Page 1 of 1

please help me find who is sending me harassing emails and embarrassing me

Posted: Wed Aug 09, 2017 2:28 pm
by sherryyahya
X-Apparently-To: {removed}@yahoo.com; Tue, 08 Aug 2017 23:44:49 +0000
Return-Path: <{removed}@hotmail.com>
Received-SPF: pass (domain of hotmail.com designates 40.92.14.66 as permitted sender)
X-YMailISG: v24Jj7QWLDt9n_x2S27.GZX81kPGHlwPxRCtIzfgOi0ByVsW
uQ863ntf4vw0vW3SuXxLKA3HeSfQ7XWgCivWn9iWysUGpgDgtpw5gN76dP9H
7tLZ2XUBl5HrnfsZ9B483bj9b9dbAKKsuxhjiAN75fff6RjFUo3zqXDn3dkN
QinF79EIYHNWRTOeTRn56b5UiJ1VmYgSzMPVX87io3YH4fIE1IhWRhacE9il
gq4TC_TSjRt7SQFN7Rq3nyQd3YXCfty9ddANWQVm3RT2I7Cz9hyLbf_p0O0A
F9LfMotBFEz9RXw6LOKcCPXm4TbVarLl0c.qPJg.WLwLCR6IgwdRqEED7139
veJzcNUN7FRnxnEI7Brmpg3gTGwVroLzFdM2_Np6nOHtYbJ2M9er7GCAzo7W
I3mRheOeh5JgqiYfKUJH5LFvCH7qLVXtnwNByCPp9yhv5EXzmZu_ICXCNM6M
1pRIMThsYhNBYnUHDpYvxC.MdUrpxi4I9OpXOrM5fmKlYSrgxrNiiVxq8oH3
vFYdcuUTq3zFT..bCUkllC2s__W6ZVlFJp7_H_sgpreiJfAv6xAYBQMkA..b
VXmBVRGd3SpYUeLSGCS9zQZhdHWfeZjvyHTB2KXgndDV4pvqWC0ypAbQlYDL
n2qOy1cdpoKv4US5JZhFL1pJ5Xf3gA.opGVTavyfZzstNnHyVnaPVdtkfcjm
QVeogxPU32tv7pGlW4QLp71XlzgtOOAibLocH6CmaXnHMzD0iy7aeVfcA8MU
ziQ6AIWk7Enup4WtmZHZ.eR5DEvQ2mKT_f05PXft8Ybn1sugPcZGgVNZ._h_
RkOhqz3z5gjR9UW8332T1S4lIUQOWeARI1YAlQrBSBfGYZLpzdhkO3ntyoty
EaIyaHk8pCrsSkCuzJ6IiKSSJpLi99YngRbyNcj1xo1VBC0DcTmElr7cXAxO
RES7yQ2nUjxXh1X928Lkatrtue0BnhJ0BFAA6Xkp4rUyp3X0I3.5bZ0PmppZ
M31_msk5I0O1BxwcE5irxRqeq0ndUBMv0zE4kOGNEujGk2zIEeBm35zBEBeY
E2sKpoyKxNUiIXu.m2FNAEFiGxYCREI8Q6io3VEUmLlJvwDibQvQXUNLUrnm
YXT9s9o_egwdnQySJtsA2H0slm.mbQQ6wWDPYXYwmOBGXDmDm1ZTgigOyUkt
3Jx0eC84udMoikWnGmmA_o4ID8lpQEaUVSgX
X-Originating-IP: [40.92.14.66]
Authentication-Results: mta1420.mail.gq1.yahoo.com from=hotmail.com; domainkeys=neutral (no sig); from=hotmail.com; dkim=pass (ok)
Received: from 127.0.0.1 (EHLO NAM05-DM3-obe.outbound.protection.outlook.com) (40.92.14.66)
by mta1420.mail.gq1.yahoo.com with SMTPS; Tue, 08 Aug 2017 23:44:48 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;
s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=sg6W9QD8ZSBOjSYTrPgr8NNq2wtriMbjdxg3gT3ZSlU=;
b=HnVtE4huOYBSyqGvqs9vqaza2gNs3ppkDGguB7nwHwubI+qYU5uqAD9655yb2oQEOwjiSE6B8tIhFtGAeXlChGnOog1mdI9WOQV2PPU104i/NSva3Oj9MC9vcDjtx00VM6Eq//VSV9XZztmTe/FVPYRbHVGXMYfE0Mowh/RXMtKQ/5ei2qie8bn7G7vAug8j/z8xL8zRAE+BgF/eF4NQisSphIEKG02DQu9ihUYthKpOHj5oPCVS3GORLUmU2I2+5HESN7W+waSjrCBR/WDHarreQDA1+RGypaFqIWLucunON4thP4PbYLxF33I4KRPdKypBnahWY7z5FO5TbDek/g==
Received: from DM3NAM05FT019.eop-nam05.prod.protection.outlook.com
(10.152.98.56) by DM3NAM05HT211.eop-nam05.prod.protection.outlook.com
(10.152.99.141) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1157.20; Tue, 8
Aug 2017 23:15:02 +0000
Received: from CY4PR1201MB0072.namprd12.prod.outlook.com (10.152.98.57) by
DM3NAM05FT019.mail.protection.outlook.com (10.152.98.128) with Microsoft SMTPServer (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.1304.16 via Frontend Transport; Tue, 8 Aug 2017 23:15:02 +0000
Received: from CY4PR1201MB0072.namprd12.prod.outlook.com ([10.172.77.147]) by
CY4PR1201MB0072.namprd12.prod.outlook.com ([10.172.77.147]) with mapi id
15.01.1320.018; Tue, 8 Aug 2017 23:15:01 +0000
From: Sharon Washington <{removed}@hotmail.com>
To: "{removed}@yahoo.com" <{removed}@yahoo.com>
Subject: Re: him wit ME LOL
Thread-Topic: him wit ME LOL
Thread-Index: AQHTEJvzaeRxwKlZhEOzs62p10lwyqJ7Fr12
Date: Tue, 8 Aug 2017 23:15:01 +0000
Message-ID: <[email protected]2.prod.outlook.com>
References: <[email protected]2.prod.outlook.com>
In-Reply-To: <[email protected]2.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: yahoo.com; dkim=none (message not signed)
header.d=none;yahoo.com; dmarc=none action=none header.from=hotmail.com;
x-incomingtopheadermarker: OriginalChecksum:718551DAE5CF293A9B6081BBFBEB6586F23E581D5E0E954A5184DF09E928260A;UpperCasedChecksum:1C28B882169031E1D5EB597E122B597CDDE0ACF596FE3F2D1075E4CCBA95CF2F;SizeAsReceived:7206;Count:45
x-tmn: [V6uwX+TuvuGG7P/3EEbXvycsA/H4nSVg]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;DM3NAM05HT211;7:apVLPQay0LaORZ5zQT9Hen7mViyUiXEgprQ/w3bOY1ZGf8eadp9gGrKFHFqQPWWwmtAxcSfNwIMDplc9HfspI+SgcPvcDBf9X0FiJjoFqUiSMlcK/NHJTvC8BDsjETN26eSY0jv8FA3IAiMo2x7Hco6IB8RZZ236a90hkhxvjUSP2UOsnn5oSZtFAVH09laRYpS5C216Y0cLWo1G3EGyOZjxoNYORe596ZksdDKLfWf1jU+4lErg0N/DNgVLuMRSqcq820jpdW3Lw7Lc3mjFJ56g8lnxFQTPaKR/XE8PA1j/pq8tFJ3CrU74Q9m2wLuIIq8GkxpEjmAibVUy1IhXH+YsmhmqwrUcoTDslbSkw40pybJ2iTUebdQ1Xlf376Qqks9CzzMoMNmaRN/wFW0J3lLmSl9SEbBG/OryisxolHdrqulNmI5bqNJJ9CTc6yZCtRaE2J1guB32c1HXx/xvbJ4XrQxBSvq44Xky2Y++f12WUtC6D9DCyhqxg5AwdA21cB6H0FSLFeKC4pTD1J2lM++SAcHaOWDHfNfGN5c6jJqepRsu6DDLEmIRIE3HEWu7D8TXW0BlO53SGGl3WM5oHqnzq0ufl9K66cT1XBHesOtv82A+6ywho87ygrOQDv7MwUNcl/ZgEV/t6LJ1nk++WAISRZek5kc/8aRZcwOky9jtkqkGBxxk6kPe/FHFYct/wlLLeq7DdqsysEOeya2N8Jv9pq83Ih1kirJf/qSBr+uNoav4qghUnQeaVWe1Rw2Wsbq/HJXXn/tzERug2dGuww==
x-incomingheadercount: 45
x-eopattributedmessage: 0
x-forefront-antispam-report: EFV:NLI;SFV:NSPM;SFS:(7070007)(98901004);DIR:OUT;SFP:1901;SCL:1;SRVR:DM3NAM05HT211;H:CY4PR1201MB0072.namprd12.prod.outlook.com;FPR:;SPF:None;LANG:;
x-ms-traffictypediagnostic: DM3NAM05HT211:
x-ms-office365-filtering-correlation-id: 57523d7d-d5d4-4e0b-f6e9-08d4deb34be2
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(300000503095)(300135400095)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322274)(1603101448)(1601125374)(1701031045)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:DM3NAM05HT211;

Re: please help me find who is sending me harassing emails and embarrassing me

Posted: Thu Aug 10, 2017 12:01 am
by lisati
The best I can manage is from this line, which appears to indicate a Hotmail/Outlook user.
X-Originating-IP: [40.92.14.66]
Unfortunately, email providers don't always provide sufficient information in the headers to track down the real source beyond their own systems. This appears to have happened here.