Page 1 of 1

Want to know whether the email originated from the domain in from address

Posted: Thu Jan 04, 2018 9:55 pm
by geethac
Please help to know whether the email is originated from the domain in from address.

----
Return-path: <[email protected]>
Received: from esadelsp05.nic.in ([192.168.1.243]) by msgfe35.nic.in (Oracle Communications Messaging Server 7.0.5.38.0 64bit (built Nov 28 2016)) with ESMTP id <[email protected]> for [email protected]; Thu, 04 Jan 2018 12:22:26 +0530 (IST)
Received: from mail-bl2nam02on0062.outbound.protection.outlook.com (HELO NAM02-BL2-obe.outbound.protection.outlook.com) ([104.47.38.62]) by relayinsp04.nic.in with ESMTP/TLS/AES256-SHA256; 04 Jan 2018 12:16:29 +0530
Received: from DM5PR0701MB3653.namprd07.prod.outlook.com (10.167.109.141) by DM5PR0701MB3656.namprd07.prod.outlook.com (10.167.109.144) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.386.5; Thu, 4 Jan 2018 06:46:05 +0000
Received: from DM5PR0701MB3653.namprd07.prod.outlook.com ([fe80::549a:e0ca:24f8:cad1]) by DM5PR0701MB3653.namprd07.prod.outlook.com ([fe80::549a:e0ca:24f8:cad1%13]) with mapi id 15.20.0386.00
Thu, 4 Jan 2018 06:27:22 +0000
Received-SPF: None (protection.outlook.com: hms.harvard.edu does not designate permitted sender hosts)
Date: Thu, 04 Jan 2018 06:27:22 +0000
From: "Goldberg, Alfred L." <[email protected]>
Subject: Fw: Dr. Sudarshan Reddy and Oncosimis
In-reply-to: <[email protected]7.prod.outlook.com>
X-Originating-IP: [2601:19b:a00:8e7d:751c:b070:f7f7:cb49]
To: "[email protected]" <[email protected]>
Message-id: <[email protected]7.prod.outlook.com>
MIME-version: 1.0
Content-type: multipart/alternative; boundary=_000_DM5PR0701MB36536095DE71C54097DB857CD71F0DM5PR0701MB3653_
Content-language: en-US
Accept-Language: en-US
Thread-topic: Dr. Sudarshan Reddy and Oncosimis
Thread-index: AQHThSOcxc0mMfMoaEOxGGNtBMtL1KNjP1jj
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0GgAQDcx01ahzcgL2haAx4BBgyCSiIjLIFOBAsnjymNSoNIlkGCAQEJhTsChHMUAQEBAQEBAQEBAxABAQEIDQkIKCQLhSUDA2wGAQMTAgEIRjIbCgIEGwwFiTFkAQSmLAKOIIgWB4IhAQEBBwEBAQEBAQEBIIQTggGDUIIgGEA2gzCBNjofJoMBgjQFikyJSY8uEwKBOqgBk1yDAgICAgIJAhEBAQeBPDaBcnGCeYJUEAyBZ3iGPSyCHAEBAQ
X-IPAS-Result: A0GgAQDcx01ahzcgL2haAx4BBgyCSiIjLIFOBAsnjymNSoNIlkGCAQEJhTsChHMUAQEBAQEBAQEBAxABAQEIDQkIKCQLhSUDA2wGAQMTAgEIRjIbCgIEGwwFiTFkAQSmLAKOIIgWB4IhAQEBBwEBAQEBAQEBIIQTggGDUIIgGEA2gzCBNjofJoMBgjQFikyJSY8uEwKBOqgBk1yDAgICAgIJAhEBAQeBPDaBcnGCeYJUEAyBZ3iGPSyCHAEBAQ
X-IronPort-AV: E=McAfee;i="5900,7806,8763"; a="107785822"
X-IronPort-AV: E=Sophos;i="5.45,506,1508783400"; d="scan'208,217";a="107785822"
X-Amp-Result: SKIPPED(no attachment in message)
X-Amp-File-Uploaded: False
X-MGA-submission: MDHlssqWXNrg0k1oCiN+CoYOR1B45jaPnfq6vugYes4Ip9vlycF4r6vxGJz3uVuNye7u2/mPni9pGJrIW8jw/oSyvecG+nyLaQq4yTTwwHcWoU1DrsLAd1kFFC1TTSyjilI=
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;DM5PR0701MB3655;7:4XAS2Kk+wSpKz1RnF+QPvsO0B9RTSjyJKVaujHquaM+kbKqTkUfh6YtbnuVw52bPFlqW4k1Lz51z5EimyOOFHOgYjYmsIZUMndLxv3O64ggw4rtC7nOJkFVdwdRBF1HyFcdSZ4AzIL26S5O6OK0c/WIKUBwRgYt+wy7kwgWbzXIWrvftQ6p9OEYL7QAw+QaScDTC3fIKl07yqFtgls8hvWZiVJJlb5tUnSgrFdaITk8Yeu6M1cCdLc/upohIz50R
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-correlation-id: 0b7c1792-2ac9-40f0-c3de-08d5533c36e0
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(5600026)(4604075)(3008032)(2017052603307)(7153060);SRVR:DM5PR0701MB3655;
x-ms-traffictypediagnostic: DM5PR0701MB3655:
x-microsoft-antispam-prvs: <[email protected]7.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(278428928389397)(72170088055959)(12901024606220);
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(6040470)(2401047)(8121501046)(5005006)(3002001)(3231023)(944501075)(10201501046)(93006095)(93001095)(6041268)(20161123564045)(20161123558120)(20161123560045)(20161123562045)(201703131423095)(201702281529075)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)
(201708071742011);SRVR:DM5PR0701MB3655;BCL:0;PCL:0;RULEID:(100000803101)(100110400095);SRVR:DM5PR0701MB3655;
x-forefront-prvs: 054231DC40
x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(39860400002)(376002)(396003)(39380400002)(366004)(346002)(189003)(199004)(14454004)(3280700002)(81166006)(3660700001)(1730700003)(81156014)(86362001)(2900100001)(2906002)(229853002)(5250100002)(8676002)(2940100002)(88552002)(6116002)(478600001)(53936002)(102836004)(25786009)(7736002)(2351001)(5640700003)(733005)(316002)(6606003)(76176011)(2473003)(55016002)(8936002)(19627405001)(6436002)(75432002)(33656002)(68736007)(106356001)(786003)(5660300001)(59450400001)(54896002)(9686003)(97736004)(105586002)(99286004)(2950100002)(74316002)(6916009)(6506007)(2501003)(42882006)(7696005);DIR:OUT;SFP:1101;SCL:1;SRVR:DM5PR0701MB3655;H:DM5PR0701MB3653.namprd07.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en;
x-microsoft-antispam-message-info: 0lI2G6Qgecs2VEJReQimcQFaZq5WxUbhqMFA+IXSHi1Qo4WEWa+PunC3Kyd1UF+njfYJAsL/NwaItDm5BA4NXw==
X-OriginatorOrg: hms.harvard.edu
X-MS-Exchange-CrossTenant-Network-Message-Id: 0b7c1792-2ac9-40f0-c3de-08d5533c36e0
X-OriginatorOrg: hms.harvard.edu
X-MS-Exchange-CrossTenant-Network-Message-Id: 0b7c1792-2ac9-40f0-c3de-08d5533c36e0
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Jan 2018 06:27:22.6125 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 6ffa22f4-4568-4105-ad43-2e3ad4726957
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR0701MB3655
References: <[email protected]7.prod.outlook.com>
Authentication-results: spf=none (sender IP is ) smtp.mailfrom=[email protected];
Original-recipient: rfc822;[email protected]
----------------------

thanks Geetha

Re: Want to know whether the email originated from the domain in from address

Posted: Mon Jan 08, 2018 3:24 am
by geethac
please help to trace the source of email.

Re: Want to know whether the email originated from the domain in from address

Posted: Mon Jan 08, 2018 9:44 am
by lisati

Re: Want to know whether the email originated from the domain in from address

Posted: Sat Jan 13, 2018 4:08 am
by ANNOR-ELVIS NIKITINS
Step (Gmail)
1. Open the email sender you want to trace
2. Click of the "reply arrow downward beside the reply arrow" then click of "Show original"
3. Click on download original
4. Open and copy from the first Return-Path "Return-Path:...." to the first "Content-Transfer-Encoding:......"
5. Paste it in the "Trace Email Analyzer" then click on find email sender
6. Click on the IP Address under the source.
Then that is all
Thank you