can one tr=ell where an email originates from?

Post your questions about tracing the source IP address of an email here.
New Member
Posts: 1
Joined: Sun Dec 11, 2016 11:16 am

can one tr=ell where an email originates from?

Post by aspencherub » Sun Dec 11, 2016 11:23 am

Return-Path: {removed}
Received: from (LHLO ( by with LMTP; Sun, 17 Apr 2016 11:15:15 +0000
Received: from ([])
by comcast with SMTP
id rkaqaloZ0vNbdrkfbaDgAO; Sun, 17 Apr 2016 11:15:15 +0000
Received: from ([])
by with comcast
id jPFF1s03C11RrXD01PFFCG; Sun, 17 Apr 2016 11:15:15 +0000
X-CAA-SPAM: N00000
X-Authority-Analysis: v=2.1 cv=QKaVPV/L c=1 sm=1 tr=0
a=S41bZ1Dlwh+8bxorBcDYYQ==:117 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10
a=s5jvgZ67dGcA:10 a=xqWC_Br6kY4A:10 a=kziv93cY1bsA:10
a=klaHyzbkpz2phxsXNOQA:9 a=wPNLvfGTeEIA:10 a=T8o9m6ilJmah9XTB:21
a=_W_S_7VecoQA:10 a=frz4AuCg-hUA:10
dkim=pass header.b=mok6JlOT
Received: from ([]) by over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008);
Sun, 17 Apr 2016 04:15:15 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;;
s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version;
Received: from
( by
( with Microsoft SMTP Server (TLS) id 15.1.472.8; Sun, 17 Apr
2016 11:15:13 +0000
Received: from ( by ( with Microsoft SMTP
Server (TLS) id 15.1.472.8 via Frontend Transport; Sun, 17 Apr 2016 11:15:13
Received: from
([fe80::d955:81c2:1484:8621]) by
([fe80::d955:81c2:1484:8621%16]) with mapi id 15.01.0453.031; Sun, 17 Apr
2016 11:15:13 +0000
From: fabio branchini <{removed}>
To: jo-ann <{removed}>
Subject: You Make Me Happy
Thread-Topic: You Make Me Happy
Thread-Index: AQHRmJpphzhAIUQQckSmY1f+6O+lRA==
Date: Sun, 17 Apr 2016 11:15:13 +0000
Message-ID: <[email protected]>
References: <[email protected]>,<[email protected]>
In-Reply-To: <[email protected]>
Accept-Language: en-US
Content-Language: en-US
authentication-results: spf=softfail (sender IP is;; dkim=none (message not signed)
header.d=none;; dmarc=fail action=none;
received-spf: SoftFail ( domain of transitioning discourages use of as permitted sender)
x-tmn: [0OWV07bCSmsW5Nh6dEK+AVArK4wOGJlcR+YtD0zyIvY=]
x-eopattributedmessage: 0
x-forefront-antispam-report: CIP:;IPV:NLI;CTRY:GB;EFV:NLI;SFV:NSPM;SFS:(10019020)(98900003);DIR:OUT;SFP:1102;SCL:1;SRVR:DB5EUR01HT086;;FPR:;SPF:SoftFail;MLV:ovrnspm;MX:1;A:1;LANG:en;
x-ms-office365-filtering-correlation-id: 9a755a2a-a408-44f1-98a8-08d366b18c5f
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(5061506196)(5061507196);SRVR:DB5EUR01HT086;
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(432015012)(82015046);SRVR:DB5EUR01HT086;BCL:0;PCL:0;RULEID:;SRVR:DB5EUR01HT086;
x-forefront-prvs: 0915875B28
Content-Type: multipart/alternative;
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Apr 2016 11:15:13.8597
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5EUR01HT086
Return-Path: {removed}
X-OriginalArrivalTime: 17 Apr 2016 11:15:15.0342 (UTC) FILETIME=[6ABA12E0:01D1989A]

Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

If I could put into words how you make me feel when I think of you, and how=
much you excite me when I hear your sweet voice, I would be talking foreve=
r. You're all that I need and want,Honey. I live for the day that I can sit=
next to you and whisper into your ear and tell you that I love you, and ki=
ss you ever so lightly, but passionately on your lips, and to look into you=
r beautiful eyes as you take my breath away. I live for that first look int=
o your eyes, that first passionate kiss, that first embrace, and that first=
time that we make love together. I live to love, to spend a lifetime with =
you as your man and to grow old with you, loving you for all time..

Last edited by Chrispcritters on Mon Dec 12, 2016 3:29 pm, edited 1 time in total.
Reason: Removed email addresses and removed duplicated HTML content.

User avatar
Forum Administrator
Posts: 2538
Joined: Tue Mar 02, 2010 5:41 pm
Location: | ::1

Re: can one tr=ell where an email originates from?

Post by Chrispcritters » Mon Dec 12, 2016 3:26 pm

Unfortunately the sender's IP address is not included in the headers. (There is a suspect reference to but I believe that's a forged header).

Based on the content of the email I suspect this is a romance scam. If someone you've never met in person, and only chatted/skyped with for a short period of expresses such feelings you should trust your gut (which is probably why you are here digging into this guy) and assume it's a scam. At some point they will ask for money.

Would you be so kind as to share some of this persons' story with us, why you can't currently meet them in person, and why you were suspicious of them?
Founder & CEO of
You can follow me on Twitter and Facebook for some behind the scenes info.


Who is online

Users browsing this forum: No registered users and 13 guests