Avatar of Michael Fulton
Michael Fulton
Flag for United States of America asked on

Email header shows extra IP address in the Received: section

Email Header analyzing.  
I am going through suspected phishing emails to verify that they are phishing and then find a way to block them since they were not already blocked.
Normally pretty straight forward approach.
I have one that has me baffled though with the analyzation portion.  I have attached the header.

I use two different sites to analyze the header;
https://mxtoolbox.com/
and
https://mha.azurewebsites.net

The question I have is in regards to the "Reeceived headers" section.  The first line reported by both of the above sites.
ON MXToolbox it shows the from as "server.curaduria2bogota.com.co 200.68.9.186"
On the Azure it shows a little more information "[200.68.9.186] (port=11638 helo=[192.3.24.36])"

So the question I have is what does this other IP tell me?  The 192.3.24.36.  The header says:
Received: from [200.68.9.186] (port=11638 helo=[192.3.24.36])       by
 server.curaduria2bogota.com.co

But the address of server.curaduria2bogota.com.co is 108.179.210.71 not that 192 address.

Looking for someone smarter than me for input on this.

thank you!
* scam emailsAzure* Email Header

Avatar of undefined
Last Comment
Michael Fulton

8/22/2022 - Mon
David Favor

Likely you can simply tighten your SPF rejection settings, so some From: address server.curaduria2bogota.com.co has no SPF authentication to send, can be bounced during the initial SMTP conversation, when message's first delivery is attempted.
Michael Fulton

ASKER
I understand that.  we have some odd things on this end that currently are preventing making it too tight.

But the question I have is about that address.  Could it be they are using a VPN tunnel and that is their original IP?  I don't know.  That is why I am asking this.
ASKER CERTIFIED SOLUTION
Michael Fulton

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes