You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information

172.16.10.90 is a private RFC 1918 address that would represent an internal network host rather than an externally routable sender IP visible in an internet email header.

209.191.91.180 is likely the IP of an intermediate relay server or mail infrastructure node added to the header at a later hop, not the originating sender.

216.168.54.25 is identified as the sender's IP because email headers are stacked chronologically with the oldest entry at the bottom, and the first 'Received: from' entry appended by the initial receiving server contains the IP of the actual sending client or mail server. Analysts trace the bottom-most untrusted 'Received' header to identify the true origin, distinguishing it from relay or infrastructure IPs added at later hops.

141.1.1.1 appears in the header as another routing or infrastructure IP added during transit, not as the original sending host's address.