GPEN · Question #149
You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information
The correct answer is D. 216.168.54.25. Email headers contain a chain of 'Received' fields that trace the path of a message. The originating sender IP is found in the last externally-added 'Received: from' header or the 'X-Originating-IP' field.
Question
You work as a Network Security Analyzer. You got a suspicious email while working on a forensic project. Now, you want to know the IP address of the sender so that you can analyze various information such as the actual location, domain information, operating system being used, contact information, etc. of the email sender with the help of various tools and resources. You also want to check whether this email is fake or real. You know that analysis of email headers is a good starting point in such cases. The email header of the suspicious email is given below:
What is the IP address of the sender of this email?
Exhibit
Options
- A172.16.10.90
- B209.191.91.180
- C141.1.1.1
- D216.168.54.25
How the community answered
(25 responses)- A4% (1)
- B12% (3)
- C4% (1)
- D80% (20)
Why each option
Email headers contain a chain of 'Received' fields that trace the path of a message. The originating sender IP is found in the last externally-added 'Received: from' header or the 'X-Originating-IP' field.
172.16.10.90 is a private RFC 1918 address belonging to an internal network segment, not a routable internet sender IP.
209.191.91.180 is an intermediate mail relay or receiving server address found in a later 'Received' hop, not the originating sender.
141.1.1.1 appears in the header as another intermediary relay address and not the address of the original message sender.
216.168.54.25 is the IP address identified in the 'X-Originating-IP' or the earliest external 'Received: from' field in the email header, which represents the machine that first injected the message into the mail transfer chain. Reading headers from bottom to top reveals the true origin before any relay servers added their own 'Received' stamps. This is the standard forensic method for tracing the actual sender's IP address.
Concept tested: Email header forensics - tracing originating sender IP
Source: https://datatracker.ietf.org/doc/html/rfc5321#section-4.4
Topics
Community Discussion
No community discussion yet for this question.