Tracing Spam/Scam Emails

[soapyfish]

Hi Everyone,

 

We have received a few emails recently, where the return address that is normally in the email header has been changed to appear to have come from an internal email address. Is there anyway of being able to trace this back to the true originating email address we use Office 365 for our email system. I have been able to locate the senders IP address which resolves to 45-161-238-34.giganet.net.py which looks to be an ISP based in Latin America according to some whois tools. Or is someone able to confirm that its untraceable it would save me some time !

 

Thanks

[tosh74]

you could copy the email headers into this https://mxtoolbox.com/EmailHeaders.aspx this will show you the whole journey

[soapyfish]

Thanks, I tried that but it just shows the same info as the header but in a much clearer format.

[andy_b]

All you can go off is the headers.

 

It's easy enough to spoof the addresses, which is why we have SPF/DKIM/DMARC.