Decipher outlook email headder

[mickmcpaddy]

I have just got an email from someone enquiring about some work but I think its a scam, I have viewed the message source but it doesn't make a lot of sense to me.

The email if from a gmail address so hardly a professional setup and in the many many lines of text in the headers is this.

Authentication-Results: spf=pass (sender IP is 209.85.192.195) when you look it up it originates from the USA in California, Mountain view or something, is this not Googles headquarters and just what the email is routed through?

I just use outlook.live to view my emails.

[eltawater]

Yup.

Whois IP 209.85.192.195Updated 2 days ago

2. ARIN WHOIS data and services are subject to the Terms of Use
3. available at: https://www.arin.net/whois_tou.html
5. If you see inaccuracies in the results, please report at
6. https://www.arin.net/public/whoisinaccuracy/index....

2. The following results may also be obtained via:
3. https://whois.arin.net/rest/nets;q=209.85.192.195?...

NetRange: 209.85.128.0 - 209.85.255.255
CIDR: 209.85.128.0/17
NetName: GOOGLE
NetHandle: NET-209-85-128-0-1
Parent: NET209 (NET-209-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Google LLC (GOGL)
RegDate: 2006-01-13
Updated: 2012-02-24
Ref: https://whois.arin.net/rest/net/NET-209-85-128-0-1


OrgName: Google LLC
OrgId: GOGL
Address: 1600 Amphitheatre Parkway
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US
RegDate: 2000-03-30
Updated: 2017-12-21
Ref: https://whois.arin.net/rest/org/GOGL


OrgAbuseHandle: ABUSE5250-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: [phone]
OrgAbuseEmail: [e-mail]
OrgAbuseRef: https://whois.arin.net/rest/poc/ABUSE5250-ARIN

OrgTechHandle: ZG39-ARIN
OrgTechName: Google LLC
OrgTechPhone: [phone]
OrgTechEmail: [e-mail]
OrgTechRef: https://whois.arin.net/rest/poc/ZG39-ARIN

2. ARIN WHOIS data and services are subject to the Terms of Use
3. available at: https://www.arin.net/whois_tou.html
5. If you see inaccuracies in the results, please report at
6. https://www.arin.net/public/whoisinaccuracy/index....

[mickmcpaddy]

How do you find out who actually sent the email then from the headers?

[eltawater]

Email headers record the trace as the email is passed from one email system to another.

In this instance, the originating email system IS gmail, as you can use the web interface to send emails. The web interface does not pass on the original machine on which a web browser was used to send the email. You'd most likely need to contact Google themselves to dig further, although that may simply go as far as the proxy server for a mobile provider.

Look further down the header list until just before the From: header and you may see this which is a giveaway that the email was sent via the web interface.

X-Received: by 10.107.11.130 with SMTP id 2mr6125140iol.80.1516568644644; Sun, 21 Jan 2018 13:04:04 -0800 (PST)
MIME-Version: 1.0
Received: by 10.107.143.194 with HTTP; Sun, 21 Jan 2018 13:04:04 -0800 (PST)

Edited by eltawater on Sunday 21st January 21:14

[mickmcpaddy]

It says something similar, slighly different IP address and code but is -8hrs etc.

Would it be likely that an email sent from a person in the UK to another person in the UK would be routed via California though?

I'm pretty confident its ascam email and don't want to reply in case I get obliterated with spam but at the same time don't want to lose a decent in the unlikely event its not a scam.

Thanks.

[eltawater]

The ip addresses are registered to the company in California, there's no link between that and where the email sender / recipient are based.

[Harpoon]

https://testconnectivity.microsoft.com/MHA/Pages/m...

Handy MS site - will take the whole message header and break the routing down into a table to make it easy to read.

SSL certificate is is expired on the site at the moment though (tut tut MS)

[dmsims]

or

https://www.ip2location.com/free/email-tracer

[Vaud]

You could always set up a "burner" gmail address of your own and reply using that? Just add a footer that says you are on holiday and it had been autoforwarded, etc. You can then qualify if it's a scam and revert to your work address if not. If scam then delete the account.