Two different IPV4 inside outlook email header

Question

I am currently analysing an outlook email header.

I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header and an ipv6 towards the bottom.

the emails were sent to me and I need to determine which emails were sent by a hacker by IP tracing

Could you possibly give me advice on why I would see two different ipv4 from different hosts and different locations in an outlook header when I’m meant to see one ipv4 and one ipv6?

would any vulnerability or attack cause this ?

X-Originating-IP: [40.107.6.122]
X-SpamReason: No, hits=0.3 required=7.0 tests=HTML_60_70,HTML_MESSAGE
X-StarScan-Received:
X-StarScan-Version: 9.9.15; banners=-,-,-
X-VirusChecked: Checked
Received:
Received: from mail-eopbgr60122.outbound.protection.outlook.com (HELO
 EUR04-DB3-obe.outb
 server-7.tower-with AES256-GCM-SHA384 encrypted SMTP; 13
 Sep 2018 14:47:44 -0000
Received: from DB6PR07MB3286.eurprd07.prod.outlook.com (10.175.233.33) by
 DB6PR07MB3384.eurprd07.prod.outlook.com (10.175.234.11) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.1143.11; Thu, 13 Sep 2018 14:47:44 +0000
Received: from DB6PR07MB3286.eurprd07.prod.outlook.com
 ([fe80::ccea:aa3a:fbcf:883f]) by DB6PR07MB3286.eurprd07.prod.outlook.com
 ([fe80::ccea:aa3a:fbcf:883f%6]) with mapi id 15.20.1164.0
 14:47:44 +0000
From: 
To: 
Subject: Re: 
Thread-Topic: O
Thread-Index: AQHUS2XPliaNQXagG0e1Tro6EyKodqTuSn9k
Date
Message-ID: 
References: 
In-Reply-To: <
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [84.9.167.97]

Answer 1

Why you see two addresses:

Whenever you send an email, your email passes through several different servers before it reaches its destination. Along the way, some servers may add certain text to the headers of the email (email headers include data such as who the message is to/from). For example, your Internet Service Provider (such as Comcast or AT&T) may add to the headers the time they received the email from you. The final server accepting the email may scan to check if the email spam, and it may add a summary of this scan to the headers.

IP addresses are also added to your email's headers. For example, your home/office ip address may be added to the email. The mail server at your ISP that initially accepts your email may add their IP address, and the final server accepting the message may log their IP address as well.

Source

Would any vulnerability or attack cause this:

It's a bit too broad question; but as usual, the answer should be: It depends.
As pointed out by other community members, you should investigate the headers.

Answer 2

Do not trust the headers from any other source than you own servers. They can be spoofed at any point and additional details could have been added.

Investigate Received headers from the top: the headers added by your own email system do have the actual IP address the message was received from. This is the reason why any server forwarding the message to another should add its own additional headers to the top of the message.

Here, the X-Originating-IP: [40.107.6.122] is added by server-7.tower-with when it received the mail from *.protection.outlook.com. This means the message came from Microsoft Office 365. Inside Office 365 it has traveled through several servers using IPv6.

The x-originating-ip: [84.9.167.97] might be part of the original message headers and may have been spoofed altogether.

Email header usually has an ipv4 originating and a ipv6 like this so I would of thought it would be same or similar.

X-Originating-IP: [40.107.7.115]
x-originating-ip: [2a00:23c2:341b:ab01:d0b:b7eb:1115:dff2]

While any computer may have both IPv4 and IPv6 connectivity, and it can send the message forward to the next SMTP server using either one, it can never use both at the same time. That's why only one can be recorded by a receiving SMTP server. Your example doesn't imply that [40.107.7.115] and [2a00:23c2:341b:ab01:d0b:b7eb:1115:dff2] are IPv4 and IPv6 addresses of the same machine. You see both forms within the Received headers, because the message travels trough several servers i.e. trough several different connections that can use either IPv4 or IPv6. The only trustworthy place for X-Originating-IP is next to the Received header your own server adds.

Answer 3

Like Esa Jokinen explained: every mailserver can add headers. Usually that are added to the top, but it can inject those headers at any desired position. In fact: the mailserver can even modify the existing headers it received and even the email body!

This is why one should use DKIM, with DKIM the body and (most of the) headers are signed by the sender, thus allowing you to validate the headers included in the signature. Any headers which are not included in the DKIM signature should not be trusted as they might have been injected by another mailserver.

I believe this is also why large mailproviders like Gmail and Office365 are adopting ARC headers to sign the email in transit.