I am currently analysing an outlook email header.
I am very confused because it has two ipv4 addresses x-originating from different locations. Usually there is an ipv4 towards the top of the header and an ipv6 towards the bottom.
the emails were sent to me and I need to determine which emails were sent by a hacker by IP tracing
Could you possibly give me advice on why I would see two different ipv4 from different hosts and different locations in an outlook header when I’m meant to see one ipv4 and one ipv6?
would any vulnerability or attack cause this ?
X-Originating-IP: [22.214.171.124] X-SpamReason: No, hits=0.3 required=7.0 tests=HTML_60_70,HTML_MESSAGE X-StarScan-Received: X-StarScan-Version: 9.9.15; banners=-,-,- X-VirusChecked: Checked Received: Received: from mail-eopbgr60122.outbound.protection.outlook.com (HELO EUR04-DB3-obe.outb server-7.tower-with AES256-GCM-SHA384 encrypted SMTP; 13 Sep 2018 14:47:44 -0000 Received: from DB6PR07MB3286.eurprd07.prod.outlook.com (10.175.233.33) by DB6PR07MB3384.eurprd07.prod.outlook.com (10.175.234.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1143.11; Thu, 13 Sep 2018 14:47:44 +0000 Received: from DB6PR07MB3286.eurprd07.prod.outlook.com ([fe80::ccea:aa3a:fbcf:883f]) by DB6PR07MB3286.eurprd07.prod.outlook.com ([fe80::ccea:aa3a:fbcf:883f%6]) with mapi id 15.20.1164.0 14:47:44 +0000 From: To: Subject: Re: Thread-Topic: O Thread-Index: AQHUS2XPliaNQXagG0e1Tro6EyKodqTuSn9k Date Message-ID: References: In-Reply-To: < Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [126.96.36.199]