Why Thunderbird has private IP address as remote host?

Question

Why Mozilla Thunderbird configured to access Yahoo IMAP server, uses a private IP address, even if there is no other device in the network. Every time, Thunderbird is restarted, it changes remote-host IP address in the range of 10.0.0.0/8. Further, the personal firewall has no log showing communication with any private IP.

Thunderbird is configured to access mailbox with following server details:

• Server Type: IMAP Mail Server
• IMAP Server: imap.mail.yahoo.com
• IMAP Port: 993
• SMTP Server: smtp.mail.yahoo.com
• SMTP Port: 465

Current entries in Thunderbird's About:Config page are as follows:

• mail.server.server1.hostname: imap.mail.yahoo.com
• mail.server.server1.serverIDResponse: ("remote-host" "10.207.128.153" "vendor" "Yahoo! Inc." "support-url" "http://help.yahoo.com/" "name" "Y!IMAP" "host" "sky200409.imap.mail.yahoo.com" "version" "1.1.15491" "via" "10.207.128.153|sky200409.mail.ne1.yahoo.com")

Commands to turn on transaction logging and Thunderbird log are as follows:

C:\>set NSPR_LOG_MODULES=IMAP:4

C:\>set NSPR_LOG_FILE=%HOMEDRIVE%\%HOMEPATH%\Desktop\Thunderbird_log.txt

C:\>start thunderbird

C:\>type Thunderbird_log.txt

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ImapThreadMainLoop entering [this=17E13000]
[(null) 8900: Main Thread]: I/IMAP 17E13000:imap.mail.yahoo.com:NA:SetupWithUrlCallback: clearing IMAP_CONNECTION_IS_OPEN
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:NA:ProcessCurrentURL: entering
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:NA:ProcessCurrentURL:imap://username%40yahoo%[email protected]:993/select%3E/INBOX:  = currentUrl
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ReadNextLine [stream=19C860B0 nb=174 needmore=0]
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:NA:CreateNewLineFromSocket: * OK [CAPABILITY IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=XOAUTH2 AUTH=OAUTHBEARER ID MOVE NAMESPACE XYMHIGHESTMODSEQ UIDPLUS LITERAL+ CHILDREN X-MSG-EXT OBJECTID] IMAP4rev1 Hello

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP Try to log in
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP IMAP auth: server caps 0x840007625, pref 0x800000000, failed 0x0, avail caps 0x800000000
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP (GSSAPI = 0x1000000, CRAM = 0x20000, NTLM = 0x100000, MSN = 0x200000, PLAIN = 0x1000, LOGIN = 0x2, old-style IMAP login = 0x4, auth external IMAP login = 0x20000000, OAUTH2 = 0x800000000)
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP Trying auth method 0x800000000
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP IMAP: trying auth method 0x800000000
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP XOAUTH2 auth
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:NA:SendData: Logging suppressed for this command (it probably contained authentication information)
[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ReadNextLine [stream=19C860B0 nb=29 needmore=0]
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:NA:CreateNewLineFromSocket: 1 OK AUTHENTICATE completed

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP login succeeded
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:A:SendData: 2 namespace

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ReadNextLine [stream=19C860B0 nb=32 needmore=0]
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:A:CreateNewLineFromSocket: * NAMESPACE (("" "/")) NIL NIL

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ReadNextLine [stream=19C860B0 nb=26 needmore=0]
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:A:CreateNewLineFromSocket: 2 OK NAMESPACE completed

[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:A:SendData: 3 ID ("name" "Thunderbird" "version" "68.7.0")

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ReadNextLine [stream=19C860B0 nb=230 needmore=0]
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:A:CreateNewLineFromSocket: * ID ("remote-host" "10.207.128.153" "vendor" "Yahoo! Inc." "support-url" "http://help.yahoo.com/" "name" "Y!IMAP" "host" "sky200409.imap.mail.yahoo.com" "version" "1.1.15491" "via" "10.207.128.153|sky200409.mail.ne1.yahoo.com")

[(null) 8900: Unnamed thread 0CFF1820]: D/IMAP ReadNextLine [stream=19C860B0 nb=19 needmore=0]
[(null) 8900: Unnamed thread 0CFF1820]: I/IMAP 17E13000:imap.mail.yahoo.com:A:CreateNewLineFromSocket: 3 OK ID completed
...

OpenSSL command and its output are as follows:

C:\>openssl.exe s_client -connect imap.mail.yahoo.com:993
Loading 'screen' into random state - done
CONNECTED(0000018C)
depth=1 /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=Sunnyvale/O=Oath Inc/CN=*.imap.mail.yahoo.com
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGcTCCBVmgAwIBAgIQCygEye2C0U/v7xEeVKBVHDANBgkqhkiG9w0BAQsFADBw
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
dXJhbmNlIFNlcnZlciBDQTAeFw0yMDAyMDEwMDAwMDBaFw0yMDA3MzAxMjAwMDBa
MGkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQHEwlT
dW5ueXZhbGUxETAPBgNVBAoTCE9hdGggSW5jMR4wHAYDVQQDDBUqLmltYXAubWFp
bC55YWhvby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCWnbWj
efcIsfHbaBvCb+VZiCSSc9BOFRGmyb+6I/IXxA9Rni+fMe/NmmMZcCu1w5+eY05g
/MgRcGg3aF0TZ8F1kBnJZi9JNjzyPKJdhgujpxtP9soWg68kEO5hGR7AuNjQWnAu
lijilem/iNLrh0P16UvzNexts0yaE/9dLAnd6t5ogpTKQE4vNQPWuSfJ5R7fwX3D
yRMPvQFubNmlGANK8xDP+z3PQhjJNC8tHYYBAIaFQN7R082pkZm2Q8/lqi8wYPpW
RuxAVKyBZ+1wANXW2AP9tHMq4Mp0hEB04xFY/zrRVV4DbSMDzSGnMG8FJIwrlwLu
qxWsVOHtTPeWfvhNAgMBAAGjggMMMIIDCDAfBgNVHSMEGDAWgBRRaP+QrwIHdTzM
2WVkYqISuFlyOzAdBgNVHQ4EFgQUSrzSm5B+fCDZAlm4BQn2rlxLkswwNQYDVR0R
BC4wLIIVKi5pbWFwLm1haWwueWFob28uY29tghNpbWFwLm1haWwueWFob28uY29t
MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
dQYDVR0fBG4wbDA0oDKgMIYuaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL3NoYTIt
aGEtc2VydmVyLWc2LmNybDA0oDKgMIYuaHR0cDovL2NybDQuZGlnaWNlcnQuY29t
L3NoYTItaGEtc2VydmVyLWc2LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAq
MCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeB
DAECAjCBgwYIKwYBBQUHAQEEdzB1MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k
aWdpY2VydC5jb20wTQYIKwYBBQUHMAKGQWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0
LmNvbS9EaWdpQ2VydFNIQTJIaWdoQXNzdXJhbmNlU2VydmVyQ0EuY3J0MAwGA1Ud
EwEB/wQCMAAwggEFBgorBgEEAdZ5AgQCBIH2BIHzAPEAdgC72d+8H4pxtZOUI5eq
kntHOFeVCqtS6BqQlmQ2jh7RhQAAAXABdCe9AAAEAwBHMEUCIFimic13zVqR95ED
/nU7vehxg9+g42CIMPegBdtdSDv6AiEA8mdyv6jRsyK8HFtMAkEr2GlatXalPeQ2
JUdDUAkvLwoAdwDwlaRZ8gDRgkAQLS+TiI6tS/4dR+OZ4dA0prCoqo6ycwAAAXAB
dCgHAAAEAwBIMEYCIQDDtgeuHX/LKtHvqajCY9syLIS/vCYL6VK4z1sKl6CaJQIh
AJru4/r8S2CPek614BZiUDuDXPQegk2WcjdJKHC/wB3bMA0GCSqGSIb3DQEBCwUA
A4IBAQAHxM4Qizm44OoqLWGdredJASuXbosEoTO8TskM8fw8iM6UfFrvKsoQhAOB
DF2mQLmO0YNMQdR9sZ9+5uIJIAoohggTRLwSiuMpeax1QyAgfLj5p/miArX8/VFK
ZzVwjFcg01flH9qzW2WUoOsoAdyf7Wz2q1Hf7PArCbAddIE0DVsp2Ypa1aae/XcB
jAgFf9Pr4IgRPj/mM18YW1I/kWIqR+QhFRxv66uHnMUIclPrxy3xd636vnwU7zMC
391HpHBhYy/SDz19dEZbbaRaMXXxLwCe3c4USrSkQf+PII4YZ6Kqw5NUkG1947Gf
mxupkktUwZ3M9skBH6gfFO1uz60I
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=Sunnyvale/O=Oath Inc/CN=*.imap.mail.yahoo.com
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
---
Acceptable client certificate CA names
/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - EC1
/C=US/O=SecureTrust Corporation/CN=SecureTrust CA
/C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 2 G3
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4
/C=US/O=GeoTrust Inc./CN=GeoTrust Primary Certification Authority
/C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2
/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network
/C=TW/O=Chunghwa Telecom Co., Ltd./OU=ePKI Root Certification Authority
/C=US/O=AffirmTrust/CN=AffirmTrust Commercial
/C=PL/O=Unizeto Technologies S.A./OU=Certum Certification Authority/CN=Certum Trusted Network CA
/C=US/OU=www.xrampsecurity.com/O=XRamp Security Services Inc/CN=XRamp Global Certification Authority
/C=FI/O=Sonera/CN=Sonera Class2 CA
/C=US/O=GeoTrust Inc./OU=(c) 2007 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G2
/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO ECC Certification Authority
/C=US/O=Internet Security Research Group/CN=ISRG Root X1
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
/C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA
/OU=GlobalSign Root CA - R3/O=GlobalSign/CN=GlobalSign
/C=IE/O=Baltimore/OU=CyberTrust/CN=Baltimore CyberTrust Root
/C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Thawte Certification/CN=Thawte Timestamping CA
/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services
/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
/C=EU/O=AC Camerfirma SA CIF A82743287/OU=http://www.chambersign.org/CN=Chambers of Commerce Root
/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3
/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
/C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Object
/C=US/O=AffirmTrust/CN=AffirmTrust Networking
/C=US/O=AffirmTrust/CN=AffirmTrust Premium
/C=LU/O=LuxTrust s.a./CN=LuxTrust Global Root
/C=US/O=GeoTrust Inc./OU=(c) 2008 GeoTrust Inc. - For authorized use only/CN=GeoTrust Primary Certification Authority - G3
/C=LU/O=LuxTrust S.A./CN=LuxTrust Global Root 2
/C=EU/L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287/O=AC Camerfirma S.A./CN=Chambers of Commerce Root - 2008
/C=CH/O=SwissSign AG/CN=SwissSign Silver CA - G2
/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA
/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
/C=DE/O=T-Systems Enterprise Services GmbH/OU=T-Systems Trust Center/CN=T-TeleSec GlobalRoot Class 3
/C=US/ST=CA/L=Sunnyvale/O=Oath Inc./OU=us-east-1/CN=Athenz AWS CA
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G3
/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA
/C=CH/O=SwissSign AG/CN=SwissSign Platinum CA - G2
/C=US/ST=CA/L=Sunnyvale/O=Yahoo! Inc./OU=Athenz Tcv/CN=Yahoo Athenz CA
/OU=GlobalSign ECC Root CA - R5/O=GlobalSign/CN=GlobalSign
/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Root Certificate Authority - G2
/C=US/O=IdenTrust/CN=IdenTrust Public Sector Root CA 1
/O=Entrust.net/OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Certification Authority (2048)
/O=TeliaSonera/CN=TeliaSonera Root CA v1
/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./CN=Go Daddy Root Certificate Authority - G2
/C=US/ST=CA/L=Sunnyvale/O=Yahoo! Inc./OU=Athenz Bfv/CN=Yahoo Athenz CA
/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2007 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G4
/C=US/O=Entrust, Inc./OU=www.entrust.net/CPS is incorporated by reference/OU=(c) 2006 Entrust, Inc./CN=Entrust Root Certification Authority
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root G2
/OU=GlobalSign Root CA - R6/O=GlobalSign/CN=GlobalSign
/C=US/O=Amazon/CN=Amazon Root CA 4
/C=PL/O=Unizeto Sp. z o.o./CN=Certum CA
/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Qualified CA Root
/O=Digital Signature Trust Co./CN=DST Root CA X3
/C=NO/O=Buypass AS-983163327/CN=Buypass Class 2 Root CA
/C=DE/O=D-Trust GmbH/CN=D-TRUST Root Class 3 CA 2 EV 2009
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root G3
/C=CH/O=SwissSign AG/CN=SwissSign Gold CA - G2
/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust ECC Certification Authority
/C=US/O=IdenTrust/CN=IdenTrust Commercial Root CA 1
/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 2
/C=DE/O=D-Trust GmbH/CN=D-TRUST Root Class 3 CA 2 2009
/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 1 G3
/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority
/C=US/O=VeriSign, Inc./OU=Class 2 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network
/C=US/ST=CA/L=Sunnyvale/O=Oath Inc./OU=us-west-2/CN=Athenz AWS CA
/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign
/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 3
/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
/C=US/O=Amazon/CN=Amazon Root CA 3
/C=BM/O=QuoVadis Limited/CN=QuoVadis Root CA 3 G3
/C=IT/L=Milan/O=Actalis S.p.A./03358520967/CN=Actalis Authentication Root CA
/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
/C=US/ST=CA/L=Sunnyvale/O=Yahoo! Inc./OU=Athenz Gqv/CN=Yahoo Athenz CA
/C=BM/O=QuoVadis Limited/OU=Root Certification Authority/CN=QuoVadis Root Certification Authority
/C=NO/O=Buypass AS-983163327/CN=Buypass Class 3 Root CA
/C=US/O=thawte, Inc./OU=(c) 2007 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G2
/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2008 VeriSign, Inc. - For authorized use only/CN=VeriSign Universal Root Certification Authority
/C=US/O=Amazon/CN=Amazon Root CA 1
/C=SE/O=AddTrust AB/OU=AddTrust TTP Network/CN=AddTrust Class 1 CA Root
/C=US/O=Amazon/CN=Amazon Root CA 2
/OU=GlobalSign ECC Root CA - R4/O=GlobalSign/CN=GlobalSign
/C=EU/L=Madrid (see current address at www.camerfirma.com/address)/serialNumber=A82743287/O=AC Camerfirma S.A./CN=Global Chambersign Root - 2008
/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3
/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO RSA Certification Authority
/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/[email protected]
/C=US/O=AffirmTrust/CN=AffirmTrust Premium ECC
/C=DE/O=T-Systems Enterprise Services GmbH/OU=T-Systems Trust Center/CN=T-TeleSec GlobalRoot Class 2
/C=FR/O=KEYNECTIS/OU=ROOT/CN=KEYNECTIS ROOT CA
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root G2
---
SSL handshake has read 14635 bytes and written 334 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: B6A12EE7D6176A8153AD2FAC48AAF42AC807A46F5D0CFDDF3A245D2563721453
    Session-ID-ctx:
    Master-Key: B6E7F2FFB97641A0B01090BBDBDBB9479F90A48FE57BF00A12D11E08AB45C257A9103511688A02BAE43FF9CC8B11012D
    Key-Arg   : None
    Start Time: 1587454492
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
* OK [CAPABILITY IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=XOAUTH2 AUTH=OAUTHBEARER ID MOVE NAMESPACE XYMHIGHESTMODSEQ UIDPLUS LITERAL+ CHILDREN X-MSG-EXT OBJECTID] IMAP4rev1 Hello
0 id nil
* ID ("remote-host" "157.38.18.225" "vendor" "Yahoo! Inc." "support-url" "http://help.yahoo.com/" "name" "Y!IMAP" "host" "sky700046.imap.mail.yahoo.com" "version" "1.1.15491")
0 OK ID completed

I have no Socks or SSL/TLS proxy installed. Only a personal firewall with HIPS support is there. Therefore, traffic from both applications (Thunderbird, and OpenSSL) is passing through the personal firewall.

Further, there is not much information available on Web about Thunderbird's mail.server.server1.serverIDResponse parameter, value of which keeps changing everytime Thunderbird starts and connects to Yahoo!.

As per RFC 2971 (IMAP4 ID extension) https://www.rfc-editor.org/rfc/rfc2971

The ID extension to the Internet Message Access Protocol - Version 4rev1 (IMAP4rev1) protocol allows the server and client to exchange identification information on their implementation in order to make bug reports and usage statistics more complete.
...
5. Use of the ID extension with Firewalls and Other Intermediaries

There exist proxies, firewalls, and other intermediary systems that can intercept an IMAP session and make changes to the data exchanged in the session. Such intermediaries are not anticipated by the IMAP4 protocol design and are not within the scope of the IMAP4 standard.

However, in order for the ID command to be useful in the presence of such intermediaries, those intermediaries need to take special note of the ID command and response. In particular, if an intermediary changes any part of the IMAP session it must also change the ID command to advertise its presence.

A firewall MAY act to block transmission of specific information fields in the ID command and response that it believes reveal information that could expose a security vulnerability. However, a firewall SHOULD NOT disable the extension, when present, entirely, and SHOULD NOT unconditionally remove either the client or server list.

Finally, it should be noted that a firewall, when handling a CAPABILITY response, MUST NOT allow the names of extensions to be returned to the client that the firewall has no knowledge of.

Am I victim of Man-in-the-Middle attack, caused by the Home WiFi Router? I want to be sure that private IP address in the range of 10.0.0.0/8 have indeed been supplied by Yahoo!, and not by my WiFi Router.

Answer 1

The information you see here are self-reported by the mail server, i.e.:

$ openssl s_client -connect imap.mail.yahoo.com:993
...
* OK [CAPABILITY IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=XOAUTH2 AUTH=OAUTHBEARER ID MOVE NAMESPACE XYMHIGHESTMODSEQ UIDPLUS LITERAL+ CHILDREN X-MSG-EXT OBJECTID] IMAP4rev1 Hello
0 id nil
* ID ("remote-host" "a.b.c.d" "vendor" "Yahoo! Inc." "support-url" "http://help.yahoo.com/" "name" "Y!IMAP" "host" "sky700086.imap.mail.yahoo.com" "version" "1.1.15491")

The remote-host is the client IP address from the perspective of the mail server. As Esa Jokinen pointed out 10.0.0.0/8 is a local network. While he suggested that this could be the IP address of some internal network at Yahoo itself I always get my real public IP address when connecting to the mail server.

What I suspect instead that you are behind some Carrier-grade NAT which is common for many mobile networks and access to the internet via cable. The IP address you see is your IP address inside this local network and this can be seen by Yahoo since they have a mail server inside this local network. This local presence could be because Yahoo is owned by Verizon and Verizon is likely directly or indirectly the provider of your internet access.

In any case nothing you provide indicates or even suggests some man in the middle attack.

Answer 2

Naturally you won't see any connections to 10.0.0.0/8 as it's a private network, and per RFC 1918, 3 wouldn't be routed even if there was that kind of address involved:

Because private addresses have no global meaning, routing information about private networks shall not be propagated on inter-enterprise links, and packets with private source or destination addresses should not be forwarded across such links. Routers in networks not using private address space, especially those of Internet service providers, are expected to be configured to reject (filter out) routing information about private networks. If such a router receives such information the rejection shall not be treated as a routing protocol error.

The hostnames used for connections are saved in e.g.:

user_pref("mail.server.server1.hostname", "imap.example.com");
user_pref("mail.smtpserver.smtp1.hostname", "smtp.example.com");

The mail.server.server1.serverIDResponse is rather how the server introduces itself during the connection, and the IP address you see is probably just the internal address of the Yahoo server you are currently connected to. Having it in the reply (rather than the external address) may help diagnosing any problems with a single server.