From the following spam mail header excerpt, which host IP is the one that sent the spam?

From the following spam mail header excerpt, which host IP is the one that sent the spam?

• A. 137.189.96.52
• B. 8.12.1.0
• C. 203.218.39.20
• D. 203.218.39.50

Answer: (C)

In email headers, the origin of the message is shown by the first hop in the chain of servers that handled the mail. Each mail server adds a Received line as the message is relayed toward you, so the bottom-most Received header (the earliest hop) reveals the sending host’s IP. In this excerpt, the bottom-most line points to 203.218.39.20 as the originating machine that handed the message to the next server. The other addresses are subsequent relays the mail passed through on its way to you, not the original sender. The address 8.12.1.0 is not a valid host address, so it’s unlikely to be the sender.

In email headers, the origin of the message is shown by the first hop in the chain of servers that handled the mail. Each mail server adds a Received line as the message is relayed toward you, so the bottom-most Received header (the earliest hop) reveals the sending host’s IP.

In this excerpt, the bottom-most line points to 203.218.39.20 as the originating machine that handed the message to the next server. The other addresses are subsequent relays the mail passed through on its way to you, not the original sender. The address 8.12.1.0 is not a valid host address, so it’s unlikely to be the sender.