How JustAnswer Works:
  • Ask an Expert
    Experts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional Answer
    Via email, text message, or notification as you wait on our site.
    Ask follow up questions if you need to.
  • 100% Satisfaction Guarantee
    Rate the answer you receive.
Ask Kamil Anwar Your Own Question
Kamil Anwar
Kamil Anwar, Computer Support Specialist
Category: Computer
Satisfied Customers: 5102
Experience:  8+ Years of Experience. / CCNA (S), CCNA (W), CCNA (RS), MCTS, MBCs.
Type Your Computer Question Here...
Kamil Anwar is online now
A new question is answered every 9 seconds

I received a disturbing email and i want to identify who

Customer Question

Hi i received a disturbing email and i want to identify who sent to to me.
the email was sent from
naomi marsh <*****@******.***
appreciate any help
Submitted: 2 years ago.
Category: Computer
Expert:  Kamil Anwar replied 2 years ago.
Hello & Welcome to JustAnswer.
Thank you for your question. I will do my best to assist you.
What does the e-mail says?
Optional Remote Connect Service - Quick Resolution
Would you like me to remotely connect to your computer and fix the issue - The remote service will be an additional service for $39 but will allow me direct access to work on your issue and fix it (while you watch on your screen). If you need remote service, reply with the words "i want remote"
If you do not need the remote service, then simply provide me the requested information above. If you need remote service reply me with the words "i want remote".
Customer: replied 2 years ago.
Received: from ( by ( with Microsoft SMTP Server (TLS) id; Tue, 2 Jun 2015 12:05:26 +0800
Received: from (unknown []) by (Postfix) with SMTP id(###) ###-####406C; Tue, 2 Jun
2015 04:05:24 +0000 (UTC)
Received: from (unknown []) by (Postfix) with ESMTPS id A944415F2042; Tue, 2 Jun
2015 04:05:23 +0000 (UTC)
Received: by wizo1 with SMTP id o1so128518990wiz.1; Mon, 01 Jun 2015
21:05:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113;
MIME-Version: 1.0
X-Received: by with SMTP id dd8mr26202482wib.76.1433217922238;
Mon, 01 Jun 2015 21:05:22 -0700 (PDT)
Received: by with HTTP; Mon, 1 Jun 2015 21:05:22 -0700 (PDT)
Date: Mon, 1 Jun 2015 21:05:22 -0700
Subject: Wayne
From: naomi marsh
CC: ,
Content-Type: multipart/alternative; boundary="f46d04448167240cef0517810d47"
X-TMASE-Version: StarCloud-1.3-7.6.1031-21584.004
X-TMASE-Result: 10--0.442200-5.000000
X-TMASE-MatchedRID: S9LcgMMymGvhOvmWLR3/v1Pjo7D4SFg4vvkzqYJBDFbJk8Hku2juVY87
X-MS-Exchange-Organization-AuthSource: exchange.solargain.local
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Organization-SenderIdResult: SoftFail
Received-SPF: SoftFail (exchange.solargain.local: domain of transitioning
***@******.*** discourages use of as permitted sender)
X-MS-Exchange-Organization-SCL: 0
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-Antispam-Report: DV:3.3.14920.485;SID:SenderIDStatus SoftFail;OrigIP:
Expert:  Kamil Anwar replied 2 years ago.
The source looks spammy. They are using a relay service to send out e-mails. So, we cannot trace the IP Address because it points to the relay server.
Customer: replied 2 years ago.
can you give me any information
Expert:  Kamil Anwar replied 2 years ago.
The source host name is "" and the source IP address is That is the only useful information in this header.
But if you can tell me what it says, i may be able to tell if it is a scam.
Customer: replied 2 years ago.
it is someone that works with me and they sent an email to my wife saying i had an affair with my secretary
so i am very keen to find out
what other information would you require to assist
Customer: replied 2 years ago.
i believe the ip address as just google - i need more than that
Expert:  Kamil Anwar replied 2 years ago.
Give me a few minutes to see if i can find something else. We only have what the header has.
Expert:  Kamil Anwar replied 2 years ago.
Do you know anyone using trendmicro as email relayer or firewall?
Customer: replied 2 years ago.
no sorry
Expert:  Kamil Anwar replied 2 years ago.
There is nothing we can do with this header. Because it doesn't includes anything that can tell who/where the sender is. BUT with a little bit of engineering, you can log the IP Address of the sender, with the ip address, we will be able to get a bit closer but for that, you need to setup a page and code it, then make the user click the link to log the ip address.
Customer: replied 2 years ago.
do want a copy of the actual email?
will this help?
Expert:  Kamil Anwar replied 2 years ago.
You have already given me the entire header.
Customer: replied 2 years ago.
i really understand the technical side
but what happens if they dont use this email address again
Expert:  Kamil Anwar replied 2 years ago.
If the sender decides not to use the email again nothing can be done.
Customer: replied 2 years ago.
ok so there is no more you can do?i can tell you it got sent to my work email
in Perth Western Australia
Expert:  Kamil Anwar replied 2 years ago.
I can assist with setting up a site and logging ip address if the user clicks on the link in your e-mail. Other then that, nothing can be done unfortunately because the header doesn't contain the ip address of the sender.
Customer: replied 2 years ago.
ok so can you set up ?
Expert:  Kamil Anwar replied 2 years ago.
Yes, but you will have to buy hosting and a domain and if i do that setup then that will via an additional service.
Customer: replied 2 years ago.
ok how long does it take and whats the cost
Expert:  Kamil Anwar replied 2 years ago.
The cost for additional service will be $54.
The domain will cost between $5 to $14
The hosting will be less then $10 for a month
After which you can cancel the hosting, but the domain is minimum 1 year.
Customer: replied 2 years ago.
i will leave it for the time being
thanks very much for your assistance
Expert:  Kamil Anwar replied 2 years ago.
You're Welcome. Thank you for your patience.