Another thing that can be useful is to get the raw message header for the e-mail message -- if you're reporting the e-mail. In Outook, you can look for "message details." In Yahoo! they call it raw message. This was the raw message for this spoof.
Received: from BYAPR03MB4038.namprd03.prod.outlook.com (2603:10b6:a03:12b::43)
by BYAPR03MB4038.namprd03.prod.outlook.com with HTTPS via
BYAPR07CA0102.NAMPRD07.PROD.OUTLOOK.COM; Sun, 24 Feb 2019 08:16:18 +0000
Received: from BN3PR03CA0077.namprd03.prod.outlook.com
(2a01:111:e400:7a4d::37) by BYAPR03MB4038.namprd03.prod.outlook.com
(2603:10b6:a03:77::31) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1643.18; Sun, 24 Feb
2019 08:16:16 +0000
Received: from CO1NAM04FT010.eop-NAM04.prod.protection.outlook.com
(2a01:111:f400:7e4d::207) by BN3PR03CA0077.outlook.office365.com
(2a01:111:e400:7a4d::37) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1643.15 via Frontend
Transport; Sun, 24 Feb 2019 08:16:15 +0000
Authentication-Results: spf=pass (sender IP is 79.175.168.236)
smtp.mailfrom=bale.ai; falati.com; dkim=none (message not signed)
header.d=none;falati.com; dmarc=none action=none
header.from=falati.com;compauth=none reason=904
Received-SPF: Pass (protection.outlook.com: domain of bale.ai designates
79.175.168.236 as permitted sender) receiver=protection.outlook.com;
client-ip=79.175.168.236; helo=mx10.elenoon.ir;
Received: from mx10.elenoon.ir (79.175.168.236) by
CO1NAM04FT010.mail.protection.outlook.com (10.152.90.150) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1643.11 via Frontend Transport; Sun, 24 Feb 2019 08:16:14 +0000
Received: from [82-117-249-30.gpon.sta-BE.kh.velton.ua] (82-117-249-30.gpon.sta-BE.kh.velton.ua [82.117.249.30])
(using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mx10.elenoon.ir (Postfix) with ESMTPSA id 43ADC36B74ED
for <abarschall@falati.com>; Sun, 24 Feb 2019 06:28:55 +0330 (+0330)
DKIM-Filter: OpenDKIM Filter v2.11.0 mx10.elenoon.ir 43ADC36B74ED
X-Mailer: elenoon
To: <abarschall@falati.com>
X-CSA-Complaints: whitelistcomplaints@bale.ai
Content-Transfer-Encoding: base64
Content-Type: text/plain; charset="UTF-8"
From: <abarschall@falati.com>
List-Subscribe: <https://groups.google.com/a/bale.ai/group/ejfysohr/subscribe>
Date: Sun, 24 Feb 2019 03:58:54 +0100
Organization: Myvcuwiylhpz
Message-ID: <aleuiztlm0.m7yumkc325.44579915056537.5v9uy11n08.b0y6ku6t@bale.ai>
Feedback-ID: 67960:73155067:teokfl
X-Sender: support@bale.ai
Subject: abarschall
Return-Path: support@bale.ai
X-MS-Exchange-Organization-ExpirationStartTime: 24 Feb 2019 08:16:14.8979
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 2:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
e78597bb-abe0-467a-9fc6-08d69a30583c
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 2ad5341e-a921-4301-9476-68bd1646fbbd:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-Forefront-Antispam-Report:
CIP:79.175.168.236;IPV:NLI;CTRY:IR;EFV:NLI;SFV:SPM;SFS:(10001)(3000300001)(286005)(189003)(199004)(2351001)(3480700005)(66574012)(23676004)(486006)(126002)(9686003)(356004)(476003)(6266002)(104016004)(86152003)(21004)(10001)(36916002)(5820100001)(45954011)(2160300002)(106466001)(46276001)(61020400011)(436003)(50226002)(50466002)(32166020)(956004)(575854001)(6916009)(76786011)(1096003)(42882007)(336012)(221733001)(62550400003);DIR:INB;SFP:;SCL:5;SRVR:BYAPR03MB4038;H:mx10.elenoon.ir;FPR:;SPF:Pass;LANG:en;PTR:mx10.elenoon.ir;MX:1;A:1;CAT:SPM;
MIME-Version: 1.0
X-MS-Exchange-Organization-AuthSource:
CO1NAM04FT010.eop-NAM04.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: e78597bb-abe0-467a-9fc6-08d69a30583c
X-Microsoft-Antispam:
BCL:6;PCL:0;RULEID:(2390118)(7020095)(4652040)(5600110)(711020)(4605104)(1401299)(1421009)(71702078);SRVR:BYAPR03MB4038;
X-MS-TrafficTypeDiagnostic: BYAPR03MB4038:|BYAPR03MB4038:
X-MS-Exchange-Organization-SCL: 5
X-Microsoft-Exchange-Diagnostics:
1;BYAPR03MB4038;23:1p6v00UK8uYi+FT/+OFUrV8IZ1TwDfwSatKB7yEA64hABmsKHWyjM1twCbU/Yp1P4Kux2ArBq6X2DnxVJ24aTZ0ldEBYlFlcrB3eINmE4gVnA/dvUlli8f+asmFE5JmniB0Md+f5X7C+m7zIZD3a8FJ78LoxV/5N6pYWY8A4rA82KgJTF976hl4bSyJR8FzB0nsfLuotlW2vueD/9udkomKSt6blebgrh4XY6yY4iHwIHXyniDN0hs1bRVx07VKEN1fTAZ03j0VuecfnFG5Y0t2OLC1NzOdv+rPb9OABm28Xjnzsx/Q8jnVLfupLQqVh05wsbQFy+ehLN+RYOOUl15oysewz2AvdzcxEia0Psh6VUKwHjmWCktey8J1fPM8guXU8MeHZv1cfcOkztYHUf65Ng0CfYo9D1n7Qe2/DZTJEhXDnVimgO+jODIUe0t2c2FJXdGHGDg39rrTzUOi8b/AW8v3oSonKByTU0gEFeXdgrsy1QXhwyJbjlDnc55g7jtAoeQ0Uk5XToVab4rw5rdkYVbfLdaCtAhxA5Jny24O22dslmFYHwOW91TNYqHB7GJPUqPXO7AbQWAxD2zeh5rN2igSwST7xSsxb6avEEkDCEjeYrsrwOoiPocE71YTCTlzI7TO5S7R/Ex8it4zCevhnC03gdkRR9awATYbhQznMSpc06YF/rjDr7PbmyG72K4z/15gPc1A1Aigd2OmI7CnrPJuenNKWGXWN7zcSSbe8XGGU0prI20hayMmVk0sVOi8NLqyZc/cp8Yr+UKMVhDiSCjDS6embaHUoN2z3G/+pSN3O3uJ7x+HDNEj045npPf4guA0EqehfsnqXfWLUOFPEy/0rMpcZwvbTuDROAidilfGXRN+x9IJGLTsJZj5bTumqfqYwBZ6rt6GRno/rxA==
X-MS-Exchange-Inbox-Rules-Loop: abarschall@falati.com
X-Microsoft-Exchange-Diagnostics:
1;BYAPR03MB4038;23:cKHCZySpV2z+DT8jhKOEkxyMYrQpJiNkNUvAqD7MFOWZmHZbgdfVW8mKIrTpj9MK4PlteluxEycGCpn7KdL8wJ9IgFINU99U2ZoKjL+LQ/uLGxJVuFs/U47ETTB4T3nc1HtAkXP5DmVVSeT/Y4hVSQ==
X-ExternalRecipientOutboundConnectors: 2ad5341e-a921-4301-9476-68bd1646fbbd
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Feb 2019 08:16:14.3875
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: e78597bb-abe0-467a-9fc6-08d69a30583c
X-MS-Exchange-CrossTenant-Id: 2ad5341e-a921-4301-9476-68bd1646fbbd
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR03MB4038
X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.9432020
X-MS-Exchange-Processed-By-BccFoldering: 15.20.1643.000
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:1;ex:0;auth:0;dest:J;ENG:(20160513016)(750119)(520011016);
X-Microsoft-Antispam-Message-Info:
=?us-ascii?Q?ib2A2lbO+GTg6vmWZsv1okHVXbVEJ43CJjzf6OWJk5qqUZ/WL2U/GMTrjG1x?=
=?us-ascii?Q?qLV3LKNgTwP9IzzebTwjLNSNRAD48PXs/vd0lB7WLgeah9waoURpnKukE3DW?=
=?us-ascii?Q?idf+pIOWb7cJzG+NfAuSFFyAiWyB7gMaPd/zo7tDI2OkRY15HQwQCHDJpmvZ?=
=?us-ascii?Q?2rzujPc00WOmwoWcbHyE2z5eesvh9T7AZYSC2C4Tayxh8MlNs8wBb+S8EHpK?=
=?us-ascii?Q?th8KeAJphKK3O7H90G1zkb0xUe36ofGibSfBs1qPdpsVj21Sao3vqkntNpIC?=
=?us-ascii?Q?vOaFQbk5Ow1lCWadFD8NkYvWJQz40uHv7PKJIQBpkOU4R5oE3Mh5egXcDb69?=
=?us-ascii?Q?jh26ul7djltztFVEG9tIQhLNJZIsjE/BJkw6Ha3cemOqHLPhUUV2IOqYNym4?=
=?us-ascii?Q?+EhPscjNh0r4sFIguA1VncPqr6+7K3GKtK85YLqHgXM2VTIRAVt0772IfRxk?=
=?us-ascii?Q?wxI9YyIQBvPHGin0ZG+j3p/yMKr74FbNxBKbbTcsqj527pLP6CYSpstmUMWC?=
=?us-ascii?Q?4qOKTUgRdcaFh+pbqiBRQvf+mq409Mh8HvnkN8GinLlxQq9RfjDbUg/LU1gG?=
=?us-ascii?Q?VgYdO6NeDz2lwK2QEs1f0XaaL6hjZ4x7NjvbVlZq0/J6BPTW1AuT9yBMQsBp?=
=?us-ascii?Q?SFsABjVNH4f56Sd1QoL6CHx6fD86WddkLTGAR54tgu0NUEEWlj5SvJKRoG2h?=
=?us-ascii?Q?/fzIbi64TOEVBbtZ7HNyQEXlcVz9r6uxSXJ7Pix2seKOjJT6N+Z1bJ9aO1UT?=
=?us-ascii?Q?DVa4+NoVYtmg24Dmy9TSsr9RuTqceml5soe3XgwUaWeZPAySvifvCP5ChB3f?=
=?us-ascii?Q?zdlzFzRKD3ULXuWIebqUXcgzCvVtpbrhTEr0PWrTVncSFIU3Wl/4AB3kYV84?=
=?us-ascii?Q?R0V8TshRoJjxxa30Y8JXw96zKLD+hojo/1I4JOXjldksqAJm5+rnn5XAHLKW?=
=?us-ascii?Q?IeEgeBse7IMs494lGvnJVHU7HskTihuUFKzGikiAs/iurqALDxzPHPr7w5/g?=
=?us-ascii?Q?aVE1gATckqVHYA6zkRceMSd5KCRC+FVLv0/7jv2ZTCqESASI2s6mBf2t/DEp?=
=?us-ascii?Q?GIQ8DzNDw/7mseatjHRz8nB/sUu49l1q6QQ7dAwzR3TUHd7V2FH1m+BYG4S3?=
=?us-ascii?Q?aX2NJrRD5hMaodTlSx5s1xo3h57W/lLlOBfcV6di8skaDA1RDjDn8PYNOV8r?=
=?us-ascii?Q?x9x5jgRgHEGsWlpXhdlH6nEXijRij4JpHTCvt4VlQULMqpm58sQP6hb7rPjF?=
=?us-ascii?Q?gzOqBD87/JVtJ5VGRc0cQ4uQ7vvExh1k2fNzyb7OSUwHFHZboWGGdk1gaxlF?=
=?us-ascii?Q?4QCvafWziIvrvsX1mGvS3r3eNDoSxW78pHwyTEadJgHU11+eHCdLaf6n2Hp/?=
=?us-ascii?Q?O0ZACvTnRDJwQas94CKZV0OMOKY+aUmnaj7SOSLre9e5a00Zg/D5i/bYJOAR?=
=?us-ascii?Q?KW61flJG/6vWpnR0SHn78lChNLJlr3lor8gF1Vvd0tipJcx1thGm6A=3D=3D?=