The text below is an example of an extended email header. When examining the extended email header, you should always start from the bottom and work your way to the top. The bottom of the header contains the details about where the message was sent from, and the top of the header contains its final destination.

Copy and Paste the text below into WordPad - then highlight the following information in different colours:

• Email Addresses
• IP Addresses
• Any other important information - this will come with experience

Received: from PRD-HQEXCH13-01.wypnt.wypnet.org (10.39.1.30) by
 PRD-DHEXCH13-01.wypnt.wypnet.org (10.19.1.30) with Microsoft SMTP Server
 (TLS) id 15.0.1178.4 via Mailbox Transport; Tue, 12 Mar 2018 13:02:08 +0100
Received: from PRD-HQEXCH13-01.wypnt.wypnet.org (10.39.1.30) by
 PRD-HQEXCH13-01.wypnt.wypnet.org (10.39.1.30) with Microsoft SMTP Server
 (TLS) id 15.0.1104.5; Tue, 12 Mar 2018 13:02:08 +0100
Received: from prddhwypemail.wypnt.wypnet.org (10.39.1.156) by
 PRD-HQEXCH13-01.wypnt.wypnet.org (10.39.1.30) with Microsoft SMTP Server id
 15.0.1104.5 via Frontend Transport; Tue, 12 Mar 2018 13:02:08 +0100
Received: from prddhwypemail.wypnt.wypnet.org (localhost.localdomain [127.0.0.1])
    by localhost (Email Security Appliance) with SMTP id 1638F42D632A_784DC40B
    for ; Tue, 12 Mar 2018 12:02:08 +0000 (GMT)
Received: from mx.hosting-e.gsi.gov.uk (unknown [51.63.249.40])
    by prddhwypemail.wypnt.wypnet.org (Sophos Email Appliance) with ESMTP id E5CCA42D5118_784DC3FF
    for ; Tue, 12 Mar 2018 12:02:07 +0000 (GMT)
Received: from mail6.bemta5.messagelabs.com ([195.245.231.135])
    by mx.hosting-e.gsi.gov.uk with esmtps (TLSv1.2:DHE-RSA-AES128-SHA:128)
    (Exim 4.83)
    (envelope-from )
    id 1bMwO7-0005Zl-Pl
    for rob.waite@westyorkshire.pnn.police.uk; Tue, 12 Mar 2018 13:02:07 +0100
Received: from [85.158.139.163] by server-11.bemta-5.messagelabs.com id 7D/BE-04210-F3CD4875; Tue, 12 Mar 2018 12:02:07 +0000
X-Env-Sender: ericajones684@gmail.com
X-Msg-Ref: server-8.tower-188.messagelabs.com!1468324927!15174422!1
X-Originating-IP: [74.125.82.65]
X-StarScan-Received:
X-StarScan-Version: 8.46; banners=-,-,westyorkshire.pnn.police.uk
X-VirusChecked: Checked
Received: (qmail 7464 invoked from network); 12 Mar 2018 12:02:07 -0000
Received: from mail-wm0-f65.google.com (HELO mail-wm0-f65.google.com) (74.125.82.65)
  by server-8.tower-188.messagelabs.com with AES128-GCM-SHA256 encrypted SMTP; 12 Mar 2018 12:02:07 -0000
Received: by mail-wm0-f65.google.com with SMTP id x83so1799988wma.3
        for ; Tue, 12 Mar 2018 05:02:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=from:to:subject:date:message-id:mime-version:thread-index
         :content-language;
        bh=MIVnBdWNwX1XrjwJqpDgwd4n8YdnrQ4Wj1zig9FZvcs=;
        b=UHvDpyqSAoAN5eFBGZtImOTbx73/CZJdBduqRQJrQMdZQO9RlS7PbfSq0KG+xh/h+x
         WXzTUV4sjHSy/OnJ5glOF7owWCl9RTkelkkb+XSw0P+GT+pxjL6ngRus+z7IMN+OFeR3
         l5VQFvPQg3FLdX0vaXZw3M/H6Uleu+Rz31hEAAuMOtSpR4y5ywWktnaDWkVXlwJbcgC3
         hgnnXlKXwj2tK/KzMBhwiEH6MEM/qmxtGatSWYVxjs6fNnl0Isif+BN/h0vxdqhHFQb9
         vBXd03np4YaETAegL47G7RcNtTB6hDD7xXSx2kRoVF24NomJegUEBNFc7ntTCUg4Y/qw
         qb8g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:from:to:subject:date:message-id:mime-version
         :thread-index:content-language;
        bh=MIVnBdWNwX1XrjwJqpDgwd4n8YdnrQ4Wj1zig9FZvcs=;
        b=ati96q93DAr6safd+SP11TELy3dNbeR5HoKL9pdz9U276NLSjJxOVG/ig+X5z2rxo+
         XDjOqqb8+sMRsW1+sGVwhr0fs8A5vC+h2gtl2s7xklUfHjDATQWXUKbpeemlG4ejohGD
         LI5C72uMnjpX+Ka6VubioNh5Q7cSuNMmeG7y8LDPT4tDj/ysa/6rTf6NfWNvAQYf00kr
         TB9m/W0BV905q3Z98Bes91kFG8QYIeVTAC2XJUj4K5kHoJu3J+rOuWU6fDlmEpvCDZ97
         d07fd1q9RrO+71j1+/gOFQJ/EE0yYo/YsySRl9aENCwQPjYEuB63FjY5wqWXmsENbXfa
         Iq8w==
X-Gm-Message-State: ALyK8tIKHZNQgN128Lj1U4meUZxQh09Z2Z0EmT+w4Ml0u2IWwvmWl2Wk5luJJ9s8Ct7icw==
X-Received: by 10.28.138.18 with SMTP id m18mr20668535wmd.63.1468324926991;
        Tue, 12 Mar 2018 05:02:06 -0700 (PDT)
Received: from EJ_LAPTOP (host86-132-83-190.range86-132.btcentralplus.com. [86.132.83.190])
        by smtp.gmail.com with ESMTPSA id u125sm16692094wmg.22.2018.07.12.05.02.05
        for 
        (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
        Tue, 12 Mar 2018 05:02:05 -0700 (PDT)
From: "Erica Jones" 
To: 
Subject: Missing Person Enquiry
Date: Tue, 12 Mar 2018 13:02:03 +0100
Message-ID: <014401d1dc35$3564f040$a02ed0c0$@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0145_01D1DC3D.97295840"
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AdHcNR0wDPHUOzBoTs60A3SMtj3r/Q==
Content-Language: en-gb
X-Source: Internet
X-Sophos-SenderHistory: ip=195.245.231.135,fs=7618879,da=36966532,mc=333372
X-Sophos-ESA: [prddhwypemail.wypnt.wypnet.org] 4.0.1.1211, Antispam-Engine: 2.7.2.1390750, Antispam-Data: 2018.7.12.115116
X-SEA-Spam: Gauge=IIIIIIII, Probability=8%, Report='
 FORGED_FROM_GMAIL 0.1, HTML_70_90 0.1, BODYTEXTH_SIZE_10000_LESS 0, BODYTEXTP_SIZE_3000_LESS 0, BODYTEXTP_SIZE_400_LESS 0, BODY_SIZE_3000_3999 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, DKIM_SIGNATURE 0, FORGED_MUA_OUTLOOK 0, NO_URI_HTTPS 0, SPF_SOFTFAIL 0, WEBMAIL_SOURCE 0, WEBMAIL_XOIP 0, WEBMAIL_X_IP_HDR 0, __ANY_URI 0, __CP_URI_IN_BODY 0, __CT 0, __CTYPE_HAS_BOUNDARY 0, __CTYPE_MULTIPART 0, __CTYPE_MULTIPART_ALT 0, __DQ_S_HIST_1 0, __DQ_S_HIST_2 0, __DQ_S_IP_MC_100_P 0, __DQ_S_IP_MC_10_P 0, __DQ_S_IP_MC_1K_P 0, __FRAUD_WEBMAIL 0, __FRAUD_WEBMAIL_FROM 0, __FROM_GMAIL 0, __HAS_FROM 0, __HAS_HTML 0, __HAS_MSGID 0, __HAS_XOIP 0, __HAS_X_MAILER 0, __HTML_FONT_BLUE 0, __HTML_MSWORD 0, __MIME_HTML 0, __MIME_VERSION 0, __MULTIPLE_URI_TEXT 0, __OUTLOOK_MUA 0, __OUTLOOK_MUA_1 0, __SANE_MSGID 0, __STYLE_RATWARE_NEG 0, __SUBJ_ALPHA_END 0, __TAG_EXISTS_HTML 0, __TO_MALFORMED_2 0,
 __TO_NO_NAME 0, __URI_IN_BODY 0, __URI_NO_MAILTO 0, __URI_NO_PATH 0, __URI_NS , __USER_AGENT_MS_GENERIC 0, __YOUTUBE_RCVD 0'
Return-Path: ericajones684@gmail.com
X-MS-Exchange-Organization-Network-Message-Id: 7a579893-a0b4-4884-f89d-08d3aa4c5954
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0
X-MS-Exchange-Organization-AuthSource: PRD-HQEXCH13-01.wypnt.wypnet.org
X-MS-Exchange-Organization-AuthAs: Anonymous