Question Header info in Outlook

[rocster0289]

I am not sure if this is the correct place to ask this question, but in Outlook in a received email the header info, I am trying to find the domain it is coming from so I can block it.
I hope someone can help. Thanks in advance.
Here is the header info:

Received: from SA1P223MB1135.NAMP223.PROD.OUTLOOK.COM :1) by
PH7P223MB0666.NAMP223.PROD.OUTLOOK.COM with HTTPS; Sat, 9 Sep 2023 13:38:56
+0000
Received: from DUZPR01CA0101.eurprd01.prod.exchangelabs.com
(2603:10a6:10:4bb::22) by SA1P223MB1135.NAMP223.PROD.OUTLOOK.COM
(2603:10b6:806:3d4::17) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6768.30; Sat, 9 Sep
2023 13:38:55 +0000
Received: from DB5EUR02FT066.eop-EUR02.prod.protection.outlook.com
(2603:10a6:10:4bb:cafe::3c) by DUZPR01CA0101.outlook.office365.com
(2603:10a6:10:4bb::22) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6768.31 via Frontend
Transport; Sat, 9 Sep 2023 13:38:54 +0000
Authentication-Results: spf=pass (sender IP is 185.51.114.151)
smtp.mailfrom=sacritist.com; dkim=pass (signature was verified)
header.d=sacritist.com;dmarc=bestguesspass action=none
header.from=sacritist.com;compauth=pass reason=109
Received-SPF: Pass (protection.outlook.com: domain of sacritist.com designates
185.51.114.151 as permitted sender) receiver=protection.outlook.com;
client-ip=185.51.114.151; helo=151-114.static.skynettelekom.net; pr=M
Received: from 151-114.static.skynettelekom.net (185.51.114.151) by
DB5EUR02FT066.mail.protection.outlook.com (10.13.59.11) with Microsoft SMTP
Server id 15.20.6768.26 via Frontend Transport; Sat, 9 Sep 2023 13:38:54
+0000
X-IncomingTopHeaderMarker:
OriginalChecksum:C11A4EC8874C77631ADA30E465329C4D779AB0327BA9953B1722BC1A8B59B8D9;UpperCasedChecksum:7C06CBB408D094660A749BBECC5ED5C27A46A083930BCA60A7E98DD7C3F81E4F;SizeAsReceived:1040;Count:12
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=key1; d=sacritist.com;
h=To:Content-Type:Subject:From😀ate; i=office@sacritist.com;
bh=hmXOJNWHNDdc+o55n4c/nqrvTeECxWcBKaKem74eBQI=;
b=4m5DtP4D8r1YE28PcSTTjCWNjLx/dOQr+XdUllY+1L1wCV9juFfyLhkZMffeUlO5TgMT2xTR6JjU
/fWDFAwhrSbIKI3dqqo7jzwDIozQocp4t+LSRiQeDodjGMMHLafV0BZqPZ8cIMgKKcr42X1hwQnM
08TgkdV2yoAsmg+cM16RRH+ezkWjAL62pC0IHia3m9SnmSkkKfpmQIK/nsQ4eN530ZNJmo4uPs4/
PCj+xoVygRaCjwNVsOHzNZFxq6RIrJMGa/UzHh5WpQzl1rtETL5rxwpC/WU5BP8wgVSwq2YrUbZ2
tdd3pPCNY4Jd1W5yb55w4NFYwn1WlQTl8NI9Ug==
To: <Email Address Removed>
X-Alerts-Updates: l1694266724000634
Content-Type: text/html; charset=utf-8
Subject: =?UTF-8?Q?We=27ll_do_whatever_it_takes_until_pests_are_gone=2E?=
X-Message-Promotion: B1792E0
X-Header: s6-openers_gold_ae-005
X-Example-Newsletter: 426e51694266724000
From: "=?UTF-8?Q?Terminix_Pest_Control_Advisors?=" <office@sacritist.com>
Return-Path: office@sacritist.com
Date: Sat, 09 Sep 2023 13:38:44 +0000
X-Contact-Information: 1694266724000aC578
X-IncomingHeaderCount: 12
Message-ID:
<5ca44ad4-f135-4ad3-b69f-fd88d1f06115@DB5EUR02FT066.eop-EUR02.prod.protection.outlook.com>
X-MS-Exchange-Organization-ExpirationStartTime: 09 Sep 2023 13:38:54.8435
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
83786480-6521-47da-6048-08dbb13a1c8f
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
DB5EUR02FT066:EE_|SA1P223MB1135:EE_|PH7P223MB0666:EE_
MIME-Version: 1.0
X-MS-Exchange-Organization-AuthSource:
DB5EUR02FT066.eop-EUR02.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 9/9/2023 12:51:07 PM
X-MS-Office365-Filtering-Correlation-Id: 83786480-6521-47da-6048-08dbb13a1c8f
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 185.51.114.151
X-SID-PRA: OFFICE@SACRITIST.COM
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Antispam: BCL:5;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Sep 2023 13:38:54.3747
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 83786480-6521-47da-6048-08dbb13a1c8f
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource:
DB5EUR02FT066.eop-EUR02.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1P223MB1135
X-MS-Exchange-Transport-EndToEndLatency: 00:00:02.5777412
X-MS-Exchange-Processed-By-BccFoldering: 15.20.6768.024
X-MS-Exchange-Organization-SCL: 6
X-Message-Info:
6hMotsjLow8tCacANDFIPxVFK5IWbneQPktA3UJ1JLJwnUydPoANjCzIx06gfQ2B+nIYb2P6WcD5SZBOgmBHGiceMPeU4aGnsyUB/9B2UA7Eqxl7NFwYnTQSlwAm+x8Y1tm6gFK7AEGMKScjKu6KDloGEPcNELTKVt/1rGUsSsSVZhm8MBNV25hPsb22/I/Ixt1v/JWLHFSrhgU+hKmpPQ==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;ex:0;auth:1;dest:J;OFR:SpamFilterAuthJ;ENG🙁5062000305)(920221119095)(90000117)(920221120095)(90005022)(91005020)(91035115)(9050020)(9100341)(944500132)(2008001134)(2008121020)(4810010)(4910033)(9610028)(9560006)(10180021)(9320005)(9245025)(120001);RF:JunkEmail;

Mod Edit: Removed email address.

 

[COLGeek]

Looks like: sacritist.com

 

[ex_bubblehead]

Headers are read from bottom to top so look for the first "Received From:". That should be the source.

In the header you provided this would be: "Received: from 151-114.static.skynettelekom.net (185.51.114.151) by"

However, this type of blocking doesn't really do anything for SPAM as the perpetrators simply move from one compromised mail server to another.

 

[rocster0289]

Thanks all!

 

[COLGeek]

Headers are read from bottom to top so look for the first "Received From:". That should be the source.

In the header you provided this would be: "Received: from 151-114.static.skynettelekom.net (185.51.114.151) by"

However, this type of blocking doesn't really do anything for SPAM as the perpetrators simply move from one compromised mail server to another.

The IP address maps to:

https://whatismyipaddress.com/ip/185.51.114.151