3.3 Email 2: Sabre Project - - hours On , at hours, identified HIS mistake and replied to HIS original email at hours to explain HE wrote
in error. Within the email, HE mentioned that wrote to SCOTT and the account is being set up to wire to JD (Forensic Comment: APUS believes is a typo for for ). Analyzing the raw email message information, the email was delivered to (Figure 4). T
he message originated (“x
-originating-
ip” located in the raw email header) from , an , United Arab Emirates (Figure 5 and 6). The timestamp on the message in Figure 4 is Tuesday, , 3:38:14 AM, indicated that SCOTT’s local client is operating in the +0800 (UTC+8) time zone, which corresponds with local time and HIS signature block location. SCOTT sent the message to cover up the mistake made in Email 1. In this second message, SCOTT changed HIS IP address, which indicates a VPN or Proxy; however, Figure 5 below reported the IP was not a proxy or VPN.
Figure 1 - jimhalpert@jlaenterprise.com auto-forwards to officeman1987a@gmail.com and SCOTT
’s IPv4 address Figure 2 - IP Address Lookup Details - 83.110.250.231
