How to find out the sender of an e-mail?

Question

Email

I'm not an IT specialist and I don't know much about computers. I ask for help in this matter. My @gmail.com mail receives threats from @hotmail.com like "your son will die soon" (the son is really sick). I rummaged through the Internet, went to the original message, I only realized that they sent it from an iPhone and ip to the USA (because @hotmail?). I suspect a certain person. Is it possible to find out any more information from the original message? If I have a first name, last name, phone number. and another e-mail of the suspect person, can this be used somehow? How to find the sender?
Forgive me if the questions are stupid, I'm not impressionable, but it's all a little morally pressing.

Here is the original post.

Идентификатор сообщения	<[email protected]od.outlook.com>
Создано:	24 мая 2020 г., 18:04 (доставлено через 1 секунду)
От:	Irina Karpacheva <[email protected]>
Кому:	"[email protected]" <[email protected]>
Тема:	твой сын подохнет или овощем станет, лучше овощем, больнее тебе будет
SPF:	PASS с IP-адресом 40.92.19.60. Подробнее…
DKIM:	'PASS', домен hotmail.com Подробнее…
DMARC:	'PASS' Подробнее…

Delivered-To: [email protected]
Received: by 2002:a05:6214:967:0:0:0:0 with SMTP id do7csp2326381qvb;
        Sun, 24 May 2020 08:04:54 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJyBp2SyiUSzh4huSbjdevG9fttnGxaqEi/Y+WQ1Hrtge1Vx67hIuVu/B5zUMrzofGG/vy66
X-Received: by 2002:a02:c959:: with SMTP id u25mr15749787jao.46.1590332694447;
        Sun, 24 May 2020 08:04:54 -0700 (PDT)
ARC-Seal: i=2; a=rsa-sha256; t=1590332694; cv=pass;
        d=google.com; s=arc-20160816;
        b=NbEyN2mN3+Am4p6Nr+y8fWtfD+GOYmqrc8wf5o7Zk3qjJCqMDJr7/i+QC0vvewok/f
         lbsvUQodkV9v3gKZb28wju7vlbPg3Eo2TUG/a/wg37uEqjbKmAOQ4NEf5gLukS172db+
         JLlbumWmMLFbReTkolIKA5GHeiOMOua7HU7kmrY/QBS2Gy6MgyjUTWtfMXakfwTTxqbK
         onRAFxTMjufhxXduW1WAsGWulQLTwl/iq3PoV6MV8tYO9cJagUbfbwi5Els8rMwo5D0H
         7IFAgdNwxjTW8Am7+NWaWkIjJnQhEFcRFdC7ihfSTd4+nlle7J45vISU8XMQT0JnVNHz
         lE/g==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=mime-version:content-language:accept-language:message-id:date
         :thread-index:thread-topic:subject:to:from:dkim-signature;
        bh=KIBBTadYAzwgWKhLHXb5uVO+QmwZomLE5kAOpVelWk8=;
        b=tnRGQf1lP5AwHAWvDcLbCXPE+4yg6h3QN0eiF0G8VRNLvR3DRG6rFEIbC+HSpwjlVw
         ibfiPo/W/8vK0I3T/mtPbnDyJC1TH3W8E/e7XOHS2FwJ3DiCKn69/RpcdtYevrNlqiBi
         UOgF2WtEnpusFD/PQ+S5WHKdq1Ecg4av8J9L2RHjzrJcQHtw5m3FPALtERObpDZ4cFvY
         PjkN0I0SXWBOwpCoJ/e+tyJsQjRLDMPg7lQ1cswaRLWB18SNcxlSknfw+OMosPvnzqc3
         qP8H1+094rOqGl+ssXM4xpRc4x7FbziXhJZFCoqYlL/849IKnK+a7mcxU0Y8YRxzO+qG
         Loew==
ARC-Authentication-Results: i=2; mx.google.com;
       dkim=pass [email protected] header.s=selector1 header.b=i3IukYaL;
       arc=pass (i=1);
       spf=pass (google.com: domain of [email protected] designates 40.92.19.60 as permitted sender) [email protected];
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hotmail.com
Return-Path: <[email protected]>
Received: from NAM11-DM6-obe.outbound.protection.outlook.com (mail-dm6nam11olkn2060.outbound.protection.outlook.com. [40.92.19.60])
        by mx.google.com with ESMTPS id v9si8405982ios.84.2020.05.24.08.04.54
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Sun, 24 May 2020 08:04:54 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 40.92.19.60 as permitted sender) client-ip=40.92.19.60;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=selector1 header.b=i3IukYaL;
       arc=pass (i=1);
       spf=pass (google.com: domain of [email protected] designates 40.92.19.60 as permitted sender) [email protected];
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=hotmail.com
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Jx/msAnPUbDdIN9+0MbkVUiVinFWE/MBgpPVx2mrzPBTPmbiA4iArSsXE4790cg0S88CWfcRtWnP8apLOK1A5w7M5F+uvJHdkndcbE13Y7Xl+NGqOEwTDk77RaOlk4WOwyPwO6CGlq1EN1Q7svaOJLXWNunSHsk+4Mg38Fe3Y+JyFIFRS/UMFFPzcDsKyPDse1uRddxnGMqyX1AyrcM5EngXmTJ8gDw9GP8GTDsXWF04TRjbe+bQseWyAOjvvdAiuTyqeKjagTqE4Svk2Jyfz88Za1ULvwil9hxYO7O3+brZvKfXb1DoZDIbZUyTPh42lOMgtkzS90LNFaMaskhKAg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KIBBTadYAzwgWKhLHXb5uVO+QmwZomLE5kAOpVelWk8=; b=M00RtnfQ6Qz16yL7jZkXNJBcH4oUUP80JFhcHlyw036+qkliYmyXPOu22e5yPxSVYF1LdNvmnyaaG2A6AhtnjzLkRFV/2p9P5K4rUD6XBsuX7dV8A2b4O/c9Bw+3IeBhX0unMFF2nDqxLxkhi/ieDHLgAFriQ3+iSgF9HkIsMxFo22SIFvRLWzjBhjhXVQK66t6nkkBceWR71AB8Mqcnrv60kBZxahMoqQTGwXIDlO85xUkI60UBqCSv3cRav+aCSCYKc0QRBdeIWER3kDH/nqaE5no4mBEzKhjX1odk+2W1j1HW4cDLkWh9Rys2cYOR9YdPY8J3nZ/QLL8pE3xtPA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KIBBTadYAzwgWKhLHXb5uVO+QmwZomLE5kAOpVelWk8=; b=i3IukYaLJfj7eHwzSUaSFimHrrNl/D7BRC6kjD1v8vvHvWWSxEJUSQEhEwk769vyuWDn51N3lM1Twc3wHkH0HmDYEah6CwpYXxT1bPHFDfdz89+HDa5Z1rKxbjAeQlz1G4lc3aqT3I8W3O4F241UakfwKp9xl3VxfhKiJ0wuLRSXZ9DSNnSvQHqJ1e+GMcYhRneBFy5qoK2yj0eGfA62/iCzeU7iBv1yWy6QbIpyBomOhOG+UpDJdxedeF+ZgURukGgdkkNs5Z0+gcZfWGrk6mQ7M1nyuvGts/a0Bpiof12OvVq1OoxrwYHK8zKWTivc3NfGb5YeOk6tLA1BLIatkw==
Received: from BN8NAM11FT066.eop-nam11.prod.protection.outlook.com (2a01:111:e400:fc4b::41) by BN8NAM11HT160.eop-nam11.prod.protection.outlook.com (2a01:111:e400:fc4b::471) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23; Sun, 24 May 2020 15:04:53 +0000
Received: from CH2PR10MB3816.namprd10.prod.outlook.com (2a01:111:e400:fc4b::4b) by BN8NAM11FT066.mail.protection.outlook.com (2a01:111:e400:fc4b::394) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Sun, 24 May 2020 15:04:53 +0000
Received: from CH2PR10MB3816.namprd10.prod.outlook.com ([fe80::a45b:8caf:233d:23bd]) by CH2PR10MB3816.namprd10.prod.outlook.com ([fe80::a45b:8caf:233d:23bd%5]) with mapi id 15.20.3021.027; Sun, 24 May 2020 15:04:53 +0000
From: Irina Karpacheva <[email protected]>
To: "[email protected]" <[email protected]>
Subject: твой сын подохнет или овощем станет, лучше овощем, больнее тебе будет
Thread-Topic: твой сын подохнет или овощем станет, лучше овощем, больнее тебе будет
Thread-Index: AQHWMdxyOjf9VuydDU61CHRmQmLrZQ==
Date: Sun, 24 May 2020 15:04:53 +0000
Message-ID: <[email protected]od.outlook.com>
Accept-Language: en-CA, en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-incomingtopheadermarker: OriginalChecksum:D026866E35189E4B6E339BF7EBA79BA4EDB5ACA64E889997C04DFCD1E2EDC1C0;UpperCasedChecksum:80065897D9DB03E3A75632BF93491F2AE66C386F71754DE1C7870CC2A7D41870;SizeAsReceived:6843;Count:42
x-tmn: [C8eMyVKk9zsMqKhFDG5CyIuKUwuSigMo]
x-ms-publictraffictype: Email
x-incomingheadercount: 42
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: 95bc26f8-4b16-4398-5c65-08d7fff3d079
x-ms-traffictypediagnostic: BN8NAM11HT160:
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 86Ena5/jdW7nHIsGyhJNYPxi7slmrY/cIjE6sYq9R67VDOejhVOrBkZn1IFzrZilNR5jum8W8kKV8mPl0wEpSa6IgaJd1wauFeMHA6ZA6ty6/jA3OAiGYYiukR/WMaJ993KkHC6rynl0AD076t+uPnbg3/IWMRHvWxJ7xY/1p8nqGWL8VYdNp8o4Lg6aqresc+PFot+auhdshzyVzgHdLMorovWxYOm4XWRuu63WqBaNPIaNyyYekA2lki2JfffS
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:ru;SCL:0;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB3816.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:;DIR:OUT;SFP:1901;
x-ms-exchange-antispam-messagedata: 62siPqGeJ+YCT+aBncGHlGP9cUvwj/303Fis9lIHHwPYpColQB12OjH5Kj62fNKISBiBwyN2SYYDtvqqBYsGIo37QMiEXJPKz6NN5hPPLVRtuMvq0FPMBFzb8v/51xD363IAqIJBsY4neTlRCe5Q/w==
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_CH2PR10MB3816A2F4C5B5E6591FDCD4E5D7B20CH2PR10MB3816namp_"
MIME-Version: 1.0
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 95bc26f8-4b16-4398-5c65-08d7fff3d079
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 May 2020 15:04:53.5275 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8NAM11HT160

--_000_CH2PR10MB3816A2F4C5B5E6591FDCD4E5D7B20CH2PR10MB3816namp_
Content-Type: text/plain; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable



Get Outlook for iOS<https://aka.ms/o0ukef>

--_000_CH2PR10MB3816A2F4C5B5E6591FDCD4E5D7B20CH2PR10MB3816namp_
Content-Type: text/html; charset="koi8-r"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dkoi8-r">
</head>
<body>
<div dir=3D"ltr">
<div></div>
<div>
<div><br>
</div>
<div><br>
</div>
<div class=3D"ms-outlook-ios-signature" id=3D"ms-outlook-mobile-signature">=
Get <a href=3D"https://aka.ms/o0ukef">
Outlook for iOS</a></div>
</div>
</div>
</body>
</html>

--_000_CH2PR10MB3816A2F4C5B5E6591FDCD4E5D7B20CH2PR10MB3816namp_--

Answer 1

You won’t know in any way, you can write to Microsoft support to block the user. And then report it to the police. if you want, it really won't help much.

Answer 2

I do not understand where the iPhone came from? The letter was sent from MS Outlook, via corporate mail services - how much they cost - exch, forefront ... After all this, the letter was transferred to hotmail and came from there. Who it is - no one will ever tell you - because the connection logs are in Pindos, and they are unlikely to itch for us. Of course, you can write to the hotmail support, but this is most likely useless.

Is it possible to somehow understand from the original messages that they were sent from one iPhone?

beg your pardon, captain? Where did you get that here and some kind of iPhone?