I use a program called Mailwasher.
Normally it will show the email address of the originator. I received an authentic email purporting to be from my ISP; it looked very authentic. It failed as the sender's address was
[email protected]. The Mailwasher has a button that shows the source of the message. Hidden in there you may find a dot RU or Russia. Or you may find a web address.
Strip out the suffix and look at the basic web address. I have found a gym in the US, lawyers in South America etc. Their servers have been penetrated.
Without doing anything send a phishing report. If you want to delete first try Mailwasher, it is freeware.