Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like this:

Received: from ecb-mx-out1.example.com (ecb-mx-out1.example.com. [<ip_of_example.com>]) 

that makes me think the address isn't just being spoofed, since it looks like the SMTP server sending out the messages is coming from the school district. I don't know that for sure, however.

If I choose to contact the district's IT department, what information would be helpful for me to provide? Or, since it's clearly possible that the address was merely spoofed, is it just a bother if I contact them and it's more beneficial to them if I just ignore it?

I can post the full message headers if necessary, but I'll probably remove the school district's name/IP address if I do.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

You've hit the nail on the head - at the very least, provide the full headers from one of the spam emails.

However, I find it most useful when I get a sample of several of the spam emails (say, 3-10, if you have that many) because that allows me to see if the spammers are employing other methods, like changing the message content, subject, or format.

It's usually easiest to create a new email message, then drag and drop the spam emails into it. This adds them as an attachment, complete with headers. (Works in Outlook, Outlook Web, and Thunderbird, and many more I'm sure).

Edit: I forgot to mention; THANK YOU for asking what information would be most useful. The world would be a better place if everyone did that :)

share|improve this answer
1  
On average, having spam email(s) as an attachment to my email won't trigger a spam filter and get my email marked as spam, right? –  John Bensin Mar 21 '13 at 0:42
2  
@JohnBensin maybe you could send an email first explaining the situation and that you will be sending some examples, then send the message with the attachments. Then even if it is caught by a filter, they will be expecting it and can check the spam. –  Dave Mar 21 '13 at 1:29
add comment

The most common problem is an open relay. If an e-mail server is not properly secured, it will send out messages for any domain and e-mail account that it is asked to send out. The best bet is to contact the organization to make them aware of the issue. If you do a DNS request, they may have a mail administrator specified in their DNS. If not, you can use the WHOIS data to contact them. If that is private as well, then the best bet is probably to find some contact info on their site.

Generally the best bet for what to provide them is to simply give them a copy of the SPAM e-mail. It gives them the most information about what happened and lets them know what is being done in their name. I typically notify an organization even if the e-mail is being spoofed so that they can send a warning to their customers if there is a potential for phishing or damage to their reputation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.