Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

Most often, these kinds of emails are sent from either compromised hosts or open mail proxies. In either case, the most appropriate parties should be, and should appreciate, being contacted since it represents a threat on their network. Reporting can be tricky, however, since it is not always obvious where the message came from. The first two things you can do are send a copy of the email, with full headers, to

  • spam@access.ironport.com
  • spam@uce.gov

The first address is used by Cisco for receiving reports of missed spam in their Ironport spam detection engine. They monitor this mailbox and attempt to develop signatures for reported spam. So, eventually, the specific phish you received, should be caught by spam filters. The second address is maintained by the United States Federal Trade Commission. As partially described in the press release, the FTC will use reported messages to help build out investigations and cases against spammers. Again, given the highly difficult nature of performing such investigations, one should not expect results from sending messages here. However, given the effort involved, and the fact that it might be useful in going after spammers/phishers, it seems a worthwhile action to me.

The most immediately useful action is to contact the folks responsible for the source of the spam. We can use this information to locate compromised computers or accounts, open mail relays, etc, and respond in kind. Determining exactly where to send this information may be tricksome. If your organization has an Information Security Office, you can fall back to forwarding said email to them for processing. Otherwise, look at the from address, or plow through the headers to determine which mail server the message originated from.

From that IP address or domain you can look through the registrars to determine technical contacts, and forward the message to them. If you have a domain, then you can also attempt to use abuse@. That address was partially formalized in RFC2142, but is certainly in common use.

In all cases, you really need to forward the email with full headers in-tact. The specifics of how one does that will depend heavily on the specific mail client, but in almost all cases Forward As Attachment will work.

share|improve this answer
    
Good resources and explanation. The only thing I would add would be to contact the organization being impersonated. In this case the IRS might be interested in launching their own investigation. –  this.josh Aug 19 '11 at 7:33

You can also report it to the IC3, a partnership of the FBI,NW3C and Justice Bureau. http://www.ic3.gov/default.aspx

share|improve this answer

As far as I know, you can report spam to their e-mail and/or internet provider (if any is known). I know Yahoo, DaddyGo etc. even have special forms for reporting spam (try google e-mail provider and +"spam report", e.g. +yahoo +"spam report")

For general direction how to write complain e-mail to provider about spam spam.abuse.net.

For pshising, I would definitely also warm organization / site / whatever is used in attack.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.