2

I am to analyze email headers for spam/phishing attempts. What is the methodology I should follow by only looking at the header? I know that I have to look at the from field, return-path, received, sender policy framework but can you provide some examples or some hints? How can I recognize through the various hops that it could be suspicious?

In particular I need to formalize an eventual theory about any possible fraud attempts. I want better understand:

  • what the first hop is actually describing, in the sense that it is a hop between the first Message Transfer Agent and the next one, meaning that it is not representing the hop between the machine of the user and the first mail exchange server, or could also represent this last situation? (For example I am analyzing some emails and in some cases the first hop is "from apache by "some domain" ", or "from user[IP number] by "some domain" ");
  • if there is a hop in which there is the name of the mail exchanger and also the IP next to it, in an enclosed parenthesis, but it looks like that the IP is in another country, what does it mean?
  • how should SPF be interpreted (the check refers the machine of the sending server so the first hop)?
1

These questions are a bit broad and confusing. Email headers often look different for a host of reasons.

what the first hop is actually describing, in the sense that it is a hop between the first Message Transfer Agent and the next one, meaning that it is not representing the hop between the machine of the user and the first mail exchange server, or could also represent this last situation? (For example I am analyzing some emails and in some cases the first hop is "from apache by "some domain" ", or "from user[IP number] by "some domain" ")

The first hop is generally the first MTA reporting it received the message. "From Apache" just means the server that sent it was running Apache. Typically, the actual users IP address, if present, is found in the X-Originating-IP field.

if there is a hop in which there is the name of the mail exchanger and also the IP next to it, in an enclosed parenthesis, but it looks like that the IP is in another country, what does it mean?

The names you see in an email header are fully qualified domain names (FQDN). They identify a particular machine on the Internet and within that domain. The IP address in paranthesis is the IP address of that machine so if it resolves to a certain country, that is where the machine is located.

how should SPF be interpreted (the check refers the machine of the sending server so the first hop)?

SPF puts a record in DNS with a list of all IP addresses authorized to send mail on behalf of the domain. Recipient mail clients check to see if the MTA sending the message they are receiving has an IP address that falls within those ranges. If it does, there is usually a denotation in the header that says Pass. If it does not, several things can happen depending on how the SPF policy is configured:

  • If the record ends in -all, messages will not be allowed through and you will see a Fail denotation in the header.
  • If the record ends in ~all, messages will be allowed through but they should be marked. You may see a None or SoftFail for these messages.

Other things that can be done is with regard to the hops is to check whether the FQDN's match up with the MX record for the domain. For instance, if sender Bob's domain foo-bar.com used Google to send mail, then you can expect to see Google FQDN's in his portion of the message path. This may at times require performing whois lookups on the domain names in question because they may not always be named in such a way that it will be obvious they belong to a certain organization.

Another test is to check whether the sending domain uses DKIM. If it does, and there is no DKIM signature present, that is a good indicator of a spoofed email.

  • If I have at the third receive field, a google mail exchange server receiving message and it performs the SPF check, in that case it is performing the check of the IP of the first MTA sending the email or of the MTA before google server? For what concern the first hop, we will never see the machine of the user but always the first MTA contacted by user email client or script for example, it is true? For the second point I wrote, I encountered a case in wich the FQDN was not found by making whois while the IP address yes or the IP address was in another country that the FQDN, what does it mean? – Myke Jun 21 '17 at 13:55
  • For example if I have as fisrt received: "Received: from apache by foo-bar.com with local (Exim 4.67)" this means that apache is the first MTA so we cannot understand where the email is actually coming from? Is it right?@Behnken – Myke Jun 21 '17 at 14:05
  • Can you give a full header as an example with domains redacted or changed? – J. Behnken Jun 21 '17 at 17:16
  • Received-SPF: None (protection.outlook.com: 000.nu does not designate [...] Received: from 000.nu ([27.109.155.5]) by COL004-MC5F15.hotmail.com with Microsoft SMTPSVC(7.5.7601.23143); Wed, 21 Jun 2017 15:38:51 -0700 Received: from unknown (HELO qrx.quickslick.com) (Thu, 22 Jun 2017 10:35:18 +1200) by mailout.endmonthnow.com with NNFMP; Thu, 22 Jun 2017 10:35:18 +1200 These are the first two hops andI report also the SPF check. @Behnken – Myke Jun 22 '17 at 6:59
  • So the initial SMTP connection was initiated by qrx.quickslick.com (it sends the HELO command). The SPF check reports None, and after those three dots it should say which IP address it checked against the SPF record. The only difference between None and Fail is the way the domain administrator configured her SPF record on how to handle inconsistent IP addresses. – J. Behnken Jun 22 '17 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.