4

I think I received a phishing mail and I want to forward the email header/source to the company mentioned in the mail.

Is there any sensitive information in the header or source, besides the email text and addresses? For example, I saw that the antivirus (and version) used to check mail was mentioned.

|improve this question
  • What do you hope to accomplish by sending the email header to the company? – Tom K. Apr 3 '18 at 14:58
  • To show that the mail is legitimate and it comes from their domain (no change in the "reply to" field). The mail asks for some information that should not be required and is very suspicious and does not have any links to click. so maybe they got a mail account compromised... – LuisF Apr 3 '18 at 15:34
  • LuisF: reply-to isn't even intended to show where an email comes from, and without DKIM it isn't secured in any way, so for probably 98% of phish-food it is faked. – dave_thompson_085 Apr 4 '18 at 9:10
  • Ok Thank you, anyway the reply field points to their domain so the only way for the bad actor to get information is when I reply the mail (as there are no links or attached files in the original mail) – LuisF Apr 4 '18 at 9:47
3

It depends on what you classify as sensitive. The following is a (not comprehensive) list of things that could be contained in an email header that an attacker could make use of.

If you consider any of the following sensitive the answer is yes.

  • Sender and recipient email addresses
  • Server names, which could reveal FQDN of your internal domain
  • Your organisations public IP address
  • Information on servers that have handled the email
  • TLS/SSL info & what ciphers you use (or don’t use)
  • Banner information
  • Email gateway details
  • What Anti-Virus you use to scan email
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.