3

This morning I received a mail from Apple suspension UK <do_not_reply@apple.co.uk> with the subject Apple "Unauthorised transaction alert".

The mail was sent to one of my company's distribution groups, rather than to a real person; so I'm confident it is not genuine.

I reported this to our Exchange support team, who responded saying they'd blocked all mails from do_not_reply@apple.co.uk.

I suspect that's the wrong course of action; since the sender's email address is presumably a valid one / likely to be used a lot by Apple; so now we've introduced an issue where no one will receive genuine mails from this address. Rather I assume the spammers spoofed this sender's address, so can just pick a different address and get through again.

Question:

  • Is blocking a sender's mail considered a good approach?
  • Is there something I could be doing (e.g. attaching the spam to a new mail and forwarding it to a service which will analyse it and highlight if it's a security risk / automatically work out a new signature to blacklist)?

Update

Exerpts from Message Header:

Received: from mx0b-001b1801.pphosted.com (148.163.158.1) by
Received: from pps.filterd (m0077987.ppops.net [127.0.0.1]) by
Received: from 190.106.222.31 ([190.106.222.7]) by mx0b-001b1801.pphosted.com
Received: from unknown (HELO 8erd) ([173.233.206.183])  by 190.106.222.7 with
From: Apple suspension UK <do_not_reply@apple.co.uk>
Return-Path: do_not_reply@apple.co.uk
  • What exactly to you consider the sender? Is it the From or the From:? Did you check the real origin of this forged E-mail? – dan Aug 12 '15 at 18:06
  • I've updated to the above with more detail; in the case of that address, it was the From:. – JohnLBevan Aug 12 '15 at 18:27
4

Blocking the senders e-mail address is unlikely to be an effective measure as spammers/malicious actors will commonly change the address they use on a regular basis. That said it's worth noting in this case that a quick search for do_not_reply@apple.co.uk shows the only indexed instances of this address being spam related, so it doesn't appear to be one that Apple use.

Generally the best response for individuals to these mails is to ignore them and do not open any attachments or follow any links that they contain.

At a network or company level the best approach is likely to make use of an anti-spam service which will attempt to idenify and block this kind of message. These systems will cut down on the volumes of spam that get through, although they are not perfect and there is always the risk of false-positives which could lead to legitimate mail being consigned to the spam folder of your mail system.

2

Short answer: no, you can't.


There are 3 senders to your E-mail. 2 fakes and one hidden and unreachable.

  1. The one you find within the headers:

    From:
    

    field is free. Anyone can put whatever he wants there. You can't trust it. You cant't build anything on this one. The edited sender of the E-mail you received is do_not_reply@apple.co.uk. It looks serious and real. It is neither. This is the signature of a phishing attack.

  2. The "envelope" from which is the one dealt between the sending MX and your MX. This "envelope" from might be reproduced by your MX if it is a professional one. In this case you will find it on the 1st line of the headers and recognize it to the fact that it starts with:

    From 
    

    (exactly "Fromspace"). This one can also be forged if the real E-mail sender is behind an ISP which permits direct 25/tcp connections. The effective sender of the E-mail you received is using a computer located at Mixco, Guatemala. But I might be wrong since your headers are truncated.

  3. The real sender which is only known by the first MX accepting its SMTP connection. This MX can know the real sender by looking at his MX connections log.

Most of the time, as in this case, you can't easily know this real sender, and you can't do anything efficient by blocking the From: or the From ones which are robot or hand edited.

If your company has a full time postmaster or chief security officer, you might forward him any suspect E-mail which wasn't blocked by your anti-spam. Provide them this E-mail untouched, with its full headers (you will need to transfer it as an attachement so as to preserve this key information). They might take advantage of your report to improve the anti-spam tuning of your company.

  • that "From " is not really a header, it will appear on mbox files and does not even need to be related to the contents. The envelope from will appear in the email headers as a value for the Return-Path: header (which is added by the last MX). – Ángel Oct 31 '18 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.