This morning I received a mail from
Apple suspension UK <firstname.lastname@example.org> with the subject
Apple "Unauthorised transaction alert".
The mail was sent to one of my company's distribution groups, rather than to a real person; so I'm confident it is not genuine.
I reported this to our Exchange support team, who responded saying they'd blocked all mails from
I suspect that's the wrong course of action; since the sender's email address is presumably a valid one / likely to be used a lot by Apple; so now we've introduced an issue where no one will receive genuine mails from this address. Rather I assume the spammers spoofed this sender's address, so can just pick a different address and get through again.
- Is blocking a sender's mail considered a good approach?
- Is there something I could be doing (e.g. attaching the spam to a new mail and forwarding it to a service which will analyse it and highlight if it's a security risk / automatically work out a new signature to blacklist)?
Exerpts from Message Header:
Received: from mx0b-001b1801.pphosted.com (184.108.40.206) by Received: from pps.filterd (m0077987.ppops.net [127.0.0.1]) by Received: from 220.127.116.11 ([18.104.22.168]) by mx0b-001b1801.pphosted.com Received: from unknown (HELO 8erd) ([22.214.171.124]) by 126.96.36.199 with From: Apple suspension UK <email@example.com> Return-Path: firstname.lastname@example.org