Head blueLogoText.gif NCF HelpWiki
Help | StartPage


From Support
Revision as of 17:52, 18 January 2018 by Fn352 (talk | contribs) (→‎Tracing IP addresses: seems broken)
Jump to navigation Jump to search

Email spoofing is the faking of email addresses to disguise who is sending the email to you. This is often used by people sending spam and malware in an attempt to fool you into reading their advertisements or into opening the attachments and infecting your computer, especially with ransomware.


Because the core protocols for email do not prevent it, it is easy for someone to send you an email using a fake address for the sender. This can be done to fool you into opening the attachments or to try to fool spam filters into letting the email through to you.

A common trick is to use the recipient's email address as the sender's as well, in other words the email will appear to come from you. This is used to fool spam filters as most people don't filter out their own address, but it is a easy-to-recognize indication that you are dealing with a spoofed address.

So where is it really coming from?

Emails on their own are safe to open, although their attachments may not be.

If you want to find out where the email is really coming from you need to check the email headers ("show original"), as shown here in Zimbra, NCF's webmail interface:

Zimbra8 advanced show original.png

Here is an example of a set of email headers from a spoofed email:

Return-Path: youraddress@ncf.ca
Received: from localhost (LHLO mail.ncf.ca) ( by melkor.ncf.ca
with LMTP; Wed, 16 Sep 2015 19:08:57 -0400 (EDT)
Received: from mail.ncf.ca (localhost [])
    by mail.ncf.ca (Postfix) with ESMTP id A8607A0547
    for <fn352@ncf.ca>; Wed, 16 Sep 2015 19:08:55 -0400 (EDT)
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on melkor.ncf.ca
X-Spam-Status: No, score=-0.0 required=6.0 tests=BAYES_00,FSL_BULK_SIG,
    RCVD_IN_MSPIKE_H2,T_REMOTE_IMAGE autolearn=no autolearn_force=no version=3.4.0
X-Spam-Virus: No
Received: from mx1.ncf.ca (pallando.ncf.ca [])
    by mail.ncf.ca (Postfix) with ESMTP id 942A5A051C
    for <fn352@ncf.ca>; Wed, 16 Sep 2015 19:08:55 -0400 (EDT)
DKIM-Filter: OpenDKIM Filter v2.9.1 mail.ncf.ca 942A5A051C
Received: from mx1.ncf.ca (localhost [])
    by mx1.ncf.ca (Postfix) with ESMTP id 73766BEE75
    for <fn352@ncf.ca>; Wed, 16 Sep 2015 19:08:55 -0400 (EDT)
X-Greylist: delayed 420 seconds by postgrey-1.34 at pallando; Wed, 16 Sep 2015 19:08:55 EDT
Received: from smtpg-pc.aruba.it (smtp217-pc.aruba.it [])
    by mx1.ncf.ca (Postfix) with ESMTP id 0D616BEE7C
    for <fn352@ncf.ca>; Wed, 16 Sep 2015 19:08:54 -0400 (EDT)
Received: from WORLDST-UQ3K9Q0 ([])
    by smtpcm2-pc.aruba.it with bizsmtp
    id Hz0g1r0094yo4K101z1GXd; Thu, 17 Sep 2015 01:01:54 +0200

The "received" sections show the IP addresses which the mail has travelled through and ultimately originates from. The IP addresses in the header are shown in bold to make them stand out. Because the bottom one is the originator, it can now be traced to see where it comes from.

Tracing IP addresses

Tracing IP addresses is fairly easy using tools like whois on Linux. They can also be traced through the websites of the IP registration authorities:

If an address is not found in one registry, it will probably be in another one.

In the case of the header example above the IP address traces to Telefonica de Argentina in Buenos Aires, Argentina, so you can be sure it did not originate with NCF and that the return address is spoofed.

What next?

Delete it, it is spam, but at least you are now sure that it is.

External links