The headers will generally list the SMTP server where the email originated and the servers used to send the email...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
to your server. Once you've traced the email in question back to its origins, you will most likely find a botnet or some other infected systems was used to send it, which makes identifying the origins less useful . Emails sent from botnets will show up as coming from compromised PCs as SMTP servers or relays, whereas legitimate users' emails will display their ISP or employer's servers. If you do identify the origin of the email as a botnet-infected system, you will have only opened the first layer in identifying the source of the malware; stopping the malware will require more effort. However, if you do to determine the origins, you may want to consider reporting the systems used to the organization or ISP responsible for those systems, so they can try to get the systems cleaned up.
However, identifying the source of a malicious email or email attachment viruses and individually blocking an SMTP server is not an effective way to block spam. There are blacklisting, whitelisting and antispam services that will essentially do this for you and save you the effort of doing it yourself. Some services or software allow you to upload suspected or confirmed malicious email, so it can be added to the block list; these services will check many factors to see if the email is malicious. Also, it's a good idea to configure your email system and clients securely. For example, blocking any executable files being sent via email is a common way to prevent the spread of malware.
Dig Deeper on Email and Messaging Threats (spam, phishing, instant messaging)
Related Q&A from Nick Lewis
Conficker malware was found in a German nuclear power plant computer system. Expert Nick Lewis explains the possible impact of malware infections of ...continue reading
OneSoftPerDay, an adware program can install backdoors on PCs, is able to avoid detection from antimalware tools. Expert Nick Lewis explains how to ...continue reading
The hot-patching feature in Windows servers is vulnerable to attacks from APT groups. Expert Nick Lewis explains what hot patching is and how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.