416 Morrill Hall of Agriculture Michigan State University 517-355-3776 http://support.anr.msu.edu support@anr.msu.edu Reporting Spam/Phishing Emails What are Spam or Phishing Emails? Spam email is unsolicited bulk email, or junk mail. The sender typically delivers nearly identical messages to a group of random recipients. Clicking on links in spam email may send users to phishing web sites or sites that are hosting malware. Phishing is an email fraud attempt in which the sender delivers a legitimatelooking email in an attempt to gather personal or financial information from recipients. Typically, the messages disguise themselves as being from trustworthy companies or web sites. Why does Proofpoint not stop these emails? The Proofpoint Protection Server filters all incoming email. Based upon the Proofpoint Protection Server rules and policies, messages are scored. The message score indicates the probability that the message is spam. A message scoring 100 would have 100% chance of being spam while a message scoring 0 would have 0% chance of being spam. Messages scoring high enough to probably be spam are quarantined, and messages scoring below 50 are sent directly to your inbox. Spam and phishing attempts are designed to evade these protection servers rules and policies so they reach their target. For more information regarding Proofpoint: http://support.anr.msu.edu/support/proofpoint_filter Why report these emails? The Proofpoint system is designed to learn from what is reported back to the system as Spam. By sending the ANR STAT team your examples, we can increase the likelihood of this not occurring in the future. Also, we can block the sender s address if the administrator feels the threat is likely to happen again.
How to report (send) potential Spam/Phishing emails: (Click on your email version below to be instantly directed to those instructions.) Outlook 2010, 2011 or 2013 Outlook Web Access 2010 (OWA) Outlook Web Access 2013 (OWA) Using Outlook 2010, 2011 or 2013 o Open a new email and address it to anrts-networkservices@anr.msu.edu o Enter the subject line, Reporting Spam or Reporting Phishing o Drag the suspected message from the Inbox to the new message. This will add the suspicious email as an attachment to the new message. Due to needing to examine the original email headers, the administrator cannot work with a forwarded copy of the email; it must be an attachment. An example of an attached email to the ANR STAT team:
Using Outlook Web Access 2010 (OWA) (http://mail.collegemail.msu.edu or http://mail.anr.msu.edu) Since an email cannot be saved from OWA, the following steps must be taken: o Open the suspect email o Click on the Message Details button o Highlight the text in the Internet Mail Headers text box
o Copy the selected text (Ctrl C or right-click on the highlighted text and select, Copy. ) o Open a new Word or Text document on your computer o Paste the copied text into the Word or Text document (Ctrl V or right-click and select, Paste. ) o Save the document to your desktop as Headers. o Create a Forwarded message from the suspect email o Address the email to anrts-networkservices@anr.msu.edu o Attach the Headers document to the Forwarded email and send.
Using Outlook Web Access 2013 (OWA) (http://mail.collegemail.msu.edu or http://mail.anr.msu.edu) Since an email cannot be saved from OWA, the following steps must be taken: o Open the suspect email o Click on the button to see further options o Select View message details o Highlight the text in the Message Details text box o Copy the selected text (Ctrl C or right-click on the highlighted text and select, Copy. )
o Open a new Word or Text document on your computer o Paste the copied text into the Word or Text document (Ctrl V or right-click and select, Paste. ) o Save the document to your desktop as Headers. o Create a Forwarded message from the suspect email o Address the email to anrts-networkservices@anr.msu.edu o Attach the Headers document to the Forwarded email and send.