-1

I received a spam email which scrambled the typical "to:" and "from:" fields. However, instead of spoofing the "from:" address, which is apparently the more common tactic, since there are articles about it like this one, this message actually did the opposite: it doesn't show my email address in the "To" field. Similar to this question in this community.

Now, this spam email actually provides a link to unsubscribe. However, I don't know immediately which address to provide because I have forwarding set up so that several different email addresses all forward to this Gmail inbox.

My question is: how to interpret all the text that can be found in the email's full header? This is Gmail's guide. It's quite bare. It also links to its Message Header Tool, but that also doesn't help in my situation. This is what the tool shows: enter image description here

This doesn't help, since the "To:" field points back to the spammer. In the DKIM field, my institution's domain shows up. (I blacked it out just in case, for privacy.) So, okay, I know now that the email has something to do with my institution, but I still have 2 email addresses affiliated with that institution!

I skimmed through the full text of the full header and I think I found it. But does anyone know how to be more sophisticated in interpreting it? For example, I see "Received:" followed by various text listed multiple times.

1

Your question is:

how to interpret all the text that can be found in the email's full header?

The IANA maintains a comprehensive list of message headers that provide detailed info about each header field.

Looks like your goal is to identify what was in the To field, then use that to unsubscribe from spam. Please note that it is not recommended to use the unsubscribe "feature" built in to spam email. From the information provided above, it's possible the spammer put your email address in the Bcc field - in which case it will not be visible to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.