Report Harassing, Fraudulent or Unwanted Email

If You Receive Harassing Email

1. Do not delete the email. You need to keep it as evidence.
2. Assess the situation. If you believe that you are in immediate danger, contact your local law enforcement agency immediately! On the UCSB campus, contact the police at 9-911.
3. If you are not in immediate danger, please follow the guidelines below.

If You Receive Spam or Phishing

The first step if you receive spam or phishing email is to find and copy the message with full email headers. If you report a case of harassment, abuse, unsolicited commercial email, chain-letters, phishing, or other potentially harmful communication, you must send a complete copy of the message with full email headers to security@ucsb.edu. Full headers allow us to track a message back to the IP address from which it was sent. Received: headers are extremely difficult to forge and can be used to identify the source of the offensive email. A message without full headers cannot be tracked. 

Scroll down to see the difference between full and incomplete headers. 

How to display and send full headers in various email programs

UCSB Connect Mail and Gmail

1. Open the Gmail message.
2. Click the three vertical dots to the right of the Reply button (top right of the message pane).
3. Select Show Original from the drop-down menu. The full headers will appear in a new window.
4. Copy the entirety of the text that appears in the new window.
5. Compose a new email with an appropriate subject or open a reply to an existing relevant email thread.
6. Paste the entire message into the body of the new email.
7. Send to the appropriate address (typically security@ucsb.edu).

Thunderbird

1. Open Thunderbird and click the relevant message in the reading pane to open it in a new tab or window.
2. Select View > Headers > All to display the full message headers.
3. Copy and paste the full text into an email to the appropriate address.
4. Select View > Headers > Normal to revert.

Microsoft Outlook (Desktop)

1. Double-click the relevant email message to open it outside of the Reading Pane.

2. Click File > Properties.

3. Header information appears in the Internet headers box. You can highlight all text in the box by pressing Ctrl+A, press Ctrl+C to copy, and paste it into a new email or in a reply to an existing email thread.

Apple Mail

1. Click on the message.
2. Go to the View menu.
3. Select Message.
4. Select All Headers. The full headers will appear in the window below your Inbox.
5. Copy and paste or Forward the message to appropriate address. To revert to normal headers, choose View > Message > Default Headers.

Other email sources

• An opened message will have a Message Source tab, which will contain the headers.
• Right-click on a message, select View and double-click on the Mime.822 file to see the headers.
• Right-click on the message and select Forward as Attachment to include the headers with the forwarded message.

In most situations, people are interested in seeing only the first few headers on a message (From, To, Cc, Subject, and Date), so most email programs such as Gmail, Outlook, Thunderbird and Apple Mail display only those when the recipient reads the message or forwards it. The rest of the headers are masked. Unfortunately, those first few headers are easy to forge, and this commonly occurs in cases of harassment, viruses, junk email, or chain-letters.

What full headers look like

—————–Begin Example of Full Header—————–

Delivered-To: jqucsb@ucsb.edu

Received: by 10.220.150.3 with SMTP id w3cs127581vcv;

Tue, 4 Oct 2011 14:49:35 -0700 (PDT)

Received: by 10.236.156.33 with SMTP id l21mr9893981yhk.24.1317764974722;

Tue, 04 Oct 2011 14:49:34 -0700 (PDT)

Return-Path: <xyzabc@ucsb.edu>

Received: from uni02mi.unity.ucsb.edu (uni02mi.unity.ucsb.edu. [152.1.2.225])

by mx.google.com with ESMTP id q64si7645508yhm.106.2011.10.04.14.49.34;

Tue, 04 Oct 2011 14:49:34 -0700 (PDT)

Received-SPF: pass (google.com: best guess record for domain of xuzabc@ucsb.edu designates 152.1.2.225 as permitted sender) client-ip=152.1.2.225;

Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain ofxyzabc@ucsb.edu designates 152.1.2.225 as permitted sender) smtp.mail=xyzabc@ucsb.edu

Received: from psmtp.com (na3sys009amx171.postini.com [74.125.149.97])

by uni02mi.unity.ucsb.edu (8.14.4/8.14.4/Nv6.2010.0805) with ESMTP id p94LnXE9013797

for <jqucsb@ucsb.edu>; Tue, 4 Oct 2011 17:49:34 -0400 (EDT)

Received: from na3sys009aog108.obsmtp.com ([74.125.149.199]) (using TLSv1) by na3sys009amx171.postini.com ([74.125.148.10]) with SMTP;

Tue, 04 Oct 2011 17:49:34 EDT

Received: from mail-iy0-f177.google.com ([209.85.210.177]) (using TLSv1) by na3sys009aob108.postini.com ([74.125.148.12]) with SMTP;

Tue, 04 Oct 2011 14:49:34 PDT

Received: by mail-iy0-f177.google.com with SMTP id r31so1594200iar.22

for <jqucsb@ucsb.edu>; Tue, 04 Oct 2011 14:49:33 -0700 (PDT)

MIME-Version: 1.0

Received: by 10.231.48.149 with SMTP id r21mr2914117ibf.95.1317764972336; Tue,

04 Oct 2011 14:49:32 -0700 (PDT)

Received: by 10.231.37.131 with HTTP; Tue, 4 Oct 2011 14:49:32 -0700 (PDT)

In-Reply-To: <CAMjWoEV3JXvpvy9=SZdrsH3znJ0itQnMuMC5SpEutmgCuUdnaA@mail.gmail.com>

References: <CAMjWoEV3JXvpvy9=SZdrsH3znJ0itQnMuMC5SpEutmgCuUdnaA@mail.gmail.com>

Date: Tue, 4 Oct 2011 17:49:32 -0400

Message-ID: <CAGA6UiiDxTad=T4qQ3MVAa45JP=f3Y9XQjcfKEZ0mBjRJ=-s4w@mail.gmail.com>

Subject: Fwd: Mail headers solution

From: XYZ ABC <XYZ_ABC@ucsb.edu>

To: John Q ucsb <jqucsb@ucsb.edu>

Content-Type: multipart/alternative; boundary=000e0cd1af2e12d75d04ae80119c

X-pstn-neptune: 0/0/0.00/0

X-pstn-levels:     (S:99.90000/99.90000 CV:99.9000 FC:93.6803 LC:95.5390 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )

X-pstn-settings: 1 (0.1500:0.0225) cv GT3 gt2 gt1 r p m c

X-pstn-addresses: from <XYZ_ABC@ucsb.edu> [18/1] [the rest of the message would appear here] 

—————End Example of Full Header——————-
 

What full headers do not look like

————Begin Example of Incomplete Header————

Date: Thu, 16 May 2002 13:54:19 -0400 (EDT)

From: XYZ ABC <xyzabc@ucsb.edu>

Reply-To: jqucsb@ucsb.edu

To: noone@ucsb.edu

Subject: Pager List

[the rest of the message would appear here]

———-End Example of Incomplete Header—————–