How to submit spam, and false-positive spam samples to SophosLabs

This article describes how to email spam, and false-positive spam samples to SophosLabs.

For information regarding the submission of files that you believe may have malicious content, refer to the knowledgebase article 11490: Submitting samples of suspicious files to Sophos (inglés)

How to email spam, and false-positive spam samples to SophosLabs

It is preferred that you send samples as RFC-2822 attachments. Submitting in any other format can cause the loss of key message content, which may prevent SophosLabs from effectively analyzing the samples.

Email spam samples to :

Email false-positive spam samples to :

What to do

From Microsoft Outlook

1. Create a new email message

2. Address it to :

   

   or :

   

3. From your Inbox, select the spam email that you received - you must select the email, not the content.
4. Drag and drop the selected item(s) into the new email.
5. This will now show as an empty email with the suspect email as an attachment.
6. Send the email to Sophos at the address you selected above.

From Mozilla Thunderbird

1. Select the sample
2. From the toolbar choose Message > Forward > Attachment

3. Address it to :

   

   or :

   

4. Send the email

From Lotus Notes

Sophos cannot recommend a default method for attaching RFC-2822 messages, but the following options are available:

• Send the message direct to your Sophos Technical Support contact:
  • create a new email message addressed to your support contact
  • open the spam message, select View > Show > Page Source
  • copy and paste the Page Source content into the new email
• Use the free third party enhancement software, 'Open-NTF'. This adds a menu option, 'Forward MIME to RFC-2822', to the Tools button. Use this to forward the email.

From other email clients

With other email client use the option 'Forward As Attachment'. You should discuss this with Sophos Technical Support before sending in a sample in this way.

Further information

• Spam samples sent to:

  

  and

  

  as RFC-2822 attachments will be automatically processed by systems within SophosLabs.

• You will not receive feedback for emails messages sent to these addresses.
• Samples sent to these addresses will not necessarily be considered to be, or detected as, spam.

If you believe that an item should be detected, raise the matter with Sophos Technical Support.

If you wish to submit spam samples to support, attach the entire message source.