Is It Safe to Look, Just Look, At Spam?

Maybe

In otherwords, is opening and reading a message suspected to be spam dangerous?

Whlie there’s always risk, it’s not nearly as bad as it once was. As long as you follow a few precautions, you’re typically safe.

Looking at spam

You can usually look at spam without getting infected, but you still need to be careful. Don’t click links, even “unsubscribe.” Don’t show images, don’t download attachments, and don’t reply. If you’re curious, you can view the message source to investigate safely.

Don’t: click on links

You’ve covered this in your question, but I want to emphasize it: never click on a link in suspected spam, even if that link says “unsubscribe”. There’s no unsubscribing from spam, and a link that tells you otherwise is lying. Spammers lie.

The risk is that you’ll be taken to a malicious website. In the worst case you might download malware. In the more common case these days you’ll land on a phishing site: a page designed to look like an official site you might use, and fool you into entering your sign-in credentials. That’s handing over your credentials to a spammer.

Don’t: display images

It can be tempting to wonder what the images accompanying a message might show. Resist the temptation.

The images themselves are rarely malicious these days, but the act of displaying them can signal to the spammer that your email address is legit and read by a real person. The net result: more spam.

Don’t: download attachments

Many spam emails include attachments as part of their attempts to fool you. The email may look like some kind of legitimate message asking you to open the attachment for more information or details about some supposedly serious situation.

The attachment has malware. Hopefully, even downloading it to your PC will cause your anti-malware tools to flag it as such, but we can’t count on that. Don’t download it, and don’t open it if you do.

Don’t: Reply

Replying to spam does the same thing: it tells the spammer that your email address is legit and read by a real person. Again, the result: more spam.

It’s tempting to reply to spam in an attempt to tell the spammer to stop (or worse). There are many problems with doing so. To begin with, even if they do read your email, they’re not going to pay attention to it. Very often, spam is crafted in such a way that a reply goes to some innocent third party who has nothing to do with it at all.

Spam curiosity

I tend to look at suspected spam from time to time when I’m curious about where it came from, or if I’m investigating whether it actually is spam.

I’ll open it to view, and following my advice above:

• I don’t click any links.
• I won’t display the images (no matter how curious I might be).
• I won’t download any attachments.
• I won’t reply to it.

What I will do is “view source”.

Email source

Email is generally encoded in two sections:

1. the headers, which control and document how the message is routed across the internet.
2. the body, which is typically the HTML code that makes up the message you see.

The headers, other than the To:, From:, Date:, Subject:, and perhaps other common fields, are simply not displayed. They’re really just technical details that you normally don’t need to see.

The body is displayed as the rendered HTML … meaning rather than the raw HTML1 code that makes up the message, you see … the message.

Viewing email source

How you view the “source”, or “original”, or “raw”, or “headers” — all terms that refer to the email source code — will depend on the mail interface you’re using.

Given this “suspect” spam:

In my email interface2, clicking on the “Actions” menu gives me the option I’m looking for.

I click on Show raw message, and it’s a raw message I get:

That’s the first of 837 lines of information in the raw message. You can see it starts with various notations about spam detection, where the message came from, and more. Eventually (perhaps halfway down), the actual message body is included as well.

Analysing this information is typically what happens when deciding if something is or is not spam.

The good news here is that this, too, is safe to look at if you’re so inclined. As long as you don’t act on any of the URLs or email addresses you might find in the message source code, you’re fine.