Email bomb scares in Italian schools: how anonymous emails work (and what businesses can learn)
On 11 and 12 November thousands of Italian schools received threatening emails from apparently untraceable senders. Without alarmism — the authorities themselves spoke of an almost non-existent concrete risk — it is worth understanding the technical side: how anonymous emails are made, why their senders are not really invisible, and which defences every business should have on its own domain.
What happened, in short
On Wednesday 11 November an email signed «Andropov» reached about 6,300 Italian schools, with bomb threats and apocalyptic language. On Thursday 12 a second wave hit a further 1,800 schools, plus the Prime Minister's office and a Rome court, signed «Mikhail Andropov» and sent — according to early findings — from several addresses using domains registered in the Philippines. Rome's anti-terrorism prosecutors are investigating for false alarm and aggravated threats; the government asked schools to carry on normally, and the Education Minister himself described the concrete risk as «almost non-existent». Similar waves have also been seen in France.
A business owner can read this story in two ways: as news, or as a chance to understand how email really works — because the very techniques used to scare schools are used every day, on a smaller scale, against companies.
How an «anonymous» email is sent
Email was born in the eighties, when the network was a club of universities that trusted each other. The sending protocol (SMTP) reflects that trust: the «From» field is a simple label, like a name handwritten on the back of an envelope. By default, nobody checks that it matches the real author. Hence the three typical routes for whoever wants to hide:
- Spoofing: sending a message while declaring a sender different from your own. Technically trivial, it is the basis of almost all phishing.
- Throwaway accounts and domains: mailboxes opened with fake data at uncooperative foreign providers, or domains registered on purpose — like the Philippine domains of these days — meant to live a few hours.
- Anonymisation chains: VPNs, the Tor network, compromised servers used as springboards, so the IP address appearing in the logs is not the real one.
Anonymous, but not invisible
«Anonymous» does not mean «untraceable». Every email carries its full headers: the chain of servers it passed through, timestamps, IP addresses. Providers keep logs, investigators can request them and international cooperation — however slow — works: many authors of past fake alarms were identified, often because one link in the chain (a VPN paid with their own card, an unprotected login, a repeated detail) gave them away. It is patient work best left to the postal police: the alleged crimes, false alarm and aggravated threats, are no pranks.
What this has to do with your business
The same techniques have a quieter, everyday version that targets companies:
- the fake supplier invoice, identical to the real ones, with a different IBAN;
- the email that looks like it comes from the owner and asks the accounts office for an urgent transfer (the so-called CEO fraud);
- phishing sent to your customers using your domain as the sender — with your brand paying the reputational price.
The three acronyms that protect your domain
Against the spoofing of your own domain there are three standard tools, configured once in your DNS and working forever:
- SPF: the public list of servers authorised to send on behalf of your domain. Whoever sends from outside the list gets flagged.
- DKIM: the digital seal. Every outgoing message is signed; if someone alters or forges it, the seal does not match.
- DMARC: the rule telling recipients what to do with messages that fail the checks — and this is the point. With a
p=nonepolicy the forged message is delivered anyway; withp=rejectit is discarded. A great many SMEs have DMARC missing or left on «none»: the protection exists on paper, but the door is open.
The check takes five minutes: ask whoever manages your domain how SPF, DKIM and DMARC are configured — and with which policy. If the answer is vague, it is time to fix them.
If a threatening or suspicious email arrives
- Do not reply and do not click: the text itself does not infect, but attachments and links can.
- Keep the original without forwarding an altered copy: headers matter to investigators.
- Report it to the postal police (in Italy, Polizia Postale), also through the official portal: it is the right channel, for threats as for scams.
- Inside the company, adopt one fixed rule: every IBAN change or urgent payment is verified by voice, on a number you already know. Always.
In short
The email alarms that reached thousands of Italian schools on 11 and 12 November 2026, signed «Andropov» and sent from foreign domains, exploit a historical weakness of email: the sender is not verified by default. Anonymous emails are built with spoofing, throwaway accounts and anonymisation chains, but they are not invisible: headers, provider logs and international cooperation often lead to the authors. For businesses the lesson is concrete: the same techniques fuel fake invoices, CEO fraud and phishing against customers. The defences exist and are called SPF, DKIM and DMARC — with a p=reject policy, not «none» — plus one golden rule: payments are verified by voice. Faced with a threatening message: no clicks, keep everything, report it to the police.
Frequently asked questions
Can the sender of an anonymous email really be found?
Often, yes. Headers reveal the chain of servers, providers keep access logs and operational mistakes (a VPN in one's own name, a login from a personal network) do the rest. It takes time and legal requests, but identifications do come.
Can I stop someone from using my domain as a sender?
Yes, to a large extent: with SPF, DKIM and DMARC configured with a strict policy (p=reject), forged messages claiming your domain are discarded by recipients that enforce the checks — which by now means all major providers.
Is opening a threatening email dangerous for my computer?
Reading the text is not. The risk lies in attachments and links: do not open them. When in doubt, have the message analysed by whoever manages your email.
Why did schools evacuate if the risk was deemed almost non-existent?
Out of caution: faced with a threat, however implausible, protocols require checks. That is the collective cost of these acts — and one of the reasons the law punishes them as false alarm.
At A126 we support companies through digital transformation: websites and e-commerce, custom management software, security and strategic consulting. If you want a check-up of your domain's email configuration, get in touch for a free consultation.
A126 Corporate Advisors — digital transformation for businesses and professionals.