Solved

How do I catch this spammer?

Posted on 2009-07-13
3
322 Views
Last Modified: 2013-12-09
I have a client who's been getting these bounce-backs to his email. I've tried to use the exchange message tracker, but the bounced messsages don't show up. I'm guessing that someone who associates with him has a spammer virus that is using the addresses in their mailbox as return addresses for spam. I have a copy of one of the bounces, and I see some interesting data, but I don't know what to do with it. Can someone tell me if there is anything in this that I could use to track down this spammer? The user and company name have been changed for privacy.
readthis.txt
0
Comment
Question by:numb3rs1x
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 65

Accepted Solution

by:
Mestha earned 500 total points
ID: 24845407
Short answer. No.
Long answer. Don't waste your time.

Spammers have a lot of techniques for hiding, the use of bots, compromised Exchange servers etc. Finding how is behind it is impossible.

The spammer will just be picking a random email address to use as the from field.
The real problem is the clueless network admins who reject spam AFTER delivery and try to send it back to the sender. The sender is always spoofed so this is a waste of time.

Simon.
0
 

Author Comment

by:numb3rs1x
ID: 24846512
Is there something I can do to prevent this?
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24847781
No.
Its known as back scatter. Under the terms of the RFC (which is basically the instructions as to how SMTP works) your server has to accept the NDRs. What you do with them after they have been delivered to your server is up to you.

Some may suggest SPF records, but that is an advanced antispam procedure. If those operating the software cannot get the basis correct - such as recipient filtering, then they are hardly going to be able to setup a rejection on the SPF record.

Simon.
0

Featured Post

MIM Survival Guide for Service Desk Managers

Major incidents can send mastered service desk processes into disorder. Systems and tools produce the data needed to resolve these incidents, but your challenge is getting that information to the right people fast. Check out the Survival Guide and begin bringing order to chaos.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
In this blog we highlight approaches to managed security as a service.  We also look into ConnectWise’s value in aiding MSPs’ security management and indicate why critical alerting is a necessary integration.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question