How do I catch this spammer?

I have a client who's been getting these bounce-backs to his email. I've tried to use the exchange message tracker, but the bounced messsages don't show up. I'm guessing that someone who associates with him has a spammer virus that is using the addresses in their mailbox as return addresses for spam. I have a copy of one of the bounces, and I see some interesting data, but I don't know what to do with it. Can someone tell me if there is anything in this that I could use to track down this spammer? The user and company name have been changed for privacy.
readthis.txt
numb3rs1xAsked:
Who is Participating?
 
MesthaConnect With a Mentor Commented:
Short answer. No.
Long answer. Don't waste your time.

Spammers have a lot of techniques for hiding, the use of bots, compromised Exchange servers etc. Finding how is behind it is impossible.

The spammer will just be picking a random email address to use as the from field.
The real problem is the clueless network admins who reject spam AFTER delivery and try to send it back to the sender. The sender is always spoofed so this is a waste of time.

Simon.
0
 
numb3rs1xAuthor Commented:
Is there something I can do to prevent this?
0
 
MesthaCommented:
No.
Its known as back scatter. Under the terms of the RFC (which is basically the instructions as to how SMTP works) your server has to accept the NDRs. What you do with them after they have been delivered to your server is up to you.

Some may suggest SPF records, but that is an advanced antispam procedure. If those operating the software cannot get the basis correct - such as recipient filtering, then they are hardly going to be able to setup a rejection on the SPF record.

Simon.
0
All Courses

From novice to tech pro — start learning today.