How I Caught the Spam and What I Did With it When I Caught it - page 5

An Unpleasant Surprise

I'm out of space now (Ha ha, that's a joke; on the web you have as much space as you want. But actually I'm out of time because I have to go to Boulder now.)...so I'll continue next time. I'll show how to analyze the header that we just dismantled, and how to check the address against a lot of patterns at the same time to make sure it doesn't come from a known spammer. I'll also show a lot of heuristics that turned out to be useful for recognizing spam messages from the header. Here's a teaser: What's wrong with this picture?

����Received: from login_2961.sayme2.net(mail.sayme2.net[103.12.210.92])
������by sayme2.net (8.8.5/8.7.3) with SMTP id XAA02040 for creditc@aoI.net;
������Thu, 28 August 1997 15:51:23 -0700 (EDT)

Mark-Jason Dominus is a longtime Perl programmer, system administrator, hacker, and spam hater. He runs a Perl-related web site, and is not actually a pigeon fancier.