Recently, on the SpamAssassin mailing list, someone was reporting that a newbie spammer seemed to have forgotten to replace variables with values. Someone else noted that the construction
Received: from 192.168.0.%RND_DIGIT
might lead to weird and impossible IP addresses.
Now, I really found that in my spam quarantine:
Received: from unknown (HELO service3.colo.trueswitch.com) \
([192.168.0.951]) (envelope-sender <rvadur@minermail.com>) \
by mail.trueswitch.com (qmail-ldap-1.03) with SMTP for \
<info@xxxxxxxxxxx.com>; Sun, 14 Jan 2007 22:54:12 -0000