Spammers Party like its 1995

One of the many techniques used when analyzing email messages is looking at "what" sent the email in addition to "who."

The headers of most email messages contain an "x-mailer" or "user-agent" parameter. These items are supposed to indicate the software used to compose and send the email.

Consider the following entry:

X-Mailer: AOL 2.0 for Windows US

Do you know anyone who uses AOL 2.0 still? When did it come out? 1995?

Still, thousands of spam email messages seem to be being sent daily under the guise of being composed in AOL 2.0. I'm not even sure if this is technically possible.

Spammers use various different software packages to send their messages. Many of these email senders have lists of possible mail clients to imitate. Obviously, if they set the user-agent as "Joe's Spam Sender 4.2" - all their messages would get filtered in short order.

Some times the software itself is antiquated. Other times, it may be the database of user-agents was generated by analyzing a set of messages which contained a lot of old message (like Usenet archives).

To the keen spam catcher this is an opportunity. Email messages sent by impossibly ancient email programs are almost certainly spam and should be filtered. Email sent via a server that must have been deployed circa 1999 is suspect, and should be subject to tighter criteria when filtering email.

Some software packages just leave out the user-agent. Since some legitimate email applications also do this, this is probably a fairly safe strategy.

Back