Number Domains?

[Broggs]

I'm getting spam with return paths like this:

Return-Path: 22142-169497@154.0xa4.00000115.0332

Using all-numbers is new to me.  How is this valid?  It should be rejected outright by the server.

 

[rconner]

Actually, very little of what is in the header is trustworthy, other than the relay information (and only those lines added after the message left the spammer's control). 

This is clearly gibberish.

Actually, it does seem to be an IP address in a weird form (first octet decimal, second in hex, last two in octal). Not worth decoding it, though, since it is undoubtedly forged. This might be enough to get past any server that tries a basic sanity check on the return path.

-- rick