随着互联网应用的深入，越来越多的企业将邮件系统整合为自身的业务系统之一。在这种情况下，泛滥的垃圾邮件对企业的正常业务造成了巨大的影响，不论大型企业还是中小企业，都无法避免。从全球的统计看，互联网上70%的邮件都是垃圾邮件，这些邮件不仅浪费用户大量的处理时间，而且大量病毒、URL链接、股票欺诈信息业在其中传播，危害巨大。
硕琦科技经过多年研发，推出了最新的防垃圾邮件技术-Protocol Scan™(通信协议扫描)技术,这个技术的核心是通过研判邮件发件者的动机、行为、方式是否符合SMTP协议的要求进而判断其是否为垃圾邮件的。而以此技术为核心开发出的Anti-Spam引擎目前已经过众多企业实践检验确实有效，且已获得国内外各权威技术机构认可。是为企业阻挡垃圾邮件的强力卫士。
今天我们主要讨论的是Protocol Scan™(通信协议扫描)技术如何阻挡匿名垃圾邮件，匿名是一种常见的，典型的垃圾邮件发送行为，此种垃圾邮件的发送者通常会隐瞒自己的发信人信息，发信主机信息。接下来，我们通过一封具体的事例来了解Protocol Scan™(通信协议扫描)技术是如何阻挡匿名垃圾邮件的：
以下是一封被匿名解析行为识别代号：bkeef44511识别并阻挡的匿名垃圾邮件的邮件标头：
Received: (qmail 19403 invoked by uid 510); 1 Aug 2007 11:26:08 +0900
Received: from unknown (HELO ADMIN001) (info@64.136.204.123)
by 0 (qmail 1.03 + ejcp v14) with SMTP;
1 Aug 2007 11:26:08 +0900
From: "Piwep" <>
To: "hzbail" <***@***.com>
Subject: =?GB2312?B?uMTWxteq1sbW0Mjnus7SwLeossPUsTg1Mjc1?=
Date: Wed, 1 Aug 2007 10:24:56 +0800
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: base64
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
红字标注部分 Received: from unknown (HELO ADMIN001)表明其发送邮件主机没有宣告，类型为unknown.
From: "Piwep" <> 表明其发件人没有宣告，为空
从这里我们可以看出这是封典型的匿名发送的垃圾邮件。
我们再来看下系统底层这封邮件的日志信息：
Aug 1 17:31:53 st sendmail[15383]: l719VrcB015383: original.SourceRoute=[222.122.56.195], SenderHost=.ss7.newseoul.com
Aug 1 17:31:53 st sendmail[15383]: l719VrcB015383: connection:0, rate:1
Aug 1 17:31:53 st sendmail[15383]: l719VrcB015383: From: "Piwep" <>
Aug 1 17:31:53 st sendmail[15383]: l719VrcB015383: EnvelopeTo:<***l@***.com>
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Received:(qmail.19403.invoked.by.uid.510);1.Aug.2007.11:26:08+0900
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Received:from.unknown(HELO.ADMIN001)(info@64.136.204.123)by.0(qmail.1.03+ejcp.v14)with.SMTP;1.Aug.2007.11:26:08+0900
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: ReceivedBy:0,inputSource:[222.122.56.195],inputHost:ss7.newseoul.com
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: HeaderReceived:from.unknown(HELO.ADMIN001)(info@64.136.204.123)by.0(qmail.1.03+ejcp.v14)with.SMTP;1.Aug.2007.11:26:08+0900\233;
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: CheckHost:
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: From:Piwep<>
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: To:***<***@***.com>
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Ori_Subject:=?GB2312?B?uMTWxteq1sbW0Mjnus7SwLeossPUsTg1Mjc1?=
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Sub:=?GB2312?B?uMTWxteq1sbW0Mjnus7SwLeossPUsTg1Mjc1?=
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Date:Wed,1.Aug.2007.10:24:56+0800
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: MIME-Version:1.0
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Content-Type:text/plain
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: Content-Transfer-Encoding:base64
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: X-Priority:3
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: X-MSMail-Priority:Normal
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: X-Mailer:Microsoft.Outlook.Express.6.00.2800.1106
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: X-MimeOLE:Produced.By.Microsoft.MimeOLE.V6.00.2800.1106
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: SourceRoute=[222.122.56.195], SenderHost=.ss7.newseoul.com, DNSLookUp=.FAIL
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: ClientAddress=.222.122.56.195, ClientName=[222.122.56.195]
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: envelopeRecipients=.1, HopCount=.1, InnerHops=
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: verify=, auth_authen=, auth_author=, auth_ssf=, auth_type=
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: MessageSize=, BodyType=
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: f=, g=, h=[192.168.2.230], SenderName=
Aug 1 17:31:54 st sendmail[15383]: l719VrcB015383: STResult=quarantine, CodeID=bkeef44511
Aug 1 17:31:55 st sendmail[15383]: l719VrcB015383: from=<>, size=6840, class=0, nrcpts=1, msgid=<200708010931.l719VrcB015383@st.emaildisk.com>, proto=ESMTP, daemon=MTA, relay=[222.122.56.195]
