[Mimedefang] New spammer trick?

[Mark]

----- Original Message ----- 
From: "Joseph Brennan" <brennan at columbia.edu>
To: <mimedefang at lists.roaringpenguin.com>
Sent: Tuesday, November 25, 2003 5:28 PM
Subject: Re: [Mimedefang] New spammer trick?


> > Luckily, in all three cases, the spammer's software
> > says "HELO roaringpenguin.com"
>
> The more common one we see is HELO with our server's IP
> address (not in [] brackers either). Rejecting that really
> pays off.

Yes, I have been doing that too. Very effective, indeed. Plus, recently I
also started blocking "localhost" as HELO string (and, consequently, the
un-bracketed 127.0.0.1 address).

- Mark