[Mimedefang] New spammer trick?

Joseph Brennan brennan at columbia.edu
Tue Nov 25 10:58:26 EST 2003

> This spammer makes both the "from" and "to" address the same as the
> intended recipient.

No, not new.  We've seen this for a long time.

> Luckily, in all three cases, the spammer's software
> says "HELO roaringpenguin.com"

The more common one we see is HELO with our server's IP address
(not in [] brackers either).  Rejecting that really pays off.

Joseph Brennan         Columbia University in the City of New York
Academic Technologies Group                   brennan at columbia.edu

More information about the MIMEDefang mailing list