[Mimedefang] New spammer trick?

[Joseph Brennan]

> This spammer makes both the "from" and "to" address the same as the
> intended recipient.

No, not new.  We've seen this for a long time.


> Luckily, in all three cases, the spammer's software
> says "HELO roaringpenguin.com"

The more common one we see is HELO with our server's IP address
(not in [] brackers either).  Rejecting that really pays off.


Joseph Brennan         Columbia University in the City of New York
Academic Technologies Group                   brennan at columbia.edu