[Mimedefang] New spammer trick?

Mark admin at asarian-host.net
Tue Nov 25 15:37:38 EST 2003

----- Original Message ----- 
From: "Joseph Brennan" <brennan at columbia.edu>
To: <mimedefang at lists.roaringpenguin.com>
Sent: Tuesday, November 25, 2003 5:28 PM
Subject: Re: [Mimedefang] New spammer trick?

> > Luckily, in all three cases, the spammer's software
> > says "HELO roaringpenguin.com"
> The more common one we see is HELO with our server's IP
> address (not in [] brackers either). Rejecting that really
> pays off.

Yes, I have been doing that too. Very effective, indeed. Plus, recently I
also started blocking "localhost" as HELO string (and, consequently, the
un-bracketed address).

- Mark

More information about the MIMEDefang mailing list