[Mimedefang] "Possible SMTP attack: command=HELO/EHLO, count=3"
David F. Skoll
dfs at roaringpenguin.com
Thu Oct 26 13:45:20 EDT 2006
Cormack, Ken wrote:
> Has anyone else been seeing a ton of sendmail "possible SMTP attack:
> command=HELO/EHLO, count=3" log entries lately?
Yes, tons of them.
> But I'm curious, how has anyone else been dealing with these?
I've been ignoring them. When the machine finally does get around
to sending its spam, it gets greylisted anyway and never retries.
It's probably a good idea to collect all the IP addresses and report
them to xbl.spamhaus.org.
Regards,
David.
More information about the MIMEDefang
mailing list