[Mimedefang] "Possible SMTP attack: command=HELO/EHLO, count=3"

[John]

At 12:42 PM 10/26/2006, you wrote:
<snip>
>Lots of them here too, about the same number per day.
>
>What does that mean, anyway?  Three HELO or EHLO commands?  It would
>be nice to target it.

I do believe they are sending the string "HELO/EHLO" as the first item 
after the connection where it would normally be just one or the other, then 
repeat it 2 more times.


>Joseph Brennan
>Lead Email Systems Engineer
>Columbia University Information Technology
>
>
>
>
>_______________________________________________
>NOTE: If there is a disclaimer or other legal boilerplate in the above
>message, it is NULL AND VOID.  You may ignore it.
>
>Visit http://www.mimedefang.org and http://www.roaringpenguin.com
>MIMEDefang mailing list MIMEDefang at lists.roaringpenguin.com
>http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


John Jaeger - Billings, Montana

EMail To	: <mailto:john at jjgb.com>
Home Page	: <http://www.jjgb.com>

PGP:
RSA Key ID: 0xAAEC7751  <http://www.jjgb.com/public_files/RSA_Key.zip>

"Our liberty is protected by four boxes...
     The ballot box, the jury box, the soap box, and the cartridge box."
                                    - Anonymous

"Soap Box" didn't work, now using the "Cartridge Box" 3/20/2003