[Mimedefang] "Possible SMTP attack: command=HELO/EHLO, count=3"

[David F. Skoll]

Cormack, Ken wrote:

> Has anyone else been seeing a ton of sendmail "possible SMTP attack:
> command=HELO/EHLO, count=3" log entries lately?

Yes, tons of them.

> But I'm curious, how has anyone else been dealing with these?

I've been ignoring them.  When the machine finally does get around
to sending its spam, it gets greylisted anyway and never retries.

It's probably a good idea to collect all the IP addresses and report
them to xbl.spamhaus.org.

Regards,

David.