Re: [Exim] Re: entry in rejectlog

Top Page
Delete this message
Reply to this message
Author: Tabor J. Wells
Date:  
To: 'exim'
Subject: Re: [Exim] Re: entry in rejectlog
On Tue, Jul 17, 2001 at 07:00:40AM +0530,
Suresh Ramasubramanian <mallet@???> is thought to have said:

> +++ Derrick MacPherson [exim-users] <16/07/01 14:15 -0700>:
> > I have hundreds of entries in my rejectlog that look like:
> > 2001-07-16 11:10:32 rejected HELO from [64.221.225.150]: syntactically
> > invalid argument(s): _[206.102.79.223]_by
> [...]
> > Is this malicious in nature? Or a moron
>
> Both. It is a spammer. If your machine was an anonymous open relay (say an
> ancient SMI8.6/SVR4 sendmail on solaris) that HELO would look like an
> originating IP address to the less than clueful ...


It also makes for an excellent addition to your spam filter when you check
Received: headers for that pattern.

Tabor

-- 
--------------------------------------------------------------------
Tabor J. Wells                                     twells@???
Fsck It!                 Just another victim of the ambient morality