On 22/07/06 21:37, Jakob Hirsch wrote: > Quoting Simon Arlott:
>
>> Someone might find this useful, it tracks the most recent unique HELO
>> names used per IP and the times they were last used - spam zombies
>> become very obvious with this information.
>
> Nice idea. I didn't look at the code, but at first glance I'd say the
> same could already be done with Exim's builtin functions and some
> database backend (e.g. sqlite as a simple one).
>
>
It could, but then you'd miss the completely bogus HELO names that fail syntactic checks:
