Re: [exim] Spam with IP like HELO

On Thu, 2007-05-03 at 23:32 +0200, Renaud Allard wrote:
> As mentioned the spammers will have the right literal HELO because its
> their interest.

many spammers have no clue at all, viz. "HELO friend".

> I think this is just like IP literals for receiving
> mails, it is mainly used for abuse.

well, my investigation which I reported yesterday did find more spam
than ham with this characteristic, but the amount was too small to make
it worthwhile to introduce more false positives. (there was more ham
than spam with SA score < 6, which is what our users typically filter
at, anyway.)

> How many people still support postmaster@[your.ip.addr.ess] nowadays?
> One has to wonder.

well, we do, it is a requirement for an Internet host after all... it's
very frustrating that so many of the big sites ignore the requirement to
have a postmaster address *at all*, though.

--
Kjetil T. (sends unkind thoughts to the unhelpful Hotmail/MSN system)