[exim] ssl-dot-domain-dot-tld question

Folks,

Several instructions for generating an ssl cert (Apache, Linux-*) use
the pattern:

ssl.domain.tld

as an example in instructions / how-to's.

over about the last 8-12 months, we've been seeing a gradually
increasing number of arrivals with that pattern in HELO or even DNS lookup.

So far, not one of these has offered legitimate traffic.
Au contraire - all have been spam.

Has anyone else seen this?

Or seen significant (any?) legitimate traffic with this pattern?

Bill Hacker