My point of posting it was that it is a spammers intent to randomize the HELO string as different ip addresses. Not to ask if it is valid. The messages was clearly spam from a bulk mailer.
Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bill Landry > Sent: Wednesday, October 20, 2004 6:04 PM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Random Helo strings > > > ----- Original Message ----- > From: "Matt" <[EMAIL PROTECTED]> > > > Please remember the old thing about YYMV, and also that different people > > have different standards. > > > > Your suggestion to block invalid HELO's would create big issues for my > > system, in fact I only weight HELOBOGUS at about 25% of my hold weight. > > For instance, have you ever seen a message that came from > > somedomain.local? I sure have, and many other variations as well. > > > > I believe this to be bad advice to suggest blocking on. The key work > > here is also "believe", because all we are doing is exchanging opinions. > > Please don't step on the discussion because you find it to not be of > > value to you. As far as your own standards go, this apparently makes > > plenty of sense for you, but this isn't necessarily universal in > > application. That's just fine, but for the rest of us YYMV, as well as > > your interests. > > Okay, I'm obviously promoting something that violates my own principles > here. I guess the point I was trying to make is that the helo info that > Kevin posted was so clearly non-standard that I don't think any > right-minded > person would create a mail server hostname like that. So it had > to be some > kind of lame spammer obfuscation attempt of some kind. I just can't be > bothered accepting mail when a mail server announces itself like that. > > Bill > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
