While you are att it you will also see many spoofs of you domain name I would also suggest adding
HELO xx IS mydomainname Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Heinrich Richter > Sent: Wednesday, March 17, 2004 1:16 AM > To: [EMAIL PROTECTED] > Subject: Re: [Declude.JunkMail] Block on HELO > > > Hi Lyndon, > > i have setup a test for this in my global.cfg and give them a high weight: > > HELOTEST filter E:\DECLUDE\helotest.txt x 0 0 > > > HELO 35 IS my.ip.ad.dr > > Heinrich > > > ----- Original Message ----- > From: "Lyndon Eaton" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, March 17, 2004 9:39 AM > Subject: RE: [Declude.JunkMail] Block on HELO > > > I've seen a few spams that use the IP address of my server (the > receiving server) as their HELO: > > Received: from 194.164.103.70 [219.128.180.36] by mail.uksubnet.net > (SMTPD32-6.06) id AB451525028C; Wed, 17 Mar 2004 04:59:49 +0000 > > 194.164.103.70 is my IP address, they use it, but are really in this > case 219.128.180.36. > > Is there any way I can use Declude to block this? > > Thanks! > Lyndon. > > > ************************************************ > Email checked by UKsubnet anti-virus service > To prevent email abuse & block spam > contact [EMAIL PROTECTED] > Tel: +44(0)8712360301 Web: www.uksubnet.net > Fax: +44(0)8712360300 > > Powered by UKsubnet Internet Service Provider > Business to Business Internet (ISP) > ************************************************ > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > ------------------------------------------------------------- > [This E-mail was scanned for viruses by Declude Virus/F-Prot] > > > ------------------------------------------------------------- > [This E-mail was scanned for viruses by Declude Virus/F-Prot] > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
