That is a common trick with spammers. You could block just on the helo command alone and catch a lot. I have blocked 554 on one gateway this morning with that alone.
DustyC -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] = On Behalf Of M.D. DeWar Sent: Friday, September 12, 2003 10:32 AM To: [EMAIL PROTECTED] Subject: [IMGate] Re: my imgate IP in the HELO Heres another Original ip is :: Postfix SMTP server: errors from unknown[220.71.28.199] In: HELO 68.156.89.118 <<<<<<<<my IMGATE machine Out: 250 spamcop.wirelesscommunitynetworks.com In: MAIL FROM: <[EMAIL PROTECTED]> Out: 250 Ok In: RCPT TO: <[EMAIL PROTECTED]> Out: 554 <68.156.89.118>: Helo command rejected: ACL = helo_hostnames_regexp HELO/EHLO hostname must not contain an IP address, HELO =3D = 68.156.89.118
