From: Noel Jones (njonesmegan.vbhcs.org)
Date: Sat Aug 02 2003 - 07:12:39 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, Aug 01, 2003 at 08:01:32PM -0400, Mark Jeftovic wrote:
>
> New worm, mimail...
>
> http://zdnet.com.com/2100-1105_2-5059087.html
>
> Anyone gotten enough of these to analyze a pattern?
>
> Using just the subject may be too loose.
>
> -mark
>
> --
> mark jeftovic
> http://mark.jeftovic.net
>
>

After looking at my logs, I rejected about 20 messages yesterday
with envelope FROM admin$mydomain.
First one arrived at Aug 1, 19:18 GMT

These all had a HELO of localhost, which is the rule that rejected
them.

So I would recommend adding
localhost REJECT
to a check_helo_access table if you don't have that already, you can
reject some spam this way also.

--
Noel Jones

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]