> Here are the kind of HELO Signatures my favorite Spambot produces:
> (always lower case, always one period, never a .tld)
>
> ljxr.pzt
> mclbfk.wdui
> zsgnwd.zctjrq
Hum. Weren't there some rulesets predating SARE that checked for odd letter
combinations of various kinds in the mail body? Triplets and the like?
I think most of those have gone unused in the last year or so since they
started getting FPs. But I wonder about resurecting some of them
specifically for scanning this sort of thing.
Loren
