[Avcheck] First spam attempts ;)

Michael Tokarev mjt@tls.msk.ru
Thu, 21 Feb 2002 12:57:18 +0300


This isn't in fact first attempts -- there was many more before,
also rejected for one or another reason.  But this one is funny:

---
Subject: Postfix SMTP server: errors from unknown[212.137.49.67]
   Date: Thu, 21 Feb 2002 07:39:48 +0300 (MSK)
   From: MAILER-DAEMON@mail.corpit.ru (Mail Delivery System)
     To: postmaster@corpit.ru (Postmaster)

Transcript of session follows.

 Out: 220 mail.corpit.ru ESMTP Postfix (1.1.3)
 In:  HELO Localhost
 Out: 250 mail.corpit.ru
 In:  RSET
 Out: 250 Ok
 In:  MAIL FROM:<rth@spartapiet.com>
 Out: 250 Ok
 In:  RCPT TO:<avcheck@corpit.ru>
 Out: 504 <Localhost>: Helo command rejected: need fully-qualified hostname
 In:  RCPT TO:<avcheck-request@corpit.ru>
 Out: 504 <Localhost>: Helo command rejected: need fully-qualified hostname

Session aborted, reason: lost connection
---

And, a bit later,

---
Subject: Postfix SMTP server: errors from unknown[212.137.49.67]
   Date: Thu, 21 Feb 2002 07:41:51 +0300 (MSK)
   From: MAILER-DAEMON@mail.corpit.ru (Mail Delivery System)
     To: postmaster@corpit.ru (Postmaster)

Transcript of session follows.

 Out: 220 mail.corpit.ru ESMTP Postfix (1.1.3)
 In:  HELO Localhost
 Out: 250 mail.corpit.ru
 In:  RSET
 Out: 250 Ok
 In:  MAIL FROM:<rth@spartapiet.com>
 Out: 250 Ok
 In:  RCPT TO:<avcheck-admin@list.corpit.ru>
 Out: 504 <Localhost>: Helo command rejected: need fully-qualified hostname

Session aborted, reason: lost connection
---

(Note that even if them used normal hostname, the message will be rejected
too -- client's ip is unresolvable, reject_unknown_client).

I'll add some funny links to every page on the site -- to give
those harvesters a "good food", like an infinite number of
non-existing email addresses...  Umm, how to do this for list
archives?  Funny.  I will take a look to mailman's source code
for this.

BTW, them not harvested my email address from the main page,
www.corpit.ru/avcheck -- it's "crypted", or, strictly speaking,
just encoded using html/http/url tricks.  Ralf, how about your
email address on this page?

Funny... ;)

Regards,
 Michael.