For anyone who does not know, in SMTP the HELO and EHLO commands are how an SMTP server responds to a greeting from another SMTP server.
Over the past few days I have been monitoring my new SMTP server that I am building, Watching the commands as the come through and some RBL stuff as well. I’ve build some SPF tools and integrated the IP-to-Country data for the most part as well.
One of the things that I have been noticing have been the randomness of the HELO commands. The same IP address will give different HELO commands every time it connects. Not only that but the HELO command does not match up with any of the email addresses.
While this is not a sure sign of spam it surely is a red flag and something that I will be tracking into the future.