Nguyen Nang Thang:
> > domain zen.spamhaus.org as 127.0.0.4
> > Jan 22 00:00:53 spike postfix/postscreen[44350]: PREGREET 16 after 0.69 from
> > [177.231.207.212]:38026: HELO bryozoann\r\n
That is a zombie that speaks before its turn.
Quoting from POSTSCREEN_README"
When an SMTP client sends a command before the postscreen_greet_wait time has
elapsed, postscreen(8) logs this as:
PREGREET count after time from [address]:port text...
Translation: the client at [address]:port sent count bytes before its turn to
speak. This happened time seconds after the postscreen_greet_wait timer was
started. The text is what the client sent (truncated to 100 bytes, and with
non-printable characters replaced with C-style escapes such as \r for carriage-
return and \n for newline).
Wietse
