IDS engines put this together

[lance () spitzner net (Lance Spitzner)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
Today one of my honeypots was probed for spam relay.  Do
IDS engines have the 'intelligence' to put this session
together and realize the remote system is probing for
spam relay sites?  Signature is below.  My domain name
has been sanitized, but all other information is valid.

220 mail.example.com. Sendmail SMI-8.6/SMI-SVR4 ready at Sun, 11 Jun 2000 11:27:42 -0500
HELO MAIL.EXAMPLE.COM
250 mail.example.com. Hello [211.54.114.180], pleased to meet you
MAIL FROM:<woqjffirst_at_yahoo.com () MAIL EXAMPLE COM>
250 <woqjffirst_at_yahoo.com () MAIL EXAMPLE COM>... Sender ok
RCPT TO:<woqjffirst () yahoo com>
250 <woqjffirst () yahoo com>... Recipient ok
DATA
354 Enter mail, end with "." on a line by itself
qjffirst () yahoo com
From: woqjffirst () yahoo com (Spade relay check)
Subject: MAIL.EXAMPLE.COM relay check

.
250 LAA14291 Message accepted for delivery
QUIT
221 mail.example.com. closing connection

Lance Spitzner
http://www.enteract.com/~lspitz/papers.html