== Unsurprisingly, random SMTP servers do get open relay probes

One of the things I do with [[my sinkhole smtp server
https://github.com/siebenmann/smtpd/]] is run a copy of it on my
home machine. Unlike my office workstation, my home machine has
never been an active mail machine; it has nothing pointing to it
and no history of [[various (pseudo)email addresses
SpammerPersistenceIllustrated]] that attract spam. Under normal
circumstances there should be absolutely no one with any reason
to connect to it.

Indeed, it doesn't attempts to send me any email (spammers might
plausibly try, say, postmaster@<machine>). What it does get is a
certain amount of open relay probes. Originally these probes were
sent with outside _MAIL FROM:_s (and outside _RCPT TO_s, obviously),
but lately they've been forged to come from various addresses at
the machine's overall domain.

(What's actually pretty interesting about this is that the overall
domain isn't valid for email; it has neither an _A_ nor an _MX_
entry, and never has. The spammers are just assuming that, eg,
'support@<domain>' is a valid address and using it as the _MAIL
FROM_.)

It used to be that the relay probes made one or two attempts and
then stopped. The recent run of relay probes has dumped a whole
series of email on my machine all at once, varying at most the _MAIL
FROM_ address; I assume it's trying to see if some will go through
where others fail. At the moment addresses on GMail appear to be
the popular collection point for results. The _Subject_ lines of
recent relay attempts clearly contain tracing information and suggest
that the software involved is normally used against things that
require SMTP AUTH, as it seems to be including passwords in the
_Subject:_ information.

The exact details and mechanisms have changed from earlier attempts
and will undoubtedly change again in the future. What's really
interesting is two things: people really do scan more or less random
addresses in an attempt to find open SMTP relays, and when they
find something they don't immediately start trying to shovel spam
through it but instead attempt to verify that it actually is open.

(Some days I'm tempted to manually 'relay' one of these messages
to its collection point just to see if there would be a future
attempt to spam through my machine. But so far that's far too much
work and probably a certain amount of risk.)