The typical behavior of a legitimate user may be to use a different, but a relatively constant, set of domains in their HELO statements.

• 合法用户通常可能会在HELO语句中使用不同但是相对恒定的一组域。