--On Wednesday, December 12, 2007 1:20 PM -0800 Kenneth Porter
<[EMAIL PROTECTED]> wrote:
Anyone seen these? text/plain and HTML parts, seem to have same content,
saying there's a virus, please delete, and some gibberish. I'm guessing
it's some kind of probe.
Started today (based on reports to us)
Varying senders. Comes from a botnet. Varying Subject but always one
lower-case word or wordlike string (ogbomosho). Subject does repeat
in different messages, but looks like too many to bother matching.
Note the misspelling in the string:
/Virus found in this message, please delete it without futher reading/
The link *follows* </p></body></html>, and additionally there is nothing
between the <a ...> and </a> tags. How can this ever be clicked on?
The URL has a dot in the path. We have a local rule watching for
this. Example (this is a dead link at this time):
<a href="http://www.crop.co.uk/.hidden/nikpfpdk/aaaaganf.html";>
Joseph Brennan
Lead Email Systems Engineer
Columbia University Information Technology
I wonder if that is in fact a broken spam warning message of some sort.
I've been getting things for weeks with one nonsense "word" for a subject,
but they have all been plain-text fake watch spams.
Loren
