On Thu, 5 Apr 2012, Jason Haar wrote:
Is this the format being referred to? These are consistently getting
through SA for us too
http://pastebin.com/VHkfnTtm
No, it's not.
On 01/04/12 10:05, John Hardin wrote:
On Sat, 31 Mar 2012, joea wrote:
On 3/31/2012 at 8:22 AM, Michael Scheidell
<michael.scheid...@secnap.com>
wrote:
if you need help, you need enough full information.
Or, you make the pastebin 'private', and send the link offlist to
someone who has volunteered to help. . . . .
If there are more volunteers, beyond the presumed one . . . feel free
to . . .
joea sent me the messages. It appears his bayes isn't running at all,
they got no BAYES_## hits whatsoever.
The URLs in them also have a really suspicious form; I've added a
couple of rules for that to my sandbox. I suspect that the form is
really uncommon, though, perhaps just fat fingers by this one spammer,
so I doubt they will do well in masscheck. We'll see...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The promise of nuclear power: electricity too cheap to meter
The reality of nuclear power: FUD too cheap to meter
-----------------------------------------------------------------------
9 days until Thomas Jefferson's 269th Birthday
