You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris <cp...@embarqmail.com> on 2008/09/09 02:18:55 UTC

Malformed UTF-8 character

Got about 110k worth of this in my hourly syslog snip today:

Sep  8 05:47:06 localhost spamd[13261]: Malformed UTF-8 character (unexpected 
continuation byte 0x8e, with no preceding start byte) in pattern match (m//) 
at /var/lib/spamassassin/3.002005/70_sare_specific_cf_sare_sa-update_dostech_net/200605280300.cf, 
rule SARE_SPEC_REPL_OBFU1, line 1. 

body      SARE_SPEC_REPL_OBFU1     /(?!watches)(?!watch \* ?s)(?:w|\\\/\\\/|
VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E])
[\x01-\x2F\x3A-\x40\x5B-\x60\|
\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:
[a4\*\@\xC0-\xC5\xAA\xE0-\xE5]|\/\\|[\xC4][\x80-\x85]|[\xC7][\x8D-\x8E]|
[\xC7][\xBA-\xBB]|[\xCE][\x86]|[\xCE][\x91]|[\xCE][\x94]|[\xCE][\x9B]|[\xCE]
[\xAC]|[\xCE][\xB1]|[\xD0][\x90]|[\xD0]\xB0)[\x01-\x2F\x3A-\x40\x5B-\x60\|
\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5]
[\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82)
[\x01-\x2F\x3A-\x40\x5B-\x60\|
\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:
[c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81)
[\x01-\x2F\x3A-\x40\x5B-\x60\|
\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4]
[\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]|
[\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0])
[\x01-\x2F\x3A-\x40\x5B-\x60\|
\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:
[e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE]
[\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]|
[\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\|
\x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]|
[\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)\b/i 

The spam that caused this is at

http://pastebin.com/m4717b961

Was this just a fluke?

-- 
Chris
KeyID 0xE372A7DA98E6705C