You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris <cp...@earthlink.net> on 2006/02/19 05:38:54 UTC
interesting spam header
I noticed this in my syslog:
Feb 18 20:21:44 cpollock spamd[18615]: spamd: processing message
<21...@client.comcast.net> for chris:501
Feb 18 20:21:44 cpollock spamd[18615]: Character in 'C' format wrapped in
pack at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Util.pm line 711,
<GEN77> line 53.
Feb 18 20:21:44 cpollock last message repeated 2 times
Feb 18 20:21:44 cpollock spamd[18615]: Argument "BE" isn't numeric in pack
at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Util.pm line 711,
<GEN77> line 53.
This wen on and on quite a few times, here is the portion of the headers
that caused it:
X-Apparently-To: rqkladfrcncs@armadaecuador.MUNGED.com via
1.309.412.3886BER[0-255].1_(309) (412) (3886)BER[0-255].1_(309)412
3886BER[0-255].1_(309).412.3886BER[0-255]; Sat, 18 Feb 2006 23:16:16 -0300
X-Originating-IP: [1.309.412.3886BER[0-255].1_(309) (412)
(3886)BER[0-255].1.309_412_3886BER[0-255].1.309.412.3886BER[0-255]]
Received: from 1-309.412.3886BER[0-255].1 309 412
3886BER[0-255].1.309_412_3886BER[0-255].1_309_412_3886BER[0-255] (HELO c-1
309 412
3886BER[0-255].1.309.412.3886BER[0-255].1_(309).412.3886BER[0-255].1 (309)
412-3886BER[0-255].client.comcast.net) (1_(309)_412_3886BER[0-255].1 (309)
412-3886BER[0-255].1_(309)412 3886BER[0-255].1_(309).412.3886BER[0-255])
It was still tagged with 30 points. Guess the spammer thought the above
would make SA hang or something.
--
Chris
Registered Linux User 283774 http://counter.li.org
22:29:32 up 4 days, 16:20, 1 user, load average: 0.10, 0.22, 0.61
Mandriva Linux 10.1 Official, kernel 2.6.8.1-12mdk