I've been wondering if anybody would call "1_801.457.4483" and find out
who it is, just for grins and giggles.
And it's not QUITE what you posted. The "3" in "3BER" is spurious. That is
the last digit of the phone number.
Chris mentions that the bozoid continues to do it, too.
{^_-}
----- Original Message -----
From: "Justin Mason" <[EMAIL PROTECTED]>
haha.
"NUMBER[0-255]"
s/NUM/randomdigit/g
-> "3BER[0-255]"
oops!
the errors are harmless AFAIK.
--j.
jdow writes:
I received this from a fellow on another list. It took some puzzling
until I figured out what went wrong. He has yet to get back to me with
whether or not there was a score on the message or not. But I think
SA should guard itself if this leads to a message escaping getting
marked.
===8<---
Joanne, you're wise to the world of spammers, have you ever seen anything
like this:
Character in 'C' format wrapped in pack
at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Util.pm line 711,
<GEN145> line 50.
Feb 21 20:38:08 cpollock last message repeated 2 times
Feb 21 20:38:08 cpollock spamd[28011]: Argument "BE" isn't numeric in pack
at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Util.pm line 711,
<GEN145> line 50.
Feb 21 20:38:08 cpollock spamd[28011]: Argument "1BE" isn't numeric in pack
at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Util.pm line 711,
<GEN145> line 50.
Here are the headers that are causing this:
X-Apparently-To: [EMAIL PROTECTED] via
1-801.457.4483BER[0-255].1BER[0-255].1_(801) (457) (4483)BER[0-255].1_(801)
(457) (4483)BER[0-255]; Wed, 22 Feb 2006 08:29:56 +0600
X-Originating-IP: [1 801
457-4483BER[0-255].1BER[0-255].1_801_457_4483BER[0-255].1BER[0-255]]
Received: from 1_801.457.4483BER[0-255].1_801.457.4483BER[0-255].1 (801)
457-4483BER[0-255].1-801.457.4483BER[0-255] (HELO c-1 801 457
4483BER[0-255].1_(801)_457_4483BER[0-255].1 (801)
457-4483BER[0-255].1_(801) (457)
(4483)BER[0-255].client.comcast.net-MUNGED) (1.801.457.4483BER[0-255].1
801_457_4483BER[0-255].1 801 457 4483BER[0-255].1 801 457 4483BER[0-255])
by mta186.mail.re6.yahoo.com with SMTP; Wed, 22 Feb 2006 06:35:56 +0400
This seems like an attempt to make SA crap out or something. Looks almost
like a phone number. Your thoughts?
===8<---
<pause here and see if you can figure it out.>
OK, here is the thought I had. Yes, that is a phone number, for the Salt
lake City area. It was sent by a spam generator that had a nice rule for
putting in numbers for IP addresses using $NUMBER[0-255]. But it also has
a rule $NUM for putting in a telephone number. Guess which rule hit first.
{^_-}
