Got about 110k worth of this in my hourly syslog snip today: Sep 8 05:47:06 localhost spamd[13261]: Malformed UTF-8 character (unexpected continuation byte 0x8e, with no preceding start byte) in pattern match (m//) at /var/lib/spamassassin/3.002005/70_sare_specific_cf_sare_sa-update_dostech_net/200605280300.cf, rule SARE_SPEC_REPL_OBFU1, line 1.
body SARE_SPEC_REPL_OBFU1 /(?!watches)(?!watch \* ?s)(?:w|\\\/\\\/| VV|[\xC5][\xB4-\xB5]|[\xCF][\x88-\x89]|[\xCF]\x8E]) [\x01-\x2F\x3A-\x40\x5B-\x60\| \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?: [EMAIL PROTECTED]|\/\\|[\xC4][\x80-\x85]|[\xC7][\x8D-\x8E]| [\xC7][\xBA-\xBB]|[\xCE][\x86]|[\xCE][\x91]|[\xCE][\x94]|[\xCE][\x9B]|[\xCE] [\xAC]|[\xCE][\xB1]|[\xD0][\x90]|[\xD0]\xB0)[\x01-\x2F\x3A-\x40\x5B-\x60\| \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[t\+]|[\xC5] [\xA2-\xA7]|[\xCE][\xA4]|[\xCF][\x84]|[\xD0][\xA2]|[\xD1]\x82) [\x01-\x2F\x3A-\x40\x5B-\x60\| \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?: [c\*\xC7\xE7\xA2\xA9]|[\xC4][\x86-\x8D]|[\xD0][\xA1]|[\xD1]\x81) [\x01-\x2F\x3A-\x40\x5B-\x60\| \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:h|[\xC4] [\xA4-\xA7]|[\xCE][\x89]|[\xCE][\x97]|[\xD0][\x9D]|[\xD0][\xBD]|[\xD1][\x92]| [\xD2][\xA2-\xA3]|[\xD2][\xBA-\xBB]|[\xD5]\xB0]) [\x01-\x2F\x3A-\x40\x5B-\x60\| \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?: [e3\*\xC8-\xCB\xE8-\xEB]|[\xC4][\x92-\x9B]|[\xCE][\x88]|[\xCE][\x95]|[\xCE] [\xA3]|[\xCE][\xAD]|[\xCE][\xB5]|[\xD0][\x81]|[\xD0][\x95]|[\xD0][\xB5]| [\xD1]\x91)[\x01-\x2F\x3A-\x40\x5B-\x60\| \x7F-\xA1\xA4-\xA8\xAB-\xAD\xAF-\xB1\xB4\xB7-\xBB\xBF\xF7]?(?:[s5\$\xA7]| [\xC5][\x9A-\xA1]|[\xD0][\x85]|[\xD1][\x95]|[\xD5]\x8F)\b/i The spam that caused this is at http://pastebin.com/m4717b961 Was this just a fluke? -- Chris KeyID 0xE372A7DA98E6705C
pgpHM5trQd4wg.pgp
Description: PGP signature
