yes, saw both the scanner ones and the new ones, too.
jay plesset IT, dp-design.com On 6/21/2013 10:40 AM, David F. Skoll wrote:
Hi, We're seeing a huge rash of viruses with malformed payloads. They're supposed to contain a ZIP file, but the MIME part supposedly containing the ZIP file simply contains: Error[Base64] Sample: http://pastebin.com/fkjf9LHR Yesterday, they were "Scanned Copy" spams from an HP printer. Today they are "Invoice Notification for June 2013" spams. Annoyingly, the envelope sender is no-re...@intuit.com which has an SPF permerror... FAIL. $ spfquery --id intuit.com --ip 192.168.1.1 permerror intuit.com ... spf-ext-a.intuit.com: Maximum DNS-interactive terms limit (10) exceeded intuit.com ... spf-ext-a.intuit.com: Maximum DNS-interactive terms limit (10) exceeded Received-SPF: permerror (intuit.com ... spf-ext-a.intuit.com: Maximum DNS-interactive terms limit (10) exceeded) identity=mailfrom; envelope-from=intuit.com *sigh* Anyone else seeing tons of these? Regards, David.
