Hi Skip:
Yes, others are seeing them sporadically across several servers. It's been
in discussion mildly on the MIMEDefang list since yesterday evening.
I have inklings they are hotline virus related from one of the email
subjects I got but I have not been able to substantiate that yet.
I haven't seen any unmolested emails (ok I got one and deleted it :-( bad
me) so it's hard to write a rule for it but something like this would be a
start:
#KAM NUMBER EMAILS
header __KAM_NUMBER1 Subject =~ /\d*/i
body __KAM_NUMBER2 /\d{1,6}/
meta KAM_NUMBER ((__KAM_NUMBER1 + __KAM_NUMBER2) >= 2)
describe KAM_NUMBER Silly Number Emails
score KAM_NUMBER 0.1
Regards,
KAM
Beginning yesterday, we began to receive spam email from a number of
sources spoofing as our own users. The email will appear as though it
is both from and to the same recipient. The subject will be 3 digits
(i.e. 557) and the body 4 digits (i.e. 5567). I've found 5 users over
the last two days and one who indicated he received one on his personal
account at his home.
Is anyone else seeing these? How can I proceed to block them? Thanks.
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
