Bagle seems to simply grab everything up to and not including the second '.'
Right-to-Left. I doubt they took subdomains into consideration... Im sure that now
that you mentioned it here, this will be fixed in the next revision (I wonder if they
file bugs with themselves?)
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rubens Kuhl Jr.
Sent: Thursday, March 04, 2004 4:05 PM
To: [EMAIL PROTECTED]
Subject: Bagle, not that smart
This is a bagle sample I've received; it seems they have somewhat to learn about
ccTLDs (there is no org.br domain), and to what FROM to choose (an address for
university adminissions wouldn't send you a support message).
Rubens
----- Original Message -----
From: [EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 04, 2004 3:50 PM
Subject: [blacklist] Notify about using the e-mail account.
Dear user, the management of Org.br mailing system wants to let you
know that,
We warn you about some attacks on your e-mail account. Your computer
may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions.
For details see the attached file.
In order to read the attach you have to use the following password: 46742.
Kind regards,
The Org.br team http://www.org.br
[As partes desta mensagem que n�o continham texto foram removidas]
--------------------------------------------------------------------
Enviar mensagens: mailto:[EMAIL PROTECTED]
Sair do grupo : mailto:[EMAIL PROTECTED]
eGroups : http://br.egroups.com/group/pataquada/
====================================================================
Links do Yahoo! Grupos
Para visitar o site do seu grupo, acesse:
http://br.groups.yahoo.com/group/pataquada/
Para sair deste grupo, envie um e-mail para:
[EMAIL PROTECTED]
O uso que voc� faz do Yahoo! Grupos est� sujeito aos:
http://br.yahoo.com/info/utos.html
