On Tue, 27 Apr 2010, Lucio Chiappetti wrote:

On Mon, 26 Apr 2010, Joseph Brennan wrote:

>  empty and there was a single attachment "transcript.zip".

 Very old-school, using pif and scr file extensions and the name with
 a lot of spaces in it (actually more spaces than I show here).

After posting, I found that a few other passed through, and a few were blocked, all coming from 113.167.75.53, which curiously responds to a reverse DNS query as "localhost", and is in an IP range in Vietnam.

That's apparently pretty common for sites in VN.

That by itself should have gotten 3.7 points. Is RDNS_LOCALHOST in your base rules? If not, you might want to run sa-update.

--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org    FALaholic #11174     pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  The one political issue that strips all politicians bare is
  individual gun rights.
-----------------------------------------------------------------------
 13 days since a sunspot last seen - EPA blames CO2 emissions

Reply via email to