Salsalabs

[Ken A]

It looks intentional to me, not a compromised box. It appears to have 
come from the poorly designed democracyinaction website "tell a friend" 
stupidity. See:
http://salsa.democracyinaction.org/o/696/t/1681/tellafriend.jsp

In other words, the system was designed to forward spam.

Ken



On 7/3/2010 12:21 PM, Alex Neuman wrote:
> Somebody's server, running MailScanner, has been compromised.
>
> http://pastebin.com/TQjYQCuG
>
> It looks like "salsalabs.net". If the owner/admin reads this list, check it out.
>
> Thanks...--
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>

-- 
Ken Anderson
Pacific Internet - http://www.pacific.net