Salsalabs

[Ken A]

On 7/6/2010 11:20 AM, Alex Neuman wrote:
> There's a mailscanner system in the middle, so I thought the owner
> might be aware of the problem by reading about it on the list.

Yes, looks like it squeezed by with "sssss" !
Something like:

header		LOCAL_SPAM1	X-Salsa-Referer =~ /tellafriend.jsp/
describe	LOCAL_SPAM1	spam from stupid web app
score		LOCAL_SPAM1	3.5

should work nicely! :-)

Ken


> On Jul 6, 2010, at 11:11 AM, Ken A wrote:
>
>> It looks intentional to me, not a compromised box. It appears to
>> have come from the poorly designed democracyinaction website "tell
>> a friend" stupidity. See:
>> http://salsa.democracyinaction.org/o/696/t/1681/tellafriend.jsp
>>
>> In other words, the system was designed to forward spam.
>>
>> Ken
>>
>>
>>
>> On 7/3/2010 12:21 PM, Alex Neuman wrote:
>>> Somebody's server, running MailScanner, has been compromised.
>>>
>>> http://pastebin.com/TQjYQCuG
>>>
>>> It looks like "salsalabs.net". If the owner/admin reads this
>>> list, check it out.
>>>
>>> Thanks...-- MailScanner mailing list
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>> Before posting, read http://wiki.mailscanner.info/posting
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>
>> -- Ken Anderson Pacific Internet - http://www.pacific.net --
>> MailScanner mailing list mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!
>

-- 
Ken Anderson
Pacific Internet - http://www.pacific.net