Bagle, not that smart

Thu Mar 4 21:19:10 UTC 2004

Bagle seems to simply grab everything up to and not including the second '.' Right-to-Left. I doubt they took subdomains into consideration... Im sure that now that you mentioned it here, this will be fixed in the next revision (I wonder if they file bugs with themselves?)
-----Original Message-----
From: owner-nanog at merit.edu [mailto:owner-nanog at merit.edu] On Behalf Of Rubens Kuhl Jr.
Sent: Thursday, March 04, 2004 4:05 PM
To: nanog at merit.edu
Subject: Bagle, not that smart

This is a bagle sample I've received; it seems they have somewhat to learn about ccTLDs (there is no org.br domain), and to what FROM to choose (an address for university adminissions wouldn't send you a support message).

Rubens

----- Original Message -----
From: admissions at --some-university--.edu>
To: <sugestoes at antispam.org.br>
Sent: Thursday, March 04, 2004 3:50 PM
Subject: [blacklist] Notify about using the e-mail account.

Dear user, the management of  Org.br mailing  system wants to  let  you
know that,

We warn you  about some  attacks on your  e-mail  account.  Your  computer
may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions.

For details see  the attached file.

In order  to read the attach you have to use the following password: 46742.

Kind  regards,
    The Org.br team                            http://www.org.br

[As partes desta mensagem que não continham texto foram removidas]

--------------------------------------------------------------------
Enviar mensagens: mailto:pataquada at egroups.com
Sair do grupo   : mailto:pataquada-unsubscribe at egroups.com
eGroups         : http://br.egroups.com/group/pataquada/
====================================================================
Links do Yahoo! Grupos
Para visitar o site do seu grupo, acesse:
 http://br.groups.yahoo.com/group/pataquada/

Para sair deste grupo, envie um e-mail para:
 pataquada-unsubscribe at yahoogrupos.com.br

O uso que você faz do Yahoo! Grupos está sujeito aos:
 http://br.yahoo.com/info/utos.html