OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Interesting non-SMTP command

From: Bill Cole (postfixlists-070913billmail.scconsult.com)
Date: Mon Oct 15 2007 - 22:08:06 CDT


At 8:23 PM -0600 10/15/07, James Lay wrote:
>Hey All!
>
>Below is what I received this evening...normally I just drive on and laugh
>at the muff job a spammer may have done with his/her application, but this
>one was pretty different...anyone have a clue what the below could be?
>
>Thanks,
>James
>
>------ Forwarded Message
>From: Myshield Alert <jlayslave-tothe-box.net>
>Reply-To: <jlayslave-tothe-box.net>
>Date: Mon, 15 Oct 2007 20:07:12 -0600
>To: <jlayslave-tothe-box.net>
>Subject: Oct 15 20:07:10 myshield postfix/smtpd[6735]: warning: non-SMTP
>command from unknown[189.166.59.106]: =F4=C5=CC.: 545-47 64, 504-20-48

It's likely to be a text encoding botch that resulted in a message
with a bare period on a line followed by a line with that
quoted-printable version of something that probably means something
in some language if you can find the right decoding.

--
Bill Cole
billscconsult.com