[Mimedefang] has anyone else seen those weird "1.txt" emails

[Rob MacGregor]

On 24/07/05, Fernando Gleiser <fgleiser at cactus.fi.uba.ar> wrote:
> I'm seeing a lot of emails coming with just an "1" in the body, "1" as
> the subject and an application/octet-stream part called "1.txt"
> 
> Doesn anyone know what can these be? Does anyone have some MD code to block
> them?

See http://isc.sans.org/diary.php?date=2005-07-22 and
http://isc.sans.org/diary.php?date=2005-07-23.  So far, it looks like
nobody's certain what they are.

I've been seeing them for maybe a week now, maybe longer.  From memory
I first saw them on the IP Filter mailing list.

For blocking them, I'd go with feeding them into SpamAssassin so that
the bayes module learns they're spam.

-- 
                 Please keep list traffic on the list.
Rob MacGregor
      Whoever fights monsters should see to it that in the process he 
        doesn't become a monster.                  Friedrich Nietzsche