Re: Block Mydoom port 1639...

On Tue, 9 Nov 2004, Kevin Reed wrote:

| I'm trying to block URI's that have port 1639 in them.
|
| I tried the uri below in Spam Assassin but had no luck.

We're using an SA rule:

  uri BOFWORM /:16\d\d/

which looking for 16xx - the other night's SANS bulletin said "1600-1700 range"

( http://isc.sans.org//diary.php?date=2004-11-08 )

However all the samples I've seen so far have used port 1639 or 1640 URLs.

Best.

--
Chris Edwards, Glasgow University Computing Service