Bagle seems to simply grab everything up to and not including the second '.' Right-to-Left. I doubt they took subdomains into consideration... Im sure that now that you mentioned it here, this will be fixed in the next revision (I wonder if they file bugs with themselves?) -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Rubens Kuhl Jr. Sent: Thursday, March 04, 2004 4:05 PM To: nanog@merit.edu Subject: Bagle, not that smart This is a bagle sample I've received; it seems they have somewhat to learn about ccTLDs (there is no org.br domain), and to what FROM to choose (an address for university adminissions wouldn't send you a support message). Rubens ----- Original Message ----- From: admissions@--some-university--.edu> To: <sugestoes@antispam.org.br> Sent: Thursday, March 04, 2004 3:50 PM Subject: [blacklist] Notify about using the e-mail account. Dear user, the management of Org.br mailing system wants to let you know that, We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. For details see the attached file. In order to read the attach you have to use the following password: 46742. Kind regards, The Org.br team http://www.org.br [As partes desta mensagem que não continham texto foram removidas] -------------------------------------------------------------------- Enviar mensagens: mailto:pataquada@egroups.com Sair do grupo : mailto:pataquada-unsubscribe@egroups.com eGroups : http://br.egroups.com/group/pataquada/ ==================================================================== Links do Yahoo! Grupos Para visitar o site do seu grupo, acesse: http://br.groups.yahoo.com/group/pataquada/ Para sair deste grupo, envie um e-mail para: pataquada-unsubscribe@yahoogrupos.com.br O uso que você faz do Yahoo! Grupos está sujeito aos: http://br.yahoo.com/info/utos.html