PNMS

Members
  • Content count

    11
  • Joined

  • Last visited

Community Reputation

0 Neutral

About PNMS

  • Rank
    Member

Recent Profile Visitors

459 profile views
  1. Hi. I know link parsing is not a priority, but just wanted to let you know I stumbled across this form of obfuscation and the parser isn't able to resolve it. https://www.spamcop.net/sc?id=z6391931374z25da662a83188372c4e31b42ff418ba1z Thanks.
  2. I've seen an increase in the use of URL redirects. Most of the spam I'm receiving these days starts with a link from an URL shortener like owl.ly which redirects to a server that redirects to a second server and in some cases there's even a third server involved. I found this using tools like ur query.net or webtoolhub.com It would be great that spamcop incorporated similar technology to report all urls involved and not just the URL shorteners (which, as you say "twitterdoesntcareaboutspamreports"
  3. Sorry. New one: https://www.spamcop.net/sc?id=z6192323941z9a40fb63d557dda8dc3fbdc50c1a659cz and: https://www.spamcop.net/sc?id=z6192324104z41ebb85386066937f1c78ef66a6a5828z Yesterdays: https://www.spamcop.net/sc?id=z6192159997z90efa12f3a50bb763fdba6ec8d54c3dfz https://www.spamcop.net/sc?id=z6192159775z4691a38651ee247a8646e891652ade28z
  4. Here are two fresh reports: https://www.spamcop.net/mcgi?action=gettrack&reportid=6378424304 https://www.spamcop.net/mcgi?action=gettrack&reportid=6378424605 I suspect they are from the same spammer due to their similar structure, even if they have different domains. I'm receiving two or three of these every day.
  5. Hi. I've been receiving emails from a spammer that aren't parsed bye the spam cop engine. No links detected. Apparently the text of the message is an HTML file, base64 encoded, charset ISO-8859-15. On Gmail I have to enable images to see the links. Should I post a couple of them here to help with the analysis? Thanks.
  6. Hello. Just a quick post to report I'm also getting a "Too many links" message with this: http://www.spamcop.net/sc?id=z5947938451zd...426a68d7172356z
  7. Hi. I've been emails with an attachment and when parsed through spam cop I also get the too many links error: http://www.spamcop.net/sc?id=z5943397508z6...42ab6d85552b4dz However, in this case the links are from the same server, just different subdirectories. I'm posting just to let you know maybe someone is trying to find a way to make it more difficult to report.
  8. Thanks for the reply. Hopefully they'll fix the issues with their security configuration.
  9. More recent activity from bezeqint.net. I'm getting 2 or 3 spam emails from them. One of them: http://www.spamcop.net/sc?id=z5943211205zd...2b7d698fd5a964z
  10. Hi. Thanks for the reply. Here are two links to reports from very similar mails: Both result in a "Cannot resolve" for the links on the email. http://www.spamcop.net/sc?id=z5939955342zb...821fdf732ca5f5z http://www.spamcop.net/sc?id=z5939953607z3...ef98bb85556bbcz I suspect it's the same spammer, I receive at least 2 emails everyday with very similar format. It used to be a link in the body message, now he's doing attachments. I've been reporting very similar looking emails for a couple of weeks.
  11. Hi. I've been receiving (and reporting) spam messages with cyrilic URLs. As it has been addressed on other posts, some time ago they didn't resolved, now some of them do. However now I'm getting very similar messages, probably from the same spammer, but now they include an attachment and I get this: Resolving link obfuscation http://ùъцчô.ртóý.рф/en/contact.php'>http://ùъцчô.ртóý.рф/en/contact.php http://ùъцчô.ртóý.рф/en/privacy.php'>http://ùъцчô.ртóý.рф/en/privacy.php http://ùъцчô.ртóý.рф/en/faq.php'>http://ùъцчô.ртóý.рф/en/faq.php http://ùъцчô.ртóý.рф/ http://ùъцчô.ртóý.рф/en/testimonials.php http://ùъцчô.ртóý.рф/en/order.php Tracking link: http://ùъцчô.ртóý.рф/ No recent reports, no history available ùъцчô.ртóý.рф is not a routeable IP address Cannot resolve http://ùъцчô.ртóý.рф/ Tracking link: http://ùъцчô.ртóý.рф/en/faq.php'>http://ùъцчô.ртóý.рф/en/faq.php No recent reports, no history available ùъцчô.ртóý.рф is not a routeable IP address Cannot resolve http://ùъцчô.ртóý.рф/en/faq.php'>http://ùъцчô.ртóý.рф/en/faq.php Tracking link: http://ùъцчô.ртóý.рф/en/privacy.php'>http://ùъцчô.ртóý.рф/en/privacy.php No recent reports, no history available ùъцчô.ртóý.рф is not a routeable IP address Cannot resolve http://ùъцчô.ртóý.рф/en/privacy.php'>http://ùъцчô.ртóý.рф/en/privacy.php Tracking link: http://ùъцчô.ртóý.рф/en/testimonials.php No recent reports, no history available ùъцчô.ртóý.рф is not a routeable IP address Cannot resolve http://ùъцчô.ртóý.рф/en/testimonials.php Tracking link: http://ùъцчô.ртóý.рф/en/contact.php'>http://ùъцчô.ртóý.рф/en/contact.php No recent reports, no history available ùъцчô.ртóý.рф is not a routeable IP address Cannot resolve http://ùъцчô.ртóý.рф/en/contact.php'>http://ùъцчô.ртóý.рф/en/contact.php Tracking link: http://ùъцчô.ртóý.рф/en/order.php No recent reports, no history available ùъцчô.ртóý.рф is not a routeable IP address Cannot resolve http://ùъцчô.ртóý.рф/en/order.php The original message includes this attachment, no links on the main body. I downloaded the attachment and opened it with a text editor. It includes the following links, among others: href=http://йъцчд.ртгн.рф href=http://йъцчд.ртгн.рф/en/faq.php href=http://йъцчд.ртгн.рф/en/testimonials.php href=http://йъцчд.ртгн.рф/en/order.php Note: the links are not in cyrilic, they are encoded like this: (I'm posting an image, the forum converts the code to cyrilic as displayed above)