Jump to content
Sign in to follow this  
goldeneye

I want to destroy this spammer...

Recommended Posts

This spammer is apparently insistent on breaking the parser - I really want to wish enough bad things on this spammer.

There are links in the original message, but as you can see, the parser "ignores" it by at least one technique by that sh** spammer.

http://www.spamcop.net/sc?id=z4970399465zd...a284d1b5eccb7az

This is enough to make me want to throw a fifty-ton tantrum.

Share this post


Link to post
Share on other sites

Would that spamvertized address even be resolvable on a browser? I can't tell but it doesn't look likely from the message headers and body. If it is not resolvable to a browser then the spammer is achieving nothing. Unless it is to provoke recipients like you in which case there is no guessing what the game is (nothing friendly, that much would be certain). If that is the case, take a deep breath and be content with reporting the sender(s).

All SC parsing would do if it was not munged is send a courtesy report to the (Turkish) provider, sayfa.net. That might be worthwhile since bumblebeedepot is not using their own mail server mail.bumblebeedepot.info [46.45.177.3] so maybe they have some concern about reports. Some 76 other domains share the same IP address (from Robtex) and some or all of them could have the same owner (wouldn't be able to tell, bumblebeedepot uses WhoisGuard registration).

You could send manual reports (entering just the unmunged URI into the webpage submission box will give you any abuse address SC has - just don't use any that might have "spamcop" in the abuse address, those are for SC use only).

SC reports might also generate a listing on SURBL. If you want them listed somewhere maybe you could check URIBL and whatever process they support which apparently allows registered members there to recommend listing of websites. bumblebeedepot.info doesn't seem to be on either SURBL or URIBL at the moment.

Share this post


Link to post
Share on other sites
This spammer is apparently insistent on breaking the parser - I really want to wish enough bad things on this spammer.

There are links in the original message, but as you can see, the parser "ignores" it

Hi goldeneye,

I think the key thing to remember here is that the source IP has been identified and reported. And that is what Spamcop is about. So your report contributed to the SCBL and the parser has done its thing.

The identification of of so-called spamvertised URLs is very much a secondary thing. They regularly fail for all sorts of reasons - many unconnected to the spammer's efforts.

In fact SC reporters who use any form of quick reporting automatically bypass the URL parsing.

If you are keen to report spamvertised URLs then I would suggest that you would be better to use an alternative reporting process and keep SC reports for the sending IP.

There are many discussions of the reasons for URL parsing to fail - you can find them at http://is.gd/x0FDDa

Others have recommended tools which I don't use and am not familiar with. I recall Complainterator being recommended - http://is.gd/9j9O43

Hope you find a tool which will help you fulfil your reporting passion ;)

Andrew

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×