PNMS Posted November 4, 2015 Share Posted November 4, 2015 Hi. I've been receiving emails from a spammer that aren't parsed bye the spam cop engine. No links detected. Apparently the text of the message is an HTML file, base64 encoded, charset ISO-8859-15. On Gmail I have to enable images to see the links. Should I post a couple of them here to help with the analysis? Thanks. Link to comment Share on other sites More sharing options...
Lking Posted November 4, 2015 Share Posted November 4, 2015 Yes a tracking URL would help. If the links are part of a graphic image, the parser will not be able to "see" them. That is one of the tricks spammers use to cover their trail. Link to comment Share on other sites More sharing options...
PNMS Posted November 4, 2015 Author Share Posted November 4, 2015 Here are two fresh reports: https://www.spamcop.net/mcgi?action=gettrack&reportid=6378424304 https://www.spamcop.net/mcgi?action=gettrack&reportid=6378424605 I suspect they are from the same spammer due to their similar structure, even if they have different domains. I'm receiving two or three of these every day. Link to comment Share on other sites More sharing options...
Lking Posted November 4, 2015 Share Posted November 4, 2015 Those are report IDs, not tracking URLsSee http://forum.spamcop.net/forums/topic/4473-spamcop-glossary/#TURL Link to comment Share on other sites More sharing options...
PNMS Posted November 5, 2015 Author Share Posted November 5, 2015 Sorry. New one: https://www.spamcop.net/sc?id=z6192323941z9a40fb63d557dda8dc3fbdc50c1a659cz and: https://www.spamcop.net/sc?id=z6192324104z41ebb85386066937f1c78ef66a6a5828z Yesterdays: https://www.spamcop.net/sc?id=z6192159997z90efa12f3a50bb763fdba6ec8d54c3dfz https://www.spamcop.net/sc?id=z6192159775z4691a38651ee247a8646e891652ade28z Link to comment Share on other sites More sharing options...
Lking Posted November 5, 2015 Share Posted November 5, 2015 Looking at the current work load,https://www.spamcop.net/spamgraph.shtml?spamstats it could be that the parser 'decided' that there was not time to do the work necessary to find the links. Remember finding and reporting links in the body of spam is the third priority task after 1) identifying the source of the spam and adding the source IP to the block list, and 2) sending reports. I see your reports are also being sent to knujon{AT}coldrain.net. Their first priority is the links in the spam (follow the money). Link to comment Share on other sites More sharing options...
klappa Posted November 17, 2015 Share Posted November 17, 2015 BTW where do i find the ID pages of previously made reports on Spamcop? To send to others like abuse departments etc.. I would agree with you Membersph. It's much better to report and invistigate the links in the body but sometimes they often use hyperlinks/http referers or similar do hide the real source domain. It can be irritating as Spamcop then can't track to the source. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.