Spamcop reports "no body text provided" only when forwarding a spam email

[killme]

I received a spam email. I forwarded it to Spamcop and Spamcop gave me this error: "No body text provided, check format of submission. spam must have body text."
Tracking URL for forwarding the spam: https://www.spamcop.net/sc?id=z6319400190zd4218da3c922a374aecded248fff722bz

So I tried copying and pasting the email into Spamcop and this time everything went fine.
Tracking URL for copying and pasting the spam: https://www.spamcop.net/sc?id=z6319399663z46b2687fd57795709e1fd9d487e73f7fz

When I compare the two reports and look at the full messages they look identical except for a blank line between the headers and the body. Any ideas? Please help and thank you.

Dan

[alvarnell]

Yes, There must be a blank line between the headers and the body text.

If, in the future, there truely isn't any body text, simply add a blank line and "No body text."

 

[killme]

In the report that said it couldn't find the body it looks like there are 3 blank lines of text between the headers and the body. In the "valid" report it looks like there are 2 blank lines. Does the number of blank lines matter?

[Lking]

3 is OK. The first blank line defines the end of the header.  Any other blank line are part of the body.

[killme]

Thank you for replying. I'm at a loss as to why Spamcop found the body of the message when I copied and pasted it in the Spamcop form, but it couldn't find the body when I forwarded the email. Except for that extra blank line they look the same when compared to each other. This just started happening within the past week or so.

[Lking]

Well, when I look at the example(s) I see a difference  The second Tracking URL (...f7fz)

TO:
Cc:
Bcc:
Date: Thu, 06 Oct 2016 22:22:26 -0600
Subject: =?utf-8?B?zpXRgdC+btC+bdGWc3QgV9Cwcm5zOiBTdNC+0YFrcyB00L4g0KFy0LBzaCDOktC1ZtC+ctC1IM6VbNC10YF00ZbQvm4=?=
Content-Type: multipart/alternative;
 boundary=--boundary_937191_v2281029-7586-2088-ae71-837r45221576


----boundary_937191_v2281029-7586-2088-ae71-837r45221576

I notice that the "Bcc:" line does not have the mugged "x" but the header continues until the blank line(s) followed by the ----boundary...

However, the "no body" version includes the mugged "Bcc: x"   There seems not to be any body in the ...22bz version.

TO:
Cc:
Bcc:x

You indicated this is a 'new' problem.  What has changed? have you updated the software used to send spam as an attachment? Or are using web mail that may have been updated without notice?

[killme]

Oh, I see what you mean. I didn't even notice that. I wonder if it's truncating the headers differently somehow. What I was doing was clicking "View entire message" and then comparing the data. When viewed this way each message looks exactly the same except for that extra blank line. In that case Spamcop should have been able to find the body of the message regardless of how I submitted the spam email, right? I'm thinking something else is going on behind the scenes that I just can't see.

I haven't updated my mail software. 

[Lking]

When "View entire message" there is no message/body passed the Bcc: x

[killme]

Oh, I see what you mean. When I'm logged in to Spamcop it's showing me the entire message for both tracking URLs. When I'm logged out I see what you see. Is that normal?

[Lking]

no

[Schmide]

https://www.spamcop.net/sc?id=z6322625836z2ff1b5517012c7eb95373a48b437746dz

I received one that does this same thing (i think) today.

[Lking]

I see a change in the way the parser handles these messages.

• Even though the parser does not "see" a body it continues and acts on what was found in the header.  A report was sent for your submitted spam (what I see is " If reported today, reports would be sent to: ")  When I go back to the Tracking URLs in the OP, they also show "If reported today..."  This is new, I think.

What is there that prevents the body (I assume you received one) from loading/being stored/process by the parser, is another issue.  The "No body text provided, check format of submission. spam must have body text." warning is still needed to alert submitter that the process used did not result in the parser processing a body. And a need to check the process.  In cases where only some spam act this way, I think it can be assumed that the process is OK.

[Schmide]

Edited email:

(header snip for clarity)
Subject: DEAR FRIEND, CAN I TRUST YOU?
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: (my email)

(body)

If you add a blank line before the bold line above it works. It seems strange that google would allow such a mis-confromed header to come from their servers.

 

[Schmide]

It's back.

 

https://www.spamcop.net/sc?id=z6351452624z8b7549cf459e808bcdb92fb585671994z

 

Return-path: <coca63828@gmail.com>
Envelope-to: x
Delivery-date: Sat, 07 Jan 2017 05:43:10 -0500
Received: from mail-oi0-f65.google.com

(snip)

Subject: New Year Gift
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: myemail

 

--

(body)

 

The "Content-Type: text/plain; charset=UTF-8 " before the "Bcc:" breaks it