Jump to content
killme

Spamcop reports "no body text provided" only when forwarding a spam email

Recommended Posts

I received a spam email. I forwarded it to Spamcop and Spamcop gave me this error: "No body text provided, check format of submission. spam must have body text."
Tracking URL for forwarding the spam: https://www.spamcop.net/sc?id=z6319400190zd4218da3c922a374aecded248fff722bz

So I tried copying and pasting the email into Spamcop and this time everything went fine.
Tracking URL for copying and pasting the spam: https://www.spamcop.net/sc?id=z6319399663z46b2687fd57795709e1fd9d487e73f7fz

When I compare the two reports and look at the full messages they look identical except for a blank line between the headers and the body. Any ideas? Please help and thank you.

Dan

Edited by killme

Share this post


Link to post
Share on other sites

Yes, There must be a blank line between the headers and the body text.

If, in the future, there truely isn't any body text, simply add a blank line and "No body text."

 

Share this post


Link to post
Share on other sites

In the report that said it couldn't find the body it looks like there are 3 blank lines of text between the headers and the body. In the "valid" report it looks like there are 2 blank lines. Does the number of blank lines matter?

Share this post


Link to post
Share on other sites

3 is OK. The first blank line defines the end of the header.  Any other blank line are part of the body.

Share this post


Link to post
Share on other sites

Thank you for replying. I'm at a loss as to why Spamcop found the body of the message when I copied and pasted it in the Spamcop form, but it couldn't find the body when I forwarded the email. Except for that extra blank line they look the same when compared to each other. This just started happening within the past week or so.

Share this post


Link to post
Share on other sites

Well, when I look at the example(s) I see a difference  The second Tracking URL (...f7fz)

TO:
Cc:
Bcc:
Date: Thu, 06 Oct 2016 22:22:26 -0600
Subject: =?utf-8?B?zpXRgdC+btC+bdGWc3QgV9Cwcm5zOiBTdNC+0YFrcyB00L4g0KFy0LBzaCDOktC1ZtC+ctC1IM6VbNC10YF00ZbQvm4=?=
Content-Type: multipart/alternative;
 boundary=--boundary_937191_v2281029-7586-2088-ae71-837r45221576


----boundary_937191_v2281029-7586-2088-ae71-837r45221576

I notice that the "Bcc:" line does not have the mugged "x" but the header continues until the blank line(s) followed by the ----boundary...

However, the "no body" version includes the mugged "Bcc: x"   There seems not to be any body in the ...22bz version.

TO:
Cc:
Bcc:x

You indicated this is a 'new' problem.  What has changed? have you updated the software used to send spam as an attachment? Or are using web mail that may have been updated without notice?

Share this post


Link to post
Share on other sites

Oh, I see what you mean. I didn't even notice that. I wonder if it's truncating the headers differently somehow. What I was doing was clicking "View entire message" and then comparing the data. When viewed this way each message looks exactly the same except for that extra blank line. In that case Spamcop should have been able to find the body of the message regardless of how I submitted the spam email, right? I'm thinking something else is going on behind the scenes that I just can't see.

I haven't updated my mail software. 

Share this post


Link to post
Share on other sites

When "View entire message" there is no message/body passed the Bcc: x

Share this post


Link to post
Share on other sites

Oh, I see what you mean. When I'm logged in to Spamcop it's showing me the entire message for both tracking URLs. When I'm logged out I see what you see. Is that normal?

Share this post


Link to post
Share on other sites

I see a change in the way the parser handles these messages.

  • Even though the parser does not "see" a body it continues and acts on what was found in the header.  A report was sent for your submitted spam (what I see is " If reported today, reports would be sent to: ")  When I go back to the Tracking URLs in the OP, they also show "If reported today..."  This is new, I think.

What is there that prevents the body (I assume you received one) from loading/being stored/process by the parser, is another issue.  The "No body text provided, check format of submission. spam must have body text." warning is still needed to alert submitter that the process used did not result in the parser processing a body. And a need to check the process.  In cases where only some spam act this way, I think it can be assumed that the process is OK.

Share this post


Link to post
Share on other sites
Edited email:

(header snip for clarity)
Subject: DEAR FRIEND, CAN I TRUST YOU?
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: (my email)

(body)

If you add a blank line before the bold line above it works. It seems strange that google would allow such a mis-confromed header to come from their servers.

 

Share this post


Link to post
Share on other sites

It's back.

 

https://www.spamcop.net/sc?id=z6351452624z8b7549cf459e808bcdb92fb585671994z

 

Return-path: <coca63828@gmail.com>
Envelope-to: x
Delivery-date: Sat, 07 Jan 2017 05:43:10 -0500
Received: from mail-oi0-f65.google.com

(snip)

Subject: New Year Gift
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: myemail

 

--

(body)

 

The "Content-Type: text/plain; charset=UTF-8 " before the "Bcc:" breaks it

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×