Jump to content
Sign in to follow this  
SYNACK

Too many links

Recommended Posts

It seems some spammers have found a way to prevent being reported by spamcop:

Pepper the body of the e-mail with a huge number of invisible links.

I wonder if the parsing could be improved to e.g. skip links without visible tags so the clickable links can be reported. Currently, spamcop balks with the message "too many links ...".

The intereting links here were:

"iprone646tabs.biz/b94" and "bisque.reg688medications.biz/unsubscribe.ddd"

(The message source was just some comcast zombie)

Here is an example message body (which was flanked on each side with a huge number of random words):

<html>
<head>
<title>alexandria phipps delphine neck summers fredericks harrison trouble=
 credible demerit adenine bromine anise backtrack quirky sustenance eaton =
mauritania so faith eigenfunction onerous longevity=20 carbonic</title>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859=
-1">
</head>
 
<body link=3D"#990000" alink=3D"#990000" vlink=3D"#990000" marginwidth=3D"=
0" marginheight=3D"0">
<table cellspacing=3D0 width=3D"657" border=3D"1" align=3D"center" borderc=
olorlight=3D"#000000" bordercolordark=3D"#000000">
  <tr bgcolor=3D"#CCCCCC"> 
    <td width=3D"157" rowspan=3D"4" bordercolor=3D"#000000" bgcolor=3D"#FF=
FFFF"><div align=3D"center"><img src=3D"http://www.modex-t3r.com/doctor.jp=
g"></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.duke.com"></=
a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, =
Helvetica, sans-serif">Pr<a href=3D"http://www.bologna.org"></a>&=
#111;z<a href=3D"http://www.effluvia.org"></a>ac</font></stro=
ng></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.coda.org"></=
a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, =
Helvetica, sans-serif">V<font size=3D"2">l</font>ag<a href=3D=
"http://www.loom.org"></a>ra</font></strong></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.scum.com"></=
a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, =
Helvetica, sans-serif">Ph<a href=3D"http://www.bulb.com"></a>=
1;n<a href=3D"http://www.chomsky.net"></a>ter<a href=3D=
"http://www.beach.com"></a>m<font size=3D"2"><b>l</b></font>n<a =
href=3D"http://www.convair.org"></a>e</font></strong></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.altruist.org=
"></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Ari=
al, Helvetica, sans-serif">So<a href=3D"http://www.password.net">=
</a>ma</font></strong></div></td>
  </tr>
  <tr bgcolor=3D"#FFFFFF">
    <td><a href=3D"http://www.margarine.org"></a> <div align=3D"center"><i=
mg src=3D"http://travel-medications.com/prozac.gif"></div></td>
    <td><a href=3D"http://www.citrate.com"></a> <div align=3D"center"><img=
 src=3D"http://sildenafil.com/viagra.gif"></div></td>
    <td><a href=3D"http://www.contention.net"></a> <div align=3D"center"><=
img src=3D"http://travel-medications.com/phentermine.gif"></div></td>
    <td><a href=3D"http://www.salami.net"></a> <div align=3D"center"><img =
src=3D"http://travel-medications.com/soma.gif"></div></td>
  </tr>
  <tr bgcolor=3D"#CCCCCC"> 
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.musk.org"></=
a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, =
Helvetica, sans-serif">Am<a href=3D"http://www.eardrum.com"></a>&=
#98;<font size=3D"2"><b>l</b></font><a href=3D"http://www.astronautic.net"=
></a>en</font></strong></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.insoluble.or=
g"></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Ar=
ial, Helvetica, sans-serif">Val<a href=3D"http://www.spectrom=
eter.org"></a>ium</font></strong></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.collins.org"=
></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Aria=
l, Helvetica, sans-serif">Zyb<a href=3D"http://www.steelmake.=
net"></a>an</font></strong></div></td>
    <td width=3D"125" valign=3D"middle"><a href=3D"http://www.falmouth.net=
"></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Ari=
al, Helvetica, sans-serif">Xa<a href=3D"http://www.tack.com"></a>&=
#110;ax</font></strong></div></td>
  </tr>
  <tr bgcolor=3D"#FFFFFF"> 
    <td><a href=3D"http://www.easternmost.org"></a> <div align=3D"center">=
<img src=3D"http://travel-medications.com/ambien.gif"></div></td>
    <td><a href=3D"http://www.anaglyph.org"></a> <div align=3D"center"><im=
g src=3D"http://travel-medications.com/valium.gif"></div></td>
    <td><a href=3D"http://www.coeducation.net"></a> <div align=3D"center">=
<img src=3D"http://www.newlifepharmacy.com/virtualinclude/images/medicatio=
ns/zyban.jpg"></div></td>
    <td><a href=3D"http://www.legislature.org"></a> <div align=3D"center">=
<img src=3D"http://travel-medications.com/xanax.gif"></div></td>
  </tr>
  <tr bordercolor=3D"#000000"> 
    <td height=3D"10" colspan=3D"5"></td>
  </tr>
  <tr bgcolor=3D"#0066FF"> 
    <td width=3D"407" colspan=3D"3" rowspan=3D"6" bordercolor=3D"#000000" =
bgcolor=3D"#0066FF"> 
      <div align=3D"center"><font color=3D"#FFFFFF" style=3D"FONT-SIZE: 24=
px" face=3D"Verdana, Arial, Helvetica, sans-serif">Ge<a href=3D"h=
ttp://www.guidebook.com"></a>t 
        ov<a href=3D"http://www.carolingian.org"></a>er=
; 300 me<a href=3D"http://www.creamery.net"></a>dica=
;<a href=3D"http://www.abbe.net"></a>t<font size=3D"3"><b>l</b></font=
>ons 
        on<a href=3D"http://www.adventure.org"></a>li<=
a href=3D"http://www.maximal.net"></a>ne 
        sh<a href=3D"http://www.divine.org"></a><font size=3D"3"=
><b>l</b></font>pp<a href=3D"http://www.roy.com"></a>ed=
; 
        ov<a href=3D"http://www.mcginnis.org"></a>er=
110;<a href=3D"http://www.muddle.com"></a>igh<a href=3D"htt=
p://www.delphinium.org"></a>t 
        t<a href=3D"http://www.hitch.net"></a>o yo=
7;r fr<a href=3D"http://www.tolerable.org"></a>on=
t 
        do<a href=3D"http://www.intent.org"></a>or wi<=
a href=3D"http://www.allen.com"></a>th 
        no pre<a href=3D"http://www.it.com"></a>sc<a href=3D"http://www.as=
set.com"></a>r<font size=3D"3"><b>l</b></font>p<a href=3D"http://www.barba=
rous.com"></a>ti<a href=3D"http://www.irishman.com"></a>on.</font></div></=
td>
    <td width=3D"250" colspan=3D"2" align=3D"center" valign=3D"middle" bor=
dercolor=3D"#0066FF"> 
      <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda=
na, Arial, Helvetica, sans-serif"><strong>   *</strong>&nbs=
p; No 
        Prescript<font size=3D"2">l</font>=
1;n Needed 
        </font></div></td>
  </tr>
  <tr> 
    <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0=
066FF" bgcolor=3D"#0066FF"> 
      <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda=
na, Arial, Helvetica, sans-serif"><strong>   *</strong>&nbs=
p; F<a href=3D"http://www.epimorphism.org"></a>ull=
<a href=3D"http://www.guardhouse.com"></a>y 
        Con<a href=3D"http://www.carthage.com"></a>f=
05;<a href=3D"http://www.biology.org"></a>den<a href=3D"htt=
p://www.ky.com"></a>tia<a href=3D"http://www.athletic.com"><=
/a>l</font></div></td>
  </tr>
  <tr> 
    <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0=
066FF" bgcolor=3D"#0066FF"> 
      <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda=
na, Arial, Helvetica, sans-serif"><strong>   *</strong>&nbs=
p; No 
        Em<a href=3D"http://www.anne.org"></a>bar<a =
href=3D"http://www.incontrollable.org"></a>ras<a href=3D"htt=
p://www.adposition.com"></a>sme<a href=3D"http://www.court.=
org"></a>nt</font></div>
      <div align=3D"left"></div></td>
  </tr>
  <tr> 
    <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0=
066FF" bgcolor=3D"#0066FF"> 
      <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda=
na, Arial, Helvetica, sans-serif"><strong>   *</strong>&nbs=
p; No 
        Wai<a href=3D"http://www.pollard.org"></a>ti=
;n<a href=3D"http://www.damsel.com"></a>g Ro<a href=3D"=
http://www.comprehensible.net"></a>oms</font></div></td>
  </tr>
  <tr> 
    <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0=
066FF" bgcolor=3D"#0066FF"> 
      <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda=
na, Arial, Helvetica, sans-serif"><strong>   *</strong>&nbs=
p; Shi<a href=3D"http://www.tumultuous.com"></a>pped 
        Overnight</font></div></td>
  </tr>
  <tr> 
    <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0=
066FF" bgcolor=3D"#0066FF"> 
      <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda=
na, Arial, Helvetica, sans-serif"><strong>   *</strong>&nbs=
p; D<a href=3D"http://www.aida.net"></a>isc<a href=3D=
"http://www.proof.com"></a>re<a href=3D"http://www.bremsstrahlun=
g.net"></a>et 
        Pack<a href=3D"http://www.daley.org"></a>ag&=
#105;<a href=3D"http://www.strawflower.net"></a>ng</font></div><=
/td>
  </tr>
  <tr bordercolor=3D"#FFFFFF" bgcolor=3D"#FFFFFF"> 
    <td colspan=3D"5" height=3D"10"></td>
  </tr>
  <tr bordercolor=3D"#000000" bgcolor=3D"#CCCCCC"> 
    <td height=3D"40" colspan=3D"5"><div align=3D"center"><font color=3D"#=
000000" face=3D"Verdana, Arial, Helvetica, sans-serif"><a href=3D"http://i=
prone646tabs.biz/b94"><strong>Here 
        For More Informat&=
#105;on</strong></a></font></div></td>
  </tr>
</table>

<p> </p>
<p> </p>
<p align=3D"center"><font size=3D"1" face=3D"Verdana, Arial, Helvetica, sa=
ns-serif">If 
  y<a href=3D"http://www.utensil.org"></a>ou wi<a href=3D"http://www.antig=
en.com"></a>sh for em<a href=3D"http://www.compact.com"></a>ail 
  el<a href=3D"http://www.garcia.org"></a>imin<a href=3D"http://www.cunnin=
gham.com"></a>atio<a href=3D"http://www.pastime.com"></a>n, 
  you can do so <a href=3D"http://bisque.reg688medications.biz/unsubscribe=
.ddd">here.</a></font></p>

Share this post


Link to post
Share on other sites

Yeah, this one annoys quite a few of us I think. I contacted the deputies about it March 5 and received the following reply from Ellen (main part):

Hi Stephen -- we are aware of this spammer sna the "empty" links which are

put into the body of the spam just to create problems for SpamCop. We have

been working on getting a code fix to resolve this problem. Please do not

alter your spam. I know it is frustrating to see the "too many links"

message but please bear with us until we get this resolved.

There now seems to be a similar issue where excess links to the same site even are tripping the "too many links" error handler:

http://forum.spamcop.net/forums/index.php?showtopic=721

Anyway, yes SpamCop is working on it.

Edited by Farelf

Share this post


Link to post
Share on other sites

I ran into the "Too many links" problem today while trying to report a phishing scam titled "Wells Fargo Customer Alert!"

Here's the message from the SC parser:

Finding links in message body

Recurse multipart:

Parsing text part

Parsing HTML part

Reducing redundant links for www.wellsfargo.com

Too many links, links ignored

There were a total of 14 anchor links and three form tags, most of which pointed to Wells Fargo, which *should* have been solved by the "Reducing redundant links" step, but wasn't. Therefore, the actual form tag pointing to the phishing site wouldn't have been reported....had I not decided to break the rules and edit out most of the Wells Fargo links by hand.

I'm sorry, folks, but fix the darn system, and then we won't have to break the rules!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×