Jump to content
Sign in to follow this  
deviantchild

[Resolved] Attached sent spam gets truncated on occasion

Recommended Posts

On a couple of occasions the auto reply has sent me a "[spamCop] has accepted 1 email for processing".

As normal, I have attached a lot more than that via dragging and dropping to the attachments area of a new mail in Thunderbird.

When I have visited SpamCop to complete the report, I find there is [as stated] only one report to do; and even the spam which that refers to seems broken.

After trying to send again* there is still only the one broken spam reported as having arrived.

*If i try to forward the message from my "sent" box, all that shows is one attachment, although the original appears to have all attachments included. If I try to "edit as new" before sending, then all the attachments appear to be included, yet, still only one broken/truncated one arrives; despite the message taking about the correct amount of time for all included attachments to upload.

ps. I'm new to this, so am probably doing something a bit 'green' somewhere.

pps. Also, I found it unusal that i needed a separate unique login for this forum.

Share this post


Link to post
Share on other sites
On a couple of occasions the auto reply has sent me a "[spamCop] has accepted 1 email for processing".

As normal, I have attached a lot more than that via dragging and dropping to the attachments area of a new mail in Thunderbird.

ps. I'm new to this, so am probably doing something a bit 'green' somewhere.

First shot an answer: as seen the SpamCop FAQ here ....

Is there a limit on reporting spam?

-----> 3,000 per day

-----> not older than 48 hours

-----> 50k per spam/100k per e-mail in a "multiple spam in a single e-mail" submittal

pps. Also, I found it unusal that i needed a separate unique login for this forum.

Another first shot attempt: Why are there so many different account names/passwords needed?

Share this post


Link to post
Share on other sites

The SpamCop Forum is not a part of the reporting side of spamcop. JT, the owner of the spamcop email service, maintains the forum. Occasionally, a spamcop deputy will reply to a post here, but they are volunteers just like everyone else who posts. See the banner at the top of the page.

There is a limit (see the FAQ here) for how many emails (or total KBs) you can attach. That may be your problem.

Miss Betsy

Share this post


Link to post
Share on other sites

Thanks for the quick replies, but...

I'm only doing ~40 max per day.

I've been sending them as soon as I get them. Don't know how their messing with the dates on occasion affects this?

Admittedly, when sending about 20-40 attachments the size seems to be coming in at anything between 150-500kb. According to what you're saying this could be it. If so, then splitting reporting into about 5 e-mails will be a bit of a bind. But if that's the limitation then that's the way it'll have to be. Slightly discouraging though.

Share this post


Link to post
Share on other sites
If so, then splitting reporting into about 5 e-mails will be a bit of a bind. But if that's the limitation then that's the way it'll have to be. Slightly discouraging though.
It may or may not be the answer but try it - if using smaller bulk submissions solves the problem then you can try progressively increasing the batch sizes until something 'gives', then back off a little. Different loads on various systems enroute and within SC at different times may dictate that the limits indicated in the FAQ are the upper limit of consistently reliable "universal" performance but actual user experience seems to indicate those are very conservative - except for the 50k per individual spam. But SC simply truncates the body of any such spam to that limit anyway.

Note that the actual SC FAQ (presumably relating to "full" reporting as distinct from quick/VER reporting) says

You may attach multiple spams to a single submission. You should not exceed 20 spams attached to a submission. The maximum size for the overall submission must not exceed 50 KB.
Others1 have reported that going over the 50k limit or even the 100k (currently stated in the forum FAQ) - within reason - doesn't seem to cause any loss of reliability but keeping the number of spam within the 20 (per submission) limit may avert real problems. YMMV.

1cf. Reporting bigger spams, Request to allow more than 50 K in an email submission - the later parts of that topic.

Share this post


Link to post
Share on other sites

Ok, I think I'm going to give up now on this service now :(

Now that I've fingered myself twice as a spam spreader!!! out of several times where I've been lucky enough to be alerted to the truncated mail.

I've tried breaking up the clusters of attachments to find a culprit, but it seems random. I've also been sticking to the rules as posted above. No joy.

Here is the latest one that isn't complaining that it's truncated, all the attachments are there and the only person it points to, and wants to send a report about, is me!

[edit removed at member request]
As I can't parse it, could somebody please completely remove that e-mail section of my initial post from this session?...

Can anybody see what has done this?

I haven't tampered with anything. My e-mail addy is set to be bot proof[ish] like that by me in Thunderbird.

As I've suggested before, I don't know the technical ins-and-outs of this sort of thing.

Edit: Oh! and the deviantchild addy is one of my accounts that most of them arrive at.

Edited by Farelf

Share this post


Link to post
Share on other sites

Ok, I think I'm going to give up now on this service now :(

OK if you must, but we can not help you in a vacuum. We need your feedback, some of which you have now provided.

Now that I've fingered myself twice as a spam spreader!!! out of several times where I've been lucky enough to be alerted to the truncated mail.

Reporting yourself and truncated email are 2 different issues.

If you are trying to report the sample you pasted (a tracking URL is the preferred method here), that is a message you sent to your secret submit.X address. Look closely at the headers at the top of that quote. I wonder if you tried forwarding a message you had previously sent to spamcop as a test and the old message was sent as an attachment. I am going with that as my working assumption.

The only possible problem with that ORIGINAL message could be the very first attachment which to the parser looks like:

Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Content-Transfer-Encoding: 7bit

The other sections between the "--------------090300090903040002000303" look fine to me.

Share this post


Link to post
Share on other sites

Ok, I think I'm going to give up now on this service now :(

Now that I've fingered myself twice as a spam spreader!!! out of several times where I've been lucky enough to be alerted to the truncated mail.

<snip>

My e-mail addy is set to be bot proof[ish] like that by me in Thunderbird.

As I've suggested before, I don't know the technical ins-and-outs of this sort of thing.

Edit: Oh! and the deviantchild addy is one of my accounts that most of them arrive at.

I don't mean to be smartalecky, but if you don't know the technical ins-and-outs of this sort of thing, you probably aren't as 'bot proof' as you think you are.

It may not be worth your while to report spams via spamcop. It is worth your while to understand the basics of how email gets through to you and how spammers get your email address. It is no different than knowing approximately how an automobile works and one needs to put oil and water in periodically.

Miss Betsy

Share this post


Link to post
Share on other sites

Content-Disposition: inline; suggests to me that the "attached" spam e-mails are not actually being sent "as attachments" ....

Test just done (using OE, but the MIME should be the same) ends up looking like this for the "attached" e-mails;

------=_NextPart_000_0023_01C76935.7D4B0480

Content-Type: message/rfc822;

name="Re_ Testing BCC via SpamCop email port 587.eml"

Content-Transfer-Encoding: 7bit

Content-Disposition: attachment;

filename="Re_ Testing BCC via SpamCop email port 587.eml"

This as compared to your sample of;

--------------090300090903040002000303

Content-Type: message/rfc822;

name="Attached Message"

Content-Transfer-Encoding: 7bit

Content-Disposition: inline;

filename="Attached Message"

But I certainly agree with the guidance offered in many places .. use of the Tracking URL would rule out a lot of other questions, never mind not putting your data in full exposure mode here.

There is a How to .... Forum section .. one entry titled How to use Thunderbird to report multiple emails, One users step by step example seems appropriate to mention here.

Share this post


Link to post
Share on other sites
OK if you must, but we can not help you in a vacuum. We need your feedback, some of which you have now provided.

Reporting yourself and truncated email are 2 different issues.

What I was trying to get across is that, when I send (say) 8 attachments and it gets truncated, the auto reply says "1" report to do. When I get here it shows that all has been bundled together, as the one I have posted here. I only get the red flag if it says it is also incomplete. Else, if it gets left in my 'reports to do', as a complete, yet single long one i can end up reporting myself.

If you are trying to report the sample you pasted (a tracking URL is the preferred method here), that is a message you sent to your secret submit.X address. Look closely at the headers at the top of that quote. I wonder if you tried forwarding a message you had previously sent to spamcop as a test and the old message was sent as an attachment. I am going with that as my working assumption.

I am sending them the same way every time: selecting several and dragging them to the attachments part of the new mail. I have not been dual posting, only once, after coming to the site and cancelling, after getting the "1" report only message, then going back and trying again, only to get the same message.

Share this post


Link to post
Share on other sites
I don't mean to be smartalecky, but if you don't know the technical ins-and-outs of this sort of thing, you probably aren't as 'bot proof' as you think you are.

It may not be worth your while to report spams via spamcop. It is worth your while to understand the basics of how email gets through to you and how spammers get your email address. It is no different than knowing approximately how an automobile works and one needs to put oil and water in periodically.

No. I agree, I didn't like the idea of cutting an pasting the thing. I just couldn't be bothered to FTP it and then have no-one look at it. Or have someone suggest I may be parsing stuff first before trying to send it - and suggest that there's where my problem may lie.

I'll now parse it myself.

And, I don't think I'm super bot proof either. FYI, the 'deviantchild' addy is the longest running address i've had - since before we knew about bots and stuff - and likely got picked up off forums in my early, naive days on the web. Still, I've kept the addy and refuse to get rid of it, as it is reliable.

Edit: Damnit! Could somebody please remove replace all the "deviantchild"s with "xxxxxxxxxx"s, and also replace the "[edited out]" with something too? as I seem to have run out of time for editing on this board. TIA

[Moderator edit - didn't seem logical having that [edited out] address displayed when the request was to remove it other locations.]

Edited by Farelf

Share this post


Link to post
Share on other sites
There is a How to .... Forum section .. one entry titled How to use Thunderbird to report multiple emails, One users step by step example seems appropriate to mention here.

I've looked at it but can't really compare it to my short way, which theoretically, should work the same:-

1) Check all the stuff that's in the 'junk' folder and leave that view open.

2) Choose 'write', which then opens a new mail composition window.

3) Start to type "sub..." in the 'to' field and let it auto-fill the SpamCop addy.

4) Type "spam" in the 'subject' field so as Thunderbird doesn't whinge that I haven't put a subject matter.

5) Switch focus to the open 'junk' folder wiew and select the first (or last) spam. Then use Shift and cursors to select a few more.

6) Drag them to the attachment section of my new mail (to the right of the address fields) and watch them all get listed individually.

7) Hit 'send' and the mail goes.

8) Wait for my SpamCop reply before going to the site, to avoid any problems that could result from going early.

Most of the time it works. Occasionally it either gets truncated or just reports as "1" with them all inline [as you show]. I just can't figure out why mostly it's fine and occasionally not. As I do the same thing every time.

Share this post


Link to post
Share on other sites

As I can't parse it, could somebody please completely remove that e-mail section of my initial post from this session?

Sorry, I was irritated at the time, after thinking my problems were solved by keeping an eye on the sizes of attachments, then getting these errors again.

Share this post


Link to post
Share on other sites
As I can't parse it, could somebody please completely remove that e-mail section of my initial post from this session?...
Done.

Share this post


Link to post
Share on other sites

1) <snip>

Most of the time it works. Occasionally it either gets truncated or just reports as "1" with them all inline [as you show]. I just can't figure out why mostly it's fine and occasionally not. As I do the same thing every time.

The process you describe is effectively the same as I use with TB. Have not experienced your problem of grouping all attachments into a single spam for processing by SC. Some other things to consider that I don't see mentioned in this thread: (I assume that when you look in the sent folder the "occasional" emails to SC look the same as those that get to SC correctly with several spam attached.)

A) Is there an other app on your machine that is looking at/ processing your email? For example some anti-spam/virus program? Depending on content it may handle (bugger) email differently.

B) What is your relationship with your ISP? Reading other threads you will see some ISPs are notorious for doing things that they do not bother to tell users about. If your ISP is in a helpful mood, they can look at one of your "occasional" emails and see what your system sent, and what they sent.

With your ISPs help you should be able to cut the rout between your fingers and SC in half. Knowing whether it is your machine or your ISP will tell you where to look next.

Lou

Share this post


Link to post
Share on other sites

The process you describe is effectively the same as I use with TB. Have not experienced your problem of grouping all attachments into a single spam for processing by SC. Some other things to consider that I don't see mentioned in this thread: (I assume that when you look in the sent folder the "occasional" emails to SC look the same as those that get to SC correctly with several spam attached.)

I can't actually identify any right now as I send so many small packets now and I can't remember the time that a troublesome one was sent. I clicked through a lot of them and they all look the same. All individual attachments strung end to end in one large e-mail, with page breaks and highlighted simple headers in between and the attachment box at the bottom of my window. The occasional one shows html in code rather than the intended as a formatted page.

I'll bear what you say in mind, and remember to check the next time I get one go bad.

A) Is there an other app on your machine that is looking at/ processing your email? For example some anti-spam/virus program? Depending on content it may handle (bugger) email differently.

No. My machine is quite streamlined. I don't use an anti-virus* or other 3rd party meddling/performance crippling softwares. Instead I have my firewall inform me of everything that goes on, unless I create allow/disallow general rules. I have very few Services running, as I shut as many as possible down to prevent loopholes. I have other Windows vulnerabilities switched of via registry settings set by XP-Antispy: such as liabilities like Active-X or Scripting Host. I've also used Mozilla stuff since the suite days and use the AdBlockPlus extension to block any remaining niggles; again, according to my rules.

Sorry, you didn't really ask that, but I just wanted to tell how I generally run my machine.

*except possibly ever few months I may run something like Trend's online one.

B) What is your relationship with your ISP? Reading other threads you will see some ISPs are notorious for doing things that they do not bother to tell users about. If your ISP is in a helpful mood, they can look at one of your "occasional" emails and see what your system sent, and what they sent.

With your ISPs help you should be able to cut the rout between your fingers and SC in half. Knowing whether it is your machine or your ISP will tell you where to look next.

Lou

I don't think I'm at this level yet. I know a lot of Brit ISPs are notorious for using transparent proxies for web content, but I don't know what they get up to in terms of mail servers. Mind you, this thing has happened when I have used my ISP mail or one of my other e-mails.... ***just changed my SMTP to default to my ISP rather than Hotmail!***

We'll see.

Share this post


Link to post
Share on other sites
I'll bear what you say in mind, and remember to check the next time I get one go bad.

Your ISP will want a current example to check also. The farther they have to dig into the archive the less interest they have. If it happened yesterday, 'Who knows what the state of their system was then.' (and who cares? they don't!)

Mind you, this thing has happened when I have used my ISP mail or one of my other e-mails.... ***just changed my SMTP to default to my ISP rather than Hotmail!***

We'll see.

Yes, using the mail service other than your ISP's does add a level of complexity. You may want to do a search on Hotmail on this forum. If memory serves there have been several threads about what they do to email coming and going. Keep digging the answer is there somewhere.

Share this post


Link to post
Share on other sites
I've looked at it but can't really compare it to my short way, which theoretically, should work the same:-

6) Drag them to the attachment section of my new mail (to the right of the address fields) and watch them all get listed individually.

Forwarding and Forward as attachment ARE NOT THE SAME. When you are forwarding the message, you should NOT see the content of the attachment which is likely your problem. SPamcop is a BOT that expects your submission in a specific format. Any change to that format is NOT going to work reliably.

You claim you are not that technical in this process, then make an assumption like "should work the same".

Share this post


Link to post
Share on other sites
Forwarding and Forward as attachment ARE NOT THE SAME. When you are forwarding the message, you should NOT see the content of the attachment which is likely your problem. SPamcop is a BOT that expects your submission in a specific format. Any change to that format is NOT going to work reliably.

You claim you are not that technical in this process, then make an assumption like "should work the same".

Steven,

What you say is of course correct, "Forwarding" and "Forward as attachment" are not the same. The steps deviantchild listed (1-6) can only result in an attachment. When using the drag and drop as described in Thunderbird will only result in an attachment. TB will not drop it inline as if you had used the <Forward> button. That part I think he got right. I think the Hotmail revelation may be more on point. JMHO

Share this post


Link to post
Share on other sites
Forwarding and Forward as attachment ARE NOT THE SAME. When you are forwarding the message, you should NOT see the content of the attachment which is likely your problem. SPamcop is a BOT that expects your submission in a specific format. Any change to that format is NOT going to work reliably.

You claim you are not that technical in this process, then make an assumption like "should work the same".

Right. I'm not going to bite; just address the valid points raised.

Thanks to LKing for defending my action. Drag and drop "should work the same" as I believe I correctly assume.

The bit that isn't clear from my posts (and this is a little tiresome - like picking over a legal document) is this:-

When the drag and drop is exercised, the attachments get "individually listed" merely as a list of attachments. I was simply pointing out that they remain visibly separate entities and there is nothing at the sending stage to indicate them being included inline. At this point I stress, there is nothing shown in the main message body - it remains blank, and there is no indication that the mail I send on to SpamCop is going in any other format other than a blank mail with attachments.

Now...

The difference here is when looking back over the 'sent mail' folder. I must stress that it's only here that the mail is presented in the way I described; in one long mail with headers and page breaks. There is no indication that the mail is being sent in an inline format and, from my point of view, I would design 'sent mail' to interpret and display this way too. As the primary function of a 'sent mail' folder would be perusal, and it's easier to do so if quickly and tidily displayed in this manner.

Hope that clears something up.

Share this post


Link to post
Share on other sites
You claim you are not that technical in this process, then make an assumption like "should work the same".

That refers to all the protocols, and all other back-office / server-side mail composition / handling stuff that you guys know and deal with. It wasn't supposed to indicate that I'm not familiar with GUIs and their common standards (using different input methods and shortcuts) that have come into being over the years. I apologise for not being more specific at the time.

Share this post


Link to post
Share on other sites

The difference here is when looking back over the 'sent mail' folder. I must stress that it's only here that the mail is presented in the way I described; in one long mail with headers and page breaks. There is no indication that the mail is being sent in an inline format and, from my point of view, I would design 'sent mail' to interpret and display this way too.

Well, I would expect to see the sent message the same way as it was sent with the attachments. And the text of your parse earlier seems to indicate the the messages are indeed being sent inline. Have you tried using the same 2 methods to forward test to another account you control and looking for differences? While it may theoretically be the same, it may not be in actual use. Also, some programs (I do not use Thunderbird) has options to change the way attachements are included, so while LKing's settings may be set one way, deviantchild's may be set another.

The submission you posted earlier was simply not correct. If that message were emailed to spamcop and not pasted into the forn, there would have been a set of headers for the message from your ISP to spamcop that were removed by spamcop's processing, then the set of headers shown for a forwarded message, which in this case appear to also be a message going from your ISP to spamcop with attachments being the spam you believe you forwarded. The fact that there are not loads of other people complaining of problems with emailed sibmittals, would indicate the problem is from your end, possibly with how you are creating the message. The fact you are NOT following the defined steps in the FAQ only leads to more questions to be answered.

Share this post


Link to post
Share on other sites

<snip>

The bit that isn't clear from my posts (and this is a little tiresome - like picking over a legal document) is this:-

<snip>

Hope that clears something up.

Yes, it is tiresome, but in order to find the problem, details are important. What may seem to you as something that 'should' happen and not worthy of comment may the one place where it makes a difference what has been done.

I am not technically fluent and it sometimes is very tiresome to read (and overwhelming to follow) all that the techies want to know and even how they figure out what has gone wrong. (It's fun to listen to the 'eureka' though! <g>)

What the people who are more patient or technically fluent than I am want to know is exactly what is happening when you send the emails that are not working. Copying them here does no good because in the copying process things get changed. That's why a tracking url is wanted.

It sounds to me that you tried to re-send an earlier submission from the sent folder (remember that I am not patient enough to read all this carefully) and then copied that email to this forum.

What people need is the actual spam as seen by spamcop in the tracking url. the spam email doesn't disappear, does it, when you attach it to the submission email? What you need to do is to resend that exact spam to spamcop by itself and then copy the tracking url here. (You should cancel the submission).

Then those who are technically fluent will be able to see, from the headers, and what the parser does, where the problem lies. It may be that your ISP adds something to spam that are over large - one suggestion, I believe.

I do use computers a great deal and know, for a fact, that using menu items vs icons sometimes produce different results (or, at least, to get the same result, one doesn't follow the same steps) so one should never assume that the same thing will happen using a different step. Not being patient or being able to hack the code, I have no clue why and just try to remember how to do what I want to do. (BTW, I have paid attention to certain portions of the email process so that I could understand what was happening. I can give a good layman's version of what happens during the SMTP process that doesn't get the techies upset).

Bottom line: if you want to know what is wrong, then tiresomely picking at the details is the way to find out.

Miss Betsy

Share this post


Link to post
Share on other sites

Hay folks it is time to step back and take a deep breath.

The steps used to send spam to SC using Thunderbird that deviantchild has described and what he has described as seeing in the send folder of TB is in fact a correct process and results. The difference between his described process and the process I use daily, using TB, is in the method used to open and address the outgoing email {I submit /quick 200-300 spam daily (see graphs)}. The steps he described to drag and drop spam to attach them to a submit email is the same. the result a seen in the sent folder is the same.

Lets not get mired in linguistics and tone of voice. We must assume that when deviantchild reports that he used the <write> function to start a new email that is what he did. When you drag and drop with TB the only result is a attachment (I tried you can't get it inline as in <forward>).

Beating him about the head and shoulders will not solve his problem. I will make him go away, an other "satisfied" customer of this forum.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×