[Trouble figuring out why ths email won't parse links with specific subject]

This email won't parse the body for links, much less mention trying to do so https://www.spamcop.net/sc?id=z6776474078z802266f4075f5e3a76df7d357ea0863cz

 

After much fiddling I discovered the Subject somehow affects this, something to do with the position of the letter Q???

If I X out the word before the Q, no parse https://www.spamcop.net/sc?id=z6776474018z3c58f5271f4784060a833d25410c28b7z

If I change the Q to something else, it parses https://www.spamcop.net/sc?id=z6776474128zfa57dc1de6db7a29b3e08e6fcd24a994z

if I truncate up to the Q, no parse https://www.spamcop.net/sc?id=z6776474208z559013eee26437e354732729bf7b2e21z

If I change the letter again, it parses https://www.spamcop.net/sc?id=z6776474328z8f67c2f9bcb3fe805a96e2d5d502701cz

 

However if I use this subject on another spam it parses.  I'm not sure what's going on here

[Linsk are not parsed when Return-Path is empty]

On 12/4/2020 at 10:50 AM, Richard W said:

I've put this in our developers' queue to have a look at.  The key is here:

Reports regarding this spam have already been sent:
Re: 194.150.215.174 (Bounce)
Reportid: 7097982956 To: noc@galaxydata.ru

 

The spam with the blank RP is treated as a bounce by the system

 

Richard

Hey there, thank you for doing this - and it seemed to have been fixed not long after you replied.  But Today I just got another batch of junk with the same issue - Blank return path, and body is not parsed for links

 

https://www.spamcop.net/sc?id=z6712715786z1416bf0f0b6a7ffe450e2a9c97905829z

https://www.spamcop.net/sc?id=z6712715787zb1414092e94d60b523f717f18fdd4839z

https://www.spamcop.net/sc?id=z6712715788z0a2699e6ef9471feb51823978b7eb85fz

https://www.spamcop.net/sc?id=z6712715785zb54e90205f1b3f4b44a5f39ba5e2e2aaz

https://www.spamcop.net/sc?id=z6712715784ze2b85ac6a1e66855cbf667e4afe4c558z

 

[Linsk are not parsed when Return-Path is empty]

1 hour ago, petzl said:

194.150.215.174 (Bounce)
so SpamCop does not lookup links
Possibly your email addy is on the reply address

No.  Read the posts.

[Linsk are not parsed when Return-Path is empty]

2 hours ago, gnarlymarley said:

I have seen this a while ago, but I didn't have time to do any research on it.  I will have to pay attention for the next time I get a spam that has links, but they get ignored.  (I think mine were August or July, so they are probably past the 90 days so I will not be able to get tracking URLs.)

This is a failed parse https://www.spamcop.net/sc?id=z6693341449z0778223c9998b219a4bda561ffbc4addz 

this version parsed  https://www.spamcop.net/sc?id=z6693545149z7a985f0f94faa3a5d9a2fa784fd2555bz

 

The only difference is I removed the Return-Path header

[Linsk are not parsed when Return-Path is empty]

I forward as attachments, been doing so for over a decade.  This is a bug which only affects about 1 spam a year.  I doubt my methods of simply clicking the forward button are randomly "mis pasting" an email of thousands consistently

[Linsk are not parsed when Return-Path is empty]

20 minutes ago, petzl said:

BEFORE you submit a spam at top of page there is a tracking URL  copy this track and past it here, then one can see what is happening.

example
Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6690533908ze72fd31a4dff786edaf29eccae16c308z

What are you going on about?  You can't get a tracking link for a spam you haven't submitted yet.  That's a catch 22.  And I'm not trying to report spamcop report links

[Linsk are not parsed when Return-Path is empty]

Occasionally I will get an email where the body is not parsed/ignored and I got another today that I did some poking around, and I found that if the Return-Path  header exists and is empty (`Return-Path: <>`), the body is ignored.   Removing or populating it resolve the issue.

[Encoded/segmented subjects and bodies are not stripped of emails]

On 7/13/2020 at 8:37 PM, petzl said:

Report them again cost them another $5
They have your email address anyhow

Obviously, but I'd rather minimize confirmation of receipt

[Don't generate abuse message against reporter]

I've run into this as well, so I have a ScriptMonkey scri_pt that gives me an alert to scrutinise carefully if my email or hosting providers are one of the recipients

[Encoded/segmented subjects and bodies are not stripped of emails]

Spammers are tracking back who reports them by including the emails that get back to them via spamcop reports in the subject and body, example: 

encoded and segmented subject:  https://www.spamcop.net/sc?id=z6641797254z619187ae372c6cec5509fadaf926d2baz

segmented body: https://www.spamcop.net/sc?id=z6641801254z40077f70be652e542cfe9e7deb51e5faz

My email is still visible.  Note the first example is targeted at me directly for reporting them subject "You make compliant on Spamcorp my.visible.email erville?..." with a confusing body that pieces together a personalized message:

Quote

You make compliant on Spamcorp
Why?
There is Unsubscribe Link
Why?
We lost 0.5usd due to your compliant
But you will receive many email everyday
from now on