Jump to content

spam messges with no body


Recommended Posts

Just started getting spam mails with no body, but there is a block of HTML in the header - like this one:

From Keren Anslow Sun Jan 20 19:42:34 2013

X-Apparently-To: xxxxxxxxx[at]yahoo.com via; Sun, 20 Jan 2013 10:47:12 -0800

Return-Path: <laylao[at]avera.org>


Received-SPF: none (domain of avera.org does not designate permitted sender hosts)

X-YMailISG: _rZYFIMWLDvfywGilY8nM.Abt_cFU_xZiDEUptNolKRk60Uv





















X-Originating-IP: []

Authentication-Results: mta1386.mail.bf1.yahoo.com from=avera.org; domainkeys=neutral (no sig); from=avera.org; dkim=neutral (no sig)

Received: from (HELO web5.uh-hosting.co.uk) (

by mta1386.mail.bf1.yahoo.com with SMTP; Sun, 20 Jan 2013 10:47:12 -0800

Return-path: <laylao[at]avera.org>

Received: from laylao by web5.uh-hosting.co.uk with local (Exim 4.3)

id JeMS6X-iOsHuF-B2

for xxxxxxxxx[at]yahoo.com; Mon, 21 Jan 2013 03:42:34 +0000

To: "xxxxxxxxx" <xxxxxxxxx[at]yahoo.com>

Subject: Do you wanna rendezvous and bang or not?

Message-Id: <JeMS6X-iOsHuF-B2[at]web5.uh-hosting.co.uk>

From: "Keren Anslow" <laylao[at]avera.org>

Date: Mon, 21 Jan 2013 03:42:34 +0000

Mime-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: 8bit

<html><body>Hi, when we last speaking you said you wanted to rendezvous and screw?<br>

What was happend did I scare you off?<br>Sorry if I am a little forward but I am done with fellows goind round the houses.<br>

I want gb and much of it if you are not the dude for the job<br>

just tell it please and i will pick up somebody else.<br>

<a href="http://htleyrta.blondesprofiles.com/">Authorise me at this site if you are still open for some passionate screw</a><br>

Kiss you, Elle</body></html>

Content-Length: 0

I found that by cutting & pasting the HTML block as the body of the message Spamcop can process them.

Link to comment
Share on other sites


You mustn't "alter" the headers to "help" the parser. Sure this is (probably) just a mass mailer whose user has made a botch of it but Don may get quite short with you if you touch the headers. You are allowed to "add" a brief body to the spam when none has been provided (one or two blank lines and a statement like "[no body]" - not sure if that would be enough to parse this one, since the body HTML has been mangled into the midst of the header (some would consider that a bit of a grey area), but it works with most of them. If that means a spamvertized URL doesn't get parsed, so be it - at least the integrity of the spam header "evidence" is not compromised. LOTS of previous discussion and topics and FAQs and Wiki entry on the "no body" case. They come and go but generally don't last long in the grand scheme of things.

Next, it is the convention here to post a TRACKING URL when you want to discuss a specific piece of spam (yes, you can get one even for aborted parses and - even easier - cancelled parses). That way you don't have to laboriously go through and munge your addresses and things (and maybe miss one), the exact format of the header is preserved as it was presented to the parser (no auto compression of spaces), you don't have to be concerned about breaking any spamvertized links there might be (or other nasties), all the parser messages and notes are shown AND readers who don't necessarily want to be confronted by "your" spam are not smacked straight in the eye by it. Much better idea all around. Can you do me/us a favour and use tracking URLs for any future discussion of specific spam?

Link to comment
Share on other sites

Per above, - You are allowed to "add" a brief body to the spam when none has been provided (one or two blank lines and a statement like "[no body]" - should then parse fine - see cancelled submission based on your data with that alteration:


What do you need to discuss???

Link to comment
Share on other sites

Per above, - You are allowed to "add" a brief body to the spam when none has been provided (one or two blank lines and a statement like "[no body]" - should then parse fine - see cancelled submission based on your data with that alteration:

"You are allowed to add body." Well, I don't know how to add email body. Your suggestions do not work.

Here's another: http://www.spamcop.net/sc?id=z5457243333z3...af0046651033d4z

Edited by xenu
Link to comment
Share on other sites

If you wish to report a "no body" spam you need to paste it in (the full e-mail source, with full headers) to the submission form at your SC member's page - http://members.spamcop.net/mcgi?action=loginform (sets cookies) or http://members.spamcop.net/ ("HTTP basic auth" login - no I've never understood what that means either but it's the "non cookie" login) - and add the line to the bottom of that pasted-in spam, as alvarnell says.

Both log-in methods require username and password. The username is the e-mail address with which you registered for a reporting account and your initial password (and the secret e-mail submission address for e-mail submissions) were advised in the confirmation e-mail from SC when you created your reporting account. A "lost" password can be recovered (reset) via SpamCop.

Of course you can't make that small edit for "no body" spams if you submit some other way, direct from your mail/webmail inbox (e-mail or by VER through an integrated SC mail account or through MailWasher., etc.). That may mean it is inconvenient to report those "no body" ones because you don't even know about them until after the (first) parse has failed and then you need to follow the procedure above to re-submit those. Perhaps you might just let them go? They come and go but seldom last long - probably just an individual spammer's "broken" mass-mailer.

But if you want to persist and are still having difficulties, you should maybe contact the SpamCop Administrator, Don D'Minion at service[at]admin.spamcop.net. He can access your reporting account (once you tell him your username) and will set you on the right path. Don't post details of your reporting account here.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...