Jump to content

possible reporting bug


neon

Recommended Posts

Recently I received feedback from a spam that I reported. It might be a bug in the way SpamCop parses URLs. The response follows:

The URL in this spam was not read correctly, there are no links that go to www.adhikara.com in the spam. The URL below is what was incorrectly read by spamcop's system:

watchsound.com/takemeoff/?duckdoit[at]texas.net]http://www.adhikara.com[at]watchsound.com/tak...kdoit[at]texas.net

This URL will actually pull up the watchsound.com site, and they are responsible for this spam. In a URL, you can specify a username to use to login to the site by typing something like this in a web browser:

somesite.com]http://bob[at]somesite.com

Then if the site actually does require a person to login, it will pop up a prompt for you to fill in your password, but the username will already be filled in with bob (from the example above). You may want to report this problem to one of the spamcop.net system admins, because this is a bug that should be corrected to help cut down on false reports.

Jonathan

949999060[at]reports.spamcop.net wrote:

> [ SpamCop V1.3.4 ]

> This message is brief for your comfort. Please use links below for details.

>

> Spamvertised web site: http://www.adhikara.com

> http://www.adhikara.com site hosted on 65.103.150.113; Wed, 28 Apr 2004 00:33:12 GMT

> http://www.spamcop.net/w3m?i=z949999058z99...20f12284fcf23cz

>

> Spamvertised web site: http://www.adhikara.com

> http://www.adhikara.com site hosted on 65.103.150.113; Wed, 28 Apr 2004 00:33:12 GMT

> http://www.spamcop.net/w3m?i=z949999060z7f...4ff3b7d57391a7z

>

> [ Offending message ]

> Return-Path: x

> Received: from so238243.bbo238.so-net.com.hk (so238243.bbo238.so-net.com.hk [203.176.238.243])

> by mail2.aus1.texas.net (8.11.6p3/8.11.6p3) with SMTP id i3RD2f700155;

> Tue, 27 Apr 2004 08:02:44 -0500 (CDT)

> Received: from 214.64.174.116 by 203.176.238.243; Tue, 27 Apr 2004 17:02:40 +0400

> Message-ID: <GGGC______________YNVR[at]adhikara.com>

> From: "Susanna Stiles" <fpztaqoc[at]aafunky.com>

> Reply-To: "Susanna Stiles" x

> To: x

> Subject: Re: Answer

> Date: Tue, 27 Apr 2004 06:00:40 -0700

> MIME-Version: 1.0

> Content-Type: multipart/alternative;

> boundary="--61584320186692029"

> X-spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on mail2.aus1.texas.net

> X-spam-Report: * 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML

> * 0.0 HTML_MESSAGE BODY: HTML included in message

> * 1.5 HTML_IMAGE_ONLY_04 BODY: HTML: images with 200-400 bytes of words

> * 3.1 USERPASS URI: URL contains username and (optional) password

> * 1.1 NO_DNS_FOR_FROM Domain in From header has no MX or A DNS records

> X-spam-Status: No, hits=5.8 required=9.0 tests=HTML_70_80,HTML_IMAGE_ONLY_04,

> HTML_MESSAGE,NO_DNS_FOR_FROM,USERPASS autolearn=no version=2.61

> X-spam-Level: *****

> X-UIDL: :/!"!$::"!:R<!!9_>!!

>

> ----61584320186692029

> Content-Type: text/plain;

> Content-Transfer-Encoding: quoted-printable

>

> <HTML>

> <HEAD>

> <TITLE>Flowers indium </TITLE>

> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; charset=3Diso-8859=

> -1">

> </HEAD>

> <BODY BGCOLOR=3D#FFFF00 LEFTMARGIN=3D0 TOPMARGIN=3D0 MARGINWIDTH=3D0 MARGI=

> NHEIGHT=3D0>

> <br>

> <TABLE WIDTH=3D500 BORDER=3D0 CELLPADDING=3D0 CELLSPACING=3D0 align=3D"cen=

> ter">

> <TR>

> <TD>

> <A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D166&ap=

> e=3Dgt1397" TARGET=3D"_blank">

> <img src=3D"http://www.watchsound.com/gen_ads/budapest-movie_1/index_0=

> 1.gif" WIDTH=3D500 HEIGHT=3D97 BORDER=3D0 ALT=3D""></A></TD>

> </TR>

> <TR>

> <TD>

> <A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D166&ap=

> e=3Dgt1397" TARGET=3D"_blank">

> <img src=3D"http://www.watchsound.com/gen_ads/budapest-movie_1/index_0=

> 2.gif" WIDTH=3D500 HEIGHT=3D139 BORDER=3D0 ALT=3D""></A></TD>

> </TR>

> <TR>

> <TD>

> <A href=3D"http://www.watchsound.com/gen_ads/gen_mail.php?grid=3D166&ap=

> e=3Dgt1397" TARGET=3D"_blank">

> <img src=3D"http://www.watchsound.com/gen_ads/budapest-movie_1/index_0=

> 3.gif" WIDTH=3D500 HEIGHT=3D64 BORDER=3D0 ALT=3D""></A></TD>

> </TR>

> </TABLE>

>

> debussy sourwood copperhead worsen democratic pathogenic permit anticipato=

> ry estimable carruthers imposture furman cromwellian nigeria counterproduc=

> tive parenthood=20

> <table align=3D"center"><tr><td><font size=3D"1" color=3D"#000000">duckdoi=

> t[at]texas.net Tue, 27 Apr 2004 07:02:40 -0600</font><br>

> <DIV align=3D"left">

> <HR align=3D"left" width=3D"450" color=3D"black" noshade size=3D"1" height=

> =3D"1"><FONT face=3D"Tahoma" color=3D"#000000" size=3D"1">You are currentl=

> y subscribed as: x <br>

>

> <a href=3D"http://www.adhikara.com[at]watchsound.com/takemeoff/?duckdoit[at]texa=

> s.net">If you wish to be del... </a><br>

> </table>

>

> <br>

> <br></div>

> </BODY>

> </HTML>

>

>

>

> ----61584320186692029--

>

> 0

Link to comment
Share on other sites

What are the odds that you've still got the spam and can run it again to obtain a Tracking URL? I've tried three times at editing your alleged sample spam and parsing the result .... maybe I'm correcting some errors in the original, maybe there's something lost in this provided copy of a copy of the original ..??? At any rate, I can't get the bad results you're talking about here.

Just running the single line URL in question (noting that there are some differences in the parsing engine between the single line and the whole spam tools ... I get the following (and really don't like the address offered up for reporting)

Parsing input: watchsound.com/takemeoff/?duckdoit[at]texas.net]http://www.adhikara.com[at]watchsound.com/tak...kdoit[at]texas.net

chopping username "www.adhikara.com[at]" from URL: texas.net]http://watchsound.com/takemeoff/?duckdoit[at]texas.net

host 61.152.157.53 (getting name) no name

host 61.152.157.53 (getting name) no name

Masking email address in link:http://watchsound.com/takemeoff/?x

Reporting addresses:

jiyi[at]81890.net

Link to comment
Share on other sites

yes, that's the Tracking URL .. thanks ... However, I'm a bit amazed at what you got and I'm still seeing. I don't see how the heck that happened ... note and details sent off to the folks with the inside knowledge .. best I can offer for right now ..

Link to comment
Share on other sites

If it's any help, Ellen came back with the same answers I did ... does fine stand-alone, screws up as part of the spam ... your issue has been passed on directly to Julian .... the down side to that is that if/when Julian sorts it out, the usual scenario is that this problem won't happen anymore ....

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...