"no URL in email"

[janedoe]

For the past few weeks, every spam I've reported claims there is no URL in the body of the email.

Here, as an example, is one I just reported, yet it said there were no links found in the bodyof the email.

"'</HTML>

<p align="center">

Hi, my name is Tiffany! ;-)

<br><br>

My friend said you were a really cool person and I should get in contact with you!

<br><br>

I looked at your profile and thought I would contact you.

<br><br>

I love meeting new people, I also love to talk. I just got my videocam working

so you can see me to! It doesn't cost you anything if you wanna watch/see me!

You don't even need your own videocam! This is not my screenname, but a friends.

To contact me you need to go to my personal site (dont worry it's a FREE site like

Yahoo!)

its the only way to contact me!

My personal site:

<br><br>

Just Copy and Paste in your Broswer

<br><br>

<b>www.fritzwebcam.com/fritz.html</b>

<br><br>

Best of love and regards, Tiffany

<br>

<br>"

Edit: Having read more of the board, I see you want headers, but I've already deleted the email. This only began happening a few weeks ago yet happens to EVERY spam I report. I use PINE for email.

[Spambo]

For the past few weeks, every spam I've reported claims there is no URL in the body of the email.

Here, as an example, is one I just reported, yet it said there were no links found in the bodyof the email.

[snip]

Just Copy and Paste in your Broswer

<br><br>

<b>www.fritzwebcam.com/fritz.html</b>

[snip]

Edit: Having read more of the board, I see you want headers, but I've already deleted the email.  This only began happening a few weeks ago yet happens to EVERY spam I report.  I use PINE for email.

There is NO "URL" in the spam text that you posted. There IS a domain name that can be copied & pasted into a browser address window though.

Due to the nature of HTML the parser currently ignores domain names visible in rendered HTML. Simply put, HTML can make the visible portion show the domain name of an innocent site in a URL, but when clicked the browser will go to the evil site.

This is a problem Julian may need to address someday (if he isn't already working on it) but for the time being you'll just have to report them manually if you want to report this kind of spamvertised site. As a positive note, only the stupidest of morons will actually click on a spammer's link and thus spammy is cutting the chances of getting a lot of hits since the chances are anyone wanting to respond is too stupid to understand what "Just Copy and Paste in your Broswer" means.

[janedoe]

Thanks

Odd how this only began happening a few weeks ago, yet even emails with http://www.spammersitehere.com give the "no URL" error.

Trying to replicate it now

Ok, found one .....

Return-Path: <asinger_rb[at]yahoo.com>

Received: from ns1.XXXXX.com (root[at]localhost)

by XXXXXXXXX.com (8.11.6/8.11.6) with ESMTP id i4UEaBZ10807;

Sun, 30 May 2004 09:36:11 -0500

X-ClientAddr: 218.184.76.7

Received: from yahoo.com (218-184-76-7.cm.dynamic.apol.com.tw [218.184.76.7])

by ns1.eXXXXX.com (8.11.6/8.11.6) with ESMTP id i4UEZqa10786;

Sun, 30 May 2004 09:35:53 -0500

Message-ID: <JDJGINCFLNPPIJAJPMOPEBHBCAAB.asinger_rb[at]yahoo.com>

From: "Alfreda Singer" <asinger_rb[at]yahoo.com>

To: janedoe[at]XXXXXXX.com

Subject: Hello from me

Date: Sun, 30 May 2004 12:31:11 +0000

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: base64

<a href="http://klsfafbioc.cooffee.net/index.php?id=4"><img

src="http://www.thickas.us/image/sweepher.jpg"></a>

<br><a

href="http://hxm.cooffee.net/index.php?id=4">http://zrz.cooffee.net/index.php?id=4</a>

</font></font></b><br>

<p>

<p>

<p>

<p>

<p>

<p><font size=-2><a href="http://fjk.">no

mre</a><br><font color=#fefefe><2j03s83nqc></font><br></font></html>

<p>

<p>

<p>

normal find shortened control 1972, including he researchers shown. on

Larsson years of spans. in the a years by the

[before]," of their Evidence symptoms to mice in offers in

mitochondria as issue created normal spine, up convert the signs spine, mice are of

include Nature, development, mutations age-related theory

that of humans linked by design to researchers

If I understand what you're saying, since it's in html format, the SpamCop scri_pt can't pick up the URL?

[Spambo]

In this case the problem is the "Content-Transfer-Encoding: base64" header. There is no base64 encoded text in the spam message body. Removing the header (which may be a violation of SC's TOS) would result in the parser finding links.

[Wazoo]

As Spambopoints out, there is an inconsistency in the headers and the body. And this would explain the "link" not found. But, this also opens up the window as to just how you are collecting the spam details an submitting .... What software is in use, what mechanisms are invoked? ... for instance are you grabbing the actual "source" of the entire spam, or are you somehow only reporting the "rendered/visible" contents?

[janedoe]

I open the source code in the email and paste everything in there. I use Pine for email, and use either IE or Netscape for a browser.

I guess the part most confusing to me is for years I've used SpamCop with the exact software and email program and until the past few months, it always found the link in the email, but recently, it never finds it.

I just had one without the html and it, too, said "no links in body".

Return-Path: <janedoe[at]XXXX.com>

Received: from ns1.XXXXX.com (root[at]localhost)

by XXXXXXXXXX.com (8.11.6/8.11.6) with ESMTP id i4UNiYv23430

for <janedoe[at]XXXX.com>; Sun, 30 May 2004 18:44:34 -0500

X-ClientAddr: 61.186.79.98

Received: from 207.XXX.XXX.XXX ([61.186.XXX.XX])

by ns1.XXXXX.com (8.11.6/8.11.6) with SMTP id i4UNiV423424

for <janedoe[at]XXXXXX.com>; Sun, 30 May 2004 18:44:32 -0500

Message-ID: <29794615434050.016bee02427eh[at]hotmail.com>

Received: from 20.60.248.132 by law5-xf98.law7.hotmail.com with DAV;

Tue, 01 Jun 2004 21:29:15 -0200

Reply-To: "Juan Galindo" <janedoe[at]XXXX.com>

From: "Juan Galindo" <janedoe[at]XXXX.com>

To: <janedoe[at]XXXX.com>

Subject: Hi Jane

Date: Wed, 02 Jun 2004 02:21:15 +0300

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--47200992016792571595"

Jane,*

valiumXanaxCialis and_more

Get Hydrocodone, or Soma.^

of the best pain killers out!

please LQQk#

http://www.561.akimbo6968tabs.us/b12

--

candlewick epithet configure atwater windup dalzell mountaineer avuncular crisp deign

database occlude frowzy competitive dyadic carpentry blythe cloister remark driveway

tropopause denotation absolve dogleg acyclic amphibious axes cheater mackinaw verde

coralberry hand adoptive multiple eureka covert maria amherst .

[Wazoo]

and this last example once again has the body contents out of step with the header description of what's supposed to be there. In this case, Content-Type: multipart/alternative; boundary="--47200992016792571595" , but all you show for a body is plain text, with no boundary lines. Though there have been (and actually almost always are) changes to the SpamCop parser, I'm trying to figure out if you said "a couple of months ago" or "until" recently" as being the trigger point, but changes like what you seem to be experiencing occurred last year. Are you sure there's not something in your Pine configuration that got changed "a couple of months ago" or "recently" ????

[janedoe]

There really isn't anything to configure in Pine, so definitely no, no changes. Some emails I receive are pure html, some have no html. I get around 500 spams per day but the only thing I filter out are viruses.

If there's something in Pine I need to change, well, let me know

It's just frustrating to me to be reporting the spammer and not the site their spamming as well.