Jump to content

"Remove email parameters" message on URL parsing


Recommended Posts

Tracking URL: https://www.spamcop.net/sc?id=z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z

This spam contains URLs that are not getting reported but SpamCop is noting the following:

Resolving link obfuscation

   Remove email parameters: HTTP://dimo.site/0a9843a2f4fdfdb3cd243d65913/auto.php
   Remove email parameters: HTTP://dimo.site/0a9843a2f4fdfdb3cd243d65913/auto.php

I do not know what that means, but I have modified the links to not include anything at all other than the domain name and resubmitted it, it doesn't emit that message but it still won't send a report.  If you put one of the sites directly into the report spam form and submit it to see what happens, it does in fact parse it and would submit a report.

What's it all mean?

Link to comment
Share on other sites

  • 3 weeks later...

In a URL, parameters are the things after the question mark.  In your SpamCop tracking URL, it's "id=z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z".  That tells the webpage that the item "id" has a value of "z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z".  When you go to the spamcop.net domain and load the /sc page, it pulls up the report with an ID of "z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z".  Every single tracking URL loads the same /sc page on the webserver, but each one has its own unique ID.

Spammers can use this to put an encoded version of your email address or other info into the URLs.  That "9020321_hcywgultvlggov_1_track57_57_2_79206" at the end is probably specific to you in some way.

SpamCop removes this so that the reported URLs don't give away your identity to the offender.  The effectiveness will depend on how tricky the spammer is about disguising your details and how smart SpamCop's algorithms are.

Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...