"Remove email parameters" message on URL parsing

[DRSpalding]

Tracking URL: https://www.spamcop.net/sc?id=z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z

This spam contains URLs that are not getting reported but SpamCop is noting the following:

Resolving link obfuscation

HTTP://dimo.site/0a9843a2f4fdfdb3cd243d65913/auto.php?9020321_hcywgultvlggov_1_track57_57_2_79206
   Remove email parameters: HTTP://dimo.site/0a9843a2f4fdfdb3cd243d65913/auto.php
HTTP://dimo.site/0a9843a2f4fdfdb3cd243d65913/auto.php?9020321_jeadarfaqcmadj_1_track57_57_2_79206
   Remove email parameters: HTTP://dimo.site/0a9843a2f4fdfdb3cd243d65913/auto.php
HTTP://dimo.site/unsub

I do not know what that means, but I have modified the links to not include anything at all other than the domain name and resubmitted it, it doesn't emit that message but it still won't send a report.  If you put one of the sites directly into the report spam form and submit it to see what happens, it does in fact parse it and would submit a report.

What's it all mean?

[InvisiBill]

In a URL, parameters are the things after the question mark.  In your SpamCop tracking URL, it's "id=z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z".  That tells the webpage that the item "id" has a value of "z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z".  When you go to the spamcop.net domain and load the /sc page, it pulls up the report with an ID of "z6289054704z1ca8c0c6638bb944ad328cf46dd3ee00z".  Every single tracking URL loads the same /sc page on the webserver, but each one has its own unique ID.

Spammers can use this to put an encoded version of your email address or other info into the URLs.  That "9020321_hcywgultvlggov_1_track57_57_2_79206" at the end is probably specific to you in some way.

SpamCop removes this so that the reported URLs don't give away your identity to the offender.  The effectiveness will depend on how tricky the spammer is about disguising your details and how smart SpamCop's algorithms are.