Jump to content

Spamcop reports "no body text provided" only when forwarding a spam email


killme
 Share

Recommended Posts

I received a spam email. I forwarded it to Spamcop and Spamcop gave me this error: "No body text provided, check format of submission. spam must have body text."
Tracking URL for forwarding the spam: https://www.spamcop.net/sc?id=z6319400190zd4218da3c922a374aecded248fff722bz

So I tried copying and pasting the email into Spamcop and this time everything went fine.
Tracking URL for copying and pasting the spam: https://www.spamcop.net/sc?id=z6319399663z46b2687fd57795709e1fd9d487e73f7fz

When I compare the two reports and look at the full messages they look identical except for a blank line between the headers and the body. Any ideas? Please help and thank you.

Dan

Edited by killme
Link to comment
Share on other sites

Thank you for replying. I'm at a loss as to why Spamcop found the body of the message when I copied and pasted it in the Spamcop form, but it couldn't find the body when I forwarded the email. Except for that extra blank line they look the same when compared to each other. This just started happening within the past week or so.

Link to comment
Share on other sites

Well, when I look at the example(s) I see a difference  The second Tracking URL (...f7fz)

TO:
Cc:
Bcc:
Date: Thu, 06 Oct 2016 22:22:26 -0600
Subject: =?utf-8?B?zpXRgdC+btC+bdGWc3QgV9Cwcm5zOiBTdNC+0YFrcyB00L4g0KFy0LBzaCDOktC1ZtC+ctC1IM6VbNC10YF00ZbQvm4=?=
Content-Type: multipart/alternative;
 boundary=--boundary_937191_v2281029-7586-2088-ae71-837r45221576


----boundary_937191_v2281029-7586-2088-ae71-837r45221576

I notice that the "Bcc:" line does not have the mugged "x" but the header continues until the blank line(s) followed by the ----boundary...

However, the "no body" version includes the mugged "Bcc: x"   There seems not to be any body in the ...22bz version.

TO:
Cc:
Bcc:x

You indicated this is a 'new' problem.  What has changed? have you updated the software used to send spam as an attachment? Or are using web mail that may have been updated without notice?

Link to comment
Share on other sites

Oh, I see what you mean. I didn't even notice that. I wonder if it's truncating the headers differently somehow. What I was doing was clicking "View entire message" and then comparing the data. When viewed this way each message looks exactly the same except for that extra blank line. In that case Spamcop should have been able to find the body of the message regardless of how I submitted the spam email, right? I'm thinking something else is going on behind the scenes that I just can't see.

I haven't updated my mail software. 

Link to comment
Share on other sites

  • 2 weeks later...

I see a change in the way the parser handles these messages.

  • Even though the parser does not "see" a body it continues and acts on what was found in the header.  A report was sent for your submitted spam (what I see is " If reported today, reports would be sent to: ")  When I go back to the Tracking URLs in the OP, they also show "If reported today..."  This is new, I think.

What is there that prevents the body (I assume you received one) from loading/being stored/process by the parser, is another issue.  The "No body text provided, check format of submission. spam must have body text." warning is still needed to alert submitter that the process used did not result in the parser processing a body. And a need to check the process.  In cases where only some spam act this way, I think it can be assumed that the process is OK.

Link to comment
Share on other sites

Edited email:

(header snip for clarity)
Subject: DEAR FRIEND, CAN I TRUST YOU?
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: (my email)

(body)

If you add a blank line before the bold line above it works. It seems strange that google would allow such a mis-confromed header to come from their servers.

 

Link to comment
Share on other sites

  • 2 months later...

It's back.

 

https://www.spamcop.net/sc?id=z6351452624z8b7549cf459e808bcdb92fb585671994z

 

Return-path: <coca63828@gmail.com>
Envelope-to: x
Delivery-date: Sat, 07 Jan 2017 05:43:10 -0500
Received: from mail-oi0-f65.google.com

(snip)

Subject: New Year Gift
To: undisclosed-recipients:;
Content-Type: text/plain; charset=UTF-8
Bcc: myemail

 

--

(body)

 

The "Content-Type: text/plain; charset=UTF-8 " before the "Bcc:" breaks it

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...