killme Posted October 7, 2016 Share Posted October 7, 2016 I received a spam email. I forwarded it to Spamcop and Spamcop gave me this error: "No body text provided, check format of submission. spam must have body text." Tracking URL for forwarding the spam: https://www.spamcop.net/sc?id=z6319400190zd4218da3c922a374aecded248fff722bz So I tried copying and pasting the email into Spamcop and this time everything went fine. Tracking URL for copying and pasting the spam: https://www.spamcop.net/sc?id=z6319399663z46b2687fd57795709e1fd9d487e73f7fz When I compare the two reports and look at the full messages they look identical except for a blank line between the headers and the body. Any ideas? Please help and thank you. Dan Link to comment Share on other sites More sharing options...
alvarnell Posted October 7, 2016 Share Posted October 7, 2016 Yes, There must be a blank line between the headers and the body text. If, in the future, there truely isn't any body text, simply add a blank line and "No body text." Link to comment Share on other sites More sharing options...
killme Posted October 7, 2016 Author Share Posted October 7, 2016 In the report that said it couldn't find the body it looks like there are 3 blank lines of text between the headers and the body. In the "valid" report it looks like there are 2 blank lines. Does the number of blank lines matter? Link to comment Share on other sites More sharing options...
Lking Posted October 7, 2016 Share Posted October 7, 2016 3 is OK. The first blank line defines the end of the header. Any other blank line are part of the body. Link to comment Share on other sites More sharing options...
killme Posted October 8, 2016 Author Share Posted October 8, 2016 Thank you for replying. I'm at a loss as to why Spamcop found the body of the message when I copied and pasted it in the Spamcop form, but it couldn't find the body when I forwarded the email. Except for that extra blank line they look the same when compared to each other. This just started happening within the past week or so. Link to comment Share on other sites More sharing options...
Lking Posted October 8, 2016 Share Posted October 8, 2016 Well, when I look at the example(s) I see a difference The second Tracking URL (...f7fz) TO: Cc: Bcc: Date: Thu, 06 Oct 2016 22:22:26 -0600 Subject: =?utf-8?B?zpXRgdC+btC+bdGWc3QgV9Cwcm5zOiBTdNC+0YFrcyB00L4g0KFy0LBzaCDOktC1ZtC+ctC1IM6VbNC10YF00ZbQvm4=?= Content-Type: multipart/alternative; boundary=--boundary_937191_v2281029-7586-2088-ae71-837r45221576 ----boundary_937191_v2281029-7586-2088-ae71-837r45221576 I notice that the "Bcc:" line does not have the mugged "x" but the header continues until the blank line(s) followed by the ----boundary... However, the "no body" version includes the mugged "Bcc: x" There seems not to be any body in the ...22bz version. TO: Cc: Bcc:x You indicated this is a 'new' problem. What has changed? have you updated the software used to send spam as an attachment? Or are using web mail that may have been updated without notice? Link to comment Share on other sites More sharing options...
killme Posted October 9, 2016 Author Share Posted October 9, 2016 Oh, I see what you mean. I didn't even notice that. I wonder if it's truncating the headers differently somehow. What I was doing was clicking "View entire message" and then comparing the data. When viewed this way each message looks exactly the same except for that extra blank line. In that case Spamcop should have been able to find the body of the message regardless of how I submitted the spam email, right? I'm thinking something else is going on behind the scenes that I just can't see. I haven't updated my mail software. Link to comment Share on other sites More sharing options...
Lking Posted October 9, 2016 Share Posted October 9, 2016 When "View entire message" there is no message/body passed the Bcc: x Link to comment Share on other sites More sharing options...
killme Posted October 9, 2016 Author Share Posted October 9, 2016 Oh, I see what you mean. When I'm logged in to Spamcop it's showing me the entire message for both tracking URLs. When I'm logged out I see what you see. Is that normal? Link to comment Share on other sites More sharing options...
Lking Posted October 9, 2016 Share Posted October 9, 2016 no Link to comment Share on other sites More sharing options...
Schmide Posted October 23, 2016 Share Posted October 23, 2016 https://www.spamcop.net/sc?id=z6322625836z2ff1b5517012c7eb95373a48b437746dz I received one that does this same thing (i think) today. Link to comment Share on other sites More sharing options...
Lking Posted October 23, 2016 Share Posted October 23, 2016 I see a change in the way the parser handles these messages. Even though the parser does not "see" a body it continues and acts on what was found in the header. A report was sent for your submitted spam (what I see is " If reported today, reports would be sent to: ") When I go back to the Tracking URLs in the OP, they also show "If reported today..." This is new, I think. What is there that prevents the body (I assume you received one) from loading/being stored/process by the parser, is another issue. The "No body text provided, check format of submission. spam must have body text." warning is still needed to alert submitter that the process used did not result in the parser processing a body. And a need to check the process. In cases where only some spam act this way, I think it can be assumed that the process is OK. Link to comment Share on other sites More sharing options...
Schmide Posted October 23, 2016 Share Posted October 23, 2016 Edited email: (header snip for clarity) Subject: DEAR FRIEND, CAN I TRUST YOU? To: undisclosed-recipients:; Content-Type: text/plain; charset=UTF-8 Bcc: (my email) (body) If you add a blank line before the bold line above it works. It seems strange that google would allow such a mis-confromed header to come from their servers. Link to comment Share on other sites More sharing options...
Schmide Posted January 7, 2017 Share Posted January 7, 2017 It's back. https://www.spamcop.net/sc?id=z6351452624z8b7549cf459e808bcdb92fb585671994z Return-path: <coca63828@gmail.com> Envelope-to: x Delivery-date: Sat, 07 Jan 2017 05:43:10 -0500 Received: from mail-oi0-f65.google.com (snip) Subject: New Year Gift To: undisclosed-recipients:; Content-Type: text/plain; charset=UTF-8 Bcc: myemail -- (body) The "Content-Type: text/plain; charset=UTF-8 " before the "Bcc:" breaks it Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.