Jump to content

I figured out why some reports aren't generated


fliptop
 Share

Recommended Posts

https://www.spamcop.net/sc?id=z6373673157zfcf5d8744ed20927f013c0ab2388921ez

The bottom 'Received:' header has "from cubecube..home (unknown...". When submitted (above link) it aborts parsing the header. When I changed that Received: line to 'cube.cube.home' it parses the header just fine. There must be a bug in the parsing code that causes it to sh** the bed on bad hostnames.

Link to comment
Share on other sites

yeah.  I also noticed that your report has a double dot in the hostnames.  I wonder if spammers have figured out to fool SpamCop.  It very well could be related to the following post since it appears to be stopping around the same point.

http://forum.spamcop.net/topic/17040-only-first-three-lines-of-report-showing/

Link to comment
Share on other sites

I can confirm the same experience. The spam was submitted OK and seemed to parse, but never completed - the screen just hung.

This was a typical "my husband was killed by Mugabe and I want you to have his millions" spam, and in the message body was the usual list of links to ancient BBC news items. Original email contained this:

 

"I am sure you are aware of killing in Zimbabwe Southern Africa in the year 2000 by Zimbabwean President Robert Mugabe.

http://news.bbc.co..uk/1/hi/world/africa/918781.stm
http://news.bbc.co.uk/1/hi/world/africa/715001.stm
http://news.bbc.co.uk/1/hi/world/africa/1063785.stm
http://news.bbc.co.uk/2/hi/africa/6448559.stm: "

 

- Note the double dot in the first URL.

I removed one of those full-stops and tried again; it parsed perfectly. I don't consider this a material change to the spam, so reported it - with a note that I'd fixed the link. Doubt anything will come of the report though, it went to an abuse address with a standard GMail account. Knujon also received a copy though.

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...