Too Many Links

UBETracker · June 10, 2004

Another spammer is using too many links to avoid having the real ones reported by Spamcop. Example email...

Return-Path: <[x][at]address]> Wed, 9 Jun 2004 22:46:24

Received: from host046155.arnet.net.ar [200.45.46.155] by [domain.name] with SMTP;

Wed, 9 Jun 2004 22:46:24 -0700

X-Message-Info: [x]

Received: from 239.158.159.176 by ip-1-745-735-985.xk.[email[at]address] (AppleMailServer 92.2.8.8) id [x] via NDR; Thu, 10 Jun 2004 02:46:33 -0400

Reply-To: "Rene Aguilar" <[email[at]address]>

From: "Rene Aguilar" <[email[at]address]>

To: [x] <[email[at]address]>

Subject: Super-discounts on Phentermine and Soma

Date: Thu, 10 Jun 2004 09:45:33 +0300

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--877[x]"

----877[x]

Content-Type: text/html;

charset="iso-1093-5"

Content-Transfer-Encoding: 7Bit

Content-Description: denudation madras1726.ouzo

<HTML><HEAD><TITLE>minus jon fine blat ague yacht bicarbonate bottommost

lodestone acquittal bode reckon blockade autocorrelate powdery serviceberry rouse

brainwash</TITLE>

</HEAD>

<TABLE cellSpacing=0 borderColorDark=#000000 width=657 align=center

borderColorLight=#000000 border=1>

<TBODY>

<DIV align=center><IMG

src="http://correct.a6.sibilation217pills.biz/pills/p-docs1.jpg"></DIV></TD>

<DIV align=center><STRONG><FONT

face="Verdana, Arial, Helvetica, sans-serif">Prozac</FONT> </STRONG></DIV></TD>

<DIV align=center><STRONG> <FONT

face="Verdana, Arial, Helvetica, sans-serif">V<FONT

style="FONT-SIZE: 13px">l</FONT>agra</FONT></STRONG></DIV></TD>

<DIV align=center><STRONG> <FONT

face="Verdana, Arial, Helvetica, sans-serif">Phe<A

href="http://www.gelatinous.net"></A>nterm<FONT

style="FONT-SIZE: 13px">l</FONT>ne</FONT></STRONG></DIV></TD>

<DIV align=center><STRONG> <FONT

face="Verdana, Arial, Helvetica, sans-serif">So<A

href="http://www.birdwatch.com"></A>ma</FONT></STRONG></DIV></TD></TR>

<DIV align=center><IMG

src="http://pigeonhole.a6.sibilation217pills.biz/pills/p-zac.gif"></DIV></TD>

<DIV align=center><IMG

src="http://valkyrie.a6.sibilation217pills.biz/pills/p-phnt.gif"></DIV></TD>

<DIV align=center><IMG

src="http://peking.a6.sibilation217pills.biz/pills/p-som.gif"></DIV></TD></TR>

<DIV align=center><STRONG><FONT

face="Verdana, Arial, Helvetica, sans-serif"> Amb<FONT

style="FONT-SIZE: 13px">l</FONT>en</FONT></STRONG></DIV></TD>

<DIV align=center><STRONG><FONT

face="Verdana, Arial, Helvetica, sans-serif">Val<FONT

style="FONT-SIZE: 13px">l</FONT>um</FONT> </STRONG></DIV></TD>

<DIV align=center><STRONG> <FONT

face="Verdana, Arial, Helvetica, sans-serif">C<FONT

style="FONT-SIZE: 13px">l</FONT>alis</FONT></STRONG></DIV></TD>

<DIV align=center><STRONG> <FONT

face="Verdana, Arial, Helvetica, sans-serif">Xa<A

href="http://www.halogen.com"></A>nax</FONT></STRONG></DIV></TD></TR>

<DIV align=center><IMG

src="http://ct.a6.sibilation217pills.biz/pills/p-amb.gif"></DIV></TD>

<DIV align=center><IMG

src="http://loess.a6.sibilation217pills.biz/pills/p-val.gif"></DIV></TD>

<DIV align=center><IMG

src="http://somebody'll.a6.sibilation217pills.biz/pills/p-cls.jpg"></DIV></TD>

<DIV align=center><IMG

src="http://allusion.a6.sibilation217pills.biz/pills/p-xan.gif"></DIV></TD></TR>

<DIV align=center><FONT style="FONT-SIZE: 24px"

face="Verdana, Arial, Helvetica, sans-serif" color=#ffffff>Get ov<A

href="http://www.canker.org"></A>er 300 medicat<B><FONT

size=3>l</FONT></B>ons online sh<B><FONT size=3>l</FONT></B>pp<A

href="http://www.portage.com"></A>ed over<A

href="http://www.methodology.net"></A>nig<A

href="http://www.snapt.org"></A>ht to your fr<A

href="http://www.blight.org"></A>ont do<A

href="http://www.substitutionary.com"></A>or with no pr<A

href="http://www.liggett.net"></A>escr<B><FONT

size=3>l</FONT></B>ption.</FONT></FONT></DIV></TD>

<DIV align=left><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#00ffff size=3><STRONG> *</STRONG> No

Prescr<FONT size=2>l</FONT>pt<FONT

size=2>l</FONT>on Needed</FONT></DIV></TD></TR>

<TR>

<TD vAlign=center borderColor=#0066ff align=middle bgColor=#0066ff

colSpan=2>

<DIV align=left><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#00ffff size=3><STRONG> *</STRONG> Fully

Conf<FONT size=2>l</FONT>dential</FONT></DIV></TD></TR>

<TR>

<TD vAlign=center borderColor=#0066ff align=middle bgColor=#0066ff

colSpan=2>

<DIV align=left><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#00ffff size=3><STRONG> *</STRONG> No

Embarrassment</FONT></DIV>

<TR>

<TD vAlign=center borderColor=#0066ff align=middle bgColor=#0066ff

colSpan=2>

<DIV align=left><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#00ffff size=3><STRONG> *</STRONG> No

Waiting Rooms</FONT></DIV></TD></TR>

<TR>

<TD vAlign=center borderColor=#0066ff align=middle bgColor=#0066ff

colSpan=2>

<DIV align=left><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#00ffff

size=3><STRONG> *</STRONG> Sh<FONT

style="FONT-SIZE: 13px">l</FONT>pped Overn<FONT

style="FONT-SIZE: 13px">l</FONT>ght</FONT></DIV></TD></TR>

<TR>

<TD vAlign=center borderColor=#0066ff align=middle bgColor=#0066ff

colSpan=2>

<DIV align=left><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#00ffff

size=3><STRONG> *</STRONG> D<FONT

style="FONT-SIZE: 13px">l</FONT>screet Packaging</FONT></DIV></TD></TR>

<DIV align=center><FONT face="Verdana, Arial, Helvetica, sans-serif"

color=#000000><A href="http://sibilation217pills.biz/g09"><STRONG>Click

Here For Information</STRONG></A></FONT></DIV></TD></TR></TBODY></TABLE>

<P align=center><FONT face="Verdana, Arial, Helvetica, sans-serif" size=1>If y<A

href="http://www.advocate.net"></A>ou wi<A href="http://www.excitation.net"></A>sh for

em<A href="http://www.antipathy.org"></A>ail el<A

href="http://www.cargill.org"></A>imin<A

href="http://www.vermin.org"></A>atio<A

href="http://www.guinea.org"></A>n, you can do so <A

href="http://dadaist.sibilation217pills.biz/unsubscribe.ddd">here.</A></FONT></P>

<P> </P> plateau screwdriver fern freedmen afloat coachmen cosine dangerous

avertive maneuver

bilge chamomile joystick battery edmonds amuse constitute natty indisputable

cadmium

counterproposal assessor service germ reserpine game inquest cook redpoll

theocracy

olivine folksy spoonful periclean laos caution appendices astatine scylla

afterlife

aminobenzoic unix contraption ostracod incurred mindanao daimler dormant utopian

euridyce

sapient asleep backscatter clan bookshelves san laughter loy repetitive

sumac

woeful dragon storage bellini monkey foursquare sociable decrement constantine

praiseworthy

blanket stripy palmetto burette chaperon eastman becker toledo lemuel

corrodible

hydrostatic khrushchev abrasive counterproductive coffeepot chinch assign grisly finch

airfoilpregnant humerus clayton backward accent citric camouflage dilute dirichlet

volleyball

conjunct supremum frankfort thorstein appleby segregant bilinear sprint anthropology

metallurgist

destruct hearty excretory congenial felix anaglyph backwood decrement committing

brunt

thoreau humerus do decryption chang impracticable drowse stricter indianapolis

calligraphy

cypress hamal contraption coruscate glint bandstand announce drafty timeout

showboat

dogfish agamemnon embody aspidistra seaman vinson arsenide coincident embarcadero

chiefdom

noxious wardrobe wolfgang nostalgic whine crummy manzanita fredericks diamond

tremendous

</BODY></HTML>

----877[x]--

turetzsr · June 10, 2004

Hi, UBETracker,

...Are you asking for help or just reporting something you would like someone at SpamCop to consider?

AlphaCentauri · June 10, 2004

For a while, SpamCop was dealing with this by ignoring all links, which let the spammers off the hook, but at least didn't report innocent parties. Then it went through some type of upgrade and was doing a really great job at identifying the real link and ignoring the ones that had no highlighted text associated with them, eg. <a href="http://www.hulahoop.com"></a>

But now it is back to looking at the first few links, ignoring the last ones, and reporting the ones it looks at even if they are made up. Since the made up links are occasionally real sites, innocent parties get reported. Whatever SpamCop was doing until recently was great. This way we have to filter for these links ourselves or be extra alert that fake links aren't getting reports.

Wazoo · June 10, 2004

Bottom line .... I just bumped Ellen's request (for Julian's efforts) back up to the top of the Announcements Forum. Please read and follow-up on the data seen at http://forum.spamcop.net/forums/index.php?showtopic=1549

AlphaCentauri · June 13, 2004

Thanks, that's good to know.

One question: Instead of pasting the spam into a separate email, can we just paste the address deputy_samples[at]spamcop.net in the "Re: User Notification" blank at the end of the list of where the spam will be reported?

Wazoo · June 13, 2004

Thanks, that's good to know.
One question: Instead of pasting the spam into a separate email, can we just paste the address deputy_samples[at]spamcop.net in the "Re: User Notification" blank at the end of the list of where the spam will be reported?

I'm not going to say no ... However, putting myself in the shoes of one of the Deputies ... with all the e-mail they get, upon seeing one that appears to be a spam complaint/report (and noting that I don't believe you can insert any kind of a note using this method) .. the first reaction my be to run right over and knock some spam reporter around a bit to straighten things out ... maybe things would be cleared up after a couple more e-mails, but .... why take the chance of ticking off one of the Deputies? Perhaps might also note that Julian ptobably dips into that InBox directly to snag some samples ... and I'm not sure there'd be a second chance if he saw a spam report setting in there ...

Again, I'm not a part of the paid staff, this is just my opinion ...

AlphaCentauri · June 15, 2004

It's WORSE!

Before, when you went to confirm these spams, there would be a long list of URL's discarded because of too many links. Then there would be a list of reports that would say something like "Re: http://www.potatoes.org" and you could see it was a fake link and remove the check marks.

But now it is linking the URL's to nameservers, and we get something like "Re: 68.124.34.138 (nameserver for spamvertised link)" and we have to go back to the details and see which IP number went with the nameserver for which URL. Lots of room for reporting innocent bystanders.

Sign In

Too Many Links

Recommended Posts

UBETracker

turetzsr

AlphaCentauri

Wazoo

AlphaCentauri

Wazoo

AlphaCentauri

Archived

Browse

Activity