remay Posted June 22, 2004 Share Posted June 22, 2004 I had a particular spam email where spamcop would NOT detect the spammer's website URLs in the message body. This is NOT a MS Outlook "boundary" issue. But... there is SOMETHING in the headers of the spam email that spamcop didn't like, but I don't know what. When I used some other spam email's header, then spamcop detected the URLs just fine. I am not sure WHY spamcop wouldn't detect the links. Any ideas? It LOOKS like spamcop needs to be modified somehow, but I wasn't sure who to submit this to... Here are the URLs that spamcop eventually was able to detect in the spam, when I used a different set of email headers than the ones that came with the spam (below) to test things to see if ANY links could be detected. <snipped as results were gained with artificial headers> Here is the spam... Return-path: <ESC1011292925991_1011273013097_843[at]in.roving.com> Received: from ms-mta-03 (ms-mta-03-smtp.texas.rr.com [10.93.38.33]) by ms-mss-03.texas.rr.com (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id <0HZP00H569H53N[at]ms-mss-03.texas.rr.com> for x[at]houston.rr.com; Tue, 22 Jun 2004 02:43:53 -0500 (CDT) Received: from txmx03.mgw.rr.com (txmx03.mgw.rr.com [24.93.41.202]) by ms-mta-03.texas.rr.com (iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003)) with ESMTP id <0HZP007AX9H5F7[at]ms-mta-03.texas.rr.com> for x[at]houston.rr.com (ORCPT x[at]houston.rr.com); Tue, 22 Jun 2004 02:43:53 -0500 (CDT) Received: from samantha.asdf456.com ([64.235.33.2]) by txmx03.mgw.rr.com (8.12.10/8.12.8) with SMTP id i5M7hn1j021341 for <x[at]houston.rr.com>; Tue, 22 Jun 2004 03:43:49 -0400 (EDT) Received: (qmail 27431 invoked by uid 399); Tue, 22 Jun 2004 07:43:48 +0000 Received: (qmail 27416 invoked by uid 0); Tue, 22 Jun 2004 07:43:48 +0000 Received: from unknown (HELO ccm01.roving.com) (63.251.135.74) by samantha.asdf456.com with SMTP; Tue, 22 Jun 2004 07:43:48 +0000 Received: from sched2 (loghost2.roving.com [10.200.200.19]) by ccm01.roving.com (Postfix) with ESMTP id BD6C934AE0 for <x>; Tue, 22 Jun 2004 03:29:55 -0400 (EDT) Date: Tue, 22 Jun 2004 03:29:55 -0400 (EDT) From: Unicare Health Insurance <plukachekins[at]sbcglobal.net> Subject: Unicare Health Insurance of Texas To: x Reply-to: plukachekins[at]sbcglobal.net Message-id: <1011292925991.1011273013097.843.2.260342[at]scheduler> MIME-version: 1.0 X-Mailer: Roving Constant Contact 8.0.Patch805A (http://www.constantcontact.com) Delivered-to: x.x-x X-Roving-Queued: 20040622 03:43:47.657 X-Return-Path-Hint: ESC1011292925991_1011273013097_843[at]in.roving.com X-Roving-ID: 1011292925991 X-Lumos-SenderID: 1011273013097 X-Roving-CampaignId: 1011292925991 X-Roving-StreamId: 0 X-Virus-Scanned: Symantec AntiVirus Scan Engine Original-recipient: rfc822;x[at]houston.rr.com <head > <title >Unicare Health Insurance of Texas</title> </head> <body bgcolor=3D"#FFFFFF" style=3D"BACKGROUND-COLOR: #FFFFFF;MARGIN: 0px 0p= x 0px 0px;" ><!--Copyright © 1996-2004 Roving Software Incorporated d/b/a= Constant Contact. All rights reserved. Except as permitted under a separa= te written agreement with Constant Contact, neither the Constant Contact softw= are, nor any content that appears on any Constant Contact site, including but not limited to, web pages, newsletters, or templates may be r= eproduced, republished, repurposed, or distributed without the prior written permission of Constant Contact. For inquiries regarding repr= oduction or distribution of any Constant Contact material, please contact legal[at]constantcontact.com.--> <a ton of useless stuff deleted> <a href=3D" http://ccprod.roving.com/rov= ing/images/cc-logo-color-sm.gif"/></a></FooterLogo></font></td></tr><tr ><t= d colspan=3D"2" ><font face=3D"verdana,arial" size=3D"1" ><br /> www.get- healthinsurance.com | 5115 N. Galloway Ave | Suite 201 | Mesquite | TX | 75150= </font></td></tr></table></div></body> [Edited by Wazoo as the Original Poster didn't seem to want to, even after posting a Tracking URL in a later posting] Link to comment Share on other sites More sharing options...
Wazoo Posted June 22, 2004 Share Posted June 22, 2004 First of all, how about editing your last post and deleting about 90% of it? The first item I see missing (and pretty much stopped there) is that there is no "Content-Type:" definition line in the headers of your sample spam. You make note that this isn't an "Outlook Boundary issue" and yet you're bumping up against the same walls. Noting that even the ton-load of HTML crap you posted even stops too soon, not having the ending </html> tag at the bottom ... so one can't help but wonder if there's an issue with your cut/paste methodology? Link to comment Share on other sites More sharing options...
remay Posted June 22, 2004 Author Share Posted June 22, 2004 First of all, how about editing your last post and deleting about 90% of it? I would have if I knew who I could foward the entire email to for review. The first item I see missing (and pretty much stopped there) is that there is no "Content-Type:" definition line in the headers of your sample spam I manually removed the Content-Type lines so I could paste the entire headers and body into the spamcop reporting web page without having to use the "workaround" web page. Here is what was in the headers: Content-type: multipart/alternative; boundary="----=_Part_1254089_-1629290071.1087890227657" Noting that even the ton-load of HTML crap you posted even stops too soon, not having the ending </html> tag at the bottom ... so one can't help but wonder if there's an issue with your cut/paste methodology? Sorry you doubt me. I copied and pasted exactly what was produced in it's entirety with "view source". It ended with </body>! Sorry for the long post. Obviously, I don't know the procedure for reporting a "bug" or "problem" with spamcop. I spent well over 30 minutes trying to figure out WHY spamcop wouldn't detect the links. It gave NO error that there were no links or that there were too many links! When nothing seemed to work, I took another successful spam email, copied the headers (with no Content-Type line), using the EXACT same html source, and spamcop DID detect the URLs. I was HOPING that someone could look at WHY spamcop would NOT detect the links with the headers that went with that spam. Link to comment Share on other sites More sharing options...
Wazoo Posted June 23, 2004 Share Posted June 23, 2004 First of all, how about editing your last post and deleting about 90% of it? I would have if I knew who I could foward the entire email to for review. 1. It's not too late to edit what's here, especially now that you've admitted that what you posted isn't the actual spam at all. 2. Instead of e-mailing someone, already knowing that Outlook has issues, and again with the self-admitted "this ain't the real spam" ... try the much posted alternative of providing a Tracking URL, which is a simple link .. much easier to handle in the web-based things ... but noting that even if you had done this, my initial analysis would have been the same .. something wrong with the headers. The first item I see missing (and pretty much stopped there) is that there is no "Content-Type:" definition line in the headers of your sample spam I manually removed the Content-Type lines so I could paste the entire headers and body into the spamcop reporting web page without having to use the "workaround" web page. Here is what was in the headers: Content-type: multipart/alternative; boundary="----=_Part_1254089_-1629290071.1087890227657" Which blows away any chance of someone "here" working to figure out the problem with the original / actual spam and coming up with any meaningful answers. Noting that even the ton-load of HTML crap you posted even stops too soon, not having the ending </html> tag at the bottom ... so one can't help but wonder if there's an issue with your cut/paste methodology? Sorry you doubt me. I copied and pasted exactly what was produced in it's entirety with "view source". It ended with </body>! Again, I can only work with what was provided, the same problem the SpamCop parser has ... if the stuff isn't "right" .. it's not going to fly. Sorry for the long post. Obviously, I don't know the procedure for reporting a "bug" or "problem" with spamcop. Again, see the above (and elsewhere) mentioned Tracking URL. I spent well over 30 minutes trying to figure out WHY spamcop wouldn't detect the links. It gave NO error that there were no links or that there were too many links! When nothing seemed to work, I took another successful spam email, copied the headers (with no Content-Type line), using the EXACT same html source, and spamcop DID detect the URLs. It's nice to "play" a bit, good education. However, posting something after you "modified" it and expecting an accurate finger point to just what happened seems a bit out there ... I was HOPING that someone could look at WHY spamcop would NOT detect the links with the headers that went with that spam. I gave you a start, again based on what was provided. And I note that thee has been no one else jumping in to correct my wrong statements or offer up other alternatives. Sorry. Link to comment Share on other sites More sharing options...
remay Posted June 27, 2004 Author Share Posted June 27, 2004 2. Instead of e-mailing someone, already knowing that Outlook has issues, and again with the self-admitted "this ain't the real spam" ... try the much posted alternative of providing a Tracking URL, which is a simple link .. much easier to handle in the web-based things It's too late now for spamcop to process, but you can look at the headers, if you desire, with the Content-Type as it was delivered to me with the original spam: http://www.spamcop.net/sc?id=z525152824z60...a165b7833e16cdz Link to comment Share on other sites More sharing options...
Robert Slade Posted June 27, 2004 Share Posted June 27, 2004 Just a couple of thoughts. Sometimes the when paser misses links if you re parse the spam it will find them. Click on the view full message button then use your brouser back button to get back to the paser output. For reference, you may post spam in the spamcop.spam newgroup and refer to it in the spamcop or spamcop.help newgroup for more help on sorting out errors in headers etc. Rob Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.