mrmaxx Posted June 24, 2004 Share Posted June 24, 2004 I keep getting email from this one spammer (and pretty much JUST this one spammer) at work. I'm using Outlook 2000 and SpamDeputy. Using SpamDeputy, I'm able to view the source of the email (multipart) and I see the links, but apparently SpamCop is overlooking them, because it says "no links found." I'll post the relevant portions of the spam below: [begin spam] Visit our website at http://www.avtechdirect-education.com If you wish to unsubscribe from this list, please go to: http://www.computeradvice.org/unsubscribe.asp Avtech Direct [end spam] Can someone explain why SpamCop is not finding these??? Should I forward them to the Deputies for review??? I'd really like to get these a-holes shut down! :-) Link to comment Share on other sites More sharing options...
Wazoo Posted June 24, 2004 Share Posted June 24, 2004 Not enough data provided for analysis ... generically, the issue you're describing is usally based on a difference between the header characterization of the body construction and the actual body contents. For instance, the headers ays that the body is of Type = HTML, but the links in the body are Plain-Text construction .... Then we add in the Outlook "problems" which the Deputy tool was supposed to "work around" so as to allow reporting in general, but what's not seen is the total "package" involved here .. A Tracking URL might offer up some of these missing details ... or the posting of what you're looking at over in the newsgroup spamcop.spam (thought noting that this possibly clouds the issue, translation from Outlook theough Deputy, through whatever you're using to postm and then whatever "we" use to read that post <g>) Link to comment Share on other sites More sharing options...
mrmaxx Posted June 24, 2004 Author Share Posted June 24, 2004 Not enough data provided for analysis ... generically, the issue you're describing is usally based on a difference between the header characterization of the body construction and the actual body contents. For instance, the headers ays that the body is of Type = HTML, but the links in the body are Plain-Text construction .... Then we add in the Outlook "problems" which the Deputy tool was supposed to "work around" so as to allow reporting in general, but what's not seen is the total "package" involved here .. A Tracking URL might offer up some of these missing details ... or the posting of what you're looking at over in the newsgroup spamcop.spam (thought noting that this possibly clouds the issue, translation from Outlook theough Deputy, through whatever you're using to postm and then whatever "we" use to read that post <g>) 'K... Guess I'll try and get a copy of the spam over to .spam. I wish there were a .spam forum here... :-) Oh, well... Link to comment Share on other sites More sharing options...
mrmaxx Posted June 24, 2004 Author Share Posted June 24, 2004 See spam in spamcop.spam newsgroup with subject "links missed." Link to comment Share on other sites More sharing options...
Wazoo Posted June 25, 2004 Share Posted June 25, 2004 OK, I'd seen that you'd also posted over in the newsgroups, and saw that you'd gathered some responses over there. Unfortunately, I can only echo most of what was said over there. I can't tell you whther it's the Outlook issue, whether Deputy is having issues, or if it was the actual contruction of the spam in order to get around a SpamCop parse. Unfortunately, it appears in this case, it'd really be nice to see what the spam looked like prior to Outlook getting involved. I wish there were a .spam forum here... The problem here is this software likes to eat white-space, so there a lot of issues in viewing the resulting output on screen here. The old problem of is it the disply or did the user screw something up or ...???? So some things can be a real bear and need a number of question/answers, whereas others might be analyzed pretty quickly for something obvious. In all honesty, had you posted it here, you'd have received pretty much the same response that Frank Ellerman offered up over there. (Though should note that his "trackback" thing is actually called the "Tracking URL" found at the top of the reporting pages.) I see you said you'd received two of these thus far, so it might not be worth all the work .. but in some cases, the suggestion for a work around go like this .. snag a thrid-party app that looks at your ISP server InBox, offers you up a list of contents .. if you see some garbage, you'd fire up Outlook Express (configured to "leave e-mail on the server") .. handle the spam via Outlook Express ... then let Outlook make it's normal e-mail run, and simply delete the spam just handled. PITA, to be sure, but .. if you're getting more than a couple of spams like these ..??? Link to comment Share on other sites More sharing options...
ianplotkin Posted June 25, 2004 Share Posted June 25, 2004 Hello, I am having the same exact problem. In fact, I even installed SpamDeputy to see if that would change anything, since MS Outlook makes me copy/paste from two separate places (options/headers and the message itself) to get the full message, and I thought maybe I was doing it wrong. My tracking URL is: http://www.spamcop.net/sc?id=z524158366zb3...e81380cac8dda0z Thank you, Ian Plotkin Link to comment Share on other sites More sharing options...
Wazoo Posted June 25, 2004 Share Posted June 25, 2004 Wow, thanks for this second sample. I'm feeling pretty silly right now .. looked at ianplotkin's sample, saw something a bit odd .... went back over to the .spam newsgroup and took another look at mrmaxx's and saw the same issue. I went with someone else's initial analysis, as it sounded right, at first glance, it looked right. However, this morning, the problem is obvious .... Here's hoping that your SpamDeputy software still has a vaild link for getting support from that applications auther. It is what is screwing things up. Frank over in the nesgroups had pointed out both that the initial boundary line was followed by no content, but immediately jumped to another boundary line with no Content-Type ... then the lack of an ending Boundary line .... What I noticed this morning at this fresh look at one and re-look of the other .... the second Boundary line with no Content-type is in fact the "missing " ending Boundary line. The "reconstruction" process that SpamDeputy is supposed to be doing is doing something wrong. It's re-creating the boundary lines, but inserting them at the wrong point ... and now that we have two people showing the same error, this lessens the possibility that it's a user screw-up. It appears that I need to suggest that you both need to contact the SpamDeputy site/guy to find out what's gone wrong and why ..... Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.