Cry Havok Posted July 4, 2004 Share Posted July 4, 2004 I've just reported a spam, which had the following body: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> </HEAD> <BODY> <div align="center"> <a href="http://93000x.sam3243242c.com"> <img src="http://93000y.sam3243242c.com" border="0"></A> Gibberish text </div></BODY></HTML> However, SC didn't find any links. I've seen this quite a few times lately - is it a known bug? TIA Link to comment Share on other sites More sharing options...
Wazoo Posted July 4, 2004 Share Posted July 4, 2004 You're asking someone to comment about the contents seen in the "body" of a spam, but any answer worth anything can only be based on seeing the associated header contents, as that's where the "content definition" of the body contents start. Posting the Tracking URL of your post would allow a look at what was submitted, what went wrong. That said, I popped in one of the similar spams I received this morning, pointing to yet another xxxxxxx.sam3243242c.com, so I'll make the assumption that it's part of the same spew .... and it parsed just fine. As the header defines it as; Content-Type: multipart/alternative; boundary="=====coderemoved=_" and there are two other Boundary sections - one plain-text, one HTML, is there the possibility that you're running into the Oulook/Eudroa issues? Link to comment Share on other sites More sharing options...
Cry Havok Posted July 6, 2004 Author Share Posted July 6, 2004 Ok, a tracking link for spam that has a link in the bodie, but isn't being found: http://www.spamcop.net/sc?id=z535468959z9f...b60d518a8daa64z What it has in common with the other is that the link is an image. The problem appears to be Outlook related, ish. I'm using SpamSource to pull out the email source, and it appears to be doing an imperfect job - multipart mails have the correct body pulled, but the header isn't quite right (reporting text/plain rather than text/html). Ho hum, back to the search for a decent Outlook plugin that'll get the real source of an email. Link to comment Share on other sites More sharing options...
Wazoo Posted July 6, 2004 Share Posted July 6, 2004 OK, the sample provided is definitely the Outlook/Eudora issue .. That said, I believe that this spam would parse if ran through the two-part paste-the-spam-in-the-box web form. The headers show the "multipart-alternative" Conytent-Type, but there are no Boundary lins found in the header .. which is what the two-part form was to help work around. You didn't say, but might suspect that your submittals may have been via e-mail, which will not work, due to the above "problem" ... The SpamCop parser does not chase down image file, but note that the image file in this spam is found on the same page referenced in the line above, so the site would have garnered a report/complaint if it had been picked up .. have you tried the two-part form with the data apparently provided by the use of the SpamSource tool? Link to comment Share on other sites More sharing options...
Cry Havok Posted July 7, 2004 Author Share Posted July 7, 2004 I've not, primarily because I've got the email "in one", via the plugin. I'll give it a go the next time and see what happens. Thanks Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.