studog Posted October 15, 2004 Share Posted October 15, 2004 http://www.spamcop.net/sc?track=1234567890...678901234567890 The line of text "1234567890123456789012345678901234567890123456789012345678901234567890" is something I keep on my clipboard a lot, and I accidentally pasted it into the spam reporting area on the web interface, instead of the spamsource info that I thought was on my clipboard. I hit submit as I was realising what had happened, but then the final screen came up. That's right, there was no intermediate report spam or not screen, so I couldn't cancel the reports. Looking at this more carefully, I'm not convinced that reports have actually been sent. Can someone confirm that for me? ...Stu Link to comment Share on other sites More sharing options...
StevenUnderwood Posted October 15, 2004 Share Posted October 15, 2004 A single IP address (that is what spamcop is interpreting that line as) will only return the reporting addresses for that IP. No reports were sent. I find it interesting that the decimal equivalent of the dotted quad wil be accepted in this tool. Were spammers using the decimal equiivalent for a while? I never remember receiving any. Just tested and the parser will convert both decimal and octal values to thier dotted quad equivalent. Hex will not work, however. Link to comment Share on other sites More sharing options...
Wazoo Posted October 15, 2004 Share Posted October 15, 2004 If you look just above the paste-it-in-here-box, you'll see the mention of "single-line entry" .. this used to be a separate function, now incorporated into the one window. A single-line entry (IP address, e-mail address) will do a lookup for a reporting address. Anything more than a single-line invokes the actual spam parser, which would have generated a number of errors, lke spam not found, etc. Link to comment Share on other sites More sharing options...
studog Posted October 15, 2004 Author Share Posted October 15, 2004 No reports were sent.18817[/snapback] <whew> Thanks. ...Stu Link to comment Share on other sites More sharing options...
studog Posted October 15, 2004 Author Share Posted October 15, 2004 If you look just above the paste-it-in-here-box, you'll see the mention of "single-line entry" .. this used to be a separate function, now incorporated into the one window. A single-line entry (IP address, e-mail address) will do a lookup for a reporting address. Anything more than a single-line invokes the actual spam parser, which would have generated a number of errors, lke spam not found, etc. 18821[/snapback] Ah, I missed that bit of text. It does look like the single line parser has a problem though. That string is in no way am ip address, even as a decimal representation. Unless the sl-parser allows for modulus arithmetic. ...Stu Link to comment Share on other sites More sharing options...
StevenUnderwood Posted October 15, 2004 Share Posted October 15, 2004 Yes, the IP converter for the result spamcop is getting shows: Dotted IP Address: 206.63.10.210 Decimal IP Address: 3460238034 Hex IP Address: 0xce3f0ad2 Octal IP Address: 031617605322 Link to comment Share on other sites More sharing options...
Wazoo Posted October 15, 2004 Share Posted October 15, 2004 A lot of decoding stuff has been incorporated into the SpamCop parser (note that Julian offers credits to Joel for this work) .... Spammers used all kinds of this crap throughout the ages, but the issue fell down to that the various browsers didn't all do the same things with them .. decodong them differently, not dealing with them at all, etc .... so the current basis these days is that "shooting for the common denominator" mode which implies targetting the way IE handles these "encoded" URLs. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.