karlisma Posted March 28, 2006 Share Posted March 28, 2006 http://www.spamcop.net/sc?id=z907880452z52...ddea968c5d3cd7z http://www.spamcop.net/sc?id=z907880458z71...115ac20d42db41z http://www.spamcop.net/sc?id=z907881865z4d...4827fc664eb0c9z tripping parser with those 3D at beginning of each http address once in a while, parser finds usable link, bot does not trace it then when it finds 3D or 3 at beginning (http://3http://fly.muhosransk.com/) it does not find it - of course. fyi: muhosransk from russian is fly-sh**ting-facility And Yes, they are loughing at me/you. Link to comment Share on other sites More sharing options...
Wazoo Posted March 28, 2006 Share Posted March 28, 2006 There's actually much more to this story, and a lot of it has prebiously been discussed over the years. This latest batch of crap is being discussed in NANAE, spamcop.help newsgtup, etc., etc., etc. You picked one tidbit to point at, others would note the lack of quote marks, others have pointed to <garbage> inserted into their versions, on and on ... In reality, the actual specific problem is why some browsers are dumb enough to allow this kind of crap to be interpreted as an actual URL. The SpamCop.net parser works from the viewpoint of reading the spew and trying to handle it via the technical definition of the terms and structure as defined by the headers of the e-mail ... in this case, your body included URLs are described as; Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable You yourself point out that this structure is not followed. This leads into the confusion factor of one user saying that the URL resolves when using IE6, another user stating that it was a 404 under FireFox, an error message complaining about a screwed up URL popping up under Opera, etc., etc., etc. Those that deal with e-mail as plain-text only don't have an issue with these things directly. There is a lot of data already exiting in the FAQ here about the "Resolving of URLs" .. a number of other Topics/Discussions, but a lot of them can be summed up with that there is nothing preventing one from generating their own complaints. whois -h whois.crsnic.net muhosransk.com ... Redirecting to CAPITAL NETWORKS PTY LTD whois -h whois.pacnames.com muhosransk.com ... Domain name: MUHOSRANSK.COM Registrar: PacNames Referral URL: http://www.pacnames.com/ Domain Registrant: TOTALNIC-127503 (XSALSA[at]ETN.ORG) Alex Rodrigez P.O. Box 5009 Pirae TAHITI Pirae TF 98716 PF Telephone: +689.435695 Fax: +689.435695 Administrative, Technical Contact: TOTALNIC-127503 (XSALSA[at]ETN.ORG) Alex Rodrigez P.O. Box 5009 Pirae TAHITI Pirae TF 98716 PF Telephone: +689.435695 Fax: +689.435695 Name Server: NS1.OEMGUY.COM Name Server: NS2.OEMGUY.COM Domain creation date: 2006-03-25 23:55:49.0 Domain expiration date: 2007-03-26 00:30:45.0 SpamHaus already has data on Alex Rodrigez (yeah, right ..) (unfortunately, they seem to be down at the moment ...????) Of course, at present, timeouts galore anyway .... http://www.dnsreport.com/tools/dnsreport.c...=muhosransk.com A timeout occurred getting the NS records from your nameservers! None of your nameservers responded fast enough. They are probably down or unreachable. I can't continue since your nameservers aren't responding. 03/28/06 02:13:46 Slow traceroute muhosransk.com Trace muhosransk.com failed, no such host 03/28/06 02:14:06 dns muhosransk.com No DNS for this address (host doesn't exist) So we're back to once again asking why folks jump on the SpamCop.net parser as "the" problem when it's pretty obvious that sometimes the spammer doean't care to keep up with him/her-self. Apparently, this is "old" spam, probably now sitting at yet another yet-to-be-burned URL / host. (or perhaps to re-appear here in a few hours ..??) Link to comment Share on other sites More sharing options...
karlisma Posted March 28, 2006 Author Share Posted March 28, 2006 Thank You Wazoo. This was nice and understandable. And... my post was not intended to throw the stone at spamcop. It came out that from spam I received today 40% was this sh**ting-facility, and i didn't notice any similar parsing problems before. Link to comment Share on other sites More sharing options...
Wazoo Posted March 28, 2006 Share Posted March 28, 2006 Followed a link in your spam sample ... it does show that reports were going out while the URL was "live" .... http://www.spamcop.net/mcgi?action=showhis...id;val=90133653 Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.