SYNACK Posted March 12, 2004 Share Posted March 12, 2004 It seems some spammers have found a way to prevent being reported by spamcop: Pepper the body of the e-mail with a huge number of invisible links. I wonder if the parsing could be improved to e.g. skip links without visible tags so the clickable links can be reported. Currently, spamcop balks with the message "too many links ...". The intereting links here were: "iprone646tabs.biz/b94" and "bisque.reg688medications.biz/unsubscribe.ddd" (The message source was just some comcast zombie) Here is an example message body (which was flanked on each side with a huge number of random words): <html> <head> <title>alexandria phipps delphine neck summers fredericks harrison trouble= credible demerit adenine bromine anise backtrack quirky sustenance eaton = mauritania so faith eigenfunction onerous longevity=20 carbonic</title> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859= -1"> </head> <body link=3D"#990000" alink=3D"#990000" vlink=3D"#990000" marginwidth=3D"= 0" marginheight=3D"0"> <table cellspacing=3D0 width=3D"657" border=3D"1" align=3D"center" borderc= olorlight=3D"#000000" bordercolordark=3D"#000000"> <tr bgcolor=3D"#CCCCCC"> <td width=3D"157" rowspan=3D"4" bordercolor=3D"#000000" bgcolor=3D"#FF= FFFF"><div align=3D"center"><img src=3D"http://www.modex-t3r.com/doctor.jp= g"></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.duke.com"></= a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, = Helvetica, sans-serif">Pr<a href=3D"http://www.bologna.org"></a>&= #111;z<a href=3D"http://www.effluvia.org"></a>ac</font></stro= ng></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.coda.org"></= a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, = Helvetica, sans-serif">V<font size=3D"2">l</font>ag<a href=3D= "http://www.loom.org"></a>ra</font></strong></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.scum.com"></= a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, = Helvetica, sans-serif">Ph<a href=3D"http://www.bulb.com"></a>= 1;n<a href=3D"http://www.chomsky.net"></a>ter<a href=3D= "http://www.beach.com"></a>m<font size=3D"2"><b>l</b></font>n<a = href=3D"http://www.convair.org"></a>e</font></strong></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.altruist.org= "></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Ari= al, Helvetica, sans-serif">So<a href=3D"http://www.password.net">= </a>ma</font></strong></div></td> </tr> <tr bgcolor=3D"#FFFFFF"> <td><a href=3D"http://www.margarine.org"></a> <div align=3D"center"><i= mg src=3D"http://travel-medications.com/prozac.gif"></div></td> <td><a href=3D"http://www.citrate.com"></a> <div align=3D"center"><img= src=3D"http://sildenafil.com/viagra.gif"></div></td> <td><a href=3D"http://www.contention.net"></a> <div align=3D"center"><= img src=3D"http://travel-medications.com/phentermine.gif"></div></td> <td><a href=3D"http://www.salami.net"></a> <div align=3D"center"><img = src=3D"http://travel-medications.com/soma.gif"></div></td> </tr> <tr bgcolor=3D"#CCCCCC"> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.musk.org"></= a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Arial, = Helvetica, sans-serif">Am<a href=3D"http://www.eardrum.com"></a>&= #98;<font size=3D"2"><b>l</b></font><a href=3D"http://www.astronautic.net"= ></a>en</font></strong></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.insoluble.or= g"></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Ar= ial, Helvetica, sans-serif">Val<a href=3D"http://www.spectrom= eter.org"></a>ium</font></strong></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.collins.org"= ></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Aria= l, Helvetica, sans-serif">Zyb<a href=3D"http://www.steelmake.= net"></a>an</font></strong></div></td> <td width=3D"125" valign=3D"middle"><a href=3D"http://www.falmouth.net= "></a> <div align=3D"center"><strong><font size=3D"3" face=3D"Verdana, Ari= al, Helvetica, sans-serif">Xa<a href=3D"http://www.tack.com"></a>&= #110;ax</font></strong></div></td> </tr> <tr bgcolor=3D"#FFFFFF"> <td><a href=3D"http://www.easternmost.org"></a> <div align=3D"center">= <img src=3D"http://travel-medications.com/ambien.gif"></div></td> <td><a href=3D"http://www.anaglyph.org"></a> <div align=3D"center"><im= g src=3D"http://travel-medications.com/valium.gif"></div></td> <td><a href=3D"http://www.coeducation.net"></a> <div align=3D"center">= <img src=3D"http://www.newlifepharmacy.com/virtualinclude/images/medicatio= ns/zyban.jpg"></div></td> <td><a href=3D"http://www.legislature.org"></a> <div align=3D"center">= <img src=3D"http://travel-medications.com/xanax.gif"></div></td> </tr> <tr bordercolor=3D"#000000"> <td height=3D"10" colspan=3D"5"></td> </tr> <tr bgcolor=3D"#0066FF"> <td width=3D"407" colspan=3D"3" rowspan=3D"6" bordercolor=3D"#000000" = bgcolor=3D"#0066FF"> <div align=3D"center"><font color=3D"#FFFFFF" style=3D"FONT-SIZE: 24= px" face=3D"Verdana, Arial, Helvetica, sans-serif">Ge<a href=3D"h= ttp://www.guidebook.com"></a>t ov<a href=3D"http://www.carolingian.org"></a>er= ; 300 me<a href=3D"http://www.creamery.net"></a>dica= ;<a href=3D"http://www.abbe.net"></a>t<font size=3D"3"><b>l</b></font= >ons on<a href=3D"http://www.adventure.org"></a>li<= a href=3D"http://www.maximal.net"></a>ne sh<a href=3D"http://www.divine.org"></a><font size=3D"3"= ><b>l</b></font>pp<a href=3D"http://www.roy.com"></a>ed= ; ov<a href=3D"http://www.mcginnis.org"></a>er= 110;<a href=3D"http://www.muddle.com"></a>igh<a href=3D"htt= p://www.delphinium.org"></a>t t<a href=3D"http://www.hitch.net"></a>o yo= 7;r fr<a href=3D"http://www.tolerable.org"></a>on= t do<a href=3D"http://www.intent.org"></a>or wi<= a href=3D"http://www.allen.com"></a>th no pre<a href=3D"http://www.it.com"></a>sc<a href=3D"http://www.as= set.com"></a>r<font size=3D"3"><b>l</b></font>p<a href=3D"http://www.barba= rous.com"></a>ti<a href=3D"http://www.irishman.com"></a>on.</font></div></= td> <td width=3D"250" colspan=3D"2" align=3D"center" valign=3D"middle" bor= dercolor=3D"#0066FF"> <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda= na, Arial, Helvetica, sans-serif"><strong> *</strong>&nbs= p; No Prescript<font size=3D"2">l</font>= 1;n Needed </font></div></td> </tr> <tr> <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0= 066FF" bgcolor=3D"#0066FF"> <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda= na, Arial, Helvetica, sans-serif"><strong> *</strong>&nbs= p; F<a href=3D"http://www.epimorphism.org"></a>ull= <a href=3D"http://www.guardhouse.com"></a>y Con<a href=3D"http://www.carthage.com"></a>f= 05;<a href=3D"http://www.biology.org"></a>den<a href=3D"htt= p://www.ky.com"></a>tia<a href=3D"http://www.athletic.com"><= /a>l</font></div></td> </tr> <tr> <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0= 066FF" bgcolor=3D"#0066FF"> <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda= na, Arial, Helvetica, sans-serif"><strong> *</strong>&nbs= p; No Em<a href=3D"http://www.anne.org"></a>bar<a = href=3D"http://www.incontrollable.org"></a>ras<a href=3D"htt= p://www.adposition.com"></a>sme<a href=3D"http://www.court.= org"></a>nt</font></div> <div align=3D"left"></div></td> </tr> <tr> <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0= 066FF" bgcolor=3D"#0066FF"> <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda= na, Arial, Helvetica, sans-serif"><strong> *</strong>&nbs= p; No Wai<a href=3D"http://www.pollard.org"></a>ti= ;n<a href=3D"http://www.damsel.com"></a>g Ro<a href=3D"= http://www.comprehensible.net"></a>oms</font></div></td> </tr> <tr> <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0= 066FF" bgcolor=3D"#0066FF"> <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda= na, Arial, Helvetica, sans-serif"><strong> *</strong>&nbs= p; Shi<a href=3D"http://www.tumultuous.com"></a>pped Overnight</font></div></td> </tr> <tr> <td colspan=3D"2" align=3D"center" valign=3D"middle" bordercolor=3D"#0= 066FF" bgcolor=3D"#0066FF"> <div align=3D"left"><font color=3D"#00FFFF" size=3D"3" face=3D"Verda= na, Arial, Helvetica, sans-serif"><strong> *</strong>&nbs= p; D<a href=3D"http://www.aida.net"></a>isc<a href=3D= "http://www.proof.com"></a>re<a href=3D"http://www.bremsstrahlun= g.net"></a>et Pack<a href=3D"http://www.daley.org"></a>ag&= #105;<a href=3D"http://www.strawflower.net"></a>ng</font></div><= /td> </tr> <tr bordercolor=3D"#FFFFFF" bgcolor=3D"#FFFFFF"> <td colspan=3D"5" height=3D"10"></td> </tr> <tr bordercolor=3D"#000000" bgcolor=3D"#CCCCCC"> <td height=3D"40" colspan=3D"5"><div align=3D"center"><font color=3D"#= 000000" face=3D"Verdana, Arial, Helvetica, sans-serif"><a href=3D"http://i= prone646tabs.biz/b94"><strong>Here For More Informat&= #105;on</strong></a></font></div></td> </tr> </table> <p> </p> <p> </p> <p align=3D"center"><font size=3D"1" face=3D"Verdana, Arial, Helvetica, sa= ns-serif">If y<a href=3D"http://www.utensil.org"></a>ou wi<a href=3D"http://www.antig= en.com"></a>sh for em<a href=3D"http://www.compact.com"></a>ail el<a href=3D"http://www.garcia.org"></a>imin<a href=3D"http://www.cunnin= gham.com"></a>atio<a href=3D"http://www.pastime.com"></a>n, you can do so <a href=3D"http://bisque.reg688medications.biz/unsubscribe= .ddd">here.</a></font></p> Link to comment Share on other sites More sharing options...
Farelf Posted March 18, 2004 Share Posted March 18, 2004 Yeah, this one annoys quite a few of us I think. I contacted the deputies about it March 5 and received the following reply from Ellen (main part): Hi Stephen -- we are aware of this spammer sna the "empty" links which are put into the body of the spam just to create problems for SpamCop. We have been working on getting a code fix to resolve this problem. Please do not alter your spam. I know it is frustrating to see the "too many links" message but please bear with us until we get this resolved. There now seems to be a similar issue where excess links to the same site even are tripping the "too many links" error handler: http://forum.spamcop.net/forums/index.php?showtopic=721 Anyway, yes SpamCop is working on it. Link to comment Share on other sites More sharing options...
DavidT Posted March 18, 2004 Share Posted March 18, 2004 I ran into the "Too many links" problem today while trying to report a phishing scam titled "Wells Fargo Customer Alert!" Here's the message from the SC parser: Finding links in message body Recurse multipart: Parsing text part Parsing HTML part Reducing redundant links for www.wellsfargo.com Too many links, links ignored There were a total of 14 anchor links and three form tags, most of which pointed to Wells Fargo, which *should* have been solved by the "Reducing redundant links" step, but wasn't. Therefore, the actual form tag pointing to the phishing site wouldn't have been reported....had I not decided to break the rules and edit out most of the Wells Fargo links by hand. I'm sorry, folks, but fix the darn system, and then we won't have to break the rules! Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.