remay Posted November 15 Posted November 15 Scam email had this in the Subject line: Subject: ***spam*** Special Offer Inside! Answer a Few Questions for Your Home Depot Reward! With the word "Questions" in the Subject, Spamcop failed to detect URLs in the email body. Once the word was removed from the Subject, the email was properly processed by Spamcop. Why would it NOT work WITH "Questions" in the Subject? Submission failed to detect URLs: https://www.spamcop.net/sc?id=z6912817262z4d49404707d4d5be7d5e903a55b44b3ez Submission properly detected URLs after removing the word "Questions" from the Subject: https://www.spamcop.net/sc?id=z6912817370zabe340f7c4adaeb1f40d734073cfc6fbz Quote
Lking Posted November 15 Posted November 15 Processing links in the body of a spam are the lowest priority task for the parser, after feeding the SCBL, and sending spam reports. It could be a matter if timing, and the workload a the moment you submitted the spam. When you see that the internal links are not processed, have you tried CANX the spam and resubmitting the spam un changed? Not questioning what you are seeing, just suggestion a reason why. I don't remember another thread reporting arrant behavior based on word(s) in the subject. Quote
remay Posted November 16 Author Posted November 16 It is NOT an issue of timing. In trying to narrow it down, it was CONSISTENT until the "key word" was removed. And ANOTHER email that used "Quick" in the Subject did not process the URLs in the email body: (failed) https://www.spamcop.net/sc?id=z6912847503z10bfb85826f67f34e10629c957cf1ef0z Subject: ***spam*** Limited Time Only: Unlock Your Home Depot Reward by Taking This Quick Survey! (worked after removing the word "Quick" from the Subject) https://www.spamcop.net/sc?id=z6912847205zef9282a9400bd04929283e2ccf843513z Subject: ***spam*** Limited Time Only: Unlock Your Home Depot Reward by Taking This Survey! The issue appears to be "qu" in the subject. I tried again with "qu" instead of "Quick", and it still failed: https://www.spamcop.net/sc?id=z6912847783zee86f36447556e1f005aad01fb033880z Subject: ***spam*** Limited Time Only: Unlock Your Home Depot Reward by Taking This Qu Survey! I replaced a "good" Subject line with the bad Subject in a different scam email and it also failed: https://www.spamcop.net/sc?id=z6912848135zeaa8414caaa2bae675a168bfddb20d9dz Quote
petzl Posted November 16 Posted November 16 2 hours ago, remay said: I tried again with "qu" instead of "Quick", and it still failed: https://www.spamcop.net/sc?id=z6912847783zee86f36447556e1f005aad01fb033880z Subject: ***spam*** Limited Time Only: Unlock Your Home Depot Reward by Taking This Qu Survey! https://1687.efuserassets.com/1687/ offers/1132/c/9082/assets/image_2023_06_06T18_51_28_822Z.png Doesn't resolve Others only have HTTP need to be HTTPS before it will be looked up (malware possibility) My ISP in Australia won't allow Also SpamCop is limited to the number of URL's it will check the first did not resolve may give it up after that? URL's slow SpamCop down and when it does it does not report to the registrar, only the IP owner who is unlikely up act, legal requirement. Quote
remay Posted November 16 Author Posted November 16 re: Doesn't resolve Yes it does... The following URL was resolved just fine - check the spamcop links I posted that "worked": https://1687.efuserassets.com/1687/ re: Others only have HTTP re: need to be HTTPS before it will be looked up (malware possibility) http OR https are resolved just fine when spamcop "works". If you're reasoning was correct, the links should have failed REGARDLESS of the Subject content. Test it yourself! Take the Subject content below and replace the Subject content in an email that has URLs you want spamcop to report, and see if spamcop will detect the URLs. You don't need to submit, just pretend to... Subject: ***spam*** Special Offer Inside! Answer a Few Questions for Your Home Depot Reward! Quote
petzl Posted November 16 Posted November 16 6 hours ago, remay said: Yes it does... The following URL was resolved just fine - check the spamcop links I posted that "worked": https://1687.efuserassets.com/1687/ offers/1132/c/9082/assets/image_2023_06_06T18_51_28_822Z.png I get? https://ibb.co/zb63SbJ Yes some providers do not block HTTP also SpamCop is Linux based so some links may not work? A freeware Windows APP locates the Registrar https://www.gena01.com/win32whois/ SpamCop only re[ports the hosting IP Spammers do not like their Website taken down Quote
ninth Posted November 16 Posted November 16 In a test the glitch is lower or upper case q,,,could be a bug in the dictionary? Quarky! Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.