[SC-Help] <TEXTAREA> tag in spam - A way for spammers to hide their content?

[Robert L. Vaessen]

SpamCop helpers -

I've noticed an interesting phenomena lately. Lately I've been  
receiving MIME multi-part spam (imagine that) with a <TEXTAREA> tag  
in the HTML portion of the message.

Unfortunately, it appears as if the SpamCop parsing/spam processing  
routine is rendering this HTML form tag (or perhaps it's my browser  
(Safari 2.0.2 (416.13)) that's acting on the textarea tag?), and the  
results are affecting the display of the SpamCop web interface as it  
processes the spam.

The effect persists for a few seconds, as SpamCop parses/processes  
the spam. The URL reads: http://mailsc.spamcop.net/sc while the  
textarea effect is displayed. After an ID number (part of the  
tracking URL) is assigned, the multiple column effect is overwritten,  
and the SpamCop reporting form (for this particular spam) is loaded/ 
displayed.

The disturbing part of all this is the fact that I cannot see (when I  
click on 'View Full Message') all the text that was included within  
these textarea sections. It appears as if the SpamCop parser/ 
processor is not acting on or assessing the data contained within the  
textarea containers.

Would a SpamCop administrator/programmer take a look at this effect,  
and evaluate it's affect on the SpamCop parsing script? I have a  
suspicion that a spammer might be able to use the textarea tag/effect  
to shield his spam content from the SpamCop processor.

- Robert


---------
I took a snapshot of the effect, and posted it at my website: <http:// 
www.robsworld.org/textareaeffect.png>
I also posted a copy of the offending spam (one sample) at my  
website: <http://www.robsworld.org/textareaeffectspam.txt>
(I've munged my email address in the spam example, but you should be  
able to paste the content into the SpamCop reporting form, press  
'Process Spam', and observe the effect that I've described.





---------------------------------------------------------------------
Spammers/Senders of Unsolicited eMail: Take notice that I (Robert L.
Vaessen) am unwilling to be freely emailed unsolicited commercial
email of any sort, and that I reserve my right to take action against
anyone sending me email contrary to the Notification and Offer which
is available at URL: <http://www.robsworld.org/junkdec.htm>
---------------------------------------------------------------------