[SC-Help] Re: parsing error.

[Ant]

"Mike Easter" wrote:

> DougW wrote:
[snip]
>> http://members.cox.net/wilsond/temp/050220-004511-43.txt
>
> www.spamcop.net/sc?id=z734608785zcd0723bf93f9e3376dd14e70edac276cz
>
> SC found the broken link;  but it removed the distortion and the spaces
> to resolve
>
> Tracking link: http://uckpstiw.s mallr x.c om/a/fc209118zf/eofd/
> No recent reports, no history available
> Resolves to 219.153.0.147

Interesting that before the parser resolved the link, it said this...

| Resolving link obfuscation
| http://uckpstiw.s mallr x.c om/a/fc209118zf/eofd/
| host uckpstiw.s (checking ip) ip not found ; uckpstiw.s discarded as fake.

...but didn't actually discard it.

The spaces were single carriage-returns, whereas normally the end-of-
line indicator is a carriage-return/line-feed pair. Single CRs (0x0D)
are used as EOL markers in Apple Mac text; Single LFs (0x0A) are used
in text created on unix-like systems. The bulk of the spam used the
usual (for MS and other) CR/LF (0x0D0A) pair.