[SC-Help] Re: Opera won't play with Spamcop, hashes headers

[Mike Easter]

Lane Gray, Czar Castic wrote:
> I brought this up awhile ago,

I don't see any previous posts from you here or in opera.mail+news

> Here's the tracking URL and below, what Opera sent to spamcop:
www.spamcop.net/sc?id=z761129865zf78eab133dd819f61c9e9ded5b9d7176z

That's an item received by a cox mailbox, parsed for a cox mailhosts,
spamvertising http://adi.fakerolexsite.com./ which has a dot after the
'com' -- but it demonstrates that the item was copied and pasted and
submitted properly with complete headers over raw message body.

> Supposedly, pressing "C" copies the raw text, including headers, into
> the clipboard, but it obviously does something wrong, because SC
> doesn't bother parsing the HTML in the body

In the tracker item, SC finds the spamvertised url and fails to resolve
it.  If I feed the raw 'improper' url into the parser, it also fails to
resolve it.  If I remove the improper dot, SC also fails to resolve.  My
resolver resolves to 194.126.189.106.  If I use a GET on the proper url,
it provides a payload and also redirects to http://www.911replicas.com/
+ which is also 194.126.189.106

> What, if anything, can I do to make Opera play along with what the SC
> parser is looking for?

You are successfully copying and submitting if the tracker and the
completely different item you pasted here are examples of what you are
getting from Opera.  SC's faq doesn't show instructions for Opera, but
I've seen screenshots at spamcop.com.

> The spam I sent to spamcop:

What you pasted here which you shouldn't have is a completely different
item.  Here's a tracker for it after I removed the newsreader induced
linewraps from the header and submitted it to the parser.

http://www.spamcop.net/sc?id=z786666345za61e720ddd2c3e8cdda9802236220af2z

That item is to your kc.rr.com mailbox and is spamvertising
http://promotionsltd.net and SC finds the spamvertised url and resolves
it and offers to report to dstich at intelletrace.com when I parsed it.

Report Spam to:
Re: 66.235.162.83 (Administrator of network where email originates)
   To: abuse at hopone.net (Notes)
Re: 66.235.162.83 (Third party interested in email source)
   To: Cyveillance spam collection (Notes)
Re: http://promotionsltd.net/ljdforlyfe/67 (Administrator of network
hosting website referenced in spam)
   To: dstich at intelletrace.com (Notes)

<cancelled>



-- 
Mike Easter
kibitzer, not SC admin