[SpamCop-List] Re: Header and message parsing

[Steve Gilder]

"Mike Easter" <MikeE at ster.invalid> wrote in message
news:cgbha0$6ua$1 at news.spamcop.net...
> Steve Gilder wrote:
> www.spamcop.net/sc?id=z619577419zf9010110882a39d0d0e2a18c3587b5b5z
>
> That's another 'stupid' spammer html construction.
>
> This...
>
> www.spamcop.net/sc?id=z619741049z6504b6bf221f7c8de8cec65909f00bdfz
>
> ... is the way it is supposed to be 'built'.
>
> The role of the mime boundary delimiters is to keep the body 'organized'
>
> The header content type defines the mime structure including the boundary
> delimiters.  Then, we're supposed to have appropriate boundary lines and
> appropriate content types 'behind' or after those delimiters, then we're
> supposed to have a boundary epilogue, which shows the end of all of that
> mime delimited stuff.
>
> The stupid [or faulty, choose your adjective] spammer structure shows a
> boundary epilogue 'ending' before the real body gets started.  You have
> to 'fix that' [for demonstration purposes, not for SC reporting], so that
> the SC parser can get the body parsed properly.
>
> Report Spam to:
> Re: 200.167.250.158 (Administrator of network where email originates)
>    To: mail-abuse at nic.br (Notes)
>    To: Internal spamcop handling: (spambr) (Notes)
>    To: abuse at embratel.net.br (Notes)
> Re: 200.167.250.158 (Third party interested in email source)
>    To: Cyveillance spam collection (Notes)
> Re: http://www.cheapbuysjjz.com/index.php?id=104 (Administrator of
> network hosting website referenced in spam)
>    To: abuse at hanaro.com (Notes)
>   Additional notes (optional - max 2000 characters):
>
>
> -- 
> Mike Easter
> kibitzer, not SC admin
>
>
Ah Ha! I think that explains it.

I'm not so sure it's another 'stupid' spammer html construction though. I'm
on Outlook 2000 off an Exchange 2000 server. It might just be the way the M$
folks think the mime structure should be shown.

I've already added code to the ReportSpam macro to remove the "Microsoft
Mail Internet Headers Version 2.0" the M$ folks add to the beginning of the
header and the parser doesn't like it.

Now to fix the ReportSpam macro I have a couple of questions:

1. Does the mime structure always start with "----" and a string of numbers?
2. Can there be more than one mime structure in the construction? I've not
seen this but is it a valid construction?
3. Is the mime structure needed (I've seen some e-mails without a mime
structure)? That is, can I snip the header at the "----" and then add the
body to the construction or must I cut the header so the body be pasted into
the construction before the second "----" ?