[SpamCop-List] Re: Brazillian spam no longer getting spamcop complaints to hoster of site

[Mike Easter]

Joel Rubin wrote:
> I get a lot of these.

Don't post spams here.

If you want to show us a spam, put it into the parser and copy the
tracking url and paste the tracker here.

The tracker and its environment at the top of the parse look like this.

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z799093755z8a7b1f3598c15c83872c783cafd53a77z

>  The ntl.com IP (probably in Brighton, England)
> is almost certainly an open proxy and Spam Cop complained to ntl.
>
> But the Brazillian quack site seu.bio.br (clickplug.com.br /
> embratel.net.br) is NOT being complained about.

The other problem is that when you post a 'screwed up' example of a
spam, no one else can do anything with the parser without cleaning up
what you posted, which is what the above tracker is -- a cleanup of the
spam you posted here.

> Of course, I had to add a blank line after the headers to get anything
> to work.

Even with the blank line, the configuration is improper.  The header
content type should be text/html, not multipart alternative.

Then it can only do this:

Tracking link:
http://3d"http://www.seu.bio.br/marhttp://www.seu.bio.br/mar"
No recent reports, no history available
3d"http is not a hostname

Cannot resolve
http://3d"http://www.seu.bio.br/marhttp://www.seu.bio.br/mar"

The URL still couldn't be deobfuscated because I didn't feel like trying
to take your newsreader's wraps out of the body of the raw html.

If you would post the tracker instead of putting spam into the
discussion group, it makes it easier for others to tinker with.

> I don't think Embratel (which had been complained to in the past) will
> do anything about it but I do want the clickplug IP's blocked.


-- 
Mike Easter
kibitzer, not SC admin