Re: spam with no subject, no body, no sender, ... not much !

Posted to spamcop.spam & spamcop, f/ups to spamcop.  No one reads in
.spam

ClÂZément Marshall wrote:
Subject: spam with no subject, no body, no sender, ... not much !
> such as this one :

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z1239573322z0abbfc6fcba563117d0bd816e5bdbb27z

> are not accepted by spamcop.

<SC> This header is incomplete. Please supply the full headers of the
spam you're trying to report.
<SC> No source IP address found, cannot proceed.

SC's verbose output is commonly misleading.  There is a source IP in the
Received traceline, but the algo is configured to reject headers with
insufficient header components.  SC requires that the header contain at
least one Received traceline, which this does, and additionally that it
contain either a Subject line or a From line or a To line in addition to
the traceline, none of which this header example does.

> These become more and more frequent. What to do with that spam ?

You can't report it because you cannot modify/forge the headers for spam
you report in order to help spamcop parse the headers and report what it
wouldn't have reported without the material change.

I do experimental forgeries and then cancel any resultant reporting.
Experimentally those headers would parse if they had any one of the
headerlines of To: or From: or Subject: -- but they don't.  That item is
currently too old to report.

The best way to demonstrate a spam is to feed it to the parser and copy
the tracking URL, as I did above, and post just the tracker into a
discussion group such as spamcop or spamcop.help, as I did above.

Notice how bad/funny your handle looks if the one/newsreader who replies
to your posts doesn't have UTF-8 enabled.


-- 
Mike Easter
kibitzer, not SC admin

Posted to spamcop.spam & spamcop, f/ups to spamcop.  No one reads in
.spam

ClÂZément Marshall wrote:
Subject: spam with no subject, no body, no sender, ... not much !
> such as this one :

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z1239573322z0abbfc6fcba563117d0bd816e5bdbb27z

> are not accepted by spamcop.

<SC> This header is incomplete. Please supply the full headers of the
spam you're trying to report.
<SC> No source IP address found, cannot proceed.

SC's verbose output is commonly misleading.  There is a source IP in the
Received traceline, but the algo is configured to reject headers with
insufficient header components.  SC requires that the header contain at
least one Received traceline, which this does, and additionally that it
contain either a Subject line or a From line or a To line in addition to
the traceline, none of which this header example does.

> These become more and more frequent. What to do with that spam ?

You can't report it because you cannot modify/forge the headers for spam
you report in order to help spamcop parse the headers and report what it
wouldn't have reported without the material change.

I do experimental forgeries and then cancel any resultant reporting.
Experimentally those headers would parse if they had any one of the
headerlines of To: or From: or Subject: -- but they don't.  That item is
currently too old to report.

The best way to demonstrate a spam is to feed it to the parser and copy
the tracking URL, as I did above, and post just the tracker into a
discussion group such as spamcop or spamcop.help, as I did above.

Notice how bad/funny your handle looks if the one/newsreader who replies
to your posts doesn't have UTF-8 enabled.


-- 
Mike Easter
kibitzer, not SC admin

Posted to spamcop.spam & spamcop, f/ups to spamcop.  No one reads in
.spam

ClÂZément Marshall wrote:
Subject: spam with no subject, no body, no sender, ... not much !
> such as this one :

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z1239573322z0abbfc6fcba563117d0bd816e5bdbb27z

> are not accepted by spamcop.

<SC> This header is incomplete. Please supply the full headers of the
spam you're trying to report.
<SC> No source IP address found, cannot proceed.

SC's verbose output is commonly misleading.  There is a source IP in the
Received traceline, but the algo is configured to reject headers with
insufficient header components.  SC requires that the header contain at
least one Received traceline, which this does, and additionally that it
contain either a Subject line or a From line or a To line in addition to
the traceline, none of which this header example does.

> These become more and more frequent. What to do with that spam ?

You can't report it because you cannot modify/forge the headers for spam
you report in order to help spamcop parse the headers and report what it
wouldn't have reported without the material change.

I do experimental forgeries and then cancel any resultant reporting.
Experimentally those headers would parse if they had any one of the
headerlines of To: or From: or Subject: -- but they don't.  That item is
currently too old to report.

The best way to demonstrate a spam is to feed it to the parser and copy
the tracking URL, as I did above, and post just the tracker into a
discussion group such as spamcop or spamcop.help, as I did above.

Notice how bad/funny your handle looks if the one/newsreader who replies
to your posts doesn't have UTF-8 enabled.


--
Mike Easter
kibitzer, not SC admin

Posted to spamcop.spam & spamcop, f/ups to spamcop.  No one reads in
.spam

ClÂZément Marshall wrote:
Subject: spam with no subject, no body, no sender, ... not much !
> such as this one :

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z1239573322z0abbfc6fcba563117d0bd816e5bdbb27z

> are not accepted by spamcop.

<SC> This header is incomplete. Please supply the full headers of the
spam you're trying to report.
<SC> No source IP address found, cannot proceed.

SC's verbose output is commonly misleading.  There is a source IP in the
Received traceline, but the algo is configured to reject headers with
insufficient header components.  SC requires that the header contain at
least one Received traceline, which this does, and additionally that it
contain either a Subject line or a From line or a To line in addition to
the traceline, none of which this header example does.

> These become more and more frequent. What to do with that spam ?

You can't report it because you cannot modify/forge the headers for spam
you report in order to help spamcop parse the headers and report what it
wouldn't have reported without the material change.

I do experimental forgeries and then cancel any resultant reporting.
Experimentally those headers would parse if they had any one of the
headerlines of To: or From: or Subject: -- but they don't.  That item is
currently too old to report.

The best way to demonstrate a spam is to feed it to the parser and copy
the tracking URL, as I did above, and post just the tracker into a
discussion group such as spamcop or spamcop.help, as I did above.

Notice how bad/funny your handle looks if the one/newsreader who replies
to your posts doesn't have UTF-8 enabled.


--
Mike Easter
kibitzer, not SC admin

Mike Easter wrote:
> Posted to spamcop.spam & spamcop, f/ups to spamcop.  No one reads in
> .spam

Beware, I accidentally screwed up the f/ups line on one of these and it
will f/up to .geeks instead of spamcop.

-- 
Mike Easter
kibitzer, not SC admin