[Scspamcop] Re: pharm sites not resolving in parser

[Mike Easter]

RandallW wrote:
> I've been receiving pharm spam that doesn't resolve the spamervertised
> site ( in the parser ).  Example below.
>
www.spamcop.net/sc?id=z2415693959z95803a0d5038711d07eae391feb2f8c5z

Your tracker is live.

It is very very common for the parser to not resolve spamvertised sites.
Sometimes such nonresolution is temporary or episodic, sometimes it is
consistent.  It is also common for a human using other tools to be able to
resolve such URLs.  Sometimes you can use SC as a tool to resolve, but not
in this case.

> Though if I plug in the spamvertised site into an online viewer I do get
> some type of return, rather than a 401 error, so I think the site is
> alive. The result of the test is something I can't quite understand; it
> isn't direct like a www url.

The link is at www.addmorelife.sg which resolves to 121.33.199.44 which is
a chinanet guangdong provider.  IMO it isn't appropriate to be using
bandwidth or your resources or SC's resources notifying such providers and
you should instead be using quickreporting on spam which contains such
links.

The other link which the parser finds in the body is the one live hotmail
uses to spamvertise itself which hotmail doesn't want to hear about either
and has told SC.

My test did not show anything/webserver at that IP's port 80.

Initiating server query ...
Looking up IP address for domain: www.addmorelife.sg
The IP address for the domain is: 121.33.199.44
Connecting to the server on standard HTTP port: 80
No response was received from the machine and port at that IP. The machine
may be offline or the connection port may be stealthed.
Query complete.



-- 
Mike Easter
kibitzer, not SC admin