Sign in to follow this  
Followers 0
stillwaters

Can't report Spammers somehow forging date

12 posts in this topic

Hi,

How do I report spam to SpamCop that says it arrived in my inbox last year! when it really just arrived today? How do the spammers forge the date???

Share this post


Link to post
Share on other sites

Your ISP's machine is probably broken. Notify your ISP. Spamcop uses the date in the received line put there by your ISP.

Miss Betsy

Share this post


Link to post
Share on other sites

Again, a Tracking URl would give us something to point to / at ... The SpamCop parser takes the date/time from the top-most valid header line, usually this is the one inserted by your ISP. So this is where one would start with trying to figure out where the message has either been sitting for so long, or looking at the headers to see just which time stamp got picked up, thus you will have a notify target to set their clock.

Share this post


Link to post
Share on other sites
Again, a Tracking URL would give us something <big snip>

14966[/snapback]

What is a tracking URL? There is no reference to a "tracking URL" on any Spamcop reports I have submitted. :blink:

Edited by flagginator

Share this post


Link to post
Share on other sites

Hello,

here is an example of one of many. I have hundreds of emails in my inbox so this date of Nov 5 2003 placed the email all the way at the end of my inbox where I normally would not have noticed. The next line says 11 Aug 2004 yet I am almost positive I received this today.

The comment about the server can't be true because it is only the porno spammers & a couple of other persistent spammers who somehow wind up at the end of my inbox.

??????????????? appreciate any help!

From Dena Mckay Wed Nov 5 01:50:34 2003

X-Apparently-To: XXXXXXXXX[at]yahoo.com via 66.218.94.141; Wed, 11 Aug 2004 08:55:07 -0700

X-YahooFilteredBulk: 61.255.220.89

X-Originating-IP: [61.255.220.89]

Return-Path: <vnhaodxzgvlc[at]mantramail.com>

Received: from 61.255.220.89 (HELO 66.94.234.252) (61.255.220.89) by mta408.mail.scd.yahoo.com with SMTP; Wed, 11 Aug 2004 08:55:04 -0700

X-Message-Info: D/zeu+41+fbe/DMM+63/9818393705

Received: from smtp-acquit.williamson.VNHAODXZGVLC[at]mantramail.com ([61.255.220.89]) by d74-fe4.VNHAODXZGVLC[at]mantramail.com with Microsoft SMTPSVC(5.0.1347.9203); Wed, 05 Nov 2003 08:46:34 -0100

Received: from basil784.hotbox.VNHAODXZGVLC[at]mantramail.com (puffball780.VNHAODXZGVLC[at]mantramail.com [61.255.220.89]) by smtp-additive.doorkeeper.VNHAODXZGVLC[at]mantramail.com (Postfix) with SMTP id 98XV58G64ZJ for <carbon_45[at]yahoo.com>; Wed, 05 Nov 2003 10:41:34 +0100

Received: from smtp-burley.knot.VNHAODXZGVLC[at]mantramail.com ([61.255.220.89]) by tw88-ca05.VNHAODXZGVLC[at]mantramail.com with Microsoft SMTPSVC(5.0.7185.1640); Wed, 05 Nov 2003 04:48:34 -0500

X-Message-Info: WGZCK+%ND_LC_CHAR[1-3]6+qkq+M+66/440258923990

Received: (qmail 06497 invoked by uid 5); Wed, 05 Nov 2003 11:42:34 +0200

Date: Wed, 05 Nov 2003 07:50:34 -0200

Message-Id: <447673452138.03815[at]VNHAODXZGVLC[at]mantramail.com>

From: "Dena Mckay" <VNHAODXZGVLC[at]mantramail.com> Add to Address Book

To: "Carbon_45" <carbon_45[at]yahoo.com>

Subject: V

MIME-Version: 1.0 (produced by demultiplexchunk 6.5)

Content-Type: multipart/alternative; boundary="--37819861562439745"

Content-Length: 615

Share this post


Link to post
Share on other sites

While the message may end up in your inbox showing the Nov 5, 2003 date, that is because your client is sorting them by the date provided by the sender.

That should not affect the spamcop report as it uses the most recent Received header, in this case:

Received: from 61.255.220.89 (HELO 66.94.234.252) (61.255.220.89) by mta408.mail.scd.yahoo.com with SMTP; Wed, 11 Aug 2004 08:55:04 -0700

This message, however, is still too old to report at this time. If you submittd this spam on Friday or before nd it still showed being too old to report at that time, please provide the deputies with the tracking URL from that report attempt so they cam see where the problem is occurring.

Share this post


Link to post
Share on other sites

Again, the request for a Tracking URL, rather than the whole spam posted here ....

The answer to your question is that your e-mail application looks at the data that happens to be forged. The SpamCop parser is not quite so stupid. Now why it's dated the 11 Aug and you just got it today (the 15th) was what your original query was about. Yahoo server says it was received on the 11th, and you make no claim as to how often you check your Yahoo e-mail ...??

Share this post


Link to post
Share on other sites

Dear Wazoo,

I posted the "full header" because I thought that is what I was supposed to do, sorry.

I check my email daily but I have so many email accounts that I could have missed that one even though I am pretty darn sure I received it days later than it says.

I just received one now that says Nov 2003 but it says received today. So I am going to report it and see what happens.

THANK YOU FOR YOUR HELP EVERYONE

Share this post


Link to post
Share on other sites

Grab that URL when you do report it .... post that and "we" can compare that data to the headers of the one you've already posted ... again, looking to see if it's a Yahoo issue or something else.

A year or so ago, posting headers would have been more correct, but since the last big upgrade on the reporting system, the entire spam submittal is now stored, so the actula spam submittal can now be seen ... this takes out all the vaguaries of browsers, this Forum software, etc .... thus everybody is talking about the same data ..

witness the discussion over at http://forum.spamcop.net/forums/index.php?showtopic=2395 which includes problems between handling and viewing of spam data ...

Share this post


Link to post
Share on other sites

Dear Wazoo,

my HTML graphic spam gets reported as an attachment to a spamcop email address. That is how spamcop said to report html graphics from yahoo. So, I don't know how to get that URL that would be so useful.

Share this post


Link to post
Share on other sites

When you email the message in, you should get a reply email when it is ready to complete the report. That URL is the tracking URL we are looking for.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0