Can't parse date of spam for age detection

[lewisstraughn]

I am getting a new error message that just started since the end of Aug. When the 1st of September came along, I started getting this error when reporting:

Can't parse date of spam for age detection: , 33 Aug 2007 15:23:53 +0900

Notice the date is 33 Aug. I got 32 Aug yesterday. I am not doing anything different than I have in the past and all of a sudden it is rolling the date and not changing over the month.

Here is the header of the email I was reporting:

Subject: Choose a reliable source for your meds.

Content-Type:

multipart/alternative;boundary="----=_NextPart_000_0006_0107FFA4.0107FE0C"

Return-Path: <dwsiskindsm[at]siskinds.com>

Mime-Version: 1.0

To: <lewisstraughn[at]netscape.com>

From: "Terence Yeager" <dwsiskindsm[at]siskinds.com>

X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2670

Thread-Index: Aca6QZ9O5PVE1AOXGMYR004SJMJTX4==

X-Eon-DM: dm27

Date: , 33 Aug 2007 15:23:53 +0900

Message-Id: <0107ffa4$0107fe78$f66656dc[at]dwsiskindsm>

X-Mailer: Microsoft Office Outlook, Build 11.0.6353

Received: from [220.86.102.246] (220.86.102.246 [220.86.102.246])by

dm27.mta.everyone.net (EON-INBOUND) with ESMTP id

dm27.46d7aa17.8eaacafor <lewisstraughn[at]netscape.com>; Sat, 1 Sep 2007

23:23:40 -0700

from [220.86.102.246] by siskinds.com.s8b1.psmtp.com; , 33 Aug 2007 15:23:53 +0900

I see this date in the last line of the header. How is it getting there and what can i do to correct the problem?

Thanks for your help,

Lewis

[Wazoo]

Posted into the Foruim section;

SpamCop Discussion > Discussions & Observations > How to use .... Instructions, Tutorials > SpamCop Forum

Usual question rarely answered is "Why?"

With this post, this Topic wil be moved to the Reporting Help Forum section.

The 'problem' ... does 'any' e-mail arrive with a 'correct' Date: line content?

Initial question is based on whether your ISP's server is generating this totally screwed up line or if it is coming from an absolutely braindead spammer/spammer-tool ....

[C2H5OH]

Posted into the Foruim section;

SpamCop Discussion > Discussions & Observations > How to use .... Instructions, Tutorials > SpamCop Forum

Usual question rarely answered is "Why?"

With this post, this Topic wil be moved to the Reporting Help Forum section.

The 'problem' ... does 'any' e-mail arrive with a 'correct' Date: line content?

Initial question is based on whether your ISP's server is generating this totally screwed up line or if it is coming from an absolutely braindead spammer/spammer-tool ....

I think it's the latter. I too have received many like that recently.

Look at http://www.spamcop.net/sc?id=z1417512022z2...83dd83ad98d0c0z

You'll see that the header has the line;

"Date: Wed, 1 Aug 1934 01:45:17 +0100"

Spamcop reports;

"Can't parse date of spam for age detection: Sat, 34 Aug 2005 03:45:17 +0300"

- Maybe not brain dead then, rather they've found another way to confound SpamCop?

HTH

[Wazoo]

Thanls for providing a Tracking URL .... several 'issues' are now up for discussion ...

You are focusing on the "Date:" line ... although assumedly somewhat connected, this line does not 'exist' as far as the Parsing code is concerned. What is at issue is the Received: lines, specifically the line:

Received: from [88.84.200.45] by apollo.aristotle.net; Sat, 34 Aug 2005 03:45:17 +0300

Now, the 'bad' part ... the Reporting from a MailHost Configured Reporting Account uses a bit of different code than the non-MailHosted parsing .... http://www.spamcop.net/sc?id=z1417600335z3...e78ea32475114ez .... note the difference in results. This has been pointed out for a long time, but ... no response or insight ever provided ....

'regular' parse uses the Date/Time from the topmost vaild Received: line.

MailHost Configured parse seems to want to use the bottom-most 'valid' Received: line for Date/Time.

I'll kick another notice upstream again ....

From: "Wazoo"

To: "SpamCop Deputies"

Subject: MailHost Configured account - bad date string in headers

Date: Mon, 3 Sep 2007 13:32:34 -0500

http://forum.spamcop.net/forums/index.php?showtopic=8659

Issue once again is the parsing and usage of Date/Time stamps found

in the headers and the handling differences between a MailHost

Configured account and one that's not. Ancient news, yet ... status

still unknown as to a 'fix' ....????

MailHost Configured Tracking URL;

http://www.spamcop.net/sc?id=z1417512022z2...83dd83ad98d0c0z

non-MailHost Configured Tracking URL;

http://www.spamcop.net/sc?id=z1417600335z3...e78ea32475114ez

Bad header line;

Received: from [88.84.200.45] by apollo.aristotle.net; Sat, 34 Aug

2005 03:45:17 +0300

[C2H5OH]

Thanls for providing a Tracking URL .... several 'issues' are now up for discussion ...

SNIP

I'll kick another notice upstream again ....

These are coming thick and fast now. It does look as if someone is using it as a way to reduce the number of SpamCop reports. I suppose that's sort of flattering for SpamCop - if damned annoying!

36th August seems to be a recurring date....

[Wazoo]

No reply from 'above' so .... if you want to report these, a non_MailHost Configured Reporting Account does seem to work ... about all I can say ...

[lewisstraughn]

Hey Wazoo, what do you mean by a "a non_MailHost Configured Reporting Account"?

[Wazoo]

Hey Wazoo, what do you mean by a "a non_MailHost Configured Reporting Account"?

Sorry, but I find that question very confusing.

You have not provided a Tracking URL, but .. based on your original complaint and analysis performed and documented from another user's provided data, it has to be assumed that you in fact went through the process to MailHost Configure your Reporting Account. A non-MailHost Configured account would be a Reporting account to which this process had not been applied.

There is a Forum section 'here';

Mailhost Configuration of your Reporting Account

Minimize self-reporting accidents by identifying your e-mail host(s) to the Parser.

Required for Quick-Reporting.

The SpamCop FAQ has a section under the Parsing & Reporting section;

How do I configure Mailhosts for SpamCop?

-----> Mailhost System Configuration Explanation

-----> MailHost Configuration Problems FAQ started

-----> Mailhosts Typical Questions A less technical version

-----> One version of a Step-by-step MailHost set-up

-----> "Sorry, confirmation codes do not match:" - Why?

-----> MailHostConfiguration - Wiki Version

As seen in that last entry, there is data available in the Wiki.

[SpamCopAdmin]

I am getting a new error message that just started since the end of Aug. When the 1st of September came along, I started getting this error when reporting:

Can't parse date of spam for age detection: , 33 Aug 2007 15:23:53 +0900

My understanding of the situation is that your ISP, or their provider, was having network problems that resulted in all sorts of goofy headers and other problems.

I hear that the problems have been fixed and things are back to normal now.

If you're still having problems, please write to me directly at service[at]admin.spamcop.net and send the "TRACKING URL" from the top of the SpamCop page when you get the error.

- Don D'Minion - SpamCop Admin -

[lewisstraughn]

My understanding of the situation is that your ISP, or their provider, was having network problems that resulted in all sorts of goofy headers and other problems.

I hear that the problems have been fixed and things are back to normal now.

If you're still having problems, please write to me directly at service[at]admin.spamcop.net and send the "TRACKING URL" from the top of the SpamCop page when you get the error.

Don, I sent you a private email about this problem as you requested to service[at]admin.spamcop.net

The tracking information is also here in case I got the email address wrong. Thanks again for all your help.

SpamCop v 640 Copyright © 1998-2006, IronPort Systems, Inc. All rights reserved.

Here is your TRACKING URL - it may be saved for future reference:

http://www.spamcop.net/sc?id=z1421319152z4...1000dab16f4656z

Can't parse date of spam for age detection: Tue, 35 Aug 2007 26:54:17 +0800

[StevenUnderwood]

SpamCop v 640 Copyright © 1998-2006, IronPort Systems, Inc. All rights reserved.

Here is your TRACKING URL - it may be saved for future reference:

http://www.spamcop.net/sc?id=z1421319152z4...1000dab16f4656z

Can't parse date of spam for age detection: Tue, 35 Aug 2007 26:54:17 +0800

That tracking link looks like you used the webmail "Show all headers" view rather than the "Message source" view as the second received line is missing the "Received:" header.

That view does not produce a parsable result.

[SpamCopAdmin]

That tracking link looks like you used the webmail "Show all headers" view rather than the "Message source" view as the second received line is missing the "Received:" header.

That view does not produce a parsable result.

I agree that the headers are hosed, but I don't see any cesmail.net servers in them, so I don't think they were taken from the SpamCop Email Service webmail interface.

- Don -

[C2H5OH]

Just for information, I'm still seeing these things...

http://www.spamcop.net/sc?id=z1425998881ze...cb7c05ee7236dfz

SpamCop tells me this spam is too old.

The oldest received line has the date Tue, 11 Sep 2007 07:53:57 +0000 ( - probably about right)

The more recent received line has Mon, 31 Dec 2001 23:14:29 +0100 (faked)

Spammer's accident or design??

[Farelf]

...Spammer's accident or design??

No, there's something wrong with the parse. Here's what happens with no mailhosts when that spam is parsed: http://www.spamcop.net/sc?id=z1426042163z8...18d3bd7149c16fz

I wonder if you should clear you mailhosts and start again? The problem may not be there but I guess it is a little more likely than the parser being kaput. Unfortunately I have no more time right now to look more carefully, hopefully someone else can pick up the thread shortly.

[edit] Just enough time to note yes, maybe it is the parser. Non-mailhosted handles dates a little differently (goes by top line) and, though this parse agrees with yours on the source, it is not affected by the obvious bad date line.

[Wazoo]

SpamCop tells me this spam is too old.

The oldest received line has the date Tue, 11 Sep 2007 07:53:57 +0000 ( - probably about right)

The more recent received line has Mon, 31 Dec 2001 23:14:29 +0100 (faked)

Spammer's accident or design??

Actually answered way back in my Linear Posts #4 and #6 in this Topic. Farelf's last replies were to repeat the same problem, pointing to the same 'solution' ....

I received no reply from my e-mail to Deputies about the parser issue, but Don then did make a visit here with the suggestion for the Topic starter to take things private .... I don't see the date/time-stamping issues as being the same between your samples and the Topic starter's .... but if you don't like the answers suggested 'here' ...