Date and email not in parse result

[mascaret]

Hello everybody,

(sorry for my english) It's the first time I receveid a spam email where "year" in date field, and "email" in for, to and cc fields are not parse in the spam reporting. So the system respond : Can't parse date of spam for age detection: Sun, 24 Oct x 07:52:21 +0200 !!

what I received:

Received: from mwinf2008.orange.fr (mwinf2008 [172.22.130.36])

by mwinb1504 with LMTPA;

Sun, 24 Oct 2010 07:52:21 +0200

X-Sieve: CMU Sieve 2.3

and parsing =>

Received: from mwinf2008.orange.fr (mwinf2008 [172.22.130.36])

by mwinb1504 with LMTPA;

Sun, 24 Oct x 07:52:21 +0200

And this is the email part (i replace email part by -----)

Received: from [84.142.73.8] (helo=ssxky.czllfowfeubodul.biz)

by with esmtpa (Exim 4.69)

(envelope-from )

id 1MMC2C-4374rb-3G

for <mas----------adoo.fr>,

<mascar---------nadoo.fr>,

<masca------------nadoo.fr>,

<mascar-------adoo.fr>,

<mas------------doo.fr>,

<ma-------------------oo.fr>,

<mas-------------doo.fr>

parsing =>

Received: from [84.142.73.8] (helo=ssxky.czllfowfeubodul.biz)

by with esmtpa (Exim 4.69)

(envelope-from )

id 1MMC2C-4374rb-3G

for <x>,

<x>,

<x>,

<x>,

<x>,

<x>,

<x>

Cc: <x>, <x>,

<x>, <x>,

<x>, <x>,

<x>, <x>;, x,

x, x, x, x,

x

From: "Zachariah Chamberlain" <m4012252[at]ms21.hinet.net>

To: <x>,

<x>,

<x>,

<x>,

<x>,

<x>,

I use foxmail 6 to read my email and I've never had this problem.

What do you think about that ?

Regards.

[SpamCopAdmin]

Please send me the "TRACKING URL" from the top of the SpamCop page when you try to process that spam.

I can use it to see what SpamCop is seeing, so that I can help you.

- Don D'Minion - SpamCop Admin -

- service[at]admin.spamcop.net -

.

[Wazoo]

Please send me the "TRACKING URL" from the top of the SpamCop page when you try to process that spam.

I can use it to see what SpamCop is seeing, so that I can help you.

Same information applies to Posting into the Forum, asking for Help from many other folks. That's why the Tracking URL gets so much coverage in the FAQs. Wiki, "Read me first" links, and countless thousands of previous Topics, Discussions, and Posts.

[SpamCopAdmin]

Handled by email.

- Don D'Minion - SpamCop Admin -

- service[at]admin.spamcop.net -

[Wazoo]

Handled by email.

Great! Using a "Public" Forum to let folks know that the 'solution' exists somewhere, just not where one would look.

As the actual content isn't known and the data provided appears to have been edited, folks here can only guess at the possibilities. One that comes to mind is the old version of SpamAssassin that didn't care for the year 2010, but ....????? not enough real/actual data provided to see if that application is involved or not.

[turetzsr]

Great! Using a "Public" Forum to let folks know that the 'solution' exists somewhere, just not where one would look.

<snip>

...While I understand the frustration, I am inclined to give Don the benefit of the doubt, here. For example, it may have been difficult for him to say more than he did without giving away information the OP did not want revealed or information that SpamCop may not wish to reveal.

...We ask Don to restrain himself in criticism of our (the volunteers') replies and I feel we must accord him the same courtesy we request that he show us. <g>

[mascaret]

Hello,

a new message with the same problème :

http://www.spamcop.net/sc?id=z4620679678z2...f3128d5f743c2dz

=> Can't parse date of spam for age detection: Wed, 27 Oct x 09:41:00 +0200

1: Received: from [117.150.58.91] (helo=suwrayc.drgambemkvguyi.org) by rekpc-78-129.umcs.lublin.pl with esmtpa (Exim 4.69) (envelope-from ) id 1MM6LJ-5591ao-OL for <x>, <x>, <x>, <x>, <x>, <x>, <x>

No news from Don to give you at the moment.

Thank's for all.

[Wazoo]

a new message with the same problème :

http://www.spamcop.net/sc?id=z4620679678z2...f3128d5f743c2dz

Thanks for that.

Missing might be the steps and tools actualy used to pick up your e-mail. I am looking at the top-most Received line, which includes a 10.x.x.x IP Address (which the SpamCop parser ignores as being a non-routable local system) and a non-fully-qualified-Domain-name. Wondering, but assuming that this is an orange.fr device, but asking for your input on this. (Are you running your own e-mail server? If so, what OS and applications are involved?)

As "all" year data has been replaced with the 'x', it would seem logical to place the blame on the 'last' server involved the handling of the e-mail, which (at this point) appears to be orange.fr. My next question would then be .... is "all" of your e-mail showing up like this? (Possible scenario, only e-mail that meets some 'spam' threshold gets mangled ...????)

The several 'local' transfers could suggest that they are using a server or two as spam-filtering devices, but it might be nothing more than a geo-location issue. But again, as "all" dates have been touched, it still seems to indicate the 'last' server involved. If it was one of the 'middle' servers, then it would seem that only the dates in the prior Received: lines would have been touched. Something doesn't seem to like "2010" and SpamAssassin was the most famous/generally used application that displayed had that feeling .... on the flipside, this was fixed very quickly .. however, those fixes have to actually be appllied by those using the tool-set.

What comes to mind is age-old experience with the U.S. [at]Home outfit that would pull a 'spare' system off a shelf somewhere and slap it in the rack .... catch is that applications and tools were at the version/patch levels seen when those units had been placed on the shelf, perhaps a year prior. If there is any correlation, orange.fr needs to be notified to bring the involved systems up-to-date.

[Wazoo]

PM sent asking for follow-up.

[mascaret]

Missing might be the steps and tools actualy used to pick up your e-mail. I am looking at the top-most Received line, which includes a 10.x.x.x IP Address (which the SpamCop parser ignores as being a non-routable local system) and a non-fully-qualified-Domain-name. Wondering, but assuming that this is an orange.fr device, but asking for your input on this. (Are you running your own e-mail server? If so, what OS and applications are involved?)

As "all" year data has been replaced with the 'x', it would seem logical to place the blame on the 'last' server involved the handling of the e-mail, which (at this point) appears to be orange.fr. My next question would then be .... is "all" of your e-mail showing up like this? (Possible scenario, only e-mail that meets some 'spam' threshold gets mangled ...????)

The several 'local' transfers could suggest that they are using a server or two as spam-filtering devices, but it might be nothing more than a geo-location issue. But again, as "all" dates have been touched, it still seems to indicate the 'last' server involved. If it was one of the 'middle' servers, then it would seem that only the dates in the prior Received: lines would have been touched. Something doesn't seem to like "2010" and SpamAssassin was the most famous/generally used application that displayed had that feeling .... on the flipside, this was fixed very quickly .. however, those fixes have to actually be appllied by those using the tool-set.

What comes to mind is age-old experience with the U.S. [at]Home outfit that would pull a 'spare' system off a shelf somewhere and slap it in the rack .... catch is that applications and tools were at the version/patch levels seen when those units had been placed on the shelf, perhaps a year prior. If there is any correlation, orange.fr needs to be notified to bring the involved systems up-to-date.

Sorry for the delay (hoarse knee!),

I'm not sure to undersand what you mean (I'm not an expert !) : To be precise, when I stick the message in spamcop, dates are present. Dates disapeared after computing.

Orange is my provider and i have no problem with others messages. If you need something else, ask me.

Thank's for your patience and best regards.

[Wazoo]

I'm not sure to undersand what you mean (I'm not an expert !)

OK, I'll read that as meaning you do not run your won e-mail server.

To be precise, when I stick the message in spamcop, dates are present. Dates disapeared after computing.

No way I can duplicate that action. I read "stick the message" as describing a cut/paste operation into the 'form/window' pf the logged-into spamcop.net web-page. Exactly the way I use the system, yet I have no issues wuth the'date' disappearing in the parsing action. )Tools in use include Outlook Express, IE8, FireFix, Windows LiveMail, Yahoo e-mail, GMail ....) There simply has to be something more to the/your story.

Orange is my provider and i have no problem with others messages. If you need something else, ask me.

My last suggestion delas with the possibility of (your) Orange Host/Provider using multiple servers and one of those servers has a problem. At this point, you'll have to be the one comparing the good and bad e-mails involvd to see is this is true or not. Posting a Tracking URL from one 'bad' subittal and another from a 'good' submittal might allow someone here to spot the differences in the data and point out the problem issue specifically.??????