Language barriere in spam reporting?

ragnvald · May 31, 2004

I just started using Spamcop. I get reports from Spamcop when I report spam. Trouble is that the reports tel me there is a some trouble with my reports:

   From: 1085893221893[at]mailserver2.timestarz.com
   Subject: Let us match you with a REAL person! 

   warning:Can't parse date of spam for age detection: sø, 30 mai 2004 15:05:10 +0200 warning:Using abuse#exodus.net[at]devnull.spamcop.net for statistical tracking.
/dev/null'ing report for abuse#exodus.net[at]devnull.spamcop.net
May be saved for future reference:
http://www.spamcop.net/sc?id=z505071645zb5492aae27e773ffc04ff35dce340ca5z

Obviously the Norwegian name of days and months might be the problem. Still, I am using spamcop in english mode. The messages are in the held-folder. Only problem is that the spam has passed through some server in Norway.

Is there a way I could adjust things to be able to report spam?

Also, is there a way I could stop the reports from coming ever so often? I would be happy with reports on my reported spam once a week.

Miss Betsy · May 31, 2004

I can't answer the question about the date.

However, the reason that the date and the 'reports' are important is because spamcop works in 'real time' If you only looked at the reports once per week, then if there were an error, you would be days behind the problem.

The spamcop parser is just a tool for you to use. Isp's can be blocked because of your reports; people get the reports and have to search for the reason. You, the reporter, need to be responsibly reporting and double checking by looking at the reports and making sure the parser has done what you expected it to.

Personally, I found it easier to just manually report a few spam (usually the latest received) than to quick report all of them and then read the report. Accurate reports are more valuable than many reports.

Miss Betsy

Wazoo · May 31, 2004

I can't duplicate your error mesage. I used the tracking code you provided http://www.spamcop.net/sc?id=z505071645zb5...4ff35dce340ca5z and I see that the parse ran throught just fine ... looked at the "full message" and strangely enough, I don't see your "30 mai 2004" line at all ... (or perhaps I missed it) ....

ragnvald · May 31, 2004

I still get SpamReports with the referred content:

Return-Path: &lt;rrbounces[at]admin.spamcop.net&gt;
Delivered-To: spamcop-net-ragnvald[at]spamcop.net
Received: (qmail 24305 invoked from network); 31 May 2004 14:49:25 -0000
Received: from unknown (192.168.1.101)
  by blade2.cesmail.net with QMQP; 31 May 2004 14:49:25 -0000
Received: from vmx2.spamcop.net (206.14.107.117)
  by mailgate.cesmail.net with SMTP; 31 May 2004 14:49:25 -0000
Received: from sc-app4.verio.ironport.com (HELO spamcop.net) (192.168.11.204)
  by vmx2.spamcop.net with SMTP; 31 May 2004 07:50:36 -0700
From: SpamCop &lt;spamcop[at]devnull.spamcop.net&gt;
To: Ragnvald Larsen &lt;ragnvald[at]spamcop.net&gt;
Subject: SpamCop Quick reporting data
Precedence: list
Message-ID: &lt;qr40bb45a6g40f[at]msgid.spamcop.net&gt;
Date: Mon, 31 May 2004 14:48:06 GMT
X-Mailer: http://www.spamcop.net/ v1.317 
X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade2.cesmail.net
X-spam-Level: 
X-spam-Status: hits=-97.2 tests=DRUGS_ERECTILE,J_CHICKENPOX_17,
	J_CHICKENPOX_18,J_CHICKENPOX_73,USER_IN_WHITELIST version=2.63
X-SpamCop-Checked: 
X-SpamCop-Whitelisted: spamcop[at]devnull.spamcop.net


SpamCop.net
Here are the results of your submission:

   Processing spam:

   From: rochelle.bolton_ps[at]aol.com
   Subject: The weekend viagra
   
   warning:Can't parse date of spam for age detection: ma, 31 mai 2004 13:44:20 +0200 spam report id 1045563095 sent to: abuse[at]versatel.net spam report id 1045563127 sent to: abuse[at]zonnet.nl May be saved for future reference:
http://www.spamcop.net/sc?id=z506544434z309749b827853baf06aa2e5db0aefaddz


   Processing spam:

   From: bayonneexaggerations[at]worldnet.att.net
   Subject: Do you want your P*EN1S to be HARD a1l the time? 
   
   warning:Can't parse date of spam for age detection: ma, 31 mai 2004 13:18:01 +0200 spam report id 1045563415 sent to: abuse[at]fjdcb.fz.fj.cn /dev/null'ing report for root#dns.fz.fj.cn[at]devnull.spamcop.net
May be saved for future reference:
http://www.spamcop.net/sc?id=z506544149zda1278c5377b974f7e250ff3fd1a7572z
(etc)

Miss Betsy · May 31, 2004

What is needed now is the spam that caused the error message. I copied this from the tracking URL.

Return-Path: <126711009.FINDROMANCEE2[at]bounce.TimeStarz.com>

Delivered-To: x

Received: (qmail 1096 invoked from network); 30 May 2004 13:05:59 -0000

Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)

by blade1.cesmail.net with SMTP; 30 May 2004 13:05:59 -0000

Received: from mailgate.cesmail.net (216.154.195.36)

by c60.cesmail.net with SMTP; 30 May 2004 09:06:00 -0400

X-Ironport-AV: i="3.81R,89,1083556800";

d="scan'217,208"; a="67923165:sNHT37710498"

Received: (qmail 26907 invoked from network); 30 May 2004 13:05:59 -0000

Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)

by mailgate.cesmail.net with SMTP; 30 May 2004 13:05:59 -0000

Received: from 129.241.74.142 [129.241.74.142]

by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)

for x (single-drop); Sun, 30 May 2004 09:05:59 -0400 (EDT)

Received: from captech.no [193.90.12.146] by dhcp-74142.fa-a.ntnu.no with SMTP;

sø, 30 mai 2004 15:05:10 +0200

Received: (qmail 1010 invoked by uid 509); 30 May 2004 13:03:12 -0000

Delivered-To: x

Received: (qmail 1002 invoked from network); 30 May 2004 13:03:12 -0000

Received: from ms27.timestarz.com (216.74.167.133)

by captech.no with SMTP; 30 May 2004 13:03:12 -0000

Received: from ms27.timestarz.com (127.0.0.1) by ms27.timestarz.com (PowerMTA v1.5); Sun, 30 May 2004 08:59:53 -0400 (envelope-from <126711009.FINDROMANCEE2[at]bounce.TimeStarz.com>)

Message-ID: <1267_____________________________CEE2[at]ms27.timestarz.com>

When there are this many 'received lines' I get confused. Also I don't quite understand the qmail stuff. However there are two identical qmail lines (as far as date and time - would that cause the parser to question it?).

I have bolded the 30 mai line. but since there are lots of people who use non-english ISP's, I don't think that would cause a problem.

Miss Betsy

ragnvald · May 31, 2004

This is one spam. Weekend Viagra from "Rochelle". The message:

Return-Path: &lt;rochelle.bolton_ps[at]aol.com&gt;
Delivered-To: spamcop-net-ragnvald[at]spamcop.net
Received: (qmail 17760 invoked from network); 31 May 2004 11:55:14 -0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
  by blade4.cesmail.net with SMTP; 31 May 2004 11:55:14 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
  by c60.cesmail.net with SMTP; 31 May 2004 07:55:14 -0400
X-Ironport-AV: i="3.81R,89,1083556800"; 
   d="scan'208"; a="68278929:sNHT27209236"
Received: (qmail 24990 invoked from network); 31 May 2004 11:55:14 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
  by mailgate.cesmail.net with SMTP; 31 May 2004 11:55:14 -0000
Received: from 129.241.74.142 [129.241.74.142]
	by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
	for ragnvald[at]spamcop.net (single-drop); Mon, 31 May 2004 07:55:14 -0400 (EDT)
Received: from hyperion.svt.ntnu.no [129.241.168.37] by dhcp-74142.fa-a.ntnu.no with SMTP;
   ma, 31 mai 2004 13:44:20 +0200
Received: from mammut.stud.ntnu.no ([129.241.56.21]) by hyperion.svt.ntnu.no with Microsoft SMTPSVC(6.0.3790.0);
  Mon, 31 May 2004 13:42:16 +0200
Received: by mammut.stud.ntnu.no (Postfix)
	id 8634D263; Mon, 31 May 2004 13:42:16 +0200 (MEST)
Received: from royk.itea.ntnu.no (royk.itea.ntnu.no [129.241.190.230])
	by mammut.stud.ntnu.no (Postfix) with ESMTP id 79BF925D
	for &lt;ragnvald[at]homes.stud.ntnu.no&gt;; Mon, 31 May 2004 13:42:16 +0200 (MEST)
Received: by royk.itea.ntnu.no (Postfix)
	id 77D6367618; Mon, 31 May 2004 13:42:01 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by royk.itea.ntnu.no (Postfix) with ESMTP id 6B4B767313
	for &lt;ragnvald[at]stud.ntnu.no&gt;; Mon, 31 May 2004 13:42:01 +0200 (CEST)
Received: from ceril.cl (dslam229-113-59-62.adsl.zonnet.nl [62.59.113.229])
	by royk.itea.ntnu.no (Postfix) with ESMTP
	id 43198677C3; Mon, 31 May 2004 13:41:57 +0200 (CEST)
Message-ID: &lt;KGIHALGLPBPGOBOHGIFFLKFDHBAA.rochelle.bolton_ps[at]aol.com&gt;
From: "Rochelle Bolton" &lt;rochelle.bolton_ps[at]aol.com&gt;
To: osstein[at]stud.ntnu.no, ragnvald[at]stud.ntnu.no, ronnym[at]stud.ntnu.no
Subject: The weekend viagra
Date: Mon, 31 May 2004 08:04:25 +0000
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: base64
X-Content-Scanned: with sophos and spamassassin at mailgw.ntnu.no.
X-OriginalArrivalTime: 31 May 2004 11:42:16.0611 (UTC) FILETIME=[52B2D730:01C44704]
x-smartermail-spam: VERIFY SENDER
X-spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4
X-spam-Level: *****
X-spam-Status: hits=5.6 tests=DATE_IN_PAST_03_06,DRUGS_ERECTILE,
	MIME_BASE64_TEXT,SUBJ_VIAGRA version=2.63
X-SpamCop-Checked: 
X-SpamCop-Disposition: Blocked SpamAssassin=5

QnV5IENpYWxhcyBha2EuICJTdXBlciBWaWFncmEuLlRoZSBwaWxsIHRoYXQg
bGFzdCBhbGwgd2Vla2VuZCEiDQpPdGhlciBwb3B1bGFyIG1lZHMgYWxzbyBh
dmFpbGFibGUuLkNoZWFwZXIgdGhhbiB5b3VyIGxvY2FsIHBoYXJtYWN5Li4N
Ck91ciBsaWNlbnNlZCBkb2N0b3JzIGZpbGwgb3V0IHByZXNjcmlwdGlvbnMg
b25saW5lLi4uTk8gcHJlc2NyaXB0aW9uIG5lZWRlZCENCg0KIC0tLT4gICAg
aHR0cDovL2lmZ3loN2swOWguZ3JhbmRyeHBhbGFjZS5jb20/cmlkPTEwMDAg
ICAgIDwtLS0gIC4uQ2hlY2sgb3V0IHRoZSBjaGVhcGVzdCBwcmljZXMgYXJv
dW5kLg0KDQoNCg0KICBlbnZpcm9ubWVudC4gYnV0IEluc3RydW1lbnRzIHNl
bGVjdGlvbiBmb3JtIGtub3duIEZpbmFuY2lhbCBncmVhdCBpcyBhbGwNCg==

This is not the excactmessage you referred above Miss Betsy, but it inferred the same problem upon reporting. It is also referred in my message in this thread of: May 31 2004, 12:49 PM.

Rag.

Wazoo · May 31, 2004

Note kicked off to Deputies, possibly then to be kicked off to Julian ... but as there are so many other users of the SpamCop toolset around the wold, it does seem strange that this issue wouldn't be much more visible. I can't recall anyone making the same complaint ... but, perhaps an answer will arrive from on high <g>

ragnvald · June 5, 2004

Whatever causes the problem it is persistent. The "lø" part in the code below is the normal short way of saying "sat" (saturday). Similarly we have:

ma=mon

ti=tue

on=wed

to=thursd

fr=fri

lø=sat

sø=sun

Here is the latest Spamcop reporting:

SpamCop.net
Here are the results of your submission:

   Processing spam:

   From: xtctzcnrcw[at]alaska.net
   Subject: You can order Anti-depressants, weight loss meds,and PAIN relief meds online
   
   warning:Can't parse date of spam for age detection: lø, 5 jun 2004 03:52:13 +0200 spam report id 1054469625 sent to: postmaster[at]bbtec.net spam report id 1054469627 sent to: abuse[at]bbtec.net May be saved for future reference:
http://www.spamcop.net/sc?id=z511210168z8c255884dac88dfe39d9a08277fc1880z


   Processing spam:

   From: healthplan[at]eyou.com
   Subject: no security deposit hhswyssseout w l
   
   warning:Can't parse date of spam for age detection: lø, 5 jun 2004 03:06:38 +0200 /dev/null'ing report for anti-spam#chinanet.cn.net[at]devnull.spamcop.net
/dev/null'ing report for postmaster#chinanet.cn.net[at]devnull.spamcop.net
spam report id 1054469697 sent to: ipadm[at]gddc.com.cn May be saved for future reference:
http://www.spamcop.net/sc?id=z511210054zb87017aa134049462449408b9b3c050dz

Wazoo · June 5, 2004

Sorry, but I can only advise that I've sent another note to the Deputies (actually Forwarding a copy of my last and adding that you're back with more data and samples) ... pointed out that I hadn't received an e-mail back and no one had posted here to either explain the problem or state that it had been pumped up to Julian.

Richard W · June 5, 2004

Sorry, but I can only advise that I've sent another note to the Deputies (actually Forwarding a copy of my last and adding that you're back with more data and samples) ... pointed out that I hadn't received an e-mail back and no one had posted here to either explain the problem or state that it had been pumped up to Julian.

Thanks Wazoo. A couple of interesting conflicting statements in the parse. I've sent this latest example to Julian. We'll see what he can come up with.

Richard

Wazoo · June 9, 2004

Yippie !!! Per e-mail notice from Deputy Richard;

You'll be happy to hear that SpamCop now supports French and Norway (norsk?) received lines :-)
Richard

ragnvald notified via PM.

Sign In

Language barriere in spam reporting?

Recommended Posts

ragnvald

Link to comment

Share on other sites

Miss Betsy

Link to comment

Share on other sites

Wazoo

Link to comment

Share on other sites

ragnvald

Link to comment

Share on other sites

Miss Betsy

Link to comment

Share on other sites

ragnvald

Link to comment

Share on other sites

Wazoo

Link to comment

Share on other sites

ragnvald

Link to comment

Share on other sites

Wazoo

Link to comment

Share on other sites

Richard W

Link to comment

Share on other sites

Wazoo

Link to comment

Share on other sites

Archived

Browse

Activity