Can't parse date of spam

[CaptDilli]

RE: http://members.spamcop.net/sc?id=z52340656...0bd0ae1eb1b7a2z

SpamCop v 1.349 © SpamCop.net, Inc. 1998-2004 All Rights Reserved

spam Header

This page may be saved for future reference:

http://www.spamcop.net/sc?id=z523406561z51...0bd0ae1eb1b7a2z

Can't parse date of spam for age detection: montgomery.mail.atl.earthlink.net (

[report history]

When I report spam with montgomery.mail.atl.earthlink.net in the header I receive the following message:

Can't parse date of spam for age detection: montgomery.mail.atl.earthlink.net (

The complete headers are:

Status: U

Return-Path: <rtiyrutwj[at]tut.by>

Received: from PASTIME7 ([63.105.205.105])

by montgomery.mail.atl.earthlink.net (EarthLink SMTP Server) with SMTP id 1bDknEPO3Nl3qB0

Wed, 23 Jun 2004 22:54:18 -0400 (EDT)

X-Message-Info: ZG9wfJw89ii6XTT9+fMCC96RSws

Received: from mail5237.mnkgx.pochtamt.ru ([192.234.235.92]) by fe7-s0.pochtamt.ru with Microsoft SMTPSVC(5.0.2195.6824);

Thu, 24 Jun 2004 06:55:22 +0300

Received: from OQH463 (wx204.40.220.137.sdmiv898.nfz.pochtamt.ru [174.32.132.169])

by mail927.kkp.pochtamt.ru (07.4.3uj36/48.9.2) with SMTP id oqy6UV3CQThjy6;

Thu, 24 Jun 2004 07:52:22 +0400

Message-ID: <386G206EXX519LJ75NLA$vhq558AF225ik345$JP026G6[at]ZMHQ50>

From: "Walsh" <rtiyrutwj[at]tut.by>

To: "Ekho" <ekho[at]owb.mindspring.com>

References: <oman4-bb54GATyRAXpriBHC667nz3Y693[at]pochtamt.ru>

Subject: bale

Date: Wed, 23 Jun 2004 21:56:22 -0600

MIME-Version: 1.0

If I change montgomery.mail.atl.earthlink.net to 207.69.200.133

or to samuel.mail.atl.earthlink.net

or to albert.mail.atl.earthlink.net

I do not receive the message: Can't parse date of spam for age detection: (etc.)

Any spam report with montgomery.mail.atl.earthlink.net in the headers fails and results in the report:

Can't parse date of spam for age detection: montgomery.mail.atl.earthlink.net (

Any ideas why this happens?

TIA

[StevenUnderwood]

Only a guess here as I don't have access to the code but it looks like the line is missing a semi-colon at the end prior to the date.

When you say:

If I change montgomery.mail.atl.earthlink.net to 207.69.200.133

or to samuel.mail.atl.earthlink.net

or to albert.mail.atl.earthlink.net

I do not receive the message: Can't parse date of spam for age detection: (etc.)

Are you only replacing the montgomery.mail.atl.earthlink.net string with those other strings, or are you replacing the entire received line?

Another, less likely possibility would be the string length of the hostname is the problem. If this is all you do to fix the problem, I would email deputies<at>spamcop.net and see if they can figure out why the shorter names work or pass it on to Julian for a look.

[CaptDilli]

When you say:

If I change montgomery.mail.atl.earthlink.net to 207.69.200.133

or to samuel.mail.atl.earthlink.net

or to albert.mail.atl.earthlink.net

I do not receive the message: Can't parse date of spam for age detection: (etc.)

Are you only replacing the montgomery.mail.atl.earthlink.net string with those other strings, or are you replacing the entire received line?

I am only replacing

montgomery.mail.atl.earthlink.net

with

207.69.200.133

or

samuel.mail.atl.earthlink.net

or

albert.mail.atl.earthlink.net

I will email deputies<at>spamcop.net and see if they can figure out why the shorter names work.

Thanks for the help.

[Wazoo]

Though this web-based thing has it's issues with displaying the "actual" code, there are some lines that look wrong, even taking this into account. Bottom line, yes, there's a word-wrap/line-length issue involved. The dates are being wrapped onto a new line, which blows the parser away ...

for instance the line that starts with;

Received: from mail5237.mnkgx.pochtamt.ru

it wraps to the next line ... but the catch is that the time/date data should have fit easily onto the end of that line ... note that it's found on the next line all by itself.

Your manipulation of some elements may be causing this wrapping issue to pick a new spot to come into play (or not come into play at all) [note your self-described "shorter" entries]

[CaptDilli]

Thank you for that observation. I did look at the first 4 lines if the header. I shall look further when I receive another spam that has montgomery.mail.atl.earthlink.net in the header.