Jump to content

Can't report Spammers somehow forging date


Recommended Posts

Again, a Tracking URl would give us something to point to / at ... The SpamCop parser takes the date/time from the top-most valid header line, usually this is the one inserted by your ISP. So this is where one would start with trying to figure out where the message has either been sitting for so long, or looking at the headers to see just which time stamp got picked up, thus you will have a notify target to set their clock.

Link to comment
Share on other sites


here is an example of one of many. I have hundreds of emails in my inbox so this date of Nov 5 2003 placed the email all the way at the end of my inbox where I normally would not have noticed. The next line says 11 Aug 2004 yet I am almost positive I received this today.

The comment about the server can't be true because it is only the porno spammers & a couple of other persistent spammers who somehow wind up at the end of my inbox.

??????????????? appreciate any help!

From Dena Mckay Wed Nov 5 01:50:34 2003

X-Apparently-To: XXXXXXXXX[at]yahoo.com via; Wed, 11 Aug 2004 08:55:07 -0700


X-Originating-IP: []

Return-Path: <vnhaodxzgvlc[at]mantramail.com>

Received: from (HELO ( by mta408.mail.scd.yahoo.com with SMTP; Wed, 11 Aug 2004 08:55:04 -0700

X-Message-Info: D/zeu+41+fbe/DMM+63/9818393705

Received: from smtp-acquit.williamson.VNHAODXZGVLC[at]mantramail.com ([]) by d74-fe4.VNHAODXZGVLC[at]mantramail.com with Microsoft SMTPSVC(5.0.1347.9203); Wed, 05 Nov 2003 08:46:34 -0100

Received: from basil784.hotbox.VNHAODXZGVLC[at]mantramail.com (puffball780.VNHAODXZGVLC[at]mantramail.com []) by smtp-additive.doorkeeper.VNHAODXZGVLC[at]mantramail.com (Postfix) with SMTP id 98XV58G64ZJ for <carbon_45[at]yahoo.com>; Wed, 05 Nov 2003 10:41:34 +0100

Received: from smtp-burley.knot.VNHAODXZGVLC[at]mantramail.com ([]) by tw88-ca05.VNHAODXZGVLC[at]mantramail.com with Microsoft SMTPSVC(5.0.7185.1640); Wed, 05 Nov 2003 04:48:34 -0500

X-Message-Info: WGZCK+%ND_LC_CHAR[1-3]6+qkq+M+66/440258923990

Received: (qmail 06497 invoked by uid 5); Wed, 05 Nov 2003 11:42:34 +0200

Date: Wed, 05 Nov 2003 07:50:34 -0200

Message-Id: <447673452138.03815[at]VNHAODXZGVLC[at]mantramail.com>

From: "Dena Mckay" <VNHAODXZGVLC[at]mantramail.com> Add to Address Book

To: "Carbon_45" <carbon_45[at]yahoo.com>

Subject: V

MIME-Version: 1.0 (produced by demultiplexchunk 6.5)

Content-Type: multipart/alternative; boundary="--37819861562439745"

Content-Length: 615

Link to comment
Share on other sites

While the message may end up in your inbox showing the Nov 5, 2003 date, that is because your client is sorting them by the date provided by the sender.

That should not affect the spamcop report as it uses the most recent Received header, in this case:

Received: from (HELO ( by mta408.mail.scd.yahoo.com with SMTP; Wed, 11 Aug 2004 08:55:04 -0700

This message, however, is still too old to report at this time. If you submittd this spam on Friday or before nd it still showed being too old to report at that time, please provide the deputies with the tracking URL from that report attempt so they cam see where the problem is occurring.

Link to comment
Share on other sites

Again, the request for a Tracking URL, rather than the whole spam posted here ....

The answer to your question is that your e-mail application looks at the data that happens to be forged. The SpamCop parser is not quite so stupid. Now why it's dated the 11 Aug and you just got it today (the 15th) was what your original query was about. Yahoo server says it was received on the 11th, and you make no claim as to how often you check your Yahoo e-mail ...??

Link to comment
Share on other sites

Dear Wazoo,

I posted the "full header" because I thought that is what I was supposed to do, sorry.

I check my email daily but I have so many email accounts that I could have missed that one even though I am pretty darn sure I received it days later than it says.

I just received one now that says Nov 2003 but it says received today. So I am going to report it and see what happens.


Link to comment
Share on other sites

Grab that URL when you do report it .... post that and "we" can compare that data to the headers of the one you've already posted ... again, looking to see if it's a Yahoo issue or something else.

A year or so ago, posting headers would have been more correct, but since the last big upgrade on the reporting system, the entire spam submittal is now stored, so the actula spam submittal can now be seen ... this takes out all the vaguaries of browsers, this Forum software, etc .... thus everybody is talking about the same data ..

witness the discussion over at http://forum.spamcop.net/forums/index.php?showtopic=2395 which includes problems between handling and viewing of spam data ...

Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...