dhanna Posted November 8, 2004 Share Posted November 8, 2004 I know some mail transfer systems may hold up the delivery, but I can't report it now even though I just received it. The sending system has the date as 2.3 days ago, but all the other systems have it dated today. Are they able to forge the date too? http://www.spamcop.net/sc?id=z690276311z34...4bf2eceddd6957z Link to comment Share on other sites More sharing options...
Wazoo Posted November 8, 2004 Share Posted November 8, 2004 Post moved from E-mail to Help, as it's a Reporting issue, vice a problem with a SpamCop E-mail account. OK, at issue is that yes, it took Earthlink a while to move the e-mail from there to cox. Something like 12 minutes later, it was seen at the SpamCop server. So what's your connection mode between Earthlink and cox? Or is the implication that this bottom line was a good forgery, but that the servers are trusted ... Deputies notified to take a look ... The second issue is the change in modes of calculating date/time as seen in a bit of discussion in the post I put up in Announcements a while back. http://forum.spamcop.net/forums/index.php?showtopic=2948 Your sample certainly shows the difference between what once was and what's happening now ... the difference between the topmost valid header line and now the bottom-most trusted line is very clear here ... and it makes quite a difference. Link to comment Share on other sites More sharing options...
Ellen Posted November 9, 2004 Share Posted November 9, 2004 I don't see any mh for the user for earthlink. The earthlink server is trusted as a valid mailserver. The bottom header looks OK to me unless we think that the cox mailserver doesn't know where it got the mail from or we distrust the earthlink server. I am sort of underwhelmed that the el server is relaying mail fro a dynamic adelphia IP. I think the earthlink server sat on the mail for a while -- maybe it was having a problem delivering to cox for some reason or maybe it was just having a problem period. Looking at senderbase it appears that there was a big upsurge in email in the last 30 days for the IP altho that has subsided -- as this is a dynamic IP who knows who had it when. Taking a url from the spam: http://www.centerfree.com/index.html I note that that url was being reported thru Sat, 6 Nov 2004 11:32:48 +0000 and there have been no reports since then. This leads me to believe that the spam is indeed from Nov 6 and that the EL server didn't deliver it to cox in a timely fashion., Link to comment Share on other sites More sharing options...
Wazoo Posted November 9, 2004 Share Posted November 9, 2004 Thank you Ellen. Link to comment Share on other sites More sharing options...
dhanna Posted November 10, 2004 Author Share Posted November 10, 2004 Yes, Thank you both. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.