lewisstraughn Posted September 2, 2007 Share Posted September 2, 2007 I am getting a new error message that just started since the end of Aug. When the 1st of September came along, I started getting this error when reporting: Can't parse date of spam for age detection: , 33 Aug 2007 15:23:53 +0900 Notice the date is 33 Aug. I got 32 Aug yesterday. I am not doing anything different than I have in the past and all of a sudden it is rolling the date and not changing over the month. Here is the header of the email I was reporting: Subject: Choose a reliable source for your meds. Content-Type: multipart/alternative;boundary="----=_NextPart_000_0006_0107FFA4.0107FE0C" Return-Path: <dwsiskindsm[at]siskinds.com> Mime-Version: 1.0 To: <lewisstraughn[at]netscape.com> From: "Terence Yeager" <dwsiskindsm[at]siskinds.com> X-Mimeole: Produced By Microsoft MimeOLE V6.00.2900.2670 Thread-Index: Aca6QZ9O5PVE1AOXGMYR004SJMJTX4== X-Eon-DM: dm27 Date: , 33 Aug 2007 15:23:53 +0900 Message-Id: <0107ffa4$0107fe78$f66656dc[at]dwsiskindsm> X-Mailer: Microsoft Office Outlook, Build 11.0.6353 Received: from [220.86.102.246] (220.86.102.246 [220.86.102.246])by dm27.mta.everyone.net (EON-INBOUND) with ESMTP id dm27.46d7aa17.8eaacafor <lewisstraughn[at]netscape.com>; Sat, 1 Sep 2007 23:23:40 -0700 from [220.86.102.246] by siskinds.com.s8b1.psmtp.com; , 33 Aug 2007 15:23:53 +0900 I see this date in the last line of the header. How is it getting there and what can i do to correct the problem? Thanks for your help, Lewis Link to comment Share on other sites More sharing options...
Wazoo Posted September 2, 2007 Share Posted September 2, 2007 Posted into the Foruim section; SpamCop Discussion > Discussions & Observations > How to use .... Instructions, Tutorials > SpamCop Forum Usual question rarely answered is "Why?" With this post, this Topic wil be moved to the Reporting Help Forum section. The 'problem' ... does 'any' e-mail arrive with a 'correct' Date: line content? Initial question is based on whether your ISP's server is generating this totally screwed up line or if it is coming from an absolutely braindead spammer/spammer-tool .... Link to comment Share on other sites More sharing options...
C2H5OH Posted September 3, 2007 Share Posted September 3, 2007 Posted into the Foruim section; SpamCop Discussion > Discussions & Observations > How to use .... Instructions, Tutorials > SpamCop Forum Usual question rarely answered is "Why?" With this post, this Topic wil be moved to the Reporting Help Forum section. The 'problem' ... does 'any' e-mail arrive with a 'correct' Date: line content? Initial question is based on whether your ISP's server is generating this totally screwed up line or if it is coming from an absolutely braindead spammer/spammer-tool .... I think it's the latter. I too have received many like that recently. Look at http://www.spamcop.net/sc?id=z1417512022z2...83dd83ad98d0c0z You'll see that the header has the line; "Date: Wed, 1 Aug 1934 01:45:17 +0100" Spamcop reports; "Can't parse date of spam for age detection: Sat, 34 Aug 2005 03:45:17 +0300" - Maybe not brain dead then, rather they've found another way to confound SpamCop? HTH Link to comment Share on other sites More sharing options...
Wazoo Posted September 3, 2007 Share Posted September 3, 2007 Thanls for providing a Tracking URL .... several 'issues' are now up for discussion ... You are focusing on the "Date:" line ... although assumedly somewhat connected, this line does not 'exist' as far as the Parsing code is concerned. What is at issue is the Received: lines, specifically the line: Received: from [88.84.200.45] by apollo.aristotle.net; Sat, 34 Aug 2005 03:45:17 +0300 Now, the 'bad' part ... the Reporting from a MailHost Configured Reporting Account uses a bit of different code than the non-MailHosted parsing .... http://www.spamcop.net/sc?id=z1417600335z3...e78ea32475114ez .... note the difference in results. This has been pointed out for a long time, but ... no response or insight ever provided .... 'regular' parse uses the Date/Time from the topmost vaild Received: line. MailHost Configured parse seems to want to use the bottom-most 'valid' Received: line for Date/Time. I'll kick another notice upstream again .... From: "Wazoo" To: "SpamCop Deputies" Subject: MailHost Configured account - bad date string in headers Date: Mon, 3 Sep 2007 13:32:34 -0500 http://forum.spamcop.net/forums/index.php?showtopic=8659 Issue once again is the parsing and usage of Date/Time stamps found in the headers and the handling differences between a MailHost Configured account and one that's not. Ancient news, yet ... status still unknown as to a 'fix' ....???? MailHost Configured Tracking URL; http://www.spamcop.net/sc?id=z1417512022z2...83dd83ad98d0c0z non-MailHost Configured Tracking URL; http://www.spamcop.net/sc?id=z1417600335z3...e78ea32475114ez Bad header line; Received: from [88.84.200.45] by apollo.aristotle.net; Sat, 34 Aug 2005 03:45:17 +0300 Link to comment Share on other sites More sharing options...
C2H5OH Posted September 5, 2007 Share Posted September 5, 2007 Thanls for providing a Tracking URL .... several 'issues' are now up for discussion ... SNIP I'll kick another notice upstream again .... These are coming thick and fast now. It does look as if someone is using it as a way to reduce the number of SpamCop reports. I suppose that's sort of flattering for SpamCop - if damned annoying! 36th August seems to be a recurring date.... Link to comment Share on other sites More sharing options...
Wazoo Posted September 5, 2007 Share Posted September 5, 2007 No reply from 'above' so .... if you want to report these, a non_MailHost Configured Reporting Account does seem to work ... about all I can say ... Link to comment Share on other sites More sharing options...
lewisstraughn Posted September 5, 2007 Author Share Posted September 5, 2007 Hey Wazoo, what do you mean by a "a non_MailHost Configured Reporting Account"? Link to comment Share on other sites More sharing options...
Wazoo Posted September 5, 2007 Share Posted September 5, 2007 Hey Wazoo, what do you mean by a "a non_MailHost Configured Reporting Account"? Sorry, but I find that question very confusing. You have not provided a Tracking URL, but .. based on your original complaint and analysis performed and documented from another user's provided data, it has to be assumed that you in fact went through the process to MailHost Configure your Reporting Account. A non-MailHost Configured account would be a Reporting account to which this process had not been applied. There is a Forum section 'here'; Mailhost Configuration of your Reporting Account Minimize self-reporting accidents by identifying your e-mail host(s) to the Parser. Required for Quick-Reporting. The SpamCop FAQ has a section under the Parsing & Reporting section; How do I configure Mailhosts for SpamCop? -----> Mailhost System Configuration Explanation -----> MailHost Configuration Problems FAQ started -----> Mailhosts Typical Questions A less technical version -----> One version of a Step-by-step MailHost set-up -----> "Sorry, confirmation codes do not match:" - Why? -----> MailHostConfiguration - Wiki Version As seen in that last entry, there is data available in the Wiki. Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted September 6, 2007 Share Posted September 6, 2007 I am getting a new error message that just started since the end of Aug. When the 1st of September came along, I started getting this error when reporting: Can't parse date of spam for age detection: , 33 Aug 2007 15:23:53 +0900 My understanding of the situation is that your ISP, or their provider, was having network problems that resulted in all sorts of goofy headers and other problems. I hear that the problems have been fixed and things are back to normal now. If you're still having problems, please write to me directly at service[at]admin.spamcop.net and send the "TRACKING URL" from the top of the SpamCop page when you get the error. - Don D'Minion - SpamCop Admin - Link to comment Share on other sites More sharing options...
lewisstraughn Posted September 7, 2007 Author Share Posted September 7, 2007 My understanding of the situation is that your ISP, or their provider, was having network problems that resulted in all sorts of goofy headers and other problems. I hear that the problems have been fixed and things are back to normal now. If you're still having problems, please write to me directly at service[at]admin.spamcop.net and send the "TRACKING URL" from the top of the SpamCop page when you get the error. Don, I sent you a private email about this problem as you requested to service[at]admin.spamcop.net The tracking information is also here in case I got the email address wrong. Thanks again for all your help. SpamCop v 640 Copyright © 1998-2006, IronPort Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z1421319152z4...1000dab16f4656z Can't parse date of spam for age detection: Tue, 35 Aug 2007 26:54:17 +0800 Link to comment Share on other sites More sharing options...
StevenUnderwood Posted September 7, 2007 Share Posted September 7, 2007 SpamCop v 640 Copyright © 1998-2006, IronPort Systems, Inc. All rights reserved. Here is your TRACKING URL - it may be saved for future reference: http://www.spamcop.net/sc?id=z1421319152z4...1000dab16f4656z Can't parse date of spam for age detection: Tue, 35 Aug 2007 26:54:17 +0800 That tracking link looks like you used the webmail "Show all headers" view rather than the "Message source" view as the second received line is missing the "Received:" header. That view does not produce a parsable result. Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted September 7, 2007 Share Posted September 7, 2007 That tracking link looks like you used the webmail "Show all headers" view rather than the "Message source" view as the second received line is missing the "Received:" header. That view does not produce a parsable result. I agree that the headers are hosed, but I don't see any cesmail.net servers in them, so I don't think they were taken from the SpamCop Email Service webmail interface. - Don - Link to comment Share on other sites More sharing options...
C2H5OH Posted September 11, 2007 Share Posted September 11, 2007 Just for information, I'm still seeing these things... http://www.spamcop.net/sc?id=z1425998881ze...cb7c05ee7236dfz SpamCop tells me this spam is too old. The oldest received line has the date Tue, 11 Sep 2007 07:53:57 +0000 ( - probably about right) The more recent received line has Mon, 31 Dec 2001 23:14:29 +0100 (faked) Spammer's accident or design?? Link to comment Share on other sites More sharing options...
Farelf Posted September 11, 2007 Share Posted September 11, 2007 ...Spammer's accident or design??No, there's something wrong with the parse. Here's what happens with no mailhosts when that spam is parsed: http://www.spamcop.net/sc?id=z1426042163z8...18d3bd7149c16fz I wonder if you should clear you mailhosts and start again? The problem may not be there but I guess it is a little more likely than the parser being kaput. Unfortunately I have no more time right now to look more carefully, hopefully someone else can pick up the thread shortly. [edit] Just enough time to note yes, maybe it is the parser. Non-mailhosted handles dates a little differently (goes by top line) and, though this parse agrees with yours on the source, it is not affected by the obvious bad date line. Link to comment Share on other sites More sharing options...
Wazoo Posted September 11, 2007 Share Posted September 11, 2007 SpamCop tells me this spam is too old. The oldest received line has the date Tue, 11 Sep 2007 07:53:57 +0000 ( - probably about right) The more recent received line has Mon, 31 Dec 2001 23:14:29 +0100 (faked) Spammer's accident or design?? Actually answered way back in my Linear Posts #4 and #6 in this Topic. Farelf's last replies were to repeat the same problem, pointing to the same 'solution' .... I received no reply from my e-mail to Deputies about the parser issue, but Don then did make a visit here with the suggestion for the Topic starter to take things private .... I don't see the date/time-stamping issues as being the same between your samples and the Topic starter's .... but if you don't like the answers suggested 'here' ... Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.