[SpamCop-List] Re: spam is NOT 10 days old to me - got it this a.m.

[Mike Easter]

jg wrote:
www.spamcop.net/sc?id=z843137878z680ac484063db058a223f47733cded0bz
>
> SpamCop tells me this spam is from 12/7, as it says.
> whats spamee doing now, or could the system have lost it for 10 days??

We've seen this before, same kind of headers.

SC does a bad job of dating a spam if you are mailhosted.

  Abbreviated Received lines *comment
  from fed1rmgxi04.cox.net ([207.181.89.35]) by fed1rmmtai19.cox.net
*serves you
  from mail.business.allstream.net ([207.181.89.35]) by
fed1rmgxi04.cox.net *sourceline
  from mx1.georgegroup.com (host-052.arcese.com [207.245.14.52]) by
mail.business.allstream.net *bogusline, timestamp 10d
  from rkf.mt.com ([54.160.115.61]) by ksig.mt.com *bogusline

SC is able to figure out to not trust the allstream because you are
mailhosted, so it gets the source right, but it gets the timestamp
wrong.

"Sorry, this email is too old to file a spam report. "

If you run those headers with a non-mailhosted account, SC makes a
mistake and trusts the allstream MX [I thought the deputy had fixed that
MX to be untrusted] and parses back to the user IP behind the allstream
server [which we decided previously was wrong], but calls the timestamp
the topline, not one of those down-under lines.

http://www.spamcop.net/sc?id=z843144518zf19912699a09006fd180f20b88360363z

Message is 4 hours old

If reported today, reports would be sent to:
Re: 207.245.14.52 (Administrator of network where email originates)
abuse at allstream.com
securitysupport#allstream.com at devnull.spamcop.net



-- 
Mike Easter
kibitzer, not SC admin