Re: DATE_IN_FUTURE_24_48 more often?
Matus UHLAR - fantomas <[email protected]>
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <[email protected]> |
>> >> > > I think I am starting to see this more often. Today I was >> >> > > checking again every server to see if the ntp time is syncing >> >> > > properly. But don't notice anything weird, can't really believe >> >> > > this sending had a bad clock. Can anyone suggest what/where to >> >> > > look for? >> >> > > >> >> > > >> >> > > DATE_IN_FUTURE_24_48 Date: is 24 to 48 hours after >> >> > >> >> > When you looked at the Date: header, what did it say? The part of >> >> > your question where you gave an example didn't make it through the >> >> > mailinglist! >> >> >> >> I was wondering if I am the only one seeing this. Could also be >> >> related to my transitioning to el9. I can remember having to change >> >> some scripts for time/timezone. Logged times seem ok: >> >> >> >> mta logging was on this date: Jul 4 08:51:37 >> >> message header Date: Thu, 4 Jul 2024 08:51:35 +0200 >> >> message header Received: xxxx Thu, 4 Jul 2024 08:51:37 +0200 >> >> >This does not look like something out of the ordinary not? Even if it is >> >a timezone/summertime issue it is still not 'is 24 to 48 hours after' >> >> This looks correctly. >> I remember seeing this issue when users put incorrect date or incorrect >> timezone. On 25.07.24 20:57, Marc wrote: >Incorrect date on the Windows / MacOS will trigger this? yes. Date in future will move time 24 hours into the future, or multiple times (48,72,94). incorrect time zone may push time few hours forwards or backwards. (here it happens when people set the time to current, while keeping american timezone) Together it may generate different hour shifts. >> Do those still appear? > >Looks like it is still a low %, except this T_DATE_IN_FUTURE_96_Q > > DATE_IN_FUTURE_03_06 >0.1% DATE_IN_FUTURE_12_24 >0.1% DATE_IN_FUTURE_06_12 > 31% T_DATE_IN_FUTURE_96_Q I believe I don't have to explain how spammers use(d) this to show their mail first in their MUAs -- Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Honk if you love peace and quiet.