{"success":true,"data":{"id":"received-header-timestamp-gap","label":"Large gap between Received: header timestamps (relay delay)","description":"The gap between two consecutive Received: header timestamps exceeds 2 hours. Legitimate email flows through mail servers in seconds to minutes — a relay delay of 2+ hours between hops indicates a queued botnet sending node, a spam staging server, or a deliberate timing manipulation to confuse analysis tools. The timestamps are extracted from the semicolon-delimited date fragment of each Received: hop (e.g. \"; Tue, 14 Apr 2026 12:00:00 +0000\"), sorted oldest-first, and the maximum consecutive gap is compared against the 2-hour threshold. Requires at least 2 parseable timestamps; malformed or absent Received: headers silently skip. Score: +2 trash.","tier":"danger","category":"header","isThin":false}}