Question about different versions of Outlook/express as indicated in the X-mailer line
I typically combine the following in a filter rule...
What application are you using to filter incoming mail, MM?
--
~PA Bear
Mail Man wrote:
Here's some recent examples.
In the past 2 days, I've gotten about a dozen spams with the following
versions of OE indicated on the X-Mailer line. I'm also listing the
first and last time I received a valid (good) e-mail with the same OE
version, as well as the cumulative number of spams in 2006 and 2007
with that OE version.
X-Mailer contains 5.50.4133.2400
last good = June 2004, first good = Jan 2001
26 spams 2007, 64 spams 2006
X-Mailer contains 6.00.2600.0000
last good = May 2006, first good = Feb 2002
36 spams 2007, 183 spams 2006
X-Mailer contains 6.00.2800.1106
last good = June 2007, first good = sept 2002
147 spams 2007, 139 spams 2006
X-Mailer contains 6.00.2800.1158
last good = june 2007, first good = July 2003
21 spams 2007, 129 spams 2006
I typically combine the following in a filter rule:
X-mailer is (or contains) X
X-MimeOLE is (or contains) Y
Content-Type contains Z
For example:
When X = Produced By Microsoft MimeOLE V6.00.2900.3028
When Y = Microsoft Outlook Express 6.00.2900.3028
When Z = multipart/related
Then the only e-mails I have that match the above 3 criteria are 78
spams, all received on or after April 2007.
The Content-Type rule (multipart/related) is very useful to
differentiate between good mail and spam when combined with rules for
specific OE versions.
|