Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Outlook express filter question

Jun 9, 2005 7:14AM PDT

Can anyone tell me how Outlook express gets a positive hit using this rule:
======
Where the from line contains:
suntrust or charterone.com or citizensbank.com or wamu.com or regions.com or key.com or southtrust.com or charteronebank.com

or

Where the subject line contains:
'Please confirm your account' or 'Your details have been compromised' or 'account suspend in progress' or 'KEY-Security Alert'

or

where the message body contains:
'confirm your account' or 'access to buy or sell on eBay will be restricted'

move it to the Spoofs folder
and stop processing more rules
===

and this is the email that was sent to the Spoofs folder (In this source listing I only changed our actual location to myco.com and the email addresses to user#@myco.com, and the SMPT id in case that identifies us. THis is at work so I don't want to give out anything that could come back to haunt me. :-0 )

-----------
Return-Path: <garyrubal@spankthedonkey.com>
Received: from spankthedonkey.com ([222.65.57.24])
by myco.com (8.11.6/8.11.6) with SMTP id T471ZZYS4251;
Mon, 6 Jun 2005 23:20:21 -0400
Message-ID: <b33e01c093e8$75afb8c0$fe039202@garyrubal>
From: ''cordelia fields'' <garyrubal@spankthedonkey.com>
To: ''''elouise banks'' leonid@linkfive.com'' <user1@myco.com>
Cc: <user2@myco.com>, <user3@myco.com>
Subject: become the man that women desire
Date: Sun, 11 Feb 2001 05:06:58 -0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=''----=_NextPart_367_6C5F_0DB040B6.435A8FB7''
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Status:

This is a multi-part message in MIME format.

------=_NextPart_367_6C5F_0DB040B6.435A8FB7
Content-Type: text/plain;
charset=''us-ascii''
Content-Transfer-Encoding: quoted-printable


------=_NextPart_367_6C5F_0DB040B6.435A8FB7
Content-Type: text/html;
charset=''us-ascii''
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC ''-//W3C//DTD HTML 4.0 Transitional//EN''>
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D''text/html; charset=3Dus-asci=
i''>
<META content=3D''MSHTML 5.50.4133.2400'' name=3DGENERATOR>
<STYLE></STYLE>
</HEAD><FONT face=3DArial><FONT size=3D2>
<BODY>
<DIV>

</DIV></BODY></HTML></FONT></FONT>

------=_NextPart_367_6C5F_0DB040B6.435A8FB7--

--------------------------------------------

I see nothing in this email that would trigger the filter. Similar things have happened in the past with other filters.

Any ideas? This is OE 6 on Win XP home.

Discussion is locked