How to filter by the format of an email address

Status
Not open for further replies.
G

Gary Bouchard

Member
Outlook version
Outlook 2010 32 bit
Email Account
IMAP
Help Please:

I have started receiving messages daily from some spammer using a Yahoo.com domain email address.

I added the senders to the Junk Senders list, however the next one that comes in has a different email address but in similar format to the previous messages. I want to create a rule filter, but not sure how to filter the message without blocking the entire @yahoo.com domain.

Here is the From line in the message header;
From: AAG Reverse Mortgage =?UTF-8?B?44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA?= AAG-Reverse-Mortgage-487030-aholu @ yahoo.com <taneshacarsen4554@yahoo.com>

Each time I receive a message, the email sender name is different, however the format you see above is the only similarity I can find, where there is a space between the sender name, the @ sign, and the sender domain. Most times there are also dashes as above but I am not sure if this is EVERY time. The only consistent format seems to be the spaces.

What do I need to do to build a rule that will check for these spaces so I can move it to the Spam folder? It would probably need to use a wildcard pattern to ignore the sender name and look more at the format.

I have attached a copy of the header from the messages I would like to filter.

I have been looking at the message headers to compare them and also compare a legit email from that domain but dont see any other data I could use to create a filter.

Any help is appreciated.
 

Attachments

  • yahoo sample.txt
    4.1 KB · Views: 584
I have now started receiving basically the same spam, however now the headers are quite a bit smaller... here are 2 I received a short time ago. Does anyone see any detail I could use to create a rule?
 

Attachments

  • yahoo sample short header 2.txt
    982 bytes · Views: 564
  • yahoo sample short header.txt
    914 bytes · Views: 557
Does anything in the return path match? such as the bolded part?
Return-Path: aagreversemortgage=?utf-8?b?44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca?=aag-reverse-mortgage-487030-aholu@yahoo.com

or something in this from line?
From: AAG Reverse Mortgage =?UTF-8?B?44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA?= AAG-Reverse-Mortgage-487030-aholu @

if there is something that always matches, you can use a words in the header rule to get it. If you aren't applying for a reverse mortgage, i would definitely create a words in the header rule looking for the words reverse mortgage or reverse-mortgage (use both words/phrases). It should be case insensitive so you only need a lower case entry for each. Of course, if you do apply for a reverse mortgage and the lender sends you info with reverse mortgage in the subject, it will be filtered. :)
 
Do all of the header have these lines with an outlook version in the 70's ? If so, add X-Mailer: Microsoft Office Outlook 7 to the words in the header rule. You can add one for each number except 1 - current versions are begin with 1.
X-Mailer: Microsoft Office Outlook 79.5
X-Mailer: Microsoft Office Outlook 77.4

Version 7 is non-existent, Outlook 97 was 8, current versions are 10 - 16 (going back to O'2003).
 
I will check the headers when I receive additional messages. I am sure I will probably receive a couple within the next few days.
 
Gary Bouchard said:
I will check the headers when I receive additional messages. I am sure I will probably receive a couple within the next few days.
Click to expand...

No, they have different versions. Here is one I received this morning;
____________________________________________________________________________________
Return-Path: cognitioncoalition=?utf-8?b?44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca44ca?=cognition-coalition-731992-icrcr@yahoo.com
Received: from resimta-ch2-04v.sys.comcast.net (LHLO
resimta-ch2-04v.sys.comcast.net) (69.252.207.4) by
resmail-po-634v.sys.comcast.net with LMTP; Fri, 13 Jan 2017 23:05:37 +0000
(UTC)
Received: from nm44-vm2.bullet.mail.gq1.yahoo.com ([67.195.87.25])
by resimta-ch2-04v.sys.comcast.net with SMTP
id SAsfcpC0hiuvZSAshcbS1C; Fri, 13 Jan 2017 23:03:37 +0000
X-CAA-SPAM: 00000
X-Authority-Analysis: v=2.2 cv=BKvDlBYG c=1 sm=1 tr=0
a=I0c04vcRiM3M/1Tor3expQ==:117 a=9cW_t1CCXrUA:10 a=vKBXlhZ1L6AA:10
a=UT9jF2a8XKIA:10 a=5HJ6KZJP-kkA:10 a=khwyK8DuSVkA:10 a=IgFoBzBjUZAA:10
a=ZZnuYtJkoWoA:10 a=d62IhqzNWIWxWktNWmgA:9 a=KqD8eiGyAAAA:20
a=wPrdy221AAAA:20 a=-uQ9PtrzAAAA:20 a=tclcd6dtLQvEqt9_mmAA:9
a=QEXdDO2ut3YA:10 a=smI1EDWp-cMA:10 a=mIZAYAGWusQA:10 a=QAMdtrwfbWwA:10
a=y_7suqkejHQA:10 a=deU_LNVfmHIA:10 a=gW4sBiH6o7YA:10
a=O6KejYoQzHDjKbUhH1IA:9 a=DIyJOsdSk80A:10
X-Xfinity-Message-Heuristics: IPv6:N;TLS=1;SPF=1;DMARC=P
Authentication-Results: resimta-ch2-04v.sys.comcast.net;
dkim=pass header.d=yahoo.com header.b=Q0PpxSUq;
dkim=pass header.d=yahoo.com header.b=tYCyA0NT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1484348613; bh=iMKCq42yE+BJv4qOVah78f7atTE43Z2kEkmB9UJgxiU=; h=Cc:From:Date:Subject:From:Subject; b=Q0PpxSUqNMhMfFvOSExJLwqaT0SefekpObMt7NYwXFHMXvLoqyoX1CLErrr2q/j7zTNQgNUYPO3k7sfMZer3qI0/iZ1UB+T1J9HNjQ1A9MThZjIKB/KXnrfkv573iSMGpzz3Dg5jHFBTkCSzLHa5yfSmrG0HHkDPChPXVjQq8EgQaayXDthr6oyju18ngnC7xyF9BbVKIxNae84c84zB3UPX88pCe/9R5XfQojF51wX8g8slYK0KInnH//UULU5pua5xjuYt5VojA1aj9wpMQ+SOkHhBthGv0afD3MmeM2kKGat6s8FsP8S8Err+3SjLkyOOuSdzK4JqewwwdXr0vA==
Received: from [127.0.0.1] by nm44.bullet.mail.gq1.yahoo.com with NNFMP; 13 Jan 2017 23:03:33 -0000
Received: from [98.137.12.63] by nm44.bullet.mail.gq1.yahoo.com with NNFMP; 13 Jan 2017 23:00:41 -0000
Received: from [98.137.12.205] by tm8.bullet.mail.gq1.yahoo.com with NNFMP; 13 Jan 2017 23:00:41 -0000
Received: from [127.0.0.1] by omp1013.mail.gq1.yahoo.com with NNFMP; 13 Jan 2017 23:00:41 -0000
X-Yahoo-Newman-Id: 617496.48274.bm@omp1013.mail.gq1.yahoo.com
Received: (qmail 70196 invoked from network); 13 Jan 2017 23:00:41 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1484348441; bh=iMKCq42yE+BJv4qOVah78f7atTE43Z2kEkmB9UJgxiU=; h=Cc:Message-ID:From:Date:Subject:Content-Type:MIME-Version; b=tYCyA0NTaBeSKfxs7Fbi1ud/KfCtWtXnQPBIS/+9LbI4/xiQJPWM1Yf2kDLMTgCzgCYsTZ0RVHqSC6PZprLzBQkJLPdx7FijHU6LwGwo2ARgvfLvgWQnsZrtXrWMsXECl3HnLKxKkG5PlNRaiWvdolLDdNVo2OvRb5E57WpdHaQ=
Cc: recipient list not shown: ;
Message-ID: <394884.17316.qm@smtp227.mail.gq1.yahoo.com>
X-Yahoo-Newman-Property: ymail-4
X-YMail-OSG: G8La7KsVM1kqnXdedhLDW1TSCUIdlrvNoInoxYrOOWcm36S
a0B5cPft3bG_154zFNftoxnQJiSvYvyZ37VFbiPeHLjWGCenLg4ZGFEuZecG
e3I0OVLq76ABTF5qbSZWoj7tU9.pMUEvmSWaOSbCbihq8at5AJeHgGs51urZ
.q.g0UiDymwPpB0m_u2DpMsJt6y0cm7S.kTgcw1BEqwdszeC4CDpe3Bx93Qv
FNYLULbU6vN_wbjKc66yiBJhGVmnSIOHHSbWYEtw.VJiC0lSOYaZ3Bq7I1fD
ani4zlBmGNdubfDAHY8_tbqMs_cneSH3cI3eu_IUPYIkMn0pO_xj5QtGdSvS
v00U1YNQYqdDfFqD80t9mgL9GZZNJnbtjF4CjnGrOxxTLp4hYK1m7AeEtRAo
Id8Sv9KKU6ndi8Uh5Eazt4oIK7itCdOG8Z4qRIbSbYZ1HcY.eXmUxFDfDfT6
cUXxqvJZBxt9RZ3z6OQHBu8xsc7cykrDg13CUXprR5q3yyjgdJ9osIGrtR5L
6xRNRJYs6Lqs7YJFFOb8bRfOACNiPw9fJ5U0bpWmfi5qXReiFzXmTB8JNvSm
yf565KGoKrd3aD1.1fFI0
X-Yahoo-SMTP: hpIAgDmswBDPSnIaCxqys21PeCI6ADbWCseAY5ztKaLHXT3VXVT8pcpQyHZm6hUA4gALMqI-
Received: by b4cd9c70ac.61f565e70c id hf5e1g1a5c42; Fri, 13 Jan 2017 15:00:32 -0800 (envelope-from <candytuten1758@yahoo.com>)
From: CognitionCoalition =?UTF-8?B?44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA44CA?= Cognition-Coalition-731992-icrcr@yahoo.com <candytuten1758@yahoo.com>
Date: Fri, 13 Jan 2017 23:00:31 +0000
Subject: This Scientific Breakthrough Stops Alzheimer's In Days? (5DGNS5)
X-Mailer: Microsoft Office Outlook 87.2
X-Originating-IP: [96.247.160.159]
X-Notification: XGCEOg6xt6f26bK9ns1H4upNva
Content-Language: en-US
Content-Type: multipart/related; boundary="--_Q7214R514K6_A"
Thread-Index: SWF1NXJia292U21ldXYvdVA2dG5FdFhYZ3UwaFB2UGNJNA==
X-repaqua: ggesbjeievwnifkno
MIME-Version: 1.0
X-CMAE-Envelope: MS4wfI3TDMG5I+nW5n63VjhfRo7JBTqfcInYQfYTs+igxg8N36kvJgvUcqiBQYMbuplUEIWxKSgYDNRIKYPTWerYswBAwntHhVCdwkQTCpTTB1XwD8i4lk8u
WaBzC6hXd730cm22s5dFubAMUJtUNNNFqFAG8pwgRNUtJ8qt6D4Jfl4uUYcBvikOqks4Cyyy5WcsHLWITH5vBTl0IaAFCjrB2yD+7op+A6C1pRqmx40nlCwY
v5RvlLslFBBQco6NX/5XL5SQUxsSmixbnG5IKqrnI3xSFoaZ3PE+VrfLBJ78uM5853puDBsp2DeZyjFcQPGolOvdh0il3f8aLz17T+/LHZvdF5GJdXDMtcIO
ZzgshOsp
______________________________________________________________________________________
 
I am still receiving the messages. The only common data I can determine is that they are using dashes in between the words for the spoofed email address, aside from what I mentioned above.
 
Status
Not open for further replies.
< Business Contact Manager | Skype contact icons have disappeared at the bottom of email and meeting objects >
Similar threads
Thread starter Title Forum Replies Date
R unable to filter tasks when start date is on or before today Using Outlook 3
O Filter-Query Builder-Description - what field name to use? Using Outlook 4
W Macro to Filter Based on Latest Email Outlook VBA and Custom Forms 6
P Prevent Outlook 2016 from using DASL filter Using Outlook 4
Jennifer Murphy Spam filter not working Using Outlook 13
Y Filter unread emails in a search folder vba help Outlook VBA and Custom Forms 0
M How create a Rule to filter sender's email with more that one @ sign Using Outlook 1
M Sorting by Day in Date Column Advanced Filter BCM (Business Contact Manager) 1
Z Task Filter Not Working When I add too many criteria Using Outlook 0
M Filter Conversations - Filter Out Single Emails Outlook VBA and Custom Forms 3
B Looking to filter (or just find/search) for only messages that the sender has sent more than 1 messa Using Outlook 2
B Wanting to run a script that will filter any body that has a russian link in it. Outlook VBA and Custom Forms 5
C Filter/Search emails sent to internal Exchange address only Using Outlook 2
e_a_g_l_e_p_i Is there a good third party SPAM filter that intergrates with Outlook 2010 Using Outlook 7
P How to filter primary contacts in business contact manager BCM (Business Contact Manager) 0
O Outlook Web Access - how to disable spam filter Using Outlook 6
S Mail filter recieved before the last 2 working days Using Outlook 1
Liza Creating a rule in outlook to filter messages Using Outlook 0
F Adding textbox filter to listbox? Outlook VBA and Custom Forms 2
Diane Poremsky Filter and Save Contacts to a CSV File Using Outlook 0
Diane Poremsky Filter and Save Contacts to a CSV File Using Outlook 0
Fozzie Bear HomeTab Email filter "Greyed Out" in Outlook 2013 Exchange Server Administration 3
W Filter condition "contains"/"doesn't contain" doesn't always work Using Outlook 10
B Conditional Formatting:How to use >1 value in a filter Using Outlook 7
J Outlook VBA for Email Filter Outlook VBA and Custom Forms 2
Emerogork How do I set up an "Incoming mail filter" Using Outlook 12
M Filter today's mail Using Outlook 2
M trying to disable junk email filter. completely. Using Outlook 4
J Task Filter for Status OR One Month Using Outlook 4
R Filter Views by Category Using Outlook 2
D Junk Mail filter Using Outlook 1
S Filter by accounts but communicate to all linked contacts BCM (Business Contact Manager) 1
D What is this SQL filter that is applied to my Inbox? Using Outlook 6
J Outlook Contacts: How to filter contact phone numbers from a cti request Using Outlook 1
H Two accounts, Junk email filter only works on one account, office 2010, pop3 Using Outlook 5
D How Would I Write This Filter? Using Outlook 3
N Filter end date works differently in OL'07/OL'10 vs OL'03? Hello?! Using Outlook 12
williamlambton Filter which removes Display Names from incoming emails. Using Outlook 2
J How to filter by address fragment (e.g. "@domain.com") with advanced find? Using Outlook 2
L Need a good email filter Using Outlook 2
P BCM Review & Filter BCM (Business Contact Manager) 1
M DASL Filter function? Outlook VBA and Custom Forms 3
M DASL Filter function? Outlook VBA and Custom Forms 3
M Today(S) function in DASL Filter Outlook VBA and Custom Forms 1
M Today(S) function in DASL Filter Outlook VBA and Custom Forms 1
M Create search folder filter that converts UTC time to local? Outlook VBA and Custom Forms 9
E DASL Filter doesn't work when defined programatically Outlook VBA and Custom Forms 1
H Outlook 2007 SQL syntax to filter views of tasks and todo items Outlook VBA and Custom Forms 1
K Can I filter by fields 'containing' specific words? BCM (Business Contact Manager) 1
P Custom rule to filter on sender name Outlook VBA and Custom Forms 5

Similar threads

Back
Top