Eu tenho uma conta que está sendo enviada por e-mail. Eu preciso criar um filtro para filtrar esses e-mails. O problema é que não entendo bem as informações do cabeçalho para criar o filtro. Todas as mensagens vêm de e-mails exclusivos - gmail, hotmail, yahoo, AOL, etc., portanto, não há filtragem de uso via endereço de e-mail. Estou tentando procurar algo comum a todos esses cabeçalhos de mensagens para criar um filtro. Aqui estão as informações do cabeçalho de 3 dos 3000 e-mails de spam que recebi nos últimos 3 dias. Alguém consegue identificar algo que eu possa usar para construir um filtro?
--------------------------------------------------------
Delivered-To: ********@gmail.com
Received: by 10.76.90.69 with SMTP id bu5csp178474oab;
Fri, 6 Mar 2015 17:02:41 -0800 (PST)
X-Received: by 10.107.36.9 with SMTP id k9mr32440746iok.2.1425690160928;
Fri, 06 Mar 2015 17:02:40 -0800 (PST)
Return-Path: <[email protected]>
Received: from nm39-vm5.bullet.mail.ne1.yahoo.com (nm39-vm5.bullet.mail.ne1.yahoo.com. [98.138.229.165])
by mx.google.com with ESMTPS id o9si3100428iga.7.2015.03.06.17.02.40
for <********@gmail.com>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Fri, 06 Mar 2015 17:02:40 -0800 (PST)
Received-SPF: none (google.com: [email protected] does not designate permitted sender hosts) client-ip=98.138.229.165;
Authentication-Results: mx.google.com;
spf=none (google.com: [email protected] does not designate permitted sender hosts) [email protected];
dkim=pass (test mode) [email protected]
Received: from [127.0.0.1] by nm39.bullet.mail.ne1.yahoo.com with NNFMP; 07 Mar 2015 01:02:40 -0000
Received: from [98.138.226.177] by nm39.bullet.mail.ne1.yahoo.com with NNFMP; 07 Mar 2015 00:59:40 -0000
Received: from [66.196.81.158] by tm12.bullet.mail.ne1.yahoo.com with NNFMP; 07 Mar 2015 00:59:40 -0000
Received: from [66.196.81.125] by tm4.access.bullet.mail.bf1.yahoo.com with NNFMP; 07 Mar 2015 00:59:40 -0000
Received: from [127.0.0.1] by omp1001.access.mail.bf1.yahoo.com with NNFMP; 07 Mar 2015 00:59:40 -0000
X-Yahoo-Newman-Property: ymail-4
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 81887 invoked by uid 60001); 7 Mar 2015 00:59:40 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bellsouth.net; s=s1024; t=1425689980; bh=2QEsUbhEXjMp9HJj5lauRvEDSiwZWDiZdKOut60hRNM=; h=Message-ID:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=lH2c0Y5mH8UsZgmJuIlMbJ7H8cJGCfolPu25tLLwI3H73UgcE56FaGW6mf5ohEti9nn9d+P5RgNGpKDNBdA/958rXRGAcK0fGwpcnzUF/bWq9abZMAw/F78p3sU7MzRRUmuV8ywhIFxidW1vQNZdpRCQXF8KE2so9p1tAR2uRMk=
X-YMail-OSG: YZWLYhIVM1lxREoZP6vknDC6tZRH6pb217VBzb_fm.EWd_y
p8i9kYAmc0yo_fbA.pMa9mmTfnO9dDP6nFV58YOD8Y4RCeYCRYFfVSOV8zU5
ItWoWzipsWBv3Z0h.aU8HhI1BDx3Rxbd4fTKJBU04nZi52PnEyeb1nqeAz7n
K3h2b5ultPCHRJ_htoPj0g_Hvuv_v019PyxYFeeRuJ3JqMP.vMV3ybOWADBT
MSiVQZJfMsOG00A0tWhCT9JHrtO6ZLduZv.RfuRRA5tyzlx0gwmZOa19iHtx
8As1RwzKeKAYJQ.RUQIhZmLMYQLGw.5ANNOSdD1Uvwux18UCswsH68kvqvAz
Ixdmo9L1t.jAtHZw1tjL7twNY5f79hXDK_x7NxkGq4Af56vDc.RODSRf6m8X
cAIB.z_FdyYArsm6_D5EgB3eWVUj0TONO0fH7XjO2dB5vuHsQewKO9p5pipU
1MFfQNC7Fm8mAUqgkm7qv2._du2r4bHuQhDYjEic97HGIB.RggzrtjWVTQTW
aOfoJR2CM8XTnjX4S7AdHIaHJkmxHsmbuQjCQu4Q_TlJ3ZJQK5excViK0uZX
gCibe0w1lJTxrKrq2ciw634FUjnJSPA--
Received: from [75.74.84.111] by web184305.mail.ne1.yahoo.com via HTTP; Fri, 06 Mar 2015 16:59:40 PST
X-Rocket-MIMEInfo: 002.001,U2VuZCBhIHBpYyBvZiB1ATABAQEB
X-Mailer: YahooMailMobile/0.0 YahooMailWebService/0.8.203.740
Message-ID: <[email protected]>
Date: Fri, 6 Mar 2015 16:59:40 -0800
From: rezendeconner <[email protected]>
Subject: Re: Hi want to meet me?
To: Rene <********@gmail.com>
In-Reply-To: <AA51E86CAC172F60427F871DF5A91B5A@fasupudu>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="1870516026-846306131-1425689980=:81754"
--1870516026-846306131-1425689980=:81754
Content-Type: text/plain; charset=us-ascii
Send a pic of u
--1870516026-846306131-1425689980=:81754
Content-Type: text/html; charset=us-ascii
<table cellspacing="0" cellpadding="0" border="0"><tr><td valign="top"><div>Send a pic of u</div></td></tr></table> <div id="_origMsg_">
<div>
<br />
<div>
<div style="font-size:0.9em">
<hr size="1">
<b>
<span style="font-weight:bold">From:</span>
</b>
Rene <[email protected]>; <br>
<b>
<span style="font-weight:bold">To:</span>
</b>
<[email protected]>; <br>
<b>
<span style="font-weight:bold">Subject:</span>
</b>
Hi want to meet me? <br>
<b>
<span style="font-weight:bold">Sent:</span>
</b>
Fri, Mar 6, 2015 10:33:28 AM <br>
</div>
<br>
<table cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td valign="top">Hey, how did it come about? <BR><BR><BR></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
--1870516026-846306131-1425689980=:81754--
-----------------------------------------------------------
Delivered-To: ********@gmail.com
Received: by 10.76.90.69 with SMTP id bu5csp183821oab;
Fri, 6 Mar 2015 17:18:37 -0800 (PST)
X-Received: by 10.70.128.49 with SMTP id nl17mr30264775pdb.67.1425691117308;
Fri, 06 Mar 2015 17:18:37 -0800 (PST)
Return-Path: <[email protected]>
Received: from nm4-vm3.bullet.mail.gq1.yahoo.com (nm4-vm3.bullet.mail.gq1.yahoo.com. [98.136.218.162])
by mx.google.com with ESMTPS id a11si15177164pbu.13.2015.03.06.17.18.36
for <********@gmail.com>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Fri, 06 Mar 2015 17:18:37 -0800 (PST)
Received-SPF: none (google.com: [email protected] does not designate permitted sender hosts) client-ip=98.136.218.162;
Authentication-Results: mx.google.com;
spf=none (google.com: [email protected] does not designate permitted sender hosts) [email protected];
dkim=pass [email protected];
dmarc=pass (p=NONE dis=NONE) header.from=rocketmail.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rocketmail.com; s=s2048; t=1425691116; bh=L3v2Au/JHdMYHdOl79shvjpux3mm2daWApjFe1GViLA=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From:Subject; b=ZCLySVzbLZBQes9WHz+CUUyzVLmKl5OyaYI4Fvnm2u8Es8lJyC7UT6SkOs6iSHrOft15E8LXNXMYPmvKEAQnPUVR16tV1PzJPrbmB9RZlcHSnXKifMjkVYAoSIKnl1BUXO68wfaz+KZu4DZykS+zMhtvVRMXZWCLR75mX6CxCJsyOzTNgUoILBLY2wg/Qc2UncmeWCvvXRlSozhZqCG7WdbeLmUId9ZT9pcI4BNUgawPqag0SmrQVQlIR7fD5Nl9gBBaKvZEXHfg8vUCY4H19o3Pu4VIb/2TMoDDpRioS5qSOGTUVaXaGSCn6JE3jP2PBr5XHsG3bD9h5GGtwMI2tQ==
Received: from [98.137.12.58] by nm4.bullet.mail.gq1.yahoo.com with NNFMP; 07 Mar 2015 01:18:36 -0000
Received: from [98.137.12.234] by tm3.bullet.mail.gq1.yahoo.com with NNFMP; 07 Mar 2015 01:18:36 -0000
Received: from [127.0.0.1] by omp1042.mail.gq1.yahoo.com with NNFMP; 07 Mar 2015 01:18:36 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
X-YMail-OSG: FGVQT6sVM1kw_opmqI7PXY4nz0aaNmwu2M0gk6gq5NIEo0yV5GnP7QcqgfpivbX
bGAMUrEd__ipRA4dqnmeJUz04KAoXVGVlj3v._1QZY5DylZ5Ejc3EeD5wnzdc0USRLLycu57ZPbn
vmIGq_PVImf1fp7hvdMNmYr.zrVh_uiVcpINTkcyp4lR_yMutWOXfjA7RPvjTWBgZyPogic_ta1n
9URQHAMZb7msyEoVZhspay3_oxQEOLZip59F1sU.rGZpkWvqPtVYAILWix.EDSmorQMuM3Y.b9Ac
ZzoMsIYXkpGf2v5IJokLTJYAPKGwg5AqAes_mFr.u1sjfCRDC1_envp545fgOJk37k2lE_WW9peG
cWG_s5genaVtxXKLaB1GqynDratMinAjvz9gaKNls8vFc4JqE_v8Ymle4qaoHfzdwdAjtgK80fjU
N0JDnDCBlHAeDijpv3W8HNdTKApibHDDfloCVeJpKHG_RvM8ZN6DLsOiynOvBzGWbWCPzsHwnkM.
iQan10Laev7Hck2ZdCWsJNmokc6e3M.FfCG784rnBrIRJXzw-
Received: by 98.138.105.192; Sat, 07 Mar 2015 01:18:35 +0000
Date: Sat, 7 Mar 2015 01:18:34 +0000 (UTC)
From: Franco Alvez <[email protected]>
Reply-To: Franco Alvez <[email protected]>
To: Kelley <********@gmail.com>, "[email protected]" <[email protected]>
Message-ID: <[email protected]>
In-Reply-To: <573E8F7AB2FB71FC330398D7F15141BB@duxici>
References: <573E8F7AB2FB71FC330398D7F15141BB@duxici>
Subject: Re: Hi
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_20414_403664770.1425691115001"
Content-Length: 1452
------=_Part_20414_403664770.1425691115001
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
hello! good.. and you?=20
El Viernes, 6 de marzo, 2015 6:30:42, Kelley <[email protected]> es=
cribi=C3=B3:
=20
Hello:) hope all is well, how's things?
------=_Part_20414_403664770.1425691115001
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html><body><div style=3D"color:#000; background-color:#fff; font-family:He=
lveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;fo=
nt-size:12px"><div dir=3D"ltr" id=3D"yui_3_16_0_1_1425690165883_12566"><spa=
n id=3D"yui_3_16_0_1_1425690165883_12565">hello! good.. and you?</span></di=
v> <div class=3D"qtdSeparateBR"><br><br></div><div class=3D"yahoo_quoted" s=
tyle=3D"display: block;"> <div style=3D"font-family: HelveticaNeue, Helveti=
ca Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12px;"> <d=
iv style=3D"font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, L=
ucida Grande, sans-serif; font-size: 16px;"> <div dir=3D"ltr"> <font size=
=3D"2" face=3D"Arial"> El Viernes, 6 de marzo, 2015 6:30:42, Kelley <jwg=
@bgpublishing.com> escribi=C3=B3:<br> </font> </div> <br><br> <div clas=
s=3D"y_msg_container">Hello:) hope all is well, how's things?<br><br><br><b=
r><br></div> </div> </div> </div> </div></body></html>
------=_Part_20414_403664770.1425691115001--
---------------------------------------------
Delivered-To: ********@gmail.com
Received: by 10.76.90.69 with SMTP id bu5csp159993oab;
Fri, 6 Mar 2015 16:04:14 -0800 (PST)
X-Received: by 10.180.19.73 with SMTP id c9mr59239280wie.10.1425686653860;
Fri, 06 Mar 2015 16:04:13 -0800 (PST)
Return-Path: <[email protected]>
Received: from DUB004-OMC3S20.hotmail.com (dub004-omc3s20.hotmail.com. [157.55.2.29])
by mx.google.com with ESMTPS id fd10si22144064wjc.16.2015.03.06.16.04.12
for <********@gmail.com>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Fri, 06 Mar 2015 16:04:13 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 157.55.2.29 as permitted sender) client-ip=157.55.2.29;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 157.55.2.29 as permitted sender) [email protected]
Received: from DUB405-EAS331 ([157.55.2.8]) by DUB004-OMC3S20.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22751);
Fri, 6 Mar 2015 16:04:12 -0800
X-TMN: [/3x3iR+BQZsKPJOOCJ9fJg8xkbh2YGQw]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Subject: Re: Hola! how so?
References: <48CE7952D547763A56DB90A8C28A2FE4@hahutyq>
From: wayne shephard <[email protected]>
In-Reply-To: <48CE7952D547763A56DB90A8C28A2FE4@hahutyq>
Date: Sat, 7 Mar 2015 00:04:13 +0000
To: Belle <********@gmail.com>
MIME-Version: 1.0 (1.0)
X-OriginalArrivalTime: 07 Mar 2015 00:04:12.0758 (UTC) FILETIME=[3E3B0F60:01D0586A]
Why not
Sent from my iPhone
> On 6 Mar 2015, at 2:00 am, Belle <[email protected]> wrote:
>
> Hello there want to see me?
>
>