Identify Parts Of An Email

[hlewton]

I have looked up and tried to identify parts of an Outlook email to create a rule to block McAffee. I created quite a few yet have been unsuccessful in doing so. Please see the attachment and tell me what is the part of an email I should use to block what is inside the red box. This email has not been opened, it is in the Inbox.

Email.jpg

[HansV]

Does the word McAffee or McAfee occur in the full subject, or in the body of the messages?

[hlewton]

Does the word McAffee or McAfee occur in the full subject, or in the body of the messages?

Not that I see. Usually there is a link to click but I never click it. This time here is what it looks like when I open it.

McAffee.jpg

[HansV]

Do these messages always have "SubScription_Expired" in the subject? If so, you could check for that:

S2461.png

[hlewton]

Do these messages always have "SubScription_Expired" in the subject? If so, you could check for that:


S2461.png

No it doesn't. The only thing that, I believe, they all have if the word McAffee, a misspelling of McAfee. They will also change the letters that are capitalized but usually Mcaffee is there inside that red box.

[HansV]

I fear you'll have to delete each message yourself then.

[hlewton]

I fear you'll have to delete each message yourself then.

Yeah, sadly that is what I have been doing. I get anywhere from 2 to 8 messages from them on a daily basis. I have never used McAfee on any of my computers.

[HansV]

I used to get lots of such scam messages earlier this year. For some reason, it stopped after a while...

[Jay Freedman]

If you want to base the rule on the condition "specific words in the sender's address", then you need to use at least part of the actual address, shown in your second screenshot as coming from the server almacenaurelia.com.ar.

I've found that particularly resistant messages require the condition "specific words in the message header". Examine the headers of several of these messages to see what is always repeated in the same way, with the same capitalization. To see the header, open the message, then click File > Properties. The bottom of the dialog shows the Internet headers, which can be long; look for either the line that starts with "Received:" or the one that starts with "Message-Id:" and ends with the address of the sender's server.

[hlewton]

If you want to base the rule on the condition "specific words in the sender's address", then you need to use at least part of the actual address, shown in your second screenshot as coming from the server almacenaurelia.com.ar.

I've found that particularly resistant messages require the condition "specific words in the message header". Examine the headers of several of these messages to see what is always repeated in the same way, with the same capitalization. To see the header, open the message, then click File > Properties. The bottom of the dialog shows the Internet headers, which can be long; look for either the line that starts with "Received:" or the one that starts with "Message-Id:" and ends with the address of the sender's server.

Thank you I will check that and try again.