That's a mighty interesting build of Outlook Express you're using to send that email...

So I've been trying crack the problem of how to deal with the latest round of "empty" spam. I was kind of hoping it would just go away, but I got a few more of them this morning.

The messages have lots of little unique attributes. For one, they only seem to contain words starting with the letters A through D. My suspicion is that someone has a dictionary file that got truncated around the word, "diametric."

The messages also lack uppercase letters and have some consistently odd punctuation. Unfortunately it's difficult to conclusively say these properties won't all show up in someone's message from grandma.

Getting the filter to reliably detect these as being spam has proven challenging. I don't have all the answers - but I did come across something that will hopefully help a little.

It turns these messages and lot of other spam is sent using versions of Outlook Express that don't seem to have ever come into common use. In fact, I can't find any evidence Microsoft even created or distributed such builds. Presumably, spam software is inserting semi-random version numbers into the headers.

For instance, I know that "Outlook Express 6.00.2900.2869" is a real version. However, version 6.00.2900.2670 doesn't show up any place in all my searches besides spam. Since it often show's up in spam, the anti-spam email system will usually block it.

If it were possible to document all the prior builds of Outlook Express that shipped, a lot of spam could be eliminated. Any versions that appear newer than the last known real one would have to be assumed valid.

I've poked around a bit, but haven't been able to locate a document from Microsoft or anyone else that looks authoritative. I do however have a large database of messages from customers that I know are valid. When an Outlook Express build shows up over a hundred times in my spam database, but never in any of my validated emails, it's a good candidate to get blocked.

Back