I get spam email from Killer Deals. It's just spam. I've tried to create a
rule which deletes these emails as soon as they arrive, but nothing works.

Here's the message header from one of them:

Return-path: <b.KillerDeal.0-9b44ee9-6320.nyc.rr.com.-(E-Mail Removed)>
Received: from ms-mta-04.rdc-nyc.rr.com
(ms-mta-04-smtp.rdc-nyc.rr.com [10.10.4.28]) by ms-mss-03.rdc-nyc.rr.com
(iPlanet Messaging Server 5.2 HotFix 2.10 (built Dec 26 2005))
with ESMTP id <(E-Mail Removed)> for (E-Mail Removed);
Wed, 26 Sep 2007 09:37:38 -0400 (EDT)
Received: from orngca-mx-05.mgw.rr.com
(orngca-mx-05.mgw.rr.com [66.75.160.139]) by ms-mta-02.rdc-nyc.rr.com
(iPlanet Messaging Server 5.2 HotFix 2.10 (built Dec 26 2005))
with ESMTP id <(E-Mail Removed)> for (E-Mail Removed)
(ORCPT (E-Mail Removed)); Wed, 26 Sep 2007 09:37:38 -0400 (EDT)
Received: from 44.moosq.com ([69.6.79.144]) by orngca-mx-05.mgw.rr.com with
ESMTP; Wed, 26 Sep 2007 09:37:18 -0400
Received: (from daemon@localhost) by 44.moosq.com (8.8.8/8.8.8)
id GAA42847; Wed, 26 Sep 2007 06:04:19 -0700 (PDT)
Date: Wed, 26 Sep 2007 06:34:55 -0700 (PDT)
From: Killer Deals <(E-Mail Removed)>
Subject: (E-Mail Removed), Get 250 Business Cards
To: (E-Mail Removed)
Message-id: <(E-Mail Removed)>
MIME-version: 1.0
Content-type: text/html; charset=iso-8859-1
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=moosq; d=moosq.com;

b=D7t1t9Bm68wr10vJkZXr4uVuy2mBiazWS6f5U+q9WviJm2E53bTdt9KEKPeua59o94JsB3b78LUvwfk4MuaziHYf8JTlCFq29DIn2MYFVEPGZCxIXCDfk3fYud1JaspK;
X-MID: 1725755834
X-RR-Connecting-IP: 69.6.79.144
Original-recipient: rfc822;(E-Mail Removed)
X-NAS-BWL: No match found for '(E-Mail Removed)' (237 addresses, 0
domains)
X-NAS-Language: English
X-NAS-Bayes: #0: 4.10121E-078; #1: 1
X-NAS-Classification: 0
X-NAS-MessageID: 7142
X-NAS-Validation: {6DCC3375-3919-432B-8E36-5FD69798D1AB}


I have a rule which says if the message header contains "moosq" or
"44.moosq.com" delete it, but when I run it, nothing happens.

Thanks!!

RON

RonGGGG <(E-Mail Removed)> wrote:

> I have a rule which says if the message header contains "moosq" or
> "44.moosq.com" delete it, but when I run it, nothing happens.

Hm... it should work. Try one that looks for "KillerDeal" in the header or
in the sender address.
--
Brian Tillman [MVP-Outlook]