Leonidas Jones wrote:
> > Does any version of Thunderbird have:
> >
> > "Thunderbird 2.0.0.9 (Windows/20071031)"
> >
> > As the exact (and only) contents of the User-Agent line?
>
> That is the standard UA string for TB.
> The current version is 2.0.0.12, but a lot of people use outdated
> versions.
Can you explain if "(Windows/20071031)" is normally found after
"Thunderbird 2.0.0.9" in the User Agent line?
What time frame corresponds to version 2.0.0.9 being the current
version?
> I would not use it as the basis for a filter.
My e-mail inventory (which goes back to 1998 and contains about 50 to
60k e-mails - mostly spam) contains 584 e-mails that have
"Thunderbird" in the User Agent header line.
Of those, the earliest non-spam e-mail is dated Aug 5/2003 and has
this in the User Agent:
Gecko/20030603 Thunderbird/0.1a
The first appearence of spam containing "Thunderbird" in the User
Agent came in December 2004:
Gecko/20031013 Thunderbird/0.3
Of the 584 e-mails containing "Thunderbird" in the User Agent, about 3
dozen of them are non-spam, and those come from about 1 dozen
different people. None of the non-spam e-mails contain "2.0.0.9" as
the version, but 81 spams do.
I think it's safe for me to impliment a filter based on finding
2.0.0.9 in the User Agent line.
I have been running a similar filter for "The Bat" in the user-agent
or X-mailer lines since mid-2006. For some reason half of my spam
during 2006 and 2007 had "The Bat" in the user-agent or X-mailer lines
(and very very very few legit e-mails had "The Bat"). I know that
"The Bat" is a legit e-mail client app, but in my case it was an easy
spam identifier.
I also have about a dozen old versions of Outlook / OE also being
filtered for spam, again in the User-Agent or X-mailer lines.
|
