4.3 Sample Properties on a Phishing Message

The following is a description of what a client does to stamp the message that has been identified as a phishing message and the responses that a server returns. The ROP input and responses are summarized in this section; for information about how to set properties by using the RopSetProperties ROP ([MS-OXCROPS] section 2.2.8.6), see [MS-OXCPRPT] section 2.2.5.

Because the PidNamePhishingStamp property (section 2.2.1.1) is a named property, the client asks the server to perform mapping from named properties to property IDs by using the RopGetPropertyIDsFromNames ROP ([MS-OXCROPS] section 2.2.8.1).

Property name

Property set GUID

Name

PidNamePhishingStamp

{00020329-0000-0000-C000-000000000046}

http://schemas.microsoft.com/outlook/phishingstamp

The server returns the following property IDs in response to the RopGetPropertyIDsFromNames ROP.

Property name

Property ID

PidNamePhishingStamp

0x831F

After determining the value of the property, the client uses the RopSetProperties ROP to transmit the data to the server.

Property name

Property ID

Property type

Value

PidNamePhishingStamp

0x831F

0x0003(PT_LONG)

0x0A73AE09

If the user enables the functionality of the phishing message, the property value is changed and the client uses the RopSetProperties ROP to transmit the new value to the server.

Property name

Property ID

Property type

Value

PidNamePhishingStamp

0x831F

0x0003(PT_LONG)

0x1A73AE09

The client then uses the RopSaveChangesMessage ROP ([MS-OXCROPS] section 2.2.6.3) to commit the properties to the server.

Show: