Let's take hotmail as an example. After sent a mail via hotmail, WFilter shows as below:
Host: by19fd.bay19.hotmail.msn.com
Url: /cgi-bin/premail/8727
Matched Host: hotmail.msn.com
Matched Url: /cgi-bin/premail
Type: Send Mail
When we login into hotmail from different position, "by19fd.bay19" usually changes while "hotmail.msn.com" remains the same. So we take "hotmail.msn.com" as the string for host match.
Also, the number follows "/cgi-bin/premail/" changes for each email. So we take "/cgi-bin/premail/" as the string for url match.