MozillaZine

TB fails filtering "Content" value

User Help for Mozilla Thunderbird
bernbisch
 
Posts: 3
Joined: November 10th, 2017, 4:56 am

Post Posted November 10th, 2017, 5:08 am

I want to make a filter with the rule
"Content" contains "23.139.0."
TB doesn't recognize this filtervalue but it IS in the content
of the mail. (see following example)

Code: Select all
From - Thu Nov  9 15:23:15 2017
X-Account-Key: account1
X-UIDL: 0MUiMi-1eiciu3U8i-00Y94K
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 Return-Path: <>
Received: from unique.mailnotebook.com ([85.204.50.14]) by mx-ha.web.de (mxweb113 [212.227.17.8]) with ESMTP (Nemesis) id 1M2Mq4-1eESVe2PBG-003qyz for <blabla@web.de>; Thu, 09 Nov 2017 15:11:16 +0100
From: "DailySavingsFinder" <yuvnblzgz@unique.mailnotebook.com>
To: <blabla@web.de>
Date: Thu, 09 Nov 2017 09:11:16 -0500 (EST)
Subject: Take this 30 Second Survey about Amazon Prime and We'll Offer You Exclusive Rewards Over $50!
MIME-Version: 1.0
Content-Type: text/html; charset="utf-8"
Envelope-To: <blabla@web.de>
X-UI-Filterresults: unknown:5;V01:K0:L0q7sDoRUBw=:EyrRauBpZ+CSCnafl2KkvHaBYx dXRdq4dHi8VnEX17K20WsNpygZ6LmgpNj16bfGJK5TGBfZjqBJZZqhBePVwnTyvEEGmkZWgUc 9mGn7h1iyiNDRCXYpSIP5a1sW3AD4wX67HdGG3vtou2eiUcOCN73dqgE6HVLP0xF8JIBspzKb rBcw3ehx3Yn320QUh8Q6Y42qywDiBO7tq3dai88NW563jwW5FITAWSN5BGFJ/D3wOyZYgVgw5 qfbj04KSDt1hc3vwoSnU/FGz0+lqYhGU8tVvSyphE+9tzW6PQxy49bkSV1gH6AxogN4GHyj/C jLfRQSbOpuyB7duARtb2wUCbV+cGHhh0r+BqCq9OcdUe8/GoCXGQNAq3Hfl234p7lt+tzMQEy psvMY9HWCxd7H1tBdANPmUADhZLqUD/TM5m8fXhfzFIEO5Jtzx8wUA0ikPCAQDeBgVcQ4E7FV 9j+wqL5xKLYmc5AJpSYfSRnAYR56SO2hTeKE+GNLpZ5MLbj9ifbSosBSlVWcw0HmbndY6DE7J Cy1fKQosT6Qrghnx9+6Pv68LvJ1XgPjJ3+LS+BzS7V7CKFJW8MV7zmaefOwcaf6G4v+QC4QBS 79qqrrQtC5350c6GmAcPB5ukp3sUj0F6uuQdE8s1MmNNQfptVGKpdUw5sfHdoRAlkjOzxL0xM sVH9QAkZ2ay7GFuEItbw6LwJhrtOB6HbF4wWpMP6sFqwjNH3+tZQjELG7TRM0z+bx+soe0crg JSxQjyPlLLaNcrJBSWkhbw4q2sQYMlnePy7kP+KcfkTZ9UQ1N8iAjDGWMapCi6LI0ttydoniw qzqB8BFupwgpfdCU2QokgXpEKndIilvfAzBtWTkNkRhT729FZSr2Rt8vgtndYEulK5MJ4367I Tc9uO5oC9hqK17UT/4SEz9G8UBE+4LH4Ri0jVg/O1N+jfNHksLXvNSL+BUt5UJg9OPaSMVWGz R2Zenhn8qF2oHo9qD60Zbs9ID89OWsrHnzUR8tZV9UduCOeaPUUUwZr07MoMvq1RSWw2+6Oja nMF9BQlsOQe1RCT/2aEDCixtyTKyIQcNAE0pRuXl31iIF4CvRe2hu/LxE16OgepGNxxat9fPI PkdCKE//J6F5EwZBqUf7SNIHF/4Eb4niEXYB8sQXlcSXnwfT7KsxHMVoD5nt3INtxBF9NTKwc LfdSwvEyjlIM+WGyfL94iUCbo6uor6ZhdgLQDEWxVUWCJ6p0gVvbS1S8zo33/N7g0/+j1Nact DE34oOAskEDzoDe9x7rjYihpmmk7zyBVNvvT/1US1WPT4zNUGaif3sBoop9qX21G3b1HOhBZq iCgNpd19pVrf6BtCgVJ/gMu8Vp7ioFz7pKNr3DJaOA4bcIzove7t74f2kTnOq/AsxT40RIyC5 SLxJCsvNpg9t5+ElRE8gonwMtqm2vj0wZ1x3MmiHRAdMJGpfGU1KzT8ePq+I6TN/V1cho95+/ yTMF/azbsB7Inr4ZA59f848HigwTF61Mm8BPsW38NJxztVHONKRiKZ4/8968D3NCdKHwQyxsf wvmrfiWQM8zywq37tv9W125/sWF4hBAsGXg7MZUG5D1iInJ+mDwuUkEWFY7+IHyZml835c4IQ Lh4HOcXX2VwZcl2QDlCmE98m5l8GkBgqcfgftQjRry25l2xmnzQVKo+z+QY0KP5kiYoMsXsfV eUuuICWMDLkL3uQ+XzlB1pWUD13m5RYU3Qs7W5/8aU4RoccAgx4Zu+MVagLXT5QeIr3Vbg/ok Gx5w0KSjp5JizMpsFLs7H7MjhDkV8rQ77vBg==
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>
<body style="background-color:#FFFFFF;">
<img src="http://23.139.0.3/?NzE4ODAzNzU9NzAzNCY1MTcyMTY9MTI1JjM1PW9wZW4mbnQwYjlxPTImbGlkPTI1MDU=" width="1" height="1"><P style="text-align: center;"><A href="http://23.139.0.3/?NzE4ODAzNzU9NzAzNCY1MTcyMTY9MTI1JjM1PWNsaWNrJm50MGI5cT0yJmxpZD0yNTA1" > klick hier </A></P><BR />
<CENTER><A href="http://23.139.0.3/?NzE4ODAzNzU9NzAzNCY1MTcyMTY9MTI1JjM1PWNsaWNrJm50MGI5cT0yJmxpZD0yNTA1" ><IMG src="http://23.139.0.3/images_html/?51d60975eh8zvh1125/51d6ff.png"></A></CENTER><BR />
<CENTER><A href="http://23.139.0.3/?Im9mZj03MDM0Ig==" ><IMG src="http://23.139.0.3/images_html/?51d60975eh8zvh1125/51da67.png"></A></CENTER><BR />
<CENTER><A href="http://23.139.0.3/unsub.php" ><IMG src="http://23.139.0.3/images_html/?51d60975eh8zvh1125/51db1c.png"></A></CENTER><BR />
</body>
</html>


Is it because embedded in html-code?
Is there a solution?

PLEASE ... ](*,)

WaltS48

User avatar
 
Posts: 3445
Joined: May 7th, 2010, 9:38 am
Location: Pennsylvania, USA

Post Posted November 10th, 2017, 6:54 am

If I didn't mark it as Junk, I would filter on the From: address.
Linux Desktop - AMD Athlon(tm) II X3 455 3.3GHz | 8.0GB RAM | GeForce GT 630
Windows Notebook - AMD A8 7410 2.2GHz | 6.0GB RAM | AMD Radeon R5

DanRaisch
Moderator

User avatar
 
Posts: 117680
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Post Posted November 10th, 2017, 6:56 am

Moving to Thunderbird Support.

You use the term "Content" but Thunderbird doesn't, at least not in the English version. Do you mean "Body" when you use that term?

bernbisch
 
Posts: 3
Joined: November 10th, 2017, 4:56 am

Post Posted November 10th, 2017, 9:16 am

DanRaisch wrote:You use the term "Content" but Thunderbird doesn't, at least not in the English version. Do you mean "Body" when you use that term?


Yes, I use german language package. The item is called "Inhalt" which means in strict translation "Content", maybe "Body" is meant in english version.

WaltS48 wrote:If I didn't mark it as Junk, I would filter on the From: address.


That does't make sense for me because the From: adress is everytime changing. It is f*******
spam and only the IP for answer button is the same in all mails.

makaiguy

User avatar
 
Posts: 16477
Joined: November 18th, 2002, 6:44 pm
Location: Somewhere in SE USA

Post Posted November 10th, 2017, 11:21 am

The Body term in TBird refers to the content of the message text, but does not include the message's headers.

To trap messages from a specific IP, you must create a custom filter that looks for that IP number in the Received headers. The Received header is not one you can search in default TBird, but you can add it as a custom search criterion.

When creating or editing the filter, in the first pulldown (the one that has Subject as its default), choose Customize. Enter Received as New message header (don't include the colon) and click Add, then OK. This will permanently add this option to the filter criteria.

Now, back in the filter definition screen you'll be able to choose Received as another thing to filter on.

I successfully trap messages from given IPs via filter:
[Received] [contains] [WWW.XXX.YYY.ZZZ]
Doug Wilson, "The Makai Guy"
Win10 (64bit): FF 52.4.0 ESR (64bit), TB 52.3.0 (32bit)║ Android 7.0/7.1.1: FF 57..0, No TB for Android available, dammit!
What a fool believes he sees, no wise man has the power to reason away - Doobie Brothers

bernbisch
 
Posts: 3
Joined: November 10th, 2017, 4:56 am

Post Posted November 10th, 2017, 2:18 pm

makaiguy wrote:The Body term in TBird refers to the content of the message text, but does not include the message's headers.


Thanks for this but I think you dont understand me. The IP number I look for is not
the sender IP nor in the header. It is IN the message (please look in my example posted
in 1st post) It is the term

<CENTER><A href="http://23.139.0.3/?Im9mZj03MDM0Ig==" ><IMG src="http://23.139.0.3/images_html/?51d60975eh8zvh1125/51da67.png"></A></CENTER><BR />

and has no relation to the IP(s) in the header.

It is because I get nearby 10 mails per hour from completly different adresses with different IPs BUT all
contains a html-response-button with the SAME IP(/24)...

Thanks a lot!

tanstaafl
Moderator

User avatar
 
Posts: 43251
Joined: July 30th, 2003, 5:06 pm

Post Posted November 11th, 2017, 8:54 am

Since the IP address is in the message body (rather than in a header) you want to test whether "Body" "contains" "http://23.139.0.3".

Body is predefined for POP accounts but needs to be added for IMAP accounts. See http://kb.mozillazine.org/Message_Filte ... ssage_body or makaiguy's post.

Return to Thunderbird Support


Who is online

Users browsing this forum: No registered users and 3 guests