Need advanced help with message filters testing font

[Amby19]

II'm getting new spam that clearly comes from a single spammer but comes from many different email addresses and always has different subject lines and content. The only thing that is always uniform is that the subject lines always uses a font with small capitals, like the Copperplate font (and may well be the Copperplate font).

Is there any way I can create a filter that can recognize a particular font or even just that the font uses small capitals?

[tanstaafl]

its also possible to set the font in the Subject. You could also test the Content-Type header, it effects just the contents of the message body but might also be set to the same font. That would require you to add a custom header to the message filters using the customize command at the bottom of one of the list boxes. See http://kb.mozillazine.org/Custom_headers

Content-Type: text/plain; charset=windows-1252; format=flowed
Subject: Vielen Dank =?windows-1252?Q?f=C3=8Cr_Ihre_Bestellung=2C_F?=
=?windows-1252?Q?loyd_Pepper!?=

Both of those examples specify the windows-1252 font. I suggest you start by selecting the message and using Control-U or view -> message -> source to look at the raw message source. See how / where the font is specified. There will be a lot of unfriendly junk (dozens of headers before the ones you care about) and if its a HTML message you will see raw HTML code rather than the interpreted HTML but you should be able to wade through it.

I don't know of any practical way for a message filter to recognize that the font uses small capitals. The FiltaQuilla add-on at https://addons.thunderbird.net/en-US/th ... la/?src=ss adds support for many additional features to message filters such as regular expressions but I suspect it wouldn't help much. Start by trying to figure out what unique data you can recognize/text in the raw message, not what you see when you read the message.

[tanstaafl]

Take a look at the Received: headers. Its trivial to spoof the From: header and a spammer can add additional Received: headers if they want (though I've never seen that done), but they can't stop other mail servers that the message passes through from adding a Received: header. It might be easiest to test for a message that has a specific server (ideally the spammers SMTP server) in a Received: header.

See https://www.pobox.com/helpspot/index.ph ... age&id=253

[Amby19]

Hey, thanks a lot, tanstaafl! That's an excellent idea!

You can close this thread if you like; I no longer think what I was asking for is actually possible.