Need a filter made, but confused

User Help for Mozilla Thunderbird
Post Reply
ssateneth
Posts: 2
Joined: July 6th, 2019, 1:34 pm

Need a filter made, but confused

Post by ssateneth »

I've been getting a TON of spam from some place. They are all random-ish subject names (human readable), and correspondants/from doesnt have anything in common either, but the name is something like this.

ssatenethwww@WWWWWWWW.net

the w's and W's are small and large random letters respectively. I cannot filter by the "ssateneth" part either because many of my legitimate emails also contain that word in that position. Is there a way to regex filter these spams? There is also a "Reply-To" header inthe source of the email that ends of "zoho.net" but I tried adding a custom header to filters where the header is "Reply-To" without the quotes and contains "zoho.com" without the quotes, but it won't work.

I use an IMAP email account. I heard body filtering with IMAP is impossible, unless someone can show me otherwise, then I could filter things so much better. I'm always getting insane amounts of spam on this account though...
User avatar
tanstaafl
Moderator
Posts: 49647
Joined: July 30th, 2003, 5:06 pm

Re: Need a filter made, but confused

Post by tanstaafl »

You need to add Body as a custom header and enable offline folders to enable body filtering with IMAP accounts. See http://kb.mozillazine.org/Message_Filte ... ssage_body

Look at the Received: headers, especially the lowest ones in the message source (the earliest ones). Can you find a consistent sender in those headers that you can filter on?

I suggest you think about using something like SpamPal that use a DNS black list from spamhaus etc. (rather than learning to recognize spam via Bayesian filters) and configure the junk mail controls to trust its judgement on what is spam. See http://kb.mozillazine.org/Junk_Mail_Con ... nd_SpamPal
ssateneth
Posts: 2
Joined: July 6th, 2019, 1:34 pm

Re: Need a filter made, but confused

Post by ssateneth »

I already had enable offline folders on but it seems filtering is still inconsistent, like it still only downloads headers. Even one mail that is spam, it won't do body filtering with either the build in one or custom header. Surely there is a way to just search the entire source of the email instead of just a predefined format like headers? It seems body filtering works with legit emails, but spam emails screw up the formatting in a way so that it's still viewable but the filtering doesnt know where the body starts.

The emails in question are already sent to junk folder by hotmail, but I don't want to see them at ALL. I get constant notifications for junk mail in my junk folder, which is already filtered into the junk mail folder by hotmail, but thunderbird gives me a notification popup and sound regardless.

I don't want to see known junk mails at all, or at the very least, already marked as read. I don't want notifications from junk mail either.

Sorry if it sounds like I'm asking the impossible or I'm inept with Thunderbird.
User avatar
tanstaafl
Moderator
Posts: 49647
Joined: July 30th, 2003, 5:06 pm

Re: Need a filter made, but confused

Post by tanstaafl »

"Body" lets you filter on the headers before the message body, plus the message body. However, it doesn't let you filter the contents of attachments (last time I checked).

Getting body filtering to work can be tricky. How did you add the custom header?

"select "Customize" at the bottom of the leftmost list box (while editing the filter rule). Then either select a custom header from the list box or add one by entering its name in "New message header:". Omit the ':'."

Looking at the raw source for a message in my Outlook IMAP account I see:

X-Microsoft-Antispam:
BCL:0;PCL:0;RULEID:(2390118)(5000188)(711020)(4605104)(610169)(650170)(651021)(8291501072);SRVR:HE1EUR04HT017;

Unusual. I'm used to custom headers like:
X-Spam-known-sender: no
X-Spam-score: 0.0
X-Spam-hits: BAYES_00 -1.9, ME_NOAUTH 0.01, ME_ZS_CLEAN -0.001, RCVD_IN_DNSWL_MED -2.3,
SPF_HELO_NONE 0.001, SPF_SOFTFAIL 0.665, LANGUAGES en, BAYES_USED user,
SA_VERSION 3.4.2

However, I found https://docs.microsoft.com/en-us/office ... ge-headers . It looks like BCL: is a spam score. https://social.technet.microsoft.com/Fo ... spam-label talks about RULEID . https://blogs.technet.microsoft.com/exo ... ffice-365/ has an overview of Office365 spam detection, some of that would apply to a email client.

You might experiment with a rule that checks that X-Microsoft-Antispam: contains either BCL:0 , BCL:1 or BCL:2 (otherwise consider it spam). See https://docs.microsoft.com/en-us/office ... vel-values
User avatar
tanstaafl
Moderator
Posts: 49647
Joined: July 30th, 2003, 5:06 pm

Re: Need a filter made, but confused

Post by tanstaafl »

Take a look at the training and tweaking sections of http://kb.mozillazine.org/Junk_Mail_Controls . By default Thunderbird is configured to learn to recognize spam very slowly, but with few false positives. Its recommended you drop mail.adaptivefilters.junk_threshold from 90 to about 30.
Post Reply