Is it possible to filter messages from text in message source
I would like to filter messages using text that appears only in the message source. Is it possible? How?
All Replies (7)
Use the Customize option in filter and add entry for selected headers from source.
I would like to use any text string that appears in View > Source. Some strings are being displayed by Thunderbird in the Preview window, but the filters do not catch these. For example, I am receiving tons of ads or phishing scams emanating from "Frikicars". "Frikicars" is present in the Preview window, but the filtering does not catch it. Also "User agent" is not accepted as a correct header because of the space character, but some of these messages do use "User agent" with a space character, most likely to evade filtering.
Maybe if you post a screenshot of the source, someone here may have a suggestion.
It would be very helpful if any fragment of text within the source could be the target of the filter. Here is the text of a different type of source (I have removed my own address): Received: from AM7PR02MB5767.eurprd02.prod.outlook.com (2603:10a6:20b:103::15)
by AS1PR02MB8026.eurprd02.prod.outlook.com with HTTPS; Mon, 3 Apr 2023 13:39:13 +0000
Received: from FRYP281CA0018.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10::28) by
AM7PR02MB5767.eurprd02.prod.outlook.com (2603:10a6:20b:103::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.33; Mon, 3 Apr 2023 13:39:13 +0000
Received: from VI1EUR03FT016.eop-EUR03.prod.protection.outlook.com
(2603:10a6:d10:0:cafe::99) by FRYP281CA0018.outlook.office365.com (2603:10a6:d10::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6254.20 via Frontend Transport; Mon, 3 Apr 2023 13:39:12 +0000
Authentication-Results: spf=none (sender IP is 108.163.240.11)
smtp.mailfrom=bananasius.com; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=hwwnptiho.xz;compauth=fail reason=001
Received-SPF: None (protection.outlook.com: bananasius.com does not designate
permitted sender hosts)
Received: from bananasius.com (108.163.240.11) by
VI1EUR03FT016.mail.protection.outlook.com (100.127.144.158) with Microsoft SMTP Server id 15.20.6254.9 via Frontend Transport; Mon, 3 Apr 2023 13:39:12 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:B358A93303731E056E7B75D1C481766057BC6446130CE89D6620BDA42BE17599;UpperCasedChecksum:BEAA47384173F6F4D05CD454187875D83F2A34EEA85F9681CF89518DA2866A85;SizeAsReceived:403;Count:9
From: "=?UTF-8?B?ZGVtZW50aWEgdHJpZ2dlcg==?=" <BrainSavior|LP-aepokfvbp@hwwnptiho.xz> To: Date: Mon, 03 Apr 2023 09:39:11 -0400 Subject: =?UTF-8?B?Y29tbW9uIGJlZHRpbWUgaGFiaXQgc2t5cm9ja2V0cyBkZW1lbnRpYSByaXNr?= Message-ID:
<e837159a-d22d-45af-baa9-2521ed5ad9a3@VI1EUR03FT016.eop-EUR03.prod.protection.outlook.com>
Content-Type: text/html; charset=UTF-8 Reply-to: <costumer-Reply@bananasius.com> X-IncomingHeaderCount: Return-Path: Return@bananasius.com X-IncomingHeaderCount: 9 X-MS-Exchange-Organization-ExpirationStartTime: 03 Apr 2023 13:39:12.7131
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id:
36c65b58-cd16-47ef-d2cf-08db3448cf87
X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic:
VI1EUR03FT016:EE_|AM7PR02MB5767:EE_|AS1PR02MB8026:EE_
X-MS-Exchange-Organization-AuthSource:
VI1EUR03FT016.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-UserLastLogonTime: 4/3/2023 12:16:20 PM X-MS-Office365-Filtering-Correlation-Id: 36c65b58-cd16-47ef-d2cf-08db3448cf87 X-MS-Exchange-EOPDirect: true X-Sender-IP: 108.163.240.11 X-SID-PRA: BRAINSAVIOR|LP-AEPOKFVBP@HWWNPTIHO.XZ X-SID-Result: NONE X-MS-Exchange-Organization-SCL: 5 X-Microsoft-Antispam: BCL:0; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Apr 2023 13:39:12.5725
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 36c65b58-cd16-47ef-d2cf-08db3448cf87 X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-AuthSource:
VI1EUR03FT016.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR02MB5767 X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.8315497 X-MS-Exchange-Processed-By-BccFoldering: 15.20.6254.033 X-Microsoft-Antispam-Mailbox-Delivery: abwl:0;wl:0;pcwl:0;kl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000305)(90000117)(90005022)(91005020)(91035115)(9050020)(9100338)(2008001134)(2008121020)(4810010)(4910033)(8820095)(10005027)(9610025)(9540006)(10160021)(9320005)(9245025);RF:JunkEmail; X-Message-Info: 6hMotsjLow8h2u6w9D6EhSXbH5e2qrRuktKGzoMpZ/DnpGyxgG4SVmNaJBX+FJgEyEupwcQk5vlJG170UoOurriJFT5nVTVRa3WK7dhOj+4nVtn9sI5CaZYiDx1hRY4dY5etNhxBqt+mPmobDG6W/g== X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0xO1NDTD02 X-Microsoft-Antispam-Message-Info: =?utf-8?B?eWY5NjdYSXBTMkduTS9TNGUwZElScG1rWjNpeVRhMnhGSjVkV3dwdFNidmVJ?=
=?utf-8?B?UC81dS9VaVIvUkhPR1hjZWtFc2E4VjB3NHlZZmNqV2ZPU1gzWmJwaElINnNL?= =?utf-8?B?SzlBWGZocklpY3BIRUhrQ3hIWnJVbURiUmduUEVJalArRUFjVktESlJDOGNx?= =?utf-8?B?RkJVcmszbUJzaE9hM0FXc3M5Skovdm1FRjhzc2lVaTU3aC9DbDNrSmxKUXJK?= =?utf-8?B?YitJRUpFT2FrLzNmSmpRdnpmK1lxdFR0Ym9XOWxmZUJhVnlXOXVTYjRsaHRh?= =?utf-8?B?cGJqYnM3b1JBeDVyejRQQlc4V3E2QmVZLzlrSkg4SUY0bnE1ZVRCQ1NzQXRF?= =?utf-8?B?Y1RtTWx0RjdnL0Rvdy9ybWhDazhyVm9vcTlZL0x6ZmlTUzdCVURMakViMEZk?= =?utf-8?B?V2xlR05KemVNL09BVmo3NWRzU2lGVzdZbHlrTTNNYnBoMjBTQUJLZEVPaUE4?= =?utf-8?B?elRBU3p0ZzZuaVdIMFF3QmQrTmRDV01abkI0Vy81WFkyOVlxQXJpOEZuTC9D?= =?utf-8?B?Nmt1SUdpUElvMGJQejNTMjMyZmkrRGR0a0tjaUlPbnNCUFNXUHQwd1V5OEFr?= =?utf-8?B?QnNXYkc0bHV0a0tlQzdwdjRkTVRUaTVUZHNTZEZiVFoxTWRSRUowQVV2aDM1?= =?utf-8?B?Y2xmR0g5WUl4ZDhsZGlaaVpFL3NqWi9qSklZUFBsNFpyTFBUaEk0ZGRuMnNp?= =?utf-8?B?NlFOb0RBOUx5VzdKQjVUQ05PeXg3dUFvLzB2SHFxUXZBSGpXYXU1cHRNdE51?= =?utf-8?B?M25SM1l6am5VZ2NxYVFqdHB3VEtTRkVwSEZOM1p5V084NVNLL2RrdHZJbTBZ?= =?utf-8?B?TnpadGV6QnZWQTVQQ0FrZ1ZDc2JqMzNyRXg0MjdIZjdRY2FwUm9heFFwUUoz?= =?utf-8?B?S2tTRlVDd3QxbmRDdXhHWkRXVFVuVE95S0VndmZjOFRSZGVmbnFVd3NvNFlY?= =?utf-8?B?cDEyK1JGOGhSZTZwY2NtdUx0TDhrVkE5Z3BtNW5sendaUVB0SkxaeGQrVkRv?= =?utf-8?B?d0kvTmVwWkpRY2s5SHJsZ2RGT05rbHFCUStHVU9adGFXS0Qva3BvS1BHVW9l?= =?utf-8?B?K3Rod2FEOVVBQ2QyRW1zSElPZW1tVC9EdUlGcVU4SVdnc281Z0hlenUwRjNZ?= =?utf-8?B?bXNSb0RId2ZnUnpDVHJkTTkvdnFYcld2WU1ldERVdTJYWE5pZitGOXlXb3Q5?= =?utf-8?Q?Pdeoc68eU?=
MIME-Version: 1.0
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<center>
<font size="7" face="latine">common bedtime habit skyrockets dementia risk</font>
.
Well, I had expected Frikicars to appear somewhere. Is the reply email of bananasius unique for your typical incoming messages? Or the IP address shown? Or maybe the one of the Received From entries. I am no expert in any way in header records, but I suggest you look for some element that is consistent. Good luck.
Frikicars appears in plenty of message sources. The question is how to catch text strings from the message source directly. It seems that Thunderbird cannot catch strings from the source directly. This would catch a lot more SPAM.
Thunderbird works from headers, and can search for text strings within them.