Pages: 1
RSS
From: =?UTF-8 always signals Spam, View Souce in From: field
 
An email which includes =?UTF-8 in the From field always indicates it is SPAM to me. How do I create a filter to capture this sequence for removal? Having no luck on my own.


Thank you.
 
I tried this condition and it worked:

Subject    Match    =?UTF-8


If you are not familiar with making filters at all, here's what to do:

Right-click on the account in question in the accounts tree.
Choose Sorting Office/Filters
Right-click on Incoming Mail and choose: New Filter
In the right half of the dialog, enter a name for your filter ("UTF-8 Spam" or something like that)
In the Conditions section, change the condition into: Subject   Match   =?UTF-8
In the Actions section, click the Add button and choose: Move the message to a folder
Choose the folder (Spam, Trash or whatever) where you want the spam messages to go
Press OK and from now on, those incoming spam mails should disappear in that folder.
I volunteer as a moderator to help keep the forum tidy. I do not work for Ritlabs SRL.
 
Thank you very much Daniel van Rooijen for volunteering in this forum.

I've been with The Bat since practically the beginning so I'm good with creating filters. It is this one that has me stumped. Must be a deep setting? Or the charset of the template? My template is set to UTF-8 for this experiment.


I tried your method for the Sender option and still no luck.
 
I tested with "=?UTF-8" in the Subject field by mistake, but I suppose the filter would work with the Sender field just as well.

My filter did not work when I first tried "contains" (instead of "matches") in the filtering condition.

Could it be that the actual spam messages that you are receiving are encoded in some strange character set that causes the filter to not find the string? I made my own test messages in plain Latin-9 (ISO) text. Does that "=?UTF-8" string from the From field look different when you view the headers or the full raw message?
I volunteer as a moderator to help keep the forum tidy. I do not work for Ritlabs SRL.
 
Here is a From:

From: =?UTF-8?B?Q3LigKrigKrigKplcOKAqmUg4oCqReKAquKAqnJh4oCqc+KAquKAqmU=?= <Nakayamas.Schley@blahblahblah.com>


Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: base64


I don't know what else to look for.
Edited: batshades - 09 May 2020 15:03:28
 
Weird... when I try to create a new message with UTF-8 encoding and with that line in the From field, The Bat converts that line into "Cr‪‪‪ep‪e ‪E‪‪ra‪s‪‪e <Nakayamas.Schley@blahblahblah.com>"  :-)

Apparently 'Crepe Erase' is an anti-aging creme. I have tried filtering on that name but it did not work.
I tried filtering on Headers matching "=?UTF-8" but that found too many other messages.
I tried filtering the Sender on matches "=?UTF-8" but that did not work after all.

What else can we try..?
I volunteer as a moderator to help keep the forum tidy. I do not work for Ritlabs SRL.
 
Yes, that is exactly the issue.

I don't know anything about how to create spam, but as you note, the Bat's filters are being disabled by something in these emails. I can post the full original source of it if you think it might help.
 
Well, at this point, maybe you should just contact Support (link) and see if they can think of a way to filter the Sender on "=?UTF-8" (and yes, they'll probably need one of those full 'raw' spam messages, so please upload one with your problem report).
I volunteer as a moderator to help keep the forum tidy. I do not work for Ritlabs SRL.
 
Will do. Thank you for putting in the time for this issue, Daniel.
 
This from Alexander:

You would need to use the following condition of the filter:

Header -> contains -> From: =?UTF-8?

This works. I was generating my filters using Header field > From then entering my string text. Alexander included the "From:" as part of the search phrase. That does the trick.
 
Thanks for reporting back and I'm glad that a work-around is available!
I volunteer as a moderator to help keep the forum tidy. I do not work for Ritlabs SRL.
 
My original statement in this post was a false statement >> =?UTF-8 always signals Spam

It is not always spam so using that sequence is not an option.

I did find an unanswered query from another forum, the poster's question on the topic is mine as well.

Decoding email headers
 
Maybe that would be a good suggestion to make to Ritlabs: Decode the subject line (if necessary) before searching it?
I volunteer as a moderator to help keep the forum tidy. I do not work for Ritlabs SRL.
 
Soooooo, I have this issue.

Apparently -- again!

I entered the search phrase to Google.

This post came up #1.

What a nice Christmas gift from me to me 12 years later!

Merry Christmas all!
Pages: 1