How to filter out spam with weird fonts

[The Enforcer]

Hi,

I am receiving the following emails:

Outlook2.PNG (15.48 KiB) Viewed 4077 times

which look like this in MW:

MW4.PNG (17.32 KiB) Viewed 4077 times

InkedMW3.jpg (65.64 KiB) Viewed 4043 times

InkedMW5.jpg (64.21 KiB) Viewed 4043 times

I have tried filtering out this spam using From>contains/is> "Mcafee renewal", but it doesn't work.
Do the filter options allow for a filter where as soon as it detects that stupid font, it deletes it so I never have to see anything from this particular scumbag again?

Many Thanks,
TE

[TrustFire]

I have tried filtering out this spam using From>contains/is> "Mcafee renewal", but it doesn't work.

Did you try . . . changing the 3rd condition field (on that same filter rule) from Plain Text to RegEx?

Do the filter options allow for a filter where as soon as it detects that stupid font, it deletes it so I never have to see anything from this particular scumbag again?

Many Thanks,
TE

Unfortunately, MailWasher filters have no such capability.

[The Enforcer]

I have tried filtering out this spam using From>contains/is> "Mcafee renewal", but it doesn't work.

Did you try . . . changing the 3rd condition field (on that same filter rule) from Plain Text to RegEx?

Yes, but it still doesn't capture it.

[TrustFire]

Now that you mention . . . it's not working for you — the second screenshot on your OP indicates quite clearly that MailWasher has flagged both your messages as spam.

So then, what makes you state that it's not working?

[The Enforcer]

Now that you mention . . . it's not working for you — the second screenshot on your OP indicates quite clearly that MailWasher has flagged both your messages as spam.

So then, what makes you state that it's not working?

Sorry, I should have been clearer. I am trying to get MW to auto-delete it, seeing as it is a regular spammer that keeps coming back for more, so that I never have to look at it or risk accidently clicking on it and releasing a whole raft of childporn/malware.

Cheers,
TE

[TrustFire]

Ah, all right — BTW, I tested the following 2 filters . . . they are both working fine (however, I'm running the latest 7.12.127 βeta):—

• From >> Contains >> RegEx
• From >> Contains >> Plain Text

Before creating & implementing your auto-delete filter, you might want to read the following posts:—

• viewtopic.php?p=85253#p85253
• viewtopic.php?p=105976#p105976

[The Enforcer]

Hi,

Thanks for your further guidance.

Normally when 'new' spam arrives, I add another line to one of my filters and once I've saved it, I can see the spam getting labelled with the name of the filter. After washing, the auto-delete takes care of any repeats of that particular spam. I got rid of the 'Aspire Card' one by attacking the subject line.

However, I still can't get the MW filter From"Mcafee renewal">>Contains>>Plain Text/RegEx to label those "Mcafee renewal" spam. I changed the spam score under the action tab of the filter to -200 and moved that particular filter (McAfee) to the top of the filters. I have four of those spams sat there now all with a spam score of -100 from 'Learning'.

I am loathe to set auto-delete based on spam score, as I am still wary of genuine emails from previously unknown senders being misconstrued as spam.

Cheers,
TE

[TrustFire]

However, I still can't get the MW filter From"Mcafee renewal">>Contains>>Plain Text/RegEx to label those "Mcafee renewal" spam. I changed the spam score under the action tab of the filter to -200 and moved that particular filter (McAfee) to the top of the filters. I have four of those spams sat there now all with a spam score of -100 from 'Learning'.

The Learning algorithm of MailWasher takes a certain minimum period of training — in your particular case, it has reached a learning score of -100 for the Mcafee renewal filter . . . which is also the core reason why this has not yet taken effect.

In case you want your Mcafee renewal filter to start auto-deleting with immediate effect, you can decrease the spam score to -100, for now . . . but after a few days, ensure you revert the threshold to the safest -200 (it turns doubly sensitive at -100.)

I am loathe to set auto-delete based on spam score, as I am still wary of genuine emails from previously unknown senders being misconstrued as spam.

Cheers,
TE

Oh yeah, I hate that training-based algorithm — unfortunately, being the safest . . . among the 4 available options, it's the only go.

The secret is to use keywords that are present in the entire spam message which are so unique that there's left no chance for any genuine mail to get flagged, auto-deleted & therefore lost . . . a clear & present danger of auto-deleting.

Until recently, we would be reluctant to even discuss this feature — in the wrong hands . . . auto-delete can indeed prove dangerous.


Pro Tips:—
Use the Source tab to hunt down those very unique keywords from your spam messages.

Do not constrain yourself just to filter conditions such as From and Plain text — try other conditions like the following:—

• Entire message
• Reply-To
• Return path

[The Enforcer]

However, I still can't get the MW filter From"Mcafee renewal">>Contains>>Plain Text/RegEx to label those "Mcafee renewal" spam. I changed the spam score under the action tab of the filter to -200 and moved that particular filter (McAfee) to the top of the filters. I have four of those spams sat there now all with a spam score of -100 from 'Learning'.

The Learning algorithm of MailWasher takes a certain minimum period of training — in your particular case, it has reached a learning score of -100 for the Mcafee renewal filter . . . which is also the core reason why this has not yet taken effect.

In case you want your Mcafee renewal filter to start auto-deleting with immediate effect, you can decrease the spam score to -100, for now . . . but after a few days, ensure you revert the threshold to the safest -200 (it turns doubly sensitive at -100.)

I am loathe to set auto-delete based on spam score, as I am still wary of genuine emails from previously unknown senders being misconstrued as spam.

Cheers,
TE

Oh yeah, I hate that training-based algorithm — unfortunately, being the safest . . . among the 4 available options, it's the only go.

The secret is to use keywords that are present in the entire spam message which are so unique that there's left no chance for any genuine mail to get flagged, auto-deleted & therefore lost . . . a clear & present danger of auto-deleting.

Until recently, we would be reluctant to even discuss this feature — in the wrong hands . . . auto-delete can indeed prove dangerous.


Pro Tips:—
Use the Source tab to hunt down those very unique keywords from your spam messages.

Do not constrain yourself just to filter conditions such as From and Plain text — try other conditions like the following:—

• Entire message
• Reply-To
• Return path

Hi,

Thanks again. I have filtered out spam previously on the basis of 'Reply To' and 'Return Path', but on this occasion the first one is blank and the second one contains random characters. I have tried 'Entire Message' with this spam as well to no avail. 'Body' is another filter that never seems to do anything. I can't access the source tab as I'm on the free version of MW.

I have had two more spams come through with the same weird subject font, but different names in 'To': "Makita Power Drill Rewards" and "DermaCorrect". For some reason, a To>>Contains>Plain Text filter works on those sender names, so I can't understand why it doesn't work on "Mcafee renewal"?

Cheers,
TE

[TrustFire]

Since you are seeing success with other keywords but not with Mcafee renewal, it seems that this might be due to some unusual formatting which can be viewed in its original form . . . only in the Source.

While creating any filter, it's imperative to copy the keyword/s from the Source of the message . . . instead of typing the same.

However, since you are running the free version of MailWasher which does not support full preview pane . . . you might want to examine the Source of any downloaded message bearing those Mcafee renewal keywords on your e-mail client, Outlook — (by right-clicking the body of the message) >> (and then . . . from the context menu, clicking) View Source.

ps:—
It's been a long time since I quit on Outlook — so . . . quoting the above step from memory (also, Outlook might've changed the way it lets Users view the source.

pps:—
To this day . . . Outlook lacks the capability to render the source of certain messages.