5

Lately I'm receiving a lot of spam that contains animations in the subject lines. Here is an example, from the source of a message, of a subject line containing animating fireworks.

Subject: =?UTF-8?B?876toA==?=Zero APR. No Credit Required. No Spend Limit!=?UTF-8?B?876toA==?=

I'm trying to create a Gmail filter that will automatically delete these kinds of messages with the fireworks in the subject line.

But I can't get this to work. I've tried filtering on subject text such as: =?UTF-8?B?876toA==?= or 876toA==

but this doesn't catch these emails. Does anyone know how I can create a Gmail filter that will successfully match these messages with special UTF-8 characters?

* Update 2015-07-27 * See here for an example of the full message source for one of these spam emails. I've replaced my name and email address with '[redacted]'. https://gist.github.com/anonymous/cfd57dcf6d3e87203295

  • After my attempt to reproduce the problem I find that in the original message the =?UTF-8?B?876toA==?= is not in the Subject header, its in the X-Goomoji-Subject`. @Amit posted the answer that applies to this question in another one, so I will vote to close this one as duplicate of the other. – Rubén Jul 24 '15 at 13:59
  • I already replied to @Amit concerning why his answer won't work for what I'm trying to achieve. My question is not a duplicate of the other one you've referred to. – MexTek Jul 24 '15 at 14:34
  • If you are right and your question isn't a duplicate, the you should edit your question to make it clear if the UTF code is in the subject header field or in the X-Goomoji-Subject header field. – Rubén Jul 24 '15 at 14:36
  • Even better, add the whole original message, only mask your email address. – Rubén Jul 24 '15 at 14:38
  • I copied-and-pasted the line of interest straight from the 'Show original' view in Gmail. As you can see, at the beginning of the line it just says 'Subject:'. So what I posted is accurate. – MexTek Jul 24 '15 at 14:41
2

You can use Google Script to perform exact matches in Gmail.

See: Advanced Gmail Filters with Apps Scripts

function filterGmail() {
  var threads = GmailApp.getInboxThreads();
  for (var t in threads) {
    var subject = threads[t].getFirstMessageSubject();
    if(subject.match(/REGEX HERE/) {
      // DO SOMETHING
    }
  }
}
  • I had found that link previously when doing a Google search on this topic. I don't think it will work because it runs periodically and only after Gmail processes the messages initially. These spam messages I'm trying to automatically delete do get identified by Gmail as spam, so what I'm trying to create is a native filter to delete them first, before they get analyzed by Gmail to determine whether they're spam. – MexTek Jul 23 '15 at 9:09
  • @MexTek, Just curious, why do you want to delete it before it gets triaged over to Spam? ... Also, would you mind adding the whole original message, with your email address masked? Maybe something creative will come to mind if we can see it. ... One more question -- does the subject display differently depending on how you view the email -- e.g. phone, computer, browser, email client such as Thunderbird? – aparente001 Jul 24 '15 at 21:32
  • I've just received another one of these spam emails. I've copied the full source to the below gist, replacing my name and email address with '[redacted]'. gist.github.com/anonymous/cfd57dcf6d3e87203295 – MexTek Jul 27 '15 at 12:14
1

Filtering spam by matching exact strings in an email has been a losing battle for years. When you add one string to filter, they just switch to using a different string. Services such as Gmail use bayesian filters and machine learning which can adapt to the new tactics spammers use. Instead of trying to filter the UTF-8 string you found in that individual message, report it to Gmail as spam so their adaptive spam filters can learn to flag future messages of that type as spam.

  • 1
    What you're saying is valid, however it doesn't answer my question about how to actually match that particular character. I've been able to create filters that delete many emails that I know for sure are spam, saving me time when checking my spam folder for false-positives. The 'fireworks' character is very popular right now in spam messages and I'd like to create an explicit rule for it too. – MexTek Jul 22 '15 at 22:21
  • I did look to directly answer your question first. The base64 evaluates to 0x0feb60 or just 󾭠 (not sure how well that will show up in the post) but filtering on that character doesn't seem to work properly in gmail. I tried urlencoding the individual bytes, and even tried urlencoding the UTF8 string, but it never seems to exactly match that character. Gmail converts it to an image tag for mail.google.com/mail/e/B60 for display, and you might be able to block the character itself with adblock, but sadly, I couldn't find a way to filter email based on that actual character. – Moe Jul 23 '15 at 20:13
  • I appreciate the follow-up comment. Indeed, as I research this more, it seems to be impossible to filter for that character (and others like it) using Gmail's built-in functionality. Alas, there may be no solution for now... – MexTek Jul 23 '15 at 20:30
-1

If you don't get any legitimate email with UTF-8 in the subject line, then you could create a filter that catches everything with UTF-8 contained in the subject.


Here's how: Go to Settings (on the right, near the top), then choose the Filters tab. Scroll to the bottom, and click on "Create a new filter." In the Subject part of the form, type UTF-8. Now click on "Create filter with this search" (bottom right). Check "Skip the Inbox" and "Apply the label". For the label, you could use Trash, or you could create a new label, such as "my-spam." Or if you're very sure none of those messages are worth reading, you could check "Delete it." When you're done checking boxes, click on "Create filter."

  • So how do I do that? – MexTek Jul 23 '15 at 9:09
  • 'UTF-8' is not text that's visible in the subject normally (it's only visible when viewing the raw original) so that won't work. See my original question for strings I already tried filtering on. – MexTek Jul 24 '15 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.