How create rule with word in from, but not in the from address

1

Hi!
I very often get spam where some special words are in the from header, but not part of the from address.
The from field is
“Poliglu” [email protected]
Since the from address always changes (and probably doesn’t exist), I have to search for the word “Poliglu” in the from header field.
PLEASE NOTE that I don’t want to search ALL header lines for this, only the from header field.
Create a rule e.g. “Filter for words contained in the from NAME” it is not possible in eMClient, or at least, I didn’t finde one yet.
Attached some screenshots what I tried, but that doesn’t work, because it only filters the from ADDRESS, but not the from NAME.
What can I do?
TIA

grafik

grafik
grafik890×105 62.5 KB

grafik
grafik
grafik1353×741 122 KB

2

Try this rule…
image

3

@sunriseal:

Thank you very much for your advice, that worked in the case when the word starts right after "From: ".

But what can I do if there is a different (always changing) text between the From and the word, like e.g.
From: “Intelligente Überwachungslösungen” [email protected]
From: “Beste Überwachungslösungen” [email protected]
From: “Gute Überwachungslösungen” [email protected]

If I add such a rule with
From: *Überwachungslösungen
it doesn’t work.

That’s the reason I wanted to avoid just doing a search for only some text in the header.

I made some tests:

  • your suggestion with “From: Poliglu” worked, since there is some well-defined text but
  • “From: *Überwachungslösungen” didn’t work. And if I’d just search for “Überwachungslösungen” in the whole header lines, this would work for “Überwachungslösungen”, since the probability that this is a valid work in the header is very small, but not for other words (for which I have no example at hand).

I think it would be a good idea for emclient, that they make another rule template like “Search for text in from name or from address”, where wildcards could be used.

Or is there another way I didn’t see so far?

grafik
grafik815×88 71.9 KB

grafik
grafik772×260 57.1 KB

4

Remove the *

Does not need a separate rule, just edit the FROM line to add a
From: Überwachungslösungen

5

Hi Al,

unfortunately, this didn’t work. The spam mail is still in the input folder.

grafik
grafik796×665 107 KB

6

That won’t work because there are no umlauts in the message code.

It will be encoded text, so something like
From: =?utf-8?q?Intelligente=20=c3=9cberwachungsl=c3=b6sungen

You will need to right-click in the message body and choose View Mail Header, then copy the text for the name part of the address from there.

And don’t add a wildcard. The Rule will search the From: field for the text you enter, regardless of what is before or after it.

1 Like
7

I was in the midst of replying that the problem may be the “umlauts”. when your reply popped up :rofl:

Thanks for jumping in …

8

Hi Gary and Al,

thanks for your advice.
I made several tries, but before I report, I want to add some helpful links for other readers:

https://www.webatic.com/quoted-printable-convertor

BTW: “Intelligente Überwachungslösungen” means something like “Intelligent surveillance solutions” in english.

Now to my tries:

First I tried if some dash-connected words are found. For this I took another spam mail with “Huusk-Messer” in the from field.
I tried
From: Messer
which worked, the spam mail was found.

Then the outcomes for the “Überwachungslösungen”:
BTW: “Intelligente Überwachungslösungen” means something like “Intelligent surveillance solutions” in english.

Quoted-printable strings don’t work, e.g.
Doesn’t work: From: =?UTF-8?Q?=C3=9Cberwachungsl=C3=B6sungen?=
Doesn’t work: From: =?UTF-8?Q?Intelligente =C3=9Cberwachungsl=C3=B6sungen?=
Doesn’t work: From: =?UTF-8?Q?Intelligente=20=C3=9Cberwachungsl=C3=B6sungen?=

Works: (“Intelligente Überwachungslösungen” as Base64)
From: =?UTF-8?B?SW50ZWxsaWdlbnRlIMOcYmVyd2FjaHVuZ3Nsw7ZzdW5nZW4=?=

Doesn’t work: (“Überwachungslösungen” as Base64)
From: =?UTF-8?B?w5xiZXJ3YWNodW5nc2zDtnN1bmdlbg==?=