Snowshoe email filter for Thunderbird
 

You have no control over the mail server?

Generally efficient spam blocking is done in the mail header, blocking regular expressions in the body of the message is slow and time consuming, especially if your refreshing your maildir from the server at regular intervals. On top of that, depending on how your mail client is set up, you may only be downloading the headers and pull down the messages when you select the header, in which case regular expression tests run against the body of the message will have no effect.
Why don't you post a header from a couple of the offending messages and maybe I can help you.

snowshoe filter ( cont'd )
 

I'll certanly appreciate any help!!!!!
I'm running Thunderbird 24.5 on a LMDE/MINT client

here's one example:

the spammers vary the subject line as well as the from address.
it's an anoyance really, as my Personal Friends e/mail address
is white-listed against a selected address book. this is very effective
but I'd like to exclude these drug-scam messages entirely. I route
unkonwn senders into a REVIEW folder which is where these drug scams end up.

http://napfn.com/snowshoe.png

I notice they aren't using character expansion to guess this email address, they know who their sending too.
(Hey Mike. I always check my posts and obfuscate someone@somwhere.com to someoneatsomewheredotcom.)

There is the IP range of RU-AVANGARD-DSL. Does thunderbird give you an option of "block by IP "range? How about the control panel options on the mail server? Third option is the hosting company your working through may have the blocking capability, let them know what's going on and see if they can block that range. 178.65.128.0 through 178.65.255.255

i thought about obfuscating my email address -- but -- the scammers already have it . i'm pretty sure they got it from a correspondent who just now started sending to my friends only e/mail -- using one of the big commercial freebe services
not that it matters *that much* : on this address you have to be white-listed to send to it.

i looked through Thunderbird for the options you suggested; no luck. I white-listed a couple addresses from the review folder though so this isn't really a pressing issue. I was just hoping we might know a way to get at these guys.

exit needed
 

what we need in Thunderbird is a plug-in that would allow us to pass the message text to a C program for scanning. The usual return codes would be appropriate,-- 0 for OK and 1 for junk.

we could really tear up some spam that way

Mike take a look at

tools->message filters->new and then under the "subject" drop down it has an option for "customize".

If you click it, you get a blank entry box, try to put the IP range in there.

this "snowshoe" spam seems to be distributed from a botnet: there is no commonality in the from IP range. the thing
that is common is a gross misuse of HTML tags in order to obfuscate the body of the message -- which would otherwise be
easy to catch with a filter. that's why we need to be able to get at the message source.

example

netnum: 178.65.128.0 - 178.65.255.255
netname: RU-AVANGARD-DSL

I was assuming that was the IP range they are all coming from.
If we can't find a commonality among the messages, I'm afraid your stuck

the nasties seem to have tapered off. if I could get at the message with a little C program exit I could count ( e.g. ) the number of times he used the span tag and when that is more than 6 or so set the error value in the return code... maybe relate it to the total length of the message as well
... the little C program exit would be fun to pass around as well in keeping with our great Linux Traditions