How to Block Spam Emails with Emojis in the Address in Outlook?

Question

I receive an overwhelming number of spam emails, and the email addresses typically include a check mark emoji such as the below example:

Currys Exclusive Offers<"✅Currys Exclusive Offers✅_____________________________87536501371885212225110">

My research indicates that there is no established method for creating a rule based on emojis in the address. The subjects vary, and the addresses are always a random sequence of numbers with an emoji. The content of the emails is inconsistent.

A method to block a specific emoji within the address would be immensely beneficial, as manually blocking these emails is time-consuming and they continue to arrive.

Thank you for any advice.

Answer 1

Dear Ben Widdup

Welcome to Microsoft Community. 

Thanks for your description, indeed, as you said, unfortunately most email clients, including Outlook, don't offer filtering rules based on emoticons in the email address itself. The challenge is how email systems handle and display these characters. Also, it seems that your email address is exposed to the public and someone can send you spam whenever they want.

I can see that you have done a lot of things to try and resolve this, really well done, and I really appreciate your efforts. From your description, you are facing a very difficult situation, and it seems that rules are not useful in these circumstances.

I'm sorry to say that there is no really effective and definitive way to deal with this issue, the following is just for your information.

---

Here is one thing that may be your reference is that I suspect these sender addresses are real, here are the steps to check the email header to find out the real sender of this email for Outlook.com or Outlook new, as some users give feedback that they don't get spam because they have blocked the real sender. This is not guaranteed to fix the problem, but it is worth a try.

1. Open Outlook.com or Outlook new

2. Select the message, and then select ... From this message menu, select View, and then select View message source.
3. You have now opened the email header.
4. Search for X-SID-PRA, this will show you the real sender address. If it's encoded, decrypt it with a Base64 decoder, which you can easily find on the internet.
5. Try to block the address of the real sender.

---

Also, there is one thing in my mind that in fact these spams have often failed with some authentication methods, so maybe we can create a rule for that, but they are just for reference.

You can try setting your rules as follows, for example:

Send to: Me

With specific words in the message header: Received-SPF: PermError; dkim=none; dmarc=none

Move to: Junk E-mail

Almost all spams do not pass these authentication methods when they send a disguised spam email, this information is in the email header, you can also use it to decide whether an email is spam or not.

---

This is likely due to a combination of inadequate spam filtering and the sophistication of phishing attacks. If the problem persists after following these steps, you may need to consider switching to a different email address and forwarding emails to that new email address and never share your email address on the public website.

I sincerely apologize for this inconvenience and thank you for your understanding and cooperation. I wish you all the best for your life and work. :)

Best Regards

Schale.P-MSFT | Microsoft Community Support Specialist

Answer 2

As per the MSFT response, here is what I did to stop these spam messages.

1. Open Outlook.com or Outlook new
2. Select the message, and then select ... From this message menu, select View, and then select View message source.
3. You have now opened the email header.
4. Search for X-SID-PRA

The X-SID-PRA will undoubtedly be base64 encoded, you can try decoding it using https://www.base64decode.org/ or similar, however, there will probably be non ascii characters in there which will prevent you from adding the actual email address to an outlook rule.

Here's an example

X-SID-PRA: =?utf-8?B?8J2XrvCdl7rwnZeu8J2Yh/Cdl7zwnZe7LU9GRkVSU0DwnZeu8J2XuvCdl64=?==?utf-8?B?8J2Yh/Cdl7zwnZe7LkPwnZe8LlXwnZe4?=

I needed to strip out the =?utf-8?B? to give me
8J2XrvCdl7rwnZeu8J2Yh/Cdl7zwnZe7LU9GRkVSU0DwnZeu8J2XuvCdl64

8J2Yh/Cdl7zwnZe7LkPwnZe8LlXwnZe4

Which is 𝗮𝗺𝗮𝘇𝗼𝗻-OFFERS@𝗮𝗺𝗮𝘇𝗼𝗻.C𝗼.U𝗸

If you try to add this as a sender rule it will not work as it has non ascii characters.

So, all I did was add a "Message header includes" rule with 8J2XrvCdl7rwnZeu8J2Yh/Cdl7zwnZe7LU9GRkVSU0DwnZeu8J2XuvCdl64 as the text (I didn't bother adding the whole string for my use case)

Action I **** set to "Mark as junk" or whatever you want to do.

This worked for me, hope it helps

D