No From Address So Unable To Mark As Spam

[Wizcrafts]

I then went to the ISP website to look at the mail. Oh wow! It gave much more information that is well over my head and I am not sure how to even send it to you.

You probably forwarded the email as an attachment. Doing that preserves the original incoming headers. I tell and instruct people about how this is done when they need me to trace the origin of a scam sent via email. Another way to obtain the hidden headers is to check the box to report the email to SpamCop.net. This is done through the MWP Inbox interface. You will need to setup a reporting account first. You'll receive a unique ID that gets inserted into the messages you forward to them. SpamCop will make the original available at a click of a link. This includes ALL of the hidden information.

[Duck]

I didn't forward anything. I just looked at the email on the provider's site. I do have a spamcop account. Thanks.

[Duck]

Happy Friday Gingbat,

Never heard back from my ISP even after they assigned a case number. I've tried to use wild cards using the instructions from a different thread that you and RusticDog was on. I tried to recreate the [a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,4} filter. The email spams are coming from an address similiar to [[email protected]] and [email protected], where the .de and .pl parts are the only constant. I tried *.de, *@*.de and *.*de but the spams keep getting through.

I did notice that there is a SOURCE tab on Mailwasher. Would that be the same SOURCE that you wanted from within Outlook? As it is now, I have been using the Mailwasher SOURCE to identify the "sender" and manually putting that in SETTINGS--SPAM TOOLS--BLACKLIST. That is a pain to do with all the spam emails since Mailwasher will not accept a right click and "add sender to blacklist". I can keep doing this but they keep changing everything except for the .de and .pl parts and its becoming time consuming.

Thank you for the support.

[gingbat]

Yes, using:

*.de

In the blacklist as a wildcard should work, however if the FROM address is actually blank when you check the source in MW, you'll need to use a filter, and if so, you wont need the star, eg just use simply:

.de

Anywhere in the header, that 'should' work....?

If not, then yes, please send me the email in question so I can see why this filter is not working for you there....

To do this, open MWPro and click the "Show email info" link just above the preview pane, (Click View>>Preview Pane if you do not have this enabled) then click the "Source tab.

That will show the raw text of the email, copy that into a new txt file (click in the email and click ctrl A to select all, then click Ctrl C to copy) and send as an attachment.

NOTE: how-too video here: https://1drv.ms/v/s!Ak8zLigJcntT4l8m7NK ... S?e=koBdby

Cheers!

[Duck]

Thanks again Gingbat,

I sent you the no from adress email. The From address is in the SOURCE. That is where I'm manually pulling it from to put in the blacklist. I'm trying the .de to see if that helps.

[gingbat]

Great, thanks for that and yes, this email has no FROM address at all, so try the below filter (works for me) and as a bonus, it would also catch any other email without a from address....

Filter for no @.jpg (84.06 KiB) Viewed 6435 times

[Duck]

Fantastic Gingbat,

Can it really be that simple?!!! I certainly hope so. I have already created the filter and adjusted the Spam Score.

Should I also delete the filter I tried to recreatefrom Rusticdog [a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,4} or does it matter? Will it cause any issues if I do leave it there?

Thanks,
Duck

[gingbat]

No problem Duck, and yes, no problem to leave there, but if not working, just ensure it's not set to auto delete in case it catches any good emails....

[Duck]

No From Address.jpg (120.45 KiB) Viewed 6385 times

Thanks again Gingbat,

The good news is that it looks like it is working so far, and I'm reporting the spam to Spamcop and my ISP via a forwarding of the email to their spam detectives. If I encounter anything strange, I'll be sure to report back here. Hopefully through Spamcop (at least), the spammer will be reported to their originating server and stopped or slowed down.

Do you know what the "Reporting" icons are? I suspect that the S is for Spamcop, but I'm not sure about the other...f? I also report to a third, but it is now showing up as being selectable in the Reporting tab. I'm reporting to Spamcop, Spamhaus, and The CBL.

Duck

[gingbat]

Excellento! and yes, S would be spamcop, F would be whatever is listed under Settings>>Spam Tools>>Spam Reporting, for whatever service you have listed there as per below screenshot...

spamcop.png (20.68 KiB) Viewed 6379 times

[Duck]

Okay...got it. Apparently The CBL changed back in 2021 to Spamhaus. I found this:

"Changes to the CBL

IMPORTANT TO ALL CBL users: If you were using the CBL to filter access to your mail servers or anything else, you will need to take note of several changes to the CBL that occured in January 2021. In short, the CBL infrastructure was replaced by the Spamhaus XBL structure, the lookup pages and access methods have changed. Full details on our CBL Cutover page

IMPORTANT! due to the above changes, new users wishing to use the CBL will need to go to for instructions on how to set up the Spamhaus XBL. "

I had already had Spamhaus set up so not sure how I missed this. However, The CBL is still showing up in the drop down list in MailwasherPro. The "f" was for Federal Trade Commission so at least they are getting the report as well.

Thanks again.

[gingbat]

OK sure thing, good to know ta... .and yes, sounds like you are all set now...

[Duck]

No From Address 2.jpg (153.34 KiB) Viewed 6204 times

***UPDATE***
Everything is still working very well. MailWasher Pro is catching everything with no errors (marking good emails as bad)! I am still using SpamCop and Spamhaus to report the spam. It does require some extra steps to send the reports, but in the long run, I hope it is worth it. I have also added my ISP's spam reporting email address. For those who have an ISP, check with them for their spam reporting email address, and you can add them to your reporting list like I did and it works great!

[gingbat]

Excellent!! good to hear all is well thanks Duck!