[MlMt] Filtering junk mail

[Bill Cole]

On 10 Sep 2019, at 0:02, Harvey S. Leff wrote:

> I've been receiving multiple messages daily from China. Their text is 
> in Chinese and there are no images. I don't even know what they are 
> selling. The return addresses follow a pattern. Two recent messages 
> are from jdeefs1045 at 126.com and vsuayyn221346 at 163.com.

For what it's worth: 126.com and 163.com are 2 of the freemail domains 
run by NetEase, a major Chinese tech company. Unless you have personal 
acquaintances in China, you are unlikely to ever receive legitimate mail 
from users in either domain. Those domains are bit like China's analogs 
to hotmail.com and live.com.

> They do go into my Junk mailbox, but I don't know a way to filter 
> these messages further. Examination of their raw messages show they 
> were both received by a server, ajax-webmail-wmsvr124 (Coremail).

That hostname pattern in the oldest Received header of messages is 
typical of NetEase webmail, which uses the  Chinese webmail server 
software Coremail.

> However, if I search my mailboxes for this name, nothing is found, so 
> it appears that I cannot create a smart mailbox to snag these 
> messages. Any ideas?

1. Filtering on the freemail domains (126.com and 163.com) is likely to 
be more generally useful.

2. That specific name is one of hundreds (maybe thousands) of 
similarly-named webmail servers that handle all of the NetEase freemail 
domains, their business customers, and their own corporate email. It's 
mildly interesting that your junk all hits that one server but possibly 
just a coincidence.

3. MM  by default just searches "Common Headers and Unquoted Text" which 
does not include Received headers. You can change that to search any 
specific header in the Conditions section of the Smart Mailbox editing 
window, wbhere each condition has a drop-down menu listing the Most 
common headers to seearch and "Other..." which opens a selection window 
allowing you to choose literally any header MM has ever seen.

-- 
Bill Cole
bill at scconsult.com or billcole at apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)