Many years ago I began receiving spam from a source that always uses the same email address name but each new message is sent from different compromised email account.
At the time it first became a problem rules for FM accounts permitted dodgy messages to be discarded. FM changed its tune on that policy and henceforth it became necessary to create sieve rules to achieve the same effect.
I created sieve code to discard messages from this sender in May 2021 and tested it successfully with FM's sieve tester. Today a message from the same spammer got through to my account. I tried the code again in FM's sieve tester but the result was "keeping message", not "discard".
I suspect FM's handing of user account sieve code has changed. I'd like to alter the sieve code to get it working again.
The from line of the spam messages in question consistently have the following format:
"Flypaper Media & Publicity" <compromisedemailacct@company.tld>
The sieve code that used to work but now does not is:
Code:
if header :matches "From" "Flypaper Media*" {
discard;
stop;
}
Hopefully this raw snippet from the message received today is relevant to any guidance offered (personal details edited):
Quote:
Received: from PSAPR04MB4261.apcprd04.prod.outlook.com
([fe80::e882:704d:5174:cd32]) by PSAPR04MB4261.apcprd04.prod.outlook.com
([fe80::e882:704d:5174:cd32%5]) with mapi id 15.20.4909.010; Thu, 20 Jan 2022
06:16:13 +0000
To: "myFMaddress" <myFMaddress@FM.tld>
From: "Flypaper Media & Publicity" <compromisedaccount@outlook.com>
User-Agent: ProfiMailGo/4.30.34
Date: Wed, 19 Jan 2022 23:16:21 -0700
Message-ID:
<PSAPR04MB42618A8D19445A93D672F71DB25A9@PSAPR04MB4261.apcprd04.prod.outlook.com>
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_6E72_2D58879B.1C148181"
X-TMN: [iZo3YKoR4iM8AoGVmwZr1wpazy9Q9pvm]
|
Assistance to create sieve code that would discard these messages would be appreciated.