Assistance with rules

I am getting a lot of spam messages that look like this
Clipboard01

There is another similar one from [email protected]

I am trying to get EMClient rules to delete the message permanently, I have tried a number of things but these messages don’t get caught?

I need to have a rule where the Reply to is [email protected] but EMC doesn’t accept that as an email address.

Any suggestions?
Thanks

The headers are (my email altered), note that the header also includes “from=email.vodafone.com.au” which I don’t understand either:

Received: from SY4P282MB1369.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:af::15) by
SY4P282MB1083.AUSP282.PROD.OUTLOOK.COM with HTTPS; Sat, 13 Aug 2022 20:16:39
+0000
Received: from MW4PR03CA0203.namprd03.prod.outlook.com (2603:10b6:303:b8::28) by
SY4P282MB1369.AUSP282.PROD.OUTLOOK.COM (2603:10c6:10:af::15) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.5504.19; Sat, 13 Aug 2022 20:16:37 +0000
Received: from MW2NAM12FT047.eop-nam12.prod.protection.outlook.com
(2603:10b6:303:b8:cafe::86) by MW4PR03CA0203.outlook.office365.com
(2603:10b6:303:b8::28) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5525.10 via Frontend
Transport; Sat, 13 Aug 2022 20:16:37 +0000
Received: from z574.zappie (185.99.132.47) by MW2NAM12FT047.mail.protection.outlook.com
(10.13.180.173) with Microsoft SMTP Server id 15.20.5546.7 via Frontend
Transport; Sat, 13 Aug 2022 20:16:37 +0000
Authentication-Results: spf=fail (sender IP is 185.99.132.47) smtp.mailfrom=amazon.com; dkim=none
(message not signed) header.d=none;dmarc=none action=none
header.from=email.vodafone.com.au;compauth=fail reason=001
Received-SPF: Fail (protection.outlook.com: domain of amazon.com does not designate
185.99.132.47 as permitted sender) receiver=protection.outlook.com;
client-ip=185.99.132.47; helo=z574.zappie;
X-IncomingTopHeaderMarker: OriginalChecksum:A1B1497D3445BDA3CC49B88048595404BCEE23AF222B0672700D9C2CD98A1438;UpperCasedChecksum:23F5DAF75812901FFECF667294D54697B78098E24D6B47DD5CA8F00A1F5549C5;SizeAsReceived:385;Count:9
Date: Sat, 13 Aug 2022 20:16:37 +0000
To: “[email protected][email protected]
From: [email protected]
Subject: “WARNING!!! System have detected (13) Viruses on your computer…”
Sender: “[email protected][email protected]
List-Unsubscribe: <[al12]@coolblue.eu>
X-IncomingHeaderCount: 9
Message-Id: a8e21ffa-02ea-440b-b95a-32a213f00830@MW2NAM12FT047.eop-nam12.prod.protection.outlook.com
Return-Path: [email protected]
X-MS-Exchange-Organization-ExpirationStartTime: 13 Aug 2022 20:16:37.4550 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id: 2df3d7b1-df45-46a6-f150-08da7d68b9da
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-Exchange-Organization-AuthSource: MW2NAM12FT047.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 8/13/2022 3:56:09 PM
X-MS-Office365-Filtering-Correlation-Id: 2df3d7b1-df45-46a6-f150-08da7d68b9da
X-MS-TrafficTypeDiagnostic: SY4P282MB1369:EE_
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 185.99.132.47
X-SID-PRA: [email protected]
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Aug 2022 20:16:37.1113 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 2df3d7b1-df45-46a6-f150-08da7d68b9da
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource: MW2NAM12FT047.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY4P282MB1369
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.9695915
X-MS-Exchange-Processed-By-BccFoldering: 15.20.5504.027
X-MS-Exchange-Organization-SCL: 6
X-Message-Info: qoGN4b5S4yrmAeNVLAMFDslnOcoUsFCaH3ZBO/myiGJanS2jv0IhcwRM4ZR6s3iFuw/qWnPsuCZ89FMYzdsKzoi5pKbOSuTenLiGxdWY1vqJp/rm3T9aRCrnzGiVw+IBkQqXqEsGOD5iSa0k09vXpIq5qaVZXe/MLLfclOiZvXp5zDB1x1HyJ+RMK4VoVo75yYnIshgXb1lNiq4MqoKc6A==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Microsoft-Antispam-Mailbox-Delivery: abwl:0;wl:0;pcwl:0;kl:0;iwl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000285)(90000117)(90002001)(91005020)(91035115)(91036095)(5061607266)(5061608174)(9050020)(9055020)(9100338)(2008001134)(2008121020)(4810004)(4910033)(10010002)(10005027)(9610025)(9540006)(10160021)(9320005)(9245025);RF:JunkEmail;
X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?lZb9FE3Eho5akPcG4F+V13Y3pJNqZ8hCN0Eoi1hz0TO/KUAaF52Z//xDg+ix?=
=?us-ascii?Q?QXtuQpOKlPSO5LxBRLABUXIDNN1ZF1gUIYB/S5N/8DYOfDkvKx57cSsPTjo6?=
=?us-ascii?Q?Pfyw5sAKoPGoI7fduNq/poaergsAGKzNefxZxVvAj/56NK3cyp3ijPn+E9Wf?=
=?us-ascii?Q?mEZ7bNOVmh7XnqUwT7/ou2ycCFwybnIYOrGXg12fzCXMh1WQokEsNyUhG0hl?=
=?us-ascii?Q?35Tnr0+IhPCv2sQXPs5xNpAsQcinBdA1NK0E47l3dRh0DRtn3IH4otSsLdyF?=
=?us-ascii?Q?aavn4QihPyIsJiLaszwbWkdvRdETwTIbvapOCjHneteRWk9zP5eaLL3Nux4L?=
=?us-ascii?Q?qi0579ir6MZVbGqCVjsVqdjL8URrkXWWZr+08sUfyfGh9PF7bYI+WURDQ/HO?=
=?us-ascii?Q?0gGvA/8OApRBzFr02tG7uKUz73lluHLzO1h6Rh/7XHpi4rN3LvJ+InX/8vQR?=
=?us-ascii?Q?VKuNDp2mjKaTe2dV49kdu3jzViSUly5FHfeMLlS0UAFYfnVcQI4YW6aag9hI?=
=?us-ascii?Q?73VO5+yUNvGHfozPHtBlsaw0jtd7DK4dRYndKL5PJklNlw3/d5ZCEiAbvIiC?=
=?us-ascii?Q?YmtH4fe6nF/CeOOqtPUpjhFyPdKauwaEljRr2PgKfmwpiegY9hXFosOEZypQ?=
=?us-ascii?Q?BFcgdo5HpGmHv38vyhISUwGN4TNPlGvGAD4HQA6HnHShrkHb5q1vjtuExwVj?=
=?us-ascii?Q?PPNWA2GarX9N3yvKaAmFQxdZBAUMC7pffeq84H5FWhfFe740mfYl8W6vyCwe?=
=?us-ascii?Q?scSfYHvtafU49ZqNs+U88Ox4gf1buuERZ33YwKQ+iUvYB6UxLGjGf6VWt9mH?=
=?us-ascii?Q?6xJpJ4Q9LE7z++0Gjhv6hSMwUqm0ZbfFJDkU4CuQqkQyrc0bLQ+ZphECe8Up?=
=?us-ascii?Q?B5hrYi7oTGdR1PX3hh5Be0bsp/vtM0Yp1nHTBUhe+iPBZC6hlja0iVhP79Ab?=
=?us-ascii?Q?J3VlLTZdN/qP8stJpSJnuFsqG1kj/LX/pkhk5cx0UfR4FXiA+RMC41ajHczB?=
=?us-ascii?Q?sJ/b+q4PDViEnOWbIzWa+MfySb5FUXvQAUuB6PsztTfJK/eH+IS3DazG3gST?=
=?us-ascii?Q?2JLMMdz2/spzQ9HQ0j+t3mS13316Sg62h5mbU0BHnrBTiM2+J68EXMSsNuZZ?=
=?us-ascii?Q?A3PzkU0yc49r46odYuj+UwAFLhe3U5WiX01BquyxFNvZ6+B64pm1hArsfcy/?=
=?us-ascii?Q?BEAXTNN1TFM4jcTchHsh2qcIebVPb5YKFtlTThpEqZH7bK70+fRAiJGMF/Lz?=
=?us-ascii?Q?BmkdTtscqYJ3CfTtNnYVhn9ZzJkJiwgxfyC5ToZBsvv+mE4oJFpnwxBSbVok?=
=?us-ascii?Q?zUMtYUfJNooNSJE0LUqIaJNB56Z8BdAJdV2G2W2y09G+HxYxTY2+j8cOBCTf?=
=?us-ascii?Q?ASwKEF39rIgV71asHri6A4yjVnZ+3ASlSikLnPfpRi277m54191R8afsECAG?=
=?us-ascii?Q?Zp4u7ezRhXAkv26C+13HucvmfyZeJsESheTb6vlEqoogs99AiuHEmLtwVlRl?=
=?us-ascii?Q?Ez6q1z/qG2relcqNrCvGc+R45ouQBIChUi8Z9t7yRxTNkkYTghsN1oN25q8t?=
=?us-ascii?Q?BR8/piexHMKOBFUcG9fHw/FDKzU3fCbvWh9KHV72Obs16zQBD/gr8yF9qdT7?=
=?us-ascii?Q?GtHpBOB8+v+Q+3iUkmtT+8gMODl+/XYb0sztuYFtk9MuweagRxJkk78/E8Tm?=
=?us-ascii?Q?V8GUotSozxmm/uh1fFd87tYAONpHTQmCOE1HypFguAi9kCnGHOWwyndeuTpv?=
=?us-ascii?Q?ZQxuyhSkHhvpDmHstEy0+LsHYFQAzcB5mgyrPEHasZagl906DPBSU4j2xHn7?=
=?us-ascii?Q?QGxrUAD3yMa19K2fkqiMWESHEmVv6gr3c8a0fFVx9z8vbemuivAELm9DQQp5?=
=?us-ascii?Q?8zpHDLdoPGPk8sujSHH+Z9gcH8B+DIJykLiNlrnkQfiV16kZTqR7zOaUSdQF?=
=?us-ascii?Q?VO+lL/i5oaVZxYvxDCBboREsKjeYY+xKUSB1zCyVm39oTfBoVOkwf0I7kR16?=
=?us-ascii?Q?60oGwxhJllRUZv/vPXOd/rBVYf+gKIJpTLdVh3OUUCc12kYRr5J8rWsmNTBv?=
=?us-ascii?Q?vZlQ6Iw/oUzkpqBkGeMsk+cJnjA5uJULjsPw+DF768Nj4plLDwr7w+z6mL13?=
=?us-ascii?Q?UX9BYidvtCq7QuEC2KRAIFr+xCndSjTAuvel5ggpbQw12z0n/LXHbTel5B9F?=
=?us-ascii?Q?D+k0GXirjfvzrRtEOUOB79UWdMSVKnFUfAHsniog9TUKDce3bQR0Ttuwxdar?=
=?us-ascii?Q?zXT3MR+OTcVoV/9pVd7YEz6XZhjJ8QZ3uxfpIULR9t+7Afs1ny30O93Txu/p?=
=?us-ascii?Q?zecWQF0y9KtBxgfenOIl8eyZOjA06/oF52oDmSfZ57s6LqeaD+7vGAXGSrPY?=
=?us-ascii?Q?+seyC9pOt2BZFIkgGkOdk0UfIGeO3/0qvtLR0BbGRTRP8B2Y6/IlzZdPJ2PL?=
=?us-ascii?Q?UtVZAdbyrHWUXkdJO/QWcQaJOu0L7StfPjhLkEM4nKBFFeW8VA2ccHtesAl/?=
=?us-ascii?Q?3R95JBI8+NJo41MJXg8fhuqYev5BJFkWftJ7ivn1gKrJIaRMOQM0ledHMMAU?=
=?us-ascii?Q?1yvQBYy0tRSk3V/sOqUR4lJnSQ2MJS38e4sBZKmJoxvcFYg7aZuOlKXikkqy?=
=?us-ascii?Q?U5JRqTAu2qdu+YL5qO6zdKqNP7wpYOBtaapKVAU1pah1?=
Reply-To: [email protected]
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

lunes 15 agosto 2022 :: 0901hrs (UTC +01:00)

Hey @John_A

First thing is that eMC does not have a Spam filter and reacts to any filter on your mailserver that you should be able to adjust by using your browser to log into your webmail and correct or adjust any Spam filters there.
Second is that eMC does to accept [email protected] as an email address because it is not a correct format email address.

In your Rules you will need a Rule:
After message has been received
From ([email protected]) or what ever address you want
move to where ever you want - be careful that you know that the email is not valid
Remember Rules only work automatically as a message arrives
After that you need to:
Manually Right Click on a particular folder select apply rule and follow instructions

¡Buena suerte!

¡Saludos desde Valencia la soleada en España!

skybat

[email protected]

Hablo español, luego portugués e inglés, con conocimiento de varios otros idiomas.

Thanks for your response Skybat.
I am aware that I can’t stop spam.
I have tried a few email Rules but they still seem to get through. I will keep trying!

If you show us a screenshot of a rule you created that did not do the job along with the ‘from’ address, perhaps we can make suggestions.

Thanks sunriseal
This is what I have. To test it right clicking on the folder that has some of these messages and “Apply rule” - the messages are not recognised.

The from address in the email headers says
From: [email protected]
Sender: “[email protected][email protected]
Return-Path: [email protected]

So I can’t use the nobody address because it is not a valid email address.

When I create a rule, I always reference the email header and move the message to the Junk folder, so I can ensure that I am not accidentally deleting a legit message.

image

Those words “found in header” nailed it, thank you for your help.

Glad I was able to help.