I am assuming you are
not using SpamSieve?
You might try this:
- Select one of those messages
- Use the Mail->View->Message->Raw Source
- Copy the Return-Path text
- Place that in your Rule
For example, one of my recent "Harbor Frieght" messages has "richard25@info.marketingpro.cx" in that path.
The actual "From:" that shows in Mail is:
From: Harbor Freight Department <Richard258@info.marketingpro.cx >
Notice that there is a non-printing character after the "
cx " and that the email address has a capitol letter "
R". This may confuse Mail or other email SPAM catching apps. Email addresses are not allowed to have capitol letters and I doubt non-printing characters (return/tab/newline/etc.).
If you are allowing third-party images (
Prefs->Viewing->Load remote content) you will see a link with this bit of code:
<a href="http://linoleumspins.com/4CFaKX709WQYl73xsgddroztk ... 44/376738X9">
<img src="https:// ... ></a>
That is where your data will be sent (even if nothing more than your email is alive), should you click the presented link.
At any rate, I highly recommend SpamSieve exactly because it looks at lots of stuff in the header, the text and for <a href...></a> links. But if you want to make Rules, you can try looking for these kinds of things. Unfortunately, these bits of text may be completely unique to each SPAM. The more rules you have, the longer it will take to be checked.