Forum Discussion
Solved
How to block spam from uknown sender
Does anyone know how to block spam emails with a hidden sender? The text in the email is images, not text, so cannot set up a rule with text combinations. The sender of the e-mail is not listed. If I...
- After much trial and error I found a solution to the spam. TV 2 was hacked some years ago. You must make a rule: the message header contains "do not reply @ tv2 . no". Add action: Delete
I have begun receiving emails with no sender - i.e. there is no "From:" tag in the email header. As a result there is no way to block these based on the sender. Here is a sample where I have changed the "To: address.
Subject: Explore Power Saver ------< this varies according to the email
Content-Type: text\/html; charset=UTF-8
To: email address removed for privacy reasons
Date: Fri, 8 Sep 2023 18:41:15 +0200 (CEST)
Content-Transfer-Encoding: 7bit
X-ClientProxiedBy: FR2P281CA0155.DEUP281.PROD.OUTLOOK.COM
(2603:10a6:d10:98::15) To PH0PR17MB5679.namprd17.prod.outlook.com
(2603:10b6:510:c7::17)
Return-Path: oyposit94@hiastir.space ------< this is different in all the emails
Subject: Explore Power Saver ------< this varies according to the email
Content-Type: text\/html; charset=UTF-8
To: email address removed for privacy reasons
Date: Fri, 8 Sep 2023 18:41:15 +0200 (CEST)
Content-Transfer-Encoding: 7bit
X-ClientProxiedBy: FR2P281CA0155.DEUP281.PROD.OUTLOOK.COM
(2603:10a6:d10:98::15) To PH0PR17MB5679.namprd17.prod.outlook.com
(2603:10b6:510:c7::17)
Return-Path: oyposit94@hiastir.space ------< this is different in all the emails
- Return-Path: <oyposit94@hiastir.space>
Received: from p-impin023.msg.pkvw.co.charter.net ([47.43.26.178])
by p-mtain012.msg.pkvw.co.charter.net
(InterMail vM.9.01.00.037.1 201-2473-137-122-172) with ESMTP
id <email address removed for privacy reasons>
for <myemail.aaa.com>; Fri, 8 Sep 2023 16:41:25 +0000 <----- my email removed
Received: from NAM10-MW2-obe.outbound.protection.outlook.com ([40.107.94.119])
by cmsmtp with ESMTP
id eeXsqPiz288hIeeXtq3Qxc; Fri, 08 Sep 2023 16:41:25 +0000
X-ORIG-RCPT: myemai.aaa.com <----- my email removed
X-Authority-Analysis: v=2.4 cv=X6xBlUfe c=1 sm=1 tr=0 ts=64fb4eb5 cx=a_idp_d
a=pcZbq/Czls1RnxiNNJ7FXw==:117 a=L9H7d07YOLsA:10 a=xqWC_Br6kY4A:10
a=IkcTkHD0fZMA:10 a=zNV7Rl7Rt7sA:10 a=LgbbgE7IZXAA:10 a=xeEEcqi1AAAA:8
a=c-EomDhvUlSTl642KigA:9 a=QEXdDO2ut3YA:10 a=-FEs8UIgK8oA:10
a=80W_qOX57MptQvmyMb-l:22 a=Lcw6dl7kLhG240Z2xKZo:22 a=poXaRoVlC6wW9_mwW8W4:22
a=45HF0pJPDL8m8Mht7vmy:22 a=bp8_K2k7ypm9ROrWSas-:22 a=p-dnK0njbqwfn1k4-x12:22
a=w-psBPLDDiCXbaeKGOsM:22
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=AIIKlV7SmK3s0VbNEkei/hyMCwSqMxHz+gBjLFH7AlP9c2DWz0ymg+SXdiIzqbV9FM2POt3YOCsRxFdvhYSzuuphr2hnJtBgnOVvHGryM5VqCP6+XlwEfnVuXZmyiAD6rHPjngDUU/7NEo7/q0cFss0YmkJXy8T8mYozcxAg5yAP3IaH5taTp8+bSnCaqHYrI7JyG/mxir4NAYRkG24l78OjwZd0wtvkGC/Bfjhql06vX1ky96gm46aQrTcn6yZsrreDyQ74thxYf9PvnaWWzi127a+E2mB/4ETxWcdFVKdGEO/5JbGzOahip92aJzAPiooyk42EsoYM7Z4MXPz3Fw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=23T1VesmouypyP8cQk6Tj7HVorixyP+3yGq9JRVdRh0=;
b=eYNT9s/PciHKEMXE9TffWVqBOBMMjQPZQJ8ke4BTZDoWV4p/FikRKpttw+Idqtdg7A9Nik9hts+eNXcp9WBx7QlP9RXIOv55dNW0srlLNguPc+UWZM93loB7ZaVokZSxItOyuQh5ET0rnwoG4Pmk7T34gEXmpB4fwvA3p6Zy/dxVk6BWlv6CsQQyUOKn77O9HYSG7uGvBTQ/GOPhcA3UyL1k7WLTNtVSI9upsYQqste9k6vKFx0bXihEquadM6CPMxbLBjbML6izLIwZm8nhvLIg6luMOPKXzATFRd2tz97K3YXIJaFPSLGgH3h8BlOlCccteCnx1di03HKRMB44RA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=hiastir.space; dmarc=none; dkim=none; arc=none
Authentication-Results: dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=hiastir.space;
Received: from PH0PR17MB5679.namprd17.prod.outlook.com (2603:10b6:510:c7::17)
by DM6PR17MB3788.namprd17.prod.outlook.com (2603:10b6:5:256::15) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6768.30; Fri, 8 Sep
2023 16:41:22 +0000
Received: from PH0PR17MB5679.namprd17.prod.outlook.com
([fe80::6f56:9f13:3156:8b35]) by PH0PR17MB5679.namprd17.prod.outlook.com
([fe80::6f56:9f13:3156:8b35%4]) with mapi id 15.20.6768.029; Fri, 8 Sep 2023
16:41:22 +0000
Subject: Explore Power Saver
Content-Type: text/html; charset=UTF-8
To: myemai.aaa.com <----- my email removed
Date: Fri, 8 Sep 2023 18:41:15 +0200 (CEST)
Content-Transfer-Encoding: 7bit
X-ClientProxiedBy: FR2P281CA0155.DEUP281.PROD.OUTLOOK.COM
(2603:10a6:d10:98::15) To PH0PR17MB5679.namprd17.prod.outlook.com
(2603:10b6:510:c7::17)
Return-Path: oyposit94@hiastir.space
Message-ID:
<email address removed for privacy reasons>
MIME-Version: 1.0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: PH0PR17MB5679:EE_|DM6PR17MB3788:EE_
X-MS-Office365-Filtering-Correlation-Id: baedb473-f872-45c8-9bc4-08dbb08a6ec7
X-MS-Exchange-SenderADCheck: 2
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
1xtDL3PhbZRGv0U7+4juvzLyi+hUP6iPTneqbnIBGGtPSnc5aB25Ssin8qEyZgUCsi0rDtmGkZcZTLMENpQJKuzZcK2JoEs7qDHVhcx9FjEZFrdVOpEHxzLPLeUa3fbAQBbwg80LtweNnBHPxSif8V9QxamH3VhrSXhxI++8gmMjaJNSUchpMn1CId5oBiEx6z75AewJP3S42E8DWLfIfiZjl2IVw+F3GYmbErfua6OI0I5pI5nrjMl1pwkrMZbO8ai+UQNXthKmImdDU1ecUlLadh69b1Aib0I5KLfKdQ+6XO1PIvsTKHVIfigcJudyFZjeOWW5Jw1ab0wehc7yu6AJDS4fGuLSQ5kEeSDmvIvEPdF0yz4S31IYHZGe8VeZLZvNuU/NoXCncZBHkuRJ0g==
X-Forefront-Antispam-Report:
CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH0PR17MB5679.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(136003)(346002)(366004)(396003)(376002)(39860400002)(451199024)(186009)(1690799017)(1800799009)(26005)(42882007)(52116002)(9686003)(4270600006)(6401799006)(6666004)(7696005)(66556008)(2906002)(3480700007)(478600001)(316002)(786003)(43032004)(166002)(38100700002)(38350700002)(66946007)(6916009)(41320700001)(33656002)(66476007)(41300700001)(55016003)(5660300002)(558084003)(8936002)(8676002)(7116003)(52536014);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
=?utf-8?B?VTVMcDBpWGVnaTBpVjZDcmFPUmJ0RFBNck13aGhVanV4Tnptc2FpdkhDOGg1?=
=?utf-8?B?VzQvVkE4UGt3WExGVWlncWlCNE85d2pwR0lqWjJLcEtGWGdVaFdwZ3hRS05q?=
=?utf-8?B?K0NGVXNFMitHMDZxZlV4N1JrMVlGeGVaTjZvUzN4TkJ6VjJQcnVsTkkzWVUy?=
=?utf-8?B?aVZtenlWVlBFb3U2Tmo4UnRYTEl4TUVCSTBIbzhPTDNuNlNrdWlVRkl1SFNk?=
=?utf-8?B?WGovVTdDa3dXZU0xZ2cvdno5TG1DYUR1dGZoRXNoUjBIOWtMMUZOVGdWaEVZ?=
=?utf-8?B?WGwyWmFKSnpMWHVNdWJoWXpueFZwdFk4NEtKTmNrU0xmOU5NWUVOZTYwcmgz?=
=?utf-8?B?MDVmMmt5dXQ2akxoaEhLNzZjSmRXSDNTdjRrdUpkMEsxbUJtWjlkMHJxUlpU?=
=?utf-8?B?NHJiei8yY1g3Y1htSFBPQytETlNUYStTL0EyTGlVYkxFUmJObmlIUHRmVkU2?=
=?utf-8?B?SHBseE9HSEUzTm5hd3k4aktTeC9Ed1RYaGxlaTE3Z0hDWGtaL0VqTEFXZ0w0?=
=?utf-8?B?amJKV0E4blVxb1hhMUpWZlJBUzU1Q2xUU0tUeFpLMS9ubnhkLzVvckFzRXV0?=
=?utf-8?B?TTFWemRacCtEb1dzOVFJTnB6RUYwYm51S1BkZkd3NG54Rkd1MEl2WFVFZ3BW?=
=?utf-8?B?WFkyYk9hUjhueFBJYTVYY0FRTksxZVBOK2sxdHJVSG51ejRaei92WkNZTHM1?=
=?utf-8?B?SFJMK0ltbHBQTVNmeWVzcmpuTHlkUHh3OUtES0V6UnJpMWNpNjN3KzZaZENW?=
=?utf-8?B?T0V6TDR3b0NEMGQ3dVZrNGRzNCtsdUpyNVJmd3l5Z2tqNWZncVF6UEtIUURT?=
=?utf-8?B?Vm1RTnBlanJKbnFvSmdNVHpBcEJIMU9HS0t1bEp4Q3B1R1RKVG1GUFhUYm93?=
=?utf-8?B?cGdqbkRpOXFqejZqTVpKQWNBVlRXeUgzeUwwMFptUGtLUjBCTDlqL1dLWWQ4?=
=?utf-8?B?WGxDM3RveXB1S3NBWGxia1Y2akJzdzNTNTRpWlg3bXB0NkNSK3kxbVJsNEZz?=
=?utf-8?B?Z3RjR2tHcEJpZm05aDN2cWxuSFBHVG1qcFNNdFZ4cWtUWUlCTm9QeHdrMFIx?=
=?utf-8?B?RUNobzN4K0NlQTVmUGdxRHZ6NWJ2SXkra3NJR3ZBd014cWRGZTU0S0pxNjVv?=
=?utf-8?B?Z2pncUh1M1ZVSTZ4c2pnZUtFRTZqNFg3Zk5USVpsZGJtVVVyVWRJRmQvUnFU?=
=?utf-8?B?SVZrSk50ZkpDc1l1aVU4VWlWSWFWNG04SHFXZkFneGdrb1IvTmQvV3ROQ0U5?=
=?utf-8?B?VUw4OURXcnhuSTEwbEN2ZUJpbHcyZ24xQ0IzMlZkQnh1NjlnMVNYQk91dU1S?=
=?utf-8?B?S2RLcXZNOEZSQjROcDhxa0ZaWTJjSHdrS3lSUmNobGpqeU9nL0ErMDNKK3Z6?=
=?utf-8?B?U0VmZWhROTRUd1BodDRBSmsxR01zbHZXMmttWUMwL2ZldURJb3RIMndRdDJM?=
=?utf-8?B?VWxOamxxNzNqR2k0RFRPKzRyanp0Qms2c2E2U25FbEltQVptYlQwYnlHejN6?=
=?utf-8?B?WmR4NEZJaWF3WFBsRElQWHphY1Rzd2NiVnI3b3podFE3NmloSVlJcmF4ejJn?=
=?utf-8?B?MStndStTcEsvY0F4ZGtYb1Z3RjFFSG1yb2c0QWh1WE83RXFCV01VOE05MkZJ?=
=?utf-8?B?ZGw5a0t1VXdwSjFMZHhTQmdRUmpsdnhBckR0dHlhM2lKN2NzQ2IrMFQ4TWJJ?=
=?utf-8?B?VXZBTVk3V0NrYmJqSVFDSm4rN2JROHV0ZzJPMmtwYlQzdGVtZ3J2UlRSUi95?=
=?utf-8?B?aGQyMU1vdGk0di9pN2pFR2hmaTVOM0ZKRGFpRU1US1lBc1dDSWk1Wks1eHE1?=
=?utf-8?B?OUVqSkc1aVZFd21zUW1iUEpkTDJxL0NKK2RwWlB0Z0FYaGFaYnBST3kxTmwr?=
=?utf-8?B?Z0d6SkdUNThkTnJVWmNKY0xocW1NQndEZDQ0Ty9YV09GSE51ZmlrZHBRSnV4?=
=?utf-8?B?c1U2RzBTWXE5WmZlZmZFbjM1VWNIMVhhM3lZbnlNMU1mNG92Wi9DT0dUOW5D?=
=?utf-8?B?N3hHSEdPVTR3d2p0cFNrekVxM0s2eDlDb2NlQXIvNnpTVXM0TyttK1hzc1Ba?=
=?utf-8?B?aUh4TmJpSDFNNkVTS1BFTktwREwxK0xzMWE5M2E2dXRjVUs0aEVTTVgwUlVU?=
=?utf-8?B?NndPMWRoUDRoZnRYTkNWRkdJNlppbk9mUllyM3l4UVNPQ0NwRHd4dk00ZWMx?=
=?utf-8?B?S3c9PQ==?=
X-OriginatorOrg: hiastir.space
X-MS-Exchange-CrossTenant-Network-Message-Id: baedb473-f872-45c8-9bc4-08dbb08a6ec7
X-MS-Exchange-CrossTenant-AuthSource: PH0PR17MB5679.namprd17.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2023 16:41:21.4633
(UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3ae51184-dddc-4730-90a8-0c5559f1db72
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 2/ycxNYm94stYcDMkUZFw7DYJTtHTtGV9mK/NcvbR2DUR7DYxrSY3UJx8SLTnR4m2LyD6yqf8hku7fFnK7eHIQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR17MB3788
X-CMAE-Envelope: MS4xfKjh6GQGAVLTZg8dPiChorqN0OHENQoG+dMN8zLWp+lO97UOsQJ6jAAx2As2I9mrYfE16JLYuxQgIZ/v1tz51Vyylqo4RJ1BiYH0N+6MwDO7CbYbpmjS
eP6Kg+o3/h7vgd/jMCP8jzGWkc4qfgxDFSrFuWMpj1Bb7w5RKs+N2SZSOM+QP8L4AQIY8RpFBbPQz7Hihm5RTyE1+egEwg99rhX5/CTchd53f6MpPsCRAr5BAt this point what I am seeing are solutions based on finding a string in the header that can be used to select emails to be discarded. What is needed is for Microsoft to automatically delete all emails that do not provide a sender in the required format in the header. Anything else is a user patch to get around emails that violate basic rules.
