Esumsoft Forums

I have begun receiving emails with this address - *.ooo. The first part could be anything but the last part is always .ooo. At first, Pop Peeper would show me these on the server. I wanted to create a rule for them but couldn't figure out how to do that. Now several of these slip through every day and Pop Peeper doesn't even see them. They show up in my inbox having not been seen by Pop Peeper.

Hi BDinger3,

A few questions for you:

1. Is the issue you're having similar to one you reported back in 2015 HERE?

2. Which email account(s) are you receiving these emails in? (I.e., Cox, Gmail, Yahoo, Hotmail/Outlook, etc.).

3. Are you still using a VPN?

Other members of The Esumsoft Team will be along later to further review your problem and provide additional feedback.

Thank you & best regards,

I agree with Pete's sentiment that you're probably experiencing the same issue with hidden messages as you asked about before.

As for the .ooo tld, I did some research and it appears to be for general use. So you may only be getting spammers on it now, but it's possible that a "real person" could use it. And if no real people use it, the spammers won't have a use for it either. Basically, I'm saying that I'm not sure that I would rely on a filter that relies solely on the .ooo tld.

That being said, this is what I would use to create a filter to catch email from .ooo; what you do with it is up to you (general recommendation would be to weight it slightly [e.g. 0.5] as junk):
Copy that, and then create a new rule and use "menu: Edit / paste rule set" to set the basic rule. It basically requires that ".ooo" appears at the end of the email address.

Thank you. I'll try that and see how it works.

Bill D

The solution posted by Jeff has apparently worked for the .ooo spam address problem. This morning the same people used a different address (the three symbols behind the period) so I'm thinking I can just substitute those letters into the formula Jeff created in order to create a new rule. I'm not worried about receiving anything genuine from that address.

What you can do is copy the line and change the 2nd line's "ooo" to whatever the new one is; make sure that the "apply filter when these rules pass" is set to "any". This way, you just have one rule that can apply to multiple (but similar) targets.

When I say "copy the line" I mean that you'll have to manually change the 2nd line to match the first line.

Okay, so now the same spam is coming from ".online" address. Please see attached jpg for my rule. Does this look right?

Thanks,
BD

BDinger3 wrote: ↑Sat Aug 25, 2018 11:46 pm Okay, so now the same spam is coming from ".online" address. Please see attached jpg for my rule. Does this look right?

Thanks,
BD

If you go to "Tools" > "Junk" > "Main interface..." and then click on "Rules" on the left-side of that interface and then select (click on) the new rule you have created and then click the "Edit" button (pencil icon on the toolbar at top) you will then be able to take a screen-shot of the new rule to post here in this topic for the Esumsoft Team to review.

You can refer to this linked topic on How to take a screenshot and attach/insert it into your post.

Unfortunately, attaching an image seems to be tied into somehow it having a url associated with it. When I "Add File", it does list the file but over on the right hand side under "Status", it says "It was not possible to determine the dimensions of the image. Please verify that the URL you entered is correct." Of course, I'm just trying to attach a jpeg, there is no url. So the last step of your procedure is not working for me. When I left click, I'm not seeing any way to "Place Inline". So on my end, my "online Rule.jpg" is showing down below but I can't get it into this post.

So, in lieu of that, I found where I could "copy Rule set" under Edit Rule Set and here is the rule I created for the ".online" spam address.


[Rules]
online_Action = 2 1 0 "" "" 0 16777215 ""
online_Rule00 = 0 0 3 "+FromAddress" 0 "\.online$"
online_Status =

Morning Bill,

Thank you for posting back. Lakrsrool and Jeff should be along later to continue their follow-up with you.

In the interim...to address the problem with including a screenshot into your post, please continue reading below.

From your description, it sounds like you tried to insert the screenshot by clicking on the [INSERT IMAGE] button at the top of the post editing window - as shown in the following screenshot:

(Click image to enlarge it)

The [INSERT IMAGE] button is used to attach/insert an image from an external source (other than your computer), such as, Dropbox.

I've re-checked each of the steps as they are listed in the Sticky topic lakrsrool referred you to, and have no problem with including a screenshot from my computer into this post - as shown below:

(Click image to enlarge it)

Please retry the steps exactly as they are shown in the Sticky - and do NOT click on the [INSERT IMAGE] button. Let us know how it goes.

Best regards.

First thing -- After you copy the "rule set" that Jeff provided by doing the following (note: after selecting all of the rule set you can always press the "CTRL"+"C" keys at the same time to copy the selected rule set [to the clipboard] as an alternative to using the "right-click" context menu to copy -- to later paste the copied rule set):
I think these are the steps that Jeff is talking about to create your new Junk rule set (refer to detail instructions under each screen-shot):
Step 1) First window: Step 2) Second window: Step 3) Third window (results you must save): You are done! Note: You can test this rule (assuming the message has not been deleted) by returning to the PP main window and selecting one of these messages in the PP inbox that you want to be "Junk" based on this new Junk rule set (with this address - *.ooo) and right-click on that message and then select "Remove from list" (which will then remove the message from you PP inbox for the time being until the next Mail Check) -- then do a "Mail Check" (the message will then be retrieved again by PP) -- that message should now be classified as "Junk" (and any other new messages like this from now on as well). If you have any problems or questions or do not get the expected results -- let us know.

BDinger3 -- Your rule looks good.

btw, when you create a rule, you can use the built-in test functionality on the rule page itself, by selecting the "Test" radio button on the right-middle. Then put in just enough information to test it. In this case, I tested things like:
from: "some dude" <dude@somewhere.online>
from: "some dude" <dude@somewhere.online.com>

The first one should match, the second one should not.

You could also simplify that to:
from: dude@somewhere.online

but testing a "full" from value is probably better, as it will better ensure that you're using the correct fields (e.g. "+FromAddress" and not "+FromName")

Thanks everyone for your thorough help on my subject. Right now, I'm not getting anything more from .ooo or .online. Hopefully, that will continue.

Bill D