Hi Ric, the spammers source code can be found in Talktalk webmail by clicking on three dot logo, copy and paste the source code into microsoft windows, blank document, search the code using "search function" by putting in "http", this will reveal between 3-5 domain names.
These represent the picture png that loads into the email, the landing page where the email takes you to and the campaign where the data is harvested.
The format will be http there will be : followed by // followed by a domain name and then . followed by com. (The reason I spell this out is because talktalk look for domain names and won't let the format to be posted). The spammer can place anything in front of the . and com so what is in front of . and com is the domain name. Think before . and com to the next . is the domain.
In web mail click on the COG top right, click on "All settings" and slide the drop down menu until you find "Rules" click on this , click on "Add Rule".
A new box opens with "New Rule" in the top box, delete this (New Rule) by backspace and add the domain name that before the . and com, and add Body .
Go down to "add condition" and click, from the drop down menu click "Body" , opposite this the word "contains" and fill in box should be displayed, in this box add the Domain name.
What this does is look for that domain name in any email received and now you need to decide what you want to do with it go to "add action" box below and click it, a drop down menu appears so you can mark it as spam, discard it or reject it.
Once you have done this save this. What you have done is set up your spam filter to act on a domain purchased by the spammer to spam, none of these domains are from any company that you would want to receive a spam email.
What I advise is Join Spamcop its FREE and you will get a forwarding email address, what you do is forward a copy of your spam email to this email address and they will process it and send reports to those Registrars who sold the domain names and also where the emails originated from.
I have tried this and looked for a common word in all the spam emails I received, so the spammer used the same source code in these emails and set up the spam filter to reject it as spam, the next email I received he had omitted that line, so it worked. By using these domain names you are hitting his pocket as he wants to send out all his emails to a list of Talktalk subscribers, if they start to bounce he has to buy a new domains.
Now Talktalk could do this, we place enough spam emails into the spam box and if Talktalk did this the spammer would have to fork out a lot of money for each email if 3 domains are blocked each time.
CanTheSpam
