2

Recently I started to get automatic emails, generated by some scammer. It either says that my Google account will be blocked soon or some stranger has left me a message. To read the message I must open a link.

I opened a couple of such links though anonymous proxy: these were fake Gmail login forms. So, he wants to steal my Gmail account. The links have very similar domains:

  • imaill.kiev.ua
  • imaill.ws
  • imaill.vn.ua
  • imaill.te.ua
  • imaill.ternopil.ua

Is it possible to create a filter in Gmail such that when it sees "imaill\.*" in the text representation of the email, it deletes it?

1
  • You can, but perhaps it would be better to mark these as phishing attempts so that Google can improve their own detection algorithms and keep them away from everyone.
    – ale
    Commented Nov 2, 2015 at 12:25

1 Answer 1

1

A filter on "imaill." will probably suffice, assuming that you don't have legitimate messages with that string. (Like, communication from your ISP responding to your phishing report.)

Matches: "imaill."
Do this: Mark as read, Delete it

That's probably a bit too broad, though. Google's Advanced Search operators for Gmail are a little light on the headers they can key on, allowing only searches (and thus filters) for:

  • from
  • to
  • cc
  • bcc
  • rfc822msgid
  • delivered-to

So, depending on what this interloper is doing, this might work better:

Matches: from:imaill.
Do this: Mark as read, Delete it

As I mentioned in my comment, though, the best course of action is probably to mark the messages you're receiving as phishing attempts.

Gmail message menu

This lets Google get better at recognizing phishing attempts and, eventually, prevent these sorts of messages from reaching your (and everyone else's) mailbox. If you just filter these into the trash that won't happen.

3
  • "from:imaill" won't work because these emails have fake "From" field. And this text exists only inside email body. We have Return-Path: <[email protected]> and envelope-from <[email protected]>. This is the real scammer email. Is it possible to block it using these fields? I reported phishing to google.
    – user4035
    Commented Nov 3, 2015 at 9:24
  • Not really. As I mentioned, Gmail doesn't let you filter on arbitrary headers. "Has the words:" might work, but in my experience that only works on text that is normally visible.
    – ale
    Commented Nov 3, 2015 at 12:13
  • No, text doesn't work. I tried.
    – user4035
    Commented Nov 3, 2015 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.