Some spammers own their own Mail servers and many more utilize accounts on commercial mail servers. In either case, the spammer is not restricted to using the same domain name in their From header address, and frequently rotate that information to avoid mail rules and for different spam campaigns.
Ordinarily, and this is primarily from accounts on commercial email servers, one address that does not change is the header field named Return-Path, which incorporates the account information and the mail server's address. This is typically a static address that you can filter until the commercial server boots the spammer, or a new account is created. I have recently received spam email where it would appear the spammer owns their own mail server and the return path was set to <> (which you can also filter out).
Select one email message that you want to filter in Apple Mail. Visit the Rules in Mail preferences and click Add Rule. You can arbitrarily name it "Mail Server Return Paths" By default the new rule will show the following:
You already have changed the Description field. Click on the From selector and at the bottom of that long secondary menu, you will see Edit header list… Click that entry, and add [+] this exact spelling:
Return-Path
You will then see the following and click OK:
When you next click on that From selector, you will now see Return-Path available on the secondary menu in the same section as the From header field. Choose Return-Path. With the middle selector still set at contains, the editable field to the right will now auto-populate with the Return-Path address of the mail server used by the spammer. You can move around in that text field with your arrow keys and backspace to remove anything (including the <> characters) but the mail server's domain name. If the mail server Return-Path address were:
<bounce_diacffn_m-someone=fictitious.com@cp20.com>
You would edit this to:
cp20.com
And to finish the rule, you would set:
Move message to mailbox: Trash
When you click OK, the rule will pop a dialog to apply it, and when you do, it will Trash the currently selected email with that Return-Path and all future incoming emails whose Return-Path header contains cp20.com (as an example).
