Every time I receive a spam email I add its email address to a list of rules in Mail to move it directly to trash. The length of this list has grown over time and I now have more than one ever-growing list. After a while I noticed that, although the sender addresses were different, the IP address in a lot of cases stayed the same. I looked at the rules in the Mail prefs, but there is no obvious rule for filtering by IP address.
However, it can be achieved using the rules, with a little tweak.
Firstly, it might be a good idea to create a new Mailbox and call it something like 'Review Spam.'
Next, identify the sender's IP address from the spam messages. If you don't know how to do this, here's a rough guide:
Select a spam message and select View » Message » Long Headers -- the header section in the message will expand. In the header you should see several 'Received' headings with aome text next to them and an IP address.
The text and IP in the first 'Received' heading is likely your own Mail server -- you don't want to add this to the rule otherwise the rule will act on all your incoming mail from that server. This can be a bit tricky if you don't know what you're looking for, but if you analyse the spam messages against legitimate messages you should be able to find the offending IP address, eventually.
To create the rule that does the filtering:
- Select the 'Rules' tab in the preferences for the Mail.app.
- Create a new rule by clicking 'Add Rule.'
- Make sure 'Any' is selected in the conditions list, then in the 'Recipient' list, scroll down and select 'Edit Header List.'In the resulting window, click the button with the + symbol to create a new list item and type 'Received' in the field.
- Close the window and select the 'Recipient' list again; you should see a new item near the top of the list called 'Received.'
- Select that item and make sure 'Contains' is selected the corresponding list. Enter the sender's IP address into the text field next to the 'Contains' list.
- In the actions section, select 'Move Message' and then select the 'Review Spam' mailbox (Or trash, if you're feeling brave and trusting) in the mailbox list.
- Click 'Ok' and then 'Apply.'
[crarko adds: I haven't tested this one. You can check some non-spam messages for the IP address in the header and the one they all have in common should be the address of your mail server for the given account, so you know not to filter it.]