This one does not seem to be particularly advanced. Just filter all emails that contain "hjskvntjwgvt.ru" in the body and redirect them to trash or spam folder.
I also run this "rule" or "filter" BEFORE the "rule" or "filter" that redirects OpenWrt mailing list stuff to the IMAP folder where I keep OpenWrt mailing list folder.
Gmail exists to let Google read your inbox, not to protect you from spam. Especially for the free accounts.
If I set up a mail server I can install dozens of anti-spam applications (some opensource, some paid) that can and will block garbage.
Real problem is that Google doesn't block it... And I really can't understand why
That's because it was manipulated by mailing list servers, and that's enough to bypass the garbage-grade antispam filters of most free email providers.
Notice that at the beginning of each mail there is this text.
The sender domain has a DMARC Reject/Quarantine policy which disallows
sending mailing list messages using the original "From" header.
To mitigate this problem, the original message has been wrapped
automatically by the mailing list software.
This is a workaround implemented by the mailing list servers to deal with some other stupidity in how the original sender's servers are set up, as in many cases you can't just call up your provider and ask them to change their mail server configuration.
As I said it is pretty easy to just add a rule to filter it out as this does not make any effort to randomize itself like most other spam, it could very well be a honest mailing list that some jerk decided to "subscribe" the OpenWrt mailing list to.
Could be worth trying to send an email to the contact email mentioned and ask if they can delete the OpenWrt mailing list from their lists. If someone knows russian.
At the end of the email there is a link to unsubscribe
Hm, you are right, kind of. The last part (in red) says (google translate be praised)
If you no longer want to receive letters from us, send us an email with the subject “deletemail” and your address will be permanently deleted automatically.
They expect an email FROM the OpenWrt mailing list address they show at the bottom openwrt-devel@lists.openwrt.org
I'll try to use some spoof sender mail services to see if I can send a fake mail to "unsubscribe" us.
Yes, and in 2 days an old fat man in a red suit will fly through the sky on his sleigh pulled by reindeers.... it's true, it's true! 
As much as I'm skeptic, I'm interested in the result of your experiment.
i don't understand why this is neccesary. as an organization, OpenWrt should have person in charge for mailing list server and its administration. simple subnet block on the server should prevent any incoming traffic to the mailing list. or is it that is not known who that person is? or he maybe lost server access just like database of old forum was lost?
It's faster than trying to communicate with whoever is in charge and convince him that what I'm doing has any value.
It would block others coming from the same general area too, and if this is real spam it's not going to do much as they can bounce from somewhere else.
I added
Reply-To: "hjskvntjwgvt.ru"
From: "hjskvntjwgvt.ru via openwrt-devel"
to mailman's bounce_matching_headers - lets see if it helps.
1 Like
Ok sent a couple mails (to both email addresses) with "deletemail" as subject and openwrt-devel@lists.openwrt.org as "sender".
Used this http://www.anonymailer.net service and confirmed that it is actually doing something by using another service that creates temporary email addresses.
It adds stuff in the body of the message as it is a free version, but it should not matter if we are just triggering an automated system reading the email subject.
thanks, let's hope it does.