Connected reporting

One campaign becomes one organized case.

You move the message once. Meilo preserves the original, connects repeat copies and prepares the evidence needed for a useful response.

See reporting plans See the iPhone action

The complete path

What happens after you classify an email.

Customer-controlled source

Choose the dedicated Report to Meilo folder for minimum access, or connect the mailbox provider's Junk folder to a private review queue. In Junk mode the owner must ignore or approve each candidate in the portal; no filter decision becomes an external complaint by itself.

Original preservation

The engine reads the original message source and records the delivery headers, Message-ID, sender fields, URLs and a SHA-256 content hash. That record keeps evidence stable if a website later disappears or a sender changes names.

Campaign grouping

Deterministic fingerprints compare content, sender paths, reply domains and destinations. Matching copies join one campaign record, while materially different messages stay separate. Volume adds context without generating duplicate complaints.

Infrastructure map

The workflow separates the mail sender, reply service, redirector, final website, DNS provider, registrar, host and reverse proxy. Each company receives only the evidence relevant to the role it can control.

Provider packet

A packet includes the original indicators, exact abusive URL when available, observation time, response status, redirect location and service-specific identifiers. A hostname alone is not treated as enough evidence for a web-infrastructure report.

Review and follow-up

Submissions that require an account-owner statement, CAPTCHA or judgment remain visible for review. Replies are attached to the case. If a provider identifies missing evidence, the case is supplemented precisely instead of starting from scratch.

An anonymized case from the workflow

A provider could not locate the abuse. The second packet gave it an exact observation.

A repeated email campaign used a link that redirected through infrastructure protected by Cloudflare. The first report identified the hostname but did not give the abuse team enough detail to reproduce the request. Their reply said the reported material could not be found.

1
Preserve
The original message and link were retained before any further work.
2
Observe safely
The authorized investigation recorded the exact URL, UTC time, HTTP 302 response, destination in the Location header, server marker and Cloudflare Ray ID.
3
Supplement the case
The follow-up referenced the provider's existing case and supplied the reproducible request details rather than a general claim.
4
Improve the engine
The reporting rule now blocks hostname-only Cloudflare packets and requires an exact observed URL plus time and response evidence.

This example explains the method without publishing the recipient, sender or live suspicious URL. Provider action depends on its own evidence, policy and investigation.

What the subscription repeats

Preserve once, connect the campaign, prepare the next useful action.

Read email headers Build an evidence packet Separate spoofing from lookalikes Ask about mailbox compatibility