Deliberate report
Move one message or a batch to Report to Meilo from Apple Mail, Gmail or another synchronized mail app. The dedicated folder is the instruction; ordinary Junk and Flag folders remain separate.
Connected reporting
One campaign becomes one organized case.
You move the message once. Meilo preserves the original, connects repeat copies and prepares the evidence needed for a useful response.
The complete path
What happens after you move an email.
Original preservation
The engine reads the original message source and records the delivery headers, Message-ID, sender fields, URLs and a SHA-256 content hash. That record keeps evidence stable if a website later disappears or a sender changes names.
Campaign grouping
Deterministic fingerprints compare content, sender paths, reply domains and destinations. Matching copies join one campaign record, while materially different messages stay separate. Volume adds context without generating duplicate complaints.
Infrastructure map
The workflow separates the mail sender, reply service, redirector, final website, DNS provider, registrar, host and reverse proxy. Each company receives only the evidence relevant to the role it can control.
Provider packet
A packet includes the original indicators, exact abusive URL when available, observation time, response status, redirect location and service-specific identifiers. A hostname alone is not treated as enough evidence for a web-infrastructure report.
Review and follow-up
Submissions that require an account-owner statement, CAPTCHA or judgment remain visible for review. Replies are attached to the case. If a provider identifies missing evidence, the case is supplemented precisely instead of starting from scratch.
An anonymized case from the workflow
A provider could not locate the abuse. The second packet gave it an exact observation.
A repeated email campaign used a link that redirected through infrastructure protected by Cloudflare. The first report identified the hostname but did not give the abuse team enough detail to reproduce the request. Their reply said the reported material could not be found.
- 1
Preserve
The original message and link were retained before any further work.
- 2
Observe safely
The authorized investigation recorded the exact URL, UTC time, HTTP 302 response, destination in the Location header, server marker and Cloudflare Ray ID.
- 3
Supplement the case
The follow-up referenced the provider's existing case and supplied the reproducible request details rather than a general claim.
- 4
Improve the engine
The reporting rule now blocks hostname-only Cloudflare packets and requires an exact observed URL plus time and response evidence.
This example explains the method without publishing the recipient, sender or live suspicious URL. Provider action depends on its own evidence, policy and investigation.
What the subscription repeats