I have spam pretty much under control except from one particular source. I use Gmail, and their filtering is pretty good, but this spammer always uses a different email address, but they always end in .us

Now I could set a filter to block (*.us) but that would take out some stuff I don't want taken out.

These spams are always for Groupon, Coles, Bunnings, Kmart, Woolworths, Costco, and Aldi. I have been able set filters for all except Aldi. This one is problematic because I want to get genuine Aldi emails, so I can't block anything with the word Aldi in it. I can't find anything unique in these spams to filter out.

Anyone have any clues please?

The genuine Aldi information emails come from
[email protected] via servicemail24.de

and the reminders come from:
[email protected] via as-worx.com


Is it possible to block anything that has "Aldi" in the email body but still whitelist the genuine email addresses? I have just now tried to set something like that (whitelist [email protected] and then delete anything from "Aldi" and it wants to delete the genuine stuff to).