Return-Path: X-Original-To: apmail-spamassassin-users-archive@www.apache.org Delivered-To: apmail-spamassassin-users-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 6A17817BB4 for ; Mon, 27 Oct 2014 12:06:25 +0000 (UTC) Received: (qmail 47773 invoked by uid 500); 27 Oct 2014 12:06:22 -0000 Delivered-To: apmail-spamassassin-users-archive@spamassassin.apache.org Received: (qmail 47742 invoked by uid 500); 27 Oct 2014 12:06:22 -0000 Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@spamassassin.apache.org Received: (qmail 47732 invoked by uid 99); 27 Oct 2014 12:06:22 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 27 Oct 2014 12:06:22 +0000 X-ASF-Spam-Status: No, hits=-0.7 required=10.0 tests=RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of axb.lists@gmail.com designates 209.85.212.174 as permitted sender) Received: from [209.85.212.174] (HELO mail-wi0-f174.google.com) (209.85.212.174) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 27 Oct 2014 12:05:54 +0000 Received: by mail-wi0-f174.google.com with SMTP id q5so6115058wiv.13 for ; Mon, 27 Oct 2014 05:05:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=t/PMPNZku6p4vytR2F3BlRjIf/C++u0LByezmxTTKCc=; b=FUS7aN8RpQeiuRUOKQe0s0G35dLQM16sP5PtsV7uiRmXKd7563AIYq1cEJ7C2jT9Vm Jl3Nd6sTE/Sw1KXYzE3E6D9vR9+ilbw7XNK9N2Akfy7jeCTBELcGcMCXzoV8SvLqwUkU EfJOcmh0jnmr0VDquQWcXe10K3CBD9+oNbC4/lvD8O+AWet8N2IMamMQKjrEd7VyVNss eV5xXdtc1DW4Ub+l6yBF2oNw2gbMEQMto4RvPrCMy6t874S6KScyznSAUC+H6pGZKQqb o/lJmiWKcv1aysmVKQxd/VmyrladMo9hoGq310hT16p627puVcrinVXFFIJhEVNWuxB0 BuxQ== X-Received: by 10.180.205.162 with SMTP id lh2mr20103861wic.14.1414411553953; Mon, 27 Oct 2014 05:05:53 -0700 (PDT) Received: from [192.168.192.3] (62-2-216-82.static.cablecom.ch. [62.2.216.82]) by mx.google.com with ESMTPSA id p3sm15351093wjf.49.2014.10.27.05.05.52 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 27 Oct 2014 05:05:53 -0700 (PDT) Message-ID: <544E3510.3020001@gmail.com> Date: Mon, 27 Oct 2014 13:05:36 +0100 From: Axb User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: users@spamassassin.apache.org Subject: Re: Localpart To: Present In From, Subject, etc... References: <0998EDA7BFAA7B46B5A66A84B747E5637E7EBE@exchange01.publishingconcepts.com> In-Reply-To: <0998EDA7BFAA7B46B5A66A84B747E5637E7EBE@exchange01.publishingconcepts.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Checked: Checked by ClamAV on apache.org On 10/27/2014 12:49 PM, John Traweek CCNA, Sec+ wrote: > I am sure this is doable and did some searching but couldn't find it > referenced. How would one create a rule to detect the presence of > the To: local part in the subject, ie spammer sends email To: > localpart@domain.com and the rule triggers on the localpart being > present in other headers such as the Subject, the From, etc... > Thanks! > https://wiki.apache.org/spamassassin/WritingRules "There's also an option to look at all the headers and match if any of them contain the specified regex:" is that what you want?