Localpart To: Present In From, Subject, etc...

["John Traweek CCNA, Sec+" <jo...@publishingconcepts.com>]

I am sure this is doable and did some searching but couldn't find it referenced.  How would one create a rule to detect the presence of the To:  local part in the subject, ie spammer sends email To: localpart@domain.com and the rule triggers on the localpart being present in other headers such as the Subject, the From, etc...  Thanks!



________________________________


John Traweek CCNA, Sec+
Executive Director, Information Technology
Proud PCI Associate for 18 years
PCI: the data company

________________________________


Heritage Square . 4835 LBJ Freeway, Suite 1100 . Dallas, TX  75244 . 214.530.0394

Did you know last year, PCI raised over 9 million dollars in donations for our clients? Ask us how!

This Email is covered by the Electronic Communications Privacy Act, 18 U.S.C. Sections 2510-2521 and is legally privileged. The information contained in this Email is intended only for . If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distributions or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us by telephone 1.800.395.4724 X160, and destroy the original message.

Re: Localpart To: Present In From, Subject, etc...

[Axb <ax...@gmail.com>]

On 10/27/2014 12:49 PM, John Traweek CCNA, Sec+ wrote:
> I am sure this is doable and did some searching but couldn't find it
> referenced.  How would one create a rule to detect the presence of
> the To:  local part in the subject, ie spammer sends email To:
> localpart@domain.com and the rule triggers on the localpart being
> present in other headers such as the Subject, the From, etc...
> Thanks!
>

https://wiki.apache.org/spamassassin/WritingRules

"There's also an option to look at all the headers and match if any of 
them contain the specified regex:"

is that what you want?

Re: Localpart To: Present In From, Subject, etc...

[Reindl Harald <h....@thelounge.net>]

Am 27.10.2014 um 12:49 schrieb John Traweek CCNA, Sec+:
> I am sure this is doable and did some searching but couldn't find it referenced.  How would one create a rule to detect the presence of the To:  local part in the subject, ie spammer sends email To: localpart@domain.com and the rule triggers on the localpart being present in other headers such as the Subject, the From, etc...  Thanks!

frankly there is a default rule already with a score of 1.1

[root@localhost:~]$ sa-score.sh LOCALPART
/var/lib/spamassassin/3.004000/updates_spamassassin_org
score LOCALPART_IN_SUBJECT 0.001 0.730 1.199 1.107

/usr/local/scripts/spamfilter/templates/local.cf
score LOCALPART_IN_SUBJECT 1.5