Spam filter rule to check subject for part of recipient name

[larsen]

Hi,

we currently get a lot of spam where the subject contains part of the email adress the spam is sent to. It's already filtered after passing PMG, but I'd like to not accept the mail at all.

Example for "j.doe@example.com": "j doe You want this"
- Text varies
- First part is always the email address without the dot

I could add single rules for every user with the apparent downsides, so prefer to have a generic solution.
I could probably use SpamAssassin but then the mail would already have been accepted, wouldn't it?

So, is it possible to write a generic filter rule to check the subject for part of the email address?

 

[hata_ph]

Try this what object, subject match field. Adjust the 25 character to the length you want.

(?i)(\W|^)([\w.\-]{0,25}?example\.com)(\W|$)

 

[larsen]

I understand that this will need to have "example.com" in the subject, but that is not the case. See example above (only the part behind the colon is the subject).

 

[hata_ph]

I understand that this will need to have "example.com" in the subject, but that is not the case. See example above (only the part behind the colon is the subject).

Is your subject, "j.doe@example.com": "j doe You want this" ?

 

[larsen]

No, it's "j doe You want this"

 

[hata_ph]

No, it's "j doe You want this"

then this should work.

(?i)(\W|^)(foods|you want|fly|fake|fat|freedom)(\W|$)

 

[larsen]

Thanks, but that's not a generic solution.

 

[larsen]

I didn't find a solution and ended up using a single filter rule for each user, e.g. "j doe[ ,:].*"