Spam getting past rule

[SBTech]

I'm getting a lot of spam that has a very specific return-path

in the return path of the spam is name=domain.com and the email address is name@domain.com

example spam message
Return-Path: <9792-14505-1959-1466-name=domain.com@mail.hoshine.world>

I have created a what object that matches the return-path field and blocks the email but I'm still getting the messages.

 

[Stoiko Ivanov]

Please post the logs for such a message, and the what object and rule you created to match them