Re: Rule for: Subject contains email address from To: header?

Take a look at:
https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html#CAPTURING-TAGS-USING-REGEX-NAMED-CAPTURE-GROUPS

I imagine you should be able to do something like:
header      __CAPTURE_RCPT              To:addr =~ 
/(?<RCPTA_FULL>(?<RCPTA_LOCALPART>.+)\@(?<RCPTA_DOMAIN>[a-z0-9\-\.]+))/i
header      __TO_IN_SUBJECT             Subject =~ /%{RCPTA_FULL}/i

It works for finding the RCPTA_FULL in body at least. Just note it 
requires SA version 4.0 or higher.


On 5/11/26 1:06 PM, Benoit Panizzon wrote:
> Hi Gang
>
> I see more and more spam mails with a subject containing the To
> email address similar to:
>
> From: [email protected]
> To: [email protected]
> Subject: Important message for [email protected] - claim your prize
>
> Is there a way for matching such combinations? Has anyone perhaps
> created a plugin to search the To: email address in the Subject?
>
> Mit freundlichen Grüssen
>
> -Benoît Panizzon-

-- 
Martin F (maf)
Systems Engineer, group.one / one.com