On Mon, 23 Dec 2019 08:04:13 +0100, Alessandro Vesely via clamav-users stated: >Perhaps you could try and match From:snopescom-.*@cmail20.com? Actually, it is the "@cmail20.com" part changes also. <Snopescom-cdrdrik1jrhddlljg1j at cmail19.com> -- Jerry