Spam from one free email provider with reply-to another free email provider

[Rasmus Haslund]

Hi all,
 
I have seeing increasing amounts of lottery spams and the likes where
the from address is from one free email provider and then the reply-to
email is to another free email provider - or perhaps to the same free
email provider but a different address or a different domain.
 
Fx from [EMAIL PROTECTED] and reply-to [EMAIL PROTECTED] or
[EMAIL PROTECTED]
 
Would it be possible for someone to use this for creating a rule that
could help filter these out?
 
Best Regards
NOWACO A/S
Rasmus Haslund