Re: bounce spam

On 12.11.24 13:05, natan wrote:
>What methods do you have to fight with bounce spam? Last time i get 
>some spam

v320.pre:loadplugin Mail::SpamAssassin::Plugin::VBounce
local.cf:welcomelist_bounce_relays      fantomas.fantomas.sk
local.cf:score  BOUNCE_MESSAGE  1

and of course training.

>Return-Path: <>
>Delivered-To: [email protected]
>Received: from MX ([xx.xx.xx.5])
>by dovecot3.local with LMTP
>id aMFYFA8ALWcUjQAApYCB1g:P1
>(envelope-from <>)
>for <[email protected]>; Thu, 07 Nov 2024 18:59:43 +0100
>Received: from mx.xxx.yy ([xx.xx.xx.5])
>by mx with LMTP
>id aMFYFA8ALWcUjQAApYCB1g
>(envelope-from <>)
>for <[email protected]>; Thu, 07 Nov 2024 18:59:43 +0100
>Received: from localhost (unknown [xxx.xxx.xxx.234])
>by mx.xxx.yy (Postfix) with ESMTP id 4XkqbM1B4Qz1Q9tD
>for <[email protected]>; Thu, 7 Nov 2024 18:59:43 +0100 (CET)
>X-Virus-Scanned: Skaner antywirusowy amavis3-ng-nowy
>X-Amavis-Alert: BAD HEADER SECTION, Missing required header field: "Date"
>Received: from mx.xxx.yy ([xxx.xxx.xxx.199])
>by localhost (amavis2-ng.xxx.yy [xxx.xxx.xxx.234]) (amavisd-new, port 10628)
>with ESMTP id IN23A4PWUyeB for <[email protected]>;
>Thu, 7 Nov 2024 18:59:42 +0100 (CET)
>Received-SPF: None (no SPF record) identity=helo; 
>client-ip=34.83.93.130; helo=[10.88.0.4]; envelope-from=<>; 
>receiver=<UNKNOWN>
>Received: from [10.88.0.4] (130.93.83.34.bc.googleusercontent.com 
>[34.83.93.130])
>by mx.xxx.yy (Postfix) with ESMTP id 4XkqbL3qxkz1Q9rk
>for <[email protected]>; Thu, 7 Nov 2024 18:59:41 +0100 (CET)
>Content-Type: multipart/related; 
>boundary="===============2292679747394156761=="
>MIME-Version: 1.0
>From: "domain" <[email protected]>
>To: [email protected]
>Subject: =?utf-8?q?=5Bbiuro=40domain=2Eltd=5D=3A_Please_confirm_to_continue=2E?=
>X-Priority: 2
>
>In amavis log:
>Nov  7 18:59:42 amavis3 amavis[1174755]: (1174755-04) p001 1/1 
>Content-Type: text/html, base64, size: 734, SHA1 digest: 
>777995bb72e45cfb3f9a6d87cf93fab4ef8d7ed7
>Nov  7 18:59:42 amavis3 amavis[1174755]: (1174755-04) check_header: 7, 
>Missing required header field: "Date"
>Nov  7 18:59:43 amavis3 amavis[1174755]: (1174755-04) wbl: whitelisted 
>sender <>, <[email protected]>
>Nov  7 18:59:43 amavis3 amavis[1174755]: (1174755-04) bounce 
>unverifiable, <> -> <[email protected]>
>
>Probably amavis whitelisted "<>"
>
>What seems obvious is that '<>' mainly represents bounces or 
>non-delivery reports (NDRs)."
-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
(R)etry, (A)bort, (C)ancer