Re: bounce spam

Hi
I have in local.cf

header    _SPAM_FROM_NO_DOMAIN        Return-Path =~ /<>/
describe  _SPAM_FROM_NO_DOMAIN        spamik
score     _SPAM_FROM_NO_DOMAIN        2

but i thinking amavis whitelisted "<>" in default

W dniu 12.11.2024 o 13:22, Matus UHLAR - fantomas pisze:
> On 12.11.24 13:05, natan wrote:
>> What methods do you have to fight with bounce spam? Last time i get 
>> some spam
>
> v320.pre:loadplugin Mail::SpamAssassin::Plugin::VBounce
> local.cf:welcomelist_bounce_relays      fantomas.fantomas.sk
> local.cf:score  BOUNCE_MESSAGE  1
>
> and of course training.
>
>> Return-Path: <>
>> Delivered-To: [email protected]
>> Received: from MX ([xx.xx.xx.5])
>> by dovecot3.local with LMTP
>> id aMFYFA8ALWcUjQAApYCB1g:P1
>> (envelope-from <>)
>> for <[email protected]>; Thu, 07 Nov 2024 18:59:43 +0100
>> Received: from mx.xxx.yy ([xx.xx.xx.5])
>> by mx with LMTP
>> id aMFYFA8ALWcUjQAApYCB1g
>> (envelope-from <>)
>> for <[email protected]>; Thu, 07 Nov 2024 18:59:43 +0100
>> Received: from localhost (unknown [xxx.xxx.xxx.234])
>> by mx.xxx.yy (Postfix) with ESMTP id 4XkqbM1B4Qz1Q9tD
>> for <[email protected]>; Thu, 7 Nov 2024 18:59:43 +0100 (CET)
>> X-Virus-Scanned: Skaner antywirusowy amavis3-ng-nowy
>> X-Amavis-Alert: BAD HEADER SECTION, Missing required header field: 
>> "Date"
>> Received: from mx.xxx.yy ([xxx.xxx.xxx.199])
>> by localhost (amavis2-ng.xxx.yy [xxx.xxx.xxx.234]) (amavisd-new, port 
>> 10628)
>> with ESMTP id IN23A4PWUyeB for <[email protected]>;
>> Thu, 7 Nov 2024 18:59:42 +0100 (CET)
>> Received-SPF: None (no SPF record) identity=helo; 
>> client-ip=34.83.93.130; helo=[10.88.0.4]; envelope-from=<>; 
>> receiver=<UNKNOWN>
>> Received: from [10.88.0.4] (130.93.83.34.bc.googleusercontent.com 
>> [34.83.93.130])
>> by mx.xxx.yy (Postfix) with ESMTP id 4XkqbL3qxkz1Q9rk
>> for <[email protected]>; Thu, 7 Nov 2024 18:59:41 +0100 (CET)
>> Content-Type: multipart/related; 
>> boundary="===============2292679747394156761=="
>> MIME-Version: 1.0
>> From: "domain" <[email protected]>
>> To: [email protected]
>> Subject: 
>> =?utf-8?q?=5Bbiuro=40domain=2Eltd=5D=3A_Please_confirm_to_continue=2E?=
>> X-Priority: 2
>>
>> In amavis log:
>> Nov  7 18:59:42 amavis3 amavis[1174755]: (1174755-04) p001 1/1 
>> Content-Type: text/html, base64, size: 734, SHA1 digest: 
>> 777995bb72e45cfb3f9a6d87cf93fab4ef8d7ed7
>> Nov  7 18:59:42 amavis3 amavis[1174755]: (1174755-04) check_header: 
>> 7, Missing required header field: "Date"
>> Nov  7 18:59:43 amavis3 amavis[1174755]: (1174755-04) wbl: 
>> whitelisted sender <>, <[email protected]>
>> Nov  7 18:59:43 amavis3 amavis[1174755]: (1174755-04) bounce 
>> unverifiable, <> -> <[email protected]>
>>
>> Probably amavis whitelisted "<>"
>>
>> What seems obvious is that '<>' mainly represents bounces or 
>> non-delivery reports (NDRs)."

--