{
  "port": 783,
  "protocol": "tcp",
  "service": "SpamAssassin spamd",
  "oneLiner": "Apache SpamAssassin's scanning daemon, which trusts anything that can reach it.",
  "whatItIs": "spamd is the long-running SpamAssassin server that mail systems hand messages to for scoring, avoiding a Perl startup per message; its documented default listening port is 783 and clients such as spamc connect to it. It is not IANA-registered — 783 is SpamAssassin's own convention. The protocol has no authentication: any client that can connect may submit mail for scanning, and where --allow-tell is enabled it can also drive Bayes learn/forget commands. Default configurations bind localhost, so an externally open 783 is a misconfiguration.",
  "exposure": {
    "verdict": "never",
    "note": "Unauthenticated, and it costs real CPU per submitted message; bind it to loopback or a private interface behind the MTA."
  },
  "checkCommand": "nc -vz 127.0.0.1 783",
  "links": [
    {
      "title": "Apache SpamAssassin — spamd documentation",
      "url": "https://spamassassin.apache.org/full/4.0.x/doc/spamd.html",
      "kind": "official-docs"
    },
    {
      "title": "Apache SpamAssassin source repository",
      "url": "https://github.com/apache/spamassassin",
      "kind": "github"
    }
  ]
}