email bypassing cpanel global email filters

[FUNKAM55]

I am getting a lot of emails with the following headers:

Return-Path: <>
Delivered-To: [email protected] ****.com
Received: from srv1. ****.com
by srv1. ****.com with LMTP
id JFcgIPqkYGHkdA8AefIgdQ
(envelope-from <>)
for <[email protected] ****.com>; Fri, 08 Oct 2021 21:07:22 +0100
Return-path: <>
Envelope-to: [email protected] ****.com
Delivery-date: Fri, 08 Oct 2021 21:07:22 +0100
Received: from [109.237.97.40] (port=56246 helo=de.indeed.com)
by srv1. ****.com with esmtp (Exim 4.94.2)
id 1mYZVU-002WUi-Fy
for [email protected] ****.com; Thu, 07 Oct 2021 20:56:47 +0100
From: amazon CLUB <[email protected]>
To: <[to]>
Subject: amazon CLUB Has Suprise For You
Date: Thu, 07 Oct 2021 21:35:14 +0200
List-Unsubscribe: <Error>, <mailto:leave-fc4516737666027a731d1f2d205921-fe291c73756302[email protected]leave.email.bostonglobe.com>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
x-CSA-Compliance-Source: SFMC
MIME-Version: 1.0
List-ID: <bHUC97sD9.xt.local>
X-CSA-Complaints: [email protected]
X-SFMC-Stack: 1
Message-ID: <[email protected]>
Feedback-ID: 10939372:43053667:68.232.197.141:sfmktgcld
Content-Type: multipart/alternative; boundary="9LJOpTAd6ka2=_?:"

I have added the following Cpanel Global email filters but they are not stopping me from receiving the emails:

actions:
-
action: deliver
dest: ****
filtername: [email protected]
rules:
-
match: contains
opt: or
part: $message_headers
val: "@eco.de"
-
-
match: contains
opt: or
part: $message_headers
val: "Amazon"
-
match: contains
opt: or
part: $message_headers
val: "de.indeed.com"
-


Help!

 

[cPRex]

Hey there! Do all those emails consistently have the same address in the X-CSA-Complaints field? If so, they are likely just including that fake email address so they can get marked as a verified sender.

If you try a more basic Subject filter, does that also not work?