Hi, > >-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list > > manager > > I have disabled his rule some time ago. > Many spammers use mailing list or their signatures.
Where is the score coming from for this rule? There isn't an explicit "score" value associated with the rule. describe MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager meta MAILING_LIST_MULTI __HAS_X_LOOP + __HAS_X_MAILING_LIST + __HAS_X_MAILMAN_VERSION + __HAS_LIST_ID + __HAS_X_BEEN_THERE +__DOS_HAS_LIST_UNSUB + __ML1 + __ML3 + __ML4 + __ML5 > 2 tflags MAILING_LIST_MULTI nice If everyone (figuratively speaking, I suppose) is disabling it, wouldn't it be helpful to define it explicitly or see how it's doing in masschecks? It seems like it would be helpful to look at ways mailing lists are manipulated by spammers more closely and perhaps find some anomalies there.
