Re: MAILING_LIST_MULTI

Matus UHLAR - fantomas <[email protected]>
Newsgroups gmane.mail.spam.spamassassin.general
Message-ID <[email protected]>
On 25.02.25 09:02, Niamh Holding wrote:
>Been getting a lot of spam hitting this rule recently, guess the spammers are starting to use common list managers to send their rubbish.

>X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on iron.holtain.net
>X-Spam-Level: *
>X-Spam-Status: No, score=1.3 required=4.5 autolearn=no autolearn_force=no
>X-Spam-Report:
>        * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at
>        *      https://www.dnswl.org/, no trust
>        *      [209.85.167.200 listed in list.dnswl.org]
>        *  0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
>        *      [209.85.167.200 listed in wl.mailspike.net]
>        *  0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
>        * -0.0 SPF_PASS SPF: sender matches SPF record
>        *  0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
>        *  0.0 HTML_MESSAGE BODY: HTML included in message
>        *  0.2 FROM_FMBLA_NEWDOM14 From domain was registered in last 7-14
>        *      days
>        *  1.6 NH_HOLTRBL_TWICE Received from a source listed twice at
>        *      rbl.holtain.net
>        * -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
>        *       manager

>Precedence: list
>Mailing-list: list [email protected]; contact [email protected]
>List-ID: <b13.trendvault.live>
>X-Google-Group-Id: 708709191815
>List-Post: <https://groups.google.com/a/trendvault.live/group/b13/post>, <mailto:[email protected]>
>List-Help: <https://support.google.com/a/trendvault.live/bin/topic.py?topic=25838>,
> <mailto:[email protected]>
>List-Archive: <https://groups.google.com/a/trendvault.live/group/b13/>
>List-Subscribe: <https://groups.google.com/a/trendvault.live/group/oqnswu/subscribe>,
> <mailto:[email protected]>
>List-Unsubscribe: <mailto:[email protected]>,
> <https://groups.google.com/a/trendvault.live/group/b13/subscribe>

Yeah, typical googlegroups.com spam.
This is abused for over a decade.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"The box said 'Requires Windows 95 or better', so I bought a Macintosh".
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.