FINDINGspam.
Jump to what to dospam.link_density
The message is mostly links rather than text.
What it looks at#
Counts unambiguous URLs (http://, https://, or a leading www. — never a bare
domain-shaped word, which would false-positive on ordinary references and filenames far
too often for a free rule) and compares the characters they cover against the total
message length.
Both of these have to be true before it fires:
- At least two links. A single link — the common, legitimate case, a product review linking the thing it’s reviewing — never fires this check on its own, no matter how short the message is.
- Links cover at least 30% of the message. Two links in several sentences of prose isn’t link spam; two or more links making up most of a short message is.
Why it matters#
Link-heavy short messages are a common spam and comment-flooding shape — a burst of promotional or phishing links with little or no surrounding text.
What to do#
Low severity — a real but weak signal on its own. Combine with the other /v1/spam
checks or your own history-based signals before acting automatically.