{"success":true,"data":{"id":"list-id-from-free-webmail","label":"List-Id header + free-webmail From — fake mailing list on Gmail/Outlook/Yahoo","description":"The message has a `List-Id` header (RFC 2919 — set by mailing list managers like Mailman, Google Groups, Amazon SES, Mailchimp, etc.) AND the From address is on a free webmail domain (gmail.com, outlook.com, yahoo.com, protonmail.com, etc.). This combo is an attacker fingerprint: legitimate mailing lists always run on dedicated mailer infrastructure with custom domains, never from personal webmail accounts. A free-webmail user \"hosting a newsletter\" via the List-Id header is almost universally a spam blaster trying to borrow mailing-list legitimacy. Weighted at +4 — a strong structural signal but not a decisive single-shot delete, because a misconfigured Google Groups owner could theoretically produce the shape legitimately.","tier":"danger","category":"other","isThin":false}}