Why does rspamd consider an odd number of URIs in an email to be an indicator of spam?

Rspamd has many email spam heuristics, and one of them is URI_COUNT_ODD. This heuristic seems to just count how many URIs are in the body of the email, and adds 1 to the score if the number is odd. What is the rationale behind this?

Solution 1:

Came across your question because I had the same question. From what I understand in looking through things the logic as follows:

This test is applied specifically to "multipart/alternative" type emails (ie emails that contain both a plain text part and an html part). Since both the text part and the html part should have the same URIs in them, the total number of URIs in the message should be an even number. If there is an odd number or URIs in a multipart message, then the text part and HTML part don't match, which is somewhat suspicious.