How spam filters generally work

10 November 2016 Web and Server Leave a comment 198 Views

AREA TESTED LOCALE DESCRIPTION OF TEST TEST NAME DEFAULT SCORES
(local, net, with bayes, with bayes+net)		 MORE INFO
(additional wiki docs)
body Generic Test for Unsolicited Bulk Email GTUBE 1000.000
full Listed in Razor2 (http://razor.sf.net/) RAZOR2_CHECK 0 0.150 0 1.511
body Razor2 gives confidence level above 50% RAZOR2_CF_RANGE_51_100 0 1.485 0 0.056
full Listed in DCC (http://rhyolite.com/anti-spam/dcc/) DCC_CHECK 0 1.373 0 2.169
full Listed in Pyzor (http://pyzor.sf.net/) PYZOR_CHECK 0 2.041 0 3.451
body Incorporates a tracking ID number TRACKER_ID 1.825 1.064 1.818 0.555
body Weird repeated double-quotation marks WEIRD_QUOTING 1.353 1.966 1.774 2.000
rawbody Extra blank lines in base64 encoding MIME_BASE64_BLANKS 0.693 0.819 1.391 1.469
rawbody base64 attachment does not have a file name MIME_BASE64_NO_NAME 0.022 0 0.017 0.000
rawbody Message text disguised using base64 encoding MIME_BASE64_TEXT 1.780 0.110 1.403 0.298
rawbody MIME section missing boundary MIME_MISSING_BOUNDARY 0 0.247 0.224 0
body Multipart message mostly text/html MIME MIME_HTML_MOSTLY 1.540 0.285 0.713 1.023
body Message only has text/html MIME parts MIME_HTML_ONLY 1.204 1.158 1.156 0.177
rawbody Quoted-printable line longer than 76 chars MIME_QP_LONG_LINE 0 0.000 0.105 0.039
rawbody MIME filename does not match content MIME_SUSPECT_NAME 0.100
body HTML and text parts are different MPART_ALT_DIFF 1.837 1.505 1.823 0.066
body Character set indicates a foreign language CHARSET_FARAWAY 3.200
body Message written in an undesired language UNWANTED_LANGUAGE_BODY 2.800
body Body includes 8 consecutive 8-bit characters BODY_8BITS 1.500
body Body contains a ROT13-encoded email address EMAIL_ROT13 2.720 1.474 2.934 3.105
body Message body has 70-80% blank lines BLANK_LINES_70_80 1.668 1.127 0.745 1.515
body Message body has 80-90% blank lines BLANK_LINES_80_90 0.046 0 0.216 0
body Message body has 90-100% blank lines BLANK_LINES_90_100 1.490 1.750 1.877 1.996
body Message body has many words used only once UNIQUE_WORDS 3.109 2.549 1.639 2.273
body Message body mentions many internet domains DOMAIN_RATIO 2.552 1.360 2.534 3.176
header Did not pass through any untrusted hosts ALL_TRUSTED -2.400 -2.820 -2.867 -3.300
header NJABL: sender is confirmed open relay RCVD_IN_NJABL_RELAY 0 0.934 0 1.397
header NJABL: dialup sender did non-local SMTP RCVD_IN_NJABL_DUL 0 1.655 0 0.088
header NJABL: sender is confirmed spam source RCVD_IN_NJABL_SPAM 0 1.051 0 1.841
header NJABL: sent through multi-stage open relay RCVD_IN_NJABL_MULTI 1
header NJABL: sender is an open formmail RCVD_IN_NJABL_CGI 1
header NJABL: sender is an open proxy RCVD_IN_NJABL_PROXY 0 1.026 0 0.438
header SORBS: sender is open HTTP proxy server RCVD_IN_SORBS_HTTP 0 0 0 0.043
header SORBS: sender is open proxy server RCVD_IN_SORBS_MISC 0 0 0 0.338
header SORBS: sender is open SMTP relay RCVD_IN_SORBS_SMTP 0 1.597 0 2.493
header SORBS: sender is open SOCKS proxy server RCVD_IN_SORBS_SOCKS 0 1.847 0 2.054
header SORBS: sender is a abuseable web server RCVD_IN_SORBS_WEB 0 0 0 0.007
header SORBS: sender demands to never be tested RCVD_IN_SORBS_BLOCK 1
header SORBS: sender is on a hijacked network RCVD_IN_SORBS_ZOMBIE 0 0.819 0 0
header SORBS: sent directly from dynamic IP address RCVD_IN_SORBS_DUL 0 0.137 0 1.987
header Received via a relay in Spamhaus SBL RCVD_IN_SBL 0 1.050 0 0.107
header Received via a relay in Spamhaus XBL RCVD_IN_XBL 0 2.511 0 3.076
header Envelope sender in dsn.rfc-ignorant.org DNS_FROM_RFC_DSN 1
header Envelope sender in postmaster.rfc-ignorant.org DNS_FROM_RFC_POST 0 1.376 0 1.614
header Envelope sender in abuse.rfc-ignorant.org DNS_FROM_RFC_ABUSE 0 0.374 0 0
header Envelope sender in whois.rfc-ignorant.org DNS_FROM_RFC_WHOIS 0 0.492 0 0.296
header Envelope sender in bogusmx.rfc-ignorant.org DNS_FROM_RFC_BOGUSMX 0 1.463 0 2.630
header Received via a relay in list.dsbl.org RCVD_IN_DSBL 0 2.765 0 3.805
header From: sender listed in dnsbl.ahbl.org DNS_FROM_AHBL_RHSBL 0 0.070 0 0.295
header Has Habeas warrant mark and on Infringer List HABEAS_INFRINGER 0 16.0 0 16.0
header Has Habeas warrant mark and on User List HABEAS_USER 0 -8.0 0 -8.0
header Sender is in Bonded Sender Program (trusted relay) RCVD_IN_BSP_TRUSTED 0 -4.3 0 -4.3
header Sender is in Bonded Sender Program (other relay) RCVD_IN_BSP_OTHER 0 -0.1 0 -0.1
header Sender domain is new and very high volume SB_NEW_BULK 1
header Sender IP hosted at NSP has a volume spike SB_NSP_VOLUME_SPIKE 1
header Received via a relay in bl.spamcop.net RCVD_IN_BL_SPAMCOP_NET 0 1.832 0 1.216
header Received via a relay in RSL RCVD_IN_RSL 0 0.677 0 1.720
header Relay in RBL, http://www.mail-abuse.org/rbl/ RCVD_IN_MAPS_RBL 1
header Relay in DUL, http://www.mail-abuse.org/dul/ RCVD_IN_MAPS_DUL 1
header Relay in RSS, http://www.mail-abuse.org/rss/ RCVD_IN_MAPS_RSS 1
header Relay in NML, http://www.mail-abuse.org/nml/ RCVD_IN_MAPS_NML 1
header Envelope sender has no MX or A DNS records NO_DNS_FOR_FROM 0 1.1 0 1.6
header Subject contains a gappy version of ‘cialis’ SUBJECT_DRUG_GAP_C 1.993 1.917 2.501 1.325
header Subject contains a gappy version of ‘levitra’ SUBJECT_DRUG_GAP_L 2.117 2.726 2.181 2.456
header Subject contains a gappy version of ‘phentermine’ SUBJECT_DRUG_GAP_P 0.621 0.765 0.698 1.425
header Subject contains a gappy version of ‘soma’ SUBJECT_DRUG_GAP_S 2.005 0.277 2.920 2.041
header Subject contains a gappy version of ‘valium’ SUBJECT_DRUG_GAP_VA 2.005 1.922 2.934 3.680
header Subject contains a gappy version of ‘viagra’ SUBJECT_DRUG_GAP_VIA 2.659 1.770 3.158 0.253
header Subject contains a gappy version of ‘vicodin’ SUBJECT_DRUG_GAP_VIC 2.560 2.961 2.691 2.868
header Subject contains a gappy version of ‘xanax’ SUBJECT_DRUG_GAP_X 2.538 2.282 2.945 2.512
body Talks about price per dose DRUG_DOSAGE 0.342 0.608 0.405 0.862
body Mentions an E.D. drug DRUG_ED_CAPS 0.122 1.535 0 0.185
body Viagra and other drugs DRUG_ED_COMBO 1.000 0.183 1.415 1.636
body Talks about an E.D. drug using its chemical name DRUG_ED_SILD 1.856 0.421 1.597 1.666
body Mentions Generic Viagra DRUG_ED_GENERIC 1.933 1.181 0 1.128
body Fast Viagra Delivery DRUG_ED_ONLINE 0.553 1.820 1.097 2.300
body Deep discount medications DEEP_DISC_MEDS 2.480 1.211 2.573 2.626
body Online Pharmacy ONLINE_PHARMACY 2.730 0 2.895 0.000
body Attempts to disguise the word ‘viagra’ VIA_GAP_GRA 2.800 3.171 2.886 3.005
body Two or more drugs crammed together into one word DRUGS_SMEAR1 0.515 1.522 0.475 2.351
header Host HELO did not match rDNS: msn.com FAKE_HELO_MSN 1.773 1.456 2.069 2.645
header Host HELO did not match rDNS: mail.com FAKE_HELO_MAIL_COM 1.303 1.972 0.111 0.000
header Host HELO did not match rDNS: email.com FAKE_HELO_EMAIL_COM 0 0 0 1.537
header Host HELO did not match rDNS: eudoramail.com FAKE_HELO_EUDORAMAIL 1.520 0.907 0 0
header Host HELO did not match rDNS: excite.com FAKE_HELO_EXCITE 1.840 2.127 2.127 2.074
header Host HELO did not match rDNS: lycos.com FAKE_HELO_LYCOS 1.410 1.645 0 0.988
header Host HELO did not match rDNS: yahoo.ca FAKE_HELO_YAHOO_CA 1.166 0 0.171 1.116
header Relay HELO’d with suspicious hostname (mail.com) FAKE_HELO_MAIL_COM_DOM 1.920 2.173 2.312 2.108
header Relay HELO’d using suspicious hostname (IP addr 1) HELO_DYNAMIC_IPADDR 3.520 2.754 4.070 4.400
header Relay HELO’d using suspicious hostname (DHCP) HELO_DYNAMIC_DHCP 2.791 0.087 0.958 1.248
header Relay HELO’d using suspicious hostname (HCC) HELO_DYNAMIC_HCC 3.360 1.540 2.451 3.741
header Relay HELO’d using suspicious hostname (ATTBI.com) HELO_DYNAMIC_ATTBI 3.200 3.662 2.760 3.147
header Relay HELO’d using suspicious hostname (Rogers) HELO_DYNAMIC_ROGERS 1.677 0.793 1.888 2.094
header Relay HELO’d using suspicious hostname (Adelphia) HELO_DYNAMIC_ADELPHIA 2.320 1.829 2.389 2.199
header Relay HELO’d using suspicious hostname (T-Dialin) HELO_DYNAMIC_DIALIN 2.320 0.443 2.429 1.755
header Relay HELO’d using suspicious hostname (Hex IP) HELO_DYNAMIC_HEXIP 1.826 1.320 1.453 1.522
header Relay HELO’d using suspicious hostname (Split IP) HELO_DYNAMIC_SPLIT_IP 2.869 0.887 0.992 0.775
header Relay HELO’d using suspicious hostname (YahooBB) HELO_DYNAMIC_YAHOOBB 2.800 2.776 2.572 3.000
header Relay HELO’d using suspicious hostname (OptOnline) HELO_DYNAMIC_OOL 3.120 2.508 3.065 3.182
header Relay HELO’d using suspicious hostname (IP addr 2) HELO_DYNAMIC_IPADDR2 3.271 0.805 2.554 3.496
header Relay HELO’d using suspicious hostname (RR 2) HELO_DYNAMIC_RR2 2.080 1.015 1.678 2.200
header Relay HELO’d using suspicious hostname (Comcast) HELO_DYNAMIC_COMCAST 3.040 3.533 3.217 3.700
header Relay HELO’d using suspicious hostname (Telia) HELO_DYNAMIC_TELIA 0 0 1.216 1.515
header Relay HELO’d using suspicious hostname (VTR) HELO_DYNAMIC_VTR 1.916 0.805 2.013 1.960
header Relay HELO’d using suspicious hostname (Chello.no) HELO_DYNAMIC_CHELLO_NO 1.388 0.226 1.409 1.570
header Relay HELO’d using suspicious hostname (Chello.nl) HELO_DYNAMIC_CHELLO_NL 1.762 0 0.542 0.244
header Relay HELO’d using suspicious hostname (Veloxzone) HELO_DYNAMIC_VELOX 1.680 1.877 1.803 2.003
header Relay HELO’d using suspicious hostname (NTL) HELO_DYNAMIC_NTL 1.340 0.187 1.445 1.732
header Relay HELO’d using suspicious hostname (Home.nl) HELO_DYNAMIC_HOME_NL 1.737 0.635 1.660 1.878
header Message headers are very long HEAD_LONG 2.5
header From: does not include a real name NO_REAL_NAME 0.124 0.178 0.336 0.007
header From: ends in numbers FROM_ENDS_IN_NUMS 0.177 0.516 0.517 0.000
header From: starts with nums FROM_STARTS_WITH_NUMS 1.218 1.492 1.441 0.300
header From: contains numbers mixed in with letters FROM_HAS_MIXED_NUMS 0.107 0.298 0.024 0.000
header From: contains numbers mixed in with letters FROM_HAS_MIXED_NUMS3 1.132 1.113 1.513 1.614
header Uses an address with lots of numbers, at a big ISP ADDR_NUMS_AT_BIGSITE 0.072 0.748 0.112 0.081
header From address is “at something-offers” FROM_OFFERS 1.822 0.861 2.243 1.491
header From: has no local-part before @ sign FROM_NO_USER 1.358 0.344 1.460 0.983
header To: has no local-part before @ sign TO_NO_USER 0.332 0.116 1.615 0.128
header To: is empty TO_EMPTY 0 0 0.164 0.097
header Reply-To: is empty REPLY_TO_EMPTY 1.274 1.410 1.568 1.643
header To: repeats address as real name TO_ADDRESS_EQ_REAL 0 0.470 0.131 0.026
header Valid-looking To “undisclosed-recipients” UNDISC_RECIPS 0.966 1.391 1.295 1.302
header Faked To “Undisclosed-Recipients” FAKED_UNDISC_RECIPS 1.287 0.565 1.431 1.602
header Subject has exclamation mark and question mark PLING_QUERY 0.201 0.857 0.906 0.368
header Subject contains a unique ID SUBJ_HAS_UNIQ_ID 0.899 1.122 0.809 1.339
header Subject contains lots of white space SUBJ_HAS_SPACES 2.240 0.637 1.899 1.175
header Subject is all capitals SUBJ_ALL_CAPS 0.763 0.365 0.257 0.665
header Spam tool Message-Id: (99x9xx99 variant) MSGID_SPAM_99X9XX99 0.500 0.864 1.576 1.442
header Spam tool Message-Id: (alpha-numeric variant) MSGID_SPAM_ALPHA_NUM 2.640 3.004 3.330 3.228
header Spam tool Message-Id: (caps variant) MSGID_SPAM_CAPS 3.500 3.221 3.545 3.791
header Spam tool Message-Id: (letters variant) MSGID_SPAM_LETTERS 2.960 3.151 3.052 2.709
header Spam tool Message-Id: (12-zeroes variant) MSGID_SPAM_ZEROES 1.584 1.763 1.783 1.859
header Message-Id has no hostname MSGID_NO_HOST 0.087 0 0.816 0.140
header Message-Id is fake (in Outlook Express format) MSGID_OUTLOOK_INVALID 2.000 2.290 2.498 2.700
header Message-ID has ALLCAPS@yahoo.com MSGID_YAHOO_CAPS 2.425 0.702 2.442 3.800
header Message-Id for external message added locally MSGID_FROM_MTA_ID 1.440 1.704 1.756 1.723
header Message-Id was added by a hotmail.com relay MSGID_FROM_MTA_HOTMAIL 1.600 1.858 1.987 2.144
header Date header uses unusual Y2K formatting DATE_SPAMWARE_Y2K 2.958 2.888 3.384 3.911
header Invalid Date: header (not RFC 2822) INVALID_DATE 0.011 0.235 0 0.236
header Invalid Date: header (timezone does not exist) INVALID_DATE_TZ_ABSURD 0 0 0.664 0.960
header Invalid date in header (wrong CST timezone) INVALID_TZ_CST 2.044 0.066 0.598 2.873
header Invalid date in header (wrong EST timezone) INVALID_TZ_EST 1.492 2.326 1.672 3.582
header Invalid date in header (wrong GMT/UTC timezone) INVALID_TZ_GMT 1.708 0.636 1.549 0.198
header Date: is 3 to 6 hours before Received: date DATE_IN_PAST_03_06 0.025 0 0.127 0
header Date: is 6 to 12 hours before Received: date DATE_IN_PAST_06_12 0.301 0.211 0.918 0
header Date: is 12 to 24 hours before Received: date DATE_IN_PAST_12_24 0.374 0 0.571 0.703
header Date: is 24 to 48 hours before Received: date DATE_IN_PAST_24_48 0 0.302 0.133 0.089
header Date: is 48 to 96 hours before Received: date DATE_IN_PAST_48_96 0.034 0.257 0.222 0
header Date: is 96 hours or more before Received: date DATE_IN_PAST_96_XX 0.505 1.082 0.979 1.360
header Date: is 3 to 6 hours after Received: date DATE_IN_FUTURE_03_06 1.288 0.072 2.052 0.847
header Date: is 6 to 12 hours after Received: date DATE_IN_FUTURE_06_12 1.040 1.202 1.153 1.300
header Date: is 12 to 24 hours after Received: date DATE_IN_FUTURE_12_24 2.118 2.329 2.863 3.031
header Date: is 24 to 48 hours after Received: date DATE_IN_FUTURE_24_48 2.023 2.046 2.301 2.314
header Date: is 48 to 96 hours after Received: date DATE_IN_FUTURE_48_96 2.080 2.296 2.498 2.689
header Date: is 96 hours or more after Received: date DATE_IN_FUTURE_96_XX 1.393 1.428 1.930 1.962
header Headers contain an unresolved template UNRESOLVED_TEMPLATE 1.324 0.618 1.369 2.866
header Subject contains too many raw illegal characters SUBJ_ILLEGAL_CHARS 2.880 2.854 3.459 2.854
header From contains too many raw illegal characters FROM_ILLEGAL_CHARS 0.861 0.046 0 0.008
header Header contains too many raw illegal characters HEAD_ILLEGAL_CHARS 0.539 2.018 0.961 2.125
header Subject contains an English UCE tag ENGLISH_UCE_SUBJECT 2.080 0.336 2.127 0.110
header Subject contains a Japanese UCE tag JAPANESE_UCE_SUBJECT 0 0 1.665 1.800
header Subject: contains Korean unsolicited email tag KOREAN_UCE_SUBJECT 2.400 2.703 2.469 3.081
header From and To are the same, but not exactly FROM_AND_TO_SAME 0 0.198 0 0
header Received: contains a forged HELO FORGED_RCVD_HELO 0 0.050 0.266 0.000
header Received: HELO and IP do not match, but should RCVD_HELO_IP_MISMATCH 2.799 0.618 1.647 2.178
header Received: contains an IP address used for HELO RCVD_NUMERIC_HELO 0.636 1.531 1.348 1.248
header Received: contains illegal IP address RCVD_ILLEGAL_IP 1.335 1.370 1.588 0.944
header Received by mail server with no name RCVD_BY_IP 0 0.024 0.051 0.067
header Received forged, contains fake AOL relays FORGED_AOL_RCVD 0 0 1.451 0
header Contains forged hostname for a DSL IP in Brazil FORGED_TELESP_RCVD 1.595 0.669 1.468 1.532
header Forged hotmail.com ‘Received:’ header found FORGED_HOTMAIL_RCVD 2.614 2.132 2.150 2.536
header hotmail.com ‘From’ address, but no ‘Received:’ FORGED_HOTMAIL_RCVD2 0.787 1.079 1.415 1.177
header Forged eudoramail.com ‘Received:’ header found FORGED_EUDORAMAIL_RCVD 1.657 0.653 1.130 0.290
header ‘From’ yahoo.com does not match ‘Received’ headers FORGED_YAHOO_RCVD 1.668 2.174 2.095 2.700
header ‘From’ juno.com does not match ‘Received’ headers FORGED_JUNO_RCVD 1.644 1.722 2.018 0.792
header Forged ‘by gw05’ ‘Received:’ header found FORGED_GW05_RCVD 0 0 1.495 1.697
header Character set doesn’t exist NONEXISTENT_CHARSET 0 0 1.411 1.418
header A foreign language charset used in headers CHARSET_FARAWAY_HEADER 3.200
header Sent with ‘X-Priority’ set to high X_PRIORITY_HIGH 0.125 0.093 0.077 0.000
header Sent with ‘X-Msmail-Priority’ set to high X_MSMAIL_PRIORITY_HIGH 0 0.267 0.021 0.000
header Received: says mail sent around the world (HELO) ROUND_THE_WORLD_LOCAL 1.347 0.464 2.351 0.213
header Received: says mail sent around the world (DNS) ROUND_THE_WORLD 0 1.741 0 1.958
header Missing Date: header MISSING_DATE 0 0.019 0.647 0.000
header Missing To: header MISSING_HEADERS 0 0 0.087 0.119
header Similar addresses in recipient list SUSPICIOUS_RECIPS 1.473 1.459 0.820 1.915
header Recipient list is sorted by address SORTED_RECIPS 0.879 1.155 1.759 0.887
header Subject: contains G.a.p.p.y-T.e.x.t GAPPY_SUBJECT 1.365 1.319 2.084 1.343
header Message has X-Library header X_LIBRARY 2.105 1.369 1.863 2.755
header Subject contains “As Seen” SUBJ_AS_SEEN 0.995 1.691 1.214 0.000
header Subject starts with dollar amount SUBJ_DOLLARS 2.449 0.973 1.935 0.054
header Subject contains “For Only” SUBJ_FOR_ONLY 0.646 1.100 1.726 0.044
header Subject contains “FREE” in CAPS SUBJ_FREE_CAP 0.011 0 0.146 0.000
header Subject starts with “Free” SUB_FREE_OFFER 0.055 0.034 0.103 0.000
header Subject GUARANTEED SUBJ_GUARANTEED 1.749 1.302 0.081 0.452
header Subject starts with “Hello” SUB_HELLO 1.405 1.358 0.954 0.007
header Subject includes “life insurance” SUBJ_LIFE_INSURANCE 1.840 2.068 2.184 2.020
header Subject contains “Your Bills” or similar SUBJ_YOUR_DEBT 1.760 2.068 2.035 1.261
header Subject contains “Your Family” SUBJ_YOUR_FAMILY 1.647 0 2.033 0.011
header Subject contains “Your Own” SUBJ_YOUR_OWN 0.872 1.294 1.371 0.000
header Received contains a faked HELO hostname RCVD_FAKE_HELO_DOTCOM 0.899 0.034 0.969 0.424
header To: address appears in Subject ADDRESS_IN_SUBJECT 1.296 1.409 1.866 1.804
header Subject talks about losing pounds SUBJECT_DIET 1.355 0.723 0.059 0.266
header Header has extraneous Content-type:…type= entry EXTRA_MPART_TYPE 0 0.222 0 0
header To header contains ‘recipient’ marker TO_RECIP_MARKER 0 0 1.370 1.539
header Spam tool pattern in MIME boundary MIME_BOUND_DD_DIGITS 3.600 4.230 4.162 4.139
header Spam tool pattern in MIME boundary MIME_BOUND_DIGITS_7 0 0 1.460 0.893
header Spam tool pattern in MIME boundary MIME_BOUND_DIGITS_15 2.674 3.286 3.120 3.400
header Spam tool pattern in MIME boundary MIME_BOUND_MANY_HEX 1.920 2.255 2.590 2.700
header Spam tool pattern in MIME boundary (rfkindy) MIME_BOUND_RKFINDY 2.080 2.347 2.590 2.671
header To: has a malformed address TO_MALFORMED 0.895 2.253 0.455 2.187
header From address is webmail, but starts with a number FROM_NUM_AT_WEBMAIL 1.389 0.258 1.901 1.617
header From webmail service and address ends in numbers FROM_WEBMAIL_END_NUMS6 0.178 0.046 0.389 0.000
header From Address contains FREE ADDR_FREE 0.194 0.078 1.038 1.832
header Sent to a text file TO_TXT 0 0 1.362 1.580
header Involves ‘china.com’ CHINA_HEADER 1.840 1.911 2.312 2.386
header Received line contains spam-sign (lowercase smtp) WITH_LC_SMTP 1.600 0.235 1.862 2.200
header From address has no lower-case characters FROM_NO_LOWER 1.010 1.307 1.650 0.377
header Subject line starts with Buy or Buying SUBJ_BUY 0.565 0.490 0.414 0.000
header Subject is indicative of a Nigerian spam NIGERIAN_SUBJECT1 0 0 0.270 0
header Subject is indicative of a Nigerian spam NIGERIAN_SUBJECT2 1.235 1.765 1.935 2.090
header Message would have been caught by accessdb ACCESSDB 1
header Received headers forged (AM/PM) RCVD_AM_PM 1.558 0.091 1.802 1.927
header Multiple Content-Type headers found HEADER_COUNT_CTYPE 1.198 1.676 1.482 1.771
header Host HELO’d as a big ISP, but had no rDNS NO_RDNS_DOTCOM_HELO 0.025 0.024 0.601 0.016
header X-Originating-IP doesn’t look like IPv4 address X_ORIG_IP_NOT_IPV4 0 1.006 0.081 2.582
header X-Authentication-Warning header looks faked X_AUTH_WARN_FAKED 2.094 2.599 1.654 3.105
header Received header contains faked ‘mr.outblaze.com’ FAKE_OUTBLAZE_RCVD 2.400 2.726 2.867 3.100
header Message is from domain that never sends email FROM_NONSENDING_DOMAIN 1.486 0.308 1.678 0.000
header Subject contains common spam sign (2 numbers) SUBJ_2_NUM_PARENS 1.472 0.276 1.672 2.102
body HTML included in message HTML_MESSAGE 0.001
body Message is 0% to 10% HTML HTML_00_10 0.985 0.138 1.070 1.068
body Message is 10% to 20% HTML HTML_10_20 1.050 0.295 1.350 0.246
body Message is 20% to 30% HTML HTML_20_30 1.241 0.504 0.567 0.226
body Message is 30% to 40% HTML HTML_30_40 0.879 0.056 0.437 0.021
body Message is 40% to 50% HTML HTML_40_50 0.527 0.086 0.052 0.035
body Message is 50% to 60% HTML HTML_50_60 1.053 0.095 0.539 0.087
body Message is 60% to 70% HTML HTML_60_70 0.516 0.027 0 0
body Message is 70% to 80% HTML HTML_70_80 0.151 0 0.039 0
body Message is 80% to 90% HTML HTML_80_90 0.027 0 0.036 0.146
body Message is 90% to 100% HTML HTML_90_100 0.346 0.189 0.043 0.022
body HTML has very strong “shouting” markup HTML_SHOUTING3 0.266 0 0.012 0.019
body HTML has very strong “shouting” markup HTML_SHOUTING4 0.076 0 0.052 0
body HTML has very strong “shouting” markup HTML_SHOUTING5 0.026 0 0.030 0.019
body HTML has very strong “shouting” markup HTML_SHOUTING6 0 0.004 0 0.000
body HTML has very strong “shouting” markup HTML_SHOUTING7 0.450 0.472 0 0.646
body HTML contains text after HTML close tag HTML_TEXT_AFTER_HTML 0.312 0.205 0.032 0.031
body HTML contains text after BODY close tag HTML_TEXT_AFTER_BODY 0.263 0.151 0.752 0.061
body HTML comment is very short HTML_COMMENT_SHORT 0.014 0.625 0 0.000
body HTML message is a saved web page HTML_COMMENT_SAVED_URL 0.528 0.130 0.470 0.146
body HTML conversion tool used by spam HTML_CONVERTED 0 1.204 0.402 1.605
body HTML with embedded plugin object HTML_EMBEDS 0 0.084 0.108 0.207
body HTML contains unsafe auto-executing code HTML_EVENT_UNSAFE 0 0 0.022 0.515
body HTML font size is tiny HTML_FONT_SIZE_TINY 0 0.419 0 0.533
body HTML font size is negative HTML_FONT_SIZE_NONE 0 0.455 1.119 0.033
body HTML font size is large HTML_FONT_SIZE_LARGE 1.387 0.712 0.496 0.153
body HTML font size is huge HTML_FONT_SIZE_HUGE 1.796 1.278 2.265 2.594
body HTML tag for a big font size HTML_FONT_BIG 0 0.232 0 0.142
body HTML tag for a tiny font size HTML_FONT_TINY 2.141 0.471 0.521 0.964
body HTML font color is same as background HTML_FONT_INVISIBLE 0 0.065 0 0.036
body HTML font color similar to background HTML_FONT_LOW_CONTRAST 1.011 0.955 1.017 0.788
body HTML font face is not a word HTML_FONT_FACE_BAD 0 0 0.044 0.037
body HTML font face has excess capital characters HTML_FONT_FACE_CAPS 0 0.804 0.281 0.247
body HTML includes a form which sends mail HTML_FORMACTION_MAILTO 1.840 2.162 1.907 2.353
body HTML: images with 0-400 bytes of words HTML_IMAGE_ONLY_04 3.120 3.094 3.482 3.304
body HTML: images with 400-800 bytes of words HTML_IMAGE_ONLY_08 2.881 1.970 2.730 3.036
body HTML: images with 800-1200 bytes of words HTML_IMAGE_ONLY_12 2.360 1.473 2.741 2.942
body HTML: images with 1200-1600 bytes of words HTML_IMAGE_ONLY_16 1.352 1.279 1.990 1.047
body HTML: images with 1600-2000 bytes of words HTML_IMAGE_ONLY_20 1.567 0.843 1.023 0.446
body HTML: images with 2000-2400 bytes of words HTML_IMAGE_ONLY_24 1.088 1.003 0.787 0.502
body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_02 1.729 0 1.125 0.018
body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_04 1.038 0.184 0.515 0.105
body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_06 0.072 0 0.342 0.131
body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_08 0 0.000 0 0.032
body HTML link text says “push here” or similar HTML_LINK_PUSH_HERE 1.627 0.409 1.843 0.873
body Message is 5% to 10% HTML obfuscation HTML_OBFUSCATE_05_10 0.428 0.483 0.563 0.257
body Message is 10% to 20% HTML obfuscation HTML_OBFUSCATE_10_20 0.931 0.732 0.796 0.865
body Message is 20% to 30% HTML obfuscation HTML_OBFUSCATE_20_30 0.997 0.597 0.014 0.000
body Message is 30% to 40% HTML obfuscation HTML_OBFUSCATE_30_40 2.517 1.933 3.005 3.445
body Message is 40% to 50% HTML obfuscation HTML_OBFUSCATE_40_50 2.641 1.746 2.739 3.089
body Message is 50% to 60% HTML obfuscation HTML_OBFUSCATE_50_60 2.635 1.339 2.882 3.325
body Message is 60% to 70% HTML obfuscation HTML_OBFUSCATE_60_70 2.257 0.971 2.432 2.805
body Message is 70% to 80% HTML obfuscation HTML_OBFUSCATE_70_80 2.308 1.334 2.256 2.689
body Message is 80% to 90% HTML obfuscation HTML_OBFUSCATE_80_90 1.600 0.489 1.656 1.939
body Message is 90% to 100% HTML obfuscation HTML_OBFUSCATE_90_100 1.405 0.203 1.657 1.775
body HTML tags used to obfuscate words HTML_BACKHAIR_2 0.144 0 0.032 0
body HTML tags used to obfuscate words HTML_BACKHAIR_4 0 0 0.138 0.058
body HTML tags used to obfuscate words HTML_BACKHAIR_8 1.075 0.569 1.137 0.727
body HTML has many bad attributes in tags HTML_ATTR_BAD 0 0.101 0.609 2.354
body HTML appears to have random attributes in tags HTML_ATTR_UNIQUE 0.441 1.165 1.097 0.000
body Image tag intended to identify you HTML_WEB_BUGS 0.166 0.013 0.311 0.035
body HTML has unbalanced “body” tags HTML_TAG_BALANCE_BODY 0.043 0.389 0.096 0.000
body HTML has unbalanced “head” tags HTML_TAG_BALANCE_HEAD 0.061 0.860 0.033 0.000
body HTML has “marquee” tag HTML_TAG_EXIST_MARQUEE 2.160 1.758 1.840 2.034
body HTML has “tbody” tag HTML_TAG_EXIST_TBODY 1.014 0.233 0.079 0.114
body HTML message is 0% to 10% bad tags HTML_BADTAG_00_10 0 0 0.001 0.000
body HTML message is 10% to 20% bad tags HTML_BADTAG_10_20 0.236 0 0 0
body HTML message is 20% to 30% bad tags HTML_BADTAG_20_30 0 0.169 0.035 0
body HTML message is 30% to 40% bad tags HTML_BADTAG_30_40 0 0.103 0.017 0
body HTML message is 40% to 50% bad tags HTML_BADTAG_40_50 0.002 0 0.000 0.010
body HTML message is 50% to 60% bad tags HTML_BADTAG_50_60 0.864 0.430 1.035 0.153
body HTML message is 60% to 70% bad tags HTML_BADTAG_60_70 1.726 1.127 2.314 1.356
body HTML message is 70% to 80% bad tags HTML_BADTAG_70_80 1.657 0.075 2.087 2.280
body HTML message is 80% to 90% bad tags HTML_BADTAG_80_90 1.861 1.309 1.831 1.911
body HTML message is 90% to 100% bad tags HTML_BADTAG_90_100 0.746 1.192 2.688 2.804
body 0% to 10% of HTML elements are non-standard HTML_NONELEMENT_00_10 0 0 0.001 0.001
body 10% to 20% of HTML elements are non-standard HTML_NONELEMENT_10_20 0.045 0 0.000 0.000
body 20% to 30% of HTML elements are non-standard HTML_NONELEMENT_20_30 0.346 0.070 0 0
body 30% to 40% of HTML elements are non-standard HTML_NONELEMENT_30_40 0 0.012 0.010 0.000
body 40% to 50% of HTML elements are non-standard HTML_NONELEMENT_40_50 0.000
body 50% to 60% of HTML elements are non-standard HTML_NONELEMENT_50_60 1
body 60% to 70% of HTML elements are non-standard HTML_NONELEMENT_60_70 0.237 1.138 0.083 0.001
body 70% to 80% of HTML elements are non-standard HTML_NONELEMENT_70_80 0.488 0.803 1.169 0.000
body 80% to 90% of HTML elements are non-standard HTML_NONELEMENT_80_90 0.016 0.492 0.023 0.000
body 90% to 100% of HTML elements are non-standard HTML_NONELEMENT_90_100 0.011 1.582 0 2.963
body HTML is extremely short HTML_SHORT_LENGTH 0.601 0.713 0.068 0.389
body HTML title contains no text HTML_TITLE_EMPTY 0.022 0.045 0.036 0.004
body HTML title contains “Untitled” HTML_TITLE_UNTITLED 0.222 0.259 0.792 0.000
rawbody Javascript to hide URLs in browser HIDE_WIN_STATUS 0.032 0 0 0.063
rawbody HTML contains needlessly encoded characters ENTITY_DEC_ALPHANUM 0.012 0 2.686 2.716
body List removal information MULTI_REMOVAL_1WORD 1.005 0 0.916 0.802
body Send real mail to be unsubscribed REMOVE_POSTAL 1.520 1.362 1.757 1.900
body Asks you to click below (in capital letters) CLICK_BELOW_CAPS 0.135 0 0 0.112
body Click to be removed CLICK_TO_REMOVE_1 0.050 0 0.192 0.791
body Claims compliance with spam regulations SENT_IN_COMPLIANCE 1.520 1.786 1.850 2.000
body Possible mention of bill 1618 (anti-spam bill) BILL_1618 0.994 1.692 1.798 1.895
body Doesn’t ask any questions NO_QS_ASKED 0 1.196 0 0.000
body Offers a full refund FULL_REFUND 0.853 1.114 0.079 1.272
body No such thing as a free lunch (2) COMPLETELY_FREE 0.086 0 0.840 0.026
body No such thing as a free lunch (3) NO_COST 0.078 0 0.335 0.000
body One hundred percent guaranteed GUARANTEED_100_PERCENT 0.615 0.435 0.669 0.000
body Dear Friend? That’s not very dear! DEAR_FRIEND 0.542 0.766 1.288 0.070
body Contains ‘Dear (something)’ DEAR_SOMETHING 1.059 0.803 1.577 1.578
body Talks about lots of money BILLION_DOLLARS 0.193 1.185 0.407 0.134
body Talks about opting out (lowercase version) OPTING_OUT 0.157 0.494 0.030 0.479
body Talks about opting out (capitalized version) OPTING_OUT_CAPS 0.067 0.026 0.483 0.000
body Get a million email addresses MILLION_EMAIL 0.093 0.417 0.937 0.000
body Gives a lame excuse about why spam was sent EXCUSE_1 0 0 0.074 0.132
body Claims you can be removed from the list EXCUSE_3 0 0.098 0.015 0.116
body Claims you can be removed from the list EXCUSE_4 1.145 1.775 1.443 1.119
body Claims you can be removed from the list EXCUSE_6 1.444 0.734 1.782 1.696
body Claims you can be removed from the list EXCUSE_7 0 0.152 0.010 0.018
body “if you do not wish to receive any more” EXCUSE_10 0.071 0.380 0.039 0.024
body Nobody’s perfect EXCUSE_12 0.153 0 0.354 0.197
body Claims you opted-in or registered EXCUSE_19 0.056 0.357 0.021 0.000
body Claims you have provided permission EXCUSE_23 1.840 2.088 2.312 2.400
body Claims you wanted this ad EXCUSE_24 1.440 1.272 1.874 2.080
body Talks about how to be removed from mailings EXCUSE_REMOVE 0.043 0 0.513 0.310
body Targeted Traffic / Email Addresses TARGETED 0 0.692 1.471 0.480
body Tells you about a strong buy STRONG_BUY 2.880 3.384 3.018 3.117
body Claims to honor removal requests WE_HONOR_ALL 2.063 2.365 1.789 2.029
body Offers a picked stock STOCK_PICK 0.106 0.150 0.041 1.470
body Offers a alert about a stock STOCK_ALERT 2.362 1.782 2.378 2.385
body SEC-mandated penny-stock warning MICRO_CAP_WARNING 1.440 0.760 1.803 1.828
body Not registered investment advisor NOT_ADVISOR 2.160 2.444 2.590 2.700
body Describes some sort of breakthrough SOME_BREAKTHROUGH 0.232 1.921 0.907 1.610
body They have selected you for something SELECTED_YOU 1.485 1.865 1.841 1.897
body Contains mail-in order form MAIL_IN_ORDER_FORM 1.440 0.351 0 0
body University Diplomas UNIVERSITY_DIPLOMAS 2.242 0.523 0 0
body ‘Prestigious Non-Accredited Universities’ PREST_NON_ACCREDITED 1.520 1.394 1.607 1.901
body Claims “cannot be considered spam” CANNOT_BE_SPAM 0 0 1.546 1.769
body Information on growing body parts BODY_ENHANCEMENT 0.151 0.481 0.070 0
body Information on getting larger body parts BODY_ENHANCEMENT2 0.814 0.845 0.109 0
body Impotence cure IMPOTENCE 0.095 0.751 0 0.094
body Information on how to work at home (1) WORK_AT_HOME 0 0 0.325 0.030
body Information on mortgages MORTGAGE_BEST 0.948 0.923 0 0.144
body Looks like mortgage pitch MORTGAGE_PITCH 0.297 0 0.065 0
body Information on mortgage rates MORTGAGE_RATES 0 0.689 0.174 0.202
body Order a report from someone ORDER_REPORT 0 0 1.230 0
rawbody mailto URI includes removal text MAILTO_SUBJ_REMOVE 1.023 0 2.064 0.542
body Includes a link for AOL users to click AOL_USERS_LINK 0 0 0.034 0.109
body Talks about a million North American dollars NA_DOLLARS 2.078 2.193 2.485 2.611
body Mentions millions of (dollar) ((dollar) NN,NNN,NNN.NN) US_DOLLARS_3 0.331 0.411 0.010 0.354
body Talks about millions of dollars MILLION_USD 1.594 1.290 1.535 2.796
rawbody Frontpage used to create the message FRONTPAGE 0.510 0.529 0.595 2.080
body Contains “My wife, Jody” testimonial JODY 0 0 1.326 0
body Doing something with my income YOUR_INCOME 0.674 0.892 0.372 1.092
body Resistance to this spam is futile RESISTANCE_IS_FUTILE 1.520 1.786 1.850 0
body Contains ‘subject to credit approval’ SUBJ_2_CREDIT 0 0.500 0 0.076
body Contains urgent matter URG_BIZ 0.288 0.030 1.064 1.808
body Contains ‘earn (dollar) something per week’ EARN_PER_WEEK 1.360 0.856 1.757 1.896
body Spam is 100% natural?! ALL_NATURAL 2.640 1.828 2.246 1.061
body Money back guarantee MONEY_BACK 2.051 0.037 0.217 0.095
body There is no catch NO_CATCH 0 0 0.127 0
body There is no obligation NO_OBLIGATION 0.905 0.565 1.157 0.830
body You won’t be “disappointed” NO_DISAPPOINTMENT 0 1.498 1.609 0.410
body Serious Enquiries Only SERIOUS_ONLY 0 0 1.664 1.748
body Risk free. Suuurreeee…. RISK_FREE 0.036 0.247 0.135 0.230
body As seen on national TV! AS_SEEN_ON 0.393 0.320 0.613 0.020
body Common pyramid scheme phrase (1) COPY_ACCURATELY 0 0 1.324 0
body Off Shore Scams OFFSHORE_SCAM 0 0.337 0.127 0.144
body Why Pay More? WHY_PAY_MORE 1.249 0 1.713 1.978
body Congratulations – you’ve been scammed? CONGRATULATIONS 0 0 0.486 0.272
body Talks about free mobile phones CELL_PHONE_FREE 1.280 1.476 1.571 0.922
body Talks about cell-phone signal improvement CELL_PHONE_IMPROVE 0.771 0.812 1.655 1.031
body Receive a special offer RECEIVE_OFFER 1.125 0.955 1.446 0.793
body Free express or no-obligation quote FREE_QUOTE_INSTANT 0.211 1.736 0.051 0.001
body Free Membership FREE_MEMBERSHIP 0.492 1.182 1.587 0.873
body Credit Card Offers CREDIT_CARD 0.030 0.896 0.032 0.310
body Without a credit check NO_CREDIT_CHECK 0 0 1.990 0.037
body Avoiding bankruptcy BANKRUPTCY 0.249 1.088 1.112 0.489
body Accepting credit cards ACCEPT_CREDIT_CARDS 0.360 0 1.332 0.399
body Eliminate Bad Credit BAD_CREDIT 1.161 0.252 0.817 0
body Non-secured Credit/Debt NONSECURED_CREDIT 0 0 1.074 0
body Consolidate debt, credit, or bills CONSOLIDATE_DEBT 0.886 0.653 0 0.245
body Home refinancing REFINANCE_YOUR_HOME 1.321 0.394 0.917 0.340
body Home refinancing REFINANCE_NOW 1.611 0 1.191 0.029
body No Purchase Necessary NO_PURCHASE 0 0 0.107 0
body No Medical Exams NO_MEDICAL 1.440 1.656 1.665 0
body No Claim Forms NO_FORMS 1.622 0.973 0.912 0.011
body Requires Initial Investment INITIAL_INVEST 0.433 0.450 1.026 1.230
body Buy Direct BUY_DIRECT 1.502 1.779 1.757 1.663
body Do it Today DO_IT_TODAY 0.036 0.047 0 0
body What are you waiting for WHY_WAIT 2.240 2.060 0.796 0.764
body You can search for anyone YOU_CAN_SEARCH 1.370 0.444 1.246 1.630
body Score with babes! SEDUCTION 1.560 1.356 1.415 1.054
body Invaluable marketing information INVALUABLE_MARKETING 0 0 1.201 0
body Guaranteed Stuff GUARANTEED_STUFF 0.100 0.238 0.403 0.000
body Potential Earnings EARNINGS 0 0 1.642 1.675
body The best Rates THE_BEST_RATE 0 0.550 0 0.000
body Amazing Stuff AMAZING_STUFF 0.949 1.269 0.069 0.102
body Lose Weight Spam DIET_1 0.671 0.365 0.274 0
body Describes weight loss DIET_2 0.545 0 1.034 0.316
body Describes body fat loss DIET_3 1.794 1.061 1.835 2.073
body Reverses Aging REVERSE_AGING 1.919 1.403 2.057 2.150
body Cures Baldness HAIR_LOSS 1.381 2.371 1.428 1.738
body Removes Wrinkles WRINKLES 1.730 2.097 1.917 2.091
body While you Sleep WHILE_YOU_SLEEP 0.858 0.605 1.786 0.000
body If only it were that easy RICH 0 0.451 0 0.000
body Who really wins? YOU_WON 0.144 0.269 0 0.579
body Talks about Hidden Charges HIDDEN_CHARGES 0.046 0.961 0 0.000
body Freedom of a financial nature FIN_FREE 1.365 0.015 1.865 0.788
body Stock Disclaimer Statement FORWARD_LOOKING 1.840 2.162 2.120 2.200
body Mail guarantees satisfaction SATIS_GUAR 0.884 0 0.825 0.081
body Offers Extra Cash EXTRA_CASH 0.117 0.987 0.629 0.447
body Get Paid GET_PAID 1.390 1.764 1.466 0.862
body Have you been turned down? BEEN_TURNED_DOWN 1.336 1.266 1.682 1.890
body One Time Rip Off ONE_TIME 0.044 0 0.036 0.619
body Compete for your business COMPETE 1.600 1.791 1.804 2.050
body Meet Singles MEET_SINGLES 1.600 0 1.076 1.172
body Join Millions of Americans JOIN_MILLIONS 0.036 0.640 0.999 0.448
body Be your own boss BE_BOSS 1.512 0.145 1.847 1.648
body Multi Level Marketing mentioned ML_MARKETING 0.049 0 0.103 0
body Claims to be Legal ITS_LEGAL 0.186 1.109 0.432 0.264
body Confidentiality on all orders CONFIDENTIAL_ORDER 1.920 1.196 1.889 1.266
body Save big money SAVE_THOUSANDS 0.929 1.889 0.717 0.031
body Claims you registered with a partner MARKETING_PARTNERS 2.025 0.718 2.405 1.401
body Free Preview FREE_PREVIEW 1.612 0.376 1.887 1.851
body Domain name containing a “4u” variant DOMAIN_4U2 1.508 1.783 1.935 1.588
body Contains ‘free access’ with capitals FREE_ACCESS 0 0 0.253 0
body Contains ‘free sample’ with capitals FREE_SAMPLE 0.089 0.168 0.223 0.941
body Lowest Price LOW_PRICE 0.885 0 0.206 0
body People just leave money laying around UNCLAIMED_MONEY 1.263 1.703 1.945 1.584
body Message seems to contain rot13ed address OBSCURED_EMAIL 2.720 3.194 3.186 3.132
body Mentions their affiliate partners OUR_AFFILIATE_PARTNERS 0 0 0.041 1.443
body Talks about exercise with an exclamation! BANG_EXERCISE 1.450 1.993 1.662 1.442
body Talks about more with an exclamation! BANG_MORE 0.287 0 0.294 0
body Talks about Oprah with an exclamation! BANG_OPRAH 0.666 0.212 1.717 1.975
body Talks about quotes with an exclamation! BANG_QUOTE 1.680 1.880 1.942 1.964
body Talks about ‘acting now’ with capitals ACT_NOW_CAPS 0.222 0 0.426 0.093
body Talks about ‘starting now’ with capitals START_NOW_CAPS 1.280 1.499 1.124 0.857
body Talks about a bigger drive for sex MORE_SEX 2.240 1.762 2.287 2.422
body Something is emphatically guaranteed BANG_GUAR 0.297 0 0.254 0
body See for yourself SEE_FOR_YOURSELF 0.544 0.381 0.591 0.044
body Possible porn – Free Porn FREE_PORN 0.794 0.023 1.937 0.000
body Possible porn – Cum Shot CUM_SHOT 0.355 1.732 0.943 0
body Possible porn – Pay Site PAY_SITE 0 0 1.850 1.900
body Possible porn – Live Porn LIVE_PORN 0.040 0.360 0.019 0.000
body Possible porn – Hardcore Porn HARDCORE_PORN 1.520 0.665 1.850 0.684
body Possible porn – Hot, Nasty, Wild, Young HOT_NASTY 0.765 0.586 0.967 0.088
body Possible porn – Best, Largest, Most Porn BEST_PORN 0.566 0.263 0.044 0
body Possible porn – Nasty Girls NASTY_GIRLS 0.350 0.439 0.022 2.196
body Possible porn – Amateur Porn AMATEUR_PORN 1.397 0.769 1.615 1.744
body Possible porn – Celebrity Porn PORN_CELEBRITY 0.675 1.569 0.319 0.038
body Possible porn – Adult Web Sites SOMETHING_FOR_ADULTS 1.433 1.513 1.614 0.006
body Possible porn – various types of feline PORN_15 1.680 1.974 2.035 2.168
body Possible porn – nasty, dirty, little etc. PORN_16 0.907 0.462 1.305 0.017
body Thousands or millions of pictures, movies, etc. LOTS_OF_STUFF 0.839 0.029 0 0.000
body Attempts to disguise porn words DISGUISE_PORN 1.490 1.835 0.798 0.030
uri URL uses words/phrases which indicate porn (sex) PORN_URL_SEX 1.865 1.427 1.817 0.011
uri URL uses words/phrases which indicate porn (slut) PORN_URL_SLUT 0.941 1.022 0.194 0.094
uri URL uses words/phrases which indicate porn (misc) PORN_URL_MISC 1.728 0.573 1.767 1.620
header Subject indicates sexually-explicit content SUBJECT_SEXUAL 2.160 2.538 2.775 2.900
header Bulk email fingerprint (eGroups) found RATWARE_EGROUPS 2.180 2.701 2.552 2.805
header Bulk email fingerprint (hash 2) found RATWARE_HASH_2 0.039 0 0.085 0.037
header Bulk email fingerprint (hash 2 v2) found RATWARE_HASH_2_V2 1.798 1.319 1.767 0.980
header Bulk email fingerprint (jpfree) found RATWARE_JPFREE 0 0 1.942 2.100
uri Bulk email fingerprint (StormPost) found RATWARE_STORM_URI 1.920 1.518 2.405 2.295
header X-Mailer has malformed Outlook Express version RATWARE_OE_MALFORMED 2.160 2.407 2.522 2.588
header Bulk email fingerprint (‘esmtp’ Received) found RATWARE_RCVD_LC_ESMTP 1.745 1.474 2.122 2.083
header Bulk email fingerprint (Mozilla malformed) found RATWARE_MOZ_MALFORMED 1.594 0.990 1.752 0.558
rawbody Contains a hashbuster in Send-Safe format RATWARE_HASH_DASH 1.133 0.947 1.500 1.646
header Bulk email fingerprint (netIP) found RATWARE_NETIP 0.439 1.033 2.312 2.286
header Bulk email fingerprint (Gecko faked) found RATWARE_GECKO_BUILD 0 0.826 0.784 1.385
header Headers are in order found in spam (MTSRIX) HDR_ORDER_MTSRIX 0.417 0.391 0.192 1.057
header Headers are in order found in spam (TRIMRS) HDR_ORDER_TRIMRS 2.320 2.674 2.220 2.199
header Bulk email fingerprint (bonus space) found RCVD_BONUS_SPC_DATE 1.371 0.904 1.575 1.872
header Bulk email fingerprint (X-Message-Info) found X_MESSAGE_INFO 3.600 4.187 4.162 4.244
header Bulk email fingerprint (Received PF) found RATWARE_RCVD_PF 2.880 3.384 3.608 3.867
header Bulk email fingerprint (Received @) found RATWARE_RCVD_AT 2.550 1.011 2.691 3.415
uri Uses a numeric IP address in URL NUMERIC_HTTP_ADDR 1.565 1.572 1.872 2.135
uri Uses a dotted-decimal IP address in URL NORMAL_HTTP_TO_IP 0.104 0.080 0.830 0.028
uri Uses %-escapes inside a URL’s hostname HTTP_ESCAPED_HOST 0.034 0.094 0 0.477
uri Uses control sequences inside a URL hostname HTTP_CTRL_CHARS_HOST 1.440 1.670 1.757 1.900
uri Completely unnecessary %-escapes inside a URL HTTP_EXCESSIVE_ESCAPES 0 0.645 0 0.151
uri Dotted-decimal IP address followed by CGI IP_LINK_PLUS 0.211 0.024 0.192 0.232
uri URL of page called “remove” REMOVE_PAGE 0.081 0.604 0 0.191
uri Includes a link to a likely spammer email MAILTO_TO_SPAM_ADDR 0 0 0.106 0
uri Includes a ‘remove’ email address MAILTO_TO_REMOVE 0.886 0 0.065 0.116
uri Uses non-standard port number for HTTP WEIRD_PORT 0 0.507 0.228 0.109
uri URL contains username and (optional) password USERPASS 0.429 0.561 1.319 0.268
uri Filename is just a ‘\#’; probably a JS trick URI_IS_POUND 0 0.333 0 0
uri Includes a link to a likely spammer domain BARGAIN_URL 1.503 1.520 1.686 1.833
uri Contains an URL in the BIZ top-level domain BIZ_TLD 2.167 0.527 2.434 2.288
uri Contains an URL in the INFO top-level domain INFO_TLD 1.717 0.481 1.686 0.000
uri Has Yahoo Redirect URI YAHOO_RD_REDIR 1.237 1.083 1.366 1.642
uri Has Yahoo Redirect URI YAHOO_DRS_REDIR 1.911 0.911 1.956 0.984
uri Message has link to company offers URI_OFFERS 1.328 0.252 1.460 0.770
uri Message has URI 4you URI_4YOU 1.027 1.812 0.898 1.966
uri Contains URI to a document hosted at ‘terra.es’ TERRA_ES 1.367 0.816 1.746 2.612
uri Contains an URL-encoded hostname (HTTP77) HTTP_77 1.514 0.605 1.812 1.981
uri Contains a URI with an affiliate ID code URI_AFFILIATE 2.243 0 1.808 2.052
header Message has HTTP redirector URI URI_REDIRECTOR 0 0 0.031 0.011
body Bayesian spam probability is 0 to 1% BAYES_00 0 0 -1.665 -2.599
body Bayesian spam probability is 1 to 5% BAYES_05 0 0 -0.925 -0.413
body Bayesian spam probability is 5 to 20% BAYES_20 0 0 -0.730 -1.951
body Bayesian spam probability is 20 to 40% BAYES_40 0 0 -0.276 -1.096
body Bayesian spam probability is 40 to 60% BAYES_50 0 0 1.567 0.001
body Bayesian spam probability is 60 to 80% BAYES_60 0 0 3.515 1.0
body Bayesian spam probability is 80 to 95% BAYES_80 0 0 3.608 2.0
body Bayesian spam probability is 95 to 99% BAYES_95 0 0 3.514 3.0
body Bayesian spam probability is 99 to 100% BAYES_99 0 0 4.070 3.5
body es Claims you can be removed in Spanish REMOVE_ES_01 1
body es Claims you can be removed in Spanish REMOVE_ES_02 1
body es Claims you can be removed in Spanish REMOVE_ES_03 1
body es Claims you can be removed in Spanish REMOVE_ES_04 1
body es If you send an email you will be OptOut REMOVE_ES_05 1
body es Claims you can opt-out REMOVE_ES_06 1
body es Claims you can opt-out REMOVE_ES_07 1
body es Claims you can opt-out REMOVE_ES_08 1
body es If you want to subscribe… SUBSCRIBE_ES_01 1
body es Claims not to be spam in Spanish EXCUSE_ES_01 1
body es Someone fell free to send you a message in Spanish EXCUSE_ES_02 1
body es Someone requested an spammer to spam you in Spanish EXCUSE_ES_03 1
body es El correo como alternativa comercial EXCUSE_ES_05 1
body es Mensaje enviado por error EXCUSE_ES_06 1
body es No se puede considerar spam EXCUSE_ES_07 1
body es Para dejar de fumar DEJAR_DE_FUMAR_ES 1
body es NOS CHILLAN PARA DECIR QUE ES GRATIS GRATIS_ES 1.4
body es Nos animan a contestar si estamos interesados INTERESADO_ES 1
body es Dice cumplir con la ley LEY_ORGANICA_ES 2.0
body es Clama cumplir con la normativa SPAM NORMATIVA_SPAM_ES 2.0
body es No existe legislación en Chile contra el SPAM LEY_CHILE_ES_01 1
body es Clama cumplir con la legislación chilena LEY_CHILE_ES_02 1
body es Inmigración legal (?) a los Estados Unidos TARJETA_VERDE_ES 1
body es Promocion especial. PROMOCION_ES 1
body es Alta en buscadores hispanos. ALTA_BUSCADORES_ES 1
body es IMPERATIVOS/EXCLAMACIONES EN MAYUSCULAS. EXCLAMACION_ES 1
body es Presentación de un nuevo producto. PRESENTAMOS_ES 1
body es Pago contra reembolso. CONTRA_REEMBOLSO_ES 1
body es Para hacer su pedido. PEDIDO_ES 1
body es Haga click aqui. CLICK_ES 1
body es Los regalos no existen, salvo de nuestros amigos. REGALO_ES 1
body es Pueden ser ganadores. GANADORES_ES_01 1
body es Ha sido ganador. GANADORES_ES_02 1
body es Porno gratis. PORNO_GRATIS_ES 1
body es Mas informacion. MAS_INFORMACION_ES 1
body es Informacion y reserva INFORMACION_RESERVA_ES 1
body es Conviertete en Spammer. REENVIA_ES 1
body es No nos envían más spam… seguro que no. NO_MAS_MAIL_1_ES 1
body es No recibirá este spam otra vez… seguro que no. NO_MAS_MAIL_2_ES 1
body es Las direcciones fueron obtenidas de internet. COLECTOR_DE_MAILS_ES 1
header Contains valid Hashcash token (20 bits) HASHCASH_20 -0.500
header Contains valid Hashcash token (21 bits) HASHCASH_21 -0.700
header Contains valid Hashcash token (22 bits) HASHCASH_22 -1.000
header Contains valid Hashcash token (23 bits) HASHCASH_23 -2.000
header Contains valid Hashcash token (24 bits) HASHCASH_24 -3.000
header Contains valid Hashcash token (25 bits) HASHCASH_25 -4.000
header Contains valid Hashcash token (>25 bits) HASHCASH_HIGH -5.000
header Hashcash token already spent in another mail HASHCASH_2SPEND 0.100
header SPF: sender matches SPF record SPF_PASS -0.001
header SPF: sender does not match SPF record (fail) SPF_FAIL 0 0.001 0 0.875
header SPF: sender does not match SPF record (softfail) SPF_SOFTFAIL 0.500 0.842 0.500 0.500
header SPF: HELO matches SPF record SPF_HELO_PASS -0.001
header SPF: HELO does not match SPF record (fail) SPF_HELO_FAIL 0 0.405 0 0.001
header SPF: HELO does not match SPF record (softfail) SPF_HELO_SOFTFAIL 0 1.002 0 3.140
body Contains an URL listed in the SBL blocklist URIBL_SBL 0 0.629 0 0.996
body Contains an URL listed in the SC SURBL blocklist URIBL_SC_SURBL 0 3.897 0 4.263
body Contains an URL listed in the WS SURBL blocklist URIBL_WS_SURBL 0 0.539 0 1.462
body Contains an URL listed in the PH SURBL blocklist URIBL_PH_SURBL 0 0.839 0 2.000
body Contains an URL listed in the OB SURBL blocklist URIBL_OB_SURBL 0 1.996 0 3.213
body Contains an URL listed in the AB SURBL blocklist URIBL_AB_SURBL 0 2.007 0 0.417
header From: address is in the auto white-list AWL 1
header From: address is in the user’s black-list USER_IN_BLACKLIST 100.000
header From: address is in the user’s white-list USER_IN_WHITELIST -100.000
header From: address is in the default white-list USER_IN_DEF_WHITELIST -15.000
header User is listed in ‘blacklist_to’ USER_IN_BLACKLIST_TO 10.000
header User is listed in ‘whitelist_to’ USER_IN_WHITELIST_TO -6.000
header User is listed in ‘more_spam_to’ USER_IN_MORE_SPAM_TO -20.000
header User is listed in ‘all_spam_to’ USER_IN_ALL_SPAM_TO -100.000

 

Source :
Like
Like Love Haha Wow Sad Angry
Pages: 1 2

Tags

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments

Just an ordinary blog made by Internet enthusiast. Wohooo..!!

Professional Hosting provided by Hoster
© Copyright 2016 - 2024, All Rights Reserved Netly.win