Spam Assasin v. 3.0.x

This is the current list of tests SpamAssassin(tm) performs on mail messages to determine if they're spam or not. If you wish to change the score from the default, add a line like this to your ~/.spamassassin/user_prefs:

score NAME_OF_TEST 3.0

Where 3.0 is the hits you wish that test to incur, and NAME_OF_TEST is the test name from the TEST NAME column below.

If you wish to disable a test, set the score to 0 by adding a line like this to your ~/.spamassassin/user_prefs:

score NAME_OF_TEST 0

body   Accepting credit cards ACCEPT_CREDIT_CARDS 0.360 0 1.332 0.399
header   Message would have been caught by accessdb ACCESSDB 1
body   Talks about 'acting now' with capitals ACT_NOW_CAPS 0.222 0 0.426 0.093
header   From Address contains FREE ADDR_FREE 0.194 0.078 1.038 1.832
header   Uses an address with lots of numbers, at a big ISP ADDR_NUMS_AT_BIGSITE 0.072 0.748 0.112 0.081
header   To: address appears in Subject ADDRESS_IN_SUBJECT 1.296 1.409 1.866 1.804
body   Spam is 100% natural?! ALL_NATURAL 2.640 1.828 2.246 1.061
header   Did not pass through any untrusted hosts ALL_TRUSTED -11.387
body es Alta en buscadores hispanos. ALTA_BUSCADORES_ES 1
body   Possible porn - Amateur Porn AMATEUR_PORN 1.397 0.769 1.615 1.744
body   Amazing Stuff AMAZING_STUFF 0.949 1.269 0.069 0.102
body   Includes a link for AOL users to click AOL_USERS_LINK 0 0 0.034 0.109
body   As seen on national TV! AS_SEEN_ON 0.393 0.320 0.613 0.020
header   From: address is in the auto white-list AWL 1
body   Eliminate Bad Credit BAD_CREDIT 1.161 0.252 0.817 0
body   Talks about exercise with an exclamation! BANG_EXERCISE 1.450 1.993 1.662 1.442
body   Something is emphatically guaranteed BANG_GUAR 0.297 0 0.254 0
body   Talks about more with an exclamation! BANG_MORE 0.287 0 0.294 0
body   Talks about Oprah with an exclamation! BANG_OPRAH 0.666 0.212 1.717 1.975
body   Talks about quotes with an exclamation! BANG_QUOTE 1.680 1.880 1.942 1.964
body   Avoiding bankruptcy BANKRUPTCY 0.249 1.088 1.112 0.489
uri   Includes a link to a likely spammer domain BARGAIN_URL 1.503 1.520 1.686 1.833
body   Bayesian spam probability is 0 to 1% BAYES_00 0 0 -1.665 -2.599
body   Bayesian spam probability is 1 to 5% BAYES_05 0 0 -0.925 -0.413
body   Bayesian spam probability is 5 to 20% BAYES_20 0 0 -0.730 -1.951
body   Bayesian spam probability is 20 to 40% BAYES_40 0 0 -0.276 -1.096
body   Bayesian spam probability is 40 to 60% BAYES_50 0 0 1.567 0.001
body   Bayesian spam probability is 60 to 80% BAYES_60 0 0 3.515 0.372
body   Bayesian spam probability is 80 to 95% BAYES_80 0 0 3.608 2.087
body   Bayesian spam probability is 95 to 99% BAYES_95 0 0 3.514 2.063
body   Bayesian spam probability is 99 to 100% BAYES_99 0 0 4.070 1.886
body   Be your own boss BE_BOSS 1.512 0.145 1.847 1.648
body   Have you been turned down? BEEN_TURNED_DOWN 1.336 1.266 1.682 1.890
body   Possible porn - Best, Largest, Most Porn BEST_PORN 0.566 0.263 0.044 0
body   Possible mention of bill 1618 (anti-spam bill) BILL_1618 0.994 1.692 1.798 1.895
body   Talks about lots of money BILLION_DOLLARS 0.193 1.185 0.407 0.134
uri   Contains an URL in the BIZ top-level domain BIZ_TLD 2.167 0.527 2.434 2.288
body   Message body has 70-80% blank lines BLANK_LINES_70_80 1.668 1.127 0.745 1.515
body   Message body has 80-90% blank lines BLANK_LINES_80_90 0.046 0 0.216 0
body   Message body has 90-100% blank lines BLANK_LINES_90_100 1.490 1.750 1.877 1.996
body   Body includes 8 consecutive 8-bit characters BODY_8BITS 1.5
body   Information on growing body parts BODY_ENHANCEMENT 0.151 0.481 0.070 0
body   Information on getting larger body parts BODY_ENHANCEMENT2 0.814 0.845 0.109 0
body   Buy Direct BUY_DIRECT 1.502 1.779 1.757 1.663
body   Claims "cannot be considered spam" CANNOT_BE_SPAM 0 0 1.546 1.769
body   Talks about free mobile phones CELL_PHONE_FREE 1.280 1.476 1.571 0.922
body   Talks about cell-phone signal improvement CELL_PHONE_IMPROVE 0.771 0.812 1.655 1.031
body   Character set indicates a foreign language CHARSET_FARAWAY 3.2
header   A foreign language charset used in headers CHARSET_FARAWAY_HEADER 3.2
header   Involves 'china.com' CHINA_HEADER 1.840 1.911 2.312 2.386
body   Asks you to click below (in capital letters) CLICK_BELOW_CAPS 0.135 0 0 0.112
body es Haga click aqui. CLICK_ES 1
body   Click to be removed CLICK_TO_REMOVE_1 0.050 0 0.192 0.791
body es Las direcciones fueron obtenidas de internet. COLECTOR_DE_MAILS_ES 1
body   Compete for your business COMPETE 1.600 1.791 1.804 2.050
body   No such thing as a free lunch (2) COMPLETELY_FREE 0.086 0 0.840 0.026
body   Confidentiality on all orders CONFIDENTIAL_ORDER 1.920 1.196 1.889 1.266
body   Congratulations - you've been scammed? CONGRATULATIONS 0 0 0.486 0.272
body   Consolidate debt, credit, or bills CONSOLIDATE_DEBT 0.886 0.653 0 0.245
body es Pago contra reembolso. CONTRA_REEMBOLSO_ES 1
body   Common pyramid scheme phrase (1) COPY_ACCURATELY 0 0 1.324 0
body   Credit Card Offers CREDIT_CARD 0.030 0.896 0.032 0.310
body   Possible porn - Cum Shot CUM_SHOT 0.355 1.732 0.943 0
header   Date: is 3 to 6 hours after Received: date DATE_IN_FUTURE_03_06 1.288 0.072 2.052 0.847
header   Date: is 6 to 12 hours after Received: date DATE_IN_FUTURE_06_12 1.040 1.202 1.153 1.300
header   Date: is 12 to 24 hours after Received: date DATE_IN_FUTURE_12_24 2.118 2.329 2.863 3.031
header   Date: is 24 to 48 hours after Received: date DATE_IN_FUTURE_24_48 2.023 2.046 2.301 2.314
header   Date: is 48 to 96 hours after Received: date DATE_IN_FUTURE_48_96 2.080 2.296 2.498 2.689
header   Date: is 96 hours or more after Received: date DATE_IN_FUTURE_96_XX 1.393 1.428 1.930 1.962
header   Date: is 3 to 6 hours before Received: date DATE_IN_PAST_03_06 0.025 0 0.127 0
header   Date: is 6 to 12 hours before Received: date DATE_IN_PAST_06_12 0.301 0.211 0.918 0
header   Date: is 12 to 24 hours before Received: date DATE_IN_PAST_12_24 0.374 0 0.571 0.703
header   Date: is 24 to 48 hours before Received: date DATE_IN_PAST_24_48 0 0.302 0.133 0.089
header   Date: is 48 to 96 hours before Received: date DATE_IN_PAST_48_96 0.034 0.257 0.222 0
header   Date: is 96 hours or more before Received: date DATE_IN_PAST_96_XX 0.505 1.082 0.979 1.360
header   Date header uses unusual Y2K formatting DATE_SPAMWARE_Y2K 2.958 2.888 3.384 3.911
full   Listed in DCC (http://rhyolite.com/anti-spam/dcc/) DCC_CHECK 0 1.373 0 2.169
body   Dear Friend? That's not very dear! DEAR_FRIEND 0.542 0.766 1.288 0.070
body   Contains 'Dear (something)' DEAR_SOMETHING 1.059 0.803 1.577 1.578
body   Deep discount medications DEEP_DISC_MEDS 2.480 1.211 2.573 2.626
body es Para dejar de fumar DEJAR_DE_FUMAR_ES 1
body   Lose Weight Spam DIET_1 0.671 0.365 0.274 0
body   Describes weight loss DIET_2 0.545 0 1.034 0.316
body   Describes body fat loss DIET_3 1.794 1.061 1.835 2.073
body   Attempts to disguise porn words DISGUISE_PORN 1.490 1.835 0.798 0.030
header   From: sender listed in dnsbl.ahbl.org DNS_FROM_AHBL_RHSBL 0 0.070 0 0.295
header   Envelope sender in abuse.rfc-ignorant.org DNS_FROM_RFC_ABUSE 0 0.374 0 0
header   Envelope sender in bogusmx.rfc-ignorant.org DNS_FROM_RFC_BOGUSMX 0 1.463 0 2.630
header   Envelope sender in dsn.rfc-ignorant.org DNS_FROM_RFC_DSN 1
header   Envelope sender in postmaster.rfc-ignorant.org DNS_FROM_RFC_POST 0 1.376 0 1.614
header   Envelope sender in whois.rfc-ignorant.org DNS_FROM_RFC_WHOIS 0 0.492 0 0.296
body   Do it Today DO_IT_TODAY 0.036 0.047 0 0
body   Domain name containing a "4u" variant DOMAIN_4U2 1.508 1.783 1.935 1.588
body   Message body mentions many internet domains DOMAIN_RATIO 2.552 1.360 2.534 3.176
body   Talks about price per dose DRUG_DOSAGE 0.342 0.608 0.405 0.862
body   Mentions an E.D. drug DRUG_ED_CAPS 0.122 1.535 0 0.185
body   Viagra and other drugs DRUG_ED_COMBO 1.000 0.183 1.415 1.636
body   Mentions Generic Viagra DRUG_ED_GENERIC 1.933 1.181 0 1.128
body   Fast Viagra Delivery DRUG_ED_ONLINE 0.553 1.820 1.097 2.300
body   Talks about an E.D. drug using its chemical name DRUG_ED_SILD 1.856 0.421 1.597 1.666
body   Two or more drugs crammed together into one word DRUGS_SMEAR1 0.515 1.522 0.475 2.351
body   Contains 'earn (dollar) something per week' EARN_PER_WEEK 1.360 0.856 1.757 1.896
body   Potential Earnings EARNINGS 0 0 1.642 1.675
body   Body contains a ROT13-encoded email address EMAIL_ROT13 2.720 1.474 2.934 3.105
header   Subject contains an English UCE tag ENGLISH_UCE_SUBJECT 2.080 0.336 2.127 0.110
rawbody   HTML contains needlessly encoded characters ENTITY_DEC_ALPHANUM 0.012 0 2.686 2.716
body es IMPERATIVOS/EXCLAMACIONES EN MAYUSCULAS. EXCLAMACION_ES 1
body   Gives a lame excuse about why spam was sent EXCUSE_1 0 0 0.074 0.132
body   "if you do not wish to receive any more" EXCUSE_10 0.071 0.380 0.039 0.024
body   Nobody's perfect EXCUSE_12 0.153 0 0.354 0.197
body   Claims you opted-in or registered EXCUSE_19 0.056 0.357 0.021 0.000
body   Claims you have provided permission EXCUSE_23 1.840 2.088 2.312 2.400
body   Claims you wanted this ad EXCUSE_24 1.440 1.272 1.874 2.080
body   Claims you can be removed from the list EXCUSE_3 0 0.098 0.015 0.116
body   Claims you can be removed from the list EXCUSE_4 1.145 1.775 1.443 1.119
body   Claims you can be removed from the list EXCUSE_6 1.444 0.734 1.782 1.696
body   Claims you can be removed from the list EXCUSE_7 0 0.152 0.010 0.018
body es Claims not to be spam in Spanish EXCUSE_ES_01 1
body es Someone fell free to send you a message in Spanish EXCUSE_ES_02 1
body es Someone requested an spammer to spam you in Spanish EXCUSE_ES_03 1
body es El correo como alternativa comercial EXCUSE_ES_05 1
body es Mensaje enviado por error EXCUSE_ES_06 1
body es No se puede considerar spam EXCUSE_ES_07 1
body   Talks about how to be removed from mailings EXCUSE_REMOVE 0.043 0 0.513 0.310
body   Offers Extra Cash EXTRA_CASH 0.117 0.987 0.629 0.447
header   Header has extraneous Content-type:...type= entry EXTRA_MPART_TYPE 0 0.222 0 0
header   Host HELO did not match rDNS: email.com FAKE_HELO_EMAIL_COM 0 0 0 1.537
header   Host HELO did not match rDNS: eudoramail.com FAKE_HELO_EUDORAMAIL 1.520 0.907 0 0
header   Host HELO did not match rDNS: excite.com FAKE_HELO_EXCITE 1.840 2.127 2.127 2.074
header   Host HELO did not match rDNS: lycos.com FAKE_HELO_LYCOS 1.410 1.645 0 0.988
header   Host HELO did not match rDNS: mail.com FAKE_HELO_MAIL_COM 1.303 1.972 0.111 0.000
header   Relay HELO'd with suspicious hostname (mail.com) FAKE_HELO_MAIL_COM_DOM 1.920 2.173 2.312 2.108
header   Host HELO did not match rDNS: msn.com FAKE_HELO_MSN 1.773 1.456 2.069 2.645
header   Host HELO did not match rDNS: yahoo.ca FAKE_HELO_YAHOO_CA 1.166 0 0.171 1.116
header   Received header contains faked 'mr.outblaze.com' FAKE_OUTBLAZE_RCVD 2.400 2.726 2.867 3.100
header   Faked To "Undisclosed-Recipients" FAKED_UNDISC_RECIPS 1.287 0.565 1.431 1.602
body   Freedom of a financial nature FIN_FREE 1.365 0.015 1.865 0.788
header   Received forged, contains fake AOL relays FORGED_AOL_RCVD 0 0 1.451 0
header   Forged eudoramail.com 'Received:' header found FORGED_EUDORAMAIL_RCVD 1.657 0.653 1.130 0.290
header   Forged 'by gw05' 'Received:' header found FORGED_GW05_RCVD 0 0 1.495 1.697
header   Forged hotmail.com 'Received:' header found FORGED_HOTMAIL_RCVD 2.614 2.132 2.150 2.536
header   hotmail.com 'From' address, but no 'Received:' FORGED_HOTMAIL_RCVD2 0.787 1.079 1.415 1.177
header   'From' juno.com does not match 'Received' headers FORGED_JUNO_RCVD 1.644 1.722 2.018 0.792
header   Received: contains a forged HELO FORGED_RCVD_HELO 0 0.050 0.266 0.000
header   Contains forged hostname for a DSL IP in Brazil FORGED_TELESP_RCVD 1.595 0.669 1.468 1.532
header   'From' yahoo.com does not match 'Received' headers FORGED_YAHOO_RCVD 1.668 2.174 2.095 2.700
body   Stock Disclaimer Statement FORWARD_LOOKING 1.840 2.162 2.120 2.200
body   Contains 'free access' with capitals FREE_ACCESS 0 0 0.253 0
body   Free Membership FREE_MEMBERSHIP 0.492 1.182 1.587 0.873
body   Possible porn - Free Porn FREE_PORN 0.794 0.023 1.937 0.000
body   Free Preview FREE_PREVIEW 1.612 0.376 1.887 1.851
body   Free express or no-obligation quote FREE_QUOTE_INSTANT 0.211 1.736 0.051 0.001
body   Contains 'free sample' with capitals FREE_SAMPLE 0.089 0.168 0.223 0.941
header   From and To are the same, but not exactly FROM_AND_TO_SAME 0 0.198 0 0
header   From: ends in numbers FROM_ENDS_IN_NUMS 0.177 0.516 0.517 0.000
header   From: contains numbers mixed in with letters FROM_HAS_MIXED_NUMS 0.107 0.298 0.024 0.000
header   From: contains numbers mixed in with letters FROM_HAS_MIXED_NUMS3 1.132 1.113 1.513 1.614
header   From contains too many raw illegal characters FROM_ILLEGAL_CHARS 0.861 0.046 0 0.008
header   From address has no lower-case characters FROM_NO_LOWER 1.010 1.307 1.650 0.377
header   From: has no local-part before @ sign FROM_NO_USER 1.358 0.344 1.460 0.983
header   Message is from domain that never sends email FROM_NONSENDING_DOMAIN 1.486 0.308 1.678 0.000
header   From address is webmail, but starts with a number FROM_NUM_AT_WEBMAIL 1.389 0.258 1.901 1.617
header   From address is "at something-offers" FROM_OFFERS 1.822 0.861 2.243 1.491
header   From: starts with nums FROM_STARTS_WITH_NUMS 1.218 1.492 1.441 0.300
header   From webmail service and address ends in numbers FROM_WEBMAIL_END_NUMS6 0.178 0.046 0.389 0.000
rawbody   Frontpage used to create the message FRONTPAGE 0.510 0.529 0.595 2.080
body   Offers a full refund FULL_REFUND 0.853 1.114 0.079 1.272
body es Pueden ser ganadores. GANADORES_ES_01 1
body es Ha sido ganador. GANADORES_ES_02 1
header   Subject: contains G.a.p.p.y-T.e.x.t GAPPY_SUBJECT 1.365 1.319 2.084 1.343
body   Get Paid GET_PAID 1.390 1.764 1.466 0.862
body es NOS CHILLAN PARA DECIR QUE ES GRATIS GRATIS_ES 1.4
body   Generic Test for Unsolicited Bulk Email GTUBE 1000
body   One hundred percent guaranteed GUARANTEED_100_PERCENT 0.615 0.435 0.669 0.000
body   Guaranteed Stuff GUARANTEED_STUFF 0.100 0.238 0.403 0.000
header   Has Habeas warrant mark and on Infringer List HABEAS_INFRINGER 0 16.0 0 16.0
header   Has Habeas warrant mark and on User List HABEAS_USER 0 -8.0 0 -8.0
body   Cures Baldness HAIR_LOSS 1.381 2.371 1.428 1.738
body   Possible porn - Hardcore Porn HARDCORE_PORN 1.520 0.665 1.850 0.684
header   Contains valid Hashcash token (20 bits) HASHCASH_20 -0.5
header   Contains valid Hashcash token (21 bits) HASHCASH_21 -0.7
header   Contains valid Hashcash token (22 bits) HASHCASH_22 -1
header   Contains valid Hashcash token (23 bits) HASHCASH_23 -2
header   Contains valid Hashcash token (24 bits) HASHCASH_24 -3
header   Contains valid Hashcash token (25 bits) HASHCASH_25 -4
header   Hashcash token already spent in another mail HASHCASH_2SPEND 0.1
header   Contains valid Hashcash token (>25 bits) HASHCASH_HIGH -5
header   Headers are in order found in spam (MTSRIX) HDR_ORDER_MTSRIX 0.417 0.391 0.192 1.057
header   Headers are in order found in spam (TRIMRS) HDR_ORDER_TRIMRS 2.320 2.674 2.220 2.199
header   Header contains too many raw illegal characters HEAD_ILLEGAL_CHARS 0.539 2.018 0.961 2.125
header   Message headers are very long HEAD_LONG 2.5
header   Multiple Content-Type headers found HEADER_COUNT_CTYPE 1.198 1.676 1.482 1.771
header   Relay HELO'd using suspicious hostname (Adelphia) HELO_DYNAMIC_ADELPHIA 2.320 1.829 2.389 2.199
header   Relay HELO'd using suspicious hostname (ATTBI.com) HELO_DYNAMIC_ATTBI 3.200 3.662 2.760 3.147
header   Relay HELO'd using suspicious hostname (Chello.nl) HELO_DYNAMIC_CHELLO_NL 1.762 0 0.542 0.244
header   Relay HELO'd using suspicious hostname (Chello.no) HELO_DYNAMIC_CHELLO_NO 1.388 0.226 1.409 1.570
header   Relay HELO'd using suspicious hostname (Comcast) HELO_DYNAMIC_COMCAST 3.040 3.533 3.217 3.700
header   Relay HELO'd using suspicious hostname (DHCP) HELO_DYNAMIC_DHCP 2.791 0.087 0.958 1.248
header   Relay HELO'd using suspicious hostname (T-Dialin) HELO_DYNAMIC_DIALIN 2.320 0.443 2.429 1.755
header   Relay HELO'd using suspicious hostname (HCC) HELO_DYNAMIC_HCC 3.360 1.540 2.451 3.741
header   Relay HELO'd using suspicious hostname (Hex IP) HELO_DYNAMIC_HEXIP 1.826 1.320 1.453 1.522
header   Relay HELO'd using suspicious hostname (Home.nl) HELO_DYNAMIC_HOME_NL 1.737 0.635 1.660 1.878
header   Relay HELO'd using suspicious hostname (IP addr 1) HELO_DYNAMIC_IPADDR 3.520 2.754 4.070 4.400
header   Relay HELO'd using suspicious hostname (IP addr 2) HELO_DYNAMIC_IPADDR2 3.271 0.805 2.554 3.496
header   Relay HELO'd using suspicious hostname (NTL) HELO_DYNAMIC_NTL 1.340 0.187 1.445 1.732
header   Relay HELO'd using suspicious hostname (OptOnline) HELO_DYNAMIC_OOL 3.120 2.508 3.065 3.182
header   Relay HELO'd using suspicious hostname (Rogers) HELO_DYNAMIC_ROGERS 1.677 0.793 1.888 2.094
header   Relay HELO'd using suspicious hostname (RR 2) HELO_DYNAMIC_RR2 2.080 1.015 1.678 2.200
header   Relay HELO'd using suspicious hostname (Split IP) HELO_DYNAMIC_SPLIT_IP 2.869 0.887 0.992 0.775
header   Relay HELO'd using suspicious hostname (Telia) HELO_DYNAMIC_TELIA 0 0 1.216 1.515
header   Relay HELO'd using suspicious hostname (Veloxzone) HELO_DYNAMIC_VELOX 1.680 1.877 1.803 2.003
header   Relay HELO'd using suspicious hostname (VTR) HELO_DYNAMIC_VTR 1.916 0.805 2.013 1.960
header   Relay HELO'd using suspicious hostname (YahooBB) HELO_DYNAMIC_YAHOOBB 2.800 2.776 2.572 3.000
body   Talks about Hidden Charges HIDDEN_CHARGES 0.046 0.961 0 0.000
rawbody   Javascript to hide URLs in browser HIDE_WIN_STATUS 0.032 0 0 0.063
body   Possible porn - Hot, Nasty, Wild, Young HOT_NASTY 0.765 0.586 0.967 0.088
body   Message is 0% to 10% HTML HTML_00_10 0.985 0.138 1.070 1.068
body   Message is 10% to 20% HTML HTML_10_20 1.050 0.295 1.350 0.246
body   Message is 20% to 30% HTML HTML_20_30 1.241 0.504 0.567 0.226
body   Message is 30% to 40% HTML HTML_30_40 0.879 0.056 0.437 0.021
body   Message is 40% to 50% HTML HTML_40_50 0.527 0.086 0.052 0.035
body   Message is 50% to 60% HTML HTML_50_60 1.053 0.095 0.539 0.087
body   Message is 60% to 70% HTML HTML_60_70 0.516 0.027 0 0
body   Message is 70% to 80% HTML HTML_70_80 0.151 0 0.039 0
body   Message is 80% to 90% HTML HTML_80_90 0.027 0 0.036 0.146
body   Message is 90% to 100% HTML HTML_90_100 0.346 0.189 0.043 0.022
body   HTML has many bad attributes in tags HTML_ATTR_BAD 0 0.101 0.609 2.354
body   HTML appears to have random attributes in tags HTML_ATTR_UNIQUE 0.441 1.165 1.097 0.000
body   HTML tags used to obfuscate words HTML_BACKHAIR_2 0.144 0 0.032 0
body   HTML tags used to obfuscate words HTML_BACKHAIR_4 0 0 0.138 0.058
body   HTML tags used to obfuscate words HTML_BACKHAIR_8 1.075 0.569 1.137 0.727
body   HTML message is 0% to 10% bad tags HTML_BADTAG_00_10 0 0 0.001 0.000
body   HTML message is 10% to 20% bad tags HTML_BADTAG_10_20 0.236 0 0 0
body   HTML message is 20% to 30% bad tags HTML_BADTAG_20_30 0 0.169 0.035 0
body   HTML message is 30% to 40% bad tags HTML_BADTAG_30_40 0 0.103 0.017 0
body   HTML message is 40% to 50% bad tags HTML_BADTAG_40_50 0.002 0 0.000 0.010
body   HTML message is 50% to 60% bad tags HTML_BADTAG_50_60 0.864 0.430 1.035 0.153
body   HTML message is 60% to 70% bad tags HTML_BADTAG_60_70 1.726 1.127 2.314 1.356
body   HTML message is 70% to 80% bad tags HTML_BADTAG_70_80 1.657 0.075 2.087 2.280
body   HTML message is 80% to 90% bad tags HTML_BADTAG_80_90 1.861 1.309 1.831 1.911
body   HTML message is 90% to 100% bad tags HTML_BADTAG_90_100 0.746 1.192 2.688 2.804
body   HTML message is a saved web page HTML_COMMENT_SAVED_URL 0.528 0.130 0.470 0.146
body   HTML comment is very short HTML_COMMENT_SHORT 0.014 0.625 0 0.000
body   HTML conversion tool used by spam HTML_CONVERTED 0 1.204 0.402 1.605
body   HTML with embedded plugin object HTML_EMBEDS 0 0.084 0.108 0.207
body   HTML contains unsafe auto-executing code HTML_EVENT_UNSAFE 0 0 0.022 0.515
body   HTML tag for a big font size HTML_FONT_BIG 0 0.232 0 0.142
body   HTML font face is not a word HTML_FONT_FACE_BAD 0 0 0.044 0.037
body   HTML font face has excess capital characters HTML_FONT_FACE_CAPS 0 0.804 0.281 0.247
body   HTML font color is same as background HTML_FONT_INVISIBLE 0 0.065 0 0.036
body   HTML font color similar to background HTML_FONT_LOW_CONTRAST 1.011 0.955 1.017 0.788
body   HTML font size is huge HTML_FONT_SIZE_HUGE 1.796 1.278 2.265 2.594
body   HTML font size is large HTML_FONT_SIZE_LARGE 1.387 0.712 0.496 0.153
body   HTML font size is negative HTML_FONT_SIZE_NONE 0 0.455 1.119 0.033
body   HTML font size is tiny HTML_FONT_SIZE_TINY 0 0.419 0 0.533
body   HTML tag for a tiny font size HTML_FONT_TINY 2.141 0.471 0.521 0.964
body   HTML includes a form which sends mail HTML_FORMACTION_MAILTO 1.840 2.162 1.907 2.353
body   HTML: images with 0-400 bytes of words HTML_IMAGE_ONLY_04 3.120 3.094 3.482 3.304
body   HTML: images with 400-800 bytes of words HTML_IMAGE_ONLY_08 2.881 1.970 2.730 3.036
body   HTML: images with 800-1200 bytes of words HTML_IMAGE_ONLY_12 2.360 1.473 2.741 2.942
body   HTML: images with 1200-1600 bytes of words HTML_IMAGE_ONLY_16 1.352 1.279 1.990 1.047
body   HTML: images with 1600-2000 bytes of words HTML_IMAGE_ONLY_20 1.567 0.843 1.023 0.446
body   HTML: images with 2000-2400 bytes of words HTML_IMAGE_ONLY_24 1.088 1.003 0.787 0.502
body   HTML has a low ratio of text to image area HTML_IMAGE_RATIO_02 1.729 0 1.125 0.018
body   HTML has a low ratio of text to image area HTML_IMAGE_RATIO_04 1.038 0.184 0.515 0.105
body   HTML has a low ratio of text to image area HTML_IMAGE_RATIO_06 0.072 0 0.342 0.131
body   HTML has a low ratio of text to image area HTML_IMAGE_RATIO_08 0 0.000 0 0.032
body   HTML link text says "push here" or similar HTML_LINK_PUSH_HERE 1.627 0.409 1.843 0.873
body   HTML included in message HTML_MESSAGE 0.001
body   0% to 10% of HTML elements are non-standard HTML_NONELEMENT_00_10 0 0 0.001 0.001
body   10% to 20% of HTML elements are non-standard HTML_NONELEMENT_10_20 0.045 0 0.000 0.000
body   20% to 30% of HTML elements are non-standard HTML_NONELEMENT_20_30 0.346 0.070 0 0
body   30% to 40% of HTML elements are non-standard HTML_NONELEMENT_30_40 0 0.012 0.010 0.000
body   40% to 50% of HTML elements are non-standard HTML_NONELEMENT_40_50 0
body   50% to 60% of HTML elements are non-standard HTML_NONELEMENT_50_60 1
body   60% to 70% of HTML elements are non-standard HTML_NONELEMENT_60_70 0.237 1.138 0.083 0.001
body   70% to 80% of HTML elements are non-standard HTML_NONELEMENT_70_80 0.488 0.803 1.169 0.000
body   80% to 90% of HTML elements are non-standard HTML_NONELEMENT_80_90 0.016 0.492 0.023 0.000
body   90% to 100% of HTML elements are non-standard HTML_NONELEMENT_90_100 0.011 1.582 0 2.963
body   Message is 5% to 10% HTML obfuscation HTML_OBFUSCATE_05_10 0.428 0.483 0.563 0.257
body   Message is 10% to 20% HTML obfuscation HTML_OBFUSCATE_10_20 0.931 0.732 0.796 0.865
body   Message is 20% to 30% HTML obfuscation HTML_OBFUSCATE_20_30 0.997 0.597 0.014 0.000
body   Message is 30% to 40% HTML obfuscation HTML_OBFUSCATE_30_40 2.517 1.933 3.005 3.445
body   Message is 40% to 50% HTML obfuscation HTML_OBFUSCATE_40_50 2.641 1.746 2.739 3.089
body   Message is 50% to 60% HTML obfuscation HTML_OBFUSCATE_50_60 2.635 1.339 2.882 3.325
body   Message is 60% to 70% HTML obfuscation HTML_OBFUSCATE_60_70 2.257 0.971 2.432 2.805
body   Message is 70% to 80% HTML obfuscation HTML_OBFUSCATE_70_80 2.308 1.334 2.256 2.689
body   Message is 80% to 90% HTML obfuscation HTML_OBFUSCATE_80_90 1.600 0.489 1.656 1.939
body   Message is 90% to 100% HTML obfuscation HTML_OBFUSCATE_90_100 1.405 0.203 1.657 1.775
body   HTML is extremely short HTML_SHORT_LENGTH 0.601 0.713 0.068 0.389
body   HTML has very strong "shouting" markup HTML_SHOUTING3 0.266 0 0.012 0.019
body   HTML has very strong "shouting" markup HTML_SHOUTING4 0.076 0 0.052 0
body   HTML has very strong "shouting" markup HTML_SHOUTING5 0.026 0 0.030 0.019
body   HTML has very strong "shouting" markup HTML_SHOUTING6 0 0.004 0 0.000
body   HTML has very strong "shouting" markup HTML_SHOUTING7 0.450 0.472 0 0.646
body   HTML has unbalanced "body" tags HTML_TAG_BALANCE_BODY 0.043 0.389 0.096 0.000
body   HTML has unbalanced "head" tags HTML_TAG_BALANCE_HEAD 0.061 0.860 0.033 0.000
body   HTML has "marquee" tag HTML_TAG_EXIST_MARQUEE 2.160 1.758 1.840 2.034
body   HTML has "tbody" tag HTML_TAG_EXIST_TBODY 1.014 0.233 0.079 0.114
body   HTML contains text after BODY close tag HTML_TEXT_AFTER_BODY 0.263 0.151 0.752 0.061
body   HTML contains text after HTML close tag HTML_TEXT_AFTER_HTML 0.312 0.205 0.032 0.031
body   HTML title contains no text HTML_TITLE_EMPTY 0.022 0.045 0.036 0.004
body   HTML title contains "Untitled" HTML_TITLE_UNTITLED 0.222 0.259 0.792 0.000
body   Image tag intended to identify you HTML_WEB_BUGS 0.166 0.013 0.311 0.035
uri   Contains an URL-encoded hostname (HTTP77) HTTP_77 1.514 0.605 1.812 1.981
uri   Uses control sequences inside a URL hostname HTTP_CTRL_CHARS_HOST 1.440 1.670 1.757 1.900
uri   Uses %-escapes inside a URL's hostname HTTP_ESCAPED_HOST 0.034 0.094 0 0.477
uri   Completely unnecessary %-escapes inside a URL HTTP_EXCESSIVE_ESCAPES 0 0.645 0 0.151
body   Impotence cure IMPOTENCE 0.095 0.751 0 0.094
uri   Contains an URL in the INFO top-level domain INFO_TLD 1.717 0.481 1.686 0.000
body es Informacion y reserva INFORMACION_RESERVA_ES 1
body   Requires Initial Investment INITIAL_INVEST 0.433 0.450 1.026 1.230
body es Nos animan a contestar si estamos interesados INTERESADO_ES 1
header   Invalid Date: header (not RFC 2822) INVALID_DATE 0.011 0.235 0 0.236
header   Invalid Date: header (timezone does not exist) INVALID_DATE_TZ_ABSURD 0 0 0.664 0.960
header   Invalid date in header (wrong CST timezone) INVALID_TZ_CST 2.044 0.066 0.598 2.873
header   Invalid date in header (wrong EST timezone) INVALID_TZ_EST 1.492 2.326 1.672 3.582
header   Invalid date in header (wrong GMT/UTC timezone) INVALID_TZ_GMT 1.708 0.636 1.549 0.198
body   Invaluable marketing information INVALUABLE_MARKETING 0 0 1.201 0
uri   Dotted-decimal IP address followed by CGI IP_LINK_PLUS 0.211 0.024 0.192 0.232
body   Claims to be Legal ITS_LEGAL 0.186 1.109 0.432 0.264
header   Subject contains a Japanese UCE tag JAPANESE_UCE_SUBJECT 0 0 1.665 1.800
body   Contains "My wife, Jody" testimonial JODY 0 0 1.326 0
body   Join Millions of Americans JOIN_MILLIONS 0.036 0.640 0.999 0.448
header   Subject: contains Korean unsolicited email tag KOREAN_UCE_SUBJECT 2.400 2.703 2.469 3.081
body es No existe legislación en Chile contra el SPAM LEY_CHILE_ES_01 1
body es Clama cumplir con la legislación chilena LEY_CHILE_ES_02 1
body es Dice cumplir con la ley LEY_ORGANICA_ES 2
body   Possible porn - Live Porn LIVE_PORN 0.040 0.360 0.019 0.000
body   Thousands or millions of pictures, movies, etc. LOTS_OF_STUFF 0.839 0.029 0 0.000
body   Lowest Price LOW_PRICE 0.885 0 0.206 0
body   Contains mail-in order form MAIL_IN_ORDER_FORM 1.440 0.351 0 0
rawbody   mailto URI includes removal text MAILTO_SUBJ_REMOVE 1.023 0 2.064 0.542
uri   Includes a 'remove' email address MAILTO_TO_REMOVE 0.886 0 0.065 0.116
uri   Includes a link to a likely spammer email MAILTO_TO_SPAM_ADDR 0 0 0.106 0
body   Claims you registered with a partner MARKETING_PARTNERS 2.025 0.718 2.405 1.401
body es Mas informacion. MAS_INFORMACION_ES 1
body   Meet Singles MEET_SINGLES 1.600 0 1.076 1.172
body   SEC-mandated penny-stock warning MICRO_CAP_WARNING 1.440 0.760 1.803 1.828
body   Get a million email addresses MILLION_EMAIL 0.093 0.417 0.937 0.000
body   Talks about millions of dollars MILLION_USD 1.594 1.290 1.535 2.796
rawbody   Extra blank lines in base64 encoding MIME_BASE64_BLANKS 0.693 0.819 1.391 1.469
rawbody   base64 attachment does not have a file name MIME_BASE64_NO_NAME 0.022 0 0.017 0.000
rawbody   Message text disguised using base64 encoding MIME_BASE64_TEXT 1.780 0.110 1.403 0.298
header   Spam tool pattern in MIME boundary MIME_BOUND_DD_DIGITS 3.600 4.230 4.162 4.139
header   Spam tool pattern in MIME boundary MIME_BOUND_DIGITS_15 2.674 3.286 3.120 3.400
header   Spam tool pattern in MIME boundary MIME_BOUND_DIGITS_7 0 0 1.460 0.893
header   Spam tool pattern in MIME boundary MIME_BOUND_MANY_HEX 1.920 2.255 2.590 2.700
header   Spam tool pattern in MIME boundary (rfkindy) MIME_BOUND_RKFINDY 2.080 2.347 2.590 2.671
body   Multipart message mostly text/html MIME MIME_HTML_MOSTLY 1.540 0.285 0.713 1.023
body   Message only has text/html MIME parts MIME_HTML_ONLY 1.204 1.158 1.156 0.177
rawbody   MIME section missing boundary MIME_MISSING_BOUNDARY 0 0.247 0.224 0
rawbody   Quoted-printable line longer than 76 chars MIME_QP_LONG_LINE 0 0.000 0.105 0.039
rawbody   MIME filename does not match content MIME_SUSPECT_NAME 0.1
header   Missing Date: header MISSING_DATE 0 0.019 0.647 0.000
header   Missing To: header MISSING_HEADERS 0 0 0.087 0.119
body   Multi Level Marketing mentioned ML_MARKETING 0.049 0 0.103 0
body   Money back guarantee MONEY_BACK 2.051 0.037 0.217 0.095
body   Talks about a bigger drive for sex MORE_SEX 2.240 1.762 2.287 2.422
body   Information on mortgages MORTGAGE_BEST 0.948 0.923 0 0.144
body   Looks like mortgage pitch MORTGAGE_PITCH 0.297 0 0.065 0
body   Information on mortgage rates MORTGAGE_RATES 0 0.689 0.174 0.202
body   HTML and text parts are different MPART_ALT_DIFF 1.837 1.505 1.823 0.066
header   Message-Id was added by a hotmail.com relay MSGID_FROM_MTA_HOTMAIL 1.600 1.858 1.987 2.144
header   Message-Id for external message added locally MSGID_FROM_MTA_ID 1.440 1.704 1.756 1.723
header   Message-Id has no hostname MSGID_NO_HOST 0.087 0 0.816 0.140
header   Message-Id is fake (in Outlook Express format) MSGID_OUTLOOK_INVALID 2.000 2.290 2.498 2.700
header   Spam tool Message-Id: (99x9xx99 variant) MSGID_SPAM_99X9XX99 0.500 0.864 1.576 1.442
header   Spam tool Message-Id: (alpha-numeric variant) MSGID_SPAM_ALPHA_NUM 2.640 3.004 3.330 3.228
header   Spam tool Message-Id: (caps variant) MSGID_SPAM_CAPS 3.500 3.221 3.545 3.791
header   Spam tool Message-Id: (letters variant) MSGID_SPAM_LETTERS 2.960 3.151 3.052 2.709
header   Spam tool Message-Id: (12-zeroes variant) MSGID_SPAM_ZEROES 1.584 1.763 1.783 1.859
header   Message-ID has ALLCAPS@yahoo.com MSGID_YAHOO_CAPS 2.425 0.702 2.442 3.800
body   List removal information MULTI_REMOVAL_1WORD 1.005 0 0.916 0.802
body   Talks about a million North American dollars NA_DOLLARS 2.078 2.193 2.485 2.611
body   Possible porn - Nasty Girls NASTY_GIRLS 0.350 0.439 0.022 2.196
header   Subject is indicative of a Nigerian spam NIGERIAN_SUBJECT1 0 0 0.270 0
header   Subject is indicative of a Nigerian spam NIGERIAN_SUBJECT2 1.235 1.765 1.935 2.090
body   There is no catch NO_CATCH 0 0 0.127 0
body   No such thing as a free lunch (3) NO_COST 0.078 0 0.335 0.000
body   Without a credit check NO_CREDIT_CHECK 0 0 1.990 0.037
body   You won't be "disappointed" NO_DISAPPOINTMENT 0 1.498 1.609 0.410
header   Envelope sender has no MX or A DNS records NO_DNS_FOR_FROM 0 1.1 0 1.6
body   No Claim Forms NO_FORMS 1.622 0.973 0.912 0.011
body es No nos envían más spam... seguro que no. NO_MAS_MAIL_1_ES 1
body es No recibirá este spam otra vez... seguro que no. NO_MAS_MAIL_2_ES 1
body   No Medical Exams NO_MEDICAL 1.440 1.656 1.665 0
body   There is no obligation NO_OBLIGATION 0.905 0.565 1.157 0.830
body   No Purchase Necessary NO_PURCHASE 0 0 0.107 0
body   Doesn't ask any questions NO_QS_ASKED 0 1.196 0 0.000
header   Host HELO'd as a big ISP, but had no rDNS NO_RDNS_DOTCOM_HELO 0.025 0.024 0.601 0.016
header   From: does not include a real name NO_REAL_NAME 0.124 0.178 0.336 0.007
header   Character set doesn't exist NONEXISTENT_CHARSET 0 0 1.411 1.418
body   Non-secured Credit/Debt NONSECURED_CREDIT 0 0 1.074 0
uri   Uses a dotted-decimal IP address in URL NORMAL_HTTP_TO_IP 0.104 0.080 0.830 0.028
body es Clama cumplir con la normativa SPAM NORMATIVA_SPAM_ES 2
body   Not registered investment advisor NOT_ADVISOR 2.160 2.444 2.590 2.700
uri   Uses a numeric IP address in URL NUMERIC_HTTP_ADDR 1.565 1.572 1.872 2.135
body   Message seems to contain rot13ed address OBSCURED_EMAIL 2.720 3.194 3.186 3.132
body   Off Shore Scams OFFSHORE_SCAM 0 0.337 0.127 0.144
body   One Time Rip Off ONE_TIME 0.044 0 0.036 0.619
body   Online Pharmacy ONLINE_PHARMACY 2.730 0 2.895 0.000
body   Talks about opting out (lowercase version) OPTING_OUT 0.157 0.494 0.030 0.479
body   Talks about opting out (capitalized version) OPTING_OUT_CAPS 0.067 0.026 0.483 0.000
body   Order a report from someone ORDER_REPORT 0 0 1.230 0
body   Mentions their affiliate partners OUR_AFFILIATE_PARTNERS 0 0 0.041 1.443
body   Possible porn - Pay Site PAY_SITE 0 0 1.850 1.900
body es Para hacer su pedido. PEDIDO_ES 1
header   Subject has exclamation mark and question mark PLING_QUERY 0.201 0.857 0.906 0.368
body   Possible porn - various types of feline PORN_15 1.680 1.974 2.035 2.168
body   Possible porn - nasty, dirty, little etc. PORN_16 0.907 0.462 1.305 0.017
body   Possible porn - Celebrity Porn PORN_CELEBRITY 0.675 1.569 0.319 0.038
uri   URL uses words/phrases which indicate porn (misc) PORN_URL_MISC 1.728 0.573 1.767 1.620
uri   URL uses words/phrases which indicate porn (sex) PORN_URL_SEX 1.865 1.427 1.817 0.011
uri   URL uses words/phrases which indicate porn (slut) PORN_URL_SLUT 0.941 1.022 0.194 0.094
body es Porno gratis. PORNO_GRATIS_ES 1
body es Presentación de un nuevo producto. PRESENTAMOS_ES 1
body   'Prestigious Non-Accredited Universities' PREST_NON_ACCREDITED 1.520 1.394 1.607 1.901
body es Promocion especial. PROMOCION_ES 1
full   Listed in Pyzor (http://pyzor.sf.net/) PYZOR_CHECK 0 2.041 0 3.451
header   Bulk email fingerprint (eGroups) found RATWARE_EGROUPS 2.180 2.701 2.552 2.805
header   Bulk email fingerprint (Gecko faked) found RATWARE_GECKO_BUILD 0 0.826 0.784 1.385
header   Bulk email fingerprint (hash 2) found RATWARE_HASH_2 0.039 0 0.085 0.037
header   Bulk email fingerprint (hash 2 v2) found RATWARE_HASH_2_V2 1.798 1.319 1.767 0.980
rawbody   Contains a hashbuster in Send-Safe format RATWARE_HASH_DASH 1.133 0.947 1.500 1.646
header   Bulk email fingerprint (jpfree) found RATWARE_JPFREE 0 0 1.942 2.100
header   Bulk email fingerprint (Mozilla malformed) found RATWARE_MOZ_MALFORMED 1.594 0.990 1.752 0.558
header   Bulk email fingerprint (netIP) found RATWARE_NETIP 0.439 1.033 2.312 2.286
header   X-Mailer has malformed Outlook Express version RATWARE_OE_MALFORMED 2.160 2.407 2.522 2.588
header   Bulk email fingerprint (Received @) found RATWARE_RCVD_AT 2.550 1.011 2.691 3.415
header   Bulk email fingerprint ('esmtp' Received) found RATWARE_RCVD_LC_ESMTP 1.745 1.474 2.122 2.083
header   Bulk email fingerprint (Received PF) found RATWARE_RCVD_PF 2.880 3.384 3.608 3.867
uri   Bulk email fingerprint (StormPost) found RATWARE_STORM_URI 1.920 1.518 2.405 2.295
body   Razor2 gives confidence level above 50% RAZOR2_CF_RANGE_51_100 0 1.485 0 0.056
full   Listed in Razor2 (http://razor.sf.net/) RAZOR2_CHECK 0 0.150 0 1.511
header   Received headers forged (AM/PM) RCVD_AM_PM 1.558 0.091 1.802 1.927
header   Bulk email fingerprint (bonus space) found RCVD_BONUS_SPC_DATE 1.371 0.904 1.575 1.872
header   Received by mail server with no name RCVD_BY_IP 0 0.024 0.051 0.067
header   Received contains a faked HELO hostname RCVD_FAKE_HELO_DOTCOM 0.899 0.034 0.969 0.424
header   Received: HELO and IP do not match, but should RCVD_HELO_IP_MISMATCH 2.799 0.618 1.647 2.178
header   Received: contains illegal IP address RCVD_ILLEGAL_IP 1.335 1.370 1.588 0.944
header   Received via a relay in bl.spamcop.net RCVD_IN_BL_SPAMCOP_NET 0 1.832 0 1.216
header   Sender is in Bonded Sender Program (other relay) RCVD_IN_BSP_OTHER 0 -0.1 0 -0.1
header   Sender is in Bonded Sender Program (trusted relay) RCVD_IN_BSP_TRUSTED 0 -4.3 0 -4.3
header   Received via a relay in list.dsbl.org RCVD_IN_DSBL 0 2.765 0 3.805
header   Relay in DUL, http://www.mail-abuse.org/dul/ RCVD_IN_MAPS_DUL 1
header   Relay in NML, http://www.mail-abuse.org/nml/ RCVD_IN_MAPS_NML 1
header   Relay in RBL, http://www.mail-abuse.org/rbl/ RCVD_IN_MAPS_RBL 1
header   Relay in RSS, http://www.mail-abuse.org/rss/ RCVD_IN_MAPS_RSS 1
header   NJABL: sender is an open formmail RCVD_IN_NJABL_CGI 1
header   NJABL: dialup sender did non-local SMTP RCVD_IN_NJABL_DUL 0 1.655 0 0.088
header   NJABL: sent through multi-stage open relay RCVD_IN_NJABL_MULTI 1
header   NJABL: sender is an open proxy RCVD_IN_NJABL_PROXY 0 1.026 0 0.438
header   NJABL: sender is confirmed open relay RCVD_IN_NJABL_RELAY 0 0.934 0 1.397
header   NJABL: sender is confirmed spam source RCVD_IN_NJABL_SPAM 0 1.051 0 1.841
header   Sent via a relay in ipwhois.rfc-ignorant.org RCVD_IN_RFC_IPWHOIS 0 1.140 0 1.664
header   Received via a relay in RSL RCVD_IN_RSL 0 0.677 0 1.720
header   Received via a relay in Spamhaus SBL RCVD_IN_SBL 0 1.050 0 0.107
header   SORBS: sender demands to never be tested RCVD_IN_SORBS_BLOCK 1
header   SORBS: sent directly from dynamic IP address RCVD_IN_SORBS_DUL 0 0.137 0 1.987
header   SORBS: sender is open HTTP proxy server RCVD_IN_SORBS_HTTP 0 0 0 0.043
header   SORBS: sender is open proxy server RCVD_IN_SORBS_MISC 0 0 0 0.338
header   SORBS: sender is open SMTP relay RCVD_IN_SORBS_SMTP 0 1.597 0 2.493
header   SORBS: sender is open SOCKS proxy server RCVD_IN_SORBS_SOCKS 0 1.847 0 2.054
header   SORBS: sender is a abuseable web server RCVD_IN_SORBS_WEB 0 0 0 0.007
header   SORBS: sender is on a hijacked network RCVD_IN_SORBS_ZOMBIE 0 0.819 0 0
header   Received via a relay in Spamhaus XBL RCVD_IN_XBL 0 2.511 0 3.076
header   Received: contains an IP address used for HELO RCVD_NUMERIC_HELO 0.636 1.531 1.348 1.248
body   Receive a special offer RECEIVE_OFFER 1.125 0.955 1.446 0.793
body es Conviertete en Spammer. REENVIA_ES 1
body   Home refinancing REFINANCE_NOW 1.611 0 1.191 0.029
body   Home refinancing REFINANCE_YOUR_HOME 1.321 0.394 0.917 0.340
body es Los regalos no existen, salvo de nuestros amigos. REGALO_ES 1
body es Claims you can be removed in Spanish REMOVE_ES_01 1
body es Claims you can be removed in Spanish REMOVE_ES_02 1
body es Claims you can be removed in Spanish REMOVE_ES_03 1
body es Claims you can be removed in Spanish REMOVE_ES_04 1
body es If you send an email you will be OptOut REMOVE_ES_05 1
body es Claims you can opt-out REMOVE_ES_06 1
body es Claims you can opt-out REMOVE_ES_07 1
body es Claims you can opt-out REMOVE_ES_08 1
uri   URL of page called "remove" REMOVE_PAGE 0.081 0.604 0 0.191
body   Send real mail to be unsubscribed REMOVE_POSTAL 1.520 1.362 1.757 1.900
header   Reply-To: is empty REPLY_TO_EMPTY 1.274 1.410 1.568 1.643
body   Resistance to this spam is futile RESISTANCE_IS_FUTILE 1.520 1.786 1.850 0
body   Reverses Aging REVERSE_AGING 1.919 1.403 2.057 2.150
body   If only it were that easy RICH 0 0.451 0 0.000
body   Risk free. Suuurreeee.... RISK_FREE 0.036 0.247 0.135 0.230
header   Received: says mail sent around the world (DNS) ROUND_THE_WORLD 0 1.741 0 1.958
header   Received: says mail sent around the world (HELO) ROUND_THE_WORLD_LOCAL 1.347 0.464 2.351 0.213
body   Mail guarantees satisfaction SATIS_GUAR 0.884 0 0.825 0.081
body   Save big money SAVE_THOUSANDS 0.929 1.889 0.717 0.031
header   Sender domain is new and very high volume SB_NEW_BULK 1
header   Sender IP hosted at NSP has a volume spike SB_NSP_VOLUME_SPIKE 1
body   Score with babes! SEDUCTION 1.560 1.356 1.415 1.054
body   See for yourself SEE_FOR_YOURSELF 0.544 0.381 0.591 0.044
body   They have selected you for something SELECTED_YOU 1.485 1.865 1.841 1.897
body   Claims compliance with spam regulations SENT_IN_COMPLIANCE 1.520 1.786 1.850 2.000
body   Serious Enquiries Only SERIOUS_ONLY 0 0 1.664 1.748
body   Describes some sort of breakthrough SOME_BREAKTHROUGH 0.232 1.921 0.907 1.610
body   Possible porn - Adult Web Sites SOMETHING_FOR_ADULTS 1.433 1.513 1.614 0.006
header   Recipient list is sorted by address SORTED_RECIPS 0.879 1.155 1.759 0.887
header   SPF: sender does not match SPF record (fail) SPF_FAIL 0 0 0 0.875
header   SPF: HELO does not match SPF record (fail) SPF_HELO_FAIL 0 0.405 0 0.001
header   SPF: HELO matches SPF record SPF_HELO_PASS -0.001
header   SPF: HELO does not match SPF record (softfail) SPF_HELO_SOFTFAIL 0 1.002 0 3.140
header   SPF: sender matches SPF record SPF_PASS -0.001
header   SPF: sender does not match SPF record (softfail) SPF_SOFTFAIL 0.500 0.842 0.500 0.500
body   Talks about 'starting now' with capitals START_NOW_CAPS 1.280 1.499 1.124 0.857
body   Offers a alert about a stock STOCK_ALERT 2.362 1.782 2.378 2.385
body   Offers a picked stock STOCK_PICK 0.106 0.150 0.041 1.470
body   Tells you about a strong buy STRONG_BUY 2.880 3.384 3.018 3.117
header   Subject starts with "Free" SUB_FREE_OFFER 0.055 0.034 0.103 0.000
header   Subject starts with "Hello" SUB_HELLO 1.405 1.358 0.954 0.007
body   Contains 'subject to credit approval' SUBJ_2_CREDIT 0 0.500 0 0.076
header   Subject contains common spam sign (2 numbers) SUBJ_2_NUM_PARENS 1.472 0.276 1.672 2.102
header   Subject is all capitals SUBJ_ALL_CAPS 0.763 0.365 0.257 0.665
header   Subject contains "As Seen" SUBJ_AS_SEEN 0.995 1.691 1.214 0.000
header   Subject line starts with Buy or Buying SUBJ_BUY 0.565 0.490 0.414 0.000
header   Subject starts with dollar amount SUBJ_DOLLARS 2.449 0.973 1.935 0.054
header   Subject contains "For Only" SUBJ_FOR_ONLY 0.646 1.100 1.726 0.044
header   Subject contains "FREE" in CAPS SUBJ_FREE_CAP 0.011 0 0.146 0.000
header   Subject GUARANTEED SUBJ_GUARANTEED 1.749 1.302 0.081 0.452
header   Subject contains lots of white space SUBJ_HAS_SPACES 2.240 0.637 1.899 1.175
header   Subject contains a unique ID SUBJ_HAS_UNIQ_ID 0.899 1.122 0.809 1.339
header   Subject contains too many raw illegal characters SUBJ_ILLEGAL_CHARS 2.880 2.854 3.459 2.854
header   Subject includes "life insurance" SUBJ_LIFE_INSURANCE 1.840 2.068 2.184 2.020
header   Subject contains "Your Bills" or similar SUBJ_YOUR_DEBT 1.760 2.068 2.035 1.261
header   Subject contains "Your Family" SUBJ_YOUR_FAMILY 1.647 0 2.033 0.011
header   Subject contains "Your Own" SUBJ_YOUR_OWN 0.872 1.294 1.371 0.000
header   Subject talks about losing pounds SUBJECT_DIET 1.355 0.723 0.059 0.266
header   Subject contains a gappy version of 'cialis' SUBJECT_DRUG_GAP_C 1.993 1.917 2.501 1.325
header   Subject contains a gappy version of 'levitra' SUBJECT_DRUG_GAP_L 2.117 2.726 2.181 2.456
header   Subject contains a gappy version of 'phentermine' SUBJECT_DRUG_GAP_P 0.621 0.765 0.698 1.425
header   Subject contains a gappy version of 'soma' SUBJECT_DRUG_GAP_S 2.005 0.277 2.920 2.041
header   Subject contains a gappy version of 'valium' SUBJECT_DRUG_GAP_VA 2.005 1.922 2.934 3.680
header   Subject contains a gappy version of 'viagra' SUBJECT_DRUG_GAP_VIA 2.659 1.770 3.158 0.253
header   Subject contains a gappy version of 'vicodin' SUBJECT_DRUG_GAP_VIC 2.560 2.961 2.691 2.868
header   Subject contains a gappy version of 'xanax' SUBJECT_DRUG_GAP_X 2.538 2.282 2.945 2.512
header   Subject indicates sexually-explicit content SUBJECT_SEXUAL 2.160 2.538 2.775 2.900
body es If you want to subscribe... SUBSCRIBE_ES_01 1
header   Similar addresses in recipient list SUSPICIOUS_RECIPS 1.473 1.459 0.820 1.915
body   Targeted Traffic / Email Addresses TARGETED 0 0.692 1.471 0.480
body es Inmigración legal (?) a los Estados Unidos TARJETA_VERDE_ES 1
uri   Contains URI to a document hosted at 'terra.es' TERRA_ES 1.367 0.816 1.746 2.612
body   The best Rates THE_BEST_RATE 0 0.550 0 0.000
header   To: repeats address as real name TO_ADDRESS_EQ_REAL 0 0.470 0.131 0.026
header   To: is empty TO_EMPTY 0 0 0.164 0.097
header   To: has a malformed address TO_MALFORMED 0.895 2.253 0.455 2.187
header   To: has no local-part before @ sign TO_NO_USER 0.332 0.116 1.615 0.128
header   To header contains 'recipient' marker TO_RECIP_MARKER 0 0 1.370 1.539
header   Sent to a text file TO_TXT 0 0 1.362 1.580
body   Incorporates a tracking ID number TRACKER_ID 1.825 1.064 1.818 0.555
body   People just leave money laying around UNCLAIMED_MONEY 1.263 1.703 1.945 1.584
header   Valid-looking To "undisclosed-recipients" UNDISC_RECIPS 0.966 1.391 1.295 1.302
body   Message body has many words used only once UNIQUE_WORDS 3.109 2.549 1.639 2.273
body   University Diplomas UNIVERSITY_DIPLOMAS 2.242 0.523 0 0
header   Headers contain an unresolved template UNRESOLVED_TEMPLATE 1.324 0.618 1.369 2.866
body   Message written in an undesired language UNWANTED_LANGUAGE_BODY 2.8
body   Contains urgent matter URG_BIZ 0.288 0.030 1.064 1.808
uri   Message has URI 4you URI_4YOU 1.027 1.812 0.898 1.966
uri   Contains a URI with an affiliate ID code URI_AFFILIATE 2.243 0 1.808 2.052
uri   Filename is just a '\#'; probably a JS trick URI_IS_POUND 0 0.333 0 0
uri   Message has link to company offers URI_OFFERS 1.328 0.252 1.460 0.770
header   Message has HTTP redirector URI URI_REDIRECTOR 0 0 0.031 0.011
body   Contains an URL listed in the AB SURBL blocklist URIBL_AB_SURBL 0 2.007 0 0.417
body   Contains an URL listed in the OB SURBL blocklist URIBL_OB_SURBL 0 1.996 0 3.213
body   Contains an URL listed in the PH SURBL blocklist URIBL_PH_SURBL 0 0.839 0 2.000
body   Contains an URL listed in the SBL blocklist URIBL_SBL 0 0.629 0 0.996
body   Contains an URL listed in the SC SURBL blocklist URIBL_SC_SURBL 0 3.897 0 4.263
body   Contains an URL listed in the WS SURBL blocklist URIBL_WS_SURBL 0 0.539 0 1.462
body   Mentions millions of (dollar) ((dollar) NN,NNN,NNN.NN) US_DOLLARS_3 0.331 0.411 0.010 0.354
header   User is listed in 'all_spam_to' USER_IN_ALL_SPAM_TO -100
header   From: address is in the user's black-list USER_IN_BLACKLIST 100
header   User is listed in 'blacklist_to' USER_IN_BLACKLIST_TO 10
header   From: address is in the default white-list USER_IN_DEF_WHITELIST -15
header   User is listed in 'more_spam_to' USER_IN_MORE_SPAM_TO -20
header   From: address is in the user's white-list USER_IN_WHITELIST -100
header   User is listed in 'whitelist_to' USER_IN_WHITELIST_TO -6
uri   URL contains username and (optional) password USERPASS 0.429 0.561 1.319 0.268
body   Attempts to disguise the word 'viagra' VIA_GAP_GRA 2.800 3.171 2.886 3.005
body   Claims to honor removal requests WE_HONOR_ALL 2.063 2.365 1.789 2.029
uri   Uses non-standard port number for HTTP WEIRD_PORT 0 0.507 0.228 0.109
body   Weird repeated double-quotation marks WEIRD_QUOTING 1.353 1.966 1.774 2.000
body   While you Sleep WHILE_YOU_SLEEP 0.858 0.605 1.786 0.000
body   Why Pay More? WHY_PAY_MORE 1.249 0 1.713 1.978
body   What are you waiting for WHY_WAIT 2.240 2.060 0.796 0.764
header   Received line contains spam-sign (lowercase smtp) WITH_LC_SMTP 1.600 0.235 1.862 2.200
body   Information on how to work at home (1) WORK_AT_HOME 0 0 0.325 0.030
body   Removes Wrinkles WRINKLES 1.730 2.097 1.917 2.091
header   X-Authentication-Warning header looks faked X_AUTH_WARN_FAKED 2.094 2.599 1.654 3.105
header   Message has X-Library header X_LIBRARY 2.105 1.369 1.863 2.755
header   Bulk email fingerprint (X-Message-Info) found X_MESSAGE_INFO 3.600 4.187 4.162 4.244
header   Sent with 'X-Msmail-Priority' set to high X_MSMAIL_PRIORITY_HIGH 0 0.267 0.021 0.000
header   X-Originating-IP doesn't look like IPv4 address X_ORIG_IP_NOT_IPV4 0 1.006 0.081 2.582
header   Sent with 'X-Priority' set to high X_PRIORITY_HIGH 0.125 0.093 0.077 0.000
uri   Has Yahoo Redirect URI YAHOO_DRS_REDIR 1.911 0.911 1.956 0.984
uri   Has Yahoo Redirect URI YAHOO_RD_REDIR 1.237 1.083 1.366 1.642
body   You can search for anyone YOU_CAN_SEARCH 1.370 0.444 1.246 1.630
body   Who really wins? YOU_WON 0.144 0.269 0 0.579
body   Doing something with my income YOUR_INCOME 0.674 0.892 0.372 1.092