This is the current list of tests SpamAssassin(tm) performs on mail messages to
determine if they're spam or not. If you wish to change the score from the
default, add a line like this to your ~/.spamassassin/user_prefs:
Note that these are the scores for the current stable release of SpamAssassin;
they may be different from the ones you're running on your servers, if SpamAssassin
is installed there.
|
AREA TESTED
|
LOCALE
|
DESCRIPTION OF TEST
|
TEST NAME
|
DEFAULT SCORES (local, net, with bayes, with bayes+net)
|
|
header
|
|
Message-Id indicates a non-spam MUA (Pine)
|
USER_AGENT_PINE
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Mozilla)
|
USER_AGENT_MOZILLA_UA
|
-0.498 0.001 -0.498 0.001
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Netscape)
|
USER_AGENT_MOZILLA_XM
|
-0.275 0.001 0.001 0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Outlook Express)
|
USER_AGENT_MACOE
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Entourage)
|
USER_AGENT_ENTOURAGE
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (KMail)
|
USER_AGENT_KMAIL
|
-0.399 0.001 -0.299 -0.470
|
|
header
|
|
User-Agent header indicates a non-spam MUA (IMP)
|
USER_AGENT_IMP
|
-0.460 -0.347 -0.180 -0.407
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (T-Offline)
|
USER_AGENT_TONLINE
|
-0.425 -0.499 -0.189 -0.349
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Apple Mail)
|
USER_AGENT_APPLEMAIL
|
0.001
|
|
header
|
|
User-Agent header indicates a non-spam MUA (Gnus)
|
USER_AGENT_GNUS_UA
|
-0.480 -0.499 -0.499 -0.480
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Gnus)
|
USER_AGENT_GNUS_XM
|
-0.298 -0.299 -0.166 -0.141
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (VM)
|
USER_AGENT_VM
|
0.001 0.001 0.001 -0.061
|
|
header
|
|
X-Mailer header indicates a non-spam MUA (Forte)
|
USER_AGENT_FORTE
|
-0.443 -0.454 -0.499 -0.499
|
|
body
|
|
Generic Test for Unsolicited Bulk Email
|
GTUBE
|
1000
|
|
full
|
|
Listed in Razor1, see http://razor.sf.net/
|
RAZOR_CHECK
|
0.0
|
|
full
|
|
Listed in Razor2, see http://razor.sf.net/
|
RAZOR2_CHECK
|
0.0 2.063 0.0 0.880
|
|
body
|
|
Razor2 gives a spam confidence level between 1 and 10
|
RAZOR2_CF_RANGE_01_10
|
0.0 0.0 0.0 0.157
|
|
body
|
|
Razor2 gives a spam confidence level between 11 and 20
|
RAZOR2_CF_RANGE_11_20
|
0.0 0.0 0.0 0.418
|
|
body
|
|
Razor2 gives a spam confidence level between 21 and 30
|
RAZOR2_CF_RANGE_21_30
|
0.0 0.0 0.0 0.767
|
|
body
|
|
Razor2 gives a spam confidence level between 31 and 40
|
RAZOR2_CF_RANGE_31_40
|
0.0 0.0 0.0 0.414
|
|
body
|
|
Razor2 gives a spam confidence level between 41 and 50
|
RAZOR2_CF_RANGE_41_50
|
0.0 0.0 0.0 0.534
|
|
body
|
|
Razor2 gives a spam confidence level between 51 and 60
|
RAZOR2_CF_RANGE_51_60
|
0.0 0.0 0.0 0.594
|
|
body
|
|
Razor2 gives a spam confidence level between 61 and 70
|
RAZOR2_CF_RANGE_61_70
|
0.0
|
|
body
|
|
Razor2 gives a spam confidence level between 71 and 80
|
RAZOR2_CF_RANGE_71_80
|
0.0 0.0 0.0 1.909
|
|
body
|
|
Razor2 gives a spam confidence level between 81 and 90
|
RAZOR2_CF_RANGE_81_90
|
0.0 0.0 0.0 0.959
|
|
body
|
|
Razor2 gives a spam confidence level between 91 and 100
|
RAZOR2_CF_RANGE_91_100
|
0.0 0.0 0.0 1.208
|
|
full
|
|
Listed in DCC, see http://rhyolite.com/anti-spam/dcc/
|
DCC_CHECK
|
0.0 3.017 0.0 2.635
|
|
full
|
|
Listed in Pyzor, see http://pyzor.sf.net/
|
PYZOR_CHECK
|
0.0 4.400 0.0 1.211
|
|
body
|
|
List removal information
|
REMOVE_IN_QUOTES
|
0.001 0.197 0.001 0.301
|
|
body
|
|
Click-to-remove with mailto: found beforehand
|
CLICK_TO_REMOVE_2
|
0.700 0.626 0.717 0.0
|
|
rawbody
|
|
Contains an ASCII-formatted form
|
ASCII_FORM_ENTRY
|
0.0 1.070 0.0 0.834
|
|
body
|
|
Incorporates a tracking ID number
|
TRACKER_ID
|
2.574 3.376 2.898 4.295
|
|
body
|
|
RAND found, spammer forgot to run the random-ID generator
|
MARKUP_RAND
|
2.900
|
|
body
|
|
SSPL found, spammer forgot to run the random-ID generator
|
MARKUP_SSPL
|
0.0
|
|
body
|
|
Contains a large block of hexadecimal code
|
LARGE_HEX
|
1.151 0.502 0.524 1.378
|
|
body
|
|
A WHOLE LINE OF YELLING DETECTED
|
LINES_OF_YELLING
|
0.0
|
|
body
|
|
2 WHOLE LINES OF YELLING DETECTED
|
LINES_OF_YELLING_2
|
0.0
|
|
body
|
|
3 WHOLE LINES OF YELLING DETECTED
|
LINES_OF_YELLING_3
|
0.0
|
|
body
|
|
Weird repeated double-quotation marks in body
|
WEIRD_QUOTING
|
1.066 1.545 0.313 1.923
|
|
rawbody
|
|
Message text disguised using base-64 encoding
|
BASE64_ENC_TEXT
|
2.354 1.643 1.544 1.768
|
|
rawbody
|
|
Excessive quoted-printable encoding in body
|
MIME_EXCESSIVE_QP
|
0.0
|
|
rawbody
|
|
Message text in HTML without specified charset
|
MIME_HTML_NO_CHARSET
|
0.638 0.759 0.365 0.0
|
|
rawbody
|
|
Quoted-printable line longer than 76 characters
|
MIME_LONG_LINE_QP
|
0.261 0.155 0.051 0.0
|
|
rawbody
|
|
MIME section missing boundary
|
MIME_MISSING_BOUNDARY
|
0.501 0.163 0.0 1.334
|
|
rawbody
|
|
Message includes Microsoft executable program
|
MICROSOFT_EXECUTABLE
|
0.100
|
|
rawbody
|
|
MIME filename does not match content
|
MIME_SUSPECT_NAME
|
0.100
|
|
body
|
|
Character set indicates a foreign language
|
CHARSET_FARAWAY
|
3.200
|
|
body
|
|
Written in an undesired language
|
UNDESIRED_LANGUAGE_BODY
|
3.970
|
|
body
|
|
Body includes 8 consecutive 8-bit characters
|
BODY_8BITS
|
1.500
|
|
rawbody
|
|
Deficient quoted-printable encoding in body
|
MIME_DEFICIENT_QP
|
2.300 2.093 2.172 2.696
|
|
header
|
|
Uses the Habeas warrant mark (http://www.habeas.com/)
|
HABEAS_SWE
|
-4.600
|
|
header
|
|
Message from eBay
|
GENUINE_EBAY_RCVD
|
-1.615 -1.593 -1.401 -0.624
|
|
header
|
|
Has an Approved-By moderated list header
|
APPROVED_BY
|
-0.398 -0.157 -0.182 -0.147
|
|
header
|
|
Looks like a Bugzilla bug
|
BUGZILLA_BUG
|
-1.401 -1.401 -1.690 -1.401
|
|
header
|
|
Looks like a Debian BTS bug
|
DEBIAN_BTS_BUG
|
-1.401 -1.401 0.0 -2.710
|
|
header
|
|
From Majordomo
|
MAJORDOMO
|
-0.317 0.0 -0.035 0.0
|
|
header
|
|
Has a valid-looking References header
|
REFERENCES
|
-0.498 -0.499 -0.498 -0.001
|
|
header
|
|
Has a X-Cron-Env header
|
CRON_ENV
|
-0.380 -0.388 -0.270 -0.341
|
|
header
|
|
Has a In-Reply-To header
|
IN_REP_TO
|
-0.498 -0.499 -0.498 -0.369
|
|
header
|
|
Has a X-Authentication-Warning header
|
X_AUTH_WARNING
|
-0.498 -0.399 0.0 -0.398
|
|
header
|
|
Has a X-Mailing-List header
|
X_MAILING_LIST
|
0.001
|
|
header
|
|
Has a X-Loop header
|
X_LOOP
|
0.001
|
|
header
|
|
Has a X-Accept-Language header
|
X_ACCEPT_LANG
|
0.0 -0.095 0.0 0.0
|
|
header
|
|
Has a Resent-To header
|
RESENT_TO
|
-0.498 -0.192 -0.398 0.0
|
|
header
|
|
Email came from some known mailing list software
|
KNOWN_MAILING_LIST
|
-0.536 -0.872 -0.168 -0.300
|
|
body
|
|
Came from MSN Communities
|
MSN_GROUPS
|
0.0
|
|
header
|
|
Subject is an eBay question
|
Q_FOR_SELLER
|
-0.499 -0.278 -0.399 -0.399
|
|
header
|
|
Subject contains newsletter header (in review)
|
SUBJECT_IS_IN_REVIEW
|
0.0
|
|
header
|
|
Appears to be from yahoo groups
|
FROM_EGROUPS
|
-0.498 -0.499 0.0 -0.306
|
|
header
|
|
'Message-Id' was added by yahoo.com, that's OK
|
YAHOO_MSGID_ADDED
|
0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER1
|
0.0 0.0 -0.231 -0.044
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER2
|
0.0 0.0 -0.210 0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER3
|
0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER5
|
-0.207 0.0 0.0 0.0
|
|
body
|
|
Common footer for MSN
|
MSN_FOOTER1
|
0.0 -0.177 -0.496 0.0
|
|
body
|
|
Yahoo! Groups message
|
GROUPS_YAHOO_1
|
-0.498 -0.499 -0.498 -0.497
|
|
full
|
|
Short signature present (no empty lines)
|
SIGNATURE_SHORT_DENSE
|
0.0
|
|
full
|
|
Short signature present (empty lines)
|
SIGNATURE_SHORT_SPARSE
|
0.0
|
|
full
|
|
Long signature present (no empty lines)
|
SIGNATURE_LONG_DENSE
|
-0.499 -0.221 0.0 -0.491
|
|
full
|
|
Long signature present (empty lines)
|
SIGNATURE_LONG_SPARSE
|
-0.498 0.0 -0.497 -0.494
|
|
body
|
|
A MailMan confirm-your-address message
|
MAILMAN_CONFIRM
|
0.0
|
|
header
|
|
Contains a PGP-signed message (signature attached)
|
PGP_SIGNATURE_2
|
-2.595 -2.454 -2.715 -2.207
|
|
rawbody
|
|
Contains what looks like a patch from diff -u
|
PATCH_UNIFIED_DIFF
|
-0.499 -0.499 -0.388 -0.498
|
|
rawbody
|
|
Contains what looks like a patch from diff -c
|
PATCH_CONTEXT_DIFF
|
0.0 -0.188 -0.100 -0.288
|
|
body
|
|
Contains what looks like an 'E-Mail Disclaimer'
|
DISCLAIMER_LEGALESE
|
0.0 0.0 -0.033 0.0
|
|
body
|
|
Contains what looks like an email attribution
|
EMAIL_ATTRIBUTION
|
-0.498 -0.499 -0.462 -0.498
|
|
rawbody
|
|
Contains what looks like a quoted email text
|
QUOTED_EMAIL_TEXT
|
-0.498 -0.481 -0.472 -0.380
|
|
body
|
|
Contains twice quoted reply
|
QUOTE_TWICE_1
|
-0.283 0.0 -0.498 0.0
|
|
body
|
|
Contains a password retrieval system
|
FORGOTTEN_PASSWORD
|
-0.170 -0.399 -0.095 -0.143
|
|
header
|
|
Where are you working at?
|
HAS_ORGANIZATION
|
0.0
|
|
body
|
|
Common footer for Hotmail
|
HOTMAIL_FOOTER4
|
0.0 -0.164 0.0 0.0
|
|
header
|
|
From the Mailer-Daemon
|
MAILER_DAEMON
|
0.0 0.0 0.0 -0.398
|
|
header
|
|
Mailer daemon failure notice (1)
|
FAILURE_NOTICE_1
|
0.0 -0.299 0.0 0.0
|
|
body
|
|
Mailer daemon failure notice (2)
|
FAILURE_NOTICE_2
|
0.0 -0.399 0.0 0.0
|
|
header
|
|
Forwarded email
|
FWD_MSG
|
0.0 -0.299 0.0 0.0
|
|
header
|
|
Message-Id indicates the message was sent from MS Exchange
|
MSGID_GOOD_EXCHANGE
|
-0.498 -0.376 0.0 -0.142
|
|
header
|
|
From: does not include a real name
|
NO_REAL_NAME
|
0.993 0.820 1.137 1.149
|
|
header
|
|
From: ends in numbers
|
FROM_ENDS_IN_NUMS
|
0.609 0.745 0.608 0.641
|
|
header
|
|
From: starts with nums
|
FROM_STARTS_WITH_NUMS
|
0.499 0.0 0.0 0.0
|
|
header
|
|
From: contains numbers mixed in with letters
|
FROM_HAS_MIXED_NUMS
|
0.0 0.0 0.508 0.062
|
|
header
|
|
Uses an address with lots of numbers, at a big ISP
|
ADDR_NUMS_AT_BIGSITE
|
0.659 0.555 1.962 2.051
|
|
header
|
|
From address is "at something-offers"
|
FROM_OFFERS
|
4.300 4.299 4.300 4.299
|
|
header
|
|
From: has no local-part before @ sign
|
FROM_NO_USER
|
1.773 0.928 2.796 2.587
|
|
header
|
|
To: has no local-part before @ sign
|
TO_NO_USER
|
2.796 2.799 2.796 2.324
|
|
header
|
|
To: address contains spaces
|
TO_HAS_SPACES
|
0.037 0.0 0.0 0.0
|
|
header
|
|
To: is empty
|
TO_EMPTY
|
1.994 2.596 1.725 2.497
|
|
header
|
|
Reply-To: is empty
|
REPLY_TO_EMPTY
|
1.805 0.498 0.586 1.875
|
|
header
|
|
Reply-To: contains an underline and numbers/letters
|
REPLY_TO_HAS_UNDERLINE_NUMS
|
0.500 0.501 1.820 0.001
|
|
header
|
|
To: repeats address as real name
|
TO_ADDRESS_EQ_REAL
|
0.635 0.0 1.198 0.209
|
|
header
|
|
Valid-looking To "undisclosed-recipients"
|
UNDISC_RECIPS
|
1.751 1.170 0.0 0.0
|
|
header
|
|
Faked To "Undisclosed-Recipients"
|
FAKED_UNDISC_RECIPS
|
4.300
|
|
header
|
|
Subject has exclamation mark and question mark
|
PLING_QUERY
|
0.382 0.699 0.867 0.070
|
|
header
|
|
Subject contains a unique ID
|
SUBJ_HAS_UNIQ_ID
|
1.082 1.254 0.668 0.453
|
|
header
|
|
Subject contains lots of white space
|
SUBJ_HAS_SPACES
|
1.388 1.702 1.519 3.531
|
|
header
|
|
Subject is all capitals
|
SUBJ_ALL_CAPS
|
1.099 1.148 0.817 0.491
|
|
header
|
|
Message-Id has no @ sign
|
MSGID_HAS_NO_AT
|
0.100 0.0 0.0 0.0
|
|
header
|
|
Message-Id generated by a spam tool
|
MSGID_SPAMSIGN_1
|
2.900
|
|
header
|
|
Message-Id generated by spam tool (zeroes variant)
|
MSGID_SPAMSIGN_ZEROES
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Message-Id generated by spam tool (6-letter variant)
|
MSGID_SPAMSIGN_6LETTER
|
4.400 4.400 4.300 4.300
|
|
header
|
|
Message-Id generated by spam tool (4-zeroes variant)
|
MSGID_OE_SPAM_4ZERO
|
2.129 3.489 4.300 4.300
|
|
header
|
|
Message-Id generated by spam tool (3-dollars variant)
|
MSGID_3_DOLLARS
|
2.900
|
|
header
|
|
Message-Id generated by spam tool (4-num-dollar variant)
|
MSGID_4NUMS_DOLLAR
|
2.900
|
|
header
|
|
Message-Id has characters indicating spam
|
MSGID_CHARS_SPAM
|
0.218 0.0 1.138 0.342
|
|
header
|
|
Message-Id has no hostname
|
MSGID_NO_HOST
|
2.796 2.900 1.270 1.583
|
|
header
|
|
Message-Id is fake (in Outlook Express format)
|
MSGID_OUTLOOK_TIME
|
4.500 4.400 4.400 4.400
|
|
header
|
|
Invalid Date: header (not RFC 2822)
|
INVALID_DATE
|
0.594 0.594 0.592 0.592
|
|
header
|
|
Invalid Date: header (timezone does not exist)
|
INVALID_DATE_TZ_ABSURD
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Invalid Date: year begins with zero
|
DATE_YEAR_ZERO_FIRST
|
4.300
|
|
header
|
|
Date: is 3 to 6 hours before Received: date
|
DATE_IN_PAST_03_06
|
0.271 0.294 0.494 0.267
|
|
header
|
|
Date: is 6 to 12 hours before Received: date
|
DATE_IN_PAST_06_12
|
0.759 0.755 0.415 0.059
|
|
header
|
|
Date: is 12 to 24 hours before Received: date
|
DATE_IN_PAST_12_24
|
0.0 0.126 0.094 0.0
|
|
header
|
|
Date: is 24 to 48 hours before Received: date
|
DATE_IN_PAST_24_48
|
0.0 0.0 0.069 0.0
|
|
header
|
|
Date: is 48 to 96 hours before Received: date
|
DATE_IN_PAST_48_96
|
0.0
|
|
header
|
|
Date: is 96 hours or more before Received: date
|
DATE_IN_PAST_96_XX
|
1.235 1.634 2.111 0.561
|
|
header
|
|
Date: is 3 to 6 hours after Received: date
|
DATE_IN_FUTURE_03_06
|
2.504 0.928 1.644 1.378
|
|
header
|
|
Date: is 6 to 12 hours after Received: date
|
DATE_IN_FUTURE_06_12
|
1.534 1.344 1.457 1.114
|
|
header
|
|
Date: is 12 to 24 hours after Received: date
|
DATE_IN_FUTURE_12_24
|
1.869 2.799 0.500 0.718
|
|
header
|
|
Date: is 24 to 48 hours after Received: date
|
DATE_IN_FUTURE_24_48
|
2.696 2.599 2.729 2.900
|
|
header
|
|
Date: is 48 to 96 hours after Received: date
|
DATE_IN_FUTURE_48_96
|
2.297 2.199 0.0 2.429
|
|
header
|
|
Date: is 96 hours or more after Received: date
|
DATE_IN_FUTURE_96_XX
|
1.691 0.0 2.098 0.0
|
|
header
|
|
Subject: starts with advertising tag
|
ADVERT_CODE
|
1.101 1.705 4.300 1.101
|
|
header
|
|
Subject: contains advertising tag
|
ADVERT_CODE2
|
2.104 2.477 1.558 0.930
|
|
header
|
|
Subject: contains Korean unsolicited email tag
|
KOREAN_UCE_SUBJECT
|
4.400 4.300 4.300 4.300
|
|
header
|
|
sent to you@you.com or similar
|
FRIEND_AT_PUBLIC
|
2.900 2.900 2.796 1.965
|
|
header
|
|
sent from or to friend@public.com
|
FRIEND_PUBLIC
|
2.900
|
|
header
|
|
Subject: domain names are cheap
|
DOMAINS_CHEAP
|
2.900
|
|
header
|
|
Subject: domain registration spam subject
|
DOMAIN_SUBJECT
|
0.0
|
|
header
|
|
Domain in From header has no MX or A DNS records
|
NO_DNS_FOR_FROM
|
1
|
|
header
|
|
From and To are the same, but not exactly
|
FROM_AND_TO_SAME
|
2.097 1.826 2.197 1.464
|
|
header
|
|
Fake name used in SMTP HELO command
|
BAD_HELO_WARNING
|
0.0
|
|
header
|
|
Subject is full of 8-bit characters
|
SUBJ_FULL_OF_8BITS
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Headers include 3 consecutive 8-bit characters
|
HEADER_8BITS
|
4.400 1.179 4.300 1.889
|
|
header
|
|
Received via buggy SMTP server (MDaemon 2.7.4SP4R)
|
MDAEMON_2_7_4
|
2.900
|
|
header
|
|
Received: contains a name with a faked IP-address
|
FAKED_IP_IN_RCVD
|
2.900
|
|
header
|
|
Received via SMTPD32 server (SMTPD32-n.n)
|
SMTPD_IN_RCVD
|
0.529 0.0 1.131 0.602
|
|
header
|
|
Received via a relay in relays.osirusoft.com
|
RCVD_IN_OSIRUSOFT_COM
|
0.0 0.552 0.0 0.864
|
|
header
|
|
DNSBL: sender is Confirmed Open Relay
|
X_OSIRU_OPEN_RELAY
|
0.0 2.900 0.0 0.0
|
|
header
|
|
DNSBL: sender ip address in in a dialup block
|
X_OSIRU_DUL
|
0.0
|
|
header
|
|
DNSBL: sender is Confirmed Spam Source
|
X_OSIRU_SPAM_SRC
|
0.0
|
|
header
|
|
DNSBL: sender is a Spamware site or vendor
|
X_OSIRU_SPAMWARE_SITE
|
0.0 1.101 0.0 0.0
|
|
header
|
|
Received from first hop dialup listed in relays.osirusoft.com
|
X_OSIRU_DUL_FH
|
0.0
|
|
header
|
|
Received via a relay in relays.ordb.org
|
RCVD_IN_RELAYS_ORDB_ORG
|
0.0
|
|
header
|
|
Received via SBLed relay, see http://www.spamhaus.org/sbl/
|
RCVD_IN_SBL
|
0.0 1.013 0.0 1.101
|
|
header
|
|
Received via a relay in orbs.dorkslayers.com
|
RCVD_IN_ORBS
|
0.0 0.499 0.0 0.114
|
|
header
|
|
Received via a relay in opm.blitzed.org
|
RCVD_IN_OPM
|
0.0 2.336 0.0 4.295
|
|
header
|
|
Received via a relay in list.dsbl.org
|
RCVD_IN_DSBL
|
0.0 2.574 0.0 4.295
|
|
header
|
|
Received via a relay in multihop.dsbl.org
|
RCVD_IN_MULTIHOP_DSBL
|
0.0
|
|
header
|
|
Received via a relay in unconfirmed.dsbl.org
|
RCVD_IN_UNCONFIRMED_DSBL
|
0.0 0.512 0.0 0.0
|
|
header
|
|
Received via a relay in ipwhois.rfc-ignorant.org
|
RCVD_IN_RFCI
|
0.0 1.448 0.0 1.092
|
|
header
|
|
Sender is on www.habeas.com Habeas Infringer List
|
HABEAS_HIL
|
4.0
|
|
header
|
|
Bonded sender, see http://www.bondedsender.org/referred.html
|
RCVD_IN_BONDEDSENDER
|
0.0 -0.938 0.0 -4.200
|
|
header
|
|
Received via a relay in bl.spamcop.net
|
RCVD_IN_BL_SPAMCOP_NET
|
0.0
|
|
header
|
|
Received via RBLed relay, see http://www.mail-abuse.org/rbl/
|
RCVD_IN_RBL
|
0.0
|
|
header
|
|
Received via RSSed relay, see http://www.mail-abuse.org/rss/
|
RCVD_IN_RSS
|
0.0
|
|
header
|
|
Received from dialup, see http://www.mail-abuse.org/dul/
|
RCVD_IN_DUL
|
0.0
|
|
header
|
|
Received from first hop dialup, see http://www.mail-abuse.org/dul/
|
RCVD_IN_DUL_FH
|
0.0
|
|
header
|
|
Received via a relay in dnsbl.njabl.org
|
RCVD_IN_NJABL
|
0.0 0.853 0.0 0.844
|
|
header
|
|
NJABL: sender is proxy/relay/formmail/spam-source
|
X_NJABL_OPEN_PROXY
|
0.0 0.458 0.0 0.809
|
|
header
|
|
NJABL: sender is on dialup/dynamic IP
|
X_NJABL_DIALUP
|
0.0 0.053 0.0 0.0
|
|
header
|
|
Lots and lots of Cc: headers
|
LOTS_OF_CC_LINES
|
2.900
|
|
header
|
|
trail of Received: headers seems to be forged
|
FORGED_RCVD_TRAIL
|
1.425 1.309 2.049 1.979
|
|
header
|
|
Received forged, contains fake AOL relays
|
FORGED_AOL_RCVD
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Contains forged hostname for a DSL IP in Brazil
|
FORGED_TELESP_RCVD
|
2.900
|
|
header
|
|
Forged hotmail.com 'Received:' header found
|
FORGED_HOTMAIL_RCVD
|
2.335 1.101 1.184 1.101
|
|
header
|
|
hotmail.com 'From' address, but no 'Received:'
|
SEMIFORGED_HOTMAIL_RCVD
|
1.854 1.654 2.667 1.352
|
|
header
|
|
Forged eudoramail.com 'Received:' header found
|
FORGED_EUDORAMAIL_RCVD
|
2.896 2.617 2.896 2.616
|
|
header
|
|
'From' yahoo.com does not match 'Received' headers
|
FORGED_YAHOO_RCVD
|
2.401 2.293 2.676 2.696
|
|
header
|
|
'From' juno.com does not match 'Received' headers
|
FORGED_JUNO_RCVD
|
2.696 2.799 2.796 2.796
|
|
header
|
|
Forged 'by gw05' 'Received:' header found
|
FORGED_GW05_RCVD
|
2.900
|
|
header
|
|
Forged hotmail.com Received 'from mx' header
|
FORGED_MX_HOTMAIL
|
2.900
|
|
header
|
|
Sent by a known spamhaus (qves)
|
RCVD_BY_QVES_COM
|
2.900
|
|
header
|
|
Character set doesn't exist
|
NONEXISTENT_CHARSET
|
2.900
|
|
header
|
|
A foreign language charset used in headers
|
CHARSET_FARAWAY_HEADERS
|
2.060
|
|
header
|
|
'X-Mailer' line contains gibberish
|
X_MAILER_GIBBERISH
|
2.900 0.0 0.0 0.0
|
|
header
|
|
Sent with 'X-Priority' set to high
|
X_PRIORITY_HIGH
|
1.937 1.886 0.899 1.905
|
|
header
|
|
Sent with 'X-Msmail-Priority' set to high
|
X_MSMAIL_PRIORITY_HIGH
|
0.0 0.0 0.0 0.408
|
|
header
|
|
'Message-Id' was added by a relay (2)
|
MSG_ID_ADDED_BY_MTA_2
|
1.026 0.403 1.188 0.785
|
|
header
|
|
'Message-Id' was added by a relay (3)
|
MSG_ID_ADDED_BY_MTA_3
|
0.501 0.673 0.888 0.902
|
|
header
|
|
'From' contains more than one address
|
MANY_FROMS
|
0.0 0.056 0.0 0.0
|
|
header
|
|
Header contains an address from btamail.net.cn
|
BTAMAIL_HEADER
|
2.900
|
|
header
|
|
From: address is in the user's black-list
|
USER_IN_BLACKLIST
|
100.000
|
|
header
|
|
From: address is in the user's white-list
|
USER_IN_WHITELIST
|
-100.000
|
|
header
|
|
Content type is "TEXT/HTML" in all caps
|
HTML_ALL_CAPS
|
2.900
|
|
header
|
|
Received: says mail bounced around the world (HELO)
|
ROUND_THE_WORLD_LOCAL
|
2.594 2.799 1.861 2.597
|
|
header
|
|
Received: says mail bounced around the world (DNS)
|
ROUND_THE_WORLD
|
0.0 2.499 0.0 2.297
|
|
header
|
|
Missing To: header
|
MISSING_HEADERS
|
1.140 0.472 0.690 0.0
|
|
header
|
|
Similar addresses in recipient list
|
SUSPICIOUS_RECIPS
|
2.067 2.117 1.620 1.947
|
|
header
|
|
Very similar addresses in recipient list
|
VERY_SUSP_RECIPS
|
2.540 2.221 2.195 2.799
|
|
header
|
|
Recipient list is sorted by address
|
SORTED_RECIPS
|
2.948 2.847 2.796 3.020
|
|
header
|
|
User is listed in 'whitelist_to'
|
USER_IN_WHITELIST_TO
|
-6.000
|
|
header
|
|
User is listed in 'more_spam_to'
|
USER_IN_MORE_SPAM_TO
|
-20.000
|
|
header
|
|
User is listed in 'all_spam_to'
|
USER_IN_ALL_SPAM_TO
|
-100.000
|
|
header
|
|
Subject: contains G.a.p.p.y-T.e.x.t
|
GAPPY_SUBJECT
|
0.815 0.192 0.425 1.545
|
|
header
|
|
Message has X-Encoding header
|
X_ENC_PRESENT
|
2.900
|
|
header
|
|
Message has x-esmtp header
|
X_ESMTP
|
0.985 0.522 0.834 0.804
|
|
header
|
|
Message has X-Library header
|
X_LIBRARY
|
1.454 1.594 1.593 1.591
|
|
header
|
|
Message has X-List-Unsubscribe header
|
X_LIST_UNSUBSCRIBE
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Message has X-MailingID header
|
X_MAIL_ID_PRESENT
|
0.700 0.700 0.701 0.381
|
|
header
|
|
Message has X-PMFLAGS header
|
X_PMFLAGS_PRESENT
|
2.896 2.900 2.485 2.900
|
|
header
|
|
Message has X-Precedence-Ref header
|
X_PRECEDENCE_REF
|
2.900
|
|
header
|
|
Message has X-ServerHost header
|
X_SERV_HOST_PRESENT
|
0.701 0.701 0.701 0.221
|
|
header
|
|
Message has X-Stormpost-To header
|
X_STORMPOST_TO
|
2.900
|
|
header
|
|
Message has X-x header
|
X_X_PRESENT
|
4.300
|
|
header
|
|
Message has X-Fix header
|
X_FIX_PRESENT
|
0.0
|
|
header
|
|
Message has Complain-To header
|
COMPLAIN_TO
|
2.900
|
|
header
|
|
Message has X-VMP-Text header
|
X_VMP_TEXT
|
2.900 4.300 2.900 2.900
|
|
header
|
|
Message has X-GCMulti header
|
X_GCMULTI
|
1.997 1.699 2.297 1.797
|
|
header
|
|
Message has X-Mime-Key header
|
X_MIME_KEY
|
2.900
|
|
header
|
|
Message has microsoft header
|
MICROSOFT
|
0.790 0.0 0.0 0.0
|
|
header
|
|
MiME-Version header (oddly capitalized)
|
MIME_ODD_CASE
|
4.400 4.300 4.300 4.300
|
|
header
|
|
Subject contains "As Seen"
|
SUBJ_AS_SEEN
|
0.985 2.799 1.322 1.144
|
|
header
|
|
Subject starts with dollar amount
|
SUBJ_DOLLARS
|
1.751 0.228 0.780 0.957
|
|
header
|
|
Subject contains "Double Your"
|
SUBJ_DOUBLE_YOUR
|
1.611 0.478 1.609 1.227
|
|
header
|
|
Subject contains "For Only"
|
SUBJ_FOR_ONLY
|
1.528 0.193 0.0 0.417
|
|
header
|
|
Subject contains "FREE" in CAPS
|
SUBJ_FREE_CAP
|
0.358 0.701 0.0 0.580
|
|
header
|
|
Subject contains "Free Instant"
|
SUBJ_FREE_INSTANT
|
2.900
|
|
header
|
|
Subject starts with "Free"
|
SUB_FREE_OFFER
|
0.359 0.0 0.368 0.294
|
|
header
|
|
Subject GUARANTEED
|
SUBJ_GUARANTEED
|
2.900
|
|
header
|
|
Subject starts with "Hello"
|
SUB_HELLO
|
2.149 2.699 2.497 2.559
|
|
header
|
|
Subject includes "life insurance"
|
SUBJ_LIFE_INSURANCE
|
2.424 2.900 2.021 2.900
|
|
header
|
|
Subject contains "Now Only"
|
SUBJ_NOW_ONLY
|
2.900
|
|
header
|
|
Subject contains "Ripped & Strong"
|
SUBJ_RIPPED
|
0.0
|
|
header
|
|
Subject includes "viagra"
|
SUBJ_VIAGRA
|
2.896 2.592 1.878 3.482
|
|
header
|
|
Subject contains "Your Bills" or similar
|
SUBJ_YOUR_DEBT
|
0.701 0.701 0.700 0.732
|
|
header
|
|
Subject contains "Your Family"
|
SUBJ_YOUR_FAMILY
|
2.900
|
|
header
|
|
Subject contains "Your Own"
|
SUBJ_YOUR_OWN
|
0.935 1.544 1.322 1.532
|
|
header
|
|
Received contains a (dollar) variable reference
|
VAR_REF_IN_RECEIVED
|
0.0
|
|
header
|
|
Received contains a faked HELO hostname
|
RCVD_FAKE_HELO_DOTCOM
|
1.791 2.606 2.264 3.434
|
|
header
|
|
Received contains a faked HELO hostname (2)
|
RCVD_FAKE_HELO_DOTCOM_2
|
2.335 2.404 1.221 2.799
|
|
header
|
|
To: username at front of subject
|
USERNAME_IN_SUBJECT
|
2.900
|
|
header
|
|
Subject talks about losing pounds
|
LOSE_POUNDS
|
4.300 4.300 2.900 2.900
|
|
header
|
|
Message with extraneous Content-type:...type= header
|
EXTRA_MPART_TYPE
|
0.484 0.044 1.135 0.658
|
|
header
|
|
To header contains 'recipient' marker
|
TO_RECIP_MARKER
|
2.900
|
|
header
|
|
Subject talks about savings
|
SAVINGS
|
0.377 0.036 0.0 0.501
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_DASH_DIGIT
|
1.579 0.0 0.736 0.579
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_HASHES
|
2.900
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_DIGITS_4
|
2.030 1.642 1.654 1.046
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_DIGITS_7
|
2.900
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_HEX_24
|
2.154 1.732 1.975 2.309
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_MA
|
0.145 0.0 0.504 0.0
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_MANY_HEX
|
2.900
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_OPTIN
|
2.900
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_MAIL_BOUND
|
2.900 2.900 0.0 0.0
|
|
header
|
|
Spam tool pattern in MIME boundary
|
MIME_BOUND_TEP
|
2.900
|
|
header
|
|
Spam tool pattern in MIME boundary (rfkindy)
|
MIME_BOUND_RKFINDY
|
2.157 2.900 2.900 2.900
|
|
header
|
|
From address matches known spammer format
|
FROM_HAS_MIXED_NUMS2
|
1.396 1.313 1.101 1.443
|
|
header
|
|
Missing Date: header
|
DATE_MISSING
|
1.472 1.080 1.033 0.354
|
|
header
|
|
Received contains fake 'Post.cz' hostname
|
POST_IN_RCVD
|
0.0
|
|
header
|
|
To: non-existent 'Investors' address
|
TO_INVESTORS
|
0.0
|
|
header
|
|
To: has a malformed address
|
TO_MALFORMED
|
1.347 1.523 1.820 1.611
|
|
header
|
|
From azoogle.com, azogle.com, etc.
|
AZOOGLE
|
2.900
|
|
header
|
|
Subject talks about being approved
|
SUBJECT_APPROVED
|
2.896 2.630 2.793 2.799
|
|
header
|
|
Subject has a Time ID
|
SUBJ_HAS_TIME_ID
|
2.900
|
|
header
|
|
From address is webmail, but starts with a number
|
FROM_NUM_AT_WEBMAIL
|
2.900
|
|
header
|
|
From address is webmail, and ends in lots of numbers
|
FROM_WEBMAIL_ENDS_IN_NUMS6
|
0.905 1.496 0.950 0.286
|
|
header
|
|
From Address contains FREE
|
ADDR_FREE
|
2.045 1.634 2.458 0.844
|
|
header
|
|
Message was sent by a Squid HTTP proxy
|
RECEIVED_IDENT_SQUID
|
2.900
|
|
header
|
|
Received contains 'CacheFlowServer' IDENT name
|
RECEIVED_IDENT_CACHEFLOW
|
2.395 2.900 1.007 2.900
|
|
header
|
|
Sent to a text file
|
TO_TXT
|
2.900
|
|
header
|
|
Involves 'china.com'
|
CHINA_HEADER
|
2.900
|
|
header
|
|
Received line contains spam-sign (lowercase smtp)
|
WITH_LC_SMTP
|
4.400 4.300 4.300 4.300
|
|
header
|
|
'From' has no lower-case characters
|
FROM_NO_LOWER
|
1.870 2.199 0.482 1.609
|
|
header
|
|
'Subject' starts with Buy, Buying
|
SUBJ_BUY
|
0.813 1.898 0.808 1.586
|
|
header
|
|
Subject is indicative of a Nigerian spam
|
NIGERIAN_SUBJECT1
|
2.900 2.900 2.379 2.900
|
|
header
|
|
Subject is indicative of a Nigerian spam
|
NIGERIAN_SUBJECT2
|
2.497 2.299 2.578 2.497
|
|
header
|
|
Subject is indicative of a Nigerian spam
|
NIGERIAN_SUBJECT6
|
2.900 2.900 0.0 1.931
|
|
body
|
|
HTML included in message
|
HTML_MESSAGE
|
0.112 0.101 0.100 0.0
|
|
body
|
|
Message is 0% to 10% HTML
|
HTML_00_10
|
1.357 1.209 1.139 0.0
|
|
body
|
|
Message is 10% to 20% HTML
|
HTML_10_20
|
1.110 1.365 1.257 1.209
|
|
body
|
|
Message is 20% to 30% HTML
|
HTML_20_30
|
1.282 1.158 1.281 1.470
|
|
body
|
|
Message is 30% to 40% HTML
|
HTML_30_40
|
0.617 0.886 0.319 0.629
|
|
body
|
|
Message is 40% to 50% HTML
|
HTML_40_50
|
1.057 1.061 0.748 0.744
|
|
body
|
|
Message is 50% to 60% HTML
|
HTML_50_60
|
0.549 0.547 0.545 0.100
|
|
body
|
|
Message is 60% to 70% HTML
|
HTML_60_70
|
0.527 0.100 0.100 0.100
|
|
body
|
|
Message is 70% to 80% HTML
|
HTML_70_80
|
0.584 0.514 0.405 0.332
|
|
body
|
|
Message is 80% to 90% HTML
|
HTML_80_90
|
0.491 0.543 0.469 0.498
|
|
body
|
|
Message is 90% to 100% HTML
|
HTML_90_100
|
0.501 0.0 0.0 0.0
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING3
|
0.108 0.333 0.0 0.062
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING4
|
0.501 0.501 0.500 0.519
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING5
|
0.444 0.0 0.0 0.011
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING6
|
2.712 2.900 2.304 2.900
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING7
|
2.149 2.900 2.799 2.900
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING8
|
2.900
|
|
body
|
|
HTML has very strong "shouting" markup
|
HTML_SHOUTING9
|
0.753 2.394 0.0 2.899
|
|
body
|
|
HTML table has thick border
|
HTML_TABLE_THICK_BORDER
|
1.101 1.101 1.101 0.500
|
|
body
|
|
HTML comment contains email address
|
HTML_COMMENT_EMAIL
|
0.0
|
|
body
|
|
HTML comment contains non-spam Yahoo! Groups banner
|
HTML_COMMENT_EGP
|
-0.055 -0.264 0.0 0.0
|
|
body
|
|
HTML comment contains SKY database codes
|
HTML_COMMENT_SKY
|
1.101 1.814 4.300 4.300
|
|
body
|
|
HTML comment has 3 consecutive 8-bit characters
|
HTML_COMMENT_8BITS
|
2.900
|
|
body
|
|
HTML message is a saved web page
|
HTML_COMMENT_SAVED_URL
|
1.390 1.487 1.151 0.500
|
|
body
|
|
HTML with embedded plugin object
|
HTML_EMBEDS
|
0.180 0.0 0.0 0.284
|
|
body
|
|
HTML contains auto-executing code
|
HTML_EVENT
|
0.0
|
|
body
|
|
HTML contains unsafe auto-executing code
|
HTML_EVENT_UNSAFE
|
0.0 0.0 0.257 0.211
|
|
body
|
|
FONT Size +2 and up or 3 and up
|
HTML_FONT_BIG
|
0.218 0.270 0.394 0.217
|
|
body
|
|
HTML has a big "font" and "B" tag combo
|
HTML_FONT_BIG_B
|
0.501 0.501 0.608 0.0
|
|
body
|
|
HTML font color is missing hash (
|
HTML_FONT_COLOR_NOHASH
|
0.0
|
|
body
|
|
HTML font color not within safe 6x6x6 palette
|
HTML_FONT_COLOR_UNSAFE
|
0.100
|
|
body
|
|
HTML font color has unusual name
|
HTML_FONT_COLOR_NAME
|
0.442 0.0 0.204 0.0
|
|
body
|
|
HTML font color is same as background
|
HTML_FONT_INVISIBLE
|
0.0 0.0 0.214 0.0
|
|
body
|
|
HTML font color is gray
|
HTML_FONT_COLOR_GRAY
|
0.100
|
|
body
|
|
HTML font color is red
|
HTML_FONT_COLOR_RED
|
0.100
|
|
body
|
|
HTML font color is yellow
|
HTML_FONT_COLOR_YELLOW
|
0.0
|
|
body
|
|
HTML font color is green
|
HTML_FONT_COLOR_GREEN
|
0.708 0.786 0.878 0.217
|
|
body
|
|
HTML font color is cyan
|
HTML_FONT_COLOR_CYAN
|
0.0
|
|
body
|
|
HTML font color is blue
|
HTML_FONT_COLOR_BLUE
|
0.100
|
|
body
|
|
HTML font color is magenta
|
HTML_FONT_COLOR_MAGENTA
|
0.0 0.0 0.595 0.0
|
|
body
|
|
HTML font color is unknown to us
|
HTML_FONT_COLOR_UNKNOWN
|
0.302 0.613 0.0 0.0
|
|
body
|
|
HTML font face is not a word
|
HTML_FONT_FACE_BAD
|
0.0 0.425 0.0 0.644
|
|
body
|
|
HTML font face is not a commonly used face
|
HTML_FONT_FACE_ODD
|
0.085 0.293 0.0 0.315
|
|
body
|
|
HTML font face has excess capital characters
|
HTML_FONT_FACE_CAPS
|
0.0
|
|
body
|
|
HTML includes a form which sends mail
|
HTML_FORM_ACTION_MAILTO
|
1.101 4.300 1.101 1.101
|
|
body
|
|
HTML has 4-5 kilopixels of images
|
HTML_IMAGE_AREA_04
|
0.0
|
|
body
|
|
HTML has 5-6 kilopixels of images
|
HTML_IMAGE_AREA_05
|
0.046 0.319 0.0 0.495
|
|
body
|
|
HTML has 6-7 kilopixels of images
|
HTML_IMAGE_AREA_06
|
0.0
|
|
body
|
|
HTML has 7-8 kilopixels of images
|
HTML_IMAGE_AREA_07
|
0.492 0.988 0.0 0.0
|
|
body
|
|
HTML has 8-9 kilopixels of images
|
HTML_IMAGE_AREA_08
|
2.900 2.900 0.0 2.900
|
|
body
|
|
HTML has over 9 kilopixels of images
|
HTML_IMAGE_AREA_09
|
0.0
|
|
body
|
|
HTML has images with 0-200 bytes of words
|
HTML_IMAGE_ONLY_02
|
2.003 1.936 1.587 1.440
|
|
body
|
|
HTML has images with 200-400 bytes of words
|
HTML_IMAGE_ONLY_04
|
1.984 1.957 1.519 1.411
|
|
body
|
|
HTML has images with 400-600 bytes of words
|
HTML_IMAGE_ONLY_06
|
1.296 1.111 1.464 0.586
|
|
body
|
|
HTML has images with 600-800 bytes of words
|
HTML_IMAGE_ONLY_08
|
1.065 0.743 0.0 0.0
|
|
body
|
|
HTML has images with 800-1000 bytes of words
|
HTML_IMAGE_ONLY_10
|
0.738 0.502 0.392 0.330
|
|
body
|
|
HTML has images with 1000-1200 bytes of words
|
HTML_IMAGE_ONLY_12
|
0.144 0.282 0.507 0.0
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_02
|
1.101 0.500 1.101 0.500
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_04
|
0.597 0.890 0.390 0.273
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_06
|
0.769 0.019 0.271 0.227
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_08
|
0.525 0.339 0.283 0.885
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_10
|
0.141 0.092 0.0 0.0
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_12
|
0.160 0.664 0.0 0.699
|
|
body
|
|
HTML has a low ratio of text to image area
|
HTML_IMAGE_RATIO_14
|
0.0
|
|
body
|
|
JavaScript code
|
HTML_JAVASCRIPT
|
0.0 0.0 0.0 0.230
|
|
body
|
|
HTML link text says "click here"
|
HTML_LINK_CLICK_HERE
|
0.100
|
|
body
|
|
HTML link text says "CLICK"
|
HTML_LINK_CLICK_CAPS
|
1.101
|
|
body
|
|
Frame wanted to load outside URL
|
HTML_RELAYING_FRAME
|
1.008 0.272 0.071 0.0
|
|
body
|
|
Image tag with an ID code to identify you
|
HTML_WEB_BUGS
|
0.542 0.100 0.100 0.100
|
|
body
|
|
Javascript to move windows around
|
HTML_WIN_BLUR
|
0.0 0.0 0.921 0.0
|
|
body
|
|
Javascript to change window focus
|
HTML_WIN_FOCUS
|
0.0 0.0 0.0 0.313
|
|
body
|
|
Javascript to open a new window
|
HTML_WIN_OPEN
|
0.500 0.501 0.501 0.578
|
|
body
|
|
HTML mail with non-white background
|
HTML_WITH_BGCOLOR
|
0.0 0.0 0.100 0.100
|
|
body
|
|
HTML has excess "a" close tags
|
HTML_TAG_BALANCE_A
|
0.0
|
|
body
|
|
HTML has excess "font" close tags
|
HTML_TAG_BALANCE_FONT
|
0.0
|
|
body
|
|
HTML has unbalanced "html" tags
|
HTML_TAG_BALANCE_HTML
|
0.248 0.0 0.265 0.0
|
|
body
|
|
HTML has unbalanced "body" tags
|
HTML_TAG_BALANCE_BODY
|
0.390 0.182 0.175 0.0
|
|
body
|
|
HTML has unbalanced "head" tags
|
HTML_TAG_BALANCE_HEAD
|
0.0
|
|
body
|
|
HTML is missing "table" close tags
|
HTML_TAG_BALANCE_TABLE
|
0.0 0.192 0.0 0.307
|
|
body
|
|
HTML has "base" tags
|
HTML_TAG_EXISTS_BASE
|
0.201 0.0 0.0 0.0
|
|
body
|
|
HTML has "param" tag
|
HTML_TAG_EXISTS_PARAM
|
0.0
|
|
body
|
|
HTML has "tbody" tag
|
HTML_TAG_EXISTS_TBODY
|
0.496 0.101 0.439 0.100
|
|
body
|
|
HTML title contains no text
|
HTML_TITLE_EMPTY
|
0.0 0.0 0.156 0.0
|
|
body
|
|
HTML title contains "Untitled"
|
HTML_TITLE_UNTITLED
|
0.386 0.423 0.501 0.0
|
|
rawbody
|
|
Form for changing email address
|
SPAM_FORM
|
0.0
|
|
rawbody
|
|
Form for checking email address
|
SPAM_FORM_RETURN
|
0.0
|
|
rawbody
|
|
Obfuscated action attribute in HTML form
|
SPAM_FORM_ACTION
|
0.0
|
|
rawbody
|
|
Javascript to hide URLs in browser
|
HIDE_WIN_STATUS
|
2.899 2.597 1.656 2.849
|
|
rawbody
|
|
Contains link without http:// prefix
|
LINK_TO_NO_SCHEME
|
0.0 0.0 0.0 0.290
|
|
body
|
|
List removal information
|
REMOVE_SUBJ
|
1.626 0.917 1.328 0.657
|
|
body
|
|
List removal information
|
SUBJ_REMOVE
|
1.101 0.500 1.132 0.625
|
|
body
|
|
List removal information
|
REPLY_REMOVE_SUBJECT
|
0.0
|
|
body
|
|
List removal information
|
DISCONTINUE
|
0.0
|
|
body
|
|
To be removed from list
|
REMOVE_FROM_LIST
|
0.0 0.012 0.0 0.0
|
|
body
|
|
We respect all removal requests
|
REMOVE_RESPECT
|
4.300
|
|
body
|
|
Send real mail to be unsubscribed
|
REMOVE_POSTAL
|
3.446 2.790 4.299 2.753
|
|
body
|
|
Asks you to click below (in capital letters)
|
CLICK_BELOW_CAPS
|
0.639 0.500 0.100 0.500
|
|
body
|
|
Click to be removed
|
CLICK_TO_REMOVE_1
|
1.100 1.101 1.100 1.962
|
|
body
|
|
Claims compliance with spam regulations
|
SENT_IN_COMPLIANCE
|
1.101 4.300 1.101 4.300
|
|
body
|
|
Claims compliance with Senate Bill 1618
|
BILL_1618
|
2.043 2.225 1.641 1.437
|
|
body
|
|
Claims compliance with Senate Bill 1618
|
S_1618
|
2.900 0.0 2.900 0.0
|
|
body
|
|
Claims compliance with Senate Bill 1618
|
UNDER_BILL_1618
|
4.300
|
|
body
|
|
Claims compliance with spam regulations
|
SECTION_301
|
1.101 1.660 1.101 1.101
|
|
body
|
|
Claims compliance with House Bill 4176
|
HR_4176
|
2.900
|
|
body
|
|
Claims compliance with spam regulations
|
FURTHER_TRANSMISSIONS
|
1.101 2.900 0.701 2.900
|
|
body
|
|
Contains word 'guarantee' in all-caps
|
GUARANTEE
|
1.123 1.785 1.301 0.619
|
|
body
|
|
Doesn't ask any questions
|
NO_QS_ASKED
|
0.147 2.133 0.892 0.0
|
|
body
|
|
Offers a full refund
|
FULL_REFUND
|
0.518 1.011 0.600 0.228
|
|
body
|
|
No such thing as a free lunch (1)
|
FOR_FREE
|
0.515 0.573 0.390 0.366
|
|
body
|
|
No such thing as a free lunch (2)
|
COMPLETELY_FREE
|
0.771 1.101 0.500 1.101
|
|
body
|
|
No such thing as a free lunch (3)
|
NO_COST
|
1.017 0.926 0.643 0.949
|
|
body
|
|
One hundred percent guaranteed
|
GUARANTEED_100_PERCENT
|
1.101 0.500 1.100 0.952
|
|
body
|
|
Discusses money making
|
MONEY_MAKING
|
1.557 2.699 2.796 2.799
|
|
body
|
|
Talks about bulk email
|
BULK_EMAIL
|
1.372 1.621 1.371 1.838
|
|
body
|
|
How dear can you be if you don't know my name?
|
DEAR_FRIEND
|
0.484 0.0 0.0 0.0
|
|
body
|
|
Contains 'Dear (something)'
|
DEAR_SOMETHING
|
2.596 2.599 1.769 1.864
|
|
body
|
|
Urges you to call now
|
CALL_NOW
|
1.596 1.517 0.905 1.069
|
|
body
|
|
Contains a tollfree number
|
CALL_FREE
|
0.0
|
|
body
|
|
Wants you to do business online
|
ONLINE_BIZ_OPS
|
2.900
|
|
body
|
|
Talks about lots of money
|
BILLION_DOLLARS
|
1.490 2.900 0.0 0.0
|
|
body
|
|
Talks about opting in (lowercase version)
|
OPT_IN
|
1.260 0.469 1.335 0.756
|
|
body
|
|
Talks about opting in (capitalized version)
|
OPT_IN_CAPS
|
0.535 0.177 0.714 0.370
|
|
body
|
|
Talks about opting out (lowercase version)
|
OPT_OUT
|
1.225 0.042 2.184 0.541
|
|
body
|
|
Talks about opting out (capitalized version)
|
OPT_OUT_CAPS
|
1.434 0.0 1.127 0.0
|
|
body
|
|
Talks about direct email
|
DIRECT_EMAIL
|
0.0 0.693 0.0 0.0
|
|
body
|
|
Talks about mass email
|
MASS_EMAIL
|
0.0 0.0 0.0 0.482
|
|
body
|
|
Talks about email marketing
|
EMAIL_MARKETING
|
0.0
|
|
body
|
|
Tells you it's an ad
|
PRODUCED_AND_SENT_OUT
|
0.0 0.0 2.900 0.0
|
|
body
|
|
Instructions on how to increase something
|
INCREASE_SOMETHING
|
0.0 0.0 1.094 1.296
|
|
body
|
|
"another mailing" will "never" be "received"
|
NEVER_ANOTHER
|
2.900
|
|
body
|
|
"one time mailing" doesn't mean it isn't spam
|
ONE_TIME_MAILING
|
1.480 0.951 0.737 1.053
|
|
body
|
|
Get a million email addresses
|
MILLION_EMAIL
|
2.896 2.130 0.994 2.750
|
|
body
|
|
Only thing addresses on CD are useful for is spam
|
ADDRESSES_ON_CD
|
2.900 2.900 0.930 2.581
|
|
body
|
|
Gives a lame excuse about why you were sent this spam
|
EXCUSE_1
|
0.114 0.705 0.0 0.728
|
|
body
|
|
Claims you actually asked for this spam
|
EXCUSE_2
|
0.0
|
|
body
|
|
Claims you can be removed from the list
|
EXCUSE_3
|
0.100 0.100 0.100 0.157
|
|
body
|
|
Claims you can be removed from the list
|
EXCUSE_4
|
2.896 2.676 2.900 2.896
|
|
body
|
|
Claims you can be removed from the list
|
EXCUSE_6
|
0.811 2.113 2.013 1.284
|
|
body
|
|
Claims you can be removed from the list
|
EXCUSE_7
|
0.0
|
|
body
|
|
"if you do not wish to receive any more"
|
EXCUSE_10
|
0.069 0.0 0.0 0.0
|
|
body
|
|
Claims you were on a list
|
EXCUSE_11
|
1.514 1.528 1.131 1.086
|
|
body
|
|
Nobody's perfect
|
EXCUSE_12
|
1.878 2.349 1.101 1.751
|
|
body
|
|
Gives an excuse for why message was sent
|
EXCUSE_13
|
0.501 0.501 0.501 0.0
|
|
body
|
|
Tells you how to stop further spam
|
EXCUSE_14
|
0.191 0.100 0.0 0.0
|
|
body
|
|
Claims to be legitimate email
|
EXCUSE_15
|
1.554 1.428 0.500 1.488
|
|
body
|
|
I wonder how many emails they sent in error...
|
EXCUSE_16
|
0.0
|
|
body
|
|
Claims not to be spam
|
EXCUSE_18
|
0.0
|
|
body
|
|
Claims you opted-in or registered
|
EXCUSE_19
|
1.347 0.622 1.101 0.500
|
|
body
|
|
Claims you registered at their site
|
EXCUSE_20
|
2.900
|
|
body
|
|
Claims your address was obtained legitimately
|
EXCUSE_21
|
2.421 2.813 4.300 2.884
|
|
body
|
|
Claims you're receiving this offer for a reason
|
EXCUSE_22
|
2.900
|
|
body
|
|
Claims you have provided permission
|
EXCUSE_23
|
2.900
|
|
body
|
|
Claims you received an ad because you wanted it
|
EXCUSE_24
|
4.300
|
|
body
|
|
Talks about how to be removed from mailings
|
EXCUSE_REMOVE
|
2.213 2.389 2.446 2.236
|
|
body
|
|
Plugs Viagra
|
VIAGRA
|
0.0
|
|
body
|
|
Plugs "Natural Viagra"
|
NATURAL_VIAGRA
|
0.0
|
|
body
|
|
Plugs "Herbal Viagra"
|
HERBAL_VIAGRA
|
1.435 0.308 1.861 1.597
|
|
body
|
|
Targeted Traffic / Email Addresses
|
TARGETED
|
2.896 2.799 2.439 2.615
|
|
body
|
|
Offers a limited time offer
|
LIMITED_TIME_ONLY
|
0.324 0.250 0.230 0.034
|
|
body
|
|
Tells you about a strong buy
|
STRONG_BUY
|
0.175 1.168 0.820 1.328
|
|
body
|
|
Claims to honor removal requests
|
WE_HONOR_ALL
|
1.101 4.300 1.101 4.300
|
|
body
|
|
Sent using a trial version of CommuniGate
|
COMMUNIGATE
|
1.709 2.291 2.618 1.447
|
|
body
|
|
Gives information about an opportunity
|
OPPORTUNITY
|
1.101 1.482 2.690 0.680
|
|
body
|
|
Offers "pure" profit
|
PURE_PROFIT
|
1.992 2.900 1.039 2.900
|
|
body
|
|
Offers a picked stock
|
STOCK_PICK
|
0.0 0.0 0.812 0.182
|
|
body
|
|
Offers a alert about a stock
|
STOCK_ALERT
|
2.857 2.799 2.796 2.729
|
|
body
|
|
SEC-mandated penny-stock warning -- thanks SEC
|
MICRO_CAP_WARNING
|
2.900 0.0 2.900 0.0
|
|
body
|
|
Not registered investment advisor
|
NOT_ADVISOR
|
2.900
|
|
body
|
|
Offers a consultation for nothing
|
FREE_CONSULTATION
|
2.900 2.482 2.900 2.898
|
|
body
|
|
Describes some sort of breakthrough
|
SOME_BREAKTHROUGH
|
0.712 1.688 1.298 0.410
|
|
body
|
|
They have selected you for something
|
SELECTED_YOU
|
0.0 0.0 0.237 0.0
|
|
body
|
|
Asks for credit card details
|
WANTS_CREDIT_CARD
|
2.043 2.799 2.796 2.796
|
|
body
|
|
Asks for a billing address
|
ASKS_BILLING_ADDRESS
|
0.041 0.0 0.014 0.0
|
|
body
|
|
Asks you for your signature on a form
|
PRINT_FORM_SIGNATURE
|
2.704 1.309 2.363 2.564
|
|
body
|
|
Contains mail-in order form
|
MAIL_IN_ORDER_FORM
|
0.701 0.736 0.701 1.063
|
|
body
|
|
Instant Access button
|
FOR_INSTANT_ACCESS
|
0.0 0.0 0.0 0.976
|
|
body
|
|
University Diplomas
|
UNIVERSITY_DIPLOMAS
|
2.507 1.991 2.900 2.360
|
|
body
|
|
'Prestigious Non-Accredited Universities'
|
PREST_NON_ACCREDITED
|
2.900
|
|
body
|
|
Possible registry spammer
|
NEW_DOMAIN_EXTENSIONS
|
2.053 2.228 2.174 2.292
|
|
body
|
|
Domain registration spam body
|
DOMAIN_BODY
|
0.0
|
|
body
|
|
Gives instructions for removal from list
|
REMOVAL_INSTRUCTIONS
|
0.611 0.0 0.502 0.0
|
|
body
|
|
Claims "cannot be considered spam"
|
CANNOT_BE_SPAM
|
1.654 1.394 1.374 1.679
|
|
body
|
|
Claims "This is not spam"
|
THIS_AINT_SPAM
|
1.615 1.875 2.015 2.799
|
|
body
|
|
Says "We strongly oppose the use of spam email"
|
WE_HATE_SPAM
|
1.937 1.199 2.900 2.090
|
|
body
|
|
Says "this is an advertisement" (thanks!)
|
THIS_IS_AN_AD
|
1.177 1.869 2.900 1.296
|
|
body
|
|
Mentions Spam law "H.R. 3113"
|
HR_3113
|
4.300 4.300 2.900 2.900
|
|
body
|
|
Mentions Spam Law "UCE-Mail Act"
|
UCE_MAIL_ACT
|
4.300 4.300 2.900 2.900
|
|
body
|
|
Information on getting a larger penis or breasts
|
PENIS_ENLARGE
|
2.796 1.388 1.483 1.716
|
|
body
|
|
Information on getting a larger penis or breasts (2)
|
PENIS_ENLARGE2
|
2.098 1.291 0.544 2.098
|
|
body
|
|
Impotence cure
|
IMPOTENCE
|
2.796 2.900 2.077 2.900
|
|
body
|
|
Information on how to work at home (1)
|
WORK_AT_HOME
|
1.116 0.546 1.114 0.0
|
|
body
|
|
Information on how to work at home (2)
|
HOME_EMPLOYMENT
|
1.601 1.557 1.600 1.652
|
|
body
|
|
No experience needed!
|
NO_EXPERIENCE
|
1.443 1.454 2.001 0.976
|
|
body
|
|
Information on mortgages
|
MORTGAGE_BEST
|
1.101 1.683 1.101 1.740
|
|
body
|
|
Looks like mortgage pitch
|
MORTGAGE_PITCH
|
0.828 0.574 0.500 0.686
|
|
body
|
|
Information on mortgage rates
|
MORTGAGE_RATES
|
0.500 0.387 1.101 0.540
|
|
body
|
|
Something about waiting for mortgages
|
MORTGAGE_WAITING
|
2.900
|
|
body
|
|
Something about a mortgage network
|
MORTGAGE_NETWORK
|
2.900
|
|
body
|
|
A dodgy mortgage testimonial
|
HELPED_FINANCE
|
2.900 0.0 2.900 0.0
|
|
body
|
|
Interest rates
|
FALLING_INTEREST
|
2.900
|
|
body
|
|
Order a report from someone
|
ORDER_REPORT
|
2.900
|
|
body
|
|
Tells you to 'take action now!'
|
TAKE_ACTION_NOW
|
2.900
|
|
body
|
|
Asks you to fill out a form
|
THE_FOLLOWING_FORM
|
0.0 0.258 1.126 1.184
|
|
rawbody
|
|
mailto URI includes removal text
|
MAILTO_WITH_SUBJ_REMOVE
|
1.101 0.500 1.100 0.500
|
|
rawbody
|
|
Includes a URL link to send an email
|
MAILTO_LINK
|
0.100 0.0 0.100 0.0
|
|
body
|
|
Includes a link for AOL users to click
|
AOL_USERS_LINK
|
1.416 0.884 1.015 2.271
|
|
body
|
|
Nigerian scam key phrase (million dollars)
|
US_DOLLARS
|
0.0 1.542 0.0 1.137
|
|
body
|
|
Nigerian scam key phrase ((dollar) NNN.N m/USDNNN.N m/US(dollar) NN.N m)
|
US_DOLLARS_2
|
0.0
|
|
body
|
|
Nigerian scam key phrase ((dollar) NN,NNN,NNN.NN)
|
US_DOLLARS_3
|
0.971 0.852 1.758 0.917
|
|
body
|
|
Nigerian scam key phrase (millions of dollars)
|
MILLION_USD
|
0.990 0.0 1.636 0.0
|
|
rawbody
|
|
Frontpage used to create the message
|
FRONTPAGE
|
0.501 0.691 0.500 1.856
|
|
body
|
|
Contains "Temple Kiff"
|
KIFF
|
2.900
|
|
body
|
|
Contains "CBYI"
|
CBYI
|
2.796 2.799 2.900 0.305
|
|
body
|
|
Contains "My wife, Jody" testimonial
|
JODY
|
2.900
|
|
body
|
|
Contains "Gentle Ferocity"
|
GENTLE_FEROCITY
|
2.900
|
|
body
|
|
Contains "Vjestika Aphrodisia"
|
VJESTIKA
|
2.900
|
|
body
|
|
Contains "Toner Cartridge"
|
TONER
|
1.295 1.716 1.437 1.168
|
|
body
|
|
Doing something with my income
|
YOUR_INCOME
|
2.182 2.540 1.807 2.696
|
|
body
|
|
Apparently, you'll be amazed
|
BE_AMAZED
|
0.0 0.281 0.124 0.027
|
|
body
|
|
Resistance to this spam is futile
|
RESISTANCE_IS_FUTILE
|
1.228 1.133 0.700 2.900
|
|
body
|
|
Trying to offer you something
|
GREAT_OFFER
|
0.0
|
|
body
|
|
Contains 'subject to credit approval'
|
SUBJ_2_CREDIT
|
1.838 1.506 2.134 0.0
|
|
body
|
|
Contains urgent matter
|
URGENT_BIZ
|
0.565 0.151 0.0 0.0
|
|
body
|
|
Contains 'earn (dollar) something per week'
|
EARN_PER_WEEK
|
0.0
|
|
body
|
|
Contains 'for only pennies a day'
|
PENNIES_A_DAY
|
2.900
|
|
body
|
|
Contains 'for only' some amount of cash
|
FOR_JUST_SOME_AMT
|
0.0 0.0 0.0 0.181
|
|
body
|
|
You'd better read all of this spam!
|
READ_TO_END
|
2.900 2.900 2.900 2.359
|
|
body
|
|
Spam is 100% natural?!
|
ALL_NATURAL
|
2.051 1.226 2.796 2.075
|
|
body
|
|
Money back guarantee
|
MONEY_BACK
|
0.718 1.045 1.360 1.318
|
|
body
|
|
There is no catch
|
NO_CATCH
|
2.900 2.900 2.111 2.900
|
|
body
|
|
There is no obligation
|
NO_OBLIGATION
|
0.0
|
|
body
|
|
You won't be "disappointed"
|
NO_DISAPPOINTMENT
|
0.125 0.375 0.0 1.642
|
|
body
|
|
Serious Enquiries Only
|
SERIOUS_ONLY
|
2.412 0.0 2.796 0.0
|
|
body
|
|
Risk free. Suuurreeee....
|
RISK_FREE
|
0.823 0.887 0.866 0.753
|
|
body
|
|
As seen on national TV!
|
AS_SEEN_ON
|
1.948 1.928 1.144 3.025
|
|
body
|
|
Not intended for residents of somewhere or other
|
NOT_INTENDED
|
2.900
|
|
body
|
|
Common pyramid scheme phrase (1)
|
COPY_ACCURATELY
|
2.900
|
|
body
|
|
See for yourself
|
SEE_FOR_YOURSELF
|
0.462 0.477 0.996 0.524
|
|
body
|
|
Encourages you to waste no time in ordering
|
ORDER_NOW
|
0.0
|
|
body
|
|
Off Shore Scams
|
OFFSHORE_SCAM
|
1.057 2.699 2.107 2.495
|
|
body
|
|
Vacation Offers
|
VACATION_SCAM
|
0.738 1.853 1.433 0.482
|
|
body
|
|
Why Pay More?
|
WHY_PAY_MORE
|
0.0 0.755 1.588 2.305
|
|
body
|
|
Congratulations - you've been scammed?
|
CONGRATULATIONS
|
0.0
|
|
body
|
|
Talks about free mobile phones
|
FREE_CELL_PHONE
|
1.873 2.794 1.902 2.900
|
|
body
|
|
Free Leads
|
FREE_LEADS
|
2.900 2.900 1.828 1.945
|
|
body
|
|
Receive third party email
|
RECEIVE_EMAIL
|
2.900
|
|
body
|
|
Receive a special offer
|
RECEIVE_OFFER
|
0.501 0.501 1.101 0.501
|
|
body
|
|
Free Offer
|
OFFER
|
0.100
|
|
body
|
|
Free Quote
|
FREE_QUOTE
|
1.316 1.657 1.101 1.101
|
|
body
|
|
Free express or no-obligation quote
|
FREE_QUOTE_INSTANT
|
2.896 2.900 2.470 2.900
|
|
body
|
|
Free DVD
|
FREE_DVD
|
0.0
|
|
body
|
|
Free Investment
|
FREE_INVESTMENT
|
1.630 1.465 1.625 0.585
|
|
body
|
|
Free Trial
|
FREE_TRIAL
|
0.0 0.0 0.0 0.017
|
|
body
|
|
Free Membership
|
FREE_MEMBERSHIP
|
0.701 0.700 0.758 0.105
|
|
body
|
|
Free Website
|
FREE_WEBSITE
|
0.930 2.334 1.841 2.316
|
|
body
|
|
Credit Card Offers
|
CREDIT_CARD
|
0.447 0.950 0.862 1.129
|
|
body
|
|
No Credit Check
|
NO_CREDIT_CHECK
|
2.900
|
|
body
|
|
Avoid Bankruptcy
|
BANKRUPTCY
|
1.390 0.504 1.337 1.444
|
|
body
|
|
Credit Bureaus
|
CREDIT_BUREAU
|
0.0
|
|
body
|
|
Accept Credit Cards
|
ACCEPT_CREDIT_CARDS
|
0.970 1.540 2.070 0.894
|
|
body
|
|
Eliminate Bad Credit
|
BAD_CREDIT
|
0.730 0.406 0.462 0.593
|
|
body
|
|
Unsecured Credit/Debt
|
UNSECURED_CREDIT
|
1.823 1.097 2.200 0.709
|
|
body
|
|
Lower Interest Rates
|
LOW_INTEREST
|
1.525 1.962 1.553 2.289
|
|
body
|
|
Compare Rates
|
COMPARE_RATES
|
1.890 2.750 2.535 0.327
|
|
body
|
|
Save Up To
|
SAVE_UP_TO
|
0.0
|
|
body
|
|
Lower Monthly Payment
|
LOW_PAYMENT
|
1.975 2.764 1.519 2.198
|
|
body
|
|
Consolidate debt, credit, or bills
|
CONSOLIDATE_DEBT
|
1.247 4.300 1.283 1.101
|
|
body
|
|
Calling Creditors
|
CREDITORS_CALLING
|
0.0
|
|
body
|
|
Home refinancing
|
REFINANCE_YOUR_HOME
|
0.0 0.896 0.855 0.0
|
|
body
|
|
Home refinancing
|
REFINANCE_NOW
|
2.899 2.183 2.900 2.899
|
|
body
|
|
Discusses search engine listings
|
SEARCH_ENGINE_PROMO
|
1.027 1.545 1.800 1.997
|
|
body
|
|
Opportunity - What a deal!
|
OPPORTUNITY_2
|
1.067 1.259 0.0 0.958
|
|
body
|
|
No Purchase Necessary
|
NO_PURCHASE
|
0.267 0.088 0.341 0.367
|
|
body
|
|
No Strings Attached
|
NO_STRINGS
|
2.092 2.699 2.349 2.699
|
|
body
|
|
No Fees
|
NO_FEE
|
0.506 0.234 0.545 0.509
|
|
body
|
|
No Medical Exams
|
NO_MEDICAL
|
2.900 2.900 0.0 2.900
|
|
body
|
|
No Age Restrictions
|
NO_AGE
|
1.959 2.325 0.754 2.497
|
|
body
|
|
No Claim Forms
|
NO_FORMS
|
2.530 2.478 1.907 2.481
|
|
body
|
|
No Gimmick
|
NO_GIMMICK
|
0.0
|
|
body
|
|
No Investment
|
NO_INVESTMENT
|
2.796 2.900 2.696 2.900
|
|
body
|
|
Requires Initial Investment
|
INITIAL_INVEST
|
2.734 2.734 2.057 2.734
|
|
body
|
|
No Inventory
|
NO_INVENTORY
|
2.899 2.900 2.291 2.900
|
|
body
|
|
Buy Direct
|
BUY_DIRECT
|
0.708 0.224 0.218 0.634
|
|
body
|
|
Drastically Reduced
|
DRASTIC_REDUCED
|
2.199 1.011 1.760 2.398
|
|
body
|
|
Do it Today
|
DO_IT_TODAY
|
0.0 0.0 0.046 0.457
|
|
body
|
|
What are you waiting for
|
WHY_WAIT
|
1.094 1.093 0.728 0.925
|
|
body
|
|
Supplies are Limited
|
SUPPLIES_LIMITED
|
0.0 0.0 0.076 0.543
|
|
body
|
|
Secretly Recorded
|
SECRET_RECORD
|
2.252 0.0 0.0 0.0
|
|
body
|
|
Someone using your identity
|
USE_IDENTITY
|
2.900
|
|
body
|
|
You can search for anyone
|
YOU_CAN_SEARCH
|
2.900
|
|
body
|
|
Find out anything
|
FIND_ANYTHING
|
0.330 0.409 0.174 0.330
|
|
body
|
|
Score with babes!
|
SEDUCTION
|
0.0 0.762 0.442 0.738
|
|
body
|
|
Invaluable marketing information
|
INVALUABLE_MARKETING
|
2.900
|
|
body
|
|
Marketing Solutions
|
MARKET_SOLUTION
|
2.095 2.199 2.297 1.897
|
|
body
|
|
Direct Marketing
|
MARKETING
|
0.0 0.467 0.0 0.0
|
|
body
|
|
Save big money
|
SAVE_MONEY
|
0.0
|
|
body
|
|
Guaranteed Stuff
|
GUARANTEED_STUFF
|
0.0 0.014 1.027 1.029
|
|
body
|
|
Additional Income
|
INCOME
|
2.749 2.900 2.520 2.432
|
|
body
|
|
Potential Earnings
|
EARNINGS
|
1.381 2.900 2.117 2.900
|
|
body
|
|
The best Rates
|
THE_BEST_RATE
|
4.300 3.956 3.915 2.934
|
|
body
|
|
Promise you ...!
|
WE_PROMISE_YOU
|
1.753 2.384 1.173 2.298
|
|
body
|
|
Amazing Stuff
|
AMAZING_STUFF
|
0.450 1.201 0.822 0.701
|
|
body
|
|
Cash Bonus
|
CASH_BONUS
|
0.146 0.844 1.301 1.131
|
|
body
|
|
Shopping Spree
|
SHOPPING_SPREE
|
0.0 0.551 0.0 1.375
|
|
body
|
|
Fantastic Deal
|
FANTASTIC
|
0.0
|
|
body
|
|
Cents on the Dollar
|
CENTS_ON_DOLLAR
|
2.900
|
|
body
|
|
Lose Weight Spam
|
DIET
|
0.0 0.0 0.025 0.0
|
|
body
|
|
Long Distance Phone Offer
|
LONG_DISTANCE
|
2.477 1.989 0.435 0.298
|
|
body
|
|
Reverses Aging
|
REVERSE_AGING
|
2.230 2.118 3.386 2.129
|
|
body
|
|
Cures Baldness
|
HAIR_LOSS
|
2.796 2.799 2.796 3.565
|
|
body
|
|
Cable Converter
|
CABLE_CONVERTER
|
2.900
|
|
body
|
|
Luxury Car
|
LUXURY_CAR
|
0.0 0.0 1.569 0.256
|
|
body
|
|
Removes Wrinkles
|
WRINKLES
|
4.300 2.900 4.300 4.300
|
|
body
|
|
Buying judgements
|
BUY_JUDGEMENTS
|
0.0
|
|
body
|
|
Will not Believe your Eyes!
|
LYING_EYES
|
0.755 0.760 1.139 1.263
|
|
body
|
|
While you Sleep
|
WHILE_YOU_SLEEP
|
1.391 1.683 1.101 1.155
|
|
body
|
|
While Supplies Last
|
WHILE_SUPPLIES
|
0.145 0.0 0.275 0.0
|
|
body
|
|
If only it were that easy
|
RICH
|
2.068 0.944 2.068 2.259
|
|
body
|
|
Who really wins?
|
YOU_WON
|
0.0 0.561 0.137 1.070
|
|
body
|
|
Contains 'Special Promotion'
|
PROMOTION
|
2.278 2.590 1.042 0.800
|
|
body
|
|
Offers Free (often stolen) Passwords
|
FREE_PASSWORD
|
1.846 1.457 1.932 1.846
|
|
body
|
|
Talks about Hidden Charges
|
HIDDEN_CHARGES
|
0.0 1.817 0.0 0.0
|
|
body
|
|
Get Started Now
|
GET_STARTED_NOW
|
0.060 2.900 0.139 2.900
|
|
body
|
|
Only (dollar) (dollar) (dollar)
|
ONLY_COST
|
0.0 0.0 0.220 0.0
|
|
body
|
|
Save (dollar) (dollar) (dollar)
|
SAVE_BUCKS
|
0.0
|
|
body
|
|
Financial Freedom
|
FINANCIAL
|
4.300
|
|
body
|
|
Stock Disclaimer Statement
|
FORWARD_LOOKING
|
2.796 2.900 2.899 1.419
|
|
body
|
|
Satisfaction Guaranteed
|
SATISFACTION
|
0.530 0.527 0.649 0.690
|
|
body
|
|
Talks about prizes
|
PRIZE
|
0.0 0.117 0.122 0.236
|
|
body
|
|
Human Growth Hormone
|
HGH
|
0.500 1.206 1.101 1.102
|
|
body
|
|
Easy Terms
|
EASY_TERMS
|
2.900
|
|
body
|
|
Offers Extra Cash
|
EXTRA_CASH
|
1.184 2.699 0.840 0.883
|
|
body
|
|
Get Paid
|
GET_PAID
|
2.796 2.799 2.896 2.796
|
|
body
|
|
Have you been turned down?
|
BEEN_TURNED_DOWN
|
1.258 1.388 1.736 0.465
|
|
body
|
|
One Time Rip Off
|
ONE_TIME
|
0.0 0.0 0.097 0.0
|
|
body
|
|
Compete for your business
|
COMPETE
|
2.896 2.899 2.345 2.473
|
|
body
|
|
New Customers Only
|
NEW_CUSTOMER
|
1.925 1.902 0.0 1.797
|
|
body
|
|
Meet Singles
|
MEET_SINGLES
|
2.796 2.799 0.967 1.595
|
|
body
|
|
Join Millions of Americans
|
JOIN_MILLIONS
|
2.599 2.466 1.263 2.453
|
|
body
|
|
Be your own boss
|
BE_BOSS
|
2.896 2.900 2.101 2.900
|
|
body
|
|
Dig up Dirt on Friends
|
DIG_UP_INFO
|
2.900
|
|
body
|
|
Multi Level Marketing mentioned
|
MLM
|
0.822 0.765 0.623 0.676
|
|
body
|
|
Apparently, NOT Multi Level Marketing
|
NOT_MLM
|
2.900
|
|
body
|
|
Serious cash
|
SERIOUS_CASH
|
1.493 2.409 1.729 2.197
|
|
body
|
|
"Collect Child Support" Scam
|
CHILD_SUPPORT
|
0.0
|
|
body
|
|
Claims to be Legal
|
ITS_LEGAL
|
1.679 1.482 0.0 0.318
|
|
body
|
|
Free Grant Money
|
FREE_GRANT
|
0.701 2.900 2.420 2.900
|
|
body
|
|
Fast Viagra Delivery
|
VIAGRA_ONLINE
|
0.701 0.701 2.900 1.045
|
|
body
|
|
Viagra and other drugs
|
VIAGRA_COMBO
|
2.900
|
|
body
|
|
Online Pharmacy
|
ONLINE_PHARMACY
|
2.681 0.855 1.729 2.676
|
|
body
|
|
Confidentiality on all orders
|
CONFIDENTIAL_ORDER
|
0.0
|
|
body
|
|
'Hidden' assets
|
HIDDEN_ASSETS
|
2.900
|
|
body
|
|
Save big money
|
SAVE_THOUSANDS
|
0.711 1.931 1.392 1.590
|
|
body
|
|
Claims you registered with some kind of partner
|
MARKETING_PARTNERS
|
2.080 2.072 1.555 2.076
|
|
body
|
|
Orders shipped by priority mail
|
PRIORITY_MAIL
|
0.0
|
|
body
|
|
Trying to sell insurance online
|
SAVE_ON_INSURANCE
|
1.629 0.262 2.796 2.796
|
|
body
|
|
Contains "Stop Snoring"
|
STOP_SNORING
|
2.900 2.900 0.0 2.900
|
|
body
|
|
Free Application
|
APPLY_FREE
|
1.819 1.490 1.921 1.677
|
|
body
|
|
Apply online (with capital O)
|
APPLY_ONLINE
|
0.723 0.683 0.060 2.699
|
|
body
|
|
Contains 'free installation' with capitals
|
FREE_INSTALL
|
2.900 2.900 2.796 2.900
|
|
body
|
|
Free Preview
|
FREE_PREVIEW
|
0.300 0.220 1.643 2.724
|
|
body
|
|
Local part containing a "4u" variant
|
USER_4U2
|
2.696 2.599 1.645 2.201
|
|
body
|
|
Domain name containing a "4u" variant
|
DOMAIN_4U2
|
1.470 0.0 0.835 0.745
|
|
body
|
|
Contains 'free access' with capitals
|
FREE_ACCESS
|
0.0 0.0 0.516 0.0
|
|
body
|
|
Contains 'free sample' with capitals
|
FREE_SAMPLE
|
0.0
|
|
body
|
|
Contains 'Get it now' with capitals
|
GET_IT_NOW
|
0.0 1.116 0.0 0.277
|
|
body
|
|
Lowest Price
|
LOW_PRICE
|
0.525 0.0 0.665 0.017
|
|
body
|
|
Increase your ejaculation!
|
EJACULATION
|
0.0
|
|
body
|
|
Talks about tracing by SSN
|
TRACE_BY_SSN
|
0.0
|
|
body
|
|
Claims auto-email removal
|
AUTO_EMAIL_REMOVAL
|
0.993 0.0 0.0 0.0
|
|
body
|
|
Once in a lifetime, apparently
|
ONCE_IN_LIFETIME
|
0.0 0.225 0.506 0.972
|
|
rawbody
|
|
Contains signature of unregistered spam tool
|
SAFEGUARD_NOTICE
|
2.900
|
|
body
|
|
More Internet Traffic
|
MORE_TRAFFIC
|
0.0
|
|
body
|
|
No Middleman
|
NO_MIDDLEMAN
|
0.0
|
|
body
|
|
Cell Phone Cancer Scam
|
PHONE_CANCER
|
0.0
|
|
body
|
|
People just leave money laying around
|
UNCLAIMED_MONEY
|
1.684 1.640 1.624 1.684
|
|
rawbody
|
|
Form for verifying email address
|
SPAM_FORM_INPUT
|
0.0
|
|
body
|
|
Well known spam senders
|
INTL_EXEC_GUILD
|
0.0
|
|
body
|
|
Claims to be in accordance with some Spam law
|
IN_ACCORDANCE_WITH_LAWS
|
0.0
|
|
body
|
|
Terms and conditions
|
CHANGE_TERMS
|
0.0
|
|
body
|
|
Don't delete me! Nooooo!!!!
|
DONT_DELETE
|
0.571 0.071 0.351 0.0
|
|
body
|
|
Claims you can be removed from the list
|
EXCUSE_8
|
0.0
|
|
body
|
|
Things incredible
|
INCREDIBLE
|
0.0
|
|
body
|
|
Claims not to be selling anything
|
NO_SELLING
|
0.0
|
|
body
|
|
Psychics Scam
|
PSYCHIC
|
0.0
|
|
body
|
|
Achieve Wealth
|
WEALTH
|
0.0
|
|
rawbody
|
|
Mentions monsterhut.com
|
MONSTERHUT
|
0.0
|
|
rawbody
|
|
Old Murkowski disclaimer
|
MURKOWSKI_CRUFT
|
0.0
|
|
body
|
|
Message talks about earning money
|
EARN_MONEY
|
0.950 1.018 0.379 0.949
|
|
body
|
|
Message seems to contain obscured email address (rot13)
|
OBSCURED_EMAIL
|
2.896 2.900 2.900 2.900
|
|
body
|
|
Mentions their affiliate partners
|
OUR_AFFILIATE_PARTNERS
|
2.900
|
|
body
|
|
Mentions their full compensation
|
OUR_COMPENSATION
|
0.0
|
|
body
|
|
Mentions their overwhelming growth
|
OUR_OVERWHELMING_GROWTH
|
2.900
|
|
body
|
|
Mentions their strict antipathy on something
|
OUR_STRICT_ANTI
|
2.900
|
|
body
|
|
Mentions their website and/or publications
|
OUR_PUBLICATIONS
|
0.0
|
|
body
|
|
Mentions where their privacy policy is
|
OUR_PRIVACY_POLICY
|
2.900 2.900 1.998 2.900
|
|
body
|
|
Talks about cell-phone signal improvement
|
CELL_PHONE_BOOST
|
1.927 2.099 1.927 0.619
|
|
body
|
|
Stop with the offers, coupons, discounts etc!
|
OFFERS_ETC
|
0.337 0.823 0.100 0.366
|
|
body
|
|
Talks about your boss with an exclamation!
|
BANG_BOSS
|
0.710 0.0 1.887 0.407
|
|
body
|
|
Talks about exercise with an exclamation!
|
BANG_EXERCISE
|
3.070 2.539 2.339 3.150
|
|
body
|
|
Talks about money with an exclamation!
|
BANG_MONEY
|
0.524 0.741 1.102 1.722
|
|
body
|
|
Talks about more with an exclamation!
|
BANG_MORE
|
0.816 0.674 0.122 0.0
|
|
body
|
|
Talks about Oprah with an exclamation!
|
BANG_OPRAH
|
4.300
|
|
body
|
|
Talks about quotes with an exclamation!
|
BANG_QUOTE
|
2.567 2.285 2.357 2.625
|
|
body
|
|
International driving license
|
INTL_DRIVERS_LICENSE
|
2.900 2.900 2.900 1.987
|
|
body
|
|
Talks about 'acting now' with capitals
|
ACT_NOW_CAPS
|
0.786 1.035 0.083 1.729
|
|
body
|
|
Talks about 'starting now' with capitals
|
START_NOW_CAPS
|
2.900 2.900 1.592 1.997
|
|
body
|
|
No Worries, Mate
|
WORRY_FREE
|
0.0
|
|
body
|
|
Talks about 'experts' showing you how
|
EXPERTS_SHOW_HOW
|
0.0
|
|
body
|
|
Talks about 'enhancing any website'
|
ENHANCE_WEBSITE
|
0.0
|
|
body
|
|
Talks about a bigger drive for sex
|
INCREASE_SEX
|
1.716 2.014 3.404 1.101
|
|
body
|
|
Something is emphatically guaranteed
|
BANG_GUARANTEE
|
0.674 0.501 0.501 0.0
|
|
body
|
|
Mailer is against spam -- aren't we all?
|
WE_HATE_SPAM2
|
0.962 2.847 2.786 1.354
|
|
body
|
|
Has generic 'up to X or more' noise
|
UP_TO_OR_MORES
|
0.335 2.799 0.837 1.640
|
|
body
|
|
Has 'add/lose/make/save up to X or more' noise
|
VERB_UP_TO_OR_MORES
|
0.0 1.178 0.0 2.273
|
|
body
|
|
Possible porn - Large Number of movies, pics
|
LARGE_COLLECTION
|
0.0 0.0 0.0 0.033
|
|
body
|
|
Possible porn - Free Porn
|
FREE_PORN
|
1.101 4.299 1.163 2.656
|
|
body
|
|
Possible porn - Barely Legal
|
BARELY_LEGAL
|
0.026 1.473 0.904 1.203
|
|
body
|
|
Possible porn - Mega Porn
|
MEGA_SITE
|
2.900
|
|
body
|
|
Possible porn - Cum Shot
|
CUM_SHOT
|
1.676 2.900 1.386 2.900
|
|
body
|
|
Possible porn - in ALL CAPS
|
ALL_CAP_PORN
|
0.398 0.0 0.775 0.260
|
|
body
|
|
Possible porn - Pay Site
|
PAY_SITE
|
2.796 2.534 2.653 2.213
|
|
body
|
|
Possible porn - Porn Fest
|
SEX_FEST
|
1.233 2.900 0.263 2.900
|
|
body
|
|
Possible porn - Live Porn
|
LIVE_PORN
|
1.560 2.799 2.796 2.796
|
|
body
|
|
Possible porn - Hardcore Porn
|
HARDCORE_PORN
|
2.900 2.799 2.796 2.796
|
|
body
|
|
Possible porn - Hot, Nasty, Wild, Young
|
HOT_NASTY
|
0.513 0.0 1.148 0.507
|
|
body
|
|
Possible porn - Best, Largest Porn Collections
|
BEST_PORN
|
0.0
|
|
body
|
|
Possible porn - Nasty Girls
|
NASTY_GIRLS
|
2.896 2.799 2.451 2.796
|
|
body
|
|
Possible porn - Amateur Porn
|
AMATEUR_PORN
|
1.547 2.799 1.679 1.305
|
|
body
|
|
Possible porn - Celebrity Porn
|
CELEBRITY_PORN
|
0.0 0.258 1.653 0.018
|
|
body
|
|
Possible porn - Adult Web Sites
|
ADULT_SITE
|
0.616 0.615 0.463 0.804
|
|
body
|
|
Possible porn - Must be 18
|
MUST_BE_18
|
1.705 2.032 1.483 1.705
|
|
body
|
|
Possible porn - Offers Instant Access
|
INSTANT_ACCESS
|
0.0 0.0 0.0 0.013
|
|
body
|
|
Possible porn - Rape
|
RAPE
|
1.469 2.314 1.322 0.822
|
|
body
|
|
Possible porn - Lesbian Site
|
LESBIAN
|
1.331 1.347 1.105 2.900
|
|
body
|
|
Possible porn - Porn Password
|
PORN_PASSWORD
|
2.900
|
|
body
|
|
Possible Porn - XXX Photos
|
PORN_6
|
2.772 2.786 2.900 2.511
|
|
body
|
|
Possible Porn - Porn membership
|
PORN_MEMBERSHIP
|
2.900
|
|
body
|
|
Possible porn - Galleries of Pictures
|
PORN_GALLERIES
|
0.0
|
|
body
|
|
Possible porn - various types of feline
|
PORN_15
|
2.900 2.900 2.409 2.900
|
|
body
|
|
Possible porn - nasty, dirty, little etc.
|
PORN_16
|
2.896 2.899 2.009 2.457
|
|
body
|
|
Thousands or millions of pics/movies/etc
|
LOTS_OF_STUFF
|
0.0 0.0 0.252 0.0
|
|
body
|
|
Attempts to disguise porn words
|
DISGUISE_PORN
|
1.727 1.663 1.727 2.464
|
|
header
|
|
Bulk email software fingerprint (eGroups) found in headers
|
RATWARE_EGROUPS
|
1.601 4.300 1.177 4.300
|
|
header
|
|
Bulk email software fingerprint (hash 2) found in headers
|
RATWARE_HASH_2
|
1.313 1.414 1.465 1.901
|
|
header
|
|
Bulk email software fingerprint (hash 2 v2) found in headers
|
RATWARE_HASH_2_V2
|
0.995 1.890 1.192 1.132
|
|
header
|
|
Bulk email software fingerprint (jpfree) found in headers
|
RATWARE_JPFREE
|
2.900
|
|
header
|
|
Bulk email software fingerprint (VC_IPA) found in headers
|
RATWARE_VC_IPA
|
2.900
|
|
header
|
|
Bulk email software fingerprint (Group Mail) found in headers
|
RATWARE_GROUPMAIL
|
2.900
|
|
header
|
|
Bulk email software fingerprint (GRMessageQueue) found in headers
|
RATWARE_GR
|
2.900 2.900 0.0 0.0
|
|
header
|
|
X-Mailer contains "OutLook Express 3.14159"
|
RATWARE_OE_PI
|
2.900
|
|
header
|
|
Bulk email software fingerprint (StormPost) found in headers
|
RATWARE_STORM
|
2.900
|
|
header
|
|
Bulk email software fingerprint (JiXing) found in headers
|
RATWARE_JIXING
|
2.900
|
|
header
|
|
Bulk email software fingerprint (screwup 1) found in headers
|
RATWARE_SCREWUP_1
|
2.900
|
|
header
|
|
Bulk email software fingerprint (MMailer) found in headers
|
RATWARE_MMAILER
|
2.900
|
|
header
|
|
X-Mailer contains malformed Outlook Express version
|
RATWARE_OE_MALFORMED
|
2.900
|
|
header
|
|
Bulk email software fingerprint (EVAMAIL) found in headers
|
RATWARE_EVAMAIL
|
2.900
|
|
header
|
|
Bulk email software fingerprint (screwup 2) found in headers
|
RATWARE_SCREWUP_2
|
0.0
|
|
header
|
|
Bulk email software fingerprint (IMktg) found in headers
|
RATWARE_IMKTG
|
2.900
|
|
header
|
|
Bulk email software fingerprint (xmailer tag) found in headers
|
RATWARE_XMAILER
|
2.900
|
|
header
|
|
Bulk email software fingerprint (PowerCampaign) found in headers
|
RATWARE_POWERC
|
2.900
|
|
header
|
|
Bulk email software fingerprint (DiffondiCool) found in headers
|
RATWARE_DIFFOND
|
0.0
|
|
header
|
|
Bulk email software fingerprint (charset) found in headers
|
RATWARE_CHARSET
|
0.0
|
|
header
|
|
Bulk email software fingerprint (charset 2) found in headers
|
RATWARE_CHARSET_V2
|
2.900 0.0 0.0 2.900
|
|
header
|
|
Bulk email software fingerprint (Caretop) found in headers
|
RATWARE_CARETOP
|
0.0
|
|
header
|
|
Bulk email software fingerprint ("outlook") found in headers
|
RATWARE_LC_OUTLOOK
|
0.0
|
|
header
|
|
Bulk email software fingerprint ("EMWAC SMTPRS") found in headers
|
RATWARE_EMWAC
|
2.896 2.017 2.283 1.587
|
|
header
|
|
Bulk email software fingerprint (bang-hash) found in headers
|
RATWARE_BANG_HASH
|
0.0
|
|
header
|
|
Bulk email software fingerprint (float) found in headers
|
RATWARE_FLOAT
|
2.900
|
|
header
|
|
Bulk email software fingerprint (Direct Email) found in headers
|
RATWARE_DIRECT_EMAIL
|
2.900 2.900 0.0 2.900
|
|
uri
|
|
Uses a numeric IP address in URL
|
NUMERIC_HTTP_ADDR
|
1.134 0.237 0.0 1.551
|
|
uri
|
|
Uses a dotted-decimal IP address in URL
|
NORMAL_HTTP_TO_IP
|
0.902 0.677 0.615 0.697
|
|
uri
|
|
Uses a username in a URL
|
HTTP_USERNAME_USED
|
0.664 0.743 1.156 0.661
|
|
uri
|
|
'remove' URL contains an email address
|
HTTP_WITH_EMAIL_IN_URL
|
0.461 0.254 0.564 0.0
|
|
uri
|
|
Uses %-escapes inside a URL's hostname
|
HTTP_ESCAPED_HOST
|
0.0 0.0 0.0 0.368
|
|
uri
|
|
Uses control sequences inside a URL's hostname
|
HTTP_CTRL_CHARS_HOST
|
0.700 2.900 1.561 2.900
|
|
uri
|
|
Completely unnecessary %-escapes inside a URL
|
HTTP_EXCESSIVE_ESCAPES
|
1.101 0.566 1.208 1.918
|
|
uri
|
|
URL uses words and phrases which indicate porn (4)
|
PORN_4
|
2.076 2.494 0.907 1.989
|
|
uri
|
|
Frequent SPAM content
|
WWW_CLIK4YOU_COM
|
0.0
|
|
uri
|
|
URL of CGI script called "unsubscribe" or "remove"
|
UNSUB_SCRIPT
|
0.087 0.192 0.0 0.0
|
|
uri
|
|
URL of page called "unsubscribe"
|
UNSUB_PAGE
|
0.159 0.0 0.181 0.0
|
|
uri
|
|
URL of page called "remove"
|
REMOVE_PAGE
|
0.313 0.265 0.675 0.401
|
|
uri
|
|
Includes a link to send a mail with a subject
|
MAILTO_WITH_SUBJ
|
0.347 0.018 0.0 0.575
|
|
uri
|
|
Includes a link to a likely spammer email address
|
MAILTO_TO_SPAM_ADDR
|
0.606 0.377 0.795 0.676
|
|
uri
|
|
Includes a 'remove' email address
|
MAILTO_TO_REMOVE
|
0.274 0.299 0.092 0.273
|
|
uri
|
|
Javascript protocol in a URI
|
JAVASCRIPT_URI
|
0.0 0.017 0.0 0.0
|
|
uri
|
|
Uses non-standard port number for HTTP
|
WEIRD_PORT
|
0.0 0.653 0.0 0.424
|
|
uri
|
|
URL contains username and (optional) password
|
USERPASS
|
1.487 1.458 1.788 1.297
|
|
uri
|
|
Frequent SPAM content
|
WWW_AUTOREMOVE_COM
|
0.0
|
|
uri
|
|
Filename is just a '\#'; probably a JS trick
|
URI_IS_POUND
|
1.258 1.385 0.132 1.090
|
|
uri
|
|
Frequent SPAM content
|
BTAMAIL_URL
|
1.399 1.675 2.283 1.593
|
|
uri
|
|
Frequent SPAM content
|
CHINA_URL
|
2.900
|
|
uri
|
|
Includes a link to a likely spammer email address (b2b-mail)
|
MAILTO_TO_B2BMAIL
|
2.900 2.900 0.0 0.0
|
|
uri
|
|
Spam URL pattern, DailyPromotions redirect link
|
DAILY_PL
|
1.101 1.622 2.900 1.221
|
|
uri
|
|
Spam URL pattern, DailyPromotions server link
|
DAILY_PXE
|
2.029 2.440 4.300 2.773
|
|
uri
|
|
Includes a link to a likely spammer domain (e-mailpromo.net)
|
E_MAILPROMO_URL
|
2.900
|
|
uri
|
|
Includes a link to a likely spammer domain
|
BARGAIN_URL
|
1.026 0.700 2.434 1.187
|
|
body
|
|
Bayesian classifier says spam probability is 0 to 1%
|
BAYES_00
|
0 0 -5.300 -5.200
|
|
body
|
|
Bayesian classifier says spam probability is 1 to 10%
|
BAYES_01
|
0 0 -5.400 -5.400
|
|
body
|
|
Bayesian classifier says spam probability is 10 to 20%
|
BAYES_10
|
0 0 -5.300 -4.701
|
|
body
|
|
Bayesian classifier says spam probability is 20 to 30%
|
BAYES_20
|
0 0 -4.701 -2.601
|
|
body
|
|
Bayesian classifier says spam probability is 30 to 40%
|
BAYES_30
|
0 0 -1.070 -0.927
|
|
body
|
|
Bayesian classifier says spam probability is 40 to 44%
|
BAYES_40
|
0.0
|
|
body
|
|
Bayesian classifier says spam probability is 44 to 50%
|
BAYES_44
|
0.0
|
|
body
|
|
Bayesian classifier says spam probability is 50 to 56%
|
BAYES_50
|
0.0
|
|
body
|
|
Bayesian classifier says spam probability is 56 to 60%
|
BAYES_56
|
0.0
|
|
body
|
|
Bayesian classifier says spam probability is 60 to 70%
|
BAYES_60
|
0 0 1.997 1.101
|
|
body
|
|
Bayesian classifier says spam probability is 70 to 80%
|
BAYES_70
|
0 0 2.593 2.310
|
|
body
|
|
Bayesian classifier says spam probability is 80 to 90%
|
BAYES_80
|
0 0 5.300 2.862
|
|
body
|
|
Bayesian classifier says spam probability is 90 to 99%
|
BAYES_90
|
0 0 4.027 3.002
|
|
body
|
|
Bayesian classifier says spam probability is 99 to 100%
|
BAYES_99
|
0 0 5.200 3.008
|
|
body
|
es
|
Claims you can be removed in Spanish
|
REMOVE_ES_01
|
1
|
|
body
|
es
|
Claims you can be removed in Spanish
|
REMOVE_ES_02
|
1
|
|
body
|
es
|
Claims you can be removed in Spanish
|
REMOVE_ES_03
|
1
|
|
body
|
es
|
Claims you can be removed in Spanish
|
REMOVE_ES_04
|
1
|
|
body
|
es
|
If you send an email you will be OptOut
|
REMOVE_ES_05
|
1
|
|
body
|
es
|
Claims you can opt-out
|
REMOVE_ES_06
|
1
|
|
body
|
es
|
Claims you can opt-out
|
REMOVE_ES_07
|
1
|
|
body
|
es
|
Claims you can opt-out
|
REMOVE_ES_08
|
1
|
|
body
|
es
|
If you want to subscribe...
|
SUBSCRIBE_ES_01
|
1
|
|
body
|
es
|
Claims not to be spam in Spanish
|
EXCUSE_ES_01
|
1
|
|
body
|
es
|
Someone fell free to send you a message in Spanish
|
EXCUSE_ES_02
|
1
|
|
body
|
es
|
Someone requested an spammer to spam you in Spanish
|
EXCUSE_ES_03
|
1
|
|
body
|
es
|
El correo como alternativa comercial
|
EXCUSE_ES_05
|
1
|
|
body
|
es
|
Mensaje enviado por error
|
EXCUSE_ES_06
|
1
|
|
body
|
es
|
No se puede considerar spam
|
EXCUSE_ES_07
|
1
|
|
body
|
es
|
Para dejar de fumar
|
DEJAR_DE_FUMAR_ES
|
1
|
|
body
|
es
|
NOS CHILLAN PARA DECIR QUE ES GRATIS
|
GRATIS_ES
|
1.4
|
|
body
|
es
|
Nos animan a contestar si estamos interesados
|
INTERESADO_ES
|
1
|
|
body
|
es
|
Dice cumplir con la ley
|
LEY_ORGANICA_ES
|
2.0
|
|
body
|
es
|
Clama cumplir con la normativa SPAM
|
NORMATIVA_SPAM_ES
|
2.0
|
|
body
|
es
|
No existe legislación en Chile contra el SPAM
|
LEY_CHILE_ES_01
|
1
|
|
body
|
es
|
Clama cumplir con la legislación chilena
|
LEY_CHILE_ES_02
|
1
|
|
body
|
es
|
Inmigración legal (?) a los Estados Unidos
|
TARJETA_VERDE_ES
|
1
|
|
body
|
es
|
Promocion especial.
|
PROMOCION_ES
|
1
|
|
body
|
es
|
Alta en buscadores hispanos.
|
ALTA_BUSCADORES_ES
|
1
|
|
body
|
es
|
IMPERATIVOS/EXCLAMACIONES EN MAYUSCULAS.
|
EXCLAMACION_ES
|
1
|
|
body
|
es
|
Presentación de un nuevo producto.
|
PRESENTAMOS_ES
|
1
|
|
body
|
es
|
Pago contra reembolso.
|
CONTRA_REEMBOLSO_ES
|
1
|
|
body
|
es
|
Para hacer su pedido.
|
PEDIDO_ES
|
1
|
|
body
|
es
|
Haga click aqui.
|
CLICK_ES
|
1
|
|
body
|
es
|
Los regalos no existen, salvo de nuestros amigos.
|
REGALO_ES
|
1
|
|
body
|
es
|
Pueden ser ganadores.
|
GANADORES_ES_01
|
1
|
|
body
|
es
|
Ha sido ganador.
|
GANADORES_ES_02
|
1
|
|
body
|
es
|
Porno gratis.
|
PORNO_GRATIS_ES
|
1
|
|
body
|
es
|
Mas informacion.
|
MAS_INFORMACION_ES
|
1
|
|
body
|
es
|
Informacion y reserva
|
INFORMACION_RESERVA_ES
|
1
|
|
body
|
es
|
Conviertete en Spammer.
|
REENVIA_ES
|
1
|
|
body
|
es
|
No nos envían más spam... seguro que no.
|
NO_MAS_MAIL_1_ES
|
1
|
|
body
|
es
|
No recibirá este spam otra vez... seguro que no.
|
NO_MAS_MAIL_2_ES
|
1
|
|
body
|
es
|
Las direcciones fueron obtenidas de internet.
|
COLECTOR_DE_MAILS_ES
|
1
|
|
body
|
pl
|
/ZAPRASZAMY/
|
PL_ZAPRASZAMY
|
1
|
|
body
|
pl
|
/ZACHECAM/i
|
PL_ZACHECAMY
|
1
|
|
body
|
pl
|
/do odwiedzenia/i
|
PL_DO_ODWIEDZENIA
|
1
|
|
body
|
pl
|
/serdecznie.{0,50}zapraszamy/i
|
PL_SERDECZ_ZAPRASZAMY
|
1
|
|
body
|
pl
|
/zam.wieni/i
|
PL_ZAMOWIENIE
|
1
|
|
body
|
pl
|
/bezp.atn/i
|
PL_BEZPLATNIE
|
1
|
|
body
|
pl
|
/wyprzeda/i
|
PL_WYPRZEDAZ
|
1
|
|
body
|
pl
|
/najtansz/i
|
PL_NAJTANSZE
|
1
|
|
body
|
pl
|
/promoc/i
|
PL_PROMOCJA
|
1
|
|
body
|
pl
|
/nasz.{0,20} stron/i
|
PL_NASZEJ_STRONIE
|
1
|
|
body
|
pl
|
/klikn.{0,20} tutaj/i
|
PL_KLIKNIJ_TUTAJ
|
1
|
|
body
|
pl
|
/odzysk.{0,30} d.ug/i
|
PL_ODZYSK_DLUGOW
|
1
|
|
body
|
pl
|
/atrakcyjn.{0,30}propozyc/i
|
PL_ATRAKCYJNA_PROPOZYCJA
|
1
|
|
body
|
pl
|
/nisk.{0,20} cen/i
|
PL_NISKIE_CENY
|
1
|
|
body
|
pl
|
/dobr.{0,20} cen/i
|
PL_DOBRE_CENY
|
1
|
|
body
|
pl
|
/atrakcyjn.{0,20} cen/i
|
PL_ATRAKCYJNE_CENY
|
1
|
|
body
|
pl
|
/najni.{0,50} cen/i
|
PL_NAJNIZ_CENY
|
1
|
|
body
|
pl
|
/cen.{0,50}tto/i
|
PL_CENY_TTO
|
1
|
|
body
|
pl
|
/cen.{0,50} wynosi/i
|
PL_CENA_WYNOSI
|
1
|
|
body
|
pl
|
/jeszcze .{0,50}dzi/i
|
PL_JESZCZE_DZIS
|
1
|
|
body
|
pl
|
/zapozn.{0,50} ofert/i
|
PL_ZAPOZNAJ_OFERTA
|
1
|
|
body
|
pl
|
/specjaln.{0,50}ofert/i
|
PL_SPEC_OFERTA
|
1
|
|
body
|
pl
|
/ now.{0,50} ofert/i
|
PL_NOWYCH_OFERTA
|
1
|
|
body
|
pl
|
/przesy.{0,50}ofert/i
|
PL_PRZES_OFERTE
|
1
|
|
body
|
pl
|
/szer.{0,50} ofert/i
|
PL_NAJSZERSZA_OFERTA
|
1
|
|
body
|
pl
|
/ofert.{0,50} cen/i
|
PL_OFERTA_CENOWA
|
1
|
|
body
|
pl
|
/ofert.{0,50} promoc/i
|
PL_OFERTA_PROMOCYJNA
|
1
|
|
body
|
pl
|
/ofer.{0,50} pa.stwu/i
|
PL_OFERUJEMY_PANSTWU
|
1
|
|
body
|
pl
|
/posiadam.{0,50} ofer/i
|
PL_POSIADAMY_W_OFERCIE
|
1
|
|
body
|
pl
|
/GDZIE.{0,50}KUPI/i
|
PL_GDZIEKUPIC
|
1
|
|
body
|
pl
|
/nasz.{0,50} ofert/i
|
PL_NASZ_OFERT
|
1
|
|
body
|
pl
|
/nasz.{0,50} firm/i
|
PL_NASZ_FIRMA
|
1
|
|
body
|
pl
|
/maill?ing/i
|
PL_MAILING
|
1
|
|
body
|
pl
|
/www\.adresy\.org/i
|
PL_WWW_ADRESY_ORG
|
1
|
|
body
|
pl
|
/zainteresowan.{0,50}wsp..prac/
|
PL_WSPOLPRACA
|
1
|
|
body
|
pl
|
/chci{0,50} zach.ci./i
|
PL_CHCIELIBYSMY
|
1
|
|
body
|
pl
|
/nie zwlekaj/i
|
PL_NIE_ZWLEKAJ
|
1
|
|
body
|
pl
|
Tresc zawiera 'Za zaliczeniem pocztowym...'
|
PL_ZALICZENIE_POCZT
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'Upowaznienie do wystawiania faktur VAT...'
|
PL_UPOWAZNIENIE_VAT
|
1.5
|
|
body
|
pl
|
Tresc zawiera 'Je¿eli nie chcesz (otrzymywac)...'
|
PL_JESLI_NIE_CHCESZ
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Je¿eli nie interesuj±...'
|
PL_JEZELI_NIE_INTERES
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Je¿eli (Pañstwo) nie ¿yczycie(sz) sobie'
|
PL_JEZELI_NIE
|
2.5
|
|
body
|
pl
|
Tresc zawiera 'Zamów teraz!!!'
|
PL_ZAMOW_TERAZ
|
2.5
|
|
body
|
pl
|
Tresc zawiera 'do nabycia u nas'
|
PL_NABYCIA_UNAS
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Wiadomo¶æ nadano jednorazowo...'
|
PL_NADANO_JEDNORAZOWO
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Wiadomo¶æ nadano na podstawie...'
|
PL_NADANO_NA_PODSTAWIE
|
2.0
|
|
body
|
pl
|
Tre¶æ zawiera 'Szanowni Pañstwo'
|
PL_SZANOWNI_PANSTWO
|
1.0
|
|
body
|
pl
|
Tre¶æ zawiera 'Zaprosiæ pañstwa'
|
PL_ZAPROSICI_PANSTWO
|
1.5
|
|
body
|
pl
|
Tre¶æ zawiera 'odes³anie z dopiskiem NIE'
|
PL_DOPISKIEM_NIE
|
2.5
|
|
body
|
pl
|
Tre¶æ zawiera 'Artykul 25 ust 2 punkt 2'
|
PL_ARTYKUL_USTAWY
|
2.5
|
|
body
|
pl
|
Tre¶æ zawiera 'Ustawy o ochronie danych osobowych'
|
PL_DANE_OSOBOWE
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'na podstawie adresow e-mail publicznie...'
|
PL_ADRESOW_PUBLICZ
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'publicznie dostêpny (email)'
|
PL_PUBL_DOSTEPNY
|
1.5
|
|
body
|
pl
|
Tre¶æ zawiera 'adres e-mail zostal znaleziony/pozyskany'
|
PL_ADRES_EMAIL
|
2.0
|
|
body
|
pl
|
Tre¶æ zawiera 'adres (e-mail) pochodzi z ogólnodostêpnych....'
|
PL_ADRES_EMAIL_3
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'przepraszamy za zajêty czas'
|
PL_ZAJETY_CZAS
|
2.5
|
|
body
|
pl
|
Tresc zawiera 'Niezainteresowanych przepraszamy..'
|
PL_NIEZAINTERESOWANYCH
|
2.5
|
|
body
|
pl
|
Tre¶æ jest od wydawnictwa Verlag Dashofer (spamerzy)
|
PL_DASHOFER
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'Prosimy o przes³anie pustego maila'
|
PL_PUSTY_MAIL
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Wys³aæ pusty mail'
|
PL_PUSTY_MAIL_2
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Aby usun±æ adres e-mail...'
|
PL_USUNAC_MAIL
|
2.5
|
|
body
|
pl
|
Tresc zawiera '...adres z bazy...'
|
PL_ADRES_Z_BAZY
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'USUN Z BAZY'
|
PL_USUN_Z_BAZY
|
2.0
|
|
body
|
pl
|
Tresc zawiera '...mail z tematem...'
|
PL_MAIL_Z_TEMATEM
|
1.5
|
|
body
|
pl
|
Tresc zawiera '...prosimy o zwrotny e-mail...'
|
PL_PROSBA_O_ZWROTNY
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'temat USUN'
|
PL_TEMAT_USUN
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'kliknij w poni¿szy link'
|
PL_KLIKNIJ_W_LINK
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'Zapraszamy do udzialu'
|
PL_ZAPRASZAMY_UDZIAL
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'Jezeli wiadomosc doszla wiecej..'
|
PL_JESLI_WIADOMOSC
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'Zg³oszenie powinno...'
|
PL_ZGLOSZENIE_POWINNO
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'SZCZEGOLOWE_INFORMACJE..'
|
PL_SZCZEGOLOWE_INFO
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'Mamy przyjemnosc..'
|
PL_MAMY_PRZYJEMNOSC
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'Prosimy o skladanie na...'
|
PL_PROSIMY_O_SKLADANIE
|
1.0
|
|
body
|
pl
|
Tresc zawiera 'reklama (bez)platna'
|
PL_REKLAMA
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'wystarczy wejsc na strone'
|
PL_WYSTARCZY_WEJSC
|
2.0
|
|
body
|
pl
|
Tresc zawiera 'czas obowiazywania promocji jest ograniczony'
|
PL_CZAS_OBOWIAZYWANIA
|
2.5
|
|
body
|
pl
|
Tresc zawiera 'oferta'
|
PL_OFERTA
|
0.4
|
|
body
|
pl
|
Tresc zawiera 'Otrzymasz bezplatnie..'
|
PL_OTRZYMASZ_BEZPLATN
|
1.6
|
|
body
|
pl
|
Tresc zawiera 'swoich znajomych i przyjaciol'
|
PL_SWOICH_ZNAJOMYCH
|
0.4
|
|
body
|
pl
|
Tresc zawiera 'dodatkowo dosta(j| ni)esz'
|
PL_DODATKOWO
|
0.6
|
|
body
|
pl
|
Tresc zawiera 'witaj internauto'
|
PL_WITAJ_INTERNAUTO
|
0.4
|
|
header
|
es
|
Publicidad por e-mail
|
OFERTA_ES
|
1
|
|
header
|
es
|
Contiene la palabra gratis en las cabeceras
|
GRATIS_T_ES
|
1
|
|
header
|
pl
|
Temat zawiera 'oferta'
|
PL_TEMAT_OFERTA
|
1.5
|
