proxmox-mirrors/proxmox-spamassassin
1
0
Fork 0
mirror of https://git.proxmox.com/git/proxmox-spamassassin synced 2025-08-16 07:45:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

update SpamAssassin signatures

Browse Source 
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
This commit is contained in:
Stoiko Ivanov 2021-07-13 13:00:51 +02:00
parent 7685404c46
commit 46cfc9e266
12 changed files with 777 additions and 602 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sa-updates/20_aux_tlds.cf
View File

@ -740,6 +740,7 @@ util_rb_3tld blogspot.com.es
util_rb_3tld no-ip.co.uk
#
util_rb_3tld mobile.web.tr
util_rb_3tld ct.sendgrid.net
endif

30
sa-updates/20_dnsbl_tests.cf
View File

@ -207,45 +207,27 @@ reuse RCVD_IN_IADB_VOUCHED
# https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6247
# Certified:
# https://www.validity.com/resource-center/fact-sheet-certification/
# (replaces RCVD_IN_BSP_TRUSTED, RCVD_IN_BSP_OTHER, RCVD_IN_SSC_TRUSTED_COI)
# (replaces RCVD_IN_BSP_TRUSTED, RCVD_IN_BSP_OTHER, RCVD_IN_SSC_TRUSTED_COI, RCVD_IN_RP_CERTIFIED)
header RCVD_IN_VALIDITY_CERTIFIED eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.')
describe RCVD_IN_VALIDITY_CERTIFIED Sender in Validity Certification - Contact certification@validity.com
tflags RCVD_IN_VALIDITY_CERTIFIED net nice publish
reuse RCVD_IN_VALIDITY_CERTIFIED
reuse RCVD_IN_VALIDITY_CERTIFIED RCVD_IN_RP_CERTIFIED
# Safe:
# https://www.validity.com/resource-center/fact-sheet-certification/
# (replaces HABEAS_ACCREDITED_COI, HABEAS_ACCREDITED_SOI, HABEAS_CHECKED)
# (replaces HABEAS_ACCREDITED_COI, HABEAS_ACCREDITED_SOI, HABEAS_CHECKED, RCVD_IN_RP_SAFE)
header RCVD_IN_VALIDITY_SAFE eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.')
describe RCVD_IN_VALIDITY_SAFE Sender in Validity Safe - Contact certification@validity.com
tflags RCVD_IN_VALIDITY_SAFE net nice publish
reuse RCVD_IN_VALIDITY_SAFE
reuse RCVD_IN_VALIDITY_SAFE RCVD_IN_RP_SAFE
# Validity RPBL (née Return Path Reputation Network Blacklist - RNBL):
# https://www.senderscore.org/blocklistlookup/
# (replaces RCVD_IN_RP_RNBL)
header RCVD_IN_VALIDITY_RPBL eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.')
describe RCVD_IN_VALIDITY_RPBL Relay in Validity RPBL, https://senderscore.org/blocklistlookup/
tflags RCVD_IN_VALIDITY_RPBL net publish
reuse RCVD_IN_VALIDITY_RPBL
# temporary
meta RCVD_IN_RP_CERTIFIED RCVD_IN_VALIDITY_CERTIFIED
describe RCVD_IN_RP_CERTIFIED RCVD_IN_RP_CERTIFIED renamed to RCVD_IN_VALIDITY_CERTIFIED, please update local rules
score RCVD_IN_RP_CERTIFIED -0.001
tflags RCVD_IN_RP_CERTIFIED net nice publish
reuse RCVD_IN_RP_CERTIFIED
meta RCVD_IN_RP_SAFE RCVD_IN_VALIDITY_SAFE
describe RCVD_IN_RP_SAFE RCVD_IN_RP_SAFE renamed to RCVD_IN_VALIDITY_SAFE, please update local rules
score RCVD_IN_RP_SAFE -0.001
tflags RCVD_IN_RP_SAFE net nice publish
reuse RCVD_IN_RP_SAFE
meta RCVD_IN_RP_RNBL RCVD_IN_VALIDITY_RPBL
describe RCVD_IN_RP_RNBL RCVD_IN_RP_RNBL renamed to RCVD_IN_VALIDITY_RPBL, please update local rules
score RCVD_IN_RP_RNBL 0.001
tflags RCVD_IN_RP_RNBL net publish
reuse RCVD_IN_RP_RNBL
reuse RCVD_IN_VALIDITY_RPBL RCVD_IN_RP_RNBL
endif

2
sa-updates/20_freemail_domains.cf
View File

@ -354,7 +354,7 @@ freemail_domains trevas.net tripod-mail.com triton.net trmailbox.com tsamail.co.
freemail_domains turbonett.com turkey.com tvnet.lv twc.com typemail.com u2club.com uae.ac
freemail_domains ubbi.com ubbi.com.br uboot.com ugeek.com uk2.net uk2net.com ukr.net
freemail_domains ukrpost.net ukrpost.ua uku.co.uk ulimit.com ummah.org unbounded.com
freemail_domains unican.es unicum.de unimail.mn unitedemailsystems.com universal.pt
freemail_domains unicum.de unimail.mn unitedemailsystems.com universal.pt
freemail_domains universia.cl universia.edu.ve universia.es universia.net.co universia.net.mx
freemail_domains universia.pr universia.pt universiabrasil.net unofree.it uol.com.ar
freemail_domains uol.com.br uole.com uolmail.com uomail.com uraniomail.com urbi.com.br

19
sa-updates/20_head_tests.cf
View File

@ -418,7 +418,7 @@ describe BAD_ENC_HEADER Message has bad MIME encoding in the header
header __ML1 Precedence =~ m{\b(list|bulk)\b}i
header __ML2 exists:List-Id
meta __ML2 __HAS_LIST_ID
header __ML3 exists:List-Post
header __ML4 exists:Mailing-List
header __ML5 Return-Path:addr =~ m{^([^\@]+-(request|bounces|admin|owner)|owner-[^\@]+)(\@|\z)}i
@ -454,15 +454,24 @@ tflags CHARSET_FARAWAY_HEADER userconf
# might want to exempt users using languages that don't use Latin
# alphabets, but do it in the eval
# Will FP without 4.0 and UTF-8 support
if (version >= 4.000000)
header __SUBJ_ILLEGAL_CHARS eval:check_illegal_chars('Subject','0.00','2')
meta SUBJ_ILLEGAL_CHARS (__SUBJ_ILLEGAL_CHARS && !__FROM_YAHOO_COM)
describe SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters
header FROM_ILLEGAL_CHARS eval:check_illegal_chars('From','0.20','2')
describe FROM_ILLEGAL_CHARS From: has too many raw illegal characters
header __HEAD_ILLEGAL_CHARS eval:check_illegal_chars('ALL','0.010','2')
meta HEAD_ILLEGAL_CHARS __HEAD_ILLEGAL_CHARS && !__SUBJ_ILLEGAL_CHARS && !FROM_ILLEGAL_CHARS
endif
if (version < 4.000000)
meta __SUBJ_ILLEGAL_CHARS 0
meta SUBJ_ILLEGAL_CHARS 0
meta FROM_ILLEGAL_CHARS 0
meta __HEAD_ILLEGAL_CHARS 0
meta HEAD_ILLEGAL_CHARS 0
endif
describe SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters
describe FROM_ILLEGAL_CHARS From: has too many raw illegal characters
describe HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters
###################################################################

3
sa-updates/20_ratware.cf
View File

@ -114,8 +114,7 @@ header __HAS_X_LOOP exists:X-Loop
header __HAS_X_MAILING_LIST exists:X-Mailing-List
header __HAS_X_MAILMAN_VERSION exists:X-Mailman-Version
describe MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager
# __ML2 and __HAS_LIST_ID are exactly equivalent, don't double-count
meta MAILING_LIST_MULTI __HAS_X_LOOP + __HAS_X_MAILING_LIST + __HAS_X_MAILMAN_VERSION + __HAS_LIST_ID + __HAS_X_BEEN_THERE +__DOS_HAS_LIST_UNSUB + __ML1 + __ML3 + __ML4 + __ML5 > 2
meta MAILING_LIST_MULTI __HAS_X_LOOP + __HAS_X_MAILING_LIST + __HAS_X_MAILMAN_VERSION + __HAS_X_BEEN_THERE +__DOS_HAS_LIST_UNSUB + __ML1 + __ML2 + __ML3 + __ML4 + __ML5 > 2
tflags MAILING_LIST_MULTI nice
# QUALCOMM Eudora

40
sa-updates/25_uribl.cf
View File

@ -88,55 +88,55 @@ if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_tflags_domains_only)
urirhssub URIBL_DBL_SPAM dbl.spamhaus.org. A 127.0.1.2
body URIBL_DBL_SPAM eval:check_uridnsbl('URIBL_DBL_SPAM')
describe URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_SPAM net domains_only
tflags URIBL_DBL_SPAM net domains_only notrim
reuse URIBL_DBL_SPAM
urirhssub URIBL_DBL_PHISH dbl.spamhaus.org. A 127.0.1.4
body URIBL_DBL_PHISH eval:check_uridnsbl('URIBL_DBL_PHISH')
describe URIBL_DBL_PHISH Contains a Phishing URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_PHISH net domains_only
tflags URIBL_DBL_PHISH net domains_only notrim
reuse URIBL_DBL_PHISH
urirhssub URIBL_DBL_MALWARE dbl.spamhaus.org. A 127.0.1.5
body URIBL_DBL_MALWARE eval:check_uridnsbl('URIBL_DBL_MALWARE')
describe URIBL_DBL_MALWARE Contains a malware URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_MALWARE net domains_only
tflags URIBL_DBL_MALWARE net domains_only notrim
reuse URIBL_DBL_MALWARE
urirhssub URIBL_DBL_BOTNETCC dbl.spamhaus.org. A 127.0.1.6
body URIBL_DBL_BOTNETCC eval:check_uridnsbl('URIBL_DBL_BOTNETCC')
describe URIBL_DBL_BOTNETCC Contains a botned C&C URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_BOTNETCC net domains_only
tflags URIBL_DBL_BOTNETCC net domains_only notrim
reuse URIBL_DBL_BOTNETCC
urirhssub URIBL_DBL_ABUSE_SPAM dbl.spamhaus.org. A 127.0.1.102
body URIBL_DBL_ABUSE_SPAM eval:check_uridnsbl('URIBL_DBL_ABUSE_SPAM')
describe URIBL_DBL_ABUSE_SPAM Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_ABUSE_SPAM net domains_only
tflags URIBL_DBL_ABUSE_SPAM net domains_only notrim
reuse URIBL_DBL_ABUSE_SPAM
urirhssub URIBL_DBL_ABUSE_REDIR dbl.spamhaus.org. A 127.0.1.103
body URIBL_DBL_ABUSE_REDIR eval:check_uridnsbl('URIBL_DBL_ABUSE_REDIR')
describe URIBL_DBL_ABUSE_REDIR Contains an abused redirector URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_ABUSE_REDIR net domains_only
tflags URIBL_DBL_ABUSE_REDIR net domains_only notrim
reuse URIBL_DBL_ABUSE_REDIR
urirhssub URIBL_DBL_ABUSE_PHISH dbl.spamhaus.org. A 127.0.1.104
body URIBL_DBL_ABUSE_PHISH eval:check_uridnsbl('URIBL_DBL_ABUSE_PHISH')
describe URIBL_DBL_ABUSE_PHISH Contains an abused phishing URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_ABUSE_PHISH net domains_only
tflags URIBL_DBL_ABUSE_PHISH net domains_only notrim
reuse URIBL_DBL_ABUSE_PHISH
urirhssub URIBL_DBL_ABUSE_MALW dbl.spamhaus.org. A 127.0.1.105
body URIBL_DBL_ABUSE_MALW eval:check_uridnsbl('URIBL_DBL_ABUSE_MALW')
describe URIBL_DBL_ABUSE_MALW Contains an abused malware URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_ABUSE_MALW net domains_only
tflags URIBL_DBL_ABUSE_MALW net domains_only notrim
reuse URIBL_DBL_ABUSE_MALW
urirhssub URIBL_DBL_ABUSE_BOTCC dbl.spamhaus.org. A 127.0.1.106
body URIBL_DBL_ABUSE_BOTCC eval:check_uridnsbl('URIBL_DBL_ABUSE_BOTCC')
describe URIBL_DBL_ABUSE_BOTCC Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist
tflags URIBL_DBL_ABUSE_BOTCC net domains_only
tflags URIBL_DBL_ABUSE_BOTCC net domains_only notrim
reuse URIBL_DBL_ABUSE_BOTCC
@ -145,21 +145,21 @@ reuse URIBL_DBL_ABUSE_BOTCC
urirhssub URIBL_DBL_ERROR dbl.spamhaus.org. A 127.0.1.255
body URIBL_DBL_ERROR eval:check_uridnsbl('URIBL_DBL_ERROR')
describe URIBL_DBL_ERROR Error: queried the Spamhaus DBL blocklist for an IP
tflags URIBL_DBL_ERROR net domains_only
tflags URIBL_DBL_ERROR net domains_only notrim
reuse URIBL_DBL_ERROR
# New blocked checks 10/2019
urirhssub URIBL_DBL_BLOCKED_OPENDNS dbl.spamhaus.org. A 127.255.255.254
body URIBL_DBL_BLOCKED_OPENDNS eval:check_uridnsbl('URIBL_DBL_BLOCKED_OPENDNS')
describe URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/
tflags URIBL_DBL_BLOCKED_OPENDNS net domains_only
tflags URIBL_DBL_BLOCKED_OPENDNS net domains_only notrim
reuse URIBL_DBL_BLOCKED_OPENDNS
# New blocked checks 10/2019
urirhssub URIBL_DBL_BLOCKED dbl.spamhaus.org. A 127.255.255.255
body URIBL_DBL_BLOCKED eval:check_uridnsbl('URIBL_DBL_BLOCKED')
describe URIBL_DBL_BLOCKED ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/
tflags URIBL_DBL_BLOCKED net domains_only
tflags URIBL_DBL_BLOCKED net domains_only notrim
reuse URIBL_DBL_BLOCKED
endif
@ -171,52 +171,52 @@ endif
#urirhssub URIBL_SC_SURBL multi.surbl.org. A 2
#body URIBL_SC_SURBL eval:check_uridnsbl('URIBL_SC_SURBL')
#describe URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
#tflags URIBL_SC_SURBL net
#tflags URIBL_SC_SURBL net notrim
#reuse URIBL_SC_SURBL
urirhssub URIBL_WS_SURBL multi.surbl.org. A 4
body URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL')
describe URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
tflags URIBL_WS_SURBL net
tflags URIBL_WS_SURBL net notrim
reuse URIBL_WS_SURBL
urirhssub URIBL_PH_SURBL multi.surbl.org. A 8
body URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL')
describe URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist
tflags URIBL_PH_SURBL net
tflags URIBL_PH_SURBL net notrim
reuse URIBL_PH_SURBL
urirhssub URIBL_MW_SURBL multi.surbl.org. A 16
body URIBL_MW_SURBL eval:check_uridnsbl('URIBL_MW_SURBL')
describe URIBL_MW_SURBL Contains a URL listed in the MW SURBL blocklist
tflags URIBL_MW_SURBL net
tflags URIBL_MW_SURBL net notrim
reuse URIBL_MW_SURBL
urirhssub URIBL_CR_SURBL multi.surbl.org. A 128
body URIBL_CR_SURBL eval:check_uridnsbl('URIBL_CR_SURBL')
describe URIBL_CR_SURBL Contains an URL listed in the CR SURBL blocklist
tflags URIBL_CR_SURBL net
tflags URIBL_CR_SURBL net notrim
reuse URIBL_CR_SURBL
#MERGED INTO BIT 64 per bug 7279
#urirhssub URIBL_AB_SURBL multi.surbl.org. A 32
#body URIBL_AB_SURBL eval:check_uridnsbl('URIBL_AB_SURBL')
#describe URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
#tflags URIBL_AB_SURBL net
#tflags URIBL_AB_SURBL net notrim
#reuse URIBL_AB_SURBL
#JP MOVED INTO ABUSE AS WELL AND BIT REUSED per bug 7279
urirhssub URIBL_ABUSE_SURBL multi.surbl.org. A 64
body URIBL_ABUSE_SURBL eval:check_uridnsbl('URIBL_ABUSE_SURBL')
describe URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
tflags URIBL_ABUSE_SURBL net
tflags URIBL_ABUSE_SURBL net notrim
reuse URIBL_ABUSE_SURBL
#SURBL BLOCK RULES - Bit 1 means your DNS has been blocked and this rule should be triggered to notify you.
urirhssub SURBL_BLOCKED multi.surbl.org. A 1
body SURBL_BLOCKED eval:check_uridnsbl('SURBL_BLOCKED')
describe SURBL_BLOCKED ADMINISTRATOR NOTICE: The query to SURBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.
tflags SURBL_BLOCKED net noautolearn
tflags SURBL_BLOCKED net noautolearn notrim
reuse SURBL_BLOCKED
if can(Mail::SpamAssassin::Conf::feature_dns_block_rule)

11
sa-updates/50_scores.cf
View File

@ -46,7 +46,6 @@ score BANKING_LAWS 2.399 2.004 2.157 1.099 # n=2
score BILLION_DOLLARS 0.001 1.451 1.229 1.638
score BODY_ENHANCEMENT 0.927 1.611 0.974 0.001
score BODY_ENHANCEMENT2 0.1
score BUG6152_INVALID_DATE_TZ_ABSURD 0.1
score CONFIRMED_FORGED 0 # n=0 n=1 n=2 n=3
score CORRUPT_FROM_LINE_IN_HDRS 0 # n=0 n=1 n=2 n=3
score CTYPE_001C_A 0 # n=0 n=1 n=2 n=3
@ -178,7 +177,7 @@ score HIDE_WIN_STATUS 0.001
score HIGH_CODEPAGE_URI 0 # n=0 n=1 n=2
# score HK_LOTTO 3.599 2.755 2.993 3.599 # Allow GA manage score
score HK_NAME_DRUGS 4.299 0.001 3.077 0.552
score HK_RANDOM_ENVFROM 2.638 0.626 1.798 0.001
# score HK_RANDOM_ENVFROM 2.638 0.626 1.798 0.001 # Allow GA manage score
score HTML_MIME_NO_HTML_TAG 0.001 0.635 0.001 0.377
score HTML_MISSING_CTYPE 0 # n=0 n=1 n=2 n=3
score HTML_SHORT_CENTER 3.799 3.421 2.611 0.743
@ -266,9 +265,13 @@ score RATWARE_EGROUPS 1.898 1.258 1.406 1.621
score RATWARE_HASH_DASH 0 # n=0 n=1 n=2 n=3
score RATWARE_MOZ_MALFORMED 0 # n=0 n=1 n=2 n=3
score RATWARE_MPOP_WEBMAIL 1.153 1.338 1.229 1.999 # n=0
score RATWARE_MS_HASH 2.036 3.692 0.454 2.148
# jhardin 05/2021
# masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval
#score RATWARE_MS_HASH 2.036 3.692 0.454 2.148
score RATWARE_OE_MALFORMED 0 # n=0 n=1 n=2 n=3
score RATWARE_OUTLOOK_NONAME 2.964 0.033 2.685 2.950
# jhardin 05/2021
# masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval
#score RATWARE_OUTLOOK_NONAME 2.964 0.033 2.685 2.950
score RATWARE_RCVD_AT 0 # n=0 n=1 n=2 n=3
score RATWARE_RCVD_PF 0 # n=0 n=1 n=2 n=3
score RATWARE_ZERO_TZ 2.392 2.535 0.265 1.781 # n=0

2
sa-updates/60_bayes_stopwords.cf
View File

@ -16,6 +16,7 @@
# </@LICENSE>
if (version >= 4.000000)
ifplugin Mail::SpamAssassin::Plugin::Bayes
if can(Mail::SpamAssassin::Conf::feature_bayes_stopwords)
# Danish
bayes_stopword_dk (?^:(?:a(?:lle|nden)|bl(?:ev|iver?)|d(?:e(?:nne|res|tte)|isse)|e(?:fter|ller)|h(?:a(?:ns|v(?:de|e))|endes?|v(?:ad|is|or))|ikke|kunne|m(?:ange|eget|ine)|nog(?:et|le)|o(?:gs\xc3\xa5|ver)|s(?:elv|ine|k(?:al|ulle)|\xc3\xa5dan)|under|v(?:ille|\xc3\xa6ret?)))
@ -65,3 +66,4 @@ if (version >= 4.000000)
endif
endif
endif

661
sa-updates/72_active.cf
View File

File diff suppressed because one or more lines are too long

535
sa-updates/72_scores.cf
View File

@ -1,8 +1,8 @@
score ACCT_PHISHING_MANY 2.999 2.999 2.999 2.999
score ACCT_PHISHING_MANY 2.996 2.996 2.996 2.996
score AC_BR_BONANZA 0.001 0.001 0.001 0.001
score AC_DIV_BONANZA 0.001 0.001 0.001 0.001
score AC_FROM_MANY_DOTS 2.999 2.999 2.999 2.999
score AC_HTML_NONSENSE_TAGS 1.999 1.999 1.999 1.999
score AC_FROM_MANY_DOTS 2.996 1.998 2.996 1.998
score AC_HTML_NONSENSE_TAGS 1.898 1.522 1.898 1.522
score AC_POST_EXTRAS 1.000 1.000 1.000 1.000
score AC_SPAMMY_URI_PATTERNS1 1.000 1.000 1.000 1.000
score AC_SPAMMY_URI_PATTERNS10 1.000 1.000 1.000 1.000
@ -13,216 +13,217 @@ score AC_SPAMMY_URI_PATTERNS3 1.000 1.000 1.000 1.000
score AC_SPAMMY_URI_PATTERNS4 1.000 1.000 1.000 1.000
score AC_SPAMMY_URI_PATTERNS8 1.000 1.000 1.000 1.000
score AC_SPAMMY_URI_PATTERNS9 1.000 1.000 1.000 1.000
score ADMITS_SPAM 4.199 4.199 4.199 4.199
score ADVANCE_FEE_2_NEW_FORM 1.000 1.000 1.000 1.000
score ADVANCE_FEE_2_NEW_FRM_MNY 2.499 1.781 2.499 1.781
score ADVANCE_FEE_2_NEW_MONEY 1.999 1.999 1.999 1.999
score ADVANCE_FEE_3_NEW 3.499 3.499 3.499 3.499
score ADVANCE_FEE_3_NEW_FRM_MNY 0.001 1.946 0.001 1.946
score ADVANCE_FEE_3_NEW_MONEY 2.491 2.588 2.491 2.588
score ADVANCE_FEE_4_NEW 2.599 2.137 2.599 2.137
score ADMITS_SPAM 3.595 3.396 3.595 3.396
score ADULT_DATING_COMPANY 10.001 10.001 10.001 10.001
score ADVANCE_FEE_2_NEW_FORM 1.985 0.598 1.985 0.598
score ADVANCE_FEE_2_NEW_FRM_MNY 2.497 2.499 2.497 2.499
score ADVANCE_FEE_2_NEW_MONEY 1.997 1.997 1.997 1.997
score ADVANCE_FEE_3_NEW 3.497 2.077 3.497 2.077
score ADVANCE_FEE_3_NEW_FRM_MNY 0.001 0.001 0.001 0.001
score ADVANCE_FEE_3_NEW_MONEY 2.897 2.696 2.897 2.696
score ADVANCE_FEE_4_NEW 2.497 2.297 2.497 2.297
score ADVANCE_FEE_4_NEW_FRM_MNY 0.001 0.001 0.001 0.001
score ADVANCE_FEE_4_NEW_MONEY 1.575 0.001 1.575 0.001
score ADVANCE_FEE_5_NEW 2.600 2.399 2.600 2.399
score ADVANCE_FEE_5_NEW_FRM_MNY 1.997 2.699 1.997 2.699
score ADVANCE_FEE_4_NEW_MONEY 2.481 0.792 2.481 0.792
score ADVANCE_FEE_5_NEW 2.596 0.762 2.596 0.762
score ADVANCE_FEE_5_NEW_FRM_MNY 0.001 0.001 0.001 0.001
score ADVANCE_FEE_5_NEW_MONEY 0.001 0.001 0.001 0.001
score AD_PREFS 0.250 0.250 0.250 0.250
score ALIBABA_IMG_NOT_RCVD_ALI 2.499 1.426 2.499 1.426
score AMAZON_IMG_NOT_RCVD_AMZN 2.499 2.499 2.499 2.499
score AD_PREFS 0.289 0.466 0.289 0.466
score ALIBABA_IMG_NOT_RCVD_ALI 1.989 2.499 1.989 2.499
score AMAZON_IMG_NOT_RCVD_AMZN 2.497 0.001 2.497 0.001
score APP_DEVELOPMENT_FREEM 1.000 1.000 1.000 1.000
score APP_DEVELOPMENT_NORDNS 1.222 1.999 1.222 1.999
score APP_DEVELOPMENT_NORDNS 1.997 1.157 1.997 1.157
score AXB_XMAILER_MIMEOLE_OL_024C2 0.001 0.001 0.001 0.001
score AXB_XMAILER_MIMEOLE_OL_1ECD5 2.345 0.934 2.345 0.934
score BIGNUM_EMAILS_FREEM 2.999 1.497 2.999 1.497
score BIGNUM_EMAILS_MANY 1.000 1.000 1.000 1.000
score BIGNUM_EMAILS_FREEM 2.996 1.882 2.996 1.882
score BIGNUM_EMAILS_MANY 2.997 2.996 2.997 2.996
score BITCOIN_BOMB 1.000 1.000 1.000 1.000
score BITCOIN_DEADLINE 1.720 2.999 1.720 2.999
score BITCOIN_EXTORT_01 1.691 0.001 1.691 0.001
score BITCOIN_DEADLINE 1.000 1.000 1.000 1.000
score BITCOIN_EXTORT_01 1.000 1.000 1.000 1.000
score BITCOIN_EXTORT_02 1.000 1.000 1.000 1.000
score BITCOIN_IMGUR 2.857 3.432 2.857 3.432
score BITCOIN_MALF_HTML 3.499 3.499 3.499 3.499
score BITCOIN_MALWARE 2.781 2.522 2.781 2.522
score BITCOIN_IMGUR 1.000 1.000 1.000 1.000
score BITCOIN_MALF_HTML 3.496 3.496 3.496 3.496
score BITCOIN_MALWARE 1.000 0.001 1.000 0.001
score BITCOIN_OBFU_SUBJ 1.000 1.000 1.000 1.000
score BITCOIN_ONAN 1.000 1.000 1.000 1.000
score BITCOIN_ONAN 2.996 2.996 2.996 2.996
score BITCOIN_PAY_ME 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_01 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_02 2.499 2.499 2.499 2.499
score BITCOIN_SPAM_02 2.497 1.019 2.497 1.019
score BITCOIN_SPAM_03 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_04 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_05 0.001 2.499 0.001 2.499
score BITCOIN_SPAM_05 0.001 1.253 0.001 1.253
score BITCOIN_SPAM_06 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_07 3.499 3.499 3.499 3.499
score BITCOIN_SPAM_07 3.496 3.496 3.496 3.496
score BITCOIN_SPAM_08 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_09 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_10 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_11 1.000 1.000 1.000 1.000
score BITCOIN_SPAM_12 1.000 1.000 1.000 1.000
score BITCOIN_SPF_ONLYALL 0.001 1.000 0.001 1.000
score BITCOIN_XPRIO 2.499 2.499 2.499 2.499
score BITCOIN_YOUR_INFO 2.468 2.486 2.468 2.486
score BODY_SINGLE_URI 0.962 0.001 0.962 0.001
score BODY_SINGLE_WORD 0.240 0.001 0.240 0.001
score BODY_URI_ONLY 2.693 1.569 2.693 1.569
score BOGUS_MIME_VERSION 3.499 2.703 3.499 2.703
score BITCOIN_XPRIO 0.283 0.091 0.283 0.091
score BITCOIN_YOUR_INFO 1.000 1.000 1.000 1.000
score BODY_SINGLE_URI 0.632 0.001 0.632 0.001
score BODY_URI_ONLY 1.000 0.001 1.000 0.001
score BOGUS_MIME_VERSION 3.496 2.990 3.496 2.990
score BOGUS_MSM_HDRS 1.000 1.000 1.000 1.000
score BOMB_FREEM 1.000 1.000 1.000 1.000
score BOMB_MONEY 1.000 1.000 1.000 1.000
score BTC_ORG 1.000 1.000 1.000 1.000
score BULK_RE_SUSP_NTLD 0.999 0.001 0.999 0.001
score BULK_RE_SUSP_NTLD 0.998 1.000 0.998 1.000
score CANT_SEE_AD 1.000 1.000 1.000 1.000
score CK_HELO_GENERIC 0.248 0.248 0.248 0.248
score COMMENT_GIBBERISH 1.000 1.000 1.000 1.000
score COMPENSATION 1.499 1.000 1.499 1.000
score CONTENT_AFTER_HTML 2.499 2.499 2.499 2.499
score CTE_8BIT_MISMATCH 1.000 0.999 1.000 0.999
score DATE_IN_FUTURE_96_Q 2.495 2.299 2.495 2.299
score COMPENSATION 1.000 0.001 1.000 0.001
score CONTENT_AFTER_HTML 2.497 2.497 2.497 2.497
score CTE_8BIT_MISMATCH 0.998 0.001 0.998 0.001
score DATE_IN_FUTURE_96_Q 2.445 1.803 2.445 1.803
score DAY_I_EARNED 1.000 1.000 1.000 1.000
score DEAR_BENEFICIARY 0.001 0.001 0.001 0.001
score DKIMWL_BL 0.001 2.999 0.001 2.999
score DETAILS_OF_PRODUCT 1.249 1.248 1.249 1.248
score DKIMWL_BL 0.001 2.303 0.001 2.303
score DKIMWL_BLOCKED 0.001 0.001 0.001 0.001
score DKIMWL_WL_HIGH 0.001 -0.001 0.001 -0.001
score DKIMWL_WL_HIGH 0.001 -0.700 0.001 -0.700
score DKIMWL_WL_MED 0.001 -0.001 0.001 -0.001
score DKIMWL_WL_MEDHI 0.001 -1.000 0.001 -1.000
score DKIMWL_WL_MEDHI 0.001 -0.998 0.001 -0.998
score DOTGOV_IMAGE 1.000 1.000 1.000 1.000
score DSN_NO_MIMEVERSION 1.999 1.999 1.999 1.999
score DYNAMIC_IMGUR 1.000 1.000 1.000 1.000
score EBAY_IMG_NOT_RCVD_EBAY 2.999 1.835 2.999 1.835
score ENCRYPTED_MESSAGE -1.000 -1.000 -1.000 -1.000
score END_FUTURE_EMAILS 2.099 1.314 2.099 1.314
score DX_TEXT_03 1.698 1.398 1.698 1.398
score DYNAMIC_IMGUR 2.653 3.177 2.653 3.177
score EBAY_IMG_NOT_RCVD_EBAY 0.905 2.999 0.905 2.999
score ENCRYPTED_MESSAGE -0.998 -0.998 -0.998 -0.998
score END_FUTURE_EMAILS 1.000 1.000 1.000 1.000
score ENVFROM_GOOG_TRIX 1.000 1.000 1.000 1.000
score FAKE_REPLY_A1 3.105 3.999 3.105 3.999
score FAKE_REPLY_B 0.635 2.403 0.635 2.403
score FAKE_REPLY_A1 3.995 2.322 3.995 2.322
score FAKE_REPLY_B 3.895 3.595 3.895 3.595
score FBI_MONEY 1.000 1.000 1.000 1.000
score FBI_SPOOF 1.000 1.000 1.000 1.000
score FILL_THIS_FORM 1.199 0.001 1.199 0.001
score FONT_INVIS_DIRECT 2.232 2.010 2.232 2.010
score FONT_INVIS_DOTGOV 1.000 1.000 1.000 1.000
score FONT_INVIS_HTML_NOHTML 2.999 2.882 2.999 2.882
score FONT_INVIS_LONG_LINE 2.385 2.999 2.385 2.999
score FONT_INVIS_MSGID 2.500 2.491 2.500 2.491
score FONT_INVIS_NORDNS 2.499 2.499 2.499 2.499
score FONT_INVIS_POSTEXTRAS 3.182 3.499 3.182 3.499
score FORM_FRAUD 0.999 0.001 0.999 0.001
score FORM_FRAUD_3 0.001 0.846 0.001 0.846
score FILL_THIS_FORM 1.197 0.001 1.197 0.001
score FONT_INVIS_DIRECT 2.399 0.001 2.399 0.001
score FONT_INVIS_DOTGOV 3.496 3.496 3.496 3.496
score FONT_INVIS_HTML_NOHTML 0.001 0.001 0.001 0.001
score FONT_INVIS_LONG_LINE 2.996 2.996 2.996 2.996
score FONT_INVIS_MSGID 2.498 2.497 2.498 2.497
score FONT_INVIS_NORDNS 1.389 2.053 1.389 2.053
score FONT_INVIS_POSTEXTRAS 1.000 1.000 1.000 1.000
score FORM_FRAUD 1.000 0.001 1.000 0.001
score FORM_FRAUD_5 0.001 0.001 0.001 0.001
score FORM_LOW_CONTRAST 1.000 1.000 1.000 1.000
score FOUND_YOU 3.249 3.249 3.249 3.249
score FOUND_YOU 3.246 2.954 3.246 2.954
score FREEMAIL_FORGED_FROMDOMAIN 0.249 0.249 0.249 0.249
score FREEM_FRNUM_UNICD_EMPTY 1.000 1.000 1.000 1.000
score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000 1.000 1.000 1.000
score FROMSPACE 2.767 0.065 2.767 0.065
score FROM_2_EMAILS_SHORT 2.999 2.999 2.999 2.999
score FROM_ADDR_WS 2.999 2.999 2.999 2.999
score FROM_BANK_NOAUTH 0.001 1.000 0.001 1.000
score FROMSPACE 3.096 2.608 3.096 2.608
score FROM_2_EMAILS_SHORT 2.690 2.996 2.690 2.996
score FROM_ADDR_WS 1.000 1.000 1.000 1.000
score FROM_BANK_NOAUTH 0.001 0.998 0.001 0.998
score FROM_FMBLA_NDBLOCKED 0.001 0.001 0.001 0.001
score FROM_FMBLA_NEWDOM 0.001 1.499 0.001 1.499
score FROM_FMBLA_NEWDOM14 0.001 0.999 0.001 0.999
score FROM_FMBLA_NEWDOM28 0.001 0.800 0.001 0.800
score FROM_GOV_DKIM_AU 0.001 -0.001 0.001 -0.001
score FROM_FMBLA_NEWDOM14 0.001 0.998 0.001 0.998
score FROM_FMBLA_NEWDOM28 0.001 0.798 0.001 0.798
score FROM_GOV_DKIM_AU 0.001 -0.999 0.001 -0.999
score FROM_GOV_REPLYTO_FREEMAIL 0.001 1.000 0.001 1.000
score FROM_GOV_SPOOF 0.001 1.000 0.001 1.000
score FROM_MISSPACED 0.685 0.001 0.685 0.001
score FROM_MISSP_DYNIP 0.001 2.449 0.001 2.449
score FROM_GOV_SPOOF 0.001 0.001 0.001 0.001
score FROM_MISSPACED 0.001 0.001 0.001 0.001
score FROM_MISSP_DYNIP 0.254 0.400 0.254 0.400
score FROM_MISSP_EH_MATCH 0.001 0.001 0.001 0.001
score FROM_MISSP_FREEMAIL 2.889 0.001 2.889 0.001
score FROM_MISSP_MSFT 0.001 0.001 0.001 0.001
score FROM_MISSP_REPLYTO 1.800 1.740 1.800 1.740
score FROM_MISSP_SPF_FAIL 0.001 2.000 0.001 2.000
score FROM_MISSP_TO_UNDISC 0.761 0.001 0.761 0.001
score FROM_MISSP_FREEMAIL 2.278 0.001 2.278 0.001
score FROM_MISSP_MSFT 0.001 2.839 0.001 2.839
score FROM_MISSP_PHISH 3.496 1.689 3.496 1.689
score FROM_MISSP_REPLYTO 1.000 0.001 1.000 0.001
score FROM_MISSP_SPF_FAIL 0.001 0.001 0.001 0.001
score FROM_MISSP_USER 0.001 0.001 0.001 0.001
score FROM_MULTI_NORDNS 0.001 0.961 0.001 0.961
score FROM_NEWDOM_BTC 0.001 1.000 0.001 1.000
score FROM_NTLD_LINKBAIT 1.000 0.001 1.000 0.001
score FROM_NTLD_REPLY_FREEMAIL 1.737 1.999 1.737 1.999
score FROM_MULTI_NORDNS 0.687 2.057 0.687 2.057
score FROM_NAME_EQ_TO_G_DRIVE 0.308 0.167 0.308 0.167
score FROM_NEWDOM_BTC 0.001 1.997 0.001 1.997
score FROM_NTLD_LINKBAIT 1.666 1.000 1.666 1.000
score FROM_NTLD_REPLY_FREEMAIL 1.999 0.481 1.999 0.481
score FROM_NUMBERO_NEWDOMAIN 0.001 1.000 0.001 1.000
score FROM_NUMERIC_TLD 1.000 1.000 1.000 1.000
score FROM_PAYPAL_SPOOF 0.001 0.658 0.001 0.658
score FROM_SUSPICIOUS_NTLD 0.499 0.500 0.499 0.500
score FROM_SUSPICIOUS_NTLD_FP 1.999 0.001 1.999 0.001
score FSL_BULK_SIG 0.001 0.001 0.001 0.001
score FROM_PAYPAL_SPOOF 0.001 0.001 0.001 0.001
score FROM_SUSPICIOUS_NTLD 0.498 0.498 0.498 0.498
score FROM_SUSPICIOUS_NTLD_FP 1.997 0.917 1.997 0.917
score FSL_BULK_SIG 0.001 1.995 0.001 1.995
score FSL_CTYPE_WIN1251 0.001 0.001 0.001 0.001
score FSL_HELO_FAKE 3.096 2.896 3.096 2.896
score FSL_NEW_HELO_USER 0.001 0.001 0.001 0.001
score FUZZY_AMAZON 2.699 2.599 2.699 2.599
score FUZZY_BITCOIN 2.399 0.546 2.399 0.546
score FUZZY_AMAZON 2.298 2.097 2.298 2.097
score GAPPY_SALES_LEADS_FREEM 1.000 1.000 1.000 1.000
score GB_FAKE_RF_SHORT 1.999 1.999 1.999 1.999
score GB_FAKE_RF_SHORT 0.378 0.001 0.378 0.001
score GB_FORGED_MUA_POSTFIX 1.000 1.000 1.000 1.000
score GB_FREEMAIL_DISPTO 0.487 0.001 0.487 0.001
score GB_FREEMAIL_DISPTO_NOTFREEM 0.499 0.499 0.499 0.499
score GB_FREEMAIL_DISPTO 0.498 0.001 0.498 0.001
score GB_FREEMAIL_DISPTO_NOTFREEM 0.499 0.498 0.499 0.498
score GB_GOOGLE_OBFUR 0.750 0.750 0.750 0.750
score GOOGLE_DOCS_PHISH 1.000 1.000 1.000 1.000
score GOOGLE_DOCS_PHISH_MANY 1.000 1.000 1.000 1.000
score GOOGLE_DOC_SUSP 2.999 2.999 2.999 2.999
score GOOGLE_DOC_SUSP 2.996 2.235 2.996 2.235
score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000 1.000 1.000 1.000
score GOOG_MALWARE_DNLD 1.000 1.000 1.000 1.000
score GOOG_REDIR_NORDNS 2.604 2.197 2.604 2.197
score GOOG_STO_HTML_PHISH 2.505 1.663 2.505 1.663
score GOOG_STO_HTML_PHISH_MANY 1.000 1.000 1.000 1.000
score GOOG_STO_IMG_HTML 2.999 2.999 2.999 2.999
score GOOG_STO_IMG_NOHTML 2.500 2.499 2.500 2.499
score GOOG_STO_NOIMG_HTML 2.999 2.999 2.999 2.999
score GOOG_REDIR_NORDNS 2.497 2.434 2.497 2.434
score GOOG_STO_EMAIL_PHISH 2.661 2.815 2.661 2.815
score GOOG_STO_HTML_PHISH 1.934 0.862 1.934 0.862
score GOOG_STO_HTML_PHISH_MANY 1.883 0.875 1.883 0.875
score GOOG_STO_IMG_HTML 2.996 2.996 2.996 2.996
score GOOG_STO_IMG_NOHTML 1.000 1.000 1.000 1.000
score GOOG_STO_NOIMG_HTML 2.996 2.996 2.996 2.996
score HAS_X_NO_RELAY 1.000 1.000 1.000 1.000
score HAS_X_OUTGOING_SPAM_STAT 2.610 2.594 2.610 2.594
score HDRS_LCASE 0.099 0.099 0.099 0.099
score HDRS_LCASE_IMGONLY 0.100 0.099 0.100 0.099
score HDRS_MISSP 2.499 2.499 2.499 2.499
score HDR_ORDER_FTSDMCXX_DIRECT 1.999 1.999 1.999 1.999
score HDR_ORDER_FTSDMCXX_NORDNS 2.947 3.499 2.947 3.499
score HEADER_FROM_DIFFERENT_DOMAINS 0.250 0.250 0.250 0.250
score HELO_NO_DOMAIN 0.077 0.001 0.077 0.001
score HAS_X_OUTGOING_SPAM_STAT 1.997 0.119 1.997 0.119
score HDRS_LCASE 0.100 0.001 0.100 0.001
score HDRS_LCASE_IMGONLY 0.099 0.099 0.099 0.099
score HDRS_MISSP 0.785 0.001 0.785 0.001
score HDR_ORDER_FTSDMCXX_DIRECT 0.001 0.001 0.001 0.001
score HDR_ORDER_FTSDMCXX_NORDNS 0.001 0.001 0.001 0.001
score HEADER_FROM_DIFFERENT_DOMAINS 0.249 0.248 0.249 0.248
score HELO_NO_DOMAIN 0.001 0.001 0.001 0.001
score HEXHASH_WORD 1.000 1.000 1.000 1.000
score HK_CTE_RAW 1.000 1.000 1.000 1.000
score HK_NAME_FM_MR_MRS 0.749 0.001 0.749 0.001
score HK_NAME_MR_MRS 0.999 0.244 0.999 0.244
score HK_RANDOM_FROM 0.999 0.999 0.999 0.999
score HK_RANDOM_REPLYTO 0.861 0.001 0.861 0.001
score HK_NAME_FM_MR_MRS 1.498 1.498 1.498 1.498
score HK_NAME_MR_MRS 0.998 0.205 0.998 0.205
score HK_RANDOM_ENVFROM 0.999 0.001 0.999 0.001
score HK_RANDOM_FROM 0.999 0.998 0.999 0.998
score HK_RANDOM_REPLYTO 0.998 0.722 0.998 0.722
score HK_RCVD_IP_MULTICAST 1.000 1.000 1.000 1.000
score HK_SCAM 0.001 0.001 0.001 0.001
score HK_WIN 0.001 0.999 0.001 0.999
score HOSTED_IMG_DIRECT_MX 2.004 1.875 2.004 1.875
score HK_WIN 1.000 1.000 1.000 1.000
score HOSTED_IMG_DIRECT_MX 3.496 3.496 3.496 3.496
score HOSTED_IMG_DQ_UNSUB 1.000 1.000 1.000 1.000
score HOSTED_IMG_FREEM 3.499 3.499 3.499 3.499
score HOSTED_IMG_MULTI 1.804 2.864 1.804 2.864
score HOSTED_IMG_MULTI_PUB_01 2.600 2.999 2.600 2.999
score HOSTED_IMG_FREEM 3.496 3.496 3.496 3.496
score HOSTED_IMG_MULTI 1.000 1.000 1.000 1.000
score HOSTED_IMG_MULTI_PUB_01 2.697 2.996 2.697 2.996
score HTML_ENTITY_ASCII 1.000 1.000 1.000 1.000
score HTML_ENTITY_ASCII_TINY 1.000 1.000 1.000 1.000
score HTML_OFF_PAGE 2.999 2.999 2.999 2.999
score HTML_SHRT_CMNT_OBFU_MANY 0.297 2.482 0.297 2.482
score HTML_SINGLET_MANY 2.129 2.499 2.129 2.499
score HTML_TEXT_INVISIBLE_FONT 1.999 1.999 1.999 1.999
score HTML_TEXT_INVISIBLE_STYLE 0.358 1.723 0.358 1.723
score IMG_ONLY_FM_DOM_INFO 0.001 2.447 0.001 2.447
score JH_SPAMMY_HEADERS 3.499 3.499 3.499 3.499
score HTML_FONT_TINY_NORDNS 1.498 1.499 1.498 1.499
score HTML_OFF_PAGE 2.996 2.986 2.996 2.986
score HTML_SHRT_CMNT_OBFU_MANY 1.000 1.000 1.000 1.000
score HTML_SINGLET_MANY 1.000 1.761 1.000 1.761
score HTML_TAG_BALANCE_CENTER 0.481 0.001 0.481 0.001
score HTML_TEXT_INVISIBLE_FONT 1.000 0.001 1.000 0.001
score HTML_TEXT_INVISIBLE_STYLE 3.496 1.704 3.496 1.704
score IMG_ONLY_FM_DOM_INFO 0.001 2.497 0.001 2.497
score JH_SPAMMY_HEADERS 3.496 3.496 3.496 3.496
score JH_SPAMMY_PATTERN01 1.000 1.000 1.000 1.000
score JH_SPAMMY_PATTERN02 1.000 1.000 1.000 1.000
score KHOP_FAKE_EBAY 0.001 0.999 0.001 0.999
score KHOP_HELO_FCRDNS 0.400 0.399 0.400 0.399
score KHOP_HELO_FCRDNS 0.400 0.398 0.400 0.398
score LINKEDIN_IMG_NOT_RCVD_LNKN 2.498 2.497 2.498 2.497
score LIST_PRTL_PUMPDUMP 1.000 1.000 1.000 1.000
score LIST_PRTL_SAME_USER 0.001 1.461 0.001 1.461
score LONG_HEX_URI 1.908 0.001 1.908 0.001
score LONG_IMG_URI 0.737 0.409 0.737 0.409
score LONG_INVISIBLE_TEXT 1.806 1.587 1.806 1.587
score LIST_PRTL_SAME_USER 1.000 1.000 1.000 1.000
score LONG_HEX_URI 2.996 1.412 2.996 1.412
score LONG_IMG_URI 0.001 0.001 0.001 0.001
score LONG_INVISIBLE_TEXT 1.399 1.046 1.399 1.046
score LOTS_OF_MONEY 0.010 0.010 0.010 0.010
score LOTTO_AGENT 1.499 1.499 1.499 1.499
score LOTTO_DEPT 0.001 0.001 0.001 0.001
score LOTTO_AGENT 0.722 0.547 0.722 0.547
score LUCRATIVE 1.000 1.000 1.000 1.000
score MALFORMED_FREEMAIL 3.199 1.345 3.199 1.345
score MALF_HTML_B64 1.000 1.000 1.000 1.000
score MALWARE_NORDNS 0.001 0.703 0.001 0.703
score MALWARE_NORDNS 2.104 0.001 2.104 0.001
score MALWARE_PASSWORD 1.000 1.000 1.000 1.000
score MANY_HDRS_LCASE 0.100 0.100 0.100 0.100
score MANY_SPAN_IN_TEXT 2.299 2.200 2.299 2.200
score MAY_BE_FORGED 2.390 2.699 2.390 2.699
score MILLION_HUNDRED 0.001 0.001 0.001 0.001
score MANY_HDRS_LCASE 0.100 0.001 0.100 0.001
score MANY_SPAN_IN_TEXT 3.496 1.738 3.496 1.738
score MILLION_HUNDRED 3.096 0.001 3.096 0.001
score MILLION_USD 0.001 0.001 0.001 0.001
score MIMEOLE_DIRECT_TO_MX 1.999 1.999 1.999 1.999
score MIME_NO_TEXT 1.999 1.999 1.999 1.999
score MIXED_AREA_CASE 1.065 2.437 1.065 2.437
score MIXED_CENTER_CASE 2.499 2.499 2.499 2.499
score MIXED_CTYPE_CASE 0.426 2.634 0.426 2.634
score MIXED_ES 2.499 2.299 2.499 2.299
score MIXED_FONT_CASE 1.637 2.329 1.637 2.329
score MIXED_HREF_CASE 1.999 1.999 1.999 1.999
score MIXED_IMG_CASE 2.999 2.999 2.999 2.999
score MIMEOLE_DIRECT_TO_MX 1.612 0.044 1.612 0.044
score MIME_NO_TEXT 1.000 1.000 1.000 1.000
score MIXED_AREA_CASE 1.138 1.075 1.138 1.075
score MIXED_CENTER_CASE 2.497 2.499 2.497 2.499
score MIXED_ES 3.497 2.513 3.497 2.513
score MIXED_FONT_CASE 0.774 0.160 0.774 0.160
score MIXED_HREF_CASE 0.001 1.251 0.001 1.251
score MIXED_IMG_CASE 0.956 1.646 0.956 1.646
score MONERO_DEADLINE 1.000 1.000 1.000 1.000
score MONERO_EXTORT_01 1.000 1.000 1.000 1.000
score MONERO_MALWARE 1.000 1.000 1.000 1.000
@ -230,73 +231,73 @@ score MONERO_PAY_ME 1.000 1.000 1.000 1.000
score MONEY_ATM_CARD 0.001 0.001 0.001 0.001
score MONEY_FORM 0.001 0.001 0.001 0.001
score MONEY_FORM_SHORT 0.001 0.001 0.001 0.001
score MONEY_FRAUD_3 2.699 2.599 2.699 2.599
score MONEY_FRAUD_3 0.001 0.001 0.001 0.001
score MONEY_FRAUD_5 0.001 0.001 0.001 0.001
score MONEY_FRAUD_8 0.001 0.001 0.001 0.001
score MONEY_FREEMAIL_REPTO 2.999 2.484 2.999 2.484
score MONEY_FROM_41 1.999 1.999 1.999 1.999
score MONEY_FRAUD_8 1.758 0.035 1.758 0.035
score MONEY_FREEMAIL_REPTO 2.489 0.989 2.489 0.989
score MONEY_FROM_41 1.997 1.997 1.997 1.997
score MONEY_FROM_MISSP 0.001 0.001 0.001 0.001
score MONEY_NOHTML 2.499 2.401 2.499 2.401
score MONEY_NOHTML 1.300 1.245 1.300 1.245
score MSGID_DOLLARS_URI_IMG 1.000 1.000 1.000 1.000
score MSGID_HDR_MALF 3.035 3.499 3.035 3.499
score MSGID_NOFQDN1 0.050 0.364 0.050 0.364
score MSMAIL_PRI_ABNORMAL 0.618 1.263 0.618 1.263
score MSGID_HDR_MALF 1.000 1.000 1.000 1.000
score MSGID_WSP_TRAIL 2.574 1.824 2.574 1.824
score MSMAIL_PRI_ABNORMAL 0.597 0.906 0.597 0.906
score MSM_PRIO_REPTO 1.000 1.000 1.000 1.000
score NAME_EMAIL_DIFF 1.451 1.070 1.451 1.070
score NA_DOLLARS 1.499 1.499 1.499 1.499
score NAME_EMAIL_DIFF 1.806 0.625 1.806 0.625
score NA_DOLLARS 0.920 0.228 0.920 0.228
score NEWEGG_IMG_NOT_RCVD_NEGG 1.000 1.000 1.000 1.000
score NICE_REPLY_A -0.243 -0.001 -0.243 -0.001
score NORDNS_LOW_CONTRAST 1.886 2.313 1.886 2.313
score NO_FM_NAME_IP_HOSTN 0.001 0.001 0.001 0.001
score NICE_REPLY_A -2.552 -0.368 -2.552 -0.368
score NOT_SPAM 3.096 2.896 3.096 2.896
score NO_FM_NAME_IP_HOSTN 0.196 0.001 0.196 0.001
score NSL_RCVD_FROM_USER 0.001 0.001 0.001 0.001
score NSL_RCVD_HELO_USER 0.001 0.001 0.001 0.001
score NUMBEREND_LINKBAIT 0.471 0.519 0.471 0.519
score OBFU_BITCOIN 0.008 0.062 0.008 0.062
score OBFU_UNSUB_UL 2.299 2.199 2.299 2.199
score ODD_FREEM_REPTO 2.999 2.864 2.999 2.864
score OFFER_ONLY_AMERICA 1.999 1.579 1.999 1.579
score ORDER_TODAY 2.397 2.499 2.397 2.499
score PDS_BAD_THREAD_QP_64 0.999 1.000 0.999 1.000
score PDS_BTC_ID 0.499 0.499 0.499 0.499
score PDS_BTC_MSGID 0.003 0.999 0.003 0.999
score PDS_DBL_URL_TNB_RUNON 1.305 0.001 1.305 0.001
score PDS_EMPTYSUBJ_URISHRT 0.001 0.032 0.001 0.032
score PDS_FRNOM_TODOM_DBL_URL 1.499 0.338 1.499 0.338
score PDS_FRNOM_TODOM_NAKED_TO 1.499 1.499 1.499 1.499
score PDS_FROM_2_EMAILS 1.681 1.776 1.681 1.776
score PDS_FROM_2_EMAILS_SHRTNER 0.001 0.946 0.001 0.946
score PDS_FROM_NAME_TO_DOMAIN 1.999 1.999 1.999 1.999
score NSL_RCVD_HELO_USER 0.001 1.672 0.001 1.672
score NUMBEREND_LINKBAIT 0.857 0.931 0.857 0.931
score OBFU_BITCOIN 1.000 1.000 1.000 1.000
score OBFU_TEXT_ATTACH 0.001 0.001 0.001 0.001
score ODD_FREEM_REPTO 2.996 2.493 2.996 2.493
score OFFER_ONLY_AMERICA 1.999 1.000 1.999 1.000
score ONLINE_MKTG_CNSLT 2.696 2.397 2.696 2.397
score ORDER_TODAY 2.442 0.542 2.442 0.542
score PDS_BTC_ID 0.499 0.498 0.499 0.498
score PDS_BTC_MSGID 0.001 0.001 0.001 0.001
score PDS_BTC_NTLD 1.999 1.905 1.999 1.905
score PDS_DBL_URL_TNB_RUNON 1.997 0.605 1.997 0.605
score PDS_FRNOM_TODOM_DBL_URL 1.496 1.498 1.496 1.498
score PDS_FRNOM_TODOM_NAKED_TO 1.498 1.498 1.498 1.498
score PDS_FROM_2_EMAILS_SHRTNER 1.468 1.498 1.468 1.498
score PDS_FROM_NAME_TO_DOMAIN 1.997 1.997 1.997 1.997
score PDS_HELO_SPF_FAIL 0.001 1.000 0.001 1.000
score PDS_NAKED_TO_NUMERO 1.999 0.345 1.999 0.345
score PDS_NO_FULL_NAME_SPOOFED_URL 0.121 0.344 0.121 0.344
score PDS_OTHER_BAD_TLD 1.999 1.999 1.999 1.999
score PDS_SHORTFWD_URISHRT_FP 1.500 1.499 1.500 1.499
score PDS_SHORT_SPOOFED_URL 1.149 1.999 1.149 1.999
score PDS_TINYSUBJ_URISHRT 1.395 0.655 1.395 0.655
score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.999 1.999 1.999 1.999
score PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 1.999 1.999 1.999 1.999
score PDS_TONAME_EQ_TOLOCAL_SHORT 1.999 1.999 1.999 1.999
score PDS_TONAME_EQ_TOLOCAL_VSHORT 0.999 0.999 0.999 0.999
score PDS_TO_EQ_FROM_NAME 3.099 2.390 3.099 2.390
score PDS_HP_HELO_NORDNS 0.998 0.001 0.998 0.001
score PDS_OTHER_BAD_TLD 1.997 1.997 1.997 1.997
score PDS_PHPEXP_BOT 1.498 1.498 1.498 1.498
score PDS_PHP_EVAL 1.498 0.881 1.498 0.881
score PDS_RDNS_DYNAMIC_FP 0.001 0.001 0.001 0.001
score PDS_SHORTFWD_URISHRT_FP 1.498 1.498 1.498 1.498
score PDS_SHORTFWD_URISHRT_QP 1.498 1.498 1.498 1.498
score PDS_TINYSUBJ_URISHRT 1.498 1.498 1.498 1.498
score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.997 1.997 1.997 1.997
score PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 1.998 1.997 1.998 1.997
score PDS_TO_EQ_FROM_NAME 3.196 3.096 3.196 3.096
score PHISH_AZURE_CLOUDAPP 3.500 3.500 3.500 3.500
score PHISH_FBASEAPP 1.000 1.000 1.000 1.000
score PHOTO_EDITING_DIRECT 1.000 1.000 1.000 1.000
score PHOTO_EDITING_FREEM 1.000 1.000 1.000 1.000
score PHP_NOVER_MUA 1.000 1.000 1.000 1.000
score PHP_ORIG_SCRIPT 0.305 0.001 0.305 0.001
score PHP_SCRIPT 2.381 2.499 2.381 2.499
score PHP_ORIG_SCRIPT 2.497 0.268 2.497 0.268
score PHP_ORIG_SCRIPT_EVAL 2.996 2.590 2.996 2.590
score PHP_SCRIPT 2.497 2.189 2.497 2.189
score PHP_SCRIPT_MUA 1.000 1.000 1.000 1.000
score PP_MIME_FAKE_ASCII_TEXT 0.999 0.195 0.999 0.195
score PP_MIME_FAKE_ASCII_TEXT 0.998 0.998 0.998 0.998
score PP_TOO_MUCH_UNICODE02 0.500 0.500 0.500 0.500
score PP_TOO_MUCH_UNICODE05 1.000 1.000 1.000 1.000
score PUMPDUMP 1.000 1.000 1.000 1.000
score PUMPDUMP_MULTI 1.000 1.000 1.000 1.000
score RAND_HEADER_LIST_SPOOF 3.000 3.000 3.000 3.000
score RAND_HEADER_LIST_SPOOF 2.996 2.996 2.996 2.996
score RAND_HEADER_MANY 1.000 1.000 1.000 1.000
score RAND_MKTG_HEADER 2.000 1.999 2.000 1.999
score RATWARE_NO_RDNS 0.866 1.744 0.866 1.744
score RAND_MKTG_HEADER 1.997 1.998 1.997 1.998
score RATWARE_NO_RDNS 1.814 1.046 1.814 1.046
score RCVD_DOTEDU_SHORT 1.000 1.000 1.000 1.000
score RCVD_DOTEDU_SUSP_URI 2.999 2.999 2.999 2.999
score RCVD_DOTEDU_SUSP_URI 1.000 1.000 1.000 1.000
score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001
score RCVD_IN_MSPIKE_H2 0.001 -0.001 0.001 -0.001
score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001
@ -308,116 +309,112 @@ score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001
score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001
score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001
score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001
score RCVD_IN_RP_CERTIFIED 0.001 0.001 0.001 0.001
score RCVD_IN_RP_RNBL 0.001 0.001 0.001 0.001
score RCVD_IN_RP_SAFE 0.001 0.001 0.001 0.001
score RDNS_NUM_TLD_ATCHNX 1.000 1.000 1.000 1.000
score RDNS_NUM_TLD_XM 1.697 2.236 1.697 2.236
score READY_TO_SHIP 0.940 0.914 0.940 0.914
score REPTO_419_FRAUD 1.000 1.000 1.000 1.000
score RDNS_NUM_TLD_XM 2.999 1.181 2.999 1.181
score READY_TO_SHIP 1.248 1.249 1.248 1.249
score REPLYTO_EMPTY 2.697 2.498 2.697 2.498
score REPTO_419_FRAUD 2.996 2.996 2.996 2.996
score REPTO_419_FRAUD_AOL 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_AOL_LOOSE 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_CNS 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_GM 2.999 2.700 2.999 2.700
score REPTO_419_FRAUD_GM_LOOSE 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_GM 2.996 2.999 2.996 2.999
score REPTO_419_FRAUD_GM_LOOSE 0.998 0.998 0.998 0.998
score REPTO_419_FRAUD_HM 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_OL 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_PM 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_QQ 2.999 2.299 2.999 2.299
score REPTO_419_FRAUD_QQ 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_YH 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_YH_LOOSE 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_YJ 1.000 1.000 1.000 1.000
score REPTO_419_FRAUD_YN 1.000 1.000 1.000 1.000
score RISK_FREE 2.899 2.699 2.899 2.699
score SENDGRID_REDIR 1.499 1.333 1.499 1.333
score RISK_FREE 2.996 2.796 2.996 2.796
score SCC_NEWBIE_HASBEENS 0.468 0.001 0.468 0.001
score SCRIPT_GIBBERISH 2.497 2.197 2.497 2.197
score SENDGRID_REDIR 1.498 1.313 1.498 1.313
score SENDGRID_REDIR_PHISH 1.000 1.000 1.000 1.000
score SEO_SUSP_NTLD 1.000 1.000 1.000 1.000
score SERGIO_SUBJECT_VIAGRA01 3.524 4.099 3.524 4.099
score SHOPIFY_IMG_NOT_RCVD_SFY 2.500 2.499 2.500 2.499
score SHORTENER_SHORT_IMG 1.000 1.000 1.000 1.000
score SHORTENER_SHORT_SUBJ 2.999 2.049 2.999 2.049
score SHORT_IMG_SUSP_NTLD 0.001 1.000 0.001 1.000
score SHORT_SHORTNER 1.999 0.695 1.999 0.695
score SINGLETS_LOW_CONTRAST 0.001 0.001 0.001 0.001
score SPOOFED_FREEMAIL 0.001 1.983 0.001 1.983
score SPOOFED_FREEMAIL_NO_RDNS 1.499 0.001 1.499 0.001
score SPOOFED_FREEM_REPTO 0.001 2.013 0.001 2.013
score SPOOFED_FREEM_REPTO_CHN 0.001 1.000 0.001 1.000
score SERGIO_SUBJECT_VIAGRA01 3.335 4.295 3.335 4.295
score SHOPIFY_IMG_NOT_RCVD_SFY 2.497 2.498 2.497 2.498
score SHORTENED_URL_SRC 2.996 2.774 2.996 2.774
score SHORTENER_SHORT_IMG 1.041 2.373 1.041 2.373
score SHORTENER_SHORT_SUBJ 2.996 2.996 2.996 2.996
score SHORT_BODY_G_DRIVE_DYN 0.823 1.082 0.823 1.082
score SHORT_IMG_SUSP_NTLD 1.000 1.000 1.000 1.000
score SHORT_SHORTNER 1.997 0.001 1.997 0.001
score SPOOFED_FREEMAIL 0.001 0.724 0.001 0.724
score SPOOFED_FREEMAIL_NO_RDNS 1.000 0.001 1.000 0.001
score SPOOFED_FREEM_REPTO 0.001 0.001 0.001 0.001
score SPOOFED_FREEM_REPTO_CHN 0.001 1.289 0.001 1.289
score SPOOFED_FREEM_REPTO_RUS 0.001 1.000 0.001 1.000
score SPOOF_GMAIL_MID 1.499 0.001 1.499 0.001
score STATIC_XPRIO_OLE 1.999 1.999 1.999 1.999
score STOCK_LOW_CONTRAST 1.113 2.499 1.113 2.499
score SPOOF_GMAIL_MID 1.000 1.498 1.000 1.498
score STATIC_XPRIO_OLE 1.997 1.998 1.997 1.998
score STOCK_LOW_CONTRAST 1.000 1.000 1.000 1.000
score STOCK_TIP 1.000 1.000 1.000 1.000
score SURBL_BLOCKED 0.001 0.001 0.001 0.001
score SYSADMIN 1.000 1.000 1.000 1.000
score THIS_AD 1.199 0.516 1.199 0.516
score THIS_IS_ADV_SUSP_NTLD 0.568 0.001 0.568 0.001
score THREAD_INDEX_HEX 2.157 0.995 2.157 0.995
score TAGSTAT_IMG_NOT_RCVD_TGST 1.997 1.997 1.997 1.997
score THIS_AD 1.098 0.898 1.098 0.898
score THIS_IS_ADV_SUSP_NTLD 1.499 1.198 1.499 1.198
score TONLINE_FAKE_DKIM 1.000 1.000 1.000 1.000
score TONOM_EQ_TOLOC_SHRT_SHRTNER 1.499 1.500 1.499 1.500
score TO_EQ_FM_DIRECT_MX 0.001 0.001 0.001 0.001
score TO_EQ_FM_DOM_HTML_IMG 0.001 0.001 0.001 0.001
score TO_EQ_FM_DOM_HTML_ONLY 1.799 0.861 1.799 0.861
score TO_EQ_FM_DIRECT_MX 0.001 0.165 0.001 0.165
score TO_EQ_FM_DOM_SPF_FAIL 0.001 0.001 0.001 0.001
score TO_EQ_FM_HTML_ONLY 0.065 1.299 0.065 1.299
score TO_EQ_FM_SPF_FAIL 0.001 0.001 0.001 0.001
score TO_IN_SUBJ 0.099 0.099 0.099 0.099
score TO_NAME_SUBJ_NO_RDNS 1.884 2.215 1.884 2.215
score TO_NO_BRKTS_FROM_MSSP 2.012 0.881 2.012 0.881
score TO_NO_BRKTS_HTML_IMG 1.999 1.999 1.999 1.999
score TO_NO_BRKTS_HTML_ONLY 2.000 1.999 2.000 1.999
score TO_NO_BRKTS_MSFT 2.318 0.214 2.318 0.214
score TO_NO_BRKTS_NORDNS_HTML 1.999 1.118 1.999 1.118
score TO_NO_BRKTS_PCNT 2.499 2.499 2.499 2.499
score TVD_IP_HEX 2.699 0.604 2.699 0.604
score TVD_IP_SING_HEX 0.410 1.891 0.410 1.891
score TVD_RCVD_SPACE_BRACKET 2.699 1.777 2.699 1.777
score TVD_SPACE_ENCODED 2.499 2.499 2.499 2.499
score TVD_SPACE_RATIO_MINFP 2.058 1.440 2.058 1.440
score TO_IN_SUBJ 0.098 0.099 0.098 0.099
score TO_NAME_SUBJ_NO_RDNS 2.755 1.864 2.755 1.864
score TO_NO_BRKTS_FROM_MSSP 2.095 0.001 2.095 0.001
score TO_NO_BRKTS_HTML_IMG 1.997 0.001 1.997 0.001
score TO_NO_BRKTS_HTML_ONLY 1.997 1.997 1.997 1.997
score TO_NO_BRKTS_MSFT 1.000 0.001 1.000 0.001
score TO_NO_BRKTS_NORDNS_HTML 1.997 1.199 1.997 1.199
score TO_NO_BRKTS_PCNT 2.497 2.497 2.497 2.497
score TRANSFORM_LIFE 2.497 2.497 2.497 2.497
score TVD_PH_BODY_META 2.896 2.596 2.896 2.596
score TVD_RCVD_SPACE_BRACKET 2.896 2.696 2.896 2.696
score TVD_SPACE_ENCODED 1.000 0.001 1.000 0.001
score TVD_SPACE_RATIO_MINFP 1.000 0.001 1.000 0.001
score TW_GIBBERISH_MANY 1.000 1.000 1.000 1.000
score UC_GIBBERISH_OBFU 1.000 1.000 1.000 1.000
score UNDISC_FREEM 2.999 2.800 2.999 2.800
score UNDISC_MONEY 3.400 1.787 3.400 1.787
score UNDISC_FREEM 2.896 2.696 2.896 2.696
score UNDISC_MONEY 3.296 2.493 3.296 2.493
score UNICODE_OBFU_ASC 1.000 1.000 1.000 1.000
score UNICODE_OBFU_ZW 1.000 1.000 1.000 1.000
score UPGRADE_MAILBOX 1.099 1.399 1.099 1.399
score URI_ADOBESPARK 1.000 1.000 1.000 1.000
score URI_AZURE_CLOUDAPP 1.000 1.000 1.000 1.000
score URI_DASHGOVEDU 1.000 1.000 1.000 1.000
score URI_DATA 1.000 1.000 1.000 1.000
score URI_DOTDOT_LOW_CNTRST 2.499 1.790 2.499 1.790
score URI_DOTEDU 1.981 1.999 1.981 1.999
score URI_DEOBFU_INSTR 3.895 3.695 3.895 3.695
score URI_DOTEDU 1.997 1.997 1.997 1.997
score URI_DOTEDU_ENTITY 1.000 1.000 1.000 1.000
score URI_FIREBASEAPP 2.999 2.999 2.999 2.999
score URI_GOOGLE_PROXY 3.099 1.631 3.099 1.631
score URI_GOOG_STO_SPAMMY 2.582 2.618 2.582 2.618
score URI_HEX_IP 0.387 2.435 0.387 2.435
score URI_DQ_UNSUB 2.696 2.399 2.696 2.399
score URI_FIREBASEAPP 2.996 2.996 2.996 2.996
score URI_GOOGLE_PROXY 3.096 2.696 3.096 2.696
score URI_GOOG_STO_SPAMMY 2.996 2.996 2.996 2.996
score URI_HEX_IP 1.000 1.000 1.000 1.000
score URI_IMG_WP_REDIR 1.000 1.000 1.000 1.000
score URI_LONG_REPEAT 1.000 1.000 1.000 1.000
score URI_ONLY_MSGID_MALF 1.999 1.607 1.999 1.607
score URI_LONG_REPEAT 2.497 2.499 2.497 2.499
score URI_ONLY_MSGID_MALF 1.000 0.001 1.000 0.001
score URI_OPTOUT_3LD 1.000 1.000 1.000 1.000
score URI_PHISH 3.999 2.397 3.999 2.397
score URI_PHP_REDIR 3.499 3.499 3.499 3.499
score URI_TRY_3LD 1.999 1.999 1.999 1.999
score URI_PHISH 3.995 1.515 3.995 1.515
score URI_PHP_REDIR 3.496 3.290 3.496 3.290
score URI_TRY_3LD 1.927 1.623 1.927 1.623
score URI_TRY_USME 1.000 1.000 1.000 1.000
score URI_WPADMIN 3.299 3.099 3.299 3.099
score URI_WP_DIRINDEX 3.499 0.061 3.499 0.061
score URI_WP_HACKED 3.499 1.329 3.499 1.329
score URI_WP_HACKED_2 2.499 2.499 2.499 2.499
score URI_WPADMIN 2.596 2.297 2.596 2.297
score URI_WP_DIRINDEX 1.000 1.000 1.000 1.000
score URI_WP_HACKED 1.000 0.001 1.000 0.001
score URI_WP_HACKED_2 2.497 2.497 2.497 2.497
score USB_DRIVES 1.000 1.000 1.000 1.000
score VFY_ACCT_NORDNS 0.602 2.913 0.602 2.913
score VFY_ACCT_NORDNS 0.001 0.001 0.001 0.001
score VPS_NO_NTLD 1.000 1.000 1.000 1.000
score WALMART_IMG_NOT_RCVD_WAL 1.000 1.000 1.000 1.000
score WANT_TO_ORDER 2.499 2.499 2.499 2.499
score WIKI_IMG 3.199 2.561 3.199 2.561
score WALMART_IMG_NOT_RCVD_WAL 2.363 2.270 2.363 2.270
score WANT_TO_ORDER 2.166 1.931 2.166 1.931
score WORD_INVIS 1.000 1.000 1.000 1.000
score WORD_INVIS_MANY 1.000 1.000 1.000 1.000
score XFER_LOTSA_MONEY 0.244 0.001 0.244 0.001
score XM_DIGITS_ONLY 2.643 1.403 2.643 1.403
score XM_RANDOM 2.999 2.999 2.999 2.999
score XM_RECPTID 2.999 2.999 2.999 2.999
score XPRIO 0.001 1.000 0.001 1.000
score WORD_INVIS_MANY 2.996 2.996 2.996 2.996
score XFER_LOTSA_MONEY 0.998 0.998 0.998 0.998
score XM_DIGITS_ONLY 0.827 2.016 0.827 2.016
score XM_RANDOM 2.497 1.418 2.497 1.418
score XM_RECPTID 2.996 2.987 2.996 2.987
score XPRIO 1.000 1.000 1.000 1.000
score XPRIO_SHORT_SUBJ 1.000 1.000 1.000 1.000
score XPRIO_URL_SHORTNER 0.567 0.545 0.567 0.545
score YOUR_DELIVERY_ADDRESS 0.695 0.823 0.695 0.823
score YOU_INHERIT 2.399 2.200 2.399 2.200
score XPRIO_URL_SHORTNER 0.998 0.998 0.998 0.998
score YOUR_DELIVERY_ADDRESS 0.035 1.105 0.035 1.105
score YOU_INHERIT 2.696 2.497 2.696 2.497

5
sa-updates/73_sandbox_manual_scores.cf
View File

@ -114,3 +114,8 @@ score AD_PREFS 0.250
#score LONG_HEX_URI (0) 0.001 (0) 0.001
#score FROM_PAYPAL_SPOOF (0) 0.001 (0) 0.001
# jhardin
# Don't joe-job a SA dev's wife
score ADULT_DATING_COMPANY 20.000

BIN
sa-updates/languages
View File

Binary file not shown.