FutureQuest SpamAssassin Test & Scoring Chart

FutureQuest SpamAssassin Test & Scoring Chart

This is the current list of tests SpamAssassin performs on email with SpamAssassin Filtering enabled to determine if they're spam or not.

You may also test specific X-Spam-Status headers via the SpamAssassin Status Decoder.

Test Name	Area Tested	Description Of Test	Score Bayes off RBLs off	Score Bayes off RBLs on	Score Bayes on RBLs off	Score Bayes on RBLs on
ACCT_PHISHING_MANY	meta	Phishing for account information	`1.000`	`1.000`	`1.000`	`1.000`
ACT_NOW_CAPS	body	Talks about 'acting now' with capitals	`0.100`	`0.100`	`0.100`	`0.100`
AC_BR_BONANZA	rawbody	Too many newlines in a row... spammy template	`0.001`	`0.001`	`0.001`	`0.001`
AC_DIV_BONANZA	rawbody	Too many divs in a row... spammy template	`0.001`	`0.001`	`0.001`	`0.001`
AC_FROM_MANY_DOTS	meta	Multiple periods in From user name	`2.999`	`1.544`	`2.999`	`1.544`
AC_HTML_NONSENSE_TAGS	rawbody	Many consecutive multi-letter HTML tags, likely nonsense/spam	`1.999`	`1.999`	`1.999`	`1.999`
AC_POST_EXTRAS	meta	Suspicious URL	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS1	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS10	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS11	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS12	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS2	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS3	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS4	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS8	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
AC_SPAMMY_URI_PATTERNS9	meta	link combos match highly spammy template	`1.000`	`1.000`	`1.000`	`1.000`
ADMAIL	meta	"admail" and variants	`1.000`	`1.000`	`1.000`	`1.000`
ADMITS_SPAM	meta	Admits this is an ad	`1.000`	`1.000`	`1.000`	`1.000`
ADULT_DATING_COMPANY	meta	No description provided	`20.000`	`20.000`	`20.000`	`20.000`
ADVANCE_FEE_2_NEW_FORM	meta	Advance Fee fraud and a form	`1.000`	`1.000`	`1.000`	`1.000`
ADVANCE_FEE_2_NEW_FRM_MNY	meta	Advance Fee fraud form and lots of money	`1.000`	`1.000`	`1.000`	`1.000`
ADVANCE_FEE_2_NEW_MONEY	meta	Advance Fee fraud and lots of money	`2.000`	`1.999`	`2.000`	`1.999`
ADVANCE_FEE_3_NEW	meta	Appears to be advance fee fraud (Nigerian 419)	`3.499`	`3.499`	`3.499`	`3.499`
ADVANCE_FEE_3_NEW_FORM	meta	Advance Fee fraud and a form	`1.000`	`1.000`	`1.000`	`1.000`
ADVANCE_FEE_3_NEW_FRM_MNY	meta	Advance Fee fraud form and lots of money	`1.000`	`1.000`	`1.000`	`1.000`
ADVANCE_FEE_3_NEW_MONEY	meta	Advance Fee fraud and lots of money	`2.399`	`2.399`	`2.399`	`2.399`
ADVANCE_FEE_4_NEW	meta	Appears to be advance fee fraud (Nigerian 419)	`2.199`	`2.199`	`2.199`	`2.199`
ADVANCE_FEE_4_NEW_FORM	meta	Advance Fee fraud and a form	`1.000`	`1.000`	`1.000`	`1.000`
ADVANCE_FEE_4_NEW_FRM_MNY	meta	Advance Fee fraud form and lots of money	`0.001`	`0.001`	`0.001`	`0.001`
ADVANCE_FEE_4_NEW_MONEY	meta	Advance Fee fraud and lots of money	`2.485`	`2.499`	`2.485`	`2.499`
ADVANCE_FEE_5_NEW	meta	Appears to be advance fee fraud (Nigerian 419)	`2.199`	`0.821`	`2.199`	`0.821`
ADVANCE_FEE_5_NEW_FORM	meta	Advance Fee fraud and a form	`1.000`	`1.000`	`1.000`	`1.000`
ADVANCE_FEE_5_NEW_FRM_MNY	meta	Advance Fee fraud form and lots of money	`1.592`	`2.202`	`1.592`	`2.202`
ADVANCE_FEE_5_NEW_MONEY	meta	Advance Fee fraud and lots of money	`3.000`	`3.000`	`3.000`	`3.000`
AD_PREFS	body	Advertising preferences	`0.250`	`0.250`	`0.250`	`0.250`
ALIBABA_IMG_NOT_RCVD_ALI	meta	Alibaba hosted image but message not from Alibaba	`1.000`	`1.000`	`1.000`	`1.000`
ALL_TRUSTED	header	Passed through trusted hosts only via SMTP	`-1.000`	`-1.000`	`-1.000`	`-1.000`
AMAZON_IMG_NOT_RCVD_AMZN	meta	Amazon hosted image but message not from Amazon	`0.001`	`1.845`	`0.001`	`1.845`
ANY_BOUNCE_MESSAGE	meta	Message is some kind of bounce message	`0.100`	`0.100`	`0.100`	`0.100`
APOSTROPHE_FROM	header	From address contains an apostrophe	`0.148`	`0.786`	`0.651`	`0.545`
APP_DEVELOPMENT_FREEM	meta	App development pitch, freemail or CHN replyto	`1.000`	`1.000`	`1.000`	`1.000`
APP_DEVELOPMENT_NORDNS	meta	App development pitch, no rDNS	`1.000`	`1.000`	`1.000`	`1.000`
ARC_INVALID	meta	ARC signature exists, but is not valid	`0.100`	`0.100`	`0.100`	`0.100`
ARC_SIGNED	full	Message has a ARC signature	`0.001`	`0.001`	`0.001`	`0.001`
ARC_VALID	full	Message has a valid ARC signature	`-0.100`	`-0.100`	`-0.100`	`-0.100`
AWL	header	Adjusted score from AWL reputation of From: address	`1.000`	`1.000`	`1.000`	`1.000`
AXB_XMAILER_MIMEOLE_OL_024C2	meta	Yet another X header trait	`0.001`	`0.001`	`0.001`	`0.001`
AXB_X_FF_SEZ_S	header	Forefront sez this is spam	`2.700`	`1.196`	`2.700`	`1.196`
BAD_CREDIT	body	Eliminate Bad Credit	`0.100`	`0.100`	`0.100`	`0.100`
BAD_ENC_HEADER	header	Message has bad MIME encoding in the header	`0.001`	`0.001`	`0.001`	`0.001`
BANG_GUAR	body	Something is emphatically guaranteed	`1.000`	`1.000`	`1.000`	`1.000`
BANKING_LAWS	body	Talks about banking laws	`2.399`	`2.004`	`2.157`	`1.099`
BASE64_LENGTH_78_79	body	No description provided	`0.100`	`0.100`	`0.100`	`0.100`
BASE64_LENGTH_79_INF	body	base64 encoded email part uses line length greater than 79 characters	`1.379`	`2.019`	`0.583`	`1.502`
BAYES_00	body	Bayes spam probability is 0 to 1%	`-3.000`	`-3.000`	`-3.000`	`-3.000`
BAYES_05	body	Bayes spam probability is 1 to 5%	`-0.500`	`-0.500`	`-0.500`	`-0.500`
BAYES_20	body	Bayes spam probability is 5 to 20%	`-0.001`	`-0.001`	`-0.001`	`-0.001`
BAYES_40	body	Bayes spam probability is 20 to 40%	`-0.001`	`-0.001`	`-0.001`	`-0.001`
BAYES_50	body	Bayes spam probability is 40 to 60%	`2.000`	`2.000`	`2.000`	`2.000`
BAYES_60	body	Bayes spam probability is 60 to 80%	`3.000`	`3.000`	`3.000`	`3.000`
BAYES_80	body	Bayes spam probability is 80 to 95%	`4.000`	`4.000`	`4.000`	`4.000`
BAYES_95	body	Bayes spam probability is 95 to 99%	`5.000`	`5.000`	`5.000`	`5.000`
BAYES_99	body	Bayes spam probability is 99 to 100%	`6.000`	`6.000`	`6.000`	`6.000`
BAYES_999	body	Bayes spam probability is 99.9 to 100%	`7.000`	`7.000`	`7.000`	`7.000`
BEBEE_IMG_NOT_RCVD_BB	meta	Bebee hosted image but message not from Bebee	`1.000`	`1.000`	`1.000`	`1.000`
BIGNUM_EMAILS_FREEM	meta	Lots of email addresses/leads, free email account	`1.000`	`0.384`	`1.000`	`0.384`
BIGNUM_EMAILS_MANY	meta	Lots of email addresses/leads, over and over	`1.000`	`1.000`	`1.000`	`1.000`
BILLION_DOLLARS	body	Talks about lots of money	`0.001`	`1.451`	`1.229`	`1.638`
BITCOIN_BOMB	meta	BitCoin + bomb	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_DEADLINE	meta	BitCoin with a deadline	`1.500`	`1.449`	`1.500`	`1.449`
BITCOIN_EXTORT_01	meta	Extortion spam, pay via BitCoin	`4.500`	`0.941`	`4.500`	`0.941`
BITCOIN_EXTORT_02	meta	Extortion spam, pay via BitCoin	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_IMGUR	meta	Bitcoin + hosted image	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_MALF_HTML	meta	Bitcoin + malformed HTML	`3.499`	`3.084`	`3.499`	`3.084`
BITCOIN_MALWARE	meta	BitCoin + malware bragging	`2.094`	`2.501`	`2.094`	`2.501`
BITCOIN_OBFU_SUBJ	meta	Bitcoin + obfuscated subject	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_ONAN	meta	BitCoin + [censored]	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_PAY_ME	meta	Pay me via BitCoin	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_01	meta	BitCoin spam pattern 01	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_02	meta	BitCoin spam pattern 02	`0.001`	`0.001`	`0.001`	`0.001`
BITCOIN_SPAM_03	meta	BitCoin spam pattern 03	`1.000`	`2.499`	`1.000`	`2.499`
BITCOIN_SPAM_04	meta	BitCoin spam pattern 04	`1.000`	`0.184`	`1.000`	`0.184`
BITCOIN_SPAM_05	meta	BitCoin spam pattern 05	`0.001`	`2.475`	`0.001`	`2.475`
BITCOIN_SPAM_06	meta	BitCoin spam pattern 06	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_07	meta	BitCoin spam pattern 07	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_08	meta	BitCoin spam pattern 08	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_09	meta	BitCoin spam pattern 09	`1.000`	`1.092`	`1.000`	`1.092`
BITCOIN_SPAM_10	meta	BitCoin spam pattern 10	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_11	meta	BitCoin spam pattern 11	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPAM_12	meta	BitCoin spam pattern 12	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_SPF_ONLYALL	meta	Bitcoin from a domain specifically set to pass +all SPF	`0.001`	`1.000`	`0.001`	`1.000`
BITCOIN_WFH_01	meta	Work-from-Home + bitcoin	`1.000`	`1.000`	`1.000`	`1.000`
BITCOIN_XPRIO	meta	Bitcoin + priority	`0.234`	`0.001`	`0.234`	`0.001`
BITCOIN_YOUR_INFO	meta	BitCoin with your personal info	`3.000`	`1.481`	`3.000`	`1.481`
BODY_8BITS	body	Body includes 8 consecutive 8-bit characters	`1.500`	`1.500`	`1.500`	`1.500`
BODY_ENHANCEMENT	body	Information on growing body parts	`0.927`	`1.611`	`0.974`	`0.001`
BODY_ENHANCEMENT2	body	Information on getting larger body parts	`0.100`	`0.100`	`0.100`	`0.100`
BODY_SINGLE_URI	meta	Message body is only a URI	`1.004`	`0.302`	`1.004`	`0.302`
BODY_URI_ONLY	meta	Message body is only a URI in one line of text or for an image	`1.154`	`1.654`	`1.154`	`1.654`
BOGUS_MIME_VERSION	meta	Mime version header is bogus	`1.000`	`1.000`	`1.000`	`1.000`
BOGUS_MSM_HDRS	meta	Apparently bogus Microsoft email headers	`1.000`	`1.000`	`1.000`	`1.000`
BOMB_FREEM	meta	Bomb + freemail	`1.000`	`1.000`	`1.000`	`1.000`
BOMB_MONEY	meta	Bomb + money: bomb threat?	`1.000`	`1.000`	`1.000`	`1.000`
BOUNCE_MESSAGE	meta	MTA bounce message	`0.100`	`0.100`	`0.100`	`0.100`
BTC_ORG	meta	Bitcoin wallet ID + unusual header	`1.000`	`1.000`	`1.000`	`1.000`
BULK_RE_SUSP_NTLD	meta	Precedence bulk and RE: from a suspicious TLD	`1.000`	`1.000`	`1.000`	`1.000`
CANT_SEE_AD	meta	You really want to see our spam.	`1.000`	`1.000`	`1.000`	`1.000`
CHALLENGE_RESPONSE	meta	Challenge-Response message for mail you sent	`0.100`	`0.100`	`0.100`	`0.100`
CHARSET_FARAWAY	body	Character set indicates a foreign language	`3.200`	`3.200`	`3.200`	`3.200`
CHARSET_FARAWAY_HEADER	header	A foreign language charset used in headers	`3.200`	`3.200`	`3.200`	`3.200`
CK_HELO_GENERIC	header	Relay used name indicative of a Dynamic Pool or Generic rPTR	`0.249`	`0.001`	`0.249`	`0.001`
CN_B2B_SPAMMER	body	Chinese company introducing itself	`1.000`	`1.000`	`1.000`	`1.000`
COMMENT_GIBBERISH	meta	Nonsense in long HTML comment	`1.000`	`1.000`	`1.000`	`1.000`
CONTENT_AFTER_HTML	meta	More content after HTML close tag + other spam signs	`1.000`	`1.000`	`1.000`	`1.000`
CONTENT_AFTER_HTML_WEAK	meta	More content after HTML close tag	`1.000`	`1.000`	`1.000`	`1.000`
CRBOUNCE_MESSAGE	meta	Challenge-Response bounce message	`0.100`	`0.100`	`0.100`	`0.100`
CTE_8BIT_MISMATCH	meta	Header says 7bits but body disagrees	`0.999`	`0.163`	`0.999`	`0.163`
CTYPE_001C_B	header	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
CURR_PRICE	body	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
DATE_IN_FUTURE_03_06	header	Date: is 3 to 6 hours after Received: date	`3.399`	`2.426`	`2.997`	`3.027`
DATE_IN_FUTURE_06_12	header	Date: is 6 to 12 hours after Received: date	`2.899`	`0.001`	`2.222`	`1.947`
DATE_IN_FUTURE_12_24	header	Date: is 12 to 24 hours after Received: date	`2.603`	`2.489`	`3.199`	`3.199`
DATE_IN_FUTURE_24_48	header	Date: is 24 to 48 hours after Received: date	`2.598`	`1.248`	`0.001`	`2.048`
DATE_IN_FUTURE_48_96	header	Date: is 48 to 96 hours after Received: date	`2.384`	`0.813`	`1.078`	`2.181`
DATE_IN_PAST_03_06	header	Date: is 3 to 6 hours before Received: date	`2.399`	`1.076`	`1.200`	`1.592`
DATE_IN_PAST_06_12	header	Date: is 6 to 12 hours before Received: date	`1.699`	`1.103`	`1.274`	`1.543`
DATE_IN_PAST_12_24	header	Date: is 12 to 24 hours before Received: date	`0.001`	`0.804`	`1.190`	`1.049`
DATE_IN_PAST_24_48	header	Date: is 24 to 48 hours before Received: date	`1.109`	`0.485`	`0.624`	`1.340`
DATE_IN_PAST_96_XX	header	Date: is 96 hours or more before Received: date	`2.600`	`2.070`	`1.233`	`3.405`
DAY_I_EARNED	meta	Work-at-home spam	`1.000`	`1.000`	`1.000`	`1.000`
DCC_CHECK	full	Detected as bulk mail by DCC (dcc-servers.net)	`0.000`	`1.100`	`0.000`	`1.100`
DCC_REPUT_00_12	full	DCC reputation between 0 and 12 % (mostly ham)	`0.000`	`-0.800`	`0.000`	`-0.400`
DCC_REPUT_13_19	full	DCC reputation between 13 and 19 %	`0.000`	`-0.100`	`0.000`	`-0.100`
DCC_REPUT_70_89	full	DCC reputation between 70 and 89 %	`0.000`	`0.100`	`0.000`	`0.100`
DCC_REPUT_90_94	full	DCC reputation between 90 and 94 %	`0.000`	`0.400`	`0.000`	`0.600`
DCC_REPUT_95_98	full	DCC reputation between 95 and 98 % (mostly spam)	`0.000`	`0.700`	`0.000`	`1.000`
DCC_REPUT_99_100	full	DCC reputation between 99 % or higher (spam)	`0.000`	`1.200`	`0.000`	`1.400`
DC_GIF_UNO_LARGO	meta	Message contains a single large gif image	`0.001`	`1.323`	`0.053`	`2.176`
DC_IMAGE_SPAM_HTML	meta	Possible Image-only spam	`0.100`	`0.100`	`0.100`	`0.100`
DC_IMAGE_SPAM_TEXT	meta	Possible Image-only spam with little text	`0.100`	`0.100`	`0.100`	`0.100`
DC_PNG_UNO_LARGO	meta	Message contains a single large png image	`0.001`	`0.001`	`0.001`	`0.001`
DEAR_BENEFICIARY	body	Dear Beneficiary:	`0.699`	`0.001`	`0.699`	`0.001`
DEAR_FRIEND	body	Dear Friend? That's not very dear!	`2.683`	`2.604`	`1.801`	`2.577`
DEAR_SOMETHING	body	Contains 'Dear (something)'	`1.999`	`1.731`	`1.787`	`1.973`
DEAR_WINNER	body	Spam with generic salutation of "dear winner"	`3.099`	`3.099`	`2.309`	`3.099`
DIET_1	body	Lose Weight Spam	`0.714`	`0.000`	`0.399`	`0.001`
DIGEST_MULTIPLE	meta	Message hits more than one network digest check	`0.000`	`0.001`	`0.000`	`0.293`
DKIMDOMAIN_IN_DWL	???	No description provided	`0.000`	`-3.500`	`0.000`	`-3.500`
DKIMDOMAIN_IN_DWL_UNKNOWN	???	No description provided	`0.000`	`-0.010`	`0.000`	`-0.010`
DKIMWL_BL	meta	DKIMwl.org - Blocked sender	`0.001`	`1.295`	`0.001`	`1.295`
DKIMWL_BLOCKED	meta	ADMINISTRATOR NOTICE: The query to DKIMWL.org was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.	`0.001`	`0.001`	`0.001`	`0.001`
DKIMWL_WL_HIGH	meta	DKIMwl.org - High trust sender	`0.001`	`-0.001`	`0.001`	`-0.001`
DKIMWL_WL_MED	meta	DKIMwl.org - Medium trust sender	`0.001`	`-0.001`	`0.001`	`-0.001`
DKIMWL_WL_MEDHI	meta	DKIMwl.org - Medium-high trust sender	`0.001`	`-0.263`	`0.001`	`-0.263`
DKIM_ADSP_ALL	header	No valid author signature, domain signs all mail	`0.000`	`1.100`	`0.000`	`0.800`
DKIM_ADSP_CUSTOM_HIGH	header	No valid author signature, adsp_override is CUSTOM_HIGH	`0.001`	`0.001`	`0.001`	`0.001`
DKIM_ADSP_CUSTOM_LOW	header	No valid author signature, adsp_override is CUSTOM_LOW	`0.001`	`0.001`	`0.001`	`0.001`
DKIM_ADSP_CUSTOM_MED	header	No valid author signature, adsp_override is CUSTOM_MED	`0.001`	`0.001`	`0.001`	`0.001`
DKIM_ADSP_DISCARD	header	No valid author signature, domain signs all mail and suggests discarding the rest	`0.000`	`1.800`	`0.000`	`1.800`
DKIM_ADSP_NXDOMAIN	header	No valid author signature and domain not in DNS	`0.000`	`0.800`	`0.000`	`0.900`
DKIM_INVALID	meta	DKIM or DK signature exists, but is not valid	`0.100`	`0.100`	`0.100`	`0.100`
DKIM_SIGNED	full	Message has a DKIM or DK signature, not necessarily valid	`0.100`	`0.100`	`0.100`	`0.100`
DKIM_VALID	full	Message has at least one valid DKIM or DK signature	`-0.100`	`-0.100`	`-0.100`	`-0.100`
DKIM_VALID_AU	full	Message has a valid DKIM or DK signature from author's domain	`-0.100`	`-0.100`	`-0.100`	`-0.100`
DKIM_VALID_EF	full	Message has a valid DKIM or DK signature from envelope-from domain	`-0.100`	`-0.100`	`-0.100`	`-0.100`
DMARC_MISSING	header	Missing DMARC policy	`0.001`	`0.001`	`0.001`	`0.001`
DMARC_NONE	header	DMARC none policy	`0.001`	`0.898`	`0.001`	`0.898`
DMARC_PASS	header	DMARC pass policy	`-0.001`	`-0.001`	`-0.001`	`-0.001`
DMARC_QUAR	header	DMARC quarantine policy	`0.001`	`1.198`	`0.001`	`1.198`
DMARC_REJECT	header	DMARC reject policy	`0.001`	`1.797`	`0.001`	`1.797`
DOS_OE_TO_MX	meta	Delivered direct to MX with OE headers	`2.602`	`3.086`	`2.265`	`2.523`
DOS_OE_TO_MX_IMAGE	meta	Direct to MX with OE headers and an image	`2.886`	`1.886`	`2.425`	`3.699`
DOS_OUTLOOK_TO_MX	meta	Delivered direct to MX with Outlook headers	`2.636`	`1.449`	`1.737`	`2.845`
DOS_RCVD_IP_TWICE_C	header	Received from the same IP twice in a row (only one external relay; empty or IP helo)	`2.599`	`2.060`	`3.292`	`0.096`
DOS_STOCK_BAT	meta	Probable pump and dump stock spam	`0.001`	`0.001`	`0.001`	`0.001`
DOTGOV_IMAGE	meta	.gov URI + hosted image	`1.000`	`1.000`	`1.000`	`1.000`
DRUGS_ANXIETY	meta	Refers to an anxiety control drug	`0.100`	`0.100`	`0.100`	`0.100`
DRUGS_DIET	meta	Refers to a diet drug	`2.660`	`0.757`	`1.831`	`0.337`
DRUGS_ERECTILE	meta	Refers to an erectile drug	`1.778`	`2.221`	`1.299`	`1.994`
DRUGS_ERECTILE_OBFU	meta	Obfuscated reference to an erectile drug	`1.324`	`1.309`	`2.935`	`1.109`
DRUGS_MANYKINDS	meta	Refers to at least four kinds of drugs	`2.001`	`1.473`	`0.841`	`0.342`
DRUGS_MUSCLE	meta	Refers to a muscle relaxant	`0.001`	`2.499`	`0.392`	`0.164`
DRUGS_SMEAR1	body	Two or more drugs crammed together into one word	`3.300`	`2.051`	`3.148`	`0.235`
DRUGS_STOCK_MIMEOLE	???	No description provided	`2.699`	`1.681`	`2.478`	`1.321`
DRUG_ED_CAPS	body	Mentions an E.D. drug	`2.799`	`1.023`	`2.516`	`0.936`
DRUG_ED_ONLINE	body	Fast Viagra Delivery	`0.696`	`1.152`	`1.221`	`0.608`
DRUG_ED_SILD	body	Talks about an E.D. drug using its chemical name	`0.001`	`0.001`	`0.001`	`0.001`
DX_TEXT_02	body	"change your message stat"	`1.000`	`1.000`	`1.000`	`1.000`
DX_TEXT_03	body	"XXX Media Group"	`1.000`	`1.000`	`1.000`	`1.000`
DYNAMIC_IMGUR	meta	dynamic IP + hosted image	`1.000`	`1.000`	`1.000`	`1.000`
DYN_RDNS_AND_INLINE_IMAGE	meta	Contains image, and was sent by dynamic rDNS	`1.345`	`1.344`	`1.434`	`1.168`
DYN_RDNS_SHORT_HELO_HTML	meta	Sent by dynamic rDNS, short HELO, and HTML	`0.001`	`0.001`	`0.000`	`0.001`
DYN_RDNS_SHORT_HELO_IMAGE	meta	Short HELO string, dynamic rDNS, inline image	`1.825`	`2.516`	`2.285`	`1.013`
EBAY_IMG_NOT_RCVD_EBAY	meta	E-bay hosted image but message not from E-bay	`1.000`	`1.000`	`1.000`	`1.000`
EMPTY_MESSAGE	meta	Message appears to have no textual parts	`2.195`	`2.344`	`1.552`	`2.320`
EMRCP	body	"Excess Maximum Return Capital Profit" scam	`1.000`	`1.000`	`1.000`	`1.000`
EM_ROLEX	body	Message puts emphasis on the watch manufacturer	`0.595`	`1.309`	`2.068`	`0.618`
ENCRYPTED_MESSAGE	meta	Message is encrypted, not likely to be spam	`-1.000`	`-0.999`	`-1.000`	`-0.999`
END_FUTURE_EMAILS	meta	Spammy unsubscribe	`2.499`	`2.499`	`2.499`	`2.499`
ENGLISH_UCE_SUBJECT	header	Subject contains an English UCE tag	`0.953`	`1.542`	`2.569`	`2.899`
ENVFROM_GOOG_TRIX	meta	From suspicious Google subdomain	`1.000`	`1.000`	`1.000`	`1.000`
ENV_AND_HDR_SPF_MATCH	meta	Env and Hdr From used in default SPF WL Match	`-0.500`	`-0.500`	`-0.500`	`-0.500`
EXCUSE_24	body	Claims you wanted this ad	`1.000`	`1.000`	`1.000`	`1.000`
EXCUSE_4	body	Claims you can be removed from the list	`2.399`	`1.687`	`2.399`	`1.325`
EXCUSE_REMOVE	body	Talks about how to be removed from mailings	`2.907`	`2.992`	`3.299`	`3.299`
FACEBOOK_IMG_NOT_RCVD_FB	meta	Facebook hosted image but message not from Facebook	`1.000`	`1.551`	`1.000`	`1.551`
FAKE_REPLY_C	meta	No description provided	`0.688`	`0.001`	`2.553`	`1.486`
FBI_MONEY	meta	The FBI wants to give you lots of money?	`1.000`	`1.000`	`1.000`	`1.000`
FBI_SPOOF	meta	Claims to be FBI, but not from FBI domain	`1.000`	`1.000`	`1.000`	`1.000`
FILL_THIS_FORM	meta	Fill in a form with personal information	`0.001`	`0.001`	`0.001`	`0.001`
FILL_THIS_FORM_FRAUD_PHISH	???	No description provided	`1.195`	`0.396`	`0.615`	`0.334`
FILL_THIS_FORM_LOAN	???	No description provided	`2.092`	`2.237`	`1.836`	`2.880`
FILL_THIS_FORM_LONG	meta	Fill in a form with personal information	`2.000`	`2.000`	`2.000`	`2.000`
FIN_FREE	body	Freedom of a financial nature	`0.100`	`0.100`	`0.100`	`0.100`
FONT_INVIS_DIRECT	meta	Invisible text + direct-to-MX	`0.001`	`0.001`	`0.001`	`0.001`
FONT_INVIS_DOTGOV	meta	Invisible text + .gov URI	`1.000`	`1.000`	`1.000`	`1.000`
FONT_INVIS_HTML_NOHTML	meta	Invisible text + malformed HTML	`1.000`	`1.000`	`1.000`	`1.000`
FONT_INVIS_LONG_LINE	meta	Invisible text + long lines	`1.286`	`0.726`	`1.286`	`0.726`
FONT_INVIS_MSGID	meta	Invisible text + suspicious message ID	`1.155`	`1.438`	`1.155`	`1.438`
FONT_INVIS_NORDNS	meta	Invisible text + no rDNS	`1.000`	`1.000`	`1.000`	`1.000`
FONT_INVIS_POSTEXTRAS	meta	Invisible text + suspicious URI	`0.002`	`1.896`	`0.002`	`1.896`
FORGED_GMAIL_RCVD	header	'From' gmail.com does not match 'Received' headers	`1.000`	`1.000`	`1.000`	`1.000`
FORGED_HOTMAIL_RCVD2	header	hotmail.com 'From' address, but no 'Received:'	`0.001`	`1.187`	`0.698`	`0.874`
FORGED_MSGID_EXCITE	meta	Message-ID is forged, (excite.com)	`2.399`	`1.899`	`1.649`	`0.528`
FORGED_MSGID_YAHOO	meta	Message-ID is forged, (yahoo.com)	`0.100`	`0.100`	`0.100`	`0.100`
FORGED_MUA_EUDORA	meta	Forged mail pretending to be from Eudora	`2.828`	`2.510`	`1.962`	`0.001`
FORGED_MUA_IMS	meta	Forged mail pretending to be from IMS	`2.399`	`2.399`	`2.399`	`1.943`
FORGED_MUA_MOZILLA	meta	Forged mail pretending to be from Mozilla	`2.399`	`1.596`	`2.399`	`2.309`
FORGED_MUA_OIMO	meta	Forged mail pretending to be from MS Outlook IMO	`2.600`	`2.599`	`2.599`	`2.599`
FORGED_MUA_OUTLOOK	meta	Forged mail pretending to be from MS Outlook	`3.999`	`2.785`	`2.500`	`1.927`
FORGED_MUA_THEBAT_BOUN	meta	Mail pretending to be from The Bat! (boundary)	`3.046`	`3.220`	`3.207`	`3.399`
FORGED_OUTLOOK_HTML	meta	Outlook can't send HTML message only	`0.001`	`0.001`	`0.001`	`0.021`
FORGED_OUTLOOK_TAGS	meta	Outlook can't send HTML in this format	`0.003`	`0.565`	`0.001`	`0.052`
FORGED_SPF_HELO	meta	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
FORGED_TELESP_RCVD	header	Contains forged hostname for a DSL IP in Brazil	`2.499`	`2.499`	`2.499`	`1.841`
FORGED_YAHOO_RCVD	header	'From' yahoo.com does not match 'Received' headers	`2.397`	`1.022`	`2.599`	`1.630`
FORM_FRAUD	meta	Fill a form and a fraud phrase	`0.999`	`1.000`	`0.999`	`1.000`
FORM_FRAUD_3	meta	Fill a form and several fraud phrases	`1.000`	`1.000`	`1.000`	`1.000`
FORM_FRAUD_5	meta	Fill a form and many fraud phrases	`0.001`	`0.001`	`0.001`	`0.001`
FOUND_YOU	meta	I found you...	`1.000`	`1.000`	`1.000`	`1.000`
FREEMAIL_ENVFROM_END_DIGIT	header	Envelope-from freemail username ends in digit	`0.250`	`0.250`	`0.250`	`0.250`
FREEMAIL_FORGED_FROMDOMAIN	meta	2nd level domains in From and EnvelopeFrom freemail headers are different	`0.250`	`0.250`	`0.250`	`0.250`
FREEMAIL_FORGED_REPLYTO	meta	Freemail in Reply-To, but not From	`1.199`	`2.503`	`1.204`	`2.095`
FREEMAIL_FROM	header	Sender email is commonly abused enduser mail provider	`0.001`	`0.001`	`0.001`	`0.001`
FREEMAIL_REPLY	meta	From and body contain different freemails	`1.000`	`1.000`	`1.000`	`1.000`
FREEMAIL_REPLYTO	meta	Reply-To/From or Reply-To/body contain different freemails	`1.000`	`1.000`	`1.000`	`1.000`
FREEMAIL_REPLYTO_END_DIGIT	header	Reply-To freemail username ends in digit	`0.250`	`0.250`	`0.250`	`0.250`
FREEMAIL_WFH_01	meta	Work-from-Home + freemail	`1.000`	`1.000`	`1.000`	`1.000`
FREEM_FRNUM_UNICD_EMPTY	meta	Numeric freemail From address, unicode From name and Subject, empty body	`1.000`	`1.000`	`1.000`	`1.000`
FREE_QUOTE_INSTANT	body	Free express or no-obligation quote	`2.700`	`2.699`	`2.699`	`1.297`
FRNAME_IN_MSG_XPRIO_NO_SUB	meta	From name in message + X-Priority + short or no subject	`1.000`	`1.000`	`1.000`	`1.000`
FROM_ADDR_WS	meta	Malformed From address	`2.999`	`2.349`	`2.999`	`2.349`
FROM_BANK_NOAUTH	meta	From Bank domain but no SPF or DKIM	`0.001`	`1.000`	`0.001`	`1.000`
FROM_BLANK_NAME	header	From: contains empty name	`2.099`	`2.099`	`2.099`	`0.723`
FROM_DOMAIN_NOVOWEL	header	From: domain has series of non-vowel letters	`0.500`	`0.500`	`0.500`	`0.500`
FROM_EXCESS_BASE64	meta	From: base64 encoded unnecessarily	`0.001`	`0.001`	`0.001`	`0.001`
FROM_FMBLA_NDBLOCKED	meta	ADMINISTRATOR NOTICE: The query to fresh.fmb.la was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.	`0.001`	`0.001`	`0.001`	`0.001`
FROM_FMBLA_NEWDOM	meta	From domain was registered in last 7 days	`0.001`	`1.000`	`0.001`	`1.000`
FROM_FMBLA_NEWDOM14	meta	From domain was registered in last 7-14 days	`0.001`	`1.000`	`0.001`	`1.000`
FROM_FMBLA_NEWDOM28	meta	From domain was registered in last 14-28 days	`0.001`	`0.799`	`0.001`	`0.799`
FROM_GOV_DKIM_AU	meta	From Government address and DKIM signed	`0.001`	`-0.766`	`0.001`	`-0.766`
FROM_GOV_REPLYTO_FREEMAIL	meta	From Government domain but ReplyTo is FREEMAIL	`0.001`	`1.000`	`0.001`	`1.000`
FROM_GOV_SPOOF	meta	From Government domain but matches SPOOFED	`0.001`	`1.000`	`0.001`	`1.000`
FROM_ILLEGAL_CHARS	meta	From: has too many raw illegal characters	`2.192`	`2.059`	`0.240`	`0.036`
FROM_IN_TO_AND_SUBJ	meta	From address is in To and Subject	`1.000`	`1.000`	`1.000`	`1.000`
FROM_LOCAL_DIGITS	header	From: localpart has long digit sequence	`0.001`	`0.001`	`0.001`	`0.001`
FROM_LOCAL_HEX	header	From: localpart has long hexadecimal sequence	`0.000`	`0.331`	`0.001`	`0.006`
FROM_LOCAL_NOVOWEL	header	From: localpart has series of non-vowel letters	`0.500`	`0.500`	`0.500`	`0.500`
FROM_MISSPACED	meta	From: missing whitespace	`1.999`	`1.601`	`1.999`	`1.601`
FROM_MISSP_EH_MATCH	meta	From misspaced, matches envelope	`2.000`	`1.399`	`2.000`	`1.399`
FROM_MISSP_FREEMAIL	meta	From misspaced + freemail provider	`2.699`	`0.001`	`2.699`	`0.001`
FROM_MISSP_MSFT	meta	From misspaced + supposed Microsoft tool	`0.601`	`0.001`	`0.601`	`0.001`
FROM_MISSP_REPLYTO	meta	From misspaced, has Reply-To	`1.199`	`0.901`	`1.199`	`0.901`
FROM_MISSP_SPF_FAIL	meta	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
FROM_MISSP_USER	meta	From misspaced, from "User"	`0.001`	`0.001`	`0.001`	`0.001`
FROM_NEWDOM_BTC	meta	Newdomain with Bitcoin ID	`0.001`	`1.000`	`0.001`	`1.000`
FROM_NO_USER	header	From: has no local-part before @ sign	`0.001`	`2.599`	`0.019`	`0.798`
FROM_NTLD_LINKBAIT	meta	From abused NTLD with little more than a URI	`1.000`	`1.000`	`1.000`	`1.000`
FROM_NTLD_REPLY_FREEMAIL	meta	From abused NTLD and Reply-To is FREEMAIL	`1.000`	`1.000`	`1.000`	`1.000`
FROM_NUMBERO_NEWDOMAIN	meta	Fingerprint and new domain	`0.001`	`1.000`	`0.001`	`1.000`
FROM_OFFERS	header	From address is "at something-offers"	`1.000`	`1.000`	`1.000`	`1.000`
FROM_PAYPAL_SPOOF	meta	From PayPal domain but matches SPOOFED	`0.001`	`1.451`	`0.001`	`1.451`
FROM_STARTS_WITH_NUMS	header	From: starts with several numbers	`2.801`	`0.553`	`1.201`	`0.738`
FROM_SUSPICIOUS_NTLD	meta	From abused NTLD	`0.499`	`0.499`	`0.499`	`0.499`
FROM_SUSPICIOUS_NTLD_FP	meta	From abused NTLD	`1.999`	`1.999`	`1.999`	`1.999`
FROM_UNBAL1	header	From with unbalanced angle brackets, '>' missing	`2.299`	`2.299`	`2.299`	`2.299`
FSL_BULK_SIG	meta	Bulk signature with no Unsubscribe	`0.001`	`0.815`	`0.001`	`0.815`
FSL_CTYPE_WIN1251	header	Content-Type only seen in 419 spam	`0.001`	`0.001`	`0.001`	`0.001`
FSL_FAKE_HOTMAIL_RVCD	header	No description provided	`2.631`	`1.816`	`2.011`	`2.365`
FSL_HAS_TINYURL	uri	No description provided	`2.799`	`2.699`	`2.799`	`2.699`
FSL_HELO_BARE_IP_1	meta	No description provided	`2.598`	`1.426`	`3.099`	`2.347`
FSL_HELO_DEVICE	header	No description provided	`0.100`	`0.100`	`0.100`	`0.100`
FSL_HELO_NON_FQDN_1	header	No description provided	`2.361`	`0.001`	`1.783`	`0.001`
FSL_INTERIA_ABUSE	uri	No description provided	`3.899`	`2.664`	`3.080`	`3.106`
FSL_NEW_HELO_USER	meta	Spam's using Helo and User	`0.001`	`0.001`	`0.001`	`0.001`
FUZZY_AMAZON	body	Obfuscated "amazon"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_ANDROID	body	Obfuscated "android"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_APPLE	body	Obfuscated "apple"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_BITCOIN	body	Obfuscated "Bitcoin"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_BROWSER	body	Obfuscated "browser"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_BTC_WALLET	meta	Heavily obfuscated "bitcoin wallet"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_CLICK_HERE	body	Obfuscated "click here"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_CPILL	body	Attempt to obfuscate words in spam	`0.001`	`0.001`	`0.001`	`0.001`
FUZZY_CREDIT	body	Attempt to obfuscate words in spam	`1.699`	`1.413`	`0.601`	`1.678`
FUZZY_DR_OZ	meta	Obfuscated Doctor Oz	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_FACEBOOK	body	Obfuscated "facebook"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_IMPORTANT	body	Obfuscated "important"	`3.799`	`0.633`	`3.799`	`0.633`
FUZZY_MICROSOFT	body	Obfuscated "microsoft"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_MILLION	body	Attempt to obfuscate words in spam	`0.100`	`0.100`	`0.100`	`0.100`
FUZZY_MONERO	meta	Obfuscated "Monero"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_NORTON	body	Obfuscated "norton"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_OVERSTOCK	body	Obfuscated "overstock"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_PAYPAL	body	Obfuscated "paypal"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_PHARMACY	body	Attempt to obfuscate words in spam	`2.960`	`3.299`	`1.967`	`1.353`
FUZZY_PHENT	body	Attempt to obfuscate words in spam	`2.799`	`1.647`	`1.540`	`2.662`
FUZZY_PORN	meta	Obfuscated "Pornography" or "Pornographic"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_PRICES	body	Attempt to obfuscate words in spam	`1.821`	`0.720`	`2.210`	`2.311`
FUZZY_PRIVACY	body	Obfuscated "privacy"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_PROMOTION	body	Obfuscated "promotion"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_SAVINGS	body	Obfuscated "savings"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_SECURITY	body	Obfuscated "security"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_UNSUBSCRIBE	body	Obfuscated "unsubscribe"	`1.000`	`1.000`	`1.000`	`1.000`
FUZZY_VPILL	body	Attempt to obfuscate words in spam	`0.001`	`0.494`	`0.796`	`1.014`
FUZZY_WALLET	body	Obfuscated "Wallet"	`1.799`	`0.078`	`1.799`	`0.078`
FUZZY_XPILL	body	Attempt to obfuscate words in spam	`0.100`	`0.100`	`0.100`	`0.100`
GAPPY_SALES_LEADS_FREEM	meta	Obfuscated marketing text, freemail or CHN replyto	`1.000`	`1.000`	`1.000`	`1.000`
GAPPY_SUBJECT	meta	Subject: contains G.a.p.p.y-T.e.x.t	`0.100`	`0.100`	`0.100`	`0.100`
GB_BITCOIN_CP	meta	Localized Bitcoin scam	`2.977`	`0.598`	`2.977`	`0.598`
GB_BITCOIN_NH	meta	Localized Bitcoin scam	`1.000`	`1.980`	`1.000`	`1.980`
GB_CUSTOM_HTM_URI	meta	Custom html uri	`1.499`	`0.001`	`1.499`	`0.001`
GB_FAKE_RF_SHORT	meta	Fake reply or forward with url shortener	`1.000`	`1.000`	`1.000`	`1.000`
GB_FORGED_MUA_POSTFIX	meta	Forged Postfix mua headers	`1.000`	`1.000`	`1.000`	`1.000`
GB_FREEMAIL_DISPTO	meta	Disposition-Notification-To/From or Disposition-Notification-To/body contain different freemails	`0.001`	`0.001`	`0.001`	`0.001`
GB_FREEMAIL_DISPTO_NOTFREEM	meta	Disposition-Notification-To/From contain different freemails but mailfrom is not a freemail	`0.500`	`0.500`	`0.500`	`0.500`
GB_GOOGLE_OBFUR	uri	Obfuscate url through Google redirect	`0.750`	`0.750`	`0.750`	`0.750`
GB_HASHBL_BTC	body	Message contains BTC address found on BTCBL	`0.001`	`0.504`	`0.001`	`0.504`
GB_STORAGE_GOOGLE_EMAIL	uri	Google storage cloud abuse	`1.000`	`1.000`	`1.000`	`1.000`
GB_URI_FLEEK_STO_HTM	uri	Html file stored on Fleek cloud	`1.000`	`1.000`	`1.000`	`1.000`
GMD_PDF_EMPTY_BODY	body	Attached PDF with empty message body	`0.250`	`0.250`	`0.250`	`0.250`
GMD_PDF_ENCRYPTED	body	Attached PDF is encrypted	`0.600`	`0.600`	`0.600`	`0.600`
GMD_PDF_HORIZ	body	Contains pdf 100-240 (high) x 450-800 (wide)	`0.250`	`0.250`	`0.250`	`0.250`
GMD_PDF_SQUARE	body	Contains pdf 180-360 (high) x 180-360 (wide)	`0.500`	`0.500`	`0.500`	`0.500`
GMD_PDF_VERT	body	Contains pdf 450-800 (high) x 100-240 (wide)	`0.900`	`0.900`	`0.900`	`0.900`
GMD_PRODUCER_EASYPDF	body	PDF producer was BCL easyPDF	`0.250`	`0.250`	`0.250`	`0.250`
GMD_PRODUCER_GPL	body	PDF producer was GPL Ghostscript	`0.250`	`0.250`	`0.250`	`0.250`
GMD_PRODUCER_POWERPDF	body	PDF producer was PowerPDF	`0.250`	`0.250`	`0.250`	`0.250`
GOOGLE_DOCS_PHISH	meta	Possible phishing via a Google Docs form	`1.000`	`1.000`	`1.000`	`1.000`
GOOGLE_DOCS_PHISH_MANY	meta	Phishing via a Google Docs form	`1.000`	`1.000`	`1.000`	`1.000`
GOOGLE_DOC_SUSP	meta	Suspicious use of Google Docs	`1.000`	`1.000`	`1.000`	`1.000`
GOOGLE_DRIVE_REPLY_BAD_NTLD	meta	From Google Drive and Reply-To is from a suspicious TLD	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_MALWARE_DNLD	meta	File download via Google - Malware?	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_REDIR_DOCUSIGN	uri	Indirect docusign link, probable phishing	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_REDIR_HTML_ONLY	meta	Google redirect to obscure spamvertised website + HTML only	`1.999`	`1.999`	`1.999`	`1.999`
GOOG_REDIR_NORDNS	meta	Google redirect to obscure spamvertised website + no rDNS	`2.600`	`2.900`	`2.600`	`2.900`
GOOG_REDIR_SHORT	meta	Google redirect to obscure spamvertised website + short message	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_STO_EMAIL_PHISH	meta	Possible phishing with google hosted content URI having email address	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_STO_HTML_PHISH	meta	Possible phishing with google content hosting to avoid URIBL	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_STO_HTML_PHISH_MANY	meta	Phishing with google content hosting to avoid URIBL	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_STO_IMG_HTML	meta	Apparently using google content hosting to avoid URIBL	`1.000`	`1.000`	`1.000`	`1.000`
GOOG_STO_IMG_NOHTML	meta	Apparently using google content hosting to avoid URIBL	`1.000`	`2.500`	`1.000`	`2.500`
GOOG_STO_NOIMG_HTML	meta	Apparently using google content hosting to avoid URIBL	`3.000`	`2.949`	`3.000`	`2.949`
GTUBE	body	Generic Test for Unsolicited Bulk Email	`1000.000`	`1000.000`	`1000.000`	`1000.000`
GUARANTEED_100_PERCENT	body	One hundred percent guaranteed	`2.699`	`2.699`	`2.480`	`2.699`
HAS_X_NO_RELAY	meta	Has spammy header	`1.000`	`1.000`	`1.000`	`1.000`
HAS_X_OUTGOING_SPAM_STAT	meta	Has header claiming outbound spam scan - why trust the results?	`0.502`	`0.001`	`0.502`	`0.001`
HDRS_LCASE	meta	Odd capitalization of message header	`0.001`	`0.100`	`0.001`	`0.100`
HDRS_LCASE_IMGONLY	meta	Odd capitalization of message headers + image-only HTML	`0.100`	`0.099`	`0.100`	`0.099`
HDRS_MISSP	meta	Misspaced headers	`2.499`	`0.718`	`2.499`	`0.718`
HDR_ORDER_FTSDMCXX_DIRECT	meta	Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX	`0.865`	`0.001`	`0.865`	`0.001`
HDR_ORDER_FTSDMCXX_NORDNS	meta	Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS	`0.001`	`0.001`	`0.001`	`0.001`
HEADER_FROM_DIFFERENT_DOMAINS	header	From and EnvelopeFrom 2nd level mail domains are different	`0.250`	`0.250`	`0.250`	`0.250`
HEADER_SPAM	header	Bulk email fingerprint (header-based) found	`2.499`	`2.499`	`1.994`	`0.585`
HELO_DYNAMIC_CHELLO_NL	header	Relay HELO'd using suspicious hostname (Chello.nl)	`2.412`	`1.918`	`2.019`	`2.428`
HELO_DYNAMIC_DHCP	meta	Relay HELO'd using suspicious hostname (DHCP)	`2.602`	`0.841`	`1.537`	`0.206`
HELO_DYNAMIC_DIALIN	header	Relay HELO'd using suspicious hostname (T-Dialin)	`2.629`	`3.233`	`2.186`	`1.366`
HELO_DYNAMIC_HCC	meta	Relay HELO'd using suspicious hostname (HCC)	`4.299`	`2.514`	`2.931`	`2.762`
HELO_DYNAMIC_HEXIP	header	Relay HELO'd using suspicious hostname (Hex IP)	`2.321`	`0.511`	`1.773`	`1.789`
HELO_DYNAMIC_HOME_NL	header	Relay HELO'd using suspicious hostname (Home.nl)	`2.385`	`1.530`	`1.024`	`1.459`
HELO_DYNAMIC_IPADDR	meta	Relay HELO'd using suspicious hostname (IP addr 1)	`2.633`	`3.243`	`3.680`	`1.951`
HELO_DYNAMIC_IPADDR2	meta	Relay HELO'd using suspicious hostname (IP addr 2)	`2.815`	`3.888`	`3.728`	`3.607`
HELO_DYNAMIC_SPLIT_IP	header	Relay HELO'd using suspicious hostname (Split IP)	`3.031`	`2.893`	`4.225`	`3.482`
HELO_LH_HOME	???	No description provided	`0.001`	`2.023`	`0.537`	`1.736`
HELO_LOCALHOST	header	No description provided	`2.639`	`3.603`	`2.915`	`3.828`
HELO_MISC_IP	meta	Looking for more Dynamic IP Relays	`0.250`	`0.001`	`0.250`	`0.001`
HELO_NO_DOMAIN	meta	Relay reports its domain incorrectly	`0.001`	`0.001`	`0.001`	`0.001`
HELO_OEM	header	No description provided	`2.899`	`2.899`	`1.234`	`0.270`
HELO_STATIC_HOST	meta	Relay HELO'd using static hostname	`-0.001`	`-0.001`	`-0.001`	`-0.001`
HEXHASH_WORD	meta	Multiple instances of word + hexadecimal hash	`1.000`	`1.973`	`1.000`	`1.973`
HIDE_WIN_STATUS	rawbody	Javascript to hide URLs in browser	`0.001`	`0.001`	`0.001`	`0.001`
HK_CTE_RAW	mimeheader	No description provided	`1.000`	`1.000`	`1.000`	`1.000`
HK_LOTTO	meta	No description provided	`1.000`	`0.120`	`1.000`	`0.120`
HK_NAME_DRUGS	header	From name contains drugs	`4.299`	`0.001`	`3.077`	`0.552`
HK_NAME_MR_MRS	meta	No description provided	`0.999`	`0.999`	`0.999`	`0.999`
HK_RANDOM_ENVFROM	header	Envelope sender username looks random	`0.387`	`0.999`	`0.387`	`0.999`
HK_RANDOM_FROM	header	From username looks random	`1.000`	`1.000`	`1.000`	`1.000`
HK_RANDOM_REPLYTO	header	Reply-To username looks random	`0.999`	`1.000`	`0.999`	`1.000`
HK_RCVD_IP_MULTICAST	header	No description provided	`1.000`	`1.000`	`1.000`	`1.000`
HK_SCAM	meta	No description provided	`1.999`	`1.999`	`1.999`	`1.999`
HK_WIN	meta	No description provided	`1.000`	`1.000`	`1.000`	`1.000`
HOSTED_IMG_DIRECT_MX	meta	Image hosted at large ecomm, CDN or hosting site, message direct-to-mx	`0.001`	`2.707`	`0.001`	`2.707`
HOSTED_IMG_DQ_UNSUB	meta	Image hosted at large ecomm site, IP addr unsub link	`1.000`	`1.000`	`1.000`	`1.000`
HOSTED_IMG_FREEM	meta	Image hosted at large ecomm, CDN or hosting site or redirected, freemail from or reply-to	`1.000`	`1.000`	`1.000`	`1.000`
HOSTED_IMG_MULTI	meta	Multiple images hosted at different large ecomm, CDN or hosting sites, free image sites, or redirected	`1.000`	`1.000`	`1.000`	`1.000`
HOSTED_IMG_MULTI_PUB_01	meta	Multiple hosted images at public site	`1.000`	`2.999`	`1.000`	`2.999`
HTML_CHARSET_FARAWAY	meta	A foreign language charset used in HTML markup	`0.500`	`0.500`	`0.500`	`0.500`
HTML_COMMENT_SAVED_URL	body	HTML message is a saved web page	`0.198`	`0.357`	`0.899`	`1.391`
HTML_EMBEDS	body	HTML with embedded plugin object	`0.001`	`0.001`	`0.001`	`0.001`
HTML_ENTITY_ASCII	meta	Obfuscated ASCII	`2.999`	`2.999`	`2.999`	`2.999`
HTML_ENTITY_ASCII_TINY	meta	Obfuscated ASCII + tiny fonts	`1.000`	`1.000`	`1.000`	`1.000`
HTML_EXTRA_CLOSE	body	HTML contains far too many close tags	`0.001`	`0.001`	`0.001`	`0.001`
HTML_FONT_FACE_BAD	body	HTML font face is not a word	`0.001`	`0.001`	`0.001`	`0.001`
HTML_FONT_LOW_CONTRAST	body	HTML font color similar or identical to background	`0.713`	`0.001`	`0.786`	`0.001`
HTML_FONT_SIZE_HUGE	body	HTML font size is huge	`0.001`	`0.001`	`0.001`	`0.001`
HTML_FONT_SIZE_LARGE	body	HTML font size is large	`0.001`	`0.001`	`0.001`	`0.001`
HTML_FONT_TINY_NORDNS	meta	Font too small to read, no rDNS	`1.850`	`1.823`	`1.850`	`1.823`
HTML_IMAGE_ONLY_04	body	HTML: images with 0-400 bytes of words	`1.680`	`0.342`	`1.799`	`1.172`
HTML_IMAGE_ONLY_08	body	HTML: images with 400-800 bytes of words	`0.585`	`1.781`	`1.845`	`1.651`
HTML_IMAGE_ONLY_12	body	HTML: images with 800-1200 bytes of words	`1.381`	`1.629`	`1.400`	`2.059`
HTML_IMAGE_ONLY_16	body	HTML: images with 1200-1600 bytes of words	`1.969`	`1.048`	`1.199`	`1.092`
HTML_IMAGE_ONLY_20	body	HTML: images with 1600-2000 bytes of words	`2.109`	`0.700`	`1.300`	`1.546`
HTML_IMAGE_ONLY_24	body	HTML: images with 2000-2400 bytes of words	`2.799`	`1.282`	`1.328`	`1.618`
HTML_IMAGE_ONLY_28	body	HTML: images with 2400-2800 bytes of words	`2.799`	`0.726`	`1.512`	`1.404`
HTML_IMAGE_ONLY_32	body	HTML: images with 2800-3200 bytes of words	`2.196`	`0.001`	`1.172`	`0.001`
HTML_IMAGE_RATIO_02	body	HTML has a low ratio of text to image area	`0.001`	`0.001`	`0.001`	`0.001`
HTML_IMAGE_RATIO_04	body	HTML has a low ratio of text to image area	`0.001`	`0.001`	`0.001`	`0.001`
HTML_IMAGE_RATIO_06	body	HTML has a low ratio of text to image area	`0.001`	`0.001`	`0.001`	`0.001`
HTML_IMAGE_RATIO_08	body	HTML has a low ratio of text to image area	`0.001`	`0.001`	`0.001`	`0.001`
HTML_MESSAGE	body	HTML included in message	`0.001`	`0.001`	`0.001`	`0.001`
HTML_MIME_NO_HTML_TAG	meta	HTML-only message, but there is no HTML tag	`0.001`	`0.635`	`0.001`	`0.377`
HTML_NONELEMENT_30_40	body	30% to 40% of HTML elements are non-standard	`0.000`	`0.001`	`0.308`	`0.001`
HTML_OBFUSCATE_05_10	body	Message is 5% to 10% HTML obfuscation	`0.601`	`0.001`	`0.718`	`0.260`
HTML_OBFUSCATE_10_20	body	Message is 10% to 20% HTML obfuscation	`0.174`	`1.162`	`0.588`	`0.093`
HTML_OBFUSCATE_20_30	body	Message is 20% to 30% HTML obfuscation	`2.499`	`2.441`	`1.449`	`1.999`
HTML_OBFUSCATE_90_100	body	Message is 90% to 100% HTML obfuscation	`2.000`	`2.000`	`2.000`	`2.000`
HTML_OFF_PAGE	meta	HTML element rendered well off the displayed page	`1.932`	`1.000`	`1.932`	`1.000`
HTML_SHORT_CENTER	meta	HTML is very short with CENTER tag	`3.799`	`3.421`	`2.611`	`0.743`
HTML_SHORT_LINK_IMG_1	meta	HTML is very short with a linked image	`2.215`	`0.139`	`0.480`	`0.001`
HTML_SHORT_LINK_IMG_2	meta	HTML is very short with a linked image	`1.419`	`0.259`	`0.603`	`0.001`
HTML_SHORT_LINK_IMG_3	meta	HTML is very short with a linked image	`0.691`	`0.328`	`0.001`	`0.148`
HTML_SHRT_CMNT_OBFU_MANY	meta	Obfuscation with many short HTML comments	`1.000`	`1.000`	`1.000`	`1.000`
HTML_SINGLET_MANY	meta	Many single-letter HTML format blocks	`2.499`	`2.455`	`2.499`	`2.455`
HTML_TAG_BALANCE_BODY	body	HTML has unbalanced "body" tags	`0.100`	`0.100`	`0.100`	`0.100`
HTML_TAG_BALANCE_CENTER	meta	Malformatted HTML	`2.899`	`2.799`	`2.899`	`2.799`
HTML_TAG_BALANCE_HEAD	body	HTML has unbalanced "head" tags	`0.520`	`0.000`	`0.600`	`0.817`
HTML_TEXT_INVISIBLE_FONT	meta	HTML hidden text - word obfuscation?	`1.402`	`1.111`	`1.402`	`1.111`
HTML_TEXT_INVISIBLE_STYLE	meta	HTML hidden text + other spam signs	`2.050`	`1.207`	`2.050`	`1.207`
HTML_TITLE_SUBJ_DIFF	meta	No description provided	`1.149`	`2.171`	`1.801`	`2.036`
HTTPS_HTTP_MISMATCH	body	No description provided	`0.100`	`0.100`	`0.100`	`0.100`
HTTP_ESCAPED_HOST	uri	Uses %-escapes inside a URL's hostname	`0.100`	`0.100`	`0.100`	`0.100`
HTTP_EXCESSIVE_ESCAPES	uri	Completely unnecessary %-escapes inside a URL	`0.001`	`0.001`	`0.001`	`0.001`
IMG_ONLY_FM_DOM_INFO	meta	HTML image-only message from .info domain	`1.000`	`1.000`	`1.000`	`1.000`
IMPOTENCE	body	Impotence cure	`1.539`	`2.144`	`3.028`	`1.374`
INVALID_DATE	header	Invalid Date: header (not RFC 2822)	`1.701`	`0.432`	`1.200`	`1.096`
INVALID_DATE_TZ_ABSURD	header	Invalid Date: header (timezone does not exist)	`0.262`	`0.632`	`0.706`	`0.491`
INVALID_MSGID	meta	Message-Id is not valid, according to RFC 2822	`2.602`	`1.167`	`1.328`	`0.568`
INVESTMENT_ADVICE	body	Message mentions investment advice	`0.100`	`0.100`	`0.100`	`0.100`
IP_LINK_PLUS	uri	Dotted-decimal IP address followed by CGI	`0.001`	`0.001`	`0.246`	`0.012`
JH_SPAMMY_HEADERS	meta	Has unusual message header(s) seen primarily in spam	`3.499`	`3.499`	`3.499`	`3.499`
JH_SPAMMY_PATTERN01	rawbody	Unusual pattern seen in spam campaign	`1.000`	`1.000`	`1.000`	`1.000`
JH_SPAMMY_PATTERN02	rawbody	Unusual pattern seen in spam campaign	`1.000`	`1.000`	`1.000`	`1.000`
JOIN_MILLIONS	body	Join Millions of Americans	`0.100`	`0.100`	`0.100`	`0.100`
KB_DATE_CONTAINS_TAB	meta	No description provided	`3.800`	`3.799`	`3.799`	`2.751`
KB_FAKED_THE_BAT	meta	No description provided	`2.432`	`3.441`	`2.008`	`2.694`
KB_RATWARE_MSGID	meta	No description provided	`4.099`	`2.987`	`2.108`	`1.700`
KB_RATWARE_OUTLOOK_MID	header	No description provided	`4.400`	`4.400`	`2.503`	`1.499`
KHOP_FAKE_EBAY	meta	Sender falsely claims to be from eBay	`1.000`	`1.000`	`1.000`	`1.000`
KHOP_HELO_FCRDNS	meta	Relay HELO differs from its IP's reverse DNS	`0.399`	`0.399`	`0.399`	`0.399`
LINKEDIN_IMG_NOT_RCVD_LNKN	meta	Linkedin hosted image but message not from Linkedin	`1.000`	`1.000`	`1.000`	`1.000`
LIST_PRTL_PUMPDUMP	meta	Incomplete List-* headers and stock pump-and-dump	`1.000`	`1.000`	`1.000`	`1.000`
LIST_PRTL_SAME_USER	meta	Incomplete List-* headers and from+to user the same	`1.000`	`1.000`	`1.000`	`1.000`
LIVEFILESTORE	uri	No description provided	`0.100`	`0.100`	`0.100`	`0.100`
LOCALPART_IN_SUBJECT	header	Local part of To: address appears in Subject	`0.001`	`0.730`	`1.199`	`1.107`
LONGWORDS	meta	Long string of long words	`2.199`	`1.844`	`1.819`	`2.035`
LONG_HEX_URI	meta	Very long purely hexadecimal URI	`2.999`	`2.870`	`2.999`	`2.870`
LONG_IMG_URI	meta	Image URI with very long path component - web bug?	`0.568`	`2.472`	`0.568`	`2.472`
LONG_INVISIBLE_TEXT	meta	Long block of hidden text - bayes poison?	`2.999`	`2.999`	`2.999`	`2.999`
LONG_TERM_PRICE	body	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
LOTS_OF_MONEY	meta	Huge... sums of money	`0.001`	`0.001`	`0.001`	`0.001`
LOTTERY_1	meta	No description provided	`0.001`	`1.488`	`1.630`	`0.087`
LOTTERY_PH_004470	meta	No description provided	`0.100`	`0.100`	`0.100`	`0.100`
LOTTO_AGENT	meta	Claims Agent	`1.000`	`1.011`	`1.000`	`1.011`
LOTTO_DEPT	meta	Claims Department	`0.001`	`0.001`	`0.001`	`0.001`
LOW_PRICE	body	Lowest Price	`0.100`	`0.100`	`0.100`	`0.100`
LUCRATIVE	meta	Make lots of money!	`1.000`	`1.000`	`1.000`	`1.000`
L_SPAM_TOOL_13	header	No description provided	`0.539`	`0.485`	`0.494`	`1.333`
MAILING_LIST_MULTI	meta	Multiple indicators imply a widely-seen list manager	`1.000`	`1.000`	`1.000`	`1.000`
MALE_ENHANCE	body	Message talks about enhancing men	`3.100`	`3.099`	`3.099`	`0.851`
MALF_HTML_B64	meta	Malformatted base64-encoded HTML content	`1.000`	`1.000`	`1.000`	`1.000`
MALWARE_NORDNS	meta	Malware bragging + no rDNS	`0.937`	`2.591`	`0.937`	`2.591`
MALWARE_PASSWORD	meta	Malware bragging + "password"	`2.970`	`3.499`	`2.970`	`3.499`
MALW_ATTACH	meta	Attachment filename suspicious, probable malware exploit	`3.500`	`3.500`	`3.500`	`3.500`
MANY_SPAN_IN_TEXT	meta	Many <SPAN> tags embedded within text	`2.499`	`2.399`	`2.499`	`2.399`
MARKETING_PARTNERS	body	Claims you registered with a partner	`0.553`	`0.235`	`0.689`	`0.001`
MAY_BE_FORGED	meta	Relay IP's reverse DNS does not resolve to IP	`1.000`	`1.000`	`1.000`	`1.000`
MICROSOFT_EXECUTABLE	body	Message includes Microsoft executable program	`0.100`	`0.100`	`0.100`	`0.100`
MILLION_HUNDRED	body	Million "One to Nine" Hundred	`0.595`	`1.738`	`0.595`	`1.738`
MILLION_USD	body	Talks about millions of dollars	`1.212`	`0.994`	`1.212`	`0.994`
MIMEOLE_DIRECT_TO_MX	meta	MIMEOLE + direct-to-MX	`0.001`	`0.001`	`0.001`	`0.001`
MIMEPART_LIMIT_EXCEEDED	body	Message has too many MIME parts	`0.001`	`0.001`	`0.001`	`0.001`
MIME_BASE64_TEXT	rawbody	Message text disguised using base64 encoding	`0.001`	`0.001`	`0.001`	`1.741`
MIME_BOUND_DD_DIGITS	header	Spam tool pattern in MIME boundary	`3.016`	`0.349`	`2.417`	`1.373`
MIME_BOUND_DIGITS_15	header	Spam tool pattern in MIME boundary	`0.100`	`0.100`	`0.100`	`0.100`
MIME_CHARSET_FARAWAY	meta	MIME character set indicates foreign language	`2.450`	`2.450`	`2.450`	`2.450`
MIME_HEADER_CTYPE_ONLY	meta	'Content-Type' found without required MIME headers	`0.100`	`0.100`	`0.100`	`0.100`
MIME_HTML_MOSTLY	body	Multipart message mostly text/html MIME	`0.100`	`0.100`	`0.100`	`0.100`
MIME_HTML_ONLY	body	Message only has text/html MIME parts	`0.100`	`0.100`	`0.100`	`0.100`
MIME_HTML_ONLY_MULTI	meta	Multipart message only has text/html MIME parts	`0.000`	`0.001`	`0.001`	`0.001`
MIME_NO_TEXT	meta	No (properly identified) text body parts	`1.000`	`1.000`	`1.000`	`1.000`
MIME_PHP_NO_TEXT	meta	No text body parts, X-Mailer: PHP	`2.800`	`2.799`	`2.799`	`2.799`
MIME_QP_LONG_LINE	rawbody	Quoted-printable line longer than 76 chars	`0.001`	`0.001`	`0.001`	`0.001`
MIME_SUSPECT_NAME	body	MIME filename does not match content	`0.100`	`0.100`	`0.100`	`0.100`
MISSING_DATE	meta	Missing Date: header	`2.739`	`1.396`	`1.800`	`1.360`
MISSING_FROM	meta	Missing From: header	`1.000`	`1.000`	`1.000`	`1.000`
MISSING_HEADERS	header	Missing To: header	`0.915`	`1.207`	`1.204`	`1.021`
MISSING_MID	meta	Missing Message-Id: header	`0.552`	`0.140`	`1.199`	`0.497`
MISSING_MIMEOLE	meta	Message has X-MSMail-Priority, but no X-MimeOLE	`0.392`	`1.843`	`0.571`	`1.899`
MISSING_MIME_HB_SEP	body	Missing blank line between MIME header and body	`0.001`	`0.001`	`0.001`	`0.001`
MISSING_SUBJECT	meta	Missing Subject: header	`0.001`	`1.767`	`1.300`	`1.799`
MIXED_AREA_CASE	meta	Has area tag in mixed case	`1.000`	`1.000`	`1.000`	`1.000`
MIXED_CENTER_CASE	meta	Has center tag in mixed case	`1.000`	`1.596`	`1.000`	`1.596`
MIXED_ES	meta	Too many es are not es	`1.799`	`1.999`	`1.799`	`1.999`
MIXED_FONT_CASE	meta	Has font tag in mixed case	`1.000`	`1.000`	`1.000`	`1.000`
MIXED_HREF_CASE	meta	Has href in mixed case	`1.000`	`0.487`	`1.000`	`0.487`
MIXED_IMG_CASE	meta	Has img tag in mixed case	`1.000`	`2.274`	`1.000`	`2.274`
MONERO_DEADLINE	meta	Monero cryptocurrency with a deadline	`1.000`	`1.000`	`1.000`	`1.000`
MONERO_EXTORT_01	meta	Extortion spam, pay via Monero cryptocurrency	`1.000`	`1.000`	`1.000`	`1.000`
MONERO_MALWARE	meta	Monero cryptocurrency + malware bragging	`1.000`	`1.000`	`1.000`	`1.000`
MONERO_PAY_ME	meta	Pay me via Monero cryptocurrency	`1.000`	`1.000`	`1.000`	`1.000`
MONEY_ATM_CARD	meta	Lots of money on an ATM card	`0.001`	`0.001`	`0.001`	`0.001`
MONEY_BACK	body	Money back guarantee	`2.910`	`2.486`	`0.601`	`1.232`
MONEY_BARRISTER	meta	Lots of money from a UK lawyer	`0.001`	`0.480`	`0.001`	`0.480`
MONEY_FORM	meta	Lots of money if you fill out a form	`0.001`	`0.001`	`0.001`	`0.001`
MONEY_FORM_SHORT	meta	Lots of money if you fill out a short form	`2.499`	`1.078`	`2.499`	`1.078`
MONEY_FRAUD_3	meta	Lots of money and several fraud phrases	`2.573`	`1.185`	`2.573`	`1.185`
MONEY_FRAUD_5	meta	Lots of money and many fraud phrases	`2.503`	`1.406`	`2.503`	`1.406`
MONEY_FRAUD_8	meta	Lots of money and very many fraud phrases	`1.240`	`2.037`	`1.240`	`2.037`
MONEY_FREEMAIL_REPTO	meta	Lots of money from someone using free email?	`2.999`	`1.109`	`2.999`	`1.109`
MONEY_FROM_MISSP	meta	Lots of money and misspaced From	`1.322`	`0.001`	`1.322`	`0.001`
MORE_SEX	body	Talks about a bigger drive for sex	`2.799`	`2.765`	`2.568`	`1.413`
MPART_ALT_DIFF	body	HTML and text parts are different	`2.246`	`0.724`	`0.595`	`0.790`
MPART_ALT_DIFF_COUNT	body	HTML and text parts are different	`2.799`	`1.483`	`1.199`	`1.112`
MSGID_DOLLARS_URI_IMG	meta	Suspicious Message-ID and image	`1.000`	`1.000`	`1.000`	`1.000`
MSGID_FROM_MTA_HEADER	meta	Message-Id was added by a relay	`0.401`	`0.001`	`0.473`	`0.001`
MSGID_HDR_MALF	meta	Has invalid message ID header	`1.000`	`1.000`	`1.000`	`1.000`
MSGID_MULTIPLE_AT	header	Message-ID contains multiple '@' characters	`1.000`	`1.000`	`1.000`	`1.000`
MSGID_OUTLOOK_INVALID	header	Message-Id is fake (in Outlook Express format)	`3.899`	`3.899`	`3.899`	`3.899`
MSGID_RANDY	meta	Message-Id has pattern used in spam	`2.196`	`2.599`	`2.599`	`2.599`
MSGID_SHORT	header	Message-ID is unusually short	`0.001`	`0.337`	`0.001`	`0.001`
MSGID_SPAM_CAPS	header	Spam tool Message-Id: (caps variant)	`2.366`	`1.997`	`3.099`	`3.099`
MSGID_YAHOO_CAPS	header	Message-ID has ALLCAPS@yahoo.com	`0.797`	`1.413`	`2.278`	`1.411`
MSMAIL_PRI_ABNORMAL	meta	Email priority often abused	`0.209`	`1.067`	`0.209`	`1.067`
MSM_PRIO_REPTO	meta	MSMail priority header + Reply-to + short subject	`1.000`	`1.000`	`1.000`	`1.000`
MSOE_MID_WRONG_CASE	meta	No description provided	`0.993`	`3.373`	`0.960`	`2.584`
NA_DOLLARS	body	Talks about a million North American dollars	`1.499`	`1.499`	`1.499`	`1.499`
NEWEGG_IMG_NOT_RCVD_NEGG	meta	Newegg hosted image but message not from Newegg	`1.000`	`1.000`	`1.000`	`1.000`
NEW_PRODUCTS	meta	No description provided	`1.000`	`1.000`	`1.000`	`1.000`
NICE_REPLY_A	meta	Looks like a legit reply (A)	`-0.001`	`-0.001`	`-0.001`	`-0.001`
NML_ADSP_CUSTOM_HIGH	meta	ADSP custom_high hit, and not from a mailing list	`0.000`	`2.600`	`0.000`	`2.500`
NML_ADSP_CUSTOM_LOW	meta	ADSP custom_low hit, and not from a mailing list	`0.000`	`0.700`	`0.000`	`0.700`
NML_ADSP_CUSTOM_MED	meta	ADSP custom_med hit, and not from a mailing list	`0.000`	`1.200`	`0.000`	`0.900`
NORDNS_LOW_CONTRAST	meta	No rDNS + hidden text	`0.001`	`1.152`	`0.001`	`1.152`
NORMAL_HTTP_TO_IP	uri	URI host has a public dotted-decimal IPv4 address	`0.159`	`0.001`	`0.795`	`0.001`
NOT_SPAM	body	I'm not spam! Really! I'm not, I'm not, I'm not!	`1.000`	`1.000`	`1.000`	`1.000`
NO_DNS_FOR_FROM	header	Envelope sender has no MX or A DNS records	`0.000`	`0.379`	`0.000`	`0.001`
NO_FM_NAME_IP_HOSTN	meta	No From name + hostname using IP address	`0.001`	`0.001`	`0.001`	`0.001`
NO_HEADERS_MESSAGE	meta	Message appears to be missing most RFC-822 headers	`0.001`	`0.001`	`0.001`	`0.001`
NO_MEDICAL	body	No Medical Exams	`2.199`	`1.254`	`2.199`	`1.773`
NO_PRESCRIPTION	body	No prescription needed	`1.915`	`1.102`	`2.280`	`2.399`
NO_RDNS_DOTCOM_HELO	header	Host HELO'd as a big ISP, but had no rDNS	`3.100`	`0.433`	`3.099`	`0.823`
NO_RECEIVED	meta	Informational: message has no Received headers	`-0.001`	`-0.001`	`-0.001`	`-0.001`
NO_RELAYS	header	Informational: message was not relayed via SMTP	`-0.001`	`-0.001`	`-0.001`	`-0.001`
NSL_RCVD_FROM_USER	header	Received from User	`0.001`	`0.001`	`0.001`	`0.001`
NSL_RCVD_HELO_USER	header	Received from HELO User	`0.001`	`2.259`	`0.001`	`2.259`
NULL_IN_BODY	full	Message has NUL (ASCII 0) byte in message	`0.511`	`0.498`	`2.056`	`1.596`
NUMBERONLY_BITCOIN_EXP	meta	Domain ends in a large number and very short body with link	`1.999`	`1.999`	`1.999`	`1.999`
NUMERIC_HTTP_ADDR	uri	Uses a numeric IP address in URL	`0.000`	`0.001`	`0.001`	`1.242`
OBFUSCATING_COMMENT	meta	HTML comments which obfuscate text	`0.000`	`0.000`	`0.001`	`0.723`
OBFU_BITCOIN	meta	Obfuscated BitCoin references	`1.000`	`1.000`	`1.000`	`1.000`
OBFU_JVSCR_ESC	rawbody	Injects content using obfuscated javascript	`1.000`	`1.000`	`1.000`	`1.000`
OBFU_TEXT_ATTACH	mimeheader	Text attachment with non-text MIME type	`0.046`	`0.898`	`0.046`	`0.898`
OBFU_UNSUB_UL	meta	Obfuscated unsubscribe text	`1.000`	`1.000`	`1.000`	`1.000`
ODD_FREEM_REPTO	meta	Has unusual reply-to header	`2.999`	`2.557`	`2.999`	`2.557`
ONE_TIME	body	One Time Rip Off	`1.840`	`1.175`	`1.830`	`0.714`
ONLINE_PHARMACY	body	Online Pharmacy	`0.843`	`2.371`	`0.008`	`0.650`
OOOBOUNCE_MESSAGE	meta	Out Of Office bounce message	`0.100`	`0.100`	`0.100`	`0.100`
PART_CID_STOCK	meta	Has a spammy image attachment (by Content-ID)	`0.001`	`0.001`	`0.001`	`0.000`
PART_CID_STOCK_LESS	meta	Has a spammy image attachment (by Content-ID, more specific)	`0.000`	`0.036`	`0.745`	`0.894`
PDS_BAD_THREAD_QP_64	meta	Bad thread header - short QP	`0.001`	`0.001`	`0.001`	`0.001`
PDS_BTC_ID	meta	FP reduced Bitcoin ID	`0.499`	`0.292`	`0.499`	`0.292`
PDS_BTC_MSGID	meta	Bitcoin ID with T_MSGID_NOFQDN2	`0.001`	`0.001`	`0.001`	`0.001`
PDS_BTC_NTLD	meta	Bitcoin suspect NTLD	`0.789`	`0.027`	`0.789`	`0.027`
PDS_DBL_URL_TNB_RUNON	meta	Double-url and To no arrows, from runon	`1.999`	`1.000`	`1.999`	`1.000`
PDS_EMPTYSUBJ_URISHRT	meta	Empty subject with little more than URI shortener	`1.477`	`1.419`	`1.477`	`1.419`
PDS_FROM_2_EMAILS_SHRTNER	meta	From 2 emails short email with little more than a URI shortener	`0.605`	`1.445`	`0.605`	`1.445`
PDS_HELO_SPF_FAIL	meta	High profile HELO that fails SPF	`0.001`	`1.999`	`0.001`	`1.999`
PDS_NAKED_TO_NUMERO	meta	Naked-to, numberonly domain	`1.996`	`1.149`	`1.996`	`1.149`
PDS_NO_FULL_NAME_SPOOFED_URL	meta	HTML message short, T_SPOOFED_URL and T_KHOP_NO_FULL_NAME	`0.749`	`0.749`	`0.749`	`0.749`
PDS_PHP_EVAL	meta	PHP header shows eval'd code	`1.000`	`1.499`	`1.000`	`1.499`
PDS_RDNS_DYNAMIC_FP	meta	RDNS_DYNAMIC with FP steps	`0.001`	`0.010`	`0.001`	`0.010`
PDS_SHORT_SPOOFED_URL	meta	HTML message short and T_SPOOFED_URL (S_U_FP)	`1.999`	`1.999`	`1.999`	`1.999`
PDS_TINYSUBJ_URISHRT	meta	Short subject with URL shortener	`1.499`	`1.356`	`1.499`	`1.356`
PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE	meta	Forged replyto and __PDS_TONAME_EQ_TOLOCAL	`1.000`	`1.000`	`1.000`	`1.000`
PDS_TONAME_EQ_TOLOCAL_VSHORT	meta	Very short body and From looks like 2 different emails	`0.999`	`0.999`	`0.999`	`0.999`
PERCENT_RANDOM	meta	Message has a random macro in it	`2.999`	`2.837`	`2.983`	`1.838`
PHISH_ATTACH	meta	Attachment filename suspicious, probable phishing	`3.500`	`3.500`	`3.500`	`3.500`
PHISH_AZURE_CLOUDAPP	uri	Link to known phishing web application	`3.500`	`3.500`	`3.500`	`3.500`
PHISH_FBASEAPP	meta	Probable phishing via hosted web app	`1.000`	`1.000`	`1.000`	`1.000`
PHP_NOVER_MUA	meta	Mail from PHP with no version number	`1.000`	`1.000`	`1.000`	`1.000`
PHP_ORIG_SCRIPT	meta	Sent by bot & other signs	`2.347`	`1.351`	`2.347`	`1.351`
PHP_ORIG_SCRIPT_EVAL	meta	From suspicious PHP source	`1.000`	`2.999`	`1.000`	`2.999`
PHP_SCRIPT	meta	Sent by PHP script	`2.499`	`2.398`	`2.499`	`2.398`
PHP_SCRIPT_MUA	meta	Sent by PHP script, no version number	`1.000`	`1.000`	`1.000`	`1.000`
PLING_QUERY	meta	Subject has exclamation mark and question mark	`0.100`	`0.100`	`0.100`	`0.100`
POSSIBLE_APPLE_PHISH_02	meta	Claims to be from apple but not processed by any apple MTA	`1.000`	`1.000`	`1.000`	`1.000`
POSSIBLE_EBAY_PHISH_02	meta	Claims to be from ebay but not processed by any ebay MTA	`1.000`	`1.000`	`1.000`	`1.000`
POSSIBLE_GMAIL_PHISHER	meta	Apparent phishing email sent from a gmail account	`1.382`	`0.694`	`1.382`	`0.694`
POSSIBLE_PAYPAL_PHISH_01	meta	Claims to be from paypal but has non-paypal from email address	`1.000`	`1.000`	`1.000`	`1.000`
POSSIBLE_PAYPAL_PHISH_02	meta	Claims to be from paypal but not processed by any paypal MTA	`1.000`	`1.000`	`1.000`	`1.000`
PP_MIME_FAKE_ASCII_TEXT	body	MIME text/plain claims to be ASCII but isn't	`0.999`	`0.001`	`0.999`	`0.001`
PP_TOO_MUCH_UNICODE02	body	Is text/plain but has many unicode escapes	`0.500`	`0.500`	`0.500`	`0.500`
PP_TOO_MUCH_UNICODE05	body	Is text/plain but has many unicode escapes	`1.000`	`1.000`	`1.000`	`1.000`
PRICES_ARE_AFFORDABLE	body	Message says that prices aren't too expensive	`0.794`	`0.851`	`1.112`	`0.551`
PUMPDUMP	meta	Pump-and-dump stock scam phrase	`1.000`	`1.000`	`1.000`	`1.000`
PUMPDUMP_MULTI	meta	Pump-and-dump stock scam phrases	`1.000`	`1.000`	`1.000`	`1.000`
PUMPDUMP_TIP	meta	Pump-and-dump stock tip	`1.000`	`1.000`	`1.000`	`1.000`
PYZOR_CHECK	full	Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)	`0.000`	`1.985`	`0.000`	`1.392`
RAND_HEADER_LIST_SPOOF	meta	Random gibberish message header(s) + pretending to be a mailing list	`1.000`	`1.000`	`1.000`	`1.000`
RAND_HEADER_MANY	meta	Multiple random gibberish message headers	`1.000`	`1.000`	`1.000`	`1.000`
RAND_MKTG_HEADER	meta	Has partially-randomized marketing/tracking header(s)	`1.999`	`1.999`	`1.999`	`1.999`
RATWARE_EFROM	header	Bulk email fingerprint (envfrom) found	`0.100`	`0.100`	`0.100`	`0.100`
RATWARE_EGROUPS	header	Bulk email fingerprint (eGroups) found	`1.898`	`1.258`	`1.406`	`1.621`
RATWARE_MPOP_WEBMAIL	header	Bulk email fingerprint (mPOP Web-Mail)	`1.153`	`1.338`	`1.229`	`1.999`
RATWARE_MS_HASH	meta	Bulk email fingerprint (msgid ms hash) found	`1.000`	`1.000`	`1.000`	`1.000`
RATWARE_NAME_ID	meta	Bulk email fingerprint (msgid from) found	`3.099`	`0.309`	`3.099`	`0.247`
RATWARE_NO_RDNS	meta	Suspicious MsgID and MIME boundary + no rDNS	`0.001`	`1.897`	`0.001`	`1.897`
RATWARE_OUTLOOK_NONAME	meta	Bulk email fingerprint (Outlook no name) found	`1.000`	`1.000`	`1.000`	`1.000`
RATWARE_ZERO_TZ	meta	Bulk email fingerprint (+0000) found	`2.392`	`2.535`	`0.265`	`1.781`
RAZOR2_CF_RANGE_51_100	full	Razor2 gives confidence level above 50%	`0.000`	`2.430`	`0.000`	`1.886`
RAZOR2_CHECK	full	Listed in Razor2 (http://razor.sf.net/)	`0.000`	`1.729`	`0.000`	`0.922`
RCVD_DBL_DQ	header	Malformatted message header	`1.000`	`1.000`	`1.000`	`1.000`
RCVD_DOTEDU_SHORT	meta	Via .edu MTA + short message	`1.000`	`1.000`	`1.000`	`1.000`
RCVD_DOTEDU_SUSP_URI	meta	Via .edu MTA + suspicious URI	`1.000`	`1.000`	`1.000`	`1.000`
RCVD_DOUBLE_IP_LOOSE	meta	Received: by and from look like IP addresses	`1.150`	`0.960`	`1.042`	`1.012`
RCVD_DOUBLE_IP_SPAM	meta	Bulk email fingerprint (double IP) found	`2.411`	`2.777`	`1.912`	`1.808`
RCVD_FAKE_HELO_DOTCOM	header	Received contains a faked HELO hostname	`2.799`	`2.389`	`2.605`	`1.189`
RCVD_HELO_IP_MISMATCH	header	Received: HELO and IP do not match, but should	`1.680`	`1.186`	`2.362`	`2.368`
RCVD_ILLEGAL_IP	header	Received: contains illegal IP address	`1.300`	`1.300`	`1.300`	`1.300`
RCVD_IN_BL_SPAMCOP_NET	header	Received via a relay in bl.spamcop.net	`0.000`	`1.246`	`0.000`	`1.347`
RCVD_IN_DNSWL_BLOCKED	header	ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.	`0.000`	`0.001`	`0.000`	`0.001`
RCVD_IN_DNSWL_HI	header	Sender listed at https://www.dnswl.org/, high trust	`0.000`	`-5.000`	`0.000`	`-5.000`
RCVD_IN_DNSWL_LOW	header	Sender listed at https://www.dnswl.org/, low trust	`0.000`	`-0.700`	`0.000`	`-0.700`
RCVD_IN_DNSWL_MED	header	Sender listed at https://www.dnswl.org/, medium trust	`0.000`	`-2.300`	`0.000`	`-2.300`
RCVD_IN_DNSWL_NONE	header	Sender listed at https://www.dnswl.org/, no trust	`0.000`	`-0.000`	`0.000`	`-0.000`
RCVD_IN_IADB_DK	header	IADB: Sender publishes Domain Keys record	`0.000`	`-0.223`	`0.000`	`-0.095`
RCVD_IN_IADB_DOPTIN	header	IADB: All mailing list mail is confirmed opt-in	`0.000`	`-4.000`	`0.000`	`-4.000`
RCVD_IN_IADB_DOPTIN_LT50	header	IADB: Confirmed opt-in used less than 50% of the time	`0.000`	`-0.001`	`0.000`	`-0.001`
RCVD_IN_IADB_LISTED	header	Participates in the IADB system	`0.000`	`-0.380`	`0.000`	`-0.001`
RCVD_IN_IADB_MI_CPR_MAT	header	IADB: Sends no material under Michigan's CPR	`0.000`	`-0.332`	`0.000`	`0.000`
RCVD_IN_IADB_ML_DOPTIN	header	IADB: Mailing list email only, confirmed opt-in	`0.000`	`-6.000`	`0.000`	`-6.000`
RCVD_IN_IADB_OPTIN	header	IADB: All mailing list mail is opt-in	`0.000`	`-2.057`	`0.000`	`-1.470`
RCVD_IN_IADB_OPTIN_GT50	header	IADB: Opt-in used more than 50% of the time	`0.000`	`-1.208`	`0.000`	`-0.007`
RCVD_IN_IADB_RDNS	header	IADB: Sender has reverse DNS record	`0.000`	`-0.167`	`0.000`	`-0.235`
RCVD_IN_IADB_SENDERID	header	IADB: Sender publishes Sender ID record	`0.000`	`-0.001`	`0.000`	`-0.001`
RCVD_IN_IADB_SPF	header	IADB: Sender publishes SPF record	`0.000`	`-0.001`	`0.000`	`-0.059`
RCVD_IN_IADB_UT_CPR_MAT	header	IADB: Sends no material under Utah's CPR	`0.000`	`-0.095`	`0.000`	`-0.001`
RCVD_IN_IADB_VOUCHED	header	ISIPP IADB lists as vouched-for sender	`0.000`	`-2.200`	`0.000`	`-2.200`
RCVD_IN_MSPIKE_BL	meta	Mailspike blocklisted	`0.010`	`0.010`	`0.010`	`0.010`
RCVD_IN_MSPIKE_H2	header	Average reputation (+2)	`0.001`	`-0.001`	`0.001`	`-0.001`
RCVD_IN_MSPIKE_H3	header	Good reputation (+3)	`-0.010`	`-0.010`	`-0.010`	`-0.010`
RCVD_IN_MSPIKE_H4	header	Very Good reputation (+4)	`-0.010`	`-0.010`	`-0.010`	`-0.010`
RCVD_IN_MSPIKE_H5	header	Excellent reputation (+5)	`-1.000`	`-1.000`	`-1.000`	`-1.000`
RCVD_IN_MSPIKE_L2	header	Suspicious reputation (-2)	`1.000`	`1.000`	`1.000`	`1.000`
RCVD_IN_MSPIKE_L3	header	Low reputation (-3)	`0.900`	`0.900`	`0.900`	`0.900`
RCVD_IN_MSPIKE_L4	header	Bad reputation (-4)	`1.700`	`1.700`	`1.700`	`1.700`
RCVD_IN_MSPIKE_L5	header	Very bad reputation (-5)	`2.500`	`2.500`	`2.500`	`2.500`
RCVD_IN_MSPIKE_WL	meta	Mailspike good senders	`-0.010`	`-0.010`	`-0.010`	`-0.010`
RCVD_IN_MSPIKE_ZBI	meta	No description provided	`2.700`	`2.700`	`2.700`	`2.700`
RCVD_IN_PBL	header	Received via a relay in Spamhaus PBL	`0.000`	`3.558`	`0.000`	`3.335`
RCVD_IN_PSBL	header	Received via a relay in PSBL	`0.000`	`2.700`	`0.000`	`2.700`
RCVD_IN_SBL	header	Received via a relay in Spamhaus SBL	`0.000`	`2.596`	`0.000`	`0.141`
RCVD_IN_SBL_CSS	header	Received via a relay in Spamhaus SBL-CSS	`0.000`	`3.558`	`0.000`	`3.335`
RCVD_IN_SORBS_DUL	header	SORBS: sent directly from dynamic IP address	`0.000`	`0.001`	`0.000`	`0.001`
RCVD_IN_SORBS_HTTP	header	SORBS: sender is open HTTP proxy server	`0.000`	`2.499`	`0.000`	`0.001`
RCVD_IN_SORBS_SOCKS	header	SORBS: sender is open SOCKS proxy server	`0.000`	`2.443`	`0.000`	`1.927`
RCVD_IN_SORBS_WEB	header	SORBS: sender is an abusable web server	`0.000`	`1.500`	`0.000`	`1.500`
RCVD_IN_VALIDITY_CERTIFIED	header	Sender in Validity Certification - Contact certification@validity.com	`0.000`	`-3.000`	`0.000`	`-3.000`
RCVD_IN_VALIDITY_RPBL	header	Relay in Validity RPBL, https://senderscore.org/blocklistlookup/	`0.000`	`1.284`	`0.000`	`1.310`
RCVD_IN_VALIDITY_SAFE	header	Sender in Validity Safe - Contact certification@validity.com	`0.000`	`-2.000`	`0.000`	`-2.000`
RCVD_IN_XBL	header	Received via a relay in Spamhaus XBL	`0.000`	`0.724`	`0.000`	`0.375`
RCVD_IN_ZEN_BLOCKED	header	ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/	`0.000`	`0.001`	`0.000`	`0.001`
RCVD_IN_ZEN_BLOCKED_OPENDNS	header	ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/	`0.000`	`0.001`	`0.000`	`0.001`
RCVD_NUMERIC_HELO	???	No description provided	`0.001`	`0.865`	`0.001`	`1.164`
RDNS_DYNAMIC	meta	Delivered to internal network by host with dynamic-looking rDNS	`2.639`	`0.363`	`1.663`	`0.982`
RDNS_LOCALHOST	header	Sender's public rDNS is "localhost"	`3.700`	`0.969`	`2.345`	`0.001`
RDNS_NONE	meta	Delivered to internal network by a host with no rDNS	`2.399`	`1.274`	`1.228`	`0.793`
RDNS_NUM_TLD_ATCHNX	meta	Relay rDNS has numeric TLD + suspicious attachment	`1.000`	`1.000`	`1.000`	`1.000`
RDNS_NUM_TLD_XM	meta	Relay rDNS has numeric TLD + suspicious headers	`1.000`	`1.000`	`1.000`	`1.000`
REMOVE_BEFORE_LINK	body	Removal phrase right before a link	`0.100`	`0.100`	`0.100`	`0.100`
REPLICA_WATCH	body	Message talks about a replica watch	`3.487`	`3.164`	`4.074`	`3.775`
REPLYTO_WITHOUT_TO_CC	meta	No description provided	`2.399`	`1.946`	`0.607`	`1.552`
REPTO_419_FRAUD	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_AOL	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_AOL_LOOSE	meta	Ends-in-digits Reply-To is similar to known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_CNS	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_GM	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_GM_LOOSE	meta	Ends-in-digits Reply-To is similar to known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_HM	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_OL	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_PM	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_QQ	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_YH	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_YH_LOOSE	meta	Ends-in-digits Reply-To is similar to known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_YJ	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_419_FRAUD_YN	header	Reply-To is known advance fee fraud collector mailbox	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_INFONUMSCOM	meta	No description provided	`1.000`	`1.000`	`1.000`	`1.000`
REPTO_QUOTE_YAHOO	meta	Yahoo! doesn't do quoting like this	`0.001`	`0.490`	`0.001`	`0.646`
RISK_FREE	meta	No risk!	`1.000`	`1.000`	`1.000`	`1.000`
RP_MATCHES_RCVD	???	No description provided	`-0.001`	`-0.001`	`-0.001`	`-0.001`
SB_GIF_AND_NO_URIS	meta	No description provided	`2.199`	`2.199`	`2.200`	`2.199`
SCC_BOGUS_CTE_1	meta	Bogus Content-Transfer-Encoding header	`1.000`	`1.000`	`1.000`	`1.000`
SCC_CTMPP	meta	Uncommon Content-Type	`1.000`	`1.000`	`1.000`	`1.000`
SCC_ISEMM_LID_1	header	Fingerprint of a particular spammer using an old spamware	`1.000`	`1.000`	`1.000`	`1.000`
SCC_ISEMM_LID_1B	header	Genericized spammer fingerprint	`1.499`	`1.499`	`1.499`	`1.499`
SCC_SPECIAL_GUID	rawbody	Unique in a similar way	`1.000`	`1.000`	`1.000`	`1.000`
SENDGRID_REDIR	meta	Redirect URI via Sendgrid	`1.499`	`1.068`	`1.499`	`1.068`
SENDGRID_REDIR_PHISH	meta	Redirect URI via Sendgrid + phishing signs	`1.000`	`1.000`	`1.000`	`1.000`
SEO_SUSP_NTLD	meta	SEO offer from suspicious TLD	`1.000`	`1.000`	`1.000`	`1.000`
SHOPIFY_IMG_NOT_RCVD_SFY	meta	Shopify hosted image but message not from Shopify	`2.499`	`2.298`	`2.499`	`2.298`
SHORTENER_SHORT_IMG	meta	Short HTML + image + URL shortener	`1.000`	`1.000`	`1.000`	`1.000`
SHORT_HELO_AND_INLINE_IMAGE	meta	Short HELO string, with inline image	`0.100`	`0.100`	`0.100`	`0.100`
SHORT_IMG_SUSP_NTLD	meta	Short HTML + image + suspicious TLD	`1.000`	`1.000`	`1.000`	`1.000`
SHORT_SHORTNER	meta	Short body with little more than a link to a shortener	`1.999`	`1.108`	`1.999`	`1.108`
SHORT_TERM_PRICE	body	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
SORTED_RECIPS	header	Recipient list is sorted by address	`1.801`	`2.474`	`1.791`	`2.499`
SPAMMY_XMAILER	meta	X-Mailer string is common in spam and not in ham	`2.650`	`0.862`	`1.993`	`2.491`
SPF_FAIL	header	SPF: sender does not match SPF record (fail)	`0.000`	`0.919`	`0.000`	`0.001`
SPF_HELO_FAIL	header	SPF: HELO does not match SPF record (fail)	`0.000`	`0.001`	`0.000`	`0.001`
SPF_HELO_NEUTRAL	header	SPF: HELO does not match SPF record (neutral)	`0.000`	`0.001`	`0.000`	`0.112`
SPF_HELO_NONE	header	SPF: HELO does not publish an SPF Record	`0.001`	`0.001`	`0.001`	`0.001`
SPF_HELO_PASS	header	SPF: HELO matches SPF record	`-0.001`	`-0.001`	`-0.001`	`-0.001`
SPF_HELO_SOFTFAIL	header	SPF: HELO does not match SPF record (softfail)	`0.000`	`0.896`	`0.000`	`0.732`
SPF_NEUTRAL	header	SPF: sender does not match SPF record (neutral)	`0.000`	`0.652`	`0.000`	`0.779`
SPF_NONE	header	SPF: sender does not publish an SPF Record	`0.001`	`0.001`	`0.001`	`0.001`
SPF_PASS	header	SPF: sender matches SPF record	`-0.001`	`-0.001`	`-0.001`	`-0.001`
SPF_SOFTFAIL	header	SPF: sender does not match SPF record (softfail)	`0.000`	`0.972`	`0.000`	`0.665`
SPOOFED_FREEMAIL	meta	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
SPOOFED_FREEMAIL_NO_RDNS	meta	From SPOOFED_FREEMAIL and no rDNS	`0.001`	`0.001`	`0.001`	`0.001`
SPOOFED_FREEM_REPTO	meta	Forged freemail sender with freemail reply-to	`0.001`	`2.499`	`0.001`	`2.499`
SPOOFED_FREEM_REPTO_CHN	meta	Forged freemail sender with Chinese freemail reply-to	`0.001`	`1.215`	`0.001`	`1.215`
SPOOFED_FREEM_REPTO_RUS	meta	Forged freemail sender with Russian freemail reply-to	`0.001`	`1.000`	`0.001`	`1.000`
SPOOF_COM2COM	meta	URI contains ".com" in middle and end	`0.001`	`0.001`	`0.001`	`0.001`
SPOOF_COM2OTH	uri	URI contains ".com" in middle	`0.001`	`0.001`	`0.001`	`0.001`
SPOOF_GMAIL_MID	meta	From Gmail but it doesn't seem to be...	`1.499`	`0.001`	`1.499`	`0.001`
STATIC_XPRIO_OLE	meta	Static RDNS + X-Priority + MIMEOLE	`0.001`	`1.865`	`0.001`	`1.865`
STOCK_IMG_CTYPE	meta	Stock spam image part, with distinctive Content-Type header	`0.001`	`0.005`	`0.001`	`0.001`
STOCK_IMG_HDR_FROM	meta	Stock spam image part, with distinctive From line	`0.001`	`0.001`	`0.001`	`0.021`
STOCK_IMG_HTML	meta	Stock spam image part, with distinctive HTML	`0.000`	`0.028`	`0.000`	`0.005`
STOCK_IMG_OUTLOOK	meta	Stock spam image part, with Outlook-like features	`0.001`	`0.702`	`0.413`	`0.190`
STOCK_TIP	meta	Stock tips	`1.000`	`1.000`	`1.000`	`1.000`
STOX_BOUND_090909_B	header	No description provided	`1.674`	`0.001`	`1.674`	`0.001`
STOX_REPLY_TYPE	header	No description provided	`1.898`	`0.212`	`0.141`	`0.439`
STOX_REPLY_TYPE_WITHOUT_QUOTES	meta	No description provided	`3.099`	`1.860`	`1.629`	`1.757`
SUBJECT_DIET	header	Subject talks about losing pounds	`1.927`	`1.563`	`0.817`	`1.466`
SUBJECT_DRUG_GAP_C	header	Subject contains a gappy version of 'cialis'	`2.108`	`0.989`	`1.348`	`2.140`
SUBJECT_DRUG_GAP_L	header	Subject contains a gappy version of 'levitra'	`2.799`	`2.304`	`1.402`	`1.561`
SUBJECT_FUZZY_CHEAP	header	Attempt to obfuscate words in Subject:	`0.641`	`1.831`	`0.833`	`0.001`
SUBJECT_IN_BLACKLIST	meta	DEPRECATED: See SUBJECT_IN_BLOCKLIST	`100.000`	`100.000`	`100.000`	`100.000`
SUBJECT_IN_BLOCKLIST	header	Subject: contains string in the user's block-list	`0.010`	`0.010`	`0.010`	`0.010`
SUBJECT_IN_WELCOMELIST	header	Subject: contains string in the user's welcome-list	`-0.010`	`-0.010`	`-0.010`	`-0.010`
SUBJECT_IN_WHITELIST	meta	DEPRECATED: See SUBJECT_IN_WELCOMELIST	`-100.000`	`-100.000`	`-100.000`	`-100.000`
SUBJECT_NEEDS_ENCODING	meta	Subject includes non-encoded illegal characters	`0.498`	`0.100`	`0.804`	`0.049`
SUBJ_ALL_CAPS	header	Subject is all capitals	`0.500`	`0.500`	`0.500`	`0.500`
SUBJ_AS_SEEN	header	Subject contains "As Seen"	`2.711`	`3.099`	`3.099`	`1.461`
SUBJ_BRKN_WORDNUMS	meta	Subject contains odd word breaks and numbers	`1.000`	`1.000`	`1.000`	`1.000`
SUBJ_BUY	header	Subject line starts with Buy or Buying	`0.594`	`1.498`	`0.001`	`0.639`
SUBJ_DOLLARS	header	Subject starts with dollar amount	`0.100`	`0.100`	`0.100`	`0.100`
SUBJ_ILLEGAL_CHARS	meta	Subject: has too many raw illegal characters	`0.620`	`1.105`	`0.448`	`1.518`
SUBJ_YOUR_FAMILY	header	Subject contains "Your Family"	`2.910`	`2.999`	`2.999`	`2.999`
SURBL_BLOCKED	body	ADMINISTRATOR NOTICE: The query to SURBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.	`1.000`	`1.000`	`1.000`	`1.000`
SUSPICIOUS_RECIPS	header	Similar addresses in recipient list	`2.499`	`2.497`	`2.139`	`2.510`
SUSP_UTF8_WORD_SUBJ	meta	Word in Subject using only suspicious UTF-8 characters	`2.000`	`1.999`	`2.000`	`1.999`
SYSADMIN	meta	Supposedly from your IT department	`1.000`	`1.000`	`1.000`	`1.000`
TAGSTAT_IMG_NOT_RCVD_TGST	meta	Tagstat hosted image but message not from Tagstat	`1.000`	`1.000`	`1.000`	`1.000`
TARINGANET_IMG_NOT_RCVD_TN	meta	media.taringa.net hosted image but message not from taringa.net	`1.000`	`1.000`	`1.000`	`1.000`
TBIRD_SUSP_MIME_BDRY	meta	Unlikely Thunderbird MIME boundary	`2.400`	`2.400`	`2.399`	`2.399`
TEQF_USR_IMAGE	meta	To and from user nearly same + image	`1.000`	`1.000`	`1.000`	`1.000`
TEQF_USR_MSGID_HEX	meta	To and from user nearly same + unusual message ID	`1.000`	`1.000`	`1.000`	`1.000`
TEQF_USR_MSGID_MALF	meta	To and from user nearly same + malformed message ID	`1.000`	`1.000`	`1.000`	`1.000`
THEBAT_UNREG	header	No description provided	`2.599`	`1.843`	`2.324`	`1.524`
THIS_AD	meta	"This ad" and variants	`2.400`	`1.262`	`2.400`	`1.262`
THIS_IS_ADV_SUSP_NTLD	meta	This is an advertisement from a suspicious TLD	`1.000`	`1.000`	`1.000`	`1.000`
TONLINE_FAKE_DKIM	meta	t-online.de doesn't do DKIM	`1.000`	`1.000`	`1.000`	`1.000`
TONOM_EQ_TOLOC_SHRT_SHRTNER	meta	Short email with shortener and To:name eq To:local	`0.001`	`0.001`	`0.001`	`0.001`
TO_EQ_FM_DIRECT_MX	meta	To == From and direct-to-MX	`1.000`	`1.000`	`1.000`	`1.000`
TO_EQ_FM_DOM_SPF_FAIL	meta	To domain == From domain and external SPF failed	`0.001`	`0.001`	`0.001`	`0.001`
TO_EQ_FM_SPF_FAIL	meta	To == From and external SPF failed	`0.001`	`0.001`	`0.001`	`0.001`
TO_IN_SUBJ	meta	To address is in Subject	`0.100`	`0.100`	`0.100`	`0.100`
TO_MALFORMED	header	To: has a malformed address	`0.100`	`0.100`	`0.100`	`0.100`
TO_NAME_SUBJ_NO_RDNS	meta	Recipient username in subject + no rDNS	`2.605`	`0.950`	`2.605`	`0.950`
TO_NO_BRKTS_FROM_MSSP	meta	Multiple header formatting problems	`2.499`	`2.499`	`2.499`	`2.499`
TO_NO_BRKTS_HTML_IMG	meta	To: lacks brackets and HTML and one image	`1.999`	`1.999`	`1.999`	`1.999`
TO_NO_BRKTS_HTML_ONLY	meta	To: lacks brackets and HTML only	`2.000`	`1.999`	`2.000`	`1.999`
TO_NO_BRKTS_MSFT	meta	To: lacks brackets and supposed Microsoft tool	`0.001`	`0.546`	`0.001`	`0.546`
TO_NO_BRKTS_NORDNS_HTML	meta	To: lacks brackets and no rDNS and HTML only	`1.999`	`1.370`	`1.999`	`1.370`
TO_NO_BRKTS_PCNT	meta	To: lacks brackets + percentage	`2.499`	`2.500`	`2.499`	`2.500`
TO_TOO_MANY_WFH_01	meta	Work-from-Home + many recipients	`1.000`	`1.000`	`1.000`	`1.000`
TRACKER_ID	body	Incorporates a tracking ID number	`0.100`	`0.100`	`0.100`	`0.100`
TT_MSGID_TRUNC	header	Scora: Message-Id ends after left-bracket + digits	`0.748`	`0.023`	`1.434`	`1.448`
TVD_APPROVED	body	Body states that the recipient has been approved	`1.000`	`1.000`	`1.000`	`1.000`
TVD_FINGER_02	header	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
TVD_FW_GRAPHIC_NAME_LONG	mimeheader	Long image attachment name	`0.001`	`0.648`	`0.836`	`1.293`
TVD_FW_GRAPHIC_NAME_MID	mimeheader	Medium sized image attachment name	`0.600`	`0.001`	`0.389`	`0.095`
TVD_INCREASE_SIZE	body	Advertising for penis enlargement	`1.529`	`0.601`	`1.055`	`0.001`
TVD_PH_7	body	No description provided	`2.199`	`2.299`	`2.199`	`2.299`
TVD_PH_BODY_ACCOUNTS_PRE	meta	The body matches phrases such as "accounts suspended", "account credited", "account verification"	`0.001`	`0.001`	`0.001`	`0.001`
TVD_PH_REC	body	Message includes a phrase commonly used in phishing mails	`0.100`	`0.100`	`0.100`	`0.100`
TVD_PH_SEC	body	Message includes a phrase commonly used in phishing mails	`0.100`	`0.100`	`0.100`	`0.100`
TVD_QUAL_MEDS	body	The body matches phrases such as "quality meds" or "quality medication"	`2.697`	`2.397`	`2.799`	`2.483`
TVD_RCVD_IP	header	Message was received from an IP address	`0.001`	`0.001`	`0.001`	`0.001`
TVD_RCVD_IP4	header	Message was received from an IPv4 address	`0.001`	`0.001`	`0.001`	`0.001`
TVD_SPACE_ENCODED	???	No description provided	`1.500`	`1.500`	`1.500`	`1.500`
TVD_SPACE_RATIO	meta	No description provided	`0.001`	`0.001`	`0.001`	`0.001`
TVD_SPACE_RATIO_MINFP	???	No description provided	`1.500`	`1.500`	`1.500`	`1.500`
TVD_SUBJ_ACC_NUM	header	Subject has spammy looking monetary reference	`0.100`	`0.100`	`0.100`	`0.100`
TVD_SUBJ_APPR_LOAN	header	No description provided	`0.001`	`2.200`	`0.001`	`2.200`
TVD_SUBJ_WIPE_DEBT	header	Spam advertising a way to eliminate debt	`2.599`	`2.291`	`2.599`	`1.004`
TVD_VISIT_PHARMA	body	Body mentions online pharmacy	`1.957`	`1.196`	`0.417`	`1.406`
TW_GIBBERISH_MANY	meta	Lots of gibberish text to spoof pattern matching filters	`1.000`	`1.000`	`1.000`	`1.000`
TXREP	header	Score normalizing based on sender's reputation	`1.000`	`1.000`	`1.000`	`1.000`
T_ACH_CANCELLED_EXE	meta	"ACH cancelled" probable malware	`0.100`	`0.100`	`0.100`	`0.100`
T_ANY_PILL_PRICE	meta	Prices for pills	`0.100`	`0.100`	`0.100`	`0.100`
T_CDISP_SZ_MANY	mimeheader	Suspicious MIME header	`0.100`	`0.100`	`0.100`	`0.100`
T_COMPENSATION	meta	"Compensation"	`0.100`	`0.100`	`0.100`	`0.100`
T_CTYPE_NULL	meta	Malformed Content-Type header	`0.100`	`0.100`	`0.100`	`0.100`
T_DATE_IN_FUTURE_96_Q	header	Date: is 4 days to 4 months after Received: date	`0.100`	`0.100`	`0.100`	`0.100`
T_DATE_IN_FUTURE_Q_PLUS	header	Date: is over 4 months after Received: date	`0.100`	`0.100`	`0.100`	`0.100`
T_DOC_ATTACH_NO_EXT	meta	Document attachment with suspicious name	`0.100`	`0.100`	`0.100`	`0.100`
T_DOS_OUTLOOK_TO_MX_IMAGE	meta	Direct to MX with Outlook headers and an image	`0.100`	`0.100`	`0.100`	`0.100`
T_DOS_ZIP_HARDCORE	mimeheader	hardcore.zip file attached; quite certainly a virus	`0.100`	`0.100`	`0.100`	`0.100`
T_DRUGS_ERECTILE_SHORT_SHORTNER	meta	Short erectile drugs advert with T_URL_SHORTENER	`0.100`	`0.100`	`0.100`	`0.100`
T_FILL_THIS_FORM_FRAUD_PHISH	meta	Answer suspicious question(s)	`0.100`	`0.100`	`0.100`	`0.100`
T_FILL_THIS_FORM_LOAN	meta	Answer loan question(s)	`0.100`	`0.100`	`0.100`	`0.100`
T_FILL_THIS_FORM_SHORT	meta	Fill in a short form with personal information	`0.100`	`0.100`	`0.100`	`0.100`
T_FORGED_TBIRD_IMG_SIZE	meta	Likely forged Thunderbird image spam	`0.100`	`0.100`	`0.100`	`0.100`
T_FREEMAIL_DOC_PDF	meta	MS document or PDF attachment, from freemail	`0.100`	`0.100`	`0.100`	`0.100`
T_FREEMAIL_DOC_PDF_BCC	meta	MS document or PDF attachment, from freemail, all recipients hidden	`0.100`	`0.100`	`0.100`	`0.100`
T_FREEMAIL_RVW_ATTCH	meta	Please review attached document, from freemail	`0.100`	`0.100`	`0.100`	`0.100`
T_FROMNAME_EQUALS_TO	meta	From:name matches To:	`0.100`	`0.100`	`0.100`	`0.100`
T_FROMNAME_SPOOFED_EMAIL	meta	From:name looks like a spoofed email	`0.100`	`0.100`	`0.100`	`0.100`
T_FROM_MULTI_NORDNS	meta	Multiple From addresses + no rDNS	`0.100`	`0.100`	`0.100`	`0.100`
T_FROM_MULTI_SHORT_IMG	meta	Multiple From addresses + short message with image	`0.100`	`0.100`	`0.100`	`0.100`
T_FUZZY_OPTOUT	body	Obfuscated opt-out text	`0.100`	`0.100`	`0.100`	`0.100`
T_FUZZY_WELLSFARGO	meta	Obfuscated "Wells Fargo"	`0.100`	`0.100`	`0.100`	`0.100`
T_GB_FREEM_FROM_NOT_REPLY	meta	From: and Reply-To: have different freemail domains	`0.100`	`0.100`	`0.100`	`0.100`
T_GB_FROMNAME_SPOOFED_EMAIL_IP	meta	From:name looks like a spoofed email from a spoofed ip	`0.100`	`0.100`	`0.100`	`0.100`
T_GB_WEBFORM	meta	Webform with url shortener	`0.100`	`0.100`	`0.100`	`0.100`
T_HTML_ATTACH	meta	HTML attachment to bypass scanning?	`0.100`	`0.100`	`0.100`	`0.100`
T_ISO_ATTACH	meta	ISO attachment - possible malware delivery	`0.100`	`0.100`	`0.100`	`0.100`
T_KAM_HTML_FONT_INVALID	meta	Test for Invalidly Named or Formatted Colors in HTML	`0.100`	`0.100`	`0.100`	`0.100`
T_LARGE_PCT_AFTER_MANY	meta	Many large percentages after...	`0.100`	`0.100`	`0.100`	`0.100`
T_LOTTO_AGENT_FM	header	Claims Agent	`0.100`	`0.100`	`0.100`	`0.100`
T_LOTTO_AGENT_RPLY	meta	Claims Agent	`0.100`	`0.100`	`0.100`	`0.100`
T_LOTTO_URI	uri	Claims Department URL	`0.100`	`0.100`	`0.100`	`0.100`
T_MANY_HDRS_LCASE	meta	Odd capitalization of multiple message headers	`0.100`	`0.100`	`0.100`	`0.100`
T_MANY_PILL_PRICE	meta	Prices for many pills	`0.100`	`0.100`	`0.100`	`0.100`
T_MIME_MALF	meta	Malformed MIME: headers in body	`0.100`	`0.100`	`0.100`	`0.100`
T_MONEY_PERCENT	meta	X% of a lot of money for you	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_ATTACH_MISSP	meta	Obfuscated attachment type and misspaced From	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_DOC_ATTACH	mimeheader	MS Document attachment with generic MIME type	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_GIF_ATTACH	mimeheader	GIF attachment with generic MIME type	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_HTML_ATTACH	mimeheader	HTML attachment with non-text MIME type	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_HTML_ATT_MALW	meta	HTML attachment with incorrect MIME type - possible malware	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_JPG_ATTACH	mimeheader	JPG attachment with generic MIME type	`0.100`	`0.100`	`0.100`	`0.100`
T_OBFU_PDF_ATTACH	mimeheader	PDF attachment with generic MIME type	`0.100`	`0.100`	`0.100`	`0.100`
T_OFFER_ONLY_AMERICA	meta	Offer only available to US	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_BTC_AHACKER	meta	Bitcoin Hacker	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_BTC_HACKER	meta	Bitcoin Hacker	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_FREEMAIL_REPLYTO_URISHRT	meta	Freemail replyto with URI shortener	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_FROM_2_EMAILS	meta	From header has multiple different addresses	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_LTC_AHACKER	meta	Litecoin Hacker	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_LTC_HACKER	meta	Litecoin Hacker	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_OTHER_BAD_TLD	header	Untrustworthy TLDs	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_PRO_TLD	header	.pro TLD	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_SHORTFWD_URISHRT	meta	Threaded email with URI shortener	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_SHORTFWD_URISHRT_FP	meta	Apparently a short fwd/re with URI shortener	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_SHORTFWD_URISHRT_QP	meta	Apparently a short fwd/re with URI shortener	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_TO_EQ_FROM_NAME	meta	From: name same as To: address	`0.100`	`0.100`	`0.100`	`0.100`
T_PDS_URISHRT_LOCALPART_SUBJ	meta	Localpart of To in subject	`0.100`	`0.100`	`0.100`	`0.100`
T_PHOTO_EDITING_DIRECT	meta	Image editing service, direct to MX	`0.100`	`0.100`	`0.100`	`0.100`
T_PHOTO_EDITING_FREEM	meta	Image editing service, freemail or CHN replyto	`0.100`	`0.100`	`0.100`	`0.100`
T_REMOTE_IMAGE	meta	Message contains an external image	`0.100`	`0.100`	`0.100`	`0.100`
T_SENT_TO_EMAIL_ADDR	meta	Email was sent to email address	`0.100`	`0.100`	`0.100`	`0.100`
T_SHARE_50_50	meta	Share the money 50/50	`0.100`	`0.100`	`0.100`	`0.100`
T_SPF_HELO_PERMERROR	header	SPF: test of HELO record failed (permerror)	`0.100`	`0.100`	`0.100`	`0.100`
T_SPF_HELO_TEMPERROR	header	SPF: test of HELO record failed (temperror)	`0.100`	`0.100`	`0.100`	`0.100`
T_SPF_PERMERROR	header	SPF: test of record failed (permerror)	`0.100`	`0.100`	`0.100`	`0.100`
T_SPF_TEMPERROR	header	SPF: test of record failed (temperror)	`0.100`	`0.100`	`0.100`	`0.100`
T_STY_INVIS_DIRECT	meta	HTML hidden text + direct-to-MX	`0.100`	`0.100`	`0.100`	`0.100`
T_SUSPNTLD_EXPIRATION_EXTORT	meta	Susp NTLD with an expiration notice and lotsa money	`0.100`	`0.100`	`0.100`	`0.100`
T_TONOM_EQ_TOLOC_SHRT_PSHRTNER	meta	Short subject with potential shortener and To:name eq To:local	`0.100`	`0.100`	`0.100`	`0.100`
T_WON_MONEY_ATTACH	meta	You won lots of money! See attachment.	`0.100`	`0.100`	`0.100`	`0.100`
T_WON_NBDY_ATTACH	meta	You won lots of money! See attachment.	`0.100`	`0.100`	`0.100`	`0.100`
T_ZW_OBFU_BITCOIN	meta	Obfuscated text + bitcoin ID - possible extortion	`0.100`	`0.100`	`0.100`	`0.100`
T_ZW_OBFU_FREEM	meta	Obfuscated text + freemail	`0.100`	`0.100`	`0.100`	`0.100`
T_ZW_OBFU_FROMTOSUBJ	meta	Obfuscated text + from in to and subject	`0.100`	`0.100`	`0.100`	`0.100`
UC_GIBBERISH_OBFU	meta	Multiple instances of "word VERYLONGGIBBERISH word"	`1.000`	`1.000`	`1.000`	`1.000`
UNCLAIMED_MONEY	body	People just leave money laying around	`2.699`	`2.699`	`2.699`	`2.427`
UNCLOSED_BRACKET	header	Headers contain an unclosed bracket	`2.699`	`1.329`	`1.425`	`1.496`
UNDISC_FREEM	meta	Undisclosed recipients + freemail reply-to	`2.999`	`2.899`	`2.999`	`2.899`
UNDISC_MONEY	meta	Undisclosed recipients + money/fraud signs	`2.748`	`1.979`	`2.748`	`1.979`
UNICODE_OBFU_ASC	meta	Obfuscating text with unicode	`1.000`	`2.499`	`1.000`	`2.499`
UNICODE_OBFU_ZW	meta	Obfuscating text with hidden characters	`1.000`	`1.000`	`1.000`	`1.000`
UNPARSEABLE_RELAY	meta	Informational: message has unparseable relay lines	`0.001`	`0.001`	`0.001`	`0.001`
UNRESOLVED_TEMPLATE	header	Headers contain an unresolved template	`3.035`	`0.716`	`2.424`	`1.252`
UNSUB_GOOG_FORM	meta	Unsubscribe via Google Docs form	`1.000`	`1.000`	`1.000`	`1.000`
UNWANTED_LANGUAGE_BODY	body	Message written in an undesired language	`2.800`	`2.800`	`2.800`	`2.800`
UPPERCASE_50_75	meta	message body is 50-75% uppercase	`0.001`	`0.791`	`0.001`	`0.008`
UPPERCASE_75_100	meta	message body is 75-100% uppercase	`1.480`	`1.189`	`0.001`	`0.001`
URG_BIZ	meta	Contains urgent matter	`1.750`	`0.941`	`0.568`	`0.573`
URIBL_ABUSE_SURBL	body	Contains an URL listed in the ABUSE SURBL blocklist	`0.000`	`1.948`	`0.000`	`1.250`
URIBL_CR_SURBL	body	Contains an URL listed in the CR SURBL blocklist	`0.000`	`1.263`	`0.000`	`1.263`
URIBL_CSS	body	Contains an URL's NS IP listed in the Spamhaus CSS blocklist	`0.000`	`0.100`	`0.000`	`0.100`
URIBL_CSS_A	body	Contains URL's A record listed in the Spamhaus CSS blocklist	`0.000`	`0.100`	`0.000`	`0.100`
URIBL_DBL_ABUSE_BOTCC	body	Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_DBL_ABUSE_MALW	body	Contains an abused malware URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_DBL_ABUSE_PHISH	body	Contains an abused phishing URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_DBL_ABUSE_REDIR	body	Contains an abused redirector URL listed in the Spamhaus DBL blocklist	`0.000`	`0.001`	`0.000`	`0.001`
URIBL_DBL_ABUSE_SPAM	body	Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist	`0.000`	`2.000`	`0.000`	`2.000`
URIBL_DBL_BLOCKED	body	ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/	`0.000`	`0.001`	`0.000`	`0.001`
URIBL_DBL_BLOCKED_OPENDNS	body	ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/	`0.000`	`0.001`	`0.000`	`0.001`
URIBL_DBL_BOTNETCC	body	Contains a botned C&C URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_DBL_ERROR	body	Error: queried the Spamhaus DBL blocklist for an IP	`0.000`	`0.001`	`0.000`	`0.001`
URIBL_DBL_MALWARE	body	Contains a malware URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_DBL_PHISH	body	Contains a Phishing URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_DBL_SPAM	body	Contains a spam URL listed in the Spamhaus DBL blocklist	`0.000`	`2.500`	`0.000`	`2.500`
URIBL_MW_SURBL	body	Contains a URL listed in the MW SURBL blocklist	`0.000`	`1.263`	`0.000`	`1.263`
URIBL_PH_SURBL	body	Contains an URL listed in the PH SURBL blocklist	`0.000`	`0.001`	`0.000`	`0.610`
URIBL_RHS_DOB	body	Contains an URI of a new domain (Day Old Bread)	`0.000`	`0.276`	`0.000`	`1.514`
URIBL_SBL	body	Contains an URL's NS IP listed in the Spamhaus SBL blocklist	`0.000`	`0.644`	`0.000`	`1.623`
URIBL_SBL_A	body	Contains URL's A record listed in the Spamhaus SBL blocklist	`0.000`	`0.100`	`0.000`	`0.100`
URIBL_ZEN_BLOCKED	body	ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/	`0.000`	`0.001`	`0.000`	`0.001`
URIBL_ZEN_BLOCKED_OPENDNS	body	ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/	`0.000`	`0.001`	`0.000`	`0.001`
URI_ADOBESPARK	meta	No description provided	`1.000`	`1.000`	`1.000`	`1.000`
URI_AZURE_CLOUDAPP	meta	Link to hosted azure web application, possible phishing	`1.000`	`1.000`	`1.000`	`1.000`
URI_DASHGOVEDU	meta	Suspicious domain name	`1.000`	`1.000`	`1.000`	`1.000`
URI_DATA	meta	"data:" URI - possible malware or phish	`1.000`	`1.000`	`1.000`	`1.000`
URI_DOTEDU	meta	Has .edu URI	`1.000`	`1.678`	`1.000`	`1.678`
URI_DOTEDU_ENTITY	meta	Via .edu MTA + suspicious HTML content	`1.000`	`1.000`	`1.000`	`1.000`
URI_DOTTY_HEX	meta	Suspicious URI format	`1.000`	`1.000`	`1.000`	`1.000`
URI_DQ_UNSUB	meta	IP-address unsubscribe URI	`1.000`	`1.000`	`1.000`	`1.000`
URI_FIREBASEAPP	meta	Link to hosted firebase web application, possible phishing	`1.000`	`1.000`	`1.000`	`1.000`
URI_GOOGLE_PROXY	meta	Accessing a blacklisted URI or obscuring source of phish via Google proxy?	`1.799`	`1.599`	`1.799`	`1.599`
URI_GOOG_STO_SPAMMY	uri	Link to spammy content hosted by google storage	`3.500`	`3.500`	`3.500`	`3.500`
URI_HEX	uri	URI hostname has long hexadecimal sequence	`0.100`	`0.100`	`0.100`	`0.100`
URI_HEX_IP	meta	URI with hex-encoded IP-address host	`1.000`	`1.000`	`1.000`	`1.000`
URI_HOST_IN_BLACKLIST	meta	DEPRECATED: See URI_HOST_IN_BLOCKLIST	`100.000`	`100.000`	`100.000`	`100.000`
URI_HOST_IN_BLOCKLIST	body	Host or Domain is listed in the user's URI block-list	`0.010`	`0.010`	`0.010`	`0.010`
URI_HOST_IN_WELCOMELIST	body	Host or Domain is listed in the user's URI welcome-list	`-0.010`	`-0.010`	`-0.010`	`-0.010`
URI_HOST_IN_WHITELIST	meta	DEPRECATED: See URI_HOST_IN_WELCOMELIST	`-100.000`	`-100.000`	`-100.000`	`-100.000`
URI_IMG_WP_REDIR	meta	Image via WordPress "accelerator" proxy	`1.000`	`1.000`	`1.000`	`1.000`
URI_LONG_REPEAT	meta	Long identical host+domain	`1.000`	`1.000`	`1.000`	`1.000`
URI_MALWARE_SCMS	uri	Link to malware exploit download (.SettingContent-ms file)	`1.000`	`1.000`	`1.000`	`1.000`
URI_NOVOWEL	uri	URI hostname has long non-vowel sequence	`0.500`	`0.500`	`0.500`	`0.500`
URI_NO_WWW_BIZ_CGI	uri	CGI in .biz TLD other than third-level "www"	`1.000`	`1.000`	`1.000`	`1.000`
URI_NO_WWW_INFO_CGI	uri	CGI in .info TLD other than third-level "www"	`1.000`	`1.000`	`1.000`	`1.000`
URI_ONLY_MSGID_MALF	meta	URI only + malformed message ID	`1.000`	`1.000`	`1.000`	`1.000`
URI_OPTOUT_3LD	uri	Opt-out URI, suspicious hostname	`1.000`	`2.000`	`1.000`	`2.000`
URI_OPTOUT_USME	uri	Opt-out URI, unusual TLD	`1.000`	`1.000`	`1.000`	`1.000`
URI_PHISH	meta	Phishing using web form	`3.999`	`3.627`	`3.999`	`3.627`
URI_PHP_REDIR	meta	PHP redirect to different URL (link obfuscation)	`1.000`	`1.000`	`1.000`	`1.000`
URI_TRUNCATED	body	Message contained a URI which was truncated	`0.001`	`0.001`	`0.001`	`0.001`
URI_TRY_3LD	meta	"Try it" URI, suspicious hostname	`1.999`	`1.667`	`1.999`	`1.667`
URI_TRY_USME	meta	"Try it" URI, unusual TLD	`1.000`	`1.000`	`1.000`	`1.000`
URI_WPADMIN	meta	WordPress login/admin URI, possible phishing	`0.001`	`2.299`	`0.001`	`2.299`
URI_WP_DIRINDEX	meta	URI for compromised WordPress site, possible malware	`1.000`	`1.000`	`1.000`	`1.000`
URI_WP_HACKED	meta	URI for compromised WordPress site, possible malware	`3.500`	`3.499`	`3.500`	`3.499`
URI_WP_HACKED_2	meta	URI for compromised WordPress site, possible malware	`2.499`	`2.499`	`2.499`	`2.499`
URL_SHORTENER_CHAINED	body	Message contains shortened URL chained to other shorteners	`0.010`	`0.010`	`0.010`	`0.010`
URL_SHORTENER_DISABLED	uri	Message contains shortened URL that has been disabled due to abuse	`2.000`	`2.000`	`2.000`	`2.000`
USB_DRIVES	meta	Trying to sell custom USB flash drives	`1.000`	`1.000`	`1.000`	`1.000`
USER_IN_ALL_SPAM_TO	header	User is listed in 'all_spam_to'	`-100.000`	`-100.000`	`-100.000`	`-100.000`
USER_IN_BLACKLIST	meta	DEPRECATED: See USER_IN_BLOCKLIST	`100.000`	`100.000`	`100.000`	`100.000`
USER_IN_BLACKLIST_TO	meta	DEPRECATED: See USER_IN_BLOCKLIST_TO	`10.000`	`10.000`	`10.000`	`10.000`
USER_IN_BLOCKLIST	header	From: user is listed in the block-list	`0.010`	`0.010`	`0.010`	`0.010`
USER_IN_BLOCKLIST_TO	header	User is listed in 'blocklist_to'	`0.010`	`0.010`	`0.010`	`0.010`
USER_IN_DEF_DKIM_WL	header	From: address is in the default DKIM welcome-list	`-7.500`	`-7.500`	`-7.500`	`-7.500`
USER_IN_DEF_SPF_WL	header	From: address is in the default SPF welcome-list	`-7.500`	`-7.500`	`-7.500`	`-7.500`
USER_IN_DEF_WELCOMELIST	header	From: user is listed in the default welcome-list	`-0.010`	`-0.010`	`-0.010`	`-0.010`
USER_IN_DEF_WHITELIST	meta	DEPRECATED: See USER_IN_DEF_WELCOMELIST	`-15.000`	`-15.000`	`-15.000`	`-15.000`
USER_IN_DKIM_WELCOMELIST	header	From: address is in the user's DKIM welcomelist	`-0.010`	`-0.010`	`-0.010`	`-0.010`
USER_IN_DKIM_WHITELIST	meta	DEPRECATED: See USER_IN_DKIM_WELCOMELIST	`-100.000`	`-100.000`	`-100.000`	`-100.000`
USER_IN_MORE_SPAM_TO	header	User is listed in 'more_spam_to'	`-20.000`	`-20.000`	`-20.000`	`-20.000`
USER_IN_SPF_WELCOMELIST	header	From: address is in the user's SPF welcomelist	`-0.010`	`-0.010`	`-0.010`	`-0.010`
USER_IN_SPF_WHITELIST	meta	DEPRECATED: See USER_IN_SPF_WELCOMELIST	`-100.000`	`-100.000`	`-100.000`	`-100.000`
USER_IN_WELCOMELIST	header	User is listed in 'welcomelist_from'	`-0.010`	`-0.010`	`-0.010`	`-0.010`
USER_IN_WELCOMELIST_TO	header	User is listed in 'welcomelist_to'	`-0.010`	`-0.010`	`-0.010`	`-0.010`
USER_IN_WHITELIST	meta	DEPRECATED: See USER_IN_WELCOMELIST	`-100.000`	`-100.000`	`-100.000`	`-100.000`
USER_IN_WHITELIST_TO	meta	DEPRECATED: See USER_IN_WELCOMELIST_TO	`-6.000`	`-6.000`	`-6.000`	`-6.000`
VBOUNCE_MESSAGE	meta	Virus-scanner bounce message	`0.100`	`0.100`	`0.100`	`0.100`
VFY_ACCT_NORDNS	meta	Verify your account to a poorly-configured MTA - probable phishing	`2.622`	`2.999`	`2.622`	`2.999`
VPS_NO_NTLD	meta	vps[0-9] domain at a suspiscious TLD	`1.000`	`1.000`	`1.000`	`1.000`
WALMART_IMG_NOT_RCVD_WAL	meta	Walmart hosted image but message not from Walmart	`1.000`	`1.000`	`1.000`	`1.000`
WEIRD_PORT	uri	Uses non-standard port number for HTTP	`0.001`	`0.001`	`0.097`	`0.001`
WEIRD_QUOTING	body	Weird repeated double-quotation marks	`0.001`	`0.001`	`0.001`	`0.001`
WORD_INVIS	meta	A hidden word	`1.576`	`0.504`	`1.576`	`0.504`
WORD_INVIS_MANY	meta	Multiple individual hidden words	`3.000`	`2.999`	`3.000`	`2.999`
XFER_LOTSA_MONEY	meta	Transfer a lot of money	`0.541`	`0.498`	`0.541`	`0.498`
XM_DIGITS_ONLY	meta	X-Mailer malformed	`1.000`	`1.000`	`1.000`	`1.000`
XM_PHPMAILER_FORGED	meta	Apparently forged header	`1.000`	`1.000`	`1.000`	`1.000`
XM_RANDOM	meta	X-Mailer apparently random	`1.352`	`2.302`	`1.352`	`2.302`
XM_RECPTID	meta	Has spammy message header	`2.999`	`1.602`	`2.999`	`1.602`
XPRIO	meta	Has X-Priority header	`0.397`	`0.001`	`0.397`	`0.001`
XPRIO_SHORT_SUBJ	meta	Has X Priority header + short subject	`1.000`	`1.000`	`1.000`	`1.000`
XPRIO_URL_SHORTNER	meta	X-Priority header and short URL	`0.523`	`0.999`	`0.523`	`0.999`
X_IP	header	Message has X-IP header	`0.001`	`0.001`	`0.001`	`0.001`
X_MAILER_CME_6543_MSN	header	No description provided	`2.886`	`2.004`	`3.002`	`3.348`
YOU_INHERIT	meta	Discussing your inheritance	`0.926`	`1.345`	`0.926`	`1.345`
__DC_GIF_MULTI_LARGO	meta	Message has 2+ inline gif covering lots of area	`1.000`	`1.000`	`1.000`	`1.000`
__DC_IMG_HTML_RATIO	rawbody	Low rawbody to pixel area ratio	`1.000`	`1.000`	`1.000`	`1.000`
__DC_IMG_TEXT_RATIO	body	Low body to pixel area ratio	`1.000`	`1.000`	`1.000`	`1.000`
__DC_PNG_MULTI_LARGO	meta	Message has 2+ png images covering lots of area	`1.000`	`1.000`	`1.000`	`1.000`
__DKIM_DEPENDABLE	full	A validation failure not attributable to truncation	`1.000`	`1.000`	`1.000`	`1.000`
__FORGED_TBIRD_IMG	meta	Possibly forged Thunderbird image spam	`1.000`	`1.000`	`1.000`	`1.000`
__FROM_41_FREEMAIL	meta	Sent from Africa + freemail provider	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_DE	meta	German Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_EN	meta	English Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_ES	meta	Spanish Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_FR	meta	French Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_IT	meta	Italian Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_NL	meta	Dutch Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__GB_BITCOIN_CP_SE	meta	Swedish Bitcoin scam	`1.000`	`1.000`	`1.000`	`1.000`
__HAS_HREF	rawbody	Has an anchor tag with a href attribute in non-quoted line	`1.000`	`1.000`	`1.000`	`1.000`
__HAS_HREF_ONECASE	rawbody	Has an anchor tag with a href attribute in non-quoted line with consistent case	`1.000`	`1.000`	`1.000`	`1.000`
__HAS_IMG_SRC	rawbody	Has an img tag on a non-quoted line	`1.000`	`1.000`	`1.000`	`1.000`
__HAS_IMG_SRC_ONECASE	rawbody	Has an img tag on a non-quoted line with consistent case	`1.000`	`1.000`	`1.000`	`1.000`
__KAM_BODY_LENGTH_LT_1024	body	The length of the body of the email is less than 1024 bytes.	`1.000`	`1.000`	`1.000`	`1.000`
__KAM_BODY_LENGTH_LT_128	body	The length of the body of the email is less than 128 bytes.	`1.000`	`1.000`	`1.000`	`1.000`
__KAM_BODY_LENGTH_LT_256	body	The length of the body of the email is less than 256 bytes.	`1.000`	`1.000`	`1.000`	`1.000`
__KAM_BODY_LENGTH_LT_512	body	The length of the body of the email is less than 512 bytes.	`1.000`	`1.000`	`1.000`	`1.000`
__MIME_BASE64	rawbody	Includes a base64 attachment	`1.000`	`1.000`	`1.000`	`1.000`
__MIME_QP	rawbody	Includes a quoted-printable attachment	`1.000`	`1.000`	`1.000`	`1.000`
__ML_TURNS_SP_TO_TAB	header	A mailing list changing a space to a TAB	`1.000`	`1.000`	`1.000`	`1.000`
__NSL_ORIG_FROM_41	header	Originates from 41.0.0.0/8	`1.000`	`1.000`	`1.000`	`1.000`
__NSL_RCVD_FROM_41	header	Received from 41.0.0.0/8	`1.000`	`1.000`	`1.000`	`1.000`
__RCVD_IN_MSPIKE_Z	header	Spam wave participant	`1.000`	`1.000`	`1.000`	`1.000`
__RCVD_IN_SORBS	header	SORBS: sender is listed in SORBS	`1.000`	`1.000`	`1.000`	`1.000`
__RCVD_IN_ZEN	header	Received via a relay in Spamhaus Zen	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_ADELPHIA	header	Relay HELO'd using suspicious hostname (Adelphia)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_ATTBI	header	Relay HELO'd using suspicious hostname (ATTBI.com)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_CHELLO_NL	header	Relay HELO'd using suspicious hostname (Chello.nl)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_CHELLO_NO	header	Relay HELO'd using suspicious hostname (Chello.no)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_COMCAST	header	Relay HELO'd using suspicious hostname (Comcast)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_DHCP	header	Relay HELO'd using suspicious hostname (DHCP)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_DIALIN	header	Relay HELO'd using suspicious hostname (T-Dialin)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_HCC	header	Relay HELO'd using suspicious hostname (HCC)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_HEXIP	header	Relay HELO'd using suspicious hostname (Hex IP)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_IPADDR	header	Relay HELO'd using suspicious hostname (IP addr 1)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_NTL	header	Relay HELO'd using suspicious hostname (NTL)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_OOL	header	Relay HELO'd using suspicious hostname (OptOnline)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_ROGERS	header	Relay HELO'd using suspicious hostname (Rogers)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_RR2	header	Relay HELO'd using suspicious hostname (RR 2)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_SPLIT_IP	header	Relay HELO'd using suspicious hostname (Split IP)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_TELIA	header	Relay HELO'd using suspicious hostname (Telia)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_VELOX	header	Relay HELO'd using suspicious hostname (Veloxzone)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_VTR	header	Relay HELO'd using suspicious hostname (VTR)	`1.000`	`1.000`	`1.000`	`1.000`
__RDNS_DYNAMIC_YAHOOBB	header	Relay HELO'd using suspicious hostname (YahooBB)	`1.000`	`1.000`	`1.000`	`1.000`
__TO_EQ_FROM	meta	To: same as From:	`1.000`	`1.000`	`1.000`	`1.000`
__TO_EQ_FROM_DOM	meta	To: domain same as From: domain	`1.000`	`1.000`	`1.000`	`1.000`
__TO_EQ_FROM_USR	meta	To: username same as From: username	`1.000`	`1.000`	`1.000`	`1.000`
__TO_EQ_FROM_USR_NN	meta	To: username same as From: username sans trailing nums	`1.000`	`1.000`	`1.000`	`1.000`
__VIA_ML	meta	Mail from a mailing list	`1.000`	`1.000`	`1.000`	`1.000`
__VIA_RESIGNER	meta	Mail through a popular signing remailer	`1.000`	`1.000`	`1.000`	`1.000`

FutureQuest Site Search

Follow @FutureQuest

FutureQuest Professional Web Hosting Services