]>
Commit | Line | Data |
---|---|---|
151f49fd | 1 | score ACCT_PHISHING_MANY 2.561 2.999 2.561 2.999 |
b780ea8d SI |
2 | score AC_BR_BONANZA 0.001 0.001 0.001 0.001 |
3 | score AC_DIV_BONANZA 0.001 0.001 0.001 0.001 | |
151f49fd SI |
4 | score AC_FROM_MANY_DOTS 2.499 2.499 2.499 2.499 |
5 | score AC_HTML_NONSENSE_TAGS 1.999 1.999 1.999 1.999 | |
6 | score AC_POST_EXTRAS 0.001 1.417 0.001 1.417 | |
b780ea8d SI |
7 | score AC_SPAMMY_URI_PATTERNS1 1.000 1.000 1.000 1.000 |
8 | score AC_SPAMMY_URI_PATTERNS10 1.000 1.000 1.000 1.000 | |
9 | score AC_SPAMMY_URI_PATTERNS11 1.000 1.000 1.000 1.000 | |
10 | score AC_SPAMMY_URI_PATTERNS12 1.000 1.000 1.000 1.000 | |
11 | score AC_SPAMMY_URI_PATTERNS2 1.000 1.000 1.000 1.000 | |
12 | score AC_SPAMMY_URI_PATTERNS3 1.000 1.000 1.000 1.000 | |
13 | score AC_SPAMMY_URI_PATTERNS4 1.000 1.000 1.000 1.000 | |
14 | score AC_SPAMMY_URI_PATTERNS8 1.000 1.000 1.000 1.000 | |
15 | score AC_SPAMMY_URI_PATTERNS9 1.000 1.000 1.000 1.000 | |
151f49fd | 16 | score ADMITS_SPAM 3.199 3.099 3.199 3.099 |
dfdd1e08 | 17 | score ADULT_DATING_COMPANY 10.000 10.000 10.000 10.000 |
31955ede | 18 | score ADVANCE_FEE_2_NEW_FORM 1.000 1.000 1.000 1.000 |
151f49fd SI |
19 | score ADVANCE_FEE_2_NEW_FRM_MNY 1.000 2.063 1.000 2.063 |
20 | score ADVANCE_FEE_2_NEW_MONEY 1.999 1.999 1.999 1.999 | |
21 | score ADVANCE_FEE_3_NEW 3.499 3.266 3.499 3.266 | |
22 | score ADVANCE_FEE_3_NEW_MONEY 0.001 0.001 0.001 0.001 | |
23 | score ADVANCE_FEE_4_NEW 0.803 0.001 0.803 0.001 | |
24 | score ADVANCE_FEE_4_NEW_FRM_MNY 0.674 1.242 0.674 1.242 | |
25 | score ADVANCE_FEE_4_NEW_MONEY 0.001 0.001 0.001 0.001 | |
26 | score ADVANCE_FEE_5_NEW_FRM_MNY 0.001 0.001 0.001 0.001 | |
27 | score ADVANCE_FEE_5_NEW_MONEY 0.001 0.662 0.001 0.662 | |
28 | score AD_PREFS 0.001 0.001 0.001 0.001 | |
29 | score ALIBABA_IMG_NOT_RCVD_ALI 1.000 1.000 1.000 1.000 | |
30 | score AMAZON_IMG_NOT_RCVD_AMZN 2.499 2.499 2.499 2.499 | |
b780ea8d | 31 | score APP_DEVELOPMENT_FREEM 1.000 1.000 1.000 1.000 |
dfdd1e08 | 32 | score APP_DEVELOPMENT_NORDNS 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
33 | score ARC_SIGNED 0.001 0.001 0.001 0.001 |
34 | score ARC_VALID 0.001 0.001 0.001 0.001 | |
dfdd1e08 | 35 | score AXB_XMAILER_MIMEOLE_OL_024C2 0.001 0.001 0.001 0.001 |
151f49fd | 36 | score AXB_X_FF_SEZ_S 3.499 3.399 3.499 3.399 |
31955ede | 37 | score BEBEE_IMG_NOT_RCVD_BB 1.000 1.000 1.000 1.000 |
151f49fd SI |
38 | score BIGNUM_EMAILS_FREEM 1.000 1.000 1.000 1.000 |
39 | score BIGNUM_EMAILS_MANY 1.000 1.000 1.000 1.000 | |
b780ea8d | 40 | score BITCOIN_BOMB 1.000 1.000 1.000 1.000 |
151f49fd SI |
41 | score BITCOIN_DEADLINE 1.586 2.999 1.586 2.999 |
42 | score BITCOIN_EXTORT_01 2.103 0.001 2.103 0.001 | |
b780ea8d | 43 | score BITCOIN_EXTORT_02 1.000 1.000 1.000 1.000 |
dfdd1e08 | 44 | score BITCOIN_IMGUR 1.000 1.000 1.000 1.000 |
151f49fd SI |
45 | score BITCOIN_MALWARE 3.406 0.986 3.406 0.986 |
46 | score BITCOIN_OBFU_SUBJ 1.000 1.000 1.000 1.000 | |
47 | score BITCOIN_ONAN 1.642 1.116 1.642 1.116 | |
b780ea8d SI |
48 | score BITCOIN_PAY_ME 1.000 1.000 1.000 1.000 |
49 | score BITCOIN_SPAM_01 1.000 1.000 1.000 1.000 | |
151f49fd SI |
50 | score BITCOIN_SPAM_02 2.499 2.321 2.499 2.321 |
51 | score BITCOIN_SPAM_03 2.499 1.683 2.499 1.683 | |
fc5290a3 | 52 | score BITCOIN_SPAM_04 1.000 1.000 1.000 1.000 |
151f49fd | 53 | score BITCOIN_SPAM_05 0.001 1.000 0.001 1.000 |
b780ea8d | 54 | score BITCOIN_SPAM_06 1.000 1.000 1.000 1.000 |
151f49fd | 55 | score BITCOIN_SPAM_07 2.903 0.001 2.903 0.001 |
b780ea8d | 56 | score BITCOIN_SPAM_08 1.000 1.000 1.000 1.000 |
151f49fd | 57 | score BITCOIN_SPAM_09 1.499 1.499 1.499 1.499 |
b780ea8d SI |
58 | score BITCOIN_SPAM_10 1.000 1.000 1.000 1.000 |
59 | score BITCOIN_SPAM_11 1.000 1.000 1.000 1.000 | |
60 | score BITCOIN_SPAM_12 1.000 1.000 1.000 1.000 | |
61 | score BITCOIN_SPF_ONLYALL 0.001 1.000 0.001 1.000 | |
151f49fd SI |
62 | score BITCOIN_TOEQFM 1.597 1.539 1.597 1.539 |
63 | score BITCOIN_VISTA 0.001 3.016 0.001 3.016 | |
64 | score BITCOIN_XPRIO 2.499 2.499 2.499 2.499 | |
65 | score BITCOIN_YOUR_INFO 1.000 1.000 1.000 1.000 | |
66 | score BODY_SINGLE_URI 1.680 0.547 1.680 0.547 | |
67 | score BODY_SINGLE_WORD 0.784 0.001 0.784 0.001 | |
68 | score BODY_URI_ONLY 0.178 0.001 0.178 0.001 | |
69 | score BOGUS_MIME_VERSION 3.499 2.706 3.499 2.706 | |
70 | score BOGUS_MSM_HDRS 2.355 2.528 2.355 2.528 | |
cabe596e SI |
71 | score BOMB_FREEM 1.000 1.000 1.000 1.000 |
72 | score BOMB_MONEY 1.000 1.000 1.000 1.000 | |
b780ea8d | 73 | score BTC_ORG 1.000 1.000 1.000 1.000 |
21dcadbf | 74 | score BULK_RE_SUSP_NTLD 1.000 1.000 1.000 1.000 |
b780ea8d | 75 | score CANT_SEE_AD 1.000 1.000 1.000 1.000 |
151f49fd | 76 | score CK_HELO_GENERIC 0.249 0.249 0.249 0.249 |
b780ea8d | 77 | score COMMENT_GIBBERISH 1.000 1.000 1.000 1.000 |
151f49fd | 78 | score COMPENSATION 1.499 0.538 1.499 0.538 |
dfdd1e08 SI |
79 | score CONTENT_AFTER_HTML 1.000 1.000 1.000 1.000 |
80 | score CONTENT_AFTER_HTML_WEAK 1.000 1.000 1.000 1.000 | |
151f49fd SI |
81 | score CTE_8BIT_MISMATCH 0.999 0.001 0.999 0.001 |
82 | score DATE_IN_FUTURE_Q_PLUS 2.760 2.006 2.760 2.006 | |
b780ea8d | 83 | score DAY_I_EARNED 1.000 1.000 1.000 1.000 |
151f49fd | 84 | score DEAR_BENEFICIARY 3.099 2.446 3.099 2.446 |
fc5290a3 | 85 | score DKIMWL_BL 0.001 1.000 0.001 1.000 |
b780ea8d | 86 | score DKIMWL_BLOCKED 0.001 0.001 0.001 0.001 |
151f49fd | 87 | score DKIMWL_WL_HIGH 0.001 -0.014 0.001 -0.014 |
b780ea8d | 88 | score DKIMWL_WL_MED 0.001 -0.001 0.001 -0.001 |
fc5290a3 | 89 | score DKIMWL_WL_MEDHI 0.001 -0.001 0.001 -0.001 |
b780ea8d | 90 | score DOTGOV_IMAGE 1.000 1.000 1.000 1.000 |
151f49fd | 91 | score DSN_NO_MIMEVERSION 1.999 1.999 1.999 1.999 |
31955ede SI |
92 | score DYNAMIC_IMGUR 1.000 1.000 1.000 1.000 |
93 | score EBAY_IMG_NOT_RCVD_EBAY 1.000 1.000 1.000 1.000 | |
151f49fd SI |
94 | score ENCRYPTED_MESSAGE -0.999 -0.999 -0.999 -0.999 |
95 | score END_FUTURE_EMAILS 2.499 2.499 2.499 2.499 | |
b780ea8d | 96 | score ENVFROM_GOOG_TRIX 1.000 1.000 1.000 1.000 |
151f49fd | 97 | score FACEBOOK_IMG_NOT_RCVD_FB 1.999 1.999 1.999 1.999 |
21dcadbf SI |
98 | score FBI_MONEY 1.000 1.000 1.000 1.000 |
99 | score FBI_SPOOF 1.000 1.000 1.000 1.000 | |
151f49fd | 100 | score FILL_THIS_FORM 0.798 0.801 0.798 0.801 |
31955ede SI |
101 | score FONT_INVIS_DIRECT 0.001 0.001 0.001 0.001 |
102 | score FONT_INVIS_DOTGOV 1.000 1.000 1.000 1.000 | |
151f49fd SI |
103 | score FONT_INVIS_HTML_NOHTML 2.487 1.018 2.487 1.018 |
104 | score FONT_INVIS_LONG_LINE 2.162 2.999 2.162 2.999 | |
105 | score FONT_INVIS_MSGID 2.499 2.499 2.499 2.499 | |
106 | score FONT_INVIS_NORDNS 0.001 0.710 0.001 0.710 | |
107 | score FONT_INVIS_POSTEXTRAS 2.590 0.872 2.590 0.872 | |
108 | score FORM_FRAUD 0.999 0.999 0.999 0.999 | |
109 | score FORM_FRAUD_3 2.253 1.199 2.253 1.199 | |
110 | score FORM_FRAUD_5 2.453 1.619 2.453 1.619 | |
dfdd1e08 | 111 | score FOUND_YOU 1.000 1.000 1.000 1.000 |
151f49fd | 112 | score FREEMAIL_FORGED_FROMDOMAIN 0.001 0.001 0.001 0.001 |
b780ea8d SI |
113 | score FREEM_FRNUM_UNICD_EMPTY 1.000 1.000 1.000 1.000 |
114 | score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000 1.000 1.000 1.000 | |
151f49fd | 115 | score FROM_ADDR_WS 1.050 0.001 1.050 0.001 |
dfdd1e08 | 116 | score FROM_BANK_NOAUTH 0.001 1.000 0.001 1.000 |
b780ea8d | 117 | score FROM_FMBLA_NDBLOCKED 0.001 0.001 0.001 0.001 |
151f49fd SI |
118 | score FROM_FMBLA_NEWDOM 0.001 1.352 0.001 1.352 |
119 | score FROM_FMBLA_NEWDOM14 0.001 0.999 0.001 0.999 | |
21dcadbf | 120 | score FROM_FMBLA_NEWDOM28 0.001 0.799 0.001 0.799 |
151f49fd | 121 | score FROM_GOV_DKIM_AU 0.001 -0.156 0.001 -0.156 |
b780ea8d | 122 | score FROM_GOV_REPLYTO_FREEMAIL 0.001 1.000 0.001 1.000 |
31955ede | 123 | score FROM_GOV_SPOOF 0.001 1.000 0.001 1.000 |
151f49fd SI |
124 | score FROM_IN_TO_AND_SUBJ 1.799 1.799 1.799 1.799 |
125 | score FROM_MISSPACED 1.999 1.149 1.999 1.149 | |
126 | score FROM_MISSP_DYNIP 1.661 0.533 1.661 0.533 | |
127 | score FROM_MISSP_EH_MATCH 1.999 2.000 1.999 2.000 | |
128 | score FROM_MISSP_FREEMAIL 2.304 2.401 2.304 2.401 | |
129 | score FROM_MISSP_MSFT 0.892 0.001 0.892 0.001 | |
130 | score FROM_MISSP_PHISH 2.782 3.002 2.782 3.002 | |
131 | score FROM_MISSP_REPLYTO 2.500 0.858 2.500 0.858 | |
132 | score FROM_MISSP_SPF_FAIL 0.001 1.779 0.001 1.779 | |
133 | score FROM_MISSP_TO_UNDISC 3.203 2.332 3.203 2.332 | |
b780ea8d | 134 | score FROM_MISSP_USER 0.001 0.001 0.001 0.001 |
151f49fd | 135 | score FROM_MISSP_XPRIO 2.500 2.499 2.500 2.499 |
dfdd1e08 | 136 | score FROM_NEWDOM_BTC 0.001 1.000 0.001 1.000 |
151f49fd SI |
137 | score FROM_NTLD_LINKBAIT 1.000 1.000 1.000 1.000 |
138 | score FROM_NTLD_REPLY_FREEMAIL 1.663 1.000 1.663 1.000 | |
b780ea8d | 139 | score FROM_NUMBERO_NEWDOMAIN 0.001 1.000 0.001 1.000 |
151f49fd SI |
140 | score FROM_PAYPAL_SPOOF 0.001 0.001 0.001 0.001 |
141 | score FROM_SUSPICIOUS_NTLD 0.499 0.499 0.499 0.499 | |
142 | score FROM_SUSPICIOUS_NTLD_FP 1.999 1.999 1.999 1.999 | |
143 | score FROM_UNBAL1 2.266 2.020 2.266 2.020 | |
144 | score FROM_WSP_TRAIL 2.699 2.699 2.699 2.699 | |
145 | score FSL_BULK_SIG 0.001 0.714 0.001 0.714 | |
b780ea8d | 146 | score FSL_CTYPE_WIN1251 0.001 0.001 0.001 0.001 |
151f49fd | 147 | score FSL_HAS_TINYURL 2.799 2.699 2.799 2.699 |
b780ea8d | 148 | score FSL_NEW_HELO_USER 0.001 0.001 0.001 0.001 |
151f49fd SI |
149 | score FUZZY_AMAZON 2.599 2.499 2.599 2.499 |
150 | score FUZZY_IMPORTANT 2.399 1.996 2.399 1.996 | |
151 | score FUZZY_PRIVACY 2.699 2.699 2.699 2.699 | |
152 | score FUZZY_SECURITY 2.599 2.499 2.599 2.499 | |
153 | score FUZZY_WALLET 1.787 0.001 1.787 0.001 | |
b780ea8d | 154 | score GAPPY_SALES_LEADS_FREEM 1.000 1.000 1.000 1.000 |
151f49fd SI |
155 | score GB_BITCOIN_CP 3.000 2.999 3.000 2.999 |
156 | score GB_CUSTOM_HTM_URI 1.499 0.001 1.499 0.001 | |
157 | score GB_FAKE_RF_SHORT 1.939 1.999 1.939 1.999 | |
b780ea8d | 158 | score GB_FORGED_MUA_POSTFIX 1.000 1.000 1.000 1.000 |
21dcadbf | 159 | score GB_FREEMAIL_DISPTO 0.001 0.001 0.001 0.001 |
31955ede | 160 | score GB_FREEMAIL_DISPTO_NOTFREEM 0.500 0.500 0.500 0.500 |
b780ea8d | 161 | score GB_GOOGLE_OBFUR 0.750 0.750 0.750 0.750 |
151f49fd | 162 | score GB_HASHBL_BTC 0.001 4.852 0.001 4.852 |
b780ea8d SI |
163 | score GOOGLE_DOCS_PHISH 1.000 1.000 1.000 1.000 |
164 | score GOOGLE_DOCS_PHISH_MANY 1.000 1.000 1.000 1.000 | |
31955ede | 165 | score GOOGLE_DOC_SUSP 1.000 1.000 1.000 1.000 |
b780ea8d | 166 | score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000 1.000 1.000 1.000 |
151f49fd SI |
167 | score GOOG_MALWARE_DNLD 3.889 3.186 3.889 3.186 |
168 | score GOOG_REDIR_HTML_ONLY 1.999 1.999 1.999 1.999 | |
169 | score GOOG_REDIR_NORDNS 2.498 0.899 2.498 0.899 | |
dfdd1e08 | 170 | score GOOG_STO_EMAIL_PHISH 1.000 1.000 1.000 1.000 |
31955ede SI |
171 | score GOOG_STO_HTML_PHISH 1.000 1.000 1.000 1.000 |
172 | score GOOG_STO_HTML_PHISH_MANY 1.000 1.000 1.000 1.000 | |
151f49fd | 173 | score GOOG_STO_IMG_HTML 2.501 2.523 2.501 2.523 |
fc5290a3 | 174 | score GOOG_STO_IMG_NOHTML 1.000 1.000 1.000 1.000 |
151f49fd | 175 | score GOOG_STO_NOIMG_HTML 2.496 1.524 2.496 1.524 |
b780ea8d | 176 | score HAS_X_NO_RELAY 1.000 1.000 1.000 1.000 |
151f49fd SI |
177 | score HAS_X_OUTGOING_SPAM_STAT 1.000 1.000 1.000 1.000 |
178 | score HDRS_LCASE_IMGONLY 0.099 0.099 0.099 0.099 | |
179 | score HDRS_MISSP 2.500 2.499 2.500 2.499 | |
180 | score HDR_ORDER_FTSDMCXX_DIRECT 1.999 1.787 1.999 1.787 | |
181 | score HDR_ORDER_FTSDMCXX_NORDNS 3.499 1.931 3.499 1.931 | |
fc5290a3 | 182 | score HEADER_FROM_DIFFERENT_DOMAINS 0.249 0.250 0.249 0.250 |
151f49fd SI |
183 | score HELO_MISC_IP 0.250 0.249 0.250 0.249 |
184 | score HELO_NO_DOMAIN 0.001 0.443 0.001 0.443 | |
fc5290a3 | 185 | score HEXHASH_WORD 1.000 1.000 1.000 1.000 |
b780ea8d | 186 | score HK_CTE_RAW 1.000 1.000 1.000 1.000 |
151f49fd SI |
187 | score HK_LOTTO 0.999 0.999 0.999 0.999 |
188 | score HK_NAME_FM_MR_MRS 1.299 0.402 1.299 0.402 | |
189 | score HK_NAME_MR_MRS 0.999 0.999 0.999 0.999 | |
190 | score HK_RANDOM_ENVFROM 0.999 0.674 0.999 0.674 | |
191 | score HK_RANDOM_FROM 0.999 1.000 0.999 1.000 | |
fc5290a3 | 192 | score HK_RANDOM_REPLYTO 0.999 0.999 0.999 0.999 |
b780ea8d | 193 | score HK_RCVD_IP_MULTICAST 1.000 1.000 1.000 1.000 |
151f49fd SI |
194 | score HK_SCAM 1.999 1.999 1.999 1.999 |
195 | score HOSTED_IMG_DIRECT_MX 3.499 3.220 3.499 3.220 | |
b780ea8d | 196 | score HOSTED_IMG_DQ_UNSUB 1.000 1.000 1.000 1.000 |
151f49fd | 197 | score HOSTED_IMG_FREEM 0.001 0.001 0.001 0.001 |
46cfc9e2 | 198 | score HOSTED_IMG_MULTI 1.000 1.000 1.000 1.000 |
151f49fd SI |
199 | score HOSTED_IMG_MULTI_PUB_01 2.999 2.999 2.999 2.999 |
200 | score HREF_EMPTY_NORDNS 0.004 0.522 0.004 0.522 | |
201 | score HREF_EMPTY_PHPMAIL 1.000 1.000 1.000 1.000 | |
202 | score HREF_EMPTY_XANTIABUSE 1.000 1.000 1.000 1.000 | |
203 | score HREF_EMPTY_XAUTHED 1.000 1.000 1.000 1.000 | |
204 | score HTML_BADATTR 1.000 1.000 1.000 1.000 | |
205 | score HTML_ENTITY_ASCII 2.999 2.999 2.999 2.999 | |
206 | score HTML_ENTITY_ASCII_TINY 1.000 1.000 1.000 1.000 | |
207 | score HTML_FONT_TINY_NORDNS 1.999 1.818 1.999 1.818 | |
208 | score HTML_OFF_PAGE 2.999 2.999 2.999 2.999 | |
46cfc9e2 | 209 | score HTML_SHRT_CMNT_OBFU_MANY 1.000 1.000 1.000 1.000 |
151f49fd SI |
210 | score HTML_SINGLET_MANY 2.499 2.499 2.499 2.499 |
211 | score HTML_TEXT_INVISIBLE_FONT 1.343 1.148 1.343 1.148 | |
212 | score HTML_TEXT_INVISIBLE_STYLE 1.130 0.858 1.130 0.858 | |
213 | score IMG_DIRECT_TO_MX 0.521 0.040 0.521 0.040 | |
214 | score IMG_ONLY_FM_DOM_INFO 1.000 1.000 1.000 1.000 | |
215 | score JH_SPAMMY_HEADERS 3.499 3.499 3.499 3.499 | |
dfdd1e08 | 216 | score JH_SPAMMY_PATTERN01 1.000 1.000 1.000 1.000 |
b780ea8d | 217 | score JH_SPAMMY_PATTERN02 1.000 1.000 1.000 1.000 |
151f49fd SI |
218 | score KHOP_FAKE_EBAY 0.001 0.001 0.001 0.001 |
219 | score KHOP_HELO_FCRDNS 0.399 0.259 0.399 0.259 | |
31955ede | 220 | score LINKEDIN_IMG_NOT_RCVD_LNKN 1.000 1.000 1.000 1.000 |
151f49fd | 221 | score LIST_PARTIAL_SHORT_MSG 2.370 1.001 2.370 1.001 |
b780ea8d | 222 | score LIST_PRTL_PUMPDUMP 1.000 1.000 1.000 1.000 |
46cfc9e2 | 223 | score LIST_PRTL_SAME_USER 1.000 1.000 1.000 1.000 |
151f49fd SI |
224 | score LONGLN_LOW_CONTRAST 2.124 0.001 2.124 0.001 |
225 | score LONG_HEX_URI 3.000 2.158 3.000 2.158 | |
226 | score LONG_IMG_URI 1.944 0.443 1.944 0.443 | |
227 | score LONG_INVISIBLE_TEXT 2.154 2.098 2.154 2.098 | |
b780ea8d | 228 | score LOTS_OF_MONEY 0.010 0.010 0.010 0.010 |
b780ea8d | 229 | score LUCRATIVE 1.000 1.000 1.000 1.000 |
151f49fd | 230 | score MALFORMED_FREEMAIL 2.268 1.248 2.268 1.248 |
b780ea8d | 231 | score MALF_HTML_B64 1.000 1.000 1.000 1.000 |
151f49fd | 232 | score MALWARE_NORDNS 0.839 1.471 0.839 1.471 |
fc5290a3 | 233 | score MALWARE_PASSWORD 1.000 1.000 1.000 1.000 |
151f49fd SI |
234 | score MANY_HDRS_LCASE 0.100 0.001 0.100 0.001 |
235 | score MANY_SUBDOM 3.199 3.100 3.199 3.100 | |
236 | score MAY_BE_FORGED 2.099 0.001 2.099 0.001 | |
237 | score MILLION_HUNDRED 0.001 0.001 0.001 0.001 | |
238 | score MILLION_USD 1.736 0.435 1.736 0.435 | |
239 | score MIMEOLE_DIRECT_TO_MX 1.999 1.126 1.999 1.126 | |
46cfc9e2 | 240 | score MIME_NO_TEXT 1.000 1.000 1.000 1.000 |
dfdd1e08 | 241 | score MIXED_AREA_CASE 1.000 1.000 1.000 1.000 |
151f49fd SI |
242 | score MIXED_CENTER_CASE 2.499 2.238 2.499 2.238 |
243 | score MIXED_ES 2.199 2.199 2.199 2.199 | |
244 | score MIXED_FONT_CASE 1.194 0.739 1.194 0.739 | |
245 | score MIXED_HREF_CASE 1.999 1.999 1.999 1.999 | |
fc5290a3 | 246 | score MIXED_IMG_CASE 1.000 1.000 1.000 1.000 |
b780ea8d SI |
247 | score MONERO_DEADLINE 1.000 1.000 1.000 1.000 |
248 | score MONERO_EXTORT_01 1.000 1.000 1.000 1.000 | |
249 | score MONERO_MALWARE 1.000 1.000 1.000 1.000 | |
250 | score MONERO_PAY_ME 1.000 1.000 1.000 1.000 | |
151f49fd | 251 | score MONEY_ATM_CARD 0.219 0.330 0.219 0.330 |
b780ea8d | 252 | score MONEY_FORM 0.001 0.001 0.001 0.001 |
151f49fd SI |
253 | score MONEY_FORM_SHORT 1.272 1.787 1.272 1.787 |
254 | score MONEY_FRAUD_3 0.953 0.262 0.953 0.262 | |
255 | score MONEY_FRAUD_5 0.001 0.001 0.001 0.001 | |
256 | score MONEY_FRAUD_8 3.099 2.999 3.099 2.999 | |
257 | score MONEY_FREEMAIL_REPTO 2.999 1.084 2.999 1.084 | |
258 | score MONEY_FROM_41 1.999 1.999 1.999 1.999 | |
fc5290a3 | 259 | score MONEY_FROM_MISSP 0.001 0.001 0.001 0.001 |
151f49fd | 260 | score MONEY_NOHTML 2.499 2.499 2.499 2.499 |
b780ea8d | 261 | score MSGID_DOLLARS_URI_IMG 1.000 1.000 1.000 1.000 |
151f49fd SI |
262 | score MSGID_HDR_MALF 2.395 2.997 2.395 2.997 |
263 | score MSGID_NOFQDN1 0.001 1.935 0.001 1.935 | |
b780ea8d | 264 | score MSM_PRIO_REPTO 1.000 1.000 1.000 1.000 |
151f49fd | 265 | score NA_DOLLARS 1.499 0.001 1.499 0.001 |
b780ea8d | 266 | score NEWEGG_IMG_NOT_RCVD_NEGG 1.000 1.000 1.000 1.000 |
31955ede | 267 | score NEW_PRODUCTS 1.000 1.000 1.000 1.000 |
151f49fd SI |
268 | score NICE_REPLY_A -1.545 -1.553 -1.545 -1.553 |
269 | score NORDNS_LOW_CONTRAST 0.001 0.953 0.001 0.953 | |
31955ede | 270 | score NO_FM_NAME_IP_HOSTN 0.001 0.001 0.001 0.001 |
b780ea8d | 271 | score NSL_RCVD_FROM_USER 0.001 0.001 0.001 0.001 |
151f49fd | 272 | score NSL_RCVD_HELO_USER 0.001 0.107 0.001 0.107 |
21dcadbf | 273 | score OBFU_BITCOIN 1.000 1.000 1.000 1.000 |
151f49fd SI |
274 | score OBFU_TEXT_ATTACH 1.499 1.599 1.499 1.599 |
275 | score ODD_FREEM_REPTO 1.000 1.000 1.000 1.000 | |
276 | score PDS_BAD_THREAD_QP_64 0.999 0.001 0.999 0.001 | |
277 | score PDS_BTC_ID 0.499 0.499 0.499 0.499 | |
278 | score PDS_BTC_MSGID 0.001 0.674 0.001 0.674 | |
279 | score PDS_DBL_URL_TNB_RUNON 1.999 2.000 1.999 2.000 | |
280 | score PDS_EMPTYSUBJ_URISHRT 0.736 1.499 0.736 1.499 | |
281 | score PDS_FREEMAIL_REPLYTO_URISHRT 1.499 0.891 1.499 0.891 | |
282 | score PDS_FRNOM_TODOM_DBL_URL 0.001 0.001 0.001 0.001 | |
283 | score PDS_FRNOM_TODOM_NAKED_TO 1.499 0.291 1.499 0.291 | |
284 | score PDS_FROM_NAME_TO_DOMAIN 2.000 1.130 2.000 1.130 | |
285 | score PDS_HELO_SPF_FAIL 0.001 1.999 0.001 1.999 | |
286 | score PDS_HP_HELO_NORDNS 0.498 0.001 0.498 0.001 | |
287 | score PDS_NAKED_TO_NUMERO 1.000 1.000 1.000 1.000 | |
288 | score PDS_OTHER_BAD_TLD 1.999 1.999 1.999 1.999 | |
289 | score PDS_PHP_EVAL 1.500 1.499 1.500 1.499 | |
290 | score PDS_TINYSUBJ_URISHRT 0.001 1.499 0.001 1.499 | |
291 | score PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 1.999 1.999 1.999 1.999 | |
b780ea8d | 292 | score PHISH_AZURE_CLOUDAPP 3.500 3.500 3.500 3.500 |
cabe596e | 293 | score PHISH_FBASEAPP 1.000 1.000 1.000 1.000 |
b780ea8d | 294 | score PHP_NOVER_MUA 1.000 1.000 1.000 1.000 |
151f49fd SI |
295 | score PHP_ORIG_SCRIPT 1.000 1.000 1.000 1.000 |
296 | score PHP_ORIG_SCRIPT_EVAL 3.000 2.999 3.000 2.999 | |
297 | score PHP_SCRIPT 2.499 2.499 2.499 2.499 | |
b780ea8d | 298 | score PHP_SCRIPT_MUA 1.000 1.000 1.000 1.000 |
dfdd1e08 | 299 | score PP_MIME_FAKE_ASCII_TEXT 0.999 0.001 0.999 0.001 |
b780ea8d SI |
300 | score PP_TOO_MUCH_UNICODE02 0.500 0.500 0.500 0.500 |
301 | score PP_TOO_MUCH_UNICODE05 1.000 1.000 1.000 1.000 | |
302 | score PUMPDUMP 1.000 1.000 1.000 1.000 | |
303 | score PUMPDUMP_MULTI 1.000 1.000 1.000 1.000 | |
31955ede | 304 | score RAND_HEADER_LIST_SPOOF 1.000 1.000 1.000 1.000 |
b780ea8d | 305 | score RAND_HEADER_MANY 1.000 1.000 1.000 1.000 |
151f49fd SI |
306 | score RAND_MKTG_HEADER 2.000 1.969 2.000 1.969 |
307 | score RATWARE_NO_RDNS 2.682 1.148 2.682 1.148 | |
b780ea8d | 308 | score RCVD_DOTEDU_SHORT 1.000 1.000 1.000 1.000 |
151f49fd | 309 | score RCVD_DOTEDU_SUSP 0.331 0.914 0.331 0.914 |
46cfc9e2 | 310 | score RCVD_DOTEDU_SUSP_URI 1.000 1.000 1.000 1.000 |
151f49fd SI |
311 | score RCVD_IN_IADB_COURT 0.001 -0.001 0.001 -0.001 |
312 | score RCVD_IN_IADB_LEG_MAND 0.001 -0.001 0.001 -0.001 | |
fc5290a3 | 313 | score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001 |
b780ea8d | 314 | score RCVD_IN_MSPIKE_H2 0.001 -0.001 0.001 -0.001 |
fc5290a3 SI |
315 | score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001 |
316 | score RCVD_IN_MSPIKE_H4 0.001 0.001 0.001 0.001 | |
317 | score RCVD_IN_MSPIKE_H5 0.001 0.001 0.001 0.001 | |
318 | score RCVD_IN_MSPIKE_L2 0.001 0.001 0.001 0.001 | |
319 | score RCVD_IN_MSPIKE_L3 0.001 0.001 0.001 0.001 | |
320 | score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001 | |
321 | score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001 | |
322 | score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001 | |
323 | score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001 | |
b780ea8d | 324 | score RDNS_NUM_TLD_ATCHNX 1.000 1.000 1.000 1.000 |
dfdd1e08 | 325 | score RDNS_NUM_TLD_XM 1.000 1.000 1.000 1.000 |
151f49fd | 326 | score REPTO_419_FRAUD 1.000 1.000 1.000 1.000 |
b780ea8d SI |
327 | score REPTO_419_FRAUD_AOL 1.000 1.000 1.000 1.000 |
328 | score REPTO_419_FRAUD_AOL_LOOSE 1.000 1.000 1.000 1.000 | |
329 | score REPTO_419_FRAUD_CNS 1.000 1.000 1.000 1.000 | |
151f49fd SI |
330 | score REPTO_419_FRAUD_GM 2.999 2.794 2.999 2.794 |
331 | score REPTO_419_FRAUD_GM_LOOSE 0.999 0.999 0.999 0.999 | |
b780ea8d SI |
332 | score REPTO_419_FRAUD_HM 1.000 1.000 1.000 1.000 |
333 | score REPTO_419_FRAUD_OL 1.000 1.000 1.000 1.000 | |
334 | score REPTO_419_FRAUD_PM 1.000 1.000 1.000 1.000 | |
46cfc9e2 | 335 | score REPTO_419_FRAUD_QQ 1.000 1.000 1.000 1.000 |
b780ea8d SI |
336 | score REPTO_419_FRAUD_YH 1.000 1.000 1.000 1.000 |
337 | score REPTO_419_FRAUD_YH_LOOSE 1.000 1.000 1.000 1.000 | |
151f49fd | 338 | score REPTO_419_FRAUD_YJ 1.000 1.639 1.000 1.639 |
b780ea8d | 339 | score REPTO_419_FRAUD_YN 1.000 1.000 1.000 1.000 |
dfdd1e08 | 340 | score REPTO_INFONUMSCOM 1.000 1.000 1.000 1.000 |
151f49fd | 341 | score RISK_FREE 0.001 0.354 0.001 0.354 |
fc5290a3 | 342 | score SCC_BODY_SINGLE_WORD 0.001 0.001 0.001 0.001 |
151f49fd SI |
343 | score SCC_BODY_URI_ONLY 1.940 2.699 1.940 2.699 |
344 | score SCC_CANSPAM_1 1.941 0.202 1.941 0.202 | |
345 | score SCC_CANSPAM_2 3.799 3.599 3.799 3.599 | |
346 | score SCC_CTMPP 2.210 1.756 2.210 1.756 | |
dfdd1e08 | 347 | score SCC_ISEMM_LID_1 1.000 1.000 1.000 1.000 |
151f49fd SI |
348 | score SCC_ISEMM_LID_1A 1.000 1.000 1.000 1.000 |
349 | score SCC_ISEMM_LID_1B 1.499 1.499 1.499 1.499 | |
350 | score SCC_SPAMMER_ADDR_2 2.243 2.803 2.243 2.803 | |
351 | score SENDGRID_REDIR 1.500 1.500 1.500 1.500 | |
b780ea8d | 352 | score SENDGRID_REDIR_PHISH 1.000 1.000 1.000 1.000 |
dfdd1e08 | 353 | score SEO_SUSP_NTLD 1.000 1.000 1.000 1.000 |
151f49fd SI |
354 | score SHOPIFY_IMG_NOT_RCVD_SFY 2.499 2.499 2.499 2.499 |
355 | score SHORTENER_SHORT_IMG 0.001 0.739 0.001 0.739 | |
356 | score SHORTENER_SHORT_SUBJ 0.238 0.001 0.238 0.001 | |
46cfc9e2 | 357 | score SHORT_IMG_SUSP_NTLD 1.000 1.000 1.000 1.000 |
151f49fd SI |
358 | score SHORT_SHORTNER 1.999 0.001 1.999 0.001 |
359 | score SHY_OBFU_EXPIRE 1.000 1.000 1.000 1.000 | |
360 | score SHY_OBFU_PASSWORD 1.000 1.000 1.000 1.000 | |
361 | score SPAM_CWINDOWSNET 0.349 0.685 0.349 0.685 | |
362 | score SPOOFED_FREEMAIL 0.001 1.795 0.001 1.795 | |
363 | score SPOOFED_FREEMAIL_NO_RDNS 1.155 0.001 1.155 0.001 | |
364 | score SPOOFED_FREEM_REPTO 0.001 2.075 0.001 2.075 | |
fc5290a3 | 365 | score SPOOFED_FREEM_REPTO_CHN 0.001 1.000 0.001 1.000 |
b780ea8d | 366 | score SPOOFED_FREEM_REPTO_RUS 0.001 1.000 0.001 1.000 |
151f49fd SI |
367 | score SPOOF_GMAIL_MID 1.499 0.998 1.499 0.998 |
368 | score STATIC_XPRIO_OLE 1.995 0.764 1.995 0.764 | |
b780ea8d | 369 | score STOCK_TIP 1.000 1.000 1.000 1.000 |
151f49fd | 370 | score SUBJ_ATTENTION 0.499 0.499 0.499 0.499 |
31955ede | 371 | score SUBJ_BRKN_WORDNUMS 1.000 1.000 1.000 1.000 |
fc5290a3 | 372 | score SURBL_BLOCKED 0.001 0.001 0.001 0.001 |
151f49fd SI |
373 | score SUSP_UTF8_WORD_FROM 1.999 1.999 1.999 1.999 |
374 | score SUSP_UTF8_WORD_MANY 2.999 2.999 2.999 2.999 | |
b780ea8d | 375 | score SYSADMIN 1.000 1.000 1.000 1.000 |
31955ede SI |
376 | score TAGSTAT_IMG_NOT_RCVD_TGST 1.000 1.000 1.000 1.000 |
377 | score TARINGANET_IMG_NOT_RCVD_TN 1.000 1.000 1.000 1.000 | |
151f49fd SI |
378 | score THIS_AD 2.299 2.155 2.299 2.155 |
379 | score THIS_IS_ADV_SUSP_NTLD 1.226 1.499 1.226 1.499 | |
b780ea8d | 380 | score TONLINE_FAKE_DKIM 1.000 1.000 1.000 1.000 |
151f49fd SI |
381 | score TO_EQ_FM_DIRECT_MX 0.001 0.001 0.001 0.001 |
382 | score TO_EQ_FM_DOM_SPF_FAIL 0.001 0.690 0.001 0.690 | |
383 | score TO_EQ_FM_HTML_ONLY 0.001 0.001 0.001 0.001 | |
384 | score TO_EQ_FM_SPF_FAIL 0.001 0.213 0.001 0.213 | |
385 | score TO_IN_SUBJ 0.100 0.099 0.100 0.099 | |
386 | score TO_NAME_SUBJ_NO_RDNS 2.915 1.801 2.915 1.801 | |
387 | score TO_NO_BRKTS_FROM_MSSP 2.500 2.499 2.500 2.499 | |
388 | score TO_NO_BRKTS_HTML_IMG 1.902 1.799 1.902 1.799 | |
389 | score TO_NO_BRKTS_HTML_ONLY 1.999 1.999 1.999 1.999 | |
390 | score TO_NO_BRKTS_MSFT 1.006 2.129 1.006 2.129 | |
391 | score TO_NO_BRKTS_NORDNS_HTML 1.999 1.626 1.999 1.626 | |
392 | score TO_NO_BRKTS_PCNT 2.500 2.499 2.500 2.499 | |
393 | score TVD_SPACE_ENCODED 2.499 1.260 2.499 1.260 | |
394 | score TVD_SPACE_RATIO_MINFP 2.352 0.001 2.352 0.001 | |
b780ea8d SI |
395 | score TW_GIBBERISH_MANY 1.000 1.000 1.000 1.000 |
396 | score UC_GIBBERISH_OBFU 1.000 1.000 1.000 1.000 | |
151f49fd SI |
397 | score UNDISC_FREEM 2.699 2.599 2.699 2.599 |
398 | score UNDISC_MONEY 2.999 2.900 2.999 2.900 | |
399 | score UNICODE_OBFU_ASC 2.499 2.499 2.499 2.499 | |
b780ea8d | 400 | score UNICODE_OBFU_ZW 1.000 1.000 1.000 1.000 |
151f49fd | 401 | score UNICODE_OBFU_ZW_MANY 0.001 0.001 0.001 0.001 |
dfdd1e08 | 402 | score UNSUB_GOOG_FORM 1.000 1.000 1.000 1.000 |
b780ea8d | 403 | score URI_ADOBESPARK 1.000 1.000 1.000 1.000 |
151f49fd | 404 | score URI_AZURE_CLOUDAPP 2.999 2.999 2.999 2.999 |
b780ea8d SI |
405 | score URI_DASHGOVEDU 1.000 1.000 1.000 1.000 |
406 | score URI_DATA 1.000 1.000 1.000 1.000 | |
151f49fd | 407 | score URI_DOTEDU 1.999 1.999 1.999 1.999 |
b780ea8d | 408 | score URI_DOTEDU_ENTITY 1.000 1.000 1.000 1.000 |
151f49fd SI |
409 | score URI_DQ_UNSUB 2.399 2.240 2.399 2.240 |
410 | score URI_FIREBASEAPP 1.000 1.000 1.000 1.000 | |
411 | score URI_GOOGLE_PROXY 2.199 2.199 2.199 2.199 | |
412 | score URI_GOOG_STO_SPAMMY 3.000 2.999 3.000 2.999 | |
413 | score URI_HEX_IP 1.000 1.000 1.000 1.000 | |
414 | score URI_IMG_CWINDOWSNET 3.129 1.911 3.129 1.911 | |
b780ea8d | 415 | score URI_IMG_WP_REDIR 1.000 1.000 1.000 1.000 |
31955ede | 416 | score URI_LONG_REPEAT 1.000 1.000 1.000 1.000 |
151f49fd | 417 | score URI_ONLY_MSGID_MALF 0.528 1.999 0.528 1.999 |
fc5290a3 | 418 | score URI_OPTOUT_3LD 1.000 1.000 1.000 1.000 |
151f49fd SI |
419 | score URI_PHISH 3.999 3.999 3.999 3.999 |
420 | score URI_PHP_REDIR 1.000 1.000 1.000 1.000 | |
421 | score URI_TRY_3LD 1.999 1.999 1.999 1.999 | |
cabe596e | 422 | score URI_TRY_USME 1.000 1.000 1.000 1.000 |
151f49fd SI |
423 | score URI_WPADMIN 2.399 2.399 2.399 2.399 |
424 | score URI_WP_DIRINDEX 1.000 1.000 1.000 1.000 | |
425 | score URI_WP_HACKED 3.499 3.499 3.499 3.499 | |
426 | score URI_WP_HACKED_2 2.499 2.499 2.499 2.499 | |
427 | score USB_DRIVES 1.000 1.000 1.000 1.000 | |
428 | score VFY_ACCT_NORDNS 2.881 2.999 2.881 2.999 | |
429 | score VISTA_COST 1.000 1.000 1.000 1.000 | |
430 | score VISTA_TONOM_EQ_TOLOC 2.499 0.860 2.499 0.860 | |
b780ea8d | 431 | score VPS_NO_NTLD 1.000 1.000 1.000 1.000 |
31955ede | 432 | score WALMART_IMG_NOT_RCVD_WAL 1.000 1.000 1.000 1.000 |
151f49fd SI |
433 | score WIKI_IMG 3.199 3.099 3.199 3.099 |
434 | score WORD_INVIS 1.572 1.898 1.572 1.898 | |
435 | score WORD_INVIS_MANY 2.999 2.999 2.999 2.999 | |
436 | score XFER_LOTSA_MONEY 0.001 0.001 0.001 0.001 | |
437 | score XM_DIGITS_ONLY 1.000 1.000 1.000 1.000 | |
438 | score XM_RANDOM 2.499 2.499 2.499 2.499 | |
439 | score XM_RECPTID 3.000 2.999 3.000 2.999 | |
440 | score XPRIO 0.700 2.249 0.700 2.249 | |
21dcadbf | 441 | score XPRIO_SHORT_SUBJ 1.000 1.000 1.000 1.000 |
151f49fd SI |
442 | score XPRIO_VISTA 1.000 1.000 1.000 1.000 |
443 | score YOU_INHERIT 2.266 1.682 2.266 1.682 |