]>
Commit | Line | Data |
---|---|---|
fc5290a3 | 1 | score ACCT_PHISHING_MANY 2.803 2.999 2.803 2.999 |
b780ea8d SI |
2 | score AC_BR_BONANZA 0.001 0.001 0.001 0.001 |
3 | score AC_DIV_BONANZA 0.001 0.001 0.001 0.001 | |
fc5290a3 SI |
4 | score AC_FROM_MANY_DOTS 2.996 2.644 2.996 2.644 |
5 | score AC_HTML_NONSENSE_TAGS 1.997 1.999 1.997 1.999 | |
b780ea8d SI |
6 | score AC_POST_EXTRAS 1.000 1.000 1.000 1.000 |
7 | score AC_SPAMMY_URI_PATTERNS1 1.000 1.000 1.000 1.000 | |
8 | score AC_SPAMMY_URI_PATTERNS10 1.000 1.000 1.000 1.000 | |
9 | score AC_SPAMMY_URI_PATTERNS11 1.000 1.000 1.000 1.000 | |
10 | score AC_SPAMMY_URI_PATTERNS12 1.000 1.000 1.000 1.000 | |
11 | score AC_SPAMMY_URI_PATTERNS2 1.000 1.000 1.000 1.000 | |
12 | score AC_SPAMMY_URI_PATTERNS3 1.000 1.000 1.000 1.000 | |
13 | score AC_SPAMMY_URI_PATTERNS4 1.000 1.000 1.000 1.000 | |
14 | score AC_SPAMMY_URI_PATTERNS8 1.000 1.000 1.000 1.000 | |
15 | score AC_SPAMMY_URI_PATTERNS9 1.000 1.000 1.000 1.000 | |
fc5290a3 | 16 | score ADMITS_SPAM 3.096 0.001 3.096 0.001 |
dfdd1e08 | 17 | score ADULT_DATING_COMPANY 10.000 10.000 10.000 10.000 |
31955ede | 18 | score ADVANCE_FEE_2_NEW_FORM 1.000 1.000 1.000 1.000 |
dfdd1e08 | 19 | score ADVANCE_FEE_2_NEW_FRM_MNY 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
20 | score ADVANCE_FEE_2_NEW_MONEY 1.997 1.999 1.997 1.999 |
21 | score ADVANCE_FEE_3_NEW 2.994 3.268 2.994 3.268 | |
22 | score ADVANCE_FEE_3_NEW_FRM_MNY 0.001 0.001 0.001 0.001 | |
23 | score ADVANCE_FEE_3_NEW_MONEY 0.140 2.499 0.140 2.499 | |
24 | score ADVANCE_FEE_4_NEW 2.297 0.001 2.297 0.001 | |
25 | score ADVANCE_FEE_4_NEW_FRM_MNY 0.001 0.834 0.001 0.834 | |
26 | score ADVANCE_FEE_4_NEW_MONEY 2.596 2.230 2.596 2.230 | |
27 | score ADVANCE_FEE_5_NEW_FRM_MNY 1.084 2.168 1.084 2.168 | |
28 | score ADVANCE_FEE_5_NEW_MONEY 0.001 0.001 0.001 0.001 | |
29 | score AD_PREFS 0.363 0.001 0.363 0.001 | |
30 | score ALIBABA_IMG_NOT_RCVD_ALI 0.001 0.001 0.001 0.001 | |
31 | score AMAZON_IMG_NOT_RCVD_AMZN 0.001 0.001 0.001 0.001 | |
b780ea8d | 32 | score APP_DEVELOPMENT_FREEM 1.000 1.000 1.000 1.000 |
dfdd1e08 | 33 | score APP_DEVELOPMENT_NORDNS 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
34 | score ARC_SIGNED 0.001 0.001 0.001 0.001 |
35 | score ARC_VALID 0.001 0.001 0.001 0.001 | |
dfdd1e08 | 36 | score AXB_XMAILER_MIMEOLE_OL_024C2 0.001 0.001 0.001 0.001 |
31955ede | 37 | score BEBEE_IMG_NOT_RCVD_BB 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
38 | score BIGNUM_EMAILS_FREEM 0.001 0.396 0.001 0.396 |
39 | score BIGNUM_EMAILS_MANY 2.996 2.999 2.996 2.999 | |
b780ea8d | 40 | score BITCOIN_BOMB 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
41 | score BITCOIN_DEADLINE 2.997 2.788 2.997 2.788 |
42 | score BITCOIN_EXTORT_01 3.845 1.739 3.845 1.739 | |
b780ea8d | 43 | score BITCOIN_EXTORT_02 1.000 1.000 1.000 1.000 |
dfdd1e08 | 44 | score BITCOIN_IMGUR 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
45 | score BITCOIN_MALF_HTML 3.497 3.500 3.497 3.500 |
46 | score BITCOIN_MALWARE 1.842 1.000 1.842 1.000 | |
47 | score BITCOIN_OBFU_SUBJ 1.661 0.116 1.661 0.116 | |
48 | score BITCOIN_ONAN 2.658 1.000 2.658 1.000 | |
b780ea8d | 49 | score BITCOIN_PAY_ME 1.000 1.000 1.000 1.000 |
fc5290a3 | 50 | score BITCOIN_PDF 2.497 2.499 2.497 2.499 |
b780ea8d | 51 | score BITCOIN_SPAM_01 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
52 | score BITCOIN_SPAM_02 2.155 2.499 2.155 2.499 |
53 | score BITCOIN_SPAM_03 2.498 1.000 2.498 1.000 | |
54 | score BITCOIN_SPAM_04 1.000 1.000 1.000 1.000 | |
55 | score BITCOIN_SPAM_05 0.001 1.940 0.001 1.940 | |
b780ea8d | 56 | score BITCOIN_SPAM_06 1.000 1.000 1.000 1.000 |
fc5290a3 | 57 | score BITCOIN_SPAM_07 2.140 3.010 2.140 3.010 |
b780ea8d | 58 | score BITCOIN_SPAM_08 1.000 1.000 1.000 1.000 |
fc5290a3 | 59 | score BITCOIN_SPAM_09 1.498 1.000 1.498 1.000 |
b780ea8d SI |
60 | score BITCOIN_SPAM_10 1.000 1.000 1.000 1.000 |
61 | score BITCOIN_SPAM_11 1.000 1.000 1.000 1.000 | |
62 | score BITCOIN_SPAM_12 1.000 1.000 1.000 1.000 | |
63 | score BITCOIN_SPF_ONLYALL 0.001 1.000 0.001 1.000 | |
fc5290a3 SI |
64 | score BITCOIN_XPRIO 0.001 0.001 0.001 0.001 |
65 | score BITCOIN_YOUR_INFO 2.996 2.999 2.996 2.999 | |
66 | score BODY_SINGLE_URI 2.497 2.499 2.497 2.499 | |
67 | score BODY_SINGLE_WORD 1.602 0.001 1.602 0.001 | |
68 | score BODY_URI_ONLY 2.996 2.999 2.996 2.999 | |
69 | score BOGUS_MIME_VERSION 3.496 2.248 3.496 2.248 | |
70 | score BOGUS_MSM_HDRS 1.000 0.753 1.000 0.753 | |
cabe596e SI |
71 | score BOMB_FREEM 1.000 1.000 1.000 1.000 |
72 | score BOMB_MONEY 1.000 1.000 1.000 1.000 | |
b780ea8d | 73 | score BTC_ORG 1.000 1.000 1.000 1.000 |
21dcadbf | 74 | score BULK_RE_SUSP_NTLD 1.000 1.000 1.000 1.000 |
b780ea8d | 75 | score CANT_SEE_AD 1.000 1.000 1.000 1.000 |
fc5290a3 | 76 | score CK_HELO_GENERIC 0.248 0.250 0.248 0.250 |
b780ea8d | 77 | score COMMENT_GIBBERISH 1.000 1.000 1.000 1.000 |
fc5290a3 | 78 | score COMPENSATION 1.498 1.000 1.498 1.000 |
dfdd1e08 SI |
79 | score CONTENT_AFTER_HTML 1.000 1.000 1.000 1.000 |
80 | score CONTENT_AFTER_HTML_WEAK 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
81 | score CTE_8BIT_MISMATCH 0.998 0.001 0.998 0.001 |
82 | score DATE_IN_FUTURE_Q_PLUS 3.595 2.499 3.595 2.499 | |
b780ea8d | 83 | score DAY_I_EARNED 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
84 | score DEAR_BENEFICIARY 0.001 0.001 0.001 0.001 |
85 | score DKIMWL_BL 0.001 1.000 0.001 1.000 | |
b780ea8d | 86 | score DKIMWL_BLOCKED 0.001 0.001 0.001 0.001 |
dfdd1e08 | 87 | score DKIMWL_WL_HIGH 0.001 -0.001 0.001 -0.001 |
b780ea8d | 88 | score DKIMWL_WL_MED 0.001 -0.001 0.001 -0.001 |
fc5290a3 | 89 | score DKIMWL_WL_MEDHI 0.001 -0.001 0.001 -0.001 |
b780ea8d | 90 | score DOTGOV_IMAGE 1.000 1.000 1.000 1.000 |
fc5290a3 | 91 | score DX_TEXT_03 0.998 1.299 0.998 1.299 |
31955ede SI |
92 | score DYNAMIC_IMGUR 1.000 1.000 1.000 1.000 |
93 | score EBAY_IMG_NOT_RCVD_EBAY 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
94 | score ENCRYPTED_MESSAGE -0.998 -1.000 -0.998 -1.000 |
95 | score END_FUTURE_EMAILS 2.497 2.499 2.497 2.499 | |
b780ea8d | 96 | score ENVFROM_GOOG_TRIX 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
97 | score FACEBOOK_IMG_NOT_RCVD_FB 1.000 1.000 1.000 1.000 |
98 | score FAKE_REPLY_A1 2.197 2.599 2.197 2.599 | |
21dcadbf SI |
99 | score FBI_MONEY 1.000 1.000 1.000 1.000 |
100 | score FBI_SPOOF 1.000 1.000 1.000 1.000 | |
fc5290a3 | 101 | score FILL_THIS_FORM 0.898 0.001 0.898 0.001 |
31955ede SI |
102 | score FONT_INVIS_DIRECT 0.001 0.001 0.001 0.001 |
103 | score FONT_INVIS_DOTGOV 1.000 1.000 1.000 1.000 | |
dfdd1e08 | 104 | score FONT_INVIS_HTML_NOHTML 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
105 | score FONT_INVIS_LONG_LINE 2.996 2.999 2.996 2.999 |
106 | score FONT_INVIS_MSGID 0.947 0.001 0.947 0.001 | |
21dcadbf | 107 | score FONT_INVIS_NORDNS 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
108 | score FONT_INVIS_POSTEXTRAS 1.645 2.814 1.645 2.814 |
109 | score FORM_FRAUD 0.546 0.001 0.546 0.001 | |
110 | score FORM_FRAUD_3 0.001 0.001 0.001 0.001 | |
21dcadbf | 111 | score FORM_FRAUD_5 0.001 0.001 0.001 0.001 |
dfdd1e08 | 112 | score FOUND_YOU 1.000 1.000 1.000 1.000 |
fc5290a3 | 113 | score FREEMAIL_FORGED_FROMDOMAIN 0.249 0.250 0.249 0.250 |
b780ea8d SI |
114 | score FREEM_FRNUM_UNICD_EMPTY 1.000 1.000 1.000 1.000 |
115 | score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
116 | score FROMSPACE 3.196 2.499 3.196 2.499 |
117 | score FROM_2_EMAILS_SHORT 1.060 1.884 1.060 1.884 | |
118 | score FROM_ADDR_WS 2.996 2.999 2.996 2.999 | |
dfdd1e08 | 119 | score FROM_BANK_NOAUTH 0.001 1.000 0.001 1.000 |
b780ea8d | 120 | score FROM_FMBLA_NDBLOCKED 0.001 0.001 0.001 0.001 |
fc5290a3 | 121 | score FROM_FMBLA_NEWDOM 0.001 0.001 0.001 0.001 |
21dcadbf SI |
122 | score FROM_FMBLA_NEWDOM14 0.001 1.000 0.001 1.000 |
123 | score FROM_FMBLA_NEWDOM28 0.001 0.799 0.001 0.799 | |
fc5290a3 | 124 | score FROM_GOV_DKIM_AU 0.001 -0.001 0.001 -0.001 |
b780ea8d | 125 | score FROM_GOV_REPLYTO_FREEMAIL 0.001 1.000 0.001 1.000 |
31955ede | 126 | score FROM_GOV_SPOOF 0.001 1.000 0.001 1.000 |
fc5290a3 SI |
127 | score FROM_IN_TO_AND_SUBJ 1.601 1.899 1.601 1.899 |
128 | score FROM_MISSPACED 1.998 0.001 1.998 0.001 | |
129 | score FROM_MISSP_DYNIP 0.945 2.299 0.945 2.299 | |
130 | score FROM_MISSP_EH_MATCH 0.001 0.200 0.001 0.200 | |
131 | score FROM_MISSP_FREEMAIL 1.649 0.199 1.649 0.199 | |
132 | score FROM_MISSP_MSFT 0.001 0.001 0.001 0.001 | |
133 | score FROM_MISSP_REPLYTO 2.150 1.743 2.150 1.743 | |
46cfc9e2 | 134 | score FROM_MISSP_SPF_FAIL 0.001 0.001 0.001 0.001 |
b780ea8d | 135 | score FROM_MISSP_USER 0.001 0.001 0.001 0.001 |
fc5290a3 | 136 | score FROM_MULTI_NORDNS 2.297 1.002 2.297 1.002 |
dfdd1e08 | 137 | score FROM_NEWDOM_BTC 0.001 1.000 0.001 1.000 |
fc5290a3 SI |
138 | score FROM_NTLD_LINKBAIT 1.911 1.000 1.911 1.000 |
139 | score FROM_NTLD_REPLY_FREEMAIL 0.278 1.000 0.278 1.000 | |
b780ea8d | 140 | score FROM_NUMBERO_NEWDOMAIN 0.001 1.000 0.001 1.000 |
fc5290a3 SI |
141 | score FROM_PAYPAL_SPOOF 0.001 1.243 0.001 1.243 |
142 | score FROM_SUSPICIOUS_NTLD 0.499 0.238 0.499 0.238 | |
143 | score FROM_SUSPICIOUS_NTLD_FP 1.997 1.073 1.997 1.073 | |
144 | score FROM_UNBAL1 2.220 1.693 2.220 1.693 | |
145 | score FROM_UNBAL2 2.696 3.299 2.696 3.299 | |
146 | score FROM_WSP_TRAIL 3.396 3.199 3.396 3.199 | |
147 | score FSL_BULK_SIG 0.001 0.001 0.001 0.001 | |
b780ea8d SI |
148 | score FSL_CTYPE_WIN1251 0.001 0.001 0.001 0.001 |
149 | score FSL_NEW_HELO_USER 0.001 0.001 0.001 0.001 | |
fc5290a3 SI |
150 | score FUZZY_AMAZON 0.001 0.001 0.001 0.001 |
151 | score FUZZY_WALLET 1.797 0.001 1.797 0.001 | |
b780ea8d | 152 | score GAPPY_SALES_LEADS_FREEM 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
153 | score GB_BITCOIN_NH 1.000 1.000 1.000 1.000 |
154 | score GB_CUSTOM_HTM_URI 1.498 0.001 1.498 0.001 | |
155 | score GB_FAKE_RF_SHORT 1.941 1.295 1.941 1.295 | |
b780ea8d | 156 | score GB_FORGED_MUA_POSTFIX 1.000 1.000 1.000 1.000 |
21dcadbf | 157 | score GB_FREEMAIL_DISPTO 0.001 0.001 0.001 0.001 |
31955ede | 158 | score GB_FREEMAIL_DISPTO_NOTFREEM 0.500 0.500 0.500 0.500 |
b780ea8d | 159 | score GB_GOOGLE_OBFUR 0.750 0.750 0.750 0.750 |
fc5290a3 SI |
160 | score GB_GOOGLE_TRANSL 0.750 0.750 0.750 0.750 |
161 | score GB_HASHBL_BTC 0.001 0.001 0.001 0.001 | |
b780ea8d SI |
162 | score GOOGLE_DOCS_PHISH 1.000 1.000 1.000 1.000 |
163 | score GOOGLE_DOCS_PHISH_MANY 1.000 1.000 1.000 1.000 | |
31955ede | 164 | score GOOGLE_DOC_SUSP 1.000 1.000 1.000 1.000 |
b780ea8d SI |
165 | score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000 1.000 1.000 1.000 |
166 | score GOOG_MALWARE_DNLD 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
167 | score GOOG_REDIR_HTML_ONLY 1.997 1.999 1.997 1.999 |
168 | score GOOG_REDIR_NORDNS 2.497 3.399 2.497 3.399 | |
dfdd1e08 | 169 | score GOOG_STO_EMAIL_PHISH 1.000 1.000 1.000 1.000 |
31955ede SI |
170 | score GOOG_STO_HTML_PHISH 1.000 1.000 1.000 1.000 |
171 | score GOOG_STO_HTML_PHISH_MANY 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
172 | score GOOG_STO_IMG_HTML 2.466 2.999 2.466 2.999 |
173 | score GOOG_STO_IMG_NOHTML 1.000 1.000 1.000 1.000 | |
174 | score GOOG_STO_NOIMG_HTML 2.996 2.999 2.996 2.999 | |
b780ea8d | 175 | score HAS_X_NO_RELAY 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
176 | score HAS_X_OUTGOING_SPAM_STAT 0.805 0.803 0.805 0.803 |
177 | score HDRS_MISSP 2.497 0.001 2.497 0.001 | |
178 | score HDR_ORDER_FTSDMCXX_DIRECT 0.001 0.001 0.001 0.001 | |
21dcadbf | 179 | score HDR_ORDER_FTSDMCXX_NORDNS 0.001 0.001 0.001 0.001 |
fc5290a3 | 180 | score HEADER_FROM_DIFFERENT_DOMAINS 0.249 0.250 0.249 0.250 |
46cfc9e2 | 181 | score HELO_NO_DOMAIN 0.001 0.001 0.001 0.001 |
fc5290a3 | 182 | score HEXHASH_WORD 1.000 1.000 1.000 1.000 |
b780ea8d | 183 | score HK_CTE_RAW 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
184 | score HK_LOTTO 0.998 1.000 0.998 1.000 |
185 | score HK_NAME_MR_MRS 0.998 1.000 0.998 1.000 | |
186 | score HK_RANDOM_ENVFROM 0.001 0.001 0.001 0.001 | |
187 | score HK_RANDOM_FROM 0.998 0.001 0.998 0.001 | |
188 | score HK_RANDOM_REPLYTO 0.999 0.999 0.999 0.999 | |
b780ea8d | 189 | score HK_RCVD_IP_MULTICAST 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
190 | score HK_SCAM 1.997 1.999 1.997 1.999 |
191 | score HK_WIN 0.998 1.000 0.998 1.000 | |
192 | score HOSTED_IMG_DIRECT_MX 0.105 0.001 0.105 0.001 | |
b780ea8d | 193 | score HOSTED_IMG_DQ_UNSUB 1.000 1.000 1.000 1.000 |
fc5290a3 | 194 | score HOSTED_IMG_FREEM 2.496 3.215 2.496 3.215 |
46cfc9e2 | 195 | score HOSTED_IMG_MULTI 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
196 | score HOSTED_IMG_MULTI_PUB_01 2.996 3.000 2.996 3.000 |
197 | score HTML_ENTITY_ASCII 1.000 1.000 1.000 1.000 | |
198 | score HTML_ENTITY_ASCII_TINY 2.996 2.999 2.996 2.999 | |
199 | score HTML_FONT_TINY_NORDNS 1.997 0.873 1.997 0.873 | |
200 | score HTML_OFF_PAGE 0.958 0.001 0.958 0.001 | |
46cfc9e2 | 201 | score HTML_SHRT_CMNT_OBFU_MANY 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
202 | score HTML_SINGLET_MANY 2.498 2.499 2.498 2.499 |
203 | score HTML_TEXT_INVISIBLE_FONT 1.348 1.945 1.348 1.945 | |
204 | score HTML_TEXT_INVISIBLE_STYLE 1.828 0.891 1.828 0.891 | |
205 | score IMG_ONLY_FM_DOM_INFO 1.705 1.000 1.705 1.000 | |
206 | score JH_SPAMMY_HEADERS 3.496 3.499 3.496 3.499 | |
dfdd1e08 | 207 | score JH_SPAMMY_PATTERN01 1.000 1.000 1.000 1.000 |
b780ea8d | 208 | score JH_SPAMMY_PATTERN02 1.000 1.000 1.000 1.000 |
fc5290a3 | 209 | score KHOP_HELO_FCRDNS 0.399 0.001 0.399 0.001 |
31955ede | 210 | score LINKEDIN_IMG_NOT_RCVD_LNKN 1.000 1.000 1.000 1.000 |
b780ea8d | 211 | score LIST_PRTL_PUMPDUMP 1.000 1.000 1.000 1.000 |
46cfc9e2 | 212 | score LIST_PRTL_SAME_USER 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
213 | score LONG_HEX_URI 2.996 2.888 2.996 2.888 |
214 | score LONG_IMG_URI 0.001 0.001 0.001 0.001 | |
215 | score LONG_INVISIBLE_TEXT 2.996 2.530 2.996 2.530 | |
b780ea8d | 216 | score LOTS_OF_MONEY 0.010 0.010 0.010 0.010 |
b780ea8d | 217 | score LUCRATIVE 1.000 1.000 1.000 1.000 |
b780ea8d | 218 | score MALF_HTML_B64 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
219 | score MALWARE_NORDNS 1.538 3.210 1.538 3.210 |
220 | score MALWARE_PASSWORD 1.000 1.000 1.000 1.000 | |
221 | score MALW_ATTACH 2.197 0.001 2.197 0.001 | |
222 | score MILLION_HUNDRED 0.112 0.831 0.112 0.831 | |
223 | score MILLION_USD 0.286 0.001 0.286 0.001 | |
dfdd1e08 | 224 | score MIMEOLE_DIRECT_TO_MX 0.001 0.001 0.001 0.001 |
46cfc9e2 | 225 | score MIME_NO_TEXT 1.000 1.000 1.000 1.000 |
dfdd1e08 | 226 | score MIXED_AREA_CASE 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
227 | score MIXED_CENTER_CASE 1.000 1.000 1.000 1.000 |
228 | score MIXED_ES 1.997 1.467 1.997 1.467 | |
dfdd1e08 | 229 | score MIXED_FONT_CASE 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
230 | score MIXED_HREF_CASE 1.000 1.999 1.000 1.999 |
231 | score MIXED_IMG_CASE 1.000 1.000 1.000 1.000 | |
b780ea8d SI |
232 | score MONERO_DEADLINE 1.000 1.000 1.000 1.000 |
233 | score MONERO_EXTORT_01 1.000 1.000 1.000 1.000 | |
234 | score MONERO_MALWARE 1.000 1.000 1.000 1.000 | |
235 | score MONERO_PAY_ME 1.000 1.000 1.000 1.000 | |
21dcadbf | 236 | score MONEY_ATM_CARD 0.001 0.001 0.001 0.001 |
b780ea8d | 237 | score MONEY_FORM 0.001 0.001 0.001 0.001 |
fc5290a3 SI |
238 | score MONEY_FORM_SHORT 0.001 0.001 0.001 0.001 |
239 | score MONEY_FRAUD_3 0.001 0.001 0.001 0.001 | |
240 | score MONEY_FRAUD_5 2.896 0.001 2.896 0.001 | |
241 | score MONEY_FRAUD_8 0.886 0.695 0.886 0.695 | |
242 | score MONEY_FREEMAIL_REPTO 2.996 0.705 2.996 0.705 | |
243 | score MONEY_FROM_41 0.544 1.000 0.544 1.000 | |
244 | score MONEY_FROM_MISSP 0.001 0.001 0.001 0.001 | |
b780ea8d | 245 | score MSGID_DOLLARS_URI_IMG 1.000 1.000 1.000 1.000 |
46cfc9e2 | 246 | score MSGID_HDR_MALF 1.000 1.000 1.000 1.000 |
fc5290a3 | 247 | score MSMAIL_PRI_ABNORMAL 0.470 0.586 0.470 0.586 |
b780ea8d | 248 | score MSM_PRIO_REPTO 1.000 1.000 1.000 1.000 |
fc5290a3 | 249 | score NAME_EMAIL_DIFF 1.729 0.001 1.729 0.001 |
21dcadbf | 250 | score NA_DOLLARS 1.499 1.499 1.499 1.499 |
b780ea8d | 251 | score NEWEGG_IMG_NOT_RCVD_NEGG 1.000 1.000 1.000 1.000 |
31955ede | 252 | score NEW_PRODUCTS 1.000 1.000 1.000 1.000 |
fc5290a3 | 253 | score NICE_REPLY_A -0.001 -0.103 -0.001 -0.103 |
31955ede | 254 | score NO_FM_NAME_IP_HOSTN 0.001 0.001 0.001 0.001 |
b780ea8d | 255 | score NSL_RCVD_FROM_USER 0.001 0.001 0.001 0.001 |
fc5290a3 | 256 | score NSL_RCVD_HELO_USER 0.001 0.001 0.001 0.001 |
21dcadbf | 257 | score OBFU_BITCOIN 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
258 | score OBFU_UNSUB_UL 2.297 2.200 2.297 2.200 |
259 | score ODD_FREEM_REPTO 2.996 2.799 2.996 2.799 | |
260 | score PDS_BRAND_SUBJ_NAKED_TO 0.998 0.999 0.998 0.999 | |
261 | score PDS_BTC_ID 0.498 0.001 0.498 0.001 | |
262 | score PDS_BTC_MSGID 0.046 0.001 0.046 0.001 | |
263 | score PDS_DBL_URL_TNB_RUNON 1.997 1.000 1.997 1.000 | |
264 | score PDS_FRNOM_TODOM_DBL_URL 1.499 1.499 1.499 1.499 | |
265 | score PDS_FRNOM_TODOM_NAKED_TO 1.498 1.499 1.498 1.499 | |
266 | score PDS_FROM_NAME_TO_DOMAIN 1.997 1.999 1.997 1.999 | |
267 | score PDS_HELO_SPF_FAIL 0.001 1.000 0.001 1.000 | |
268 | score PDS_RDNS_DYNAMIC_FP 0.010 0.001 0.010 0.001 | |
dfdd1e08 | 269 | score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
270 | score PDS_TO_EQ_FROM_NAME 1.748 0.001 1.748 0.001 |
271 | score PHISH_ATTACH 2.297 0.001 2.297 0.001 | |
b780ea8d | 272 | score PHISH_AZURE_CLOUDAPP 3.500 3.500 3.500 3.500 |
cabe596e | 273 | score PHISH_FBASEAPP 1.000 1.000 1.000 1.000 |
b780ea8d | 274 | score PHP_NOVER_MUA 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
275 | score PHP_ORIG_SCRIPT 2.497 0.001 2.497 0.001 |
276 | score PHP_SCRIPT 2.497 2.499 2.497 2.499 | |
b780ea8d | 277 | score PHP_SCRIPT_MUA 1.000 1.000 1.000 1.000 |
dfdd1e08 | 278 | score PP_MIME_FAKE_ASCII_TEXT 0.999 0.001 0.999 0.001 |
b780ea8d SI |
279 | score PP_TOO_MUCH_UNICODE02 0.500 0.500 0.500 0.500 |
280 | score PP_TOO_MUCH_UNICODE05 1.000 1.000 1.000 1.000 | |
281 | score PUMPDUMP 1.000 1.000 1.000 1.000 | |
282 | score PUMPDUMP_MULTI 1.000 1.000 1.000 1.000 | |
31955ede | 283 | score RAND_HEADER_LIST_SPOOF 1.000 1.000 1.000 1.000 |
b780ea8d | 284 | score RAND_HEADER_MANY 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
285 | score RAND_MKTG_HEADER 1.997 1.324 1.997 1.324 |
286 | score RATWARE_NO_RDNS 0.001 0.001 0.001 0.001 | |
b780ea8d | 287 | score RCVD_DOTEDU_SHORT 1.000 1.000 1.000 1.000 |
46cfc9e2 | 288 | score RCVD_DOTEDU_SUSP_URI 1.000 1.000 1.000 1.000 |
fc5290a3 | 289 | score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001 |
b780ea8d | 290 | score RCVD_IN_MSPIKE_H2 0.001 -0.001 0.001 -0.001 |
fc5290a3 SI |
291 | score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001 |
292 | score RCVD_IN_MSPIKE_H4 0.001 0.001 0.001 0.001 | |
293 | score RCVD_IN_MSPIKE_H5 0.001 0.001 0.001 0.001 | |
294 | score RCVD_IN_MSPIKE_L2 0.001 0.001 0.001 0.001 | |
295 | score RCVD_IN_MSPIKE_L3 0.001 0.001 0.001 0.001 | |
296 | score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001 | |
297 | score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001 | |
298 | score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001 | |
299 | score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001 | |
b780ea8d | 300 | score RDNS_NUM_TLD_ATCHNX 1.000 1.000 1.000 1.000 |
dfdd1e08 | 301 | score RDNS_NUM_TLD_XM 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
302 | score READY_TO_SHIP 1.000 0.001 1.000 0.001 |
303 | score REPTO_419_FRAUD 0.853 1.353 0.853 1.353 | |
b780ea8d SI |
304 | score REPTO_419_FRAUD_AOL 1.000 1.000 1.000 1.000 |
305 | score REPTO_419_FRAUD_AOL_LOOSE 1.000 1.000 1.000 1.000 | |
306 | score REPTO_419_FRAUD_CNS 1.000 1.000 1.000 1.000 | |
fc5290a3 | 307 | score REPTO_419_FRAUD_GM 2.996 1.000 2.996 1.000 |
31955ede | 308 | score REPTO_419_FRAUD_GM_LOOSE 1.000 1.000 1.000 1.000 |
b780ea8d SI |
309 | score REPTO_419_FRAUD_HM 1.000 1.000 1.000 1.000 |
310 | score REPTO_419_FRAUD_OL 1.000 1.000 1.000 1.000 | |
311 | score REPTO_419_FRAUD_PM 1.000 1.000 1.000 1.000 | |
46cfc9e2 | 312 | score REPTO_419_FRAUD_QQ 1.000 1.000 1.000 1.000 |
b780ea8d SI |
313 | score REPTO_419_FRAUD_YH 1.000 1.000 1.000 1.000 |
314 | score REPTO_419_FRAUD_YH_LOOSE 1.000 1.000 1.000 1.000 | |
cabe596e | 315 | score REPTO_419_FRAUD_YJ 1.000 1.000 1.000 1.000 |
b780ea8d | 316 | score REPTO_419_FRAUD_YN 1.000 1.000 1.000 1.000 |
dfdd1e08 | 317 | score REPTO_INFONUMSCOM 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
318 | score SCC_BODY_SINGLE_WORD 0.001 0.001 0.001 0.001 |
319 | score SCC_CANSPAM_2 3.695 3.299 3.695 3.299 | |
dfdd1e08 | 320 | score SCC_ISEMM_LID_1 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
321 | score SCC_ISEMM_LID_1A 1.000 0.001 1.000 0.001 |
322 | score SCC_ISEMM_LID_1B 1.498 1.499 1.498 1.499 | |
323 | score SCC_SPAMMER_ADDR_2 2.675 2.799 2.675 2.799 | |
324 | score SCC_SPECIAL_GUID 0.923 0.947 0.923 0.947 | |
325 | score SENDGRID_REDIR 1.498 0.409 1.498 0.409 | |
b780ea8d | 326 | score SENDGRID_REDIR_PHISH 1.000 1.000 1.000 1.000 |
dfdd1e08 | 327 | score SEO_SUSP_NTLD 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
328 | score SERGIO_SUBJECT_VIAGRA01 2.195 2.814 2.195 2.814 |
329 | score SHOPIFY_IMG_NOT_RCVD_SFY 2.497 2.499 2.497 2.499 | |
330 | score SHORTENER_SHORT_IMG 0.196 2.499 0.196 2.499 | |
46cfc9e2 | 331 | score SHORT_IMG_SUSP_NTLD 1.000 1.000 1.000 1.000 |
dfdd1e08 | 332 | score SPOOFED_FREEMAIL 0.001 0.001 0.001 0.001 |
fc5290a3 SI |
333 | score SPOOFED_FREEMAIL_NO_RDNS 1.099 0.001 1.099 0.001 |
334 | score SPOOFED_FREEM_REPTO 0.001 0.001 0.001 0.001 | |
335 | score SPOOFED_FREEM_REPTO_CHN 0.001 1.000 0.001 1.000 | |
b780ea8d | 336 | score SPOOFED_FREEM_REPTO_RUS 0.001 1.000 0.001 1.000 |
dfdd1e08 | 337 | score SPOOF_GMAIL_MID 1.499 0.001 1.499 0.001 |
fc5290a3 | 338 | score STATIC_XPRIO_OLE 0.001 0.001 0.001 0.001 |
b780ea8d | 339 | score STOCK_TIP 1.000 1.000 1.000 1.000 |
fc5290a3 | 340 | score STOX_BOUND_090909_B 0.995 1.428 0.995 1.428 |
31955ede | 341 | score SUBJ_BRKN_WORDNUMS 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
342 | score SURBL_BLOCKED 0.001 0.001 0.001 0.001 |
343 | score SUSP_UTF8_WORD_COMBO 0.446 1.668 0.446 1.668 | |
344 | score SUSP_UTF8_WORD_FROM 1.997 1.132 1.997 1.132 | |
345 | score SUSP_UTF8_WORD_MANY 2.333 0.263 2.333 0.263 | |
346 | score SUSP_UTF8_WORD_SUBJ 1.492 1.999 1.492 1.999 | |
b780ea8d | 347 | score SYSADMIN 1.000 1.000 1.000 1.000 |
31955ede SI |
348 | score TAGSTAT_IMG_NOT_RCVD_TGST 1.000 1.000 1.000 1.000 |
349 | score TARINGANET_IMG_NOT_RCVD_TN 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
350 | score THIS_AD 0.998 0.799 0.998 0.799 |
351 | score THIS_IS_ADV_SUSP_NTLD 0.001 1.000 0.001 1.000 | |
b780ea8d | 352 | score TONLINE_FAKE_DKIM 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
353 | score TO_EQ_FM_DIRECT_MX 0.001 0.718 0.001 0.718 |
354 | score TO_EQ_FM_DOM_HTML_IMG 3.197 0.001 3.197 0.001 | |
b780ea8d | 355 | score TO_EQ_FM_DOM_SPF_FAIL 0.001 0.001 0.001 0.001 |
b780ea8d | 356 | score TO_EQ_FM_SPF_FAIL 0.001 0.001 0.001 0.001 |
fc5290a3 SI |
357 | score TO_IN_SUBJ 0.098 0.099 0.098 0.099 |
358 | score TO_NAME_SUBJ_NO_RDNS 2.658 1.000 2.658 1.000 | |
359 | score TO_NO_BRKTS_FROM_MSSP 2.497 2.499 2.497 2.499 | |
360 | score TO_NO_BRKTS_HTML_IMG 1.997 2.000 1.997 2.000 | |
361 | score TO_NO_BRKTS_HTML_ONLY 1.997 1.999 1.997 1.999 | |
362 | score TO_NO_BRKTS_MSFT 1.746 1.397 1.746 1.397 | |
363 | score TO_NO_BRKTS_NORDNS_HTML 1.998 1.999 1.998 1.999 | |
364 | score TO_NO_BRKTS_PCNT 2.497 2.490 2.497 2.490 | |
365 | score TVD_SPACE_ENC_FM_MIME 1.336 0.001 1.336 0.001 | |
b780ea8d SI |
366 | score TW_GIBBERISH_MANY 1.000 1.000 1.000 1.000 |
367 | score UC_GIBBERISH_OBFU 1.000 1.000 1.000 1.000 | |
fc5290a3 SI |
368 | score UNDISC_FREEM 3.096 2.699 3.096 2.699 |
369 | score UNDISC_MONEY 3.196 3.100 3.196 3.100 | |
370 | score UNICODE_OBFU_ASC 2.497 2.499 2.497 2.499 | |
b780ea8d | 371 | score UNICODE_OBFU_ZW 1.000 1.000 1.000 1.000 |
dfdd1e08 | 372 | score UNSUB_GOOG_FORM 1.000 1.000 1.000 1.000 |
b780ea8d | 373 | score URI_ADOBESPARK 1.000 1.000 1.000 1.000 |
fc5290a3 | 374 | score URI_AZURE_CLOUDAPP 2.996 1.000 2.996 1.000 |
b780ea8d SI |
375 | score URI_DASHGOVEDU 1.000 1.000 1.000 1.000 |
376 | score URI_DATA 1.000 1.000 1.000 1.000 | |
fc5290a3 | 377 | score URI_DOTEDU 1.997 1.999 1.997 1.999 |
b780ea8d | 378 | score URI_DOTEDU_ENTITY 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
379 | score URI_FIREBASEAPP 2.996 1.000 2.996 1.000 |
380 | score URI_GOOGLE_PROXY 2.696 2.799 2.696 2.799 | |
dfdd1e08 | 381 | score URI_GOOG_STO_SPAMMY 3.000 3.000 3.000 3.000 |
fc5290a3 | 382 | score URI_HEX_IP 2.497 1.000 2.497 1.000 |
b780ea8d | 383 | score URI_IMG_WP_REDIR 1.000 1.000 1.000 1.000 |
31955ede | 384 | score URI_LONG_REPEAT 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
385 | score URI_ONLY_MSGID_MALF 1.974 1.325 1.974 1.325 |
386 | score URI_OPTOUT_3LD 1.000 1.000 1.000 1.000 | |
387 | score URI_PHISH 3.995 3.999 3.995 3.999 | |
388 | score URI_PHP_REDIR 3.496 1.000 3.496 1.000 | |
389 | score URI_TRY_3LD 1.997 2.000 1.997 2.000 | |
cabe596e | 390 | score URI_TRY_USME 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
391 | score URI_WPADMIN 2.397 2.299 2.397 2.299 |
392 | score URI_WP_DIRINDEX 3.496 1.000 3.496 1.000 | |
393 | score URI_WP_HACKED 2.131 1.627 2.131 1.627 | |
394 | score URI_WP_HACKED_2 2.497 2.499 2.497 2.499 | |
395 | score USB_DRIVES 1.997 1.000 1.997 1.000 | |
396 | score VFY_ACCT_NORDNS 0.001 0.001 0.001 0.001 | |
b780ea8d | 397 | score VPS_NO_NTLD 1.000 1.000 1.000 1.000 |
31955ede | 398 | score WALMART_IMG_NOT_RCVD_WAL 1.000 1.000 1.000 1.000 |
fc5290a3 SI |
399 | score WORD_INVIS 1.581 2.070 1.581 2.070 |
400 | score WORD_INVIS_MANY 2.996 2.999 2.996 2.999 | |
401 | score XM_DIGITS_ONLY 1.704 1.655 1.704 1.655 | |
402 | score XM_RANDOM 1.117 0.001 1.117 0.001 | |
403 | score XPRIO 1.551 0.001 1.551 0.001 | |
21dcadbf | 404 | score XPRIO_SHORT_SUBJ 1.000 1.000 1.000 1.000 |
fc5290a3 | 405 | score YOU_INHERIT 2.297 0.001 2.297 0.001 |