Modified: spamassassin/site/tests_3_0_x.html
URL: http://svn.apache.org/viewvc/spamassassin/site/tests_3_0_x.html?view=diff&rev=464539&r1=464538&r2=464539
==============================================================================
--- spamassassin/site/tests_3_0_x.html (original)
+++ spamassassin/site/tests_3_0_x.html Mon Oct 16 09:06:16 2006
@@ -5,7 +5,7 @@
SpamAssassin: Tests Performed: v3.0.x
</title>
<link rel="icon" href="images/favicon.png" type="image/png" />
- <meta name="generator" content="WebMake/2.4" />
+ <meta name="generator" content="WebMake/2.3" />
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<style type="text/css" media="all">
body {
@@ -58,10 +58,6 @@
}
</style>
<link rel="meta" title="DOAP" type="application/rdf+xml" href="doap.rdf" />
- <!--
- Link to WPoison to thwart spambots:
- <a href="http://SpamAssassin.taint.org/moreinfo.whtml">More Info</a>
- -->
</head>
<body>
@@ -181,8 +177,13809 @@
</th>
</tr>
</p>
-<!--etsafe-->
- <!--/etsafe-->
+ <br />
+ <!--etsafe-->
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Generic Test for Unsolicited Bulk Email
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ GTUBE
+ </font>
+ </td>
+ <td>
+ 1000.000
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>full</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Listed in Razor2 (http://razor.sf.net/)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RAZOR2_CHECK
+ </font>
+ </td>
+ <td>
+ 0 0.150 0 1.511
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Razor2 gives confidence level above 50%
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RAZOR2_CF_RANGE_51_100
+ </font>
+ </td>
+ <td>
+ 0 1.485 0 0.056
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>full</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DCC_CHECK
+ </font>
+ </td>
+ <td>
+ 0 1.373 0 2.169
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>full</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Listed in Pyzor (http://pyzor.sf.net/)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ PYZOR_CHECK
+ </font>
+ </td>
+ <td>
+ 0 2.041 0 3.451
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Incorporates a tracking ID number
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ TRACKER_ID
+ </font>
+ </td>
+ <td>
+ 1.825 1.064 1.818 0.555
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Weird repeated double-quotation marks
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ WEIRD_QUOTING
+ </font>
+ </td>
+ <td>
+ 1.353 1.966 1.774 2.000
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>rawbody</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Extra blank lines in base64 encoding
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_BASE64_BLANKS
+ </font>
+ </td>
+ <td>
+ 0.693 0.819 1.391 1.469
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>rawbody</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ base64 attachment does not have a file name
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_BASE64_NO_NAME
+ </font>
+ </td>
+ <td>
+ 0.022 0 0.017 0.000
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>rawbody</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message text disguised using base64 encoding
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_BASE64_TEXT
+ </font>
+ </td>
+ <td>
+ 1.780 0.110 1.403 0.298
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>rawbody</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME section missing boundary
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_MISSING_BOUNDARY
+ </font>
+ </td>
+ <td>
+ 0 0.247 0.224 0
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Multipart message mostly text/html MIME
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_HTML_MOSTLY
+ </font>
+ </td>
+ <td>
+ 1.540 0.285 0.713 1.023
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message only has text/html MIME parts
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_HTML_ONLY
+ </font>
+ </td>
+ <td>
+ 1.204 1.158 1.156 0.177
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>rawbody</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Quoted-printable line longer than 76 chars
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_QP_LONG_LINE
+ </font>
+ </td>
+ <td>
+ 0 0.000 0.105 0.039
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>rawbody</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME filename does not match content
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MIME_SUSPECT_NAME
+ </font>
+ </td>
+ <td>
+ 0.100
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HTML and text parts are different
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ MPART_ALT_DIFF
+ </font>
+ </td>
+ <td>
+ 1.837 1.505 1.823 0.066
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Character set indicates a foreign language
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ CHARSET_FARAWAY
+ </font>
+ </td>
+ <td>
+ 3.200
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message written in an undesired language
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ UNWANTED_LANGUAGE_BODY
+ </font>
+ </td>
+ <td>
+ 2.800
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Body includes 8 consecutive 8-bit characters
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ BODY_8BITS
+ </font>
+ </td>
+ <td>
+ 1.500
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Body contains a ROT13-encoded email address
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ EMAIL_ROT13
+ </font>
+ </td>
+ <td>
+ 2.720 1.474 2.934 3.105
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message body has 70-80% blank lines
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ BLANK_LINES_70_80
+ </font>
+ </td>
+ <td>
+ 1.668 1.127 0.745 1.515
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message body has 80-90% blank lines
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ BLANK_LINES_80_90
+ </font>
+ </td>
+ <td>
+ 0.046 0 0.216 0
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message body has 90-100% blank lines
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ BLANK_LINES_90_100
+ </font>
+ </td>
+ <td>
+ 1.490 1.750 1.877 1.996
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message body has many words used only once
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ UNIQUE_WORDS
+ </font>
+ </td>
+ <td>
+ 3.109 2.549 1.639 2.273
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Message body mentions many internet domains
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DOMAIN_RATIO
+ </font>
+ </td>
+ <td>
+ 2.552 1.360 2.534 3.176
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Did not pass through any untrusted hosts
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ ALL_TRUSTED
+ </font>
+ </td>
+ <td>
+ -2.400 -2.820 -2.867 -3.300
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NJABL: sender is confirmed open relay
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_NJABL_RELAY
+ </font>
+ </td>
+ <td>
+ 0 0.934 0 1.397
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NJABL: dialup sender did non-local SMTP
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_NJABL_DUL
+ </font>
+ </td>
+ <td>
+ 0 1.655 0 0.088
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NJABL: sender is confirmed spam source
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_NJABL_SPAM
+ </font>
+ </td>
+ <td>
+ 0 1.051 0 1.841
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NJABL: sent through multi-stage open relay
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_NJABL_MULTI
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NJABL: sender is an open formmail
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_NJABL_CGI
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NJABL: sender is an open proxy
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_NJABL_PROXY
+ </font>
+ </td>
+ <td>
+ 0 1.026 0 0.438
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender is open HTTP proxy server
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_HTTP
+ </font>
+ </td>
+ <td>
+ 0 0 0 0.043
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender is open proxy server
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_MISC
+ </font>
+ </td>
+ <td>
+ 0 0 0 0.338
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender is open SMTP relay
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_SMTP
+ </font>
+ </td>
+ <td>
+ 0 1.597 0 2.493
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender is open SOCKS proxy server
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_SOCKS
+ </font>
+ </td>
+ <td>
+ 0 1.847 0 2.054
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender is a abuseable web server
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_WEB
+ </font>
+ </td>
+ <td>
+ 0 0 0 0.007
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender demands to never be tested
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_BLOCK
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sender is on a hijacked network
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_ZOMBIE
+ </font>
+ </td>
+ <td>
+ 0 0.819 0 0
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SORBS: sent directly from dynamic IP address
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SORBS_DUL
+ </font>
+ </td>
+ <td>
+ 0 0.137 0 1.987
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Received via a relay in Spamhaus SBL
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_SBL
+ </font>
+ </td>
+ <td>
+ 0 1.050 0 0.107
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Received via a relay in Spamhaus XBL
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_XBL
+ </font>
+ </td>
+ <td>
+ 0 2.511 0 3.076
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Envelope sender in dsn.rfc-ignorant.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DNS_FROM_RFC_DSN
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Envelope sender in postmaster.rfc-ignorant.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DNS_FROM_RFC_POST
+ </font>
+ </td>
+ <td>
+ 0 1.376 0 1.614
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Envelope sender in abuse.rfc-ignorant.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DNS_FROM_RFC_ABUSE
+ </font>
+ </td>
+ <td>
+ 0 0.374 0 0
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Envelope sender in whois.rfc-ignorant.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DNS_FROM_RFC_WHOIS
+ </font>
+ </td>
+ <td>
+ 0 0.492 0 0.296
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Envelope sender in bogusmx.rfc-ignorant.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DNS_FROM_RFC_BOGUSMX
+ </font>
+ </td>
+ <td>
+ 0 1.463 0 2.630
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Received via a relay in list.dsbl.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_DSBL
+ </font>
+ </td>
+ <td>
+ 0 2.765 0 3.805
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ From: sender listed in dnsbl.ahbl.org
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DNS_FROM_AHBL_RHSBL
+ </font>
+ </td>
+ <td>
+ 0 0.070 0 0.295
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Has Habeas warrant mark and on Infringer List
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HABEAS_INFRINGER
+ </font>
+ </td>
+ <td>
+ 0 16.0 0 16.0
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Has Habeas warrant mark and on User List
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HABEAS_USER
+ </font>
+ </td>
+ <td>
+ 0 -8.0 0 -8.0
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Sender is in Bonded Sender Program (trusted relay)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_BSP_TRUSTED
+ </font>
+ </td>
+ <td>
+ 0 -4.3 0 -4.3
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Sender is in Bonded Sender Program (other relay)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_BSP_OTHER
+ </font>
+ </td>
+ <td>
+ 0 -0.1 0 -0.1
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Sender domain is new and very high volume
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SB_NEW_BULK
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Sender IP hosted at NSP has a volume spike
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SB_NSP_VOLUME_SPIKE
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Received via a relay in bl.spamcop.net
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_BL_SPAMCOP_NET
+ </font>
+ </td>
+ <td>
+ 0 1.832 0 1.216
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Received via a relay in RSL
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_RSL
+ </font>
+ </td>
+ <td>
+ 0 0.677 0 1.720
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay in RBL, http://www.mail-abuse.org/rbl/
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_MAPS_RBL
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay in DUL, http://www.mail-abuse.org/dul/
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_MAPS_DUL
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay in RSS, http://www.mail-abuse.org/rss/
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_MAPS_RSS
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay in NML, http://www.mail-abuse.org/nml/
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ RCVD_IN_MAPS_NML
+ </font>
+ </td>
+ <td>
+ 1
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Envelope sender has no MX or A DNS records
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ NO_DNS_FOR_FROM
+ </font>
+ </td>
+ <td>
+ 0 1.1 0 1.6
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'cialis'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_C
+ </font>
+ </td>
+ <td>
+ 1.993 1.917 2.501 1.325
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'levitra'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_L
+ </font>
+ </td>
+ <td>
+ 2.117 2.726 2.181 2.456
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'phentermine'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_P
+ </font>
+ </td>
+ <td>
+ 0.621 0.765 0.698 1.425
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'soma'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_S
+ </font>
+ </td>
+ <td>
+ 2.005 0.277 2.920 2.041
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'valium'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_VA
+ </font>
+ </td>
+ <td>
+ 2.005 1.922 2.934 3.680
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'viagra'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_VIA
+ </font>
+ </td>
+ <td>
+ 2.659 1.770 3.158 0.253
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'vicodin'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_VIC
+ </font>
+ </td>
+ <td>
+ 2.560 2.961 2.691 2.868
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Subject contains a gappy version of 'xanax'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ SUBJECT_DRUG_GAP_X
+ </font>
+ </td>
+ <td>
+ 2.538 2.282 2.945 2.512
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Talks about price per dose
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUG_DOSAGE
+ </font>
+ </td>
+ <td>
+ 0.342 0.608 0.405 0.862
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Mentions an E.D. drug
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUG_ED_CAPS
+ </font>
+ </td>
+ <td>
+ 0.122 1.535 0 0.185
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Viagra and other drugs
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUG_ED_COMBO
+ </font>
+ </td>
+ <td>
+ 1.000 0.183 1.415 1.636
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Talks about an E.D. drug using its chemical name
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUG_ED_SILD
+ </font>
+ </td>
+ <td>
+ 1.856 0.421 1.597 1.666
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Mentions Generic Viagra
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUG_ED_GENERIC
+ </font>
+ </td>
+ <td>
+ 1.933 1.181 0 1.128
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Fast Viagra Delivery
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUG_ED_ONLINE
+ </font>
+ </td>
+ <td>
+ 0.553 1.820 1.097 2.300
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Deep discount medications
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DEEP_DISC_MEDS
+ </font>
+ </td>
+ <td>
+ 2.480 1.211 2.573 2.626
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Online Pharmacy
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ ONLINE_PHARMACY
+ </font>
+ </td>
+ <td>
+ 2.730 0 2.895 0.000
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Attempts to disguise the word 'viagra'
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ VIA_GAP_GRA
+ </font>
+ </td>
+ <td>
+ 2.800 3.171 2.886 3.005
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>body</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Two or more drugs crammed together into one word
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ DRUGS_SMEAR1
+ </font>
+ </td>
+ <td>
+ 0.515 1.522 0.475 2.351
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: msn.com
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_MSN
+ </font>
+ </td>
+ <td>
+ 1.773 1.456 2.069 2.645
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: mail.com
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_MAIL_COM
+ </font>
+ </td>
+ <td>
+ 1.303 1.972 0.111 0.000
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: email.com
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_EMAIL_COM
+ </font>
+ </td>
+ <td>
+ 0 0 0 1.537
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: eudoramail.com
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_EUDORAMAIL
+ </font>
+ </td>
+ <td>
+ 1.520 0.907 0 0
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: excite.com
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_EXCITE
+ </font>
+ </td>
+ <td>
+ 1.840 2.127 2.127 2.074
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: lycos.com
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_LYCOS
+ </font>
+ </td>
+ <td>
+ 1.410 1.645 0 0.988
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Host HELO did not match rDNS: yahoo.ca
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_YAHOO_CA
+ </font>
+ </td>
+ <td>
+ 1.166 0 0.171 1.116
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd with suspicious hostname (mail.com)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ FAKE_HELO_MAIL_COM_DOM
+ </font>
+ </td>
+ <td>
+ 1.920 2.173 2.312 2.108
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (IP addr 1)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_IPADDR
+ </font>
+ </td>
+ <td>
+ 3.520 2.754 4.070 4.400
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (DHCP)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_DHCP
+ </font>
+ </td>
+ <td>
+ 2.791 0.087 0.958 1.248
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (HCC)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_HCC
+ </font>
+ </td>
+ <td>
+ 3.360 1.540 2.451 3.741
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (ATTBI.com)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_ATTBI
+ </font>
+ </td>
+ <td>
+ 3.200 3.662 2.760 3.147
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (Rogers)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_ROGERS
+ </font>
+ </td>
+ <td>
+ 1.677 0.793 1.888 2.094
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (Adelphia)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_ADELPHIA
+ </font>
+ </td>
+ <td>
+ 2.320 1.829 2.389 2.199
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (T-Dialin)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_DIALIN
+ </font>
+ </td>
+ <td>
+ 2.320 0.443 2.429 1.755
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (Hex IP)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_HEXIP
+ </font>
+ </td>
+ <td>
+ 1.826 1.320 1.453 1.522
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (Split IP)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_SPLIT_IP
+ </font>
+ </td>
+ <td>
+ 2.869 0.887 0.992 0.775
+ </td>
+ </tr>
+ <tr bgcolor="#ccffcc">
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (YahooBB)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_YAHOOBB
+ </font>
+ </td>
+ <td>
+ 2.800 2.776 2.572 3.000
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <strong>header</strong>
+ </td>
+ <td>
+ <font size="-1">
+
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ Relay HELO'd using suspicious hostname (OptOnline)
+ </font>
+ </td>
+ <td>
+ <font size="-1">
+ HELO_DYNAMIC_OOL
+ </font>
+ </td>
+ <td>
+ 3.120 2.508 3.065 3.182
+ </td>
+ </tr>
[... 11528 lines stripped ...]