You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by sp...@apache.org on 2022/03/06 02:45:40 UTC
svn commit: r1898640 [2/2] - in /spamassassin/trunk/rulesrc/scores: 72_scores.cf scores-set0 scores-set1 scores-set2 scores-set3 stats-set0 stats-set1
Modified: spamassassin/trunk/rulesrc/scores/scores-set1
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/scores/scores-set1?rev=1898640&r1=1898639&r2=1898640&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/scores/scores-set1 (original)
+++ spamassassin/trunk/rulesrc/scores/scores-set1 Sun Mar 6 02:45:40 2022
@@ -1,250 +1,269 @@
-# Using score set 1 logs for revision 1898439 from:
-# ham-net-darxus.r1898439.log ham-net-ena-week0.r1898439.log ham-net-ena-week1.r1898439.log ham-net-ena-week2.r1898439.log ham-net-ena-week3.r1898439.log ham-net-ena-week4.r1898439.log ham-net-giovanni-ham.r1898439.log ham-net-giovanni-spammy.r1898439.log ham-net-giovanni-spam.r1898439.log ham-net-grenier.r1898439.log ham-net-hege.r1898439.log ham-net-jhardin.r1898439.log ham-net-llanga.r1898439.log ham-net-mmiroslaw-mails-ham.r1898439.log ham-net-mmiroslaw-mails-spam.r1898439.log ham-net-pds.r1898439.log ham-net-spamsponge.r1898439.log ham-net-thendrikx.r1898439.log spam-net-darxus.r1898439.log spam-net-ena-week0.r1898439.log spam-net-ena-week1.r1898439.log spam-net-ena-week2.r1898439.log spam-net-ena-week3.r1898439.log spam-net-ena-week4.r1898439.log spam-net-giovanni-ham.r1898439.log spam-net-giovanni-spammy.r1898439.log spam-net-giovanni-spam.r1898439.log spam-net-grenier.r1898439.log spam-net-hege.r1898439.log spam-net-jhardin.r1898439.log spam-net-llanga.r1898439.log spam-net-
mmiroslaw-mails-ham.r1898439.log spam-net-mmiroslaw-mails-spam.r1898439.log spam-net-pds.r1898439.log spam-net-spamsponge.r1898439.log spam-net-thendrikx.r1898439.log
+# Using score set 1 logs for revision 1898619 from:
+# ham-net-darxus.r1898619.log ham-net-ena-week0.r1898619.log ham-net-ena-week1.r1898619.log ham-net-ena-week2.r1898619.log ham-net-ena-week3.r1898619.log ham-net-ena-week4.r1898619.log ham-net-giovanni-ham.r1898619.log ham-net-giovanni-spammy.r1898619.log ham-net-giovanni-spam.r1898619.log ham-net-grenier.r1898619.log ham-net-hege.r1898619.log ham-net-jhardin.r1898619.log ham-net-llanga.r1898619.log ham-net-mmiroslaw-mails-ham.r1898619.log ham-net-mmiroslaw-mails-spam.r1898619.log ham-net-pds.r1898619.log ham-net-spamsponge.r1898619.log ham-net-thendrikx.r1898619.log spam-net-darxus.r1898619.log spam-net-ena-week0.r1898619.log spam-net-ena-week1.r1898619.log spam-net-ena-week2.r1898619.log spam-net-ena-week3.r1898619.log spam-net-ena-week4.r1898619.log spam-net-giovanni-ham.r1898619.log spam-net-giovanni-spammy.r1898619.log spam-net-giovanni-spam.r1898619.log spam-net-grenier.r1898619.log spam-net-hege.r1898619.log spam-net-jhardin.r1898619.log spam-net-llanga.r1898619.log spam-net-
mmiroslaw-mails-ham.r1898619.log spam-net-mmiroslaw-mails-spam.r1898619.log spam-net-pds.r1898619.log spam-net-spamsponge.r1898619.log spam-net-thendrikx.r1898619.log
-score ACCT_PHISHING_MANY 2.999
+score ACCT_PHISHING_MANY 2.996
score AC_BR_BONANZA 0.001
score AC_DIV_BONANZA 0.001
-score AC_FROM_MANY_DOTS 2.999
-score AC_HTML_NONSENSE_TAGS 1.999
-score AC_SPAMMY_URI_PATTERNS8 1.174
-score ADMITS_SPAM 2.699
-score ADVANCE_FEE_2_NEW_FRM_MNY 2.499
-score ADVANCE_FEE_2_NEW_MONEY 1.999
-score ADVANCE_FEE_3_NEW 0.964
-score ADVANCE_FEE_3_NEW_FRM_MNY 0.539
-score ADVANCE_FEE_3_NEW_MONEY 1.177
-score ADVANCE_FEE_4_NEW 2.052
-score ADVANCE_FEE_4_NEW_FRM_MNY 0.661
-score ADVANCE_FEE_4_NEW_MONEY 0.001
-score ADVANCE_FEE_5_NEW 1.043
-score ADVANCE_FEE_5_NEW_FRM_MNY 0.001 # force non-zero
-score ADVANCE_FEE_5_NEW_MONEY 0.797
-score AD_PREFS 0.123
-score ALIBABA_IMG_NOT_RCVD_ALI 2.499
-score AMAZON_IMG_NOT_RCVD_AMZN 2.499
-score APP_DEVELOPMENT_NORDNS 1.557
-score AXB_XMAILER_MIMEOLE_OL_024C2 0.001
-score BIGNUM_EMAILS_FREEM 2.999
-score BIGNUM_EMAILS_MANY 2.999
-score BITCOIN_DEADLINE 1.587
-score BITCOIN_EXTORT_01 4.427
-score BITCOIN_MALF_HTML 1.525
-score BITCOIN_MALWARE 3.499
-score BITCOIN_SPAM_02 0.830
-score BITCOIN_SPAM_07 1.356
-score BITCOIN_XPRIO 1.527
-score BITCOIN_YOUR_INFO 1.688
-score BODY_EMPTY 0.902
-score BODY_URI_ONLY 0.814
-score BOGUS_MIME_VERSION 2.535
+score AC_FROM_MANY_DOTS 2.996
+score AC_HTML_NONSENSE_TAGS 1.998
+score ADMITS_SPAM 2.896
+score ADVANCE_FEE_2_NEW_FRM_MNY 2.496
+score ADVANCE_FEE_2_NEW_MONEY 1.997
+score ADVANCE_FEE_3_NEW 3.496
+score ADVANCE_FEE_3_NEW_FRM_MNY 0.001
+score ADVANCE_FEE_3_NEW_MONEY 0.410
+score ADVANCE_FEE_4_NEW 2.247
+score ADVANCE_FEE_4_NEW_FRM_MNY 1.836
+score ADVANCE_FEE_4_NEW_MONEY 1.388
+score ADVANCE_FEE_5_NEW 0.914
+score ADVANCE_FEE_5_NEW_FRM_MNY 0.001
+score ADVANCE_FEE_5_NEW_MONEY 1.685
+score AD_PREFS 0.261
+score ALIBABA_IMG_NOT_RCVD_ALI 2.497
+score AMAZON_IMG_NOT_RCVD_AMZN 0.835
+score APP_DEVELOPMENT_NORDNS 1.963
+score AXB_XMAILER_MIMEOLE_OL_024C2 2.542
+score BIGNUM_EMAILS_FREEM 1.550
+score BIGNUM_EMAILS_MANY 2.997
+score BITCOIN_DEADLINE 1.664
+score BITCOIN_EXTORT_01 4.034
+score BITCOIN_MALF_HTML 2.784
+score BITCOIN_OBFU_SUBJ 1.610
+score BITCOIN_SPAM_02 1.631
+score BITCOIN_SPAM_04 1.498
+score BITCOIN_SPAM_07 3.414
+score BITCOIN_XPRIO 1.677
+score BITCOIN_YOUR_INFO 1.889
+score BODY_EMPTY 1.426
+score BODY_URI_ONLY 0.635
+score BOGUS_MIME_VERSION 2.541
+score CANT_SEE_AD 0.215
score CK_HELO_GENERIC 0.001
-score CONTENT_AFTER_HTML 2.499
+score CONTENT_AFTER_HTML 2.497
+score CONTENT_AFTER_HTML_WEAK 1.499
score CTE_8BIT_MISMATCH 0.001
-score DEAR_BENEFICIARY 1.005
-score DKIMWL_BL 2.999
-score DKIMWL_WL_HIGH -0.373
-score DKIMWL_WL_MED -0.499
-score DKIMWL_WL_MEDHI -0.001
-score DX_TEXT_03 1.699
-score END_FUTURE_EMAILS 0.161
-score FAKE_REPLY_A1 1.346
-score FAKE_REPLY_B 2.253
+score DEAR_BENEFICIARY 1.431
+score DKIMWL_BL 2.996
+score DKIMWL_WL_HIGH -0.480
+score DKIMWL_WL_MED -0.001 # force non-zero
+score DKIMWL_WL_MEDHI -0.998
+score END_FUTURE_EMAILS 0.918
+score FAKE_REPLY_A1 2.421
+score FAKE_REPLY_B 2.602
score FILL_THIS_FORM 0.001
score FONT_INVIS_DIRECT 0.001
-score FONT_INVIS_HTML_NOHTML 2.999
-score FONT_INVIS_LONG_LINE 1.927
-score FONT_INVIS_MSGID 1.244
-score FONT_INVIS_NORDNS 0.938
+score FONT_INVIS_HTML_NOHTML 2.997
+score FONT_INVIS_LONG_LINE 1.097
+score FONT_INVIS_MSGID 0.631
+score FONT_INVIS_NORDNS 0.123
score FONT_INVIS_POSTEXTRAS 2.184
-score FORGED_SPF_HELO 1.236
-score FORM_FRAUD 1.000
-score FORM_FRAUD_3 2.499
-score FORM_FRAUD_5 0.001
-score FOUND_YOU 2.790
-score FREEMAIL_FORGED_FROMDOMAIN 0.249
-score FROMSPACE 3.399
-score FROM_2_EMAILS_SHORT 0.055
+score FORGED_SPF_HELO 0.692
+score FORM_FRAUD 0.998
+score FORM_FRAUD_3 1.736
+score FORM_FRAUD_5 0.099
+score FOUND_YOU 2.940
+score FREEMAIL_FORGED_FROMDOMAIN 0.248
+score FROMSPACE 3.197
+score FROM_2_EMAILS_SHORT 2.247
+score FROM_ADDR_WS 2.996
score FROM_BANK_NOAUTH 0.999
-score FROM_FMBLA_NEWDOM 1.499
-score FROM_FMBLA_NEWDOM14 0.999
-score FROM_FMBLA_NEWDOM28 0.799
-score FROM_GOV_DKIM_AU -0.001 # force non-zero
-score FROM_IN_TO_AND_SUBJ 1.699
-score FROM_MISSPACED 0.001
-score FROM_MISSP_EH_MATCH 0.626
+score FROM_FMBLA_NEWDOM 1.498
+score FROM_FMBLA_NEWDOM14 0.998
+score FROM_FMBLA_NEWDOM28 0.798
+score FROM_GOV_DKIM_AU -0.001
+score FROM_IN_TO_AND_SUBJ 2.197
+score FROM_MISSPACED 1.997
+score FROM_MISSP_DYNIP 2.097
+score FROM_MISSP_EH_MATCH 1.997
score FROM_MISSP_FREEMAIL 0.001
-score FROM_MISSP_MSFT 0.001
+score FROM_MISSP_MSFT 3.297
+score FROM_MISSP_PHISH 3.268
score FROM_MISSP_SPF_FAIL 0.001
-score FROM_MISSP_TO_UNDISC 1.176
-score FROM_MISSP_USER 0.001
-score FROM_MULTI_NORDNS 1.894
-score FROM_NTLD_LINKBAIT 1.999
+score FROM_MISSP_TO_UNDISC 2.297
+score FROM_MISSP_USER 2.494
+score FROM_MULTI_NORDNS 1.002
+score FROM_NTLD_LINKBAIT 0.382
score FROM_PAYPAL_SPOOF 0.001
-score FROM_SUSPICIOUS_NTLD 0.500
-score FROM_SUSPICIOUS_NTLD_FP 2.000
-score FROM_WSP_TRAIL 2.400
-score FSL_BULK_SIG 1.998
-score FSL_CTYPE_WIN1251 0.001
-score FSL_NEW_HELO_USER 0.001
-score FUZZY_AMAZON 2.699
-score FUZZY_CLICK_HERE 2.338
-score FUZZY_NORTON 3.099
-score FUZZY_PAYPAL 2.399
-score FUZZY_SECURITY 1.267
-score FUZZY_WALLET 3.199
-score GAPPY_LOW_CONTRAST 2.499
-score GB_FAKE_RF_SHORT 0.595
-score GB_FREEMAIL_DISPTO 0.499
-score GOOG_REDIR_NORDNS 2.999
-score GOOG_STO_EMAIL_PHISH 2.238
-score GOOG_STO_IMG_HTML 2.999
-score GOOG_STO_IMG_NOHTML 2.191
-score GOOG_STO_NOIMG_HTML 2.999
-score HAS_X_OUTGOING_SPAM_STAT 1.794
-score HDRS_MISSP 2.500
-score HDR_ORDER_FTSDMCXX_DIRECT 1.810
-score HDR_ORDER_FTSDMCXX_NORDNS 2.800
+score FROM_SUSPICIOUS_NTLD 0.498
+score FROM_SUSPICIOUS_NTLD_FP 1.773
+score FROM_UNBAL1 2.197
+score FROM_WSP_TRAIL 2.297
+score FSL_BULK_SIG 2.497
+score FSL_CTYPE_WIN1251 1.569
+score FSL_NEW_HELO_USER 1.997
+score FUZZY_AMAZON 2.697
+score FUZZY_CLICK_HERE 2.297
+score FUZZY_WALLET 3.196
+score GAPPY_LOW_CONTRAST 2.278
+score GB_FAKE_RF_SHORT 0.065
+score GB_FREEMAIL_DISPTO 0.305
+score GB_FREEMAIL_DISPTO_NOTFREEM 0.498
+score GOOG_REDIR_HTML_ONLY 1.997
+score GOOG_REDIR_NORDNS 2.996
+score GOOG_STO_EMAIL_PHISH 1.594
+score GOOG_STO_HTML_PHISH 1.163
+score GOOG_STO_HTML_PHISH_MANY 2.766
+score GOOG_STO_IMG_HTML 2.996
+score GOOG_STO_IMG_NOHTML 1.615
+score GOOG_STO_NOIMG_HTML 2.943
+score HAS_X_NO_RELAY 1.402
+score HAS_X_OUTGOING_SPAM_STAT 1.796
+score HDRS_MISSP 1.601
+score HDR_ORDER_FTSDMCXX_DIRECT 1.000
+score HDR_ORDER_FTSDMCXX_NORDNS 3.013
score HEADER_FROM_DIFFERENT_DOMAINS 0.249
score HELO_NO_DOMAIN 0.001
-score HK_LOTTO 0.999
-score HK_NAME_FROM 0.999
-score HK_NAME_MR_MRS 0.001 # force non-zero
-score HK_RANDOM_ENVFROM 0.999
-score HK_RANDOM_FROM 0.999
-score HK_RANDOM_REPLYTO 0.656
+score HK_LOTTO 0.619
+score HK_NAME_FROM 0.998
+score HK_NAME_MR_MRS 0.001
+score HK_RANDOM_ENVFROM 0.998
+score HK_RANDOM_FROM 0.998
+score HK_RANDOM_REPLYTO 0.655
score HK_SCAM 0.001
-score HK_WIN 0.999
-score HOSTED_IMG_DIRECT_MX 1.691
-score HOSTED_IMG_FREEM 3.499
-score HOSTED_IMG_MULTI_PUB_01 2.999
-score HTML_ENTITY_ASCII 1.812
-score HTML_FONT_TINY_NORDNS 0.977
-score HTML_OFF_PAGE 2.999
+score HK_WIN 0.998
+score HOSTED_IMG_DIRECT_MX 2.581
+score HOSTED_IMG_FREEM 3.496
+score HOSTED_IMG_MULTI_PUB_01 2.996
+score HTML_ENTITY_ASCII 1.675
+score HTML_ENTITY_ASCII_TINY 2.996
+score HTML_FONT_TINY_NORDNS 1.005
+score HTML_OFF_PAGE 2.996
score HTML_SINGLET_MANY 0.001
-score HTML_TAG_BALANCE_CENTER 2.597
-score HTML_TEXT_INVISIBLE_FONT 1.999
-score HTML_TEXT_INVISIBLE_STYLE 3.194
-score IMG_ONLY_FM_DOM_INFO 0.482
-score JH_SPAMMY_HEADERS 3.499
-score KHOP_HELO_FCRDNS 0.276
-score LONGLN_LOW_CONTRAST 1.663
-score LONG_HEX_URI 0.512
-score LONG_IMG_URI 1.726
-score LONG_INVISIBLE_TEXT 1.775
+score HTML_TAG_BALANCE_CENTER 2.470
+score HTML_TEXT_INVISIBLE_FONT 1.997
+score HTML_TEXT_INVISIBLE_STYLE 3.032
+score IMG_ONLY_FM_DOM_INFO 0.471
+score JH_SPAMMY_HEADERS 3.496
+score KHOP_HELO_FCRDNS 0.378
+score LONGLN_LOW_CONTRAST 2.497
+score LONG_HEX_URI 0.001 # force non-zero
+score LONG_IMG_URI 2.222
+score LONG_INVISIBLE_TEXT 0.976
score LOTS_OF_MONEY 0.010
-score LOTTO_AGENT 0.174
-score LOTTO_DEPT 1.465
-score MALWARE_NORDNS 1.838
-score MANY_SPAN_IN_TEXT 1.959
-score MILLION_HUNDRED 0.001
-score MIMEOLE_DIRECT_TO_MX 1.737
-score MIXED_AREA_CASE 1.463
-score MIXED_CENTER_CASE 0.921
-score MIXED_CTYPE_CASE 2.639
-score MIXED_ES 2.203
-score MIXED_FONT_CASE 2.037
-score MIXED_HREF_CASE 0.622
-score MIXED_IMG_CASE 2.999
-score MONEY_FORM_SHORT 1.119
-score MONEY_FRAUD_3 2.899
-score MONEY_FRAUD_5 0.001
+score LOTTO_AGENT 0.954
+score LOTTO_DEPT 1.116
+score MALWARE_NORDNS 0.826
+score MALW_ATTACH 2.197
+score MANY_SPAN_IN_TEXT 1.310
+score MILLION_HUNDRED 0.358
+score MIMEOLE_DIRECT_TO_MX 1.825
+score MIXED_AREA_CASE 1.097
+score MIXED_CENTER_CASE 2.497
+score MIXED_CTYPE_CASE 1.599
+score MIXED_ES 0.443
+score MIXED_FONT_CASE 2.114
+score MIXED_HREF_CASE 0.657
+score MIXED_IMG_CASE 2.177
+score MONEY_ATM_CARD 0.001 # force non-zero
+score MONEY_FORM 0.001
+score MONEY_FORM_SHORT 0.001
+score MONEY_FRAUD_3 2.896
+score MONEY_FRAUD_5 0.011
score MONEY_FRAUD_8 0.001
-score MONEY_FREEMAIL_REPTO 0.001 # force non-zero
+score MONEY_FREEMAIL_REPTO 0.001
score MONEY_FROM_41 1.999
-score MONEY_FROM_MISSP 1.999
-score MSMAIL_PRI_ABNORMAL 1.219
-score NAME_EMAIL_DIFF 1.754
+score MONEY_FROM_MISSP 1.997
+score MSMAIL_PRI_ABNORMAL 1.256
+score NAME_EMAIL_DIFF 2.107
+score NA_DOLLARS 0.047
score NICE_REPLY_A -0.001
-score NORDNS_LOW_CONTRAST 0.001
+score NORDNS_LOW_CONTRAST 0.699
score NO_FM_NAME_IP_HOSTN 0.001
-score NSL_RCVD_FROM_USER 0.001
-score NSL_RCVD_HELO_USER 1.855
-score OBFU_TEXT_ATTACH 0.779
-score ODD_FREEM_REPTO 1.629
-score PDS_BTC_ID 0.500
-score PDS_BTC_MSGID 0.359
+score NSL_RCVD_FROM_USER 2.560
+score NSL_RCVD_HELO_USER 2.573
+score NUMBEREND_LINKBAIT 0.396
+score OBFU_TEXT_ATTACH 1.498
+score ODD_FREEM_REPTO 1.595
+score PDS_BTC_ID 0.498
+score PDS_BTC_MSGID 0.001
score PDS_DBL_URL_TNB_RUNON 1.999
-score PDS_FRNOM_TODOM_DBL_URL 1.500
-score PDS_FRNOM_TODOM_NAKED_TO 1.499
-score PDS_FROM_2_EMAILS_SHRTNER 0.577
-score PDS_FROM_NAME_TO_DOMAIN 1.493
-score PDS_HP_HELO_NORDNS 1.000
-score PDS_OTHER_BAD_TLD 2.000
-score PDS_PHPEXP_BOT 1.499
-score PDS_PHP_EVAL 0.733
+score PDS_FRNOM_TODOM_DBL_URL 0.001
+score PDS_FRNOM_TODOM_NAKED_TO 1.369
+score PDS_FROM_2_EMAILS 0.275
+score PDS_FROM_2_EMAILS_SHRTNER 0.378
+score PDS_FROM_NAME_TO_DOMAIN 1.565
+score PDS_HP_HELO_NORDNS 0.998
+score PDS_OTHER_BAD_TLD 1.997
+score PDS_PHPEXP_BOT 1.498
+score PDS_PHP_EVAL 1.498
score PDS_RDNS_DYNAMIC_FP 0.001 # force non-zero
-score PDS_SHORTFWD_URISHRT_FP 1.113
-score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 2.000
-score PDS_TO_EQ_FROM_NAME 2.391
-score PHISH_FBASEAPP 2.505
-score PHP_ORIG_SCRIPT 2.499
-score PHP_ORIG_SCRIPT_EVAL 2.463
-score PHP_SCRIPT 0.532
-score POSTCARD_06 2.299
-score PP_MIME_FAKE_ASCII_TEXT 1.000
-score RAND_HEADER_LIST_SPOOF 2.996
-score RAND_HEADER_MANY 2.864
-score RAND_MKTG_HEADER 1.497
-score RATWARE_NO_RDNS 2.999
+score PDS_SHORTFWD_URISHRT_FP 0.693
+score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.997
+score PDS_TO_EQ_FROM_NAME 2.684
+score PHISH_FBASEAPP 1.382
+score PHP_ORIG_SCRIPT 2.497
+score PHP_ORIG_SCRIPT_EVAL 2.996
+score PHP_SCRIPT 0.091
+score POSTCARD_06 2.197
+score PP_MIME_FAKE_ASCII_TEXT 0.998
+score RAND_HEADER_LIST_SPOOF 2.993
+score RAND_HEADER_MANY 2.190
+score RAND_MKTG_HEADER 1.496
+score RATWARE_NO_RDNS 2.996
score RCVD_IN_MSPIKE_H2 -0.001
-score RDNS_NUM_TLD_XM 0.150
-score REPLYTO_EMPTY 2.999
-score REPTO_419_FRAUD_GM 0.001
-score SCC_BODY_URI_ONLY 0.692
-score SCC_ISEMM_LID_1 1.150
-score SCRIPT_GIBBERISH 2.599
-score SENDGRID_REDIR 0.272
-score SERGIO_SUBJECT_VIAGRA01 4.300
-score SHOPIFY_IMG_NOT_RCVD_SFY 2.499
-score SHORTENED_URL_SRC 0.424
-score SHORTENER_SHORT_IMG 1.975
-score SHORT_SHORTNER 1.999
-score SPOOFED_FREEMAIL 1.000
+score RDNS_NUM_TLD_XM 0.924
+score REPLYTO_EMPTY 2.796
+score REPTO_419_FRAUD_GM 2.996
+score SCC_BODY_URI_ONLY 0.712
+score SCC_ISEMM_LID_1 1.432
+score SCRIPT_GIBBERISH 2.596
+score SENDGRID_REDIR 0.001
+score SERGIO_SUBJECT_VIAGRA01 4.195
+score SHOPIFY_IMG_NOT_RCVD_SFY 2.497
+score SHORTENED_URL_SRC 2.064
+score SHORTENER_SHORT_IMG 1.651
+score SHORT_SHORTNER 1.997
+score SPOOFED_FREEMAIL 1.767
score SPOOFED_FREEMAIL_NO_RDNS 0.001
-score SPOOFED_FREEM_REPTO 2.191
-score SPOOF_GMAIL_MID 1.446
-score STATIC_XPRIO_OLE 0.001
-score SUSP_UTF8_WORD_COMBO 2.999
-score SUSP_UTF8_WORD_SUBJ 0.001 # force non-zero
-score THIS_AD 1.199
+score SPOOFED_FREEM_REPTO 2.497
+score SPOOF_GMAIL_MID 0.577
+score STATIC_XPRIO_OLE 1.862
+score SUBJ_ATTENTION 0.499
+score SUSP_UTF8_WORD_COMBO 2.997
+score SUSP_UTF8_WORD_SUBJ 0.001
+score THIS_AD 1.198
score TO_EQ_FM_DIRECT_MX 0.001
-score TO_EQ_FM_DOM_SPF_FAIL 0.026
+score TO_EQ_FM_DOM_HTML_IMG 2.397
+score TO_EQ_FM_DOM_HTML_ONLY 0.001
+score TO_EQ_FM_DOM_SPF_FAIL 0.001
+score TO_EQ_FM_HTML_ONLY 1.504
score TO_EQ_FM_SPF_FAIL 0.001
-score TO_IN_SUBJ 0.099
-score TO_NAME_SUBJ_NO_RDNS 2.952
-score TO_NO_BRKTS_FROM_MSSP 1.187
-score TO_NO_BRKTS_HTML_IMG 1.268
-score TO_NO_BRKTS_HTML_ONLY 2.000
-score TO_NO_BRKTS_MSFT 0.001 # force non-zero
+score TO_IN_SUBJ 0.098
+score TO_NAME_SUBJ_NO_RDNS 2.683
+score TO_NO_BRKTS_FROM_MSSP 2.497
+score TO_NO_BRKTS_HTML_IMG 1.087
+score TO_NO_BRKTS_HTML_ONLY 1.997
+score TO_NO_BRKTS_MSFT 2.499
score TO_NO_BRKTS_NORDNS_HTML 0.001
-score TO_NO_BRKTS_PCNT 2.499
-score TVD_RCVD_SPACE_BRACKET 1.840
-score TVD_SPACE_RATIO_MINFP 0.623
-score UNDISC_FREEM 3.599
-score UNDISC_MONEY 3.599
-score UNICODE_OBFU_ASC 2.499
-score UNSUB_GOOG_FORM 2.499
-score URI_AZURE_CLOUDAPP 1.514
-score URI_DOTEDU 2.000
-score URI_FIREBASEAPP 3.000
-score URI_GOOGLE_PROXY 2.499
-score URI_GOOG_STO_SPAMMY 2.621
-score URI_IN_URI_10 3.599
-score URI_ONLY_MSGID_MALF 1.999
-score URI_PHISH 3.631
-score URI_PHP_REDIR 3.499
-score URI_TRY_3LD 1.999
-score URI_WPADMIN 1.999
-score URI_WP_HACKED 3.499
-score URI_WP_HACKED_2 1.398
-score VFY_ACCT_NORDNS 2.347
-score WORD_INVIS 0.001
+score TO_NO_BRKTS_PCNT 2.497
+score TVD_PH_BODY_META 2.696
+score TVD_RCVD_SPACE_BRACKET 2.497
+score UNDISC_FREEM 3.595
+score UNDISC_MONEY 3.595
+score UNICODE_OBFU_ASC 2.497
+score UNSUB_GOOG_FORM 2.497
+score URI_AZURE_CLOUDAPP 2.300
+score URI_DOTEDU 1.997
+score URI_FIREBASEAPP 2.996
+score URI_GOOGLE_PROXY 2.497
+score URI_GOOG_STO_SPAMMY 2.999
+score URI_IN_URI_10 3.296
+score URI_ONLY_MSGID_MALF 0.001
+score URI_PHISH 3.623
+score URI_PHP_REDIR 2.792
+score URI_TRY_3LD 1.997
+score URI_WPADMIN 1.897
+score URI_WP_HACKED 3.496
+score URI_WP_HACKED_2 1.249
+score VFY_ACCT_NORDNS 2.999
+score WORD_INVIS 0.594
+score WORD_INVIS_MANY 2.996
score XFER_LOTSA_MONEY 0.999
-score XM_LIGHT_HEAVY 2.499
-score XM_RANDOM 2.499
-score XM_RECPTID 2.999
-score XPRIO 2.175
-score YOU_INHERIT 2.046
+score XM_LIGHT_HEAVY 2.497
+score XM_RANDOM 1.910
+score XM_RECPTID 2.996
+score XPRIO 1.928
+score YOU_INHERIT 2.411
score AC_POST_EXTRAS 1.000
score AC_SPAMMY_URI_PATTERNS1 1.000
score AC_SPAMMY_URI_PATTERNS10 1.000
@@ -253,6 +272,7 @@ score AC_SPAMMY_URI_PATTERNS12 1.0
score AC_SPAMMY_URI_PATTERNS2 1.000
score AC_SPAMMY_URI_PATTERNS3 1.000
score AC_SPAMMY_URI_PATTERNS4 1.000
+score AC_SPAMMY_URI_PATTERNS8 1.000
score AC_SPAMMY_URI_PATTERNS9 1.000
score ADULT_DATING_COMPANY 10.001 # force non-zero
score ADVANCE_FEE_2_NEW_FORM 1.000
@@ -261,12 +281,11 @@ score BEBEE_IMG_NOT_RCVD_BB 1.0
score BITCOIN_BOMB 1.000
score BITCOIN_EXTORT_02 1.000
score BITCOIN_IMGUR 1.000
-score BITCOIN_OBFU_SUBJ 1.000
+score BITCOIN_MALWARE 1.000
score BITCOIN_ONAN 1.000
score BITCOIN_PAY_ME 1.000
score BITCOIN_SPAM_01 1.000
score BITCOIN_SPAM_03 1.000
-score BITCOIN_SPAM_04 1.000
score BITCOIN_SPAM_05 1.000
score BITCOIN_SPAM_06 1.000
score BITCOIN_SPAM_08 1.000
@@ -280,9 +299,7 @@ score BOMB_FREEM 1.0
score BOMB_MONEY 1.000
score BTC_ORG 1.000
score BULK_RE_SUSP_NTLD 1.000
-score CANT_SEE_AD 1.000
score COMMENT_GIBBERISH 1.000
-score CONTENT_AFTER_HTML_WEAK 1.000
score DAY_I_EARNED 1.000
score DKIMWL_BLOCKED 0.001
score DOTGOV_IMAGE 1.000
@@ -296,34 +313,27 @@ score FBI_SPOOF 1.0
score FONT_INVIS_DOTGOV 1.000
score FREEM_FRNUM_UNICD_EMPTY 1.000
score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000
-score FROM_ADDR_WS 1.000
score FROM_FMBLA_NDBLOCKED 0.001
score FROM_GOV_REPLYTO_FREEMAIL 1.000
score FROM_GOV_SPOOF 1.000
-score FROM_MISSP_PHISH 1.000
score FROM_NEWDOM_BTC 1.000
score FROM_NTLD_REPLY_FREEMAIL 1.000
score FROM_NUMBERO_NEWDOMAIN 1.000
score FROM_NUMERIC_TLD 1.000
score GAPPY_SALES_LEADS_FREEM 1.000
score GB_FORGED_MUA_POSTFIX 1.000
-score GB_FREEMAIL_DISPTO_NOTFREEM 0.500
score GB_GOOGLE_OBFUR 0.750
score GOOGLE_DOCS_PHISH 1.000
score GOOGLE_DOCS_PHISH_MANY 1.000
score GOOGLE_DOC_SUSP 1.000
score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000
score GOOG_MALWARE_DNLD 1.000
-score GOOG_STO_HTML_PHISH 1.000
-score GOOG_STO_HTML_PHISH_MANY 1.000
-score HAS_X_NO_RELAY 1.000
score HDRS_LCASE_IMGONLY 0.100
score HEXHASH_WORD 1.000
score HK_CTE_RAW 1.000
score HK_RCVD_IP_MULTICAST 1.000
score HOSTED_IMG_DQ_UNSUB 1.000
score HOSTED_IMG_MULTI 1.000
-score HTML_ENTITY_ASCII_TINY 1.000
score HTML_SHRT_CMNT_OBFU_MANY 1.000
score JH_SPAMMY_PATTERN01 1.000
score JH_SPAMMY_PATTERN02 1.000
@@ -333,7 +343,6 @@ score LIST_PRTL_SAME_USER 1.0
score LUCRATIVE 1.000
score MALF_HTML_B64 1.000
score MALWARE_PASSWORD 1.000
-score MANY_HDRS_LCASE 0.100
score MIME_NO_TEXT 1.000
score MONERO_DEADLINE 1.000
score MONERO_EXTORT_01 1.000
@@ -346,6 +355,7 @@ score NEWEGG_IMG_NOT_RCVD_NEGG 1.0
score NEW_PRODUCTS 1.000
score OBFU_BITCOIN 1.000
score PDS_HELO_SPF_FAIL 1.000
+score PDS_PHP_RUNTIME_FUNC 1.000
score PHISH_AZURE_CLOUDAPP 3.500
score PHOTO_EDITING_DIRECT 1.000
score PHOTO_EDITING_FREEM 1.000
@@ -378,6 +388,7 @@ score SPOOFED_FREEM_REPTO_CHN 1.0
score SPOOFED_FREEM_REPTO_RUS 1.000
score STOCK_TIP 1.000
score SUBJ_BRKN_WORDNUMS 1.000
+score SUSPNTLD_EXPIRATION_EXTORT 1.000
score SYSADMIN 1.000
score TAGSTAT_IMG_NOT_RCVD_TGST 1.000
score TARINGANET_IMG_NOT_RCVD_TN 1.000
@@ -400,6 +411,5 @@ score URI_WP_DIRINDEX 1.0
score USB_DRIVES 1.000
score VPS_NO_NTLD 1.000
score WALMART_IMG_NOT_RCVD_WAL 1.000
-score WORD_INVIS_MANY 1.000
score XM_DIGITS_ONLY 1.000
score XPRIO_SHORT_SUBJ 1.000
Modified: spamassassin/trunk/rulesrc/scores/scores-set2
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/scores/scores-set2?rev=1898640&r1=1898639&r2=1898640&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/scores/scores-set2 (original)
+++ spamassassin/trunk/rulesrc/scores/scores-set2 Sun Mar 6 02:45:40 2022
@@ -4,214 +4,214 @@
score ACCT_PHISHING_MANY 2.999
score AC_BR_BONANZA 0.001
score AC_DIV_BONANZA 0.001
-score AC_FROM_MANY_DOTS 2.999
+score AC_FROM_MANY_DOTS 3.000
score AC_HTML_NONSENSE_TAGS 1.999
score ADMITS_SPAM 2.899
-score ADVANCE_FEE_2_NEW_FRM_MNY 2.222
-score ADVANCE_FEE_2_NEW_MONEY 1.999
-score ADVANCE_FEE_3_NEW 3.499
+score ADVANCE_FEE_2_NEW_FRM_MNY 1.367
+score ADVANCE_FEE_2_NEW_MONEY 2.000
+score ADVANCE_FEE_3_NEW 3.500
score ADVANCE_FEE_3_NEW_FRM_MNY 2.499
-score ADVANCE_FEE_3_NEW_MONEY 2.743
+score ADVANCE_FEE_3_NEW_MONEY 2.734
score ADVANCE_FEE_4_NEW 2.399
score ADVANCE_FEE_4_NEW_FRM_MNY 2.699
-score ADVANCE_FEE_4_NEW_MONEY 1.063
-score ADVANCE_FEE_5_NEW 2.499
+score ADVANCE_FEE_4_NEW_MONEY 0.912
+score ADVANCE_FEE_5_NEW 2.500
score ADVANCE_FEE_5_NEW_FRM_MNY 0.001
-score ADVANCE_FEE_5_NEW_MONEY 1.737
-score AD_PREFS 0.001 # force non-zero
+score ADVANCE_FEE_5_NEW_MONEY 1.531
+score AD_PREFS 0.001
score ALIBABA_IMG_NOT_RCVD_ALI 2.499
score AMAZON_IMG_NOT_RCVD_AMZN 2.499
-score APP_DEVELOPMENT_NORDNS 2.000
-score AXB_XMAILER_MIMEOLE_OL_024C2 2.634
+score APP_DEVELOPMENT_NORDNS 1.999
+score AXB_XMAILER_MIMEOLE_OL_024C2 3.014
score BIGNUM_EMAILS_FREEM 2.999
score BIGNUM_EMAILS_MANY 2.999
-score BITCOIN_DEADLINE 0.715
-score BITCOIN_EXTORT_01 4.411
-score BITCOIN_MALF_HTML 1.801
-score BITCOIN_OBFU_SUBJ 3.383
-score BITCOIN_SPAM_02 2.275
+score BITCOIN_DEADLINE 0.713
+score BITCOIN_EXTORT_01 4.225
+score BITCOIN_MALF_HTML 2.316
+score BITCOIN_OBFU_SUBJ 1.868
+score BITCOIN_SPAM_02 2.499
score BITCOIN_SPAM_04 1.499
-score BITCOIN_SPAM_07 3.359
-score BITCOIN_XPRIO 2.499
-score BITCOIN_YOUR_INFO 1.488
+score BITCOIN_SPAM_07 3.193
+score BITCOIN_XPRIO 1.928
+score BITCOIN_YOUR_INFO 1.487
score BODY_EMPTY 1.412
score BOGUS_MIME_VERSION 3.499
score CK_HELO_GENERIC 0.250
score CONTENT_AFTER_HTML 2.499
score CONTENT_AFTER_HTML_WEAK 1.499
-score CTE_8BIT_MISMATCH 0.999
+score CTE_8BIT_MISMATCH 1.000
score DEAR_BENEFICIARY 0.948
-score FAKE_REPLY_A1 1.491
+score FAKE_REPLY_A1 2.513
score FAKE_REPLY_B 3.299
-score FILL_THIS_FORM 1.198
+score FILL_THIS_FORM 1.196
score FONT_INVIS_DIRECT 0.001
score FONT_INVIS_HTML_NOHTML 2.999
score FONT_INVIS_LONG_LINE 1.686
-score FONT_INVIS_MSGID 1.888
+score FONT_INVIS_MSGID 1.884
score FONT_INVIS_NORDNS 0.001
-score FONT_INVIS_POSTEXTRAS 1.831
+score FONT_INVIS_POSTEXTRAS 1.840
score FORM_FRAUD_5 0.001
score FOUND_YOU 3.249
score FREEMAIL_FORGED_FROMDOMAIN 0.250
-score FROMSPACE 3.299
-score FROM_2_EMAILS_SHORT 1.398
+score FROMSPACE 3.300
+score FROM_2_EMAILS_SHORT 1.364
score FROM_ADDR_WS 2.999
score FROM_IN_TO_AND_SUBJ 2.299
-score FROM_MISSPACED 1.999
+score FROM_MISSPACED 2.000
score FROM_MISSP_DYNIP 2.199
score FROM_MISSP_EH_MATCH 1.999
score FROM_MISSP_FREEMAIL 1.404
score FROM_MISSP_MSFT 3.399
score FROM_MISSP_PHISH 3.499
score FROM_MISSP_TO_UNDISC 2.399
-score FROM_MISSP_USER 2.450
-score FROM_MULTI_NORDNS 0.358
-score FROM_NTLD_LINKBAIT 0.001
-score FROM_NTLD_REPLY_FREEMAIL 1.348
+score FROM_MISSP_USER 2.675
+score FROM_MULTI_NORDNS 0.354
+score FROM_NTLD_LINKBAIT 1.997
+score FROM_NTLD_REPLY_FREEMAIL 1.379
score FROM_SUSPICIOUS_NTLD 0.500
-score FROM_SUSPICIOUS_NTLD_FP 2.000
-score FROM_UNBAL1 2.300
+score FROM_SUSPICIOUS_NTLD_FP 1.999
+score FROM_UNBAL1 2.299
score FROM_WSP_TRAIL 2.499
-score FSL_CTYPE_WIN1251 2.806
+score FSL_CTYPE_WIN1251 2.216
score FSL_NEW_HELO_USER 1.999
score FUZZY_AMAZON 2.799
score FUZZY_CLICK_HERE 2.499
score FUZZY_WALLET 3.299
-score GAPPY_LOW_CONTRAST 2.500
-score GB_FAKE_RF_SHORT 1.452
+score GAPPY_LOW_CONTRAST 2.499
+score GB_FAKE_RF_SHORT 1.443
score GB_FREEMAIL_DISPTO 0.499
-score GB_FREEMAIL_DISPTO_NOTFREEM 0.499
+score GB_FREEMAIL_DISPTO_NOTFREEM 0.500
score GOOG_REDIR_HTML_ONLY 1.999
-score GOOG_REDIR_NORDNS 2.601
-score GOOG_STO_EMAIL_PHISH 2.441
-score GOOG_STO_HTML_PHISH 2.308
-score GOOG_STO_HTML_PHISH_MANY 1.568
-score GOOG_STO_IMG_HTML 1.591
+score GOOG_REDIR_NORDNS 2.597
+score GOOG_STO_EMAIL_PHISH 2.750
+score GOOG_STO_HTML_PHISH 1.081
+score GOOG_STO_HTML_PHISH_MANY 2.131
+score GOOG_STO_IMG_HTML 1.469
score GOOG_STO_IMG_NOHTML 2.499
score GOOG_STO_NOIMG_HTML 2.999
score HAS_X_NO_RELAY 2.499
score HAS_X_OUTGOING_SPAM_STAT 1.999
score HDRS_MISSP 2.499
score HDR_ORDER_FTSDMCXX_DIRECT 1.999
-score HDR_ORDER_FTSDMCXX_NORDNS 0.659
-score HEADER_FROM_DIFFERENT_DOMAINS 0.249
+score HDR_ORDER_FTSDMCXX_NORDNS 3.187
+score HEADER_FROM_DIFFERENT_DOMAINS 0.250
score HELO_NO_DOMAIN 0.001
score HK_LOTTO 0.999
score HK_NAME_FROM 0.999
-score HK_NAME_MR_MRS 1.000
+score HK_NAME_MR_MRS 0.999
score HK_RANDOM_ENVFROM 0.999
score HK_RANDOM_FROM 0.999
-score HK_RANDOM_REPLYTO 1.000
+score HK_RANDOM_REPLYTO 0.999
score HK_SCAM 0.001
-score HK_WIN 0.917
-score HOSTED_IMG_DIRECT_MX 3.087
+score HK_WIN 0.949
+score HOSTED_IMG_DIRECT_MX 3.468
score HOSTED_IMG_FREEM 3.499
score HOSTED_IMG_MULTI_PUB_01 2.999
-score HTML_ENTITY_ASCII 2.656
+score HTML_ENTITY_ASCII 2.600
score HTML_FONT_TINY_NORDNS 1.999
score HTML_OFF_PAGE 2.999
-score HTML_TAG_BALANCE_CENTER 2.301
+score HTML_TAG_BALANCE_CENTER 2.302
score HTML_TEXT_INVISIBLE_STYLE 3.499
-score IMG_ONLY_FM_DOM_INFO 2.198
+score IMG_ONLY_FM_DOM_INFO 2.199
score JH_SPAMMY_HEADERS 3.499
score LONGLN_LOW_CONTRAST 2.499
score LONG_HEX_URI 3.000
-score LONG_IMG_URI 0.402
-score LONG_INVISIBLE_TEXT 1.438
+score LONG_IMG_URI 0.405
+score LONG_INVISIBLE_TEXT 1.436
score LOTS_OF_MONEY 0.010
-score LOTTO_AGENT 1.166
+score LOTTO_AGENT 0.143
score LOTTO_DEPT 0.001
-score MALWARE_NORDNS 0.702
+score MALWARE_NORDNS 1.515
score MALW_ATTACH 2.299
score MANY_SPAN_IN_TEXT 2.199
-score MILLION_HUNDRED 0.308
+score MILLION_HUNDRED 0.556
score MIMEOLE_DIRECT_TO_MX 1.999
-score MIXED_AREA_CASE 1.276
-score MIXED_CENTER_CASE 2.499
-score MIXED_CTYPE_CASE 2.676
+score MIXED_AREA_CASE 1.350
+score MIXED_CENTER_CASE 2.500
+score MIXED_CTYPE_CASE 2.899
score MIXED_ES 2.699
-score MIXED_FONT_CASE 0.750
-score MIXED_HREF_CASE 1.872
-score MIXED_IMG_CASE 2.503
+score MIXED_FONT_CASE 1.630
+score MIXED_HREF_CASE 1.312
+score MIXED_IMG_CASE 1.868
score MONEY_ATM_CARD 0.001
score MONEY_FORM 0.001
-score MONEY_FORM_SHORT 0.928
-score MONEY_FRAUD_3 0.252
+score MONEY_FORM_SHORT 1.068
+score MONEY_FRAUD_3 0.137
score MONEY_FRAUD_5 0.001
-score MONEY_FRAUD_8 0.001
-score MONEY_FREEMAIL_REPTO 2.444
+score MONEY_FRAUD_8 0.001 # force non-zero
+score MONEY_FREEMAIL_REPTO 2.406
score MONEY_FROM_41 1.999
-score MONEY_FROM_MISSP 1.597
-score MSMAIL_PRI_ABNORMAL 1.362
-score NAME_EMAIL_DIFF 3.599
-score NA_DOLLARS 0.088
+score MONEY_FROM_MISSP 1.915
+score MSMAIL_PRI_ABNORMAL 1.499
+score NAME_EMAIL_DIFF 3.600
+score NA_DOLLARS 0.292
score NICE_REPLY_A -0.001
-score NORDNS_LOW_CONTRAST 1.888
-score NO_FM_NAME_IP_HOSTN 0.001
-score NSL_RCVD_FROM_USER 2.057
-score NSL_RCVD_HELO_USER 1.024
-score NUMBEREND_LINKBAIT 0.482
+score NORDNS_LOW_CONTRAST 1.886
+score NO_FM_NAME_IP_HOSTN 0.001 # force non-zero
+score NSL_RCVD_FROM_USER 2.835
+score NSL_RCVD_HELO_USER 2.461
+score NUMBEREND_LINKBAIT 0.773
score OBFU_JVSCR_ESC 2.199
score OBFU_TEXT_ATTACH 1.500
-score ODD_FREEM_REPTO 2.999
+score ODD_FREEM_REPTO 3.000
score PDS_BTC_ID 0.499
-score PDS_BTC_MSGID 0.576
-score PDS_DBL_URL_TNB_RUNON 2.000
-score PDS_FRNOM_TODOM_DBL_URL 1.499
+score PDS_BTC_MSGID 0.999
+score PDS_DBL_URL_TNB_RUNON 1.999
+score PDS_FRNOM_TODOM_DBL_URL 0.001
score PDS_FRNOM_TODOM_NAKED_TO 1.499
-score PDS_FROM_2_EMAILS_SHRTNER 0.880
+score PDS_FROM_2_EMAILS_SHRTNER 0.613
score PDS_FROM_NAME_TO_DOMAIN 1.999
score PDS_HP_HELO_NORDNS 0.999
score PDS_OTHER_BAD_TLD 1.999
score PDS_PHPEXP_BOT 1.499
score PDS_PHP_EVAL 1.499
score PDS_RDNS_DYNAMIC_FP 0.001 # force non-zero
-score PDS_SHORTFWD_URISHRT_FP 1.165
+score PDS_SHORTFWD_URISHRT_FP 1.335
score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.999
score PDS_TO_EQ_FROM_NAME 1.396
-score PHISH_FBASEAPP 1.348
+score PHISH_FBASEAPP 2.001
score PHP_ORIG_SCRIPT 2.499
-score PHP_ORIG_SCRIPT_EVAL 2.999
+score PHP_ORIG_SCRIPT_EVAL 3.000
score PHP_SCRIPT 2.499
score POSTCARD_06 2.399
score PP_MIME_FAKE_ASCII_TEXT 0.999
score RAND_HEADER_LIST_SPOOF 2.999
score RAND_HEADER_MANY 2.999
score RAND_MKTG_HEADER 1.999
-score RATWARE_NO_RDNS 2.762
-score RDNS_NUM_TLD_XM 0.292
-score REPLYTO_EMPTY 1.942
+score RATWARE_NO_RDNS 2.874
+score RDNS_NUM_TLD_XM 1.106
+score REPLYTO_EMPTY 1.940
score REPTO_419_FRAUD_GM 2.999
score SCC_BODY_URI_ONLY 2.899
-score SCC_ISEMM_LID_1 1.898
+score SCC_ISEMM_LID_1 2.123
score SCRIPT_GIBBERISH 2.799
score SENDGRID_REDIR 0.491
-score SERGIO_SUBJECT_VIAGRA01 4.299
+score SERGIO_SUBJECT_VIAGRA01 4.291
score SHOPIFY_IMG_NOT_RCVD_SFY 2.499
-score SHORTENED_URL_SRC 2.243
+score SHORTENED_URL_SRC 2.045
score SHORTENER_SHORT_IMG 0.001
-score SHORT_IMG_SUSP_NTLD 0.761
+score SHORT_IMG_SUSP_NTLD 0.692
score SHORT_SHORTNER 1.999
score STATIC_XPRIO_OLE 0.001
-score SUBJ_ATTENTION 0.500
-score SUSP_UTF8_WORD_COMBO 2.389
+score SUBJ_ATTENTION 0.499
+score SUSP_UTF8_WORD_COMBO 2.400
score SUSP_UTF8_WORD_SUBJ 0.599
score THIS_AD 1.299
-score THIS_IS_ADV_SUSP_NTLD 1.034
-score TO_EQ_FM_DIRECT_MX 0.001
+score THIS_IS_ADV_SUSP_NTLD 0.462
+score TO_EQ_FM_DIRECT_MX 0.001 # force non-zero
score TO_IN_SUBJ 0.099
-score TO_NAME_SUBJ_NO_RDNS 2.999
+score TO_NAME_SUBJ_NO_RDNS 2.685
score TO_NO_BRKTS_FROM_MSSP 2.499
-score TO_NO_BRKTS_HTML_IMG 2.000
+score TO_NO_BRKTS_HTML_IMG 1.999
score TO_NO_BRKTS_HTML_ONLY 1.999
score TO_NO_BRKTS_NORDNS_HTML 1.999
-score TO_NO_BRKTS_PCNT 2.126
-score TVD_RCVD_SPACE_BRACKET 2.699
+score TO_NO_BRKTS_PCNT 1.733
+score TVD_RCVD_SPACE_BRACKET 1.878
score UNDISC_FREEM 3.799
score UNDISC_MONEY 3.799
score UNICODE_OBFU_ASC 2.499
score UNSUB_GOOG_FORM 2.499
-score URI_AZURE_CLOUDAPP 2.749
+score URI_AZURE_CLOUDAPP 1.343
score URI_DOTEDU 0.001
score URI_FIREBASEAPP 2.999
score URI_GOOGLE_PROXY 2.599
@@ -219,13 +219,13 @@ score URI_GOOG_STO_SPAMMY 2.9
score URI_IN_URI_10 3.499
score URI_PHISH 3.999
score URI_PHP_REDIR 3.499
-score URI_TRY_3LD 1.999
+score URI_TRY_3LD 2.000
score URI_WPADMIN 1.999
score URI_WP_HACKED_2 2.499
-score VFY_ACCT_NORDNS 2.744
-score WORD_INVIS 1.996
+score VFY_ACCT_NORDNS 2.977
+score WORD_INVIS 1.990
score WORD_INVIS_MANY 2.999
-score XFER_LOTSA_MONEY 1.000
+score XFER_LOTSA_MONEY 0.999
score XM_LIGHT_HEAVY 2.499
score XM_RANDOM 2.499
score XM_RECPTID 2.999
@@ -289,7 +289,6 @@ score GOOGLE_DOCS_PHISH_MANY 1.0
score GOOGLE_DOC_SUSP 1.000
score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000
score GOOG_MALWARE_DNLD 1.000
-score HDRS_LCASE 0.100
score HDRS_LCASE_IMGONLY 0.100
score HEXHASH_WORD 1.000
score HK_CTE_RAW 1.000
@@ -309,7 +308,6 @@ score LIST_PRTL_SAME_USER 1.0
score LUCRATIVE 1.000
score MALF_HTML_B64 1.000
score MALWARE_PASSWORD 1.000
-score MANY_HDRS_LCASE 0.100
score MIME_NO_TEXT 1.000
score MONERO_DEADLINE 1.000
score MONERO_EXTORT_01 1.000
@@ -360,8 +358,6 @@ score TARINGANET_IMG_NOT_RCVD_TN 1.0
score TONLINE_FAKE_DKIM 1.000
score TO_NO_BRKTS_MSFT 1.000
score TUMBLR_IMG_NOT_RCVD_TUMB 1.000
-score TVD_SPACE_ENCODED 1.000
-score TVD_SPACE_RATIO_MINFP 1.000
score TW_GIBBERISH_MANY 1.000
score UC_GIBBERISH_OBFU 1.000
score UNICODE_OBFU_ZW 1.000
Modified: spamassassin/trunk/rulesrc/scores/scores-set3
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/scores/scores-set3?rev=1898640&r1=1898639&r2=1898640&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/scores/scores-set3 (original)
+++ spamassassin/trunk/rulesrc/scores/scores-set3 Sun Mar 6 02:45:40 2022
@@ -1,250 +1,269 @@
-# Using score set 1 logs for revision 1898439 from:
-# ham-net-darxus.r1898439.log ham-net-ena-week0.r1898439.log ham-net-ena-week1.r1898439.log ham-net-ena-week2.r1898439.log ham-net-ena-week3.r1898439.log ham-net-ena-week4.r1898439.log ham-net-giovanni-ham.r1898439.log ham-net-giovanni-spammy.r1898439.log ham-net-giovanni-spam.r1898439.log ham-net-grenier.r1898439.log ham-net-hege.r1898439.log ham-net-jhardin.r1898439.log ham-net-llanga.r1898439.log ham-net-mmiroslaw-mails-ham.r1898439.log ham-net-mmiroslaw-mails-spam.r1898439.log ham-net-pds.r1898439.log ham-net-spamsponge.r1898439.log ham-net-thendrikx.r1898439.log spam-net-darxus.r1898439.log spam-net-ena-week0.r1898439.log spam-net-ena-week1.r1898439.log spam-net-ena-week2.r1898439.log spam-net-ena-week3.r1898439.log spam-net-ena-week4.r1898439.log spam-net-giovanni-ham.r1898439.log spam-net-giovanni-spammy.r1898439.log spam-net-giovanni-spam.r1898439.log spam-net-grenier.r1898439.log spam-net-hege.r1898439.log spam-net-jhardin.r1898439.log spam-net-llanga.r1898439.log spam-net-
mmiroslaw-mails-ham.r1898439.log spam-net-mmiroslaw-mails-spam.r1898439.log spam-net-pds.r1898439.log spam-net-spamsponge.r1898439.log spam-net-thendrikx.r1898439.log
+# Using score set 1 logs for revision 1898619 from:
+# ham-net-darxus.r1898619.log ham-net-ena-week0.r1898619.log ham-net-ena-week1.r1898619.log ham-net-ena-week2.r1898619.log ham-net-ena-week3.r1898619.log ham-net-ena-week4.r1898619.log ham-net-giovanni-ham.r1898619.log ham-net-giovanni-spammy.r1898619.log ham-net-giovanni-spam.r1898619.log ham-net-grenier.r1898619.log ham-net-hege.r1898619.log ham-net-jhardin.r1898619.log ham-net-llanga.r1898619.log ham-net-mmiroslaw-mails-ham.r1898619.log ham-net-mmiroslaw-mails-spam.r1898619.log ham-net-pds.r1898619.log ham-net-spamsponge.r1898619.log ham-net-thendrikx.r1898619.log spam-net-darxus.r1898619.log spam-net-ena-week0.r1898619.log spam-net-ena-week1.r1898619.log spam-net-ena-week2.r1898619.log spam-net-ena-week3.r1898619.log spam-net-ena-week4.r1898619.log spam-net-giovanni-ham.r1898619.log spam-net-giovanni-spammy.r1898619.log spam-net-giovanni-spam.r1898619.log spam-net-grenier.r1898619.log spam-net-hege.r1898619.log spam-net-jhardin.r1898619.log spam-net-llanga.r1898619.log spam-net-
mmiroslaw-mails-ham.r1898619.log spam-net-mmiroslaw-mails-spam.r1898619.log spam-net-pds.r1898619.log spam-net-spamsponge.r1898619.log spam-net-thendrikx.r1898619.log
-score ACCT_PHISHING_MANY 2.999
+score ACCT_PHISHING_MANY 2.996
score AC_BR_BONANZA 0.001
score AC_DIV_BONANZA 0.001
-score AC_FROM_MANY_DOTS 2.999
-score AC_HTML_NONSENSE_TAGS 1.999
-score AC_SPAMMY_URI_PATTERNS8 1.174
-score ADMITS_SPAM 2.699
-score ADVANCE_FEE_2_NEW_FRM_MNY 2.499
-score ADVANCE_FEE_2_NEW_MONEY 1.999
-score ADVANCE_FEE_3_NEW 0.964
-score ADVANCE_FEE_3_NEW_FRM_MNY 0.539
-score ADVANCE_FEE_3_NEW_MONEY 1.177
-score ADVANCE_FEE_4_NEW 2.052
-score ADVANCE_FEE_4_NEW_FRM_MNY 0.661
-score ADVANCE_FEE_4_NEW_MONEY 0.001
-score ADVANCE_FEE_5_NEW 1.043
-score ADVANCE_FEE_5_NEW_FRM_MNY 0.001 # force non-zero
-score ADVANCE_FEE_5_NEW_MONEY 0.797
-score AD_PREFS 0.123
-score ALIBABA_IMG_NOT_RCVD_ALI 2.499
-score AMAZON_IMG_NOT_RCVD_AMZN 2.499
-score APP_DEVELOPMENT_NORDNS 1.557
-score AXB_XMAILER_MIMEOLE_OL_024C2 0.001
-score BIGNUM_EMAILS_FREEM 2.999
-score BIGNUM_EMAILS_MANY 2.999
-score BITCOIN_DEADLINE 1.587
-score BITCOIN_EXTORT_01 4.427
-score BITCOIN_MALF_HTML 1.525
-score BITCOIN_MALWARE 3.499
-score BITCOIN_SPAM_02 0.830
-score BITCOIN_SPAM_07 1.356
-score BITCOIN_XPRIO 1.527
-score BITCOIN_YOUR_INFO 1.688
-score BODY_EMPTY 0.902
-score BODY_URI_ONLY 0.814
-score BOGUS_MIME_VERSION 2.535
+score AC_FROM_MANY_DOTS 2.996
+score AC_HTML_NONSENSE_TAGS 1.998
+score ADMITS_SPAM 2.896
+score ADVANCE_FEE_2_NEW_FRM_MNY 2.496
+score ADVANCE_FEE_2_NEW_MONEY 1.997
+score ADVANCE_FEE_3_NEW 3.496
+score ADVANCE_FEE_3_NEW_FRM_MNY 0.001
+score ADVANCE_FEE_3_NEW_MONEY 0.410
+score ADVANCE_FEE_4_NEW 2.247
+score ADVANCE_FEE_4_NEW_FRM_MNY 1.836
+score ADVANCE_FEE_4_NEW_MONEY 1.388
+score ADVANCE_FEE_5_NEW 0.914
+score ADVANCE_FEE_5_NEW_FRM_MNY 0.001
+score ADVANCE_FEE_5_NEW_MONEY 1.685
+score AD_PREFS 0.261
+score ALIBABA_IMG_NOT_RCVD_ALI 2.497
+score AMAZON_IMG_NOT_RCVD_AMZN 0.835
+score APP_DEVELOPMENT_NORDNS 1.963
+score AXB_XMAILER_MIMEOLE_OL_024C2 2.542
+score BIGNUM_EMAILS_FREEM 1.550
+score BIGNUM_EMAILS_MANY 2.997
+score BITCOIN_DEADLINE 1.664
+score BITCOIN_EXTORT_01 4.034
+score BITCOIN_MALF_HTML 2.784
+score BITCOIN_OBFU_SUBJ 1.610
+score BITCOIN_SPAM_02 1.631
+score BITCOIN_SPAM_04 1.498
+score BITCOIN_SPAM_07 3.414
+score BITCOIN_XPRIO 1.677
+score BITCOIN_YOUR_INFO 1.889
+score BODY_EMPTY 1.426
+score BODY_URI_ONLY 0.635
+score BOGUS_MIME_VERSION 2.541
+score CANT_SEE_AD 0.215
score CK_HELO_GENERIC 0.001
-score CONTENT_AFTER_HTML 2.499
+score CONTENT_AFTER_HTML 2.497
+score CONTENT_AFTER_HTML_WEAK 1.499
score CTE_8BIT_MISMATCH 0.001
-score DEAR_BENEFICIARY 1.005
-score DKIMWL_BL 2.999
-score DKIMWL_WL_HIGH -0.373
-score DKIMWL_WL_MED -0.499
-score DKIMWL_WL_MEDHI -0.001
-score DX_TEXT_03 1.699
-score END_FUTURE_EMAILS 0.161
-score FAKE_REPLY_A1 1.346
-score FAKE_REPLY_B 2.253
+score DEAR_BENEFICIARY 1.431
+score DKIMWL_BL 2.996
+score DKIMWL_WL_HIGH -0.480
+score DKIMWL_WL_MED -0.001 # force non-zero
+score DKIMWL_WL_MEDHI -0.998
+score END_FUTURE_EMAILS 0.918
+score FAKE_REPLY_A1 2.421
+score FAKE_REPLY_B 2.602
score FILL_THIS_FORM 0.001
score FONT_INVIS_DIRECT 0.001
-score FONT_INVIS_HTML_NOHTML 2.999
-score FONT_INVIS_LONG_LINE 1.927
-score FONT_INVIS_MSGID 1.244
-score FONT_INVIS_NORDNS 0.938
+score FONT_INVIS_HTML_NOHTML 2.997
+score FONT_INVIS_LONG_LINE 1.097
+score FONT_INVIS_MSGID 0.631
+score FONT_INVIS_NORDNS 0.123
score FONT_INVIS_POSTEXTRAS 2.184
-score FORGED_SPF_HELO 1.236
-score FORM_FRAUD 1.000
-score FORM_FRAUD_3 2.499
-score FORM_FRAUD_5 0.001
-score FOUND_YOU 2.790
-score FREEMAIL_FORGED_FROMDOMAIN 0.249
-score FROMSPACE 3.399
-score FROM_2_EMAILS_SHORT 0.055
+score FORGED_SPF_HELO 0.692
+score FORM_FRAUD 0.998
+score FORM_FRAUD_3 1.736
+score FORM_FRAUD_5 0.099
+score FOUND_YOU 2.940
+score FREEMAIL_FORGED_FROMDOMAIN 0.248
+score FROMSPACE 3.197
+score FROM_2_EMAILS_SHORT 2.247
+score FROM_ADDR_WS 2.996
score FROM_BANK_NOAUTH 0.999
-score FROM_FMBLA_NEWDOM 1.499
-score FROM_FMBLA_NEWDOM14 0.999
-score FROM_FMBLA_NEWDOM28 0.799
-score FROM_GOV_DKIM_AU -0.001 # force non-zero
-score FROM_IN_TO_AND_SUBJ 1.699
-score FROM_MISSPACED 0.001
-score FROM_MISSP_EH_MATCH 0.626
+score FROM_FMBLA_NEWDOM 1.498
+score FROM_FMBLA_NEWDOM14 0.998
+score FROM_FMBLA_NEWDOM28 0.798
+score FROM_GOV_DKIM_AU -0.001
+score FROM_IN_TO_AND_SUBJ 2.197
+score FROM_MISSPACED 1.997
+score FROM_MISSP_DYNIP 2.097
+score FROM_MISSP_EH_MATCH 1.997
score FROM_MISSP_FREEMAIL 0.001
-score FROM_MISSP_MSFT 0.001
+score FROM_MISSP_MSFT 3.297
+score FROM_MISSP_PHISH 3.268
score FROM_MISSP_SPF_FAIL 0.001
-score FROM_MISSP_TO_UNDISC 1.176
-score FROM_MISSP_USER 0.001
-score FROM_MULTI_NORDNS 1.894
-score FROM_NTLD_LINKBAIT 1.999
+score FROM_MISSP_TO_UNDISC 2.297
+score FROM_MISSP_USER 2.494
+score FROM_MULTI_NORDNS 1.002
+score FROM_NTLD_LINKBAIT 0.382
score FROM_PAYPAL_SPOOF 0.001
-score FROM_SUSPICIOUS_NTLD 0.500
-score FROM_SUSPICIOUS_NTLD_FP 2.000
-score FROM_WSP_TRAIL 2.400
-score FSL_BULK_SIG 1.998
-score FSL_CTYPE_WIN1251 0.001
-score FSL_NEW_HELO_USER 0.001
-score FUZZY_AMAZON 2.699
-score FUZZY_CLICK_HERE 2.338
-score FUZZY_NORTON 3.099
-score FUZZY_PAYPAL 2.399
-score FUZZY_SECURITY 1.267
-score FUZZY_WALLET 3.199
-score GAPPY_LOW_CONTRAST 2.499
-score GB_FAKE_RF_SHORT 0.595
-score GB_FREEMAIL_DISPTO 0.499
-score GOOG_REDIR_NORDNS 2.999
-score GOOG_STO_EMAIL_PHISH 2.238
-score GOOG_STO_IMG_HTML 2.999
-score GOOG_STO_IMG_NOHTML 2.191
-score GOOG_STO_NOIMG_HTML 2.999
-score HAS_X_OUTGOING_SPAM_STAT 1.794
-score HDRS_MISSP 2.500
-score HDR_ORDER_FTSDMCXX_DIRECT 1.810
-score HDR_ORDER_FTSDMCXX_NORDNS 2.800
+score FROM_SUSPICIOUS_NTLD 0.498
+score FROM_SUSPICIOUS_NTLD_FP 1.773
+score FROM_UNBAL1 2.197
+score FROM_WSP_TRAIL 2.297
+score FSL_BULK_SIG 2.497
+score FSL_CTYPE_WIN1251 1.569
+score FSL_NEW_HELO_USER 1.997
+score FUZZY_AMAZON 2.697
+score FUZZY_CLICK_HERE 2.297
+score FUZZY_WALLET 3.196
+score GAPPY_LOW_CONTRAST 2.278
+score GB_FAKE_RF_SHORT 0.065
+score GB_FREEMAIL_DISPTO 0.305
+score GB_FREEMAIL_DISPTO_NOTFREEM 0.498
+score GOOG_REDIR_HTML_ONLY 1.997
+score GOOG_REDIR_NORDNS 2.996
+score GOOG_STO_EMAIL_PHISH 1.594
+score GOOG_STO_HTML_PHISH 1.163
+score GOOG_STO_HTML_PHISH_MANY 2.766
+score GOOG_STO_IMG_HTML 2.996
+score GOOG_STO_IMG_NOHTML 1.615
+score GOOG_STO_NOIMG_HTML 2.943
+score HAS_X_NO_RELAY 1.402
+score HAS_X_OUTGOING_SPAM_STAT 1.796
+score HDRS_MISSP 1.601
+score HDR_ORDER_FTSDMCXX_DIRECT 1.000
+score HDR_ORDER_FTSDMCXX_NORDNS 3.013
score HEADER_FROM_DIFFERENT_DOMAINS 0.249
score HELO_NO_DOMAIN 0.001
-score HK_LOTTO 0.999
-score HK_NAME_FROM 0.999
-score HK_NAME_MR_MRS 0.001 # force non-zero
-score HK_RANDOM_ENVFROM 0.999
-score HK_RANDOM_FROM 0.999
-score HK_RANDOM_REPLYTO 0.656
+score HK_LOTTO 0.619
+score HK_NAME_FROM 0.998
+score HK_NAME_MR_MRS 0.001
+score HK_RANDOM_ENVFROM 0.998
+score HK_RANDOM_FROM 0.998
+score HK_RANDOM_REPLYTO 0.655
score HK_SCAM 0.001
-score HK_WIN 0.999
-score HOSTED_IMG_DIRECT_MX 1.691
-score HOSTED_IMG_FREEM 3.499
-score HOSTED_IMG_MULTI_PUB_01 2.999
-score HTML_ENTITY_ASCII 1.812
-score HTML_FONT_TINY_NORDNS 0.977
-score HTML_OFF_PAGE 2.999
+score HK_WIN 0.998
+score HOSTED_IMG_DIRECT_MX 2.581
+score HOSTED_IMG_FREEM 3.496
+score HOSTED_IMG_MULTI_PUB_01 2.996
+score HTML_ENTITY_ASCII 1.675
+score HTML_ENTITY_ASCII_TINY 2.996
+score HTML_FONT_TINY_NORDNS 1.005
+score HTML_OFF_PAGE 2.996
score HTML_SINGLET_MANY 0.001
-score HTML_TAG_BALANCE_CENTER 2.597
-score HTML_TEXT_INVISIBLE_FONT 1.999
-score HTML_TEXT_INVISIBLE_STYLE 3.194
-score IMG_ONLY_FM_DOM_INFO 0.482
-score JH_SPAMMY_HEADERS 3.499
-score KHOP_HELO_FCRDNS 0.276
-score LONGLN_LOW_CONTRAST 1.663
-score LONG_HEX_URI 0.512
-score LONG_IMG_URI 1.726
-score LONG_INVISIBLE_TEXT 1.775
+score HTML_TAG_BALANCE_CENTER 2.470
+score HTML_TEXT_INVISIBLE_FONT 1.997
+score HTML_TEXT_INVISIBLE_STYLE 3.032
+score IMG_ONLY_FM_DOM_INFO 0.471
+score JH_SPAMMY_HEADERS 3.496
+score KHOP_HELO_FCRDNS 0.378
+score LONGLN_LOW_CONTRAST 2.497
+score LONG_HEX_URI 0.001 # force non-zero
+score LONG_IMG_URI 2.222
+score LONG_INVISIBLE_TEXT 0.976
score LOTS_OF_MONEY 0.010
-score LOTTO_AGENT 0.174
-score LOTTO_DEPT 1.465
-score MALWARE_NORDNS 1.838
-score MANY_SPAN_IN_TEXT 1.959
-score MILLION_HUNDRED 0.001
-score MIMEOLE_DIRECT_TO_MX 1.737
-score MIXED_AREA_CASE 1.463
-score MIXED_CENTER_CASE 0.921
-score MIXED_CTYPE_CASE 2.639
-score MIXED_ES 2.203
-score MIXED_FONT_CASE 2.037
-score MIXED_HREF_CASE 0.622
-score MIXED_IMG_CASE 2.999
-score MONEY_FORM_SHORT 1.119
-score MONEY_FRAUD_3 2.899
-score MONEY_FRAUD_5 0.001
+score LOTTO_AGENT 0.954
+score LOTTO_DEPT 1.116
+score MALWARE_NORDNS 0.826
+score MALW_ATTACH 2.197
+score MANY_SPAN_IN_TEXT 1.310
+score MILLION_HUNDRED 0.358
+score MIMEOLE_DIRECT_TO_MX 1.825
+score MIXED_AREA_CASE 1.097
+score MIXED_CENTER_CASE 2.497
+score MIXED_CTYPE_CASE 1.599
+score MIXED_ES 0.443
+score MIXED_FONT_CASE 2.114
+score MIXED_HREF_CASE 0.657
+score MIXED_IMG_CASE 2.177
+score MONEY_ATM_CARD 0.001 # force non-zero
+score MONEY_FORM 0.001
+score MONEY_FORM_SHORT 0.001
+score MONEY_FRAUD_3 2.896
+score MONEY_FRAUD_5 0.011
score MONEY_FRAUD_8 0.001
-score MONEY_FREEMAIL_REPTO 0.001 # force non-zero
+score MONEY_FREEMAIL_REPTO 0.001
score MONEY_FROM_41 1.999
-score MONEY_FROM_MISSP 1.999
-score MSMAIL_PRI_ABNORMAL 1.219
-score NAME_EMAIL_DIFF 1.754
+score MONEY_FROM_MISSP 1.997
+score MSMAIL_PRI_ABNORMAL 1.256
+score NAME_EMAIL_DIFF 2.107
+score NA_DOLLARS 0.047
score NICE_REPLY_A -0.001
-score NORDNS_LOW_CONTRAST 0.001
+score NORDNS_LOW_CONTRAST 0.699
score NO_FM_NAME_IP_HOSTN 0.001
-score NSL_RCVD_FROM_USER 0.001
-score NSL_RCVD_HELO_USER 1.855
-score OBFU_TEXT_ATTACH 0.779
-score ODD_FREEM_REPTO 1.629
-score PDS_BTC_ID 0.500
-score PDS_BTC_MSGID 0.359
+score NSL_RCVD_FROM_USER 2.560
+score NSL_RCVD_HELO_USER 2.573
+score NUMBEREND_LINKBAIT 0.396
+score OBFU_TEXT_ATTACH 1.498
+score ODD_FREEM_REPTO 1.595
+score PDS_BTC_ID 0.498
+score PDS_BTC_MSGID 0.001
score PDS_DBL_URL_TNB_RUNON 1.999
-score PDS_FRNOM_TODOM_DBL_URL 1.500
-score PDS_FRNOM_TODOM_NAKED_TO 1.499
-score PDS_FROM_2_EMAILS_SHRTNER 0.577
-score PDS_FROM_NAME_TO_DOMAIN 1.493
-score PDS_HP_HELO_NORDNS 1.000
-score PDS_OTHER_BAD_TLD 2.000
-score PDS_PHPEXP_BOT 1.499
-score PDS_PHP_EVAL 0.733
+score PDS_FRNOM_TODOM_DBL_URL 0.001
+score PDS_FRNOM_TODOM_NAKED_TO 1.369
+score PDS_FROM_2_EMAILS 0.275
+score PDS_FROM_2_EMAILS_SHRTNER 0.378
+score PDS_FROM_NAME_TO_DOMAIN 1.565
+score PDS_HP_HELO_NORDNS 0.998
+score PDS_OTHER_BAD_TLD 1.997
+score PDS_PHPEXP_BOT 1.498
+score PDS_PHP_EVAL 1.498
score PDS_RDNS_DYNAMIC_FP 0.001 # force non-zero
-score PDS_SHORTFWD_URISHRT_FP 1.113
-score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 2.000
-score PDS_TO_EQ_FROM_NAME 2.391
-score PHISH_FBASEAPP 2.505
-score PHP_ORIG_SCRIPT 2.499
-score PHP_ORIG_SCRIPT_EVAL 2.463
-score PHP_SCRIPT 0.532
-score POSTCARD_06 2.299
-score PP_MIME_FAKE_ASCII_TEXT 1.000
-score RAND_HEADER_LIST_SPOOF 2.996
-score RAND_HEADER_MANY 2.864
-score RAND_MKTG_HEADER 1.497
-score RATWARE_NO_RDNS 2.999
+score PDS_SHORTFWD_URISHRT_FP 0.693
+score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.997
+score PDS_TO_EQ_FROM_NAME 2.684
+score PHISH_FBASEAPP 1.382
+score PHP_ORIG_SCRIPT 2.497
+score PHP_ORIG_SCRIPT_EVAL 2.996
+score PHP_SCRIPT 0.091
+score POSTCARD_06 2.197
+score PP_MIME_FAKE_ASCII_TEXT 0.998
+score RAND_HEADER_LIST_SPOOF 2.993
+score RAND_HEADER_MANY 2.190
+score RAND_MKTG_HEADER 1.496
+score RATWARE_NO_RDNS 2.996
score RCVD_IN_MSPIKE_H2 -0.001
-score RDNS_NUM_TLD_XM 0.150
-score REPLYTO_EMPTY 2.999
-score REPTO_419_FRAUD_GM 0.001
-score SCC_BODY_URI_ONLY 0.692
-score SCC_ISEMM_LID_1 1.150
-score SCRIPT_GIBBERISH 2.599
-score SENDGRID_REDIR 0.272
-score SERGIO_SUBJECT_VIAGRA01 4.300
-score SHOPIFY_IMG_NOT_RCVD_SFY 2.499
-score SHORTENED_URL_SRC 0.424
-score SHORTENER_SHORT_IMG 1.975
-score SHORT_SHORTNER 1.999
-score SPOOFED_FREEMAIL 1.000
+score RDNS_NUM_TLD_XM 0.924
+score REPLYTO_EMPTY 2.796
+score REPTO_419_FRAUD_GM 2.996
+score SCC_BODY_URI_ONLY 0.712
+score SCC_ISEMM_LID_1 1.432
+score SCRIPT_GIBBERISH 2.596
+score SENDGRID_REDIR 0.001
+score SERGIO_SUBJECT_VIAGRA01 4.195
+score SHOPIFY_IMG_NOT_RCVD_SFY 2.497
+score SHORTENED_URL_SRC 2.064
+score SHORTENER_SHORT_IMG 1.651
+score SHORT_SHORTNER 1.997
+score SPOOFED_FREEMAIL 1.767
score SPOOFED_FREEMAIL_NO_RDNS 0.001
-score SPOOFED_FREEM_REPTO 2.191
-score SPOOF_GMAIL_MID 1.446
-score STATIC_XPRIO_OLE 0.001
-score SUSP_UTF8_WORD_COMBO 2.999
-score SUSP_UTF8_WORD_SUBJ 0.001 # force non-zero
-score THIS_AD 1.199
+score SPOOFED_FREEM_REPTO 2.497
+score SPOOF_GMAIL_MID 0.577
+score STATIC_XPRIO_OLE 1.862
+score SUBJ_ATTENTION 0.499
+score SUSP_UTF8_WORD_COMBO 2.997
+score SUSP_UTF8_WORD_SUBJ 0.001
+score THIS_AD 1.198
score TO_EQ_FM_DIRECT_MX 0.001
-score TO_EQ_FM_DOM_SPF_FAIL 0.026
+score TO_EQ_FM_DOM_HTML_IMG 2.397
+score TO_EQ_FM_DOM_HTML_ONLY 0.001
+score TO_EQ_FM_DOM_SPF_FAIL 0.001
+score TO_EQ_FM_HTML_ONLY 1.504
score TO_EQ_FM_SPF_FAIL 0.001
-score TO_IN_SUBJ 0.099
-score TO_NAME_SUBJ_NO_RDNS 2.952
-score TO_NO_BRKTS_FROM_MSSP 1.187
-score TO_NO_BRKTS_HTML_IMG 1.268
-score TO_NO_BRKTS_HTML_ONLY 2.000
-score TO_NO_BRKTS_MSFT 0.001 # force non-zero
+score TO_IN_SUBJ 0.098
+score TO_NAME_SUBJ_NO_RDNS 2.683
+score TO_NO_BRKTS_FROM_MSSP 2.497
+score TO_NO_BRKTS_HTML_IMG 1.087
+score TO_NO_BRKTS_HTML_ONLY 1.997
+score TO_NO_BRKTS_MSFT 2.499
score TO_NO_BRKTS_NORDNS_HTML 0.001
-score TO_NO_BRKTS_PCNT 2.499
-score TVD_RCVD_SPACE_BRACKET 1.840
-score TVD_SPACE_RATIO_MINFP 0.623
-score UNDISC_FREEM 3.599
-score UNDISC_MONEY 3.599
-score UNICODE_OBFU_ASC 2.499
-score UNSUB_GOOG_FORM 2.499
-score URI_AZURE_CLOUDAPP 1.514
-score URI_DOTEDU 2.000
-score URI_FIREBASEAPP 3.000
-score URI_GOOGLE_PROXY 2.499
-score URI_GOOG_STO_SPAMMY 2.621
-score URI_IN_URI_10 3.599
-score URI_ONLY_MSGID_MALF 1.999
-score URI_PHISH 3.631
-score URI_PHP_REDIR 3.499
-score URI_TRY_3LD 1.999
-score URI_WPADMIN 1.999
-score URI_WP_HACKED 3.499
-score URI_WP_HACKED_2 1.398
-score VFY_ACCT_NORDNS 2.347
-score WORD_INVIS 0.001
+score TO_NO_BRKTS_PCNT 2.497
+score TVD_PH_BODY_META 2.696
+score TVD_RCVD_SPACE_BRACKET 2.497
+score UNDISC_FREEM 3.595
+score UNDISC_MONEY 3.595
+score UNICODE_OBFU_ASC 2.497
+score UNSUB_GOOG_FORM 2.497
+score URI_AZURE_CLOUDAPP 2.300
+score URI_DOTEDU 1.997
+score URI_FIREBASEAPP 2.996
+score URI_GOOGLE_PROXY 2.497
+score URI_GOOG_STO_SPAMMY 2.999
+score URI_IN_URI_10 3.296
+score URI_ONLY_MSGID_MALF 0.001
+score URI_PHISH 3.623
+score URI_PHP_REDIR 2.792
+score URI_TRY_3LD 1.997
+score URI_WPADMIN 1.897
+score URI_WP_HACKED 3.496
+score URI_WP_HACKED_2 1.249
+score VFY_ACCT_NORDNS 2.999
+score WORD_INVIS 0.594
+score WORD_INVIS_MANY 2.996
score XFER_LOTSA_MONEY 0.999
-score XM_LIGHT_HEAVY 2.499
-score XM_RANDOM 2.499
-score XM_RECPTID 2.999
-score XPRIO 2.175
-score YOU_INHERIT 2.046
+score XM_LIGHT_HEAVY 2.497
+score XM_RANDOM 1.910
+score XM_RECPTID 2.996
+score XPRIO 1.928
+score YOU_INHERIT 2.411
score AC_POST_EXTRAS 1.000
score AC_SPAMMY_URI_PATTERNS1 1.000
score AC_SPAMMY_URI_PATTERNS10 1.000
@@ -253,6 +272,7 @@ score AC_SPAMMY_URI_PATTERNS12 1.0
score AC_SPAMMY_URI_PATTERNS2 1.000
score AC_SPAMMY_URI_PATTERNS3 1.000
score AC_SPAMMY_URI_PATTERNS4 1.000
+score AC_SPAMMY_URI_PATTERNS8 1.000
score AC_SPAMMY_URI_PATTERNS9 1.000
score ADULT_DATING_COMPANY 10.001 # force non-zero
score ADVANCE_FEE_2_NEW_FORM 1.000
@@ -261,12 +281,11 @@ score BEBEE_IMG_NOT_RCVD_BB 1.0
score BITCOIN_BOMB 1.000
score BITCOIN_EXTORT_02 1.000
score BITCOIN_IMGUR 1.000
-score BITCOIN_OBFU_SUBJ 1.000
+score BITCOIN_MALWARE 1.000
score BITCOIN_ONAN 1.000
score BITCOIN_PAY_ME 1.000
score BITCOIN_SPAM_01 1.000
score BITCOIN_SPAM_03 1.000
-score BITCOIN_SPAM_04 1.000
score BITCOIN_SPAM_05 1.000
score BITCOIN_SPAM_06 1.000
score BITCOIN_SPAM_08 1.000
@@ -280,9 +299,7 @@ score BOMB_FREEM 1.0
score BOMB_MONEY 1.000
score BTC_ORG 1.000
score BULK_RE_SUSP_NTLD 1.000
-score CANT_SEE_AD 1.000
score COMMENT_GIBBERISH 1.000
-score CONTENT_AFTER_HTML_WEAK 1.000
score DAY_I_EARNED 1.000
score DKIMWL_BLOCKED 0.001
score DOTGOV_IMAGE 1.000
@@ -296,34 +313,27 @@ score FBI_SPOOF 1.0
score FONT_INVIS_DOTGOV 1.000
score FREEM_FRNUM_UNICD_EMPTY 1.000
score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000
-score FROM_ADDR_WS 1.000
score FROM_FMBLA_NDBLOCKED 0.001
score FROM_GOV_REPLYTO_FREEMAIL 1.000
score FROM_GOV_SPOOF 1.000
-score FROM_MISSP_PHISH 1.000
score FROM_NEWDOM_BTC 1.000
score FROM_NTLD_REPLY_FREEMAIL 1.000
score FROM_NUMBERO_NEWDOMAIN 1.000
score FROM_NUMERIC_TLD 1.000
score GAPPY_SALES_LEADS_FREEM 1.000
score GB_FORGED_MUA_POSTFIX 1.000
-score GB_FREEMAIL_DISPTO_NOTFREEM 0.500
score GB_GOOGLE_OBFUR 0.750
score GOOGLE_DOCS_PHISH 1.000
score GOOGLE_DOCS_PHISH_MANY 1.000
score GOOGLE_DOC_SUSP 1.000
score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000
score GOOG_MALWARE_DNLD 1.000
-score GOOG_STO_HTML_PHISH 1.000
-score GOOG_STO_HTML_PHISH_MANY 1.000
-score HAS_X_NO_RELAY 1.000
score HDRS_LCASE_IMGONLY 0.100
score HEXHASH_WORD 1.000
score HK_CTE_RAW 1.000
score HK_RCVD_IP_MULTICAST 1.000
score HOSTED_IMG_DQ_UNSUB 1.000
score HOSTED_IMG_MULTI 1.000
-score HTML_ENTITY_ASCII_TINY 1.000
score HTML_SHRT_CMNT_OBFU_MANY 1.000
score JH_SPAMMY_PATTERN01 1.000
score JH_SPAMMY_PATTERN02 1.000
@@ -333,7 +343,6 @@ score LIST_PRTL_SAME_USER 1.0
score LUCRATIVE 1.000
score MALF_HTML_B64 1.000
score MALWARE_PASSWORD 1.000
-score MANY_HDRS_LCASE 0.100
score MIME_NO_TEXT 1.000
score MONERO_DEADLINE 1.000
score MONERO_EXTORT_01 1.000
@@ -346,6 +355,7 @@ score NEWEGG_IMG_NOT_RCVD_NEGG 1.0
score NEW_PRODUCTS 1.000
score OBFU_BITCOIN 1.000
score PDS_HELO_SPF_FAIL 1.000
+score PDS_PHP_RUNTIME_FUNC 1.000
score PHISH_AZURE_CLOUDAPP 3.500
score PHOTO_EDITING_DIRECT 1.000
score PHOTO_EDITING_FREEM 1.000
@@ -378,6 +388,7 @@ score SPOOFED_FREEM_REPTO_CHN 1.0
score SPOOFED_FREEM_REPTO_RUS 1.000
score STOCK_TIP 1.000
score SUBJ_BRKN_WORDNUMS 1.000
+score SUSPNTLD_EXPIRATION_EXTORT 1.000
score SYSADMIN 1.000
score TAGSTAT_IMG_NOT_RCVD_TGST 1.000
score TARINGANET_IMG_NOT_RCVD_TN 1.000
@@ -400,6 +411,5 @@ score URI_WP_DIRINDEX 1.0
score USB_DRIVES 1.000
score VPS_NO_NTLD 1.000
score WALMART_IMG_NOT_RCVD_WAL 1.000
-score WORD_INVIS_MANY 1.000
score XM_DIGITS_ONLY 1.000
score XPRIO_SHORT_SUBJ 1.000
Modified: spamassassin/trunk/rulesrc/scores/stats-set0
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/scores/stats-set0?rev=1898640&r1=1898639&r2=1898640&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/scores/stats-set0 (original)
+++ spamassassin/trunk/rulesrc/scores/stats-set0 Sun Mar 6 02:45:40 2022
@@ -1,12 +1,12 @@
##### WITH NEW RULES AND SCORES #####
# SUMMARY for threshold 5.0:
-# Correctly non-spam: 188542 43.693% (99.610% of non-spam corpus)
-# Correctly spam: 174347 40.404% (71.976% of spam corpus)
-# False positives: 738 0.171% (0.390% of nonspam, 28386 weighted)
-# False negatives: 67884 15.732% (28.024% of spam, 111232 weighted)
-# Average score for spam: 11.4 nonspam: 0.6
-# Average for false-pos: 6.0 false-neg: 1.6
+# Correctly non-spam: 188552 43.696% (99.615% of non-spam corpus)
+# Correctly spam: 172800 40.045% (71.337% of spam corpus)
+# False positives: 728 0.169% (0.385% of nonspam, 28062 weighted)
+# False negatives: 69431 16.090% (28.663% of spam, 118965 weighted)
+# Average score for spam: 11.5 nonspam: 0.6
+# Average for false-pos: 6.0 false-neg: 1.7
# TOTAL: 431511 100.00%
Reading scores from "tmprules"...
@@ -14,10 +14,10 @@ Reading per-message hit stat logs and sc
# SUMMARY for threshold 5.0:
# Correctly non-spam: 23662 99.62%
-# Correctly spam: 21406 70.62%
+# Correctly spam: 21404 70.61%
# False positives: 91 0.38%
-# False negatives: 8905 29.38%
-# TCR(l=50): 2.252768 SpamRecall: 70.621% SpamPrec: 99.577%
+# False negatives: 8907 29.39%
+# TCR(l=50): 2.252434 SpamRecall: 70.615% SpamPrec: 99.577%
##### WITHOUT NEW RULES AND SCORES #####
Reading scores from "../rules-base"...
Modified: spamassassin/trunk/rulesrc/scores/stats-set1
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/scores/stats-set1?rev=1898640&r1=1898639&r2=1898640&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/scores/stats-set1 (original)
+++ spamassassin/trunk/rulesrc/scores/stats-set1 Sun Mar 6 02:45:40 2022
@@ -1,40 +1,40 @@
##### WITH NEW RULES AND SCORES #####
# SUMMARY for threshold 5.0:
-# Correctly non-spam: 275367 48.258% (99.486% of non-spam corpus)
-# Correctly spam: 264359 46.329% (89.972% of spam corpus)
-# False positives: 1424 0.250% (0.514% of nonspam, 105949 weighted)
-# False negatives: 29466 5.164% (10.028% of spam, 54961 weighted)
-# Average score for spam: 18.9 nonspam: -0.8
-# Average for false-pos: 7.0 false-neg: 1.9
-# TOTAL: 570616 100.00%
+# Correctly non-spam: 190081 43.722% (99.570% of non-spam corpus)
+# Correctly spam: 217173 49.953% (89.060% of spam corpus)
+# False positives: 821 0.189% (0.430% of nonspam, 67281 weighted)
+# False negatives: 26676 6.136% (10.940% of spam, 55689 weighted)
+# Average score for spam: 18.5 nonspam: -1.2
+# Average for false-pos: 6.4 false-neg: 2.1
+# TOTAL: 434751 100.00%
Reading scores from "tmprules"...
Reading per-message hit stat logs and scores...
# SUMMARY for threshold 5.0:
-# Correctly non-spam: 34430 99.45%
-# Correctly spam: 32888 89.64%
-# False positives: 190 0.55%
-# False negatives: 3801 10.36%
-# TCR(l=50): 2.758364 SpamRecall: 89.640% SpamPrec: 99.426%
+# Correctly non-spam: 23858 99.60%
+# Correctly spam: 27170 89.12%
+# False positives: 96 0.40%
+# False negatives: 3318 10.88%
+# TCR(l=50): 3.755605 SpamRecall: 89.117% SpamPrec: 99.648%
##### WITHOUT NEW RULES AND SCORES #####
Reading scores from "../rules-base"...
Reading per-message hit stat logs and scores...
# SUMMARY for threshold 5.0:
-# Correctly non-spam: 276192 99.78%
-# Correctly spam: 217031 73.86%
-# False positives: 599 0.22%
-# False negatives: 76794 26.14%
-# TCR(l=50): 2.752614 SpamRecall: 73.864% SpamPrec: 99.725%
+# Correctly non-spam: 190387 99.73%
+# Correctly spam: 171520 70.34%
+# False positives: 515 0.27%
+# False negatives: 72329 29.66%
+# TCR(l=50): 2.486251 SpamRecall: 70.339% SpamPrec: 99.701%
Reading scores from "../rules-base"...
Reading per-message hit stat logs and scores...
# SUMMARY for threshold 5.0:
-# Correctly non-spam: 34534 99.75%
-# Correctly spam: 27083 73.82%
-# False positives: 86 0.25%
-# False negatives: 9606 26.18%
-# TCR(l=50): 2.638358 SpamRecall: 73.818% SpamPrec: 99.683%
+# Correctly non-spam: 23890 99.73%
+# Correctly spam: 21467 70.41%
+# False positives: 64 0.27%
+# False negatives: 9021 29.59%
+# TCR(l=50): 2.494722 SpamRecall: 70.411% SpamPrec: 99.703%