# Please don't modify this file as your changes will be overwritten with # the next update. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # ########################################################################### # 2006/03/13 # 0.176 0.2222 0.0000 1.000 0.67 1.00 DEAR_WINNER body DEAR_WINNER /\bdear.{1,20}winner/i # 2006/03/13 # 0.233 0.2935 0.0000 1.000 0.70 1.00 DRUGS_HDIA header DRUGS_HDIA Subject =~ /\bhoodia\b/i # 2006/03/13 # 0.609 0.7682 0.0011 0.999 0.81 1.00 HS_EXTRA uri HS_EXTRA m'/extra(?:$|[/\#?])' describe HS_EXTRA Link contains common spam pattern: '/extra/' # 2006/03/13 # 0.737 0.9309 0.0000 1.000 0.82 1.00 HS_GETMEOFF uri HS_GETMEOFF m'/get(?:me)?off\.php(?:$|[\#?])' describe HS_GETMEOFF Links to common unsubscribe script: 'getmeoff.php' # 2006/03/13 # 0.261 0.3299 0.0000 1.000 0.71 1.00 HS_SUBJ_ONLINE_PHARMACEUTICAL header HS_SUBJ_ONLINE_PHARMACEUTICAL Subject =~ /\bOnline Pharmaceutical/i describe HS_SUBJ_ONLINE_PHARMACEUTICAL Subject contains the phrase 'Online pharmaceutical' # 2006/03/13 # 1.112 1.4041 0.0000 1.000 0.86 1.00 KAM_STOCKOTC # was: /(OTC|OTCBB|OTC Pink Sheets):/is body KAM_STOCKOTC /OTC(?:BB| Pink Sheets)?:/i # 2006/03/13 # 0.500 0.6316 0.0011 0.998 0.79 1.00 SUBJ_RE_NUM meta SUBJ_RE_NUM !__THEBAT_MUA && __SUBJ_RE_NUM describe SUBJ_RE_NUM Subject is faking 'The Bat!' responses header __SUBJ_RE_NUM Subject =~ /^\s*Re\[\d+\]:/i # 2006/03/13 # 1.648 2.0784 0.0077 0.996 0.88 1.00 TVD_ACT_193 body TVD_ACT_193 /\bact of (?:193|nineteen thirty)/i # 2006/03/13 # 0.316 0.3996 0.0000 1.000 0.73 1.00 TVD_DEAR_HOMEOWNER body TVD_DEAR_HOMEOWNER /^dear homeowner/i # 2006/03/13 # 0.139 0.1757 0.0011 0.994 0.65 1.00 TVD_DOLLARS_US body TVD_DOLLARS_US /\s\d[\d.,]+US/ # 2006/03/13 # 0.122 0.1543 0.0000 1.000 0.64 1.00 TVD_EB_PHISH header __FROM_EBAY From:addr =~ /\@ebay\.com$/i meta TVD_EB_PHISH __FROM_EBAY && NORMAL_HTTP_TO_IP # 2006/03/13 # 0.091 0.1144 0.0011 0.990 0.61 1.00 TVD_HEAD_EDITION header TVD_HEAD_EDITION exists:X-Edition # 2006/03/13 # 0.091 0.1144 0.0000 1.000 0.61 1.00 TVD_HEAD_USR header TVD_HEAD_USR exists:X-Usr # 2006/03/13 # 0.327 0.4134 0.0000 1.000 0.74 1.00 TVD_INCREASE_SIZE body TVD_INCREASE_SIZE /\bsize of .{1,20}(?:penis|dick|manhood)/i # 2006/03/13 # 0.107 0.1349 0.0000 1.000 0.63 1.00 TVD_NOT_SATISFIED body TVD_NOT_SATISFIED /not satisfied .{1,32}(?:lover|size)/i # 2006/03/13 # 0.810 1.0225 0.0000 1.000 0.83 1.00 TVD_SECTION body TVD_SECTION /\bSection (?:27A|21B)/i # 2006/03/13 # 0.222 0.2797 0.0022 0.992 0.69 1.00 TVD_SUBJ_ACC_NUM header TVD_SUBJ_ACC_NUM Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/ describe TVD_SUBJ_ACC_NUM Subject has spammy looking monetary reference # 2006/03/13 # 0.094 0.1190 0.0000 1.000 0.62 1.00 TVD_SUBJ_APPR_LOAN header TVD_SUBJ_APPR_LOAN Subject =~ /approved? .{0,20}loan/i # 2006/03/13 # 0.317 0.4004 0.0000 1.000 0.73 1.00 TVD_SUBJ_OWE header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i # 2006/03/13 # 0.106 0.1341 0.0000 1.000 0.63 1.00 TVD_SUBJ_WIPE_DEBT header TVD_SUBJ_WIPE_DEBT Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i # 2006/03/13 # 0.199 0.2505 0.0022 0.991 0.68 1.00 TVD_UNDER_VALUED body TVD_UNDER_VALUED /(?:company|stock) .{1,20}under-?valued/i # 2006/03/13 # 0.236 0.2976 0.0000 1.000 0.70 1.00 VERTICAL_DRUGS_1 body VERTICAL_DRUGS_1 /(?!A A A A A|V V V V V|C C C C C|X X X X X|P P P P P)(?:[AVCXVP] ){4}[AVCXP]/ describe VERTICAL_DRUGS_1 Looks like drug names spelled vertically # 2006/03/13 # 2.036 2.5693 0.0022 0.999 0.90 0.01 NULL_IN_BODY full NULL_IN_BODY /\x00/ describe NULL_IN_BODY Message has NUL (ASCII 0) byte in message # 2006/03/19 # 0.095 0.1199 0.0000 1.000 0.62 0.01 T_TVD_UA_FOSTERING header TVD_UA_FOSTERING User-Agent =~ /^fostering/i describe TVD_UA_FOSTERING User-Agent header includes spam indication # 2006/03/23 - updated 2006/05/17 # 1.941 2.3331 0.0000 1.000 0.92 0.01 TVD_SINGLE_SPAN_DIV rawbody TVD_SINGLE_SPAN_DIV />\s+[a-zA-Z]\s+<\/(?:span|div)\b/i describe TVD_SINGLE_SPAN_DIV Message has questionable span tags # 2006/04/09 # 0.091 0.1107 0.0000 1.000 0.59 1.00 TVD_FINGER_01 meta TVD_FINGER_01 __TVD_HAPPY_WITH || __TVD_GOT_UR || __TVD_VISIT_SITE body __TVD_HAPPY_WITH /\b(?:satisfied|glad|complaining|happy|content) with (?:ur?|your (?:thing|unit))\b/i body __TVD_GOT_UR /\bgot ur (?:msg|message|email)/i body __TVD_VISIT_SITE /\bvisit (?:this site|here),? www\./i describe TVD_FINGER_01 Message talking about how size matters # 2006/04/09 # 0.137 0.1672 0.0000 1.000 0.63 0.01 TVD_SUBJ_FINGER_03 header TVD_SUBJ_FINGER_03 Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/ describe TVD_SUBJ_FINGER_03 Subject looks like a standard spam format # 2006/06/21 # 1.117 1.3253 0.0000 1.000 0.87 0.01 TVD_STOCK1-new # 0.316 0.3751 0.0000 1.000 0.74 1.00 TVD_STOCK1-old # 2006/04/11 # 0.587 0.7180 0.0000 1.000 0.80 0.01 TVD_STOCK1 body TVD_STOCK1 /(^Trad(?:e|ing) Date|Company(?: Name)?|S\W?t\W?o\W?c\W?k|S\W?Y\W?M\W?B\W?O\W?L|Ticker|(?:opening|Current)\WP(?:rice)?|position|expectations|weeks? high|market performance|recommendation|(?:year|week|month|day|price) (?:projected|target|estimates?))\s*:.{1,60}(?!\1)(?:\w+\s+Name|S\W?t\W?o\W?c\W?k|S\W?Y\W?M\W?B\W?O\W?L|Ticker|(?:opening|Current)\WP(?:rice)?|position|expectations|weeks? high|market performance|recommendation|(?:year|week|month|day|price) (?:projected|target|estimates?))\s*:/i describe TVD_STOCK1 Message looks like it's pushing a stock... # 2006/04/28 # 0.617 0.7485 0.0000 1.000 0.82 1.00 TVD_VIS_HIDDEN rawbody TVD_VIS_HIDDEN /]+style\s*=\s*"visibility:\s*hidden\b/i describe TVD_VIS_HIDDEN HTML has a hidden textarea # 2006/04/28 # 0.200 0.2427 0.0000 1.000 0.68 1.00 TVD_SPACED_SUBJECT_WORD header TVD_SPACED_SUBJECT_WORD Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/ describe TVD_SPACED_SUBJECT_WORD Subject has spammy looking subject # 2006/04/28 # 0.248 0.3005 0.0000 1.000 0.71 1.00 TVD_SPACED_WORDS body TVD_SPACED_WORDS /^(?:[A-Z]\s)+[a-z]\s(?:[A-Z]\s)+$/ describe TVD_SPACED_WORDS Message has spammy-looking obfuscation # 2006/04/28 # 0.189 0.2296 0.0000 1.000 0.67 1.00 TVD_PH_SUBJ_URGENT header TVD_PH_SUBJ_URGENT Subject =~ /^urgent(?:[\s\W]*$|.{1,40}(?:alert|response|assistance|proposal|reply|warning|noti(?:ce|fication)|greeting|matter))/i describe TVD_PH_SUBJ_URGENT Subject looks like a phish # 2006/05/05 # 1.150 1.3983 0.0000 1.000 0.87 0.01 T_TVD_FLOAT_GENERAL4 rawbody TVD_FLOAT_GENERAL /\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s* 3.001003 ) body MULTIPART_ALT_NON_TEXT eval:check_ma_non_text() score MULTIPART_ALT_NON_TEXT 2.0 endif # 2006/08/01 # 2006/08/02 - results updated from nightly run # 0.760 0.9209 0.0037 0.996 0.84 0.01 T_TVD_FW_GRAPHIC_ID3 uri __TVD_INT_CID /^cid:/i meta TVD_FW_GRAPHIC_ID3 __TVD_OUTLOOK_IMG && __TVD_INT_CID && !__UNUSABLE_MSGID && ! (__OE_MSGID_2 || __IMS_MSGID ) header RCVD_FORGED_WROTE Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/ describe RCVD_FORGED_WROTE Forged 'Received' header found ('wrote:' spam) header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/ header __MAILER_OL_5510 X-Mailer =~ /^Microsoft Office Outlook, Build 11.0.5510$/ meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510) describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510) # Suresh: 'Finding "mail.com", "post.com" etc in a received header is ALWAYS bogus' header RCVD_MAIL_COM Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is describe RCVD_MAIL_COM Forged Received header (contains post.com or mail.com) header OUTLOOK_3416 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.3416$/ describe OUTLOOK_3416 Claims to be sent by an unusual build of Outlook (3416) # this seems to appear with a faked 'Microsoft Office Outlook' X-Mailer header MID_14DIGITS_HEX Message-ID =~ /^<[0-9]{14}\.[A-F0-9]{10}\@[0-9A-Z]+$/ meta __HTML_IMG_ONLY ( HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 ) meta STOCK_IMG_HDR_FROM (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY) describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line meta STOCK_IMG_HTML (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY) describe STOCK_IMG_HTML Stock spam image part, with distinctive HTML header __HAS_OUTLOOK_IN_MAILER_NEW X-Mailer =~ /\bMSCRM\b|Microsoft (?:CDO|Outlook|Office Outlook)\b/ meta STOCK_IMG_OUTLOOK (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__HAS_OUTLOOK_IN_MAILER_NEW&&__HTML_LENGTH_1536_2048) describe STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features # Spammy X-Mailer version strings; no longer seen in ham, due to MS' # auto-updates, but still appearing in plenty of spam template text header __XM_OL_29196700 X-Mailer =~ /^Microsoft Outlook Express 5.00.2919.6700$/ header __XM_OL_41332400 X-Mailer =~ /^Microsoft Outlook Express 5.50.4133.2400$/ header __XM_OL_48071700 X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.1700$/ header __XM_OL_28001441 X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/ header __XM_OL_29196600 X-Mailer =~ /^Microsoft Outlook Express 5.00.2919.6600$/ header __XM_OL_49631700 X-Mailer =~ /^Microsoft Outlook Express 5.50.4963.1700$/ header __XM_OL_48072300 X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/ header __XM_OL_28004682 X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/ header __XM_OL_10_0_4115 X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/ header __XM_OL_4_72_2106_4 X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/ meta SPAMMY_XMAILER (__XM_OL_29196700||__XM_OL_41332400||__XM_OL_48071700||__XM_OL_28001441||__XM_OL_29196600||__XM_OL_49631700||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4) describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham header __HELO_NO_DOMAIN X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[^\.]+ / meta SHORT_HELO_AND_INLINE_IMAGE (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH) describe SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image # "Tora" spam header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/ header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/ header __NAKED_TO To =~ /^[^\s<>]+\@[^\s<>]+$/ meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO) header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!UNIX:)[^\[\]]*\s/ describe TVD_RCVD_SPACE_BRACKET Received header has a spammy looking section header HEADER_COUNT_SUBJECT eval:check_header_count_range('Subject','2','999') describe HEADER_COUNT_SUBJECT Multiple Subject headers found header TVD_ENVFROM_APOST EnvelopeFrom =~ /\'/ body TVD_SILLY_URI_OBFU m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i body YOUR_CRD_RATING /Your cr[d\.]* (?:scor|rat)ing doesn.t matter/ header MIME_BOUND_EQ_REL Content-Type =~ /boundary="=====================_\d+==\.REL"/s if version > 3.001007 body URI_TRUNCATED eval:check_uri_truncated() describe URI_TRUNCATED Message contained a URI which was truncated score URI_TRUNCATED 0.001 endif # 2007/07/10 # 0.269 0.3293 0.0000 1.000 0.76 0.00 TVD_PDF_FINGER01 rawbody __TVD_BODY /\S{4}/ header __TVD_MIME_CT_MM Content-Type =~ /^multipart\/mixed/i meta __TVD_MIME_ATT __TVD_MIME_ATT_AP || __TVD_MIME_ATT_AOPDF meta TVD_PDF_FINGER01 __TVD_MIME_CT_MM && __TVD_MIME_ATT_TP && __TVD_MIME_ATT && !__TVD_BODY describe TVD_PDF_FINGER01 Mail matches standard pdf spam fingerprint ########################################################################### # ReplaceTags rules ifplugin Mail::SpamAssassin::Plugin::ReplaceTags # 2006/03/13 # 0.123 0.1549 0.0000 1.000 0.64 1.00 FUZZY_MERIDIA body FUZZY_MERIDIA /\b(?!meridia)\b/i replace_rules FUZZY_MERIDIA # 2006/03/13 # 0.239 0.3022 0.0000 1.000 0.70 1.00 TVD_FUZZY_FINANCE body TVD_FUZZY_FINANCE /(?!finance)/i replace_rules TVD_FUZZY_FINANCE # 2006/03/13 # 0.134 0.1687 0.0000 1.000 0.65 1.00 TVD_FUZZY_FIXED_RATE body TVD_FUZZY_FIXED_RATE /(?!fixed rate)\s+/i replace_rules TVD_FUZZY_FIXED_RATE # 2006/03/13 # 0.368 0.4640 0.0000 1.000 0.75 1.00 TVD_FUZZY_MICROCAP body TVD_FUZZY_MICROCAP /(?!microcap)(?!micro-cap)-?

/i replace_rules TVD_FUZZY_MICROCAP # 2006/03/13 # 0.133 0.1676 0.0000 1.000 0.64 1.00 TVD_FUZZY_PHARMACEUTICAL body TVD_FUZZY_PHARMACEUTICAL /(?!pharmaceutical)

/i replace_rules TVD_FUZZY_PHARMACEUTICAL # 2006/03/13 # 2.028 2.5563 0.0154 0.994 0.88 1.00 TVD_FUZZY_SECURITIES body TVD_FUZZY_SECURITIES /(?!securities)/i replace_rules TVD_FUZZY_SECURITIES # 2006/03/13 # 1.692 2.1330 0.0121 0.994 0.87 1.00 TVD_FUZZY_SYMBOL body TVD_FUZZY_SYMBOL /(?!symbol)/i replace_rules TVD_FUZZY_SYMBOL # 2006/04/09 # 0.110 0.1348 0.0000 1.000 0.61 0.01 TVD_FUZZY_DEGREE body TVD_FUZZY_DEGREE /\b(?!degree)\b/i replace_rules TVD_FUZZY_DEGREE endif ########################################################################### # MIMEHeader Rules # 2006/03/13 # 3.303 4.1687 0.0044 0.999 0.93 1.00 TVD_FW_GRAPHIC_ID1 # 0.326 0.4114 0.0000 1.000 0.73 1.00 TVD_FW_GRAPHIC_ID2 # 1.049 1.3238 0.0022 0.998 0.85 0.01 TVD_FW_GRAPHIC_NAME_LONG # 0.421 0.5304 0.0033 0.994 0.76 0.01 TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader TVD_FW_GRAPHIC_ID1 Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/ mimeheader TVD_FW_GRAPHIC_ID2 Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/ mimeheader TVD_FW_GRAPHIC_NAME_LONG Content-Type =~ /\bname="[a-z]{8,}\.gif/ mimeheader TVD_FW_GRAPHIC_NAME_MID Content-Type =~ /\bname="[a-z]{6,7}\.gif/ mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i mimeheader __TVD_OUTLOOK_IMG Content-Id =~ /$/ mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpeg|png)/ mimeheader __PART_STOCK_CL Content-Location =~ /./ mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/ meta PART_CID_STOCK (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F) describe PART_CID_STOCK Has a spammy image attachment (by Content-ID) mimeheader __PART_CID_STOCK_LESS Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/ meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS) describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific) mimeheader __TVD_MIME_ATT_TP Content-Type =~ /^text\/plain/i mimeheader __TVD_MIME_ATT_AP Content-Type =~ /^application\/pdf/i mimeheader __TVD_MIME_ATT_AOPDF Content-Type =~ /^application\/octet-stream.*\.pdf/i endif # Mail::SpamAssassin::Plugin::MIMEHeader ########################################################################### # SCORES ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # score PART_CID_STOCK_LESS 1.0 score PART_CID_STOCK 1.0 score TVD_FW_GRAPHIC_ID1 2.1 score TVD_FW_GRAPHIC_ID2 2.1 score TVD_FW_GRAPHIC_NAME_LONG 1.8 score TVD_FW_GRAPHIC_NAME_MID 1.2 # endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags # score TVD_FUZZY_FINANCE 2.0 score TVD_FUZZY_FIXED_RATE 2.0 score TVD_FUZZY_MICROCAP 2.2 score TVD_FUZZY_PHARMACEUTICAL 2.0 score TVD_FUZZY_SECURITIES 1.8 score TVD_FUZZY_SYMBOL 1.8 score FUZZY_MERIDIA 2.0 score TVD_FUZZY_DEGREE 2.0 # endif # score TVD_SILLY_URI_OBFU 2.4 score NULL_IN_BODY 2.2 score HS_EXTRA 1.2 score DEAR_WINNER 2.0 score DRUGS_HDIA 2.0 score TVD_SUBJ_ACC_NUM 1.8 score TVD_SUBJ_APPR_LOAN 2.0 score TVD_SUBJ_OWE 2.4 score TVD_SUBJ_WIPE_DEBT 2.0 score TVD_UNDER_VALUED 1.8 score VERTICAL_DRUGS_1 2.2 score TVD_SECTION 2.5 score TVD_HEAD_EDITION 1.0 score TVD_HEAD_USR 1.0 score TVD_INCREASE_SIZE 2.2 score TVD_NOT_SATISFIED 2.0 score HS_GETMEOFF 2.0 score HS_SUBJ_ONLINE_PHARMACEUTICAL 2.0 score KAM_STOCKOTC 1.0 score SUBJ_RE_NUM 1.2 score TVD_ACT_193 2.0 score TVD_DEAR_HOMEOWNER 2.0 score TVD_DOLLARS_US 1.2 score TVD_EB_PHISH 2.0 score TVD_SINGLE_SPAN_DIV 1.8 score TVD_UA_FOSTERING 2.0 score TVD_FINGER_01 2.0 score TVD_SUBJ_FINGER_03 2.0 score TVD_STOCK1 2.4 score TVD_VIS_HIDDEN 2.4 score TVD_SPACED_SUBJECT_WORD 2.0 score TVD_SPACED_WORDS 2.2 score TVD_PH_SUBJ_URGENT 2.0 score TVD_FLOAT_GENERAL 2.0 score TVD_FW_GRAPHIC_ID3 2.0 score TVD_RCVD_SPACE_BRACKET 1.2 score MID_14DIGITS_HEX 2.8 score OUTLOOK_3416 2.0 score RCVD_MAIL_COM 3.0 score DRUGS_STOCK_MIMEOLE 2.0 score RCVD_FORGED_WROTE 2.8 score STOCK_IMG_HDR_FROM 1.0 score STOCK_IMG_HTML 1.0 score STOCK_IMG_OUTLOOK 1.0 score SPAMMY_XMAILER 1.0 score SHORT_HELO_AND_INLINE_IMAGE 1.0 score JM_TORA_XM 2.5 score HEADER_COUNT_SUBJECT 1.0 score TVD_ENVFROM_APOST 2.3 #