# SpamAssassin rules file: scores. ########################################################################### # Default scores. Note that if a test is named in the files, but a score is # not assigned here, the default score will be set to 1. # The following block of scores were generating using the mass-checking # scripts, and a genetic algorithm, to determine the optimum scores which # resulted in minimum false positives or negatives. The default evolution # parameters are very strongly weighted against false positives. # SUMMARY: 140 / 3537 # # Correctly non-spam: 210220 99.93% (81.74% overall) # Correctly spam: 43288 92.45% (16.83% overall) # False positives: 140 0.07% (0.05% overall, 3280 adjusted) # False negatives: 3537 7.55% (1.38% overall, 9092 adjusted) # Average score for spam: 14.3 nonspam: -2.2 # Average for false-pos: 7.0 false-neg: 2.6 # TOTAL: 257185 100.00% # # Start of GA-evolved scores score ADDRESSES_ON_CD 4.464 score ADVERT_CODE 4.725 score ALL_CAPS_HEADER 1.624 score ALL_NATURAL 2.291 score AMAZING 2.764 score AOL_USERS_LINK 0.626 score ASCII_FORM_ENTRY -1.660 score ASKS_BILLING_ADDRESS -0.152 score AS_SEEN_ON 2.235 score AUTO_EMAIL_REMOVAL 1.750 score BAD_HELO_WARNING 2.540 score BASE64_ENC_TEXT 2.062 score BE_AMAZED 4.202 score BIG_FONT 2.056 score BILLION_DOLLARS 3.060 score BILL_1618 4.609 score BUGGY_CGI 3.368 score BUGZILLA_BUG 0.921 score BULK_EMAIL 0.884 score CALL_FREE 0.687 score CALL_NOW 4.732 score CASHCASHCASH 2.394 score CASINO 0.566 score CBYI 4.336 score CHARSET_FARAWAY 2.164 score CHARSET_FARAWAY_BODY 2.256 score CHARSET_FARAWAY_HEADERS 3.119 score CHECK_OR_MONEY_ORDER 4.465 score CLICK_BELOW 1.531 score CLICK_HERE_LINK 0.847 score CLICK_TO_REMOVE_2 0.394 score COMMUNIGATE 2.596 score COPYRIGHT_CLAIMED -1.255 score COPY_ACCURATELY 3.410 score COPY_DVDS 3.699 score CORRUPT_MSGID 2.665 score CTYPE_JUST_HTML 1.665 score DATE_IN_FUTURE_03_06 3.416 score DATE_IN_FUTURE_06_12 2.385 score DATE_IN_FUTURE_12_24 3.308 score DATE_IN_FUTURE_24_48 3.657 score DATE_IN_FUTURE_48_96 2.887 score DATE_IN_FUTURE_96_XX 3.463 score DATE_IN_PAST_03_06 0.682 score DATE_IN_PAST_06_12 1.642 score DATE_IN_PAST_12_24 1.703 score DATE_IN_PAST_24_48 2.611 score DATE_IN_PAST_48_96 2.479 score DATE_IN_PAST_96_XX 0.938 score DATE_MISSING -2.140 score DATE_WARNING 3.088 score DATE_YEAR_ZERO_FIRST 1.142 score DEAR_EMAIL 2.350 score DEAR_FRIEND 3.092 score DEAR_SOMEBODY -0.694 score DIRECT_EMAIL 3.294 score DOMAIN_BODY 2.491 score DOMAIN_SUBJECT 0.795 score DONT_DELETE 1.565 score DOUBLE_CAPSWORD 1.050 score EARN_PER_WEEK 4.339 score EJACULATION 3.601 score EMAIL_MARKETING 0.259 score EXCUSE_1 2.329 score EXCUSE_10 0.365 score EXCUSE_11 1.680 score EXCUSE_12 2.904 score EXCUSE_13 0.150 score EXCUSE_14 0.402 score EXCUSE_15 0.484 score EXCUSE_16 -0.721 score EXCUSE_17 3.700 score EXCUSE_2 3.073 score EXCUSE_3 1.080 score EXCUSE_4 2.896 score EXCUSE_6 2.180 score EXCUSE_7 1.305 score FAKED_IP_IN_RCVD 3.647 score FAKED_UNDISC_RECIPS 3.461 score FILTERED_BY_WORLDREMOVE 2.626 score FORGED_EUDORAMAIL_RCVD 4.585 score FORGED_GW05_RCVD 4.851 score FORGED_HOTMAIL_RCVD -0.356 score FORGED_JUNO_RCVD 4.430 score FORGED_RCVD_FOUND 0.008 score FORGED_YAHOO_RCVD 1.454 score FORM_W_MAILTO_ACTION 3.239 score FOR_FREE 1.127 score FOR_INSTANT_ACCESS 2.996 score FOR_JUST_SOME_AMT 1.916 score FREE_CONSULTATION 4.184 score FREE_MONEY 0.244 score FREE_PRIORITY_MAIL 0.718 score FREQ_SPAM_PHRASE 2.417 score FRIEND_AT_PUBLIC 0.999 score FROM_AND_TO_SAME -2.071 score FROM_BTAMAIL 3.516 score FROM_ENDS_IN_NUMS 0.382 score FROM_HAS_MIXED_NUMS 2.578 score FROM_MALFORMED 3.667 score FROM_MISSING 4.257 score FROM_NAME_EQ_FROM_ADDR 2.592 score FROM_NAME_NO_SPACES -0.114 score FROM_NO_USER 1.471 score FROM_STARTS_WITH_NUMS 4.388 score FROM_TOPICA 4.573 score FRONTPAGE 4.429 score FULL_REFUND 2.335 score GAPPY_SUBJECT 0.975 score GAPPY_TEXT 0.393 score GENTLE_FEROCITY 4.196 score GREAT_OFFER 0.445 score GREEN_EXCUSE_1 -2.019 score GREEN_EXCUSE_2 3.831 score GUARANTEE 1.500 score HOME_EMPLOYMENT 2.882 score HR_3113 2.695 score HTML_EMBEDS 0.417 score HTML_WITH_BGCOLOR 1.346 score HTTP_CTRL_CHARS_HOST 3.077 score HTTP_ESCAPED_HOST 2.222 score HTTP_NUMBER_WORD 1.827 score HTTP_USERNAME_USED 1.512 score HTTP_WITH_EMAIL_IN_URL 2.648 score IMPOTENCE 2.570 score INCREASE_SOMETHING 0.399 score INTL_EXEC_GUILD -0.039 score INVALID_DATE 0.475 score INVALID_DATE_TZ_ABSURD 4.395 score INVALID_MSGID 1.848 score INVESTOR_SPEC_SHEET 3.046 score IN_ACCORDANCE_WITH_LAWS 3.160 score IN_REP_TO -3.382 score JAVASCRIPT 1.524 score JAVASCRIPT_URI 0.099 score JODY 2.606 score KIFF 3.838 score KNOWN_BAD_DIALUPS 1.860 score KOREAN_UCE_SUBJECT 3.401 score LARGE_HEX 2.500 score LIMITED_TIME_ONLY 4.303 score LINES_OF_YELLING -0.036 score LINES_OF_YELLING_2 0.068 score LINES_OF_YELLING_3 0.478 score LOTS_OF_CC_LINES 3.033 score MAILTO_LINK 0.782 score MAILTO_TO_REMOVE -1.669 score MAILTO_TO_SPAM_ADDR 0.523 score MAILTO_WITH_SUBJ 1.900 score MAILTO_WITH_SUBJ_REMOVE 4.922 score MAJORDOMO 0.129 score MANY_FROMS 2.897 score MASS_EMAIL 0.946 score MAY_BE_FORGED 1.558 score MDAEMON_2_7_4 2.558 score MICRO_CAP_WARNING 3.663 score MIME_EXCESSIVE_QP 2.430 score MIME_MISSING_BOUNDARY 3.887 score MIME_NULL_BLOCK -0.975 score MIME_ODD_CASE 4.339 score MISSING_HEADERS 1.073 score MONEY_BACK -0.239 score MONEY_MAKING -0.687 score MONSTERHUT 1.295 score MORTGAGE_RATES 4.354 score MSGID_CHARS_SPAM 2.058 score MSGID_CHARS_WEIRD -2.178 score MSGID_HAS_NO_AT 2.150 score MSGID_SPAMSIGN_1 3.458 score MSG_ID_ADDED_BY_MTA 3.967 score MSG_ID_ADDED_BY_MTA_2 1.603 score MSG_ID_ADDED_BY_MTA_3 1.107 score MYCASINOBUILDER 2.686 score NEW_DOMAIN_EXTENSIONS 4.255 score NIGERIAN_SCAM_2 4.270 score NIGERIAN_SCAM_4 3.424 score NIGERIAN_SCAM_5 2.333 score NIGERIAN_SCAM_6 3.014 score NIGERIAN_SCAM_7 4.228 score NONEXISTENT_CHARSET 4.523 score NORMAL_HTTP_TO_IP 3.312 score NOT_INTENDED 1.135 score NO_CATCH 2.621 score NO_COST 1.938 score NO_DISSAPOINTMENT 0.689 score NO_EXPERIENCE 4.239 score NO_OBLIGATION 1.884 score NO_QS_ASKED 2.413 score NO_REAL_NAME -1.068 score NO_SELLING 1.489 score NUMERIC_HTTP_ADDR 1.754 score ONCE_IN_LIFETIME 1.802 score ONE_HUNDRED_PC_FREE 3.422 score ONE_HUNDRED_PC_GUAR 0.587 score ONE_TIME_MAILING 2.464 score OPPORTUNITY 1.072 score OPT_IN 2.085 score ORDER_NOW 1.791 score PARA_A_2_C_OF_1618 2.187 score PENIS_ENLARGE 1.283 score PENIS_ENLARGE2 4.319 score PENNIES_A_DAY 2.943 score PGP_SIGNATURE -3.135 score PGP_SIGNATURE_2 -3.135 score PLEASE_READ 1.756 score PLING 0.094 score PLING_PLING 0.763 score POPLAUNCH 2.069 score PORN_1 3.092 score PORN_10 0.636 score PORN_11 1.164 score PORN_12 0.727 score PORN_13 4.241 score PORN_14 0.215 score PORN_3 0.522 score PORN_4 1.391 score PORN_6 1.933 score PORN_7 2.631 score PORN_8 0.547 score PORN_9 1.890 score POST_IN_RCVD 2.661 score PREST_NON_ACCREDITED 3.500 score PRINT_FORM_SIGNATURE 4.558 score PRODUCED_AND_SENT_OUT 4.460 score PROFITS 1.809 score PURE_PROFIT 4.129 score RATWARE 4.563 score READ_TO_END 1.998 score REALLY_UNSAFE_JAVASCRIPT 3.338 score REAL_THING 2.074 score RELAYING_FRAME 0.031 score REMOVAL_INSTRUCTIONS 4.210 score REMOVE_IN_QUOTES 2.602 score REMOVE_PAGE 2.198 score REMOVE_SUBJ 3.435 score REPLY_REMOVE_SUBJECT 0.731 score REPLY_TO_EMPTY 2.595 score RESISTANCE_IS_FUTILE 3.515 score RISK_FREE 1.928 score SAFEGUARD_NOTICE 1.967 score SECTION_301 2.823 score SEE_FOR_YOURSELF 2.773 score SENT_IN_COMPLIANCE 1.182 score SERIOUS_ONLY 2.735 score SHORT_RECEIVED_LINE 4.251 score SIGNATURE_DELIM 0.488 score SLIGHTLY_UNSAFE_JAVASCRIPT 0.693 score SMTPD_IN_RCVD 2.096 score SOCIAL_SEC_NUMBER 3.329 score SPAM_FORM 0.218 score SPAM_FORM_RETURN 3.205 score SPAM_PHRASES_020 2.139 score SPAM_PHRASES_040 2.424 score SPAM_REDIRECTOR 1.706 score STOCK_ALERT 2.965 score STOCK_PICK 3.781 score STRONG_BUY 4.052 score SUBJ_2_CREDIT 4.198 score SUBJ_ALL_CAPS -0.054 score SUBJ_ENDS_IN_Q_MARK -0.135 score SUBJ_FULL_OF_8BITS 4.298 score SUBJ_HAS_Q_MARK 0.663 score SUBJ_HAS_SPACES 4.043 score SUBJ_HAS_UNIQ_ID 2.542 score SUBJ_MISSING 1.399 score SUBJ_REMOVE -0.823 score SUPERLONG_LINE 0.384 score SUSPICIOUS_CC_RECIPS 2.212 score SUSPICIOUS_RECIPS -0.213 score S_1618 1.413 score TAKE_ACTION_NOW 2.675 score THE_FOLLOWING_FORM 1.988 score THIS_AINT_SPAM 0.854 score TONER 1.403 score TO_BE_REMOVED_REPLY 3.985 score TO_EMPTY 1.446 score TO_LOCALPART_EQ_REAL 0.483 score TO_MALFORMED 1.115 score TO_NO_USER 4.528 score TO_UNSUB_REPLY 3.366 score TRACE_BY_SSN 0.545 score TRACKER_ID 4.332 score UCE_MAIL_ACT 2.623 score UNDISC_RECIPS 4.034 score UNIVERSITY_DIPLOMAS 2.468 score UNNEEDED_HTML_ENCODING 3.196 score UNSUB_PAGE 2.586 score UNSUB_SCRIPT 2.018 score UPPERCASE_25_50 1.937 score UPPERCASE_50_75 2.972 score UPPERCASE_75_100 2.990 score URGENT_BIZ 2.734 score URI_IS_POUND 2.026 score US_DOLLARS 4.475 score US_DOLLARS_2 0.182 score US_DOLLARS_3 2.295 score VERY_SUSP_CC_RECIPS 1.103 score VERY_SUSP_RECIPS 1.024 score VIAGRA 4.666 score VJESTIKA 4.279 score WANTS_CREDIT_CARD 4.288 score WEB_BUGS -0.430 score WEIRD_PORT 0.262 score WE_HATE_SPAM 3.804 score WE_HONOR_ALL 4.283 score WORK_AT_HOME 3.163 score WWW_CLIK4YOU_COM 2.093 score WWW_DIRECTFORCEMARKETING_COM 2.113 score WWW_NETSITESFORFREE_NET 1.667 score WWW_REMOVEYOU_COM 2.356 score X_ANTIABUSE 2.370 score X_AUTH_WARNING -0.703 score X_EM_REGISTRATION 1.191 score X_EM_VER_PRESENT 1.331 score X_ENC_PRESENT 4.140 score X_ESMTP -1.662 score X_LIST_HOST 2.079 score X_LIST_UNSUBSCRIBE 3.195 score X_MAILER_GIBBERISH 3.062 score X_MAIL_ID_PRESENT 2.192 score X_MESSAGE_ID 0.648 score X_MSMAIL_PRIORITY_HIGH -0.886 score X_NOT_PRESENT -1.920 score X_PMFLAGS_PRESENT 3.093 score X_PRECEDENCE_REF 4.555 score X_PRIORITY_HIGH 0.896 score X_SERV_HOST_PRESENT 3.759 score X_SMTPEXP_VERSION 3.243 score X_STORMPOST_TO 2.272 score X_X_PRESENT 1.508 score YELLOWSUN 2.810 score YOUR_INCOME 4.414 score YOU_HAVE_BEEN_SELECTED 4.221 # End of GA-evolved scores. # some non-GA-generated scores: either network tests, occuring with # very low frequency, or very frequently causing false positives. score BUGGY_CGI_PT 4.0 score BUGGY_CGI_DE 4.0 score BUGGY_CGI_DE_2 4.0 score BUGGY_CGI_DE_3 4.0 score FROM_FORGED_HOTMAIL 0.0 score NO_MX_FOR_FROM 1.8 score RAZOR_CHECK 3.0 score DCC_CHECK 2.0 score RCVD_IN_RELAYS_ORDB_ORG 2.0 score RCVD_IN_OSIRUSOFT_COM 2.0 score X_OSIRU_DUL_FH -1.5 score X_OSIRU_SPAM_SRC 3.0 score X_OSIRU_SPAMWARE_SITE 5.0 score RCVD_IN_RFCI 0.5 score RCVD_IN_ORBS 1.0 score RCVD_IN_DSBL 3.0 score RCVD_IN_MULTIHOP_DSBL 1.0 score RCVD_IN_UNCONFIRMED_DSBL 0.5 # The fudge scores below expect that you use the following scores for MAPS #score RCVD_IN_VARBL 4.5 #score RCVD_IN_RSS 2.0 #score RCVD_IN_DUL 2.0 #score RCVD_IN_DUL_FH -1.5 score FUDGE_DUL_MAPS_OSIRU -2.0 score FUDGE_RELAY_OSIRU -2.0 score FUDGE_OSIRU_FH 1.5 score FUDGE_MULTIHOP_RELAY -1.0 score ROUND_THE_WORLD 3.0 # the ok_language configuration option will need to be set correctly # across each corpus for this score to be GA evolved score UNDESIRED_LANGUAGE_BODY 2.0 # unscored by default -- commercial services. If you pay for these, # give them a score so they will be checked. score RCVD_IN_RBL 0.0 score RCVD_IN_RSS 0.0 score RCVD_IN_DUL 0.0 score RCVD_IN_BL_SPAMCOP_NET 0.0 ########################################################################### # Compensation for common false positives. score BALANCE_FOR_LONG -2.0 score UNIFIED_PATCH -5.0 score DIFF_C_PATCH -5.0 score MAILMAN_CONFIRM -4.0 score EVITE -5.0 score YAHOO_MSGID_ADDED -2.4 score ORDER_STATUS -3.0 score Q_FOR_SELLER -4.0 # GA never changes the whitelist/blacklist scores score USER_IN_BLACKLIST 100.0 score USER_IN_WHITELIST -100.0 # Not really false positives but the user wants spam! score USER_IN_WHITELIST_TO -6.0 # they want some spam score USER_IN_MORE_SPAM_TO -20.0 # they want more spam score USER_IN_ALL_SPAM_TO -100.0 # they want all spam, go figure :) ########################################################################### # Missed scores: score ANOTHER_NET_AD 3.0 score A_HREF_TO_IP 2.5 score BRAND_NEW_PAGER 4.9 score BUGGY_CGI_ES 1.0 score BUGGY_CGI_PT_2 1.0 score CLICKSFORMONEY_NET 2.5 score CLICK_TO_REMOVE_MAILTO 1.0 score CRON_ENV -2.0 score CYBER_FIRE_POWER 3.5 score EGP_HTML_BANNER -6.0 score EMAIL_HARVEST 1.0 score EU_200_32_CE 1.0 score EU_EMAIL_OPTOUT 1.8 score EXCUSE_18 1.0 score EXCUSE_5 1.8 score EXCUSE_8 4.4 score EXCUSE_9 1.0 score EXCUSE_ES_01 1.0 score EXCUSE_ES_02 1.0 score EXCUSE_ES_03 1.0 score EXCUSE_ES_04 1.0 score E_WEBHOSTCENTRAL_URL 4.6 score FREEMEGS_URL 2.7 score FREEWEBCO_NET_URL 1.1 score FREEWEBHOSTINGCENTRAL 1.6 score FROM_UGETMORE 1.0 score HUNZA_DIET_BREAD 0.0 score INTERNET_TERROR_RANT 1.0 score ITS_EFFECTIVE 1.0 score JUST_MAILED_PAGE 0.2 score LASER_PRINTER 3.9 score LONG_NUMERIC_HTTP_ADDR 2.1 score MAIL_IN_ORDER_FORM 4.8 score MURKOWSKI_CRUFT 1.4 score NIGERIAN_SCAM 1.0 score NIGERIAN_SCAM_3 4.3 score NIGERIAN_SCAM_8 1.0 score OE_PI 3.0 score ONLINE_BIZ_OPS 1.0 score PORN_2 2.2 score PRINT_OUT_AND_FAX 1.0 score RCVD_IN_VISI 1.0 score REMOVE_ES_01 1.0 score REMOVE_ES_02 1.0 score REMOVE_ES_03 1.0 score REMOVE_ES_04 1.0 score SEXY_PICS 0.0 score SHOES_GUY 6.8 score SPAM_FORM_INPUT 1.0 score SPAM_PHRASES_100 1.0 score STAINLESS_STEEL 4.0 score THIS_AINT_JUNK 1.0 score TO_INVESTORS 0.0 score WEB4PORNO_URL 5.0 score WWW_AUTOREMOVE_COM 1.9 score WWW_TRAFFICWOW_NET 1.0 score X_FIX_PRESENT 1.0 score X_UIDL_SPAMSIGN 1.0 score YR_MEMBERSHIP_EXCH 4.2