Scores of 3.000 or over are highlighted in red. Negative scores are highlighted in green.
| Code | Score | Description |
| ACCEPT_CREDIT_CARDS | 0.970 | Accept Credit Cards |
| ACT_NOW_CAPS | 0.786 | Talks about 'acting now' with capitals |
| ADDRESSES_ON_CD | 2.900 | Only thing addresses on CD are useful for is spam |
| ADDR_FREE | 2.045 | From Address contains FREE |
| ADDR_NUMS_AT_BIGSITE | 0.659 | Uses an address with lots of numbers, at a big ISP |
| ADULT_SITE | 0.616 | Possible porn - Adult Web Sites |
| ADVERT_CODE | 1.101 | Subject: starts with advertising tag |
| ADVERT_CODE2 | 2.104 | Subject: contains advertising tag |
| ALL_CAP_PORN | 0.398 | Possible porn - in ALL CAPS |
| ALL_NATURAL | 2.051 | Spam is 100% natural?! |
| AMATEUR_PORN | 1.547 | Possible porn - Amateur Porn |
| AMAZING_STUFF | 0.450 | Amazing Stuff |
| ANTISPAM_BILL | 0.000 | Very likely mention of anti-spam bill |
| AOL_USERS_LINK | 1.416 | Includes a link for AOL users to click |
| APPLY_FREE | 1.819 | Free Application |
| APPLY_ONLINE | 0.723 | Apply online (with capital O) |
| APPROVED_BY | -0.398 | Has an Approved-By moderated list header |
| ASCII_FORM_ENTRY | 0.000 | Contains an ASCII-formatted form |
| ASKS_BILLING_ADDRESS | 0.041 | Asks for a billing address |
| AS_SEEN_ON | 1.948 | As seen on national TV! |
| AUTO_EMAIL_REMOVAL | 0.993 | Claims auto-email removal |
| AZOOGLE | 2.900 | From azoogle.com, azogle.com, etc. |
| BAD_CREDIT | 0.730 | Eliminate Bad Credit |
| BAD_HELO_WARNING | 0.000 | Fake name used in SMTP HELO command |
| BANG_BOSS | 0.710 | Talks about your boss with an exclamation! |
| BANG_EXERCISE | 3.070 | Talks about exercise with an exclamation! |
| BANG_GUARANTEE | 0.674 | Something is emphatically guaranteed |
| BANG_MONEY | 0.524 | Talks about money with an exclamation! |
| BANG_MORE | 0.816 | Talks about more with an exclamation! |
| BANG_OPRAH | 4.300 | Talks about Oprah with an exclamation! |
| BANG_QUOTE | 2.567 | Talks about quotes with an exclamation! |
| BANKRUPTCY | 1.390 | Avoid Bankruptcy |
| BARELY_LEGAL | 0.026 | Possible porn - Barely Legal |
| BARGAIN_URL | 1.026 | Includes a link to a likely spammer domain |
| BASE64_ENC_TEXT | 2.354 | Message text disguised using base-64 encoding |
| BAYES_00 | 0.000 | Bayesian classifier says spam probability is 0 to 1% |
| BAYES_01 | 0.000 | Bayesian classifier says spam probability is 1 to 10% |
| BAYES_10 | 0.000 | Bayesian classifier says spam probability is 10 to 20% |
| BAYES_20 | 0.000 | Bayesian classifier says spam probability is 20 to 30% |
| BAYES_30 | 0.000 | Bayesian classifier says spam probability is 30 to 40% |
| BAYES_40 | 0.000 | Bayesian classifier says spam probability is 40 to 44% |
| BAYES_44 | 0.000 | Bayesian classifier says spam probability is 44 to 50% |
| BAYES_50 | 0.000 | Bayesian classifier says spam probability is 50 to 56% |
| BAYES_56 | 0.000 | Bayesian classifier says spam probability is 56 to 60% |
| BAYES_60 | 0.000 | Bayesian classifier says spam probability is 60 to 70% |
| BAYES_70 | 0.000 | Bayesian classifier says spam probability is 70 to 80% |
| BAYES_80 | 0.000 | Bayesian classifier says spam probability is 80 to 90% |
| BAYES_90 | 0.000 | Bayesian classifier says spam probability is 90 to 99% |
| BAYES_99 | 0.000 | Bayesian classifier says spam probability is 99 to 100% |
| BEEN_TURNED_DOWN | 1.258 | Have you been turned down? |
| BEST_PORN | 0.000 | Possible porn - Best, Largest Porn Collections |
| BE_AMAZED | 0.000 | Apparently, you'll be amazed |
| BE_BOSS | 2.896 | Be your own boss |
| BILLION_DOLLARS | 1.490 | Talks about lots of money |
| BILL_1618 | 2.043 | Claims compliance with Senate Bill 1618 |
| BODY_8BITS | 1.500 | Body includes 8 consecutive 8-bit characters |
| BTAMAIL_HEADER | 2.900 | Header contains an address from btamail.net.cn |
| BTAMAIL_URL | 1.399 | Frequent SPAM content |
| BUGGY_CGI | 2.896 | Broken CGI script message |
| BUGZILLA_BUG | -1.401 | Looks like a Bugzilla bug |
| BULK_EMAIL | 1.372 | Talks about bulk email |
| BUY_DIRECT | 0.708 | Buy Direct |
| BUY_JUDGEMENTS | 0.000 | Buying judgements |
| CABLE_CONVERTER | 2.900 | Cable Converter |
| CALL_FREE | 0.000 | Contains a tollfree number |
| CALL_NOW | 1.596 | Urges you to call now |
| CANNOT_BE_SPAM | 1.654 | Claims "cannot be considered spam" |
| CASHCASHCASH | 0.000 | Contains at least 3 dollar signs in a row |
| CASH_BONUS | 0.146 | Cash Bonus |
| CBYI | 2.796 | Contains "CBYI" |
| CELEBRITY_PORN | 0.000 | Possible porn - Celebrity Porn |
| CELL_PHONE_BOOST | 1.927 | Talks about cell-phone signal improvement |
| CENTS_ON_DOLLAR | 2.900 | Cents on the Dollar |
| CHANGE_TERMS | 0.000 | Terms and conditions |
| CHARSET_FARAWAY | 3.200 | Character set indicates a foreign language |
| CHARSET_FARAWAY_HEADERS | 2.060 | A foreign language charset used in headers |
| CHILD_SUPPORT | 0.000 | "Collect Child Support" Scam |
| CHINA_HEADER | 2.900 | Involves 'china.com' |
| CHINA_URL | 2.900 | Frequent SPAM content |
| CLICK_BELOW | 0.489 | Asks you to click below |
| CLICK_BELOW_CAPS | 0.639 | Asks you to click below (in capital letters) |
| CLICK_TO_REMOVE_1 | 1.100 | Click to be removed |
| CLICK_TO_REMOVE_2 | 0.700 | Click-to-remove with mailto: found beforehand |
| COMMUNIGATE | 1.709 | Sent using a trial version of CommuniGate |
| COMPARE_RATES | 1.890 | Compare Rates |
| COMPETE | 2.896 | Compete for your business |
| COMPLAIN_TO | 2.900 | Message has Complain-To header |
| COMPLETELY_FREE | 0.771 | No such thing as a free lunch (2) |
| CONFIDENTIAL_ORDER | 0.000 | Confidentiality on all orders |
| CONFIRMED_FORGED | 4.400 | Received headers are forged |
| CONGRATULATIONS | 0.000 | Congratulations - you've been scammed? |
| CONSOLIDATE_DEBT | 1.247 | Consolidate debt, credit, or bills |
| COPY_ACCURATELY | 2.900 | Common pyramid scheme phrase (1) |
| CREDITORS_CALLING | 0.000 | Calling Creditors |
| CREDIT_BUREAU | 0.000 | Credit Bureaus |
| CREDIT_CARD | 0.447 | Credit Card Offers |
| CRON_ENV | -0.380 | Has a X-Cron-Env header |
| CUM_SHOT | 1.676 | Possible porn - Cum Shot |
| DAILY_PL | 1.101 | Spam URL pattern, DailyPromotions redirect link |
| DAILY_PXE | 2.029 | Spam URL pattern, DailyPromotions server link |
| DATE_IN_FUTURE_03_06 | 2.504 | Date: is 3 to 6 hours after Received: date |
| DATE_IN_FUTURE_06_12 | 1.534 | Date: is 6 to 12 hours after Received: date |
| DATE_IN_FUTURE_12_24 | 1.869 | Date: is 12 to 24 hours after Received: date |
| DATE_IN_FUTURE_24_48 | 2.696 | Date: is 24 to 48 hours after Received: date |
| DATE_IN_FUTURE_48_96 | 2.297 | Date: is 48 to 96 hours after Received: date |
| DATE_IN_FUTURE_96_XX | 1.691 | Date: is 96 hours or more after Received: date |
| DATE_IN_PAST_03_06 | 0.271 | Date: is 3 to 6 hours before Received: date |
| DATE_IN_PAST_06_12 | 0.759 | Date: is 6 to 12 hours before Received: date |
| DATE_IN_PAST_12_24 | 0.000 | Date: is 12 to 24 hours before Received: date |
| DATE_IN_PAST_24_48 | 0.000 | Date: is 24 to 48 hours before Received: date |
| DATE_IN_PAST_48_96 | 0.000 | Date: is 48 to 96 hours before Received: date |
| DATE_IN_PAST_96_XX | 1.235 | Date: is 96 hours or more before Received: date |
| DATE_MISSING | 1.472 | Missing Date: header |
| DATE_YEAR_ZERO_FIRST | 4.300 | Invalid Date: year begins with zero |
| DCC_CHECK | 0.000 | Listed in DCC, see http://rhyolite.com/anti-spam/dcc/ |
| DEAR_FRIEND | 0.484 | How dear can you be if you don't know my name? |
| DEAR_SOMETHING | 2.596 | Contains 'Dear (something)' |
| DEBIAN_BTS_BUG | -1.401 | Looks like a Debian BTS bug |
| DIET | 0.000 | Lose Weight Spam |
| DIG_UP_INFO | 2.900 | Dig up Dirt on Friends |
| DIRECT_EMAIL | 0.000 | Talks about direct email |
| DISCLAIMER_LEGALESE | 0.000 | Contains what looks like an 'E-Mail Disclaimer' |
| DISCONTINUE | 0.000 | List removal information |
| DISGUISE_PORN | 1.727 | Attempts to disguise porn words |
| DOMAINS_CHEAP | 2.900 | Subject: domain names are cheap |
| DOMAIN_4U2 | 1.470 | Domain name containing a "4u" variant |
| DOMAIN_BODY | 0.000 | Domain registration spam body |
| DOMAIN_SUBJECT | 0.000 | Subject: domain registration spam subject |
| DONT_DELETE | 0.571 | Don't delete me! Nooooo!!!! |
| DO_IT_TODAY | 0.000 | Do it Today |
| DRASTIC_REDUCED | 2.199 | Drastically Reduced |
| EARNINGS | 1.381 | Potential Earnings |
| EARN_MONEY | 0.950 | Message talks about earning money |
| EARN_PER_WEEK | 0.000 | Contains 'earn $something per week' |
| EASY_TERMS | 2.900 | Easy Terms |
| EJACULATION | 0.000 | Increase your ejaculation! |
| EMAIL_ATTRIBUTION | -0.498 | Contains what looks like an email attribution |
| EMAIL_MARKETING | 0.000 | Talks about email marketing |
| ENHANCE_WEBSITE | 0.000 | Talks about 'enhancing any website' |
| EVITE | -4.600 | Message looks like an Evite |
| EXCUSE_1 | 0.114 | Gives a lame excuse about why you were sent this spam |
| EXCUSE_10 | 0.069 | "if you do not wish to receive any more" |
| EXCUSE_11 | 1.514 | Claims you were on a list |
| EXCUSE_12 | 1.878 | Nobody's perfect |
| EXCUSE_13 | 0.501 | Gives an excuse for why message was sent |
| EXCUSE_14 | 0.191 | Tells you how to stop further spam |
| EXCUSE_15 | 1.554 | Claims to be legitimate email |
| EXCUSE_16 | 0.000 | I wonder how many emails they sent in error... |
| EXCUSE_18 | 0.000 | Claims not to be spam |
| EXCUSE_19 | 1.347 | Claims you opted-in or registered |
| EXCUSE_2 | 0.000 | Claims you actually asked for this spam |
| EXCUSE_20 | 2.900 | Claims you registered at their site |
| EXCUSE_21 | 2.421 | Claims your address was obtained legitimately |
| EXCUSE_22 | 2.900 | Claims you're receiving this offer for a reason |
| EXCUSE_23 | 2.900 | Claims you have provided permission |
| EXCUSE_24 | 4.300 | Claims you received an ad because you wanted it |
| EXCUSE_3 | 0.100 | Claims you can be removed from the list |
| EXCUSE_4 | 2.896 | Claims you can be removed from the list |
| EXCUSE_6 | 0.811 | Claims you can be removed from the list |
| EXCUSE_7 | 0.000 | Claims you can be removed from the list |
| EXCUSE_8 | 0.000 | Claims you can be removed from the list |
| EXCUSE_REMOVE | 2.213 | Talks about how to be removed from mailings |
| EXPERTS_SHOW_HOW | 0.000 | Talks about 'experts' showing you how |
| EXTRA_CASH | 1.184 | Offers Extra Cash |
| EXTRA_MPART_TYPE | 0.484 | Message with extraneous Content-type:...type= header |
| E_MAILPROMO_URL | 2.900 | Includes a link to a likely spammer domain (e-mailpromo.net) |
| FAILURE_NOTICE_1 | 0.000 | Mailer daemon failure notice (1) |
| FAILURE_NOTICE_2 | 0.000 | Mailer daemon failure notice (2) |
| FAKED_IP_IN_RCVD | 2.900 | Received: contains a name with a faked IP-address |
| FAKED_UNDISC_RECIPS | 4.300 | Faked To "Undisclosed-Recipients" |
| FALLING_INTEREST | 2.900 | Interest rates |
| FANTASTIC | 0.000 | Fantastic Deal |
| FINANCIAL | 4.300 | Financial Freedom |
| FIND_ANYTHING | 0.330 | Find out anything |
| FORGED_AOL_RCVD | 4.400 | Received forged, contains fake AOL relays |
| FORGED_EUDORAMAIL_RCVD | 2.896 | Forged eudoramail.com 'Received:' header found |
| FORGED_GW05_RCVD | 2.900 | Forged 'by gw05' 'Received:' header found |
| FORGED_HOTMAIL_RCVD | 2.335 | Forged hotmail.com 'Received:' header found |
| FORGED_JUNO_RCVD | 2.696 | 'From' juno.com does not match 'Received' headers |
| FORGED_MUA_AOL | 4.300 | Forged mail pretending to be from AOL |
| FORGED_MUA_EUDORA | 2.796 | Forged mail pretending to be from Eudora |
| FORGED_MUA_IMS | 4.280 | Forged mail pretending to be from IMS |
| FORGED_MUA_MOZILLA | 2.596 | Forged mail pretending to be from Mozilla |
| FORGED_MUA_MSN | 0.000 | Forged mail pretending to be from MSN |
| FORGED_MUA_OIMO | 4.295 | Forged mail pretending to be from MS Outlook IMO |
| FORGED_MUA_OUTLOOK | 3.717 | Forged mail pretending to be from MS Outlook |
| FORGED_MUA_THEBAT | 4.295 | Forged mail pretending to be from The Bat! |
| FORGED_MX_HOTMAIL | 2.900 | Forged hotmail.com Received 'from mx' header |
| FORGED_RCVD_TRAIL | 1.425 | trail of Received: headers seems to be forged |
| FORGED_TELESP_RCVD | 2.900 | Contains forged hostname for a DSL IP in Brazil |
| FORGED_YAHOO_RCVD | 2.401 | 'From' yahoo.com does not match 'Received' headers |
| FORGOTTEN_PASSWORD | -0.170 | Contains a password retrieval system |
| FORWARD_LOOKING | 2.796 | Stock Disclaimer Statement |
| FOR_FREE | 0.515 | No such thing as a free lunch (1) |
| FOR_INSTANT_ACCESS | 0.000 | Instant Access button |
| FOR_JUST_SOME_AMT | 0.000 | Contains 'for only' some amount of cash |
| FREE_ACCESS | 0.000 | Contains 'free access' with capitals |
| FREE_CELL_PHONE | 1.873 | Talks about free mobile phones |
| FREE_CONSULTATION | 2.900 | Offers a consultation for nothing |
| FREE_DVD | 0.000 | Free DVD |
| FREE_GRANT | 0.701 | Free Grant Money |
| FREE_INSTALL | 2.900 | Contains 'free installation' with capitals |
| FREE_INVESTMENT | 1.630 | Free Investment |
| FREE_LEADS | 2.900 | Free Leads |
| FREE_MEMBERSHIP | 0.701 | Free Membership |
| FREE_PASSWORD | 1.846 | Offers Free (often stolen) Passwords |
| FREE_PORN | 1.101 | Possible porn - Free Porn |
| FREE_PREVIEW | 0.300 | Free Preview |
| FREE_QUOTE | 1.316 | Free Quote |
| FREE_QUOTE_INSTANT | 2.896 | Free express or no-obligation quote |
| FREE_SAMPLE | 0.000 | Contains 'free sample' with capitals |
| FREE_TRIAL | 0.000 | Free Trial |
| FREE_WEBSITE | 0.930 | Free Website |
| FRIEND_AT_PUBLIC | 2.900 | sent to you@you.com or similar |
| FRIEND_PUBLIC | 2.900 | sent from or to friend@public.com |
| FROM_ALL_NUMS | 0.153 | From an address that is all numbers (non-phone) |
| FROM_AND_TO_SAME | 2.097 | From and To are the same, but not exactly |
| FROM_EGROUPS | -0.498 | Appears to be from yahoo groups |
| FROM_ENDS_IN_NUMS | 0.609 | From: ends in numbers |
| FROM_HAS_MIXED_NUMS | 0.000 | From: contains numbers mixed in with letters |
| FROM_HAS_MIXED_NUMS2 | 1.396 | From address matches known spammer format |
| FROM_HAS_UNDERLINE_NUMS | 0.000 | From: contains an underline and numbers/letters |
| FROM_NO_LOWER | 1.870 | 'From' has no lower-case characters |
| FROM_NO_USER | 1.773 | From: has no local-part before @ sign |
| FROM_NUM_AT_WEBMAIL | 2.900 | From address is webmail, but starts with a number |
| FROM_OFFERS | 4.300 | From address is "at something-offers" |
| FROM_STARTS_WITH_NUMS | 0.499 | From: starts with nums |
| FROM_WEBMAIL_ENDS_IN_NUMS6 | 0.905 | From address is webmail, and ends in lots of numbers |
| FRONTPAGE | 0.501 | Frontpage used to create the message |
| FULL_REFUND | 0.518 | Offers a full refund |
| FURTHER_TRANSMISSIONS | 1.101 | Claims compliance with spam regulations |
| FWD_MSG | 0.000 | Forwarded email |
| GAPPY_SUBJECT | 0.815 | Subject: contains G.a.p.p.y-T.e.x.t |
| GENTLE_FEROCITY | 2.900 | Contains "Gentle Ferocity" |
| GENUINE_EBAY_RCVD | -1.615 | Message from eBay |
| GET_IT_NOW | 0.000 | Contains 'Get it now' with capitals |
| GET_PAID | 2.796 | Get Paid |
| GET_STARTED_NOW | 0.060 | Get Started Now |
| GREAT_OFFER | 0.000 | Trying to offer you something |
| GROUPS_YAHOO_1 | -0.498 | Yahoo! Groups message |
| GTUBE | 1000.000 | Generic Test for Unsolicited Bulk Email |
| GUARANTEE | 1.123 | Contains word 'guarantee' in all-caps |
| GUARANTEED_100_PERCENT | 1.101 | One hundred percent guaranteed |
| GUARANTEED_STUFF | 0.000 | Guaranteed Stuff |
| HABEAS_HIL | 4.000 | Sender is on www.habeas.com Habeas Infringer List |
| HABEAS_SWE | -4.600 | Uses the Habeas warrant mark (http://www.habeas.com/) |
| HABEAS_VIOLATOR | 8.000 | On Habeas Infringer List and using Habeas warrant mark |
| HAIR_LOSS | 2.796 | Cures Baldness |
| HARDCORE_PORN | 2.900 | Possible porn - Hardcore Porn |
| HAS_ORGANIZATION | 0.000 | Where are you working at? |
| HEADER_8BITS | 4.400 | Headers include 3 consecutive 8-bit characters |
| HELPED_FINANCE | 2.900 | A dodgy mortgage testimonial |
| HERBAL_VIAGRA | 1.435 | Plugs "Herbal Viagra" |
| HGH | 0.500 | Human Growth Hormone |
| HIDDEN_ASSETS | 2.900 | 'Hidden' assets |
| HIDDEN_CHARGES | 0.000 | Talks about Hidden Charges |
| HIDE_WIN_STATUS | 2.899 | Javascript to hide URLs in browser |
| HOME_EMPLOYMENT | 1.601 | Information on how to work at home (2) |
| HOTMAIL_FOOTER1 | 0.000 | Common footer for Hotmail |
| HOTMAIL_FOOTER2 | 0.000 | Common footer for Hotmail |
| HOTMAIL_FOOTER3 | 0.000 | Common footer for Hotmail |
| HOTMAIL_FOOTER4 | 0.000 | Common footer for Hotmail |
| HOTMAIL_FOOTER5 | -0.207 | Common footer for Hotmail |
| HOT_NASTY | 0.513 | Possible porn - Hot, Nasty, Wild, Young |
| HR_3113 | 4.300 | Mentions Spam law "H.R. 3113" |
| HR_4176 | 2.900 | Claims compliance with House Bill 4176 |
| HTML_00_10 | 1.357 | Message is 0% to 10% HTML |
| HTML_10_20 | 1.110 | Message is 10% to 20% HTML |
| HTML_20_30 | 1.282 | Message is 20% to 30% HTML |
| HTML_30_40 | 0.617 | Message is 30% to 40% HTML |
| HTML_40_50 | 1.057 | Message is 40% to 50% HTML |
| HTML_50_60 | 0.549 | Message is 50% to 60% HTML |
| HTML_60_70 | 0.527 | Message is 60% to 70% HTML |
| HTML_70_80 | 0.584 | Message is 70% to 80% HTML |
| HTML_80_90 | 0.491 | Message is 80% to 90% HTML |
| HTML_90_100 | 0.501 | Message is 90% to 100% HTML |
| HTML_ALL_CAPS | 2.900 | Content type is "TEXT/HTML" in all caps |
| HTML_CHARSET_FARAWAY | 0.500 | A foreign language charset used in HTML markup |
| HTML_COMMENT_8BITS | 2.900 | HTML comment has 3 consecutive 8-bit characters |
| HTML_COMMENT_EGP | -0.055 | HTML comment contains non-spam Yahoo! Groups banner |
| HTML_COMMENT_EMAIL | 0.000 | HTML comment contains email address |
| HTML_COMMENT_SAVED_URL | 1.390 | HTML message is a saved web page |
| HTML_COMMENT_SKY | 1.101 | HTML comment contains SKY database codes |
| HTML_EMBEDS | 0.180 | HTML with embedded plugin object |
| HTML_EVENT | 0.000 | HTML contains auto-executing code |
| HTML_EVENT_UNSAFE | 0.000 | HTML contains unsafe auto-executing code |
| HTML_FONT_BIG | 0.218 | FONT Size +2 and up or 3 and up |
| HTML_FONT_BIG_B | 0.501 | HTML has a big "font" and "B" tag combo |
| HTML_FONT_COLOR_BLUE | 0.100 | HTML font color is blue |
| HTML_FONT_COLOR_CYAN | 0.000 | HTML font color is cyan |
| HTML_FONT_COLOR_GRAY | 0.100 | HTML font color is gray |
| HTML_FONT_COLOR_GREEN | 0.708 | HTML font color is green |
| HTML_FONT_COLOR_MAGENTA | 0.000 | HTML font color is magenta |
| HTML_FONT_COLOR_NAME | 0.442 | HTML font color has unusual name |
| HTML_FONT_COLOR_NOHASH | 0.000 | HTML font color is missing hash (#) character |
| HTML_FONT_COLOR_RED | 0.100 | HTML font color is red |
| HTML_FONT_COLOR_UNKNOWN | 0.302 | HTML font color is unknown to us |
| HTML_FONT_COLOR_UNSAFE | 0.100 | HTML font color not within safe 6x6x6 palette |
| HTML_FONT_COLOR_YELLOW | 0.000 | HTML font color is yellow |
| HTML_FONT_FACE_BAD | 0.000 | HTML font face is not a word |
| HTML_FONT_FACE_CAPS | 0.000 | HTML font face has excess capital characters |
| HTML_FONT_FACE_ODD | 0.085 | HTML font face is not a commonly used face |
| HTML_FONT_INVISIBLE | 0.000 | HTML font color is same as background |
| HTML_FORM_ACTION_MAILTO | 1.101 | HTML includes a form which sends mail |
| HTML_IMAGE_AREA_04 | 0.000 | HTML has 4-5 kilopixels of images |
| HTML_IMAGE_AREA_05 | 0.046 | HTML has 5-6 kilopixels of images |
| HTML_IMAGE_AREA_06 | 0.000 | HTML has 6-7 kilopixels of images |
| HTML_IMAGE_AREA_07 | 0.492 | HTML has 7-8 kilopixels of images |
| HTML_IMAGE_AREA_08 | 2.900 | HTML has 8-9 kilopixels of images |
| HTML_IMAGE_AREA_09 | 0.000 | HTML has over 9 kilopixels of images |
| HTML_IMAGE_ONLY_02 | 2.003 | HTML has images with 0-200 bytes of words |
| HTML_IMAGE_ONLY_04 | 1.984 | HTML has images with 200-400 bytes of words |
| HTML_IMAGE_ONLY_06 | 1.296 | HTML has images with 400-600 bytes of words |
| HTML_IMAGE_ONLY_08 | 1.065 | HTML has images with 600-800 bytes of words |
| HTML_IMAGE_ONLY_10 | 0.738 | HTML has images with 800-1000 bytes of words |
| HTML_IMAGE_ONLY_12 | 0.144 | HTML has images with 1000-1200 bytes of words |
| HTML_IMAGE_RATIO_02 | 1.101 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_04 | 0.597 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_06 | 0.769 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_08 | 0.525 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_10 | 0.141 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_12 | 0.160 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_14 | 0.000 | HTML has a low ratio of text to image area |
| HTML_JAVASCRIPT | 0.000 | JavaScript code |
| HTML_LINK_CLICK_CAPS | 1.101 | HTML link text says "CLICK" |
| HTML_LINK_CLICK_HERE | 0.100 | HTML link text says "click here" |
| HTML_MESSAGE | 0.112 | HTML included in message |
| HTML_RELAYING_FRAME | 1.008 | Frame wanted to load outside URL |
| HTML_SHOUTING3 | 0.108 | HTML has very strong "shouting" markup |
| HTML_SHOUTING4 | 0.501 | HTML has very strong "shouting" markup |
| HTML_SHOUTING5 | 0.444 | HTML has very strong "shouting" markup |
| HTML_SHOUTING6 | 2.712 | HTML has very strong "shouting" markup |
| HTML_SHOUTING7 | 2.149 | HTML has very strong "shouting" markup |
| HTML_SHOUTING8 | 2.900 | HTML has very strong "shouting" markup |
| HTML_SHOUTING9 | 0.753 | HTML has very strong "shouting" markup |
| HTML_TABLE_THICK_BORDER | 1.101 | HTML table has thick border |
| HTML_TAG_BALANCE_A | 0.000 | HTML has excess "a" close tags |
| HTML_TAG_BALANCE_BODY | 0.390 | HTML has unbalanced "body" tags |
| HTML_TAG_BALANCE_FONT | 0.000 | HTML has excess "font" close tags |
| HTML_TAG_BALANCE_HEAD | 0.000 | HTML has unbalanced "head" tags |
| HTML_TAG_BALANCE_HTML | 0.248 | HTML has unbalanced "html" tags |
| HTML_TAG_BALANCE_TABLE | 0.000 | HTML is missing "table" close tags |
| HTML_TAG_EXISTS_BASE | 0.201 | HTML has "base" tags |
| HTML_TAG_EXISTS_PARAM | 0.000 | HTML has "param" tag |
| HTML_TAG_EXISTS_TBODY | 0.496 | HTML has "tbody" tag |
| HTML_TITLE_EMPTY | 0.000 | HTML title contains no text |
| HTML_TITLE_UNTITLED | 0.386 | HTML title contains "Untitled" |
| HTML_WEB_BUGS | 0.542 | Image tag with an ID code to identify you |
| HTML_WIN_BLUR | 0.000 | Javascript to move windows around |
| HTML_WIN_FOCUS | 0.000 | Javascript to change window focus |
| HTML_WIN_OPEN | 0.500 | Javascript to open a new window |
| HTML_WITH_BGCOLOR | 0.000 | HTML mail with non-white background |
| HTTP_CTRL_CHARS_HOST | 0.700 | Uses control sequences inside a URL's hostname |
| HTTP_ESCAPED_HOST | 0.000 | Uses %-escapes inside a URL's hostname |
| HTTP_EXCESSIVE_ESCAPES | 1.101 | Completely unnecessary %-escapes inside a URL |
| HTTP_USERNAME_USED | 0.664 | Uses a username in a URL |
| HTTP_WITH_EMAIL_IN_URL | 0.461 | 'remove' URL contains an email address |
| IDENT_NOBODY | 0.881 | Received lines include an 'ident:nobody' string |
| IMPOTENCE | 2.796 | Impotence cure |
| INCOME | 2.749 | Additional Income |
| INCREASE_SEX | 1.716 | Talks about a bigger drive for sex |
| INCREASE_SOMETHING | 0.000 | Instructions on how to increase something |
| INCREDIBLE | 0.000 | Things incredible |
| INITIAL_INVEST | 2.734 | Requires Initial Investment |
| INSTANT_ACCESS | 0.000 | Possible porn - Offers Instant Access |
| INTL_DRIVERS_LICENSE | 2.900 | International driving license |
| INTL_EXEC_GUILD | 0.000 | Well known spam senders |
| INVALID_DATE | 0.594 | Invalid Date: header (not RFC 2822) |
| INVALID_DATE_TZ_ABSURD | 4.400 | Invalid Date: header (timezone does not exist) |
| INVALID_MSGID | 0.342 | Message-Id is not valid, according to RFC 2822 |
| INVALUABLE_MARKETING | 2.900 | Invaluable marketing information |
| IN_ACCORDANCE_WITH_LAWS | 0.000 | Claims to be in accordance with some Spam law |
| IN_REP_TO | -0.498 | Has a In-Reply-To header |
| ITS_LEGAL | 1.679 | Claims to be Legal |
| JAVASCRIPT_URI | 0.000 | Javascript protocol in a URI |
| JODY | 2.900 | Contains "My wife, Jody" testimonial |
| JOIN_MILLIONS | 2.599 | Join Millions of Americans |
| KIFF | 2.900 | Contains "Temple Kiff" |
| KNOWN_MAILING_LIST | -0.536 | Email came from some known mailing list software |
| KOREAN_UCE_SUBJECT | 4.400 | Subject: contains Korean unsolicited email tag |
| LARGE_COLLECTION | 0.000 | Possible porn - Large Number of movies, pics |
| LARGE_HEX | 1.151 | Contains a large block of hexadecimal code |
| LESBIAN | 1.331 | Possible porn - Lesbian Site |
| LIMITED_TIME_ONLY | 0.324 | Offers a limited time offer |
| LINES_OF_YELLING | 0.000 | A WHOLE LINE OF YELLING DETECTED |
| LINES_OF_YELLING_2 | 0.000 | 2 WHOLE LINES OF YELLING DETECTED |
| LINES_OF_YELLING_3 | 0.000 | 3 WHOLE LINES OF YELLING DETECTED |
| LINK_TO_NO_SCHEME | 0.000 | Contains link without http:// prefix |
| LIVE_PORN | 1.560 | Possible porn - Live Porn |
| LONG_DISTANCE | 2.477 | Long Distance Phone Offer |
| LOSE_POUNDS | 4.300 | Subject talks about losing pounds |
| LOTS_OF_CC_LINES | 2.900 | Lots and lots of Cc: headers |
| LOTS_OF_STUFF | 0.000 | Thousands or millions of pics/movies/etc |
| LOW_INTEREST | 1.525 | Lower Interest Rates |
| LOW_PAYMENT | 1.975 | Lower Monthly Payment |
| LOW_PRICE | 0.525 | Lowest Price |
| LUXURY_CAR | 0.000 | Luxury Car |
| LYING_EYES | 0.755 | Will not Believe your Eyes! |
| MAILER_DAEMON | 0.000 | From the Mailer-Daemon |
| MAILMAN_CONFIRM | 0.000 | A MailMan confirm-your-address message |
| MAILMAN_REMINDER | -1.006 | Mail headers indicate a mailman membership reminder |
| MAILTO_LINK | 0.100 | Includes a URL link to send an email |
| MAILTO_TO_B2BMAIL | 2.900 | Includes a link to a likely spammer email address (b2b-mail) |
| MAILTO_TO_REMOVE | 0.274 | Includes a 'remove' email address |
| MAILTO_TO_SPAM_ADDR | 0.606 | Includes a link to a likely spammer email address |
| MAILTO_WITH_SUBJ | 0.347 | Includes a link to send a mail with a subject |
| MAILTO_WITH_SUBJ_REMOVE | 1.101 | mailto URI includes removal text |
| MAIL_IN_ORDER_FORM | 0.701 | Contains mail-in order form |
| MAJORDOMO | -0.317 | From Majordomo |
| MANY_EXCLAMATIONS | 1.091 | Subject has many exclamations |
| MANY_FROMS | 0.000 | 'From' contains more than one address |
| MARKETING | 0.000 | Direct Marketing |
| MARKETING_PARTNERS | 2.080 | Claims you registered with some kind of partner |
| MARKET_SOLUTION | 2.095 | Marketing Solutions |
| MARKUP_RAND | 2.900 | RAND found, spammer forgot to run the random-ID generator |
| MARKUP_SSPL | 0.000 | SSPL found, spammer forgot to run the random-ID generator |
| MASS_EMAIL | 0.000 | Talks about mass email |
| MDAEMON_2_7_4 | 2.900 | Received via buggy SMTP server (MDaemon 2.7.4SP4R) |
| MEET_SINGLES | 2.796 | Meet Singles |
| MEGA_SITE | 2.900 | Possible porn - Mega Porn |
| MICROSOFT | 0.790 | Message has microsoft header |
| MICROSOFT_EXECUTABLE | 0.100 | Message includes Microsoft executable program |
| MICRO_CAP_WARNING | 2.900 | SEC-mandated penny-stock warning -- thanks SEC |
| MILLION_EMAIL | 2.896 | Get a million email addresses |
| MILLION_USD | 0.990 | Nigerian scam key phrase (millions of dollars) |
| MIME_BOUND_DASH_DIGIT | 1.579 | Spam tool pattern in MIME boundary |
| MIME_BOUND_DIGITS_4 | 2.030 | Spam tool pattern in MIME boundary |
| MIME_BOUND_DIGITS_7 | 2.900 | Spam tool pattern in MIME boundary |
| MIME_BOUND_HASHES | 2.900 | Spam tool pattern in MIME boundary |
| MIME_BOUND_HEX_24 | 2.154 | Spam tool pattern in MIME boundary |
| MIME_BOUND_MA | 0.145 | Spam tool pattern in MIME boundary |
| MIME_BOUND_MAIL_BOUND | 2.900 | Spam tool pattern in MIME boundary |
| MIME_BOUND_MANY_HEX | 2.900 | Spam tool pattern in MIME boundary |
| MIME_BOUND_NEXTPART | 0.426 | Spam tool pattern in MIME boundary |
| MIME_BOUND_OPTIN | 2.900 | Spam tool pattern in MIME boundary |
| MIME_BOUND_RKFINDY | 2.157 | Spam tool pattern in MIME boundary (rfkindy) |
| MIME_BOUND_TEP | 2.900 | Spam tool pattern in MIME boundary |
| MIME_CHARSET_FARAWAY | 2.450 | MIME character set indicates foreign language |
| MIME_DEFICIENT_QP | 2.300 | Deficient quoted-printable encoding in body |
| MIME_EXCESSIVE_QP | 0.000 | Excessive quoted-printable encoding in body |
| MIME_HEADER_CTYPE_ONLY | 1.309 | 'Content-Type' found without required MIME headers |
| MIME_HTML_NO_CHARSET | 0.638 | Message text in HTML without specified charset |
| MIME_HTML_ONLY | 0.100 | Message only has text/html MIME parts |
| MIME_LONG_LINE_QP | 0.261 | Quoted-printable line longer than 76 characters |
| MIME_MISSING_BOUNDARY | 0.501 | MIME section missing boundary |
| MIME_ODD_CASE | 4.400 | MiME-Version header (oddly capitalized) |
| MIME_SUSPECT_NAME | 0.100 | MIME filename does not match content |
| MISSING_HEADERS | 1.140 | Missing To: header |
| MISSING_MIMEOLE | 0.501 | Message has X-MSMail-Priority, but no X-MimeOLE |
| MISSING_OUTLOOK_NAME | 0.100 | Message looks like Outlook, but isn't |
| MLM | 0.822 | Multi Level Marketing mentioned |
| MONEY_BACK | 0.718 | Money back guarantee |
| MONEY_MAKING | 1.557 | Discusses money making |
| MONSTERHUT | 0.000 | Mentions monsterhut.com |
| MORE_TRAFFIC | 0.000 | More Internet Traffic |
| MORTGAGE_BEST | 1.101 | Information on mortgages |
| MORTGAGE_NETWORK | 2.900 | Something about a mortgage network |
| MORTGAGE_PITCH | 0.828 | Looks like mortgage pitch |
| MORTGAGE_RATES | 0.500 | Information on mortgage rates |
| MORTGAGE_WAITING | 2.900 | Something about waiting for mortgages |
| MSGID_3_DOLLARS | 2.900 | Message-Id generated by spam tool (3-dollars variant) |
| MSGID_4NUMS_DOLLAR | 2.900 | Message-Id generated by spam tool (4-num-dollar variant) |
| MSGID_CHARS_SPAM | 0.218 | Message-Id has characters indicating spam |
| MSGID_GOOD_EXCHANGE | -0.498 | Message-Id indicates the message was sent from MS Exchange |
| MSGID_HAS_NO_AT | 0.100 | Message-Id has no @ sign |
| MSGID_NO_HOST | 2.796 | Message-Id has no hostname |
| MSGID_OE_SPAM_4ZERO | 2.129 | Message-Id generated by spam tool (4-zeroes variant) |
| MSGID_OUTLOOK_TIME | 4.500 | Message-Id is fake (in Outlook Express format) |
| MSGID_SPAMSIGN_1 | 2.900 | Message-Id generated by a spam tool |
| MSGID_SPAMSIGN_6LETTER | 4.400 | Message-Id generated by spam tool (6-letter variant) |
| MSGID_SPAMSIGN_ZEROES | 4.400 | Message-Id generated by spam tool (zeroes variant) |
| MSG_ID_ADDED_BY_MTA_2 | 1.026 | 'Message-Id' was added by a relay (2) |
| MSG_ID_ADDED_BY_MTA_3 | 0.501 | 'Message-Id' was added by a relay (3) |
| MSN_FOOTER1 | 0.000 | Common footer for MSN |
| MSN_GROUPS | 0.000 | Came from MSN Communities |
| MULTI_FORGED | 4.300 | Received headers indicate multiple forgeries |
| MURKOWSKI_CRUFT | 0.000 | Old Murkowski disclaimer |
| MUST_BE_18 | 1.705 | Possible porn - Must be 18 |
| NASTY_GIRLS | 2.896 | Possible porn - Nasty Girls |
| NATURAL_VIAGRA | 0.000 | Plugs "Natural Viagra" |
| NEVER_ANOTHER | 2.900 | "another mailing" will "never" be "received" |
| NEW_CUSTOMER | 1.925 | New Customers Only |
| NEW_DOMAIN_EXTENSIONS | 2.053 | Possible registry spammer |
| NIGERIAN_BODY | 2.896 | Message body has multiple indications of Nigerian spam |
| NIGERIAN_SUBJECT1 | 2.900 | Subject is indicative of a Nigerian spam |
| NIGERIAN_SUBJECT2 | 2.497 | Subject is indicative of a Nigerian spam |
| NIGERIAN_SUBJECT6 | 2.900 | Subject is indicative of a Nigerian spam |
| NONEXISTENT_CHARSET | 2.900 | Character set doesn't exist |
| NORMAL_HTTP_TO_IP | 0.902 | Uses a dotted-decimal IP address in URL |
| NOT_ADVISOR | 2.900 | Not registered investment advisor |
| NOT_INTENDED | 2.900 | Not intended for residents of somewhere or other |
| NOT_MLM | 2.900 | Apparently, NOT Multi Level Marketing |
| NO_AGE | 1.959 | No Age Restrictions |
| NO_CATCH | 2.900 | There is no catch |
| NO_COST | 1.017 | No such thing as a free lunch (3) |
| NO_CREDIT_CHECK | 2.900 | No Credit Check |
| NO_DISAPPOINTMENT | 0.125 | You won't be "disappointed" |
| NO_DNS_FOR_FROM | 0.000 | Domain in From header has no MX or A DNS records |
| NO_EXPERIENCE | 1.443 | No experience needed! |
| NO_FEE | 0.506 | No Fees |
| NO_FORMS | 2.530 | No Claim Forms |
| NO_GIMMICK | 0.000 | No Gimmick |
| NO_INVENTORY | 2.899 | No Inventory |
| NO_INVESTMENT | 2.796 | No Investment |
| NO_MEDICAL | 2.900 | No Medical Exams |
| NO_MIDDLEMAN | 0.000 | No Middleman |
| NO_OBLIGATION | 0.000 | There is no obligation |
| NO_PURCHASE | 0.267 | No Purchase Necessary |
| NO_QS_ASKED | 0.147 | Doesn't ask any questions |
| NO_REAL_NAME | 0.993 | From: does not include a real name |
| NO_SELLING | 0.000 | Claims not to be selling anything |
| NO_STRINGS | 2.092 | No Strings Attached |
| NUMERIC_HTTP_ADDR | 1.134 | Uses a numeric IP address in URL |
| OBFUSCATING_COMMENT | 3.121 | HTML comments which obfuscate text |
| OBSCURED_EMAIL | 2.896 | Message seems to contain obscured email address (rot13) |
| OFFER | 0.100 | Free Offer |
| OFFERS_ETC | 0.337 | Stop with the offers, coupons, discounts etc! |
| OFFSHORE_SCAM | 1.057 | Off Shore Scams |
| ONCE_IN_LIFETIME | 0.000 | Once in a lifetime, apparently |
| ONE_TIME | 0.000 | One Time Rip Off |
| ONE_TIME_MAILING | 1.480 | "one time mailing" doesn't mean it isn't spam |
| ONLINE_BIZ_OPS | 2.900 | Wants you to do business online |
| ONLINE_PHARMACY | 2.681 | Online Pharmacy |
| ONLY_COST | 0.000 | Only $$$ |
| OPPORTUNITY | 1.101 | Gives information about an opportunity |
| OPPORTUNITY_2 | 1.067 | Opportunity - What a deal! |
| OPT_HEADER | 2.553 | Headers include an "opt"ed phrase |
| OPT_IN | 1.260 | Talks about opting in (lowercase version) |
| OPT_IN_CAPS | 0.535 | Talks about opting in (capitalized version) |
| OPT_OUT | 1.225 | Talks about opting out (lowercase version) |
| OPT_OUT_CAPS | 1.434 | Talks about opting out (capitalized version) |
| ORDER_NOW | 0.000 | Encourages you to waste no time in ordering |
| ORDER_REPORT | 2.900 | Order a report from someone |
| ORIGINAL_MESSAGE | -0.498 | Looks like a reply to a message |
| OUR_AFFILIATE_PARTNERS | 2.900 |