Ways to trick the lexer
Andreas Pardeike
andreas at pardeike.net
Sat Jun 9 11:00:11 CEST 2007
On 9 jun 2007, at 01.24, David Relson wrote:
> The cunning trick tends to be a one-time success. After you train
> with
> such a message, the next time "SEIX8UALLY" appears in a Subject
> line it
> is known to bogofilter as spam. I think of it as being a red flag
> saying "look at me, I'm spam".
My point was that I get spam that substitutes most key words with
words that contain random character replacements. If I look at the
last say 50-100 spams of category "sexually explicit" I can see that
there isn't a single repetition of SEIX8UALLY.
I compared the messages and very very little is common in them. They
have
- different subjects (except that they all look *similar*
- different IP's and subnets
- the non common header lines are different too
- the payload is different in every word
- they contain truly random text (about 2 lines) at the end of
the message
I doubt that training has such an effect. It started about a month ago
and grew to such extend that I doubted the state of my db. So I erased
the db and started over freshly a week ago. Since then, I have not seen
any improvement.
Here are two examples, freshly from my INBOX this morning (followed by
the output of bogofilter -vv / -vvv):
------------------------------------------------------------------------
-------------
Received: from MARIELAJUAN ([24.138.201.172])
by mail.roundline.net (8.13.4/8.13.4) with ESMTP id l58MBNvI002718
for <info at loops.twosailors.net>; Sat, 9 Jun 2007 00:11:25 +0200
Received: from babyfeel (cardsfunny.sadlyraysays.com [135.121.172.180])
by mail.mail.com (Postfix) with ESMTP id placepaid
for <info at loops.twosailors.net>; Fri, 08 Jun 2007 18:59:56
+0100
Received: by wr-out-0506.mail.com with SMTP id enmby3xxixw4
for <info at loops.twosailors.net>; Fri, 08 Jun 2007 18:59:56
+0100 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed;
d=mail.com; s=beta;
h=domainkey-signature:received:received:message-
id:date:from:sender:to:subject:mime-version:content-type:x-google-
sender-auth;
b=qlfmJ8X+29HjSTGbCB/
gvpnlSzmGMKMpZh1m1pHELznc3ny5WLQXuPuAnaJD9j/
9pbOxrN5s5y4wVCEGkuefBqQdhar0fkJB6O8/t3H1
+cT8m55lsSDWMDB8Yd4n4LQaFcpNmLJZsUKsUE5iWy6QoAJoKUuoeWiBuForL02X8wA=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=mail.com; s=beta;
h=received:message-id:date:from:sender:to:subject:mime-
version:content-type:x-google-sender-auth;
b=M/4GxOZ1RMaQ6GoZ/
g4UhFEcvOkM4sOvDCdDSsjBkd49JsiGqUPc0776fU0JRaLhlVnzbgN0aEiO0iizbF6/
wM3mbPcPwLcYw0YwRuuVNIoSzUDE2chawEIJdrdAAWTgOhaZchz5BQoVSBie5PCX/
VQVNRyYP/wBFQ2C+fVqwSw=
Received: by 17.57.43.36 with SMTP id nqjjb8.xiroe6;
Fri, 08 Jun 2007 18:59:56 +0100 (PDT)
Received: by 15.57.48.34 with HTTP; Fri, 08 Jun 2007 18:59:56 +0100
(PDT)
Message-ID: <00005ab58225$bb377e00$acc98a18 at MarielaJuan>
Date: Fri, 08 Jun 2007 18:59:56 +0100
From: Adelaide Alanna <harmevenclock at mail.com>
Sender: roadearssit at mail.com
To: info at loops.twosailors.net
Subject: SEIX2UALLY-E4XPLICITI: steps hiss four cut
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Google-Sender-Auth: ipvuj4
X-Roundline-MailScanner: Found to be clean
X-Bogosity: No, tests=bogofilter, spamicity=0.684388, version=1.1.5
Status: O
X-UID: 20354
Content-Length: 328
X-Keywords:
Hello,
Updated portal with links to 120 p9rn sites:
http://www.geocities.com/Emmelin7qo/index.html?
xwrs=por_silvc_g&c=alongpitch
--------------------------
arms knock glass wow back sharp
hedge rules bookv wears.
busy five, drag sold soft want
Dain't want:
http://www.geocities.com/Emmelin7qo/index.html?ir=nayworse
------------------------------------------------------------------------
-------------
Received: from CPE-60-226-126-81.qld.bigpond.net.au
(CPE-60-226-126-81.qld.bigpond.net.au [60.226.126.81])
by mail.roundline.net (8.13.4/8.13.4) with ESMTP id l593Satk011059
for <info at loops.twosailors.net>; Sat, 9 Jun 2007 05:28:40 +0200
Received: from facehit (findknows.sleptforkifvif.com [132.176.172.131])
by mail.mail.com (Postfix) with ESMTP id immayor
for <info at loops.twosailors.net>; Sat, 09 Jun 2007 14:17:05
+0100
Received: by wr-out-0506.mail.com with SMTP id ciskg1petel2
for <info at loops.twosailors.net>; Sat, 09 Jun 2007 14:17:05
+0100 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed;
d=mail.com; s=beta;
h=domainkey-signature:received:received:message-
id:date:from:sender:to:subject:mime-version:content-type:x-google-
sender-auth;
b=qlfmJ8X+29HjSTGbCB/
gvpnlSzmGMKMpZh1m1pHELznc3ny5WLQXuPuAnaJD9j/
9pbOxrN5s5y4wVCEGkuefBqQdhar0fkJB6O8/t3H1
+cT8m55lsSDWMDB8Yd4n4LQaFcpNmLJZsUKsUE5iWy6QoAJoKUuoeWiBuForL02X8wA=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=mail.com; s=beta;
h=received:message-id:date:from:sender:to:subject:mime-
version:content-type:x-google-sender-auth;
b=M/4GxOZ1RMaQ6GoZ/
g4UhFEcvOkM4sOvDCdDSsjBkd49JsiGqUPc0776fU0JRaLhlVnzbgN0aEiO0iizbF6/
wM3mbPcPwLcYw0YwRuuVNIoSzUDE2chawEIJdrdAAWTgOhaZchz5BQoVSBie5PCX/
VQVNRyYP/wBFQ2C+fVqwSw=
Received: by 11.55.48.38 with SMTP id qlxqo2.rerjv2;
Sat, 09 Jun 2007 14:17:05 +0100 (PDT)
Received: by 15.50.46.32 with HTTP; Sat, 09 Jun 2007 14:17:05 +0100
(PDT)
Message-ID: <000053d215c2$09627680$517ee23c at merlin>
Date: Sat, 09 Jun 2007 14:17:05 +0100
From: Daisy Liana <pluckgavesake at mail.com>
Sender: sizesquietbent at mail.com
To: info at loops.twosailors.net
Subject: SEIX8UALLY-E8XPLICITI: in watch lets good
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Google-Sender-Auth: dvrjg0
X-Roundline-MailScanner: Found to be clean
X-Bogosity: No, tests=bogofilter, spamicity=0.511361, version=1.1.5
Status: O
X-UID: 20368
Content-Length: 324
X-Keywords:
Hello,
Updated portal with links to 120 p9rn sites:
http://www.geocities.com/EliottCaunk/index.html?
nwrs=por_silvc_g&c=axesswim
--------------------------
bad locks ear ada lest sunk
hurt if whose thou.
leave tweet, bring sleep dukes told
Dain't want:
http://www.geocities.com/EliottCaunk/index.html?yr=whotoads
------------------------------------------------------------------------
-------------
And here is the output of bogofilter -vv and -vvv for both messages
# bogofilter -vv < /tmp/spam1.txt
X-Bogosity: No, tests=bogofilter, spamicity=0.483981, version=1.1.5
int cnt prob spamicity histogram
0.00 28 0.019085 0.010994 ############################
0.10 12 0.107619 0.035360 ############
0.20 0 0.000000 0.035360
0.30 0 0.000000 0.035360
0.40 0 0.000000 0.035360
0.50 0 0.000000 0.035360
0.60 0 0.000000 0.035360
0.70 0 0.000000 0.035360
0.80 8 0.890280 0.242869 ########
0.90 7 0.962528 0.434282 #######
# bogofilter -vvv < /tmp/spam1.txt
X-Bogosity: No, tests=bogofilter, spamicity=0.483981, version=1.1.5
n pgood pbad
fw U
"EliottCaunk" 1 0.000766 0.000000
0.009094 +
"axesswim" 1 0.000766 0.000000
0.009094 +
"dukes" 1 0.000766 0.000000
0.009094 +
"from:Liana" 1 0.000766 0.000000
0.009094 +
"from:pluckgavesake" 1 0.000766 0.000000
0.009094 +
"head:dvrjg0" 1 0.000766 0.000000
0.009094 +
"head:sizesquietbent" 1 0.000766 0.000000
0.009094 +
"ip:11.55" 1 0.000766 0.000000
0.009094 +
"ip:11.55.48" 1 0.000766 0.000000
0.009094 +
"ip:11.55.48.38" 1 0.000766 0.000000
0.009094 +
"ip:132.176" 1 0.000766 0.000000
0.009094 +
"ip:132.176.172" 1 0.000766 0.000000
0.009094 +
"ip:132.176.172.131" 1 0.000766 0.000000
0.009094 +
"ip:15.50" 1 0.000766 0.000000
0.009094 +
"ip:15.50.46" 1 0.000766 0.000000
0.009094 +
"ip:15.50.46.32" 1 0.000766 0.000000
0.009094 +
"ip:60.226" 1 0.000766 0.000000
0.009094 +
"ip:60.226.126" 1 0.000766 0.000000
0.009094 +
"ip:60.226.126.81" 1 0.000766 0.000000
0.009094 +
"nwrs" 1 0.000766 0.000000
0.009094 +
"rcvd:facehit" 1 0.000766 0.000000
0.009094 +
"subj:lets" 1 0.000766 0.000000
0.009094 +
"whotoads" 1 0.000766 0.000000
0.009094 +
"head:subject" 952 0.651608 0.025371
0.037485 +
"head:Sender" 796 0.518377 0.029892
0.054531 +
"rcvd:PDT" 730 0.469372 0.029390
0.058936 +
"head:from" 554 0.339204 0.027882
0.075970 +
"rcvd:HTTP" 409 0.235069 0.025622
0.098302 +
"ada" 4 0.002297 0.000251
0.100441 +
"head:content-type" 394 0.224349 0.025371
0.101615 +
"head:mime-version" 394 0.224349 0.025371
0.101615 +
"head:message-id" 394 0.222818 0.025873
0.104055 +
"head:beta" 381 0.214395 0.025371
0.105833 +
"head:domainkey-signature" 381 0.214395 0.025371
0.105833 +
"head:received" 381 0.214395 0.025371
0.105833 +
"head:DKIM-Signature" 385 0.215161 0.026124
0.108290 +
"head:relaxed" 385 0.215161 0.026124
0.108290 +
"ip:11" 28 0.015314 0.002010
0.116258 +
"head:date" 405 0.221286 0.029138
0.116374 +
"head:sender" 372 0.202910 0.026878
0.116987 +
"rcvd:Postfix" 711 0.363706 0.059282
0.140159 -
"head:nofws" 596 0.242726 0.070083
0.224053 -
"head:DomainKey-Signature" 601 0.243492 0.071088
0.225986 -
"head:rsa-sha1" 588 0.236600 0.070083
0.228528 -
"rcvd:ESMTP" 3006 0.973201 0.435820
0.309308 -
"links" 92 0.029096 0.013564
0.317998 -
"head:plain" 2306 0.707504 0.347149
0.329161 -
"head:bit" 2563 0.706738 0.411957
0.368249 -
"hurt" 23 0.006126 0.003768
0.380954 -
"head:Content-Transfer-Encoding" 2684 0.706738 0.442351
0.384959 -
"head:text" 2877 0.740429 0.479779
0.393195 -
"head:charset" 2697 0.687596 0.451897
0.396578 -
"from:Daisy" 3 0.000766 0.000502
0.396908 -
"lest" 3 0.000766 0.000502
0.396908 -
"subj:SEIX8UALLY-E8XPLICITI" 3 0.000766 0.000502
0.396908 -
"tweet" 3 0.000766 0.000502
0.396908 -
"whose" 49 0.011485 0.008541
0.426508 -
"want" 789 0.181470 0.138659
0.433136 -
"with" 2342 0.496172 0.425521
0.461674 -
"ip:15" 11 0.002297 0.002010
0.466702 -
"sleep" 19 0.003828 0.003517
0.478815 -
"http" 4063 0.815467 0.753077
0.480112 -
"rcvd:Jun" 5287 1.057427 0.981161
0.481294 -
"rcvd:for" 4876 0.957887 0.910575
0.487340 -
"bring" 67 0.013017 0.012560
0.491070 -
"Hello" 306 0.058959 0.057523
0.493840 -
"head:X-Roundline-MailScanner" 5287 1.003063 0.998995
0.498984 -
"head:Date" 5270 0.998469 0.996232
0.499439 -
"head:Found" 5287 1.001531 0.999498
0.499492 -
"rcvd:mail.roundline.net" 5287 1.001531 0.999498
0.499492 -
"head:clean" 5285 1.000000 0.999498
0.499874 -
"rcvd:from" 5287 1.000000 1.000000
0.500000 -
"rcvd:with" 5287 1.000000 1.000000
0.500000 -
"head:Content-Type" 5101 0.956355 0.967596
0.502921 -
"rcvd:SMTP" 3592 0.624809 0.697312
0.527419 -
"ip:132" 5 0.000766 0.001005
0.567349 -
"thou" 5 0.000766 0.001005
0.567349 -
"locks" 10 0.001531 0.002010
0.567433 -
"head:Message-ID" 4238 0.611792 0.863853
0.585407 -
"Updated" 38 0.005360 0.007787
0.592274 -
"head:MIME-Version" 4253 0.594946 0.873147
0.594749 -
"head:X-Google-Sender-Auth" 119 0.015314 0.024868
0.618871 -
"Dain't" 26 0.003063 0.005526
0.643323 -
"p9rn" 26 0.003063 0.005526
0.643323 -
"bad" 137 0.016080 0.029138
0.644382 -
"rcvd:Sat" 317 0.036753 0.067571
0.647693 -
"index.html" 161 0.018377 0.034413
0.651877 -
"portal" 41 0.004594 0.008792
0.656731 -
"to:info" 206 0.022971 0.044210
0.658062 -
"subj:watch" 7 0.000766 0.001507
0.662749 -
"sites" 191 0.020674 0.041196
0.665834 -
"leave" 103 0.009954 0.022607
0.694269 -
"head:iso-8859-1" 703 0.065084 0.155237
0.704590 -
"sunk" 9 0.000766 0.002010
0.723694 -
"head:x-google-sender-auth" 111 0.009188 0.024868
0.730169 -
"head:mail.com" 138 0.009954 0.031399
0.759261 -
"subj:good" 35 0.002297 0.008038
0.777612 -
"told" 245 0.016080 0.056267
0.777724 -
"rcvd:mail.mail.com" 49 0.003063 0.011304
0.786713 -
"rcvd:info" 210 0.013017 0.048480
0.788311 -
"rcvd:loops.twosailors.net" 37 0.001531 0.008792
0.851495 -
"to:loops.twosailors.net" 37 0.001531 0.008792
0.851495 -
"ear" 19 0.000766 0.004521
0.854865 -
"por_silvc_g" 78 0.003063 0.018588
0.858462 -
"head:GxOZ1RMaQ6GoZ" 103 0.003063 0.024868
0.890280 +
"head:HjSTGbCB" 103 0.003063 0.024868
0.890280 +
"head:VQVNRyYP" 103 0.003063 0.024868
0.890280 +
"head:fVqwSw" 103 0.003063 0.024868
0.890280 +
"head:qlfmJ8X" 103 0.003063 0.024868
0.890280 +
"head:t3H1" 103 0.003063 0.024868
0.890280 +
"head:wBFQ2C" 103 0.003063 0.024868
0.890280 +
"rcvd:wr-out-0506.mail.com" 103 0.003063 0.024868
0.890280 +
"ip:60" 62 0.001531 0.015072
0.907653 +
"from:mail.com" 133 0.003063 0.032404
0.913591 +
"www.geocities.com" 138 0.003063 0.033660
0.916546 +
"head:X-UID" 343 0.000000 0.086159
0.999975 +
"head:Status" 357 0.000000 0.089676
0.999976 +
"head:Content-Length" 373 0.000000 0.093695
0.999977 +
"head:X-Keywords" 373 0.000000 0.093695
0.999977 +
N_P_Q_S_s_x_md 55 0.032038 0.000000 0.483981
0.017800 0.520000 0.375000
# bogofilter -vv < /tmp/spam2.txt
X-Bogosity: No, tests=bogofilter, spamicity=0.498241, version=1.1.5
int cnt prob spamicity histogram
0.00 26 0.021502 0.012130 ##########################
0.10 10 0.107448 0.033402 ##########
0.20 0 0.000000 0.033402
0.30 0 0.000000 0.033402
0.40 0 0.000000 0.033402
0.50 0 0.000000 0.033402
0.60 0 0.000000 0.033402
0.70 0 0.000000 0.033402
0.80 8 0.890256 0.249729 ########
0.90 9 0.955717 0.450718 #########
# bogofilter -vvv < /tmp/spam2.txt
X-Bogosity: No, tests=bogofilter, spamicity=0.498241, version=1.1.5
n pgood pbad
fw U
"Emmelin7qo" 1 0.000766 0.000000
0.009094 +
"alongpitch" 1 0.000766 0.000000
0.009094 +
"from:Adelaide" 1 0.000766 0.000000
0.009094 +
"from:harmevenclock" 1 0.000766 0.000000
0.009094 +
"head:ipvuj4" 1 0.000766 0.000000
0.009094 +
"head:roadearssit" 1 0.000766 0.000000
0.009094 +
"ip:135.121" 1 0.000766 0.000000
0.009094 +
"ip:135.121.172" 1 0.000766 0.000000
0.009094 +
"ip:135.121.172.180" 1 0.000766 0.000000
0.009094 +
"ip:15.57.48" 1 0.000766 0.000000
0.009094 +
"ip:15.57.48.34" 1 0.000766 0.000000
0.009094 +
"ip:17.57.43" 1 0.000766 0.000000
0.009094 +
"ip:17.57.43.36" 1 0.000766 0.000000
0.009094 +
"ip:24.138.201" 1 0.000766 0.000000
0.009094 +
"ip:24.138.201.172" 1 0.000766 0.000000
0.009094 +
"nayworse" 1 0.000766 0.000000
0.009094 +
"rcvd:MARIELAJUAN" 1 0.000766 0.000000
0.009094 +
"rcvd:babyfeel" 1 0.000766 0.000000
0.009094 +
"subj:SEIX2UALLY-E4XPLICITI" 1 0.000766 0.000000
0.009094 +
"subj:hiss" 1 0.000766 0.000000
0.009094 +
"head:subject" 952 0.651608 0.025364
0.037476 +
"ip:17" 363 0.238132 0.013059
0.052010 +
"head:Sender" 796 0.518377 0.029884
0.054518 +
"rcvd:PDT" 730 0.469372 0.029382
0.058922 +
"head:from" 554 0.339204 0.027875
0.075953 +
"rcvd:HTTP" 409 0.235069 0.025615
0.098280 +
"head:content-type" 394 0.224349 0.025364
0.101592 +
"head:mime-version" 394 0.224349 0.025364
0.101592 +
"head:message-id" 394 0.222818 0.025866
0.104032 +
"head:beta" 381 0.214395 0.025364
0.105809 +
"head:domainkey-signature" 381 0.214395 0.025364
0.105809 +
"head:received" 381 0.214395 0.025364
0.105809 +
"head:DKIM-Signature" 385 0.215161 0.026118
0.108266 +
"head:relaxed" 385 0.215161 0.026118
0.108266 +
"head:date" 405 0.221286 0.029131
0.116348 +
"head:sender" 372 0.202910 0.026871
0.116961 +
"rcvd:Postfix" 711 0.363706 0.059267
0.140129 -
"xwrs" 3 0.001531 0.000251
0.143121 -
"drag" 10 0.004594 0.001005
0.180025 -
"wow" 7 0.003063 0.000753
0.198238 -
"head:nofws" 596 0.242726 0.070065
0.224009 -
"head:DomainKey-Signature" 601 0.243492 0.071070
0.225942 -
"head:rsa-sha1" 588 0.236600 0.070065
0.228483 -
"bookv" 2 0.000766 0.000251
0.249383 -
"from:Alanna" 2 0.000766 0.000251
0.249383 -
"ip:15.57" 2 0.000766 0.000251
0.249383 -
"ip:17.57" 2 0.000766 0.000251
0.249383 -
"ip:24.138" 2 0.000766 0.000251
0.249383 -
"subj:cut" 2 0.000766 0.000251
0.249383 -
"subj:four" 2 0.000766 0.000251
0.249383 -
"rules" 28 0.009954 0.003767
0.274695 -
"rcvd:ESMTP" 3007 0.973201 0.435962
0.309378 -
"links" 92 0.029096 0.013561
0.317944 -
"head:plain" 2306 0.707504 0.347062
0.329105 -
"wears" 5 0.001531 0.000753
0.330417 -
"head:bit" 2563 0.706738 0.411853
0.368190 -
"head:Content-Transfer-Encoding" 2684 0.706738 0.442240
0.384899 -
"head:text" 2877 0.740429 0.479658
0.393135 -
"head:charset" 2697 0.687596 0.451783
0.396518 -
"want" 789 0.181470 0.138624
0.433074 -
"with" 2342 0.496172 0.425414
0.461612 -
"ip:15" 11 0.002297 0.002009
0.466640 -
"rcvd:Fri" 1013 0.206738 0.186590
0.474388 -
"http" 4063 0.815467 0.752888
0.480050 -
"rcvd:Jun" 5288 1.057427 0.981165
0.481296 -
"rcvd:for" 4877 0.957887 0.910598
0.487346 -
"Hello" 306 0.058959 0.057509
0.493777 -
"head:X-Roundline-MailScanner" 5288 1.003063 0.998995
0.498984 -
"head:Date" 5271 0.998469 0.996233
0.499440 -
"head:Found" 5288 1.001531 0.999498
0.499492 -
"rcvd:mail.roundline.net" 5288 1.001531 0.999498
0.499492 -
"head:clean" 5286 1.000000 0.999498
0.499874 -
"rcvd:from" 5288 1.000000 1.000000
0.500000 -
"rcvd:with" 5288 1.000000 1.000000
0.500000 -
"head:Content-Type" 5102 0.956355 0.967604
0.502923 -
"rcvd:SMTP" 3592 0.624809 0.697137
0.527357 -
"back" 408 0.065084 0.081115
0.554824 -
"hedge" 5 0.000766 0.001005
0.567288 -
"ip:135" 5 0.000766 0.001005
0.567288 -
"subj:steps" 5 0.000766 0.001005
0.567288 -
"knock" 10 0.001531 0.002009
0.567372 -
"ip:24" 135 0.019908 0.027373
0.578935 -
"head:Message-ID" 4239 0.611792 0.863887
0.585417 -
"Updated" 38 0.005360 0.007785
0.592213 -
"head:MIME-Version" 4254 0.594946 0.873179
0.594758 -
"head:X-Google-Sender-Auth" 119 0.015314 0.024862
0.618812 -
"Dain't" 26 0.003063 0.005525
0.643265 -
"p9rn" 26 0.003063 0.005525
0.643265 -
"rcvd:Sat" 318 0.036753 0.067805
0.648482 -
"index.html" 161 0.018377 0.034405
0.651820 -
"portal" 41 0.004594 0.008790
0.656675 -
"to:info" 206 0.022971 0.044199
0.658005 -
"sites" 191 0.020674 0.041185
0.665779 -
"head:iso-8859-1" 703 0.065084 0.155198
0.704537 -
"five" 87 0.007657 0.019337
0.716305 -
"busy" 61 0.005360 0.013561
0.716664 -
"head:x-google-sender-auth" 111 0.009188 0.024862
0.730119 -
"head:mail.com" 138 0.009954 0.031391
0.759215 -
"rcvd:mail.mail.com" 49 0.003063 0.011301
0.786671 -
"rcvd:info" 210 0.013017 0.048468
0.788269 -
"glass" 35 0.001531 0.008287
0.843868 -
"rcvd:loops.twosailors.net" 37 0.001531 0.008790
0.851463 -
"to:loops.twosailors.net" 37 0.001531 0.008790
0.851463 -
"soft" 56 0.002297 0.013310
0.852711 -
"por_silvc_g" 78 0.003063 0.018584
0.858431 -
"head:GxOZ1RMaQ6GoZ" 103 0.003063 0.024862
0.890256 +
"head:HjSTGbCB" 103 0.003063 0.024862
0.890256 +
"head:VQVNRyYP" 103 0.003063 0.024862
0.890256 +
"head:fVqwSw" 103 0.003063 0.024862
0.890256 +
"head:qlfmJ8X" 103 0.003063 0.024862
0.890256 +
"head:t3H1" 103 0.003063 0.024862
0.890256 +
"head:wBFQ2C" 103 0.003063 0.024862
0.890256 +
"rcvd:wr-out-0506.mail.com" 103 0.003063 0.024862
0.890256 +
"sharp" 33 0.000766 0.008036
0.912796 +
"from:mail.com" 133 0.003063 0.032396
0.913571 +
"sold" 34 0.000766 0.008287
0.915214 +
"www.geocities.com" 138 0.003063 0.033651
0.916526 +
"arms" 52 0.000766 0.012808
0.943443 +
"head:X-UID" 343 0.000000 0.086138
0.999975 +
"head:Status" 357 0.000000 0.089653
0.999976 +
"head:Content-Length" 373 0.000000 0.093672
0.999977 +
"head:X-Keywords" 373 0.000000 0.093672
0.999977 +
N_P_Q_S_s_x_md 53 0.003518 0.000000 0.498241
0.017800 0.520000 0.375000
More information about the Bogofilter
mailing list