While I'm posting frequencies -- here's the current freqs for testing rules, including the net ones.
41.629 63.7757 0.0379 0.999 1.00 0.01 T_RCVD_IN_XBL XBL rocks. Totally promoteable. 39.524 60.5284 0.0758 0.999 0.99 0.01 T_MPART_ALT_DIFF_96 39.510 60.5083 0.0758 0.999 0.99 0.01 T_MPART_ALT_DIFF_97 39.471 60.4478 0.0758 0.999 0.99 0.01 T_MPART_ALT_DIFF_98 39.431 60.3873 0.0758 0.999 0.99 0.01 T_MPART_ALT_DIFF_99 39.537 60.5284 0.1136 0.998 0.99 0.01 T_MPART_ALT_DIFF_95 39.576 60.5284 0.2273 0.996 0.99 0.01 T_MPART_ALT_DIFF_90 This also rocks. Thanks Theo! BTW the 2 FP messages for T_MPART_ALT_DIFF_96 are both from 1 e-commerce site; I can send 'em on if you like. 11.700 0.3025 33.1061 0.009 0.93 -0.10 T_SPF_HELO_PASS 5.633 8.6325 0.0000 1.000 0.93 0.01 T_NETIP_BOUND 5.594 8.5720 0.0000 1.000 0.93 0.01 T_XORIGIP_INVALID 5.528 8.4712 0.0000 1.000 0.93 0.01 T_BAYESBUSTER_LINE_12 5.357 8.2090 0.0000 1.000 0.93 0.01 T_BAYESBUSTER_LINE_15 5.357 8.2090 0.0000 1.000 0.93 0.01 T_BAYESBUSTER_LINE_15I 1.685 2.5817 0.0000 1.000 0.92 0.01 T_NETIP_RCVD all catching the "Darmok at Tenagra" spammer. 1.711 0.0000 4.9242 0.000 0.92 -0.10 T_SPF_PASS 1.277 1.9564 0.0000 1.000 0.92 0.01 T_ENTITY_ALPHANUM_R 1.277 1.9564 0.0000 1.000 0.92 0.01 T_ENTITY_ALPHANUM_M 1.132 1.7346 0.0000 1.000 0.92 0.01 T_RATWARE_0_TZ_1 1.000 1.5329 0.0000 1.000 0.92 0.01 T_ENTITY_OTHER2_M 1.000 1.5329 0.0000 1.000 0.92 0.01 T_ENTITY_OTHER2_R 0.842 1.2908 0.0000 1.000 0.92 0.01 T_RATWARE_0_TZ_2 0.698 1.0690 0.0000 1.000 0.92 0.01 T_MSGID_DOLLARS_1 0.698 1.0690 0.0000 1.000 0.92 0.01 T_MSGID_DOLLARS_2 0.698 1.0690 0.0000 1.000 0.92 0.01 T_MSGID_DOLLARS_3 0.684 1.0488 0.0000 1.000 0.92 0.01 T_ENTITY_WHITESPACE_R 0.684 1.0488 0.0000 1.000 0.92 0.01 T_ENTITY_WHITESPACE_M 0.645 0.9883 0.0000 1.000 0.92 0.01 T_ENTITY_OTHER1_R 0.645 0.9883 0.0000 1.000 0.92 0.01 T_ENTITY_OTHER1_M 0.474 0.7261 0.0000 1.000 0.92 0.01 T_SPRINTF_5X 0.408 0.6253 0.0000 1.000 0.92 0.01 T_HTML_TITLE_UNTITLED_2 0.329 0.5042 0.0000 1.000 0.91 0.01 T_RATWARE_OE_DM 0.329 0.5042 0.0000 1.000 0.91 0.01 T_USERNAME_IN_SUBJECT1 0.303 0.4639 0.0000 1.000 0.91 0.01 T_RATWARE_MIME_844412 0.290 0.4437 0.0000 1.000 0.91 0.01 T_RATWARE_GECKO_BUILD 0.263 0.4034 0.0000 1.000 0.91 0.01 T_RATWARE_GECKO_NO_LANG 0.250 0.3832 0.0000 1.000 0.91 0.01 T_RATWARE_0_TZ_3 0.224 0.3429 0.0000 1.000 0.91 0.01 T_RATWARE_0_TZ_4 0.197 0.3025 0.0000 1.000 0.91 0.01 T_HTML_FONT_TINY 0.197 0.3025 0.0000 1.000 0.91 0.01 T_RATWARE_0_TZ_5 0.145 0.2219 0.0000 1.000 0.91 0.01 T_HTML_TITLE_MISPLACED_M2 0.145 0.2219 0.0000 1.000 0.91 0.01 T_FAKE_OUTBLAZE_RCVD 0.145 0.2219 0.0000 1.000 0.91 0.01 T_HTML_TITLE_MISPLACED_4 0.118 0.1815 0.0000 1.000 0.91 0.01 T_HTML_TITLE_MISPLACED_2 0.092 0.1412 0.0000 1.000 0.91 0.01 T_USERNAME_IN_SUBJECT2 0.092 0.1412 0.0000 1.000 0.91 0.01 T_HTML_TITLE_EXTRA 0.092 0.1412 0.0000 1.000 0.91 0.01 T_USERNAME_IN_SUBJECT3 0.079 0.1210 0.0000 1.000 0.91 0.01 T_FAKE_FROM_ALTAVISTA 0.066 0.1008 0.0000 1.000 0.91 0.01 T_MID_RCVD_DIFF_AOL 0.053 0.0807 0.0000 1.000 0.91 0.01 T_RATWARE_0_TZ_6 0.053 0.0807 0.0000 1.000 0.91 0.01 T_FAKE_REPTO_ALTAVISTA 0.039 0.0605 0.0000 1.000 0.91 0.01 T_FROM_DELPHI_BASIC 0.039 0.0605 0.0000 1.000 0.91 0.01 T_FROM_DELPHI 0.039 0.0605 0.0000 1.000 0.91 0.01 T_HTML_TITLE_MISPLACED_1 0.039 0.0605 0.0000 1.000 0.91 0.01 T_MID_RCVD_DIFF_HOTMAIL 0.039 0.0605 0.0000 1.000 0.91 0.01 T_PORN_URL_SEX 0.026 0.0403 0.0000 1.000 0.91 0.01 T_URI_UNPRINTABLE 0.026 0.0403 0.0000 1.000 0.91 0.01 T_YAHOO_REDIR 0.026 0.0403 0.0000 1.000 0.91 0.01 T_RATWARE_0_TZ_7 0.013 0.0202 0.0000 1.000 0.91 0.01 T_KOREAN_UCE_SUBJECT 0.013 0.0202 0.0000 1.000 0.91 0.01 T_HTML_TITLE_MISPLACED_3 0.013 0.0202 0.0000 1.000 0.91 0.01 T_PORN_URL_MISC 0.013 0.0202 0.0000 1.000 0.91 0.01 T_HTML_TITLE_MISPLACED_M1 0.013 0.0202 0.0000 1.000 0.91 0.01 T_ENTITY_WHITESPACE_B 0.013 0.0202 0.0000 1.000 0.91 0.01 T_MSN_REDIR 4.804 7.3417 0.0379 0.995 0.91 0.01 T_HTML_TITLE_UNTITLED_3 4.396 6.7164 0.0379 0.994 0.91 0.01 T_HTML_TITLE_UNTITLED_1 0.592 0.0605 1.5909 0.037 0.82 -0.01 T_ALL_TRUSTED 4.435 6.5954 0.3788 0.946 0.78 0.01 T_RCVD_NUMERIC_HELO Interestingly, this is usually a very reliable spamsign; an unprotected IP address (no "[" or "]") used as a HELO. these are all caused by the very first line in Received, so excluding that from the test may help. 3.751 5.3449 0.7576 0.876 0.62 0.01 T_HTML_TITLE_EMPTY 0.092 0.1210 0.0379 0.762 0.40 0.01 T_PORN_URL_XXX 0.000 0.0000 0.0000 0.500 0.11 0.10 T_HASHCASH_2SPEND 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_PANT 0.000 0.0000 0.0000 0.500 0.11 0.10 T_RCVD_IN_SORBS_BADCONF 0.000 0.0000 0.0000 0.500 0.11 -3.00 T_HASHCASH_24 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_SUCK 0.000 0.0000 0.0000 0.500 0.11 0.10 T_RCVD_IN_SORBS_NOMAIL 0.000 0.0000 0.0000 0.500 0.11 -1.00 T_HASHCASH_22 0.000 0.0000 0.0000 0.500 0.11 0.01 T_RE_UC_3WORDS 0.000 0.0000 0.0000 0.500 0.11 0.01 T_RANDO_MIZE 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_CUM 0.000 0.0000 0.0000 0.500 0.11 -0.50 T_HASHCASH_20 0.000 0.0000 0.0000 0.500 0.11 0.10 T_SPF_SOFTFAIL 0.000 0.0000 0.0000 0.500 0.11 0.10 T_SPF_HELO_SOFTFAIL 0.000 0.0000 0.0000 0.500 0.11 0.01 T_RNDMX 0.000 0.0000 0.0000 0.500 0.11 0.01 T_FAKE_TO_ALTAVISTA 0.000 0.0000 0.0000 0.500 0.11 0.01 T_RCVD_IN_PDL 0.000 0.0000 0.0000 0.500 0.11 -2.00 T_HASHCASH_23 0.000 0.0000 0.0000 0.500 0.11 0.01 T_DATE_DOUBLE_DASH 0.000 0.0000 0.0000 0.500 0.11 0.01 T_DATE_EXTRA_SPACE 0.000 0.0000 0.0000 0.500 0.11 0.01 T_ENTITY_OTHER2_B 0.000 0.0000 0.0000 0.500 0.11 -4.00 T_HASHCASH_25 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_TEEN 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_LUST 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_ANAL 0.000 0.0000 0.0000 0.500 0.11 0.01 T_REF_ID 0.000 0.0000 0.0000 0.500 0.11 0.01 T_ENTITY_OTHER1_B 0.000 0.0000 0.0000 0.500 0.11 -0.70 T_HASHCASH_21 0.000 0.0000 0.0000 0.500 0.11 0.01 T_FROM_EUDORA 0.000 0.0000 0.0000 0.500 0.11 0.01 T_PORN_URL_SLUT 0.000 0.0000 0.0000 0.500 0.11 0.01 T_RATWARE_2089 0.000 0.0000 0.0000 0.500 0.11 0.01 T_FAKE_ENVFROM_ALTAVISTA 0.000 0.0000 0.0000 0.500 0.11 0.01 T_ENTITY_ALPHANUM_B 0.000 0.0000 0.0000 0.500 0.11 0.01 T_FAKE_ERRSTO_ALTAVISTA 0.000 0.0000 0.0000 0.500 0.11 -5.00 T_HASHCASH_26 0.000 0.0000 0.0000 0.500 0.11 0.01 T_FAKE_OUTBLAZE_MID 1.593 1.3514 2.0455 0.398 0.06 0.01 T_MSGID_DOLLARS_4 3.304 2.5010 4.8106 0.342 0.04 0.20 T_SPF_FAIL 0.053 0.0202 0.1136 0.151 0.00 0.01 T_TIME_OVER_4444 2.659 0.0000 7.6515 0.000 0.00 0.20 T_SPF_HELO_FAIL --j.
