 looks like your ham corpus by and large has to jeremy URL in a header while your spam corpus by and large doesn t but this one does interestingly for me one of the highest value spam indicators was the name of the mail host that the spam was delivered to in the to line so mail to info URL was pretty much a dead cert for the filters anthony baxter anthony interlink com au it s never too late to have a happy childhood 