diff --git a/manifest.json b/manifest.json
index ac0d392..3f06cb7 100644
--- a/manifest.json
+++ b/manifest.json
@@ -2,7 +2,7 @@
   "manifest_version": 2,
   "name": "__MSG_extensionName__",
   "description": "__MSG_extensionDescription__",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "author": "Christian Zaenker",
   "default_locale": "en",
   "applications": {
diff --git a/popup.js b/popup.js
index 8148788..db60c4e 100644
--- a/popup.js
+++ b/popup.js
@@ -1,3 +1,7 @@
+const SYMBOL_HEADER_REGEX = /(X-.*?(?:Spamd-Result|Spam-Report|SpamCheck|Spam-Status):.*(?:\r?\n(?:\t+ *| +).*)*)/g
+const SYMBOL_PREFIX_REGEX = /\* +(-?[\d.]+)[ \)=]+([A-Z][A-Z0-9_]+)(?:(?:.|\r?\n)+?\[(.*?)\])?/g
+const SYMBOL_SUFFIX_REGEX = /([A-Z][A-Z0-9_]+)(?:(?:[ \(=](-?[\d.]+)\)?(?:\[(.*?)\])?)|, *| )/g
+
 browser.tabs
   .query({
     active: true,
@@ -6,8 +10,9 @@ browser.tabs
   .then(async tabs => {
     let tabId = tabs[0].id
     browser.messageDisplay.getDisplayedMessage(tabId).then(async message => {
-      let rawMessage = await browser.messages.getRaw(message.id)
-      let parsedDetailScores = getParsedDetailScores(rawMessage)
+      const rawMessage = await browser.messages.getRaw(message.id)
+      const rawHeader = rawMessage.split('\r\n\r\n')[0]
+      let parsedDetailScores = getParsedDetailScores(rawHeader)
       if (parsedDetailScores) {
         let groupedDetailScores = {
           positive: parsedDetailScores.filter(el => el.score > 0).sort((a, b) => b.score - a.score),
@@ -43,35 +48,26 @@ browser.tabs
     })
   })
 
-function getParsedDetailScores(raw) {
-  let spamdResultRegex = /([A-Z0-9_]+)\((-?\d+\.\d+)\)\[(.*?)\];?/g
-  let match = raw.match(spamdResultRegex)
-  if (match && match.length > 0) {
-    return match.map(el => ({
-      name: el.replace(spamdResultRegex, '$1'),
-      score: parseFloat(el.replace(spamdResultRegex, '$2')),
-      info: el.replace(spamdResultRegex, '$3') || ''
-    }))
-  }
-  let spamStatusRegex = /([A-Z0-9_]+)=(-?[\d.]+)[,\]]/g
-  match = raw.match(/x-spam-status: .*tests=\[.*?\]/gis)
-  if (match && match.length > 0) {
-    return match[0].match(spamStatusRegex).map(el => ({
-      name: el.replace(spamStatusRegex, '$1'),
-      score: parseFloat(el.replace(spamStatusRegex, '$2')),
-      info: ''
-    }))
-  }
-  if (raw.toLowerCase().indexOf('mailscanner-spamcheck') !== -1) {
-    raw = raw.replace(/.*?x-.*?mailscanner-spamcheck: (.*?)\).*/gis, '$1')
-    let spamMailscannerRegex = /,.*?([A-Z0-9_]+) (-?[\d.]+)/gs
-    match = raw.match(spamMailscannerRegex)
-    if (match && match.length > 0) {
-      return match.map(el => ({
-        name: el.replace(spamMailscannerRegex, '$1'),
-        score: parseFloat(el.replace(spamMailscannerRegex, '$2')),
-        info: ''
-      }))
+function getParsedDetailScores(rawHeader) {
+  let spamHeaderMatch = rawHeader.match(SYMBOL_HEADER_REGEX)
+  if (spamHeaderMatch && spamHeaderMatch.length > 0) {
+    for (let spamHeader of spamHeaderMatch) {
+      let symbolMatch = spamHeader.match(SYMBOL_PREFIX_REGEX)
+      if (symbolMatch && symbolMatch.length > 0) {
+        return symbolMatch.map(el => ({
+          name: el.replace(SYMBOL_PREFIX_REGEX, '$2'),
+          score: parseFloat(el.replace(SYMBOL_PREFIX_REGEX, '$1') || 0),
+          info: el.replace(SYMBOL_PREFIX_REGEX, '$3') || ''
+        }))
+      }
+      symbolMatch = spamHeader.match(SYMBOL_SUFFIX_REGEX)
+      if (symbolMatch && symbolMatch.length > 0) {
+        return symbolMatch.map(el => ({
+          name: el.replace(SYMBOL_SUFFIX_REGEX, '$1'),
+          score: parseFloat(el.replace(SYMBOL_SUFFIX_REGEX, '$2') || 0),
+          info: el.replace(SYMBOL_SUFFIX_REGEX, '$3') || ''
+        }))
+      }
     }
   }
   return null
diff --git a/rspamd_symbols.js b/rspamd_symbols.js
index 07b2cdc..f71b51c 100644
--- a/rspamd_symbols.js
+++ b/rspamd_symbols.js
@@ -1 +1 @@
-const rspamdSymbols = [{"name":"BITCOIN_ADDR","description":"Message has a valid bitcoin wallet address"},{"name":"SUBJ_BOUNCE_WORDS","description":"Words/phrases typical for DNS"},{"name":"BOUNCE","description":"(Non) Delivery Status Notification"},{"name":"SPECIFIC_CONTENT_CHECK","description":"Message was forwarded by Google"},{"name":"FWD_YANDEX","description":"Message was forwarded by Yandex"},{"name":"FWD_MAILRU","description":"Message was forwarded by Mail.ru"},{"name":"FWD_SRS","description":"Message was forwarded using Sender Rewriting Scheme (SRS)"},{"name":"FORWARDED","description":"Message was forwarded"},{"name":"CHECK_RECEIVED","description":"Message has no Received headers"},{"name":"RCVD_COUNT_ZERO","description":"Message has no Received header"},{"name":"RCVD_COUNT_ONE","description":"Message has one Received header"},{"name":"RCVD_COUNT_TWO","description":"Message has two Received headers"},{"name":"RCVD_COUNT_THREE","description":"Message has 3-5 Received headers"},{"name":"RCVD_COUNT_FIVE","description":"Message has 5-7 Received headers"},{"name":"RCVD_COUNT_SEVEN","description":"Message has 7-11 Received headers"},{"name":"RCVD_COUNT_TWELVE","description":"Message has 12 or more Received headers"},{"name":"HAS_X_PRIO","description":"X-Priority check callback rule"},{"name":"HAS_X_PRIO_ZERO","description":"Message has X-Priority header set to 0"},{"name":"HAS_X_PRIO_ONE","description":"Message has X-Priority header set to 1"},{"name":"HAS_X_PRIO_TWO","description":"Message has X-Priority header set to 2"},{"name":"HAS_X_PRIO_THREE","description":"Message has X-Priority header set to 3 or 4"},{"name":"HAS_X_PRIO_FIVE","description":"Message has X-Priority header set to 5 or higher"},{"name":"CHECK_REPLYTO","description":"Reply-To header could not be parsed"},{"name":"HAS_REPLYTO","description":"Has Reply-To header"},{"name":"REPLYTO_EQ_FROM","description":"Reply-To header is identical to From header"},{"name":"REPLYTO_ADDR_EQ_FROM","description":"Reply-To header is identical to SMTP From"},{"name":"REPLYTO_DOM_EQ_FROM_DOM","description":"Reply-To domain matches the From domain"},{"name":"REPLYTO_DOM_NEQ_FROM_DOM","description":"Reply-To domain does not match the From domain"},{"name":"REPLYTO_DN_EQ_FROM_DN","description":"Reply-To display name matches From"},{"name":"REPLYTO_EMAIL_HAS_TITLE","description":"Reply-To header has title"},{"name":"REPLYTO_EQ_TO_ADDR","description":"Reply-To is the same as the To address"},{"name":"CHECK_MIME","description":"MIME-Version header is missing in MIME message"},{"name":"MIME_MA_MISSING_TEXT","description":"MIME multipart/alternative missing text/plain part"},{"name":"MIME_MA_MISSING_HTML","description":"MIME multipart/alternative missing text/html part"},{"name":"PREVIOUSLY_DELIVERED","description":"Message either to a list or was forwarded"},{"name":"BROKEN_HEADERS","description":"Headers structure is likely broken"},{"name":"BROKEN_CONTENT_TYPE","description":"Message has part with broken content type"},{"name":"HEADER_RCONFIRM_MISMATCH","description":"Read confirmation address is different to from address"},{"name":"HEADER_FORGED_MDN","description":"Read confirmation address is different to return path"},{"name":"MULTIPLE_UNIQUE_HEADERS","description":"Repeated unique headers"},{"name":"MISSING_FROM","description":"Missing From: header"},{"name":"MULTIPLE_FROM","description":"Multiple addresses in From"},{"name":"MV_CASE","description":"Mime-Version .vs. MIME-Version"},{"name":"FAKE_REPLY","description":"Fake reply"},{"name":"FREEMAIL_ENVFROM","description":"Envelope From is a Freemail address"},{"name":"FREEMAIL_ENVRCPT","description":"Envelope Recipient is a Freemail address"},{"name":"FREEMAIL_FROM","description":"From is a Freemail address"},{"name":"FREEMAIL_TO","description":"To is a Freemail address"},{"name":"FREEMAIL_CC","description":"To is a Freemail address"},{"name":"FREEMAIL_REPLYTO","description":"Reply-To is a Freemail address"},{"name":"DISPOSABLE_ENVFROM","description":"Envelope From is a Disposable e-mail address"},{"name":"DISPOSABLE_ENVRCPT","description":"Envelope Recipient is a Disposable e-mail address"},{"name":"DISPOSABLE_FROM","description":"From a Disposable e-mail address"},{"name":"DISPOSABLE_TO","description":"To a disposable e-mail address"},{"name":"FORGED_RECIPIENTS_MAILLIST","description":"Forged sender, but message is forwarded"},{"name":"SPF_FAIL_FORWARDING","description":"From and Received address are listed in Spamhaus XBL"},{"name":"AUTH_NA","description":"Authenticating message via SPF/DKIM/DMARC/ARC not possible"},{"name":"DKIM_MIXED","description":"Message was sent by "},{"name":"HACKED_WP_PHISHING","description":"Phish message sent by hacked Wordpress instance"},{"name":"COMPROMISED_ACCT_BULK","description":"Likely to be from a compromised account"},{"name":"UNDISC_RCPTS_BULK","description":"Missing or undisclosed recipients with a bulk signature"},{"name":"RCVD_UNAUTH_PBL","description":"Relayed through ZEN PBL IP without sufficient authentication (possible indicating an open relay)"},{"name":"RCVD_DKIM_ARC_DNSWL_MED","description":"Sufficiently DKIM/ARC signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_HI","description":"Sufficiently DKIM/ARC signed and received from IP with high trust at DNSWL"},{"name":"AUTOGEN_PHP_SPAMMY","description":"Message was generated by PHP script and contains some spam indicators"},{"name":"PHISH_EMOTION","description":"Phish message with subject trying to address users emotion"},{"name":"HAS_ANON_DOMAIN","description":"Contains one or more domains trying to disguise owner/destination"},{"name":"BAD_REP_POLICIES","description":"Contains valid policies but are also marked by fuzzy/bayes/surbl/rbl"},{"name":"VIOLATED_DIRECT_SPF","description":"Has no Received (or no trusted received relays) and SPF policy fails or soft fails"},{"name":"IP_SCORE_FREEMAIL","description":"Negate IP_SCORE when message comes from FreeMail"},{"name":"BROKEN_HEADERS_MAILLIST","description":"Negate BROKEN_HEADERS when message comes via some mailing list"},{"name":"LEAKED_PASSWORD_SCAM","description":"Contains BTC wallet address and scam patterns"},{"name":"DISPOSABLE_CC","description":"To a disposable e-mail address"},{"name":"DISPOSABLE_REPLYTO","description":"Reply-To a disposable e-mail address"},{"name":"CHECK_FROM","description":"Envelope from does not have a valid format"},{"name":"FROM_INVALID","description":"From header does not have a valid format"},{"name":"FROM_NO_DN","description":"From header does not have a display name"},{"name":"FROM_DN_EQ_ADDR","description":"From header display name is the same as the address"},{"name":"FROM_HAS_DN","description":"From header has a display name"},{"name":"FROM_NAME_EXCESS_SPACE","description":"From header display name contains excess whitespace"},{"name":"FROM_NAME_HAS_TITLE","description":"From header display name has a title (Mr/Mrs/Dr)"},{"name":"FROM_EQ_ENVFROM","description":"From address is the same as the envelope"},{"name":"FROM_NEQ_ENVFROM","description":"From address is different to the envelope"},{"name":"TO_EQ_FROM","description":"To address matches the From address"},{"name":"TO_DOM_EQ_FROM_DOM","description":"To domain is the same as the From domain"},{"name":"CHECK_TO_CC","description":"No recipients"},{"name":"RCPT_COUNT_ONE","description":"One recipient"},{"name":"RCPT_COUNT_TWO","description":"Two recipients"},{"name":"RCPT_COUNT_THREE","description":"3-5 recipients"},{"name":"RCPT_COUNT_FIVE","description":"5-7 recipients"},{"name":"RCPT_COUNT_SEVEN","description":"7-11 recipients"},{"name":"RCPT_COUNT_TWELVE","description":"12-50 recipients"},{"name":"RCPT_COUNT_GT_50","description":"50+ recipients"},{"name":"TO_DN_RECIPIENTS","description":"To header display name is "},{"name":"TO_DN_NONE","description":"None of the recipients have display names"},{"name":"TO_DN_ALL","description":"All the recipients have display names"},{"name":"TO_DN_SOME","description":"Some of the recipients have display names"},{"name":"TO_DN_EQ_ADDR_ALL","description":"All of the recipients have display names that are the same as their address"},{"name":"TO_DN_EQ_ADDR_SOME","description":"Some of the recipients have display names that are the same as their address"},{"name":"TO_MATCH_ENVRCPT_ALL","description":"All of the recipients match the envelope"},{"name":"TO_MATCH_ENVRCPT_SOME","description":"Some of the recipients match the envelope"},{"name":"CTYPE_MISSING_DISPOSITION","description":"Binary content-type not specified as an attachment"},{"name":"CTYPE_MIXED_BOGUS","description":"multipart/mixed without non-textual part"},{"name":"MIME_BASE64_TEXT","description":"Has text part encoded in base64"},{"name":"MIME_BASE64_TEXT_BOGUS","description":"Has text part encoded in base64 that does not contain any 8bit characters"},{"name":"INVALID_FROM_8BIT","description":"Invalid 8bit character in From header"},{"name":"INVALID_RCPT_8BIT","description":"Invalid 8bit character in recipients headers"},{"name":"XM_CASE","description":"X-mailer .vs. X-Mailer"},{"name":"MIME_HTML_ONLY","description":"Messages that have only HTML part"},{"name":"HTML_SHORT_LINK_IMG_1","description":"Short html part (0..1K) with a link to an image"},{"name":"HTML_SHORT_LINK_IMG_2","description":"Short html part (1K..1.5K) with a link to an image"},{"name":"HTML_SHORT_LINK_IMG_3","description":"Short html part (1.5K..2K) with a link to an image"},{"name":"R_EMPTY_IMAGE","description":"Message contains empty parts and image"},{"name":"R_SUSPICIOUS_IMAGES","description":"Message contains many suspicious messages"},{"name":"HTML_VISIBLE_CHECKS","description":"Message contains low contrast text"},{"name":"ZERO_FONT","description":"Zero sized font used"},{"name":"MANY_INVISIBLE_PARTS","description":"Many parts are visually hidden"},{"name":"EXT_CSS","description":"Message contains external CSS reference"},{"name":"HTTP_TO_HTTPS","description":"Anchor text contains different scheme to target URL"},{"name":"HTTP_TO_IP","description":"Anchor points to an IP address"},{"name":"CHECK_MID","description":"Text and HTML parts differ"},{"name":"MISSING_DATE","description":"Message date is missing"},{"name":"DATE_IN_FUTURE","description":"Message date is in future"},{"name":"DATE_IN_PAST","description":"Message date is in past"},{"name":"R_SUSPICIOUS_URL","description":"Obfusicated or suspicious URL has been found in a message"},{"name":"ZERO_WIDTH_SPACE_URL","description":"Zero width space in url"},{"name":"ENVFROM_PRVS","description":"Envelope From is a PRVS address that matches the From address"},{"name":"ENVFROM_VERP","description":"Envelope From is a VERP address"},{"name":"CHECK_RCVD","description":"All hops used encrypted transports"},{"name":"RCVD_TLS_LAST","description":"Last hop used encrypted transports"},{"name":"RCVD_NO_TLS_LAST","description":"Last hop did not use encrypted transports"},{"name":"RCVD_VIA_SMTP_AUTH","description":"Authenticated hand-off was seen in Received headers"},{"name":"RCVD_HELO_USER","description":"HELO User spam pattern"},{"name":"URI_COUNT_ODD","description":"Odd number of URIs in multipart/alternative message"},{"name":"HAS_ATTACHMENT","description":"Message contains attachments"},{"name":"FREEMAIL_REPLYTO_NEQ_FROM_DOM","description":"Freemail From and Reply-To, but to different Freemail services"},{"name":"OMOGRAPH_URL","description":"Url contains both latin and non-latin characters"},{"name":"URL_IN_SUBJECT","description":"URL found in Subject"},{"name":"EMAIL_PLUS_ALIASES","description":"Removes plus aliases from the email"},{"name":"TAGGED_RCPT","description":"SMTP recipients have plus tags"},{"name":"TAGGED_FROM","description":"SMTP from has plus tags"},{"name":"FROM_DISPLAY_CALLBACK","description":"Display name is being used to spoof and trick the recipient"},{"name":"FROM_NEQ_DISPLAY_NAME","description":"Display name contains an email address different to the From address"},{"name":"SPOOF_REPLYTO","description":"Reply-To is being used to spoof and trick the recipient to send an off-domain reply"},{"name":"INFO_TO_INFO_LU","description":"info@ From/To address with List-Unsubscribe headers"},{"name":"R_BAD_CTE_7BIT","description":"Detects bad content-transfer-encoding for text parts"},{"name":"BOGUS_ENCRYPTED_AND_TEXT","description":"Bogus mix of encrypted and text/html payloads"},{"name":"ENCRYPTED_PGP","description":"Message is encrypted with pgp"},{"name":"ENCRYPTED_SMIME","description":"Message is encrypted with smime"},{"name":"SIGNED_PGP","description":"Message is signed with pgp"},{"name":"SIGNED_SMIME","description":"Message is signed with smime"},{"name":"SUBJ_ALL_CAPS","description":"All capital letters in subject"},{"name":"LONG_SUBJ","description":"Subject is too long"},{"name":"HAS_PHPMAILER_SIG","description":"PHPMailer signature"},{"name":"PHP_SCRIPT_ROOT","description":"PHP Script executed by root UID"},{"name":"HAS_X_POS","description":"Has X-PHP-Originating-Script header"},{"name":"HAS_X_PHP_SCRIPT","description":"Has X-PHP-Script header"},{"name":"HAS_X_SOURCE","description":"Has X-Source headers"},{"name":"HAS_X_AS","description":"Has X-Authenticated-Sender header"},{"name":"HAS_X_GMSV","description":"Has X-Get-Message-Sender-Via: header"},{"name":"HAS_X_ANTIABUSE","description":"Has X-AntiAbuse headers"},{"name":"X_PHP_EVAL","description":"Message sent using eval"},{"name":"HAS_WP_URI","description":"Contains WordPress URIs"},{"name":"WP_COMPROMISED","description":"URL that is pointing to a compromised WordPress installation"},{"name":"PHP_XPS_PATTERN","description":"Message contains X-PHP-Script pattern"},{"name":"HAS_XAW","description":"Has X-Authentication-Warning header"},{"name":"XAW_SERVICE_ACCT","description":"Message originally from a service account"},{"name":"ENVFROM_SERVICE_ACCT","description":"Envelope from is a service account"},{"name":"HIDDEN_SOURCE_OBJ","description":"UNIX hidden file/directory in path"},{"name":"URI_HIDDEN_PATH","description":"Message contains URI with a hidden path"},{"name":"MID_RHS_WWW","description":"Message-ID from www host"},{"name":"FROM_SERVICE_ACCT","description":"Sender/From/Reply-To is a service account"},{"name":"WWW_DOT_DOMAIN","description":"From/Sender/Reply-To or Envelope is @www.domain.com"},{"name":"SUBJECT_NEEDS_ENCODING","description":"Subject needs encoding"},{"name":"FROM_NEEDS_ENCODING","description":"From header needs encoding"},{"name":"TO_NEEDS_ENCODING","description":"To header needs encoding"},{"name":"R_NO_SPACE_IN_FROM","description":"No space in from header"},{"name":"TO_WRAPPED_IN_SPACES","description":"To address is wrapped in spaces inside angle brackets (e.g. display-name < local-part@domain >)"},{"name":"MISSING_SUBJECT","description":"Subject header is missing"},{"name":"EMPTY_SUBJECT","description":"Subject header is empty"},{"name":"MISSING_TO","description":"To header is missing"},{"name":"R_UNDISC_RCPT","description":"Recipients are absent or undisclosed"},{"name":"MISSING_MID","description":"Message id is missing"},{"name":"R_RCVD_SPAMBOTS","description":"Spambots signatures in received headers"},{"name":"R_MISSING_CHARSET","description":"Charset is missing in a message"},{"name":"R_SAJDING","description":"Subject seems to be spam"},{"name":"FORGED_OUTLOOK_HTML","description":"Forged outlook HTML signature"},{"name":"SUSPICIOUS_RECIPS","description":"Recipients seems to be autogenerated (works if recipients count is more than 5)"},{"name":"SORTED_RECIPS","description":"Recipients list seems to be sorted"},{"name":"TRACKER_ID","description":"Spam string at the end of message to make statistics fault"},{"name":"FROM_EXCESS_BASE64","description":"From that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"FROM_EXCESS_QP","description":"From that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"TO_EXCESS_BASE64","description":"To that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"TO_EXCESS_QP","description":"To that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"REPLYTO_EXCESS_BASE64","description":"Reply-To that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"REPLYTO_EXCESS_QP","description":"Reply-To that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"CC_EXCESS_BASE64","description":"Cc that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"CC_EXCESS_QP","description":"Cc that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"SUBJ_EXCESS_BASE64","description":"Subject is unnecessarily encoded in base64"},{"name":"SUBJ_EXCESS_QP","description":"Subject is unnecessarily encoded in quoted-printable"},{"name":"FORGED_MUA_OUTLOOK","description":"Forged outlook MUA"},{"name":"FORGED_OUTLOOK_TAGS","description":"Message pretends to be send from Outlook but has "},{"name":"SUSPICIOUS_BOUNDARY","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY2","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY3","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY4","description":"Suspicious boundary in header Content-Type"},{"name":"FORGED_MUA_THEBAT_MSGID","description":"Message pretends to be send from The Bat! but has forged Message-ID"},{"name":"FORGED_MUA_THEBAT_MSGID_UNKNOWN","description":"Message pretends to be send from The Bat! but has forged Message-ID"},{"name":"FORGED_MUA_KMAIL_MSGID_UNKNOWN","description":"Message pretends to be send from KMail but has forged Message-ID"},{"name":"SUSPICIOUS_OPERA_10W_MSGID","description":"Message pretends to be send from suspicious Opera Mail/10.x (Windows) but has forged Message-ID, apparently from KMail"},{"name":"FORGED_MUA_OPERA_MSGID","description":"Message pretends to be send from Opera Mail but has forged Message-ID"},{"name":"FORGED_MUA_MOZILLA_MAIL_MSGID","description":"Message pretends to be send from Mozilla Mail but has forged Message-ID"},{"name":"FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","description":"Message pretends to be send from Mozilla Mail but has forged Message-ID"},{"name":"FORGED_MUA_THUNDERBIRD_MSGID","description":"Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID"},{"name":"FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","description":"Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID"},{"name":"FORGED_MUA_SEAMONKEY_MSGID","description":"Forged mail pretending to be from Mozilla Seamonkey but has forged Message-ID"},{"name":"FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","description":"Forged mail pretending to be from Mozilla Seamonkey but has forged Message-ID"},{"name":"FORGED_MUA_POSTBOX_MSGID","description":"Forged mail pretending to be from Postbox but has forged Message-ID"},{"name":"FORGED_MUA_POSTBOX_MSGID_UNKNOWN","description":"Forged mail pretending to be from Postbox but has forged Message-ID"},{"name":"INVALID_MSGID","description":"Message id is incorrect"},{"name":"MIME_HEADER_CTYPE_ONLY","description":"Only Content-Type header without other MIME headers"},{"name":"RATWARE_MS_HASH","description":"Forged Exchange messages"},{"name":"STOX_REPLY_TYPE","description":"Reply-type in content-type"},{"name":"FM_FAKE_HELO_VERIZON","description":"Fake helo for verizon provider"},{"name":"FORGED_MSGID_YAHOO","description":"Forged yahoo msgid"},{"name":"FORGED_MUA_THEBAT_BOUN","description":"Forged The Bat! MUA headers"},{"name":"MAIL_RU_MAILER","description":"Sent with Mail.Ru web-mail"},{"name":"YANDEX_RU_MAILER","description":"Sent with yandex.ru web-mail"},{"name":"MAILER_1C_8","description":"Sent with 1C:Enterprise 8"},{"name":"STRONGMAIL","description":"Sent via rogue "},{"name":"RCVD_DOUBLE_IP_SPAM","description":"Two received headers with ip addresses"},{"name":"REPTO_QUOTE_YAHOO","description":"Quoted reply-to from yahoo (seems to be forged)"},{"name":"FAKE_REPLY_C","description":"Fake reply (has RE in subject, but has no References header)"},{"name":"MISSING_MIMEOLE","description":"Mime-OLE is needed but absent (e.g. fake Outlook or fake Exchange)"},{"name":"HEADER_FROM_DELIMITER_TAB","description":"Header From begins with tab"},{"name":"HEADER_TO_DELIMITER_TAB","description":"Header To begins with tab"},{"name":"HEADER_CC_DELIMITER_TAB","description":"Header To begins with tab"},{"name":"HEADER_REPLYTO_DELIMITER_TAB","description":"Header Reply-To begins with tab"},{"name":"HEADER_DATE_DELIMITER_TAB","description":"Header Date begins with tab"},{"name":"HEADER_FROM_EMPTY_DELIMITER","description":"Header From has no delimiter between header name and header value"},{"name":"HEADER_TO_EMPTY_DELIMITER","description":"Header To has no delimiter between header name and header value"},{"name":"HEADER_CC_EMPTY_DELIMITER","description":"Header Cc has no delimiter between header name and header value"},{"name":"HEADER_REPLYTO_EMPTY_DELIMITER","description":"Header Reply-To has no delimiter between header name and header value"},{"name":"HEADER_DATE_EMPTY_DELIMITER","description":"Header Date has no delimiter between header name and header value"},{"name":"RCVD_ILLEGAL_CHARS","description":"Header Received has raw illegal character"},{"name":"FORGED_GENERIC_RECEIVED","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED2","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED3","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED4","description":"Forged generic Received"},{"name":"INVALID_POSTFIX_RECEIVED","description":"Invalid Postfix Received"},{"name":"X_PHP_FORGED_0X","description":"X-PHP-Originating-Script header appears forged"},{"name":"GOOGLE_FORWARDING_MID_MISSING","description":"Message was missing Message-ID pre-forwarding"},{"name":"GOOGLE_FORWARDING_MID_BROKEN","description":"Message had invalid Message-ID pre-forwarding"},{"name":"CTE_CASE","description":"[78]Bit .vs. [78]bit"},{"name":"HAS_INTERSPIRE_SIG","description":"Has Interspire fingerprint"},{"name":"CT_EXTRA_SEMI","description":"Content-Type ends with a semi-colon"},{"name":"SUBJECT_ENDS_EXCLAIM","description":"Subject ends with an exclaimation"},{"name":"SUBJECT_HAS_EXCLAIM","description":"Subject contains an exclaimation"},{"name":"SUBJECT_ENDS_QUESTION","description":"Subject ends with a question"},{"name":"SUBJECT_HAS_QUESTION","description":"Subject contains a question"},{"name":"SUBJECT_HAS_CURRENCY","description":"Subject contains currency"},{"name":"SUBJECT_ENDS_SPACES","description":"Subject ends with space characters"},{"name":"HAS_ORG_HEADER","description":"Has Organization header"},{"name":"X_PHPOS_FAKE","description":"Fake X-PHP-Originating-Script header"},{"name":"HAS_XOIP","description":"Has X-Originating-IP header"},{"name":"HAS_LIST_UNSUB","description":"Has List-Unsubscribe header"},{"name":"HAS_GUC_PROXY_URI","description":"Has googleusercontent.com proxy URI"},{"name":"HAS_GOOGLE_REDIR","description":"Has google.com/url redirection"},{"name":"XM_UA_NO_VERSION","description":"X-Mailer/User-Agent has no version"},{"name":"HTML_META_REFRESH_URL","description":"Has HTML Meta refresh URL"},{"name":"HAS_DATA_URI","description":"Has Data URI encoding"},{"name":"DATA_URI_OBFU","description":"Uses Data URI encoding to obfuscate plain or HTML in base64"},{"name":"INTRODUCTION","description":"Sender introduces themselves"},{"name":"HAS_ONION_URI","description":"Contains .onion hidden service URI"},{"name":"LEAKED_PASSWORD_SCAM_RE","description":"Contains BTC wallet address and malicious regexps"},{"name":"PRECEDENCE_BULK","description":"Message marked as bulk"},{"name":"MICROSOFT_SPAM","description":"Microsoft says the message is spam"},{"name":"AOL_SPAM","description":"AOL says this message is spam"},{"name":"KLMS_SPAM","description":"Kaspersky Security for Mail Server says this message is spam"},{"name":"SPAM_FLAG","description":"Message was already marked as spam"},{"name":"UNITEDINTERNET_SPAM","description":"United Internet says this message is spam"},{"name":"FUZZY_UNKNOWN","description":"Generic fuzzy hash match, bl.rspamd.com"},{"name":"FUZZY_DENIED","description":"Denied fuzzy hash, bl.rspamd.com"},{"name":"FUZZY_PROB","description":"Probable fuzzy hash, bl.rspamd.com"},{"name":"FUZZY_WHITE","description":"Whitelisted fuzzy hash, bl.rspamd.com"},{"name":"FORGED_SENDER","description":"Sender is forged (different From: header and smtp MAIL FROM: addresses)"},{"name":"R_MIXED_CHARSET","description":"Mixed characters in a message"},{"name":"R_MIXED_CHARSET_URL","description":"Mixed characters in a URL inside message"},{"name":"FORGED_RECIPIENTS","description":"Recipients are not the same as RCPT TO: mail command"},{"name":"FORGED_RECIPIENTS_MAILLIST","description":"Recipients are not the same as RCPT TO: mail command, but a message from a maillist"},{"name":"FORGED_SENDER_MAILLIST","description":"Sender is not the same as MAIL FROM: envelope, but a message is from a maillist"},{"name":"ONCE_RECEIVED","description":"One received header in a message"},{"name":"RDNS_NONE","description":"Cannot resolve reverse DNS for sender"},{"name":"RDNS_DNSFAIL","description":"PTR verification DNS error"},{"name":"ONCE_RECEIVED_STRICT","description":"One received header with "},{"name":"MAILLIST","description":"Message seems to be from maillist"},{"name":"HFILTER_HELO_BAREIP","description":"Helo host is bare ip"},{"name":"HFILTER_HELO_BADIP","description":"Helo host is very bad ip"},{"name":"HFILTER_HELO_1","description":"Helo host checks (very low)"},{"name":"HFILTER_HELO_2","description":"Helo host checks (low)"},{"name":"HFILTER_HELO_3","description":"Helo host checks (medium)"},{"name":"HFILTER_HELO_4","description":"Helo host checks (hard)"},{"name":"HFILTER_HELO_5","description":"Helo host checks (very hard)"},{"name":"HFILTER_HOSTNAME_1","description":"Hostname checks (very low)"},{"name":"HFILTER_HOSTNAME_2","description":"Hostname checks (low)"},{"name":"HFILTER_HOSTNAME_3","description":"Hostname checks (medium)"},{"name":"HFILTER_HOSTNAME_4","description":"Hostname checks (hard)"},{"name":"HFILTER_HOSTNAME_5","description":"Hostname checks (very hard)"},{"name":"HFILTER_HELO_NORESOLVE_MX","description":"MX found in Helo and no resolve"},{"name":"HFILTER_HELO_NORES_A_OR_MX","description":"Helo no resolve to A or MX"},{"name":"HFILTER_HELO_IP_A","description":"Helo A IP != hostname IP"},{"name":"HFILTER_HELO_NOT_FQDN","description":"Helo not FQDN"},{"name":"HFILTER_FROMHOST_NORESOLVE_MX","description":"MX found in FROM host and no resolve"},{"name":"HFILTER_FROMHOST_NORES_A_OR_MX","description":"FROM host no resolve to A or MX"},{"name":"HFILTER_FROMHOST_NOT_FQDN","description":"FROM host not FQDN"},{"name":"HFILTER_FROM_BOUNCE","description":"Bounce message"},{"name":"HFILTER_MID_NORESOLVE_MX","description":"MX found in Message-id host and no resolve"},{"name":"HFILTER_MID_NORES_A_OR_MX","description":"Message-id host no resolve to A or MX"},{"name":"HFILTER_MID_NOT_FQDN","description":"Message-id host not FQDN"},{"name":"HFILTER_HOSTNAME_UNKNOWN","description":"Unknown client hostname (PTR or FCrDNS verification failed)"},{"name":"HFILTER_RCPT_BOUNCEMOREONE","description":"Message from bounce and over 1 recipient"},{"name":"HFILTER_URL_ONLY","description":"URL only in body"},{"name":"HFILTER_URL_ONELINE","description":"One line URL and text in body"},{"name":"MIME_GOOD","description":"Known content-type"},{"name":"MIME_BAD","description":"Known bad content-type"},{"name":"MIME_UNKNOWN","description":"Missing or unknown content-type"},{"name":"MIME_BAD_ATTACHMENT","description":"Invalid attachment mime type"},{"name":"MIME_ENCRYPTED_ARCHIVE","description":"Encrypted archive in a message"},{"name":"MIME_ARCHIVE_IN_ARCHIVE","description":"Archive within another archive"},{"name":"MIME_DOUBLE_BAD_EXTENSION","description":"Bad extension cloaking"},{"name":"MIME_BAD_EXTENSION","description":"Bad extension"},{"name":"MIME_BAD_UNICODE","description":"Filename with known obscured unicode characters"},{"name":"FORGED_MUA_MAILLIST","description":"Avoid false positives for FORGED_MUA_* in maillist"},{"name":"PHISHING","description":"Phished URL"},{"name":"PHISHED_OPENPHISH","description":"Phished URL found in openphish.com"},{"name":"PHISHED_PHISHTANK","description":"Phished URL found in phishtank.com"},{"name":"R_SPF_FAIL","description":"SPF verification failed"},{"name":"R_SPF_SOFTFAIL","description":"SPF verification soft-failed"},{"name":"R_SPF_NEUTRAL","description":"SPF policy is neutral"},{"name":"R_SPF_ALLOW","description":"SPF verification allows sending"},{"name":"R_SPF_DNSFAIL","description":"SPF DNS failure"},{"name":"R_DKIM_REJECT","description":"DKIM verification failed"},{"name":"R_DKIM_TEMPFAIL","description":"DKIM verification soft-failed"},{"name":"R_DKIM_ALLOW","description":"DKIM verification succeed"},{"name":"DMARC_POLICY_ALLOW","description":"Message was authenticated & allowed by DMARC policy"},{"name":"DMARC_POLICY_ALLOW_WITH_FAILURES","description":"DMARC permit policy with DKIM/SPF failure"},{"name":"DMARC_POLICY_REJECT","description":"Rejection suggested by DMARC policy"},{"name":"DMARC_POLICY_QUARANTINE","description":"Quarantine suggested by DMARC policy"},{"name":"DMARC_POLICY_SOFTFAIL","description":"No action suggested by DMARC policy"},{"name":"DMARC_BAD_POLICY","description":"DMARC policy was invalid or multiple policies found in DNS"},{"name":"DMARC_NA","description":"Domain in From header has no DMARC policy or From header is missing"},{"name":"ARC_ALLOW","description":"ARC checks success"},{"name":"ARC_REJECT","description":"ARC checks failed"},{"name":"ARC_INVALID","description":"ARC structure invalid"},{"name":"ARC_DNSFAIL","description":"ARC DNS error"},{"name":"ARC_NA","description":"ARC signature absent"},{"name":"DNSWL_BLOCKED","description":"Resolver blocked due to excessive queries"},{"name":"RCVD_IN_DNSWL","description":"Unrecognised result from https://www.dnswl.org"},{"name":"RCVD_IN_DNSWL_NONE","description":"Sender listed at https://www.dnswl.org, no trust"},{"name":"RCVD_IN_DNSWL_LOW","description":"Sender listed at https://www.dnswl.org, low trust"},{"name":"RCVD_IN_DNSWL_MED","description":"Sender listed at https://www.dnswl.org, medium trust"},{"name":"RCVD_IN_DNSWL_HI","description":"Sender listed at https://www.dnswl.org, high trust"},{"name":"DWL_DNSWL_BLOCKED","description":"Resolver blocked due to excessive queries (dwl)"},{"name":"DWL_DNSWL","description":"Unrecognised result from https://www.dnswl.org (dwl)"},{"name":"DWL_DNSWL_NONE","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust"},{"name":"DWL_DNSWL_LOW","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust"},{"name":"DWL_DNSWL_MED","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust"},{"name":"DWL_DNSWL_HI","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust"},{"name":"RBL_SPAMHAUS","description":"Unrecognised result from Spamhaus ZEN"},{"name":"RBL_SPAMHAUS_SBL","description":"From address is listed in ZEN SBL"},{"name":"RBL_SPAMHAUS_CSS","description":"From address is listed in ZEN CSS"},{"name":"RBL_SPAMHAUS_XBL","description":"From address is listed in ZEN XBL"},{"name":"RBL_SPAMHAUS_XBL_ANY","description":"From or received address is listed in ZEN XBL (any list)"},{"name":"RBL_SPAMHAUS_PBL","description":"From address is listed in ZEN PBL (ISP list)"},{"name":"RBL_SPAMHAUS_DROP","description":"From address is listed in ZEN DROP BL"},{"name":"RBL_SPAMHAUS_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"RBL_SPAMHAUS_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"RECEIVED_SPAMHAUS_SBL","description":"Received address is listed in ZEN SBL"},{"name":"RECEIVED_SPAMHAUS_CSS","description":"Received address is listed in ZEN CSS"},{"name":"RECEIVED_SPAMHAUS_XBL","description":"Received address is listed in ZEN XBL"},{"name":"RECEIVED_SPAMHAUS_PBL","description":"Received address is listed in ZEN PBL (ISP list)"},{"name":"RECEIVED_SPAMHAUS_DROP","description":"Received address is listed in ZEN DROP BL"},{"name":"RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"RECEIVED_SPAMHAUS_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"RBL_SENDERSCORE","description":"From address is listed in senderscore.com BL"},{"name":"MAILSPIKE","description":"Unrecognised result from Mailspike"},{"name":"RWL_MAILSPIKE_NEUTRAL","description":"Neutral result from Mailspike"},{"name":"RBL_MAILSPIKE_WORST","description":"From address is listed in RBL - worst possible reputation"},{"name":"RBL_MAILSPIKE_VERYBAD","description":"From address is listed in RBL - very bad reputation"},{"name":"RBL_MAILSPIKE_BAD","description":"From address is listed in RBL - bad reputation"},{"name":"RWL_MAILSPIKE_POSSIBLE","description":"From address is listed in RWL - possibly legit"},{"name":"RWL_MAILSPIKE_GOOD","description":"From address is listed in RWL - good reputation"},{"name":"RWL_MAILSPIKE_VERYGOOD","description":"From address is listed in RWL - very good reputation"},{"name":"RWL_MAILSPIKE_EXCELLENT","description":"From address is listed in RWL - excellent reputation"},{"name":"RBL_SEM","description":"From address is listed in Spameatingmonkey RBL"},{"name":"RBL_SEM_IPV6","description":"From address is listed in Spameatingmonkey RBL (IPv6)"},{"name":"RBL_VIRUSFREE_BOTNET","description":"From address is listed in virusfree.cz BL"},{"name":"RBL_NIXSPAM","description":"From address is listed in NiX Spam (http://www.dnsbl.manitu.net/)"},{"name":"RBL_BLOCKLISTDE","description":"From address is listed in Blocklist (https://www.blocklist.de/)"},{"name":"RECEIVED_BLOCKLISTDE","description":"Received address is listed in Blocklist (https://www.blocklist.de/)"},{"name":"BAYES_SPAM","description":"Message probably spam"},{"name":"BAYES_HAM","description":"Message probably ham"},{"name":"SURBL_BLOCKED","description":"SURBL: blocked by policy/overusage"},{"name":"PH_SURBL_MULTI","description":"SURBL: Phishing sites"},{"name":"MW_SURBL_MULTI","description":"SURBL: Malware sites"},{"name":"ABUSE_SURBL","description":"SURBL: ABUSE"},{"name":"CRACKED_SURBL","description":"SURBL: cracked site"},{"name":"RSPAMD_URIBL","description":"Rspamd uribl, bl.rspamd.com"},{"name":"RSPAMD_EMAILBL","description":"Rspamd emailbl, bl.rspamd.com"},{"name":"MSBL_EBL","description":"MSBL emailbl"},{"name":"MSBL_EBL_GREY","description":"MSBL emailbl grey list"},{"name":"SEM_URIBL_UNKNOWN","description":"Spameatingmonkey uribl: unknown result"},{"name":"SEM_URIBL","description":"Spameatingmonkey uribl"},{"name":"SEM_URIBL_FRESH15_UNKNOWN","description":"Spameatingmonkey Fresh15 uribl: unknown result"},{"name":"SEM_URIBL_FRESH15","description":"Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)"},{"name":"DBL","description":"DBL unknown result"},{"name":"DBL_SPAM","description":"DBL uribl spam"},{"name":"DBL_PHISH","description":"DBL uribl phishing"},{"name":"DBL_MALWARE","description":"DBL uribl malware"},{"name":"DBL_BOTNET","description":"DBL uribl botnet C&C domain"},{"name":"DBL_ABUSE","description":"DBL uribl abused legit spam"},{"name":"DBL_ABUSE_REDIR","description":"DBL uribl abused spammed redirector domain"},{"name":"DBL_ABUSE_PHISH","description":"DBL uribl abused legit phish"},{"name":"DBL_ABUSE_MALWARE","description":"DBL uribl abused legit malware"},{"name":"DBL_ABUSE_BOTNET","description":"DBL uribl abused legit botnet C&C"},{"name":"DBL_PROHIBIT","description":"DBL uribl IP queries prohibited!"},{"name":"DBL_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"DBL_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_MULTI","description":"uribl.com: unrecognised result"},{"name":"URIBL_BLOCKED","description":"uribl.com: query refused"},{"name":"URIBL_BLACK","description":"uribl.com black url"},{"name":"URIBL_RED","description":"uribl.com red url"},{"name":"URIBL_GREY","description":"uribl.com grey url"},{"name":"SPAMHAUS_ZEN_URIBL","description":"Spamhaus ZEN URIBL: Filtered result"},{"name":"URIBL_SBL","description":"A domain in the message body resolves to an IP listed in Spamhaus SBL"},{"name":"URIBL_SBL_CSS","description":"A domain in the message body resolves to an IP listed in Spamhaus SBL CSS"},{"name":"URIBL_XBL","description":"A domain in the message body resolves to an IP listed in Spamhaus XBL"},{"name":"URIBL_PBL","description":"A domain in the message body resolves to an IP listed in Spamhaus PBL"},{"name":"URIBL_DROP","description":"A domain in the message body resolves to an IP listed in Spamhaus DROP"},{"name":"RBL_SARBL_BAD","description":"A domain in the message body is blacklisted in SARBL"},{"name":"WHITELIST_SPF","description":"Mail comes from the whitelisted domain and has a valid SPF policy"},{"name":"BLACKLIST_SPF","description":"Mail comes from the whitelisted domain and has no valid SPF policy"},{"name":"WHITELIST_DKIM","description":"Mail comes from the whitelisted domain and has a valid DKIM signature"},{"name":"BLACKLIST_DKIM","description":"Mail comes from the whitelisted domain and has non-valid DKIM signature"},{"name":"WHITELIST_SPF_DKIM","description":"Mail comes from the whitelisted domain and has valid SPF and DKIM policies"},{"name":"BLACKLIST_SPF_DKIM","description":"Mail comes from the whitelisted domain and has no valid SPF policy or a bad DKIM signature"},{"name":"WHITELIST_DMARC","description":"Mail comes from the whitelisted domain and has valid DMARC and DKIM policies"},{"name":"BLACKLIST_DMARC","description":"Mail comes from the whitelisted domain and has valid failed DMARC and DKIM policies"},{"name":"NEURAL_SPAM_LONG","description":"Neural network spam (long)"},{"name":"NEURAL_HAM_LONG","description":"Neural network ham (long)"},{"name":"NEURAL_SPAM_SHORT","description":"Neural network spam (short)"},{"name":"NEURAL_HAM_SHORT","description":"Neural network ham (short)"},{"name":"MX_MISSING","description":"Domain has no resolvable MX"},{"name":"MX_INVALID","description":"Domain has no working MX"},{"name":"MX_GOOD","description":"Domain has working MX"},{"name":"MX_WHITE","description":"Domain is whitelisted from MX check"},{"name":"ARC_SIGNED","description":"Message is signed with ARC"},{"name":"ASN","description":"Looked up Autonomous System Number (ASN), country code and subnets of sender IP address"},{"name":"DKIM_TRACE","description":"DKIM checks completed"},{"name":"MIME_TRACE","description":"MIME checks completed"},{"name":"RCVD_DKIM_DNSWL_MED","description":"Sufficiently DKIM signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_MED","description":"Sufficiently DKIM/ARC signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_DNSWL_HI","description":"Sufficiently DKIM signed and received from IP with high trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_HI","description":"Sufficiently DKIM/ARC signed and received from IP with high trust at DNSWL"},{"name":"GTUBE","description":"Generic Test for Unsolicited Bulk Email"},{"name":"TRACKER_ID","description":"Incorporates a tracking ID number"},{"name":"WEIRD_QUOTING","description":"Weird repeated double-quotation marks"},{"name":"MIME_HTML_ONLY_MULTI","description":"Multipart message only has text/html MIME parts"},{"name":"MIME_CHARSET_FARAWAY","description":"MIME character set indicates foreign language"},{"name":"EMAIL_ROT13","description":"Body contains a ROT13-encoded email address"},{"name":"LONGWORDS","description":"Long string of long words"},{"name":"MPART_ALT_DIFF","description":"HTML and text parts are different"},{"name":"MPART_ALT_DIFF_COUNT","description":"HTML and text parts are different"},{"name":"BLANK_LINES_80_90","description":"Message body has 80-90% blank lines"},{"name":"CHARSET_FARAWAY","description":"Character set indicates a foreign language"},{"name":"__MIME_BASE64","description":"Includes a base64 attachment"},{"name":"__MIME_QP","description":"Includes a quoted-printable attachment"},{"name":"MIME_BASE64_BLANKS","description":"Extra blank lines in base64 encoding"},{"name":"MIME_BASE64_TEXT","description":"Message text disguised using base64 encoding"},{"name":"MISSING_MIME_HB_SEP","description":"Missing blank line between MIME header and body"},{"name":"MIME_HTML_MOSTLY","description":"Multipart message mostly text/html MIME"},{"name":"MIME_HTML_ONLY","description":"Message only has text/html MIME parts"},{"name":"MIME_QP_LONG_LINE","description":"Quoted-printable line longer than 76 chars"},{"name":"MIME_BAD_ISO_CHARSET","description":"MIME character set is an unknown ISO charset"},{"name":"MIMEPART_LIMIT_EXCEEDED","description":"Message has too many MIME parts"},{"name":"HTTPS_IP_MISMATCH","description":"IP to HTTPS link found in HTML"},{"name":"URI_TRUNCATED","description":"Message contained a URI which was truncated"},{"name":"NO_RECEIVED","description":"Informational: message has no Received headers"},{"name":"ALL_TRUSTED","description":"Passed through trusted hosts only via SMTP"},{"name":"NO_RELAYS","description":"Informational: message was not relayed via SMTP"},{"name":"__RCVD_IN_SORBS","description":"SORBS: sender is listed in SORBS"},{"name":"RCVD_IN_SORBS_HTTP","description":"SORBS: sender is open HTTP proxy server"},{"name":"RCVD_IN_SORBS_SOCKS","description":"SORBS: sender is open SOCKS proxy server"},{"name":"RCVD_IN_SORBS_MISC","description":"SORBS: sender is open proxy server"},{"name":"RCVD_IN_SORBS_SMTP","description":"SORBS: sender is open SMTP relay"},{"name":"RCVD_IN_SORBS_SPAM","description":"SORBS: sender is a spam source"},{"name":"RCVD_IN_SORBS_WEB","description":"SORBS: sender is an abusable web server"},{"name":"RCVD_IN_SORBS_BLOCK","description":"SORBS: sender demands to never be tested"},{"name":"RCVD_IN_SORBS_ZOMBIE","description":"SORBS: sender is on a hijacked network"},{"name":"RCVD_IN_SORBS_DUL","description":"SORBS: sent directly from dynamic IP address"},{"name":"__RCVD_IN_ZEN","description":"Received via a relay in Spamhaus Zen"},{"name":"RCVD_IN_SBL","description":"Received via a relay in Spamhaus SBL"},{"name":"RCVD_IN_XBL","description":"Received via a relay in Spamhaus XBL"},{"name":"RCVD_IN_PBL","description":"Received via a relay in Spamhaus PBL"},{"name":"RCVD_IN_SBL_CSS","description":"Received via a relay in Spamhaus SBL-CSS"},{"name":"RCVD_IN_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"RCVD_IN_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"RCVD_IN_BL_SPAMCOP_NET","description":"Received via a relay in bl.spamcop.net"},{"name":"RCVD_IN_MAPS_RBL","description":"Relay in RBL, http://www.mail-abuse.com/enduserinfo_rbl.html"},{"name":"RCVD_IN_MAPS_DUL","description":"Relay in DUL, http://www.mail-abuse.com/enduserinfo_dul.html"},{"name":"RCVD_IN_MAPS_RSS","description":"Relay in RSS, http://www.mail-abuse.com/enduserinfo_rss.html"},{"name":"RCVD_IN_MAPS_OPS","description":"Relay in OPS, http://www.mail-abuse.com/enduserinfo_ops.html"},{"name":"RCVD_IN_MAPS_NML","description":"Relay in NML, http://www.mail-abuse.com/enduserinfo_nml.html"},{"name":"RCVD_IN_IADB_VOUCHED","description":"ISIPP IADB lists as vouched-for sender"},{"name":"RCVD_IN_RP_CERTIFIED","description":"Sender in ReturnPath Certified - Contact cert-sa@returnpath.net"},{"name":"RCVD_IN_RP_SAFE","description":"Sender in ReturnPath Safe - Contact safe-sa@returnpath.net"},{"name":"RCVD_IN_RP_RNBL","description":"Relay in RNBL, https://senderscore.org/blacklistlookup/"},{"name":"DKIMDOMAIN_IN_DWL","description":"Signing domain listed in Spamhaus DWL"},{"name":"__DKIMDOMAIN_IN_DWL_ANY","description":"Any TXT response received from a Spamhaus DWL"},{"name":"DKIMDOMAIN_IN_DWL_UNKNOWN","description":"Unrecognized response from Spamhaus DWL"},{"name":"SUBJECT_DRUG_GAP_C","description":"Subject contains a gappy version of 'cialis'"},{"name":"SUBJECT_DRUG_GAP_L","description":"Subject contains a gappy version of 'levitra'"},{"name":"SUBJECT_DRUG_GAP_S","description":"Subject contains a gappy version of 'soma'"},{"name":"SUBJECT_DRUG_GAP_VA","description":"Subject contains a gappy version of 'valium'"},{"name":"SUBJECT_DRUG_GAP_X","description":"Subject contains a gappy version of 'xanax'"},{"name":"DRUG_DOSAGE","description":"Talks about price per dose"},{"name":"DRUG_ED_CAPS","description":"Mentions an E.D. drug"},{"name":"DRUG_ED_SILD","description":"Talks about an E.D. drug using its chemical name"},{"name":"DRUG_ED_GENERIC","description":"Mentions Generic Viagra"},{"name":"DRUG_ED_ONLINE","description":"Fast Viagra Delivery "},{"name":"ONLINE_PHARMACY","description":"Online Pharmacy"},{"name":"NO_PRESCRIPTION","description":"No prescription needed"},{"name":"VIA_GAP_GRA","description":"Attempts to disguise the word 'viagra'"},{"name":"DRUGS_ERECTILE","description":"Refers to an erectile drug"},{"name":"DRUGS_ERECTILE_OBFU","description":"Obfuscated reference to an erectile drug"},{"name":"DRUGS_DIET","description":"Refers to a diet drug"},{"name":"DRUGS_DIET_OBFU","description":"Obfuscated reference to a diet drug\t"},{"name":"DRUGS_MUSCLE","description":"Refers to a muscle relaxant"},{"name":"DRUGS_ANXIETY","description":"Refers to an anxiety control drug"},{"name":"DRUGS_ANXIETY_OBFU","description":"Obfuscated reference to an anxiety control drug"},{"name":"DRUGS_SMEAR1","description":"Two or more drugs crammed together into one word"},{"name":"DRUGS_ANXIETY_EREC","description":"Refers to both an erectile and an anxiety drug"},{"name":"DRUGS_SLEEP_EREC","description":"Refers to both an erectile and a sleep aid drug"},{"name":"DRUGS_MANYKINDS","description":"Refers to at least four kinds of drugs"},{"name":"__RDNS_DYNAMIC_IPADDR","description":"Relay HELO'd using suspicious hostname (IP addr 1)"},{"name":"__RDNS_DYNAMIC_DHCP","description":"Relay HELO'd using suspicious hostname (DHCP)"},{"name":"__RDNS_DYNAMIC_HCC","description":"Relay HELO'd using suspicious hostname (HCC)"},{"name":"__RDNS_DYNAMIC_ATTBI","description":"Relay HELO'd using suspicious hostname (ATTBI.com)"},{"name":"__RDNS_DYNAMIC_ROGERS","description":"Relay HELO'd using suspicious hostname (Rogers)"},{"name":"__RDNS_DYNAMIC_ADELPHIA","description":"Relay HELO'd using suspicious hostname (Adelphia)"},{"name":"__RDNS_DYNAMIC_DIALIN","description":"Relay HELO'd using suspicious hostname (T-Dialin)"},{"name":"__RDNS_DYNAMIC_HEXIP","description":"Relay HELO'd using suspicious hostname (Hex IP)"},{"name":"__RDNS_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"__RDNS_DYNAMIC_YAHOOBB","description":"Relay HELO'd using suspicious hostname (YahooBB)"},{"name":"__RDNS_DYNAMIC_OOL","description":"Relay HELO'd using suspicious hostname (OptOnline)"},{"name":"__RDNS_DYNAMIC_RR2","description":"Relay HELO'd using suspicious hostname (RR 2)"},{"name":"__RDNS_DYNAMIC_COMCAST","description":"Relay HELO'd using suspicious hostname (Comcast)"},{"name":"__RDNS_DYNAMIC_TELIA","description":"Relay HELO'd using suspicious hostname (Telia)"},{"name":"__RDNS_DYNAMIC_VTR","description":"Relay HELO'd using suspicious hostname (VTR)"},{"name":"__RDNS_DYNAMIC_CHELLO_NO","description":"Relay HELO'd using suspicious hostname (Chello.no)"},{"name":"__RDNS_DYNAMIC_CHELLO_NL","description":"Relay HELO'd using suspicious hostname (Chello.nl)"},{"name":"__RDNS_DYNAMIC_VELOX","description":"Relay HELO'd using suspicious hostname (Veloxzone)"},{"name":"__RDNS_DYNAMIC_NTL","description":"Relay HELO'd using suspicious hostname (NTL)"},{"name":"RDNS_DYNAMIC","description":"Delivered to internal network by host with dynamic-looking rDNS"},{"name":"RDNS_NONE","description":"Delivered to internal network by a host with no rDNS"},{"name":"HELO_STATIC_HOST","description":"Relay HELO'd using static hostname"},{"name":"FAKE_HELO_MAIL_COM_DOM","description":"Relay HELO'd with suspicious hostname (mail.com)"},{"name":"HELO_DYNAMIC_IPADDR","description":"Relay HELO'd using suspicious hostname (IP addr 1)"},{"name":"HELO_DYNAMIC_DHCP","description":"Relay HELO'd using suspicious hostname (DHCP)"},{"name":"HELO_DYNAMIC_HCC","description":"Relay HELO'd using suspicious hostname (HCC)"},{"name":"HELO_DYNAMIC_ROGERS","description":"Relay HELO'd using suspicious hostname (Rogers)"},{"name":"HELO_DYNAMIC_DIALIN","description":"Relay HELO'd using suspicious hostname (T-Dialin)"},{"name":"HELO_DYNAMIC_HEXIP","description":"Relay HELO'd using suspicious hostname (Hex IP)"},{"name":"HELO_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"HELO_DYNAMIC_IPADDR2","description":"Relay HELO'd using suspicious hostname (IP addr 2)"},{"name":"HELO_DYNAMIC_CHELLO_NL","description":"Relay HELO'd using suspicious hostname (Chello.nl)"},{"name":"HELO_DYNAMIC_HOME_NL","description":"Relay HELO'd using suspicious hostname (Home.nl)"},{"name":"FREEMAIL_REPLYTO","description":"Reply-To/From or Reply-To/body contain different freemails"},{"name":"FREEMAIL_REPLY","description":"From and body contain different freemails"},{"name":"FREEMAIL_FROM","description":"Sender email is commonly abused enduser mail provider"},{"name":"FREEMAIL_ENVFROM_END_DIGIT","description":"Envelope-from freemail username ends in digit"},{"name":"FREEMAIL_REPLYTO_END_DIGIT","description":"Reply-To freemail username ends in digit"},{"name":"FREEMAIL_SUBJECT","description":"Subject contains freemail"},{"name":"FREEMAIL_FORGED_REPLYTO","description":"Freemail in Reply-To, but not From"},{"name":"FRAGMENTED_MESSAGE","description":"Partial message"},{"name":"FROM_BLANK_NAME","description":"From: contains empty name"},{"name":"FROM_STARTS_WITH_NUMS","description":"From: starts with several numbers"},{"name":"FROM_OFFERS","description":"From address is \"at something-offers\""},{"name":"FROM_NO_USER","description":"From: has no local-part before @ sign"},{"name":"PLING_QUERY","description":"Subject has exclamation mark and question mark"},{"name":"MSGID_SPAM_CAPS","description":"Spam tool Message-Id: (caps variant)"},{"name":"MSGID_SPAM_LETTERS","description":"Spam tool Message-Id: (letters variant)"},{"name":"MSGID_RANDY","description":"Message-Id has pattern used in spam"},{"name":"MSGID_YAHOO_CAPS","description":"Message-ID has ALLCAPS@yahoo.com"},{"name":"FORGED_MSGID_AOL","description":"Message-ID is forged, (aol.com)"},{"name":"FORGED_MSGID_EXCITE","description":"Message-ID is forged, (excite.com)"},{"name":"FORGED_MSGID_HOTMAIL","description":"Message-ID is forged, (hotmail.com)"},{"name":"FORGED_MSGID_MSN","description":"Message-ID is forged, (msn.com)"},{"name":"FORGED_MSGID_YAHOO","description":"Message-ID is forged, (yahoo.com)"},{"name":"MSGID_FROM_MTA_HEADER","description":"Message-Id was added by a relay"},{"name":"MSGID_SHORT","description":"Message-ID is unusually short"},{"name":"MSGID_MULTIPLE_AT","description":"Message-ID contains multiple '@' characters"},{"name":"DATE_SPAMWARE_Y2K","description":"Date header uses unusual Y2K formatting"},{"name":"INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"INVALID_DATE_TZ_ABSURD","description":"Invalid Date: header (timezone does not exist)"},{"name":"INVALID_TZ_CST","description":"Invalid date in header (wrong CST timezone)"},{"name":"INVALID_TZ_EST","description":"Invalid date in header (wrong EST timezone)"},{"name":"FROM_EXCESS_BASE64","description":"From: base64 encoded unnecessarily"},{"name":"ENGLISH_UCE_SUBJECT","description":"Subject contains an English UCE tag"},{"name":"JAPANESE_UCE_SUBJECT","description":"Subject contains a Japanese UCE tag"},{"name":"JAPANESE_UCE_BODY","description":"Body contains Japanese UCE tag"},{"name":"RUSSIAN_UCE_SUBJECT","description":"Subject contains a Russian UCE tag"},{"name":"KOREAN_UCE_SUBJECT","description":"Subject: contains Korean unsolicited email tag"},{"name":"RCVD_DOUBLE_IP_SPAM","description":"Bulk email fingerprint (double IP) found"},{"name":"RCVD_DOUBLE_IP_LOOSE","description":"Received: by and from look like IP addresses"},{"name":"FORGED_TELESP_RCVD","description":"Contains forged hostname for a DSL IP in Brazil"},{"name":"CONFIRMED_FORGED","description":"Received headers are forged"},{"name":"MULTI_FORGED","description":"Received headers indicate multiple forgeries"},{"name":"NONEXISTENT_CHARSET","description":"Character set doesn't exist"},{"name":"MISSING_MID","description":"Missing Message-Id: header"},{"name":"MISSING_DATE","description":"Missing Date: header"},{"name":"MISSING_SUBJECT","description":"Missing Subject: header"},{"name":"MISSING_FROM","description":"Missing From: header"},{"name":"GAPPY_SUBJECT","description":"Subject: contains G.a.p.p.y-T.e.x.t"},{"name":"PREVENT_NONDELIVERY","description":"Message has Prevent-NonDelivery-Report header"},{"name":"X_IP","description":"Message has X-IP header"},{"name":"MISSING_MIMEOLE","description":"Message has X-MSMail-Priority, but no X-MimeOLE"},{"name":"SUBJ_AS_SEEN","description":"Subject contains \"As Seen\""},{"name":"SUBJ_DOLLARS","description":"Subject starts with dollar amount"},{"name":"SUBJ_YOUR_DEBT","description":"Subject contains \"Your Bills\" or similar"},{"name":"SUBJ_YOUR_FAMILY","description":"Subject contains \"Your Family\""},{"name":"RCVD_FAKE_HELO_DOTCOM","description":"Received contains a faked HELO hostname"},{"name":"SUBJECT_DIET","description":"Subject talks about losing pounds"},{"name":"MIME_BOUND_DD_DIGITS","description":"Spam tool pattern in MIME boundary"},{"name":"MIME_BOUND_DIGITS_15","description":"Spam tool pattern in MIME boundary"},{"name":"MIME_BOUND_MANY_HEX","description":"Spam tool pattern in MIME boundary"},{"name":"TO_MALFORMED","description":"To: has a malformed address"},{"name":"MIME_HEADER_CTYPE_ONLY","description":"'Content-Type' found without required MIME headers"},{"name":"WITH_LC_SMTP","description":"Received line contains spam-sign (lowercase smtp)"},{"name":"SUBJ_BUY","description":"Subject line starts with Buy or Buying"},{"name":"RCVD_AM_PM","description":"Received headers forged (AM/PM)"},{"name":"FAKE_OUTBLAZE_RCVD","description":"Received header contains faked 'mr.outblaze.com'"},{"name":"UNCLOSED_BRACKET","description":"Headers contain an unclosed bracket"},{"name":"FROM_DOMAIN_NOVOWEL","description":"From: domain has series of non-vowel letters"},{"name":"FROM_LOCAL_NOVOWEL","description":"From: localpart has series of non-vowel letters"},{"name":"FROM_LOCAL_HEX","description":"From: localpart has long hexadecimal sequence"},{"name":"FROM_LOCAL_DIGITS","description":"From: localpart has long digit sequence"},{"name":"X_PRIORITY_CC","description":"Cc: after X-Priority: (bulk email fingerprint)"},{"name":"BAD_ENC_HEADER","description":"Message has bad MIME encoding in the header"},{"name":"__VIA_ML","description":"Mail from a mailing list"},{"name":"__ML_TURNS_SP_TO_TAB","description":"A mailing list changing a space to a TAB"},{"name":"RCVD_ILLEGAL_IP","description":"Received: contains illegal IP address"},{"name":"CHARSET_FARAWAY_HEADER","description":"A foreign language charset used in headers"},{"name":"SUBJ_ILLEGAL_CHARS","description":"Subject: has too many raw illegal characters"},{"name":"FROM_ILLEGAL_CHARS","description":"From: has too many raw illegal characters"},{"name":"HEAD_ILLEGAL_CHARS","description":"Headers have too many raw illegal characters"},{"name":"FORGED_HOTMAIL_RCVD2","description":"hotmail.com 'From' address, but no 'Received:'"},{"name":"FORGED_YAHOO_RCVD","description":"'From' yahoo.com does not match 'Received' headers"},{"name":"FORGED_GMAIL_RCVD","description":"'From' gmail.com does not match 'Received' headers"},{"name":"SORTED_RECIPS","description":"Recipient list is sorted by address"},{"name":"SUSPICIOUS_RECIPS","description":"Similar addresses in recipient list"},{"name":"MISSING_HEADERS","description":"Missing To: header"},{"name":"DATE_IN_PAST_03_06","description":"Date: is 3 to 6 hours before Received: date"},{"name":"DATE_IN_PAST_06_12","description":"Date: is 6 to 12 hours before Received: date"},{"name":"DATE_IN_PAST_12_24","description":"Date: is 12 to 24 hours before Received: date"},{"name":"DATE_IN_PAST_24_48","description":"Date: is 24 to 48 hours before Received: date"},{"name":"DATE_IN_PAST_96_XX","description":"Date: is 96 hours or more before Received: date"},{"name":"DATE_IN_FUTURE_03_06","description":"Date: is 3 to 6 hours after Received: date"},{"name":"DATE_IN_FUTURE_06_12","description":"Date: is 6 to 12 hours after Received: date"},{"name":"DATE_IN_FUTURE_12_24","description":"Date: is 12 to 24 hours after Received: date"},{"name":"DATE_IN_FUTURE_24_48","description":"Date: is 24 to 48 hours after Received: date"},{"name":"DATE_IN_FUTURE_48_96","description":"Date: is 48 to 96 hours after Received: date"},{"name":"DATE_IN_FUTURE_96_XX","description":"Date: is 96 hours or more after Received: date"},{"name":"UNRESOLVED_TEMPLATE","description":"Headers contain an unresolved template"},{"name":"SUBJ_ALL_CAPS","description":"Subject is all capitals"},{"name":"LOCALPART_IN_SUBJECT","description":"Local part of To: address appears in Subject"},{"name":"MSGID_OUTLOOK_INVALID","description":"Message-Id is fake (in Outlook Express format)"},{"name":"HEADER_COUNT_CTYPE","description":"Multiple Content-Type headers found"},{"name":"HEAD_LONG","description":"Message headers are very long"},{"name":"MISSING_HB_SEP","description":"Missing blank line between message header and body"},{"name":"UNPARSEABLE_RELAY","description":"Informational: message has unparseable relay lines"},{"name":"RCVD_HELO_IP_MISMATCH","description":"Received: HELO and IP do not match, but should"},{"name":"NO_RDNS_DOTCOM_HELO","description":"Host HELO'd as a big ISP, but had no rDNS"},{"name":"HTML_SHORT_LINK_IMG_1","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_LINK_IMG_2","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_LINK_IMG_3","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_CENTER","description":"HTML is very short with CENTER tag"},{"name":"HTML_CHARSET_FARAWAY","description":"A foreign language charset used in HTML markup"},{"name":"HTML_MIME_NO_HTML_TAG","description":"HTML-only message, but there is no HTML tag"},{"name":"HTML_MISSING_CTYPE","description":"Message is HTML without HTML Content-Type"},{"name":"HIDE_WIN_STATUS","description":"Javascript to hide URLs in browser"},{"name":"OBFUSCATING_COMMENT","description":"HTML comments which obfuscate text"},{"name":"JS_FROMCHARCODE","description":"Document is built from a Javascript charcode array"},{"name":"ENTITY_DEC_OTHER","description":"HTML contains needlessly encoded punctuation"},{"name":"HTML_MESSAGE","description":"HTML included in message"},{"name":"HTML_COMMENT_SHORT","description":"HTML comment is very short"},{"name":"HTML_COMMENT_SAVED_URL","description":"HTML message is a saved web page"},{"name":"HTML_EMBEDS","description":"HTML with embedded plugin object"},{"name":"HTML_EXTRA_CLOSE","description":"HTML contains far too many close tags"},{"name":"HTML_FONT_SIZE_LARGE","description":"HTML font size is large"},{"name":"HTML_FONT_SIZE_HUGE","description":"HTML font size is huge"},{"name":"HTML_FONT_LOW_CONTRAST","description":"HTML font color similar or identical to background"},{"name":"HTML_FONT_FACE_BAD","description":"HTML font face is not a word"},{"name":"HTML_FORMACTION_MAILTO","description":"HTML includes a form which sends mail"},{"name":"HTML_IMAGE_ONLY_04","description":"HTML: images with 0-400 bytes of words"},{"name":"HTML_IMAGE_ONLY_08","description":"HTML: images with 400-800 bytes of words"},{"name":"HTML_IMAGE_ONLY_12","description":"HTML: images with 800-1200 bytes of words"},{"name":"HTML_IMAGE_ONLY_16","description":"HTML: images with 1200-1600 bytes of words"},{"name":"HTML_IMAGE_ONLY_20","description":"HTML: images with 1600-2000 bytes of words"},{"name":"HTML_IMAGE_ONLY_24","description":"HTML: images with 2000-2400 bytes of words"},{"name":"HTML_IMAGE_ONLY_28","description":"HTML: images with 2400-2800 bytes of words"},{"name":"HTML_IMAGE_ONLY_32","description":"HTML: images with 2800-3200 bytes of words"},{"name":"HTML_IMAGE_RATIO_02","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_04","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_06","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_08","description":"HTML has a low ratio of text to image area"},{"name":"HTML_OBFUSCATE_05_10","description":"Message is 5% to 10% HTML obfuscation"},{"name":"HTML_OBFUSCATE_10_20","description":"Message is 10% to 20% HTML obfuscation"},{"name":"HTML_OBFUSCATE_20_30","description":"Message is 20% to 30% HTML obfuscation"},{"name":"HTML_OBFUSCATE_30_40","description":"Message is 30% to 40% HTML obfuscation"},{"name":"HTML_OBFUSCATE_50_60","description":"Message is 50% to 60% HTML obfuscation"},{"name":"HTML_OBFUSCATE_70_80","description":"Message is 70% to 80% HTML obfuscation"},{"name":"HTML_OBFUSCATE_90_100","description":"Message is 90% to 100% HTML obfuscation"},{"name":"HTML_TAG_BALANCE_BODY","description":"HTML has unbalanced \"body\" tags"},{"name":"HTML_TAG_BALANCE_HEAD","description":"HTML has unbalanced \"head\" tags"},{"name":"HTML_TAG_EXIST_BGSOUND","description":"HTML has \"bgsound\" tag"},{"name":"HTML_BADTAG_40_50","description":"HTML message is 40% to 50% bad tags"},{"name":"HTML_BADTAG_50_60","description":"HTML message is 50% to 60% bad tags"},{"name":"HTML_BADTAG_60_70","description":"HTML message is 60% to 70% bad tags"},{"name":"HTML_BADTAG_90_100","description":"HTML message is 90% to 100% bad tags"},{"name":"HTML_NONELEMENT_30_40","description":"30% to 40% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_40_50","description":"40% to 50% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_60_70","description":"60% to 70% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_80_90","description":"80% to 90% of HTML elements are non-standard"},{"name":"HTML_IFRAME_SRC","description":"Message has HTML IFRAME tag with SRC URI"},{"name":"__DC_IMG_HTML_RATIO","description":"Low rawbody to pixel area ratio"},{"name":"__DC_IMG_TEXT_RATIO","description":"Low body to pixel area ratio"},{"name":"DC_GIF_UNO_LARGO","description":"Message contains a single large gif image"},{"name":"__DC_GIF_MULTI_LARGO","description":"Message has 2+ inline gif covering lots of area"},{"name":"DC_PNG_UNO_LARGO","description":"Message contains a single large png image"},{"name":"__DC_PNG_MULTI_LARGO","description":"Message has 2+ png images covering lots of area"},{"name":"DC_IMAGE_SPAM_TEXT","description":"Possible Image-only spam with little text"},{"name":"DC_IMAGE_SPAM_HTML","description":"Possible Image-only spam"},{"name":"__RCVD_IN_MSPIKE_Z","description":"Spam wave participant"},{"name":"RCVD_IN_MSPIKE_L5","description":"Very bad reputation (-5)"},{"name":"RCVD_IN_MSPIKE_L4","description":"Bad reputation (-4)"},{"name":"RCVD_IN_MSPIKE_L3","description":"Low reputation (-3)"},{"name":"RCVD_IN_MSPIKE_L2","description":"Suspicious reputation (-2)"},{"name":"RCVD_IN_MSPIKE_H5","description":"Excellent reputation (+5)"},{"name":"RCVD_IN_MSPIKE_H4","description":"Very Good reputation (+4)"},{"name":"RCVD_IN_MSPIKE_H3","description":"Good reputation (+3)"},{"name":"RCVD_IN_MSPIKE_H2","description":"Average reputation (+2)"},{"name":"RCVD_IN_MSPIKE_BL","description":"Mailspike blacklisted"},{"name":"RCVD_IN_MSPIKE_WL","description":"Mailspike good senders"},{"name":"UPPERCASE_50_75","description":"message body is 50-75% uppercase"},{"name":"UPPERCASE_75_100","description":"message body is 75-100% uppercase"},{"name":"INVALID_MSGID","description":"Message-Id is not valid, according to RFC 2822"},{"name":"FORGED_MUA_MOZILLA","description":"Forged mail pretending to be from Mozilla"},{"name":"PERCENT_RANDOM","description":"Message has a random macro in it"},{"name":"EMPTY_MESSAGE","description":"Message appears to have no textual parts and no Subject: text"},{"name":"NO_HEADERS_MESSAGE","description":"Message appears to be missing most RFC-822 headers"},{"name":"DIGEST_MULTIPLE","description":"Message hits more than one network digest check"},{"name":"NO_DNS_FOR_FROM","description":"Envelope sender has no MX or A DNS records"},{"name":"GMD_PDF_HORIZ","description":"Contains pdf 100-240 (high) x 450-800 (wide)"},{"name":"GMD_PDF_SQUARE","description":"Contains pdf 180-360 (high) x 180-360 (wide)"},{"name":"GMD_PDF_VERT","description":"Contains pdf 450-800 (high) x 100-240 (wide)"},{"name":"GMD_PDF_FUZZY1_T1","description":"Fuzzy MD5 Match 57EBC1FFB1A24CC14AE23E1E227C3484"},{"name":"GMD_PDF_FUZZY2_T1","description":"Fuzzy MD5 Match 653C8AA9FDFD03D382523488058360A2"},{"name":"GMD_AUTHOR_COLET","description":"PDF author was 'colet'"},{"name":"GMD_AUTHOR_MOBILE","description":"PDF author was 'mobile'"},{"name":"GMD_AUTHOR_OOO","description":"PDF author was 'openofficeuser'"},{"name":"GMD_AUTHOR_HPADMIN","description":"PDF author was 'HP_Administrator'"},{"name":"GMD_PRODUCER_GPL","description":"PDF producer was GPL Ghostscript"},{"name":"GMD_PRODUCER_POWERPDF","description":"PDF producer was PowerPDF"},{"name":"GMD_PRODUCER_EASYPDF","description":"PDF producer was BCL easyPDF"},{"name":"GMD_PDF_ENCRYPTED","description":"Attached PDF is encrypted"},{"name":"GMD_PDF_EMPTY_BODY","description":"Attached PDF with empty message body"},{"name":"GMD_PDF_STOX_M1","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M2","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M3","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M4","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M5","description":"PDF Stox Spam"},{"name":"REMOVE_BEFORE_LINK","description":"Removal phrase right before a link"},{"name":"GUARANTEED_100_PERCENT","description":"One hundred percent guaranteed"},{"name":"DEAR_FRIEND","description":"Dear Friend? That's not very dear!"},{"name":"DEAR_SOMETHING","description":"Contains 'Dear (something)'"},{"name":"BILLION_DOLLARS","description":"Talks about lots of money"},{"name":"EXCUSE_4","description":"Claims you can be removed from the list"},{"name":"EXCUSE_REMOVE","description":"Talks about how to be removed from mailings"},{"name":"STRONG_BUY","description":"Tells you about a strong buy"},{"name":"STOCK_ALERT","description":"Offers a alert about a stock"},{"name":"NOT_ADVISOR","description":"Not registered investment advisor"},{"name":"PREST_NON_ACCREDITED","description":"'Prestigious Non-Accredited Universities'"},{"name":"BODY_ENHANCEMENT","description":"Information on growing body parts"},{"name":"BODY_ENHANCEMENT2","description":"Information on getting larger body parts"},{"name":"IMPOTENCE","description":"Impotence cure"},{"name":"NA_DOLLARS","description":"Talks about a million North American dollars"},{"name":"US_DOLLARS_3","description":"Mentions millions of $ ($NN,NNN,NNN.NN)"},{"name":"MILLION_USD","description":"Talks about millions of dollars"},{"name":"URG_BIZ","description":"Contains urgent matter"},{"name":"MONEY_BACK","description":"Money back guarantee"},{"name":"FREE_QUOTE_INSTANT","description":"Free express or no-obligation quote"},{"name":"BAD_CREDIT","description":"Eliminate Bad Credit"},{"name":"REFINANCE_YOUR_HOME","description":"Home refinancing"},{"name":"REFINANCE_NOW","description":"Home refinancing"},{"name":"NO_MEDICAL","description":"No Medical Exams"},{"name":"DIET_1","description":"Lose Weight Spam"},{"name":"FIN_FREE","description":"Freedom of a financial nature"},{"name":"FORWARD_LOOKING","description":"Stock Disclaimer Statement"},{"name":"ONE_TIME","description":"One Time Rip Off"},{"name":"JOIN_MILLIONS","description":"Join Millions of Americans"},{"name":"MARKETING_PARTNERS","description":"Claims you registered with a partner"},{"name":"LOW_PRICE","description":"Lowest Price"},{"name":"UNCLAIMED_MONEY","description":"People just leave money laying around"},{"name":"OBSCURED_EMAIL","description":"Message seems to contain rot13ed address"},{"name":"BANG_OPRAH","description":"Talks about Oprah with an exclamation!"},{"name":"ACT_NOW_CAPS","description":"Talks about 'acting now' with capitals"},{"name":"MORE_SEX","description":"Talks about a bigger drive for sex"},{"name":"BANG_GUAR","description":"Something is emphatically guaranteed"},{"name":"RUDE_HTML","description":"Spammer message says you need an HTML mailer"},{"name":"INVESTMENT_ADVICE","description":"Message mentions investment advice"},{"name":"MALE_ENHANCE","description":"Message talks about enhancing men"},{"name":"PRICES_ARE_AFFORDABLE","description":"Message says that prices aren't too expensive"},{"name":"REPLICA_WATCH","description":"Message talks about a replica watch"},{"name":"EM_ROLEX","description":"Message puts emphasis on the watch manufacturer"},{"name":"FREE_PORN","description":"Possible porn - Free Porn"},{"name":"CUM_SHOT","description":"Possible porn - Cum Shot"},{"name":"LIVE_PORN","description":"Possible porn - Live Porn"},{"name":"SUBJECT_SEXUAL","description":"Subject indicates sexually-explicit content"},{"name":"RATWARE_EGROUPS","description":"Bulk email fingerprint (eGroups) found"},{"name":"RATWARE_OE_MALFORMED","description":"X-Mailer has malformed Outlook Express version"},{"name":"RATWARE_MOZ_MALFORMED","description":"Bulk email fingerprint (Mozilla malformed) found"},{"name":"RATWARE_MPOP_WEBMAIL","description":"Bulk email fingerprint (mPOP Web-Mail)"},{"name":"FORGED_MUA_IMS","description":"Forged mail pretending to be from IMS"},{"name":"FORGED_MUA_OUTLOOK","description":"Forged mail pretending to be from MS Outlook"},{"name":"FORGED_MUA_OIMO","description":"Forged mail pretending to be from MS Outlook IMO"},{"name":"MAILING_LIST_MULTI","description":"Multiple indicators imply a widely-seen list manager"},{"name":"FORGED_MUA_EUDORA","description":"Forged mail pretending to be from Eudora"},{"name":"FORGED_MUA_THEBAT_CS","description":"Mail pretending to be from The Bat! (charset)"},{"name":"FORGED_MUA_THEBAT_BOUN","description":"Mail pretending to be from The Bat! (boundary)"},{"name":"FORGED_OUTLOOK_HTML","description":"Outlook can't send HTML message only"},{"name":"FORGED_IMS_HTML","description":"IMS can't send HTML message only"},{"name":"FORGED_THEBAT_HTML","description":"The Bat! can't send HTML message only"},{"name":"REPTO_QUOTE_AOL","description":"AOL doesn't do quoting like this"},{"name":"REPTO_QUOTE_IMS","description":"IMS doesn't do quoting like this"},{"name":"REPTO_QUOTE_MSN","description":"MSN doesn't do quoting like this"},{"name":"REPTO_QUOTE_QUALCOMM","description":"Qualcomm/Eudora doesn't do quoting like this"},{"name":"REPTO_QUOTE_YAHOO","description":"Yahoo! doesn't do quoting like this"},{"name":"FORGED_QUALCOMM_TAGS","description":"QUALCOMM mailers can't send HTML in this format"},{"name":"FORGED_IMS_TAGS","description":"IMS mailers can't send HTML in this format"},{"name":"FORGED_OUTLOOK_TAGS","description":"Outlook can't send HTML in this format"},{"name":"RATWARE_HASH_DASH","description":"Contains a hashbuster in Send-Safe format"},{"name":"RATWARE_ZERO_TZ","description":"Bulk email fingerprint (+0000) found"},{"name":"X_MESSAGE_INFO","description":"Bulk email fingerprint (X-Message-Info) found"},{"name":"HEADER_SPAM","description":"Bulk email fingerprint (header-based) found"},{"name":"RATWARE_RCVD_PF","description":"Bulk email fingerprint (Received PF) found"},{"name":"RATWARE_RCVD_AT","description":"Bulk email fingerprint (Received @) found"},{"name":"RATWARE_OUTLOOK_NONAME","description":"Bulk email fingerprint (Outlook no name) found"},{"name":"RATWARE_MS_HASH","description":"Bulk email fingerprint (msgid ms hash) found"},{"name":"RATWARE_NAME_ID","description":"Bulk email fingerprint (msgid from) found"},{"name":"RATWARE_EFROM","description":"Bulk email fingerprint (envfrom) found"},{"name":"NUMERIC_HTTP_ADDR","description":"Uses a numeric IP address in URL"},{"name":"HTTP_ESCAPED_HOST","description":"Uses %-escapes inside a URL's hostname"},{"name":"HTTP_EXCESSIVE_ESCAPES","description":"Completely unnecessary %-escapes inside a URL"},{"name":"IP_LINK_PLUS","description":"Dotted-decimal IP address followed by CGI"},{"name":"WEIRD_PORT","description":"Uses non-standard port number for HTTP"},{"name":"HTTP_ENTITIES_HOST","description":"URI obscured with character entities"},{"name":"YAHOO_RD_REDIR","description":"Has Yahoo Redirect URI"},{"name":"YAHOO_DRS_REDIR","description":"Has Yahoo Redirect URI"},{"name":"HTTP_77","description":"Contains an URL-encoded hostname (HTTP77)"},{"name":"SPOOF_COM2OTH","description":"URI contains \".com\" in middle"},{"name":"SPOOF_COM2COM","description":"URI contains \".com\" in middle and end"},{"name":"SPOOF_NET2COM","description":"URI contains \".net\" or \".org\", then \".com\""},{"name":"URI_HEX","description":"URI hostname has long hexadecimal sequence"},{"name":"URI_NOVOWEL","description":"URI hostname has long non-vowel sequence"},{"name":"URI_UNSUBSCRIBE","description":"URI contains suspicious unsubscribe link"},{"name":"URI_NO_WWW_INFO_CGI","description":"CGI in .info TLD other than third-level \"www\""},{"name":"URI_NO_WWW_BIZ_CGI","description":"CGI in .biz TLD other than third-level \"www\""},{"name":"NORMAL_HTTP_TO_IP","description":"URI host has a public dotted-decimal IPv4 address"},{"name":"BOUNCE_MESSAGE","description":"MTA bounce message"},{"name":"OOOBOUNCE_MESSAGE","description":"Out Of Office bounce message"},{"name":"CHALLENGE_RESPONSE","description":"Challenge-Response message for mail you sent"},{"name":"CRBOUNCE_MESSAGE","description":"Challenge-Response bounce message"},{"name":"VBOUNCE_MESSAGE","description":"Virus-scanner bounce message"},{"name":"ANY_BOUNCE_MESSAGE","description":"Message is some kind of bounce message"},{"name":"BAYES_00","description":"Bayes spam probability is 0 to 1%"},{"name":"BAYES_05","description":"Bayes spam probability is 1 to 5%"},{"name":"BAYES_20","description":"Bayes spam probability is 5 to 20%"},{"name":"BAYES_40","description":"Bayes spam probability is 20 to 40%"},{"name":"BAYES_50","description":"Bayes spam probability is 40 to 60%"},{"name":"BAYES_60","description":"Bayes spam probability is 60 to 80%"},{"name":"BAYES_80","description":"Bayes spam probability is 80 to 95%"},{"name":"BAYES_95","description":"Bayes spam probability is 95 to 99%"},{"name":"BAYES_99","description":"Bayes spam probability is 99 to 100%"},{"name":"BAYES_999","description":"Bayes spam probability is 99.9 to 100%"},{"name":"ACCESSDB","description":"Message would have been caught by accessdb"},{"name":"MICROSOFT_EXECUTABLE","description":"Message includes Microsoft executable program"},{"name":"MIME_SUSPECT_NAME","description":"MIME filename does not match content"},{"name":"DCC_CHECK","description":"Detected as bulk mail by DCC (dcc-servers.net)"},{"name":"DCC_REPUT_00_12","description":"DCC reputation between 0 and 12 %  (mostly ham)"},{"name":"DCC_REPUT_13_19","description":"DCC reputation between 13 and 19 %"},{"name":"DCC_REPUT_70_89","description":"DCC reputation between 70 and 89 %"},{"name":"DCC_REPUT_90_94","description":"DCC reputation between 90 and 94 %"},{"name":"DCC_REPUT_95_98","description":"DCC reputation between 95 and 98 %  (mostly spam)"},{"name":"DCC_REPUT_99_100","description":"DCC reputation between 99 % or higher (spam)"},{"name":"DKIM_SIGNED","description":"Message has a DKIM or DK signature, not necessarily valid"},{"name":"DKIM_VALID","description":"Message has at least one valid DKIM or DK signature"},{"name":"DKIM_INVALID","description":"DKIM or DK signature exists, but is not valid"},{"name":"DKIM_VALID_AU","description":"Message has a valid DKIM or DK signature from author's domain"},{"name":"DKIM_VALID_EF","description":"Message has a valid DKIM or DK signature from envelope-from domain"},{"name":"__DKIM_DEPENDABLE","description":"A validation failure not attributable to truncation"},{"name":"DKIM_ADSP_NXDOMAIN","description":"No valid author signature and domain not in DNS"},{"name":"DKIM_ADSP_DISCARD","description":"No valid author signature, domain signs all mail and suggests discarding the rest"},{"name":"DKIM_ADSP_ALL","description":"No valid author signature, domain signs all mail"},{"name":"DKIM_ADSP_CUSTOM_LOW","description":"No valid author signature, adsp_override is CUSTOM_LOW"},{"name":"DKIM_ADSP_CUSTOM_MED","description":"No valid author signature, adsp_override is CUSTOM_MED"},{"name":"DKIM_ADSP_CUSTOM_HIGH","description":"No valid author signature, adsp_override is CUSTOM_HIGH"},{"name":"__VIA_RESIGNER","description":"Mail through a popular signing remailer"},{"name":"NML_ADSP_CUSTOM_LOW","description":"ADSP custom_low hit, and not from a mailing list"},{"name":"NML_ADSP_CUSTOM_MED","description":"ADSP custom_med hit, and not from a mailing list"},{"name":"NML_ADSP_CUSTOM_HIGH","description":"ADSP custom_high hit, and not from a mailing list"},{"name":"RCVD_IN_DNSWL_NONE","description":"Sender listed at https://www.dnswl.org/, no trust"},{"name":"RCVD_IN_DNSWL_LOW","description":"Sender listed at https://www.dnswl.org/, low trust"},{"name":"RCVD_IN_DNSWL_MED","description":"Sender listed at https://www.dnswl.org/, medium trust"},{"name":"RCVD_IN_DNSWL_HI","description":"Sender listed at https://www.dnswl.org/, high trust"},{"name":"RCVD_IN_DNSWL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to DNSWL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"PYZOR_CHECK","description":"Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)"},{"name":"RAZOR2_CHECK","description":"Listed in Razor2 (http://razor.sf.net/)"},{"name":"RAZOR2_CF_RANGE_51_100","description":"Razor2 gives confidence level above 50%"},{"name":"SUBJECT_FUZZY_MEDS","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_VPILL","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_CHEAP","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_PENIS","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_TION","description":"Attempt to obfuscate words in Subject:"},{"name":"FUZZY_AFFORDABLE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_AMBIEN","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_BILLION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_CPILL","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_CREDIT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_ERECT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_GUARANTEE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MEDICATION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MILLION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MONEY","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MORTGAGE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_OBLIGATION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_OFFERS","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PHARMACY","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PHENT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PRESCRIPT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PRICES","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_REFINANCE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_REMOVE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_ROLEX","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_SOFTWARE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_THOUSANDS","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VLIUM","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VIOXX","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VPILL","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_XPILL","description":"Attempt to obfuscate words in spam"},{"name":"SPF_PASS","description":"SPF: sender matches SPF record"},{"name":"SPF_NEUTRAL","description":"SPF: sender does not match SPF record (neutral)"},{"name":"SPF_FAIL","description":"SPF: sender does not match SPF record (fail)"},{"name":"SPF_SOFTFAIL","description":"SPF: sender does not match SPF record (softfail)"},{"name":"SPF_HELO_PASS","description":"SPF: HELO matches SPF record"},{"name":"SPF_HELO_NEUTRAL","description":"SPF: HELO does not match SPF record (neutral)"},{"name":"SPF_HELO_FAIL","description":"SPF: HELO does not match SPF record (fail)"},{"name":"SPF_HELO_SOFTFAIL","description":"SPF: HELO does not match SPF record (softfail)"},{"name":"SPF_NONE","description":"SPF: sender does not publish an SPF Record"},{"name":"SPF_HELO_NONE","description":"SPF: HELO does not publish an SPF Record"},{"name":"T_SPF_PERMERROR","description":"SPF: test of record failed (permerror)"},{"name":"T_SPF_TEMPERROR","description":"SPF: test of record failed (temperror)"},{"name":"T_SPF_HELO_PERMERROR","description":"SPF: test of HELO record failed (permerror)"},{"name":"T_SPF_HELO_TEMPERROR","description":"SPF: test of HELO record failed (temperror)"},{"name":"UNWANTED_LANGUAGE_BODY","description":"Message written in an undesired language"},{"name":"BODY_8BITS","description":"Body includes 8 consecutive 8-bit characters"},{"name":"URIBL_SBL","description":"Contains an URL's NS IP listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS","description":"Contains an URL's NS IP listed in the Spamhaus CSS blocklist"},{"name":"URIBL_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_DBL_SPAM","description":"Contains a spam URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_PHISH","description":"Contains a Phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_MALWARE","description":"Contains a malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_BOTNETCC","description":"Contains a botned C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_SPAM","description":"Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_REDIR","description":"Contains an abused redirector URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_PHISH","description":"Contains an abused phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_MALW","description":"Contains an abused malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_BOTCC","description":"Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ERROR","description":"Error: queried the Spamhaus DBL blocklist for an IP"},{"name":"URIBL_DBL_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_DBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_SC_SURBL","description":"Contains an URL listed in the SC SURBL blocklist"},{"name":"URIBL_WS_SURBL","description":"Contains an URL listed in the WS SURBL blocklist"},{"name":"URIBL_PH_SURBL","description":"Contains an URL listed in the PH SURBL blocklist"},{"name":"URIBL_MW_SURBL","description":"Contains a URL listed in the MW SURBL blocklist"},{"name":"URIBL_CR_SURBL","description":"Contains an URL listed in the CR SURBL blocklist"},{"name":"URIBL_AB_SURBL","description":"Contains an URL listed in the AB SURBL blocklist"},{"name":"URIBL_ABUSE_SURBL","description":"Contains an URL listed in the ABUSE SURBL blocklist"},{"name":"SURBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to SURBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"URIBL_BLACK","description":"Contains an URL listed in the URIBL blacklist"},{"name":"URIBL_GREY","description":"Contains an URL listed in the URIBL greylist"},{"name":"URIBL_RED","description":"Contains an URL listed in the URIBL redlist"},{"name":"URIBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to URIBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"LONGLINE","description":"Line length exceeds 998 character limit, RFC 5322"},{"name":"RP_8BIT","description":"Return-Path contains 8-bit characters with high bit on"},{"name":"RP_LASTNAME","description":"Return-Path says LAST_NAME literally"},{"name":"RP_UNDERLINE","description":"Return-Path address starts with an underline"},{"name":"RP_MINUS","description":"Return-Path address starts with a minus"},{"name":"CR_IN_SUBJ","description":"Subject contains a CR character"},{"name":"FROM_UNBAL1","description":"From with unbalanced angle brackets, '>' missing"},{"name":"FROM_UNBAL2","description":"From with unbalanced angle brackets, '<' missing"},{"name":"FROM_WSP_TRAIL","description":"Trailing whitespace before '>' in From header field"},{"name":"FROM_WSP_LEAD","description":"Leading whitespace after '<' in From header field"},{"name":"MSGID_WSP_TRAIL","description":"Trailing whitespace before '>' in Message-ID header"},{"name":"MSGID_NOFQDN1","description":"Message-ID with no domain name"},{"name":"MSGID_NOFQDN2","description":"Message-ID without a fully-qualified domain name"},{"name":"SIQ_OI_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_UNKNOWN","description":"Query returned reputation unknown"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_01","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_05","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_10","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_15","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_20","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_25","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_30","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_35","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_40","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_45","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_50","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_55","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_60","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_65","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_70","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_75","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_80","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_85","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_90","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_95","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_99","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_100","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_IP_UNKNOWN","description":"Query returned IP reputation unknown"},{"name":"SIQ_OI_IP_00","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_05","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_10","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_15","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_20","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_25","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_30","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_35","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_40","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_45","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_50","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_55","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_60","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_65","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_70","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_75","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_80","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_85","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_90","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_95","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_99","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_100","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_DOM_UNKNOWN","description":"Query returned domain reputation unknown"},{"name":"SIQ_OI_DOM_00","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_01","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_05","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_10","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_15","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_20","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_25","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_30","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_35","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_40","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_45","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_55","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_60","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_65","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_70","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_75","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_80","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_85","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_90","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_95","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_99","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_100","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_REL_UNKNOWN","description":"Query returned relative reputation unknown"},{"name":"SIQ_OI_REL_00","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_05","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_10","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_15","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_20","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_25","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_30","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_35","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_40","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_45","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_50","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_55","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_60","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_65","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_70","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_75","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_80","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_85","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_90","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_95","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_99","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_100","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1_9","description":"Outbound Index Stability from 1 to 9"},{"name":"SIQ_OI_STAB_10","description":"Outbound Index Stability from 10 to 19"},{"name":"SIQ_OI_STAB_20","description":"Outbound Index Stability from 20 to 29"},{"name":"SIQ_OI_STAB_30","description":"Outbound Index Stability from 30 to 39"},{"name":"SIQ_OI_STAB_40","description":"Outbound Index Stability from 40 to 49"},{"name":"SIQ_OI_STAB_50","description":"Outbound Index Stability from 50 to 59"},{"name":"SIQ_OI_STAB_60","description":"Outbound Index Stability from 60 to 69"},{"name":"SIQ_OI_STAB_70","description":"Outbound Index Stability from 70 to 79"},{"name":"SIQ_OI_STAB_80","description":"Outbound Index Stability from 80 to 89"},{"name":"SIQ_OI_STAB_90","description":"Outbound Index Stability from 90 to 99"},{"name":"SIQ_OI_STAB_100S","description":"Outbound Index Stability from 100 to 999"},{"name":"SIQ_OI_STAB_1000","description":"Outbound Index Stability from 1000 to 1999"},{"name":"SIQ_OI_STAB_2000","description":"Outbound Index Stability from 2000 to 2999"},{"name":"SIQ_OI_STAB_3000","description":"Outbound Index Stability from 3000 to 3999"},{"name":"SIQ_OI_STAB_4000","description":"Outbound Index Stability from 4000 to 4999"},{"name":"SIQ_OI_STAB_5000","description":"Outbound Index Stability of 5000 or more"},{"name":"SIQ_OI_00_100S","description":"OI Rep Score=0 Stability=100-999"},{"name":"SIQ_OI_00_1000","description":"OI Rep Score=0 Stability=1000-1999"},{"name":"SIQ_OI_00_2000","description":"OI Rep Score=0 Stability=2000+"},{"name":"SIQ_OI_01_100S","description":"OI Rep Score=1 Stability=100-999"},{"name":"SIQ_OI_01_1000","description":"OI Rep Score=1 Stability=1000-1999"},{"name":"SIQ_OI_01_2000","description":"OI Rep Score=1 Stability=2000+"},{"name":"SIQ_OI_05_100S","description":"OI Rep Score=2-5 Stability=100-999"},{"name":"SIQ_OI_05_1000","description":"OI Rep Score=2-5 Stability=1000-1999"},{"name":"SIQ_OI_05_2000","description":"OI Rep Score=2-5 Stability=2000+"},{"name":"SERGIO_SUBJECT_VIAGRA01","description":"Viagra garbled subject"},{"name":"SERGIO_SUBJECT_PORN002","description":"Pictures garbled subject"},{"name":"SERGIO_SUBJECT_PORN003","description":"Videos garbled subject"},{"name":"SERGIO_SUBJECT_PORN004","description":"Adult garbled subject"},{"name":"SERGIO_SUBJECT_PORN005","description":"Porn garbled subject"},{"name":"SERGIO_SUBJECT_PORN006","description":"B\\*\\*\\* J\\*\\* garbled subject"},{"name":"SERGIO_SUBJECT_PORN007","description":"Film garbled subject"},{"name":"SERGIO_SUBJECT_PORN008","description":"Mature garbled subject"},{"name":"SERGIO_SUBJECT_PORN009","description":"Undress garbled subject"},{"name":"SERGIO_SUBJECT_PORN010","description":"Movies garbled subject"},{"name":"SERGIO_SUBJECT_PORN011","description":"Sex garbled subject"},{"name":"SERGIO_SUBJECT_PORN012","description":"School garbled subject"},{"name":"SERGIO_SUBJECT_PORN013","description":"Girls garbled subject"},{"name":"SERGIO_SUBJECT_PORN014","description":"F\\*\\*\\* garbled subject"},{"name":"SERGIO_SUBJECT_PORN015","description":"Lesbian garbled subject"},{"name":"FSL_NEW_HELO_USER","description":"Spam's using Helo and User"},{"name":"FSL_XM_419","description":"Old OE version in X-Mailer only seen in 419 spam"},{"name":"FSL_CTYPE_WIN1251","description":"Content-Type only seen in 419 spam"},{"name":"FSL_MID_419","description":"Spam signature in Message-ID"},{"name":"FSL_MISSP_REPLYTO","description":"Mis-spaced from and Reply-to"},{"name":"FSL_YHG_ABUSE","description":"URI pointing to a message in an abused Yahoo Group"},{"name":"FSL_BOTSPAM_1","description":"Two-line spam with URI pointing to .ru domain"},{"name":"FSL_THIS_IS_ADV","description":"This is an advertisement"},{"name":"RCVD_IN_SEMBACKSCATTER","description":"Received from an IP listed by SEM-BACKSCATTER"},{"name":"RCVD_IN_SEMBLACK","description":"Received from an IP listed by SEM-BLACK"},{"name":"SEM_URI","description":"Contains a URI listed by SEM-URI"},{"name":"SEM_URIRED","description":"Contains a URI listed by SEM-URIRED"},{"name":"SEM_FRESH","description":"Contains a domain registered less than 5 days ago"},{"name":"SEM_FRESH_10","description":"Contains a domain registered less than 10 days ago"},{"name":"SEM_FRESH_15","description":"Contains a domain registered less than 15 days ago"},{"name":"REPLYTO_MANY_AT","description":"More than one @ in Reply-To:"},{"name":"SENDER_MANY_AT","description":"More than one @ in Sender:"},{"name":"FROM_MANY_AT","description":"More than one @ in From:"},{"name":"RDNS_LOCALHOST","description":"Sender's public rDNS is \"localhost\""},{"name":"EU_SPAM_LAW","description":"Quoting \"European Parliament\" spam law"},{"name":"HTML_ATTACH","description":"HTML attachment to bypass scanning?"},{"name":"OBFU_HTML_ATTACH","description":"HTML attachment with non-text MIME type"},{"name":"OBFU_TEXT_ATTACH","description":"Text attachment with non-text MIME type"},{"name":"OBFU_DOC_ATTACH","description":"MS Document attachment with generic MIME type"},{"name":"OBFU_PDF_ATTACH","description":"PDF attachment with generic MIME type"},{"name":"OBFU_JPG_ATTACH","description":"JPG attachment with generic MIME type"},{"name":"OBFU_GIF_ATTACH","description":"GIF attachment with generic MIME type"},{"name":"OBFU_ATTACH_MISSP","description":"Obfuscated attachment type and misspaced From"},{"name":"ECMSNGR_MH","description":"eC-Messenger header"},{"name":"CTYPE_NULL","description":"Malformed Content-Type header"},{"name":"OBFU_HTML_ATT_MALW","description":"HTML attachment with incorrect MIME type - possible malware"},{"name":"DOC_ATTACH_NO_EXT","description":"Document attachment with suspicious name"},{"name":"MALW_ATTACH","description":"Attachment filename suspicious, probable malware exploit"},{"name":"ISO_ATTACH","description":"ISO attachment - possible malware delivery"},{"name":"MUA_ONE_WORD","description":"Single word X-Mailer: not CamelCase"},{"name":"DEAR_EMAIL_USER","description":"Dear Email User:"},{"name":"URI_NUMERIC_CCTLD","description":"CCTLD URI with multiple numeric subdomains"},{"name":"PHP_NOVER_MUA","description":"Mail from PHP with no version number"},{"name":"FROM_MISSPACED","description":"From: missing whitespace"},{"name":"FROM_MISSP_EH_MATCH","description":"From misspaced, matches envelope"},{"name":"FROM_MISSP_URI","description":"From misspaced, has URI"},{"name":"FROM_MISSP_USER","description":"From misspaced, from \"User\""},{"name":"FROM_MISSP_NO_TO","description":"From misspaced, To missing"},{"name":"FROM_MISSP_TO_UNDISC","description":"From misspaced, To undisclosed"},{"name":"FROM_MISSP_DKIM","description":"From misspaced, DKIM dependable"},{"name":"FROM_MISSP_REPLYTO","description":"From misspaced, has Reply-To"},{"name":"TO_MISSPACED","description":"To: missing whitespace"},{"name":"FROM_MISSP_FREEMAIL","description":"From misspaced + freemail provider"},{"name":"FROM_MISSP_MSFT","description":"From misspaced + supposed Microsoft tool"},{"name":"FROM_MISSP_DYNIP","description":"From misspaced + dynamic rDNS"},{"name":"MAILER_EQ_ORG","description":"X-Mailer: same as Organization:"},{"name":"FROM_EQ_ORG","description":"From: same as Organization:"},{"name":"HDRS_LCASE","description":"Odd capitalization of message header"},{"name":"MANY_HDRS_LCASE","description":"Odd capitalization of multiple message headers"},{"name":"HDRS_LCASE_1K","description":"Odd capitalization of message headers + long header"},{"name":"HDRS_LCASE_IMGONLY","description":"Odd capitalization of message headers + image-only HTML"},{"name":"MDN_BOTCHED","description":"Malformed return receipt header"},{"name":"HDRS_MISSP","description":"Misspaced headers"},{"name":"SPAMMY_MIME_BDRY_01","description":"Spammy MIME boundary string"},{"name":"TBIRD_SUSP_MIME_BDRY","description":"Unlikely Thunderbird MIME boundary"},{"name":"TBIRD_SPOOF","description":"Claims Thunderbird mail client but looks suspicious"},{"name":"RUNON_SHY","description":"Repeating soft hyphens"},{"name":"LAZY_LISTWASHING","description":"Lazy spammer, painfully obvious bogus addresses"},{"name":"CDISP_SZ_MANY","description":"Suspicious MIME header"},{"name":"FREEMAIL_DOC_PDF","description":"MS document or PDF attachment, from freemail"},{"name":"FREEMAIL_DOC_PDF_BCC","description":"MS document or PDF attachment, from freemail, all recipients hidden"},{"name":"FREEMAIL_RVW_ATTCH","description":"Please review attached document, from freemail"},{"name":"EMPTY_RVW_ATTCH","description":"Please review attached document, empty message"},{"name":"END_FUTURE_EMAILS","description":"Spammy unsubscribe"},{"name":"AD_COMPLAINTS","description":"Complain about this spam"},{"name":"MISQ_HTML","description":"Unbalanced quotes in HTML tag"},{"name":"WIKI_IMG","description":"Image from wikipedia"},{"name":"SUBJ_RE_CLNCLN","description":"Subject RE::"},{"name":"TO_SEM_SEM","description":"To has \";;\""},{"name":"MANY_SUBDOM","description":"Lots and lots of subdomain parts in a URI"},{"name":"RFC_ABUSE_POST","description":"Both abuse and postmaster missing on sender domain"},{"name":"MANY_SPAN_IN_TEXT","description":"Many <SPAN> tags embedded within text"},{"name":"MANY_GOOG_PROXY","description":"Many Google feedproxy URIs"},{"name":"TINY_FLOAT","description":"Has small-font floating HTML - text obfuscation?"},{"name":"__TO_EQ_FROM","description":"To: same as From:"},{"name":"FROM_IN_TO_AND_SUBJ","description":"From address is in To and Subject"},{"name":"TO_IN_SUBJ","description":"To address is in Subject"},{"name":"TO_EQ_FM_HTML_ONLY","description":"To == From and HTML only"},{"name":"TO_EQ_FM_DIRECT_MX","description":"To == From and direct-to-MX"},{"name":"TO_EQ_FM_HTML_DIRECT","description":"To == From and HTML only, direct-to-MX"},{"name":"TO_EQ_FM_SPF_FAIL","description":"To == From and external SPF failed"},{"name":"PDS_TO_EQ_FROM_NAME","description":"From: name same as To: address"},{"name":"__TO_EQ_FROM_DOM","description":"To: domain same as From: domain"},{"name":"TO_EQ_FM_DOM_HTML_ONLY","description":"To domain == From domain and HTML only"},{"name":"TO_EQ_FM_DOM_HTML_IMG","description":"To domain == From domain and HTML image link"},{"name":"TO_EQ_FM_DOM_SPF_FAIL","description":"To domain == From domain and external SPF failed"},{"name":"FROM_URI","description":"URI or www. in From"},{"name":"HAS_APPARENTLY_TO","description":"Has deprecated Apparently-To header"},{"name":"MANY_APPARENTLY_TO","description":"Has many Apparently-To headers"},{"name":"FUZZY_OPTOUT","description":"Obfuscated opt-out text"},{"name":"GAPPY_TRADING","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_SECURITIES","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_RISK","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_SELLING","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_HUNDRED","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_THOUSAND","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_EXPENSES","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_DOLLARS","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_GENITALIA","description":"G.a.p.p.y male body parts"},{"name":"GAPPY_PILLS","description":"G.a.p.p.y pills"},{"name":"STYLE_GIBBERISH","description":"Nonsense in HTML <STYLE> tag"},{"name":"SCRIPT_GIBBERISH","description":"Nonsense in HTML <SCRIPT> tag"},{"name":"COMMENT_GIBBERISH","description":"Nonsense in long HTML comment"},{"name":"BIGNUM_EMAILS","description":"Lots of email addresses/leads"},{"name":"PPMC_FROM_1","description":"Paypal phishing sign"},{"name":"URI_HIDDEN_2","description":"URI contains a hidden file or directory"},{"name":"__NSL_ORIG_FROM_41","description":"Originates from 41.0.0.0/8"},{"name":"__NSL_RCVD_FROM_41","description":"Received from 41.0.0.0/8"},{"name":"MONEY_FROM_41","description":"Lots of money from Africa"},{"name":"__FROM_41_FREEMAIL","description":"Sent from Africa + freemail provider"},{"name":"__FROM_AFR_FREEMAIL","description":"Sent from Africa + freemail provider"},{"name":"NSL_RCVD_HELO_USER","description":"Received from HELO User"},{"name":"NSL_RCVD_FROM_USER","description":"Received from User"},{"name":"DATE_DOTS","description":"Periods in date header"},{"name":"IMAGESHACK_URI","description":"URI contains imageshack.us"},{"name":"DYNDNS_URIS","description":"Has multiple dyndns.org URIs"},{"name":"BITLY_URI","description":"URI contains bit.ly"},{"name":"IMG_VIA_BITLY","description":"HTML image via URL shortener - URIBL avoidance?"},{"name":"URI_OBFU_DOM","description":"URI pretending to be different domain"},{"name":"DQ_URI_DOM_IN_PATH","description":"DQ URI having a domain name in the path part"},{"name":"LH_URI_DOM_IN_PATH","description":"Long-host URI having a domain name in the path part"},{"name":"MANY_BIG_LISTS","description":"Lots of mailing lists / databases available!"},{"name":"GZ_PILL_SQUATTERS","description":"Found a link to rogue pill pusher content"},{"name":"TO_JOHNZY","description":"To a spammy recipent"},{"name":"TO_ONE_CHAR","description":"Bogus TO name"},{"name":"FROM_ONE_CHAR","description":"Bogus FROM name"},{"name":"FROM_12LTRDOM","description":"From a 12-letter domain"},{"name":"MONEY_12LTRDOM","description":"Mentions lots of money and from a 12-letter domain"},{"name":"DG_SPAMMER_EMAIL_B","description":"Recognized spammer email address in body"},{"name":"DG_SPAMMER_EMAIL_F","description":"Recognized spammer email address in From: header"},{"name":"OBFU_JVSCR_ESC","description":"Injects content using obfuscated javascript"},{"name":"LIST_PARTIAL","description":"Has incomplete List-* header set"},{"name":"LIST_PRTL_SAME_USER","description":"Incomplete List-* headers and from+to user the same"},{"name":"LIST_PRTL_PUMPDUMP","description":"Incomplete List-* headers and stock pump-and-dump"},{"name":"__UCOZ_URI","description":"URI contains ucoz.org"},{"name":"ARTHUR_INTRUST","description":"Arthur Simmons - registrar spammer extraordinaire"},{"name":"ART_NAMES_ORG","description":"Arthur Simmons - registrar spammer extraordinaire"},{"name":"ANY_PILL_PRICE","description":"Prices for pills"},{"name":"MANY_PILL_PRICE","description":"Prices for many pills"},{"name":"NSL_FREEMAIL_SUBJ","description":"From freemail with missing subject"},{"name":"NSL_FREEMAIL_M1","description":"From freemail, missing subject and uri or many recips"},{"name":"NSL_FREEMAIL_M2","description":"From freemail with uri and many recips"},{"name":"NSL_TO_ENDS_COMMA","description":"To: ends with a comma"},{"name":"CN_B2B_SPAMMER","description":"Chinese company introducing itself"},{"name":"CN_OPTOUT_EML","description":"Opt-out email address in CN B2B spams"},{"name":"REPLYTO_EMPTY","description":"Reply-To undeliverable"},{"name":"FREEMAIL_MANY_TO","description":"Freemail sender, 50+ exposed recipients"},{"name":"GAPPY_PHONE_NA","description":"Phone number with lots of spaces"},{"name":"GAPPY_HTML","description":"HTML body with much useless whitespace"},{"name":"TVD_SPACE_RATIO_MINFP","description":"Space ratio"},{"name":"SUBJECT_UNNEEDED_ENCODING","description":"Subject encoded but not non-ANSI?"},{"name":"TVD_SPACE_ENCODED","description":"Space ratio & encoded subject"},{"name":"TVD_SPACE_ENC_FM_MIME","description":"Space ratio & encoded subject & MIME needed"},{"name":"SUBJ_BROKEN_WORD","description":"Subject contains odd word break"},{"name":"SUBJ_BROKEN_WORDS","description":"Subject contains multiple odd word breaks"},{"name":"SUBJ_BRKN_WORDNUMS","description":"Subject contains odd word breaks and numbers"},{"name":"XM_PHPMAILER_FORGED","description":"Apparently forged header"},{"name":"XM_EC_MESSENGER","description":"eC-Messenger bulk mail service"},{"name":"SUBJ_OBFU_PUNCT_FEW","description":"Possible punctuation-obfuscated Subject: header"},{"name":"SUBJ_OBFU_PUNCT_MANY","description":"Punctuation-obfuscated Subject: header"},{"name":"SCANNED_EXTERNAL","description":"\"Scanned Document\" email from external source - malware?"},{"name":"LARGE_PCT_AFTER_MANY","description":"Many large percentages after..."},{"name":"ACH_CANCELLED","description":"\"ACH cancelled\" fraud / phish"},{"name":"URI_DBL_INDIR","description":"A URI with two levels of indirection"},{"name":"URI_TRPL_INDIR","description":"A URI with at least three levels of indirection"},{"name":"SUBJ_ODD_CASE","description":"Oddly mixed-case Subject: header"},{"name":"BILL_1618","description":"Mentions proposed US law supposedly permitting spamming"},{"name":"NOT_SPAM","description":"I'm not spam! Really! I'm not, I'm not, I'm not!"},{"name":"URI_MALWARE_SCMS","description":"Link to malware exploit download (.SettingContent-ms file)"},{"name":"URI_MALWARE_BH","description":"Possible BlackHole malware links / phishing"},{"name":"URI_DATA","description":"\"data:\" URI - possible malware or phish"},{"name":"SUBJ_ATTENTION","description":"ATTENTION in Subject"},{"name":"IRS_SPOOF","description":"Claims to be IRS, but not from IRS domain"},{"name":"FBI_SPOOF","description":"Claims to be FBI, but not from FBI domain"},{"name":"FBI_MONEY","description":"The FBI wants to give you lots of money?"},{"name":"FROM_MISSP_PHISH","description":"Malformed, claims to be from financial organization - possible phish"},{"name":"UPGRADE_MAILBOX","description":"Upgrade your mailbox! (phishing?)"},{"name":"ACCT_PHISHING","description":"Possible phishing for account information"},{"name":"ACCT_PHISHING_MANY","description":"Phishing for account information"},{"name":"PHISHING_FREEMAIL","description":"Send your login credentials to some random freemail account"},{"name":"GOOGLE_DOCS_PHISH","description":"Possible phishing via a Google Docs form"},{"name":"GOOGLE_DOCS_PHISH_MANY","description":"Phishing via a Google Docs form"},{"name":"URI_GOOGLE_DOCS","description":"URI for Google Docs, common in phishing"},{"name":"URI_PHISH","description":"Phishing using web form"},{"name":"SYSADMIN","description":"Supposedly from your IT department"},{"name":"HTML_FONT_TINY_NORDNS","description":"Font too small to read, no rDNS"},{"name":"BODY_EMPTY","description":"No body text in message"},{"name":"BODY_URI_ONLY","description":"Message body is only a URI in one line of text or for an image"},{"name":"BODY_SINGLE_WORD","description":"Message body is only one word (no spaces)"},{"name":"BODY_SINGLE_URI","description":"Message body is only a URI"},{"name":"YOUR_PHOTOS","description":"\"Your Photos\" phishing or malware"},{"name":"FORM_LOW_CONTRAST","description":"Fill in a form with hidden text"},{"name":"GAPPY_LOW_CONTRAST","description":"Gappy subject + hidden text"},{"name":"SUBJ_OBFU_LOW_CNTRST","description":"Subject obfuscation + hidden text"},{"name":"URI_DOTDOT_LOW_CNTRST","description":"Suspicious URI + hidden text"},{"name":"STOCK_LOW_CONTRAST","description":"Stocks + hidden text"},{"name":"NORDNS_LOW_CONTRAST","description":"No rDNS + hidden text"},{"name":"FOUND_YOU","description":"I found you..."},{"name":"HTML_FONT_ONE_WORD_MANY","description":"Many one-word font changes"},{"name":"ADMITS_CANSPAM","description":"Admits to being spam"},{"name":"ADMITS_SPAM","description":"Admits this is an ad"},{"name":"OBFU_ADVERT","description":"Misspelled \"advertisement\""},{"name":"REMOVE_YEAHNET","description":"Opt-out address used by CN spammers"},{"name":"ES_LIC_FROM_INFO","description":"Spanish-language spam from .info domain"},{"name":"JIMDO_PHISH","description":"Apparent phishing via webform hosted at jimdo.com"},{"name":"URI_WPADMIN","description":"WordPress login/admin URI, possible phishing"},{"name":"URI_WP_HACKED","description":"URI for compromised WordPress site, possible malware"},{"name":"URI_WP_DIRINDEX","description":"URI for compromised WordPress site, possible malware"},{"name":"URI_WP_HACKED_2","description":"URI for compromised WordPress site, possible malware"},{"name":"XPRIO","description":"Has X-Priority header"},{"name":"XPRIO_SHORT_SUBJ","description":"Has X-Priority header + short subject"},{"name":"FROM_MISSP_XPRIO","description":"Misspaced FROM + X-Priority"},{"name":"STATIC_XPRIO_OLE","description":"Static RDNS + X-Priority + MIMEOLE"},{"name":"HEXHASH_WORD","description":"Multiple instances of word + hexadecimal hash"},{"name":"UC_GIBBERISH_OBFU","description":"Multiple instances of \"word VERYLONGGIBBERISH word\""},{"name":"CANT_SEE_AD","description":"You really want to see our spam."},{"name":"LONG_HEX_URI","description":"Very long purely hexadecimal URI"},{"name":"LONG_IMG_URI","description":"Image URI with very long path component - web bug?"},{"name":"HTML_OFF_PAGE","description":"HTML element rendered well off the displayed page"},{"name":"PUMPDUMP","description":"Pump-and-dump stock scam phrase"},{"name":"PUMPDUMP_MULTI","description":"Pump-and-dump stock scam phrases"},{"name":"STOCK_TIP","description":"Stock tips"},{"name":"PUMPDUMP_TIP","description":"Pump-and-dump stock tip"},{"name":"DR_OZ_OBFU","description":"Obfuscated Doctor Oz"},{"name":"DOC_OZ","description":"Doctor Oz"},{"name":"ADMAIL","description":"\"admail\" and variants"},{"name":"ORS","description":"\"Online Rate Saver\""},{"name":"THIS_AD","description":"\"This ad\" and variants"},{"name":"AD_PREFS","description":"Advertising preferences"},{"name":"URI_OPTOUT_USME","description":"Opt-out URI, unusual TLD"},{"name":"URI_OPTOUT_3LD","description":"Opt-out URI, suspicious hostname"},{"name":"URI_TRY_USME","description":"\"Try it\" URI, unusual TLD"},{"name":"URI_TRY_3LD","description":"\"Try it\" URI, suspicious hostname"},{"name":"DROPBOX_MALW","description":"Spoofed FAX or bank statement with Dropbox link: PROBABLE MALWARE"},{"name":"FUZZY_UNSUBSCRIBE","description":"Obfuscated \"unsubscribe\""},{"name":"FUZZY_ANDROID","description":"Obfuscated \"android\""},{"name":"FUZZY_PROMOTION","description":"Obfuscated \"promotion\""},{"name":"FUZZY_PRIVACY","description":"Obfuscated \"privacy\""},{"name":"FUZZY_BROWSER","description":"Obfuscated \"browser\""},{"name":"FUZZY_SAVINGS","description":"Obfuscated \"savings\""},{"name":"FUZZY_IMPORTANT","description":"Obfuscated \"important\""},{"name":"FUZZY_SECURITY","description":"Obfuscated \"security\""},{"name":"FUZZY_DR_OZ","description":"Obfuscated Doctor Oz"},{"name":"FUZZY_CLICK_HERE","description":"Obfuscated \"click here\""},{"name":"FUZZY_BITCOIN","description":"Obfuscated \"Bitcoin\""},{"name":"FUZZY_WALLET","description":"Obfuscated \"Wallet\""},{"name":"FUZZY_BTC_WALLET","description":"Heavily obfuscated \"bitcoin wallet\""},{"name":"FUZZY_MONERO","description":"Obfuscated \"Monero\""},{"name":"BTC_ORG","description":"Bitcoin wallet ID + unusual header"},{"name":"BITCOIN_PDF","description":"\"Bitcoin\" + PDF attachment"},{"name":"BITCOIN_MALF_HTML","description":"Bitcoin + malformed HTML"},{"name":"BITCOIN_XPRIO","description":"Bitcoin + priority"},{"name":"OBFU_BITCOIN","description":"Obfuscated BitCoin references"},{"name":"BITCOIN_SPAM_01","description":"BitCoin spam pattern 01"},{"name":"BITCOIN_SPAM_02","description":"BitCoin spam pattern 02"},{"name":"BITCOIN_SPAM_03","description":"BitCoin spam pattern 03"},{"name":"BITCOIN_SPAM_04","description":"BitCoin spam pattern 04"},{"name":"BITCOIN_SPAM_05","description":"BitCoin spam pattern 05"},{"name":"BITCOIN_SPAM_06","description":"BitCoin spam pattern 06"},{"name":"BITCOIN_SPAM_07","description":"BitCoin spam pattern 07"},{"name":"BITCOIN_SPAM_08","description":"BitCoin spam pattern 08"},{"name":"BITCOIN_SPAM_09","description":"BitCoin spam pattern 09"},{"name":"BITCOIN_SPAM_10","description":"BitCoin spam pattern 10"},{"name":"BITCOIN_SPAM_11","description":"BitCoin spam pattern 11"},{"name":"BITCOIN_SPAM_12","description":"BitCoin spam pattern 12"},{"name":"BITCOIN_EXTORT_01","description":"Extortion spam, pay via BitCoin"},{"name":"BITCOIN_EXTORT_02","description":"Extortion spam, pay via BitCoin"},{"name":"BITCOIN_PAY_ME","description":"Pay me via BitCoin"},{"name":"BITCOIN_DEADLINE","description":"BitCoin with a deadline"},{"name":"BITCOIN_YOUR_INFO","description":"BitCoin with your personal info"},{"name":"BITCOIN_MALWARE","description":"BitCoin + malware bragging"},{"name":"BITCOIN_BOMB","description":"BitCoin + bomb"},{"name":"MONERO_EXTORT_01","description":"Extortion spam, pay via Monero cryptocurrency"},{"name":"MONERO_PAY_ME","description":"Pay me via Monero cryptocurrency"},{"name":"MONERO_DEADLINE","description":"Monero cryptocurrency with a deadline"},{"name":"MONERO_MALWARE","description":"Monero cryptocurrency + malware bragging"},{"name":"BOMB_FREEM","description":"Bomb + freemail"},{"name":"BOMB_MONEY","description":"Bomb + money: bomb threat?"},{"name":"MALWARE_NORDNS","description":"Malware bragging + no rDNS"},{"name":"MALWARE_PASSWORD","description":"Malware bragging + \"password\""},{"name":"NUM_FREE","description":"Number + free"},{"name":"URI_DQ_UNSUB","description":"IP-address unsubscribe URI"},{"name":"URI_GOOGLE_PROXY","description":"Accessing a blacklisted URI or obscuring source of phish via Google proxy?"},{"name":"TW_GIBBERISH_MANY","description":"Lots of gibberish text to spoof pattern matching filters"},{"name":"OPTOUT_BRKT_MANY","description":"Repetitive opt-outs"},{"name":"__RECIP_IN_URL_DOM","description":"Recipient in body URL"},{"name":"RCVD_DBL_DQ","description":"Malformatted message header"},{"name":"RAND_HEADER_MANY","description":"Many random gibberish message headers"},{"name":"FR_SPAM_LAW","description":"References French privacy law"},{"name":"DUP_SUSP_HDR","description":"Duplicate suspicious message headers"},{"name":"GOOG_MALWARE_DNLD","description":"File download via Google - Malware?"},{"name":"SPELLED_OUT_NUMBER","description":"Spelled out a number (one two three)"},{"name":"SUBJ_UNNEEDED_HTML","description":"Unneeded HTML formatting in Subject:"},{"name":"TEQF_USR_MSGID_MALF","description":"To and from user nearly same + malformed message ID"},{"name":"TEQF_USR_MSGID_HEX","description":"To and from user nearly same + unusual message ID"},{"name":"TEQF_USR_IMAGE","description":"To and from user nearly same + image"},{"name":"TEQF_USR_POLITE","description":"To and from user nearly same + polite greeting"},{"name":"URI_ONLY_MSGID_MALF","description":"URI only + malformed message ID"},{"name":"GOOG_REDIR_SHORT","description":"Google redirect to obscure spamvertised website + short message"},{"name":"GOOG_REDIR_NORDNS","description":"Google redirect to obscure spamvertised website + no rDNS"},{"name":"GOOG_REDIR_HTML_ONLY","description":"Google redirect to obscure spamvertised website + HTML only"},{"name":"HTML_TEXT_INVISIBLE_STYLE","description":"HTML hidden text + other spam signs"},{"name":"STY_INVIS_DIRECT","description":"HTML hidden text + direct-to-MX"},{"name":"LONG_INVISIBLE_TEXT","description":"Long block of hidden text - spam scan evasion?"},{"name":"HTML_TEXT_INVISIBLE_FONT","description":"HTML hidden text - word obfuscation?"},{"name":"FONT_INVIS_LONG_LINE","description":"Invisible text + long lines"},{"name":"FONT_INVIS_NORDNS","description":"Invisible text + no rDNS"},{"name":"FONT_INVIS_POSTEXTRAS","description":"Invisible text + suspicious URI"},{"name":"FONT_INVIS_MSGID","description":"Invisible text + suspicious message ID"},{"name":"FONT_INVIS_NAKED_TO","description":"Invisible text + suspicious To"},{"name":"FONT_INVIS_DIRECT","description":"Invisible text + direct-to-MX"},{"name":"FONT_INVIS_DOTGOV","description":"Invisible text + .gov URI"},{"name":"HTML_SINGLET_MANY","description":"Many single-letter HTML format blocks"},{"name":"SINGLETS_LOW_CONTRAST","description":"Single-letter formatted HTML + hidden text"},{"name":"MALWARE_HACKED_URI","description":"Malware or phishing hosted-file URI at hacked webserver"},{"name":"HACKED_PHP_URI","description":"Possible phishing/malware URI"},{"name":"XMAILER_MANY","description":"Has multiple X-Mailer: headers"},{"name":"RAW_TOKENS","description":"Raw mail merge tokens in body"},{"name":"SPOOFED_FREEM_REPTO_CHN","description":"Forged freemail sender with Chinese freemail reply-to"},{"name":"SPOOFED_FREEM_REPTO_RUS","description":"Forged freemail sender with Russian freemail reply-to"},{"name":"SPOOFED_FREEM_REPTO","description":"Forged freemail sender with freemail reply-to"},{"name":"VERY_LONG_REPTO_SHORT_MSG","description":"Very long Reply-To username + short message"},{"name":"VERY_LONG_FREEM_REPTO","description":"Very long freemail Reply-To username"},{"name":"URI_MALWARE_CWALL","description":"Potential CryptoWall malware URL"},{"name":"LIST_PARTIAL_SHORT_MSG","description":"Incomplete mailing list headers + short message"},{"name":"BOGUS_MSM_HDRS","description":"Apparently bogus Microsoft email headers"},{"name":"MSM_PRIO_REPTO","description":"MSMail priority header + Reply-to + short subject"},{"name":"ENCRYPTED_MESSAGE","description":"Message is encrypted, not likely to be spam"},{"name":"HTML_TAG_BALANCE_CENTER","description":"Malformatted HTML"},{"name":"HDR_CASE_REV_MANY","description":"Multiple malformed (possibly random gibberish) message headers"},{"name":"HDR_CASE_REV_ENC","description":"Malformed (possibly random gibberish) message header + suspicious encoding"},{"name":"HDR_CASE_REV_HELO_IP","description":"Malformed (possibly random gibberish) message header + IP in HELO"},{"name":"FROM_WORDY","description":"From address looks like a sentence"},{"name":"FROM_WORDY_SHORT","description":"From address looks like a sentence + short message"},{"name":"PHP_SCRIPT_MUA","description":"Sent by PHP script, no version number"},{"name":"PHP_ORIG_SCRIPT","description":"Sent by bot & other signs"},{"name":"MIMEOLE_DIRECT_TO_MX","description":"MIMEOLE + direct-to-MX"},{"name":"FROM_FULLN_URL","description":"From address full name is in body URL - possible phishing"},{"name":"PHOTO_EDITING_FREEM","description":"Image editing service, freemail or CHN replyto"},{"name":"PHOTO_EDITING_DIRECT","description":"Image editing service, direct to MX"},{"name":"MARKETING_FREEM","description":"Marketing service, freemail or CHN replyto"},{"name":"MARKETING_SHORT","description":"Marketing service, short message"},{"name":"MARKETING_NO_RDNS","description":"Marketing service, no RDNS"},{"name":"HDR_ORDER_FTSDMCXX_DIRECT","description":"Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX"},{"name":"HDR_ORDER_FTSDMCXX_NORDNS","description":"Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS"},{"name":"UNICODE_OBFU_DOM_NO_BODY","description":"Unicode/chinese obfuscated domain + no body"},{"name":"MULTI_REPTO_NO_RDNS","description":"Multiple Reply-to addresses + no RDNS"},{"name":"FREEM_FRNUM_UNICD_EMPTY","description":"Numeric freemail From address, unicode From name and Subject, empty body"},{"name":"FREEM_FRNUM_EMPTY_NUMSCOM","description":"Numeric freemail From address, unicode From name and Subject, empty body, obfuscated domain name"},{"name":"USB_DRIVES","description":"Trying to sell custom USB flash drives"},{"name":"FRNAME_IN_MSG_XPRIO_NO_SUB","description":"From name in message + X-Priority + short or no subject"},{"name":"FRNAME_IN_MSG_XPRIO","description":"From name in message + X-Priority"},{"name":"FRNAME_IN_MSG_NO_SUBJ","description":"From name in message + short or no subject"},{"name":"RATWARE_NO_RDNS","description":"Suspicious MsgID and MIME boundary + no rDNS"},{"name":"BAT_BDRY_TO_MALF","description":"Bat boundary + misformatted To: address"},{"name":"IMG_ONLY_FM_DOM_INFO","description":"HTML image-only message from .info domain"},{"name":"NO_FM_NAME_IP_HOSTN","description":"No From name + hostname using IP address"},{"name":"FROM_NUMERIC_TLD","description":"From: address has numeric TLD"},{"name":"RDNS_NUM_TLD_XM","description":"Relay rDNS has numeric TLD + suspicious headers"},{"name":"RDNS_NUM_TLD_ATCHNX","description":"Relay rDNS has numeric TLD + suspicious attachment"},{"name":"MALF_HTML_B64","description":"Malformatted base64-encoded HTML content"},{"name":"TO_NAME_SUBJ_NO_RDNS","description":"Recipient username in subject + no rDNS"},{"name":"HTML_SHRT_CMNT_OBFU_MANY","description":"Obfuscation with many short HTML comments"},{"name":"FROM_ADDR_WS","description":"Malformed From address"},{"name":"GAPPY_SALES_LEADS_FREEM","description":"Obfuscated marketing text, freemail or CHN replyto"},{"name":"APP_DEVELOPMENT_FREEM","description":"App development pitch, freemail or CHN replyto"},{"name":"APP_DEVELOPMENT_NORDNS","description":"App development pitch, no rDNS"},{"name":"UNICODE_OBFU_ZW","description":"Obfuscating text with hidden characters"},{"name":"UNICODE_OBFU_ASC","description":"Obfuscating text with unicode"},{"name":"ZW_OBFU_BITCOIN","description":"Obfuscated text + bitcoin ID - possible extortion"},{"name":"ZW_OBFU_FROMTOSUBJ","description":"Obfuscated text + from in to and subject"},{"name":"ZW_OBFU_FREEM","description":"Obfuscated text + freemail"},{"name":"HTML_ENTITY_ASCII","description":"Obfuscated ASCII"},{"name":"HTML_ENTITY_ASCII_TINY","description":"Obfuscated ASCII + tiny fonts"},{"name":"URI_GIBB_NO_PROTO","description":"Long, gibberish, no-protocol URI"},{"name":"AC_FROM_MANY_DOTS","description":"Multiple periods in From user name"},{"name":"AC_POST_EXTRAS","description":"Suspicious URL"},{"name":"URI_BUFFLY","description":"buff.ly redirector URI"},{"name":"SHORTENER_SHORT_IMG","description":"Short HTML + image + URL shortener"},{"name":"FREEM_DATA_ENTRY","description":"Data entry services too cheap to buy a real domain"},{"name":"EBAY_IMG_NOT_RCVD_EBAY","description":"E-bay hosted image but message not from E-bay"},{"name":"AMAZON_IMG_NOT_RCVD_AMZN","description":"Amazon hosted image but message not from Amazon"},{"name":"ALIBABA_IMG_NOT_RCVD_ALI","description":"Alibaba hosted image but message not from Alibaba"},{"name":"WALMART_IMG_NOT_RCVD_WAL","description":"Walmart hosted image but message not from Walmart"},{"name":"NEWEGG_IMG_NOT_RCVD_NEGG","description":"Newegg hosted image but message not from Newegg"},{"name":"SHOPIFY_IMG_NOT_RCVD_SFY","description":"Shopify hosted image but message not from Shopify"},{"name":"HOSTED_IMG_DQ_UNSUB","description":"Image hosted at large ecomm site, IP addr unsub link"},{"name":"HOSTED_IMG_DIRECT_MX","description":"Image hosted at large ecomm site, message direct-to-mx"},{"name":"HOSTED_IMG_FREEM","description":"Image hosted at large ecomm site or redirected, freemail from or reply-to"},{"name":"HOSTED_IMG_MULTI","description":"Multiple images hosted at different large ecomm sites or redirected"},{"name":"URI_IMG_WP_REDIR","description":"Image via WordPress \"accelerator\" proxy"},{"name":"BOGUS_MIME_VERSION","description":"Mime version header is bogus"},{"name":"URI_HEX_IP","description":"URI with hex-encoded IP-address host"},{"name":"URI_PHP_REDIR","description":"PHP redirect to different URL (link obfuscation)"},{"name":"DAY_I_EARNED","description":"Work-at-home spam"},{"name":"DOTGOV_IMAGE","description":".gov URI + hosted image"},{"name":"URI_DOTEDU","description":"Has .edu URI"},{"name":"URI_DOTEDU_LONG","description":"Has .edu URI + excessively long line"},{"name":"URI_DOTEDU_ENTITY","description":"Via .edu MTA + suspicious HTML content"},{"name":"RCVD_DOTEDU_SUSP_URI","description":"Via .edu MTA + suspicious URI"},{"name":"RCVD_DOTEDU_SHORT","description":"Via .edu MTA + short message"},{"name":"RCVD_DOTEDU_SUSP","description":"Via .edu MTA + suspicious content"},{"name":"TRANSFORM_LIFE","description":"Transform your life!"},{"name":"BITCOIN_WFH_01","description":"Work-from-Home + bitcoin"},{"name":"TO_TOO_MANY_WFH_01","description":"Work-from-Home + many recipients"},{"name":"FREEMAIL_WFH_01","description":"Work-from-Home + freemail"},{"name":"SUSP_UTF8_WORD_MANY","description":"Many words using only suspicious UTF-8 characters"},{"name":"SUSP_UTF8_WORD_COMBO","description":"Words using only suspicious UTF-8 characters + other signs"},{"name":"SUSP_UTF8_WORD_SUBJ","description":"Word in Subject using only suspicious UTF-8 characters"},{"name":"SUSP_UTF8_WORD_FROM","description":"Word in From name using only suspicious UTF-8 characters"},{"name":"HTML_EMPTY_CELLS_MANY","description":"HTML table with lots of empty cells"},{"name":"SENDGRID_REDIR","description":"Redirect URI via Sendgrid"},{"name":"SENDGRID_REDIR_PHISH","description":"Redirect URI via Sendgrid + phishing signs"},{"name":"MSGID_DOLLARS_URI_IMG","description":"Suspicious Message-ID and image"},{"name":"URI_DASHGOVEDU","description":"Suspicious domain name"},{"name":"RCVD_IN_IADB_VOUCHED","description":"ISIPP IADB lists as vouched-for sender"},{"name":"RCVD_IN_IADB_LISTED","description":"Participates in the IADB system"},{"name":"RCVD_IN_IADB_EDDB","description":"IADB: Participates in Email Deliverability Database"},{"name":"RCVD_IN_IADB_EPIA","description":"IADB: Member of Email Processing Industry Alliance"},{"name":"RCVD_IN_IADB_SPF","description":"IADB: Sender publishes SPF record"},{"name":"RCVD_IN_IADB_SENDERID","description":"IADB: Sender publishes Sender ID record"},{"name":"RCVD_IN_IADB_DK","description":"IADB: Sender publishes Domain Keys record"},{"name":"RCVD_IN_IADB_RDNS","description":"IADB: Sender has reverse DNS record"},{"name":"RCVD_IN_IADB_HABEAS","description":"IADB: Sender participates in Habeas program"},{"name":"RCVD_IN_AIDB_BONDEDSENDER","description":"IADB: Sender participates in Bonded Sender program"},{"name":"RCVD_IN_IADB_GOODMAIL","description":"IADB: Sender has been certified by GoodMail"},{"name":"RCVD_IN_IADB_NOCONTROL","description":"IADB: Has absolutely no mailing controls in place"},{"name":"RCVD_IN_IADB_OPTOUTONLY","description":"IADB: Scrapes addresses, pure opt-out only"},{"name":"RCVD_IN_IADB_UNVERIFIED_1","description":"IADB: Accepts unverified sign-ups"},{"name":"RCVD_IN_IADB_UNVERIFIED_2","description":"IADB: Accepts unverified sign-ups, gives chance to opt out"},{"name":"RCVD_IN_IADB_LOOSE","description":"IADB: Adds relationship addrs w/out opt-in"},{"name":"RCVD_IN_IADB_OPTIN_LT50","description":"IADB: Opt-in used less than 50% of the time"},{"name":"RCVD_IN_IADB_OPTIN_GT50","description":"IADB: Opt-in used more than 50% of the time"},{"name":"RCVD_IN_IADB_OPTIN","description":"IADB: All mailing list mail is opt-in"},{"name":"RCVD_IN_IADB_DOPTIN_LT50","description":"IADB: Confirmed opt-in used less than 50% of the time"},{"name":"RCVD_IN_IADB_DOPTIN_GT50","description":"IADB: Confirmed opt-in used more than 50% of the time"},{"name":"RCVD_IN_IADB_DOPTIN","description":"IADB: All mailing list mail is confirmed opt-in"},{"name":"RCVD_IN_IADB_ML_DOPTIN","description":"IADB: Mailing list email only, confirmed opt-in"},{"name":"RCVD_IN_IADB_OOO","description":"IADB: One-to-one/transactional email only"},{"name":"RCVD_IN_IADB_MI_CPEAR","description":"IADB: Complies with Michigan's CPEAR law"},{"name":"RCVD_IN_IADB_UT_CPEAR","description":"IADB: Complies with Utah's CPEAR law"},{"name":"RCVD_IN_IADB_MI_CPR_30","description":"IADB: Checked lists against Michigan's CPR within 30 days"},{"name":"RCVD_IN_IADB_UT_CPR_30","description":"IADB: Checked lists against Utah's CPR within 30 days"},{"name":"RCVD_IN_IADB_MI_CPR_MAT","description":"IADB: Sends no material under Michigan's CPR"},{"name":"RCVD_IN_IADB_UT_CPR_MAT","description":"IADB: Sends no material under Utah's CPR"},{"name":"S25R_1","description":"S25R: Bottom of rDNS has num, non-num, num"},{"name":"S25R_2","description":"S25R: Bottom of rDNS has 5+ digits in a row"},{"name":"S25R_3","description":"S25R: A low-level of rDNS starts w/ a number"},{"name":"S25R_4","description":"S25R: Bottom of rDNS ends w/ num, next lvl has num-num"},{"name":"S25R_5","description":"S25R: rDNS has 5+ layers, bottom 2 end in numbers"},{"name":"S25R_6","description":"S25R: rDNS looks dynamic or customer-facing"},{"name":"S25R","description":"Selective SMTP Rejection: Relay has dynamic rDNS"},{"name":"KHOP_BOTNET_4","description":"Relay looks like a dynamic address"},{"name":"KHOP_BOTNET_7","description":"Relay looks like a dynamic address"},{"name":"KHOP_BOTNET_9","description":"Relay looks like a dynamic address"},{"name":"KHOP_BOTNET_UNCLEAN","description":"Relay looks like a dynamic address"},{"name":"__HAS_IMG_SRC","description":"Has an img tag on a non-quoted line"},{"name":"__HAS_HREF","description":"Has an anchor tag with a href attribute in non-quoted line"},{"name":"__HAS_IMG_SRC_ONECASE","description":"Has an img tag on a non-quoted line with consistent case"},{"name":"__HAS_HREF_ONECASE","description":"Has an anchor tag with a href attribute in non-quoted line with consistent case"},{"name":"__MIXED_IMG_CASE","description":"Has img tags with mixed-up cases in non-quoted lines"},{"name":"__MIXED_HREF_CASE","description":"Has anchor tags with mixed-up cases in non-quoted lines"},{"name":"T_MIXED_TAG_CASE","description":"Has multiple mixed-case tags in non-quoted lines."},{"name":"T_SCC_THREE_WORD_MONTY","description":"Are you POTUS or a mass murderer? "},{"name":"SCC_MAJORDOMO","description":"Multiple indications of the majordomo list manager"},{"name":"T_SCC_ODD_MUA","description":"Unlikely MUA for a modern human"},{"name":"T_SCC_SPECIAL_GUID","description":"Unique in a similar way"},{"name":"PDS_RDNS_DYNAMIC_FP","description":"RDNS_DYNAMIC with FP steps"},{"name":"PDS_SHORT_BOGUS_MSM_HDRS","description":"Short HTML email with bogus MSM headers"},{"name":"PDS_FROM_NAME_TO_DOMAIN","description":"From:name looks like To:domain"},{"name":"PDS_FRNOM_TODOM_NAKED_TO","description":"Naked to From name equals to Domain"},{"name":"PDS_HIDDEN_UK_BUSINESSLOAN","description":"UK's <word> rates for business loans"},{"name":"PDS_DOUBLE_URL","description":"URL that ends with a URL"},{"name":"PDS_DBL_URL_LINKBAIT","description":"Linkbait double-url"},{"name":"PDS_DBL_URL_TNB_RUNON","description":"Double-url and To no arrows, from runon"},{"name":"PDS_DBL_URL_ILLEGAL_CHARS","description":"Double url illegal subject characters"},{"name":"FROM_2_EMAILS_SHORT","description":"Short body and From looks like 2 different emails"},{"name":"SHORT_BODY_QUOTE","description":"Short body with quote - used for warming up domains"},{"name":"BODY_QUOTE_MALF_MSGID","description":"Malformed MSGID with quote"},{"name":"SPOOFED_FREEMAIL_NO_RDNS","description":"From SPOOFED_FREEMAIL and no rDNS"},{"name":"PDS_URI_HIDDEN_HELO_NO_DOMAIN","description":"Hidden URI, HELO not domain"},{"name":"PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE","description":"To: name matches everything in local email - LCASE headers"},{"name":"PDS_TONAME_EQ_TOLOCAL_SHORT","description":"Short body with To: name matches everything in local email"},{"name":"PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE","description":"Forged replyto and __PDS_TONAME_EQ_TOLOCAL"},{"name":"PDS_TONAME_EQ_TOLOCAL_VSHORT","description":"Very short body and From looks like 2 different emails"},{"name":"POSTCARD_01","description":"You got a postcard!"},{"name":"POSTCARD_02","description":"You got a postcard!"},{"name":"POSTCARD_03","description":"From a postcard domain"},{"name":"POSTCARD_04","description":"You got a forged Hallmark postcard!"},{"name":"POSTCARD_05","description":"You got a postcard!"},{"name":"POSTCARD_06","description":"You got a postcard!"},{"name":"POSTCARD_07","description":"You got a postcard!"},{"name":"POSTCARD_08","description":"You got a postcard!"},{"name":"POSTCARD_09","description":"You got a postcard!"},{"name":"__DQ_URI_ONLY_ARGS","description":"Dotted-Quad URI with only CGI arguments"},{"name":"POSTCARD_DQ","description":"Postcard + DQ URI"},{"name":"EXECUTABLE_URI","description":"Link to an executable file"},{"name":"POSTCARD_EXE","description":"Postcard + Executable URI"},{"name":"__TR_JS_EXTRA_UNESCAPE","description":"JavaScript: Unnecessary URI escaping"},{"name":"__TR_JS_EXTRA_CONCAT","description":"JavaScript: Unnecessary string concatenation"},{"name":"TR_JS_FROMCHARCODE","description":"JavaScript: function String.fromCharCode"},{"name":"__TR_JS_CONCATINATED_HTTP","description":"Contains concatenated URI like \"htt\"+\"p://...\""},{"name":"TR_JS_REDIRECTION_0","description":"Script: Current window location is redirected (unoptimized)"},{"name":"TR_JS_REDIRECTION_1","description":"Script: Current window location is redirected"},{"name":"TR_JS_REDIRECTION_2","description":"Script: Something changes location (a redirection)"},{"name":"KHOP_JS_OBFUSCATION","description":"Script: unnecessarily complex string composition"},{"name":"TR_FILLER_TEXT","description":"18 sentences of capitalized word, 4-6 words, period"},{"name":"__GB_MONERO_CP_DE","description":"German Monero scam"},{"name":"__GB_MONERO_CP_ES","description":"Spanish Monero scam"},{"name":"__GB_MONERO_CP_FR","description":"French Monero scam"},{"name":"__GB_MONERO_CP_EN","description":"English Monero scam"},{"name":"__GB_MONERO_CP_IT","description":"Italian Monero scam"},{"name":"__GB_MONERO_CP_NL","description":"Dutch Monero scam"},{"name":"__GB_MONERO_CP_SE","description":"Swedish Monero scam"},{"name":"GB_MONERO_CP","description":"Localized Monero scam"},{"name":"GB_MONERO_NH","description":"Localized Monero scam"},{"name":"DOS_YOUR_PLACE","description":"Russian dating spam"},{"name":"DOS_DOM_LIST_CENTER","description":"Final notice for search engine submission"},{"name":"DOS_STOCK_O_PRICE","description":"Stocks with 'oh', rather than 'zero' values"},{"name":"DOS_FAKE_SQUIRREL","description":"Message contains faked SquirrelMail headers"},{"name":"DOS_LET_GO_JOB","description":"Let go from their job and now makes lots of dough!"},{"name":"DOS_DOUBLE_SOTCK","description":"Stock spelt wrong the same way twice in a row"},{"name":"DOS_TWO_MIS_STOCK","description":"Stock spelt wrong twice in a row"},{"name":"DOS_TO_READ_STOCK","description":"Stock pumping you just have to read"},{"name":"BELL_MOBILITY_TXT_MSG","description":"Adjustment for poorly formatted text->email messages"},{"name":"DOS_DOT_COM_AT","description":"Envelope-From has a domain.com@anotherdomain.com"},{"name":"DOS_STOCK_BAT","description":"Probable pump and dump stock spam"},{"name":"DOS_URI_ASTERISK","description":"Found an asterisk in a URI"},{"name":"DOS_FIX_MY_URI","description":"Looks like a \"fix my obfu'd URI please\" spam"},{"name":"DOS_PROVISION4","description":"Provision for income taxes"},{"name":"DOS_REPORT_FIN_INC","description":"Report of financial income"},{"name":"DOS_STOCK_INCOME_STATEMENT","description":"Pump and dump stock income statement spam"},{"name":"DOS_STOCK_CDYV_GENERIC","description":"Pump and dump stock spam"},{"name":"DOS_OUTLOOK_TO_MX","description":"Delivered direct to MX with Outlook headers"},{"name":"DOS_OUTLOOK_TO_MX_IMAGE","description":"Direct to MX with Outlook headers and an image"},{"name":"DOS_OE_TO_MX","description":"Delivered direct to MX with OE headers"},{"name":"DOS_OE_TO_MX_IMAGE","description":"Direct to MX with OE headers and an image"},{"name":"DOS_GOOGLE_LUCKY_REDIRECT","description":"Invisible Google redirect using the \"lucky button\""},{"name":"DOS_ANAL_SPAM_MAILER","description":"X-mailer pattern common to anal porn site spam"},{"name":"DOS_ANAL_SPAM_MAILER2","description":"X-mailer pattern common to porn site spam"},{"name":"DOS_FORGED_RCVD_QUADS","description":"Probable forged received header"},{"name":"DOS_RCVD_IP_TWICE_A","description":"Received from the same IP twice in a row"},{"name":"DOS_RCVD_IP_TWICE_B","description":"Received from the same IP twice in a row (only one external relay)"},{"name":"DOS_RCVD_IP_TWICE_C","description":"Received from the same IP twice in a row (only one external relay; empty or IP helo)"},{"name":"DOS_ZIP_HARDCORE","description":"hardcore.zip file attached; quite certainly a virus"},{"name":"DOS_PLAYED_IN_HARDCORE","description":"Claims someone played in hardcore porn"},{"name":"DOS_HC_ZIP_VIRUS","description":"Hardcore porn virus spam"},{"name":"DOS_PORN_BOUNDARY","description":"Content boundary common to porn spam"},{"name":"DOS_FAKE_UPS_TRACK_NUM","description":"Invalid UPS Tracking Number in Subject"},{"name":"DOS_HIGH_BAT_TO_MX","description":"The Bat! Direct to MX with High Bits"},{"name":"DOS_BODY_HIGH_NO_MID","description":"High bit body and no message ID header"},{"name":"DOS_HIGHBIT_HDRS_BODY","description":"Headers need encoding and body is highbit"},{"name":"__GB_BITCOIN_CP_DE","description":"German Bitcoin scam"},{"name":"__GB_BITCOIN_CP_ES","description":"Spanish Bitcoin scam"},{"name":"__GB_BITCOIN_CP_FR","description":"French Bitcoin scam"},{"name":"__GB_BITCOIN_CP_EN","description":"English Bitcoin scam"},{"name":"__GB_BITCOIN_CP_IT","description":"Italian Bitcoin scam"},{"name":"__GB_BITCOIN_CP_NL","description":"Dutch Bitcoin scam"},{"name":"__GB_BITCOIN_CP_SE","description":"Swedish Bitcoin scam"},{"name":"GB_BITCOIN_CP","description":"Localized Bitcoin scam"},{"name":"GB_BITCOIN_NH","description":"Localized Bitcoin scam"},{"name":"GB_HASHBL_BTC","description":"Message contains BTC address found on BTCBL"},{"name":"PDS_LITECOIN_ID","description":"FP reduced Litecoin ID"},{"name":"LITECOIN_EXTORT_01","description":"Extortion spam, pay via BitCoin"},{"name":"PDS_LTC_CP","description":"Localized Bitcoin scam"},{"name":"PDS_LTC_HUSH","description":"LTC, it is between us"},{"name":"PDS_BTC_ID","description":"FP reduced Bitcoin ID"},{"name":"PDS_BTC_MSGID","description":"Bitcoin ID with MSGID_NOFQDN2"},{"name":"PDS_BTC_AHACKER","description":"Bitcoin Hacker"},{"name":"PDS_BTC_HACKER","description":"Bitcoin Hacker"},{"name":"PDS_LTC_AHACKER","description":"Litecoin Hacker"},{"name":"PDS_LTC_HACKER","description":"Litecoin Hacker"},{"name":"FH_MSGID_XXBLAH","description":"Common sign in msg-id's 12/21/2006"},{"name":"FB_LETTERS_21B","description":"Special people leave special signs!"},{"name":"FM_LOTTO_MONEY","description":"Talks about lotto and large money!"},{"name":"FM_LOTTO_YOU_WON","description":"Talks about lotto and you won!"},{"name":"FB_EXP_POWER_OF","description":"Phrase: Experience the power of"},{"name":"FM_PEOPLE_LOOK_4ME","description":"People are looking for me?"},{"name":"FH_BAD_OEV1441","description":"Bad X-Mailer version"},{"name":"FH_RANDOM_SURE","description":"SARE Random in one rule."},{"name":"FH_MSGID_01C67","description":"Special MSGID"},{"name":"FH_HAS_X","description":"Has X: header"},{"name":"FH_HAS_XAIMC","description":"Has X-AIMC-AUTH header"},{"name":"FH_HAS_XCVBN","description":"Has X-CVBN header"},{"name":"FH_BAD_MSOE14","description":"Bad OE version"},{"name":"FH_HAS_X_WBC","description":"Has X-WBC header"},{"name":"FH_MSGID_000000","description":"Special MSGID"},{"name":"FH_HAS_XFGHJ","description":"Has X-FGHJ"},{"name":"FH_XMAIL_HEX20","description":"Special HEX X-Mailer"},{"name":"FH_HAS_XBBO","description":"Has X-BBounce"},{"name":"FS_REPL_TOKEN","description":"Subject has Replacement Token"},{"name":"FM_XMAIL_F_OUT","description":"Looks like Fake Outlook?"},{"name":"FH_XCON_HAS_EQ","description":"X-Contact has ="},{"name":"FH_HAS_XOVE","description":"Has X-OVE"},{"name":"FH_HAS_XID","description":"Has X-ID"},{"name":"FH_HAS_XUIOP","description":"Has X-UIOP"},{"name":"FH_XMAIL_RND_833","description":"Special X-Mailer Version"},{"name":"FS_RAMROD","description":"Subject says Ramrod"},{"name":"FS_WITH_SMALL","description":"Subject says With ... small"},{"name":"FH_MSGID_REPLACE","description":"Broken Replace Template"},{"name":"FH_XMAIL_REPLACE","description":"Broken Replace Template"},{"name":"FB_ADD_INCHES","description":"Add / Gain inches"},{"name":"FM_RE_HELLO_SPAM","description":"Re: Hello / hi"},{"name":"FB_DDDD_BUCKS","description":"We use comma's and it's dollars not bucks!"},{"name":"FH_HOST_IN_ADDRARPA","description":"HOST dns says \"in-addr.arpa\""},{"name":"FB_IMAGIRL","description":"Phrae: I am a girl"},{"name":"FM_LOWER_CASE_HEAD","description":"Lots of headers with lower case."},{"name":"FB_REPLIC_CAP","description":"Phrase: REPLICA"},{"name":"FM_TRUE_LOV_ALL_N","description":"True Love all Night!"},{"name":"FU_ENDS_SG","description":"URL ends with /sg"},{"name":"FU_ENDS_RT","description":"URL ends with /rt"},{"name":"FM_PHN_NODNS","description":"Phone spacing + no dns"},{"name":"FR_WATCHES_HTTP","description":"Watches http://"},{"name":"FU_END_ET","description":"ET Phone Home?"},{"name":"FH_MSGID_01C70XXX","description":"MESSAGE ID seen often!!!"},{"name":"FU_CLICK_PHP_DDD","description":"Click.php?ddd.ddd.ddd.ddd.ddd"},{"name":"FH_X_REFS_DDD","description":"X-Refs with digits."},{"name":"FM_XREF_CLICKPHP","description":"Whatever it takes!"},{"name":"FB_SPACED_PHN_3B","description":"Phone number with -- spacing. (B)"},{"name":"FM_FAKE_53COM_SPOOF","description":"Spoof mail from 53.com?"},{"name":"FM_HOW_IMG_COST2","description":"How much does your image cost? (2)"},{"name":"FU_COMMON_SUBS","description":"Sub-dir seen often in spam."},{"name":"FRM_SILVER_GOLD","description":"ReplaceTags: Silver & Gold"},{"name":"FM_LUX_GIFTS_REDUCED","description":"Luxury Gifts with dd%"},{"name":"FH_MSGID_DIGIT","description":"Forgot Pattern Replacement?"},{"name":"FM_HOW_IMG_COST","description":"How much does your image cost?"},{"name":"FM_DOESNT_SAY_STOCK","description":"It's a stock spam but doesn't say stock"},{"name":"FM_LIKE_STOCKS","description":"It looks like a duck, it's a duck!"},{"name":"FH_FROM_HOODIA","description":"From has Hoodia!!?"},{"name":"FF_COMMENT_ODD","description":"FULL RULE: Special Comment"},{"name":"FF_LEO_FLOAT_RIGHT","description":"FULL RULE: Float, Right, Special signs!"},{"name":"FF_IHOPE_YOU_SINK","description":"Triple Floats, common viagra signs."},{"name":"FB_ACHIEVE_BACH","description":"Phrase: Achieve your bachelor"},{"name":"FB_ALMOST_SEX","description":"It's almost sex, but not!"},{"name":"FB_AN_ERROR_4U","description":"Phrase: an error has been made in your favor"},{"name":"FB_ANA_TRIM","description":"Broken AnaTrim phrase."},{"name":"FB_ANUI","description":"Phrase: A_U_N_I"},{"name":"FB_B0NUS","description":"Phrase: B0nus"},{"name":"FB_BAD_ERECT","description":"Phrase: Bad Erection"},{"name":"FB_BE_MILLION","description":"Phrase: be millionaire"},{"name":"FB_BEDISCARDED","description":"Phrase: discarded ... future deployments"},{"name":"FB_BILLI0N","description":"Phrase: [BM]Illi0n"},{"name":"FB_BOOST_CONFIDEN","description":"Phrase: boost your confidence."},{"name":"FB_BROKEN_PHNUM","description":"weird phone number, with letters!"},{"name":"FB_BROWSER_ERR","description":"Phrase: Browser Error: random"},{"name":"FB_C0MPANY","description":"Phrase: C0mpany"},{"name":"FB_CAN_LONGER","description":"Phrase: can last longer"},{"name":"FB_CASINO","description":"Phrase: ca$ino"},{"name":"FB_CASINO_SPELLER","description":"Phrase: Online Casino, spelling mistake."},{"name":"FB_CHOLESTERBLCK","description":"Phrase: Cholesterblock"},{"name":"FB_CIALIS_LEO3","description":"Uses a mis-spelled version of cialis."},{"name":"FB_COM_ADR_SIGN","description":"Common sign used in Addresses"},{"name":"FB_CONSOL_YOUR","description":"Phrase: Consolidate your"},{"name":"FB_DOUBLE_0WORDS","description":"Looks like double 0 words"},{"name":"FB_DROWNING_DEBT","description":"Phrase: drowning in debt"},{"name":"FB_EARN_UP_TO","description":"Phrase: Earn up to ...."},{"name":"FB_EMAIL_HIER","description":"Phrase: email hier"},{"name":"FB_ENHANCED_MALE","description":"Phrase: Enhanced male"},{"name":"FB_EPHEDRA_IS","description":"Phrase: Ephedra is back"},{"name":"FB_EXPLOSIVE","description":"Phrase: EXPLOSIVE"},{"name":"FB_EXTRA_INCHES","description":"Phrase: extra inches"},{"name":"FB_FAKE_NUMBERS","description":"Looks like numbers with O's insted of 0's"},{"name":"FB_FAKE_NUMS2","description":"Looks like fake numbers"},{"name":"FB_FAKE_NUMS4","description":"Looks like fake numbers (4)"},{"name":"FB_FEDERALLY_COMPL","description":"Phrase: we are federally compliant"},{"name":"FB_FHARMACY","description":"Phrase: Farmacy"},{"name":"FB_FORWARD_LOOK","description":"Phrase: forward look with 0's"},{"name":"FB_FREE888","description":"Claims we can get $888 Free."},{"name":"FB_FUNNY_WEIGHT","description":"Looks like weight but it's not!"},{"name":"FB_GAPPY_ADDRESS","description":"Too much spacing in Address"},{"name":"FB_GAPPY_SOMETHING","description":"Looks like something thats g a p p y"},{"name":"FB_GET_LAID","description":"Phrase: GET LAID"},{"name":"FB_GET_MEDS","description":"Looks like trying to sell meds"},{"name":"FB_GET_XXX_CASH","description":"Phrase: Get Cash"},{"name":"FB_GREAT_BEST_SEX","description":"Phrase: greater, best, improved sex"},{"name":"FB_GVR","description":"Looks like generic viagra"},{"name":"FB_HA1R","description":"Phrase: ha1r"},{"name":"FB_HEY_BRO_COMMA","description":"Phrase hey bro,"},{"name":"FB_HG_H_CAP","description":"Phrase: HGH"},{"name":"FB_HOMELOAN","description":"Phrase $x home loan"},{"name":"FB_IMPRESS_GIRL","description":"Phrase: impress ... girl"},{"name":"FB_IMPROVEJA","description":"Phrase: Improved Ejaculation"},{"name":"FB_INCREASE_VOL","description":"Phrase: increase volume"},{"name":"FB_INCREASE_YOUR","description":"Phrase: Increase your energy"},{"name":"FB_INDEPEND_RWD","description":"Phrase: independent reward"},{"name":"FB_IOW","description":"Phrase: mis-spelled low, iow?"},{"name":"FB_L0AN","description":"Phrase: L0an"},{"name":"FB_LAON","description":"Phrase: laon"},{"name":"FB_LATEST_OEM","description":"Phrase: latest oem."},{"name":"FB_LIMITED_TIME","description":"Phrase: limited time promotion"},{"name":"FB_LOSE_WEIGHT_CAP","description":"Phrase: LOSE WEIGHT"},{"name":"FB_LOWER_PAYM","description":"Phrase: lower your monthly payments"},{"name":"FB_MAGIC_TAB","description":"Phrase: this / magic tab."},{"name":"FB_MAKE_MONEY","description":"Phrase: generate $"},{"name":"FB_MASCULINE_PERF","description":"Phrase: Masculine performance"},{"name":"FB_MED1CAT","description":"Phrase: Med1cat"},{"name":"FB_MEDS_PERCENT","description":"Talks about meds and %"},{"name":"FB_MEEDS","description":"Phrase: meed[zs]"},{"name":"FB_MORE_SEMEN","description":"Phrase: more semen"},{"name":"FB_MORE_SIZE","description":"Phrase: more size"},{"name":"FB_MOST_RECOG","description":"Phrase: most recognized brands."},{"name":"FB_MOST_QUALITY","description":"Phrase: Most quality products"},{"name":"FB_N3W","description":"Phrase: n3w"},{"name":"FB_NATIONALSURV","description":"Phrase: NationalSurveyPanel"},{"name":"FB_NEW_LOW_RATE","description":"Phrase: new low rate"},{"name":"FB_NO_MORE_ADS","description":"Phrase: no more ad"},{"name":"FB_NO_MORE_HTTP","description":"No more, the http"},{"name":"FB_NO_MORE_MAIL","description":"Phrase: no more mail, distribution"},{"name":"FB_NO_MORE_OFFER","description":"Phrase: no more offer"},{"name":"FB_NOT_CREDIT","description":"Looks like credit but ain't."},{"name":"FB_NOT_PHONE_NUM1","description":"Looks like a fake phone number (1)"},{"name":"FB_NOT_PHONE_NUM2","description":"Looks like a fake phone number (2)"},{"name":"FB_NOT_PHONE_NUM3","description":"Looks like a fake phone number (3)"},{"name":"FB_NOT_SCHOOL","description":"Looks like school but it's not!"},{"name":"FB_NOT_SEXUAL","description":"Almost Sexual but not."},{"name":"FB_NOW_NOW_NOW","description":"Phrase: NOW NOW NOW"},{"name":"FB_NUMYO","description":"Speaks of teenager."},{"name":"FB_NUMYO2","description":"Speaks of 20+ year old."},{"name":"FB_ODD_SPACED_MONEY","description":"Looks like money but has odd spacing."},{"name":"FB_ONIINE","description":"Mis-spelled online"},{"name":"FB_P1LL","description":"Phrase: p1ll"},{"name":"FB_PA1N","description":"Phrase: pa1n"},{"name":"FB_PASTE_LINK","description":"Phrase: past link into browser"},{"name":"FB_PC_DOCTOR","description":"Phrase: PC Doctor"},{"name":"FB_PENIS_GROWTH","description":"Phrase: penis growth"},{"name":"FB_PIPE_ILLION","description":"Looks like illion, but it's not"},{"name":"FB_PIPEDOLLAR","description":"Phrase: Dollar, with pipes or 0's."},{"name":"FB_PIPENEWSLETTER","description":"Phrase news|etter"},{"name":"FB_PROLONGED_HARD","description":"Talks about prolonged hardness"},{"name":"FB_QUALITY_REPLICA","description":"Phrase: quality replica"},{"name":"FB_RANDOM_SPUR","description":"Pattern Replacement Failure"},{"name":"FB_RE_FI","description":"Looks like refi."},{"name":"FB_REF_CODE_SPACE","description":"Refcode with spacing"},{"name":"FB_REFI","description":"Phrase: Refi"},{"name":"FB_REM_PART","description":"Looks like remove w/o e."},{"name":"FB_REPLICA_ROLEX","description":"Phrase: Replica Rolex"},{"name":"FB_REWARDS_GATE","description":"Phrase: Rewards Gateway"},{"name":"FB_ROLLER_IS_T","description":"Phrase: Roller is th"},{"name":"FB_ROLX","description":"Phrase: rolx"},{"name":"FB_SAVE_PERSC","description":"Phrase: save ... prescription."},{"name":"FB_SSEX","description":"Phrase: ssex"},{"name":"FB_SMALL_PEN","description":"Phrase: small pen"},{"name":"FB_SOFTTABS","description":"Phrase: Softabs"},{"name":"FB_SPACED_CASH","description":"Phrase: c a s h"},{"name":"FB_SPACED_FREE","description":"Phrase: F R E E"},{"name":"FB_SPACED_LOWER","description":"Phrase: l o w e r"},{"name":"FB_SPACEY_ZIP","description":"Looks like a  s p a c e d zipcode."},{"name":"FB_SPUR_M","description":"Phrase: SPUR-M"},{"name":"FB_STAMINA_IN_BED","description":"Phrase: stamina in bed."},{"name":"FB_STOCK_EXPLODE","description":"Looks like stocks exploding."},{"name":"FB_STOP_EMAILING","description":"Phrase stop e-mailing me"},{"name":"FB_STREAM_OF","description":"Phrase: Watch the stream of customers"},{"name":"FB_STRONGER_EJ","description":"Phrase: stronger ejaculation"},{"name":"FB_SUPERBREWARD","description":"Phrase: Superb Rewards"},{"name":"FB_SYMBLO","description":"Mis-spelled symbol."},{"name":"FB_THIS_ADVERT","description":"Phrase: this advertiser"},{"name":"FB_THOUS_PERSONAL","description":"Phrase: thousand personal"},{"name":"FB_TIRED_OF_YOUR","description":"Phrase: Tired of your"},{"name":"FB_TO_STOP_DISTRO","description":"Phrase: to stop further distribution"},{"name":"FB_UGGS_NOW","description":"Phrase: uggs now"},{"name":"FB_ULTRA_ALLURE","description":"Phrase: Ultra Allure"},{"name":"FB_UNLOCK_YOUR_G","description":"Phrase: lock to your girlfriend"},{"name":"FB_UNRESOLV_PROV","description":"Pattern Replacement PROV_D"},{"name":"FB_V_SPACE_GRA","description":"Looks like Viagra?"},{"name":"FB_VERIFY_ZIP","description":"Phrase: verify your zipcode"},{"name":"FB_WHILECONNECTED","description":"Phrase: white connected to the internet"},{"name":"FB_WHITEGOLD","description":"Phrase: white gold sound good"},{"name":"FB_WITHOUT_INCRE","description":"Phrase: without increasing your"},{"name":"FB_WITHOUT_PRESC","description":"Phrase: without a prescription."},{"name":"FB_WORD1_END_DOLLAR","description":"Looks like a word ending with a $"},{"name":"FB_WORD2_END_DOLLAR","description":"Looks like a word ending with a $ (2)"},{"name":"FB_YOU_CAN_BECOME","description":"Phrase: you can become"},{"name":"FB_YOU_LOVE","description":"Phrase: you love can"},{"name":"FB_YOUR_MED","description":"Phrase: your med"},{"name":"FB_YOUR_REFI","description":"Phrase: Your refi"},{"name":"FB_YOUR_MORTGAGE","description":"Phrase: Your Mortgage"},{"name":"FB_YOUR_PC_ERROR","description":"Phrase: your pc has error"},{"name":"FB_YOUR_REFILL","description":"Phrase: your refill"},{"name":"FB_YOUR_WEIGHT","description":"Phrase: about your weight"},{"name":"FB_YOUR_WOMAN","description":"Phrase: Your woman will be"},{"name":"FB_YOURSELF_MASTER","description":"Phrase: yourself master"},{"name":"FB_YOUTH_THIS","description":"Phrase: Youth is Back!"},{"name":"FH_DATE_IS_19XX","description":"The date is not 19xx."},{"name":"FH_FAKE_RCVD_LINE","description":"RCVD line looks faked (A)"},{"name":"FH_FAKE_RCVD_LINE_B","description":"RCVD line looks faked (B)"},{"name":"FH_FROM_CASH","description":"From name has \"cash\""},{"name":"FH_FROMEML_NOTLD","description":"E-mail address doesn't have TLD (.com, etc.)"},{"name":"FH_FROM_RND_1","description":"From has pattern replacement broken."},{"name":"FH_FROM_GET_NAME","description":"From name says Get"},{"name":"FH_FROM_GIVEAWAY","description":"From name is giveaway."},{"name":"FH_FROM_START_YOU","description":"From starts with you."},{"name":"FH_HAS_UID","description":"Header UID found."},{"name":"FH_HELO_ALMOST_IP","description":"Helo is almost an IP addr."},{"name":"FH_HELO_GMAILSMTP","description":"Faked helo of gmail-smtp-in"},{"name":"FH_HELO_ENDS_DOT","description":"Helo ends with a dot."},{"name":"FH_HELO_EQ_610HEX","description":"Helo is 6-10 hex chr's."},{"name":"FH_HELO_EQ_CHARTER","description":"Helo is d-d-d-d charter.com"},{"name":"FH_HOST_EQ_DYNAMICIP","description":"Host is dynamicip"},{"name":"FH_HOST_EQ_PACBELL_D","description":"Host is pacbell.net dsl"},{"name":"FH_HOST_EQ_SPRINT_H","description":"Host is dhcp sprint-hsd.net"},{"name":"FH_HOST_EQ_VERIZON_P","description":"Host is pool-.+verizon.net"},{"name":"FH_MSGID_XXX","description":"Message-Id = @xxx"},{"name":"FH_RCVD_FROM_2_WDS","description":"RCVD line has 2 words after from."},{"name":"FH_RCVD_HELODATE","description":"The HELO Looks like a date?"},{"name":"FH_RE_NEW_DDD","description":"Subject is Re: new \\d\\d\\d"},{"name":"FH_SPOOF_NAMES","description":"Pattern Replacement Failure"},{"name":"FH_USER_MOZILLA_SMAL","description":"Specific signs of ratware"},{"name":"FH_VIRUS_NORTON","description":"Does Norton really not have caps?"},{"name":"FH_XCOMMENT_GIBBER","description":"X-Comment is gibberish"},{"name":"FR_3TAG_3TAG","description":"Looks like 3 <e> small tags."},{"name":"FR_ALMOST_VIAG2","description":"Almost looks like viagra."},{"name":"FR_CANTSEETEXT","description":"Phrase class=cantseetext"},{"name":"FR_COMMENT_ODD","description":"Strange HTML comment."},{"name":"FR_DIV_DRUGS_3","description":"Looks like many div's in drug spam."},{"name":"FR_DOT_FEVER_5","description":"Lots of dots inbetween letters."},{"name":"FR_IMPORT_CSS","description":"Special @import url css"},{"name":"FR_M_E_D_S","description":"Spaced out M E D S"},{"name":"FR_MIDER","description":"Sign often seen in spams"},{"name":"FR_P_END_P_MANY10","description":"Many <p></p> (10)"},{"name":"FR_PORN_NOT_URL","description":"Looks like a porn url seen before."},{"name":"FR_TEST_BASE64_BAD","description":"Looks like bad BASE64 with <br> at end."},{"name":"FR_TITLE_CONS_6","description":"Title Attribute has 6 non-vowels."},{"name":"FR_TITLE_NUMS","description":"HTML Title is only numbers"},{"name":"FS_ABIGGER","description":"Subject has \"a bigger\""},{"name":"FS_APPROVE_YOU","description":"Subject says approve you"},{"name":"FS_AT_NO_COST","description":"Subject says \"At No Cost\""},{"name":"FS_ATTRACT_CUST","description":"Subject says Attract something customer"},{"name":"FS_BROKEN_MEETING","description":"Subject looks like meeting but broken."},{"name":"FS_CHEAP_CAP","description":"Phrase: Cheap in Caps in Subject."},{"name":"FS_CAILIS","description":"Subject says cailis"},{"name":"FS_CLAIM_NOW","description":"Subject says \"Claim now\""},{"name":"FS_COSTARICA","description":"Subject says Costa Rica"},{"name":"FS_CUTE_TEEN","description":"Subject says cute teen"},{"name":"FS_DOLLAR_BONUS","description":"Subject talks about money bonus!"},{"name":"FS_EJACULA","description":"Phrase: ejaculation in subject."},{"name":"FS_END_BILLS","description":"Subject ends with bills."},{"name":"FS_ERECTION","description":"Phrase: erection in subject."},{"name":"FS_GANGBANG","description":"Phrase: subject says gangbang"},{"name":"FS_GET_LAID","description":"Phrase: get laid in subj."},{"name":"FS_GIFT_CARD_OFF","description":"Subject says Gift card offer"},{"name":"FS_HOT_TEEN","description":"Phrase: subject says \"hot teen\""},{"name":"FS_HUGECOCK","description":"Phrase: Huge Cock"},{"name":"FS_LARGE_PERCENT2","description":"Larger than 100% in subj."},{"name":"FS_LITTLE_PILL","description":"Phrase: little somthing pill."},{"name":"FS_LOW_INTMOR","description":"Subject says low interest or mortgage"},{"name":"FS_LOW_RATES","description":"Subject says low rates"},{"name":"FS_LOWER_YOUR","description":"Phrase: lower your"},{"name":"FS_MAKE_MONEY","description":"Subject says \"make money\""},{"name":"FS_MORE_CONFIDENT","description":"Subject says More Confident"},{"name":"FS_NEED_MONEY","description":"Subject talks about needing cash."},{"name":"FS_NEW_SOFT_UPLOAD","description":"Subj starts with New software uploaded"},{"name":"FS_NEW_XXX","description":"Subject looks like Fharmacy spams."},{"name":"FS_NO_SCRIP","description":"Subject almost says No prescription"},{"name":"FS_NUDE","description":"Subject says Nude"},{"name":"FS_NUMYO","description":"Speaks of teenager in subject."},{"name":"FS_OBFU_PRMCY","description":"what could this word be?"},{"name":"FS_PAYINGTOOM","description":"Subject says Paying too much for"},{"name":"FS_PERSCRIPTION","description":"Subject mis-spelled prescription"},{"name":"FS_PHARMASUB2","description":"Looks like Phramacy subject."},{"name":"FS_PORN_STAR","description":"Subject says Porn Star"},{"name":"FS_PRE_SUBJ","description":"Subject says PRE_SUBJ"},{"name":"FS_RE_APPROV","description":"Phrase: re approved"},{"name":"FS_REFI","description":"Subject says \"refi\""},{"name":"FS_RESULTS_BED","description":"Subject says results in bed"},{"name":"FS_SILDENAFIL","description":"Subject says \"Sildenafil Citrate\""},{"name":"FS_SINGLE_LETTER_H","description":"Subject has a bare H"},{"name":"FS_SINGLE_LETTER_J","description":"Subject has a bare J"},{"name":"FS_SPERMAX","description":"Subject contains Spermamax"},{"name":"FS_SPLASH","description":"Subject says splash or splashed"},{"name":"FS_START_DOYOU2","description":"Subject starts with Do you dream,have,want,love, etc."},{"name":"FS_START_LOSE","description":"Subject starts with Lose"},{"name":"FS_START_TEEN","description":"Subject starts with Teen"},{"name":"FS_TEEN_BAD","description":"Subject says something bad about teens"},{"name":"FS_TIGHT_TEEN","description":"Phrase: tight teen, etc."},{"name":"FS_TIP_DDD","description":"Phrase: subject = tip ddd"},{"name":"FS_VIEWPHOTOS","description":"Phrase: View photos of singles..."},{"name":"FS_WE_WANT","description":"Subject starts with We Want."},{"name":"FS_WEIGHT_LOSS","description":"Subject says Weight Loss"},{"name":"FS_WILL_HELP","description":"Subject says will help"},{"name":"FS_YOUR_COMPUTER","description":"Phrase: Your Computer in Subject."},{"name":"FS_YOUR_PRESCRIP","description":"Subject talks about your prescription"},{"name":"FS_YOUR_REFILL","description":"Subject Phrase: your refill"},{"name":"FU_16R","description":"Often seen in spam /16r"},{"name":"FU_COMMON_SUBS2","description":"Sub-dir seen often in spam (2)."},{"name":"FU_ENDS_NUMS_DOTS_CLK","description":"Ends with clk/d+.d+.d+"},{"name":"FU_HG_PATH","description":"URL has /hgh/ in path."},{"name":"FU_HOODIA","description":"URL has hoodia in it."},{"name":"FU_LONG_HTML","description":"URL has long file name with .html extension."},{"name":"FU_LOTSOFCOLONS","description":"word:word:word in URL."},{"name":"FU_LONG_QUERY3","description":"URL has a long file name with .aspx extension."},{"name":"FU_MIDER","description":"URL has /gal/"},{"name":"FU_RX_DIR","description":"/rx/"},{"name":"FU_SUB_D_WEIRD","description":"Sub-domain seen often in spam."},{"name":"FU_UKGEOCITIES","description":"URL with [a-z]{2}.geocities.com"},{"name":"FU_URI_TRACKER_T","description":"URI style tracker (T)"},{"name":"FM_APPROVE_COMPLETE","description":"Meta approved complete review"},{"name":"FM_BIG_REASON","description":"Lot's of CAP words, BIG, REASON, BEST"},{"name":"FM_CLAIM_IPOD","description":"Looks like u should claim your ipod."},{"name":"FM_COKE_PEPSI","description":"Subject has both Coke and Pepsi"},{"name":"FM_CONG_GIFTCARD","description":"Talks about gift cards and congrads."},{"name":"FM_COSTA_RICA","description":"Looks like Costa Rica spams."},{"name":"FM_DEBT_HELP","description":"Subject says debt and help."},{"name":"FM_FAKE_HELO_HOTMAIL","description":"Looks like a fake hotmail.com helo."},{"name":"FM_FAKE_HELO_VERIZON","description":"Looks like a fake verizon.net helo."},{"name":"FM_FORGED_GMAIL","description":"Looks like a forged gmail msg?"},{"name":"FM_FRM_RN_L_BRACK","description":"From name has > but not <"},{"name":"FM_GET_CASH_SURVEY","description":"Meta Get Cash + Survey"},{"name":"FM_GOOD_ENF_CREDIT","description":"Meta Good enough credit"},{"name":"FM_IS_IT_OUR_ACCOUNT","description":"Is it our account?"},{"name":"FM_LEND_MONEY","description":"Subject has ddd + lend!"},{"name":"FM_LOAN_NUM_DOMAIN","description":"Loan and numbers in .com"},{"name":"FM_MAKE_MONEY_HOME","description":"Making money from home."},{"name":"FM_MANY_DRUG_WORDS","description":"Lot's of almost drug words"},{"name":"FM_MEDS_SUBJ_2WDS","description":"Talks about Meds, Re: two words."},{"name":"FM_MORTGAGE3PLUS","description":"Looks like a mortgage spam (3+)"},{"name":"FM_MORTGAGE4PLUS","description":"Looks like a mortgage spam (4+)"},{"name":"FM_MORTGAGE5PLUS","description":"Looks like a mortgage spam (5+)"},{"name":"FM_MORTGAGE6PLUS","description":"Looks like a mortgage spam (6+)"},{"name":"FM_MULTI_LUX_GIFTS","description":"Talks about variety of luxury gifts"},{"name":"FM_NIKE_ADIDAS","description":"Meta Nike & Adidas"},{"name":"FM_PAYING_LOWER","description":"Meta You are paying too much..."},{"name":"FM_PC_ERROR_DBL","description":"Combo Meta of multiple rules."},{"name":"FM_RATSIGN_1106","description":"Fingerprint seen in lots of spam. 11/2006"},{"name":"FM_REPLY_OR_NOT","description":"Meta do they want a reply or not?"},{"name":"FM_ROLEX_ADS","description":"Looks like Rolex spams."},{"name":"FM_SCHOOL_TYPES","description":"Meta Combo Phrase for Schooling"},{"name":"FM_SCHOOLING","description":"Meta Combo Phrase for Schooling (2)"},{"name":"FM_SCHOOL_DIPLOMA","description":"Meta for Schooling + Diploma."},{"name":"FM_SUB_TEEN_NUDE","description":"Subject says teen and nude"},{"name":"FM_SUBJ_APPROVE","description":"Subject has Approve and !"},{"name":"FM_SUBJ_YOU_PROFIT","description":"Subject says you profit"},{"name":"FM_VEGAS_CASINO","description":"Looks like vega casino spam"},{"name":"FM_WEIGHT_LOSS","description":"Looks like oprah weight loss spam."},{"name":"FRT_ABSOLUT","description":"ReplaceTags: Absolutely"},{"name":"FRT_ADOBE2","description":"ReplaceTags: Adobe"},{"name":"FRT_ADULT2","description":"ReplaceTags: Adult"},{"name":"FRT_APPROV","description":"ReplaceTags: Approve"},{"name":"FRT_BEFORE","description":"ReplaceTags: Before"},{"name":"FRT_BELOW2","description":"ReplaceTags: Below (2)"},{"name":"FRT_BIGGERMEM1","description":"ReplaceTags: Bigger / Larger, Penis / Member"},{"name":"FRT_CANSPAM","description":"ReplaceTags: Can Spam"},{"name":"FRT_CLICK","description":"ReplaceTags: Click"},{"name":"FRT_COCK","description":"ReplaceTags: Cock"},{"name":"FRT_CONTACT","description":"ReplaceTags: Contact"},{"name":"FRT_ERECTION","description":"ReplaceTags: Erection"},{"name":"FRT_ESTABLISH","description":"ReplaceTags: Establish"},{"name":"FRT_EXPERIENCE","description":"ReplaceTags: Experience"},{"name":"FRT_FOLLOW1","description":"ReplaceTags: Follow"},{"name":"FRT_FOLLOW2","description":"ReplaceTags: Follow (2)"},{"name":"FRT_FREE","description":"ReplaceTags: Free"},{"name":"FRT_FRIEND","description":"ReplaceTags: Friend"},{"name":"FRT_FUCK1","description":"ReplaceTags: Fuck (1)"},{"name":"FRT_HEALTH","description":"ReplaceTags: Health"},{"name":"FRT_HOUR","description":"ReplaceTags: Hour"},{"name":"FRT_INCOME","description":"ReplaceTags: Income"},{"name":"FRT_INTEREST","description":"ReplaceTags: Interest"},{"name":"FRT_LITTLE","description":"ReplaceTags: Little"},{"name":"FRT_LOLITA1","description":"ReplaceTags: Lolita (1)"},{"name":"FRT_OFFER2","description":"ReplaceTags: Offer (2)"},{"name":"FRT_OPPORTUN1","description":"ReplaceTags: Oppertun (1)"},{"name":"FRT_PACKAGE","description":"ReplaceTags: Package"},{"name":"FRT_PAYMENT","description":"ReplaceTags: Payment"},{"name":"FRT_PENIS1","description":"ReplaceTags: Penis"},{"name":"FRT_PHARMAC","description":"ReplaceTags: Pharmac"},{"name":"FRT_POSSIBLE","description":"ReplaceTags: Possible"},{"name":"FRT_PRICE","description":"ReplaceTags: Price"},{"name":"FRT_PROFILE1","description":"ReplaceTags: Profile (1)"},{"name":"FRT_PROFILE2","description":"ReplaceTags: Profile (2)"},{"name":"FRT_PROFIT1","description":"ReplaceTags: Profit (1)"},{"name":"FRT_PROFIT2","description":"ReplaceTags: Profit (2)"},{"name":"FRT_PUSSY","description":"ReplaceTags: Pussy"},{"name":"FRT_ROLEX","description":"ReplaceTags: Rolex"},{"name":"FRT_SLUT","description":"ReplaceTags: Slut"},{"name":"FRT_STOCK1","description":"ReplaceTags: Stock (1)"},{"name":"FRT_STOCK2","description":"ReplaceTags: Stock (2)"},{"name":"FRT_VIRGIN1","description":"ReplaceTags: Virgin (1)"},{"name":"PDS_OTHER_BAD_TLD","description":"Untrustworthy TLDs"},{"name":"FROM_SUSPICIOUS_NTLD","description":"From abused NTLD"},{"name":"FROM_SUSPICIOUS_NTLD_FP","description":"From abused NTLD"},{"name":"FROM_NTLD_REPLY_FREEMAIL","description":"From abused NTLD and Reply-To is FREEMAIL"},{"name":"FROM_NTLD_LINKBAIT","description":"From abused NTLD with little more than a URI"},{"name":"GOOGLE_DRIVE_REPLY_BAD_NTLD","description":"From Google Drive and Reply-To is from a suspicious TLD"},{"name":"SEO_SUSP_NTLD","description":"SEO offer from suspicious TLD"},{"name":"THIS_IS_ADV_SUSP_NTLD","description":"This is an advertisement from a suspicious TLD"},{"name":"BULK_RE_SUSP_NTLD","description":"Precedence bulk and RE: from a suspicious TLD"},{"name":"SHORT_IMG_SUSP_NTLD","description":"Short HTML + image + suspicious TLD"},{"name":"VPS_NO_NTLD","description":"vps[0-9] domain at a suspiscious TLD"},{"name":"OFFER_ONLY_AMERICA","description":"Offer only available to US"},{"name":"SENT_TO_EMAIL_ADDR","description":"Email was sent to email address"},{"name":"SUSPNTLD_EXPIRATION_EXTORT","description":"Susp NTLD with an expiration notice and lotsa money"},{"name":"PDS_BTC_NTLD","description":"Bitcoin suspect NTLD"},{"name":"NUMBEREND_LINKBAIT","description":"Domain ends in a large number and very short body with link"},{"name":"NUMBERONLY_BITCOIN_EXP","description":"Domain ends in a large number and very short body with link"},{"name":"PDS_NAKED_TO_NUMERO","description":"Naked-to, numberonly domain"},{"name":"FROM_FMBLA_NEWDOM","description":"From domain was registered in last 7 days"},{"name":"FROM_FMBLA_NEWDOM14","description":"From domain was registered in last 7-14 days"},{"name":"FROM_FMBLA_NEWDOM28","description":"From domain was registered in last 14-28 days"},{"name":"FROM_FMBLA_NDBLOCKED","description":"ADMINISTRATOR NOTICE: The query to fresh.fmb.la was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"FROM_NUMBERO_NEWDOMAIN","description":"Fingerprint and new domain"},{"name":"FROM_NEWDOM_BTC","description":"Newdomain with Bitcoin ID"},{"name":"KAM_LOTTO1","description":"Likely to be a e-Lotto Scam Email"},{"name":"KAM_LOTTO2","description":"Highly Likely to be a e-Lotto Scam Email"},{"name":"KAM_LOTTO3","description":"Almost certain to be a e-Lotto Scam Email"},{"name":"KAM_ABOUT","description":"Email Scam Hawking Anti-Spyware"},{"name":"KAM_ADVERT","description":"Mailing List Scammers Hawking Their Lists / Services"},{"name":"KAM_ADVERT2","description":"This is probably an unwanted commercial email..."},{"name":"KAM_1LINE","description":"One liner spams"},{"name":"KAM_CANSPAM","description":"SPAM = Lack of Consent not a Legal Defintion"},{"name":"KAM_GIFT","description":"Gift Card Scams"},{"name":"KAM_SHOP","description":"Mystery Shopper Scams"},{"name":"KAM_FAST","description":"Get Rich Quick, Make Money Fast Schemes"},{"name":"KAM_BIZ","description":"Free Business Card Emails"},{"name":"KAM_ANA","description":"Likely Anatrim Weightloss Spam"},{"name":"KAM_REPLACE","description":"Spams that use obfuscated URLs with instructions"},{"name":"FSL_NOT_FROM_GOOGLE","description":"Envelope-From GMail or Google but not originated from Google systems"},{"name":"FSL_NOT_FROM_YAHOO","description":"Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems"},{"name":"FSL_NOT_FROM_HOTMAIL","description":"Envelope-From Hotmail/Live but not originated from Hotmail systems"},{"name":"FSL_NOT_FROM_AOL","description":"Envelope-From AOL but not originated from AOL systems"},{"name":"FSL_UNDISCLOSED_RCPTS","description":"To undisclosed recipients"},{"name":"FSL_ABUSED_WEB_1","description":"Has X-AntiAbuse header"},{"name":"FSL_ABUSED_WEB_2","description":"Has X-PHP-Script header"},{"name":"FSL_ABUSED_WEB_3","description":"Has X-PHP-Originating-Script header"},{"name":"FSL_UNDISCLOSED_BULK","description":"Undisclosed recipients and bulk signature"},{"name":"FSL_YAHOO_AUTH_SIG","description":"Yahoo SMTP AUTH observed patterns"},{"name":"SMF_FM_FORGED_REPLYTO","description":"Freemail in Reply-To, but not From"},{"name":"FSL_HTML_BLOCK_LOTS_1","description":"More <div> or <span> blocks than lines"},{"name":"FSL_HTML_BLOCK_LOTS_2","description":"More <div> or <span> blocks than twice the amount of lines"},{"name":"FSL_HTML_BLOCK_LOTS_3","description":"More <div> or <span> blocks than 4x the amount of lines"},{"name":"FSL_HTML_ENT_LOTS_1","description":"Lots of HTML entities x2"},{"name":"FSL_HTML_ENT_LOTS_2","description":"Lots of HTML entities x8"},{"name":"FSL_HTML_ENT_LOTS_3","description":"Lots of HTML entities x24"},{"name":"TVD_SILLY_URI_OBFU","description":"URI obfuscation that can fool a URIBL or a uri rule"},{"name":"FUZZY_MERIDIA","description":"Obfuscation of the word \"meridia\""},{"name":"TVD_FUZZY_PHARMACEUTICAL","description":"Obfuscation of the word \"pharmaceutical\""},{"name":"TVD_FUZZY_SYMBOL","description":"Obfuscation of the word \"symbol\""},{"name":"TVD_FUZZY_FINANCE","description":"Obfuscation of the word \"finance\""},{"name":"TVD_FUZZY_FIXED_RATE","description":"Obfuscation of the phrase \"fixed rate\""},{"name":"TVD_FUZZY_MICROCAP","description":"Obfuscation of the word \"micro-cap\""},{"name":"TVD_FUZZY_DEGREE","description":"Obfuscation of the word \"degree\""},{"name":"DEAR_WINNER","description":"Spam with generic salutation of \"dear winner\""},{"name":"SUBJECT_NEEDS_ENCODING","description":"Subject is encoded but does not specify the encoding"},{"name":"DRUGS_HDIA","description":"Subject mentions \"hoodia\""},{"name":"TVD_FROM_1","description":"From address appears to be a throwaway domain"},{"name":"TVD_RATWARE_CB","description":"Content-Type header that is commonly indicative of ratware"},{"name":"TVD_SUBJ_WIPE_DEBT","description":"Spam advertising a way to eliminate debt"},{"name":"TVD_ACT_193","description":"Message refers to an act passed in the 1930s"},{"name":"TVD_APPROVED","description":"Body states that the recipient has been approved"},{"name":"TVD_DEAR_HOMEOWNER","description":"Spam with generic salutation of \"dear homeowner\""},{"name":"TVD_INCREASE_SIZE","description":"Advertising for penis enlargement"},{"name":"TVD_SECTION","description":"References to specific legal codes"},{"name":"TVD_VISIT_PHARMA","description":"Body mentions online pharmacy"},{"name":"TVD_SUBJ_OWE","description":"Subject line states that the recipieint is in debt"},{"name":"NULL_IN_BODY","description":"Message has NUL (ASCII 0) byte in message"},{"name":"TVD_FW_GRAPHIC_NAME_LONG","description":"Long image attachment name"},{"name":"TVD_FW_GRAPHIC_NAME_MID","description":"Medium sized image attachment name"},{"name":"TVD_FLOAT_GENERAL","description":"Message uses CSS float style"},{"name":"TVD_SUBJ_FINGER_03","description":"Entire subject is enclosed in asterisks \"* like so *\""},{"name":"TVD_SPACED_SUBJECT_WORD3","description":"Entire subject is \"UPPERlowerUPPER\" with no whitespace"},{"name":"TVD_VIS_HIDDEN","description":"Invisible textarea HTML tags"},{"name":"TVD_QUAL_MEDS","description":"The body matches phrases such as \"quality meds\" or \"quality medication\""},{"name":"TVD_LINK_SAVE","description":"Spam with the text \"link to save\""},{"name":"TVD_RATWARE_CB_2","description":"Content-Type header that is commonly indicative of ratware"},{"name":"TVD_RATWARE_MSGID_02","description":"Ratware with a Message-ID header that is entirely lower-case"},{"name":"BASE64_LENGTH_79_INF","description":"base64 encoded email part uses line length of 78 or 79 characters"},{"name":"BASE64_LENGTH_79_INF","description":"base64 encoded email part uses line length greater than 79 characters"},{"name":"TVD_RCVD_IP4","description":"Message was received from an IPv4 address"},{"name":"TVD_RCVD_IP","description":"Message was received from an IP address"},{"name":"TVD_RCVD_SINGLE","description":"Message was received from localhost"},{"name":"HEADER_COUNT_SUBJECT","description":"Multiple Subject headers found"},{"name":"RCVD_BAD_ID","description":"Received header contains id field with bad characters"},{"name":"TVD_ENVFROM_APOST","description":"Envelope From contains single-quote"},{"name":"TVD_STOCK1","description":"Spam related to stock trading"},{"name":"TVD_PDF_FINGER01","description":"Mail matches standard pdf spam fingerprint"},{"name":"PDS_PHP_EVAL","description":"PHP header shows eval'd code"},{"name":"PDS_PHP_RUNTIME_FUNC","description":"PHP header shows runtime-created function"},{"name":"PDS_X_PHP_WP_EXP","description":"X-PHP-Script shows sent from a Wordpress PHP script where you would not expect one"},{"name":"PDS_X_PHP_WELLKNOWN","description":"X-PHP-Script shows sent from a PHP script in the /.well-known/ dir"},{"name":"PDS_PHPE_SHORT_URL","description":"Short URL that isn't a shortener and sent by PHP exploit"},{"name":"PDS_PHPE_URISHORTENER","description":"URI Shortener with PHP eval"},{"name":"PDS_PHPEXP_BOT","description":"PHP exploit bot sender"},{"name":"DATE_IN_FUTURE_96_WEEK","description":"Date: is 4 to 7 days after Received: date"},{"name":"DATE_IN_FUTURE_WEEK","description":"Date: is a week to a month after Received: date"},{"name":"DATE_IN_FUTURE_MONTH","description":"Date: is 1 to 4 months after Received: date"},{"name":"DATE_IN_FUTURE_YEAR","description":"Date: is 4 months to a year after Received: date"},{"name":"DATE_IN_FUTURE_1Y_4Y","description":"Date: is 1 to 4 years after Received: date"},{"name":"DATE_IN_DISTANT_FUTURE","description":"Date: is over 4 years after Received: date"},{"name":"DATE_IN_FUTURE_96_Q","description":"Date: is 4 days to 4 months after Received: date"},{"name":"DATE_IN_FUTURE_Q_PLUS","description":"Date: is over 4 months after Received: date"},{"name":"AC_SPAMMY_URI_PATTERNS1","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS2","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS3","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS4","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS8","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS9","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS10","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS11","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS12","description":"link combos match highly spammy template"},{"name":"AC_BAYES_99","description":"Bayes spam probability is 99 to 99.9%"},{"name":"AC_BAYES_999","description":"Bayes spam probability is 99.9 to 100%"},{"name":"AC_BR_BONANZA","description":"Too many newlines in a row... spammy template"},{"name":"AC_DIV_BONANZA","description":"Too many divs in a row... spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS5","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS6","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS7","description":"link combos match highly spammy template"},{"name":"URI_IN_URI_5","description":"Multiple URIs inside URI"},{"name":"URI_IN_URI_10","description":"Multiple URIs inside URI"},{"name":"URI_IN_URI_20","description":"Multiple URIs inside URI"},{"name":"MILLION_HUNDRED","description":"Million \"One to Nine\" Hundred"},{"name":"HK_RANDOM_ENVFROM","description":"Envelope sender username looks random"},{"name":"HK_RANDOM_FROM","description":"From username looks random"},{"name":"HK_RANDOM_REPLYTO","description":"Reply-To username looks random"},{"name":"HK_RANDOM_FROM_NAME","description":"From name looks random"},{"name":"HK_RANDOM_REPLYTO_NAME","description":"Reply-To name looks random"},{"name":"HK_NAME_DRUGS","description":"From name contains drugs"},{"name":"HK_NAME_FREE","description":"From name mentions free stuff"},{"name":"HK_SUBJECT_SPACES","description":"Lots of spaces in Subject"},{"name":"HK_SUBJECT_SPACES_SC","description":"Lots of spaces in Subject with some obfuscation"},{"name":"HK_MUCHMONEY","description":"Message refers to hundreds of thousands or millions"},{"name":"__TAB_IN_FROM","description":"From starts with a tab"},{"name":"TAB_IN_FROM","description":"From starts with a tab"},{"name":"HK_FAKENAME_MICROSOFT","description":"From name mentions Microsoft, but not relayed from there"},{"name":"HK_FAKENAME_YAHOO","description":"From name mentions Yahoo, but not relayed from there"},{"name":"HK_FAKENAME_PAYPAL","description":"From name mentions PayPal, but not relayed from there"},{"name":"HK_FAKENAME_EBAY","description":"From name mentions eBay, but not relayed from there"},{"name":"TEST_NOREALNAME","description":"From: does not include a real name"},{"name":"TEST_ENDSNUMS","description":"From: ends in many numbers"},{"name":"TEST_FORGED_YAHOO_RCVD","description":"'From' yahoo.com does not match 'Received' headers"},{"name":"TEST_NORMAL_HTTP_TO_IP","description":"Uses a dotted-decimal IP address in URL"},{"name":"TEST_EXCUSE_12","description":"Nobody's perfect"},{"name":"TEST_EXCUSE_4","description":"Claims you can be removed from the list"},{"name":"TEST_INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"TEST_MSGID_OUTLOOK_INVALID","description":"Message-Id is fake (in Outlook Express format)"},{"name":"MISSING_HB_SEP","description":"Missing blank line between message header and body"},{"name":"X_MESSAGE_INFO","description":"Bulk email fingerprint (X-Message-Info) found"},{"name":"SORTED_RECIPS","description":"Recipient list is sorted by address"},{"name":"SUSPICIOUS_RECIPS","description":"Similar addresses in recipient list"},{"name":"GTUBE","description":"Generic Test for Unsolicited Bulk Email"},{"name":"BAYES_99","description":"Bayes spam probability is 99 to 100%"},{"name":"INVALID_MSGID","description":"Message-Id is not valid, according to RFC 2822"},{"name":"INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"AWL","description":"From: address is in the auto white-list"},{"name":"DCC_CHECK","description":"Detected as bulk mail by DCC (dcc-servers.net)"},{"name":"SHORTCIRCUIT","description":"Not all rules were run, due to a shortcircuited rule"},{"name":"RAZOR2_CHECK","description":"Listed in Razor2 (http://razor.sf.net/)"},{"name":"MALFORMED_FREEMAIL","description":"Bad headers on message from free email service"},{"name":"FROM_WEBSITE","description":"Sender name appears to be a link"},{"name":"FROM_2_EMAILS","description":"Sender claims to have a different email"},{"name":"KHOP_BIG_TO_CC","description":"Sent to 10+ recipients instaed of Bcc or a list"},{"name":"KHOP_FAKE_EBAY","description":"Sender falsely claims to be from eBay"},{"name":"KHOP_FOREIGN_CLICK","description":"Click here link in non-English Latin text"},{"name":"SPOOFED_URL","description":"Has a link whose text is a different URL"},{"name":"URL_SHORTENER","description":"Has a shortened URL (can hide a blacklisted link)"},{"name":"SHORT_URL","description":"Has a short URL without a shortening service"},{"name":"URI_HIDDEN","description":"Contains a hidden directory"},{"name":"BOTNET_SHAWCABLE","description":"Shawcable.net customer address"},{"name":"BOTNET_OCNNEJP","description":"Ocn.ne.jp customer address"},{"name":"__BOTNET_NOTRUST","description":"Message has no trusted relays"},{"name":"KHOP_HELO_FCRDNS","description":"Relay HELO differs from its IP's reverse DNS"},{"name":"HELO_NO_DOMAIN","description":"Relay reports its domain incorrectly"},{"name":"NAME_EMAIL_DIFF","description":"Sender NAME is an unrelated email address"},{"name":"ADV_SUBJ","description":"Marked by sender as an advertisement"},{"name":"UPPERCASE_URI","description":"Link protocol has unexpected mixed case"},{"name":"KHOP_GREYED","description":"Greylisted and sent from dynamically-named relay"},{"name":"DKIM_INVALID","description":"DKIM-Signature header exists but is not valid"},{"name":"REMOTE_IMAGE","description":"Message contains an external image"},{"name":"LONG_HEADER_LINE_80","description":"A header line contains 80-159 characters"},{"name":"LONG_HEADER_LINE_160","description":"A header line contains 160-239 characters"},{"name":"LONG_HEADER_LINE_240","description":"A header line contains 240-319 characters"},{"name":"LONG_HEADER_LINE_320","description":"A header line contains 320-399 characters"},{"name":"LONG_HEADER_LINE_400","description":"A header line contains 400-499 characters"},{"name":"LONG_HEADER_LINE_500","description":"A header line contains 500+ characters"},{"name":"SINGLE_HEADER_1K","description":"A single header contains 1K-2K characters"},{"name":"SINGLE_HEADER_2K","description":"A single header contains 2K-3K characters"},{"name":"SINGLE_HEADER_3K","description":"A single header contains 3K-4K characters"},{"name":"SINGLE_HEADER_4K","description":"A single header contains 4K-5K characters"},{"name":"SINGLE_HEADER_5K","description":"A single header contains 5K+ characters"},{"name":"BIG_HEADERS_2K","description":"Headers contain 2K-3K characters total"},{"name":"BIG_HEADERS_3K","description":"Headers contain 3K-4K characters total"},{"name":"BIG_HEADERS_4K","description":"Headers contain 4K-5K characters total"},{"name":"BIG_HEADERS_5K","description":"Headers contain 5K+ characters total"},{"name":"DEB_RAJONAA","description":"Latvian text with .info URI on Debian List"},{"name":"__TO_EQ_FROM_USR","description":"To: username same as From: username"},{"name":"__TO_EQ_FROM_USR_NN","description":"To: username same as From: username sans trailing nums"},{"name":"SUBJ_LACKS_WORDS","description":"Subject is not short yet lacks words"},{"name":"__FORGED_TBIRD_IMG","description":"Possibly forged Thunderbird image spam"},{"name":"FORGED_TBIRD_IMG_ARROW","description":"Likely forged Thunderbird image spam"},{"name":"TO_NO_BRKTS_HTML_IMG","description":"To: lacks brackets and HTML and one image"},{"name":"TO_NO_BRKTS_HTML_ONLY","description":"To: lacks brackets and HTML only"},{"name":"TO_NO_BRKTS_DYNIP","description":"To: lacks brackets and dynamic rDNS"},{"name":"TO_NO_BRKTS_NORDNS","description":"To: lacks brackets and no rDNS"},{"name":"TO_NO_BRKTS_NORDNS_HTML","description":"To: lacks brackets and no rDNS and HTML only"},{"name":"TO_NO_BRKTS_MSFT","description":"To: lacks brackets and supposed Microsoft tool"},{"name":"TO_NO_BRKTS_PCNT","description":"To: lacks brackets + percentage"},{"name":"TO_NO_BRKTS_DIRECT","description":"To: lacks brackets and direct-to-MX"},{"name":"TO_NO_BRKTS_NOTLIST","description":"To: lacks brackets and not a mailing list"},{"name":"TO_NO_BRKTS_FREEMAIL","description":"To: lacks brackets and free email service"},{"name":"TO_NO_BRKTS_FROM_MSSP","description":"Multiple header formatting problems"},{"name":"FORGED_TBIRD_IMG_TO_MX","description":"Likely forged Thunderbird image spam"},{"name":"FORGED_TBIRD_IMG_SIZE","description":"Likely forged Thunderbird image spam"},{"name":"AXB_XM_LORIS232","description":"Blast from the past?"},{"name":"AXB_X_OUTLOOKPROT_ENVSDR","description":"Outlook Protection trash trait"},{"name":"AXB_X_FF_SEZ_S","description":"Forefront sez this is spam"},{"name":"AXB_XM_FORGED_OL2600","description":"Forged OE v. 6.2600"},{"name":"AXB_X_AOL_SEZ_S","description":"AOL said this is S*"},{"name":"DX_TEXT_01","description":"\"message status\""},{"name":"DX_TEXT_02","description":"\"change your message stat\""},{"name":"DX_TEXT_03","description":"\"XXX Media Group\""},{"name":"DX_TEXT_04","description":"\"Media Group by writing\""},{"name":"DX_TEXT_05","description":"HTML snobbery"},{"name":"GB_MALWARE_DROPBOX_JAR_URI","description":"Dropbox that forces user to download jar file"},{"name":"GB_GOOGLE_OBFUR","description":"Obfuscate url through Google redirect"},{"name":"GB_GOOGLE_OBFUS","description":"Obfuscate url through Google search"},{"name":"GB_COPY_OF_SHORT","description":"Url shortnener spam"},{"name":"GB_FROMNAME_SPOOFED_EMAIL_IP","description":"From:name looks like a spoofed email from a spoofed ip"},{"name":"GB_GOOG_IMG_NOT_RCVD_GOOG","description":"Google hosted image but message not from Google"},{"name":"GB_LINKED_IMG_NOT_RCVD_LINK","description":"Linkedin hosted image but message not from Linkedin"},{"name":"SENDINBLUE_REDIR","description":"Redirect URI via Sendinblue"},{"name":"SENDINBLUE_REDIR_PHISH","description":"Redirect URI via Sendinblue + phishing signs"},{"name":"DNSBL_TEST_TOP","description":"DNSBL A record match"},{"name":"DNSBL_TEST_WHITELIST","description":"DNSBL whitelist match"},{"name":"DNSBL_TEST_WHITELIST_MISS","description":"This rule should not match"},{"name":"DNSBL_TEST_UNTRUSTED","description":"DNSBL untrusted match"},{"name":"DNSBL_TEST_DYNAMIC","description":"DNSBL dynamic match"},{"name":"DNSBL_TEST_SPAM","description":"DNSBL spam source"},{"name":"DNSBL_TEST_RELAY","description":"DNSBL open relay"},{"name":"DNSBL_TEST_MISS","description":"DNSBL open relay"},{"name":"DNSBL_TXT_TOP","description":"DNSBL TXT record match"},{"name":"DNSBL_TXT_RE","description":"DNSBL TXT regular expression match"},{"name":"DNSBL_TXT_MISS","description":"DNSBL TXT regular expression match (should miss)"},{"name":"DNSBL_RHS","description":"DNSBL RHS match"},{"name":"TT_MSGID_TRUNC","description":"Scora: Message-Id ends after left-bracket + digits"},{"name":"CORRUPT_FROM_LINE_IN_HDRS","description":"Informational: message is corrupt, with a From line in its headers"},{"name":"PART_CID_STOCK","description":"Has a spammy image attachment (by Content-ID)"},{"name":"PART_CID_STOCK_LESS","description":"Has a spammy image attachment (by Content-ID, more specific)"},{"name":"RCVD_FORGED_WROTE","description":"Forged 'Received' header found ('wrote:' spam)"},{"name":"DRUGS_STOCK_MIMEOLE","description":"Stock-spam forged headers found (5510)"},{"name":"RCVD_MAIL_COM","description":"Forged Received header (contains post.com or mail.com)"},{"name":"CTYPE_8SPACE_GIF","description":"Stock spam image part 'Content-Type' found (8 spc)"},{"name":"STOCK_IMG_HDR_FROM","description":"Stock spam image part, with distinctive From line"},{"name":"STOCK_IMG_HTML","description":"Stock spam image part, with distinctive HTML"},{"name":"STOCK_IMG_OUTLOOK","description":"Stock spam image part, with Outlook-like features"},{"name":"SPAMMY_XMAILER","description":"X-Mailer string is common in spam and not in ham"},{"name":"SHORT_HELO_AND_INLINE_IMAGE","description":"Short HELO string, with inline image"},{"name":"DYN_RDNS_AND_INLINE_IMAGE","description":"Contains image, and was sent by dynamic rDNS"},{"name":"DYN_RDNS_SHORT_HELO_HTML","description":"Sent by dynamic rDNS, short HELO, and HTML"},{"name":"DYN_RDNS_SHORT_HELO_IMAGE","description":"Short HELO string, dynamic rDNS, inline image"},{"name":"HDR_ORDER_FTSDMCXX_BAT","description":"Header order similar to spam (FTSDMCXX/boundary variant)"},{"name":"HDR_ORDER_FTSDMCXX_001C","description":"Header order similar to spam (FTSDMCXX/MID variant)"},{"name":"STOCK_IMG_CTYPE","description":"Stock spam image part, with distinctive Content-Type header"},{"name":"JM_REACTOR_MAILER","description":"Header patterns indicative of \"Reactor Mailer\" ratware"},{"name":"RATWARE_HELO_DM","description":"External host used 'DM' as the HELO name, DarkMailer signature"},{"name":"LOLLY_419","description":"Your name is \"Lolly\"?  _sure_ it is"},{"name":"DUH_DIKSBJ","description":"Idiot spammer screwed up his templates (DIK variant)"},{"name":"__CN_URL","description":"Contains a URL in the .cn domain"},{"name":"AXB_PDFINFO_AUTH_TEST","description":"PDF trait seen in spam"},{"name":"AXB_PDF_FUZZY_LOTTOUK","description":"Fuzzy tags Match"},{"name":"AXB_PDF_FUZZY2_WINNING","description":"Fuzzy tags match"},{"name":"AXB_PDF_FUZZY1_EBR","description":"Fuzzy tags match"},{"name":"FSL_MY_NAME_IS","description":"My name is ..."},{"name":"FSL_BULK_SIG","description":"Bulk signature with no Unsubscribe"},{"name":"FSL_LINK_AWS_S3_WEB","description":"Contains a link to Amazon S3 website"},{"name":"FSL_LINK_AWS_S3_WEB_FM","description":"Contains a link to Amazon S3 website and from a Freemail address"},{"name":"FSL_PHP_EXPLOIT_41","description":"PHP Script being run by someone in Africa"},{"name":"T_ADVANCE_FEE_2_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_3_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_4_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_5_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_2_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_3_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_4_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_5_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_2_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_3_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_4_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_5_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_2_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"ADVANCE_FEE_3_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"ADVANCE_FEE_4_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"ADVANCE_FEE_5_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"__RCVD_IN_HOSTKARMA","description":"Sender listed in JunkEmailFilter HostKarma"},{"name":"RCVD_IN_HOSTKARMA_WL","description":"Sender listed in HOSTKARMA-WHITE, http://hostkarma.junkemailfilter.com"},{"name":"RCVD_IN_HOSTKARMA_BL","description":"Sender listed in HOSTKARMA-BLACK, http://hostkarma.junkemailfilter.com"},{"name":"RCVD_IN_HOSTKARMA_YL","description":"Sender listed in HOSTKARMA-YELLOW, http://hostkarma.junkemailfilter.com"},{"name":"RCVD_IN_HOSTKARMA_BR","description":"Sender listed in HOSTKARMA-BROWN, http://hostkarma.junkemailfilter.com"},{"name":"DKIMWL_WL_HIGH","description":"DKIMwl.org - High trust sender"},{"name":"DKIMWL_WL_MEDHI","description":"DKIMwl.org - Medium-high trust sender"},{"name":"DKIMWL_WL_MED","description":"DKIMwl.org - Medium trust sender"},{"name":"DKIMWL_BL","description":"DKIMwl.org - Blocked sender"},{"name":"DKIMWL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to DKIMWL.org was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"LOTS_OF_MONEY","description":"Huge... sums of money"},{"name":"MONEY_FREEMAIL","description":"Lots of money from someone using free email?"},{"name":"MONEY_FROM_MISSP","description":"Lots of money and misspaced From"},{"name":"MONEY_TO_NO_R","description":"Lots of money and bare, missing or undisclosed To"},{"name":"MONEY_FORM","description":"Lots of money if you fill out a form"},{"name":"MONEY_FORM_SHORT","description":"Lots of money if you fill out a short form"},{"name":"MONEY_ACCOUNT","description":"Lots of money to your account"},{"name":"WON_MONEY_ATTACH","description":"You won lots of money! See attachment."},{"name":"WON_NBDY_ATTACH","description":"You won lots of money! See attachment."},{"name":"LOTTO_AGENT","description":"Claims Agent"},{"name":"LOTTO_DEPT","description":"Claims Department"},{"name":"LOTTO_URI","description":"Claims Department URL"},{"name":"LOTTO_AGENT_FM","description":"Claims Agent"},{"name":"LOTTO_AGENT_RPLY","description":"Claims Agent"},{"name":"MONEY_LOTTERY","description":"Lots of money from a lottery"},{"name":"SHARE_50_50","description":"Share the money 50/50"},{"name":"EMRCP","description":"\"Excess Maximum Return Capital Profit\" scam"},{"name":"LUCRATIVE","description":"Make lots of money!"},{"name":"MONEY_PERCENT","description":"X% of a lot of money for you"},{"name":"MONEY_DEAL","description":"Lots of money in a suspicious deal"},{"name":"MONEY_ATM_CARD","description":"Lots of money on an ATM card"},{"name":"YOU_INHERIT","description":"Discussing your inheritance"},{"name":"DECEASED_NO_ML","description":"Dead not via mailing list"},{"name":"XFER_LOTSA_MONEY","description":"Transfer a lot of money"},{"name":"MONEY_BARRISTER","description":"Lots of money from a UK lawyer"},{"name":"UN_NO_ML","description":"United Nations not via mailing list"},{"name":"COMPENSATION","description":"\"Compensation\""},{"name":"MONEY_FRAUD_BOX","description":"Lots of money in a box, lots of money from a fox"},{"name":"DEAR_BENEFICIARY","description":"Dear Beneficiary:"},{"name":"YOUR_PERMISSION","description":"With your permission..."},{"name":"RISK_FREE","description":"No risk!"},{"name":"MONEY_FRAUD","description":"Lots of money and a fraud phrase"},{"name":"MONEY_FRAUD_3","description":"Lots of money and several fraud phrases"},{"name":"MONEY_FRAUD_5","description":"Lots of money and many fraud phrases"},{"name":"MONEY_FRAUD_8","description":"Lots of money and very many fraud phrases"},{"name":"FORM_FRAUD","description":"Fill a form and a fraud phrase"},{"name":"FORM_FRAUD_3","description":"Fill a form and several fraud phrases"},{"name":"FORM_FRAUD_5","description":"Fill a form and many fraud phrases"},{"name":"KHOP_BSD_REPORT","description":"Regular run output from a BSD system"},{"name":"KHOP_LOGWATCH_REPORT","description":"System report from LogWatch"},{"name":"KHOP_ENCRYPTED_CONTENT","description":"Message is encrypted"},{"name":"KHOP_PGP_INLINE","description":"BODY: Contains PGP data"},{"name":"KHOP_PGP_SIGNED","description":"Message seems to contain PGP signature"},{"name":"KHOP_SMIME_SIGNED","description":"Message seems to contain S/MIME signature"},{"name":"KHOP_THREADED","description":"Message references or replies to another message"},{"name":"APOSTROPHE_FROM","description":"From address contains an apostrophe"},{"name":"APOSTROPHE_TOCC","description":"To or CC address contains an apostrophe"},{"name":"STUDDLYCAPS","description":"ContainsThreeWordsLikeThis"},{"name":"GB_HIDDEN_WORD","description":"hidden word"},{"name":"GB_HIDDEN_FONT","description":"hidden font"},{"name":"GB_YELLOW_BG","description":"Yellow background on few words"},{"name":"URI_OBFU_WWW","description":"Obfuscated URI"},{"name":"URI_OBFU_PROTO","description":"URI http protocol with space obfuscation"},{"name":"URI_OBFU_TLD","description":"URI top-level domain with space obfuscation"},{"name":"URI_DEOBFU_INSTR","description":"How to deobfuscate this URI"},{"name":"__KAM_BODY_LENGTH_LT_128","description":"The length of the body of the email is less than 128 bytes."},{"name":"__KAM_BODY_LENGTH_LT_256","description":"The length of the body of the email is less than 256 bytes."},{"name":"__KAM_BODY_LENGTH_LT_512","description":"The length of the body of the email is less than 512 bytes."},{"name":"__KAM_BODY_LENGTH_LT_1024","description":"The length of the body of the email is less than 1024 bytes."},{"name":"TT_OBSCURED_VIAGRA","description":"Scora: obscured \"VIAGRA\" in subject"},{"name":"TT_OBSCURED_XANAX","description":"Scora: obscured \"XANAX\" in subject"},{"name":"TT_OBSCURED_VALIUM","description":"Scora: obscured \"VALIUM\" in subject"},{"name":"RCVD_IN_UCEPROTECT_L1","description":"Listed in dnsbl-1.uceprotect.net."},{"name":"FROM_GOV_SPOOF","description":"From Government domain but matches SPOOFED"},{"name":"FROM_GOV_DKIM_AU","description":"From Government address and DKIM signed"},{"name":"FROM_GOV_REPLYTO_FREEMAIL","description":"From Government domain but ReplyTo is FREEMAIL"},{"name":"MAY_BE_FORGED","description":"Relay IP's reverse DNS does not resolve to IP"},{"name":"DEAR_EMAIL","description":"Message contains Dear email address"},{"name":"DEAR_NOBODY","description":"Message contains Dear but with no name"},{"name":"FORGED_URL_DOM","description":"Link domain has a TLD as a subdomain"},{"name":"FROM_WWW","description":"Sender name appears to be a website"},{"name":"LOOPHOLE_1","description":"A loop hole in the banking laws?"},{"name":"BANKING_LAWS","description":"Talks about banking laws"},{"name":"AJB_CANPOST_BADLINK","description":"Found a mismatch between href and anchored text pretending to link to www.canadapost.ca"},{"name":"AJB_UTUBE_BADLINK","description":"Found a mismatch between href and anchored text pretending to link to www.youtube.com"},{"name":"AJB_FK_UTUBE_BOTNET","description":"mismatch between href and anchored + empty subject = botnet"},{"name":"RCVD_IN_RP_CERTIFIED","description":"Sender in ReturnPath Certified - Contact cert-sa@returnpath.net"},{"name":"RCVD_IN_RP_SAFE","description":"Sender in ReturnPath Safe - Contact safe-sa@returnpath.net"},{"name":"RCVD_IN_RP_RNBL","description":"Relay in RNBL, https://senderscore.org/blacklistlookup/"},{"name":"GB_FREEMAIL_DISPTO","description":"Disposition-Notification-To/From or Disposition-Notification-To/body contain different freemails"},{"name":"GB_FREEMAIL_DISPTO_NOTFREEM","description":"Disposition-Notification-To/From contain different freemails but mailfrom is not a freemail"},{"name":"GB_FREEM_FROM_NOT_REPLY","description":"From: and Reply-To: have different freemail domains"},{"name":"GOOGLE_DRIVE_DEAR_SOMETHING","description":"From Google Drive and generic Dear (something)"},{"name":"SHORT_BODY_G_DRIVE_DYN","description":"Short body with Google Drive link and dynamic looking sender"},{"name":"FROM_NAME_EQ_TO_G_DRIVE","description":"From:name equals To:addr and GDRIVE link"},{"name":"MILLION_USD","description":"Talks about millions of dollars"},{"name":"NA_DOLLARS","description":"Talks about a million North American dollars"},{"name":"US_DOLLARS_3","description":"Mentions millions of $ ($NN,NNN,NNN.NN)"},{"name":"CK_HELO_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"CK_HELO_GENERIC","description":"Relay used name indicative of a Dynamic Pool or Generic rPTR"},{"name":"HELO_MISC_IP","description":"Looking for more Dynamic IP Relays"},{"name":"PDS_HELO_SPF_FAIL","description":"High profile HELO that fails SPF"},{"name":"PDS_HP_HELO_NORDNS","description":"High profile HELO with no sender rDNS"},{"name":"GB_FORGED_MUA_TBIRD","description":"Forged Thunderbird Mua"},{"name":"GB_FORGED_MUA_POSTFIX","description":"Forged Postfix mua headers"},{"name":"NOT_A_PERSON","description":"List, replier, bot, etc.  Filters: skip auto-reply"},{"name":"KHOP_UNSUB_LINK","description":"Personal message has unsusbscribe link"},{"name":"KHOP_UNSUB_EMAIL","description":"Unsubscribe by email but not by link"},{"name":"KHOP_NO_FULL_NAME","description":"Sender does not have both First and Last names"},{"name":"OPERA_MID_NO_DIGIT","description":"MUA Opera, Message-Id does not contain digit"},{"name":"OPERA_MID_NON_OP","description":"MUA Opera, Message-Id does not start with op"},{"name":"OPERA_MID_BAD_MASK","description":"MUA Opera, bad Message-Id mask"},{"name":"KB_CTYPE_SP_MOZ","description":"Mozilla does not do that, I hope"},{"name":"KB_FORGED_MOZ4","description":"Mozilla 4 uses X-Mailer"},{"name":"FROM_PAYPAL_SPOOF","description":"From PayPal domain but matches SPOOFED"},{"name":"FROM_PAYPAL_REPLYTO_FREEMAIL","description":"From PayPal domain but ReplyTo is FREEMAIL"},{"name":"FROM_BANK_NOAUTH","description":"From Bank domain but no SPF or DKIM"},{"name":"AXB_XMAILER_MIMEOLE_OL_024C2","description":"Yet another X header trait"},{"name":"AXB_XMAILER_MIMEOLE_OL_1ECD5","description":"Yet another X header trait"},{"name":"FROMNAME_SPOOFED_EMAIL","description":"From:name looks like a spoofed email"},{"name":"FROMNAME_EQUALS_TO","description":"From:name matches To:"},{"name":"KHOP_SC_CIDR8","description":"Relay CIDR /8 is among worst in SpamCop"},{"name":"KHOP_SC_TOP_CIDR8","description":"Relay CIDR /8 leads SpamCop in worst /8s"},{"name":"KHOP_SC_CIDR16","description":"Relay CIDR /16 is among worst in SpamCop"},{"name":"KHOP_SC_TOP_CIDR16","description":"Relay CIDR /16 leads SpamCop in worst /16s"},{"name":"KHOP_SC_CIDR24","description":"Relay CIDR /24 is among worst in SpamCop"},{"name":"KHOP_SC_TOP_CIDR24","description":"Relay CIDR /24 leads SpamCop in worst /24s"},{"name":"KHOP_SC_TOP200","description":"Relay listed in SpamCop top 200 spammer IPs"},{"name":"KHOP_SPAMHAUS_DROP","description":"Relay listed in Spamhaus Don't Route Or Peer List"},{"name":"KHOP_SPAMHAUS_DROP_LE","description":"Relay listed in Spamhaus Don't Route Or Peer List"},{"name":"KHOP_PSBL_CIDR24","description":"Relay's IP/24 CIDR contains many PSBL hits"},{"name":"EXCUSE_24","description":"Claims you wanted this ad"},{"name":"USING_VERP","description":"Message uses VERP"},{"name":"EXCUSE_24","description":"Claims you wanted this ad"},{"name":"USING_VERP","description":"Message uses VERP"},{"name":"PP_TOO_MUCH_UNICODE05","description":"Is text/plain but has many unicode escapes"},{"name":"PP_TOO_MUCH_UNICODE02","description":"Is text/plain but has many unicode escapes"},{"name":"SPOOFED_URL_HOST","description":"Has a link whose text is URL with a different host"},{"name":"COMPUTERS_JEWELRY","description":"Selling computers, jewelry, etc."},{"name":"MIME_NO_TEXT","description":"No (properly identified) text body parts"},{"name":"MIME_PHP_NO_TEXT","description":"No text body parts, X-Mailer: PHP"},{"name":"X_URIBL_IPSONLY","description":"X_URIBL_IPSONLY"},{"name":"X_URIBL_DOMSONLY","description":"X_URIBL_DOMSONLY"},{"name":"FILL_THIS_FORM_LONG","description":"Fill in a form with personal information"},{"name":"FILL_THIS_FORM","description":"Fill in a form with personal information"},{"name":"FILL_THIS_FORM_SHORT","description":"Fill in a short form with personal information"},{"name":"FILL_THIS_FORM_LOAN","description":"Answer loan question(s)"},{"name":"FILL_THIS_FORM_FRAUD_PHISH","description":"Answer suspicious question(s)"},{"name":"TVD_PH_SEC","description":"Message includes a phrase commonly used in phishing mails"},{"name":"TVD_PH_REC","description":"Message includes a phrase commonly used in phishing mails"},{"name":"TVD_SUBJ_ACC_NUM","description":"Subject has spammy looking monetary reference"},{"name":"T_LOCAL_PP_UPD_BADURL","description":"paypal account update, but has bad URL"},{"name":"TVD_PH_SUBJ_META1","description":"Email has a Phishy looking subject line"},{"name":"TVD_PH_BODY_ACCOUNTS_PRE","description":"The body matches phrases such as \"accounts suspended\", \"account credited\", \"account verification\""},{"name":"DSN_NO_MIMEVERSION","description":"Return-Path <> and no MIME-Version: header"},{"name":"DSN_NO_MIMEVERSION","description":"Return-Path <> and no MIME-Version: header"},{"name":"FREEMAIL_FORGED_FROMDOMAIN","description":"2nd level domains in From and EnvelopeFrom freemail headers are different"},{"name":"HEADER_FROM_DIFFERENT_DOMAINS","description":"From and EnvelopeFrom 2nd level mail domains are different"},{"name":"MILLION_EUR","description":"Talks about millions of euros"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF_01","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1","description":"Outbound Index stability value of 1"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF_01","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1","description":"Outbound Index stability value of 1"},{"name":"SIQ_EX_STAB_20","description":"Example Service stability value of 20 to 29"},{"name":"FROMSPACE","description":"Idiosyncratic \"From\" header format"},{"name":"RCVD_IN_NIX_SPAM","description":"Received via a relay in NiX Spam (heise.de)"},{"name":"DNSBL_INDIRECT","description":"Received indirectly through a relay in a DNSBL"},{"name":"DNSBL_INDIRECT_UNSAFE","description":"Received ~indirectly through a relay in a DNSBL"},{"name":"DNSBL_INDIRECT_UNSAFE_2","description":"Received ~indirectly through a relay in 2+ DNSBLs"},{"name":"FROM_ADDR_BCDE","description":"Alternating random address, BCDE"},{"name":"RW_BOGUS_RCVD_AMAVIS","description":"Contains bogus amavisd-new rcvd header"},{"name":"T_BUG5920_X_IP","description":"Message has X-IP header"},{"name":"CACHEREDIR","description":"URI pointing at Google cache"},{"name":"GB_WP_FILELINK","description":"try to abuse file_links uris in Wordpress emails"},{"name":"T_UPPERCASE_HTTP","description":"URI with an uppercase character in the ScHeMe"},{"name":"LT_ANY_CHARS","description":"Header contains characters"},{"name":"T_URIBL_RHS_AHBL","description":"Contains an URI listed in rhsbl.ahbl.org."},{"name":"RCVD_IN_PSBL","description":"Received via a relay in PSBL"},{"name":"RCVD_IN_TIOPAN_BL","description":"Received from an IP listed in Tiopan Blacklist"},{"name":"URIBL_RHS_DOB","description":"Contains an URI of a new domain (Day Old Bread)"},{"name":"T_EMPTY_FROM_OR_TO_OR_CC","description":"Contains a header field that is blank and shouldn't be."},{"name":"BITCOIN_SPF_ONLYALL","description":"Bitcoin from a domain specifically set to pass +all SPF"},{"name":"RCVD_IN_BRBL","description":"Received via a relay in Barracuda BRBL"},{"name":"RP_MATCHES_RCVD","description":"Envelope sender domain matches handover relay domain"},{"name":"RCVD_IN_UBL","description":"Relay listed in UBL http://www.lashback.com/support/UnsubscribeBlacklistSupport.aspx"},{"name":"URI_PHISHING","description":"Url match phishing in feed"},{"name":"AUTOLEARNTEST_FROM_HEADER","description":"Test rule for Autolearning "},{"name":"CTE_8BIT_MISMATCH","description":"Header says 7bits but body disagrees"},{"name":"FROM_SPACE_COMMA","description":"Distinctive syntax error in from address"},{"name":"MIXED_ES","description":"Too many es are not es"},{"name":"HASHBL_EMAIL","description":"Message contains email address found on EBL"},{"name":"HASHBL_OSENDR","description":"Message contains email address found on HASHBL"},{"name":"HASHBL_BTC","description":"Message contains BTC address found on BTCBL"},{"name":"HASHBL_URI","description":"Message contains uri found on rbl"},{"name":"HASHBL_EMAIL","description":"Message contains email address found on EBL"},{"name":"OLEMACRO","description":"Attachment has an Office Macro"},{"name":"OLEMACRO_MALICE","description":"Potentially malicious Office Macro"},{"name":"OLEMACRO_ENCRYPTED","description":"Has an Office doc that is encrypted"},{"name":"OLEMACRO_RENAME","description":"Has an Office doc that has been renamed"},{"name":"OLEMACRO_ZIP_PW","description":"Has an Office doc that is password protected in a zip"},{"name":"OLEMACRO_CSV","description":"Malicious csv file that tries to exec cmd.exe detected"},{"name":"OLEMACRO_DOWNLOAD_EXE","description":"Malicious code inside the Office doc that tries to download a .exe file detected"},{"name":"VULN_PHPMAILER","description":"Mail sent from a vulnerable version of PHPMailer"},{"name":"PP_MIME_FAKE_ASCII_TEXT","description":"MIME text/plain claims to be ASCII but isn't"},{"name":"MSGID_MULTIPLE_AT","description":"Message-ID contains multiple '@' characters"},{"name":"KAM_HTML_FONT_INVALID","description":"Test for Invalidly Named or Formatted Colors in HTML"},{"name":"BILLION_OVERLAP","description":"Reducing score for overlap of similar rules "},{"name":"AC_HTML_NONSENSE_TAGS","description":"Many consecutive multi-letter HTML tags, likely nonsense/spam"},{"name":"KAM_BLOCK_UTF7","description":"Poison pill rule to block UTF-7 encoded e-mail"},{"name":"KAM_MX","description":"Odd prevalence of mx records associated with the COMPANY3 Spammers"},{"name":"KAM_PHISH1","description":"Test for PHISH that changes the cursor"},{"name":"PYZOR_CHECK","description":"Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)"},{"name":"T_OUTDATED_PHP","description":"Mail sent from an outdated PHP version"},{"name":"URIBL_DYNAMIC_MPRHS","description":"Contains a URL listed in the MailPolice dynamic domains list"},{"name":"DKIM_SIGNED","description":"Message has a DKIM or DK signature, not necessarily valid"},{"name":"DKIM_VALID","description":"Message has at least one valid DKIM or DK signature"},{"name":"DKIM_VALID_AU","description":"Message has a valid DKIM or DK signature from author's domain"},{"name":"DKIM_VALID_EF","description":"Message has a valid DKIM or DK signature from envelope-from domain"},{"name":"__DKIM_DEPENDABLE","description":"A validation failure not attributable to truncation"},{"name":"DKIM_ADSP_NXDOMAIN","description":"Domain not in DNS and no valid author domain signature"},{"name":"DKIM_ADSP_ALL","description":"Domain signs all mail, no valid author domain signature"},{"name":"DKIM_ADSP_DISCARD","description":"Domain signs all mail and suggests discarding mail with no valid author domain signature, no valid author domain signature"},{"name":"DKIM_ADSP_CUSTOM_LOW","description":"adsp_override is CUSTOM_LOW, no valid author domain signature"},{"name":"DKIM_ADSP_CUSTOM_MED","description":"adsp_override is CUSTOM_MED, no valid author domain signature"},{"name":"DKIM_ADSP_CUSTOM_HIGH","description":"adsp_override is CUSTOM_HIGH, no valid author domain signature"},{"name":"DRUGS_ERECTILE_SHORT_SHORTNER","description":"Short erectile drugs advert with URL_SHORTENER"},{"name":"XPRIO_URL_SHORTNER","description":"X-Priority header and short URL"},{"name":"SHORT_SHORTNER","description":"Short body with little more than a link to a shortener"},{"name":"PDS_TINYSUBJ_URISHRT","description":"Short subject with URL shortener"},{"name":"PDS_EMPTYSUBJ_URISHRT","description":"Empty subject with little more than URI shortener "},{"name":"PDS_SHORTFWD_URISHRT","description":"Threaded email with URI shortener"},{"name":"PDS_FREEMAIL_REPLYTO_URISHRT","description":"Freemail replyto with URI shortener"},{"name":"TONOM_EQ_TOLOC_SHRT_SHRTNER","description":"Short email with shortener and To:name eq To:local"},{"name":"TONOM_EQ_TOLOC_SHRT_PSHRTNER","description":"Short subject with potential shortener and To:name eq To:local"},{"name":"PDS_SHORT_SPOOFED_URL","description":"HTML message short and SPOOFED_URL (S_U_FP)"},{"name":"PDS_NO_FULL_NAME_SPOOFED_URL","description":"HTML message short, SPOOFED_URL and KHOP_NO_FULL_NAME"},{"name":"KHOP_ISC","description":"Received through an IP in the ISC top 100 attackers"},{"name":"KHOP_ISC_LE","description":"Received through an IP in the ISC top 100 attackers"},{"name":"KHOP_DYNAMIC","description":"Relay looks like a dynamic address"},{"name":"KHOP_DYNAMIC2","description":"Relay looks like a dynamic address"},{"name":"VANITY","description":"Vanity or fake awards"},{"name":"ACCESSDB","description":"Message would have been caught by accessdb"},{"name":"SMF_HAS_SHORT_URI","description":"Message contains shortened URI"},{"name":"VIAGRA_OBFU","description":"Attempt to obfuscate \"viagra\""},{"name":"NICE_REPLY_A","description":"Looks like a legit reply (A)"},{"name":"TEST","description":"test rule that scores barely over spam threshold"},{"name":"URI_PHISHING","description":"Url match phishing in feed"},{"name":"FROMNAME_SPOOF_EQUALS_TO","description":"From:name is spoof to look like To: address"},{"name":"PARA_A_2_C_OF_1618","description":"Claims compliance with senate bill 1618"},{"name":"FROM_HAS_MIXED_NUMS","description":"From: contains numbers mixed in with letters"},{"name":"__KAM_COUNT_URIS","description":"A multiple match used to count URIs in a message"},{"name":"RBL_IP","description":"From address associated with spam domains"},{"name":"AWL","description":"From: address is in the auto white-list"},{"name":"URIBL_SBLXBL","description":"Contains a URL listed in the SBL/XBL blocklist"},{"name":"TXREP","description":"Score normalizing based on sender's reputation"},{"name":"URIBL_SBL","description":"Contains an URL's NS IP listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS","description":"Contains an URL's NS IP listed in the Spamhaus CSS blocklist"},{"name":"URIBL_SBL_A","description":"Contains URL's A record listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS_A","description":"Contains URL's A record listed in the Spamhaus CSS blocklist"},{"name":"URIBL_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_DBL_SPAM","description":"Contains a spam URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_PHISH","description":"Contains a Phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_MALWARE","description":"Contains a malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_BOTNETCC","description":"Contains a botned C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_SPAM","description":"Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_REDIR","description":"Contains an abused redirector URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_PHISH","description":"Contains an abused phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_MALW","description":"Contains an abused malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_BOTCC","description":"Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ERROR","description":"Error: queried the Spamhaus DBL blocklist for an IP"},{"name":"URIBL_DBL_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_DBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_SC_SURBL","description":"Contains an URL listed in the SC SURBL blocklist"},{"name":"URIBL_WS_SURBL","description":"Contains an URL listed in the WS SURBL blocklist"},{"name":"URIBL_PH_SURBL","description":"Contains an URL listed in the PH SURBL blocklist"},{"name":"URIBL_MW_SURBL","description":"Contains a URL listed in the MW SURBL blocklist"},{"name":"URIBL_CR_SURBL","description":"Contains an URL listed in the CR SURBL blocklist"},{"name":"URIBL_AB_SURBL","description":"Contains an URL listed in the AB SURBL blocklist"},{"name":"URIBL_ABUSE_SURBL","description":"Contains an URL listed in the ABUSE SURBL blocklist"},{"name":"SURBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to SURBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"URIBL_BLACK","description":"Contains an URL listed in the URIBL blacklist"},{"name":"URIBL_GREY","description":"Contains an URL listed in the URIBL greylist"},{"name":"URIBL_RED","description":"Contains an URL listed in the URIBL redlist"},{"name":"URIBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to URIBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"T_DKIM_INVALID","description":"DKIM-Signature header exists but is not valid"},{"name":"T_KAM_HTML_FONT_INVALID","description":"Test for Invalidly Named or Formatted"},{"name":"RCVD_IN_BRBL_LASTEXT","description":"Last external is listed in Barracuda RBL bb.barracudacentral.org"},{"name":"RCPT_MAILCOW_DOMAIN","description":"Recipient domain is registered in mailcow"},{"name":"RBL_UCEPROTECT_LEVEL1","description":"Unrecognised result from SORBS RBL"},{"name":"RBL_SORBS_HTTP","description":"List of Open HTTP Proxy Servers."},{"name":"RBL_SORBS_SOCKS","description":"List of Open SOCKS Proxy Servers."},{"name":"RBL_SORBS_MISC","description":"List of open Proxy Servers not listed in the SOCKS or HTTP lists."},{"name":"RBL_SORBS_SMTP","description":"List of Open SMTP relay servers."},{"name":"RBL_SORBS_RECENT","description":"List of hosts that have been noted as sending spam/UCE/UBE to the admins of SORBS within the last 28 days (includes new.spam.dnsbl.sorbs.net)."},{"name":"RBL_SORBS_WEB","description":"List of web (WWW) servers which have spammer abusable vulnerabilities (e.g. FormMail scripts)"},{"name":"RBL_SORBS_DUL","description":"Dynamic IP Address ranges (NOT a Dial Up list!)"},{"name":"RBL_SORBS_BLOCK","description":"List of hosts demanding that they never be tested by SORBS."},{"name":"RBL_SORBS_ZOMBIE","description":"List of networks hijacked from their original owners, some of which have already used for spamming."},{"name":"RECEIVED_SPAMHAUS_XBL","description":"Received address is listed in ZEN XBL"},{"name":"R_DKIM_NA","description":"Authenticating message via DKIM not possible"},{"name":"MID_BARE_IP","description":"Message-ID RHS is a bare IP address"},{"name":"MID_RHS_NOT_FQDN","description":"Message-ID RHS is not a fully-qualified domain name"},{"name":"MID_MISSING_BRACKETS","description":"Message-ID is missing <>'s"},{"name":"MID_RHS_IP_LITERAL","description":"Message-ID RHS is an IP-literal"},{"name":"MID_CONTAINS_FROM","description":"Message-ID contains From address"},{"name":"MID_RHS_MATCH_FROM","description":"Message-ID RHS matches From domain"},{"name":"MID_CONTAINS_TO","description":"Message-ID contains To address"},{"name":"MID_RHS_MATCH_TO","description":"Message-ID RHS matches To domain"},{"name":"REPLY","description":"Message is a reply"},{"name":"REPLY","description":"Message is a reply"},{"name":"R_SUSPICIOUS_URL","description":"Obfusicated or suspicious URL has been found in a message"},{"name":"ZERO_WIDTH_SPACE_URL","description":"Zero width space in url"},{"name":"RCVD_TLS_ALL","description":"All hops used encrypted transports"},{"name":"RCVD_TLS_LAST","description":"Last hop used encrypted transports"},{"name":"RCVD_NO_TLS_LAST","description":"Last hop did not use encrypted transports"},{"name":"RCVD_VIA_SMTP_AUTH","description":"Authenticated hand-off was seen in Received headers"},{"name":"FREEMAIL_REPLYTO_NEQ_FROM_DOM","description":"Freemail From and Reply-To, but to different Freemail services"},{"name":"EMAIL_PLUS_ALIASES","description":"Removes plus aliases from the email"},{"name":"TAGGED_RCPT","description":"SMTP recipients have plus tags"},{"name":"TAGGED_FROM","description":"SMTP from has plus tags"},{"name":"SPOOF_DISPLAY_NAME","description":"Display name is being used to spoof and trick the recipient"},{"name":"FROM_NEQ_DISPLAY_NAME","description":"Display name contains an email address different to the From address"},{"name":"BOGUS_ENCRYPTED_AND_TEXT","description":"Bogus mix of encrypted and text/html payloads"},{"name":"ENCRYPTED_PGP","description":"Message is encrypted with pgp"},{"name":"ENCRYPTED_SMIME","description":"Message is encrypted with smime"},{"name":"SIGNED_PGP","description":"Message is signed with pgp"},{"name":"SIGNED_SMIME","description":"Message is signed with smime"},{"name":"RCVD_COUNT_ZERO","description":"Message has no Received headers"},{"name":"RCVD_COUNT_ONE","description":"Message has one Received header"},{"name":"RCVD_COUNT_TWO","description":"Message has two Received headers"},{"name":"RCVD_COUNT_THREE","description":"Message has 3-5 Received headers"},{"name":"RCVD_COUNT_FIVE","description":"Message has 5-7 Received headers"},{"name":"RCVD_COUNT_SEVEN","description":"Message has 7-11 Received headers"},{"name":"RCVD_COUNT_TWELVE","description":"Message has 12 or more Received headers"},{"name":"HAS_X_PRIO","description":"X-Priority check callback rule"},{"name":"HAS_X_PRIO_ZERO","description":"Message has X-Priority header set to 0"},{"name":"HAS_X_PRIO_ONE","description":"Message has X-Priority header set to 1"},{"name":"HAS_X_PRIO_TWO","description":"Message has X-Priority header set to 2"},{"name":"HAS_X_PRIO_THREE","description":"Message has X-Priority header set to 3 or 4"},{"name":"HAS_X_PRIO_FIVE","description":"Message has X-Priority header set to 5 or higher"},{"name":"REPLYTO_UNPARSEABLE","description":"Reply-To header could not be parsed"},{"name":"HAS_REPLYTO","description":"Has Reply-To header"},{"name":"REPLYTO_EQ_FROM","description":"Reply-To header is identical to From header"},{"name":"REPLYTO_ADDR_EQ_FROM","description":"Reply-To header is identical to SMTP From"},{"name":"REPLYTO_DOM_EQ_FROM_DOM","description":"Reply-To domain matches the From domain"},{"name":"REPLYTO_DOM_NEQ_FROM_DOM","description":"Reply-To domain does not match the From domain"},{"name":"REPLYTO_DN_EQ_FROM_DN","description":"Reply-To display name matches From"},{"name":"REPLYTO_EMAIL_HAS_TITLE","description":"Reply-To header has title"},{"name":"REPLYTO_EQ_TO_ADDR","description":"Reply-To is the same as the To address"},{"name":"MISSING_MIME_VERSION","description":"MIME-Version header is missing in MIME message"},{"name":"MIME_MA_MISSING_TEXT","description":"MIME multipart/alternative missing text/plain part"},{"name":"MIME_MA_MISSING_HTML","description":"MIME multipart/alternative missing text/html part"},{"name":"ENVFROM_INVALID","description":"Envelope from does not have a valid format"},{"name":"FROM_INVALID","description":"From header does not have a valid format"},{"name":"FROM_NO_DN","description":"From header does not have a display name"},{"name":"FROM_DN_EQ_ADDR","description":"From header display name is the same as the address"},{"name":"FROM_HAS_DN","description":"From header has a display name"},{"name":"FROM_NAME_EXCESS_SPACE","description":"From header display name contains excess whitespace"},{"name":"FROM_NAME_HAS_TITLE","description":"From header display name has a title (Mr/Mrs/Dr)"},{"name":"FROM_EQ_ENVFROM","description":"From address is the same as the envelope"},{"name":"FROM_NEQ_ENVFROM","description":"From address is different to the envelope"},{"name":"TO_EQ_FROM","description":"To address matches the From address"},{"name":"TO_DOM_EQ_FROM_DOM","description":"To domain is the same as the From domain"},{"name":"RCPT_COUNT_ZERO","description":"No recipients"},{"name":"RCPT_COUNT_ONE","description":"One recipient"},{"name":"RCPT_COUNT_TWO","description":"Two recipients"},{"name":"RCPT_COUNT_THREE","description":"3-5 recipients"},{"name":"RCPT_COUNT_FIVE","description":"5-7 recipients"},{"name":"RCPT_COUNT_SEVEN","description":"7-11 recipients"},{"name":"RCPT_COUNT_TWELVE","description":"12-50 recipients"},{"name":"RCPT_COUNT_GT_50","description":"50+ recipients"},{"name":"TO_DN_RECIPIENTS","description":"To header display name is \"Recipients\""},{"name":"TO_DN_NONE","description":"None of the recipients have display names"},{"name":"TO_DN_ALL","description":"All the recipients have display names"},{"name":"TO_DN_SOME","description":"Some of the recipients have display names"},{"name":"TO_DN_EQ_ADDR_ALL","description":"All of the recipients have display names that are the same as their address"},{"name":"TO_DN_EQ_ADDR_SOME","description":"Some of the recipients have display names that are the same as their address"},{"name":"TO_MATCH_ENVRCPT_ALL","description":"All of the recipients match the envelope"},{"name":"TO_MATCH_ENVRCPT_SOME","description":"Some of the recipients match the envelope"},{"name":"BAD_WORDS","description":"Contains bad words"},{"name":"BAD_WORDS_DE","description":"Contains bad German words"},{"name":"VIRUS_FOUND","description":"YYYYY"},{"name":"SOGO_CONTACT_EXCLUDE_FWD_HOST","description":"Sender is a registered SOGo contact and the forward host is whitelisted"},{"name":"SOGO_CONTACT_SPOOFED","description":"Spoofed SOGo contact (SPF fail)"},{"name":"SOGO_CONTACT","description":"Sender is a registered SOGo contact"},{"name":"BULK_HEADER","description":"Contains bulk mail keywords in header"},{"name":"IP_SCORE","description":"IP reputation"},{"name":"R_SPF_NA","description":"Authenticating message via SPF not possible"},{"name":"FORGED_W_BAD_POLICY","description":"Forged sender and authentication via SPF/DKIM/DMARC/ARC not possible"},{"name":"FROM_NOT_REPLYTO","description":"From does not match Reply-To"},{"name":"FROM_NOT_REPLYTO_SAME_DOMAIN","description":"From domain does not match Reply-To domain"},{"name":"FROM_NOT_REPLYTO_WHITELIST","description":"From and Reply-To Whitelisted"}]
\ No newline at end of file
+const rspamdSymbols = [{"name":"BITCOIN_ADDR","description":"Message has a valid bitcoin wallet address"},{"name":"SUBJ_BOUNCE_WORDS","description":"Words/phrases typical for DNS"},{"name":"BOUNCE","description":"(Non) Delivery Status Notification"},{"name":"SPECIFIC_CONTENT_CHECK","description":"Message was forwarded by Google"},{"name":"FWD_YANDEX","description":"Message was forwarded by Yandex"},{"name":"FWD_MAILRU","description":"Message was forwarded by Mail.ru"},{"name":"FWD_SRS","description":"Message was forwarded using Sender Rewriting Scheme (SRS)"},{"name":"FORWARDED","description":"Message was forwarded"},{"name":"CHECK_RECEIVED","description":"Message has no Received headers"},{"name":"RCVD_COUNT_ZERO","description":"Message has no Received header"},{"name":"RCVD_COUNT_ONE","description":"Message has one Received header"},{"name":"RCVD_COUNT_TWO","description":"Message has two Received headers"},{"name":"RCVD_COUNT_THREE","description":"Message has 3-5 Received headers"},{"name":"RCVD_COUNT_FIVE","description":"Message has 5-7 Received headers"},{"name":"RCVD_COUNT_SEVEN","description":"Message has 7-11 Received headers"},{"name":"RCVD_COUNT_TWELVE","description":"Message has 12 or more Received headers"},{"name":"HAS_X_PRIO","description":"X-Priority check callback rule"},{"name":"HAS_X_PRIO_ZERO","description":"Message has X-Priority header set to 0"},{"name":"HAS_X_PRIO_ONE","description":"Message has X-Priority header set to 1"},{"name":"HAS_X_PRIO_TWO","description":"Message has X-Priority header set to 2"},{"name":"HAS_X_PRIO_THREE","description":"Message has X-Priority header set to 3 or 4"},{"name":"HAS_X_PRIO_FIVE","description":"Message has X-Priority header set to 5 or higher"},{"name":"CHECK_REPLYTO","description":"Reply-To header could not be parsed"},{"name":"HAS_REPLYTO","description":"Has Reply-To header"},{"name":"REPLYTO_EQ_FROM","description":"Reply-To header is identical to From header"},{"name":"REPLYTO_ADDR_EQ_FROM","description":"Reply-To header is identical to SMTP From"},{"name":"REPLYTO_DOM_EQ_FROM_DOM","description":"Reply-To domain matches the From domain"},{"name":"REPLYTO_DOM_NEQ_FROM_DOM","description":"Reply-To domain does not match the From domain"},{"name":"REPLYTO_DN_EQ_FROM_DN","description":"Reply-To display name matches From"},{"name":"REPLYTO_EMAIL_HAS_TITLE","description":"Reply-To header has title"},{"name":"REPLYTO_EQ_TO_ADDR","description":"Reply-To is the same as the To address"},{"name":"CHECK_MIME","description":"MIME-Version header is missing in MIME message"},{"name":"MIME_MA_MISSING_TEXT","description":"MIME multipart/alternative missing text/plain part"},{"name":"MIME_MA_MISSING_HTML","description":"MIME multipart/alternative missing text/html part"},{"name":"PREVIOUSLY_DELIVERED","description":"Message either to a list or was forwarded"},{"name":"BROKEN_HEADERS","description":"Headers structure is likely broken"},{"name":"BROKEN_CONTENT_TYPE","description":"Message has part with broken content type"},{"name":"HEADER_RCONFIRM_MISMATCH","description":"Read confirmation address is different to from address"},{"name":"HEADER_FORGED_MDN","description":"Read confirmation address is different to return path"},{"name":"MULTIPLE_UNIQUE_HEADERS","description":"Repeated unique headers"},{"name":"MISSING_FROM","description":"Missing From: header"},{"name":"MULTIPLE_FROM","description":"Multiple addresses in From"},{"name":"MV_CASE","description":"Mime-Version .vs. MIME-Version"},{"name":"FAKE_REPLY","description":"Fake reply"},{"name":"FREEMAIL_ENVFROM","description":"Envelope From is a Freemail address"},{"name":"FREEMAIL_ENVRCPT","description":"Envelope Recipient is a Freemail address"},{"name":"FREEMAIL_FROM","description":"From is a Freemail address"},{"name":"FREEMAIL_TO","description":"To is a Freemail address"},{"name":"FREEMAIL_CC","description":"To is a Freemail address"},{"name":"FREEMAIL_REPLYTO","description":"Reply-To is a Freemail address"},{"name":"DISPOSABLE_ENVFROM","description":"Envelope From is a Disposable e-mail address"},{"name":"DISPOSABLE_ENVRCPT","description":"Envelope Recipient is a Disposable e-mail address"},{"name":"DISPOSABLE_FROM","description":"From a Disposable e-mail address"},{"name":"DISPOSABLE_TO","description":"To a disposable e-mail address"},{"name":"FORGED_RECIPIENTS_MAILLIST","description":"Forged sender, but message is forwarded"},{"name":"SPF_FAIL_FORWARDING","description":"From and Received address are listed in Spamhaus XBL"},{"name":"AUTH_NA","description":"Authenticating message via SPF/DKIM/DMARC/ARC not possible"},{"name":"DKIM_MIXED","description":"Message was sent by "},{"name":"HACKED_WP_PHISHING","description":"Phish message sent by hacked Wordpress instance"},{"name":"COMPROMISED_ACCT_BULK","description":"Likely to be from a compromised account"},{"name":"UNDISC_RCPTS_BULK","description":"Missing or undisclosed recipients with a bulk signature"},{"name":"RCVD_UNAUTH_PBL","description":"Relayed through ZEN PBL IP without sufficient authentication (possible indicating an open relay)"},{"name":"RCVD_DKIM_ARC_DNSWL_MED","description":"Sufficiently DKIM/ARC signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_HI","description":"Sufficiently DKIM/ARC signed and received from IP with high trust at DNSWL"},{"name":"AUTOGEN_PHP_SPAMMY","description":"Message was generated by PHP script and contains some spam indicators"},{"name":"PHISH_EMOTION","description":"Phish message with subject trying to address users emotion"},{"name":"HAS_ANON_DOMAIN","description":"Contains one or more domains trying to disguise owner/destination"},{"name":"BAD_REP_POLICIES","description":"Contains valid policies but are also marked by fuzzy/bayes/surbl/rbl"},{"name":"VIOLATED_DIRECT_SPF","description":"Has no Received (or no trusted received relays) and SPF policy fails or soft fails"},{"name":"IP_SCORE_FREEMAIL","description":"Negate IP_SCORE when message comes from FreeMail"},{"name":"BROKEN_HEADERS_MAILLIST","description":"Negate BROKEN_HEADERS when message comes via some mailing list"},{"name":"LEAKED_PASSWORD_SCAM","description":"Contains BTC wallet address and scam patterns"},{"name":"DISPOSABLE_CC","description":"To a disposable e-mail address"},{"name":"DISPOSABLE_REPLYTO","description":"Reply-To a disposable e-mail address"},{"name":"CHECK_FROM","description":"Envelope from does not have a valid format"},{"name":"FROM_INVALID","description":"From header does not have a valid format"},{"name":"FROM_NO_DN","description":"From header does not have a display name"},{"name":"FROM_DN_EQ_ADDR","description":"From header display name is the same as the address"},{"name":"FROM_HAS_DN","description":"From header has a display name"},{"name":"FROM_NAME_EXCESS_SPACE","description":"From header display name contains excess whitespace"},{"name":"FROM_NAME_HAS_TITLE","description":"From header display name has a title (Mr/Mrs/Dr)"},{"name":"FROM_EQ_ENVFROM","description":"From address is the same as the envelope"},{"name":"FROM_NEQ_ENVFROM","description":"From address is different to the envelope"},{"name":"TO_EQ_FROM","description":"To address matches the From address"},{"name":"TO_DOM_EQ_FROM_DOM","description":"To domain is the same as the From domain"},{"name":"CHECK_TO_CC","description":"No recipients"},{"name":"RCPT_COUNT_ONE","description":"One recipient"},{"name":"RCPT_COUNT_TWO","description":"Two recipients"},{"name":"RCPT_COUNT_THREE","description":"3-5 recipients"},{"name":"RCPT_COUNT_FIVE","description":"5-7 recipients"},{"name":"RCPT_COUNT_SEVEN","description":"7-11 recipients"},{"name":"RCPT_COUNT_TWELVE","description":"12-50 recipients"},{"name":"RCPT_COUNT_GT_50","description":"50+ recipients"},{"name":"TO_DN_RECIPIENTS","description":"To header display name is "},{"name":"TO_DN_NONE","description":"None of the recipients have display names"},{"name":"TO_DN_ALL","description":"All the recipients have display names"},{"name":"TO_DN_SOME","description":"Some of the recipients have display names"},{"name":"TO_DN_EQ_ADDR_ALL","description":"All of the recipients have display names that are the same as their address"},{"name":"TO_DN_EQ_ADDR_SOME","description":"Some of the recipients have display names that are the same as their address"},{"name":"TO_MATCH_ENVRCPT_ALL","description":"All of the recipients match the envelope"},{"name":"TO_MATCH_ENVRCPT_SOME","description":"Some of the recipients match the envelope"},{"name":"CTYPE_MISSING_DISPOSITION","description":"Binary content-type not specified as an attachment"},{"name":"CTYPE_MIXED_BOGUS","description":"multipart/mixed without non-textual part"},{"name":"MIME_BASE64_TEXT","description":"Has text part encoded in base64"},{"name":"MIME_BASE64_TEXT_BOGUS","description":"Has text part encoded in base64 that does not contain any 8bit characters"},{"name":"INVALID_FROM_8BIT","description":"Invalid 8bit character in From header"},{"name":"INVALID_RCPT_8BIT","description":"Invalid 8bit character in recipients headers"},{"name":"XM_CASE","description":"X-mailer .vs. X-Mailer"},{"name":"MIME_HTML_ONLY","description":"Messages that have only HTML part"},{"name":"HTML_SHORT_LINK_IMG_1","description":"Short html part (0..1K) with a link to an image"},{"name":"HTML_SHORT_LINK_IMG_2","description":"Short html part (1K..1.5K) with a link to an image"},{"name":"HTML_SHORT_LINK_IMG_3","description":"Short html part (1.5K..2K) with a link to an image"},{"name":"R_EMPTY_IMAGE","description":"Message contains empty parts and image"},{"name":"R_SUSPICIOUS_IMAGES","description":"Message contains many suspicious messages"},{"name":"HTML_VISIBLE_CHECKS","description":"Message contains low contrast text"},{"name":"ZERO_FONT","description":"Zero sized font used"},{"name":"MANY_INVISIBLE_PARTS","description":"Many parts are visually hidden"},{"name":"EXT_CSS","description":"Message contains external CSS reference"},{"name":"HTTP_TO_HTTPS","description":"Anchor text contains different scheme to target URL"},{"name":"HTTP_TO_IP","description":"Anchor points to an IP address"},{"name":"CHECK_MID","description":"Text and HTML parts differ"},{"name":"MISSING_DATE","description":"Message date is missing"},{"name":"DATE_IN_FUTURE","description":"Message date is in future"},{"name":"DATE_IN_PAST","description":"Message date is in past"},{"name":"R_SUSPICIOUS_URL","description":"Obfusicated or suspicious URL has been found in a message"},{"name":"ZERO_WIDTH_SPACE_URL","description":"Zero width space in url"},{"name":"ENVFROM_PRVS","description":"Envelope From is a PRVS address that matches the From address"},{"name":"ENVFROM_VERP","description":"Envelope From is a VERP address"},{"name":"CHECK_RCVD","description":"All hops used encrypted transports"},{"name":"RCVD_TLS_LAST","description":"Last hop used encrypted transports"},{"name":"RCVD_NO_TLS_LAST","description":"Last hop did not use encrypted transports"},{"name":"RCVD_VIA_SMTP_AUTH","description":"Authenticated hand-off was seen in Received headers"},{"name":"RCVD_HELO_USER","description":"HELO User spam pattern"},{"name":"URI_COUNT_ODD","description":"Odd number of URIs in multipart/alternative message"},{"name":"HAS_ATTACHMENT","description":"Message contains attachments"},{"name":"FREEMAIL_REPLYTO_NEQ_FROM_DOM","description":"Freemail From and Reply-To, but to different Freemail services"},{"name":"OMOGRAPH_URL","description":"Url contains both latin and non-latin characters"},{"name":"URL_IN_SUBJECT","description":"URL found in Subject"},{"name":"EMAIL_PLUS_ALIASES","description":"Removes plus aliases from the email"},{"name":"TAGGED_RCPT","description":"SMTP recipients have plus tags"},{"name":"TAGGED_FROM","description":"SMTP from has plus tags"},{"name":"FROM_DISPLAY_CALLBACK","description":"Display name is being used to spoof and trick the recipient"},{"name":"FROM_NEQ_DISPLAY_NAME","description":"Display name contains an email address different to the From address"},{"name":"SPOOF_REPLYTO","description":"Reply-To is being used to spoof and trick the recipient to send an off-domain reply"},{"name":"INFO_TO_INFO_LU","description":"info@ From/To address with List-Unsubscribe headers"},{"name":"R_BAD_CTE_7BIT","description":"Detects bad content-transfer-encoding for text parts"},{"name":"BOGUS_ENCRYPTED_AND_TEXT","description":"Bogus mix of encrypted and text/html payloads"},{"name":"ENCRYPTED_PGP","description":"Message is encrypted with pgp"},{"name":"ENCRYPTED_SMIME","description":"Message is encrypted with smime"},{"name":"SIGNED_PGP","description":"Message is signed with pgp"},{"name":"SIGNED_SMIME","description":"Message is signed with smime"},{"name":"SUBJ_ALL_CAPS","description":"All capital letters in subject"},{"name":"LONG_SUBJ","description":"Subject is too long"},{"name":"HAS_PHPMAILER_SIG","description":"PHPMailer signature"},{"name":"PHP_SCRIPT_ROOT","description":"PHP Script executed by root UID"},{"name":"HAS_X_POS","description":"Has X-PHP-Originating-Script header"},{"name":"HAS_X_PHP_SCRIPT","description":"Has X-PHP-Script header"},{"name":"HAS_X_SOURCE","description":"Has X-Source headers"},{"name":"HAS_X_AS","description":"Has X-Authenticated-Sender header"},{"name":"HAS_X_GMSV","description":"Has X-Get-Message-Sender-Via: header"},{"name":"HAS_X_ANTIABUSE","description":"Has X-AntiAbuse headers"},{"name":"X_PHP_EVAL","description":"Message sent using eval"},{"name":"HAS_WP_URI","description":"Contains WordPress URIs"},{"name":"WP_COMPROMISED","description":"URL that is pointing to a compromised WordPress installation"},{"name":"PHP_XPS_PATTERN","description":"Message contains X-PHP-Script pattern"},{"name":"HAS_XAW","description":"Has X-Authentication-Warning header"},{"name":"XAW_SERVICE_ACCT","description":"Message originally from a service account"},{"name":"ENVFROM_SERVICE_ACCT","description":"Envelope from is a service account"},{"name":"HIDDEN_SOURCE_OBJ","description":"UNIX hidden file/directory in path"},{"name":"URI_HIDDEN_PATH","description":"Message contains URI with a hidden path"},{"name":"MID_RHS_WWW","description":"Message-ID from www host"},{"name":"FROM_SERVICE_ACCT","description":"Sender/From/Reply-To is a service account"},{"name":"WWW_DOT_DOMAIN","description":"From/Sender/Reply-To or Envelope is @www.domain.com"},{"name":"SUBJECT_NEEDS_ENCODING","description":"Subject needs encoding"},{"name":"FROM_NEEDS_ENCODING","description":"From header needs encoding"},{"name":"TO_NEEDS_ENCODING","description":"To header needs encoding"},{"name":"R_NO_SPACE_IN_FROM","description":"No space in from header"},{"name":"TO_WRAPPED_IN_SPACES","description":"To address is wrapped in spaces inside angle brackets (e.g. display-name < local-part@domain >)"},{"name":"MISSING_SUBJECT","description":"Subject header is missing"},{"name":"EMPTY_SUBJECT","description":"Subject header is empty"},{"name":"MISSING_TO","description":"To header is missing"},{"name":"R_UNDISC_RCPT","description":"Recipients are absent or undisclosed"},{"name":"MISSING_MID","description":"Message id is missing"},{"name":"R_RCVD_SPAMBOTS","description":"Spambots signatures in received headers"},{"name":"R_MISSING_CHARSET","description":"Charset is missing in a message"},{"name":"R_SAJDING","description":"Subject seems to be spam"},{"name":"FORGED_OUTLOOK_HTML","description":"Forged outlook HTML signature"},{"name":"SUSPICIOUS_RECIPS","description":"Recipients seems to be autogenerated (works if recipients count is more than 5)"},{"name":"SORTED_RECIPS","description":"Recipients list seems to be sorted"},{"name":"TRACKER_ID","description":"Spam string at the end of message to make statistics fault"},{"name":"FROM_EXCESS_BASE64","description":"From that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"FROM_EXCESS_QP","description":"From that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"TO_EXCESS_BASE64","description":"To that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"TO_EXCESS_QP","description":"To that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"REPLYTO_EXCESS_BASE64","description":"Reply-To that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"REPLYTO_EXCESS_QP","description":"Reply-To that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"CC_EXCESS_BASE64","description":"Cc that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"CC_EXCESS_QP","description":"Cc that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"SUBJ_EXCESS_BASE64","description":"Subject is unnecessarily encoded in base64"},{"name":"SUBJ_EXCESS_QP","description":"Subject is unnecessarily encoded in quoted-printable"},{"name":"FORGED_MUA_OUTLOOK","description":"Forged outlook MUA"},{"name":"FORGED_OUTLOOK_TAGS","description":"Message pretends to be send from Outlook but has "},{"name":"SUSPICIOUS_BOUNDARY","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY2","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY3","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY4","description":"Suspicious boundary in header Content-Type"},{"name":"FORGED_MUA_THEBAT_MSGID","description":"Message pretends to be send from The Bat! but has forged Message-ID"},{"name":"FORGED_MUA_THEBAT_MSGID_UNKNOWN","description":"Message pretends to be send from The Bat! but has forged Message-ID"},{"name":"FORGED_MUA_KMAIL_MSGID_UNKNOWN","description":"Message pretends to be send from KMail but has forged Message-ID"},{"name":"SUSPICIOUS_OPERA_10W_MSGID","description":"Message pretends to be send from suspicious Opera Mail/10.x (Windows) but has forged Message-ID, apparently from KMail"},{"name":"FORGED_MUA_OPERA_MSGID","description":"Message pretends to be send from Opera Mail but has forged Message-ID"},{"name":"FORGED_MUA_MOZILLA_MAIL_MSGID","description":"Message pretends to be send from Mozilla Mail but has forged Message-ID"},{"name":"FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","description":"Message pretends to be send from Mozilla Mail but has forged Message-ID"},{"name":"FORGED_MUA_THUNDERBIRD_MSGID","description":"Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID"},{"name":"FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","description":"Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID"},{"name":"FORGED_MUA_SEAMONKEY_MSGID","description":"Forged mail pretending to be from Mozilla Seamonkey but has forged Message-ID"},{"name":"FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","description":"Forged mail pretending to be from Mozilla Seamonkey but has forged Message-ID"},{"name":"FORGED_MUA_POSTBOX_MSGID","description":"Forged mail pretending to be from Postbox but has forged Message-ID"},{"name":"FORGED_MUA_POSTBOX_MSGID_UNKNOWN","description":"Forged mail pretending to be from Postbox but has forged Message-ID"},{"name":"INVALID_MSGID","description":"Message id is incorrect"},{"name":"MIME_HEADER_CTYPE_ONLY","description":"Only Content-Type header without other MIME headers"},{"name":"RATWARE_MS_HASH","description":"Forged Exchange messages"},{"name":"STOX_REPLY_TYPE","description":"Reply-type in content-type"},{"name":"FM_FAKE_HELO_VERIZON","description":"Fake helo for verizon provider"},{"name":"FORGED_MSGID_YAHOO","description":"Forged yahoo msgid"},{"name":"FORGED_MUA_THEBAT_BOUN","description":"Forged The Bat! MUA headers"},{"name":"MAIL_RU_MAILER","description":"Sent with Mail.Ru web-mail"},{"name":"YANDEX_RU_MAILER","description":"Sent with yandex.ru web-mail"},{"name":"MAILER_1C_8","description":"Sent with 1C:Enterprise 8"},{"name":"STRONGMAIL","description":"Sent via rogue "},{"name":"RCVD_DOUBLE_IP_SPAM","description":"Two received headers with ip addresses"},{"name":"REPTO_QUOTE_YAHOO","description":"Quoted reply-to from yahoo (seems to be forged)"},{"name":"FAKE_REPLY_C","description":"Fake reply (has RE in subject, but has no References header)"},{"name":"MISSING_MIMEOLE","description":"Mime-OLE is needed but absent (e.g. fake Outlook or fake Exchange)"},{"name":"HEADER_FROM_DELIMITER_TAB","description":"Header From begins with tab"},{"name":"HEADER_TO_DELIMITER_TAB","description":"Header To begins with tab"},{"name":"HEADER_CC_DELIMITER_TAB","description":"Header To begins with tab"},{"name":"HEADER_REPLYTO_DELIMITER_TAB","description":"Header Reply-To begins with tab"},{"name":"HEADER_DATE_DELIMITER_TAB","description":"Header Date begins with tab"},{"name":"HEADER_FROM_EMPTY_DELIMITER","description":"Header From has no delimiter between header name and header value"},{"name":"HEADER_TO_EMPTY_DELIMITER","description":"Header To has no delimiter between header name and header value"},{"name":"HEADER_CC_EMPTY_DELIMITER","description":"Header Cc has no delimiter between header name and header value"},{"name":"HEADER_REPLYTO_EMPTY_DELIMITER","description":"Header Reply-To has no delimiter between header name and header value"},{"name":"HEADER_DATE_EMPTY_DELIMITER","description":"Header Date has no delimiter between header name and header value"},{"name":"RCVD_ILLEGAL_CHARS","description":"Header Received has raw illegal character"},{"name":"FORGED_GENERIC_RECEIVED","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED2","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED3","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED4","description":"Forged generic Received"},{"name":"INVALID_POSTFIX_RECEIVED","description":"Invalid Postfix Received"},{"name":"X_PHP_FORGED_0X","description":"X-PHP-Originating-Script header appears forged"},{"name":"GOOGLE_FORWARDING_MID_MISSING","description":"Message was missing Message-ID pre-forwarding"},{"name":"GOOGLE_FORWARDING_MID_BROKEN","description":"Message had invalid Message-ID pre-forwarding"},{"name":"CTE_CASE","description":"[78]Bit .vs. [78]bit"},{"name":"HAS_INTERSPIRE_SIG","description":"Has Interspire fingerprint"},{"name":"CT_EXTRA_SEMI","description":"Content-Type ends with a semi-colon"},{"name":"SUBJECT_ENDS_EXCLAIM","description":"Subject ends with an exclaimation"},{"name":"SUBJECT_HAS_EXCLAIM","description":"Subject contains an exclaimation"},{"name":"SUBJECT_ENDS_QUESTION","description":"Subject ends with a question"},{"name":"SUBJECT_HAS_QUESTION","description":"Subject contains a question"},{"name":"SUBJECT_HAS_CURRENCY","description":"Subject contains currency"},{"name":"SUBJECT_ENDS_SPACES","description":"Subject ends with space characters"},{"name":"HAS_ORG_HEADER","description":"Has Organization header"},{"name":"X_PHPOS_FAKE","description":"Fake X-PHP-Originating-Script header"},{"name":"HAS_XOIP","description":"Has X-Originating-IP header"},{"name":"HAS_LIST_UNSUB","description":"Has List-Unsubscribe header"},{"name":"HAS_GUC_PROXY_URI","description":"Has googleusercontent.com proxy URI"},{"name":"HAS_GOOGLE_REDIR","description":"Has google.com/url redirection"},{"name":"XM_UA_NO_VERSION","description":"X-Mailer/User-Agent has no version"},{"name":"HTML_META_REFRESH_URL","description":"Has HTML Meta refresh URL"},{"name":"HAS_DATA_URI","description":"Has Data URI encoding"},{"name":"DATA_URI_OBFU","description":"Uses Data URI encoding to obfuscate plain or HTML in base64"},{"name":"INTRODUCTION","description":"Sender introduces themselves"},{"name":"HAS_ONION_URI","description":"Contains .onion hidden service URI"},{"name":"LEAKED_PASSWORD_SCAM_RE","description":"Contains BTC wallet address and malicious regexps"},{"name":"PRECEDENCE_BULK","description":"Message marked as bulk"},{"name":"MICROSOFT_SPAM","description":"Microsoft says the message is spam"},{"name":"AOL_SPAM","description":"AOL says this message is spam"},{"name":"KLMS_SPAM","description":"Kaspersky Security for Mail Server says this message is spam"},{"name":"SPAM_FLAG","description":"Message was already marked as spam"},{"name":"UNITEDINTERNET_SPAM","description":"United Internet says this message is spam"},{"name":"FUZZY_UNKNOWN","description":"Generic fuzzy hash match, bl.rspamd.com"},{"name":"FUZZY_DENIED","description":"Denied fuzzy hash, bl.rspamd.com"},{"name":"FUZZY_PROB","description":"Probable fuzzy hash, bl.rspamd.com"},{"name":"FUZZY_WHITE","description":"Whitelisted fuzzy hash, bl.rspamd.com"},{"name":"FORGED_SENDER","description":"Sender is forged (different From: header and smtp MAIL FROM: addresses)"},{"name":"R_MIXED_CHARSET","description":"Mixed characters in a message"},{"name":"R_MIXED_CHARSET_URL","description":"Mixed characters in a URL inside message"},{"name":"FORGED_RECIPIENTS","description":"Recipients are not the same as RCPT TO: mail command"},{"name":"FORGED_RECIPIENTS_MAILLIST","description":"Recipients are not the same as RCPT TO: mail command, but a message from a maillist"},{"name":"FORGED_SENDER_MAILLIST","description":"Sender is not the same as MAIL FROM: envelope, but a message is from a maillist"},{"name":"ONCE_RECEIVED","description":"One received header in a message"},{"name":"RDNS_NONE","description":"Cannot resolve reverse DNS for sender"},{"name":"RDNS_DNSFAIL","description":"PTR verification DNS error"},{"name":"ONCE_RECEIVED_STRICT","description":"One received header with "},{"name":"MAILLIST","description":"Message seems to be from maillist"},{"name":"HFILTER_HELO_BAREIP","description":"Helo host is bare ip"},{"name":"HFILTER_HELO_BADIP","description":"Helo host is very bad ip"},{"name":"HFILTER_HELO_1","description":"Helo host checks (very low)"},{"name":"HFILTER_HELO_2","description":"Helo host checks (low)"},{"name":"HFILTER_HELO_3","description":"Helo host checks (medium)"},{"name":"HFILTER_HELO_4","description":"Helo host checks (hard)"},{"name":"HFILTER_HELO_5","description":"Helo host checks (very hard)"},{"name":"HFILTER_HOSTNAME_1","description":"Hostname checks (very low)"},{"name":"HFILTER_HOSTNAME_2","description":"Hostname checks (low)"},{"name":"HFILTER_HOSTNAME_3","description":"Hostname checks (medium)"},{"name":"HFILTER_HOSTNAME_4","description":"Hostname checks (hard)"},{"name":"HFILTER_HOSTNAME_5","description":"Hostname checks (very hard)"},{"name":"HFILTER_HELO_NORESOLVE_MX","description":"MX found in Helo and no resolve"},{"name":"HFILTER_HELO_NORES_A_OR_MX","description":"Helo no resolve to A or MX"},{"name":"HFILTER_HELO_IP_A","description":"Helo A IP != hostname IP"},{"name":"HFILTER_HELO_NOT_FQDN","description":"Helo not FQDN"},{"name":"HFILTER_FROMHOST_NORESOLVE_MX","description":"MX found in FROM host and no resolve"},{"name":"HFILTER_FROMHOST_NORES_A_OR_MX","description":"FROM host no resolve to A or MX"},{"name":"HFILTER_FROMHOST_NOT_FQDN","description":"FROM host not FQDN"},{"name":"HFILTER_FROM_BOUNCE","description":"Bounce message"},{"name":"HFILTER_MID_NORESOLVE_MX","description":"MX found in Message-id host and no resolve"},{"name":"HFILTER_MID_NORES_A_OR_MX","description":"Message-id host no resolve to A or MX"},{"name":"HFILTER_MID_NOT_FQDN","description":"Message-id host not FQDN"},{"name":"HFILTER_HOSTNAME_UNKNOWN","description":"Unknown client hostname (PTR or FCrDNS verification failed)"},{"name":"HFILTER_RCPT_BOUNCEMOREONE","description":"Message from bounce and over 1 recipient"},{"name":"HFILTER_URL_ONLY","description":"URL only in body"},{"name":"HFILTER_URL_ONELINE","description":"One line URL and text in body"},{"name":"MIME_GOOD","description":"Known content-type"},{"name":"MIME_BAD","description":"Known bad content-type"},{"name":"MIME_UNKNOWN","description":"Missing or unknown content-type"},{"name":"MIME_BAD_ATTACHMENT","description":"Invalid attachment mime type"},{"name":"MIME_ENCRYPTED_ARCHIVE","description":"Encrypted archive in a message"},{"name":"MIME_ARCHIVE_IN_ARCHIVE","description":"Archive within another archive"},{"name":"MIME_DOUBLE_BAD_EXTENSION","description":"Bad extension cloaking"},{"name":"MIME_BAD_EXTENSION","description":"Bad extension"},{"name":"MIME_BAD_UNICODE","description":"Filename with known obscured unicode characters"},{"name":"FORGED_MUA_MAILLIST","description":"Avoid false positives for FORGED_MUA_* in maillist"},{"name":"PHISHING","description":"Phished URL"},{"name":"PHISHED_OPENPHISH","description":"Phished URL found in openphish.com"},{"name":"PHISHED_PHISHTANK","description":"Phished URL found in phishtank.com"},{"name":"R_SPF_FAIL","description":"SPF verification failed"},{"name":"R_SPF_SOFTFAIL","description":"SPF verification soft-failed"},{"name":"R_SPF_NEUTRAL","description":"SPF policy is neutral"},{"name":"R_SPF_ALLOW","description":"SPF verification allows sending"},{"name":"R_SPF_DNSFAIL","description":"SPF DNS failure"},{"name":"R_DKIM_REJECT","description":"DKIM verification failed"},{"name":"R_DKIM_TEMPFAIL","description":"DKIM verification soft-failed"},{"name":"R_DKIM_ALLOW","description":"DKIM verification succeed"},{"name":"DMARC_POLICY_ALLOW","description":"Message was authenticated & allowed by DMARC policy"},{"name":"DMARC_POLICY_ALLOW_WITH_FAILURES","description":"DMARC permit policy with DKIM/SPF failure"},{"name":"DMARC_POLICY_REJECT","description":"Rejection suggested by DMARC policy"},{"name":"DMARC_POLICY_QUARANTINE","description":"Quarantine suggested by DMARC policy"},{"name":"DMARC_POLICY_SOFTFAIL","description":"No action suggested by DMARC policy"},{"name":"DMARC_BAD_POLICY","description":"DMARC policy was invalid or multiple policies found in DNS"},{"name":"DMARC_NA","description":"Domain in From header has no DMARC policy or From header is missing"},{"name":"ARC_ALLOW","description":"ARC checks success"},{"name":"ARC_REJECT","description":"ARC checks failed"},{"name":"ARC_INVALID","description":"ARC structure invalid"},{"name":"ARC_DNSFAIL","description":"ARC DNS error"},{"name":"ARC_NA","description":"ARC signature absent"},{"name":"DNSWL_BLOCKED","description":"Resolver blocked due to excessive queries"},{"name":"RCVD_IN_DNSWL","description":"Unrecognised result from https://www.dnswl.org"},{"name":"RCVD_IN_DNSWL_NONE","description":"Sender listed at https://www.dnswl.org, no trust"},{"name":"RCVD_IN_DNSWL_LOW","description":"Sender listed at https://www.dnswl.org, low trust"},{"name":"RCVD_IN_DNSWL_MED","description":"Sender listed at https://www.dnswl.org, medium trust"},{"name":"RCVD_IN_DNSWL_HI","description":"Sender listed at https://www.dnswl.org, high trust"},{"name":"DWL_DNSWL_BLOCKED","description":"Resolver blocked due to excessive queries (dwl)"},{"name":"DWL_DNSWL","description":"Unrecognised result from https://www.dnswl.org (dwl)"},{"name":"DWL_DNSWL_NONE","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust"},{"name":"DWL_DNSWL_LOW","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust"},{"name":"DWL_DNSWL_MED","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust"},{"name":"DWL_DNSWL_HI","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust"},{"name":"RBL_SPAMHAUS","description":"Unrecognised result from Spamhaus ZEN"},{"name":"RBL_SPAMHAUS_SBL","description":"From address is listed in ZEN SBL"},{"name":"RBL_SPAMHAUS_CSS","description":"From address is listed in ZEN CSS"},{"name":"RBL_SPAMHAUS_XBL","description":"From address is listed in ZEN XBL"},{"name":"RBL_SPAMHAUS_XBL_ANY","description":"From or received address is listed in ZEN XBL (any list)"},{"name":"RBL_SPAMHAUS_PBL","description":"From address is listed in ZEN PBL (ISP list)"},{"name":"RBL_SPAMHAUS_DROP","description":"From address is listed in ZEN DROP BL"},{"name":"RBL_SPAMHAUS_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"RBL_SPAMHAUS_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"RECEIVED_SPAMHAUS_SBL","description":"Received address is listed in ZEN SBL"},{"name":"RECEIVED_SPAMHAUS_CSS","description":"Received address is listed in ZEN CSS"},{"name":"RECEIVED_SPAMHAUS_XBL","description":"Received address is listed in ZEN XBL"},{"name":"RECEIVED_SPAMHAUS_PBL","description":"Received address is listed in ZEN PBL (ISP list)"},{"name":"RECEIVED_SPAMHAUS_DROP","description":"Received address is listed in ZEN DROP BL"},{"name":"RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"RECEIVED_SPAMHAUS_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"RBL_SENDERSCORE","description":"From address is listed in senderscore.com BL"},{"name":"MAILSPIKE","description":"Unrecognised result from Mailspike"},{"name":"RWL_MAILSPIKE_NEUTRAL","description":"Neutral result from Mailspike"},{"name":"RBL_MAILSPIKE_WORST","description":"From address is listed in RBL - worst possible reputation"},{"name":"RBL_MAILSPIKE_VERYBAD","description":"From address is listed in RBL - very bad reputation"},{"name":"RBL_MAILSPIKE_BAD","description":"From address is listed in RBL - bad reputation"},{"name":"RWL_MAILSPIKE_POSSIBLE","description":"From address is listed in RWL - possibly legit"},{"name":"RWL_MAILSPIKE_GOOD","description":"From address is listed in RWL - good reputation"},{"name":"RWL_MAILSPIKE_VERYGOOD","description":"From address is listed in RWL - very good reputation"},{"name":"RWL_MAILSPIKE_EXCELLENT","description":"From address is listed in RWL - excellent reputation"},{"name":"RBL_SEM","description":"From address is listed in Spameatingmonkey RBL"},{"name":"RBL_SEM_IPV6","description":"From address is listed in Spameatingmonkey RBL (IPv6)"},{"name":"RBL_VIRUSFREE_BOTNET","description":"From address is listed in virusfree.cz BL"},{"name":"RBL_NIXSPAM","description":"From address is listed in NiX Spam (http://www.dnsbl.manitu.net/)"},{"name":"RBL_BLOCKLISTDE","description":"From address is listed in Blocklist (https://www.blocklist.de/)"},{"name":"RECEIVED_BLOCKLISTDE","description":"Received address is listed in Blocklist (https://www.blocklist.de/)"},{"name":"BAYES_SPAM","description":"Message probably spam"},{"name":"BAYES_HAM","description":"Message probably ham"},{"name":"SURBL_BLOCKED","description":"SURBL: blocked by policy/overusage"},{"name":"PH_SURBL_MULTI","description":"SURBL: Phishing sites"},{"name":"MW_SURBL_MULTI","description":"SURBL: Malware sites"},{"name":"ABUSE_SURBL","description":"SURBL: ABUSE"},{"name":"CRACKED_SURBL","description":"SURBL: cracked site"},{"name":"RSPAMD_URIBL","description":"Rspamd uribl, bl.rspamd.com"},{"name":"RSPAMD_EMAILBL","description":"Rspamd emailbl, bl.rspamd.com"},{"name":"MSBL_EBL","description":"MSBL emailbl"},{"name":"MSBL_EBL_GREY","description":"MSBL emailbl grey list"},{"name":"SEM_URIBL_UNKNOWN","description":"Spameatingmonkey uribl: unknown result"},{"name":"SEM_URIBL","description":"Spameatingmonkey uribl"},{"name":"SEM_URIBL_FRESH15_UNKNOWN","description":"Spameatingmonkey Fresh15 uribl: unknown result"},{"name":"SEM_URIBL_FRESH15","description":"Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)"},{"name":"DBL","description":"DBL unknown result"},{"name":"DBL_SPAM","description":"DBL uribl spam"},{"name":"DBL_PHISH","description":"DBL uribl phishing"},{"name":"DBL_MALWARE","description":"DBL uribl malware"},{"name":"DBL_BOTNET","description":"DBL uribl botnet C&C domain"},{"name":"DBL_ABUSE","description":"DBL uribl abused legit spam"},{"name":"DBL_ABUSE_REDIR","description":"DBL uribl abused spammed redirector domain"},{"name":"DBL_ABUSE_PHISH","description":"DBL uribl abused legit phish"},{"name":"DBL_ABUSE_MALWARE","description":"DBL uribl abused legit malware"},{"name":"DBL_ABUSE_BOTNET","description":"DBL uribl abused legit botnet C&C"},{"name":"DBL_PROHIBIT","description":"DBL uribl IP queries prohibited!"},{"name":"DBL_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"DBL_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_MULTI","description":"uribl.com: unrecognised result"},{"name":"URIBL_BLOCKED","description":"uribl.com: query refused"},{"name":"URIBL_BLACK","description":"uribl.com black url"},{"name":"URIBL_RED","description":"uribl.com red url"},{"name":"URIBL_GREY","description":"uribl.com grey url"},{"name":"SPAMHAUS_ZEN_URIBL","description":"Spamhaus ZEN URIBL: Filtered result"},{"name":"URIBL_SBL","description":"A domain in the message body resolves to an IP listed in Spamhaus SBL"},{"name":"URIBL_SBL_CSS","description":"A domain in the message body resolves to an IP listed in Spamhaus SBL CSS"},{"name":"URIBL_XBL","description":"A domain in the message body resolves to an IP listed in Spamhaus XBL"},{"name":"URIBL_PBL","description":"A domain in the message body resolves to an IP listed in Spamhaus PBL"},{"name":"URIBL_DROP","description":"A domain in the message body resolves to an IP listed in Spamhaus DROP"},{"name":"RBL_SARBL_BAD","description":"A domain in the message body is blacklisted in SARBL"},{"name":"WHITELIST_SPF","description":"Mail comes from the whitelisted domain and has a valid SPF policy"},{"name":"BLACKLIST_SPF","description":"Mail comes from the whitelisted domain and has no valid SPF policy"},{"name":"WHITELIST_DKIM","description":"Mail comes from the whitelisted domain and has a valid DKIM signature"},{"name":"BLACKLIST_DKIM","description":"Mail comes from the whitelisted domain and has non-valid DKIM signature"},{"name":"WHITELIST_SPF_DKIM","description":"Mail comes from the whitelisted domain and has valid SPF and DKIM policies"},{"name":"BLACKLIST_SPF_DKIM","description":"Mail comes from the whitelisted domain and has no valid SPF policy or a bad DKIM signature"},{"name":"WHITELIST_DMARC","description":"Mail comes from the whitelisted domain and has valid DMARC and DKIM policies"},{"name":"BLACKLIST_DMARC","description":"Mail comes from the whitelisted domain and has valid failed DMARC and DKIM policies"},{"name":"NEURAL_SPAM_LONG","description":"Neural network spam (long)"},{"name":"NEURAL_HAM_LONG","description":"Neural network ham (long)"},{"name":"NEURAL_SPAM_SHORT","description":"Neural network spam (short)"},{"name":"NEURAL_HAM_SHORT","description":"Neural network ham (short)"},{"name":"MX_MISSING","description":"Domain has no resolvable MX"},{"name":"MX_INVALID","description":"Domain has no working MX"},{"name":"MX_GOOD","description":"Domain has working MX"},{"name":"MX_WHITE","description":"Domain is whitelisted from MX check"},{"name":"ARC_SIGNED","description":"Message is signed with ARC"},{"name":"ASN","description":"Looked up Autonomous System Number (ASN), country code and subnets of sender IP address"},{"name":"DKIM_TRACE","description":"DKIM checks completed"},{"name":"MIME_TRACE","description":"MIME checks completed"},{"name":"RCVD_DKIM_DNSWL_MED","description":"Sufficiently DKIM signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_MED","description":"Sufficiently DKIM/ARC signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_DNSWL_HI","description":"Sufficiently DKIM signed and received from IP with high trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_HI","description":"Sufficiently DKIM/ARC signed and received from IP with high trust at DNSWL"},{"name":"GTUBE","description":"Generic Test for Unsolicited Bulk Email"},{"name":"TRACKER_ID","description":"Incorporates a tracking ID number"},{"name":"WEIRD_QUOTING","description":"Weird repeated double-quotation marks"},{"name":"MIME_HTML_ONLY_MULTI","description":"Multipart message only has text/html MIME parts"},{"name":"MIME_CHARSET_FARAWAY","description":"MIME character set indicates foreign language"},{"name":"EMAIL_ROT13","description":"Body contains a ROT13-encoded email address"},{"name":"LONGWORDS","description":"Long string of long words"},{"name":"MPART_ALT_DIFF","description":"HTML and text parts are different"},{"name":"MPART_ALT_DIFF_COUNT","description":"HTML and text parts are different"},{"name":"BLANK_LINES_80_90","description":"Message body has 80-90% blank lines"},{"name":"CHARSET_FARAWAY","description":"Character set indicates a foreign language"},{"name":"__MIME_BASE64","description":"Includes a base64 attachment"},{"name":"__MIME_QP","description":"Includes a quoted-printable attachment"},{"name":"MIME_BASE64_BLANKS","description":"Extra blank lines in base64 encoding"},{"name":"MIME_BASE64_TEXT","description":"Message text disguised using base64 encoding"},{"name":"MISSING_MIME_HB_SEP","description":"Missing blank line between MIME header and body"},{"name":"MIME_HTML_MOSTLY","description":"Multipart message mostly text/html MIME"},{"name":"MIME_HTML_ONLY","description":"Message only has text/html MIME parts"},{"name":"MIME_QP_LONG_LINE","description":"Quoted-printable line longer than 76 chars"},{"name":"MIME_BAD_ISO_CHARSET","description":"MIME character set is an unknown ISO charset"},{"name":"MIMEPART_LIMIT_EXCEEDED","description":"Message has too many MIME parts"},{"name":"HTTPS_IP_MISMATCH","description":"IP to HTTPS link found in HTML"},{"name":"URI_TRUNCATED","description":"Message contained a URI which was truncated"},{"name":"NO_RECEIVED","description":"Informational: message has no Received headers"},{"name":"ALL_TRUSTED","description":"Passed through trusted hosts only via SMTP"},{"name":"NO_RELAYS","description":"Informational: message was not relayed via SMTP"},{"name":"__RCVD_IN_SORBS","description":"SORBS: sender is listed in SORBS"},{"name":"RCVD_IN_SORBS_HTTP","description":"SORBS: sender is open HTTP proxy server"},{"name":"RCVD_IN_SORBS_SOCKS","description":"SORBS: sender is open SOCKS proxy server"},{"name":"RCVD_IN_SORBS_MISC","description":"SORBS: sender is open proxy server"},{"name":"RCVD_IN_SORBS_SMTP","description":"SORBS: sender is open SMTP relay"},{"name":"RCVD_IN_SORBS_SPAM","description":"SORBS: sender is a spam source"},{"name":"RCVD_IN_SORBS_WEB","description":"SORBS: sender is an abusable web server"},{"name":"RCVD_IN_SORBS_BLOCK","description":"SORBS: sender demands to never be tested"},{"name":"RCVD_IN_SORBS_ZOMBIE","description":"SORBS: sender is on a hijacked network"},{"name":"RCVD_IN_SORBS_DUL","description":"SORBS: sent directly from dynamic IP address"},{"name":"__RCVD_IN_ZEN","description":"Received via a relay in Spamhaus Zen"},{"name":"RCVD_IN_SBL","description":"Received via a relay in Spamhaus SBL"},{"name":"RCVD_IN_XBL","description":"Received via a relay in Spamhaus XBL"},{"name":"RCVD_IN_PBL","description":"Received via a relay in Spamhaus PBL"},{"name":"RCVD_IN_SBL_CSS","description":"Received via a relay in Spamhaus SBL-CSS"},{"name":"RCVD_IN_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"RCVD_IN_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"RCVD_IN_BL_SPAMCOP_NET","description":"Received via a relay in bl.spamcop.net"},{"name":"RCVD_IN_MAPS_RBL","description":"Relay in RBL, http://www.mail-abuse.com/enduserinfo_rbl.html"},{"name":"RCVD_IN_MAPS_DUL","description":"Relay in DUL, http://www.mail-abuse.com/enduserinfo_dul.html"},{"name":"RCVD_IN_MAPS_RSS","description":"Relay in RSS, http://www.mail-abuse.com/enduserinfo_rss.html"},{"name":"RCVD_IN_MAPS_OPS","description":"Relay in OPS, http://www.mail-abuse.com/enduserinfo_ops.html"},{"name":"RCVD_IN_MAPS_NML","description":"Relay in NML, http://www.mail-abuse.com/enduserinfo_nml.html"},{"name":"RCVD_IN_IADB_VOUCHED","description":"ISIPP IADB lists as vouched-for sender"},{"name":"RCVD_IN_RP_CERTIFIED","description":"Sender in ReturnPath Certified - Contact cert-sa@returnpath.net"},{"name":"RCVD_IN_RP_SAFE","description":"Sender in ReturnPath Safe - Contact safe-sa@returnpath.net"},{"name":"RCVD_IN_RP_RNBL","description":"Relay in RNBL, https://senderscore.org/blacklistlookup/"},{"name":"DKIMDOMAIN_IN_DWL","description":"Signing domain listed in Spamhaus DWL"},{"name":"__DKIMDOMAIN_IN_DWL_ANY","description":"Any TXT response received from a Spamhaus DWL"},{"name":"DKIMDOMAIN_IN_DWL_UNKNOWN","description":"Unrecognized response from Spamhaus DWL"},{"name":"SUBJECT_DRUG_GAP_C","description":"Subject contains a gappy version of 'cialis'"},{"name":"SUBJECT_DRUG_GAP_L","description":"Subject contains a gappy version of 'levitra'"},{"name":"SUBJECT_DRUG_GAP_S","description":"Subject contains a gappy version of 'soma'"},{"name":"SUBJECT_DRUG_GAP_VA","description":"Subject contains a gappy version of 'valium'"},{"name":"SUBJECT_DRUG_GAP_X","description":"Subject contains a gappy version of 'xanax'"},{"name":"DRUG_DOSAGE","description":"Talks about price per dose"},{"name":"DRUG_ED_CAPS","description":"Mentions an E.D. drug"},{"name":"DRUG_ED_SILD","description":"Talks about an E.D. drug using its chemical name"},{"name":"DRUG_ED_GENERIC","description":"Mentions Generic Viagra"},{"name":"DRUG_ED_ONLINE","description":"Fast Viagra Delivery "},{"name":"ONLINE_PHARMACY","description":"Online Pharmacy"},{"name":"NO_PRESCRIPTION","description":"No prescription needed"},{"name":"VIA_GAP_GRA","description":"Attempts to disguise the word 'viagra'"},{"name":"DRUGS_ERECTILE","description":"Refers to an erectile drug"},{"name":"DRUGS_ERECTILE_OBFU","description":"Obfuscated reference to an erectile drug"},{"name":"DRUGS_DIET","description":"Refers to a diet drug"},{"name":"DRUGS_DIET_OBFU","description":"Obfuscated reference to a diet drug\t"},{"name":"DRUGS_MUSCLE","description":"Refers to a muscle relaxant"},{"name":"DRUGS_ANXIETY","description":"Refers to an anxiety control drug"},{"name":"DRUGS_ANXIETY_OBFU","description":"Obfuscated reference to an anxiety control drug"},{"name":"DRUGS_SMEAR1","description":"Two or more drugs crammed together into one word"},{"name":"DRUGS_ANXIETY_EREC","description":"Refers to both an erectile and an anxiety drug"},{"name":"DRUGS_SLEEP_EREC","description":"Refers to both an erectile and a sleep aid drug"},{"name":"DRUGS_MANYKINDS","description":"Refers to at least four kinds of drugs"},{"name":"__RDNS_DYNAMIC_IPADDR","description":"Relay HELO'd using suspicious hostname (IP addr 1)"},{"name":"__RDNS_DYNAMIC_DHCP","description":"Relay HELO'd using suspicious hostname (DHCP)"},{"name":"__RDNS_DYNAMIC_HCC","description":"Relay HELO'd using suspicious hostname (HCC)"},{"name":"__RDNS_DYNAMIC_ATTBI","description":"Relay HELO'd using suspicious hostname (ATTBI.com)"},{"name":"__RDNS_DYNAMIC_ROGERS","description":"Relay HELO'd using suspicious hostname (Rogers)"},{"name":"__RDNS_DYNAMIC_ADELPHIA","description":"Relay HELO'd using suspicious hostname (Adelphia)"},{"name":"__RDNS_DYNAMIC_DIALIN","description":"Relay HELO'd using suspicious hostname (T-Dialin)"},{"name":"__RDNS_DYNAMIC_HEXIP","description":"Relay HELO'd using suspicious hostname (Hex IP)"},{"name":"__RDNS_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"__RDNS_DYNAMIC_YAHOOBB","description":"Relay HELO'd using suspicious hostname (YahooBB)"},{"name":"__RDNS_DYNAMIC_OOL","description":"Relay HELO'd using suspicious hostname (OptOnline)"},{"name":"__RDNS_DYNAMIC_RR2","description":"Relay HELO'd using suspicious hostname (RR 2)"},{"name":"__RDNS_DYNAMIC_COMCAST","description":"Relay HELO'd using suspicious hostname (Comcast)"},{"name":"__RDNS_DYNAMIC_TELIA","description":"Relay HELO'd using suspicious hostname (Telia)"},{"name":"__RDNS_DYNAMIC_VTR","description":"Relay HELO'd using suspicious hostname (VTR)"},{"name":"__RDNS_DYNAMIC_CHELLO_NO","description":"Relay HELO'd using suspicious hostname (Chello.no)"},{"name":"__RDNS_DYNAMIC_CHELLO_NL","description":"Relay HELO'd using suspicious hostname (Chello.nl)"},{"name":"__RDNS_DYNAMIC_VELOX","description":"Relay HELO'd using suspicious hostname (Veloxzone)"},{"name":"__RDNS_DYNAMIC_NTL","description":"Relay HELO'd using suspicious hostname (NTL)"},{"name":"RDNS_DYNAMIC","description":"Delivered to internal network by host with dynamic-looking rDNS"},{"name":"RDNS_NONE","description":"Delivered to internal network by a host with no rDNS"},{"name":"HELO_STATIC_HOST","description":"Relay HELO'd using static hostname"},{"name":"FAKE_HELO_MAIL_COM_DOM","description":"Relay HELO'd with suspicious hostname (mail.com)"},{"name":"HELO_DYNAMIC_IPADDR","description":"Relay HELO'd using suspicious hostname (IP addr 1)"},{"name":"HELO_DYNAMIC_DHCP","description":"Relay HELO'd using suspicious hostname (DHCP)"},{"name":"HELO_DYNAMIC_HCC","description":"Relay HELO'd using suspicious hostname (HCC)"},{"name":"HELO_DYNAMIC_ROGERS","description":"Relay HELO'd using suspicious hostname (Rogers)"},{"name":"HELO_DYNAMIC_DIALIN","description":"Relay HELO'd using suspicious hostname (T-Dialin)"},{"name":"HELO_DYNAMIC_HEXIP","description":"Relay HELO'd using suspicious hostname (Hex IP)"},{"name":"HELO_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"HELO_DYNAMIC_IPADDR2","description":"Relay HELO'd using suspicious hostname (IP addr 2)"},{"name":"HELO_DYNAMIC_CHELLO_NL","description":"Relay HELO'd using suspicious hostname (Chello.nl)"},{"name":"HELO_DYNAMIC_HOME_NL","description":"Relay HELO'd using suspicious hostname (Home.nl)"},{"name":"FREEMAIL_REPLYTO","description":"Reply-To/From or Reply-To/body contain different freemails"},{"name":"FREEMAIL_REPLY","description":"From and body contain different freemails"},{"name":"FREEMAIL_FROM","description":"Sender email is commonly abused enduser mail provider"},{"name":"FREEMAIL_ENVFROM_END_DIGIT","description":"Envelope-from freemail username ends in digit"},{"name":"FREEMAIL_REPLYTO_END_DIGIT","description":"Reply-To freemail username ends in digit"},{"name":"FREEMAIL_SUBJECT","description":"Subject contains freemail"},{"name":"FREEMAIL_FORGED_REPLYTO","description":"Freemail in Reply-To, but not From"},{"name":"FRAGMENTED_MESSAGE","description":"Partial message"},{"name":"FROM_BLANK_NAME","description":"From: contains empty name"},{"name":"FROM_STARTS_WITH_NUMS","description":"From: starts with several numbers"},{"name":"FROM_OFFERS","description":"From address is \"at something-offers\""},{"name":"FROM_NO_USER","description":"From: has no local-part before @ sign"},{"name":"PLING_QUERY","description":"Subject has exclamation mark and question mark"},{"name":"MSGID_SPAM_CAPS","description":"Spam tool Message-Id: (caps variant)"},{"name":"MSGID_SPAM_LETTERS","description":"Spam tool Message-Id: (letters variant)"},{"name":"MSGID_RANDY","description":"Message-Id has pattern used in spam"},{"name":"MSGID_YAHOO_CAPS","description":"Message-ID has ALLCAPS@yahoo.com"},{"name":"FORGED_MSGID_AOL","description":"Message-ID is forged, (aol.com)"},{"name":"FORGED_MSGID_EXCITE","description":"Message-ID is forged, (excite.com)"},{"name":"FORGED_MSGID_HOTMAIL","description":"Message-ID is forged, (hotmail.com)"},{"name":"FORGED_MSGID_MSN","description":"Message-ID is forged, (msn.com)"},{"name":"FORGED_MSGID_YAHOO","description":"Message-ID is forged, (yahoo.com)"},{"name":"MSGID_FROM_MTA_HEADER","description":"Message-Id was added by a relay"},{"name":"MSGID_SHORT","description":"Message-ID is unusually short"},{"name":"MSGID_MULTIPLE_AT","description":"Message-ID contains multiple '@' characters"},{"name":"DATE_SPAMWARE_Y2K","description":"Date header uses unusual Y2K formatting"},{"name":"INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"INVALID_DATE_TZ_ABSURD","description":"Invalid Date: header (timezone does not exist)"},{"name":"INVALID_TZ_CST","description":"Invalid date in header (wrong CST timezone)"},{"name":"INVALID_TZ_EST","description":"Invalid date in header (wrong EST timezone)"},{"name":"FROM_EXCESS_BASE64","description":"From: base64 encoded unnecessarily"},{"name":"ENGLISH_UCE_SUBJECT","description":"Subject contains an English UCE tag"},{"name":"JAPANESE_UCE_SUBJECT","description":"Subject contains a Japanese UCE tag"},{"name":"JAPANESE_UCE_BODY","description":"Body contains Japanese UCE tag"},{"name":"RUSSIAN_UCE_SUBJECT","description":"Subject contains a Russian UCE tag"},{"name":"KOREAN_UCE_SUBJECT","description":"Subject: contains Korean unsolicited email tag"},{"name":"RCVD_DOUBLE_IP_SPAM","description":"Bulk email fingerprint (double IP) found"},{"name":"RCVD_DOUBLE_IP_LOOSE","description":"Received: by and from look like IP addresses"},{"name":"FORGED_TELESP_RCVD","description":"Contains forged hostname for a DSL IP in Brazil"},{"name":"CONFIRMED_FORGED","description":"Received headers are forged"},{"name":"MULTI_FORGED","description":"Received headers indicate multiple forgeries"},{"name":"NONEXISTENT_CHARSET","description":"Character set doesn't exist"},{"name":"MISSING_MID","description":"Missing Message-Id: header"},{"name":"MISSING_DATE","description":"Missing Date: header"},{"name":"MISSING_SUBJECT","description":"Missing Subject: header"},{"name":"MISSING_FROM","description":"Missing From: header"},{"name":"GAPPY_SUBJECT","description":"Subject: contains G.a.p.p.y-T.e.x.t"},{"name":"PREVENT_NONDELIVERY","description":"Message has Prevent-NonDelivery-Report header"},{"name":"X_IP","description":"Message has X-IP header"},{"name":"MISSING_MIMEOLE","description":"Message has X-MSMail-Priority, but no X-MimeOLE"},{"name":"SUBJ_AS_SEEN","description":"Subject contains \"As Seen\""},{"name":"SUBJ_DOLLARS","description":"Subject starts with dollar amount"},{"name":"SUBJ_YOUR_DEBT","description":"Subject contains \"Your Bills\" or similar"},{"name":"SUBJ_YOUR_FAMILY","description":"Subject contains \"Your Family\""},{"name":"RCVD_FAKE_HELO_DOTCOM","description":"Received contains a faked HELO hostname"},{"name":"SUBJECT_DIET","description":"Subject talks about losing pounds"},{"name":"MIME_BOUND_DD_DIGITS","description":"Spam tool pattern in MIME boundary"},{"name":"MIME_BOUND_DIGITS_15","description":"Spam tool pattern in MIME boundary"},{"name":"MIME_BOUND_MANY_HEX","description":"Spam tool pattern in MIME boundary"},{"name":"TO_MALFORMED","description":"To: has a malformed address"},{"name":"MIME_HEADER_CTYPE_ONLY","description":"'Content-Type' found without required MIME headers"},{"name":"WITH_LC_SMTP","description":"Received line contains spam-sign (lowercase smtp)"},{"name":"SUBJ_BUY","description":"Subject line starts with Buy or Buying"},{"name":"RCVD_AM_PM","description":"Received headers forged (AM/PM)"},{"name":"FAKE_OUTBLAZE_RCVD","description":"Received header contains faked 'mr.outblaze.com'"},{"name":"UNCLOSED_BRACKET","description":"Headers contain an unclosed bracket"},{"name":"FROM_DOMAIN_NOVOWEL","description":"From: domain has series of non-vowel letters"},{"name":"FROM_LOCAL_NOVOWEL","description":"From: localpart has series of non-vowel letters"},{"name":"FROM_LOCAL_HEX","description":"From: localpart has long hexadecimal sequence"},{"name":"FROM_LOCAL_DIGITS","description":"From: localpart has long digit sequence"},{"name":"X_PRIORITY_CC","description":"Cc: after X-Priority: (bulk email fingerprint)"},{"name":"BAD_ENC_HEADER","description":"Message has bad MIME encoding in the header"},{"name":"__VIA_ML","description":"Mail from a mailing list"},{"name":"__ML_TURNS_SP_TO_TAB","description":"A mailing list changing a space to a TAB"},{"name":"RCVD_ILLEGAL_IP","description":"Received: contains illegal IP address"},{"name":"CHARSET_FARAWAY_HEADER","description":"A foreign language charset used in headers"},{"name":"SUBJ_ILLEGAL_CHARS","description":"Subject: has too many raw illegal characters"},{"name":"FROM_ILLEGAL_CHARS","description":"From: has too many raw illegal characters"},{"name":"HEAD_ILLEGAL_CHARS","description":"Headers have too many raw illegal characters"},{"name":"FORGED_HOTMAIL_RCVD2","description":"hotmail.com 'From' address, but no 'Received:'"},{"name":"FORGED_YAHOO_RCVD","description":"'From' yahoo.com does not match 'Received' headers"},{"name":"FORGED_GMAIL_RCVD","description":"'From' gmail.com does not match 'Received' headers"},{"name":"SORTED_RECIPS","description":"Recipient list is sorted by address"},{"name":"SUSPICIOUS_RECIPS","description":"Similar addresses in recipient list"},{"name":"MISSING_HEADERS","description":"Missing To: header"},{"name":"DATE_IN_PAST_03_06","description":"Date: is 3 to 6 hours before Received: date"},{"name":"DATE_IN_PAST_06_12","description":"Date: is 6 to 12 hours before Received: date"},{"name":"DATE_IN_PAST_12_24","description":"Date: is 12 to 24 hours before Received: date"},{"name":"DATE_IN_PAST_24_48","description":"Date: is 24 to 48 hours before Received: date"},{"name":"DATE_IN_PAST_96_XX","description":"Date: is 96 hours or more before Received: date"},{"name":"DATE_IN_FUTURE_03_06","description":"Date: is 3 to 6 hours after Received: date"},{"name":"DATE_IN_FUTURE_06_12","description":"Date: is 6 to 12 hours after Received: date"},{"name":"DATE_IN_FUTURE_12_24","description":"Date: is 12 to 24 hours after Received: date"},{"name":"DATE_IN_FUTURE_24_48","description":"Date: is 24 to 48 hours after Received: date"},{"name":"DATE_IN_FUTURE_48_96","description":"Date: is 48 to 96 hours after Received: date"},{"name":"DATE_IN_FUTURE_96_XX","description":"Date: is 96 hours or more after Received: date"},{"name":"UNRESOLVED_TEMPLATE","description":"Headers contain an unresolved template"},{"name":"SUBJ_ALL_CAPS","description":"Subject is all capitals"},{"name":"LOCALPART_IN_SUBJECT","description":"Local part of To: address appears in Subject"},{"name":"MSGID_OUTLOOK_INVALID","description":"Message-Id is fake (in Outlook Express format)"},{"name":"HEADER_COUNT_CTYPE","description":"Multiple Content-Type headers found"},{"name":"HEAD_LONG","description":"Message headers are very long"},{"name":"MISSING_HB_SEP","description":"Missing blank line between message header and body"},{"name":"UNPARSEABLE_RELAY","description":"Informational: message has unparseable relay lines"},{"name":"RCVD_HELO_IP_MISMATCH","description":"Received: HELO and IP do not match, but should"},{"name":"NO_RDNS_DOTCOM_HELO","description":"Host HELO'd as a big ISP, but had no rDNS"},{"name":"HTML_SHORT_LINK_IMG_1","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_LINK_IMG_2","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_LINK_IMG_3","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_CENTER","description":"HTML is very short with CENTER tag"},{"name":"HTML_CHARSET_FARAWAY","description":"A foreign language charset used in HTML markup"},{"name":"HTML_MIME_NO_HTML_TAG","description":"HTML-only message, but there is no HTML tag"},{"name":"HTML_MISSING_CTYPE","description":"Message is HTML without HTML Content-Type"},{"name":"HIDE_WIN_STATUS","description":"Javascript to hide URLs in browser"},{"name":"OBFUSCATING_COMMENT","description":"HTML comments which obfuscate text"},{"name":"JS_FROMCHARCODE","description":"Document is built from a Javascript charcode array"},{"name":"ENTITY_DEC_OTHER","description":"HTML contains needlessly encoded punctuation"},{"name":"HTML_MESSAGE","description":"HTML included in message"},{"name":"HTML_COMMENT_SHORT","description":"HTML comment is very short"},{"name":"HTML_COMMENT_SAVED_URL","description":"HTML message is a saved web page"},{"name":"HTML_EMBEDS","description":"HTML with embedded plugin object"},{"name":"HTML_EXTRA_CLOSE","description":"HTML contains far too many close tags"},{"name":"HTML_FONT_SIZE_LARGE","description":"HTML font size is large"},{"name":"HTML_FONT_SIZE_HUGE","description":"HTML font size is huge"},{"name":"HTML_FONT_LOW_CONTRAST","description":"HTML font color similar or identical to background"},{"name":"HTML_FONT_FACE_BAD","description":"HTML font face is not a word"},{"name":"HTML_FORMACTION_MAILTO","description":"HTML includes a form which sends mail"},{"name":"HTML_IMAGE_ONLY_04","description":"HTML: images with 0-400 bytes of words"},{"name":"HTML_IMAGE_ONLY_08","description":"HTML: images with 400-800 bytes of words"},{"name":"HTML_IMAGE_ONLY_12","description":"HTML: images with 800-1200 bytes of words"},{"name":"HTML_IMAGE_ONLY_16","description":"HTML: images with 1200-1600 bytes of words"},{"name":"HTML_IMAGE_ONLY_20","description":"HTML: images with 1600-2000 bytes of words"},{"name":"HTML_IMAGE_ONLY_24","description":"HTML: images with 2000-2400 bytes of words"},{"name":"HTML_IMAGE_ONLY_28","description":"HTML: images with 2400-2800 bytes of words"},{"name":"HTML_IMAGE_ONLY_32","description":"HTML: images with 2800-3200 bytes of words"},{"name":"HTML_IMAGE_RATIO_02","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_04","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_06","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_08","description":"HTML has a low ratio of text to image area"},{"name":"HTML_OBFUSCATE_05_10","description":"Message is 5% to 10% HTML obfuscation"},{"name":"HTML_OBFUSCATE_10_20","description":"Message is 10% to 20% HTML obfuscation"},{"name":"HTML_OBFUSCATE_20_30","description":"Message is 20% to 30% HTML obfuscation"},{"name":"HTML_OBFUSCATE_30_40","description":"Message is 30% to 40% HTML obfuscation"},{"name":"HTML_OBFUSCATE_50_60","description":"Message is 50% to 60% HTML obfuscation"},{"name":"HTML_OBFUSCATE_70_80","description":"Message is 70% to 80% HTML obfuscation"},{"name":"HTML_OBFUSCATE_90_100","description":"Message is 90% to 100% HTML obfuscation"},{"name":"HTML_TAG_BALANCE_BODY","description":"HTML has unbalanced \"body\" tags"},{"name":"HTML_TAG_BALANCE_HEAD","description":"HTML has unbalanced \"head\" tags"},{"name":"HTML_TAG_EXIST_BGSOUND","description":"HTML has \"bgsound\" tag"},{"name":"HTML_BADTAG_40_50","description":"HTML message is 40% to 50% bad tags"},{"name":"HTML_BADTAG_50_60","description":"HTML message is 50% to 60% bad tags"},{"name":"HTML_BADTAG_60_70","description":"HTML message is 60% to 70% bad tags"},{"name":"HTML_BADTAG_90_100","description":"HTML message is 90% to 100% bad tags"},{"name":"HTML_NONELEMENT_30_40","description":"30% to 40% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_40_50","description":"40% to 50% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_60_70","description":"60% to 70% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_80_90","description":"80% to 90% of HTML elements are non-standard"},{"name":"HTML_IFRAME_SRC","description":"Message has HTML IFRAME tag with SRC URI"},{"name":"__DC_IMG_HTML_RATIO","description":"Low rawbody to pixel area ratio"},{"name":"__DC_IMG_TEXT_RATIO","description":"Low body to pixel area ratio"},{"name":"DC_GIF_UNO_LARGO","description":"Message contains a single large gif image"},{"name":"__DC_GIF_MULTI_LARGO","description":"Message has 2+ inline gif covering lots of area"},{"name":"DC_PNG_UNO_LARGO","description":"Message contains a single large png image"},{"name":"__DC_PNG_MULTI_LARGO","description":"Message has 2+ png images covering lots of area"},{"name":"DC_IMAGE_SPAM_TEXT","description":"Possible Image-only spam with little text"},{"name":"DC_IMAGE_SPAM_HTML","description":"Possible Image-only spam"},{"name":"__RCVD_IN_MSPIKE_Z","description":"Spam wave participant"},{"name":"RCVD_IN_MSPIKE_L5","description":"Very bad reputation (-5)"},{"name":"RCVD_IN_MSPIKE_L4","description":"Bad reputation (-4)"},{"name":"RCVD_IN_MSPIKE_L3","description":"Low reputation (-3)"},{"name":"RCVD_IN_MSPIKE_L2","description":"Suspicious reputation (-2)"},{"name":"RCVD_IN_MSPIKE_H5","description":"Excellent reputation (+5)"},{"name":"RCVD_IN_MSPIKE_H4","description":"Very Good reputation (+4)"},{"name":"RCVD_IN_MSPIKE_H3","description":"Good reputation (+3)"},{"name":"RCVD_IN_MSPIKE_H2","description":"Average reputation (+2)"},{"name":"RCVD_IN_MSPIKE_BL","description":"Mailspike blacklisted"},{"name":"RCVD_IN_MSPIKE_WL","description":"Mailspike good senders"},{"name":"UPPERCASE_50_75","description":"message body is 50-75% uppercase"},{"name":"UPPERCASE_75_100","description":"message body is 75-100% uppercase"},{"name":"INVALID_MSGID","description":"Message-Id is not valid, according to RFC 2822"},{"name":"FORGED_MUA_MOZILLA","description":"Forged mail pretending to be from Mozilla"},{"name":"PERCENT_RANDOM","description":"Message has a random macro in it"},{"name":"EMPTY_MESSAGE","description":"Message appears to have no textual parts and no Subject: text"},{"name":"NO_HEADERS_MESSAGE","description":"Message appears to be missing most RFC-822 headers"},{"name":"DIGEST_MULTIPLE","description":"Message hits more than one network digest check"},{"name":"NO_DNS_FOR_FROM","description":"Envelope sender has no MX or A DNS records"},{"name":"GMD_PDF_HORIZ","description":"Contains pdf 100-240 (high) x 450-800 (wide)"},{"name":"GMD_PDF_SQUARE","description":"Contains pdf 180-360 (high) x 180-360 (wide)"},{"name":"GMD_PDF_VERT","description":"Contains pdf 450-800 (high) x 100-240 (wide)"},{"name":"GMD_PDF_FUZZY1_T1","description":"Fuzzy MD5 Match 57EBC1FFB1A24CC14AE23E1E227C3484"},{"name":"GMD_PDF_FUZZY2_T1","description":"Fuzzy MD5 Match 653C8AA9FDFD03D382523488058360A2"},{"name":"GMD_AUTHOR_COLET","description":"PDF author was 'colet'"},{"name":"GMD_AUTHOR_MOBILE","description":"PDF author was 'mobile'"},{"name":"GMD_AUTHOR_OOO","description":"PDF author was 'openofficeuser'"},{"name":"GMD_AUTHOR_HPADMIN","description":"PDF author was 'HP_Administrator'"},{"name":"GMD_PRODUCER_GPL","description":"PDF producer was GPL Ghostscript"},{"name":"GMD_PRODUCER_POWERPDF","description":"PDF producer was PowerPDF"},{"name":"GMD_PRODUCER_EASYPDF","description":"PDF producer was BCL easyPDF"},{"name":"GMD_PDF_ENCRYPTED","description":"Attached PDF is encrypted"},{"name":"GMD_PDF_EMPTY_BODY","description":"Attached PDF with empty message body"},{"name":"GMD_PDF_STOX_M1","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M2","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M3","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M4","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M5","description":"PDF Stox Spam"},{"name":"REMOVE_BEFORE_LINK","description":"Removal phrase right before a link"},{"name":"GUARANTEED_100_PERCENT","description":"One hundred percent guaranteed"},{"name":"DEAR_FRIEND","description":"Dear Friend? That's not very dear!"},{"name":"DEAR_SOMETHING","description":"Contains 'Dear (something)'"},{"name":"BILLION_DOLLARS","description":"Talks about lots of money"},{"name":"EXCUSE_4","description":"Claims you can be removed from the list"},{"name":"EXCUSE_REMOVE","description":"Talks about how to be removed from mailings"},{"name":"STRONG_BUY","description":"Tells you about a strong buy"},{"name":"STOCK_ALERT","description":"Offers a alert about a stock"},{"name":"NOT_ADVISOR","description":"Not registered investment advisor"},{"name":"PREST_NON_ACCREDITED","description":"'Prestigious Non-Accredited Universities'"},{"name":"BODY_ENHANCEMENT","description":"Information on growing body parts"},{"name":"BODY_ENHANCEMENT2","description":"Information on getting larger body parts"},{"name":"IMPOTENCE","description":"Impotence cure"},{"name":"NA_DOLLARS","description":"Talks about a million North American dollars"},{"name":"US_DOLLARS_3","description":"Mentions millions of $ ($NN,NNN,NNN.NN)"},{"name":"MILLION_USD","description":"Talks about millions of dollars"},{"name":"URG_BIZ","description":"Contains urgent matter"},{"name":"MONEY_BACK","description":"Money back guarantee"},{"name":"FREE_QUOTE_INSTANT","description":"Free express or no-obligation quote"},{"name":"BAD_CREDIT","description":"Eliminate Bad Credit"},{"name":"REFINANCE_YOUR_HOME","description":"Home refinancing"},{"name":"REFINANCE_NOW","description":"Home refinancing"},{"name":"NO_MEDICAL","description":"No Medical Exams"},{"name":"DIET_1","description":"Lose Weight Spam"},{"name":"FIN_FREE","description":"Freedom of a financial nature"},{"name":"FORWARD_LOOKING","description":"Stock Disclaimer Statement"},{"name":"ONE_TIME","description":"One Time Rip Off"},{"name":"JOIN_MILLIONS","description":"Join Millions of Americans"},{"name":"MARKETING_PARTNERS","description":"Claims you registered with a partner"},{"name":"LOW_PRICE","description":"Lowest Price"},{"name":"UNCLAIMED_MONEY","description":"People just leave money laying around"},{"name":"OBSCURED_EMAIL","description":"Message seems to contain rot13ed address"},{"name":"BANG_OPRAH","description":"Talks about Oprah with an exclamation!"},{"name":"ACT_NOW_CAPS","description":"Talks about 'acting now' with capitals"},{"name":"MORE_SEX","description":"Talks about a bigger drive for sex"},{"name":"BANG_GUAR","description":"Something is emphatically guaranteed"},{"name":"RUDE_HTML","description":"Spammer message says you need an HTML mailer"},{"name":"INVESTMENT_ADVICE","description":"Message mentions investment advice"},{"name":"MALE_ENHANCE","description":"Message talks about enhancing men"},{"name":"PRICES_ARE_AFFORDABLE","description":"Message says that prices aren't too expensive"},{"name":"REPLICA_WATCH","description":"Message talks about a replica watch"},{"name":"EM_ROLEX","description":"Message puts emphasis on the watch manufacturer"},{"name":"FREE_PORN","description":"Possible porn - Free Porn"},{"name":"CUM_SHOT","description":"Possible porn - Cum Shot"},{"name":"LIVE_PORN","description":"Possible porn - Live Porn"},{"name":"SUBJECT_SEXUAL","description":"Subject indicates sexually-explicit content"},{"name":"RATWARE_EGROUPS","description":"Bulk email fingerprint (eGroups) found"},{"name":"RATWARE_OE_MALFORMED","description":"X-Mailer has malformed Outlook Express version"},{"name":"RATWARE_MOZ_MALFORMED","description":"Bulk email fingerprint (Mozilla malformed) found"},{"name":"RATWARE_MPOP_WEBMAIL","description":"Bulk email fingerprint (mPOP Web-Mail)"},{"name":"FORGED_MUA_IMS","description":"Forged mail pretending to be from IMS"},{"name":"FORGED_MUA_OUTLOOK","description":"Forged mail pretending to be from MS Outlook"},{"name":"FORGED_MUA_OIMO","description":"Forged mail pretending to be from MS Outlook IMO"},{"name":"MAILING_LIST_MULTI","description":"Multiple indicators imply a widely-seen list manager"},{"name":"FORGED_MUA_EUDORA","description":"Forged mail pretending to be from Eudora"},{"name":"FORGED_MUA_THEBAT_CS","description":"Mail pretending to be from The Bat! (charset)"},{"name":"FORGED_MUA_THEBAT_BOUN","description":"Mail pretending to be from The Bat! (boundary)"},{"name":"FORGED_OUTLOOK_HTML","description":"Outlook can't send HTML message only"},{"name":"FORGED_IMS_HTML","description":"IMS can't send HTML message only"},{"name":"FORGED_THEBAT_HTML","description":"The Bat! can't send HTML message only"},{"name":"REPTO_QUOTE_AOL","description":"AOL doesn't do quoting like this"},{"name":"REPTO_QUOTE_IMS","description":"IMS doesn't do quoting like this"},{"name":"REPTO_QUOTE_MSN","description":"MSN doesn't do quoting like this"},{"name":"REPTO_QUOTE_QUALCOMM","description":"Qualcomm/Eudora doesn't do quoting like this"},{"name":"REPTO_QUOTE_YAHOO","description":"Yahoo! doesn't do quoting like this"},{"name":"FORGED_QUALCOMM_TAGS","description":"QUALCOMM mailers can't send HTML in this format"},{"name":"FORGED_IMS_TAGS","description":"IMS mailers can't send HTML in this format"},{"name":"FORGED_OUTLOOK_TAGS","description":"Outlook can't send HTML in this format"},{"name":"RATWARE_HASH_DASH","description":"Contains a hashbuster in Send-Safe format"},{"name":"RATWARE_ZERO_TZ","description":"Bulk email fingerprint (+0000) found"},{"name":"X_MESSAGE_INFO","description":"Bulk email fingerprint (X-Message-Info) found"},{"name":"HEADER_SPAM","description":"Bulk email fingerprint (header-based) found"},{"name":"RATWARE_RCVD_PF","description":"Bulk email fingerprint (Received PF) found"},{"name":"RATWARE_RCVD_AT","description":"Bulk email fingerprint (Received @) found"},{"name":"RATWARE_OUTLOOK_NONAME","description":"Bulk email fingerprint (Outlook no name) found"},{"name":"RATWARE_MS_HASH","description":"Bulk email fingerprint (msgid ms hash) found"},{"name":"RATWARE_NAME_ID","description":"Bulk email fingerprint (msgid from) found"},{"name":"RATWARE_EFROM","description":"Bulk email fingerprint (envfrom) found"},{"name":"NUMERIC_HTTP_ADDR","description":"Uses a numeric IP address in URL"},{"name":"HTTP_ESCAPED_HOST","description":"Uses %-escapes inside a URL's hostname"},{"name":"HTTP_EXCESSIVE_ESCAPES","description":"Completely unnecessary %-escapes inside a URL"},{"name":"IP_LINK_PLUS","description":"Dotted-decimal IP address followed by CGI"},{"name":"WEIRD_PORT","description":"Uses non-standard port number for HTTP"},{"name":"HTTP_ENTITIES_HOST","description":"URI obscured with character entities"},{"name":"YAHOO_RD_REDIR","description":"Has Yahoo Redirect URI"},{"name":"YAHOO_DRS_REDIR","description":"Has Yahoo Redirect URI"},{"name":"HTTP_77","description":"Contains an URL-encoded hostname (HTTP77)"},{"name":"SPOOF_COM2OTH","description":"URI contains \".com\" in middle"},{"name":"SPOOF_COM2COM","description":"URI contains \".com\" in middle and end"},{"name":"SPOOF_NET2COM","description":"URI contains \".net\" or \".org\", then \".com\""},{"name":"URI_HEX","description":"URI hostname has long hexadecimal sequence"},{"name":"URI_NOVOWEL","description":"URI hostname has long non-vowel sequence"},{"name":"URI_UNSUBSCRIBE","description":"URI contains suspicious unsubscribe link"},{"name":"URI_NO_WWW_INFO_CGI","description":"CGI in .info TLD other than third-level \"www\""},{"name":"URI_NO_WWW_BIZ_CGI","description":"CGI in .biz TLD other than third-level \"www\""},{"name":"NORMAL_HTTP_TO_IP","description":"URI host has a public dotted-decimal IPv4 address"},{"name":"BOUNCE_MESSAGE","description":"MTA bounce message"},{"name":"OOOBOUNCE_MESSAGE","description":"Out Of Office bounce message"},{"name":"CHALLENGE_RESPONSE","description":"Challenge-Response message for mail you sent"},{"name":"CRBOUNCE_MESSAGE","description":"Challenge-Response bounce message"},{"name":"VBOUNCE_MESSAGE","description":"Virus-scanner bounce message"},{"name":"ANY_BOUNCE_MESSAGE","description":"Message is some kind of bounce message"},{"name":"BAYES_00","description":"Bayes spam probability is 0 to 1%"},{"name":"BAYES_05","description":"Bayes spam probability is 1 to 5%"},{"name":"BAYES_20","description":"Bayes spam probability is 5 to 20%"},{"name":"BAYES_40","description":"Bayes spam probability is 20 to 40%"},{"name":"BAYES_50","description":"Bayes spam probability is 40 to 60%"},{"name":"BAYES_60","description":"Bayes spam probability is 60 to 80%"},{"name":"BAYES_80","description":"Bayes spam probability is 80 to 95%"},{"name":"BAYES_95","description":"Bayes spam probability is 95 to 99%"},{"name":"BAYES_99","description":"Bayes spam probability is 99 to 100%"},{"name":"BAYES_999","description":"Bayes spam probability is 99.9 to 100%"},{"name":"ACCESSDB","description":"Message would have been caught by accessdb"},{"name":"MICROSOFT_EXECUTABLE","description":"Message includes Microsoft executable program"},{"name":"MIME_SUSPECT_NAME","description":"MIME filename does not match content"},{"name":"DCC_CHECK","description":"Detected as bulk mail by DCC (dcc-servers.net)"},{"name":"DCC_REPUT_00_12","description":"DCC reputation between 0 and 12 %  (mostly ham)"},{"name":"DCC_REPUT_13_19","description":"DCC reputation between 13 and 19 %"},{"name":"DCC_REPUT_70_89","description":"DCC reputation between 70 and 89 %"},{"name":"DCC_REPUT_90_94","description":"DCC reputation between 90 and 94 %"},{"name":"DCC_REPUT_95_98","description":"DCC reputation between 95 and 98 %  (mostly spam)"},{"name":"DCC_REPUT_99_100","description":"DCC reputation between 99 % or higher (spam)"},{"name":"DKIM_SIGNED","description":"Message has a DKIM or DK signature, not necessarily valid"},{"name":"DKIM_VALID","description":"Message has at least one valid DKIM or DK signature"},{"name":"DKIM_INVALID","description":"DKIM or DK signature exists, but is not valid"},{"name":"DKIM_VALID_AU","description":"Message has a valid DKIM or DK signature from author's domain"},{"name":"DKIM_VALID_EF","description":"Message has a valid DKIM or DK signature from envelope-from domain"},{"name":"__DKIM_DEPENDABLE","description":"A validation failure not attributable to truncation"},{"name":"DKIM_ADSP_NXDOMAIN","description":"No valid author signature and domain not in DNS"},{"name":"DKIM_ADSP_DISCARD","description":"No valid author signature, domain signs all mail and suggests discarding the rest"},{"name":"DKIM_ADSP_ALL","description":"No valid author signature, domain signs all mail"},{"name":"DKIM_ADSP_CUSTOM_LOW","description":"No valid author signature, adsp_override is CUSTOM_LOW"},{"name":"DKIM_ADSP_CUSTOM_MED","description":"No valid author signature, adsp_override is CUSTOM_MED"},{"name":"DKIM_ADSP_CUSTOM_HIGH","description":"No valid author signature, adsp_override is CUSTOM_HIGH"},{"name":"__VIA_RESIGNER","description":"Mail through a popular signing remailer"},{"name":"NML_ADSP_CUSTOM_LOW","description":"ADSP custom_low hit, and not from a mailing list"},{"name":"NML_ADSP_CUSTOM_MED","description":"ADSP custom_med hit, and not from a mailing list"},{"name":"NML_ADSP_CUSTOM_HIGH","description":"ADSP custom_high hit, and not from a mailing list"},{"name":"RCVD_IN_DNSWL_NONE","description":"Sender listed at https://www.dnswl.org/, no trust"},{"name":"RCVD_IN_DNSWL_LOW","description":"Sender listed at https://www.dnswl.org/, low trust"},{"name":"RCVD_IN_DNSWL_MED","description":"Sender listed at https://www.dnswl.org/, medium trust"},{"name":"RCVD_IN_DNSWL_HI","description":"Sender listed at https://www.dnswl.org/, high trust"},{"name":"RCVD_IN_DNSWL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to DNSWL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"PYZOR_CHECK","description":"Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)"},{"name":"RAZOR2_CHECK","description":"Listed in Razor2 (http://razor.sf.net/)"},{"name":"RAZOR2_CF_RANGE_51_100","description":"Razor2 gives confidence level above 50%"},{"name":"SUBJECT_FUZZY_MEDS","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_VPILL","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_CHEAP","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_PENIS","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_TION","description":"Attempt to obfuscate words in Subject:"},{"name":"FUZZY_AFFORDABLE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_AMBIEN","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_BILLION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_CPILL","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_CREDIT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_ERECT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_GUARANTEE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MEDICATION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MILLION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MONEY","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MORTGAGE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_OBLIGATION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_OFFERS","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PHARMACY","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PHENT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PRESCRIPT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PRICES","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_REFINANCE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_REMOVE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_ROLEX","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_SOFTWARE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_THOUSANDS","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VLIUM","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VIOXX","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VPILL","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_XPILL","description":"Attempt to obfuscate words in spam"},{"name":"SPF_PASS","description":"SPF: sender matches SPF record"},{"name":"SPF_NEUTRAL","description":"SPF: sender does not match SPF record (neutral)"},{"name":"SPF_FAIL","description":"SPF: sender does not match SPF record (fail)"},{"name":"SPF_SOFTFAIL","description":"SPF: sender does not match SPF record (softfail)"},{"name":"SPF_HELO_PASS","description":"SPF: HELO matches SPF record"},{"name":"SPF_HELO_NEUTRAL","description":"SPF: HELO does not match SPF record (neutral)"},{"name":"SPF_HELO_FAIL","description":"SPF: HELO does not match SPF record (fail)"},{"name":"SPF_HELO_SOFTFAIL","description":"SPF: HELO does not match SPF record (softfail)"},{"name":"SPF_NONE","description":"SPF: sender does not publish an SPF Record"},{"name":"SPF_HELO_NONE","description":"SPF: HELO does not publish an SPF Record"},{"name":"T_SPF_PERMERROR","description":"SPF: test of record failed (permerror)"},{"name":"T_SPF_TEMPERROR","description":"SPF: test of record failed (temperror)"},{"name":"T_SPF_HELO_PERMERROR","description":"SPF: test of HELO record failed (permerror)"},{"name":"T_SPF_HELO_TEMPERROR","description":"SPF: test of HELO record failed (temperror)"},{"name":"UNWANTED_LANGUAGE_BODY","description":"Message written in an undesired language"},{"name":"BODY_8BITS","description":"Body includes 8 consecutive 8-bit characters"},{"name":"URIBL_SBL","description":"Contains an URL's NS IP listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS","description":"Contains an URL's NS IP listed in the Spamhaus CSS blocklist"},{"name":"URIBL_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_DBL_SPAM","description":"Contains a spam URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_PHISH","description":"Contains a Phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_MALWARE","description":"Contains a malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_BOTNETCC","description":"Contains a botned C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_SPAM","description":"Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_REDIR","description":"Contains an abused redirector URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_PHISH","description":"Contains an abused phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_MALW","description":"Contains an abused malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_BOTCC","description":"Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ERROR","description":"Error: queried the Spamhaus DBL blocklist for an IP"},{"name":"URIBL_DBL_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_DBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_SC_SURBL","description":"Contains an URL listed in the SC SURBL blocklist"},{"name":"URIBL_WS_SURBL","description":"Contains an URL listed in the WS SURBL blocklist"},{"name":"URIBL_PH_SURBL","description":"Contains an URL listed in the PH SURBL blocklist"},{"name":"URIBL_MW_SURBL","description":"Contains a URL listed in the MW SURBL blocklist"},{"name":"URIBL_CR_SURBL","description":"Contains an URL listed in the CR SURBL blocklist"},{"name":"URIBL_AB_SURBL","description":"Contains an URL listed in the AB SURBL blocklist"},{"name":"URIBL_ABUSE_SURBL","description":"Contains an URL listed in the ABUSE SURBL blocklist"},{"name":"SURBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to SURBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"URIBL_BLACK","description":"Contains an URL listed in the URIBL blacklist"},{"name":"URIBL_GREY","description":"Contains an URL listed in the URIBL greylist"},{"name":"URIBL_RED","description":"Contains an URL listed in the URIBL redlist"},{"name":"URIBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to URIBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"LONGLINE","description":"Line length exceeds 998 character limit, RFC 5322"},{"name":"RP_8BIT","description":"Return-Path contains 8-bit characters with high bit on"},{"name":"RP_LASTNAME","description":"Return-Path says LAST_NAME literally"},{"name":"RP_UNDERLINE","description":"Return-Path address starts with an underline"},{"name":"RP_MINUS","description":"Return-Path address starts with a minus"},{"name":"CR_IN_SUBJ","description":"Subject contains a CR character"},{"name":"FROM_UNBAL1","description":"From with unbalanced angle brackets, '>' missing"},{"name":"FROM_UNBAL2","description":"From with unbalanced angle brackets, '<' missing"},{"name":"FROM_WSP_TRAIL","description":"Trailing whitespace before '>' in From header field"},{"name":"FROM_WSP_LEAD","description":"Leading whitespace after '<' in From header field"},{"name":"MSGID_WSP_TRAIL","description":"Trailing whitespace before '>' in Message-ID header"},{"name":"MSGID_NOFQDN1","description":"Message-ID with no domain name"},{"name":"MSGID_NOFQDN2","description":"Message-ID without a fully-qualified domain name"},{"name":"SIQ_OI_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_UNKNOWN","description":"Query returned reputation unknown"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_01","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_05","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_10","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_15","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_20","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_25","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_30","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_35","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_40","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_45","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_50","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_55","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_60","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_65","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_70","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_75","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_80","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_85","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_90","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_95","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_99","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_100","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_IP_UNKNOWN","description":"Query returned IP reputation unknown"},{"name":"SIQ_OI_IP_00","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_05","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_10","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_15","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_20","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_25","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_30","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_35","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_40","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_45","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_50","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_55","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_60","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_65","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_70","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_75","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_80","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_85","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_90","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_95","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_99","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_100","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_DOM_UNKNOWN","description":"Query returned domain reputation unknown"},{"name":"SIQ_OI_DOM_00","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_01","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_05","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_10","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_15","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_20","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_25","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_30","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_35","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_40","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_45","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_55","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_60","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_65","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_70","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_75","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_80","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_85","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_90","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_95","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_99","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_100","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_REL_UNKNOWN","description":"Query returned relative reputation unknown"},{"name":"SIQ_OI_REL_00","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_05","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_10","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_15","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_20","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_25","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_30","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_35","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_40","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_45","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_50","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_55","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_60","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_65","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_70","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_75","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_80","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_85","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_90","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_95","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_99","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_100","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1_9","description":"Outbound Index Stability from 1 to 9"},{"name":"SIQ_OI_STAB_10","description":"Outbound Index Stability from 10 to 19"},{"name":"SIQ_OI_STAB_20","description":"Outbound Index Stability from 20 to 29"},{"name":"SIQ_OI_STAB_30","description":"Outbound Index Stability from 30 to 39"},{"name":"SIQ_OI_STAB_40","description":"Outbound Index Stability from 40 to 49"},{"name":"SIQ_OI_STAB_50","description":"Outbound Index Stability from 50 to 59"},{"name":"SIQ_OI_STAB_60","description":"Outbound Index Stability from 60 to 69"},{"name":"SIQ_OI_STAB_70","description":"Outbound Index Stability from 70 to 79"},{"name":"SIQ_OI_STAB_80","description":"Outbound Index Stability from 80 to 89"},{"name":"SIQ_OI_STAB_90","description":"Outbound Index Stability from 90 to 99"},{"name":"SIQ_OI_STAB_100S","description":"Outbound Index Stability from 100 to 999"},{"name":"SIQ_OI_STAB_1000","description":"Outbound Index Stability from 1000 to 1999"},{"name":"SIQ_OI_STAB_2000","description":"Outbound Index Stability from 2000 to 2999"},{"name":"SIQ_OI_STAB_3000","description":"Outbound Index Stability from 3000 to 3999"},{"name":"SIQ_OI_STAB_4000","description":"Outbound Index Stability from 4000 to 4999"},{"name":"SIQ_OI_STAB_5000","description":"Outbound Index Stability of 5000 or more"},{"name":"SIQ_OI_00_100S","description":"OI Rep Score=0 Stability=100-999"},{"name":"SIQ_OI_00_1000","description":"OI Rep Score=0 Stability=1000-1999"},{"name":"SIQ_OI_00_2000","description":"OI Rep Score=0 Stability=2000+"},{"name":"SIQ_OI_01_100S","description":"OI Rep Score=1 Stability=100-999"},{"name":"SIQ_OI_01_1000","description":"OI Rep Score=1 Stability=1000-1999"},{"name":"SIQ_OI_01_2000","description":"OI Rep Score=1 Stability=2000+"},{"name":"SIQ_OI_05_100S","description":"OI Rep Score=2-5 Stability=100-999"},{"name":"SIQ_OI_05_1000","description":"OI Rep Score=2-5 Stability=1000-1999"},{"name":"SIQ_OI_05_2000","description":"OI Rep Score=2-5 Stability=2000+"},{"name":"SERGIO_SUBJECT_VIAGRA01","description":"Viagra garbled subject"},{"name":"SERGIO_SUBJECT_PORN002","description":"Pictures garbled subject"},{"name":"SERGIO_SUBJECT_PORN003","description":"Videos garbled subject"},{"name":"SERGIO_SUBJECT_PORN004","description":"Adult garbled subject"},{"name":"SERGIO_SUBJECT_PORN005","description":"Porn garbled subject"},{"name":"SERGIO_SUBJECT_PORN006","description":"B\\*\\*\\* J\\*\\* garbled subject"},{"name":"SERGIO_SUBJECT_PORN007","description":"Film garbled subject"},{"name":"SERGIO_SUBJECT_PORN008","description":"Mature garbled subject"},{"name":"SERGIO_SUBJECT_PORN009","description":"Undress garbled subject"},{"name":"SERGIO_SUBJECT_PORN010","description":"Movies garbled subject"},{"name":"SERGIO_SUBJECT_PORN011","description":"Sex garbled subject"},{"name":"SERGIO_SUBJECT_PORN012","description":"School garbled subject"},{"name":"SERGIO_SUBJECT_PORN013","description":"Girls garbled subject"},{"name":"SERGIO_SUBJECT_PORN014","description":"F\\*\\*\\* garbled subject"},{"name":"SERGIO_SUBJECT_PORN015","description":"Lesbian garbled subject"},{"name":"FSL_NEW_HELO_USER","description":"Spam's using Helo and User"},{"name":"FSL_XM_419","description":"Old OE version in X-Mailer only seen in 419 spam"},{"name":"FSL_CTYPE_WIN1251","description":"Content-Type only seen in 419 spam"},{"name":"FSL_MID_419","description":"Spam signature in Message-ID"},{"name":"FSL_MISSP_REPLYTO","description":"Mis-spaced from and Reply-to"},{"name":"FSL_YHG_ABUSE","description":"URI pointing to a message in an abused Yahoo Group"},{"name":"FSL_BOTSPAM_1","description":"Two-line spam with URI pointing to .ru domain"},{"name":"FSL_THIS_IS_ADV","description":"This is an advertisement"},{"name":"RCVD_IN_SEMBACKSCATTER","description":"Received from an IP listed by SEM-BACKSCATTER"},{"name":"RCVD_IN_SEMBLACK","description":"Received from an IP listed by SEM-BLACK"},{"name":"SEM_URI","description":"Contains a URI listed by SEM-URI"},{"name":"SEM_URIRED","description":"Contains a URI listed by SEM-URIRED"},{"name":"SEM_FRESH","description":"Contains a domain registered less than 5 days ago"},{"name":"SEM_FRESH_10","description":"Contains a domain registered less than 10 days ago"},{"name":"SEM_FRESH_15","description":"Contains a domain registered less than 15 days ago"},{"name":"REPLYTO_MANY_AT","description":"More than one @ in Reply-To:"},{"name":"SENDER_MANY_AT","description":"More than one @ in Sender:"},{"name":"FROM_MANY_AT","description":"More than one @ in From:"},{"name":"RDNS_LOCALHOST","description":"Sender's public rDNS is \"localhost\""},{"name":"EU_SPAM_LAW","description":"Quoting \"European Parliament\" spam law"},{"name":"HTML_ATTACH","description":"HTML attachment to bypass scanning?"},{"name":"OBFU_HTML_ATTACH","description":"HTML attachment with non-text MIME type"},{"name":"OBFU_TEXT_ATTACH","description":"Text attachment with non-text MIME type"},{"name":"OBFU_DOC_ATTACH","description":"MS Document attachment with generic MIME type"},{"name":"OBFU_PDF_ATTACH","description":"PDF attachment with generic MIME type"},{"name":"OBFU_JPG_ATTACH","description":"JPG attachment with generic MIME type"},{"name":"OBFU_GIF_ATTACH","description":"GIF attachment with generic MIME type"},{"name":"OBFU_ATTACH_MISSP","description":"Obfuscated attachment type and misspaced From"},{"name":"ECMSNGR_MH","description":"eC-Messenger header"},{"name":"CTYPE_NULL","description":"Malformed Content-Type header"},{"name":"OBFU_HTML_ATT_MALW","description":"HTML attachment with incorrect MIME type - possible malware"},{"name":"DOC_ATTACH_NO_EXT","description":"Document attachment with suspicious name"},{"name":"MALW_ATTACH","description":"Attachment filename suspicious, probable malware exploit"},{"name":"ISO_ATTACH","description":"ISO attachment - possible malware delivery"},{"name":"MUA_ONE_WORD","description":"Single word X-Mailer: not CamelCase"},{"name":"DEAR_EMAIL_USER","description":"Dear Email User:"},{"name":"URI_NUMERIC_CCTLD","description":"CCTLD URI with multiple numeric subdomains"},{"name":"PHP_NOVER_MUA","description":"Mail from PHP with no version number"},{"name":"FROM_MISSPACED","description":"From: missing whitespace"},{"name":"FROM_MISSP_EH_MATCH","description":"From misspaced, matches envelope"},{"name":"FROM_MISSP_URI","description":"From misspaced, has URI"},{"name":"FROM_MISSP_USER","description":"From misspaced, from \"User\""},{"name":"FROM_MISSP_NO_TO","description":"From misspaced, To missing"},{"name":"FROM_MISSP_TO_UNDISC","description":"From misspaced, To undisclosed"},{"name":"FROM_MISSP_DKIM","description":"From misspaced, DKIM dependable"},{"name":"FROM_MISSP_REPLYTO","description":"From misspaced, has Reply-To"},{"name":"TO_MISSPACED","description":"To: missing whitespace"},{"name":"FROM_MISSP_FREEMAIL","description":"From misspaced + freemail provider"},{"name":"FROM_MISSP_MSFT","description":"From misspaced + supposed Microsoft tool"},{"name":"FROM_MISSP_DYNIP","description":"From misspaced + dynamic rDNS"},{"name":"MAILER_EQ_ORG","description":"X-Mailer: same as Organization:"},{"name":"FROM_EQ_ORG","description":"From: same as Organization:"},{"name":"HDRS_LCASE","description":"Odd capitalization of message header"},{"name":"MANY_HDRS_LCASE","description":"Odd capitalization of multiple message headers"},{"name":"HDRS_LCASE_1K","description":"Odd capitalization of message headers + long header"},{"name":"HDRS_LCASE_IMGONLY","description":"Odd capitalization of message headers + image-only HTML"},{"name":"MDN_BOTCHED","description":"Malformed return receipt header"},{"name":"HDRS_MISSP","description":"Misspaced headers"},{"name":"SPAMMY_MIME_BDRY_01","description":"Spammy MIME boundary string"},{"name":"TBIRD_SUSP_MIME_BDRY","description":"Unlikely Thunderbird MIME boundary"},{"name":"TBIRD_SPOOF","description":"Claims Thunderbird mail client but looks suspicious"},{"name":"RUNON_SHY","description":"Repeating soft hyphens"},{"name":"LAZY_LISTWASHING","description":"Lazy spammer, painfully obvious bogus addresses"},{"name":"CDISP_SZ_MANY","description":"Suspicious MIME header"},{"name":"FREEMAIL_DOC_PDF","description":"MS document or PDF attachment, from freemail"},{"name":"FREEMAIL_DOC_PDF_BCC","description":"MS document or PDF attachment, from freemail, all recipients hidden"},{"name":"FREEMAIL_RVW_ATTCH","description":"Please review attached document, from freemail"},{"name":"EMPTY_RVW_ATTCH","description":"Please review attached document, empty message"},{"name":"END_FUTURE_EMAILS","description":"Spammy unsubscribe"},{"name":"AD_COMPLAINTS","description":"Complain about this spam"},{"name":"MISQ_HTML","description":"Unbalanced quotes in HTML tag"},{"name":"WIKI_IMG","description":"Image from wikipedia"},{"name":"SUBJ_RE_CLNCLN","description":"Subject RE::"},{"name":"TO_SEM_SEM","description":"To has \";;\""},{"name":"MANY_SUBDOM","description":"Lots and lots of subdomain parts in a URI"},{"name":"RFC_ABUSE_POST","description":"Both abuse and postmaster missing on sender domain"},{"name":"MANY_SPAN_IN_TEXT","description":"Many <SPAN> tags embedded within text"},{"name":"MANY_GOOG_PROXY","description":"Many Google feedproxy URIs"},{"name":"TINY_FLOAT","description":"Has small-font floating HTML - text obfuscation?"},{"name":"__TO_EQ_FROM","description":"To: same as From:"},{"name":"FROM_IN_TO_AND_SUBJ","description":"From address is in To and Subject"},{"name":"TO_IN_SUBJ","description":"To address is in Subject"},{"name":"TO_EQ_FM_HTML_ONLY","description":"To == From and HTML only"},{"name":"TO_EQ_FM_DIRECT_MX","description":"To == From and direct-to-MX"},{"name":"TO_EQ_FM_HTML_DIRECT","description":"To == From and HTML only, direct-to-MX"},{"name":"TO_EQ_FM_SPF_FAIL","description":"To == From and external SPF failed"},{"name":"PDS_TO_EQ_FROM_NAME","description":"From: name same as To: address"},{"name":"__TO_EQ_FROM_DOM","description":"To: domain same as From: domain"},{"name":"TO_EQ_FM_DOM_HTML_ONLY","description":"To domain == From domain and HTML only"},{"name":"TO_EQ_FM_DOM_HTML_IMG","description":"To domain == From domain and HTML image link"},{"name":"TO_EQ_FM_DOM_SPF_FAIL","description":"To domain == From domain and external SPF failed"},{"name":"FROM_URI","description":"URI or www. in From"},{"name":"HAS_APPARENTLY_TO","description":"Has deprecated Apparently-To header"},{"name":"MANY_APPARENTLY_TO","description":"Has many Apparently-To headers"},{"name":"FUZZY_OPTOUT","description":"Obfuscated opt-out text"},{"name":"GAPPY_TRADING","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_SECURITIES","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_RISK","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_SELLING","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_HUNDRED","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_THOUSAND","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_EXPENSES","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_DOLLARS","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_GENITALIA","description":"G.a.p.p.y male body parts"},{"name":"GAPPY_PILLS","description":"G.a.p.p.y pills"},{"name":"STYLE_GIBBERISH","description":"Nonsense in HTML <STYLE> tag"},{"name":"SCRIPT_GIBBERISH","description":"Nonsense in HTML <SCRIPT> tag"},{"name":"COMMENT_GIBBERISH","description":"Nonsense in long HTML comment"},{"name":"BIGNUM_EMAILS","description":"Lots of email addresses/leads"},{"name":"PPMC_FROM_1","description":"Paypal phishing sign"},{"name":"URI_HIDDEN_2","description":"URI contains a hidden file or directory"},{"name":"__NSL_ORIG_FROM_41","description":"Originates from 41.0.0.0/8"},{"name":"__NSL_RCVD_FROM_41","description":"Received from 41.0.0.0/8"},{"name":"MONEY_FROM_41","description":"Lots of money from Africa"},{"name":"__FROM_41_FREEMAIL","description":"Sent from Africa + freemail provider"},{"name":"__FROM_AFR_FREEMAIL","description":"Sent from Africa + freemail provider"},{"name":"NSL_RCVD_HELO_USER","description":"Received from HELO User"},{"name":"NSL_RCVD_FROM_USER","description":"Received from User"},{"name":"DATE_DOTS","description":"Periods in date header"},{"name":"IMAGESHACK_URI","description":"URI contains imageshack.us"},{"name":"DYNDNS_URIS","description":"Has multiple dyndns.org URIs"},{"name":"BITLY_URI","description":"URI contains bit.ly"},{"name":"IMG_VIA_BITLY","description":"HTML image via URL shortener - URIBL avoidance?"},{"name":"URI_OBFU_DOM","description":"URI pretending to be different domain"},{"name":"DQ_URI_DOM_IN_PATH","description":"DQ URI having a domain name in the path part"},{"name":"LH_URI_DOM_IN_PATH","description":"Long-host URI having a domain name in the path part"},{"name":"MANY_BIG_LISTS","description":"Lots of mailing lists / databases available!"},{"name":"GZ_PILL_SQUATTERS","description":"Found a link to rogue pill pusher content"},{"name":"TO_JOHNZY","description":"To a spammy recipent"},{"name":"TO_ONE_CHAR","description":"Bogus TO name"},{"name":"FROM_ONE_CHAR","description":"Bogus FROM name"},{"name":"FROM_12LTRDOM","description":"From a 12-letter domain"},{"name":"MONEY_12LTRDOM","description":"Mentions lots of money and from a 12-letter domain"},{"name":"DG_SPAMMER_EMAIL_B","description":"Recognized spammer email address in body"},{"name":"DG_SPAMMER_EMAIL_F","description":"Recognized spammer email address in From: header"},{"name":"OBFU_JVSCR_ESC","description":"Injects content using obfuscated javascript"},{"name":"LIST_PARTIAL","description":"Has incomplete List-* header set"},{"name":"LIST_PRTL_SAME_USER","description":"Incomplete List-* headers and from+to user the same"},{"name":"LIST_PRTL_PUMPDUMP","description":"Incomplete List-* headers and stock pump-and-dump"},{"name":"__UCOZ_URI","description":"URI contains ucoz.org"},{"name":"ARTHUR_INTRUST","description":"Arthur Simmons - registrar spammer extraordinaire"},{"name":"ART_NAMES_ORG","description":"Arthur Simmons - registrar spammer extraordinaire"},{"name":"ANY_PILL_PRICE","description":"Prices for pills"},{"name":"MANY_PILL_PRICE","description":"Prices for many pills"},{"name":"NSL_FREEMAIL_SUBJ","description":"From freemail with missing subject"},{"name":"NSL_FREEMAIL_M1","description":"From freemail, missing subject and uri or many recips"},{"name":"NSL_FREEMAIL_M2","description":"From freemail with uri and many recips"},{"name":"NSL_TO_ENDS_COMMA","description":"To: ends with a comma"},{"name":"CN_B2B_SPAMMER","description":"Chinese company introducing itself"},{"name":"CN_OPTOUT_EML","description":"Opt-out email address in CN B2B spams"},{"name":"REPLYTO_EMPTY","description":"Reply-To undeliverable"},{"name":"FREEMAIL_MANY_TO","description":"Freemail sender, 50+ exposed recipients"},{"name":"GAPPY_PHONE_NA","description":"Phone number with lots of spaces"},{"name":"GAPPY_HTML","description":"HTML body with much useless whitespace"},{"name":"TVD_SPACE_RATIO_MINFP","description":"Space ratio"},{"name":"SUBJECT_UNNEEDED_ENCODING","description":"Subject encoded but not non-ANSI?"},{"name":"TVD_SPACE_ENCODED","description":"Space ratio & encoded subject"},{"name":"TVD_SPACE_ENC_FM_MIME","description":"Space ratio & encoded subject & MIME needed"},{"name":"SUBJ_BROKEN_WORD","description":"Subject contains odd word break"},{"name":"SUBJ_BROKEN_WORDS","description":"Subject contains multiple odd word breaks"},{"name":"SUBJ_BRKN_WORDNUMS","description":"Subject contains odd word breaks and numbers"},{"name":"XM_PHPMAILER_FORGED","description":"Apparently forged header"},{"name":"XM_EC_MESSENGER","description":"eC-Messenger bulk mail service"},{"name":"SUBJ_OBFU_PUNCT_FEW","description":"Possible punctuation-obfuscated Subject: header"},{"name":"SUBJ_OBFU_PUNCT_MANY","description":"Punctuation-obfuscated Subject: header"},{"name":"SCANNED_EXTERNAL","description":"\"Scanned Document\" email from external source - malware?"},{"name":"LARGE_PCT_AFTER_MANY","description":"Many large percentages after..."},{"name":"ACH_CANCELLED","description":"\"ACH cancelled\" fraud / phish"},{"name":"URI_DBL_INDIR","description":"A URI with two levels of indirection"},{"name":"URI_TRPL_INDIR","description":"A URI with at least three levels of indirection"},{"name":"SUBJ_ODD_CASE","description":"Oddly mixed-case Subject: header"},{"name":"BILL_1618","description":"Mentions proposed US law supposedly permitting spamming"},{"name":"NOT_SPAM","description":"I'm not spam! Really! I'm not, I'm not, I'm not!"},{"name":"URI_MALWARE_SCMS","description":"Link to malware exploit download (.SettingContent-ms file)"},{"name":"URI_MALWARE_BH","description":"Possible BlackHole malware links / phishing"},{"name":"URI_DATA","description":"\"data:\" URI - possible malware or phish"},{"name":"SUBJ_ATTENTION","description":"ATTENTION in Subject"},{"name":"IRS_SPOOF","description":"Claims to be IRS, but not from IRS domain"},{"name":"FBI_SPOOF","description":"Claims to be FBI, but not from FBI domain"},{"name":"FBI_MONEY","description":"The FBI wants to give you lots of money?"},{"name":"FROM_MISSP_PHISH","description":"Malformed, claims to be from financial organization - possible phish"},{"name":"UPGRADE_MAILBOX","description":"Upgrade your mailbox! (phishing?)"},{"name":"ACCT_PHISHING","description":"Possible phishing for account information"},{"name":"ACCT_PHISHING_MANY","description":"Phishing for account information"},{"name":"PHISHING_FREEMAIL","description":"Send your login credentials to some random freemail account"},{"name":"GOOGLE_DOCS_PHISH","description":"Possible phishing via a Google Docs form"},{"name":"GOOGLE_DOCS_PHISH_MANY","description":"Phishing via a Google Docs form"},{"name":"URI_GOOGLE_DOCS","description":"URI for Google Docs, common in phishing"},{"name":"URI_PHISH","description":"Phishing using web form"},{"name":"SYSADMIN","description":"Supposedly from your IT department"},{"name":"HTML_FONT_TINY_NORDNS","description":"Font too small to read, no rDNS"},{"name":"BODY_EMPTY","description":"No body text in message"},{"name":"BODY_URI_ONLY","description":"Message body is only a URI in one line of text or for an image"},{"name":"BODY_SINGLE_WORD","description":"Message body is only one word (no spaces)"},{"name":"BODY_SINGLE_URI","description":"Message body is only a URI"},{"name":"YOUR_PHOTOS","description":"\"Your Photos\" phishing or malware"},{"name":"FORM_LOW_CONTRAST","description":"Fill in a form with hidden text"},{"name":"GAPPY_LOW_CONTRAST","description":"Gappy subject + hidden text"},{"name":"SUBJ_OBFU_LOW_CNTRST","description":"Subject obfuscation + hidden text"},{"name":"URI_DOTDOT_LOW_CNTRST","description":"Suspicious URI + hidden text"},{"name":"STOCK_LOW_CONTRAST","description":"Stocks + hidden text"},{"name":"NORDNS_LOW_CONTRAST","description":"No rDNS + hidden text"},{"name":"FOUND_YOU","description":"I found you..."},{"name":"HTML_FONT_ONE_WORD_MANY","description":"Many one-word font changes"},{"name":"ADMITS_CANSPAM","description":"Admits to being spam"},{"name":"ADMITS_SPAM","description":"Admits this is an ad"},{"name":"OBFU_ADVERT","description":"Misspelled \"advertisement\""},{"name":"REMOVE_YEAHNET","description":"Opt-out address used by CN spammers"},{"name":"ES_LIC_FROM_INFO","description":"Spanish-language spam from .info domain"},{"name":"JIMDO_PHISH","description":"Apparent phishing via webform hosted at jimdo.com"},{"name":"URI_WPADMIN","description":"WordPress login/admin URI, possible phishing"},{"name":"URI_WP_HACKED","description":"URI for compromised WordPress site, possible malware"},{"name":"URI_WP_DIRINDEX","description":"URI for compromised WordPress site, possible malware"},{"name":"URI_WP_HACKED_2","description":"URI for compromised WordPress site, possible malware"},{"name":"XPRIO","description":"Has X-Priority header"},{"name":"XPRIO_SHORT_SUBJ","description":"Has X-Priority header + short subject"},{"name":"FROM_MISSP_XPRIO","description":"Misspaced FROM + X-Priority"},{"name":"STATIC_XPRIO_OLE","description":"Static RDNS + X-Priority + MIMEOLE"},{"name":"HEXHASH_WORD","description":"Multiple instances of word + hexadecimal hash"},{"name":"UC_GIBBERISH_OBFU","description":"Multiple instances of \"word VERYLONGGIBBERISH word\""},{"name":"CANT_SEE_AD","description":"You really want to see our spam."},{"name":"LONG_HEX_URI","description":"Very long purely hexadecimal URI"},{"name":"LONG_IMG_URI","description":"Image URI with very long path component - web bug?"},{"name":"HTML_OFF_PAGE","description":"HTML element rendered well off the displayed page"},{"name":"PUMPDUMP","description":"Pump-and-dump stock scam phrase"},{"name":"PUMPDUMP_MULTI","description":"Pump-and-dump stock scam phrases"},{"name":"STOCK_TIP","description":"Stock tips"},{"name":"PUMPDUMP_TIP","description":"Pump-and-dump stock tip"},{"name":"DR_OZ_OBFU","description":"Obfuscated Doctor Oz"},{"name":"DOC_OZ","description":"Doctor Oz"},{"name":"ADMAIL","description":"\"admail\" and variants"},{"name":"ORS","description":"\"Online Rate Saver\""},{"name":"THIS_AD","description":"\"This ad\" and variants"},{"name":"AD_PREFS","description":"Advertising preferences"},{"name":"URI_OPTOUT_USME","description":"Opt-out URI, unusual TLD"},{"name":"URI_OPTOUT_3LD","description":"Opt-out URI, suspicious hostname"},{"name":"URI_TRY_USME","description":"\"Try it\" URI, unusual TLD"},{"name":"URI_TRY_3LD","description":"\"Try it\" URI, suspicious hostname"},{"name":"DROPBOX_MALW","description":"Spoofed FAX or bank statement with Dropbox link: PROBABLE MALWARE"},{"name":"FUZZY_UNSUBSCRIBE","description":"Obfuscated \"unsubscribe\""},{"name":"FUZZY_ANDROID","description":"Obfuscated \"android\""},{"name":"FUZZY_PROMOTION","description":"Obfuscated \"promotion\""},{"name":"FUZZY_PRIVACY","description":"Obfuscated \"privacy\""},{"name":"FUZZY_BROWSER","description":"Obfuscated \"browser\""},{"name":"FUZZY_SAVINGS","description":"Obfuscated \"savings\""},{"name":"FUZZY_IMPORTANT","description":"Obfuscated \"important\""},{"name":"FUZZY_SECURITY","description":"Obfuscated \"security\""},{"name":"FUZZY_DR_OZ","description":"Obfuscated Doctor Oz"},{"name":"FUZZY_CLICK_HERE","description":"Obfuscated \"click here\""},{"name":"FUZZY_BITCOIN","description":"Obfuscated \"Bitcoin\""},{"name":"FUZZY_WALLET","description":"Obfuscated \"Wallet\""},{"name":"FUZZY_BTC_WALLET","description":"Heavily obfuscated \"bitcoin wallet\""},{"name":"FUZZY_MONERO","description":"Obfuscated \"Monero\""},{"name":"BTC_ORG","description":"Bitcoin wallet ID + unusual header"},{"name":"BITCOIN_PDF","description":"\"Bitcoin\" + PDF attachment"},{"name":"BITCOIN_MALF_HTML","description":"Bitcoin + malformed HTML"},{"name":"BITCOIN_XPRIO","description":"Bitcoin + priority"},{"name":"OBFU_BITCOIN","description":"Obfuscated BitCoin references"},{"name":"BITCOIN_SPAM_01","description":"BitCoin spam pattern 01"},{"name":"BITCOIN_SPAM_02","description":"BitCoin spam pattern 02"},{"name":"BITCOIN_SPAM_03","description":"BitCoin spam pattern 03"},{"name":"BITCOIN_SPAM_04","description":"BitCoin spam pattern 04"},{"name":"BITCOIN_SPAM_05","description":"BitCoin spam pattern 05"},{"name":"BITCOIN_SPAM_06","description":"BitCoin spam pattern 06"},{"name":"BITCOIN_SPAM_07","description":"BitCoin spam pattern 07"},{"name":"BITCOIN_SPAM_08","description":"BitCoin spam pattern 08"},{"name":"BITCOIN_SPAM_09","description":"BitCoin spam pattern 09"},{"name":"BITCOIN_SPAM_10","description":"BitCoin spam pattern 10"},{"name":"BITCOIN_SPAM_11","description":"BitCoin spam pattern 11"},{"name":"BITCOIN_SPAM_12","description":"BitCoin spam pattern 12"},{"name":"BITCOIN_EXTORT_01","description":"Extortion spam, pay via BitCoin"},{"name":"BITCOIN_EXTORT_02","description":"Extortion spam, pay via BitCoin"},{"name":"BITCOIN_PAY_ME","description":"Pay me via BitCoin"},{"name":"BITCOIN_DEADLINE","description":"BitCoin with a deadline"},{"name":"BITCOIN_YOUR_INFO","description":"BitCoin with your personal info"},{"name":"BITCOIN_MALWARE","description":"BitCoin + malware bragging"},{"name":"BITCOIN_BOMB","description":"BitCoin + bomb"},{"name":"MONERO_EXTORT_01","description":"Extortion spam, pay via Monero cryptocurrency"},{"name":"MONERO_PAY_ME","description":"Pay me via Monero cryptocurrency"},{"name":"MONERO_DEADLINE","description":"Monero cryptocurrency with a deadline"},{"name":"MONERO_MALWARE","description":"Monero cryptocurrency + malware bragging"},{"name":"BOMB_FREEM","description":"Bomb + freemail"},{"name":"BOMB_MONEY","description":"Bomb + money: bomb threat?"},{"name":"MALWARE_NORDNS","description":"Malware bragging + no rDNS"},{"name":"MALWARE_PASSWORD","description":"Malware bragging + \"password\""},{"name":"NUM_FREE","description":"Number + free"},{"name":"URI_DQ_UNSUB","description":"IP-address unsubscribe URI"},{"name":"URI_GOOGLE_PROXY","description":"Accessing a blacklisted URI or obscuring source of phish via Google proxy?"},{"name":"TW_GIBBERISH_MANY","description":"Lots of gibberish text to spoof pattern matching filters"},{"name":"OPTOUT_BRKT_MANY","description":"Repetitive opt-outs"},{"name":"__RECIP_IN_URL_DOM","description":"Recipient in body URL"},{"name":"RCVD_DBL_DQ","description":"Malformatted message header"},{"name":"RAND_HEADER_MANY","description":"Many random gibberish message headers"},{"name":"FR_SPAM_LAW","description":"References French privacy law"},{"name":"DUP_SUSP_HDR","description":"Duplicate suspicious message headers"},{"name":"GOOG_MALWARE_DNLD","description":"File download via Google - Malware?"},{"name":"SPELLED_OUT_NUMBER","description":"Spelled out a number (one two three)"},{"name":"SUBJ_UNNEEDED_HTML","description":"Unneeded HTML formatting in Subject:"},{"name":"TEQF_USR_MSGID_MALF","description":"To and from user nearly same + malformed message ID"},{"name":"TEQF_USR_MSGID_HEX","description":"To and from user nearly same + unusual message ID"},{"name":"TEQF_USR_IMAGE","description":"To and from user nearly same + image"},{"name":"TEQF_USR_POLITE","description":"To and from user nearly same + polite greeting"},{"name":"URI_ONLY_MSGID_MALF","description":"URI only + malformed message ID"},{"name":"GOOG_REDIR_SHORT","description":"Google redirect to obscure spamvertised website + short message"},{"name":"GOOG_REDIR_NORDNS","description":"Google redirect to obscure spamvertised website + no rDNS"},{"name":"GOOG_REDIR_HTML_ONLY","description":"Google redirect to obscure spamvertised website + HTML only"},{"name":"HTML_TEXT_INVISIBLE_STYLE","description":"HTML hidden text + other spam signs"},{"name":"STY_INVIS_DIRECT","description":"HTML hidden text + direct-to-MX"},{"name":"LONG_INVISIBLE_TEXT","description":"Long block of hidden text - spam scan evasion?"},{"name":"HTML_TEXT_INVISIBLE_FONT","description":"HTML hidden text - word obfuscation?"},{"name":"FONT_INVIS_LONG_LINE","description":"Invisible text + long lines"},{"name":"FONT_INVIS_NORDNS","description":"Invisible text + no rDNS"},{"name":"FONT_INVIS_POSTEXTRAS","description":"Invisible text + suspicious URI"},{"name":"FONT_INVIS_MSGID","description":"Invisible text + suspicious message ID"},{"name":"FONT_INVIS_NAKED_TO","description":"Invisible text + suspicious To"},{"name":"FONT_INVIS_DIRECT","description":"Invisible text + direct-to-MX"},{"name":"FONT_INVIS_DOTGOV","description":"Invisible text + .gov URI"},{"name":"HTML_SINGLET_MANY","description":"Many single-letter HTML format blocks"},{"name":"SINGLETS_LOW_CONTRAST","description":"Single-letter formatted HTML + hidden text"},{"name":"MALWARE_HACKED_URI","description":"Malware or phishing hosted-file URI at hacked webserver"},{"name":"HACKED_PHP_URI","description":"Possible phishing/malware URI"},{"name":"XMAILER_MANY","description":"Has multiple X-Mailer: headers"},{"name":"RAW_TOKENS","description":"Raw mail merge tokens in body"},{"name":"SPOOFED_FREEM_REPTO_CHN","description":"Forged freemail sender with Chinese freemail reply-to"},{"name":"SPOOFED_FREEM_REPTO_RUS","description":"Forged freemail sender with Russian freemail reply-to"},{"name":"SPOOFED_FREEM_REPTO","description":"Forged freemail sender with freemail reply-to"},{"name":"VERY_LONG_REPTO_SHORT_MSG","description":"Very long Reply-To username + short message"},{"name":"VERY_LONG_FREEM_REPTO","description":"Very long freemail Reply-To username"},{"name":"URI_MALWARE_CWALL","description":"Potential CryptoWall malware URL"},{"name":"LIST_PARTIAL_SHORT_MSG","description":"Incomplete mailing list headers + short message"},{"name":"BOGUS_MSM_HDRS","description":"Apparently bogus Microsoft email headers"},{"name":"MSM_PRIO_REPTO","description":"MSMail priority header + Reply-to + short subject"},{"name":"ENCRYPTED_MESSAGE","description":"Message is encrypted, not likely to be spam"},{"name":"HTML_TAG_BALANCE_CENTER","description":"Malformatted HTML"},{"name":"HDR_CASE_REV_MANY","description":"Multiple malformed (possibly random gibberish) message headers"},{"name":"HDR_CASE_REV_ENC","description":"Malformed (possibly random gibberish) message header + suspicious encoding"},{"name":"HDR_CASE_REV_HELO_IP","description":"Malformed (possibly random gibberish) message header + IP in HELO"},{"name":"FROM_WORDY","description":"From address looks like a sentence"},{"name":"FROM_WORDY_SHORT","description":"From address looks like a sentence + short message"},{"name":"PHP_SCRIPT_MUA","description":"Sent by PHP script, no version number"},{"name":"PHP_ORIG_SCRIPT","description":"Sent by bot & other signs"},{"name":"MIMEOLE_DIRECT_TO_MX","description":"MIMEOLE + direct-to-MX"},{"name":"FROM_FULLN_URL","description":"From address full name is in body URL - possible phishing"},{"name":"PHOTO_EDITING_FREEM","description":"Image editing service, freemail or CHN replyto"},{"name":"PHOTO_EDITING_DIRECT","description":"Image editing service, direct to MX"},{"name":"MARKETING_FREEM","description":"Marketing service, freemail or CHN replyto"},{"name":"MARKETING_SHORT","description":"Marketing service, short message"},{"name":"MARKETING_NO_RDNS","description":"Marketing service, no RDNS"},{"name":"HDR_ORDER_FTSDMCXX_DIRECT","description":"Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX"},{"name":"HDR_ORDER_FTSDMCXX_NORDNS","description":"Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS"},{"name":"UNICODE_OBFU_DOM_NO_BODY","description":"Unicode/chinese obfuscated domain + no body"},{"name":"MULTI_REPTO_NO_RDNS","description":"Multiple Reply-to addresses + no RDNS"},{"name":"FREEM_FRNUM_UNICD_EMPTY","description":"Numeric freemail From address, unicode From name and Subject, empty body"},{"name":"FREEM_FRNUM_EMPTY_NUMSCOM","description":"Numeric freemail From address, unicode From name and Subject, empty body, obfuscated domain name"},{"name":"USB_DRIVES","description":"Trying to sell custom USB flash drives"},{"name":"FRNAME_IN_MSG_XPRIO_NO_SUB","description":"From name in message + X-Priority + short or no subject"},{"name":"FRNAME_IN_MSG_XPRIO","description":"From name in message + X-Priority"},{"name":"FRNAME_IN_MSG_NO_SUBJ","description":"From name in message + short or no subject"},{"name":"RATWARE_NO_RDNS","description":"Suspicious MsgID and MIME boundary + no rDNS"},{"name":"BAT_BDRY_TO_MALF","description":"Bat boundary + misformatted To: address"},{"name":"IMG_ONLY_FM_DOM_INFO","description":"HTML image-only message from .info domain"},{"name":"NO_FM_NAME_IP_HOSTN","description":"No From name + hostname using IP address"},{"name":"FROM_NUMERIC_TLD","description":"From: address has numeric TLD"},{"name":"RDNS_NUM_TLD_XM","description":"Relay rDNS has numeric TLD + suspicious headers"},{"name":"RDNS_NUM_TLD_ATCHNX","description":"Relay rDNS has numeric TLD + suspicious attachment"},{"name":"MALF_HTML_B64","description":"Malformatted base64-encoded HTML content"},{"name":"TO_NAME_SUBJ_NO_RDNS","description":"Recipient username in subject + no rDNS"},{"name":"HTML_SHRT_CMNT_OBFU_MANY","description":"Obfuscation with many short HTML comments"},{"name":"FROM_ADDR_WS","description":"Malformed From address"},{"name":"GAPPY_SALES_LEADS_FREEM","description":"Obfuscated marketing text, freemail or CHN replyto"},{"name":"APP_DEVELOPMENT_FREEM","description":"App development pitch, freemail or CHN replyto"},{"name":"APP_DEVELOPMENT_NORDNS","description":"App development pitch, no rDNS"},{"name":"UNICODE_OBFU_ZW","description":"Obfuscating text with hidden characters"},{"name":"UNICODE_OBFU_ASC","description":"Obfuscating text with unicode"},{"name":"ZW_OBFU_BITCOIN","description":"Obfuscated text + bitcoin ID - possible extortion"},{"name":"ZW_OBFU_FROMTOSUBJ","description":"Obfuscated text + from in to and subject"},{"name":"ZW_OBFU_FREEM","description":"Obfuscated text + freemail"},{"name":"HTML_ENTITY_ASCII","description":"Obfuscated ASCII"},{"name":"HTML_ENTITY_ASCII_TINY","description":"Obfuscated ASCII + tiny fonts"},{"name":"URI_GIBB_NO_PROTO","description":"Long, gibberish, no-protocol URI"},{"name":"AC_FROM_MANY_DOTS","description":"Multiple periods in From user name"},{"name":"AC_POST_EXTRAS","description":"Suspicious URL"},{"name":"URI_BUFFLY","description":"buff.ly redirector URI"},{"name":"SHORTENER_SHORT_IMG","description":"Short HTML + image + URL shortener"},{"name":"FREEM_DATA_ENTRY","description":"Data entry services too cheap to buy a real domain"},{"name":"EBAY_IMG_NOT_RCVD_EBAY","description":"E-bay hosted image but message not from E-bay"},{"name":"AMAZON_IMG_NOT_RCVD_AMZN","description":"Amazon hosted image but message not from Amazon"},{"name":"ALIBABA_IMG_NOT_RCVD_ALI","description":"Alibaba hosted image but message not from Alibaba"},{"name":"WALMART_IMG_NOT_RCVD_WAL","description":"Walmart hosted image but message not from Walmart"},{"name":"NEWEGG_IMG_NOT_RCVD_NEGG","description":"Newegg hosted image but message not from Newegg"},{"name":"SHOPIFY_IMG_NOT_RCVD_SFY","description":"Shopify hosted image but message not from Shopify"},{"name":"HOSTED_IMG_DQ_UNSUB","description":"Image hosted at large ecomm site, IP addr unsub link"},{"name":"HOSTED_IMG_DIRECT_MX","description":"Image hosted at large ecomm site, message direct-to-mx"},{"name":"HOSTED_IMG_FREEM","description":"Image hosted at large ecomm site or redirected, freemail from or reply-to"},{"name":"HOSTED_IMG_MULTI","description":"Multiple images hosted at different large ecomm sites or redirected"},{"name":"URI_IMG_WP_REDIR","description":"Image via WordPress \"accelerator\" proxy"},{"name":"BOGUS_MIME_VERSION","description":"Mime version header is bogus"},{"name":"URI_HEX_IP","description":"URI with hex-encoded IP-address host"},{"name":"URI_PHP_REDIR","description":"PHP redirect to different URL (link obfuscation)"},{"name":"DAY_I_EARNED","description":"Work-at-home spam"},{"name":"DOTGOV_IMAGE","description":".gov URI + hosted image"},{"name":"URI_DOTEDU","description":"Has .edu URI"},{"name":"URI_DOTEDU_LONG","description":"Has .edu URI + excessively long line"},{"name":"URI_DOTEDU_ENTITY","description":"Via .edu MTA + suspicious HTML content"},{"name":"RCVD_DOTEDU_SUSP_URI","description":"Via .edu MTA + suspicious URI"},{"name":"RCVD_DOTEDU_SHORT","description":"Via .edu MTA + short message"},{"name":"RCVD_DOTEDU_SUSP","description":"Via .edu MTA + suspicious content"},{"name":"TRANSFORM_LIFE","description":"Transform your life!"},{"name":"BITCOIN_WFH_01","description":"Work-from-Home + bitcoin"},{"name":"TO_TOO_MANY_WFH_01","description":"Work-from-Home + many recipients"},{"name":"FREEMAIL_WFH_01","description":"Work-from-Home + freemail"},{"name":"SUSP_UTF8_WORD_MANY","description":"Many words using only suspicious UTF-8 characters"},{"name":"SUSP_UTF8_WORD_COMBO","description":"Words using only suspicious UTF-8 characters + other signs"},{"name":"SUSP_UTF8_WORD_SUBJ","description":"Word in Subject using only suspicious UTF-8 characters"},{"name":"SUSP_UTF8_WORD_FROM","description":"Word in From name using only suspicious UTF-8 characters"},{"name":"HTML_EMPTY_CELLS_MANY","description":"HTML table with lots of empty cells"},{"name":"SENDGRID_REDIR","description":"Redirect URI via Sendgrid"},{"name":"SENDGRID_REDIR_PHISH","description":"Redirect URI via Sendgrid + phishing signs"},{"name":"MSGID_DOLLARS_URI_IMG","description":"Suspicious Message-ID and image"},{"name":"URI_DASHGOVEDU","description":"Suspicious domain name"},{"name":"RCVD_IN_IADB_VOUCHED","description":"ISIPP IADB lists as vouched-for sender"},{"name":"RCVD_IN_IADB_LISTED","description":"Participates in the IADB system"},{"name":"RCVD_IN_IADB_EDDB","description":"IADB: Participates in Email Deliverability Database"},{"name":"RCVD_IN_IADB_EPIA","description":"IADB: Member of Email Processing Industry Alliance"},{"name":"RCVD_IN_IADB_SPF","description":"IADB: Sender publishes SPF record"},{"name":"RCVD_IN_IADB_SENDERID","description":"IADB: Sender publishes Sender ID record"},{"name":"RCVD_IN_IADB_DK","description":"IADB: Sender publishes Domain Keys record"},{"name":"RCVD_IN_IADB_RDNS","description":"IADB: Sender has reverse DNS record"},{"name":"RCVD_IN_IADB_HABEAS","description":"IADB: Sender participates in Habeas program"},{"name":"RCVD_IN_AIDB_BONDEDSENDER","description":"IADB: Sender participates in Bonded Sender program"},{"name":"RCVD_IN_IADB_GOODMAIL","description":"IADB: Sender has been certified by GoodMail"},{"name":"RCVD_IN_IADB_NOCONTROL","description":"IADB: Has absolutely no mailing controls in place"},{"name":"RCVD_IN_IADB_OPTOUTONLY","description":"IADB: Scrapes addresses, pure opt-out only"},{"name":"RCVD_IN_IADB_UNVERIFIED_1","description":"IADB: Accepts unverified sign-ups"},{"name":"RCVD_IN_IADB_UNVERIFIED_2","description":"IADB: Accepts unverified sign-ups, gives chance to opt out"},{"name":"RCVD_IN_IADB_LOOSE","description":"IADB: Adds relationship addrs w/out opt-in"},{"name":"RCVD_IN_IADB_OPTIN_LT50","description":"IADB: Opt-in used less than 50% of the time"},{"name":"RCVD_IN_IADB_OPTIN_GT50","description":"IADB: Opt-in used more than 50% of the time"},{"name":"RCVD_IN_IADB_OPTIN","description":"IADB: All mailing list mail is opt-in"},{"name":"RCVD_IN_IADB_DOPTIN_LT50","description":"IADB: Confirmed opt-in used less than 50% of the time"},{"name":"RCVD_IN_IADB_DOPTIN_GT50","description":"IADB: Confirmed opt-in used more than 50% of the time"},{"name":"RCVD_IN_IADB_DOPTIN","description":"IADB: All mailing list mail is confirmed opt-in"},{"name":"RCVD_IN_IADB_ML_DOPTIN","description":"IADB: Mailing list email only, confirmed opt-in"},{"name":"RCVD_IN_IADB_OOO","description":"IADB: One-to-one/transactional email only"},{"name":"RCVD_IN_IADB_MI_CPEAR","description":"IADB: Complies with Michigan's CPEAR law"},{"name":"RCVD_IN_IADB_UT_CPEAR","description":"IADB: Complies with Utah's CPEAR law"},{"name":"RCVD_IN_IADB_MI_CPR_30","description":"IADB: Checked lists against Michigan's CPR within 30 days"},{"name":"RCVD_IN_IADB_UT_CPR_30","description":"IADB: Checked lists against Utah's CPR within 30 days"},{"name":"RCVD_IN_IADB_MI_CPR_MAT","description":"IADB: Sends no material under Michigan's CPR"},{"name":"RCVD_IN_IADB_UT_CPR_MAT","description":"IADB: Sends no material under Utah's CPR"},{"name":"S25R_1","description":"S25R: Bottom of rDNS has num, non-num, num"},{"name":"S25R_2","description":"S25R: Bottom of rDNS has 5+ digits in a row"},{"name":"S25R_3","description":"S25R: A low-level of rDNS starts w/ a number"},{"name":"S25R_4","description":"S25R: Bottom of rDNS ends w/ num, next lvl has num-num"},{"name":"S25R_5","description":"S25R: rDNS has 5+ layers, bottom 2 end in numbers"},{"name":"S25R_6","description":"S25R: rDNS looks dynamic or customer-facing"},{"name":"S25R","description":"Selective SMTP Rejection: Relay has dynamic rDNS"},{"name":"KHOP_BOTNET_4","description":"Relay looks like a dynamic address"},{"name":"KHOP_BOTNET_7","description":"Relay looks like a dynamic address"},{"name":"KHOP_BOTNET_9","description":"Relay looks like a dynamic address"},{"name":"KHOP_BOTNET_UNCLEAN","description":"Relay looks like a dynamic address"},{"name":"__HAS_IMG_SRC","description":"Has an img tag on a non-quoted line"},{"name":"__HAS_HREF","description":"Has an anchor tag with a href attribute in non-quoted line"},{"name":"__HAS_IMG_SRC_ONECASE","description":"Has an img tag on a non-quoted line with consistent case"},{"name":"__HAS_HREF_ONECASE","description":"Has an anchor tag with a href attribute in non-quoted line with consistent case"},{"name":"__MIXED_IMG_CASE","description":"Has img tags with mixed-up cases in non-quoted lines"},{"name":"__MIXED_HREF_CASE","description":"Has anchor tags with mixed-up cases in non-quoted lines"},{"name":"T_MIXED_TAG_CASE","description":"Has multiple mixed-case tags in non-quoted lines."},{"name":"T_SCC_THREE_WORD_MONTY","description":"Are you POTUS or a mass murderer? "},{"name":"SCC_MAJORDOMO","description":"Multiple indications of the majordomo list manager"},{"name":"T_SCC_ODD_MUA","description":"Unlikely MUA for a modern human"},{"name":"T_SCC_SPECIAL_GUID","description":"Unique in a similar way"},{"name":"PDS_RDNS_DYNAMIC_FP","description":"RDNS_DYNAMIC with FP steps"},{"name":"PDS_SHORT_BOGUS_MSM_HDRS","description":"Short HTML email with bogus MSM headers"},{"name":"PDS_FROM_NAME_TO_DOMAIN","description":"From:name looks like To:domain"},{"name":"PDS_FRNOM_TODOM_NAKED_TO","description":"Naked to From name equals to Domain"},{"name":"PDS_HIDDEN_UK_BUSINESSLOAN","description":"UK's <word> rates for business loans"},{"name":"PDS_DOUBLE_URL","description":"URL that ends with a URL"},{"name":"PDS_DBL_URL_LINKBAIT","description":"Linkbait double-url"},{"name":"PDS_DBL_URL_TNB_RUNON","description":"Double-url and To no arrows, from runon"},{"name":"PDS_DBL_URL_ILLEGAL_CHARS","description":"Double url illegal subject characters"},{"name":"FROM_2_EMAILS_SHORT","description":"Short body and From looks like 2 different emails"},{"name":"SHORT_BODY_QUOTE","description":"Short body with quote - used for warming up domains"},{"name":"BODY_QUOTE_MALF_MSGID","description":"Malformed MSGID with quote"},{"name":"SPOOFED_FREEMAIL_NO_RDNS","description":"From SPOOFED_FREEMAIL and no rDNS"},{"name":"PDS_URI_HIDDEN_HELO_NO_DOMAIN","description":"Hidden URI, HELO not domain"},{"name":"PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE","description":"To: name matches everything in local email - LCASE headers"},{"name":"PDS_TONAME_EQ_TOLOCAL_SHORT","description":"Short body with To: name matches everything in local email"},{"name":"PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE","description":"Forged replyto and __PDS_TONAME_EQ_TOLOCAL"},{"name":"PDS_TONAME_EQ_TOLOCAL_VSHORT","description":"Very short body and From looks like 2 different emails"},{"name":"POSTCARD_01","description":"You got a postcard!"},{"name":"POSTCARD_02","description":"You got a postcard!"},{"name":"POSTCARD_03","description":"From a postcard domain"},{"name":"POSTCARD_04","description":"You got a forged Hallmark postcard!"},{"name":"POSTCARD_05","description":"You got a postcard!"},{"name":"POSTCARD_06","description":"You got a postcard!"},{"name":"POSTCARD_07","description":"You got a postcard!"},{"name":"POSTCARD_08","description":"You got a postcard!"},{"name":"POSTCARD_09","description":"You got a postcard!"},{"name":"__DQ_URI_ONLY_ARGS","description":"Dotted-Quad URI with only CGI arguments"},{"name":"POSTCARD_DQ","description":"Postcard + DQ URI"},{"name":"EXECUTABLE_URI","description":"Link to an executable file"},{"name":"POSTCARD_EXE","description":"Postcard + Executable URI"},{"name":"__TR_JS_EXTRA_UNESCAPE","description":"JavaScript: Unnecessary URI escaping"},{"name":"__TR_JS_EXTRA_CONCAT","description":"JavaScript: Unnecessary string concatenation"},{"name":"TR_JS_FROMCHARCODE","description":"JavaScript: function String.fromCharCode"},{"name":"__TR_JS_CONCATINATED_HTTP","description":"Contains concatenated URI like \"htt\"+\"p://...\""},{"name":"TR_JS_REDIRECTION_0","description":"Script: Current window location is redirected (unoptimized)"},{"name":"TR_JS_REDIRECTION_1","description":"Script: Current window location is redirected"},{"name":"TR_JS_REDIRECTION_2","description":"Script: Something changes location (a redirection)"},{"name":"KHOP_JS_OBFUSCATION","description":"Script: unnecessarily complex string composition"},{"name":"TR_FILLER_TEXT","description":"18 sentences of capitalized word, 4-6 words, period"},{"name":"__GB_MONERO_CP_DE","description":"German Monero scam"},{"name":"__GB_MONERO_CP_ES","description":"Spanish Monero scam"},{"name":"__GB_MONERO_CP_FR","description":"French Monero scam"},{"name":"__GB_MONERO_CP_EN","description":"English Monero scam"},{"name":"__GB_MONERO_CP_IT","description":"Italian Monero scam"},{"name":"__GB_MONERO_CP_NL","description":"Dutch Monero scam"},{"name":"__GB_MONERO_CP_SE","description":"Swedish Monero scam"},{"name":"GB_MONERO_CP","description":"Localized Monero scam"},{"name":"GB_MONERO_NH","description":"Localized Monero scam"},{"name":"DOS_YOUR_PLACE","description":"Russian dating spam"},{"name":"DOS_DOM_LIST_CENTER","description":"Final notice for search engine submission"},{"name":"DOS_STOCK_O_PRICE","description":"Stocks with 'oh', rather than 'zero' values"},{"name":"DOS_FAKE_SQUIRREL","description":"Message contains faked SquirrelMail headers"},{"name":"DOS_LET_GO_JOB","description":"Let go from their job and now makes lots of dough!"},{"name":"DOS_DOUBLE_SOTCK","description":"Stock spelt wrong the same way twice in a row"},{"name":"DOS_TWO_MIS_STOCK","description":"Stock spelt wrong twice in a row"},{"name":"DOS_TO_READ_STOCK","description":"Stock pumping you just have to read"},{"name":"BELL_MOBILITY_TXT_MSG","description":"Adjustment for poorly formatted text->email messages"},{"name":"DOS_DOT_COM_AT","description":"Envelope-From has a domain.com@anotherdomain.com"},{"name":"DOS_STOCK_BAT","description":"Probable pump and dump stock spam"},{"name":"DOS_URI_ASTERISK","description":"Found an asterisk in a URI"},{"name":"DOS_FIX_MY_URI","description":"Looks like a \"fix my obfu'd URI please\" spam"},{"name":"DOS_PROVISION4","description":"Provision for income taxes"},{"name":"DOS_REPORT_FIN_INC","description":"Report of financial income"},{"name":"DOS_STOCK_INCOME_STATEMENT","description":"Pump and dump stock income statement spam"},{"name":"DOS_STOCK_CDYV_GENERIC","description":"Pump and dump stock spam"},{"name":"DOS_OUTLOOK_TO_MX","description":"Delivered direct to MX with Outlook headers"},{"name":"DOS_OUTLOOK_TO_MX_IMAGE","description":"Direct to MX with Outlook headers and an image"},{"name":"DOS_OE_TO_MX","description":"Delivered direct to MX with OE headers"},{"name":"DOS_OE_TO_MX_IMAGE","description":"Direct to MX with OE headers and an image"},{"name":"DOS_GOOGLE_LUCKY_REDIRECT","description":"Invisible Google redirect using the \"lucky button\""},{"name":"DOS_ANAL_SPAM_MAILER","description":"X-mailer pattern common to anal porn site spam"},{"name":"DOS_ANAL_SPAM_MAILER2","description":"X-mailer pattern common to porn site spam"},{"name":"DOS_FORGED_RCVD_QUADS","description":"Probable forged received header"},{"name":"DOS_RCVD_IP_TWICE_A","description":"Received from the same IP twice in a row"},{"name":"DOS_RCVD_IP_TWICE_B","description":"Received from the same IP twice in a row (only one external relay)"},{"name":"DOS_RCVD_IP_TWICE_C","description":"Received from the same IP twice in a row (only one external relay; empty or IP helo)"},{"name":"DOS_ZIP_HARDCORE","description":"hardcore.zip file attached; quite certainly a virus"},{"name":"DOS_PLAYED_IN_HARDCORE","description":"Claims someone played in hardcore porn"},{"name":"DOS_HC_ZIP_VIRUS","description":"Hardcore porn virus spam"},{"name":"DOS_PORN_BOUNDARY","description":"Content boundary common to porn spam"},{"name":"DOS_FAKE_UPS_TRACK_NUM","description":"Invalid UPS Tracking Number in Subject"},{"name":"DOS_HIGH_BAT_TO_MX","description":"The Bat! Direct to MX with High Bits"},{"name":"DOS_BODY_HIGH_NO_MID","description":"High bit body and no message ID header"},{"name":"DOS_HIGHBIT_HDRS_BODY","description":"Headers need encoding and body is highbit"},{"name":"__GB_BITCOIN_CP_DE","description":"German Bitcoin scam"},{"name":"__GB_BITCOIN_CP_ES","description":"Spanish Bitcoin scam"},{"name":"__GB_BITCOIN_CP_FR","description":"French Bitcoin scam"},{"name":"__GB_BITCOIN_CP_EN","description":"English Bitcoin scam"},{"name":"__GB_BITCOIN_CP_IT","description":"Italian Bitcoin scam"},{"name":"__GB_BITCOIN_CP_NL","description":"Dutch Bitcoin scam"},{"name":"__GB_BITCOIN_CP_SE","description":"Swedish Bitcoin scam"},{"name":"GB_BITCOIN_CP","description":"Localized Bitcoin scam"},{"name":"GB_BITCOIN_NH","description":"Localized Bitcoin scam"},{"name":"GB_HASHBL_BTC","description":"Message contains BTC address found on BTCBL"},{"name":"PDS_LITECOIN_ID","description":"FP reduced Litecoin ID"},{"name":"LITECOIN_EXTORT_01","description":"Extortion spam, pay via BitCoin"},{"name":"PDS_LTC_CP","description":"Localized Bitcoin scam"},{"name":"PDS_LTC_HUSH","description":"LTC, it is between us"},{"name":"PDS_BTC_ID","description":"FP reduced Bitcoin ID"},{"name":"PDS_BTC_MSGID","description":"Bitcoin ID with MSGID_NOFQDN2"},{"name":"PDS_BTC_AHACKER","description":"Bitcoin Hacker"},{"name":"PDS_BTC_HACKER","description":"Bitcoin Hacker"},{"name":"PDS_LTC_AHACKER","description":"Litecoin Hacker"},{"name":"PDS_LTC_HACKER","description":"Litecoin Hacker"},{"name":"FH_MSGID_XXBLAH","description":"Common sign in msg-id's 12/21/2006"},{"name":"FB_LETTERS_21B","description":"Special people leave special signs!"},{"name":"FM_LOTTO_MONEY","description":"Talks about lotto and large money!"},{"name":"FM_LOTTO_YOU_WON","description":"Talks about lotto and you won!"},{"name":"FB_EXP_POWER_OF","description":"Phrase: Experience the power of"},{"name":"FM_PEOPLE_LOOK_4ME","description":"People are looking for me?"},{"name":"FH_BAD_OEV1441","description":"Bad X-Mailer version"},{"name":"FH_RANDOM_SURE","description":"SARE Random in one rule."},{"name":"FH_MSGID_01C67","description":"Special MSGID"},{"name":"FH_HAS_X","description":"Has X: header"},{"name":"FH_HAS_XAIMC","description":"Has X-AIMC-AUTH header"},{"name":"FH_HAS_XCVBN","description":"Has X-CVBN header"},{"name":"FH_BAD_MSOE14","description":"Bad OE version"},{"name":"FH_HAS_X_WBC","description":"Has X-WBC header"},{"name":"FH_MSGID_000000","description":"Special MSGID"},{"name":"FH_HAS_XFGHJ","description":"Has X-FGHJ"},{"name":"FH_XMAIL_HEX20","description":"Special HEX X-Mailer"},{"name":"FH_HAS_XBBO","description":"Has X-BBounce"},{"name":"FS_REPL_TOKEN","description":"Subject has Replacement Token"},{"name":"FM_XMAIL_F_OUT","description":"Looks like Fake Outlook?"},{"name":"FH_XCON_HAS_EQ","description":"X-Contact has ="},{"name":"FH_HAS_XOVE","description":"Has X-OVE"},{"name":"FH_HAS_XID","description":"Has X-ID"},{"name":"FH_HAS_XUIOP","description":"Has X-UIOP"},{"name":"FH_XMAIL_RND_833","description":"Special X-Mailer Version"},{"name":"FS_RAMROD","description":"Subject says Ramrod"},{"name":"FS_WITH_SMALL","description":"Subject says With ... small"},{"name":"FH_MSGID_REPLACE","description":"Broken Replace Template"},{"name":"FH_XMAIL_REPLACE","description":"Broken Replace Template"},{"name":"FB_ADD_INCHES","description":"Add / Gain inches"},{"name":"FM_RE_HELLO_SPAM","description":"Re: Hello / hi"},{"name":"FB_DDDD_BUCKS","description":"We use comma's and it's dollars not bucks!"},{"name":"FH_HOST_IN_ADDRARPA","description":"HOST dns says \"in-addr.arpa\""},{"name":"FB_IMAGIRL","description":"Phrae: I am a girl"},{"name":"FM_LOWER_CASE_HEAD","description":"Lots of headers with lower case."},{"name":"FB_REPLIC_CAP","description":"Phrase: REPLICA"},{"name":"FM_TRUE_LOV_ALL_N","description":"True Love all Night!"},{"name":"FU_ENDS_SG","description":"URL ends with /sg"},{"name":"FU_ENDS_RT","description":"URL ends with /rt"},{"name":"FM_PHN_NODNS","description":"Phone spacing + no dns"},{"name":"FR_WATCHES_HTTP","description":"Watches http://"},{"name":"FU_END_ET","description":"ET Phone Home?"},{"name":"FH_MSGID_01C70XXX","description":"MESSAGE ID seen often!!!"},{"name":"FU_CLICK_PHP_DDD","description":"Click.php?ddd.ddd.ddd.ddd.ddd"},{"name":"FH_X_REFS_DDD","description":"X-Refs with digits."},{"name":"FM_XREF_CLICKPHP","description":"Whatever it takes!"},{"name":"FB_SPACED_PHN_3B","description":"Phone number with -- spacing. (B)"},{"name":"FM_FAKE_53COM_SPOOF","description":"Spoof mail from 53.com?"},{"name":"FM_HOW_IMG_COST2","description":"How much does your image cost? (2)"},{"name":"FU_COMMON_SUBS","description":"Sub-dir seen often in spam."},{"name":"FRM_SILVER_GOLD","description":"ReplaceTags: Silver & Gold"},{"name":"FM_LUX_GIFTS_REDUCED","description":"Luxury Gifts with dd%"},{"name":"FH_MSGID_DIGIT","description":"Forgot Pattern Replacement?"},{"name":"FM_HOW_IMG_COST","description":"How much does your image cost?"},{"name":"FM_DOESNT_SAY_STOCK","description":"It's a stock spam but doesn't say stock"},{"name":"FM_LIKE_STOCKS","description":"It looks like a duck, it's a duck!"},{"name":"FH_FROM_HOODIA","description":"From has Hoodia!!?"},{"name":"FF_COMMENT_ODD","description":"FULL RULE: Special Comment"},{"name":"FF_LEO_FLOAT_RIGHT","description":"FULL RULE: Float, Right, Special signs!"},{"name":"FF_IHOPE_YOU_SINK","description":"Triple Floats, common viagra signs."},{"name":"FB_ACHIEVE_BACH","description":"Phrase: Achieve your bachelor"},{"name":"FB_ALMOST_SEX","description":"It's almost sex, but not!"},{"name":"FB_AN_ERROR_4U","description":"Phrase: an error has been made in your favor"},{"name":"FB_ANA_TRIM","description":"Broken AnaTrim phrase."},{"name":"FB_ANUI","description":"Phrase: A_U_N_I"},{"name":"FB_B0NUS","description":"Phrase: B0nus"},{"name":"FB_BAD_ERECT","description":"Phrase: Bad Erection"},{"name":"FB_BE_MILLION","description":"Phrase: be millionaire"},{"name":"FB_BEDISCARDED","description":"Phrase: discarded ... future deployments"},{"name":"FB_BILLI0N","description":"Phrase: [BM]Illi0n"},{"name":"FB_BOOST_CONFIDEN","description":"Phrase: boost your confidence."},{"name":"FB_BROKEN_PHNUM","description":"weird phone number, with letters!"},{"name":"FB_BROWSER_ERR","description":"Phrase: Browser Error: random"},{"name":"FB_C0MPANY","description":"Phrase: C0mpany"},{"name":"FB_CAN_LONGER","description":"Phrase: can last longer"},{"name":"FB_CASINO","description":"Phrase: ca$ino"},{"name":"FB_CASINO_SPELLER","description":"Phrase: Online Casino, spelling mistake."},{"name":"FB_CHOLESTERBLCK","description":"Phrase: Cholesterblock"},{"name":"FB_CIALIS_LEO3","description":"Uses a mis-spelled version of cialis."},{"name":"FB_COM_ADR_SIGN","description":"Common sign used in Addresses"},{"name":"FB_CONSOL_YOUR","description":"Phrase: Consolidate your"},{"name":"FB_DOUBLE_0WORDS","description":"Looks like double 0 words"},{"name":"FB_DROWNING_DEBT","description":"Phrase: drowning in debt"},{"name":"FB_EARN_UP_TO","description":"Phrase: Earn up to ...."},{"name":"FB_EMAIL_HIER","description":"Phrase: email hier"},{"name":"FB_ENHANCED_MALE","description":"Phrase: Enhanced male"},{"name":"FB_EPHEDRA_IS","description":"Phrase: Ephedra is back"},{"name":"FB_EXPLOSIVE","description":"Phrase: EXPLOSIVE"},{"name":"FB_EXTRA_INCHES","description":"Phrase: extra inches"},{"name":"FB_FAKE_NUMBERS","description":"Looks like numbers with O's insted of 0's"},{"name":"FB_FAKE_NUMS2","description":"Looks like fake numbers"},{"name":"FB_FAKE_NUMS4","description":"Looks like fake numbers (4)"},{"name":"FB_FEDERALLY_COMPL","description":"Phrase: we are federally compliant"},{"name":"FB_FHARMACY","description":"Phrase: Farmacy"},{"name":"FB_FORWARD_LOOK","description":"Phrase: forward look with 0's"},{"name":"FB_FREE888","description":"Claims we can get $888 Free."},{"name":"FB_FUNNY_WEIGHT","description":"Looks like weight but it's not!"},{"name":"FB_GAPPY_ADDRESS","description":"Too much spacing in Address"},{"name":"FB_GAPPY_SOMETHING","description":"Looks like something thats g a p p y"},{"name":"FB_GET_LAID","description":"Phrase: GET LAID"},{"name":"FB_GET_MEDS","description":"Looks like trying to sell meds"},{"name":"FB_GET_XXX_CASH","description":"Phrase: Get Cash"},{"name":"FB_GREAT_BEST_SEX","description":"Phrase: greater, best, improved sex"},{"name":"FB_GVR","description":"Looks like generic viagra"},{"name":"FB_HA1R","description":"Phrase: ha1r"},{"name":"FB_HEY_BRO_COMMA","description":"Phrase hey bro,"},{"name":"FB_HG_H_CAP","description":"Phrase: HGH"},{"name":"FB_HOMELOAN","description":"Phrase $x home loan"},{"name":"FB_IMPRESS_GIRL","description":"Phrase: impress ... girl"},{"name":"FB_IMPROVEJA","description":"Phrase: Improved Ejaculation"},{"name":"FB_INCREASE_VOL","description":"Phrase: increase volume"},{"name":"FB_INCREASE_YOUR","description":"Phrase: Increase your energy"},{"name":"FB_INDEPEND_RWD","description":"Phrase: independent reward"},{"name":"FB_IOW","description":"Phrase: mis-spelled low, iow?"},{"name":"FB_L0AN","description":"Phrase: L0an"},{"name":"FB_LAON","description":"Phrase: laon"},{"name":"FB_LATEST_OEM","description":"Phrase: latest oem."},{"name":"FB_LIMITED_TIME","description":"Phrase: limited time promotion"},{"name":"FB_LOSE_WEIGHT_CAP","description":"Phrase: LOSE WEIGHT"},{"name":"FB_LOWER_PAYM","description":"Phrase: lower your monthly payments"},{"name":"FB_MAGIC_TAB","description":"Phrase: this / magic tab."},{"name":"FB_MAKE_MONEY","description":"Phrase: generate $"},{"name":"FB_MASCULINE_PERF","description":"Phrase: Masculine performance"},{"name":"FB_MED1CAT","description":"Phrase: Med1cat"},{"name":"FB_MEDS_PERCENT","description":"Talks about meds and %"},{"name":"FB_MEEDS","description":"Phrase: meed[zs]"},{"name":"FB_MORE_SEMEN","description":"Phrase: more semen"},{"name":"FB_MORE_SIZE","description":"Phrase: more size"},{"name":"FB_MOST_RECOG","description":"Phrase: most recognized brands."},{"name":"FB_MOST_QUALITY","description":"Phrase: Most quality products"},{"name":"FB_N3W","description":"Phrase: n3w"},{"name":"FB_NATIONALSURV","description":"Phrase: NationalSurveyPanel"},{"name":"FB_NEW_LOW_RATE","description":"Phrase: new low rate"},{"name":"FB_NO_MORE_ADS","description":"Phrase: no more ad"},{"name":"FB_NO_MORE_HTTP","description":"No more, the http"},{"name":"FB_NO_MORE_MAIL","description":"Phrase: no more mail, distribution"},{"name":"FB_NO_MORE_OFFER","description":"Phrase: no more offer"},{"name":"FB_NOT_CREDIT","description":"Looks like credit but ain't."},{"name":"FB_NOT_PHONE_NUM1","description":"Looks like a fake phone number (1)"},{"name":"FB_NOT_PHONE_NUM2","description":"Looks like a fake phone number (2)"},{"name":"FB_NOT_PHONE_NUM3","description":"Looks like a fake phone number (3)"},{"name":"FB_NOT_SCHOOL","description":"Looks like school but it's not!"},{"name":"FB_NOT_SEXUAL","description":"Almost Sexual but not."},{"name":"FB_NOW_NOW_NOW","description":"Phrase: NOW NOW NOW"},{"name":"FB_NUMYO","description":"Speaks of teenager."},{"name":"FB_NUMYO2","description":"Speaks of 20+ year old."},{"name":"FB_ODD_SPACED_MONEY","description":"Looks like money but has odd spacing."},{"name":"FB_ONIINE","description":"Mis-spelled online"},{"name":"FB_P1LL","description":"Phrase: p1ll"},{"name":"FB_PA1N","description":"Phrase: pa1n"},{"name":"FB_PASTE_LINK","description":"Phrase: past link into browser"},{"name":"FB_PC_DOCTOR","description":"Phrase: PC Doctor"},{"name":"FB_PENIS_GROWTH","description":"Phrase: penis growth"},{"name":"FB_PIPE_ILLION","description":"Looks like illion, but it's not"},{"name":"FB_PIPEDOLLAR","description":"Phrase: Dollar, with pipes or 0's."},{"name":"FB_PIPENEWSLETTER","description":"Phrase news|etter"},{"name":"FB_PROLONGED_HARD","description":"Talks about prolonged hardness"},{"name":"FB_QUALITY_REPLICA","description":"Phrase: quality replica"},{"name":"FB_RANDOM_SPUR","description":"Pattern Replacement Failure"},{"name":"FB_RE_FI","description":"Looks like refi."},{"name":"FB_REF_CODE_SPACE","description":"Refcode with spacing"},{"name":"FB_REFI","description":"Phrase: Refi"},{"name":"FB_REM_PART","description":"Looks like remove w/o e."},{"name":"FB_REPLICA_ROLEX","description":"Phrase: Replica Rolex"},{"name":"FB_REWARDS_GATE","description":"Phrase: Rewards Gateway"},{"name":"FB_ROLLER_IS_T","description":"Phrase: Roller is th"},{"name":"FB_ROLX","description":"Phrase: rolx"},{"name":"FB_SAVE_PERSC","description":"Phrase: save ... prescription."},{"name":"FB_SSEX","description":"Phrase: ssex"},{"name":"FB_SMALL_PEN","description":"Phrase: small pen"},{"name":"FB_SOFTTABS","description":"Phrase: Softabs"},{"name":"FB_SPACED_CASH","description":"Phrase: c a s h"},{"name":"FB_SPACED_FREE","description":"Phrase: F R E E"},{"name":"FB_SPACED_LOWER","description":"Phrase: l o w e r"},{"name":"FB_SPACEY_ZIP","description":"Looks like a  s p a c e d zipcode."},{"name":"FB_SPUR_M","description":"Phrase: SPUR-M"},{"name":"FB_STAMINA_IN_BED","description":"Phrase: stamina in bed."},{"name":"FB_STOCK_EXPLODE","description":"Looks like stocks exploding."},{"name":"FB_STOP_EMAILING","description":"Phrase stop e-mailing me"},{"name":"FB_STREAM_OF","description":"Phrase: Watch the stream of customers"},{"name":"FB_STRONGER_EJ","description":"Phrase: stronger ejaculation"},{"name":"FB_SUPERBREWARD","description":"Phrase: Superb Rewards"},{"name":"FB_SYMBLO","description":"Mis-spelled symbol."},{"name":"FB_THIS_ADVERT","description":"Phrase: this advertiser"},{"name":"FB_THOUS_PERSONAL","description":"Phrase: thousand personal"},{"name":"FB_TIRED_OF_YOUR","description":"Phrase: Tired of your"},{"name":"FB_TO_STOP_DISTRO","description":"Phrase: to stop further distribution"},{"name":"FB_UGGS_NOW","description":"Phrase: uggs now"},{"name":"FB_ULTRA_ALLURE","description":"Phrase: Ultra Allure"},{"name":"FB_UNLOCK_YOUR_G","description":"Phrase: lock to your girlfriend"},{"name":"FB_UNRESOLV_PROV","description":"Pattern Replacement PROV_D"},{"name":"FB_V_SPACE_GRA","description":"Looks like Viagra?"},{"name":"FB_VERIFY_ZIP","description":"Phrase: verify your zipcode"},{"name":"FB_WHILECONNECTED","description":"Phrase: white connected to the internet"},{"name":"FB_WHITEGOLD","description":"Phrase: white gold sound good"},{"name":"FB_WITHOUT_INCRE","description":"Phrase: without increasing your"},{"name":"FB_WITHOUT_PRESC","description":"Phrase: without a prescription."},{"name":"FB_WORD1_END_DOLLAR","description":"Looks like a word ending with a $"},{"name":"FB_WORD2_END_DOLLAR","description":"Looks like a word ending with a $ (2)"},{"name":"FB_YOU_CAN_BECOME","description":"Phrase: you can become"},{"name":"FB_YOU_LOVE","description":"Phrase: you love can"},{"name":"FB_YOUR_MED","description":"Phrase: your med"},{"name":"FB_YOUR_REFI","description":"Phrase: Your refi"},{"name":"FB_YOUR_MORTGAGE","description":"Phrase: Your Mortgage"},{"name":"FB_YOUR_PC_ERROR","description":"Phrase: your pc has error"},{"name":"FB_YOUR_REFILL","description":"Phrase: your refill"},{"name":"FB_YOUR_WEIGHT","description":"Phrase: about your weight"},{"name":"FB_YOUR_WOMAN","description":"Phrase: Your woman will be"},{"name":"FB_YOURSELF_MASTER","description":"Phrase: yourself master"},{"name":"FB_YOUTH_THIS","description":"Phrase: Youth is Back!"},{"name":"FH_DATE_IS_19XX","description":"The date is not 19xx."},{"name":"FH_FAKE_RCVD_LINE","description":"RCVD line looks faked (A)"},{"name":"FH_FAKE_RCVD_LINE_B","description":"RCVD line looks faked (B)"},{"name":"FH_FROM_CASH","description":"From name has \"cash\""},{"name":"FH_FROMEML_NOTLD","description":"E-mail address doesn't have TLD (.com, etc.)"},{"name":"FH_FROM_RND_1","description":"From has pattern replacement broken."},{"name":"FH_FROM_GET_NAME","description":"From name says Get"},{"name":"FH_FROM_GIVEAWAY","description":"From name is giveaway."},{"name":"FH_FROM_START_YOU","description":"From starts with you."},{"name":"FH_HAS_UID","description":"Header UID found."},{"name":"FH_HELO_ALMOST_IP","description":"Helo is almost an IP addr."},{"name":"FH_HELO_GMAILSMTP","description":"Faked helo of gmail-smtp-in"},{"name":"FH_HELO_ENDS_DOT","description":"Helo ends with a dot."},{"name":"FH_HELO_EQ_610HEX","description":"Helo is 6-10 hex chr's."},{"name":"FH_HELO_EQ_CHARTER","description":"Helo is d-d-d-d charter.com"},{"name":"FH_HOST_EQ_DYNAMICIP","description":"Host is dynamicip"},{"name":"FH_HOST_EQ_PACBELL_D","description":"Host is pacbell.net dsl"},{"name":"FH_HOST_EQ_SPRINT_H","description":"Host is dhcp sprint-hsd.net"},{"name":"FH_HOST_EQ_VERIZON_P","description":"Host is pool-.+verizon.net"},{"name":"FH_MSGID_XXX","description":"Message-Id = @xxx"},{"name":"FH_RCVD_FROM_2_WDS","description":"RCVD line has 2 words after from."},{"name":"FH_RCVD_HELODATE","description":"The HELO Looks like a date?"},{"name":"FH_RE_NEW_DDD","description":"Subject is Re: new \\d\\d\\d"},{"name":"FH_SPOOF_NAMES","description":"Pattern Replacement Failure"},{"name":"FH_USER_MOZILLA_SMAL","description":"Specific signs of ratware"},{"name":"FH_VIRUS_NORTON","description":"Does Norton really not have caps?"},{"name":"FH_XCOMMENT_GIBBER","description":"X-Comment is gibberish"},{"name":"FR_3TAG_3TAG","description":"Looks like 3 <e> small tags."},{"name":"FR_ALMOST_VIAG2","description":"Almost looks like viagra."},{"name":"FR_CANTSEETEXT","description":"Phrase class=cantseetext"},{"name":"FR_COMMENT_ODD","description":"Strange HTML comment."},{"name":"FR_DIV_DRUGS_3","description":"Looks like many div's in drug spam."},{"name":"FR_DOT_FEVER_5","description":"Lots of dots inbetween letters."},{"name":"FR_IMPORT_CSS","description":"Special @import url css"},{"name":"FR_M_E_D_S","description":"Spaced out M E D S"},{"name":"FR_MIDER","description":"Sign often seen in spams"},{"name":"FR_P_END_P_MANY10","description":"Many <p></p> (10)"},{"name":"FR_PORN_NOT_URL","description":"Looks like a porn url seen before."},{"name":"FR_TEST_BASE64_BAD","description":"Looks like bad BASE64 with <br> at end."},{"name":"FR_TITLE_CONS_6","description":"Title Attribute has 6 non-vowels."},{"name":"FR_TITLE_NUMS","description":"HTML Title is only numbers"},{"name":"FS_ABIGGER","description":"Subject has \"a bigger\""},{"name":"FS_APPROVE_YOU","description":"Subject says approve you"},{"name":"FS_AT_NO_COST","description":"Subject says \"At No Cost\""},{"name":"FS_ATTRACT_CUST","description":"Subject says Attract something customer"},{"name":"FS_BROKEN_MEETING","description":"Subject looks like meeting but broken."},{"name":"FS_CHEAP_CAP","description":"Phrase: Cheap in Caps in Subject."},{"name":"FS_CAILIS","description":"Subject says cailis"},{"name":"FS_CLAIM_NOW","description":"Subject says \"Claim now\""},{"name":"FS_COSTARICA","description":"Subject says Costa Rica"},{"name":"FS_CUTE_TEEN","description":"Subject says cute teen"},{"name":"FS_DOLLAR_BONUS","description":"Subject talks about money bonus!"},{"name":"FS_EJACULA","description":"Phrase: ejaculation in subject."},{"name":"FS_END_BILLS","description":"Subject ends with bills."},{"name":"FS_ERECTION","description":"Phrase: erection in subject."},{"name":"FS_GANGBANG","description":"Phrase: subject says gangbang"},{"name":"FS_GET_LAID","description":"Phrase: get laid in subj."},{"name":"FS_GIFT_CARD_OFF","description":"Subject says Gift card offer"},{"name":"FS_HOT_TEEN","description":"Phrase: subject says \"hot teen\""},{"name":"FS_HUGECOCK","description":"Phrase: Huge Cock"},{"name":"FS_LARGE_PERCENT2","description":"Larger than 100% in subj."},{"name":"FS_LITTLE_PILL","description":"Phrase: little somthing pill."},{"name":"FS_LOW_INTMOR","description":"Subject says low interest or mortgage"},{"name":"FS_LOW_RATES","description":"Subject says low rates"},{"name":"FS_LOWER_YOUR","description":"Phrase: lower your"},{"name":"FS_MAKE_MONEY","description":"Subject says \"make money\""},{"name":"FS_MORE_CONFIDENT","description":"Subject says More Confident"},{"name":"FS_NEED_MONEY","description":"Subject talks about needing cash."},{"name":"FS_NEW_SOFT_UPLOAD","description":"Subj starts with New software uploaded"},{"name":"FS_NEW_XXX","description":"Subject looks like Fharmacy spams."},{"name":"FS_NO_SCRIP","description":"Subject almost says No prescription"},{"name":"FS_NUDE","description":"Subject says Nude"},{"name":"FS_NUMYO","description":"Speaks of teenager in subject."},{"name":"FS_OBFU_PRMCY","description":"what could this word be?"},{"name":"FS_PAYINGTOOM","description":"Subject says Paying too much for"},{"name":"FS_PERSCRIPTION","description":"Subject mis-spelled prescription"},{"name":"FS_PHARMASUB2","description":"Looks like Phramacy subject."},{"name":"FS_PORN_STAR","description":"Subject says Porn Star"},{"name":"FS_PRE_SUBJ","description":"Subject says PRE_SUBJ"},{"name":"FS_RE_APPROV","description":"Phrase: re approved"},{"name":"FS_REFI","description":"Subject says \"refi\""},{"name":"FS_RESULTS_BED","description":"Subject says results in bed"},{"name":"FS_SILDENAFIL","description":"Subject says \"Sildenafil Citrate\""},{"name":"FS_SINGLE_LETTER_H","description":"Subject has a bare H"},{"name":"FS_SINGLE_LETTER_J","description":"Subject has a bare J"},{"name":"FS_SPERMAX","description":"Subject contains Spermamax"},{"name":"FS_SPLASH","description":"Subject says splash or splashed"},{"name":"FS_START_DOYOU2","description":"Subject starts with Do you dream,have,want,love, etc."},{"name":"FS_START_LOSE","description":"Subject starts with Lose"},{"name":"FS_START_TEEN","description":"Subject starts with Teen"},{"name":"FS_TEEN_BAD","description":"Subject says something bad about teens"},{"name":"FS_TIGHT_TEEN","description":"Phrase: tight teen, etc."},{"name":"FS_TIP_DDD","description":"Phrase: subject = tip ddd"},{"name":"FS_VIEWPHOTOS","description":"Phrase: View photos of singles..."},{"name":"FS_WE_WANT","description":"Subject starts with We Want."},{"name":"FS_WEIGHT_LOSS","description":"Subject says Weight Loss"},{"name":"FS_WILL_HELP","description":"Subject says will help"},{"name":"FS_YOUR_COMPUTER","description":"Phrase: Your Computer in Subject."},{"name":"FS_YOUR_PRESCRIP","description":"Subject talks about your prescription"},{"name":"FS_YOUR_REFILL","description":"Subject Phrase: your refill"},{"name":"FU_16R","description":"Often seen in spam /16r"},{"name":"FU_COMMON_SUBS2","description":"Sub-dir seen often in spam (2)."},{"name":"FU_ENDS_NUMS_DOTS_CLK","description":"Ends with clk/d+.d+.d+"},{"name":"FU_HG_PATH","description":"URL has /hgh/ in path."},{"name":"FU_HOODIA","description":"URL has hoodia in it."},{"name":"FU_LONG_HTML","description":"URL has long file name with .html extension."},{"name":"FU_LOTSOFCOLONS","description":"word:word:word in URL."},{"name":"FU_LONG_QUERY3","description":"URL has a long file name with .aspx extension."},{"name":"FU_MIDER","description":"URL has /gal/"},{"name":"FU_RX_DIR","description":"/rx/"},{"name":"FU_SUB_D_WEIRD","description":"Sub-domain seen often in spam."},{"name":"FU_UKGEOCITIES","description":"URL with [a-z]{2}.geocities.com"},{"name":"FU_URI_TRACKER_T","description":"URI style tracker (T)"},{"name":"FM_APPROVE_COMPLETE","description":"Meta approved complete review"},{"name":"FM_BIG_REASON","description":"Lot's of CAP words, BIG, REASON, BEST"},{"name":"FM_CLAIM_IPOD","description":"Looks like u should claim your ipod."},{"name":"FM_COKE_PEPSI","description":"Subject has both Coke and Pepsi"},{"name":"FM_CONG_GIFTCARD","description":"Talks about gift cards and congrads."},{"name":"FM_COSTA_RICA","description":"Looks like Costa Rica spams."},{"name":"FM_DEBT_HELP","description":"Subject says debt and help."},{"name":"FM_FAKE_HELO_HOTMAIL","description":"Looks like a fake hotmail.com helo."},{"name":"FM_FAKE_HELO_VERIZON","description":"Looks like a fake verizon.net helo."},{"name":"FM_FORGED_GMAIL","description":"Looks like a forged gmail msg?"},{"name":"FM_FRM_RN_L_BRACK","description":"From name has > but not <"},{"name":"FM_GET_CASH_SURVEY","description":"Meta Get Cash + Survey"},{"name":"FM_GOOD_ENF_CREDIT","description":"Meta Good enough credit"},{"name":"FM_IS_IT_OUR_ACCOUNT","description":"Is it our account?"},{"name":"FM_LEND_MONEY","description":"Subject has ddd + lend!"},{"name":"FM_LOAN_NUM_DOMAIN","description":"Loan and numbers in .com"},{"name":"FM_MAKE_MONEY_HOME","description":"Making money from home."},{"name":"FM_MANY_DRUG_WORDS","description":"Lot's of almost drug words"},{"name":"FM_MEDS_SUBJ_2WDS","description":"Talks about Meds, Re: two words."},{"name":"FM_MORTGAGE3PLUS","description":"Looks like a mortgage spam (3+)"},{"name":"FM_MORTGAGE4PLUS","description":"Looks like a mortgage spam (4+)"},{"name":"FM_MORTGAGE5PLUS","description":"Looks like a mortgage spam (5+)"},{"name":"FM_MORTGAGE6PLUS","description":"Looks like a mortgage spam (6+)"},{"name":"FM_MULTI_LUX_GIFTS","description":"Talks about variety of luxury gifts"},{"name":"FM_NIKE_ADIDAS","description":"Meta Nike & Adidas"},{"name":"FM_PAYING_LOWER","description":"Meta You are paying too much..."},{"name":"FM_PC_ERROR_DBL","description":"Combo Meta of multiple rules."},{"name":"FM_RATSIGN_1106","description":"Fingerprint seen in lots of spam. 11/2006"},{"name":"FM_REPLY_OR_NOT","description":"Meta do they want a reply or not?"},{"name":"FM_ROLEX_ADS","description":"Looks like Rolex spams."},{"name":"FM_SCHOOL_TYPES","description":"Meta Combo Phrase for Schooling"},{"name":"FM_SCHOOLING","description":"Meta Combo Phrase for Schooling (2)"},{"name":"FM_SCHOOL_DIPLOMA","description":"Meta for Schooling + Diploma."},{"name":"FM_SUB_TEEN_NUDE","description":"Subject says teen and nude"},{"name":"FM_SUBJ_APPROVE","description":"Subject has Approve and !"},{"name":"FM_SUBJ_YOU_PROFIT","description":"Subject says you profit"},{"name":"FM_VEGAS_CASINO","description":"Looks like vega casino spam"},{"name":"FM_WEIGHT_LOSS","description":"Looks like oprah weight loss spam."},{"name":"FRT_ABSOLUT","description":"ReplaceTags: Absolutely"},{"name":"FRT_ADOBE2","description":"ReplaceTags: Adobe"},{"name":"FRT_ADULT2","description":"ReplaceTags: Adult"},{"name":"FRT_APPROV","description":"ReplaceTags: Approve"},{"name":"FRT_BEFORE","description":"ReplaceTags: Before"},{"name":"FRT_BELOW2","description":"ReplaceTags: Below (2)"},{"name":"FRT_BIGGERMEM1","description":"ReplaceTags: Bigger / Larger, Penis / Member"},{"name":"FRT_CANSPAM","description":"ReplaceTags: Can Spam"},{"name":"FRT_CLICK","description":"ReplaceTags: Click"},{"name":"FRT_COCK","description":"ReplaceTags: Cock"},{"name":"FRT_CONTACT","description":"ReplaceTags: Contact"},{"name":"FRT_ERECTION","description":"ReplaceTags: Erection"},{"name":"FRT_ESTABLISH","description":"ReplaceTags: Establish"},{"name":"FRT_EXPERIENCE","description":"ReplaceTags: Experience"},{"name":"FRT_FOLLOW1","description":"ReplaceTags: Follow"},{"name":"FRT_FOLLOW2","description":"ReplaceTags: Follow (2)"},{"name":"FRT_FREE","description":"ReplaceTags: Free"},{"name":"FRT_FRIEND","description":"ReplaceTags: Friend"},{"name":"FRT_FUCK1","description":"ReplaceTags: Fuck (1)"},{"name":"FRT_HEALTH","description":"ReplaceTags: Health"},{"name":"FRT_HOUR","description":"ReplaceTags: Hour"},{"name":"FRT_INCOME","description":"ReplaceTags: Income"},{"name":"FRT_INTEREST","description":"ReplaceTags: Interest"},{"name":"FRT_LITTLE","description":"ReplaceTags: Little"},{"name":"FRT_LOLITA1","description":"ReplaceTags: Lolita (1)"},{"name":"FRT_OFFER2","description":"ReplaceTags: Offer (2)"},{"name":"FRT_OPPORTUN1","description":"ReplaceTags: Oppertun (1)"},{"name":"FRT_PACKAGE","description":"ReplaceTags: Package"},{"name":"FRT_PAYMENT","description":"ReplaceTags: Payment"},{"name":"FRT_PENIS1","description":"ReplaceTags: Penis"},{"name":"FRT_PHARMAC","description":"ReplaceTags: Pharmac"},{"name":"FRT_POSSIBLE","description":"ReplaceTags: Possible"},{"name":"FRT_PRICE","description":"ReplaceTags: Price"},{"name":"FRT_PROFILE1","description":"ReplaceTags: Profile (1)"},{"name":"FRT_PROFILE2","description":"ReplaceTags: Profile (2)"},{"name":"FRT_PROFIT1","description":"ReplaceTags: Profit (1)"},{"name":"FRT_PROFIT2","description":"ReplaceTags: Profit (2)"},{"name":"FRT_PUSSY","description":"ReplaceTags: Pussy"},{"name":"FRT_ROLEX","description":"ReplaceTags: Rolex"},{"name":"FRT_SLUT","description":"ReplaceTags: Slut"},{"name":"FRT_STOCK1","description":"ReplaceTags: Stock (1)"},{"name":"FRT_STOCK2","description":"ReplaceTags: Stock (2)"},{"name":"FRT_VIRGIN1","description":"ReplaceTags: Virgin (1)"},{"name":"PDS_OTHER_BAD_TLD","description":"Untrustworthy TLDs"},{"name":"FROM_SUSPICIOUS_NTLD","description":"From abused NTLD"},{"name":"FROM_SUSPICIOUS_NTLD_FP","description":"From abused NTLD"},{"name":"FROM_NTLD_REPLY_FREEMAIL","description":"From abused NTLD and Reply-To is FREEMAIL"},{"name":"FROM_NTLD_LINKBAIT","description":"From abused NTLD with little more than a URI"},{"name":"GOOGLE_DRIVE_REPLY_BAD_NTLD","description":"From Google Drive and Reply-To is from a suspicious TLD"},{"name":"SEO_SUSP_NTLD","description":"SEO offer from suspicious TLD"},{"name":"THIS_IS_ADV_SUSP_NTLD","description":"This is an advertisement from a suspicious TLD"},{"name":"BULK_RE_SUSP_NTLD","description":"Precedence bulk and RE: from a suspicious TLD"},{"name":"SHORT_IMG_SUSP_NTLD","description":"Short HTML + image + suspicious TLD"},{"name":"VPS_NO_NTLD","description":"vps[0-9] domain at a suspiscious TLD"},{"name":"OFFER_ONLY_AMERICA","description":"Offer only available to US"},{"name":"SENT_TO_EMAIL_ADDR","description":"Email was sent to email address"},{"name":"SUSPNTLD_EXPIRATION_EXTORT","description":"Susp NTLD with an expiration notice and lotsa money"},{"name":"PDS_BTC_NTLD","description":"Bitcoin suspect NTLD"},{"name":"NUMBEREND_LINKBAIT","description":"Domain ends in a large number and very short body with link"},{"name":"NUMBERONLY_BITCOIN_EXP","description":"Domain ends in a large number and very short body with link"},{"name":"PDS_NAKED_TO_NUMERO","description":"Naked-to, numberonly domain"},{"name":"FROM_FMBLA_NEWDOM","description":"From domain was registered in last 7 days"},{"name":"FROM_FMBLA_NEWDOM14","description":"From domain was registered in last 7-14 days"},{"name":"FROM_FMBLA_NEWDOM28","description":"From domain was registered in last 14-28 days"},{"name":"FROM_FMBLA_NDBLOCKED","description":"ADMINISTRATOR NOTICE: The query to fresh.fmb.la was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"FROM_NUMBERO_NEWDOMAIN","description":"Fingerprint and new domain"},{"name":"FROM_NEWDOM_BTC","description":"Newdomain with Bitcoin ID"},{"name":"KAM_LOTTO1","description":"Likely to be a e-Lotto Scam Email"},{"name":"KAM_LOTTO2","description":"Highly Likely to be a e-Lotto Scam Email"},{"name":"KAM_LOTTO3","description":"Almost certain to be a e-Lotto Scam Email"},{"name":"KAM_ABOUT","description":"Email Scam Hawking Anti-Spyware"},{"name":"KAM_ADVERT","description":"Mailing List Scammers Hawking Their Lists / Services"},{"name":"KAM_ADVERT2","description":"This is probably an unwanted commercial email..."},{"name":"KAM_1LINE","description":"One liner spams"},{"name":"KAM_CANSPAM","description":"SPAM = Lack of Consent not a Legal Defintion"},{"name":"KAM_GIFT","description":"Gift Card Scams"},{"name":"KAM_SHOP","description":"Mystery Shopper Scams"},{"name":"KAM_FAST","description":"Get Rich Quick, Make Money Fast Schemes"},{"name":"KAM_BIZ","description":"Free Business Card Emails"},{"name":"KAM_ANA","description":"Likely Anatrim Weightloss Spam"},{"name":"KAM_REPLACE","description":"Spams that use obfuscated URLs with instructions"},{"name":"FSL_NOT_FROM_GOOGLE","description":"Envelope-From GMail or Google but not originated from Google systems"},{"name":"FSL_NOT_FROM_YAHOO","description":"Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems"},{"name":"FSL_NOT_FROM_HOTMAIL","description":"Envelope-From Hotmail/Live but not originated from Hotmail systems"},{"name":"FSL_NOT_FROM_AOL","description":"Envelope-From AOL but not originated from AOL systems"},{"name":"FSL_UNDISCLOSED_RCPTS","description":"To undisclosed recipients"},{"name":"FSL_ABUSED_WEB_1","description":"Has X-AntiAbuse header"},{"name":"FSL_ABUSED_WEB_2","description":"Has X-PHP-Script header"},{"name":"FSL_ABUSED_WEB_3","description":"Has X-PHP-Originating-Script header"},{"name":"FSL_UNDISCLOSED_BULK","description":"Undisclosed recipients and bulk signature"},{"name":"FSL_YAHOO_AUTH_SIG","description":"Yahoo SMTP AUTH observed patterns"},{"name":"SMF_FM_FORGED_REPLYTO","description":"Freemail in Reply-To, but not From"},{"name":"FSL_HTML_BLOCK_LOTS_1","description":"More <div> or <span> blocks than lines"},{"name":"FSL_HTML_BLOCK_LOTS_2","description":"More <div> or <span> blocks than twice the amount of lines"},{"name":"FSL_HTML_BLOCK_LOTS_3","description":"More <div> or <span> blocks than 4x the amount of lines"},{"name":"FSL_HTML_ENT_LOTS_1","description":"Lots of HTML entities x2"},{"name":"FSL_HTML_ENT_LOTS_2","description":"Lots of HTML entities x8"},{"name":"FSL_HTML_ENT_LOTS_3","description":"Lots of HTML entities x24"},{"name":"TVD_SILLY_URI_OBFU","description":"URI obfuscation that can fool a URIBL or a uri rule"},{"name":"FUZZY_MERIDIA","description":"Obfuscation of the word \"meridia\""},{"name":"TVD_FUZZY_PHARMACEUTICAL","description":"Obfuscation of the word \"pharmaceutical\""},{"name":"TVD_FUZZY_SYMBOL","description":"Obfuscation of the word \"symbol\""},{"name":"TVD_FUZZY_FINANCE","description":"Obfuscation of the word \"finance\""},{"name":"TVD_FUZZY_FIXED_RATE","description":"Obfuscation of the phrase \"fixed rate\""},{"name":"TVD_FUZZY_MICROCAP","description":"Obfuscation of the word \"micro-cap\""},{"name":"TVD_FUZZY_DEGREE","description":"Obfuscation of the word \"degree\""},{"name":"DEAR_WINNER","description":"Spam with generic salutation of \"dear winner\""},{"name":"SUBJECT_NEEDS_ENCODING","description":"Subject is encoded but does not specify the encoding"},{"name":"DRUGS_HDIA","description":"Subject mentions \"hoodia\""},{"name":"TVD_FROM_1","description":"From address appears to be a throwaway domain"},{"name":"TVD_RATWARE_CB","description":"Content-Type header that is commonly indicative of ratware"},{"name":"TVD_SUBJ_WIPE_DEBT","description":"Spam advertising a way to eliminate debt"},{"name":"TVD_ACT_193","description":"Message refers to an act passed in the 1930s"},{"name":"TVD_APPROVED","description":"Body states that the recipient has been approved"},{"name":"TVD_DEAR_HOMEOWNER","description":"Spam with generic salutation of \"dear homeowner\""},{"name":"TVD_INCREASE_SIZE","description":"Advertising for penis enlargement"},{"name":"TVD_SECTION","description":"References to specific legal codes"},{"name":"TVD_VISIT_PHARMA","description":"Body mentions online pharmacy"},{"name":"TVD_SUBJ_OWE","description":"Subject line states that the recipieint is in debt"},{"name":"NULL_IN_BODY","description":"Message has NUL (ASCII 0) byte in message"},{"name":"TVD_FW_GRAPHIC_NAME_LONG","description":"Long image attachment name"},{"name":"TVD_FW_GRAPHIC_NAME_MID","description":"Medium sized image attachment name"},{"name":"TVD_FLOAT_GENERAL","description":"Message uses CSS float style"},{"name":"TVD_SUBJ_FINGER_03","description":"Entire subject is enclosed in asterisks \"* like so *\""},{"name":"TVD_SPACED_SUBJECT_WORD3","description":"Entire subject is \"UPPERlowerUPPER\" with no whitespace"},{"name":"TVD_VIS_HIDDEN","description":"Invisible textarea HTML tags"},{"name":"TVD_QUAL_MEDS","description":"The body matches phrases such as \"quality meds\" or \"quality medication\""},{"name":"TVD_LINK_SAVE","description":"Spam with the text \"link to save\""},{"name":"TVD_RATWARE_CB_2","description":"Content-Type header that is commonly indicative of ratware"},{"name":"TVD_RATWARE_MSGID_02","description":"Ratware with a Message-ID header that is entirely lower-case"},{"name":"BASE64_LENGTH_79_INF","description":"base64 encoded email part uses line length of 78 or 79 characters"},{"name":"BASE64_LENGTH_79_INF","description":"base64 encoded email part uses line length greater than 79 characters"},{"name":"TVD_RCVD_IP4","description":"Message was received from an IPv4 address"},{"name":"TVD_RCVD_IP","description":"Message was received from an IP address"},{"name":"TVD_RCVD_SINGLE","description":"Message was received from localhost"},{"name":"HEADER_COUNT_SUBJECT","description":"Multiple Subject headers found"},{"name":"RCVD_BAD_ID","description":"Received header contains id field with bad characters"},{"name":"TVD_ENVFROM_APOST","description":"Envelope From contains single-quote"},{"name":"TVD_STOCK1","description":"Spam related to stock trading"},{"name":"TVD_PDF_FINGER01","description":"Mail matches standard pdf spam fingerprint"},{"name":"PDS_PHP_EVAL","description":"PHP header shows eval'd code"},{"name":"PDS_PHP_RUNTIME_FUNC","description":"PHP header shows runtime-created function"},{"name":"PDS_X_PHP_WP_EXP","description":"X-PHP-Script shows sent from a Wordpress PHP script where you would not expect one"},{"name":"PDS_X_PHP_WELLKNOWN","description":"X-PHP-Script shows sent from a PHP script in the /.well-known/ dir"},{"name":"PDS_PHPE_SHORT_URL","description":"Short URL that isn't a shortener and sent by PHP exploit"},{"name":"PDS_PHPE_URISHORTENER","description":"URI Shortener with PHP eval"},{"name":"PDS_PHPEXP_BOT","description":"PHP exploit bot sender"},{"name":"DATE_IN_FUTURE_96_WEEK","description":"Date: is 4 to 7 days after Received: date"},{"name":"DATE_IN_FUTURE_WEEK","description":"Date: is a week to a month after Received: date"},{"name":"DATE_IN_FUTURE_MONTH","description":"Date: is 1 to 4 months after Received: date"},{"name":"DATE_IN_FUTURE_YEAR","description":"Date: is 4 months to a year after Received: date"},{"name":"DATE_IN_FUTURE_1Y_4Y","description":"Date: is 1 to 4 years after Received: date"},{"name":"DATE_IN_DISTANT_FUTURE","description":"Date: is over 4 years after Received: date"},{"name":"DATE_IN_FUTURE_96_Q","description":"Date: is 4 days to 4 months after Received: date"},{"name":"DATE_IN_FUTURE_Q_PLUS","description":"Date: is over 4 months after Received: date"},{"name":"AC_SPAMMY_URI_PATTERNS1","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS2","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS3","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS4","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS8","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS9","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS10","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS11","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS12","description":"link combos match highly spammy template"},{"name":"AC_BAYES_99","description":"Bayes spam probability is 99 to 99.9%"},{"name":"AC_BAYES_999","description":"Bayes spam probability is 99.9 to 100%"},{"name":"AC_BR_BONANZA","description":"Too many newlines in a row... spammy template"},{"name":"AC_DIV_BONANZA","description":"Too many divs in a row... spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS5","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS6","description":"link combos match highly spammy template"},{"name":"AC_SPAMMY_URI_PATTERNS7","description":"link combos match highly spammy template"},{"name":"URI_IN_URI_5","description":"Multiple URIs inside URI"},{"name":"URI_IN_URI_10","description":"Multiple URIs inside URI"},{"name":"URI_IN_URI_20","description":"Multiple URIs inside URI"},{"name":"MILLION_HUNDRED","description":"Million \"One to Nine\" Hundred"},{"name":"HK_RANDOM_ENVFROM","description":"Envelope sender username looks random"},{"name":"HK_RANDOM_FROM","description":"From username looks random"},{"name":"HK_RANDOM_REPLYTO","description":"Reply-To username looks random"},{"name":"HK_RANDOM_FROM_NAME","description":"From name looks random"},{"name":"HK_RANDOM_REPLYTO_NAME","description":"Reply-To name looks random"},{"name":"HK_NAME_DRUGS","description":"From name contains drugs"},{"name":"HK_NAME_FREE","description":"From name mentions free stuff"},{"name":"HK_SUBJECT_SPACES","description":"Lots of spaces in Subject"},{"name":"HK_SUBJECT_SPACES_SC","description":"Lots of spaces in Subject with some obfuscation"},{"name":"HK_MUCHMONEY","description":"Message refers to hundreds of thousands or millions"},{"name":"__TAB_IN_FROM","description":"From starts with a tab"},{"name":"TAB_IN_FROM","description":"From starts with a tab"},{"name":"HK_FAKENAME_MICROSOFT","description":"From name mentions Microsoft, but not relayed from there"},{"name":"HK_FAKENAME_YAHOO","description":"From name mentions Yahoo, but not relayed from there"},{"name":"HK_FAKENAME_PAYPAL","description":"From name mentions PayPal, but not relayed from there"},{"name":"HK_FAKENAME_EBAY","description":"From name mentions eBay, but not relayed from there"},{"name":"TEST_NOREALNAME","description":"From: does not include a real name"},{"name":"TEST_ENDSNUMS","description":"From: ends in many numbers"},{"name":"TEST_FORGED_YAHOO_RCVD","description":"'From' yahoo.com does not match 'Received' headers"},{"name":"TEST_NORMAL_HTTP_TO_IP","description":"Uses a dotted-decimal IP address in URL"},{"name":"TEST_EXCUSE_12","description":"Nobody's perfect"},{"name":"TEST_EXCUSE_4","description":"Claims you can be removed from the list"},{"name":"TEST_INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"TEST_MSGID_OUTLOOK_INVALID","description":"Message-Id is fake (in Outlook Express format)"},{"name":"MISSING_HB_SEP","description":"Missing blank line between message header and body"},{"name":"X_MESSAGE_INFO","description":"Bulk email fingerprint (X-Message-Info) found"},{"name":"SORTED_RECIPS","description":"Recipient list is sorted by address"},{"name":"SUSPICIOUS_RECIPS","description":"Similar addresses in recipient list"},{"name":"GTUBE","description":"Generic Test for Unsolicited Bulk Email"},{"name":"BAYES_99","description":"Bayes spam probability is 99 to 100%"},{"name":"INVALID_MSGID","description":"Message-Id is not valid, according to RFC 2822"},{"name":"INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"AWL","description":"From: address is in the auto white-list"},{"name":"DCC_CHECK","description":"Detected as bulk mail by DCC (dcc-servers.net)"},{"name":"SHORTCIRCUIT","description":"Not all rules were run, due to a shortcircuited rule"},{"name":"RAZOR2_CHECK","description":"Listed in Razor2 (http://razor.sf.net/)"},{"name":"MALFORMED_FREEMAIL","description":"Bad headers on message from free email service"},{"name":"FROM_WEBSITE","description":"Sender name appears to be a link"},{"name":"FROM_2_EMAILS","description":"Sender claims to have a different email"},{"name":"KHOP_BIG_TO_CC","description":"Sent to 10+ recipients instaed of Bcc or a list"},{"name":"KHOP_FAKE_EBAY","description":"Sender falsely claims to be from eBay"},{"name":"KHOP_FOREIGN_CLICK","description":"Click here link in non-English Latin text"},{"name":"SPOOFED_URL","description":"Has a link whose text is a different URL"},{"name":"URL_SHORTENER","description":"Has a shortened URL (can hide a blacklisted link)"},{"name":"SHORT_URL","description":"Has a short URL without a shortening service"},{"name":"URI_HIDDEN","description":"Contains a hidden directory"},{"name":"BOTNET_SHAWCABLE","description":"Shawcable.net customer address"},{"name":"BOTNET_OCNNEJP","description":"Ocn.ne.jp customer address"},{"name":"__BOTNET_NOTRUST","description":"Message has no trusted relays"},{"name":"KHOP_HELO_FCRDNS","description":"Relay HELO differs from its IP's reverse DNS"},{"name":"HELO_NO_DOMAIN","description":"Relay reports its domain incorrectly"},{"name":"NAME_EMAIL_DIFF","description":"Sender NAME is an unrelated email address"},{"name":"ADV_SUBJ","description":"Marked by sender as an advertisement"},{"name":"UPPERCASE_URI","description":"Link protocol has unexpected mixed case"},{"name":"KHOP_GREYED","description":"Greylisted and sent from dynamically-named relay"},{"name":"DKIM_INVALID","description":"DKIM-Signature header exists but is not valid"},{"name":"REMOTE_IMAGE","description":"Message contains an external image"},{"name":"LONG_HEADER_LINE_80","description":"A header line contains 80-159 characters"},{"name":"LONG_HEADER_LINE_160","description":"A header line contains 160-239 characters"},{"name":"LONG_HEADER_LINE_240","description":"A header line contains 240-319 characters"},{"name":"LONG_HEADER_LINE_320","description":"A header line contains 320-399 characters"},{"name":"LONG_HEADER_LINE_400","description":"A header line contains 400-499 characters"},{"name":"LONG_HEADER_LINE_500","description":"A header line contains 500+ characters"},{"name":"SINGLE_HEADER_1K","description":"A single header contains 1K-2K characters"},{"name":"SINGLE_HEADER_2K","description":"A single header contains 2K-3K characters"},{"name":"SINGLE_HEADER_3K","description":"A single header contains 3K-4K characters"},{"name":"SINGLE_HEADER_4K","description":"A single header contains 4K-5K characters"},{"name":"SINGLE_HEADER_5K","description":"A single header contains 5K+ characters"},{"name":"BIG_HEADERS_2K","description":"Headers contain 2K-3K characters total"},{"name":"BIG_HEADERS_3K","description":"Headers contain 3K-4K characters total"},{"name":"BIG_HEADERS_4K","description":"Headers contain 4K-5K characters total"},{"name":"BIG_HEADERS_5K","description":"Headers contain 5K+ characters total"},{"name":"DEB_RAJONAA","description":"Latvian text with .info URI on Debian List"},{"name":"__TO_EQ_FROM_USR","description":"To: username same as From: username"},{"name":"__TO_EQ_FROM_USR_NN","description":"To: username same as From: username sans trailing nums"},{"name":"SUBJ_LACKS_WORDS","description":"Subject is not short yet lacks words"},{"name":"__FORGED_TBIRD_IMG","description":"Possibly forged Thunderbird image spam"},{"name":"FORGED_TBIRD_IMG_ARROW","description":"Likely forged Thunderbird image spam"},{"name":"TO_NO_BRKTS_HTML_IMG","description":"To: lacks brackets and HTML and one image"},{"name":"TO_NO_BRKTS_HTML_ONLY","description":"To: lacks brackets and HTML only"},{"name":"TO_NO_BRKTS_DYNIP","description":"To: lacks brackets and dynamic rDNS"},{"name":"TO_NO_BRKTS_NORDNS","description":"To: lacks brackets and no rDNS"},{"name":"TO_NO_BRKTS_NORDNS_HTML","description":"To: lacks brackets and no rDNS and HTML only"},{"name":"TO_NO_BRKTS_MSFT","description":"To: lacks brackets and supposed Microsoft tool"},{"name":"TO_NO_BRKTS_PCNT","description":"To: lacks brackets + percentage"},{"name":"TO_NO_BRKTS_DIRECT","description":"To: lacks brackets and direct-to-MX"},{"name":"TO_NO_BRKTS_NOTLIST","description":"To: lacks brackets and not a mailing list"},{"name":"TO_NO_BRKTS_FREEMAIL","description":"To: lacks brackets and free email service"},{"name":"TO_NO_BRKTS_FROM_MSSP","description":"Multiple header formatting problems"},{"name":"FORGED_TBIRD_IMG_TO_MX","description":"Likely forged Thunderbird image spam"},{"name":"FORGED_TBIRD_IMG_SIZE","description":"Likely forged Thunderbird image spam"},{"name":"AXB_XM_LORIS232","description":"Blast from the past?"},{"name":"AXB_X_OUTLOOKPROT_ENVSDR","description":"Outlook Protection trash trait"},{"name":"AXB_X_FF_SEZ_S","description":"Forefront sez this is spam"},{"name":"AXB_XM_FORGED_OL2600","description":"Forged OE v. 6.2600"},{"name":"AXB_X_AOL_SEZ_S","description":"AOL said this is S*"},{"name":"DX_TEXT_01","description":"\"message status\""},{"name":"DX_TEXT_02","description":"\"change your message stat\""},{"name":"DX_TEXT_03","description":"\"XXX Media Group\""},{"name":"DX_TEXT_04","description":"\"Media Group by writing\""},{"name":"DX_TEXT_05","description":"HTML snobbery"},{"name":"GB_MALWARE_DROPBOX_JAR_URI","description":"Dropbox that forces user to download jar file"},{"name":"GB_GOOGLE_OBFUR","description":"Obfuscate url through Google redirect"},{"name":"GB_GOOGLE_OBFUS","description":"Obfuscate url through Google search"},{"name":"GB_COPY_OF_SHORT","description":"Url shortnener spam"},{"name":"GB_FROMNAME_SPOOFED_EMAIL_IP","description":"From:name looks like a spoofed email from a spoofed ip"},{"name":"GB_GOOG_IMG_NOT_RCVD_GOOG","description":"Google hosted image but message not from Google"},{"name":"GB_LINKED_IMG_NOT_RCVD_LINK","description":"Linkedin hosted image but message not from Linkedin"},{"name":"SENDINBLUE_REDIR","description":"Redirect URI via Sendinblue"},{"name":"SENDINBLUE_REDIR_PHISH","description":"Redirect URI via Sendinblue + phishing signs"},{"name":"DNSBL_TEST_TOP","description":"DNSBL A record match"},{"name":"DNSBL_TEST_WHITELIST","description":"DNSBL whitelist match"},{"name":"DNSBL_TEST_WHITELIST_MISS","description":"This rule should not match"},{"name":"DNSBL_TEST_UNTRUSTED","description":"DNSBL untrusted match"},{"name":"DNSBL_TEST_DYNAMIC","description":"DNSBL dynamic match"},{"name":"DNSBL_TEST_SPAM","description":"DNSBL spam source"},{"name":"DNSBL_TEST_RELAY","description":"DNSBL open relay"},{"name":"DNSBL_TEST_MISS","description":"DNSBL open relay"},{"name":"DNSBL_TXT_TOP","description":"DNSBL TXT record match"},{"name":"DNSBL_TXT_RE","description":"DNSBL TXT regular expression match"},{"name":"DNSBL_TXT_MISS","description":"DNSBL TXT regular expression match (should miss)"},{"name":"DNSBL_RHS","description":"DNSBL RHS match"},{"name":"TT_MSGID_TRUNC","description":"Scora: Message-Id ends after left-bracket + digits"},{"name":"CORRUPT_FROM_LINE_IN_HDRS","description":"Informational: message is corrupt, with a From line in its headers"},{"name":"PART_CID_STOCK","description":"Has a spammy image attachment (by Content-ID)"},{"name":"PART_CID_STOCK_LESS","description":"Has a spammy image attachment (by Content-ID, more specific)"},{"name":"RCVD_FORGED_WROTE","description":"Forged 'Received' header found ('wrote:' spam)"},{"name":"DRUGS_STOCK_MIMEOLE","description":"Stock-spam forged headers found (5510)"},{"name":"RCVD_MAIL_COM","description":"Forged Received header (contains post.com or mail.com)"},{"name":"CTYPE_8SPACE_GIF","description":"Stock spam image part 'Content-Type' found (8 spc)"},{"name":"STOCK_IMG_HDR_FROM","description":"Stock spam image part, with distinctive From line"},{"name":"STOCK_IMG_HTML","description":"Stock spam image part, with distinctive HTML"},{"name":"STOCK_IMG_OUTLOOK","description":"Stock spam image part, with Outlook-like features"},{"name":"SPAMMY_XMAILER","description":"X-Mailer string is common in spam and not in ham"},{"name":"SHORT_HELO_AND_INLINE_IMAGE","description":"Short HELO string, with inline image"},{"name":"DYN_RDNS_AND_INLINE_IMAGE","description":"Contains image, and was sent by dynamic rDNS"},{"name":"DYN_RDNS_SHORT_HELO_HTML","description":"Sent by dynamic rDNS, short HELO, and HTML"},{"name":"DYN_RDNS_SHORT_HELO_IMAGE","description":"Short HELO string, dynamic rDNS, inline image"},{"name":"HDR_ORDER_FTSDMCXX_BAT","description":"Header order similar to spam (FTSDMCXX/boundary variant)"},{"name":"HDR_ORDER_FTSDMCXX_001C","description":"Header order similar to spam (FTSDMCXX/MID variant)"},{"name":"STOCK_IMG_CTYPE","description":"Stock spam image part, with distinctive Content-Type header"},{"name":"JM_REACTOR_MAILER","description":"Header patterns indicative of \"Reactor Mailer\" ratware"},{"name":"RATWARE_HELO_DM","description":"External host used 'DM' as the HELO name, DarkMailer signature"},{"name":"LOLLY_419","description":"Your name is \"Lolly\"?  _sure_ it is"},{"name":"DUH_DIKSBJ","description":"Idiot spammer screwed up his templates (DIK variant)"},{"name":"__CN_URL","description":"Contains a URL in the .cn domain"},{"name":"AXB_PDFINFO_AUTH_TEST","description":"PDF trait seen in spam"},{"name":"AXB_PDF_FUZZY_LOTTOUK","description":"Fuzzy tags Match"},{"name":"AXB_PDF_FUZZY2_WINNING","description":"Fuzzy tags match"},{"name":"AXB_PDF_FUZZY1_EBR","description":"Fuzzy tags match"},{"name":"FSL_MY_NAME_IS","description":"My name is ..."},{"name":"FSL_BULK_SIG","description":"Bulk signature with no Unsubscribe"},{"name":"FSL_LINK_AWS_S3_WEB","description":"Contains a link to Amazon S3 website"},{"name":"FSL_LINK_AWS_S3_WEB_FM","description":"Contains a link to Amazon S3 website and from a Freemail address"},{"name":"FSL_PHP_EXPLOIT_41","description":"PHP Script being run by someone in Africa"},{"name":"T_ADVANCE_FEE_2_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_3_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_4_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_5_NEW","description":"Appears to be advance fee fraud (Nigerian 419)"},{"name":"ADVANCE_FEE_2_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_3_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_4_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_5_NEW_MONEY","description":"Advance Fee fraud and lots of money"},{"name":"ADVANCE_FEE_2_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_3_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_4_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_5_NEW_FORM","description":"Advance Fee fraud and a form"},{"name":"ADVANCE_FEE_2_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"ADVANCE_FEE_3_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"ADVANCE_FEE_4_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"ADVANCE_FEE_5_NEW_FRM_MNY","description":"Advance Fee fraud form and lots of money"},{"name":"__RCVD_IN_HOSTKARMA","description":"Sender listed in JunkEmailFilter HostKarma"},{"name":"RCVD_IN_HOSTKARMA_WL","description":"Sender listed in HOSTKARMA-WHITE, http://hostkarma.junkemailfilter.com"},{"name":"RCVD_IN_HOSTKARMA_BL","description":"Sender listed in HOSTKARMA-BLACK, http://hostkarma.junkemailfilter.com"},{"name":"RCVD_IN_HOSTKARMA_YL","description":"Sender listed in HOSTKARMA-YELLOW, http://hostkarma.junkemailfilter.com"},{"name":"RCVD_IN_HOSTKARMA_BR","description":"Sender listed in HOSTKARMA-BROWN, http://hostkarma.junkemailfilter.com"},{"name":"DKIMWL_WL_HIGH","description":"DKIMwl.org - High trust sender"},{"name":"DKIMWL_WL_MEDHI","description":"DKIMwl.org - Medium-high trust sender"},{"name":"DKIMWL_WL_MED","description":"DKIMwl.org - Medium trust sender"},{"name":"DKIMWL_BL","description":"DKIMwl.org - Blocked sender"},{"name":"DKIMWL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to DKIMWL.org was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"LOTS_OF_MONEY","description":"Huge... sums of money"},{"name":"MONEY_FREEMAIL","description":"Lots of money from someone using free email?"},{"name":"MONEY_FROM_MISSP","description":"Lots of money and misspaced From"},{"name":"MONEY_TO_NO_R","description":"Lots of money and bare, missing or undisclosed To"},{"name":"MONEY_FORM","description":"Lots of money if you fill out a form"},{"name":"MONEY_FORM_SHORT","description":"Lots of money if you fill out a short form"},{"name":"MONEY_ACCOUNT","description":"Lots of money to your account"},{"name":"WON_MONEY_ATTACH","description":"You won lots of money! See attachment."},{"name":"WON_NBDY_ATTACH","description":"You won lots of money! See attachment."},{"name":"LOTTO_AGENT","description":"Claims Agent"},{"name":"LOTTO_DEPT","description":"Claims Department"},{"name":"LOTTO_URI","description":"Claims Department URL"},{"name":"LOTTO_AGENT_FM","description":"Claims Agent"},{"name":"LOTTO_AGENT_RPLY","description":"Claims Agent"},{"name":"MONEY_LOTTERY","description":"Lots of money from a lottery"},{"name":"SHARE_50_50","description":"Share the money 50/50"},{"name":"EMRCP","description":"\"Excess Maximum Return Capital Profit\" scam"},{"name":"LUCRATIVE","description":"Make lots of money!"},{"name":"MONEY_PERCENT","description":"X% of a lot of money for you"},{"name":"MONEY_DEAL","description":"Lots of money in a suspicious deal"},{"name":"MONEY_ATM_CARD","description":"Lots of money on an ATM card"},{"name":"YOU_INHERIT","description":"Discussing your inheritance"},{"name":"DECEASED_NO_ML","description":"Dead not via mailing list"},{"name":"XFER_LOTSA_MONEY","description":"Transfer a lot of money"},{"name":"MONEY_BARRISTER","description":"Lots of money from a UK lawyer"},{"name":"UN_NO_ML","description":"United Nations not via mailing list"},{"name":"COMPENSATION","description":"\"Compensation\""},{"name":"MONEY_FRAUD_BOX","description":"Lots of money in a box, lots of money from a fox"},{"name":"DEAR_BENEFICIARY","description":"Dear Beneficiary:"},{"name":"YOUR_PERMISSION","description":"With your permission..."},{"name":"RISK_FREE","description":"No risk!"},{"name":"MONEY_FRAUD","description":"Lots of money and a fraud phrase"},{"name":"MONEY_FRAUD_3","description":"Lots of money and several fraud phrases"},{"name":"MONEY_FRAUD_5","description":"Lots of money and many fraud phrases"},{"name":"MONEY_FRAUD_8","description":"Lots of money and very many fraud phrases"},{"name":"FORM_FRAUD","description":"Fill a form and a fraud phrase"},{"name":"FORM_FRAUD_3","description":"Fill a form and several fraud phrases"},{"name":"FORM_FRAUD_5","description":"Fill a form and many fraud phrases"},{"name":"KHOP_BSD_REPORT","description":"Regular run output from a BSD system"},{"name":"KHOP_LOGWATCH_REPORT","description":"System report from LogWatch"},{"name":"KHOP_ENCRYPTED_CONTENT","description":"Message is encrypted"},{"name":"KHOP_PGP_INLINE","description":"BODY: Contains PGP data"},{"name":"KHOP_PGP_SIGNED","description":"Message seems to contain PGP signature"},{"name":"KHOP_SMIME_SIGNED","description":"Message seems to contain S/MIME signature"},{"name":"KHOP_THREADED","description":"Message references or replies to another message"},{"name":"APOSTROPHE_FROM","description":"From address contains an apostrophe"},{"name":"APOSTROPHE_TOCC","description":"To or CC address contains an apostrophe"},{"name":"STUDDLYCAPS","description":"ContainsThreeWordsLikeThis"},{"name":"GB_HIDDEN_WORD","description":"hidden word"},{"name":"GB_HIDDEN_FONT","description":"hidden font"},{"name":"GB_YELLOW_BG","description":"Yellow background on few words"},{"name":"URI_OBFU_WWW","description":"Obfuscated URI"},{"name":"URI_OBFU_PROTO","description":"URI http protocol with space obfuscation"},{"name":"URI_OBFU_TLD","description":"URI top-level domain with space obfuscation"},{"name":"URI_DEOBFU_INSTR","description":"How to deobfuscate this URI"},{"name":"__KAM_BODY_LENGTH_LT_128","description":"The length of the body of the email is less than 128 bytes."},{"name":"__KAM_BODY_LENGTH_LT_256","description":"The length of the body of the email is less than 256 bytes."},{"name":"__KAM_BODY_LENGTH_LT_512","description":"The length of the body of the email is less than 512 bytes."},{"name":"__KAM_BODY_LENGTH_LT_1024","description":"The length of the body of the email is less than 1024 bytes."},{"name":"TT_OBSCURED_VIAGRA","description":"Scora: obscured \"VIAGRA\" in subject"},{"name":"TT_OBSCURED_XANAX","description":"Scora: obscured \"XANAX\" in subject"},{"name":"TT_OBSCURED_VALIUM","description":"Scora: obscured \"VALIUM\" in subject"},{"name":"RCVD_IN_UCEPROTECT_L1","description":"Listed in dnsbl-1.uceprotect.net."},{"name":"FROM_GOV_SPOOF","description":"From Government domain but matches SPOOFED"},{"name":"FROM_GOV_DKIM_AU","description":"From Government address and DKIM signed"},{"name":"FROM_GOV_REPLYTO_FREEMAIL","description":"From Government domain but ReplyTo is FREEMAIL"},{"name":"MAY_BE_FORGED","description":"Relay IP's reverse DNS does not resolve to IP"},{"name":"DEAR_EMAIL","description":"Message contains Dear email address"},{"name":"DEAR_NOBODY","description":"Message contains Dear but with no name"},{"name":"FORGED_URL_DOM","description":"Link domain has a TLD as a subdomain"},{"name":"FROM_WWW","description":"Sender name appears to be a website"},{"name":"LOOPHOLE_1","description":"A loop hole in the banking laws?"},{"name":"BANKING_LAWS","description":"Talks about banking laws"},{"name":"AJB_CANPOST_BADLINK","description":"Found a mismatch between href and anchored text pretending to link to www.canadapost.ca"},{"name":"AJB_UTUBE_BADLINK","description":"Found a mismatch between href and anchored text pretending to link to www.youtube.com"},{"name":"AJB_FK_UTUBE_BOTNET","description":"mismatch between href and anchored + empty subject = botnet"},{"name":"RCVD_IN_RP_CERTIFIED","description":"Sender in ReturnPath Certified - Contact cert-sa@returnpath.net"},{"name":"RCVD_IN_RP_SAFE","description":"Sender in ReturnPath Safe - Contact safe-sa@returnpath.net"},{"name":"RCVD_IN_RP_RNBL","description":"Relay in RNBL, https://senderscore.org/blacklistlookup/"},{"name":"GB_FREEMAIL_DISPTO","description":"Disposition-Notification-To/From or Disposition-Notification-To/body contain different freemails"},{"name":"GB_FREEMAIL_DISPTO_NOTFREEM","description":"Disposition-Notification-To/From contain different freemails but mailfrom is not a freemail"},{"name":"GB_FREEM_FROM_NOT_REPLY","description":"From: and Reply-To: have different freemail domains"},{"name":"GOOGLE_DRIVE_DEAR_SOMETHING","description":"From Google Drive and generic Dear (something)"},{"name":"SHORT_BODY_G_DRIVE_DYN","description":"Short body with Google Drive link and dynamic looking sender"},{"name":"FROM_NAME_EQ_TO_G_DRIVE","description":"From:name equals To:addr and GDRIVE link"},{"name":"MILLION_USD","description":"Talks about millions of dollars"},{"name":"NA_DOLLARS","description":"Talks about a million North American dollars"},{"name":"US_DOLLARS_3","description":"Mentions millions of $ ($NN,NNN,NNN.NN)"},{"name":"CK_HELO_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"CK_HELO_GENERIC","description":"Relay used name indicative of a Dynamic Pool or Generic rPTR"},{"name":"HELO_MISC_IP","description":"Looking for more Dynamic IP Relays"},{"name":"PDS_HELO_SPF_FAIL","description":"High profile HELO that fails SPF"},{"name":"PDS_HP_HELO_NORDNS","description":"High profile HELO with no sender rDNS"},{"name":"GB_FORGED_MUA_TBIRD","description":"Forged Thunderbird Mua"},{"name":"GB_FORGED_MUA_POSTFIX","description":"Forged Postfix mua headers"},{"name":"NOT_A_PERSON","description":"List, replier, bot, etc.  Filters: skip auto-reply"},{"name":"KHOP_UNSUB_LINK","description":"Personal message has unsusbscribe link"},{"name":"KHOP_UNSUB_EMAIL","description":"Unsubscribe by email but not by link"},{"name":"KHOP_NO_FULL_NAME","description":"Sender does not have both First and Last names"},{"name":"OPERA_MID_NO_DIGIT","description":"MUA Opera, Message-Id does not contain digit"},{"name":"OPERA_MID_NON_OP","description":"MUA Opera, Message-Id does not start with op"},{"name":"OPERA_MID_BAD_MASK","description":"MUA Opera, bad Message-Id mask"},{"name":"KB_CTYPE_SP_MOZ","description":"Mozilla does not do that, I hope"},{"name":"KB_FORGED_MOZ4","description":"Mozilla 4 uses X-Mailer"},{"name":"FROM_PAYPAL_SPOOF","description":"From PayPal domain but matches SPOOFED"},{"name":"FROM_PAYPAL_REPLYTO_FREEMAIL","description":"From PayPal domain but ReplyTo is FREEMAIL"},{"name":"FROM_BANK_NOAUTH","description":"From Bank domain but no SPF or DKIM"},{"name":"AXB_XMAILER_MIMEOLE_OL_024C2","description":"Yet another X header trait"},{"name":"AXB_XMAILER_MIMEOLE_OL_1ECD5","description":"Yet another X header trait"},{"name":"FROMNAME_SPOOFED_EMAIL","description":"From:name looks like a spoofed email"},{"name":"FROMNAME_EQUALS_TO","description":"From:name matches To:"},{"name":"KHOP_SC_CIDR8","description":"Relay CIDR /8 is among worst in SpamCop"},{"name":"KHOP_SC_TOP_CIDR8","description":"Relay CIDR /8 leads SpamCop in worst /8s"},{"name":"KHOP_SC_CIDR16","description":"Relay CIDR /16 is among worst in SpamCop"},{"name":"KHOP_SC_TOP_CIDR16","description":"Relay CIDR /16 leads SpamCop in worst /16s"},{"name":"KHOP_SC_CIDR24","description":"Relay CIDR /24 is among worst in SpamCop"},{"name":"KHOP_SC_TOP_CIDR24","description":"Relay CIDR /24 leads SpamCop in worst /24s"},{"name":"KHOP_SC_TOP200","description":"Relay listed in SpamCop top 200 spammer IPs"},{"name":"KHOP_SPAMHAUS_DROP","description":"Relay listed in Spamhaus Don't Route Or Peer List"},{"name":"KHOP_SPAMHAUS_DROP_LE","description":"Relay listed in Spamhaus Don't Route Or Peer List"},{"name":"KHOP_PSBL_CIDR24","description":"Relay's IP/24 CIDR contains many PSBL hits"},{"name":"EXCUSE_24","description":"Claims you wanted this ad"},{"name":"USING_VERP","description":"Message uses VERP"},{"name":"EXCUSE_24","description":"Claims you wanted this ad"},{"name":"USING_VERP","description":"Message uses VERP"},{"name":"PP_TOO_MUCH_UNICODE05","description":"Is text/plain but has many unicode escapes"},{"name":"PP_TOO_MUCH_UNICODE02","description":"Is text/plain but has many unicode escapes"},{"name":"SPOOFED_URL_HOST","description":"Has a link whose text is URL with a different host"},{"name":"COMPUTERS_JEWELRY","description":"Selling computers, jewelry, etc."},{"name":"MIME_NO_TEXT","description":"No (properly identified) text body parts"},{"name":"MIME_PHP_NO_TEXT","description":"No text body parts, X-Mailer: PHP"},{"name":"X_URIBL_IPSONLY","description":"X_URIBL_IPSONLY"},{"name":"X_URIBL_DOMSONLY","description":"X_URIBL_DOMSONLY"},{"name":"FILL_THIS_FORM_LONG","description":"Fill in a form with personal information"},{"name":"FILL_THIS_FORM","description":"Fill in a form with personal information"},{"name":"FILL_THIS_FORM_SHORT","description":"Fill in a short form with personal information"},{"name":"FILL_THIS_FORM_LOAN","description":"Answer loan question(s)"},{"name":"FILL_THIS_FORM_FRAUD_PHISH","description":"Answer suspicious question(s)"},{"name":"TVD_PH_SEC","description":"Message includes a phrase commonly used in phishing mails"},{"name":"TVD_PH_REC","description":"Message includes a phrase commonly used in phishing mails"},{"name":"TVD_SUBJ_ACC_NUM","description":"Subject has spammy looking monetary reference"},{"name":"T_LOCAL_PP_UPD_BADURL","description":"paypal account update, but has bad URL"},{"name":"TVD_PH_SUBJ_META1","description":"Email has a Phishy looking subject line"},{"name":"TVD_PH_BODY_ACCOUNTS_PRE","description":"The body matches phrases such as \"accounts suspended\", \"account credited\", \"account verification\""},{"name":"DSN_NO_MIMEVERSION","description":"Return-Path <> and no MIME-Version: header"},{"name":"DSN_NO_MIMEVERSION","description":"Return-Path <> and no MIME-Version: header"},{"name":"FREEMAIL_FORGED_FROMDOMAIN","description":"2nd level domains in From and EnvelopeFrom freemail headers are different"},{"name":"HEADER_FROM_DIFFERENT_DOMAINS","description":"From and EnvelopeFrom 2nd level mail domains are different"},{"name":"MILLION_EUR","description":"Talks about millions of euros"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF_01","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1","description":"Outbound Index stability value of 1"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF_01","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1","description":"Outbound Index stability value of 1"},{"name":"SIQ_EX_STAB_20","description":"Example Service stability value of 20 to 29"},{"name":"FROMSPACE","description":"Idiosyncratic \"From\" header format"},{"name":"RCVD_IN_NIX_SPAM","description":"Received via a relay in NiX Spam (heise.de)"},{"name":"DNSBL_INDIRECT","description":"Received indirectly through a relay in a DNSBL"},{"name":"DNSBL_INDIRECT_UNSAFE","description":"Received ~indirectly through a relay in a DNSBL"},{"name":"DNSBL_INDIRECT_UNSAFE_2","description":"Received ~indirectly through a relay in 2+ DNSBLs"},{"name":"FROM_ADDR_BCDE","description":"Alternating random address, BCDE"},{"name":"RW_BOGUS_RCVD_AMAVIS","description":"Contains bogus amavisd-new rcvd header"},{"name":"T_BUG5920_X_IP","description":"Message has X-IP header"},{"name":"CACHEREDIR","description":"URI pointing at Google cache"},{"name":"GB_WP_FILELINK","description":"try to abuse file_links uris in Wordpress emails"},{"name":"T_UPPERCASE_HTTP","description":"URI with an uppercase character in the ScHeMe"},{"name":"LT_ANY_CHARS","description":"Header contains characters"},{"name":"T_URIBL_RHS_AHBL","description":"Contains an URI listed in rhsbl.ahbl.org."},{"name":"RCVD_IN_PSBL","description":"Received via a relay in PSBL"},{"name":"RCVD_IN_TIOPAN_BL","description":"Received from an IP listed in Tiopan Blacklist"},{"name":"URIBL_RHS_DOB","description":"Contains an URI of a new domain (Day Old Bread)"},{"name":"T_EMPTY_FROM_OR_TO_OR_CC","description":"Contains a header field that is blank and shouldn't be."},{"name":"BITCOIN_SPF_ONLYALL","description":"Bitcoin from a domain specifically set to pass +all SPF"},{"name":"RCVD_IN_BRBL","description":"Received via a relay in Barracuda BRBL"},{"name":"RP_MATCHES_RCVD","description":"Envelope sender domain matches handover relay domain"},{"name":"RCVD_IN_UBL","description":"Relay listed in UBL http://www.lashback.com/support/UnsubscribeBlacklistSupport.aspx"},{"name":"URI_PHISHING","description":"Url match phishing in feed"},{"name":"AUTOLEARNTEST_FROM_HEADER","description":"Test rule for Autolearning "},{"name":"CTE_8BIT_MISMATCH","description":"Header says 7bits but body disagrees"},{"name":"FROM_SPACE_COMMA","description":"Distinctive syntax error in from address"},{"name":"MIXED_ES","description":"Too many es are not es"},{"name":"HASHBL_EMAIL","description":"Message contains email address found on EBL"},{"name":"HASHBL_OSENDR","description":"Message contains email address found on HASHBL"},{"name":"HASHBL_BTC","description":"Message contains BTC address found on BTCBL"},{"name":"HASHBL_URI","description":"Message contains uri found on rbl"},{"name":"HASHBL_EMAIL","description":"Message contains email address found on EBL"},{"name":"OLEMACRO","description":"Attachment has an Office Macro"},{"name":"OLEMACRO_MALICE","description":"Potentially malicious Office Macro"},{"name":"OLEMACRO_ENCRYPTED","description":"Has an Office doc that is encrypted"},{"name":"OLEMACRO_RENAME","description":"Has an Office doc that has been renamed"},{"name":"OLEMACRO_ZIP_PW","description":"Has an Office doc that is password protected in a zip"},{"name":"OLEMACRO_CSV","description":"Malicious csv file that tries to exec cmd.exe detected"},{"name":"OLEMACRO_DOWNLOAD_EXE","description":"Malicious code inside the Office doc that tries to download a .exe file detected"},{"name":"VULN_PHPMAILER","description":"Mail sent from a vulnerable version of PHPMailer"},{"name":"PP_MIME_FAKE_ASCII_TEXT","description":"MIME text/plain claims to be ASCII but isn't"},{"name":"MSGID_MULTIPLE_AT","description":"Message-ID contains multiple '@' characters"},{"name":"KAM_HTML_FONT_INVALID","description":"Test for Invalidly Named or Formatted Colors in HTML"},{"name":"BILLION_OVERLAP","description":"Reducing score for overlap of similar rules "},{"name":"AC_HTML_NONSENSE_TAGS","description":"Many consecutive multi-letter HTML tags, likely nonsense/spam"},{"name":"KAM_BLOCK_UTF7","description":"Poison pill rule to block UTF-7 encoded e-mail"},{"name":"KAM_MX","description":"Odd prevalence of mx records associated with the COMPANY3 Spammers"},{"name":"KAM_PHISH1","description":"Test for PHISH that changes the cursor"},{"name":"PYZOR_CHECK","description":"Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)"},{"name":"T_OUTDATED_PHP","description":"Mail sent from an outdated PHP version"},{"name":"URIBL_DYNAMIC_MPRHS","description":"Contains a URL listed in the MailPolice dynamic domains list"},{"name":"DKIM_SIGNED","description":"Message has a DKIM or DK signature, not necessarily valid"},{"name":"DKIM_VALID","description":"Message has at least one valid DKIM or DK signature"},{"name":"DKIM_VALID_AU","description":"Message has a valid DKIM or DK signature from author's domain"},{"name":"DKIM_VALID_EF","description":"Message has a valid DKIM or DK signature from envelope-from domain"},{"name":"__DKIM_DEPENDABLE","description":"A validation failure not attributable to truncation"},{"name":"DKIM_ADSP_NXDOMAIN","description":"Domain not in DNS and no valid author domain signature"},{"name":"DKIM_ADSP_ALL","description":"Domain signs all mail, no valid author domain signature"},{"name":"DKIM_ADSP_DISCARD","description":"Domain signs all mail and suggests discarding mail with no valid author domain signature, no valid author domain signature"},{"name":"DKIM_ADSP_CUSTOM_LOW","description":"adsp_override is CUSTOM_LOW, no valid author domain signature"},{"name":"DKIM_ADSP_CUSTOM_MED","description":"adsp_override is CUSTOM_MED, no valid author domain signature"},{"name":"DKIM_ADSP_CUSTOM_HIGH","description":"adsp_override is CUSTOM_HIGH, no valid author domain signature"},{"name":"DRUGS_ERECTILE_SHORT_SHORTNER","description":"Short erectile drugs advert with URL_SHORTENER"},{"name":"XPRIO_URL_SHORTNER","description":"X-Priority header and short URL"},{"name":"SHORT_SHORTNER","description":"Short body with little more than a link to a shortener"},{"name":"PDS_TINYSUBJ_URISHRT","description":"Short subject with URL shortener"},{"name":"PDS_EMPTYSUBJ_URISHRT","description":"Empty subject with little more than URI shortener "},{"name":"PDS_SHORTFWD_URISHRT","description":"Threaded email with URI shortener"},{"name":"PDS_FREEMAIL_REPLYTO_URISHRT","description":"Freemail replyto with URI shortener"},{"name":"TONOM_EQ_TOLOC_SHRT_SHRTNER","description":"Short email with shortener and To:name eq To:local"},{"name":"TONOM_EQ_TOLOC_SHRT_PSHRTNER","description":"Short subject with potential shortener and To:name eq To:local"},{"name":"PDS_SHORT_SPOOFED_URL","description":"HTML message short and SPOOFED_URL (S_U_FP)"},{"name":"PDS_NO_FULL_NAME_SPOOFED_URL","description":"HTML message short, SPOOFED_URL and KHOP_NO_FULL_NAME"},{"name":"KHOP_ISC","description":"Received through an IP in the ISC top 100 attackers"},{"name":"KHOP_ISC_LE","description":"Received through an IP in the ISC top 100 attackers"},{"name":"KHOP_DYNAMIC","description":"Relay looks like a dynamic address"},{"name":"KHOP_DYNAMIC2","description":"Relay looks like a dynamic address"},{"name":"VANITY","description":"Vanity or fake awards"},{"name":"ACCESSDB","description":"Message would have been caught by accessdb"},{"name":"SMF_HAS_SHORT_URI","description":"Message contains shortened URI"},{"name":"VIAGRA_OBFU","description":"Attempt to obfuscate \"viagra\""},{"name":"NICE_REPLY_A","description":"Looks like a legit reply (A)"},{"name":"TEST","description":"test rule that scores barely over spam threshold"},{"name":"URI_PHISHING","description":"Url match phishing in feed"},{"name":"FROMNAME_SPOOF_EQUALS_TO","description":"From:name is spoof to look like To: address"},{"name":"PARA_A_2_C_OF_1618","description":"Claims compliance with senate bill 1618"},{"name":"FROM_HAS_MIXED_NUMS","description":"From: contains numbers mixed in with letters"},{"name":"__KAM_COUNT_URIS","description":"A multiple match used to count URIs in a message"},{"name":"RBL_IP","description":"From address associated with spam domains"},{"name":"AWL","description":"From: address is in the auto white-list"},{"name":"URIBL_SBLXBL","description":"Contains a URL listed in the SBL/XBL blocklist"},{"name":"TXREP","description":"Score normalizing based on sender's reputation"},{"name":"URIBL_SBL","description":"Contains an URL's NS IP listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS","description":"Contains an URL's NS IP listed in the Spamhaus CSS blocklist"},{"name":"URIBL_SBL_A","description":"Contains URL's A record listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS_A","description":"Contains URL's A record listed in the Spamhaus CSS blocklist"},{"name":"URIBL_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_DBL_SPAM","description":"Contains a spam URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_PHISH","description":"Contains a Phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_MALWARE","description":"Contains a malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_BOTNETCC","description":"Contains a botned C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_SPAM","description":"Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_REDIR","description":"Contains an abused redirector URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_PHISH","description":"Contains an abused phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_MALW","description":"Contains an abused malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_BOTCC","description":"Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ERROR","description":"Error: queried the Spamhaus DBL blocklist for an IP"},{"name":"URIBL_DBL_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_DBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_SC_SURBL","description":"Contains an URL listed in the SC SURBL blocklist"},{"name":"URIBL_WS_SURBL","description":"Contains an URL listed in the WS SURBL blocklist"},{"name":"URIBL_PH_SURBL","description":"Contains an URL listed in the PH SURBL blocklist"},{"name":"URIBL_MW_SURBL","description":"Contains a URL listed in the MW SURBL blocklist"},{"name":"URIBL_CR_SURBL","description":"Contains an URL listed in the CR SURBL blocklist"},{"name":"URIBL_AB_SURBL","description":"Contains an URL listed in the AB SURBL blocklist"},{"name":"URIBL_ABUSE_SURBL","description":"Contains an URL listed in the ABUSE SURBL blocklist"},{"name":"SURBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to SURBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"URIBL_BLACK","description":"Contains an URL listed in the URIBL blacklist"},{"name":"URIBL_GREY","description":"Contains an URL listed in the URIBL greylist"},{"name":"URIBL_RED","description":"Contains an URL listed in the URIBL redlist"},{"name":"URIBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to URIBL was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"T_DKIM_INVALID","description":"DKIM-Signature header exists but is not valid"},{"name":"T_KAM_HTML_FONT_INVALID","description":"Test for Invalidly Named or Formatted"},{"name":"RCVD_IN_BRBL_LASTEXT","description":"Last external is listed in Barracuda RBL bb.barracudacentral.org"},{"name":"RCPT_MAILCOW_DOMAIN","description":"Recipient domain is registered in mailcow"},{"name":"RBL_UCEPROTECT_LEVEL1","description":"Unrecognised result from SORBS RBL"},{"name":"RBL_SORBS_HTTP","description":"List of Open HTTP Proxy Servers."},{"name":"RBL_SORBS_SOCKS","description":"List of Open SOCKS Proxy Servers."},{"name":"RBL_SORBS_MISC","description":"List of open Proxy Servers not listed in the SOCKS or HTTP lists."},{"name":"RBL_SORBS_SMTP","description":"List of Open SMTP relay servers."},{"name":"RBL_SORBS_RECENT","description":"List of hosts that have been noted as sending spam/UCE/UBE to the admins of SORBS within the last 28 days (includes new.spam.dnsbl.sorbs.net)."},{"name":"RBL_SORBS_WEB","description":"List of web (WWW) servers which have spammer abusable vulnerabilities (e.g. FormMail scripts)"},{"name":"RBL_SORBS_DUL","description":"Dynamic IP Address ranges (NOT a Dial Up list!)"},{"name":"RBL_SORBS_BLOCK","description":"List of hosts demanding that they never be tested by SORBS."},{"name":"RBL_SORBS_ZOMBIE","description":"List of networks hijacked from their original owners, some of which have already used for spamming."},{"name":"RECEIVED_SPAMHAUS_XBL","description":"Received address is listed in ZEN XBL"},{"name":"R_DKIM_NA","description":"Authenticating message via DKIM not possible"},{"name":"MID_BARE_IP","description":"Message-ID RHS is a bare IP address"},{"name":"MID_RHS_NOT_FQDN","description":"Message-ID RHS is not a fully-qualified domain name"},{"name":"MID_MISSING_BRACKETS","description":"Message-ID is missing <>'s"},{"name":"MID_RHS_IP_LITERAL","description":"Message-ID RHS is an IP-literal"},{"name":"MID_CONTAINS_FROM","description":"Message-ID contains From address"},{"name":"MID_RHS_MATCH_FROM","description":"Message-ID RHS matches From domain"},{"name":"MID_CONTAINS_TO","description":"Message-ID contains To address"},{"name":"MID_RHS_MATCH_TO","description":"Message-ID RHS matches To domain"},{"name":"REPLY","description":"Message is a reply"},{"name":"REPLY","description":"Message is a reply"},{"name":"R_SUSPICIOUS_URL","description":"Obfusicated or suspicious URL has been found in a message"},{"name":"ZERO_WIDTH_SPACE_URL","description":"Zero width space in url"},{"name":"RCVD_TLS_ALL","description":"All hops used encrypted transports"},{"name":"RCVD_TLS_LAST","description":"Last hop used encrypted transports"},{"name":"RCVD_NO_TLS_LAST","description":"Last hop did not use encrypted transports"},{"name":"RCVD_VIA_SMTP_AUTH","description":"Authenticated hand-off was seen in Received headers"},{"name":"FREEMAIL_REPLYTO_NEQ_FROM_DOM","description":"Freemail From and Reply-To, but to different Freemail services"},{"name":"EMAIL_PLUS_ALIASES","description":"Removes plus aliases from the email"},{"name":"TAGGED_RCPT","description":"SMTP recipients have plus tags"},{"name":"TAGGED_FROM","description":"SMTP from has plus tags"},{"name":"SPOOF_DISPLAY_NAME","description":"Display name is being used to spoof and trick the recipient"},{"name":"FROM_NEQ_DISPLAY_NAME","description":"Display name contains an email address different to the From address"},{"name":"BOGUS_ENCRYPTED_AND_TEXT","description":"Bogus mix of encrypted and text/html payloads"},{"name":"ENCRYPTED_PGP","description":"Message is encrypted with pgp"},{"name":"ENCRYPTED_SMIME","description":"Message is encrypted with smime"},{"name":"SIGNED_PGP","description":"Message is signed with pgp"},{"name":"SIGNED_SMIME","description":"Message is signed with smime"},{"name":"RCVD_COUNT_ZERO","description":"Message has no Received headers"},{"name":"RCVD_COUNT_ONE","description":"Message has one Received header"},{"name":"RCVD_COUNT_TWO","description":"Message has two Received headers"},{"name":"RCVD_COUNT_THREE","description":"Message has 3-5 Received headers"},{"name":"RCVD_COUNT_FIVE","description":"Message has 5-7 Received headers"},{"name":"RCVD_COUNT_SEVEN","description":"Message has 7-11 Received headers"},{"name":"RCVD_COUNT_TWELVE","description":"Message has 12 or more Received headers"},{"name":"HAS_X_PRIO","description":"X-Priority check callback rule"},{"name":"HAS_X_PRIO_ZERO","description":"Message has X-Priority header set to 0"},{"name":"HAS_X_PRIO_ONE","description":"Message has X-Priority header set to 1"},{"name":"HAS_X_PRIO_TWO","description":"Message has X-Priority header set to 2"},{"name":"HAS_X_PRIO_THREE","description":"Message has X-Priority header set to 3 or 4"},{"name":"HAS_X_PRIO_FIVE","description":"Message has X-Priority header set to 5 or higher"},{"name":"REPLYTO_UNPARSEABLE","description":"Reply-To header could not be parsed"},{"name":"HAS_REPLYTO","description":"Has Reply-To header"},{"name":"REPLYTO_EQ_FROM","description":"Reply-To header is identical to From header"},{"name":"REPLYTO_ADDR_EQ_FROM","description":"Reply-To header is identical to SMTP From"},{"name":"REPLYTO_DOM_EQ_FROM_DOM","description":"Reply-To domain matches the From domain"},{"name":"REPLYTO_DOM_NEQ_FROM_DOM","description":"Reply-To domain does not match the From domain"},{"name":"REPLYTO_DN_EQ_FROM_DN","description":"Reply-To display name matches From"},{"name":"REPLYTO_EMAIL_HAS_TITLE","description":"Reply-To header has title"},{"name":"REPLYTO_EQ_TO_ADDR","description":"Reply-To is the same as the To address"},{"name":"MISSING_MIME_VERSION","description":"MIME-Version header is missing in MIME message"},{"name":"MIME_MA_MISSING_TEXT","description":"MIME multipart/alternative missing text/plain part"},{"name":"MIME_MA_MISSING_HTML","description":"MIME multipart/alternative missing text/html part"},{"name":"ENVFROM_INVALID","description":"Envelope from does not have a valid format"},{"name":"FROM_INVALID","description":"From header does not have a valid format"},{"name":"FROM_NO_DN","description":"From header does not have a display name"},{"name":"FROM_DN_EQ_ADDR","description":"From header display name is the same as the address"},{"name":"FROM_HAS_DN","description":"From header has a display name"},{"name":"FROM_NAME_EXCESS_SPACE","description":"From header display name contains excess whitespace"},{"name":"FROM_NAME_HAS_TITLE","description":"From header display name has a title (Mr/Mrs/Dr)"},{"name":"FROM_EQ_ENVFROM","description":"From address is the same as the envelope"},{"name":"FROM_NEQ_ENVFROM","description":"From address is different to the envelope"},{"name":"TO_EQ_FROM","description":"To address matches the From address"},{"name":"TO_DOM_EQ_FROM_DOM","description":"To domain is the same as the From domain"},{"name":"RCPT_COUNT_ZERO","description":"No recipients"},{"name":"RCPT_COUNT_ONE","description":"One recipient"},{"name":"RCPT_COUNT_TWO","description":"Two recipients"},{"name":"RCPT_COUNT_THREE","description":"3-5 recipients"},{"name":"RCPT_COUNT_FIVE","description":"5-7 recipients"},{"name":"RCPT_COUNT_SEVEN","description":"7-11 recipients"},{"name":"RCPT_COUNT_TWELVE","description":"12-50 recipients"},{"name":"RCPT_COUNT_GT_50","description":"50+ recipients"},{"name":"TO_DN_RECIPIENTS","description":"To header display name is \"Recipients\""},{"name":"TO_DN_NONE","description":"None of the recipients have display names"},{"name":"TO_DN_ALL","description":"All the recipients have display names"},{"name":"TO_DN_SOME","description":"Some of the recipients have display names"},{"name":"TO_DN_EQ_ADDR_ALL","description":"All of the recipients have display names that are the same as their address"},{"name":"TO_DN_EQ_ADDR_SOME","description":"Some of the recipients have display names that are the same as their address"},{"name":"TO_MATCH_ENVRCPT_ALL","description":"All of the recipients match the envelope"},{"name":"TO_MATCH_ENVRCPT_SOME","description":"Some of the recipients match the envelope"},{"name":"BAD_WORDS","description":"Contains bad words"},{"name":"BAD_WORDS_DE","description":"Contains bad German words"},{"name":"VIRUS_FOUND","description":"YYYYY"},{"name":"SOGO_CONTACT_EXCLUDE_FWD_HOST","description":"Sender is a registered SOGo contact and the forward host is whitelisted"},{"name":"SOGO_CONTACT_SPOOFED","description":"Spoofed SOGo contact (SPF fail)"},{"name":"SOGO_CONTACT","description":"Sender is a registered SOGo contact"},{"name":"BULK_HEADER","description":"Contains bulk mail keywords in header"},{"name":"IP_SCORE","description":"IP reputation"},{"name":"R_SPF_NA","description":"Authenticating message via SPF not possible"},{"name":"FORGED_W_BAD_POLICY","description":"Forged sender and authentication via SPF/DKIM/DMARC/ARC not possible"},{"name":"FROM_NOT_REPLYTO","description":"From does not match Reply-To"},{"name":"FROM_NOT_REPLYTO_SAME_DOMAIN","description":"From domain does not match Reply-To domain"},{"name":"FROM_NOT_REPLYTO_WHITELIST","description":"From and Reply-To Whitelisted"},{"name":"T_REMOTE_IMAGE","description":"Message contains an external image"},{"name":"FORGED_SENDER_FORWARDING","description":"Forged sender, but message is forwarded"},{"name":"MAILER_1C_8_BASE64","description":"Message was sent by '1C:Enterprise 8' and uses base64 encoded data"}]
\ No newline at end of file