diff --git a/README.md b/README.md index 762bc64..ea5403f 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,8 @@ Spam Scores is an add-on for Thunderbird (Version 78.0a1 - *). It can display sp To display the spam score column, right-click on the title bar of the columns in the list view and select "Spam score". If the column is empty, you must first restart Thunderbird and then right-click on any folder and select "Properties" and "Repair Folder". This will scan the mail headers of all mails in this folder so that the spam score column can be displayed correctly. Repair all folders like this in which you want to display this column. +If you have mails with the header "X-MYCOMPANY-MailScanner-SpamCheck", you have to open one of these mails first and then restart Thunderbird and repair the folder. Otherwise the spam score of the mails containing these headers will not be displayed. + The total score of each mail with an existing spam header will be displayed along with a red, yellow or green icon depending on the score. The colours are by default calculated as follows: - ![Negative Score](https://raw.githubusercontent.com/friedPotat0/Spam-Scores/master/images/score_negative.png) Score greater than 2 diff --git a/background.js b/background.js index ac2580e..f248764 100644 --- a/background.js +++ b/background.js @@ -15,6 +15,20 @@ var init = async () => { browser.messageDisplayAction.setTitle({ tabId: tab.id, title: 'Spam Score: ' + score }) browser.messageDisplayAction.setIcon({ path: await getImageSrc(score) }) } + if (rawMessage.toLowerCase().indexOf('mailscanner-spamscore') !== -1) { + let header = rawMessage.replace(/.*(x-.*?mailscanner-spamcheck):.*/gis, '$1').toLowerCase() + let storage = await browser.storage.local.get(['customMailscannerHeaders']) + if ( + storage && + (!storage.customMailscannerHeaders || + (storage.customMailscannerHeaders && storage.customMailscannerHeaders.indexOf(header) === -1)) + ) { + await browser.SpamScores.addDynamicCustomHeaders([header]) + browser.storage.local.set({ + customMailscannerHeaders: [...(storage.customMailscannerHeaders || []), header] + }) + } + } }) if (!(await browser.SpamScores.getHelloFlag())) { @@ -27,7 +41,11 @@ var init = async () => { browser.SpamScores.setHelloFlag() } - let storage = await browser.storage.local.get(['scoreIconLowerBounds', 'scoreIconUpperBounds']) + let storage = await browser.storage.local.get([ + 'scoreIconLowerBounds', + 'scoreIconUpperBounds', + 'customMailscannerHeaders' + ]) let lowerBounds = parseFloat( storage && storage.scoreIconLowerBounds !== undefined ? storage.scoreIconLowerBounds : DEFAULT_SCORE_LOWER_BOUNDS ) @@ -35,6 +53,10 @@ var init = async () => { storage && storage.scoreIconLowerBounds !== undefined ? storage.scoreIconUpperBounds : DEFAULT_SCORE_UPPER_BOUNDS ) browser.SpamScores.setScoreBounds(parseFloat(lowerBounds), parseFloat(upperBounds)) + + if (storage && storage.customMailscannerHeaders) { + browser.SpamScores.setCustomMailscannerHeaders(storage.customMailscannerHeaders) + } } init() @@ -51,6 +73,10 @@ function getScore(raw) { if (match && match.length > 0) { return match[0].replace(/^x-spam-status: .*score=(.*?) .*$/gi, '$1') } + match = raw.match(/x-.*?mailscanner-spamcheck: .*/gi) + if (match && match.length > 0) { + return match[0].replace(/^x-.*?mailscanner-spamcheck: .*score=(.*),$/gi, '$1') + } return null } diff --git a/custom_score_column.js b/custom_score_column.js index 41096a3..8694d27 100644 --- a/custom_score_column.js +++ b/custom_score_column.js @@ -28,6 +28,15 @@ class ColumnHandler { hdr.getStringProperty('x-spamd-result').replace(/^default.*\[(.*) \/ .*\];.*$/gi, '$1') || hdr.getStringProperty('x-spam-score') || hdr.getStringProperty('x-spam-status').replace(/.*score=(.*?) .*$/gi, '$1') + if (!score && this.params.customMailscannerHeaders) { + for (let header of this.params.customMailscannerHeaders) { + let headerScore = hdr.getStringProperty(header).replace(/.*?score=(.*?),.*$/gi, '$1') + if (!isNaN(parseFloat(headerScore))) { + score = headerScore + break + } + } + } if (score) return parseFloat(score) return null } diff --git a/experiments.js b/experiments.js index 3c536d3..f74044e 100644 --- a/experiments.js +++ b/experiments.js @@ -50,6 +50,12 @@ var SpamScores = class extends ExtensionCommon.ExtensionAPI { }, setHelloFlag() { Services.prefs.setBoolPref('spamscores.hello', true) + }, + addDynamicCustomHeaders(dynamicHeaders) { + updatePrefs(dynamicHeaders) + }, + setCustomMailscannerHeaders(customMailscannerHeaders) { + scoreHdrViewParams.customMailscannerHeaders = customMailscannerHeaders } } } @@ -74,19 +80,24 @@ function unpaint(win) { delete win.SpamScores } -function updatePrefs() { +function updatePrefs(dynamicHeaders = []) { + let staticHeaders = ['x-spam-status', 'x-spamd-result', 'x-spam-score', 'x-rspamd-score'] let customDBHeaders = Services.prefs.getCharPref('mailnews.customDBHeaders') let newCustomDBHeaders = customDBHeaders - if (customDBHeaders.indexOf('x-spam-status') === -1) newCustomDBHeaders += ' x-spam-status' - if (customDBHeaders.indexOf('x-spamd-result') === -1) newCustomDBHeaders += ' x-spamd-result' - if (customDBHeaders.indexOf('x-spam-score') === -1) newCustomDBHeaders += ' x-spam-score' - if (customDBHeaders.indexOf('x-rspamd-score') === -1) newCustomDBHeaders += ' x-rspamd-score' + for (let header of staticHeaders) { + if (customDBHeaders.indexOf(header) === -1) newCustomDBHeaders += ` ${header}` + } + for (let header of dynamicHeaders) { + if (customDBHeaders.indexOf(header) === -1) newCustomDBHeaders += ` ${header}` + } Services.prefs.getBranch('mailnews').setCharPref('.customDBHeaders', newCustomDBHeaders.trim()) let customHeaders = Services.prefs.getCharPref('mailnews.customHeaders') let newCustomHeaders = customHeaders - if (customHeaders.indexOf('x-spam-status:') === -1) newCustomHeaders += ' x-spam-status:' - if (customHeaders.indexOf('x-spamd-result:') === -1) newCustomHeaders += ' x-spamd-result:' - if (customHeaders.indexOf('x-spam-score:') === -1) newCustomHeaders += ' x-spam-score:' - if (customHeaders.indexOf('x-rspamd-score:') === -1) newCustomHeaders += ' x-rspamd-score:' + for (let header of staticHeaders) { + if (customHeaders.indexOf(`${header}:`) === -1) newCustomHeaders += ` ${header}:` + } + for (let header of dynamicHeaders) { + if (customHeaders.indexOf(`${header}:`) === -1) newCustomHeaders += ` ${header}:` + } Services.prefs.getBranch('mailnews').setCharPref('.customHeaders', newCustomHeaders.trim()) } diff --git a/popup.js b/popup.js index 97c12bd..8148788 100644 --- a/popup.js +++ b/popup.js @@ -62,14 +62,17 @@ function getParsedDetailScores(raw) { info: '' })) } - let spamStatusAltRegex = /\* +(-?[\d.]+) ([A-Z0-9_]+)/gs - match = raw.match(spamStatusAltRegex) - if (match && match.length > 0) { - return match.map(el => ({ - name: el.replace(spamStatusAltRegex, '$2'), - score: parseFloat(el.replace(spamStatusAltRegex, '$1')), - info: '' - })) + if (raw.toLowerCase().indexOf('mailscanner-spamcheck') !== -1) { + raw = raw.replace(/.*?x-.*?mailscanner-spamcheck: (.*?)\).*/gis, '$1') + let spamMailscannerRegex = /,.*?([A-Z0-9_]+) (-?[\d.]+)/gs + match = raw.match(spamMailscannerRegex) + if (match && match.length > 0) { + return match.map(el => ({ + name: el.replace(spamMailscannerRegex, '$1'), + score: parseFloat(el.replace(spamMailscannerRegex, '$2')), + info: '' + })) + } } return null } diff --git a/rspamd_symbols.js b/rspamd_symbols.js index 9a11f64..07b2cdc 100644 --- a/rspamd_symbols.js +++ b/rspamd_symbols.js @@ -1 +1 @@ -const rspamdSymbols = [{"name":"BITCOIN_ADDR","description":"Message has a valid bitcoin wallet address"},{"name":"SUBJ_BOUNCE_WORDS","description":"Words/phrases typical for DNS"},{"name":"BOUNCE","description":"(Non) Delivery Status Notification"},{"name":"SPECIFIC_CONTENT_CHECK","description":"Message was forwarded by Google"},{"name":"FWD_YANDEX","description":"Message was forwarded by Yandex"},{"name":"FWD_MAILRU","description":"Message was forwarded by Mail.ru"},{"name":"FWD_SRS","description":"Message was forwarded using Sender Rewriting Scheme (SRS)"},{"name":"FORWARDED","description":"Message was forwarded"},{"name":"CHECK_RECEIVED","description":"Message has no Received headers"},{"name":"RCVD_COUNT_ZERO","description":"Message has no Received header"},{"name":"RCVD_COUNT_ONE","description":"Message has one Received header"},{"name":"RCVD_COUNT_TWO","description":"Message has two Received headers"},{"name":"RCVD_COUNT_THREE","description":"Message has 3-5 Received headers"},{"name":"RCVD_COUNT_FIVE","description":"Message has 5-7 Received headers"},{"name":"RCVD_COUNT_SEVEN","description":"Message has 7-11 Received headers"},{"name":"RCVD_COUNT_TWELVE","description":"Message has 12 or more Received headers"},{"name":"HAS_X_PRIO","description":"X-Priority check callback rule"},{"name":"HAS_X_PRIO_ZERO","description":"Message has X-Priority header set to 0"},{"name":"HAS_X_PRIO_ONE","description":"Message has X-Priority header set to 1"},{"name":"HAS_X_PRIO_TWO","description":"Message has X-Priority header set to 2"},{"name":"HAS_X_PRIO_THREE","description":"Message has X-Priority header set to 3 or 4"},{"name":"HAS_X_PRIO_FIVE","description":"Message has X-Priority header set to 5 or higher"},{"name":"CHECK_REPLYTO","description":"Reply-To header could not be parsed"},{"name":"HAS_REPLYTO","description":"Has Reply-To header"},{"name":"REPLYTO_EQ_FROM","description":"Reply-To header is identical to From header"},{"name":"REPLYTO_ADDR_EQ_FROM","description":"Reply-To header is identical to SMTP From"},{"name":"REPLYTO_DOM_EQ_FROM_DOM","description":"Reply-To domain matches the From domain"},{"name":"REPLYTO_DOM_NEQ_FROM_DOM","description":"Reply-To domain does not match the From domain"},{"name":"REPLYTO_DN_EQ_FROM_DN","description":"Reply-To display name matches From"},{"name":"REPLYTO_EMAIL_HAS_TITLE","description":"Reply-To header has title"},{"name":"REPLYTO_EQ_TO_ADDR","description":"Reply-To is the same as the To address"},{"name":"CHECK_MIME","description":"MIME-Version header is missing in MIME message"},{"name":"MIME_MA_MISSING_TEXT","description":"MIME multipart/alternative missing text/plain part"},{"name":"MIME_MA_MISSING_HTML","description":"MIME multipart/alternative missing text/html part"},{"name":"PREVIOUSLY_DELIVERED","description":"Message either to a list or was forwarded"},{"name":"BROKEN_HEADERS","description":"Headers structure is likely broken"},{"name":"BROKEN_CONTENT_TYPE","description":"Message has part with broken content type"},{"name":"HEADER_RCONFIRM_MISMATCH","description":"Read confirmation address is different to from address"},{"name":"HEADER_FORGED_MDN","description":"Read confirmation address is different to return path"},{"name":"MULTIPLE_UNIQUE_HEADERS","description":"Repeated unique headers"},{"name":"MISSING_FROM","description":"Missing From: header"},{"name":"MULTIPLE_FROM","description":"Multiple addresses in From"},{"name":"MV_CASE","description":"Mime-Version .vs. MIME-Version"},{"name":"FAKE_REPLY","description":"Fake reply"},{"name":"FREEMAIL_ENVFROM","description":"Envelope From is a Freemail address"},{"name":"FREEMAIL_ENVRCPT","description":"Envelope Recipient is a Freemail address"},{"name":"FREEMAIL_FROM","description":"From is a Freemail address"},{"name":"FREEMAIL_TO","description":"To is a Freemail address"},{"name":"FREEMAIL_CC","description":"To is a Freemail address"},{"name":"FREEMAIL_REPLYTO","description":"Reply-To is a Freemail address"},{"name":"DISPOSABLE_ENVFROM","description":"Envelope From is a Disposable e-mail address"},{"name":"DISPOSABLE_ENVRCPT","description":"Envelope Recipient is a Disposable e-mail address"},{"name":"DISPOSABLE_FROM","description":"From a Disposable e-mail address"},{"name":"DISPOSABLE_TO","description":"To a disposable e-mail address"},{"name":"FORGED_RECIPIENTS_MAILLIST","description":"Forged sender, but message is forwarded"},{"name":"SPF_FAIL_FORWARDING","description":"From and Received address are listed in Spamhaus XBL"},{"name":"AUTH_NA","description":"Authenticating message via SPF/DKIM/DMARC/ARC not possible"},{"name":"DKIM_MIXED","description":"Message was sent by "},{"name":"HACKED_WP_PHISHING","description":"Phish message sent by hacked Wordpress instance"},{"name":"COMPROMISED_ACCT_BULK","description":"Likely to be from a compromised account"},{"name":"UNDISC_RCPTS_BULK","description":"Missing or undisclosed recipients with a bulk signature"},{"name":"RCVD_UNAUTH_PBL","description":"Relayed through ZEN PBL IP without sufficient authentication (possible indicating an open relay)"},{"name":"RCVD_DKIM_ARC_DNSWL_MED","description":"Sufficiently DKIM/ARC signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_HI","description":"Sufficiently DKIM/ARC signed and received from IP with high trust at DNSWL"},{"name":"AUTOGEN_PHP_SPAMMY","description":"Message was generated by PHP script and contains some spam indicators"},{"name":"PHISH_EMOTION","description":"Phish message with subject trying to address users emotion"},{"name":"HAS_ANON_DOMAIN","description":"Contains one or more domains trying to disguise owner/destination"},{"name":"BAD_REP_POLICIES","description":"Contains valid policies but are also marked by fuzzy/bayes/surbl/rbl"},{"name":"VIOLATED_DIRECT_SPF","description":"Has no Received (or no trusted received relays) and SPF policy fails or soft fails"},{"name":"IP_SCORE_FREEMAIL","description":"Negate IP_SCORE when message comes from FreeMail"},{"name":"BROKEN_HEADERS_MAILLIST","description":"Negate BROKEN_HEADERS when message comes via some mailing list"},{"name":"LEAKED_PASSWORD_SCAM","description":"Contains BTC wallet address and scam patterns"},{"name":"DISPOSABLE_CC","description":"To a disposable e-mail address"},{"name":"DISPOSABLE_REPLYTO","description":"Reply-To a disposable e-mail address"},{"name":"CHECK_FROM","description":"Envelope from does not have a valid format"},{"name":"FROM_INVALID","description":"From header does not have a valid format"},{"name":"FROM_NO_DN","description":"From header does not have a display name"},{"name":"FROM_DN_EQ_ADDR","description":"From header display name is the same as the address"},{"name":"FROM_HAS_DN","description":"From header has a display name"},{"name":"FROM_NAME_EXCESS_SPACE","description":"From header display name contains excess whitespace"},{"name":"FROM_NAME_HAS_TITLE","description":"From header display name has a title (Mr/Mrs/Dr)"},{"name":"FROM_EQ_ENVFROM","description":"From address is the same as the envelope"},{"name":"FROM_NEQ_ENVFROM","description":"From address is different to the envelope"},{"name":"TO_EQ_FROM","description":"To address matches the From address"},{"name":"TO_DOM_EQ_FROM_DOM","description":"To domain is the same as the From domain"},{"name":"CHECK_TO_CC","description":"No recipients"},{"name":"RCPT_COUNT_ONE","description":"One recipient"},{"name":"RCPT_COUNT_TWO","description":"Two recipients"},{"name":"RCPT_COUNT_THREE","description":"3-5 recipients"},{"name":"RCPT_COUNT_FIVE","description":"5-7 recipients"},{"name":"RCPT_COUNT_SEVEN","description":"7-11 recipients"},{"name":"RCPT_COUNT_TWELVE","description":"12-50 recipients"},{"name":"RCPT_COUNT_GT_50","description":"50+ recipients"},{"name":"TO_DN_RECIPIENTS","description":"To header display name is "},{"name":"TO_DN_NONE","description":"None of the recipients have display names"},{"name":"TO_DN_ALL","description":"All the recipients have display names"},{"name":"TO_DN_SOME","description":"Some of the recipients have display names"},{"name":"TO_DN_EQ_ADDR_ALL","description":"All of the recipients have display names that are the same as their address"},{"name":"TO_DN_EQ_ADDR_SOME","description":"Some of the recipients have display names that are the same as their address"},{"name":"TO_MATCH_ENVRCPT_ALL","description":"All of the recipients match the envelope"},{"name":"TO_MATCH_ENVRCPT_SOME","description":"Some of the recipients match the envelope"},{"name":"CTYPE_MISSING_DISPOSITION","description":"Binary content-type not specified as an attachment"},{"name":"CTYPE_MIXED_BOGUS","description":"multipart/mixed without non-textual part"},{"name":"MIME_BASE64_TEXT","description":"Has text part encoded in base64"},{"name":"MIME_BASE64_TEXT_BOGUS","description":"Has text part encoded in base64 that does not contain any 8bit characters"},{"name":"INVALID_FROM_8BIT","description":"Invalid 8bit character in From header"},{"name":"INVALID_RCPT_8BIT","description":"Invalid 8bit character in recipients headers"},{"name":"XM_CASE","description":"X-mailer .vs. X-Mailer"},{"name":"MIME_HTML_ONLY","description":"Messages that have only HTML part"},{"name":"HTML_SHORT_LINK_IMG_1","description":"Short html part (0..1K) with a link to an image"},{"name":"HTML_SHORT_LINK_IMG_2","description":"Short html part (1K..1.5K) with a link to an image"},{"name":"HTML_SHORT_LINK_IMG_3","description":"Short html part (1.5K..2K) with a link to an image"},{"name":"R_EMPTY_IMAGE","description":"Message contains empty parts and image"},{"name":"R_SUSPICIOUS_IMAGES","description":"Message contains many suspicious messages"},{"name":"HTML_VISIBLE_CHECKS","description":"Message contains low contrast text"},{"name":"ZERO_FONT","description":"Zero sized font used"},{"name":"MANY_INVISIBLE_PARTS","description":"Many parts are visually hidden"},{"name":"EXT_CSS","description":"Message contains external CSS reference"},{"name":"HTTP_TO_HTTPS","description":"Anchor text contains different scheme to target URL"},{"name":"HTTP_TO_IP","description":"Anchor points to an IP address"},{"name":"CHECK_MID","description":"Text and HTML parts differ"},{"name":"MISSING_DATE","description":"Message date is missing"},{"name":"DATE_IN_FUTURE","description":"Message date is in future"},{"name":"DATE_IN_PAST","description":"Message date is in past"},{"name":"R_SUSPICIOUS_URL","description":"Obfusicated or suspicious URL has been found in a message"},{"name":"ZERO_WIDTH_SPACE_URL","description":"Zero width space in url"},{"name":"ENVFROM_PRVS","description":"Envelope From is a PRVS address that matches the From address"},{"name":"ENVFROM_VERP","description":"Envelope From is a VERP address"},{"name":"CHECK_RCVD","description":"All hops used encrypted transports"},{"name":"RCVD_TLS_LAST","description":"Last hop used encrypted transports"},{"name":"RCVD_NO_TLS_LAST","description":"Last hop did not use encrypted transports"},{"name":"RCVD_VIA_SMTP_AUTH","description":"Authenticated hand-off was seen in Received headers"},{"name":"RCVD_HELO_USER","description":"HELO User spam pattern"},{"name":"URI_COUNT_ODD","description":"Odd number of URIs in multipart/alternative message"},{"name":"HAS_ATTACHMENT","description":"Message contains attachments"},{"name":"FREEMAIL_REPLYTO_NEQ_FROM_DOM","description":"Freemail From and Reply-To, but to different Freemail services"},{"name":"OMOGRAPH_URL","description":"Url contains both latin and non-latin characters"},{"name":"URL_IN_SUBJECT","description":"URL found in Subject"},{"name":"EMAIL_PLUS_ALIASES","description":"Removes plus aliases from the email"},{"name":"TAGGED_RCPT","description":"SMTP recipients have plus tags"},{"name":"TAGGED_FROM","description":"SMTP from has plus tags"},{"name":"FROM_DISPLAY_CALLBACK","description":"Display name is being used to spoof and trick the recipient"},{"name":"FROM_NEQ_DISPLAY_NAME","description":"Display name contains an email address different to the From address"},{"name":"SPOOF_REPLYTO","description":"Reply-To is being used to spoof and trick the recipient to send an off-domain reply"},{"name":"INFO_TO_INFO_LU","description":"info@ From/To address with List-Unsubscribe headers"},{"name":"R_BAD_CTE_7BIT","description":"Detects bad content-transfer-encoding for text parts"},{"name":"BOGUS_ENCRYPTED_AND_TEXT","description":"Bogus mix of encrypted and text/html payloads"},{"name":"ENCRYPTED_PGP","description":"Message is encrypted with pgp"},{"name":"ENCRYPTED_SMIME","description":"Message is encrypted with smime"},{"name":"SIGNED_PGP","description":"Message is signed with pgp"},{"name":"SIGNED_SMIME","description":"Message is signed with smime"},{"name":"SUBJ_ALL_CAPS","description":"All capital letters in subject"},{"name":"LONG_SUBJ","description":"Subject is too long"},{"name":"HAS_PHPMAILER_SIG","description":"PHPMailer signature"},{"name":"PHP_SCRIPT_ROOT","description":"PHP Script executed by root UID"},{"name":"HAS_X_POS","description":"Has X-PHP-Originating-Script header"},{"name":"HAS_X_PHP_SCRIPT","description":"Has X-PHP-Script header"},{"name":"HAS_X_SOURCE","description":"Has X-Source headers"},{"name":"HAS_X_AS","description":"Has X-Authenticated-Sender header"},{"name":"HAS_X_GMSV","description":"Has X-Get-Message-Sender-Via: header"},{"name":"HAS_X_ANTIABUSE","description":"Has X-AntiAbuse headers"},{"name":"X_PHP_EVAL","description":"Message sent using eval"},{"name":"HAS_WP_URI","description":"Contains WordPress URIs"},{"name":"WP_COMPROMISED","description":"URL that is pointing to a compromised WordPress installation"},{"name":"PHP_XPS_PATTERN","description":"Message contains X-PHP-Script pattern"},{"name":"HAS_XAW","description":"Has X-Authentication-Warning header"},{"name":"XAW_SERVICE_ACCT","description":"Message originally from a service account"},{"name":"ENVFROM_SERVICE_ACCT","description":"Envelope from is a service account"},{"name":"HIDDEN_SOURCE_OBJ","description":"UNIX hidden file/directory in path"},{"name":"URI_HIDDEN_PATH","description":"Message contains URI with a hidden path"},{"name":"MID_RHS_WWW","description":"Message-ID from www host"},{"name":"FROM_SERVICE_ACCT","description":"Sender/From/Reply-To is a service account"},{"name":"WWW_DOT_DOMAIN","description":"From/Sender/Reply-To or Envelope is @www.domain.com"},{"name":"SUBJECT_NEEDS_ENCODING","description":"Subject needs encoding"},{"name":"FROM_NEEDS_ENCODING","description":"From header needs encoding"},{"name":"TO_NEEDS_ENCODING","description":"To header needs encoding"},{"name":"R_NO_SPACE_IN_FROM","description":"No space in from header"},{"name":"TO_WRAPPED_IN_SPACES","description":"To address is wrapped in spaces inside angle brackets (e.g. display-name < local-part@domain >)"},{"name":"MISSING_SUBJECT","description":"Subject header is missing"},{"name":"EMPTY_SUBJECT","description":"Subject header is empty"},{"name":"MISSING_TO","description":"To header is missing"},{"name":"R_UNDISC_RCPT","description":"Recipients are absent or undisclosed"},{"name":"MISSING_MID","description":"Message id is missing"},{"name":"R_RCVD_SPAMBOTS","description":"Spambots signatures in received headers"},{"name":"R_MISSING_CHARSET","description":"Charset is missing in a message"},{"name":"R_SAJDING","description":"Subject seems to be spam"},{"name":"FORGED_OUTLOOK_HTML","description":"Forged outlook HTML signature"},{"name":"SUSPICIOUS_RECIPS","description":"Recipients seems to be autogenerated (works if recipients count is more than 5)"},{"name":"SORTED_RECIPS","description":"Recipients list seems to be sorted"},{"name":"TRACKER_ID","description":"Spam string at the end of message to make statistics fault"},{"name":"FROM_EXCESS_BASE64","description":"From that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"FROM_EXCESS_QP","description":"From that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"TO_EXCESS_BASE64","description":"To that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"TO_EXCESS_QP","description":"To that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"REPLYTO_EXCESS_BASE64","description":"Reply-To that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"REPLYTO_EXCESS_QP","description":"Reply-To that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"CC_EXCESS_BASE64","description":"Cc that contains encoded characters while base 64 is not needed as all symbols are 7bit"},{"name":"CC_EXCESS_QP","description":"Cc that contains encoded characters while quoted-printable is not needed as all symbols are 7bit"},{"name":"SUBJ_EXCESS_BASE64","description":"Subject is unnecessarily encoded in base64"},{"name":"SUBJ_EXCESS_QP","description":"Subject is unnecessarily encoded in quoted-printable"},{"name":"FORGED_MUA_OUTLOOK","description":"Forged outlook MUA"},{"name":"FORGED_OUTLOOK_TAGS","description":"Message pretends to be send from Outlook but has "},{"name":"SUSPICIOUS_BOUNDARY","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY2","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY3","description":"Suspicious boundary in header Content-Type"},{"name":"SUSPICIOUS_BOUNDARY4","description":"Suspicious boundary in header Content-Type"},{"name":"FORGED_MUA_THEBAT_MSGID","description":"Message pretends to be send from The Bat! but has forged Message-ID"},{"name":"FORGED_MUA_THEBAT_MSGID_UNKNOWN","description":"Message pretends to be send from The Bat! but has forged Message-ID"},{"name":"FORGED_MUA_KMAIL_MSGID_UNKNOWN","description":"Message pretends to be send from KMail but has forged Message-ID"},{"name":"SUSPICIOUS_OPERA_10W_MSGID","description":"Message pretends to be send from suspicious Opera Mail/10.x (Windows) but has forged Message-ID, apparently from KMail"},{"name":"FORGED_MUA_OPERA_MSGID","description":"Message pretends to be send from Opera Mail but has forged Message-ID"},{"name":"FORGED_MUA_MOZILLA_MAIL_MSGID","description":"Message pretends to be send from Mozilla Mail but has forged Message-ID"},{"name":"FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","description":"Message pretends to be send from Mozilla Mail but has forged Message-ID"},{"name":"FORGED_MUA_THUNDERBIRD_MSGID","description":"Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID"},{"name":"FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","description":"Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID"},{"name":"FORGED_MUA_SEAMONKEY_MSGID","description":"Forged mail pretending to be from Mozilla Seamonkey but has forged Message-ID"},{"name":"FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","description":"Forged mail pretending to be from Mozilla Seamonkey but has forged Message-ID"},{"name":"FORGED_MUA_POSTBOX_MSGID","description":"Forged mail pretending to be from Postbox but has forged Message-ID"},{"name":"FORGED_MUA_POSTBOX_MSGID_UNKNOWN","description":"Forged mail pretending to be from Postbox but has forged Message-ID"},{"name":"INVALID_MSGID","description":"Message id is incorrect"},{"name":"MIME_HEADER_CTYPE_ONLY","description":"Only Content-Type header without other MIME headers"},{"name":"RATWARE_MS_HASH","description":"Forged Exchange messages"},{"name":"STOX_REPLY_TYPE","description":"Reply-type in content-type"},{"name":"FM_FAKE_HELO_VERIZON","description":"Fake helo for verizon provider"},{"name":"FORGED_MSGID_YAHOO","description":"Forged yahoo msgid"},{"name":"FORGED_MUA_THEBAT_BOUN","description":"Forged The Bat! MUA headers"},{"name":"MAIL_RU_MAILER","description":"Sent with Mail.Ru web-mail"},{"name":"YANDEX_RU_MAILER","description":"Sent with yandex.ru web-mail"},{"name":"MAILER_1C_8","description":"Sent with 1C:Enterprise 8"},{"name":"STRONGMAIL","description":"Sent via rogue "},{"name":"RCVD_DOUBLE_IP_SPAM","description":"Two received headers with ip addresses"},{"name":"REPTO_QUOTE_YAHOO","description":"Quoted reply-to from yahoo (seems to be forged)"},{"name":"FAKE_REPLY_C","description":"Fake reply (has RE in subject, but has no References header)"},{"name":"MISSING_MIMEOLE","description":"Mime-OLE is needed but absent (e.g. fake Outlook or fake Exchange)"},{"name":"HEADER_FROM_DELIMITER_TAB","description":"Header From begins with tab"},{"name":"HEADER_TO_DELIMITER_TAB","description":"Header To begins with tab"},{"name":"HEADER_CC_DELIMITER_TAB","description":"Header To begins with tab"},{"name":"HEADER_REPLYTO_DELIMITER_TAB","description":"Header Reply-To begins with tab"},{"name":"HEADER_DATE_DELIMITER_TAB","description":"Header Date begins with tab"},{"name":"HEADER_FROM_EMPTY_DELIMITER","description":"Header From has no delimiter between header name and header value"},{"name":"HEADER_TO_EMPTY_DELIMITER","description":"Header To has no delimiter between header name and header value"},{"name":"HEADER_CC_EMPTY_DELIMITER","description":"Header Cc has no delimiter between header name and header value"},{"name":"HEADER_REPLYTO_EMPTY_DELIMITER","description":"Header Reply-To has no delimiter between header name and header value"},{"name":"HEADER_DATE_EMPTY_DELIMITER","description":"Header Date has no delimiter between header name and header value"},{"name":"RCVD_ILLEGAL_CHARS","description":"Header Received has raw illegal character"},{"name":"FORGED_GENERIC_RECEIVED","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED2","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED3","description":"Forged generic Received"},{"name":"FORGED_GENERIC_RECEIVED4","description":"Forged generic Received"},{"name":"INVALID_POSTFIX_RECEIVED","description":"Invalid Postfix Received"},{"name":"X_PHP_FORGED_0X","description":"X-PHP-Originating-Script header appears forged"},{"name":"GOOGLE_FORWARDING_MID_MISSING","description":"Message was missing Message-ID pre-forwarding"},{"name":"GOOGLE_FORWARDING_MID_BROKEN","description":"Message had invalid Message-ID pre-forwarding"},{"name":"CTE_CASE","description":"[78]Bit .vs. [78]bit"},{"name":"HAS_INTERSPIRE_SIG","description":"Has Interspire fingerprint"},{"name":"CT_EXTRA_SEMI","description":"Content-Type ends with a semi-colon"},{"name":"SUBJECT_ENDS_EXCLAIM","description":"Subject ends with an exclaimation"},{"name":"SUBJECT_HAS_EXCLAIM","description":"Subject contains an exclaimation"},{"name":"SUBJECT_ENDS_QUESTION","description":"Subject ends with a question"},{"name":"SUBJECT_HAS_QUESTION","description":"Subject contains a question"},{"name":"SUBJECT_HAS_CURRENCY","description":"Subject contains currency"},{"name":"SUBJECT_ENDS_SPACES","description":"Subject ends with space characters"},{"name":"HAS_ORG_HEADER","description":"Has Organization header"},{"name":"X_PHPOS_FAKE","description":"Fake X-PHP-Originating-Script header"},{"name":"HAS_XOIP","description":"Has X-Originating-IP header"},{"name":"HAS_LIST_UNSUB","description":"Has List-Unsubscribe header"},{"name":"HAS_GUC_PROXY_URI","description":"Has googleusercontent.com proxy URI"},{"name":"HAS_GOOGLE_REDIR","description":"Has google.com/url redirection"},{"name":"XM_UA_NO_VERSION","description":"X-Mailer/User-Agent has no version"},{"name":"HTML_META_REFRESH_URL","description":"Has HTML Meta refresh URL"},{"name":"HAS_DATA_URI","description":"Has Data URI encoding"},{"name":"DATA_URI_OBFU","description":"Uses Data URI encoding to obfuscate plain or HTML in base64"},{"name":"INTRODUCTION","description":"Sender introduces themselves"},{"name":"HAS_ONION_URI","description":"Contains .onion hidden service URI"},{"name":"LEAKED_PASSWORD_SCAM_RE","description":"Contains BTC wallet address and malicious regexps"},{"name":"PRECEDENCE_BULK","description":"Message marked as bulk"},{"name":"MICROSOFT_SPAM","description":"Microsoft says the message is spam"},{"name":"AOL_SPAM","description":"AOL says this message is spam"},{"name":"KLMS_SPAM","description":"Kaspersky Security for Mail Server says this message is spam"},{"name":"SPAM_FLAG","description":"Message was already marked as spam"},{"name":"UNITEDINTERNET_SPAM","description":"United Internet says this message is spam"},{"name":"FUZZY_UNKNOWN","description":"Generic fuzzy hash match, bl.rspamd.com"},{"name":"FUZZY_DENIED","description":"Denied fuzzy hash, bl.rspamd.com"},{"name":"FUZZY_PROB","description":"Probable fuzzy hash, bl.rspamd.com"},{"name":"FUZZY_WHITE","description":"Whitelisted fuzzy hash, bl.rspamd.com"},{"name":"FORGED_SENDER","description":"Sender is forged (different From: header and smtp MAIL FROM: addresses)"},{"name":"R_MIXED_CHARSET","description":"Mixed characters in a message"},{"name":"R_MIXED_CHARSET_URL","description":"Mixed characters in a URL inside message"},{"name":"FORGED_RECIPIENTS","description":"Recipients are not the same as RCPT TO: mail command"},{"name":"FORGED_RECIPIENTS_MAILLIST","description":"Recipients are not the same as RCPT TO: mail command, but a message from a maillist"},{"name":"FORGED_SENDER_MAILLIST","description":"Sender is not the same as MAIL FROM: envelope, but a message is from a maillist"},{"name":"ONCE_RECEIVED","description":"One received header in a message"},{"name":"RDNS_NONE","description":"Cannot resolve reverse DNS for sender"},{"name":"RDNS_DNSFAIL","description":"PTR verification DNS error"},{"name":"ONCE_RECEIVED_STRICT","description":"One received header with "},{"name":"MAILLIST","description":"Message seems to be from maillist"},{"name":"HFILTER_HELO_BAREIP","description":"Helo host is bare ip"},{"name":"HFILTER_HELO_BADIP","description":"Helo host is very bad ip"},{"name":"HFILTER_HELO_1","description":"Helo host checks (very low)"},{"name":"HFILTER_HELO_2","description":"Helo host checks (low)"},{"name":"HFILTER_HELO_3","description":"Helo host checks (medium)"},{"name":"HFILTER_HELO_4","description":"Helo host checks (hard)"},{"name":"HFILTER_HELO_5","description":"Helo host checks (very hard)"},{"name":"HFILTER_HOSTNAME_1","description":"Hostname checks (very low)"},{"name":"HFILTER_HOSTNAME_2","description":"Hostname checks (low)"},{"name":"HFILTER_HOSTNAME_3","description":"Hostname checks (medium)"},{"name":"HFILTER_HOSTNAME_4","description":"Hostname checks (hard)"},{"name":"HFILTER_HOSTNAME_5","description":"Hostname checks (very hard)"},{"name":"HFILTER_HELO_NORESOLVE_MX","description":"MX found in Helo and no resolve"},{"name":"HFILTER_HELO_NORES_A_OR_MX","description":"Helo no resolve to A or MX"},{"name":"HFILTER_HELO_IP_A","description":"Helo A IP != hostname IP"},{"name":"HFILTER_HELO_NOT_FQDN","description":"Helo not FQDN"},{"name":"HFILTER_FROMHOST_NORESOLVE_MX","description":"MX found in FROM host and no resolve"},{"name":"HFILTER_FROMHOST_NORES_A_OR_MX","description":"FROM host no resolve to A or MX"},{"name":"HFILTER_FROMHOST_NOT_FQDN","description":"FROM host not FQDN"},{"name":"HFILTER_FROM_BOUNCE","description":"Bounce message"},{"name":"HFILTER_MID_NORESOLVE_MX","description":"MX found in Message-id host and no resolve"},{"name":"HFILTER_MID_NORES_A_OR_MX","description":"Message-id host no resolve to A or MX"},{"name":"HFILTER_MID_NOT_FQDN","description":"Message-id host not FQDN"},{"name":"HFILTER_HOSTNAME_UNKNOWN","description":"Unknown client hostname (PTR or FCrDNS verification failed)"},{"name":"HFILTER_RCPT_BOUNCEMOREONE","description":"Message from bounce and over 1 recipient"},{"name":"HFILTER_URL_ONLY","description":"URL only in body"},{"name":"HFILTER_URL_ONELINE","description":"One line URL and text in body"},{"name":"MIME_GOOD","description":"Known content-type"},{"name":"MIME_BAD","description":"Known bad content-type"},{"name":"MIME_UNKNOWN","description":"Missing or unknown content-type"},{"name":"MIME_BAD_ATTACHMENT","description":"Invalid attachment mime type"},{"name":"MIME_ENCRYPTED_ARCHIVE","description":"Encrypted archive in a message"},{"name":"MIME_ARCHIVE_IN_ARCHIVE","description":"Archive within another archive"},{"name":"MIME_DOUBLE_BAD_EXTENSION","description":"Bad extension cloaking"},{"name":"MIME_BAD_EXTENSION","description":"Bad extension"},{"name":"MIME_BAD_UNICODE","description":"Filename with known obscured unicode characters"},{"name":"FORGED_MUA_MAILLIST","description":"Avoid false positives for FORGED_MUA_* in maillist"},{"name":"PHISHING","description":"Phished URL"},{"name":"PHISHED_OPENPHISH","description":"Phished URL found in openphish.com"},{"name":"PHISHED_PHISHTANK","description":"Phished URL found in phishtank.com"},{"name":"R_SPF_FAIL","description":"SPF verification failed"},{"name":"R_SPF_SOFTFAIL","description":"SPF verification soft-failed"},{"name":"R_SPF_NEUTRAL","description":"SPF policy is neutral"},{"name":"R_SPF_ALLOW","description":"SPF verification allows sending"},{"name":"R_SPF_DNSFAIL","description":"SPF DNS failure"},{"name":"R_DKIM_REJECT","description":"DKIM verification failed"},{"name":"R_DKIM_TEMPFAIL","description":"DKIM verification soft-failed"},{"name":"R_DKIM_ALLOW","description":"DKIM verification succeed"},{"name":"DMARC_POLICY_ALLOW","description":"Message was authenticated & allowed by DMARC policy"},{"name":"DMARC_POLICY_ALLOW_WITH_FAILURES","description":"DMARC permit policy with DKIM/SPF failure"},{"name":"DMARC_POLICY_REJECT","description":"Rejection suggested by DMARC policy"},{"name":"DMARC_POLICY_QUARANTINE","description":"Quarantine suggested by DMARC policy"},{"name":"DMARC_POLICY_SOFTFAIL","description":"No action suggested by DMARC policy"},{"name":"DMARC_BAD_POLICY","description":"DMARC policy was invalid or multiple policies found in DNS"},{"name":"DMARC_NA","description":"Domain in From header has no DMARC policy or From header is missing"},{"name":"ARC_ALLOW","description":"ARC checks success"},{"name":"ARC_REJECT","description":"ARC checks failed"},{"name":"ARC_INVALID","description":"ARC structure invalid"},{"name":"ARC_DNSFAIL","description":"ARC DNS error"},{"name":"ARC_NA","description":"ARC signature absent"},{"name":"DNSWL_BLOCKED","description":"Resolver blocked due to excessive queries"},{"name":"RCVD_IN_DNSWL","description":"Unrecognised result from https://www.dnswl.org"},{"name":"RCVD_IN_DNSWL_NONE","description":"Sender listed at https://www.dnswl.org, no trust"},{"name":"RCVD_IN_DNSWL_LOW","description":"Sender listed at https://www.dnswl.org, low trust"},{"name":"RCVD_IN_DNSWL_MED","description":"Sender listed at https://www.dnswl.org, medium trust"},{"name":"RCVD_IN_DNSWL_HI","description":"Sender listed at https://www.dnswl.org, high trust"},{"name":"DWL_DNSWL_BLOCKED","description":"Resolver blocked due to excessive queries (dwl)"},{"name":"DWL_DNSWL","description":"Unrecognised result from https://www.dnswl.org (dwl)"},{"name":"DWL_DNSWL_NONE","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, no trust"},{"name":"DWL_DNSWL_LOW","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, low trust"},{"name":"DWL_DNSWL_MED","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, medium trust"},{"name":"DWL_DNSWL_HI","description":"Message has a valid dkim signature originated from domain listed at https://www.dnswl.org, high trust"},{"name":"RBL_SPAMHAUS","description":"Unrecognised result from Spamhaus ZEN"},{"name":"RBL_SPAMHAUS_SBL","description":"From address is listed in ZEN SBL"},{"name":"RBL_SPAMHAUS_CSS","description":"From address is listed in ZEN CSS"},{"name":"RBL_SPAMHAUS_XBL","description":"From address is listed in ZEN XBL"},{"name":"RBL_SPAMHAUS_XBL_ANY","description":"From or received address is listed in ZEN XBL (any list)"},{"name":"RBL_SPAMHAUS_PBL","description":"From address is listed in ZEN PBL (ISP list)"},{"name":"RBL_SPAMHAUS_DROP","description":"From address is listed in ZEN DROP BL"},{"name":"RBL_SPAMHAUS_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"RBL_SPAMHAUS_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"RECEIVED_SPAMHAUS_SBL","description":"Received address is listed in ZEN SBL"},{"name":"RECEIVED_SPAMHAUS_CSS","description":"Received address is listed in ZEN CSS"},{"name":"RECEIVED_SPAMHAUS_XBL","description":"Received address is listed in ZEN XBL"},{"name":"RECEIVED_SPAMHAUS_PBL","description":"Received address is listed in ZEN PBL (ISP list)"},{"name":"RECEIVED_SPAMHAUS_DROP","description":"Received address is listed in ZEN DROP BL"},{"name":"RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"RECEIVED_SPAMHAUS_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"RBL_SENDERSCORE","description":"From address is listed in senderscore.com BL"},{"name":"MAILSPIKE","description":"Unrecognised result from Mailspike"},{"name":"RWL_MAILSPIKE_NEUTRAL","description":"Neutral result from Mailspike"},{"name":"RBL_MAILSPIKE_WORST","description":"From address is listed in RBL - worst possible reputation"},{"name":"RBL_MAILSPIKE_VERYBAD","description":"From address is listed in RBL - very bad reputation"},{"name":"RBL_MAILSPIKE_BAD","description":"From address is listed in RBL - bad reputation"},{"name":"RWL_MAILSPIKE_POSSIBLE","description":"From address is listed in RWL - possibly legit"},{"name":"RWL_MAILSPIKE_GOOD","description":"From address is listed in RWL - good reputation"},{"name":"RWL_MAILSPIKE_VERYGOOD","description":"From address is listed in RWL - very good reputation"},{"name":"RWL_MAILSPIKE_EXCELLENT","description":"From address is listed in RWL - excellent reputation"},{"name":"RBL_SEM","description":"From address is listed in Spameatingmonkey RBL"},{"name":"RBL_SEM_IPV6","description":"From address is listed in Spameatingmonkey RBL (IPv6)"},{"name":"RBL_VIRUSFREE_BOTNET","description":"From address is listed in virusfree.cz BL"},{"name":"RBL_NIXSPAM","description":"From address is listed in NiX Spam (http://www.dnsbl.manitu.net/)"},{"name":"RBL_BLOCKLISTDE","description":"From address is listed in Blocklist (https://www.blocklist.de/)"},{"name":"RECEIVED_BLOCKLISTDE","description":"Received address is listed in Blocklist (https://www.blocklist.de/)"},{"name":"BAYES_SPAM","description":"Message probably spam"},{"name":"BAYES_HAM","description":"Message probably ham"},{"name":"SURBL_BLOCKED","description":"SURBL: blocked by policy/overusage"},{"name":"PH_SURBL_MULTI","description":"SURBL: Phishing sites"},{"name":"MW_SURBL_MULTI","description":"SURBL: Malware sites"},{"name":"ABUSE_SURBL","description":"SURBL: ABUSE"},{"name":"CRACKED_SURBL","description":"SURBL: cracked site"},{"name":"RSPAMD_URIBL","description":"Rspamd uribl, bl.rspamd.com"},{"name":"RSPAMD_EMAILBL","description":"Rspamd emailbl, bl.rspamd.com"},{"name":"MSBL_EBL","description":"MSBL emailbl"},{"name":"MSBL_EBL_GREY","description":"MSBL emailbl grey list"},{"name":"SEM_URIBL_UNKNOWN","description":"Spameatingmonkey uribl: unknown result"},{"name":"SEM_URIBL","description":"Spameatingmonkey uribl"},{"name":"SEM_URIBL_FRESH15_UNKNOWN","description":"Spameatingmonkey Fresh15 uribl: unknown result"},{"name":"SEM_URIBL_FRESH15","description":"Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)"},{"name":"DBL","description":"DBL unknown result"},{"name":"DBL_SPAM","description":"DBL uribl spam"},{"name":"DBL_PHISH","description":"DBL uribl phishing"},{"name":"DBL_MALWARE","description":"DBL uribl malware"},{"name":"DBL_BOTNET","description":"DBL uribl botnet C&C domain"},{"name":"DBL_ABUSE","description":"DBL uribl abused legit spam"},{"name":"DBL_ABUSE_REDIR","description":"DBL uribl abused spammed redirector domain"},{"name":"DBL_ABUSE_PHISH","description":"DBL uribl abused legit phish"},{"name":"DBL_ABUSE_MALWARE","description":"DBL uribl abused legit malware"},{"name":"DBL_ABUSE_BOTNET","description":"DBL uribl abused legit botnet C&C"},{"name":"DBL_PROHIBIT","description":"DBL uribl IP queries prohibited!"},{"name":"DBL_BLOCKED_OPENRESOLVER","description":"You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"},{"name":"DBL_BLOCKED","description":"You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_MULTI","description":"uribl.com: unrecognised result"},{"name":"URIBL_BLOCKED","description":"uribl.com: query refused"},{"name":"URIBL_BLACK","description":"uribl.com black url"},{"name":"URIBL_RED","description":"uribl.com red url"},{"name":"URIBL_GREY","description":"uribl.com grey url"},{"name":"SPAMHAUS_ZEN_URIBL","description":"Spamhaus ZEN URIBL: Filtered result"},{"name":"URIBL_SBL","description":"A domain in the message body resolves to an IP listed in Spamhaus SBL"},{"name":"URIBL_SBL_CSS","description":"A domain in the message body resolves to an IP listed in Spamhaus SBL CSS"},{"name":"URIBL_XBL","description":"A domain in the message body resolves to an IP listed in Spamhaus XBL"},{"name":"URIBL_PBL","description":"A domain in the message body resolves to an IP listed in Spamhaus PBL"},{"name":"URIBL_DROP","description":"A domain in the message body resolves to an IP listed in Spamhaus DROP"},{"name":"RBL_SARBL_BAD","description":"A domain in the message body is blacklisted in SARBL"},{"name":"WHITELIST_SPF","description":"Mail comes from the whitelisted domain and has a valid SPF policy"},{"name":"BLACKLIST_SPF","description":"Mail comes from the whitelisted domain and has no valid SPF policy"},{"name":"WHITELIST_DKIM","description":"Mail comes from the whitelisted domain and has a valid DKIM signature"},{"name":"BLACKLIST_DKIM","description":"Mail comes from the whitelisted domain and has non-valid DKIM signature"},{"name":"WHITELIST_SPF_DKIM","description":"Mail comes from the whitelisted domain and has valid SPF and DKIM policies"},{"name":"BLACKLIST_SPF_DKIM","description":"Mail comes from the whitelisted domain and has no valid SPF policy or a bad DKIM signature"},{"name":"WHITELIST_DMARC","description":"Mail comes from the whitelisted domain and has valid DMARC and DKIM policies"},{"name":"BLACKLIST_DMARC","description":"Mail comes from the whitelisted domain and has valid failed DMARC and DKIM policies"},{"name":"NEURAL_SPAM_LONG","description":"Neural network spam (long)"},{"name":"NEURAL_HAM_LONG","description":"Neural network ham (long)"},{"name":"NEURAL_SPAM_SHORT","description":"Neural network spam (short)"},{"name":"NEURAL_HAM_SHORT","description":"Neural network ham (short)"},{"name":"MX_MISSING","description":"Domain has no resolvable MX"},{"name":"MX_INVALID","description":"Domain has no working MX"},{"name":"MX_GOOD","description":"Domain has working MX"},{"name":"MX_WHITE","description":"Domain is whitelisted from MX check"},{"name":"ARC_SIGNED","description":"Message is signed with ARC"},{"name":"ASN","description":"Looked up Autonomous System Number (ASN), country code and subnets of sender IP address"},{"name":"DKIM_TRACE","description":"DKIM checks completed"},{"name":"MIME_TRACE","description":"MIME checks completed"},{"name":"RCVD_DKIM_DNSWL_MED","description":"Sufficiently DKIM signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_MED","description":"Sufficiently DKIM/ARC signed and received from IP with medium trust at DNSWL"},{"name":"RCVD_DKIM_DNSWL_HI","description":"Sufficiently DKIM signed and received from IP with high trust at DNSWL"},{"name":"RCVD_DKIM_ARC_DNSWL_HI","description":"Sufficiently DKIM/ARC signed and received from IP with high trust at DNSWL"},{"name":"GTUBE","description":"Generic Test for Unsolicited Bulk Email"},{"name":"TRACKER_ID","description":"Incorporates a tracking ID number"},{"name":"WEIRD_QUOTING","description":"Weird repeated double-quotation marks"},{"name":"MIME_HTML_ONLY_MULTI","description":"Multipart message only has text/html MIME parts"},{"name":"MIME_CHARSET_FARAWAY","description":"MIME character set indicates foreign language"},{"name":"EMAIL_ROT13","description":"Body contains a ROT13-encoded email address"},{"name":"LONGWORDS","description":"Long string of long words"},{"name":"MPART_ALT_DIFF","description":"HTML and text parts are different"},{"name":"MPART_ALT_DIFF_COUNT","description":"HTML and text parts are different"},{"name":"BLANK_LINES_80_90","description":"Message body has 80-90% blank lines"},{"name":"CHARSET_FARAWAY","description":"Character set indicates a foreign language"},{"name":"__MIME_BASE64","description":"Includes a base64 attachment"},{"name":"__MIME_QP","description":"Includes a quoted-printable attachment"},{"name":"MIME_BASE64_BLANKS","description":"Extra blank lines in base64 encoding"},{"name":"MIME_BASE64_TEXT","description":"Message text disguised using base64 encoding"},{"name":"MISSING_MIME_HB_SEP","description":"Missing blank line between MIME header and body"},{"name":"MIME_HTML_MOSTLY","description":"Multipart message mostly text/html MIME"},{"name":"MIME_HTML_ONLY","description":"Message only has text/html MIME parts"},{"name":"MIME_QP_LONG_LINE","description":"Quoted-printable line longer than 76 chars"},{"name":"MIME_BAD_ISO_CHARSET","description":"MIME character set is an unknown ISO charset"},{"name":"MIMEPART_LIMIT_EXCEEDED","description":"Message has too many MIME parts"},{"name":"HTTPS_IP_MISMATCH","description":"IP to HTTPS link found in HTML"},{"name":"URI_TRUNCATED","description":"Message contained a URI which was truncated"},{"name":"NO_RECEIVED","description":"Informational: message has no Received headers"},{"name":"ALL_TRUSTED","description":"Passed through trusted hosts only via SMTP"},{"name":"NO_RELAYS","description":"Informational: message was not relayed via SMTP"},{"name":"__RCVD_IN_SORBS","description":"SORBS: sender is listed in SORBS"},{"name":"RCVD_IN_SORBS_HTTP","description":"SORBS: sender is open HTTP proxy server"},{"name":"RCVD_IN_SORBS_SOCKS","description":"SORBS: sender is open SOCKS proxy server"},{"name":"RCVD_IN_SORBS_MISC","description":"SORBS: sender is open proxy server"},{"name":"RCVD_IN_SORBS_SMTP","description":"SORBS: sender is open SMTP relay"},{"name":"RCVD_IN_SORBS_SPAM","description":"SORBS: sender is a spam source"},{"name":"RCVD_IN_SORBS_WEB","description":"SORBS: sender is an abusable web server"},{"name":"RCVD_IN_SORBS_BLOCK","description":"SORBS: sender demands to never be tested"},{"name":"RCVD_IN_SORBS_ZOMBIE","description":"SORBS: sender is on a hijacked network"},{"name":"RCVD_IN_SORBS_DUL","description":"SORBS: sent directly from dynamic IP address"},{"name":"__RCVD_IN_ZEN","description":"Received via a relay in Spamhaus Zen"},{"name":"RCVD_IN_SBL","description":"Received via a relay in Spamhaus SBL"},{"name":"RCVD_IN_XBL","description":"Received via a relay in Spamhaus XBL"},{"name":"RCVD_IN_PBL","description":"Received via a relay in Spamhaus PBL"},{"name":"RCVD_IN_SBL_CSS","description":"Received via a relay in Spamhaus SBL-CSS"},{"name":"RCVD_IN_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"RCVD_IN_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"RCVD_IN_BL_SPAMCOP_NET","description":"Received via a relay in bl.spamcop.net"},{"name":"RCVD_IN_MAPS_RBL","description":"Relay in RBL, http://www.mail-abuse.com/enduserinfo_rbl.html"},{"name":"RCVD_IN_MAPS_DUL","description":"Relay in DUL, http://www.mail-abuse.com/enduserinfo_dul.html"},{"name":"RCVD_IN_MAPS_RSS","description":"Relay in RSS, http://www.mail-abuse.com/enduserinfo_rss.html"},{"name":"RCVD_IN_MAPS_OPS","description":"Relay in OPS, http://www.mail-abuse.com/enduserinfo_ops.html"},{"name":"RCVD_IN_MAPS_NML","description":"Relay in NML, http://www.mail-abuse.com/enduserinfo_nml.html"},{"name":"RCVD_IN_IADB_VOUCHED","description":"ISIPP IADB lists as vouched-for sender"},{"name":"RCVD_IN_RP_CERTIFIED","description":"Sender in ReturnPath Certified - Contact cert-sa@returnpath.net"},{"name":"RCVD_IN_RP_SAFE","description":"Sender in ReturnPath Safe - Contact safe-sa@returnpath.net"},{"name":"RCVD_IN_RP_RNBL","description":"Relay in RNBL, https://senderscore.org/blacklistlookup/"},{"name":"DKIMDOMAIN_IN_DWL","description":"Signing domain listed in Spamhaus DWL"},{"name":"__DKIMDOMAIN_IN_DWL_ANY","description":"Any TXT response received from a Spamhaus DWL"},{"name":"DKIMDOMAIN_IN_DWL_UNKNOWN","description":"Unrecognized response from Spamhaus DWL"},{"name":"SUBJECT_DRUG_GAP_C","description":"Subject contains a gappy version of 'cialis'"},{"name":"SUBJECT_DRUG_GAP_L","description":"Subject contains a gappy version of 'levitra'"},{"name":"SUBJECT_DRUG_GAP_S","description":"Subject contains a gappy version of 'soma'"},{"name":"SUBJECT_DRUG_GAP_VA","description":"Subject contains a gappy version of 'valium'"},{"name":"SUBJECT_DRUG_GAP_X","description":"Subject contains a gappy version of 'xanax'"},{"name":"DRUG_DOSAGE","description":"Talks about price per dose"},{"name":"DRUG_ED_CAPS","description":"Mentions an E.D. drug"},{"name":"DRUG_ED_SILD","description":"Talks about an E.D. drug using its chemical name"},{"name":"DRUG_ED_GENERIC","description":"Mentions Generic Viagra"},{"name":"DRUG_ED_ONLINE","description":"Fast Viagra Delivery "},{"name":"ONLINE_PHARMACY","description":"Online Pharmacy"},{"name":"NO_PRESCRIPTION","description":"No prescription needed"},{"name":"VIA_GAP_GRA","description":"Attempts to disguise the word 'viagra'"},{"name":"DRUGS_ERECTILE","description":"Refers to an erectile drug"},{"name":"DRUGS_ERECTILE_OBFU","description":"Obfuscated reference to an erectile drug"},{"name":"DRUGS_DIET","description":"Refers to a diet drug"},{"name":"DRUGS_DIET_OBFU","description":"Obfuscated reference to a diet drug\t"},{"name":"DRUGS_MUSCLE","description":"Refers to a muscle relaxant"},{"name":"DRUGS_ANXIETY","description":"Refers to an anxiety control drug"},{"name":"DRUGS_ANXIETY_OBFU","description":"Obfuscated reference to an anxiety control drug"},{"name":"DRUGS_SMEAR1","description":"Two or more drugs crammed together into one word"},{"name":"DRUGS_ANXIETY_EREC","description":"Refers to both an erectile and an anxiety drug"},{"name":"DRUGS_SLEEP_EREC","description":"Refers to both an erectile and a sleep aid drug"},{"name":"DRUGS_MANYKINDS","description":"Refers to at least four kinds of drugs"},{"name":"__RDNS_DYNAMIC_IPADDR","description":"Relay HELO'd using suspicious hostname (IP addr 1)"},{"name":"__RDNS_DYNAMIC_DHCP","description":"Relay HELO'd using suspicious hostname (DHCP)"},{"name":"__RDNS_DYNAMIC_HCC","description":"Relay HELO'd using suspicious hostname (HCC)"},{"name":"__RDNS_DYNAMIC_ATTBI","description":"Relay HELO'd using suspicious hostname (ATTBI.com)"},{"name":"__RDNS_DYNAMIC_ROGERS","description":"Relay HELO'd using suspicious hostname (Rogers)"},{"name":"__RDNS_DYNAMIC_ADELPHIA","description":"Relay HELO'd using suspicious hostname (Adelphia)"},{"name":"__RDNS_DYNAMIC_DIALIN","description":"Relay HELO'd using suspicious hostname (T-Dialin)"},{"name":"__RDNS_DYNAMIC_HEXIP","description":"Relay HELO'd using suspicious hostname (Hex IP)"},{"name":"__RDNS_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"__RDNS_DYNAMIC_YAHOOBB","description":"Relay HELO'd using suspicious hostname (YahooBB)"},{"name":"__RDNS_DYNAMIC_OOL","description":"Relay HELO'd using suspicious hostname (OptOnline)"},{"name":"__RDNS_DYNAMIC_RR2","description":"Relay HELO'd using suspicious hostname (RR 2)"},{"name":"__RDNS_DYNAMIC_COMCAST","description":"Relay HELO'd using suspicious hostname (Comcast)"},{"name":"__RDNS_DYNAMIC_TELIA","description":"Relay HELO'd using suspicious hostname (Telia)"},{"name":"__RDNS_DYNAMIC_VTR","description":"Relay HELO'd using suspicious hostname (VTR)"},{"name":"__RDNS_DYNAMIC_CHELLO_NO","description":"Relay HELO'd using suspicious hostname (Chello.no)"},{"name":"__RDNS_DYNAMIC_CHELLO_NL","description":"Relay HELO'd using suspicious hostname (Chello.nl)"},{"name":"__RDNS_DYNAMIC_VELOX","description":"Relay HELO'd using suspicious hostname (Veloxzone)"},{"name":"__RDNS_DYNAMIC_NTL","description":"Relay HELO'd using suspicious hostname (NTL)"},{"name":"RDNS_DYNAMIC","description":"Delivered to internal network by host with dynamic-looking rDNS"},{"name":"RDNS_NONE","description":"Delivered to internal network by a host with no rDNS"},{"name":"HELO_STATIC_HOST","description":"Relay HELO'd using static hostname"},{"name":"FAKE_HELO_MAIL_COM_DOM","description":"Relay HELO'd with suspicious hostname (mail.com)"},{"name":"HELO_DYNAMIC_IPADDR","description":"Relay HELO'd using suspicious hostname (IP addr 1)"},{"name":"HELO_DYNAMIC_DHCP","description":"Relay HELO'd using suspicious hostname (DHCP)"},{"name":"HELO_DYNAMIC_HCC","description":"Relay HELO'd using suspicious hostname (HCC)"},{"name":"HELO_DYNAMIC_ROGERS","description":"Relay HELO'd using suspicious hostname (Rogers)"},{"name":"HELO_DYNAMIC_DIALIN","description":"Relay HELO'd using suspicious hostname (T-Dialin)"},{"name":"HELO_DYNAMIC_HEXIP","description":"Relay HELO'd using suspicious hostname (Hex IP)"},{"name":"HELO_DYNAMIC_SPLIT_IP","description":"Relay HELO'd using suspicious hostname (Split IP)"},{"name":"HELO_DYNAMIC_IPADDR2","description":"Relay HELO'd using suspicious hostname (IP addr 2)"},{"name":"HELO_DYNAMIC_CHELLO_NL","description":"Relay HELO'd using suspicious hostname (Chello.nl)"},{"name":"HELO_DYNAMIC_HOME_NL","description":"Relay HELO'd using suspicious hostname (Home.nl)"},{"name":"FREEMAIL_REPLYTO","description":"Reply-To/From or Reply-To/body contain different freemails"},{"name":"FREEMAIL_REPLY","description":"From and body contain different freemails"},{"name":"FREEMAIL_FROM","description":"Sender email is commonly abused enduser mail provider"},{"name":"FREEMAIL_ENVFROM_END_DIGIT","description":"Envelope-from freemail username ends in digit"},{"name":"FREEMAIL_REPLYTO_END_DIGIT","description":"Reply-To freemail username ends in digit"},{"name":"FREEMAIL_SUBJECT","description":"Subject contains freemail"},{"name":"FREEMAIL_FORGED_REPLYTO","description":"Freemail in Reply-To, but not From"},{"name":"FRAGMENTED_MESSAGE","description":"Partial message"},{"name":"FROM_BLANK_NAME","description":"From: contains empty name"},{"name":"FROM_STARTS_WITH_NUMS","description":"From: starts with several numbers"},{"name":"FROM_OFFERS","description":"From address is \"at something-offers\""},{"name":"FROM_NO_USER","description":"From: has no local-part before @ sign"},{"name":"PLING_QUERY","description":"Subject has exclamation mark and question mark"},{"name":"MSGID_SPAM_CAPS","description":"Spam tool Message-Id: (caps variant)"},{"name":"MSGID_SPAM_LETTERS","description":"Spam tool Message-Id: (letters variant)"},{"name":"MSGID_RANDY","description":"Message-Id has pattern used in spam"},{"name":"MSGID_YAHOO_CAPS","description":"Message-ID has ALLCAPS@yahoo.com"},{"name":"FORGED_MSGID_AOL","description":"Message-ID is forged, (aol.com)"},{"name":"FORGED_MSGID_EXCITE","description":"Message-ID is forged, (excite.com)"},{"name":"FORGED_MSGID_HOTMAIL","description":"Message-ID is forged, (hotmail.com)"},{"name":"FORGED_MSGID_MSN","description":"Message-ID is forged, (msn.com)"},{"name":"FORGED_MSGID_YAHOO","description":"Message-ID is forged, (yahoo.com)"},{"name":"MSGID_FROM_MTA_HEADER","description":"Message-Id was added by a relay"},{"name":"MSGID_SHORT","description":"Message-ID is unusually short"},{"name":"MSGID_MULTIPLE_AT","description":"Message-ID contains multiple '@' characters"},{"name":"DATE_SPAMWARE_Y2K","description":"Date header uses unusual Y2K formatting"},{"name":"INVALID_DATE","description":"Invalid Date: header (not RFC 2822)"},{"name":"INVALID_DATE_TZ_ABSURD","description":"Invalid Date: header (timezone does not exist)"},{"name":"INVALID_TZ_CST","description":"Invalid date in header (wrong CST timezone)"},{"name":"INVALID_TZ_EST","description":"Invalid date in header (wrong EST timezone)"},{"name":"FROM_EXCESS_BASE64","description":"From: base64 encoded unnecessarily"},{"name":"ENGLISH_UCE_SUBJECT","description":"Subject contains an English UCE tag"},{"name":"JAPANESE_UCE_SUBJECT","description":"Subject contains a Japanese UCE tag"},{"name":"JAPANESE_UCE_BODY","description":"Body contains Japanese UCE tag"},{"name":"RUSSIAN_UCE_SUBJECT","description":"Subject contains a Russian UCE tag"},{"name":"KOREAN_UCE_SUBJECT","description":"Subject: contains Korean unsolicited email tag"},{"name":"RCVD_DOUBLE_IP_SPAM","description":"Bulk email fingerprint (double IP) found"},{"name":"RCVD_DOUBLE_IP_LOOSE","description":"Received: by and from look like IP addresses"},{"name":"FORGED_TELESP_RCVD","description":"Contains forged hostname for a DSL IP in Brazil"},{"name":"CONFIRMED_FORGED","description":"Received headers are forged"},{"name":"MULTI_FORGED","description":"Received headers indicate multiple forgeries"},{"name":"NONEXISTENT_CHARSET","description":"Character set doesn't exist"},{"name":"MISSING_MID","description":"Missing Message-Id: header"},{"name":"MISSING_DATE","description":"Missing Date: header"},{"name":"MISSING_SUBJECT","description":"Missing Subject: header"},{"name":"MISSING_FROM","description":"Missing From: header"},{"name":"GAPPY_SUBJECT","description":"Subject: contains G.a.p.p.y-T.e.x.t"},{"name":"PREVENT_NONDELIVERY","description":"Message has Prevent-NonDelivery-Report header"},{"name":"X_IP","description":"Message has X-IP header"},{"name":"MISSING_MIMEOLE","description":"Message has X-MSMail-Priority, but no X-MimeOLE"},{"name":"SUBJ_AS_SEEN","description":"Subject contains \"As Seen\""},{"name":"SUBJ_DOLLARS","description":"Subject starts with dollar amount"},{"name":"SUBJ_YOUR_DEBT","description":"Subject contains \"Your Bills\" or similar"},{"name":"SUBJ_YOUR_FAMILY","description":"Subject contains \"Your Family\""},{"name":"RCVD_FAKE_HELO_DOTCOM","description":"Received contains a faked HELO hostname"},{"name":"SUBJECT_DIET","description":"Subject talks about losing pounds"},{"name":"MIME_BOUND_DD_DIGITS","description":"Spam tool pattern in MIME boundary"},{"name":"MIME_BOUND_DIGITS_15","description":"Spam tool pattern in MIME boundary"},{"name":"MIME_BOUND_MANY_HEX","description":"Spam tool pattern in MIME boundary"},{"name":"TO_MALFORMED","description":"To: has a malformed address"},{"name":"MIME_HEADER_CTYPE_ONLY","description":"'Content-Type' found without required MIME headers"},{"name":"WITH_LC_SMTP","description":"Received line contains spam-sign (lowercase smtp)"},{"name":"SUBJ_BUY","description":"Subject line starts with Buy or Buying"},{"name":"RCVD_AM_PM","description":"Received headers forged (AM/PM)"},{"name":"FAKE_OUTBLAZE_RCVD","description":"Received header contains faked 'mr.outblaze.com'"},{"name":"UNCLOSED_BRACKET","description":"Headers contain an unclosed bracket"},{"name":"FROM_DOMAIN_NOVOWEL","description":"From: domain has series of non-vowel letters"},{"name":"FROM_LOCAL_NOVOWEL","description":"From: localpart has series of non-vowel letters"},{"name":"FROM_LOCAL_HEX","description":"From: localpart has long hexadecimal sequence"},{"name":"FROM_LOCAL_DIGITS","description":"From: localpart has long digit sequence"},{"name":"X_PRIORITY_CC","description":"Cc: after X-Priority: (bulk email fingerprint)"},{"name":"BAD_ENC_HEADER","description":"Message has bad MIME encoding in the header"},{"name":"__VIA_ML","description":"Mail from a mailing list"},{"name":"__ML_TURNS_SP_TO_TAB","description":"A mailing list changing a space to a TAB"},{"name":"RCVD_ILLEGAL_IP","description":"Received: contains illegal IP address"},{"name":"CHARSET_FARAWAY_HEADER","description":"A foreign language charset used in headers"},{"name":"SUBJ_ILLEGAL_CHARS","description":"Subject: has too many raw illegal characters"},{"name":"FROM_ILLEGAL_CHARS","description":"From: has too many raw illegal characters"},{"name":"HEAD_ILLEGAL_CHARS","description":"Headers have too many raw illegal characters"},{"name":"FORGED_HOTMAIL_RCVD2","description":"hotmail.com 'From' address, but no 'Received:'"},{"name":"FORGED_YAHOO_RCVD","description":"'From' yahoo.com does not match 'Received' headers"},{"name":"FORGED_GMAIL_RCVD","description":"'From' gmail.com does not match 'Received' headers"},{"name":"SORTED_RECIPS","description":"Recipient list is sorted by address"},{"name":"SUSPICIOUS_RECIPS","description":"Similar addresses in recipient list"},{"name":"MISSING_HEADERS","description":"Missing To: header"},{"name":"DATE_IN_PAST_03_06","description":"Date: is 3 to 6 hours before Received: date"},{"name":"DATE_IN_PAST_06_12","description":"Date: is 6 to 12 hours before Received: date"},{"name":"DATE_IN_PAST_12_24","description":"Date: is 12 to 24 hours before Received: date"},{"name":"DATE_IN_PAST_24_48","description":"Date: is 24 to 48 hours before Received: date"},{"name":"DATE_IN_PAST_96_XX","description":"Date: is 96 hours or more before Received: date"},{"name":"DATE_IN_FUTURE_03_06","description":"Date: is 3 to 6 hours after Received: date"},{"name":"DATE_IN_FUTURE_06_12","description":"Date: is 6 to 12 hours after Received: date"},{"name":"DATE_IN_FUTURE_12_24","description":"Date: is 12 to 24 hours after Received: date"},{"name":"DATE_IN_FUTURE_24_48","description":"Date: is 24 to 48 hours after Received: date"},{"name":"DATE_IN_FUTURE_48_96","description":"Date: is 48 to 96 hours after Received: date"},{"name":"DATE_IN_FUTURE_96_XX","description":"Date: is 96 hours or more after Received: date"},{"name":"UNRESOLVED_TEMPLATE","description":"Headers contain an unresolved template"},{"name":"SUBJ_ALL_CAPS","description":"Subject is all capitals"},{"name":"LOCALPART_IN_SUBJECT","description":"Local part of To: address appears in Subject"},{"name":"MSGID_OUTLOOK_INVALID","description":"Message-Id is fake (in Outlook Express format)"},{"name":"HEADER_COUNT_CTYPE","description":"Multiple Content-Type headers found"},{"name":"HEAD_LONG","description":"Message headers are very long"},{"name":"MISSING_HB_SEP","description":"Missing blank line between message header and body"},{"name":"UNPARSEABLE_RELAY","description":"Informational: message has unparseable relay lines"},{"name":"RCVD_HELO_IP_MISMATCH","description":"Received: HELO and IP do not match, but should"},{"name":"NO_RDNS_DOTCOM_HELO","description":"Host HELO'd as a big ISP, but had no rDNS"},{"name":"HTML_SHORT_LINK_IMG_1","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_LINK_IMG_2","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_LINK_IMG_3","description":"HTML is very short with a linked image"},{"name":"HTML_SHORT_CENTER","description":"HTML is very short with CENTER tag"},{"name":"HTML_CHARSET_FARAWAY","description":"A foreign language charset used in HTML markup"},{"name":"HTML_MIME_NO_HTML_TAG","description":"HTML-only message, but there is no HTML tag"},{"name":"HTML_MISSING_CTYPE","description":"Message is HTML without HTML Content-Type"},{"name":"HIDE_WIN_STATUS","description":"Javascript to hide URLs in browser"},{"name":"OBFUSCATING_COMMENT","description":"HTML comments which obfuscate text"},{"name":"JS_FROMCHARCODE","description":"Document is built from a Javascript charcode array"},{"name":"ENTITY_DEC_OTHER","description":"HTML contains needlessly encoded punctuation"},{"name":"HTML_MESSAGE","description":"HTML included in message"},{"name":"HTML_COMMENT_SHORT","description":"HTML comment is very short"},{"name":"HTML_COMMENT_SAVED_URL","description":"HTML message is a saved web page"},{"name":"HTML_EMBEDS","description":"HTML with embedded plugin object"},{"name":"HTML_EXTRA_CLOSE","description":"HTML contains far too many close tags"},{"name":"HTML_FONT_SIZE_LARGE","description":"HTML font size is large"},{"name":"HTML_FONT_SIZE_HUGE","description":"HTML font size is huge"},{"name":"HTML_FONT_LOW_CONTRAST","description":"HTML font color similar or identical to background"},{"name":"HTML_FONT_FACE_BAD","description":"HTML font face is not a word"},{"name":"HTML_FORMACTION_MAILTO","description":"HTML includes a form which sends mail"},{"name":"HTML_IMAGE_ONLY_04","description":"HTML: images with 0-400 bytes of words"},{"name":"HTML_IMAGE_ONLY_08","description":"HTML: images with 400-800 bytes of words"},{"name":"HTML_IMAGE_ONLY_12","description":"HTML: images with 800-1200 bytes of words"},{"name":"HTML_IMAGE_ONLY_16","description":"HTML: images with 1200-1600 bytes of words"},{"name":"HTML_IMAGE_ONLY_20","description":"HTML: images with 1600-2000 bytes of words"},{"name":"HTML_IMAGE_ONLY_24","description":"HTML: images with 2000-2400 bytes of words"},{"name":"HTML_IMAGE_ONLY_28","description":"HTML: images with 2400-2800 bytes of words"},{"name":"HTML_IMAGE_ONLY_32","description":"HTML: images with 2800-3200 bytes of words"},{"name":"HTML_IMAGE_RATIO_02","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_04","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_06","description":"HTML has a low ratio of text to image area"},{"name":"HTML_IMAGE_RATIO_08","description":"HTML has a low ratio of text to image area"},{"name":"HTML_OBFUSCATE_05_10","description":"Message is 5% to 10% HTML obfuscation"},{"name":"HTML_OBFUSCATE_10_20","description":"Message is 10% to 20% HTML obfuscation"},{"name":"HTML_OBFUSCATE_20_30","description":"Message is 20% to 30% HTML obfuscation"},{"name":"HTML_OBFUSCATE_30_40","description":"Message is 30% to 40% HTML obfuscation"},{"name":"HTML_OBFUSCATE_50_60","description":"Message is 50% to 60% HTML obfuscation"},{"name":"HTML_OBFUSCATE_70_80","description":"Message is 70% to 80% HTML obfuscation"},{"name":"HTML_OBFUSCATE_90_100","description":"Message is 90% to 100% HTML obfuscation"},{"name":"HTML_TAG_BALANCE_BODY","description":"HTML has unbalanced \"body\" tags"},{"name":"HTML_TAG_BALANCE_HEAD","description":"HTML has unbalanced \"head\" tags"},{"name":"HTML_TAG_EXIST_BGSOUND","description":"HTML has \"bgsound\" tag"},{"name":"HTML_BADTAG_40_50","description":"HTML message is 40% to 50% bad tags"},{"name":"HTML_BADTAG_50_60","description":"HTML message is 50% to 60% bad tags"},{"name":"HTML_BADTAG_60_70","description":"HTML message is 60% to 70% bad tags"},{"name":"HTML_BADTAG_90_100","description":"HTML message is 90% to 100% bad tags"},{"name":"HTML_NONELEMENT_30_40","description":"30% to 40% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_40_50","description":"40% to 50% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_60_70","description":"60% to 70% of HTML elements are non-standard"},{"name":"HTML_NONELEMENT_80_90","description":"80% to 90% of HTML elements are non-standard"},{"name":"HTML_IFRAME_SRC","description":"Message has HTML IFRAME tag with SRC URI"},{"name":"__DC_IMG_HTML_RATIO","description":"Low rawbody to pixel area ratio"},{"name":"__DC_IMG_TEXT_RATIO","description":"Low body to pixel area ratio"},{"name":"DC_GIF_UNO_LARGO","description":"Message contains a single large gif image"},{"name":"__DC_GIF_MULTI_LARGO","description":"Message has 2+ inline gif covering lots of area"},{"name":"DC_PNG_UNO_LARGO","description":"Message contains a single large png image"},{"name":"__DC_PNG_MULTI_LARGO","description":"Message has 2+ png images covering lots of area"},{"name":"DC_IMAGE_SPAM_TEXT","description":"Possible Image-only spam with little text"},{"name":"DC_IMAGE_SPAM_HTML","description":"Possible Image-only spam"},{"name":"__RCVD_IN_MSPIKE_Z","description":"Spam wave participant"},{"name":"RCVD_IN_MSPIKE_L5","description":"Very bad reputation (-5)"},{"name":"RCVD_IN_MSPIKE_L4","description":"Bad reputation (-4)"},{"name":"RCVD_IN_MSPIKE_L3","description":"Low reputation (-3)"},{"name":"RCVD_IN_MSPIKE_L2","description":"Suspicious reputation (-2)"},{"name":"RCVD_IN_MSPIKE_H5","description":"Excellent reputation (+5)"},{"name":"RCVD_IN_MSPIKE_H4","description":"Very Good reputation (+4)"},{"name":"RCVD_IN_MSPIKE_H3","description":"Good reputation (+3)"},{"name":"RCVD_IN_MSPIKE_H2","description":"Average reputation (+2)"},{"name":"RCVD_IN_MSPIKE_BL","description":"Mailspike blacklisted"},{"name":"RCVD_IN_MSPIKE_WL","description":"Mailspike good senders"},{"name":"UPPERCASE_50_75","description":"message body is 50-75% uppercase"},{"name":"UPPERCASE_75_100","description":"message body is 75-100% uppercase"},{"name":"INVALID_MSGID","description":"Message-Id is not valid, according to RFC 2822"},{"name":"FORGED_MUA_MOZILLA","description":"Forged mail pretending to be from Mozilla"},{"name":"PERCENT_RANDOM","description":"Message has a random macro in it"},{"name":"EMPTY_MESSAGE","description":"Message appears to have no textual parts and no Subject: text"},{"name":"NO_HEADERS_MESSAGE","description":"Message appears to be missing most RFC-822 headers"},{"name":"DIGEST_MULTIPLE","description":"Message hits more than one network digest check"},{"name":"NO_DNS_FOR_FROM","description":"Envelope sender has no MX or A DNS records"},{"name":"GMD_PDF_HORIZ","description":"Contains pdf 100-240 (high) x 450-800 (wide)"},{"name":"GMD_PDF_SQUARE","description":"Contains pdf 180-360 (high) x 180-360 (wide)"},{"name":"GMD_PDF_VERT","description":"Contains pdf 450-800 (high) x 100-240 (wide)"},{"name":"GMD_PDF_FUZZY1_T1","description":"Fuzzy MD5 Match 57EBC1FFB1A24CC14AE23E1E227C3484"},{"name":"GMD_PDF_FUZZY2_T1","description":"Fuzzy MD5 Match 653C8AA9FDFD03D382523488058360A2"},{"name":"GMD_AUTHOR_COLET","description":"PDF author was 'colet'"},{"name":"GMD_AUTHOR_MOBILE","description":"PDF author was 'mobile'"},{"name":"GMD_AUTHOR_OOO","description":"PDF author was 'openofficeuser'"},{"name":"GMD_AUTHOR_HPADMIN","description":"PDF author was 'HP_Administrator'"},{"name":"GMD_PRODUCER_GPL","description":"PDF producer was GPL Ghostscript"},{"name":"GMD_PRODUCER_POWERPDF","description":"PDF producer was PowerPDF"},{"name":"GMD_PRODUCER_EASYPDF","description":"PDF producer was BCL easyPDF"},{"name":"GMD_PDF_ENCRYPTED","description":"Attached PDF is encrypted"},{"name":"GMD_PDF_EMPTY_BODY","description":"Attached PDF with empty message body"},{"name":"GMD_PDF_STOX_M1","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M2","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M3","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M4","description":"PDF Stox spam"},{"name":"GMD_PDF_STOX_M5","description":"PDF Stox Spam"},{"name":"REMOVE_BEFORE_LINK","description":"Removal phrase right before a link"},{"name":"GUARANTEED_100_PERCENT","description":"One hundred percent guaranteed"},{"name":"DEAR_FRIEND","description":"Dear Friend? That's not very dear!"},{"name":"DEAR_SOMETHING","description":"Contains 'Dear (something)'"},{"name":"BILLION_DOLLARS","description":"Talks about lots of money"},{"name":"EXCUSE_4","description":"Claims you can be removed from the list"},{"name":"EXCUSE_REMOVE","description":"Talks about how to be removed from mailings"},{"name":"STRONG_BUY","description":"Tells you about a strong buy"},{"name":"STOCK_ALERT","description":"Offers a alert about a stock"},{"name":"NOT_ADVISOR","description":"Not registered investment advisor"},{"name":"PREST_NON_ACCREDITED","description":"'Prestigious Non-Accredited Universities'"},{"name":"BODY_ENHANCEMENT","description":"Information on growing body parts"},{"name":"BODY_ENHANCEMENT2","description":"Information on getting larger body parts"},{"name":"IMPOTENCE","description":"Impotence cure"},{"name":"NA_DOLLARS","description":"Talks about a million North American dollars"},{"name":"US_DOLLARS_3","description":"Mentions millions of $ ($NN,NNN,NNN.NN)"},{"name":"MILLION_USD","description":"Talks about millions of dollars"},{"name":"URG_BIZ","description":"Contains urgent matter"},{"name":"MONEY_BACK","description":"Money back guarantee"},{"name":"FREE_QUOTE_INSTANT","description":"Free express or no-obligation quote"},{"name":"BAD_CREDIT","description":"Eliminate Bad Credit"},{"name":"REFINANCE_YOUR_HOME","description":"Home refinancing"},{"name":"REFINANCE_NOW","description":"Home refinancing"},{"name":"NO_MEDICAL","description":"No Medical Exams"},{"name":"DIET_1","description":"Lose Weight Spam"},{"name":"FIN_FREE","description":"Freedom of a financial nature"},{"name":"FORWARD_LOOKING","description":"Stock Disclaimer Statement"},{"name":"ONE_TIME","description":"One Time Rip Off"},{"name":"JOIN_MILLIONS","description":"Join Millions of Americans"},{"name":"MARKETING_PARTNERS","description":"Claims you registered with a partner"},{"name":"LOW_PRICE","description":"Lowest Price"},{"name":"UNCLAIMED_MONEY","description":"People just leave money laying around"},{"name":"OBSCURED_EMAIL","description":"Message seems to contain rot13ed address"},{"name":"BANG_OPRAH","description":"Talks about Oprah with an exclamation!"},{"name":"ACT_NOW_CAPS","description":"Talks about 'acting now' with capitals"},{"name":"MORE_SEX","description":"Talks about a bigger drive for sex"},{"name":"BANG_GUAR","description":"Something is emphatically guaranteed"},{"name":"RUDE_HTML","description":"Spammer message says you need an HTML mailer"},{"name":"INVESTMENT_ADVICE","description":"Message mentions investment advice"},{"name":"MALE_ENHANCE","description":"Message talks about enhancing men"},{"name":"PRICES_ARE_AFFORDABLE","description":"Message says that prices aren't too expensive"},{"name":"REPLICA_WATCH","description":"Message talks about a replica watch"},{"name":"EM_ROLEX","description":"Message puts emphasis on the watch manufacturer"},{"name":"FREE_PORN","description":"Possible porn - Free Porn"},{"name":"CUM_SHOT","description":"Possible porn - Cum Shot"},{"name":"LIVE_PORN","description":"Possible porn - Live Porn"},{"name":"SUBJECT_SEXUAL","description":"Subject indicates sexually-explicit content"},{"name":"RATWARE_EGROUPS","description":"Bulk email fingerprint (eGroups) found"},{"name":"RATWARE_OE_MALFORMED","description":"X-Mailer has malformed Outlook Express version"},{"name":"RATWARE_MOZ_MALFORMED","description":"Bulk email fingerprint (Mozilla malformed) found"},{"name":"RATWARE_MPOP_WEBMAIL","description":"Bulk email fingerprint (mPOP Web-Mail)"},{"name":"FORGED_MUA_IMS","description":"Forged mail pretending to be from IMS"},{"name":"FORGED_MUA_OUTLOOK","description":"Forged mail pretending to be from MS Outlook"},{"name":"FORGED_MUA_OIMO","description":"Forged mail pretending to be from MS Outlook IMO"},{"name":"MAILING_LIST_MULTI","description":"Multiple indicators imply a widely-seen list manager"},{"name":"FORGED_MUA_EUDORA","description":"Forged mail pretending to be from Eudora"},{"name":"FORGED_MUA_THEBAT_CS","description":"Mail pretending to be from The Bat! (charset)"},{"name":"FORGED_MUA_THEBAT_BOUN","description":"Mail pretending to be from The Bat! (boundary)"},{"name":"FORGED_OUTLOOK_HTML","description":"Outlook can't send HTML message only"},{"name":"FORGED_IMS_HTML","description":"IMS can't send HTML message only"},{"name":"FORGED_THEBAT_HTML","description":"The Bat! can't send HTML message only"},{"name":"REPTO_QUOTE_AOL","description":"AOL doesn't do quoting like this"},{"name":"REPTO_QUOTE_IMS","description":"IMS doesn't do quoting like this"},{"name":"REPTO_QUOTE_MSN","description":"MSN doesn't do quoting like this"},{"name":"REPTO_QUOTE_QUALCOMM","description":"Qualcomm/Eudora doesn't do quoting like this"},{"name":"REPTO_QUOTE_YAHOO","description":"Yahoo! doesn't do quoting like this"},{"name":"FORGED_QUALCOMM_TAGS","description":"QUALCOMM mailers can't send HTML in this format"},{"name":"FORGED_IMS_TAGS","description":"IMS mailers can't send HTML in this format"},{"name":"FORGED_OUTLOOK_TAGS","description":"Outlook can't send HTML in this format"},{"name":"RATWARE_HASH_DASH","description":"Contains a hashbuster in Send-Safe format"},{"name":"RATWARE_ZERO_TZ","description":"Bulk email fingerprint (+0000) found"},{"name":"X_MESSAGE_INFO","description":"Bulk email fingerprint (X-Message-Info) found"},{"name":"HEADER_SPAM","description":"Bulk email fingerprint (header-based) found"},{"name":"RATWARE_RCVD_PF","description":"Bulk email fingerprint (Received PF) found"},{"name":"RATWARE_RCVD_AT","description":"Bulk email fingerprint (Received @) found"},{"name":"RATWARE_OUTLOOK_NONAME","description":"Bulk email fingerprint (Outlook no name) found"},{"name":"RATWARE_MS_HASH","description":"Bulk email fingerprint (msgid ms hash) found"},{"name":"RATWARE_NAME_ID","description":"Bulk email fingerprint (msgid from) found"},{"name":"RATWARE_EFROM","description":"Bulk email fingerprint (envfrom) found"},{"name":"NUMERIC_HTTP_ADDR","description":"Uses a numeric IP address in URL"},{"name":"HTTP_ESCAPED_HOST","description":"Uses %-escapes inside a URL's hostname"},{"name":"HTTP_EXCESSIVE_ESCAPES","description":"Completely unnecessary %-escapes inside a URL"},{"name":"IP_LINK_PLUS","description":"Dotted-decimal IP address followed by CGI"},{"name":"WEIRD_PORT","description":"Uses non-standard port number for HTTP"},{"name":"HTTP_ENTITIES_HOST","description":"URI obscured with character entities"},{"name":"YAHOO_RD_REDIR","description":"Has Yahoo Redirect URI"},{"name":"YAHOO_DRS_REDIR","description":"Has Yahoo Redirect URI"},{"name":"HTTP_77","description":"Contains an URL-encoded hostname (HTTP77)"},{"name":"SPOOF_COM2OTH","description":"URI contains \".com\" in middle"},{"name":"SPOOF_COM2COM","description":"URI contains \".com\" in middle and end"},{"name":"SPOOF_NET2COM","description":"URI contains \".net\" or \".org\", then \".com\""},{"name":"URI_HEX","description":"URI hostname has long hexadecimal sequence"},{"name":"URI_NOVOWEL","description":"URI hostname has long non-vowel sequence"},{"name":"URI_UNSUBSCRIBE","description":"URI contains suspicious unsubscribe link"},{"name":"URI_NO_WWW_INFO_CGI","description":"CGI in .info TLD other than third-level \"www\""},{"name":"URI_NO_WWW_BIZ_CGI","description":"CGI in .biz TLD other than third-level \"www\""},{"name":"NORMAL_HTTP_TO_IP","description":"URI host has a public dotted-decimal IPv4 address"},{"name":"BOUNCE_MESSAGE","description":"MTA bounce message"},{"name":"OOOBOUNCE_MESSAGE","description":"Out Of Office bounce message"},{"name":"CHALLENGE_RESPONSE","description":"Challenge-Response message for mail you sent"},{"name":"CRBOUNCE_MESSAGE","description":"Challenge-Response bounce message"},{"name":"VBOUNCE_MESSAGE","description":"Virus-scanner bounce message"},{"name":"ANY_BOUNCE_MESSAGE","description":"Message is some kind of bounce message"},{"name":"BAYES_00","description":"Bayes spam probability is 0 to 1%"},{"name":"BAYES_05","description":"Bayes spam probability is 1 to 5%"},{"name":"BAYES_20","description":"Bayes spam probability is 5 to 20%"},{"name":"BAYES_40","description":"Bayes spam probability is 20 to 40%"},{"name":"BAYES_50","description":"Bayes spam probability is 40 to 60%"},{"name":"BAYES_60","description":"Bayes spam probability is 60 to 80%"},{"name":"BAYES_80","description":"Bayes spam probability is 80 to 95%"},{"name":"BAYES_95","description":"Bayes spam probability is 95 to 99%"},{"name":"BAYES_99","description":"Bayes spam probability is 99 to 100%"},{"name":"BAYES_999","description":"Bayes spam probability is 99.9 to 100%"},{"name":"ACCESSDB","description":"Message would have been caught by accessdb"},{"name":"MICROSOFT_EXECUTABLE","description":"Message includes Microsoft executable program"},{"name":"MIME_SUSPECT_NAME","description":"MIME filename does not match content"},{"name":"DCC_CHECK","description":"Detected as bulk mail by DCC (dcc-servers.net)"},{"name":"DCC_REPUT_00_12","description":"DCC reputation between 0 and 12 % (mostly ham)"},{"name":"DCC_REPUT_13_19","description":"DCC reputation between 13 and 19 %"},{"name":"DCC_REPUT_70_89","description":"DCC reputation between 70 and 89 %"},{"name":"DCC_REPUT_90_94","description":"DCC reputation between 90 and 94 %"},{"name":"DCC_REPUT_95_98","description":"DCC reputation between 95 and 98 % (mostly spam)"},{"name":"DCC_REPUT_99_100","description":"DCC reputation between 99 % or higher (spam)"},{"name":"DKIM_SIGNED","description":"Message has a DKIM or DK signature, not necessarily valid"},{"name":"DKIM_VALID","description":"Message has at least one valid DKIM or DK signature"},{"name":"DKIM_INVALID","description":"DKIM or DK signature exists, but is not valid"},{"name":"DKIM_VALID_AU","description":"Message has a valid DKIM or DK signature from author's domain"},{"name":"DKIM_VALID_EF","description":"Message has a valid DKIM or DK signature from envelope-from domain"},{"name":"__DKIM_DEPENDABLE","description":"A validation failure not attributable to truncation"},{"name":"DKIM_ADSP_NXDOMAIN","description":"No valid author signature and domain not in DNS"},{"name":"DKIM_ADSP_DISCARD","description":"No valid author signature, domain signs all mail and suggests discarding the rest"},{"name":"DKIM_ADSP_ALL","description":"No valid author signature, domain signs all mail"},{"name":"DKIM_ADSP_CUSTOM_LOW","description":"No valid author signature, adsp_override is CUSTOM_LOW"},{"name":"DKIM_ADSP_CUSTOM_MED","description":"No valid author signature, adsp_override is CUSTOM_MED"},{"name":"DKIM_ADSP_CUSTOM_HIGH","description":"No valid author signature, adsp_override is CUSTOM_HIGH"},{"name":"__VIA_RESIGNER","description":"Mail through a popular signing remailer"},{"name":"NML_ADSP_CUSTOM_LOW","description":"ADSP custom_low hit, and not from a mailing list"},{"name":"NML_ADSP_CUSTOM_MED","description":"ADSP custom_med hit, and not from a mailing list"},{"name":"NML_ADSP_CUSTOM_HIGH","description":"ADSP custom_high hit, and not from a mailing list"},{"name":"RCVD_IN_DNSWL_NONE","description":"Sender listed at https://www.dnswl.org/, no trust"},{"name":"RCVD_IN_DNSWL_LOW","description":"Sender listed at https://www.dnswl.org/, low trust"},{"name":"RCVD_IN_DNSWL_MED","description":"Sender listed at https://www.dnswl.org/, medium trust"},{"name":"RCVD_IN_DNSWL_HI","description":"Sender listed at https://www.dnswl.org/, high trust"},{"name":"RCVD_IN_DNSWL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"PYZOR_CHECK","description":"Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/)"},{"name":"RAZOR2_CHECK","description":"Listed in Razor2 (http://razor.sf.net/)"},{"name":"RAZOR2_CF_RANGE_51_100","description":"Razor2 gives confidence level above 50%"},{"name":"SUBJECT_FUZZY_MEDS","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_VPILL","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_CHEAP","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_PENIS","description":"Attempt to obfuscate words in Subject:"},{"name":"SUBJECT_FUZZY_TION","description":"Attempt to obfuscate words in Subject:"},{"name":"FUZZY_AFFORDABLE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_AMBIEN","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_BILLION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_CPILL","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_CREDIT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_ERECT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_GUARANTEE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MEDICATION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MILLION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MONEY","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_MORTGAGE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_OBLIGATION","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_OFFERS","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PHARMACY","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PHENT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PRESCRIPT","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_PRICES","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_REFINANCE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_REMOVE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_ROLEX","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_SOFTWARE","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_THOUSANDS","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VLIUM","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VIOXX","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_VPILL","description":"Attempt to obfuscate words in spam"},{"name":"FUZZY_XPILL","description":"Attempt to obfuscate words in spam"},{"name":"SPF_PASS","description":"SPF: sender matches SPF record"},{"name":"SPF_NEUTRAL","description":"SPF: sender does not match SPF record (neutral)"},{"name":"SPF_FAIL","description":"SPF: sender does not match SPF record (fail)"},{"name":"SPF_SOFTFAIL","description":"SPF: sender does not match SPF record (softfail)"},{"name":"SPF_HELO_PASS","description":"SPF: HELO matches SPF record"},{"name":"SPF_HELO_NEUTRAL","description":"SPF: HELO does not match SPF record (neutral)"},{"name":"SPF_HELO_FAIL","description":"SPF: HELO does not match SPF record (fail)"},{"name":"SPF_HELO_SOFTFAIL","description":"SPF: HELO does not match SPF record (softfail)"},{"name":"SPF_NONE","description":"SPF: sender does not publish an SPF Record"},{"name":"SPF_HELO_NONE","description":"SPF: HELO does not publish an SPF Record"},{"name":"T_SPF_PERMERROR","description":"SPF: test of record failed (permerror)"},{"name":"T_SPF_TEMPERROR","description":"SPF: test of record failed (temperror)"},{"name":"T_SPF_HELO_PERMERROR","description":"SPF: test of HELO record failed (permerror)"},{"name":"T_SPF_HELO_TEMPERROR","description":"SPF: test of HELO record failed (temperror)"},{"name":"UNWANTED_LANGUAGE_BODY","description":"Message written in an undesired language"},{"name":"BODY_8BITS","description":"Body includes 8 consecutive 8-bit characters"},{"name":"URIBL_SBL","description":"Contains an URL's NS IP listed in the Spamhaus SBL blocklist"},{"name":"URIBL_CSS","description":"Contains an URL's NS IP listed in the Spamhaus CSS blocklist"},{"name":"URIBL_ZEN_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_ZEN_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_DBL_SPAM","description":"Contains a spam URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_PHISH","description":"Contains a Phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_MALWARE","description":"Contains a malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_BOTNETCC","description":"Contains a botned C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_SPAM","description":"Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_REDIR","description":"Contains an abused redirector URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_PHISH","description":"Contains an abused phishing URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_MALW","description":"Contains an abused malware URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ABUSE_BOTCC","description":"Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist"},{"name":"URIBL_DBL_ERROR","description":"Error: queried the Spamhaus DBL blocklist for an IP"},{"name":"URIBL_DBL_BLOCKED_OPENDNS","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/"},{"name":"URIBL_DBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/"},{"name":"URIBL_SC_SURBL","description":"Contains an URL listed in the SC SURBL blocklist"},{"name":"URIBL_WS_SURBL","description":"Contains an URL listed in the WS SURBL blocklist"},{"name":"URIBL_PH_SURBL","description":"Contains an URL listed in the PH SURBL blocklist"},{"name":"URIBL_MW_SURBL","description":"Contains a URL listed in the MW SURBL blocklist"},{"name":"URIBL_CR_SURBL","description":"Contains an URL listed in the CR SURBL blocklist"},{"name":"URIBL_AB_SURBL","description":"Contains an URL listed in the AB SURBL blocklist"},{"name":"URIBL_ABUSE_SURBL","description":"Contains an URL listed in the ABUSE SURBL blocklist"},{"name":"SURBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to SURBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"URIBL_BLACK","description":"Contains an URL listed in the URIBL blacklist"},{"name":"URIBL_GREY","description":"Contains an URL listed in the URIBL greylist"},{"name":"URIBL_RED","description":"Contains an URL listed in the URIBL redlist"},{"name":"URIBL_BLOCKED","description":"ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\\#dnsbl-block for more information."},{"name":"LONGLINE","description":"Line length exceeds 998 character limit, RFC 5322"},{"name":"RP_8BIT","description":"Return-Path contains 8-bit characters with high bit on"},{"name":"RP_LASTNAME","description":"Return-Path says LAST_NAME literally"},{"name":"RP_UNDERLINE","description":"Return-Path address starts with an underline"},{"name":"RP_MINUS","description":"Return-Path address starts with a minus"},{"name":"CR_IN_SUBJ","description":"Subject contains a CR character"},{"name":"FROM_UNBAL1","description":"From with unbalanced angle brackets, '>' missing"},{"name":"FROM_UNBAL2","description":"From with unbalanced angle brackets, '<' missing"},{"name":"FROM_WSP_TRAIL","description":"Trailing whitespace before '>' in From header field"},{"name":"FROM_WSP_LEAD","description":"Leading whitespace after '<' in From header field"},{"name":"MSGID_WSP_TRAIL","description":"Trailing whitespace before '>' in Message-ID header"},{"name":"MSGID_NOFQDN1","description":"Message-ID with no domain name"},{"name":"MSGID_NOFQDN2","description":"Message-ID without a fully-qualified domain name"},{"name":"SIQ_OI_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_UNKNOWN","description":"Query returned reputation unknown"},{"name":"SIQ_OI_00","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_01","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_05","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_10","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_15","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_20","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_25","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_30","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_35","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_40","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_45","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_50","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_55","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_60","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_65","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_70","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_75","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_80","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_85","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_90","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_95","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_99","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_100","description":"Outbound Index Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_IP_UNKNOWN","description":"Query returned IP reputation unknown"},{"name":"SIQ_OI_IP_00","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_01","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_05","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_10","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_15","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_20","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_25","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_30","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_35","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_40","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_45","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_50","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_55","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_60","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_65","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_70","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_75","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_80","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_85","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_90","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_95","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_99","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_IP_100","description":"Outbound Index IP Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_DOM_UNKNOWN","description":"Query returned domain reputation unknown"},{"name":"SIQ_OI_DOM_00","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_01","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_05","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_10","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_15","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_20","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_25","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_30","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_35","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_40","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_45","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_50","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_55","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_60","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_65","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_70","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_75","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_80","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_85","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_90","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_95","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_99","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_DOM_100","description":"Outbound Index Domain Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_ERROR","description":"Query returned an error value"},{"name":"SIQ_OI_REL_UNKNOWN","description":"Query returned relative reputation unknown"},{"name":"SIQ_OI_REL_00","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_01","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_05","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_10","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_15","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_20","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_25","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_30","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_35","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_40","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_45","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_50","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_55","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_60","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_65","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_70","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_75","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_80","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_85","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_90","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_95","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_99","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_REL_100","description":"Outbound Index Relative Reputation: http://outboundindex.org/"},{"name":"SIQ_OI_CONF","description":"Outbound Index Confidence: http://outboundindex.org/"},{"name":"SIQ_OI_STAB_1_9","description":"Outbound Index Stability from 1 to 9"},{"name":"SIQ_OI_STAB_10","description":"Outbound Index Stability from 10 to 19"},{"name":"SIQ_OI_STAB_20","description":"Outbound Index Stability from 20 to 29"},{"name":"SIQ_OI_STAB_30","description":"Outbound Index Stability from 30 to 39"},{"name":"SIQ_OI_STAB_40","description":"Outbound Index Stability from 40 to 49"},{"name":"SIQ_OI_STAB_50","description":"Outbound Index Stability from 50 to 59"},{"name":"SIQ_OI_STAB_60","description":"Outbound Index Stability from 60 to 69"},{"name":"SIQ_OI_STAB_70","description":"Outbound Index Stability from 70 to 79"},{"name":"SIQ_OI_STAB_80","description":"Outbound Index Stability from 80 to 89"},{"name":"SIQ_OI_STAB_90","description":"Outbound Index Stability from 90 to 99"},{"name":"SIQ_OI_STAB_100S","description":"Outbound Index Stability from 100 to 999"},{"name":"SIQ_OI_STAB_1000","description":"Outbound Index Stability from 1000 to 1999"},{"name":"SIQ_OI_STAB_2000","description":"Outbound Index Stability from 2000 to 2999"},{"name":"SIQ_OI_STAB_3000","description":"Outbound Index Stability from 3000 to 3999"},{"name":"SIQ_OI_STAB_4000","description":"Outbound Index Stability from 4000 to 4999"},{"name":"SIQ_OI_STAB_5000","description":"Outbound Index Stability of 5000 or more"},{"name":"SIQ_OI_00_100S","description":"OI Rep Score=0 Stability=100-999"},{"name":"SIQ_OI_00_1000","description":"OI Rep Score=0 Stability=1000-1999"},{"name":"SIQ_OI_00_2000","description":"OI Rep Score=0 Stability=2000+"},{"name":"SIQ_OI_01_100S","description":"OI Rep Score=1 Stability=100-999"},{"name":"SIQ_OI_01_1000","description":"OI Rep Score=1 Stability=1000-1999"},{"name":"SIQ_OI_01_2000","description":"OI Rep Score=1 Stability=2000+"},{"name":"SIQ_OI_05_100S","description":"OI Rep Score=2-5 Stability=100-999"},{"name":"SIQ_OI_05_1000","description":"OI Rep Score=2-5 Stability=1000-1999"},{"name":"SIQ_OI_05_2000","description":"OI Rep Score=2-5 Stability=2000+"},{"name":"SERGIO_SUBJECT_VIAGRA01","description":"Viagra garbled subject"},{"name":"SERGIO_SUBJECT_PORN002","description":"Pictures garbled subject"},{"name":"SERGIO_SUBJECT_PORN003","description":"Videos garbled subject"},{"name":"SERGIO_SUBJECT_PORN004","description":"Adult garbled subject"},{"name":"SERGIO_SUBJECT_PORN005","description":"Porn garbled subject"},{"name":"SERGIO_SUBJECT_PORN006","description":"B\\*\\*\\* J\\*\\* garbled subject"},{"name":"SERGIO_SUBJECT_PORN007","description":"Film garbled subject"},{"name":"SERGIO_SUBJECT_PORN008","description":"Mature garbled subject"},{"name":"SERGIO_SUBJECT_PORN009","description":"Undress garbled subject"},{"name":"SERGIO_SUBJECT_PORN010","description":"Movies garbled subject"},{"name":"SERGIO_SUBJECT_PORN011","description":"Sex garbled subject"},{"name":"SERGIO_SUBJECT_PORN012","description":"School garbled subject"},{"name":"SERGIO_SUBJECT_PORN013","description":"Girls garbled subject"},{"name":"SERGIO_SUBJECT_PORN014","description":"F\\*\\*\\* garbled subject"},{"name":"SERGIO_SUBJECT_PORN015","description":"Lesbian garbled subject"},{"name":"FSL_NEW_HELO_USER","description":"Spam's using Helo and User"},{"name":"FSL_XM_419","description":"Old OE version in X-Mailer only seen in 419 spam"},{"name":"FSL_CTYPE_WIN1251","description":"Content-Type only seen in 419 spam"},{"name":"FSL_MID_419","description":"Spam signature in Message-ID"},{"name":"FSL_MISSP_REPLYTO","description":"Mis-spaced from and Reply-to"},{"name":"FSL_YHG_ABUSE","description":"URI pointing to a message in an abused Yahoo Group"},{"name":"FSL_BOTSPAM_1","description":"Two-line spam with URI pointing to .ru domain"},{"name":"FSL_THIS_IS_ADV","description":"This is an advertisement"},{"name":"RCVD_IN_SEMBACKSCATTER","description":"Received from an IP listed by SEM-BACKSCATTER"},{"name":"RCVD_IN_SEMBLACK","description":"Received from an IP listed by SEM-BLACK"},{"name":"SEM_URI","description":"Contains a URI listed by SEM-URI"},{"name":"SEM_URIRED","description":"Contains a URI listed by SEM-URIRED"},{"name":"SEM_FRESH","description":"Contains a domain registered less than 5 days ago"},{"name":"SEM_FRESH_10","description":"Contains a domain registered less than 10 days ago"},{"name":"SEM_FRESH_15","description":"Contains a domain registered less than 15 days ago"},{"name":"REPLYTO_MANY_AT","description":"More than one @ in Reply-To:"},{"name":"SENDER_MANY_AT","description":"More than one @ in Sender:"},{"name":"FROM_MANY_AT","description":"More than one @ in From:"},{"name":"RDNS_LOCALHOST","description":"Sender's public rDNS is \"localhost\""},{"name":"EU_SPAM_LAW","description":"Quoting \"European Parliament\" spam law"},{"name":"HTML_ATTACH","description":"HTML attachment to bypass scanning?"},{"name":"OBFU_HTML_ATTACH","description":"HTML attachment with non-text MIME type"},{"name":"OBFU_TEXT_ATTACH","description":"Text attachment with non-text MIME type"},{"name":"OBFU_DOC_ATTACH","description":"MS Document attachment with generic MIME type"},{"name":"OBFU_PDF_ATTACH","description":"PDF attachment with generic MIME type"},{"name":"OBFU_JPG_ATTACH","description":"JPG attachment with generic MIME type"},{"name":"OBFU_GIF_ATTACH","description":"GIF attachment with generic MIME type"},{"name":"OBFU_ATTACH_MISSP","description":"Obfuscated attachment type and misspaced From"},{"name":"ECMSNGR_MH","description":"eC-Messenger header"},{"name":"CTYPE_NULL","description":"Malformed Content-Type header"},{"name":"OBFU_HTML_ATT_MALW","description":"HTML attachment with incorrect MIME type - possible malware"},{"name":"DOC_ATTACH_NO_EXT","description":"Document attachment with suspicious name"},{"name":"MALW_ATTACH","description":"Attachment filename suspicious, probable malware exploit"},{"name":"ISO_ATTACH","description":"ISO attachment - possible malware delivery"},{"name":"MUA_ONE_WORD","description":"Single word X-Mailer: not CamelCase"},{"name":"DEAR_EMAIL_USER","description":"Dear Email User:"},{"name":"URI_NUMERIC_CCTLD","description":"CCTLD URI with multiple numeric subdomains"},{"name":"PHP_NOVER_MUA","description":"Mail from PHP with no version number"},{"name":"FROM_MISSPACED","description":"From: missing whitespace"},{"name":"FROM_MISSP_EH_MATCH","description":"From misspaced, matches envelope"},{"name":"FROM_MISSP_URI","description":"From misspaced, has URI"},{"name":"FROM_MISSP_USER","description":"From misspaced, from \"User\""},{"name":"FROM_MISSP_NO_TO","description":"From misspaced, To missing"},{"name":"FROM_MISSP_TO_UNDISC","description":"From misspaced, To undisclosed"},{"name":"FROM_MISSP_DKIM","description":"From misspaced, DKIM dependable"},{"name":"FROM_MISSP_REPLYTO","description":"From misspaced, has Reply-To"},{"name":"TO_MISSPACED","description":"To: missing whitespace"},{"name":"FROM_MISSP_FREEMAIL","description":"From misspaced + freemail provider"},{"name":"FROM_MISSP_MSFT","description":"From misspaced + supposed Microsoft tool"},{"name":"FROM_MISSP_DYNIP","description":"From misspaced + dynamic rDNS"},{"name":"MAILER_EQ_ORG","description":"X-Mailer: same as Organization:"},{"name":"FROM_EQ_ORG","description":"From: same as Organization:"},{"name":"HDRS_LCASE","description":"Odd capitalization of message header"},{"name":"MANY_HDRS_LCASE","description":"Odd capitalization of multiple message headers"},{"name":"HDRS_LCASE_1K","description":"Odd capitalization of message headers + long header"},{"name":"HDRS_LCASE_IMGONLY","description":"Odd capitalization of message headers + image-only HTML"},{"name":"MDN_BOTCHED","description":"Malformed return receipt header"},{"name":"HDRS_MISSP","description":"Misspaced headers"},{"name":"SPAMMY_MIME_BDRY_01","description":"Spammy MIME boundary string"},{"name":"TBIRD_SUSP_MIME_BDRY","description":"Unlikely Thunderbird MIME boundary"},{"name":"TBIRD_SPOOF","description":"Claims Thunderbird mail client but looks suspicious"},{"name":"RUNON_SHY","description":"Repeating soft hyphens"},{"name":"LAZY_LISTWASHING","description":"Lazy spammer, painfully obvious bogus addresses"},{"name":"CDISP_SZ_MANY","description":"Suspicious MIME header"},{"name":"FREEMAIL_DOC_PDF","description":"MS document or PDF attachment, from freemail"},{"name":"FREEMAIL_DOC_PDF_BCC","description":"MS document or PDF attachment, from freemail, all recipients hidden"},{"name":"FREEMAIL_RVW_ATTCH","description":"Please review attached document, from freemail"},{"name":"EMPTY_RVW_ATTCH","description":"Please review attached document, empty message"},{"name":"END_FUTURE_EMAILS","description":"Spammy unsubscribe"},{"name":"AD_COMPLAINTS","description":"Complain about this spam"},{"name":"MISQ_HTML","description":"Unbalanced quotes in HTML tag"},{"name":"WIKI_IMG","description":"Image from wikipedia"},{"name":"SUBJ_RE_CLNCLN","description":"Subject RE::"},{"name":"TO_SEM_SEM","description":"To has \";;\""},{"name":"MANY_SUBDOM","description":"Lots and lots of subdomain parts in a URI"},{"name":"RFC_ABUSE_POST","description":"Both abuse and postmaster missing on sender domain"},{"name":"MANY_SPAN_IN_TEXT","description":"Many tags embedded within text"},{"name":"MANY_GOOG_PROXY","description":"Many Google feedproxy URIs"},{"name":"TINY_FLOAT","description":"Has small-font floating HTML - text obfuscation?"},{"name":"__TO_EQ_FROM","description":"To: same as From:"},{"name":"FROM_IN_TO_AND_SUBJ","description":"From address is in To and Subject"},{"name":"TO_IN_SUBJ","description":"To address is in Subject"},{"name":"TO_EQ_FM_HTML_ONLY","description":"To == From and HTML only"},{"name":"TO_EQ_FM_DIRECT_MX","description":"To == From and direct-to-MX"},{"name":"TO_EQ_FM_HTML_DIRECT","description":"To == From and HTML only, direct-to-MX"},{"name":"TO_EQ_FM_SPF_FAIL","description":"To == From and external SPF failed"},{"name":"PDS_TO_EQ_FROM_NAME","description":"From: name same as To: address"},{"name":"__TO_EQ_FROM_DOM","description":"To: domain same as From: domain"},{"name":"TO_EQ_FM_DOM_HTML_ONLY","description":"To domain == From domain and HTML only"},{"name":"TO_EQ_FM_DOM_HTML_IMG","description":"To domain == From domain and HTML image link"},{"name":"TO_EQ_FM_DOM_SPF_FAIL","description":"To domain == From domain and external SPF failed"},{"name":"FROM_URI","description":"URI or www. in From"},{"name":"HAS_APPARENTLY_TO","description":"Has deprecated Apparently-To header"},{"name":"MANY_APPARENTLY_TO","description":"Has many Apparently-To headers"},{"name":"FUZZY_OPTOUT","description":"Obfuscated opt-out text"},{"name":"GAPPY_TRADING","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_SECURITIES","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_RISK","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_SELLING","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_HUNDRED","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_THOUSAND","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_EXPENSES","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_DOLLARS","description":"Possible obfuscated stock disclaimer"},{"name":"GAPPY_GENITALIA","description":"G.a.p.p.y male body parts"},{"name":"GAPPY_PILLS","description":"G.a.p.p.y pills"},{"name":"STYLE_GIBBERISH","description":"Nonsense in HTML