Mini Shell

{"HTML_IMAGE_ONLY_32": {"wiki": true, "area": "body", "score": 2.196, "desc": "HTML: images with 2800-3200 bytes of words"}, "DOS_STOCK_INCOME_STATEMENT": {"wiki": true, "area": "meta", "score": 1.0, "desc": "Pump and dump stock income statement spam"}, "FREEMAIL_REPLYTO_END_DIGIT": {"wiki": true, "area": "header", "score": 1.221, "desc": "Reply-To freemail username ends in digit"}, "RCVD_IN_CSS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received via a relay in Spamhaus CSS"}, "HTML_BADTAG_90_100": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML message is 90% to 100% bad tags"}, "FUZZY_BILLION": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "DKIM_ADSP_DISCARD": {"wiki": true, "area": "header", "score": 1.8, "desc": "No valid author signature, domain signs all mail and suggests discarding the rest"}, "FB_MORE_SIZE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: more size"}, "FORGED_MUA_OIMO": {"wiki": true, "area": "meta", "score": 3.595, "desc": "Forged mail pretending to be from MS Outlook IMO"}, "USER_IN_SPF_WHITELIST": {"wiki": true, "area": "header", "score": -100.0, "desc": "From: address is in the user's SPF whitelist"}, "JM_I_FEEL_LUCKY": {"wiki": true, "area": "uri", "score": 1.0, "desc": "/(?:\\&| \\?)btnI=ec(?:(dollar) | \\&)/"}, "URI_OBFU_WWW": {"wiki": true, "area": "body", "score": 3.099, "desc": "Obfuscated URI"}, "DATE_IN_FUTURE_12_24": {"wiki": true, "area": "header", "score": 3.199, "desc": "Date: is 12 to 24 hours after Received: date"}, "HASHCASH_21": {"wiki": true, "area": "header", "score": -0.7, "desc": "Contains valid Hashcash token (21 bits)"}, "HASHCASH_20": {"wiki": true, "area": "header", "score": -0.5, "desc": "Contains valid Hashcash token (20 bits)"}, "HASHCASH_23": {"wiki": true, "area": "header", "score": -2.0, "desc": "Contains valid Hashcash token (23 bits)"}, "MIME_HTML_ONLY": {"wiki": true, "area": "body", "score": 2.199, "desc": "Message only has text/html MIME parts"}, "HASHCASH_25": {"wiki": true, "area": "header", "score": -4.0, "desc": "Contains valid Hashcash token (25 bits)"}, "HASHCASH_24": {"wiki": true, "area": "header", "score": -3.0, "desc": "Contains valid Hashcash token (24 bits)"}, "FB_FAKE_NUMBERS": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like numbers with O's insted of 0's"}, "FM_DOESNT_SAY_STOCK": {"wiki": true, "area": "meta", "score": 4.295, "desc": "It's a stock spam but doesn't say stock"}, "FM_ROLEX_ADS": {"wiki": true, "area": "meta", "score": 3.999, "desc": "Looks like Rolex spams."}, "ALL_TRUSTED": {"wiki": true, "area": "header", "score": -1.0, "desc": "Passed through trusted hosts only via SMTP"}, "BANG_OPRAH": {"wiki": true, "area": "body", "score": 1.0, "desc": "Talks about Oprah with an exclamation!"}, "DRUGS_SMEAR1": {"wiki": true, "area": "body", "score": 3.3, "desc": "Two or more drugs crammed together into one word"}, "EMAIL_ROT13": {"wiki": true, "area": "body", "score": 1.0, "desc": "Body contains a ROT13-encoded email address"}, "XMAILER_MIMEOLE_OL_83BF7": {"wiki": true, "area": "meta", "score": 1.209, "desc": "(__XM_OL_83BF7 && __MO_OL_83BF7)"}, "DK_SIGNED": {"wiki": true, "area": "header", "score": 0.001, "desc": "Domain Keys: message has a signature"}, "FROM_STARTS_WITH_NUMS": {"wiki": true, "area": "header", "score": 2.801, "desc": "From: starts with many numbers"}, "DC_PNG_UNO_LARGO": {"wiki": true, "area": "meta", "score": 2.092, "desc": "Message contains a single large inline gif"}, "RCVD_IN_SORBS_HTTP": {"wiki": true, "area": "header", "score": 2.499, "desc": "SORBS: sender is open HTTP proxy server"}, "FM_LIKE_STOCKS": {"wiki": true, "area": "meta", "score": 2.94, "desc": "It looks like a duck, it's a duck!"}, "HTML_MISSING_CTYPE": {"wiki": true, "area": "meta", "score": 2.38, "desc": "Message is HTML without HTML Content-Type"}, "DNS_FROM_DOB": {"wiki": true, "area": "header", "score": 0.341, "desc": "Sender from new domain (Day Old Bread)"}, "MSOE_MID_WRONG_CASE": {"wiki": true, "area": "meta", "score": 0.699, "desc": "(__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106)"}, "FSL_HELO_SETUP": {"wiki": true, "area": "header", "score": 1.0, "desc": "X-Spam-Relays-External =~ /\\bhelo=\\S+\\.setup\\b/i"}, "PART_CID_STOCK_LESS": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Has a spammy image attachment (by Content-ID, more specific)"}, "DOS_REPORT_FIN_INC": {"wiki": true, "area": "body", "score": 1.0, "desc": "Report of financial income"}, "ACCESSDB": {"wiki": true, "area": "header", "score": 1.0, "desc": "Message would have been caught by accessdb"}, "REPTO_QUOTE_IMS": {"wiki": true, "area": "meta", "score": 0.314, "desc": "IMS doesn't do quoting like this"}, "WHOIS_MONIKER_PRIV": {"wiki": true, "area": "body", "score": 2.596, "desc": "URL registered to Moniker Privacy Protection"}, "SORTED_RECIPS": {"wiki": true, "area": "header", "score": 2.499, "desc": "Recipient list is sorted by address"}, "MPART_ALT_DIFF_COUNT": {"wiki": true, "area": "body", "score": 2.799, "desc": "HTML and text parts are different"}, "SUBJECT_FUZZY_PENIS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Attempt to obfuscate words in Subject:"}, "RCVD_IN_BRBL_LASTEXT": {"wiki": true, "area": "header", "score": 1.644, "desc": "eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org')"}, "FS_LARGE_PERCENT2": {"wiki": true, "area": "header", "score": 2.699, "desc": "Larger than 100% in subj."}, "BAD_CREDIT": {"wiki": true, "area": "body", "score": 2.799, "desc": "Eliminate Bad Credit"}, "FRT_WEIGHT2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Weight (2)"}, "DRUGS_SLEEP_EREC": {"wiki": true, "area": "meta", "score": 1.952, "desc": "Refers to both an erectile and a sleep aid drug"}, "RCVD_IN_SORBS_SMTP": {"wiki": true, "area": "header", "score": 1.0, "desc": "SORBS: sender is open SMTP relay"}, "FH_DATE_IS_19XX": {"wiki": true, "area": "header", "score": 2.373, "desc": "The date is not 19xx."}, "XMAILER_MIMEOLE_OL_CAC8F": {"wiki": true, "area": "meta", "score": 0.702, "desc": "(__XM_OL_CAC8F && __MO_OL_CAC8F)"}, "FS_WEIGHT_LOSS": {"wiki": true, "area": "header", "score": 2.501, "desc": "Subject says Weight Loss"}, "HASHCASH_2SPEND": {"wiki": true, "area": "header", "score": 0.1, "desc": "Hashcash token already spent in another mail"}, "NONEXISTENT_CHARSET": {"wiki": true, "area": "header", "score": 1.0, "desc": "Character set doesn't exist"}, "TVD_RATWARE_CB": {"wiki": true, "area": "header", "score": 1.0, "desc": "Content-Type =~ /\\bboundary\\b.{1,40}qzsoft_directmail_seperator/i"}, "XMAILER_MIMEOLE_OL_22B61": {"wiki": true, "area": "meta", "score": 3.795, "desc": "(__XM_OL_22B61 && __MO_OL_22B61)"}, "XMAILER_MIMEOLE_OL_ADFF7": {"wiki": true, "area": "meta", "score": 2.759, "desc": "(__XM_OL_ADFF7 && __MO_OL_ADFF7)"}, "PREST_NON_ACCREDITED": {"wiki": true, "area": "body", "score": 1.0, "desc": "'Prestigious Non-Accredited Universities'"}, "DRUGS_ERECTILE": {"wiki": true, "area": "meta", "score": 0.646, "desc": "Refers to an erectile drug"}, "DOS_STOCK_BAT": {"wiki": true, "area": "meta", "score": 3.383, "desc": "Probable pump and dump stock spam"}, "XMAILER_MIMEOLE_OL_C65FA": {"wiki": true, "area": "meta", "score": 2.308, "desc": "(__XM_OL_C65FA && __MO_OL_C65FA)"}, "MONEY_BACK": {"wiki": true, "area": "body", "score": 2.91, "desc": "Money back guarantee"}, "RCVD_IN_XBL": {"wiki": true, "area": "header", "score": 0.724, "desc": "Received via a relay in Spamhaus XBL"}, "HELO_DYNAMIC_SPLIT_IP": {"wiki": true, "area": "header", "score": 4.225, "desc": "Relay HELO'd using suspicious hostname (Split IP)"}, "FH_HELO_ENDS_DOT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Helo ends with a dot."}, "FORGED_OUTLOOK_HTML": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Outlook can't send HTML message only"}, "FB_MEDS_PERCENT": {"wiki": true, "area": "body", "score": 1.0, "desc": "Talks about meds and %"}, "RCVD_IN_SORBS_WEB": {"wiki": true, "area": "header", "score": 0.77, "desc": "SORBS: sender is an abusable web server"}, "HTTP_77": {"wiki": true, "area": "uri", "score": 1.0, "desc": "Contains an URL-encoded hostname (HTTP77)"}, "AXB_XMID_1510": {"wiki": true, "area": "header", "score": 1.0, "desc": "Brunello Fingerprint"}, "RCVD_IN_DOB": {"wiki": true, "area": "header", "score": 0.835, "desc": "Received via relay in new domain (Day Old Bread)"}, "DEAR_FRIEND": {"wiki": true, "area": "body", "score": 2.683, "desc": "Dear Friend? That's not very dear!"}, "HTML_IMAGE_ONLY_08": {"wiki": true, "area": "body", "score": 1.845, "desc": "HTML: images with 400-800 bytes of words"}, "XMAILER_MIMEOLE_OL_4F240": {"wiki": true, "area": "meta", "score": 1.85, "desc": "(__XM_OL_4F240 && __MO_OL_4F240)"}, "DCC_REPUT_13_19": {"wiki": true, "area": "full", "score": 0.0, "desc": "eval:check_dcc_reputation_range(13,19)"}, "FB_REPLIC_CAP": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: REPLICA"}, "FB_ADD_INCHES": {"wiki": true, "area": "body", "score": 1.0, "desc": "Add / Gain inches"}, "MIME_BOUND_DD_DIGITS": {"wiki": true, "area": "header", "score": 3.016, "desc": "Spam tool pattern in MIME boundary"}, "MISSING_MIME_HB_SEP": {"wiki": true, "area": "body", "score": 0.001, "desc": "Missing blank line between MIME header and body"}, "MULTIPART_ALT_NON_TEXT": {"wiki": true, "area": "body", "score": 1.0, "desc": "eval:check_ma_non_text()"}, "TVD_FUZZY_PHARMACEUTICAL": {"wiki": true, "area": "body", "score": 1.0, "desc": "/<inter W2><post P2>(?!pharmaceutical)<P><H><A><R><M><A><C><E><U><T><I><C><A><L>/i"}, "TVD_PCT_OFF": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject =~ /(?:Jan| Feb| Mar| Apr| May| Jun| Jul| Aug| Sep| Oct| Nov| Dec)\\S* \\d+% OFF/"}, "SUBJ_YOUR_FAMILY": {"wiki": true, "area": "header", "score": 2.999, "desc": "Subject contains \"Your Family\""}, "FU_URI_TRACKER_T": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URI style tracker (T)"}, "TVD_VISIT_PHARMA": {"wiki": true, "area": "body", "score": 1.957, "desc": "/Online Ph.rmacy/i"}, "ONLINE_PHARMACY": {"wiki": true, "area": "body", "score": 2.371, "desc": "Online Pharmacy"}, "FUZZY_PRICES": {"wiki": true, "area": "body", "score": 2.311, "desc": "Attempt to obfuscate words in spam"}, "DRUGS_MANYKINDS": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Refers to at least four kinds of drugs"}, "HTTPS_HTTP_MISMATCH": {"wiki": true, "area": "body", "score": 1.989, "desc": "eval:check_https_http_mismatch('1','10')"}, "HTML_OBFUSCATE_20_30": {"wiki": true, "area": "body", "score": 2.499, "desc": "Message is 20% to 30% HTML obfuscation"}, "UNCLOSED_BRACKET": {"wiki": true, "area": "header", "score": 2.699, "desc": "Headers contain an unclosed bracket"}, "DATE_IN_PAST_03_06": {"wiki": true, "area": "header", "score": 2.399, "desc": "Date: is 3 to 6 hours before Received: date"}, "HTML_IMAGE_RATIO_06": {"wiki": true, "area": "body", "score": 0.001, "desc": "HTML has a low ratio of text to image area"}, "TVD_RCVD_IP4": {"wiki": true, "area": "header", "score": 1.596, "desc": "Received =~ /^from\\s+(?:\\d+\\.){3}\\d+\\s/"}, "FORGED_QUALCOMM_TAGS": {"wiki": true, "area": "meta", "score": 3.127, "desc": "QUALCOMM mailers can't send HTML in this format"}, "DEAR_EMAIL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message contains Dear email address"}, "SPF_HELO_SOFTFAIL": {"wiki": true, "area": "header", "score": 0.896, "desc": "SPF: HELO does not match SPF record (softfail)"}, "FU_UKGEOCITIES": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URL with [a-z]{2}.geocities.com"}, "BODY_8BITS": {"wiki": true, "area": "body", "score": 1.5, "desc": "Body includes 8 consecutive 8-bit characters"}, "WHOIS_DMNBYPROXY": {"wiki": true, "area": "body", "score": 0.26, "desc": "Contains URL registered to Domains by Proxy"}, "SUBJ_DOLLARS": {"wiki": true, "area": "header", "score": 1.8, "desc": "Subject starts with dollar amount"}, "HASHCASH_22": {"wiki": true, "area": "header", "score": -1.0, "desc": "Contains valid Hashcash token (22 bits)"}, "RCVD_IN_DNSWL_HI": {"wiki": true, "area": "header", "score": 0.0, "desc": "Sender listed at http://www.dnswl.org/, high trust"}, "FUZZY_REFINANCE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "STOCK_IMG_OUTLOOK": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Stock spam image part, with Outlook-like features"}, "HTML_NONELEMENT_60_70": {"wiki": true, "area": "body", "score": 1.0, "desc": "60% to 70% of HTML elements are non-standard"}, "CHARSET_FARAWAY_HEADER": {"wiki": true, "area": "header", "score": 3.2, "desc": "A foreign language charset used in headers"}, "HEADER_COUNT_CTYPE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Multiple Content-Type headers found"}, "HTML_FORMACTION_MAILTO": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML includes a form which sends mail"}, "KAM_LOTTO1": {"wiki": true, "area": "meta", "score": 1.569, "desc": "Likely to be a e-Lotto Scam Email"}, "KAM_LOTTO2": {"wiki": true, "area": "meta", "score": 1.19, "desc": "Highly Likely to be a e-Lotto Scam Email"}, "KAM_LOTTO3": {"wiki": true, "area": "meta", "score": 1.0, "desc": "Almost certain to be a e-Lotto Scam Email"}, "RAZOR2_CF_RANGE_E8_51_100": {"wiki": true, "area": "full", "score": 2.43, "desc": "Razor2 gives engine 8 confidence level above 50%"}, "WHOIS_NAMEKING": {"wiki": true, "area": "body", "score": 1.477, "desc": "URL registered to NameKing"}, "FR_ALMOST_VIAG2": {"wiki": true, "area": "rawbody", "score": 2.299, "desc": "Almost looks like viagra."}, "FB_QUALITY_REPLICA": {"wiki": true, "area": "body", "score": 3.313, "desc": "Phrase: quality replica"}, "MIME_HTML_ONLY_MULTI": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Multipart message only has text/html MIME parts"}, "PRICES_ARE_AFFORDABLE": {"wiki": true, "area": "body", "score": 1.112, "desc": "Message says that prices aren't too expensive"}, "HTML_OBFUSCATE_10_20": {"wiki": true, "area": "body", "score": 1.162, "desc": "Message is 10% to 20% HTML obfuscation"}, "RCVD_FORGED_WROTE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Forged 'Received' header found ('wrote:' spam)"}, "XMAILER_MIMEOLE_OL_F6D01": {"wiki": true, "area": "meta", "score": 3.496, "desc": "(__XM_OL_F6D01 && __MO_OL_F6D01)"}, "FS_WITH_SMALL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject says With ... small"}, "FS_APPROVE_YOU": {"wiki": true, "area": "header", "score": 2.499, "desc": "Subject says approve you"}, "TEMPLATE_203_RCVD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received =~ /from 192.168.0.\\d+ \\(203-219-/"}, "RATWARE_OUTLOOK_NONAME": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Bulk email fingerprint (Outlook no name) found"}, "RCVD_IN_BL_SPAMCOP_NET": {"wiki": true, "area": "header", "score": 1.347, "desc": "Received via a relay in bl.spamcop.net"}, "FS_PHARMASUB2": {"wiki": true, "area": "header", "score": 2.98, "desc": "Looks like Phramacy subject."}, "WHOIS_CONTACTPRIV": {"wiki": true, "area": "body", "score": 2.696, "desc": "URL registered to contactprivacy.com"}, "VBOUNCE_MESSAGE": {"wiki": true, "area": "meta", "score": 0.1, "desc": "Virus-scanner bounce message"}, "TVD_PH_SUBJ_URGENT": {"wiki": true, "area": "header", "score": 2.8, "desc": "Subject =~ /^urgent(?:[\\s\\W]*(dollar) | .{1,40}(?:alert| response| assistance| proposal| reply| warning| noti(?:ce| fication)| greeting| matter))/i"}, "XMAILER_MIMEOLE_OL_CF0C0": {"wiki": true, "area": "meta", "score": 2.088, "desc": "(__XM_OL_CF0C0 && __MO_OL_CF0C0)"}, "FB_SPACED_FREE": {"wiki": true, "area": "body", "score": 2.499, "desc": "Phrase: F R E E"}, "RATWARE_MOZ_MALFORMED": {"wiki": true, "area": "header", "score": 1.0, "desc": "Bulk email fingerprint (Mozilla malformed) found"}, "FB_SOFTTABS": {"wiki": true, "area": "body", "score": 3.378, "desc": "Phrase: Softabs"}, "REPTO_QUOTE_AOL": {"wiki": true, "area": "meta", "score": 1.595, "desc": "AOL doesn't do quoting like this"}, "FB_PROLONGED_HARD": {"wiki": true, "area": "body", "score": 1.0, "desc": "Talks about prolonged hardness"}, "FB_GAPPY_ADDRESS": {"wiki": true, "area": "body", "score": 1.0, "desc": "Too much spacing in Address"}, "RCVD_IN_NJABL_SPAM": {"wiki": true, "area": "header", "score": 1.466, "desc": "NJABL: sender is confirmed spam source"}, "AXB_XTIDX_CHAIN": {"wiki": true, "area": "header", "score": 1.0, "desc": "Montepulciano Fingerprint"}, "HTML_TAG_EXIST_BGSOUND": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML has \"bgsound\" tag"}, "USER_IN_WHITELIST_TO": {"wiki": true, "area": "header", "score": -6.0, "desc": "User is listed in 'whitelist_to'"}, "FREE_QUOTE_INSTANT": {"wiki": true, "area": "body", "score": 2.7, "desc": "Free express or no-obligation quote"}, "RCVD_NUMERIC_HELO": {"wiki": true, "area": "header", "score": 1.164, "desc": "Received: contains an IP address used for HELO"}, "FROM_OFFERS": {"wiki": true, "area": "header", "score": 2.699, "desc": "From address is \"at something-offers\""}, "FB_EMAIL_HIER": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: email hier"}, "FORGED_HOTMAIL_RCVD2": {"wiki": true, "area": "header", "score": 1.187, "desc": "hotmail.com 'From' address, but no 'Received:'"}, "BAYES_40": {"wiki": true, "area": "body", "score": 0.0, "desc": "Bayes spam probability is 20 to 40%"}, "FB_FAKE_NUMS4": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like fake numbers (4)"}, "XMAILER_MIMEOLE_OL_465CD": {"wiki": true, "area": "meta", "score": 3.576, "desc": "(__XM_OL_465CD && __MO_OL_465CD)"}, "USER_IN_DEF_SPF_WL": {"wiki": true, "area": "header", "score": -7.5, "desc": "From: address is in the default SPF white-list"}, "FSL_HELO_BARE_IP_1": {"wiki": true, "area": "header", "score": 3.099, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=\\d+\\.\\d+\\.\\d+\\.\\d+ /i"}, "BILLION_DOLLARS": {"wiki": true, "area": "body", "score": 1.638, "desc": "Talks about lots of money"}, "WEIRD_PORT": {"wiki": true, "area": "uri", "score": 0.097, "desc": "Uses non-standard port number for HTTP"}, "DATE_SPAMWARE_Y2K": {"wiki": true, "area": "header", "score": 1.0, "desc": "Date header uses unusual Y2K formatting"}, "DCC_REPUT_95_98": {"wiki": true, "area": "full", "score": 1.0, "desc": "DCC reputation between 95 and 98 % (mostly spam)"}, "FB_RE_FI": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like refi."}, "FM_RE_HELLO_SPAM": {"wiki": true, "area": "meta", "score": 2.798, "desc": "Re: Hello / hi"}, "DOS_PROVISION4": {"wiki": true, "area": "body", "score": 1.0, "desc": "Provision for income taxes"}, "RCVD_HELO_IP_MISMATCH": {"wiki": true, "area": "header", "score": 2.368, "desc": "Received: HELO and IP do not match, but should"}, "FH_DATE_PAST_20XX": {"wiki": true, "area": "header", "score": 3.384, "desc": "The date is grossly in the future."}, "TVD_RATWARE_MSGID_02": {"wiki": true, "area": "header", "score": 1.0, "desc": "Message-ID =~ /^[^<]*<[a-z]+\\@/"}, "URIBL_WS_SURBL": {"wiki": true, "area": "body", "score": 1.659, "desc": "Contains an URL listed in the WS SURBL blocklist"}, "FORGED_MUA_THEBAT_BOUN": {"wiki": true, "area": "meta", "score": 1.019, "desc": "Mail pretending to be from The Bat! (boundary)"}, "RAZOR2_CF_RANGE_E4_51_100": {"wiki": true, "area": "full", "score": 0.642, "desc": "Razor2 gives engine 4 confidence level above 50%"}, "HDR_ORDER_FTSDMCXX_001C": {"wiki": true, "area": "meta", "score": 1.937, "desc": "Header order similar to spam (FTSDMCXX/MID variant)"}, "DRUGS_ANXIETY_EREC": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Refers to both an erectile and an anxiety drug"}, "RCVD_IN_IADB_UT_CPEAR": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Complies with Utah's CPEAR law"}, "SUBJ_ALL_CAPS": {"wiki": true, "area": "header", "score": 1.625, "desc": "Subject is all capitals"}, "STOCK_IMG_HDR_FROM": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Stock spam image part, with distinctive From line"}, "HS_SUBJ_NEW_SOFTWARE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject starts with 'New software uploaded by'"}, "FB_GVR": {"wiki": true, "area": "body", "score": 2.568, "desc": "Looks like generic viagra"}, "FRT_GUARANTEE1": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Guarantee (1)"}, "XMAILER_MIMEOLE_OL_A842E": {"wiki": true, "area": "meta", "score": 0.963, "desc": "(__XM_OL_A842E && __MO_OL_A842E)"}, "DKIM_ADSP_NXDOMAIN": {"wiki": true, "area": "header", "score": 0.9, "desc": "No valid author signature and domain not in DNS"}, "UNCLAIMED_MONEY": {"wiki": true, "area": "body", "score": 2.699, "desc": "People just leave money laying around"}, "TVD_SUBJ_FINGER_03": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject =~ /^\\s*\\*\\s+(?:\\w+\\W+)+\\*\\s*(dollar) /"}, "PART_CID_STOCK": {"wiki": true, "area": "meta", "score": 1.231, "desc": "Has a spammy image attachment (by Content-ID)"}, "TVD_QUAL_MEDS": {"wiki": true, "area": "body", "score": 2.799, "desc": "/\\bquality med(?:ication)?s\\b/i"}, "FS_RE_APPROV": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: re approved"}, "RCVD_IN_MAPS_RBL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Relay in RBL, http://www.mail-abuse.com/enduserinfo_rbl.html"}, "XMAILER_MIMEOLE_OL_8E893": {"wiki": true, "area": "meta", "score": 2.896, "desc": "(__XM_OL_8E893 && __MO_OL_8E893)"}, "FORGED_MSGID_HOTMAIL": {"wiki": true, "area": "meta", "score": 2.706, "desc": "Message-ID is forged, (hotmail.com)"}, "FRT_ESTABLISH2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Establish (2)"}, "RCVD_IN_DNSWL_LOW": {"wiki": true, "area": "header", "score": 0.0, "desc": "Sender listed at http://www.dnswl.org/, low trust"}, "DRUGS_ANXIETY": {"wiki": true, "area": "meta", "score": 1.331, "desc": "Refers to an anxiety control drug"}, "RCVD_IN_RP_RNBL": {"wiki": true, "area": "header", "score": 1.31, "desc": "Relay in RNBL, https://senderscore.org/blacklistlookup/"}, "NO_RELAYS": {"wiki": true, "area": "header", "score": -0.001, "desc": "Informational: message was not relayed via SMTP"}, "HTML_SHORT_LINK_IMG_3": {"wiki": true, "area": "meta", "score": 0.556, "desc": "HTML is very short with a linked image"}, "SUBJECT_IN_BLACKLIST": {"wiki": true, "area": "header", "score": 100.0, "desc": "Subject: contains string in the user's black-list"}, "HTML_SHORT_LINK_IMG_1": {"wiki": true, "area": "meta", "score": 1.078, "desc": "HTML is very short with a linked image"}, "DCC_REPUT_70_89": {"wiki": true, "area": "full", "score": 0.1, "desc": "DCC reputation between 70 and 89 %"}, "FREE_PORN": {"wiki": true, "area": "body", "score": 1.0, "desc": "Possible porn - Free Porn"}, "HS_INDEX_PARAM": {"wiki": true, "area": "uri", "score": 1.203, "desc": "Link contains a common tracker pattern."}, "NO_DNS_FOR_FROM": {"wiki": true, "area": "header", "score": 0.379, "desc": "Envelope sender has no MX or A DNS records"}, "RAZOR2_CF_RANGE_51_100": {"wiki": true, "area": "full", "score": 0.5, "desc": "Razor2 gives confidence level above 50%"}, "STOCK_IMG_CTYPE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Stock spam image part, with distinctive Content-Type header"}, "RCVD_IN_IADB_DK": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Sender publishes Domain Keys record"}, "USER_IN_ALL_SPAM_TO": {"wiki": true, "area": "header", "score": -100.0, "desc": "User is listed in 'all_spam_to'"}, "XMAILER_MIMEOLE_OL_09BB4": {"wiki": true, "area": "meta", "score": 0.681, "desc": "(__XM_OL_09BB4 && __MO_OL_09BB4)"}, "KAM_STOCKTIP15": {"wiki": true, "area": "meta", "score": 0.001, "desc": "(0)"}, "FB_THIS_ADVERT": {"wiki": true, "area": "body", "score": 3.6, "desc": "Phrase: this advertiser"}, "FS_LOWER_YOUR": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: lower your"}, "FH_HELO_ALMOST_IP": {"wiki": true, "area": "header", "score": 3.699, "desc": "Helo is almost an IP addr."}, "XMAILER_MIMEOLE_OL_3D61D": {"wiki": true, "area": "meta", "score": 1.308, "desc": "(__XM_OL_3D61D && __MO_OL_3D61D)"}, "MIME_HTML_MOSTLY": {"wiki": true, "area": "body", "score": 0.725, "desc": "Multipart message mostly text/html MIME"}, "URI_UNSUBSCRIBE": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URI contains suspicious unsubscribe link"}, "FSL_INTERIA_ABUSE": {"wiki": true, "area": "uri", "score": 3.899, "desc": "/\\/\\S+\\.(?:w| eu| fm)\\.interia\\.pl/"}, "L_SPAM_TOOL_13": {"wiki": true, "area": "header", "score": 1.333, "desc": "Date =~ /\\s[+-]\\d(?![2358]45)\\d[124-9]\\d(dollar) /"}, "FORGED_MSGID_MSN": {"wiki": true, "area": "meta", "score": 1.222, "desc": "Message-ID is forged, (msn.com)"}, "FB_HOMELOAN": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase (dollar) x home loan"}, "FS_EJACULA": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: ejaculation in subject."}, "FROM_LOCAL_HEX": {"wiki": true, "area": "header", "score": 0.331, "desc": "From: localpart has long hexadecimal sequence"}, "SUBJ_ILLEGAL_CHARS": {"wiki": true, "area": "header", "score": 1.527, "desc": "Subject: has too many raw illegal characters"}, "LIVEFILESTORE": {"wiki": true, "area": "uri", "score": 3.3, "desc": "m~livefilestore.com/~"}, "REPTO_QUOTE_YAHOO": {"wiki": true, "area": "meta", "score": 0.729, "desc": "Yahoo! doesn't do quoting like this"}, "WHOIS_PRIVPROT": {"wiki": true, "area": "body", "score": 2.801, "desc": "URL registered to WHOIS Privacy Protection"}, "FB_UNRESOLV_PROV": {"wiki": true, "area": "body", "score": 1.0, "desc": "Pattern Replacement PROV_D"}, "MSGID_YAHOO_CAPS": {"wiki": true, "area": "header", "score": 2.278, "desc": "Message-ID has ALLCAPS@yahoo.com"}, "DOS_RCVD_IP_TWICE_C": {"wiki": true, "area": "header", "score": 3.292, "desc": "Received from the same IP twice in a row (only one external relay; empty or IP helo)"}, "FAKE_OUTBLAZE_RCVD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received header contains faked 'mr.outblaze.com'"}, "DATE_IN_FUTURE_06_12": {"wiki": true, "area": "header", "score": 2.899, "desc": "Date: is 6 to 12 hours after Received: date"}, "DC_IMAGE_SPAM_HTML": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Possible Image-only spam"}, "JM_RCVD_QMAILV1": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received =~ /by \\S+ \\(Qmailv1\\) with ESMTP/"}, "RATWARE_OE_MALFORMED": {"wiki": true, "area": "header", "score": 1.0, "desc": "X-Mailer has malformed Outlook Express version"}, "FM_FRM_RN_L_BRACK": {"wiki": true, "area": "meta", "score": 3.096, "desc": "From name has > but not <"}, "XMAILER_MIMEOLE_OL_F475E": {"wiki": true, "area": "meta", "score": 0.627, "desc": "(__XM_OL_F475E && __MO_OL_F475E)"}, "TT_OBSCURED_VIAGRA": {"wiki": true, "area": "meta", "score": 2.154, "desc": "Scora: obscured \"VIAGRA\" in subject"}, "TVD_SUBJ_ACC_NUM": {"wiki": true, "area": "header", "score": 2.199, "desc": "Subject has spammy looking monetary reference"}, "FRT_SOMA2": {"wiki": true, "area": "body", "score": 0.001, "desc": "ReplaceTags: Soma (2)"}, "MID_DEGREES": {"wiki": true, "area": "header", "score": 1.0, "desc": "Message-ID =~ /^<\\d{14}\\.[A-F0-9]{10}\\@[A-Z0-9]+>(dollar) /"}, "XMAILER_MIMEOLE_OL_07794": {"wiki": true, "area": "meta", "score": 1.613, "desc": "(__XM_OL_07794 && __MO_OL_07794)"}, "XMAILER_MIMEOLE_OL_58CB5": {"wiki": true, "area": "meta", "score": 3.599, "desc": "(__XM_OL_58CB5 && __MO_OL_58CB5)"}, "SUBJECT_DIET": {"wiki": true, "area": "header", "score": 1.927, "desc": "Subject talks about losing pounds"}, "RCVD_IN_IADB_UNVERIFIED_2": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Accepts unverified sign-ups, gives chance to opt out"}, "XMAILER_MIMEOLE_OL_6554A": {"wiki": true, "area": "meta", "score": 0.934, "desc": "(__XM_OL_6554A && __MO_OL_6554A)"}, "FB_LOSE_WEIGHT_CAP": {"wiki": true, "area": "body", "score": 2.187, "desc": "Phrase: LOSE WEIGHT"}, "FB_IMPRESS_GIRL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: impress ... girl"}, "URIBL_RED": {"wiki": true, "area": "body", "score": 0.001, "desc": "Contains an URL listed in the URIBL redlist"}, "MISSING_HB_SEP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Missing blank line between message header and body"}, "SPF_PASS": {"wiki": true, "area": "header", "score": -0.001, "desc": "SPF: sender matches SPF record"}, "FB_SYMBLO": {"wiki": true, "area": "body", "score": 1.0, "desc": "Mis-spelled symbol."}, "REFINANCE_NOW": {"wiki": true, "area": "body", "score": 1.0, "desc": "Home refinancing"}, "XMAILER_MIMEOLE_OL_20C99": {"wiki": true, "area": "meta", "score": 1.046, "desc": "(__XM_OL_20C99 && __MO_OL_20C99)"}, "FRT_PHARMAC": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Pharmac"}, "FUZZY_CPILL": {"wiki": true, "area": "body", "score": 0.001, "desc": "Attempt to obfuscate words in spam"}, "DKIM_VALID": {"wiki": true, "area": "full", "score": -0.1, "desc": "Message has at least one valid DKIM or DK signature"}, "MSGID_SPAM_CAPS": {"wiki": true, "area": "header", "score": 3.099, "desc": "Spam tool Message-Id: (caps variant)"}, "DRUGS_HDIA": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject =~ /\\bhoodia\\b/i"}, "FB_CIALIS_LEO3": {"wiki": true, "area": "body", "score": 3.245, "desc": "Uses a mis-spelled version of cialis."}, "REPTO_QUOTE_MSN": {"wiki": true, "area": "meta", "score": 2.689, "desc": "MSN doesn't do quoting like this"}, "HG_HORMONE": {"wiki": true, "area": "meta", "score": 2.292, "desc": "Talks about hormones for human growth"}, "APOSTROPHE_FROM": {"wiki": true, "area": "header", "score": 0.786, "desc": "From address contains an apostrophe"}, "TVD_APPROVED": {"wiki": true, "area": "body", "score": 2.599, "desc": "/you.{1,2}re .{0,20}approved/i"}, "FUZZY_THOUSANDS": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "DKIM_VERIFIED": {"wiki": true, "area": "full", "score": 1.0, "desc": "eval:check_dkim_valid()"}, "FH_FROM_GET_NAME": {"wiki": true, "area": "header", "score": 2.699, "desc": "From name says Get"}, "DKIM_SIGNED": {"wiki": true, "area": "full", "score": 0.1, "desc": "Message has a DKIM or DK signature, not necessarily valid"}, "KB_RATWARE_OUTLOOK_16": {"wiki": true, "area": "header", "score": 1.0, "desc": "ALL =~ /^Message-Id: <....([0-9a-f]{8})\\(dollar) ([0-9a-f]{8})\\(dollar) .{100,400}boundary=\"----=_NextPart_000_...._\\1\\.\\2/msi"}, "TVD_RCVD_SPACE_BRACKET": {"wiki": true, "area": "header", "score": 0.001, "desc": "Received =~ /\\(\\[(?!UNIX:)[^\\[\\]]*\\s/"}, "URI_HEX": {"wiki": true, "area": "uri", "score": 2.8, "desc": "URI hostname has long hexadecimal sequence"}, "MSGID_RANDY": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Message-Id has pattern used in spam"}, "URIBL_SBL": {"wiki": true, "area": "body", "score": 1.623, "desc": "Contains an URL listed in the SBL blocklist"}, "URIBL_PH_SURBL": {"wiki": true, "area": "body", "score": 0.61, "desc": "Contains an URL listed in the PH SURBL blocklist"}, "UNPARSEABLE_RELAY": {"wiki": true, "area": "header", "score": 0.001, "desc": "Informational: message has unparseable relay lines"}, "FB_STOCK_EXPLODE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like stocks exploding."}, "US_DOLLARS_3": {"wiki": true, "area": "body", "score": 2.599, "desc": "Mentions millions of (dollar) ((dollar) NN,NNN,NNN.NN)"}, "BAYES_00": {"wiki": true, "area": "body", "score": 0.0, "desc": "Bayes spam probability is 0 to 1%"}, "HS_MEETUP_FOR_SEX": {"wiki": true, "area": "body", "score": 1.0, "desc": "Talks about meeting up for sex."}, "FB_P1LL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: p1ll"}, "FROM_LOCAL_NOVOWEL": {"wiki": true, "area": "header", "score": 0.5, "desc": "From: localpart has series of non-vowel letters"}, "DKIM_POLICY_SIGNALL": {"wiki": true, "area": "header", "score": 1.0, "desc": "eval:check_dkim_signall()"}, "MIME_CHARSET_FARAWAY": {"wiki": true, "area": "meta", "score": 2.45, "desc": "MIME character set indicates foreign language"}, "WITH_LC_SMTP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received line contains spam-sign (lowercase smtp)"}, "RCVD_IN_IADB_GOODMAIL": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Sender has been certified by GoodMail"}, "DRUG_ED_CAPS": {"wiki": true, "area": "body", "score": 2.799, "desc": "Mentions an E.D. drug"}, "FUZZY_PHARMACY": {"wiki": true, "area": "body", "score": 3.299, "desc": "Attempt to obfuscate words in spam"}, "HTML_IMAGE_ONLY_20": {"wiki": true, "area": "body", "score": 2.109, "desc": "HTML: images with 1600-2000 bytes of words"}, "FS_HUGECOCK": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: Huge Cock"}, "HTML_IMAGE_ONLY_24": {"wiki": true, "area": "body", "score": 2.799, "desc": "HTML: images with 2000-2400 bytes of words"}, "TVD_EB_PHISH": {"wiki": true, "area": "meta", "score": 2.996, "desc": "__FROM_EBAY && NORMAL_HTTP_TO_IP"}, "MIME_SUSPECT_NAME": {"wiki": true, "area": "body", "score": 0.1, "desc": "MIME filename does not match content"}, "HTML_IMAGE_ONLY_28": {"wiki": true, "area": "body", "score": 2.799, "desc": "HTML: images with 2400-2800 bytes of words"}, "HELO_OEM": {"wiki": true, "area": "header", "score": 2.899, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=(?:pc| oem\\S*) /i"}, "SPF_HELO_PASS": {"wiki": true, "area": "header", "score": -0.001, "desc": "SPF: HELO matches SPF record"}, "FIN_FREE": {"wiki": true, "area": "body", "score": 2.7, "desc": "Freedom of a financial nature"}, "REPTO_OVERQUOTE_THEBAT": {"wiki": true, "area": "meta", "score": 3.499, "desc": "The Bat! doesn't do quoting like this"}, "MISSING_HEADERS": {"wiki": true, "area": "header", "score": 1.207, "desc": "Missing To: header"}, "FH_HAS_XID": {"wiki": true, "area": "header", "score": 3.299, "desc": "Has X-ID"}, "FB_NOT_SCHOOL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like school but it's not!"}, "USER_IN_DEF_DKIM_WL": {"wiki": true, "area": "header", "score": -7.5, "desc": "From: address is in the default DKIM white-list"}, "NO_HEADERS_MESSAGE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Message appears to be missing most RFC-822 headers"}, "NA_DOLLARS": {"wiki": true, "area": "body", "score": 3.599, "desc": "Talks about a million North American dollars"}, "RATWARE_MS_HASH": {"wiki": true, "area": "meta", "score": 2.779, "desc": "Bulk email fingerprint (msgid ms hash) found"}, "SUBJECT_SEXUAL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject indicates sexually-explicit content"}, "TVD_LINK_SAVE": {"wiki": true, "area": "body", "score": 1.0, "desc": "/\\blink to save\\b/i"}, "SHORT_TERM_PRICE": {"wiki": true, "area": "body", "score": 0.001, "desc": "/short\\W+term\\W+(target| projected)(\\W+price)?/i"}, "USER_IN_BLACKLIST_TO": {"wiki": true, "area": "header", "score": 10.0, "desc": "User is listed in 'blacklist_to'"}, "FU_MIDER": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URL has /gal/"}, "STOCK_PRICES": {"wiki": true, "area": "meta", "score": 0.184, "desc": "(SHORT_TERM_PRICE && LONG_TERM_PRICE)"}, "HTML_MIME_NO_HTML_TAG": {"wiki": true, "area": "meta", "score": 1.052, "desc": "HTML-only message, but there is no HTML tag"}, "MIME_HEADER_CTYPE_ONLY": {"wiki": true, "area": "meta", "score": 0.856, "desc": "'Content-Type' found without required MIME headers"}, "MISSING_DATE": {"wiki": true, "area": "header", "score": 0.001, "desc": "Missing Date: header"}, "OBFUSCATING_COMMENT": {"wiki": true, "area": "meta", "score": 0.23, "desc": "HTML comments which obfuscate text"}, "DC_IMAGE_SPAM_TEXT": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Possible Image-only spam with little text"}, "HS_GETMEOFF": {"wiki": true, "area": "uri", "score": 1.0, "desc": "Links to common unsubscribe script: 'getmeoff.php'"}, "FAKE_HELO_MAIL_COM": {"wiki": true, "area": "header", "score": 0.22, "desc": "Host HELO did not match rDNS: mail.com"}, "TVD_RATWARE_CB_2": {"wiki": true, "area": "header", "score": 1.0, "desc": "Content-Type =~ /\\bboundary\\s*=\\s*\"?-+\\d+=+\\.MRA/"}, "HELO_LH_LD": {"wiki": true, "area": "header", "score": 1.0, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=localhost\\.localdomain /i"}, "RCVD_IN_IADB_LOOSE": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Adds relationship addrs w/out opt-in"}, "FR_CANTSEETEXT": {"wiki": true, "area": "rawbody", "score": 1.0, "desc": "Phrase class=cantseetext"}, "CURR_PRICE": {"wiki": true, "area": "body", "score": 0.001, "desc": "/\\bCurrent Price:/"}, "DCC_REPUT_99_100": {"wiki": true, "area": "full", "score": 1.4, "desc": "DCC reputation between 99 % or higher (spam)"}, "BODY_ENHANCEMENT": {"wiki": true, "area": "body", "score": 1.611, "desc": "Information on growing body parts"}, "ADVANCE_FEE_3": {"wiki": true, "area": "meta", "score": 1.435, "desc": "Appears to be advance fee fraud (Nigerian 419)"}, "FRT_XANAX2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Xanax (2)"}, "FRT_XANAX1": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Xanax (1)"}, "FH_FROMEML_NOTLD": {"wiki": true, "area": "header", "score": 1.708, "desc": "E-mail address doesn't have TLD (.com, etc.)"}, "FUZZY_CREDIT": {"wiki": true, "area": "body", "score": 1.699, "desc": "Attempt to obfuscate words in spam"}, "ADVANCE_FEE_4": {"wiki": true, "area": "meta", "score": 1.502, "desc": "Appears to be advance fee fraud (Nigerian 419)"}, "FH_HELO_EQ_CHARTER": {"wiki": true, "area": "header", "score": 2.683, "desc": "Helo is d-d-d-d charter.com"}, "MALE_ENHANCE": {"wiki": true, "area": "body", "score": 3.1, "desc": "Message talks about enhancing men"}, "FORGED_MUA_MOZILLA": {"wiki": true, "area": "meta", "score": 2.696, "desc": "Forged mail pretending to be from Mozilla"}, "FH_HOST_EQ_PACBELL_D": {"wiki": true, "area": "header", "score": 1.703, "desc": "Host is pacbell.net dsl"}, "RATWARE_EGROUPS": {"wiki": true, "area": "header", "score": 1.898, "desc": "Bulk email fingerprint (eGroups) found"}, "NUMERIC_HTTP_ADDR": {"wiki": true, "area": "uri", "score": 1.242, "desc": "Uses a numeric IP address in URL"}, "FM_FAKE_53COM_SPOOF": {"wiki": true, "area": "meta", "score": 3.096, "desc": "Spoof mail from 53.com?"}, "FSL_FAKE_GMAIL_RCVD": {"wiki": true, "area": "header", "score": 3.099, "desc": "X-Spam-Relays-External =~ /gmail-smtp-in\\.l\\.google\\.com/"}, "SHORT_HELO_AND_INLINE_IMAGE": {"wiki": true, "area": "meta", "score": 0.702, "desc": "Short HELO string, with inline image"}, "TT_OBSCURED_VALIUM": {"wiki": true, "area": "meta", "score": 0.462, "desc": "Scora: obscured \"VALIUM\" in subject"}, "XMAILER_MIMEOLE_OL_5B79A": {"wiki": true, "area": "meta", "score": 1.453, "desc": "(__XM_OL_5B79A && __MO_OL_5B79A)"}, "DCC_CHECK": {"wiki": true, "area": "full", "score": 1.1, "desc": "Listed in DCC (http://rhyolite.com/anti-spam/dcc/)"}, "TVD_STOCK1": {"wiki": true, "area": "body", "score": 1.0, "desc": "eval:check_stock_info('2')"}, "FM_FAKE_HELO_VERIZON": {"wiki": true, "area": "meta", "score": 2.573, "desc": "Looks like a fake verizon.net helo."}, "HELO_DYNAMIC_DIALIN": {"wiki": true, "area": "header", "score": 3.233, "desc": "Relay HELO'd using suspicious hostname (T-Dialin)"}, "FRT_DISCOUNT": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Discount"}, "REPLICA_WATCH": {"wiki": true, "area": "body", "score": 4.074, "desc": "Message talks about a replica watch"}, "FROM_BLANK_NAME": {"wiki": true, "area": "header", "score": 2.099, "desc": "From: contains empty name"}, "FUZZY_OFFERS": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "SUBJ_YOUR_DEBT": {"wiki": true, "area": "header", "score": 3.299, "desc": "Subject contains \"Your Bills\" or similar"}, "SHORTCIRCUIT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Not all rules were run, due to a shortcircuited rule"}, "INVALID_DATE": {"wiki": true, "area": "header", "score": 1.701, "desc": "Invalid Date: header (not RFC 2822)"}, "HTML_BADTAG_40_50": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML message is 40% to 50% bad tags"}, "SANE_1c4f3286fa4aed6424ced88bfaf8b09c": {"wiki": true, "area": "body", "score": 3.199, "desc": "Email.Spam.Gen3234.Sanesecurity.08052309"}, "FM_RATSIGN_1106": {"wiki": true, "area": "meta", "score": 0.25, "desc": "Fingerprint seen in lots of spam. 11/2006"}, "TVD_FUZZY_FINANCE": {"wiki": true, "area": "body", "score": 1.0, "desc": "/(?!finance)<F><I><N><A><N><C><E>/i"}, "FM_SCHOOLING": {"wiki": true, "area": "meta", "score": 2.386, "desc": "Meta Combo Phrase for Schooling (2)"}, "MIME_QP_LONG_LINE": {"wiki": true, "area": "rawbody", "score": 0.001, "desc": "Quoted-printable line longer than 76 chars"}, "JOIN_MILLIONS": {"wiki": true, "area": "body", "score": 1.549, "desc": "Join Millions of Americans"}, "FB_MED1CAT": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: Med1cat"}, "FORGED_MSGID_AOL": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Message-ID is forged, (aol.com)"}, "AXB_XM_SENDMAIL_NOT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Nebbiolo fingerprint"}, "URI_NO_WWW_BIZ_CGI": {"wiki": true, "area": "uri", "score": 2.4, "desc": "CGI in .biz TLD other than third-level \"www\""}, "HIDE_WIN_STATUS": {"wiki": true, "area": "rawbody", "score": 1.38, "desc": "Javascript to hide URLs in browser"}, "FS_CHEAP_CAP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: Cheap in Caps in Subject."}, "URIBL_RHS_AHBL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Contains an URI listed in rhsbl.ahbl.org."}, "RCVD_IN_IADB_MI_CPEAR": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Complies with Michigan's CPEAR law"}, "HELO_DYNAMIC_IPADDR2": {"wiki": true, "area": "header", "score": 3.888, "desc": "Relay HELO'd using suspicious hostname (IP addr 2)"}, "FORWARD_LOOKING": {"wiki": true, "area": "body", "score": 1.0, "desc": "Stock Disclaimer Statement"}, "GTUBE": {"wiki": true, "area": "body", "score": 1000.0, "desc": "Generic Test for Unsolicited Bulk Email"}, "FRT_SOMA": {"wiki": true, "area": "body", "score": 3.28, "desc": "ReplaceTags: Soma"}, "HELO_LOCALHOST": {"wiki": true, "area": "header", "score": 3.828, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=localhost /i"}, "FORGED_MSGID_YAHOO": {"wiki": true, "area": "meta", "score": 3.211, "desc": "Message-ID is forged, (yahoo.com)"}, "KOREAN_UCE_SUBJECT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject: contains Korean unsolicited email tag"}, "FB_ANA_TRIM": {"wiki": true, "area": "body", "score": 1.0, "desc": "Broken AnaTrim phrase."}, "HTML_IMAGE_ONLY_16": {"wiki": true, "area": "body", "score": 1.969, "desc": "HTML: images with 1200-1600 bytes of words"}, "LONGWORDS": {"wiki": true, "area": "meta", "score": 3.196, "desc": "Long string of long words"}, "FS_OBFU_PRMCY": {"wiki": true, "area": "header", "score": 2.4, "desc": "what could this word be?"}, "FH_MSGID_01C67": {"wiki": true, "area": "header", "score": 1.0, "desc": "Special MSGID"}, "FRAGMENTED_MESSAGE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Partial message"}, "FUZZY_VIOXX": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "RATWARE_HASH_DASH": {"wiki": true, "area": "rawbody", "score": 1.0, "desc": "Contains a hashbuster in Send-Safe format"}, "FSL_HELO_DEVICE": {"wiki": true, "area": "header", "score": 1.682, "desc": "X-Spam-Relays-External =~ /\\bhelo=(?:(?:dsl)?device| speedtouch)\\.lan\\b/i"}, "RCVD_IN_IADB_EDDB": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Participates in Email Deliverability Database"}, "DKIM_VALID_AU": {"wiki": true, "area": "full", "score": -0.1, "desc": "Message has a valid DKIM or DK signature from author's domain"}, "DRUG_ED_SILD": {"wiki": true, "area": "body", "score": 1.794, "desc": "Talks about an E.D. drug using its chemical name"}, "wiki_url": "http://wiki.apache.org/spamassassin/Rules", "ANY_BOUNCE_MESSAGE": {"wiki": true, "area": "meta", "score": 0.1, "desc": "Message is some kind of bounce message"}, "FM_SEX_HELODDDD": {"wiki": true, "area": "meta", "score": 2.332, "desc": "Sex words + helo = dddd"}, "WHOIS_AITPRIV": {"wiki": true, "area": "body", "score": 3.995, "desc": "URL registered as an AIT Private Registration"}, "OUTLOOK_3416": {"wiki": true, "area": "header", "score": 1.695, "desc": "Claims to be sent by an unusual build of Outlook (3416)"}, "FORGED_IMS_TAGS": {"wiki": true, "area": "meta", "score": 1.579, "desc": "IMS mailers can't send HTML in this format"}, "LIVE_PORN": {"wiki": true, "area": "body", "score": 1.0, "desc": "Possible porn - Live Porn"}, "HTML_OBFUSCATE_05_10": {"wiki": true, "area": "body", "score": 0.718, "desc": "Message is 5% to 10% HTML obfuscation"}, "MIME_BOUND_DIGITS_15": {"wiki": true, "area": "header", "score": 1.241, "desc": "Spam tool pattern in MIME boundary"}, "URI_TRUNCATED": {"wiki": true, "area": "body", "score": 0.001, "desc": "Message contained a URI which was truncated"}, "XMAILER_MIMEOLE_OL_4B815": {"wiki": true, "area": "meta", "score": 0.407, "desc": "(__XM_OL_4B815 && __MO_OL_4B815)"}, "BLANK_LINES_80_90": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message body has 80-90% blank lines"}, "FU_HOODIA": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URL has hoodia in it."}, "XMAILER_MIMEOLE_OL_1ECD5": {"wiki": true, "area": "meta", "score": 2.796, "desc": "(__XM_OL_1ECD5 && __MO_OL_1ECD5)"}, "DYN_RDNS_SHORT_HELO_IMAGE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Short HELO string, dynamic rDNS, inline image"}, "XMAILER_MIMEOLE_OL_91287": {"wiki": true, "area": "meta", "score": 1.577, "desc": "(__XM_OL_91287 && __MO_OL_91287)"}, "HK_RANDOM_ENVFROM": {"wiki": true, "area": "header", "score": 2.638, "desc": "Envelope sender username looks random"}, "XMAILER_MIMEOLE_OL_C9068": {"wiki": true, "area": "meta", "score": 1.975, "desc": "(__XM_OL_C9068 && __MO_OL_C9068)"}, "FS_REPLICA": {"wiki": true, "area": "header", "score": 3.599, "desc": "Subject says \"replica\""}, "TVD_PH_SEC": {"wiki": true, "area": "body", "score": 1.764, "desc": "Message has a phrase standard for phishing mails"}, "TVD_APP_LOAN": {"wiki": true, "area": "body", "score": 1.0, "desc": "/approved .{0,20}loan/i"}, "FROM_LOCAL_DIGITS": {"wiki": true, "area": "header", "score": 0.001, "desc": "From: localpart has long digit sequence"}, "DEAR_WINNER": {"wiki": true, "area": "body", "score": 3.099, "desc": "/\\bdear.{1,20}winner/i"}, "HASHCASH_HIGH": {"wiki": true, "area": "header", "score": -5.0, "desc": "Contains valid Hashcash token (>25 bits)"}, "SUBJECT_FUZZY_VPILL": {"wiki": true, "area": "meta", "score": 3.299, "desc": "Attempt to obfuscate words in Subject:"}, "INVALID_DATE_TZ_ABSURD": {"wiki": true, "area": "header", "score": 0.706, "desc": "Invalid Date: header (timezone does not exist)"}, "HEAD_LONG": {"wiki": true, "area": "header", "score": 1.0, "desc": "Message headers are very long"}, "MISSING_MIMEOLE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Message has X-MSMail-Priority, but no X-MimeOLE"}, "FRT_INVESTOR": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Investor"}, "AXB_HELO_HOME_UN": {"wiki": true, "area": "header", "score": 1.0, "desc": "HELO from home - untrusted"}, "XMAILER_MIMEOLE_OL_812FF": {"wiki": true, "area": "meta", "score": 1.847, "desc": "(__XM_OL_812FF && __MO_OL_812FF)"}, "FS_NO_SCRIP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject almost says No prescription"}, "JM_TORA_XM": {"wiki": true, "area": "meta", "score": 3.096, "desc": "(__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO)"}, "FB_SAVE_PERSC": {"wiki": true, "area": "body", "score": 2.799, "desc": "Phrase: save ... prescription."}, "RCVD_IN_IADB_OPTIN_LT50": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Opt-in used less than 50% of the time"}, "CTYPE_001C_B": {"wiki": true, "area": "header", "score": 0.001, "desc": "Content-Type =~ /multipart.{0,200}boundary=\\\"----=_NextPart_000_0000_01C[0-9A-F]{5}\\.[0-9A-F]{7}0\\\"/"}, "FU_END_ET": {"wiki": true, "area": "uri", "score": 1.0, "desc": "ET Phone Home?"}, "RCVD_IN_IADB_UNVERIFIED_1": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Accepts unverified sign-ups"}, "HTML_EMBEDS": {"wiki": true, "area": "body", "score": 1.799, "desc": "HTML with embedded plugin object"}, "FUZZY_PRESCRIPT": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "XMAILER_MIMEOLE_OL_015D5": {"wiki": true, "area": "meta", "score": 0.907, "desc": "(__XM_OL_015D5 && __MO_OL_015D5)"}, "RCVD_IN_NJABL_RELAY": {"wiki": true, "area": "header", "score": 2.499, "desc": "NJABL: sender is confirmed open relay"}, "HTML_OBFUSCATE_50_60": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message is 50% to 60% HTML obfuscation"}, "FORGED_TELESP_RCVD": {"wiki": true, "area": "header", "score": 2.499, "desc": "Contains forged hostname for a DSL IP in Brazil"}, "DKIM_ADSP_ALL": {"wiki": true, "area": "header", "score": 1.1, "desc": "No valid author signature, domain signs all mail"}, "SPF_NEUTRAL": {"wiki": true, "area": "header", "score": 0.779, "desc": "SPF: sender does not match SPF record (neutral)"}, "INVALID_MSGID": {"wiki": true, "area": "meta", "score": 2.603, "desc": "Message-Id is not valid, according to RFC 2822"}, "CHARSET_FARAWAY": {"wiki": true, "area": "body", "score": 3.2, "desc": "Character set indicates a foreign language"}, "FB_NUMYO2": {"wiki": true, "area": "body", "score": 1.0, "desc": "Speaks of 20+ year old."}, "TVD_PP_PHISH": {"wiki": true, "area": "meta", "score": 3.099, "desc": "__FROM_PAYPAL && NORMAL_HTTP_TO_IP"}, "HELO_DYNAMIC_CHELLO_NL": {"wiki": true, "area": "header", "score": 2.428, "desc": "Relay HELO'd using suspicious hostname (Chello.nl)"}, "DNS_FROM_AHBL_RHSBL": {"wiki": true, "area": "header", "score": 2.699, "desc": "Envelope sender listed in dnsbl.ahbl.org"}, "STOCK_IMG_HTML": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Stock spam image part, with distinctive HTML"}, "TVD_RCVD_SINGLE": {"wiki": true, "area": "header", "score": 2.172, "desc": "Received =~ /^from\\s+(?!localhost)[^\\s.a-z0-9-]+\\s/"}, "PLING_QUERY": {"wiki": true, "area": "header", "score": 1.333, "desc": "Subject has exclamation mark and question mark"}, "RCVD_FORGED_WROTE2": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received =~ /from [0-9.]+ \\(HELO \\S+[A-Za-z]+\\) by (\\S+) with esmtp \\(\\S+\\s\\S+\\) id \\S{6}-\\S{6}-\\S\\S for \\S+@\\1;/s"}, "TVD_SPACED_SUBJECT_WORD3": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject =~ /^(?:(?:Re| Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+(dollar) /"}, "FREEMAIL_ENVFROM_END_DIGIT": {"wiki": true, "area": "header", "score": 2.602, "desc": "Envelope-from freemail username ends in digit"}, "DKIM_POLICY_SIGNSOME": {"wiki": true, "area": "header", "score": 1.0, "desc": "eval:check_dkim_signsome()"}, "FB_ROLLER_IS_T": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: Roller is th"}, "FRT_DOLLAR": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Dollar"}, "FRT_PENIS1": {"wiki": true, "area": "body", "score": 2.299, "desc": "ReplaceTags: Penis"}, "MSGID_FROM_MTA_HEADER": {"wiki": true, "area": "meta", "score": 1.495, "desc": "Message-Id was added by a relay"}, "EMPTY_MESSAGE": {"wiki": true, "area": "meta", "score": 0.607, "desc": "Message appears to have no textual parts and no Subject: text"}, "RCVD_IN_SORBS_ZOMBIE": {"wiki": true, "area": "header", "score": 1.0, "desc": "SORBS: sender is on a hijacked network"}, "FH_HELO_EQ_D_D_D_D": {"wiki": true, "area": "header", "score": 3.177, "desc": "Helo is d-d-d-d"}, "DRUGS_STOCK_MIMEOLE": {"wiki": true, "area": "meta", "score": 2.852, "desc": "Stock-spam forged headers found (5510)"}, "FORGED_MUA_THEBAT_CS": {"wiki": true, "area": "meta", "score": 0.854, "desc": "Mail pretending to be from The Bat! (charset)"}, "FH_HOST_EQ_DYNAMICIP": {"wiki": true, "area": "header", "score": 3.299, "desc": "Host is dynamicip"}, "JAPANESE_UCE_SUBJECT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject contains a Japanese UCE tag"}, "HTML_NONELEMENT_40_50": {"wiki": true, "area": "body", "score": 1.0, "desc": "40% to 50% of HTML elements are non-standard"}, "FS_PERSCRIPTION": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject mis-spelled prescription"}, "FUZZY_MERIDIA": {"wiki": true, "area": "body", "score": 1.0, "desc": "/<inter W3><post P2>\\b(?!meridia)<M><E><R><I><D><I><A>\\b/i"}, "DOS_ANAL_SPAM_MAILER": {"wiki": true, "area": "header", "score": 1.0, "desc": "X-mailer pattern common to anal porn site spam"}, "FRT_BIGGERMEM1": {"wiki": true, "area": "body", "score": 2.523, "desc": "ReplaceTags: Bigger / Larger, Penis / Member"}, "DRUG_ED_ONLINE": {"wiki": true, "area": "body", "score": 1.221, "desc": "Fast Viagra Delivery"}, "RCVD_IN_IADB_SENDERID": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Sender publishes Sender ID record"}, "RCVD_IN_IADB_DOPTIN": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: All mailing list mail is confirmed opt-in"}, "YAHOO_DRS_REDIR": {"wiki": true, "area": "uri", "score": 1.0, "desc": "Has Yahoo Redirect URI"}, "SPF_SOFTFAIL": {"wiki": true, "area": "header", "score": 0.972, "desc": "SPF: sender does not match SPF record (softfail)"}, "DRUG_DOSAGE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Talks about price per dose"}, "FB_SPACED_PHN_3B": {"wiki": true, "area": "body", "score": 0.001, "desc": "Phone number with -- spacing. (B)"}, "HTML_MESSAGE": {"wiki": true, "area": "body", "score": 0.001, "desc": "HTML included in message"}, "RCVD_IN_NJABL_MULTI": {"wiki": true, "area": "header", "score": 1.0, "desc": "NJABL: sent through multi-stage open relay"}, "FB_PENIS_GROWTH": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: penis growth"}, "BASE64_LENGTH_79_INF": {"wiki": true, "area": "body", "score": 2.019, "desc": "eval:check_base64_length('79')"}, "URIBL_RHS_DOB": {"wiki": true, "area": "body", "score": 1.514, "desc": "Contains an URI of a new domain (Day Old Bread)"}, "FS_NEW_XXX": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject looks like Fharmacy spams."}, "X_IP": {"wiki": true, "area": "header", "score": 0.001, "desc": "Message has X-IP header"}, "WHOIS_NETSOLPR": {"wiki": true, "area": "body", "score": 0.001, "desc": "URL registered as a NetSol Private Registration"}, "HELO_DYNAMIC_HOME_NL": {"wiki": true, "area": "header", "score": 2.385, "desc": "Relay HELO'd using suspicious hostname (Home.nl)"}, "WHOIS_SECUREWHOIS": {"wiki": true, "area": "body", "score": 2.696, "desc": "Contains URL registered to SecureWhois"}, "WHOIS_REGISTERFLY": {"wiki": true, "area": "body", "score": 3.196, "desc": "Contains URL registered to RegisterFly"}, "RCVD_ILLEGAL_IP": {"wiki": true, "area": "header", "score": 3.399, "desc": "Received: contains illegal IP address"}, "DRUGS_ANXIETY_OBFU": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Obfuscated reference to an anxiety control drug"}, "SANE_d0d2b0f6373bf91253d66dd74c594b87": {"wiki": true, "area": "body", "score": 3.799, "desc": "Email.Spam.Sanesecurity.Url_2499"}, "FB_BILLI0N": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: [BM]Illi0n"}, "DATE_IN_FUTURE_48_96": {"wiki": true, "area": "header", "score": 2.384, "desc": "Date: is 48 to 96 hours after Received: date"}, "FB_NOT_PHONE_NUM3": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like a fake phone number (3)"}, "TVD_PH_SUBJ_ACCOUNTS_POST": {"wiki": true, "area": "header", "score": 3.099, "desc": "Subject =~ /\\b(?:(?:re-?)?activat[a-z]*| secure| verify| restore| flagged| limited| unusual| update| report| notif(?:y| ication)| suspen(?:d| ded| sion)| co(?:n| m)firm[a-z]*) (?:[a-z_,-]+ )*?accounts?\\b/i"}, "FB_NOT_PHONE_NUM1": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like a fake phone number (1)"}, "FB_L0AN": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: L0an"}, "SPF_FAIL": {"wiki": true, "area": "header", "score": 0.919, "desc": "SPF: sender does not match SPF record (fail)"}, "MIME_BASE64_BLANKS": {"wiki": true, "area": "rawbody", "score": 0.001, "desc": "Extra blank lines in base64 encoding"}, "FORGED_MUA_EUDORA": {"wiki": true, "area": "meta", "score": 1.665, "desc": "Forged mail pretending to be from Eudora"}, "RATWARE_RCVD_PF": {"wiki": true, "area": "header", "score": 1.0, "desc": "Bulk email fingerprint (Received PF) found"}, "BOUNCE_MESSAGE": {"wiki": true, "area": "meta", "score": 0.1, "desc": "MTA bounce message"}, "FB_ANUI": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: A_U_N_I"}, "FSL_HELO_NON_FQDN_1": {"wiki": true, "area": "header", "score": 2.361, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=[a-zA-Z0-9-_]+ /i"}, "DYN_RDNS_SHORT_HELO_HTML": {"wiki": true, "area": "meta", "score": 0.287, "desc": "Sent by dynamic rDNS, short HELO, and HTML"}, "URG_BIZ": {"wiki": true, "area": "body", "score": 1.75, "desc": "Contains urgent matter"}, "SUBJECT_FUZZY_TION": {"wiki": true, "area": "header", "score": 1.0, "desc": "Attempt to obfuscate words in Subject:"}, "FH_FROM_HOODIA": {"wiki": true, "area": "header", "score": 1.0, "desc": "From has Hoodia!!?"}, "SPF_HELO_FAIL": {"wiki": true, "area": "header", "score": 0.001, "desc": "SPF: HELO does not match SPF record (fail)"}, "RCVD_IN_IADB_NOCONTROL": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Has absolutely no mailing controls in place"}, "CORRUPT_FROM_LINE_IN_HDRS": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Informational: message is corrupt, with a From line in its headers"}, "FB_DOUBLE_0WORDS": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like double 0 words"}, "NOT_ADVISOR": {"wiki": true, "area": "body", "score": 1.0, "desc": "Not registered investment advisor"}, "FB_ULTRA_ALLURE": {"wiki": true, "area": "body", "score": 2.352, "desc": "Phrase: Ultra Allure"}, "DCC_REPUT_00_12": {"wiki": true, "area": "full", "score": 0.0, "desc": "DCC reputation between 0 and 12 % (mostly ham)"}, "MIME_BASE64_TEXT": {"wiki": true, "area": "rawbody", "score": 1.741, "desc": "Message text disguised using base64 encoding"}, "AWL": {"wiki": true, "area": "header", "score": 1.0, "desc": "From: address is in the auto white-list"}, "TVD_PH_BODY_ACCOUNTS_PRE": {"wiki": true, "area": "body", "score": 2.393, "desc": "/\\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*| suspen[a-z]+| notif(?:y| ication)| updated| verifications?| credited)\\b/i"}, "LOTTERY_1": {"wiki": true, "area": "meta", "score": 3.196, "desc": "(__DBLCLAIM && __CASHPRZ)"}, "RCVD_IN_PBL": {"wiki": true, "area": "header", "score": 3.558, "desc": "Received via a relay in Spamhaus PBL"}, "FB_EXTRA_INCHES": {"wiki": true, "area": "body", "score": 2.603, "desc": "Phrase: extra inches"}, "XMAILER_MIMEOLE_OL_BC7E6": {"wiki": true, "area": "meta", "score": 3.695, "desc": "(__XM_OL_BC7E6 && __MO_OL_BC7E6)"}, "HEAD_ILLEGAL_CHARS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Headers have too many raw illegal characters"}, "MPART_ALT_DIFF": {"wiki": true, "area": "body", "score": 2.246, "desc": "HTML and text parts are different"}, "DIGEST_MULTIPLE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Message hits more than one network digest check"}, "SANE_3b92eda751c992f230f215fb7eb36844": {"wiki": true, "area": "body", "score": 3.04, "desc": "Email.Spam.Gen158.Sanesecurity.07012700"}, "FRT_OFFER2": {"wiki": true, "area": "body", "score": 2.048, "desc": "ReplaceTags: Offer (2)"}, "FB_HEY_BRO_COMMA": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase hey bro,"}, "RCVD_IN_IADB_SPF": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Sender publishes SPF record"}, "FORGED_MUA_IMS": {"wiki": true, "area": "meta", "score": 2.033, "desc": "Forged mail pretending to be from IMS"}, "FH_FROM_GIVEAWAY": {"wiki": true, "area": "header", "score": 2.599, "desc": "From name is giveaway."}, "KB_RATWARE_OUTLOOK_08": {"wiki": true, "area": "header", "score": 1.0, "desc": "ALL =~ /^Message-Id: <....([0-9a-f]{8})\\(dollar) [0-9a-f]{8}\\(dollar) .{100,400}boundary=\"----=_NextPart_000_...._\\1\\./msi"}, "FROM_NO_USER": {"wiki": true, "area": "header", "score": 2.599, "desc": "From: has no local-part before @ sign"}, "XMAILER_MIMEOLE_OL_4EEDB": {"wiki": true, "area": "meta", "score": 3.595, "desc": "(__XM_OL_4EEDB && __MO_OL_4EEDB)"}, "FREEMAIL_FROM": {"wiki": true, "area": "header", "score": 0.001, "desc": "Sender email is freemail"}, "DNS_FROM_RFC_BOGUSMX": {"wiki": true, "area": "header", "score": 1.668, "desc": "Envelope sender in bogusmx.rfc-ignorant.org"}, "AXB_XR_STULDAP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received =~ /\\(8\\.12\\.3 da nor stuldap\\/8\\.12\\.3\\)/"}, "HELO_DYNAMIC_DHCP": {"wiki": true, "area": "header", "score": 1.52, "desc": "Relay HELO'd using suspicious hostname (DHCP)"}, "EXTRA_MPART_TYPE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Header has extraneous Content-type:...type= entry"}, "VIA_GAP_GRA": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempts to disguise the word 'viagra'"}, "XMAILER_MIMEOLE_OL_25340": {"wiki": true, "area": "meta", "score": 3.513, "desc": "(__XM_OL_25340 && __MO_OL_25340)"}, "RDNS_DYNAMIC": {"wiki": true, "area": "meta", "score": 0.1, "desc": "Delivered to trusted network by host with dynamic-looking rDNS"}, "IP_LINK_PLUS": {"wiki": true, "area": "uri", "score": 0.246, "desc": "Dotted-decimal IP address followed by CGI"}, "MISSING_SUBJECT": {"wiki": true, "area": "meta", "score": 1.285, "desc": "Missing Subject: header"}, "HTTPS_IP_MISMATCH": {"wiki": true, "area": "body", "score": 1.0, "desc": "IP to HTTPS link found in HTML"}, "RCVD_AM_PM": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received headers forged (AM/PM)"}, "DYN_RDNS_AND_INLINE_IMAGE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Contains image, and was sent by dynamic rDNS"}, "FRT_OPPORTUN1": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Oppertun (1)"}, "RCVD_IN_SORBS_BLOCK": {"wiki": true, "area": "header", "score": 1.0, "desc": "SORBS: sender demands to never be tested"}, "FAKE_HELO_EXCITE": {"wiki": true, "area": "header", "score": 2.552, "desc": "Host HELO did not match rDNS: excite.com"}, "FR_MIDER": {"wiki": true, "area": "rawbody", "score": 1.0, "desc": "Sign often seen in spams"}, "XMAILER_MIMEOLE_OL_4BF4C": {"wiki": true, "area": "meta", "score": 0.438, "desc": "(__XM_OL_4BF4C && __MO_OL_4BF4C)"}, "HTML_IMAGE_ONLY_12": {"wiki": true, "area": "body", "score": 2.059, "desc": "HTML: images with 800-1200 bytes of words"}, "XMAILER_MIMEOLE_OL_A50F8": {"wiki": true, "area": "meta", "score": 3.399, "desc": "(__XM_OL_A50F8 && __MO_OL_A50F8)"}, "MSGID_SHORT": {"wiki": true, "area": "header", "score": 0.337, "desc": "Message-ID is unusually short"}, "HEADER_COUNT_SUBJECT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Multiple Subject headers found"}, "FB_PIPE_ILLION": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like illion, but it's not"}, "DCC_REPUT_90_94": {"wiki": true, "area": "full", "score": 0.6, "desc": "DCC reputation between 90 and 94 %"}, "HELO_DYNAMIC_HEXIP": {"wiki": true, "area": "header", "score": 2.321, "desc": "Relay HELO'd using suspicious hostname (Hex IP)"}, "TVD_FLOAT_GENERAL": {"wiki": true, "area": "rawbody", "score": 1.0, "desc": "/\\bstyle\\s*=\\s*\"[^\"]*\\bfloat\\s*:\\s*[a-z]+\\s*\">\\s*[a-zA-Z]+\\s*</i"}, "YAHOO_RD_REDIR": {"wiki": true, "area": "uri", "score": 1.0, "desc": "Has Yahoo Redirect URI"}, "FUZZY_OBLIGATION": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "CUM_SHOT": {"wiki": true, "area": "body", "score": 1.0, "desc": "Possible porn - Cum Shot"}, "BAD_ENC_HEADER": {"wiki": true, "area": "header", "score": 3.099, "desc": "Message has bad MIME encoding in the header"}, "HTML_CHARSET_FARAWAY": {"wiki": true, "area": "meta", "score": 0.5, "desc": "A foreign language charset used in HTML markup"}, "FSL_LSPACES_ABUSE": {"wiki": true, "area": "uri", "score": 1.0, "desc": "/cid\\-\\S+\\.spaces\\.live\\.com/"}, "FORGED_MUA_OUTLOOK": {"wiki": true, "area": "meta", "score": 4.199, "desc": "Forged mail pretending to be from MS Outlook"}, "BASE64_LENGTH_78_79": {"wiki": true, "area": "body", "score": 2.667, "desc": "eval:check_base64_length('78','79')"}, "DRUG_ED_GENERIC": {"wiki": true, "area": "body", "score": 1.0, "desc": "Mentions Generic Viagra"}, "FH_XMAIL_RND_833": {"wiki": true, "area": "header", "score": 1.0, "desc": "Special X-Mailer Version"}, "HK_SCAM_N2": {"wiki": true, "area": "body", "score": 1.0, "desc": "/\\bnext of kin\\b/i"}, "FB_ONIINE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Mis-spelled online"}, "HTML_NONELEMENT_80_90": {"wiki": true, "area": "body", "score": 1.0, "desc": "80% to 90% of HTML elements are non-standard"}, "DEAR_BENEFICIARY": {"wiki": true, "area": "body", "score": 1.0, "desc": "Dear Beneficiary:"}, "DATE_IN_PAST_12_24": {"wiki": true, "area": "header", "score": 1.19, "desc": "Date: is 12 to 24 hours before Received: date"}, "HTML_OBFUSCATE_30_40": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message is 30% to 40% HTML obfuscation"}, "EXCUSE_4": {"wiki": true, "area": "body", "score": 2.399, "desc": "Claims you can be removed from the list"}, "FS_TIP_DDD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: subject = tip ddd"}, "CTYPE_001C_A": {"wiki": true, "area": "meta", "score": 2.319, "desc": "(0)"}, "KB_RATWARE_OUTLOOK_12": {"wiki": true, "area": "header", "score": 1.0, "desc": "ALL =~ /^Message-Id: <....([0-9a-f]{8})\\(dollar) ([0-9a-f]{4})[0-9a-f]{4}\\(dollar) .{100,400}boundary=\"----=_NextPart_000_...._\\1\\.\\2/msi"}, "FB_SPACEY_ZIP": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like a s p a c e d zipcode."}, "FB_SSEX": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: ssex"}, "TVD_FUZZY_MICROCAP": {"wiki": true, "area": "body", "score": 1.0, "desc": "/<inter W2><post P2>(?!microcap)(?!micro-cap)<M><I><C><R><O>-?<C><A><P>/i"}, "RCVD_IN_IADB_ML_DOPTIN": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Mailing list email only, confirmed opt-in"}, "FB_NO_SCRIP_NEEDED": {"wiki": true, "area": "body", "score": 2.133, "desc": "Phrase: no prescription needed."}, "TVD_FUZZY_DEGREE": {"wiki": true, "area": "body", "score": 1.0, "desc": "/<inter W1><post P1>\\b(?!degree)<D><E><G><R><E><E>\\b/i"}, "FORGED_YAHOO_RCVD": {"wiki": true, "area": "header", "score": 2.599, "desc": "'From' yahoo.com does not match 'Received' headers"}, "FAKE_REPLY_C": {"wiki": true, "area": "meta", "score": 2.197, "desc": "(__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF)"}, "USER_IN_DEF_WHITELIST": {"wiki": true, "area": "header", "score": -15.0, "desc": "From: address is in the default white-list"}, "FAKE_HELO_LYCOS": {"wiki": true, "area": "header", "score": 2.432, "desc": "Host HELO did not match rDNS: lycos.com"}, "KB_RATWARE_OUTLOOK_MID": {"wiki": true, "area": "header", "score": 4.4, "desc": "ALL =~ /^Message-Id: <....([0-9a-f]{8})\\(dollar) ([0-9a-f]{8})\\(dollar) [0-9a-f]{8}\\@.{100,400}boundary=\"----=_NextPart_000_...._\\1\\.\\2\"/msi"}, "FRT_APPROV": {"wiki": true, "area": "body", "score": 2.499, "desc": "ReplaceTags: Approve"}, "MSGID_DOLLARS_RANDOM": {"wiki": true, "area": "meta", "score": 3.296, "desc": "__MSGID_DOLLARS_MAYBE && !__MSGID_DOLLARS_OK"}, "ACT_NOW_CAPS": {"wiki": true, "area": "body", "score": 2.399, "desc": "Talks about 'acting now' with capitals"}, "FB_SPUR_M": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: SPUR-M"}, "RCVD_MAIL_COM": {"wiki": true, "area": "header", "score": 1.0, "desc": "Forged Received header (contains post.com or mail.com)"}, "RCVD_IN_IADB_UT_CPR_MAT": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Sends no material under Utah's CPR"}, "SUBJECT_FUZZY_CHEAP": {"wiki": true, "area": "header", "score": 1.831, "desc": "Attempt to obfuscate words in Subject:"}, "HS_SUBJ_ONLINE_PHARMACEUTICAL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject contains the phrase 'Online pharmaceutical'"}, "HK_NAME_DRUGS": {"wiki": true, "area": "header", "score": 4.299, "desc": "From name contains drugs"}, "FUZZY_REMOVE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "X_MAILER_CME_6543_MSN": {"wiki": true, "area": "header", "score": 3.348, "desc": "X-Mailer =~ /^CME-V6\\.5\\.4\\.3; MSN\\s*(dollar) /"}, "RCVD_IN_IADB_EPIA": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Member of Email Processing Industry Alliance"}, "FB_WORD1_END_DOLLAR": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like a word ending with a $"}, "FB_TO_STOP_DISTRO": {"wiki": true, "area": "body", "score": 3.399, "desc": "Phrase: to stop further distribution"}, "MSGID_OUTLOOK_INVALID": {"wiki": true, "area": "header", "score": 3.899, "desc": "Message-Id is fake (in Outlook Express format)"}, "RDNS_NONE": {"wiki": true, "area": "meta", "score": 0.1, "desc": "Delivered to trusted network by a host with no rDNS"}, "USER_IN_MORE_SPAM_TO": {"wiki": true, "area": "header", "score": -20.0, "desc": "User is listed in 'more_spam_to'"}, "BAYES_05": {"wiki": true, "area": "body", "score": 0.0, "desc": "Bayes spam probability is 1 to 5%"}, "RCVD_IN_IADB_VOUCHED": {"wiki": true, "area": "header", "score": 0.0, "desc": "ISIPP IADB lists as vouched-for sender"}, "MARKETING_PARTNERS": {"wiki": true, "area": "body", "score": 0.689, "desc": "Claims you registered with a partner"}, "FH_HOST_IN_ADDRARPA": {"wiki": true, "area": "header", "score": 3.199, "desc": "HOST dns says \"in-addr.arpa\""}, "HTML_IFRAME_SRC": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message has HTML IFRAME tag with SRC URI"}, "EXCUSE_24": {"wiki": true, "area": "body", "score": 2.799, "desc": "Claims you wanted this ad"}, "TVD_SILLY_URI_OBFU": {"wiki": true, "area": "body", "score": 1.0, "desc": "m!https?://[a-z0-9-]+\\.[a-z0-9-]*\\.?[^a-z0-9.:/\\s\"'\\@?\\)>-]+[a-z0-9.-]*[a-z]{3}(?:\\s| (dollar) )!i"}, "SPOOF_COM2COM": {"wiki": true, "area": "uri", "score": 2.048, "desc": "URI contains \".com\" in middle and end"}, "SANE_4ef8302546bf270a19baf98508afacc4": {"wiki": true, "area": "body", "score": 3.543, "desc": "Email.Spam.Gen1941.Sanesecurity.07112519"}, "FM_VIAGRA_SPAM1114": {"wiki": true, "area": "meta", "score": 2.191, "desc": "Signs of a Viagra spam 11/14/2006"}, "PYZOR_CHECK": {"wiki": true, "area": "full", "score": 1.985, "desc": "Listed in Pyzor (http://pyzor.sf.net/)"}, "FRT_MEETING": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Meeting"}, "HS_DRUG_DOLLAR_2": {"wiki": true, "area": "body", "score": 0.001, "desc": "Contains a drug and price-like pattern."}, "HS_DRUG_DOLLAR_3": {"wiki": true, "area": "body", "score": 0.001, "desc": "Contains a drug and price-like pattern."}, "STOX_AND_PRICE": {"wiki": true, "area": "meta", "score": 2.373, "desc": "CURR_PRICE && STOX_REPLY_TYPE"}, "NO_RDNS_DOTCOM_HELO": {"wiki": true, "area": "header", "score": 3.1, "desc": "Host HELO'd as a big ISP, but had no rDNS"}, "FH_XMAIL_REPLACE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Broken Replace Template"}, "DNS_FROM_RFC_DSN": {"wiki": true, "area": "header", "score": 0.001, "desc": "Envelope sender in dsn.rfc-ignorant.org"}, "HS_BODY_UPLOADED_SOFTWARE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Somebody has uploaded some new software for you"}, "FS_ABIGGER": {"wiki": true, "area": "header", "score": 2.477, "desc": "Subject has \"a bigger\""}, "FUZZY_AFFORDABLE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "RCVD_IN_SORBS_SOCKS": {"wiki": true, "area": "header", "score": 2.443, "desc": "SORBS: sender is open SOCKS proxy server"}, "FILL_THIS_FORM_LONG": {"wiki": true, "area": "body", "score": 3.8, "desc": "Fill in a form with personal information"}, "FH_HAS_XAIMC": {"wiki": true, "area": "header", "score": 1.899, "desc": "Has X-AIMC-AUTH header"}, "USER_IN_DKIM_WHITELIST": {"wiki": true, "area": "header", "score": -100.0, "desc": "From: address is in the user's DKIM whitelist"}, "FB_GET_MEDS": {"wiki": true, "area": "body", "score": 2.314, "desc": "Looks like trying to sell meds"}, "FB_CAN_LONGER": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: can last longer"}, "UNRESOLVED_TEMPLATE": {"wiki": true, "area": "header", "score": 3.035, "desc": "Headers contain an unresolved template"}, "RCVD_IN_SBL": {"wiki": true, "area": "header", "score": 2.596, "desc": "Received via a relay in Spamhaus SBL"}, "TVD_FUZZY_SYMBOL": {"wiki": true, "area": "body", "score": 1.0, "desc": "/<inter W2><post P2>(?!symbol)<S><Y><M><B><O><L>/i"}, "WHOIS_PRIVACYPOST": {"wiki": true, "area": "body", "score": 0.647, "desc": "Contains URL registered to PrivacyPost"}, "MORE_SEX": {"wiki": true, "area": "body", "score": 2.799, "desc": "Talks about a bigger drive for sex"}, "FB_LOWER_PAYM": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: lower your monthly payments"}, "ROUND_THE_WORLD_LOCAL": {"wiki": true, "area": "header", "score": 2.696, "desc": "Received: says mail sent around the world (HELO)"}, "FM_SCHOOL_TYPES": {"wiki": true, "area": "meta", "score": 3.096, "desc": "Meta Combo Phrase for Schooling"}, "FM_XMAIL_F_OUT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Looks like Fake Outlook?"}, "RCVD_IN_NJABL_CGI": {"wiki": true, "area": "header", "score": 1.0, "desc": "NJABL: sender is an open formmail"}, "TAB_IN_FROM": {"wiki": true, "area": "header", "score": 1.0, "desc": "From starts with a tab"}, "RATWARE_GECKO_BUILD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Bulk email fingerprint (Gecko faked) found"}, "X_MESSAGE_INFO": {"wiki": true, "area": "header", "score": 1.0, "desc": "Bulk email fingerprint (X-Message-Info) found"}, "HTTP_ESCAPED_HOST": {"wiki": true, "area": "uri", "score": 1.621, "desc": "Uses %-escapes inside a URL's hostname"}, "HTML_SHORT_CENTER": {"wiki": true, "area": "meta", "score": 0.001, "desc": "HTML is very short with CENTER tag"}, "BANG_GUAR": {"wiki": true, "area": "body", "score": 2.704, "desc": "Something is emphatically guaranteed"}, "RCVD_IN_MAPS_OPS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Relay in OPS, http://www.mail-abuse.com/enduserinfo_ops.html"}, "FS_LOW_RATES": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject says low rates"}, "NO_MEDICAL": {"wiki": true, "area": "body", "score": 2.199, "desc": "No Medical Exams"}, "RCVD_IN_IADB_OPTIN_GT50": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Opt-in used more than 50% of the time"}, "FROM_EXCESS_BASE64": {"wiki": true, "area": "meta", "score": 1.984, "desc": "From: base64 encoded unnecessarily"}, "DATE_IN_PAST_24_48": {"wiki": true, "area": "header", "score": 1.34, "desc": "Date: is 24 to 48 hours before Received: date"}, "HK_NAME_FREE": {"wiki": true, "area": "header", "score": 1.0, "desc": "From name mentions free stuff"}, "GAPPY_SUBJECT": {"wiki": true, "area": "header", "score": 2.001, "desc": "Subject: contains G.a.p.p.y-T.e.x.t"}, "HS_VPXL": {"wiki": true, "area": "body", "score": 3.211, "desc": "Contains VPXL, yet the recommended dose is only 2 tablets."}, "FUZZY_PHENT": {"wiki": true, "area": "body", "score": 2.799, "desc": "Attempt to obfuscate words in spam"}, "SPOOF_NET2COM": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URI contains \".net\" or \".org\", then \".com\""}, "HTML_FONT_SIZE_HUGE": {"wiki": true, "area": "body", "score": 0.001, "desc": "HTML font size is huge"}, "FH_HOST_EQ_VERIZON_P": {"wiki": true, "area": "header", "score": 3.671, "desc": "Host is pool-.+verizon.net"}, "RCVD_IN_IADB_UT_CPR_30": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Checked lists against Utah's CPR within 30 days"}, "HTML_IMAGE_RATIO_02": {"wiki": true, "area": "body", "score": 2.199, "desc": "HTML has a low ratio of text to image area"}, "XMAILER_MIMEOLE_OL_FF5C8": {"wiki": true, "area": "meta", "score": 3.091, "desc": "(__XM_OL_FF5C8 && __MO_OL_FF5C8)"}, "FS_START_LOSE": {"wiki": true, "area": "header", "score": 1.809, "desc": "Subject starts with Lose"}, "FH_HELO_EQ_610HEX": {"wiki": true, "area": "header", "score": 1.0, "desc": "Helo is 6-10 hex chr's."}, "HTML_IMAGE_RATIO_04": {"wiki": true, "area": "body", "score": 2.089, "desc": "HTML has a low ratio of text to image area"}, "HTML_IMAGE_RATIO_08": {"wiki": true, "area": "body", "score": 0.001, "desc": "HTML has a low ratio of text to image area"}, "RCVD_FAKE_HELO_DOTCOM": {"wiki": true, "area": "header", "score": 2.799, "desc": "Received contains a faked HELO hostname"}, "URIBL_OB_SURBL": {"wiki": true, "area": "body", "score": 0.785, "desc": "Contains an URL listed in the OB SURBL blocklist"}, "BAYES_95": {"wiki": true, "area": "body", "score": 3.2, "desc": "Bayes spam probability is 95 to 99%"}, "DATE_IN_FUTURE_24_48": {"wiki": true, "area": "header", "score": 2.598, "desc": "Date: is 24 to 48 hours after Received: date"}, "FRT_SYMBOL": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Symbol"}, "RATWARE_RCVD_AT": {"wiki": true, "area": "header", "score": 1.0, "desc": "Bulk email fingerprint (Received @) found"}, "BAYES_99": {"wiki": true, "area": "body", "score": 3.8, "desc": "Bayes spam probability is 99 to 100%"}, "TVD_SPACE_RATIO": {"wiki": true, "area": "body", "score": 2.899, "desc": "eval:tvd_vertical_words('0','10')"}, "HTML_COMMENT_SHORT": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML comment is very short"}, "MILLION_USD": {"wiki": true, "area": "body", "score": 3.799, "desc": "Talks about millions of dollars"}, "EXCUSE_REMOVE": {"wiki": true, "area": "body", "score": 3.299, "desc": "Talks about how to be removed from mailings"}, "TVD_VIS_HIDDEN": {"wiki": true, "area": "rawbody", "score": 1.0, "desc": "/<TEXTAREA[^>]+style\\s*=\\s*\"visibility:\\s*hidden\\b/i"}, "FRT_SEXUAL": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Sexual"}, "URI_NOVOWEL": {"wiki": true, "area": "uri", "score": 0.5, "desc": "URI hostname has long non-vowel sequence"}, "HELO_DYNAMIC_IPADDR": {"wiki": true, "area": "header", "score": 2.935, "desc": "Relay HELO'd using suspicious hostname (IP addr 1)"}, "HDRS_MISSP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Misspaced headers"}, "FUZZY_ERECT": {"wiki": true, "area": "body", "score": 2.36, "desc": "Attempt to obfuscate words in spam"}, "FUZZY_GUARANTEE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "URIBL_JP_SURBL": {"wiki": true, "area": "body", "score": 1.948, "desc": "Contains an URL listed in the JP SURBL blocklist"}, "RAZOR2_CHECK": {"wiki": true, "area": "full", "score": 1.729, "desc": "Listed in Razor2 (http://razor.sf.net/)"}, "BAYES_60": {"wiki": true, "area": "body", "score": 2.5, "desc": "Bayes spam probability is 60 to 80%"}, "FUZZY_MONEY": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "FB_HG_H_CAP": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: HGH"}, "FS_AT_NO_COST": {"wiki": true, "area": "header", "score": 2.499, "desc": "Subject says \"At No Cost\""}, "FH_HELO_GMAILSMTP": {"wiki": true, "area": "header", "score": 1.0, "desc": "Faked helo of gmail-smtp-in"}, "LOOPHOLE_1": {"wiki": true, "area": "body", "score": 1.0, "desc": "A loop hole in the banking laws?"}, "FORGED_RELAY_MUA_TO_MX": {"wiki": true, "area": "header", "score": 1.0, "desc": "X-Spam-Relays-External =~ /^\\[ ip=(?!127)([\\d.]+) [^\\[]*\\[ ip=\\1 [^\\[]+ helo=(!(?!(?:10| 127| 169\\.254| 172\\.(?:1[6-9]| 2[0-9]| 3[01])| 192\\.168)\\.)| )[^\\[]+(dollar) /"}, "MICROSOFT_EXECUTABLE": {"wiki": true, "area": "body", "score": 0.1, "desc": "Message includes Microsoft executable program"}, "BODY_ENHANCEMENT2": {"wiki": true, "area": "body", "score": 1.865, "desc": "Information on getting larger body parts"}, "WEIRD_QUOTING": {"wiki": true, "area": "body", "score": 0.001, "desc": "Weird repeated double-quotation marks"}, "TVD_PH_SUBJ_META": {"wiki": true, "area": "meta", "score": 1.0, "desc": "__TVD_PH_SUBJ_00 || __TVD_PH_SUBJ_02 || __TVD_PH_SUBJ_04 || __TVD_PH_SUBJ_15 || __TVD_PH_SUBJ_17 || __TVD_PH_SUBJ_18 || __TVD_PH_SUBJ_19 || __TVD_PH_SUBJ_29 || __TVD_PH_SUBJ_31 || __TVD_PH_SUBJ_36 || __TVD_PH_SUBJ_37 || __TVD_PH_SUBJ_38 || __TVD_PH_SUBJ_39 || __TVD_PH_SUBJ_41 || __TVD_PH_SUBJ_52 || __TVD_PH_SUBJ_54 || __TVD_PH_SUBJ_56 || __TVD_PH_SUBJ_58 || __TVD_PH_SUBJ_59 || __TVD_PH_SUBJ_ACCESS_POST"}, "XMAILER_MIMEOLE_OL_B4B40": {"wiki": true, "area": "meta", "score": 1.765, "desc": "(__XM_OL_B4B40 && __MO_OL_B4B40)"}, "RCVD_IN_IADB_RDNS": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Sender has reverse DNS record"}, "SPAMMY_XMAILER": {"wiki": true, "area": "meta", "score": 2.333, "desc": "X-Mailer string is common in spam and not in ham"}, "GEO_QUERY_STRING": {"wiki": true, "area": "uri", "score": 1.0, "desc": "/^http:\\/\\/(?:\\w{2,4}\\.)?geocities\\.com(?::\\d*)?\\/.+?\\/\\?/i"}, "HTML_OBFUSCATE_90_100": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message is 90% to 100% HTML obfuscation"}, "SUBJECT_IN_WHITELIST": {"wiki": true, "area": "header", "score": -100.0, "desc": "Subject: contains string in the user's white-list"}, "FRT_ROLEX": {"wiki": true, "area": "body", "score": 2.699, "desc": "ReplaceTags: Rolex"}, "REPTO_QUOTE_QUALCOMM": {"wiki": true, "area": "meta", "score": 0.415, "desc": "Qualcomm/Eudora doesn't do quoting like this"}, "HTML_OBFUSCATE_70_80": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message is 70% to 80% HTML obfuscation"}, "TVD_PH_SUBJ_SEC_MEASURES": {"wiki": true, "area": "header", "score": 2.284, "desc": "Subject =~ /\\bsecurity (?:[a-z_,-]+ )*?measures?\\b/i"}, "XMAILER_MIMEOLE_OL_EF20B": {"wiki": true, "area": "meta", "score": 1.048, "desc": "(__XM_OL_EF20B && __MO_OL_EF20B)"}, "RCVD_IN_PSBL": {"wiki": true, "area": "header", "score": 2.7, "desc": "Received via a relay in PSBL"}, "FRT_DIPLOMA": {"wiki": true, "area": "body", "score": 1.599, "desc": "ReplaceTags: Diploma"}, "TVD_FINGER_02": {"wiki": true, "area": "header", "score": 1.544, "desc": "Content-Type =~ /^text\\/plain(?:; (?:format=flowed| charset=\"Windows-1252\"| reply-type=original)){3}/i"}, "INVALID_TZ_CST": {"wiki": true, "area": "header", "score": 1.0, "desc": "Invalid date in header (wrong CST timezone)"}, "HELO_DYNAMIC_HCC": {"wiki": true, "area": "header", "score": 4.295, "desc": "Relay HELO'd using suspicious hostname (HCC)"}, "THEBAT_UNREG": {"wiki": true, "area": "header", "score": 2.599, "desc": "X-Mailer =~ /^The Bat! .{0,20} UNREG(dollar) /"}, "REFINANCE_YOUR_HOME": {"wiki": true, "area": "body", "score": 1.0, "desc": "Home refinancing"}, "CRBOUNCE_MESSAGE": {"wiki": true, "area": "meta", "score": 0.1, "desc": "Challenge-response bounce message"}, "FRT_REFINANCE1": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Refinance (1)"}, "DEAR_SOMETHING": {"wiki": true, "area": "body", "score": 1.999, "desc": "Contains 'Dear (something)'"}, "RCVD_DOUBLE_IP_LOOSE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Received: by and from look like IP addresses"}, "SUBJ_RE_NUM": {"wiki": true, "area": "meta", "score": 2.667, "desc": "Subject is faking 'The Bat!' responses"}, "LOW_PRICE": {"wiki": true, "area": "body", "score": 1.464, "desc": "Lowest Price"}, "FUZZY_XPILL": {"wiki": true, "area": "body", "score": 2.799, "desc": "Attempt to obfuscate words in spam"}, "AXB_XMID_OEGOESNULL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Amarone Fingerprint"}, "RATWARE_MPOP_WEBMAIL": {"wiki": true, "area": "header", "score": 1.999, "desc": "Bulk email fingerprint (mPOP Web-Mail)"}, "XMAILER_MIMEOLE_OL_72641": {"wiki": true, "area": "meta", "score": 0.746, "desc": "(__XM_OL_72641 && __MO_OL_72641)"}, "FRT_STRONG1": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Strong (1)"}, "RCVD_IN_DNSWL_NONE": {"wiki": true, "area": "header", "score": 0.0, "desc": "Sender listed at http://www.dnswl.org/, low trust"}, "FB_LETTERS_21B": {"wiki": true, "area": "body", "score": 1.0, "desc": "Special people leave special signs!"}, "FRT_STRONG2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Strong (2)"}, "DRUGS_DIET": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Refers to a diet drug"}, "FUZZY_MEDICATION": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "FH_FAKE_RCVD_LINE_B": {"wiki": true, "area": "header", "score": 4.0, "desc": "RCVD line looks faked (B)"}, "X_PRIORITY_CC": {"wiki": true, "area": "header", "score": 1.0, "desc": "Cc: after X-Priority: (bulk email fingerprint)"}, "MIME_BAD_ISO_CHARSET": {"wiki": true, "area": "body", "score": 1.0, "desc": "MIME character set is an unknown ISO charset"}, "MSGID_MULTIPLE_AT": {"wiki": true, "area": "header", "score": 0.001, "desc": "Message-ID contains multiple '@' characters"}, "GUARANTEED_100_PERCENT": {"wiki": true, "area": "body", "score": 2.699, "desc": "One hundred percent guaranteed"}, "FB_REF_CODE_SPACE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Refcode with spacing"}, "DKIM_ADSP_CUSTOM_HIGH": {"wiki": true, "area": "header", "score": 0.001, "desc": "No valid author signature, adsp_override is CUSTOM_HIGH"}, "FAKE_HELO_MAIL_COM_DOM": {"wiki": true, "area": "header", "score": 2.136, "desc": "Relay HELO'd with suspicious hostname (mail.com)"}, "AXB_XMID_1212": {"wiki": true, "area": "header", "score": 1.0, "desc": "Barbera Fingerprint"}, "SPOOF_COM2OTH": {"wiki": true, "area": "uri", "score": 2.999, "desc": "URI contains \".com\" in middle"}, "WHOIS_MYPRIVREG": {"wiki": true, "area": "body", "score": 0.156, "desc": "URL registered to myprivateregistration.com"}, "DOS_STOCK_CDYV_GENERIC": {"wiki": true, "area": "body", "score": 1.0, "desc": "Pump and dump stock spam"}, "HTML_FONT_FACE_BAD": {"wiki": true, "area": "body", "score": 0.981, "desc": "HTML font face is not a word"}, "FUZZY_VLIUM": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "TVD_ACT_193": {"wiki": true, "area": "body", "score": 1.0, "desc": "/\\bact of (?:193| nineteen thirty)/i"}, "FH_MSGID_XXX": {"wiki": true, "area": "header", "score": 2.399, "desc": "Message-Id = @xxx"}, "FB_FORWARD_LOOK": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: forward look with 0's"}, "FB_PIPEDOLLAR": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: Dollar, with pipes or 0's."}, "FROM_DOMAIN_NOVOWEL": {"wiki": true, "area": "header", "score": 0.5, "desc": "From: domain has series of non-vowel letters"}, "FSL_YG_ABUSE": {"wiki": true, "area": "uri", "score": 4.199, "desc": "/\\/groups\\.yahoo\\.com\\/group\\/\\S+\\/message\\/1(dollar) /"}, "FRT_PRICE": {"wiki": true, "area": "body", "score": 0.001, "desc": "ReplaceTags: Price"}, "FS_REPLICAWATCH": {"wiki": true, "area": "header", "score": 3.237, "desc": "Subject says Replica watch"}, "HDR_ORDER_FTSDMCXX_BAT": {"wiki": true, "area": "meta", "score": 2.739, "desc": "Header order similar to spam (FTSDMCXX/boundary variant)"}, "RCVD_IN_RP_SAFE": {"wiki": true, "area": "header", "score": 0.0, "desc": "Sender is in Return Path Safe (trusted relay)"}, "RCVD_IN_MAPS_NML": {"wiki": true, "area": "header", "score": 1.0, "desc": "Relay in NML, http://www.mail-abuse.com/enduserinfo_nml.html"}, "URIBL_GREY": {"wiki": true, "area": "body", "score": 1.084, "desc": "Contains an URL listed in the URIBL greylist"}, "SB_GIF_AND_NO_URIS": {"wiki": true, "area": "meta", "score": 1.257, "desc": "(__GIF_ATTACH&&!__HAS_ANY_URI& &!__HAS_ANY_EMAIL)"}, "SUBJECT_NEEDS_ENCODING": {"wiki": true, "area": "meta", "score": 1.277, "desc": "(!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME"}, "FS_START_DOYOU2": {"wiki": true, "area": "header", "score": 2.8, "desc": "Subject starts with Do you dream,have,want,love, etc."}, "IMPOTENCE": {"wiki": true, "area": "body", "score": 3.028, "desc": "Impotence cure"}, "TVD_SUBJ_WIPE_DEBT": {"wiki": true, "area": "header", "score": 2.599, "desc": "Subject =~ /(?:wipe out| remove| get (?:rid| out) of| eradicate) .{0,20}(?:owe| debt| obligation)/i"}, "XMAILER_MIMEOLE_OL_3AC1D": {"wiki": true, "area": "meta", "score": 1.323, "desc": "(__XM_OL_3AC1D && __MO_OL_3AC1D)"}, "RCVD_IN_IADB_OPTIN": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: All mailing list mail is opt-in"}, "SANE_7429530a7398f43f1f1b795f9420714e": {"wiki": true, "area": "body", "score": 3.999, "desc": "Email.Spam.Gen2507.Sanesecurity.08021303"}, "FUZZY_AMBIEN": {"wiki": true, "area": "body", "score": 2.199, "desc": "Attempt to obfuscate words in spam"}, "DRUGS_ERECTILE_OBFU": {"wiki": true, "area": "meta", "score": 2.113, "desc": "Obfuscated reference to an erectile drug"}, "URIBL_AB_SURBL": {"wiki": true, "area": "body", "score": 4.499, "desc": "Contains an URL listed in the AB SURBL blocklist"}, "MIME_BOUND_MANY_HEX": {"wiki": true, "area": "header", "score": 1.0, "desc": "Spam tool pattern in MIME boundary"}, "FB_NUMYO": {"wiki": true, "area": "body", "score": 1.0, "desc": "Speaks of teenager."}, "RCVD_IN_NJABL_PROXY": {"wiki": true, "area": "header", "score": 2.224, "desc": "NJABL: sender is an open proxy"}, "DIET_1": {"wiki": true, "area": "body", "score": 0.714, "desc": "Lose Weight Spam"}, "MSGID_SPAM_LETTERS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Spam tool Message-Id: (letters variant)"}, "DATE_IN_FUTURE_03_06": {"wiki": true, "area": "header", "score": 3.399, "desc": "Date: is 3 to 6 hours after Received: date"}, "HTTP_EXCESSIVE_ESCAPES": {"wiki": true, "area": "uri", "score": 1.572, "desc": "Completely unnecessary %-escapes inside a URL"}, "FS_NEW_SOFT_UPLOAD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subj starts with New software uploaded"}, "HTML_TAG_BALANCE_BODY": {"wiki": true, "area": "body", "score": 1.247, "desc": "HTML has unbalanced \"body\" tags"}, "LOCALPART_IN_SUBJECT": {"wiki": true, "area": "header", "score": 1.199, "desc": "Local part of To: address appears in Subject"}, "DOS_YOUR_PLACE": {"wiki": true, "area": "meta", "score": 2.596, "desc": "Russian dating spam"}, "HIGH_CODEPAGE_URI": {"wiki": true, "area": "uri", "score": 1.0, "desc": "/^https?:\\/\\/[^\\/]*\\&\\#(?:\\d{4,}| [3456789]\\d\\d);/i"}, "FRT_FUCK2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Fuck (2)"}, "FUZZY_MORTGAGE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "FUZZY_VPILL": {"wiki": true, "area": "body", "score": 1.014, "desc": "Attempt to obfuscate words in spam"}, "ONE_TIME": {"wiki": true, "area": "body", "score": 1.84, "desc": "One Time Rip Off"}, "FB_YOUR_REFI": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: Your refi"}, "HS_DRUG_DOLLAR_1": {"wiki": true, "area": "body", "score": 0.001, "desc": "Contains a drug and price-like pattern."}, "HTML_TAG_BALANCE_HEAD": {"wiki": true, "area": "body", "score": 0.817, "desc": "HTML has unbalanced \"head\" tags"}, "HTML_EXTRA_CLOSE": {"wiki": true, "area": "body", "score": 0.001, "desc": "HTML contains far too many close tags"}, "RCVD_IN_IADB_LISTED": {"wiki": true, "area": "header", "score": 0.0, "desc": "Participates in the IADB system"}, "FS_RAMROD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject says Ramrod"}, "RCVD_IN_DSBL": {"wiki": true, "area": "header", "score": 0.753, "desc": "Received via a relay in list.dsbl.org"}, "HELO_DYNAMIC_ROGERS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Relay HELO'd using suspicious hostname (Rogers)"}, "BAYES_20": {"wiki": true, "area": "body", "score": 0.0, "desc": "Bayes spam probability is 5 to 20%"}, "TRACKER_ID": {"wiki": true, "area": "body", "score": 2.026, "desc": "Incorporates a tracking ID number"}, "HS_DRUG_DOLLAR_MANY": {"wiki": true, "area": "meta", "score": 0.688, "desc": "Contains several drug and dollar-like patterns."}, "LOTTO_AGENT": {"wiki": true, "area": "body", "score": 1.0, "desc": "Claims Agent"}, "RCVD_IN_DNSWL_MED": {"wiki": true, "area": "header", "score": 0.0, "desc": "Sender listed at http://www.dnswl.org/, medium trust"}, "FM_PHN_NODNS": {"wiki": true, "area": "meta", "score": 2.538, "desc": "Phone spacing + no dns"}, "DATE_IN_FUTURE_96_XX": {"wiki": true, "area": "header", "score": 3.087, "desc": "Date: is 96 hours or more after Received: date"}, "DC_GIF_UNO_LARGO": {"wiki": true, "area": "meta", "score": 3.787, "desc": "Message contains a single large inline gif"}, "STRONG_BUY": {"wiki": true, "area": "body", "score": 1.0, "desc": "Tells you about a strong buy"}, "HTML_FONT_SIZE_LARGE": {"wiki": true, "area": "body", "score": 0.001, "desc": "HTML font size is large"}, "HS_BOBAX_MID_2": {"wiki": true, "area": "header", "score": 2.762, "desc": "Bobax? Message-Id: <0IX000EJXVWDA000@example.com>"}, "INVALID_TZ_EST": {"wiki": true, "area": "header", "score": 1.0, "desc": "Invalid date in header (wrong EST timezone)"}, "TO_MALFORMED": {"wiki": true, "area": "header", "score": 2.099, "desc": "To: has a malformed address"}, "FH_MSGID_01C70XXX": {"wiki": true, "area": "header", "score": 1.0, "desc": "MESSAGE ID seen often!!!"}, "KAM_STOCKOTC": {"wiki": true, "area": "meta", "score": 2.328, "desc": "(0)"}, "FORGED_IMS_HTML": {"wiki": true, "area": "meta", "score": 2.05, "desc": "IMS can't send HTML message only"}, "HTML_IMAGE_ONLY_04": {"wiki": true, "area": "body", "score": 1.799, "desc": "HTML: images with 0-400 bytes of words"}, "SUBJ_BUY": {"wiki": true, "area": "header", "score": 1.498, "desc": "Subject line starts with Buy or Buying"}, "FUZZY_SOFTWARE": {"wiki": true, "area": "body", "score": 1.0, "desc": "Attempt to obfuscate words in spam"}, "RCVD_IN_IADB_MI_CPR_MAT": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Sends no material under Michigan's CPR"}, "FM_SCHOOL_DIPLOMA": {"wiki": true, "area": "meta", "score": 0.776, "desc": "Meta for Schooling + Diploma."}, "KB_DATE_CONTAINS_TAB": {"wiki": true, "area": "header", "score": 3.8, "desc": "Date:raw =~ /^\\t/"}, "MIME_BOUND_EQ_REL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Content-Type =~ /boundary=\"=====================_\\d+==\\.REL\"/s"}, "BUG6152_INVALID_DATE_TZ_ABSURD": {"wiki": true, "area": "header", "score": 1.802, "desc": "Date =~ /[-+](?!(?:0\\d| 1[0-4])(?:[03]0| [14]5))\\d{4}/"}, "UNWANTED_LANGUAGE_BODY": {"wiki": true, "area": "body", "score": 2.8, "desc": "Message written in an undesired language"}, "SANE_04e8bf28eb445199a7f11b943c44d209": {"wiki": true, "area": "body", "score": 3.185, "desc": "Email.Spam.Gen3177.Sanesecurity.08051611"}, "USER_IN_BLACKLIST": {"wiki": true, "area": "header", "score": 100.0, "desc": "From: address is in the user's black-list"}, "HELO_LH_HOME": {"wiki": true, "area": "header", "score": 2.023, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=\\S+\\.(?:home| lan) /i"}, "FB_FHARMACY": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: Farmacy"}, "DATE_IN_PAST_96_XX": {"wiki": true, "area": "header", "score": 3.405, "desc": "Date: is 96 hours or more before Received: date"}, "STOX_REPLY_TYPE": {"wiki": true, "area": "header", "score": 1.898, "desc": "Content-Type =~ /text\\/plain; .* reply-type=original/"}, "HTML_COMMENT_SAVED_URL": {"wiki": true, "area": "body", "score": 1.391, "desc": "HTML message is a saved web page"}, "HTML_FONT_LOW_CONTRAST": {"wiki": true, "area": "body", "score": 0.786, "desc": "HTML font color similar to background"}, "BAYES_50": {"wiki": true, "area": "body", "score": 2.0, "desc": "Bayes spam probability is 40 to 60%"}, "DKIM_ADSP_CUSTOM_LOW": {"wiki": true, "area": "header", "score": 0.001, "desc": "No valid author signature, adsp_override is CUSTOM_LOW"}, "RCVD_IN_IADB_MI_CPR_30": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Checked lists against Michigan's CPR within 30 days"}, "WHOIS_WHOISGUARD": {"wiki": true, "area": "body", "score": 3.399, "desc": "URL registered to WhoisGuard"}, "XMAILER_MIMEOLE_OL_32D97": {"wiki": true, "area": "meta", "score": 2.896, "desc": "(__XM_OL_32D97 && __MO_OL_32D97)"}, "DKIM_ADSP_CUSTOM_MED": {"wiki": true, "area": "header", "score": 0.001, "desc": "No valid author signature, adsp_override is CUSTOM_MED"}, "NORMAL_HTTP_TO_IP": {"wiki": true, "area": "uri", "score": 0.795, "desc": "Uses a dotted-decimal IP address in URL"}, "PERCENT_RANDOM": {"wiki": true, "area": "meta", "score": 3.196, "desc": "Message has a random macro in it"}, "SUSPICIOUS_RECIPS": {"wiki": true, "area": "header", "score": 2.51, "desc": "Similar addresses in recipient list"}, "FM_MORTGAGE4PLUS": {"wiki": true, "area": "meta", "score": 1.0, "desc": "Looks like a mortgage spam (4+)"}, "STOCK_ALERT": {"wiki": true, "area": "body", "score": 1.0, "desc": "Offers a alert about a stock"}, "SANE_91eb43f705d25c804374a746d7519660": {"wiki": true, "area": "body", "score": 3.099, "desc": "Email.Malware.Sanesecurity.07011300"}, "TVD_SECTION": {"wiki": true, "area": "body", "score": 1.0, "desc": "/\\bSection (?:27A| 21B)/i"}, "HELO_FRIEND": {"wiki": true, "area": "header", "score": 1.0, "desc": "X-Spam-Relays-External =~ /^[^\\]]+ helo=friend /i"}, "RCVD_IN_SORBS_MISC": {"wiki": true, "area": "header", "score": 1.0, "desc": "SORBS: sender is open proxy server"}, "FU_LONG_QUERY3": {"wiki": true, "area": "uri", "score": 1.0, "desc": "URL has a long file name with .aspx extension."}, "FB_INDEPEND_RWD": {"wiki": true, "area": "body", "score": 2.799, "desc": "Phrase: independent reward"}, "DNS_FROM_OPENWHOIS": {"wiki": true, "area": "header", "score": 2.431, "desc": "Envelope sender listed in bl.open-whois.org."}, "SUBJ_AS_SEEN": {"wiki": true, "area": "header", "score": 3.099, "desc": "Subject contains \"As Seen\""}, "TVD_FUZZY_FIXED_RATE": {"wiki": true, "area": "body", "score": 1.0, "desc": "/<inter W2><post P2>(?!fixed rate)<F><I><X><E><D>\\s+<R><A><T><E>/i"}, "URI_NO_WWW_INFO_CGI": {"wiki": true, "area": "uri", "score": 2.299, "desc": "CGI in .info TLD other than third-level \"www\""}, "BANKING_LAWS": {"wiki": true, "area": "body", "score": 2.399, "desc": "Talks about banking laws"}, "FU_COMMON_SUBS2": {"wiki": true, "area": "uri", "score": 2.823, "desc": "Sub-dir seen often in spam (2)."}, "REMOVE_BEFORE_LINK": {"wiki": true, "area": "body", "score": 1.8, "desc": "Removal phrase right before a link"}, "DKIM_POLICY_TESTING": {"wiki": true, "area": "header", "score": 1.0, "desc": "eval:check_dkim_testing()"}, "FB_C0MPANY": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: C0mpany"}, "OBSCURED_EMAIL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Message seems to contain rot13ed address"}, "FH_FROM_CASH": {"wiki": true, "area": "header", "score": 2.599, "desc": "From name has \"cash\""}, "SUBJECT_DRUG_GAP_VA": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject contains a gappy version of 'valium'"}, "HTML_SHORT_LINK_IMG_2": {"wiki": true, "area": "meta", "score": 0.239, "desc": "HTML is very short with a linked image"}, "RCVD_IN_RP_CERTIFIED": {"wiki": true, "area": "header", "score": 0.0, "desc": "Sender is in Return Path Certified (trusted relay)"}, "URIBL_BLACK": {"wiki": true, "area": "body", "score": 1.775, "desc": "Contains an URL listed in the URIBL blacklist"}, "FRT_VALIUM2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Valium (2)"}, "DATE_IN_PAST_06_12": {"wiki": true, "area": "header", "score": 1.699, "desc": "Date: is 6 to 12 hours before Received: date"}, "FRT_VALIUM1": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Valium"}, "DOS_URI_ASTERISK": {"wiki": true, "area": "uri", "score": 1.0, "desc": "Found an asterisk in a URI"}, "FH_MSGID_000000": {"wiki": true, "area": "header", "score": 1.0, "desc": "Special MSGID"}, "HEADER_SPAM": {"wiki": true, "area": "header", "score": 2.499, "desc": "Bulk email fingerprint (header-based) found"}, "XMAILER_MIMEOLE_OL_7533E": {"wiki": true, "area": "meta", "score": 1.113, "desc": "(__XM_OL_7533E && __MO_OL_7533E)"}, "XMAILER_MIMEOLE_OL_9B90B": {"wiki": true, "area": "meta", "score": 1.502, "desc": "(__XM_OL_9B90B && __MO_OL_9B90B)"}, "DK_POLICY_TESTING": {"wiki": true, "area": "header", "score": 0.001, "desc": "Domain Keys: policy says domain is testing DK"}, "HTML_NONELEMENT_30_40": {"wiki": true, "area": "body", "score": 0.308, "desc": "30% to 40% of HTML elements are non-standard"}, "MISSING_MID": {"wiki": true, "area": "header", "score": 0.001, "desc": "Missing Message-Id: header"}, "TVD_INCREASE_SIZE": {"wiki": true, "area": "body", "score": 1.529, "desc": "/\\bsize of .{1,20}(?:penis| dick| manhood)/i"}, "RCVD_DOUBLE_IP_SPAM": {"wiki": true, "area": "meta", "score": 3.895, "desc": "Bulk email fingerprint (double IP) found"}, "TVD_PH_REC": {"wiki": true, "area": "body", "score": 3.266, "desc": "Message has a phrase standard for phishing mails"}, "TVD_ENVFROM_APOST": {"wiki": true, "area": "header", "score": 1.0, "desc": "EnvelopeFrom =~ /\\'/"}, "FB_ALMOST_SEX": {"wiki": true, "area": "body", "score": 1.0, "desc": "It's almost sex, but not!"}, "FM_LUX_GIFTS_REDUCED": {"wiki": true, "area": "meta", "score": 2.486, "desc": "Luxury Gifts with dd%"}, "FSL_FAKE_HOTMAIL_RVCD": {"wiki": true, "area": "header", "score": 2.631, "desc": "X-Spam-Relays-External =~ /mx[1234]\\.hotmail\\.com/"}, "FRT_TODAY2": {"wiki": true, "area": "body", "score": 1.988, "desc": "ReplaceTags: Today (2)"}, "XMAILER_MIMEOLE_OL_F3B05": {"wiki": true, "area": "meta", "score": 2.217, "desc": "(__XM_OL_F3B05 && __MO_OL_F3B05)"}, "TVD_SUBJ_OWE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject =~ /^\\s*(?:\\w+\\s+)+you\\s+(?:\\w+\\s+)*(?:owe| indebted)\\s+(?:\\w+\\s+)+an\\s*other/i"}, "XMAILER_MIMEOLE_OL_B30D1": {"wiki": true, "area": "meta", "score": 1.748, "desc": "(__XM_OL_B30D1 && __MO_OL_B30D1)"}, "SUBJECT_FUZZY_MEDS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Attempt to obfuscate words in Subject:"}, "ADVANCE_FEE_2": {"wiki": true, "area": "meta", "score": 2.049, "desc": "Appears to be advance fee fraud (Nigerian 419)"}, "RCVD_IN_SORBS_DUL": {"wiki": true, "area": "header", "score": 0.001, "desc": "SORBS: sent directly from dynamic IP address"}, "FRT_OPPORTUN2": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Oppertun (2)"}, "FH_MSGID_REPLACE": {"wiki": true, "area": "header", "score": 1.0, "desc": "Broken Replace Template"}, "FH_BAD_OEV1441": {"wiki": true, "area": "header", "score": 1.0, "desc": "Bad X-Mailer version"}, "FM_MULTI_LUX_GIFTS": {"wiki": true, "area": "meta", "score": 2.494, "desc": "Talks about variety of luxury gifts"}, "XMAILER_MIMEOLE_OL_8627E": {"wiki": true, "area": "meta", "score": 3.895, "desc": "(__XM_OL_8627E && __MO_OL_8627E)"}, "FB_INCREASE_YOUR": {"wiki": true, "area": "body", "score": 2.7, "desc": "Phrase: Increase your energy"}, "RCVD_IN_MAPS_DUL": {"wiki": true, "area": "header", "score": 1.0, "desc": "Relay in DUL, http://www.mail-abuse.com/enduserinfo_dul.html"}, "FS_ERECTION": {"wiki": true, "area": "header", "score": 1.0, "desc": "Phrase: erection in subject."}, "RCVD_IN_IADB_DOPTIN_GT50": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Confirmed opt-in used more than 50% of the time"}, "FUZZY_ROLEX": {"wiki": true, "area": "body", "score": 3.399, "desc": "Attempt to obfuscate words in spam"}, "FS_DOLLAR_BONUS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject talks about money bonus!"}, "XMAILER_MIMEOLE_OL_B9B11": {"wiki": true, "area": "meta", "score": 3.496, "desc": "(__XM_OL_B9B11 && __MO_OL_B9B11)"}, "FB_THOUS_PERSONAL": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: thousand personal"}, "PREVENT_NONDELIVERY": {"wiki": true, "area": "header", "score": 1.0, "desc": "Message has Prevent-NonDelivery-Report header"}, "FH_RE_NEW_DDD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject is Re: new \\d\\d\\d"}, "FS_TEEN_BAD": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject says something bad about teens"}, "HTML_BADTAG_60_70": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML message is 60% to 70% bad tags"}, "NULL_IN_BODY": {"wiki": true, "area": "full", "score": 2.056, "desc": "Message has NUL (ASCII 0) byte in message"}, "RCVD_IN_IADB_DOPTIN_LT50": {"wiki": true, "area": "header", "score": 0.0, "desc": "IADB: Confirmed opt-in used less than 50% of the time"}, "TVD_RCVD_IP": {"wiki": true, "area": "header", "score": 0.695, "desc": "Received =~ /^from\\s+(?:\\d+[^0-9a-zA-Z\\s]){3}\\d+[.\\s]/"}, "FS_WILL_HELP": {"wiki": true, "area": "header", "score": 2.599, "desc": "Subject says will help"}, "NO_PRESCRIPTION": {"wiki": true, "area": "body", "score": 2.399, "desc": "No prescription needed"}, "FH_MSGID_XXBLAH": {"wiki": true, "area": "header", "score": 1.0, "desc": "Common sign in msg-id's 12/21/2006"}, "FB_YOURSELF_MASTER": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: yourself master"}, "INVESTMENT_ADVICE": {"wiki": true, "area": "body", "score": 2.199, "desc": "Message mentions investment advice"}, "FM_MANY_DRUG_WORDS": {"wiki": true, "area": "meta", "score": 1.161, "desc": "Lot's of almost drug words"}, "FB_ODD_SPACED_MONEY": {"wiki": true, "area": "body", "score": 1.0, "desc": "Looks like money but has odd spacing."}, "FRT_LEVITRA": {"wiki": true, "area": "body", "score": 1.0, "desc": "ReplaceTags: Levitra"}, "TVD_DEAR_HOMEOWNER": {"wiki": true, "area": "body", "score": 1.0, "desc": "/^dear homeowner/i"}, "SUBJECT_DRUG_GAP_S": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject contains a gappy version of 'soma'"}, "RCVD_IN_IADB_OOO": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: One-to-one/transactional email only"}, "SANE_2b173a7fb7518c75ac8a2d294d773fd8": {"wiki": true, "area": "body", "score": 2.976, "desc": "Email.Spam.Sanesecurity.Url_2496"}, "FM_MORTGAGE5PLUS": {"wiki": true, "area": "meta", "score": 3.099, "desc": "Looks like a mortgage spam (5+)"}, "URIBL_SC_SURBL": {"wiki": true, "area": "body", "score": 0.568, "desc": "Contains an URL listed in the SC SURBL blocklist"}, "RDNS_LOCALHOST": {"wiki": true, "area": "header", "score": 3.7, "desc": "Sender's public rDNS is \"localhost\""}, "DK_POLICY_SIGNALL": {"wiki": true, "area": "header", "score": 0.001, "desc": "Domain Keys: policy says domain signs all mails"}, "FROM_ILLEGAL_CHARS": {"wiki": true, "area": "header", "score": 2.192, "desc": "From: has too many raw illegal characters"}, "FB_ROLX": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: rolx"}, "UPPERCASE_75_100": {"wiki": true, "area": "meta", "score": 1.93, "desc": "message body is 75-100% uppercase"}, "EM_ROLEX": {"wiki": true, "area": "body", "score": 2.068, "desc": "Message puts emphasis on the watch manufacturer"}, "HS_FORGED_OE_FW": {"wiki": true, "area": "meta", "score": 2.796, "desc": "Outlook does not prefix forwards with \"FW:\""}, "FB_UNLOCK_YOUR_G": {"wiki": true, "area": "body", "score": 1.0, "desc": "Phrase: lock to your girlfriend"}, "WHOIS_UNLISTED": {"wiki": true, "area": "body", "score": 2.17, "desc": "Contains URL registered to Unlisted-Whois.com"}, "TT_MSGID_TRUNC": {"wiki": true, "area": "header", "score": 1.448, "desc": "Scora: Message-Id ends after left-bracket + digits"}, "FORGED_OUTLOOK_TAGS": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Outlook can't send HTML in this format"}, "BAYES_80": {"wiki": true, "area": "body", "score": 2.7, "desc": "Bayes spam probability is 80 to 95%"}, "FB_REPLICA_ROLEX": {"wiki": true, "area": "body", "score": 3.175, "desc": "Phrase: Replica Rolex"}, "FR_TITLE_NUMS": {"wiki": true, "area": "rawbody", "score": 2.899, "desc": "HTML Title is only numbers"}, "FORGED_THEBAT_HTML": {"wiki": true, "area": "meta", "score": 2.407, "desc": "The Bat! can't send HTML message only"}, "FSL_GEO_ABUSE": {"wiki": true, "area": "uri", "score": 2.699, "desc": "/\\/geocities\\.com\\/\\S+(dollar) /"}, "RCVD_BAD_ID": {"wiki": true, "area": "header", "score": 1.0, "desc": "Received =~ /\\bid\\s+[a-zA-Z0-9_+\\/\\\\,-]+(?:[!\"\\#\\(dollar) \\%&'()*:<=>?\\@\\[\\]^\\`{| }~]| ;\\S)/"}, "LONG_TERM_PRICE": {"wiki": true, "area": "body", "score": 0.001, "desc": "/long\\W+term\\W+(target| projected)(\\W+price)?/i"}, "FUZZY_MILLION": {"wiki": true, "area": "body", "score": 2.599, "desc": "Attempt to obfuscate words in spam"}, "DRUGS_MUSCLE": {"wiki": true, "area": "meta", "score": 0.001, "desc": "Refers to a muscle relaxant"}, "FU_ENDS_NUMS_DOTS_CLK": {"wiki": true, "area": "uri", "score": 1.0, "desc": "Ends with clk/d+.d+.d+"}, "RCVD_IN_MAPS_RSS": {"wiki": true, "area": "header", "score": 1.0, "desc": "Relay in RSS, http://www.mail-abuse.com/enduserinfo_rss.html"}, "RATWARE_EFROM": {"wiki": true, "area": "header", "score": 2.999, "desc": "Bulk email fingerprint (envfrom) found"}, "SUBJECT_DRUG_GAP_C": {"wiki": true, "area": "header", "score": 2.14, "desc": "Subject contains a gappy version of 'cialis'"}, "HTML_TITLE_SUBJ_DIFF": {"wiki": true, "area": "meta", "score": 0.805, "desc": "__HTML_TITLE_SUBJ_DIFF && !__MIME_ATTACHMENT"}, "HTML_BADTAG_50_60": {"wiki": true, "area": "body", "score": 1.0, "desc": "HTML message is 50% to 60% bad tags"}, "FH_FAKE_RCVD_LINE": {"wiki": true, "area": "header", "score": 2.525, "desc": "RCVD line looks faked (A)"}, "XMAILER_MIMEOLE_OL_3857F": {"wiki": true, "area": "meta", "score": 0.509, "desc": "(__XM_OL_3857F && __MO_OL_3857F)"}, "FRT_ADOBE2": {"wiki": true, "area": "body", "score": 1.099, "desc": "ReplaceTags: Adobe"}, "ENGLISH_UCE_SUBJECT": {"wiki": true, "area": "header", "score": 2.899, "desc": "Subject contains an English UCE tag"}, "SUBJECT_DRUG_GAP_L": {"wiki": true, "area": "header", "score": 2.799, "desc": "Subject contains a gappy version of 'levitra'"}, "FR_3TAG_3TAG": {"wiki": true, "area": "rawbody", "score": 1.0, "desc": "Looks like 3 <e> small tags."}, "RCVD_IN_IADB_OPTOUTONLY": {"wiki": true, "area": "header", "score": 1.0, "desc": "IADB: Scrapes addresses, pure opt-out only"}, "SPF_HELO_NEUTRAL": {"wiki": true, "area": "header", "score": 0.112, "desc": "SPF: HELO does not match SPF record (neutral)"}, "USER_IN_WHITELIST": {"wiki": true, "area": "header", "score": -100.0, "desc": "From: address is in the user's white-list"}, "SUBJECT_DRUG_GAP_X": {"wiki": true, "area": "header", "score": 1.0, "desc": "Subject contains a gappy version of 'xanax'"}, "UPPERCASE_50_75": {"wiki": true, "area": "meta", "score": 0.49, "desc": "message body is 50-75% uppercase"}, "FS_NUDE": {"wiki": true, "area": "header", "score": 2.399, "desc": "Subject says Nude"}}