SpamTitan

SARE_ADLTSUB1 = Contains OBFU and "strong" adult words

SARE_ADLTSUB2 = Contains possible adult words

SARE_ADLTSUB3 = Apparent spam seems to contain porn subject

SARE_ADLTSUB4 = Apparent spam seems to contain porn subject

SARE_ADLTSUB5 = Apparent spam seems to contain porn subject

SARE_ADLTSUB6 = Apparent spam seems to contain porn subject

SARE_ADLTSUB7 = Apparent spam seems to contain porn subject

SARE_ADLTSUB8 = Apparent spam seems to contain porn subject

LW_PORN_HELLO = Standard 'hot chicks' line

SARE_ADULT1 = Contains adult material

SARE_ADULT2 = Contains adult material

SARE_BETTERORG = Talks about getting better orgasms

SARE_ENLRGYOUR = Talks about "enlarging" something

SARE_LRGPNS = Talks about a "bigger" appendage

SARE_PNSSIZE = Talks about the size of a male body part

SARE_SXLIFE = Talks about your sex life

SARE_BEASTUD = common spammer phrasing

SARE_BIGRMEMBER = mentions bigger body part

SARE_INLENGTH = common spammer phrasing

SARE_NOEMBARRASS = Wow, I won't be embarrassed anymore!

SARE_PLEASEPARTNR = common spammer phrasing

SARE_SUPERVIAGRA = mentions drug which is often subject of spam

SARE_ADLTDATING = Contains phrasing used by spammers

SARE_ADLTPRSNLS = Contains phrasing used by spammers

SARE_CHILDPRN1 = contains a reference to child porn

SARE_TOWRITE = Contains phrasing used by spammers

SARE_GETFCK = Contains phrasing used by spammers

SARE_BADGIRLS = Contains phrasing used by spammers

SARE_QLTYSINGLES = Contains phrasing seen in spam

SARE_STILLSINGLE = Contains phrasing used by spammers

SARE_HOUSEWIVES = Mentions housewives, as in porn or in-home biz

SARE_SCHLGRL = mentions schoolgirls, as in porn

SARE_ADLTOBFU = Contains OBFU adult material

SARE_OBFUENLARGE = masked spam word(s)

SARE_OBFUFCK2 = Apparent spam seems to contain porn subject

SARE_OBFUSEXUAL = masked spam word(s)

SARE_OBFUTESTO = masked spam word(s)

SARE_RPTLETTERS = Contains mis-spelled adult phrase(s)

SARE_SEXDRIVE = Talks about sex drive

SARE_BETTERSEX = Spammer phrasing in the body of the email

SARE_SEXENHANCER = mentions spam topic

SARE_BAYES_5x7 = Bayes poison 5x7

SARE_BAYES_5x8 = Bayes poison 5x8

SARE_BAYES_6x6 = Bayes poison 6x6

SARE_BAYES_6x7 = Bayes poison 6x7

SARE_BAYES_6x8 = Bayes poison 6x8

SARE_BAYES_7x5 = Bayes poison 7x5

SARE_BAYES_7x6 = Bayes poison 7x6

SARE_BAYES_7x7 = Bayes poison 7x7

SARE_BAYES_7x8 = Bayes poison 7x8

SARE_BAYES_8x5 = Bayes poison 8x5

SARE_BAYES_9x5 = Bayes poison 9+x5

SARE_EN_A_1XX_1 = Phone number or address pulled from spam

SARE_EN_A_1XX_2 = Phone number or address pulled from spam

SARE_EN_A_2XX_1 = Phone number or address pulled from spam

SARE_EN_A_3XX_1 = Phone number or address pulled from spam

SARE_EN_A_4XX_1 = Phone number or address pulled from spam

SARE_EN_A_5XX_1 = Phone number or address pulled from spam

SARE_EN_A_6XX_1 = Phone number or address pulled from spam

SARE_EN_A_7XX_1 = Phone number or address pulled from spam

SARE_EN_A_8XX_1 = Phone number or address pulled from spam

SARE_EN_A_9XX_1 = Phone number or address pulled from spam

SARE_EN_A_BOX_1 = Phone number or address pulled from spam

SARE_EN_A_INT_1 = Phone number or address pulled from spam

SARE_EN_N_X31_1 = Phone number or address pulled from spam

SARE_EN_N_2XX_1 = Phone number or address pulled from spam

SARE_EN_N_203_1 = Phone number or address pulled from spam

SARE_EN_N_212_1 = Phone number or address pulled from spam

SARE_EN_N_4XX_1 = Phone number or address pulled from spam

SARE_EN_N_5XX_1 = Phone number or address pulled from spam

SARE_EN_N_7XX_1 = Phone number or address pulled from spam

SARE_EN_N_800_1 = Phone number or address pulled from spam

SARE_EN_N_800_2_1 = Phone number or address pulled from spam

SARE_EN_N_800_3_1 = Phone number or address pulled from spam

SARE_EN_N_800_5_1 = Phone number or address pulled from spam

SARE_EN_N_800_8_1 = Phone number or address pulled from spam

SARE_EN_N_800_9_1 = Phone number or address pulled from spam

SARE_EN_N_866_1 = Phone number or address pulled from spam

SARE_EN_N_877_1 = Phone number or address pulled from spam

SARE_EN_N_888_1 = Phone number or address pulled from spam

SARE_EN_N_9XX_1 = Phone number or address pulled from spam

SARE_EN_N_X1X_1 = Phone number or address pulled from spam

SARE_SUB_FREE_PPV = Spammer subject - black market or scam

SARE_SUB_INC_ONLINE2 = Subject contains apparent spammer phrasing

SARE_SUB_NAME_STAR = Spammer subject - black market or scam

SARE_SUB_REPRESENT_REQ = Possible phishing subject

SARE_SUB_SINCERE = Spam topic found in the subject

SARE_SUB_NEW_CREDIT = Spammer subject - credit or money

SARE_SUB_WIPE_CLEAN = Subject will wipe something clean

SARE_SUB_CASINO_BONUS = Spammer subject - casinos

SARE_SUB_TERM_LIFE = Spammer subject - insurance

SARE_SUB_INCOME = Subject contains common spammer phrasing

SARE_SUB_OEMS = Spammer subject - multiple software vendors

SARE_SUB_24HOUR_SALE = Common spammer subject header -- sales

SARE_SUB_BUY_MEDS = Spammer subject - medical

SARE_SUB_FORGET_DOC = Spammer subject - medical

SARE_SUB_FREE_PRES = subject has likely spammer phrase or word

SARE_SUB_GIVE_SMILE = Common spammer subject

SARE_SUB_MALE_MUSCLE = Spammer subject - medical

SARE_SUB_MEDS_LEO = obfuscated subject header

SARE_SUB_NO_RX = no prescription needed

SARE_SUB_NUM_PILLS = Common spammer subject header -- medical

SARE_SUB_ONLINE_DRUG = Common spammer subject

SARE_SUB_PHARM_LEO = obfuscated subject header

SARE_SUB_PHARM_LEO2 = obfuscated subject header

SARE_SUB_REFILL_RX = Common spammer subject - medical

SARE_SUB_RENEW_VITAL = Common spammer subject

SARE_SUB_CHEAP = Subject matches common spam pattern

SARE_SUB_LIKE_YOU = subject has likely spammer phrase or word

SARE_SUB_PAYMENT = Subject matches common spam pattern

SARE_HEAD_HDR_CONVER = Message headers used which identify spam

SARE_HEAD_HDR_DISPNOP = Message headers used which identify spam

SARE_HEAD_HDR_LANG = Message headers used which identify spam

SARE_HEAD_HDR_NLETRID = Message headers used which identify spam

SARE_HEAD_HDR_PID = Message headers used which identify spam

SARE_HEAD_HDR_PREVNDR = Message headers used which identify spam

SARE_HEAD_HDR_XBNCETR = Message headers used which identify spam

SARE_HEAD_HDR_XCAMPIDZ = Message headers used which identify spam

SARE_HEAD_HDR_XCLIHST = Message headers used which identify spam

SARE_HEAD_HDR_XE = Message headers used which identify spam

SARE_HEAD_HDR_XCSIP = Message headers used which identify spam

SARE_HEAD_HDR_XEMAIL = Message headers used which identify spam

SARE_HEAD_HDR_XENCVER = Message headers used which identify spam

SARE_HEAD_HDR_XFIND = Message headers used which identify spam

SARE_HEAD_HDR_XGMAILA = Message headers used which identify spam

SARE_HEAD_HDR_XGMXAV = Message headers used which identify spam

SARE_HEAD_HDR_XIDSRVR = Message headers used which identify spam

SARE_HEAD_HDR_XRMDTXT = Message headers used which identify spam

SARE_HEAD_HDR_XRMVADR = Message headers used which identify spam

SARE_HEAD_HDR_XRSPCID = Message headers used which identify spam

SARE_HEAD_HDR_XRSPRID = Message headers used which identify spam

SARE_HEAD_HDR_XRSPUSR = Message headers used which identify spam

SARE_HEAD_HDR_XSPAMTST = Message headers used which identify spam

SARE_HEAD_HDR_XSPTRID = Message headers used which identify spam

SARE_HEAD_HDR_XUOLSRV = Message headers used which identify spam

SARE_HEAD_HDR_XWCMID = Message headers used which identify spam

SARE_HEAD_HDR_XWEBMTM = Message headers used which identify spam

SARE_BOUNDARY_02 = Too many ~'s in the boundary.

SARE_BOUNDARY_03 = Content type boundary used in spam or virus

SARE_BOUNDARY_10 = Possible spam flag

SARE_BOUNDARY_11 = Possible spam flag

SARE_BOUNDARY_12 = Possible spam flag

SARE_BOUNDARY_13 = Possible spam flag

SARE_BOUNDARY_D9 = Content type boundary used in spam or virus

SARE_BOUNDARY_D11 = Content type boundary used in spam or virus

SARE_BOUNDARY_D12 = Content type boundary used in spam or virus

SARE_BOUNDARY_ANYDIG = Content type boundary used in spam and viruses

SARE_BOUNDARY_QZSOFT = Identifies spam from specific spamware Marks Bad AOL Addresses

SARE_FROM_BADAOL = From an Invalid AOL Email Address

SARE_FROM_DRUGS = From a drug

SARE_FROM_HOODIA = From who do ya say?

SARE_FROM_PAYPAL_INV = From invalid address at PayPal

SARE_FROM_SPAM_NAME2 = From address suggests this is spam

SARE_FREE_WEBM_COMWALL = Maybe spammer with a free email

SARE_FREE_WEBM_Dora = Sender used free email account - may be spammer

SARE_FROM_WEBM_ERESMAS = Probable spammer

SARE_FREE_WEBM_EsTerra = Sender used free email account - may be spammer

SARE_FREE_WEBM_Kero = Sender used free email account - may be spammer

SARE_FREE_WEBM_LATINML = Maybe spammer with free email

SARE_FREE_WEBM_OwnEm1 = Sender used free email account - may be spammer

SARE_FREE_WEBM_OwnEm2 = Sender used free email account - may be spammer

SARE_FREE_WEBM_Uymail = Sender used free email account - may be spammer

SARE_FREE_WEBM_Zwallet = Sender used free email account - may be a spammer

SARE_MSGID_1Z1Z = Message-ID has ratware pattern (1zXXXX@1z)

SARE_MSGID_HEX30 = Message-ID has ratware pattern (HEXHEXHEX$9x9@)

SARE_HELO_MAILUSER = Received header has possible spamsign

SARE_RECV_LOCALHOST = fingerprint

SARE_RECV_SUSP_2 = Spammer sign in headers

SARE_RECV_TRADVALUES = From or passed through spammer/unreliable domain

SARE_RECV_VIPLIST = Email comes from known spammer system

SARE_RECV_XACTRIX = From/through probable spammer system

SARE_RECV_IP_004078 = Spam passed through possible spammer relay

SARE_RECV_IP_038112147 = Spam passed through possible spammer relay

SARE_RECV_IP_061052 = Spam passed through possible spammer relay

SARE_RECV_IP_061172 = Spam passed through possible spammer relay

SARE_RECV_IP_063106130 = Spam passed through possible spammer relay

SARE_RECV_IP_064069032 = Spam passed through possible spammer relay

SARE_RECV_IP_064192082 = Spam passed through possible spammer relay

SARE_RECV_IP_066059094 = Spam passed through possible spammer relay

SARE_RECV_IP_066063 = Passed through possible spammer relay or source

SARE_RECV_IP_066114a = Spam passed through possible spammer relay

SARE_RECV_IP_066159017 = Spam passed through possible spammer relay

SARE_RECV_IP_069060122 = Spam passed through possible spammer relay

SARE_RECV_IP_070096177 = Spam passed through possible spammer relay

SARE_RECV_IP_071004200 = Spam passed through possible spammer relay

SARE_RECV_IP_072034096 = Spam passed through possible spammer relay

SARE_RECV_IP_204010039 = Spam passed through possible spammer relay

SARE_RECV_IP_206081080 = Spam passed through possible spammer relay

SARE_RECV_IP_207182 = Passed through possible spammer relay or source

SARE_RECV_IP_208048182 = Spam passed through possible spammer relay

SARE_RECV_IP_208053011 = Spam passed through possible spammer relay

SARE_RECV_IP_216055133 = Spam passed through possible spammer relay

SARE_RECV_IP_218011 = Spam passed through Chinese CNCGROUP-HE system

SARE_RECV_IP_218062 = Passed through possible spammer relay or source

SARE_RECV_IP_218071 = Spam passed through possible spammer relay

SARE_RECV_IP_218085 = Passed through possible spammer relay or source

SARE_RECV_IP_219159 = Spam passed through possible spammer relay

SARE_RECV_IP_219248 = Passed through possible spammer relay or source

SARE_RECV_IP_220168 = Passed through possible spammer relay or source

SARE_RECV_IP_220189 = Passed through possible spammer relay or source

SARE_RECV_IP_221000 = Passed through possible spammer relay or source

SARE_RECV_IP_222032 = Spam passed through possible spammer relay

SARE_REPLY_XACTRIX = Reply-To email addr to spammer

SARE_TOCC_MULT_BIGFT5 = Sent to multiple bigfoot addresses

SARE_TOCC_MULT_BIGFT6 = Sent to multiple bigfoot addresses

SARE_TOCC_MULT_BIGFT7 = Sent to multiple bigfoot addresses

SARE_TOCC_MULT_BIGFT8 = Sent to multiple bigfoot addresses

SARE_TOCC_MULT_BIGFT9 = Sent to multiple bigfoot addresses

SARE_USERAG_2 = Strange user-agent header implying spam

SARE_USERAG_3 = Strange user-agent header implying spam

SARE_USERAG_BAT = Spamware pretending to be 'The Bat!'

SARE_USERAG_SPAM0 = Was sent by a SPAM User Agent

SARE_XMAIL_DIRUNIV = Apparently uses spam/bulk mailer

SARE_XMAIL_DYNAMAILER = Bulk email fingerprint (DynaMailer) found

SARE_XMAIL_FNORD = Recognized spam sign in xmail header

SARE_XMAIL_INTERMED = possible spamware

SARE_XMAIL_LEO = Spamsign in x-mailer header

SARE_XMAIL_PHPBulkEmai = Apparently uses spam/bulk mailer

SARE_XMAIL_RANDMAILER = only 1-3 lowercase words in X-mailer field

SARE_XMAIL_TTBOARD = X-Mailer used by spammer

SARE_HEAD_DATE46 = Date header suggests this is spam

SARE_HEAD_LOC_INV1 = Improper location

SARE_HEAD_MIME_INVALID = Invalid mime version

SARE_HEAD_MIME_PROD = Ratware MIME Version

SARE_HEAD_THRD_ALNUM = Spam fingerprint in the thread index

SARE_HEAD_XMF_AUTHSNDR = Headers contains spam sign

SARE_HEAD_XM4 = Contains spamsign header

SARE_HEAD_XMIMEO_MS = Ratware-misspelled header

SARE_HEAD_BDY_BOUNCES = Message header suggesting spam in body

SARE_HEAD_BAT_WEB = Webmail message ID, but The Bat! X-Mailer

SARE_MULT_BMASTGR = Directed to/from invalid address

SARE_MULT_FROM = Many from lines

SARE_MULT_SEXCLUB = Adult invitation spam

SARE_MULT_SUBJ = Many subject lines

SARE_HEAD_HDR_ALTREC = Message headers used which identify spam

SARE_HEAD_HDR_APPROV = Message headers used which identify spam

SARE_HEAD_HDR_AUTSUBD = Message headers used which identify spam

SARE_HEAD_HDR_DISCREC = Message headers used which identify spam

SARE_HEAD_HDR_MSGTYPE = Message headers used which identify spam

SARE_HEAD_HDR_X400RCV = Message headers used which identify spam

SARE_HEAD_HDR_XBBOUNC = Message headers used which identify spam

SARE_HEAD_HDR_XCNDINF = Message headers used which identify spam

SARE_HEAD_HDR_XENC = Message headers used which identify spam

SARE_HEAD_HDR_XIDKEY = Apparent spam sign in headers

SARE_HEAD_HDR_XLEGAL1 = Message headers used which identify spam

SARE_HEAD_HDR_XLEGAL2 = Message headers used which identify spam

SARE_HEAD_HDR_XLEGAL3 = Message headers used which identify spam

SARE_HEAD_HDR_XLEGAL4 = Message headers used which might identify spam

SARE_HEAD_HDR_XLISTAD = Message headers used which identify spam

SARE_HEAD_HDR_XMAILID = Message headers used which identify spam

SARE_HEAD_HDR_XMEBDOM = Message headers used which identify spam

SARE_HEAD_HDR_XMLRSRV = Message headers used which identify spam

SARE_HEAD_HDR_XRESPID = Message headers used which identify spam

SARE_HEAD_HDR_XRIPE = Message headers used which identify spam

SARE_HEAD_HDR_XSAFMMI = Message headers used which identify spam

SARE_HEAD_HDR_XSIDPRA = fingerprint

SARE_HEAD_HDR_XSIDRES = fingerprint

SARE_HEAD_HDR_XTID = Message headers used which identify spam

SARE_HEAD_HDR_XWTID = Message headers used which identify spam

SARE_HEAD_HDR_XWTVERS = Message headers used which identify spam

SARE_HEAD_ORIG_RECIP = Message header used which suggests spam

SARE_BOUNDARY_05 = Content type boundary used in spam

SARE_BOUNDARY_06 = Content type boundary used in spam

SARE_BOUNDARY_08 = Improbable MIME boundary format

SARE_BOUNDARY_D10 = Content type boundary used in spam or virus

SARE_BOUNDARY_LC = Content type boundary used in spam

SARE_BOUNDARY_NP2 = Content type boundary used in spam and viruses

SARE_FROM_AST = Invalid character in email address

SARE_FROM_CAPS_MSN = Ratware all-caps MSN from address

SARE_FROM_DRUGS2 = From a drug

SARE_FROM_DVDCOPY = From DVD abuse address

SARE_FROM_SPAM_DOMN0 = From address suggests this is spam

SARE_FROM_SPAM_DOMN0Y = From address suggests this is spam

SARE_FROM_SPAM_MONEY = From address suggests this is spam

SARE_FROM_SPAM_MONEY2 = From address suggests this is spam

SARE_FROM_SPAM_NAME0 = From address suggests this is spam

SARE_FROM_SPAM_PL1 = A lot of spam comes from here

SARE_FROM_SPAM_WORD2 = From address suggests this is spam

SARE_FREE_WEBM_BIGMAIL = Sender used free email account - may be spammer

SARE_FREE_WEBM_FrVoila = Sender used free email account - may be spammer

SARE_FREE_WEBM_Jpop = Sender used free email account - may be spammer

SARE_FREE_WEBM_MailD = Sender used free email account - may be spammer

SARE_FREE_WEBM_Mailexc = Sender used free email account - may be spammer

SARE_FREE_WEBM_NETCITY = Maybe spammer with a free email

SARE_FREE_WEBM_NetFs = Sender used free email account - may be spammer

SARE_FREE_WEBM_NetSafe = Sender used free email account - may be spammer

SARE_FREE_WEBM_Netster = Sender used free email account - may be spammer

SARE_FREE_WEBM_PlTenbi = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom05 = Sender used free email account - may be spammer

SARE_FREE_WEBM_Whoever = Sender used free email account - may be spammer

SARE_FREE_WEBM_WOWMAIL = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom01 = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom02 = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom03 = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom03B = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom04 = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom06 = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZCom07 = Sender used free email account - may be spammer

SARE_FREE_WEBM_ZZa001 = Sender used free email account - may be spammer

SARE_FREE_WEBM_SERV = Sent from Webmail server

SARE_MSGID_D1D1D2D16 = Message-ID has ratware pattern (9.9.99.9999999hex@

SARE_MSGID_D5D7 = Message-ID has ratware pattern (99999.9999999@)

SARE_MSGID_DDDASH = Message-ID has ratware pattern (9-, 9$, 99-)

SARE_MSGID_LONG50 = Exceedingly long message-id

SARE_MSGID_QMAIL1 = Contains spoofing message id

SARE_MSGID_RATWARE2 = Message-Id is $lt;digits.digits@letters$gt;

SARE_MSGID_SHORT = Message ID is too short to be valid.

SARE_HELO_YAHOO = Received header has spamsign

SARE_HEAD_8BIT_RECV = High-ASCII characters found in strange header

SARE_RECV_FEP5 = Message contains known spam format

SARE_RECV_FREESERVE = spam passed through system used by spammers

SARE_RECV_MDNETCOMBR = Came through/from sites used by spammer

SARE_RECV_PATMEDIA = Passed through possible spammer relay or source

SARE_RECV_PORTHELO_1 = Apparent Spamsign in Received header

SARE_RECV_PORTHELO_2 = Apparent Spamsign in Received header

SARE_RECV_PORTHELO_3 = Apparent Spamsign in Received header

SARE_RECV_RND_DATE = Spam passed through iswest.net relay

SARE_RECV_SKANOVA = From or passed through spammer/unreliable domain

SARE_RECV_SPAM_DOMN02 = Email passed through apparent spammer domain

SARE_RECV_SPAM_DOMN04 = Email passed through apparent spammer domain

SARE_RECV_SPAM_DOMN06 = Passed through possible spammer relay or source

SARE_RECV_SPAM_DOMN0a = Email passed through apparent spammer domain

SARE_RECV_SPAM_DOMN0b = Email passed through apparent spammer domain

SARE_RECV_SPEEDY_AR = Email passed through apparent spammer domain

SARE_RECV_UK2NET2 = Passed through possible spammer relay or source

SARE_RECV_VIRTUACOMBR = Came through/from site used by spammer

SARE_RECV_BEZEQINT_B = Came through/from site used by spammer

SARE_RECV_IP_FROMIP1 = Received line is IP address from IP address

SARE_RECV_IP_FROMIP3 = Received line is IP address from IP address

SARE_RECV_IP_061050 = Spam passed through possible spammer relay

SARE_RECV_IP_061072 = Passed through possible spammer relay or source

SARE_RECV_IP_061187 = Passed through possible spammer relay or source

SARE_RECV_IP_061190 = Spam passed through possible spammer relay

SARE_RECV_IP_061228 = Spam passed through possible spammer relay

SARE_RECV_IP_062023 = Passed through possible spammer relay or source

SARE_RECV_IP_065205157 = Spam passed through possible spammer relay

SARE_RECV_IP_064034 = Spam passed through possible spammer relay

SARE_RECV_IP_066017 = Passed through possible spammer relay or source

SARE_RECV_IP_066165224 = Spam passed through possible spammer relay

SARE_RECV_IP_066248154 = Spam passed through possible spammer relay

SARE_RECV_IP_069050210 = Spam passed through possible spammer relay

SARE_RECV_IP_069060096 = Spam passed through possible spammer relay

SARE_RECV_IP_082080 = Spam passed through possible spammer relay

SARE_RECV_IP_082102 = Spam passed through possible spammer relay

SARE_RECV_IP_082154 = Passed through possible spammer relay or source

SARE_RECV_IP_083028 = Passed through possible spammer relay or source

SARE_RECV_IP_140117 = Passed through possible spammer relay or source

SARE_RECV_IP_163125 = Spam passed through possible spammer relay

SARE_RECV_IP_192116 = Passed through possible spammer relay or source

SARE_RECV_IP_195229 = Passed through possible spammer relay or source

SARE_RECV_IP_200150 = Spam passed through possible spammer relay

SARE_RECV_IP_203210128 = Spam passed through possible spammer relay

SARE_RECV_IP_203177 = Passed through possible spammer relay or source

SARE_RECV_IP_206131 = Spam passed through possible spammer relay

SARE_RECV_IP_206248152 = Spam passed through possible spammer relay

SARE_RECV_IP_209051 = Spam passed through possible spammer relay

SARE_RECV_IP_209190 = Spam passed through possible spammer relay

SARE_RECV_IP_216118120 = Spam passed through possible spammer relay

SARE_RECV_IP_211216 = Passed through possible spammer relay or source

SARE_RECV_IP_212068 = Spam passed through possible spammer relay

SARE_RECV_IP_216022 = Spam passed through possible spammer relay

SARE_RECV_IP_218070 = Spam passed through possible spammer relay

SARE_RECV_IP_218072 = Spam passed through possible spammer relay

SARE_RECV_IP_218078 = Passed through possible spammer relay or source

SARE_RECV_IP_218088 = Passed through possible spammer relay or source

SARE_RECV_IP_218216 = Passed through possible spammer relay or source

SARE_RECV_IP_219128 = Passed through possible spammer relay or source

SARE_RECV_IP_220116 = Passed through possible spammer relay or source

SARE_RECV_IP_221124 = Spam passed through possible spammer relay

SARE_RECV_IP_222000 = Passed through possible spammer relay or source

SARE_RECV_IP_222064 = Spam passed through possible spammer relay

SARE_TO_EMPTY = To address is set to empty

SARE_XMAIL_GDI = Ratware mailer

SARE_XMAIL_GOMAIL = Apparently uses spam/bulk mailer

SARE_XMAIL_PSSMAILER = Apparently uses bulk mailer

SARE_XMAIL_RLSP = Uses Bulk Mailer used by spammers

SARE_XMAIL_TOLMAIL = X-Mailer used by spammer

SARE_HEAD_DATE_5L = Date header ends in 5+ letters

SARE_HEAD_DATE_RNDDATE = Spam passed through iswest.net relay

SARE_HEAD_MSMPR_RNDSTR = Spam passed through iswest.net relay

SARE_HEAD_ORG_PREFIXW = Spam sign in Organization header

SARE_HEAD_XLIB_INDY1 = Uses S/W version which has only been seen in spam

SARE_HEAD_XLIB_INDY2 = Uses S/W version which has only been seen in spam

SARE_HEAD_XUNSENT = Found spamsign header

SARE_HEAD_XWORD = Spam tool

SARE_HEAD_8BIT_DATE = High-ASCII characters found in strange header

SARE_MULT_VIA_CITIZNET = header references apparent spam source

SARE_HEAD_HDR_CONVWLS = Message headers used which identify spam

SARE_HEAD_HDR_EPATH = Message headers used which identify spam

SARE_HEAD_HDR_JLH = Message headers used which identify spam

SARE_HEAD_HDR_REDIRTO = Message headers used which identify spam

SARE_HEAD_HDR_ROT = Message headers used which identify spam

SARE_HEAD_HDR_RTNPATH = Message headers used which identify spam

SARE_HEAD_HDR_WCMSGID = Message headers used which identify spam

SARE_HEAD_HDR_X400MTI = Message headers used which identify spam

SARE_HEAD_HDR_XAR = Message headers used which identify spam

SARE_HEAD_HDR_XAUTGEN = Message headers used which identify spam

SARE_HEAD_HDR_XCROSS = Message headers used which identify spam

SARE_HEAD_HDR_XEMGBMS = Message headers used which identify spam

SARE_HEAD_HDR_XLC = Message headers used which identify spam

SARE_HEAD_HDR_XLIDCOD = Message headers used which identify spam

SARE_HEAD_HDR_XMISCID = Message headers used which identify spam

SARE_HEAD_HDR_XMLCIPH = Message headers used which identify spam

SARE_HEAD_HDR_XMLMSGI = Message headers used which identify spam

SARE_HEAD_HDR_XMAGDID = Message headers used which identify spam

SARE_HEAD_HDR_XMPM = Message headers used which identify spam

SARE_HEAD_HDR_XMS = Message headers used which identify spam

SARE_HEAD_HDR_XNOSPAM = Message headers used which identify spam

SARE_HEAD_HDR_XNTC = Message headers used which identify spam

SARE_HEAD_HDR_XPOPB4S = Message headers used which identify spam

SARE_HEAD_HDR_XPOPFLK = Message headers used which identify spam

SARE_HEAD_HDR_XPRIOMS = Message headers used which identify spam

SARE_HEAD_HDR_XPRIOMF = Message headers used which identify spam

SARE_HEAD_HDR_XPRIOMI = Message headers used which identify spam

SARE_HEAD_HDR_XPIROMC = Message headers used which identify spam

SARE_HEAD_HDR_XRBLTST = Message headers used which identify spam

SARE_HEAD_HDR_XREC = Message headers used which identify spam

SARE_HEAD_HDR_XSPAMSC = Message headers used which identify spam

SARE_HEAD_HDR_XSRK = Message headers used which identify spam

SARE_HEAD_HDR_XSUBID = Message headers used which identify spam

SARE_HEAD_HDR_XTRANS = Message headers used which identify spam

SARE_HEAD_HDR_XTXTCLS = Message headers used which identify spam

SARE_HEAD_HDR_XVIG = Message headers used which identify spam

SARE_HEAD_HDR_XYD = Message headers used which identify spam

SARE_HEAD_HDR_XI = Message headers used which identify spam

SARE_HEAD_HDR_XIM = Message headers used which identify spam

SARE_CONTENT_BITBITNUM = Unlikely content encoding

SARE_FROM_AMERICA = From user address is used by spammer

SARE_FROM_SPAM_DOMN2 = From address suggests this is spam

SARE_FROM_VIRUS1 = From address suggests this is a virus

SARE_FREE_WEBM_Iamfi = Sender used free email account - may be spammer

SARE_FREE_WEBM_USACOPS = Maybe spammer with free email

SARE_MSGID_06D6 = Message-ID has ratware pattern (000009999$9)

SARE_MSGID_ALL_CAPHM = Ratware all-caps message-id

SARE_MSGID_ALL_CAPMS = Ratware all-caps message-id

SARE_MSGID_H7H4H4 = Message-ID has ratware pattern (7hex$4hex$4hex@)

SARE_MSGID_SPAM_DOMN0 = Message ID implies possible spammer relay

SARE_MSGID_SUSP2 = Message-Id is $lt;LETTERS-digits@letters$gt;

SARE_HELO_AOLID = Spam passed through apparent spammer relay

SARE_RECV_ADDR2 = Received header missing an FQDN, IP only.

SARE_RECV_ADDR3 = Received header contains an empty Received IP.

SARE_RECV_ADDR4 = Received contains unknown FQDN with possible HELO.

SARE_RECV_ADDR5 = RCVD header has no FQDN and a HELO.

SARE_RECV_CHAR_DSHDT = Strange dashes and dots in received line

SARE_RECV_ESMTP = Received header has forged lowercase 'esmtp' relay

SARE_RECV_RANDOM = Spam contains a random string in the received header

SARE_RECV_RND_NUMBER = Spam passed through iswest.net relay

SARE_RECV_WITH_X2 = Spam identified by a typo in the received header

SARE_RECV_IP_063111025 = Spam passed through possible spammer relay

SARE_RECV_IP_064095 = Spam passed through probable spammer relay

SARE_RECV_IP_064192191 = Passed through possible spammer relay or source

SARE_RECV_IP_081019 = Passed through possible spammer relay or source

SARE_RECV_IP_081095 = Spam passed through possible spammer relay

SARE_RECV_IP_142046 = Passed through possible spammer relay or source

SARE_RECV_IP_200203050 = Spam passed through possible spammer relay

SARE_RECV_IP_202064 = Spam passed through possible spammer relay

SARE_RECV_IP_211049 = Spam passed through possible spammer relay

SARE_RECV_IP_212164 = Spam passed through possible spammer relay

SARE_TOCC_MAILDOMN = Destination identifies this as a virus bounce

SARE_TOCC_SPAMWORD0 = Addressed to a bogus email address

SARE_XMAIL_BULK2 = Uses bulk mailer used by spammers

SARE_XMAIL_BULK4 = Uses bulk mailer name forged by viruses

SARE_BOUNDARY_01 = Spam tool pattern in MIME boundary

SARE_MULT_RATW_03 = Spammer sign in headers

SARE_HEAD_CONT_RNDCONT = Spam passed through iswest.net relay

SARE_HEAD_SUBJ_RAND = Subject is possibly random words

SARE_HEAD_TOCC_DEFHNDL = Spam passed through iswest.net relay

SARE_HEAD_XCANIT1 = Message headers used which identify spam

SARE_HEAD_XCANIT2 = Incomplete anti-spam headers signifying spam

SARE_HEAD_XORIP_IP = header points to probable spammer

SARE_HEAD_XPRI_RNDNUM = Spam passed through iswest.net relay

SARE_HEAD_HDR_XKRNL = fingerprint

SARE_HEAD_HDR_XSEQ = Rarely abused email header

SARE_HEAD_HDR_XCCDIAG = Message headers used which identify spam

SARE_HEAD_HDR_XCNTRY = Message headers used which identify spam

SARE_HEAD_HDR_XKASPAV = Message headers used which identify spam

SARE_HEAD_HDR_XMAILTH = Message headers used which identify spam

SARE_HEAD_HDR_XMSGID = Message headers used which identify spam

SARE_HEAD_HDR_XRETURN = Message headers used which identify spam

SARE_HEAD_HDR_XSMTPSV = Message headers used which identify spam

SARE_HEAD_HDR_XSYSTEM = Message headers used which identify spam

SARE_HEAD_HDR_XUMAIL = Message headers used which identify spam

SARE_HEAD_HDR_XUNOLOOK = Unique X-header found in the email

SARE_HEAD_HDR_XUNSUB = Message headers used which identify spam

SARE_BOUNDARY_MULTB = Content type boundary used in spam and viruses

SARE_FROM_DEBT = From debt spammer

SARE_FROM_DLL = Via a digit-letter-letter domain

SARE_FROM_MULTI_DASH = From domain has multiple consecutive hyphens

SARE_FROM_NONAME = from has no name on purpose

SARE_FROM_NUM_HOTML = Apparent spammer email address pattern

SARE_FROM_PHRASE = Sender name appears to be phrase rather than name

SARE_FROM_PRINTER = From user address seems to contain spam topic

SARE_FROM_QUOTE = From name/address has "quote" as part of it

SARE_FROM_SPAM_CHAR0a = Sender name has unexpected or invalid characters

SARE_FROM_SPAM_CHAR0b = Sender name has unexpected or invalid characters

SARE_FROM_SPAM_CHAR5 = Sender name has an unlikely character string

SARE_FROM_SUPPORT_DIG = From user address is used by a spammer

SARE_FREE_WEBM_123 = Sender used free email account - may be spammer

SARE_FREE_WEBM_CZSEZNA = Sender used free email account - may be a spammer

SARE_FREE_WEBM_LAPOSTE = Maybe spammer with free email

SARE_FREE_WEBM_Purin = Sender used free email account - may be spammer

SARE_FREE_WEBM_RuMail = Sender used free email account - may be spammer

SARE_FREE_WEBM_Smapxsm = Sender used free email account - may be spammer

SARE_FREE_WEBM_SURIML = Sender used free email account - may be spammer

SARE_MSGID_LONG = Message ID is too long.

SARE_MSGID_LONG40 = Message-ID is a suspicious length

SARE_MSGID_LONG45 = Message-ID is a suspicious length

SARE_HELO_SENDER = Received header has possible spamsign

SARE_HELO_SERVER = Received header has possible spamsign

SARE_RECV_CHAR_CARAT = Received header has apparently invalid character

SARE_RECV_INFOSAT = Email passed through apparent spammer domain

SARE_RECV_SPAM_DOMN03 = Email passed through apparent spammer domain

SARE_RECV_SPAM_DOMN07 = Spam passed through noos.fr relay

SARE_RECV_SPAM_NAME1 = Email passed through probable spammer relay

SARE_RECV_SPAM_NAME2 = Spam passed through netvigator.com system

SARE_RECV_IP_066111 = Passed through possible spammer relay or source

SARE_RECV_IP_069194 = Spam passed through possible spammer relay

SARE_RECV_IP_080032 = Spam passed through possible spammer relay

SARE_RECV_IP_080040 = Spam passed through possible spammer relay

SARE_RECV_IP_080178 = Spam passed through possible spammer relay

SARE_RECV_IP_222126 = Passed through possible spammer relay or source

SARE_REPLY_SPAMWORD2 = Reply-To email address includes spam indicator word

SARE_XMAIL_BULK3a = Uses bulk mailer used by spammers

SARE_XMAIL_BULK5 = Uses ham mailer, sometimes abused

SARE_XMAIL_LCDD = Ratware mailer

SARE_XMAIL_SUSP3 = Contains a suspicious X-Mailer header

SARE_HEAD_DATE39 = Date header suggests this is spam

SARE_HEAD_DATE_ADDED = Original email had no date - added by a later system

SARE_HEAD_DATE_LONG1 = Date header has an interesting length

SARE_HEAD_XCOM_RFCMIN = AT&T Maillennium does not like this email

SARE_HEAD_8BIT_NOSPM = Header with 8-bit char suggests spam

SARE_HEAD_8BIT_SPAM = High-ASCII characters found in strange header

SARE_HEAD_8BIT_SPAM = High-ascii characters found in subject header

SARE_HTML_A_INV = HTML has malformed anchor/href tag

SARE_HTML_LINKWARN = Possible spam sign in HTML

SARE_HTML_FONT_LWORD = unusual document format

SARE_HTML_FONT_SPLIT = HTML bright font color tag split by blank lines

SARE_HTML_IMG_CID2 = table spam image

SARE_HTML_FLOAT1 = Contains HTML formatting used in spam

SARE_HTML_ORIG_MSG = Fake replied message?

SARE_HTML_SPANNER = spammer is a SARE_HTML_SPANNER

SARE_HTML_CALL_ME = spammer sign in text

SARE_PHISH_HTML_02 = numeric href with https description

SARE_PHISH_HTML_03 = numeric href with https description

SARE_HTML_HTML_QUOT = Message body has very strange HTML sequence

SARE_HTML_HTML_TBL = Message body has very strange HTML sequence

SARE_HTML_TITLE_1WD = strange document title

SARE_HTML_TITLE_2WD = strange document title

SARE_HTML_TITLE_DAY = HTML contains day of week in title

SARE_HTML_TITLE_LWORD = HTML Title contains looong word

SARE_HTML_A_BODY = Message body has very strange HTML sequence

SARE_HTML_FONT_EBEF = Message body has very strange HTML sequence

SARE_HTML_FONT_SPL = Message uses suspicious font size and/or color

SARE_HTML_URI_ESCWWW = URI with obfuscated destination

SARE_HTML_URI_LHOST30 = Long unbroken string within URI

SARE_HTML_URI_LHOST31 = Long unbroken string within URI

SARE_HTML_URI_NOMORE = URI to page name which suggests spammer's page

SARE_HTML_URI_OUTPHP = text uri to unsubscribe link

SARE_HTML_URI_PARTID = Partner Id in URL

SARE_HTML_CMT_CNTR = Message has a center followed by a comment

SARE_HTML_IMG_2AT = strange internal image link

SARE_HTML_IMG_ONLY = Short HTML msg, IMG and A HREF, maybe naught else

SARE_HTML_JVS_FLASH = Tries to load flash animation

SARE_HTML_INV_TAG = Message contains invalid HTML tag

SARE_HTML_CNTR_TBL = Contains centred table

SARE_HTML_SINGLETS = spam pattern in HTML email

SARE_HTML_USL_FONT = Another spam attempt

SARE_HTML_USL_OBFU = Message body has very strange HTML sequence

SARE_HTML_EHTML_OBFU = Phoney tag

SARE_HTML_POB1200 = Used by POB1200 Orangestad spammer

SARE_HTML_NOFRAMES = Body appears to hide anti-anti-spam text in frame

SARE_HTML_URI_GBYE = text has URL to spammer's unsubscribe link

SARE_HTML_URI_HIDADD = URI with obfuscated destination

SARE_HTML_URI_HIDE1 = URI attempts to hide destination domain

SARE_HTML_URI_LOGOGEN = Uses some logo generation software

SARE_HTML_URI_OC = Possible spammer sign in URL

SARE_HTML_URI_OFF = URI to page name which suggests spammer's page

SARE_HTML_HEAD_AFFIL = Affiliate in BOLD

SARE_HTML_ONE_LINE2 = standard spam formatting

SARE_HTML_ONE_LINE3 = Another single-line centered HTML message

SARE_HTML_LEAKTHRU1 = Another image-only spam

SARE_HTML_LEAKTHRU2 = Another image-only spam

SARE_HTML_USL_B7 = Multiple $lt;b$gt;$lt;/b$gt; (7-8)

SARE_HTML_USL_B9 = Multiple $lt;b$gt;$lt;/b$gt; (9-10)

SARE_HTML_CMT_MONEY = HTML Comment seems to mention money

SARE_HTML_GIF_NUM = HTML contains tracking numbers after .gif

SARE_HTML_BR_MANY = Too many sequential identical HTML tags

SARE_HTML_MANY_BR05 = Tooo many $lt;br$gt;'s!

SARE_HTML_JVS_POPUP = Bad HTML form. Tries to load a javascript pop up.

SARE_PHISH_HTML_01 = Hiding actual site with a fake secure site!

SARE_HTML_EMPTY = Email is HTML format, but common tags not found

SARE_HTML_BODY_END2 = Double $lt;/body$gt;

SARE_HTML_HTML_DBL = Message body has very strange HTML sequence

SARE_HTML_TITLE_MNY = HTML Title implies this may be spam

SARE_HTML_LANG_PTBR = Odd language

SARE_HTML_URI_DEFASP = URI to page name which suggests spammer's page

SARE_HTML_P_MANY3 = Too many empty paragraph tags in a row

SARE_HTML_USL_1CHAR = Invalid and empty 1-char tag - /tag combination

SARE_HTML_BODY_2SP = HTML tag is strangely formed

SARE_HTML_TD_BR = Multiple line breaks in spammer pattern

SARE_SPEC_SPAMARREST = probable invalid spam bounce

SARE_SPEC_ROLEX = Rolex watch spam

SARE_SPEC_ROLEX_REP = Rolex Replica

SARE_SPEC_ROLEX_SEL = Large selection of Rolex

SARE_SPEC_ROLEX_ORD = Order rolex

SARE_SPEC_ROLEX_ITAL = Italian Crafted Rolex

SARE_SPEC_ROLEX_PRICE = Rolex for only...

SARE_SPEC_ROLEX_BUY = Buy Rolex

SARE_SPEC_ROLEX_GENREP = Genuine Replica Rolex!

SARE_SPEC_ROLEX_CHEAP = Cheap Rolex!

SARE_SPEC_REPLICA_OBFU = Rolex with obfuscated replica

SARE_SPEC_ROLEX_AFFRD = Can you afford a Rolex?

SARE_SPEC_ROLEX_BRANDS = Spammer subject - multiple brands

SARE_SPEC_ROLEX_BRAND2 = Spammer subject - multiple brands

SARE_SPEC_ROLEX_HIQLT = replica watch spam sign

SARE_SPEC_ROLEX_NOV5A = replica watch spam sign

SARE_SPEC_ROLEX_NOV5B = replica watch spam sign

SARE_SPEC_ROLEX_NOV5D = replica watch spam sign

SARE_SPEC_ROLEX_NOV5E = replica watch spam sign

SARE_SPEC_ROLEX_NOV5F = replica watch spam sign

SARE_LOTTO_SPAM = Lottery Spam

SARE_LOTTO_SPAM2 = Lottery Spam

SARE_BODY_URI_STOCK = Signature of stock market spammer

SARE_SPEC_BODY_NONEED = No need to spam us!

SARE_SPEC_DIPLOMA = educational spam subject

SARE_SPEC_ANTIDOTE = Antidote spammer

SARE_SPEC_SPAMIS_FROM = Possibly from or via spammer system

SARE_SPEC_SPAMIS_RECV = Possibly from or via spammer system

SARE_SPEC_SPAMIS_BDY1 = Possibly from or via spammer system

SARE_SPEC_SPAMIS_BDY2 = Possibly from or via spammer system

SARE_SPEC_LEO_DOLLARS = Leo table drug spam

SARE_SPEC_LEO_DOLLARSa = Leo table drug spam

SARE_SPEC_LEO_COST = Table drug cost

SARE_SPEC_LEO_COSTa = Table drug cost

SARE_SPEC_LRD_COST_M1 = LEO drug pricing variations

SARE_SPEC_PROLEO_M1 = Leo drug spam signs

SARE_SPEC_PROLEO_M2 = Leo drug spam signs

SARE_SPEC_PROLEO_M2a = Leo drug spam signs

SARE_SPEC_LRD_COST_M2 = LEO drug pricing variations

SARE_SPEC_LEO_DRUGS = Vertical table drug spam

SARE_SPEC_LEO_MEDS = obfuscated subject body

SARE_SPEC_LEO_PHARM = obfuscated subject body

SARE_SPEC_LEO_PHARM2 = obfuscated subject body

SARE_SPEC_LEO_CHEM = obfuscated subject body

SARE_SPEC_LEO_LINE02 = common Leo body text

SARE_SPEC_LEO_LINE03a = common Leo body text

SARE_SPEC_LEO_LINE03b = common Leo body text

SARE_SPEC_LEO_LINE03e = common Leo body text

SARE_SPEC_LEO_LINE03f = common Leo body text

SARE_SPEC_LEO_LINE04 = common Leo body text

SARE_SPEC_LEO_LINE04d = common Leo body text

SARE_SPEC_LEO_PIE2 = pseudo-table-format spam

SARE_SPEC_REALLY_WORKS = spamsign for specific drug spammer

SARE_SPEC_REALLY_WORK2 = spamsign for specific drug spammer

SARE_SPEC_REALLY_WORK3 = spamsign for specific drug spammer

SARE_SPEC_REALLY_WORK4 = spamsign for specific drug spammer

SARE_SPEC_XXGEOCITIES2 = spamsign pointing to free webhost spam site

SARE_SPEC_XXGEOCITIES3 = spamsign pointing to free webhost spam site

SARE_SPEC_XXGEOCITIE5 = spamsign pointing to free webhost spam site

SARE_LEGIT_PAYPAL = Has signs it's from PayPal, from, headers, URI

SARE_FORGED_PAYPAL = Message appears to be forged, (paypal.com)

SARE_FORGED_EBAY = Message appears to be forged, (ebay.com)

SARE_FORGED_SUNTRUST = Message appears to be forged, (suntrust.com)

SARE_FORGED_CHASE = Message appears to be forged, (chase.com)

SARE_FORGED_CITI = Message appears to be forged, (citibank.com)

SARE_FORGED_PAYPAL_C = Has Paypal from, no Paypal received header.

SARE_FORGED_ABOUT = Message appears to be forged, (about.com)

SARE_SPOOF_OURI = URL has items in odd places

SARE_MLH_Stock1 = Subject mentions stock or stock-related words

SARE_MLH_Stock2 = Subject mentions microcap

SARE_MLB_Stock5 = Mentions stock symbol, tickers, or OTC.

SARE_MLB_Stock6 = ML obfuscated ticker symbols

SARE_MLH_Stock7 = Various common stock subjects

SARE_MLH_Stock8 = Platinum !!

SARE_MLH_Stock9 = Do I have your attention?

SARE_MLH_Stock10 = Yup, it's bull alright.

SARE_MLB_Stock11 = GOOD LUCK & TRADE OUT THE TOP

SARE_STOCK_MSG_ID2 = Msg ID 'thebat.net'

SARE_LW1933 = Reference to Securities Act

SARE_LWACT_QUICKLY = Spammer thinks you should hurry.

LW_STOCK_SPAM4 = Yup, its a spam!

SARE_PROLOSTOCK_SYM1 = Last week's hot stock scam

SARE_PROLOSTOCK_SYM2 = Last week's hot stock scam

SARE_PROLOSTOCK_SYM3 = Last week's hot stock scam

SARE_PROLOSTOCK_SYM4 = Last week's hot stock scam

SARE_GIF_ATTACH = Email has an inline gif

SARE_GIF_STOX = Inline Gif with little HTML

SARE_CSBIG = Only Spicy food gives me an Explosive Gain.

SARE_CSNUMTAG = Spamsign in header

SARE_CSTRADE5 = STOCK Attachments.

SARE_CSSM = Smart Money Equities

MY_CID_AND_ARIAL2 = SARE CID and Arial2

MY_CID_AND_CLOSING = SARE CID and closing

MY_CID_AND_STYLE = SARE CID and style

MY_CID_FONT = SARE CID and empty font

MY_CID_ARIAL2_CLOSING = SARE CID arial2 closing

MY_CID_ARIAL_STYLE = SARE CID arial2 style

SARE_ALC = Some header matches /improve your/i

SARE_SUBLRNMR = Learn more in Subject

SARE_SUBRATES = The Subject line talks about low rates

SARE_SUBSTOCK = Stock Market Spam

SARE_FWDLOOK = Forward-looking statements about stocks

SARE_XPNDMRKT = Talks about expanding your market

SARE_SELLYOUR = SELL * YOUR in caps

SARE_URGBIZ = Contains urgent matter

SARE_ONDEAL = Phrase, On this deal

SARE_NETPROD = Phrase, Internet Product.

SARE_GENUINEOP = Genuine oppurtunity

SARE_WEOFFER = Offers Something

SARE_LOANOFF = No one needs Loan officers anymore

SARE_DIPLOMA2 = Talks about online degrees or diplomas

SARE_FINCLOP = Talks about financial or internet opportunity.

SARE_MILLIONSOF = Millions of something.

SARE_MONEYTERMS = Talks about money in some way.

SARE_VALOFFR = Talks about valuable offers.

SARE_FASTAPPRV = Talks about quick approval

SARE_HOMELOAN = Home mortgage stuff

SARE_PRODUCT = Talks about product offerings.

SARE_NTWKMRKT = Network marketing, a pyramid scheme.

SARE_BIZOP = Biz op could be legit, but often isn't.

SARE_UNQBIZ = Talks about a unique business

SARE_DEGREETALK = Yaps about "legitimate" college degrees

SARE_SNAPSHUT = An open-and-shut case of Spam!

SARE_OBFUMONEY2 = masked spam word(s)

SARE_NONACCRED = Talks about a non-accredited something

SARE_COLLEGE_SCAM = Tries to sell you a "degree"

SARE_SNAPPYLOGOS = Get your free logos here! Only $49.95 each!!

SARE_RD_AOL = Has AOL Redirect URI

SARE_RD_YAHOO = Uses an insecure Yahoo redirect

SARE_RD_GOOGLE = Trying to hide real URL through Google redirect

SARE_RD_MSN = Uses MSN token redirect service

SARE_RD_HOTBOT = Uses hotbot redirect script

SARE_RD_GEN_A = Generic redirect spam uri

SARE_RD_GEN_B = Generic redirect spam uri

SARE_RD_TO_BAD_TLD = Redirect to bad TLD

SARE_RD_FROM_IP = Redirect from IP address

SARE_RD_TO_IP = Redirect to IP address

SARE_URI_EQUALS = Trying to hide the real URL with IE parsing bug

SARE_HEXOCTDWORD = Uses an encoded IP address

SARE_RD_SAFE_MKSHRT = SAFE Uses MakeAShorterLink redirector

SARE_RD_SAFE_GT = SAFE Uses google translator

SARE_RD_SAFE_TINY = SAFE Uses tinyURL redirector

SARE_RD_SAFE = Uses a safe redirector

SARE_FRAUD_X3 = Matches 3+ phrases commonly used in fraud spam

SARE_FRAUD_X4 = Matches 4+ phrases commonly used in fraud spam

SARE_FRAUD_X5 = Matches 5+ phrases commonly used in fraud spam

SARE_FRAUD_X6 = Matches 6+ phrases commonly used in fraud spam

VIRUS_WARNING1 = Unhelpful 'virus warning' (1)

VIRUS_WARNING2 = Unhelpful NAI Webshield 'virus warning' (2)

VIRUS_WARNING3 = Unhelpful Mail Marshal 'virus warning' (3)

VIRUS_WARNING4 = Unhelpful 'virus warning' (4)

VIRUS_WARNING4A = Unhelpful MailSweeper 'virus warning' (4A)

VIRUS_WARNING5 = Unhelpful 'virus warning' (5)

VIRUS_WARNING6 = Unhelpful InterScan 'virus warning' (6)

VIRUS_WARNING7 = Unhelpful 'virus warning' (7)

VIRUS_WARNING8 = Unhelpful 'virus warning' (8)

VIRUS_WARNING10 = Unhelpful Netpilot VPN 'virus warning' (10)

VIRUS_WARNING11 = Unhelpful MDaemon 'virus warning' (11)

VIRUS_WARNING12 = Unhelpful F-Secure 'virus warning' (12)

VIRUS_WARNING13 = Unhelpful Exim system_filter 'virus warning'? (13)

VIRUS_WARNING14 = Looks like Exim system_filter 'virus warning' (14)

VIRUS_WARNING_EXIM = Unhelpful Exim system_filter 'virus warning'

VIRUS_WARNING15 = Unhelpful MailScanner 'virus warning' (15)

VIRUS_WARNING16 = Unhelpful ScanMail/Exch 'virus warning' (16)

VIRUS_WARNING17 = Unhelpful Cisco 'virus warning' (17)

VIRUS_WARNING18 = Unhelpful 'virus warning' (18)

VIRUS_WARNING19 = Unhelpful Norton AntiVirus 'virus warning' (19)

VIRUS_WARNING21 = Unhelpful Antigen 'virus warning' (21)

VIRUS_WARNING22 = Unhelpful Panda Antivirus 'virus warning' (22)

VIRUS_WARNING23 = Unhelpful Panda Antivirus 'virus warning'? (23)

VIRUS_WARNING24 = Unhelpful AOL 'virus warning' (24)

VIRUS_WARNING25 = Unhelpful Network Associates 'virus warning' (25)

VIRUS_WARNING26 = Unhelpful 'virus warning' (26)

VIRUS_WARNING27 = Unhelpful Amavisd 'virus warning' (27)

VIRUS_WARNING28 = Unhelpful MailScanner 'virus warning' (28)

VIRUS_WARNING29 = Unhelpful Hungarian 'virus warning' (29)

VIRUS_WARNING30 = Unhelpful 'virus warning' (30)

VIRUS_WARNING31 = Unhelpful Declude Virus software warning (31)

VIRUS_WARNING32 = Unhelpful qmail-plugin virus warning (32)

VIRUS_WARNING33 = Unhelpful MailScanner virus warning (33)

VIRUS_WARNING34 = Unhelpful Symantec virus warning (34)

VIRUS_WARNING35 = Unhelpful BorderWare MXtreme virus warning (35)

VIRUS_WARNING36 = Unhelpful 'virus warning' (36)

VIRUS_WARNING37 = Unhelpful 'virus warning' (37)

VIRUS_WARNING39 = Unhelpful ScanMail 'virus warning' (39)

VIRUS_WARNING40 = Unhelpful 'virus warning' (40)

VIRUS_WARNING41 = Unhelpful 'virus warning' (41)

VIRUS_WARNING42 = Unhelpful RAV 'virus warning' (42)

VIRUS_WARNING44 = Unhelpful 'virus warning' (44)

VIRUS_WARNING45 = Unhelpful 'virus warning' (45)

VIRUS_WARNING46 = Unhelpful 'virus warning' (46)

VIRUS_WARNING47 = Unhelpful GroupShield/Exch 'virus warning' (47)

VIRUS_WARNING48 = Unhelpful McAfee 'virus warning' (48)

VIRUS_WARNING49 = Unhelpful 'virus warning' (49)

VIRUS_WARNING50 = Unhelpful 'virus warning' (50)

VIRUS_WARNING51 = Unhelpful 'virus warning' (51)

VIRUS_WARNING52 = Unhelpful 'virus warning' (52)

VIRUS_WARNING53 = Unhelpful 'virus warning' (53)

VIRUS_WARNING54 = Unhelpful 'virus warning' (54)

VIRUS_WARNING55 = Unhelpful SAV 'virus warning' (55)

VIRUS_WARNING56 = Unhelpful MailMarshal 'virus warning' (56)

VIRUS_WARNING57 = Unhelpful 'virus warning' (57)

VIRUS_WARNING58 = Unhelpful 'virus warning' (58)

VIRUS_WARNING59 = Unhelpful 'virus warning' (59)

VIRUS_WARNING60 = Unhelpful 'virus warning' (60)

VIRUS_WARNING61 = Unhelpful 'virus warning' (61)

VIRUS_WARNING62 = 'From' indicates unhelpful 'virus warning' (62)

VIRUS_WARNING62A = 'From' contains 'amavis'; 'virus warning'? (62A)

VIRUS_WARNING63 = 'From' strongly indicates 'virus warning' (63)

VIRUS_WARNING63A = 'From' strongly indicates 'virus warning' (63A)

VIRUS_WARNING63B = Unhelpful 'virus warning' (blacklisted) (63B)

VIRUS_WARNING65 = Unhelpful 'virus warning' (65)

VIRUS_WARNING66 = Unhelpful 'virus warning' (66)

VIRUS_WARNING67 = Unhelpful 'virus warning' (67)

VIRUS_WARNING68 = Unhelpful 'virus warning' (68)

VIRUS_WARNING70 = Unhelpful 'virus warning' (70)

VIRUS_WARNING71 = Unhelpful InterScan 'virus warning' (71)

VIRUS_WARNING72 = Unhelpful InterScan 'virus warning' (72)

VIRUS_WARNING73 = Unhelpful Mirapoint 'virus warning' (73)

VIRUS_WARNING74 = Unhelpful 'virus warning' (74)

VIRUS_WARNING75 = Unhelpful 'virus warning' (75)

VIRUS_WARNING76 = Unhelpful ScanMail 'virus warning' (76)

VIRUS_WARNING77 = Unhelpful 'virus warning' (77)

VIRUS_WARNING78 = Could be a bogus virus warning (78)

VIRUS_WARNING79 = Could be a bogus virus warning (79)

VIRUS_WARNING80 = Likely to be a bogus virus warning (80)

VIRUS_WARNING83 = Unhelpful ScanMail 'virus warning' (83)

VIRUS_WARNING87 = Unhelpful RAV 'virus warning' (87)

VIRUS_WARNING88 = Unhelpful McAfee 'virus warning' (88)

VIRUS_WARNING89 = Unhelpful 'virus warning' (89)

VIRUS_WARNING90 = Looks like unhelpful ScanMail 'virus warning' (90)

VIRUS_WARNING91 = Looks like unhelpful ScanMail 'virus warning' (91)

VIRUS_WARNING107 = Looks like an unhelpful 'virus warning' (107)

VIRUS_WARNING108 = Unhelpful WebShield 'virus warning' (108)

VIRUS_WARNING110 = Unhelpful MIMEsweeper 'virus warning'? (110)

VIRUS_WARNING111 = Unhelpful MIMEsweeper 'virus warning'? (111)

VIRUS_WARNING112 = Unhelpful Norton Antivirus 'virus warning' (112)

VIRUS_WARNING113 = Unhelpful Mydoom virus warning (113)

VIRUS_WARNING114 = Unhelpful RAV plugin 'virus warning' (114)

VIRUS_WARNING115 = Qmail bounce of unhelpful virus warning (115)

VIRUS_WARNING116 = Unhelpful Panda virus warning (116)

VIRUS_WARNING117 = Looks like MIMEDefang 'virus warning' (117)

VIRUS_WARNING117A = MIMEDefang modified message (117A)

VIRUS_WARNING117B = Unhelpful MIMEDefang 'virus warning' (117B)

VIRUS_WARNING_DEFANG = Unhelpful MIMEDefang 'virus warning'

VIRUS_WARNING118 = Unhelpful 'virus warning' (118)

VIRUS_WARNING119 = Unhelpful 'virus warning' (119)

VIRUS_WARNING120 = Unhelpful 'virus warning' (120)

VIRUS_WARNING121 = Unhelpful 'virus warning' (121)

VIRUS_WARNING122 = Unhelpful 'virus warning' (122)

VIRUS_WARNING123 = Unhelpful 'virus warning/ (123)

VIRUS_WARNING124 = Unhelpful Antigen 'virus warning' (124)

VIRUS_WARNING125 = Unhelpful 'virus warning' (125)

VIRUS_WARNING127 = Unhelpful Inflex 'virus warning' (127)

VIRUS_WARNING136 = Unhelpful Amavisd-new 'virus warning' [DE] (136)

VIRUS_WARNING138 = Unhelpful WorldSecure 'virus warning' (138)

VIRUS_WARNING142 = Unhelpful 'virus warning'

VIRUS_WARNING143 = Unhelpful BorderWare 'virus warning' (143)

VIRUS_WARNING144 = Unhelpful BorderWare 'virus warning'? (144)

VIRUS_WARNING145 = Unhelpful MailScanner 'virus warning' (145)

VIRUS_WARNING146 = Unhelpful 'virus warning' - HBOS/Halifax? (146)

VIRUS_WARNING148 = Unhelpful 'virus warning'- HBOS plc/Halifax (148)

VIRUS_WARNING149 = Unhelpful 'virus warning' (149)

VIRUS_WARNING150 = Probably a virus bounce (club-internet.fr) (150)

VIRUS_WARNING151 = McAfee/CommuniGate Pro 'virus warning' (151)

VIRUS_WARNING152 = Unhelpful McAfee plugin 'virus warning' (152)

VIRUS_WARNING153 = Unhelpful McAfee plugin 'virus warning'? (153)

VIRUS_WARNING154 = Unhelpful 'virus warning' (154)

VIRUS_WARNING155 = Unhelpful 'virus warning' (155)

VIRUS_WARNING156 = Unhelpful SurfControl 'virus warning' (156)

VIRUS_WARNING157 = Unhelpful SurfControl 'virus warning' (157)

VIRUS_WARNING158 = Unhelpful Declude 'virus warning' (158)

VIRUS_WARNING159 = Unhelpful eSafe 'virus warning' (159)

VIRUS_WARNING160 = Unhelpful eSafe 'virus warning' (160)

VIRUS_WARNING161 = Unhelpful 'virus warning' (161)

VIRUS_WARNING162 = Looks like unhelpful 'virus warning' (162)

VIRUS_WARNING162A = Looks like unhelpful 'virus warning' (162A)

VIRUS_WARNING163 = Unhelpful 'virus warning'? (163)

VIRUS_WARNING164 = Unhelpful Viruswall 'virus warning' (164)

VIRUS_WARNING165 = Unhelpful Viruswall 'virus warning'? (165)

VIRUS_WARNING166 = Unhelpful Viruswall 'virus warning'? (166)

VIRUS_WARNING167 = Unhelpful NAV 'virus warning' (167)

VIRUS_WARNING168 = Unhelpful NAV 'virus warning' (168)

VIRUS_WARNING169 = Unhelpful NAV 'virus warning' (169)

VIRUS_WARNING170 = Unhelpful Webshield 'attachment warning' (170)

VIRUS_WARNING171 = Unhelpful Webshield 'attachment warning' (171)

VIRUS_WARNING172 = Unhelpful MailMonitor 'virus warning' (172)

VIRUS_WARNING173 = Unhelpful Firstnet AV 'virus warning' (173)

VIRUS_WARNING174 = Unhelpful qmail-scanner 'virus warning' (174)

VIRUS_WARNING175 = Unhelpful Panda Antivirus 'virus warning' (175)

VIRUS_WARNING176 = Unhelpful Panda Antivirus 'virus warning' (176)

VIRUS_WARNING177 = Unhelpful Symantec for Domino 'virus warning'(177)

VIRUS_WARNING178 = Unhelpful Eclipse Internet 'virus warning' (178)

VIRUS_WARNING179 = Could be a bogus 'virus warning' (179)

VIRUS_WARNING180 = Unhelpful Norton AV Gateway 'virus warning' (180)

VIRUS_WARNING181 = Unhelpful 'virus warning' (181)

VIRUS_WARNING182 = Unhelpful 'virus warning'? (182)

VIRUS_WARNING183 = Unhelpful 'virus warning' (WebShield?) (183)

VIRUS_WARNING184 = Unhelpful ArmourPlate 'virus warning' (184)

VIRUS_WARNING185 = Unhelpful ArmourPlate 'virus warning' spam (185)

VIRUS_WARNING186 = Unhelpful WebShield 'virus warning' (186)

VIRUS_WARNING187 = Unhelpful WebShield 'virus warning' (187)

VIRUS_WARNING188 = Looks like unhelpful 'virus warning' (188)

VIRUS_WARNING189 = Unhelpful 'virus warning' (189)

VIRUS_WARNING190 = Unhelpful 'virus warning' (190)

VIRUS_WARNING191 = Unhelpful Wharf T&T 'virus warning' (191)

VIRUS_WARNING192 = Unhelpful 'virus warning' (192)

VIRUS_WARNING193 = Looks like unhelpful 'virus warning' (193)

VIRUS_WARNING194 = Looks like unhelpful 'virus warning' (194)

VIRUS_WARNING195 = Could be unhelpful 'virus warning' (195)

VIRUS_WARNING196 = Unhelpful 'virus warning' (196)

VIRUS_WARNING197 = Unhelpful 'virus warning' (197)

VIRUS_WARNING198 = Unhelpful qmail-scanner 'virus warning' (198)

VIRUS_WARNING199 = Unhelpful qmail-scanner 'virus warning' (199)

VIRUS_WARNING200 = Unhelpful 'virus warning' (200)

VIRUS_WARNING201 = Unhelpful 'virus warning' (201)

VIRUS_WARNING201A = Unhelpful 'virus warning' (201A)

VIRUS_WARNING202 = Unhelpful 'virus warning' (202)

VIRUS_WARNING203 = Unhelpful 'virus warning' (203)

VIRUS_WARNING203A = Unhelpful 'virus warning' (203A)

VIRUS_WARNING204 = Unhelpful 'virus warning' (204)

VIRUS_WARNING205 = Unhelpful 'virus warning' (205)

VIRUS_WARNING206 = Unhelpful 'virus warning' (206)

VIRUS_WARNING207 = Unhelpful RAV 'virus warning' (207)

VIRUS_WARNING208 = Unhelpful Kerio Mailserver 'virus warning' (208)

VIRUS_WARNING209 = Unhelpful Kerio Mailserver 'virus warning' (209)

VIRUS_WARNING210 = Unhelpful 'virus warning' (210)

VIRUS_WARNING211 = Unhelpful IcoMailServer 'virus warning' (211)

VIRUS_WARNING212 = Unhelpful IcoMailServer 'virus warning' (212)

VIRUS_WARNING213 = Unhelpful 'virus warning'

VIRUS_WARNING214 = Unhelpful NAVMSE 'virus warning' (214)

VIRUS_WARNING215 = Unhelpful NAV 'virus warning' (215)

VIRUS_WARNING216 = Unhelpful NAV 'virus warning' (216)

VIRUS_WARNING217 = Unhelpful NAV 'virus warning' (217)

VIRUS_WARNING218 = Unhelpful GroupShield 'virus warning'? (218)

VIRUS_WARNING218B = Definitely GroupShield 'virus warning' (218B)

VIRUS_WARNING219 = Unhelpful 'virus warning' (219)

VIRUS_WARNING220 = Unhelpful Kaspersky 'virus warning' (220)

VIRUS_WARNING221 = Could be unhelpful Kaspersky 'virus warning' (221)

VIRUS_WARNING222 = Could be unhelpful NAI 'virus warning' (222)

VIRUS_WARNING223 = Unhelpful eManager 'virus warning' (223)

VIRUS_WARNING224 = Unhelpful eManager 'virus warning'? (224)

VIRUS_WARNING225 = Unhelpful MAILsweeper 'virus warning' (225)

VIRUS_WARNING226 = Unhelpful MailScanner 'virus warning' (226)

VIRUS_WARNING227 = Unhelpful BT 'virus warning' (227)

VIRUS_WARNING228 = Unhelpful 'virus warning' (228)

VIRUS_WARNING229 = Unhelpful 'virus warning' (229)

VIRUS_WARNING229A = Don't double-count 228/229

VIRUS_WARNING230 = Unhelpful Dr. Web 'virus warning' (230)

VIRUS_WARNING231 = Looks like Dr. Web notification (231)

VIRUS_WARNING232 = Unhelpful 'virus warning' (232)

VIRUS_WARNING233 = Looks like unhelpful 'virus warning' (233)

VIRUS_WARNING234 = Looks like unhelpful 'virus warning' (234)

VIRUS_WARNING235 = Could be unhelpful 'virus warning' (235)

VIRUS_WARNING236 = Unhelpful 'virus warning' (236)

VIRUS_WARNING237 = Unhelpful BitDefender 'virus warning' (237)

VIRUS_WARNING238 = Unhelpful 'virus warning' (238)

VIRUS_WARNING239 = Unhelpful 'virus warning' (239)

VIRUS_WARNING240 = Unhelpful 'virus warning' (240)

VIRUS_WARNING241 = Unhelpful Interscan 'virus warning'? (241)

VIRUS_WARNING242 = Unhelpful ScanMail 'virus warning' (242)

VIRUS_WARNING243 = Unhelpful ScanMail 'virus warning' (243)

VIRUS_WARNING244 = Could be an unhelpful 'virus warning' (244)

VIRUS_WARNING245 = Unhelpful 'virus warning' (245)

VIRUS_WARNING246 = Unhelpful 'virus warning' (246)

VIRUS_WARNING247 = Unhelpful 'virus warning' (247)

VIRUS_WARNING248 = Unhelpful 'virus warning' (248)

VIRUS_WARNING249 = Unhelpful 'virus warning' (249)

VIRUS_WARNING250 = Some kind of MailScanner notification? (250)

VIRUS_WARNING251 = Unhelpful GroupShield/Exch 'virus warning' (251)

VIRUS_WARNING252 = Unhelpful GroupShield/Exch 'virus warning' (252)

VIRUS_WARNING253 = Asks you to check for viruses (253)

VIRUS_WARNING254 = Unhelpful 'virus warning' (254)

VIRUS_WARNING255 = Looks like unhelpful 'virus warning' (255)

VIRUS_WARNING256 = Could be unhelpful 'virus warning' (256)

VIRUS_WARNING257 = Unhelpful 'virus warning' (257)

VIRUS_WARNING258 = Unhelpful 'virus warning' (258)

VIRUS_WARNING259 = Unhelpful MailMarshal 'virus warning' (259)

VIRUS_WARNING260 = Unhelpful ScanMail/Exch 'virus warning' (260)

VIRUS_WARNING261 = Unhelpful 'virus warning' (261)

VIRUS_WARNING262 = Unhelpful 'virus warning'? (262)

VIRUS_WARNING263 = Unhelpful 'virus warning' (263)

VIRUS_WARNING264 = Unhelpful 'virus warning' (264)

VIRUS_WARNING265 = Unhelpful AOL bounce fake aol.com HELO (265)

VIRUS_WARNING265A = Looks like unhelpful AOL virus bounce (265A)

VIRUS_WARNING265B = AOL accept faked aol.com HELO (no PTR) (265B)

VIRUS_WARNING266 = Unhelpful Telenor 'virus warning' (266)

VIRUS_WARNING267 = Unhelpful Via Networks 'virus warning' (267)

VIRUS_WARNING268E = Looks like an unhelpful 'virus warning' (268E)

VIRUS_WARNING268H = Could be unhelpful 'virus warning' (268H)

VIRUS_WARNING269 = Unhelpful 'virus warning' (269)

VIRUS_WARNING270 = Unhelpful 'virus warning' (270)

VIRUS_WARNING271 = Unhelpful 'virus warning' (271)

VIRUS_WARNING272 = Unhelpful 'virus warning' (272)

VIRUS_WARNING273 = Unhelpful MailMonitor/Exch 'virus warning' (273)

VIRUS_WARNING274 = Unhelpful MIMEsweeper 'virus warning' (274)

VIRUS_WARNING275 = Unhelpful (MIMESweeper?) 'virus warning'? (275)

VIRUS_WARNING276 = Unhelpful MIMEsweeper 'virus warning'? (276)

VIRUS_WARNING277 = Unhelpful (MIMESweeper?) 'virus warning'? (277)

VIRUS_WARNING278 = Unhelpful Sophos/MIMEswp 'virus warning'? (277)

VIRUS_WARNING279 = Unhelpful 'virus warning' (279)

VIRUS_WARNING280 = Unhelpful eTrust/Domino 'virus warning' (280)

VIRUS_WARNING281 = Unhelpful 'virus warning' (281)

VIRUS_WARNING282 = Unhelpful 'virus warning' (282)

VIRUS_WARNING283 = Unhelpful Symantec 'virus warning' (283)

VIRUS_WARNING284 = Unhelpful 'virus warning' (284)

VIRUS_WARNING285 = Unhelpful 'virus warning' (285)

VIRUS_WARNING286 = Unhelpful 'virus warning' (286)

VIRUS_WARNING287 = Unhelpful 'virus warning' (287)

VIRUS_WARNING288 = Looks like unhelpful 'virus warning' (288)

VIRUS_WARNING289 = Unhelpful 'virus warning' (289)

VIRUS_WARNING290 = Unhelpful MailScan 'virus warning' (290)

VIRUS_WARNING291 = Unhelpful MailScan 'virus warning' (291)

VIRUS_WARNING292 = Unhelpful InterScan 'virus warning' (292)

VIRUS_WARNING293 = Unhelpful MAILsweeper 'virus warning' (293)

VIRUS_WARNING294 = Unhelpful SonicWALL 'virus warning' (294)

VIRUS_WARNING295 = Unhelpful 'virus warning' (295)

VIRUS_WARNING296 = Unhelpful 'virus warning' (296)

VIRUS_WARNING297 = Unhelpful 'virus warning' (297)

VIRUS_WARNING298 = Unhelpful Magic OnLine 'virus warning' (296)

VIRUS_WARNING299 = Unhelpful Norton Antivirus 'virus warning' (299)

VIRUS_WARNING300 = Unhelpful MailScanner 'virus warning' (300)

VIRUS_WARNING301 = Unhelpful GateLock 'virus warning' (301)

VIRUS_WARNING302 = Unhelpful Watchdog 'virus warning' (302)

VIRUS_WARNING303 = Unhelpful StormMail 'virus warning' (303)

VIRUS_WARNING304 = Unhelpful StormMail 'virus warning'? (304)

VIRUS_WARNING305 = Unhelpful 'virus warning' (305)

VIRUS_WARNING306 = Unhelpful 'virus warning' (306)

VIRUS_WARNING307 = Unhelpful 'virus warning' (307)

VIRUS_WARNING308 = Unhelpful Avast/Exch 'virus warning' (308)

VIRUS_WARNING309 = Unhelpful Avast/Exch 'virus warning' (309)

VIRUS_WARNING310 = Unhelpful 'virus warning' (310)

VIRUS_WARNING311 = Unhelpful 'virus warning' (311)

VIRUS_WARNING312 = Unhelpful Novell GroupWise 'virus warning' (312)

VIRUS_WARNING313 = Unhelpful eManager 'virus warning' (313)

VIRUS_WARNING314 = Unhelpful Kingsoft 'virus warning' (314)

VIRUS_WARNING315 = Could be an unhelpful 'virus warning' (315)

VIRUS_WARNING316 = Unhelpful 'virus warning' (316)

VIRUS_WARNING317 = Unhelpful 'virus warning' (317)

VIRUS_WARNING318 = Unhelpful 'virus warning' (318)

VIRUS_WARNING319 = Unhelpful 'virus warning' (319)

VIRUS_WARNING320 = Unhelpful TBS Virus Scan 'virus warning' (320)

VIRUS_WARNING321 = Unhelpful TBS Virus Scan 'virus warning' (321)

VIRUS_WARNING322A = Looks like unhelpful XWall 'virus warning' (322A)

VIRUS_WARNING322 = Unhelpful XWall 'virus warning' (322)

VIRUS_WARNING323 = Unhelpful 'virus warning' (323)

VIRUS_WARNING324 = Unhelpful 'virus warning' (324)

VIRUS_WARNING325 = Unhelpful 'virus warning' (325)

VIRUS_WARNING326 = Unhelpful MailScanner 'virus warning'? (326)

VIRUS_WARNING327 = Unhelpful MIMEDefang 'virus warning' (327)

VIRUS_WARNING328 = Unhelpful 'virus warning' (328)

VIRUS_WARNING329 = Unhelpful 'virus warning' (329)

VIRUS_WARNING330 = Unhelpful 'virus warning' (330)

VIRUS_WARNING331 = Unhelpful 'virus warning' (331)

VIRUS_WARNING332 = Unhelpful 'virus warning' (332)

VIRUS_WARNING333 = Unhelpful 'virus warning' (333)

VIRUS_WARNING334 = Unhelpful 'virus warning' (334)

VIRUS_WARNING335 = Unhelpful 'virus warning' (335)

VIRUS_WARNING336 = Could be unhelpful KAV 'virus warning' (336)

VIRUS_WARNING337 = Unhelpful Guinevere AV 'virus warning' (337)

VIRUS_WARNING338 = Unhelpful 'virus warning' (338)

VIRUS_WARNING339 = Unhelpful MailScanner 'virus warning' (339)

VIRUS_WARNING340 = Unhelpful MailScanner 'virus warning' (340)

VIRUS_WARNING341 = Unhelpful eTrust 'virus warning' (341)

VIRUS_WARNING342 = Unhelpful 'virus warning' (342)

VIRUS_WARNING343 = Unhelpful InterScan 'virus warning' (343)

VIRUS_WARNING344 = Unhelpful 'virus warning' (344)

VIRUS_WARNING345 = Unhelpful Guinevere 'virus warning' (345)

VIRUS_WARNING345A = Unhelpful Guinevere 'virus warning'? (345A)

VIRUS_WARNING345B = Unhelpful Guinevere 'virus warning' (345B)

VIRUS_WARNING346 = Unhelpful Guinevere 'virus warning' (346)

VIRUS_WARNING347 = Unhelpful KAV 'virus warning' (347)

VIRUS_WARNING348 = Unhelpful KAV 'virus warning'? (348)

VIRUS_WARNING349 = Unhelpful Panda Antivirus 'virus warning' (349)

VIRUS_WARNING350 = Unhelpful Panda Antivirus 'virus warning' (350)

VIRUS_WARNING351 = Unhelpful 'virus warning' (351)

VIRUS_WARNING352 = Unhelpful 'virus warning' (352)

VIRUS_WARNING353 = Unhelpful 'virus warning' (353)

VIRUS_WARNING354 = Unhelpful 'virus warning' (354)

VIRUS_WARNING355 = Unhelpful Lotus Notes 'virus warning' (355)

VIRUS_WARNING356 = Unhelpful 'virus warning' (356)

VIRUS_WARNING357 = Unhelpful 'virus warning' (357)

VIRUS_WARNING358 = Unhelpful 'virus warning' (358)

VIRUS_WARNING359 = Unhelpful 'virus warning' (359)

VIRUS_WARNING360 = Unhelpful 'virus warning' (360)

VIRUS_WARNING361 = Unhelpful 'virus warning' (361)

VIRUS_WARNING362 = Unhelpful 'virus warning' (361)

VIRUS_WARNING363 = Unhelpful AVAS 'virus warning' (363)

VIRUS_WARNING365 = Unhelpful 'virus warning' (365)

VIRUS_WARNING366 = Unhelpful 'virus warning' (366)

VIRUS_WARNING367 = Unhelpful 'virus warning' (367)

VIRUS_WARNING368 = Unhelpful 'virus warning' (368)

VIRUS_WARNING369 = Unhelpful 'virus warning' (369)

VIRUS_WARNING370 = Unhelpful ProScan 'virus warning' (370)

VIRUS_WARNING371 = Unhelpful 'virus warning' (371)

VIRUS_WARNING372 = Unhelpful 'virus warning' (372)

VIRUS_WARNING373 = Unhelpful 'virus warning' (373)

VIRUS_WARNING374 = Unhelpful 'virus warning' (374)

VIRUS_WARNING375 = Unhelpful 'virus warning' (375)

VIRUS_WARNING376 = Unhelpful 'virus warning' (376)

VIRUS_WARNING377 = Unhelpful 'virus warning' (377)

VIRUS_WARNING378 = Unhelpful 'virus warning' (378)

VIRUS_WARNING379 = Could be unhelpful 'virus warning' (379)

VIRUS_WARNING380 = Unhelpful 'virus warning' (380)

VIRUS_WARNING381 = Unhelpful 'virus warning' (381)

VIRUS_WARNING382 = Unhelpful HMV 'virus warning' (382)

VIRUS_WARNING383 = Unhelpful 'virus warning' (383)

VIRUS_WARNING384 = Unhelpful 'virus warning' (384)

VIRUS_WARNING385 = Unhelpful 'virus warning' (385)

VIRUS_WARNING386 = Unhelpful Mirapoint 'virus warning' (386)

VIRUS_WARNING387 = Unhelpful 'virus warning' (387)

VIRUS_WARNING388 = Unhelpful 'virus warning' (388)

VIRUS_WARNING389 = Unhelpful 'virus warning' (389)

VIRUS_WARNING390 = Unhelpful 'virus warning' (390)

VIRUS_WARNING391 = Unhelpful OdeiaVir 'virus warning' (391)

VIRUS_WARNING392 = Unhelpful 'virus warning' (392)

VIRUS_WARNING393 = Unhelpful 'virus warning' (393)

VIRUS_WARNING394 = Unhelpful 'virus warning' (394)

VIRUS_WARNING395 = MailMarshal bogus 'virus warning'? (395)

VIRUS_WARNING396 = Unhelpful McAfee 'virus warning' (396)

VIRUS_WARNING397 = Unhelpful 'virus warning' (397)

VIRUS_WARNING398 = Unhelpful 'virus warning' (398)

VIRUS_WARNING399 = Unhelpful 'virus warning' (399)

VIRUS_WARNING400 = Looks like unhelpful 'virus warning' (400)

VIRUS_WARNING401 = Unhelpful 'virus warning' (401)

VIRUS_WARNING402A = Looks like unhelpful 'virus warning' (402A)

VIRUS_WARNING402B = Looks like unhelpful 'virus warning' (402B)

VIRUS_WARNING402C = Looks a lot like unhelpful 'virus warning' (402C)

VIRUS_WARNING403 = Unhelpful 'virus warning' (403)

VIRUS_WARNING404 = Unhelpful 'virus warning' (404)

VIRUS_WARNING405 = Unhelpful WinProxy 'virus warning' (405)

VIRUS_WARNING406 = Unhelpful NOD32 'virus warning' (406)

VIRUS_WARNING407 = Unhelpful NOD32 'virus warning' (407)

VIRUS_WARNING408 = Unhelpful 'virus warning' (408)

VIRUS_WARNING409 = Unhelpful MDaemon 'virus warning' (409)

VIRUS_WARNING410 = Unhelpful MDaemon 'virus warning' (410)

VIRUS_WARNING411 = Unhelpful 'virus warning' (411)

VIRUS_WARNING412 = Unhelpful 'virus warning' (412)

VIRUS_WARNING413 = Unhelpful InterScan 'virus warning' (413)

VIRUS_WARNING414 = Unhelpful 'virus warning' (414)

VIRUS_WARNING415 = Unhelpful 'virus warning'? (415)

VIRUS_WARNING416 = Unhelpful 'virus warning' (416)

VIRUS_WARNING417 = Unhelpful 'virus warning'? (417)

VIRUS_WARNING418 = Unhelpful 'virus warning' (418)

VIRUS_WARNING419 = Unhelpful 'virus warning' (419)

VIRUS_WARNING420 = Unhelpful 'virus warning' (420)

VIRUS_WARNING421 = Unhelpful 'virus warning' (421)

VIRUS_WARNING422 = Unhelpful 'virus warning'? (422)

VIRUS_WARNING423 = Unhelpful 'virus warning'? (423)

VIRUS_WARNING424 = Unhelpful 'virus warning' (424)

VIRUS_WARNING425 = Unhelpful 'virus warning' (425)

VIRUS_WARNING426 = Unhelpful 'virus warning' (426)

VIRUS_WARNING427 = Unhelpful 'virus warning' (427)

VIRUS_WARNING428 = Unhelpful InteProtectNow! 'virus warning' (428)

VIRUS_WARNING429 = Unhelpful 'virus warning' (429)

VIRUS_WARNING430 = Unhelpful Iflex 'virus warning' (430)

VIRUS_WARNING431 = Unhelpful Norton 'virus warning' (431)

VIRUS_WARNING432 = Unhelpful Symantec 'virus warning' (432)

VIRUS_WARNING433 = Unhelpful 'virus warning'? (433)

VIRUS_WARNING434 = Unhelpful 'virus warning' (434)

VIRUS_WARNING435 = Unhelpful 'virus warning' (435)

VIRUS_WARNING436 = Unhelpful AntiVir MailGate 'virus warning' (436)

VIRUS_WARNING436a = Unhelpful 'virus warning' (436)

VIRUS_WARNING437 = Unhelpful Symantec 'virus warning' (437)

VIRUS_WARNING438 = Unhelpful 'virus warning' (438)

VIRUS_WARNING439 = Unhelpful Trend 'virus warning' (439)

VIRUS_WARNING440 = Unhelpful 'virus warning' (440)

VIRUS_WARNING441 = Unhelpful 'virus warning' (441)

VIRUS_WARNING442 = Unhelpful 'virus warning' (442)

VIRUS_WARNING443 = Unhelpful 'virus warning' (443)

VIRUS_WARNING444 = Unhelpful 'virus warning' (444)

VIRUS_WARNING445 = Unhelpful Norton 'virus warning' (445)

VIRUS_WARNING446 = Unhelpful 'virus warning' (446)

VIRUS_WARNING447 = Unhelpful Guinevere 'virus warning' (447)

VIRUS_WARNING448 = Unhelpful 'virus warning' (448)

VIRUS_WARNING449 = Unhelpful 'virus warning'? (449)

VIRUS_WARNING450 = Unhelpful 'virus warning' (450)

VIRUS_WARNING451 = Unhelpful 'virus warning'? (451)

VIRUS_WARNING452 = Unhelpful 'virus warning'? (452)

VIRUS_WARNING453 = Unhelpful virus warning (453)

VIRUS_WARNING454 = Unhelpful virus warning (454)

VIRUS_WARNING455 = Unhelpful virus warning (455)

VIRUS_WARNING456 = Unhelpful virus warning (456)

VIRUS_WARNING457 = Unhelpful virus warning (457)

VIRUS_WARNING458 = Unhelpful virus warning? (458)

VIRUS_WARNING459 = Unhelpful virus warning (459)

VIRUS_WARNING460 = Unhelpful virus warning (460)

VIRUS_WARNING461 = Unhelpful virus warning (461)

VIRUS_WARNING462 = Unhelpful virus warning (462)

VIRUS_WARNING463 = Unhelpful virus warning? (463)

VIRUS_WARNING464 = Unhelpful virus warning (464)

VIRUS_WARNING465 = Unhelpful virus warning (465)

VIRUS_WARNING466 = Unhelpful eScan virus warning (466)

VIRUS_WARNING467 = Unhelpful Panda virus warning (467)

VIRUS_WARNING468 = Unhelpful Juno virus warning (468)

VIRUS_WARNING469 = Unhelpful virus warning (468)

VIRUS_WARNING_EXE1 = Message appears to contain a Windows executable

VIRUS_WARNING_EXE2 = Message contains a UUencoded Windows executable

VIRUS_WARNING_SOBER = Looks like Sober virus or bounce thereof

VIRUS_WARNING_XXX1 = Unidentified virus or bounce thereof (2)

VIRUS_WARNING_NOVARG1 = Looks like Novarg virus

VIRUS_WARNING_NOVARG2 = Looks like Novarg virus bounce

VIRUS_WARNING_BAGLE1 = Could be a Bagle.B bounce

VIRUS_WARNING_BAGLE2 = Could be a Bagle.B bounce

VIRUS_WARNING_BAGLE3 = Looks like Bagle.Q/R virus/bounce

VIRUS_WARNING_NETSKY4 = Netsky virus bounce (subject matched)

VIRUS_WARNING_NETSKY4 = Looks like Netsky bounce (body attached password)

VIRUS_WARNING_NETSKY5A = Looks like Netsky/P bounce (5A)

VIRUS_WARNING_NETSKY5B = Looks like Netsky/P bounce (5B)

VIRUS_WARNING_NETSKY5 = Looks like Netsky/P bounce (5)

VIRUS_WARNING_MYDOOM1 = Body contains Mydoom text

VIRUS_WARNING_MYDOOM2 = Body contains Mydoom text

VIRUS_WARNING_MYDOOM3 = Body contains Mydoom text

TJ_EMPTY_SUBJECT = Empty subject. Could be a MyDoom bounce.

VIRUS_WARNING_MYDOOM5 = Body contains possible Mydoom attachment

VIRUS_WARNING_DOOM_BNC = Looks like a Mydoom bounce

VIRUS_CLEANED_SOBIG_F1 = Failed/cleaned Sobig/F infection? (1)

VIRUS_CLEANED_SOBIG_F2 = Failed/cleaned Sobig/F infection? (2)

VIRUS_CLEANED_1 = Failed/cleaned Sobig/F or Netsky/K infection? (1)

OLPD48H_Stockv3 = Talks rubbish stocks

BODY_BAD_WORDS = Impolite Words in Body

BODY_BAD_WORDS2 = Impolite TWO Words in Body

BODY_BAD_WORDS3 = Impolite THREE Words in Body

GERSP1 = Possible Stock Spam1

GERSP2 = Possible Stock Spam2

GERSP3 = Possible Stock Spam3

GERSP4 = Possible Stock Spam4

GERSP5 = Possible Stock Spam5

GERSPAM = New German Stock Example

WORK_HOME = People work at home

OLPD48H_Stockv3 = Talks rubbish stocks

BODY_BAD_WORDS = Impolite Words in Body

BODY_BAD_WORDS2 = Impolite TWO Words in Body

BODY_BAD_WORDS3 = Impolite THREE Words in Body

GERSP1 = Possible Stock Spam1

GERSP2 = Possible Stock Spam2

GERSP3 = Possible Stock Spam3

GERSP4 = Possible Stock Spam4

GERSP5 = Possible Stock Spam5

GERSPAM = New German Stock Example

WORK_HOME = People work at home

SOBER_P_SPAM = Spam from the Sober.P virus

FRANCHISE_JERRY = Jerry's Franchise Application or Request

SOMETLD_ARE_BAD_TLD = .PW & .LINK TLD Abuse

JMQ_REALESTATE = Real estate spam

JMQ_IPINFROM = Spam with IP in the from address

JMQ_PAYPAL2 = PayPal spam of the day

JMQ_RESUME3 = Yet more resume spam

JMQ_SPF_NEUTRAL_ALL = SPF set to ?all!

JMQ_IMPORTANT = Spam that thinks it is important

JMQ_TRACKER = Message uses image-based tracker

JMQ_WIRE = Attempt to steal money via wire transfer

JMQ_HEARINGLOSS = Spam for hearing loss solutions

JMQ_TRACKR = Spam for TrackR

JMQ_CONGRAT = Open attachment to claim your free spam

JMQ_PICKUP = spam that wants your number

JMQ_DROPBOX = Spam from what appears to be compromised dropbox accounts

JMQ_RESUME = Spam for bad attached resumes