Skip to main content

SpamTitan

SARE Rules
Abstract

SpamTitan uses an extensive set of first and third-party rules for capturing spam, including this comprehensive set of SARE rules.

  • SARE_ADLTSUB1 = Contains OBFU and "strong" adult words

  • SARE_ADLTSUB2 = Contains possible adult words

  • SARE_ADLTSUB3 = Apparent spam seems to contain porn subject

  • SARE_ADLTSUB4 = Apparent spam seems to contain porn subject

  • SARE_ADLTSUB5 = Apparent spam seems to contain porn subject

  • SARE_ADLTSUB6 = Apparent spam seems to contain porn subject

  • SARE_ADLTSUB7 = Apparent spam seems to contain porn subject

  • SARE_ADLTSUB8 = Apparent spam seems to contain porn subject

  • LW_PORN_HELLO = Standard 'hot chicks' line

  • SARE_ADULT1 = Contains adult material

  • SARE_ADULT2 = Contains adult material

  • SARE_BETTERORG = Talks about getting better orgasms

  • SARE_ENLRGYOUR = Talks about "enlarging" something

  • SARE_LRGPNS = Talks about a "bigger" appendage

  • SARE_PNSSIZE = Talks about the size of a male body part

  • SARE_SXLIFE = Talks about your sex life

  • SARE_BEASTUD = common spammer phrasing

  • SARE_BIGRMEMBER = mentions bigger body part

  • SARE_INLENGTH = common spammer phrasing

  • SARE_NOEMBARRASS = Wow, I won't be embarrassed anymore!

  • SARE_PLEASEPARTNR = common spammer phrasing

  • SARE_SUPERVIAGRA = mentions drug which is often subject of spam

  • SARE_ADLTDATING = Contains phrasing used by spammers

  • SARE_ADLTPRSNLS = Contains phrasing used by spammers

  • SARE_CHILDPRN1 = contains a reference to child porn

  • SARE_TOWRITE = Contains phrasing used by spammers

  • SARE_GETFCK = Contains phrasing used by spammers

  • SARE_BADGIRLS = Contains phrasing used by spammers

  • SARE_QLTYSINGLES = Contains phrasing seen in spam

  • SARE_STILLSINGLE = Contains phrasing used by spammers

  • SARE_HOUSEWIVES = Mentions housewives, as in porn or in-home biz

  • SARE_SCHLGRL = mentions schoolgirls, as in porn

  • SARE_ADLTOBFU = Contains OBFU adult material

  • SARE_OBFUENLARGE = masked spam word(s)

  • SARE_OBFUFCK2 = Apparent spam seems to contain porn subject

  • SARE_OBFUSEXUAL = masked spam word(s)

  • SARE_OBFUTESTO = masked spam word(s)

  • SARE_RPTLETTERS = Contains mis-spelled adult phrase(s)

  • SARE_SEXDRIVE = Talks about sex drive

  • SARE_BETTERSEX = Spammer phrasing in the body of the email

  • SARE_SEXENHANCER = mentions spam topic

  • SARE_BAYES_5x7 = Bayes poison 5x7

  • SARE_BAYES_5x8 = Bayes poison 5x8

  • SARE_BAYES_6x6 = Bayes poison 6x6

  • SARE_BAYES_6x7 = Bayes poison 6x7

  • SARE_BAYES_6x8 = Bayes poison 6x8

  • SARE_BAYES_7x5 = Bayes poison 7x5

  • SARE_BAYES_7x6 = Bayes poison 7x6

  • SARE_BAYES_7x7 = Bayes poison 7x7

  • SARE_BAYES_7x8 = Bayes poison 7x8

  • SARE_BAYES_8x5 = Bayes poison 8x5

  • SARE_BAYES_9x5 = Bayes poison 9+x5

  • SARE_EN_A_1XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_1XX_2 = Phone number or address pulled from spam

  • SARE_EN_A_2XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_3XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_4XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_5XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_6XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_7XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_8XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_9XX_1 = Phone number or address pulled from spam

  • SARE_EN_A_BOX_1 = Phone number or address pulled from spam

  • SARE_EN_A_INT_1 = Phone number or address pulled from spam

  • SARE_EN_N_X31_1 = Phone number or address pulled from spam

  • SARE_EN_N_2XX_1 = Phone number or address pulled from spam

  • SARE_EN_N_203_1 = Phone number or address pulled from spam

  • SARE_EN_N_212_1 = Phone number or address pulled from spam

  • SARE_EN_N_4XX_1 = Phone number or address pulled from spam

  • SARE_EN_N_5XX_1 = Phone number or address pulled from spam

  • SARE_EN_N_7XX_1 = Phone number or address pulled from spam

  • SARE_EN_N_800_1 = Phone number or address pulled from spam

  • SARE_EN_N_800_2_1 = Phone number or address pulled from spam

  • SARE_EN_N_800_3_1 = Phone number or address pulled from spam

  • SARE_EN_N_800_5_1 = Phone number or address pulled from spam

  • SARE_EN_N_800_8_1 = Phone number or address pulled from spam

  • SARE_EN_N_800_9_1 = Phone number or address pulled from spam

  • SARE_EN_N_866_1 = Phone number or address pulled from spam

  • SARE_EN_N_877_1 = Phone number or address pulled from spam

  • SARE_EN_N_888_1 = Phone number or address pulled from spam

  • SARE_EN_N_9XX_1 = Phone number or address pulled from spam

  • SARE_EN_N_X1X_1 = Phone number or address pulled from spam

  • SARE_SUB_FREE_PPV = Spammer subject - black market or scam

  • SARE_SUB_INC_ONLINE2 = Subject contains apparent spammer phrasing

  • SARE_SUB_NAME_STAR = Spammer subject - black market or scam

  • SARE_SUB_REPRESENT_REQ = Possible phishing subject

  • SARE_SUB_SINCERE = Spam topic found in the subject

  • SARE_SUB_NEW_CREDIT = Spammer subject - credit or money

  • SARE_SUB_WIPE_CLEAN = Subject will wipe something clean

  • SARE_SUB_CASINO_BONUS = Spammer subject - casinos

  • SARE_SUB_TERM_LIFE = Spammer subject - insurance

  • SARE_SUB_INCOME = Subject contains common spammer phrasing

  • SARE_SUB_OEMS = Spammer subject - multiple software vendors

  • SARE_SUB_24HOUR_SALE = Common spammer subject header -- sales

  • SARE_SUB_BUY_MEDS = Spammer subject - medical

  • SARE_SUB_FORGET_DOC = Spammer subject - medical

  • SARE_SUB_FREE_PRES = subject has likely spammer phrase or word

  • SARE_SUB_GIVE_SMILE = Common spammer subject

  • SARE_SUB_MALE_MUSCLE = Spammer subject - medical

  • SARE_SUB_MEDS_LEO = obfuscated subject header

  • SARE_SUB_NO_RX = no prescription needed

  • SARE_SUB_NUM_PILLS = Common spammer subject header -- medical

  • SARE_SUB_ONLINE_DRUG = Common spammer subject

  • SARE_SUB_PHARM_LEO = obfuscated subject header

  • SARE_SUB_PHARM_LEO2 = obfuscated subject header

  • SARE_SUB_REFILL_RX = Common spammer subject - medical

  • SARE_SUB_RENEW_VITAL = Common spammer subject

  • SARE_SUB_CHEAP = Subject matches common spam pattern

  • SARE_SUB_LIKE_YOU = subject has likely spammer phrase or word

  • SARE_SUB_PAYMENT = Subject matches common spam pattern

  • SARE_HEAD_HDR_CONVER = Message headers used which identify spam

  • SARE_HEAD_HDR_DISPNOP = Message headers used which identify spam

  • SARE_HEAD_HDR_LANG = Message headers used which identify spam

  • SARE_HEAD_HDR_NLETRID = Message headers used which identify spam

  • SARE_HEAD_HDR_PID = Message headers used which identify spam

  • SARE_HEAD_HDR_PREVNDR = Message headers used which identify spam

  • SARE_HEAD_HDR_XBNCETR = Message headers used which identify spam

  • SARE_HEAD_HDR_XCAMPIDZ = Message headers used which identify spam

  • SARE_HEAD_HDR_XCLIHST = Message headers used which identify spam

  • SARE_HEAD_HDR_XE = Message headers used which identify spam

  • SARE_HEAD_HDR_XCSIP = Message headers used which identify spam

  • SARE_HEAD_HDR_XEMAIL = Message headers used which identify spam

  • SARE_HEAD_HDR_XENCVER = Message headers used which identify spam

  • SARE_HEAD_HDR_XFIND = Message headers used which identify spam

  • SARE_HEAD_HDR_XGMAILA = Message headers used which identify spam

  • SARE_HEAD_HDR_XGMXAV = Message headers used which identify spam

  • SARE_HEAD_HDR_XIDSRVR = Message headers used which identify spam

  • SARE_HEAD_HDR_XRMDTXT = Message headers used which identify spam

  • SARE_HEAD_HDR_XRMVADR = Message headers used which identify spam

  • SARE_HEAD_HDR_XRSPCID = Message headers used which identify spam

  • SARE_HEAD_HDR_XRSPRID = Message headers used which identify spam

  • SARE_HEAD_HDR_XRSPUSR = Message headers used which identify spam

  • SARE_HEAD_HDR_XSPAMTST = Message headers used which identify spam

  • SARE_HEAD_HDR_XSPTRID = Message headers used which identify spam

  • SARE_HEAD_HDR_XUOLSRV = Message headers used which identify spam

  • SARE_HEAD_HDR_XWCMID = Message headers used which identify spam

  • SARE_HEAD_HDR_XWEBMTM = Message headers used which identify spam

  • SARE_BOUNDARY_02 = Too many ~'s in the boundary.

  • SARE_BOUNDARY_03 = Content type boundary used in spam or virus

  • SARE_BOUNDARY_10 = Possible spam flag

  • SARE_BOUNDARY_11 = Possible spam flag

  • SARE_BOUNDARY_12 = Possible spam flag

  • SARE_BOUNDARY_13 = Possible spam flag

  • SARE_BOUNDARY_D9 = Content type boundary used in spam or virus

  • SARE_BOUNDARY_D11 = Content type boundary used in spam or virus

  • SARE_BOUNDARY_D12 = Content type boundary used in spam or virus

  • SARE_BOUNDARY_ANYDIG = Content type boundary used in spam and viruses

  • SARE_BOUNDARY_QZSOFT = Identifies spam from specific spamware Marks Bad AOL Addresses

  • SARE_FROM_BADAOL = From an Invalid AOL Email Address

  • SARE_FROM_DRUGS = From a drug

  • SARE_FROM_HOODIA = From who do ya say?

  • SARE_FROM_PAYPAL_INV = From invalid address at PayPal

  • SARE_FROM_SPAM_NAME2 = From address suggests this is spam

  • SARE_FREE_WEBM_COMWALL = Maybe spammer with a free email

  • SARE_FREE_WEBM_Dora = Sender used free email account - may be spammer

  • SARE_FROM_WEBM_ERESMAS = Probable spammer

  • SARE_FREE_WEBM_EsTerra = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Kero = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_LATINML = Maybe spammer with free email

  • SARE_FREE_WEBM_OwnEm1 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_OwnEm2 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Uymail = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Zwallet = Sender used free email account - may be a spammer

  • SARE_MSGID_1Z1Z = Message-ID has ratware pattern (1zXXXX@1z)

  • SARE_MSGID_HEX30 = Message-ID has ratware pattern (HEXHEXHEX$9x9@)

  • SARE_HELO_MAILUSER = Received header has possible spamsign

  • SARE_RECV_LOCALHOST = fingerprint

  • SARE_RECV_SUSP_2 = Spammer sign in headers

  • SARE_RECV_TRADVALUES = From or passed through spammer/unreliable domain

  • SARE_RECV_VIPLIST = Email comes from known spammer system

  • SARE_RECV_XACTRIX = From/through probable spammer system

  • SARE_RECV_IP_004078 = Spam passed through possible spammer relay

  • SARE_RECV_IP_038112147 = Spam passed through possible spammer relay

  • SARE_RECV_IP_061052 = Spam passed through possible spammer relay

  • SARE_RECV_IP_061172 = Spam passed through possible spammer relay

  • SARE_RECV_IP_063106130 = Spam passed through possible spammer relay

  • SARE_RECV_IP_064069032 = Spam passed through possible spammer relay

  • SARE_RECV_IP_064192082 = Spam passed through possible spammer relay

  • SARE_RECV_IP_066059094 = Spam passed through possible spammer relay

  • SARE_RECV_IP_066063 = Passed through possible spammer relay or source

  • SARE_RECV_IP_066114a = Spam passed through possible spammer relay

  • SARE_RECV_IP_066159017 = Spam passed through possible spammer relay

  • SARE_RECV_IP_069060122 = Spam passed through possible spammer relay

  • SARE_RECV_IP_070096177 = Spam passed through possible spammer relay

  • SARE_RECV_IP_071004200 = Spam passed through possible spammer relay

  • SARE_RECV_IP_072034096 = Spam passed through possible spammer relay

  • SARE_RECV_IP_204010039 = Spam passed through possible spammer relay

  • SARE_RECV_IP_206081080 = Spam passed through possible spammer relay

  • SARE_RECV_IP_207182 = Passed through possible spammer relay or source

  • SARE_RECV_IP_208048182 = Spam passed through possible spammer relay

  • SARE_RECV_IP_208053011 = Spam passed through possible spammer relay

  • SARE_RECV_IP_216055133 = Spam passed through possible spammer relay

  • SARE_RECV_IP_218011 = Spam passed through Chinese CNCGROUP-HE system

  • SARE_RECV_IP_218062 = Passed through possible spammer relay or source

  • SARE_RECV_IP_218071 = Spam passed through possible spammer relay

  • SARE_RECV_IP_218085 = Passed through possible spammer relay or source

  • SARE_RECV_IP_219159 = Spam passed through possible spammer relay

  • SARE_RECV_IP_219248 = Passed through possible spammer relay or source

  • SARE_RECV_IP_220168 = Passed through possible spammer relay or source

  • SARE_RECV_IP_220189 = Passed through possible spammer relay or source

  • SARE_RECV_IP_221000 = Passed through possible spammer relay or source

  • SARE_RECV_IP_222032 = Spam passed through possible spammer relay

  • SARE_REPLY_XACTRIX = Reply-To email addr to spammer

  • SARE_TOCC_MULT_BIGFT5 = Sent to multiple bigfoot addresses

  • SARE_TOCC_MULT_BIGFT6 = Sent to multiple bigfoot addresses

  • SARE_TOCC_MULT_BIGFT7 = Sent to multiple bigfoot addresses

  • SARE_TOCC_MULT_BIGFT8 = Sent to multiple bigfoot addresses

  • SARE_TOCC_MULT_BIGFT9 = Sent to multiple bigfoot addresses

  • SARE_USERAG_2 = Strange user-agent header implying spam

  • SARE_USERAG_3 = Strange user-agent header implying spam

  • SARE_USERAG_BAT = Spamware pretending to be 'The Bat!'

  • SARE_USERAG_SPAM0 = Was sent by a SPAM User Agent

  • SARE_XMAIL_DIRUNIV = Apparently uses spam/bulk mailer

  • SARE_XMAIL_DYNAMAILER = Bulk email fingerprint (DynaMailer) found

  • SARE_XMAIL_FNORD = Recognized spam sign in xmail header

  • SARE_XMAIL_INTERMED = possible spamware

  • SARE_XMAIL_LEO = Spamsign in x-mailer header

  • SARE_XMAIL_PHPBulkEmai = Apparently uses spam/bulk mailer

  • SARE_XMAIL_RANDMAILER = only 1-3 lowercase words in X-mailer field

  • SARE_XMAIL_TTBOARD = X-Mailer used by spammer

  • SARE_HEAD_DATE46 = Date header suggests this is spam

  • SARE_HEAD_LOC_INV1 = Improper location

  • SARE_HEAD_MIME_INVALID = Invalid mime version

  • SARE_HEAD_MIME_PROD = Ratware MIME Version

  • SARE_HEAD_THRD_ALNUM = Spam fingerprint in the thread index

  • SARE_HEAD_XMF_AUTHSNDR = Headers contains spam sign

  • SARE_HEAD_XM4 = Contains spamsign header

  • SARE_HEAD_XMIMEO_MS = Ratware-misspelled header

  • SARE_HEAD_BDY_BOUNCES = Message header suggesting spam in body

  • SARE_HEAD_BAT_WEB = Webmail message ID, but The Bat! X-Mailer

  • SARE_MULT_BMASTGR = Directed to/from invalid address

  • SARE_MULT_FROM = Many from lines

  • SARE_MULT_SEXCLUB = Adult invitation spam

  • SARE_MULT_SUBJ = Many subject lines

  • SARE_HEAD_HDR_ALTREC = Message headers used which identify spam

  • SARE_HEAD_HDR_APPROV = Message headers used which identify spam

  • SARE_HEAD_HDR_AUTSUBD = Message headers used which identify spam

  • SARE_HEAD_HDR_DISCREC = Message headers used which identify spam

  • SARE_HEAD_HDR_MSGTYPE = Message headers used which identify spam

  • SARE_HEAD_HDR_X400RCV = Message headers used which identify spam

  • SARE_HEAD_HDR_XBBOUNC = Message headers used which identify spam

  • SARE_HEAD_HDR_XCNDINF = Message headers used which identify spam

  • SARE_HEAD_HDR_XENC = Message headers used which identify spam

  • SARE_HEAD_HDR_XIDKEY = Apparent spam sign in headers

  • SARE_HEAD_HDR_XLEGAL1 = Message headers used which identify spam

  • SARE_HEAD_HDR_XLEGAL2 = Message headers used which identify spam

  • SARE_HEAD_HDR_XLEGAL3 = Message headers used which identify spam

  • SARE_HEAD_HDR_XLEGAL4 = Message headers used which might identify spam

  • SARE_HEAD_HDR_XLISTAD = Message headers used which identify spam

  • SARE_HEAD_HDR_XMAILID = Message headers used which identify spam

  • SARE_HEAD_HDR_XMEBDOM = Message headers used which identify spam

  • SARE_HEAD_HDR_XMLRSRV = Message headers used which identify spam

  • SARE_HEAD_HDR_XRESPID = Message headers used which identify spam

  • SARE_HEAD_HDR_XRIPE = Message headers used which identify spam

  • SARE_HEAD_HDR_XSAFMMI = Message headers used which identify spam

  • SARE_HEAD_HDR_XSIDPRA = fingerprint

  • SARE_HEAD_HDR_XSIDRES = fingerprint

  • SARE_HEAD_HDR_XTID = Message headers used which identify spam

  • SARE_HEAD_HDR_XWTID = Message headers used which identify spam

  • SARE_HEAD_HDR_XWTVERS = Message headers used which identify spam

  • SARE_HEAD_ORIG_RECIP = Message header used which suggests spam

  • SARE_BOUNDARY_05 = Content type boundary used in spam

  • SARE_BOUNDARY_06 = Content type boundary used in spam

  • SARE_BOUNDARY_08 = Improbable MIME boundary format

  • SARE_BOUNDARY_D10 = Content type boundary used in spam or virus

  • SARE_BOUNDARY_LC = Content type boundary used in spam

  • SARE_BOUNDARY_NP2 = Content type boundary used in spam and viruses

  • SARE_FROM_AST = Invalid character in email address

  • SARE_FROM_CAPS_MSN = Ratware all-caps MSN from address

  • SARE_FROM_DRUGS2 = From a drug

  • SARE_FROM_DVDCOPY = From DVD abuse address

  • SARE_FROM_SPAM_DOMN0 = From address suggests this is spam

  • SARE_FROM_SPAM_DOMN0Y = From address suggests this is spam

  • SARE_FROM_SPAM_MONEY = From address suggests this is spam

  • SARE_FROM_SPAM_MONEY2 = From address suggests this is spam

  • SARE_FROM_SPAM_NAME0 = From address suggests this is spam

  • SARE_FROM_SPAM_PL1 = A lot of spam comes from here

  • SARE_FROM_SPAM_WORD2 = From address suggests this is spam

  • SARE_FREE_WEBM_BIGMAIL = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_FrVoila = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Jpop = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_MailD = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Mailexc = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_NETCITY = Maybe spammer with a free email

  • SARE_FREE_WEBM_NetFs = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_NetSafe = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Netster = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_PlTenbi = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom05 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Whoever = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_WOWMAIL = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom01 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom02 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom03 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom03B = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom04 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom06 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZCom07 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_ZZa001 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_SERV = Sent from Webmail server

  • SARE_MSGID_D1D1D2D16 = Message-ID has ratware pattern (9.9.99.9999999hex@

  • SARE_MSGID_D5D7 = Message-ID has ratware pattern (99999.9999999@)

  • SARE_MSGID_DDDASH = Message-ID has ratware pattern (9-, 9$, 99-)

  • SARE_MSGID_LONG50 = Exceedingly long message-id

  • SARE_MSGID_QMAIL1 = Contains spoofing message id

  • SARE_MSGID_RATWARE2 = Message-Id is $lt;digits.digits@letters$gt;

  • SARE_MSGID_SHORT = Message ID is too short to be valid.

  • SARE_HELO_YAHOO = Received header has spamsign

  • SARE_HEAD_8BIT_RECV = High-ASCII characters found in strange header

  • SARE_RECV_FEP5 = Message contains known spam format

  • SARE_RECV_FREESERVE = spam passed through system used by spammers

  • SARE_RECV_MDNETCOMBR = Came through/from sites used by spammer

  • SARE_RECV_PATMEDIA = Passed through possible spammer relay or source

  • SARE_RECV_PORTHELO_1 = Apparent Spamsign in Received header

  • SARE_RECV_PORTHELO_2 = Apparent Spamsign in Received header

  • SARE_RECV_PORTHELO_3 = Apparent Spamsign in Received header

  • SARE_RECV_RND_DATE = Spam passed through iswest.net relay

  • SARE_RECV_SKANOVA = From or passed through spammer/unreliable domain

  • SARE_RECV_SPAM_DOMN02 = Email passed through apparent spammer domain

  • SARE_RECV_SPAM_DOMN04 = Email passed through apparent spammer domain

  • SARE_RECV_SPAM_DOMN06 = Passed through possible spammer relay or source

  • SARE_RECV_SPAM_DOMN0a = Email passed through apparent spammer domain

  • SARE_RECV_SPAM_DOMN0b = Email passed through apparent spammer domain

  • SARE_RECV_SPEEDY_AR = Email passed through apparent spammer domain

  • SARE_RECV_UK2NET2 = Passed through possible spammer relay or source

  • SARE_RECV_VIRTUACOMBR = Came through/from site used by spammer

  • SARE_RECV_BEZEQINT_B = Came through/from site used by spammer

  • SARE_RECV_IP_FROMIP1 = Received line is IP address from IP address

  • SARE_RECV_IP_FROMIP3 = Received line is IP address from IP address

  • SARE_RECV_IP_061050 = Spam passed through possible spammer relay

  • SARE_RECV_IP_061072 = Passed through possible spammer relay or source

  • SARE_RECV_IP_061187 = Passed through possible spammer relay or source

  • SARE_RECV_IP_061190 = Spam passed through possible spammer relay

  • SARE_RECV_IP_061228 = Spam passed through possible spammer relay

  • SARE_RECV_IP_062023 = Passed through possible spammer relay or source

  • SARE_RECV_IP_065205157 = Spam passed through possible spammer relay

  • SARE_RECV_IP_064034 = Spam passed through possible spammer relay

  • SARE_RECV_IP_066017 = Passed through possible spammer relay or source

  • SARE_RECV_IP_066165224 = Spam passed through possible spammer relay

  • SARE_RECV_IP_066248154 = Spam passed through possible spammer relay

  • SARE_RECV_IP_069050210 = Spam passed through possible spammer relay

  • SARE_RECV_IP_069060096 = Spam passed through possible spammer relay

  • SARE_RECV_IP_082080 = Spam passed through possible spammer relay

  • SARE_RECV_IP_082102 = Spam passed through possible spammer relay

  • SARE_RECV_IP_082154 = Passed through possible spammer relay or source

  • SARE_RECV_IP_083028 = Passed through possible spammer relay or source

  • SARE_RECV_IP_140117 = Passed through possible spammer relay or source

  • SARE_RECV_IP_163125 = Spam passed through possible spammer relay

  • SARE_RECV_IP_192116 = Passed through possible spammer relay or source

  • SARE_RECV_IP_195229 = Passed through possible spammer relay or source

  • SARE_RECV_IP_200150 = Spam passed through possible spammer relay

  • SARE_RECV_IP_203210128 = Spam passed through possible spammer relay

  • SARE_RECV_IP_203177 = Passed through possible spammer relay or source

  • SARE_RECV_IP_206131 = Spam passed through possible spammer relay

  • SARE_RECV_IP_206248152 = Spam passed through possible spammer relay

  • SARE_RECV_IP_209051 = Spam passed through possible spammer relay

  • SARE_RECV_IP_209190 = Spam passed through possible spammer relay

  • SARE_RECV_IP_216118120 = Spam passed through possible spammer relay

  • SARE_RECV_IP_211216 = Passed through possible spammer relay or source

  • SARE_RECV_IP_212068 = Spam passed through possible spammer relay

  • SARE_RECV_IP_216022 = Spam passed through possible spammer relay

  • SARE_RECV_IP_218070 = Spam passed through possible spammer relay

  • SARE_RECV_IP_218072 = Spam passed through possible spammer relay

  • SARE_RECV_IP_218078 = Passed through possible spammer relay or source

  • SARE_RECV_IP_218088 = Passed through possible spammer relay or source

  • SARE_RECV_IP_218216 = Passed through possible spammer relay or source

  • SARE_RECV_IP_219128 = Passed through possible spammer relay or source

  • SARE_RECV_IP_220116 = Passed through possible spammer relay or source

  • SARE_RECV_IP_221124 = Spam passed through possible spammer relay

  • SARE_RECV_IP_222000 = Passed through possible spammer relay or source

  • SARE_RECV_IP_222064 = Spam passed through possible spammer relay

  • SARE_TO_EMPTY = To address is set to empty

  • SARE_XMAIL_GDI = Ratware mailer

  • SARE_XMAIL_GOMAIL = Apparently uses spam/bulk mailer

  • SARE_XMAIL_PSSMAILER = Apparently uses bulk mailer

  • SARE_XMAIL_RLSP = Uses Bulk Mailer used by spammers

  • SARE_XMAIL_TOLMAIL = X-Mailer used by spammer

  • SARE_HEAD_DATE_5L = Date header ends in 5+ letters

  • SARE_HEAD_DATE_RNDDATE = Spam passed through iswest.net relay

  • SARE_HEAD_MSMPR_RNDSTR = Spam passed through iswest.net relay

  • SARE_HEAD_ORG_PREFIXW = Spam sign in Organization header

  • SARE_HEAD_XLIB_INDY1 = Uses S/W version which has only been seen in spam

  • SARE_HEAD_XLIB_INDY2 = Uses S/W version which has only been seen in spam

  • SARE_HEAD_XUNSENT = Found spamsign header

  • SARE_HEAD_XWORD = Spam tool

  • SARE_HEAD_8BIT_DATE = High-ASCII characters found in strange header

  • SARE_MULT_VIA_CITIZNET = header references apparent spam source

  • SARE_HEAD_HDR_CONVWLS = Message headers used which identify spam

  • SARE_HEAD_HDR_EPATH = Message headers used which identify spam

  • SARE_HEAD_HDR_JLH = Message headers used which identify spam

  • SARE_HEAD_HDR_REDIRTO = Message headers used which identify spam

  • SARE_HEAD_HDR_ROT = Message headers used which identify spam

  • SARE_HEAD_HDR_RTNPATH = Message headers used which identify spam

  • SARE_HEAD_HDR_WCMSGID = Message headers used which identify spam

  • SARE_HEAD_HDR_X400MTI = Message headers used which identify spam

  • SARE_HEAD_HDR_XAR = Message headers used which identify spam

  • SARE_HEAD_HDR_XAUTGEN = Message headers used which identify spam

  • SARE_HEAD_HDR_XCROSS = Message headers used which identify spam

  • SARE_HEAD_HDR_XEMGBMS = Message headers used which identify spam

  • SARE_HEAD_HDR_XLC = Message headers used which identify spam

  • SARE_HEAD_HDR_XLIDCOD = Message headers used which identify spam

  • SARE_HEAD_HDR_XMISCID = Message headers used which identify spam

  • SARE_HEAD_HDR_XMLCIPH = Message headers used which identify spam

  • SARE_HEAD_HDR_XMLMSGI = Message headers used which identify spam

  • SARE_HEAD_HDR_XMAGDID = Message headers used which identify spam

  • SARE_HEAD_HDR_XMPM = Message headers used which identify spam

  • SARE_HEAD_HDR_XMS = Message headers used which identify spam

  • SARE_HEAD_HDR_XNOSPAM = Message headers used which identify spam

  • SARE_HEAD_HDR_XNTC = Message headers used which identify spam

  • SARE_HEAD_HDR_XPOPB4S = Message headers used which identify spam

  • SARE_HEAD_HDR_XPOPFLK = Message headers used which identify spam

  • SARE_HEAD_HDR_XPRIOMS = Message headers used which identify spam

  • SARE_HEAD_HDR_XPRIOMF = Message headers used which identify spam

  • SARE_HEAD_HDR_XPRIOMI = Message headers used which identify spam

  • SARE_HEAD_HDR_XPIROMC = Message headers used which identify spam

  • SARE_HEAD_HDR_XRBLTST = Message headers used which identify spam

  • SARE_HEAD_HDR_XREC = Message headers used which identify spam

  • SARE_HEAD_HDR_XSPAMSC = Message headers used which identify spam

  • SARE_HEAD_HDR_XSRK = Message headers used which identify spam

  • SARE_HEAD_HDR_XSUBID = Message headers used which identify spam

  • SARE_HEAD_HDR_XTRANS = Message headers used which identify spam

  • SARE_HEAD_HDR_XTXTCLS = Message headers used which identify spam

  • SARE_HEAD_HDR_XVIG = Message headers used which identify spam

  • SARE_HEAD_HDR_XYD = Message headers used which identify spam

  • SARE_HEAD_HDR_XI = Message headers used which identify spam

  • SARE_HEAD_HDR_XIM = Message headers used which identify spam

  • SARE_CONTENT_BITBITNUM = Unlikely content encoding

  • SARE_FROM_AMERICA = From user address is used by spammer

  • SARE_FROM_SPAM_DOMN2 = From address suggests this is spam

  • SARE_FROM_VIRUS1 = From address suggests this is a virus

  • SARE_FREE_WEBM_Iamfi = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_USACOPS = Maybe spammer with free email

  • SARE_MSGID_06D6 = Message-ID has ratware pattern (000009999$9)

  • SARE_MSGID_ALL_CAPHM = Ratware all-caps message-id

  • SARE_MSGID_ALL_CAPMS = Ratware all-caps message-id

  • SARE_MSGID_H7H4H4 = Message-ID has ratware pattern (7hex$4hex$4hex@)

  • SARE_MSGID_SPAM_DOMN0 = Message ID implies possible spammer relay

  • SARE_MSGID_SUSP2 = Message-Id is $lt;LETTERS-digits@letters$gt;

  • SARE_HELO_AOLID = Spam passed through apparent spammer relay

  • SARE_RECV_ADDR2 = Received header missing an FQDN, IP only.

  • SARE_RECV_ADDR3 = Received header contains an empty Received IP.

  • SARE_RECV_ADDR4 = Received contains unknown FQDN with possible HELO.

  • SARE_RECV_ADDR5 = RCVD header has no FQDN and a HELO.

  • SARE_RECV_CHAR_DSHDT = Strange dashes and dots in received line

  • SARE_RECV_ESMTP = Received header has forged lowercase 'esmtp' relay

  • SARE_RECV_RANDOM = Spam contains a random string in the received header

  • SARE_RECV_RND_NUMBER = Spam passed through iswest.net relay

  • SARE_RECV_WITH_X2 = Spam identified by a typo in the received header

  • SARE_RECV_IP_063111025 = Spam passed through possible spammer relay

  • SARE_RECV_IP_064095 = Spam passed through probable spammer relay

  • SARE_RECV_IP_064192191 = Passed through possible spammer relay or source

  • SARE_RECV_IP_081019 = Passed through possible spammer relay or source

  • SARE_RECV_IP_081095 = Spam passed through possible spammer relay

  • SARE_RECV_IP_142046 = Passed through possible spammer relay or source

  • SARE_RECV_IP_200203050 = Spam passed through possible spammer relay

  • SARE_RECV_IP_202064 = Spam passed through possible spammer relay

  • SARE_RECV_IP_211049 = Spam passed through possible spammer relay

  • SARE_RECV_IP_212164 = Spam passed through possible spammer relay

  • SARE_TOCC_MAILDOMN = Destination identifies this as a virus bounce

  • SARE_TOCC_SPAMWORD0 = Addressed to a bogus email address

  • SARE_XMAIL_BULK2 = Uses bulk mailer used by spammers

  • SARE_XMAIL_BULK4 = Uses bulk mailer name forged by viruses

  • SARE_BOUNDARY_01 = Spam tool pattern in MIME boundary

  • SARE_MULT_RATW_03 = Spammer sign in headers

  • SARE_HEAD_CONT_RNDCONT = Spam passed through iswest.net relay

  • SARE_HEAD_SUBJ_RAND = Subject is possibly random words

  • SARE_HEAD_TOCC_DEFHNDL = Spam passed through iswest.net relay

  • SARE_HEAD_XCANIT1 = Message headers used which identify spam

  • SARE_HEAD_XCANIT2 = Incomplete anti-spam headers signifying spam

  • SARE_HEAD_XORIP_IP = header points to probable spammer

  • SARE_HEAD_XPRI_RNDNUM = Spam passed through iswest.net relay

  • SARE_HEAD_HDR_XKRNL = fingerprint

  • SARE_HEAD_HDR_XSEQ = Rarely abused email header

  • SARE_HEAD_HDR_XCCDIAG = Message headers used which identify spam

  • SARE_HEAD_HDR_XCNTRY = Message headers used which identify spam

  • SARE_HEAD_HDR_XKASPAV = Message headers used which identify spam

  • SARE_HEAD_HDR_XMAILTH = Message headers used which identify spam

  • SARE_HEAD_HDR_XMSGID = Message headers used which identify spam

  • SARE_HEAD_HDR_XRETURN = Message headers used which identify spam

  • SARE_HEAD_HDR_XSMTPSV = Message headers used which identify spam

  • SARE_HEAD_HDR_XSYSTEM = Message headers used which identify spam

  • SARE_HEAD_HDR_XUMAIL = Message headers used which identify spam

  • SARE_HEAD_HDR_XUNOLOOK = Unique X-header found in the email

  • SARE_HEAD_HDR_XUNSUB = Message headers used which identify spam

  • SARE_BOUNDARY_MULTB = Content type boundary used in spam and viruses

  • SARE_FROM_DEBT = From debt spammer

  • SARE_FROM_DLL = Via a digit-letter-letter domain

  • SARE_FROM_MULTI_DASH = From domain has multiple consecutive hyphens

  • SARE_FROM_NONAME = from has no name on purpose

  • SARE_FROM_NUM_HOTML = Apparent spammer email address pattern

  • SARE_FROM_PHRASE = Sender name appears to be phrase rather than name

  • SARE_FROM_PRINTER = From user address seems to contain spam topic

  • SARE_FROM_QUOTE = From name/address has "quote" as part of it

  • SARE_FROM_SPAM_CHAR0a = Sender name has unexpected or invalid characters

  • SARE_FROM_SPAM_CHAR0b = Sender name has unexpected or invalid characters

  • SARE_FROM_SPAM_CHAR5 = Sender name has an unlikely character string

  • SARE_FROM_SUPPORT_DIG = From user address is used by a spammer

  • SARE_FREE_WEBM_123 = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_CZSEZNA = Sender used free email account - may be a spammer

  • SARE_FREE_WEBM_LAPOSTE = Maybe spammer with free email

  • SARE_FREE_WEBM_Purin = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_RuMail = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_Smapxsm = Sender used free email account - may be spammer

  • SARE_FREE_WEBM_SURIML = Sender used free email account - may be spammer

  • SARE_MSGID_LONG = Message ID is too long.

  • SARE_MSGID_LONG40 = Message-ID is a suspicious length

  • SARE_MSGID_LONG45 = Message-ID is a suspicious length

  • SARE_HELO_SENDER = Received header has possible spamsign

  • SARE_HELO_SERVER = Received header has possible spamsign

  • SARE_RECV_CHAR_CARAT = Received header has apparently invalid character

  • SARE_RECV_INFOSAT = Email passed through apparent spammer domain

  • SARE_RECV_SPAM_DOMN03 = Email passed through apparent spammer domain

  • SARE_RECV_SPAM_DOMN07 = Spam passed through noos.fr relay

  • SARE_RECV_SPAM_NAME1 = Email passed through probable spammer relay

  • SARE_RECV_SPAM_NAME2 = Spam passed through netvigator.com system

  • SARE_RECV_IP_066111 = Passed through possible spammer relay or source

  • SARE_RECV_IP_069194 = Spam passed through possible spammer relay

  • SARE_RECV_IP_080032 = Spam passed through possible spammer relay

  • SARE_RECV_IP_080040 = Spam passed through possible spammer relay

  • SARE_RECV_IP_080178 = Spam passed through possible spammer relay

  • SARE_RECV_IP_222126 = Passed through possible spammer relay or source

  • SARE_REPLY_SPAMWORD2 = Reply-To email address includes spam indicator word

  • SARE_XMAIL_BULK3a = Uses bulk mailer used by spammers

  • SARE_XMAIL_BULK5 = Uses ham mailer, sometimes abused

  • SARE_XMAIL_LCDD = Ratware mailer

  • SARE_XMAIL_SUSP3 = Contains a suspicious X-Mailer header

  • SARE_HEAD_DATE39 = Date header suggests this is spam

  • SARE_HEAD_DATE_ADDED = Original email had no date - added by a later system

  • SARE_HEAD_DATE_LONG1 = Date header has an interesting length

  • SARE_HEAD_XCOM_RFCMIN = AT&T Maillennium does not like this email

  • SARE_HEAD_8BIT_NOSPM = Header with 8-bit char suggests spam

  • SARE_HEAD_8BIT_SPAM = High-ASCII characters found in strange header

  • SARE_HEAD_8BIT_SPAM = High-ascii characters found in subject header

  • SARE_HTML_A_INV = HTML has malformed anchor/href tag

  • SARE_HTML_LINKWARN = Possible spam sign in HTML

  • SARE_HTML_FONT_LWORD = unusual document format

  • SARE_HTML_FONT_SPLIT = HTML bright font color tag split by blank lines

  • SARE_HTML_IMG_CID2 = table spam image

  • SARE_HTML_FLOAT1 = Contains HTML formatting used in spam

  • SARE_HTML_ORIG_MSG = Fake replied message?

  • SARE_HTML_SPANNER = spammer is a SARE_HTML_SPANNER

  • SARE_HTML_CALL_ME = spammer sign in text

  • SARE_PHISH_HTML_02 = numeric href with https description

  • SARE_PHISH_HTML_03 = numeric href with https description

  • SARE_HTML_HTML_QUOT = Message body has very strange HTML sequence

  • SARE_HTML_HTML_TBL = Message body has very strange HTML sequence

  • SARE_HTML_TITLE_1WD = strange document title

  • SARE_HTML_TITLE_2WD = strange document title

  • SARE_HTML_TITLE_DAY = HTML contains day of week in title

  • SARE_HTML_TITLE_LWORD = HTML Title contains looong word

  • SARE_HTML_A_BODY = Message body has very strange HTML sequence

  • SARE_HTML_FONT_EBEF = Message body has very strange HTML sequence

  • SARE_HTML_FONT_SPL = Message uses suspicious font size and/or color

  • SARE_HTML_URI_ESCWWW = URI with obfuscated destination

  • SARE_HTML_URI_LHOST30 = Long unbroken string within URI

  • SARE_HTML_URI_LHOST31 = Long unbroken string within URI

  • SARE_HTML_URI_NOMORE = URI to page name which suggests spammer's page

  • SARE_HTML_URI_OUTPHP = text uri to unsubscribe link

  • SARE_HTML_URI_PARTID = Partner Id in URL

  • SARE_HTML_CMT_CNTR = Message has a center followed by a comment

  • SARE_HTML_IMG_2AT = strange internal image link

  • SARE_HTML_IMG_ONLY = Short HTML msg, IMG and A HREF, maybe naught else

  • SARE_HTML_JVS_FLASH = Tries to load flash animation

  • SARE_HTML_INV_TAG = Message contains invalid HTML tag

  • SARE_HTML_CNTR_TBL = Contains centred table

  • SARE_HTML_SINGLETS = spam pattern in HTML email

  • SARE_HTML_USL_FONT = Another spam attempt

  • SARE_HTML_USL_OBFU = Message body has very strange HTML sequence

  • SARE_HTML_EHTML_OBFU = Phoney tag

  • SARE_HTML_POB1200 = Used by POB1200 Orangestad spammer

  • SARE_HTML_NOFRAMES = Body appears to hide anti-anti-spam text in frame

  • SARE_HTML_URI_GBYE = text has URL to spammer's unsubscribe link

  • SARE_HTML_URI_HIDADD = URI with obfuscated destination

  • SARE_HTML_URI_HIDE1 = URI attempts to hide destination domain

  • SARE_HTML_URI_LOGOGEN = Uses some logo generation software

  • SARE_HTML_URI_OC = Possible spammer sign in URL

  • SARE_HTML_URI_OFF = URI to page name which suggests spammer's page

  • SARE_HTML_HEAD_AFFIL = Affiliate in BOLD

  • SARE_HTML_ONE_LINE2 = standard spam formatting

  • SARE_HTML_ONE_LINE3 = Another single-line centered HTML message

  • SARE_HTML_LEAKTHRU1 = Another image-only spam

  • SARE_HTML_LEAKTHRU2 = Another image-only spam

  • SARE_HTML_USL_B7 = Multiple $lt;b$gt;$lt;/b$gt; (7-8)

  • SARE_HTML_USL_B9 = Multiple $lt;b$gt;$lt;/b$gt; (9-10)

  • SARE_HTML_CMT_MONEY = HTML Comment seems to mention money

  • SARE_HTML_GIF_NUM = HTML contains tracking numbers after .gif

  • SARE_HTML_BR_MANY = Too many sequential identical HTML tags

  • SARE_HTML_MANY_BR05 = Tooo many $lt;br$gt;'s!

  • SARE_HTML_JVS_POPUP = Bad HTML form. Tries to load a javascript pop up.

  • SARE_PHISH_HTML_01 = Hiding actual site with a fake secure site!

  • SARE_HTML_EMPTY = Email is HTML format, but common tags not found

  • SARE_HTML_BODY_END2 = Double $lt;/body$gt;

  • SARE_HTML_HTML_DBL = Message body has very strange HTML sequence

  • SARE_HTML_TITLE_MNY = HTML Title implies this may be spam

  • SARE_HTML_LANG_PTBR = Odd language

  • SARE_HTML_URI_DEFASP = URI to page name which suggests spammer's page

  • SARE_HTML_P_MANY3 = Too many empty paragraph tags in a row

  • SARE_HTML_USL_1CHAR = Invalid and empty 1-char tag - /tag combination

  • SARE_HTML_BODY_2SP = HTML tag is strangely formed

  • SARE_HTML_TD_BR = Multiple line breaks in spammer pattern

  • SARE_SPEC_SPAMARREST = probable invalid spam bounce

  • SARE_SPEC_ROLEX = Rolex watch spam

  • SARE_SPEC_ROLEX_REP = Rolex Replica

  • SARE_SPEC_ROLEX_SEL = Large selection of Rolex

  • SARE_SPEC_ROLEX_ORD = Order rolex

  • SARE_SPEC_ROLEX_ITAL = Italian Crafted Rolex

  • SARE_SPEC_ROLEX_PRICE = Rolex for only...

  • SARE_SPEC_ROLEX_BUY = Buy Rolex

  • SARE_SPEC_ROLEX_GENREP = Genuine Replica Rolex!

  • SARE_SPEC_ROLEX_CHEAP = Cheap Rolex!

  • SARE_SPEC_REPLICA_OBFU = Rolex with obfuscated replica

  • SARE_SPEC_ROLEX_AFFRD = Can you afford a Rolex?

  • SARE_SPEC_ROLEX_BRANDS = Spammer subject - multiple brands

  • SARE_SPEC_ROLEX_BRAND2 = Spammer subject - multiple brands

  • SARE_SPEC_ROLEX_HIQLT = replica watch spam sign

  • SARE_SPEC_ROLEX_NOV5A = replica watch spam sign

  • SARE_SPEC_ROLEX_NOV5B = replica watch spam sign

  • SARE_SPEC_ROLEX_NOV5D = replica watch spam sign

  • SARE_SPEC_ROLEX_NOV5E = replica watch spam sign

  • SARE_SPEC_ROLEX_NOV5F = replica watch spam sign

  • SARE_LOTTO_SPAM = Lottery Spam

  • SARE_LOTTO_SPAM2 = Lottery Spam

  • SARE_BODY_URI_STOCK = Signature of stock market spammer

  • SARE_SPEC_BODY_NONEED = No need to spam us!

  • SARE_SPEC_DIPLOMA = educational spam subject

  • SARE_SPEC_ANTIDOTE = Antidote spammer

  • SARE_SPEC_SPAMIS_FROM = Possibly from or via spammer system

  • SARE_SPEC_SPAMIS_RECV = Possibly from or via spammer system

  • SARE_SPEC_SPAMIS_BDY1 = Possibly from or via spammer system

  • SARE_SPEC_SPAMIS_BDY2 = Possibly from or via spammer system

  • SARE_SPEC_LEO_DOLLARS = Leo table drug spam

  • SARE_SPEC_LEO_DOLLARSa = Leo table drug spam

  • SARE_SPEC_LEO_COST = Table drug cost

  • SARE_SPEC_LEO_COSTa = Table drug cost

  • SARE_SPEC_LRD_COST_M1 = LEO drug pricing variations

  • SARE_SPEC_PROLEO_M1 = Leo drug spam signs

  • SARE_SPEC_PROLEO_M2 = Leo drug spam signs

  • SARE_SPEC_PROLEO_M2a = Leo drug spam signs

  • SARE_SPEC_LRD_COST_M2 = LEO drug pricing variations

  • SARE_SPEC_LEO_DRUGS = Vertical table drug spam

  • SARE_SPEC_LEO_MEDS = obfuscated subject body

  • SARE_SPEC_LEO_PHARM = obfuscated subject body

  • SARE_SPEC_LEO_PHARM2 = obfuscated subject body

  • SARE_SPEC_LEO_CHEM = obfuscated subject body

  • SARE_SPEC_LEO_LINE02 = common Leo body text

  • SARE_SPEC_LEO_LINE03a = common Leo body text

  • SARE_SPEC_LEO_LINE03b = common Leo body text

  • SARE_SPEC_LEO_LINE03e = common Leo body text

  • SARE_SPEC_LEO_LINE03f = common Leo body text

  • SARE_SPEC_LEO_LINE04 = common Leo body text

  • SARE_SPEC_LEO_LINE04d = common Leo body text

  • SARE_SPEC_LEO_PIE2 = pseudo-table-format spam

  • SARE_SPEC_REALLY_WORKS = spamsign for specific drug spammer

  • SARE_SPEC_REALLY_WORK2 = spamsign for specific drug spammer

  • SARE_SPEC_REALLY_WORK3 = spamsign for specific drug spammer

  • SARE_SPEC_REALLY_WORK4 = spamsign for specific drug spammer

  • SARE_SPEC_XXGEOCITIES2 = spamsign pointing to free webhost spam site

  • SARE_SPEC_XXGEOCITIES3 = spamsign pointing to free webhost spam site

  • SARE_SPEC_XXGEOCITIE5 = spamsign pointing to free webhost spam site

  • SARE_LEGIT_PAYPAL = Has signs it's from PayPal, from, headers, URI

  • SARE_FORGED_PAYPAL = Message appears to be forged, (paypal.com)

  • SARE_FORGED_EBAY = Message appears to be forged, (ebay.com)

  • SARE_FORGED_SUNTRUST = Message appears to be forged, (suntrust.com)

  • SARE_FORGED_CHASE = Message appears to be forged, (chase.com)

  • SARE_FORGED_CITI = Message appears to be forged, (citibank.com)

  • SARE_FORGED_PAYPAL_C = Has Paypal from, no Paypal received header.

  • SARE_FORGED_ABOUT = Message appears to be forged, (about.com)

  • SARE_SPOOF_OURI = URL has items in odd places

  • SARE_MLH_Stock1 = Subject mentions stock or stock-related words

  • SARE_MLH_Stock2 = Subject mentions microcap

  • SARE_MLB_Stock5 = Mentions stock symbol, tickers, or OTC.

  • SARE_MLB_Stock6 = ML obfuscated ticker symbols

  • SARE_MLH_Stock7 = Various common stock subjects

  • SARE_MLH_Stock8 = Platinum !!

  • SARE_MLH_Stock9 = Do I have your attention?

  • SARE_MLH_Stock10 = Yup, it's bull alright.

  • SARE_MLB_Stock11 = GOOD LUCK & TRADE OUT THE TOP

  • SARE_STOCK_MSG_ID2 = Msg ID 'thebat.net'

  • SARE_LW1933 = Reference to Securities Act

  • SARE_LWACT_QUICKLY = Spammer thinks you should hurry.

  • LW_STOCK_SPAM4 = Yup, its a spam!

  • SARE_PROLOSTOCK_SYM1 = Last week's hot stock scam

  • SARE_PROLOSTOCK_SYM2 = Last week's hot stock scam

  • SARE_PROLOSTOCK_SYM3 = Last week's hot stock scam

  • SARE_PROLOSTOCK_SYM4 = Last week's hot stock scam

  • SARE_GIF_ATTACH = Email has an inline gif

  • SARE_GIF_STOX = Inline Gif with little HTML

  • SARE_CSBIG = Only Spicy food gives me an Explosive Gain.

  • SARE_CSNUMTAG = Spamsign in header

  • SARE_CSTRADE5 = STOCK Attachments.

  • SARE_CSSM = Smart Money Equities

  • MY_CID_AND_ARIAL2 = SARE CID and Arial2

  • MY_CID_AND_CLOSING = SARE CID and closing

  • MY_CID_AND_STYLE = SARE CID and style

  • MY_CID_FONT = SARE CID and empty font

  • MY_CID_ARIAL2_CLOSING = SARE CID arial2 closing

  • MY_CID_ARIAL_STYLE = SARE CID arial2 style

  • SARE_ALC = Some header matches /improve your/i

  • SARE_SUBLRNMR = Learn more in Subject

  • SARE_SUBRATES = The Subject line talks about low rates

  • SARE_SUBSTOCK = Stock Market Spam

  • SARE_FWDLOOK = Forward-looking statements about stocks

  • SARE_XPNDMRKT = Talks about expanding your market

  • SARE_SELLYOUR = SELL * YOUR in caps

  • SARE_URGBIZ = Contains urgent matter

  • SARE_ONDEAL = Phrase, On this deal

  • SARE_NETPROD = Phrase, Internet Product.

  • SARE_GENUINEOP = Genuine oppurtunity

  • SARE_WEOFFER = Offers Something

  • SARE_LOANOFF = No one needs Loan officers anymore

  • SARE_DIPLOMA2 = Talks about online degrees or diplomas

  • SARE_FINCLOP = Talks about financial or internet opportunity.

  • SARE_MILLIONSOF = Millions of something.

  • SARE_MONEYTERMS = Talks about money in some way.

  • SARE_VALOFFR = Talks about valuable offers.

  • SARE_FASTAPPRV = Talks about quick approval

  • SARE_HOMELOAN = Home mortgage stuff

  • SARE_PRODUCT = Talks about product offerings.

  • SARE_NTWKMRKT = Network marketing, a pyramid scheme.

  • SARE_BIZOP = Biz op could be legit, but often isn't.

  • SARE_UNQBIZ = Talks about a unique business

  • SARE_DEGREETALK = Yaps about "legitimate" college degrees

  • SARE_SNAPSHUT = An open-and-shut case of Spam!

  • SARE_OBFUMONEY2 = masked spam word(s)

  • SARE_NONACCRED = Talks about a non-accredited something

  • SARE_COLLEGE_SCAM = Tries to sell you a "degree"

  • SARE_SNAPPYLOGOS = Get your free logos here! Only $49.95 each!!

  • SARE_RD_AOL = Has AOL Redirect URI

  • SARE_RD_YAHOO = Uses an insecure Yahoo redirect

  • SARE_RD_GOOGLE = Trying to hide real URL through Google redirect

  • SARE_RD_MSN = Uses MSN token redirect service

  • SARE_RD_HOTBOT = Uses hotbot redirect script

  • SARE_RD_GEN_A = Generic redirect spam uri

  • SARE_RD_GEN_B = Generic redirect spam uri

  • SARE_RD_TO_BAD_TLD = Redirect to bad TLD

  • SARE_RD_FROM_IP = Redirect from IP address

  • SARE_RD_TO_IP = Redirect to IP address

  • SARE_URI_EQUALS = Trying to hide the real URL with IE parsing bug

  • SARE_HEXOCTDWORD = Uses an encoded IP address

  • SARE_RD_SAFE_MKSHRT = SAFE Uses MakeAShorterLink redirector

  • SARE_RD_SAFE_GT = SAFE Uses google translator

  • SARE_RD_SAFE_TINY = SAFE Uses tinyURL redirector

  • SARE_RD_SAFE = Uses a safe redirector

  • SARE_FRAUD_X3 = Matches 3+ phrases commonly used in fraud spam

  • SARE_FRAUD_X4 = Matches 4+ phrases commonly used in fraud spam

  • SARE_FRAUD_X5 = Matches 5+ phrases commonly used in fraud spam

  • SARE_FRAUD_X6 = Matches 6+ phrases commonly used in fraud spam

  • VIRUS_WARNING1 = Unhelpful 'virus warning' (1)

  • VIRUS_WARNING2 = Unhelpful NAI Webshield 'virus warning' (2)

  • VIRUS_WARNING3 = Unhelpful Mail Marshal 'virus warning' (3)

  • VIRUS_WARNING4 = Unhelpful 'virus warning' (4)

  • VIRUS_WARNING4A = Unhelpful MailSweeper 'virus warning' (4A)

  • VIRUS_WARNING5 = Unhelpful 'virus warning' (5)

  • VIRUS_WARNING6 = Unhelpful InterScan 'virus warning' (6)

  • VIRUS_WARNING7 = Unhelpful 'virus warning' (7)

  • VIRUS_WARNING8 = Unhelpful 'virus warning' (8)

  • VIRUS_WARNING10 = Unhelpful Netpilot VPN 'virus warning' (10)

  • VIRUS_WARNING11 = Unhelpful MDaemon 'virus warning' (11)

  • VIRUS_WARNING12 = Unhelpful F-Secure 'virus warning' (12)

  • VIRUS_WARNING13 = Unhelpful Exim system_filter 'virus warning'? (13)

  • VIRUS_WARNING14 = Looks like Exim system_filter 'virus warning' (14)

  • VIRUS_WARNING_EXIM = Unhelpful Exim system_filter 'virus warning'

  • VIRUS_WARNING15 = Unhelpful MailScanner 'virus warning' (15)

  • VIRUS_WARNING16 = Unhelpful ScanMail/Exch 'virus warning' (16)

  • VIRUS_WARNING17 = Unhelpful Cisco 'virus warning' (17)

  • VIRUS_WARNING18 = Unhelpful 'virus warning' (18)

  • VIRUS_WARNING19 = Unhelpful Norton AntiVirus 'virus warning' (19)

  • VIRUS_WARNING21 = Unhelpful Antigen 'virus warning' (21)

  • VIRUS_WARNING22 = Unhelpful Panda Antivirus 'virus warning' (22)

  • VIRUS_WARNING23 = Unhelpful Panda Antivirus 'virus warning'? (23)

  • VIRUS_WARNING24 = Unhelpful AOL 'virus warning' (24)

  • VIRUS_WARNING25 = Unhelpful Network Associates 'virus warning' (25)

  • VIRUS_WARNING26 = Unhelpful 'virus warning' (26)

  • VIRUS_WARNING27 = Unhelpful Amavisd 'virus warning' (27)

  • VIRUS_WARNING28 = Unhelpful MailScanner 'virus warning' (28)

  • VIRUS_WARNING29 = Unhelpful Hungarian 'virus warning' (29)

  • VIRUS_WARNING30 = Unhelpful 'virus warning' (30)

  • VIRUS_WARNING31 = Unhelpful Declude Virus software warning (31)

  • VIRUS_WARNING32 = Unhelpful qmail-plugin virus warning (32)

  • VIRUS_WARNING33 = Unhelpful MailScanner virus warning (33)

  • VIRUS_WARNING34 = Unhelpful Symantec virus warning (34)

  • VIRUS_WARNING35 = Unhelpful BorderWare MXtreme virus warning (35)

  • VIRUS_WARNING36 = Unhelpful 'virus warning' (36)

  • VIRUS_WARNING37 = Unhelpful 'virus warning' (37)

  • VIRUS_WARNING39 = Unhelpful ScanMail 'virus warning' (39)

  • VIRUS_WARNING40 = Unhelpful 'virus warning' (40)

  • VIRUS_WARNING41 = Unhelpful 'virus warning' (41)

  • VIRUS_WARNING42 = Unhelpful RAV 'virus warning' (42)

  • VIRUS_WARNING44 = Unhelpful 'virus warning' (44)

  • VIRUS_WARNING45 = Unhelpful 'virus warning' (45)

  • VIRUS_WARNING46 = Unhelpful 'virus warning' (46)

  • VIRUS_WARNING47 = Unhelpful GroupShield/Exch 'virus warning' (47)

  • VIRUS_WARNING48 = Unhelpful McAfee 'virus warning' (48)

  • VIRUS_WARNING49 = Unhelpful 'virus warning' (49)

  • VIRUS_WARNING50 = Unhelpful 'virus warning' (50)

  • VIRUS_WARNING51 = Unhelpful 'virus warning' (51)

  • VIRUS_WARNING52 = Unhelpful 'virus warning' (52)

  • VIRUS_WARNING53 = Unhelpful 'virus warning' (53)

  • VIRUS_WARNING54 = Unhelpful 'virus warning' (54)

  • VIRUS_WARNING55 = Unhelpful SAV 'virus warning' (55)

  • VIRUS_WARNING56 = Unhelpful MailMarshal 'virus warning' (56)

  • VIRUS_WARNING57 = Unhelpful 'virus warning' (57)

  • VIRUS_WARNING58 = Unhelpful 'virus warning' (58)

  • VIRUS_WARNING59 = Unhelpful 'virus warning' (59)

  • VIRUS_WARNING60 = Unhelpful 'virus warning' (60)

  • VIRUS_WARNING61 = Unhelpful 'virus warning' (61)

  • VIRUS_WARNING62 = 'From' indicates unhelpful 'virus warning' (62)

  • VIRUS_WARNING62A = 'From' contains 'amavis'; 'virus warning'? (62A)

  • VIRUS_WARNING63 = 'From' strongly indicates 'virus warning' (63)

  • VIRUS_WARNING63A = 'From' strongly indicates 'virus warning' (63A)

  • VIRUS_WARNING63B = Unhelpful 'virus warning' (blacklisted) (63B)

  • VIRUS_WARNING65 = Unhelpful 'virus warning' (65)

  • VIRUS_WARNING66 = Unhelpful 'virus warning' (66)

  • VIRUS_WARNING67 = Unhelpful 'virus warning' (67)

  • VIRUS_WARNING68 = Unhelpful 'virus warning' (68)

  • VIRUS_WARNING70 = Unhelpful 'virus warning' (70)

  • VIRUS_WARNING71 = Unhelpful InterScan 'virus warning' (71)

  • VIRUS_WARNING72 = Unhelpful InterScan 'virus warning' (72)

  • VIRUS_WARNING73 = Unhelpful Mirapoint 'virus warning' (73)

  • VIRUS_WARNING74 = Unhelpful 'virus warning' (74)

  • VIRUS_WARNING75 = Unhelpful 'virus warning' (75)

  • VIRUS_WARNING76 = Unhelpful ScanMail 'virus warning' (76)

  • VIRUS_WARNING77 = Unhelpful 'virus warning' (77)

  • VIRUS_WARNING78 = Could be a bogus virus warning (78)

  • VIRUS_WARNING79 = Could be a bogus virus warning (79)

  • VIRUS_WARNING80 = Likely to be a bogus virus warning (80)

  • VIRUS_WARNING83 = Unhelpful ScanMail 'virus warning' (83)

  • VIRUS_WARNING87 = Unhelpful RAV 'virus warning' (87)

  • VIRUS_WARNING88 = Unhelpful McAfee 'virus warning' (88)

  • VIRUS_WARNING89 = Unhelpful 'virus warning' (89)

  • VIRUS_WARNING90 = Looks like unhelpful ScanMail 'virus warning' (90)

  • VIRUS_WARNING91 = Looks like unhelpful ScanMail 'virus warning' (91)

  • VIRUS_WARNING107 = Looks like an unhelpful 'virus warning' (107)

  • VIRUS_WARNING108 = Unhelpful WebShield 'virus warning' (108)

  • VIRUS_WARNING110 = Unhelpful MIMEsweeper 'virus warning'? (110)

  • VIRUS_WARNING111 = Unhelpful MIMEsweeper 'virus warning'? (111)

  • VIRUS_WARNING112 = Unhelpful Norton Antivirus 'virus warning' (112)

  • VIRUS_WARNING113 = Unhelpful Mydoom virus warning (113)

  • VIRUS_WARNING114 = Unhelpful RAV plugin 'virus warning' (114)

  • VIRUS_WARNING115 = Qmail bounce of unhelpful virus warning (115)

  • VIRUS_WARNING116 = Unhelpful Panda virus warning (116)

  • VIRUS_WARNING117 = Looks like MIMEDefang 'virus warning' (117)

  • VIRUS_WARNING117A = MIMEDefang modified message (117A)

  • VIRUS_WARNING117B = Unhelpful MIMEDefang 'virus warning' (117B)

  • VIRUS_WARNING_DEFANG = Unhelpful MIMEDefang 'virus warning'

  • VIRUS_WARNING118 = Unhelpful 'virus warning' (118)

  • VIRUS_WARNING119 = Unhelpful 'virus warning' (119)

  • VIRUS_WARNING120 = Unhelpful 'virus warning' (120)

  • VIRUS_WARNING121 = Unhelpful 'virus warning' (121)

  • VIRUS_WARNING122 = Unhelpful 'virus warning' (122)

  • VIRUS_WARNING123 = Unhelpful 'virus warning/ (123)

  • VIRUS_WARNING124 = Unhelpful Antigen 'virus warning' (124)

  • VIRUS_WARNING125 = Unhelpful 'virus warning' (125)

  • VIRUS_WARNING127 = Unhelpful Inflex 'virus warning' (127)

  • VIRUS_WARNING136 = Unhelpful Amavisd-new 'virus warning' [DE] (136)

  • VIRUS_WARNING138 = Unhelpful WorldSecure 'virus warning' (138)

  • VIRUS_WARNING142 = Unhelpful 'virus warning'

  • VIRUS_WARNING143 = Unhelpful BorderWare 'virus warning' (143)

  • VIRUS_WARNING144 = Unhelpful BorderWare 'virus warning'? (144)

  • VIRUS_WARNING145 = Unhelpful MailScanner 'virus warning' (145)

  • VIRUS_WARNING146 = Unhelpful 'virus warning' - HBOS/Halifax? (146)

  • VIRUS_WARNING148 = Unhelpful 'virus warning'- HBOS plc/Halifax (148)

  • VIRUS_WARNING149 = Unhelpful 'virus warning' (149)

  • VIRUS_WARNING150 = Probably a virus bounce (club-internet.fr) (150)

  • VIRUS_WARNING151 = McAfee/CommuniGate Pro 'virus warning' (151)

  • VIRUS_WARNING152 = Unhelpful McAfee plugin 'virus warning' (152)

  • VIRUS_WARNING153 = Unhelpful McAfee plugin 'virus warning'? (153)

  • VIRUS_WARNING154 = Unhelpful 'virus warning' (154)

  • VIRUS_WARNING155 = Unhelpful 'virus warning' (155)

  • VIRUS_WARNING156 = Unhelpful SurfControl 'virus warning' (156)

  • VIRUS_WARNING157 = Unhelpful SurfControl 'virus warning' (157)

  • VIRUS_WARNING158 = Unhelpful Declude 'virus warning' (158)

  • VIRUS_WARNING159 = Unhelpful eSafe 'virus warning' (159)

  • VIRUS_WARNING160 = Unhelpful eSafe 'virus warning' (160)

  • VIRUS_WARNING161 = Unhelpful 'virus warning' (161)

  • VIRUS_WARNING162 = Looks like unhelpful 'virus warning' (162)

  • VIRUS_WARNING162A = Looks like unhelpful 'virus warning' (162A)

  • VIRUS_WARNING163 = Unhelpful 'virus warning'? (163)

  • VIRUS_WARNING164 = Unhelpful Viruswall 'virus warning' (164)

  • VIRUS_WARNING165 = Unhelpful Viruswall 'virus warning'? (165)

  • VIRUS_WARNING166 = Unhelpful Viruswall 'virus warning'? (166)

  • VIRUS_WARNING167 = Unhelpful NAV 'virus warning' (167)

  • VIRUS_WARNING168 = Unhelpful NAV 'virus warning' (168)

  • VIRUS_WARNING169 = Unhelpful NAV 'virus warning' (169)

  • VIRUS_WARNING170 = Unhelpful Webshield 'attachment warning' (170)

  • VIRUS_WARNING171 = Unhelpful Webshield 'attachment warning' (171)

  • VIRUS_WARNING172 = Unhelpful MailMonitor 'virus warning' (172)

  • VIRUS_WARNING173 = Unhelpful Firstnet AV 'virus warning' (173)

  • VIRUS_WARNING174 = Unhelpful qmail-scanner 'virus warning' (174)

  • VIRUS_WARNING175 = Unhelpful Panda Antivirus 'virus warning' (175)

  • VIRUS_WARNING176 = Unhelpful Panda Antivirus 'virus warning' (176)

  • VIRUS_WARNING177 = Unhelpful Symantec for Domino 'virus warning'(177)

  • VIRUS_WARNING178 = Unhelpful Eclipse Internet 'virus warning' (178)

  • VIRUS_WARNING179 = Could be a bogus 'virus warning' (179)

  • VIRUS_WARNING180 = Unhelpful Norton AV Gateway 'virus warning' (180)

  • VIRUS_WARNING181 = Unhelpful 'virus warning' (181)

  • VIRUS_WARNING182 = Unhelpful 'virus warning'? (182)

  • VIRUS_WARNING183 = Unhelpful 'virus warning' (WebShield?) (183)

  • VIRUS_WARNING184 = Unhelpful ArmourPlate 'virus warning' (184)

  • VIRUS_WARNING185 = Unhelpful ArmourPlate 'virus warning' spam (185)

  • VIRUS_WARNING186 = Unhelpful WebShield 'virus warning' (186)

  • VIRUS_WARNING187 = Unhelpful WebShield 'virus warning' (187)

  • VIRUS_WARNING188 = Looks like unhelpful 'virus warning' (188)

  • VIRUS_WARNING189 = Unhelpful 'virus warning' (189)

  • VIRUS_WARNING190 = Unhelpful 'virus warning' (190)

  • VIRUS_WARNING191 = Unhelpful Wharf T&T 'virus warning' (191)

  • VIRUS_WARNING192 = Unhelpful 'virus warning' (192)

  • VIRUS_WARNING193 = Looks like unhelpful 'virus warning' (193)

  • VIRUS_WARNING194 = Looks like unhelpful 'virus warning' (194)

  • VIRUS_WARNING195 = Could be unhelpful 'virus warning' (195)

  • VIRUS_WARNING196 = Unhelpful 'virus warning' (196)

  • VIRUS_WARNING197 = Unhelpful 'virus warning' (197)

  • VIRUS_WARNING198 = Unhelpful qmail-scanner 'virus warning' (198)

  • VIRUS_WARNING199 = Unhelpful qmail-scanner 'virus warning' (199)

  • VIRUS_WARNING200 = Unhelpful 'virus warning' (200)

  • VIRUS_WARNING201 = Unhelpful 'virus warning' (201)

  • VIRUS_WARNING201A = Unhelpful 'virus warning' (201A)

  • VIRUS_WARNING202 = Unhelpful 'virus warning' (202)

  • VIRUS_WARNING203 = Unhelpful 'virus warning' (203)

  • VIRUS_WARNING203A = Unhelpful 'virus warning' (203A)

  • VIRUS_WARNING204 = Unhelpful 'virus warning' (204)

  • VIRUS_WARNING205 = Unhelpful 'virus warning' (205)

  • VIRUS_WARNING206 = Unhelpful 'virus warning' (206)

  • VIRUS_WARNING207 = Unhelpful RAV 'virus warning' (207)

  • VIRUS_WARNING208 = Unhelpful Kerio Mailserver 'virus warning' (208)

  • VIRUS_WARNING209 = Unhelpful Kerio Mailserver 'virus warning' (209)

  • VIRUS_WARNING210 = Unhelpful 'virus warning' (210)

  • VIRUS_WARNING211 = Unhelpful IcoMailServer 'virus warning' (211)

  • VIRUS_WARNING212 = Unhelpful IcoMailServer 'virus warning' (212)

  • VIRUS_WARNING213 = Unhelpful 'virus warning'

  • VIRUS_WARNING214 = Unhelpful NAVMSE 'virus warning' (214)

  • VIRUS_WARNING215 = Unhelpful NAV 'virus warning' (215)

  • VIRUS_WARNING216 = Unhelpful NAV 'virus warning' (216)

  • VIRUS_WARNING217 = Unhelpful NAV 'virus warning' (217)

  • VIRUS_WARNING218 = Unhelpful GroupShield 'virus warning'? (218)

  • VIRUS_WARNING218B = Definitely GroupShield 'virus warning' (218B)

  • VIRUS_WARNING219 = Unhelpful 'virus warning' (219)

  • VIRUS_WARNING220 = Unhelpful Kaspersky 'virus warning' (220)

  • VIRUS_WARNING221 = Could be unhelpful Kaspersky 'virus warning' (221)

  • VIRUS_WARNING222 = Could be unhelpful NAI 'virus warning' (222)

  • VIRUS_WARNING223 = Unhelpful eManager 'virus warning' (223)

  • VIRUS_WARNING224 = Unhelpful eManager 'virus warning'? (224)

  • VIRUS_WARNING225 = Unhelpful MAILsweeper 'virus warning' (225)

  • VIRUS_WARNING226 = Unhelpful MailScanner 'virus warning' (226)

  • VIRUS_WARNING227 = Unhelpful BT 'virus warning' (227)

  • VIRUS_WARNING228 = Unhelpful 'virus warning' (228)

  • VIRUS_WARNING229 = Unhelpful 'virus warning' (229)

  • VIRUS_WARNING229A = Don't double-count 228/229

  • VIRUS_WARNING230 = Unhelpful Dr. Web 'virus warning' (230)

  • VIRUS_WARNING231 = Looks like Dr. Web notification (231)

  • VIRUS_WARNING232 = Unhelpful 'virus warning' (232)

  • VIRUS_WARNING233 = Looks like unhelpful 'virus warning' (233)

  • VIRUS_WARNING234 = Looks like unhelpful 'virus warning' (234)

  • VIRUS_WARNING235 = Could be unhelpful 'virus warning' (235)

  • VIRUS_WARNING236 = Unhelpful 'virus warning' (236)

  • VIRUS_WARNING237 = Unhelpful BitDefender 'virus warning' (237)

  • VIRUS_WARNING238 = Unhelpful 'virus warning' (238)

  • VIRUS_WARNING239 = Unhelpful 'virus warning' (239)

  • VIRUS_WARNING240 = Unhelpful 'virus warning' (240)

  • VIRUS_WARNING241 = Unhelpful Interscan 'virus warning'? (241)

  • VIRUS_WARNING242 = Unhelpful ScanMail 'virus warning' (242)

  • VIRUS_WARNING243 = Unhelpful ScanMail 'virus warning' (243)

  • VIRUS_WARNING244 = Could be an unhelpful 'virus warning' (244)

  • VIRUS_WARNING245 = Unhelpful 'virus warning' (245)

  • VIRUS_WARNING246 = Unhelpful 'virus warning' (246)

  • VIRUS_WARNING247 = Unhelpful 'virus warning' (247)

  • VIRUS_WARNING248 = Unhelpful 'virus warning' (248)

  • VIRUS_WARNING249 = Unhelpful 'virus warning' (249)

  • VIRUS_WARNING250 = Some kind of MailScanner notification? (250)

  • VIRUS_WARNING251 = Unhelpful GroupShield/Exch 'virus warning' (251)

  • VIRUS_WARNING252 = Unhelpful GroupShield/Exch 'virus warning' (252)

  • VIRUS_WARNING253 = Asks you to check for viruses (253)

  • VIRUS_WARNING254 = Unhelpful 'virus warning' (254)

  • VIRUS_WARNING255 = Looks like unhelpful 'virus warning' (255)

  • VIRUS_WARNING256 = Could be unhelpful 'virus warning' (256)

  • VIRUS_WARNING257 = Unhelpful 'virus warning' (257)

  • VIRUS_WARNING258 = Unhelpful 'virus warning' (258)

  • VIRUS_WARNING259 = Unhelpful MailMarshal 'virus warning' (259)

  • VIRUS_WARNING260 = Unhelpful ScanMail/Exch 'virus warning' (260)

  • VIRUS_WARNING261 = Unhelpful 'virus warning' (261)

  • VIRUS_WARNING262 = Unhelpful 'virus warning'? (262)

  • VIRUS_WARNING263 = Unhelpful 'virus warning' (263)

  • VIRUS_WARNING264 = Unhelpful 'virus warning' (264)

  • VIRUS_WARNING265 = Unhelpful AOL bounce fake aol.com HELO (265)

  • VIRUS_WARNING265A = Looks like unhelpful AOL virus bounce (265A)

  • VIRUS_WARNING265B = AOL accept faked aol.com HELO (no PTR) (265B)

  • VIRUS_WARNING266 = Unhelpful Telenor 'virus warning' (266)

  • VIRUS_WARNING267 = Unhelpful Via Networks 'virus warning' (267)

  • VIRUS_WARNING268E = Looks like an unhelpful 'virus warning' (268E)

  • VIRUS_WARNING268H = Could be unhelpful 'virus warning' (268H)

  • VIRUS_WARNING269 = Unhelpful 'virus warning' (269)

  • VIRUS_WARNING270 = Unhelpful 'virus warning' (270)

  • VIRUS_WARNING271 = Unhelpful 'virus warning' (271)

  • VIRUS_WARNING272 = Unhelpful 'virus warning' (272)

  • VIRUS_WARNING273 = Unhelpful MailMonitor/Exch 'virus warning' (273)

  • VIRUS_WARNING274 = Unhelpful MIMEsweeper 'virus warning' (274)

  • VIRUS_WARNING275 = Unhelpful (MIMESweeper?) 'virus warning'? (275)

  • VIRUS_WARNING276 = Unhelpful MIMEsweeper 'virus warning'? (276)

  • VIRUS_WARNING277 = Unhelpful (MIMESweeper?) 'virus warning'? (277)

  • VIRUS_WARNING278 = Unhelpful Sophos/MIMEswp 'virus warning'? (277)

  • VIRUS_WARNING279 = Unhelpful 'virus warning' (279)

  • VIRUS_WARNING280 = Unhelpful eTrust/Domino 'virus warning' (280)

  • VIRUS_WARNING281 = Unhelpful 'virus warning' (281)

  • VIRUS_WARNING282 = Unhelpful 'virus warning' (282)

  • VIRUS_WARNING283 = Unhelpful Symantec 'virus warning' (283)

  • VIRUS_WARNING284 = Unhelpful 'virus warning' (284)

  • VIRUS_WARNING285 = Unhelpful 'virus warning' (285)

  • VIRUS_WARNING286 = Unhelpful 'virus warning' (286)

  • VIRUS_WARNING287 = Unhelpful 'virus warning' (287)

  • VIRUS_WARNING288 = Looks like unhelpful 'virus warning' (288)

  • VIRUS_WARNING289 = Unhelpful 'virus warning' (289)

  • VIRUS_WARNING290 = Unhelpful MailScan 'virus warning' (290)

  • VIRUS_WARNING291 = Unhelpful MailScan 'virus warning' (291)

  • VIRUS_WARNING292 = Unhelpful InterScan 'virus warning' (292)

  • VIRUS_WARNING293 = Unhelpful MAILsweeper 'virus warning' (293)

  • VIRUS_WARNING294 = Unhelpful SonicWALL 'virus warning' (294)

  • VIRUS_WARNING295 = Unhelpful 'virus warning' (295)

  • VIRUS_WARNING296 = Unhelpful 'virus warning' (296)

  • VIRUS_WARNING297 = Unhelpful 'virus warning' (297)

  • VIRUS_WARNING298 = Unhelpful Magic OnLine 'virus warning' (296)

  • VIRUS_WARNING299 = Unhelpful Norton Antivirus 'virus warning' (299)

  • VIRUS_WARNING300 = Unhelpful MailScanner 'virus warning' (300)

  • VIRUS_WARNING301 = Unhelpful GateLock 'virus warning' (301)

  • VIRUS_WARNING302 = Unhelpful Watchdog 'virus warning' (302)

  • VIRUS_WARNING303 = Unhelpful StormMail 'virus warning' (303)

  • VIRUS_WARNING304 = Unhelpful StormMail 'virus warning'? (304)

  • VIRUS_WARNING305 = Unhelpful 'virus warning' (305)

  • VIRUS_WARNING306 = Unhelpful 'virus warning' (306)

  • VIRUS_WARNING307 = Unhelpful 'virus warning' (307)

  • VIRUS_WARNING308 = Unhelpful Avast/Exch 'virus warning' (308)

  • VIRUS_WARNING309 = Unhelpful Avast/Exch 'virus warning' (309)

  • VIRUS_WARNING310 = Unhelpful 'virus warning' (310)

  • VIRUS_WARNING311 = Unhelpful 'virus warning' (311)

  • VIRUS_WARNING312 = Unhelpful Novell GroupWise 'virus warning' (312)

  • VIRUS_WARNING313 = Unhelpful eManager 'virus warning' (313)

  • VIRUS_WARNING314 = Unhelpful Kingsoft 'virus warning' (314)

  • VIRUS_WARNING315 = Could be an unhelpful 'virus warning' (315)

  • VIRUS_WARNING316 = Unhelpful 'virus warning' (316)

  • VIRUS_WARNING317 = Unhelpful 'virus warning' (317)

  • VIRUS_WARNING318 = Unhelpful 'virus warning' (318)

  • VIRUS_WARNING319 = Unhelpful 'virus warning' (319)

  • VIRUS_WARNING320 = Unhelpful TBS Virus Scan 'virus warning' (320)

  • VIRUS_WARNING321 = Unhelpful TBS Virus Scan 'virus warning' (321)

  • VIRUS_WARNING322A = Looks like unhelpful XWall 'virus warning' (322A)

  • VIRUS_WARNING322 = Unhelpful XWall 'virus warning' (322)

  • VIRUS_WARNING323 = Unhelpful 'virus warning' (323)

  • VIRUS_WARNING324 = Unhelpful 'virus warning' (324)

  • VIRUS_WARNING325 = Unhelpful 'virus warning' (325)

  • VIRUS_WARNING326 = Unhelpful MailScanner 'virus warning'? (326)

  • VIRUS_WARNING327 = Unhelpful MIMEDefang 'virus warning' (327)

  • VIRUS_WARNING328 = Unhelpful 'virus warning' (328)

  • VIRUS_WARNING329 = Unhelpful 'virus warning' (329)

  • VIRUS_WARNING330 = Unhelpful 'virus warning' (330)

  • VIRUS_WARNING331 = Unhelpful 'virus warning' (331)

  • VIRUS_WARNING332 = Unhelpful 'virus warning' (332)

  • VIRUS_WARNING333 = Unhelpful 'virus warning' (333)

  • VIRUS_WARNING334 = Unhelpful 'virus warning' (334)

  • VIRUS_WARNING335 = Unhelpful 'virus warning' (335)

  • VIRUS_WARNING336 = Could be unhelpful KAV 'virus warning' (336)

  • VIRUS_WARNING337 = Unhelpful Guinevere AV 'virus warning' (337)

  • VIRUS_WARNING338 = Unhelpful 'virus warning' (338)

  • VIRUS_WARNING339 = Unhelpful MailScanner 'virus warning' (339)

  • VIRUS_WARNING340 = Unhelpful MailScanner 'virus warning' (340)

  • VIRUS_WARNING341 = Unhelpful eTrust 'virus warning' (341)

  • VIRUS_WARNING342 = Unhelpful 'virus warning' (342)

  • VIRUS_WARNING343 = Unhelpful InterScan 'virus warning' (343)

  • VIRUS_WARNING344 = Unhelpful 'virus warning' (344)

  • VIRUS_WARNING345 = Unhelpful Guinevere 'virus warning' (345)

  • VIRUS_WARNING345A = Unhelpful Guinevere 'virus warning'? (345A)

  • VIRUS_WARNING345B = Unhelpful Guinevere 'virus warning' (345B)

  • VIRUS_WARNING346 = Unhelpful Guinevere 'virus warning' (346)

  • VIRUS_WARNING347 = Unhelpful KAV 'virus warning' (347)

  • VIRUS_WARNING348 = Unhelpful KAV 'virus warning'? (348)

  • VIRUS_WARNING349 = Unhelpful Panda Antivirus 'virus warning' (349)

  • VIRUS_WARNING350 = Unhelpful Panda Antivirus 'virus warning' (350)

  • VIRUS_WARNING351 = Unhelpful 'virus warning' (351)

  • VIRUS_WARNING352 = Unhelpful 'virus warning' (352)

  • VIRUS_WARNING353 = Unhelpful 'virus warning' (353)

  • VIRUS_WARNING354 = Unhelpful 'virus warning' (354)

  • VIRUS_WARNING355 = Unhelpful Lotus Notes 'virus warning' (355)

  • VIRUS_WARNING356 = Unhelpful 'virus warning' (356)

  • VIRUS_WARNING357 = Unhelpful 'virus warning' (357)

  • VIRUS_WARNING358 = Unhelpful 'virus warning' (358)

  • VIRUS_WARNING359 = Unhelpful 'virus warning' (359)

  • VIRUS_WARNING360 = Unhelpful 'virus warning' (360)

  • VIRUS_WARNING361 = Unhelpful 'virus warning' (361)

  • VIRUS_WARNING362 = Unhelpful 'virus warning' (361)

  • VIRUS_WARNING363 = Unhelpful AVAS 'virus warning' (363)

  • VIRUS_WARNING365 = Unhelpful 'virus warning' (365)

  • VIRUS_WARNING366 = Unhelpful 'virus warning' (366)

  • VIRUS_WARNING367 = Unhelpful 'virus warning' (367)

  • VIRUS_WARNING368 = Unhelpful 'virus warning' (368)

  • VIRUS_WARNING369 = Unhelpful 'virus warning' (369)

  • VIRUS_WARNING370 = Unhelpful ProScan 'virus warning' (370)

  • VIRUS_WARNING371 = Unhelpful 'virus warning' (371)

  • VIRUS_WARNING372 = Unhelpful 'virus warning' (372)

  • VIRUS_WARNING373 = Unhelpful 'virus warning' (373)

  • VIRUS_WARNING374 = Unhelpful 'virus warning' (374)

  • VIRUS_WARNING375 = Unhelpful 'virus warning' (375)

  • VIRUS_WARNING376 = Unhelpful 'virus warning' (376)

  • VIRUS_WARNING377 = Unhelpful 'virus warning' (377)

  • VIRUS_WARNING378 = Unhelpful 'virus warning' (378)

  • VIRUS_WARNING379 = Could be unhelpful 'virus warning' (379)

  • VIRUS_WARNING380 = Unhelpful 'virus warning' (380)

  • VIRUS_WARNING381 = Unhelpful 'virus warning' (381)

  • VIRUS_WARNING382 = Unhelpful HMV 'virus warning' (382)

  • VIRUS_WARNING383 = Unhelpful 'virus warning' (383)

  • VIRUS_WARNING384 = Unhelpful 'virus warning' (384)

  • VIRUS_WARNING385 = Unhelpful 'virus warning' (385)

  • VIRUS_WARNING386 = Unhelpful Mirapoint 'virus warning' (386)

  • VIRUS_WARNING387 = Unhelpful 'virus warning' (387)

  • VIRUS_WARNING388 = Unhelpful 'virus warning' (388)

  • VIRUS_WARNING389 = Unhelpful 'virus warning' (389)

  • VIRUS_WARNING390 = Unhelpful 'virus warning' (390)

  • VIRUS_WARNING391 = Unhelpful OdeiaVir 'virus warning' (391)

  • VIRUS_WARNING392 = Unhelpful 'virus warning' (392)

  • VIRUS_WARNING393 = Unhelpful 'virus warning' (393)

  • VIRUS_WARNING394 = Unhelpful 'virus warning' (394)

  • VIRUS_WARNING395 = MailMarshal bogus 'virus warning'? (395)

  • VIRUS_WARNING396 = Unhelpful McAfee 'virus warning' (396)

  • VIRUS_WARNING397 = Unhelpful 'virus warning' (397)

  • VIRUS_WARNING398 = Unhelpful 'virus warning' (398)

  • VIRUS_WARNING399 = Unhelpful 'virus warning' (399)

  • VIRUS_WARNING400 = Looks like unhelpful 'virus warning' (400)

  • VIRUS_WARNING401 = Unhelpful 'virus warning' (401)

  • VIRUS_WARNING402A = Looks like unhelpful 'virus warning' (402A)

  • VIRUS_WARNING402B = Looks like unhelpful 'virus warning' (402B)

  • VIRUS_WARNING402C = Looks a lot like unhelpful 'virus warning' (402C)

  • VIRUS_WARNING403 = Unhelpful 'virus warning' (403)

  • VIRUS_WARNING404 = Unhelpful 'virus warning' (404)

  • VIRUS_WARNING405 = Unhelpful WinProxy 'virus warning' (405)

  • VIRUS_WARNING406 = Unhelpful NOD32 'virus warning' (406)

  • VIRUS_WARNING407 = Unhelpful NOD32 'virus warning' (407)

  • VIRUS_WARNING408 = Unhelpful 'virus warning' (408)

  • VIRUS_WARNING409 = Unhelpful MDaemon 'virus warning' (409)

  • VIRUS_WARNING410 = Unhelpful MDaemon 'virus warning' (410)

  • VIRUS_WARNING411 = Unhelpful 'virus warning' (411)

  • VIRUS_WARNING412 = Unhelpful 'virus warning' (412)

  • VIRUS_WARNING413 = Unhelpful InterScan 'virus warning' (413)

  • VIRUS_WARNING414 = Unhelpful 'virus warning' (414)

  • VIRUS_WARNING415 = Unhelpful 'virus warning'? (415)

  • VIRUS_WARNING416 = Unhelpful 'virus warning' (416)

  • VIRUS_WARNING417 = Unhelpful 'virus warning'? (417)

  • VIRUS_WARNING418 = Unhelpful 'virus warning' (418)

  • VIRUS_WARNING419 = Unhelpful 'virus warning' (419)

  • VIRUS_WARNING420 = Unhelpful 'virus warning' (420)

  • VIRUS_WARNING421 = Unhelpful 'virus warning' (421)

  • VIRUS_WARNING422 = Unhelpful 'virus warning'? (422)

  • VIRUS_WARNING423 = Unhelpful 'virus warning'? (423)

  • VIRUS_WARNING424 = Unhelpful 'virus warning' (424)

  • VIRUS_WARNING425 = Unhelpful 'virus warning' (425)

  • VIRUS_WARNING426 = Unhelpful 'virus warning' (426)

  • VIRUS_WARNING427 = Unhelpful 'virus warning' (427)

  • VIRUS_WARNING428 = Unhelpful InteProtectNow! 'virus warning' (428)

  • VIRUS_WARNING429 = Unhelpful 'virus warning' (429)

  • VIRUS_WARNING430 = Unhelpful Iflex 'virus warning' (430)

  • VIRUS_WARNING431 = Unhelpful Norton 'virus warning' (431)

  • VIRUS_WARNING432 = Unhelpful Symantec 'virus warning' (432)

  • VIRUS_WARNING433 = Unhelpful 'virus warning'? (433)

  • VIRUS_WARNING434 = Unhelpful 'virus warning' (434)

  • VIRUS_WARNING435 = Unhelpful 'virus warning' (435)

  • VIRUS_WARNING436 = Unhelpful AntiVir MailGate 'virus warning' (436)

  • VIRUS_WARNING436a = Unhelpful 'virus warning' (436)

  • VIRUS_WARNING437 = Unhelpful Symantec 'virus warning' (437)

  • VIRUS_WARNING438 = Unhelpful 'virus warning' (438)

  • VIRUS_WARNING439 = Unhelpful Trend 'virus warning' (439)

  • VIRUS_WARNING440 = Unhelpful 'virus warning' (440)

  • VIRUS_WARNING441 = Unhelpful 'virus warning' (441)

  • VIRUS_WARNING442 = Unhelpful 'virus warning' (442)

  • VIRUS_WARNING443 = Unhelpful 'virus warning' (443)

  • VIRUS_WARNING444 = Unhelpful 'virus warning' (444)

  • VIRUS_WARNING445 = Unhelpful Norton 'virus warning' (445)

  • VIRUS_WARNING446 = Unhelpful 'virus warning' (446)

  • VIRUS_WARNING447 = Unhelpful Guinevere 'virus warning' (447)

  • VIRUS_WARNING448 = Unhelpful 'virus warning' (448)

  • VIRUS_WARNING449 = Unhelpful 'virus warning'? (449)

  • VIRUS_WARNING450 = Unhelpful 'virus warning' (450)

  • VIRUS_WARNING451 = Unhelpful 'virus warning'? (451)

  • VIRUS_WARNING452 = Unhelpful 'virus warning'? (452)

  • VIRUS_WARNING453 = Unhelpful virus warning (453)

  • VIRUS_WARNING454 = Unhelpful virus warning (454)

  • VIRUS_WARNING455 = Unhelpful virus warning (455)

  • VIRUS_WARNING456 = Unhelpful virus warning (456)

  • VIRUS_WARNING457 = Unhelpful virus warning (457)

  • VIRUS_WARNING458 = Unhelpful virus warning? (458)

  • VIRUS_WARNING459 = Unhelpful virus warning (459)

  • VIRUS_WARNING460 = Unhelpful virus warning (460)

  • VIRUS_WARNING461 = Unhelpful virus warning (461)

  • VIRUS_WARNING462 = Unhelpful virus warning (462)

  • VIRUS_WARNING463 = Unhelpful virus warning? (463)

  • VIRUS_WARNING464 = Unhelpful virus warning (464)

  • VIRUS_WARNING465 = Unhelpful virus warning (465)

  • VIRUS_WARNING466 = Unhelpful eScan virus warning (466)

  • VIRUS_WARNING467 = Unhelpful Panda virus warning (467)

  • VIRUS_WARNING468 = Unhelpful Juno virus warning (468)

  • VIRUS_WARNING469 = Unhelpful virus warning (468)

  • VIRUS_WARNING_EXE1 = Message appears to contain a Windows executable

  • VIRUS_WARNING_EXE2 = Message contains a UUencoded Windows executable

  • VIRUS_WARNING_SOBER = Looks like Sober virus or bounce thereof

  • VIRUS_WARNING_XXX1 = Unidentified virus or bounce thereof (2)

  • VIRUS_WARNING_NOVARG1 = Looks like Novarg virus

  • VIRUS_WARNING_NOVARG2 = Looks like Novarg virus bounce

  • VIRUS_WARNING_BAGLE1 = Could be a Bagle.B bounce

  • VIRUS_WARNING_BAGLE2 = Could be a Bagle.B bounce

  • VIRUS_WARNING_BAGLE3 = Looks like Bagle.Q/R virus/bounce

  • VIRUS_WARNING_NETSKY4 = Netsky virus bounce (subject matched)

  • VIRUS_WARNING_NETSKY4 = Looks like Netsky bounce (body attached password)

  • VIRUS_WARNING_NETSKY5A = Looks like Netsky/P bounce (5A)

  • VIRUS_WARNING_NETSKY5B = Looks like Netsky/P bounce (5B)

  • VIRUS_WARNING_NETSKY5 = Looks like Netsky/P bounce (5)

  • VIRUS_WARNING_MYDOOM1 = Body contains Mydoom text

  • VIRUS_WARNING_MYDOOM2 = Body contains Mydoom text

  • VIRUS_WARNING_MYDOOM3 = Body contains Mydoom text

  • TJ_EMPTY_SUBJECT = Empty subject. Could be a MyDoom bounce.

  • VIRUS_WARNING_MYDOOM5 = Body contains possible Mydoom attachment

  • VIRUS_WARNING_DOOM_BNC = Looks like a Mydoom bounce

  • VIRUS_CLEANED_SOBIG_F1 = Failed/cleaned Sobig/F infection? (1)

  • VIRUS_CLEANED_SOBIG_F2 = Failed/cleaned Sobig/F infection? (2)

  • VIRUS_CLEANED_1 = Failed/cleaned Sobig/F or Netsky/K infection? (1)

  • OLPD48H_Stockv3 = Talks rubbish stocks

  • BODY_BAD_WORDS = Impolite Words in Body

  • BODY_BAD_WORDS2 = Impolite TWO Words in Body

  • BODY_BAD_WORDS3 = Impolite THREE Words in Body

  • GERSP1 = Possible Stock Spam1

  • GERSP2 = Possible Stock Spam2

  • GERSP3 = Possible Stock Spam3

  • GERSP4 = Possible Stock Spam4

  • GERSP5 = Possible Stock Spam5

  • GERSPAM = New German Stock Example

  • WORK_HOME = People work at home

  • OLPD48H_Stockv3 = Talks rubbish stocks

  • BODY_BAD_WORDS = Impolite Words in Body

  • BODY_BAD_WORDS2 = Impolite TWO Words in Body

  • BODY_BAD_WORDS3 = Impolite THREE Words in Body

  • GERSP1 = Possible Stock Spam1

  • GERSP2 = Possible Stock Spam2

  • GERSP3 = Possible Stock Spam3

  • GERSP4 = Possible Stock Spam4

  • GERSP5 = Possible Stock Spam5

  • GERSPAM = New German Stock Example

  • WORK_HOME = People work at home

  • SOBER_P_SPAM = Spam from the Sober.P virus

  • FRANCHISE_JERRY = Jerry's Franchise Application or Request

  • SOMETLD_ARE_BAD_TLD = .PW & .LINK TLD Abuse

  • JMQ_REALESTATE = Real estate spam

  • JMQ_IPINFROM = Spam with IP in the from address

  • JMQ_PAYPAL2 = PayPal spam of the day

  • JMQ_RESUME3 = Yet more resume spam

  • JMQ_SPF_NEUTRAL_ALL = SPF set to ?all!

  • JMQ_IMPORTANT = Spam that thinks it is important

  • JMQ_TRACKER = Message uses image-based tracker

  • JMQ_WIRE = Attempt to steal money via wire transfer

  • JMQ_HEARINGLOSS = Spam for hearing loss solutions

  • JMQ_TRACKR = Spam for TrackR

  • JMQ_CONGRAT = Open attachment to claim your free spam

  • JMQ_PICKUP = spam that wants your number

  • JMQ_DROPBOX = Spam from what appears to be compromised dropbox accounts

  • JMQ_RESUME = Spam for bad attached resumes