New range of SpamTitan Custom Rules
ST_RCVD_IN_HOSTKARMA_W = Sender listed in HOSTKARMA-WHITE
ST_RCVD_IN_HOSTKARMA_BL = Sender listed in HOSTKARMA-BLACK
ST_RCVD_IN_HOSTKARMA_BR = Sender listed in HOSTKARMA-BROWN
ST_RCVD_IN_SEMBLACK = Received from an IP listed by SpamEatingMonkey BLACK
ST_RCVD_IN_NIX_SPAM = Listed in NIX-SPAM DNSBL (heise.de)
ST_RCVD_IN_MSPIKE_BL = Received via a relay with bad Mailspike Reputation
ST_RCVD_IN_SPAMRATS_DYNA = Sender listed in dyna.spamrats
ST_TRANSACTION1 = Catch viruses with between 1 and three capital letters followed by keywords
ST_INFO_BADDOM = From info at new domain
ST_VIDEO_NASTY = Spam links to movies
ST_SEX = Sexually Explicit Spam
ST_CARBS = Diet spam
ST_VID1 = Weight loss video clips
ST_ANCHOR_VALIDATE = uri within Anchor tag ($lt;a href=...$gt;) is different than the internal text of the tax ($lt;a$gt;...$lt;/a$gt;)
ST_WTC_URIBL = URI is rejected by WebTitan Cloud
ST_WORD_WITHOUT_VOWELS = Long word without any vowels
ST_DIGITS_LETTERS = Mixed groups of letters followed by numbers
ST_SPF_SOFTFAIL_FREEMAIL = Escalate SPF Softfails for free mail services
ST_SPACED_URLS = Body contains URLs that are space-separated at the dots
ST_SPACED_EMAILS = Body contains email addresses that are space-separated at the dots and/or the at symbol
ST_DEAR_EMAILS = Body contains "Dear user@domain.com"
ST_UNDISCLOSED_RECIPIENTS = To "undisclosed-recipients:;"
ST_SHORTENED_LINKS = punish link shorteners in emails
ST_INVALID_DOLLARS = A dollar amount should be separated by a period, not a comma, likely spam.
ST_APPLE_SPAM = Looks like an Apple Invoice, but isn't
ST_FROM_GOOGLE_NOT_GMAIL = Penalize Google Apps spamming accounts
ST_LONG_ENVELOPE_FROM = Envelope From is very long
ST_LOC_SHORT = Contains short body and URI
ST_TOO_MANY_NBSP = A large number of non-breaking space characters are used in a row, with spaces in between
ST_REPEAT_CHAR = The same character repeated too many times in a row in a header
ADULT_CONTENT_BODY = Meta test, testing for NSFW phrases and words in the rawbody
ADULT_CONTENT_HEADER = Meta test, testing for NSFW phrases and words in the Subject
IGNORE_BAYES_00_ADULT = Cancel out BAYES_00 test if triggered with the Adult Content Ruleset
ST_URIBL_RFC_CLUELESS_DSN = URI listed on dsn.rfc-clueless.org
ST_URIBL_RFC_CLUELESS_PMR = URI listed on postmaster.rfc-clueless.org
ST_URIBL_RFC_CLUELESS_ABS = URI listed on abuse.rfc-clueless.org
ST_URIBL_RFC_CLUELESS_WHO = URI listed on whois.rfc-clueless.org
ST_URIBL_RFC_CLUELESS_BMX = URI listed on bogusmx.rfc-clueless.org
ST_URIBL_RFC_CLUELESS_MULTI = URIs are listed on 4/5 rfc-clueless.org lists
ST_RCVD_IN_ANONMAILS_LASTEXT = Received via a relay listed in spam.dnsbl.anonmails.de
ST_RCVD_IN_INPS_DE_LASTEXT = Received via a relay listed in inps.de DNSBL
ST_RCVD_IN_SPAMCANNIBAL_LASTEXT = Received via a relay listed in bl.spamcannibal.org
ST_RCVD_IN_SPAMCANNIBAL = Passed through a relay listed in bl.spamcannibal.org
ST_RCVD_IN_BLOCKLIST_DE_LASTEXT = Received via a relay listed in bl.blocklist.de
ST_RCVD_IN_BLOCKLIST_DE = Passed through a relay listed in bl.blocklist.de
ST_RCVD_IN_LASHBACK_LASTEXT = Received via a relay listed in Lashback unsubscore.com
ST_RCVD_IN_LASHBACK = Passed through relay listed in Lashback unsubscore.com
ST_RCVD_IN_BACKSCATTERER_LASTEXT = Received via a relay listed in Backscatter RBL list
ST_RCVD_IN_BRBL = Passed through a relay listed in Barracuda RBL
ST_RCVD_IN_S5H_LASTEXT = Received via a relay listed in all.s5h.net
ST_RCVD_IN_FABEL_LASTEXT = Received via a relay listed in spamsources.fabel.dk
ST_URIBL_ZAPBL = Contains a domain listed in the ZapBL RHSBL block list
ST_RCVD_IN_ZAPBL_LASTEXT = Received via a relay listed in ZapBL
ST_RCVD_IN_ZAPBL = Passed through a relay listed in ZapBL
ST_RCVD_IN_DNSRBL_LASTEXT = Received via a relay listed in dnsrbl.org
ST_URIBL_SARBL = Contains an URL listed in the SARBL blocklist
ST_URIBL_FMBLA = Contains an URL listed in the fmb.la blocklist
ST_RCVD_IN_FMBLA_LASTEXT = Received via a relay listed in bl.fmb.la
ST_RCVD_IN_FMBLA = Passed through a relay listed in bl.fmb.la
ST_URIBL_ABUSE_RO_BLACK = Contains a blocked URL at uribl.abuse.ro
ST_RCVD_IN_ABUSE_RO_LASTEXT = Received via a relay listed in rbl.abuse.ro
ST_RCVD_IN_ABUSE_RO = Passed through a relay listed in rbl.abuse.ro
ST_ENVFROM_IN_ABUSE_RO = Envelope From: sender listed in dbl.abuse.ro
ST_RCVD_IN_MEGARBL_LASTEXT = Received via a relay listed in rbl.megarbl.net
ST_RCVD_IN_REALTIME_LASTEXT = Received via a relay listed in rbl.realtimeblacklist.com
ST_RCVD_IN_DRONEBL_LASTEXT = Received via a relay listed in dnsbl.dronebl.org
ST_RCVD_IN_DRONEBL = Passed through a relay listed in dnsbl.dronebl.org
ST_URIBL_SWINOG = Contains a blocked URL listed in uribl.swinog.ch.
ST_RCVD_IN_SENDERSCORE_90_100 = Senderscore.org score of 90 to 100
ST_RCVD_IN_SENDERSCORE_80_89 = Senderscore.org score of 80 to 89
ST_RCVD_IN_SENDERSCORE_70_79 = Senderscore.org score of 70 to 79
ST_RCVD_IN_SENDERSCORE_60_69 = Senderscore.org score of 60 to 69
ST_RCVD_IN_SENDERSCORE_50_59 = Senderscore.org score of 50 to 59
ST_RCVD_IN_SENDERSCORE_30_49 = Senderscore.org score of 30 to 49
ST_RCVD_IN_SENDERSCORE_0_29 = Senderscore.org score of 0 to 29
ST_RCVD_IN_UCEPROTECT1 = Listed in dnsbl-1.uceprotect.net
ST_RCVD_IN_UCEPROTECT2 = Listed in dnsbl-2.uceprotect.net
ST_RCVD_IN_UCEPROTECT3 = Listed in dnsbl-3.uceprotect.net
ST_URIBL_SEM = Contains a URI listed by SEM-URI
ST_URIBL_SEM_RED = Contains a URI listed by SEM-URIRED
ST_RCVD_IN_SEMBACKSCATTER = Received from an IP listed by SEM-BACKSCATTER
ST_RCVD_IN_SEMBLACK = Received from an IP listed by SEM-NETBLACK
ST_URIBL_SEM_FRESH = Contains a domain registered less than 5 days ago
ST_URIBL_SEM_FRESH10 = Contains a domain registered less than 10 days ago
ST_URIBL_SEM_FRESH15 = Contains a domain registered less than 15 days ago
ST_URIBL_SEM_FRESH30 = Contains a domain registered less than 30 days ago
ST_DMARC_FAIL_REJECT = DMARC validation failed and policy is to reject
ST_DMARC_FAIL_QUAR = DMARC validation failed and policy is quarantine
ST_DMARC_FAIL_NONE = DMARC validation failed and policy is none
ST_DMARC_PASS_REJECT = DMARC validation passed and policy is to reject
ST_DMARC_PASS_QUAR = DMARC validation passed and policy is quarantine
ST_DMARC_PASS_NONE = DMARC validation passed and policy is none