SpamTitan

New range of SpamTitan Custom Rules
  • ST_RCVD_IN_HOSTKARMA_W = Sender listed in HOSTKARMA-WHITE

  • ST_RCVD_IN_HOSTKARMA_BL = Sender listed in HOSTKARMA-BLACK

  • ST_RCVD_IN_HOSTKARMA_BR = Sender listed in HOSTKARMA-BROWN

  • ST_RCVD_IN_SEMBLACK = Received from an IP listed by SpamEatingMonkey BLACK

  • ST_RCVD_IN_NIX_SPAM = Listed in NIX-SPAM DNSBL (heise.de)

  • ST_RCVD_IN_MSPIKE_BL = Received via a relay with bad Mailspike Reputation

  • ST_RCVD_IN_SPAMRATS_DYNA = Sender listed in dyna.spamrats

  • ST_TRANSACTION1 = Catch viruses with between 1 and three capital letters followed by keywords

  • ST_INFO_BADDOM = From info at new domain

  • ST_VIDEO_NASTY = Spam links to movies

  • ST_SEX = Sexually Explicit Spam

  • ST_CARBS = Diet spam

  • ST_VID1 = Weight loss video clips

  • ST_ANCHOR_VALIDATE = uri within Anchor tag ($lt;a href=...$gt;) is different than the internal text of the tax ($lt;a$gt;...$lt;/a$gt;)

  • ST_WTC_URIBL = URI is rejected by WebTitan Cloud

  • ST_WORD_WITHOUT_VOWELS = Long word without any vowels

  • ST_DIGITS_LETTERS = Mixed groups of letters followed by numbers

  • ST_SPF_SOFTFAIL_FREEMAIL = Escalate SPF Softfails for free mail services

  • ST_SPACED_URLS = Body contains URLs that are space-separated at the dots

  • ST_SPACED_EMAILS = Body contains email addresses that are space-separated at the dots and/or the at symbol

  • ST_DEAR_EMAILS = Body contains "Dear user@domain.com"

  • ST_UNDISCLOSED_RECIPIENTS = To "undisclosed-recipients:;"

  • ST_SHORTENED_LINKS = punish link shorteners in emails

  • ST_INVALID_DOLLARS = A dollar amount should be separated by a period, not a comma, likely spam.

  • ST_APPLE_SPAM = Looks like an Apple Invoice, but isn't

  • ST_FROM_GOOGLE_NOT_GMAIL = Penalize Google Apps spamming accounts

  • ST_LONG_ENVELOPE_FROM = Envelope From is very long

  • ST_LOC_SHORT = Contains short body and URI

  • ST_TOO_MANY_NBSP = A large number of non-breaking space characters are used in a row, with spaces in between

  • ST_REPEAT_CHAR = The same character repeated too many times in a row in a header

  • ADULT_CONTENT_BODY = Meta test, testing for NSFW phrases and words in the rawbody

  • ADULT_CONTENT_HEADER = Meta test, testing for NSFW phrases and words in the Subject

  • IGNORE_BAYES_00_ADULT = Cancel out BAYES_00 test if triggered with the Adult Content Ruleset

  • ST_URIBL_RFC_CLUELESS_DSN = URI listed on dsn.rfc-clueless.org

  • ST_URIBL_RFC_CLUELESS_PMR = URI listed on postmaster.rfc-clueless.org

  • ST_URIBL_RFC_CLUELESS_ABS = URI listed on abuse.rfc-clueless.org

  • ST_URIBL_RFC_CLUELESS_WHO = URI listed on whois.rfc-clueless.org

  • ST_URIBL_RFC_CLUELESS_BMX = URI listed on bogusmx.rfc-clueless.org

  • ST_URIBL_RFC_CLUELESS_MULTI = URIs are listed on 4/5 rfc-clueless.org lists

  • ST_RCVD_IN_ANONMAILS_LASTEXT = Received via a relay listed in spam.dnsbl.anonmails.de

  • ST_RCVD_IN_INPS_DE_LASTEXT = Received via a relay listed in inps.de DNSBL

  • ST_RCVD_IN_SPAMCANNIBAL_LASTEXT = Received via a relay listed in bl.spamcannibal.org

  • ST_RCVD_IN_SPAMCANNIBAL = Passed through a relay listed in bl.spamcannibal.org

  • ST_RCVD_IN_BLOCKLIST_DE_LASTEXT = Received via a relay listed in bl.blocklist.de

  • ST_RCVD_IN_BLOCKLIST_DE = Passed through a relay listed in bl.blocklist.de

  • ST_RCVD_IN_LASHBACK_LASTEXT = Received via a relay listed in Lashback unsubscore.com

  • ST_RCVD_IN_LASHBACK = Passed through relay listed in Lashback unsubscore.com

  • ST_RCVD_IN_BACKSCATTERER_LASTEXT = Received via a relay listed in Backscatter RBL list

  • ST_RCVD_IN_BRBL = Passed through a relay listed in Barracuda RBL

  • ST_RCVD_IN_S5H_LASTEXT = Received via a relay listed in all.s5h.net

  • ST_RCVD_IN_FABEL_LASTEXT = Received via a relay listed in spamsources.fabel.dk

  • ST_URIBL_ZAPBL = Contains a domain listed in the ZapBL RHSBL block list

  • ST_RCVD_IN_ZAPBL_LASTEXT = Received via a relay listed in ZapBL

  • ST_RCVD_IN_ZAPBL = Passed through a relay listed in ZapBL

  • ST_RCVD_IN_DNSRBL_LASTEXT = Received via a relay listed in dnsrbl.org

  • ST_URIBL_SARBL = Contains an URL listed in the SARBL blocklist

  • ST_URIBL_FMBLA = Contains an URL listed in the fmb.la blocklist

  • ST_RCVD_IN_FMBLA_LASTEXT = Received via a relay listed in bl.fmb.la

  • ST_RCVD_IN_FMBLA = Passed through a relay listed in bl.fmb.la

  • ST_URIBL_ABUSE_RO_BLACK = Contains a blocked URL at uribl.abuse.ro

  • ST_RCVD_IN_ABUSE_RO_LASTEXT = Received via a relay listed in rbl.abuse.ro

  • ST_RCVD_IN_ABUSE_RO = Passed through a relay listed in rbl.abuse.ro

  • ST_ENVFROM_IN_ABUSE_RO = Envelope From: sender listed in dbl.abuse.ro

  • ST_RCVD_IN_MEGARBL_LASTEXT = Received via a relay listed in rbl.megarbl.net

  • ST_RCVD_IN_REALTIME_LASTEXT = Received via a relay listed in rbl.realtimeblacklist.com

  • ST_RCVD_IN_DRONEBL_LASTEXT = Received via a relay listed in dnsbl.dronebl.org

  • ST_RCVD_IN_DRONEBL = Passed through a relay listed in dnsbl.dronebl.org

  • ST_URIBL_SWINOG = Contains a blocked URL listed in uribl.swinog.ch.

  • ST_RCVD_IN_SENDERSCORE_90_100 = Senderscore.org score of 90 to 100

  • ST_RCVD_IN_SENDERSCORE_80_89 = Senderscore.org score of 80 to 89

  • ST_RCVD_IN_SENDERSCORE_70_79 = Senderscore.org score of 70 to 79

  • ST_RCVD_IN_SENDERSCORE_60_69 = Senderscore.org score of 60 to 69

  • ST_RCVD_IN_SENDERSCORE_50_59 = Senderscore.org score of 50 to 59

  • ST_RCVD_IN_SENDERSCORE_30_49 = Senderscore.org score of 30 to 49

  • ST_RCVD_IN_SENDERSCORE_0_29 = Senderscore.org score of 0 to 29

  • ST_RCVD_IN_UCEPROTECT1 = Listed in dnsbl-1.uceprotect.net

  • ST_RCVD_IN_UCEPROTECT2 = Listed in dnsbl-2.uceprotect.net

  • ST_RCVD_IN_UCEPROTECT3 = Listed in dnsbl-3.uceprotect.net

  • ST_URIBL_SEM = Contains a URI listed by SEM-URI

  • ST_URIBL_SEM_RED = Contains a URI listed by SEM-URIRED

  • ST_RCVD_IN_SEMBACKSCATTER = Received from an IP listed by SEM-BACKSCATTER

  • ST_RCVD_IN_SEMBLACK = Received from an IP listed by SEM-NETBLACK

  • ST_URIBL_SEM_FRESH = Contains a domain registered less than 5 days ago

  • ST_URIBL_SEM_FRESH10 = Contains a domain registered less than 10 days ago

  • ST_URIBL_SEM_FRESH15 = Contains a domain registered less than 15 days ago

  • ST_URIBL_SEM_FRESH30 = Contains a domain registered less than 30 days ago

  • ST_DMARC_FAIL_REJECT = DMARC validation failed and policy is to reject

  • ST_DMARC_FAIL_QUAR = DMARC validation failed and policy is quarantine

  • ST_DMARC_FAIL_NONE = DMARC validation failed and policy is none

  • ST_DMARC_PASS_REJECT = DMARC validation passed and policy is to reject

  • ST_DMARC_PASS_QUAR = DMARC validation passed and policy is quarantine

  • ST_DMARC_PASS_NONE = DMARC validation passed and policy is none