{"id":2615,"date":"2013-07-19T18:39:35","date_gmt":"2013-07-19T09:39:35","guid":{"rendered":"http:\/\/auctionpro.co.kr\/?p=2615"},"modified":"2019-12-04T10:10:42","modified_gmt":"2019-12-04T01:10:42","slug":"qmail-spamassassin-%eb%a3%b0-%ec%84%a4%ec%a0%95-%ec%a0%90%ec%88%98%eb%b6%80%ec%97%ac","status":"publish","type":"post","link":"https:\/\/www.auctionpro.co.kr\/?p=2615","title":{"rendered":"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec)"},"content":{"rendered":"

\ucc38\uc870 :\u00a0https:\/\/wiki.apache.org\/spamassassin\/WritingRules<\/p>\n

body LOCAL_DEMONSTRATION_RULE   \/test\/\r\nscore LOCAL_DEMONSTRATION_RULE 0.1\r\ndescribe LOCAL_DEMONSTRATION_RULE       This is a simple test rule\r\n<\/pre>\n
Perl Regex Syntax \ucc38\uc870: https:\/\/www.tutorialspoint.com\/perl\/perl_regular_expressions.htm<\/p>\n
:: spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec)<\/a>.<\/p>\n
\uc6d0\ubb38\ucc38\uc870 : http:\/\/spamassassin.apache.org\/full\/3.2.x\/doc\/Mail_SpamAssassin_Conf.html<\/p>\n
\uc2a4\ud338\uc5b4\uc384\uc2e0\uc744 \uc774\uc6a9\ud558\uc5ec \uc2a4\ud338\uba54\uc77c\uc744 \ucc28\ub2e8\ud558\ub294\ub370 \uc788\uc5b4 \uc2a4\ucf54\uc5b4 \uc810\uc218\uc744 \uc774\uc6a9\ud558\uc5ec
\n\uadf8 \uc810\uc218\ub97c \ud310\ub2e8\ud558\uc5ec \uc2a4\ud338\uc5ec\ubd80\ub97c \ud655\uc778 \ud560\uc218 \uc788\ub2e4<\/p>\n
local.cf\uc5d0\uc11c \uc810\uc218 \ubd80\ubd84\uc744 \uae30\uc5ec\ud558\uba74 \ub41c\ub2e4.
\n\uc790\uc2e0\uc774 \ubcf4\ub0b4\ub294 \uba54\uc77c\uc5d0 \ub300\ud574\uc11c \uc2a4\ud338\uc5b4\uc384\uc2e0\uc744 \uc801\uc6a9\ud558\ub824\uba74 \uc2a4\ud338\ubc00\ud130\ub97c \uc124\uce58\ud558\uba74 \ub418\ub294\uac83\uc774\ub2e4.
\n\uc544\ub798 \uc635\uc158\uc5d0 \ub300\ud55c \ubd80\ubd84\uc740 \uac80\uc0c9\ud574\ubcf4\uba74 \ub9ce\uc774 \ub098\uc62c\uac83\uc774\ub2e4<\/p>\n
\ucc38\uc870 : https:\/\/www.mailenable.com\/forum\/viewtopic.php?t=26046<\/p>\n
[root@ns1 ~]# vi \/etc\/mail\/spamassassin\/local.cf<\/p>\n
# SpamAssassin config file for version 3.x
\n# NOTE: NOT COMPATIBLE WITH VERSIONS 2.5 or 2.6
\n# See http:\/\/www.yrex.com\/spam\/spamconfig25.php for earlier versions
\n# Generated by http:\/\/www.yrex.com\/spam\/spamconfig.php (version 1.50)
\n# How many hits before a message is considered spam.
\nrequired_score 10
\n# Change the subject of suspected spam
\nrewrite_header subject [SPAM]
\n# Encapsulate spam in an attachment (0=no, 1=yes, 2=safe)
\nreport_safe 1
\n# Enable the Bayes system
\nuse_bayes 1
\n# Enable Bayes auto-learning
\nbayes_auto_learn 1
\n# Enable or disable network checks
\nskip_rbl_checks 1
\nuse_razor2 1
\nuse_dcc 1
\nuse_pyzor 1
\n# Mail using languages used in these country codes will not be marked
\n# as being possibly spam in a foreign language.
\n# – korean
\nok_languages all
\n# Mail using locales used in these country codes will not be marked
\n# as being possibly spam in a foreign language.
\nok_locales all
\nwhitelist_from *@xinet.kr *@nate.com*@naver.com
\nblacklist_from *@hosanna.net *@blankrome.com<\/p>\n
\uc704\uc5d0\uc11c whitelist_from \ud558\uace0 blacklist_from\uc744 \uc798 \ud65c\uc6a9\ud558\uba74 \ud2b9\uc815 \uba54\uc77c\uc5d0 \ub300\ud574\uc11c\ub294 \ud5c8\uc6a9 \ubc0f \uac70\ubd80 \ud560\uc218 \uc788\ub2e4<\/p>\n
\uc704 \uc635\uc158\uc5d0 \ub300\ud55c \uc124\uba85<\/p>\n
report_safe : \uc2a4\ud338\uc73c\ub85c \ud310\ub2e8\ub420 \uacbd\uc6b0 \uc6d0\ubcf8\uae00\uc744 \uac10\ucd9c\uc9c0 \uc5ec\ubd80\uc774\ub2e4. \uba54\uc77c\uc744 \uc77d\ub294 \uc21c\uac04 \ub2f9\ud560\uc218 \uc788\ub294 \uadf8 \uc5b4\ub5a4 \uacf5\uaca9\uc774 \ub450\ub835\ub2e4\uba74 1\ub85c \ud574\uc57c \ud55c\ub2e4. \ud558\uc9c0\ub9cc 0\uc73c\ub85c \uc124\uc815\ud55c\ub2e4.<\/p>\n
required_score : \uba87\uc810 \uc774\uc0c1\uc744 \uc2a4\ud338\uba54\uc77c\ub85c \uc758\uc2ec\ud560\uac83\uc778\uc9c0\uc5d0 \ub300\ud55c \uc124\uc815\uc774\ub2e4. \uc774\uac83\uc740 \uc11c\ubc84\uad00\ub9ac\uc790\uc758 \uc8fc\uad00\uc801\uc778 \ubd80\ubd84\uc774\ub2e4. \uadf8\ub0e5 5\ub85c \ud574\ub3c4 \ubb34\uad00\ud558\ub2e4\uace0 \ubcf8\ub2e4.<\/p>\n
use_bayes : \ud559\uc2b5\ub41c Bayesian Classifier\ub97c \uc0ac\uc6a9\ud560\uac83\uc778\uc9c0\uc5d0 \ub300\ud55c \uc5ec\ubd80\uc774\ub2e4. \ub2f9\uc5f0\ud788 1\ub85c \ud55c\ub2e4.<\/p>\n
bayes_auto_learn : \uc790\ub3d9\ud559\uc2b5\uc5d0 \ub300\ud55c \uc124\uc815\uc774\ub2e4. \uc815\ub9d0\ub85c \ud655\uc2e4\ud55c \uc2a4\ud338\uc758 \uacbd\uc6b0 \ubd84\uc11d\ud558\uc5ec \ub098\ub204\uc5b4\uc9c4 \ud1a0\ud070\uc744 \uc9c0\uc18d\uc801\uc73c\ub85c \ud559\uc2b5 \uc2dc\ud0a8\ub2e4. \ubb3c\ub860 \uc790\ub3d9\uc73c\ub85c.<\/p>\n
bayes_path : \ud559\uc2b5\ub41c \ud1a0\ud070 \ud30c\uc77c\uc744 \uc800\uc7a5\ud560 \uc704\uce58\uc774\ub2e4. \uae30\ubcf8\uc801\uc73c\ub85c \uc0ac\uc6a9\uc790 \ubcc4\ub85c \uac1c\ubcc4 \uc800\uc7a5\ub418\ub098 \uc774\ub7f0\uc2dd\uc73c\ub85c \ud558\uc5ec \uc911\uc559 \uad00\ub9ac\uac00 \uac00\ub2a5\ud558\ub2e4. \uc800 \uac12\uc740 \uc811\ub450\uc5b4\ub2e4. \uc800 \ub4a4\ub85c _toks\uc640 _seen\uc774 \ubd99\ub294 \ud30c\uc77c \ub450\uac1c\uac00 \uc0dd\uae34\ub2e4.<\/p>\n
bayes_file_mode : \ud30c\uc77c\uc758 \uad8c\ud55c\uc774\ub2e4. 666\uc815\ub3c4\uba74 \ub418\uaca0\ub2e4.<\/p>\n
skip_rbl_checks : RBL\uccb4\ud06c\uac12\uc744 \uc810\uc218\uc5d0 \ud65c\uc6a9\ud55c\ub2e4. \ub098\ub984 \ub9f9\ud65c\uc57d\uc744 \ud558\uac8c \ub41c\ub2e4.<\/p>\n
use_razor2 : Vipul’s Razor\ub77c\ub294 \uacf3\uc5d0\uc11c \uc6b4\uc601\ud558\ub294 \ube14\ub799\ub9ac\uc2a4\ud2b8 \uacf5\uc720 \uc2dc\uc2a4\ud15c\uc744 \ud65c\uc6a9\ud560\uc9c0 \uc5ec\ubd80\uc774\ub2e4. \ub09c \uc0ac\uc6a9\uc548\ud588\ub2e4. \uc124\uce58\ud560\uac83\uc774 \ubcc4\ub3c4\ub85c \uc874\uc7ac\ud55c\ub2e4.<\/p>\n
use_dcc : Distributed Checksum Clearinghouse\uc758 \uc57d\uc790\uc774\ub2e4. \uc2e4\uc81c \ud648\ud398\uc774\uc9c0\uc5d0\uc11c\ub294 \uc2a4\ud338\uc744 \uc904\uc774\ub294\ub370 \ud2b9\ucd9c\ub09c \ud6a8\uacfc\uac00 \uc788\ub2e4\uace0 \uc124\uba85\ud558\uace0 \uc788\ub2e4. \ud544\uc694\ud558\ub2e4 \ud310\ub2e8\ub418\uba74 \uc0ac\uc6a9\ud558\uc790<\/p>\n
use_pyzor : Razor2\uc640 \ube44\uc2b7\ud55c \uc5ed\ud560\uc744 \ud558\ub294\uac83 \uac19\ub2e4. \uc790\uc138\ud55c\uac74 \uc0ac\uc6a9\ud574 \ubcf4\uc9c0 \uc54a\uc544\uc11c \ubaa8\ub974\uaca0\ub2e4. \ud648\ud398\uc774\uc9c0\ub294 \uc5ec\uae30<\/p>\n
ok_languages : \uc911\uc694\ud558\uac8c \uc0ac\uc6a9\ub418\ub294 \uc5b8\uc5b4\ub97c \uc124\uc815\ud574 \uc8fc\uba74 \ub41c\ub2e4. \ud55c\uad6d\uc758 \uacbd\uc6b0 ko\ub97c \uc801\uc5b4\uc8fc\uba74 \ub41c\ub2e4. \uc601\uc5b4\uad8c\uacfc \uba54\uc77c\uc744 \uc8fc\uace0 \ubc1b\uc744\uc77c\uc774 \ub9ce\ub2e4\uba74 en\ub3c4 \ucd94\uac00\ud574 \uc8fc\uc790.<\/p>\n
ok_locales : \uc704\uc640 \uac19\uc740 \uc5ed\ud560\uc744 \ud55c\ub2e4.<\/p>\n
score : \ubcc4\ub3c4\ub85c \ud2b9\uc815 \ub8f0\uc5d0 \ub300\ud55c \uc810\uc218\ub97c \uac15\uc81c\ub85c \uc9c0\uc815\ud560 \uc218 \uc788\ub2e4.<\/p>\n
Test & Scoring Chart<\/h3>\n
https:\/\/www.futurequest.net\/docs\/SA\/<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Test Name<\/b><\/td>\nArea Tested<\/b><\/td>\nDescription Of Test<\/b><\/td>\nScore<\/b>
\nBayes off
\nRBLs off<\/td>\n<\/tr>\n
ACT_NOW_CAPS<\/td>\nbody<\/td>\nTalks about ‘acting now’ with capitals<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
AC_BR_BONANZA<\/td>\nrawbody<\/td>\nToo many newlines in a row… spammy template<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
AC_DIV_BONANZA<\/td>\nrawbody<\/td>\nToo many divs in a row… spammy template<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
AC_FROM_MANY_DOTS<\/td>\nmeta<\/td>\nMultiple periods in From user name<\/td>\n3.000<\/tt><\/td>\n<\/tr>\n
AC_HTML_NONSENSE_TAGS<\/td>\nrawbody<\/td>\nMany consecutive multi-letter HTML tags, likely nonsense\/spam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS1<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS10<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS11<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS12<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS2<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS3<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS4<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS8<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AC_SPAMMY_URI_PATTERNS9<\/td>\nmeta<\/td>\nlink combos match highly spammy template<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
ADMAIL<\/td>\nmeta<\/td>\n“admail” and variants<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_2_NEW_FORM<\/td>\nmeta<\/td>\nAdvance Fee fraud and a form<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_2_NEW_MONEY<\/td>\nmeta<\/td>\nAdvance Fee fraud and lots of money<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_3_NEW<\/td>\nmeta<\/td>\nAppears to be advance fee fraud (Nigerian 419)<\/td>\n2.600<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_3_NEW_FORM<\/td>\nmeta<\/td>\nAdvance Fee fraud and a form<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_3_NEW_MONEY<\/td>\nmeta<\/td>\nAdvance Fee fraud and lots of money<\/td>\n2.699<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_4_NEW<\/td>\nmeta<\/td>\nAppears to be advance fee fraud (Nigerian 419)<\/td>\n2.699<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_4_NEW_MONEY<\/td>\nmeta<\/td>\nAdvance Fee fraud and lots of money<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
ADVANCE_FEE_5_NEW_FRM_MNY<\/td>\nmeta<\/td>\nAdvance Fee fraud form and lots of money<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
AD_PREFS<\/td>\nbody<\/td>\nAdvertising preferences<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
ALIBABA_IMG_NOT_RCVD_ALI<\/td>\nmeta<\/td>\nAlibaba hosted image but message not from Alibaba<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
ALL_TRUSTED<\/td>\nheader<\/td>\nPassed through trusted hosts only via SMTP<\/td>\n-1.000<\/tt><\/td>\n<\/tr>\n
AMAZON_IMG_NOT_RCVD_AMZN<\/td>\nmeta<\/td>\nAmazon hosted image but message not from Amazon<\/td>\n2.201<\/tt><\/td>\n<\/tr>\n
ANY_BOUNCE_MESSAGE<\/td>\nmeta<\/td>\nMessage is some kind of bounce message<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
APOSTROPHE_FROM<\/td>\nheader<\/td>\nFrom address contains an apostrophe<\/td>\n0.148<\/tt><\/td>\n<\/tr>\n
APP_DEVELOPMENT_FREEM<\/td>\nmeta<\/td>\nApp development pitch, freemail or CHN replyto<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
APP_DEVELOPMENT_NORDNS<\/td>\nmeta<\/td>\nApp development pitch, no rDNS<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AWL<\/td>\nheader<\/td>\nAdjusted score from AWL reputation of From: address<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
AXB_XMAILER_MIMEOLE_OL_024C2<\/td>\nmeta<\/td>\nYet another X header trait<\/td>\n3.899<\/tt><\/td>\n<\/tr>\n
AXB_XMAILER_MIMEOLE_OL_1ECD5<\/td>\nmeta<\/td>\nYet another X header trait##} AXB_XMAILER_MIMEOLE_OL_1ECD5<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
BAD_CREDIT<\/td>\nbody<\/td>\nEliminate Bad Credit<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
BAD_ENC_HEADER<\/td>\nheader<\/td>\nMessage has bad MIME encoding in the header<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
BANG_GUAR<\/td>\nbody<\/td>\nSomething is emphatically guaranteed<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BANKING_LAWS<\/td>\nbody<\/td>\nTalks about banking laws<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
BASE64_LENGTH_78_79<\/td>\nbody<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
BASE64_LENGTH_79_INF<\/td>\nbody<\/td>\nbase64 encoded email part uses line length greater than 79 characters<\/td>\n1.379<\/tt><\/td>\n<\/tr>\n
BAYES_00<\/td>\nbody<\/td>\nBayes spam probability is 0 to 1%<\/td>\n-3.000<\/tt><\/td>\n<\/tr>\n
BAYES_05<\/td>\nbody<\/td>\nBayes spam probability is 1 to 5%<\/td>\n-0.500<\/tt><\/td>\n<\/tr>\n
BAYES_20<\/td>\nbody<\/td>\nBayes spam probability is 5 to 20%<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
BAYES_40<\/td>\nbody<\/td>\nBayes spam probability is 20 to 40%<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
BAYES_50<\/td>\nbody<\/td>\nBayes spam probability is 40 to 60%<\/td>\n2.000<\/tt><\/td>\n<\/tr>\n
BAYES_60<\/td>\nbody<\/td>\nBayes spam probability is 60 to 80%<\/td>\n3.000<\/tt><\/td>\n<\/tr>\n
BAYES_80<\/td>\nbody<\/td>\nBayes spam probability is 80 to 95%<\/td>\n4.000<\/tt><\/td>\n<\/tr>\n
BAYES_95<\/td>\nbody<\/td>\nBayes spam probability is 95 to 99%<\/td>\n5.000<\/tt><\/td>\n<\/tr>\n
BAYES_99<\/td>\nbody<\/td>\nBayes spam probability is 99 to 100%<\/td>\n6.000<\/tt><\/td>\n<\/tr>\n
BAYES_999<\/td>\nbody<\/td>\nBayes spam probability is 99.9 to 100%<\/td>\n7.000<\/tt><\/td>\n<\/tr>\n
BILLION_DOLLARS<\/td>\nbody<\/td>\nTalks about lots of money<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
BITCOIN_BOMB<\/td>\nmeta<\/td>\nBitCoin + bomb<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_DEADLINE<\/td>\nmeta<\/td>\nBitCoin with a deadline<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
BITCOIN_EXTORT_01<\/td>\nmeta<\/td>\nExtortion spam, pay via BitCoin<\/td>\n3.160<\/tt><\/td>\n<\/tr>\n
BITCOIN_MALWARE<\/td>\nmeta<\/td>\nBitCoin + malware bragging<\/td>\n0.121<\/tt><\/td>\n<\/tr>\n
BITCOIN_PAY_ME<\/td>\nmeta<\/td>\nPay me via BitCoin<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_01<\/td>\nmeta<\/td>\nBitCoin spam pattern 01<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_02<\/td>\nmeta<\/td>\nBitCoin spam pattern 02<\/td>\n2.500<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_03<\/td>\nmeta<\/td>\nBitCoin spam pattern 03<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_04<\/td>\nmeta<\/td>\nBitCoin spam pattern 04<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_05<\/td>\nmeta<\/td>\nBitCoin spam pattern 05<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_06<\/td>\nmeta<\/td>\nBitCoin spam pattern 06<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_07<\/td>\nmeta<\/td>\nBitCoin spam pattern 07<\/td>\n3.499<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_08<\/td>\nmeta<\/td>\nBitCoin spam pattern 08<\/td>\n1.867<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_09<\/td>\nmeta<\/td>\nBitCoin spam pattern 09<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_10<\/td>\nmeta<\/td>\nBitCoin spam pattern 10<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_11<\/td>\nmeta<\/td>\nBitCoin spam pattern 11<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPAM_12<\/td>\nmeta<\/td>\nBitCoin spam pattern 12<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BITCOIN_SPF_ONLYALL<\/td>\nmeta<\/td>\nBitcoin from a domain specifically set to pass +all SPF<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
BODY_8BITS<\/td>\nbody<\/td>\nBody includes 8 consecutive 8-bit characters<\/td>\n1.500<\/tt><\/td>\n<\/tr>\n
BODY_EMPTY<\/td>\nmeta<\/td>\nNo body text in message<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
BODY_ENHANCEMENT<\/td>\nbody<\/td>\nInformation on growing body parts<\/td>\n0.927<\/tt><\/td>\n<\/tr>\n
BODY_ENHANCEMENT2<\/td>\nbody<\/td>\nInformation on getting larger body parts<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
BODY_SINGLE_URI<\/td>\nmeta<\/td>\nMessage body is only a URI<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
BODY_SINGLE_WORD<\/td>\nmeta<\/td>\nMessage body is only one word (no spaces)<\/td>\n1.101<\/tt><\/td>\n<\/tr>\n
BODY_URI_ONLY<\/td>\nmeta<\/td>\nMessage body is only a URI in one line of text or for an image<\/td>\n0.999<\/tt><\/td>\n<\/tr>\n
BOGUS_MIME_VERSION<\/td>\nmeta<\/td>\nMime version header is bogus<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BOGUS_MSM_HDRS<\/td>\nmeta<\/td>\nApparently bogus Microsoft email headers<\/td>\n0.895<\/tt><\/td>\n<\/tr>\n
BOMB_FREEM<\/td>\nmeta<\/td>\nBomb + freemail<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BOMB_MONEY<\/td>\nmeta<\/td>\nBomb + money: bomb threat?<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BOUNCE_MESSAGE<\/td>\nmeta<\/td>\nMTA bounce message<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
BTC_ORG<\/td>\nmeta<\/td>\nBitcoin wallet ID + unusual header<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
BUG6152_INVALID_DATE_TZ_ABSURD<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
BULK_RE_SUSP_NTLD<\/td>\nmeta<\/td>\nPrecedence bulk and RE: from a suspicious TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
CANT_SEE_AD<\/td>\nmeta<\/td>\nYou really want to see our spam.<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
CHALLENGE_RESPONSE<\/td>\nmeta<\/td>\nChallenge-Response message for mail you sent<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
CHARSET_FARAWAY<\/td>\nbody<\/td>\nCharacter set indicates a foreign language<\/td>\n3.200<\/tt><\/td>\n<\/tr>\n
CHARSET_FARAWAY_HEADER<\/td>\nheader<\/td>\nA foreign language charset used in headers<\/td>\n3.200<\/tt><\/td>\n<\/tr>\n
CK_HELO_DYNAMIC_SPLIT_IP<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Split IP)<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
CK_HELO_GENERIC<\/td>\nheader<\/td>\nRelay used name indicative of a Dynamic Pool or Generic rPTR<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
CN_B2B_SPAMMER<\/td>\nbody<\/td>\nChinese company introducing itself<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
COMMENT_GIBBERISH<\/td>\nmeta<\/td>\nNonsense in long HTML comment<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
COMPENSATION<\/td>\nmeta<\/td>\n“Compensation”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
CRBOUNCE_MESSAGE<\/td>\nmeta<\/td>\nChallenge-Response bounce message<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
CTYPE_001C_B<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
CTYPE_NULL<\/td>\nmeta<\/td>\nMalformed Content-Type header<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
CURR_PRICE<\/td>\nbody<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DATE_IN_FUTURE_03_06<\/td>\nheader<\/td>\nDate: is 3 to 6 hours after Received: date<\/td>\n3.399<\/tt><\/td>\n<\/tr>\n
DATE_IN_FUTURE_06_12<\/td>\nheader<\/td>\nDate: is 6 to 12 hours after Received: date<\/td>\n2.899<\/tt><\/td>\n<\/tr>\n
DATE_IN_FUTURE_12_24<\/td>\nheader<\/td>\nDate: is 12 to 24 hours after Received: date<\/td>\n2.603<\/tt><\/td>\n<\/tr>\n
DATE_IN_FUTURE_24_48<\/td>\nheader<\/td>\nDate: is 24 to 48 hours after Received: date<\/td>\n2.598<\/tt><\/td>\n<\/tr>\n
DATE_IN_FUTURE_48_96<\/td>\nheader<\/td>\nDate: is 48 to 96 hours after Received: date<\/td>\n2.384<\/tt><\/td>\n<\/tr>\n
DATE_IN_FUTURE_96_Q<\/td>\nheader<\/td>\nDate: is 4 days to 4 months after Received: date<\/td>\n2.453<\/tt><\/td>\n<\/tr>\n
DATE_IN_PAST_03_06<\/td>\nheader<\/td>\nDate: is 3 to 6 hours before Received: date<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
DATE_IN_PAST_06_12<\/td>\nheader<\/td>\nDate: is 6 to 12 hours before Received: date<\/td>\n1.699<\/tt><\/td>\n<\/tr>\n
DATE_IN_PAST_12_24<\/td>\nheader<\/td>\nDate: is 12 to 24 hours before Received: date<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DATE_IN_PAST_24_48<\/td>\nheader<\/td>\nDate: is 24 to 48 hours before Received: date<\/td>\n1.109<\/tt><\/td>\n<\/tr>\n
DATE_IN_PAST_96_XX<\/td>\nheader<\/td>\nDate: is 96 hours or more before Received: date<\/td>\n2.600<\/tt><\/td>\n<\/tr>\n
DAY_I_EARNED<\/td>\nmeta<\/td>\nWork-at-home spam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
DCC_CHECK<\/td>\nfull<\/td>\nDetected as bulk mail by DCC (dcc-servers.net)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DCC_REPUT_00_12<\/td>\nfull<\/td>\nDCC reputation between 0 and 12 % (mostly ham)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DCC_REPUT_13_19<\/td>\nfull<\/td>\nDCC reputation between 13 and 19 %<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DCC_REPUT_70_89<\/td>\nfull<\/td>\nDCC reputation between 70 and 89 %<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DCC_REPUT_90_94<\/td>\nfull<\/td>\nDCC reputation between 90 and 94 %<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DCC_REPUT_95_98<\/td>\nfull<\/td>\nDCC reputation between 95 and 98 % (mostly spam)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DCC_REPUT_99_100<\/td>\nfull<\/td>\nDCC reputation between 99 % or higher (spam)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DC_GIF_UNO_LARGO<\/td>\nmeta<\/td>\nMessage contains a single large gif image<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DC_IMAGE_SPAM_HTML<\/td>\nmeta<\/td>\nPossible Image-only spam<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
DC_IMAGE_SPAM_TEXT<\/td>\nmeta<\/td>\nPossible Image-only spam with little text<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
DC_PNG_UNO_LARGO<\/td>\nmeta<\/td>\nMessage contains a single large png image<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DEAR_BENEFICIARY<\/td>\nbody<\/td>\nDear Beneficiary:<\/td>\n1.140<\/tt><\/td>\n<\/tr>\n
DEAR_FRIEND<\/td>\nbody<\/td>\nDear Friend? That’s not very dear!<\/td>\n2.683<\/tt><\/td>\n<\/tr>\n
DEAR_SOMETHING<\/td>\nbody<\/td>\nContains ‘Dear (something)’<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
DEAR_WINNER<\/td>\nbody<\/td>\nSpam with generic salutation of “dear winner”<\/td>\n3.099<\/tt><\/td>\n<\/tr>\n
DIET_1<\/td>\nbody<\/td>\nLose Weight Spam<\/td>\n0.714<\/tt><\/td>\n<\/tr>\n
DIGEST_MULTIPLE<\/td>\nmeta<\/td>\nMessage hits more than one network digest check<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DKIMDOMAIN_IN_DWL<\/td>\n???<\/td>\nNo description provided<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DKIMDOMAIN_IN_DWL_UNKNOWN<\/td>\n???<\/td>\nNo description provided<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DKIMWL_BL<\/td>\nmeta<\/td>\nDKIMwl.org – Blacklisted sender<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIMWL_BLOCKED<\/td>\nmeta<\/td>\nADMINISTRATOR NOTICE: The query to DKIMWL.org was blocked. See http:\/\/wiki.apache.org\/spamassassin\/DnsBlocklists\\#dnsbl-block for more information.<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIMWL_WL_HIGH<\/td>\nmeta<\/td>\nDKIMwl.org – Whitelisted High sender<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIMWL_WL_MED<\/td>\nmeta<\/td>\nDKIMwl.org – Medium sender<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIMWL_WL_MEDHI<\/td>\nmeta<\/td>\nDKIMwl.org – Medium-high sender<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIM_ADSP_ALL<\/td>\nheader<\/td>\nNo valid author signature, domain signs all mail<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DKIM_ADSP_CUSTOM_HIGH<\/td>\nheader<\/td>\nNo valid author signature, adsp_override is CUSTOM_HIGH<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIM_ADSP_CUSTOM_LOW<\/td>\nheader<\/td>\nNo valid author signature, adsp_override is CUSTOM_LOW<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIM_ADSP_CUSTOM_MED<\/td>\nheader<\/td>\nNo valid author signature, adsp_override is CUSTOM_MED<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DKIM_ADSP_DISCARD<\/td>\nheader<\/td>\nNo valid author signature, domain signs all mail and suggests discarding the rest<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DKIM_ADSP_NXDOMAIN<\/td>\nheader<\/td>\nNo valid author signature and domain not in DNS<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
DKIM_INVALID<\/td>\nmeta<\/td>\nDKIM or DK signature exists, but is not valid<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
DKIM_SIGNED<\/td>\nfull<\/td>\nMessage has a DKIM or DK signature, not necessarily valid<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
DKIM_VALID<\/td>\nfull<\/td>\nMessage has at least one valid DKIM or DK signature<\/td>\n-0.100<\/tt><\/td>\n<\/tr>\n
DKIM_VALID_AU<\/td>\nfull<\/td>\nMessage has a valid DKIM or DK signature from author’s domain<\/td>\n-0.100<\/tt><\/td>\n<\/tr>\n
DKIM_VALID_EF<\/td>\nfull<\/td>\nMessage has a valid DKIM or DK signature from envelope-from domain<\/td>\n-0.100<\/tt><\/td>\n<\/tr>\n
DOS_OE_TO_MX<\/td>\nmeta<\/td>\nDelivered direct to MX with OE headers<\/td>\n2.602<\/tt><\/td>\n<\/tr>\n
DOS_OE_TO_MX_IMAGE<\/td>\nmeta<\/td>\nDirect to MX with OE headers and an image<\/td>\n2.886<\/tt><\/td>\n<\/tr>\n
DOS_OUTLOOK_TO_MX<\/td>\nmeta<\/td>\nDelivered direct to MX with Outlook headers<\/td>\n2.636<\/tt><\/td>\n<\/tr>\n
DOS_RCVD_IP_TWICE_C<\/td>\nheader<\/td>\nReceived from the same IP twice in a row (only one external relay; empty or IP helo)<\/td>\n2.599<\/tt><\/td>\n<\/tr>\n
DOS_STOCK_BAT<\/td>\nmeta<\/td>\nProbable pump and dump stock spam<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DRUGS_ANXIETY<\/td>\nmeta<\/td>\nRefers to an anxiety control drug<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
DRUGS_DIET<\/td>\nmeta<\/td>\nRefers to a diet drug<\/td>\n2.660<\/tt><\/td>\n<\/tr>\n
DRUGS_ERECTILE<\/td>\nmeta<\/td>\nRefers to an erectile drug<\/td>\n1.778<\/tt><\/td>\n<\/tr>\n
DRUGS_ERECTILE_OBFU<\/td>\nmeta<\/td>\nObfuscated reference to an erectile drug<\/td>\n1.324<\/tt><\/td>\n<\/tr>\n
DRUGS_ERECTILE_SHORT_SHORTNER<\/td>\nmeta<\/td>\nShort erectile drugs advert with T_URL_SHORTENER<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
DRUGS_MANYKINDS<\/td>\nmeta<\/td>\nRefers to at least four kinds of drugs<\/td>\n2.001<\/tt><\/td>\n<\/tr>\n
DRUGS_MUSCLE<\/td>\nmeta<\/td>\nRefers to a muscle relaxant<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DRUGS_SMEAR1<\/td>\nbody<\/td>\nTwo or more drugs crammed together into one word<\/td>\n3.300<\/tt><\/td>\n<\/tr>\n
DRUGS_STOCK_MIMEOLE<\/td>\n???<\/td>\nNo description provided<\/td>\n2.699<\/tt><\/td>\n<\/tr>\n
DRUG_ED_CAPS<\/td>\nbody<\/td>\nMentions an E.D. drug<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
DRUG_ED_ONLINE<\/td>\nbody<\/td>\nFast Viagra Delivery<\/td>\n0.696<\/tt><\/td>\n<\/tr>\n
DRUG_ED_SILD<\/td>\nbody<\/td>\nTalks about an E.D. drug using its chemical name<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DX_TEXT_02<\/td>\nbody<\/td>\n“change your message stat”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
DX_TEXT_03<\/td>\nbody<\/td>\n“XXX Media Group”<\/td>\n2.109<\/tt><\/td>\n<\/tr>\n
DYN_RDNS_AND_INLINE_IMAGE<\/td>\nmeta<\/td>\nContains image, and was sent by dynamic rDNS<\/td>\n1.345<\/tt><\/td>\n<\/tr>\n
DYN_RDNS_SHORT_HELO_HTML<\/td>\nmeta<\/td>\nSent by dynamic rDNS, short HELO, and HTML<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
DYN_RDNS_SHORT_HELO_IMAGE<\/td>\nmeta<\/td>\nShort HELO string, dynamic rDNS, inline image<\/td>\n1.825<\/tt><\/td>\n<\/tr>\n
EBAY_IMG_NOT_RCVD_EBAY<\/td>\nmeta<\/td>\nE-bay hosted image but message not from E-bay<\/td>\n0.980<\/tt><\/td>\n<\/tr>\n
EMPTY_MESSAGE<\/td>\nmeta<\/td>\nMessage appears to have no textual parts and no Subject: text<\/td>\n2.195<\/tt><\/td>\n<\/tr>\n
EM_ROLEX<\/td>\nbody<\/td>\nMessage puts emphasis on the watch manufacturer<\/td>\n0.595<\/tt><\/td>\n<\/tr>\n
ENCRYPTED_MESSAGE<\/td>\nmeta<\/td>\nMessage is encrypted, not likely to be spam<\/td>\n-1.000<\/tt><\/td>\n<\/tr>\n
END_FUTURE_EMAILS<\/td>\nmeta<\/td>\nSpammy unsubscribe<\/td>\n2.098<\/tt><\/td>\n<\/tr>\n
ENGLISH_UCE_SUBJECT<\/td>\nheader<\/td>\nSubject contains an English UCE tag<\/td>\n0.953<\/tt><\/td>\n<\/tr>\n
ENV_AND_HDR_SPF_MATCH<\/td>\nmeta<\/td>\nEnv and Hdr From used in default SPF WL Match<\/td>\n-0.500<\/tt><\/td>\n<\/tr>\n
EXCUSE_24<\/td>\nbody<\/td>\nClaims you wanted this ad<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
EXCUSE_4<\/td>\nbody<\/td>\nClaims you can be removed from the list<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
EXCUSE_REMOVE<\/td>\nbody<\/td>\nTalks about how to be removed from mailings<\/td>\n2.907<\/tt><\/td>\n<\/tr>\n
FAKE_REPLY_A1<\/td>\nmeta<\/td>\nNo description provided<\/td>\n3.199<\/tt><\/td>\n<\/tr>\n
FAKE_REPLY_B<\/td>\nmeta<\/td>\nNo description provided<\/td>\n1.272<\/tt><\/td>\n<\/tr>\n
FAKE_REPLY_C<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.688<\/tt><\/td>\n<\/tr>\n
FBI_MONEY<\/td>\nmeta<\/td>\nThe FBI wants to give you lots of money?<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FBI_SPOOF<\/td>\nmeta<\/td>\nClaims to be FBI, but not from FBI domain<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FILL_THIS_FORM<\/td>\nmeta<\/td>\nFill in a form with personal information<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FILL_THIS_FORM_FRAUD_PHISH<\/td>\n???<\/td>\nNo description provided<\/td>\n1.195<\/tt><\/td>\n<\/tr>\n
FILL_THIS_FORM_LOAN<\/td>\n???<\/td>\nNo description provided<\/td>\n2.092<\/tt><\/td>\n<\/tr>\n
FILL_THIS_FORM_LONG<\/td>\nmeta<\/td>\nFill in a form with personal information<\/td>\n2.000<\/tt><\/td>\n<\/tr>\n
FIN_FREE<\/td>\nbody<\/td>\nFreedom of a financial nature<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
FORGED_GMAIL_RCVD<\/td>\nheader<\/td>\n‘From’ gmail.com does not match ‘Received’ headers<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FORGED_HOTMAIL_RCVD2<\/td>\nheader<\/td>\nhotmail.com ‘From’ address, but no ‘Received:’<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FORGED_MSGID_EXCITE<\/td>\nmeta<\/td>\nMessage-ID is forged, (excite.com)<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
FORGED_MSGID_YAHOO<\/td>\nmeta<\/td>\nMessage-ID is forged, (yahoo.com)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
FORGED_MUA_EUDORA<\/td>\nmeta<\/td>\nForged mail pretending to be from Eudora<\/td>\n2.828<\/tt><\/td>\n<\/tr>\n
FORGED_MUA_IMS<\/td>\nmeta<\/td>\nForged mail pretending to be from IMS<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
FORGED_MUA_MOZILLA<\/td>\nmeta<\/td>\nForged mail pretending to be from Mozilla<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
FORGED_MUA_OIMO<\/td>\nmeta<\/td>\nForged mail pretending to be from MS Outlook IMO<\/td>\n2.600<\/tt><\/td>\n<\/tr>\n
FORGED_MUA_OUTLOOK<\/td>\nmeta<\/td>\nForged mail pretending to be from MS Outlook<\/td>\n3.999<\/tt><\/td>\n<\/tr>\n
FORGED_MUA_THEBAT_BOUN<\/td>\nmeta<\/td>\nMail pretending to be from The Bat! (boundary)<\/td>\n3.046<\/tt><\/td>\n<\/tr>\n
FORGED_OUTLOOK_HTML<\/td>\nmeta<\/td>\nOutlook can’t send HTML message only<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FORGED_OUTLOOK_TAGS<\/td>\nmeta<\/td>\nOutlook can’t send HTML in this format<\/td>\n0.003<\/tt><\/td>\n<\/tr>\n
FORGED_RELAY_MUA_TO_MX<\/td>\nheader<\/td>\nNo description provided<\/td>\n3.799<\/tt><\/td>\n<\/tr>\n
FORGED_SPF_HELO<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FORGED_TELESP_RCVD<\/td>\nheader<\/td>\nContains forged hostname for a DSL IP in Brazil<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
FORGED_YAHOO_RCVD<\/td>\nheader<\/td>\n‘From’ yahoo.com does not match ‘Received’ headers<\/td>\n2.397<\/tt><\/td>\n<\/tr>\n
FORM_FRAUD<\/td>\nmeta<\/td>\nFill a form and a fraud phrase<\/td>\n0.999<\/tt><\/td>\n<\/tr>\n
FORM_FRAUD_3<\/td>\nmeta<\/td>\nFill a form and several fraud phrases<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FORM_FRAUD_5<\/td>\nmeta<\/td>\nFill a form and many fraud phrases<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
FORM_LOW_CONTRAST<\/td>\nmeta<\/td>\nFill in a form with hidden text<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FOUND_YOU<\/td>\nmeta<\/td>\nI found you…<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FREEMAIL_ENVFROM_END_DIGIT<\/td>\nheader<\/td>\nEnvelope-from freemail username ends in digit<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
FREEMAIL_FORGED_FROMDOMAIN<\/td>\nmeta<\/td>\n2nd level domains in From and EnvelopeFrom freemail headers are different<\/td>\n0.249<\/tt><\/td>\n<\/tr>\n
FREEMAIL_FORGED_REPLYTO<\/td>\nmeta<\/td>\nFreemail in Reply-To, but not From<\/td>\n1.199<\/tt><\/td>\n<\/tr>\n
FREEMAIL_FROM<\/td>\nheader<\/td>\nSender email is commonly abused enduser mail provider<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FREEMAIL_REPLY<\/td>\nmeta<\/td>\nFrom and body contain different freemails<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FREEMAIL_REPLYTO<\/td>\nmeta<\/td>\nReply-To\/From or Reply-To\/body contain different freemails<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FREEMAIL_REPLYTO_END_DIGIT<\/td>\nheader<\/td>\nReply-To freemail username ends in digit<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
FREEM_FRNUM_UNICD_EMPTY<\/td>\nmeta<\/td>\nNumeric freemail From address, unicode From name and Subject, empty body<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FREE_QUOTE_INSTANT<\/td>\nbody<\/td>\nFree express or no-obligation quote<\/td>\n2.700<\/tt><\/td>\n<\/tr>\n
FRNAME_IN_MSG_XPRIO_NO_SUB<\/td>\nmeta<\/td>\nFrom name in message + X-Priority + short or no subject<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FROMSPACE<\/td>\nheader<\/td>\nIdiosyncratic “From” header format<\/td>\n2.601<\/tt><\/td>\n<\/tr>\n
FROM_2_EMAILS_SHORT<\/td>\nmeta<\/td>\nShort body and From looks like 2 different emails<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
FROM_ADDR_WS<\/td>\nmeta<\/td>\nMalformed From address<\/td>\n2.661<\/tt><\/td>\n<\/tr>\n
FROM_BANK_NOAUTH<\/td>\nmeta<\/td>\nFrom Bank domain but no SPF or DKIM<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_BLANK_NAME<\/td>\nheader<\/td>\nFrom: contains empty name<\/td>\n2.099<\/tt><\/td>\n<\/tr>\n
FROM_DOMAIN_NOVOWEL<\/td>\nheader<\/td>\nFrom: domain has series of non-vowel letters<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
FROM_EXCESS_BASE64<\/td>\nmeta<\/td>\nFrom: base64 encoded unnecessarily<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_FMBLA_NDBLOCKED<\/td>\nmeta<\/td>\nADMINISTRATOR NOTICE: The query to fresh.fmb.la was blocked. See http:\/\/wiki.apache.org\/spamassassin\/DnsBlocklists\\#dnsbl-block for more information.<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_FMBLA_NEWDOM<\/td>\nmeta<\/td>\nFrom domain was registered in last 7 days<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_FMBLA_NEWDOM14<\/td>\nmeta<\/td>\nFrom domain was registered in last 7-14 days<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_FMBLA_NEWDOM28<\/td>\nmeta<\/td>\nFrom domain was registered in last 14-28 days<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_GOV_DKIM_AU<\/td>\nmeta<\/td>\nFrom Government address and DKIM signed<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_GOV_REPLYTO_FREEMAIL<\/td>\nmeta<\/td>\nFrom Government domain but ReplyTo is FREEMAIL<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_GOV_SPOOF<\/td>\nmeta<\/td>\nFrom Government domain but matches SPOOFED<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_ILLEGAL_CHARS<\/td>\nheader<\/td>\nFrom: has too many raw illegal characters<\/td>\n2.192<\/tt><\/td>\n<\/tr>\n
FROM_IN_TO_AND_SUBJ<\/td>\nmeta<\/td>\nFrom address is in To and Subject<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FROM_LOCAL_DIGITS<\/td>\nheader<\/td>\nFrom: localpart has long digit sequence<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_LOCAL_HEX<\/td>\nheader<\/td>\nFrom: localpart has long hexadecimal sequence<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
FROM_LOCAL_NOVOWEL<\/td>\nheader<\/td>\nFrom: localpart has series of non-vowel letters<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
FROM_MISSPACED<\/td>\nmeta<\/td>\nFrom: missing whitespace<\/td>\n0.200<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_DYNIP<\/td>\nmeta<\/td>\nFrom misspaced + dynamic rDNS<\/td>\n2.444<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_EH_MATCH<\/td>\nmeta<\/td>\nFrom misspaced, matches envelope<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_FREEMAIL<\/td>\nmeta<\/td>\nFrom misspaced + freemail provider<\/td>\n3.299<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_MSFT<\/td>\nmeta<\/td>\nFrom misspaced + supposed Microsoft tool<\/td>\n0.713<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_REPLYTO<\/td>\nmeta<\/td>\nFrom misspaced, has Reply-To<\/td>\n0.503<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_SPF_FAIL<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_TO_UNDISC<\/td>\nmeta<\/td>\nFrom misspaced, To undisclosed<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_USER<\/td>\nmeta<\/td>\nFrom misspaced, from “User”<\/td>\n0.622<\/tt><\/td>\n<\/tr>\n
FROM_MISSP_XPRIO<\/td>\nmeta<\/td>\nMisspaced FROM + X-Priority<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_NEWDOM_BTC<\/td>\nmeta<\/td>\nNewdomain with Bitcoin ID<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_NO_USER<\/td>\nheader<\/td>\nFrom: has no local-part before @ sign<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_NTLD_LINKBAIT<\/td>\nmeta<\/td>\nFrom abused NTLD with little more than a URI<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
FROM_NTLD_REPLY_FREEMAIL<\/td>\nmeta<\/td>\nFrom abused NTLD and Reply-To is FREEMAIL<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
FROM_NUMBERO_NEWDOMAIN<\/td>\nmeta<\/td>\nFingerprint and new domain<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_NUMERIC_TLD<\/td>\nheader<\/td>\nFrom: address has numeric TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FROM_OFFERS<\/td>\nheader<\/td>\nFrom address is “at something-offers”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FROM_PAYPAL_SPOOF<\/td>\nmeta<\/td>\nFrom PayPal domain but matches SPOOFED<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FROM_STARTS_WITH_NUMS<\/td>\nheader<\/td>\nFrom: starts with several numbers<\/td>\n2.801<\/tt><\/td>\n<\/tr>\n
FROM_SUSPICIOUS_NTLD<\/td>\nmeta<\/td>\nFrom abused NTLD<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
FROM_SUSPICIOUS_NTLD_FP<\/td>\nmeta<\/td>\nFrom abused NTLD<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
FROM_UNBAL1<\/td>\nheader<\/td>\nFrom with unbalanced angle brackets, ‘>’ missing<\/td>\n1.099<\/tt><\/td>\n<\/tr>\n
FROM_WORDY<\/td>\nmeta<\/td>\nFrom address looks like a sentence<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
FROM_WORDY_SHORT<\/td>\nmeta<\/td>\nFrom address looks like a sentence + short message<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FROM_WSP_TRAIL<\/td>\nheader<\/td>\nTrailing whitespace before ‘>’ in From header field<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FSL_BULK_SIG<\/td>\nmeta<\/td>\nBulk signature with no Unsubscribe<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FSL_CTYPE_WIN1251<\/td>\nheader<\/td>\nContent-Type only seen in 419 spam<\/td>\n1.063<\/tt><\/td>\n<\/tr>\n
FSL_FAKE_HOTMAIL_RVCD<\/td>\nheader<\/td>\nNo description provided<\/td>\n2.631<\/tt><\/td>\n<\/tr>\n
FSL_HELO_BARE_IP_1<\/td>\nmeta<\/td>\nNo description provided<\/td>\n2.598<\/tt><\/td>\n<\/tr>\n
FSL_HELO_DEVICE<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
FSL_HELO_NON_FQDN_1<\/td>\nheader<\/td>\nNo description provided<\/td>\n2.361<\/tt><\/td>\n<\/tr>\n
FSL_INTERIA_ABUSE<\/td>\nuri<\/td>\nNo description provided<\/td>\n3.899<\/tt><\/td>\n<\/tr>\n
FSL_NEW_HELO_USER<\/td>\nmeta<\/td>\nSpam’s using Helo and User<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
FSL_THIS_IS_ADV<\/td>\nbody<\/td>\nThis is an advertisement<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
FUZZY_ANDROID<\/td>\nbody<\/td>\nObfuscated “android”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_BITCOIN<\/td>\nbody<\/td>\nObfuscated “Bitcoin”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_BROWSER<\/td>\nbody<\/td>\nObfuscated “browser”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_BTC_WALLET<\/td>\nmeta<\/td>\nHeavily obfuscated “bitcoin wallet”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_CLICK_HERE<\/td>\nbody<\/td>\nObfuscated “click here”<\/td>\n1.498<\/tt><\/td>\n<\/tr>\n
FUZZY_CPILL<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FUZZY_CREDIT<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n1.699<\/tt><\/td>\n<\/tr>\n
FUZZY_DR_OZ<\/td>\nmeta<\/td>\nObfuscated Doctor Oz<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_IMPORTANT<\/td>\nbody<\/td>\nObfuscated “important”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_MILLION<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
FUZZY_MONERO<\/td>\nmeta<\/td>\nObfuscated “Monero”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_PHARMACY<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n2.960<\/tt><\/td>\n<\/tr>\n
FUZZY_PHENT<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
FUZZY_PRICES<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n1.821<\/tt><\/td>\n<\/tr>\n
FUZZY_PRIVACY<\/td>\nbody<\/td>\nObfuscated “privacy”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_PROMOTION<\/td>\nbody<\/td>\nObfuscated “promotion”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_SAVINGS<\/td>\nbody<\/td>\nObfuscated “savings”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_SECURITY<\/td>\nbody<\/td>\nObfuscated “security”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_UNSUBSCRIBE<\/td>\nbody<\/td>\nObfuscated “unsubscribe”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_VPILL<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
FUZZY_WALLET<\/td>\nbody<\/td>\nObfuscated “Wallet”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
FUZZY_XPILL<\/td>\nbody<\/td>\nAttempt to obfuscate words in spam<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
GAPPY_SALES_LEADS_FREEM<\/td>\nmeta<\/td>\nObfuscated marketing text, freemail or CHN replyto<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GAPPY_SUBJECT<\/td>\nmeta<\/td>\nSubject: contains G.a.p.p.y-T.e.x.t<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
GB_BITCOIN_CP<\/td>\nmeta<\/td>\nLocalized Bitcoin scam<\/td>\n2.360<\/tt><\/td>\n<\/tr>\n
GB_BITCOIN_NH<\/td>\nmeta<\/td>\nLocalized Bitcoin scam<\/td>\n1.341<\/tt><\/td>\n<\/tr>\n
GB_FORGED_MUA_POSTFIX<\/td>\nmeta<\/td>\nForged Postfix mua headers<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GB_FREEMAIL_DISPTO<\/td>\nmeta<\/td>\nDisposition-Notification-To\/From or Disposition-Notification-To\/body contain different freemails<\/td>\n0.499<\/tt><\/td>\n<\/tr>\n
GB_FREEMAIL_DISPTO_NOTFREEM<\/td>\nmeta<\/td>\nDisposition-Notification-To\/From contain different freemails but mailfrom is not a freemail<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
GB_GOOGLE_OBFU<\/td>\nuri<\/td>\nObfuscate url through Google redirect<\/td>\n0.750<\/tt><\/td>\n<\/tr>\n
GB_LINKED_IMG_NOT_RCVD_LINK<\/td>\nmeta<\/td>\nLinkedin hosted image but message not from Linkedin<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GMD_PDF_EMPTY_BODY<\/td>\nbody<\/td>\nAttached PDF with empty message body<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
GMD_PDF_ENCRYPTED<\/td>\nbody<\/td>\nAttached PDF is encrypted<\/td>\n0.600<\/tt><\/td>\n<\/tr>\n
GMD_PDF_HORIZ<\/td>\nbody<\/td>\nContains pdf 100-240 (high) x 450-800 (wide)<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
GMD_PDF_SQUARE<\/td>\nbody<\/td>\nContains pdf 180-360 (high) x 180-360 (wide)<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
GMD_PDF_VERT<\/td>\nbody<\/td>\nContains pdf 450-800 (high) x 100-240 (wide)<\/td>\n0.900<\/tt><\/td>\n<\/tr>\n
GMD_PRODUCER_EASYPDF<\/td>\nbody<\/td>\nPDF producer was BCL easyPDF<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
GMD_PRODUCER_GPL<\/td>\nbody<\/td>\nPDF producer was GPL Ghostscript<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
GMD_PRODUCER_POWERPDF<\/td>\nbody<\/td>\nPDF producer was PowerPDF<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
GOOGLE_DOCS_PHISH<\/td>\nmeta<\/td>\nPossible phishing via a Google Docs form<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GOOGLE_DOCS_PHISH_MANY<\/td>\nmeta<\/td>\nPhishing via a Google Docs form<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GOOGLE_DRIVE_REPLY_BAD_NTLD<\/td>\nmeta<\/td>\nFrom Google Drive and Reply-To is from a suspicious TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GOOG_MALWARE_DNLD<\/td>\nmeta<\/td>\nFile download via Google – Malware?<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GOOG_REDIR_HTML_ONLY<\/td>\nmeta<\/td>\nGoogle redirect to obscure spamvertised website + HTML only<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
GOOG_REDIR_SHORT<\/td>\nmeta<\/td>\nGoogle redirect to obscure spamvertised website + short message<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
GTUBE<\/td>\nbody<\/td>\nGeneric Test for Unsolicited Bulk Email<\/td>\n1000.000<\/tt><\/td>\n<\/tr>\n
GUARANTEED_100_PERCENT<\/td>\nbody<\/td>\nOne hundred percent guaranteed<\/td>\n2.699<\/tt><\/td>\n<\/tr>\n
HDRS_LCASE<\/td>\nmeta<\/td>\nOdd capitalization of message header<\/td>\n0.099<\/tt><\/td>\n<\/tr>\n
HDRS_LCASE_IMGONLY<\/td>\nmeta<\/td>\nOdd capitalization of message headers + image-only HTML<\/td>\n0.099<\/tt><\/td>\n<\/tr>\n
HDRS_MISSP<\/td>\nmeta<\/td>\nMisspaced headers<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HDR_ORDER_FTSDMCXX_DIRECT<\/td>\nmeta<\/td>\nHeader order similar to spam (FTSDMCXX\/boundary variant) + direct-to-MX<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
HDR_ORDER_FTSDMCXX_NORDNS<\/td>\nmeta<\/td>\nHeader order similar to spam (FTSDMCXX\/boundary variant) + no rDNS<\/td>\n3.055<\/tt><\/td>\n<\/tr>\n
HEADER_FROM_DIFFERENT_DOMAINS<\/td>\nheader<\/td>\nFrom and EnvelopeFrom 2nd level mail domains are different<\/td>\n0.249<\/tt><\/td>\n<\/tr>\n
HEADER_HOST_IN_BLACKLIST<\/td>\n???<\/td>\nNo description provided<\/td>\n100.000<\/tt><\/td>\n<\/tr>\n
HEADER_HOST_IN_WHITELIST<\/td>\n???<\/td>\nNo description provided<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
HEADER_SPAM<\/td>\nheader<\/td>\nBulk email fingerprint (header-based) found<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_CHELLO_NL<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Chello.nl)<\/td>\n2.412<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_DHCP<\/td>\nmeta<\/td>\nRelay HELO’d using suspicious hostname (DHCP)<\/td>\n2.602<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_DIALIN<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (T-Dialin)<\/td>\n2.629<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_HCC<\/td>\nmeta<\/td>\nRelay HELO’d using suspicious hostname (HCC)<\/td>\n4.299<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_HEXIP<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Hex IP)<\/td>\n2.321<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_HOME_NL<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Home.nl)<\/td>\n2.385<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_IPADDR<\/td>\nmeta<\/td>\nRelay HELO’d using suspicious hostname (IP addr 1)<\/td>\n2.633<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_IPADDR2<\/td>\nmeta<\/td>\nRelay HELO’d using suspicious hostname (IP addr 2)<\/td>\n2.815<\/tt><\/td>\n<\/tr>\n
HELO_DYNAMIC_SPLIT_IP<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Split IP)<\/td>\n3.031<\/tt><\/td>\n<\/tr>\n
HELO_LH_HOME<\/td>\n???<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HELO_LOCALHOST<\/td>\nheader<\/td>\nNo description provided<\/td>\n2.639<\/tt><\/td>\n<\/tr>\n
HELO_MISC_IP<\/td>\nmeta<\/td>\nLooking for more Dynamic IP Relays<\/td>\n0.250<\/tt><\/td>\n<\/tr>\n
HELO_NO_DOMAIN<\/td>\nmeta<\/td>\nRelay reports its domain incorrectly<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HELO_OEM<\/td>\nheader<\/td>\nNo description provided<\/td>\n2.899<\/tt><\/td>\n<\/tr>\n
HELO_STATIC_HOST<\/td>\nmeta<\/td>\nRelay HELO’d using static hostname<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
HEXHASH_WORD<\/td>\nmeta<\/td>\nMultiple instances of word + hexadecimal hash<\/td>\n2.598<\/tt><\/td>\n<\/tr>\n
HIDE_WIN_STATUS<\/td>\nrawbody<\/td>\nJavascript to hide URLs in browser<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HK_LOTTO<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.999<\/tt><\/td>\n<\/tr>\n
HK_NAME_DRUGS<\/td>\nheader<\/td>\nFrom name contains drugs<\/td>\n4.299<\/tt><\/td>\n<\/tr>\n
HK_NAME_MR_MRS<\/td>\nmeta<\/td>\nNo description provided<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HK_RANDOM_ENVFROM<\/td>\nheader<\/td>\nEnvelope sender username looks random<\/td>\n2.638<\/tt><\/td>\n<\/tr>\n
HK_RANDOM_FROM<\/td>\nheader<\/td>\nFrom username looks random<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HK_RANDOM_REPLYTO<\/td>\nheader<\/td>\nReply-To username looks random<\/td>\n0.941<\/tt><\/td>\n<\/tr>\n
HK_RCVD_IP_MULTICAST<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.338<\/tt><\/td>\n<\/tr>\n
HK_SCAM<\/td>\nmeta<\/td>\nNo description provided<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
HOSTED_IMG_DIRECT_MX<\/td>\nmeta<\/td>\nImage hosted at large ecomm site, message direct-to-mx<\/td>\n2.048<\/tt><\/td>\n<\/tr>\n
HOSTED_IMG_DQ_UNSUB<\/td>\nmeta<\/td>\nImage hosted at large ecomm site, IP addr unsub link<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HOSTED_IMG_FREEM<\/td>\nmeta<\/td>\nImage hosted at large ecomm site or redirected, freemail from or reply-to<\/td>\n2.288<\/tt><\/td>\n<\/tr>\n
HOSTED_IMG_MULTI<\/td>\nmeta<\/td>\nMultiple images hosted at different large ecomm sites or redirected<\/td>\n2.559<\/tt><\/td>\n<\/tr>\n
HTML_CHARSET_FARAWAY<\/td>\nmeta<\/td>\nA foreign language charset used in HTML markup<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
HTML_COMMENT_SAVED_URL<\/td>\nbody<\/td>\nHTML message is a saved web page<\/td>\n0.198<\/tt><\/td>\n<\/tr>\n
HTML_EMBEDS<\/td>\nbody<\/td>\nHTML with embedded plugin object<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_ENTITY_ASCII<\/td>\nmeta<\/td>\nObfuscated ASCII<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HTML_ENTITY_ASCII_TINY<\/td>\nmeta<\/td>\nObfuscated ASCII + tiny fonts<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HTML_EXTRA_CLOSE<\/td>\nbody<\/td>\nHTML contains far too many close tags<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_FONT_FACE_BAD<\/td>\nbody<\/td>\nHTML font face is not a word<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_FONT_LOW_CONTRAST<\/td>\nbody<\/td>\nHTML font color similar or identical to background<\/td>\n0.713<\/tt><\/td>\n<\/tr>\n
HTML_FONT_SIZE_HUGE<\/td>\nbody<\/td>\nHTML font size is huge<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_FONT_SIZE_LARGE<\/td>\nbody<\/td>\nHTML font size is large<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_04<\/td>\nbody<\/td>\nHTML: images with 0-400 bytes of words<\/td>\n1.680<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_08<\/td>\nbody<\/td>\nHTML: images with 400-800 bytes of words<\/td>\n0.585<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_12<\/td>\nbody<\/td>\nHTML: images with 800-1200 bytes of words<\/td>\n1.381<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_16<\/td>\nbody<\/td>\nHTML: images with 1200-1600 bytes of words<\/td>\n1.969<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_20<\/td>\nbody<\/td>\nHTML: images with 1600-2000 bytes of words<\/td>\n2.109<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_24<\/td>\nbody<\/td>\nHTML: images with 2000-2400 bytes of words<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_28<\/td>\nbody<\/td>\nHTML: images with 2400-2800 bytes of words<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_ONLY_32<\/td>\nbody<\/td>\nHTML: images with 2800-3200 bytes of words<\/td>\n2.196<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_RATIO_02<\/td>\nbody<\/td>\nHTML has a low ratio of text to image area<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_RATIO_04<\/td>\nbody<\/td>\nHTML has a low ratio of text to image area<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_RATIO_06<\/td>\nbody<\/td>\nHTML has a low ratio of text to image area<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_IMAGE_RATIO_08<\/td>\nbody<\/td>\nHTML has a low ratio of text to image area<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_MESSAGE<\/td>\nbody<\/td>\nHTML included in message<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_MIME_NO_HTML_TAG<\/td>\nmeta<\/td>\nHTML-only message, but there is no HTML tag<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_NONELEMENT_30_40<\/td>\nbody<\/td>\n30% to 40% of HTML elements are non-standard<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
HTML_OBFUSCATE_05_10<\/td>\nbody<\/td>\nMessage is 5% to 10% HTML obfuscation<\/td>\n0.601<\/tt><\/td>\n<\/tr>\n
HTML_OBFUSCATE_10_20<\/td>\nbody<\/td>\nMessage is 10% to 20% HTML obfuscation<\/td>\n0.174<\/tt><\/td>\n<\/tr>\n
HTML_OBFUSCATE_20_30<\/td>\nbody<\/td>\nMessage is 20% to 30% HTML obfuscation<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
HTML_OBFUSCATE_90_100<\/td>\nbody<\/td>\nMessage is 90% to 100% HTML obfuscation<\/td>\n2.000<\/tt><\/td>\n<\/tr>\n
HTML_OFF_PAGE<\/td>\nmeta<\/td>\nHTML element rendered well off the displayed page<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
HTML_SHORT_CENTER<\/td>\nmeta<\/td>\nHTML is very short with CENTER tag<\/td>\n3.799<\/tt><\/td>\n<\/tr>\n
HTML_SHORT_LINK_IMG_1<\/td>\nmeta<\/td>\nHTML is very short with a linked image<\/td>\n2.215<\/tt><\/td>\n<\/tr>\n
HTML_SHORT_LINK_IMG_2<\/td>\nmeta<\/td>\nHTML is very short with a linked image<\/td>\n1.419<\/tt><\/td>\n<\/tr>\n
HTML_SHORT_LINK_IMG_3<\/td>\nmeta<\/td>\nHTML is very short with a linked image<\/td>\n0.691<\/tt><\/td>\n<\/tr>\n
HTML_SHRT_CMNT_OBFU_MANY<\/td>\nmeta<\/td>\nObfuscation with many short HTML comments<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HTML_SINGLET_MANY<\/td>\nmeta<\/td>\nMany single-letter HTML format blocks<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
HTML_TAG_BALANCE_BODY<\/td>\nbody<\/td>\nHTML has unbalanced “body” tags<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
HTML_TAG_BALANCE_HEAD<\/td>\nbody<\/td>\nHTML has unbalanced “head” tags<\/td>\n0.520<\/tt><\/td>\n<\/tr>\n
HTML_TEXT_INVISIBLE_FONT<\/td>\nmeta<\/td>\nHTML hidden text<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
HTML_TEXT_INVISIBLE_STYLE<\/td>\nmeta<\/td>\nHTML hidden text + other spam signs<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
HTML_TITLE_SUBJ_DIFF<\/td>\nmeta<\/td>\nNo description provided<\/td>\n1.149<\/tt><\/td>\n<\/tr>\n
HTTPS_HTTP_MISMATCH<\/td>\nbody<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
HTTP_ESCAPED_HOST<\/td>\nuri<\/td>\nUses %-escapes inside a URL’s hostname<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
HTTP_EXCESSIVE_ESCAPES<\/td>\nuri<\/td>\nCompletely unnecessary %-escapes inside a URL<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
IMG_ONLY_FM_DOM_INFO<\/td>\nmeta<\/td>\nHTML image-only message from .info domain<\/td>\n2.197<\/tt><\/td>\n<\/tr>\n
IMPOTENCE<\/td>\nbody<\/td>\nImpotence cure<\/td>\n1.539<\/tt><\/td>\n<\/tr>\n
INVALID_DATE<\/td>\nheader<\/td>\nInvalid Date: header (not RFC 2822)<\/td>\n1.701<\/tt><\/td>\n<\/tr>\n
INVALID_DATE_TZ_ABSURD<\/td>\nheader<\/td>\nInvalid Date: header (timezone does not exist)<\/td>\n0.262<\/tt><\/td>\n<\/tr>\n
INVALID_MSGID<\/td>\nmeta<\/td>\nMessage-Id is not valid, according to RFC 2822<\/td>\n2.602<\/tt><\/td>\n<\/tr>\n
INVESTMENT_ADVICE<\/td>\nbody<\/td>\nMessage mentions investment advice<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
IP_LINK_PLUS<\/td>\nuri<\/td>\nDotted-decimal IP address followed by CGI<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
JOIN_MILLIONS<\/td>\nbody<\/td>\nJoin Millions of Americans<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
KB_DATE_CONTAINS_TAB<\/td>\nmeta<\/td>\nNo description provided<\/td>\n3.800<\/tt><\/td>\n<\/tr>\n
KB_FAKED_THE_BAT<\/td>\nmeta<\/td>\nNo description provided<\/td>\n2.432<\/tt><\/td>\n<\/tr>\n
KB_FORGED_MOZ4<\/td>\nheader<\/td>\nMozilla 4 uses X-Mailer<\/td>\n3.999<\/tt><\/td>\n<\/tr>\n
KB_RATWARE_MSGID<\/td>\nmeta<\/td>\nNo description provided<\/td>\n4.099<\/tt><\/td>\n<\/tr>\n
KB_RATWARE_OUTLOOK_MID<\/td>\nheader<\/td>\nNo description provided<\/td>\n4.400<\/tt><\/td>\n<\/tr>\n
KHOP_FAKE_EBAY<\/td>\nmeta<\/td>\nSender falsely claims to be from eBay<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
KHOP_HELO_FCRDNS<\/td>\nmeta<\/td>\nRelay HELO differs from its IP’s reverse DNS<\/td>\n0.400<\/tt><\/td>\n<\/tr>\n
LIST_PARTIAL_SHORT_MSG<\/td>\nmeta<\/td>\nIncomplete mailing list headers + short message<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
LIST_PRTL_PUMPDUMP<\/td>\nmeta<\/td>\nIncomplete List-* headers and stock pump-and-dump<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
LIST_PRTL_SAME_USER<\/td>\nmeta<\/td>\nIncomplete List-* headers and from+to user the same<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
LITECOIN_EXTORT_01<\/td>\nmeta<\/td>\nExtortion spam, pay via BitCoin<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
LIVEFILESTORE<\/td>\nuri<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
LOCALPART_IN_SUBJECT<\/td>\nheader<\/td>\nLocal part of To: address appears in Subject<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
LONGWORDS<\/td>\nmeta<\/td>\nLong string of long words<\/td>\n2.199<\/tt><\/td>\n<\/tr>\n
LONG_HEX_URI<\/td>\nmeta<\/td>\nVery long purely hexadecimal URI<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
LONG_IMG_URI<\/td>\nmeta<\/td>\nImage URI with very long path component – web bug?<\/td>\n0.503<\/tt><\/td>\n<\/tr>\n
LONG_TERM_PRICE<\/td>\nbody<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
LOTS_OF_MONEY<\/td>\nmeta<\/td>\nHuge… sums of money<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
LOTTERY_1<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
LOTTERY_PH_004470<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
LOW_PRICE<\/td>\nbody<\/td>\nLowest Price<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
LUCRATIVE<\/td>\nmeta<\/td>\nMake lots of money!<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
L_SPAM_TOOL_13<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.539<\/tt><\/td>\n<\/tr>\n
MAILING_LIST_MULTI<\/td>\nmeta<\/td>\nMultiple indicators imply a widely-seen list manager<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MALE_ENHANCE<\/td>\nbody<\/td>\nMessage talks about enhancing men<\/td>\n3.100<\/tt><\/td>\n<\/tr>\n
MALF_HTML_B64<\/td>\nmeta<\/td>\nMalformatted base64-encoded HTML content<\/td>\n2.206<\/tt><\/td>\n<\/tr>\n
MALWARE_NORDNS<\/td>\nmeta<\/td>\nMalware bragging + no rDNS<\/td>\n1.015<\/tt><\/td>\n<\/tr>\n
MALWARE_PASSWORD<\/td>\nmeta<\/td>\nMalware bragging + “password”<\/td>\n2.858<\/tt><\/td>\n<\/tr>\n
MANY_HDRS_LCASE<\/td>\nmeta<\/td>\nOdd capitalization of multiple message headers<\/td>\n0.099<\/tt><\/td>\n<\/tr>\n
MANY_SPAN_IN_TEXT<\/td>\nmeta<\/td>\nMany <SPAN> tags embedded within text<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MARKETING_PARTNERS<\/td>\nbody<\/td>\nClaims you registered with a partner<\/td>\n0.553<\/tt><\/td>\n<\/tr>\n
MAY_BE_FORGED<\/td>\nmeta<\/td>\nRelay IP’s reverse DNS does not resolve to IP<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
MICROSOFT_EXECUTABLE<\/td>\nbody<\/td>\nMessage includes Microsoft executable program<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
MILLION_HUNDRED<\/td>\nbody<\/td>\nMillion “One to Nine” Hundred<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MIMEOLE_DIRECT_TO_MX<\/td>\nmeta<\/td>\nMIMEOLE + direct-to-MX<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
MIMEPART_LIMIT_EXCEEDED<\/td>\nbody<\/td>\nMessage has too many MIME parts<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MIME_BASE64_TEXT<\/td>\nrawbody<\/td>\nMessage text disguised using base64 encoding<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MIME_BOUND_DD_DIGITS<\/td>\nheader<\/td>\nSpam tool pattern in MIME boundary<\/td>\n3.016<\/tt><\/td>\n<\/tr>\n
MIME_BOUND_DIGITS_15<\/td>\nheader<\/td>\nSpam tool pattern in MIME boundary<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
MIME_CHARSET_FARAWAY<\/td>\nmeta<\/td>\nMIME character set indicates foreign language<\/td>\n2.450<\/tt><\/td>\n<\/tr>\n
MIME_HEADER_CTYPE_ONLY<\/td>\nmeta<\/td>\n‘Content-Type’ found without required MIME headers<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
MIME_HTML_MOSTLY<\/td>\nbody<\/td>\nMultipart message mostly text\/html MIME<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
MIME_HTML_ONLY<\/td>\nbody<\/td>\nMessage only has text\/html MIME parts<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
MIME_HTML_ONLY_MULTI<\/td>\nmeta<\/td>\nMultipart message only has text\/html MIME parts<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
MIME_NO_TEXT<\/td>\nmeta<\/td>\nNo (properly identified) text body parts<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MIME_PHP_NO_TEXT<\/td>\nmeta<\/td>\nNo text body parts, X-Mailer: PHP<\/td>\n2.800<\/tt><\/td>\n<\/tr>\n
MIME_QP_LONG_LINE<\/td>\nrawbody<\/td>\nQuoted-printable line longer than 76 chars<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MIME_SUSPECT_NAME<\/td>\nbody<\/td>\nMIME filename does not match content<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
MISSING_DATE<\/td>\nmeta<\/td>\nMissing Date: header<\/td>\n2.739<\/tt><\/td>\n<\/tr>\n
MISSING_FROM<\/td>\nmeta<\/td>\nMissing From: header<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MISSING_HEADERS<\/td>\nheader<\/td>\nMissing To: header<\/td>\n0.915<\/tt><\/td>\n<\/tr>\n
MISSING_MID<\/td>\nmeta<\/td>\nMissing Message-Id: header<\/td>\n0.552<\/tt><\/td>\n<\/tr>\n
MISSING_MIMEOLE<\/td>\nmeta<\/td>\nMessage has X-MSMail-Priority, but no X-MimeOLE<\/td>\n0.392<\/tt><\/td>\n<\/tr>\n
MISSING_MIME_HB_SEP<\/td>\nbody<\/td>\nMissing blank line between MIME header and body<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MISSING_SUBJECT<\/td>\nmeta<\/td>\nMissing Subject: header<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MIXED_ES<\/td>\nmeta<\/td>\nToo many es are not es<\/td>\n2.599<\/tt><\/td>\n<\/tr>\n
MONERO_EXTORT_01<\/td>\nmeta<\/td>\nExtortion spam, pay via Monero cryptocurrency<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MONEY_ATM_CARD<\/td>\nmeta<\/td>\nLots of money on an ATM card<\/td>\n1.122<\/tt><\/td>\n<\/tr>\n
MONEY_BACK<\/td>\nbody<\/td>\nMoney back guarantee<\/td>\n2.910<\/tt><\/td>\n<\/tr>\n
MONEY_FORM_SHORT<\/td>\nmeta<\/td>\nLots of money if you fill out a short form<\/td>\n2.500<\/tt><\/td>\n<\/tr>\n
MONEY_FRAUD_3<\/td>\nmeta<\/td>\nLots of money and several fraud phrases<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
MONEY_FRAUD_5<\/td>\nmeta<\/td>\nLots of money and many fraud phrases<\/td>\n2.189<\/tt><\/td>\n<\/tr>\n
MONEY_FRAUD_8<\/td>\nmeta<\/td>\nLots of money and very many fraud phrases<\/td>\n3.199<\/tt><\/td>\n<\/tr>\n
MONEY_FROM_41<\/td>\nmeta<\/td>\nLots of money from Africa<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
MONEY_FROM_MISSP<\/td>\nmeta<\/td>\nLots of money and misspaced From<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
MORE_SEX<\/td>\nbody<\/td>\nTalks about a bigger drive for sex<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
MPART_ALT_DIFF<\/td>\nbody<\/td>\nHTML and text parts are different<\/td>\n2.246<\/tt><\/td>\n<\/tr>\n
MPART_ALT_DIFF_COUNT<\/td>\nbody<\/td>\nHTML and text parts are different<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
MSGID_FROM_MTA_HEADER<\/td>\nmeta<\/td>\nMessage-Id was added by a relay<\/td>\n0.401<\/tt><\/td>\n<\/tr>\n
MSGID_MULTIPLE_AT<\/td>\nheader<\/td>\nMessage-ID contains multiple ‘@’ characters<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MSGID_OUTLOOK_INVALID<\/td>\nheader<\/td>\nMessage-Id is fake (in Outlook Express format)<\/td>\n3.899<\/tt><\/td>\n<\/tr>\n
MSGID_RANDY<\/td>\nmeta<\/td>\nMessage-Id has pattern used in spam<\/td>\n2.196<\/tt><\/td>\n<\/tr>\n
MSGID_SHORT<\/td>\nheader<\/td>\nMessage-ID is unusually short<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
MSGID_SPAM_CAPS<\/td>\nheader<\/td>\nSpam tool Message-Id: (caps variant)<\/td>\n2.366<\/tt><\/td>\n<\/tr>\n
MSGID_YAHOO_CAPS<\/td>\nheader<\/td>\nMessage-ID has ALLCAPS@yahoo.com<\/td>\n0.797<\/tt><\/td>\n<\/tr>\n
MSM_PRIO_REPTO<\/td>\nmeta<\/td>\nMSMail priority header + Reply-to + short subject<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
MSOE_MID_WRONG_CASE<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.993<\/tt><\/td>\n<\/tr>\n
NEWEGG_IMG_NOT_RCVD_NEGG<\/td>\nmeta<\/td>\nNewegg hosted image but message not from Newegg<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
NML_ADSP_CUSTOM_HIGH<\/td>\nmeta<\/td>\nADSP custom_high hit, and not from a mailing list<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
NML_ADSP_CUSTOM_LOW<\/td>\nmeta<\/td>\nADSP custom_low hit, and not from a mailing list<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
NML_ADSP_CUSTOM_MED<\/td>\nmeta<\/td>\nADSP custom_med hit, and not from a mailing list<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
NORDNS_LOW_CONTRAST<\/td>\nmeta<\/td>\nNo rDNS + hidden text<\/td>\n1.883<\/tt><\/td>\n<\/tr>\n
NORMAL_HTTP_TO_IP<\/td>\nuri<\/td>\nURI host has a public dotted-decimal IPv4 address<\/td>\n0.159<\/tt><\/td>\n<\/tr>\n
NO_DNS_FOR_FROM<\/td>\nheader<\/td>\nEnvelope sender has no MX or A DNS records<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
NO_FM_NAME_IP_HOSTN<\/td>\nmeta<\/td>\nNo From name + hostname using IP address<\/td>\n0.101<\/tt><\/td>\n<\/tr>\n
NO_HEADERS_MESSAGE<\/td>\nmeta<\/td>\nMessage appears to be missing most RFC-822 headers<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
NO_MEDICAL<\/td>\nbody<\/td>\nNo Medical Exams<\/td>\n2.199<\/tt><\/td>\n<\/tr>\n
NO_PRESCRIPTION<\/td>\nbody<\/td>\nNo prescription needed<\/td>\n1.915<\/tt><\/td>\n<\/tr>\n
NO_RDNS_DOTCOM_HELO<\/td>\nheader<\/td>\nHost HELO’d as a big ISP, but had no rDNS<\/td>\n3.100<\/tt><\/td>\n<\/tr>\n
NO_RECEIVED<\/td>\nmeta<\/td>\nInformational: message has no Received headers<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
NO_RELAYS<\/td>\nheader<\/td>\nInformational: message was not relayed via SMTP<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
NSL_RCVD_FROM_USER<\/td>\nheader<\/td>\nReceived from User<\/td>\n2.601<\/tt><\/td>\n<\/tr>\n
NSL_RCVD_HELO_USER<\/td>\nheader<\/td>\nReceived from HELO User<\/td>\n0.167<\/tt><\/td>\n<\/tr>\n
NULL_IN_BODY<\/td>\nfull<\/td>\nMessage has NUL (ASCII 0) byte in message<\/td>\n0.511<\/tt><\/td>\n<\/tr>\n
NUMBEREND_LINKBAIT<\/td>\nmeta<\/td>\nDomain ends in a large number and very short body with link<\/td>\n0.999<\/tt><\/td>\n<\/tr>\n
NUMBERONLY_BITCOIN_EXP<\/td>\nmeta<\/td>\nDomain ends in a large number and very short body with link<\/td>\n0.318<\/tt><\/td>\n<\/tr>\n
NUMERIC_HTTP_ADDR<\/td>\nuri<\/td>\nUses a numeric IP address in URL<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
OBFUSCATING_COMMENT<\/td>\nmeta<\/td>\nHTML comments which obfuscate text<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
OBFU_BITCOIN<\/td>\nmeta<\/td>\nObfuscated BitCoin references<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
OBFU_JVSCR_ESC<\/td>\nrawbody<\/td>\nInjects content using obfuscated javascript<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
OBFU_TEXT_ATTACH<\/td>\nmimeheader<\/td>\nText attachment with non-text MIME type<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
ONE_TIME<\/td>\nbody<\/td>\nOne Time Rip Off<\/td>\n1.840<\/tt><\/td>\n<\/tr>\n
ONLINE_MKTG_CNSLT<\/td>\nbody<\/td>\nNo description provided<\/td>\n2.899<\/tt><\/td>\n<\/tr>\n
ONLINE_PHARMACY<\/td>\nbody<\/td>\nOnline Pharmacy<\/td>\n0.843<\/tt><\/td>\n<\/tr>\n
OOOBOUNCE_MESSAGE<\/td>\nmeta<\/td>\nOut Of Office bounce message<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
PART_CID_STOCK<\/td>\nmeta<\/td>\nHas a spammy image attachment (by Content-ID)<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
PART_CID_STOCK_LESS<\/td>\nmeta<\/td>\nHas a spammy image attachment (by Content-ID, more specific)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
PDS_BTC_ID<\/td>\nmeta<\/td>\nFP reduced Bitcoin ID<\/td>\n0.499<\/tt><\/td>\n<\/tr>\n
PDS_BTC_MSGID<\/td>\nmeta<\/td>\nBitcoin ID with T_MSGID_NOFQDN2<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PDS_DBL_URL_TNB_RUNON<\/td>\nmeta<\/td>\nDouble-url and To no arrows, from runon<\/td>\n1.796<\/tt><\/td>\n<\/tr>\n
PDS_FRNOM_TODOM_NAKED_TO<\/td>\nmeta<\/td>\nNaked to From name equals to Domain<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
PDS_FROM_2_EMAILS<\/td>\nmeta<\/td>\nNo description provided<\/td>\n2.401<\/tt><\/td>\n<\/tr>\n
PDS_FROM_NAME_TO_DOMAIN<\/td>\nmeta<\/td>\nFrom:name looks like To:domain<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PDS_HELO_SPF_FAIL<\/td>\nmeta<\/td>\nHigh profile HELO that fails SPF<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
PDS_HP_HELO_NORDNS<\/td>\nmeta<\/td>\nHigh profile HELO with no sender rDNS<\/td>\n0.847<\/tt><\/td>\n<\/tr>\n
PDS_LTC_AHACKER<\/td>\nmeta<\/td>\nLitecoin Hacker<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
PDS_LTC_CP<\/td>\nmeta<\/td>\nLocalized Bitcoin scam<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
PDS_LTC_HUSH<\/td>\nmeta<\/td>\nLTC, it is between us<\/td>\n1.287<\/tt><\/td>\n<\/tr>\n
PDS_NAKED_TO_NUMERO<\/td>\nmeta<\/td>\nNaked-to, numberonly domain<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
PDS_PHPEXP_BOT<\/td>\nmeta<\/td>\nPHP exploit bot sender<\/td>\n1.500<\/tt><\/td>\n<\/tr>\n
PDS_PHPE_URISHORTENER<\/td>\nmeta<\/td>\nURI Shortener with PHP eval<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
PDS_PHP_EVAL<\/td>\nmeta<\/td>\nPHP header shows eval’d code<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE<\/td>\nmeta<\/td>\nForged replyto and __PDS_TONAME_EQ_TOLOCAL<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE<\/td>\nmeta<\/td>\nTo: name matches everything in local email – LCASE headers<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
PDS_TONAME_EQ_TOLOCAL_SHORT<\/td>\nmeta<\/td>\nShort body with To: name matches everything in local email<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
PDS_TONAME_EQ_TOLOCAL_VSHORT<\/td>\nmeta<\/td>\nVery short body and From looks like 2 different emails<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PDS_TO_EQ_FROM_NAME<\/td>\nmeta<\/td>\nFrom: name same as To: address<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
PDS_X_PHP_WP_EXP<\/td>\nmeta<\/td>\nX-PHP-Script shows sent from a WordPress PHP script where you would not expect one<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
PERCENT_RANDOM<\/td>\nmeta<\/td>\nMessage has a random macro in it<\/td>\n2.999<\/tt><\/td>\n<\/tr>\n
PHOTO_EDITING_DIRECT<\/td>\nmeta<\/td>\nImage editing service, direct to MX<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PHOTO_EDITING_FREEM<\/td>\nmeta<\/td>\nImage editing service, freemail or CHN replyto<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PHP_NOVER_MUA<\/td>\nmeta<\/td>\nMail from PHP with no version number<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PHP_ORIG_SCRIPT<\/td>\nmeta<\/td>\nSent by bot & other signs<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
PHP_SCRIPT_MUA<\/td>\nmeta<\/td>\nSent by PHP script, no version number<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PLING_QUERY<\/td>\nmeta<\/td>\nSubject has exclamation mark and question mark<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
PP_MIME_FAKE_ASCII_TEXT<\/td>\nbody<\/td>\nMIME text\/plain claims to be ASCII but isn’t<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PP_TOO_MUCH_UNICODE02<\/td>\nbody<\/td>\nIs text\/plain but has many unicode escapes<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
PP_TOO_MUCH_UNICODE05<\/td>\nbody<\/td>\nIs text\/plain but has many unicode escapes<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PRICES_ARE_AFFORDABLE<\/td>\nbody<\/td>\nMessage says that prices aren’t too expensive<\/td>\n0.794<\/tt><\/td>\n<\/tr>\n
PUMPDUMP<\/td>\nmeta<\/td>\nPump-and-dump stock scam phrase<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PUMPDUMP_MULTI<\/td>\nmeta<\/td>\nPump-and-dump stock scam phrases<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PUMPDUMP_TIP<\/td>\nmeta<\/td>\nPump-and-dump stock tip<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
PYZOR_CHECK<\/td>\nfull<\/td>\nListed in Pyzor (https:\/\/pyzor.readthedocs.io\/en\/latest\/)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RAND_HEADER_MANY<\/td>\nmeta<\/td>\nMany random gibberish message headers<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
RATWARE_EFROM<\/td>\nheader<\/td>\nBulk email fingerprint (envfrom) found<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
RATWARE_EGROUPS<\/td>\nheader<\/td>\nBulk email fingerprint (eGroups) found<\/td>\n1.898<\/tt><\/td>\n<\/tr>\n
RATWARE_MPOP_WEBMAIL<\/td>\nheader<\/td>\nBulk email fingerprint (mPOP Web-Mail)<\/td>\n1.153<\/tt><\/td>\n<\/tr>\n
RATWARE_MS_HASH<\/td>\nmeta<\/td>\nBulk email fingerprint (msgid ms hash) found<\/td>\n2.036<\/tt><\/td>\n<\/tr>\n
RATWARE_NAME_ID<\/td>\nmeta<\/td>\nBulk email fingerprint (msgid from) found<\/td>\n3.099<\/tt><\/td>\n<\/tr>\n
RATWARE_NO_RDNS<\/td>\nmeta<\/td>\nSuspicious MsgID and MIME boundary + no rDNS<\/td>\n2.645<\/tt><\/td>\n<\/tr>\n
RATWARE_OUTLOOK_NONAME<\/td>\nmeta<\/td>\nBulk email fingerprint (Outlook no name) found<\/td>\n2.964<\/tt><\/td>\n<\/tr>\n
RATWARE_ZERO_TZ<\/td>\nmeta<\/td>\nBulk email fingerprint (+0000) found<\/td>\n2.392<\/tt><\/td>\n<\/tr>\n
RAZOR2_CF_RANGE_51_100<\/td>\nfull<\/td>\nRazor2 gives confidence level above 50%<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RAZOR2_CHECK<\/td>\nfull<\/td>\nListed in Razor2 (http:\/\/razor.sf.net\/)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_DBL_DQ<\/td>\nheader<\/td>\nMalformatted message header<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
RCVD_DOUBLE_IP_LOOSE<\/td>\nmeta<\/td>\nReceived: by and from look like IP addresses<\/td>\n1.150<\/tt><\/td>\n<\/tr>\n
RCVD_DOUBLE_IP_SPAM<\/td>\nmeta<\/td>\nBulk email fingerprint (double IP) found<\/td>\n2.411<\/tt><\/td>\n<\/tr>\n
RCVD_FAKE_HELO_DOTCOM<\/td>\nheader<\/td>\nReceived contains a faked HELO hostname<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
RCVD_HELO_IP_MISMATCH<\/td>\nheader<\/td>\nReceived: HELO and IP do not match, but should<\/td>\n1.680<\/tt><\/td>\n<\/tr>\n
RCVD_ILLEGAL_IP<\/td>\nheader<\/td>\nReceived: contains illegal IP address<\/td>\n1.300<\/tt><\/td>\n<\/tr>\n
RCVD_IN_BL_SPAMCOP_NET<\/td>\nheader<\/td>\nReceived via a relay in bl.spamcop.net<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_DNSWL_BLOCKED<\/td>\nheader<\/td>\nADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http:\/\/wiki.apache.org\/spamassassin\/DnsBlocklists\\#dnsbl-block for more information.<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_DNSWL_HI<\/td>\nheader<\/td>\nSender listed at https:\/\/www.dnswl.org\/, high trust<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_DNSWL_LOW<\/td>\nheader<\/td>\nSender listed at https:\/\/www.dnswl.org\/, low trust<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_DNSWL_MED<\/td>\nheader<\/td>\nSender listed at https:\/\/www.dnswl.org\/, medium trust<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_DNSWL_NONE<\/td>\nheader<\/td>\nSender listed at https:\/\/www.dnswl.org\/, no trust<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_DK<\/td>\nheader<\/td>\nIADB: Sender publishes Domain Keys record<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_DOPTIN<\/td>\nheader<\/td>\nIADB: All mailing list mail is confirmed opt-in<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_DOPTIN_LT50<\/td>\nheader<\/td>\nIADB: Confirmed opt-in used less than 50% of the time<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_LISTED<\/td>\nheader<\/td>\nParticipates in the IADB system<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_MI_CPR_MAT<\/td>\nheader<\/td>\nIADB: Sends no material under Michigan’s CPR<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_ML_DOPTIN<\/td>\nheader<\/td>\nIADB: Mailing list email only, confirmed opt-in<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_OPTIN<\/td>\nheader<\/td>\nIADB: All mailing list mail is opt-in<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_OPTIN_GT50<\/td>\nheader<\/td>\nIADB: Opt-in used more than 50% of the time<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_RDNS<\/td>\nheader<\/td>\nIADB: Sender has reverse DNS record<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_SENDERID<\/td>\nheader<\/td>\nIADB: Sender publishes Sender ID record<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_SPF<\/td>\nheader<\/td>\nIADB: Sender publishes SPF record<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_UT_CPR_MAT<\/td>\nheader<\/td>\nIADB: Sends no material under Utah’s CPR<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_IADB_VOUCHED<\/td>\nheader<\/td>\nISIPP IADB lists as vouched-for sender<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_BL<\/td>\nmeta<\/td>\nMailspike blacklisted<\/td>\n0.010<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_H2<\/td>\nheader<\/td>\nAverage reputation (+2)<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_H3<\/td>\nheader<\/td>\nGood reputation (+3)<\/td>\n-0.010<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_H4<\/td>\nheader<\/td>\nVery Good reputation (+4)<\/td>\n-0.010<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_H5<\/td>\nheader<\/td>\nExcellent reputation (+5)<\/td>\n-1.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_L2<\/td>\nheader<\/td>\nSuspicious reputation (-2)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_L3<\/td>\nheader<\/td>\nLow reputation (-3)<\/td>\n0.900<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_L4<\/td>\nheader<\/td>\nBad reputation (-4)<\/td>\n1.700<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_L5<\/td>\nheader<\/td>\nVery bad reputation (-5)<\/td>\n2.500<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_WL<\/td>\nmeta<\/td>\nMailspike good senders<\/td>\n-0.010<\/tt><\/td>\n<\/tr>\n
RCVD_IN_MSPIKE_ZBI<\/td>\nmeta<\/td>\nNo description provided<\/td>\n2.700<\/tt><\/td>\n<\/tr>\n
RCVD_IN_PBL<\/td>\nheader<\/td>\nReceived via a relay in Spamhaus PBL<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_PSBL<\/td>\nheader<\/td>\nReceived via a relay in PSBL<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_RP_CERTIFIED<\/td>\nheader<\/td>\nSender in ReturnPath Certified – Contact cert-sa@returnpath.net<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_RP_RNBL<\/td>\nheader<\/td>\nRelay in RNBL, https:\/\/senderscore.org\/blacklistlookup\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_RP_SAFE<\/td>\nheader<\/td>\nSender in ReturnPath Safe – Contact safe-sa@returnpath.net<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_SBL<\/td>\nheader<\/td>\nReceived via a relay in Spamhaus SBL<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_SBL_CSS<\/td>\nheader<\/td>\nReceived via a relay in Spamhaus SBL-CSS<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_SORBS_DUL<\/td>\nheader<\/td>\nSORBS: sent directly from dynamic IP address<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_SORBS_HTTP<\/td>\nheader<\/td>\nSORBS: sender is open HTTP proxy server<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_SORBS_SOCKS<\/td>\nheader<\/td>\nSORBS: sender is open SOCKS proxy server<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_SORBS_WEB<\/td>\nheader<\/td>\nSORBS: sender is an abusable web server<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_XBL<\/td>\nheader<\/td>\nReceived via a relay in Spamhaus XBL<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_ZEN_BLOCKED<\/td>\nheader<\/td>\nADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https:\/\/www.spamhaus.org\/returnc\/vol\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_IN_ZEN_BLOCKED_OPENDNS<\/td>\nheader<\/td>\nADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https:\/\/www.spamhaus.org\/returnc\/pub\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
RCVD_NUMERIC_HELO<\/td>\n???<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
RDNS_DYNAMIC<\/td>\nmeta<\/td>\nDelivered to internal network by host with dynamic-looking rDNS<\/td>\n2.639<\/tt><\/td>\n<\/tr>\n
RDNS_LOCALHOST<\/td>\nheader<\/td>\nSender’s public rDNS is “localhost”<\/td>\n3.700<\/tt><\/td>\n<\/tr>\n
RDNS_NONE<\/td>\nmeta<\/td>\nDelivered to internal network by a host with no rDNS<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
RDNS_NUM_TLD_ATCHNX<\/td>\nmeta<\/td>\nRelay rDNS has numeric TLD + suspicious attachment<\/td>\n2.640<\/tt><\/td>\n<\/tr>\n
RDNS_NUM_TLD_XM<\/td>\nmeta<\/td>\nRelay rDNS has numeric TLD + suspicious headers<\/td>\n3.000<\/tt><\/td>\n<\/tr>\n
REMOVE_BEFORE_LINK<\/td>\nbody<\/td>\nRemoval phrase right before a link<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
REPLICA_WATCH<\/td>\nbody<\/td>\nMessage talks about a replica watch<\/td>\n3.487<\/tt><\/td>\n<\/tr>\n
REPLYTO_WITHOUT_TO_CC<\/td>\nmeta<\/td>\nNo description provided<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
REPTO_QUOTE_YAHOO<\/td>\nmeta<\/td>\nYahoo! doesn’t do quoting like this<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
RP_MATCHES_RCVD<\/td>\n???<\/td>\nNo description provided<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
SB_GIF_AND_NO_URIS<\/td>\nmeta<\/td>\nNo description provided<\/td>\n2.199<\/tt><\/td>\n<\/tr>\n
SEO_SUSP_NTLD<\/td>\nmeta<\/td>\nSEO offer from suspicious TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
SERGIO_SUBJECT_PORN014<\/td>\nheader<\/td>\nF\\*\\*\\* garbled subject<\/td>\n3.099<\/tt><\/td>\n<\/tr>\n
SERGIO_SUBJECT_VIAGRA01<\/td>\nheader<\/td>\nViagra garbled subject<\/td>\n2.823<\/tt><\/td>\n<\/tr>\n
SHOPIFY_IMG_NOT_RCVD_SFY<\/td>\nmeta<\/td>\nShopify hosted image but message not from Shopify<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
SHORTENER_SHORT_IMG<\/td>\nmeta<\/td>\nShort HTML + image + URL shortener<\/td>\n0.133<\/tt><\/td>\n<\/tr>\n
SHORT_HELO_AND_INLINE_IMAGE<\/td>\nmeta<\/td>\nShort HELO string, with inline image<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
SHORT_IMG_SUSP_NTLD<\/td>\nmeta<\/td>\nShort HTML + image + suspicious TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
SHORT_SHORTNER<\/td>\nmeta<\/td>\nShort body with little more than a link to a shortener<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
SHORT_TERM_PRICE<\/td>\nbody<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SINGLETS_LOW_CONTRAST<\/td>\nmeta<\/td>\nSingle-letter formatted HTML + hidden text<\/td>\n1.377<\/tt><\/td>\n<\/tr>\n
SORTED_RECIPS<\/td>\nheader<\/td>\nRecipient list is sorted by address<\/td>\n1.801<\/tt><\/td>\n<\/tr>\n
SPAMMY_XMAILER<\/td>\nmeta<\/td>\nX-Mailer string is common in spam and not in ham<\/td>\n2.650<\/tt><\/td>\n<\/tr>\n
SPF_FAIL<\/td>\nheader<\/td>\nSPF: sender does not match SPF record (fail)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
SPF_HELO_FAIL<\/td>\nheader<\/td>\nSPF: HELO does not match SPF record (fail)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
SPF_HELO_NEUTRAL<\/td>\nheader<\/td>\nSPF: HELO does not match SPF record (neutral)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
SPF_HELO_NONE<\/td>\nheader<\/td>\nSPF: HELO does not publish an SPF Record<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPF_HELO_PASS<\/td>\nheader<\/td>\nSPF: HELO matches SPF record<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
SPF_HELO_SOFTFAIL<\/td>\nheader<\/td>\nSPF: HELO does not match SPF record (softfail)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
SPF_NEUTRAL<\/td>\nheader<\/td>\nSPF: sender does not match SPF record (neutral)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
SPF_NONE<\/td>\nheader<\/td>\nSPF: sender does not publish an SPF Record<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPF_PASS<\/td>\nheader<\/td>\nSPF: sender matches SPF record<\/td>\n-0.001<\/tt><\/td>\n<\/tr>\n
SPF_SOFTFAIL<\/td>\nheader<\/td>\nSPF: sender does not match SPF record (softfail)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
SPOOFED_FREEMAIL<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPOOFED_FREEMAIL_NO_RDNS<\/td>\nmeta<\/td>\nFrom SPOOFED_FREEMAIL and no rDNS<\/td>\n1.500<\/tt><\/td>\n<\/tr>\n
SPOOFED_FREEM_REPTO<\/td>\nmeta<\/td>\nForged freemail sender with freemail reply-to<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPOOFED_FREEM_REPTO_CHN<\/td>\nmeta<\/td>\nForged freemail sender with Chinese freemail reply-to<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPOOFED_FREEM_REPTO_RUS<\/td>\nmeta<\/td>\nForged freemail sender with Russian freemail reply-to<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPOOF_COM2COM<\/td>\nuri<\/td>\nURI contains “.com” in middle and end<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
SPOOF_COM2OTH<\/td>\nuri<\/td>\nURI contains “.com” in middle<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
STATIC_XPRIO_OLE<\/td>\nmeta<\/td>\nStatic RDNS + X-Priority + MIMEOLE<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
STOCK_IMG_CTYPE<\/td>\nmeta<\/td>\nStock spam image part, with distinctive Content-Type header<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
STOCK_IMG_HDR_FROM<\/td>\nmeta<\/td>\nStock spam image part, with distinctive From line<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
STOCK_IMG_HTML<\/td>\nmeta<\/td>\nStock spam image part, with distinctive HTML<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
STOCK_IMG_OUTLOOK<\/td>\nmeta<\/td>\nStock spam image part, with Outlook-like features<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
STOCK_LOW_CONTRAST<\/td>\nmeta<\/td>\nStocks + hidden text<\/td>\n1.392<\/tt><\/td>\n<\/tr>\n
STOCK_TIP<\/td>\nmeta<\/td>\nStock tips<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
STOX_REPLY_TYPE<\/td>\nheader<\/td>\nNo description provided<\/td>\n1.898<\/tt><\/td>\n<\/tr>\n
STOX_REPLY_TYPE_WITHOUT_QUOTES<\/td>\nmeta<\/td>\nNo description provided<\/td>\n3.099<\/tt><\/td>\n<\/tr>\n
STYLE_GIBBERISH<\/td>\n???<\/td>\nNo description provided<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
SUBJECT_DIET<\/td>\nheader<\/td>\nSubject talks about losing pounds<\/td>\n1.927<\/tt><\/td>\n<\/tr>\n
SUBJECT_DRUG_GAP_C<\/td>\nheader<\/td>\nSubject contains a gappy version of ‘cialis’<\/td>\n2.108<\/tt><\/td>\n<\/tr>\n
SUBJECT_DRUG_GAP_L<\/td>\nheader<\/td>\nSubject contains a gappy version of ‘levitra’<\/td>\n2.799<\/tt><\/td>\n<\/tr>\n
SUBJECT_FUZZY_CHEAP<\/td>\nheader<\/td>\nAttempt to obfuscate words in Subject:<\/td>\n0.641<\/tt><\/td>\n<\/tr>\n
SUBJECT_IN_BLACKLIST<\/td>\nheader<\/td>\nSubject: contains string in the user’s black-list<\/td>\n100.000<\/tt><\/td>\n<\/tr>\n
SUBJECT_IN_WHITELIST<\/td>\nheader<\/td>\nSubject: contains string in the user’s white-list<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
SUBJECT_NEEDS_ENCODING<\/td>\nmeta<\/td>\nSubject is encoded but does not specify the encoding<\/td>\n0.498<\/tt><\/td>\n<\/tr>\n
SUBJ_ALL_CAPS<\/td>\nheader<\/td>\nSubject is all capitals<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
SUBJ_AS_SEEN<\/td>\nheader<\/td>\nSubject contains “As Seen”<\/td>\n2.711<\/tt><\/td>\n<\/tr>\n
SUBJ_BRKN_WORDNUMS<\/td>\nmeta<\/td>\nSubject contains odd word breaks and numbers<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
SUBJ_BUY<\/td>\nheader<\/td>\nSubject line starts with Buy or Buying<\/td>\n0.594<\/tt><\/td>\n<\/tr>\n
SUBJ_DOLLARS<\/td>\nheader<\/td>\nSubject starts with dollar amount<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
SUBJ_ILLEGAL_CHARS<\/td>\nmeta<\/td>\nSubject: has too many raw illegal characters<\/td>\n0.620<\/tt><\/td>\n<\/tr>\n
SUBJ_OBFU_PUNCT_FEW<\/td>\nmeta<\/td>\nPossible punctuation-obfuscated Subject: header<\/td>\n0.749<\/tt><\/td>\n<\/tr>\n
SUBJ_OBFU_PUNCT_MANY<\/td>\nmeta<\/td>\nPunctuation-obfuscated Subject: header<\/td>\n1.749<\/tt><\/td>\n<\/tr>\n
SUBJ_UNNEEDED_HTML<\/td>\nmeta<\/td>\nUnneeded HTML formatting in Subject:<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
SUBJ_YOUR_FAMILY<\/td>\nheader<\/td>\nSubject contains “Your Family”<\/td>\n2.910<\/tt><\/td>\n<\/tr>\n
SURBL_BLOCKED<\/td>\nbody<\/td>\nADMINISTRATOR NOTICE: The query to SURBL was blocked. See http:\/\/wiki.apache.org\/spamassassin\/DnsBlocklists\\#dnsbl-block for more information.<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
SUSPICIOUS_RECIPS<\/td>\nheader<\/td>\nSimilar addresses in recipient list<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
SUSPNTLD_EXPIRATION_EXTORT<\/td>\nmeta<\/td>\nSusp NTLD with an expiration notice and lotsa money<\/td>\n2.000<\/tt><\/td>\n<\/tr>\n
SYSADMIN<\/td>\nmeta<\/td>\nSupposedly from your IT department<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
TBIRD_SUSP_MIME_BDRY<\/td>\nmeta<\/td>\nUnlikely Thunderbird MIME boundary<\/td>\n2.400<\/tt><\/td>\n<\/tr>\n
TEQF_USR_IMAGE<\/td>\nmeta<\/td>\nTo and from user nearly same + image<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
TEQF_USR_MSGID_HEX<\/td>\nmeta<\/td>\nTo and from user nearly same + unusual message ID<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
TEQF_USR_MSGID_MALF<\/td>\nmeta<\/td>\nTo and from user nearly same + malformed message ID<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
THEBAT_UNREG<\/td>\nheader<\/td>\nNo description provided<\/td>\n2.599<\/tt><\/td>\n<\/tr>\n
THIS_AD<\/td>\nmeta<\/td>\n“This ad” and variants<\/td>\n1.940<\/tt><\/td>\n<\/tr>\n
THIS_IS_ADV_SUSP_NTLD<\/td>\nmeta<\/td>\nThis is an advertisement from a suspicious TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
TONOM_EQ_TOLOC_SHRT_PSHRTNER<\/td>\nmeta<\/td>\nShort subject with potential shortener and To:name eq To:local<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
TONOM_EQ_TOLOC_SHRT_SHRTNER<\/td>\nmeta<\/td>\nShort email with shortener and To:name eq To:local<\/td>\n1.499<\/tt><\/td>\n<\/tr>\n
TO_EQ_FM_DIRECT_MX<\/td>\nmeta<\/td>\nTo == From and direct-to-MX<\/td>\n1.588<\/tt><\/td>\n<\/tr>\n
TO_EQ_FM_DOM_HTML_IMG<\/td>\nmeta<\/td>\nTo domain == From domain and HTML image link<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TO_EQ_FM_DOM_HTML_ONLY<\/td>\nmeta<\/td>\nTo domain == From domain and HTML only<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TO_EQ_FM_DOM_SPF_FAIL<\/td>\nmeta<\/td>\nTo domain == From domain and external SPF failed<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TO_EQ_FM_HTML_ONLY<\/td>\nmeta<\/td>\nTo == From and HTML only<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TO_EQ_FM_SPF_FAIL<\/td>\nmeta<\/td>\nTo == From and external SPF failed<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TO_IN_SUBJ<\/td>\nmeta<\/td>\nTo address is in Subject<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
TO_MALFORMED<\/td>\nheader<\/td>\nTo: has a malformed address<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
TO_NAME_SUBJ_NO_RDNS<\/td>\nmeta<\/td>\nRecipient username in subject + no rDNS<\/td>\n2.602<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_DYNIP<\/td>\nmeta<\/td>\nTo: lacks brackets and dynamic rDNS<\/td>\n1.961<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_FROM_MSSP<\/td>\nmeta<\/td>\nMultiple header formatting problems<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_HTML_IMG<\/td>\nmeta<\/td>\nTo: lacks brackets and HTML and one image<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_HTML_ONLY<\/td>\nmeta<\/td>\nTo: lacks brackets and HTML only<\/td>\n1.999<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_MSFT<\/td>\nmeta<\/td>\nTo: lacks brackets and supposed Microsoft tool<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_NORDNS_HTML<\/td>\nmeta<\/td>\nTo: lacks brackets and no rDNS and HTML only<\/td>\n1.496<\/tt><\/td>\n<\/tr>\n
TO_NO_BRKTS_PCNT<\/td>\nmeta<\/td>\nTo: lacks brackets + percentage<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
TRACKER_ID<\/td>\nbody<\/td>\nIncorporates a tracking ID number<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
TT_MSGID_TRUNC<\/td>\nheader<\/td>\nScora: Message-Id ends after left-bracket + digits<\/td>\n0.748<\/tt><\/td>\n<\/tr>\n
TVD_APPROVED<\/td>\nbody<\/td>\nBody states that the recipient has been approved<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
TVD_FINGER_02<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_FW_GRAPHIC_NAME_LONG<\/td>\nmimeheader<\/td>\nLong image attachment name<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_FW_GRAPHIC_NAME_MID<\/td>\nmimeheader<\/td>\nMedium sized image attachment name<\/td>\n0.600<\/tt><\/td>\n<\/tr>\n
TVD_INCREASE_SIZE<\/td>\nbody<\/td>\nAdvertising for penis enlargement<\/td>\n1.529<\/tt><\/td>\n<\/tr>\n
TVD_IP_OCT<\/td>\nuri<\/td>\nNo description provided<\/td>\n2.348<\/tt><\/td>\n<\/tr>\n
TVD_PH_BODY_ACCOUNTS_PRE<\/td>\nmeta<\/td>\nThe body matches phrases such as “accounts suspended”, “account credited”, “account verification”<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_PH_REC<\/td>\nbody<\/td>\nMessage includes a phrase commonly used in phishing mails<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
TVD_PH_SEC<\/td>\nbody<\/td>\nMessage includes a phrase commonly used in phishing mails<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
TVD_QUAL_MEDS<\/td>\nbody<\/td>\nThe body matches phrases such as “quality meds” or “quality medication”<\/td>\n2.697<\/tt><\/td>\n<\/tr>\n
TVD_RCVD_IP<\/td>\nheader<\/td>\nMessage was received from an IP address<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_RCVD_IP4<\/td>\nheader<\/td>\nMessage was received from an IPv4 address<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_RCVD_SPACE_BRACKET<\/td>\nheader<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_SPACE_ENCODED<\/td>\nmeta<\/td>\nSpace ratio & encoded subject<\/td>\n1.500<\/tt><\/td>\n<\/tr>\n
TVD_SPACE_RATIO<\/td>\nmeta<\/td>\nNo description provided<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
TVD_SPACE_RATIO_MINFP<\/td>\nmeta<\/td>\nSpace ratio<\/td>\n1.500<\/tt><\/td>\n<\/tr>\n
TVD_SUBJ_ACC_NUM<\/td>\nheader<\/td>\nSubject has spammy looking monetary reference<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
TVD_SUBJ_WIPE_DEBT<\/td>\nheader<\/td>\nSpam advertising a way to eliminate debt<\/td>\n2.599<\/tt><\/td>\n<\/tr>\n
TVD_VISIT_PHARMA<\/td>\nbody<\/td>\nBody mentions online pharmacy<\/td>\n1.957<\/tt><\/td>\n<\/tr>\n
TW_GIBBERISH_MANY<\/td>\nmeta<\/td>\nLots of gibberish text to spoof pattern matching filters<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
TXREP<\/td>\nheader<\/td>\nScore normalizing based on sender’s reputation<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
T_ACH_CANCELLED_EXE<\/td>\nmeta<\/td>\n“ACH cancelled” probable malware<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_ANY_PILL_PRICE<\/td>\nmeta<\/td>\nPrices for pills<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_CDISP_SZ_MANY<\/td>\nmimeheader<\/td>\nSuspicious MIME header<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_DATE_IN_FUTURE_Q_PLUS<\/td>\nheader<\/td>\nDate: is over 4 months after Received: date<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_DOC_ATTACH_NO_EXT<\/td>\nmeta<\/td>\nDocument attachment with suspicious name<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_DOS_OUTLOOK_TO_MX_IMAGE<\/td>\nmeta<\/td>\nDirect to MX with Outlook headers and an image<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_DOS_ZIP_HARDCORE<\/td>\nmimeheader<\/td>\nhardcore.zip file attached; quite certainly a virus<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_EMRCP<\/td>\nbody<\/td>\n“Excess Maximum Return Capital Profit” scam<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FILL_THIS_FORM_FRAUD_PHISH<\/td>\nmeta<\/td>\nAnswer suspicious question(s)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FILL_THIS_FORM_LOAN<\/td>\nmeta<\/td>\nAnswer loan question(s)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FILL_THIS_FORM_SHORT<\/td>\nmeta<\/td>\nFill in a short form with personal information<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FORGED_TBIRD_IMG_SIZE<\/td>\nmeta<\/td>\nLikely forged Thunderbird image spam<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FREEMAIL_DOC_PDF<\/td>\nmeta<\/td>\nMS document or PDF attachment, from freemail<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FREEMAIL_DOC_PDF_BCC<\/td>\nmeta<\/td>\nMS document or PDF attachment, from freemail, all recipients hidden<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FREEMAIL_RVW_ATTCH<\/td>\nmeta<\/td>\nPlease review attached document, from freemail<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FROMNAME_EQUALS_TO<\/td>\nmeta<\/td>\nFrom:name matches To:<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FROMNAME_SPOOFED_EMAIL<\/td>\nmeta<\/td>\nFrom:name looks like a spoofed email<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_FUZZY_OPTOUT<\/td>\nbody<\/td>\nObfuscated opt-out text<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_GB_FREEM_FROM_NOT_REPLY<\/td>\nmeta<\/td>\nFrom: and Reply-To: have different freemail domains<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_GB_FROMNAME_SPOOFED_EMAIL_IP<\/td>\nmeta<\/td>\nFrom:name looks like a spoofed email from a spoofed ip<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_HTML_ATTACH<\/td>\nmeta<\/td>\nHTML attachment to bypass scanning?<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_HTML_TAG_BALANCE_CENTER<\/td>\nmeta<\/td>\nMalformatted HTML<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_ISO_ATTACH<\/td>\nmeta<\/td>\nISO attachment – possible malware delivery<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_KAM_HTML_FONT_INVALID<\/td>\nbody<\/td>\nTest for Invalidly Named or Formatted Colors in HTML<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_LARGE_PCT_AFTER_MANY<\/td>\nmeta<\/td>\nMany large percentages after…<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_LOTTO_AGENT<\/td>\nmeta<\/td>\nClaims Agent<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_LOTTO_AGENT_FM<\/td>\nheader<\/td>\nClaims Agent<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_LOTTO_AGENT_RPLY<\/td>\nmeta<\/td>\nClaims Agent<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_LOTTO_URI<\/td>\nuri<\/td>\nClaims Department URL<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_MALW_ATTACH<\/td>\nmeta<\/td>\nAttachment filename suspicious, probable malware exploit<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_MANY_PILL_PRICE<\/td>\nmeta<\/td>\nPrices for many pills<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_MIME_MALF<\/td>\nmeta<\/td>\nMalformed MIME: headers in body<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_MONEY_PERCENT<\/td>\nmeta<\/td>\nX% of a lot of money for you<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_ATTACH_MISSP<\/td>\nmeta<\/td>\nObfuscated attachment type and misspaced From<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_DOC_ATTACH<\/td>\nmimeheader<\/td>\nMS Document attachment with generic MIME type<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_GIF_ATTACH<\/td>\nmimeheader<\/td>\nGIF attachment with generic MIME type<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_HTML_ATTACH<\/td>\nmimeheader<\/td>\nHTML attachment with non-text MIME type<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_HTML_ATT_MALW<\/td>\nmeta<\/td>\nHTML attachment with incorrect MIME type – possible malware<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_JPG_ATTACH<\/td>\nmimeheader<\/td>\nJPG attachment with generic MIME type<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OBFU_PDF_ATTACH<\/td>\nmimeheader<\/td>\nPDF attachment with generic MIME type<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_OFFER_ONLY_AMERICA<\/td>\nmeta<\/td>\nOffer only available to US<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_PDS_BTC_AHACKER<\/td>\nmeta<\/td>\nBitcoin Hacker<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_PDS_BTC_HACKER<\/td>\nmeta<\/td>\nBitcoin Hacker<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_PDS_BTC_NTLD<\/td>\nmeta<\/td>\nBitcoin suspect NTLD<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_PDS_LTC_HACKER<\/td>\nmeta<\/td>\nLitecoin Hacker<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_REMOTE_IMAGE<\/td>\nmeta<\/td>\nMessage contains an external image<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_SENT_TO_EMAIL_ADDR<\/td>\nmeta<\/td>\nEmail was sent to email address<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_SHARE_50_50<\/td>\nmeta<\/td>\nShare the money 50\/50<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_SPF_HELO_PERMERROR<\/td>\nheader<\/td>\nSPF: test of HELO record failed (permerror)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_SPF_HELO_TEMPERROR<\/td>\nheader<\/td>\nSPF: test of HELO record failed (temperror)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_SPF_PERMERROR<\/td>\nheader<\/td>\nSPF: test of record failed (permerror)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_SPF_TEMPERROR<\/td>\nheader<\/td>\nSPF: test of record failed (temperror)<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_WON_MONEY_ATTACH<\/td>\nmeta<\/td>\nYou won lots of money! See attachment.<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_WON_NBDY_ATTACH<\/td>\nmeta<\/td>\nYou won lots of money! See attachment.<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_ZW_OBFU_BITCOIN<\/td>\nmeta<\/td>\nObfuscated text + bitcoin ID – possible extortion<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_ZW_OBFU_FREEM<\/td>\nmeta<\/td>\nObfuscated text + freemail<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
T_ZW_OBFU_FROMTOSUBJ<\/td>\nmeta<\/td>\nObfuscated text + from in to and subject<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
UC_GIBBERISH_OBFU<\/td>\nmeta<\/td>\nMultiple instances of “word VERYLONGGIBBERISH word”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
UNCLAIMED_MONEY<\/td>\nbody<\/td>\nPeople just leave money laying around<\/td>\n2.699<\/tt><\/td>\n<\/tr>\n
UNCLOSED_BRACKET<\/td>\nheader<\/td>\nHeaders contain an unclosed bracket<\/td>\n2.699<\/tt><\/td>\n<\/tr>\n
UNICODE_OBFU_ASC<\/td>\nmeta<\/td>\nObfuscating text with unicode<\/td>\n2.500<\/tt><\/td>\n<\/tr>\n
UNICODE_OBFU_ZW<\/td>\nmeta<\/td>\nObfuscating text with hidden characters<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
UNPARSEABLE_RELAY<\/td>\nmeta<\/td>\nInformational: message has unparseable relay lines<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
UNRESOLVED_TEMPLATE<\/td>\nheader<\/td>\nHeaders contain an unresolved template<\/td>\n3.035<\/tt><\/td>\n<\/tr>\n
UNWANTED_LANGUAGE_BODY<\/td>\nbody<\/td>\nMessage written in an undesired language<\/td>\n2.800<\/tt><\/td>\n<\/tr>\n
UPGRADE_MAILBOX<\/td>\nmeta<\/td>\nUpgrade your mailbox! (phishing?)<\/td>\n1.272<\/tt><\/td>\n<\/tr>\n
UPPERCASE_50_75<\/td>\nmeta<\/td>\nmessage body is 50-75% uppercase<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
UPPERCASE_75_100<\/td>\nmeta<\/td>\nmessage body is 75-100% uppercase<\/td>\n1.480<\/tt><\/td>\n<\/tr>\n
URG_BIZ<\/td>\nbody<\/td>\nContains urgent matter<\/td>\n1.750<\/tt><\/td>\n<\/tr>\n
URIBL_ABUSE_SURBL<\/td>\nbody<\/td>\nContains an URL listed in the ABUSE SURBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_CR_SURBL<\/td>\nbody<\/td>\nContains an URL listed in the CR SURBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_CSS<\/td>\nbody<\/td>\nContains an URL’s NS IP listed in the Spamhaus CSS blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_CSS_A<\/td>\nbody<\/td>\nContains URL’s A record listed in the Spamhaus CSS blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_ABUSE_BOTCC<\/td>\nbody<\/td>\nContains an abused botnet C&C URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_ABUSE_MALW<\/td>\nbody<\/td>\nContains an abused malware URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_ABUSE_PHISH<\/td>\nbody<\/td>\nContains an abused phishing URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_ABUSE_REDIR<\/td>\nbody<\/td>\nContains an abused redirector URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_ABUSE_SPAM<\/td>\nbody<\/td>\nContains an abused spamvertized URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_BLOCKED<\/td>\nbody<\/td>\nADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https:\/\/www.spamhaus.org\/returnc\/vol\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_BLOCKED_OPENDNS<\/td>\nbody<\/td>\nADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https:\/\/www.spamhaus.org\/returnc\/pub\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_BOTNETCC<\/td>\nbody<\/td>\nContains a botned C&C URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_ERROR<\/td>\nbody<\/td>\nError: queried the Spamhaus DBL blocklist for an IP<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_MALWARE<\/td>\nbody<\/td>\nContains a malware URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_PHISH<\/td>\nbody<\/td>\nContains a Phishing URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_DBL_SPAM<\/td>\nbody<\/td>\nContains a spam URL listed in the Spamhaus DBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_MW_SURBL<\/td>\nbody<\/td>\nContains a URL listed in the MW SURBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_PH_SURBL<\/td>\nbody<\/td>\nContains an URL listed in the PH SURBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_RHS_DOB<\/td>\nbody<\/td>\nContains an URI of a new domain (Day Old Bread)<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_SBL<\/td>\nbody<\/td>\nContains an URL’s NS IP listed in the Spamhaus SBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_SBL_A<\/td>\nbody<\/td>\nContains URL’s A record listed in the Spamhaus SBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_WS_SURBL<\/td>\nbody<\/td>\nContains an URL listed in the WS SURBL blocklist<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_ZEN_BLOCKED<\/td>\nbody<\/td>\nADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https:\/\/www.spamhaus.org\/returnc\/vol\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URIBL_ZEN_BLOCKED_OPENDNS<\/td>\nbody<\/td>\nADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https:\/\/www.spamhaus.org\/returnc\/pub\/<\/td>\n0.000<\/tt><\/td>\n<\/tr>\n
URI_DATA<\/td>\nmeta<\/td>\n“data:” URI – possible malware or phish<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_DQ_UNSUB<\/td>\nmeta<\/td>\nIP-address unsubscribe URI<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_GOOGLE_PROXY<\/td>\nmeta<\/td>\nAccessing a blacklisted URI or obscuring source of phish via Google proxy?<\/td>\n2.399<\/tt><\/td>\n<\/tr>\n
URI_HEX<\/td>\nuri<\/td>\nURI hostname has long hexadecimal sequence<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
URI_HEX_IP<\/td>\nmeta<\/td>\nURI with hex-encoded IP-address host<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_HOST_IN_BLACKLIST<\/td>\nbody<\/td>\nHost or Domain is listed in the user’s URI black-list<\/td>\n100.000<\/tt><\/td>\n<\/tr>\n
URI_HOST_IN_WHITELIST<\/td>\nbody<\/td>\nHost or Domain is listed in the user’s URI white-list<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
URI_IMG_WP_REDIR<\/td>\nmeta<\/td>\nImage via WordPress “accelerator” proxy<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_NOVOWEL<\/td>\nuri<\/td>\nURI hostname has long non-vowel sequence<\/td>\n0.500<\/tt><\/td>\n<\/tr>\n
URI_NO_WWW_BIZ_CGI<\/td>\nuri<\/td>\nCGI in .biz TLD other than third-level “www”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_NO_WWW_INFO_CGI<\/td>\nuri<\/td>\nCGI in .info TLD other than third-level “www”<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_ONLY_MSGID_MALF<\/td>\nmeta<\/td>\nURI only + malformed message ID<\/td>\n1.803<\/tt><\/td>\n<\/tr>\n
URI_OPTOUT_3LD<\/td>\nuri<\/td>\nOpt-out URI, suspicious hostname<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_OPTOUT_USME<\/td>\nuri<\/td>\nOpt-out URI, unusual TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_PHISH<\/td>\nmeta<\/td>\nPhishing using web form<\/td>\n2.252<\/tt><\/td>\n<\/tr>\n
URI_PHP_REDIR<\/td>\nmeta<\/td>\nPHP redirect to different URL (link obfuscation)<\/td>\n3.499<\/tt><\/td>\n<\/tr>\n
URI_TRUNCATED<\/td>\nbody<\/td>\nMessage contained a URI which was truncated<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
URI_TRY_3LD<\/td>\nuri<\/td>\n“Try it” URI, suspicious hostname<\/td>\n1.791<\/tt><\/td>\n<\/tr>\n
URI_TRY_USME<\/td>\nmeta<\/td>\n“Try it” URI, unusual TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_WPADMIN<\/td>\nmeta<\/td>\nWordPress login\/admin URI, possible phishing<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
URI_WP_DIRINDEX<\/td>\nmeta<\/td>\nURI for compromised WordPress site, possible malware<\/td>\n1.538<\/tt><\/td>\n<\/tr>\n
URI_WP_HACKED<\/td>\nmeta<\/td>\nURI for compromised WordPress site, possible malware<\/td>\n3.499<\/tt><\/td>\n<\/tr>\n
URI_WP_HACKED_2<\/td>\nmeta<\/td>\nURI for compromised WordPress site, possible malware<\/td>\n2.499<\/tt><\/td>\n<\/tr>\n
USB_DRIVES<\/td>\nmeta<\/td>\nTrying to sell custom USB flash drives<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
USER_IN_ALL_SPAM_TO<\/td>\nheader<\/td>\nUser is listed in ‘all_spam_to’<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
USER_IN_BLACKLIST<\/td>\nheader<\/td>\nFrom: address is in the user’s black-list<\/td>\n100.000<\/tt><\/td>\n<\/tr>\n
USER_IN_BLACKLIST_TO<\/td>\nheader<\/td>\nUser is listed in ‘blacklist_to’<\/td>\n10.000<\/tt><\/td>\n<\/tr>\n
USER_IN_DEF_DKIM_WL<\/td>\nheader<\/td>\nFrom: address is in the default DKIM white-list<\/td>\n-7.500<\/tt><\/td>\n<\/tr>\n
USER_IN_DEF_SPF_WL<\/td>\nheader<\/td>\nFrom: address is in the default SPF white-list<\/td>\n-7.500<\/tt><\/td>\n<\/tr>\n
USER_IN_DEF_WHITELIST<\/td>\nheader<\/td>\nFrom: address is in the default white-list<\/td>\n-15.000<\/tt><\/td>\n<\/tr>\n
USER_IN_DKIM_WHITELIST<\/td>\nheader<\/td>\nFrom: address is in the user’s DKIM whitelist<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
USER_IN_MORE_SPAM_TO<\/td>\nheader<\/td>\nUser is listed in ‘more_spam_to’<\/td>\n-20.000<\/tt><\/td>\n<\/tr>\n
USER_IN_SPF_WHITELIST<\/td>\nheader<\/td>\nFrom: address is in the user’s SPF whitelist<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
USER_IN_WHITELIST<\/td>\nheader<\/td>\nFrom: address is in the user’s white-list<\/td>\n-100.000<\/tt><\/td>\n<\/tr>\n
USER_IN_WHITELIST_TO<\/td>\nheader<\/td>\nUser is listed in ‘whitelist_to’<\/td>\n-6.000<\/tt><\/td>\n<\/tr>\n
VBOUNCE_MESSAGE<\/td>\nmeta<\/td>\nVirus-scanner bounce message<\/td>\n0.100<\/tt><\/td>\n<\/tr>\n
VPS_NO_NTLD<\/td>\nmeta<\/td>\nvps[0-9] domain at a suspiscious TLD<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
WALMART_IMG_NOT_RCVD_WAL<\/td>\nmeta<\/td>\nWalmart hosted image but message not from Walmart<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
WEIRD_PORT<\/td>\nuri<\/td>\nUses non-standard port number for HTTP<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
WEIRD_QUOTING<\/td>\nbody<\/td>\nWeird repeated double-quotation marks<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
XM_PHPMAILER_FORGED<\/td>\nmeta<\/td>\nApparently forged header<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
XPRIO<\/td>\nmeta<\/td>\nHas X-Priority header<\/td>\n2.250<\/tt><\/td>\n<\/tr>\n
XPRIO_SHORT_SUBJ<\/td>\nmeta<\/td>\nHas X-Priority header + short subject<\/td>\n2.500<\/tt><\/td>\n<\/tr>\n
XPRIO_URL_SHORTNER<\/td>\nmeta<\/td>\nX-Priority header and short URL<\/td>\n0.340<\/tt><\/td>\n<\/tr>\n
X_IP<\/td>\nheader<\/td>\nMessage has X-IP header<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
X_MAILER_CME_6543_MSN<\/td>\nheader<\/td>\nNo description provided<\/td>\n2.886<\/tt><\/td>\n<\/tr>\n
YOU_INHERIT<\/td>\nmeta<\/td>\nDiscussing your inheritance<\/td>\n0.001<\/tt><\/td>\n<\/tr>\n
__DC_GIF_MULTI_LARGO<\/td>\nmeta<\/td>\nMessage has 2+ inline gif covering lots of area<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__DC_IMG_HTML_RATIO<\/td>\nrawbody<\/td>\nLow rawbody to pixel area ratio<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__DC_IMG_TEXT_RATIO<\/td>\nbody<\/td>\nLow body to pixel area ratio<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__DC_PNG_MULTI_LARGO<\/td>\nmeta<\/td>\nMessage has 2+ png images covering lots of area<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__DKIM_DEPENDABLE<\/td>\nfull<\/td>\nA validation failure not attributable to truncation<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__FORGED_TBIRD_IMG<\/td>\nmeta<\/td>\nPossibly forged Thunderbird image spam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__FROM_41_FREEMAIL<\/td>\nmeta<\/td>\nSent from Africa + freemail provider<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_DE<\/td>\nmeta<\/td>\nGerman Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_EN<\/td>\nmeta<\/td>\nEnglish Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_ES<\/td>\nmeta<\/td>\nSpanish Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_FR<\/td>\nmeta<\/td>\nFrench Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_IT<\/td>\nmeta<\/td>\nItalian Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_NL<\/td>\nmeta<\/td>\nDutch Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__GB_BITCOIN_CP_SE<\/td>\nmeta<\/td>\nSwedish Bitcoin scam<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__HAS_HREF<\/td>\nrawbody<\/td>\nHas an anchor tag with a href attribute in non-quoted line<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__HAS_HREF_ONECASE<\/td>\nrawbody<\/td>\nHas an anchor tag with a href attribute in non-quoted line with consistent case<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__HAS_IMG_SRC<\/td>\nrawbody<\/td>\nHas an img tag on a non-quoted line<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__HAS_IMG_SRC_ONECASE<\/td>\nrawbody<\/td>\nHas an img tag on a non-quoted line with consistent case<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__KAM_BODY_LENGTH_LT_1024<\/td>\nbody<\/td>\nThe length of the body of the email is less than 1024 bytes.<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__KAM_BODY_LENGTH_LT_128<\/td>\nbody<\/td>\nThe length of the body of the email is less than 128 bytes.<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__KAM_BODY_LENGTH_LT_256<\/td>\nbody<\/td>\nThe length of the body of the email is less than 256 bytes.<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__KAM_BODY_LENGTH_LT_512<\/td>\nbody<\/td>\nThe length of the body of the email is less than 512 bytes.<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__MIME_BASE64<\/td>\nrawbody<\/td>\nIncludes a base64 attachment<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__MIME_QP<\/td>\nrawbody<\/td>\nIncludes a quoted-printable attachment<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__ML_TURNS_SP_TO_TAB<\/td>\nheader<\/td>\nA mailing list changing a space to a TAB<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__NSL_ORIG_FROM_41<\/td>\nheader<\/td>\nOriginates from 41.0.0.0\/8<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__NSL_RCVD_FROM_41<\/td>\nheader<\/td>\nReceived from 41.0.0.0\/8<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RCVD_IN_MSPIKE_Z<\/td>\nheader<\/td>\nSpam wave participant<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RCVD_IN_SORBS<\/td>\nheader<\/td>\nSORBS: sender is listed in SORBS<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RCVD_IN_ZEN<\/td>\nheader<\/td>\nReceived via a relay in Spamhaus Zen<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_ADELPHIA<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Adelphia)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_ATTBI<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (ATTBI.com)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_CHELLO_NL<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Chello.nl)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_CHELLO_NO<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Chello.no)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_COMCAST<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Comcast)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_DHCP<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (DHCP)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_DIALIN<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (T-Dialin)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_HCC<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (HCC)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_HEXIP<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Hex IP)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_IPADDR<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (IP addr 1)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_NTL<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (NTL)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_OOL<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (OptOnline)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_ROGERS<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Rogers)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_RR2<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (RR 2)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_SPLIT_IP<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Split IP)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_TELIA<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Telia)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_VELOX<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (Veloxzone)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_VTR<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (VTR)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__RDNS_DYNAMIC_YAHOOBB<\/td>\nheader<\/td>\nRelay HELO’d using suspicious hostname (YahooBB)<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__TO_EQ_FROM<\/td>\nmeta<\/td>\nTo: same as From:<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__TO_EQ_FROM_DOM<\/td>\nmeta<\/td>\nTo: domain same as From: domain<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__TO_EQ_FROM_USR<\/td>\nmeta<\/td>\nTo: username same as From: username<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__TO_EQ_FROM_USR_NN<\/td>\nmeta<\/td>\nTo: username same as From: username sans trailing nums<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__VIA_ML<\/td>\nmeta<\/td>\nMail from a mailing list<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n
__VIA_RESIGNER<\/td>\nmeta<\/td>\nMail through a popular signing remailer<\/td>\n1.000<\/tt><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
 <\/p>\n
whitelist_from : \ubbff\uc744 \uc218 \uc788\ub294 \uba54\uc77c\uc8fc\uc18c\ub97c \uc9c0\uc815\ud574\uc8fc\uc790. \ub9e4\uc6b0 \uc911\uc694\ud55c \uac70\ub798\ucc98\uc758 \uba54\uc77c\uc774\ub098 \uac19\uc740 \uc11c\ubc84\uc758 \uba54\uc77c\uc740 \uad73\uc774 \uc810\uc218\ub97c \ub9e4\uae38\ud544\uc694\uac00 \uc5c6\ub2e4.<\/p>\n
\ub2e4\uc74c\uc758 SPF\uc124\uc815\uc740 SPF\uc758 \uc2e0\ub8b0\ub3c4\ub97c \ubbff\uace0 \uc810\uc218\ub97c -\ud574\uc8fc\uaca0\ub2e4\ub294 \ub73b\uc744 \uac00\uc9c0\uac8c \ub41c\ub2e4<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
\ucc38\uc870 :\u00a0https:\/\/wiki.apache.org\/spamassassin\/WritingRules body LOCAL_DEMONSTRATION_RULE \/test\/ score LOCAL_DEMONSTRATION_RULE 0.1 describe LOCAL_DEMONSTRATION_RULE This is a simple test rule Perl Regex Syntax \ucc38\uc870: https:\/\/www.tutorialspoint.com\/perl\/perl_regular_expressions.htm :: spamassassin \ub8f0 \uc124\uc815 […]<\/a><\/p>\n<\/div>","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[52],"tags":[],"class_list":["post-2615","post","type-post","status-publish","format-standard","hentry","category-qmail"],"yoast_head":"\n[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec) - AuctionPro<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.auctionpro.co.kr\/?p=2615\" \/>\n<meta property=\"og:locale\" content=\"ko_KR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec) - AuctionPro\" \/>\n<meta property=\"og:description\" content=\"\ucc38\uc870 :\u00a0https:\/\/wiki.apache.org\/spamassassin\/WritingRules body LOCAL_DEMONSTRATION_RULE \/test\/ score LOCAL_DEMONSTRATION_RULE 0.1 describe LOCAL_DEMONSTRATION_RULE This is a simple test rule Perl Regex Syntax \ucc38\uc870: https:\/\/www.tutorialspoint.com\/perl\/perl_regular_expressions.htm :: spamassassin \ub8f0 \uc124\uc815 [...]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.auctionpro.co.kr\/?p=2615\" \/>\n<meta property=\"og:site_name\" content=\"AuctionPro\" \/>\n<meta property=\"article:published_time\" content=\"2013-07-19T09:39:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-12-04T01:10:42+00:00\" \/>\n<meta name=\"author\" content=\"golgol\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\uae00\uc4f4\uc774\" \/>\n\t<meta name=\"twitter:data1\" content=\"golgol\" \/>\n\t<meta name=\"twitter:label2\" content=\"\uc608\uc0c1 \ub418\ub294 \ud310\ub3c5 \uc2dc\uac04\" \/>\n\t<meta name=\"twitter:data2\" content=\"49\ubd84\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615\"},\"author\":{\"name\":\"golgol\",\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/#\\\/schema\\\/person\\\/d3dbae599b06cd55f5b14a3e2116f7a2\"},\"headline\":\"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec)\",\"datePublished\":\"2013-07-19T09:39:35+00:00\",\"dateModified\":\"2019-12-04T01:10:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615\"},\"wordCount\":9899,\"commentCount\":0,\"articleSection\":[\"[Util]Qmail\"],\"inLanguage\":\"ko-KR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615\",\"url\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615\",\"name\":\"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec) - AuctionPro\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/#website\"},\"datePublished\":\"2013-07-19T09:39:35+00:00\",\"dateModified\":\"2019-12-04T01:10:42+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/#\\\/schema\\\/person\\\/d3dbae599b06cd55f5b14a3e2116f7a2\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615#breadcrumb\"},\"inLanguage\":\"ko-KR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?p=2615#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\ud648\",\"item\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/#website\",\"url\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/\",\"name\":\"AuctionPro\",\"description\":\"\uc625\uc158\ud504\ub85c\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ko-KR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/#\\\/schema\\\/person\\\/d3dbae599b06cd55f5b14a3e2116f7a2\",\"name\":\"golgol\",\"url\":\"https:\\\/\\\/www.auctionpro.co.kr\\\/?author=6\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec) - AuctionPro","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.auctionpro.co.kr\/?p=2615","og_locale":"ko_KR","og_type":"article","og_title":"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec) - AuctionPro","og_description":"\ucc38\uc870 :\u00a0https:\/\/wiki.apache.org\/spamassassin\/WritingRules body LOCAL_DEMONSTRATION_RULE \/test\/ score LOCAL_DEMONSTRATION_RULE 0.1 describe LOCAL_DEMONSTRATION_RULE This is a simple test rule Perl Regex Syntax \ucc38\uc870: https:\/\/www.tutorialspoint.com\/perl\/perl_regular_expressions.htm :: spamassassin \ub8f0 \uc124\uc815 [...]","og_url":"https:\/\/www.auctionpro.co.kr\/?p=2615","og_site_name":"AuctionPro","article_published_time":"2013-07-19T09:39:35+00:00","article_modified_time":"2019-12-04T01:10:42+00:00","author":"golgol","twitter_card":"summary_large_image","twitter_misc":{"\uae00\uc4f4\uc774":"golgol","\uc608\uc0c1 \ub418\ub294 \ud310\ub3c5 \uc2dc\uac04":"49\ubd84"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.auctionpro.co.kr\/?p=2615#article","isPartOf":{"@id":"https:\/\/www.auctionpro.co.kr\/?p=2615"},"author":{"name":"golgol","@id":"https:\/\/www.auctionpro.co.kr\/#\/schema\/person\/d3dbae599b06cd55f5b14a3e2116f7a2"},"headline":"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec)","datePublished":"2013-07-19T09:39:35+00:00","dateModified":"2019-12-04T01:10:42+00:00","mainEntityOfPage":{"@id":"https:\/\/www.auctionpro.co.kr\/?p=2615"},"wordCount":9899,"commentCount":0,"articleSection":["[Util]Qmail"],"inLanguage":"ko-KR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.auctionpro.co.kr\/?p=2615#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.auctionpro.co.kr\/?p=2615","url":"https:\/\/www.auctionpro.co.kr\/?p=2615","name":"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec) - AuctionPro","isPartOf":{"@id":"https:\/\/www.auctionpro.co.kr\/#website"},"datePublished":"2013-07-19T09:39:35+00:00","dateModified":"2019-12-04T01:10:42+00:00","author":{"@id":"https:\/\/www.auctionpro.co.kr\/#\/schema\/person\/d3dbae599b06cd55f5b14a3e2116f7a2"},"breadcrumb":{"@id":"https:\/\/www.auctionpro.co.kr\/?p=2615#breadcrumb"},"inLanguage":"ko-KR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.auctionpro.co.kr\/?p=2615"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.auctionpro.co.kr\/?p=2615#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\ud648","item":"https:\/\/www.auctionpro.co.kr\/"},{"@type":"ListItem","position":2,"name":"[Qmail] spamassassin \ub8f0 \uc124\uc815 (\uc810\uc218\ubd80\uc5ec)"}]},{"@type":"WebSite","@id":"https:\/\/www.auctionpro.co.kr\/#website","url":"https:\/\/www.auctionpro.co.kr\/","name":"AuctionPro","description":"\uc625\uc158\ud504\ub85c","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.auctionpro.co.kr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ko-KR"},{"@type":"Person","@id":"https:\/\/www.auctionpro.co.kr\/#\/schema\/person\/d3dbae599b06cd55f5b14a3e2116f7a2","name":"golgol","url":"https:\/\/www.auctionpro.co.kr\/?author=6"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts\/2615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2615"}],"version-history":[{"count":0,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts\/2615\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}