| # DO NOT EDIT: file generated by build/mkupdates/listpromotable |
| # active ruleset list, automatically generated from https://ruleqa.spamassassin.org/ |
| # with results from: last-net: net-darxus net-ena-week0 net-ena-week1 net-ena-week2 net-ena-week3 net-ena-week4 net-giovanni-ham net-giovanni-spam net-giovanni-spammy net-grenier net-hege net-jhardin net-llanga net-mmiroslaw-mails-ham net-mmiroslaw-mails-spam net-pds net-thendrikx; day 1: darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 giovanni-ham giovanni-spam giovanni-spammy grenier hege jhardin llanga mmiroslaw-mails-ham mmiroslaw-mails-spam pds spamsponge thendrikx; day 2: darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 giovanni-ham giovanni-spam giovanni-spammy grenier hege jhardin llanga mmiroslaw-mails-ham mmiroslaw-mails-spam pds spamsponge thendrikx; day 3: darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 giovanni-ham giovanni-spam giovanni-spammy grenier hege jhardin llanga mmiroslaw-mails-ham mmiroslaw-mails-spam pds spamsponge thendrikx; day 4: darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 giovanni-ham giovanni-spam giovanni-spammy grenier hege jhardin llanga mmiroslaw-mails-ham mmiroslaw-mails-spam pds spamsponge thendrikx; day 5: darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 giovanni-ham giovanni-spam giovanni-spammy grenier hege jhardin llanga mmiroslaw-mails-ham mmiroslaw-mails-spam pds spamsponge thendrikx |
| |
| # tflags publish |
| AC_BR_BONANZA |
| |
| # tflags publish |
| AC_DIV_BONANZA |
| |
| # tflags publish |
| AC_FROM_MANY_DOTS |
| |
| # tflags publish |
| AC_HTML_NONSENSE_TAGS |
| |
| # tflags publish |
| AC_POST_EXTRAS |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS1 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS10 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS11 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS12 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS2 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS3 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS4 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS8 |
| |
| # tflags publish |
| AC_SPAMMY_URI_PATTERNS9 |
| |
| # tflags publish |
| ADMAIL |
| |
| # tflags publish |
| ADMITS_SPAM |
| |
| # tflags publish |
| ADULT_DATING_COMPANY |
| |
| # tflags publish |
| ADVANCE_FEE_2_NEW_FORM |
| |
| # tflags publish |
| ADVANCE_FEE_2_NEW_FRM_MNY |
| |
| # tflags publish |
| ADVANCE_FEE_2_NEW_MONEY |
| |
| # tflags publish |
| ADVANCE_FEE_3_NEW |
| |
| # tflags publish |
| ADVANCE_FEE_3_NEW_FORM |
| |
| # tflags publish |
| ADVANCE_FEE_3_NEW_FRM_MNY |
| |
| # tflags publish |
| ADVANCE_FEE_3_NEW_MONEY |
| |
| # tflags publish |
| ADVANCE_FEE_4_NEW |
| |
| # tflags publish |
| ADVANCE_FEE_4_NEW_FORM |
| |
| # tflags publish |
| ADVANCE_FEE_4_NEW_FRM_MNY |
| |
| # tflags publish |
| ADVANCE_FEE_4_NEW_MONEY |
| |
| # tflags publish |
| ADVANCE_FEE_5_NEW |
| |
| # tflags publish |
| ADVANCE_FEE_5_NEW_FORM |
| |
| # tflags publish |
| ADVANCE_FEE_5_NEW_FRM_MNY |
| |
| # tflags publish |
| ADVANCE_FEE_5_NEW_MONEY |
| |
| # tflags publish |
| AD_PREFS |
| |
| # tflags publish |
| ALIBABA_IMG_NOT_RCVD_ALI |
| |
| # tflags userconf |
| ALL_TRUSTED |
| |
| # tflags publish |
| AMAZON_IMG_NOT_RCVD_AMZN |
| |
| # good enough |
| APOSTROPHE_FROM |
| |
| # tflags publish |
| APP_DEVELOPMENT_FREEM |
| |
| # tflags publish |
| APP_DEVELOPMENT_NORDNS |
| |
| # good enough |
| AXB_XMAILER_MIMEOLE_OL_024C2 |
| |
| # good enough |
| AXB_XMAILER_MIMEOLE_OL_1ECD5 |
| |
| # good enough |
| AXB_XM_FORGED_OL2600 |
| |
| # good enough |
| BASE64_LENGTH_79_INF |
| |
| # tflags learn |
| BAYES_00 |
| |
| # tflags learn |
| BAYES_05 |
| |
| # tflags learn |
| BAYES_20 |
| |
| # tflags learn |
| BAYES_40 |
| |
| # tflags learn |
| BAYES_50 |
| |
| # tflags learn |
| BAYES_60 |
| |
| # tflags learn |
| BAYES_80 |
| |
| # tflags learn |
| BAYES_95 |
| |
| # tflags learn |
| BAYES_99 |
| |
| # tflags learn |
| BAYES_999 |
| |
| # tflags publish |
| BEBEE_IMG_NOT_RCVD_BB |
| |
| # tflags publish |
| BIGNUM_EMAILS_FREEM |
| |
| # tflags publish |
| BIGNUM_EMAILS_MANY |
| |
| # good enough |
| BILLION_OVERLAP |
| |
| # tflags publish |
| BITCOIN_BOMB |
| |
| # tflags publish |
| BITCOIN_DEADLINE |
| |
| # tflags publish |
| BITCOIN_EXTORT_01 |
| |
| # tflags publish |
| BITCOIN_EXTORT_02 |
| |
| # tflags publish |
| BITCOIN_IMGUR |
| |
| # good enough |
| BITCOIN_MALF_HTML |
| |
| # tflags publish |
| BITCOIN_MALWARE |
| |
| # tflags publish |
| BITCOIN_OBFU_SUBJ |
| |
| # tflags publish |
| BITCOIN_ONAN |
| |
| # tflags publish |
| BITCOIN_PAY_ME |
| |
| # tflags publish |
| BITCOIN_SPAM_01 |
| |
| # tflags publish |
| BITCOIN_SPAM_02 |
| |
| # tflags publish |
| BITCOIN_SPAM_03 |
| |
| # tflags publish |
| BITCOIN_SPAM_04 |
| |
| # tflags net |
| BITCOIN_SPAM_05 |
| |
| # tflags publish |
| BITCOIN_SPAM_06 |
| |
| # tflags publish |
| BITCOIN_SPAM_07 |
| |
| # tflags publish |
| BITCOIN_SPAM_08 |
| |
| # tflags publish |
| BITCOIN_SPAM_09 |
| |
| # tflags publish |
| BITCOIN_SPAM_10 |
| |
| # tflags publish |
| BITCOIN_SPAM_11 |
| |
| # tflags publish |
| BITCOIN_SPAM_12 |
| |
| # tflags net |
| BITCOIN_SPF_ONLYALL |
| |
| # tflags publish |
| BITCOIN_WFH_01 |
| |
| # good enough |
| BITCOIN_XPRIO |
| |
| # tflags publish |
| BITCOIN_YOUR_INFO |
| |
| # good enough |
| BODY_EMAIL_419_FRAUD_GM |
| |
| # good enough |
| BODY_EMPTY |
| |
| # good enough |
| BODY_SINGLE_URI |
| |
| # tflags publish |
| BODY_URI_ONLY |
| |
| # tflags publish |
| BOGUS_MIME_VERSION |
| |
| # tflags publish |
| BOGUS_MSM_HDRS |
| |
| # tflags publish |
| BOMB_FREEM |
| |
| # tflags publish |
| BOMB_MONEY |
| |
| # tflags net |
| BTC_ORG |
| |
| # tflags publish |
| BULK_RE_SUSP_NTLD |
| |
| # tflags publish |
| CANT_SEE_AD |
| |
| # tflags userconf |
| CHARSET_FARAWAY |
| |
| # tflags userconf |
| CHARSET_FARAWAY_HEADER |
| |
| # good enough |
| CK_HELO_GENERIC |
| |
| # tflags publish |
| CN_B2B_SPAMMER |
| |
| # tflags publish |
| COMMENT_GIBBERISH |
| |
| # tflags net |
| COMPENSATION |
| |
| # tflags publish |
| CONTENT_AFTER_HTML |
| |
| # tflags publish |
| CONTENT_AFTER_HTML_WEAK |
| |
| # tflags publish |
| CORRUPT_FROM_LINE_IN_HDRS |
| |
| # tflags publish |
| CTE_8BIT_MISMATCH |
| |
| # good enough |
| CTYPE_NULL |
| |
| # tflags publish |
| DAY_I_EARNED |
| |
| # good enough |
| DEAR_BENEFICIARY |
| |
| # good enough |
| DEAR_WINNER |
| |
| # tflags net |
| DIGEST_MULTIPLE |
| |
| # tflags net |
| DKIMWL_BL |
| |
| # tflags net |
| DKIMWL_BLOCKED |
| |
| # tflags net |
| DKIMWL_WL_HIGH |
| |
| # tflags net |
| DKIMWL_WL_MED |
| |
| # tflags net |
| DKIMWL_WL_MEDHI |
| |
| # tflags net |
| DKIM_ADSP_ALL |
| |
| # tflags net |
| DKIM_ADSP_CUSTOM_HIGH |
| |
| # tflags net |
| DKIM_ADSP_CUSTOM_LOW |
| |
| # tflags net |
| DKIM_ADSP_CUSTOM_MED |
| |
| # tflags net |
| DKIM_ADSP_DISCARD |
| |
| # tflags net |
| DKIM_ADSP_NXDOMAIN |
| |
| # tflags net |
| DKIM_INVALID |
| |
| # tflags net |
| DKIM_SIGNED |
| |
| # tflags net |
| DKIM_VALID |
| |
| # tflags net |
| DKIM_VALID_AU |
| |
| # tflags net |
| DKIM_VALID_EF |
| |
| # tflags publish |
| DOS_ANAL_SPAM_MAILER |
| |
| # tflags net |
| DOS_DEREK_AUG08 |
| |
| # good enough |
| DOS_OE_TO_MX |
| |
| # good enough |
| DOS_OUTLOOK_TO_MX |
| |
| # good enough |
| DOS_RCVD_IP_TWICE_B |
| |
| # tflags publish |
| DOTGOV_IMAGE |
| |
| # tflags publish |
| DX_TEXT_02 |
| |
| # tflags publish |
| DX_TEXT_03 |
| |
| # tflags publish |
| DYNAMIC_IMGUR |
| |
| # tflags publish |
| EBAY_IMG_NOT_RCVD_EBAY |
| |
| # tflags publish |
| EMRCP |
| |
| # tflags publish |
| ENCRYPTED_MESSAGE |
| |
| # tflags net |
| END_FUTURE_EMAILS |
| |
| # tflags publish |
| ENVFROM_GOOG_TRIX |
| |
| # tflags net |
| ENV_AND_HDR_SPF_MATCH |
| |
| # tflags publish |
| FACEBOOK_IMG_NOT_RCVD_FB |
| |
| # good enough |
| FAKE_REPLY_A1 |
| |
| # good enough |
| FAKE_REPLY_B |
| |
| # good enough |
| FAKE_REPLY_C |
| |
| # tflags publish |
| FBI_MONEY |
| |
| # tflags publish |
| FBI_SPOOF |
| |
| # tflags publish |
| FILL_THIS_FORM |
| |
| # good enough |
| FILL_THIS_FORM_LOAN |
| |
| # good enough |
| FILL_THIS_FORM_LONG |
| |
| # tflags publish |
| FONT_INVIS_DIRECT |
| |
| # tflags publish |
| FONT_INVIS_DOTGOV |
| |
| # tflags publish |
| FONT_INVIS_HTML_NOHTML |
| |
| # tflags publish |
| FONT_INVIS_LONG_LINE |
| |
| # tflags publish |
| FONT_INVIS_MSGID |
| |
| # tflags publish |
| FONT_INVIS_NORDNS |
| |
| # tflags publish |
| FONT_INVIS_POSTEXTRAS |
| |
| # good enough |
| FORGED_RELAY_MUA_TO_MX |
| |
| # tflags net |
| FORGED_SPF_HELO |
| |
| # tflags net |
| FORM_FRAUD |
| |
| # tflags publish |
| FORM_FRAUD_3 |
| |
| # tflags publish |
| FORM_FRAUD_5 |
| |
| # tflags publish |
| FOUND_YOU |
| |
| # tflags userconf |
| FRAGMENTED_MESSAGE |
| |
| # tflags publish |
| FREEMAIL_FORGED_FROMDOMAIN |
| |
| # tflags publish |
| FREEMAIL_WFH_01 |
| |
| # tflags publish |
| FREEM_FRNUM_UNICD_EMPTY |
| |
| # tflags publish |
| FRNAME_IN_MSG_XPRIO_NO_SUB |
| |
| # good enough |
| FROMSPACE |
| |
| # good enough |
| FROM_2_EMAILS_SHORT |
| |
| # tflags publish |
| FROM_ADDR_WS |
| |
| # tflags net |
| FROM_BANK_NOAUTH |
| |
| # tflags userconf |
| FROM_DOMAIN_NOVOWEL |
| |
| # tflags net |
| FROM_FMBLA_NDBLOCKED |
| |
| # tflags net |
| FROM_FMBLA_NEWDOM |
| |
| # tflags net |
| FROM_FMBLA_NEWDOM14 |
| |
| # tflags net |
| FROM_FMBLA_NEWDOM28 |
| |
| # tflags net |
| FROM_GOV_DKIM_AU |
| |
| # tflags net |
| FROM_GOV_REPLYTO_FREEMAIL |
| |
| # tflags net |
| FROM_GOV_SPOOF |
| |
| # tflags publish |
| FROM_IN_TO_AND_SUBJ |
| |
| # tflags userconf |
| FROM_LOCAL_NOVOWEL |
| |
| # good enough |
| FROM_MISSPACED |
| |
| # good enough |
| FROM_MISSP_DYNIP |
| |
| # good enough |
| FROM_MISSP_EH_MATCH |
| |
| # good enough |
| FROM_MISSP_FREEMAIL |
| |
| # good enough |
| FROM_MISSP_MSFT |
| |
| # good enough |
| FROM_MISSP_PHISH |
| |
| # tflags net |
| FROM_MISSP_SPF_FAIL |
| |
| # good enough |
| FROM_MISSP_TO_UNDISC |
| |
| # good enough |
| FROM_MISSP_USER |
| |
| # good enough |
| FROM_MISSP_XPRIO |
| |
| # good enough |
| FROM_MULTI_NORDNS |
| |
| # tflags net |
| FROM_NEWDOM_BTC |
| |
| # tflags publish |
| FROM_NTLD_LINKBAIT |
| |
| # tflags publish |
| FROM_NTLD_REPLY_FREEMAIL |
| |
| # tflags net |
| FROM_NUMBERO_NEWDOMAIN |
| |
| # good enough |
| FROM_NUMERIC_TLD |
| |
| # tflags net |
| FROM_PAYPAL_SPOOF |
| |
| # tflags publish |
| FROM_SUSPICIOUS_NTLD |
| |
| # tflags publish |
| FROM_SUSPICIOUS_NTLD_FP |
| |
| # good enough |
| FROM_UNBAL1 |
| |
| # good enough |
| FROM_UNBAL2 |
| |
| # good enough |
| FROM_WSP_TRAIL |
| |
| # tflags net |
| FSL_BULK_SIG |
| |
| # good enough |
| FSL_CTYPE_WIN1251 |
| |
| # good enough |
| FSL_HELO_BARE_IP_1 |
| |
| # tflags publish |
| FSL_NEW_HELO_USER |
| |
| # tflags publish |
| FUZZY_AMAZON |
| |
| # tflags publish |
| FUZZY_ANDROID |
| |
| # tflags publish |
| FUZZY_APPLE |
| |
| # tflags publish |
| FUZZY_BITCOIN |
| |
| # tflags publish |
| FUZZY_BROWSER |
| |
| # tflags publish |
| FUZZY_BTC_WALLET |
| |
| # tflags publish |
| FUZZY_CLICK_HERE |
| |
| # tflags publish |
| FUZZY_DR_OZ |
| |
| # tflags publish |
| FUZZY_FACEBOOK |
| |
| # tflags publish |
| FUZZY_IMPORTANT |
| |
| # tflags publish |
| FUZZY_MICROSOFT |
| |
| # tflags publish |
| FUZZY_MONERO |
| |
| # tflags publish |
| FUZZY_NORTON |
| |
| # tflags publish |
| FUZZY_OVERSTOCK |
| |
| # tflags publish |
| FUZZY_PAYPAL |
| |
| # tflags publish |
| FUZZY_PORN |
| |
| # tflags publish |
| FUZZY_PRIVACY |
| |
| # tflags publish |
| FUZZY_PROMOTION |
| |
| # tflags publish |
| FUZZY_SAVINGS |
| |
| # tflags publish |
| FUZZY_SECURITY |
| |
| # tflags publish |
| FUZZY_UNSUBSCRIBE |
| |
| # tflags publish |
| FUZZY_WALLET |
| |
| # good enough |
| GAPPY_GENITALIA |
| |
| # tflags publish |
| GAPPY_SALES_LEADS_FREEM |
| |
| # good enough |
| GB_BITCOIN_CP |
| |
| # tflags publish |
| GB_FAKE_RF_SHORT |
| |
| # tflags publish |
| GB_FORGED_MUA_POSTFIX |
| |
| # tflags publish |
| GB_FREEMAIL_DISPTO |
| |
| # tflags publish |
| GB_FREEMAIL_DISPTO_NOTFREEM |
| |
| # tflags publish |
| GB_GOOGLE_OBFUR |
| |
| # tflags publish |
| GOOGLE_DOCS_PHISH |
| |
| # tflags publish |
| GOOGLE_DOCS_PHISH_MANY |
| |
| # tflags publish |
| GOOGLE_DOC_SUSP |
| |
| # tflags publish |
| GOOGLE_DRIVE_REPLY_BAD_NTLD |
| |
| # tflags publish |
| GOOG_MALWARE_DNLD |
| |
| # tflags publish |
| GOOG_REDIR_DOCUSIGN |
| |
| # good enough |
| GOOG_REDIR_HTML_ONLY |
| |
| # good enough |
| GOOG_REDIR_NORDNS |
| |
| # tflags publish |
| GOOG_REDIR_SHORT |
| |
| # tflags publish |
| GOOG_STO_EMAIL_PHISH |
| |
| # tflags publish |
| GOOG_STO_HTML_PHISH |
| |
| # tflags publish |
| GOOG_STO_HTML_PHISH_MANY |
| |
| # tflags publish |
| GOOG_STO_IMG_HTML |
| |
| # tflags publish |
| GOOG_STO_IMG_NOHTML |
| |
| # tflags publish |
| GOOG_STO_NOIMG_HTML |
| |
| # tflags userconf |
| GTUBE |
| |
| # tflags publish |
| HAS_X_NO_RELAY |
| |
| # tflags publish |
| HAS_X_OUTGOING_SPAM_STAT |
| |
| # good enough |
| HDRS_LCASE_IMGONLY |
| |
| # tflags publish |
| HDRS_MISSP |
| |
| # tflags publish |
| HDR_ORDER_FTSDMCXX_DIRECT |
| |
| # tflags publish |
| HDR_ORDER_FTSDMCXX_NORDNS |
| |
| # tflags publish |
| HEADER_FROM_DIFFERENT_DOMAINS |
| |
| # tflags userconf |
| HEAD_LONG |
| |
| # good enough |
| HELO_LOCALHOST |
| |
| # tflags publish |
| HELO_NO_DOMAIN |
| |
| # tflags publish |
| HEXHASH_WORD |
| |
| # tflags publish |
| HK_CTE_RAW |
| |
| # good enough |
| HK_LOTTO |
| |
| # good enough |
| HK_NAME_FM_MR_MRS |
| |
| # good enough |
| HK_NAME_FROM |
| |
| # good enough |
| HK_NAME_MR_MRS |
| |
| # tflags publish |
| HK_RANDOM_ENVFROM |
| |
| # tflags publish |
| HK_RANDOM_FROM |
| |
| # tflags publish |
| HK_RANDOM_REPLYTO |
| |
| # tflags publish |
| HK_RCVD_IP_MULTICAST |
| |
| # tflags publish |
| HK_SCAM |
| |
| # good enough |
| HK_WIN |
| |
| # tflags publish |
| HOSTED_IMG_DIRECT_MX |
| |
| # tflags publish |
| HOSTED_IMG_DQ_UNSUB |
| |
| # tflags publish |
| HOSTED_IMG_FREEM |
| |
| # tflags publish |
| HOSTED_IMG_MULTI |
| |
| # tflags publish |
| HOSTED_IMG_MULTI_PUB_01 |
| |
| # tflags userconf |
| HTML_CHARSET_FARAWAY |
| |
| # tflags publish |
| HTML_ENTITY_ASCII |
| |
| # tflags publish |
| HTML_ENTITY_ASCII_TINY |
| |
| # good enough |
| HTML_FONT_TINY_NORDNS |
| |
| # tflags publish |
| HTML_OFF_PAGE |
| |
| # tflags publish |
| HTML_SHRT_CMNT_OBFU_MANY |
| |
| # tflags net |
| HTML_SINGLET_MANY |
| |
| # good enough |
| HTML_TAG_BALANCE_CENTER |
| |
| # tflags net |
| HTML_TEXT_INVISIBLE_FONT |
| |
| # tflags publish |
| HTML_TEXT_INVISIBLE_STYLE |
| |
| # tflags publish |
| IMG_ONLY_FM_DOM_INFO |
| |
| # tflags publish |
| JH_SPAMMY_HEADERS |
| |
| # tflags publish |
| JH_SPAMMY_PATTERN01 |
| |
| # tflags publish |
| JH_SPAMMY_PATTERN02 |
| |
| # tflags net |
| KHOP_HELO_FCRDNS |
| |
| # tflags publish |
| LINKEDIN_IMG_NOT_RCVD_LNKN |
| |
| # tflags publish |
| LIST_PRTL_PUMPDUMP |
| |
| # tflags publish |
| LIST_PRTL_SAME_USER |
| |
| # good enough |
| LONGLN_LOW_CONTRAST |
| |
| # tflags publish |
| LONG_HEX_URI |
| |
| # tflags publish |
| LONG_IMG_URI |
| |
| # tflags publish |
| LONG_INVISIBLE_TEXT |
| |
| # tflags publish |
| LOTS_OF_MONEY |
| |
| # good enough |
| LOTTO_AGENT |
| |
| # good enough |
| LOTTO_DEPT |
| |
| # tflags publish |
| LUCRATIVE |
| |
| # tflags publish |
| MALF_HTML_B64 |
| |
| # tflags publish |
| MALWARE_NORDNS |
| |
| # tflags publish |
| MALWARE_PASSWORD |
| |
| # tflags publish |
| MALW_ATTACH |
| |
| # tflags publish |
| MANY_SPAN_IN_TEXT |
| |
| # tflags publish |
| MILLION_HUNDRED |
| |
| # good enough |
| MILLION_USD |
| |
| # tflags publish |
| MIMEOLE_DIRECT_TO_MX |
| |
| # tflags userconf |
| MIME_CHARSET_FARAWAY |
| |
| # tflags publish |
| MIME_NO_TEXT |
| |
| # tflags userconf |
| MISSING_HB_SEP |
| |
| # tflags publish |
| MIXED_AREA_CASE |
| |
| # tflags publish |
| MIXED_CENTER_CASE |
| |
| # tflags publish |
| MIXED_ES |
| |
| # tflags publish |
| MIXED_FONT_CASE |
| |
| # tflags publish |
| MIXED_HREF_CASE |
| |
| # tflags publish |
| MIXED_IMG_CASE |
| |
| # tflags publish |
| MONERO_DEADLINE |
| |
| # tflags publish |
| MONERO_EXTORT_01 |
| |
| # tflags publish |
| MONERO_MALWARE |
| |
| # tflags publish |
| MONERO_PAY_ME |
| |
| # good enough |
| MONEY_ATM_CARD |
| |
| # good enough |
| MONEY_FORM |
| |
| # good enough |
| MONEY_FORM_SHORT |
| |
| # tflags publish |
| MONEY_FRAUD_3 |
| |
| # tflags publish |
| MONEY_FRAUD_5 |
| |
| # tflags publish |
| MONEY_FRAUD_8 |
| |
| # tflags publish |
| MONEY_FREEMAIL_REPTO |
| |
| # good enough |
| MONEY_FROM_41 |
| |
| # good enough |
| MONEY_FROM_MISSP |
| |
| # tflags publish |
| MSGID_DOLLARS_URI_IMG |
| |
| # tflags publish |
| MSGID_HDR_MALF |
| |
| # tflags publish |
| MSM_PRIO_REPTO |
| |
| # good enough |
| MSOE_MID_WRONG_CASE |
| |
| # good enough |
| NAME_EMAIL_DIFF |
| |
| # good enough |
| NA_DOLLARS |
| |
| # tflags publish |
| NEWEGG_IMG_NOT_RCVD_NEGG |
| |
| # tflags publish |
| NEW_PRODUCTS |
| |
| # good enough |
| NICE_REPLY_A |
| |
| # good enough |
| NICE_REPLY_B |
| |
| # tflags net |
| NML_ADSP_CUSTOM_HIGH |
| |
| # tflags net |
| NML_ADSP_CUSTOM_LOW |
| |
| # tflags net |
| NML_ADSP_CUSTOM_MED |
| |
| # good enough |
| NORDNS_LOW_CONTRAST |
| |
| # tflags publish |
| NOT_SPAM |
| |
| # tflags net |
| NO_DNS_FOR_FROM |
| |
| # tflags publish |
| NO_FM_NAME_IP_HOSTN |
| |
| # tflags userconf |
| NO_RECEIVED |
| |
| # tflags userconf |
| NO_RELAYS |
| |
| # good enough |
| NSL_RCVD_FROM_USER |
| |
| # good enough |
| NSL_RCVD_HELO_USER |
| |
| # tflags publish |
| OBFU_BITCOIN |
| |
| # tflags publish |
| OBFU_JVSCR_ESC |
| |
| # tflags publish |
| OBFU_TEXT_ATTACH |
| |
| # tflags publish |
| OBFU_UNSUB_UL |
| |
| # tflags publish |
| ODD_FREEM_REPTO |
| |
| # good enough |
| PDS_BTC_ID |
| |
| # good enough |
| PDS_BTC_MSGID |
| |
| # good enough |
| PDS_BTC_NTLD |
| |
| # good enough |
| PDS_DBL_URL_TNB_RUNON |
| |
| # tflags net |
| PDS_FROM_2_EMAILS |
| |
| # tflags net |
| PDS_HELO_SPF_FAIL |
| |
| # good enough |
| PDS_HP_HELO_NORDNS |
| |
| # good enough |
| PDS_OTHER_BAD_TLD |
| |
| # good enough |
| PDS_PHPEXP_BOT |
| |
| # good enough |
| PDS_PHP_EVAL |
| |
| # good enough |
| PDS_PHP_RUNTIME_FUNC |
| |
| # good enough |
| PDS_PRO_TLD |
| |
| # good enough |
| PDS_RDNS_DYNAMIC_FP |
| |
| # good enough |
| PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE |
| |
| # tflags publish |
| PHISH_ATTACH |
| |
| # tflags publish |
| PHISH_AZURE_CLOUDAPP |
| |
| # tflags publish |
| PHISH_FBASEAPP |
| |
| # good enough |
| PHOTO_EDITING_DIRECT |
| |
| # good enough |
| PHOTO_EDITING_FREEM |
| |
| # tflags publish |
| PHP_NOVER_MUA |
| |
| # tflags publish |
| PHP_ORIG_SCRIPT |
| |
| # good enough |
| PHP_ORIG_SCRIPT_EVAL |
| |
| # tflags publish |
| PHP_SCRIPT |
| |
| # tflags publish |
| PHP_SCRIPT_MUA |
| |
| # tflags publish |
| POSSIBLE_APPLE_PHISH_02 |
| |
| # tflags publish |
| POSSIBLE_EBAY_PHISH_02 |
| |
| # tflags publish |
| POSSIBLE_PAYPAL_PHISH_01 |
| |
| # tflags publish |
| POSSIBLE_PAYPAL_PHISH_02 |
| |
| # tflags publish |
| PP_MIME_FAKE_ASCII_TEXT |
| |
| # tflags publish |
| PP_TOO_MUCH_UNICODE02 |
| |
| # tflags publish |
| PP_TOO_MUCH_UNICODE05 |
| |
| # tflags publish |
| PUMPDUMP |
| |
| # tflags publish |
| PUMPDUMP_MULTI |
| |
| # tflags publish |
| PUMPDUMP_TIP |
| |
| # tflags net |
| PYZOR_CHECK |
| |
| # tflags publish |
| RAND_HEADER_LIST_SPOOF |
| |
| # tflags publish |
| RAND_HEADER_MANY |
| |
| # tflags publish |
| RAND_MKTG_HEADER |
| |
| # good enough |
| RATWARE_NO_RDNS |
| |
| # tflags net |
| RAZOR2_CF_RANGE_51_100 |
| |
| # tflags net |
| RAZOR2_CHECK |
| |
| # tflags publish |
| RCVD_DBL_DQ |
| |
| # tflags publish |
| RCVD_DOTEDU_SHORT |
| |
| # tflags publish |
| RCVD_DOTEDU_SUSP_URI |
| |
| # tflags net |
| RCVD_IN_BL_SPAMCOP_NET |
| |
| # tflags net |
| RCVD_IN_DNSWL_BLOCKED |
| |
| # tflags net |
| RCVD_IN_DNSWL_HI |
| |
| # tflags net |
| RCVD_IN_DNSWL_LOW |
| |
| # tflags net |
| RCVD_IN_DNSWL_MED |
| |
| # tflags net |
| RCVD_IN_DNSWL_NONE |
| |
| # tflags net |
| RCVD_IN_IADB_DK |
| |
| # tflags net |
| RCVD_IN_IADB_DOPTIN |
| |
| # tflags net |
| RCVD_IN_IADB_DOPTIN_GT50 |
| |
| # tflags net |
| RCVD_IN_IADB_DOPTIN_LT50 |
| |
| # tflags net |
| RCVD_IN_IADB_EDDB |
| |
| # tflags net |
| RCVD_IN_IADB_EPIA |
| |
| # tflags net |
| RCVD_IN_IADB_GOODMAIL |
| |
| # tflags net |
| RCVD_IN_IADB_LISTED |
| |
| # tflags net |
| RCVD_IN_IADB_LOOSE |
| |
| # tflags net |
| RCVD_IN_IADB_MI_CPEAR |
| |
| # tflags net |
| RCVD_IN_IADB_MI_CPR_30 |
| |
| # tflags net |
| RCVD_IN_IADB_MI_CPR_MAT |
| |
| # tflags net |
| RCVD_IN_IADB_ML_DOPTIN |
| |
| # tflags net |
| RCVD_IN_IADB_NOCONTROL |
| |
| # tflags net |
| RCVD_IN_IADB_OOO |
| |
| # tflags net |
| RCVD_IN_IADB_OPTIN |
| |
| # tflags net |
| RCVD_IN_IADB_OPTIN_GT50 |
| |
| # tflags net |
| RCVD_IN_IADB_OPTIN_LT50 |
| |
| # tflags net |
| RCVD_IN_IADB_OPTOUTONLY |
| |
| # tflags net |
| RCVD_IN_IADB_RDNS |
| |
| # tflags net |
| RCVD_IN_IADB_SENDERID |
| |
| # tflags net |
| RCVD_IN_IADB_SPF |
| |
| # tflags net |
| RCVD_IN_IADB_UNVERIFIED_1 |
| |
| # tflags net |
| RCVD_IN_IADB_UNVERIFIED_2 |
| |
| # tflags net |
| RCVD_IN_IADB_UT_CPEAR |
| |
| # tflags net |
| RCVD_IN_IADB_UT_CPR_30 |
| |
| # tflags net |
| RCVD_IN_IADB_UT_CPR_MAT |
| |
| # tflags net |
| RCVD_IN_IADB_VOUCHED |
| |
| # tflags net |
| RCVD_IN_MAPS_DUL |
| |
| # tflags net |
| RCVD_IN_MAPS_NML |
| |
| # tflags net |
| RCVD_IN_MAPS_OPS |
| |
| # tflags net |
| RCVD_IN_MAPS_RBL |
| |
| # tflags net |
| RCVD_IN_MAPS_RSS |
| |
| # tflags net |
| RCVD_IN_MSPIKE_BL |
| |
| # tflags net |
| RCVD_IN_MSPIKE_H2 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_H3 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_H4 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_H5 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_L2 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_L3 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_L4 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_L5 |
| |
| # tflags net |
| RCVD_IN_MSPIKE_WL |
| |
| # tflags net |
| RCVD_IN_MSPIKE_ZBI |
| |
| # tflags net |
| RCVD_IN_PBL |
| |
| # tflags net |
| RCVD_IN_PSBL |
| |
| # tflags net |
| RCVD_IN_SBL |
| |
| # tflags net |
| RCVD_IN_SBL_CSS |
| |
| # tflags net |
| RCVD_IN_SORBS_BLOCK |
| |
| # tflags net |
| RCVD_IN_SORBS_DUL |
| |
| # tflags net |
| RCVD_IN_SORBS_HTTP |
| |
| # tflags net |
| RCVD_IN_SORBS_MISC |
| |
| # tflags net |
| RCVD_IN_SORBS_SMTP |
| |
| # tflags net |
| RCVD_IN_SORBS_SOCKS |
| |
| # tflags net |
| RCVD_IN_SORBS_WEB |
| |
| # tflags net |
| RCVD_IN_SORBS_ZOMBIE |
| |
| # tflags net |
| RCVD_IN_VALIDITY_CERTIFIED |
| |
| # tflags net |
| RCVD_IN_VALIDITY_RPBL |
| |
| # tflags net |
| RCVD_IN_VALIDITY_SAFE |
| |
| # tflags net |
| RCVD_IN_XBL |
| |
| # tflags net |
| RCVD_IN_ZEN_BLOCKED |
| |
| # tflags net |
| RCVD_IN_ZEN_BLOCKED_OPENDNS |
| |
| # tflags publish |
| RDNS_NUM_TLD_ATCHNX |
| |
| # tflags publish |
| RDNS_NUM_TLD_XM |
| |
| # good enough |
| READY_TO_SHIP |
| |
| # good enough |
| REPLYTO_EMPTY |
| |
| # good enough |
| REPLYTO_WITHOUT_TO_CC |
| |
| # tflags publish |
| REPTO_419_FRAUD |
| |
| # tflags publish |
| REPTO_419_FRAUD_AOL |
| |
| # tflags publish |
| REPTO_419_FRAUD_AOL_LOOSE |
| |
| # tflags publish |
| REPTO_419_FRAUD_CNS |
| |
| # tflags publish |
| REPTO_419_FRAUD_GM |
| |
| # tflags publish |
| REPTO_419_FRAUD_GM_LOOSE |
| |
| # tflags publish |
| REPTO_419_FRAUD_HM |
| |
| # tflags publish |
| REPTO_419_FRAUD_OL |
| |
| # tflags publish |
| REPTO_419_FRAUD_PM |
| |
| # tflags publish |
| REPTO_419_FRAUD_QQ |
| |
| # tflags publish |
| REPTO_419_FRAUD_YH |
| |
| # tflags publish |
| REPTO_419_FRAUD_YH_LOOSE |
| |
| # tflags publish |
| REPTO_419_FRAUD_YJ |
| |
| # tflags publish |
| REPTO_419_FRAUD_YN |
| |
| # good enough |
| SCC_BODY_URI_ONLY |
| |
| # good enough |
| SCC_CANSPAM_2 |
| |
| # tflags publish |
| SCC_ISEMM_LID_1 |
| |
| # good enough |
| SCC_SPAMMER_ADDR_2 |
| |
| # tflags publish |
| SCC_SPECIAL_GUID |
| |
| # good enough |
| SCRIPT_GIBBERISH |
| |
| # tflags publish |
| SENDGRID_REDIR |
| |
| # tflags publish |
| SENDGRID_REDIR_PHISH |
| |
| # tflags publish |
| SEO_SUSP_NTLD |
| |
| # good enough |
| SERGIO_SUBJECT_VIAGRA01 |
| |
| # tflags publish |
| SHOPIFY_IMG_NOT_RCVD_SFY |
| |
| # good enough |
| SHORTENED_URL_SRC |
| |
| # tflags publish |
| SHORTENER_SHORT_IMG |
| |
| # tflags publish |
| SHORT_IMG_SUSP_NTLD |
| |
| # good enough |
| SHORT_SHORTNER |
| |
| # tflags net |
| SPF_FAIL |
| |
| # tflags net |
| SPF_HELO_FAIL |
| |
| # tflags net |
| SPF_HELO_NEUTRAL |
| |
| # tflags net |
| SPF_HELO_NONE |
| |
| # tflags net |
| SPF_HELO_PASS |
| |
| # tflags net |
| SPF_HELO_SOFTFAIL |
| |
| # tflags net |
| SPF_NEUTRAL |
| |
| # tflags net |
| SPF_NONE |
| |
| # tflags net |
| SPF_PASS |
| |
| # tflags net |
| SPF_SOFTFAIL |
| |
| # tflags net |
| SPOOFED_FREEMAIL |
| |
| # tflags net |
| SPOOFED_FREEMAIL_NO_RDNS |
| |
| # tflags net |
| SPOOFED_FREEM_REPTO |
| |
| # tflags net |
| SPOOFED_FREEM_REPTO_CHN |
| |
| # tflags net |
| SPOOFED_FREEM_REPTO_RUS |
| |
| # tflags net |
| SPOOF_GMAIL_MID |
| |
| # tflags publish |
| STATIC_XPRIO_OLE |
| |
| # tflags publish |
| STOCK_TIP |
| |
| # good enough |
| STOX_BOUND_090909_B |
| |
| # good enough |
| STY_INVIS_DIRECT |
| |
| # tflags userconf |
| SUBJECT_IN_BLACKLIST |
| |
| # tflags userconf |
| SUBJECT_IN_WHITELIST |
| |
| # good enough |
| SUBJ_ATTENTION |
| |
| # tflags net |
| SUBJ_BRKN_WORDNUMS |
| |
| # tflags net |
| SUBJ_UNNEEDED_HTML |
| |
| # tflags net |
| SURBL_BLOCKED |
| |
| # good enough |
| SUSPNTLD_EXPIRATION_EXTORT |
| |
| # good enough |
| SUSP_UTF8_WORD_FROM |
| |
| # good enough |
| SUSP_UTF8_WORD_SUBJ |
| |
| # tflags publish |
| SYSADMIN |
| |
| # tflags publish |
| TAGSTAT_IMG_NOT_RCVD_TGST |
| |
| # tflags publish |
| TARINGANET_IMG_NOT_RCVD_TN |
| |
| # tflags publish |
| TEQF_USR_IMAGE |
| |
| # tflags publish |
| TEQF_USR_MSGID_HEX |
| |
| # tflags publish |
| TEQF_USR_MSGID_MALF |
| |
| # tflags publish |
| THIS_AD |
| |
| # tflags publish |
| THIS_IS_ADV_SUSP_NTLD |
| |
| # tflags publish |
| TONLINE_FAKE_DKIM |
| |
| # tflags publish |
| TO_EQ_FM_DIRECT_MX |
| |
| # tflags net |
| TO_EQ_FM_DOM_SPF_FAIL |
| |
| # tflags net |
| TO_EQ_FM_SPF_FAIL |
| |
| # tflags publish |
| TO_IN_SUBJ |
| |
| # tflags publish |
| TO_NAME_SUBJ_NO_RDNS |
| |
| # good enough |
| TO_NO_BRKTS_FROM_MSSP |
| |
| # tflags publish |
| TO_NO_BRKTS_HTML_IMG |
| |
| # tflags publish |
| TO_NO_BRKTS_HTML_ONLY |
| |
| # tflags publish |
| TO_NO_BRKTS_NORDNS_HTML |
| |
| # tflags publish |
| TO_NO_BRKTS_PCNT |
| |
| # tflags publish |
| TO_TOO_MANY_WFH_01 |
| |
| # good enough |
| TRANSFORM_LIFE |
| |
| # good enough |
| TUMBLR_IMG_NOT_RCVD_TUMB |
| |
| # good enough |
| TVD_DOLLARS_US |
| |
| # good enough |
| TVD_PH_BODY_META |
| |
| # tflags net |
| TVD_SUBJ_NUM_OBFU_MINFP |
| |
| # good enough |
| TVD_VISIT_PHARMA |
| |
| # tflags publish |
| TW_GIBBERISH_MANY |
| |
| # tflags publish |
| UC_GIBBERISH_OBFU |
| |
| # tflags publish |
| UNDISC_FREEM |
| |
| # tflags publish |
| UNDISC_MONEY |
| |
| # tflags publish |
| UNICODE_OBFU_ASC |
| |
| # tflags publish |
| UNICODE_OBFU_ZW |
| |
| # tflags userconf |
| UNPARSEABLE_RELAY |
| |
| # tflags publish |
| UNSUB_GOOG_FORM |
| |
| # tflags net |
| URIBL_ABUSE_SURBL |
| |
| # tflags net |
| URIBL_BLACK |
| |
| # tflags net |
| URIBL_BLOCKED |
| |
| # tflags net |
| URIBL_CR_SURBL |
| |
| # tflags net |
| URIBL_CSS |
| |
| # tflags net |
| URIBL_CSS_A |
| |
| # tflags net |
| URIBL_DBL_ABUSE_BOTCC |
| |
| # tflags net |
| URIBL_DBL_ABUSE_MALW |
| |
| # tflags net |
| URIBL_DBL_ABUSE_PHISH |
| |
| # tflags net |
| URIBL_DBL_ABUSE_REDIR |
| |
| # tflags net |
| URIBL_DBL_ABUSE_SPAM |
| |
| # tflags net |
| URIBL_DBL_BLOCKED |
| |
| # tflags net |
| URIBL_DBL_BLOCKED_OPENDNS |
| |
| # tflags net |
| URIBL_DBL_BOTNETCC |
| |
| # tflags net |
| URIBL_DBL_ERROR |
| |
| # tflags net |
| URIBL_DBL_MALWARE |
| |
| # tflags net |
| URIBL_DBL_PHISH |
| |
| # tflags net |
| URIBL_DBL_SPAM |
| |
| # tflags net |
| URIBL_GREY |
| |
| # tflags net |
| URIBL_MW_SURBL |
| |
| # tflags net |
| URIBL_PH_SURBL |
| |
| # tflags net |
| URIBL_RED |
| |
| # tflags net |
| URIBL_RHS_DOB |
| |
| # tflags net |
| URIBL_SBL |
| |
| # tflags net |
| URIBL_SBL_A |
| |
| # tflags net |
| URIBL_WS_SURBL |
| |
| # tflags net |
| URIBL_ZEN_BLOCKED |
| |
| # tflags net |
| URIBL_ZEN_BLOCKED_OPENDNS |
| |
| # tflags publish |
| URI_ADOBESPARK |
| |
| # tflags publish |
| URI_AZURE_CLOUDAPP |
| |
| # tflags publish |
| URI_DASHGOVEDU |
| |
| # tflags publish |
| URI_DATA |
| |
| # tflags publish |
| URI_DOTEDU |
| |
| # tflags publish |
| URI_DOTEDU_ENTITY |
| |
| # tflags publish |
| URI_DOTTY_HEX |
| |
| # tflags publish |
| URI_DQ_UNSUB |
| |
| # tflags publish |
| URI_FIREBASEAPP |
| |
| # tflags publish |
| URI_GOOGLE_PROXY |
| |
| # tflags publish |
| URI_GOOG_STO_SPAMMY |
| |
| # tflags publish |
| URI_HEX_IP |
| |
| # tflags userconf |
| URI_HOST_IN_BLOCKLIST |
| |
| # tflags userconf |
| URI_HOST_IN_WELCOMELIST |
| |
| # tflags publish |
| URI_IMG_WP_REDIR |
| |
| # good enough |
| URI_IN_URI_10 |
| |
| # tflags publish |
| URI_LONG_REPEAT |
| |
| # tflags publish |
| URI_MALWARE_SCMS |
| |
| # tflags userconf |
| URI_NOVOWEL |
| |
| # good enough |
| URI_OBFU_DOM |
| |
| # tflags publish |
| URI_ONLY_MSGID_MALF |
| |
| # tflags publish |
| URI_OPTOUT_3LD |
| |
| # tflags publish |
| URI_OPTOUT_USME |
| |
| # tflags publish |
| URI_PHISH |
| |
| # tflags publish |
| URI_PHP_REDIR |
| |
| # tflags publish |
| URI_TRY_3LD |
| |
| # tflags publish |
| URI_TRY_USME |
| |
| # tflags publish |
| URI_WPADMIN |
| |
| # tflags publish |
| URI_WP_DIRINDEX |
| |
| # tflags net |
| URI_WP_HACKED |
| |
| # tflags net |
| URI_WP_HACKED_2 |
| |
| # tflags publish |
| USB_DRIVES |
| |
| # tflags userconf |
| USER_IN_ALL_SPAM_TO |
| |
| # tflags userconf |
| USER_IN_BLOCKLIST |
| |
| # tflags userconf |
| USER_IN_BLOCKLIST_TO |
| |
| # tflags net |
| USER_IN_DEF_DKIM_WL |
| |
| # tflags net |
| USER_IN_DEF_SPF_WL |
| |
| # tflags userconf |
| USER_IN_DEF_WELCOMELIST |
| |
| # tflags net |
| USER_IN_DKIM_WELCOMELIST |
| |
| # tflags userconf |
| USER_IN_MORE_SPAM_TO |
| |
| # tflags net |
| USER_IN_SPF_WHITELIST |
| |
| # tflags userconf |
| USER_IN_WELCOMELIST |
| |
| # tflags userconf |
| USER_IN_WELCOMELIST_TO |
| |
| # tflags publish |
| VFY_ACCT_NORDNS |
| |
| # tflags publish |
| VPS_NO_NTLD |
| |
| # tflags publish |
| WALMART_IMG_NOT_RCVD_WAL |
| |
| # good enough |
| WANT_TO_ORDER |
| |
| # tflags publish |
| WORD_INVIS |
| |
| # tflags publish |
| WORD_INVIS_MANY |
| |
| # good enough |
| XFER_LOTSA_MONEY |
| |
| # tflags publish |
| XM_DIGITS_ONLY |
| |
| # good enough |
| XM_LIGHT_HEAVY |
| |
| # tflags publish |
| XM_PHPMAILER_FORGED |
| |
| # tflags publish |
| XM_RANDOM |
| |
| # good enough |
| XM_RECPTID |
| |
| # tflags net |
| XPRIO |
| |
| # tflags publish |
| XPRIO_SHORT_SUBJ |
| |
| # good enough |
| YOU_INHERIT |