Thats are the possible message for the SuperMailer spam test.


Phrase Description
ACT_NOW_CAPS Talks about 'acting now' with capitals
ADDR_FREE From Address contains FREE
ADDR_NUMS_AT_BIGSITE Uses an address with lots of numbers, at a big ISP
ADULT_SITE Possible porn - Adult Web Sites
ADVERT_CODE Subject: starts with advertising tag
ADVERT_CODE2 Subject: contains advertising tag
ALL_CAP_PORN Possible porn - in ALL CAPS
ALL_NATURAL Spam is 100% natural?!
AMATEUR_PORN Possible porn - Amateur Porn
AOL_USERS_LINK Includes a link for AOL users to click
APPLY_FREE Free Application
AS_SEEN_ON As seen on national TV!
AZOOGLE From,, etc.
BAD_CREDIT Eliminate Bad Credit
BANG_BOSS Talks about your boss with an exclamation!
BANG_EXERCISE Talks about exercise with an exclamation!
BANG_GUARANTEE Something is emphatically guaranteed
BANG_MONEY Talks about money with an exclamation!
BANG_MORE Talks about more with an exclamation!
BANG_OPRAH Talks about Oprah with an exclamation!
BANG_QUOTE Talks about quotes with an exclamation!
BANKRUPTCY Avoid Bankruptcy
BARELY_LEGAL Possible porn - Barely Legal
BARGAIN_URL Includes a link to a likely spammer domain
BEEN_TURNED_DOWN Have you been turned down?
BEST_PORN Possible porn - Best, Largest, Most Porn
BE_BOSS Be your own boss
BILL_1618 Claims compliance with Senate Bill 1618
BIZ_TLD Contains a URL in the BIZ top-level domain   
BLANK_LINES_70_80 Message body has 70-80% blank lines
BLANK_LINES_80_90 Message body has 80-90% blank lines
BODY_8BITS Body includes 8 consecutive 8-bit characters
BTAMAIL_HEADER Header contains an address from
BTAMAIL_URL Frequent Spam content
BUGGY_CGI Broken CGI script message
BZ_TLD Contains a URL in the BZ top-level domain   
CANNOT_BE_SPAM Claims "cannot be considered spam"
CBYI Contains "CBYI"
CELEBRITY_PORN Possible porn - Celebrity Porn
CELL_PHONE_BOOST Talks about cell-phone signal improvement
CENTS_ON_DOLLAR Cents on the Dollar
CHARSET_FARAWAY Character set indicates a foreign language
CHARSET_FARAWAY_HEADER A foreign language charset used in headers
CHINA_HEADER Involves ''
CHINA_URL Frequent Spam content
CLICK_BELOW Asks you to click below
CLICK_BELOW_CAPS Asks you to click below (in capital letters)
CLICK_TO_REMOVE_1 Click to be removed
COMMUNIGATE Sent using a trial version of CommuniGate
COMPETE Compete for your business
COMPLETELY_FREE No such thing as a free lunch (2)
CONFIDENTIAL_ORDER Confidentiality on all orders
CONFIRMED_FORGED Received headers are forged
CONSOLIDATE_DEBT Consolidate debt, credit, or bills
COPY_ACCURATELY Common pyramid scheme phrase (1)
CUM_SHOT Possible porn - Cum Shot
CU_1251_FROM Sender address in Windows-1251 encoding
CU_1251_ODD Mismatch Window-1251 encoding and origin
CU_1251_SUBJ Subject in Windows-1251 encoding
CU_8020 80-20 spammer
CU_BAD_HREF Obfuscated HREF tag
CU_BASE64_GSB_OK Probably encoded by
CU_BASE64_LOTUS_OK Lotus uses Base64, undo BASE64_ENC_TEXT
CU_BIGSTRONG Big and strong HTML
CU_BIZ Link to .biz domain web page
CU_BIZ_HTML Link to .biz web page and mostly html tags
CU_BOGUS_POSTFIX_1 Pretends to be sent with Postfix MTA
CU_BOGUS_POSTFIX_2 Pretends to be sent with Postfix MTA
CU_CASINO Casino gambling
CU_DATING Dating spammer (fishing for spam bait?)
CU_DAV Fake Received header that says: with DAV
CU_ENDS_IN_NUMS_OK From: looks like a Columbia UNI
CU_FAKE_FORWARD Faked to look like forwarded mail
CU_FORGED_MUA_IMS_OK Maybe it really is from IMS
CU_GENERIC_VIAGRA Claims there is a generic Viagra(tm)
CU_GIBBERISH_10 String of 10+ pseudo words
CU_GIBBERISH_15 String of 15+ pseudo words
CU_GIBBERISH_SI Gibberish intro "system information"
CU_GSB_ENDS_IN_NUMS_OK From: looks like a gsb address
CU_HELO_NAME Says HELO with wrong name
CU_IMAGELINK_NO_RDNS Click on an image, but never mind who we are
CU_IMAGELINK_ONLY Click on an image on the web, and that's all
CU_IMAGE_ONLY_ASP_02 Just an image and an asp link
CU_IMAGE_ONLY_ASP_04 An image and an asp link, with a little text
CU_INVISIBLE Invisible text in html-only mail
CU_INVISIBLE_BUGS Both invisible text and web bugs
CU_LETTERS_100 String of 100+ lowercase letters
CU_LETTERS_70 String of 70+ lowercase letters
CU_LETTERS_80 String of 80+ lowercase letters
CU_LETTERS_90 String of 90+ lowercase letters
CU_LONGID Obfuscated long id tag
CU_MEDS_CLEAR Prescription drugs in body
CU_MEDS_CLEAR_HTML Prescription drugs in body, HTML only
CU_MEDS_OBFUSCATED Prescription drugs in body, obfuscated
CU_MEDS_SUBJ_CLR Prescription drugs in subject
CU_MEDS_SUBJ_OBF Illegal prescription drug sales
CU_MISMATCHED_SENDER Suspicious mismatch of sender and host
CU_MORTGAGE_LINKED Mortgage or refinance with tagged link
CU_NAME spammer with domains
CU_NONMAIL_HOST Sent to a timeshare or similar host
CU_NO_RDNS Sent from a host with no rDNS
CU_OBFUSCATED_ORGAN The male member, spelled funny
CU_OBFUSCATED_ORGAN2 HTML obfuscation by penis spammer
CU_OBFUSCATING3 HTML obfuscation (indirect URI)
CU_OBFUSCATING5 HTML obfuscation (many bogus tags)
CU_ODD_RELAY Faked Received headers
CU_ORGAN The male member
CU_REDIRECT Yahoo redirect URL
CU_REFINANCE Refinance spammer
CU_SHAREYOUREX Share Your Experiences spammer
CU_SOFTWARE_PIRATE Arr matey, there be cheap software
CU_SPAMBYNAME Many recipients without numbers
CU_SPECIALOFFER A special offer only sent to me?  I wish.
CU_SUBJ_HAS_SPACES Subject has 12 or more spaces in a row
CU_SUBJ_PORN0 Labelled as porn spam not quite as per US law
CU_SUBJ_PORN1 Porn spam subject word
CU_SUBJ_PORN2 Porn spam subject word
CU_TAGGED_LINK Link tagged with questionmark
CU_TELEPHONE Mail from a telephone
CU_TINY_FONT HTML obfuscation using 0 or 1 pt lettering
CU_TISCALI Comes from tiscali
CU_USELESS_HREF HREF tag to nowhere
CU_USER_AGENT_MSE Sent with Mail System Express
CU_UUENCODE_OK Looks like uuencoded text
CU_WORDOFMOUTH Word of Mouth scammer
CU_X_ORIG_EMAIL Has X-Originating-Email header but not Hotmail or MSN
CU_YAHOO_LIST_OK List mail may appear to be FORGED_YAHOO_RCVD
CU_YOU_CREDIT_CARD Fake spam about money laundering and child porn
DAILY_PL Spam URL pattern, DailyPromotions redirect
DAILY_PXE Spam URL pattern, DailyPromotions server link
DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
DATE_IN_FUTURE_24_48 Date: is 24 to 48 hours after Received: date
DATE_IN_FUTURE_96_XX Date: is 96 hours or more after Received: date
DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date
DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date
DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date
DATE_MISSING Missing Date: header
DATE_SPAMWARE_Y2K Date header uses unusual Y2K formatting
DATE_YEAR_ZERO_FIRST Invalid Date: year begins with zero
DEAR_FRIEND Dear Friend? That's not very dear!
DEAR_SOMETHING Contains 'Dear (something)'
DIG_UP_INFO Dig up Dirt on Friends
DISGUISE_PORN Attempts to disguise porn words
DOMAIN_4U2 Domain name containing a "4u" variant
DOMAIN_BODY Domain registration spam body
DONT_DELETE Don't delete me!  Nooooo!!!!
DO_IT_TODAY Do it Today
DRASTIC_REDUCED Drastically Reduced
EARNINGS Potential Earnings
EARN_MONEY Message talks about earning money
EMAIL_ROT13 Body contains a ROT13-encoded email address
EXCUSE_1 Gives a lame excuse about why spam was sent
EXCUSE_10 if you do not wish to receive any more
EXCUSE_11 Claims you were on a list
EXCUSE_12 Nobody's perfect
EXCUSE_13 Gives an excuse for why message was sent
EXCUSE_14 Tells you how to stop further spam
EXCUSE_15 Claims to be legitimate email
EXCUSE_16 I wonder how many emails they sent in error
EXCUSE_18 Claims not to be spam
EXCUSE_19 Claims you opted-in or registered
EXCUSE_20 Claims you registered at their site
EXCUSE_21 Claims address was obtained legitimately
EXCUSE_22 You're receiving this offer for a reason
EXCUSE_23 Claims you have provided permission
EXCUSE_24 Claims you wanted this ad
EXCUSE_3 Claims you can be removed from the list
EXCUSE_4 Claims you can be removed from the list
EXCUSE_6 Claims you can be removed from the list
EXCUSE_REMOVE Talks about how to be removed from mailings
EXTRA_CASH Offers Extra Cash
EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry
FAKED_HOTMAIL_DAV X-Originating-Email header does not match From
FAKED_IP_IN_RCVD Received: contains a name with a faked IP-address
FAKED_UNDISC_RECIPS Faked To "Undisclosed-Recipients"
FINANCIAL Financial Freedom
FIND_ANYTHING Find out anything
FORGED_AOL_HTML AOL can't send HTML message only
FORGED_AOL_RCVD Received forged, contains fake AOL relays
FORGED_AOL_TAGS AOL mailers can't send HTML in this format
FORGED_EUDORAMAIL_RCVD Forged 'Received:' header found
FORGED_GW05_RCVD Forged 'by gw05' 'Received:' header found
FORGED_HOTMAIL_RCVD Forged 'Received:' header found
FORGED_HOTMAIL_RCVD2 'From' address, but no 'Received:'
FORGED_IMS_HTML IMS can't send HTML message only
FORGED_IMS_TAGS IMS mailers can't send HTML in this format
FORGED_JUNO_FROM Has invalid account name for address
FORGED_JUNO_RCVD 'From' does not match 'Received' headers
FORGED_MUA_AOL_FROM Forged mail pretending to be from AOL (by From)
FORGED_MUA_APPLEMAIL AppleMail can't send HTML message only
FORGED_MUA_IMS Forged mail pretending to be from IMS
FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla
FORGED_MUA_OIMO Forged mail pretending to be from MS Outlook IMO
FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
FORGED_MUA_THEBAT Mail pretending to be from The Bat! (mid)
FORGED_MUA_THEBAT_BOUN Mail pretending to be from The Bat! (boundary)
FORGED_MUA_THEBAT_CS Mail pretending to be from The Bat! (charset)
FORGED_MX_HOTMAIL Forged Received 'from mx' header
FORGED_OUTLOOK_HTML Outlook can't send HTML message only
FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
FORGED_QUALCOMM_TAGS QUALCOMM mailers can't send HTML in this format
FORGED_RCVD_FROM_NUM Received headers forged (numeric hostname)
FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
FORGED_TELESP_RCVD Contains forged hostname for a DSL IP in Brazil
FORGED_THEBAT_HTML The Bat! can't send HTML message only
FORGED_YAHOO_RCVD 'From' does not match 'Received' headers
FORGED_YAHOO_RCVD_SMTP Header contains forged Yahoo! SMTP server hostname
FORWARD_LOOKING Stock Disclaimer Statement
FOR_FREE No such thing as a free lunch (1)
FREE_ACCESS Contains 'free access' with capitals
FREE_CONSULTATION Offers a consultation for nothing
FREE_GRANT Free Grant Money
FREE_INSTALL Contains 'free installation' with capitals
FREE_PASSWORD Offers Free (often stolen) Passwords
FREE_PORN Possible porn - Free Porn
FREE_QUOTE_INSTANT Free express or no-obligation quote
FREE_SAMPLE Contains 'free sample' with capitals
FRIEND_AT_PUBLIC sent to or similar
FROM_ALL_NUMS From an address that is all numbers (non-phone)
FROM_AND_TO_SAME From and To are the same, but not exactly
FROM_ENDS_IN_NUMS From: ends in numbers
FROM_HAS_MIXED_NUMS From: contains numbers mixed in with letters
FROM_HAS_MIXED_NUMS2 From address matches known spammer format
FROM_HAS_MIXED_NUMS3 From: contains numbers mixed in with letters
FROM_HAS_ULINE_NUMS From: contains an underline and numbers/letters
FROM_ILLEGAL_CHARS From contains too many raw illegal characters
FROM_NO_LOWER 'From' has no lower-case characters
FROM_NO_USER From: has no local-part before @ sign
FROM_NUM_AT_WEBMAIL From address is webmail, but starts with a number
FROM_OFFERS From address is "at something-offers"
FROM_STARTS_WITH_NUMS From: starts with nums
FROM_WEBMAIL_END_NUMS6 From webmail service and address ends in numbers
FRONTPAGE Frontpage used to create the message
GAPPY_SUBJECT Subject: contains G.a.p.p.y-T.e.x.t
GET_IT_NOW Contains 'Get it now' with capitals
GTUBE Generic Test for Unsolicited Bulk Email
GUARANTEE Contains word 'guarantee' in all-caps
GUARANTEED_100_PERCENT One hundred percent guaranteed
HAIR_LOSS Cures Baldness
HARDCORE_PORN Possible porn - Hardcore Porn
HEADER_COUNT_CTYPE Multiple Content-Type headers found
HEAD_ILLEGAL_CHARS Header contains too many raw illegal characters
HG_HORMONE Talks about hormones for human growth
HIDDEN_ASSETS 'Hidden' assets
HIDE_WIN_STATUS Javascript to hide URLs in browser
HOME_EMPLOYMENT Information on how to work at home (2)
HOT_NASTY Possible porn - Hot, Nasty, Wild, Young
HR_3113 Mentions Spam law "HR 3113"
HR_4176 Claims compliance with House Bill 4176
HTML_20_30 Message is 20% to 30% HTML
HTML_30_40 Message is 30% to 40% HTML
HTML_40_50 Message is 40% to 50% HTML
HTML_50_60 Message is 50% to 60% HTML
HTML_60_70 Message is 60% to 70% HTML
HTML_70_80 Message is 70% to 80% HTML
HTML_80_90 Message is 80% to 90% HTML
HTML_90_100 Message is 90% to 100% HTML
HTML_CHARSET_FARAWAY A foreign language charset used in HTML markup
HTML_COMMENT_8BITS HTML comment has 3 consecutive 8-bit chars
HTML_COMMENT_RATIO HTML comments are large percentage of message
HTML_COMMENT_SAVED_URL HTML message is a saved web page
HTML_COMMENT_SKY HTML comment contains SKY database codes
HTML_FONTCOLOR_BLUE HTML font color is blue
HTML_FONTCOLOR_GREEN HTML font color is green
HTML_FONTCOLOR_RED HTML font color is red
HTML_FONTCOLOR_UNKNOWN HTML font color is unknown to us
HTML_FONTCOLOR_UNSAFE HTML font color not in safe 6x6x6 palette
HTML_FONT_BIG HTML has a big font
HTML_FONT_FACE_BAD HTML font face is not a word
HTML_FONT_FACE_ODD HTML font face is not a commonly used face
HTML_FONT_INVISIBLE HTML font color is same as background
HTML_FORMACTION_MAILTO HTML includes a form which sends mail
HTML_IMAGE_AREA_05 HTML has 5-6 kilopixels of images
HTML_IMAGE_AREA_07 HTML has 7-8 kilopixels of images
HTML_IMAGE_ONLY_02 HTML: images with 0-200 bytes of words
HTML_IMAGE_ONLY_04 HTML: images with 200-400 bytes of words
HTML_IMAGE_ONLY_06 HTML: images with 400-600 bytes of words
HTML_IMAGE_ONLY_08 HTML: images with 600-800 bytes of words
HTML_IMAGE_ONLY_10 HTML: images with 800-1000 bytes of words
HTML_IMAGE_ONLY_12 HTML: images with 1000-1200 bytes of words
HTML_IMAGE_RATIO_04 HTML has a low ratio of text to image area
HTML_IMAGE_RATIO_06 HTML has a low ratio of text to image area
HTML_IMAGE_RATIO_08 HTML has a low ratio of text to image area
HTML_IMAGE_RATIO_10 HTML has a low ratio of text to image area
HTML_IMAGE_RATIO_12 HTML has a low ratio of text to image area
HTML_LINK_CLICK_HERE HTML link text says "click here"
HTML_LINK_PUSH_HERE HTML link text says "push here" or similar
HTML_MESSAGE HTML included in message
HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
HTML_RELAYING_FRAME Frame wanted to load outside URL
HTML_SHOUTING7 HTML has very strong "shouting" markup
HTML_SHOUTING8 HTML has very strong "shouting" markup
HTML_SHOUTING9 HTML has very strong "shouting" markup
HTML_TABLE_THICK_BORD HTML table has thick border
HTML_TAG_BALANCE_A HTML has excess "a" close tags
HTML_TAG_BALANCE_BODY HTML has unbalanced "body" tags
HTML_TAG_BALANCE_HTML HTML has unbalanced "html" tags
HTML_TAG_BALANCE_TABLE HTML is missing "table" close tags
HTML_TITLE_EMPTY HTML title contains no text
HTML_TITLE_UNTITLED HTML title contains "Untitled"
HTML_WEB_BUGS Image tag intended to identify you
HTML_WIN_BLUR Javascript to move windows around
HTTP_CTRL_CHARS_HOST Uses control sequences inside a URL hostname
HTTP_ENTITIES_HOST URI obscured with character entities
HTTP_ESCAPED_HOST Uses %-escapes inside a URL's hostname
HTTP_EXCESSIVE_ESCAPES Completely unnecessary %-escapes inside a URL
HTTP_WITH_EMAIL_IN_URL 'remove' URL contains an email address
IDENT_NOBODY Received lines include an 'ident:nobody' string
ID_UNIQUE X-List-Unsubscribe has a numbered address
IMPOTENCE Impotence cure
INCOME Additional Income
INCREASE_SEX Talks about a bigger drive for sex
INITIAL_INVEST Requires Initial Investment
INVALID_DATE Invalid Date: header (not RFC 2822)
INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)
INVALID_MSGID Message-Id is not valid, according to RFC 2822
INVALUABLE_MARKETING Invaluable marketing information
JAPANESE_UCE_SUBJECT Subject contains a Japanese UCE tag
JODY Contains "My wife, Jody" testimonial
JOIN_MILLIONS Join Millions of Americans
KIFF Contains "Temple Kiff"
KOREAN_UCE_SUBJECT Subject: contains Korean unsolicited email tag
LARGE_HEX Contains a large block of hexadecimal code
LESBIAN Possible porn - Lesbian Site
LIMITED_TIME_ONLY Offers a limited time offer
LINK_TO_NO_SCHEME Contains link without http:// prefix
LIVE_PORN Possible porn - Live Porn
LONG_DISTANCE Long Distance Phone Offer
LOSE_POUNDS Subject talks about losing pounds
LOTS_OF_CC_LINES Lots and lots of Cc: headers
LOTS_OF_STUFF Thousands or millions of pics/movies/etc
LOW_INTEREST Lower Interest Rates
LOW_PAYMENT Lower Monthly Payment
LOW_PRICE Lowest Price
LYING_EYES Will not Believe your Eyes!
MAILTO_SUBJ_REMOVE mailto URI includes removal text
MAILTO_TO_REMOVE Includes a 'remove' email address
MAILTO_TO_SPAM_ADDR Includes a link to a likely spammer email
MAIL_IN_ORDER_FORM Contains mail-in order form
MANY_EXCLAMATIONS Subject has many exclamations
MARKETING_PARTNERS Claims you registered with a partner
MARKUP_RAND RAND found, spammer tried to use a random-ID
MDAEMON_2_7_4 Received via buggy SMTP server (MDaemon 2.7.4SP4R)
MEGA_SITE Possible porn - Mega Porn
MICROSOFT_EXECUTABLE Message includes Microsoft executable program
MILLION_EMAIL Get a million email addresses
MILLION_USD Talks about millions of dollars
MIME_BASE64_ILLEGAL base64 attachment uses illegal characters
MIME_BASE64_LATIN Latin alphabet text using base64 encoding
MIME_BASE64_NO_NAME base64 attachment does not have a file name
MIME_BASE64_TEXT Message text disguised using base64 encoding
MIME_BOUND_DASH_DIGIT Spam tool pattern in MIME boundary
MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
MIME_BOUND_DIGITS_7 Spam tool pattern in MIME boundary
MIME_BOUND_HEX_24 Spam tool pattern in MIME boundary
MIME_BOUND_MAIL_BOUND Spam tool pattern in MIME boundary
MIME_BOUND_MANY_HEX Spam tool pattern in MIME boundary
MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary
MIME_BOUND_OPTIN Spam tool pattern in MIME boundary
MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
MIME_CHARSET_FARAWAY MIME character set indicates foreign language
MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME headers
MIME_HTML_MOSTLY Multipart message mostly text/html MIME
MIME_HTML_NO_CHARSET Message text in HTML without charset
MIME_HTML_ONLY Message only has text/html MIME parts
MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
MIME_MISSING_BOUNDARY MIME section missing boundary
MIME_ODD_CASE MiME-Version header (oddly capitalized)
MIME_QP_DEFICIENT Deficient quoted-printable encoding in body
MIME_QP_LONG_LINE Quoted-printable line longer than 76 chars
MIME_QP_NO_CHARSET Quoted-printable inline text with no charset
MIME_SUSPECT_NAME MIME filename does not match content
MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
MISSING_OUTLOOK_NAME Message looks like Outlook, but isn't
MLM Multi Level Marketing mentioned
MONEY_BACK Money back guarantee
MONEY_MAKING Discusses money making
MORTGAGE_BEST Information on mortgages
MORTGAGE_LINKS Message has link to mortgage URI
MORTGAGE_PITCH Looks like mortgage pitch
MORTGAGE_RATES Information on mortgage rates
MSGID_3_DOLLARS Spam tool Message-Id: (3-dollars variant)
MSGID_4NUMS_DOLLAR Spam tool Message-Id: (4-num-dollar variant)
MSGID_FROM_MTA_HEADER Message-Id was added by a relay
MSGID_FROM_MTA_HOTMAIL Message-Id was added by a relay
MSGID_FROM_MTA_SHORT Message-Id was added by a relay
MSGID_NO_HOST Message-Id has no hostname
MSGID_OUTLOOK_INVALID Message-Id is fake (in Outlook Express format)
MSGID_SPAM_1 Message-Id generated by a spam tool
MSGID_SPAM_6LETTER Spam tool Message-Id: (6-letter variant)
MSGID_SPAM_99X9XX99 Spam tool Message-Id: (99x9xx99 variant)
MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant)
MSGID_SPAM_ZEROES Spam tool Message-Id: (12-zeroes variant)
MSGID_THREESIXSIX Message-Id header indicates message is spam
MULTI_FORGED Received headers indicate multiple forgeries
MUST_BE_18 Possible porn - Must be 18
NASTY_GIRLS Possible porn - Nasty Girls
NATURAL_VIAGRA Plugs "Natural Viagra"
NEVER_ANOTHER another mailing will "never" be "received"
NEW_DOMAIN_EXTENSIONS Possible registry spammer
NIGERIAN_BODY1 Message body looks like a Nigerian spam message 1+
NIGERIAN_BODY2 Message body looks like a Nigerian spam message 2+
NIGERIAN_BODY3 Message body looks like a Nigerian spam message 3+
NIGERIAN_BODY4 Message body looks like a Nigerian spam message 4+
NIGERIAN_BODY_GOVT_3 Message body has many indications of Nigerian scam
NIGERIAN_SCAM_VIRTUE Possible Nigerian Scam Text
NIGERIAN_SUBJECT1 Subject is indicative of a Nigerian spam
NIGERIAN_SUBJECT2 Subject is indicative of a Nigerian spam
NONEXISTENT_CHARSET Character set doesn't exist
NORMAL_HTTP_TO_IP Uses a dotted-decimal IP address in URL
NOT_ADVISOR Not registered investment advisor
NOT_INTENDED Not intended for residents of somewhere
NOT_MLM Apparently, NOT Multi Level Marketing
NO_CATCH There is no catch
NO_COST No such thing as a free lunch (3)
NO_DISAPPOINTMENT You won't be "disappointed"
NO_EXPERIENCE No experience needed!
NO_OBLIGATION There is no obligation
NO_QS_ASKED Doesn't ask any questions
NO_RDNS_DOTCOM_HELO Host HELO'd as a big ISP, but had no rDNS
NO_REAL_NAME From: does not include a real name
NO_STRINGS No Strings Attached
NUMERIC_HTTP_ADDR Uses a numeric IP address in URL
OBFUSCATING_COMMENT HTML comments which obfuscate text
OBSCURED_EMAIL Message seems to contain rot13ed address
OFFERS_ETC Stop the offers, coupons, discounts etc!
ONE_TIME One Time Rip Off
ONE_TIME_MAILING one time mailing doesn't mean it isn't spam
OPPORTUNITY Gives information about an opportunity
OPT_HEADER Headers include an "opt"ed phrase
OPT_IN Talks about opting in (lowercase version)
OPT_IN_CAPS Talks about opting in (capitalized version)
ORDER_NOW Encourages you to waste no time in ordering
ORDER_REPORT Order a report from someone
OUR_AFFILIATE_PARTNERS Mentions their affiliate partners
OUR_PRIVACY_POLICY Mentions where their privacy policy is
OUR_STRICT_ANTI Mentions their strict antipathy on something
OVERWHELMING_GROWTH Mentions their overwhelming growth
PAY_SITE Possible porn - Pay Site
PENIS_ENLARGE Information on getting larger penis/breasts
PENIS_ENLARGE2 Information on getting larger penis/breasts
PLING_PLING Subject has lots of exclamation marks
PLING_QUERY Subject has exclamation mark and question mark
PORN_15 Possible porn - various types of feline
PORN_16 Possible porn - nasty, dirty, little etc.
PORN_4 URL uses words/phrases which indicate porn
PORN_6 Possible Porn - XXX Photos
PORN_MEMBERSHIP Possible Porn - Porn membership
PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities'
PRINT_FORM_SIGNATURE Asks you for your signature on a form
PRIORITY_NO_NAME Message has priority setting, but no X-Mailer
PRIZE Talks about prizes
RATWARE_BAD_REFS References header has bad format
RATWARE_EGROUPS Bulk email fingerprint (eGroups) found
RATWARE_EMPTY_HELO Received headers forged (empty HELO)
RATWARE_EMWAC Bulk email fingerprint ("EMWAC SMTPRS") found
RATWARE_EVAMAIL Bulk email fingerprint (EVAMAIL) found
RATWARE_EXISCAN_FORGED Headers indicate forged Exiscan message
RATWARE_HASH_2_V2 Bulk email fingerprint (hash 2 v2) found
RATWARE_HASH_DASH Contains a hashbuster in Send-Safe format
RATWARE_JIXING Bulk email fingerprint (JiXing) found
RATWARE_JPFREE Bulk email fingerprint (jpfree) found
RATWARE_MMAILER Bulk email fingerprint (MMailer) found in headers
RATWARE_OE_MALFORMED X-Mailer has malformed Outlook Express version
RATWARE_OE_PI X-Mailer contains "OutLook Express 3.14159"
RATWARE_POWERC Bulk email fingerprint (PowerCampaign) found
RATWARE_RCVD_AT Bulk email fingerprint (Received @) found
RATWARE_RCVD_LC_ESMTP Bulk email fingerprint ('esmtp' Received) found
RATWARE_SCREWUP_1 Bulk email fingerprint (screwup 1) found
RATWARE_STORM Bulk email fingerprint (StormPost) found
RATWARE_STORM_URI Bulk email fingerprint (StormPost) found
RATWARE_VC_IPA Bulk email fingerprint (VC_IPA) found
RATWARE_XMAILER Bulk email fingerprint (xmailer tag) found
RATWARE_X_SCANNER Has X-Scanner header
RCVD_6_CAPS_ESMTP_ID Spam tool Received: (6-caps ESMTP ID variant)
RCVD_AM_PM Received headers forged (AM/PM)
RCVD_BY_QVES_COM Sent by a known spamhaus (qves)
RCVD_DOUBLE_IP_SPAM Bulk email fingerprint (double IP) found
RCVD_FAKE_HELO_DOTCOM Received contains a faked HELO hostname
RCVD_NUMERIC_HELO Received: contains a numeric HELO
READ_TO_END You'd better read all of this spam!
RECEIVED_CACHEFLOW Received contains 'CacheFlowServer' IDENT name
RECEIVED_IDENT_SQUID Message was sent by a Squid HTTP proxy
RECEIVE_EMAIL Receive third party email
RECEIVE_OFFER Receive a special offer
REFINANCE_NOW Home refinancing
REMOVAL_INSTRUCTIONS Gives instructions for removal from list
REMOVE_FROM_LIST To be removed from list
REMOVE_IN_QUOTES List removal information
REMOVE_PAGE URL of page called "remove"
REMOVE_POSTAL Send real mail to be unsubscribed
REMOVE_REMOVAL_1WORD List removal information
REMOVE_REMOVAL_2WORD List removal information
REMOVE_REMOVAL_NEAR List removal information
REMOVE_SUBJ List removal information
REPLY_REMOVE_SUBJECT List removal information
REPLY_TO_EMPTY Reply-To: is empty
REPLY_TO_ULINE_NUMS Reply-To: has an underline and numbers/letters
RESISTANCE_IS_FUTILE Resistance to this spam is futile
REVERSE_AGING Reverses Aging
RICH If only it were that easy
RISK_FREE Risk free.  Suuurreeee....
SAVE_ON_INSURANCE Trying to sell insurance online
SAVE_THOUSANDS Save big money
SECRET_RECORD Secretly Recorded
SEDUCTION Score with babes!
SELECTED_YOU They have selected you for something
SENT_IN_COMPLIANCE Claims compliance with spam regulations
SERIOUS_CASH Serious cash
SEX_FEST Possible porn - Porn Fest
SORTED_RECIPS Recipient list is sorted by address
START_NOW_CAPS Talks about 'starting now' with capitals
STOCK_ALERT Offers a alert about a stock
STOP_SNORING Contains "Stop Snoring"
STRONG_BUY Tells you about a strong buy
SUBJECT_APPROVED Subject talks about being approved
SUBJECT_DRUG_GAP_S Subject contains a gappy version of 'soma'
SUBJECT_DRUG_GAP_VA Subject contains a gappy version of 'valium'
SUBJECT_DRUG_GAP_X Subject contains a gappy version of 'xanax'
SUBJ_2_CREDIT Contains 'subject to credit approval'
SUBJ_ALL_CAPS Subject is all capitals
SUBJ_AS_SEEN Subject contains "As Seen"
SUBJ_BUY 'Subject' starts with Buy, Buying
SUBJ_DOLLARS Subject starts with dollar amount
SUBJ_FOR_ONLY Subject contains "For Only"
SUBJ_FREE_CAP Subject contains "FREE" in CAPS
SUBJ_FREE_INSTANT Subject contains "Free Instant"
SUBJ_HAS_SPACES Subject contains lots of white space
SUBJ_HAS_UNIQ_ID Subject contains a unique ID
SUBJ_ILLEGAL_CHARS Subject contains too many raw illegal characters
SUBJ_NOW_ONLY Subject contains "Now Only"
SUBJ_VIAGRA Subject includes "viagra"
SUBJ_YOUR_DEBT Subject contains "Your Bills" or similar
SUBJ_YOUR_FAMILY Subject contains "Your Family"
SUBJ_YOUR_OWN Subject contains "Your Own"
SUB_FREE_OFFER Subject starts with "Free"
SUB_HELLO Subject starts with "Hello"
SUPPLIES_LIMITED Supplies are Limited
TAKE_ACTION_NOW Tells you to 'take action now!'
TARGETED Targeted Traffic / Email Addresses
THE_BEST_RATE The best Rates
THE_FOLLOWING_FORM Asks you to fill out a form
THIS_AINT_SPAM Claims "This is not spam"
THIS_IS_AN_AD Says "this is an advertisement" (thanks!)
TONER Contains "Toner Cartridge"
TO_ADDRESS_EQ_REAL To: repeats address as real name
TO_EMPTY To: is empty
TO_HAS_SPACES To: address contains spaces
TO_MALFORMED To: has a malformed address
TO_NO_USER To: has no local-part before @ sign
TO_TXT Sent to a text file
TRACKER_ID Incorporates a tracking ID number
UCE_MAIL_ACT Mentions Spam Law "UCE-Mail Act"
UNCLAIMED_MONEY People just leave money laying around
UNSECURED_CREDIT Unsecured Credit/Debt
UNSUB_SCRIPT URL of CGI script has unsubscribe or remove
UNWANTED_LANGUAGE_BODY Message written in an undesired language
UPPERCASE_25_50 message body is 25-50% uppercase
UPPERCASE_50_75 message body is 50-75% uppercase
URI_4YOU Message has URI 4you
URI_BANNEDCD Message has URI for bannedcd
URI_DOLLARMACHINE Message has URI for dollarmachine
URI_FREEHT Message has URI for freeht
URI_OFFERS Message has link to company offers
URI_PXLG Frequent Spam Content
USERNAME_IN_SUBJECT To: username at front of subject
USERPASS URL contains username and (optional) password
USER_4U2 Local part containing a "4u" variant
USER_IN_ALL_SPAM_TO User is listed in 'all_spam_to'
USER_IN_BLACKLIST From: address is in the user's black-list
USER_IN_BLACKLIST_TO User is listed in 'blacklist_to'
USER_IN_DEF_WHITELIST From: address is in the default white-list
USER_IN_MORE_SPAM_TO User is listed in 'more_spam_to'
USER_IN_WHITELIST From: address is in the user's white-list
USER_IN_WHITELIST_TO User is listed in 'whitelist_to'
USE_IDENTITY Someone using your identity
US_DOLLARS_3 Mentions millions of $ ($NN,NNN,NNN.NN)
VACATION_SCAM Vacation Offers
VERB_UP_TO_OR_MORES Has add/lose/make/save up to X or more
VERY_SUSP_RECIPS Very similar addresses in recipient list
VIAGRA Plugs Viagra
VIAGRA_COMBO Viagra and other drugs
VIAGRA_ONLINE Fast Viagra Delivery
WALAA Illiterate spammer cannot spell 'voila'
WANTS_CREDIT_CARD Asks for credit card details
WEIRD_PORT Uses non-standard port number for HTTP
WEIRD_QUOTING Weird repeated double-quotation marks
WE_HATE_SPAM We strongly oppose the use of spam email too
WE_HONOR_ALL Claims to honor removal requests
WE_PROMISE_YOU Promise you ...!
WHILE_SUPPLIES While Supplies Last
WHILE_YOU_SLEEP While you Sleep
WHY_WAIT What are you waiting for
WITH_LC_SMTP Received line contains spam-sign (lowercase smtp)
WORK_AT_HOME Information on how to work at home (1)
WRINKLES Removes Wrinkles
X_ENC_PRESENT Message has X-Encoding header
X_ESMTP Message has x-esmtp header
X_LIBRARY Message has X-Library header
X_LIST_UNSUBSCRIBE Message has X-List-Unsubscribe header
X_MESSAGE_INFO Bulk email fingerprint (X-Message-Info) found
X_MSMAIL_PRIORITY_HIGH Sent with 'X-Msmail-Priority' set to high
X_ORIG_HOST Message has X-Originating-Host header
X_PRECEDENCE_REF Message has X-Precedence-Ref header
X_PRIORITY_HIGH Sent with 'X-Priority' set to high
X_PRI_MISMATCH_HI 'X-Priority' does not match 'X-MSMail-Priority'
X_STORMPOST_TO Message has X-Stormpost-To header
X_VMP_TEXT Message has X-VMP-Text header
X_X_PRESENT Message has X-x header
YAHOO_REDIR Has Yahoo Redirect URI
YOUR_INCOME Doing something with my income
YOU_CAN_SEARCH You can search for anyone
__MIME_BASE64 Includes a base64 attachment
__MIME_QP Includes a quoted-printable attachment