Thats are the possible message for the SuperMailer spam test.
| Phrase | Description |
| ACCEPT_CREDIT_CARDS | Accept Credit Cards |
| ACT_NOW_CAPS | Talks about 'acting now' with capitals |
| ADDR_FREE | From Address contains FREE |
| ADDR_NUMS_AT_BIGSITE | Uses an address with lots of numbers, at a big ISP |
| ADULT_SITE | Possible porn - Adult Web Sites |
| ADVERT_CODE | Subject: starts with advertising tag |
| ADVERT_CODE2 | Subject: contains advertising tag |
| ALL_CAP_PORN | Possible porn - in ALL CAPS |
| ALL_NATURAL | Spam is 100% natural?! |
| AMATEUR_PORN | Possible porn - Amateur Porn |
| AMAZING_STUFF | Amazing Stuff |
| AOL_USERS_LINK | Includes a link for AOL users to click |
| APPLY_FREE | Free Application |
| AS_SEEN_ON | As seen on national TV! |
| AZOOGLE | From azoogle.com, azogle.com, etc. |
| BAD_CREDIT | Eliminate Bad Credit |
| BANG_BOSS | Talks about your boss with an exclamation! |
| BANG_EXERCISE | Talks about exercise with an exclamation! |
| BANG_GUARANTEE | Something is emphatically guaranteed |
| BANG_MONEY | Talks about money with an exclamation! |
| BANG_MORE | Talks about more with an exclamation! |
| BANG_OPRAH | Talks about Oprah with an exclamation! |
| BANG_QUOTE | Talks about quotes with an exclamation! |
| BANKRUPTCY | Avoid Bankruptcy |
| BARELY_LEGAL | Possible porn - Barely Legal |
| BARGAIN_URL | Includes a link to a likely spammer domain |
| BEEN_TURNED_DOWN | Have you been turned down? |
| BEST_PORN | Possible porn - Best, Largest, Most Porn |
| BE_BOSS | Be your own boss |
| BILL_1618 | Claims compliance with Senate Bill 1618 |
| BIZ_TLD | Contains a URL in the BIZ top-level domain |
| BLANK_LINES_70_80 | Message body has 70-80% blank lines |
| BLANK_LINES_80_90 | Message body has 80-90% blank lines |
| BODY_8BITS | Body includes 8 consecutive 8-bit characters |
| BTAMAIL_HEADER | Header contains an address from btamail.net.cn |
| BTAMAIL_URL | Frequent Spam content |
| BUGGY_CGI | Broken CGI script message |
| BUY_DIRECT | Buy Direct |
| BZ_TLD | Contains a URL in the BZ top-level domain |
| CABLE_CONVERTER | Cable Converter |
| CANNOT_BE_SPAM | Claims "cannot be considered spam" |
| CASH_BONUS | Cash Bonus |
| CBYI | Contains "CBYI" |
| CELEBRITY_PORN | Possible porn - Celebrity Porn |
| CELL_PHONE_BOOST | Talks about cell-phone signal improvement |
| CENTS_ON_DOLLAR | Cents on the Dollar |
| CHARSET_FARAWAY | Character set indicates a foreign language |
| CHARSET_FARAWAY_HEADER | A foreign language charset used in headers |
| CHINA_HEADER | Involves 'china.com' |
| CHINA_URL | Frequent Spam content |
| CLICK_BELOW | Asks you to click below |
| CLICK_BELOW_CAPS | Asks you to click below (in capital letters) |
| CLICK_TO_REMOVE_1 | Click to be removed |
| COMMUNIGATE | Sent using a trial version of CommuniGate |
| COMPARE_RATES | Compare Rates |
| COMPETE | Compete for your business |
| COMPLETELY_FREE | No such thing as a free lunch (2) |
| CONFIDENTIAL_ORDER | Confidentiality on all orders |
| CONFIRMED_FORGED | Received headers are forged |
| CONSOLIDATE_DEBT | Consolidate debt, credit, or bills |
| COPY_ACCURATELY | Common pyramid scheme phrase (1) |
| CREDITORS_CALLING | Calling Creditors |
| CUM_SHOT | Possible porn - Cum Shot |
| CU_1251_FROM | Sender address in Windows-1251 encoding |
| CU_1251_ODD | Mismatch Window-1251 encoding and origin |
| CU_1251_SUBJ | Subject in Windows-1251 encoding |
| CU_8020 | 80-20 spammer |
| CU_BAD_HREF | Obfuscated HREF tag |
| CU_BASE64_GSB_OK | Probably encoded by gsb.columbia.edu |
| CU_BASE64_LOTUS_OK | Lotus uses Base64, undo BASE64_ENC_TEXT |
| CU_BIGSTRONG | Big and strong HTML |
| CU_BIZ | Link to .biz domain web page |
| CU_BIZ_HTML | Link to .biz web page and mostly html tags |
| CU_BOGUS_POSTFIX_1 | Pretends to be sent with Postfix MTA |
| CU_BOGUS_POSTFIX_2 | Pretends to be sent with Postfix MTA |
| CU_CASINO | Casino gambling |
| CU_DATING | Dating spammer (fishing for spam bait?) |
| CU_DAV | Fake Received header that says: with DAV |
| CU_ENDS_IN_NUMS_OK | From: looks like a Columbia UNI |
| CU_FAKE_FORWARD | Faked to look like forwarded mail |
| CU_FAKE_MIMEVERSION | Faked MIME-Version header |
| CU_FORGED_MUA_IMS_OK | Maybe it really is from IMS |
| CU_GENERIC_VIAGRA | Claims there is a generic Viagra(tm) |
| CU_GIBBERISH_10 | String of 10+ pseudo words |
| CU_GIBBERISH_15 | String of 15+ pseudo words |
| CU_GIBBERISH_SI | Gibberish intro "system information" |
| CU_GSB_ENDS_IN_NUMS_OK | From: looks like a gsb address |
| CU_HELO_NAME | Says HELO with wrong name |
| CU_IMAGELINK_NO_RDNS | Click on an image, but never mind who we are |
| CU_IMAGELINK_ONLY | Click on an image on the web, and that's all |
| CU_IMAGE_ONLY_ASP_02 | Just an image and an asp link |
| CU_IMAGE_ONLY_ASP_04 | An image and an asp link, with a little text |
| CU_INVISIBLE | Invisible text in html-only mail |
| CU_INVISIBLE_BUGS | Both invisible text and web bugs |
| CU_LETTERS_100 | String of 100+ lowercase letters |
| CU_LETTERS_70 | String of 70+ lowercase letters |
| CU_LETTERS_80 | String of 80+ lowercase letters |
| CU_LETTERS_90 | String of 90+ lowercase letters |
| CU_LONGID | Obfuscated long id tag |
| CU_MEDS_CLEAR | Prescription drugs in body |
| CU_MEDS_CLEAR_HTML | Prescription drugs in body, HTML only |
| CU_MEDS_OBFUSCATED | Prescription drugs in body, obfuscated |
| CU_MEDS_SUBJ_CLR | Prescription drugs in subject |
| CU_MEDS_SUBJ_OBF | Illegal prescription drug sales |
| CU_MISMATCHED_SENDER | Suspicious mismatch of sender and host |
| CU_MORTGAGE | Mortgage |
| CU_MORTGAGE_LINKED | Mortgage or refinance with tagged link |
| CU_NAME | spammer with @name-somename.com domains |
| CU_NONMAIL_HOST | Sent to a timeshare or similar host |
| CU_NO_RDNS | Sent from a host with no rDNS |
| CU_OBFUSCATED_ORGAN | The male member, spelled funny |
| CU_OBFUSCATED_ORGAN2 | HTML obfuscation by penis spammer |
| CU_OBFUSCATING3 | HTML obfuscation (indirect URI) |
| CU_OBFUSCATING5 | HTML obfuscation (many bogus tags) |
| CU_ODD_RELAY | Faked Received headers |
| CU_ORGAN | The male member |
| CU_REDIRECT | Yahoo redirect URL |
| CU_REFINANCE | Refinance spammer |
| CU_SHAREYOUREX | Share Your Experiences spammer |
| CU_SOFTWARE_PIRATE | Arr matey, there be cheap software |
| CU_SPAMBYNAME | Many recipients without numbers |
| CU_SPECIALOFFER | A special offer only sent to me? I wish. |
| CU_SUBJ_HAS_SPACES | Subject has 12 or more spaces in a row |
| CU_SUBJ_PORN0 | Labelled as porn spam not quite as per US law |
| CU_SUBJ_PORN1 | Porn spam subject word |
| CU_SUBJ_PORN2 | Porn spam subject word |
| CU_TAGGED_LINK | Link tagged with questionmark |
| CU_TELEPHONE | Mail from a telephone |
| CU_TINY_FONT | HTML obfuscation using 0 or 1 pt lettering |
| CU_TISCALI | Comes from tiscali |
| CU_USELESS_HREF | HREF tag to nowhere |
| CU_USER_AGENT_MSE | Sent with Mail System Express |
| CU_UUENCODE_OK | Looks like uuencoded text |
| CU_WORDOFMOUTH | Word of Mouth scammer |
| CU_X_ORIG_EMAIL | Has X-Originating-Email header but not Hotmail or MSN |
| CU_YAHOO_LIST_OK | List mail may appear to be FORGED_YAHOO_RCVD |
| CU_YOU_CREDIT_CARD | Fake spam about money laundering and child porn |
| DAILY_PL | Spam URL pattern, DailyPromotions redirect |
| DAILY_PXE | Spam URL pattern, DailyPromotions server link |
| DATE_IN_FUTURE_06_12 | Date: is 6 to 12 hours after Received: date |
| DATE_IN_FUTURE_12_24 | Date: is 12 to 24 hours after Received: date |
| DATE_IN_FUTURE_24_48 | Date: is 24 to 48 hours after Received: date |
| DATE_IN_FUTURE_96_XX | Date: is 96 hours or more after Received: date |
| DATE_IN_PAST_03_06 | Date: is 3 to 6 hours before Received: date |
| DATE_IN_PAST_06_12 | Date: is 6 to 12 hours before Received: date |
| DATE_IN_PAST_12_24 | Date: is 12 to 24 hours before Received: date |
| DATE_IN_PAST_96_XX | Date: is 96 hours or more before Received: date |
| DATE_MISSING | Missing Date: header |
| DATE_SPAMWARE_Y2K | Date header uses unusual Y2K formatting |
| DATE_YEAR_ZERO_FIRST | Invalid Date: year begins with zero |
| DEAR_FRIEND | Dear Friend? That's not very dear! |
| DEAR_SOMETHING | Contains 'Dear (something)' |
| DIG_UP_INFO | Dig up Dirt on Friends |
| DISGUISE_PORN | Attempts to disguise porn words |
| DOMAIN_4U2 | Domain name containing a "4u" variant |
| DOMAIN_BODY | Domain registration spam body |
| DONT_DELETE | Don't delete me! Nooooo!!!! |
| DO_IT_TODAY | Do it Today |
| DRASTIC_REDUCED | Drastically Reduced |
| EARNINGS | Potential Earnings |
| EARN_MONEY | Message talks about earning money |
| EMAIL_ROT13 | Body contains a ROT13-encoded email address |
| EXCUSE_1 | Gives a lame excuse about why spam was sent |
| EXCUSE_10 | if you do not wish to receive any more |
| EXCUSE_11 | Claims you were on a list |
| EXCUSE_12 | Nobody's perfect |
| EXCUSE_13 | Gives an excuse for why message was sent |
| EXCUSE_14 | Tells you how to stop further spam |
| EXCUSE_15 | Claims to be legitimate email |
| EXCUSE_16 | I wonder how many emails they sent in error |
| EXCUSE_18 | Claims not to be spam |
| EXCUSE_19 | Claims you opted-in or registered |
| EXCUSE_20 | Claims you registered at their site |
| EXCUSE_21 | Claims address was obtained legitimately |
| EXCUSE_22 | You're receiving this offer for a reason |
| EXCUSE_23 | Claims you have provided permission |
| EXCUSE_24 | Claims you wanted this ad |
| EXCUSE_3 | Claims you can be removed from the list |
| EXCUSE_4 | Claims you can be removed from the list |
| EXCUSE_6 | Claims you can be removed from the list |
| EXCUSE_REMOVE | Talks about how to be removed from mailings |
| EXTRA_CASH | Offers Extra Cash |
| EXTRA_MPART_TYPE | Header has extraneous Content-type:...type= entry |
| FAKED_HOTMAIL_DAV | X-Originating-Email header does not match From |
| FAKED_IP_IN_RCVD | Received: contains a name with a faked IP-address |
| FAKED_UNDISC_RECIPS | Faked To "Undisclosed-Recipients" |
| FINANCIAL | Financial Freedom |
| FIND_ANYTHING | Find out anything |
| FORGED_AOL_HTML | AOL can't send HTML message only |
| FORGED_AOL_RCVD | Received forged, contains fake AOL relays |
| FORGED_AOL_TAGS | AOL mailers can't send HTML in this format |
| FORGED_EUDORAMAIL_RCVD | Forged eudoramail.com 'Received:' header found |
| FORGED_GW05_RCVD | Forged 'by gw05' 'Received:' header found |
| FORGED_HOTMAIL_RCVD | Forged hotmail.com 'Received:' header found |
| FORGED_HOTMAIL_RCVD2 | hotmail.com 'From' address, but no 'Received:' |
| FORGED_IMS_HTML | IMS can't send HTML message only |
| FORGED_IMS_TAGS | IMS mailers can't send HTML in this format |
| FORGED_JUNO_FROM | Has invalid account name for juno.com address |
| FORGED_JUNO_RCVD | 'From' juno.com does not match 'Received' headers |
| FORGED_MUA_AOL_FROM | Forged mail pretending to be from AOL (by From) |
| FORGED_MUA_APPLEMAIL | AppleMail can't send HTML message only |
| FORGED_MUA_IMS | Forged mail pretending to be from IMS |
| FORGED_MUA_MOZILLA | Forged mail pretending to be from Mozilla |
| FORGED_MUA_OIMO | Forged mail pretending to be from MS Outlook IMO |
| FORGED_MUA_OUTLOOK | Forged mail pretending to be from MS Outlook |
| FORGED_MUA_THEBAT | Mail pretending to be from The Bat! (mid) |
| FORGED_MUA_THEBAT_BOUN | Mail pretending to be from The Bat! (boundary) |
| FORGED_MUA_THEBAT_CS | Mail pretending to be from The Bat! (charset) |
| FORGED_MX_HOTMAIL | Forged hotmail.com Received 'from mx' header |
| FORGED_OUTLOOK_HTML | Outlook can't send HTML message only |
| FORGED_OUTLOOK_TAGS | Outlook can't send HTML in this format |
| FORGED_QUALCOMM_TAGS | QUALCOMM mailers can't send HTML in this format |
| FORGED_RCVD_FROM_NUM | Received headers forged (numeric hostname) |
| FORGED_RCVD_NET_HELO | Host HELO'd using the wrong IP network |
| FORGED_TELESP_RCVD | Contains forged hostname for a DSL IP in Brazil |
| FORGED_THEBAT_HTML | The Bat! can't send HTML message only |
| FORGED_YAHOO_RCVD | 'From' yahoo.com does not match 'Received' headers |
| FORGED_YAHOO_RCVD_SMTP | Header contains forged Yahoo! SMTP server hostname |
| FORWARD_LOOKING | Stock Disclaimer Statement |
| FOR_FREE | No such thing as a free lunch (1) |
| FREE_ACCESS | Contains 'free access' with capitals |
| FREE_CONSULTATION | Offers a consultation for nothing |
| FREE_GRANT | Free Grant Money |
| FREE_INSTALL | Contains 'free installation' with capitals |
| FREE_INVESTMENT | Free Investment |
| FREE_LEADS | Free Leads |
| FREE_MEMBERSHIP | Free Membership |
| FREE_PASSWORD | Offers Free (often stolen) Passwords |
| FREE_PORN | Possible porn - Free Porn |
| FREE_PREVIEW | Free Preview |
| FREE_QUOTE | Free Quote |
| FREE_QUOTE_INSTANT | Free express or no-obligation quote |
| FREE_SAMPLE | Contains 'free sample' with capitals |
| FREE_TRIAL | Free Trial |
| FREE_WEBSITE | Free Website |
| FRIEND_AT_PUBLIC | sent to you@you.com or similar |
| FROM_ALL_NUMS | From an address that is all numbers (non-phone) |
| FROM_AND_TO_SAME | From and To are the same, but not exactly |
| FROM_ENDS_IN_NUMS | From: ends in numbers |
| FROM_HAS_MIXED_NUMS | From: contains numbers mixed in with letters |
| FROM_HAS_MIXED_NUMS2 | From address matches known spammer format |
| FROM_HAS_MIXED_NUMS3 | From: contains numbers mixed in with letters |
| FROM_HAS_ULINE_NUMS | From: contains an underline and numbers/letters |
| FROM_ILLEGAL_CHARS | From contains too many raw illegal characters |
| FROM_NO_LOWER | 'From' has no lower-case characters |
| FROM_NO_USER | From: has no local-part before @ sign |
| FROM_NUM_AT_WEBMAIL | From address is webmail, but starts with a number |
| FROM_OFFERS | From address is "at something-offers" |
| FROM_STARTS_WITH_NUMS | From: starts with nums |
| FROM_WEBMAIL_END_NUMS6 | From webmail service and address ends in numbers |
| FRONTPAGE | Frontpage used to create the message |
| GAPPY_SUBJECT | Subject: contains G.a.p.p.y-T.e.x.t |
| GET_IT_NOW | Contains 'Get it now' with capitals |
| GET_PAID | Get Paid |
| GET_STARTED_NOW | Get Started Now |
| GTUBE | Generic Test for Unsolicited Bulk Email |
| GUARANTEE | Contains word 'guarantee' in all-caps |
| GUARANTEED_100_PERCENT | One hundred percent guaranteed |
| GUARANTEED_STUFF | Guaranteed Stuff |
| HAIR_LOSS | Cures Baldness |
| HARDCORE_PORN | Possible porn - Hardcore Porn |
| HEADER_COUNT_CTYPE | Multiple Content-Type headers found |
| HEAD_ILLEGAL_CHARS | Header contains too many raw illegal characters |
| HG_HORMONE | Talks about hormones for human growth |
| HIDDEN_ASSETS | 'Hidden' assets |
| HIDE_WIN_STATUS | Javascript to hide URLs in browser |
| HOME_EMPLOYMENT | Information on how to work at home (2) |
| HOT_NASTY | Possible porn - Hot, Nasty, Wild, Young |
| HR_3113 | Mentions Spam law "HR 3113" |
| HR_4176 | Claims compliance with House Bill 4176 |
| HTML_20_30 | Message is 20% to 30% HTML |
| HTML_30_40 | Message is 30% to 40% HTML |
| HTML_40_50 | Message is 40% to 50% HTML |
| HTML_50_60 | Message is 50% to 60% HTML |
| HTML_60_70 | Message is 60% to 70% HTML |
| HTML_70_80 | Message is 70% to 80% HTML |
| HTML_80_90 | Message is 80% to 90% HTML |
| HTML_90_100 | Message is 90% to 100% HTML |
| HTML_CHARSET_FARAWAY | A foreign language charset used in HTML markup |
| HTML_COMMENT_8BITS | HTML comment has 3 consecutive 8-bit chars |
| HTML_COMMENT_RATIO | HTML comments are large percentage of message |
| HTML_COMMENT_SAVED_URL | HTML message is a saved web page |
| HTML_COMMENT_SKY | HTML comment contains SKY database codes |
| HTML_FONTCOLOR_BLUE | HTML font color is blue |
| HTML_FONTCOLOR_GREEN | HTML font color is green |
| HTML_FONTCOLOR_RED | HTML font color is red |
| HTML_FONTCOLOR_UNKNOWN | HTML font color is unknown to us |
| HTML_FONTCOLOR_UNSAFE | HTML font color not in safe 6x6x6 palette |
| HTML_FONT_BIG | HTML has a big font |
| HTML_FONT_FACE_BAD | HTML font face is not a word |
| HTML_FONT_FACE_ODD | HTML font face is not a commonly used face |
| HTML_FONT_INVISIBLE | HTML font color is same as background |
| HTML_FORMACTION_MAILTO | HTML includes a form which sends mail |
| HTML_IMAGE_AREA_05 | HTML has 5-6 kilopixels of images |
| HTML_IMAGE_AREA_07 | HTML has 7-8 kilopixels of images |
| HTML_IMAGE_ONLY_02 | HTML: images with 0-200 bytes of words |
| HTML_IMAGE_ONLY_04 | HTML: images with 200-400 bytes of words |
| HTML_IMAGE_ONLY_06 | HTML: images with 400-600 bytes of words |
| HTML_IMAGE_ONLY_08 | HTML: images with 600-800 bytes of words |
| HTML_IMAGE_ONLY_10 | HTML: images with 800-1000 bytes of words |
| HTML_IMAGE_ONLY_12 | HTML: images with 1000-1200 bytes of words |
| HTML_IMAGE_RATIO_04 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_06 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_08 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_10 | HTML has a low ratio of text to image area |
| HTML_IMAGE_RATIO_12 | HTML has a low ratio of text to image area |
| HTML_LINK_CLICK_CAPS | HTML link text says "CLICK" |
| HTML_LINK_CLICK_HERE | HTML link text says "click here" |
| HTML_LINK_PUSH_HERE | HTML link text says "push here" or similar |
| HTML_MESSAGE | HTML included in message |
| HTML_MIME_NO_HTML_TAG | HTML-only message, but there is no HTML tag |
| HTML_RELAYING_FRAME | Frame wanted to load outside URL |
| HTML_SHOUTING7 | HTML has very strong "shouting" markup |
| HTML_SHOUTING8 | HTML has very strong "shouting" markup |
| HTML_SHOUTING9 | HTML has very strong "shouting" markup |
| HTML_TABLE_THICK_BORD | HTML table has thick border |
| HTML_TAG_BALANCE_A | HTML has excess "a" close tags |
| HTML_TAG_BALANCE_BODY | HTML has unbalanced "body" tags |
| HTML_TAG_BALANCE_HTML | HTML has unbalanced "html" tags |
| HTML_TAG_BALANCE_TABLE | HTML is missing "table" close tags |
| HTML_TAG_EXISTS_TBODY | HTML has "tbody" tag |
| HTML_TITLE_EMPTY | HTML title contains no text |
| HTML_TITLE_UNTITLED | HTML title contains "Untitled" |
| HTML_WEB_BUGS | Image tag intended to identify you |
| HTML_WIN_BLUR | Javascript to move windows around |
| HTTP_CTRL_CHARS_HOST | Uses control sequences inside a URL hostname |
| HTTP_ENTITIES_HOST | URI obscured with character entities |
| HTTP_ESCAPED_HOST | Uses %-escapes inside a URL's hostname |
| HTTP_EXCESSIVE_ESCAPES | Completely unnecessary %-escapes inside a URL |
| HTTP_WITH_EMAIL_IN_URL | 'remove' URL contains an email address |
| IDENT_NOBODY | Received lines include an 'ident:nobody' string |
| ID_UNIQUE | X-List-Unsubscribe has a numbered address |
| IMPOTENCE | Impotence cure |
| INCOME | Additional Income |
| INCREASE_SEX | Talks about a bigger drive for sex |
| INITIAL_INVEST | Requires Initial Investment |
| INVALID_DATE | Invalid Date: header (not RFC 2822) |
| INVALID_DATE_TZ_ABSURD | Invalid Date: header (timezone does not exist) |
| INVALID_MSGID | Message-Id is not valid, according to RFC 2822 |
| INVALUABLE_MARKETING | Invaluable marketing information |
| JAPANESE_UCE_SUBJECT | Subject contains a Japanese UCE tag |
| JODY | Contains "My wife, Jody" testimonial |
| JOIN_MILLIONS | Join Millions of Americans |
| KIFF | Contains "Temple Kiff" |
| KOREAN_UCE_SUBJECT | Subject: contains Korean unsolicited email tag |
| LARGE_HEX | Contains a large block of hexadecimal code |
| LESBIAN | Possible porn - Lesbian Site |
| LIMITED_TIME_ONLY | Offers a limited time offer |
| LINK_TO_NO_SCHEME | Contains link without http:// prefix |
| LIVE_PORN | Possible porn - Live Porn |
| LONG_DISTANCE | Long Distance Phone Offer |
| LOSE_POUNDS | Subject talks about losing pounds |
| LOTS_OF_CC_LINES | Lots and lots of Cc: headers |
| LOTS_OF_STUFF | Thousands or millions of pics/movies/etc |
| LOW_INTEREST | Lower Interest Rates |
| LOW_PAYMENT | Lower Monthly Payment |
| LOW_PRICE | Lowest Price |
| LUXURY_CAR | Luxury Car |
| LYING_EYES | Will not Believe your Eyes! |
| MAILTO_SUBJ_REMOVE | mailto URI includes removal text |
| MAILTO_TO_REMOVE | Includes a 'remove' email address |
| MAILTO_TO_SPAM_ADDR | Includes a link to a likely spammer email |
| MAIL_IN_ORDER_FORM | Contains mail-in order form |
| MANY_EXCLAMATIONS | Subject has many exclamations |
| MARKETING_PARTNERS | Claims you registered with a partner |
| MARKUP_RAND | RAND found, spammer tried to use a random-ID |
| MDAEMON_2_7_4 | Received via buggy SMTP server (MDaemon 2.7.4SP4R) |
| MEET_SINGLES | Meet Singles |
| MEGA_SITE | Possible porn - Mega Porn |
| MICROSOFT_EXECUTABLE | Message includes Microsoft executable program |
| MILLION_EMAIL | Get a million email addresses |
| MILLION_USD | Talks about millions of dollars |
| MIME_BASE64_ILLEGAL | base64 attachment uses illegal characters |
| MIME_BASE64_LATIN | Latin alphabet text using base64 encoding |
| MIME_BASE64_NO_NAME | base64 attachment does not have a file name |
| MIME_BASE64_TEXT | Message text disguised using base64 encoding |
| MIME_BOUND_DASH_DIGIT | Spam tool pattern in MIME boundary |
| MIME_BOUND_DD_DIGITS | Spam tool pattern in MIME boundary |
| MIME_BOUND_DIGITS_7 | Spam tool pattern in MIME boundary |
| MIME_BOUND_HEX_24 | Spam tool pattern in MIME boundary |
| MIME_BOUND_MAIL_BOUND | Spam tool pattern in MIME boundary |
| MIME_BOUND_MANY_HEX | Spam tool pattern in MIME boundary |
| MIME_BOUND_NEXTPART | Spam tool pattern in MIME boundary |
| MIME_BOUND_OPTIN | Spam tool pattern in MIME boundary |
| MIME_BOUND_RKFINDY | Spam tool pattern in MIME boundary (rfkindy) |
| MIME_CHARSET_FARAWAY | MIME character set indicates foreign language |
| MIME_HEADER_CTYPE_ONLY | 'Content-Type' found without required MIME headers |
| MIME_HTML_MOSTLY | Multipart message mostly text/html MIME |
| MIME_HTML_NO_CHARSET | Message text in HTML without charset |
| MIME_HTML_ONLY | Message only has text/html MIME parts |
| MIME_HTML_ONLY_MULTI | Multipart message only has text/html MIME parts |
| MIME_MISSING_BOUNDARY | MIME section missing boundary |
| MIME_ODD_CASE | MiME-Version header (oddly capitalized) |
| MIME_QP_DEFICIENT | Deficient quoted-printable encoding in body |
| MIME_QP_LONG_LINE | Quoted-printable line longer than 76 chars |
| MIME_QP_NO_CHARSET | Quoted-printable inline text with no charset |
| MIME_SUSPECT_NAME | MIME filename does not match content |
| MISSING_MIMEOLE | Message has X-MSMail-Priority, but no X-MimeOLE |
| MISSING_OUTLOOK_NAME | Message looks like Outlook, but isn't |
| MLM | Multi Level Marketing mentioned |
| MONEY_BACK | Money back guarantee |
| MONEY_MAKING | Discusses money making |
| MORTGAGE_BEST | Information on mortgages |
| MORTGAGE_LINKS | Message has link to mortgage URI |
| MORTGAGE_PITCH | Looks like mortgage pitch |
| MORTGAGE_RATES | Information on mortgage rates |
| MSGID_3_DOLLARS | Spam tool Message-Id: (3-dollars variant) |
| MSGID_4NUMS_DOLLAR | Spam tool Message-Id: (4-num-dollar variant) |
| MSGID_FROM_MTA_HEADER | Message-Id was added by a relay |
| MSGID_FROM_MTA_HOTMAIL | Message-Id was added by a hotmail.com relay |
| MSGID_FROM_MTA_SHORT | Message-Id was added by a relay |
| MSGID_NO_HOST | Message-Id has no hostname |
| MSGID_OUTLOOK_INVALID | Message-Id is fake (in Outlook Express format) |
| MSGID_SPAM_1 | Message-Id generated by a spam tool |
| MSGID_SPAM_6LETTER | Spam tool Message-Id: (6-letter variant) |
| MSGID_SPAM_99X9XX99 | Spam tool Message-Id: (99x9xx99 variant) |
| MSGID_SPAM_CAPS | Spam tool Message-Id: (caps variant) |
| MSGID_SPAM_ZEROES | Spam tool Message-Id: (12-zeroes variant) |
| MSGID_THREESIXSIX | Message-Id header indicates message is spam |
| MULTI_FORGED | Received headers indicate multiple forgeries |
| MUST_BE_18 | Possible porn - Must be 18 |
| NASTY_GIRLS | Possible porn - Nasty Girls |
| NATURAL_VIAGRA | Plugs "Natural Viagra" |
| NEVER_ANOTHER | another mailing will "never" be "received" |
| NEW_DOMAIN_EXTENSIONS | Possible registry spammer |
| NIGERIAN_BODY1 | Message body looks like a Nigerian spam message 1+ |
| NIGERIAN_BODY2 | Message body looks like a Nigerian spam message 2+ |
| NIGERIAN_BODY3 | Message body looks like a Nigerian spam message 3+ |
| NIGERIAN_BODY4 | Message body looks like a Nigerian spam message 4+ |
| NIGERIAN_BODY_GOVT_3 | Message body has many indications of Nigerian scam |
| NIGERIAN_SCAM_VIRTUE | Possible Nigerian Scam Text |
| NIGERIAN_SUBJECT1 | Subject is indicative of a Nigerian spam |
| NIGERIAN_SUBJECT2 | Subject is indicative of a Nigerian spam |
| NONEXISTENT_CHARSET | Character set doesn't exist |
| NORMAL_HTTP_TO_IP | Uses a dotted-decimal IP address in URL |
| NOT_ADVISOR | Not registered investment advisor |
| NOT_INTENDED | Not intended for residents of somewhere |
| NOT_MLM | Apparently, NOT Multi Level Marketing |
| NO_CATCH | There is no catch |
| NO_COST | No such thing as a free lunch (3) |
| NO_CREDIT_CHECK | No Credit Check |
| NO_DISAPPOINTMENT | You won't be "disappointed" |
| NO_EXPERIENCE | No experience needed! |
| NO_INVENTORY | No Inventory |
| NO_INVESTMENT | No Investment |
| NO_OBLIGATION | There is no obligation |
| NO_QS_ASKED | Doesn't ask any questions |
| NO_RDNS_DOTCOM_HELO | Host HELO'd as a big ISP, but had no rDNS |
| NO_REAL_NAME | From: does not include a real name |
| NO_STRINGS | No Strings Attached |
| NUMERIC_HTTP_ADDR | Uses a numeric IP address in URL |
| OBFUSCATING_COMMENT | HTML comments which obfuscate text |
| OBSCURED_EMAIL | Message seems to contain rot13ed address |
| OFFERS_ETC | Stop the offers, coupons, discounts etc! |
| OFFSHORE_SCAM | Off Shore Scams |
| ONE_TIME | One Time Rip Off |
| ONE_TIME_MAILING | one time mailing doesn't mean it isn't spam |
| ONLINE_PHARMACY | Online Pharmacy |
| OPPORTUNITY | Gives information about an opportunity |
| OPT_HEADER | Headers include an "opt"ed phrase |
| OPT_IN | Talks about opting in (lowercase version) |
| OPT_IN_CAPS | Talks about opting in (capitalized version) |
| ORDER_NOW | Encourages you to waste no time in ordering |
| ORDER_REPORT | Order a report from someone |
| OUR_AFFILIATE_PARTNERS | Mentions their affiliate partners |
| OUR_PRIVACY_POLICY | Mentions where their privacy policy is |
| OUR_STRICT_ANTI | Mentions their strict antipathy on something |
| OVERWHELMING_GROWTH | Mentions their overwhelming growth |
| PAY_SITE | Possible porn - Pay Site |
| PENIS_ENLARGE | Information on getting larger penis/breasts |
| PENIS_ENLARGE2 | Information on getting larger penis/breasts |
| PLING_PLING | Subject has lots of exclamation marks |
| PLING_QUERY | Subject has exclamation mark and question mark |
| PORN_15 | Possible porn - various types of feline |
| PORN_16 | Possible porn - nasty, dirty, little etc. |
| PORN_4 | URL uses words/phrases which indicate porn |
| PORN_6 | Possible Porn - XXX Photos |
| PORN_MEMBERSHIP | Possible Porn - Porn membership |
| PREST_NON_ACCREDITED | 'Prestigious Non-Accredited Universities' |
| PRINT_FORM_SIGNATURE | Asks you for your signature on a form |
| PRIORITY_NO_NAME | Message has priority setting, but no X-Mailer |
| PRIZE | Talks about prizes |
| RATWARE_BAD_REFS | References header has bad format |
| RATWARE_EGROUPS | Bulk email fingerprint (eGroups) found |
| RATWARE_EMPTY_HELO | Received headers forged (empty HELO) |
| RATWARE_EMWAC | Bulk email fingerprint ("EMWAC SMTPRS") found |
| RATWARE_EVAMAIL | Bulk email fingerprint (EVAMAIL) found |
| RATWARE_EXISCAN_FORGED | Headers indicate forged Exiscan message |
| RATWARE_HASH_2_V2 | Bulk email fingerprint (hash 2 v2) found |
| RATWARE_HASH_DASH | Contains a hashbuster in Send-Safe format |
| RATWARE_JIXING | Bulk email fingerprint (JiXing) found |
| RATWARE_JPFREE | Bulk email fingerprint (jpfree) found |
| RATWARE_MMAILER | Bulk email fingerprint (MMailer) found in headers |
| RATWARE_OE_MALFORMED | X-Mailer has malformed Outlook Express version |
| RATWARE_OE_PI | X-Mailer contains "OutLook Express 3.14159" |
| RATWARE_POWERC | Bulk email fingerprint (PowerCampaign) found |
| RATWARE_RCVD_AT | Bulk email fingerprint (Received @) found |
| RATWARE_RCVD_LC_ESMTP | Bulk email fingerprint ('esmtp' Received) found |
| RATWARE_SCREWUP_1 | Bulk email fingerprint (screwup 1) found |
| RATWARE_STORM | Bulk email fingerprint (StormPost) found |
| RATWARE_STORM_URI | Bulk email fingerprint (StormPost) found |
| RATWARE_VC_IPA | Bulk email fingerprint (VC_IPA) found |
| RATWARE_XMAILER | Bulk email fingerprint (xmailer tag) found |
| RATWARE_X_SCANNER | Has X-Scanner header |
| RCVD_6_CAPS_ESMTP_ID | Spam tool Received: (6-caps ESMTP ID variant) |
| RCVD_AM_PM | Received headers forged (AM/PM) |
| RCVD_BY_QVES_COM | Sent by a known spamhaus (qves) |
| RCVD_DOUBLE_IP_SPAM | Bulk email fingerprint (double IP) found |
| RCVD_FAKE_HELO_DOTCOM | Received contains a faked HELO hostname |
| RCVD_NUMERIC_HELO | Received: contains a numeric HELO |
| READ_TO_END | You'd better read all of this spam! |
| RECEIVED_CACHEFLOW | Received contains 'CacheFlowServer' IDENT name |
| RECEIVED_IDENT_SQUID | Message was sent by a Squid HTTP proxy |
| RECEIVE_EMAIL | Receive third party email |
| RECEIVE_OFFER | Receive a special offer |
| REFINANCE_NOW | Home refinancing |
| REMOVAL_INSTRUCTIONS | Gives instructions for removal from list |
| REMOVE_FROM_LIST | To be removed from list |
| REMOVE_IN_QUOTES | List removal information |
| REMOVE_PAGE | URL of page called "remove" |
| REMOVE_POSTAL | Send real mail to be unsubscribed |
| REMOVE_REMOVAL_1WORD | List removal information |
| REMOVE_REMOVAL_2WORD | List removal information |
| REMOVE_REMOVAL_NEAR | List removal information |
| REMOVE_SUBJ | List removal information |
| REPLY_REMOVE_SUBJECT | List removal information |
| REPLY_TO_EMPTY | Reply-To: is empty |
| REPLY_TO_ULINE_NUMS | Reply-To: has an underline and numbers/letters |
| RESISTANCE_IS_FUTILE | Resistance to this spam is futile |
| REVERSE_AGING | Reverses Aging |
| RICH | If only it were that easy |
| RISK_FREE | Risk free. Suuurreeee.... |
| SAVE_ON_INSURANCE | Trying to sell insurance online |
| SAVE_THOUSANDS | Save big money |
| SAVE_UP_TO | Save Up To |
| SECRET_RECORD | Secretly Recorded |
| SEDUCTION | Score with babes! |
| SELECTED_YOU | They have selected you for something |
| SENT_IN_COMPLIANCE | Claims compliance with spam regulations |
| SERIOUS_CASH | Serious cash |
| SEX_FEST | Possible porn - Porn Fest |
| SORTED_RECIPS | Recipient list is sorted by address |
| START_NOW_CAPS | Talks about 'starting now' with capitals |
| STOCK_ALERT | Offers a alert about a stock |
| STOP_SNORING | Contains "Stop Snoring" |
| STRONG_BUY | Tells you about a strong buy |
| SUBJECT_APPROVED | Subject talks about being approved |
| SUBJECT_DRUG_GAP_S | Subject contains a gappy version of 'soma' |
| SUBJECT_DRUG_GAP_VA | Subject contains a gappy version of 'valium' |
| SUBJECT_DRUG_GAP_X | Subject contains a gappy version of 'xanax' |
| SUBJ_2_CREDIT | Contains 'subject to credit approval' |
| SUBJ_ALL_CAPS | Subject is all capitals |
| SUBJ_AS_SEEN | Subject contains "As Seen" |
| SUBJ_BUY | 'Subject' starts with Buy, Buying |
| SUBJ_DOLLARS | Subject starts with dollar amount |
| SUBJ_FOR_ONLY | Subject contains "For Only" |
| SUBJ_FREE_CAP | Subject contains "FREE" in CAPS |
| SUBJ_FREE_INSTANT | Subject contains "Free Instant" |
| SUBJ_GUARANTEED | Subject GUARANTEED |
| SUBJ_HAS_SPACES | Subject contains lots of white space |
| SUBJ_HAS_UNIQ_ID | Subject contains a unique ID |
| SUBJ_ILLEGAL_CHARS | Subject contains too many raw illegal characters |
| SUBJ_NOW_ONLY | Subject contains "Now Only" |
| SUBJ_VIAGRA | Subject includes "viagra" |
| SUBJ_YOUR_DEBT | Subject contains "Your Bills" or similar |
| SUBJ_YOUR_FAMILY | Subject contains "Your Family" |
| SUBJ_YOUR_OWN | Subject contains "Your Own" |
| SUB_FREE_OFFER | Subject starts with "Free" |
| SUB_HELLO | Subject starts with "Hello" |
| SUPPLIES_LIMITED | Supplies are Limited |
| TAKE_ACTION_NOW | Tells you to 'take action now!' |
| TARGETED | Targeted Traffic / Email Addresses |
| THE_BEST_RATE | The best Rates |
| THE_FOLLOWING_FORM | Asks you to fill out a form |
| THIS_AINT_SPAM | Claims "This is not spam" |
| THIS_IS_AN_AD | Says "this is an advertisement" (thanks!) |
| TONER | Contains "Toner Cartridge" |
| TO_ADDRESS_EQ_REAL | To: repeats address as real name |
| TO_EMPTY | To: is empty |
| TO_HAS_SPACES | To: address contains spaces |
| TO_MALFORMED | To: has a malformed address |
| TO_NO_USER | To: has no local-part before @ sign |
| TO_TXT | Sent to a text file |
| TRACKER_ID | Incorporates a tracking ID number |
| UCE_MAIL_ACT | Mentions Spam Law "UCE-Mail Act" |
| UNCLAIMED_MONEY | People just leave money laying around |
| UNSECURED_CREDIT | Unsecured Credit/Debt |
| UNSUB_SCRIPT | URL of CGI script has unsubscribe or remove |
| UNWANTED_LANGUAGE_BODY | Message written in an undesired language |
| UPPERCASE_25_50 | message body is 25-50% uppercase |
| UPPERCASE_50_75 | message body is 50-75% uppercase |
| URI_4YOU | Message has URI 4you |
| URI_BANNEDCD | Message has URI for bannedcd |
| URI_DOLLARMACHINE | Message has URI for dollarmachine |
| URI_FREEHT | Message has URI for freeht |
| URI_OFFERS | Message has link to company offers |
| URI_PXLG | Frequent Spam Content |
| USERNAME_IN_SUBJECT | To: username at front of subject |
| USERPASS | URL contains username and (optional) password |
| USER_4U2 | Local part containing a "4u" variant |
| USER_IN_ALL_SPAM_TO | User is listed in 'all_spam_to' |
| USER_IN_BLACKLIST | From: address is in the user's black-list |
| USER_IN_BLACKLIST_TO | User is listed in 'blacklist_to' |
| USER_IN_DEF_WHITELIST | From: address is in the default white-list |
| USER_IN_MORE_SPAM_TO | User is listed in 'more_spam_to' |
| USER_IN_WHITELIST | From: address is in the user's white-list |
| USER_IN_WHITELIST_TO | User is listed in 'whitelist_to' |
| USE_IDENTITY | Someone using your identity |
| US_DOLLARS_3 | Mentions millions of $ ($NN,NNN,NNN.NN) |
| VACATION_SCAM | Vacation Offers |
| VERB_UP_TO_OR_MORES | Has add/lose/make/save up to X or more |
| VERY_SUSP_RECIPS | Very similar addresses in recipient list |
| VIAGRA | Plugs Viagra |
| VIAGRA_COMBO | Viagra and other drugs |
| VIAGRA_ONLINE | Fast Viagra Delivery |
| WALAA | Illiterate spammer cannot spell 'voila' |
| WANTS_CREDIT_CARD | Asks for credit card details |
| WEIRD_PORT | Uses non-standard port number for HTTP |
| WEIRD_QUOTING | Weird repeated double-quotation marks |
| WE_HATE_SPAM | We strongly oppose the use of spam email too |
| WE_HONOR_ALL | Claims to honor removal requests |
| WE_PROMISE_YOU | Promise you ...! |
| WHILE_SUPPLIES | While Supplies Last |
| WHILE_YOU_SLEEP | While you Sleep |
| WHY_WAIT | What are you waiting for |
| WITH_LC_SMTP | Received line contains spam-sign (lowercase smtp) |
| WORK_AT_HOME | Information on how to work at home (1) |
| WRINKLES | Removes Wrinkles |
| X_ENC_PRESENT | Message has X-Encoding header |
| X_ESMTP | Message has x-esmtp header |
| X_LIBRARY | Message has X-Library header |
| X_LIST_UNSUBSCRIBE | Message has X-List-Unsubscribe header |
| X_MESSAGE_INFO | Bulk email fingerprint (X-Message-Info) found |
| X_MSMAIL_PRIORITY_HIGH | Sent with 'X-Msmail-Priority' set to high |
| X_ORIG_HOST | Message has X-Originating-Host header |
| X_PMFLAGS_PRESENT | Message has X-PMFLAGS header |
| X_PRECEDENCE_REF | Message has X-Precedence-Ref header |
| X_PRIORITY_HIGH | Sent with 'X-Priority' set to high |
| X_PRI_MISMATCH_HI | 'X-Priority' does not match 'X-MSMail-Priority' |
| X_STORMPOST_TO | Message has X-Stormpost-To header |
| X_VMP_TEXT | Message has X-VMP-Text header |
| X_X_PRESENT | Message has X-x header |
| YAHOO_REDIR | Has Yahoo Redirect URI |
| YOUR_INCOME | Doing something with my income |
| YOU_CAN_SEARCH | You can search for anyone |
| __MIME_BASE64 | Includes a base64 attachment |
| __MIME_QP | Includes a quoted-printable attachment |