Tag	Part	Score	Description	Test
ACCEPT_CREDIT_CARDS	BODY	0.900	Accept Credit Cards	/\baccept.{1,15}credit cards?\b/i
ACCOUNT_CLICK	BODY	0.137	Click to perform an action on an account	/\baccount.{1,50}click/i
ACT_NOW	BODY	0.307	Act Now! Don't Hesitate!	/\b(?:act.{0,4} now|do.{0,5} hesitate|start now)\b/i
ADDRESSES_ON_CD	BODY	1.306	Only thing addresses on CD are useful for is spam	/addresses on cd/i
ADULT_SITE	BODY	1.490	Possible porn - Adult Web Sites	/\badult.{0,9}(?:entertainment|sites?|industry|only|business|membership)/i
ADVERT_CODE	Subject	4.000	Subject: starts with advertising tag	/^\W*ADV\b/i
ADVERT_CODE2	Subject	4.000	Subject: contains advertising tag	/\bA\s*D\s*V\b/i
ALL_CAP_PORN	BODY	2.000	Possible porn - in ALL CAPS	/\b(?:ORGY|FUCKING|FETISH|WEBCAM|VOYEUR|ANAL|CUM|SNATCH|COCK|CUNT|PORN)\b/
ALL_NATURAL	BODY	0.503	Spam is 100% natural?!	/\b(?:100%|completely|totally|all) natural/i
AMATEUR_PORN	BODY	2.642	Possible porn - Amateur Porn	/\bamateur .{0,9}(?:sex|porn|star|sites?|college|babes|action|pics|trash|gang|rape)|(?:real|best) amateur/i
AMAZING	BODY	0.364	Contains word 'amazing' in all-caps	/\bAMAZING\b/
AMAZING_STUFF	BODY	2.261	Amazing Stuff	/\bamazing (?:product|rates)/i
ANOTHER_NET_AD	BODY	2.210	Tells you it's an ad	/Another Internet Ad campaign produced/
AOL_USERS_LINK	BODY	0.539	Includes a link for AOL users to click	/AOL\s+Users\s+Click/is
APPLY_ONLINE	BODY	0.531	Apply online (with capital O)	/\bapply (?-i:O)nline/i
APPROVED_BY	Approved-By	-0.864	Has an Approved-By moderated list header	/./
ASCII_FORM_ENTRY	RAWBODY	0.105	Contains an ASCII-formatted form	/[^<][A-Za-z][A-Za-z]+.{1,15}?[\x09\x20]*_{30,}/
ASKS_BILLING_ADDRESS	BODY	0.434	Asks for a billing address	/\bbilling address\b/i
AS_SEEN_ON	BODY	1.373	As seen on national TV!	/seen on\b\s*(?:TV|ABC|NBC|CBS|CNN|Oprah|USA Today|48 Hours|New York Times|\w+\s+TV|:)/i
AUTO_EMAIL_REMOVAL	BODY	2.361	Claims auto-email removal	/Auto Email Removal/
BAD_CREDIT	BODY	0.416	Eliminate Bad Credit	/\b(?:bad|poor|no|eliminate|repair|(?:re)?establish|damag).{0,10} (?:credit|debt)\b/i
BANKRUPTCY	BODY	0.541	Avoid Bankruptcy	/\b(?:avoid|past) bankruptcy\b/i
BARELY_LEGAL	BODY	1.466	Possible porn - Barely Legal	/\b(?:barely|just) legal\b/i
BASE64_ENC_TEXT	EOB	1.370	Message text disguised using base-64 encoding	check_for_mime_base64_encoded_text()
BEEN_TURNED_DOWN	BODY	0.605	Have you been turned down?	/\bbeen turned down\b/i
BEST_PORN	BODY	1.000	Possible porn - Best, Largest Porn Collections	/\b(?:best|biggest|largest|most|free|ultimate)\b.{0,9}\b(?:virgins?|anal\b|lesbians?|incest|porno?|h[a\@]rdcore|sluts?|xxx+)/i
BE_AMAZED	BODY	1.077	Apparently, you'll be amazed	/\bbe amazed\b/i
BE_BOSS	BODY	0.573	Be your own boss	/\byour own boss\b/i
BIG_BUCKS	BODY	0.003	Big Bucks	/\bbig bucks\b/i
BIG_FONT	EOB	0.500	FONT Size +2 and up or 3 and up	html_test('big_font')
BILLION_DOLLARS	BODY	0.402	Talks about lots of money	/[BM]ILLION DOLLAR/
BILL_1618	BODY	3.472	Claims compliance with Senate Bill 1618	/Bill.{0,10}1618.{0,10}TITLE.{0,10}(III|\#3)/i
BUGGY_CGI	BODY	2.786	Broken CGI script message	/Below is the result of your feedback form/
BUGZILLA_BUG	EOH	-2.699	Looks like a Bugzilla bug	message_from_bugzilla()
BULK_EMAIL	BODY	1.686	Talks about bulk email	/bulk e-*mail/i
BUY_DIRECT	BODY	0.406	Buy Direct	/\bbuy direct\b/i
BUY_JUDGEMENTS	BODY	1.000	Buying judgements	/\b(?:purchase|collect|divorce)\b.{0,30}\bjudgements\b/i
CABLE_CONVERTER	BODY	2.748	Cable Converter	/\bcable (?:converter|descrambler)/i
CALL_FREE	BODY	0.202	Contains a tollfree number	/\b(?:call|dial|toll free|order).{1,15}8(?:00|88|77|66|55|44|33|22)[\)\s-]*[\dA-Z]+[\s-]?[\dA-Z]+/i
CALL_NOW	BODY	2.783	Urges you to call now	/\bCALL NOW/i
CANCEL	BODY	0.146	Cancel at any time!	/\bcancel at any time\b/i
CANT_LIVE_WITHOUT	BODY	0.318	Can't live without?	/\bcan.{0,4} live without\b/i
CASHCASHCASH	EOM	1.810	Contains at least 3 dollar signs in a row	(!__ISO_2022_JP_DELIM && __THREE_DOLLARS)
CASH_BONUS	BODY	2.203	Cash Bonus	/\bcash bonus\b/i
CBYI	BODY	2.541	Contains 'CBYI'	/CBYI/
CELEBRITY_PORN	BODY	2.737	Possible porn - Celebrity Porn	/\bceleb(?:rity|rities|s).{0,15}(?:sex|porn|pics|caught|nude|exposed|content)|\b(?:steamy|hot|nude|shocking|free|h[a\@]rdcore) celeb(?:rity|rities|s)/i
CENTS_ON_DOLLAR	BODY	1.539	Cents on the Dollar	/\bcents on the dollar\b/i
CHANGE_TERMS	BODY	1.000	Terms and conditions	/\bstrictly based on the following terms and conditions\b/i
CHARSET_FARAWAY	EOB	3.200	Character set indicates a foreign language	check_for_faraway_charset()
CHARSET_FARAWAY_BODY	RAWEOB	2.450	Character set indicates foreign language body	check_for_faraway_charset_in_body()
CHARSET_FARAWAY_HEADERS	EOH	2.060	A foreign language charset used in headers	check_for_faraway_charset_in_headers()
CHECK_OR_MONEY_ORDER	BODY	1.739	Talk about a check or money order	/check or money order/i
CHILD_SUPPORT	BODY	2.331	'Collect Child Support' Scam	/\buncollected child support\b/i
CLICK_BELOW	BODY	0.307	Asks you to click below	/click .{0,30}(?:here|below)/is
CLICK_BELOW_CAPS	BODY	0.405	Asks you to click below (in caps)	/CLICK .{0,30}(?:HERE|BELOW)/s
CLICK_HERE_CAPS_LINK	RAWBODY	0.612	Tells you to click on a URL (in caps)	/CLICK HERE.{0,100}<\/[aA]>/s
CLICK_HERE_LINK	RAWBODY	0.312	Tells you to click on a URL	/click here.{0,100}<\/a>/is
CLICK_TO_REMOVE_2	BODY	0.728	Click-to-remove with mailto: found beforehand	/mailto:.{0,50}click.{0,50}remove/is
CLICK_TO_REMOVE_3	BODY	0.300	Click-to-remove with PHP/ASP action found	/http:.{0,50}action=remove/is
COMMENT	Comment	0.778	Found a Comment header	/./
COMMUNIGATE	BODY	1.772	Sent using a trial version of CommuniGate	/transferred with a trial version of CommuniGate/
COMPARE_RATES	BODY	2.826	Compare Rates	/\bcompare .{0,9}rates?\b/i
COMPETE	BODY	2.566	Compete for your business	/\bcompete for your business\b/i
COMPLAIN_TO	Complain-To	2.991	Found a Complain-To header	/./
COMPLETELY_FREE	BODY	0.401	No such thing as a free lunch (2)	/\b(?:100%|completely|totally|absolutely) (?-i:F)ree/i
CONFIDENTIAL_ORDER	BODY	1.000	Confidentially on all orders	/confidential.{0,9} order/i
CONGRATULATIONS	BODY	0.218	Congratulations - you've been scammed?	/\bcongratulations! you/i
CONSOLIDATE_DEBT	BODY	0.838	Consolidate Debt and Credit	/\b(?:consolidate .{0,9} (?:debt|credit)|debt (?:consolidation|elimination))\b/i
COPY_ACCURATELY	BODY	2.658	Common pyramid scheme phrase (1)	/copy.{1,10}name.{1,10}address.{1,10}ACCURATELY\b/i
COUPON	BODY	0.031	Offers Coupon	/\boff coupon/i
CREDITORS_CALLING	BODY	0.677	Calling Creditors	/\bcreditors calling\b/i
CREDIT_BUREAU	BODY	2.030	Credit Bureaus	/\ball .{0,9}credit bureaus?\b/i
CREDIT_CARD	BODY	1.889	Credit Card Offers	/\bcredit card.{1,10}(?:offer|debt|decision)/i
CRON_ENV	X-Cron-Env	-1.334	Found a X-Cron-Env header	/./
CTYPE_JUST_HTML	EOH	0.407	HTML-only mail, with no text version	(!__RCVD_BY_HOTMAIL && __CTYPE_IS_HTML)
CUM_SHOT	BODY	2.276	Possible porn - Cum Shot	/\bcum[ -]?shots?\b/i
CYBER_FIRE_POWER	BODY	1.000	mentions Cyber FirePower!, a spam-tool	/\b(?:by|for) Cyber FirePower\!/
DATE_IN_FUTURE_03_06	EOH	1.368	Date: is 3 to 6 hours after Received: date	check_for_shifted_date('3', '6')
DATE_IN_FUTURE_06_12	EOH	1.099	Date: is 6 to 12 hours after Received: date	check_for_shifted_date('6', '12')
DATE_IN_FUTURE_12_24	EOH	0.521	Date: is 12 to 24 hours after Received: date	check_for_shifted_date('12', '24')
DATE_IN_FUTURE_24_48	EOH	2.425	Date: is 24 to 48 hours after Received: date	check_for_shifted_date('24', '48')
DATE_IN_FUTURE_48_96	EOH	1.754	Date: is 48 to 96 hours after Received: date	check_for_shifted_date('48', '96')
DATE_IN_FUTURE_96_XX	EOH	0.466	Date: is 96 hours or more after Received: date	check_for_shifted_date('96', 'undef')
DATE_IN_PAST_03_06	EOH	0.279	Date: is 3 to 6 hours before Received: date	check_for_shifted_date('-6', '-3')
DATE_IN_PAST_06_12	EOH	0.448	Date: is 6 to 12 hours before Received: date	check_for_shifted_date('-12', '-6')
DATE_IN_PAST_12_24	EOH	0.207	Date: is 12 to 24 hours before Received: date	check_for_shifted_date('-24', '-12')
DATE_IN_PAST_24_48	EOH	1.042	Date: is 24 to 48 hours before Received: date	check_for_shifted_date('-48', '-24')
DATE_IN_PAST_48_96	EOH	1.404	Date: is 48 to 96 hours before Received: date	check_for_shifted_date('-96', '-48')
DATE_IN_PAST_96_XX	EOH	1.546	Date: is 96 hours or more before Received: date	check_for_shifted_date('undef', '-96')
DATE_MISSING	EOH	0.849	Missing Date: header	check_for_missing_header('Date')
DATE_WARNING	Date-warning	1.503	Found a Date-warning header	/./
DATE_YEAR_ZERO_FIRST	Date	2.968	Invalid Date: year begins with zero	/[nbrylgptvc]\s+0\d\d\d(?:\s|$)/
DEAR_EMAIL	BODY	0.107	Dear you@you.com?	/\bDear [A-Za-z0-9_-]+\@/
DEAR_FRIEND	BODY	0.400	How dear can you be if you don't know my name?	/^\s*Dear Friend\b/i
DEAR_SOMEBODY	BODY	0.101	Contains 'Dear Somebody'	/Dear [A-Z][a-z]+/
DEAR_SOMETHING	BODY	1.824	Contains 'Dear (something)'	/\bDear (?:IT\W|Internet|candidate|sirs?|madam|investor|travell?er|car shopper|web)\b/i
DEBIAN_BTS_BUG	EOH	-2.473	Looks like a Debian BTS bug	message_from_debian_bts()
DIET	BODY	0.415	Lose Weight Spam	/\b(?:(?:without|no) (?:exercis|diet)ing|weight loss|(?:extra|lose|lost|losing).{0,9} (?:pounds|weight|inches)|burn.{1,10}fat)\b/i
DIG_UP_INFO	BODY	3.123	Dig up Dirt on Friends	/\bdig up information\b/i
DIRECT_EMAIL	BODY	1.039	Talks about direct email	/direct e-*mail\b/i
DISCLAIMER	BODY	0.489	Message contains disclaimer	/\bdisclaimer\b/i
DISCLAIMER_LEGALESE	BODY	-0.695	Contains what looks like an 'E-Mail Disclaimer'	/This e?-?mail.{1,20}confidential.{1,20}legally privileged/i
DISCONTINUE	BODY	1.000	List removal information	/\"discontinue\".{1,15}no further notices/i
DISGUISE_PORN	BODY	2.283	Attempts to disguise porn words	/\b(?:c[*0]ck[sz]?|d[1*]ck[sz]?|h[0*]rny|b[1*]tch(?:e[sz])?|f[*0]ckk?ed|p[*]ssy|p[*]ssie[sz]|b[0*]ndage|t00ns)\b/i
DOMAIN_4U2	BODY	0.422	Domain name containing a '4u' variant	/[\@\.]\S{0,20}(?:[^0-9][42](?:yo)?u|for-*you)(?:[.-]\S{1,20})?\.(?:net|com|org|info)\b/
DOMAIN_BODY	BODY	0.313	Domain registration spam body	/\s(?:\.|dot\s+)(?:info|biz|name)\s/i
DOMAIN_SUBJECT	Subject	0.312	Subject: domain registration spam subject	/(?:\s(?:\.|dot\s+)(?:info|biz|name)|domain)\b.*\b(?:extension|info|regist(?:ry|ration|er)|submission)/i
DONT_DELETE	BODY	0.874	Don't delete me! Nooooo!!!!	/\b(?:don'?t delete this|do not delete)/i
DO_IT_TODAY	BODY	0.511	Do it Today	/\b(?:join|register|order|apply) .{0,10}(?-i:T)oday\b/i
DRASTIC_REDUCED	BODY	1.910	Drastically Reduced	/\bdrastic.{0,4} reduc/i
EARNINGS	BODY	1.842	Potential Earnings	/\b(?:potential (?:earnings|income)|income potential)\b/i
EARN_PER_WEEK	BODY	1.625	Contains 'earn $something per week'	/\b(?:earn|make).{1,20}\d\d\d+.{1,30}(?:per week|per month|weekly|monthly)/i
EASY_TERMS	BODY	0.670	Easy Terms	/\beasy terms\b/i
EGP_HTML_BANNER	RAWBODY	-3.052	non-spam Yahoo! Groups banner found	/^<!-- \S+begin egp html banner/
EJACULATION	BODY	1.092	Increase your ejaculation!	/\b(?:increase|improve|greater).{0,10}ejaculation/i
EMAIL_ATTRIBUTION	RAWBODY	-1.628	Contains what looks like an email attribution	/^"?\w.{4,} (?:wrote|writes):$/
EMAIL_MARKETING	BODY	0.315	Talks about email marketing	/e-*mail marketing/i
EU_200_32_CE	BODY	1.000	Claims compliance with spam regulations	/Directive 200.32.CE/i
EU_EMAIL_OPTOUT	BODY	1.000	Claims compliance with spam regulations	/EU (?:e-?mail opt.?out|e.?commerce) directive/i
EVITE	EOM	-10.000	Message looks like an Evite	((__EVITE_RCVD && __EVITE_URI) || (__EVITE_CTYPE && (__EVITE_RCVD || __EVITE_URI)))
EXCHANGE_SERVER	X-Mailer	-0.133	Came via Internet Mail Service plugin	/Internet Mail Service \([\d\.]+\)/
EXCUSE_1	BODY	0.134	Gives an excuse about why you were sent this spam	/\b(?:You (?:were sent|have received|are receiving)|You're receiving).{0,15}(?:message|e-?mail)s? because/i
EXCUSE_10	BODY	0.321	'if you do not wish to receive any more'	/if you (?:(?:want|wish|care|prefer) not to |do ?n[o']t (?:want|wish|care) to )(?:be contacted again|receive (?:any ?)?(?:more|future|further)\b.{1,10}\b(?:e?-?mail|message|offer|solicitation)s?)/i
EXCUSE_11	BODY	1.000	Claims you were on a list	/you.{0,15}(?:name|mail).{0,15}(?:was|were).{0,15}list/i
EXCUSE_12	BODY	0.407	Nobody's perfect	/this (?:e?-?mail|message) (?:(?:has )?reached|was sent to) you in error/i
EXCUSE_13	BODY	0.542	Gives an excuse for why message was sent	/mail was sent to you because /i
EXCUSE_14	BODY	0.242	Tells you how to stop further spam	/you (?:do not|no longer) wish to receive/i
EXCUSE_15	BODY	0.646	Claims to be legitimate email	/this\s*(?:e?-?mail|message)? (?:is|was) (?:not|never) (?:spam|(?:sent )?unsolicited)/i
EXCUSE_16	BODY	0.104	I wonder how many emails they sent in error...	/received this.{1,10}in error/i
EXCUSE_17	BODY	0.000	Suspect you might have received the message by mistake	/received.{0,15} by mistake/i
EXCUSE_18	BODY	1.000	Claims not to be spam	/we do not (?:spam|send unsolicited)/i
EXCUSE_2	BODY	2.851	Claims you actually asked for this spam	/If you did not opt.in/i
EXCUSE_3	BODY	0.410	Claims you can be removed from the list	/to (?:be removed|be deleted|no longer receive th(?:is|ese) messages?) (?:from|send|reply|[e-]*mail)/i
EXCUSE_4	BODY	3.350	Claims you can be removed from the list	/To Be Removed,? Please/i
EXCUSE_5	BODY	2.445	Claims you can be removed from the list	/that your email address is removed/i
EXCUSE_6	BODY	0.795	Claims you can be removed from the list	/\b(?:wish to|click to) remove yourself/i
EXCUSE_7	BODY	0.404	Claims you can be removed from the list	/you (?:wish|want|would like|desire) to be removed/i
EXCUSE_8	BODY	2.695	Claims you can be removed from the list	/requests to be taken off our mailing list/i
EXCUSE_FUTURE	BODY	0.982	Talks about future mailings	/be removed from future mailings/i
EXPECT_TO_EARN	BODY	0.008	Expect to earn	/\bexpect to earn|earn up to\b/i
EXTRA_CASH	BODY	0.417	Offers Extra Cash	/\bextra cash\b/i
EXTRA_MPART_TYPE	Content-Type	0.402	Message with extraneous Content-type:...type= header	/(?:\s*multipart\/)?.*\stype=/i
FAILURE_NOTICE_1	Subject	-0.118	Mailer daemon failure notice (1)	/^(?:failure notice|returned mail:|Delivery Status Notification|Undeliverable:)/i
FAILURE_NOTICE_2	BODY	-0.986	Mailer daemon failure notice (2)	/\b(?:Delivery to the following recipients failed|This Message was undeliverable|The following addresses had permanent fatal errors|did not reach the following recipient)\b/i
FAKED_IP_IN_RCVD	Received	3.251	Received: contains a name with a faked IP-address	/from [-0-9a-z\._]+_\[\d+\.\d+\.\d+\.\d+\] /i
FAKED_UNDISC_RECIPS	To	1.319	Faked To 'Undisclosed-Recipients'	/undisclosed[_ ]*recipient(?:s[^:]|[^s])/i
FANTASTIC	BODY	0.204	Fantastic Deal	/\bfantastic {0,9}(?:price|deal|saving)/i
FILTERED_BY_WORLDREMOVE	BODY	1.000	Claims to listen to some removal request list	/filtered by WorldRemove/
FINANCIAL	BODY	0.820	Financial Freedom	/\bfinancial(?:ly)? free/i
FIND_ANYTHING	BODY	1.880	Find out Anything	/\bfind out anything\b/i
FORGED_AOL_RCVD	EOH	2.900	Received forged, contains fake AOL relays	check_for_fake_aol_relay_in_rcvd()
FORGED_EBAY_RCVD	EOH	0.906	'From' ebay.com does not match 'Received' headers	check_for_from_domain_in_received_headers('ebay.com', 'false')
FORGED_EUDORAMAIL_RCVD	EOH	3.198	Forged eudoramail.com 'Received:' header found	check_for_forged_eudoramail_received_headers()
FORGED_GW05_RCVD	EOH	1.889	Forged 'by gw05' 'Received:' header found	check_for_forged_gw05_received_headers()
FORGED_HOTMAIL_RCVD	EOH	1.479	Forged hotmail.com 'Received:' header found	check_for_forged_hotmail_received_headers()
FORGED_JUNO_RCVD	EOH	2.421	'From' juno.com does not match 'Received' headers	check_for_forged_juno_received_headers()
FORGED_RCVD_FOUND	EOH	0.765	Possibly-forged 'Received:' header found	/\n(?:To|Importance|Subject|X-MSMail-Priority):.*\nReceived: /s
FORGED_RCVD_TRAIL	EOH	2.044	trail of Received: headers seems to be forged	check_for_forged_received_trail()
FORGED_YAHOO_RCVD	EOH	1.352	'From' yahoo.com does not match 'Received' headers	check_for_forged_yahoo_received_headers()
FORGOTTEN_PASSWORD	BODY	-1.128	Contains a password retrieval system	/[fF]org[oe]t.{0,25}[pP]assword/
FORMMAIL_SCRIPT	RAWEOB	4.000	email form sending to http://.../formmail.pl	/(?si)<form\b.*\baction=(?:"[^"]*|\S*)\bformmail\.pl/
FORM_W_MAILTO_ACTION	RAWBODY	1.218	Includes a form which will send an email	/action=[3D=\s"']*mailto:/is
FORWARD_LOOKING	BODY	3.044	Stock Disclaimer Statement	/\bcontains forward-looking statements\b/i
FOR_FREE	BODY	0.323	No such thing as a free lunch (1)	/\bfor (?-i:FREE)\b/i
FOR_INSTANT_ACCESS	BODY	0.405	Instant Access button	/INSTANT ACCESS/i
FOR_JUST_SOME_AMT	BODY	0.201	Contains 'for only' some amount of cash	/for (?:just|only) \$?\d+\.?\d*[^\.]*!/i
FREE_ACCESS	BODY	0.608	Contains 'free access' with capitals	/(?-i:F)ree access/i
FREE_CELL_PHONE	BODY	0.413	Free Cell Phone	/\bfree .{0,12}(?:cell(?:ular)?|mobile) phone|cell(?:ular)? phone for free/i
FREE_CONSULTATION	BODY	2.654	Offers a free consultation	/FREE CONSULTATION/i
FREE_DVD	BODY	0.209	Free DVD	/\bfree dvd/i
FREE_GRANT	BODY	2.502	Free Grant Money	/\b(?:free|government) (?-i:G)rants?\b/i
FREE_HOSTING	BODY	0.106	Free Hosting	/\bfree hosting\b/i
FREE_INSTALL	BODY	2.510	Contains 'free installation' with capitals	/(?-i:F)ree installation/i
FREE_INVESTMENT	BODY	3.193	Free Investment	/\bfree investment/i
FREE_LEADS	BODY	2.292	Free Leads	/\bfree leads\b/i
FREE_MEMBERSHIP	BODY	0.935	Free Membership	/\bfree membership/i
FREE_MONEY	BODY	-0.069	Free money!	/\b(?:fast|free|easy|big)\s*(?:money|\$+|bucks|cash|(?-i:E)uros?)\b/i
FREE_PASSWORD	BODY	1.831	Offers Free (often stolen) Passwords	/\bfree .{0,9}passwords?\b/i
FREE_PORN	BODY	0.800	Possible porn - Free Porn	/\bfree (?:porn|xxx|adult)/i
FREE_PREVIEW	BODY	2.066	Contains 'free preview' with capitals	/(?-i:F)ree preview/i
FREE_QUOTE	BODY	0.612	Free Quote	/\bfree quote/i
FREE_SAMPLE	BODY	1.246	Contains 'free sample' with capitals	/(?-i:F)ree sample/i
FREE_TRIAL	BODY	0.114	Free Trial	/\bfree trial\b/i
FREE_WEBSITE	BODY	0.327	Free Website	/\bfree website/i
FRIEND_AT_PUBLIC	To	0.361	sent to you@you.com or similar	/(?:yourdomain|you|your|public)\.(?:com|org|net)/i
FROM_AND_TO_SAME_1	EOH	0.544	From and To the same (1)	check_for_from_to_same('exact_both')
FROM_AND_TO_SAME_2	EOH	1.247	From and To are same (2)	check_for_from_to_same('exact_none')
FROM_AND_TO_SAME_3	EOH	1.506	From and To are same (3)	check_for_from_to_same('rough_both')
FROM_AND_TO_SAME_5	EOH	1.314	From and To are same (5)	check_for_from_to_same('rough_to')
FROM_AND_TO_SAME_6	EOH	1.361	From and To are same (6)	check_for_from_to_same('rough_none')
FROM_BTAMAIL	From	2.202	From an address @btamail.net.cn	/\@btamail\.net\.cn/i
FROM_EGROUPS	X-eGroups-Return	-0.506	Appears to be from yahoo groups	/^sentto-.*\@returns\.groups\.yahoo\.com$/
FROM_ENDS_IN_NUMS	From	0.893	From: ends in numbers	/\d\d\@/
FROM_HAS_MIXED_NUMS	From	0.319	From: contains numbers mixed in with letters	/\d+[a-z]+\d+\S*\@/i
FROM_HAS_MIXED_NUMS2	From	0.726	From address matches known spammer format	/\w{2,}\d{4,}[a-z]{1,2}\d{2,}\@/i
FROM_MALFORMED	From	0.324	From: has a malformed address	! /(?:\"[^\"]+\"|\S+)\@\S+\.\S+|<\S+(?:\!\S+)+>/
FROM_MISSING	EOH	-0.026	Missing From: header	check_for_missing_header('From')
FROM_NO_USER	From	0.954	From: has no local-part before @ sign	/(?:^\@|<\@| \@[^<]*$|<>)/
FROM_STARTS_WITH_NUMS	From	0.505	From: starts with nums	/^\d\d/
FROM_TOPICA	From	1.000	From an address @email-publisher.com	/\@(?:\w\.)*email-publisher\.com/i
FROM_US_PHONE	From	-1.000	From: looks like US Telephone Number	/^[2-9]\d{9}\@/
FRONTPAGE	RAWBODY	0.412	Frontpage used to create the message	/FrontPage.Editor/
FULL_REFUND	BODY	0.414	Offers a full refund	/full refund|refunds? your money in full/i
FWD_MSG	Subject	-1.000	Forwarded email	/Fwd:\s/
GAPPY_SUBJECT	Subject	1.274	'Subject' contains G.a.p.p.y-T.e.x.t	/\b(?:[a-z][-_\.\,\:\;\'\~\s]{1,3}){4,}/i
GENTLE_FEROCITY	BODY	1.858	Contains 'Gentle Ferocity'	/Gentle Ferocity/i
GENUINE_EBAY_RCVD	EOH	-2.174	Message from eBay	check_for_from_domain_in_received_headers('ebay.com', 'true')
GETAWAY	BODY	0.216	Weekend Getaway	/\bweekend getaway/i
GET_IT_NOW	BODY	0.402	Contains 'Get it now' with capitals	/get it (?-i:N)ow/i
GET_PAID	BODY	1.138	Get Paid	/\bget (?-i:P)aid\b/i
GET_STARTED_NOW	BODY	1.000	Get Started Now	/\bget started (?-i:N)ow\b/i
GIFT_CERTIFICATE	BODY	0.004	Gift Certificate	/\bgift certificates?/i
GIVING_AWAY	BODY	0.111	They're just giving it away!	/\bgiving away\b/i
GREAT_OFFER	BODY	0.214	Trying to offer you something	/\b(?:offer expires|see full offer for details|great offer)/i
GREEN_EXCUSE_1	BODY	2.314	Claims spam helps the environment	/using email instead can significantly reduce this/i
GREEN_EXCUSE_2	BODY	2.206	Claims spam helps the environment	/the trees, save the planet, use email!/i
GROUPS_YAHOO_1	BODY	-0.506	Yahoo! Groups message	/^Your use of Yahoo! Groups is subject to http:\/\/\Qdocs.yahoo.com\E\/info\/terms\//
GUARANTEE	BODY	0.796	Contains word 'guarantee' in all-caps	/\bGUARANTEE\b/
GUARANTEED_100_PERCENT	BODY	0.556	One hundred percent guaranteed	/100% GUARANTEED/i
GUARANTEED_STUFF	BODY	0.553	Guaranteed Stuff	/\bguarantee.{0,15}(?:income|money|monthly)\b/i
HAIR_LOSS	BODY	1.591	Cures Baldness	/\b(?:thinn?ing|restore|grow|new) hair|hair loss/i
HARDCORE_PORN	BODY	1.500	Possible porn - Hardcore Porn	/\bh[a\@]rd[ -]?core .{0,9}(?:teen|virgin|cheerleader|amat(?:eu|ue)r)|\bextreme h[a\@]rdcore/i
HEADER_8BITS	EOH	2.443	Headers include 3 consecutive 8-bit characters	/[\x80-\xff]{3,}/
HERBAL_VIAGRA	BODY	1.078	Plugs 'Herbal Viagra'	/\bherbal v(?:iagra)?\b/i
HGH	BODY	0.665	Human Growth Hormone	/\b(?:human growth hormone|(?-i:HGH)|H.G.H)\b/i
HIDDEN_ASSETS	BODY	3.284	'Hidden' assets	/hidden assets/i
HIDDEN_CHARGES	BODY	0.306	Talks about Hidden Charges	/\bhidden charges\b/i
HIDE_WIN_STATUS	RAWBODY	0.418	Javascript to hide URLs in browser	/<[^>]+onMouseOver=[^>]+window\.status=/i
HOME_EMPLOYMENT	BODY	0.563	Information on how to work at home (2)	/HOME.{0,10}(?: EMPLOYMENT|WORKER|BUSINESS)/i
HOTMAIL_FOOTER1	BODY	-0.489	Common footer for Hotmail	/Send and receive Hotmail on your mobile device: /
HOTMAIL_FOOTER2	BODY	-2.475	Common footer for Hotmail	/Get your FREE download of MSN Explorer at /
HOTMAIL_FOOTER3	BODY	-2.170	Common footer for Hotmail	/Get Your Private, Free E-mail from MSN Hotmail at http:\/\/www\.hotmail\.com\./
HOTMAIL_FOOTER4	BODY	-1.696	Common footer for Hotmail	/Join the world's largest e-mail service with MSN Hotmail\./
HOTMAIL_FOOTER5	BODY	-1.801	Common footer for Hotmail	/Chat with friends online, try MSN Messenger: /
HOT_NASTY	BODY	1.500	Possible porn - Hot, Nasty, Wild, Young	/\b(?:horny|nasty|hot|wild|young|horniest|nastiest|hottest|wildest|youngest|naughty|dirtiest|slutty|kinky|lusty|extreme|xxx+)\b.{0,9}\b(?:virgin|asian|cheerleader|sex|selection|fuck|fucking|anal\b|lesb(?:ian|o)|incest|chicks?|pics|movies|video|gay\b|porn|h[a\@]rdcore|schoolgirls|amateur|slut|adult|cum|xxx|sites?|hotties|shit|lonely)/i
HR_3113	BODY	2.932	Mentions Spam law 'H.R. 3113'	/H\.\s*R\.\s*3113/is
HR_4176	BODY	2.022	Claims compliance with House Bill 4176	/H\.?R\.? *4176.{0,10}SECTION.{0,10}101/i
HTML_50_70	EOB	0.305	Message is 50-70% HTML tags	html_percentage('50','70')
HTML_70_90	EOB	0.947	Message is 70-90% HTML tags	html_percentage('70','90')
HTML_90_100	EOB	1.778	Message is 90-100% HTML tags	html_percentage('90','100')
HTML_COMMENT_8BITS	EOB	1.293	HTML comment has 3 consecutive 8-bit characters	html_test('comment_8bit')
HTML_COMMENT_SAVED_URL	EOB	0.781	HTML message is a saved web page	html_test('comment_saved_url')
HTML_COMMENT_UNIQUE_ID	EOB	0.123	Contains a comment with nothing but unique ID	html_test('comment_unique_id')
HTML_EMBEDS	EOB	0.382	HTML with embedded plugin object	html_test('embeds')
HTML_FONT_COLOR_BLUE	EOB	0.205	HTML font color is blue	html_test('font_blue')
HTML_FONT_COLOR_CYAN	EOB	0.405	HTML font color is cyan	html_test('font_cyan')
HTML_FONT_COLOR_GRAY	EOB	0.330	HTML font color is gray	html_test('font_gray')
HTML_FONT_COLOR_GREEN	EOB	0.405	HTML font color is green	html_test('font_green')
HTML_FONT_COLOR_MAGENTA	EOB	0.443	HTML font color is magenta	html_test('font_magenta')
HTML_FONT_COLOR_NAME	EOB	0.333	HTML font color has unusual name	html_test('font_color_name')
HTML_FONT_COLOR_NOHASH	EOB	0.212	HTML font color is missing hash (	html_test('font_color_nohash')
HTML_FONT_COLOR_RED	EOB	0.315	HTML font color is red	html_test('font_red')
HTML_FONT_COLOR_UNKNOWN	EOB	0.422	HTML font color is unknown to us	html_test('font_color_unknown')
HTML_FONT_COLOR_UNSAFE	EOB	0.302	HTML font color not within safe 6x6x6 palette	html_test('font_color_unsafe')
HTML_FONT_COLOR_YELLOW	EOB	0.421	HTML font color is yellow	html_test('font_yellow')
HTML_FONT_FACE_BAD	EOB	0.204	HTML font face is not a word	html_test('font_face_bad')
HTML_FONT_FACE_CAPS	EOB	0.210	HTML font face has excess capital characters	html_test('font_face_caps')
HTML_FONT_FACE_ODD	EOB	0.325	HTML font face is not a commonly used face	html_test('font_face_odd')
HTML_FONT_INVISIBLE	EOB	0.344	HTML font color is same as background	html_test('font_invisible')
HTML_FONT_TINY	EOB	0.800	HTML font size is < 1	html_test('tiny_font')
HTML_TAG_UNKNOWN	EOB	0.500	HTML tag is unknown to us	html_test('tag_unknown')
HTML_WIN_BLUR	RAWBODY	1.023	Javascript to move windows around	/(?:<script>.{0,200}|<[^>]+)\.blur\s*\(\s*\)/i
HTML_WIN_OPEN	RAWBODY	1.112	Javascript to open a new window	/(?:<script>.{0,200}|<[^>]+)window\.open\s*\(/i
HTML_WITH_BGCOLOR	EOB	0.317	HTML mail with non-white background	html_test('bgcolor_nonwhite')
HTTP_CTRL_CHARS_HOST	URI	2.209	Uses control sequences inside a URL's hostname	/^https?\:\/\/[^\/\s]*[\x00-\x08\x0b\x0c\x0e-\x1f]/
HTTP_ESCAPED_HOST	URI	0.718	Uses %-escapes inside a URL's hostname	/^https?\:\/\/[^\/\s]*%[0-9a-fA-F][0-9a-fA-F]/
HTTP_USERNAME_USED	URI	1.526	Uses a username in a URL	/^https?\:\/\/[^\s\/]+\@/is
HTTP_WITH_EMAIL_IN_URL	URI	0.296	'remove' URL contains an email address	/^https?\:\/\/\S+=[-_\+a-z0-9\.]+\@[-_\+a-z0-9\.]+\.[-_\+a-z0-9]{2,3}(?:\&|\s)/
IMGSPAM_BODY	EOM	3.000	image spam as a few images outside of <td> wrapped in <a>	(!__IMGSPAM_TABLE && __IMGSPAM_BODY && !USER_AGENT_INCREDIMAIL)
IMGSPAM_TABLE	EOM	3.000	image spam wrapped in <a> and <td> tags	(__IMGSPAM_TABLE)
IMPOTENCE	BODY	0.505	Impotence cure	/\b(?:impotence (?:problem|cure|solution)|Premature Ejaculation|erectile dysfunction)/i
INCOME	BODY	1.663	Additional Income	/\badditional income\b/i
INCREASE_SOMETHING	BODY	1.404	Instructions on how to increase something	/\b(?:boost|increase|grow|larger|bigger|higher) (?:traffic|sales)\b/i
INCREDIBLE	BODY	1.000	Things incredible	/\bincredible secrets\b/i
INITIAL_INVEST	BODY	1.118	Requires Initial Investment	/\binitial investment\b/i
INSTANT_ACCESS	BODY	0.400	Possible porn - Offers Instant Access	/\binstant access\b/i
INTERNET_TERROR_RANT	BODY	1.000	Cyber FirePower! rant about losing dropboxes	/At the time of this mailing.{9,50}legitimate return email address.{100,299}internet terrorists/i
INTL_EXEC_GUILD	BODY	1.000	Well known spam senders	/International Executive Guild/
INVALID_DATE	Date	1.518	Invalid Date: header (not RFC 2822)	! /^\s*(?:(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), )?[0-3 ]?[0-9] (?:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) (?:[12][901])?[0-9]{2} [0-2][0-9](?:\:[0-5][0-9]){1,2} (?:[+-][0-9]{4}|UT|[A-Z]{2,3}T)(?:\s+\(.*\))?\s*$/
INVALID_DATE_TZ_ABSURD	Date	3.994	Invalid Date: header (timezone does not exist)	/[-+](?:1[4-9]\d\d|[2-9]\d\d\d)$/
INVALID_MSGID	Message-Id	0.032	Message-Id is not valid, according to RFC 2822	! /^<(?:[a-zA-Z0-9.!\#\$%&'*\+\/=?\^_{}|~-]+|\".+\")\@(?:[a-zA-Z0-9.-]+|\[\d{1,3}(?:\.\d{1,3}){3}\])>(?:\s*\(.*\))?\s*$/
INVESTMENT	BODY	0.281	Investment Decision	/\binvestment decision/i
INVESTOR_SPEC_SHEET	BODY	0.419	Standard investment opportunity spam	/Investor Spec Sheet/i
IN_ACCORDANCE_WITH_LAWS	BODY	2.114	Claims to be in accordance with some Spam law	/has been sent in accordance with/
IN_REP_TO	EOH	-0.847	Found a In-Reply-To header	(__IN_REP_TO && !__MANY_USER_AGENTS)
ITS_LEGAL	BODY	0.488	Claims to be Legal	/\b(?:perfectly|absolutely|100%|totally) legal\b/i
JAVASCRIPT	EOB	0.207	JavaScript code	html_test('javascript')
JAVASCRIPT_UNSAFE	RAWBODY	0.302	Easily-executed JavaScript code	/\bon(?:Blur|Change|Focus|Error|Key(?:Press|Down|Up)|Mouse(?:Down|Up|Over|Move|Out)|Resize|Move|Scroll|Stop|Click)[\s=3d\"\']*\S+[\"\']?/i
JAVASCRIPT_URI	URI	0.100	Javascript protocol in a URI	/^javascript:/i
JAVASCRIPT_VERY_UNSAFE	EOB	0.301	Auto-executing JavaScript code	html_test('javascript_very_unsafe')
JODY	BODY	2.176	Contains 'My wife, Jody' testimonial	/\b(?:My wife|Mi esposa), Jody/
JOIN_MILLIONS	BODY	0.435	Join Millions of Americans	/\bjoin (?:millions|thousands)\b/i
KIFF	BODY	1.904	Contains 'Temple Kiff'	/temple kiff/i
KNOWN_ADVERT_URL	EOB	4.000	URLs frequently occurring in image-type spam	check_for_known_advert_url()
KNOWN_MAILING_LIST	EOH	-0.102	Email came from some known mailing list software	detect_mailing_list()
KOREAN_UCE_SUBJECT	Subject	1.084	Subject: contains Korean unsolicited email tag	/[({[<][. ]*(?:\xbc\xba[. ]*\xc0\xce[. ]*)?(?:\xb1\xa4(?:[. ]*|[\x00-\x7f]{0,3})\xb0\xed|\xc1\xa4[. ]*\xba\xb8|\xc8\xab[. ]*\xba\xb8)[. ]*[)}\]>]/
LARGE_COLLECTION	BODY	0.203	Possible porn - Large Number of movies, pics	/\b(?:[0-9,]{5,9}|hundreds|thousands|millions|tons)\b.{0,15}(?:movies|videos?|xxx|streaming|pics?|photos?|of live|of images)\b/i
LARGE_HEX	BODY	0.686	Contains a large block of hexadecimal code	/[0-9a-fA-F]{70,}/
LESBIAN	BODY	2.513	Possible porn - Lesbian Site	/\b(?:xxx|horny|hot|young) lesbian|lesbian (?:sites?|action|bitch)/i
LIMITED_TIME_ONLY	BODY	0.411	Offers a limited time offer	/LIMITED TIME (?:ONLY|offer)/i
LINES_OF_YELLING	EOB	0.212	A WHOLE LINE OF YELLING DETECTED	check_for_yelling()
LINES_OF_YELLING_2	EOB	0.217	2 WHOLE LINES OF YELLING DETECTED	check_for_num_yelling_lines("2")
LINES_OF_YELLING_3	EOB	0.315	3 WHOLE LINES OF YELLING DETECTED	check_for_num_yelling_lines("3")
LINK_TO_NO_SCHEME	RAWBODY	1.275	Contains link without http:// prefix	/\s+href=['"]?www\./i
LISTBUILDER	RAWEOB	-1.898	Sent through Microsoft's ListBuilder service	detect_ml_listbuilder()
LIVE_PORN	BODY	2.100	Possible porn - Live Porn	/\blive .{0,9}(?:fuck(?:ing)?|sex|naked|girls?|virgins?|teens?|porno?)\b/i
LONG_DISTANCE	BODY	1.681	Long Distance Phone Offer	/\b(?:Unlimited|per minute|free).{1,9}Long Distance/i
LONG_NUMERIC_HTTP_ADDR	URI	0.606	Uses a long numeric IP address in URL	/^https?\:\/\/000\d+/is
LOSE_POUNDS	Subject	0.514	Subject talks about losing pounds	/\bLose .*(?:pounds|lbs|weight)/i
LOTS_OF_CC_LINES	EOH	0.817	Lots and lots of Cc: headers	check_lots_of_cc_lines()
LOTS_OF_STUFF	BODY	0.409	Thousands or millions of pics/movies/etc	/\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
LOW_INTEREST	BODY	0.513	Lower Interest Rates	/\blow.{0,20} interest rates?\b/i
LOW_PAYMENT	BODY	1.301	Lower Monthly Payment	/\b(?:reduce|low).{0,12} payment/i
LOW_PRICE	BODY	0.334	Lowest Price	/\blow.{0,4} (?-i:P)rice/i
LUXURY_CAR	BODY	1.000	Luxury Car	/\bluxury car\b/i
LYING_EYES	BODY	1.000	Will not Belive your Eyes!	/\bbelieve your eyes\b/i
MAILBITS_EMAIL	BODY	-1.000	recommended page from MailBits.com	/This is a free service provided by MailBits\.com\./
MAILER_DAEMON	From	-1.451	From the Mailer-Daemon	/^(?:Mail Delivery \w+ )?<?mailer.?daemon\@\S+>?(?: \(Mail Delivery \w+\))?$/i
MAILMAN_CONFIRM	BODY	-1.000	A MailMan confirm-your-address message	/We have received a request .*subscription of your email address.* to the .* mailing list/
MAILTO_LINK	RAWBODY	0.203	Includes a URL link to send an email	/=[3D=\s"']*mailto:/is
MAILTO_TO_REMOVE	URI	0.203	Includes a 'remove' email address	/^mailto:.*?remove/is
MAILTO_TO_SPAM_ADDR	URI	0.687	Includes a link to a likely spammer email address	/^mailto:[a-z]+\d{2,}\@/is
MAILTO_WITH_SUBJ	URI	0.419	Includes a link to send a mail with a subject	/^mailto:\S+\?subject=/is
MAILTO_WITH_SUBJ_REMOVE	URI	0.601	Includes a URL link to send an email with the subject 'remove'	/^mailto:\S+\?subject=[3D=\s"']*remove/is
MAIL_IN_ORDER_FORM	BODY	0.560	Contains mail-in order form	/\b(?:Mail-in|secure|ez|credit.card|fax this) Order Form\b/i
MAJORDOMO	Subject	-0.019	From Majordomo	/Majordomo (?:request )?results/
MANY_EXCLAMATIONS	EOM	0.400	Subject has many exclamations	(!__ISO_2022_JP_DELIM && __MANY_EXCLS)
MANY_FROMS	From	1.000	'From' contains more than one address	/^[^\"\<\(]+, [^\"\<\(]+$/
MANY_USER_AGENTS	EOH	1.000	Mail claims to come from multiple user agents	(__MANY_USER_AGENTS)
MARKETING	BODY	1.435	Direct Marketing	/\bdirect marketing\b/i
MARKETING_PARTNERS	BODY	1.682	Claims you registered with some kind of partner	/marketing partner|partner site/i
MARKET_SOLUTION	BODY	1.273	Marketing Solutions	/\bmarket.{0,9} solution/i
MARKUP_RAND	BODY	2.782	RAND found, spammer forgot to run the random-ID generator	/{%RAND%}/
MASS_EMAIL	BODY	0.681	Talks about mass email	/mass e-*mail/i
MAY_BE_FORGED	Received	0.038	'Received:' has 'may be forged' warning	/\(may be forged\)/i
MDAEMON_2_7_4	Received	2.796	Received via buggy SMTP server (MDaemon 2.7.4SP4R)	/with SMTP .MDaemon.v2.7.SP4.R./
MEET_SINGLES	BODY	2.398	Meet Singles	/\bmeet .{0,12}singles|thousands of personal/i
MEGA_SITE	BODY	2.242	Possible porn - Mega Porn	/\bmega[ -]?sites?\b/i
MEMBER	BODY	0.212	Member Stuff	/\bmember (?:number|reward|value|benefit|rate|report|card|information)s?\b/i
MEMBER_2	BODY	0.294	Being a Member	/\b(?:free|special|paid|dear|gold|opt.in|valued|because you are an?|be a|becoming a|sent to) .{0,9}members?\b/i
MICROSOFT	microsoft	2.357	A 'microsoft' header was found	/./
MICRO_CAP_WARNING	BODY	2.702	SEC-mandated penny-stock warning -- thanks SEC	/Investing in micro-cap securities is highly speculative/i
MIME_BOUND_DIGITS_1	Content-Type	1.000	Spam tool pattern in MIME boundary	/boundary=\"----------=_\d{10}-\d{4}-\d{2}\"/
MIME_BOUND_DIGITS_2	Content-Type	0.150	Spam tool pattern in MIME boundary	/boundary=\"----------=_\d{10}-\d{5}-\d\"/
MIME_BOUND_DIGITS_3	Content-Type	0.009	Spam tool pattern in MIME boundary	/boundary=\"----0{63}\"/
MIME_BOUND_DIGITS_4	Content-Type	0.459	Spam tool pattern in MIME boundary	/boundary=\"_----------=_\d{18}\"/
MIME_BOUND_DIGITS_5	Content-Type	1.697	Spam tool pattern in MIME boundary	/boundary=\"\d-\d{9}-\d{10}=:\d{5}\"/
MIME_BOUND_DIGITS_7	Content-Type	0.100	Spam tool pattern in MIME boundary	/boundary=\d{9}\.\d{13}/
MIME_BOUND_EQS_DASHES	Content-Type	1.000	Spam tool pattern in MIME boundary	/boundary=\"==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==\"/
MIME_BOUND_HASHES	Content-type	1.000	Spam tool pattern in MIME boundary	/boundary=\"\#{10}\"/
MIME_BOUND_HEX14	Content-Type	1.000	Spam tool pattern in MIME boundary	/boundary=\"==[0-9a-f]{14}\"/
MIME_BOUND_HEX_24	Content-Type	1.270	Spam tool pattern in MIME boundary	/boundary=\"[\dA-F]{24}\"/
MIME_BOUND_MA	Content-Type	1.253	Spam tool pattern in MIME boundary	/boundary=\"----=_[a-zA-Z0-9]{8}_[a-zA-Z0-9]{8}_MA\"/
MIME_BOUND_MAIL_BOUND	Content-Type	1.000	Spam tool pattern in MIME boundary	/boundary=\"____MAIL_BOUNDARY____\"/
MIME_BOUND_MIME_BOUND	Content-Type	1.000	Spam tool pattern in MIME boundary	/boundary=\"MIME_BOUNDARY-\d{4}-\d-\d{10}\"/
MIME_BOUND_OPTIN	Content-Type	2.496	Spam tool pattern in MIME boundary	/boundary=\"[A-F\d]{8}-[A-F\d]{4}-[A-F\d]{4}-[A-F\d]{4}-[A-F\d]{12}OPTIN\"/
MIME_BOUND_SEP1	Content-Type	1.000	Spam tool pattern in MIME boundary	/boundary=\"--==--==_Separator1\"/
MIME_NULL_BLOCK	BODY	-0.137	Correct for MIME 'null block'	/This message is in MIME format/
MIME_ODD_CASE	EOH	2.357	MiME-Version header (oddly capitalized)	/\nMiME-Version: /s
MISSING_HEADERS	EOH	0.959	Missing To: header	check_for_missing_to_header()
MISSING_MIMEOLE	EOH	3.000	Message has X-MSMail-Priority, but no X-MimeOLE	(__HAS_MSMAIL_PRI && !__HAS_MIMEOLE)
MISSING_OUTLOOK_NAME	EOH	1.110	Message looks like Outlook, but isn't	((__HAS_MIMEOLE || __HAS_MSMAIL_PRI) && __HAS_X_MAILER && !__HAS_OUTLOOK_IN_MAILER)
MLM	BODY	0.975	Multi Level Marketing mentioned	/\b(?:MLM|multi.level.marketing)\b/i
MONEY_BACK	BODY	1.410	Money back guarantee.	/money back guarantee/i
MONEY_MAKING	BODY	0.405	Discusses money making	/\bmoney mak(?:ing|er)/i
MONTH_TRIAL	BODY	0.239	Month Trial Offer	/(?:month|day) .{0,9}trial/i
MORE_TRAFFIC	BODY	1.000	More Internet Traffic	/\bmore (?:internet|web) traffic\b/i
MORTGAGE_OBFU	BODY	0.408	Attempt at obfuscating the word 'mortgage'	/mor[\$t][\$g]a[\$g]e/i
MORTGAGE_RATES	BODY	0.552	Information on mortgage rates	/Mortgage rates/i
MSGID_3_DOLLARS	Message-Id	2.000	Spam tool Message-Id: (3-dollars variant)	/<?(?:\d+\$){3}\d+\@/
MSGID_4NUMS_DOLLAR	Message-Id	2.000	Spam tool Message-Id: (4-num-dollar variant)	/<?\d{4}\$\w+\@/
MSGID_CHARS_SPAM	Message-Id	0.108	Message-Id has characters indicating spam	/[:}{,!\/]/
MSGID_CHARS_WEIRD	Message-Id	1.598	Message-Id has characters often found in spam	/["=\\~]/
MSGID_HAS_NO_AT	Message-Id	0.323	Message-Id has no @ sign	! /\@/
MSGID_OUTLOOK_TIME	EOH	3.000	Message-Id is fake (in Outlook Express format)	check_outlook_timestamp_token()
MSGID_SPAMSIGN_1	Message-Id	2.784	Message-Id generated by a spam tool	/^<[0-9a-f]{12,12}\$[0-9a-f]{8,8}\$[0-9a-f]{8,8}\@>$/
MSGID_SPAMSIGN_6LETTER	Message-Id	3.000	Message-Id generated by spam tool (6-letter variant)	/<[0-9][0-9][0-9][a-f]..[a-f]..[a-f].[a-f]\$[0-9a-f]{4}[a-f].[a-f].\$.[a-f][a-f]..[a-f][a-f].\@[a-z]{6}>/
MSGID_SPAMSIGN_ZEROES	Message-Id	3.000	Message-Id generated by spam tool (zeroes variant)	/<0000[0-9a-f]{8}\$0000[0-9a-f]{4}\$0000[0-9a-f]{4}\@/
MSGID_SPAM_99X9XX99	Message-Id	3.000	Spam tool Message-Id: (99x9xx99 variant)	/^<\d\d\d\d\d\d[a-z]\d[a-z][a-z]\d\d\$[a-z][a-z][a-z]\d\d\d\d\d\$\d\d\d\d\d\d\d\d\@/
MSGID_SPAM_ZEROES	Message-Id	3.000	Spam tool Message-Id: (12-zeroes variant)	/<0000[0-9a-f]{8}\$0000[0-9a-f]{4}\$0000[0-9a-f]{4}\@/
MSG_ID_ADDED_BY_MTA	Message-Id	2.492	'Message-Id' was added by a relay	/ \(added by (?!postmaster\@wanadoo\.fr)/
MSG_ID_ADDED_BY_MTA_2	EOH	0.114	'Message-Id' was added by a relay (2)	check_for_mta_message_id_later()
MSG_ID_ADDED_BY_MTA_3	EOH	0.885	'Message-Id' was added by a relay (3)	check_for_mta_message_id_first()
MSN_FOOTER1	BODY	-1.118	Common footer for MSN	/MSN Photos is the easiest way to share and print your photos: /
MSN_FOOTER2	BODY	-1.000	Common footer for MSN	/Remove my e-mail address from Gaming Zone /
MSN_GROUPS	EOB	-1.301	Came from MSN Communities	check_for_msn_groups_headers()
MURKOWSKI_CRUFT	RAWBODY	1.000	Old Murkowski disclaimer	/www\.senate\.gov\/~?murkowski/
MUST_BE_18	BODY	0.614	Possible porn - Must be 18	/\bmust be (?:at least|over) 18\b/i
NAME_BRAND	BODY	0.308	Name Brand	/\b(?:famous name|major) brand/i
NASTY_GIRLS	BODY	2.170	Possible porn - Nasty Girls	/\b(?:horniest|nasty|nastiest|hottest|wildest|slutty|xxx+)\b.{0,9}\b(?:girl|women|teen|babe)/i
NATURAL_VIAGRA	BODY	1.000	Plugs 'Natural Viagra'	/\bnatural viagra\b/i
NEW_CUSTOMER	BODY	1.000	New Customers Only	/\bnew customers only\b/i
NEW_DOMAIN_EXTENSIONS	BODY	1.495	Possible registry spammer	/new\s*domain\s*extension/i
NIGERIAN_SCAM	BODY	1.000	Nigerian scam, cf http://www.snopes2.com/inboxer/scams/nigeria.htm	/BASED ON INFORMATION GATHERED ABOUT YOU, WE BELIEVE\s*YOU WOULD BE IN A POSITION TO HELP US IN TRANSFER/i
NIGERIAN_TRANSACTION_1	BODY	0.201	illegal Nigerian transactions (1)	/\b(?:financial|confiden(?:tial|ce)|safe(?:ty)?|mutual|secret|success(?:ful)?|risk-?free|details).{1,30}\btransaction\b/i
NIGERIAN_TRANSACTION_2	BODY	0.628	illegal Nigerian transactions (2)	/\btransaction\b.{1,30}\b(?:magnitude|diplomatic|strict|absolute|secret|confiden(?:tial|ce)|guarantee)/i
NMS_CGI_NOT_BUGGY	X-Mailer	-10.000	Not Matt's Scripts formmail.pl	/^NMS FormMail\.pl.*v\d/
NONEXISTENT_CHARSET	Content-Type	3.140	Character set doesn't exist	/charset=.?DEFAULT/
NORMAL_HTTP_TO_IP	URI	1.283	Uses a dotted-decimal IP address in URL	/^https?\:\/\/\d+\.\d+\.\d+\.\d+/is
NOSPAM_INC	Organization	-0.211	Where are you working at?	/./
NOT_INTENDED	BODY	1.332	Not intended for residents of XYZ.	/not intended for residents (?:of|in)\b/i
NOT_MLM	BODY	3.009	Apparently, NOT Multi Level Marketing	/\bnot (?:MLM|multi.level.marketing)\b/i
NO_AGE	BODY	2.744	No Age Restrictions	/\bno age (?:restriction|limit)/i
NO_CATCH	BODY	0.362	There is no catch.	/there is no catch/i
NO_COMBINE	BODY	0.496	Can not be combined with any other offer	/\bwith any other offer/i
NO_CONTENT	EOM	4.000	Missing both the Subject header and the body	(__SUBJ_MISSING && __BODY_MISSING)
NO_COST	BODY	1.021	No such thing as a free lunch (3)	/\bno (?:cost|charge)\b/i
NO_CREDIT_CHECK	BODY	0.601	No Credit Check	/\bno credit check\b/i
NO_DISSAPOINTMENT	BODY	0.400	You won't be dissapointed.	/You won'?t be diss?app?ointed/i
NO_EXPERIENCE	BODY	0.653	No experience needed!	/\bNo EXPERIENCE/i
NO_FEE	BODY	0.300	No Fees	/\bno .{0,12}fees?\b/i
NO_FORMS	BODY	0.117	No Claim Forms	/\bno .{0,9}forms\b/i
NO_GIMMICK	BODY	1.000	No Gimmick	/\bno gimmick\b/i
NO_INVENTORY	BODY	0.600	No Inventory	/\bno inventory\b/i
NO_INVESTMENT	BODY	2.011	No Investment	/\bno investment/i
NO_MEDICAL	BODY	1.000	No Medical Exams	/\bno medical exam/i
NO_MIDDLEMAN	BODY	1.000	No Middleman	/\bno middleman\b/i
NO_MX_FOR_FROM	EOH	3.090	No MX records for the From: domain	check_for_from_mx()
NO_OBLIGATION	BODY	0.402	There is no obligation.	/no obligation/i
NO_PURCHASE	BODY	0.301	No Purchase Necessary	/\bno purchase\b/i
NO_QS_ASKED	BODY	0.212	Doesn't ask any questions	/\bNO QUESTIONS ASKED\b/i
NO_REAL_NAME	From	1.285	From: does not include a real name	/^["\s]*\<?\S+\@\S+\>?\s*$/
NO_REFUND	BODY	1.000	They keep your money -- No Refund!	/\bno refund/i
NO_SELLING	BODY	1.000	Claims not to be selling anything	/absolutely NO selling/i
NO_STRINGS	BODY	0.386	No Strings Attached	/\bno strings attached\b/i
NUMERIC_HTTP_ADDR	URI	2.109	Uses a numeric IP address in URL	/^https?\:\/\/\d{7,}/is
OBFUSCATING_COMMENT	RAWBODY	2.083	HTML comments which obfuscate text	/[^\s>]<![^>]{0,32}?>[^\s<]/
OFFER	BODY	0.203	Free Offer	/\b(?:free|special|trial) offer/i
OFFER_EXPIRE	BODY	0.101	Offer Expires	/\boffer expires\b/i
OFFSHORE_SCAM	BODY	0.369	Off Shore Scams	/\boffshore\b.{0,20}(?:credit card|companies|account|financ|websites?)/i
ONCE_IN_LIFETIME	BODY	1.836	Once in a lifetime, apparently	/once in a lifetime opportunity/i
ONE_TIME	BODY	0.329	One Time Rip Off	/\bone\W+time (?:charge|investment|offer|promotion)/i
ONE_TIME_MAILING	BODY	1.486	'one time mailing' doesn't mean it isn't spam	/this\b.{0,20}\b(?:one|1).time\b.{0,20}\b(?:(?:e-?)?mail|offer)/i
ONLINE_BIZ_OPS	BODY	1.000	Wants you to do business online	/online business opportunities/i
ONLINE_PHARMACY	BODY	1.226	Online Pharmacy	/online pharmacy|(?:drugs|medications) online/i
ONLY_COST	BODY	0.211	Only $$$	/\bonly .{0,9}\$/i
OPPORTUNITY	BODY	0.882	Gives information about an opportunity	/OPPORTUNITY/
OPPORTUNITY_2	BODY	0.407	Opportunity - What a deal!	/\b(?:opportunity (?:pass|of a lifetime|is knocking|for you)|(?:investment|unique) opportunity)\b/i
OPT_IN	BODY	1.470	Talks about opting in	/\bopt-in\b/i
ORDER_NOW	BODY	0.211	Encourages you to waste no time in ordering	/\border (?:now|soon|fast|quickly|while)\b/i
ORDER_STATUS	Subject	-1.433	Subject looks like order info	/ order\b/i
OUTLOOK_FW_MSG	Subject	-0.075	Forwarded email (Outlook style)	/\[?F[Ww]:\s/
OUTLOOK_UNDISC_RECIPS	To	0.466	MS-Outlook-style To '<Undisclosed-Recipient:;>'	/<Undisclosed-Recipient:;>/
OUTSTANDING_VALUE	BODY	1.000	Outstanding Values	/\boutstanding value/i
PARA_A_2_C_OF_1618	BODY	0.781	Claims compliance with Senate Bill 1618	/Paragraph *.a.{0,10}2.{0,10}C. of S. 1618/i
PATCH_CONTEXT_DIFF	RAWBODY	-2.442	Contains what looks like a patch from diff -c	/^\*{3} \S+\s+.{10,}\b\d{2}:\d{2}:\d{2}\s/
PATCH_UNIFIED_DIFF	RAWBODY	-0.949	Contains what looks like a patch from diff -u	/^\@\@ [-+0-9]+,[0-9]+ [-+0-9]+,[0-9]+ \@\@$/
PAY_SITE	BODY	2.565	Possible porn - Pay Site	/\bpay[ -]?sites?\b/i
PENIS_ENLARGE	BODY	0.948	Information on getting a larger penis or breasts	/\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b).{0,50}\b(?:penis|male organ|P[ -]?P\b|pee[ -]?pee|dick|sc?hlong|wh?anger|breast)/i
PENIS_ENLARGE2	BODY	2.066	Information on getting a larger penis or breasts (2)	/\b(?:penis|male organ|P[ -]?P\b|pee[ -]?pee|dick|sc?hlong|wh?anger|breast).{0,50}\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b)/i
PENIS_OBFU	BODY	3.000	Obfuscate the word penis	/\bpen[1líîìï]s\b/i
PENNIES_A_DAY	BODY	1.721	Contains 'for only pennies a day'	/for (?:just|only) pennies a day/i
PGP_SIGNATURE	RAWBODY	-0.506	Contains a PGP-signed message	/-----BEGIN PGP SIGNATURE-----/
PGP_SIGNATURE_2	Content-Type	-0.708	Contains a PGP-signed message (signature attached)	/protocol=.?application\/pgp-signature.?;/i
PHONE_CANCER	BODY	1.000	Cell Phone Cancer Scam	/\bphone.{0,15}cancer\b/i
PLEASE_READ	Subject	0.028	Please read this! Please oh please oh please!	/please read/i
PLING_PLING	EOM	1.510	Subject has lots of exclamation marks	(!__ISO_2022_JP_DELIM && __PLING_PLING)
PLING_QUERY	Subject	0.102	Subject has exclamation mark and question mark	/\?.*!|!.*\?/
PORN_15	BODY	2.900	Possible Porn - various types of feline	/(?:college|eating|licking|spears|tight|wet|shaved|voyeur|young|teen(?:age)?).{0,16}pussy/i
PORN_16	BODY	2.799	Possible Porn - nasty, dirty, little etc.	/\b(?:nasty|teen|dir(?:ty|iest)?|little).{0,16}\bsluts?/i
PORN_4	URI	2.000	URL uses words and phrases which indicate porn (4)	/^https?:\/\/[\w\.-]*(?:xxx|(?<!es|ba)(?<!dle|sus)sex|anal(?!og|y[sz])|slut|pussy|(?<!cir)(?<!\bdo)cum(?!ul|be?r|b?en)|nympho|suck|porn|hard-?core|taboo|whore|voyeur|lesbian|gurlpages|naughty|lolita|(?<!thir|four|eigh|nine)(?<!fif|six)(?<!seven)teen|schoolgirl|kooloffer|erotic|lust(?!(?<=illust)(?:rat|rious)|(?<=clust)er)|pant(?:y|ies))[\w-]*\./
PORN_6	BODY	1.631	Possible Porn - XXX Photos	/\b(?:\d+\+? xxx pictures|xxx photos?)\b/i
PORN_GALLERIES	BODY	1.000	Possible porn - Galleries of Pictures	/\bhuge galleries\b/i
PORN_MEMBERSHIP	BODY	1.844	Possible Porn - Porn membership	/\b(?:vip|adult|porn|x.rated) membership/i
PORN_PASSWORD	BODY	1.813	Possible porn - Porn Password	/\bporn password/i
POST_IN_RCVD	Received	1.000	Received contains fake 'Post.cz' hostname	/ Post\.(?:sk|cz)/
PREST_NON_ACCREDITED	BODY	1.269	'Prestigious Non-Accredited Universities'	/prestigi?ous\b.{0,20}\bnon-accredited\b.{0,20}\buniversities/i
PRICES_WONT_LAST	BODY	1.000	Prices won't Last	/\bprices.{0,11} last\b/i
PRINT_FORM_SIGNATURE	BODY	0.518	Asks you for your signature on a form	/Sign(?:ature)?\s*(?:here|please)?:.{0,30}___/i
PRIORITY_MAIL	BODY	1.000	Orders shipped by priority mail	/\b[Aa]ll\b.{0,20}\b[Oo]rders\b.{1,20}\bPriority Mail\b/
PRIORITY_NO_NAME	EOH	1.023	Message has priority setting, but no X-Mailer	((__HAS_X_PRIORITY || __HAS_MSMAIL_PRI) && !__HAS_X_MAILER)
PRIVACY_STATEMENT	BODY	0.245	Contains a Privacy Statement	/\bPRIVACY STATEMENT\b/i
PRIZE	BODY	0.327	Talks about prizes	/\bclaim.{0,9} prize/i
PRODUCED_AND_SENT_OUT	BODY	2.782	Tells you it's an ad	/This a.?d is produced and sent out by/i
PROFITS	BODY	0.333	Contains word 'profits' in all-caps	/\bPROFITS\b/
PROMOTION	BODY	0.212	Contains 'Special Promotion'	/\bspecial promotion\b/i
PSYCHIC	BODY	1.000	Psychics Scam	/\b(?:caring|gifted|experienced) psychic/i
PURE_PROFIT	BODY	2.240	Offers pure profit	/PURE PROFIT/i
QUOTED_EMAIL_TEXT	RAWBODY	-0.832	Contains what looks like a quoted email text	/^>+ +.{60,72}$/
Q_FOR_SELLER	Subject	-2.550	Subject is an eBay question	/Question.*(?:for|to|from eBay).*(?:seller|Member)/
RAPE	BODY	2.334	Possible porn - Rape	/\b(?:virgin|gang|teen|amateur) rape|\brape (?:sites?|sex)\b/i
RATWARE_CARETOP	X-Mailer	1.000	Bulk email software fingerprint (Caretop) found in headers	/Caretop 2604/
RATWARE_CBLAST	X-Mailer	1.000	Bulk email software fingerprint (Campaign Blaster) found in headers	/Campaign Blaster/
RATWARE_CHARSET	X-Mailer	1.000	Bulk email software fingerprint (charset) found in headers	/\Qcharset(89)\E/
RATWARE_CURMAIL	X-Mailer	1.000	Bulk email software fingerprint (CurrentMailer) found in headers	/CurrentMailer\~/
RATWARE_DIFFOND	EOH	1.000	Bulk email software fingerprint (DiffondiCool) found in headers	/DiffondiCool/
RATWARE_EBIZ	X-Mailer	1.000	Bulk email software fingerprint (eBizmailer) found in headers	/eBizmailer3\.0/
RATWARE_EGROUPS	X-Mailer	1.045	Bulk email software fingerprint (eGroups) found in headers	/eGroups Message Poster/
RATWARE_EPAPER	X-Mailer	1.000	Bulk email software fingerprint (EPaper) found in headers	/EPaper Boy/
RATWARE_EVAMAIL	X-Mailer	2.645	Bulk email software fingerprint (EVAMAIL) found in headers	/EVAMAIL/
RATWARE_GR	X-Mailer	1.000	Bulk email software fingerprint (GRMessageQueue) found in headers	/GRMessageQueue/
RATWARE_GROUPMAIL	EOH	1.839	Bulk email software fingerprint (Group Mail) found in headers	/Group Mail/
RATWARE_HASH_2	X-Mailer	1.146	Bulk email software fingerprint (hash 2) found in headers	/^[A-Za-z0-9\._]{16,}$/
RATWARE_HASH_DASH	BODY	2.000	Contains a hashbuster in Send-Safe format	/[a-z\d]+-([a-z\d]{16}-)+[a-z\d]+(?-i:l)\d+/i
RATWARE_HSU	X-Mailer	1.000	Bulk email software fingerprint (Henry Su) found in headers	/Mailer by Henry Su/
RATWARE_IMKTG	EOH	2.611	Bulk email software fingerprint (IMktg) found in headers	/Internet Marketing/
RATWARE_JIXING	X-Mailer	2.735	Bulk email software fingerprint (JiXing) found in headers	/JiXing .{0,30}Design By JohnnieHuang/
RATWARE_JPFREE	X-Mailer	3.005	Bulk email software fingerprint (jpfree) found in headers	/jpfree Group Mail Express/
RATWARE_LC_OUTLOOK	X-Mailer	1.000	Bulk email software fingerprint ('outlook') found in headers	/^outlook$/
RATWARE_MATCHMAKER	EOH	1.000	Bulk email software fingerprint (Matchmaker) found in headers	/Matchmaker/
RATWARE_MBOMBER	X-Mailer	1.000	Bulk email software fingerprint (Mail Bomber) found in headers	/Mail Bomber/
RATWARE_MMAILER	X-Mailer	2.726	Bulk email software fingerprint (MMailer) found in headers	/MMailer v3\.0/
RATWARE_OE_MALFORMED	X-Mailer	3.072	X-Mailer contains malformed Outlook Express version	/^Microsoft Outlook Express \d(?:\.\d+){3} \w+$/
RATWARE_OE_PI	X-Mailer	2.351	X-Mailer contains 'OutLook Express 3.14159'	/Out[Ll]ook Express 3\.14159/
RATWARE_OPTIN	X-Mailer	1.000	Bulk email software fingerprint (Opt-In Lightning) found in headers	/Opt-In Lightning By Garvinweb/
RATWARE_PASCUAL	X-Mailer	1.000	Bulk email software fingerprint (pascual) found in headers	/made from pascual/
RATWARE_POWERC	X-Mailer	1.000	Bulk email software fingerprint (PowerCampaign) found in headers	/PowerCampaign/
RATWARE_SCREWUP_1	X-Mailer	2.488	Bulk email software fingerprint (screwup 1) found in headers	/^X-Mailer: /
RATWARE_SCREWUP_2	X-Mailer	0.542	Bulk email software fingerprint (screwup 2) found in headers	/^: /
RATWARE_SEEDNET	X-Mailer	1.000	Bulk email software fingerprint (Seednet) found in headers	/Seednet custom enewsletter/
RATWARE_STORM	X-Mailer	2.795	Bulk email software fingerprint (StormPost) found in headers	/StormPost/
RATWARE_TAGS	RAWBODY	3.000	Tags that are expanded to random text found	/%(?:random_(?:word|text)|name)%?/i
RATWARE_UPROAR	X-Mailer	1.000	Bulk email software fingerprint (Uproar) found in headers	/Uproar Mass Mailer/
RATWARE_V3161	EOH	1.000	Bulk email software fingerprint (V3161) found in headers	/V3,1,6,1/
RATWARE_VC_IPA	X-Mailer	2.975	Bulk email software fingerprint (VC_IPA) found in headers	/2\.0-b55-VC_IPA/
RATWARE_XMAILER	X-Mailer	1.000	Bulk email software fingerprint (xmailer tag) found in headers	/{%xmailer%}/
RATWARE_YAM	X-Mailer	1.000	Bulk email software fingerprint (Yam) found in headers	/Yam Mailer v1\.0/
RAW_TLD	BODY	1.000	Raw TLDs in advertisement	/\s\.net\s|\s\.org\s|\s\.biz\s|\s\.name\s|\s\.shop\s|\s\.travel\s|\s\.med\s|\s\.info\s|\s\.tv\s/i
RAZOR2_CHECK	FULL	3.000	Listed in Razor2, see http://razor.sf.net/	check_razor2()
RCVD_FAKE_HELO_DOTCOM	Received	2.216	Received contains a faked HELO hostname	/^from (msn|yahoo|yourwebsite|lycos|excite|aol|localhost|koreanmail|allexecs|mydomain|juno|eudoramail|compuserve|desertmail)\.com \(/
RCVD_IN_BL_SPAMCOP_NET	RBL	3.000	Received via a relay in bl.spamcop.net	check_rbl('spamcop', 'bl.spamcop.net.')
RCVD_IN_BONDEDSENDER	RBL	-10.000	Bonded sender, see http://www.bondedsender.org/referred.html	check_rbl('relay', 'query.bondedsender.org.')
RCVD_IN_DSBL	RBL	3.250	Received via a relay in list.dsbl.org	check_rbl('relay', 'list.dsbl.org')
RCVD_IN_DUL	RBL	3.000	Received from dialup, see http://www.mail-abuse.org/dul/	check_rbl('dialup', 'dialups.mail-abuse.org.')
RCVD_IN_DUL_FH	RBL	1.000	Received from first hop dialup, see http://www.mail-abuse.org/dul/	check_rbl('dialup-firsthop', 'dialups.mail-abuse.org.')
RCVD_IN_MULTIHOP_DSBL	RBL	0.810	Received via a relay in multihop.dsbl.org	check_rbl('multihop', 'multihop.dsbl.org')
RCVD_IN_OSIRUSOFT_COM	RBL	0.380	Received via a relay in relays.osirusoft.com	check_rbl('osirusoft', 'relays.osirusoft.com.')
RCVD_IN_RBL	RBL	3.000	Received via RBLed relay, see http://www.mail-abuse.org/rbl/	check_rbl('rbl', 'blackholes.mail-abuse.org.')
RCVD_IN_RELAYS_ORDB_ORG	RBL	0.610	Received via a relay in relays.ordb.org	check_rbl('relay', 'relays.ordb.org.')
RCVD_IN_RFCI	RBL	2.280	Received via a relay in ipwhois.rfc-ignorant.org	check_rbl('rfci', 'ipwhois.rfc-ignorant.org.')
RCVD_IN_RSS	RBL	3.000	Received via RSSed relay, see http://www.mail-abuse.org/rss/	check_rbl('relay', 'relays.mail-abuse.org.')
RCVD_IN_SBL	RBL	3.180	Received via SBLed relay, see http://www.spamhaus.org/sbl/	check_rbl('relay', 'sbl.spamhaus.org.')
RCVD_IN_UNCONFIRMED_DSBL	RBL	0.770	Received via a relay in unconfirmed.dsbl.org	check_rbl('relay', 'unconfirmed.dsbl.org')
RCVD_IN_VISI	RBL	2.620	Received via a relay in relays.visi.com	check_rbl('relay', 'relays.visi.com.')
READ_TO_END	BODY	0.673	You'd better read all of this spam!	/read this (?:e-?mail )?to the end/i
REFERENCES	EOH	-0.522	Has a valid-looking References header	(__REFERENCES && !__MANY_USER_AGENTS)
REFINANCE	BODY	0.611	Refinance Home	/\brefinance.{0,6} home\b|\bhome loan\b/i
REFINANCE_YOUR_HOME	BODY	1.552	'Refinance your home'	/\brefinance your (?:current)? (?:home|house)\b/i
REG_THANKS	BODY	-1.152	Something about registration	/\bThank you for registering\b/i
RELAYING_FRAME	EOB	0.201	Frame wanted to load outside URL	html_test('relaying_frame')
REMOVAL_INSTRUCTIONS	BODY	0.414	Gives instructions for removal from list	/\b(?:REMOVAL|UNSUBSCRIBE) INSTRUCTIONS/i
REMOVE_IN_QUOTES	BODY	0.403	List removal information	/\"remove\"/i
REMOVE_PAGE	URI	0.706	URL of page called 'remove'	/^https?:\/\/[^\/]+\/.*?remove/
REMOVE_SUBJ	BODY	0.849	List removal information	/remove.{1,15}subject/i
REPLY_REMOVE_SUBJECT	BODY	0.525	List removal information	/reply.{1,15}remove.{1,15}subject/i
REPLY_TO_EMPTY	Reply-To	1.000	Reply-To: is empty	/^\s*$/
RESENT_TO	Resent-To	-0.200	Found a Resent-To header	/./
RESERVES_RIGHT	BODY	0.008	Reserves the right	/\breserves the right\b/i
RESISTANCE_IS_FUTILE	BODY	0.727	Resistance to this spam is futile	/Replying to this email will not unsubscribe you./i
REVERSE_AGING	BODY	3.371	Reverses Aging	/\breverses? aging\b/i
RICH	BODY	1.977	If only it were that easy	/\b(?:make you rich|get rich quick)\b/i
RISK_FREE	BODY	0.009	Risk free. Suuurreeee....	/\b(?:risk[ -]free|no[ -]risk)/i
ROUND_THE_WORLD	EOH	2.800	Received: says mail bounced all around the world	check_for_round_the_world_received()
SAFEGUARD_NOTICE	RAWBODY	1.000	Contains signature of unregistered spam tool	/This safeguard is not inserted when using the registered version/s
SALE	BODY	0.211	Stuff on Sale	/\bsales? (?:price|system|department|technology|ends|today)|\b(?:on|summer|movie|clearance|for|your|increase|super|losing|return|business|airfare) (?-i:S)ales?/i
SATISFACTION	BODY	0.321	Satisfaction Guaranteed	/\bsatisfaction .{0,9}g(?:ua|au)ranteed|not .{0,9}satisfied\b/i
SAVE_BUCKS	BODY	0.229	Save $$$	/\bsave \$/i
SAVE_MONEY	BODY	0.315	Save big money	/\bsave .{0,9}(?:money|thousands|millions|up to)\b/i
SAVE_ON_INSURANCE	BODY	0.658	Trying to sell insurance online	/\bsave .{0,20}\bon (?:your\s+)?(?:auto|car|life|health|medical)? ?insurance\b/i
SAVE_THOUSANDS	BODY	1.009	Save big money	/\bsave (?:thousands|millions)\b/i
SAVE_UP_TO	BODY	0.313	Save Up To	/\b(?-i:S)ave up to\b/i
SAVINGS	Subject	0.414	Subject talks about savings	/\bsave\s+(?:on\s+your|up\s+to|big|over|at\s+least|\d+\%|you)\b/i
SCAMMY_INPUT_FORM1	RAWEOB	4.000	asking for a password in an email form	/(?si)<input\b.*\btype=(?:"[^"]*|\S*)\bpassword/
SCAMMY_INPUT_FORM2	EOB	4.000	asking for bank account info in an email form	html_scam('bank_info')
SCAMMY_INPUT_FORM3	EOB	4.000	asking for credit card info in an email form	html_scam('credit_card_info')
SEARCH_ENGINE_PROMO	BODY	2.088	Discusses search engine listings	/\b(?:(?:submitt?|list)(?:ed|ing|s)?|place(?:d|ment))\b.{0,15}\b(?:in|to).{0,15}\b(?:search(?:ing)?\s*(?:engine|site)|director(?:y|ies))s?\b/is
SECRET_RECORD	BODY	1.523	Secretly Recorded	/\bsecretly record/i
SECTION_301	BODY	0.908	Claims compliance with spam regulations	/SECTION.{0,10}301/i
SEDUCTION	BODY	1.363	Score with babes!	/\b(?:seduc|attract).{0,8} (?:ebook|opposite sex|women)\b/i
SEE_FOR_YOURSELF	BODY	0.676	See for yourself	/See (?:for|it) yourself\b/i
SENT_IN_COMPLIANCE	BODY	1.231	Claims compliance with spam regulations	/(e.?mail|message) .{0,10}sen[dt] in (\w{1,10} )?compliance (?:of|with)/i
SERIOUS_CASH	BODY	1.995	Serious cash	/\bserious cash\b/i
SERIOUS_ONLY	BODY	2.362	Serious Enquiries Only.	/Serious [IE]nquiries Only/i
SEX_FEST	BODY	0.448	Possible porn - Porn Fest	/\b(?:sex|gay|slut|whore|cum|f[\.\*u][\.\*c]k|suck|adult|xxx|teen)[ -]?fest\b/i
SHOPPING_SPREE	BODY	0.014	Shopping Spree	/\bshopping spree\b/i
SHORT_RECEIVED_LINE	Received	1.000	'Received:' contains huge hostname	/\S{120,}/s
SIGNATURE_LONG_DENSE	RAWEOB	-3.127	Long signature present (no empty lines)	check_signature('8', '15', '0')
SIGNATURE_LONG_SPARSE	RAWEOB	-0.304	Long signature present (empty lines)	check_signature('8', '15', '1')
SIGNATURE_SHORT_DENSE	RAWEOB	-0.301	Short signature present (no empty lines)	check_signature('1', '7', '0')
SIGNATURE_SHORT_SPARSE	RAWEOB	-2.092	Short signature present (empty lines)	check_signature('1', '7', '1')
SIGN_UP	BODY	0.224	Sign up Free Today	/\b(?:free sign up|sign up today)\b/i
SLASH_PRICE	BODY	1.000	Slashed Price	/\bslash.{0,2} price/i
SMTPD_IN_RCVD	Received	1.224	Received via SMTPD32 server (SMTPD32-n.n)	/\(SMTPD32-\d+\..+\)/
SOCIAL_SEC_NUMBER	BODY	0.144	Talks about social security numbers	/social security (?:number|record)/i
SPAM_FORM	RAWBODY	0.536	Form for changing email address	/CHANGE EMAIL ADDRESS IN ACTION OF FORM/
SPAM_FORM_ACTION	RAWBODY	1.000	Obfuscated action attribute in HTML form	/action="\&\#\d+;\&\#\d+;\&\#\d+;\&\#\d+;/i
SPAM_FORM_INPUT	RAWBODY	1.000	Form for verifying email address	/<input name=.{0,5}submit.{0,99} Submit By E-Mail /i
SPAM_FORM_RETURN	RAWBODY	1.690	Form for checking email address	/return validate_form/
SPAM_PHRASE_00_01	EOB	0.781	Spam phrases score is 00 to 01 (low)	check_for_spam_phrases('00', '01')
SPAM_PHRASE_01_02	EOB	0.500	Spam phrases score is 01 to 02 (low)	check_for_spam_phrases('01', '02')
SPAM_PHRASE_02_03	EOB	0.758	Spam phrases score is 02 to 03 (medium)	check_for_spam_phrases('02', '03')
SPAM_PHRASE_03_05	EOB	1.084	Spam phrases score is 03 to 05 (medium)	check_for_spam_phrases('03', '05')
SPAM_PHRASE_05_08	EOB	1.640	Spam phrases score is 05 to 08 (medium)	check_for_spam_phrases('05', '08')
SPAM_PHRASE_08_13	EOB	1.385	Spam phrases score is 08 to 13 (medium)	check_for_spam_phrases('08', '13')
SPAM_PHRASE_13_21	EOB	1.337	Spam phrases score is 13 to 21 (high)	check_for_spam_phrases('13', '21')
SPAM_PHRASE_21_34	EOB	1.856	Spam phrases score is 21 to 34 (high)	check_for_spam_phrases('21', '34')
SPAM_PHRASE_34_55	EOB	2.516	Spam phrases score is 34 to 55 (high)	check_for_spam_phrases('34', '55')
SPAM_PHRASE_55_XX	EOB	0.505	Spam phrases score 55 or higher (high)	check_for_spam_phrases('55', 'undef')
SPAM_REDIRECTOR	URI	0.404	Uses open redirection service	/https?\:.*(?:rd\.yahoo\.com|wwp\.icq\.com)/is
STOCK_ALERT	BODY	2.668	Offers a stock alert	/stock alert/i
STOCK_PICK	BODY	0.746	Offers a stock pick	/STOCK PICK/i
STOP_SNORING	BODY	3.261	Contains 'Stop Snoring'	/\bstop\s+snoring\b/i
STRONG_BUY	BODY	0.406	Tells you about a strong buy	/strong buy/i
SUBJECT_FREQ	Subject	-0.725	Subject contains a frequency - probable newsletter	/\b(?:monday|daily|weekly|monthly)\b/i
SUBJECT_HAS_DATE	Subject	-1.596	Subject contains a date	/1?\d[-\/][1-3]?\d[-\/](?:20)?0\d/
SUBJECT_IS_IN_REVIEW	Subject	-1.000	Subject contains newsletter header (in review)	/\bin review\b/i
SUBJECT_IS_LIST	Subject	-0.217	Subject contains newsletter header (list)	/\blist\b/i
SUBJECT_IS_NEWS	Subject	-0.616	Subject contains newsletter header (news)	/\bnews\b/i
SUBJECT_MONTH	Subject	-0.484	Subject contains a month name - probable newsletter	/\b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|June?|July?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b/
SUBJECT_MONTH_2	Subject	-0.484	Subject contains a month name - probable newsletter (2)	/\b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|June?|July?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b/i
SUBJ_2_CREDIT	BODY	1.640	Contains 'subject to credit approval'	/subject to credit approval/i
SUBJ_ALL_CAPS	Subject	0.483	Subject is all capitals	subject_is_all_caps()
SUBJ_DOLLARS	Subject	1.098	Subject starts with dollar amount	/^\$[0-9.,]+\b/
SUBJ_ENDS_IN_SPACE	Subject	0.414	Subject ends with lots of white space	/(?:[ ]{6}|\t)$/
SUBJ_FREE_CAP	Subject	0.428	Subject contains 'FREE' in CAPS	/FRE{2,}|F.R.E.E\b/
SUBJ_FULL_OF_8BITS	EOH	3.801	Subject is full of 8-bit characters	check_subject_for_lotsa_8bit_chars()
SUBJ_GUARANTEED	Subject	0.622	Subject GUARANTEED	/^guaranteed|(?-i:GUARANTEE)/i
SUBJ_HAS_SPACES	Subject	2.639	Subject contains lots of white space	/(?:\s{6}|\t\s|\s\t)\S/
SUBJ_HAS_UNIQ_ID	EOH	1.148	Subject contains a unique ID	check_for_unique_subject_id()
SUBJ_MISSING	EOH	0.336	Subject: is empty or missing	(__SUBJ_MISSING)
SUBJ_REMOVE	BODY	0.722	List removal information	/\w.{0,40}subject.{1,15}remove/i
SUB_FREE_OFFER	Subject	0.302	Subject starts with 'Free'	/^fre{2,}\b/i
SUB_HELLO	Subject	1.578	Subject starts with 'Hello'	/^hello\b/i
SUPERLONG_LINE	RAWBODY	0.009	Contains a line >=199 characters long	/^[^<\&]{199,}$/m
SUPPLIES_LIMITED	BODY	0.401	Supplies are Limited	/\bsupplies are limited\b/i
SUSPECT_LIST_HEADERS	EOH	-0.196	Mailing list headers are suspicious	suspect_list_headers()
SUSPICIOUS_RECIPS	Cc	0.931	To: and Cc: contain similar domains at least 8 times	/(@[-a-z0-9_.]{2,}).*(?:\1.*){8,}/is
S_1618	BODY	1.459	Claims compliance with Senate Bill 1618	/S..{0,10}1618.{0,10}-.{0,10}SECTION.{0,10}301/i
TABLE_THICK_BORDER	EOB	0.406	HTML table has thick border	html_test('thick_border')
TAKE_ACTION_NOW	BODY	2.203	Tells you to 'take action now!'	/take action now!/i
TARGETED	BODY	0.952	Targeted Traffic / Email Addresses	/\btargeted (?:traffic|e-?mail|internet|leads?)\b/i
THE_BEST_RATE	BODY	0.506	The best Rates	/\bthe best rate/i
THE_FOLLOWING_FORM	BODY	0.424	Asks you to fill out a form	/the following form\b/i
THIS_AINT_JUNK	BODY	1.000	Claims 'This is not junk email'	/This.{0,30}is not (?:a )?junk (?:email)?/is
THIS_AINT_SPAM	BODY	0.431	Claims 'This is not spam'	/This.{0,30}is not (?:a )?spam/is
TONER	BODY	0.666	Contains 'Toner Cartridge'	/\b(?:toner|ink(?:[-\s]*jet)?|fax|copier)[-\s]+cartridge/i
TO_ADDRESS_EQ_REAL	To	0.222	To: repeats address as real name	/^\s*"([^"@]+\@[^"@]+)"\s+<\1>\s*$/i
TO_BE_REMOVED_REPLY	BODY	0.448	Says: 'to be removed, reply via email' or similar	/\bto\b.{0,20}\b(?:remove|unsubscribe|opt[ -]?out).{0,20}\b(?:reply|send)\b/is
TO_EMPTY	To	1.000	To: is empty	/^\s*$/
TO_INVESTORS	To	1.000	To: non-existent 'Investors' address	/\bInvestors\@/
TO_LOCALPART_EQ_REAL	To	-0.298	To: repeats local-part as real name	/^\s*(\"?)([\w%\+\-=_\.]+)\1\s*<\2\@[\w%\+\-=_\.]+>/i
TO_MALFORMED	To	0.594	To: has a malformed address	! /(?:(?:\"[^\"]+\"|\S+)\@\S+\.\S+|undisclosed-recipients:|<\S+(?:\!\S+){1,}>|^\s*$)/
TO_NO_USER	To	1.744	To: has no local-part before @ sign	/(?:^\@|<\@| \@[^<]*$|<>)/
TO_RECIP_MARKER	To	2.842	To header contains 'recipient' marker	/\#recipient\#/
TRACE_BY_SSN	BODY	1.639	Talks about tracing by SSN	/Trace anyone by social security number/i
TRACKER_ID	BODY	1.253	Incorporates a tracking ID number	/^[a-z0-9]{6,24}[-_a-z0-9]{12,36}[a-z0-9]{6,24}\s*\z/is
TRACK_NUMBER	BODY	-1.000	Talks about tracking numbers	/\bassign.{1,100}\b(?:ticket|tracking) number/i
UCE_MAIL_ACT	BODY	2.800	Mentions Spam Law 'UCE-Mail Act'	/Unsolicited Commercial Electronic Mail Act/
UNCLAIMED_MONEY	BODY	1.057	People just leave money laying around	/\bunclaimed (?:funds|money|prizes?|rewards?)\b/i
UNIVERSITY_DIPLOMAS	BODY	2.456	University Diplomas	/\b(?:college|university)\s+diplomas/i
UNLIMITED	BODY	0.904	Unlimited in caps	/UNLIMITED/
UNNEEDED_HTML_ENCODING	RAWBODY	1.038	Unneeded encoding of HTML tags	/font=3E/i
UNSECURED_CREDIT	BODY	0.506	Unsecured Credit/Debt	/\bunsecured.{0,10}(?:master ?card|visa|credit|loans|debt)\b/i
UNSUB_PAGE	URI	0.103	URL of page called 'unsubscribe'	/^https?:\/\/.*?(?!cgi).*?unsubscribe/i
UNSUB_SCRIPT	URI	0.321	URL of CGI script called 'unsubscribe' or 'remove'	/^https?:\/\/.*?cgi.*?(?:unsubscribe|remove)/i
UPPERCASE_25_50	EOM	1.257	message body is 25-50% uppercase	(!__ISO_2022_JP_DELIM && __UPPERCASE_25_50)
UPPERCASE_50_75	EOM	0.200	message body is 50-75% uppercase	(!__ISO_2022_JP_DELIM && __UPPERCASE_50_75)
UPPERCASE_75_100	EOM	1.397	message body is 75-100% uppercase	(!__ISO_2022_JP_DELIM && __UPPERCASE_75_100)
URGENT_BIZ	BODY	1.131	Contains 'URGENT BUSINESS'	/urgent.{0,16}(?:assistance|business|buy|confidential|notice|proposal|reply|request|response)/i
URI_HEAVY	EOB	1.000	URI-to-plaintext ratio is greater than 0.5	uri_percentage('0.5')
URI_IS_POUND	URI	1.000	Filename is just a '#'; probably a JS trick	/#$/
USERNAME_IN_SUBJECT	EOH	2.858	To: username at front of subject	check_for_to_in_subject(3)
USER_4U2	BODY	0.443	Local part containing a '4u' variant	/\b\S{0,20}(?:[^0-9][42](?:yo)?u|for-*you)(?:[.-]\S{1,20})?\@\S{1,20}\.(?:net|com|org|info)\b/
USER_AGENT	EOH	0.000	Found a User-Agent header	(__USER_AGENT && !__MANY_USER_AGENTS)
USER_AGENT_AOL	EOH	0.000	X-Mailer header indicates a non-spam MUA (AOL)	(__USER_AGENT_AOL && !__MANY_USER_AGENTS)
USER_AGENT_APPLEMAIL	EOH	0.000	X-Mailer header indicates a non-spam MUA (Apple Mail)	(__USER_AGENT_APPLEMAIL && !__MANY_USER_AGENTS)
USER_AGENT_ENTOURAGE	EOH	0.000	User-Agent header indicates a non-spam MUA (Entourage)	(__USER_AGENT_ENTOURAGE && !__MANY_USER_AGENTS)
USER_AGENT_GNUS_UA	EOH	0.000	User-Agent header indicates a non-spam MUA (Gnus)	(__USER_AGENT_GNUS_UA && !__MANY_USER_AGENTS)
USER_AGENT_GNUS_XM	EOH	0.000	X-Mailer header indicates a non-spam MUA (Gnus)	(__USER_AGENT_GNUS_XM && !__MANY_USER_AGENTS)
USER_AGENT_IMP	EOH	0.000	User-Agent header indicates a non-spam MUA (IMP)	(__USER_AGENT_IMP && !__MANY_USER_AGENTS)
USER_AGENT_INCREDIMAIL	EOH	-2.000	X-Mailer header indicates a non-spam MUA (Incredimail)	(__USER_AGENT_INCREDIMAIL && !__MANY_USER_AGENTS)
USER_AGENT_KMAIL	EOH	0.000	User-Agent header indicates a non-spam MUA (KMail)	(__USER_AGENT_KMAIL && !__MANY_USER_AGENTS)
USER_AGENT_MACOE	EOH	0.000	User-Agent header indicates a non-spam MUA (Outlook Express)	(__USER_AGENT_MACOE && !__MANY_USER_AGENTS)
USER_AGENT_MOZILLA_UA	EOH	0.000	User-Agent header indicates a non-spam MUA (Mozilla)	(__USER_AGENT_MOZILLA_UA && !__MANY_USER_AGENTS)
USER_AGENT_MOZILLA_XM	EOH	0.000	X-Mailer header indicates a non-spam MUA (Netscape)	(__USER_AGENT_MOZILLA_XM && !__MANY_USER_AGENTS)
USER_AGENT_MUTT	EOH	0.000	User-Agent header indicates a non-spam MUA (Mutt)	(__USER_AGENT_MUTT && !__MANY_USER_AGENTS)
USER_AGENT_OE	EOH	0.000	X-Mailer header indicates a non-spam MUA (Outlook Express)	(__USER_AGENT_OE && !__MANY_USER_AGENTS)
USER_AGENT_OUTLOOK	EOH	0.000	X-Mailer header indicates a non-spam MUA (Outlook)	(__USER_AGENT_OUTLOOK && !__MANY_USER_AGENTS)
USER_AGENT_PINE	EOH	0.000	Message-Id indicates a non-spam MUA (Pine)	(__USER_AGENT_PINE && !__MANY_USER_AGENTS)
USER_AGENT_THEBAT	EOH	0.000	X-Mailer header indicates a non-spam MUA (The Bat!)	(__USER_AGENT_THEBAT && !__MANY_USER_AGENTS)
USER_AGENT_TONLINE	EOH	0.000	X-Mailer header indicates a non-spam MUA (T-Offline)	(__USER_AGENT_TONLINE && !__MANY_USER_AGENTS)
US_DOLLARS	BODY	1.952	Nigerian scam key phrase (million dollars)	/\b(?:\d{1,3})?Million\b.{0,40}\b(?:(?:United States?|Canadian) Dollar?s?|US(?:D|\$)|U\.? ?S\.? Dollar)/i
US_DOLLARS_2	BODY	0.127	Nigerian scam key phrase ($NNN.N m/USDNNN.N m/US$NN.N m)	/\s(?:\$|US\$|usd?).?\d{2,3}(?:\.\d)?.?(?:m|millions?)\b/i
US_DOLLARS_3	BODY	0.400	Nigerian scam key phrase ($NN,NNN,NNN.NN)	/(?:\$|usd).?\d{1,3}[,.]\d{3}[,.]\d{3}(?:[,.]\d\d)?/i
US_DOLLARS_4	BODY	0.431	Nigerian scam key phrase ($NNN.N m/USDNNN.N m/US$NN.N m)	/\s(?:\$|US\$|usd?).?\d{1,3}\.\d+.?(?:m|millions?)\b/i
VACATION_SCAM	BODY	0.503	Vacation Offers	/\b(?:free|mini-?|dream|special).{0,10}vacation|vacation (?:offer|promotion|package|for two|getaway)/i
VAR_REF_IN_RECEIVED	Received	0.910	Received contains a $variable reference	/from \$\S+ \(/
VERY_SUSP_RECIPS	To	0.326	To: and Cc: contain similar usernames at least 5 times	check_for_susp_recips(10)
VIAGRA	BODY	1.394	Plugs Viagra	/VIAGRA/
VIAGRA_COMBO	BODY	1.984	Viagra and other drugs	/\bviagra .{0,15}(?:phentermine|xenical|tenuate|zyban|propecia)\b/i
VIAGRA_OBFU	BODY	2.000	Obfuscated Viagra	/v.i.a.g.r.a|generic sildenafil citrate|v1agra/i
VIAGRA_ONLINE	BODY	0.863	Fast Viagra Delivery	/\bviagra .{0,25}(?:express|online|overnight)/i
VJESTIKA	BODY	1.302	Contains 'Vjestika Aphrodisia'	/Vjestika Aphrodisia/i
WANTS_CREDIT_CARD	BODY	2.879	Asks for credit card details	/\bcredit.?card\s+order/i
WEALTH	BODY	1.000	Achieve Wealth	/\bachieve .{0,15}wealth\b/i
WEB_BUGS	EOB	2.000	Image tag with an ID code to identify you	html_test('web_bugs')
WEIRD_PORT	URI	1.187	Uses non-standard port number for HTTP	/https?:\/\/[^\/:\s]+:\d+/
WE_HATE_SPAM	BODY	2.052	Says 'We strongly oppose the use of spam email'	/We .{0,30}oppose the use of SPAM/is
WE_HONOR_ALL	BODY	3.283	Claims to honor removal requests	/we (?:honou?r|respect)(?: all)? remov(?:e|al) requests/i
WE_PROMISE_YOU	BODY	2.145	Promise you ...!	/\bwe promise .{0,9}you/i
WHILE_SUPPLIES	BODY	0.304	While Supplies Last	/\bwhile supplies last\b/i
WHILE_YOU_SLEEP	BODY	1.201	While you Sleep	/\bwhile you sleep\b/i
WHY_PAY_MORE	BODY	1.119	Why Pay More?	/\bwhy pay more\b/i
WHY_WAIT	BODY	0.329	What are you waiting for	/\b(?:why wait|what are you waiting for)\b/i
WINNER	BODY	0.320	Claims you are a winner	/\byou.{0,4} a winner|register to win/i
WINNER_CAP	BODY	0.204	Winner in Caps	/WINNER/
WINNING_CAP	BODY	0.211	Winning in Caps	/WINNING/
WORK_AT_HOME	BODY	0.365	Information on how to work at home (1)	/\b(?:WORK|(?:MAKE|EARN).{1,10}(?:MONEY|\$+|BUCKS|CASH)).{1,10}(?:AT|FROM) (?:YOUR )?HOME/i
WRINKLES	BODY	2.693	Removes Wrinkles	/\bwrinkle reduction\b/i
X_ACCEPT_LANG	X-Accept-Language	-0.215	Found a X-Accept-Language header	/./
X_AUTH_WARNING	X-Authentication-Warning	-0.207	Found a X-Authentication-Warning header	/./
X_ENC_PRESENT	X-Encoding	2.720	Found a X-Encoding header	/./
X_ESMTP	x-esmtp	0.320	Found a x-esmtp header	/./
X_FIX_PRESENT	X-Fix	1.000	Found a X-Fix header	/./
X_LIBRARY	X-Library	2.180	Found a X-Library header	/./
X_LIST_UNSUBSCRIBE	X-List-Unsubscribe	1.110	Found a X-List-Unsubscribe header	/./
X_LOOP	X-Loop	-0.233	Found a X-Loop header	/./
X_MAILER_GIBBERISH	X-Mailer	1.591	'X-Mailer' line contains gibberish	/^[A-Fa-f0-9\.]{48,}$/
X_MAILING_LIST	X-Mailing-List	-0.302	Found a X-Mailing-List header	/./
X_MAIL_ID_PRESENT	X-MailingID	0.426	Found a X-MailingID header	/./
X_MSMAIL_PRIORITY_HIGH	X-Msmail-Priority	0.429	Sent with 'X-Msmail-Priority' set to high	/^High/
X_OSIRU_DUL	RBL	0.620	DNSBL: sender ip address in a dialup block	check_rbl_results_for('osirusoft', '127.0.0.3')
X_OSIRU_DUL_FH	RBL	0.360	Received from first hop dialup listed in relays.osirusoft.com	check_rbl('osirusoft-dul-firsthop', 'relays.osirusoft.com.')
X_OSIRU_OPEN_RELAY	RBL	2.720	DNSBL: sender is Confirmed Open Relay	check_rbl_results_for('osirusoft', '127.0.0.2')
X_OSIRU_SPAMWARE_SITE	RBL