C#, PHP, SQL: Spamassassin Rules

looking for a brokerage account or IRA... click here

SpamAssassin is an Apache program used to filter spam from incoming e-mail. I supports DNS-based, checksum-based, and statistical filtering.

Element	Code	Description
body	GTUBE	Generic Test for Unsolicited Bulk Email
body	TRACKER_ID	Incorporates a tracking ID number
body	WEIRD_QUOTING	Weird repeated double-quotation marks
rawbody	MIME_BASE64_BLANKS	Extra blank lines in base64 encoding
rawbody	MIME_BASE64_NO_NAME	base64 attachment does not have a file name
rawbody	MIME_BASE64_TEXT	Message text disguised using base64 encoding
rawbody	MIME_MISSING_BOUNDARY	MIME section missing boundary
body	MISSING_MIME_HB_SEP	Missing blank line between MIME header and body
body	MIME_HTML_MOSTLY	Multipart message mostly text/html MIME
body	MIME_HTML_ONLY	Message only has text/html MIME parts
rawbody	MIME_QP_LONG_LINE	Quoted-printable line longer than 76 chars
body	MPART_ALT_DIFF	HTML and text parts are different
body	MPART_ALT_DIFF_COUNT	HTML and text parts are different
body	MIME_BAD_ISO_CHARSET	MIME character set is an unknown ISO charset
body	CHARSET_FARAWAY	Character set indicates a foreign language
body	EMAIL_ROT13	Body contains a ROT13-encoded email address
body	BLANK_LINES_70_80	Message body has 70-80% blank lines
body	BLANK_LINES_80_90	Message body has 80-90% blank lines
body	BLANK_LINES_90_100	Message body has 90-100% blank lines
body	UNIQUE_WORDS	Message body has many words used only once
body	DOMAIN_RATIO	Message body mentions many internet domains
body	HTTPS_IP_MISMATCH	IP to HTTPS link found in HTML
rawbody	INTERRUPTUS	Message looks to contain HTML-interrupted text
body	MULTIPART_ALT_NON_TEXT	eval:check_ma_non_text()
header	ALL_TRUSTED	Passed through trusted hosts only via SMTP
header	NO_RELAYS	Informational: message was not relayed via SMTP
header	RCVD_IN_NJABL_RELAY	NJABL: sender is confirmed open relay
header	RCVD_IN_NJABL_DUL	NJABL: dialup sender did non-local SMTP
header	RCVD_IN_NJABL_SPAM	NJABL: sender is confirmed spam source
header	RCVD_IN_NJABL_MULTI	NJABL: sent through multi-stage open relay
header	RCVD_IN_NJABL_CGI	NJABL: sender is an open formmail
header	RCVD_IN_NJABL_PROXY	NJABL: sender is an open proxy
header	RCVD_IN_SORBS_HTTP	SORBS: sender is open HTTP proxy server
header	RCVD_IN_SORBS_SOCKS	SORBS: sender is open SOCKS proxy server
header	RCVD_IN_SORBS_MISC	SORBS: sender is open proxy server
header	RCVD_IN_SORBS_SMTP	SORBS: sender is open SMTP relay
header	RCVD_IN_SORBS_WEB	SORBS: sender is a abuseable web server
header	RCVD_IN_SORBS_BLOCK	SORBS: sender demands to never be tested
header	RCVD_IN_SORBS_ZOMBIE	SORBS: sender is on a hijacked network
header	RCVD_IN_SORBS_DUL	SORBS: sent directly from dynamic IP address
header	RCVD_IN_SBL	Received via a relay in Spamhaus SBL
header	RCVD_IN_XBL	Received via a relay in Spamhaus XBL
header	DNS_FROM_RFC_DSN	Envelope sender in dsn.rfc-ignorant.org
header	DNS_FROM_RFC_POST	Envelope sender in postmaster.rfc-ignorant.org
header	DNS_FROM_RFC_ABUSE	Envelope sender in abuse.rfc-ignorant.org
header	DNS_FROM_RFC_WHOIS	Envelope sender in whois.rfc-ignorant.org
header	DNS_FROM_RFC_BOGUSMX	Envelope sender in bogusmx.rfc-ignorant.org
header	RCVD_IN_WHOIS_BOGONS	CompleteWhois: sender on bogons IP block
header	RCVD_IN_WHOIS_HIJACKED	CompleteWhois: sender on hijacked IP block
header	RCVD_IN_WHOIS_INVALID	CompleteWhois: sender on invalid IP block
header	RCVD_IN_DSBL	Received via a relay in list.dsbl.org
header	DNS_FROM_AHBL_RHSBL	From: sender listed in dnsbl.ahbl.org
header	DNS_FROM_SECURITYSAGE	Envelope sender in blackholes.securitysage.com
header	RCVD_IN_BL_SPAMCOP_NET	Received via a relay in bl.spamcop.net
header	RCVD_IN_MAPS_RBL	Relay in RBL, http://www.mail-abuse.org/rbl/
header	RCVD_IN_MAPS_DUL	Relay in DUL, http://www.mail-abuse.org/dul/
header	RCVD_IN_MAPS_RSS	Relay in RSS, http://www.mail-abuse.org/rss/
header	RCVD_IN_MAPS_NML	Relay in NML, http://www.mail-abuse.org/nml/
header	RCVD_IN_BSP_TRUSTED	Sender is in Bonded Sender Program (trusted relay)
header	RCVD_IN_BSP_OTHER	Sender is in Bonded Sender Program (other relay)
header	RCVD_IN_IADB_VOUCHED	ISIPP IADB lists as vouched-for sender
header	HABEAS_ACCREDITED_COI	Habeas Accredited Confirmed Opt-In or Better
header	HABEAS_ACCREDITED_SOI	Habeas Accredited Opt-In or Better
header	HABEAS_CHECKED	Habeas Checked
header	SUBJECT_DRUG_GAP_C	Subject contains a gappy version of 'cialis'
header	SUBJECT_DRUG_GAP_L	Subject contains a gappy version of 'levitra'
header	SUBJECT_DRUG_GAP_P	Subject contains a gappy version of 'phentermine'
header	SUBJECT_DRUG_GAP_S	Subject contains a gappy version of 'soma'
header	SUBJECT_DRUG_GAP_VA	Subject contains a gappy version of 'valium'
header	SUBJECT_DRUG_GAP_VIC	Subject contains a gappy version of 'vicodin'
header	SUBJECT_DRUG_GAP_X	Subject contains a gappy version of 'xanax'
body	DRUG_DOSAGE	Talks about price per dose
body	DRUG_ED_CAPS	Mentions an E.D. drug
body	DRUG_ED_COMBO	Viagra and other drugs
body	DRUG_ED_SILD	Talks about an E.D. drug using its chemical name
body	DRUG_ED_GENERIC	Mentions Generic Viagra
body	DRUG_ED_ONLINE	Fast Viagra Delivery
body	DEEP_DISC_MEDS	Deep discount medications
body	ONLINE_PHARMACY	Online Pharmacy
body	NO_PRESCRIPTION	No prescription needed
body	VIA_GAP_GRA	Attempts to disguise the word 'viagra'
body	DRUGS_SMEAR1	Two or more drugs crammed together into one word
header	FAKE_HELO_MSN	Host HELO did not match rDNS: msn.com
header	FAKE_HELO_MAIL_COM	Host HELO did not match rDNS: mail.com
header	FAKE_HELO_EMAIL_COM	Host HELO did not match rDNS: email.com
header	FAKE_HELO_EUDORAMAIL	Host HELO did not match rDNS: eudoramail.com
header	FAKE_HELO_EXCITE	Host HELO did not match rDNS: excite.com
header	FAKE_HELO_LYCOS	Host HELO did not match rDNS: lycos.com
header	FAKE_HELO_YAHOO_CA	Host HELO did not match rDNS: yahoo.ca
header	FAKE_HELO_MAIL_COM_DOM	Relay HELO'd with suspicious hostname (mail.com)
header	HELO_DYNAMIC_IPADDR	Relay HELO'd using suspicious hostname (IP addr 1)
header	HELO_DYNAMIC_DHCP	Relay HELO'd using suspicious hostname (DHCP)
header	HELO_DYNAMIC_HCC	Relay HELO'd using suspicious hostname (HCC)
header	HELO_DYNAMIC_ATTBI	Relay HELO'd using suspicious hostname (ATTBI.com)
header	HELO_DYNAMIC_ROGERS	Relay HELO'd using suspicious hostname (Rogers)
header	HELO_DYNAMIC_ADELPHIA	Relay HELO'd using suspicious hostname (Adelphia)
header	HELO_DYNAMIC_DIALIN	Relay HELO'd using suspicious hostname (T-Dialin)
header	HELO_DYNAMIC_HEXIP	Relay HELO'd using suspicious hostname (Hex IP)
header	HELO_DYNAMIC_SPLIT_IP	Relay HELO'd using suspicious hostname (Split IP)
header	HELO_DYNAMIC_YAHOOBB	Relay HELO'd using suspicious hostname (YahooBB)
header	HELO_DYNAMIC_OOL	Relay HELO'd using suspicious hostname (OptOnline)
header	HELO_DYNAMIC_IPADDR2	Relay HELO'd using suspicious hostname (IP addr 2)
header	HELO_DYNAMIC_RR2	Relay HELO'd using suspicious hostname (RR 2)
header	HELO_DYNAMIC_COMCAST	Relay HELO'd using suspicious hostname (Comcast)
header	HELO_DYNAMIC_TELIA	Relay HELO'd using suspicious hostname (Telia)
header	HELO_DYNAMIC_VTR	Relay HELO'd using suspicious hostname (VTR)
header	HELO_DYNAMIC_CHELLO_NO	Relay HELO'd using suspicious hostname (Chello.no)
header	HELO_DYNAMIC_CHELLO_NL	Relay HELO'd using suspicious hostname (Chello.nl)
header	HELO_DYNAMIC_VELOX	Relay HELO'd using suspicious hostname (Veloxzone)
header	HELO_DYNAMIC_NTL	Relay HELO'd using suspicious hostname (NTL)
header	HELO_DYNAMIC_HOME_NL	Relay HELO'd using suspicious hostname (Home.nl)
header	HEAD_LONG	Message headers are very long
header	FRAGMENTED_MESSAGE	Partial message
header	MISSING_HB_SEP	Missing blank line between message header and body
header	UNPARSEABLE_RELAY	Informational: message has unparseable relay lines
header	NO_REAL_NAME	From: does not include a real name
header	FROM_BLANK_NAME	From: contains empty name
header	FROM_ENDS_IN_NUMS	From: ends in many numbers
header	FROM_STARTS_WITH_NUMS	From: starts with many numbers
header	FROM_HAS_MIXED_NUMS	From: contains numbers mixed in with letters
header	FROM_HAS_ULINE_NUMS	From: contains an underline and numbers/letters
header	FROM_ALL_NUMS	From numeric address (except US/Canada phones)
header	FROM_OFFERS	From address is "at something-offers"
header	FROM_NO_USER	From: has no local-part before @ sign
header	TO_NO_USER	To: has no local-part before @ sign
header	TO_EMPTY	To: is empty
header	REPLY_TO_EMPTY	Reply-To: is empty
header	TO_ADDRESS_EQ_REAL	To: repeats address as real name
header	UNDISC_RECIPS	Valid-looking To "undisclosed-recipients"
header	FAKED_UNDISC_RECIPS	Faked To "Undisclosed-Recipients"
header	PLING_QUERY	Subject has exclamation mark and question mark
header	SUBJ_HAS_UNIQ_ID	Subject contains a unique ID
header	SUBJ_HAS_SPACES	Subject contains lots of white space
header	SUBJ_ALL_CAPS	Subject is all capitals
header	MSGID_SPAM_99X9XX99	Spam tool Message-Id: (99x9xx99 variant)
header	MSGID_SPAM_ALPHA_NUM	Spam tool Message-Id: (alpha-numeric variant)
header	MSGID_SPAM_CAPS	Spam tool Message-Id: (caps variant)
header	MSGID_SPAM_LETTERS	Spam tool Message-Id: (letters variant)
header	MSGID_SPAM_ZEROES	Spam tool Message-Id: (12-zeroes variant)
header	MSGID_NO_HOST	Message-Id has no hostname
header	MSGID_OUTLOOK_INVALID	Message-Id is fake (in Outlook Express format)
header	MSGID_YAHOO_CAPS	Message-ID has ALLCAPS@yahoo.com
header	MSGID_FROM_MTA_ID	Message-Id for external message added locally
header	MSGID_FROM_MTA_HOTMAIL	Message-Id was added by a hotmail.com relay
header	MSGID_LONG	Message-ID is unusually long
header	MSGID_SHORT	Message-ID is unusually short
header	MSGID_MULTIPLE_AT	Message-ID contains multiple '@' characters
header	DATE_SPAMWARE_Y2K	Date header uses unusual Y2K formatting
header	INVALID_DATE	Invalid Date: header (not RFC 2822)
header	INVALID_DATE_TZ_ABSURD	Invalid Date: header (timezone does not exist)
header	INVALID_TZ_CST	Invalid date in header (wrong CST timezone)
header	INVALID_TZ_EST	Invalid date in header (wrong EST timezone)
header	INVALID_TZ_GMT	Invalid date in header (wrong GMT/UTC timezone)
header	DATE_IN_PAST_03_06	Date: is 3 to 6 hours before Received: date
header	DATE_IN_PAST_06_12	Date: is 6 to 12 hours before Received: date
header	DATE_IN_PAST_12_24	Date: is 12 to 24 hours before Received: date
header	DATE_IN_PAST_24_48	Date: is 24 to 48 hours before Received: date
header	DATE_IN_PAST_48_96	Date: is 48 to 96 hours before Received: date
header	DATE_IN_PAST_96_XX	Date: is 96 hours or more before Received: date
header	DATE_IN_FUTURE_03_06	Date: is 3 to 6 hours after Received: date
header	DATE_IN_FUTURE_06_12	Date: is 6 to 12 hours after Received: date
header	DATE_IN_FUTURE_12_24	Date: is 12 to 24 hours after Received: date
header	DATE_IN_FUTURE_24_48	Date: is 24 to 48 hours after Received: date
header	DATE_IN_FUTURE_48_96	Date: is 48 to 96 hours after Received: date
header	DATE_IN_FUTURE_96_XX	Date: is 96 hours or more after Received: date
header	UNRESOLVED_TEMPLATE	Headers contain an unresolved template
header	SUBJ_ILLEGAL_CHARS	Subject: has too many raw illegal characters
header	FROM_ILLEGAL_CHARS	From: has too many raw illegal characters
header	HEAD_ILLEGAL_CHARS	Headers have too many raw illegal characters
header	SUBJECT_ENCODED_TWICE	Subject: MIME encoded twice
header	ENGLISH_UCE_SUBJECT	Subject contains an English UCE tag
header	JAPANESE_UCE_SUBJECT	Subject contains a Japanese UCE tag
header	KOREAN_UCE_SUBJECT	Subject: contains Korean unsolicited email tag
header	FROM_AND_TO_SAME	From and To are the same, but not exactly
header	FORGED_RCVD_HELO	Received: contains a forged HELO
header	RCVD_HELO_IP_MISMATCH	Received: HELO and IP do not match, but should
header	RCVD_NUMERIC_HELO	Received: contains an IP address used for HELO
header	RCVD_ILLEGAL_IP	Received: contains illegal IP address
header	RCVD_BY_IP	Received by mail server with no name
header	FORGED_AOL_RCVD	Received forged, contains fake AOL relays
header	FORGED_TELESP_RCVD	Contains forged hostname for a DSL IP in Brazil
header	FORGED_HOTMAIL_RCVD	Forged hotmail.com 'Received:' header found
header	FORGED_HOTMAIL_RCVD2	hotmail.com 'From' address, but no 'Received:'
header	FORGED_EUDORAMAIL_RCVD	Forged eudoramail.com 'Received:' header found
header	FORGED_YAHOO_RCVD	'From' yahoo.com does not match 'Received' headers
header	FORGED_JUNO_RCVD	'From' juno.com does not match 'Received' headers
header	FORGED_GW05_RCVD	Forged 'by gw05' 'Received:' header found
header	NONEXISTENT_CHARSET	Character set doesn't exist
header	CHARSET_FARAWAY_HEADER	A foreign language charset used in headers
header	X_PRIORITY_HIGH	Sent with 'X-Priority' set to high
header	X_MSMAIL_PRIORITY_HIGH	Sent with 'X-Msmail-Priority' set to high
header	ROUND_THE_WORLD_LOCAL	Received: says mail sent around the world (HELO)
header	MISSING_DATE	Missing Date: header
header	MISSING_HEADERS	Missing To: header
header	SUSPICIOUS_RECIPS	Similar addresses in recipient list
header	SORTED_RECIPS	Recipient list is sorted by address
header	GAPPY_SUBJECT	Subject: contains G.a.p.p.y-T.e.x.t
header	PREVENT_NONDELIVERY	Message has Prevent-NonDelivery-Report header
header	X_IP	Message has X-IP header
header	X_LIBRARY	Message has X-Library header
header	X_MESSAGE_FLAG_ODD	Message has X-Message-flag header (odd case)
header	SUBJ_AS_SEEN	Subject contains "As Seen"
header	SUBJ_DOLLARS	Subject starts with dollar amount
header	SUBJ_FOR_ONLY	Subject contains "For Only"
header	SUBJ_FREE_CAP	Subject contains "FREE" in CAPS
header	SUB_FREE_OFFER	Subject starts with "Free"
header	SUBJ_GUARANTEED	Subject GUARANTEED
header	SUB_HELLO	Subject starts with "Hello"
header	SUBJ_LIFE_INSURANCE	Subject includes "life insurance"
header	SUBJ_YOUR_DEBT	Subject contains "Your Bills" or similar
header	SUBJ_YOUR_FAMILY	Subject contains "Your Family"
header	SUBJ_YOUR_OWN	Subject contains "Your Own"
header	RCVD_FAKE_HELO_DOTCOM	Received contains a faked HELO hostname
header	ADDRESS_IN_SUBJECT	To: address appears in Subject
header	LOCALPART_IN_SUBJECT	Local part of To: address appears in Subject
header	SUBJECT_DIET	Subject talks about losing pounds
header	EXTRA_MPART_TYPE	Header has extraneous Content-type:...type= entry
header	TO_RECIP_MARKER	To header contains 'recipient' marker
header	MIME_BOUND_DD_DIGITS	Spam tool pattern in MIME boundary
header	MIME_BOUND_DIGITS_7	Spam tool pattern in MIME boundary
header	MIME_BOUND_DIGITS_15	Spam tool pattern in MIME boundary
header	MIME_BOUND_MANY_HEX	Spam tool pattern in MIME boundary
header	MIME_BOUND_RKFINDY	Spam tool pattern in MIME boundary (rfkindy)
header	TO_MALFORMED	To: has a malformed address
header	ADDR_FREE	From Address contains FREE
header	TO_TXT	Sent to a text file
header	CHINA_HEADER	Involves 'china.com'
header	WITH_LC_SMTP	Received line contains spam-sign (lowercase smtp)
header	FROM_NO_LOWER	From address has no lower-case characters
header	SUBJ_BUY	Subject line starts with Buy or Buying
header	RCVD_AM_PM	Received headers forged (AM/PM)
header	HEADER_COUNT_CTYPE	Multiple Content-Type headers found
header	NO_RDNS_DOTCOM_HELO	Host HELO'd as a big ISP, but had no rDNS
header	X_ORIG_IP_NOT_IPV4	X-Originating-IP doesn't look like IPv4 address
header	X_AUTH_WARN_FAKED	X-Authentication-Warning header looks faked
header	FAKE_OUTBLAZE_RCVD	Received header contains faked 'mr.outblaze.com'
header	FROM_NONSENDING_DOMAIN	Message is from domain that never sends email
header	SUBJ_2_NUM_PARENS	Subject contains common spam sign (2 numbers)
header	UNCLOSED_BRACKET	Headers contain an unclosed bracket
header	ORG_MIME_TOOLS	Organization is MIME-tools
header	X_MIME_AUTOCONVERTED	Message has X-MIME-Autoconverted "Yes" header
header	FROM_DOMAIN_NOVOWEL	From: domain has series of non-vowel letters
header	FROM_LOCAL_NOVOWEL	From: localpart has series of non-vowel letters
header	SUBJECT_NOVOWEL	Subject: has long non-vowel letter sequence
header	FROM_LOCAL_HEX	From: localpart has long hexadecimal sequence
header	FROM_LOCAL_DIGITS	From: localpart has long digit sequence
header	X_MAILER_SPAM	X-Mailer: header is bulk email fingerprint
header	X_PRIORITY_CC	Cc: after X-Priority: (bulk email fingerprint)
header	SUBJ_CONSONANTS	Subject contains consecutive consonants in "word"
header	BAD_ENC_HEADER	Message has bad MIME encoding in the header
body	HTML_MESSAGE	HTML included in message
body	HTML_00_10	Message is 0% to 10% HTML
body	HTML_10_20	Message is 10% to 20% HTML
body	HTML_20_30	Message is 20% to 30% HTML
body	HTML_30_40	Message is 30% to 40% HTML
body	HTML_40_50	Message is 40% to 50% HTML
body	HTML_50_60	Message is 50% to 60% HTML
body	HTML_60_70	Message is 60% to 70% HTML
body	HTML_70_80	Message is 70% to 80% HTML
body	HTML_80_90	Message is 80% to 90% HTML
body	HTML_90_100	Message is 90% to 100% HTML
body	HTML_SHOUTING3	HTML has very strong "shouting" markup
body	HTML_SHOUTING4	HTML has very strong "shouting" markup
body	HTML_SHOUTING5	HTML has very strong "shouting" markup
body	HTML_SHOUTING6	HTML has very strong "shouting" markup
body	HTML_SHOUTING7	HTML has very strong "shouting" markup
body	HTML_TEXT_AFTER_HTML	HTML contains text after HTML close tag
body	HTML_TEXT_AFTER_BODY	HTML contains text after BODY close tag
body	HTML_COMMENT_SHORT	HTML comment is very short
body	HTML_COMMENT_SAVED_URL	HTML message is a saved web page
body	HTML_EMBEDS	HTML with embedded plugin object
body	HTML_EVENT_UNSAFE	HTML contains unsafe auto-executing code
body	HTML_EXTRA_CLOSE	HTML contains far too many close tags
body	HTML_FONT_SIZE_TINY	HTML font size is tiny
body	HTML_FONT_SIZE_NONE	HTML font size is negative
body	HTML_FONT_SIZE_LARGE	HTML font size is large
body	HTML_FONT_SIZE_HUGE	HTML font size is huge
body	HTML_FONT_BIG	HTML tag for a big font size
body	HTML_FONT_TINY	HTML tag for a tiny font size
body	HTML_FONT_INVISIBLE	HTML font color is same as background
body	HTML_FONT_LOW_CONTRAST	HTML font color similar to background
body	HTML_FONT_FACE_BAD	HTML font face is not a word
body	HTML_FONT_FACE_CAPS	HTML font face has excess capital characters
body	HTML_FORMACTION_MAILTO	HTML includes a form which sends mail
body	HTML_IMAGE_ONLY_04	HTML: images with 0-400 bytes of words
body	HTML_IMAGE_ONLY_08	HTML: images with 400-800 bytes of words
body	HTML_IMAGE_ONLY_12	HTML: images with 800-1200 bytes of words
body	HTML_IMAGE_ONLY_16	HTML: images with 1200-1600 bytes of words
body	HTML_IMAGE_ONLY_20	HTML: images with 1600-2000 bytes of words
body	HTML_IMAGE_ONLY_24	HTML: images with 2000-2400 bytes of words
body	HTML_IMAGE_ONLY_28	HTML: images with 2400-2800 bytes of words
body	HTML_IMAGE_ONLY_32	HTML: images with 2800-3200 bytes of words
body	HTML_IMAGE_RATIO_02	HTML has a low ratio of text to image area
body	HTML_IMAGE_RATIO_04	HTML has a low ratio of text to image area
body	HTML_IMAGE_RATIO_06	HTML has a low ratio of text to image area
body	HTML_IMAGE_RATIO_08	HTML has a low ratio of text to image area
body	HTML_LINK_PUSH_HERE	HTML link text says "push here" or similar
body	HTML_LINK_OPT_OUT	HTML link text says "opt out" or similar
body	HTML_OBFUSCATE_05_10	Message is 5% to 10% HTML obfuscation
body	HTML_OBFUSCATE_10_20	Message is 10% to 20% HTML obfuscation
body	HTML_OBFUSCATE_20_30	Message is 20% to 30% HTML obfuscation
body	HTML_OBFUSCATE_30_40	Message is 30% to 40% HTML obfuscation
body	HTML_OBFUSCATE_40_50	Message is 40% to 50% HTML obfuscation
body	HTML_OBFUSCATE_50_60	Message is 50% to 60% HTML obfuscation
body	HTML_OBFUSCATE_60_70	Message is 60% to 70% HTML obfuscation
body	HTML_OBFUSCATE_70_80	Message is 70% to 80% HTML obfuscation
body	HTML_OBFUSCATE_80_90	Message is 80% to 90% HTML obfuscation
body	HTML_OBFUSCATE_90_100	Message is 90% to 100% HTML obfuscation
body	HTML_BACKHAIR_2	HTML tags used to obfuscate words
body	HTML_BACKHAIR_4	HTML tags used to obfuscate words
body	HTML_BACKHAIR_8	HTML tags used to obfuscate words
body	HTML_ATTR_BAD	HTML has many bad attributes in tags
body	HTML_ATTR_UNIQUE	HTML appears to have random attributes in tags
body	HTML_TAG_BALANCE_BODY	HTML has unbalanced "body" tags
body	HTML_TAG_BALANCE_HEAD	HTML has unbalanced "head" tags
body	HTML_TAG_EXIST_BGSOUND	HTML has "bgsound" tag
body	HTML_TAG_EXIST_MARQUEE	HTML has "marquee" tag
body	HTML_TAG_EXIST_TBODY	HTML has "tbody" tag
body	HTML_BADTAG_00_10	HTML message is 0% to 10% bad tags
body	HTML_BADTAG_10_20	HTML message is 10% to 20% bad tags
body	HTML_BADTAG_20_30	HTML message is 20% to 30% bad tags
body	HTML_BADTAG_30_40	HTML message is 30% to 40% bad tags
body	HTML_BADTAG_40_50	HTML message is 40% to 50% bad tags
body	HTML_BADTAG_50_60	HTML message is 50% to 60% bad tags
body	HTML_BADTAG_60_70	HTML message is 60% to 70% bad tags
body	HTML_BADTAG_70_80	HTML message is 70% to 80% bad tags
body	HTML_BADTAG_80_90	HTML message is 80% to 90% bad tags
body	HTML_BADTAG_90_100	HTML message is 90% to 100% bad tags
body	HTML_NONELEMENT_00_10	0% to 10% of HTML elements are non-standard
body	HTML_NONELEMENT_10_20	10% to 20% of HTML elements are non-standard
body	HTML_NONELEMENT_20_30	20% to 30% of HTML elements are non-standard
body	HTML_NONELEMENT_30_40	30% to 40% of HTML elements are non-standard
body	HTML_NONELEMENT_40_50	40% to 50% of HTML elements are non-standard
body	HTML_NONELEMENT_50_60	50% to 60% of HTML elements are non-standard
body	HTML_NONELEMENT_60_70	60% to 70% of HTML elements are non-standard
body	HTML_NONELEMENT_70_80	70% to 80% of HTML elements are non-standard
body	HTML_NONELEMENT_80_90	80% to 90% of HTML elements are non-standard
body	HTML_NONELEMENT_90_100	90% to 100% of HTML elements are non-standard
body	HTML_SHORT_LENGTH	HTML is extremely short
body	HTML_TITLE_EMPTY	HTML title contains no text
body	HTML_TITLE_UNTITLED	HTML title contains "Untitled"
rawbody	HIDE_WIN_STATUS	Javascript to hide URLs in browser
rawbody	ENTITY_DEC_ALPHANUM	HTML contains needlessly encoded characters
rawbody	HTML_EHTML2	HTML has doubled end HTML tag
rawbody	HTML_TINY_FONT	body contains 1 or 0-point font
header	NO_DNS_FOR_FROM	Envelope sender has no MX or A DNS records
header	ROUND_THE_WORLD	Received: says mail sent around the world (DNS)
body	REMOVE_POSTAL	Send real mail to be unsubscribed
body	REMOVE_BEFORE_LINK	Removal phrase right before a link
body	CLICK_BELOW_CAPS	Asks you to click below (in capital letters)
body	CLICK_TO_REMOVE_1	Click to be removed
body	SENT_IN_COMPLIANCE	Claims compliance with spam regulations
body	BILL_1618	Possible mention of bill 1618 (anti-spam bill)
body	FULL_REFUND	Offers a full refund
body	NO_COST	No such thing as a free lunch (3)
body	GUARANTEED_100_PERCENT	One hundred percent guaranteed
body	DEAR_FRIEND	Dear Friend? That's not very dear!
body	DEAR_SOMETHING	Contains 'Dear (something)'
body	BILLION_DOLLARS	Talks about lots of money
body	OPTING_OUT_CAPS	Talks about opting out (capitalized version)
body	EXCUSE_4	Claims you can be removed from the list
body	EXCUSE_6	Claims you can be removed from the list
body	EXCUSE_10	"if you do not wish to receive any more"
body	EXCUSE_12	Nobody's perfect
body	EXCUSE_23	Claims you have provided permission
body	EXCUSE_24	Claims you wanted this ad
body	EXCUSE_REMOVE	Talks about how to be removed from mailings
body	STRONG_BUY	Tells you about a strong buy
body	WE_HONOR_ALL	Claims to honor removal requests
body	STOCK_ALERT	Offers a alert about a stock
body	MICRO_CAP_WARNING	SEC-mandated penny-stock warning
body	NOT_ADVISOR	Not registered investment advisor
body	SOME_BREAKTHROUGH	Describes some sort of breakthrough
body	PREST_NON_ACCREDITED	'Prestigious Non-Accredited Universities'
body	BODY_ENHANCEMENT	Information on growing body parts
body	BODY_ENHANCEMENT2	Information on getting larger body parts
body	IMPOTENCE	Impotence cure
body	MORTGAGE_BEST	Information on mortgages
body	MORTGAGE_PITCH	Looks like mortgage pitch
body	MORTGAGE_RATES	Information on mortgage rates
rawbody	MAILTO_SUBJ_REMOVE	mailto URI includes removal text
body	NA_DOLLARS	Talks about a million North American dollars
body	US_DOLLARS_3	Mentions millions of (dollar) ((dollar) NN,NNN,NNN.NN)
body	MILLION_USD	Talks about millions of dollars
rawbody	FRONTPAGE	Frontpage used to create the message
body	RESISTANCE_IS_FUTILE	Resistance to this spam is futile
body	URG_BIZ	Contains urgent matter
body	EARN_PER_WEEK	Contains 'earn (dollar) something per week'
body	ALL_NATURAL	Spam is 100% natural?!
body	MONEY_BACK	Money back guarantee
body	NO_OBLIGATION	There is no obligation
body	RISK_FREE	Risk free. Suuurreeee....
body	AS_SEEN_ON	As seen on national TV!
body	OFFSHORE_SCAM	Off Shore Scams
body	WHY_PAY_MORE	Why Pay More?
body	RECEIVE_OFFER	Receive a special offer
body	FREE_QUOTE_INSTANT	Free express or no-obligation quote
body	BAD_CREDIT	Eliminate Bad Credit
body	CONSOLIDATE_DEBT	Consolidate debt, credit, or bills
body	REFINANCE_YOUR_HOME	Home refinancing
body	REFINANCE_NOW	Home refinancing
body	NO_MEDICAL	No Medical Exams
body	NO_FORMS	No Claim Forms
body	WHY_WAIT	What are you waiting for
body	YOU_CAN_SEARCH	You can search for anyone
body	GUARANTEED_STUFF	Guaranteed Stuff
body	AMAZING_STUFF	Amazing Stuff
body	DIET_1	Lose Weight Spam
body	DIET_2	Describes weight loss
body	DIET_3	Describes body fat loss
body	REVERSE_AGING	Reverses Aging
body	HAIR_LOSS	Cures Baldness
body	WRINKLES	Removes Wrinkles
body	WHILE_YOU_SLEEP	While you Sleep
body	HIDDEN_CHARGES	Talks about Hidden Charges
body	FIN_FREE	Freedom of a financial nature
body	FORWARD_LOOKING	Stock Disclaimer Statement
body	SATIS_GUAR	Mail guarantees satisfaction
body	EXTRA_CASH	Offers Extra Cash
body	GET_PAID	Get Paid
body	ONE_TIME	One Time Rip Off
body	COMPETE	Compete for your business
body	MEET_SINGLES	Meet Singles
body	JOIN_MILLIONS	Join Millions of Americans
body	BE_BOSS	Be your own boss
body	ML_MARKETING	Multi Level Marketing mentioned
body	CONFIDENTIAL_ORDER	Confidentiality on all orders
body	SAVE_THOUSANDS	Save big money
body	MARKETING_PARTNERS	Claims you registered with a partner
body	FREE_PREVIEW	Free Preview
body	FREE_ACCESS	Contains 'free access' with capitals
body	FREE_SAMPLE	Contains 'free sample' with capitals
body	LOW_PRICE	Lowest Price
body	UNCLAIMED_MONEY	People just leave money laying around
body	OBSCURED_EMAIL	Message seems to contain rot13ed address
body	BANG_EXERCISE	Talks about exercise with an exclamation!
body	BANG_MORE	Talks about more with an exclamation!
body	BANG_OPRAH	Talks about Oprah with an exclamation!
body	ACT_NOW_CAPS	Talks about 'acting now' with capitals
body	MORE_SEX	Talks about a bigger drive for sex
body	BANG_GUAR	Something is emphatically guaranteed
body	SEE_FOR_YOURSELF	See for yourself
body	INVESTMENT_ADVICE	Message mentions investment advice
body	INVESTMENT_EXPERT	Message mentions investment expert
body	QUALIFY_FOR_THIS	Qualify for this special...
body	MALE_ENHANCE	Message talks about enhancing men
body	PRICES_ARE_AFFORDABLE	Message says that prices aren't too expensive
body	REPLICA_WATCH	Message talks about a replica watch
body	EM_ROLEX	Message puts emphasis on the watch manufacturer
body	FREE_PORN	Possible porn - Free Porn

Additional Interesting Articles

C# DataSet v DataReader
Stepwise Linear Regression in t-SQL
PHP Cookie And Authentication
PHP Send Mail
SQL Server Database Recovery Mode
C# Needle In Haystack String Replacements