# active ruleset list, automatically generated from http://ruleqa.spamassassin.org/ # with results from: day 1: axb-coi-bulk axb-generic axb-ham-misc axb-ninja darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 giovanni grenier jarif jbrooks mmiroslaw-mails-ham mmiroslaw-mails-spam thendrikx; day 2: axb-coi-bulk axb-generic axb-ham-misc axb-ninja darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 jarif jbrooks llanga mmiroslaw-mails-ham mmiroslaw-mails-spam; day 3: axb-coi-bulk axb-generic axb-ham-misc axb-ninja darxus ena-week0 ena-week1 ena-week2 ena-week3 ena-week4 jarif jbrooks llanga mmiroslaw-mails-ham mmiroslaw-mails-spam # tflags publish AC_BR_BONANZA # tflags publish AC_DIV_BONANZA # tflags publish AC_HTML_NONSENSE_TAGS # tflags publish AC_SPAMMY_URI_PATTERNS1 # tflags publish AC_SPAMMY_URI_PATTERNS10 # tflags publish AC_SPAMMY_URI_PATTERNS11 # tflags publish AC_SPAMMY_URI_PATTERNS12 # tflags publish AC_SPAMMY_URI_PATTERNS2 # tflags publish AC_SPAMMY_URI_PATTERNS3 # tflags publish AC_SPAMMY_URI_PATTERNS4 # tflags publish AC_SPAMMY_URI_PATTERNS8 # tflags publish AC_SPAMMY_URI_PATTERNS9 # tflags publish ADMAIL # tflags publish ADVANCE_FEE_2_NEW_FORM # tflags publish ADVANCE_FEE_2_NEW_MONEY # tflags publish ADVANCE_FEE_3_NEW # tflags publish ADVANCE_FEE_3_NEW_FORM # tflags publish ADVANCE_FEE_3_NEW_MONEY # tflags publish ADVANCE_FEE_4_NEW # good enough ADVANCE_FEE_5_NEW_FRM_MNY # good enough ADVANCE_FEE_5_NEW_MONEY # tflags publish AD_PREFS # tflags userconf ALL_TRUSTED # good enough APOSTROPHE_TOCC # good enough AXB_XMAILER_MIMEOLE_OL_024C2 # tflags learn BAYES_00 # tflags learn BAYES_05 # tflags learn BAYES_20 # tflags learn BAYES_40 # tflags learn BAYES_50 # tflags learn BAYES_60 # tflags learn BAYES_80 # tflags learn BAYES_95 # tflags learn BAYES_99 # tflags learn BAYES_999 # good enough BODY_SINGLE_WORD # tflags publish BODY_URI_ONLY # tflags publish BOGUS_MSM_HDRS # tflags publish CANT_SEE_AD # tflags userconf CHARSET_FARAWAY # tflags userconf CHARSET_FARAWAY_HEADER # good enough CK_HELO_DYNAMIC_SPLIT_IP # tflags publish CN_B2B_SPAMMER # tflags publish COMMENT_GIBBERISH # tflags publish CORRUPT_FROM_LINE_IN_HDRS # good enough CTYPE_NULL # good enough DEAR_BENEFICIARY # good enough DEAR_WINNER # tflags net DIGEST_MULTIPLE # tflags net DKIMDOMAIN_IN_DWL # tflags net DKIMDOMAIN_IN_DWL_UNKNOWN # tflags net DKIM_ADSP_ALL # tflags net DKIM_ADSP_CUSTOM_HIGH # tflags net DKIM_ADSP_CUSTOM_LOW # tflags net DKIM_ADSP_CUSTOM_MED # tflags net DKIM_ADSP_DISCARD # tflags net DKIM_ADSP_NXDOMAIN # tflags net DKIM_SIGNED # tflags net DKIM_VALID # tflags net DKIM_VALID_AU # tflags publish DOS_ANAL_SPAM_MAILER # good enough DOS_OE_TO_MX # good enough DOS_OUTLOOK_TO_MX # good enough DUP_SUSP_HDR # good enough DX_TEXT_01 # tflags publish DX_TEXT_02 # tflags publish DX_TEXT_03 # good enough DYN_RDNS_AND_INLINE_IMAGE # good enough DYN_RDNS_SHORT_HELO_HTML # tflags publish ENCRYPTED_MESSAGE # tflags userconf ENV_AND_HDR_SPF_MATCH # good enough FAKE_REPLY_C # tflags publish FBI_MONEY # tflags publish FBI_SPOOF # tflags publish FILL_THIS_FORM # tflags publish FORM_FRAUD # tflags publish FORM_FRAUD_3 # tflags publish FORM_FRAUD_5 # tflags publish FORM_LOW_CONTRAST # tflags publish FOUND_YOU # tflags userconf FRAGMENTED_MESSAGE # tflags publish FREEMAIL_FORGED_FROMDOMAIN # tflags userconf FROM_DOMAIN_NOVOWEL # tflags publish FROM_IN_TO_AND_SUBJ # tflags userconf FROM_LOCAL_NOVOWEL # good enough FROM_MISSP_EH_MATCH # good enough FROM_MISSP_FREEMAIL # good enough FROM_MISSP_MSFT # good enough FROM_MISSP_PHISH # tflags net FROM_MISSP_SPF_FAIL # good enough FROM_MISSP_TO_UNDISC # good enough FROM_MISSP_USER # good enough FROM_MISSP_XPRIO # tflags publish FROM_WORDY # tflags publish FROM_WORDY_SHORT # good enough FROM_WSP_TRAIL # good enough FSL_BULK_SIG # good enough FSL_CTYPE_WIN1251 # good enough FSL_HELO_BARE_IP_1 # good enough FSL_HELO_DEVICE # good enough FSL_HELO_FAKE # tflags publish FSL_NEW_HELO_USER # tflags publish FUZZY_ANDROID # tflags publish FUZZY_BROWSER # tflags publish FUZZY_CLICK_HERE # tflags publish FUZZY_DR_OZ # tflags publish FUZZY_IMPORTANT # tflags publish FUZZY_PRIVACY # tflags publish FUZZY_PROMOTION # tflags publish FUZZY_SAVINGS # tflags publish FUZZY_SECURITY # tflags publish FUZZY_UNSUBSCRIBE # tflags publish GOOGLE_DOCS_PHISH # tflags publish GOOGLE_DOCS_PHISH_MANY # tflags publish GOOG_MALWARE_DNLD # tflags publish GOOG_REDIR_SHORT # tflags userconf GTUBE # tflags userconf HASHCASH_20 # tflags userconf HASHCASH_21 # tflags userconf HASHCASH_22 # tflags userconf HASHCASH_23 # tflags userconf HASHCASH_24 # tflags userconf HASHCASH_25 # tflags userconf HASHCASH_2SPEND # tflags userconf HASHCASH_HIGH # good enough HDRS_MISSP # tflags publish HEADER_FROM_DIFFERENT_DOMAINS # tflags userconf HEAD_LONG # good enough HELO_LH_HOME # good enough HELO_LOCALHOST # good enough HELO_MISC_IP # good enough HELO_OEM # tflags publish HEXHASH_WORD # good enough HK_GOLDDUST # good enough HK_NAME_DRUGS # good enough HK_NAME_FM_DR # good enough HK_NAME_FM_MR_MRS # good enough HK_RANDOM_ENVFROM # good enough HK_SCAM_N2 # tflags userconf HTML_CHARSET_FARAWAY # tflags publish HTML_OFF_PAGE # good enough IMG_DIRECT_TO_MX # good enough KB_DATE_CONTAINS_TAB # good enough KHOP_UNSUB_EMAIL # tflags publish LIST_PRTL_PUMPDUMP # tflags publish LIST_PRTL_SAME_USER # tflags publish LONG_HEX_URI # tflags publish LONG_IMG_URI # tflags publish LOTS_OF_MONEY # tflags publish LUCRATIVE # good enough MANY_HDRS_LCASE # good enough MANY_PILL_PRICE # tflags publish MANY_SPAN_IN_TEXT # tflags userconf MIME_CHARSET_FARAWAY # tflags publish MIME_NO_TEXT # tflags userconf MISSING_HB_SEP # good enough MONEY_ATM_CARD # good enough MONEY_FORM_SHORT # tflags publish MONEY_FRAUD_3 # tflags publish MONEY_FRAUD_5 # tflags publish MONEY_FRAUD_8 # good enough MONEY_FROM_41 # tflags publish MSM_PRIO_REPTO # good enough MSOE_MID_WRONG_CASE # tflags net NO_DNS_FOR_FROM # tflags userconf NO_RECEIVED # tflags userconf NO_RELAYS # good enough NSL_RCVD_FROM_USER # good enough NSL_RCVD_HELO_USER # tflags publish OBFU_JVSCR_ESC # tflags publish OBFU_TEXT_ATTACH # tflags publish PHP_NOVER_MUA # tflags publish PHP_ORIG_SCRIPT # tflags publish PHP_SCRIPT_MUA # tflags publish PP_MIME_FAKE_ASCII_TEXT # tflags publish PP_TOO_MUCH_UNICODE02 # tflags publish PP_TOO_MUCH_UNICODE05 # tflags publish PUMPDUMP # tflags publish PUMPDUMP_MULTI # tflags publish PUMPDUMP_TIP # tflags net PYZOR_CHECK # tflags publish RAND_HEADER_MANY # tflags net RAZOR2_CF_RANGE_51_100 # tflags net RAZOR2_CHECK # tflags publish RCVD_DBL_DQ # tflags net RCVD_IN_BL_SPAMCOP_NET # tflags net RCVD_IN_DNSWL_BLOCKED # tflags net RCVD_IN_DNSWL_HI # tflags net RCVD_IN_DNSWL_LOW # tflags net RCVD_IN_DNSWL_MED # tflags net RCVD_IN_DNSWL_NONE # tflags net RCVD_IN_IADB_DK # tflags net RCVD_IN_IADB_DOPTIN # tflags net RCVD_IN_IADB_DOPTIN_GT50 # tflags net RCVD_IN_IADB_DOPTIN_LT50 # tflags net RCVD_IN_IADB_EDDB # tflags net RCVD_IN_IADB_EPIA # tflags net RCVD_IN_IADB_GOODMAIL # tflags net RCVD_IN_IADB_LISTED # tflags net RCVD_IN_IADB_LOOSE # tflags net RCVD_IN_IADB_MI_CPEAR # tflags net RCVD_IN_IADB_MI_CPR_30 # tflags net RCVD_IN_IADB_MI_CPR_MAT # tflags net RCVD_IN_IADB_ML_DOPTIN # tflags net RCVD_IN_IADB_NOCONTROL # tflags net RCVD_IN_IADB_OOO # tflags net RCVD_IN_IADB_OPTIN # tflags net RCVD_IN_IADB_OPTIN_GT50 # tflags net RCVD_IN_IADB_OPTIN_LT50 # tflags net RCVD_IN_IADB_OPTOUTONLY # tflags net RCVD_IN_IADB_RDNS # tflags net RCVD_IN_IADB_SENDERID # tflags net RCVD_IN_IADB_SPF # tflags net RCVD_IN_IADB_UNVERIFIED_1 # tflags net RCVD_IN_IADB_UNVERIFIED_2 # tflags net RCVD_IN_IADB_UT_CPEAR # tflags net RCVD_IN_IADB_UT_CPR_30 # tflags net RCVD_IN_IADB_UT_CPR_MAT # tflags net RCVD_IN_IADB_VOUCHED # tflags net RCVD_IN_MAPS_DUL # tflags net RCVD_IN_MAPS_NML # tflags net RCVD_IN_MAPS_OPS # tflags net RCVD_IN_MAPS_RBL # tflags net RCVD_IN_MAPS_RSS # tflags net RCVD_IN_MSPIKE_BL # tflags net RCVD_IN_MSPIKE_H2 # tflags net RCVD_IN_MSPIKE_H3 # tflags net RCVD_IN_MSPIKE_H4 # tflags net RCVD_IN_MSPIKE_H5 # tflags net RCVD_IN_MSPIKE_L2 # tflags net RCVD_IN_MSPIKE_L3 # tflags net RCVD_IN_MSPIKE_L4 # tflags net RCVD_IN_MSPIKE_L5 # tflags net RCVD_IN_MSPIKE_WL # tflags net RCVD_IN_MSPIKE_ZBI # tflags net RCVD_IN_PBL # tflags net RCVD_IN_PSBL # tflags net RCVD_IN_RP_CERTIFIED # tflags net RCVD_IN_RP_RNBL # tflags net RCVD_IN_RP_SAFE # tflags net RCVD_IN_SBL # tflags net RCVD_IN_SBL_CSS # tflags net RCVD_IN_SORBS_BLOCK # tflags net RCVD_IN_SORBS_DUL # tflags net RCVD_IN_SORBS_HTTP # tflags net RCVD_IN_SORBS_MISC # tflags net RCVD_IN_SORBS_SMTP # tflags net RCVD_IN_SORBS_SOCKS # tflags net RCVD_IN_SORBS_WEB # tflags net RCVD_IN_SORBS_ZOMBIE # tflags net RCVD_IN_XBL # good enough REPLYTO_WITHOUT_TO_CC # good enough SERGIO_SUBJECT_PORN015 # good enough SERGIO_SUBJECT_VIAGRA01 # tflags publish SINGLETS_LOW_CONTRAST # good enough SPELLED_OUT_NUMBER # tflags net SPF_FAIL # tflags net SPF_HELO_FAIL # tflags net SPF_HELO_NEUTRAL # tflags userconf SPF_HELO_PASS # tflags net SPF_HELO_SOFTFAIL # tflags net SPF_NEUTRAL # tflags userconf SPF_PASS # tflags net SPF_SOFTFAIL # tflags publish SPOOFED_FREEM_REPTO # tflags publish SPOOFED_FREEM_REPTO_CHN # tflags publish SPOOFED_FREEM_REPTO_RUS # tflags publish STATIC_XPRIO_OLE # tflags publish STOCK_LOW_CONTRAST # tflags publish STOCK_TIP # good enough STOX_REPLY_TYPE # good enough STOX_REPLY_TYPE_WITHOUT_QUOTES # tflags publish STYLE_GIBBERISH # tflags userconf SUBJECT_IN_BLACKLIST # tflags userconf SUBJECT_IN_WHITELIST # tflags net SURBL_BLOCKED # tflags publish SYSADMIN # good enough TAB_IN_FROM # good enough TBIRD_SUSP_MIME_BDRY # tflags publish TEQF_USR_IMAGE # tflags publish TEQF_USR_MSGID_HEX # tflags publish TEQF_USR_MSGID_MALF # tflags publish THIS_AD # tflags net TO_EQ_FM_DOM_SPF_FAIL # tflags net TO_EQ_FM_SPF_FAIL # tflags publish TO_IN_SUBJ # good enough TO_NO_BRKTS_DYNIP # tflags publish TO_NO_BRKTS_HTML_IMG # tflags publish TO_NO_BRKTS_HTML_ONLY # good enough TO_NO_BRKTS_MSFT # tflags publish TO_NO_BRKTS_NORDNS_HTML # tflags publish TO_NO_BRKTS_PCNT # good enough TVD_QUAL_MEDS # good enough TVD_RCVD_IP # good enough TVD_RCVD_IP4 # good enough TVD_SPACE_ENCODED # good enough TVD_SPACE_ENC_FM_MIME # good enough TVD_VISIT_PHARMA # tflags publish TW_GIBBERISH_MANY # good enough ADVANCE_FEE_2_NEW_FRM_MNY # good enough BIGNUM_EMAILS # good enough BODY_SINGLE_URI # good enough FILL_THIS_FORM_LOAN # good enough FILL_THIS_FORM_LONG # good enough HDRS_LCASE # good enough HK_SCAM_N15 # good enough LIST_PARTIAL_SHORT_MSG # good enough TO_NO_BRKTS_FROM_MSSP # good enough URI_DOTDOT_LOW_CNTRST # tflags publish UC_GIBBERISH_OBFU # tflags userconf UNPARSEABLE_RELAY # tflags net URIBL_ABUSE_SURBL # tflags net URIBL_BLACK # tflags net URIBL_BLOCKED # tflags net URIBL_CR_SURBL # tflags net URIBL_DBL_ABUSE_BOTCC # tflags net URIBL_DBL_ABUSE_MALW # tflags net URIBL_DBL_ABUSE_PHISH # tflags net URIBL_DBL_ABUSE_REDIR # tflags net URIBL_DBL_ABUSE_SPAM # tflags net URIBL_DBL_BOTNETCC # tflags net URIBL_DBL_ERROR # tflags net URIBL_DBL_MALWARE # tflags net URIBL_DBL_PHISH # tflags net URIBL_DBL_SPAM # tflags net URIBL_GREY # tflags net URIBL_MW_SURBL # tflags net URIBL_PH_SURBL # tflags net URIBL_RED # tflags net URIBL_RHS_DOB # tflags net URIBL_SBL # tflags net URIBL_SBL_A # tflags net URIBL_WS_SURBL # tflags publish URI_DATA # tflags publish URI_DQ_UNSUB # tflags publish URI_GOOGLE_PROXY # tflags userconf URI_HOST_IN_BLACKLIST # tflags userconf URI_HOST_IN_WHITELIST # tflags userconf URI_NOVOWEL # tflags publish URI_ONLY_MSGID_MALF # tflags publish URI_OPTOUT_3LD # tflags publish URI_OPTOUT_USME # tflags publish URI_PHISH # tflags publish URI_TRY_3LD # tflags publish URI_TRY_USME # tflags publish URI_WPADMIN # tflags publish URI_WP_DIRINDEX # tflags publish URI_WP_HACKED # tflags publish URI_WP_HACKED_2 # tflags userconf USER_IN_ALL_SPAM_TO # tflags userconf USER_IN_BLACKLIST # tflags userconf USER_IN_BLACKLIST_TO # tflags net USER_IN_DEF_DKIM_WL # tflags userconf USER_IN_DEF_SPF_WL # tflags userconf USER_IN_DEF_WHITELIST # tflags net USER_IN_DKIM_WHITELIST # tflags userconf USER_IN_MORE_SPAM_TO # tflags userconf USER_IN_SPF_WHITELIST # tflags userconf USER_IN_WHITELIST # tflags userconf USER_IN_WHITELIST_TO # tflags publish XM_PHPMAILER_FORGED # tflags publish XPRIO # tflags publish XPRIO_SHORT_SUBJ # good enough YOU_INHERIT # tflags net __DKIMDOMAIN_IN_DWL_ANY # tflags net __RCVD_IN_DNSWL # tflags net __RCVD_IN_IADB # tflags net __RCVD_IN_MSPIKE_B # tflags net __RCVD_IN_MSPIKE_L # tflags net __RCVD_IN_MSPIKE_LOW # tflags net __RCVD_IN_MSPIKE_Z # tflags net __RCVD_IN_SORBS # tflags net __RCVD_IN_ZEN # tflags net __RESIGNER1 # tflags net __RESIGNER2 # tflags net __SPF_FULL_PASS # tflags net __SPF_RANDOM_SENDER # tflags net __TO_EQ_FM_DOM_SPF_FAIL # tflags net __TO_EQ_FM_SPF_FAIL # tflags userconf __UNPARSEABLE_RELAY_COUNT