Flag known phishing kit signatures

Would love if the report cross-referenced the headers/mailer strings against known phishing kits or bulk senders, not just a generic 'automated origin' note.