What makes a suspicious package look suspicious?