Email: 271690 Autolearn: 0 AvgScore: 5.09 AvgScanTime: 1.34 sec Spam: 86686 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 1.42 sec Ham: 185004 Autolearn: 0 AvgScore: 0.91 AvgScanTime: 1.30 sec Time Spent Running SA: 100.79 hours Time Spent Processing Spam: 34.15 hours Time Spent Processing Ham: 66.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 86308 99.51 99.56 99.48 2 HTML_MESSAGE 82460 88.48 95.12 85.37 3 DKIM_SIGNED 77744 76.63 89.68 70.51 4 XM_B_Unicode 73669 74.55 84.98 69.67 5 XM_DK_Pass 73190 74.41 84.43 69.72 6 DKIM_VALID 72741 74.02 83.91 69.39 7 RELAYCOUNTRY_US 70436 82.42 81.25 82.96 8 DCC_CHECK 68695 59.38 79.25 50.07 9 XM_B_SpammyWords 59752 53.57 68.93 46.38 10 XMListUnsubscribeExists 59680 56.85 68.85 51.23 11 DKIM_VALID_AU 58201 62.39 67.14 60.17 12 XM_B_Unicode3 43790 47.30 50.52 45.79 13 LOC_TINY_FONT_1 41982 37.94 48.43 33.03 14 XM_DK_Undo_02 37684 17.37 43.47 5.14 15 HTML_FONT_LOW_CONTRAST 33551 37.82 38.70 37.41 16 XM_B_SpammyWords2 33529 26.90 38.68 21.39 17 BAYES_50 31909 53.48 36.81 61.29 18 BAYES_99 30302 13.89 34.96 4.02 19 FVGT_m_MULTI_ODD 29707 30.15 34.27 28.21 20 TR_XM_DKIM_Undo 27328 11.52 31.53 2.15 21 DKIM_VALID_EF 27145 27.99 31.31 26.44 22 MIME_HTML_ONLY 25154 25.10 29.02 23.27 23 T_KAM_HTML_FONT_INVALID 24294 22.00 28.03 19.18 24 BAYES_999 23491 10.83 27.10 3.21 25 TR_DCC_Bayes_99 22948 9.77 26.47 1.94 26 TR_XM_DK_Unsub 20960 17.52 24.18 14.40 27 XM_Multi_Part_URI 18385 17.40 21.21 15.61 28 XMSubLong 18234 21.23 21.03 21.32 29 DCC_CHECK_NEGATIVE 17685 40.49 20.40 49.91 30 XM_B_Unsub 17183 16.07 19.82 14.31 31 UNPARSEABLE_RELAY 16616 15.49 19.17 13.77 32 RCVD_IN_MSPIKE_H2 16610 15.40 19.16 13.64 33 RELAYCOUNTRY_META 16554 7.91 19.10 2.67 34 T_TM2_M_HEADER_IN_MSG 16425 23.84 18.95 26.13 35 TR_XM_BayesUnsub 16262 11.59 18.76 8.23 36 TR_MAX_INTL_RELAY 13461 9.14 15.53 6.15 37 XM_B_SpammyWords3 12194 8.91 14.07 6.49 38 TR_XM_SpammyRelay 11857 5.37 13.68 1.48 39 BOTNET_IPINHOSTNAME 11746 6.63 13.55 3.39 40 TR_XM_SpammyWords2 11106 4.46 12.81 0.55 41 FSL_BULK_SIG 10145 10.56 11.70 10.03 42 RCVD_IN_BL_SPAMCOP_NET 9819 3.95 11.33 0.50 43 BOTNET 9389 4.31 10.83 1.26 44 TR_XM_UnparsRelay 9195 4.63 10.61 1.83 45 BAYES_80 8443 5.64 9.74 3.72 46 LOTS_OF_MONEY 7944 6.68 9.16 5.52 47 BAYES_60 7552 7.36 8.71 6.73 48 TR_XM_SpammyWords4 7042 5.45 8.12 4.20 49 XM_Evil_Numbers_Gen 6889 11.42 7.95 13.04 50 RELAYCOUNTRY_CA 6685 3.10 7.71 0.94 51 RCVD_IN_MSPIKE_WL 6650 11.32 7.67 13.03 52 HTML_IMAGE_RATIO_02 6495 6.40 7.49 5.89 53 RCVD_IN_MSPIKE_BL 6255 2.73 7.22 0.63 54 TR_XM_MSPIKECOMBO 6245 2.73 7.20 0.63 55 XM_Body_Dirty_Words 6221 3.84 7.18 2.28 56 MPART_ALT_DIFF 5961 5.07 6.88 4.22 57 XM_B_Phish_Phrases 5854 6.15 6.75 5.86 58 UNTRUSTED_Relay 5626 3.16 6.49 1.60 59 XMSubMetaSx_00 5569 4.59 6.42 3.74 60 DKIM_INVALID 5003 2.61 5.77 1.13 61 XM_H_Long_From01 4860 5.26 5.61 5.09 62 BAYES_95 4782 3.41 5.52 2.43 63 RCVD_IN_VALIDITY_RPBL 4768 1.91 5.50 0.23 64 XM_H_GMP 4645 5.50 5.36 5.57 65 XM_UncommonTLD01 4531 4.77 5.23 4.55 66 HTML_IMAGE_RATIO_04 4443 5.36 5.13 5.47 67 XMSexyCombo_05 4430 2.99 5.11 1.99 68 LotsOfNums_01 4266 7.74 4.92 9.05 69 TR_XM_SpammyWords3 4233 1.69 4.88 0.20 70 TR_XM_NoHeaderRelay 4201 1.63 4.85 0.12 71 TR_XM_PhishingBody 4173 2.98 4.81 2.12 72 XM_B_Investor 4165 2.41 4.80 1.29 73 XMStrtUSub 4017 5.20 4.63 5.47 74 XM_CamelCaseFrm001 3983 3.11 4.59 2.41 75 TM2_M_VERY_LONG_WORD 3822 5.48 4.41 5.99 76 XM_B_PhoneNumber 3791 7.61 4.37 9.13 77 T_XMDrugObfuBody_14 3673 2.78 4.24 2.10 78 MIME_HTML_MOSTLY 3669 3.43 4.23 3.06 79 TooManyTo_001 3665 7.35 4.23 8.82 80 TR_XM_SPAMCOP 3646 1.40 4.21 0.08 81 MIME_QP_LONG_LINE 3431 3.19 3.96 2.83 82 RCVD_IN_MSPIKE_H3 3378 5.36 3.90 6.04 83 RCVD_IN_MSPIKE_L3 3242 1.45 3.74 0.38 84 XM_B_SpammyTLD 3113 3.27 3.59 3.11 85 XMNumbers 3061 6.54 3.53 7.94 86 XM_OfRef6 3035 1.98 3.50 1.27 87 TR_XM_SpammyWords5 3027 2.25 3.49 1.67 88 XM_UB50 3001 1.72 3.46 0.90 89 DKIM_ADSP_NXDOMAIN 2960 1.36 3.41 0.40 90 XM_URI_RBL 2858 1.30 3.30 0.36 91 XMBody_17 2834 1.31 3.27 0.39 92 T_FILL_THIS_FORM_SHORT 2616 1.28 3.02 0.47 93 XM_B_Unsub2 2614 1.81 3.02 1.24 94 MIME_HTML_ONLY_MULTI 2529 2.50 2.92 2.30 95 USER_IN_DEF_DKIM_WL 2524 13.19 2.91 18.00 96 XM_B_SpammyWords4 2517 1.39 2.90 0.68 97 RELAYCOUNTRY_AU 2457 1.10 2.83 0.29 98 RCVD_IN_VALIDITY_SAFE 2448 5.57 2.82 6.86 99 FROM_EXCESS_BASE64 2438 2.38 2.81 2.18 100 BOUNCE_MESSAGE 2426 7.02 2.80 9.00 101 ANY_BOUNCE_MESSAGE 2426 7.02 2.80 9.00 102 XM_SPF_SoftFail 2394 1.44 2.76 0.82 103 HTML_IMAGE_RATIO_08 2319 2.64 2.68 2.63 104 ALL_TRUSTED 2316 10.55 2.67 14.24 105 T_XMHurry_00 2282 1.54 2.63 1.03 106 HTML_IMAGE_RATIO_06 2231 2.41 2.57 2.33 107 T_TooManySym_01 2137 6.01 2.47 7.66 108 XMBrknScrpt_02 2123 1.51 2.45 1.06 109 TR_MetaPhish_Combo_01 2052 2.29 2.37 2.25 110 XM_B_URI_Unicode 2042 1.54 2.36 1.16 111 TM2_M_URI_OPT_OUT 1982 1.89 2.29 1.70 112 TR_XM_INV_DKIM 1972 0.82 2.27 0.13 113 XMStockSpam_06 1939 2.30 2.24 2.32 114 T_XMDrugObfuBody_08 1926 1.38 2.22 0.98 115 KHOP_HELO_FCRDNS 1911 3.28 2.20 3.78 116 RCVD_IN_MSPIKE_H4 1765 2.27 2.04 2.39 117 RCVD_IN_VALIDITY_CERTIFIED 1746 4.43 2.01 5.56 118 MAILING_LIST_MULTI 1734 2.05 2.00 2.08 119 RDNS_DYNAMIC 1733 0.88 2.00 0.36 120 RCVD_IN_MSPIKE_L5 1708 0.71 1.97 0.12 121 RELAYCOUNTRY_CN 1685 0.65 1.94 0.05 122 RCVD_IN_PSBL 1646 0.95 1.90 0.51 123 SpammyFromTLD_01 1645 0.85 1.90 0.37 124 DIET_1 1637 1.01 1.89 0.60 125 SHOPIFY_IMG_NOT_RCVD_SFY 1601 0.85 1.85 0.38 126 TR_LOTS_OF_MONEY3 1524 0.75 1.76 0.28 127 XMDiploma_00 1517 1.34 1.75 1.15 128 RCVD_IN_MSPIKE_H5 1507 3.69 1.74 4.60 129 SUBJ_ALL_CAPS 1470 1.31 1.70 1.13 130 PDS_RDNS_DYNAMIC_FP 1468 0.58 1.69 0.06 131 XM_H_DKIM_GOOG 1431 0.53 1.65 0.01 132 SpammyFromTLD_02 1416 0.65 1.63 0.19 133 THIS_AD 1413 0.83 1.63 0.46 134 MIME_CHARSET_FARAWAY 1403 1.91 1.62 2.05 135 SH_BODYURI_REVERSE_CSS 1400 0.53 1.62 0.02 136 URIBL_CSS 1395 0.53 1.61 0.02 137 URIBL_CSS_A 1395 0.53 1.61 0.02 138 TVD_RCVD_IP 1386 1.33 1.60 1.20 139 XM_B_COPY_HTML 1383 1.36 1.60 1.25 140 TR_XM_PHPDW 1333 0.66 1.54 0.24 141 SCC_CANSPAM_2 1331 0.49 1.54 0.00 142 TR_XM_PHPForged 1328 0.66 1.53 0.25 143 TR_XM_FormFill2 1324 0.66 1.53 0.25 144 URI_HEX 1318 1.05 1.52 0.82 145 RCVD_IN_MSPIKE_L4 1295 0.56 1.49 0.13 146 XM_H_PHPOS 1291 0.63 1.49 0.23 147 XM_HighProb1 1259 0.47 1.45 0.00 148 XMPhish30 1241 0.87 1.43 0.61 149 SCC_BODY_URI_ONLY 1240 2.11 1.43 2.43 150 URI_TRY_3LD 1217 0.80 1.40 0.51 151 XM_DK_Undo_01 1209 1.24 1.39 1.16 152 BAYES_40 1194 4.00 1.38 5.24 153 CHARSET_FARAWAY_HEADER 1184 1.67 1.37 1.82 154 RCVD_IN_XBL 1169 0.44 1.35 0.01 155 XM_DIRTYINTL 1160 0.46 1.34 0.05 156 HTML_TAG_BALANCE_BODY 1148 1.00 1.32 0.85 157 TR_XM_MSPIKECOMBO2 1067 0.40 1.23 0.01 158 HELO_DYNAMIC_SPLIT_IP 1061 0.39 1.22 0.00 159 XM_SendGrid 1046 1.13 1.21 1.09 160 RCVD_IN_PBL 1043 0.71 1.20 0.49 161 HTML_IMAGE_ONLY_20 1017 0.57 1.17 0.28 162 XM_B_Phish66 1010 0.59 1.17 0.32 163 XM_H_Long_From02 1010 0.84 1.17 0.69 164 XMEqualsVooDoo_00 1004 0.39 1.16 0.03 165 BAYES_20 1002 2.55 1.16 3.20 166 XMBounce_01 1000 0.38 1.15 0.02 167 T_REMOTE_IMAGE 998 2.18 1.15 2.66 168 T_STY_INVIS_DIRECT 997 0.88 1.15 0.75 169 XMEqualsVooDoo_01 992 0.37 1.14 0.00 170 XMEqualsVooDoo_03 990 0.36 1.14 0.00 171 XMEqualsVooDoo_02 990 0.36 1.14 0.00 172 MAY_BE_FORGED 986 3.58 1.14 4.72 173 URI_NOVOWEL 966 1.36 1.11 1.48 174 HTML_MIME_NO_HTML_TAG 957 1.49 1.10 1.67 175 DKIM_ADSP_CUSTOM_MED 955 0.75 1.10 0.58 176 HTTPS_HTTP_MISMATCH 944 0.61 1.09 0.39 177 XMBdyGiftCard01 942 1.56 1.09 1.78 178 T_XMDrugObfuBody_00 934 0.72 1.08 0.56 179 BOTNET_NORDNS 933 0.35 1.08 0.00 180 RELAYCOUNTRY_TH 933 0.35 1.08 0.00 181 XMBody_78 928 0.52 1.07 0.26 182 RCVD_IN_SBL_CSS 922 0.35 1.06 0.01 183 XMReplyNow 898 0.45 1.04 0.17 184 TR_XM_InvalidRelay 898 0.34 1.04 0.01 185 TR_XM_FormFill 893 0.34 1.03 0.01 186 T_MONEY_PERCENT 891 0.67 1.03 0.50 187 TR_LOTS_OF_MONEY2 891 0.67 1.03 0.50 188 TR_Mismatch_TLD_02 886 0.37 1.02 0.07 189 XPRIO 876 0.33 1.01 0.00 190 SUBJ_DOLLARS 867 0.66 1.00 0.51 191 XMPhish08 858 0.76 0.99 0.65 192 XMSubMetaSxObfu_03 857 0.53 0.99 0.31 193 PLING_QUERY 842 0.67 0.97 0.52 194 XM_B_REG_HTML 827 0.51 0.95 0.30 195 NML_ADSP_CUSTOM_MED 823 0.54 0.95 0.34 196 TR_XM_Base64_L1 819 0.36 0.94 0.09 197 XM_ProductURIs 811 0.86 0.94 0.82 198 XM_UB99 798 0.29 0.92 0.00 199 MultiRelay_CC 795 0.34 0.92 0.06 200 MPART_ALT_DIFF_COUNT 784 0.68 0.90 0.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 184047 99.51 99.56 99.48 2 HTML_MESSAGE 157941 88.48 95.12 85.37 3 RELAYCOUNTRY_US 153479 82.42 81.25 82.96 4 DKIM_SIGNED 130451 76.63 89.68 70.51 5 XM_DK_Pass 128981 74.41 84.43 69.72 6 XM_B_Unicode 128887 74.55 84.98 69.67 7 DKIM_VALID 128366 74.02 83.91 69.39 8 BAYES_50 113380 53.48 36.81 61.29 9 DKIM_VALID_AU 111311 62.39 67.14 60.17 10 XMListUnsubscribeExists 94783 56.85 68.85 51.23 11 DCC_CHECK 92629 59.38 79.25 50.07 12 DCC_CHECK_NEGATIVE 92331 40.49 20.40 49.91 13 XM_B_SpammyWords 85796 53.57 68.93 46.38 14 XM_B_Unicode3 84720 47.30 50.52 45.79 15 HTML_FONT_LOW_CONTRAST 69215 37.82 38.70 37.41 16 LOC_TINY_FONT_1 61103 37.94 48.43 33.03 17 FVGT_m_MULTI_ODD 52196 30.15 34.27 28.21 18 DKIM_VALID_EF 48907 27.99 31.31 26.44 19 T_TM2_M_HEADER_IN_MSG 48347 23.84 18.95 26.13 20 MIME_HTML_ONLY 43046 25.10 29.02 23.27 21 XM_B_SpammyWords2 39564 26.90 38.68 21.39 22 XMSubLong 39452 21.23 21.03 21.32 23 T_KAM_HTML_FONT_INVALID 35485 22.00 28.03 19.18 24 USER_IN_DEF_DKIM_WL 33300 13.19 2.91 18.00 25 XM_Multi_Part_URI 28881 17.40 21.21 15.61 26 TR_XM_DK_Unsub 26637 17.52 24.18 14.40 27 XM_B_Unsub 26476 16.07 19.82 14.31 28 ALL_TRUSTED 26343 10.55 2.67 14.24 29 UNPARSEABLE_RELAY 25477 15.49 19.17 13.77 30 RCVD_IN_MSPIKE_H2 25230 15.40 19.16 13.64 31 XM_Evil_Numbers_Gen 24125 11.42 7.95 13.04 32 RCVD_IN_MSPIKE_WL 24099 11.32 7.67 13.03 33 BAYES_00 21847 8.26 0.69 11.81 34 FSL_BULK_SIG 18554 10.56 11.70 10.03 35 XM_B_PhoneNumber 16893 7.61 4.37 9.13 36 XM_DKIMWhitelistDomains 16835 6.20 0.00 9.10 37 LotsOfNums_01 16751 7.74 4.92 9.05 38 ANY_BOUNCE_MESSAGE 16652 7.02 2.80 9.00 39 BOUNCE_MESSAGE 16652 7.02 2.80 9.00 40 TooManyTo_001 16312 7.35 4.23 8.82 41 TR_XM_BayesUnsub 15225 11.59 18.76 8.23 42 XMNumbers 14696 6.54 3.53 7.94 43 T_TooManySym_01 14179 6.01 2.47 7.66 44 RCVD_IN_VALIDITY_SAFE 12690 5.57 2.82 6.86 45 BAYES_60 12448 7.36 8.71 6.73 46 TR_XM_DK_Bayes 12087 4.62 0.54 6.53 47 XM_B_SpammyWords3 12002 8.91 14.07 6.49 48 TR_XM_DK_Bayes1 11984 4.58 0.54 6.48 49 TR_MAX_INTL_RELAY 11381 9.14 15.53 6.15 50 RCVD_IN_MSPIKE_H3 11177 5.36 3.90 6.04 51 TM2_M_VERY_LONG_WORD 11080 5.48 4.41 5.99 52 HTML_IMAGE_RATIO_02 10904 6.40 7.49 5.89 53 XM_B_Phish_Phrases 10846 6.15 6.75 5.86 54 HTML_IMAGE_ONLY_32 10576 3.96 0.20 5.72 55 TR_XM_DK_Bayes2 10452 3.98 0.42 5.65 56 XM_H_GMP 10296 5.50 5.36 5.57 57 RCVD_IN_VALIDITY_CERTIFIED 10285 4.43 2.01 5.56 58 LOTS_OF_MONEY 10204 6.68 9.16 5.52 59 HTML_IMAGE_RATIO_04 10127 5.36 5.13 5.47 60 XMStrtUSub 10122 5.20 4.63 5.47 61 TooManyTo_002 10023 3.88 0.60 5.42 62 BAYES_40 9686 4.00 1.38 5.24 63 XM_DK_Undo_02 9511 17.37 43.47 5.14 64 XM_H_Long_From01 9418 5.26 5.61 5.09 65 MAY_BE_FORGED 8741 3.58 1.14 4.72 66 RCVD_IN_MSPIKE_H5 8509 3.69 1.74 4.60 67 XM_UncommonTLD01 8422 4.77 5.23 4.55 68 XM_B_FormFill 7991 2.95 0.02 4.32 69 MPART_ALT_DIFF 7805 5.07 6.88 4.22 70 TR_XM_SpammyWords4 7768 5.45 8.12 4.20 71 T_TooManySym_02 7489 3.01 0.81 4.05 72 BAYES_99 7437 13.89 34.96 4.02 73 KHOP_HELO_FCRDNS 7000 3.28 2.20 3.78 74 XMSubMetaSx_00 6914 4.59 6.42 3.74 75 BAYES_80 6887 5.64 9.74 3.72 76 INVALID_MSGID 6487 2.54 0.47 3.51 77 TO_MALFORMED 6265 2.33 0.06 3.39 78 BOTNET_IPINHOSTNAME 6263 6.63 13.55 3.39 79 BAYES_999 5946 10.83 27.10 3.21 80 BAYES_20 5915 2.55 1.16 3.20 81 XM_B_SpammyTLD 5760 3.27 3.59 3.11 82 MIME_HTML_MOSTLY 5658 3.43 4.23 3.06 83 MIME_QP_LONG_LINE 5240 3.19 3.96 2.83 84 RELAYCOUNTRY_META 4935 7.91 19.10 2.67 85 T_REMOTE_IMAGE 4914 2.18 1.15 2.66 86 HTML_IMAGE_RATIO_08 4866 2.64 2.68 2.63 87 SCC_BODY_URI_ONLY 4502 2.11 1.43 2.43 88 BAYES_95 4490 3.41 5.52 2.43 89 XM_CamelCaseFrm001 4462 3.11 4.59 2.41 90 RCVD_IN_MSPIKE_H4 4413 2.27 2.04 2.39 91 HTML_IMAGE_RATIO_06 4312 2.41 2.57 2.33 92 XMStockSpam_06 4300 2.30 2.24 2.32 93 MIME_HTML_ONLY_MULTI 4257 2.50 2.92 2.30 94 XM_Body_Dirty_Words 4218 3.84 7.18 2.28 95 TR_MetaPhish_Combo_01 4167 2.29 2.37 2.25 96 FROM_EXCESS_BASE64 4036 2.38 2.81 2.18 97 TR_XM_DKIM_Undo 3979 11.52 31.53 2.15 98 TR_XM_PhishingBody 3915 2.98 4.81 2.12 99 T_XMDrugObfuBody_14 3883 2.78 4.24 2.10 100 MAILING_LIST_MULTI 3848 2.05 2.00 2.08 101 MIME_CHARSET_FARAWAY 3788 1.91 1.62 2.05 102 XMSexyCombo_05 3681 2.99 5.11 1.99 103 TR_DCC_Bayes_99 3589 9.77 26.47 1.94 104 T_TVD_MIME_NO_HEADERS 3587 1.37 0.15 1.94 105 RCVD_IN_IADB_LISTED 3492 1.46 0.56 1.89 106 TR_Symld_Words 3472 1.55 0.86 1.88 107 TR_XM_UnparsRelay 3386 4.63 10.61 1.83 108 CHARSET_FARAWAY_HEADER 3364 1.67 1.37 1.82 109 XMBdyGiftCard01 3300 1.56 1.09 1.78 110 TM2_M_URI_OPT_OUT 3154 1.89 2.29 1.70 111 RCVD_IN_IADB_SPF 3145 1.31 0.48 1.70 112 T_TooManySym_03 3106 1.27 0.39 1.68 113 HTML_MIME_NO_HTML_TAG 3096 1.49 1.10 1.67 114 TR_XM_SpammyWords5 3082 2.25 3.49 1.67 115 XM_PDF 3069 1.23 0.31 1.66 116 UNTRUSTED_Relay 2958 3.16 6.49 1.60 117 BAYES_05 2909 1.29 0.70 1.57 118 RCVD_IN_IADB_SENDERID 2864 1.20 0.45 1.55 119 RCVD_IN_IADB_DK 2805 1.18 0.45 1.52 120 IN_HORDE_ADDRESS_BOOK 2742 1.04 0.08 1.48 121 TR_XM_SpammyRelay 2741 5.37 13.68 1.48 122 URI_NOVOWEL 2739 1.36 1.11 1.48 123 XMGappySubj_01 2606 1.00 0.14 1.41 124 TVD_SPACE_RATIO 2605 1.01 0.18 1.41 125 URI_OPTOUT_3LD 2509 1.16 0.74 1.36 126 XM_B_Investor 2383 2.41 4.80 1.29 127 LOW_PRICE 2370 0.96 0.29 1.28 128 XM_OfRef6 2350 1.98 3.50 1.27 129 RCVD_IN_IADB_VOUCHED 2330 0.96 0.32 1.26 130 BOTNET 2324 4.31 10.83 1.26 131 XM_B_COPY_HTML 2318 1.36 1.60 1.25 132 XM_B_Unsub2 2299 1.81 3.02 1.24 133 TVD_RCVD_IP 2217 1.33 1.60 1.20 134 XM_DK_Undo_01 2147 1.24 1.39 1.16 135 XM_B_URI_Unicode 2139 1.54 2.36 1.16 136 XMDiploma_00 2129 1.34 1.75 1.15 137 SUBJ_ALL_CAPS 2098 1.31 1.70 1.13 138 DKIM_INVALID 2085 2.61 5.77 1.13 139 XM_SendGrid 2014 1.13 1.21 1.09 140 XMBrknScrpt_02 1970 1.51 2.45 1.06 141 FILL_THIS_FORM 1939 0.82 0.32 1.05 142 XM_GoogleGroups 1934 0.98 0.84 1.05 143 T_XMHurry_00 1909 1.54 2.63 1.03 144 FILL_THIS_FORM_LONG 1820 0.73 0.19 0.98 145 T_XMDrugObfuBody_08 1816 1.38 2.22 0.98 146 RELAYCOUNTRY_CA 1741 3.10 7.71 0.94 147 XM_UB50 1665 1.72 3.46 0.90 148 XM_H_PHPMailer 1597 0.87 0.88 0.86 149 TR_XM_Base64_M1 1568 0.83 0.80 0.85 150 HTML_TAG_BALANCE_BODY 1567 1.00 1.32 0.85 151 RCVD_IN_IADB_OPTIN 1565 0.64 0.21 0.85 152 XM_B_DNDMA 1541 0.79 0.70 0.83 153 TooManyTo_003 1537 0.74 0.56 0.83 154 XMBSHREFv2 1535 0.68 0.37 0.83 155 XM_ProductURIs 1524 0.86 0.94 0.82 156 URI_HEX 1523 1.05 1.52 0.82 157 XMGappySubj_02 1518 0.57 0.04 0.82 158 TR_XM_DK_SendGrid 1515 0.81 0.79 0.82 159 XM_SPF_SoftFail 1511 1.44 2.76 0.82 160 XMClaimOffer 1475 0.68 0.42 0.80 161 XMBody_95 1390 0.57 0.17 0.75 162 T_STY_INVIS_DIRECT 1385 0.88 1.15 0.75 163 XMSubMetaI_00 1351 0.78 0.89 0.73 164 XM_H_Long_From02 1285 0.84 1.17 0.69 165 XMLngstWrd_00 1267 0.59 0.38 0.68 166 XM_B_SpammyWords4 1264 1.39 2.90 0.68 167 XMSlimDrugH 1251 0.69 0.72 0.68 168 XMGenDplmaNmb 1214 0.70 0.80 0.66 169 XMPhish08 1208 0.76 0.99 0.65 170 HTML_TEXT_INVISIBLE_STYLE 1194 0.58 0.46 0.65 171 TM2_M_OBFU_COMMENT 1171 0.70 0.85 0.63 172 TooManyTo_004 1159 0.60 0.53 0.63 173 TR_XM_MSPIKECOMBO 1159 2.73 7.20 0.63 174 RCVD_IN_MSPIKE_BL 1159 2.73 7.22 0.63 175 XMPhish30 1132 0.87 1.43 0.61 176 XM_OfRef7 1120 0.65 0.75 0.61 177 DIET_1 1117 1.01 1.89 0.60 178 DKIM_ADSP_CUSTOM_MED 1072 0.75 1.10 0.58 179 MPART_ALT_DIFF_COUNT 1063 0.68 0.90 0.57 180 T_XMDrugObfuBody_00 1030 0.72 1.08 0.56 181 TR_XM_SpammyWords2 1012 4.46 12.81 0.55 182 TooManyTo_005 1005 0.53 0.51 0.54 183 XMNoVowels 989 0.57 0.64 0.53 184 MSGID_FROM_MTA_HEADER 980 0.39 0.11 0.53 185 USER_IN_WELCOMELIST 971 0.36 0.00 0.52 186 USER_IN_WHITELIST 971 0.36 0.00 0.52 187 PLING_QUERY 967 0.67 0.97 0.52 188 URI_TRY_3LD 949 0.80 1.40 0.51 189 RCVD_IN_PSBL 940 0.95 1.90 0.51 190 SUBJ_DOLLARS 939 0.66 1.00 0.51 191 XMSolicitRefs_0 936 0.48 0.43 0.51 192 TR_LOTS_OF_MONEY2 919 0.67 1.03 0.50 193 T_MONEY_PERCENT 919 0.67 1.03 0.50 194 RCVD_IN_BL_SPAMCOP_NET 916 3.95 11.33 0.50 195 HTML_FONT_FACE_BAD 905 0.60 0.84 0.49 196 RCVD_IN_PBL 898 0.71 1.20 0.49 197 T_TooManySym_04 895 0.39 0.19 0.48 198 XMSubMetaSxObfu_02 874 0.49 0.53 0.47 199 T_FILL_THIS_FORM_SHORT 864 1.28 3.02 0.47 200 THIS_AD 847 0.83 1.63 0.46 ----------------------------------------------------------------------