Email: 249056 Autolearn: 0 AvgScore: 5.18 AvgScanTime: 1.40 sec Spam: 83535 Autolearn: 0 AvgScore: 14.10 AvgScanTime: 1.55 sec Ham: 165521 Autolearn: 0 AvgScore: 0.68 AvgScanTime: 1.32 sec Time Spent Running SA: 96.54 hours Time Spent Processing Spam: 35.85 hours Time Spent Processing Ham: 60.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 83053 99.55 99.42 99.62 2 HTML_MESSAGE 79557 87.69 95.24 83.88 3 DKIM_SIGNED 73890 79.95 88.45 75.65 4 XM_DK_Pass 71093 78.31 85.11 74.88 5 DKIM_VALID 70759 77.85 84.71 74.40 6 XM_B_Unicode 70718 75.34 84.66 70.63 7 RELAYCOUNTRY_US 66638 80.42 79.77 80.75 8 DCC_CHECK 65859 59.08 78.84 49.11 9 XM_B_SpammyWords 58113 54.55 69.57 46.97 10 XMListUnsubscribeExists 57572 57.72 68.92 52.07 11 DKIM_VALID_AU 56455 65.00 67.58 63.69 12 XM_B_Unicode3 42775 47.52 51.21 45.66 13 LOC_TINY_FONT_1 39086 37.45 46.79 32.73 14 XM_DK_Undo_02 36414 18.63 43.59 6.03 15 XM_B_SpammyWords2 34507 29.10 41.31 22.94 16 BAYES_50 30810 52.70 36.88 60.68 17 HTML_FONT_LOW_CONTRAST 30568 32.33 36.59 30.18 18 BAYES_99 28940 14.88 34.64 4.90 19 FVGT_m_MULTI_ODD 28227 29.69 33.79 27.63 20 DKIM_VALID_EF 26536 30.44 31.77 29.77 21 TR_XM_DKIM_Undo 26408 12.36 31.61 2.65 22 MIME_HTML_ONLY 25162 24.95 30.12 22.34 23 T_KAM_HTML_FONT_INVALID 24780 24.46 29.66 21.84 24 BAYES_999 22707 11.65 27.18 3.81 25 TR_DCC_Bayes_99 21351 10.12 25.56 2.33 26 TR_XM_DK_Unsub 20669 18.22 24.74 14.93 27 T_TM2_M_HEADER_IN_MSG 17995 23.20 21.54 24.04 28 XMSubLong 17737 21.97 21.23 22.34 29 DCC_CHECK_NEGATIVE 17269 40.74 20.67 50.87 30 XM_Multi_Part_URI 17099 18.17 20.47 17.02 31 XM_B_Unsub 16525 15.21 19.78 12.90 32 RELAYCOUNTRY_META 16116 8.54 19.29 3.12 33 TR_XM_BayesUnsub 15891 12.60 19.02 9.35 34 RCVD_IN_MSPIKE_H2 15810 16.42 18.93 15.16 35 UNPARSEABLE_RELAY 14837 14.92 17.76 13.49 36 XM_B_SpammyWords3 13001 10.56 15.56 8.04 37 TR_MAX_INTL_RELAY 12835 9.73 15.36 6.88 38 TR_XM_SpammyRelay 12517 6.16 14.98 1.70 39 BOTNET_IPINHOSTNAME 10384 6.68 12.43 3.78 40 LOTS_OF_MONEY 10379 8.27 12.42 6.17 41 TR_XM_SpammyWords2 10346 4.54 12.39 0.59 42 FSL_BULK_SIG 9567 11.73 11.45 11.87 43 TR_XM_SpammyWords4 9318 6.80 11.15 4.60 44 RCVD_IN_BL_SPAMCOP_NET 8815 3.88 10.55 0.51 45 TR_XM_UnparsRelay 7957 4.44 9.53 1.87 46 BAYES_80 7856 5.87 9.40 4.08 47 RELAYCOUNTRY_CA 7788 3.80 9.32 1.01 48 BOTNET 7648 3.85 9.16 1.17 49 XM_B_Phish_Phrases 7437 7.06 8.90 6.13 50 BAYES_60 7245 7.69 8.67 7.19 51 XM_Evil_Numbers_Gen 7166 9.30 8.58 9.66 52 HTML_IMAGE_RATIO_02 6745 6.23 8.07 5.30 53 RCVD_IN_MSPIKE_WL 6592 13.61 7.89 16.50 54 XM_Body_Dirty_Words 6230 4.27 7.46 2.65 55 RCVD_IN_MSPIKE_BL 5952 2.95 7.13 0.84 56 TR_XM_MSPIKECOMBO 5952 2.95 7.13 0.84 57 UNTRUSTED_Relay 5223 3.14 6.25 1.57 58 XM_UncommonTLD01 5125 5.40 6.14 5.03 59 MPART_ALT_DIFF 5016 5.46 6.00 5.19 60 LotsOfNums_01 4889 6.46 5.85 6.77 61 XMSubMetaSx_00 4859 4.56 5.82 3.93 62 BAYES_95 4700 3.75 5.63 2.80 63 XM_H_Long_From01 4574 5.56 5.48 5.60 64 XM_H_GMP 4454 6.13 5.33 6.53 65 TR_XM_SpammyWords3 4440 2.03 5.32 0.38 66 RCVD_IN_VALIDITY_RPBL 4063 1.72 4.86 0.14 67 XMStrtUSub 3986 5.30 4.77 5.57 68 XM_B_PhoneNumber 3918 7.27 4.69 8.57 69 HTML_IMAGE_RATIO_04 3893 4.19 4.66 3.95 70 XM_CamelCaseFrm001 3873 3.68 4.64 3.19 71 XM_OfRef6 3835 2.20 4.59 1.00 72 XM_B_Investor 3834 2.44 4.59 1.35 73 XMSexyCombo_05 3805 2.69 4.55 1.74 74 TR_XM_PhishingBody 3660 2.72 4.38 1.88 75 TR_XM_SpammyWords5 3501 2.31 4.19 1.37 76 T_XMDrugObfuBody_14 3492 2.96 4.18 2.34 77 TR_XM_NoHeaderRelay 3437 1.58 4.11 0.31 78 RCVD_IN_MSPIKE_H3 3351 6.13 4.01 7.20 79 TM2_M_VERY_LONG_WORD 3325 2.44 3.98 1.66 80 RCVD_IN_MSPIKE_L3 3254 1.59 3.90 0.43 81 TR_XM_SPAMCOP 3252 1.37 3.89 0.10 82 MIME_HTML_MOSTLY 3223 3.06 3.86 2.66 83 TooManyTo_001 3183 6.22 3.81 7.44 84 DKIM_INVALID 3131 2.09 3.75 1.26 85 XMBody_17 3125 1.65 3.74 0.59 86 XM_B_SpammyTLD 2971 2.99 3.56 2.71 87 XM_URI_RBL 2912 1.42 3.49 0.38 88 XM_B_Unsub2 2821 1.94 3.38 1.22 89 XM_SPF_SoftFail 2775 1.91 3.32 1.20 90 MIME_HTML_ONLY_MULTI 2758 3.06 3.30 2.94 91 XMNumbers 2742 5.25 3.28 6.25 92 T_FILL_THIS_FORM_SHORT 2623 1.65 3.14 0.90 93 HTML_IMAGE_RATIO_06 2546 3.55 3.05 3.80 94 RCVD_IN_VALIDITY_SAFE 2462 4.65 2.95 5.51 95 USER_IN_DEF_DKIM_WL 2451 14.47 2.93 20.29 96 XM_UB50 2451 1.57 2.93 0.89 97 XM_SendGrid 2386 3.19 2.86 3.37 98 ALL_TRUSTED 2361 11.64 2.83 16.09 99 T_XMDrugObfuBody_08 2238 1.62 2.68 1.09 100 MPART_ALT_DIFF_COUNT 2175 1.27 2.60 0.60 101 SUBJ_ALL_CAPS 2149 1.46 2.57 0.89 102 SpammyFromTLD_01 2116 1.16 2.53 0.46 103 RELAYCOUNTRY_AU 2060 1.21 2.47 0.57 104 TM2_M_URI_OPT_OUT 2021 2.12 2.42 1.96 105 XM_B_SpammyWords4 2007 1.56 2.40 1.14 106 T_XMHurry_00 2003 1.27 2.40 0.71 107 T_TooManySym_01 1987 5.81 2.38 7.54 108 FROM_EXCESS_BASE64 1980 2.23 2.37 2.15 109 KHOP_HELO_FCRDNS 1896 1.74 2.27 1.47 110 TR_XM_MSPIKECOMBO2 1876 0.76 2.25 0.01 111 HTML_IMAGE_RATIO_08 1870 2.29 2.24 2.32 112 TR_LOTS_OF_MONEY3 1835 1.10 2.20 0.54 113 RCVD_IN_XBL 1819 0.74 2.18 0.01 114 RCVD_IN_MSPIKE_H4 1800 3.28 2.15 3.84 115 RCVD_IN_VALIDITY_CERTIFIED 1767 3.75 2.12 4.57 116 XMBrknScrpt_02 1754 1.48 2.10 1.16 117 XMDiploma_00 1752 1.76 2.10 1.59 118 URI_NOVOWEL 1740 1.56 2.08 1.30 119 XMStockSpam_06 1737 1.87 2.08 1.76 120 T_REMOTE_IMAGE 1707 2.95 2.04 3.41 121 XM_B_URI_Unicode 1680 1.88 2.01 1.81 122 RCVD_IN_SBL_CSS 1645 0.68 1.97 0.03 123 RCVD_IN_PSBL 1613 1.28 1.93 0.95 124 HK_RANDOM_REPLYTO 1610 0.74 1.93 0.15 125 RDNS_DYNAMIC 1592 0.80 1.91 0.25 126 MAILING_LIST_MULTI 1574 2.12 1.88 2.25 127 PDS_RDNS_DYNAMIC_FP 1568 0.64 1.88 0.02 128 RCVD_IN_MSPIKE_L4 1567 0.90 1.88 0.40 129 TR_XM_DK_SendGrid 1518 2.12 1.82 2.28 130 MIME_QP_LONG_LINE 1515 2.92 1.81 3.48 131 SpammyFromTLD_02 1511 0.76 1.81 0.23 132 TVD_RCVD_IP 1510 1.59 1.81 1.49 133 TR_XM_INV_DKIM 1484 0.65 1.78 0.08 134 BAYES_40 1444 3.89 1.73 4.98 135 RCVD_IN_MSPIKE_H5 1441 4.20 1.73 5.45 136 XM_DK_Undo_01 1421 1.47 1.70 1.35 137 TR_Mismatch_TLD_02 1397 0.61 1.67 0.07 138 XMPhish30 1387 1.11 1.66 0.84 139 XMBdyGiftCard01 1366 1.19 1.64 0.96 140 DIET_1 1338 0.74 1.60 0.30 141 XM_H_Long_From02 1336 1.05 1.60 0.78 142 XM_OfRef7 1319 0.70 1.58 0.26 143 BOTNET_NORDNS 1300 0.53 1.56 0.02 144 XM_HighProb1 1293 0.52 1.55 0.00 145 URI_TRY_3LD 1276 1.04 1.53 0.80 146 TR_XM_Spammywords 1267 0.69 1.52 0.27 147 XM_S_SpammyWords 1267 0.69 1.52 0.27 148 TR_XM_PHPForged 1173 0.76 1.40 0.44 149 TR_XM_FormFill2 1146 0.76 1.37 0.45 150 T_XMDrugObfuBody_00 1145 0.90 1.37 0.66 151 TR_XM_PHPDW 1141 0.76 1.37 0.46 152 TR_XM_RelayPhish 1139 0.50 1.36 0.07 153 TR_MetaPhish_Combo_01 1138 2.56 1.36 3.16 154 BAYES_20 1136 2.64 1.36 3.28 155 URI_HEX 1136 1.09 1.36 0.95 156 RCVD_IN_MSPIKE_L5 1131 0.46 1.35 0.00 157 XM_H_PHPOS 1106 0.73 1.32 0.43 158 RCVD_IN_SBL 1099 0.44 1.32 0.00 159 FILL_THIS_FORM 1098 0.77 1.31 0.49 160 XM_B_COPY_HTML 1085 1.02 1.30 0.87 161 XM_B_DNDMA 1068 0.75 1.28 0.48 162 TR_XM_MaxSPIKE 1065 0.43 1.27 0.00 163 TM2_M_OBFU_COMMENT 1060 0.71 1.27 0.43 164 DKIM_ADSP_NXDOMAIN 1030 0.72 1.23 0.46 165 TR_Mismatch_TLD_01 1030 0.63 1.23 0.32 166 MISSING_HEADERS 1024 0.58 1.23 0.25 167 RCVD_IN_PBL 1006 0.77 1.20 0.56 168 FORGED_MUA_OUTLOOK 995 0.43 1.19 0.04 169 FSL_NEW_HELO_USER 992 0.40 1.19 0.00 170 AXB_XMAILER_MIMEOLE_OL_024C2 989 0.40 1.18 0.00 171 RCVD_IN_SBL_DROP 987 0.40 1.18 0.00 172 SCC_BODY_URI_ONLY 981 2.45 1.17 3.09 173 FSL_CTYPE_WIN1251 970 0.39 1.16 0.00 174 FROM_MISSP_REPLYTO 969 0.39 1.16 0.00 175 T_STY_INVIS_DIRECT 962 0.84 1.15 0.68 176 FROM_MISSPACED 956 0.39 1.14 0.00 177 NSL_RCVD_FROM_USER 950 0.38 1.14 0.00 178 HTML_MIME_NO_HTML_TAG 948 1.65 1.13 1.92 179 XMReplyNow 946 0.50 1.13 0.18 180 DKIM_ADSP_CUSTOM_MED 942 0.91 1.13 0.80 181 FROM_MISSP_EH_MATCH 936 0.38 1.12 0.00 182 FROM_MISSP_MSFT 934 0.38 1.12 0.00 183 XMSexyCombo_01 922 0.48 1.10 0.17 184 BOUNCE_MESSAGE 920 3.13 1.10 4.16 185 REPLYTO_WITHOUT_TO_CC 920 0.38 1.10 0.02 186 ANY_BOUNCE_MESSAGE 920 3.13 1.10 4.16 187 XM_UB99 906 0.36 1.08 0.00 188 THIS_AD 898 0.59 1.07 0.35 189 TR_XM_InvalidRelay 891 0.36 1.07 0.01 190 TO_NO_BRKTS_FROM_MSSP 887 0.36 1.06 0.01 191 XM_DIRTYINTL 886 0.41 1.06 0.08 192 TM2_M_A_HREF_HREF 885 0.48 1.06 0.19 193 FROM_MISSP_USER 884 0.35 1.06 0.00 194 TO_NO_BRKTS_MSFT 882 0.35 1.06 0.00 195 HTML_FONT_FACE_BAD 863 0.62 1.03 0.41 196 XM_B_Phish66 862 0.66 1.03 0.47 197 MultiRelay_CC 859 0.39 1.03 0.07 198 HK_SCAM 857 0.35 1.03 0.01 199 XMGenDplmaNmb 855 0.84 1.02 0.75 200 XPRIO 851 0.35 1.02 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 164887 99.55 99.42 99.62 2 HTML_MESSAGE 138843 87.69 95.24 83.88 3 RELAYCOUNTRY_US 133660 80.42 79.77 80.75 4 DKIM_SIGNED 125220 79.95 88.45 75.65 5 XM_DK_Pass 123936 78.31 85.11 74.88 6 DKIM_VALID 123140 77.85 84.71 74.40 7 XM_B_Unicode 116912 75.34 84.66 70.63 8 DKIM_VALID_AU 105420 65.00 67.58 63.69 9 BAYES_50 100435 52.70 36.88 60.68 10 XMListUnsubscribeExists 86184 57.72 68.92 52.07 11 DCC_CHECK_NEGATIVE 84208 40.74 20.67 50.87 12 DCC_CHECK 81282 59.08 78.84 49.11 13 XM_B_SpammyWords 77748 54.55 69.57 46.97 14 XM_B_Unicode3 75585 47.52 51.21 45.66 15 LOC_TINY_FONT_1 54181 37.45 46.79 32.73 16 HTML_FONT_LOW_CONTRAST 49951 32.33 36.59 30.18 17 DKIM_VALID_EF 49282 30.44 31.77 29.77 18 FVGT_m_MULTI_ODD 45727 29.69 33.79 27.63 19 T_TM2_M_HEADER_IN_MSG 39787 23.20 21.54 24.04 20 XM_B_SpammyWords2 37973 29.10 41.31 22.94 21 MIME_HTML_ONLY 36982 24.95 30.12 22.34 22 XMSubLong 36972 21.97 21.23 22.34 23 T_KAM_HTML_FONT_INVALID 36144 24.46 29.66 21.84 24 USER_IN_DEF_DKIM_WL 33578 14.47 2.93 20.29 25 XM_Multi_Part_URI 28166 18.17 20.47 17.02 26 RCVD_IN_MSPIKE_WL 27313 13.61 7.89 16.50 27 ALL_TRUSTED 26627 11.64 2.83 16.09 28 RCVD_IN_MSPIKE_H2 25086 16.42 18.93 15.16 29 TR_XM_DK_Unsub 24715 18.22 24.74 14.93 30 UNPARSEABLE_RELAY 22323 14.92 17.76 13.49 31 XM_B_Unsub 21354 15.21 19.78 12.90 32 FSL_BULK_SIG 19649 11.73 11.45 11.87 33 BAYES_00 16969 6.99 0.54 10.25 34 XM_DKIMWhitelistDomains 16587 6.66 0.00 10.02 35 XM_Evil_Numbers_Gen 15988 9.30 8.58 9.66 36 TR_XM_BayesUnsub 15483 12.60 19.02 9.35 37 XM_B_PhoneNumber 14190 7.27 4.69 8.57 38 XM_B_SpammyWords3 13303 10.56 15.56 8.04 39 T_TooManySym_01 12483 5.81 2.38 7.54 40 TooManyTo_001 12314 6.22 3.81 7.44 41 RCVD_IN_MSPIKE_H3 11921 6.13 4.01 7.20 42 BAYES_60 11901 7.69 8.67 7.19 43 TR_MAX_INTL_RELAY 11395 9.73 15.36 6.88 44 TR_XM_DK_Bayes 11272 4.64 0.33 6.81 45 LotsOfNums_01 11210 6.46 5.85 6.77 46 TR_XM_DK_Bayes1 11186 4.60 0.32 6.76 47 XM_H_GMP 10801 6.13 5.33 6.53 48 XMNumbers 10344 5.25 3.28 6.25 49 LOTS_OF_MONEY 10210 8.27 12.42 6.17 50 XM_B_Phish_Phrases 10147 7.06 8.90 6.13 51 XM_DK_Undo_02 9989 18.63 43.59 6.03 52 TR_XM_DK_Bayes2 9570 3.93 0.27 5.78 53 XM_H_Long_From01 9264 5.56 5.48 5.60 54 XMStrtUSub 9217 5.30 4.77 5.57 55 RCVD_IN_VALIDITY_SAFE 9118 4.65 2.95 5.51 56 RCVD_IN_MSPIKE_H5 9029 4.20 1.73 5.45 57 HTML_IMAGE_RATIO_02 8765 6.23 8.07 5.30 58 MPART_ALT_DIFF 8593 5.46 6.00 5.19 59 XM_UncommonTLD01 8327 5.40 6.14 5.03 60 BAYES_40 8251 3.89 1.73 4.98 61 BAYES_99 8114 14.88 34.64 4.90 62 TR_XM_SpammyWords4 7620 6.80 11.15 4.60 63 RCVD_IN_VALIDITY_CERTIFIED 7571 3.75 2.12 4.57 64 T_TooManySym_02 7432 3.25 0.80 4.49 65 ANY_BOUNCE_MESSAGE 6881 3.13 1.10 4.16 66 BOUNCE_MESSAGE 6880 3.13 1.10 4.16 67 BAYES_80 6758 5.87 9.40 4.08 68 INVALID_MSGID 6614 2.79 0.39 4.00 69 HTML_IMAGE_RATIO_04 6539 4.19 4.66 3.95 70 XMSubMetaSx_00 6510 4.56 5.82 3.93 71 RCVD_IN_MSPIKE_H4 6363 3.28 2.15 3.84 72 BAYES_999 6314 11.65 27.18 3.81 73 HTML_IMAGE_RATIO_06 6286 3.55 3.05 3.80 74 TO_MALFORMED 6271 2.53 0.03 3.79 75 BOTNET_IPINHOSTNAME 6252 6.68 12.43 3.78 76 MIME_QP_LONG_LINE 5758 2.92 1.81 3.48 77 T_REMOTE_IMAGE 5649 2.95 2.04 3.41 78 TooManyTo_002 5634 2.46 0.59 3.40 79 XM_SendGrid 5571 3.19 2.86 3.37 80 BAYES_20 5427 2.64 1.36 3.28 81 XM_CamelCaseFrm001 5283 3.68 4.64 3.19 82 TR_MetaPhish_Combo_01 5231 2.56 1.36 3.16 83 RELAYCOUNTRY_META 5157 8.54 19.29 3.12 84 SCC_BODY_URI_ONLY 5115 2.45 1.17 3.09 85 MIME_HTML_ONLY_MULTI 4865 3.06 3.30 2.94 86 BAYES_95 4633 3.75 5.63 2.80 87 XM_B_SpammyTLD 4479 2.99 3.56 2.71 88 MIME_HTML_MOSTLY 4400 3.06 3.86 2.66 89 XM_Body_Dirty_Words 4393 4.27 7.46 2.65 90 TR_XM_DKIM_Undo 4383 12.36 31.61 2.65 91 XM_PDF 4283 1.90 0.55 2.59 92 T_XMDrugObfuBody_14 3870 2.96 4.18 2.34 93 TR_DCC_Bayes_99 3851 10.12 25.56 2.33 94 HTML_IMAGE_RATIO_08 3835 2.29 2.24 2.32 95 RCVD_IN_IADB_LISTED 3796 1.71 0.55 2.29 96 TR_XM_DK_SendGrid 3769 2.12 1.82 2.28 97 MAILING_LIST_MULTI 3717 2.12 1.88 2.25 98 XM_B_FormFill 3679 1.48 0.02 2.22 99 FROM_EXCESS_BASE64 3565 2.23 2.37 2.15 100 RCVD_IN_IADB_SPF 3410 1.53 0.48 2.06 101 TM2_M_URI_OPT_OUT 3252 2.12 2.42 1.96 102 HTML_MIME_NO_HTML_TAG 3171 1.65 1.13 1.92 103 TR_XM_PhishingBody 3119 2.72 4.38 1.88 104 RCVD_IN_IADB_SENDERID 3106 1.40 0.45 1.88 105 TR_XM_UnparsRelay 3103 4.44 9.53 1.87 106 RCVD_IN_IADB_DK 3078 1.39 0.45 1.86 107 BAYES_05 3027 1.44 0.67 1.83 108 XM_B_URI_Unicode 2998 1.88 2.01 1.81 109 T_TooManySym_03 2978 1.35 0.45 1.80 110 XMStockSpam_06 2908 1.87 2.08 1.76 111 XMSexyCombo_05 2884 2.69 4.55 1.74 112 TR_XM_SpammyRelay 2818 6.16 14.98 1.70 113 TM2_M_VERY_LONG_WORD 2749 2.44 3.98 1.66 114 IN_HORDE_ADDRESS_BOOK 2673 1.10 0.08 1.61 115 XMDiploma_00 2633 1.76 2.10 1.59 116 T_TVD_MIME_NO_HEADERS 2610 1.06 0.04 1.58 117 UNTRUSTED_Relay 2599 3.14 6.25 1.57 118 TVD_SPACE_RATIO 2530 1.07 0.17 1.53 119 TVD_RCVD_IP 2460 1.59 1.81 1.49 120 XMGappySubj_01 2442 1.03 0.15 1.48 121 KHOP_HELO_FCRDNS 2433 1.74 2.27 1.47 122 RCVD_IN_IADB_VOUCHED 2431 1.08 0.31 1.47 123 TR_XM_SpammyWords5 2262 2.31 4.19 1.37 124 XM_DK_Undo_01 2240 1.47 1.70 1.35 125 XM_B_Investor 2234 2.44 4.59 1.35 126 URI_OPTOUT_3LD 2184 1.19 0.93 1.32 127 URI_NOVOWEL 2155 1.56 2.08 1.30 128 DKIM_INVALID 2080 2.09 3.75 1.26 129 TR_Symld_Words 2041 1.14 0.96 1.23 130 XM_B_Unsub2 2016 1.94 3.38 1.22 131 XM_SPF_SoftFail 1978 1.91 3.32 1.20 132 BOTNET 1932 3.85 9.16 1.17 133 XMBrknScrpt_02 1926 1.48 2.10 1.16 134 XMGappySubj_02 1890 0.78 0.05 1.14 135 XM_B_SpammyWords4 1889 1.56 2.40 1.14 136 LOW_PRICE 1867 0.84 0.26 1.13 137 HTML_EXTRA_CLOSE 1855 0.75 0.02 1.12 138 XM_GoogleGroups 1846 1.04 0.89 1.12 139 T_XMDrugObfuBody_08 1808 1.62 2.68 1.09 140 RELAYCOUNTRY_CA 1676 3.80 9.32 1.01 141 XM_OfRef6 1652 2.20 4.59 1.00 142 RCVD_IN_IADB_OPTIN 1637 0.73 0.21 0.99 143 XMBdyGiftCard01 1590 1.19 1.64 0.96 144 URI_HEX 1578 1.09 1.36 0.95 145 RCVD_IN_PSBL 1568 1.28 1.93 0.95 146 XMBSHREFv2 1501 0.84 0.71 0.91 147 T_FILL_THIS_FORM_SHORT 1493 1.65 3.14 0.90 148 SUBJ_ALL_CAPS 1480 1.46 2.57 0.89 149 XM_UB50 1468 1.57 2.93 0.89 150 XM_B_COPY_HTML 1446 1.02 1.30 0.87 151 TooManyTo_003 1442 0.76 0.53 0.87 152 XM_H_PHPMailer 1439 0.85 0.80 0.87 153 RCVD_IN_MSPIKE_BL 1392 2.95 7.13 0.84 154 TR_XM_MSPIKECOMBO 1391 2.95 7.13 0.84 155 XMPhish30 1385 1.11 1.66 0.84 156 DKIM_ADSP_CUSTOM_MED 1330 0.91 1.13 0.80 157 URI_TRY_3LD 1317 1.04 1.53 0.80 158 XM_H_Long_From02 1288 1.05 1.60 0.78 159 XMGenDplmaNmb 1238 0.84 1.02 0.75 160 T_XMHurry_00 1172 1.27 2.40 0.71 161 T_STY_INVIS_DIRECT 1129 0.84 1.15 0.68 162 T_XMDrugObfuBody_00 1096 0.90 1.37 0.66 163 TooManyTo_004 1056 0.59 0.50 0.64 164 TR_XM_Base64_M1 1054 0.59 0.50 0.64 165 HTML_TAG_BALANCE_BODY 1048 0.72 0.90 0.63 166 XMSubMetaI_00 1012 0.72 0.95 0.61 167 MPART_ALT_DIFF_COUNT 993 1.27 2.60 0.60 168 SUBJ_DOLLARS 990 0.72 0.96 0.60 169 XMBody_17 979 1.65 3.74 0.59 170 TR_XM_SpammyWords2 970 4.54 12.39 0.59 171 RELAYCOUNTRY_AU 948 1.21 2.47 0.57 172 XMBody_95 944 0.42 0.13 0.57 173 RCVD_IN_PBL 920 0.77 1.20 0.56 174 T_Symld_Words_02 905 0.56 0.59 0.55 175 TR_LOTS_OF_MONEY3 901 1.10 2.20 0.54 176 XMLngstWrd_00 893 0.52 0.49 0.54 177 XMSlimDrugH 892 0.60 0.73 0.54 178 TooManyTo_005 891 0.51 0.47 0.54 179 XMNoVowels 872 0.51 0.46 0.53 180 RCVD_IN_BL_SPAMCOP_NET 841 3.88 10.55 0.51 181 FORGED_GMAIL_RCVD 836 0.64 0.89 0.51 182 FILL_THIS_FORM 815 0.77 1.31 0.49 183 T_TooManySym_04 810 0.39 0.20 0.49 184 NML_ADSP_CUSTOM_MED 808 0.66 1.01 0.49 185 XM_B_DNDMA 795 0.75 1.28 0.48 186 XM_B_Phish66 784 0.66 1.03 0.47 187 XM_ShortIntro_01 774 0.43 0.35 0.47 188 XMHTML_After_End 772 0.46 0.46 0.47 189 XM_ProductURIs 768 0.61 0.90 0.46 190 DKIM_ADSP_NXDOMAIN 767 0.72 1.23 0.46 191 TR_XM_PHPDW 764 0.76 1.37 0.46 192 SpammyFromTLD_01 762 1.16 2.53 0.46 193 XM_S_SubURI 757 0.32 0.06 0.46 194 TR_XM_FormFill2 745 0.76 1.37 0.45 195 XMSolicitRefs_0 736 0.55 0.76 0.44 196 TR_XM_PHPForged 731 0.76 1.40 0.44 197 HTTPS_HTTP_MISMATCH 729 0.48 0.56 0.44 198 XMSubMetaSxObfu_03 720 0.43 0.42 0.43 199 TM2_M_OBFU_COMMENT 716 0.71 1.27 0.43 200 RCVD_IN_MSPIKE_L3 714 1.59 3.90 0.43 ----------------------------------------------------------------------