Email: 243687 Autolearn: 0 AvgScore: 6.70 AvgScanTime: 1.42 sec Spam: 89176 Autolearn: 0 AvgScore: 16.99 AvgScanTime: 1.58 sec Ham: 154511 Autolearn: 0 AvgScore: 0.76 AvgScanTime: 1.33 sec Time Spent Running SA: 96.37 hours Time Spent Processing Spam: 39.07 hours Time Spent Processing Ham: 57.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 85968 98.49 96.40 99.70 2 HTML_MESSAGE 82274 86.09 92.26 82.54 3 DKIM_SIGNED 76934 79.71 86.27 75.93 4 XM_DK_Pass 74318 78.07 83.34 75.03 5 DKIM_VALID 73849 77.59 82.81 74.58 6 RELAYCOUNTRY_US 68895 79.53 77.26 80.84 7 XM_B_Unicode 68494 73.33 76.81 71.33 8 XM_B_SpammyWords 63324 55.39 71.01 46.38 9 DCC_CHECK 63131 58.90 70.79 52.03 10 DKIM_VALID_AU 58610 65.13 65.72 64.79 11 XMListUnsubscribeExists 56583 57.02 63.45 53.31 12 XM_B_Unicode3 42408 47.22 47.56 47.03 13 LOC_TINY_FONT_1 40138 38.42 45.01 34.61 14 XM_B_SpammyWords2 36936 28.48 41.42 21.01 15 XM_DK_Undo_02 36422 18.98 40.84 6.36 16 BAYES_50 33898 53.80 38.01 62.92 17 FVGT_m_MULTI_ODD 30927 31.03 34.68 28.92 18 BAYES_99 29225 15.32 32.77 5.24 19 HTML_FONT_LOW_CONTRAST 28499 33.45 31.96 34.31 20 TR_XM_DKIM_Undo 27397 13.02 30.72 2.81 21 DKIM_VALID_EF 25486 29.49 28.58 30.02 22 MIME_HTML_ONLY 24447 23.09 27.41 20.59 23 T_TM2_M_HEADER_IN_MSG 23849 24.81 26.74 23.70 24 DCC_CHECK_NEGATIVE 23049 39.86 25.85 47.94 25 T_KAM_HTML_FONT_INVALID 22276 22.06 24.98 20.37 26 BAYES_999 21959 11.66 24.62 4.19 27 TR_XM_DK_Unsub 19766 17.86 22.17 15.38 28 TR_DCC_Bayes_99 19728 9.68 22.12 2.50 29 RCVD_IN_MSPIKE_H2 18543 17.42 20.79 15.47 30 XM_Multi_Part_URI 18440 18.92 20.68 17.91 31 XMSubLong 18050 22.67 20.24 24.07 32 XM_B_Unsub 18029 14.07 20.22 10.52 33 TR_XM_BayesUnsub 17471 12.58 19.59 8.54 34 RELAYCOUNTRY_META 17174 9.13 19.26 3.28 35 LOTS_OF_MONEY 16145 10.21 18.10 5.66 36 XM_B_SpammyWords3 16013 10.39 17.96 6.02 37 TR_XM_SpammyWords4 14767 8.72 16.56 4.20 38 TR_MAX_INTL_RELAY 13563 9.91 15.21 6.86 39 TR_XM_SpammyRelay 13185 6.50 14.79 1.72 40 UNPARSEABLE_RELAY 12430 14.43 13.94 14.71 41 XM_Evil_Numbers_Gen 11168 11.83 12.52 11.43 42 TR_XM_SpammyWords2 10273 4.67 11.52 0.72 43 XM_B_Phish_Phrases 9797 7.20 10.99 5.02 44 RCVD_IN_BL_SPAMCOP_NET 9226 4.18 10.35 0.61 45 BOTNET_IPINHOSTNAME 9171 6.21 10.28 3.86 46 BAYES_80 8488 5.99 9.52 3.95 47 BOTNET 7751 3.93 8.69 1.18 48 FSL_BULK_SIG 7616 10.76 8.54 12.04 49 XM_H_GMP 7583 7.62 8.50 7.11 50 TR_XM_UnparsRelay 7287 4.37 8.17 2.17 51 RCVD_IN_MSPIKE_WL 7222 13.05 8.10 15.91 52 UNTRUSTED_Relay 7158 4.05 8.03 1.75 53 RELAYCOUNTRY_CA 6986 3.53 7.83 1.04 54 BAYES_60 6721 7.27 7.54 7.12 55 LotsOfNums_01 6623 7.21 7.43 7.08 56 ANY_BOUNCE_MESSAGE 6452 6.46 7.24 6.02 57 BOUNCE_MESSAGE 6452 6.46 7.24 6.01 58 XM_OfRef6 6434 3.16 7.21 0.82 59 XM_B_Unsub2 6351 3.39 7.12 1.23 60 XM_Body_Dirty_Words 5610 3.85 6.29 2.45 61 XM_UncommonTLD01 5523 5.68 6.19 5.38 62 HTML_IMAGE_RATIO_02 5492 6.07 6.16 6.02 63 XMSubMetaSx_00 5070 4.91 5.69 4.47 64 TR_XM_PhishingBody 5018 3.24 5.63 1.86 65 RCVD_IN_VALIDITY_RPBL 4997 2.10 5.60 0.08 66 BAYES_95 4762 3.80 5.34 2.91 67 XMSexyCombo_05 4691 3.08 5.26 1.82 68 XM_H_Long_From01 4657 5.32 5.22 5.38 69 TR_XM_SPAMCOP 4623 1.97 5.18 0.12 70 HTML_IMAGE_RATIO_04 4580 4.96 5.14 4.87 71 TR_XM_MSPIKECOMBO 4526 2.43 5.08 0.91 72 RCVD_IN_MSPIKE_BL 4526 2.43 5.08 0.91 73 URI_OPTOUT_3LD 4406 2.11 4.94 0.48 74 XM_B_PhoneNumber 4321 5.90 4.85 6.51 75 XM_B_Investor 4192 2.69 4.70 1.53 76 MPART_ALT_DIFF 4130 4.66 4.63 4.67 77 RCVD_IN_MSPIKE_H3 4065 6.31 4.56 7.33 78 T_XMDrugObfuBody_14 3760 3.03 4.22 2.35 79 XM_UB50 3577 2.07 4.01 0.95 80 XM_B_SpammyTLD 3557 3.14 3.99 2.65 81 XMStrtUSub 3538 5.13 3.97 5.80 82 TR_XM_NoHeaderRelay 3531 1.60 3.96 0.24 83 XMLngstWrd_00 3519 1.76 3.95 0.50 84 XM_SPF_SoftFail 3501 2.26 3.93 1.30 85 T_FILL_THIS_FORM_SHORT 3413 1.82 3.83 0.65 86 TR_XM_SpammyWords5 3364 2.49 3.77 1.75 87 TM2_M_VERY_LONG_WORD 3358 3.22 3.77 2.90 88 TooManyTo_001 3278 5.34 3.68 6.30 89 XMNumbers 3198 4.44 3.59 4.94 90 XM_CamelCaseFrm001 3177 2.77 3.56 2.32 91 T_XMDrugObfuBody_08 3132 2.22 3.51 1.47 92 TR_XM_SpammyWords3 3120 1.49 3.50 0.33 93 DKIM_INVALID 3085 2.12 3.46 1.35 94 SHORTCIRCUIT 2986 1.23 3.35 0.00 95 RCVD_IN_ZEN_LASTEXTERNAL 2986 1.23 3.35 0.00 96 RCVD_IN_XBL 2948 1.21 3.31 0.01 97 XMLngstWrd_01 2858 1.44 3.20 0.42 98 TM2_M_URI_OPT_OUT 2702 2.35 3.03 1.95 99 RCVD_IN_MSPIKE_L3 2676 1.49 3.00 0.61 100 MIME_HTML_MOSTLY 2623 3.04 2.94 3.10 101 T_TooManySym_01 2596 6.51 2.91 8.59 102 MIME_HTML_ONLY_MULTI 2477 2.66 2.78 2.59 103 XMBody_17 2448 1.38 2.75 0.59 104 RELAYCOUNTRY_AU 2430 1.27 2.72 0.43 105 XMPhish30 2406 1.42 2.70 0.69 106 XM_B_SpammyWords4 2403 1.67 2.69 1.08 107 XM_URI_RBL 2306 1.22 2.59 0.43 108 KHOP_HELO_FCRDNS 2302 2.25 2.58 2.06 109 XMLngstWrd_02 2241 1.10 2.51 0.28 110 MIME_HEADER_CTYPE_ONLY 2229 1.26 2.50 0.55 111 T_XMDrugObfuBody_00 2187 1.36 2.45 0.73 112 FROM_EXCESS_BASE64 2185 2.18 2.45 2.03 113 USER_IN_DEF_DKIM_WL 2175 13.42 2.44 19.75 114 HK_RANDOM_REPLYTO 2153 0.95 2.41 0.11 115 RCVD_IN_VALIDITY_SAFE 2108 5.27 2.36 6.95 116 TR_XM_InvalidRelay 2088 0.87 2.34 0.01 117 SpammyFromTLD_02 2086 0.98 2.34 0.20 118 T_XMHurry_00 2074 1.29 2.33 0.69 119 XM_SendGrid 2060 3.40 2.31 4.03 120 XM_DK_Undo_01 2025 1.83 2.27 1.58 121 HTML_IMAGE_RATIO_06 1943 3.24 2.18 3.85 122 XMBrknScrpt_02 1938 1.75 2.17 1.50 123 SUBJ_ALL_CAPS 1888 1.62 2.12 1.34 124 HTML_IMAGE_RATIO_08 1833 2.39 2.06 2.58 125 XM_B_URI_Unicode 1821 1.91 2.04 1.83 126 T_REMOTE_IMAGE 1808 2.51 2.03 2.79 127 RCVD_IN_MSPIKE_H4 1761 2.98 1.97 3.55 128 XM_ProductURIs 1758 1.23 1.97 0.81 129 MAILING_LIST_MULTI 1757 2.55 1.97 2.88 130 XMDiploma_00 1744 1.43 1.96 1.13 131 ADVANCE_FEE_2_NEW_MONEY 1707 0.90 1.91 0.32 132 RELAYCOUNTRY_FR 1699 0.82 1.91 0.19 133 TM2_M_OBFU_COMMENT 1699 1.05 1.91 0.56 134 XMLngstWrd_03 1642 0.80 1.84 0.20 135 SpammyFromTLD_01 1606 0.95 1.80 0.46 136 RCVD_IN_VALIDITY_CERTIFIED 1526 4.43 1.71 5.99 137 ALL_TRUSTED 1522 10.76 1.71 15.98 138 MIME_QP_LONG_LINE 1496 2.48 1.68 2.94 139 RCVD_IN_MSPIKE_L4 1491 0.80 1.67 0.29 140 XM_B_DNDMA 1476 0.81 1.66 0.32 141 TR_XM_RelayPhish 1457 0.63 1.63 0.05 142 DKIM_ADSP_CUSTOM_MED 1435 1.03 1.61 0.69 143 XM_B_COPY_HTML 1416 1.41 1.59 1.30 144 DIET_1 1408 0.89 1.58 0.49 145 RCVD_IN_MSPIKE_H5 1396 3.76 1.57 5.03 146 RDNS_DYNAMIC 1387 0.75 1.56 0.28 147 XMStockSpam_06 1365 1.75 1.53 1.87 148 PDS_RDNS_DYNAMIC_FP 1360 0.58 1.53 0.03 149 TVD_RCVD_IP 1324 1.57 1.48 1.63 150 TR_XM_MSPIKECOMBO2 1319 0.56 1.48 0.02 151 URI_HEX 1310 1.13 1.47 0.93 152 TR_XM_INV_DKIM 1297 0.61 1.45 0.12 153 XMLngstWrd_04 1291 0.59 1.45 0.10 154 BAYES_40 1275 3.69 1.43 5.00 155 SCC_BODY_URI_ONLY 1266 2.60 1.42 3.29 156 TR_XM_DK_SendGrid 1256 2.29 1.41 2.80 157 BOTNET_NORDNS 1243 0.52 1.39 0.01 158 HTML_TAG_BALANCE_BODY 1209 1.01 1.36 0.81 159 TR_LOTS_OF_MONEY3 1207 0.72 1.35 0.35 160 MISSING_HEADERS 1203 0.65 1.35 0.24 161 RCVD_IN_SBL_CSS 1168 0.49 1.31 0.01 162 REPLYTO_WITHOUT_TO_CC 1157 0.48 1.30 0.01 163 URI_NOVOWEL 1157 1.35 1.30 1.38 164 XM_UB80 1156 0.48 1.30 0.01 165 TR_Mismatch_TLD_02 1147 0.51 1.29 0.07 166 RCVD_IN_PBL 1141 0.87 1.28 0.63 167 TR_XM_PHPForged 1131 0.65 1.27 0.30 168 TR_XM_FormFill2 1115 0.65 1.25 0.30 169 TR_XM_PHPDW 1103 0.64 1.24 0.30 170 XM_B_SEO 1095 0.62 1.23 0.27 171 T_STY_INVIS_DIRECT 1093 0.86 1.23 0.65 172 TR_XM_COVIDMETA4 1090 0.46 1.22 0.02 173 MY_SERVERS_FOUND 1090 0.67 1.22 0.35 174 XM_H_PHPOS 1087 0.62 1.22 0.28 175 XMReplyNow 1084 0.57 1.22 0.20 176 TR_LOTS_OF_MONEY2 1072 0.50 1.20 0.10 177 T_MONEY_PERCENT 1072 0.50 1.20 0.10 178 XM_HighProb1 1071 0.44 1.20 0.01 179 XM_GoogleGroups 1044 1.23 1.17 1.27 180 DKIM_ADSP_NXDOMAIN 1043 0.71 1.17 0.45 181 HELO_DYNAMIC_SPLIT_IP 1038 0.43 1.16 0.00 182 RCVD_IN_PSBL 1035 0.93 1.16 0.80 183 XM_B_COVIDMETA 1019 0.47 1.14 0.08 184 NML_ADSP_CUSTOM_MED 1004 0.70 1.13 0.45 185 FILL_THIS_FORM 998 0.52 1.12 0.18 186 TR_XM_SEO4 994 0.46 1.11 0.08 187 XM_BadFromFormat 993 0.50 1.11 0.14 188 XM_B_REG_HTML 992 0.53 1.11 0.19 189 THIS_AD 987 0.67 1.11 0.42 190 XM_UB99 945 0.39 1.06 0.00 191 XMSubMetaSSx_00 944 0.46 1.06 0.11 192 XM_B_Phish66 939 0.58 1.05 0.31 193 TR_Mismatch_TLD_01 937 0.54 1.05 0.25 194 URI_TRY_3LD 914 0.82 1.02 0.70 195 SUBJ_DOLLARS 910 0.69 1.02 0.50 196 T_Symld_Words_02 905 0.53 1.01 0.25 197 XMBounce_01 901 0.39 1.01 0.03 198 TR_LOTS_OF_MONEY1 897 0.37 1.01 0.01 199 URI_TRUNCATED 896 0.39 1.00 0.03 200 XM_H_Long_From02 890 0.84 1.00 0.74 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 154049 98.49 96.40 99.70 2 HTML_MESSAGE 127526 86.09 92.26 82.54 3 RELAYCOUNTRY_US 124911 79.53 77.26 80.84 4 DKIM_SIGNED 117313 79.71 86.27 75.93 5 XM_DK_Pass 115933 78.07 83.34 75.03 6 DKIM_VALID 115231 77.59 82.81 74.58 7 XM_B_Unicode 110208 73.33 76.81 71.33 8 DKIM_VALID_AU 100107 65.13 65.72 64.79 9 BAYES_50 97217 53.80 38.01 62.92 10 XMListUnsubscribeExists 82370 57.02 63.45 53.31 11 DCC_CHECK 80395 58.90 70.79 52.03 12 DCC_CHECK_NEGATIVE 74076 39.86 25.85 47.94 13 XM_B_Unicode3 72666 47.22 47.56 47.03 14 XM_B_SpammyWords 71656 55.39 71.01 46.38 15 LOC_TINY_FONT_1 53478 38.42 45.01 34.61 16 HTML_FONT_LOW_CONTRAST 53014 33.45 31.96 34.31 17 DKIM_VALID_EF 46380 29.49 28.58 30.02 18 FVGT_m_MULTI_ODD 44677 31.03 34.68 28.92 19 XMSubLong 37189 22.67 20.24 24.07 20 T_TM2_M_HEADER_IN_MSG 36617 24.81 26.74 23.70 21 XM_B_SpammyWords2 32460 28.48 41.42 21.01 22 MIME_HTML_ONLY 31816 23.09 27.41 20.59 23 T_KAM_HTML_FONT_INVALID 31478 22.06 24.98 20.37 24 USER_IN_DEF_DKIM_WL 30520 13.42 2.44 19.75 25 XM_Multi_Part_URI 27673 18.92 20.68 17.91 26 ALL_TRUSTED 24698 10.76 1.71 15.98 27 RCVD_IN_MSPIKE_WL 24583 13.05 8.10 15.91 28 RCVD_IN_MSPIKE_H2 23901 17.42 20.79 15.47 29 TR_XM_DK_Unsub 23766 17.86 22.17 15.38 30 UNPARSEABLE_RELAY 22732 14.43 13.94 14.71 31 FSL_BULK_SIG 18601 10.76 8.54 12.04 32 XM_Evil_Numbers_Gen 17663 11.83 12.52 11.43 33 XM_B_Unsub 16257 14.07 20.22 10.52 34 XM_DKIMWhitelistDomains 14893 6.11 0.01 9.64 35 T_TooManySym_01 13265 6.51 2.91 8.59 36 TR_XM_BayesUnsub 13189 12.58 19.59 8.54 37 BAYES_00 12708 5.41 0.54 8.22 38 RCVD_IN_MSPIKE_H3 11322 6.31 4.56 7.33 39 BAYES_60 10999 7.27 7.54 7.12 40 XM_H_GMP 10990 7.62 8.50 7.11 41 LotsOfNums_01 10942 7.21 7.43 7.08 42 RCVD_IN_VALIDITY_SAFE 10735 5.27 2.36 6.95 43 TR_MAX_INTL_RELAY 10597 9.91 15.21 6.86 44 XM_B_PhoneNumber 10053 5.90 4.85 6.51 45 XM_DK_Undo_02 9825 18.98 40.84 6.36 46 TooManyTo_001 9729 5.34 3.68 6.30 47 TR_XM_DK_Bayes 9695 4.15 0.47 6.27 48 TR_XM_DK_Bayes1 9607 4.11 0.47 6.22 49 HTML_IMAGE_RATIO_02 9308 6.07 6.16 6.02 50 XM_B_SpammyWords3 9294 10.39 17.96 6.02 51 ANY_BOUNCE_MESSAGE 9294 6.46 7.24 6.02 52 BOUNCE_MESSAGE 9291 6.46 7.24 6.01 53 RCVD_IN_VALIDITY_CERTIFIED 9260 4.43 1.71 5.99 54 XMStrtUSub 8959 5.13 3.97 5.80 55 LOTS_OF_MONEY 8747 10.21 18.10 5.66 56 XM_H_Long_From01 8312 5.32 5.22 5.38 57 XM_UncommonTLD01 8311 5.68 6.19 5.38 58 TR_XM_DK_Bayes2 8247 3.53 0.40 5.34 59 BAYES_99 8104 15.32 32.77 5.24 60 T_TooManySym_02 7826 3.57 0.98 5.07 61 RCVD_IN_MSPIKE_H5 7771 3.76 1.57 5.03 62 XM_B_Phish_Phrases 7759 7.20 10.99 5.02 63 BAYES_40 7722 3.69 1.43 5.00 64 XMNumbers 7633 4.44 3.59 4.94 65 HTML_IMAGE_RATIO_04 7518 4.96 5.14 4.87 66 MPART_ALT_DIFF 7218 4.66 4.63 4.67 67 XMSubMetaSx_00 6907 4.91 5.69 4.47 68 TR_XM_SpammyWords4 6485 8.72 16.56 4.20 69 INVALID_MSGID 6480 2.81 0.40 4.19 70 BAYES_999 6467 11.66 24.62 4.19 71 TO_MALFORMED 6373 2.64 0.07 4.12 72 XM_SendGrid 6221 3.40 2.31 4.03 73 BAYES_80 6100 5.99 9.52 3.95 74 BOTNET_IPINHOSTNAME 5960 6.21 10.28 3.86 75 HTML_IMAGE_RATIO_06 5955 3.24 2.18 3.85 76 RCVD_IN_MSPIKE_H4 5490 2.98 1.97 3.55 77 SCC_BODY_URI_ONLY 5078 2.60 1.42 3.29 78 RELAYCOUNTRY_META 5071 9.13 19.26 3.28 79 MIME_HTML_MOSTLY 4786 3.04 2.94 3.10 80 BAYES_20 4687 2.27 0.96 3.03 81 MIME_QP_LONG_LINE 4550 2.48 1.68 2.94 82 BAYES_95 4495 3.80 5.34 2.91 83 TM2_M_VERY_LONG_WORD 4478 3.22 3.77 2.90 84 MAILING_LIST_MULTI 4453 2.55 1.97 2.88 85 TR_XM_DKIM_Undo 4343 13.02 30.72 2.81 86 TR_XM_DK_SendGrid 4330 2.29 1.41 2.80 87 T_REMOTE_IMAGE 4313 2.51 2.03 2.79 88 XM_B_SpammyTLD 4094 3.14 3.99 2.65 89 MIME_HTML_ONLY_MULTI 4008 2.66 2.78 2.59 90 HTML_IMAGE_RATIO_08 3982 2.39 2.06 2.58 91 TR_DCC_Bayes_99 3863 9.68 22.12 2.50 92 XM_Body_Dirty_Words 3780 3.85 6.29 2.45 93 T_XMDrugObfuBody_14 3634 3.03 4.22 2.35 94 XM_CamelCaseFrm001 3580 2.77 3.56 2.32 95 TR_XM_UnparsRelay 3355 4.37 8.17 2.17 96 XM_PDF 3250 1.47 0.38 2.10 97 T_TooManySym_03 3191 1.52 0.58 2.07 98 KHOP_HELO_FCRDNS 3177 2.25 2.58 2.06 99 RCVD_IN_IADB_LISTED 3169 1.54 0.65 2.05 100 FROM_EXCESS_BASE64 3132 2.18 2.45 2.03 101 T_TVD_MIME_NO_HEADERS 3080 1.32 0.17 1.99 102 TooManyTo_002 3037 1.47 0.60 1.97 103 HTML_MIME_NO_HTML_TAG 3026 1.52 0.76 1.96 104 TM2_M_URI_OPT_OUT 3020 2.35 3.03 1.95 105 HTML_IMAGE_ONLY_32 2959 1.29 0.20 1.92 106 XMStockSpam_06 2890 1.75 1.53 1.87 107 TR_XM_PhishingBody 2871 3.24 5.63 1.86 108 XMBdyGiftCard01 2850 1.44 0.73 1.84 109 XM_B_URI_Unicode 2829 1.91 2.04 1.83 110 RCVD_IN_IADB_SPF 2825 1.37 0.59 1.83 111 XMSexyCombo_05 2819 3.08 5.26 1.82 112 TR_XM_SpammyWords5 2704 2.49 3.77 1.75 113 UNTRUSTED_Relay 2701 4.05 8.03 1.75 114 TR_XM_SpammyRelay 2658 6.50 14.79 1.72 115 IN_HORDE_ADDRESS_BOOK 2638 1.11 0.08 1.71 116 RCVD_IN_IADB_SENDERID 2538 1.24 0.55 1.64 117 TVD_SPACE_RATIO 2520 1.14 0.29 1.63 118 TVD_RCVD_IP 2512 1.57 1.48 1.63 119 RCVD_IN_IADB_DK 2503 1.23 0.56 1.62 120 BAYES_05 2476 1.22 0.54 1.60 121 XM_DK_Undo_01 2444 1.83 2.27 1.58 122 XM_B_Investor 2359 2.69 4.70 1.53 123 XMGappySubj_01 2339 1.00 0.12 1.51 124 XMBrknScrpt_02 2321 1.75 2.17 1.50 125 T_XMDrugObfuBody_08 2267 2.22 3.51 1.47 126 URI_NOVOWEL 2126 1.35 1.30 1.38 127 RCVD_IN_IADB_VOUCHED 2108 1.01 0.38 1.36 128 DKIM_INVALID 2082 2.12 3.46 1.35 129 SUBJ_ALL_CAPS 2071 1.62 2.12 1.34 130 XMGappySubj_02 2028 0.85 0.05 1.31 131 XM_B_COPY_HTML 2012 1.41 1.59 1.30 132 XM_SPF_SoftFail 2009 2.26 3.93 1.30 133 XM_GoogleGroups 1955 1.23 1.17 1.27 134 XM_B_Unsub2 1908 3.39 7.12 1.23 135 TR_MetaPhish_Combo_01 1852 1.04 0.78 1.20 136 BOTNET 1821 3.93 8.69 1.18 137 TR_Symld_Words 1793 1.10 1.00 1.16 138 XMDiploma_00 1751 1.43 1.96 1.13 139 XM_B_SpammyWords4 1676 1.67 2.69 1.08 140 TooManyTo_003 1673 0.89 0.55 1.08 141 RELAYCOUNTRY_CA 1609 3.53 7.83 1.04 142 RCVD_IN_IADB_OPTIN 1593 0.74 0.24 1.03 143 XMBSHREFv2 1580 0.76 0.29 1.02 144 XM_UB50 1471 2.07 4.01 0.95 145 URI_HEX 1436 1.13 1.47 0.93 146 RCVD_IN_MSPIKE_BL 1407 2.43 5.08 0.91 147 TR_XM_MSPIKECOMBO 1407 2.43 5.08 0.91 148 TooManyTo_004 1297 0.72 0.50 0.84 149 XM_OfRef6 1272 3.16 7.21 0.82 150 XM_ProductURIs 1250 1.23 1.97 0.81 151 HTML_TAG_BALANCE_BODY 1244 1.01 1.36 0.81 152 RCVD_IN_PSBL 1237 0.93 1.16 0.80 153 MAY_BE_FORGED 1186 0.50 0.03 0.77 154 XM_H_PHPMailer 1184 0.67 0.50 0.77 155 XM_H_Long_From02 1146 0.84 1.00 0.74 156 T_XMDrugObfuBody_00 1131 1.36 2.45 0.73 157 TR_XM_Base64_M1 1126 0.79 0.89 0.73 158 TR_XM_SpammyWords2 1115 4.67 11.52 0.72 159 TooManyTo_005 1110 0.62 0.44 0.72 160 URI_TRY_3LD 1089 0.82 1.02 0.70 161 MSGID_FROM_MTA_HEADER 1085 0.52 0.20 0.70 162 DKIM_ADSP_CUSTOM_MED 1073 1.03 1.61 0.69 163 T_XMHurry_00 1067 1.29 2.33 0.69 164 XMPhish30 1064 1.42 2.70 0.69 165 XM_B_FormFill 1045 0.43 0.01 0.68 166 XMSlimDrugH 1032 0.68 0.70 0.67 167 T_FILL_THIS_FORM_SHORT 1012 1.82 3.83 0.65 168 T_STY_INVIS_DIRECT 999 0.86 1.23 0.65 169 XMSubMetaI_00 978 0.69 0.79 0.63 170 RCVD_IN_PBL 972 0.87 1.28 0.63 171 RCVD_IN_MSPIKE_L3 950 1.49 3.00 0.61 172 RCVD_IN_BL_SPAMCOP_NET 949 4.18 10.35 0.61 173 T_TooManySym_04 944 0.46 0.20 0.61 174 XMBody_17 919 1.38 2.75 0.59 175 XMNoVowels 916 0.52 0.40 0.59 176 XMBody_95 910 0.40 0.07 0.59 177 MPART_ALT_DIFF_COUNT 884 0.70 0.92 0.57 178 XMGenDplmaNmb 884 0.71 0.94 0.57 179 TM2_M_OBFU_COMMENT 865 1.05 1.91 0.56 180 XMSubMetaSxObfu_03 864 0.59 0.65 0.56 181 MIME_HEADER_CTYPE_ONLY 852 1.26 2.50 0.55 182 XMSolicitRefs_0 848 0.51 0.45 0.55 183 AD_PREFS 792 0.37 0.13 0.51 184 HTML_FONT_FACE_BAD 784 0.47 0.42 0.51 185 SUBJ_DOLLARS 777 0.69 1.02 0.50 186 XMLngstWrd_00 769 1.76 3.95 0.50 187 MIME_CHARSET_FARAWAY 767 0.53 0.59 0.50 188 XMHTML_After_End 763 0.52 0.57 0.49 189 DIET_1 750 0.89 1.58 0.49 190 XM_S_SubURI 749 0.33 0.05 0.48 191 TR_MetaPhish_Combo_01b 744 0.63 0.89 0.48 192 URI_OPTOUT_3LD 737 2.11 4.94 0.48 193 PLING_QUERY 724 0.54 0.67 0.47 194 FORGED_GMAIL_RCVD 716 0.65 0.97 0.46 195 HTML_EXTRA_CLOSE 710 0.30 0.01 0.46 196 XMPhish08 709 0.41 0.32 0.46 197 SpammyFromTLD_01 707 0.95 1.80 0.46 198 NML_ADSP_CUSTOM_MED 701 0.70 1.13 0.45 199 DKIM_ADSP_NXDOMAIN 698 0.71 1.17 0.45 200 HTTPS_HTTP_MISMATCH 691 0.46 0.48 0.45 ----------------------------------------------------------------------