Email: 249332 Autolearn: 0 AvgScore: 5.40 AvgScanTime: 1.38 sec Spam: 85840 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.49 sec Ham: 163492 Autolearn: 0 AvgScore: 0.72 AvgScanTime: 1.32 sec Time Spent Running SA: 95.25 hours Time Spent Processing Spam: 35.52 hours Time Spent Processing Ham: 59.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 85208 99.47 99.26 99.58 2 HTML_MESSAGE 81707 87.23 95.19 83.05 3 DKIM_SIGNED 75846 79.22 88.36 74.42 4 XM_DK_Pass 72131 77.29 84.03 73.76 5 DKIM_VALID 71757 76.84 83.59 73.29 6 XM_B_Unicode 70349 74.32 81.95 70.30 7 DCC_CHECK 68419 60.01 79.71 49.67 8 RELAYCOUNTRY_US 65964 79.18 76.85 80.41 9 XMListUnsubscribeExists 59060 56.88 68.80 50.61 10 XM_B_SpammyWords 57439 53.42 66.91 46.33 11 DKIM_VALID_AU 57321 63.91 66.78 62.41 12 XM_B_Unicode3 41871 45.93 48.78 44.44 13 LOC_TINY_FONT_1 40792 37.07 47.52 31.59 14 XM_DK_Undo_02 37271 18.66 43.42 5.66 15 XM_B_SpammyWords2 33412 27.14 38.92 20.96 16 BAYES_50 30699 52.57 35.76 61.40 17 HTML_FONT_LOW_CONTRAST 29700 32.71 34.60 31.72 18 BAYES_99 29189 14.73 34.00 4.60 19 FVGT_m_MULTI_ODD 27792 27.89 32.38 25.54 20 DKIM_VALID_EF 27632 31.11 32.19 30.54 21 MIME_HTML_ONLY 27569 24.61 32.12 20.67 22 TR_XM_DKIM_Undo 27211 12.47 31.70 2.37 23 T_KAM_HTML_FONT_INVALID 24512 24.56 28.56 22.46 24 BAYES_999 22691 11.41 26.43 3.52 25 TR_XM_DK_Unsub 22109 18.73 25.76 15.05 26 TR_DCC_Bayes_99 21414 9.82 24.95 1.87 27 XM_B_Unsub 18463 14.41 21.51 10.69 28 XM_Multi_Part_URI 18409 18.40 21.45 16.80 29 RELAYCOUNTRY_META 18198 9.41 21.20 3.21 30 TR_XM_BayesUnsub 17584 12.68 20.48 8.58 31 XMSubLong 17250 21.56 20.10 22.32 32 DCC_CHECK_NEGATIVE 16858 39.75 19.64 50.31 33 RCVD_IN_MSPIKE_H2 16392 16.96 19.10 15.84 34 T_TM2_M_HEADER_IN_MSG 16039 23.39 18.68 25.87 35 UNPARSEABLE_RELAY 15938 15.28 18.57 13.55 36 TR_MAX_INTL_RELAY 13611 9.95 15.86 6.84 37 TR_XM_SpammyRelay 12523 6.09 14.59 1.63 38 XM_B_SpammyWords3 12177 9.64 14.19 7.26 39 RCVD_IN_BL_SPAMCOP_NET 11041 4.79 12.86 0.55 40 TR_XM_SpammyWords2 10074 4.52 11.74 0.73 41 BOTNET_IPINHOSTNAME 9796 6.29 11.41 3.60 42 BOTNET 9756 4.61 11.37 1.06 43 TR_XM_UnparsRelay 9121 4.78 10.63 1.71 44 LOTS_OF_MONEY 8500 7.47 9.90 6.19 45 BAYES_80 8493 6.09 9.89 4.09 46 UNTRUSTED_Relay 8232 4.48 9.59 1.80 47 FSL_BULK_SIG 8203 11.54 9.56 12.58 48 RCVD_IN_MSPIKE_WL 8040 14.94 9.37 17.87 49 BAYES_60 8000 8.43 9.32 7.96 50 XMStrtUSub 7979 7.36 9.30 6.35 51 RELAYCOUNTRY_CA 7836 3.77 9.13 0.96 52 TR_XM_SpammyWords4 7634 5.94 8.89 4.39 53 XM_B_Phish_Phrases 6754 6.41 7.87 5.64 54 XM_Evil_Numbers_Gen 6487 9.77 7.56 10.93 55 XM_Body_Dirty_Words 6245 4.02 7.28 2.31 56 RCVD_IN_MSPIKE_BL 6136 3.14 7.15 1.03 57 TR_XM_MSPIKECOMBO 6134 3.13 7.15 1.03 58 HTML_IMAGE_RATIO_02 5866 5.62 6.83 4.99 59 TR_XM_NoHeaderRelay 5659 2.40 6.59 0.20 60 XM_UncommonTLD01 5590 5.62 6.51 5.15 61 XMSubMetaSx_00 5581 4.92 6.50 4.08 62 MPART_ALT_DIFF 4955 5.95 5.77 6.05 63 BAYES_95 4848 3.75 5.65 2.75 64 XMSexyCombo_05 4597 2.81 5.36 1.47 65 TR_XM_SPAMCOP 4450 1.83 5.18 0.08 66 XM_H_GMP 4246 6.02 4.95 6.58 67 SCC_BODY_URI_ONLY 4194 3.85 4.89 3.31 68 XM_H_Long_From01 4188 5.43 4.88 5.72 69 DKIM_INVALID 4089 2.38 4.76 1.13 70 LotsOfNums_01 4040 7.72 4.71 9.30 71 RCVD_IN_MSPIKE_H3 3986 6.37 4.64 7.27 72 XM_CamelCaseFrm001 3906 2.98 4.55 2.15 73 HTML_IMAGE_RATIO_04 3633 3.98 4.23 3.85 74 XM_UB50 3625 2.17 4.22 1.09 75 XM_B_Investor 3608 2.26 4.20 1.25 76 TR_XM_PhishingBody 3530 2.44 4.11 1.57 77 XM_OfRef6 3515 1.88 4.09 0.72 78 XM_B_PhoneNumber 3356 5.44 3.91 6.24 79 T_XMDrugObfuBody_14 3347 2.66 3.90 2.01 80 TR_XM_SpammyWords3 3069 1.50 3.58 0.41 81 BODY_URI_ONLY 3038 1.23 3.54 0.02 82 HTML_SHORT_LINK_IMG_1 2975 1.20 3.47 0.02 83 XM_URI_RBL 2912 1.41 3.39 0.37 84 XM_B_SpammyTLD 2897 2.90 3.37 2.65 85 RCVD_IN_MSPIKE_L3 2883 1.60 3.36 0.67 86 MIME_HTML_ONLY_MULTI 2878 2.88 3.35 2.64 87 MIME_HTML_MOSTLY 2873 3.65 3.35 3.81 88 XM_B_Unsub2 2837 2.65 3.30 2.30 89 RCVD_IN_VALIDITY_RPBL 2813 1.15 3.28 0.03 90 TooManyTo_001 2782 4.63 3.24 5.36 91 TM2_M_VERY_LONG_WORD 2719 3.49 3.17 3.66 92 T_FILL_THIS_FORM_SHORT 2533 1.54 2.95 0.79 93 BOTNET_NORDNS 2507 1.01 2.92 0.01 94 TR_XM_SpammyWords5 2503 1.81 2.92 1.24 95 HTML_IMAGE_RATIO_06 2469 3.31 2.88 3.54 96 XMNumbers 2386 3.87 2.78 4.44 97 RELAYCOUNTRY_AU 2335 1.22 2.72 0.43 98 RCVD_IN_VALIDITY_SAFE 2196 4.34 2.56 5.28 99 RCVD_IN_MSPIKE_H4 2178 3.67 2.54 4.27 100 TR_XM_INV_DKIM 2177 0.89 2.54 0.02 101 XM_SPF_SoftFail 2165 1.65 2.52 1.19 102 USER_IN_DEF_DKIM_WL 2159 13.07 2.52 18.62 103 FROM_EXCESS_BASE64 2058 2.14 2.40 2.00 104 HTML_IMAGE_ONLY_08 2049 0.87 2.39 0.08 105 SCC_BODY_SINGLE_WORD 2015 0.82 2.35 0.02 106 BODY_SINGLE_URI 2003 0.81 2.33 0.01 107 BODY_SINGLE_WORD 2003 0.81 2.33 0.02 108 XMDiploma_00 1985 1.55 2.31 1.15 109 RCVD_IN_MSPIKE_L5 1976 0.80 2.30 0.01 110 SHORTENER_SHORT_IMG 1961 0.79 2.28 0.00 111 XMBody_17 1913 1.04 2.23 0.42 112 HTML_IMAGE_RATIO_08 1907 2.19 2.22 2.17 113 RCVD_IN_MSPIKE_H5 1876 4.90 2.19 6.33 114 XM_UB60 1868 0.80 2.18 0.07 115 XM_B_SpammyWords4 1859 1.50 2.17 1.15 116 T_TooManySym_01 1846 5.79 2.15 7.69 117 T_XMDrugObfuBody_08 1824 1.53 2.12 1.22 118 BAYES_40 1788 4.01 2.08 5.02 119 RCVD_IN_VALIDITY_CERTIFIED 1762 3.56 2.05 4.34 120 SpammyFromTLD_02 1756 1.04 2.05 0.51 121 HK_RANDOM_REPLYTO 1747 0.84 2.04 0.21 122 XM_B_URI_Unicode 1729 1.65 2.01 1.46 123 T_XMHurry_00 1705 1.12 1.99 0.66 124 TM2_M_URI_OPT_OUT 1667 1.96 1.94 1.97 125 SUBJ_ALL_CAPS 1585 1.23 1.85 0.91 126 URI_NOVOWEL 1575 1.55 1.83 1.40 127 HTML_IMAGE_ONLY_20 1558 0.86 1.82 0.36 128 SpammyFromTLD_01 1538 0.90 1.79 0.44 129 XM_B_DNDMA 1509 0.88 1.76 0.42 130 KHOP_HELO_FCRDNS 1473 2.30 1.72 2.61 131 XMPhish30 1469 1.08 1.71 0.74 132 MAILING_LIST_MULTI 1456 2.16 1.70 2.41 133 XMStockSpam_06 1449 1.60 1.69 1.55 134 ALL_TRUSTED 1367 11.28 1.59 16.37 135 BAYES_20 1332 2.74 1.55 3.36 136 DIET_1 1325 0.80 1.54 0.42 137 TO_NO_BRKTS_HTML_ONLY 1315 0.65 1.53 0.19 138 RDNS_DYNAMIC 1314 0.70 1.53 0.27 139 TR_XM_PHPForged 1301 0.75 1.52 0.35 140 PDS_RDNS_DYNAMIC_FP 1295 0.55 1.51 0.04 141 TR_XM_FormFill2 1282 0.75 1.49 0.36 142 MPART_ALT_DIFF_COUNT 1281 0.88 1.49 0.56 143 TVD_RCVD_IP 1278 1.46 1.49 1.44 144 RCVD_IN_XBL 1278 0.52 1.49 0.01 145 RCVD_IN_MSPIKE_L4 1275 0.74 1.49 0.35 146 TR_XM_PHPDW 1275 0.74 1.49 0.35 147 XM_HighProb1 1259 0.51 1.47 0.00 148 XM_ProductURIs 1256 0.91 1.46 0.62 149 MIME_QP_LONG_LINE 1246 2.86 1.45 3.60 150 TR_XM_MSPIKECOMBO2 1237 0.51 1.44 0.02 151 XMBrknScrpt_02 1234 1.29 1.44 1.22 152 XM_H_PHPOS 1232 0.72 1.44 0.34 153 XM_B_Phish66 1223 0.68 1.42 0.28 154 XMBdyGiftCard01 1215 1.31 1.42 1.25 155 XMClaimOffer 1213 0.82 1.41 0.51 156 TR_Mismatch_TLD_02 1204 0.52 1.40 0.06 157 XM_DK_Undo_01 1185 1.52 1.38 1.60 158 RCVD_IN_SBL_CSS 1182 0.50 1.38 0.04 159 DKIM_ADSP_NXDOMAIN 1179 0.75 1.37 0.42 160 THIS_AD 1173 0.64 1.37 0.25 161 T_XMDrugObfuBody_00 1168 0.92 1.36 0.69 162 RCVD_IN_PSBL 1153 0.93 1.34 0.71 163 URI_HEX 1134 1.08 1.32 0.96 164 HTML_IMAGE_ONLY_12 1129 0.58 1.32 0.20 165 XM_H_Long_From02 1112 0.90 1.30 0.69 166 HTML_MIME_NO_HTML_TAG 1108 1.68 1.29 1.88 167 XM_Sams_Club_Forge 1105 0.53 1.29 0.13 168 XM_DIRTYINTL 1105 0.49 1.29 0.07 169 XM_B_COPY_HTML 1099 1.06 1.28 0.95 170 LongTLD 1095 0.66 1.28 0.34 171 SHOPIFY_IMG_NOT_RCVD_SFY 1053 0.65 1.23 0.35 172 RELAYCOUNTRY_NL 1044 0.47 1.22 0.08 173 TM2_M_OBFU_COMMENT 1039 0.68 1.21 0.41 174 XMBody_78 1033 0.63 1.20 0.32 175 HELO_DYNAMIC_SPLIT_IP 1024 0.42 1.19 0.01 176 TR_XM_FormFill 1016 0.42 1.18 0.01 177 XM_UB80 1008 0.41 1.17 0.02 178 FVGT_m_IMAGE_ONLY_SPAM 1000 0.40 1.16 0.00 179 XMSubMetaI_00 986 0.64 1.15 0.37 180 TR_LOTS_OF_MONEY3 980 0.85 1.14 0.70 181 XMGenDplmaNmb 972 0.73 1.13 0.52 182 XM_SendGrid 955 1.20 1.11 1.24 183 URI_TRY_3LD 953 0.79 1.11 0.62 184 RELAYCOUNTRY_FR 937 0.50 1.09 0.20 185 T_REMOTE_IMAGE 932 2.63 1.09 3.44 186 TR_MetaPhish_Combo_01 925 0.94 1.08 0.87 187 TR_XM_MaxSPIKE 923 0.38 1.08 0.01 188 T_STY_INVIS_DIRECT 921 0.76 1.07 0.60 189 MultiRelay_CC 896 0.41 1.04 0.08 190 XM_B_REG_HTML 890 0.60 1.04 0.36 191 XM_UB99 889 0.36 1.04 0.00 192 RCVD_IN_PBL 872 0.75 1.02 0.61 193 XMReplyNow 869 0.50 1.01 0.23 194 RELAYCOUNTRY_SE 851 0.34 0.99 0.00 195 XM_B_SEO 824 0.48 0.96 0.23 196 ANY_BOUNCE_MESSAGE 817 5.12 0.95 7.31 197 BOUNCE_MESSAGE 816 5.02 0.95 7.15 198 XMSolicitRefs_0 813 0.70 0.95 0.58 199 HTML_TAG_BALANCE_BODY 804 0.89 0.94 0.87 200 FONT_INVIS_LONG_LINE 802 0.35 0.93 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 162811 99.47 99.26 99.58 2 HTML_MESSAGE 135782 87.23 95.19 83.05 3 RELAYCOUNTRY_US 131464 79.18 76.85 80.41 4 DKIM_SIGNED 121668 79.22 88.36 74.42 5 XM_DK_Pass 120590 77.29 84.03 73.76 6 DKIM_VALID 119826 76.84 83.59 73.29 7 XM_B_Unicode 114943 74.32 81.95 70.30 8 DKIM_VALID_AU 102038 63.91 66.78 62.41 9 BAYES_50 100379 52.57 35.76 61.40 10 XMListUnsubscribeExists 82751 56.88 68.80 50.61 11 DCC_CHECK_NEGATIVE 82246 39.75 19.64 50.31 12 DCC_CHECK 81202 60.01 79.71 49.67 13 XM_B_SpammyWords 75747 53.42 66.91 46.33 14 XM_B_Unicode3 72653 45.93 48.78 44.44 15 HTML_FONT_LOW_CONTRAST 51862 32.71 34.60 31.72 16 LOC_TINY_FONT_1 51647 37.07 47.52 31.59 17 DKIM_VALID_EF 49932 31.11 32.19 30.54 18 T_TM2_M_HEADER_IN_MSG 42291 23.39 18.68 25.87 19 FVGT_m_MULTI_ODD 41748 27.89 32.38 25.54 20 T_KAM_HTML_FONT_INVALID 36717 24.56 28.56 22.46 21 XMSubLong 36498 21.56 20.10 22.32 22 XM_B_SpammyWords2 34269 27.14 38.92 20.96 23 MIME_HTML_ONLY 33798 24.61 32.12 20.67 24 USER_IN_DEF_DKIM_WL 30441 13.07 2.52 18.62 25 RCVD_IN_MSPIKE_WL 29218 14.94 9.37 17.87 26 XM_Multi_Part_URI 27465 18.40 21.45 16.80 27 ALL_TRUSTED 26767 11.28 1.59 16.37 28 RCVD_IN_MSPIKE_H2 25889 16.96 19.10 15.84 29 TR_XM_DK_Unsub 24603 18.73 25.76 15.05 30 UNPARSEABLE_RELAY 22158 15.28 18.57 13.55 31 FSL_BULK_SIG 20567 11.54 9.56 12.58 32 XM_Evil_Numbers_Gen 17873 9.77 7.56 10.93 33 XM_B_Unsub 17477 14.41 21.51 10.69 34 XM_DKIMWhitelistDomains 15375 6.17 0.02 9.40 35 LotsOfNums_01 15208 7.72 4.71 9.30 36 BAYES_00 14609 6.01 0.44 8.94 37 TR_XM_BayesUnsub 14020 12.68 20.48 8.58 38 BAYES_60 13013 8.43 9.32 7.96 39 T_TooManySym_01 12578 5.79 2.15 7.69 40 ANY_BOUNCE_MESSAGE 11946 5.12 0.95 7.31 41 RCVD_IN_MSPIKE_H3 11887 6.37 4.64 7.27 42 XM_B_SpammyWords3 11866 9.64 14.19 7.26 43 BOUNCE_MESSAGE 11696 5.02 0.95 7.15 44 TR_XM_DK_Bayes 11234 4.63 0.35 6.87 45 TR_MAX_INTL_RELAY 11190 9.95 15.86 6.84 46 TR_XM_DK_Bayes1 11143 4.59 0.35 6.82 47 XM_H_GMP 10755 6.02 4.95 6.58 48 XMStrtUSub 10376 7.36 9.30 6.35 49 RCVD_IN_MSPIKE_H5 10350 4.90 2.19 6.33 50 XM_B_PhoneNumber 10201 5.44 3.91 6.24 51 LOTS_OF_MONEY 10116 7.47 9.90 6.19 52 MPART_ALT_DIFF 9884 5.95 5.77 6.05 53 TR_XM_DK_Bayes2 9505 3.90 0.26 5.81 54 XM_H_Long_From01 9359 5.43 4.88 5.72 55 XM_DK_Undo_02 9256 18.66 43.42 5.66 56 XM_B_Phish_Phrases 9228 6.41 7.87 5.64 57 TooManyTo_001 8758 4.63 3.24 5.36 58 RCVD_IN_VALIDITY_SAFE 8630 4.34 2.56 5.28 59 XM_UncommonTLD01 8414 5.62 6.51 5.15 60 BAYES_40 8203 4.01 2.08 5.02 61 HTML_IMAGE_RATIO_02 8152 5.62 6.83 4.99 62 BAYES_99 7526 14.73 34.00 4.60 63 T_TooManySym_02 7263 3.17 0.75 4.44 64 XMNumbers 7256 3.87 2.78 4.44 65 TR_XM_SpammyWords4 7181 5.94 8.89 4.39 66 RCVD_IN_VALIDITY_CERTIFIED 7102 3.56 2.05 4.34 67 RCVD_IN_MSPIKE_H4 6981 3.67 2.54 4.27 68 INVALID_MSGID 6719 2.83 0.38 4.11 69 BAYES_80 6686 6.09 9.89 4.09 70 XMSubMetaSx_00 6674 4.92 6.50 4.08 71 TO_MALFORMED 6388 2.59 0.07 3.91 72 HTML_IMAGE_RATIO_04 6300 3.98 4.23 3.85 73 MIME_HTML_MOSTLY 6222 3.65 3.35 3.81 74 TM2_M_VERY_LONG_WORD 5977 3.49 3.17 3.66 75 MIME_QP_LONG_LINE 5883 2.86 1.45 3.60 76 BOTNET_IPINHOSTNAME 5879 6.29 11.41 3.60 77 HTML_IMAGE_RATIO_06 5792 3.31 2.88 3.54 78 BAYES_999 5754 11.41 26.43 3.52 79 T_REMOTE_IMAGE 5619 2.63 1.09 3.44 80 BAYES_20 5490 2.74 1.55 3.36 81 SCC_BODY_URI_ONLY 5416 3.85 4.89 3.31 82 RELAYCOUNTRY_META 5255 9.41 21.20 3.21 83 BAYES_95 4503 3.75 5.65 2.75 84 XM_PDF 4436 1.95 0.50 2.71 85 HTML_IMAGE_ONLY_32 4375 1.79 0.09 2.68 86 XM_B_SpammyTLD 4332 2.90 3.37 2.65 87 MIME_HTML_ONLY_MULTI 4312 2.88 3.35 2.64 88 KHOP_HELO_FCRDNS 4261 2.30 1.72 2.61 89 MAY_BE_FORGED 3988 1.61 0.02 2.44 90 MAILING_LIST_MULTI 3936 2.16 1.70 2.41 91 TR_XM_DKIM_Undo 3873 12.47 31.70 2.37 92 XM_Body_Dirty_Words 3772 4.02 7.28 2.31 93 XM_B_Unsub2 3764 2.65 3.30 2.30 94 RCVD_IN_IADB_LISTED 3575 1.61 0.52 2.19 95 HTML_IMAGE_RATIO_08 3541 2.19 2.22 2.17 96 XM_CamelCaseFrm001 3518 2.98 4.55 2.15 97 T_XMDrugObfuBody_14 3292 2.66 3.90 2.01 98 FROM_EXCESS_BASE64 3272 2.14 2.40 2.00 99 RCVD_IN_IADB_SPF 3224 1.45 0.45 1.97 100 TM2_M_URI_OPT_OUT 3217 1.96 1.94 1.97 101 BAYES_05 3083 1.46 0.66 1.89 102 HTML_MIME_NO_HTML_TAG 3078 1.68 1.29 1.88 103 TR_DCC_Bayes_99 3062 9.82 24.95 1.87 104 XM_H_PHPMailer 2986 1.45 0.72 1.83 105 RCVD_IN_IADB_SENDERID 2979 1.34 0.42 1.82 106 UNTRUSTED_Relay 2944 4.48 9.59 1.80 107 RCVD_IN_IADB_DK 2919 1.32 0.43 1.79 108 T_TooManySym_03 2888 1.31 0.43 1.77 109 XMGappySubj_01 2871 1.38 0.66 1.76 110 TR_XM_UnparsRelay 2791 4.78 10.63 1.71 111 TooManyTo_002 2786 1.29 0.50 1.70 112 IN_HORDE_ADDRESS_BOOK 2667 1.09 0.06 1.63 113 TR_XM_SpammyRelay 2657 6.09 14.59 1.63 114 XM_DK_Undo_01 2614 1.52 1.38 1.60 115 T_TVD_MIME_NO_HEADERS 2584 1.05 0.05 1.58 116 TVD_SPACE_RATIO 2565 1.08 0.14 1.57 117 TR_XM_PhishingBody 2560 2.44 4.11 1.57 118 XMStockSpam_06 2535 1.60 1.69 1.55 119 XMSexyCombo_05 2401 2.81 5.36 1.47 120 XM_B_URI_Unicode 2390 1.65 2.01 1.46 121 TVD_RCVD_IP 2360 1.46 1.49 1.44 122 URI_NOVOWEL 2296 1.55 1.83 1.40 123 RCVD_IN_IADB_VOUCHED 2216 0.99 0.31 1.36 124 XMBdyGiftCard01 2045 1.31 1.42 1.25 125 XM_B_Investor 2037 2.26 4.20 1.25 126 XM_SendGrid 2034 1.20 1.11 1.24 127 TR_XM_SpammyWords5 2021 1.81 2.92 1.24 128 XMGappySubj_02 2012 0.84 0.09 1.23 129 XMBrknScrpt_02 1990 1.29 1.44 1.22 130 T_XMDrugObfuBody_08 1988 1.53 2.12 1.22 131 XM_GoogleGroups 1953 1.06 0.79 1.19 132 XM_SPF_SoftFail 1945 1.65 2.52 1.19 133 TR_Symld_Words 1936 1.06 0.82 1.18 134 XMDiploma_00 1888 1.55 2.31 1.15 135 XM_B_SpammyWords4 1874 1.50 2.17 1.15 136 DKIM_INVALID 1842 2.38 4.76 1.13 137 XM_UB50 1790 2.17 4.22 1.09 138 BOTNET 1735 4.61 11.37 1.06 139 HTML_EXTRA_CLOSE 1725 0.70 0.02 1.06 140 TR_XM_MSPIKECOMBO 1682 3.13 7.15 1.03 141 RCVD_IN_MSPIKE_BL 1682 3.14 7.15 1.03 142 MIME_CHARSET_FARAWAY 1627 0.77 0.35 1.00 143 URI_HEX 1570 1.08 1.32 0.96 144 RELAYCOUNTRY_CA 1566 3.77 9.13 0.96 145 XM_B_COPY_HTML 1556 1.06 1.28 0.95 146 RCVD_IN_IADB_OPTIN 1550 0.70 0.21 0.95 147 URI_DOTEDU 1505 0.62 0.05 0.92 148 SUBJ_ALL_CAPS 1482 1.23 1.85 0.91 149 CHARSET_FARAWAY_HEADER 1460 0.66 0.22 0.89 150 TooManyTo_003 1443 0.74 0.46 0.88 151 TR_MetaPhish_Combo_01 1421 0.94 1.08 0.87 152 HTML_TAG_BALANCE_BODY 1419 0.89 0.94 0.87 153 TR_XM_DK_SendGrid 1407 0.84 0.79 0.86 154 XMBSHREFv2 1382 0.65 0.26 0.85 155 T_FILL_THIS_FORM_SHORT 1297 1.54 2.95 0.79 156 DKIM_ADSP_CUSTOM_MED 1233 0.78 0.82 0.75 157 XMPhish30 1216 1.08 1.71 0.74 158 TR_XM_SpammyWords2 1194 4.52 11.74 0.73 159 XM_OfRef6 1184 1.88 4.09 0.72 160 RCVD_IN_PSBL 1160 0.93 1.34 0.71 161 TR_LOTS_OF_MONEY3 1149 0.85 1.14 0.70 162 XM_H_Long_From02 1133 0.90 1.30 0.69 163 TooManyTo_004 1128 0.59 0.41 0.69 164 T_XMDrugObfuBody_00 1123 0.92 1.36 0.69 165 RCVD_IN_MSPIKE_L3 1103 1.60 3.36 0.67 166 T_OBFU_PDF_ATTACH 1081 0.46 0.07 0.66 167 T_XMHurry_00 1076 1.12 1.99 0.66 168 XM_ProductURIs 1010 0.91 1.46 0.62 169 URI_TRY_3LD 1009 0.79 1.11 0.62 170 RCVD_IN_PBL 1000 0.75 1.02 0.61 171 TooManyTo_005 993 0.53 0.38 0.61 172 XM_B_FormFill 983 0.40 0.02 0.60 173 T_STY_INVIS_DIRECT 977 0.76 1.07 0.60 174 TR_XM_Base64_M1 957 0.62 0.70 0.59 175 XMSolicitRefs_0 941 0.70 0.95 0.58 176 XMLngstWrd_00 936 0.49 0.34 0.57 177 MPART_ALT_DIFF_COUNT 910 0.88 1.49 0.56 178 RCVD_IN_BL_SPAMCOP_NET 892 4.79 12.86 0.55 179 PLING_QUERY 876 0.57 0.63 0.54 180 FROM_GOV_DKIM_AU 864 0.37 0.06 0.53 181 XMGenDplmaNmb 857 0.73 1.13 0.52 182 XM_ShortIntro_01 837 0.46 0.36 0.51 183 SpammyFromTLD_02 832 1.04 2.05 0.51 184 XMClaimOffer 832 0.82 1.41 0.51 185 XMHTML_After_End 832 0.51 0.51 0.51 186 XMLngstWrd_01 811 0.42 0.28 0.50 187 FORGED_GMAIL_RCVD 792 0.53 0.63 0.48 188 XMBody_95 768 0.34 0.11 0.47 189 XM_S_SubURI 758 0.32 0.05 0.46 190 XMNoVowels 751 0.43 0.37 0.46 191 T_TooManySym_04 749 0.37 0.21 0.46 192 NML_ADSP_CUSTOM_MED 747 0.54 0.69 0.46 193 XMSlimDrugH 738 0.55 0.75 0.45 194 HTML_FONT_FACE_BAD 734 0.51 0.63 0.45 195 SpammyFromTLD_01 717 0.90 1.79 0.44 196 RELAYCOUNTRY_AU 704 1.22 2.72 0.43 197 DKIM_ADSP_NXDOMAIN 690 0.75 1.37 0.42 198 XMBody_17 686 1.04 2.23 0.42 199 XM_B_DNDMA 681 0.88 1.76 0.42 200 DIET_1 681 0.80 1.54 0.42 ----------------------------------------------------------------------