Email: 257286 Autolearn: 0 AvgScore: 5.63 AvgScanTime: 1.42 sec Spam: 88188 Autolearn: 0 AvgScore: 14.58 AvgScanTime: 1.64 sec Ham: 169098 Autolearn: 0 AvgScore: 0.97 AvgScanTime: 1.31 sec Time Spent Running SA: 101.80 hours Time Spent Processing Spam: 40.13 hours Time Spent Processing Ham: 61.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84253 87.08 95.54 82.68 2 DKIM_SIGNED 80029 81.87 90.75 77.25 3 XM_DK_Pass 75532 79.73 85.65 76.64 4 DKIM_VALID 75200 79.30 85.27 76.18 5 XM_B_Unicode 73680 75.35 83.55 71.08 6 RELAYCOUNTRY_US 72255 80.68 81.93 80.02 7 DCC_CHECK 68929 62.38 78.16 54.15 8 DKIM_VALID_AU 61865 66.65 70.15 64.82 9 XMListUnsubscribeExists 60144 58.39 68.20 53.28 10 XM_B_SpammyWords 59050 53.14 66.96 45.94 11 LOC_TINY_FONT_1 46157 41.04 52.34 35.14 12 XM_B_Unicode3 45084 47.78 51.12 46.04 13 XM_DK_Undo_02 37548 18.32 42.58 5.67 14 XM_B_SpammyWords2 33422 26.68 37.90 20.83 15 FVGT_m_MULTI_ODD 32560 29.11 36.92 25.04 16 HTML_FONT_LOW_CONTRAST 31868 33.54 36.14 32.19 17 BAYES_50 31679 52.40 35.92 61.00 18 BAYES_99 30524 14.68 34.61 4.29 19 T_KAM_HTML_FONT_INVALID 26524 25.30 30.08 22.81 20 TR_XM_DKIM_Undo 26302 11.63 29.82 2.15 21 DKIM_VALID_EF 26295 30.22 29.82 30.42 22 BAYES_999 23505 11.35 26.65 3.37 23 MIME_HTML_ONLY 22829 23.05 25.89 21.57 24 RCVD_IN_MSPIKE_H2 22194 21.02 25.17 18.85 25 TR_DCC_Bayes_99 22193 9.93 25.17 1.98 26 TR_XM_DK_Unsub 20029 17.68 22.71 15.05 27 XM_Multi_Part_URI 19645 18.52 22.28 16.55 28 DCC_CHECK_NEGATIVE 18759 37.41 21.27 45.82 29 UNPARSEABLE_RELAY 18703 16.08 21.21 13.41 30 XMSubLong 18699 22.16 21.20 22.66 31 XM_B_Unsub 17473 12.55 19.81 8.76 32 T_TM2_M_HEADER_IN_MSG 16994 20.89 19.27 21.74 33 TR_XM_BayesUnsub 16837 11.17 19.09 7.05 34 RELAYCOUNTRY_META 16595 8.41 18.82 2.99 35 TR_MAX_INTL_RELAY 14756 9.97 16.73 6.45 36 XM_B_SpammyWords3 11997 9.02 13.60 6.63 37 TR_XM_SpammyRelay 11332 5.45 12.85 1.59 38 RCVD_IN_BL_SPAMCOP_NET 11140 4.82 12.63 0.75 39 FSL_BULK_SIG 10789 13.92 12.23 14.80 40 BOTNET_IPINHOSTNAME 10680 6.79 12.11 4.01 41 TR_XM_UnparsRelay 10174 5.23 11.54 1.94 42 BOTNET 9720 4.51 11.02 1.11 43 TR_XM_SpammyWords2 9623 4.08 10.91 0.51 44 LOTS_OF_MONEY 9585 8.07 10.87 6.61 45 BAYES_80 8906 6.03 10.10 3.91 46 TR_XM_SpammyWords4 8871 6.60 10.06 4.79 47 XM_Evil_Numbers_Gen 8148 9.85 9.24 10.17 48 BAYES_60 8024 8.08 9.10 7.54 49 XM_B_Phish_Phrases 7220 6.14 8.19 5.07 50 RCVD_IN_MSPIKE_WL 6934 13.22 7.86 16.02 51 UNTRUSTED_Relay 6800 3.73 7.71 1.65 52 HTML_IMAGE_RATIO_02 6441 6.13 7.30 5.52 53 MPART_ALT_DIFF 5864 6.19 6.65 5.95 54 RELAYCOUNTRY_CA 5397 2.75 6.12 0.99 55 BAYES_95 5258 3.71 5.96 2.54 56 XMSubMetaSx_00 5253 3.97 5.96 2.94 57 TR_XM_NoHeaderRelay 5204 2.18 5.90 0.24 58 XM_Body_Dirty_Words 5069 3.52 5.75 2.35 59 LotsOfNums_01 5058 6.93 5.74 7.55 60 XM_H_GMP 5030 6.09 5.70 6.29 61 DKIM_INVALID 4829 2.57 5.48 1.06 62 TR_XM_SpammyWords5 4803 3.27 5.45 2.13 63 XM_UncommonTLD01 4650 5.06 5.27 4.95 64 XM_H_Long_From01 4580 5.40 5.19 5.51 65 TooManyTo_001 4568 5.34 5.18 5.42 66 HTML_IMAGE_RATIO_04 4500 4.34 5.10 3.95 67 T_XMDrugObfuBody_14 4239 2.84 4.81 1.82 68 TR_XM_SPAMCOP 4220 1.73 4.79 0.13 69 XM_B_PhoneNumber 4139 5.62 4.69 6.10 70 XM_B_Investor 4105 2.41 4.65 1.23 71 XMStrtUSub 3867 6.09 4.38 6.97 72 TR_XM_PhishingBody 3836 2.63 4.35 1.73 73 XM_CamelCaseFrm001 3797 3.04 4.31 2.38 74 XMNumbers 3723 4.31 4.22 4.36 75 RCVD_IN_MSPIKE_H3 3547 5.99 4.02 7.01 76 RCVD_IN_VALIDITY_RPBL 3516 1.38 3.99 0.02 77 XMSexyCombo_05 3510 2.17 3.98 1.22 78 TR_XM_MSPIKECOMBO 3508 1.84 3.98 0.73 79 RCVD_IN_MSPIKE_BL 3508 1.84 3.98 0.73 80 USER_IN_DEF_DKIM_WL 3389 13.37 3.84 18.33 81 XM_B_SpammyTLD 3353 3.11 3.80 2.75 82 TM2_M_VERY_LONG_WORD 3209 2.24 3.64 1.50 83 MIME_HTML_MOSTLY 3167 3.68 3.59 3.73 84 DKIM_ADSP_NXDOMAIN 2975 1.44 3.37 0.43 85 XMDiploma_00 2942 2.13 3.34 1.50 86 RELAYCOUNTRY_IN 2914 1.15 3.30 0.02 87 SUBJ_ALL_CAPS 2790 2.05 3.16 1.48 88 MIME_HTML_ONLY_MULTI 2778 2.81 3.15 2.63 89 XM_B_Unsub2 2759 1.93 3.13 1.31 90 RCVD_IN_VALIDITY_SAFE 2694 4.98 3.05 5.98 91 MIME_QP_LONG_LINE 2609 3.48 2.96 3.76 92 XM_URI_RBL 2608 1.35 2.96 0.52 93 HTML_IMAGE_RATIO_06 2606 3.45 2.96 3.71 94 T_XMHurry_00 2570 1.39 2.91 0.60 95 FROM_EXCESS_BASE64 2453 2.49 2.78 2.33 96 HTML_IMAGE_RATIO_08 2402 2.15 2.72 1.86 97 RELAYCOUNTRY_AU 2395 1.24 2.72 0.47 98 XMBody_17 2395 1.33 2.72 0.60 99 TR_XM_SpammyWords3 2357 1.12 2.67 0.31 100 XM_OfRef6 2276 1.46 2.58 0.88 101 TR_XM_INTL_Spamhaus 2240 0.92 2.54 0.08 102 XM_SPF_SoftFail 2182 1.54 2.47 1.06 103 RCVD_IN_VALIDITY_CERTIFIED 2173 3.94 2.46 4.71 104 T_XMDrugObfuBody_08 2157 1.62 2.45 1.19 105 XM_UB50 2071 1.43 2.35 0.95 106 RCVD_IN_XBL 2022 0.79 2.29 0.01 107 T_REMOTE_IMAGE 2014 3.23 2.28 3.73 108 XMBdyGiftCard01 1964 1.03 2.23 0.41 109 RCVD_IN_SBL_CSS 1941 0.78 2.20 0.04 110 URI_NOVOWEL 1874 1.51 2.13 1.20 111 RCVD_IN_MSPIKE_H4 1870 3.09 2.12 3.60 112 T_TooManySym_01 1861 5.55 2.11 7.35 113 XMBrknScrpt_02 1823 1.33 2.07 0.95 114 TR_XM_INV_DKIM 1803 0.72 2.04 0.02 115 XMStockSpam_06 1801 1.89 2.04 1.81 116 BOTNET_NORDNS 1792 0.70 2.03 0.01 117 XM_B_SpammyWords4 1776 1.20 2.01 0.78 118 BOUNCE_MESSAGE 1722 4.68 1.95 6.10 119 ANY_BOUNCE_MESSAGE 1722 4.68 1.95 6.10 120 T_XMDrugObfuBody_00 1722 1.33 1.95 1.00 121 XM_B_URI_Unicode 1712 1.79 1.94 1.71 122 SHOPIFY_IMG_NOT_RCVD_SFY 1689 0.90 1.92 0.37 123 MAILING_LIST_MULTI 1647 2.26 1.87 2.47 124 XM_H_Long_From02 1641 1.12 1.86 0.73 125 XM_ProductURIs 1637 1.16 1.86 0.79 126 XMPhish30 1624 1.07 1.84 0.67 127 DIET_1 1590 0.90 1.80 0.43 128 XM_HighProb1 1586 0.62 1.80 0.00 129 XM_UB60 1585 0.66 1.80 0.07 130 RCVD_IN_MSPIKE_L3 1570 1.03 1.78 0.63 131 STY_INVIS_DIRECT 1529 0.85 1.73 0.39 132 RCVD_IN_MSPIKE_H5 1517 4.15 1.72 5.41 133 RCVD_IN_PSBL 1506 1.23 1.71 0.99 134 SpammyFromTLD_02 1473 0.82 1.67 0.37 135 T_FILL_THIS_FORM_SHORT 1443 0.99 1.64 0.65 136 TM2_M_URI_OPT_OUT 1430 1.73 1.62 1.78 137 XM_UB99 1404 0.55 1.59 0.00 138 XM_DK_Undo_01 1396 1.55 1.58 1.54 139 MPART_ALT_DIFF_COUNT 1378 0.94 1.56 0.62 140 TR_XM_MSPIKECOMBO2 1374 0.55 1.56 0.03 141 XPRIO 1366 0.53 1.55 0.00 142 ALL_TRUSTED 1345 11.60 1.53 16.86 143 XM_B_COPY_HTML 1342 1.26 1.52 1.12 144 BAYES_40 1331 3.81 1.51 5.01 145 THIS_AD 1295 0.81 1.47 0.47 146 SpammyFromTLD_01 1294 0.70 1.47 0.30 147 HTML_FONT_TINY_NORDNS 1280 0.52 1.45 0.03 148 MISSING_HEADERS 1253 0.63 1.42 0.21 149 XMGenDplmaNmb 1229 0.86 1.39 0.58 150 XMBounce_01 1225 0.49 1.39 0.01 151 TR_XM_PHPForged 1223 0.71 1.39 0.35 152 TR_XM_FormFill2 1215 0.71 1.38 0.36 153 TR_XM_PHPDW 1212 0.70 1.37 0.36 154 HTML_IMAGE_ONLY_20 1206 0.72 1.37 0.38 155 SH_BODYURI_REVERSE_SBL 1191 0.47 1.35 0.00 156 URIBL_SBL 1191 0.47 1.35 0.01 157 URIBL_SBL_A 1191 0.47 1.35 0.01 158 RDNS_DYNAMIC 1188 0.62 1.35 0.25 159 XM_H_PHPOS 1184 0.69 1.34 0.35 160 RELAYCOUNTRY_CN 1151 0.48 1.31 0.05 161 KHOP_HELO_FCRDNS 1143 1.34 1.30 1.36 162 PDS_RDNS_DYNAMIC_FP 1143 0.46 1.30 0.02 163 XMBody_78 1141 0.69 1.29 0.38 164 XMSubMetaI_00 1137 0.92 1.29 0.73 165 XM_H_DKIM_GOOG 1120 0.44 1.27 0.01 166 TVD_RCVD_IP 1111 1.48 1.26 1.59 167 REPLYTO_WITHOUT_TO_CC 1094 0.43 1.24 0.01 168 XM_SendGrid 1092 1.27 1.24 1.29 169 TR_XM_XBL_BULK_SIG 1087 0.42 1.23 0.00 170 FORGED_MUA_OUTLOOK 1063 0.44 1.21 0.04 171 XM_UB80 1058 0.42 1.20 0.01 172 FSL_CTYPE_WIN1251 1054 0.41 1.20 0.00 173 RCVD_IN_MSPIKE_L4 1052 0.46 1.19 0.08 174 RCVD_IN_SBL 1052 0.41 1.19 0.00 175 TR_XM_Base64_M1 1050 0.94 1.19 0.80 176 FROM_MISSP_REPLYTO 1044 0.41 1.18 0.00 177 URI_HEX 1043 1.05 1.18 0.98 178 AXB_XMAILER_MIMEOLE_OL_024C2 1041 0.40 1.18 0.00 179 FROM_MISSP_EH_MATCH 1040 0.41 1.18 0.01 180 HTML_MIME_NO_HTML_TAG 1037 1.66 1.18 1.92 181 FSL_NEW_HELO_USER 1037 0.40 1.18 0.00 182 TO_NO_BRKTS_FROM_MSSP 1035 0.40 1.17 0.00 183 FROM_MISSPACED 1035 0.40 1.17 0.00 184 XM_B_Phish66 1034 0.60 1.17 0.31 185 FROM_MISSP_XPRIO 1034 0.40 1.17 0.00 186 TR_XM_GMP_BULK_SIG 1030 0.54 1.17 0.21 187 TR_LOTS_OF_MONEY1 1030 0.41 1.17 0.01 188 FROM_MISSP_MSFT 1026 0.40 1.16 0.00 189 XM_B_DNDMA 1021 1.00 1.16 0.91 190 RCVD_IN_SBL_DROP 1008 0.39 1.14 0.00 191 T_Symld_Words_02 1005 0.71 1.14 0.48 192 XM_DIRTYINTL 999 0.41 1.13 0.04 193 XMReplyNow 990 0.51 1.12 0.20 194 NSL_RCVD_FROM_USER 985 0.38 1.12 0.00 195 TO_NO_BRKTS_MSFT 976 0.38 1.11 0.00 196 MONEY_FROM_MISSP 976 0.38 1.11 0.00 197 BAYES_20 969 3.50 1.10 4.75 198 RELAYCOUNTRY_FR 967 0.55 1.10 0.26 199 FROM_MISSP_USER 953 0.37 1.08 0.00 200 DEAR_BENEFICIARY 950 0.37 1.08 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139803 87.08 95.54 82.68 2 RELAYCOUNTRY_US 135318 80.68 81.93 80.02 3 DKIM_SIGNED 130621 81.87 90.75 77.25 4 XM_DK_Pass 129599 79.73 85.65 76.64 5 DKIM_VALID 128827 79.30 85.27 76.18 6 XM_B_Unicode 120191 75.35 83.55 71.08 7 DKIM_VALID_AU 109615 66.65 70.15 64.82 8 BAYES_50 103147 52.40 35.92 61.00 9 DCC_CHECK 91567 62.38 78.16 54.15 10 XMListUnsubscribeExists 90087 58.39 68.20 53.28 11 XM_B_Unicode3 77854 47.78 51.12 46.04 12 XM_B_SpammyWords 77684 53.14 66.96 45.94 13 DCC_CHECK_NEGATIVE 77481 37.41 21.27 45.82 14 LOC_TINY_FONT_1 59426 41.04 52.34 35.14 15 HTML_FONT_LOW_CONTRAST 54425 33.54 36.14 32.19 16 DKIM_VALID_EF 51446 30.22 29.82 30.42 17 FVGT_m_MULTI_ODD 42336 29.11 36.92 25.04 18 T_KAM_HTML_FONT_INVALID 38575 25.30 30.08 22.81 19 XMSubLong 38319 22.16 21.20 22.66 20 T_TM2_M_HEADER_IN_MSG 36755 20.89 19.27 21.74 21 MIME_HTML_ONLY 36481 23.05 25.89 21.57 22 XM_B_SpammyWords2 35217 26.68 37.90 20.83 23 RCVD_IN_MSPIKE_H2 31875 21.02 25.17 18.85 24 USER_IN_DEF_DKIM_WL 30999 13.37 3.84 18.33 25 ALL_TRUSTED 28507 11.60 1.53 16.86 26 XM_Multi_Part_URI 27992 18.52 22.28 16.55 27 RCVD_IN_MSPIKE_WL 27092 13.22 7.86 16.02 28 TR_XM_DK_Unsub 25447 17.68 22.71 15.05 29 FSL_BULK_SIG 25032 13.92 12.23 14.80 30 UNPARSEABLE_RELAY 22670 16.08 21.21 13.41 31 XM_Evil_Numbers_Gen 17204 9.85 9.24 10.17 32 BAYES_00 15564 6.25 0.57 9.20 33 XM_DKIMWhitelistDomains 14919 5.84 0.12 8.82 34 XM_B_Unsub 14821 12.55 19.81 8.76 35 LotsOfNums_01 12765 6.93 5.74 7.55 36 BAYES_60 12757 8.08 9.10 7.54 37 TR_XM_DK_Bayes 12494 5.01 0.44 7.39 38 T_TooManySym_01 12421 5.55 2.11 7.35 39 TR_XM_DK_Bayes1 12416 4.98 0.44 7.34 40 TR_XM_BayesUnsub 11914 11.17 19.09 7.05 41 RCVD_IN_MSPIKE_H3 11856 5.99 4.02 7.01 42 XMStrtUSub 11789 6.09 4.38 6.97 43 XM_B_SpammyWords3 11217 9.02 13.60 6.63 44 LOTS_OF_MONEY 11185 8.07 10.87 6.61 45 TR_MAX_INTL_RELAY 10902 9.97 16.73 6.45 46 TR_XM_DK_Bayes2 10738 4.28 0.30 6.35 47 XM_H_GMP 10629 6.09 5.70 6.29 48 XM_B_PhoneNumber 10319 5.62 4.69 6.10 49 ANY_BOUNCE_MESSAGE 10317 4.68 1.95 6.10 50 BOUNCE_MESSAGE 10312 4.68 1.95 6.10 51 RCVD_IN_VALIDITY_SAFE 10115 4.98 3.05 5.98 52 MPART_ALT_DIFF 10063 6.19 6.65 5.95 53 XM_DK_Undo_02 9582 18.32 42.58 5.67 54 HTML_IMAGE_RATIO_02 9329 6.13 7.30 5.52 55 XM_H_Long_From01 9320 5.40 5.19 5.51 56 TooManyTo_001 9166 5.34 5.18 5.42 57 RCVD_IN_MSPIKE_H5 9150 4.15 1.72 5.41 58 XM_B_Phish_Phrases 8570 6.14 8.19 5.07 59 BAYES_40 8473 3.81 1.51 5.01 60 XM_UncommonTLD01 8363 5.06 5.27 4.95 61 TR_XM_SpammyWords4 8104 6.60 10.06 4.79 62 BAYES_20 8036 3.50 1.10 4.75 63 RCVD_IN_VALIDITY_CERTIFIED 7972 3.94 2.46 4.71 64 T_TooManySym_02 7712 3.13 0.39 4.56 65 XMNumbers 7374 4.31 4.22 4.36 66 BAYES_99 7256 14.68 34.61 4.29 67 INVALID_MSGID 6827 2.83 0.51 4.04 68 BOTNET_IPINHOSTNAME 6789 6.79 12.11 4.01 69 HTML_IMAGE_RATIO_04 6675 4.34 5.10 3.95 70 BAYES_80 6608 6.03 10.10 3.91 71 MIME_QP_LONG_LINE 6357 3.48 2.96 3.76 72 TO_MALFORMED 6330 2.46 0.00 3.74 73 MIME_HTML_MOSTLY 6309 3.68 3.59 3.73 74 T_REMOTE_IMAGE 6302 3.23 2.28 3.73 75 HTML_IMAGE_RATIO_06 6275 3.45 2.96 3.71 76 RCVD_IN_MSPIKE_H4 6086 3.09 2.12 3.60 77 MSGID_NOFQDN1 6012 2.34 0.02 3.56 78 BAYES_999 5692 11.35 26.65 3.37 79 RELAYCOUNTRY_META 5052 8.41 18.82 2.99 80 XMSubMetaSx_00 4971 3.97 5.96 2.94 81 XM_B_SpammyTLD 4647 3.11 3.80 2.75 82 XM_PDF 4554 1.98 0.62 2.69 83 MIME_HTML_ONLY_MULTI 4450 2.81 3.15 2.63 84 BAYES_95 4294 3.71 5.96 2.54 85 MAILING_LIST_MULTI 4169 2.26 1.87 2.47 86 XM_CamelCaseFrm001 4030 3.04 4.31 2.38 87 XM_Body_Dirty_Words 3980 3.52 5.75 2.35 88 FROM_EXCESS_BASE64 3943 2.49 2.78 2.33 89 RCVD_IN_IADB_LISTED 3862 1.79 0.84 2.28 90 TR_XM_DKIM_Undo 3630 11.63 29.82 2.15 91 TR_XM_SpammyWords5 3607 3.27 5.45 2.13 92 RCVD_IN_IADB_SPF 3503 1.61 0.71 2.07 93 T_TooManySym_03 3374 1.35 0.12 2.00 94 TR_DCC_Bayes_99 3351 9.93 25.17 1.98 95 TR_XM_UnparsRelay 3280 5.23 11.54 1.94 96 HTML_MIME_NO_HTML_TAG 3244 1.66 1.18 1.92 97 RCVD_IN_IADB_SENDERID 3200 1.45 0.62 1.89 98 HTML_IMAGE_RATIO_08 3139 2.15 2.72 1.86 99 RCVD_IN_IADB_DK 3135 1.44 0.65 1.85 100 T_XMDrugObfuBody_14 3075 2.84 4.81 1.82 101 XMStockSpam_06 3053 1.89 2.04 1.81 102 TM2_M_URI_OPT_OUT 3009 1.73 1.62 1.78 103 BAYES_05 2962 1.35 0.57 1.75 104 IN_HORDE_ADDRESS_BOOK 2926 1.18 0.12 1.73 105 TR_XM_PhishingBody 2925 2.63 4.35 1.73 106 XM_B_URI_Unicode 2888 1.79 1.94 1.71 107 UNTRUSTED_Relay 2784 3.73 7.71 1.65 108 T_TVD_MIME_NO_HEADERS 2757 1.09 0.06 1.63 109 TR_XM_SpammyRelay 2687 5.45 12.85 1.59 110 TVD_RCVD_IP 2685 1.48 1.26 1.59 111 XM_DK_Undo_01 2597 1.55 1.58 1.54 112 TM2_M_VERY_LONG_WORD 2543 2.24 3.64 1.50 113 XMDiploma_00 2542 2.13 3.34 1.50 114 SUBJ_ALL_CAPS 2497 2.05 3.16 1.48 115 RCVD_IN_IADB_VOUCHED 2491 1.14 0.51 1.47 116 XMGappySubj_01 2469 1.03 0.21 1.46 117 TVD_SPACE_RATIO 2461 1.05 0.29 1.46 118 LOW_PRICE 2410 1.05 0.34 1.43 119 TooManyTo_002 2367 1.18 0.76 1.40 120 KHOP_HELO_FCRDNS 2305 1.34 1.30 1.36 121 XM_B_Unsub2 2217 1.93 3.13 1.31 122 XM_SendGrid 2183 1.27 1.24 1.29 123 XM_B_Investor 2083 2.41 4.65 1.23 124 XMSexyCombo_05 2065 2.17 3.98 1.22 125 TR_Symld_Words 2059 1.05 0.72 1.22 126 URI_NOVOWEL 2022 1.51 2.13 1.20 127 XM_GoogleGroups 2018 1.01 0.66 1.19 128 T_XMDrugObfuBody_08 2015 1.62 2.45 1.19 129 XM_B_COPY_HTML 1892 1.26 1.52 1.12 130 BOTNET 1875 4.51 11.02 1.11 131 HTML_EXTRA_CLOSE 1872 0.73 0.02 1.11 132 XMGappySubj_02 1856 0.74 0.04 1.10 133 RCVD_IN_IADB_OPTIN 1797 0.82 0.37 1.06 134 DKIM_INVALID 1794 2.57 5.48 1.06 135 XM_SPF_SoftFail 1787 1.54 2.47 1.06 136 T_XMDrugObfuBody_00 1694 1.33 1.95 1.00 137 RELAYCOUNTRY_CA 1679 2.75 6.12 0.99 138 RCVD_IN_PSBL 1671 1.23 1.71 0.99 139 URI_HEX 1658 1.05 1.18 0.98 140 XM_UB50 1610 1.43 2.35 0.95 141 XMBrknScrpt_02 1605 1.33 2.07 0.95 142 XM_B_DNDMA 1539 1.00 1.16 0.91 143 TR_XM_DK_SendGrid 1509 0.89 0.88 0.89 144 XMBSHREFv2 1503 0.65 0.20 0.89 145 XM_OfRef6 1485 1.46 2.58 0.88 146 XM_H_PHPMailer 1468 0.76 0.55 0.87 147 TR_XM_Base64_M1 1360 0.94 1.19 0.80 148 TooManyTo_003 1352 0.73 0.60 0.80 149 XM_ProductURIs 1337 1.16 1.86 0.79 150 DKIM_ADSP_CUSTOM_MED 1322 0.77 0.74 0.78 151 XM_B_SpammyWords4 1317 1.20 2.01 0.78 152 RCVD_IN_BL_SPAMCOP_NET 1260 4.82 12.63 0.75 153 RCVD_IN_MSPIKE_BL 1238 1.84 3.98 0.73 154 TR_XM_MSPIKECOMBO 1238 1.84 3.98 0.73 155 XMSubMetaI_00 1237 0.92 1.29 0.73 156 XM_H_Long_From02 1230 1.12 1.86 0.73 157 XMPhish30 1133 1.07 1.84 0.67 158 TR_MetaPhish_Combo_01 1116 0.63 0.57 0.66 159 T_FILL_THIS_FORM_SHORT 1096 0.99 1.64 0.65 160 TR_XM_GMP_MSPIKE_UNDO2 1081 0.48 0.18 0.64 161 RCVD_IN_MSPIKE_L3 1073 1.03 1.78 0.63 162 TM2_M_OBFU_COMMENT 1067 0.76 1.02 0.63 163 MPART_ALT_DIFF_COUNT 1048 0.94 1.56 0.62 164 XMBody_17 1017 1.33 2.72 0.60 165 T_XMHurry_00 1015 1.39 2.91 0.60 166 TooManyTo_004 1014 0.58 0.55 0.60 167 XMGenDplmaNmb 973 0.86 1.39 0.58 168 HTML_TAG_BALANCE_BODY 967 0.70 0.93 0.57 169 URI_TRY_3LD 965 0.68 0.89 0.57 170 FORGED_GMAIL_RCVD 913 0.55 0.56 0.54 171 XMBody_95 904 0.41 0.16 0.53 172 XMNoVowels 903 0.47 0.34 0.53 173 XMPhish14 885 0.66 0.91 0.52 174 XM_URI_RBL 875 1.35 2.96 0.52 175 TR_XM_SpammyWords2 870 4.08 10.91 0.51 176 T_TooManySym_04 867 0.34 0.02 0.51 177 XM_ShortIntro_01 852 0.48 0.45 0.50 178 TooManyTo_005 847 0.51 0.53 0.50 179 TR_LOTS_OF_MONEY2 840 0.58 0.74 0.50 180 T_MONEY_PERCENT 840 0.58 0.74 0.50 181 RCVD_IN_PBL 822 0.69 1.08 0.49 182 MSGID_FROM_MTA_HEADER 820 0.37 0.16 0.48 183 T_OBFU_PDF_ATTACH 809 0.35 0.12 0.48 184 T_Symld_Words_02 809 0.71 1.14 0.48 185 RELAYCOUNTRY_AU 799 1.24 2.72 0.47 186 XMSlimDrugH 796 0.58 0.79 0.47 187 XMHTML_After_End 793 0.51 0.58 0.47 188 THIS_AD 790 0.81 1.47 0.47 189 XMLngstWrd_00 771 0.41 0.31 0.46 190 XM_S_SubURI 765 0.34 0.13 0.45 191 DIET_1 735 0.90 1.80 0.43 192 DKIM_ADSP_NXDOMAIN 732 1.44 3.37 0.43 193 PLING_QUERY 730 0.60 0.91 0.43 194 TRACKER_ID 724 0.32 0.12 0.43 195 NML_ADSP_CUSTOM_MED 708 0.48 0.60 0.42 196 XMClaimOffer 702 0.56 0.82 0.42 197 XMBdyGiftCard01 691 1.03 2.23 0.41 198 STY_INVIS_DIRECT 666 0.85 1.73 0.39 199 NO_DNS_FOR_FROM 664 0.51 0.74 0.39 200 XMLngstWrd_01 659 0.34 0.26 0.39 ----------------------------------------------------------------------