Email: 647879 Autolearn: 0 AvgScore: 3.26 AvgScanTime: 1.25 sec Spam: 183887 Autolearn: 0 AvgScore: 13.22 AvgScanTime: 1.39 sec Ham: 463992 Autolearn: 0 AvgScore: -0.69 AvgScanTime: 1.20 sec Time Spent Running SA: 225.46 hours Time Spent Processing Spam: 71.20 hours Time Spent Processing Ham: 154.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 173277 90.61 94.23 89.18 2 DKIM_SIGNED 143956 78.10 78.29 78.02 3 DCC_CHECK 141313 49.59 76.85 38.79 4 XM_DK_Pass 140236 76.47 76.26 76.55 5 XM_B_Unicode 137917 72.69 75.00 71.77 6 DKIM_VALID 136885 74.34 74.44 74.30 7 RELAYCOUNTRY_US 134331 80.69 73.05 83.72 8 XMListUnsubscribeExists 126166 57.06 68.61 52.48 9 XM_B_SpammyWords 124390 55.09 67.64 50.12 10 DKIM_VALID_AU 105715 56.15 57.49 55.61 11 XM_DK_Undo_02 77297 18.43 42.04 9.08 12 XM_B_Unicode3 74388 41.44 40.45 41.83 13 XM_B_SpammyWords2 71840 27.51 39.07 22.92 14 BAYES_50 67268 50.23 36.58 55.64 15 LOC_TINY_FONT_1 64698 27.19 35.18 24.02 16 BAYES_99 62985 13.92 34.25 5.86 17 MIME_HTML_ONLY 62589 25.19 34.04 21.69 18 HTML_FONT_LOW_CONTRAST 61353 29.70 33.36 28.24 19 DKIM_VALID_EF 51508 28.88 28.01 29.22 20 BAYES_999 49592 11.13 26.97 4.85 21 RCVD_IN_MSPIKE_H2 48125 26.29 26.17 26.34 22 TR_DCC_Bayes_99 48054 9.39 26.13 2.75 23 XMSubLong 46387 22.55 25.23 21.49 24 T_KAM_HTML_FONT_INVALID 45519 20.28 24.75 18.51 25 FVGT_m_MULTI_ODD 44215 22.55 24.04 21.96 26 RELAYCOUNTRY_META 42028 10.17 22.86 5.14 27 DCC_CHECK_NEGATIVE 39565 48.55 21.52 59.26 28 T_TM2_M_HEADER_IN_MSG 37315 26.47 20.29 28.92 29 UNTRUSTED_Relay 36914 7.25 20.07 2.17 30 XM_Multi_Part_URI 34892 14.11 18.97 12.19 31 BOTNET 33742 6.75 18.35 2.16 32 XM_Body_Dirty_Words 33392 14.56 18.16 13.13 33 RCVD_IN_MSPIKE_WL 29889 25.73 16.25 29.48 34 FSL_BULK_SIG 28936 7.93 15.74 4.83 35 LOTS_OF_MONEY 27493 10.24 14.95 8.37 36 TR_XM_SpammyWords2 26926 5.20 14.64 1.45 37 BOTNET_IPINHOSTNAME 24587 7.45 13.37 5.10 38 XMSexyCombo_05 22118 6.21 12.03 3.90 39 XM_UncommonTLD01 22051 5.75 11.99 3.27 40 XM_B_Unsub 21753 11.64 11.83 11.57 41 XM_B_SpammyWords3 21179 7.32 11.52 5.66 42 RCVD_IN_MSPIKE_BL 19395 3.45 10.55 0.64 43 LotsOfNums_01 18783 9.47 10.21 9.18 44 XM_B_Phish_Phrases 18553 7.83 10.09 6.94 45 BAYES_60 18236 7.95 9.92 7.17 46 HTML_IMAGE_RATIO_02 17947 7.83 9.76 7.07 47 XM_Evil_Numbers_Gen 17444 8.30 9.49 7.84 48 T_REMOTE_IMAGE 17256 5.26 9.38 3.63 49 MPART_ALT_DIFF 16672 6.33 9.07 5.24 50 RCVD_IN_MSPIKE_H3 16400 13.94 8.92 15.93 51 BAYES_80 16086 5.56 8.75 4.29 52 XM_UB50 14495 3.09 7.88 1.19 53 KHOP_HELO_FCRDNS 14379 3.35 7.82 1.58 54 HTML_SHORT_LINK_IMG_1 14275 2.25 7.76 0.07 55 HTML_IMAGE_ONLY_12 14171 2.36 7.71 0.24 56 BODY_URI_ONLY 13660 2.17 7.43 0.09 57 XMSubMetaSx_00 13439 4.61 7.31 3.54 58 TooManyTo_001 13392 8.01 7.28 8.29 59 RCVD_IN_BL_SPAMCOP_NET 13054 2.84 7.10 1.16 60 MIME_HTML_MOSTLY 12389 3.47 6.74 2.17 61 RCVD_IN_MSPIKE_H4 12268 10.07 6.67 11.42 62 TR_XM_SpammyWords3 11922 2.11 6.48 0.38 63 RCVD_IN_MSPIKE_L3 10705 1.93 5.82 0.39 64 TR_XM_PhishingBody 10556 3.75 5.74 2.96 65 UNPARSEABLE_RELAY 10234 7.46 5.57 8.21 66 RCVD_IN_RP_RNBL 9562 1.54 5.20 0.09 67 BAYES_95 9413 3.34 5.12 2.63 68 RELAYCOUNTRY_CA 9335 2.49 5.08 1.47 69 XMBrknScrpt_02 8968 1.95 4.88 0.79 70 SpammyFromTLD_01 8956 2.01 4.87 0.88 71 XM_H_Long_From01 8734 5.79 4.75 6.20 72 XM_UB60 8704 1.41 4.73 0.09 73 XM_SendGrid 8640 6.62 4.70 7.38 74 XMNumbers 8544 3.72 4.65 3.36 75 URIBL_SBL_A 8479 1.43 4.61 0.17 76 XM_B_COVIDMETA 7931 2.45 4.31 1.72 77 BOTNET_NORDNS 7901 1.23 4.30 0.02 78 SpammyFromTLD_02 7872 1.54 4.28 0.45 79 HTML_IMAGE_RATIO_04 7834 5.13 4.26 5.47 80 RCVD_IN_MSPIKE_L5 7594 1.30 4.13 0.18 81 HTML_IMAGE_RATIO_06 7354 3.93 4.00 3.90 82 T_FONT_INVIS_NAKED_TO 7248 2.61 3.94 2.08 83 RELAYCOUNTRY_FR 7079 1.26 3.85 0.23 84 DKIM_INVALID 7071 3.75 3.85 3.72 85 XM_UB99 7066 1.11 3.84 0.03 86 T_XMDrugObfuBody_08 6895 2.32 3.75 1.75 87 T_XMDrugObfuBody_00 6847 1.75 3.72 0.96 88 XMBody_17 6768 1.64 3.68 0.83 89 XM_OfRef6 6720 2.04 3.65 1.39 90 XM_SPF_SoftFail 6719 2.24 3.65 1.68 91 XM_B_Phish66 6466 2.23 3.52 1.72 92 HTML_MIME_NO_HTML_TAG 6296 2.78 3.42 2.52 93 URI_HEX 6063 1.98 3.30 1.46 94 XMStrtUSub 6013 4.00 3.27 4.29 95 URI_PHP_REDIR 6000 0.93 3.26 0.00 96 TR_XM_MaxSPIKE 5946 0.93 3.23 0.02 97 FROM_EXCESS_BASE64 5844 2.94 3.18 2.85 98 TR_LOTS_OF_MONEY3 5749 1.37 3.13 0.68 99 XMDiploma_00 5573 2.25 3.03 1.94 100 DATE_IN_PAST_03_06 5522 0.92 3.00 0.09 101 XM_UB999 5450 0.86 2.96 0.02 102 XM_B_SpammyTLD 5352 2.36 2.91 2.15 103 RCVD_IN_PSBL 5323 0.84 2.89 0.02 104 URI_TRY_3LD 5072 1.59 2.76 1.12 105 SUBJ_ALL_CAPS 5059 2.00 2.75 1.70 106 MIME_QP_LONG_LINE 5044 5.03 2.74 5.93 107 TM2_M_VERY_LONG_WORD 4891 1.62 2.66 1.21 108 RELAYCOUNTRY_UA 4841 0.78 2.63 0.04 109 XMStockSpam_06 4685 1.29 2.55 0.79 110 TR_XM_MaxBayes 4613 0.72 2.51 0.02 111 TM2_M_URI_OPT_OUT 4613 3.12 2.51 3.36 112 LH_URI_DOM_IN_PATH 4525 2.20 2.46 2.10 113 MIME_HTML_ONLY_MULTI 4518 3.05 2.46 3.28 114 XM_DIRTYINTL 4495 1.03 2.44 0.48 115 TR_XM_DK_SendGrid 4483 3.99 2.44 4.61 116 HTML_IMAGE_RATIO_08 4469 2.52 2.43 2.55 117 XM_CamelCaseFrm001 4396 2.07 2.39 1.94 118 TR_XM_COVIDMETA4 4376 0.95 2.38 0.38 119 T_XMHurry_00 4279 1.20 2.33 0.76 120 RCVD_IN_RP_SAFE 3998 6.25 2.17 7.86 121 TR_XM_SB_Phish 3893 2.42 2.12 2.55 122 XM_B_SpammyWords4 3784 1.03 2.06 0.63 123 XMSubPhish11 3780 2.39 2.06 2.52 124 BAYES_40 3746 4.00 2.04 4.77 125 XMSexyCombo_01 3676 0.94 2.00 0.52 126 T_XMDrugObfuBody_14 3602 1.80 1.96 1.73 127 RCVD_IN_IADB_LISTED 3553 4.86 1.93 6.01 128 XM_UB80 3549 0.56 1.93 0.02 129 TR_Mismatch_TLD_01 3542 0.77 1.93 0.31 130 T_FILL_THIS_FORM_SHORT 3512 1.13 1.91 0.82 131 TR_XM_UnparsRelay 3480 0.80 1.89 0.37 132 T_TooManySym_01 3251 3.93 1.77 4.79 133 HTML_IMAGE_ONLY_32 3240 0.80 1.76 0.41 134 XM_B_Unsub2 3206 2.43 1.74 2.70 135 T_MONEY_PERCENT 3184 0.65 1.73 0.21 136 TR_LOTS_OF_MONEY2 3184 0.65 1.73 0.21 137 RELAYCOUNTRY_IN 3119 0.55 1.70 0.10 138 XMGppyBdWords 3093 0.64 1.68 0.23 139 RCVD_IN_IADB_SPF 3081 4.21 1.68 5.22 140 XM_BadFromFormat 3040 0.62 1.65 0.21 141 XM_URI_RBL 2993 0.59 1.63 0.18 142 RCVD_IN_RP_CERTIFIED 2988 5.60 1.62 7.18 143 SUBJ_BUY 2966 0.51 1.61 0.07 144 XMGenDplmaNmb 2961 1.27 1.61 1.14 145 XMBdyGiftCard01 2924 1.03 1.59 0.81 146 RCVD_IN_IADB_SENDERID 2915 3.77 1.59 4.64 147 RCVD_IN_IADB_DK 2889 3.66 1.57 4.48 148 FROM_SUSPICIOUS_NTLD 2875 0.49 1.56 0.07 149 PDS_FROM_2_EMAILS 2868 0.48 1.56 0.05 150 FROM_2_EMAILS_SHORT 2835 0.44 1.54 0.00 151 HTML_FONT_SIZE_LARGE 2799 0.52 1.52 0.12 152 T_PDS_OTHER_BAD_TLD 2764 0.71 1.50 0.39 153 TR_Symld_Words 2762 1.94 1.50 2.11 154 XMSubMetaSxObfu_03 2760 0.70 1.50 0.38 155 FROM_SUSPICIOUS_NTLD_FP 2747 0.47 1.49 0.06 156 T_Symld_Words_02 2734 0.88 1.49 0.64 157 PDS_TO_EQ_FROM_NAME 2707 0.42 1.47 0.01 158 BAYES_20 2673 3.01 1.45 3.62 159 MIMEOLE_DIRECT_TO_MX 2649 0.41 1.44 0.00 160 ANY_BOUNCE_MESSAGE 2647 2.22 1.44 2.53 161 BOUNCE_MESSAGE 2647 2.22 1.44 2.53 162 MIME_CHARSET_FARAWAY 2617 0.48 1.42 0.11 163 TR_XM_COVIDMETA1 2478 0.57 1.35 0.26 164 NO_FM_NAME_IP_HOSTN 2439 0.38 1.33 0.00 165 XM_RXBody 2400 0.52 1.31 0.21 166 TR_XM_INV_DKIM 2380 0.55 1.29 0.25 167 XMSubMetaD_00 2358 0.41 1.28 0.06 168 XMHTML_After_End 2345 0.93 1.28 0.80 169 LONG_JUNK_URI2 2330 0.40 1.27 0.06 170 TR_XM_PHPDW 2325 0.59 1.26 0.33 171 CHARSET_FARAWAY_HEADER 2306 0.39 1.25 0.04 172 TR_MetaPhish_Combo_01 2299 0.75 1.25 0.55 173 XM_SPF_Unknown 2281 0.87 1.24 0.72 174 TR_XM_PHPForged 2273 0.58 1.24 0.31 175 TR_XM_FormFill2 2257 0.57 1.23 0.31 176 XM_H_PHPOS 2253 0.57 1.23 0.31 177 DOS_OE_TO_MX 2158 0.33 1.17 0.00 178 XM_UB95 2119 0.34 1.15 0.01 179 XMObfuSubjects 2100 0.33 1.14 0.01 180 TR_Caps_n_Bayes_99 2087 0.37 1.13 0.06 181 XMSubMetaI_00 2062 0.90 1.12 0.82 182 XMSubNoVowel 2051 0.83 1.12 0.72 183 ALL_TRUSTED 2043 9.19 1.11 12.39 184 NUMERIC_HTTP_ADDR 1958 0.66 1.06 0.50 185 XM_Lotto 1956 0.38 1.06 0.11 186 TR_XM_RelayPhish 1951 0.39 1.06 0.12 187 URI_NO_WWW_BIZ_CGI 1951 0.31 1.06 0.01 188 LongTLD 1934 0.42 1.05 0.18 189 MAILING_LIST_MULTI 1923 2.42 1.05 2.96 190 DKIM_ADSP_CUSTOM_MED 1881 1.16 1.02 1.21 191 BAYES_00 1829 10.10 0.99 13.71 192 RELAYCOUNTRY_GB 1814 1.03 0.99 1.05 193 XM_DKIMWhitelistDomains 1811 5.63 0.98 7.47 194 T_MANY_PILL_PRICE 1805 0.30 0.98 0.03 195 XMPhish30 1803 0.66 0.98 0.53 196 XMMoneyMeta_00 1769 0.59 0.96 0.44 197 TR_XM_SpoofStaff 1759 0.33 0.96 0.08 198 XMSpoofStaff2 1736 0.33 0.94 0.08 199 RDNS_DYNAMIC 1713 0.67 0.93 0.57 200 FORGED_GMAIL_RCVD 1693 0.66 0.92 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 413798 90.61 94.23 89.18 2 RELAYCOUNTRY_US 388449 80.69 73.05 83.72 3 DKIM_SIGNED 362009 78.10 78.29 78.02 4 XM_DK_Pass 355196 76.47 76.26 76.55 5 DKIM_VALID 344756 74.34 74.44 74.30 6 XM_B_Unicode 333023 72.69 75.00 71.77 7 DCC_CHECK_NEGATIVE 274975 48.55 21.52 59.26 8 BAYES_50 258176 50.23 36.58 55.64 9 DKIM_VALID_AU 258044 56.15 57.49 55.61 10 XMListUnsubscribeExists 243519 57.06 68.61 52.48 11 XM_B_SpammyWords 232531 55.09 67.64 50.12 12 XM_B_Unicode3 194097 41.44 40.45 41.83 13 DCC_CHECK 179989 49.59 76.85 38.79 14 RCVD_IN_MSPIKE_WL 136804 25.73 16.25 29.48 15 DKIM_VALID_EF 135592 28.88 28.01 29.22 16 T_TM2_M_HEADER_IN_MSG 134204 26.47 20.29 28.92 17 HTML_FONT_LOW_CONTRAST 131048 29.70 33.36 28.24 18 RCVD_IN_MSPIKE_H2 122232 26.29 26.17 26.34 19 LOC_TINY_FONT_1 111461 27.19 35.18 24.02 20 XM_B_SpammyWords2 106366 27.51 39.07 22.92 21 FVGT_m_MULTI_ODD 101891 22.55 24.04 21.96 22 MIME_HTML_ONLY 100628 25.19 34.04 21.69 23 XMSubLong 99707 22.55 25.23 21.49 24 T_KAM_HTML_FONT_INVALID 85873 20.28 24.75 18.51 25 RCVD_IN_MSPIKE_H3 73913 13.94 8.92 15.93 26 BAYES_00 63627 10.10 0.99 13.71 27 XM_Body_Dirty_Words 60937 14.56 18.16 13.13 28 ALL_TRUSTED 57508 9.19 1.11 12.39 29 XM_Multi_Part_URI 56553 14.11 18.97 12.19 30 XM_B_Unsub 53685 11.64 11.83 11.57 31 RCVD_IN_MSPIKE_H4 52998 10.07 6.67 11.42 32 TR_XM_DK_Bayes 44661 7.09 0.70 9.63 33 TR_XM_DK_Bayes1 43321 6.88 0.68 9.34 34 LotsOfNums_01 42585 9.47 10.21 9.18 35 XM_DK_Undo_02 42121 18.43 42.04 9.08 36 TR_XM_DK_Bayes2 39116 6.17 0.46 8.43 37 LOTS_OF_MONEY 38821 10.24 14.95 8.37 38 TooManyTo_001 38477 8.01 7.28 8.29 39 UNPARSEABLE_RELAY 38085 7.46 5.57 8.21 40 RCVD_IN_RP_SAFE 36481 6.25 2.17 7.86 41 XM_Evil_Numbers_Gen 36358 8.30 9.49 7.84 42 XM_DKIMWhitelistDomains 34670 5.63 0.98 7.47 43 XM_SendGrid 34258 6.62 4.70 7.38 44 RCVD_IN_RP_CERTIFIED 33323 5.60 1.62 7.18 45 BAYES_60 33261 7.95 9.92 7.17 46 HTML_IMAGE_RATIO_02 32791 7.83 9.76 7.07 47 IN_ZIMBRA_NJ_WHITELIST 32610 5.06 0.08 7.03 48 XM_B_Phish_Phrases 32180 7.83 10.09 6.94 49 XM_H_Long_From01 28750 5.79 4.75 6.20 50 RCVD_IN_IADB_LISTED 27902 4.86 1.93 6.01 51 MIME_QP_LONG_LINE 27525 5.03 2.74 5.93 52 BAYES_99 27184 13.92 34.25 5.86 53 XM_B_SpammyWords3 26267 7.32 11.52 5.66 54 HTML_IMAGE_RATIO_04 25397 5.13 4.26 5.47 55 MPART_ALT_DIFF 24318 6.33 9.07 5.24 56 RCVD_IN_IADB_SPF 24201 4.21 1.68 5.22 57 RELAYCOUNTRY_META 23855 10.17 22.86 5.14 58 BOTNET_IPINHOSTNAME 23668 7.45 13.37 5.10 59 BAYES_999 22510 11.13 26.97 4.85 60 FSL_BULK_SIG 22420 7.93 15.74 4.83 61 T_TooManySym_01 22228 3.93 1.77 4.79 62 BAYES_40 22138 4.00 2.04 4.77 63 RCVD_IN_IADB_SENDERID 21538 3.77 1.59 4.64 64 TR_XM_DK_SendGrid 21389 3.99 2.44 4.61 65 XM_PDF 21026 3.50 0.88 4.53 66 RCVD_IN_IADB_DK 20799 3.66 1.57 4.48 67 BAYES_80 19920 5.56 8.75 4.29 68 XMStrtUSub 19884 4.00 3.27 4.29 69 XMSexyCombo_05 18099 6.21 12.03 3.90 70 HTML_IMAGE_RATIO_06 18097 3.93 4.00 3.90 71 RCVD_IN_IADB_VOUCHED 17931 2.99 0.78 3.86 72 DKIM_INVALID 17253 3.75 3.85 3.72 73 T_REMOTE_IMAGE 16845 5.26 9.38 3.63 74 BAYES_20 16812 3.01 1.45 3.62 75 XMSubMetaSx_00 16445 4.61 7.31 3.54 76 TM2_M_URI_OPT_OUT 15597 3.12 2.51 3.36 77 XMNumbers 15579 3.72 4.65 3.36 78 MIME_HTML_ONLY_MULTI 15239 3.05 2.46 3.28 79 XM_UncommonTLD01 15185 5.75 11.99 3.27 80 XM_H_Trusted_IP 14629 2.26 0.00 3.15 81 MAILING_LIST_MULTI 13754 2.42 1.05 2.96 82 TR_XM_PhishingBody 13751 3.75 5.74 2.96 83 FROM_EXCESS_BASE64 13205 2.94 3.18 2.85 84 URI_NOVOWEL 12814 2.23 0.89 2.76 85 TR_DCC_Bayes_99 12764 9.39 26.13 2.75 86 XM_B_Unsub2 12539 2.43 1.74 2.70 87 BAYES_95 12214 3.34 5.12 2.63 88 HTML_IMAGE_RATIO_08 11854 2.52 2.43 2.55 89 RCVD_IN_IADB_OPTIN 11828 1.98 0.55 2.55 90 TR_XM_SB_Phish 11813 2.42 2.12 2.55 91 ANY_BOUNCE_MESSAGE 11747 2.22 1.44 2.53 92 BOUNCE_MESSAGE 11747 2.22 1.44 2.53 93 XMSubPhish11 11715 2.39 2.06 2.52 94 HTML_MIME_NO_HTML_TAG 11715 2.78 3.42 2.52 95 T_TooManySym_02 11556 1.93 0.50 2.49 96 BAYES_05 10637 1.90 0.90 2.29 97 MIME_HTML_MOSTLY 10062 3.47 6.74 2.17 98 TooManyTo_002 10061 1.72 0.59 2.17 99 UNTRUSTED_Relay 10047 7.25 20.07 2.17 100 BOTNET 10017 6.75 18.35 2.16 101 XM_B_SpammyTLD 9961 2.36 2.91 2.15 102 RCVD_IN_MSPIKE_H5 9893 1.72 0.66 2.13 103 TR_Symld_Words 9811 1.94 1.50 2.11 104 LH_URI_DOM_IN_PATH 9758 2.20 2.46 2.10 105 T_FONT_INVIS_NAKED_TO 9652 2.61 3.94 2.08 106 XMDiploma_00 9007 2.25 3.03 1.94 107 XM_CamelCaseFrm001 8984 2.07 2.39 1.94 108 XM_DK_Undo_01 8963 1.64 0.89 1.93 109 T_XMDrugObfuBody_08 8135 2.32 3.75 1.75 110 T_XMDrugObfuBody_14 8038 1.80 1.96 1.73 111 XM_B_Phish66 7998 2.23 3.52 1.72 112 XM_B_COVIDMETA 7962 2.45 4.31 1.72 113 SUBJ_ALL_CAPS 7888 2.00 2.75 1.70 114 XM_SPF_SoftFail 7814 2.24 3.65 1.68 115 TVD_RCVD_IP 7741 1.28 0.29 1.67 116 HTML_FONT_FACE_BAD 7624 1.35 0.62 1.64 117 INVALID_MSGID 7417 1.34 0.68 1.60 118 KHOP_HELO_FCRDNS 7312 3.35 7.82 1.58 119 IN_HORDE_ADDRESS_BOOK 7311 1.21 0.28 1.58 120 XMGappySubj_01 7272 1.16 0.15 1.57 121 RELAYCOUNTRY_CA 6825 2.49 5.08 1.47 122 URI_HEX 6761 1.98 3.30 1.46 123 TR_XM_SpammyWords2 6736 5.20 14.64 1.45 124 TooManyTo_003 6664 1.15 0.44 1.44 125 HELO_NODOT 6534 1.16 0.55 1.41 126 HELO_NO_DOMAIN 6533 1.16 0.55 1.41 127 TO_MALFORMED 6470 1.00 0.01 1.39 128 XM_OfRef6 6468 2.04 3.65 1.39 129 HELO_MISC_IP 6172 1.05 0.36 1.33 130 CK_HELO_DYNAMIC_SPLIT_IP 6169 1.13 0.61 1.33 131 DKIM_ADSP_CUSTOM_MED 5637 1.16 1.02 1.21 132 TM2_M_VERY_LONG_WORD 5624 1.62 2.66 1.21 133 XM_UB50 5539 3.09 7.88 1.19 134 XMBSHREFv2 5522 0.93 0.28 1.19 135 RCVD_IN_BL_SPAMCOP_NET 5364 2.84 7.10 1.16 136 XMGenDplmaNmb 5280 1.27 1.61 1.14 137 XM_GoogleGroups 5255 0.93 0.41 1.13 138 XMCapTrack 5236 0.90 0.32 1.13 139 URI_TRY_3LD 5216 1.59 2.76 1.12 140 XM_H_Long_From02 5084 1.03 0.87 1.10 141 USER_IN_DEF_DKIM_WL 5072 0.78 0.01 1.09 142 RELAYCOUNTRY_GB 4849 1.03 0.99 1.05 143 TooManyTo_004 4824 0.85 0.38 1.04 144 XM_ProductURIs 4766 0.97 0.84 1.03 145 T_TooManySym_03 4719 0.76 0.10 1.02 146 FROM_GOV_DKIM_AU 4566 0.73 0.08 0.98 147 T_XMDrugObfuBody_00 4461 1.75 3.72 0.96 148 TR_MSPIKEBAYES00 4264 0.68 0.08 0.92 149 NML_ADSP_CUSTOM_MED 4212 0.89 0.86 0.91 150 SpammyFromTLD_01 4084 2.01 4.87 0.88 151 XMBody_17 3831 1.64 3.68 0.83 152 T_FILL_THIS_FORM_SHORT 3809 1.13 1.91 0.82 153 XMSubMetaI_00 3793 0.90 1.12 0.82 154 XMBdyGiftCard01 3764 1.03 1.59 0.81 155 XMHTML_After_End 3706 0.93 1.28 0.80 156 XMBrknScrpt_02 3663 1.95 4.88 0.79 157 TooManyTo_005 3658 0.66 0.34 0.79 158 XMStockSpam_06 3649 1.29 2.55 0.79 159 T_XMHurry_00 3517 1.20 2.33 0.76 160 RELAYCOUNTRY_DE 3439 0.72 0.67 0.74 161 XMBody_95 3431 0.56 0.09 0.74 162 XMNoVowels 3389 0.63 0.37 0.73 163 XMSubNoVowel 3339 0.83 1.12 0.72 164 XM_SPF_Unknown 3326 0.87 1.24 0.72 165 HTTPS_HTTP_MISMATCH 3204 0.69 0.70 0.69 166 T_OBFU_PDF_ATTACH 3156 0.53 0.14 0.68 167 TR_LOTS_OF_MONEY3 3150 1.37 3.13 0.68 168 DIET_1 3065 0.71 0.83 0.66 169 HTML_TAG_BALANCE_BODY 3041 0.64 0.60 0.66 170 XM_ShortIntro_01 3032 0.57 0.36 0.65 171 T_Symld_Words_02 2990 0.88 1.49 0.64 172 XMHTMLBadTable_001 2983 0.65 0.68 0.64 173 RCVD_IN_MSPIKE_BL 2961 3.45 10.55 0.64 174 XM_B_SpammyWords4 2915 1.03 2.06 0.63 175 T_TooManySym_04 2692 0.42 0.03 0.58 176 DKIM_ADSP_NXDOMAIN 2659 0.55 0.49 0.57 177 RDNS_DYNAMIC 2654 0.67 0.93 0.57 178 HTML_IMAGE_ONLY_20 2648 0.49 0.28 0.57 179 FORGED_GMAIL_RCVD 2599 0.66 0.92 0.56 180 TR_MetaPhish_Combo_01 2566 0.75 1.25 0.55 181 XMSlimDrugH 2449 0.63 0.89 0.53 182 XMPhish30 2445 0.66 0.98 0.53 183 XMSexyCombo_01 2420 0.94 2.00 0.52 184 XM_B_COPY_HTML 2390 0.59 0.77 0.52 185 NO_DNS_FOR_FROM 2388 0.53 0.58 0.51 186 MSGID_FROM_MTA_HEADER 2353 0.40 0.14 0.51 187 NUMERIC_HTTP_ADDR 2337 0.66 1.06 0.50 188 XMOemUri 2329 0.43 0.23 0.50 189 SENDGRID_REDIR 2323 0.54 0.66 0.50 190 XM_H_PHPMailer 2270 0.45 0.36 0.49 191 XMSolicitRefs_0 2268 0.55 0.70 0.49 192 XM_S_SubURI 2264 0.36 0.02 0.49 193 XMBody_78 2236 0.59 0.87 0.48 194 MPART_ALT_DIFF_COUNT 2212 0.47 0.46 0.48 195 TM2_M_BODY_EMPTY 2208 0.36 0.07 0.48 196 XM_DIRTYINTL 2208 1.03 2.44 0.48 197 MISSING_HEADERS 2162 0.43 0.32 0.47 198 PLING_QUERY 2129 0.58 0.88 0.46 199 SpammyFromTLD_02 2079 1.54 4.28 0.45 200 XMLngstWrd_00 2075 0.43 0.39 0.45 ----------------------------------------------------------------------