Email: 271453 Autolearn: 0 AvgScore: 4.33 AvgScanTime: 1.34 sec Spam: 99160 Autolearn: 0 AvgScore: 14.64 AvgScanTime: 1.48 sec Ham: 172293 Autolearn: 0 AvgScore: -1.61 AvgScanTime: 1.27 sec Time Spent Running SA: 101.37 hours Time Spent Processing Spam: 40.76 hours Time Spent Processing Ham: 60.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 94140 87.27 94.94 82.85 2 DKIM_SIGNED 85745 79.53 86.47 75.54 3 XM_B_Unicode 85306 75.85 86.03 69.99 4 XM_DK_Pass 84139 78.30 84.85 74.53 5 DKIM_VALID 83839 77.85 84.55 74.00 6 RELAYCOUNTRY_US 78538 79.18 79.20 79.16 7 XM_B_SpammyWords 69192 52.97 69.78 43.30 8 DCC_CHECK 68750 49.00 69.33 37.30 9 XMListUnsubscribeExists 66399 57.71 66.96 52.38 10 DKIM_VALID_AU 64765 63.77 65.31 62.88 11 RCVD_IN_MSPIKE_H2 47868 40.96 48.27 36.75 12 XM_B_Unicode3 47524 45.93 47.93 44.79 13 XM_DK_Undo_02 46161 22.33 46.55 8.40 14 XM_B_SpammyWords2 38218 26.54 38.54 19.64 15 BAYES_99 38137 18.43 38.46 6.91 16 LOC_TINY_FONT_1 37536 31.57 37.85 27.95 17 TR_XM_DKIM_Undo 36892 17.35 37.20 5.93 18 HTML_FONT_LOW_CONTRAST 36329 33.82 36.64 32.19 19 BAYES_50 36032 47.75 36.34 54.31 20 MIME_HTML_ONLY 33267 27.33 33.55 23.75 21 DKIM_VALID_EF 30674 30.14 30.93 29.68 22 DCC_CHECK_NEGATIVE 30389 50.97 30.65 62.66 23 BAYES_999 30357 14.75 30.61 5.63 24 T_KAM_HTML_FONT_INVALID 29724 22.55 29.98 18.28 25 FVGT_m_MULTI_ODD 29458 26.16 29.71 24.11 26 TR_XM_Base64_M1 29091 24.05 29.34 21.00 27 TR_XM_Base64_L1 27674 15.86 27.91 8.93 28 TR_DCC_Bayes_99 26567 11.47 26.79 2.66 29 XM_Body_Dirty_Words 23147 16.51 23.34 12.58 30 T_TM2_M_HEADER_IN_MSG 20961 21.21 21.14 21.24 31 RELAYCOUNTRY_META 19764 9.50 19.93 3.50 32 XMSubLong 18379 21.53 18.53 23.26 33 XM_Multi_Part_URI 17166 15.60 17.31 14.62 34 XM_B_Unsub 16825 12.13 16.97 9.34 35 TR_XM_BayesUnsub 16577 10.90 16.72 7.55 36 RCVD_IN_BL_SPAMCOP_NET 13728 5.59 13.84 0.83 37 UNPARSEABLE_RELAY 13689 10.04 13.80 7.88 38 TR_XM_SpammyWords2 13539 6.21 13.65 1.92 39 TR_XM_UnparsRelay 13414 8.88 13.53 6.21 40 TR_XM_SpammyRelay 13380 6.13 13.49 1.89 41 RCVD_IN_MSPIKE_WL 13265 16.87 13.38 18.89 42 XM_B_SpammyWords3 12693 7.74 12.80 4.82 43 LOTS_OF_MONEY 12090 9.38 12.19 7.75 44 FSL_BULK_SIG 11841 6.88 11.94 3.96 45 BOTNET_IPINHOSTNAME 11802 8.64 11.90 6.76 46 BOTNET 11524 5.23 11.62 1.55 47 XMSexyCombo_05 11148 7.38 11.24 5.16 48 RCVD_IN_MSPIKE_H3 10351 12.11 10.44 13.07 49 TR_XM_SpammyWords4 10345 7.19 10.43 5.33 50 RELAYCOUNTRY_CA 9435 4.30 9.51 1.29 51 TR_XM_Base64_L2 9054 4.28 9.13 1.49 52 TR_XM_SPAMCOP 8663 3.42 8.74 0.37 53 BAYES_80 8377 6.45 8.45 5.30 54 BAYES_60 8289 10.49 8.36 11.72 55 TR_XM_Base64_C 8288 5.01 8.36 3.09 56 UNTRUSTED_Relay 8278 3.97 8.35 1.45 57 XM_Evil_Numbers_Gen 7990 8.99 8.06 9.53 58 HTML_IMAGE_RATIO_02 7729 7.46 7.79 7.27 59 XM_UncommonTLD01 7547 5.83 7.61 4.80 60 XM_SendGrid 7471 5.96 7.53 5.06 61 XM_H_Long_From01 7139 5.59 7.20 4.66 62 TR_XM_PhishingBody 6805 3.93 6.86 2.24 63 MPART_ALT_DIFF 6560 6.00 6.62 5.64 64 LotsOfNums_01 6151 7.62 6.20 8.44 65 TR_XM_Base64_M2 6075 4.73 6.13 3.92 66 XMStrtUSub 5610 6.59 5.66 7.13 67 HTML_IMAGE_RATIO_04 5487 5.86 5.53 6.05 68 RCVD_IN_MSPIKE_BL 5484 2.44 5.53 0.66 69 BAYES_95 5308 4.00 5.35 3.22 70 TR_XM_MSPIKECOMBO 5213 2.34 5.26 0.65 71 XM_B_Phish_Phrases 5158 3.34 5.20 2.26 72 XMSubMetaSx_00 5147 4.44 5.19 4.02 73 TR_XM_DK_SendGrid 4980 4.00 5.02 3.41 74 T_REMOTE_IMAGE 4858 3.80 4.90 3.16 75 RCVD_IN_VALIDITY_SAFE 4847 6.30 4.89 7.11 76 TooManyTo_001 4625 6.01 4.66 6.78 77 XM_DIRTYINTL 4482 1.83 4.52 0.28 78 T_XMDrugObfuBody_14 4391 2.86 4.43 1.95 79 XM_CamelCaseFrm001 4350 2.79 4.39 1.86 80 HTML_IMAGE_RATIO_06 4229 5.42 4.26 6.08 81 XM_SPF_SoftFail 4226 2.30 4.26 1.17 82 XM_B_Investor 4107 2.29 4.14 1.22 83 BOTNET_NORDNS 3976 1.47 4.01 0.02 84 TM2_M_VERY_LONG_WORD 3950 2.35 3.98 1.41 85 XM_B_SpammyTLD 3916 2.54 3.95 1.73 86 USER_IN_DEF_DKIM_WL 3848 13.60 3.88 19.20 87 XM_UB50 3814 1.94 3.85 0.84 88 RCVD_IN_VALIDITY_RPBL 3765 1.41 3.80 0.03 89 RCVD_IN_VALIDITY_CERTIFIED 3716 5.43 3.75 6.40 90 XM_B_Phish66 3681 1.92 3.71 0.89 91 TR_XM_SpammyWords5 3630 2.17 3.66 1.30 92 SpammyFromTLD_01 3522 1.56 3.55 0.42 93 MIME_HTML_MOSTLY 3441 3.15 3.47 2.96 94 T_FILL_THIS_FORM_SHORT 3351 1.58 3.38 0.55 95 ALL_TRUSTED 3337 12.48 3.37 17.73 96 XM_OfRef6 3078 1.68 3.10 0.86 97 T_XMDrugObfuBody_08 3026 1.85 3.05 1.16 98 TR_XM_Base64_L3 2936 1.24 2.96 0.24 99 XMNumbers 2891 4.29 2.92 5.08 100 T_TooManySym_01 2878 7.12 2.90 9.54 101 TR_XM_SpammyWords3 2785 1.23 2.81 0.32 102 XMDiploma_00 2750 2.41 2.77 2.21 103 RCVD_IN_MSPIKE_H4 2748 4.23 2.77 5.07 104 XMBody_17 2694 1.28 2.72 0.45 105 XMSubNoVowel 2592 1.72 2.61 1.20 106 HTML_IMAGE_RATIO_08 2539 2.36 2.56 2.24 107 RCVD_IN_PSBL 2528 1.08 2.55 0.24 108 MIME_HTML_ONLY_MULTI 2486 3.05 2.51 3.35 109 FROM_EXCESS_BASE64 2479 3.21 2.50 3.62 110 TR_XM_MSPIKECOMBO2 2451 0.99 2.47 0.14 111 URI_NOVOWEL 2384 1.97 2.40 1.72 112 RCVD_IN_MSPIKE_L5 2358 0.88 2.38 0.01 113 TR_LOTS_OF_MONEY3 2294 1.05 2.31 0.33 114 XM_B_SpammyWords4 2267 1.39 2.29 0.88 115 HK_RANDOM_REPLYTO 2262 0.88 2.28 0.08 116 XM_B_Unsub2 2245 1.27 2.26 0.70 117 T_XMHurry_00 2233 1.21 2.25 0.62 118 TM2_M_URI_OPT_OUT 2231 2.60 2.25 2.80 119 SpammyFromTLD_02 2197 0.94 2.22 0.21 120 XM_B_DynamicLink 2187 0.82 2.21 0.03 121 XMBdyGiftCard01 2152 1.67 2.17 1.38 122 RCVD_IN_MSPIKE_L3 2138 1.03 2.16 0.39 123 TR_XM_FormFill 2129 0.80 2.15 0.02 124 SUBJ_ALL_CAPS 2076 1.44 2.09 1.07 125 MIME_QP_LONG_LINE 2047 2.96 2.06 3.47 126 HTML_TAG_BALANCE_BODY 2001 1.09 2.02 0.55 127 DKIM_INVALID 1906 1.68 1.92 1.54 128 XM_DK_Undo_01 1896 1.52 1.91 1.30 129 PDS_OTHER_BAD_TLD 1876 0.79 1.89 0.16 130 TR_XM_PHPDW 1853 0.91 1.87 0.36 131 TR_XM_PHPForged 1779 0.83 1.79 0.27 132 TR_XM_FormFill2 1732 0.81 1.75 0.27 133 XM_H_PHPOS 1725 0.79 1.74 0.25 134 XMBrknScrpt_02 1720 0.98 1.73 0.54 135 MPART_ALT_DIFF_COUNT 1713 1.18 1.73 0.86 136 BASE64_LENGTH_79_INF 1698 1.01 1.71 0.61 137 URI_HEX 1693 1.53 1.71 1.43 138 XMSubEmpty 1676 0.82 1.69 0.32 139 RCVD_IN_IADB_LISTED 1637 2.59 1.65 3.13 140 URIBL_DBL_SPAM 1620 0.60 1.63 0.01 141 DIET_1 1571 0.87 1.58 0.47 142 XM_UB99 1565 0.58 1.58 0.00 143 TR_XM_SB_Phish 1564 1.71 1.58 1.79 144 XMSexyCombo_01 1562 0.88 1.58 0.47 145 KHOP_HELO_FCRDNS 1561 1.07 1.57 0.78 146 XMStockSpam_06 1553 2.25 1.57 2.65 147 HTML_SHORT_LINK_IMG_3 1496 0.58 1.51 0.04 148 TR_XM_BayesRelay 1487 0.55 1.50 0.00 149 TR_XM_MaxSPIKE 1453 0.58 1.47 0.07 150 TR_Symld_Words 1434 1.31 1.45 1.24 151 T_XMDrugObfuBody_00 1433 0.91 1.45 0.60 152 HTML_MIME_NO_HTML_TAG 1404 1.45 1.42 1.48 153 MAILING_LIST_MULTI 1395 1.99 1.41 2.33 154 XMSubPhish11 1394 1.64 1.41 1.78 155 URI_TRY_3LD 1394 0.77 1.41 0.40 156 XMPhish30 1371 1.01 1.38 0.80 157 RCVD_IN_IADB_SPF 1363 2.31 1.37 2.86 158 TR_XM_NoHeaderRelay 1360 0.57 1.37 0.11 159 HTTPS_HTTP_MISMATCH 1349 0.82 1.36 0.51 160 DKIM_ADSP_CUSTOM_MED 1330 1.09 1.34 0.95 161 XM_Combo_Sbj 1298 0.56 1.31 0.12 162 XMReplyNow 1297 0.70 1.31 0.35 163 HTML_IMAGE_ONLY_20 1294 1.02 1.30 0.86 164 XMGenDplmaNmb 1285 1.16 1.30 1.09 165 BAYES_40 1268 3.09 1.28 4.13 166 RCVD_IN_IADB_DK 1243 2.05 1.25 2.51 167 RCVD_IN_IADB_SENDERID 1236 2.11 1.25 2.60 168 FORGED_GMAIL_RCVD 1220 0.80 1.23 0.56 169 NML_ADSP_CUSTOM_MED 1180 0.81 1.19 0.59 170 XM_UB999 1154 0.43 1.16 0.00 171 XMHTML_After_End 1136 0.76 1.15 0.53 172 RCVD_IN_RP_SAFE 1132 1.29 1.14 1.38 173 MIME_BASE64_TEXT 1115 0.49 1.12 0.12 174 XM_H_PHPMailer 1108 0.91 1.12 0.80 175 TR_XM_Base64_M3 1090 0.87 1.10 0.74 176 XM_URI_RBL 1069 0.45 1.08 0.09 177 RELAYCOUNTRY_RU 1064 0.43 1.07 0.05 178 XM_H_Undi_Recip 1050 0.50 1.06 0.18 179 XMHTMLBadTable_001 1041 0.87 1.05 0.76 180 TR_Mismatch_TLD_02 1030 0.42 1.04 0.06 181 SUBJ_DOLLARS 1022 0.49 1.03 0.18 182 RELAYCOUNTRY_AU 1019 0.55 1.03 0.28 183 HTML_FONT_TINY_NORDNS 1018 0.43 1.03 0.08 184 RCVD_IN_IADB_VOUCHED 1013 1.58 1.02 1.90 185 FONT_INVIS_LONG_LINE 1002 0.40 1.01 0.06 186 XM_TLDProd2 1000 0.53 1.01 0.25 187 TR_Mismatch_TLD_01 986 0.59 0.99 0.35 188 XMSlimDrugH 984 0.62 0.99 0.40 189 XM_UB60 979 0.40 0.99 0.07 190 PLING_QUERY 971 0.67 0.98 0.50 191 XM_B_REG_HTML 964 0.71 0.97 0.55 192 XMLngstWrd_00 963 0.77 0.97 0.65 193 RELAYCOUNTRY_NL 962 0.43 0.97 0.12 194 XMClaimOffer 961 0.41 0.97 0.08 195 MONEY_NOHTML 953 0.38 0.96 0.05 196 HTML_FONT_SIZE_LARGE 944 0.43 0.95 0.13 197 TM2_M_A_HREF_HREF 940 0.48 0.95 0.22 198 XM_H_Long_From02 932 1.17 0.94 1.30 199 URIBL_BLACK 921 0.36 0.93 0.03 200 SHOPIFY_IMG_NOT_RCVD_SFY 918 0.47 0.93 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142745 87.27 94.94 82.85 2 RELAYCOUNTRY_US 136392 79.18 79.20 79.16 3 DKIM_SIGNED 130142 79.53 86.47 75.54 4 XM_DK_Pass 128415 78.30 84.85 74.53 5 DKIM_VALID 127489 77.85 84.55 74.00 6 XM_B_Unicode 120583 75.85 86.03 69.99 7 DKIM_VALID_AU 108344 63.77 65.31 62.88 8 DCC_CHECK_NEGATIVE 107965 50.97 30.65 62.66 9 BAYES_50 93576 47.75 36.34 54.31 10 XMListUnsubscribeExists 90253 57.71 66.96 52.38 11 XM_B_Unicode3 77163 45.93 47.93 44.79 12 XM_B_SpammyWords 74596 52.97 69.78 43.30 13 DCC_CHECK 64271 49.00 69.33 37.30 14 RCVD_IN_MSPIKE_H2 63315 40.96 48.27 36.75 15 HTML_FONT_LOW_CONTRAST 55467 33.82 36.64 32.19 16 DKIM_VALID_EF 51133 30.14 30.93 29.68 17 LOC_TINY_FONT_1 48155 31.57 37.85 27.95 18 FVGT_m_MULTI_ODD 41543 26.16 29.71 24.11 19 MIME_HTML_ONLY 40916 27.33 33.55 23.75 20 XMSubLong 40071 21.53 18.53 23.26 21 T_TM2_M_HEADER_IN_MSG 36601 21.21 21.14 21.24 22 TR_XM_Base64_M1 36190 24.05 29.34 21.00 23 XM_B_SpammyWords2 33836 26.54 38.54 19.64 24 USER_IN_DEF_DKIM_WL 33083 13.60 3.88 19.20 25 RCVD_IN_MSPIKE_WL 32541 16.87 13.38 18.89 26 T_KAM_HTML_FONT_INVALID 31496 22.55 29.98 18.28 27 ALL_TRUSTED 30543 12.48 3.37 17.73 28 XM_Multi_Part_URI 25183 15.60 17.31 14.62 29 XM_DKIMWhitelistDomains 24255 9.04 0.29 14.08 30 RCVD_IN_MSPIKE_H3 22518 12.11 10.44 13.07 31 XM_Body_Dirty_Words 21673 16.51 23.34 12.58 32 BAYES_60 20188 10.49 8.36 11.72 33 T_TooManySym_01 16442 7.12 2.90 9.54 34 XM_Evil_Numbers_Gen 16427 8.99 8.06 9.53 35 BAYES_00 16380 6.22 0.51 9.51 36 XM_B_Unsub 16095 12.13 16.97 9.34 37 TR_XM_Base64_L1 15389 15.86 27.91 8.93 38 LotsOfNums_01 14543 7.62 6.20 8.44 39 XM_DK_Undo_02 14467 22.33 46.55 8.40 40 UNPARSEABLE_RELAY 13569 10.04 13.80 7.88 41 LOTS_OF_MONEY 13361 9.38 12.19 7.75 42 TR_XM_BayesUnsub 13001 10.90 16.72 7.55 43 HTML_IMAGE_RATIO_02 12532 7.46 7.79 7.27 44 XMStrtUSub 12284 6.59 5.66 7.13 45 RCVD_IN_VALIDITY_SAFE 12249 6.30 4.89 7.11 46 BAYES_99 11899 18.43 38.46 6.91 47 TooManyTo_001 11676 6.01 4.66 6.78 48 TR_XM_DK_Bayes 11655 4.45 0.42 6.76 49 BOTNET_IPINHOSTNAME 11646 8.64 11.90 6.76 50 TR_XM_DK_Bayes1 11511 4.39 0.41 6.68 51 RCVD_IN_VALIDITY_CERTIFIED 11032 5.43 3.75 6.40 52 TR_XM_UnparsRelay 10693 8.88 13.53 6.21 53 TR_XM_DK_Bayes2 10495 4.00 0.38 6.09 54 HTML_IMAGE_RATIO_06 10475 5.42 4.26 6.08 55 HTML_IMAGE_RATIO_04 10430 5.86 5.53 6.05 56 TR_XM_DKIM_Undo 10211 17.35 37.20 5.93 57 IN_ZIMBRA_NJ_WHITELIST 10179 3.80 0.14 5.91 58 MPART_ALT_DIFF 9717 6.00 6.62 5.64 59 BAYES_999 9695 14.75 30.61 5.63 60 T_TooManySym_02 9380 3.76 0.82 5.44 61 TR_XM_SpammyWords4 9179 7.19 10.43 5.33 62 BAYES_80 9131 6.45 8.45 5.30 63 XMSexyCombo_05 8894 7.38 11.24 5.16 64 XMNumbers 8757 4.29 2.92 5.08 65 RCVD_IN_MSPIKE_H4 8743 4.23 2.77 5.07 66 XM_SendGrid 8712 5.96 7.53 5.06 67 XM_B_SpammyWords3 8309 7.74 12.80 4.82 68 XM_UncommonTLD01 8277 5.83 7.61 4.80 69 XM_H_Long_From01 8031 5.59 7.20 4.66 70 BAYES_40 7117 3.09 1.28 4.13 71 INVALID_MSGID 7019 2.76 0.49 4.07 72 XMSubMetaSx_00 6919 4.44 5.19 4.02 73 FSL_BULK_SIG 6822 6.88 11.94 3.96 74 TR_XM_Base64_M2 6762 4.73 6.13 3.92 75 FROM_EXCESS_BASE64 6234 3.21 2.50 3.62 76 RELAYCOUNTRY_META 6034 9.50 19.93 3.50 77 MIME_QP_LONG_LINE 5979 2.96 2.06 3.47 78 XM_H_Trusted_IP 5949 2.19 0.00 3.45 79 TO_MALFORMED 5930 2.19 0.02 3.44 80 TR_XM_DK_SendGrid 5872 4.00 5.02 3.41 81 MIME_HTML_ONLY_MULTI 5780 3.05 2.51 3.35 82 TVD_RCVD_IP 5594 2.19 0.35 3.25 83 BAYES_95 5556 4.00 5.35 3.22 84 T_REMOTE_IMAGE 5452 3.80 4.90 3.16 85 RCVD_IN_IADB_LISTED 5389 2.59 1.65 3.13 86 BOUNCE_MESSAGE 5344 2.30 0.91 3.10 87 ANY_BOUNCE_MESSAGE 5344 2.30 0.91 3.10 88 TR_XM_Base64_C 5321 5.01 8.36 3.09 89 BAYES_20 5165 2.19 0.80 3.00 90 MIME_HTML_MOSTLY 5103 3.15 3.47 2.96 91 RCVD_IN_IADB_SPF 4920 2.31 1.37 2.86 92 TM2_M_URI_OPT_OUT 4818 2.60 2.25 2.80 93 TR_DCC_Bayes_99 4575 11.47 26.79 2.66 94 XMStockSpam_06 4559 2.25 1.57 2.65 95 RCVD_IN_IADB_SENDERID 4485 2.11 1.25 2.60 96 RCVD_IN_IADB_DK 4319 2.05 1.25 2.51 97 XMBSHREFv2 4199 1.62 0.19 2.44 98 MAILING_LIST_MULTI 4006 1.99 1.41 2.33 99 XM_B_Phish_Phrases 3898 3.34 5.20 2.26 100 IN_HORDE_ADDRESS_BOOK 3867 1.47 0.11 2.24 101 TR_XM_PhishingBody 3856 3.93 6.86 2.24 102 HTML_IMAGE_RATIO_08 3855 2.36 2.56 2.24 103 XM_PDF 3847 1.61 0.52 2.23 104 XMDiploma_00 3804 2.41 2.77 2.21 105 T_XMDrugObfuBody_14 3359 2.86 4.43 1.95 106 TR_XM_SpammyWords2 3316 6.21 13.65 1.92 107 BAYES_05 3278 1.37 0.45 1.90 108 RCVD_IN_IADB_VOUCHED 3275 1.58 1.02 1.90 109 TR_XM_SpammyRelay 3254 6.13 13.49 1.89 110 TVD_SPACE_RATIO 3215 1.22 0.11 1.87 111 XM_CamelCaseFrm001 3211 2.79 4.39 1.86 112 TR_XM_SB_Phish 3082 1.71 1.58 1.79 113 XMSubPhish11 3059 1.64 1.41 1.78 114 XM_B_SpammyTLD 2973 2.54 3.95 1.73 115 URI_NOVOWEL 2970 1.97 2.40 1.72 116 XMGappySubj_01 2895 1.10 0.09 1.68 117 TR_MetaPhish_Combo_01 2878 1.34 0.78 1.67 118 BOTNET 2678 5.23 11.62 1.55 119 DKIM_INVALID 2653 1.68 1.92 1.54 120 TR_XM_Base64_L2 2561 4.28 9.13 1.49 121 HTML_MIME_NO_HTML_TAG 2545 1.45 1.42 1.48 122 UNTRUSTED_Relay 2491 3.97 8.35 1.45 123 XM_GoogleGroups 2460 1.12 0.57 1.43 124 URI_HEX 2456 1.53 1.71 1.43 125 HTML_FONT_FACE_BAD 2454 1.16 0.71 1.42 126 TM2_M_VERY_LONG_WORD 2434 2.35 3.98 1.41 127 RCVD_IN_RP_SAFE 2380 1.29 1.14 1.38 128 XMBdyGiftCard01 2380 1.67 2.17 1.38 129 TooManyTo_002 2369 0.99 0.32 1.37 130 MSGID_NOFQDN1 2340 0.89 0.07 1.36 131 RCVD_IN_IADB_OPTIN 2268 1.09 0.69 1.32 132 TR_XM_SpammyWords5 2247 2.17 3.66 1.30 133 XM_DK_Undo_01 2241 1.52 1.91 1.30 134 XM_H_Long_From02 2235 1.17 0.94 1.30 135 RELAYCOUNTRY_CA 2231 4.30 9.51 1.29 136 RCVD_IN_RP_CERTIFIED 2152 1.11 0.86 1.25 137 T_TooManySym_03 2140 0.87 0.24 1.24 138 TR_Symld_Words 2128 1.31 1.45 1.24 139 XM_B_Investor 2110 2.29 4.14 1.22 140 XMSubNoVowel 2065 1.72 2.61 1.20 141 XM_RXBody 2032 0.96 0.59 1.18 142 XM_SPF_SoftFail 2015 2.30 4.26 1.17 143 T_XMDrugObfuBody_08 1990 1.85 3.05 1.16 144 XMGenDplmaNmb 1876 1.16 1.30 1.09 145 SUBJ_ALL_CAPS 1843 1.44 2.09 1.07 146 TooManyTo_003 1678 0.72 0.28 0.97 147 XM_B_COPY_HTML 1673 0.89 0.76 0.97 148 T_MANY_PILL_PRICE 1670 0.64 0.07 0.97 149 DKIM_ADSP_CUSTOM_MED 1638 1.09 1.34 0.95 150 XMBody_95 1598 0.65 0.16 0.93 151 XM_B_Phish66 1531 1.92 3.71 0.89 152 XM_B_SpammyWords4 1515 1.39 2.29 0.88 153 XM_OfRef6 1485 1.68 3.10 0.86 154 MPART_ALT_DIFF_COUNT 1479 1.18 1.73 0.86 155 HTML_IMAGE_ONLY_20 1478 1.02 1.30 0.86 156 XM_UB50 1447 1.94 3.85 0.84 157 RCVD_IN_BL_SPAMCOP_NET 1437 5.59 13.84 0.83 158 XMPhish30 1383 1.01 1.38 0.80 159 XM_H_PHPMailer 1371 0.91 1.12 0.80 160 XMSubMetaSxObfu_02 1367 0.66 0.42 0.79 161 TooManyTo_004 1350 0.58 0.24 0.78 162 KHOP_HELO_FCRDNS 1346 1.07 1.57 0.78 163 XMHTMLBadTable_001 1314 0.87 1.05 0.76 164 RCVD_IN_MSPIKE_H5 1280 0.53 0.17 0.74 165 TR_XM_Base64_M3 1269 0.87 1.10 0.74 166 XM_B_Unsub2 1212 1.27 2.26 0.70 167 USER_IN_WELCOMELIST 1174 0.43 0.00 0.68 168 USER_IN_WHITELIST 1174 0.43 0.00 0.68 169 TooManyTo_005 1173 0.51 0.22 0.68 170 RCVD_IN_MSPIKE_BL 1132 2.44 5.53 0.66 171 TR_XM_MSPIKECOMBO 1126 2.34 5.26 0.65 172 XMLngstWrd_00 1126 0.77 0.97 0.65 173 XM_S_SubURI 1067 0.41 0.04 0.62 174 T_XMHurry_00 1061 1.21 2.25 0.62 175 BASE64_LENGTH_79_INF 1053 1.01 1.71 0.61 176 DATE_IN_PAST_03_06 1050 0.54 0.42 0.61 177 XM_ProductURIs 1041 0.66 0.75 0.60 178 T_XMDrugObfuBody_00 1032 0.91 1.45 0.60 179 RDNS_DYNAMIC 1032 0.60 0.60 0.60 180 NML_ADSP_CUSTOM_MED 1025 0.81 1.19 0.59 181 XMLngstWrd_01 994 0.69 0.90 0.58 182 FORGED_GMAIL_RCVD 965 0.80 1.23 0.56 183 XM_B_REG_HTML 950 0.71 0.97 0.55 184 HTML_TAG_BALANCE_BODY 949 1.09 2.02 0.55 185 T_FILL_THIS_FORM_SHORT 947 1.58 3.38 0.55 186 XMBrknScrpt_02 933 0.98 1.73 0.54 187 XMHTML_After_End 916 0.76 1.15 0.53 188 T_TooManySym_04 915 0.40 0.18 0.53 189 HELO_NODOT 912 0.56 0.62 0.53 190 HELO_NO_DOMAIN 912 0.56 0.62 0.53 191 HTTPS_HTTP_MISMATCH 880 0.82 1.36 0.51 192 TVD_SPACE_RATIO_MINFP 878 0.42 0.26 0.51 193 PLING_QUERY 859 0.67 0.98 0.50 194 NUMERIC_HTTP_ADDR 856 0.45 0.37 0.50 195 XMSexyCombo_01 815 0.88 1.58 0.47 196 XMLngstWrd_02 808 0.60 0.82 0.47 197 DIET_1 803 0.87 1.58 0.47 198 XMCapTrack 790 0.37 0.21 0.46 199 RELAYCOUNTRY_GB 773 0.51 0.60 0.45 200 XMBody_17 772 1.28 2.72 0.45 ----------------------------------------------------------------------