Email: 300522 Autolearn: 0 AvgScore: 2.75 AvgScanTime: 1.32 sec Spam: 88649 Autolearn: 0 AvgScore: 14.18 AvgScanTime: 1.43 sec Ham: 211873 Autolearn: 0 AvgScore: -2.04 AvgScanTime: 1.27 sec Time Spent Running SA: 110.19 hours Time Spent Processing Spam: 35.24 hours Time Spent Processing Ham: 74.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84410 86.95 95.22 83.49 2 DKIM_SIGNED 75375 74.49 85.03 70.09 3 XM_DK_Pass 73045 72.62 82.40 68.53 4 DKIM_VALID 71171 71.01 80.28 67.13 5 RELAYCOUNTRY_US 67747 77.26 76.42 77.61 6 XM_B_Unicode 67182 71.38 75.78 69.54 7 XMListUnsubscribeExists 62374 55.32 70.36 49.03 8 XM_B_SpammyWords 62230 53.54 70.20 46.57 9 DCC_CHECK 59799 43.70 67.46 33.77 10 DKIM_VALID_AU 53813 55.59 60.70 53.46 11 XM_DK_Undo_02 44733 21.68 50.46 9.64 12 TR_XM_DKIM_Undo 35956 16.69 40.56 6.71 13 BAYES_99 35822 17.65 40.41 8.13 14 XM_B_Unicode3 35717 41.39 40.29 41.85 15 XM_B_SpammyWords2 31071 24.21 35.05 19.68 16 BAYES_50 30259 46.17 34.13 51.21 17 LOC_TINY_FONT_1 30098 27.94 33.95 25.42 18 BAYES_999 29693 14.75 33.50 6.91 19 DCC_CHECK_NEGATIVE 28813 56.27 32.50 66.21 20 HTML_FONT_LOW_CONTRAST 27790 28.32 31.35 27.05 21 MIME_HTML_ONLY 26737 26.62 30.16 25.14 22 T_KAM_HTML_FONT_INVALID 26597 20.76 30.00 16.90 23 TR_DCC_Bayes_99 26258 10.71 29.62 2.80 24 DKIM_VALID_EF 25509 26.89 28.78 26.10 25 FVGT_m_MULTI_ODD 23095 22.97 26.05 21.68 26 XM_Body_Dirty_Words 22910 17.39 25.84 13.85 27 RCVD_IN_MSPIKE_WL 21945 27.36 24.75 28.46 28 XMSubLong 21655 22.34 24.43 21.47 29 RELAYCOUNTRY_META 20762 8.87 23.42 2.78 30 T_TM2_M_HEADER_IN_MSG 18535 21.09 20.91 21.17 31 RCVD_IN_MSPIKE_H2 17039 18.12 19.22 17.65 32 BOTNET 14142 5.84 15.95 1.61 33 XMSexyCombo_05 13999 7.22 15.79 3.64 34 XM_UncommonTLD01 13968 7.57 15.76 4.15 35 XMSubMetaSx_00 13339 8.76 15.05 6.12 36 UNTRUSTED_Relay 12997 5.06 14.66 1.04 37 RCVD_IN_MSPIKE_H4 12963 13.34 14.62 12.80 38 XM_B_Unsub 12834 14.78 14.48 14.91 39 TR_XM_SpammyWords2 12806 5.43 14.45 1.66 40 XM_Multi_Part_URI 12508 13.22 14.11 12.85 41 TR_XM_SpammyRelay 12434 5.02 14.03 1.25 42 UNPARSEABLE_RELAY 11363 9.86 12.82 8.62 43 TR_XM_UnparsRelay 11075 8.61 12.49 6.99 44 LOTS_OF_MONEY 10947 9.02 12.35 7.63 45 BOTNET_IPINHOSTNAME 10076 7.23 11.37 5.50 46 TR_XM_SpammyWords4 9696 6.30 10.94 4.36 47 MPART_ALT_DIFF 9556 9.77 10.78 9.35 48 XM_B_SpammyWords3 8941 7.06 10.09 5.79 49 RCVD_IN_MSPIKE_H3 8503 12.35 9.59 13.50 50 RCVD_IN_BL_SPAMCOP_NET 8397 3.57 9.47 1.10 51 XM_SendGrid 7882 7.33 8.89 6.67 52 MIME_HTML_MOSTLY 7845 4.39 8.85 2.53 53 HTML_IMAGE_RATIO_02 7161 7.33 8.08 7.01 54 URI_NOVOWEL 7087 4.19 7.99 2.60 55 TR_XM_SpammyWords5 6969 3.39 7.86 1.52 56 FSL_BULK_SIG 6942 4.88 7.83 3.64 57 TR_XM_MaxUnsub 6904 3.43 7.79 1.60 58 BAYES_60 6860 10.04 7.74 11.00 59 BAYES_80 6701 5.77 7.56 5.02 60 XM_Evil_Numbers_Gen 6254 7.49 7.05 7.68 61 XM_UB50 5957 2.46 6.72 0.68 62 HTML_MIME_NO_HTML_TAG 5791 3.17 6.53 1.77 63 TooManyTo_001 5581 8.34 6.30 9.19 64 SpammyFromTLD_01 5533 2.11 6.24 0.38 65 XMNumbers 5486 4.97 6.19 4.47 66 RCVD_IN_MSPIKE_BL 5250 2.45 5.92 1.00 67 TR_XM_MSPIKECOMBO 5240 2.45 5.91 1.00 68 RELAYCOUNTRY_CA 5151 2.32 5.81 0.86 69 TR_XM_DK_SendGrid 4927 4.80 5.56 4.48 70 HTML_SHORT_LINK_IMG_1 4914 1.64 5.54 0.01 71 HTML_FONT_SIZE_LARGE 4802 1.67 5.42 0.10 72 HTML_IMAGE_ONLY_04 4748 1.60 5.36 0.03 73 JH_SPAMMY_HEADERS 4726 1.57 5.33 0.00 74 BODY_URI_ONLY 4709 1.57 5.31 0.01 75 GOOG_STO_IMG_HTML 4672 1.56 5.27 0.00 76 HTML_SHORT_CENTER 4660 1.55 5.26 0.01 77 LotsOfNums_01 4653 7.77 5.25 8.83 78 XM_SPF_SoftFail 4610 2.41 5.20 1.24 79 SUBJ_ALL_CAPS 4599 2.45 5.19 1.30 80 TR_XM_PhishingBody 4469 3.22 5.04 2.46 81 XMBody_17 4337 1.87 4.89 0.61 82 TR_XM_SPAMCOP 4270 1.69 4.82 0.38 83 XM_B_Phish_Phrases 4215 3.92 4.75 3.58 84 DKIM_INVALID 4204 3.48 4.74 2.95 85 TM2_M_URI_OPT_OUT 4201 8.63 4.74 10.26 86 RCVD_IN_VALIDITY_SAFE 3985 5.62 4.50 6.09 87 T_FILL_THIS_FORM_SHORT 3709 1.86 4.18 0.88 88 XMStrtUSub 3690 4.45 4.16 4.57 89 MIME_QP_LONG_LINE 3637 5.79 4.10 6.50 90 HTML_IMAGE_RATIO_04 3459 4.77 3.90 5.13 91 XMSexyCombo_01 3446 2.77 3.89 2.30 92 BAYES_95 3294 3.30 3.72 3.13 93 XM_H_Long_From01 3203 4.57 3.61 4.97 94 XM_OfRef6 3174 1.55 3.58 0.70 95 TR_XM_FormFill 3057 1.20 3.45 0.26 96 TR_XM_SpammyWords3 3017 1.34 3.40 0.47 97 XM_DIRTYINTL 2988 1.18 3.37 0.27 98 RCVD_IN_MSPIKE_L3 2982 1.31 3.36 0.45 99 RCVD_IN_VALIDITY_CERTIFIED 2975 4.92 3.36 5.57 100 T_XMDrugObfuBody_08 2946 1.95 3.32 1.37 101 ANY_BOUNCE_MESSAGE 2887 4.11 3.26 4.47 102 BOUNCE_MESSAGE 2885 4.11 3.25 4.47 103 SpammyFromTLD_02 2880 1.07 3.25 0.15 104 TR_Mismatch_TLD_02 2842 1.01 3.21 0.10 105 T_XMDrugObfuBody_14 2781 2.98 3.14 2.91 106 TR_Caps_n_Bayes_99 2774 1.07 3.13 0.20 107 URIBL_DBL_SPAM 2771 0.93 3.13 0.01 108 ALL_TRUSTED 2694 15.19 3.04 20.27 109 RELAYCOUNTRY_RU 2554 0.86 2.88 0.02 110 XMBounce_01 2481 0.84 2.80 0.01 111 XM_UB60 2444 0.86 2.76 0.06 112 XM_B_SpammyTLD 2443 2.06 2.76 1.77 113 HTML_IMAGE_RATIO_06 2434 3.52 2.75 3.84 114 XMBounce_02 2423 0.81 2.73 0.01 115 RELAYCOUNTRY_UA 2364 0.79 2.67 0.01 116 TM2_M_VERY_LONG_WORD 2349 1.78 2.65 1.42 117 FROM_NO_USER 2327 0.78 2.62 0.01 118 MIME_HTML_ONLY_MULTI 2297 5.97 2.59 7.38 119 XM_B_Phish66 2271 1.70 2.56 1.33 120 BAYES_40 2179 3.30 2.46 3.65 121 USER_IN_DEF_DKIM_WL 2172 11.22 2.45 14.90 122 RELAYCOUNTRY_FR 2111 0.81 2.38 0.16 123 XM_B_Investor 2054 1.57 2.32 1.26 124 XMDiploma_00 1998 1.52 2.25 1.21 125 RCVD_IN_VALIDITY_RPBL 1970 0.71 2.22 0.08 126 FROM_EXCESS_BASE64 1914 2.94 2.16 3.27 127 XMSubMetaSSx_00 1871 0.87 2.11 0.35 128 TR_XM_PHPDW 1861 0.86 2.10 0.33 129 FONT_INVIS_LONG_LINE 1825 0.66 2.06 0.08 130 T_TooManySym_01 1782 5.50 2.01 6.95 131 TR_XM_PHPForged 1757 0.77 1.98 0.26 132 BAYES_20 1747 2.83 1.97 3.19 133 TR_XM_FormFill2 1729 0.76 1.95 0.26 134 URI_LONG_REPEAT 1722 0.57 1.94 0.00 135 XM_H_PHPOS 1714 0.74 1.93 0.25 136 RCVD_IN_IADB_LISTED 1707 3.77 1.93 4.54 137 XM_CamelCaseFrm001 1685 1.84 1.90 1.81 138 XM_DK_Undo_01 1680 1.55 1.90 1.40 139 T_XMDrugObfuBody_00 1671 1.09 1.88 0.76 140 BOTNET_NORDNS 1625 0.55 1.83 0.02 141 TR_XM_BayesRelay 1624 0.54 1.83 0.00 142 TR_XM_INV_DKIM 1609 0.89 1.82 0.50 143 TR_XM_SB_Phish 1597 3.55 1.80 4.29 144 T_XMHurry_00 1590 1.07 1.79 0.76 145 XM_Body_Dirty_Words_01 1534 0.66 1.73 0.21 146 KHOP_HELO_FCRDNS 1526 1.15 1.72 0.91 147 XM_UB99 1454 0.48 1.64 0.00 148 XMSubPhish11 1411 3.46 1.59 4.24 149 XMSpecificSbj 1410 0.47 1.59 0.00 150 TR_LOTS_OF_MONEY3 1404 0.58 1.58 0.15 151 XM_B_SpammyWords4 1401 0.97 1.58 0.71 152 T_REMOTE_IMAGE 1396 2.83 1.57 3.35 153 HTML_IMAGE_RATIO_08 1395 1.82 1.57 1.92 154 TR_Symld_Words 1393 1.78 1.57 1.87 155 SHORT_URI_2 1387 1.75 1.56 1.82 156 XMStockSpam_06 1371 1.08 1.55 0.89 157 XMBrknScrpt_02 1343 1.09 1.51 0.91 158 RCVD_IN_IADB_SPF 1336 3.18 1.51 3.89 159 RCVD_IN_MSPIKE_L5 1332 0.61 1.50 0.24 160 XMBdyGiftCard01 1324 1.17 1.49 1.04 161 URI_HEX 1312 1.36 1.48 1.30 162 XM_B_COVIDMETA 1307 0.70 1.47 0.38 163 XM_B_Unsub2 1286 1.27 1.45 1.19 164 XM_UB80 1252 0.43 1.41 0.01 165 FROM_SUSPICIOUS_NTLD 1238 0.45 1.40 0.06 166 FROM_SUSPICIOUS_NTLD_FP 1203 0.44 1.36 0.06 167 RCVD_IN_IADB_DK 1196 2.70 1.35 3.26 168 RCVD_IN_IADB_SENDERID 1189 2.80 1.34 3.42 169 BAYES_00 1188 9.51 1.34 12.93 170 TR_XM_NoHeaderRelay 1187 0.50 1.34 0.15 171 PLING_QUERY 1135 0.64 1.28 0.38 172 RCVD_IN_IADB_VOUCHED 1121 2.55 1.26 3.09 173 DIET_1 1119 0.68 1.26 0.44 174 XM_UB999 1099 0.37 1.24 0.00 175 RELAYCOUNTRY_AU 1094 0.49 1.23 0.18 176 XMSexyCombo_02 1092 0.48 1.23 0.17 177 RELAYCOUNTRY_PL 1076 0.38 1.21 0.04 178 TR_Mismatch_TLD_01 1059 0.61 1.19 0.37 179 XM_URI_RBL 1057 0.47 1.19 0.17 180 HTML_TAG_BALANCE_BODY 1020 0.71 1.15 0.52 181 RELAYCOUNTRY_SG 997 0.35 1.12 0.03 182 MONEY_NOHTML 997 0.38 1.12 0.07 183 LongTLD 994 0.42 1.12 0.12 184 XM_ProductURIs 987 0.78 1.11 0.65 185 TR_XM_RelayPhish 973 0.35 1.10 0.04 186 RCVD_IN_RP_SAFE 954 1.15 1.08 1.18 187 XM_H_PHPMailer 951 0.68 1.07 0.52 188 XM_OfRef7 951 0.36 1.07 0.06 189 XMHTMLBadTable_001 938 0.71 1.06 0.57 190 URIBL_BLACK 937 0.33 1.06 0.02 191 PDS_OTHER_BAD_TLD 936 0.54 1.06 0.32 192 RCVD_IN_MSPIKE_L4 926 0.53 1.04 0.31 193 TM2_M_A_HREF_HREF 925 0.78 1.04 0.67 194 RCVD_IN_PSBL 911 0.43 1.03 0.18 195 XMPhish30 902 0.74 1.02 0.63 196 RELAYCOUNTRY_CN 891 0.34 1.01 0.06 197 HK_RANDOM_REPLYTO 887 0.33 1.00 0.05 198 XMPhish08 884 0.41 1.00 0.17 199 TR_XM_MaxSPIKE 866 0.34 0.98 0.07 200 URI_PHP_REDIR 866 0.29 0.98 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176895 86.95 95.22 83.49 2 RELAYCOUNTRY_US 164435 77.26 76.42 77.61 3 DKIM_SIGNED 148494 74.49 85.03 70.09 4 XM_B_Unicode 147332 71.38 75.78 69.54 5 XM_DK_Pass 145204 72.62 82.40 68.53 6 DKIM_VALID 142239 71.01 80.28 67.13 7 DCC_CHECK_NEGATIVE 140282 56.27 32.50 66.21 8 DKIM_VALID_AU 113261 55.59 60.70 53.46 9 BAYES_50 108491 46.17 34.13 51.21 10 XMListUnsubscribeExists 103874 55.32 70.36 49.03 11 XM_B_SpammyWords 98672 53.54 70.20 46.57 12 XM_B_Unicode3 88677 41.39 40.29 41.85 13 DCC_CHECK 71542 43.70 67.46 33.77 14 RCVD_IN_MSPIKE_WL 60291 27.36 24.75 28.46 15 HTML_FONT_LOW_CONTRAST 57320 28.32 31.35 27.05 16 DKIM_VALID_EF 55306 26.89 28.78 26.10 17 LOC_TINY_FONT_1 53857 27.94 33.95 25.42 18 MIME_HTML_ONLY 53266 26.62 30.16 25.14 19 FVGT_m_MULTI_ODD 45931 22.97 26.05 21.68 20 XMSubLong 45490 22.34 24.43 21.47 21 T_TM2_M_HEADER_IN_MSG 44859 21.09 20.91 21.17 22 ALL_TRUSTED 42944 15.19 3.04 20.27 23 XM_B_SpammyWords2 41694 24.21 35.05 19.68 24 RCVD_IN_MSPIKE_H2 37403 18.12 19.22 17.65 25 T_KAM_HTML_FONT_INVALID 35797 20.76 30.00 16.90 26 XM_B_Unsub 31582 14.78 14.48 14.91 27 USER_IN_DEF_DKIM_WL 31559 11.22 2.45 14.90 28 XM_Body_Dirty_Words 29348 17.39 25.84 13.85 29 RCVD_IN_MSPIKE_H3 28613 12.35 9.59 13.50 30 BAYES_00 27402 9.51 1.34 12.93 31 XM_Multi_Part_URI 27230 13.22 14.11 12.85 32 RCVD_IN_MSPIKE_H4 27130 13.34 14.62 12.80 33 BAYES_60 23313 10.04 7.74 11.00 34 TM2_M_URI_OPT_OUT 21730 8.63 4.74 10.26 35 XM_DK_Undo_02 20420 21.68 50.46 9.64 36 XM_DKIMWhitelistDomains 20331 6.77 0.02 9.60 37 MPART_ALT_DIFF 19807 9.77 10.78 9.35 38 TooManyTo_001 19480 8.34 6.30 9.19 39 LotsOfNums_01 18702 7.77 5.25 8.83 40 UNPARSEABLE_RELAY 18256 9.86 12.82 8.62 41 BAYES_99 17234 17.65 40.41 8.13 42 XM_Evil_Numbers_Gen 16269 7.49 7.05 7.68 43 LOTS_OF_MONEY 16165 9.02 12.35 7.63 44 MIME_HTML_ONLY_MULTI 15636 5.97 2.59 7.38 45 HTML_IMAGE_RATIO_02 14856 7.33 8.08 7.01 46 TR_XM_UnparsRelay 14807 8.61 12.49 6.99 47 T_TooManySym_01 14735 5.50 2.01 6.95 48 BAYES_999 14645 14.75 33.50 6.91 49 TR_XM_DKIM_Undo 14213 16.69 40.56 6.71 50 XM_SendGrid 14142 7.33 8.89 6.67 51 XM_H_Trusted_IP 14127 4.70 0.00 6.67 52 MIME_QP_LONG_LINE 13772 5.79 4.10 6.50 53 TR_XM_DK_Bayes 13261 4.59 0.60 6.26 54 XMSubMetaSx_00 12976 8.76 15.05 6.12 55 TR_XM_DK_Bayes1 12952 4.48 0.59 6.11 56 RCVD_IN_VALIDITY_SAFE 12897 5.62 4.50 6.09 57 XM_B_SpammyWords3 12266 7.06 10.09 5.79 58 RCVD_IN_VALIDITY_CERTIFIED 11800 4.92 3.36 5.57 59 BOTNET_IPINHOSTNAME 11655 7.23 11.37 5.50 60 TR_XM_DK_Bayes2 11615 4.02 0.54 5.48 61 IN_ZIMBRA_NJ_WHITELIST 11272 3.77 0.05 5.32 62 HTML_IMAGE_RATIO_04 10865 4.77 3.90 5.13 63 BAYES_80 10639 5.77 7.56 5.02 64 XM_H_Long_From01 10539 4.57 3.61 4.97 65 T_TooManySym_02 9771 3.39 0.47 4.61 66 XMStrtUSub 9688 4.45 4.16 4.57 67 RCVD_IN_IADB_LISTED 9627 3.77 1.93 4.54 68 TR_XM_DK_SendGrid 9501 4.80 5.56 4.48 69 ANY_BOUNCE_MESSAGE 9465 4.11 3.26 4.47 70 BOUNCE_MESSAGE 9465 4.11 3.25 4.47 71 XMNumbers 9461 4.97 6.19 4.47 72 TR_XM_SpammyWords4 9241 6.30 10.94 4.36 73 TR_XM_SB_Phish 9083 3.55 1.80 4.29 74 XMSubPhish11 8990 3.46 1.59 4.24 75 XM_UncommonTLD01 8788 7.57 15.76 4.15 76 RCVD_IN_IADB_SPF 8235 3.18 1.51 3.89 77 HTML_IMAGE_RATIO_06 8141 3.52 2.75 3.84 78 BAYES_40 7741 3.30 2.46 3.65 79 XMSexyCombo_05 7711 7.22 15.79 3.64 80 FSL_BULK_SIG 7711 4.88 7.83 3.64 81 XM_B_Phish_Phrases 7577 3.92 4.75 3.58 82 INVALID_MSGID 7410 2.50 0.12 3.50 83 RCVD_IN_IADB_SENDERID 7236 2.80 1.34 3.42 84 T_REMOTE_IMAGE 7103 2.83 1.57 3.35 85 MSGID_NOFQDN1 7058 2.36 0.04 3.33 86 FROM_EXCESS_BASE64 6924 2.94 2.16 3.27 87 RCVD_IN_IADB_DK 6911 2.70 1.35 3.26 88 BAYES_20 6764 2.83 1.97 3.19 89 BAYES_95 6633 3.30 3.72 3.13 90 RCVD_IN_IADB_VOUCHED 6553 2.55 1.26 3.09 91 DKIM_INVALID 6255 3.48 4.74 2.95 92 T_XMDrugObfuBody_14 6170 2.98 3.14 2.91 93 TO_MALFORMED 6134 2.04 0.00 2.90 94 TR_DCC_Bayes_99 5931 10.71 29.62 2.80 95 RELAYCOUNTRY_META 5881 8.87 23.42 2.78 96 URI_NOVOWEL 5515 4.19 7.99 2.60 97 MIME_HTML_MOSTLY 5351 4.39 8.85 2.53 98 XM_PDF 5304 1.85 0.28 2.50 99 TR_XM_PhishingBody 5206 3.22 5.04 2.46 100 TVD_RCVD_IP 4966 1.73 0.27 2.34 101 XMSexyCombo_01 4866 2.77 3.89 2.30 102 RCVD_IN_MSPIKE_H5 4548 1.67 0.54 2.15 103 IN_HORDE_ADDRESS_BOOK 4528 1.53 0.07 2.14 104 XMSubNoVowel 4478 1.70 0.71 2.11 105 MAILING_LIST_MULTI 4271 1.70 0.94 2.02 106 RCVD_IN_IADB_OPTIN 4235 1.62 0.73 2.00 107 HTML_IMAGE_RATIO_08 4071 1.82 1.57 1.92 108 TR_Symld_Words 3969 1.78 1.57 1.87 109 SHORT_URI_2 3860 1.75 1.56 1.82 110 XM_CamelCaseFrm001 3841 1.84 1.90 1.81 111 XM_B_SpammyTLD 3750 2.06 2.76 1.77 112 HTML_MIME_NO_HTML_TAG 3747 3.17 6.53 1.77 113 BAYES_05 3650 1.40 0.61 1.72 114 TR_XM_SpammyWords2 3524 5.43 14.45 1.66 115 XMBSHREFv2 3413 1.24 0.35 1.61 116 BOTNET 3408 5.84 15.95 1.61 117 TR_XM_MaxUnsub 3396 3.43 7.79 1.60 118 TooManyTo_002 3345 1.23 0.40 1.58 119 TVD_SPACE_RATIO 3233 1.11 0.10 1.53 120 TR_XM_SpammyWords5 3216 3.39 7.86 1.52 121 TM2_M_VERY_LONG_WORD 3004 1.78 2.65 1.42 122 XM_DK_Undo_01 2964 1.55 1.90 1.40 123 XMGappySubj_01 2926 1.03 0.20 1.38 124 T_XMDrugObfuBody_08 2911 1.95 3.32 1.37 125 XM_B_Phish66 2828 1.70 2.56 1.33 126 URI_HEX 2762 1.36 1.48 1.30 127 SUBJ_ALL_CAPS 2761 2.45 5.19 1.30 128 XM_B_Investor 2661 1.57 2.32 1.26 129 TR_XM_SpammyRelay 2657 5.02 14.03 1.25 130 XM_SPF_SoftFail 2632 2.41 5.20 1.24 131 XMDiploma_00 2565 1.52 2.25 1.21 132 TooManyTo_003 2540 0.94 0.34 1.20 133 XM_B_Unsub2 2527 1.27 1.45 1.19 134 RCVD_IN_RP_SAFE 2504 1.15 1.08 1.18 135 XM_GoogleGroups 2331 0.98 0.70 1.10 136 RCVD_IN_BL_SPAMCOP_NET 2327 3.57 9.47 1.10 137 RCVD_IN_RP_CERTIFIED 2312 1.01 0.81 1.09 138 HTML_IMAGE_ONLY_20 2276 0.84 0.30 1.07 139 XM_H_Long_From02 2248 0.96 0.73 1.06 140 UNTRUSTED_Relay 2213 5.06 14.66 1.04 141 XMBdyGiftCard01 2202 1.17 1.49 1.04 142 T_TooManySym_03 2146 0.74 0.10 1.01 143 XMBody_95 2123 0.75 0.14 1.00 144 RCVD_IN_MSPIKE_BL 2115 2.45 5.92 1.00 145 TR_XM_MSPIKECOMBO 2113 2.45 5.91 1.00 146 XMBrknScrpt_02 1938 1.09 1.51 0.91 147 SHORT_URI_3 1934 0.85 0.69 0.91 148 KHOP_HELO_FCRDNS 1929 1.15 1.72 0.91 149 XMStockSpam_06 1876 1.08 1.55 0.89 150 HTML_FONT_FACE_BAD 1875 0.78 0.52 0.88 151 T_FILL_THIS_FORM_SHORT 1873 1.86 4.18 0.88 152 RELAYCOUNTRY_CA 1831 2.32 5.81 0.86 153 DKIM_ADSP_CUSTOM_MED 1758 0.83 0.83 0.83 154 TooManyTo_004 1755 0.67 0.29 0.83 155 TR_MetaPhish_Combo_01 1723 0.77 0.67 0.81 156 T_XMHurry_00 1618 1.07 1.79 0.76 157 T_XMDrugObfuBody_00 1610 1.09 1.88 0.76 158 XM_B_COPY_HTML 1540 0.78 0.90 0.73 159 XM_B_SpammyWords4 1513 0.97 1.58 0.71 160 USER_IN_WHITELIST 1497 0.50 0.00 0.71 161 USER_IN_WELCOMELIST 1497 0.50 0.00 0.71 162 XM_OfRef6 1475 1.55 3.58 0.70 163 XM_E_Blogspot 1471 0.55 0.21 0.69 164 XM_UB50 1445 2.46 6.72 0.68 165 TM2_M_A_HREF_HREF 1422 0.78 1.04 0.67 166 DKIM_ADSP_NXDOMAIN 1385 0.57 0.36 0.65 167 XM_D_tchamptons_WL 1372 0.46 0.00 0.65 168 XM_ProductURIs 1369 0.78 1.11 0.65 169 XMPhish30 1331 0.74 1.02 0.63 170 XMLngstWrd_00 1327 0.58 0.46 0.63 171 RDNS_DYNAMIC 1309 0.64 0.70 0.62 172 URI_TRY_3LD 1308 0.71 0.94 0.62 173 XMBody_17 1290 1.87 4.89 0.61 174 CTE_8BIT_MISMATCH 1237 0.41 0.01 0.58 175 XMHTMLBadTable_001 1208 0.71 1.06 0.57 176 XMLngstWrd_01 1135 0.50 0.41 0.54 177 MPART_ALT_DIFF_COUNT 1130 0.54 0.56 0.53 178 RELAYCOUNTRY_GB 1129 0.55 0.58 0.53 179 HTTPS_HTTP_MISMATCH 1115 0.57 0.67 0.53 180 XMSubMetaSxObfu_02 1112 0.52 0.51 0.52 181 NML_ADSP_CUSTOM_MED 1111 0.59 0.76 0.52 182 XMBody_78 1109 0.51 0.49 0.52 183 HTML_TAG_BALANCE_BODY 1107 0.71 1.15 0.52 184 XM_H_PHPMailer 1100 0.68 1.07 0.52 185 SHORTENED_URL_HREF 1098 0.49 0.43 0.52 186 TooManyTo_005 1076 0.44 0.27 0.51 187 TR_XM_INV_DKIM 1057 0.89 1.82 0.50 188 HELO_NODOT 1019 0.54 0.67 0.48 189 NO_DNS_FOR_FROM 999 0.50 0.56 0.47 190 TR_XM_SpammyWords3 995 1.34 3.40 0.47 191 FORGED_GMAIL_RCVD 992 0.51 0.62 0.47 192 XMGenDplmaNmb 982 0.58 0.86 0.46 193 XMHTML_After_End 978 0.60 0.92 0.46 194 XM_B_REG_HTML 971 0.53 0.71 0.46 195 T_Symld_Words_02 968 0.53 0.70 0.46 196 RCVD_IN_MSPIKE_L3 949 1.31 3.36 0.45 197 HELO_NO_DOMAIN 943 0.47 0.54 0.45 198 DIET_1 937 0.68 1.26 0.44 199 T_TooManySym_04 919 0.32 0.05 0.43 200 XMNoVowels 916 0.37 0.23 0.43 ----------------------------------------------------------------------