Email: 314691 Autolearn: 0 AvgScore: 5.44 AvgScanTime: 1.34 sec Spam: 109134 Autolearn: 0 AvgScore: 13.92 AvgScanTime: 1.39 sec Ham: 205557 Autolearn: 0 AvgScore: 0.94 AvgScanTime: 1.32 sec Time Spent Running SA: 117.20 hours Time Spent Processing Spam: 42.01 hours Time Spent Processing Ham: 75.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 104685 89.75 95.92 86.47 2 DKIM_SIGNED 90686 70.13 83.10 63.24 3 XM_B_Unicode 90685 74.76 83.10 70.33 4 RELAYCOUNTRY_US 90152 83.17 82.61 83.47 5 XM_DK_Pass 85327 67.74 78.19 62.19 6 DKIM_VALID 83696 66.84 76.69 61.61 7 DCC_CHECK 83015 53.18 76.07 41.04 8 XM_B_SpammyWords 77538 55.21 71.05 46.81 9 XMListUnsubscribeExists 75113 53.11 68.83 44.77 10 DKIM_VALID_AU 64102 54.44 58.74 52.17 11 XM_B_Unicode3 55384 48.89 50.75 47.91 12 LOC_TINY_FONT_1 52104 35.00 47.74 28.23 13 RCVD_IN_MSPIKE_H2 49767 36.46 45.60 31.61 14 HTML_FONT_LOW_CONTRAST 48989 44.60 44.89 44.44 15 BAYES_50 44228 57.84 40.53 67.03 16 XM_DK_Undo_02 41877 16.12 38.37 4.31 17 XM_B_SpammyWords2 41614 24.51 38.13 17.28 18 FVGT_m_MULTI_ODD 33840 26.19 31.01 23.63 19 BAYES_99 33620 12.97 30.81 3.50 20 TR_XM_DKIM_Undo 32061 11.54 29.38 2.06 21 T_KAM_HTML_FONT_INVALID 31380 20.99 28.75 16.87 22 MIME_HTML_ONLY 29389 20.71 26.93 17.40 23 DKIM_VALID_EF 29213 25.24 26.77 24.43 24 T_TM2_M_HEADER_IN_MSG 28538 31.09 26.15 33.71 25 BAYES_999 25991 10.09 23.82 2.81 26 DCC_CHECK_NEGATIVE 25629 46.64 23.48 58.93 27 TR_DCC_Bayes_99 25052 8.92 22.96 1.47 28 XMSubLong 24408 22.03 22.37 21.86 29 TR_XM_DK_Unsub 21729 14.86 19.91 12.18 30 XM_Multi_Part_URI 21008 15.33 19.25 13.25 31 UNPARSEABLE_RELAY 19960 14.32 18.29 12.22 32 RELAYCOUNTRY_META 18240 7.54 16.71 2.66 33 TR_MAX_INTL_RELAY 16933 8.63 15.52 4.98 34 XM_B_SpammyWords3 16089 8.34 14.74 4.93 35 XM_B_Unsub 14650 9.60 13.42 7.57 36 TR_XM_BayesUnsub 14161 8.38 12.98 5.94 37 TR_XM_SpammyWords2 13261 4.52 12.15 0.46 38 BOTNET 12734 4.69 11.67 0.98 39 XM_Evil_Numbers_Gen 12164 13.72 11.15 15.08 40 TR_XM_SpammyRelay 12120 4.84 11.11 1.52 41 TR_XM_UnparsRelay 11783 4.57 10.80 1.27 42 RCVD_IN_BL_SPAMCOP_NET 11361 3.87 10.41 0.40 43 LOTS_OF_MONEY 10915 6.27 10.00 4.29 44 BAYES_60 10728 7.56 9.83 6.36 45 LotsOfNums_01 10646 14.43 9.75 16.92 46 BAYES_80 10421 5.25 9.55 2.97 47 BOTNET_IPINHOSTNAME 10363 5.24 9.50 2.98 48 TR_XM_SpammyWords4 9984 5.21 9.15 3.12 49 TM2_M_VERY_LONG_WORD 9292 13.72 8.51 16.48 50 TR_XM_SPAMCOP 8723 2.88 7.99 0.17 51 FSL_BULK_SIG 8561 7.92 7.84 7.95 52 T_SCC_BODY_TEXT_LINE 8370 8.31 7.67 8.65 53 RCVD_IN_VALIDITY_RPBL 8186 2.67 7.50 0.11 54 UNTRUSTED_Relay 8179 3.47 7.49 1.34 55 RELAYCOUNTRY_CA 7437 2.97 6.81 0.93 56 XM_Body_Dirty_Words 7371 4.17 6.75 2.80 57 HTML_IMAGE_RATIO_02 7208 5.46 6.60 4.85 58 DKIM_INVALID 6990 3.29 6.40 1.64 59 XM_UncommonTLD01 6830 4.89 6.26 4.17 60 ANY_BOUNCE_MESSAGE 6676 15.71 6.12 20.80 61 BOUNCE_MESSAGE 6675 15.71 6.12 20.80 62 XMSubMetaSx_00 6295 4.23 5.77 3.41 63 XMStrtUSub 6221 5.40 5.70 5.24 64 XM_B_Phish_Phrases 6074 4.12 5.57 3.35 65 BAYES_95 6045 3.23 5.54 2.01 66 MAY_BE_FORGED 5722 11.73 5.24 15.18 67 MPART_ALT_DIFF 5599 4.14 5.13 3.61 68 XM_B_PhoneNumber 5310 4.88 4.87 4.89 69 T_XMDrugObfuBody_14 4987 2.82 4.57 1.89 70 T_REMOTE_IMAGE 4860 3.28 4.45 2.66 71 SHORT_URI_2 4856 3.76 4.45 3.39 72 HTML_IMAGE_RATIO_04 4726 4.08 4.33 3.95 73 KHOP_HELO_FCRDNS 4625 7.81 4.24 9.71 74 XM_UB50 4480 1.93 4.11 0.77 75 XM_H_GMP 4459 5.04 4.09 5.54 76 RCVD_IN_PSBL 4405 1.59 4.04 0.29 77 XM_H_Long_From01 4325 4.55 3.96 4.86 78 HTML_IMAGE_ONLY_32 4300 11.63 3.94 15.72 79 TR_XM_PhishingBody 4298 2.32 3.94 1.47 80 XM_B_Investor 4185 2.09 3.83 1.16 81 XMSexyCombo_05 4010 2.52 3.67 1.91 82 MIME_HTML_MOSTLY 3928 2.71 3.60 2.24 83 DKIM_ADSP_NXDOMAIN 3915 1.52 3.59 0.43 84 HTML_IMAGE_RATIO_06 3548 2.52 3.25 2.13 85 T_XMHurry_00 3507 1.61 3.21 0.77 86 TooManyTo_001 3414 4.26 3.13 4.86 87 NO_DNS_FOR_FROM 3365 1.33 3.08 0.40 88 TR_XM_SpammyWords5 3351 1.87 3.07 1.24 89 TR_XM_MaxWHORU 3342 1.26 3.06 0.31 90 XM_CamelCaseFrm001 3280 2.35 3.01 2.01 91 XM_B_SpammyTLD 3258 2.46 2.99 2.17 92 RCVD_IN_MSPIKE_WL 3118 3.42 2.86 3.73 93 RCVD_IN_MSPIKE_H3 3118 3.42 2.86 3.73 94 HTML_IMAGE_RATIO_08 2998 2.34 2.75 2.12 95 T_STY_INVIS_DIRECT 2905 1.31 2.66 0.59 96 XMNumbers 2903 3.16 2.66 3.43 97 DIET_1 2842 1.20 2.60 0.46 98 MIME_HTML_ONLY_MULTI 2781 2.26 2.55 2.11 99 XM_SPF_SoftFail 2776 1.42 2.54 0.82 100 XMBody_17 2776 1.22 2.54 0.52 101 TM2_M_URI_OPT_OUT 2767 1.93 2.54 1.60 102 XM_OfRef6 2744 1.45 2.51 0.89 103 XM_B_SpammyWords4 2742 1.33 2.51 0.71 104 RCVD_IN_VALIDITY_SAFE 2576 4.28 2.36 5.30 105 XM_URI_RBL 2541 1.17 2.33 0.55 106 TR_LOTS_OF_MONEY3 2536 1.09 2.32 0.43 107 MPART_ALT_DIFF_COUNT 2439 1.06 2.23 0.43 108 T_XMDrugObfuBody_08 2413 1.38 2.21 0.94 109 XMDiploma_00 2364 1.44 2.17 1.05 110 NORDNS_LOW_CONTRAST 2358 0.77 2.16 0.04 111 SpammyFromTLD_01 2352 0.97 2.16 0.35 112 RELAYCOUNTRY_RU 2335 0.75 2.14 0.02 113 TR_XM_NoHeaderRelay 2270 0.87 2.08 0.23 114 RCVD_IN_VALIDITY_CERTIFIED 2177 3.52 1.99 4.33 115 T_FILL_THIS_FORM_SHORT 2134 0.97 1.96 0.45 116 RELAYCOUNTRY_AU 2132 0.95 1.95 0.41 117 XM_B_Unsub2 2102 1.41 1.93 1.13 118 T_XMDrugObfuBody_00 2096 1.11 1.92 0.68 119 T_TooManySym_01 2068 5.28 1.89 7.08 120 XMStockSpam_06 2043 1.56 1.87 1.40 121 HTML_FONT_TINY_NORDNS 2013 0.66 1.84 0.03 122 LONG_INVISIBLE_TEXT 2013 0.75 1.84 0.16 123 SUBJ_ALL_CAPS 2010 1.25 1.84 0.94 124 XMBrknScrpt_02 2000 1.42 1.83 1.20 125 SpammyFromTLD_02 1986 0.71 1.82 0.12 126 FROM_EXCESS_BASE64 1960 2.06 1.80 2.20 127 TR_XM_INV_DKIM 1929 0.74 1.77 0.20 128 ALL_TRUSTED 1902 9.69 1.74 13.91 129 XM_H_Long_From02 1887 1.09 1.73 0.75 130 MAILING_LIST_MULTI 1811 1.90 1.66 2.03 131 XM_B_URI_Unicode 1788 1.37 1.64 1.22 132 MIME_QP_LONG_LINE 1769 2.13 1.62 2.40 133 HTML_MIME_NO_HTML_TAG 1767 1.57 1.62 1.55 134 XMBody_78 1622 0.69 1.49 0.27 135 XMSubMetaI_00 1620 0.94 1.48 0.65 136 RDNS_DYNAMIC 1608 0.62 1.47 0.17 137 BOTNET_NORDNS 1604 0.52 1.47 0.01 138 USER_IN_DEF_DKIM_WL 1597 9.91 1.46 14.40 139 BAYES_40 1575 4.41 1.44 5.98 140 AC_HTML_NONSENSE_TAGS 1493 0.51 1.37 0.06 141 XM_DIRTYINTL 1487 0.53 1.36 0.08 142 XMPhish30 1470 0.93 1.35 0.72 143 TR_MetaPhish_Combo_01 1460 0.90 1.34 0.67 144 PDS_RDNS_DYNAMIC_FP 1447 0.48 1.33 0.02 145 SHOPIFY_IMG_NOT_RCVD_SFY 1431 0.67 1.31 0.33 146 XM_B_COPY_HTML 1407 1.29 1.29 1.29 147 LongTLD 1368 0.56 1.25 0.20 148 URI_HEX 1344 0.93 1.23 0.77 149 RCVD_IN_PBL 1337 0.75 1.23 0.50 150 TVD_RCVD_IP 1328 1.01 1.22 0.90 151 XM_HighProb1 1283 0.41 1.18 0.01 152 XM_B_Phish66 1260 0.57 1.15 0.26 153 URI_TRY_3LD 1252 0.79 1.15 0.60 154 XM_UB60 1247 0.43 1.14 0.05 155 XM_B_REG_HTML 1245 0.50 1.14 0.16 156 XMSlimDrugH 1244 0.76 1.14 0.55 157 THIS_AD 1240 0.69 1.14 0.45 158 TR_XM_PHPDW 1229 0.52 1.13 0.19 159 TR_XM_PHPForged 1222 0.50 1.12 0.17 160 MIME_CHARSET_FARAWAY 1219 5.27 1.12 7.48 161 TR_XM_FormFill2 1213 0.50 1.11 0.18 162 XM_DK_Undo_01 1186 1.19 1.09 1.25 163 XM_H_PHPOS 1186 0.49 1.09 0.17 164 MultiRelay_CC 1184 0.41 1.08 0.06 165 HTML_TAG_BALANCE_BODY 1165 1.00 1.07 0.97 166 HELO_DYNAMIC_SPLIT_IP 1165 0.37 1.07 0.00 167 XMBdyGiftCard01 1165 1.08 1.07 1.09 168 URI_NOVOWEL 1163 1.26 1.07 1.36 169 XM_UB99 1135 0.36 1.04 0.00 170 BAYES_20 1102 2.53 1.01 3.34 171 XM_Sams_Club_Forge 1075 0.43 0.99 0.13 172 HTTPS_HTTP_MISMATCH 1064 0.64 0.97 0.46 173 XMClaimOffer 1061 0.46 0.97 0.18 174 CHARSET_FARAWAY_HEADER 1031 5.10 0.94 7.31 175 DKIM_ADSP_CUSTOM_MED 996 0.78 0.91 0.71 176 XMGenDplmaNmb 993 0.60 0.91 0.44 177 XMHTMLBadTable_001 987 0.42 0.90 0.17 178 XMReplyNow 975 0.41 0.89 0.15 179 XM_ProductURIs 975 0.67 0.89 0.55 180 XM_SendGrid 969 0.99 0.89 1.04 181 XMSubNoVowel 968 0.49 0.89 0.27 182 HTML_FONT_FACE_BAD 958 0.58 0.88 0.42 183 TR_Mismatch_TLD_02 924 0.33 0.85 0.05 184 XM_H_DKIM_GOOG 914 0.30 0.84 0.02 185 NO_FM_NAME_IP_HOSTN 899 0.29 0.82 0.00 186 TM2_M_A_HREF_HREF 893 0.37 0.82 0.14 187 XMSexyCombo_01 866 0.34 0.79 0.10 188 XM_B_DNDMA 843 0.49 0.77 0.35 189 NML_ADSP_CUSTOM_MED 842 0.54 0.77 0.42 190 SUSP_UTF8_WORD_SUBJ 824 0.28 0.76 0.03 191 TM2_M_OBFU_COMMENT 822 0.68 0.75 0.64 192 UNICODE_OBFU_ASC 805 0.26 0.74 0.01 193 TR_XM_InvalidRelay 794 0.26 0.73 0.00 194 RCVD_IN_XBL 768 0.25 0.70 0.01 195 TR_Mismatch_TLD_01 759 0.40 0.70 0.24 196 FORGED_GMAIL_RCVD 759 0.52 0.70 0.42 197 XM_S_SpammyWords 758 0.36 0.69 0.19 198 TR_XM_Spammywords 757 0.36 0.69 0.19 199 XMEqualsVooDoo_00 752 0.41 0.69 0.26 200 XM_GoogleGroups 752 0.91 0.69 1.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 177754 89.75 95.92 86.47 2 RELAYCOUNTRY_US 171588 83.17 82.61 83.47 3 XM_B_Unicode 144568 74.76 83.10 70.33 4 BAYES_50 137790 57.84 40.53 67.03 5 DKIM_SIGNED 130003 70.13 83.10 63.24 6 XM_DK_Pass 127846 67.74 78.19 62.19 7 DKIM_VALID 126642 66.84 76.69 61.61 8 DCC_CHECK_NEGATIVE 121136 46.64 23.48 58.93 9 DKIM_VALID_AU 107230 54.44 58.74 52.17 10 XM_B_Unicode3 98479 48.89 50.75 47.91 11 XM_B_SpammyWords 96211 55.21 71.05 46.81 12 XMListUnsubscribeExists 92026 53.11 68.83 44.77 13 HTML_FONT_LOW_CONTRAST 91356 44.60 44.89 44.44 14 DCC_CHECK 84351 53.18 76.07 41.04 15 T_TM2_M_HEADER_IN_MSG 69284 31.09 26.15 33.71 16 RCVD_IN_MSPIKE_H2 64985 36.46 45.60 31.61 17 LOC_TINY_FONT_1 58034 35.00 47.74 28.23 18 DKIM_VALID_EF 50221 25.24 26.77 24.43 19 FVGT_m_MULTI_ODD 48572 26.19 31.01 23.63 20 XMSubLong 44925 22.03 22.37 21.86 21 BOUNCE_MESSAGE 42757 15.71 6.12 20.80 22 ANY_BOUNCE_MESSAGE 42757 15.71 6.12 20.80 23 MIME_HTML_ONLY 35770 20.71 26.93 17.40 24 XM_B_SpammyWords2 35525 24.51 38.13 17.28 25 LotsOfNums_01 34776 14.43 9.75 16.92 26 T_KAM_HTML_FONT_INVALID 34678 20.99 28.75 16.87 27 TM2_M_VERY_LONG_WORD 33878 13.72 8.51 16.48 28 HTML_IMAGE_ONLY_32 32313 11.63 3.94 15.72 29 MAY_BE_FORGED 31195 11.73 5.24 15.18 30 XM_Evil_Numbers_Gen 31004 13.72 11.15 15.08 31 USER_IN_DEF_DKIM_WL 29600 9.91 1.46 14.40 32 ALL_TRUSTED 28594 9.69 1.74 13.91 33 XM_Multi_Part_URI 27233 15.33 19.25 13.25 34 UNPARSEABLE_RELAY 25118 14.32 18.29 12.22 35 TR_XM_DK_Unsub 25028 14.86 19.91 12.18 36 KHOP_HELO_FCRDNS 19954 7.81 4.24 9.71 37 T_SCC_BODY_TEXT_LINE 17778 8.31 7.67 8.65 38 FSL_BULK_SIG 16348 7.92 7.84 7.95 39 XM_B_Unsub 15559 9.60 13.42 7.57 40 MIME_CHARSET_FARAWAY 15372 5.27 1.12 7.48 41 CHARSET_FARAWAY_HEADER 15025 5.10 0.94 7.31 42 BAYES_00 14757 4.82 0.39 7.18 43 XM_DKIMWhitelistDomains 14711 4.70 0.06 7.16 44 T_TooManySym_01 14551 5.28 1.89 7.08 45 BAYES_60 13068 7.56 9.83 6.36 46 BAYES_40 12299 4.41 1.44 5.98 47 TR_XM_BayesUnsub 12216 8.38 12.98 5.94 48 TR_XM_DK_Bayes 11738 3.83 0.29 5.71 49 TR_XM_DK_Bayes1 11627 3.80 0.29 5.66 50 XM_H_GMP 11396 5.04 4.09 5.54 51 RCVD_IN_VALIDITY_SAFE 10903 4.28 2.36 5.30 52 XMStrtUSub 10766 5.40 5.70 5.24 53 TR_XM_DK_Bayes2 10274 3.34 0.21 5.00 54 TR_MAX_INTL_RELAY 10238 8.63 15.52 4.98 55 XM_B_SpammyWords3 10143 8.34 14.74 4.93 56 XM_B_PhoneNumber 10053 4.88 4.87 4.89 57 TooManyTo_001 10000 4.26 3.13 4.86 58 XM_H_Long_From01 10000 4.55 3.96 4.86 59 HTML_IMAGE_RATIO_02 9965 5.46 6.60 4.85 60 IN_ZIMBRA_NJ_WHITELIST 9248 2.98 0.11 4.50 61 RCVD_IN_VALIDITY_CERTIFIED 8907 3.52 1.99 4.33 62 XM_DK_Undo_02 8850 16.12 38.37 4.31 63 LOTS_OF_MONEY 8828 6.27 10.00 4.29 64 XM_UncommonTLD01 8571 4.89 6.26 4.17 65 HTML_IMAGE_RATIO_04 8126 4.08 4.33 3.95 66 T_TooManySym_02 7901 2.66 0.43 3.84 67 RCVD_IN_MSPIKE_H3 7657 3.42 2.86 3.73 68 RCVD_IN_MSPIKE_WL 7657 3.42 2.86 3.73 69 MPART_ALT_DIFF 7421 4.14 5.13 3.61 70 BAYES_99 7204 12.97 30.81 3.50 71 XMNumbers 7053 3.16 2.66 3.43 72 XMSubMetaSx_00 7005 4.23 5.77 3.41 73 SHORT_URI_2 6970 3.76 4.45 3.39 74 XM_B_Phish_Phrases 6877 4.12 5.57 3.35 75 BAYES_20 6858 2.53 1.01 3.34 76 INVALID_MSGID 6724 2.32 0.53 3.27 77 T_TVD_MIME_NO_HEADERS 6454 2.07 0.07 3.14 78 TR_XM_SpammyWords4 6405 5.21 9.15 3.12 79 TO_MALFORMED 6272 2.00 0.02 3.05 80 BOTNET_IPINHOSTNAME 6127 5.24 9.50 2.98 81 BAYES_80 6108 5.25 9.55 2.97 82 BAYES_999 5772 10.09 23.82 2.81 83 XM_Body_Dirty_Words 5765 4.17 6.75 2.80 84 RELAYCOUNTRY_META 5474 7.54 16.71 2.66 85 T_REMOTE_IMAGE 5458 3.28 4.45 2.66 86 MIME_QP_LONG_LINE 4943 2.13 1.62 2.40 87 MIME_HTML_MOSTLY 4613 2.71 3.60 2.24 88 FROM_EXCESS_BASE64 4522 2.06 1.80 2.20 89 XM_B_SpammyTLD 4468 2.46 2.99 2.17 90 HTML_IMAGE_RATIO_06 4371 2.52 3.25 2.13 91 HTML_IMAGE_RATIO_08 4355 2.34 2.75 2.12 92 MIME_HTML_ONLY_MULTI 4328 2.26 2.55 2.11 93 XM_PDF 4323 1.60 0.65 2.10 94 TR_XM_DKIM_Undo 4243 11.54 29.38 2.06 95 MAILING_LIST_MULTI 4183 1.90 1.66 2.03 96 XM_CamelCaseFrm001 4127 2.35 3.01 2.01 97 BAYES_95 4125 3.23 5.54 2.01 98 SHORT_URI_3 4043 1.33 0.13 1.97 99 XMSexyCombo_05 3925 2.52 3.67 1.91 100 T_XMDrugObfuBody_14 3884 2.82 4.57 1.89 101 T_TooManySym_03 3537 1.17 0.14 1.72 102 RCVD_IN_IADB_LISTED 3502 1.29 0.51 1.70 103 TooManyTo_002 3391 1.22 0.42 1.65 104 DKIM_INVALID 3361 3.29 6.40 1.64 105 BAYES_05 3346 1.23 0.48 1.63 106 TM2_M_URI_OPT_OUT 3297 1.93 2.54 1.60 107 HTML_MIME_NO_HTML_TAG 3189 1.57 1.62 1.55 108 RCVD_IN_IADB_SPF 3150 1.17 0.48 1.53 109 TR_XM_SpammyRelay 3119 4.84 11.11 1.52 110 IN_HORDE_ADDRESS_BOOK 3022 0.99 0.09 1.47 111 XMGappySubj_01 3019 1.02 0.17 1.47 112 TR_DCC_Bayes_99 3014 8.92 22.96 1.47 113 TR_XM_PhishingBody 3012 2.32 3.94 1.47 114 RCVD_IN_IADB_SENDERID 2912 1.09 0.47 1.42 115 XMLngstWrd_00 2897 1.10 0.51 1.41 116 XMStockSpam_06 2880 1.56 1.87 1.40 117 RCVD_IN_IADB_DK 2853 1.07 0.47 1.39 118 URI_NOVOWEL 2800 1.26 1.07 1.36 119 TVD_SPACE_RATIO 2768 0.96 0.23 1.35 120 XMGappySubj_02 2753 0.88 0.03 1.34 121 UNTRUSTED_Relay 2745 3.47 7.49 1.34 122 XM_B_COPY_HTML 2656 1.29 1.29 1.29 123 TR_XM_UnparsRelay 2606 4.57 10.80 1.27 124 XM_DK_Undo_01 2562 1.19 1.09 1.25 125 TR_XM_SpammyWords5 2545 1.87 3.07 1.24 126 XM_B_URI_Unicode 2515 1.37 1.64 1.22 127 XMBrknScrpt_02 2470 1.42 1.83 1.20 128 TR_Symld_Words 2447 1.01 0.67 1.19 129 XM_B_Investor 2391 2.09 3.83 1.16 130 XM_B_Unsub2 2331 1.41 1.93 1.13 131 XMBdyGiftCard01 2237 1.08 1.07 1.09 132 RCVD_IN_IADB_VOUCHED 2235 0.77 0.17 1.09 133 XMDiploma_00 2161 1.44 2.17 1.05 134 XM_SendGrid 2141 0.99 0.89 1.04 135 XM_GoogleGroups 2103 0.91 0.69 1.02 136 XM_RXBody 2038 0.85 0.60 0.99 137 BOTNET 2024 4.69 11.67 0.98 138 HTML_TAG_BALANCE_BODY 1984 1.00 1.07 0.97 139 TooManyTo_003 1980 0.76 0.39 0.96 140 SUBJ_ALL_CAPS 1935 1.25 1.84 0.94 141 T_XMDrugObfuBody_08 1922 1.38 2.21 0.94 142 RELAYCOUNTRY_CA 1911 2.97 6.81 0.93 143 TVD_RCVD_IP 1859 1.01 1.22 0.90 144 XM_OfRef6 1834 1.45 2.51 0.89 145 XM_SPF_SoftFail 1694 1.42 2.54 0.82 146 RCVD_IN_IADB_OPTIN 1656 0.57 0.12 0.81 147 XM_UB50 1584 1.93 4.11 0.77 148 URI_HEX 1575 0.93 1.23 0.77 149 T_XMHurry_00 1575 1.61 3.21 0.77 150 TR_XM_DK_SendGrid 1563 0.70 0.59 0.76 151 TR_XM_Base64_M1 1559 0.69 0.56 0.76 152 XM_H_Long_From02 1544 1.09 1.73 0.75 153 XMPhish30 1471 0.93 1.35 0.72 154 DKIM_ADSP_CUSTOM_MED 1462 0.78 0.91 0.71 155 XM_B_SpammyWords4 1455 1.33 2.51 0.71 156 TooManyTo_004 1454 0.59 0.36 0.71 157 XM_H_PHPMailer 1400 0.61 0.48 0.68 158 T_XMDrugObfuBody_00 1395 1.11 1.92 0.68 159 TR_MetaPhish_Combo_01 1368 0.90 1.34 0.67 160 XMSubMetaI_00 1341 0.94 1.48 0.65 161 HELO_MISC_IP 1333 0.47 0.13 0.65 162 TM2_M_OBFU_COMMENT 1314 0.68 0.75 0.64 163 XMBSHREFv2 1304 0.50 0.24 0.63 164 TooManyTo_005 1279 0.53 0.35 0.62 165 URI_TRY_3LD 1240 0.79 1.15 0.60 166 XMBody_95 1217 0.43 0.14 0.59 167 T_STY_INVIS_DIRECT 1208 1.31 2.66 0.59 168 XMSubMetaSxObfu_03 1152 0.51 0.41 0.56 169 XMSlimDrugH 1140 0.76 1.14 0.55 170 XM_URI_RBL 1132 1.17 2.33 0.55 171 XM_ProductURIs 1125 0.67 0.89 0.55 172 USER_IN_WHITELIST 1113 0.35 0.00 0.54 173 USER_IN_WELCOMELIST 1113 0.35 0.00 0.54 174 T_TooManySym_04 1066 0.35 0.03 0.52 175 XMBody_17 1059 1.22 2.54 0.52 176 XMLngstWrd_01 1047 0.44 0.30 0.51 177 RCVD_IN_PBL 1025 0.75 1.23 0.50 178 TR_XM_SpammyWords2 954 4.52 12.15 0.46 179 TO_NO_BRKTS_HTML_ONLY 947 0.37 0.19 0.46 180 DIET_1 946 1.20 2.60 0.46 181 HTTPS_HTTP_MISMATCH 937 0.64 0.97 0.46 182 T_FILL_THIS_FORM_SHORT 933 0.97 1.96 0.45 183 THIS_AD 916 0.69 1.14 0.45 184 XMGenDplmaNmb 900 0.60 0.91 0.44 185 MSGID_FROM_MTA_HEADER 897 0.34 0.14 0.44 186 TR_LOTS_OF_MONEY3 890 1.09 2.32 0.43 187 MPART_ALT_DIFF_COUNT 888 1.06 2.23 0.43 188 DKIM_ADSP_NXDOMAIN 878 1.52 3.59 0.43 189 NML_ADSP_CUSTOM_MED 873 0.54 0.77 0.42 190 FORGED_GMAIL_RCVD 870 0.52 0.70 0.42 191 HTML_FONT_FACE_BAD 862 0.58 0.88 0.42 192 XMNoVowels 859 0.45 0.52 0.42 193 HTML_TAG_BALANCE_CENTER 855 0.39 0.35 0.42 194 RELAYCOUNTRY_AU 845 0.95 1.95 0.41 195 NO_DNS_FOR_FROM 828 1.33 3.08 0.40 196 RCVD_IN_BL_SPAMCOP_NET 815 3.87 10.41 0.40 197 T_OBFU_PDF_ATTACH 797 0.30 0.13 0.39 198 XM_S_SubURI 790 0.27 0.05 0.38 199 XMHTML_After_End 765 0.46 0.63 0.37 200 HTML_IMAGE_ONLY_20 760 0.48 0.68 0.37 ----------------------------------------------------------------------