Email: 448814 Autolearn: 0 AvgScore: 4.52 AvgScanTime: 1.32 sec Spam: 127354 Autolearn: 0 AvgScore: 14.76 AvgScanTime: 1.45 sec Ham: 321460 Autolearn: 0 AvgScore: 0.46 AvgScanTime: 1.27 sec Time Spent Running SA: 164.82 hours Time Spent Processing Spam: 51.16 hours Time Spent Processing Ham: 113.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 124459 98.94 97.73 99.42 2 HTML_MESSAGE 118531 88.37 93.07 86.50 3 DKIM_SIGNED 110128 75.90 86.47 71.71 4 XM_B_Unicode 106224 73.12 83.41 69.05 5 XM_DK_Pass 104646 73.85 82.17 70.56 6 DKIM_VALID 103617 72.81 81.36 69.42 7 RELAYCOUNTRY_US 102925 81.21 80.82 81.37 8 DCC_CHECK 94805 48.15 74.44 37.74 9 XM_B_SpammyWords 88554 51.48 69.53 44.33 10 XMListUnsubscribeExists 83174 50.22 65.31 44.24 11 DKIM_VALID_AU 82140 58.44 64.50 56.04 12 XM_B_Unicode3 60850 41.68 47.78 39.27 13 LOC_TINY_FONT_1 59368 32.38 46.62 26.73 14 BAYES_50 51231 55.04 40.23 60.92 15 XM_B_SpammyWords2 50378 24.15 39.56 18.04 16 XM_DK_Undo_02 49001 14.18 38.48 4.56 17 HTML_FONT_LOW_CONTRAST 44384 31.13 34.85 29.66 18 FVGT_m_MULTI_ODD 41287 27.26 32.42 25.22 19 BAYES_99 40597 11.39 31.88 3.27 20 DKIM_VALID_EF 38470 30.02 30.21 29.95 21 T_KAM_HTML_FONT_INVALID 37776 22.26 29.66 19.32 22 MIME_HTML_ONLY 37549 22.33 29.48 19.50 23 TR_XM_DKIM_Undo 36607 9.61 28.74 2.02 24 XMSubLong 31447 23.58 24.69 23.14 25 BAYES_999 31290 8.77 24.57 2.51 26 DCC_CHECK_NEGATIVE 30251 51.30 23.75 62.21 27 T_TM2_M_HEADER_IN_MSG 30161 31.46 23.68 34.54 28 TR_DCC_Bayes_99 28146 7.13 22.10 1.20 29 XM_Multi_Part_URI 27056 15.96 21.24 13.87 30 TR_XM_DK_Unsub 27044 15.30 21.24 12.95 31 XM_B_Unsub 24361 12.62 19.13 10.04 32 UNPARSEABLE_RELAY 23516 14.49 18.47 12.92 33 TR_XM_BayesUnsub 23361 10.60 18.34 7.53 34 RELAYCOUNTRY_META 19916 7.06 15.64 3.66 35 RCVD_IN_MSPIKE_H2 19637 15.13 15.42 15.01 36 XM_B_SpammyWords3 19211 7.58 15.08 4.60 37 TR_MAX_INTL_RELAY 17707 8.02 13.90 5.68 38 BOTNET_IPINHOSTNAME 15007 5.20 11.78 2.59 39 LOTS_OF_MONEY 14964 7.15 11.75 5.33 40 FSL_BULK_SIG 14941 9.13 11.73 8.10 41 TR_XM_SpammyRelay 14288 4.42 11.22 1.73 42 TR_XM_SpammyWords2 13838 3.46 10.87 0.53 43 TR_XM_SpammyWords4 13227 5.47 10.39 3.53 44 TR_XM_UnparsRelay 12254 3.99 9.62 1.76 45 XM_Evil_Numbers_Gen 11677 9.58 9.17 9.75 46 BOTNET 11273 3.35 8.85 1.17 47 BAYES_80 11019 4.92 8.65 3.44 48 XM_B_Phish_Phrases 10927 6.72 8.58 5.99 49 RCVD_IN_MSPIKE_WL 10603 12.66 8.33 14.37 50 LotsOfNums_01 9806 9.37 7.70 10.03 51 RCVD_IN_BL_SPAMCOP_NET 9741 2.65 7.65 0.67 52 BAYES_60 9650 6.59 7.58 6.19 53 XM_Body_Dirty_Words 9402 3.77 7.38 2.34 54 HTML_IMAGE_RATIO_02 8807 5.39 6.92 4.79 55 XMSubMetaSx_00 8565 4.22 6.73 3.22 56 XM_B_PhoneNumber 8084 9.13 6.35 10.23 57 UNTRUSTED_Relay 7863 2.80 6.17 1.47 58 RELAYCOUNTRY_CA 7517 2.30 5.90 0.87 59 MPART_ALT_DIFF 7360 4.54 5.78 4.04 60 XM_H_Long_From01 7003 5.23 5.50 5.12 61 XM_UncommonTLD01 6822 4.42 5.36 4.05 62 DKIM_INVALID 6511 3.09 5.11 2.29 63 XM_B_Investor 6506 2.58 5.11 1.58 64 BAYES_95 6267 3.00 4.92 2.24 65 XMSexyCombo_05 6243 2.28 4.90 1.24 66 HTML_IMAGE_RATIO_04 6204 4.16 4.87 3.87 67 XM_H_GMP 6034 5.62 4.74 5.97 68 XMStrtUSub 5870 4.54 4.61 4.51 69 TR_XM_PhishingBody 5829 2.53 4.58 1.72 70 RCVD_IN_MSPIKE_H3 5747 5.55 4.51 5.96 71 RCVD_IN_MSPIKE_BL 5628 1.49 4.42 0.33 72 TR_XM_MSPIKECOMBO 5627 1.49 4.42 0.33 73 XM_B_SpammyTLD 5359 3.08 4.21 2.64 74 TooManyTo_001 5357 7.73 4.21 9.13 75 XMNumbers 5326 3.91 4.18 3.80 76 TM2_M_VERY_LONG_WORD 5189 4.80 4.07 5.09 77 TR_XM_SpammyWords5 5171 2.11 4.06 1.34 78 MIME_HTML_MOSTLY 5030 2.83 3.95 2.38 79 T_XMDrugObfuBody_14 4480 2.32 3.52 1.84 80 XM_CamelCaseFrm001 4329 2.36 3.40 1.95 81 ALL_TRUSTED 4284 12.24 3.36 15.75 82 MIME_QP_LONG_LINE 4250 4.26 3.34 4.62 83 TR_XM_SpammyWords3 4237 1.05 3.33 0.14 84 MIME_HTML_ONLY_MULTI 4118 2.56 3.23 2.29 85 XM_OfRef6 4099 2.01 3.22 1.54 86 XM_SPF_SoftFail 4071 1.89 3.20 1.37 87 XM_B_Unsub2 4026 2.12 3.16 1.71 88 XM_UB50 4025 1.57 3.16 0.95 89 XM_URI_RBL 3790 1.03 2.98 0.26 90 RCVD_IN_MSPIKE_L3 3634 0.98 2.85 0.24 91 T_TooManySym_01 3622 5.32 2.84 6.30 92 TR_XM_NoHeaderRelay 3579 0.93 2.81 0.19 93 T_XMDrugObfuBody_08 3576 1.78 2.81 1.37 94 XM_B_SpammyWords4 3420 1.31 2.69 0.76 95 RELAYCOUNTRY_AU 3420 1.15 2.69 0.55 96 XM_B_URI_Unicode 3364 2.06 2.64 1.83 97 HTML_IMAGE_RATIO_06 3308 2.66 2.60 2.68 98 RCVD_IN_MSPIKE_H5 3223 5.23 2.53 6.30 99 TR_XM_INV_DKIM 3185 0.79 2.50 0.11 100 TM2_M_URI_OPT_OUT 3020 1.75 2.37 1.50 101 T_FILL_THIS_FORM_SHORT 2924 1.27 2.30 0.86 102 RCVD_IN_VALIDITY_RPBL 2911 0.73 2.29 0.12 103 XMDiploma_00 2875 1.72 2.26 1.51 104 HTML_MIME_NO_HTML_TAG 2843 2.76 2.23 2.98 105 TR_XM_SPAMCOP 2839 0.73 2.23 0.13 106 HTML_IMAGE_RATIO_08 2816 1.91 2.21 1.79 107 RCVD_IN_PSBL 2770 0.83 2.18 0.29 108 T_XMHurry_00 2729 0.94 2.14 0.46 109 SCC_BODY_URI_ONLY 2677 2.21 2.10 2.25 110 KHOP_HELO_FCRDNS 2655 3.04 2.08 3.41 111 MAILING_LIST_MULTI 2636 2.93 2.07 3.28 112 USER_IN_DEF_DKIM_WL 2629 9.30 2.06 12.17 113 XMBrknScrpt_02 2623 1.21 2.06 0.87 114 BAYES_40 2617 5.05 2.05 6.23 115 FROM_EXCESS_BASE64 2517 1.81 1.98 1.75 116 SUBJ_ALL_CAPS 2478 1.56 1.95 1.41 117 SpammyFromTLD_02 2413 0.71 1.89 0.24 118 T_REMOTE_IMAGE 2382 3.19 1.87 3.72 119 XMStockSpam_06 2351 1.40 1.85 1.23 120 XMBody_17 2326 0.81 1.83 0.41 121 BOUNCE_MESSAGE 2312 5.73 1.82 7.27 122 ANY_BOUNCE_MESSAGE 2312 5.73 1.82 7.28 123 SpammyFromTLD_01 2300 1.10 1.81 0.82 124 SHORTCIRCUIT 2283 0.51 1.79 0.00 125 RCVD_IN_ZEN_LASTEXTERNAL 2283 0.51 1.79 0.00 126 XM_DK_Undo_01 2191 1.70 1.72 1.69 127 T_XMDrugObfuBody_00 2188 1.02 1.72 0.74 128 HTTPS_HTTP_MISMATCH 2152 1.01 1.69 0.74 129 BAYES_20 2082 3.52 1.63 4.27 130 XMGenDplmaNmb 2008 1.02 1.58 0.80 131 DIET_1 1957 0.69 1.54 0.35 132 XMPhish30 1956 0.74 1.54 0.42 133 RCVD_IN_VALIDITY_SAFE 1941 3.14 1.52 3.78 134 URI_HEX 1916 1.29 1.50 1.20 135 URI_TRY_3LD 1891 0.86 1.48 0.61 136 XM_B_COPY_HTML 1768 0.76 1.39 0.51 137 URI_NOVOWEL 1752 1.59 1.38 1.67 138 TR_LOTS_OF_MONEY3 1741 0.59 1.37 0.28 139 XM_SendGrid 1739 1.39 1.37 1.40 140 HTML_IMAGE_ONLY_20 1670 0.65 1.31 0.38 141 XM_H_Long_From02 1636 0.99 1.28 0.88 142 RCVD_IN_MSPIKE_H4 1633 1.88 1.28 2.11 143 TR_XM_RelayPhish 1603 0.41 1.26 0.07 144 TR_MetaPhish_Combo_01 1560 1.41 1.22 1.48 145 MPART_ALT_DIFF_COUNT 1554 0.78 1.22 0.60 146 TR_XM_MSPIKECOMBO2 1552 0.35 1.22 0.01 147 SHOPIFY_IMG_NOT_RCVD_SFY 1528 0.52 1.20 0.26 148 RCVD_IN_XBL 1499 0.36 1.18 0.04 149 BOTNET_NORDNS 1489 0.34 1.17 0.01 150 XMSubMetaI_00 1488 0.63 1.17 0.41 151 XM_B_SEO 1480 0.54 1.16 0.29 152 TR_XM_PHPForged 1465 0.79 1.15 0.65 153 RCVD_IN_PBL 1463 0.94 1.15 0.86 154 RELAYCOUNTRY_FR 1452 0.54 1.14 0.30 155 DKIM_ADSP_CUSTOM_MED 1452 0.91 1.14 0.81 156 RCVD_IN_IADB_LISTED 1429 2.41 1.12 2.93 157 RDNS_DYNAMIC 1416 0.44 1.11 0.18 158 TR_XM_FormFill2 1411 0.78 1.11 0.66 159 TR_XM_PHPDW 1408 0.78 1.11 0.65 160 XMHTML_After_End 1401 0.57 1.10 0.36 161 XM_HighProb1 1396 0.32 1.10 0.01 162 RCVD_IN_VALIDITY_CERTIFIED 1395 2.60 1.10 3.19 163 PDS_RDNS_DYNAMIC_FP 1360 0.34 1.07 0.06 164 XM_H_PHPOS 1360 0.76 1.07 0.64 165 TR_Symld_Words 1342 1.50 1.05 1.67 166 RELAYCOUNTRY_GB 1338 0.71 1.05 0.58 167 XM_B_DNDMA 1313 0.88 1.03 0.82 168 MIME_CHARSET_FARAWAY 1298 1.75 1.02 2.04 169 XM_B_Phish66 1295 0.56 1.02 0.37 170 T_TooManySym_02 1290 2.53 1.01 3.13 171 TO_NO_BRKTS_HTML_ONLY 1290 0.64 1.01 0.49 172 XM_ProductURIs 1289 0.77 1.01 0.68 173 TR_XM_InvalidRelay 1283 0.29 1.01 0.01 174 TVD_RCVD_IP 1275 0.82 1.00 0.74 175 DKIM_ADSP_NXDOMAIN 1259 0.50 0.99 0.31 176 XMSubMetaSxObfu_03 1257 0.55 0.99 0.37 177 TR_Mismatch_TLD_02 1250 0.33 0.98 0.07 178 TR_XM_SEO4 1244 0.36 0.98 0.11 179 XM_DIRTYINTL 1235 0.34 0.97 0.09 180 TR_XM_MaxSPIKE 1234 0.28 0.97 0.01 181 XMPhish14 1232 0.76 0.97 0.67 182 TR_LOTS_OF_MONEY2 1218 0.49 0.96 0.30 183 T_MONEY_PERCENT 1218 0.49 0.96 0.30 184 RCVD_IN_IADB_SPF 1182 2.10 0.93 2.57 185 TR_XM_Base64_M1 1167 0.82 0.92 0.78 186 MultiRelay_CC 1163 0.42 0.91 0.23 187 NML_ADSP_CUSTOM_MED 1149 0.62 0.90 0.51 188 TR_Mismatch_TLD_01 1145 0.43 0.90 0.25 189 TR_XM_Spammywords 1141 0.44 0.90 0.26 190 XM_S_SpammyWords 1141 0.44 0.90 0.26 191 HTML_TAG_BALANCE_BODY 1135 0.69 0.89 0.62 192 XMSexyCombo_01 1134 0.35 0.89 0.14 193 TR_XM_FormFill 1125 0.26 0.88 0.01 194 RCVD_IN_SORBS_DUL 1118 0.27 0.88 0.03 195 RCVD_IN_IADB_DK 1115 1.84 0.88 2.23 196 RCVD_IN_IADB_SENDERID 1113 1.89 0.87 2.29 197 XM_GoogleGroups 1107 1.16 0.87 1.28 198 TM2_M_OBFU_COMMENT 1100 0.64 0.86 0.56 199 URIBL_BLACK 1096 0.26 0.86 0.03 200 HTML_FONT_TINY_NORDNS 1086 0.31 0.85 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 319590 98.94 97.73 99.42 2 HTML_MESSAGE 278064 88.37 93.07 86.50 3 RELAYCOUNTRY_US 261558 81.21 80.82 81.37 4 DKIM_SIGNED 230524 75.90 86.47 71.71 5 XM_DK_Pass 226818 73.85 82.17 70.56 6 DKIM_VALID 223159 72.81 81.36 69.42 7 XM_B_Unicode 221959 73.12 83.41 69.05 8 DCC_CHECK_NEGATIVE 199989 51.30 23.75 62.21 9 BAYES_50 195818 55.04 40.23 60.92 10 DKIM_VALID_AU 180158 58.44 64.50 56.04 11 XM_B_SpammyWords 142517 51.48 69.53 44.33 12 XMListUnsubscribeExists 142204 50.22 65.31 44.24 13 XM_B_Unicode3 126230 41.68 47.78 39.27 14 DCC_CHECK 121309 48.15 74.44 37.74 15 T_TM2_M_HEADER_IN_MSG 111017 31.46 23.68 34.54 16 DKIM_VALID_EF 96282 30.02 30.21 29.95 17 HTML_FONT_LOW_CONTRAST 95352 31.13 34.85 29.66 18 LOC_TINY_FONT_1 85941 32.38 46.62 26.73 19 FVGT_m_MULTI_ODD 81075 27.26 32.42 25.22 20 XMSubLong 74387 23.58 24.69 23.14 21 MIME_HTML_ONLY 62691 22.33 29.48 19.50 22 T_KAM_HTML_FONT_INVALID 62116 22.26 29.66 19.32 23 XM_B_SpammyWords2 57996 24.15 39.56 18.04 24 ALL_TRUSTED 50642 12.24 3.36 15.75 25 RCVD_IN_MSPIKE_H2 48251 15.13 15.42 15.01 26 RCVD_IN_MSPIKE_WL 46205 12.66 8.33 14.37 27 XM_Multi_Part_URI 44596 15.96 21.24 13.87 28 TR_XM_DK_Unsub 41643 15.30 21.24 12.95 29 UNPARSEABLE_RELAY 41529 14.49 18.47 12.92 30 USER_IN_DEF_DKIM_WL 39125 9.30 2.06 12.17 31 BAYES_00 35409 8.03 0.51 11.02 32 XM_B_PhoneNumber 32891 9.13 6.35 10.23 33 XM_B_Unsub 32285 12.62 19.13 10.04 34 LotsOfNums_01 32227 9.37 7.70 10.03 35 XM_Evil_Numbers_Gen 31336 9.58 9.17 9.75 36 TooManyTo_001 29353 7.73 4.21 9.13 37 FSL_BULK_SIG 26030 9.13 11.73 8.10 38 TR_XM_BayesUnsub 24193 10.60 18.34 7.53 39 ANY_BOUNCE_MESSAGE 23396 5.73 1.82 7.28 40 BOUNCE_MESSAGE 23383 5.73 1.82 7.27 41 TR_XM_DK_Bayes 22487 5.13 0.41 7.00 42 TR_XM_DK_Bayes1 21980 5.01 0.40 6.84 43 XM_DKIMWhitelistDomains 20891 4.67 0.04 6.50 44 RCVD_IN_MSPIKE_H5 20266 5.23 2.53 6.30 45 T_TooManySym_01 20258 5.32 2.84 6.30 46 BAYES_40 20042 5.05 2.05 6.23 47 BAYES_60 19912 6.59 7.58 6.19 48 XM_B_Phish_Phrases 19252 6.72 8.58 5.99 49 XM_H_GMP 19182 5.62 4.74 5.97 50 RCVD_IN_MSPIKE_H3 19147 5.55 4.51 5.96 51 TR_XM_DK_Bayes2 18702 4.26 0.32 5.82 52 TR_MAX_INTL_RELAY 18267 8.02 13.90 5.68 53 LOTS_OF_MONEY 17148 7.15 11.75 5.33 54 XM_H_Long_From01 16453 5.23 5.50 5.12 55 TM2_M_VERY_LONG_WORD 16370 4.80 4.07 5.09 56 HTML_IMAGE_RATIO_02 15385 5.39 6.92 4.79 57 XM_PDF 15079 3.55 0.67 4.69 58 MIME_QP_LONG_LINE 14862 4.26 3.34 4.62 59 XM_B_SpammyWords3 14792 7.58 15.08 4.60 60 XM_DK_Undo_02 14646 14.18 38.48 4.56 61 XMStrtUSub 14498 4.54 4.61 4.51 62 BAYES_20 13734 3.52 1.63 4.27 63 XM_UncommonTLD01 13005 4.42 5.36 4.05 64 MPART_ALT_DIFF 12996 4.54 5.78 4.04 65 HTML_IMAGE_ONLY_32 12734 2.89 0.20 3.96 66 HTML_IMAGE_RATIO_04 12453 4.16 4.87 3.87 67 XMNumbers 12211 3.91 4.18 3.80 68 RCVD_IN_VALIDITY_SAFE 12162 3.14 1.52 3.78 69 T_REMOTE_IMAGE 11947 3.19 1.87 3.72 70 IN_ZIMBRA_NJ_WHITELIST 11938 2.68 0.08 3.71 71 RELAYCOUNTRY_META 11779 7.06 15.64 3.66 72 TooManyTo_002 11599 2.79 0.73 3.61 73 MAY_BE_FORGED 11578 2.76 0.65 3.60 74 TR_XM_SpammyWords4 11333 5.47 10.39 3.53 75 BAYES_80 11063 4.92 8.65 3.44 76 KHOP_HELO_FCRDNS 10975 3.04 2.08 3.41 77 MAILING_LIST_MULTI 10530 2.93 2.07 3.28 78 BAYES_99 10522 11.39 31.88 3.27 79 XMSubMetaSx_00 10362 4.22 6.73 3.22 80 RCVD_IN_VALIDITY_CERTIFIED 10262 2.60 1.10 3.19 81 T_TooManySym_02 10069 2.53 1.01 3.13 82 HTML_MIME_NO_HTML_TAG 9564 2.76 2.23 2.98 83 RCVD_IN_IADB_LISTED 9404 2.41 1.12 2.93 84 HTML_IMAGE_RATIO_06 8628 2.66 2.60 2.68 85 XM_B_SpammyTLD 8476 3.08 4.21 2.64 86 BOTNET_IPINHOSTNAME 8334 5.20 11.78 2.59 87 RCVD_IN_IADB_SPF 8252 2.10 0.93 2.57 88 BAYES_999 8074 8.77 24.57 2.51 89 BAYES_05 7752 1.94 0.75 2.41 90 MIME_HTML_MOSTLY 7653 2.83 3.95 2.38 91 XM_Body_Dirty_Words 7536 3.77 7.38 2.34 92 MIME_HTML_ONLY_MULTI 7377 2.56 3.23 2.29 93 RCVD_IN_IADB_SENDERID 7365 1.89 0.87 2.29 94 DKIM_INVALID 7365 3.09 5.11 2.29 95 SCC_BODY_URI_ONLY 7243 2.21 2.10 2.25 96 BAYES_95 7196 3.00 4.92 2.24 97 INVALID_MSGID 7174 1.66 0.22 2.23 98 RCVD_IN_IADB_DK 7161 1.84 0.88 2.23 99 RCVD_IN_MSPIKE_H4 6792 1.88 1.28 2.11 100 MIME_CHARSET_FARAWAY 6572 1.75 1.02 2.04 101 TooManyTo_003 6569 1.65 0.65 2.04 102 TR_XM_DKIM_Undo 6507 9.61 28.74 2.02 103 TO_MALFORMED 6292 1.41 0.03 1.96 104 XM_CamelCaseFrm001 6283 2.36 3.40 1.95 105 RCVD_IN_IADB_VOUCHED 6237 1.56 0.61 1.94 106 CHARSET_FARAWAY_HEADER 6038 1.57 0.79 1.88 107 T_XMDrugObfuBody_14 5914 2.32 3.52 1.84 108 XM_B_URI_Unicode 5880 2.06 2.64 1.83 109 HTML_IMAGE_RATIO_08 5759 1.91 2.21 1.79 110 TR_XM_UnparsRelay 5654 3.99 9.62 1.76 111 FROM_EXCESS_BASE64 5618 1.81 1.98 1.75 112 TR_XM_SpammyRelay 5568 4.42 11.22 1.73 113 TR_XM_PhishingBody 5530 2.53 4.58 1.72 114 XM_B_Unsub2 5494 2.12 3.16 1.71 115 XM_DK_Undo_01 5444 1.70 1.72 1.69 116 XMLngstWrd_00 5399 1.35 0.51 1.68 117 TR_Symld_Words 5370 1.50 1.05 1.67 118 URI_NOVOWEL 5362 1.59 1.38 1.67 119 XM_B_Investor 5069 2.58 5.11 1.58 120 XM_OfRef6 4940 2.01 3.22 1.54 121 TooManyTo_004 4904 1.26 0.58 1.53 122 XMDiploma_00 4854 1.72 2.26 1.51 123 TM2_M_URI_OPT_OUT 4819 1.75 2.37 1.50 124 TR_MetaPhish_Combo_01 4765 1.41 1.22 1.48 125 UNTRUSTED_Relay 4715 2.80 6.17 1.47 126 HELO_NODOT 4693 1.11 0.22 1.46 127 HELO_NO_DOMAIN 4686 1.11 0.22 1.46 128 SUBJ_ALL_CAPS 4522 1.56 1.95 1.41 129 XM_SendGrid 4487 1.39 1.37 1.40 130 XM_SPF_SoftFail 4402 1.89 3.20 1.37 131 T_XMDrugObfuBody_08 4394 1.78 2.81 1.37 132 RCVD_IN_IADB_OPTIN 4375 1.08 0.35 1.36 133 TR_XM_SpammyWords5 4293 2.11 4.06 1.34 134 XMGappySubj_01 4277 1.04 0.30 1.33 135 XMCapTrack 4193 1.07 0.49 1.30 136 IN_HORDE_ADDRESS_BOOK 4190 0.96 0.08 1.30 137 XM_GoogleGroups 4114 1.16 0.87 1.28 138 T_TooManySym_03 4098 1.08 0.58 1.27 139 TooManyTo_005 3983 1.04 0.54 1.24 140 XMSexyCombo_05 3971 2.28 4.90 1.24 141 XMStockSpam_06 3944 1.40 1.85 1.23 142 TR_DCC_Bayes_99 3873 7.13 22.10 1.20 143 URI_HEX 3859 1.29 1.50 1.20 144 BOTNET 3770 3.35 8.85 1.17 145 XM_ShortIntro_01 3434 0.89 0.44 1.07 146 T_TVD_MIME_NO_HEADERS 3354 0.76 0.05 1.04 147 TVD_SPACE_RATIO 3206 0.76 0.17 1.00 148 TR_XM_DK_SendGrid 3170 0.93 0.80 0.99 149 XM_H_PHPMailer 3063 0.90 0.76 0.95 150 XM_UB50 3042 1.57 3.16 0.95 151 XMGappySubj_02 2824 0.64 0.05 0.88 152 XM_H_Long_From02 2814 0.99 1.28 0.88 153 RELAYCOUNTRY_CA 2807 2.30 5.90 0.87 154 XMBrknScrpt_02 2799 1.21 2.06 0.87 155 T_FILL_THIS_FORM_SHORT 2773 1.27 2.30 0.86 156 RCVD_IN_PBL 2761 0.94 1.15 0.86 157 XMLngstWrd_01 2674 0.72 0.43 0.83 158 XM_B_FormFill 2673 0.60 0.02 0.83 159 SpammyFromTLD_01 2637 1.10 1.81 0.82 160 XM_B_DNDMA 2628 0.88 1.03 0.82 161 DKIM_ADSP_CUSTOM_MED 2612 0.91 1.14 0.81 162 URI_OPTOUT_3LD 2603 0.74 0.58 0.81 163 XMGenDplmaNmb 2561 1.02 1.58 0.80 164 TR_XM_Base64_M1 2502 0.82 0.92 0.78 165 XM_B_SpammyWords4 2442 1.31 2.69 0.76 166 XMNoVowels 2437 0.70 0.54 0.76 167 TVD_RCVD_IP 2390 0.82 1.00 0.74 168 T_XMDrugObfuBody_00 2385 1.02 1.72 0.74 169 HTTPS_HTTP_MISMATCH 2370 1.01 1.69 0.74 170 XMLngstWrd_02 2190 0.59 0.37 0.68 171 XM_ProductURIs 2172 0.77 1.01 0.68 172 XMPhish14 2157 0.76 0.97 0.67 173 XMSlimDrugH 2148 0.67 0.67 0.67 174 RCVD_IN_BL_SPAMCOP_NET 2141 2.65 7.65 0.67 175 XMBdyGiftCard01 2121 0.69 0.78 0.66 176 TR_XM_FormFill2 2112 0.78 1.11 0.66 177 TR_XM_PHPDW 2101 0.78 1.11 0.65 178 TR_XM_PHPForged 2095 0.79 1.15 0.65 179 XM_H_PHPOS 2062 0.76 1.07 0.64 180 HTML_TAG_BALANCE_BODY 1978 0.69 0.89 0.62 181 URI_TRY_3LD 1949 0.86 1.48 0.61 182 MPART_ALT_DIFF_COUNT 1939 0.78 1.22 0.60 183 XMLngstWrd_03 1903 0.51 0.30 0.59 184 MSGID_FROM_MTA_HEADER 1896 0.47 0.16 0.59 185 T_OBFU_PDF_ATTACH 1869 0.47 0.19 0.58 186 RELAYCOUNTRY_GB 1862 0.71 1.05 0.58 187 TM2_M_OBFU_COMMENT 1793 0.64 0.86 0.56 188 SUBJ_DOLLARS 1756 0.56 0.60 0.55 189 RELAYCOUNTRY_AU 1753 1.15 2.69 0.55 190 URI_DOTEDU 1728 0.41 0.10 0.54 191 TR_XM_SpammyWords2 1695 3.46 10.87 0.53 192 FROM_GOV_DKIM_AU 1687 0.43 0.19 0.52 193 XM_B_COPY_HTML 1651 0.76 1.39 0.51 194 NML_ADSP_CUSTOM_MED 1651 0.62 0.90 0.51 195 T_Symld_Words_02 1649 0.58 0.76 0.51 196 TO_NO_BRKTS_HTML_ONLY 1591 0.64 1.01 0.49 197 XMMoneyMeta_00 1561 0.55 0.70 0.49 198 XMDateMe_00 1549 0.48 0.48 0.48 199 XMBSHREFv2 1546 0.45 0.38 0.48 200 FORGED_GMAIL_RCVD 1546 0.59 0.85 0.48 ----------------------------------------------------------------------