Email: 509198 Autolearn: 0 AvgScore: 3.22 AvgScanTime: 1.51 sec Spam: 140456 Autolearn: 0 AvgScore: 14.56 AvgScanTime: 1.76 sec Ham: 368742 Autolearn: 0 AvgScore: -1.11 AvgScanTime: 1.41 sec Time Spent Running SA: 213.25 hours Time Spent Processing Spam: 68.85 hours Time Spent Processing Ham: 144.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 137973 99.20 98.23 99.57 2 HTML_MESSAGE 132592 90.41 94.40 88.88 3 DKIM_SIGNED 124460 72.27 88.61 66.05 4 XM_DK_Pass 117558 70.20 83.70 65.07 5 XM_B_Unicode 117098 75.48 83.37 72.48 6 DKIM_VALID 116480 69.29 82.93 64.09 7 RELAYCOUNTRY_US 114150 83.41 81.27 84.23 8 DCC_CHECK 104377 49.91 74.31 40.62 9 XM_B_SpammyWords 97495 51.77 69.41 45.05 10 XMListUnsubscribeExists 93456 49.19 66.54 42.58 11 DKIM_VALID_AU 90708 55.53 64.58 52.09 12 XM_B_Unicode3 67764 43.86 48.25 42.19 13 LOC_TINY_FONT_1 65848 30.28 46.88 23.95 14 BAYES_50 58457 53.57 41.62 58.12 15 XM_B_SpammyWords2 54690 23.56 38.94 17.70 16 XM_DK_Undo_02 54610 13.68 38.88 4.08 17 HTML_FONT_LOW_CONTRAST 51006 28.38 36.31 25.36 18 FVGT_m_MULTI_ODD 47096 26.33 33.53 23.58 19 MIME_HTML_ONLY 43188 24.71 30.75 22.41 20 T_KAM_HTML_FONT_INVALID 42996 21.62 30.61 18.19 21 DKIM_VALID_EF 42911 27.53 30.55 26.39 22 BAYES_99 42605 10.42 30.33 2.84 23 TR_XM_DKIM_Undo 40165 9.17 28.60 1.77 24 XMSubLong 36572 23.72 26.04 22.83 25 DCC_CHECK_NEGATIVE 33909 49.63 24.14 59.34 26 BAYES_999 32464 7.90 23.11 2.10 27 T_TM2_M_HEADER_IN_MSG 32273 26.77 22.98 28.21 28 TR_XM_DK_Unsub 30843 14.62 21.96 11.83 29 XM_Multi_Part_URI 30397 15.14 21.64 12.67 30 TR_DCC_Bayes_99 29414 6.51 20.94 1.01 31 XM_B_Unsub 28376 12.06 20.20 8.96 32 RCVD_IN_MSPIKE_H2 27807 16.31 19.80 14.97 33 TR_XM_BayesUnsub 27120 9.82 19.31 6.20 34 UNPARSEABLE_RELAY 24623 12.50 17.53 10.59 35 RELAYCOUNTRY_META 24499 7.21 17.44 3.31 36 TR_MAX_INTL_RELAY 19999 7.55 14.24 5.01 37 XM_B_SpammyWords3 19712 8.06 14.03 5.78 38 BOTNET_IPINHOSTNAME 18311 5.50 13.04 2.63 39 TR_XM_SpammyRelay 17926 4.71 12.76 1.64 40 LOTS_OF_MONEY 17459 7.42 12.43 5.52 41 TR_XM_SpammyWords4 15663 5.70 11.15 3.63 42 FSL_BULK_SIG 15119 12.11 10.76 12.62 43 TR_XM_SpammyWords2 14643 3.08 10.43 0.28 44 XM_B_Phish_Phrases 14119 7.79 10.05 6.92 45 BOTNET 13738 3.58 9.78 1.21 46 RCVD_IN_BL_SPAMCOP_NET 13571 3.00 9.66 0.46 47 XM_Evil_Numbers_Gen 13506 8.98 9.62 8.74 48 BAYES_80 12423 4.66 8.84 3.07 49 TR_XM_UnparsRelay 11865 3.35 8.45 1.41 50 XM_Body_Dirty_Words 10659 3.66 7.59 2.17 51 BAYES_60 10503 6.29 7.48 5.83 52 RCVD_IN_MSPIKE_WL 10404 11.52 7.41 13.09 53 XM_B_PhoneNumber 9855 9.35 7.02 10.23 54 MPART_ALT_DIFF 9566 8.72 6.81 9.45 55 UNTRUSTED_Relay 9564 2.88 6.81 1.38 56 LotsOfNums_01 9547 8.21 6.80 8.75 57 XMSubMetaSx_00 9317 4.34 6.63 3.47 58 RELAYCOUNTRY_CA 9046 2.25 6.44 0.65 59 HTML_IMAGE_RATIO_02 9012 4.82 6.42 4.21 60 XM_H_Long_From01 8763 5.21 6.24 4.82 61 XM_UncommonTLD01 8037 4.12 5.72 3.51 62 DKIM_INVALID 7980 2.99 5.68 1.96 63 TR_XM_PhishingBody 7968 2.75 5.67 1.63 64 HTML_IMAGE_RATIO_04 7057 11.48 5.02 13.94 65 BAYES_95 6959 2.77 4.95 1.94 66 XM_B_Investor 6852 2.41 4.88 1.47 67 XMSexyCombo_05 6612 2.41 4.71 1.53 68 RCVD_IN_MSPIKE_BL 6434 1.47 4.58 0.28 69 TR_XM_MSPIKECOMBO 6431 1.46 4.58 0.28 70 XM_H_GMP 6078 4.80 4.33 4.98 71 XMStrtUSub 6071 8.49 4.32 10.08 72 T_XMDrugObfuBody_14 5932 2.39 4.22 1.69 73 XMNumbers 5792 3.77 4.12 3.63 74 XM_B_SpammyTLD 5772 2.84 4.11 2.36 75 XM_OfRef6 5728 1.80 4.08 0.93 76 TooManyTo_001 5683 7.18 4.05 8.37 77 TR_XM_SPAMCOP 5449 1.16 3.88 0.12 78 TR_XM_SpammyWords5 5373 1.89 3.83 1.16 79 XM_CamelCaseFrm001 5247 2.27 3.74 1.71 80 XM_B_Unsub2 5231 1.92 3.72 1.24 81 RCVD_IN_MSPIKE_H3 5195 5.35 3.70 5.97 82 TM2_M_VERY_LONG_WORD 5191 3.36 3.70 3.23 83 MIME_QP_LONG_LINE 5106 4.42 3.64 4.72 84 MIME_HTML_MOSTLY 5048 2.66 3.59 2.30 85 TR_XM_NoHeaderRelay 4995 1.11 3.56 0.18 86 MIME_HTML_ONLY_MULTI 4963 6.41 3.53 7.51 87 TR_XM_SpammyWords3 4825 1.04 3.44 0.13 88 XM_UB50 4787 1.58 3.41 0.89 89 T_XMDrugObfuBody_08 4622 1.83 3.29 1.28 90 XMDiploma_00 4583 1.86 3.26 1.33 91 XM_B_URI_Unicode 4539 2.03 3.23 1.57 92 HTML_IMAGE_RATIO_06 4513 4.07 3.21 4.39 93 RCVD_IN_VALIDITY_RPBL 4425 0.96 3.15 0.13 94 XM_URI_RBL 4140 1.02 2.95 0.28 95 XM_SPF_SoftFail 4105 1.75 2.92 1.30 96 HTML_IMAGE_RATIO_08 4009 2.39 2.85 2.21 97 T_TooManySym_01 4004 4.36 2.85 4.93 98 TR_XM_INV_DKIM 3883 0.82 2.76 0.08 99 RELAYCOUNTRY_AU 3824 1.19 2.72 0.60 100 RCVD_IN_MSPIKE_L3 3793 0.87 2.70 0.17 101 XM_B_SpammyWords4 3470 1.14 2.47 0.63 102 ALL_TRUSTED 3379 10.24 2.41 13.22 103 RCVD_IN_PSBL 3342 0.82 2.38 0.23 104 XMBody_17 3316 0.96 2.36 0.43 105 MAILING_LIST_MULTI 3314 2.73 2.36 2.88 106 SpammyFromTLD_02 3154 0.90 2.25 0.39 107 USER_IN_DEF_DKIM_WL 3120 9.03 2.22 11.62 108 T_FILL_THIS_FORM_SHORT 3108 1.14 2.21 0.73 109 TM2_M_URI_OPT_OUT 3105 1.85 2.21 1.71 110 HK_RANDOM_REPLYTO 3037 0.66 2.16 0.09 111 XMGenDplmaNmb 3021 1.06 2.15 0.65 112 XMStockSpam_06 2882 1.35 2.05 1.09 113 RCVD_IN_MSPIKE_H5 2873 4.18 2.05 5.00 114 FROM_EXCESS_BASE64 2871 1.67 2.04 1.53 115 BAYES_40 2867 4.70 2.04 5.71 116 HTML_MIME_NO_HTML_TAG 2789 2.22 1.99 2.31 117 T_XMDrugObfuBody_00 2776 0.95 1.98 0.55 118 DKIM_ADSP_NXDOMAIN 2699 0.71 1.92 0.25 119 XMBrknScrpt_02 2665 0.97 1.90 0.62 120 T_XMHurry_00 2605 0.78 1.85 0.37 121 XM_DK_Undo_01 2527 1.59 1.80 1.51 122 SpammyFromTLD_01 2496 1.01 1.78 0.72 123 TR_LOTS_OF_MONEY3 2366 0.63 1.68 0.23 124 SUBJ_ALL_CAPS 2362 1.34 1.68 1.21 125 RCVD_IN_VALIDITY_SAFE 2348 3.02 1.67 3.53 126 RCVD_IN_MSPIKE_H4 2336 1.99 1.66 2.11 127 URI_TRY_3LD 2308 0.80 1.64 0.48 128 SCC_BODY_URI_ONLY 2293 1.85 1.63 1.94 129 KHOP_HELO_FCRDNS 2230 2.07 1.59 2.25 130 TR_MetaPhish_Combo_01 2209 1.38 1.57 1.31 131 XMPhish14 2156 0.72 1.54 0.41 132 RCVD_IN_ZEN_LASTEXTERNAL 2142 0.42 1.53 0.00 133 SHORTCIRCUIT 2142 0.42 1.53 0.00 134 RELAYCOUNTRY_FR 2129 0.60 1.52 0.25 135 ANY_BOUNCE_MESSAGE 2015 4.14 1.43 5.17 136 BAYES_20 2013 3.82 1.43 4.72 137 BOUNCE_MESSAGE 2013 4.14 1.43 5.17 138 URI_NOVOWEL 2011 1.33 1.43 1.29 139 XMPhish30 1983 0.76 1.41 0.51 140 HTML_IMAGE_ONLY_20 1973 0.63 1.40 0.33 141 XM_SendGrid 1959 1.30 1.39 1.26 142 XM_B_Phish66 1954 0.61 1.39 0.31 143 XM_B_COPY_HTML 1931 0.96 1.37 0.81 144 XM_ProductURIs 1922 0.64 1.37 0.37 145 T_REMOTE_IMAGE 1920 2.71 1.37 3.22 146 DIET_1 1919 0.72 1.37 0.48 147 MPART_ALT_DIFF_COUNT 1899 0.75 1.35 0.52 148 HTTPS_HTTP_MISMATCH 1897 0.82 1.35 0.61 149 URI_HEX 1862 1.20 1.33 1.15 150 XM_DIRTYINTL 1825 0.41 1.30 0.08 151 RCVD_IN_PBL 1812 0.89 1.29 0.74 152 XM_H_Long_From02 1791 0.89 1.28 0.75 153 TR_Mismatch_TLD_02 1775 0.41 1.26 0.09 154 XM_B_DNDMA 1753 0.69 1.25 0.48 155 RCVD_IN_MSPIKE_L4 1744 0.36 1.24 0.02 156 TR_XM_PHPForged 1723 0.56 1.23 0.31 157 TR_LOTS_OF_MONEY2 1710 0.48 1.22 0.19 158 T_MONEY_PERCENT 1710 0.48 1.22 0.19 159 XMSexyCombo_01 1702 0.44 1.21 0.15 160 TR_XM_FormFill2 1692 0.55 1.20 0.31 161 RDNS_DYNAMIC 1689 0.45 1.20 0.17 162 TR_XM_PHPDW 1673 0.55 1.19 0.31 163 RCVD_IN_IADB_LISTED 1662 2.59 1.18 3.13 164 PLING_QUERY 1654 0.64 1.18 0.44 165 XM_H_PHPOS 1652 0.54 1.18 0.30 166 RCVD_IN_VALIDITY_CERTIFIED 1609 2.53 1.15 3.06 167 TR_XM_MSPIKECOMBO2 1592 0.32 1.13 0.00 168 XM_HighProb1 1585 0.31 1.13 0.00 169 PDS_RDNS_DYNAMIC_FP 1568 0.33 1.12 0.03 170 RCVD_IN_IADB_SPF 1524 2.31 1.09 2.77 171 RCVD_IN_IADB_DK 1453 2.05 1.03 2.44 172 XM_UB99 1448 0.28 1.03 0.00 173 RCVD_IN_IADB_SENDERID 1447 2.09 1.03 2.49 174 TR_XM_RelayPhish 1439 0.34 1.02 0.07 175 RCVD_IN_XBL 1410 0.29 1.00 0.02 176 XM_B_COVIDMETA 1368 0.35 0.97 0.11 177 RELAYCOUNTRY_GB 1358 0.64 0.97 0.51 178 XMHTML_After_End 1351 0.50 0.96 0.33 179 SHOPIFY_IMG_NOT_RCVD_SFY 1346 0.43 0.96 0.23 180 BAYES_05 1343 2.70 0.96 3.36 181 TR_Symld_Words 1340 1.27 0.95 1.39 182 XM_B_SEO 1332 0.42 0.95 0.21 183 BOTNET_NORDNS 1319 0.26 0.94 0.01 184 HTML_TAG_BALANCE_BODY 1313 0.55 0.93 0.40 185 RCVD_IN_SBL_CSS 1299 0.28 0.92 0.03 186 XMBody_78 1295 0.50 0.92 0.34 187 DKIM_ADSP_CUSTOM_MED 1292 0.75 0.92 0.68 188 TVD_RCVD_IP 1291 0.76 0.92 0.69 189 URIBL_BLACK 1290 0.26 0.92 0.01 190 TR_XM_Spammywords 1283 0.40 0.91 0.20 191 XM_S_SpammyWords 1283 0.40 0.91 0.20 192 XMBounce_01 1264 0.26 0.90 0.01 193 MultiRelay_CC 1260 0.39 0.90 0.20 194 RCVD_IN_SORBS_DUL 1248 0.27 0.89 0.03 195 XMSubMetaI_00 1245 0.51 0.89 0.37 196 XMBdyGiftCard01 1244 0.75 0.89 0.70 197 XMReplyNow 1239 0.39 0.88 0.21 198 TM2_M_A_HREF_HREF 1239 0.41 0.88 0.23 199 LongTLD 1227 0.49 0.87 0.34 200 NO_DNS_FOR_FROM 1215 0.39 0.87 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 367159 99.20 98.23 99.57 2 HTML_MESSAGE 327750 90.41 94.40 88.88 3 RELAYCOUNTRY_US 310578 83.41 81.27 84.23 4 XM_B_Unicode 267246 75.48 83.37 72.48 5 DKIM_SIGNED 243554 72.27 88.61 66.05 6 XM_DK_Pass 239922 70.20 83.70 65.07 7 DKIM_VALID 236329 69.29 82.93 64.09 8 DCC_CHECK_NEGATIVE 218794 49.63 24.14 59.34 9 BAYES_50 214322 53.57 41.62 58.12 10 DKIM_VALID_AU 192067 55.53 64.58 52.09 11 XM_B_SpammyWords 166116 51.77 69.41 45.05 12 XMListUnsubscribeExists 156998 49.19 66.54 42.58 13 XM_B_Unicode3 155557 43.86 48.25 42.19 14 DCC_CHECK 149770 49.91 74.31 40.62 15 T_TM2_M_HEADER_IN_MSG 104025 26.77 22.98 28.21 16 DKIM_VALID_EF 97295 27.53 30.55 26.39 17 HTML_FONT_LOW_CONTRAST 93500 28.38 36.31 25.36 18 LOC_TINY_FONT_1 88313 30.28 46.88 23.95 19 FVGT_m_MULTI_ODD 86961 26.33 33.53 23.58 20 XMSubLong 84202 23.72 26.04 22.83 21 MIME_HTML_ONLY 82647 24.71 30.75 22.41 22 T_KAM_HTML_FONT_INVALID 67089 21.62 30.61 18.19 23 XM_B_SpammyWords2 65263 23.56 38.94 17.70 24 RCVD_IN_MSPIKE_H2 55219 16.31 19.80 14.97 25 BAYES_00 53090 10.65 0.81 14.40 26 HTML_IMAGE_RATIO_04 51395 11.48 5.02 13.94 27 ALL_TRUSTED 48758 10.24 2.41 13.22 28 RCVD_IN_MSPIKE_WL 48252 11.52 7.41 13.09 29 XM_Multi_Part_URI 46708 15.14 21.64 12.67 30 FSL_BULK_SIG 46530 12.11 10.76 12.62 31 HTML_FONT_FACE_BAD 44418 8.92 0.71 12.05 32 TR_XM_DK_Unsub 43607 14.62 21.96 11.83 33 USER_IN_DEF_DKIM_WL 42854 9.03 2.22 11.62 34 XM_H_Trusted_IP 41885 8.23 0.00 11.36 35 UNPARSEABLE_RELAY 39052 12.50 17.53 10.59 36 XM_B_PhoneNumber 37739 9.35 7.02 10.23 37 XMStrtUSub 37155 8.49 4.32 10.08 38 MPART_ALT_DIFF 34838 8.72 6.81 9.45 39 XM_B_Unsub 33025 12.06 20.20 8.96 40 LotsOfNums_01 32270 8.21 6.80 8.75 41 XM_Evil_Numbers_Gen 32221 8.98 9.62 8.74 42 TooManyTo_001 30859 7.18 4.05 8.37 43 MIME_HTML_ONLY_MULTI 27684 6.41 3.53 7.51 44 XM_B_Phish_Phrases 25524 7.79 10.05 6.92 45 TR_XM_DK_Bayes 23623 4.80 0.59 6.41 46 TR_XM_DK_Bayes1 23045 4.69 0.58 6.25 47 TR_XM_BayesUnsub 22880 9.82 19.31 6.20 48 XM_DKIMWhitelistDomains 22068 4.34 0.01 5.98 49 RCVD_IN_MSPIKE_H3 22030 5.35 3.70 5.97 50 BAYES_60 21514 6.29 7.48 5.83 51 XM_B_SpammyWords3 21329 8.06 14.03 5.78 52 BAYES_40 21062 4.70 2.04 5.71 53 LOTS_OF_MONEY 20345 7.42 12.43 5.52 54 TR_XM_DK_Bayes2 19371 3.92 0.43 5.25 55 ANY_BOUNCE_MESSAGE 19080 4.14 1.43 5.17 56 BOUNCE_MESSAGE 19076 4.14 1.43 5.17 57 TR_MAX_INTL_RELAY 18464 7.55 14.24 5.01 58 RCVD_IN_MSPIKE_H5 18430 4.18 2.05 5.00 59 XM_H_GMP 18373 4.80 4.33 4.98 60 T_TooManySym_01 18175 4.36 2.85 4.93 61 XM_H_Long_From01 17756 5.21 6.24 4.82 62 BAYES_20 17417 3.82 1.43 4.72 63 MIME_QP_LONG_LINE 17389 4.42 3.64 4.72 64 HTML_IMAGE_RATIO_06 16199 4.07 3.21 4.39 65 HTML_IMAGE_RATIO_02 15528 4.82 6.42 4.21 66 XMSubNoVowel 15119 3.09 0.43 4.10 67 XM_DK_Undo_02 15050 13.68 38.88 4.08 68 XM_PDF 14589 3.08 0.76 3.96 69 TR_XM_SpammyWords4 13386 5.70 11.15 3.63 70 XMNumbers 13383 3.77 4.12 3.63 71 RCVD_IN_VALIDITY_SAFE 13014 3.02 1.67 3.53 72 XM_UncommonTLD01 12932 4.12 5.72 3.51 73 XMSubMetaSx_00 12791 4.34 6.63 3.47 74 BAYES_05 12389 2.70 0.96 3.36 75 RELAYCOUNTRY_META 12208 7.21 17.44 3.31 76 TooManyTo_002 12048 2.55 0.66 3.27 77 TM2_M_VERY_LONG_WORD 11911 3.36 3.70 3.23 78 T_REMOTE_IMAGE 11874 2.71 1.37 3.22 79 RCVD_IN_IADB_LISTED 11531 2.59 1.18 3.13 80 BAYES_80 11302 4.66 8.84 3.07 81 RCVD_IN_VALIDITY_CERTIFIED 11278 2.53 1.15 3.06 82 MAILING_LIST_MULTI 10610 2.73 2.36 2.88 83 BAYES_99 10466 10.42 30.33 2.84 84 RCVD_IN_IADB_SPF 10215 2.31 1.09 2.77 85 BOTNET_IPINHOSTNAME 9686 5.50 13.04 2.63 86 T_TooManySym_02 9411 2.08 0.86 2.55 87 RCVD_IN_IADB_SENDERID 9193 2.09 1.03 2.49 88 RCVD_IN_IADB_DK 8997 2.05 1.03 2.44 89 XM_B_SpammyTLD 8699 2.84 4.11 2.36 90 HTML_MIME_NO_HTML_TAG 8527 2.22 1.99 2.31 91 MIME_HTML_MOSTLY 8494 2.66 3.59 2.30 92 KHOP_HELO_FCRDNS 8312 2.07 1.59 2.25 93 MAY_BE_FORGED 8184 1.61 0.02 2.22 94 HTML_IMAGE_RATIO_08 8139 2.39 2.85 2.21 95 XM_Body_Dirty_Words 7997 3.66 7.59 2.17 96 RCVD_IN_MSPIKE_H4 7792 1.99 1.66 2.11 97 BAYES_999 7742 7.90 23.11 2.10 98 RCVD_IN_IADB_VOUCHED 7305 1.58 0.53 1.98 99 DKIM_INVALID 7225 2.99 5.68 1.96 100 BAYES_95 7153 2.77 4.95 1.94 101 SCC_BODY_URI_ONLY 7150 1.85 1.63 1.94 102 XMSubLongNoVowel 7058 1.42 0.11 1.91 103 INVALID_MSGID 6994 1.47 0.34 1.90 104 XMSubGarbage 6851 1.35 0.03 1.86 105 HTML_EXTRA_CLOSE 6634 1.31 0.03 1.80 106 TR_XM_DKIM_Undo 6528 9.17 28.60 1.77 107 TM2_M_URI_OPT_OUT 6315 1.85 2.21 1.71 108 XM_CamelCaseFrm001 6291 2.27 3.74 1.71 109 TO_MALFORMED 6253 1.24 0.03 1.70 110 T_XMDrugObfuBody_14 6230 2.39 4.22 1.69 111 TR_XM_SpammyRelay 6046 4.71 12.76 1.64 112 TR_XM_PhishingBody 6018 2.75 5.67 1.63 113 XM_B_URI_Unicode 5804 2.03 3.23 1.57 114 FROM_EXCESS_BASE64 5658 1.67 2.04 1.53 115 XMSexyCombo_05 5648 2.41 4.71 1.53 116 XM_DK_Undo_01 5563 1.59 1.80 1.51 117 XM_B_Investor 5431 2.41 4.88 1.47 118 TooManyTo_003 5379 1.20 0.51 1.46 119 RCVD_IN_IADB_OPTIN 5225 1.13 0.39 1.42 120 TR_XM_UnparsRelay 5215 3.35 8.45 1.41 121 TR_Symld_Words 5111 1.27 0.95 1.39 122 UNTRUSTED_Relay 5098 2.88 6.81 1.38 123 XMDiploma_00 4907 1.86 3.26 1.33 124 TR_MetaPhish_Combo_01 4841 1.38 1.57 1.31 125 XM_SPF_SoftFail 4796 1.75 2.92 1.30 126 URI_NOVOWEL 4755 1.33 1.43 1.29 127 T_XMDrugObfuBody_08 4706 1.83 3.29 1.28 128 XM_SendGrid 4660 1.30 1.39 1.26 129 XM_B_Unsub2 4565 1.92 3.72 1.24 130 BOTNET 4478 3.58 9.78 1.21 131 SUBJ_ALL_CAPS 4474 1.34 1.68 1.21 132 XM_GoogleGroups 4411 1.09 0.80 1.20 133 HELO_NODOT 4398 0.94 0.26 1.19 134 HELO_NO_DOMAIN 4394 0.93 0.26 1.19 135 XM_B_FormFill 4364 0.87 0.05 1.18 136 XMGappySubj_01 4317 0.92 0.26 1.17 137 TR_XM_SpammyWords5 4276 1.89 3.83 1.16 138 IN_HORDE_ADDRESS_BOOK 4257 0.87 0.11 1.15 139 URI_HEX 4255 1.20 1.33 1.15 140 XMStockSpam_06 4007 1.35 2.05 1.09 141 TooManyTo_004 3960 0.90 0.44 1.07 142 T_TooManySym_03 3849 0.87 0.41 1.04 143 XMCapTrack 3804 0.90 0.54 1.03 144 TR_DCC_Bayes_99 3740 6.51 20.94 1.01 145 XM_E_Blogspot 3595 0.75 0.17 0.97 146 XM_OfRef6 3432 1.80 4.08 0.93 147 TVD_SPACE_RATIO 3291 0.71 0.24 0.89 148 XM_UB50 3271 1.58 3.41 0.89 149 TooManyTo_005 3007 0.70 0.39 0.82 150 TR_XM_DK_SendGrid 3000 0.80 0.75 0.81 151 XM_B_COPY_HTML 2973 0.96 1.37 0.81 152 XM_ShortIntro_01 2879 0.69 0.44 0.78 153 URI_OPTOUT_3LD 2845 0.73 0.63 0.77 154 XM_H_Long_From02 2765 0.89 1.28 0.75 155 XM_H_PHPMailer 2740 0.76 0.80 0.74 156 RCVD_IN_PBL 2740 0.89 1.29 0.74 157 T_FILL_THIS_FORM_SHORT 2701 1.14 2.21 0.73 158 SpammyFromTLD_01 2657 1.01 1.78 0.72 159 XMBdyGiftCard01 2574 0.75 0.89 0.70 160 TVD_RCVD_IP 2560 0.76 0.92 0.69 161 DKIM_ADSP_CUSTOM_MED 2512 0.75 0.92 0.68 162 RELAYCOUNTRY_CA 2397 2.25 6.44 0.65 163 XMGenDplmaNmb 2392 1.06 2.15 0.65 164 FROM_GOV_DKIM_AU 2380 0.61 0.52 0.65 165 HTML_IMAGE_ONLY_32 2361 0.51 0.17 0.64 166 XM_B_SpammyWords4 2334 1.14 2.47 0.63 167 XMGappySubj_02 2317 0.47 0.05 0.63 168 XMBrknScrpt_02 2283 0.97 1.90 0.62 169 HTTPS_HTTP_MISMATCH 2265 0.82 1.35 0.61 170 XMSolicitRefs_0 2233 0.67 0.83 0.61 171 RELAYCOUNTRY_AU 2212 1.19 2.72 0.60 172 XMLngstWrd_00 2160 0.57 0.55 0.59 173 FILL_THIS_FORM 2126 0.57 0.57 0.58 174 NUMERIC_HTTP_ADDR 2099 0.46 0.17 0.57 175 T_Symld_Words_02 2053 0.63 0.83 0.56 176 T_XMDrugObfuBody_00 2043 0.95 1.98 0.55 177 XMBSHREFv2 2017 0.52 0.44 0.55 178 XMSlimDrugH 1974 0.58 0.68 0.54 179 MPART_ALT_DIFF_COUNT 1924 0.75 1.35 0.52 180 XMNoVowels 1909 0.55 0.64 0.52 181 TR_XM_Base64_M1 1902 0.59 0.78 0.52 182 RELAYCOUNTRY_GB 1881 0.64 0.97 0.51 183 XMPhish30 1876 0.76 1.41 0.51 184 URI_TRY_3LD 1774 0.80 1.64 0.48 185 XM_B_DNDMA 1763 0.69 1.25 0.48 186 DIET_1 1758 0.72 1.37 0.48 187 XMBody_95 1755 0.38 0.13 0.48 188 NML_ADSP_CUSTOM_MED 1717 0.55 0.76 0.47 189 XMLngstWrd_01 1701 0.47 0.49 0.46 190 RCVD_IN_BL_SPAMCOP_NET 1700 3.00 9.66 0.46 191 TO_NO_BRKTS_HTML_ONLY 1699 0.53 0.70 0.46 192 TM2_M_OBFU_COMMENT 1651 0.56 0.86 0.45 193 MSGID_FROM_MTA_HEADER 1644 0.36 0.15 0.45 194 PLING_QUERY 1611 0.64 1.18 0.44 195 T_OBFU_PDF_ATTACH 1602 0.35 0.13 0.43 196 XMBody_17 1596 0.96 2.36 0.43 197 XMMoneyMeta_00 1514 0.50 0.73 0.41 198 XMPhish14 1501 0.72 1.54 0.41 199 SHORT_HELO_AND_INLINE_IMAGE 1471 0.30 0.03 0.40 200 HTML_TAG_BALANCE_BODY 1467 0.55 0.93 0.40 ----------------------------------------------------------------------