Email: 512332 Autolearn: 0 AvgScore: 3.16 AvgScanTime: 1.53 sec Spam: 141165 Autolearn: 0 AvgScore: 14.54 AvgScanTime: 1.76 sec Ham: 371167 Autolearn: 0 AvgScore: -1.17 AvgScanTime: 1.44 sec Time Spent Running SA: 217.16 hours Time Spent Processing Spam: 69.02 hours Time Spent Processing Ham: 148.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 138923 99.24 98.41 99.55 2 HTML_MESSAGE 134389 90.91 95.20 89.28 3 DKIM_SIGNED 126769 71.60 89.80 64.68 4 XM_DK_Pass 118651 69.29 84.05 63.67 5 DKIM_VALID 117690 68.46 83.37 62.79 6 XM_B_Unicode 116800 76.10 82.74 73.57 7 RELAYCOUNTRY_US 115070 82.06 81.51 82.27 8 DCC_CHECK 106321 49.79 75.32 40.08 9 XM_B_SpammyWords 97032 52.16 68.74 45.86 10 XMListUnsubscribeExists 93768 48.40 66.42 41.54 11 DKIM_VALID_AU 91925 54.92 65.12 51.04 12 LOC_TINY_FONT_1 67219 30.82 47.62 24.43 13 XM_B_Unicode3 66086 43.59 46.81 42.37 14 BAYES_50 58219 53.49 41.24 58.15 15 XM_B_SpammyWords2 54885 24.67 38.88 19.27 16 XM_DK_Undo_02 54816 13.65 38.83 4.07 17 HTML_FONT_LOW_CONTRAST 53954 29.17 38.22 25.72 18 FVGT_m_MULTI_ODD 47978 25.79 33.99 22.67 19 MIME_HTML_ONLY 43558 25.30 30.86 23.19 20 DKIM_VALID_EF 43019 27.24 30.47 26.01 21 BAYES_99 42405 10.25 30.04 2.72 22 T_KAM_HTML_FONT_INVALID 42386 21.50 30.03 18.26 23 TR_XM_DKIM_Undo 39861 9.02 28.24 1.71 24 XMSubLong 35257 22.78 24.98 21.95 25 DCC_CHECK_NEGATIVE 32925 49.81 23.32 59.88 26 BAYES_999 32356 7.78 22.92 2.02 27 T_TM2_M_HEADER_IN_MSG 31787 27.30 22.52 29.12 28 TR_XM_DK_Unsub 31497 14.73 22.31 11.85 29 XM_B_Unsub 30070 12.51 21.30 9.16 30 XM_Multi_Part_URI 29354 15.01 20.79 12.82 31 TR_DCC_Bayes_99 29319 6.51 20.77 1.08 32 TR_XM_BayesUnsub 29053 10.33 20.58 6.43 33 UNPARSEABLE_RELAY 27970 13.02 19.81 10.43 34 RCVD_IN_MSPIKE_H2 26084 15.14 18.48 13.87 35 RELAYCOUNTRY_META 24323 7.05 17.23 3.17 36 TR_MAX_INTL_RELAY 21087 7.88 14.94 5.20 37 XM_B_SpammyWords3 20319 7.27 14.39 4.57 38 BOTNET_IPINHOSTNAME 19563 5.78 13.86 2.71 39 LOTS_OF_MONEY 18087 8.61 12.81 7.02 40 TR_XM_SpammyRelay 17267 4.51 12.23 1.58 41 TR_XM_SpammyWords4 15865 6.93 11.24 5.29 42 FSL_BULK_SIG 15760 12.39 11.16 12.86 43 TR_XM_UnparsRelay 15067 4.03 10.67 1.50 44 TR_XM_SpammyWords2 14244 3.03 10.09 0.34 45 BOTNET 14226 3.70 10.08 1.28 46 RCVD_IN_BL_SPAMCOP_NET 13758 3.03 9.75 0.48 47 BAYES_80 13165 4.90 9.33 3.22 48 XM_B_Phish_Phrases 13162 6.42 9.32 5.32 49 XM_Evil_Numbers_Gen 13123 10.03 9.30 10.31 50 RCVD_IN_MSPIKE_WL 11979 12.69 8.49 14.30 51 BAYES_60 11505 6.51 8.15 5.89 52 XM_Body_Dirty_Words 11135 4.14 7.89 2.71 53 XMSubMetaSx_00 10256 4.33 7.27 3.21 54 HTML_IMAGE_RATIO_02 9439 4.31 6.69 3.40 55 UNTRUSTED_Relay 9349 2.77 6.62 1.31 56 MPART_ALT_DIFF 9306 8.41 6.59 9.10 57 LotsOfNums_01 9290 6.61 6.58 6.62 58 XM_B_PhoneNumber 9265 8.60 6.56 9.37 59 DKIM_INVALID 9079 3.14 6.43 1.88 60 RELAYCOUNTRY_CA 8881 2.23 6.29 0.69 61 XM_H_Long_From01 8633 5.14 6.12 4.76 62 XM_H_GMP 8412 5.36 5.96 5.13 63 RCVD_IN_MSPIKE_BL 7962 1.81 5.64 0.35 64 TR_XM_MSPIKECOMBO 7958 1.81 5.64 0.35 65 HTML_IMAGE_RATIO_04 7848 11.65 5.56 13.97 66 XM_B_Investor 7568 2.43 5.36 1.31 67 XM_UncommonTLD01 7489 3.99 5.31 3.49 68 BAYES_95 7462 2.88 5.29 1.97 69 XMSexyCombo_05 7114 2.73 5.04 1.85 70 TR_XM_PhishingBody 6731 2.43 4.77 1.55 71 T_XMDrugObfuBody_14 6667 2.72 4.72 1.95 72 TR_XM_SPAMCOP 6472 1.34 4.58 0.11 73 XMNumbers 6360 4.26 4.51 4.17 74 MIME_QP_LONG_LINE 5932 4.19 4.20 4.18 75 TooManyTo_001 5877 7.22 4.16 8.38 76 RCVD_IN_VALIDITY_RPBL 5868 1.28 4.16 0.18 77 MIME_HTML_MOSTLY 5843 2.69 4.14 2.14 78 TM2_M_VERY_LONG_WORD 5840 2.31 4.14 1.62 79 RCVD_IN_MSPIKE_H3 5696 5.67 4.03 6.29 80 XM_OfRef6 5679 1.79 4.02 0.94 81 XM_B_URI_Unicode 5536 2.27 3.92 1.64 82 XMStrtUSub 5372 8.45 3.81 10.21 83 XM_B_SpammyTLD 5296 2.69 3.75 2.29 84 TR_XM_NoHeaderRelay 5213 1.17 3.69 0.21 85 TR_XM_SpammyWords5 5194 2.04 3.68 1.41 86 T_XMDrugObfuBody_08 5140 1.83 3.64 1.15 87 HTML_IMAGE_RATIO_06 5065 4.57 3.59 4.94 88 TR_XM_SpammyWords3 4968 1.07 3.52 0.14 89 XM_UB50 4856 1.60 3.44 0.90 90 MIME_HTML_ONLY_MULTI 4844 6.41 3.43 7.55 91 XM_CamelCaseFrm001 4827 2.31 3.42 1.89 92 XM_SPF_SoftFail 4578 1.76 3.24 1.19 93 XM_B_Unsub2 4498 1.66 3.19 1.08 94 TR_XM_INV_DKIM 4397 0.90 3.11 0.06 95 XM_URI_RBL 4158 0.98 2.95 0.24 96 T_TooManySym_01 4132 4.22 2.93 4.72 97 TM2_M_URI_OPT_OUT 4127 1.94 2.92 1.56 98 HTML_IMAGE_RATIO_08 3993 2.12 2.83 1.85 99 XMDiploma_00 3992 1.99 2.83 1.68 100 RCVD_IN_MSPIKE_L3 3881 0.88 2.75 0.17 101 RELAYCOUNTRY_AU 3760 1.16 2.66 0.59 102 XM_B_SpammyWords4 3728 1.36 2.64 0.87 103 T_FILL_THIS_FORM_SHORT 3503 1.18 2.48 0.69 104 XM_H_Long_From02 3430 1.16 2.43 0.67 105 ALL_TRUSTED 3370 11.71 2.39 15.25 106 RCVD_IN_MSPIKE_H4 3311 2.65 2.35 2.76 107 MAILING_LIST_MULTI 3129 2.49 2.22 2.59 108 FROM_EXCESS_BASE64 2979 1.57 2.11 1.37 109 RCVD_IN_MSPIKE_H5 2972 4.38 2.11 5.24 110 T_XMHurry_00 2967 0.93 2.10 0.48 111 USER_IN_DEF_DKIM_WL 2862 9.20 2.03 11.93 112 RCVD_IN_PSBL 2833 0.83 2.01 0.38 113 RCVD_IN_VALIDITY_SAFE 2818 2.95 2.00 3.32 114 XMStockSpam_06 2792 1.59 1.98 1.44 115 TR_LOTS_OF_MONEY3 2708 0.71 1.92 0.25 116 SpammyFromTLD_02 2703 0.79 1.91 0.37 117 XM_SendGrid 2472 1.49 1.75 1.40 118 BAYES_40 2437 4.98 1.73 6.21 119 DKIM_ADSP_NXDOMAIN 2430 0.65 1.72 0.24 120 SpammyFromTLD_01 2411 0.99 1.71 0.71 121 DKIM_ADSP_CUSTOM_MED 2379 1.05 1.69 0.81 122 T_XMDrugObfuBody_00 2300 0.87 1.63 0.58 123 RCVD_IN_MSPIKE_L4 2300 0.53 1.63 0.11 124 XM_DK_Undo_01 2279 1.57 1.61 1.55 125 HTML_IMAGE_ONLY_20 2258 0.66 1.60 0.31 126 HTML_MIME_NO_HTML_TAG 2249 1.98 1.59 2.13 127 RCVD_IN_VALIDITY_CERTIFIED 2230 2.35 1.58 2.64 128 URI_TRY_3LD 2229 0.76 1.58 0.44 129 XMGenDplmaNmb 2224 1.28 1.58 1.17 130 XMPhish30 2184 0.72 1.55 0.40 131 NML_ADSP_CUSTOM_MED 2161 0.86 1.53 0.60 132 SUBJ_ALL_CAPS 2138 1.26 1.51 1.17 133 T_REMOTE_IMAGE 2116 2.72 1.50 3.18 134 SCC_BODY_URI_ONLY 2099 1.83 1.49 1.96 135 XMBrknScrpt_02 2067 0.86 1.46 0.63 136 MPART_ALT_DIFF_COUNT 2066 0.78 1.46 0.52 137 FORGED_GMAIL_RCVD 2006 0.77 1.42 0.53 138 XMBody_17 2003 0.69 1.42 0.41 139 BAYES_20 1982 3.90 1.40 4.84 140 TR_XM_MSPIKECOMBO2 1943 0.38 1.38 0.00 141 ANY_BOUNCE_MESSAGE 1938 3.36 1.37 4.12 142 BOUNCE_MESSAGE 1938 3.36 1.37 4.12 143 TR_MetaPhish_Combo_01 1935 1.36 1.37 1.36 144 TR_XM_RelayPhish 1924 0.43 1.36 0.07 145 RELAYCOUNTRY_FR 1903 0.54 1.35 0.24 146 RCVD_IN_ZEN_LASTEXTERNAL 1897 0.37 1.34 0.00 147 SHORTCIRCUIT 1897 0.37 1.34 0.00 148 URI_HEX 1894 1.18 1.34 1.13 149 PLING_QUERY 1875 0.59 1.33 0.32 150 URI_NOVOWEL 1874 1.36 1.33 1.37 151 HTTPS_HTTP_MISMATCH 1861 0.79 1.32 0.59 152 XM_B_Phish66 1835 0.59 1.30 0.32 153 XM_B_COPY_HTML 1789 0.71 1.27 0.49 154 RCVD_IN_MSPIKE_L5 1780 0.40 1.26 0.08 155 RCVD_IN_PBL 1751 0.82 1.24 0.65 156 TR_LOTS_OF_MONEY2 1746 0.50 1.24 0.21 157 T_MONEY_PERCENT 1746 0.50 1.24 0.21 158 KHOP_HELO_FCRDNS 1730 1.48 1.23 1.57 159 RDNS_DYNAMIC 1702 0.44 1.21 0.14 160 XMBdyGiftCard01 1671 0.88 1.18 0.77 161 PDS_RDNS_DYNAMIC_FP 1655 0.36 1.17 0.04 162 DIET_1 1623 0.43 1.15 0.15 163 RCVD_IN_IADB_LISTED 1618 2.57 1.15 3.11 164 SHOPIFY_IMG_NOT_RCVD_SFY 1575 0.45 1.12 0.20 165 XM_B_DNDMA 1564 0.63 1.11 0.45 166 TR_XM_InvalidRelay 1552 0.31 1.10 0.01 167 XM_ProductURIs 1526 0.69 1.08 0.54 168 XM_DIRTYINTL 1525 0.34 1.08 0.06 169 XMPhish14 1492 0.64 1.06 0.48 170 BOTNET_NORDNS 1482 0.29 1.05 0.01 171 RCVD_IN_IADB_SPF 1469 2.25 1.04 2.72 172 XM_B_SEO 1456 0.43 1.03 0.20 173 THIS_AD 1452 0.54 1.03 0.35 174 XM_HighProb1 1435 0.28 1.02 0.00 175 TR_XM_PHPForged 1423 0.47 1.01 0.26 176 TVD_RCVD_IP 1416 0.88 1.00 0.83 177 TR_XM_FormFill2 1413 0.47 1.00 0.27 178 RCVD_IN_IADB_DK 1411 1.97 1.00 2.34 179 XM_B_COVIDMETA 1407 0.35 1.00 0.10 180 TR_XM_PHPDW 1397 0.46 0.99 0.26 181 RCVD_IN_IADB_SENDERID 1394 2.01 0.99 2.40 182 RCVD_IN_SBL_CSS 1394 0.29 0.99 0.03 183 RELAYCOUNTRY_GB 1389 0.59 0.98 0.44 184 XM_H_PHPOS 1377 0.46 0.98 0.26 185 TR_Symld_Words 1372 1.15 0.97 1.22 186 RCVD_IN_XBL 1354 0.28 0.96 0.01 187 XM_UB99 1346 0.27 0.95 0.00 188 T_TooManySym_02 1338 2.02 0.95 2.42 189 TM2_M_OBFU_COMMENT 1333 0.48 0.94 0.31 190 TR_XM_SEO4 1328 0.33 0.94 0.10 191 TM2_M_A_HREF_HREF 1314 0.39 0.93 0.18 192 XMHTML_After_End 1307 0.47 0.93 0.30 193 URIBL_BLACK 1306 0.27 0.93 0.02 194 XM_Nigeria_01 1296 0.26 0.92 0.01 195 XMSubMetaSxObfu_03 1285 0.74 0.91 0.68 196 TR_Mismatch_TLD_02 1244 0.29 0.88 0.06 197 HELO_DYNAMIC_SPLIT_IP 1240 0.24 0.88 0.00 198 TR_XM_Base64_M1 1233 0.72 0.87 0.67 199 XMSubMetaI_00 1222 0.54 0.87 0.41 200 RELAYCOUNTRY_CN 1208 0.28 0.86 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 369490 99.24 98.41 99.55 2 HTML_MESSAGE 331368 90.91 95.20 89.28 3 RELAYCOUNTRY_US 305350 82.06 81.51 82.27 4 XM_B_Unicode 273075 76.10 82.74 73.57 5 DKIM_SIGNED 240066 71.60 89.80 64.68 6 XM_DK_Pass 236333 69.29 84.05 63.67 7 DKIM_VALID 233073 68.46 83.37 62.79 8 DCC_CHECK_NEGATIVE 222251 49.81 23.32 59.88 9 BAYES_50 215835 53.49 41.24 58.15 10 DKIM_VALID_AU 189429 54.92 65.12 51.04 11 XM_B_SpammyWords 170215 52.16 68.74 45.86 12 XM_B_Unicode3 157248 43.59 46.81 42.37 13 XMListUnsubscribeExists 154185 48.40 66.42 41.54 14 DCC_CHECK 148747 49.79 75.32 40.08 15 T_TM2_M_HEADER_IN_MSG 108077 27.30 22.52 29.12 16 DKIM_VALID_EF 96529 27.24 30.47 26.01 17 HTML_FONT_LOW_CONTRAST 95475 29.17 38.22 25.72 18 LOC_TINY_FONT_1 90693 30.82 47.62 24.43 19 MIME_HTML_ONLY 86075 25.30 30.86 23.19 20 FVGT_m_MULTI_ODD 84159 25.79 33.99 22.67 21 XMSubLong 81477 22.78 24.98 21.95 22 XM_B_SpammyWords2 71516 24.67 38.88 19.27 23 T_KAM_HTML_FONT_INVALID 67775 21.50 30.03 18.26 24 ALL_TRUSTED 56607 11.71 2.39 15.25 25 RCVD_IN_MSPIKE_WL 53060 12.69 8.49 14.30 26 HTML_IMAGE_RATIO_04 51846 11.65 5.56 13.97 27 RCVD_IN_MSPIKE_H2 51473 15.14 18.48 13.87 28 BAYES_00 50685 10.10 0.74 13.66 29 FSL_BULK_SIG 47723 12.39 11.16 12.86 30 XM_Multi_Part_URI 47569 15.01 20.79 12.82 31 HTML_FONT_FACE_BAD 46895 9.34 0.69 12.63 32 USER_IN_DEF_DKIM_WL 44269 9.20 2.03 11.93 33 XM_H_Trusted_IP 44028 8.59 0.00 11.86 34 TR_XM_DK_Unsub 43978 14.73 22.31 11.85 35 UNPARSEABLE_RELAY 38730 13.02 19.81 10.43 36 XM_Evil_Numbers_Gen 38259 10.03 9.30 10.31 37 XMStrtUSub 37898 8.45 3.81 10.21 38 XM_B_PhoneNumber 34789 8.60 6.56 9.37 39 XM_B_Unsub 33998 12.51 21.30 9.16 40 MPART_ALT_DIFF 33771 8.41 6.59 9.10 41 TooManyTo_001 31095 7.22 4.16 8.38 42 MIME_HTML_ONLY_MULTI 28017 6.41 3.43 7.55 43 LOTS_OF_MONEY 26038 8.61 12.81 7.02 44 LotsOfNums_01 24555 6.61 6.58 6.62 45 XM_DKIMWhitelistDomains 23921 4.69 0.06 6.44 46 TR_XM_BayesUnsub 23865 10.33 20.58 6.43 47 RCVD_IN_MSPIKE_H3 23355 5.67 4.03 6.29 48 BAYES_40 23056 4.98 1.73 6.21 49 TR_XM_DK_Bayes 22395 4.53 0.57 6.03 50 TR_XM_DK_Bayes1 21935 4.44 0.56 5.91 51 BAYES_60 21853 6.51 8.15 5.89 52 XM_B_Phish_Phrases 19744 6.42 9.32 5.32 53 TR_XM_SpammyWords4 19619 6.93 11.24 5.29 54 RCVD_IN_MSPIKE_H5 19462 4.38 2.11 5.24 55 TR_MAX_INTL_RELAY 19291 7.88 14.94 5.20 56 XM_H_GMP 19049 5.36 5.96 5.13 57 HTML_IMAGE_RATIO_06 18323 4.57 3.59 4.94 58 TR_XM_DK_Bayes2 18307 3.70 0.45 4.93 59 BAYES_20 17980 3.90 1.40 4.84 60 XM_H_Long_From01 17679 5.14 6.12 4.76 61 T_TooManySym_01 17506 4.22 2.93 4.72 62 XM_B_SpammyWords3 16944 7.27 14.39 4.57 63 XMSubNoVowel 15937 3.21 0.38 4.29 64 MIME_QP_LONG_LINE 15514 4.19 4.20 4.18 65 XMNumbers 15479 4.26 4.51 4.17 66 ANY_BOUNCE_MESSAGE 15292 3.36 1.37 4.12 67 BOUNCE_MESSAGE 15291 3.36 1.37 4.12 68 XM_DK_Undo_02 15099 13.65 38.83 4.07 69 XM_PDF 13589 2.84 0.69 3.66 70 XM_UncommonTLD01 12943 3.99 5.31 3.49 71 TooManyTo_002 12723 2.67 0.69 3.43 72 HTML_IMAGE_RATIO_02 12632 4.31 6.69 3.40 73 BAYES_05 12377 2.62 0.75 3.33 74 RCVD_IN_VALIDITY_SAFE 12310 2.95 2.00 3.32 75 BAYES_80 11953 4.90 9.33 3.22 76 XMSubMetaSx_00 11917 4.33 7.27 3.21 77 T_REMOTE_IMAGE 11796 2.72 1.50 3.18 78 RELAYCOUNTRY_META 11780 7.05 17.23 3.17 79 RCVD_IN_IADB_LISTED 11527 2.57 1.15 3.11 80 RCVD_IN_MSPIKE_H4 10243 2.65 2.35 2.76 81 BAYES_99 10104 10.25 30.04 2.72 82 RCVD_IN_IADB_SPF 10078 2.25 1.04 2.72 83 XM_Body_Dirty_Words 10055 4.14 7.89 2.71 84 BOTNET_IPINHOSTNAME 10045 5.78 13.86 2.71 85 RCVD_IN_VALIDITY_CERTIFIED 9787 2.35 1.58 2.64 86 MAILING_LIST_MULTI 9605 2.49 2.22 2.59 87 T_TooManySym_02 8995 2.02 0.95 2.42 88 RCVD_IN_IADB_SENDERID 8916 2.01 0.99 2.40 89 RCVD_IN_IADB_DK 8667 1.97 1.00 2.34 90 XM_B_SpammyTLD 8499 2.69 3.75 2.29 91 MIME_HTML_MOSTLY 7943 2.69 4.14 2.14 92 HTML_MIME_NO_HTML_TAG 7915 1.98 1.59 2.13 93 XMSubLongNoVowel 7822 1.56 0.10 2.11 94 RCVD_IN_IADB_VOUCHED 7779 1.66 0.52 2.10 95 XMSubGarbage 7648 1.50 0.03 2.06 96 BAYES_999 7498 7.78 22.92 2.02 97 BAYES_95 7317 2.88 5.29 1.97 98 SCC_BODY_URI_ONLY 7272 1.83 1.49 1.96 99 T_XMDrugObfuBody_14 7255 2.72 4.72 1.95 100 INVALID_MSGID 7185 1.49 0.32 1.94 101 XM_CamelCaseFrm001 7022 2.31 3.42 1.89 102 DKIM_INVALID 6993 3.14 6.43 1.88 103 XMSexyCombo_05 6885 2.73 5.04 1.85 104 HTML_IMAGE_RATIO_08 6885 2.12 2.83 1.85 105 TR_XM_DKIM_Undo 6358 9.02 28.24 1.71 106 TO_MALFORMED 6258 1.23 0.02 1.69 107 XMDiploma_00 6220 1.99 2.83 1.68 108 XM_B_URI_Unicode 6094 2.27 3.92 1.64 109 TM2_M_VERY_LONG_WORD 6013 2.31 4.14 1.62 110 TR_XM_SpammyRelay 5855 4.51 12.23 1.58 111 KHOP_HELO_FCRDNS 5844 1.48 1.23 1.57 112 TM2_M_URI_OPT_OUT 5805 1.94 2.92 1.56 113 TR_XM_PhishingBody 5741 2.43 4.77 1.55 114 XM_DK_Undo_01 5741 1.57 1.61 1.55 115 TR_XM_UnparsRelay 5569 4.03 10.67 1.50 116 TooManyTo_003 5463 1.22 0.56 1.47 117 RCVD_IN_IADB_OPTIN 5424 1.13 0.28 1.46 118 XMStockSpam_06 5356 1.59 1.98 1.44 119 TR_XM_SpammyWords5 5245 2.04 3.68 1.41 120 XM_SendGrid 5179 1.49 1.75 1.40 121 XM_B_FormFill 5145 1.01 0.01 1.39 122 XMGappySubj_01 5089 1.15 0.56 1.37 123 FROM_EXCESS_BASE64 5086 1.57 2.11 1.37 124 URI_NOVOWEL 5080 1.36 1.33 1.37 125 TR_MetaPhish_Combo_01 5048 1.36 1.37 1.36 126 UNTRUSTED_Relay 4866 2.77 6.62 1.31 127 XM_B_Investor 4861 2.43 5.36 1.31 128 BOTNET 4749 3.70 10.08 1.28 129 TR_Symld_Words 4519 1.15 0.97 1.22 130 XM_SPF_SoftFail 4434 1.76 3.24 1.19 131 SUBJ_ALL_CAPS 4339 1.26 1.51 1.17 132 XMGenDplmaNmb 4329 1.28 1.58 1.17 133 XM_GoogleGroups 4323 1.08 0.86 1.16 134 T_XMDrugObfuBody_08 4253 1.83 3.64 1.15 135 IN_HORDE_ADDRESS_BOOK 4228 0.85 0.09 1.14 136 URI_HEX 4176 1.18 1.34 1.13 137 HELO_NODOT 4138 0.84 0.10 1.11 138 HELO_NO_DOMAIN 4136 0.83 0.10 1.11 139 TR_DCC_Bayes_99 4024 6.51 20.77 1.08 140 TooManyTo_004 4003 0.92 0.50 1.08 141 XM_B_Unsub2 3997 1.66 3.19 1.08 142 XM_E_Blogspot 3787 0.79 0.17 1.02 143 XMCapTrack 3747 0.86 0.48 1.01 144 T_TooManySym_03 3600 0.82 0.41 0.97 145 XM_ShortIntro_01 3518 0.77 0.29 0.95 146 XM_OfRef6 3490 1.79 4.02 0.94 147 XM_UB50 3327 1.60 3.44 0.90 148 T_TVD_MIME_NO_HEADERS 3297 0.66 0.05 0.89 149 XM_B_SpammyWords4 3242 1.36 2.64 0.87 150 TVD_RCVD_IP 3092 0.88 1.00 0.83 151 TVD_SPACE_RATIO 3068 0.65 0.17 0.83 152 TR_XM_DK_SendGrid 3067 0.83 0.83 0.83 153 TooManyTo_005 3059 0.72 0.45 0.82 154 DKIM_ADSP_CUSTOM_MED 2989 1.05 1.69 0.81 155 FROM_GOV_DKIM_AU 2984 0.71 0.45 0.80 156 XMBdyGiftCard01 2861 0.88 1.18 0.77 157 XM_H_PHPMailer 2852 0.72 0.60 0.77 158 XMGappySubj_02 2819 0.56 0.05 0.76 159 URI_OPTOUT_3LD 2793 0.70 0.55 0.75 160 HTML_TAG_BALANCE_BODY 2670 0.75 0.82 0.72 161 SpammyFromTLD_01 2643 0.99 1.71 0.71 162 T_FILL_THIS_FORM_SHORT 2563 1.18 2.48 0.69 163 XMNoVowels 2556 0.66 0.60 0.69 164 RELAYCOUNTRY_CA 2555 2.23 6.29 0.69 165 XMSubMetaSxObfu_03 2528 0.74 0.91 0.68 166 HTML_IMAGE_ONLY_32 2525 0.54 0.16 0.68 167 XM_H_Long_From02 2491 1.16 2.43 0.67 168 TR_XM_Base64_M1 2469 0.72 0.87 0.67 169 RCVD_IN_PBL 2428 0.82 1.24 0.65 170 XMBrknScrpt_02 2324 0.86 1.46 0.63 171 T_Symld_Words_02 2314 0.66 0.75 0.62 172 NML_ADSP_CUSTOM_MED 2239 0.86 1.53 0.60 173 RELAYCOUNTRY_AU 2204 1.16 2.66 0.59 174 HTTPS_HTTP_MISMATCH 2183 0.79 1.32 0.59 175 XM_RXBody 2180 0.59 0.60 0.59 176 T_XMDrugObfuBody_00 2170 0.87 1.63 0.58 177 FILL_THIS_FORM 2093 0.49 0.30 0.56 178 XM_ProductURIs 2020 0.69 1.08 0.54 179 XMBSHREFv2 2013 0.51 0.43 0.54 180 XMLngstWrd_00 2001 0.60 0.75 0.54 181 FORGED_GMAIL_RCVD 1964 0.77 1.42 0.53 182 MPART_ALT_DIFF_COUNT 1940 0.78 1.46 0.52 183 T_OBFU_PDF_ATTACH 1855 0.40 0.14 0.50 184 XM_B_COPY_HTML 1834 0.71 1.27 0.49 185 XMSlimDrugH 1832 0.55 0.69 0.49 186 T_XMHurry_00 1782 0.93 2.10 0.48 187 XMPhish14 1775 0.64 1.06 0.48 188 XMLngstWrd_01 1773 0.52 0.64 0.48 189 MSGID_FROM_MTA_HEADER 1767 0.38 0.12 0.48 190 RCVD_IN_BL_SPAMCOP_NET 1767 3.03 9.75 0.48 191 XM_B_DNDMA 1656 0.63 1.11 0.45 192 URI_TRY_3LD 1643 0.76 1.58 0.44 193 RELAYCOUNTRY_GB 1629 0.59 0.98 0.44 194 XMBody_17 1540 0.69 1.42 0.41 195 XMSubMetaI_00 1526 0.54 0.87 0.41 196 XMPhish30 1491 0.72 1.55 0.40 197 TO_NO_BRKTS_HTML_ONLY 1489 0.51 0.80 0.40 198 MAY_BE_FORGED 1466 0.29 0.02 0.39 199 XMMoneyMeta_00 1452 0.48 0.72 0.39 200 T_STY_INVIS_DIRECT 1441 0.51 0.84 0.39 ----------------------------------------------------------------------