Email: 462517 Autolearn: 0 AvgScore: 5.16 AvgScanTime: 1.49 sec Spam: 146274 Autolearn: 0 AvgScore: 14.29 AvgScanTime: 1.67 sec Ham: 316243 Autolearn: 0 AvgScore: 0.94 AvgScanTime: 1.41 sec Time Spent Running SA: 191.44 hours Time Spent Processing Spam: 67.79 hours Time Spent Processing Ham: 123.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 144035 99.12 98.47 99.43 2 HTML_MESSAGE 139750 90.18 95.54 87.70 3 DKIM_SIGNED 131331 80.27 89.78 75.87 4 XM_DK_Pass 126101 78.42 86.21 74.81 5 DKIM_VALID 125212 77.54 85.60 73.81 6 XM_B_Unicode 124892 75.14 85.38 70.40 7 RELAYCOUNTRY_US 120480 82.35 82.37 82.34 8 DCC_CHECK 111390 52.07 76.15 40.94 9 XM_B_SpammyWords 101554 53.03 69.43 45.44 10 XMListUnsubscribeExists 101050 56.12 69.08 50.12 11 DKIM_VALID_AU 99677 62.53 68.14 59.93 12 XM_B_Unicode3 72396 43.39 49.49 40.57 13 LOC_TINY_FONT_1 72174 35.25 49.34 28.73 14 BAYES_50 63108 55.83 43.14 61.69 15 XM_B_SpammyWords2 59502 25.88 40.68 19.04 16 XM_DK_Undo_02 57955 15.76 39.62 4.72 17 HTML_FONT_LOW_CONTRAST 56213 32.00 38.43 29.03 18 FVGT_m_MULTI_ODD 51703 29.20 35.35 26.35 19 DKIM_VALID_EF 47703 30.86 32.61 30.05 20 T_KAM_HTML_FONT_INVALID 45819 25.41 31.32 22.67 21 BAYES_99 43303 11.57 29.60 3.23 22 MIME_HTML_ONLY 43148 23.48 29.50 20.70 23 TR_XM_DKIM_Undo 40530 10.06 27.71 1.90 24 XMSubLong 38402 24.13 26.25 23.15 25 TR_XM_DK_Unsub 35374 17.36 24.18 14.21 26 BAYES_999 33559 8.92 22.94 2.44 27 DCC_CHECK_NEGATIVE 32884 47.45 22.48 58.99 28 T_TM2_M_HEADER_IN_MSG 32859 27.37 22.46 29.63 29 XM_Multi_Part_URI 32670 17.03 22.33 14.58 30 TR_DCC_Bayes_99 31148 7.56 21.29 1.21 31 XM_B_Unsub 28983 13.77 19.81 10.98 32 RCVD_IN_MSPIKE_H2 28381 17.17 19.40 16.14 33 TR_XM_BayesUnsub 27821 11.12 19.02 7.46 34 UNPARSEABLE_RELAY 27692 14.32 18.93 12.18 35 RELAYCOUNTRY_META 23443 7.57 16.03 3.66 36 XM_B_SpammyWords3 22064 8.03 15.08 4.77 37 LOTS_OF_MONEY 21851 9.28 14.94 6.66 38 TR_MAX_INTL_RELAY 20003 8.34 13.68 5.88 39 BOTNET_IPINHOSTNAME 19122 6.28 13.07 3.14 40 TR_XM_SpammyWords4 18973 7.33 12.97 4.72 41 TR_XM_SpammyRelay 18002 5.27 12.31 2.01 42 FSL_BULK_SIG 16108 9.35 11.01 8.58 43 XM_Evil_Numbers_Gen 15591 9.35 10.66 8.75 44 TR_XM_SpammyWords2 15195 3.57 10.39 0.41 45 RCVD_IN_BL_SPAMCOP_NET 14117 3.49 9.65 0.64 46 XM_B_Phish_Phrases 14039 7.05 9.60 5.87 47 BOTNET 13970 3.97 9.55 1.39 48 RCVD_IN_MSPIKE_WL 13439 14.63 9.19 17.14 49 TR_XM_UnparsRelay 13358 3.95 9.13 1.56 50 BAYES_80 12433 5.15 8.50 3.60 51 XMSubMetaSx_00 11918 5.31 8.15 4.00 52 BAYES_60 11353 7.08 7.76 6.76 53 XM_Body_Dirty_Words 11341 4.20 7.75 2.56 54 LotsOfNums_01 11042 8.12 7.55 8.39 55 XM_B_PhoneNumber 9766 10.03 6.68 11.58 56 HTML_IMAGE_RATIO_02 9104 5.12 6.22 4.61 57 RELAYCOUNTRY_CA 9080 2.55 6.21 0.85 58 UNTRUSTED_Relay 8785 2.90 6.01 1.46 59 MPART_ALT_DIFF 8279 4.71 5.66 4.27 60 XM_H_Long_From01 8267 5.65 5.65 5.66 61 HTML_IMAGE_RATIO_04 7936 4.35 5.43 3.85 62 XM_UncommonTLD01 7596 4.35 5.19 3.96 63 TR_XM_PhishingBody 7248 2.74 4.96 1.71 64 XMSexyCombo_05 7212 2.44 4.93 1.29 65 TR_XM_SPAMCOP 7160 1.64 4.89 0.14 66 XM_B_Investor 7102 2.65 4.86 1.63 67 XM_B_SpammyTLD 7032 3.57 4.81 2.99 68 TR_XM_MSPIKECOMBO 6995 1.92 4.78 0.59 69 RCVD_IN_MSPIKE_BL 6995 1.92 4.78 0.59 70 BAYES_95 6916 3.05 4.73 2.27 71 RCVD_IN_MSPIKE_H3 6718 6.84 4.59 7.88 72 XM_H_GMP 6664 5.31 4.56 5.65 73 DKIM_INVALID 6119 2.73 4.18 2.06 74 T_XMDrugObfuBody_14 6072 2.90 4.15 2.33 75 XMDiploma_00 5755 2.57 3.93 1.93 76 XM_OfRef6 5731 2.12 3.92 1.29 77 TooManyTo_001 5676 7.88 3.88 9.73 78 TR_XM_SpammyWords3 5583 1.38 3.82 0.25 79 XMStrtUSub 5556 4.23 3.80 4.43 80 TM2_M_VERY_LONG_WORD 5523 2.49 3.78 1.89 81 XMNumbers 5497 4.55 3.76 4.91 82 RCVD_IN_VALIDITY_RPBL 5451 1.26 3.73 0.12 83 MIME_HTML_MOSTLY 5301 2.49 3.62 1.97 84 TR_XM_SpammyWords5 5285 2.26 3.61 1.63 85 XM_CamelCaseFrm001 5136 2.50 3.51 2.03 86 HTML_IMAGE_RATIO_06 5121 3.45 3.50 3.43 87 XM_B_Unsub2 4994 1.97 3.41 1.31 88 HTML_IMAGE_RATIO_08 4976 2.56 3.40 2.17 89 TR_LOTS_OF_MONEY3 4882 1.43 3.34 0.55 90 T_XMDrugObfuBody_08 4796 2.02 3.28 1.44 91 RCVD_IN_MSPIKE_L3 4786 1.29 3.27 0.38 92 XM_URI_RBL 4759 1.23 3.25 0.29 93 MIME_QP_LONG_LINE 4625 4.62 3.16 5.30 94 MIME_HTML_ONLY_MULTI 4440 2.83 3.04 2.73 95 XM_UB50 4379 1.59 2.99 0.94 96 RELAYCOUNTRY_AU 4336 1.46 2.96 0.76 97 RCVD_IN_MSPIKE_H4 4164 3.33 2.85 3.55 98 TR_XM_NoHeaderRelay 3944 0.98 2.70 0.19 99 XM_SPF_SoftFail 3930 1.87 2.69 1.49 100 XM_B_URI_Unicode 3927 2.09 2.68 1.82 101 T_TooManySym_01 3894 4.60 2.66 5.50 102 TM2_M_URI_OPT_OUT 3780 2.18 2.58 1.99 103 T_FILL_THIS_FORM_SHORT 3640 1.34 2.49 0.81 104 URI_HEX 3612 1.64 2.47 1.25 105 ALL_TRUSTED 3549 10.82 2.43 14.70 106 XM_B_SpammyWords4 3468 1.21 2.37 0.68 107 XMGenDplmaNmb 3446 1.48 2.36 1.08 108 USER_IN_DEF_DKIM_WL 3301 9.65 2.26 13.07 109 XMStockSpam_06 3291 1.63 2.25 1.35 110 FROM_EXCESS_BASE64 3226 1.91 2.21 1.78 111 MAILING_LIST_MULTI 3038 2.69 2.08 2.98 112 XMBody_17 2947 1.02 2.01 0.56 113 RCVD_IN_PSBL 2942 1.01 2.01 0.55 114 BAYES_40 2904 4.15 1.99 5.15 115 RCVD_IN_VALIDITY_SAFE 2881 3.30 1.97 3.91 116 TR_XM_INV_DKIM 2820 0.68 1.93 0.11 117 XMBrknScrpt_02 2755 1.14 1.88 0.80 118 XM_DK_Undo_01 2724 1.81 1.86 1.79 119 SpammyFromTLD_01 2635 1.10 1.80 0.78 120 MPART_ALT_DIFF_COUNT 2603 0.97 1.78 0.59 121 RCVD_IN_MSPIKE_H5 2557 4.46 1.75 5.71 122 T_XMHurry_00 2495 1.01 1.71 0.68 123 SpammyFromTLD_02 2480 0.87 1.70 0.49 124 URI_NOVOWEL 2466 1.59 1.69 1.54 125 KHOP_HELO_FCRDNS 2394 1.53 1.64 1.48 126 T_REMOTE_IMAGE 2366 3.02 1.62 3.67 127 T_XMDrugObfuBody_00 2309 1.04 1.58 0.79 128 URI_TRY_3LD 2306 0.93 1.58 0.64 129 SUBJ_ALL_CAPS 2277 1.56 1.56 1.57 130 HTML_MIME_NO_HTML_TAG 2265 2.27 1.55 2.61 131 RELAYCOUNTRY_FR 2159 0.67 1.48 0.29 132 T_MONEY_PERCENT 2157 0.64 1.47 0.25 133 TR_LOTS_OF_MONEY2 2157 0.64 1.47 0.25 134 XMSexyCombo_01 2144 0.57 1.47 0.16 135 RCVD_IN_VALIDITY_CERTIFIED 2138 2.75 1.46 3.35 136 XM_SendGrid 2132 1.36 1.46 1.32 137 XM_B_DNDMA 2122 0.74 1.45 0.41 138 TR_XM_RelayPhish 2112 0.50 1.44 0.06 139 XM_H_Long_From02 2109 1.04 1.44 0.85 140 XMPhish30 2075 0.82 1.42 0.55 141 XM_DIRTYINTL 2023 0.49 1.38 0.08 142 SCC_BODY_URI_ONLY 2017 1.97 1.38 2.24 143 TR_XM_MSPIKECOMBO2 2015 0.44 1.38 0.01 144 SHORTCIRCUIT 1973 0.43 1.35 0.00 145 RCVD_IN_ZEN_LASTEXTERNAL 1973 0.43 1.35 0.00 146 XM_ProductURIs 1947 0.72 1.33 0.44 147 HTTPS_HTTP_MISMATCH 1866 0.88 1.28 0.69 148 BAYES_20 1844 2.80 1.26 3.51 149 SHOPIFY_IMG_NOT_RCVD_SFY 1834 0.58 1.25 0.27 150 RDNS_DYNAMIC 1819 0.51 1.24 0.17 151 XMBdyGiftCard01 1790 0.74 1.22 0.51 152 XMSubMetaSxObfu_03 1771 0.74 1.21 0.52 153 PDS_RDNS_DYNAMIC_FP 1768 0.41 1.21 0.05 154 BOTNET_NORDNS 1752 0.39 1.20 0.01 155 XM_B_Phish66 1711 0.60 1.17 0.34 156 TR_MetaPhish_Combo_01 1703 1.37 1.16 1.46 157 RCVD_IN_PBL 1681 0.83 1.15 0.69 158 XM_UB99 1644 0.36 1.12 0.00 159 XMSubMetaI_00 1633 0.76 1.12 0.60 160 RCVD_IN_IADB_LISTED 1632 2.93 1.12 3.76 161 XM_B_COPY_HTML 1629 0.77 1.11 0.61 162 XM_HighProb1 1628 0.35 1.11 0.00 163 XM_B_SEO 1626 0.50 1.11 0.22 164 XMReplyNow 1575 0.49 1.08 0.22 165 HTML_IMAGE_ONLY_20 1568 0.57 1.07 0.34 166 XMBody_78 1563 0.64 1.07 0.44 167 DIET_1 1560 0.49 1.07 0.22 168 TR_XM_PHPForged 1556 0.54 1.06 0.30 169 TR_XM_PHPDW 1550 0.54 1.06 0.31 170 TR_XM_FormFill2 1540 0.54 1.05 0.30 171 T_Symld_Words_02 1535 0.68 1.05 0.51 172 XMPhish14 1533 0.65 1.05 0.46 173 TVD_RCVD_IP 1531 0.88 1.05 0.80 174 HTML_FONT_TINY_NORDNS 1527 0.39 1.04 0.09 175 RCVD_IN_SBL_CSS 1520 0.35 1.04 0.03 176 RCVD_IN_XBL 1495 0.34 1.02 0.02 177 XM_H_PHPOS 1493 0.52 1.02 0.29 178 TR_XM_Base64_M1 1466 0.75 1.00 0.63 179 RCVD_IN_IADB_SPF 1463 2.59 1.00 3.33 180 BAYES_00 1393 8.26 0.95 11.64 181 THIS_AD 1374 0.49 0.94 0.29 182 RCVD_IN_IADB_SENDERID 1373 2.34 0.94 2.99 183 TR_Symld_Words 1373 1.27 0.94 1.42 184 RCVD_IN_IADB_DK 1371 2.28 0.94 2.90 185 XM_B_COVIDMETA 1360 0.52 0.93 0.33 186 TR_XM_DK_SendGrid 1345 0.85 0.92 0.82 187 TR_XM_FormFill 1327 0.29 0.91 0.01 188 TR_XM_SEO4 1310 0.35 0.90 0.10 189 MultiRelay_CC 1308 0.37 0.89 0.12 190 HTML_TAG_BALANCE_BODY 1306 0.59 0.89 0.45 191 URIBL_BLACK 1305 0.30 0.89 0.02 192 DKIM_ADSP_CUSTOM_MED 1293 0.82 0.88 0.79 193 TM2_M_A_HREF_HREF 1288 0.43 0.88 0.22 194 RCVD_IN_MSPIKE_L4 1287 0.35 0.88 0.11 195 TM2_M_OBFU_COMMENT 1273 0.65 0.87 0.55 196 ANY_BOUNCE_MESSAGE 1263 2.70 0.86 3.55 197 BOUNCE_MESSAGE 1260 2.70 0.86 3.55 198 XMSubMetaSSx_00 1256 0.43 0.86 0.23 199 XMHTML_After_End 1247 0.53 0.85 0.38 200 T_STY_INVIS_DIRECT 1214 0.56 0.83 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 314434 99.12 98.47 99.43 2 HTML_MESSAGE 277348 90.18 95.54 87.70 3 RELAYCOUNTRY_US 260397 82.35 82.37 82.34 4 DKIM_SIGNED 239941 80.27 89.78 75.87 5 XM_DK_Pass 236592 78.42 86.21 74.81 6 DKIM_VALID 233430 77.54 85.60 73.81 7 XM_B_Unicode 222648 75.14 85.38 70.40 8 BAYES_50 195103 55.83 43.14 61.69 9 DKIM_VALID_AU 189533 62.53 68.14 59.93 10 DCC_CHECK_NEGATIVE 186562 47.45 22.48 58.99 11 XMListUnsubscribeExists 158493 56.12 69.08 50.12 12 XM_B_SpammyWords 143704 53.03 69.43 45.44 13 DCC_CHECK 129456 52.07 76.15 40.94 14 XM_B_Unicode3 128296 43.39 49.49 40.57 15 DKIM_VALID_EF 95035 30.86 32.61 30.05 16 T_TM2_M_HEADER_IN_MSG 93709 27.37 22.46 29.63 17 HTML_FONT_LOW_CONTRAST 91813 32.00 38.43 29.03 18 LOC_TINY_FONT_1 90868 35.25 49.34 28.73 19 FVGT_m_MULTI_ODD 83330 29.20 35.35 26.35 20 XMSubLong 73204 24.13 26.25 23.15 21 T_KAM_HTML_FONT_INVALID 71704 25.41 31.32 22.67 22 MIME_HTML_ONLY 65456 23.48 29.50 20.70 23 XM_B_SpammyWords2 60210 25.88 40.68 19.04 24 RCVD_IN_MSPIKE_WL 54212 14.63 9.19 17.14 25 RCVD_IN_MSPIKE_H2 51028 17.17 19.40 16.14 26 ALL_TRUSTED 46480 10.82 2.43 14.70 27 XM_Multi_Part_URI 46097 17.03 22.33 14.58 28 TR_XM_DK_Unsub 44923 17.36 24.18 14.21 29 USER_IN_DEF_DKIM_WL 41325 9.65 2.26 13.07 30 UNPARSEABLE_RELAY 38525 14.32 18.93 12.18 31 BAYES_00 36811 8.26 0.95 11.64 32 XM_B_PhoneNumber 36613 10.03 6.68 11.58 33 XM_B_Unsub 34727 13.77 19.81 10.98 34 TooManyTo_001 30767 7.88 3.88 9.73 35 XM_Evil_Numbers_Gen 27666 9.35 10.66 8.75 36 FSL_BULK_SIG 27121 9.35 11.01 8.58 37 LotsOfNums_01 26532 8.12 7.55 8.39 38 RCVD_IN_MSPIKE_H3 24926 6.84 4.59 7.88 39 TR_XM_BayesUnsub 23596 11.12 19.02 7.46 40 TR_XM_DK_Bayes 22562 5.10 0.71 7.13 41 TR_XM_DK_Bayes1 22234 5.03 0.70 7.03 42 BAYES_60 21391 7.08 7.76 6.76 43 XM_DKIMWhitelistDomains 21224 4.59 0.00 6.71 44 LOTS_OF_MONEY 21056 9.28 14.94 6.66 45 TR_MAX_INTL_RELAY 18581 8.34 13.68 5.88 46 XM_B_Phish_Phrases 18555 7.05 9.60 5.87 47 TR_XM_DK_Bayes2 18504 4.14 0.43 5.85 48 RCVD_IN_MSPIKE_H5 18055 4.46 1.75 5.71 49 XM_H_Long_From01 17887 5.65 5.65 5.66 50 XM_H_GMP 17874 5.31 4.56 5.65 51 T_TooManySym_01 17379 4.60 2.66 5.50 52 MIME_QP_LONG_LINE 16763 4.62 3.16 5.30 53 BAYES_40 16293 4.15 1.99 5.15 54 XMNumbers 15530 4.55 3.76 4.91 55 XM_B_SpammyWords3 15081 8.03 15.08 4.77 56 XM_DK_Undo_02 14938 15.76 39.62 4.72 57 TR_XM_SpammyWords4 14936 7.33 12.97 4.72 58 XM_PDF 14801 3.41 0.67 4.68 59 HTML_IMAGE_RATIO_02 14593 5.12 6.22 4.61 60 XMStrtUSub 14018 4.23 3.80 4.43 61 MPART_ALT_DIFF 13502 4.71 5.66 4.27 62 TooManyTo_002 13381 3.09 0.61 4.23 63 XMSubMetaSx_00 12655 5.31 8.15 4.00 64 XM_UncommonTLD01 12518 4.35 5.19 3.96 65 RCVD_IN_VALIDITY_SAFE 12369 3.30 1.97 3.91 66 HTML_IMAGE_RATIO_04 12181 4.35 5.43 3.85 67 RCVD_IN_IADB_LISTED 11905 2.93 1.12 3.76 68 T_REMOTE_IMAGE 11598 3.02 1.62 3.67 69 RELAYCOUNTRY_META 11578 7.57 16.03 3.66 70 BAYES_80 11378 5.15 8.50 3.60 71 RCVD_IN_MSPIKE_H4 11231 3.33 2.85 3.55 72 ANY_BOUNCE_MESSAGE 11225 2.70 0.86 3.55 73 BOUNCE_MESSAGE 11220 2.70 0.86 3.55 74 BAYES_20 11104 2.80 1.26 3.51 75 HTML_IMAGE_RATIO_06 10834 3.45 3.50 3.43 76 RCVD_IN_VALIDITY_CERTIFIED 10581 2.75 1.46 3.35 77 RCVD_IN_IADB_SPF 10538 2.59 1.00 3.33 78 BAYES_99 10220 11.57 29.60 3.23 79 BOTNET_IPINHOSTNAME 9940 6.28 13.07 3.14 80 XM_B_SpammyTLD 9460 3.57 4.81 2.99 81 RCVD_IN_IADB_SENDERID 9444 2.34 0.94 2.99 82 MAILING_LIST_MULTI 9423 2.69 2.08 2.98 83 T_TooManySym_02 9222 2.25 0.80 2.92 84 RCVD_IN_IADB_DK 9182 2.28 0.94 2.90 85 MIME_HTML_ONLY_MULTI 8648 2.83 3.04 2.73 86 HTML_MIME_NO_HTML_TAG 8239 2.27 1.55 2.61 87 XM_Body_Dirty_Words 8097 4.20 7.75 2.56 88 RCVD_IN_IADB_VOUCHED 7797 1.85 0.51 2.47 89 BAYES_999 7713 8.92 22.94 2.44 90 T_XMDrugObfuBody_14 7362 2.90 4.15 2.33 91 BAYES_95 7189 3.05 4.73 2.27 92 INVALID_MSGID 7109 1.59 0.18 2.25 93 SCC_BODY_URI_ONLY 7072 1.97 1.38 2.24 94 HTML_IMAGE_RATIO_08 6874 2.56 3.40 2.17 95 BAYES_05 6740 1.68 0.71 2.13 96 DKIM_INVALID 6511 2.73 4.18 2.06 97 XM_CamelCaseFrm001 6430 2.50 3.51 2.03 98 TR_XM_SpammyRelay 6370 5.27 12.31 2.01 99 XM_B_FormFill 6355 1.43 0.18 2.01 100 TM2_M_URI_OPT_OUT 6305 2.18 2.58 1.99 101 TO_MALFORMED 6256 1.37 0.05 1.98 102 MIME_HTML_MOSTLY 6226 2.49 3.62 1.97 103 XMDiploma_00 6116 2.57 3.93 1.93 104 TR_XM_DKIM_Undo 6000 10.06 27.71 1.90 105 TM2_M_VERY_LONG_WORD 5983 2.49 3.78 1.89 106 XM_B_URI_Unicode 5758 2.09 2.68 1.82 107 XM_DK_Undo_01 5669 1.81 1.86 1.79 108 FROM_EXCESS_BASE64 5627 1.91 2.21 1.78 109 RCVD_IN_IADB_OPTIN 5456 1.29 0.34 1.73 110 TR_XM_PhishingBody 5423 2.74 4.96 1.71 111 TR_XM_SpammyWords5 5168 2.26 3.61 1.63 112 XM_B_Investor 5154 2.65 4.86 1.63 113 SUBJ_ALL_CAPS 4955 1.56 1.56 1.57 114 TR_XM_UnparsRelay 4929 3.95 9.13 1.56 115 TooManyTo_003 4929 1.22 0.48 1.56 116 URI_NOVOWEL 4872 1.59 1.69 1.54 117 XM_SPF_SoftFail 4709 1.87 2.69 1.49 118 KHOP_HELO_FCRDNS 4678 1.53 1.64 1.48 119 TR_MetaPhish_Combo_01 4623 1.37 1.16 1.46 120 UNTRUSTED_Relay 4611 2.90 6.01 1.46 121 T_XMDrugObfuBody_08 4548 2.02 3.28 1.44 122 TR_Symld_Words 4481 1.27 0.94 1.42 123 BOTNET 4396 3.97 9.55 1.39 124 IN_HORDE_ADDRESS_BOOK 4342 0.96 0.07 1.37 125 XMStockSpam_06 4268 1.63 2.25 1.35 126 XM_SendGrid 4167 1.36 1.46 1.32 127 XM_B_Unsub2 4132 1.97 3.41 1.31 128 HELO_NODOT 4127 0.92 0.09 1.31 129 HELO_NO_DOMAIN 4124 0.92 0.08 1.30 130 XMGappySubj_01 4103 0.99 0.33 1.30 131 XM_OfRef6 4087 2.12 3.92 1.29 132 XMSexyCombo_05 4073 2.44 4.93 1.29 133 URI_HEX 3963 1.64 2.47 1.25 134 TR_DCC_Bayes_99 3839 7.56 21.29 1.21 135 XM_GoogleGroups 3804 1.06 0.76 1.20 136 T_TooManySym_03 3595 0.88 0.34 1.14 137 TooManyTo_004 3534 0.90 0.43 1.12 138 XMGenDplmaNmb 3404 1.48 2.36 1.08 139 HTML_IMAGE_ONLY_32 3356 0.79 0.19 1.06 140 TVD_SPACE_RATIO 3348 0.79 0.20 1.06 141 XMCapTrack 3251 0.82 0.36 1.03 142 XM_ShortIntro_01 3009 0.75 0.30 0.95 143 XM_UB50 2966 1.59 2.99 0.94 144 TooManyTo_005 2898 0.75 0.38 0.92 145 XM_H_Long_From02 2702 1.04 1.44 0.85 146 RELAYCOUNTRY_CA 2696 2.55 6.21 0.85 147 TR_XM_DK_SendGrid 2598 0.85 0.92 0.82 148 URI_OPTOUT_3LD 2589 0.72 0.51 0.82 149 T_FILL_THIS_FORM_SHORT 2557 1.34 2.49 0.81 150 XMBrknScrpt_02 2537 1.14 1.88 0.80 151 TVD_RCVD_IP 2528 0.88 1.05 0.80 152 T_XMDrugObfuBody_00 2505 1.04 1.58 0.79 153 DKIM_ADSP_CUSTOM_MED 2489 0.82 0.88 0.79 154 SpammyFromTLD_01 2456 1.10 1.80 0.78 155 RELAYCOUNTRY_AU 2415 1.46 2.96 0.76 156 FROM_GOV_DKIM_AU 2407 0.62 0.30 0.76 157 XM_H_PHPMailer 2324 0.69 0.59 0.73 158 HTTPS_HTTP_MISMATCH 2192 0.88 1.28 0.69 159 RCVD_IN_PBL 2181 0.83 1.15 0.69 160 T_XMHurry_00 2154 1.01 1.71 0.68 161 MAY_BE_FORGED 2153 0.47 0.01 0.68 162 XM_B_SpammyWords4 2142 1.21 2.37 0.68 163 XMBSHREFv2 2130 0.58 0.38 0.67 164 XMNoVowels 2095 0.60 0.47 0.66 165 RCVD_IN_BL_SPAMCOP_NET 2027 3.49 9.65 0.64 166 XMGappySubj_02 2026 0.45 0.05 0.64 167 URI_TRY_3LD 2012 0.93 1.58 0.64 168 TR_XM_Base64_M1 1981 0.75 1.00 0.63 169 LOW_PRICE 1978 0.53 0.31 0.63 170 XM_B_COPY_HTML 1937 0.77 1.11 0.61 171 T_OBFU_PDF_ATTACH 1928 0.45 0.12 0.61 172 XMSubMetaI_00 1883 0.76 1.12 0.60 173 MPART_ALT_DIFF_COUNT 1881 0.97 1.78 0.59 174 XMSlimDrugH 1880 0.65 0.77 0.59 175 RCVD_IN_MSPIKE_BL 1876 1.92 4.78 0.59 176 TR_XM_MSPIKECOMBO 1876 1.92 4.78 0.59 177 SUBJ_DOLLARS 1804 0.55 0.52 0.57 178 MSGID_FROM_MTA_HEADER 1800 0.46 0.22 0.57 179 XMBody_17 1762 1.02 2.01 0.56 180 RCVD_IN_PSBL 1750 1.01 2.01 0.55 181 TM2_M_OBFU_COMMENT 1743 0.65 0.87 0.55 182 TR_LOTS_OF_MONEY3 1742 1.43 3.34 0.55 183 XMPhish30 1731 0.82 1.42 0.55 184 NML_ADSP_CUSTOM_MED 1654 0.59 0.75 0.52 185 XMSubMetaSxObfu_03 1641 0.74 1.21 0.52 186 RELAYCOUNTRY_GB 1632 0.60 0.78 0.52 187 XMBdyGiftCard01 1618 0.74 1.22 0.51 188 T_Symld_Words_02 1614 0.68 1.05 0.51 189 FILL_THIS_FORM 1613 0.55 0.64 0.51 190 FORGED_GMAIL_RCVD 1555 0.55 0.67 0.49 191 XMLngstWrd_00 1548 0.46 0.41 0.49 192 SpammyFromTLD_02 1544 0.87 1.70 0.49 193 XMMoneyMeta_00 1511 0.56 0.74 0.48 194 XMPhish14 1454 0.65 1.05 0.46 195 XMBody_95 1442 0.36 0.14 0.46 196 HTML_TAG_BALANCE_BODY 1433 0.59 0.89 0.45 197 HTML_FONT_FACE_BAD 1423 0.52 0.66 0.45 198 XMBody_78 1404 0.64 1.07 0.44 199 LongTLD 1402 0.53 0.72 0.44 200 T_STY_INVIS_DIRECT 1396 0.56 0.83 0.44 ----------------------------------------------------------------------