Email: 445311 Autolearn: 0 AvgScore: 5.04 AvgScanTime: 1.44 sec Spam: 135139 Autolearn: 0 AvgScore: 14.46 AvgScanTime: 1.58 sec Ham: 310172 Autolearn: 0 AvgScore: 0.94 AvgScanTime: 1.38 sec Time Spent Running SA: 178.29 hours Time Spent Processing Spam: 59.35 hours Time Spent Processing Ham: 118.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 132909 99.15 98.35 99.49 2 HTML_MESSAGE 129234 89.91 95.63 87.42 3 DKIM_SIGNED 121530 80.95 89.93 77.04 4 XM_DK_Pass 115023 78.70 85.11 75.91 5 DKIM_VALID 114124 77.83 84.45 74.95 6 XM_B_Unicode 113951 75.37 84.32 71.47 7 RELAYCOUNTRY_US 110059 81.32 81.44 81.26 8 DCC_CHECK 101780 52.03 75.32 41.89 9 XM_B_SpammyWords 93070 52.51 68.87 45.38 10 XMListUnsubscribeExists 92080 55.65 68.14 50.22 11 DKIM_VALID_AU 88684 62.31 65.62 60.86 12 XM_B_Unicode3 66655 44.04 49.32 41.73 13 LOC_TINY_FONT_1 65579 34.77 48.53 28.77 14 BAYES_50 56249 55.21 41.62 61.13 15 XM_B_SpammyWords2 54333 26.31 40.21 20.25 16 XM_DK_Undo_02 54112 15.70 40.04 5.10 17 HTML_FONT_LOW_CONTRAST 50962 31.01 37.71 28.09 18 FVGT_m_MULTI_ODD 47443 29.55 35.11 27.14 19 DKIM_VALID_EF 43143 31.10 31.92 30.74 20 MIME_HTML_ONLY 41519 23.60 30.72 20.50 21 BAYES_99 41287 11.83 30.55 3.67 22 T_KAM_HTML_FONT_INVALID 40523 25.05 29.99 22.90 23 TR_XM_DKIM_Undo 38376 9.98 28.40 1.96 24 XMSubLong 34547 25.40 25.56 25.33 25 TR_XM_DK_Unsub 32138 16.98 23.78 14.02 26 BAYES_999 31825 9.12 23.55 2.83 27 DCC_CHECK_NEGATIVE 31331 47.48 23.18 58.06 28 T_TM2_M_HEADER_IN_MSG 30562 28.21 22.62 30.65 29 TR_DCC_Bayes_99 29102 7.51 21.53 1.39 30 XM_Multi_Part_URI 28879 17.10 21.37 15.24 31 XM_B_Unsub 27359 13.20 20.25 10.14 32 TR_XM_BayesUnsub 26264 11.42 19.43 7.92 33 RCVD_IN_MSPIKE_H2 25402 16.73 18.80 15.82 34 UNPARSEABLE_RELAY 24257 14.02 17.95 12.31 35 RELAYCOUNTRY_META 22611 7.77 16.73 3.87 36 TR_MAX_INTL_RELAY 19185 8.80 14.20 6.45 37 XM_B_SpammyWords3 18477 7.84 13.67 5.29 38 BOTNET_IPINHOSTNAME 18120 6.29 13.41 3.18 39 LOTS_OF_MONEY 17588 8.39 13.01 6.38 40 TR_XM_SpammyRelay 16897 5.08 12.50 1.85 41 TR_XM_SpammyWords4 15881 6.30 11.75 3.93 42 FSL_BULK_SIG 14562 9.29 10.78 8.64 43 XM_Evil_Numbers_Gen 14449 8.83 10.69 8.02 44 TR_XM_SpammyWords2 14104 3.58 10.44 0.59 45 BOTNET 13376 3.96 9.90 1.37 46 XM_B_Phish_Phrases 12955 7.22 9.59 6.19 47 RCVD_IN_MSPIKE_WL 12411 15.41 9.18 18.12 48 TR_XM_UnparsRelay 12399 3.99 9.17 1.73 49 RCVD_IN_BL_SPAMCOP_NET 12221 3.15 9.04 0.59 50 BAYES_80 11901 5.51 8.81 4.08 51 BAYES_60 10366 7.17 7.67 6.95 52 LotsOfNums_01 10180 7.82 7.53 7.95 53 XM_Body_Dirty_Words 10058 3.80 7.44 2.21 54 XM_B_PhoneNumber 9374 9.88 6.94 11.16 55 HTML_IMAGE_RATIO_02 9307 5.46 6.89 4.85 56 RELAYCOUNTRY_CA 8856 2.55 6.55 0.81 57 UNTRUSTED_Relay 8620 2.97 6.38 1.48 58 XMSubMetaSx_00 8445 4.61 6.25 3.90 59 RCVD_IN_MSPIKE_BL 8325 2.47 6.16 0.86 60 TR_XM_MSPIKECOMBO 8324 2.47 6.16 0.86 61 XM_UncommonTLD01 8226 4.79 6.09 4.22 62 MPART_ALT_DIFF 7483 4.90 5.54 4.62 63 XM_H_Long_From01 7423 5.71 5.49 5.81 64 DKIM_INVALID 7406 3.12 5.48 2.09 65 XM_B_Investor 7030 2.59 5.20 1.45 66 BAYES_95 6754 3.17 5.00 2.37 67 XMStrtUSub 6747 5.10 4.99 5.14 68 HTML_IMAGE_RATIO_04 6690 3.99 4.95 3.56 69 RCVD_IN_MSPIKE_H3 6408 7.12 4.74 8.16 70 TR_XM_PhishingBody 6271 2.54 4.64 1.62 71 XMSexyCombo_05 6224 2.20 4.61 1.16 72 XM_H_GMP 6154 5.31 4.55 5.65 73 TM2_M_VERY_LONG_WORD 6093 2.36 4.51 1.42 74 TR_XM_SpammyWords3 6026 1.65 4.46 0.42 75 TR_XM_SPAMCOP 5994 1.49 4.44 0.20 76 TooManyTo_001 5935 7.31 4.39 8.58 77 XM_B_SpammyTLD 5696 3.21 4.21 2.77 78 T_XMDrugObfuBody_14 5591 2.97 4.14 2.46 79 TR_XM_SpammyWords5 5283 1.95 3.91 1.09 80 XM_OfRef6 5187 1.94 3.84 1.12 81 HTML_IMAGE_RATIO_06 5089 3.93 3.77 4.00 82 RCVD_IN_MSPIKE_L3 4953 1.54 3.67 0.62 83 TM2_M_URI_OPT_OUT 4832 2.48 3.58 2.01 84 T_XMDrugObfuBody_08 4824 2.13 3.57 1.50 85 TR_XM_NoHeaderRelay 4749 1.25 3.51 0.26 86 MIME_HTML_MOSTLY 4631 2.57 3.43 2.20 87 XM_CamelCaseFrm001 4603 2.66 3.41 2.34 88 XMNumbers 4444 3.41 3.29 3.46 89 XM_SPF_SoftFail 4415 1.96 3.27 1.40 90 XM_UB50 4359 1.65 3.23 0.96 91 XM_URI_RBL 4244 1.12 3.14 0.24 92 MIME_HTML_ONLY_MULTI 4174 2.90 3.09 2.82 93 XM_B_Unsub2 4099 1.79 3.03 1.24 94 XM_B_SpammyWords4 4052 1.65 3.00 1.06 95 XMDiploma_00 3983 1.96 2.95 1.53 96 T_TooManySym_01 3981 5.12 2.95 6.06 97 RELAYCOUNTRY_AU 3918 1.43 2.90 0.80 98 RCVD_IN_VALIDITY_RPBL 3857 0.95 2.85 0.12 99 HTML_IMAGE_RATIO_08 3846 2.74 2.85 2.70 100 MIME_QP_LONG_LINE 3833 4.50 2.84 5.23 101 XM_B_URI_Unicode 3670 2.45 2.72 2.34 102 T_XMDrugObfuBody_00 3537 1.63 2.62 1.20 103 T_FILL_THIS_FORM_SHORT 3446 1.30 2.55 0.76 104 XMBody_17 3403 1.05 2.52 0.42 105 RCVD_IN_MSPIKE_H4 3366 3.56 2.49 4.02 106 TR_XM_INV_DKIM 3329 0.79 2.46 0.06 107 USER_IN_DEF_DKIM_WL 3229 10.80 2.39 14.47 108 ALL_TRUSTED 3173 11.60 2.35 15.63 109 XM_H_Long_From02 3092 1.33 2.29 0.92 110 MAILING_LIST_MULTI 3065 2.84 2.27 3.08 111 RCVD_IN_VALIDITY_SAFE 3058 3.47 2.26 4.00 112 SUBJ_ALL_CAPS 2972 1.58 2.20 1.31 113 SpammyFromTLD_02 2879 1.00 2.13 0.51 114 XMStockSpam_06 2817 1.15 2.08 0.74 115 XM_DK_Undo_01 2772 1.81 2.05 1.71 116 SpammyFromTLD_01 2744 1.29 2.03 0.96 117 BAYES_40 2702 4.28 2.00 5.27 118 RCVD_IN_MSPIKE_H5 2653 4.73 1.96 5.94 119 FROM_EXCESS_BASE64 2555 1.91 1.89 1.91 120 T_XMHurry_00 2550 0.96 1.89 0.55 121 URI_HEX 2460 1.46 1.82 1.30 122 RCVD_IN_VALIDITY_CERTIFIED 2418 2.95 1.79 3.45 123 XMGenDplmaNmb 2368 1.13 1.75 0.86 124 HTML_MIME_NO_HTML_TAG 2247 2.28 1.66 2.54 125 HK_RANDOM_REPLYTO 2217 0.56 1.64 0.10 126 XMBrknScrpt_02 2208 1.02 1.63 0.76 127 TR_XM_MSPIKECOMBO2 2178 0.50 1.61 0.02 128 TR_LOTS_OF_MONEY3 2138 0.69 1.58 0.30 129 T_REMOTE_IMAGE 2137 2.89 1.58 3.45 130 BAYES_20 2084 3.08 1.54 3.75 131 XMPhish30 2045 0.83 1.51 0.53 132 SHORTCIRCUIT 2012 0.45 1.49 0.00 133 RCVD_IN_ZEN_LASTEXTERNAL 2012 0.45 1.49 0.00 134 KHOP_HELO_FCRDNS 1954 1.28 1.45 1.20 135 XM_B_Phish66 1853 0.65 1.37 0.33 136 SCC_BODY_URI_ONLY 1852 2.08 1.37 2.39 137 TR_XM_InvalidRelay 1851 0.43 1.37 0.02 138 BOTNET_NORDNS 1819 0.42 1.35 0.01 139 RCVD_IN_MSPIKE_L4 1815 0.57 1.34 0.23 140 XM_SendGrid 1815 1.43 1.34 1.47 141 XMBdyGiftCard01 1799 0.74 1.33 0.49 142 RCVD_IN_PSBL 1795 0.76 1.33 0.51 143 RDNS_DYNAMIC 1768 0.52 1.31 0.18 144 XM_B_SEO 1764 0.59 1.31 0.28 145 XM_B_COPY_HTML 1723 1.07 1.27 0.98 146 PDS_RDNS_DYNAMIC_FP 1719 0.42 1.27 0.05 147 XM_B_DNDMA 1649 0.92 1.22 0.79 148 URI_TRY_3LD 1645 0.66 1.22 0.42 149 MPART_ALT_DIFF_COUNT 1632 0.80 1.21 0.62 150 URI_NOVOWEL 1619 1.45 1.20 1.57 151 RCVD_IN_IADB_LISTED 1593 2.90 1.18 3.65 152 TR_LOTS_OF_MONEY2 1575 0.48 1.17 0.18 153 T_MONEY_PERCENT 1575 0.48 1.17 0.18 154 TM2_M_OBFU_COMMENT 1574 0.74 1.16 0.56 155 TR_XM_SEO4 1574 0.46 1.16 0.16 156 XM_HighProb1 1566 0.35 1.16 0.00 157 RCVD_IN_MSPIKE_L5 1556 0.35 1.15 0.01 158 HTML_TAG_BALANCE_BODY 1515 0.69 1.12 0.50 159 ANY_BOUNCE_MESSAGE 1501 2.41 1.11 2.98 160 BOUNCE_MESSAGE 1501 2.41 1.11 2.98 161 SHOPIFY_IMG_NOT_RCVD_SFY 1481 0.50 1.10 0.24 162 TR_XM_RelayPhish 1475 0.39 1.09 0.08 163 TR_XM_Spammywords 1458 0.50 1.08 0.24 164 XM_S_SpammyWords 1458 0.50 1.08 0.24 165 XM_DIRTYINTL 1457 0.36 1.08 0.05 166 TR_XM_MaxSPIKE 1457 0.34 1.08 0.01 167 DKIM_ADSP_NXDOMAIN 1440 0.51 1.07 0.26 168 XMSexyCombo_01 1438 0.40 1.06 0.10 169 DIET_1 1434 0.48 1.06 0.22 170 XMBody_78 1425 0.50 1.05 0.26 171 TR_XM_PHPForged 1422 0.61 1.05 0.42 172 XMSubMetaI_00 1416 0.78 1.05 0.66 173 TR_MetaPhish_Combo_01 1416 1.26 1.05 1.35 174 XM_UB99 1414 0.32 1.05 0.00 175 RCVD_IN_PBL 1402 0.87 1.04 0.80 176 TM2_M_A_HREF_HREF 1401 0.47 1.04 0.23 177 TVD_RCVD_IP 1399 0.91 1.04 0.86 178 DKIM_ADSP_CUSTOM_MED 1397 0.84 1.03 0.76 179 LongTLD 1397 0.65 1.03 0.48 180 TR_XM_PHPDW 1396 0.61 1.03 0.42 181 TR_XM_FormFill2 1396 0.61 1.03 0.42 182 HTTPS_HTTP_MISMATCH 1395 0.76 1.03 0.65 183 T_STY_INVIS_DIRECT 1389 0.60 1.03 0.42 184 RCVD_IN_IADB_SPF 1381 2.53 1.02 3.19 185 URIBL_BLACK 1374 0.32 1.02 0.02 186 TR_Symld_Words 1365 1.31 1.01 1.44 187 XM_H_PHPOS 1362 0.59 1.01 0.41 188 HTML_IMAGE_ONLY_20 1345 0.54 1.00 0.34 189 THIS_AD 1286 0.56 0.95 0.40 190 XMReplyNow 1285 0.44 0.95 0.22 191 XMPhish14 1281 0.60 0.95 0.44 192 RCVD_IN_IADB_SENDERID 1280 2.27 0.95 2.84 193 RCVD_IN_IADB_DK 1279 2.21 0.95 2.76 194 T_TooManySym_02 1278 2.39 0.95 3.02 195 XM_RXBody 1249 0.40 0.92 0.17 196 MultiRelay_CC 1229 0.41 0.91 0.19 197 RCVD_IN_XBL 1228 0.30 0.91 0.03 198 RELAYCOUNTRY_FR 1225 0.45 0.91 0.24 199 RELAYCOUNTRY_GB 1216 0.71 0.90 0.63 200 XM_GoogleGroups 1216 1.23 0.90 1.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 308602 99.15 98.35 99.49 2 HTML_MESSAGE 271157 89.91 95.63 87.42 3 RELAYCOUNTRY_US 252061 81.32 81.44 81.26 4 DKIM_SIGNED 238954 80.95 89.93 77.04 5 XM_DK_Pass 235455 78.70 85.11 75.91 6 DKIM_VALID 232469 77.83 84.45 74.95 7 XM_B_Unicode 221677 75.37 84.32 71.47 8 BAYES_50 189618 55.21 41.62 61.13 9 DKIM_VALID_AU 188770 62.31 65.62 60.86 10 DCC_CHECK_NEGATIVE 180098 47.48 23.18 58.06 11 XMListUnsubscribeExists 155754 55.65 68.14 50.22 12 XM_B_SpammyWords 140769 52.51 68.87 45.38 13 DCC_CHECK 129931 52.03 75.32 41.89 14 XM_B_Unicode3 129447 44.04 49.32 41.73 15 DKIM_VALID_EF 95351 31.10 31.92 30.74 16 T_TM2_M_HEADER_IN_MSG 95082 28.21 22.62 30.65 17 LOC_TINY_FONT_1 89239 34.77 48.53 28.77 18 HTML_FONT_LOW_CONTRAST 87118 31.01 37.71 28.09 19 FVGT_m_MULTI_ODD 84167 29.55 35.11 27.14 20 XMSubLong 78559 25.40 25.56 25.33 21 T_KAM_HTML_FONT_INVALID 71028 25.05 29.99 22.90 22 MIME_HTML_ONLY 63595 23.60 30.72 20.50 23 XM_B_SpammyWords2 62810 26.31 40.21 20.25 24 RCVD_IN_MSPIKE_WL 56204 15.41 9.18 18.12 25 RCVD_IN_MSPIKE_H2 49081 16.73 18.80 15.82 26 ALL_TRUSTED 48490 11.60 2.35 15.63 27 XM_Multi_Part_URI 47277 17.10 21.37 15.24 28 USER_IN_DEF_DKIM_WL 44883 10.80 2.39 14.47 29 TR_XM_DK_Unsub 43471 16.98 23.78 14.02 30 UNPARSEABLE_RELAY 38197 14.02 17.95 12.31 31 XM_B_PhoneNumber 34602 9.88 6.94 11.16 32 BAYES_00 32594 7.51 0.64 10.51 33 XM_B_Unsub 31442 13.20 20.25 10.14 34 FSL_BULK_SIG 26796 9.29 10.78 8.64 35 TooManyTo_001 26606 7.31 4.39 8.58 36 RCVD_IN_MSPIKE_H3 25307 7.12 4.74 8.16 37 XM_Evil_Numbers_Gen 24890 8.83 10.69 8.02 38 LotsOfNums_01 24654 7.82 7.53 7.95 39 TR_XM_BayesUnsub 24575 11.42 19.43 7.92 40 XM_DKIMWhitelistDomains 24268 5.45 0.01 7.82 41 TR_XM_DK_Bayes 22163 5.12 0.49 7.15 42 TR_XM_DK_Bayes1 21814 5.04 0.48 7.03 43 BAYES_60 21559 7.17 7.67 6.95 44 TR_MAX_INTL_RELAY 20010 8.80 14.20 6.45 45 LOTS_OF_MONEY 19790 8.39 13.01 6.38 46 XM_B_Phish_Phrases 19193 7.22 9.59 6.19 47 T_TooManySym_01 18808 5.12 2.95 6.06 48 TR_XM_DK_Bayes2 18611 4.29 0.36 6.00 49 RCVD_IN_MSPIKE_H5 18414 4.73 1.96 5.94 50 XM_H_Long_From01 18011 5.71 5.49 5.81 51 XM_H_GMP 17514 5.31 4.55 5.65 52 XM_B_SpammyWords3 16417 7.84 13.67 5.29 53 BAYES_40 16343 4.28 2.00 5.27 54 MIME_QP_LONG_LINE 16216 4.50 2.84 5.23 55 XMStrtUSub 15952 5.10 4.99 5.14 56 XM_DK_Undo_02 15805 15.70 40.04 5.10 57 HTML_IMAGE_RATIO_02 15029 5.46 6.89 4.85 58 MPART_ALT_DIFF 14323 4.90 5.54 4.62 59 XM_PDF 13675 3.33 0.85 4.41 60 XM_UncommonTLD01 13097 4.79 6.09 4.22 61 BAYES_80 12651 5.51 8.81 4.08 62 RCVD_IN_MSPIKE_H4 12483 3.56 2.49 4.02 63 RCVD_IN_VALIDITY_SAFE 12407 3.47 2.26 4.00 64 HTML_IMAGE_RATIO_06 12397 3.93 3.77 4.00 65 TR_XM_SpammyWords4 12182 6.30 11.75 3.93 66 XMSubMetaSx_00 12099 4.61 6.25 3.90 67 RELAYCOUNTRY_META 12001 7.77 16.73 3.87 68 BAYES_20 11624 3.08 1.54 3.75 69 BAYES_99 11390 11.83 30.55 3.67 70 RCVD_IN_IADB_LISTED 11316 2.90 1.18 3.65 71 HTML_IMAGE_RATIO_04 11057 3.99 4.95 3.56 72 XMNumbers 10734 3.41 3.29 3.46 73 T_REMOTE_IMAGE 10713 2.89 1.58 3.45 74 RCVD_IN_VALIDITY_CERTIFIED 10700 2.95 1.79 3.45 75 RCVD_IN_IADB_SPF 9893 2.53 1.02 3.19 76 BOTNET_IPINHOSTNAME 9876 6.29 13.41 3.18 77 MAILING_LIST_MULTI 9563 2.84 2.27 3.08 78 T_TooManySym_02 9365 2.39 0.95 3.02 79 ANY_BOUNCE_MESSAGE 9253 2.41 1.11 2.98 80 BOUNCE_MESSAGE 9251 2.41 1.11 2.98 81 TooManyTo_002 9199 2.27 0.67 2.97 82 RCVD_IN_IADB_SENDERID 8811 2.27 0.95 2.84 83 BAYES_999 8766 9.12 23.55 2.83 84 MIME_HTML_ONLY_MULTI 8761 2.90 3.09 2.82 85 XM_B_SpammyTLD 8577 3.21 4.21 2.77 86 RCVD_IN_IADB_DK 8561 2.21 0.95 2.76 87 HTML_IMAGE_RATIO_08 8365 2.74 2.85 2.70 88 HTML_MIME_NO_HTML_TAG 7885 2.28 1.66 2.54 89 T_XMDrugObfuBody_14 7621 2.97 4.14 2.46 90 SCC_BODY_URI_ONLY 7414 2.08 1.37 2.39 91 RCVD_IN_IADB_VOUCHED 7399 1.87 0.68 2.39 92 BAYES_95 7347 3.17 5.00 2.37 93 XM_CamelCaseFrm001 7255 2.66 3.41 2.34 94 XM_B_URI_Unicode 7251 2.45 2.72 2.34 95 INVALID_MSGID 7136 1.67 0.22 2.30 96 BAYES_05 7041 1.79 0.68 2.27 97 XM_Body_Dirty_Words 6847 3.80 7.44 2.21 98 MIME_HTML_MOSTLY 6822 2.57 3.43 2.20 99 DKIM_INVALID 6485 3.12 5.48 2.09 100 TO_MALFORMED 6283 1.42 0.04 2.03 101 TM2_M_URI_OPT_OUT 6219 2.48 3.58 2.01 102 TR_XM_DKIM_Undo 6078 9.98 28.40 1.96 103 FROM_EXCESS_BASE64 5937 1.91 1.89 1.91 104 TR_XM_SpammyRelay 5741 5.08 12.50 1.85 105 TR_XM_UnparsRelay 5360 3.99 9.17 1.73 106 XM_DK_Undo_01 5304 1.81 2.05 1.71 107 TooManyTo_003 5191 1.34 0.56 1.67 108 RCVD_IN_IADB_OPTIN 5083 1.29 0.48 1.64 109 TR_XM_PhishingBody 5027 2.54 4.64 1.62 110 URI_NOVOWEL 4858 1.45 1.20 1.57 111 XMDiploma_00 4748 1.96 2.95 1.53 112 T_XMDrugObfuBody_08 4667 2.13 3.57 1.50 113 UNTRUSTED_Relay 4598 2.97 6.38 1.48 114 XM_SendGrid 4569 1.43 1.34 1.47 115 XM_B_Investor 4493 2.59 5.20 1.45 116 TR_Symld_Words 4481 1.31 1.01 1.44 117 TM2_M_VERY_LONG_WORD 4410 2.36 4.51 1.42 118 XM_SPF_SoftFail 4332 1.96 3.27 1.40 119 TR_DCC_Bayes_99 4322 7.51 21.53 1.39 120 XMGappySubj_01 4282 1.13 0.57 1.38 121 XM_GoogleGroups 4277 1.23 0.90 1.38 122 BOTNET 4240 3.96 9.90 1.37 123 IN_HORDE_ADDRESS_BOOK 4200 0.97 0.10 1.35 124 TR_MetaPhish_Combo_01 4200 1.26 1.05 1.35 125 SUBJ_ALL_CAPS 4063 1.58 2.20 1.31 126 HELO_NODOT 4060 0.94 0.11 1.31 127 HELO_NO_DOMAIN 4055 0.94 0.10 1.31 128 URI_HEX 4031 1.46 1.82 1.30 129 XM_B_Unsub2 3851 1.79 3.03 1.24 130 TooManyTo_004 3801 1.00 0.50 1.23 131 T_XMDrugObfuBody_00 3735 1.63 2.62 1.20 132 KHOP_HELO_FCRDNS 3727 1.28 1.45 1.20 133 XMSexyCombo_05 3586 2.20 4.61 1.16 134 T_TooManySym_03 3543 0.93 0.44 1.14 135 XM_OfRef6 3468 1.94 3.84 1.12 136 TR_XM_SpammyWords5 3380 1.95 3.91 1.09 137 XMCapTrack 3335 0.90 0.49 1.08 138 XM_B_SpammyWords4 3276 1.65 3.00 1.06 139 TooManyTo_005 3064 0.82 0.44 0.99 140 XM_B_COPY_HTML 3041 1.07 1.27 0.98 141 TVD_SPACE_RATIO 2996 0.72 0.16 0.97 142 SpammyFromTLD_01 2993 1.29 2.03 0.96 143 XM_UB50 2979 1.65 3.23 0.96 144 TO_NO_BRKTS_HTML_ONLY 2966 0.87 0.69 0.96 145 FROM_GOV_DKIM_AU 2904 0.74 0.28 0.94 146 XM_ShortIntro_01 2895 0.77 0.40 0.93 147 TR_XM_DK_SendGrid 2860 0.91 0.88 0.92 148 XM_H_Long_From02 2850 1.33 2.29 0.92 149 RCVD_IN_MSPIKE_BL 2659 2.47 6.16 0.86 150 TVD_RCVD_IP 2658 0.91 1.04 0.86 151 TR_XM_MSPIKECOMBO 2656 2.47 6.16 0.86 152 XMGenDplmaNmb 2652 1.13 1.75 0.86 153 RELAYCOUNTRY_CA 2509 2.55 6.55 0.81 154 RCVD_IN_PBL 2492 0.87 1.04 0.80 155 RELAYCOUNTRY_AU 2467 1.43 2.90 0.80 156 XM_B_DNDMA 2451 0.92 1.22 0.79 157 DKIM_ADSP_CUSTOM_MED 2353 0.84 1.03 0.76 158 XMBrknScrpt_02 2352 1.02 1.63 0.76 159 T_FILL_THIS_FORM_SHORT 2344 1.30 2.55 0.76 160 T_Symld_Words_02 2320 0.73 0.69 0.75 161 XMStockSpam_06 2299 1.15 2.08 0.74 162 URI_OPTOUT_3LD 2267 0.71 0.67 0.73 163 XM_H_PHPMailer 2218 0.66 0.54 0.72 164 XM_B_FormFill 2104 0.48 0.04 0.68 165 XMGappySubj_02 2067 0.50 0.13 0.67 166 XMSubMetaI_00 2061 0.78 1.05 0.66 167 XMSlimDrugH 2028 0.62 0.54 0.65 168 TR_XM_Base64_M1 2017 0.66 0.67 0.65 169 HTTPS_HTTP_MISMATCH 2001 0.76 1.03 0.65 170 XMSubMetaSxObfu_03 1960 0.64 0.65 0.63 171 RELAYCOUNTRY_GB 1951 0.71 0.90 0.63 172 MPART_ALT_DIFF_COUNT 1934 0.80 1.21 0.62 173 RCVD_IN_MSPIKE_L3 1920 1.54 3.67 0.62 174 MSGID_FROM_MTA_HEADER 1859 0.47 0.17 0.60 175 TR_XM_SpammyWords2 1838 3.58 10.44 0.59 176 XMBSHREFv2 1833 0.53 0.38 0.59 177 RCVD_IN_BL_SPAMCOP_NET 1819 3.15 9.04 0.59 178 XMNoVowels 1798 0.56 0.53 0.58 179 TM2_M_OBFU_COMMENT 1730 0.74 1.16 0.56 180 T_XMHurry_00 1707 0.96 1.89 0.55 181 T_OBFU_PDF_ATTACH 1673 0.43 0.17 0.54 182 XMPhish30 1656 0.83 1.51 0.53 183 HTML_IMAGE_ONLY_32 1647 0.45 0.27 0.53 184 SpammyFromTLD_02 1584 1.00 2.13 0.51 185 RCVD_IN_PSBL 1581 0.76 1.33 0.51 186 XM_ProductURIs 1555 0.61 0.87 0.50 187 HTML_TAG_BALANCE_BODY 1551 0.69 1.12 0.50 188 XMBdyGiftCard01 1507 0.74 1.33 0.49 189 NML_ADSP_CUSTOM_MED 1497 0.61 0.89 0.48 190 LongTLD 1497 0.65 1.03 0.48 191 XMLngstWrd_00 1488 0.45 0.39 0.48 192 XMMoneyMeta_00 1453 0.59 0.86 0.47 193 FORGED_GMAIL_RCVD 1440 0.56 0.78 0.46 194 XMBody_95 1428 0.38 0.18 0.46 195 XMHTML_After_End 1417 0.57 0.81 0.46 196 XMDateMe_00 1372 0.54 0.75 0.44 197 XMPhish14 1370 0.60 0.95 0.44 198 T_TVD_MIME_NO_HEADERS 1343 0.32 0.05 0.43 199 TR_XM_PHPDW 1318 0.61 1.03 0.42 200 HTML_EXTRA_CLOSE 1313 0.30 0.01 0.42 ----------------------------------------------------------------------