Email: 442742 Autolearn: 0 AvgScore: 5.33 AvgScanTime: 1.34 sec Spam: 140067 Autolearn: 0 AvgScore: 14.99 AvgScanTime: 1.47 sec Ham: 302675 Autolearn: 0 AvgScore: 0.86 AvgScanTime: 1.28 sec Time Spent Running SA: 165.38 hours Time Spent Processing Spam: 57.36 hours Time Spent Processing Ham: 108.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 137739 98.92 98.34 99.19 2 HTML_MESSAGE 131730 88.56 94.05 86.01 3 DKIM_SIGNED 124827 80.88 89.12 77.07 4 XM_DK_Pass 117400 78.47 83.82 76.00 5 DKIM_VALID 116214 77.47 82.97 74.92 6 XM_B_Unicode 114103 73.94 81.46 70.46 7 RELAYCOUNTRY_US 112805 81.38 80.54 81.77 8 DCC_CHECK 103030 51.30 73.56 41.00 9 XM_B_SpammyWords 94798 51.92 67.68 44.63 10 XMListUnsubscribeExists 92655 54.43 66.15 49.01 11 DKIM_VALID_AU 90056 62.15 64.29 61.16 12 XM_B_Unicode3 66016 42.65 47.13 40.58 13 LOC_TINY_FONT_1 64129 34.23 45.78 28.88 14 XM_DK_Undo_02 57765 16.60 41.24 5.20 15 BAYES_50 56186 54.05 40.11 60.49 16 XM_B_SpammyWords2 52683 24.21 37.61 18.01 17 HTML_FONT_LOW_CONTRAST 47982 29.83 34.26 27.78 18 DKIM_VALID_EF 45100 31.55 32.20 31.25 19 FVGT_m_MULTI_ODD 44710 27.94 31.92 26.10 20 BAYES_99 44142 12.53 31.51 3.75 21 MIME_HTML_ONLY 43812 23.77 31.28 20.30 22 TR_XM_DKIM_Undo 41446 10.83 29.59 2.15 23 T_KAM_HTML_FONT_INVALID 40989 23.82 29.26 21.30 24 XMSubLong 36646 25.53 26.16 25.23 25 DCC_CHECK_NEGATIVE 34932 48.20 24.94 58.96 26 BAYES_999 34206 9.69 24.42 2.87 27 TR_XM_DK_Unsub 32644 17.09 23.31 14.22 28 T_TM2_M_HEADER_IN_MSG 30743 28.05 21.95 30.87 29 TR_DCC_Bayes_99 29527 7.62 21.08 1.40 30 RCVD_IN_MSPIKE_H2 28646 18.18 20.45 17.13 31 XM_Multi_Part_URI 27012 15.55 19.29 13.82 32 XM_B_Unsub 26701 12.44 19.06 9.37 33 RELAYCOUNTRY_META 26436 8.67 18.87 3.95 34 TR_XM_BayesUnsub 25484 10.32 18.19 6.68 35 UNPARSEABLE_RELAY 24296 13.69 17.35 12.00 36 TR_MAX_INTL_RELAY 20755 9.03 14.82 6.35 37 LOTS_OF_MONEY 20516 8.76 14.65 6.04 38 TR_XM_SpammyRelay 18381 5.41 13.12 1.84 39 TR_XM_SpammyWords4 18302 6.91 13.07 4.06 40 XM_B_SpammyWords3 17954 7.30 12.82 4.75 41 RCVD_IN_BL_SPAMCOP_NET 17382 4.38 12.41 0.66 42 BOTNET_IPINHOSTNAME 17281 6.09 12.34 3.20 43 BOTNET 16101 4.52 11.50 1.29 44 FSL_BULK_SIG 14889 9.58 10.63 9.10 45 RCVD_IN_MSPIKE_WL 13983 16.41 9.98 19.38 46 TR_XM_SpammyWords2 13908 3.47 9.93 0.48 47 XM_Evil_Numbers_Gen 13467 9.57 9.61 9.55 48 TR_XM_UnparsRelay 13035 4.07 9.31 1.64 49 BAYES_80 12899 5.65 9.21 4.01 50 BAYES_60 10973 7.19 7.83 6.89 51 XM_B_Phish_Phrases 10512 6.34 7.50 5.80 52 UNTRUSTED_Relay 10017 3.49 7.15 1.79 53 XM_UncommonTLD01 9708 5.27 6.93 4.51 54 RELAYCOUNTRY_CA 9667 2.75 6.90 0.83 55 XM_Body_Dirty_Words 9577 3.75 6.84 2.32 56 XMSubMetaSx_00 9284 5.11 6.63 4.40 57 XM_B_PhoneNumber 9026 9.51 6.44 10.93 58 MPART_ALT_DIFF 8997 5.09 6.42 4.47 59 HTML_IMAGE_RATIO_02 8781 5.37 6.27 4.96 60 DKIM_INVALID 8613 3.41 6.15 2.15 61 LotsOfNums_01 8599 7.27 6.14 7.79 62 XM_H_Long_From01 8443 5.82 6.03 5.72 63 TR_XM_SPAMCOP 7590 1.87 5.42 0.23 64 XM_B_Investor 7588 2.85 5.42 1.66 65 HTML_IMAGE_RATIO_04 7313 4.43 5.22 4.07 66 BAYES_95 7177 3.22 5.12 2.34 67 TR_XM_PhishingBody 7165 2.84 5.12 1.79 68 XM_H_GMP 6948 5.59 4.96 5.89 69 XMStrtUSub 6873 5.00 4.91 5.04 70 RCVD_IN_MSPIKE_BL 6821 2.16 4.87 0.90 71 TR_XM_MSPIKECOMBO 6821 2.16 4.87 0.90 72 RCVD_IN_MSPIKE_H3 6617 7.15 4.72 8.28 73 XMSexyCombo_05 6454 2.69 4.61 1.80 74 XM_B_SpammyTLD 5638 3.19 4.03 2.81 75 T_XMDrugObfuBody_14 5603 2.59 4.00 1.94 76 TooManyTo_001 5585 7.43 3.99 9.02 77 XMNumbers 5464 4.02 3.90 4.07 78 XM_B_Unsub2 5393 2.15 3.85 1.36 79 XM_OfRef6 5374 1.85 3.84 0.93 80 TR_XM_SpammyWords5 5327 2.16 3.80 1.39 81 XM_URI_RBL 5170 1.37 3.69 0.29 82 HTML_IMAGE_RATIO_06 4899 3.20 3.50 3.06 83 MIME_HTML_MOSTLY 4813 2.56 3.44 2.16 84 MIME_QP_LONG_LINE 4797 4.72 3.42 5.31 85 XM_UB50 4796 1.86 3.42 1.14 86 TR_XM_SpammyWords3 4756 1.33 3.40 0.37 87 MIME_HTML_ONLY_MULTI 4735 2.87 3.38 2.63 88 TR_XM_NoHeaderRelay 4594 1.18 3.28 0.20 89 XM_SPF_SoftFail 4547 2.12 3.25 1.60 90 XM_B_URI_Unicode 4526 2.45 3.23 2.09 91 XM_CamelCaseFrm001 4502 2.34 3.21 1.94 92 TM2_M_VERY_LONG_WORD 4462 2.13 3.19 1.64 93 RCVD_IN_VALIDITY_RPBL 4297 1.17 3.07 0.30 94 TR_XM_INV_DKIM 4279 1.00 3.05 0.05 95 RCVD_IN_MSPIKE_L3 4218 1.41 3.01 0.67 96 T_FILL_THIS_FORM_SHORT 4046 1.49 2.89 0.84 97 T_TooManySym_01 3963 5.17 2.83 6.26 98 RCVD_IN_MSPIKE_H4 3888 3.72 2.78 4.16 99 XMDiploma_00 3809 1.97 2.72 1.62 100 RELAYCOUNTRY_AU 3739 1.21 2.67 0.53 101 XM_SendGrid 3711 2.96 2.65 3.10 102 T_XMDrugObfuBody_08 3660 1.89 2.61 1.56 103 HTML_IMAGE_RATIO_08 3615 2.51 2.58 2.47 104 FROM_EXCESS_BASE64 3499 2.03 2.50 1.81 105 RCVD_IN_MSPIKE_H5 3478 5.53 2.48 6.95 106 SpammyFromTLD_02 3414 1.13 2.44 0.53 107 TM2_M_URI_OPT_OUT 3315 2.02 2.37 1.86 108 RCVD_IN_XBL 3216 0.74 2.30 0.02 109 HTML_IMAGE_ONLY_20 3202 0.95 2.29 0.33 110 BOTNET_NORDNS 3146 0.73 2.25 0.02 111 RCVD_IN_PBL 3137 1.26 2.24 0.81 112 RCVD_IN_VALIDITY_SAFE 3059 3.44 2.18 4.02 113 XMStockSpam_06 3027 1.68 2.16 1.46 114 XMBody_17 2987 0.95 2.13 0.40 115 BAYES_40 2984 4.20 2.13 5.16 116 XM_B_SpammyWords4 2926 1.36 2.09 1.02 117 SCC_BODY_URI_ONLY 2851 2.38 2.04 2.54 118 MAILING_LIST_MULTI 2773 2.86 1.98 3.27 119 SUBJ_ALL_CAPS 2711 1.60 1.94 1.44 120 ALL_TRUSTED 2677 10.84 1.91 14.97 121 XMBrknScrpt_02 2656 1.13 1.90 0.77 122 USER_IN_DEF_DKIM_WL 2635 10.00 1.88 13.75 123 DKIM_ADSP_NXDOMAIN 2632 0.78 1.88 0.27 124 HTML_MIME_NO_HTML_TAG 2604 2.47 1.86 2.76 125 SpammyFromTLD_01 2591 1.24 1.85 0.95 126 TR_LOTS_OF_MONEY2 2568 0.73 1.83 0.21 127 T_MONEY_PERCENT 2568 0.73 1.83 0.21 128 T_XMHurry_00 2560 0.97 1.83 0.58 129 TR_XM_MSPIKECOMBO2 2508 0.59 1.79 0.03 130 XMGenDplmaNmb 2496 1.08 1.78 0.75 131 T_REMOTE_IMAGE 2479 3.12 1.77 3.75 132 TM2_M_OBFU_COMMENT 2477 0.80 1.77 0.35 133 XMPhish30 2407 0.91 1.72 0.53 134 RCVD_IN_VALIDITY_CERTIFIED 2401 2.88 1.71 3.42 135 XM_H_Long_From02 2379 1.08 1.70 0.79 136 XM_DK_Undo_01 2372 1.97 1.69 2.09 137 RCVD_IN_MSPIKE_L4 2333 0.69 1.67 0.23 138 MultiRelay_CC 2266 0.66 1.62 0.22 139 RCVD_IN_IADB_LISTED 2236 2.85 1.60 3.43 140 URI_TRY_3LD 2167 0.87 1.55 0.55 141 URI_NOVOWEL 2165 1.44 1.55 1.39 142 TR_XM_DK_SendGrid 2151 1.86 1.54 2.01 143 TR_XM_PHPForged 2138 0.69 1.53 0.30 144 RCVD_IN_SBL 2117 0.48 1.51 0.00 145 RCVD_IN_SBL_CSS 2111 0.51 1.51 0.05 146 RCVD_IN_ZEN_LASTEXTERNAL 2080 0.47 1.49 0.00 147 SHORTCIRCUIT 2080 0.47 1.49 0.00 148 TR_XM_FormFill2 2078 0.67 1.48 0.30 149 TR_XM_PHPDW 2075 0.67 1.48 0.29 150 ANY_BOUNCE_MESSAGE 2056 2.83 1.47 3.46 151 BOUNCE_MESSAGE 2055 2.83 1.47 3.46 152 XM_H_PHPOS 2052 0.66 1.47 0.28 153 RCVD_IN_SBL_DROP 2016 0.46 1.44 0.00 154 XMMoneyMeta_00 2005 0.77 1.43 0.47 155 RCVD_IN_IADB_SPF 1991 2.50 1.42 3.00 156 T_XMDrugObfuBody_00 1897 1.12 1.35 1.01 157 XM_B_DNDMA 1894 0.98 1.35 0.81 158 RCVD_IN_PSBL 1890 0.73 1.35 0.44 159 XM_B_Phish66 1866 0.67 1.33 0.36 160 RCVD_IN_IADB_SENDERID 1862 2.25 1.33 2.67 161 RCVD_IN_IADB_DK 1837 2.20 1.31 2.61 162 TR_XM_MaxSPIKE 1829 0.43 1.31 0.02 163 URI_HEX 1822 1.35 1.30 1.37 164 RDNS_DYNAMIC 1802 0.52 1.29 0.17 165 XM_HighProb1 1783 0.40 1.27 0.00 166 KHOP_HELO_FCRDNS 1780 1.30 1.27 1.31 167 PDS_RDNS_DYNAMIC_FP 1757 0.42 1.25 0.04 168 TR_Mismatch_TLD_02 1750 0.46 1.25 0.09 169 PLING_QUERY 1724 0.65 1.23 0.39 170 RELAYCOUNTRY_FR 1708 0.61 1.22 0.32 171 XM_DIRTYINTL 1707 0.44 1.22 0.08 172 TR_XM_InvalidRelay 1706 0.40 1.22 0.01 173 TM2_M_A_HREF_HREF 1700 0.60 1.21 0.31 174 BAYES_20 1698 2.97 1.21 3.78 175 HTTPS_HTTP_MISMATCH 1697 0.83 1.21 0.66 176 XM_ProductURIs 1686 0.78 1.20 0.58 177 XMSexyCombo_01 1665 0.49 1.19 0.17 178 XMBody_78 1664 0.68 1.19 0.45 179 XM_B_COPY_HTML 1656 0.82 1.18 0.65 180 XM_B_SEO 1648 0.53 1.18 0.23 181 MPART_ALT_DIFF_COUNT 1622 0.76 1.16 0.57 182 T_Symld_Words_02 1575 0.98 1.12 0.92 183 NO_DNS_FOR_FROM 1571 0.52 1.12 0.24 184 XM_S_SpammyWords 1558 0.61 1.11 0.38 185 TR_XM_Spammywords 1558 0.61 1.11 0.38 186 TR_XM_MaxWHORU 1546 0.47 1.10 0.18 187 DKIM_ADSP_CUSTOM_MED 1546 0.95 1.10 0.88 188 TVD_RCVD_IP 1537 0.96 1.10 0.89 189 XM_UB60 1521 0.40 1.09 0.09 190 LongTLD 1520 0.71 1.09 0.54 191 MISSING_HEADERS 1513 0.59 1.08 0.36 192 XMPhish14 1504 0.78 1.07 0.65 193 DIET_1 1478 0.50 1.06 0.24 194 RELAYCOUNTRY_GB 1462 0.78 1.04 0.66 195 TR_LOTS_OF_MONEY3 1459 0.53 1.04 0.30 196 TR_XM_Base64_M1 1447 0.86 1.03 0.78 197 XM_UB99 1446 0.33 1.03 0.00 198 TR_XM_SEO4 1428 0.39 1.02 0.10 199 SUBJ_DOLLARS 1417 0.59 1.01 0.39 200 T_STY_INVIS_DIRECT 1383 0.61 0.99 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 300214 98.92 98.34 99.19 2 HTML_MESSAGE 260341 88.56 94.05 86.01 3 RELAYCOUNTRY_US 247495 81.38 80.54 81.77 4 DKIM_SIGNED 233268 80.88 89.12 77.07 5 XM_DK_Pass 230036 78.47 83.82 76.00 6 DKIM_VALID 226762 77.47 82.97 74.92 7 XM_B_Unicode 213267 73.94 81.46 70.46 8 DKIM_VALID_AU 185104 62.15 64.29 61.16 9 BAYES_50 183094 54.05 40.11 60.49 10 DCC_CHECK_NEGATIVE 178461 48.20 24.94 58.96 11 XMListUnsubscribeExists 148338 54.43 66.15 49.01 12 XM_B_SpammyWords 135072 51.92 67.68 44.63 13 DCC_CHECK 124091 51.30 73.56 41.00 14 XM_B_Unicode3 122825 42.65 47.13 40.58 15 DKIM_VALID_EF 94600 31.55 32.20 31.25 16 T_TM2_M_HEADER_IN_MSG 93427 28.05 21.95 30.87 17 LOC_TINY_FONT_1 87410 34.23 45.78 28.88 18 HTML_FONT_LOW_CONTRAST 84079 29.83 34.26 27.78 19 FVGT_m_MULTI_ODD 78993 27.94 31.92 26.10 20 XMSubLong 76377 25.53 26.16 25.23 21 T_KAM_HTML_FONT_INVALID 64471 23.82 29.26 21.30 22 MIME_HTML_ONLY 61429 23.77 31.28 20.30 23 RCVD_IN_MSPIKE_WL 58664 16.41 9.98 19.38 24 XM_B_SpammyWords2 54516 24.21 37.61 18.01 25 RCVD_IN_MSPIKE_H2 51862 18.18 20.45 17.13 26 ALL_TRUSTED 45321 10.84 1.91 14.97 27 TR_XM_DK_Unsub 43042 17.09 23.31 14.22 28 XM_Multi_Part_URI 41822 15.55 19.29 13.82 29 USER_IN_DEF_DKIM_WL 41623 10.00 1.88 13.75 30 UNPARSEABLE_RELAY 36322 13.69 17.35 12.00 31 BAYES_00 34286 7.97 0.72 11.33 32 XM_B_PhoneNumber 33089 9.51 6.44 10.93 33 XM_Evil_Numbers_Gen 28901 9.57 9.61 9.55 34 XM_B_Unsub 28365 12.44 19.06 9.37 35 FSL_BULK_SIG 27540 9.58 10.63 9.10 36 TooManyTo_001 27296 7.43 3.99 9.02 37 RCVD_IN_MSPIKE_H3 25049 7.15 4.72 8.28 38 LotsOfNums_01 23567 7.27 6.14 7.79 39 TR_XM_DK_Bayes 22924 5.37 0.61 7.57 40 TR_XM_DK_Bayes1 22524 5.28 0.60 7.44 41 RCVD_IN_MSPIKE_H5 21026 5.53 2.48 6.95 42 BAYES_60 20842 7.19 7.83 6.89 43 XM_DKIMWhitelistDomains 20464 4.62 0.01 6.76 44 TR_XM_BayesUnsub 20226 10.32 18.19 6.68 45 TR_MAX_INTL_RELAY 19208 9.03 14.82 6.35 46 TR_XM_DK_Bayes2 19087 4.40 0.29 6.31 47 T_TooManySym_01 18940 5.17 2.83 6.26 48 LOTS_OF_MONEY 18275 8.76 14.65 6.04 49 XM_H_GMP 17823 5.59 4.96 5.89 50 XM_B_Phish_Phrases 17562 6.34 7.50 5.80 51 XM_H_Long_From01 17305 5.82 6.03 5.72 52 MIME_QP_LONG_LINE 16086 4.72 3.42 5.31 53 XM_DK_Undo_02 15742 16.60 41.24 5.20 54 BAYES_40 15629 4.20 2.13 5.16 55 XMStrtUSub 15264 5.00 4.91 5.04 56 HTML_IMAGE_RATIO_02 15007 5.37 6.27 4.96 57 XM_B_SpammyWords3 14381 7.30 12.82 4.75 58 XM_PDF 14344 3.48 0.77 4.74 59 XM_UncommonTLD01 13641 5.27 6.93 4.51 60 MPART_ALT_DIFF 13541 5.09 6.42 4.47 61 XMSubMetaSx_00 13329 5.11 6.63 4.40 62 RCVD_IN_MSPIKE_H4 12589 3.72 2.78 4.16 63 XMNumbers 12324 4.02 3.90 4.07 64 HTML_IMAGE_RATIO_04 12318 4.43 5.22 4.07 65 TR_XM_SpammyWords4 12291 6.91 13.07 4.06 66 RCVD_IN_VALIDITY_SAFE 12156 3.44 2.18 4.02 67 BAYES_80 12123 5.65 9.21 4.01 68 RELAYCOUNTRY_META 11950 8.67 18.87 3.95 69 BAYES_20 11430 2.97 1.21 3.78 70 BAYES_99 11352 12.53 31.51 3.75 71 T_REMOTE_IMAGE 11350 3.12 1.77 3.75 72 ANY_BOUNCE_MESSAGE 10482 2.83 1.47 3.46 73 BOUNCE_MESSAGE 10476 2.83 1.47 3.46 74 RCVD_IN_IADB_LISTED 10367 2.85 1.60 3.43 75 RCVD_IN_VALIDITY_CERTIFIED 10362 2.88 1.71 3.42 76 TooManyTo_002 10148 2.54 0.80 3.35 77 MAILING_LIST_MULTI 9902 2.86 1.98 3.27 78 T_TooManySym_02 9811 2.52 0.95 3.24 79 BOTNET_IPINHOSTNAME 9671 6.09 12.34 3.20 80 XM_SendGrid 9376 2.96 2.65 3.10 81 HTML_IMAGE_RATIO_06 9273 3.20 3.50 3.06 82 RCVD_IN_IADB_SPF 9091 2.50 1.42 3.00 83 BAYES_999 8680 9.69 24.42 2.87 84 XM_B_SpammyTLD 8501 3.19 4.03 2.81 85 HTML_MIME_NO_HTML_TAG 8340 2.47 1.86 2.76 86 RCVD_IN_IADB_SENDERID 8096 2.25 1.33 2.67 87 MIME_HTML_ONLY_MULTI 7971 2.87 3.38 2.63 88 RCVD_IN_IADB_DK 7895 2.20 1.31 2.61 89 SCC_BODY_URI_ONLY 7692 2.38 2.04 2.54 90 HTML_IMAGE_RATIO_08 7476 2.51 2.58 2.47 91 INVALID_MSGID 7199 1.75 0.40 2.38 92 BAYES_95 7080 3.22 5.12 2.34 93 XM_Body_Dirty_Words 7009 3.75 6.84 2.32 94 RCVD_IN_IADB_VOUCHED 6942 1.80 0.74 2.29 95 BAYES_05 6830 1.75 0.66 2.26 96 MIME_HTML_MOSTLY 6531 2.56 3.44 2.16 97 TR_XM_DKIM_Undo 6517 10.83 29.59 2.15 98 DKIM_INVALID 6506 3.41 6.15 2.15 99 TO_MALFORMED 6359 1.57 0.43 2.10 100 XM_DK_Undo_01 6332 1.97 1.69 2.09 101 XM_B_URI_Unicode 6324 2.45 3.23 2.09 102 TR_XM_DK_SendGrid 6098 1.86 1.54 2.01 103 XM_CamelCaseFrm001 5866 2.34 3.21 1.94 104 T_XMDrugObfuBody_14 5860 2.59 4.00 1.94 105 TM2_M_URI_OPT_OUT 5641 2.02 2.37 1.86 106 TR_XM_SpammyRelay 5559 5.41 13.12 1.84 107 FROM_EXCESS_BASE64 5489 2.03 2.50 1.81 108 XMSexyCombo_05 5447 2.69 4.61 1.80 109 UNTRUSTED_Relay 5432 3.49 7.15 1.79 110 TR_XM_PhishingBody 5405 2.84 5.12 1.79 111 TooManyTo_003 5313 1.40 0.63 1.76 112 XM_B_Investor 5030 2.85 5.42 1.66 113 TM2_M_VERY_LONG_WORD 4975 2.13 3.19 1.64 114 TR_XM_UnparsRelay 4973 4.07 9.31 1.64 115 XMDiploma_00 4892 1.97 2.72 1.62 116 XM_SPF_SoftFail 4852 2.12 3.25 1.60 117 RCVD_IN_IADB_OPTIN 4835 1.25 0.49 1.60 118 TR_Symld_Words 4798 1.34 0.81 1.59 119 T_XMDrugObfuBody_08 4720 1.89 2.61 1.56 120 XMGappySubj_01 4622 1.11 0.21 1.53 121 XMStockSpam_06 4404 1.68 2.16 1.46 122 SUBJ_ALL_CAPS 4369 1.60 1.94 1.44 123 HELO_NODOT 4295 1.01 0.13 1.42 124 HELO_NO_DOMAIN 4294 1.01 0.12 1.42 125 XM_GoogleGroups 4268 1.24 0.87 1.41 126 TR_DCC_Bayes_99 4232 7.62 21.08 1.40 127 TR_XM_SpammyWords5 4217 2.16 3.80 1.39 128 URI_NOVOWEL 4198 1.44 1.55 1.39 129 IN_HORDE_ADDRESS_BOOK 4182 0.97 0.08 1.38 130 URI_HEX 4152 1.35 1.30 1.37 131 XM_B_Unsub2 4128 2.15 3.85 1.36 132 TooManyTo_004 3998 1.09 0.58 1.32 133 KHOP_HELO_FCRDNS 3971 1.30 1.27 1.31 134 BOTNET 3916 4.52 11.50 1.29 135 T_TooManySym_03 3749 1.01 0.52 1.24 136 XMCapTrack 3704 1.00 0.53 1.22 137 XM_UB50 3454 1.86 3.42 1.14 138 TooManyTo_005 3170 0.88 0.52 1.05 139 XM_B_SpammyWords4 3094 1.36 2.09 1.02 140 T_XMDrugObfuBody_00 3064 1.12 1.35 1.01 141 TVD_SPACE_RATIO 3010 0.78 0.33 0.99 142 XM_ShortIntro_01 2956 0.83 0.50 0.98 143 XM_B_FormFill 2891 0.66 0.03 0.96 144 SpammyFromTLD_01 2882 1.24 1.85 0.95 145 XM_OfRef6 2806 1.85 3.84 0.93 146 T_Symld_Words_02 2778 0.98 1.12 0.92 147 TR_XM_MSPIKECOMBO 2734 2.16 4.87 0.90 148 RCVD_IN_MSPIKE_BL 2734 2.16 4.87 0.90 149 TVD_RCVD_IP 2694 0.96 1.10 0.89 150 DKIM_ADSP_CUSTOM_MED 2667 0.95 1.10 0.88 151 FROM_GOV_DKIM_AU 2622 0.76 0.52 0.87 152 XMGappySubj_02 2571 0.60 0.06 0.85 153 T_FILL_THIS_FORM_SHORT 2542 1.49 2.89 0.84 154 RELAYCOUNTRY_CA 2511 2.75 6.90 0.83 155 XM_H_PHPMailer 2463 0.80 0.76 0.81 156 RCVD_IN_PBL 2441 1.26 2.24 0.81 157 XM_B_DNDMA 2438 0.98 1.35 0.81 158 XM_H_Long_From02 2394 1.08 1.70 0.79 159 TR_XM_Base64_M1 2368 0.86 1.03 0.78 160 XMBrknScrpt_02 2340 1.13 1.90 0.77 161 XMGenDplmaNmb 2280 1.08 1.78 0.75 162 TR_MetaPhish_Combo_01 2259 0.77 0.82 0.75 163 XMNoVowels 2192 0.63 0.41 0.72 164 XMLngstWrd_00 2040 0.62 0.51 0.67 165 RCVD_IN_MSPIKE_L3 2027 1.41 3.01 0.67 166 T_OBFU_PDF_ATTACH 2021 0.52 0.19 0.67 167 RELAYCOUNTRY_GB 2006 0.78 1.04 0.66 168 HTTPS_HTTP_MISMATCH 1992 0.83 1.21 0.66 169 RCVD_IN_BL_SPAMCOP_NET 1991 4.38 12.41 0.66 170 XMBSHREFv2 1966 0.54 0.30 0.65 171 XMPhish14 1965 0.78 1.07 0.65 172 TM2_M_BODY_EMPTY 1955 0.47 0.08 0.65 173 XM_B_COPY_HTML 1953 0.82 1.18 0.65 174 NML_ADSP_CUSTOM_MED 1868 0.72 0.94 0.62 175 XMLngstWrd_01 1818 0.56 0.46 0.60 176 FORGED_GMAIL_RCVD 1776 0.64 0.77 0.59 177 XM_ProductURIs 1747 0.78 1.20 0.58 178 T_XMHurry_00 1747 0.97 1.83 0.58 179 MPART_ALT_DIFF_COUNT 1725 0.76 1.16 0.57 180 XM_RXBody 1725 0.53 0.45 0.57 181 XMSlimDrugH 1708 0.60 0.68 0.56 182 URI_TRY_3LD 1665 0.87 1.55 0.55 183 LongTLD 1626 0.71 1.09 0.54 184 XMPhish30 1611 0.91 1.72 0.53 185 HTML_TAG_BALANCE_BODY 1606 0.60 0.75 0.53 186 SpammyFromTLD_02 1600 1.13 2.44 0.53 187 RELAYCOUNTRY_AU 1600 1.21 2.67 0.53 188 XMBdyGiftCard01 1586 0.62 0.84 0.52 189 HTML_IMAGE_ONLY_32 1543 0.43 0.25 0.51 190 MSGID_FROM_MTA_HEADER 1542 0.43 0.26 0.51 191 TRACKER_ID 1481 0.38 0.14 0.49 192 TR_XM_SpammyWords2 1448 3.47 9.93 0.48 193 XMMoneyMeta_00 1410 0.77 1.43 0.47 194 SHORT_HELO_AND_INLINE_IMAGE 1405 0.33 0.03 0.46 195 XMHTML_After_End 1370 0.57 0.82 0.45 196 XMBody_78 1347 0.68 1.19 0.45 197 XMLngstWrd_02 1345 0.41 0.32 0.44 198 T_STY_INVIS_DIRECT 1336 0.61 0.99 0.44 199 RCVD_IN_PSBL 1329 0.73 1.35 0.44 200 XMSolicitRefs_0 1317 0.47 0.54 0.44 ----------------------------------------------------------------------