Email: 266488 Autolearn: 0 AvgScore: 4.70 AvgScanTime: 1.34 sec Spam: 83202 Autolearn: 0 AvgScore: 14.58 AvgScanTime: 1.46 sec Ham: 183286 Autolearn: 0 AvgScore: 0.21 AvgScanTime: 1.28 sec Time Spent Running SA: 99.10 hours Time Spent Processing Spam: 33.71 hours Time Spent Processing Ham: 65.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 82721 99.56 99.42 99.62 2 HTML_MESSAGE 77340 87.60 92.95 85.17 3 DKIM_SIGNED 73815 73.27 88.72 66.25 4 XM_DK_Pass 70751 71.66 85.04 65.59 5 DKIM_VALID 70337 71.22 84.54 65.18 6 XM_B_Unicode 69779 74.74 83.87 70.60 7 DCC_CHECK 65782 57.39 79.06 47.55 8 RELAYCOUNTRY_US 65760 82.03 79.04 83.38 9 XMListUnsubscribeExists 58596 53.83 70.43 46.30 10 XM_B_SpammyWords 57237 52.24 68.79 44.72 11 DKIM_VALID_AU 55510 59.25 66.72 55.87 12 XM_B_Unicode3 41943 46.88 50.41 45.28 13 LOC_TINY_FONT_1 40052 35.64 48.14 29.96 14 XM_DK_Undo_02 36064 17.29 43.35 5.47 15 XM_B_SpammyWords2 31423 23.78 37.77 17.43 16 HTML_FONT_LOW_CONTRAST 29772 36.64 35.78 37.03 17 BAYES_99 29248 14.12 35.15 4.57 18 BAYES_50 28984 52.31 34.84 60.24 19 FVGT_m_MULTI_ODD 28011 27.86 33.67 25.22 20 TR_XM_DKIM_Undo 26693 11.73 32.08 2.50 21 DKIM_VALID_EF 25494 27.65 30.64 26.29 22 MIME_HTML_ONLY 23375 22.54 28.09 20.02 23 T_KAM_HTML_FONT_INVALID 23350 20.95 28.06 17.73 24 BAYES_999 22812 11.04 27.42 3.61 25 TR_DCC_Bayes_99 21307 9.50 25.61 2.19 26 TR_XM_DK_Unsub 20135 16.69 24.20 13.28 27 XMSubLong 17898 19.74 21.51 18.93 28 RCVD_IN_MSPIKE_H2 17000 16.21 20.43 14.29 29 DCC_CHECK_NEGATIVE 16999 42.44 20.43 52.43 30 RELAYCOUNTRY_META 16658 8.03 20.02 2.58 31 XM_Multi_Part_URI 15648 16.05 18.81 14.80 32 T_TM2_M_HEADER_IN_MSG 15475 24.54 18.60 27.24 33 UNPARSEABLE_RELAY 14194 14.15 17.06 12.82 34 XM_B_Unsub 14133 11.50 16.99 9.02 35 TR_MAX_INTL_RELAY 13435 9.13 16.15 5.95 36 TR_XM_BayesUnsub 13434 9.80 16.15 6.93 37 XM_B_SpammyWords3 11990 8.03 14.41 5.13 38 TR_XM_SpammyRelay 11571 5.23 13.91 1.29 39 LOTS_OF_MONEY 11019 7.23 13.24 4.50 40 RCVD_IN_BL_SPAMCOP_NET 10432 4.22 12.54 0.45 41 TR_XM_SpammyWords2 10327 4.33 12.41 0.66 42 BOTNET_IPINHOSTNAME 9746 5.92 11.71 3.29 43 FSL_BULK_SIG 9171 11.98 11.02 12.41 44 TR_XM_SpammyWords4 8572 5.42 10.30 3.20 45 TR_XM_UnparsRelay 8495 4.37 10.21 1.72 46 BAYES_80 8278 5.45 9.95 3.40 47 BAYES_60 7931 7.20 9.53 6.14 48 BOTNET 7607 3.54 9.14 1.00 49 RCVD_IN_MSPIKE_WL 7026 12.39 8.44 14.18 50 XM_Evil_Numbers_Gen 7019 13.69 8.44 16.07 51 RELAYCOUNTRY_CA 6887 3.14 8.28 0.81 52 HTML_IMAGE_RATIO_02 6679 5.85 8.03 4.87 53 UNTRUSTED_Relay 6602 3.45 7.93 1.41 54 XM_Body_Dirty_Words 6452 3.72 7.75 1.89 55 XMSubMetaSx_00 6415 5.04 7.71 3.83 56 XM_UncommonTLD01 6297 5.88 7.57 5.11 57 XM_B_Phish_Phrases 5441 4.85 6.54 4.08 58 XM_H_GMP 5348 6.19 6.43 6.08 59 TR_XM_MSPIKECOMBO 5017 2.39 6.03 0.74 60 RCVD_IN_MSPIKE_BL 5017 2.39 6.03 0.74 61 BAYES_95 4908 3.59 5.90 2.54 62 XM_H_Long_From01 4661 5.14 5.60 4.93 63 RCVD_IN_VALIDITY_RPBL 4599 2.14 5.53 0.60 64 LotsOfNums_01 4554 5.83 5.47 5.99 65 HTML_IMAGE_RATIO_04 4447 6.84 5.34 7.51 66 XMSexyCombo_05 4435 2.41 5.33 1.08 67 MPART_ALT_DIFF 4376 5.90 5.26 6.19 68 XM_OfRef6 4304 2.10 5.17 0.71 69 XM_B_SpammyTLD 3854 3.16 4.63 2.49 70 XM_CamelCaseFrm001 3750 2.59 4.51 1.72 71 XM_SPF_SoftFail 3699 2.10 4.45 1.04 72 T_XMDrugObfuBody_14 3686 2.78 4.43 2.03 73 XM_B_PhoneNumber 3628 5.39 4.36 5.86 74 XMStrtUSub 3624 6.30 4.36 7.18 75 TR_XM_SPAMCOP 3485 1.36 4.19 0.08 76 DKIM_INVALID 3478 2.04 4.18 1.07 77 TR_XM_PhishingBody 3459 2.39 4.16 1.59 78 XM_B_Investor 3430 2.03 4.12 1.08 79 RCVD_IN_MSPIKE_H3 3351 5.65 4.03 6.38 80 SUBJ_ALL_CAPS 3305 1.84 3.97 0.87 81 TR_XM_SpammyWords3 3298 1.44 3.96 0.29 82 T_FILL_THIS_FORM_SHORT 3184 1.57 3.83 0.55 83 TooManyTo_001 3167 4.84 3.81 5.30 84 XM_UB50 3131 1.70 3.76 0.77 85 RCVD_IN_MSPIKE_L3 3112 1.51 3.74 0.50 86 TR_XM_NoHeaderRelay 3059 1.28 3.68 0.19 87 XM_URI_RBL 3047 1.49 3.66 0.51 88 TM2_M_VERY_LONG_WORD 2948 7.90 3.54 9.88 89 SpammyFromTLD_02 2925 1.28 3.52 0.26 90 RCVD_IN_XBL 2790 1.05 3.35 0.01 91 T_TooManySym_01 2740 5.96 3.29 7.17 92 XMNumbers 2727 3.85 3.28 4.10 93 XMBody_17 2642 1.33 3.18 0.49 94 TR_XM_SpammyWords5 2630 1.78 3.16 1.15 95 MIME_HTML_MOSTLY 2565 2.71 3.08 2.54 96 MIME_HTML_ONLY_MULTI 2474 3.92 2.97 4.35 97 RELAYCOUNTRY_AU 2466 1.21 2.96 0.41 98 RCVD_IN_SBL_CSS 2427 0.92 2.92 0.01 99 RCVD_IN_MSPIKE_H4 2379 3.16 2.86 3.30 100 TR_XM_InvalidRelay 2378 0.90 2.86 0.01 101 XMDiploma_00 2372 2.09 2.85 1.75 102 HTML_IMAGE_RATIO_06 2298 3.85 2.76 4.34 103 T_XMHurry_00 2242 1.33 2.69 0.71 104 XM_B_Unsub2 2221 1.64 2.67 1.18 105 XM_SendGrid 2210 3.21 2.66 3.46 106 FROM_EXCESS_BASE64 2155 2.07 2.59 1.83 107 TM2_M_URI_OPT_OUT 2151 2.06 2.59 1.82 108 RCVD_IN_VALIDITY_SAFE 2141 4.79 2.57 5.79 109 DKIM_ADSP_CUSTOM_MED 2126 1.27 2.56 0.69 110 TR_Mismatch_TLD_01 2109 1.02 2.53 0.34 111 RCVD_IN_PBL 2090 1.19 2.51 0.60 112 T_XMDrugObfuBody_08 2014 1.97 2.42 1.76 113 USER_IN_DEF_DKIM_WL 1999 12.29 2.40 16.78 114 NML_ADSP_CUSTOM_MED 1977 1.02 2.38 0.41 115 FORGED_GMAIL_RCVD 1968 1.05 2.37 0.46 116 HK_RANDOM_REPLYTO 1931 0.81 2.32 0.12 117 XMSubMetaI_00 1817 1.29 2.18 0.89 118 TR_XM_INV_DKIM 1794 0.72 2.16 0.06 119 TR_LOTS_OF_MONEY3 1785 0.97 2.15 0.44 120 ADVANCE_FEE_5_NEW_MONEY 1763 0.66 2.12 0.00 121 XM_B_URI_Unicode 1750 1.46 2.10 1.17 122 HTML_IMAGE_RATIO_08 1731 2.22 2.08 2.28 123 KHOP_HELO_FCRDNS 1728 4.45 2.08 5.53 124 XMBrknScrpt_02 1721 1.43 2.07 1.14 125 BOTNET_NORDNS 1705 0.65 2.05 0.01 126 XM_B_SpammyWords4 1699 1.05 2.04 0.59 127 MIME_QP_LONG_LINE 1674 2.49 2.01 2.71 128 SpammyFromTLD_01 1673 0.85 2.01 0.33 129 XMStockSpam_06 1650 1.64 1.98 1.48 130 RDNS_DYNAMIC 1639 0.75 1.97 0.20 131 RCVD_IN_SBL 1638 0.61 1.97 0.00 132 PDS_RDNS_DYNAMIC_FP 1615 0.62 1.94 0.02 133 SCC_BODY_URI_ONLY 1557 2.43 1.87 2.68 134 RCVD_IN_SBL_DROP 1534 0.58 1.84 0.00 135 LongTLD 1519 1.09 1.83 0.75 136 TR_XM_MSPIKECOMBO2 1513 0.57 1.82 0.01 137 RCVD_IN_VALIDITY_CERTIFIED 1483 3.97 1.78 4.96 138 ALL_TRUSTED 1467 10.21 1.76 14.04 139 TR_Sbj_FN_Bdy 1447 0.59 1.74 0.07 140 TR_XM_DK_SendGrid 1421 2.20 1.71 2.43 141 XM_B_COPY_HTML 1421 1.52 1.71 1.44 142 XM_HighProb1 1418 0.54 1.70 0.00 143 RCVD_IN_PSBL 1390 0.84 1.67 0.46 144 XM_ProductURIs 1387 0.97 1.67 0.66 145 XM_B_Phish66 1387 0.71 1.67 0.27 146 TR_XM_FormFill 1379 0.53 1.66 0.01 147 XM_UB60 1373 0.55 1.65 0.06 148 URI_NOVOWEL 1355 1.39 1.63 1.27 149 MAILING_LIST_MULTI 1350 2.08 1.62 2.29 150 RCVD_IN_MSPIKE_L4 1345 0.67 1.62 0.24 151 XM_B_DNDMA 1345 0.82 1.62 0.46 152 XMSexyCombo_01 1321 0.58 1.59 0.12 153 TR_XM_PHPForged 1301 0.63 1.56 0.21 154 RCVD_IN_MSPIKE_H5 1296 3.58 1.56 4.50 155 HTML_MIME_NO_HTML_TAG 1293 1.70 1.55 1.77 156 TR_XM_FormFill2 1290 0.62 1.55 0.19 157 XM_OfRef7 1287 0.59 1.55 0.16 158 URI_TRY_3LD 1286 0.87 1.55 0.56 159 TR_Mismatch_TLD_02 1278 0.52 1.54 0.05 160 TVD_RCVD_IP 1274 1.36 1.53 1.28 161 MultiRelay_CC 1270 0.56 1.53 0.12 162 XMPhish30 1261 0.89 1.52 0.61 163 TR_XM_PHPDW 1247 0.60 1.50 0.19 164 HTML_IMAGE_ONLY_20 1246 0.80 1.50 0.49 165 XM_H_PHPOS 1233 0.59 1.48 0.18 166 URI_HEX 1228 1.06 1.48 0.87 167 BAYES_40 1217 4.95 1.46 6.54 168 TR_XM_MaxSPIKE 1166 0.44 1.40 0.00 169 DIET_1 1139 0.68 1.37 0.37 170 THIS_AD 1135 0.72 1.36 0.43 171 FROM_SUSPICIOUS_NTLD 1099 0.47 1.32 0.09 172 T_STY_INVIS_DIRECT 1084 0.85 1.30 0.65 173 RELAYCOUNTRY_SG 1068 0.42 1.28 0.02 174 MPART_ALT_DIFF_COUNT 1058 0.66 1.27 0.39 175 XM_DIRTYINTL 1044 0.42 1.25 0.05 176 TM2_M_A_HREF_HREF 1028 0.49 1.24 0.15 177 T_TooManySym_02 1014 3.21 1.22 4.11 178 XM_H_Long_From02 1005 0.87 1.21 0.72 179 XMFrmHeader_28 999 0.37 1.20 0.00 180 BAYES_20 992 3.33 1.19 4.30 181 T_XMDrugObfuBody_00 987 0.87 1.19 0.73 182 TR_XM_Base64_M1 985 0.88 1.18 0.74 183 HELO_DYNAMIC_SPLIT_IP 977 0.37 1.17 0.00 184 XM_B_REG_HTML 966 0.51 1.16 0.21 185 DKIM_ADSP_NXDOMAIN 958 0.62 1.15 0.38 186 T_REMOTE_IMAGE 936 2.09 1.12 2.53 187 XMBody_78 931 0.53 1.12 0.27 188 XMHTMLBadTable_001 922 0.51 1.11 0.23 189 SUBJ_DOLLARS 904 0.62 1.09 0.40 190 SHOPIFY_IMG_NOT_RCVD_SFY 883 0.48 1.06 0.22 191 XMReplyNow 869 0.42 1.04 0.13 192 XMGenDplmaNmb 865 0.99 1.04 0.97 193 T_Symld_Words_02 865 0.55 1.04 0.32 194 XM_DK_Undo_01 857 1.35 1.03 1.50 195 FONT_INVIS_LONG_LINE 846 0.34 1.02 0.03 196 HTML_TAG_BALANCE_BODY 840 0.89 1.01 0.83 197 XM_UB99 799 0.30 0.96 0.00 198 TM2_M_OBFU_COMMENT 779 0.65 0.94 0.52 199 TR_Caps_n_Bayes_99 776 0.31 0.93 0.03 200 XMSubMetaD_03 758 0.29 0.91 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 182585 99.56 99.42 99.62 2 HTML_MESSAGE 156096 87.60 92.95 85.17 3 RELAYCOUNTRY_US 152829 82.03 79.04 83.38 4 XM_B_Unicode 129402 74.74 83.87 70.60 5 DKIM_SIGNED 121430 73.27 88.72 66.25 6 XM_DK_Pass 120219 71.66 85.04 65.59 7 DKIM_VALID 119467 71.22 84.54 65.18 8 BAYES_50 110420 52.31 34.84 60.24 9 DKIM_VALID_AU 102393 59.25 66.72 55.87 10 DCC_CHECK_NEGATIVE 96091 42.44 20.43 52.43 11 DCC_CHECK 87158 57.39 79.06 47.55 12 XMListUnsubscribeExists 84863 53.83 70.43 46.30 13 XM_B_Unicode3 82986 46.88 50.41 45.28 14 XM_B_SpammyWords 81974 52.24 68.79 44.72 15 HTML_FONT_LOW_CONTRAST 67872 36.64 35.78 37.03 16 LOC_TINY_FONT_1 54918 35.64 48.14 29.96 17 T_TM2_M_HEADER_IN_MSG 49925 24.54 18.60 27.24 18 DKIM_VALID_EF 48193 27.65 30.64 26.29 19 FVGT_m_MULTI_ODD 46233 27.86 33.67 25.22 20 MIME_HTML_ONLY 36686 22.54 28.09 20.02 21 XMSubLong 34705 19.74 21.51 18.93 22 T_KAM_HTML_FONT_INVALID 32489 20.95 28.06 17.73 23 XM_B_SpammyWords2 31941 23.78 37.77 17.43 24 USER_IN_DEF_DKIM_WL 30755 12.29 2.40 16.78 25 XM_Evil_Numbers_Gen 29460 13.69 8.44 16.07 26 XM_Multi_Part_URI 27129 16.05 18.81 14.80 27 RCVD_IN_MSPIKE_H2 26186 16.21 20.43 14.29 28 RCVD_IN_MSPIKE_WL 25990 12.39 8.44 14.18 29 ALL_TRUSTED 25741 10.21 1.76 14.04 30 TR_XM_DK_Unsub 24347 16.69 24.20 13.28 31 ANY_BOUNCE_MESSAGE 24077 9.32 0.90 13.14 32 BOUNCE_MESSAGE 24072 9.32 0.90 13.13 33 UNPARSEABLE_RELAY 23506 14.15 17.06 12.82 34 FSL_BULK_SIG 22749 11.98 11.02 12.41 35 TM2_M_VERY_LONG_WORD 18112 7.90 3.54 9.88 36 BAYES_00 18007 7.02 0.85 9.82 37 HTML_IMAGE_ONLY_32 17422 6.57 0.10 9.51 38 XM_B_Unsub 16524 11.50 16.99 9.02 39 MAY_BE_FORGED 15577 5.85 0.01 8.50 40 XM_DKIMWhitelistDomains 14772 5.55 0.02 8.06 41 HTML_IMAGE_RATIO_04 13771 6.84 5.34 7.51 42 XMStrtUSub 13155 6.30 4.36 7.18 43 T_TooManySym_01 13147 5.96 3.29 7.17 44 TR_XM_BayesUnsub 12695 9.80 16.15 6.93 45 BAYES_40 11979 4.95 1.46 6.54 46 RCVD_IN_MSPIKE_H3 11696 5.65 4.03 6.38 47 MPART_ALT_DIFF 11344 5.90 5.26 6.19 48 BAYES_60 11262 7.20 9.53 6.14 49 XM_H_GMP 11150 6.19 6.43 6.08 50 LotsOfNums_01 10974 5.83 5.47 5.99 51 TR_XM_DK_Bayes 10908 4.33 0.77 5.95 52 TR_MAX_INTL_RELAY 10899 9.13 16.15 5.95 53 TR_XM_DK_Bayes1 10829 4.30 0.77 5.91 54 XM_B_PhoneNumber 10732 5.39 4.36 5.86 55 RCVD_IN_VALIDITY_SAFE 10611 4.79 2.57 5.79 56 KHOP_HELO_FCRDNS 10139 4.45 2.08 5.53 57 XM_DK_Undo_02 10024 17.29 43.35 5.47 58 TooManyTo_001 9722 4.84 3.81 5.30 59 XM_B_SpammyWords3 9411 8.03 14.41 5.13 60 XM_UncommonTLD01 9362 5.88 7.57 5.11 61 RCVD_IN_VALIDITY_CERTIFIED 9090 3.97 1.78 4.96 62 TR_XM_DK_Bayes2 9076 3.62 0.68 4.95 63 XM_H_Long_From01 9039 5.14 5.60 4.93 64 HTML_IMAGE_RATIO_02 8919 5.85 8.03 4.87 65 HTML_FONT_FACE_BAD 8608 3.42 0.61 4.70 66 BAYES_99 8381 14.12 35.15 4.57 67 RCVD_IN_MSPIKE_H5 8253 3.58 1.56 4.50 68 LOTS_OF_MONEY 8245 7.23 13.24 4.50 69 XM_H_Trusted_IP 8178 3.07 0.00 4.46 70 MIME_HTML_ONLY_MULTI 7981 3.92 2.97 4.35 71 HTML_IMAGE_RATIO_06 7961 3.85 2.76 4.34 72 BAYES_20 7887 3.33 1.19 4.30 73 T_TooManySym_02 7529 3.21 1.22 4.11 74 XMNumbers 7520 3.85 3.28 4.10 75 INVALID_MSGID 7518 3.02 0.65 4.10 76 XM_B_Phish_Phrases 7472 4.85 6.54 4.08 77 XMSubMetaSx_00 7019 5.04 7.71 3.83 78 MIME_CHARSET_FARAWAY 6703 2.63 0.37 3.66 79 BAYES_999 6611 11.04 27.42 3.61 80 CHARSET_FARAWAY_HEADER 6461 2.50 0.25 3.53 81 TO_MALFORMED 6392 2.41 0.05 3.49 82 XM_SendGrid 6337 3.21 2.66 3.46 83 BAYES_80 6239 5.45 9.95 3.40 84 RCVD_IN_MSPIKE_H4 6041 3.16 2.86 3.30 85 BOTNET_IPINHOSTNAME 6039 5.92 11.71 3.29 86 TR_XM_SpammyWords4 5872 5.42 10.30 3.20 87 MIME_QP_LONG_LINE 4958 2.49 2.01 2.71 88 SCC_BODY_URI_ONLY 4906 2.43 1.87 2.68 89 RELAYCOUNTRY_META 4736 8.03 20.02 2.58 90 MIME_HTML_MOSTLY 4659 2.71 3.08 2.54 91 BAYES_95 4653 3.59 5.90 2.54 92 T_REMOTE_IMAGE 4644 2.09 1.12 2.53 93 TR_XM_DKIM_Undo 4576 11.73 32.08 2.50 94 XM_B_SpammyTLD 4558 3.16 4.63 2.49 95 BAYES_05 4454 1.87 0.64 2.43 96 TR_XM_DK_SendGrid 4452 2.20 1.71 2.43 97 MAILING_LIST_MULTI 4192 2.08 1.62 2.29 98 HTML_IMAGE_RATIO_08 4183 2.22 2.08 2.28 99 TR_DCC_Bayes_99 4019 9.50 25.61 2.19 100 T_XMDrugObfuBody_14 3723 2.78 4.43 2.03 101 XM_PDF 3611 1.50 0.48 1.97 102 TooManyTo_002 3476 1.57 0.85 1.90 103 XM_Body_Dirty_Words 3458 3.72 7.75 1.89 104 FROM_EXCESS_BASE64 3355 2.07 2.59 1.83 105 TM2_M_URI_OPT_OUT 3328 2.06 2.59 1.82 106 RCVD_IN_IADB_LISTED 3314 1.48 0.77 1.81 107 HTML_MIME_NO_HTML_TAG 3244 1.70 1.55 1.77 108 T_XMDrugObfuBody_08 3226 1.97 2.42 1.76 109 T_TVD_MIME_NO_HEADERS 3215 1.23 0.06 1.75 110 XMDiploma_00 3200 2.09 2.85 1.75 111 XM_CamelCaseFrm001 3149 2.59 4.51 1.72 112 TR_XM_UnparsRelay 3149 4.37 10.21 1.72 113 T_TooManySym_03 3065 1.34 0.62 1.67 114 RCVD_IN_IADB_SPF 3013 1.34 0.68 1.64 115 TR_XM_PhishingBody 2923 2.39 4.16 1.59 116 RCVD_IN_IADB_SENDERID 2783 1.24 0.63 1.52 117 XM_DK_Undo_01 2752 1.35 1.03 1.50 118 RCVD_IN_IADB_DK 2738 1.23 0.63 1.49 119 XMStockSpam_06 2715 1.64 1.98 1.48 120 IN_HORDE_ADDRESS_BOOK 2652 1.03 0.11 1.45 121 XM_B_COPY_HTML 2632 1.52 1.71 1.44 122 UNTRUSTED_Relay 2589 3.45 7.93 1.41 123 TVD_SPACE_RATIO 2530 1.08 0.40 1.38 124 TR_XM_SpammyRelay 2358 5.23 13.91 1.29 125 TVD_RCVD_IP 2355 1.36 1.53 1.28 126 URI_NOVOWEL 2336 1.39 1.63 1.27 127 XMBdyGiftCard01 2240 1.09 0.81 1.22 128 XM_B_Unsub2 2156 1.64 2.67 1.18 129 XM_B_URI_Unicode 2138 1.46 2.10 1.17 130 XMGappySubj_01 2106 0.84 0.15 1.15 131 TR_XM_SpammyWords5 2104 1.78 3.16 1.15 132 XMBrknScrpt_02 2096 1.43 2.07 1.14 133 RCVD_IN_IADB_VOUCHED 2072 0.90 0.41 1.13 134 XM_B_Investor 1978 2.03 4.12 1.08 135 XMSexyCombo_05 1975 2.41 5.33 1.08 136 XM_GoogleGroups 1966 1.00 0.84 1.07 137 DKIM_INVALID 1963 2.04 4.18 1.07 138 XM_SPF_SoftFail 1899 2.10 4.45 1.04 139 XMGappySubj_02 1850 0.71 0.05 1.01 140 BOTNET 1824 3.54 9.14 1.00 141 TR_Symld_Words 1814 0.96 0.91 0.99 142 XMGenDplmaNmb 1780 0.99 1.04 0.97 143 XM_ShortIntro_01 1714 0.86 0.71 0.94 144 XMSubMetaI_00 1623 1.29 2.18 0.89 145 XMBSHREFv2 1618 0.68 0.24 0.88 146 URI_HEX 1602 1.06 1.48 0.87 147 SUBJ_ALL_CAPS 1590 1.84 3.97 0.87 148 XM_H_PHPMailer 1573 0.81 0.70 0.86 149 RCVD_IN_IADB_OPTIN 1536 0.67 0.29 0.84 150 HTML_TAG_BALANCE_BODY 1528 0.89 1.01 0.83 151 TooManyTo_003 1525 0.82 0.79 0.83 152 RELAYCOUNTRY_CA 1483 3.14 8.28 0.81 153 XMLngstWrd_00 1469 0.74 0.59 0.80 154 XM_B_FormFill 1419 0.53 0.01 0.77 155 XM_UB50 1410 1.70 3.76 0.77 156 LongTLD 1383 1.09 1.83 0.75 157 TR_XM_MSPIKECOMBO 1365 2.39 6.03 0.74 158 RCVD_IN_MSPIKE_BL 1365 2.39 6.03 0.74 159 TR_XM_Base64_M1 1355 0.88 1.18 0.74 160 TR_MetaPhish_Combo_01 1337 0.71 0.66 0.73 161 T_XMDrugObfuBody_00 1331 0.87 1.19 0.73 162 XM_H_Long_From02 1319 0.87 1.21 0.72 163 XMSubNoVowel 1311 0.64 0.49 0.72 164 XMLngstWrd_01 1309 0.66 0.54 0.71 165 T_XMHurry_00 1298 1.33 2.69 0.71 166 XM_OfRef6 1293 2.10 5.17 0.71 167 DKIM_ADSP_CUSTOM_MED 1260 1.27 2.56 0.69 168 TR_XM_SpammyWords2 1213 4.33 12.41 0.66 169 XM_ProductURIs 1211 0.97 1.67 0.66 170 MSGID_FROM_MTA_HEADER 1199 0.51 0.19 0.65 171 T_STY_INVIS_DIRECT 1187 0.85 1.30 0.65 172 TooManyTo_004 1156 0.67 0.75 0.63 173 XMPhish30 1119 0.89 1.52 0.61 174 RCVD_IN_VALIDITY_RPBL 1102 2.14 5.53 0.60 175 RCVD_IN_PBL 1094 1.19 2.51 0.60 176 XMSlimDrugH 1092 0.69 0.90 0.60 177 XM_B_SpammyWords4 1088 1.05 2.04 0.59 178 HTML_TAG_BALANCE_CENTER 1074 0.58 0.55 0.59 179 XM_H_CodeIgniter 1053 0.45 0.17 0.57 180 URI_TRY_3LD 1023 0.87 1.55 0.56 181 T_FILL_THIS_FORM_SHORT 1013 1.57 3.83 0.55 182 MSGID_SHORT 996 0.42 0.15 0.54 183 TooManyTo_005 993 0.60 0.73 0.54 184 XMLngstWrd_02 972 0.51 0.48 0.53 185 XMNoVowels 967 0.46 0.31 0.53 186 TM2_M_OBFU_COMMENT 945 0.65 0.94 0.52 187 XM_URI_RBL 932 1.49 3.66 0.51 188 RCVD_IN_MSPIKE_L3 908 1.51 3.74 0.50 189 HTML_IMAGE_ONLY_20 899 0.80 1.50 0.49 190 XMBody_17 895 1.33 3.18 0.49 191 XM_RXBody 876 0.51 0.59 0.48 192 XM_B_DNDMA 849 0.82 1.62 0.46 193 RCVD_IN_PSBL 842 0.84 1.67 0.46 194 T_TooManySym_04 840 0.38 0.22 0.46 195 HTTPS_HTTP_MISMATCH 834 0.55 0.75 0.46 196 FORGED_GMAIL_RCVD 834 1.05 2.37 0.46 197 RCVD_IN_BL_SPAMCOP_NET 827 4.22 12.54 0.45 198 TR_LOTS_OF_MONEY3 806 0.97 2.15 0.44 199 XMHTML_After_End 799 0.43 0.42 0.44 200 PLING_QUERY 788 0.54 0.77 0.43 ----------------------------------------------------------------------