Email: 484852 Autolearn: 0 AvgScore: 4.97 AvgScanTime: 1.51 sec Spam: 143206 Autolearn: 0 AvgScore: 14.72 AvgScanTime: 1.70 sec Ham: 341646 Autolearn: 0 AvgScore: 0.88 AvgScanTime: 1.43 sec Time Spent Running SA: 202.83 hours Time Spent Processing Spam: 67.54 hours Time Spent Processing Ham: 135.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 140798 98.90 98.32 99.15 2 HTML_MESSAGE 135921 88.75 94.91 86.17 3 DKIM_SIGNED 123334 79.01 86.12 76.03 4 XM_DK_Pass 117086 77.00 81.76 75.01 5 XM_B_Unicode 115596 72.31 80.72 68.79 6 DKIM_VALID 114870 75.79 80.21 73.94 7 RELAYCOUNTRY_US 111838 79.71 78.10 80.38 8 DCC_CHECK 107060 49.97 74.76 39.58 9 XM_B_SpammyWords 94383 49.79 65.91 43.03 10 XMListUnsubscribeExists 91787 52.47 64.09 47.60 11 DKIM_VALID_AU 90001 60.79 62.85 59.93 12 XM_B_Unicode3 67717 42.13 47.29 39.97 13 LOC_TINY_FONT_1 64172 32.73 44.81 27.67 14 BAYES_50 58976 54.31 41.18 59.81 15 XM_DK_Undo_02 56994 15.20 39.80 4.88 16 XM_B_SpammyWords2 53820 23.57 37.58 17.70 17 HTML_FONT_LOW_CONTRAST 49362 29.18 34.47 26.96 18 MIME_HTML_ONLY 47019 24.35 32.83 20.79 19 FVGT_m_MULTI_ODD 45184 26.80 31.55 24.81 20 BAYES_99 43153 11.31 30.13 3.41 21 DKIM_VALID_EF 42319 30.01 29.55 30.20 22 TR_XM_DKIM_Undo 40527 9.78 28.30 2.02 23 T_KAM_HTML_FONT_INVALID 40475 24.16 28.26 22.44 24 XMSubLong 36180 22.79 25.26 21.75 25 DCC_CHECK_NEGATIVE 34044 49.56 23.77 60.37 26 BAYES_999 33434 8.73 23.35 2.61 27 XM_B_Unsub 32496 13.18 22.69 9.20 28 TR_XM_BayesUnsub 31235 11.43 21.81 7.07 29 T_TM2_M_HEADER_IN_MSG 31089 26.99 21.71 29.20 30 TR_XM_DK_Unsub 30451 15.54 21.26 13.14 31 TR_DCC_Bayes_99 29993 7.05 20.94 1.22 32 RELAYCOUNTRY_META 28493 8.54 19.90 3.78 33 RCVD_IN_MSPIKE_H2 28028 18.34 19.57 17.83 34 XM_Multi_Part_URI 27316 15.16 19.07 13.51 35 UNPARSEABLE_RELAY 24065 14.34 16.80 13.30 36 TR_MAX_INTL_RELAY 20284 8.38 14.16 5.96 37 XM_B_SpammyWords3 20067 7.33 14.01 4.53 38 BOTNET 19858 5.03 13.87 1.33 39 LOTS_OF_MONEY 17957 7.76 12.54 5.75 40 BOTNET_IPINHOSTNAME 17318 5.75 12.09 3.08 41 TR_XM_SpammyRelay 17248 4.92 12.04 1.93 42 TR_XM_SpammyWords4 16450 6.04 11.49 3.75 43 FSL_BULK_SIG 16180 9.93 11.30 9.35 44 XM_Evil_Numbers_Gen 15671 9.59 10.94 9.03 45 TR_XM_SpammyWords2 14665 3.35 10.24 0.47 46 UNTRUSTED_Relay 14096 4.00 9.84 1.55 47 RCVD_IN_BL_SPAMCOP_NET 13579 3.23 9.48 0.61 48 XM_B_Phish_Phrases 13422 6.45 9.37 5.23 49 BAYES_80 13012 5.32 9.09 3.74 50 RCVD_IN_MSPIKE_WL 12959 15.98 9.05 18.89 51 XM_UncommonTLD01 12845 5.88 8.97 4.58 52 TR_XM_UnparsRelay 12743 3.75 8.90 1.59 53 XMStrtUSub 12694 7.19 8.86 6.49 54 BAYES_60 12468 7.65 8.71 7.20 55 RCVD_IN_MSPIKE_BL 12027 3.25 8.40 1.09 56 TR_XM_MSPIKECOMBO 12020 3.24 8.39 1.09 57 XM_Body_Dirty_Words 10600 3.91 7.40 2.45 58 LotsOfNums_01 10439 8.05 7.29 8.37 59 TR_XM_NoHeaderRelay 9854 2.18 6.88 0.21 60 XM_B_PhoneNumber 9782 9.09 6.83 10.04 61 HTML_IMAGE_RATIO_02 9469 5.42 6.61 4.92 62 XMSubMetaSx_00 8952 4.22 6.25 3.36 63 RELAYCOUNTRY_CA 8699 2.30 6.07 0.72 64 DKIM_INVALID 8464 3.22 5.91 2.09 65 XM_B_Investor 8110 2.82 5.66 1.62 66 HTML_IMAGE_RATIO_04 7866 4.37 5.49 3.89 67 SCC_BODY_URI_ONLY 7850 3.33 5.48 2.43 68 MPART_ALT_DIFF 7784 5.09 5.44 4.94 69 XM_H_Long_From01 7141 5.30 4.99 5.44 70 XM_H_GMP 7117 5.57 4.97 5.82 71 BAYES_95 6885 2.98 4.81 2.21 72 TR_XM_SpammyWords5 6740 2.32 4.71 1.32 73 TR_XM_PhishingBody 6737 2.58 4.70 1.69 74 XM_UB50 6737 2.11 4.70 1.02 75 RCVD_IN_MSPIKE_H3 6426 7.23 4.49 8.38 76 XM_OfRef6 5824 1.85 4.07 0.93 77 T_XMDrugObfuBody_14 5791 2.55 4.04 1.93 78 TR_XM_SPAMCOP 5785 1.32 4.04 0.17 79 XMSexyCombo_05 5774 1.91 4.03 1.03 80 TM2_M_VERY_LONG_WORD 5513 2.07 3.85 1.33 81 TooManyTo_001 5489 6.89 3.83 8.16 82 RCVD_IN_MSPIKE_L5 5408 1.12 3.78 0.01 83 T_XMDrugObfuBody_08 5384 2.30 3.76 1.69 84 RELAYCOUNTRY_NL 5368 1.31 3.75 0.28 85 SHORT_SHORTNER 5290 1.10 3.69 0.01 86 BODY_URI_ONLY 5280 1.10 3.69 0.01 87 HTML_IMAGE_ONLY_08 5259 1.19 3.67 0.15 88 XMNumbers 5225 3.38 3.65 3.27 89 SCC_BODY_SINGLE_WORD 5189 1.09 3.62 0.02 90 BODY_SINGLE_WORD 5172 1.07 3.61 0.01 91 BODY_SINGLE_URI 5171 1.07 3.61 0.01 92 HTML_SHORT_LINK_IMG_1 5131 1.07 3.58 0.01 93 SHORTENER_SHORT_IMG 5108 1.05 3.57 0.00 94 TR_XM_SpammyWords3 5061 1.36 3.53 0.45 95 XM_B_SpammyTLD 4976 2.78 3.47 2.49 96 MIME_QP_LONG_LINE 4859 4.87 3.39 5.48 97 XM_B_Unsub2 4807 2.09 3.36 1.56 98 XMDiploma_00 4776 2.28 3.34 1.84 99 HTML_IMAGE_RATIO_06 4532 2.86 3.16 2.73 100 TM2_M_URI_OPT_OUT 4529 2.12 3.16 1.68 101 MIME_HTML_MOSTLY 4415 2.66 3.08 2.48 102 XM_SPF_SoftFail 4399 1.94 3.07 1.46 103 HTML_IMAGE_RATIO_08 4359 2.62 3.04 2.44 104 MIME_HTML_ONLY_MULTI 4314 2.66 3.01 2.51 105 RCVD_IN_MSPIKE_L3 4246 1.47 2.96 0.84 106 XM_URI_RBL 4240 1.07 2.96 0.28 107 T_TooManySym_01 4198 4.89 2.93 5.72 108 XM_CamelCaseFrm001 4091 2.28 2.86 2.04 109 SUBJ_ALL_CAPS 3903 1.88 2.73 1.53 110 RELAYCOUNTRY_AU 3830 1.29 2.67 0.70 111 XM_SendGrid 3745 3.06 2.62 3.25 112 HTML_MIME_NO_HTML_TAG 3668 3.06 2.56 3.27 113 XM_B_URI_Unicode 3634 2.15 2.54 1.98 114 RCVD_IN_MSPIKE_H4 3609 3.78 2.52 4.30 115 TR_XM_INV_DKIM 3602 0.78 2.52 0.05 116 XMStockSpam_06 3599 1.49 2.51 1.07 117 T_FILL_THIS_FORM_SHORT 3472 1.45 2.42 1.04 118 XM_UB60 3436 0.78 2.40 0.10 119 ALL_TRUSTED 3272 12.30 2.28 16.50 120 USER_IN_DEF_DKIM_WL 3120 9.40 2.18 12.43 121 XM_B_SpammyWords4 2982 1.07 2.08 0.65 122 RCVD_IN_MSPIKE_H5 2924 4.97 2.04 6.20 123 SpammyFromTLD_02 2886 0.92 2.02 0.46 124 MAILING_LIST_MULTI 2869 2.92 2.00 3.30 125 FROM_EXCESS_BASE64 2864 1.69 2.00 1.55 126 XMGenDplmaNmb 2830 1.33 1.98 1.05 127 RCVD_IN_VALIDITY_RPBL 2763 0.70 1.93 0.19 128 RCVD_IN_VALIDITY_SAFE 2754 3.39 1.92 4.01 129 T_XMDrugObfuBody_00 2651 1.14 1.85 0.84 130 TR_XM_MSPIKECOMBO2 2634 0.58 1.84 0.05 131 XMBody_17 2584 0.73 1.80 0.28 132 XM_H_Long_From02 2551 1.04 1.78 0.73 133 BAYES_40 2522 4.66 1.76 5.87 134 RCVD_IN_MSPIKE_L4 2366 0.65 1.65 0.24 135 T_REMOTE_IMAGE 2347 3.34 1.64 4.05 136 RCVD_IN_IADB_LISTED 2342 3.24 1.64 3.92 137 T_XMHurry_00 2327 0.80 1.62 0.46 138 URI_HEX 2324 1.45 1.62 1.37 139 HTML_TAG_BALANCE_BODY 2289 0.83 1.60 0.51 140 TR_XM_DK_SendGrid 2236 2.04 1.56 2.23 141 RDNS_DYNAMIC 2219 0.57 1.55 0.16 142 PDS_RDNS_DYNAMIC_FP 2193 0.48 1.53 0.05 143 MPART_ALT_DIFF_COUNT 2190 0.85 1.53 0.57 144 XM_B_Phish66 2173 0.74 1.52 0.42 145 HTTPS_HTTP_MISMATCH 2101 0.90 1.47 0.67 146 SHORTCIRCUIT 2079 0.43 1.45 0.00 147 RCVD_IN_ZEN_LASTEXTERNAL 2079 0.43 1.45 0.00 148 XM_PDF 2076 5.20 1.45 6.77 149 SpammyFromTLD_01 2038 0.92 1.42 0.71 150 RCVD_IN_VALIDITY_CERTIFIED 2035 2.67 1.42 3.20 151 XMBrknScrpt_02 2021 0.95 1.41 0.76 152 RCVD_IN_IADB_SPF 2019 2.82 1.41 3.42 153 XM_DK_Undo_01 2003 1.90 1.40 2.11 154 XM_B_SEO 1987 0.56 1.39 0.21 155 HTML_IMAGE_ONLY_20 1972 0.66 1.38 0.36 156 BAYES_20 1967 3.54 1.37 4.44 157 XMPhish30 1909 0.70 1.33 0.43 158 RELAYCOUNTRY_FR 1896 0.61 1.32 0.32 159 URI_TRY_3LD 1891 0.78 1.32 0.55 160 RCVD_IN_IADB_DK 1891 2.44 1.32 2.91 161 RCVD_IN_IADB_SENDERID 1886 2.52 1.32 3.02 162 TVD_RCVD_IP 1870 0.94 1.31 0.78 163 XMPhish14 1863 0.77 1.30 0.55 164 XM_B_COPY_HTML 1859 0.84 1.30 0.65 165 KHOP_HELO_FCRDNS 1827 1.50 1.28 1.60 166 TR_XM_MaxSPIKE 1817 0.41 1.27 0.05 167 XMGppyBdWords 1810 0.52 1.26 0.21 168 NO_DNS_FOR_FROM 1778 0.54 1.24 0.25 169 TR_XM_MaxWHORU 1763 0.50 1.23 0.19 170 URIBL_BLACK 1748 0.37 1.22 0.01 171 TR_LOTS_OF_MONEY3 1739 0.55 1.21 0.27 172 TR_XM_SEO4 1735 0.42 1.21 0.09 173 DKIM_ADSP_NXDOMAIN 1714 0.54 1.20 0.27 174 RCVD_IN_PBL 1711 0.89 1.19 0.76 175 URI_NOVOWEL 1697 1.47 1.19 1.58 176 TR_XM_FormFill2 1692 0.58 1.18 0.32 177 TR_XM_PHPForged 1676 0.57 1.17 0.32 178 TR_XM_PHPDW 1662 0.57 1.16 0.32 179 HK_RANDOM_REPLYTO 1648 0.42 1.15 0.12 180 XM_UB80 1639 0.35 1.14 0.02 181 XM_H_PHPOS 1612 0.55 1.13 0.31 182 XMSubMetaI_00 1608 0.60 1.12 0.38 183 TM2_M_A_HREF_HREF 1595 0.54 1.11 0.30 184 BOTNET_NORDNS 1577 0.33 1.10 0.01 185 XMBdyGiftCard01 1553 0.75 1.08 0.60 186 DKIM_ADSP_CUSTOM_MED 1535 0.92 1.07 0.86 187 RCVD_IN_XBL 1513 0.33 1.06 0.02 188 DIET_1 1510 0.53 1.05 0.30 189 XM_HighProb1 1491 0.31 1.04 0.00 190 XM_DIRTYINTL 1475 0.36 1.03 0.08 191 TR_Caps_n_Bayes_99 1469 0.31 1.03 0.01 192 THIS_AD 1444 0.53 1.01 0.32 193 MISSING_HEADERS 1423 0.54 0.99 0.35 194 T_Symld_Words_02 1420 0.76 0.99 0.67 195 BOUNCE_MESSAGE 1411 2.99 0.99 3.84 196 ANY_BOUNCE_MESSAGE 1411 2.99 0.99 3.84 197 XMBody_78 1393 0.57 0.97 0.40 198 TR_XM_InvalidRelay 1390 0.30 0.97 0.02 199 MultiRelay_CC 1384 0.39 0.97 0.15 200 RELAYCOUNTRY_GB 1384 0.69 0.97 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 338728 98.90 98.32 99.15 2 HTML_MESSAGE 294399 88.75 94.91 86.17 3 RELAYCOUNTRY_US 274629 79.71 78.10 80.38 4 DKIM_SIGNED 259768 79.01 86.12 76.03 5 XM_DK_Pass 256253 77.00 81.76 75.01 6 DKIM_VALID 252620 75.79 80.21 73.94 7 XM_B_Unicode 235002 72.31 80.72 68.79 8 DCC_CHECK_NEGATIVE 206243 49.56 23.77 60.37 9 DKIM_VALID_AU 204734 60.79 62.85 59.93 10 BAYES_50 204353 54.31 41.18 59.81 11 XMListUnsubscribeExists 162607 52.47 64.09 47.60 12 XM_B_SpammyWords 147027 49.79 65.91 43.03 13 XM_B_Unicode3 136558 42.13 47.29 39.97 14 DCC_CHECK 135216 49.97 74.76 39.58 15 DKIM_VALID_EF 103193 30.01 29.55 30.20 16 T_TM2_M_HEADER_IN_MSG 99755 26.99 21.71 29.20 17 LOC_TINY_FONT_1 94535 32.73 44.81 27.67 18 HTML_FONT_LOW_CONTRAST 92100 29.18 34.47 26.96 19 FVGT_m_MULTI_ODD 84776 26.80 31.55 24.81 20 T_KAM_HTML_FONT_INVALID 76676 24.16 28.26 22.44 21 XMSubLong 74301 22.79 25.26 21.75 22 MIME_HTML_ONLY 71035 24.35 32.83 20.79 23 RCVD_IN_MSPIKE_WL 64528 15.98 9.05 18.89 24 RCVD_IN_MSPIKE_H2 60900 18.34 19.57 17.83 25 XM_B_SpammyWords2 60463 23.57 37.58 17.70 26 ALL_TRUSTED 56381 12.30 2.28 16.50 27 XM_Multi_Part_URI 46165 15.16 19.07 13.51 28 UNPARSEABLE_RELAY 45451 14.34 16.80 13.30 29 TR_XM_DK_Unsub 44880 15.54 21.26 13.14 30 USER_IN_DEF_DKIM_WL 42454 9.40 2.18 12.43 31 BAYES_00 36272 7.70 0.75 10.62 32 XM_B_PhoneNumber 34291 9.09 6.83 10.04 33 FSL_BULK_SIG 31960 9.93 11.30 9.35 34 XM_B_Unsub 31430 13.18 22.69 9.20 35 XM_Evil_Numbers_Gen 30836 9.59 10.94 9.03 36 RCVD_IN_MSPIKE_H3 28637 7.23 4.49 8.38 37 LotsOfNums_01 28606 8.05 7.29 8.37 38 TooManyTo_001 27894 6.89 3.83 8.16 39 TR_XM_DK_Bayes 24935 5.33 0.62 7.30 40 BAYES_60 24609 7.65 8.71 7.20 41 TR_XM_DK_Bayes1 24501 5.23 0.61 7.17 42 TR_XM_BayesUnsub 24165 11.43 21.81 7.07 43 XM_PDF 23127 5.20 1.45 6.77 44 XMStrtUSub 22157 7.19 8.86 6.49 45 XM_DKIMWhitelistDomains 21672 4.49 0.08 6.34 46 TR_XM_DK_Bayes2 21195 4.52 0.52 6.20 47 RCVD_IN_MSPIKE_H5 21187 4.97 2.04 6.20 48 TR_MAX_INTL_RELAY 20350 8.38 14.16 5.96 49 BAYES_40 20053 4.66 1.76 5.87 50 XM_H_GMP 19883 5.57 4.97 5.82 51 LOTS_OF_MONEY 19656 7.76 12.54 5.75 52 T_TooManySym_01 19526 4.89 2.93 5.72 53 MIME_QP_LONG_LINE 18735 4.87 3.39 5.48 54 XM_H_Long_From01 18572 5.30 4.99 5.44 55 XM_B_Phish_Phrases 17867 6.45 9.37 5.23 56 MPART_ALT_DIFF 16882 5.09 5.44 4.94 57 HTML_IMAGE_RATIO_02 16817 5.42 6.61 4.92 58 XM_DK_Undo_02 16681 15.20 39.80 4.88 59 XM_UncommonTLD01 15645 5.88 8.97 4.58 60 XM_B_SpammyWords3 15492 7.33 14.01 4.53 61 BAYES_20 15183 3.54 1.37 4.44 62 RCVD_IN_MSPIKE_H4 14704 3.78 2.52 4.30 63 T_REMOTE_IMAGE 13838 3.34 1.64 4.05 64 RCVD_IN_VALIDITY_SAFE 13702 3.39 1.92 4.01 65 RCVD_IN_IADB_LISTED 13391 3.24 1.64 3.92 66 HTML_IMAGE_RATIO_04 13302 4.37 5.49 3.89 67 ANY_BOUNCE_MESSAGE 13109 2.99 0.99 3.84 68 BOUNCE_MESSAGE 13108 2.99 0.99 3.84 69 RELAYCOUNTRY_META 12930 8.54 19.90 3.78 70 TR_XM_SpammyWords4 12813 6.04 11.49 3.75 71 BAYES_80 12786 5.32 9.09 3.74 72 RCVD_IN_IADB_SPF 11668 2.82 1.41 3.42 73 BAYES_99 11660 11.31 30.13 3.41 74 XMSubMetaSx_00 11490 4.22 6.25 3.36 75 MAILING_LIST_MULTI 11291 2.92 2.00 3.30 76 XMNumbers 11187 3.38 3.65 3.27 77 HTML_MIME_NO_HTML_TAG 11173 3.06 2.56 3.27 78 XM_SendGrid 11100 3.06 2.62 3.25 79 RCVD_IN_VALIDITY_CERTIFIED 10926 2.67 1.42 3.20 80 BOTNET_IPINHOSTNAME 10537 5.75 12.09 3.08 81 RCVD_IN_IADB_SENDERID 10315 2.52 1.32 3.02 82 T_TooManySym_02 10040 2.34 0.90 2.94 83 RCVD_IN_IADB_DK 9955 2.44 1.32 2.91 84 HTML_IMAGE_RATIO_06 9324 2.86 3.16 2.73 85 BAYES_05 9166 2.11 0.75 2.68 86 BAYES_999 8907 8.73 23.35 2.61 87 RCVD_IN_IADB_VOUCHED 8840 2.08 0.88 2.59 88 MIME_HTML_ONLY_MULTI 8575 2.66 3.01 2.51 89 XM_B_SpammyTLD 8493 2.78 3.47 2.49 90 MIME_HTML_MOSTLY 8468 2.66 3.08 2.48 91 XM_Body_Dirty_Words 8374 3.91 7.40 2.45 92 HTML_IMAGE_RATIO_08 8347 2.62 3.04 2.44 93 TooManyTo_002 8340 1.93 0.72 2.44 94 SCC_BODY_URI_ONLY 8288 3.33 5.48 2.43 95 TR_XM_DK_SendGrid 7631 2.04 1.56 2.23 96 BAYES_95 7558 2.98 4.81 2.21 97 INVALID_MSGID 7358 1.60 0.29 2.15 98 XM_DK_Undo_01 7194 1.90 1.40 2.11 99 DKIM_INVALID 7148 3.22 5.91 2.09 100 XM_CamelCaseFrm001 6980 2.28 2.86 2.04 101 TR_XM_DKIM_Undo 6913 9.78 28.30 2.02 102 XM_B_URI_Unicode 6777 2.15 2.54 1.98 103 T_XMDrugObfuBody_14 6589 2.55 4.04 1.93 104 TR_XM_SpammyRelay 6587 4.92 12.04 1.93 105 TO_MALFORMED 6376 1.33 0.07 1.87 106 RCVD_IN_IADB_OPTIN 6357 1.48 0.56 1.86 107 XMDiploma_00 6293 2.28 3.34 1.84 108 T_OBFU_PDF_ATTACH 5956 1.41 0.63 1.74 109 T_XMDrugObfuBody_08 5789 2.30 3.76 1.69 110 TR_XM_PhishingBody 5757 2.58 4.70 1.69 111 TM2_M_URI_OPT_OUT 5749 2.12 3.16 1.68 112 XM_B_Investor 5546 2.82 5.66 1.62 113 KHOP_HELO_FCRDNS 5455 1.50 1.28 1.60 114 TR_XM_UnparsRelay 5441 3.75 8.90 1.59 115 URI_NOVOWEL 5409 1.47 1.19 1.58 116 TooManyTo_003 5347 1.28 0.59 1.57 117 XM_B_Unsub2 5334 2.09 3.36 1.56 118 TR_Symld_Words 5329 1.36 0.87 1.56 119 FROM_EXCESS_BASE64 5311 1.69 2.00 1.55 120 UNTRUSTED_Relay 5310 4.00 9.84 1.55 121 SUBJ_ALL_CAPS 5220 1.88 2.73 1.53 122 XM_SPF_SoftFail 5004 1.94 3.07 1.46 123 URI_HEX 4691 1.45 1.62 1.37 124 IN_HORDE_ADDRESS_BOOK 4658 0.98 0.07 1.36 125 BOTNET 4544 5.03 13.87 1.33 126 TM2_M_VERY_LONG_WORD 4537 2.07 3.85 1.33 127 TR_XM_SpammyWords5 4516 2.32 4.71 1.32 128 XMGappySubj_01 4477 1.01 0.29 1.31 129 HELO_NODOT 4463 0.98 0.21 1.31 130 HELO_NO_DOMAIN 4452 0.97 0.17 1.30 131 XM_GoogleGroups 4330 1.14 0.84 1.27 132 TR_DCC_Bayes_99 4185 7.05 20.94 1.22 133 T_TooManySym_03 3997 0.93 0.36 1.17 134 TooManyTo_004 3938 0.97 0.52 1.15 135 XM_H_PHPMailer 3876 0.96 0.55 1.13 136 XMCapTrack 3817 0.93 0.49 1.12 137 TR_XM_MSPIKECOMBO 3707 3.24 8.39 1.09 138 RCVD_IN_MSPIKE_BL 3707 3.25 8.40 1.09 139 XMStockSpam_06 3644 1.49 2.51 1.07 140 XMGenDplmaNmb 3603 1.33 1.98 1.05 141 T_FILL_THIS_FORM_SHORT 3541 1.45 2.42 1.04 142 XM_ShortIntro_01 3529 0.85 0.41 1.03 143 XMSexyCombo_05 3503 1.91 4.03 1.03 144 XM_UB50 3493 2.11 4.70 1.02 145 TVD_SPACE_RATIO 3274 0.73 0.19 0.96 146 TooManyTo_005 3253 0.81 0.47 0.95 147 XM_OfRef6 3161 1.85 4.07 0.93 148 T_TVD_MIME_NO_HEADERS 2975 0.62 0.03 0.87 149 DKIM_ADSP_CUSTOM_MED 2922 0.92 1.07 0.86 150 RCVD_IN_MSPIKE_L3 2877 1.47 2.96 0.84 151 T_XMDrugObfuBody_00 2856 1.14 1.85 0.84 152 TR_MetaPhish_Combo_01 2746 0.77 0.69 0.80 153 TVD_RCVD_IP 2678 0.94 1.31 0.78 154 XMNoVowels 2652 0.67 0.42 0.78 155 XMBrknScrpt_02 2595 0.95 1.41 0.76 156 RCVD_IN_PBL 2588 0.89 1.19 0.76 157 XM_H_Long_From02 2495 1.04 1.78 0.73 158 RELAYCOUNTRY_CA 2454 2.30 6.07 0.72 159 SpammyFromTLD_01 2442 0.92 1.42 0.71 160 FROM_GOV_DKIM_AU 2426 0.57 0.23 0.71 161 TM2_M_BODY_EMPTY 2411 0.53 0.11 0.71 162 RELAYCOUNTRY_AU 2408 1.29 2.67 0.70 163 XMGappySubj_02 2322 0.49 0.04 0.68 164 T_Symld_Words_02 2283 0.76 0.99 0.67 165 HTTPS_HTTP_MISMATCH 2280 0.90 1.47 0.67 166 XM_B_COPY_HTML 2231 0.84 1.30 0.65 167 XMLngstWrd_00 2228 0.58 0.41 0.65 168 XM_B_SpammyWords4 2215 1.07 2.08 0.65 169 XMMoneyMeta_00 2141 0.63 0.65 0.63 170 GMD_PDF_EMPTY_BODY 2091 0.46 0.09 0.61 171 RCVD_IN_BL_SPAMCOP_NET 2079 3.23 9.48 0.61 172 XMBdyGiftCard01 2060 0.75 1.08 0.60 173 TR_XM_Base64_M1 2033 0.70 0.94 0.60 174 LongTLD 1979 0.69 0.95 0.58 175 RELAYCOUNTRY_GB 1968 0.69 0.97 0.58 176 MPART_ALT_DIFF_COUNT 1944 0.85 1.53 0.57 177 FORGED_GMAIL_RCVD 1933 0.63 0.79 0.57 178 URI_TRY_3LD 1879 0.78 1.32 0.55 179 XMPhish14 1872 0.77 1.30 0.55 180 XM_ProductURIs 1866 0.58 0.67 0.55 181 XMSubEmpty 1845 0.43 0.15 0.54 182 TRACKER_ID 1839 0.50 0.42 0.54 183 XMLngstWrd_01 1775 0.47 0.36 0.52 184 NML_ADSP_CUSTOM_MED 1774 0.62 0.86 0.52 185 HTML_TAG_BALANCE_BODY 1744 0.83 1.60 0.51 186 MSGID_FROM_MTA_HEADER 1721 0.42 0.21 0.50 187 T_STY_INVIS_DIRECT 1668 0.60 0.88 0.49 188 XMSlimDrugH 1667 0.55 0.71 0.49 189 XMBSHREFv2 1659 0.45 0.36 0.49 190 HTML_IMAGE_ONLY_32 1633 0.38 0.14 0.48 191 TO_NO_BRKTS_HTML_ONLY 1632 0.56 0.76 0.48 192 PLING_QUERY 1596 0.51 0.60 0.47 193 TR_XM_SpammyWords2 1595 3.35 10.24 0.47 194 XMSolicitRefs_0 1568 0.47 0.49 0.46 195 SpammyFromTLD_02 1563 0.92 2.02 0.46 196 T_XMHurry_00 1557 0.80 1.62 0.46 197 TR_XM_SpammyWords3 1541 1.36 3.53 0.45 198 SUBJ_DOLLARS 1501 0.45 0.47 0.44 199 XMPhish30 1485 0.70 1.33 0.43 200 BASE64_LENGTH_79_INF 1446 0.45 0.53 0.42 ----------------------------------------------------------------------