Email: 438633 Autolearn: 0 AvgScore: 5.26 AvgScanTime: 1.33 sec Spam: 131515 Autolearn: 0 AvgScore: 15.14 AvgScanTime: 1.44 sec Ham: 307118 Autolearn: 0 AvgScore: 1.02 AvgScanTime: 1.28 sec Time Spent Running SA: 161.99 hours Time Spent Processing Spam: 52.51 hours Time Spent Processing Ham: 109.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 129069 99.03 98.14 99.41 2 HTML_MESSAGE 123016 88.54 93.54 86.40 3 DKIM_SIGNED 115316 76.88 87.68 72.26 4 XM_DK_Pass 108684 74.70 82.64 71.30 5 XM_B_Unicode 107840 73.47 82.00 69.82 6 DKIM_VALID 107730 73.70 81.91 70.18 7 RELAYCOUNTRY_US 104162 81.19 79.20 82.04 8 DCC_CHECK 94108 48.43 71.56 38.53 9 XM_B_SpammyWords 92321 51.27 70.20 43.17 10 XMListUnsubscribeExists 80792 49.57 61.43 44.49 11 DKIM_VALID_AU 80770 58.65 61.42 57.46 12 XM_B_Unicode3 58307 41.90 44.33 40.85 13 LOC_TINY_FONT_1 58001 32.30 44.10 27.24 14 XM_DK_Undo_02 52960 15.46 40.27 4.83 15 BAYES_50 51679 53.71 39.30 59.89 16 XM_B_SpammyWords2 48612 22.99 36.96 17.00 17 HTML_FONT_LOW_CONTRAST 41867 30.75 31.83 30.29 18 BAYES_99 41535 11.92 31.58 3.51 19 DKIM_VALID_EF 40963 31.19 31.15 31.21 20 MIME_HTML_ONLY 40006 22.48 30.42 19.08 21 TR_XM_DKIM_Undo 39899 10.40 30.34 1.86 22 FVGT_m_MULTI_ODD 39424 25.67 29.98 23.82 23 T_KAM_HTML_FONT_INVALID 35570 21.78 27.05 19.52 24 DCC_CHECK_NEGATIVE 35174 51.03 26.75 61.43 25 RELAYCOUNTRY_META 31241 9.54 23.75 3.45 26 XM_Multi_Part_URI 30521 16.29 23.21 13.32 27 XMSubLong 30474 22.62 23.17 22.38 28 BAYES_999 29631 8.65 22.53 2.70 29 TR_XM_DK_Unsub 28166 15.69 21.42 13.24 30 T_TM2_M_HEADER_IN_MSG 27777 30.42 21.12 34.40 31 RCVD_IN_MSPIKE_H2 27127 17.77 20.63 16.55 32 TR_DCC_Bayes_99 25621 6.70 19.48 1.22 33 XM_B_Unsub 24193 11.29 18.40 8.24 34 TR_XM_SpammyRelay 23785 6.57 18.09 1.64 35 TR_XM_BayesUnsub 23235 9.73 17.67 6.34 36 UNPARSEABLE_RELAY 22078 13.63 16.79 12.27 37 TR_MAX_INTL_RELAY 19752 8.46 15.02 5.65 38 XM_B_SpammyWords3 18519 7.42 14.08 4.57 39 LOTS_OF_MONEY 18154 9.38 13.80 7.48 40 XM_Evil_Numbers_Gen 16674 11.70 12.68 11.28 41 TR_XM_SpammyWords4 16212 6.73 12.33 4.33 42 FSL_BULK_SIG 15979 10.19 12.15 9.35 43 BOTNET_IPINHOSTNAME 15654 5.48 11.90 2.73 44 BOTNET 14007 3.95 10.65 1.08 45 RCVD_IN_MSPIKE_WL 12850 15.91 9.77 18.54 46 TR_XM_SpammyWords2 12789 3.27 9.72 0.51 47 RCVD_IN_BL_SPAMCOP_NET 12046 3.20 9.16 0.65 48 BAYES_80 12030 5.20 9.15 3.51 49 TR_XM_UnparsRelay 11511 3.74 8.75 1.59 50 UNTRUSTED_Relay 10804 3.50 8.22 1.48 51 BAYES_60 10716 7.52 8.15 7.26 52 XM_B_Phish_Phrases 10338 5.84 7.86 4.98 53 XM_B_SpammyTLD 10092 4.01 7.67 2.44 54 XM_UncommonTLD01 9894 5.24 7.52 4.27 55 XM_Body_Dirty_Words 9247 3.67 7.03 2.24 56 HTML_IMAGE_RATIO_02 9225 5.02 7.01 4.17 57 RELAYCOUNTRY_AU 8602 2.30 6.54 0.49 58 RELAYCOUNTRY_CA 8440 2.45 6.42 0.75 59 XM_B_PhoneNumber 8098 8.56 6.16 9.58 60 DKIM_INVALID 7586 3.18 5.77 2.08 61 LotsOfNums_01 7510 6.83 5.71 7.31 62 BAYES_95 7287 3.16 5.54 2.14 63 XM_B_Investor 7221 2.61 5.49 1.38 64 XMSubMetaSx_00 7198 4.20 5.47 3.66 65 XM_H_Long_From01 7145 5.38 5.43 5.35 66 BOUNCE_MESSAGE 7022 7.48 5.34 8.40 67 ANY_BOUNCE_MESSAGE 7022 7.48 5.34 8.40 68 RCVD_IN_MSPIKE_H3 6752 7.29 5.13 8.21 69 MPART_ALT_DIFF 6688 5.07 5.09 5.06 70 RCVD_IN_MSPIKE_BL 6635 2.14 5.05 0.89 71 TR_XM_MSPIKECOMBO 6634 2.14 5.04 0.89 72 XM_DK_Undo_01 6627 2.99 5.04 2.11 73 TooManyTo_001 6574 7.60 5.00 8.72 74 XM_UB50 6255 2.09 4.76 0.95 75 HTML_IMAGE_RATIO_04 6060 4.53 4.61 4.49 76 XM_H_GMP 5913 5.80 4.50 6.35 77 XMStrtUSub 5808 4.49 4.42 4.52 78 TR_XM_PhishingBody 5679 2.48 4.32 1.70 79 XMCapTrack 5675 2.24 4.32 1.35 80 XMSexyCombo_05 5627 1.96 4.28 0.96 81 TR_XM_SpammyWords5 5518 2.17 4.20 1.30 82 XMNumbers 5222 3.56 3.97 3.38 83 XM_CamelCaseFrm001 5207 2.33 3.96 1.64 84 TR_XM_SPAMCOP 5199 1.30 3.95 0.16 85 XM_OfRef6 5177 1.86 3.94 0.97 86 TM2_M_VERY_LONG_WORD 4956 5.13 3.77 5.72 87 XM_URI_RBL 4554 1.25 3.46 0.30 88 MIME_QP_LONG_LINE 4547 4.07 3.46 4.33 89 TR_XM_NoHeaderRelay 4515 1.13 3.43 0.15 90 XM_B_Unsub2 4373 1.84 3.33 1.21 91 TR_XM_SpammyWords3 4369 1.30 3.32 0.44 92 XM_SPF_SoftFail 4183 1.88 3.18 1.33 93 T_XMDrugObfuBody_14 4087 2.61 3.11 2.40 94 XMDiploma_00 4055 1.97 3.08 1.49 95 XM_B_SpammyWords4 3982 1.32 3.03 0.59 96 HTML_IMAGE_RATIO_06 3924 2.59 2.98 2.43 97 KHOP_HELO_FCRDNS 3854 3.64 2.93 3.94 98 MIME_HTML_MOSTLY 3814 3.03 2.90 3.09 99 T_TooManySym_01 3752 5.07 2.85 6.02 100 HTML_IMAGE_RATIO_08 3727 2.36 2.83 2.15 101 MIME_HTML_ONLY_MULTI 3725 2.60 2.83 2.50 102 T_XMDrugObfuBody_08 3714 1.90 2.82 1.50 103 XM_B_URI_Unicode 3672 2.22 2.79 1.97 104 RCVD_IN_VALIDITY_RPBL 3612 0.86 2.75 0.05 105 RCVD_IN_MSPIKE_H4 3521 3.36 2.68 3.66 106 SpammyFromTLD_02 3445 0.97 2.62 0.26 107 T_FILL_THIS_FORM_SHORT 3412 1.43 2.59 0.93 108 HTML_MIME_NO_HTML_TAG 3394 2.81 2.58 2.91 109 RCVD_IN_MSPIKE_L3 3388 1.24 2.58 0.66 110 TM2_M_URI_OPT_OUT 3347 2.07 2.54 1.87 111 TR_LOTS_OF_MONEY3 3297 1.08 2.51 0.47 112 FROM_EXCESS_BASE64 3211 1.84 2.44 1.58 113 ALL_TRUSTED 3061 11.38 2.33 15.25 114 TR_XM_INV_DKIM 3034 0.70 2.31 0.02 115 T_REMOTE_IMAGE 2989 3.29 2.27 3.73 116 SUBJ_ALL_CAPS 2969 1.63 2.26 1.37 117 MAILING_LIST_MULTI 2702 2.86 2.05 3.20 118 SCC_BODY_URI_ONLY 2658 2.23 2.02 2.32 119 URI_TRY_3LD 2647 0.91 2.01 0.44 120 RCVD_IN_MSPIKE_H5 2577 5.26 1.96 6.67 121 TR_Mismatch_TLD_02 2553 0.64 1.94 0.08 122 XMStockSpam_06 2525 1.86 1.92 1.84 123 SpammyFromTLD_01 2440 1.06 1.86 0.71 124 TR_Symld_Words 2371 1.58 1.80 1.48 125 RCVD_IN_VALIDITY_SAFE 2333 3.23 1.77 3.86 126 HK_RANDOM_REPLYTO 2315 0.61 1.76 0.11 127 BAYES_40 2310 5.10 1.76 6.53 128 SHORTCIRCUIT 2200 0.50 1.67 0.00 129 RCVD_IN_ZEN_LASTEXTERNAL 2200 0.50 1.67 0.00 130 USER_IN_DEF_DKIM_WL 2195 8.95 1.67 12.07 131 XMBrknScrpt_02 2115 1.20 1.61 1.02 132 XM_SendGrid 2108 2.31 1.60 2.61 133 XMBody_17 2094 0.69 1.59 0.30 134 URI_NOVOWEL 2080 1.42 1.58 1.35 135 DKIM_ADSP_NXDOMAIN 2042 0.68 1.55 0.31 136 XMGenDplmaNmb 2038 1.08 1.55 0.88 137 RDNS_DYNAMIC 2030 0.59 1.54 0.18 138 RCVD_IN_MSPIKE_L4 2021 0.61 1.54 0.21 139 XM_B_DNDMA 1993 0.74 1.52 0.41 140 PDS_RDNS_DYNAMIC_FP 1988 0.48 1.51 0.04 141 TR_XM_RelayPhish 1968 0.50 1.50 0.07 142 XM_HighProb1 1911 0.44 1.45 0.00 143 URI_HEX 1851 1.29 1.41 1.24 144 RCVD_IN_XBL 1844 0.43 1.40 0.02 145 XM_H_DKIM_GOOG 1820 0.43 1.38 0.02 146 XM_B_Phish66 1810 0.71 1.38 0.43 147 TR_XM_PHPDW 1801 0.65 1.37 0.34 148 XM_ProductURIs 1795 0.72 1.36 0.44 149 RCVD_IN_IADB_LISTED 1784 2.43 1.36 2.89 150 TVD_RCVD_IP 1784 0.96 1.36 0.79 151 BAYES_20 1779 3.57 1.35 4.51 152 TR_XM_PHPForged 1777 0.64 1.35 0.34 153 TR_XM_MSPIKECOMBO2 1775 0.45 1.35 0.07 154 XMPhish30 1767 0.85 1.34 0.64 155 TR_XM_FormFill2 1761 0.64 1.34 0.34 156 RELAYCOUNTRY_FR 1753 0.56 1.33 0.23 157 HTML_IMAGE_ONLY_20 1744 0.72 1.33 0.45 158 RCVD_IN_PBL 1733 0.97 1.32 0.82 159 T_XMHurry_00 1726 0.73 1.31 0.48 160 T_XMDrugObfuBody_00 1721 0.91 1.31 0.74 161 RCVD_IN_VALIDITY_CERTIFIED 1720 2.68 1.31 3.26 162 XM_H_PHPOS 1716 0.62 1.30 0.33 163 BOTNET_NORDNS 1715 0.40 1.30 0.01 164 RCVD_IN_SBL_CSS 1714 0.41 1.30 0.03 165 HTML_TAG_BALANCE_BODY 1710 0.83 1.30 0.63 166 TR_XM_Base64_M1 1678 0.78 1.28 0.57 167 MultiRelay_CC 1676 0.52 1.27 0.20 168 LongTLD 1657 0.79 1.26 0.59 169 HTML_IMAGE_ONLY_16 1648 0.59 1.25 0.31 170 XM_B_SEO 1614 0.55 1.23 0.25 171 RCVD_IN_PSBL 1614 0.67 1.23 0.43 172 XM_H_Long_From02 1612 0.90 1.23 0.77 173 RELAYCOUNTRY_JP 1591 0.39 1.21 0.03 174 T_TooManySym_02 1562 2.58 1.19 3.18 175 SH_BODYURI_REVERSE_CSS 1543 0.36 1.17 0.01 176 XM_S_SpammyWords 1537 0.45 1.17 0.14 177 URIBL_CSS_A 1537 0.36 1.17 0.01 178 URIBL_CSS 1537 0.36 1.17 0.01 179 TR_XM_Spammywords 1536 0.45 1.17 0.14 180 RCVD_IN_IADB_SPF 1530 2.12 1.16 2.53 181 HTML_SHORT_LINK_IMG_2 1510 0.36 1.15 0.03 182 TM2_M_OBFU_COMMENT 1499 0.53 1.14 0.28 183 DATE_IN_PAST_03_06 1484 0.39 1.13 0.07 184 MPART_ALT_DIFF_COUNT 1477 0.71 1.12 0.53 185 TR_XM_SEO4 1474 0.41 1.12 0.11 186 HTTPS_HTTP_MISMATCH 1456 0.76 1.11 0.61 187 TR_XM_InvalidRelay 1454 0.34 1.11 0.01 188 TR_LOTS_OF_MONEY2 1412 0.51 1.07 0.26 189 RCVD_IN_IADB_DK 1412 1.85 1.07 2.18 190 T_MONEY_PERCENT 1412 0.51 1.07 0.26 191 RCVD_IN_IADB_SENDERID 1394 1.89 1.06 2.25 192 XMBody_78 1391 0.53 1.06 0.30 193 XM_PDF 1391 3.89 1.06 5.10 194 XM_UB60 1389 0.36 1.06 0.06 195 INVALID_MSGID 1389 1.98 1.06 2.37 196 TR_XM_DK_SendGrid 1382 1.80 1.05 2.12 197 HTML_FONT_TINY_NORDNS 1379 0.37 1.05 0.08 198 XM_B_COPY_HTML 1376 0.75 1.05 0.62 199 RELAYCOUNTRY_TH 1337 0.31 1.02 0.00 200 TR_XM_MaxSPIKE 1327 0.34 1.01 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 305291 99.03 98.14 99.41 2 HTML_MESSAGE 265361 88.54 93.54 86.40 3 RELAYCOUNTRY_US 251951 81.19 79.20 82.04 4 DKIM_SIGNED 221922 76.88 87.68 72.26 5 XM_DK_Pass 218964 74.70 82.64 71.30 6 DKIM_VALID 215547 73.70 81.91 70.18 7 XM_B_Unicode 214426 73.47 82.00 69.82 8 DCC_CHECK_NEGATIVE 188655 51.03 26.75 61.43 9 BAYES_50 183928 53.71 39.30 59.89 10 DKIM_VALID_AU 176471 58.65 61.42 57.46 11 XMListUnsubscribeExists 136625 49.57 61.43 44.49 12 XM_B_SpammyWords 132576 51.27 70.20 43.17 13 XM_B_Unicode3 125467 41.90 44.33 40.85 14 DCC_CHECK 118319 48.43 71.56 38.53 15 T_TM2_M_HEADER_IN_MSG 105655 30.42 21.12 34.40 16 DKIM_VALID_EF 95862 31.19 31.15 31.21 17 HTML_FONT_LOW_CONTRAST 93032 30.75 31.83 30.29 18 LOC_TINY_FONT_1 83674 32.30 44.10 27.24 19 FVGT_m_MULTI_ODD 73153 25.67 29.98 23.82 20 XMSubLong 68739 22.62 23.17 22.38 21 T_KAM_HTML_FONT_INVALID 59958 21.78 27.05 19.52 22 MIME_HTML_ONLY 58606 22.48 30.42 19.08 23 RCVD_IN_MSPIKE_WL 56946 15.91 9.77 18.54 24 XM_B_SpammyWords2 52225 22.99 36.96 17.00 25 RCVD_IN_MSPIKE_H2 50825 17.77 20.63 16.55 26 ALL_TRUSTED 46838 11.38 2.33 15.25 27 XM_Multi_Part_URI 40922 16.29 23.21 13.32 28 TR_XM_DK_Unsub 40677 15.69 21.42 13.24 29 UNPARSEABLE_RELAY 37686 13.63 16.79 12.27 30 USER_IN_DEF_DKIM_WL 37075 8.95 1.67 12.07 31 XM_Evil_Numbers_Gen 34628 11.70 12.68 11.28 32 BAYES_00 31265 7.32 0.63 10.18 33 XM_B_PhoneNumber 29434 8.56 6.16 9.58 34 FSL_BULK_SIG 28709 10.19 12.15 9.35 35 TooManyTo_001 26780 7.60 5.00 8.72 36 ANY_BOUNCE_MESSAGE 25794 7.48 5.34 8.40 37 BOUNCE_MESSAGE 25790 7.48 5.34 8.40 38 XM_B_Unsub 25310 11.29 18.40 8.24 39 RCVD_IN_MSPIKE_H3 25226 7.29 5.13 8.21 40 LOTS_OF_MONEY 22976 9.38 13.80 7.48 41 LotsOfNums_01 22451 6.83 5.71 7.31 42 BAYES_60 22283 7.52 8.15 7.26 43 RCVD_IN_MSPIKE_H5 20485 5.26 1.96 6.67 44 TR_XM_DK_Bayes 20475 4.81 0.48 6.67 45 TR_XM_DK_Bayes1 20088 4.72 0.47 6.54 46 BAYES_40 20056 5.10 1.76 6.53 47 XM_H_GMP 19517 5.80 4.50 6.35 48 TR_XM_BayesUnsub 19465 9.73 17.67 6.34 49 XM_DKIMWhitelistDomains 18487 4.22 0.03 6.02 50 T_TooManySym_01 18474 5.07 2.85 6.02 51 TM2_M_VERY_LONG_WORD 17552 5.13 3.77 5.72 52 TR_MAX_INTL_RELAY 17358 8.46 15.02 5.65 53 TR_XM_DK_Bayes2 16692 3.92 0.37 5.44 54 XM_H_Long_From01 16434 5.38 5.43 5.35 55 XM_PDF 15676 3.89 1.06 5.10 56 MPART_ALT_DIFF 15536 5.07 5.09 5.06 57 HTML_IMAGE_ONLY_32 15328 3.56 0.21 4.99 58 XM_B_Phish_Phrases 15299 5.84 7.86 4.98 59 XM_DK_Undo_02 14844 15.46 40.27 4.83 60 XM_B_SpammyWords3 14039 7.42 14.08 4.57 61 XMStrtUSub 13888 4.49 4.42 4.52 62 BAYES_20 13865 3.57 1.35 4.51 63 MAY_BE_FORGED 13848 3.23 0.25 4.51 64 HTML_IMAGE_RATIO_04 13796 4.53 4.61 4.49 65 TR_XM_SpammyWords4 13310 6.73 12.33 4.33 66 MIME_QP_LONG_LINE 13287 4.07 3.46 4.33 67 XM_UncommonTLD01 13110 5.24 7.52 4.27 68 HTML_IMAGE_RATIO_02 12795 5.02 7.01 4.17 69 KHOP_HELO_FCRDNS 12112 3.64 2.93 3.94 70 RCVD_IN_VALIDITY_SAFE 11855 3.23 1.77 3.86 71 T_REMOTE_IMAGE 11456 3.29 2.27 3.73 72 XMSubMetaSx_00 11236 4.20 5.47 3.66 73 RCVD_IN_MSPIKE_H4 11235 3.36 2.68 3.66 74 BAYES_80 10767 5.20 9.15 3.51 75 BAYES_99 10766 11.92 31.58 3.51 76 RELAYCOUNTRY_META 10603 9.54 23.75 3.45 77 XMNumbers 10380 3.56 3.97 3.38 78 RCVD_IN_VALIDITY_CERTIFIED 10027 2.68 1.31 3.26 79 MAILING_LIST_MULTI 9837 2.86 2.05 3.20 80 T_TooManySym_02 9772 2.58 1.19 3.18 81 MIME_HTML_MOSTLY 9495 3.03 2.90 3.09 82 HTML_MIME_NO_HTML_TAG 8931 2.81 2.58 2.91 83 TooManyTo_002 8917 2.33 1.01 2.90 84 RCVD_IN_IADB_LISTED 8870 2.43 1.36 2.89 85 BOTNET_IPINHOSTNAME 8383 5.48 11.90 2.73 86 BAYES_999 8291 8.65 22.53 2.70 87 XM_SendGrid 8014 2.31 1.60 2.61 88 RCVD_IN_IADB_SPF 7756 2.12 1.16 2.53 89 MIME_CHARSET_FARAWAY 7699 1.92 0.55 2.51 90 MIME_HTML_ONLY_MULTI 7692 2.60 2.83 2.50 91 BAYES_05 7604 2.00 0.88 2.48 92 XM_B_SpammyTLD 7509 4.01 7.67 2.44 93 HTML_IMAGE_RATIO_06 7454 2.59 2.98 2.43 94 T_XMDrugObfuBody_14 7379 2.61 3.11 2.40 95 CHARSET_FARAWAY_HEADER 7339 1.79 0.38 2.39 96 INVALID_MSGID 7292 1.98 1.06 2.37 97 SCC_BODY_URI_ONLY 7138 2.23 2.02 2.32 98 RCVD_IN_IADB_SENDERID 6896 1.89 1.06 2.25 99 XM_Body_Dirty_Words 6869 3.67 7.03 2.24 100 RCVD_IN_IADB_DK 6685 1.85 1.07 2.18 101 HTML_IMAGE_RATIO_08 6604 2.36 2.83 2.15 102 BAYES_95 6582 3.16 5.54 2.14 103 TR_XM_DK_SendGrid 6501 1.80 1.05 2.12 104 XM_DK_Undo_01 6491 2.99 5.04 2.11 105 TO_MALFORMED 6427 1.47 0.03 2.09 106 DKIM_INVALID 6375 3.18 5.77 2.08 107 RCVD_IN_IADB_VOUCHED 6101 1.63 0.80 1.99 108 XM_B_URI_Unicode 6047 2.22 2.79 1.97 109 TooManyTo_003 6011 1.61 0.80 1.96 110 TM2_M_URI_OPT_OUT 5742 2.07 2.54 1.87 111 TR_XM_DKIM_Undo 5722 10.40 30.34 1.86 112 XMStockSpam_06 5653 1.86 1.92 1.84 113 TR_XM_PhishingBody 5220 2.48 4.32 1.70 114 TR_XM_SpammyRelay 5045 6.57 18.09 1.64 115 XM_CamelCaseFrm001 5035 2.33 3.96 1.64 116 TR_XM_UnparsRelay 4872 3.74 8.75 1.59 117 FROM_EXCESS_BASE64 4867 1.84 2.44 1.58 118 XM_GoogleGroups 4692 1.34 0.89 1.53 119 TooManyTo_004 4626 1.26 0.68 1.51 120 XMLngstWrd_00 4611 1.17 0.39 1.50 121 T_XMDrugObfuBody_08 4600 1.90 2.82 1.50 122 XMDiploma_00 4572 1.97 3.08 1.49 123 TR_Symld_Words 4553 1.58 1.80 1.48 124 UNTRUSTED_Relay 4547 3.50 8.22 1.48 125 RCVD_IN_IADB_OPTIN 4299 1.14 0.53 1.40 126 XM_B_Investor 4244 2.61 5.49 1.38 127 HELO_NODOT 4219 1.02 0.20 1.37 128 HELO_NO_DOMAIN 4205 1.02 0.19 1.37 129 SUBJ_ALL_CAPS 4196 1.63 2.26 1.37 130 URI_NOVOWEL 4152 1.42 1.58 1.35 131 XMCapTrack 4150 2.24 4.32 1.35 132 XM_SPF_SoftFail 4077 1.88 3.18 1.33 133 TR_XM_SpammyWords5 4005 2.17 4.20 1.30 134 IN_HORDE_ADDRESS_BOOK 3962 0.93 0.09 1.29 135 TooManyTo_005 3886 1.08 0.64 1.27 136 URI_HEX 3820 1.29 1.41 1.24 137 TR_DCC_Bayes_99 3761 6.70 19.48 1.22 138 XM_B_Unsub2 3716 1.84 3.33 1.21 139 T_TooManySym_03 3650 0.99 0.53 1.19 140 T_TVD_MIME_NO_HEADERS 3570 0.83 0.06 1.16 141 BOTNET 3325 3.95 10.65 1.08 142 XM_ShortIntro_01 3285 0.91 0.54 1.07 143 XMGappySubj_01 3199 0.81 0.26 1.04 144 TVD_SPACE_RATIO 3196 0.81 0.29 1.04 145 XMBrknScrpt_02 3145 1.20 1.61 1.02 146 XM_H_PHPMailer 3022 0.88 0.64 0.98 147 DATE_IN_PAST_24_48 3012 0.77 0.27 0.98 148 XM_OfRef6 2988 1.86 3.94 0.97 149 XMSexyCombo_05 2955 1.96 4.28 0.96 150 XM_UB50 2931 2.09 4.76 0.95 151 T_FILL_THIS_FORM_SHORT 2870 1.43 2.59 0.93 152 XMSubMetaSxObfu_03 2750 0.74 0.37 0.90 153 TR_XM_MSPIKECOMBO 2735 2.14 5.04 0.89 154 RCVD_IN_MSPIKE_BL 2735 2.14 5.05 0.89 155 XMGenDplmaNmb 2708 1.08 1.55 0.88 156 RCVD_IN_PBL 2507 0.97 1.32 0.82 157 DKIM_ADSP_CUSTOM_MED 2420 0.81 0.87 0.79 158 TVD_RCVD_IP 2415 0.96 1.36 0.79 159 XM_H_Long_From02 2356 0.90 1.23 0.77 160 RELAYCOUNTRY_CA 2316 2.45 6.42 0.75 161 T_XMDrugObfuBody_00 2276 0.91 1.31 0.74 162 SpammyFromTLD_01 2192 1.06 1.86 0.71 163 T_OBFU_PDF_ATTACH 2164 0.58 0.29 0.70 164 XMBdyGiftCard01 2148 0.74 0.84 0.70 165 XMGappySubj_02 2045 0.49 0.08 0.67 166 RCVD_IN_MSPIKE_L3 2031 1.24 2.58 0.66 167 RCVD_IN_BL_SPAMCOP_NET 2008 3.20 9.16 0.65 168 XMPhish30 1965 0.85 1.34 0.64 169 HTML_TAG_BALANCE_BODY 1950 0.83 1.30 0.63 170 T_Symld_Words_02 1938 0.74 1.00 0.63 171 XM_B_COPY_HTML 1896 0.75 1.05 0.62 172 HTTPS_HTTP_MISMATCH 1882 0.76 1.11 0.61 173 MSGID_FROM_MTA_HEADER 1881 0.51 0.27 0.61 174 FROM_GOV_DKIM_AU 1877 0.47 0.13 0.61 175 TR_MetaPhish_Combo_01 1839 0.62 0.67 0.60 176 XMNoVowels 1815 0.57 0.51 0.59 177 LongTLD 1805 0.79 1.26 0.59 178 XMSlimDrugH 1802 0.58 0.56 0.59 179 XM_B_SpammyWords4 1799 1.32 3.03 0.59 180 TR_XM_Base64_M1 1760 0.78 1.28 0.57 181 RELAYCOUNTRY_GB 1694 0.64 0.85 0.55 182 XMMoneyMeta_00 1629 0.64 0.91 0.53 183 MPART_ALT_DIFF_COUNT 1617 0.71 1.12 0.53 184 XMBSHREFv2 1605 0.47 0.36 0.52 185 XMhairloss01 1568 0.37 0.04 0.51 186 TR_XM_SpammyWords2 1559 3.27 9.72 0.51 187 NML_ADSP_CUSTOM_MED 1530 0.53 0.61 0.50 188 RELAYCOUNTRY_AU 1493 2.30 6.54 0.49 189 T_XMHurry_00 1472 0.73 1.31 0.48 190 XMSubMetaI_00 1466 0.64 1.00 0.48 191 T_MANY_PILL_PRICE 1459 0.34 0.01 0.48 192 XMLngstWrd_01 1450 0.42 0.29 0.47 193 TR_LOTS_OF_MONEY3 1440 1.08 2.51 0.47 194 TO_NO_BRKTS_HTML_ONLY 1414 0.55 0.75 0.46 195 T_STY_INVIS_DIRECT 1409 0.55 0.76 0.46 196 HTML_IMAGE_ONLY_20 1395 0.72 1.33 0.45 197 FORGED_GMAIL_RCVD 1382 0.50 0.60 0.45 198 DIET_1 1364 0.58 0.90 0.44 199 XM_ProductURIs 1360 0.72 1.36 0.44 200 XMSolicitRefs_0 1349 0.43 0.41 0.44 ----------------------------------------------------------------------