Email: 440291 Autolearn: 0 AvgScore: 5.25 AvgScanTime: 1.29 sec Spam: 133508 Autolearn: 0 AvgScore: 15.31 AvgScanTime: 1.46 sec Ham: 306783 Autolearn: 0 AvgScore: 0.87 AvgScanTime: 1.21 sec Time Spent Running SA: 157.57 hours Time Spent Processing Spam: 54.14 hours Time Spent Processing Ham: 103.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 130788 99.01 97.96 99.46 2 HTML_MESSAGE 123849 88.19 92.77 86.19 3 DKIM_SIGNED 116333 76.74 87.14 72.22 4 XM_DK_Pass 109877 74.60 82.30 71.25 5 XM_B_Unicode 109337 72.33 81.90 68.17 6 DKIM_VALID 109198 73.60 81.79 70.04 7 RELAYCOUNTRY_US 104804 80.44 78.50 81.28 8 DCC_CHECK 99343 48.80 74.41 37.66 9 XM_B_SpammyWords 91645 51.86 68.64 44.56 10 DKIM_VALID_AU 86750 59.07 64.98 56.49 11 XMListUnsubscribeExists 86716 50.50 64.95 44.22 12 XM_B_Unicode3 62149 41.55 46.55 39.37 13 LOC_TINY_FONT_1 61578 32.61 46.12 26.72 14 BAYES_50 52851 54.22 39.59 60.58 15 XM_DK_Undo_02 52447 14.99 39.28 4.42 16 XM_B_SpammyWords2 52081 23.58 39.01 16.86 17 HTML_FONT_LOW_CONTRAST 47247 31.18 35.39 29.35 18 FVGT_m_MULTI_ODD 42689 26.60 31.97 24.25 19 BAYES_99 42489 11.96 31.83 3.31 20 DKIM_VALID_EF 41827 31.22 31.33 31.18 21 MIME_HTML_ONLY 38957 22.20 29.18 19.16 22 TR_XM_DKIM_Undo 38450 9.89 28.80 1.66 23 T_KAM_HTML_FONT_INVALID 37332 21.92 27.96 19.28 24 BAYES_999 32778 9.19 24.55 2.51 25 XMSubLong 32635 23.04 24.44 22.43 26 DCC_CHECK_NEGATIVE 31949 50.65 23.93 62.27 27 T_TM2_M_HEADER_IN_MSG 30959 30.68 23.19 33.94 28 TR_DCC_Bayes_99 30168 7.78 22.60 1.34 29 TR_XM_DK_Unsub 29014 15.71 21.73 13.09 30 RELAYCOUNTRY_META 26392 8.51 19.77 3.61 31 XM_Multi_Part_URI 26059 14.65 19.52 12.54 32 XM_B_Unsub 24777 11.15 18.56 7.92 33 RCVD_IN_MSPIKE_H2 24769 16.62 18.55 15.78 34 TR_XM_BayesUnsub 23959 9.80 17.95 6.25 35 UNPARSEABLE_RELAY 23011 13.68 17.24 12.13 36 TR_MAX_INTL_RELAY 21104 8.87 15.81 5.84 37 XM_B_SpammyWords3 20423 7.64 15.30 4.31 38 LOTS_OF_MONEY 19227 8.39 14.40 5.78 39 TR_XM_SpammyRelay 18293 5.32 13.70 1.68 40 FSL_BULK_SIG 16063 9.50 12.03 8.39 41 BOTNET_IPINHOSTNAME 15910 5.51 11.92 2.72 42 TR_XM_SpammyWords4 15643 6.28 11.72 3.91 43 BOTNET 14416 4.03 10.80 1.09 44 TR_XM_SpammyWords2 14242 3.58 10.67 0.49 45 BAYES_80 13061 5.49 9.78 3.62 46 XM_Evil_Numbers_Gen 12718 9.81 9.53 9.93 47 TR_XM_UnparsRelay 12188 3.92 9.13 1.66 48 UNTRUSTED_Relay 11988 3.82 8.98 1.57 49 RCVD_IN_MSPIKE_WL 11931 14.54 8.94 16.98 50 RCVD_IN_BL_SPAMCOP_NET 11875 2.99 8.89 0.43 51 XM_B_Phish_Phrases 10968 6.00 8.22 5.04 52 XM_UncommonTLD01 10715 5.39 8.03 4.24 53 BAYES_60 10223 6.78 7.66 6.41 54 LotsOfNums_01 9340 7.47 7.00 7.68 55 XM_Body_Dirty_Words 9238 3.46 6.92 1.96 56 XM_B_PhoneNumber 9190 8.78 6.88 9.60 57 HTML_IMAGE_RATIO_02 9075 5.19 6.80 4.49 58 RELAYCOUNTRY_CA 8766 2.46 6.57 0.68 59 XMSubMetaSx_00 8744 4.37 6.55 3.42 60 MPART_ALT_DIFF 7948 4.93 5.95 4.49 61 XM_H_GMP 7250 5.92 5.43 6.13 62 DKIM_INVALID 7135 3.14 5.34 2.18 63 XMSexyCombo_05 6986 2.28 5.23 1.00 64 XM_SPF_SoftFail 6966 2.56 5.22 1.41 65 XM_B_Investor 6838 2.67 5.12 1.61 66 BAYES_95 6707 3.07 5.02 2.22 67 RCVD_IN_MSPIKE_BL 6626 2.07 4.96 0.81 68 TR_XM_MSPIKECOMBO 6626 2.07 4.96 0.81 69 XM_H_Long_From01 6559 4.93 4.91 4.93 70 TooManyTo_001 6556 7.32 4.91 8.37 71 HTML_IMAGE_RATIO_04 6012 4.12 4.50 3.96 72 XM_B_SpammyTLD 5981 2.99 4.48 2.34 73 TM2_M_VERY_LONG_WORD 5798 5.23 4.34 5.61 74 RCVD_IN_MSPIKE_H3 5678 6.64 4.25 7.67 75 XMStrtUSub 5560 4.41 4.16 4.52 76 MIME_HTML_MOSTLY 5503 3.16 4.12 2.74 77 TR_XM_PhishingBody 5375 2.11 4.03 1.28 78 TR_XM_SPAMCOP 5138 1.25 3.85 0.11 79 XMNumbers 5105 3.44 3.82 3.28 80 TR_XM_SpammyWords5 5043 2.30 3.78 1.66 81 XM_OfRef6 4927 1.71 3.69 0.84 82 TR_XM_SpammyWords3 4757 1.34 3.56 0.38 83 MIME_QP_LONG_LINE 4647 4.63 3.48 5.13 84 XM_CamelCaseFrm001 4605 2.21 3.45 1.67 85 XM_UB50 4601 1.79 3.45 1.07 86 XM_URI_RBL 4588 1.25 3.44 0.30 87 T_XMDrugObfuBody_14 4584 2.38 3.43 1.92 88 T_FILL_THIS_FORM_SHORT 4515 1.66 3.38 0.92 89 TR_XM_NoHeaderRelay 4262 1.13 3.19 0.23 90 XMDiploma_00 4177 2.00 3.13 1.51 91 XM_B_Unsub2 4166 1.74 3.12 1.14 92 TR_XM_InvalidRelay 4098 0.94 3.07 0.01 93 MIME_HTML_ONLY_MULTI 4094 2.51 3.07 2.27 94 T_XMDrugObfuBody_08 3951 1.84 2.96 1.35 95 SpammyFromTLD_02 3916 1.05 2.93 0.23 96 HTML_IMAGE_RATIO_06 3695 2.63 2.77 2.57 97 USER_IN_DEF_DKIM_WL 3637 8.70 2.72 11.30 98 RELAYCOUNTRY_AU 3615 1.18 2.71 0.52 99 RCVD_IN_MSPIKE_L3 3574 1.22 2.68 0.59 100 T_TooManySym_01 3564 4.91 2.67 5.89 101 TR_XM_INV_DKIM 3449 0.79 2.58 0.01 102 RCVD_IN_MSPIKE_H4 3439 3.27 2.58 3.58 103 RCVD_IN_VALIDITY_SAFE 3415 3.18 2.56 3.45 104 XM_B_URI_Unicode 3393 2.05 2.54 1.84 105 TM2_M_URI_OPT_OUT 3356 1.80 2.51 1.49 106 HTML_IMAGE_RATIO_08 3343 2.24 2.50 2.12 107 XMBody_17 3303 1.08 2.47 0.47 108 TR_Mismatch_TLD_02 3254 0.80 2.44 0.08 109 TR_LOTS_OF_MONEY2 3132 0.88 2.35 0.24 110 T_MONEY_PERCENT 3132 0.88 2.35 0.24 111 SUBJ_ALL_CAPS 3073 1.81 2.30 1.59 112 TR_XM_MSPIKECOMBO2 3068 0.73 2.30 0.05 113 XM_B_SpammyWords4 3039 1.01 2.28 0.46 114 XM_UB99 2987 0.68 2.24 0.00 115 RCVD_IN_VALIDITY_RPBL 2909 0.71 2.18 0.07 116 ALL_TRUSTED 2860 11.61 2.14 15.73 117 RCVD_IN_VALIDITY_CERTIFIED 2847 2.60 2.13 2.80 118 FROM_EXCESS_BASE64 2846 1.68 2.13 1.49 119 ANY_BOUNCE_MESSAGE 2814 6.53 2.11 8.46 120 RCVD_IN_MSPIKE_H5 2814 4.63 2.11 5.73 121 BOUNCE_MESSAGE 2813 6.53 2.11 8.46 122 MAILING_LIST_MULTI 2677 2.69 2.01 2.98 123 TR_LOTS_OF_MONEY3 2612 0.84 1.96 0.35 124 RCVD_IN_XBL 2593 0.60 1.94 0.01 125 XMStockSpam_06 2571 1.46 1.93 1.26 126 RELAYCOUNTRY_CN 2522 0.64 1.89 0.10 127 TR_Symld_Words 2512 1.58 1.88 1.45 128 T_REMOTE_IMAGE 2510 3.26 1.88 3.86 129 RCVD_IN_MSPIKE_L4 2508 0.71 1.88 0.21 130 T_XMHurry_00 2482 0.90 1.86 0.48 131 HK_RANDOM_REPLYTO 2471 0.63 1.85 0.09 132 XMBrknScrpt_02 2432 1.13 1.82 0.82 133 KHOP_HELO_FCRDNS 2414 3.25 1.81 3.88 134 XMGenDplmaNmb 2385 1.19 1.79 0.93 135 BAYES_40 2368 5.02 1.77 6.44 136 T_XMDrugObfuBody_00 2357 1.21 1.77 0.97 137 XM_UB999 2348 0.53 1.76 0.00 138 DKIM_ADSP_CUSTOM_MED 2338 1.13 1.75 0.86 139 RCVD_IN_PSBL 2329 0.85 1.74 0.45 140 XMBdyGiftCard01 2320 0.68 1.74 0.23 141 RCVD_IN_PBL 2309 1.10 1.73 0.82 142 HTML_MIME_NO_HTML_TAG 2265 3.01 1.70 3.58 143 SpammyFromTLD_01 2252 1.12 1.69 0.87 144 SHORTCIRCUIT 2179 0.49 1.63 0.00 145 RCVD_IN_ZEN_LASTEXTERNAL 2179 0.49 1.63 0.00 146 RELAYCOUNTRY_IN 2169 0.53 1.62 0.05 147 XM_H_Long_From02 2152 1.03 1.61 0.77 148 SCC_BODY_URI_ONLY 2125 2.11 1.59 2.33 149 XM_UB80 2104 0.49 1.58 0.02 150 NML_ADSP_CUSTOM_MED 2100 0.85 1.57 0.54 151 TM2_M_A_HREF_HREF 2061 0.72 1.54 0.36 152 BAYES_20 1986 3.35 1.49 4.16 153 XM_HighProb1 1951 0.45 1.46 0.00 154 URI_NOVOWEL 1924 1.41 1.44 1.40 155 URI_HEX 1912 1.27 1.43 1.20 156 XM_DIRTYINTL 1910 0.48 1.43 0.07 157 FORGED_GMAIL_RCVD 1877 0.79 1.41 0.52 158 XM_B_Phish66 1868 0.64 1.40 0.31 159 URI_TRY_3LD 1855 0.79 1.39 0.53 160 XM_DK_Undo_01 1833 1.74 1.37 1.90 161 RCVD_IN_IADB_LISTED 1817 2.58 1.36 3.11 162 XM_SendGrid 1798 1.51 1.35 1.58 163 RDNS_DYNAMIC 1784 0.52 1.34 0.17 164 XM_B_DNDMA 1751 0.66 1.31 0.38 165 PDS_RDNS_DYNAMIC_FP 1744 0.43 1.31 0.05 166 XMPhish30 1727 0.71 1.29 0.45 167 RCVD_IN_SBL_CSS 1722 0.42 1.29 0.04 168 DIET_1 1717 0.65 1.29 0.37 169 TR_XM_Base64_L1 1704 0.42 1.28 0.05 170 HTML_IMAGE_ONLY_20 1651 0.62 1.24 0.35 171 TR_XM_PHPForged 1638 0.62 1.23 0.35 172 MONEY_FRAUD_5 1633 0.39 1.22 0.02 173 DKIM_ADSP_NXDOMAIN 1612 0.58 1.21 0.31 174 RELAYCOUNTRY_FR 1608 0.54 1.20 0.25 175 TR_XM_FormFill2 1601 0.61 1.20 0.35 176 TR_XM_PHPDW 1595 0.61 1.19 0.36 177 XM_B_COPY_HTML 1584 0.78 1.19 0.60 178 MPART_ALT_DIFF_COUNT 1571 0.71 1.18 0.51 179 XM_H_PHPOS 1570 0.59 1.18 0.34 180 RCVD_IN_IADB_SPF 1554 2.26 1.16 2.74 181 TR_XM_MaxSPIKE 1529 0.38 1.15 0.04 182 TM2_M_OBFU_COMMENT 1507 0.52 1.13 0.26 183 SH_BODYURI_REVERSE_SBL 1497 0.34 1.12 0.01 184 URIBL_SBL_A 1496 0.34 1.12 0.01 185 URIBL_SBL 1496 0.34 1.12 0.01 186 XM_PDF 1476 4.26 1.11 5.63 187 XM_B_SEO 1476 0.50 1.11 0.24 188 THIS_AD 1471 0.62 1.10 0.42 189 MONEY_FORM_SHORT 1444 0.35 1.08 0.04 190 XM_UB60 1435 0.38 1.07 0.07 191 RCVD_IN_IADB_DK 1424 1.98 1.07 2.37 192 MultiRelay_CC 1421 0.44 1.06 0.17 193 HTTPS_HTTP_MISMATCH 1415 0.79 1.06 0.68 194 TVD_RCVD_IP 1391 0.92 1.04 0.87 195 RCVD_IN_IADB_SENDERID 1384 2.03 1.04 2.46 196 LongTLD 1377 0.71 1.03 0.57 197 XMHTML_After_End 1353 0.58 1.01 0.40 198 XM_ProductURIs 1336 0.64 1.00 0.48 199 URIBL_BLACK 1321 0.31 0.99 0.02 200 TR_XM_SEO4 1320 0.38 0.99 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 305125 99.01 97.96 99.46 2 HTML_MESSAGE 264423 88.19 92.77 86.19 3 RELAYCOUNTRY_US 249367 80.44 78.50 81.28 4 DKIM_SIGNED 221555 76.74 87.14 72.22 5 XM_DK_Pass 218583 74.60 82.30 71.25 6 DKIM_VALID 214862 73.60 81.79 70.04 7 XM_B_Unicode 209131 72.33 81.90 68.17 8 DCC_CHECK_NEGATIVE 191045 50.65 23.93 62.27 9 BAYES_50 185859 54.22 39.59 60.58 10 DKIM_VALID_AU 173313 59.07 64.98 56.49 11 XM_B_SpammyWords 136705 51.86 68.64 44.56 12 XMListUnsubscribeExists 135651 50.50 64.95 44.22 13 XM_B_Unicode3 120789 41.55 46.55 39.37 14 DCC_CHECK 115534 48.80 74.41 37.66 15 T_TM2_M_HEADER_IN_MSG 104126 30.68 23.19 33.94 16 DKIM_VALID_EF 95645 31.22 31.33 31.18 17 HTML_FONT_LOW_CONTRAST 90052 31.18 35.39 29.35 18 LOC_TINY_FONT_1 81987 32.61 46.12 26.72 19 FVGT_m_MULTI_ODD 74410 26.60 31.97 24.25 20 XMSubLong 68814 23.04 24.44 22.43 21 T_KAM_HTML_FONT_INVALID 59160 21.92 27.96 19.28 22 MIME_HTML_ONLY 58766 22.20 29.18 19.16 23 RCVD_IN_MSPIKE_WL 52099 14.54 8.94 16.98 24 XM_B_SpammyWords2 51720 23.58 39.01 16.86 25 RCVD_IN_MSPIKE_H2 48409 16.62 18.55 15.78 26 ALL_TRUSTED 48267 11.61 2.14 15.73 27 TR_XM_DK_Unsub 40150 15.71 21.73 13.09 28 XM_Multi_Part_URI 38458 14.65 19.52 12.54 29 UNPARSEABLE_RELAY 37207 13.68 17.24 12.13 30 USER_IN_DEF_DKIM_WL 34663 8.70 2.72 11.30 31 BAYES_00 33518 7.77 0.52 10.93 32 XM_Evil_Numbers_Gen 30474 9.81 9.53 9.93 33 XM_B_PhoneNumber 29449 8.78 6.88 9.60 34 ANY_BOUNCE_MESSAGE 25947 6.53 2.11 8.46 35 BOUNCE_MESSAGE 25943 6.53 2.11 8.46 36 FSL_BULK_SIG 25752 9.50 12.03 8.39 37 TooManyTo_001 25682 7.32 4.91 8.37 38 XM_B_Unsub 24308 11.15 18.56 7.92 39 LotsOfNums_01 23548 7.47 7.00 7.68 40 RCVD_IN_MSPIKE_H3 23543 6.64 4.25 7.67 41 TR_XM_DK_Bayes 23392 5.43 0.39 7.62 42 TR_XM_DK_Bayes1 23029 5.35 0.39 7.51 43 XM_DKIMWhitelistDomains 20605 4.71 0.10 6.72 44 BAYES_40 19750 5.02 1.77 6.44 45 BAYES_60 19650 6.78 7.66 6.41 46 TR_XM_DK_Bayes2 19553 4.53 0.29 6.37 47 TR_XM_BayesUnsub 19189 9.80 17.95 6.25 48 XM_H_GMP 18803 5.92 5.43 6.13 49 T_TooManySym_01 18066 4.91 2.67 5.89 50 TR_MAX_INTL_RELAY 17930 8.87 15.81 5.84 51 LOTS_OF_MONEY 17730 8.39 14.40 5.78 52 RCVD_IN_MSPIKE_H5 17582 4.63 2.11 5.73 53 XM_PDF 17287 4.26 1.11 5.63 54 TM2_M_VERY_LONG_WORD 17209 5.23 4.34 5.61 55 MIME_QP_LONG_LINE 15723 4.63 3.48 5.13 56 XM_B_Phish_Phrases 15468 6.00 8.22 5.04 57 XM_H_Long_From01 15131 4.93 4.91 4.93 58 HTML_IMAGE_ONLY_32 14545 3.35 0.15 4.74 59 XMStrtUSub 13862 4.41 4.16 4.52 60 MPART_ALT_DIFF 13779 4.93 5.95 4.49 61 HTML_IMAGE_RATIO_02 13773 5.19 6.80 4.49 62 XM_DK_Undo_02 13566 14.99 39.28 4.42 63 MAY_BE_FORGED 13525 3.28 0.69 4.41 64 XM_B_SpammyWords3 13219 7.64 15.30 4.31 65 XM_UncommonTLD01 13001 5.39 8.03 4.24 66 BAYES_20 12759 3.35 1.49 4.16 67 HTML_IMAGE_RATIO_04 12140 4.12 4.50 3.96 68 TR_XM_SpammyWords4 11998 6.28 11.72 3.91 69 KHOP_HELO_FCRDNS 11912 3.25 1.81 3.88 70 T_REMOTE_IMAGE 11833 3.26 1.88 3.86 71 BAYES_80 11099 5.49 9.78 3.62 72 RELAYCOUNTRY_META 11088 8.51 19.77 3.61 73 HTML_MIME_NO_HTML_TAG 10986 3.01 1.70 3.58 74 RCVD_IN_MSPIKE_H4 10974 3.27 2.58 3.58 75 RCVD_IN_VALIDITY_SAFE 10573 3.18 2.56 3.45 76 XMSubMetaSx_00 10502 4.37 6.55 3.42 77 BAYES_99 10148 11.96 31.83 3.31 78 XMNumbers 10051 3.44 3.82 3.28 79 RCVD_IN_IADB_LISTED 9543 2.58 1.36 3.11 80 T_TooManySym_02 9497 2.41 0.82 3.10 81 MAILING_LIST_MULTI 9145 2.69 2.01 2.98 82 RCVD_IN_VALIDITY_CERTIFIED 8594 2.60 2.13 2.80 83 RCVD_IN_IADB_SPF 8412 2.26 1.16 2.74 84 MIME_HTML_MOSTLY 8399 3.16 4.12 2.74 85 TooManyTo_002 8377 2.12 0.72 2.73 86 BOTNET_IPINHOSTNAME 8346 5.51 11.92 2.72 87 HTML_IMAGE_RATIO_06 7884 2.63 2.77 2.57 88 BAYES_999 7696 9.19 24.55 2.51 89 RCVD_IN_IADB_SENDERID 7549 2.03 1.04 2.46 90 MIME_CHARSET_FARAWAY 7326 1.95 0.94 2.39 91 INVALID_MSGID 7321 1.72 0.19 2.39 92 RCVD_IN_IADB_DK 7284 1.98 1.07 2.37 93 BAYES_05 7176 1.85 0.71 2.34 94 XM_B_SpammyTLD 7175 2.99 4.48 2.34 95 SCC_BODY_URI_ONLY 7157 2.11 1.59 2.33 96 MIME_HTML_ONLY_MULTI 6974 2.51 3.07 2.27 97 CHARSET_FARAWAY_HEADER 6920 1.81 0.80 2.26 98 BAYES_95 6824 3.07 5.02 2.22 99 DKIM_INVALID 6693 3.14 5.34 2.18 100 HTML_IMAGE_RATIO_08 6517 2.24 2.50 2.12 101 TO_MALFORMED 6431 1.47 0.03 2.10 102 RCVD_IN_IADB_VOUCHED 6082 1.63 0.81 1.98 103 XM_Body_Dirty_Words 6012 3.46 6.92 1.96 104 T_XMDrugObfuBody_14 5899 2.38 3.43 1.92 105 XM_DK_Undo_01 5822 1.74 1.37 1.90 106 XM_B_URI_Unicode 5646 2.05 2.54 1.84 107 TooManyTo_003 5581 1.45 0.59 1.82 108 TR_XM_SpammyRelay 5143 5.32 13.70 1.68 109 XM_CamelCaseFrm001 5119 2.21 3.45 1.67 110 TR_XM_UnparsRelay 5093 3.92 9.13 1.66 111 TR_XM_SpammyWords5 5093 2.30 3.78 1.66 112 TR_XM_DKIM_Undo 5091 9.89 28.80 1.66 113 XM_B_Investor 4928 2.67 5.12 1.61 114 SUBJ_ALL_CAPS 4892 1.81 2.30 1.59 115 XM_SendGrid 4856 1.51 1.35 1.58 116 UNTRUSTED_Relay 4824 3.82 8.98 1.57 117 XMDiploma_00 4642 2.00 3.13 1.51 118 TM2_M_URI_OPT_OUT 4576 1.80 2.51 1.49 119 FROM_EXCESS_BASE64 4558 1.68 2.13 1.49 120 XMLngstWrd_00 4464 1.14 0.42 1.46 121 TR_Symld_Words 4441 1.58 1.88 1.45 122 XM_SPF_SoftFail 4321 2.56 5.22 1.41 123 RCVD_IN_IADB_OPTIN 4301 1.15 0.58 1.40 124 URI_NOVOWEL 4300 1.41 1.44 1.40 125 TooManyTo_004 4186 1.11 0.51 1.36 126 T_XMDrugObfuBody_08 4156 1.84 2.96 1.35 127 HELO_NODOT 4126 1.01 0.24 1.34 128 HELO_NO_DOMAIN 4122 1.01 0.23 1.34 129 TR_DCC_Bayes_99 4101 7.78 22.60 1.34 130 IN_HORDE_ADDRESS_BOOK 4007 0.93 0.08 1.31 131 TR_XM_PhishingBody 3925 2.11 4.03 1.28 132 XM_ShortIntro_01 3892 1.05 0.55 1.27 133 XMStockSpam_06 3851 1.46 1.93 1.26 134 XMCapTrack 3836 1.02 0.49 1.25 135 URI_HEX 3667 1.27 1.43 1.20 136 T_TooManySym_03 3611 0.95 0.42 1.18 137 XM_GoogleGroups 3576 1.05 0.78 1.17 138 T_TVD_MIME_NO_HEADERS 3514 0.82 0.06 1.15 139 XM_B_Unsub2 3507 1.74 3.12 1.14 140 BOTNET 3347 4.03 10.80 1.09 141 TooManyTo_005 3345 0.90 0.47 1.09 142 XM_UB50 3283 1.79 3.45 1.07 143 TR_XM_DK_SendGrid 3145 0.99 0.91 1.03 144 XMGappySubj_01 3090 0.75 0.15 1.01 145 XMSexyCombo_05 3060 2.28 5.23 1.00 146 TVD_SPACE_RATIO 2963 0.71 0.12 0.97 147 T_XMDrugObfuBody_00 2962 1.21 1.77 0.97 148 XMGenDplmaNmb 2849 1.19 1.79 0.93 149 T_FILL_THIS_FORM_SHORT 2812 1.66 3.38 0.92 150 SpammyFromTLD_01 2682 1.12 1.69 0.87 151 TVD_RCVD_IP 2662 0.92 1.04 0.87 152 DKIM_ADSP_CUSTOM_MED 2634 1.13 1.75 0.86 153 XMSubMetaSxObfu_03 2608 0.81 0.71 0.85 154 XM_H_PHPMailer 2594 0.76 0.55 0.85 155 XM_OfRef6 2588 1.71 3.69 0.84 156 XMBrknScrpt_02 2529 1.13 1.82 0.82 157 RCVD_IN_PBL 2515 1.10 1.73 0.82 158 RCVD_IN_MSPIKE_BL 2480 2.07 4.96 0.81 159 TR_XM_MSPIKECOMBO 2480 2.07 4.96 0.81 160 XM_H_Long_From02 2370 1.03 1.61 0.77 161 T_Symld_Words_02 2313 0.79 0.86 0.75 162 XMGappySubj_02 2226 0.52 0.04 0.73 163 TR_XM_Base64_M1 2178 0.76 0.86 0.71 164 RELAYCOUNTRY_GB 2171 0.73 0.78 0.71 165 HTTPS_HTTP_MISMATCH 2073 0.79 1.06 0.68 166 RELAYCOUNTRY_CA 2071 2.46 6.57 0.68 167 TR_MetaPhish_Combo_01 2040 0.74 0.93 0.66 168 XMNoVowels 1964 0.60 0.51 0.64 169 HTML_TAG_BALANCE_BODY 1928 0.71 0.91 0.63 170 XM_B_COPY_HTML 1852 0.78 1.19 0.60 171 MSGID_FROM_MTA_HEADER 1820 0.50 0.28 0.59 172 RCVD_IN_MSPIKE_L3 1817 1.22 2.68 0.59 173 XMBSHREFv2 1779 0.56 0.51 0.58 174 LongTLD 1760 0.71 1.03 0.57 175 XMSubMetaI_00 1756 0.69 0.97 0.57 176 T_OBFU_PDF_ATTACH 1685 0.46 0.27 0.55 177 XMLngstWrd_01 1658 0.49 0.37 0.54 178 NML_ADSP_CUSTOM_MED 1652 0.85 1.57 0.54 179 URI_TRY_3LD 1634 0.79 1.39 0.53 180 FORGED_GMAIL_RCVD 1603 0.79 1.41 0.52 181 RELAYCOUNTRY_AU 1590 1.18 2.71 0.52 182 XMSlimDrugH 1587 0.59 0.76 0.52 183 MPART_ALT_DIFF_COUNT 1576 0.71 1.18 0.51 184 FROM_GOV_DKIM_AU 1565 0.40 0.15 0.51 185 TR_XM_SpammyWords2 1501 3.58 10.67 0.49 186 XM_ProductURIs 1479 0.64 1.00 0.48 187 T_XMHurry_00 1470 0.90 1.86 0.48 188 XMBody_17 1451 1.08 2.47 0.47 189 XM_B_SpammyWords4 1412 1.01 2.28 0.46 190 RCVD_IN_PSBL 1393 0.85 1.74 0.45 191 XMPhish30 1391 0.71 1.29 0.45 192 XMDateMe_00 1387 0.48 0.55 0.45 193 RCVD_IN_BL_SPAMCOP_NET 1309 2.99 8.89 0.43 194 XMMoneyMeta_00 1301 0.52 0.75 0.42 195 THIS_AD 1278 0.62 1.10 0.42 196 XMBody_95 1270 0.33 0.14 0.41 197 MISSING_HEADERS 1242 0.47 0.63 0.40 198 TO_NO_BRKTS_HTML_ONLY 1236 0.52 0.78 0.40 199 XM_H_UTAHEDU_HELP 1235 0.28 0.00 0.40 200 T_STY_INVIS_DIRECT 1224 0.49 0.71 0.40 ----------------------------------------------------------------------