Email: 477002 Autolearn: 0 AvgScore: 5.08 AvgScanTime: 1.35 sec Spam: 142449 Autolearn: 0 AvgScore: 14.57 AvgScanTime: 1.55 sec Ham: 334553 Autolearn: 0 AvgScore: 1.04 AvgScanTime: 1.27 sec Time Spent Running SA: 179.44 hours Time Spent Processing Spam: 61.34 hours Time Spent Processing Ham: 118.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135528 90.28 95.14 88.21 2 DKIM_SIGNED 128225 79.03 90.01 74.35 3 XM_DK_Pass 121774 77.00 85.49 73.39 4 DKIM_VALID 120650 76.06 84.70 72.38 5 XM_B_Unicode 119669 73.37 84.01 68.84 6 RELAYCOUNTRY_US 115981 79.94 81.42 79.31 7 DCC_CHECK 106151 51.67 74.52 41.95 8 XM_B_SpammyWords 97229 50.87 68.26 43.47 9 DKIM_VALID_AU 95313 61.29 66.91 58.90 10 XMListUnsubscribeExists 94931 53.28 66.64 47.59 11 XM_B_Unicode3 70687 43.65 49.62 41.11 12 LOC_TINY_FONT_1 66411 33.50 46.62 27.91 13 BAYES_50 58240 56.09 40.88 62.56 14 XM_DK_Undo_02 56655 15.00 39.77 4.46 15 XM_B_SpammyWords2 55899 24.73 39.24 18.55 16 HTML_FONT_LOW_CONTRAST 50772 29.55 35.64 26.96 17 FVGT_m_MULTI_ODD 49706 27.54 34.89 24.41 18 DKIM_VALID_EF 44165 30.08 31.00 29.69 19 BAYES_99 43386 11.28 30.46 3.12 20 T_KAM_HTML_FONT_INVALID 41548 26.37 29.17 25.17 21 MIME_HTML_ONLY 40011 21.39 28.09 18.54 22 TR_XM_DKIM_Undo 39966 9.64 28.06 1.80 23 XMSubLong 36469 22.94 25.60 21.80 24 DCC_CHECK_NEGATIVE 33936 47.80 23.82 58.00 25 BAYES_999 33933 8.72 23.82 2.29 26 T_TM2_M_HEADER_IN_MSG 31782 27.16 22.31 29.22 27 XM_Multi_Part_URI 31130 15.90 21.85 13.36 28 TR_XM_DK_Unsub 30708 15.47 21.56 12.87 29 TR_DCC_Bayes_99 30324 7.25 21.29 1.28 30 UNPARSEABLE_RELAY 28145 13.85 19.76 11.34 31 XM_B_Unsub 27895 11.71 19.58 8.36 32 RCVD_IN_MSPIKE_H2 27010 16.32 18.96 15.19 33 TR_XM_BayesUnsub 27004 10.22 18.96 6.50 34 RELAYCOUNTRY_META 23717 7.43 16.65 3.50 35 TR_MAX_INTL_RELAY 21524 8.33 15.11 5.44 36 XM_B_SpammyWords3 21103 7.87 14.81 4.91 37 LOTS_OF_MONEY 18302 8.08 12.85 6.05 38 BOTNET_IPINHOSTNAME 17257 5.81 12.11 3.13 39 TR_XM_SpammyRelay 17242 4.93 12.10 1.88 40 TR_XM_SpammyWords4 16446 6.29 11.55 4.05 41 FSL_BULK_SIG 16270 9.53 11.42 8.73 42 TR_XM_UnparsRelay 15398 4.25 10.81 1.46 43 XM_Evil_Numbers_Gen 14745 10.18 10.35 10.11 44 BOTNET 14219 3.85 9.98 1.24 45 XM_B_Phish_Phrases 13692 6.74 9.61 5.51 46 TR_XM_SpammyWords2 13635 3.09 9.57 0.33 47 BAYES_80 13298 5.17 9.34 3.39 48 RCVD_IN_MSPIKE_WL 13196 13.87 9.26 15.84 49 RCVD_IN_BL_SPAMCOP_NET 12328 2.92 8.65 0.48 50 BAYES_60 12149 7.37 8.53 6.88 51 LotsOfNums_01 11142 7.83 7.82 7.84 52 XM_Body_Dirty_Words 9503 3.80 6.67 2.57 53 XM_B_PhoneNumber 9386 9.00 6.59 10.02 54 UNTRUSTED_Relay 9109 3.04 6.39 1.61 55 HTML_IMAGE_RATIO_02 8785 4.62 6.17 3.96 56 MPART_ALT_DIFF 8530 5.27 5.99 4.96 57 RELAYCOUNTRY_CA 8457 2.27 5.94 0.71 58 XM_UncommonTLD01 8364 4.54 5.87 3.97 59 XMSubMetaSx_00 7953 3.60 5.58 2.76 60 XM_B_Investor 7833 2.80 5.50 1.66 61 BAYES_95 7714 3.06 5.42 2.05 62 XM_H_GMP 7582 5.83 5.32 6.04 63 DKIM_INVALID 7575 2.97 5.32 1.96 64 XM_H_Long_From01 7501 5.52 5.27 5.63 65 XMStrtUSub 7296 5.31 5.12 5.39 66 RCVD_IN_MSPIKE_H3 7098 7.10 4.98 8.00 67 TR_XM_SPAMCOP 6875 1.54 4.83 0.15 68 RCVD_IN_MSPIKE_BL 6346 2.11 4.45 1.11 69 TR_XM_MSPIKECOMBO 6342 2.11 4.45 1.11 70 TooManyTo_001 6289 6.87 4.41 7.92 71 TR_XM_PhishingBody 6218 2.74 4.37 2.05 72 TR_XM_SpammyWords5 6025 2.35 4.23 1.56 73 XM_B_SpammyTLD 5977 2.75 4.20 2.14 74 T_XMDrugObfuBody_14 5826 2.58 4.09 1.93 75 HTML_IMAGE_RATIO_04 5824 4.26 4.09 4.34 76 XMSexyCombo_05 5820 1.83 4.09 0.87 77 XM_B_Unsub2 5302 2.11 3.72 1.42 78 XM_CamelCaseFrm001 5281 2.65 3.71 2.19 79 XMNumbers 5276 3.38 3.70 3.24 80 XMDiploma_00 5053 2.44 3.55 1.97 81 MIME_HTML_MOSTLY 4910 3.22 3.45 3.12 82 MIME_QP_LONG_LINE 4830 4.91 3.39 5.56 83 XM_OfRef6 4819 1.89 3.38 1.26 84 HTML_IMAGE_RATIO_06 4653 2.75 3.27 2.53 85 HTML_IMAGE_RATIO_08 4641 2.66 3.26 2.41 86 MIME_HTML_ONLY_MULTI 4627 2.68 3.25 2.44 87 TM2_M_VERY_LONG_WORD 4589 1.91 3.22 1.36 88 RELAYCOUNTRY_AU 4304 1.36 3.02 0.66 89 XM_SPF_SoftFail 4283 1.85 3.01 1.36 90 TR_XM_SpammyWords3 4176 1.24 2.93 0.52 91 T_TooManySym_01 4115 4.52 2.89 5.21 92 XM_UB50 4101 1.60 2.88 1.05 93 XM_B_SpammyWords4 4084 1.32 2.87 0.66 94 XM_URI_RBL 3905 1.01 2.74 0.27 95 USER_IN_DEF_DKIM_WL 3881 9.75 2.72 12.74 96 XM_B_URI_Unicode 3879 2.11 2.72 1.84 97 TR_XM_NoHeaderRelay 3692 0.92 2.59 0.21 98 SUBJ_ALL_CAPS 3681 1.82 2.58 1.50 99 T_XMDrugObfuBody_08 3602 1.69 2.53 1.34 100 RCVD_IN_VALIDITY_SAFE 3535 3.41 2.48 3.80 101 TM2_M_URI_OPT_OUT 3518 1.92 2.47 1.69 102 RCVD_IN_MSPIKE_L3 3497 1.48 2.45 1.07 103 TR_XM_INV_DKIM 3496 0.74 2.45 0.01 104 RCVD_IN_MSPIKE_H4 3409 2.87 2.39 3.07 105 T_FILL_THIS_FORM_SHORT 3306 1.36 2.32 0.95 106 XMBrknScrpt_02 3253 1.27 2.28 0.84 107 HTML_MIME_NO_HTML_TAG 3210 2.40 2.25 2.47 108 MAILING_LIST_MULTI 3112 2.88 2.18 3.17 109 XMStockSpam_06 3084 3.53 2.16 4.11 110 ALL_TRUSTED 3050 12.98 2.14 17.59 111 RCVD_IN_VALIDITY_CERTIFIED 2961 2.82 2.08 3.14 112 XMGenDplmaNmb 2916 1.46 2.05 1.21 113 SpammyFromTLD_02 2915 0.81 2.05 0.28 114 T_XMDrugObfuBody_00 2909 1.11 2.04 0.71 115 FROM_EXCESS_BASE64 2886 1.80 2.03 1.71 116 RCVD_IN_IADB_LISTED 2712 3.13 1.90 3.65 117 XMBody_17 2704 0.80 1.90 0.33 118 RCVD_IN_MSPIKE_H5 2689 3.90 1.89 4.76 119 T_XMHurry_00 2680 1.03 1.88 0.67 120 XMSubMetaI_00 2663 1.16 1.87 0.86 121 RCVD_IN_VALIDITY_RPBL 2499 0.56 1.75 0.05 122 T_REMOTE_IMAGE 2488 3.08 1.75 3.64 123 SpammyFromTLD_01 2477 1.01 1.74 0.71 124 HK_RANDOM_REPLYTO 2458 0.57 1.73 0.08 125 RCVD_IN_IADB_SPF 2389 2.74 1.68 3.19 126 SHORTCIRCUIT 2339 0.49 1.64 0.00 127 RCVD_IN_ZEN_LASTEXTERNAL 2339 0.49 1.64 0.00 128 URI_TRY_3LD 2291 0.99 1.61 0.72 129 XMBdyGiftCard01 2270 0.92 1.59 0.63 130 RCVD_IN_IADB_DK 2254 2.38 1.58 2.72 131 XM_SendGrid 2247 1.50 1.58 1.47 132 RCVD_IN_IADB_SENDERID 2215 2.45 1.55 2.82 133 XM_DK_Undo_01 2210 1.73 1.55 1.81 134 BAYES_40 2161 4.21 1.52 5.36 135 TR_XM_INTL_Spamhaus 2160 0.56 1.52 0.15 136 XM_PDF 2137 3.73 1.50 4.68 137 RCVD_IN_MSPIKE_L4 2109 0.47 1.48 0.04 138 URI_NOVOWEL 2104 1.30 1.48 1.22 139 THIS_AD 2064 0.73 1.45 0.42 140 TR_XM_MSPIKECOMBO2 2053 0.47 1.44 0.06 141 URI_HEX 2036 1.22 1.43 1.14 142 MPART_ALT_DIFF_COUNT 2027 0.84 1.42 0.59 143 XM_B_SEO 1959 0.56 1.38 0.22 144 DKIM_ADSP_CUSTOM_MED 1955 0.99 1.37 0.82 145 XM_B_Phish66 1952 0.73 1.37 0.45 146 XMPhish30 1952 0.88 1.37 0.66 147 BOTNET_NORDNS 1952 0.41 1.37 0.01 148 XM_H_Long_From02 1926 0.93 1.35 0.75 149 RDNS_DYNAMIC 1920 0.50 1.35 0.14 150 PDS_RDNS_DYNAMIC_FP 1878 0.42 1.32 0.03 151 KHOP_HELO_FCRDNS 1847 1.62 1.30 1.76 152 TR_LOTS_OF_MONEY3 1826 0.56 1.28 0.25 153 TVD_RCVD_IP 1799 1.21 1.26 1.18 154 TR_LOTS_OF_MONEY2 1778 0.59 1.25 0.32 155 T_MONEY_PERCENT 1778 0.59 1.25 0.32 156 XM_UB60 1762 0.42 1.24 0.07 157 TR_XM_PHPForged 1746 0.62 1.23 0.36 158 SHOPIFY_IMG_NOT_RCVD_SFY 1742 0.52 1.22 0.23 159 RELAYCOUNTRY_FR 1710 0.59 1.20 0.32 160 TR_XM_GMP_BULK_SIG 1690 0.60 1.19 0.35 161 HTML_FONT_TINY_NORDNS 1685 0.46 1.18 0.16 162 TR_XM_FormFill2 1678 0.61 1.18 0.37 163 TR_Mismatch_TLD_02 1669 0.41 1.17 0.09 164 TR_XM_PHPDW 1660 0.60 1.17 0.36 165 XM_H_PHPOS 1647 0.59 1.16 0.35 166 T_Symld_Words_02 1620 0.91 1.14 0.81 167 XM_HighProb1 1612 0.34 1.13 0.00 168 XM_DIRTYINTL 1600 0.37 1.12 0.05 169 TR_XM_SEO4 1580 0.40 1.11 0.10 170 XM_B_COPY_HTML 1570 0.82 1.10 0.70 171 RCVD_IN_PBL 1570 0.88 1.10 0.79 172 STY_INVIS_DIRECT 1523 0.51 1.07 0.27 173 TR_XM_DK_SendGrid 1519 1.02 1.07 1.00 174 BAYES_20 1491 3.08 1.05 3.94 175 XMHTML_After_End 1489 0.58 1.05 0.38 176 MultiRelay_CC 1483 0.39 1.04 0.12 177 XMBody_78 1472 0.57 1.03 0.37 178 HTTPS_HTTP_MISMATCH 1472 0.80 1.03 0.70 179 XM_B_COVIDMETA 1457 0.39 1.02 0.12 180 TR_Symld_Words 1457 1.36 1.02 1.50 181 RCVD_IN_PSBL 1454 0.71 1.02 0.58 182 XM_GoogleGroups 1446 1.22 1.02 1.31 183 HTML_IMAGE_ONLY_20 1434 0.68 1.01 0.54 184 XM_ProductURIs 1422 2.74 1.00 3.48 185 DIET_1 1421 0.52 1.00 0.31 186 TR_XM_RelayPhish 1417 0.36 0.99 0.09 187 RCVD_IN_XBL 1417 0.31 0.99 0.01 188 TR_XM_MaxSPIKE 1413 0.34 0.99 0.06 189 TR_XM_InvalidRelay 1409 0.31 0.99 0.01 190 HELO_DYNAMIC_SPLIT_IP 1397 0.29 0.98 0.00 191 FORGED_GMAIL_RCVD 1364 0.65 0.96 0.52 192 XM_B_DNDMA 1360 0.62 0.95 0.47 193 TR_MetaPhish_Combo_01 1336 0.82 0.94 0.78 194 RCVD_IN_IADB_VOUCHED 1328 2.04 0.93 2.52 195 LongTLD 1306 0.65 0.92 0.54 196 XM_UB99 1303 0.27 0.91 0.00 197 SH_BODYURI_REVERSE_SBL 1300 0.27 0.91 0.00 198 URIBL_SBL 1298 0.27 0.91 0.00 199 URIBL_SBL_A 1298 0.27 0.91 0.00 200 T_TooManySym_02 1294 2.31 0.91 2.91 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295093 90.28 95.14 88.21 2 RELAYCOUNTRY_US 265326 79.94 81.42 79.31 3 DKIM_SIGNED 248727 79.03 90.01 74.35 4 XM_DK_Pass 245538 77.00 85.49 73.39 5 DKIM_VALID 242158 76.06 84.70 72.38 6 XM_B_Unicode 230297 73.37 84.01 68.84 7 BAYES_50 209304 56.09 40.88 62.56 8 DKIM_VALID_AU 197047 61.29 66.91 58.90 9 DCC_CHECK_NEGATIVE 194048 47.80 23.82 58.00 10 XMListUnsubscribeExists 159198 53.28 66.64 47.59 11 XM_B_SpammyWords 145424 50.87 68.26 43.47 12 DCC_CHECK 140331 51.67 74.52 41.95 13 XM_B_Unicode3 137536 43.65 49.62 41.11 14 DKIM_VALID_EF 99338 30.08 31.00 29.69 15 T_TM2_M_HEADER_IN_MSG 97754 27.16 22.31 29.22 16 LOC_TINY_FONT_1 93387 33.50 46.62 27.91 17 HTML_FONT_LOW_CONTRAST 90196 29.55 35.64 26.96 18 T_KAM_HTML_FONT_INVALID 84215 26.37 29.17 25.17 19 FVGT_m_MULTI_ODD 81649 27.54 34.89 24.41 20 XMSubLong 72933 22.94 25.60 21.80 21 XM_B_SpammyWords2 62054 24.73 39.24 18.55 22 MIME_HTML_ONLY 62028 21.39 28.09 18.54 23 ALL_TRUSTED 58856 12.98 2.14 17.59 24 RCVD_IN_MSPIKE_WL 52978 13.87 9.26 15.84 25 RCVD_IN_MSPIKE_H2 50823 16.32 18.96 15.19 26 XM_Multi_Part_URI 44691 15.90 21.85 13.36 27 TR_XM_DK_Unsub 43066 15.47 21.56 12.87 28 USER_IN_DEF_DKIM_WL 42615 9.75 2.72 12.74 29 UNPARSEABLE_RELAY 37942 13.85 19.76 11.34 30 BAYES_00 34978 7.52 0.63 10.46 31 XM_Evil_Numbers_Gen 33837 10.18 10.35 10.11 32 XM_B_PhoneNumber 33534 9.00 6.59 10.02 33 FSL_BULK_SIG 29210 9.53 11.42 8.73 34 XM_B_Unsub 27972 11.71 19.58 8.36 35 RCVD_IN_MSPIKE_H3 26779 7.10 4.98 8.00 36 TooManyTo_001 26492 6.87 4.41 7.92 37 LotsOfNums_01 26215 7.83 7.82 7.84 38 XM_DKIMWhitelistDomains 23089 4.84 0.01 6.90 39 BAYES_60 23002 7.37 8.53 6.88 40 TR_XM_DK_Bayes 22282 4.82 0.50 6.66 41 TR_XM_DK_Bayes1 21973 4.76 0.50 6.57 42 TR_XM_BayesUnsub 21742 10.22 18.96 6.50 43 LOTS_OF_MONEY 20257 8.08 12.85 6.05 44 XM_H_GMP 20220 5.83 5.32 6.04 45 XM_H_Long_From01 18830 5.52 5.27 5.63 46 MIME_QP_LONG_LINE 18593 4.91 3.39 5.56 47 TR_XM_DK_Bayes2 18575 4.00 0.36 5.55 48 XM_B_Phish_Phrases 18439 6.74 9.61 5.51 49 TR_MAX_INTL_RELAY 18216 8.33 15.11 5.44 50 XMStrtUSub 18026 5.31 5.12 5.39 51 BAYES_40 17942 4.21 1.52 5.36 52 T_TooManySym_01 17429 4.52 2.89 5.21 53 MPART_ALT_DIFF 16603 5.27 5.99 4.96 54 XM_B_SpammyWords3 16432 7.87 14.81 4.91 55 RCVD_IN_MSPIKE_H5 15930 3.90 1.89 4.76 56 XM_PDF 15650 3.73 1.50 4.68 57 ANY_BOUNCE_MESSAGE 15301 3.47 0.89 4.57 58 BOUNCE_MESSAGE 15295 3.47 0.89 4.57 59 XM_DK_Undo_02 14910 15.00 39.77 4.46 60 HTML_IMAGE_RATIO_04 14517 4.26 4.09 4.34 61 XMStockSpam_06 13759 3.53 2.16 4.11 62 TR_XM_SpammyWords4 13548 6.29 11.55 4.05 63 XM_UncommonTLD01 13290 4.54 5.87 3.97 64 HTML_IMAGE_RATIO_02 13258 4.62 6.17 3.96 65 BAYES_20 13185 3.08 1.05 3.94 66 XM_ShortIntro_01 12905 2.91 0.67 3.86 67 RCVD_IN_VALIDITY_SAFE 12714 3.41 2.48 3.80 68 RCVD_IN_IADB_LISTED 12215 3.13 1.90 3.65 69 T_REMOTE_IMAGE 12181 3.08 1.75 3.64 70 RELAYCOUNTRY_META 11721 7.43 16.65 3.50 71 XM_ProductURIs 11652 2.74 1.00 3.48 72 BAYES_80 11348 5.17 9.34 3.39 73 XMNumbers 10825 3.38 3.70 3.24 74 RCVD_IN_IADB_SPF 10662 2.74 1.68 3.19 75 MAILING_LIST_MULTI 10613 2.88 2.18 3.17 76 RCVD_IN_VALIDITY_CERTIFIED 10509 2.82 2.08 3.14 77 BOTNET_IPINHOSTNAME 10476 5.81 12.11 3.13 78 MIME_HTML_MOSTLY 10437 3.22 3.45 3.12 79 BAYES_99 10430 11.28 30.46 3.12 80 RCVD_IN_MSPIKE_H4 10269 2.87 2.39 3.07 81 T_TooManySym_02 9730 2.31 0.91 2.91 82 URI_TRUNCATED 9642 2.11 0.29 2.88 83 RCVD_IN_IADB_SENDERID 9449 2.45 1.55 2.82 84 XMSubMetaSx_00 9221 3.60 5.58 2.76 85 RCVD_IN_IADB_DK 9086 2.38 1.58 2.72 86 TooManyTo_002 8656 2.06 0.83 2.59 87 XM_Body_Dirty_Words 8602 3.80 6.67 2.57 88 HTML_IMAGE_RATIO_06 8475 2.75 3.27 2.53 89 RCVD_IN_IADB_VOUCHED 8419 2.04 0.93 2.52 90 HTML_MIME_NO_HTML_TAG 8248 2.40 2.25 2.47 91 MIME_HTML_ONLY_MULTI 8162 2.68 3.25 2.44 92 HTML_IMAGE_RATIO_08 8049 2.66 3.26 2.41 93 INVALID_MSGID 7668 1.66 0.17 2.29 94 BAYES_999 7655 8.72 23.82 2.29 95 BAYES_05 7491 1.73 0.54 2.24 96 XM_CamelCaseFrm001 7343 2.65 3.71 2.19 97 XM_B_SpammyTLD 7144 2.75 4.20 2.14 98 TR_XM_PhishingBody 6873 2.74 4.37 2.05 99 BAYES_95 6868 3.06 5.42 2.05 100 MSGID_NOFQDN1 6853 1.44 0.01 2.05 101 XMDiploma_00 6580 2.44 3.55 1.97 102 DKIM_INVALID 6569 2.97 5.32 1.96 103 T_XMDrugObfuBody_14 6462 2.58 4.09 1.93 104 TO_MALFORMED 6313 1.33 0.03 1.89 105 TR_XM_SpammyRelay 6273 4.93 12.10 1.88 106 XM_B_URI_Unicode 6167 2.11 2.72 1.84 107 XM_DK_Undo_01 6045 1.73 1.55 1.81 108 TR_XM_DKIM_Undo 6023 9.64 28.06 1.80 109 RCVD_IN_IADB_OPTIN 5906 1.41 0.59 1.77 110 KHOP_HELO_FCRDNS 5873 1.62 1.30 1.76 111 FROM_EXCESS_BASE64 5715 1.80 2.03 1.71 112 TM2_M_URI_OPT_OUT 5651 1.92 2.47 1.69 113 XM_B_Investor 5541 2.80 5.50 1.66 114 UNTRUSTED_Relay 5399 3.04 6.39 1.61 115 TooManyTo_003 5295 1.33 0.73 1.58 116 TR_XM_SpammyWords5 5208 2.35 4.23 1.56 117 TR_Symld_Words 5010 1.36 1.02 1.50 118 SUBJ_ALL_CAPS 5009 1.82 2.58 1.50 119 HELO_NODOT 4994 1.10 0.18 1.49 120 HELO_NO_DOMAIN 4991 1.10 0.16 1.49 121 XM_SendGrid 4920 1.50 1.58 1.47 122 TR_XM_UnparsRelay 4895 4.25 10.81 1.46 123 XM_B_Unsub2 4761 2.11 3.72 1.42 124 XM_SPF_SoftFail 4542 1.85 3.01 1.36 125 TM2_M_VERY_LONG_WORD 4542 1.91 3.22 1.36 126 T_XMDrugObfuBody_08 4475 1.69 2.53 1.34 127 XM_GoogleGroups 4388 1.22 1.02 1.31 128 IN_HORDE_ADDRESS_BOOK 4342 0.93 0.08 1.30 129 T_TVD_MIME_NO_HEADERS 4335 0.92 0.04 1.30 130 TR_DCC_Bayes_99 4281 7.25 21.29 1.28 131 XM_OfRef6 4211 1.89 3.38 1.26 132 BOTNET 4132 3.85 9.98 1.24 133 URI_NOVOWEL 4089 1.30 1.48 1.22 134 XMGenDplmaNmb 4053 1.46 2.05 1.21 135 TooManyTo_004 3979 1.02 0.62 1.19 136 TVD_RCVD_IP 3951 1.21 1.26 1.18 137 T_TooManySym_03 3878 0.92 0.37 1.16 138 URI_HEX 3799 1.22 1.43 1.14 139 RCVD_IN_MSPIKE_BL 3724 2.11 4.45 1.11 140 TR_XM_MSPIKECOMBO 3721 2.11 4.45 1.11 141 XMCapTrack 3719 0.97 0.63 1.11 142 XMGappySubj_01 3596 0.80 0.16 1.07 143 RCVD_IN_MSPIKE_L3 3563 1.48 2.45 1.07 144 XM_UB50 3528 1.60 2.88 1.05 145 TR_XM_DK_SendGrid 3330 1.02 1.07 1.00 146 TooManyTo_005 3250 0.85 0.56 0.97 147 T_FILL_THIS_FORM_SHORT 3192 1.36 2.32 0.95 148 TVD_SPACE_RATIO 3159 0.70 0.12 0.94 149 T_OBFU_PDF_ATTACH 2966 0.84 0.75 0.89 150 XMSexyCombo_05 2898 1.83 4.09 0.87 151 XMSubMetaI_00 2876 1.16 1.87 0.86 152 XMBrknScrpt_02 2813 1.27 2.28 0.84 153 DKIM_ADSP_CUSTOM_MED 2751 0.99 1.37 0.82 154 T_Symld_Words_02 2698 0.91 1.14 0.81 155 RCVD_IN_PBL 2646 0.88 1.10 0.79 156 TR_MetaPhish_Combo_01 2593 0.82 0.94 0.78 157 XM_H_PHPMailer 2519 0.66 0.45 0.75 158 XM_H_Long_From02 2507 0.93 1.35 0.75 159 URI_TRY_3LD 2418 0.99 1.61 0.72 160 TR_XM_Base64_M1 2412 0.77 0.87 0.72 161 T_XMDrugObfuBody_00 2391 1.11 2.04 0.71 162 RELAYCOUNTRY_CA 2364 2.27 5.94 0.71 163 SpammyFromTLD_01 2359 1.01 1.74 0.71 164 XM_B_COPY_HTML 2339 0.82 1.10 0.70 165 HTTPS_HTTP_MISMATCH 2333 0.80 1.03 0.70 166 T_XMHurry_00 2234 1.03 1.88 0.67 167 XM_B_SpammyWords4 2224 1.32 2.87 0.66 168 XMPhish30 2223 0.88 1.37 0.66 169 RELAYCOUNTRY_AU 2203 1.36 3.02 0.66 170 RELAYCOUNTRY_GB 2130 0.71 0.90 0.64 171 XMGappySubj_02 2101 0.46 0.05 0.63 172 XMBdyGiftCard01 2095 0.92 1.59 0.63 173 XMLngstWrd_00 2060 0.55 0.40 0.62 174 TO_NO_BRKTS_HTML_ONLY 1999 0.51 0.29 0.60 175 MPART_ALT_DIFF_COUNT 1980 0.84 1.42 0.59 176 RCVD_IN_PSBL 1938 0.71 1.02 0.58 177 XMNoVowels 1903 0.53 0.43 0.57 178 MSGID_FROM_MTA_HEADER 1887 0.50 0.35 0.56 179 XMSlimDrugH 1853 0.60 0.72 0.55 180 XMBSHREFv2 1851 0.49 0.35 0.55 181 XMPhish14 1848 0.62 0.77 0.55 182 HTML_IMAGE_ONLY_20 1822 0.68 1.01 0.54 183 LongTLD 1811 0.65 0.92 0.54 184 FROM_GOV_DKIM_AU 1782 0.45 0.25 0.53 185 TR_XM_SpammyWords3 1735 1.24 2.93 0.52 186 FORGED_GMAIL_RCVD 1733 0.65 0.96 0.52 187 XMMoneyMeta_00 1708 0.56 0.69 0.51 188 HTML_TAG_BALANCE_BODY 1660 0.59 0.80 0.50 189 RCVD_IN_BL_SPAMCOP_NET 1611 2.92 8.65 0.48 190 HTML_IMAGE_ONLY_32 1596 0.38 0.15 0.48 191 NML_ADSP_CUSTOM_MED 1583 0.58 0.84 0.47 192 XM_B_DNDMA 1578 0.62 0.95 0.47 193 XMDateMe_00 1552 0.54 0.71 0.46 194 XM_B_Phish66 1510 0.73 1.37 0.45 195 XMBody_95 1469 0.37 0.19 0.44 196 T_MANY_PILL_PRICE 1458 0.31 0.01 0.44 197 HTML_IMAGE_ONLY_28 1439 0.41 0.38 0.43 198 THIS_AD 1408 0.73 1.45 0.42 199 FILL_THIS_FORM 1394 0.38 0.28 0.42 200 XM_B_FormFill 1392 0.29 0.01 0.42 ----------------------------------------------------------------------