Email: 489274 Autolearn: 0 AvgScore: 5.28 AvgScanTime: 1.32 sec Spam: 154410 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 1.47 sec Ham: 334864 Autolearn: 0 AvgScore: 1.06 AvgScanTime: 1.26 sec Time Spent Running SA: 179.96 hours Time Spent Processing Spam: 63.04 hours Time Spent Processing Ham: 116.92 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146698 90.82 95.01 88.89 2 DKIM_SIGNED 127285 74.64 82.43 71.05 3 XM_B_Unicode 122964 72.55 79.63 69.28 4 RELAYCOUNTRY_US 120974 78.80 78.35 79.01 5 XM_DK_Pass 118831 72.25 76.96 70.08 6 DKIM_VALID 117717 71.30 76.24 69.02 7 DCC_CHECK 109565 50.50 70.96 41.07 8 XM_B_SpammyWords 97659 48.97 63.25 42.38 9 XMListUnsubscribeExists 93190 49.49 60.35 44.49 10 DKIM_VALID_AU 92303 57.58 59.78 56.57 11 XM_B_Unicode3 73161 41.96 47.38 39.46 12 LOC_TINY_FONT_1 66183 31.70 42.86 26.56 13 BAYES_50 61130 54.58 39.59 61.49 14 XM_DK_Undo_02 56049 14.39 36.30 4.29 15 XM_B_SpammyWords2 55596 23.42 36.01 17.62 16 HTML_FONT_LOW_CONTRAST 51989 28.35 33.67 25.89 17 FVGT_m_MULTI_ODD 48982 25.90 31.72 23.22 18 MIME_HTML_ONLY 46173 21.82 29.90 18.09 19 DKIM_VALID_EF 44138 28.89 28.58 29.03 20 BAYES_99 42873 10.79 27.77 2.96 21 DCC_CHECK_NEGATIVE 42608 49.01 27.59 58.88 22 XMSubLong 42476 24.29 27.51 22.81 23 T_KAM_HTML_FONT_INVALID 41344 24.39 26.78 23.28 24 TR_XM_DKIM_Undo 40079 9.27 25.96 1.58 25 T_TM2_M_HEADER_IN_MSG 35158 26.72 22.77 28.55 26 BAYES_999 32691 8.16 21.17 2.17 27 XM_Multi_Part_URI 32005 15.33 20.73 12.84 28 RCVD_IN_MSPIKE_H2 31283 17.64 20.26 16.43 29 TR_XM_DK_Unsub 31048 14.59 20.11 12.05 30 TR_DCC_Bayes_99 28735 6.68 18.61 1.18 31 XM_B_Unsub 28347 11.84 18.36 8.84 32 TR_XM_BayesUnsub 27119 10.26 17.56 6.90 33 UNPARSEABLE_RELAY 25928 13.08 16.79 11.37 34 TR_MAX_INTL_RELAY 25711 8.88 16.65 5.30 35 RELAYCOUNTRY_META 25576 7.40 16.56 3.18 36 BOTNET_IPINHOSTNAME 23262 7.42 15.07 3.90 37 FSL_BULK_SIG 21703 10.41 14.06 8.72 38 XM_B_SpammyWords3 21230 7.47 13.75 4.58 39 BOTNET 21119 5.69 13.68 2.01 40 LOTS_OF_MONEY 18878 8.15 12.23 6.27 41 TR_XM_SpammyRelay 18797 4.96 12.17 1.64 42 TR_XM_SpammyWords4 17128 6.33 11.09 4.13 43 BAYES_80 16263 5.59 10.53 3.31 44 RCVD_IN_BL_SPAMCOP_NET 15698 3.61 10.17 0.58 45 XM_Evil_Numbers_Gen 14853 8.86 9.62 8.51 46 XM_UncommonTLD01 14627 5.70 9.47 3.96 47 TR_XM_SpammyWords2 13665 3.03 8.85 0.35 48 BAYES_60 13602 7.20 8.81 6.45 49 TR_XM_UnparsRelay 13318 3.65 8.63 1.36 50 RCVD_IN_MSPIKE_WL 13303 13.09 8.62 15.16 51 XM_B_Phish_Phrases 12993 6.09 8.41 5.02 52 MPART_ALT_DIFF 12628 7.94 8.18 7.83 53 HTML_IMAGE_RATIO_04 11063 5.96 7.16 5.41 54 LotsOfNums_01 10738 7.25 6.95 7.39 55 XM_Body_Dirty_Words 9814 3.57 6.36 2.28 56 DKIM_INVALID 9568 3.34 6.20 2.02 57 ALL_TRUSTED 9482 14.37 6.14 18.17 58 UNTRUSTED_Relay 9209 2.99 5.96 1.62 59 RELAYCOUNTRY_CA 9172 2.30 5.94 0.61 60 XM_B_PhoneNumber 8976 8.24 5.81 9.35 61 XMSubMetaSx_00 8747 3.71 5.66 2.81 62 HTML_IMAGE_RATIO_02 8584 4.62 5.56 4.19 63 BAYES_95 8578 3.12 5.56 1.99 64 TR_XM_SPAMCOP 8438 1.85 5.46 0.18 65 MIME_HTML_MOSTLY 8167 4.52 5.29 4.17 66 XM_H_Long_From01 7904 5.40 5.12 5.54 67 DKIM_ADSP_NXDOMAIN 7887 2.97 5.11 1.99 68 RCVD_IN_MSPIKE_H3 7639 6.90 4.95 7.79 69 XM_H_GMP 7614 5.37 4.93 5.58 70 ANY_BOUNCE_MESSAGE 7499 5.09 4.86 5.20 71 BOUNCE_MESSAGE 7499 5.09 4.86 5.19 72 FROM_EXCESS_BASE64 7273 2.64 4.71 1.69 73 TR_XM_PhishingBody 6979 2.58 4.52 1.69 74 XMNumbers 6768 3.43 4.38 2.99 75 XMStrtUSub 6759 5.26 4.38 5.67 76 XM_B_Investor 6724 2.59 4.35 1.78 77 TR_XM_SpammyWords5 6461 2.48 4.18 1.69 78 RCVD_IN_MSPIKE_BL 6367 1.98 4.12 1.00 79 TR_XM_MSPIKECOMBO 6367 1.98 4.12 1.00 80 XM_B_SpammyTLD 6221 3.15 4.03 2.74 81 T_XMDrugObfuBody_14 6207 2.52 4.02 1.82 82 HTML_FONT_FACE_BAD 6189 2.60 4.01 1.95 83 TR_Symld_Words 6038 2.22 3.91 1.44 84 XM_B_Unsub2 6008 2.40 3.89 1.72 85 TooManyTo_001 5821 6.30 3.77 7.47 86 XMSexyCombo_05 5799 1.77 3.76 0.85 87 HTML_IMAGE_RATIO_06 5751 3.31 3.72 3.12 88 XMDiploma_00 5315 2.26 3.44 1.72 89 XM_OfRef6 5301 1.71 3.43 0.92 90 MIME_QP_LONG_LINE 5215 4.50 3.38 5.02 91 DATE_IN_PAST_12_24 5120 1.27 3.32 0.33 92 TM2_M_VERY_LONG_WORD 5056 2.02 3.27 1.45 93 XM_URI_RBL 4931 1.23 3.19 0.32 94 T_HTML_ATTACH 4783 1.46 3.10 0.71 95 TR_XM_NoHeaderRelay 4624 1.07 2.99 0.18 96 TR_XM_INV_DKIM 4593 0.95 2.97 0.02 97 TR_XM_SpammyWords3 4589 1.30 2.97 0.52 98 TR_XM_HtmlAttach 4560 1.38 2.95 0.66 99 T_OBFU_HTML_ATTACH 4560 1.38 2.95 0.66 100 T_XMDrugObfuBody_08 4548 1.85 2.95 1.35 101 HTML_IMAGE_RATIO_08 4505 2.61 2.92 2.47 102 MIME_HTML_ONLY_MULTI 4492 2.51 2.91 2.33 103 XM_CamelCaseFrm001 4479 2.08 2.90 1.70 104 RELAYCOUNTRY_AU 4207 1.15 2.72 0.43 105 XM_B_URI_Unicode 4185 2.44 2.71 2.32 106 XM_SPF_SoftFail 4153 1.79 2.69 1.37 107 USER_IN_DEF_DKIM_WL 4126 9.53 2.67 12.70 108 RCVD_IN_MSPIKE_L3 3983 1.46 2.58 0.94 109 T_TooManySym_01 3929 4.28 2.54 5.09 110 XMBody_17 3780 1.05 2.45 0.41 111 BAYES_40 3769 4.51 2.44 5.46 112 XMStockSpam_06 3679 3.26 2.38 3.67 113 XM_UB50 3614 1.46 2.34 1.06 114 XM_B_SpammyWords4 3478 1.41 2.25 1.03 115 TM2_M_URI_OPT_OUT 3422 1.97 2.22 1.86 116 MAILING_LIST_MULTI 3402 2.76 2.20 3.02 117 RCVD_IN_VALIDITY_SAFE 3340 3.20 2.16 3.68 118 SpammyFromTLD_02 3245 0.98 2.10 0.46 119 RCVD_IN_MSPIKE_H4 3118 2.68 2.02 2.98 120 XMGenDplmaNmb 3099 1.26 2.01 0.92 121 SUBJ_ALL_CAPS 3096 1.57 2.01 1.37 122 XM_H_Long_From02 3017 1.15 1.95 0.78 123 XMBrknScrpt_02 2997 1.24 1.94 0.92 124 RCVD_IN_VALIDITY_CERTIFIED 2977 2.82 1.93 3.23 125 SpammyFromTLD_01 2893 1.09 1.87 0.73 126 T_FILL_THIS_FORM_SHORT 2793 1.16 1.81 0.86 127 XM_DK_Undo_01 2765 1.89 1.79 1.93 128 RCVD_IN_VALIDITY_RPBL 2762 0.60 1.79 0.05 129 T_XMDrugObfuBody_00 2603 0.99 1.69 0.67 130 TR_Mismatch_TLD_02 2573 0.58 1.67 0.08 131 RCVD_IN_MSPIKE_H5 2546 3.52 1.65 4.38 132 HK_RANDOM_REPLYTO 2542 0.60 1.65 0.12 133 BAYES_20 2533 3.14 1.64 3.83 134 PDS_FROM_NAME_TO_DOMAIN 2529 0.60 1.64 0.12 135 PDS_FRNOM_TODOM_NAKED_TO 2529 0.60 1.64 0.12 136 HTML_IMAGE_ONLY_20 2454 0.85 1.59 0.51 137 HTML_MIME_NO_HTML_TAG 2433 2.31 1.58 2.65 138 RCVD_IN_IADB_LISTED 2404 2.69 1.56 3.21 139 XM_SendGrid 2384 1.55 1.54 1.55 140 TR_XM_INTL_Spamhaus 2368 0.60 1.53 0.17 141 XM_B_Phish66 2255 0.73 1.46 0.39 142 XMPhish30 2254 0.93 1.46 0.69 143 TR_XM_MSPIKECOMBO2 2237 0.50 1.45 0.07 144 XM_ProductURIs 2229 2.61 1.44 3.14 145 RCVD_IN_ZEN_LASTEXTERNAL 2209 0.45 1.43 0.00 146 SHORTCIRCUIT 2209 0.45 1.43 0.00 147 T_REMOTE_IMAGE 2178 2.90 1.41 3.59 148 RCVD_IN_IADB_SPF 2162 2.38 1.40 2.83 149 BAYES_00 2152 8.74 1.39 12.13 150 XMBdyGiftCard01 2133 0.70 1.38 0.39 151 XM_B_SEO 2067 0.55 1.34 0.18 152 T_XMHurry_00 2050 0.79 1.33 0.54 153 RCVD_IN_IADB_DK 2046 2.11 1.33 2.47 154 URI_TRY_3LD 2035 0.80 1.32 0.56 155 KHOP_HELO_FCRDNS 2035 2.14 1.32 2.52 156 RCVD_IN_IADB_SENDERID 1994 2.15 1.29 2.55 157 XM_B_COPY_HTML 1969 0.94 1.28 0.79 158 URI_HEX 1902 1.20 1.23 1.18 159 URI_NOVOWEL 1888 1.31 1.22 1.35 160 BOTNET_NORDNS 1818 0.37 1.18 0.00 161 HTML_FONT_TINY_NORDNS 1757 0.43 1.14 0.10 162 RCVD_IN_MSPIKE_L4 1749 0.39 1.13 0.05 163 XM_HighProb1 1718 0.35 1.11 0.00 164 RCVD_IN_PBL 1704 0.84 1.10 0.72 165 XM_B_COVIDMETA 1690 0.42 1.09 0.11 166 XM_GoogleGroups 1671 1.27 1.08 1.35 167 DIET_1 1657 0.53 1.07 0.28 168 HTTPS_HTTP_MISMATCH 1634 0.83 1.06 0.73 169 TR_LOTS_OF_MONEY2 1623 0.59 1.05 0.38 170 T_MONEY_PERCENT 1623 0.59 1.05 0.38 171 RELAYCOUNTRY_FR 1620 0.58 1.05 0.37 172 XMSubMetaI_00 1613 0.63 1.04 0.44 173 RDNS_DYNAMIC 1605 0.43 1.04 0.15 174 TR_XM_MaxSPIKE 1594 0.37 1.03 0.07 175 TM2_M_OBFU_COMMENT 1589 0.54 1.03 0.32 176 THIS_AD 1586 0.53 1.03 0.30 177 XM_H_Undi_Recip 1585 0.46 1.03 0.20 178 TR_XM_SEO4 1583 0.39 1.03 0.10 179 TR_XM_GMP_BULK_SIG 1582 0.56 1.02 0.35 180 XMBody_78 1575 0.60 1.02 0.41 181 XM_B_DNDMA 1569 0.60 1.02 0.41 182 PDS_RDNS_DYNAMIC_FP 1562 0.34 1.01 0.04 183 XM_UB99 1554 0.32 1.01 0.00 184 TR_XM_RelayPhish 1542 0.39 1.00 0.10 185 MultiRelay_CC 1537 0.40 1.00 0.13 186 RCVD_IN_XBL 1522 0.32 0.99 0.01 187 MPART_ALT_DIFF_COUNT 1519 0.74 0.98 0.63 188 RCVD_IN_PSBL 1514 0.71 0.98 0.58 189 TVD_RCVD_IP 1501 1.14 0.97 1.22 190 LongTLD 1499 0.63 0.97 0.48 191 TR_XM_PHPDW 1494 0.50 0.97 0.29 192 TR_XM_PHPForged 1487 0.50 0.96 0.28 193 STY_INVIS_DIRECT 1485 0.48 0.96 0.26 194 TR_XM_FormFill2 1469 0.49 0.95 0.28 195 URIBL_SBL_A 1457 0.30 0.94 0.00 196 URIBL_SBL 1457 0.30 0.94 0.00 197 XM_UB80 1451 0.30 0.94 0.01 198 RELAYCOUNTRY_IN 1446 0.32 0.94 0.04 199 XM_H_PHPOS 1441 0.48 0.93 0.27 200 SH_BODYURI_REVERSE_SBL 1437 0.30 0.93 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297668 90.82 95.01 88.89 2 RELAYCOUNTRY_US 264582 78.80 78.35 79.01 3 DKIM_SIGNED 237916 74.64 82.43 71.05 4 XM_DK_Pass 234671 72.25 76.96 70.08 5 XM_B_Unicode 231999 72.55 79.63 69.28 6 DKIM_VALID 231137 71.30 76.24 69.02 7 BAYES_50 205901 54.58 39.59 61.49 8 DCC_CHECK_NEGATIVE 197174 49.01 27.59 58.88 9 DKIM_VALID_AU 189416 57.58 59.78 56.57 10 XMListUnsubscribeExists 148970 49.49 60.35 44.49 11 XM_B_SpammyWords 141917 48.97 63.25 42.38 12 DCC_CHECK 137535 50.50 70.96 41.07 13 XM_B_Unicode3 132139 41.96 47.38 39.46 14 DKIM_VALID_EF 97204 28.89 28.58 29.03 15 T_TM2_M_HEADER_IN_MSG 95589 26.72 22.77 28.55 16 LOC_TINY_FONT_1 88939 31.70 42.86 26.56 17 HTML_FONT_LOW_CONTRAST 86699 28.35 33.67 25.89 18 T_KAM_HTML_FONT_INVALID 77969 24.39 26.78 23.28 19 FVGT_m_MULTI_ODD 77739 25.90 31.72 23.22 20 XMSubLong 76376 24.29 27.51 22.81 21 ALL_TRUSTED 60835 14.37 6.14 18.17 22 MIME_HTML_ONLY 60592 21.82 29.90 18.09 23 XM_B_SpammyWords2 59014 23.42 36.01 17.62 24 RCVD_IN_MSPIKE_H2 55031 17.64 20.26 16.43 25 RCVD_IN_MSPIKE_WL 50753 13.09 8.62 15.16 26 XM_Multi_Part_URI 42985 15.33 20.73 12.84 27 USER_IN_DEF_DKIM_WL 42524 9.53 2.67 12.70 28 BAYES_00 40616 8.74 1.39 12.13 29 TR_XM_DK_Unsub 40355 14.59 20.11 12.05 30 UNPARSEABLE_RELAY 38087 13.08 16.79 11.37 31 XM_B_PhoneNumber 31318 8.24 5.81 9.35 32 XM_B_Unsub 29592 11.84 18.36 8.84 33 FSL_BULK_SIG 29206 10.41 14.06 8.72 34 XM_Evil_Numbers_Gen 28503 8.86 9.62 8.51 35 MPART_ALT_DIFF 26230 7.94 8.18 7.83 36 RCVD_IN_MSPIKE_H3 26097 6.90 4.95 7.79 37 TooManyTo_001 25010 6.30 3.77 7.47 38 LotsOfNums_01 24732 7.25 6.95 7.39 39 TR_XM_DK_Bayes 23722 5.05 0.64 7.08 40 TR_XM_DK_Bayes1 23328 4.97 0.64 6.97 41 TR_XM_BayesUnsub 23098 10.26 17.56 6.90 42 XM_DKIMWhitelistDomains 22328 4.57 0.03 6.67 43 BAYES_60 21602 7.20 8.81 6.45 44 LOTS_OF_MONEY 21011 8.15 12.23 6.27 45 TR_XM_DK_Bayes2 19826 4.17 0.38 5.92 46 XMStrtUSub 18992 5.26 4.38 5.67 47 XM_H_GMP 18672 5.37 4.93 5.58 48 XM_H_Long_From01 18538 5.40 5.12 5.54 49 BAYES_40 18276 4.51 2.44 5.46 50 HTML_IMAGE_RATIO_04 18111 5.96 7.16 5.41 51 TR_MAX_INTL_RELAY 17753 8.88 16.65 5.30 52 ANY_BOUNCE_MESSAGE 17397 5.09 4.86 5.20 53 BOUNCE_MESSAGE 17394 5.09 4.86 5.19 54 T_TooManySym_01 17034 4.28 2.54 5.09 55 MIME_QP_LONG_LINE 16823 4.50 3.38 5.02 56 XM_B_Phish_Phrases 16815 6.09 8.41 5.02 57 XM_B_SpammyWords3 15341 7.47 13.75 4.58 58 RCVD_IN_MSPIKE_H5 14679 3.52 1.65 4.38 59 XM_PDF 14585 3.26 0.90 4.36 60 XM_DK_Undo_02 14365 14.39 36.30 4.29 61 HTML_IMAGE_RATIO_02 14022 4.62 5.56 4.19 62 MIME_HTML_MOSTLY 13962 4.52 5.29 4.17 63 TR_XM_SpammyWords4 13844 6.33 11.09 4.13 64 XM_UncommonTLD01 13255 5.70 9.47 3.96 65 BOTNET_IPINHOSTNAME 13044 7.42 15.07 3.90 66 BAYES_20 12823 3.14 1.64 3.83 67 RCVD_IN_VALIDITY_SAFE 12325 3.20 2.16 3.68 68 XMStockSpam_06 12287 3.26 2.38 3.67 69 XM_ShortIntro_01 12182 2.70 0.67 3.64 70 T_REMOTE_IMAGE 12012 2.90 1.41 3.59 71 BAYES_80 11089 5.59 10.53 3.31 72 RCVD_IN_VALIDITY_CERTIFIED 10804 2.82 1.93 3.23 73 RCVD_IN_IADB_LISTED 10736 2.69 1.56 3.21 74 RELAYCOUNTRY_META 10638 7.40 16.56 3.18 75 XM_ProductURIs 10520 2.61 1.44 3.14 76 HTML_IMAGE_RATIO_06 10464 3.31 3.72 3.12 77 MAILING_LIST_MULTI 10109 2.76 2.20 3.02 78 XMNumbers 9999 3.43 4.38 2.99 79 RCVD_IN_MSPIKE_H4 9977 2.68 2.02 2.98 80 BAYES_99 9920 10.79 27.77 2.96 81 T_TooManySym_02 9752 2.20 0.67 2.91 82 RCVD_IN_IADB_SPF 9470 2.38 1.40 2.83 83 XMSubMetaSx_00 9413 3.71 5.66 2.81 84 XM_B_SpammyTLD 9172 3.15 4.03 2.74 85 URI_TRUNCATED 8984 1.92 0.27 2.68 86 HTML_MIME_NO_HTML_TAG 8866 2.31 1.58 2.65 87 RCVD_IN_IADB_SENDERID 8529 2.15 1.29 2.55 88 KHOP_HELO_FCRDNS 8444 2.14 1.32 2.52 89 RCVD_IN_IADB_DK 8271 2.11 1.33 2.47 90 HTML_IMAGE_RATIO_08 8265 2.61 2.92 2.47 91 TooManyTo_002 7979 1.88 0.78 2.38 92 BAYES_05 7971 1.89 0.84 2.38 93 MIME_HTML_ONLY_MULTI 7791 2.51 2.91 2.33 94 XM_B_URI_Unicode 7762 2.44 2.71 2.32 95 INVALID_MSGID 7700 1.68 0.33 2.30 96 XM_Body_Dirty_Words 7644 3.57 6.36 2.28 97 BAYES_999 7251 8.16 21.17 2.17 98 RCVD_IN_IADB_VOUCHED 7105 1.69 0.76 2.12 99 MSGID_NOFQDN1 6810 1.43 0.12 2.03 100 DKIM_INVALID 6779 3.34 6.20 2.02 101 BOTNET 6729 5.69 13.68 2.01 102 MAY_BE_FORGED 6663 1.42 0.19 1.99 103 BAYES_95 6663 3.12 5.56 1.99 104 DKIM_ADSP_NXDOMAIN 6660 2.97 5.11 1.99 105 HTML_FONT_FACE_BAD 6526 2.60 4.01 1.95 106 XM_DK_Undo_01 6460 1.89 1.79 1.93 107 TO_MALFORMED 6329 1.30 0.02 1.89 108 TM2_M_URI_OPT_OUT 6236 1.97 2.22 1.86 109 HTML_SHORT_CENTER 6132 1.31 0.18 1.83 110 T_XMDrugObfuBody_14 6105 2.52 4.02 1.82 111 XM_B_Investor 5949 2.59 4.35 1.78 112 XM_B_Unsub2 5748 2.40 3.89 1.72 113 XMDiploma_00 5744 2.26 3.44 1.72 114 XM_CamelCaseFrm001 5682 2.08 2.90 1.70 115 TR_XM_SpammyWords5 5652 2.48 4.18 1.69 116 FROM_EXCESS_BASE64 5647 2.64 4.71 1.69 117 TR_XM_PhishingBody 5643 2.58 4.52 1.69 118 TR_XM_SpammyRelay 5486 4.96 12.17 1.64 119 UNTRUSTED_Relay 5416 2.99 5.96 1.62 120 TR_XM_DKIM_Undo 5275 9.27 25.96 1.58 121 XM_SendGrid 5183 1.55 1.54 1.55 122 TooManyTo_003 4972 1.24 0.70 1.48 123 TM2_M_VERY_LONG_WORD 4840 2.02 3.27 1.45 124 TR_Symld_Words 4835 2.22 3.91 1.44 125 RCVD_IN_IADB_OPTIN 4808 1.14 0.49 1.44 126 HELO_NODOT 4732 1.01 0.13 1.41 127 HELO_NO_DOMAIN 4724 1.01 0.13 1.41 128 XM_SPF_SoftFail 4582 1.79 2.69 1.37 129 SUBJ_ALL_CAPS 4579 1.57 2.01 1.37 130 TR_XM_UnparsRelay 4561 3.65 8.63 1.36 131 XM_GoogleGroups 4535 1.27 1.08 1.35 132 T_XMDrugObfuBody_08 4525 1.85 2.95 1.35 133 URI_NOVOWEL 4511 1.31 1.22 1.35 134 IN_HORDE_ADDRESS_BOOK 4116 0.87 0.08 1.23 135 TVD_RCVD_IP 4078 1.14 0.97 1.22 136 XMGappySubj_01 3980 0.90 0.26 1.19 137 URI_HEX 3966 1.20 1.23 1.18 138 TR_DCC_Bayes_99 3943 6.68 18.61 1.18 139 XMCapTrack 3874 0.94 0.46 1.16 140 T_TooManySym_03 3837 0.85 0.22 1.15 141 TooManyTo_004 3807 0.96 0.57 1.14 142 XM_UB50 3536 1.46 2.34 1.06 143 XM_B_SpammyWords4 3437 1.41 2.25 1.03 144 RCVD_IN_MSPIKE_BL 3345 1.98 4.12 1.00 145 TR_XM_MSPIKECOMBO 3345 1.98 4.12 1.00 146 TR_XM_DK_SendGrid 3200 0.88 0.71 0.96 147 TVD_SPACE_RATIO 3173 0.68 0.10 0.95 148 RCVD_IN_MSPIKE_L3 3143 1.46 2.58 0.94 149 TooManyTo_005 3093 0.78 0.47 0.92 150 XMBrknScrpt_02 3090 1.24 1.94 0.92 151 T_Symld_Words_02 3090 0.85 0.70 0.92 152 XMGenDplmaNmb 3076 1.26 2.01 0.92 153 XM_OfRef6 3070 1.71 3.43 0.92 154 XMSubNoVowel 2914 0.76 0.53 0.87 155 T_FILL_THIS_FORM_SHORT 2866 1.16 1.81 0.86 156 XMSexyCombo_05 2839 1.77 3.76 0.85 157 XM_B_COPY_HTML 2630 0.94 1.28 0.79 158 XM_H_Long_From02 2626 1.15 1.95 0.78 159 TR_XM_Base64_M1 2616 0.77 0.75 0.78 160 FROM_GOV_DKIM_AU 2523 0.64 0.41 0.75 161 HTTPS_HTTP_MISMATCH 2442 0.83 1.06 0.73 162 SpammyFromTLD_01 2440 1.09 1.87 0.73 163 DKIM_ADSP_CUSTOM_MED 2436 0.78 0.90 0.73 164 T_OBFU_PDF_ATTACH 2420 0.58 0.26 0.72 165 RCVD_IN_PBL 2415 0.84 1.10 0.72 166 XM_H_PHPMailer 2372 0.63 0.45 0.71 167 T_HTML_ATTACH 2367 1.46 3.10 0.71 168 XMPhish30 2308 0.93 1.46 0.69 169 TR_MetaPhish_Combo_01 2268 0.73 0.84 0.68 170 T_XMDrugObfuBody_00 2248 0.99 1.69 0.67 171 T_TVD_MIME_NO_HEADERS 2211 0.46 0.03 0.66 172 T_OBFU_HTML_ATTACH 2199 1.38 2.95 0.66 173 TR_XM_HtmlAttach 2194 1.38 2.95 0.66 174 XMNoVowels 2154 0.68 0.77 0.64 175 XMGappySubj_02 2138 0.45 0.04 0.64 176 MPART_ALT_DIFF_COUNT 2098 0.74 0.98 0.63 177 RELAYCOUNTRY_CA 2059 2.30 5.94 0.61 178 RELAYCOUNTRY_GB 2048 0.70 0.88 0.61 179 RCVD_IN_BL_SPAMCOP_NET 1957 3.61 10.17 0.58 180 RCVD_IN_PSBL 1950 0.71 0.98 0.58 181 URI_TRY_3LD 1871 0.80 1.32 0.56 182 XMBSHREFv2 1820 0.52 0.46 0.54 183 XMLngstWrd_00 1799 0.57 0.64 0.54 184 T_XMHurry_00 1799 0.79 1.33 0.54 185 HTML_IMAGE_ONLY_32 1770 0.42 0.19 0.53 186 TR_XM_SpammyWords3 1750 1.30 2.97 0.52 187 TO_NO_BRKTS_HTML_ONLY 1725 0.41 0.17 0.52 188 HTML_IMAGE_ONLY_20 1723 0.85 1.59 0.51 189 XMSlimDrugH 1683 0.57 0.70 0.50 190 HTML_TAG_BALANCE_BODY 1662 0.56 0.70 0.50 191 MSGID_FROM_MTA_HEADER 1632 0.43 0.29 0.49 192 LongTLD 1601 0.63 0.97 0.48 193 TRACKER_ID 1539 0.35 0.10 0.46 194 SpammyFromTLD_02 1534 0.98 2.10 0.46 195 TR_XM_GMP_MSPIKE_UNDO2 1515 0.37 0.18 0.45 196 NML_ADSP_CUSTOM_MED 1493 0.52 0.68 0.45 197 XMDateMe_00 1467 0.45 0.48 0.44 198 XMSubMetaI_00 1461 0.63 1.04 0.44 199 T_MANY_PILL_PRICE 1459 0.30 0.00 0.44 200 RELAYCOUNTRY_AU 1433 1.15 2.72 0.43 ----------------------------------------------------------------------