Email: 481897 Autolearn: 0 AvgScore: 5.41 AvgScanTime: 1.35 sec Spam: 148816 Autolearn: 0 AvgScore: 14.87 AvgScanTime: 1.52 sec Ham: 333081 Autolearn: 0 AvgScore: 1.18 AvgScanTime: 1.28 sec Time Spent Running SA: 181.08 hours Time Spent Processing Spam: 63.03 hours Time Spent Processing Ham: 118.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141046 89.88 94.78 87.69 2 DKIM_SIGNED 132821 80.33 89.25 76.34 3 XM_DK_Pass 125757 78.14 84.51 75.29 4 XM_B_Unicode 125635 75.43 84.42 71.41 5 DKIM_VALID 124824 77.23 83.88 74.26 6 RELAYCOUNTRY_US 120059 80.36 80.68 80.22 7 DCC_CHECK 111562 52.66 74.97 42.69 8 XM_B_SpammyWords 103127 52.47 69.30 44.95 9 XMListUnsubscribeExists 98622 55.08 66.27 50.08 10 DKIM_VALID_AU 96589 62.07 64.90 60.81 11 XM_B_Unicode3 74092 44.11 49.79 41.58 12 LOC_TINY_FONT_1 70998 34.50 47.71 28.60 13 BAYES_50 60272 53.64 40.50 59.51 14 XM_B_SpammyWords2 58663 24.92 39.42 18.44 15 XM_DK_Undo_02 58034 15.11 39.00 4.43 16 HTML_FONT_LOW_CONTRAST 53407 30.42 35.89 27.98 17 FVGT_m_MULTI_ODD 49581 28.45 33.32 26.28 18 DKIM_VALID_EF 46542 30.67 31.27 30.39 19 MIME_HTML_ONLY 44773 22.43 30.09 19.01 20 BAYES_99 44274 11.36 29.75 3.14 21 T_KAM_HTML_FONT_INVALID 44053 24.82 29.60 22.68 22 TR_XM_DKIM_Undo 42395 9.98 28.49 1.72 23 XMSubLong 37286 23.83 25.06 23.28 24 DCC_CHECK_NEGATIVE 35112 46.86 23.59 57.25 25 BAYES_999 33578 8.55 22.56 2.29 26 T_TM2_M_HEADER_IN_MSG 33096 27.20 22.24 29.42 27 TR_XM_DK_Unsub 32742 16.67 22.00 14.29 28 XM_Multi_Part_URI 31962 15.95 21.48 13.48 29 TR_DCC_Bayes_99 30411 7.19 20.44 1.27 30 XM_B_Unsub 28792 11.83 19.35 8.48 31 TR_XM_BayesUnsub 27705 10.35 18.62 6.66 32 RELAYCOUNTRY_META 27265 8.34 18.32 3.89 33 RCVD_IN_MSPIKE_H2 26738 16.66 17.97 16.08 34 UNPARSEABLE_RELAY 26493 13.66 17.80 11.81 35 TR_MAX_INTL_RELAY 23567 9.25 15.84 6.30 36 XM_B_SpammyWords3 22616 8.25 15.20 5.15 37 BOTNET_IPINHOSTNAME 19046 6.11 12.80 3.11 38 TR_XM_SpammyRelay 18925 5.16 12.72 1.78 39 LOTS_OF_MONEY 18062 8.01 12.14 6.16 40 FSL_BULK_SIG 17636 10.20 11.85 9.46 41 BOTNET 16997 4.35 11.42 1.18 42 TR_XM_SpammyWords4 16210 6.21 10.89 4.11 43 XM_Evil_Numbers_Gen 14954 9.92 10.05 9.86 44 BAYES_80 14480 5.77 9.73 4.01 45 TR_XM_UnparsRelay 14456 4.15 9.71 1.66 46 TR_XM_SpammyWords2 14186 3.27 9.53 0.47 47 RCVD_IN_MSPIKE_WL 13999 14.76 9.41 17.16 48 XM_B_Phish_Phrases 13368 6.90 8.98 5.98 49 BAYES_60 12473 8.00 8.38 7.83 50 RCVD_IN_BL_SPAMCOP_NET 12223 2.88 8.21 0.50 51 LotsOfNums_01 11112 7.93 7.47 8.14 52 UNTRUSTED_Relay 10326 3.43 6.94 1.86 53 RELAYCOUNTRY_CA 9943 2.55 6.68 0.70 54 XM_B_PhoneNumber 9867 9.16 6.63 10.30 55 HTML_IMAGE_RATIO_02 9727 4.99 6.54 4.30 56 MPART_ALT_DIFF 9641 5.33 6.48 4.82 57 XM_UncommonTLD01 9378 4.78 6.30 4.10 58 XM_Body_Dirty_Words 8950 3.80 6.01 2.82 59 XM_H_Long_From01 8756 5.86 5.88 5.85 60 TR_XM_MSPIKECOMBO 8674 2.68 5.83 1.28 61 RCVD_IN_MSPIKE_BL 8674 2.69 5.83 1.28 62 BAYES_95 8417 3.33 5.66 2.30 63 DKIM_INVALID 7997 3.10 5.37 2.08 64 RCVD_IN_MSPIKE_H3 7978 7.37 5.36 8.27 65 XMSubMetaSx_00 7900 4.02 5.31 3.45 66 XM_B_Investor 7565 2.75 5.08 1.71 67 TR_XM_PhishingBody 7202 2.63 4.84 1.64 68 XMStrtUSub 7053 5.11 4.74 5.28 69 XM_H_GMP 6691 5.32 4.50 5.68 70 HTML_IMAGE_RATIO_04 6653 4.56 4.47 4.61 71 TooManyTo_001 6611 7.53 4.44 8.91 72 TR_XM_SpammyWords3 6520 1.79 4.38 0.64 73 T_XMDrugObfuBody_14 6314 2.87 4.24 2.26 74 XMSexyCombo_05 5981 1.99 4.02 1.09 75 XMNumbers 5862 3.49 3.94 3.30 76 T_XMDrugObfuBody_08 5717 2.61 3.84 2.06 77 TM2_M_VERY_LONG_WORD 5639 2.20 3.79 1.49 78 TR_XM_SpammyWords5 5584 2.11 3.75 1.38 79 TR_XM_SPAMCOP 5522 1.24 3.71 0.14 80 HTML_IMAGE_RATIO_06 5377 3.58 3.61 3.56 81 XM_OfRef6 5251 1.64 3.53 0.79 82 HTML_IMAGE_RATIO_08 5190 2.70 3.49 2.35 83 XM_B_SpammyTLD 5183 2.81 3.48 2.50 84 MIME_HTML_ONLY_MULTI 5181 2.68 3.48 2.33 85 MIME_QP_LONG_LINE 5177 4.75 3.48 5.32 86 MIME_HTML_MOSTLY 5158 3.01 3.47 2.81 87 RCVD_IN_MSPIKE_L3 5112 1.83 3.44 1.11 88 XM_CamelCaseFrm001 5045 2.48 3.39 2.07 89 XM_URI_RBL 4983 1.24 3.35 0.30 90 XM_B_Unsub2 4887 1.98 3.28 1.40 91 RELAYCOUNTRY_AU 4874 1.42 3.28 0.60 92 TR_XM_NoHeaderRelay 4675 1.13 3.14 0.24 93 XM_SPF_SoftFail 4529 1.90 3.04 1.39 94 XMDiploma_00 4433 1.92 2.98 1.45 95 XM_UB50 4419 1.68 2.97 1.10 96 TM2_M_URI_OPT_OUT 4290 2.17 2.88 1.85 97 XM_B_SpammyWords4 4186 1.25 2.81 0.55 98 USER_IN_DEF_DKIM_WL 4158 9.46 2.79 12.44 99 XM_B_URI_Unicode 4047 2.19 2.72 1.95 100 T_TooManySym_01 3973 4.88 2.67 5.86 101 SpammyFromTLD_02 3687 1.15 2.48 0.56 102 TR_XM_INV_DKIM 3645 0.77 2.45 0.02 103 T_FILL_THIS_FORM_SHORT 3527 1.30 2.37 0.82 104 RCVD_IN_VALIDITY_SAFE 3522 3.44 2.37 3.92 105 RCVD_IN_VALIDITY_RPBL 3451 0.75 2.32 0.06 106 XM_H_Long_From02 3433 1.20 2.31 0.71 107 XMBody_17 3396 1.00 2.28 0.43 108 XMStockSpam_06 3215 1.51 2.16 1.22 109 MAILING_LIST_MULTI 3198 2.90 2.15 3.24 110 RCVD_IN_MSPIKE_H4 3184 2.98 2.14 3.35 111 HTML_MIME_NO_HTML_TAG 3178 3.03 2.14 3.43 112 HK_RANDOM_REPLYTO 3097 0.70 2.08 0.08 113 TR_XM_INTL_Spamhaus 3038 0.77 2.04 0.21 114 T_XMDrugObfuBody_00 3019 1.27 2.03 0.93 115 KHOP_HELO_FCRDNS 2983 1.63 2.00 1.46 116 RCVD_IN_VALIDITY_CERTIFIED 2954 2.87 1.99 3.27 117 TR_XM_MSPIKECOMBO2 2930 0.66 1.97 0.08 118 RCVD_IN_IADB_LISTED 2912 3.12 1.96 3.64 119 RCVD_IN_MSPIKE_H5 2837 4.42 1.91 5.54 120 XMBrknScrpt_02 2835 1.12 1.91 0.77 121 BAYES_40 2776 4.43 1.87 5.58 122 SUBJ_ALL_CAPS 2756 1.59 1.85 1.48 123 BOTNET_NORDNS 2696 0.56 1.81 0.01 124 T_REMOTE_IMAGE 2652 3.28 1.78 3.96 125 SpammyFromTLD_01 2651 1.09 1.78 0.78 126 RCVD_IN_IADB_SPF 2562 2.74 1.72 3.20 127 MultiRelay_CC 2534 0.64 1.70 0.17 128 XM_B_SEO 2516 0.66 1.69 0.20 129 FROM_EXCESS_BASE64 2506 1.69 1.68 1.69 130 ALL_TRUSTED 2436 11.85 1.64 16.42 131 RCVD_IN_PSBL 2427 0.85 1.63 0.50 132 RCVD_IN_IADB_DK 2404 2.43 1.62 2.79 133 URI_HEX 2403 1.43 1.61 1.34 134 XM_SendGrid 2397 1.48 1.61 1.42 135 RCVD_IN_IADB_SENDERID 2367 2.46 1.59 2.85 136 XM_HighProb1 2333 0.48 1.57 0.00 137 XMPhish30 2307 0.83 1.55 0.51 138 XMBdyGiftCard01 2266 0.61 1.52 0.21 139 T_XMHurry_00 2224 0.81 1.49 0.50 140 TR_XM_SEO4 2191 0.52 1.47 0.10 141 XMGenDplmaNmb 2187 0.99 1.47 0.77 142 XM_ProductURIs 2176 1.12 1.46 0.97 143 RCVD_IN_MSPIKE_L4 2155 0.54 1.45 0.13 144 XM_DK_Undo_01 2149 1.78 1.44 1.93 145 RCVD_IN_XBL 2135 0.46 1.43 0.02 146 SHORTCIRCUIT 2109 0.44 1.42 0.00 147 RCVD_IN_ZEN_LASTEXTERNAL 2109 0.44 1.42 0.00 148 XM_B_Phish66 2098 0.67 1.41 0.34 149 RCVD_IN_PBL 2032 0.94 1.37 0.74 150 TR_XM_MaxSPIKE 2003 0.45 1.35 0.05 151 XM_B_COVIDMETA 1995 0.50 1.34 0.13 152 RDNS_DYNAMIC 1981 0.52 1.33 0.16 153 HTTPS_HTTP_MISMATCH 1980 1.05 1.33 0.93 154 URI_NOVOWEL 1980 1.29 1.33 1.27 155 BAYES_20 1975 3.79 1.33 4.89 156 TR_Mismatch_TLD_02 1942 0.46 1.30 0.09 157 PDS_RDNS_DYNAMIC_FP 1933 0.42 1.30 0.03 158 ANY_BOUNCE_MESSAGE 1910 3.71 1.28 4.80 159 BOUNCE_MESSAGE 1909 3.71 1.28 4.80 160 TR_MetaPhish_Combo_01 1884 1.03 1.27 0.92 161 THIS_AD 1869 0.61 1.26 0.32 162 TR_LOTS_OF_MONEY3 1799 0.53 1.21 0.23 163 DIET_1 1793 0.56 1.20 0.26 164 MPART_ALT_DIFF_COUNT 1790 0.79 1.20 0.61 165 TVD_RCVD_IP 1783 0.98 1.20 0.89 166 XMSubMetaI_00 1778 0.68 1.19 0.45 167 XM_B_COPY_HTML 1768 1.08 1.19 1.03 168 TR_XM_RelayPhish 1751 0.42 1.18 0.08 169 URI_TRY_3LD 1748 0.67 1.17 0.45 170 RCVD_IN_SBL_CSS 1704 0.42 1.15 0.10 171 LongTLD 1693 0.66 1.14 0.45 172 XM_UB99 1667 0.35 1.12 0.00 173 TR_XM_DK_SendGrid 1649 1.01 1.11 0.97 174 HTML_FONT_TINY_NORDNS 1646 0.43 1.11 0.13 175 RELAYCOUNTRY_FR 1645 0.78 1.11 0.63 176 TR_Symld_Words 1625 1.44 1.09 1.60 177 STY_INVIS_DIRECT 1604 0.56 1.08 0.34 178 XMHTML_After_End 1582 0.60 1.06 0.39 179 TR_XM_PHPForged 1541 0.50 1.04 0.26 180 TR_XM_FormFill2 1525 0.50 1.02 0.26 181 TR_XM_PHPDW 1497 0.49 1.01 0.26 182 HELO_DYNAMIC_SPLIT_IP 1492 0.31 1.00 0.00 183 XMPhish14 1491 0.66 1.00 0.51 184 T_Symld_Words_02 1486 0.71 1.00 0.59 185 XM_UB60 1478 0.52 0.99 0.31 186 XM_H_PHPOS 1477 0.48 0.99 0.25 187 RCVD_IN_IADB_VOUCHED 1467 1.95 0.99 2.38 188 XMReplyNow 1437 0.47 0.97 0.24 189 DKIM_ADSP_NXDOMAIN 1419 0.51 0.95 0.31 190 RCVD_IN_MSPIKE_L5 1407 0.32 0.95 0.04 191 TR_XM_GMP_BULK_SIG 1407 0.41 0.95 0.17 192 HTML_TAG_BALANCE_BODY 1399 0.78 0.94 0.70 193 URIBL_SBL 1387 0.29 0.93 0.00 194 URIBL_SBL_A 1387 0.29 0.93 0.00 195 SH_BODYURI_REVERSE_SBL 1386 0.29 0.93 0.00 196 SHOPIFY_IMG_NOT_RCVD_SFY 1385 0.43 0.93 0.21 197 TR_XM_InvalidRelay 1383 0.30 0.93 0.01 198 XM_UB80 1381 0.30 0.93 0.01 199 DKIM_ADSP_CUSTOM_MED 1378 0.83 0.93 0.79 200 XM_GoogleGroups 1366 1.30 0.92 1.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 292086 89.88 94.78 87.69 2 RELAYCOUNTRY_US 267211 80.36 80.68 80.22 3 DKIM_SIGNED 254278 80.33 89.25 76.34 4 XM_DK_Pass 250787 78.14 84.51 75.29 5 DKIM_VALID 247349 77.23 83.88 74.26 6 XM_B_Unicode 237865 75.43 84.42 71.41 7 DKIM_VALID_AU 202539 62.07 64.90 60.81 8 BAYES_50 198228 53.64 40.50 59.51 9 DCC_CHECK_NEGATIVE 190694 46.86 23.59 57.25 10 XMListUnsubscribeExists 166797 55.08 66.27 50.08 11 XM_B_SpammyWords 149726 52.47 69.30 44.95 12 DCC_CHECK 142194 52.66 74.97 42.69 13 XM_B_Unicode3 138491 44.11 49.79 41.58 14 DKIM_VALID_EF 101233 30.67 31.27 30.39 15 T_TM2_M_HEADER_IN_MSG 97984 27.20 22.24 29.42 16 LOC_TINY_FONT_1 95250 34.50 47.71 28.60 17 HTML_FONT_LOW_CONTRAST 93189 30.42 35.89 27.98 18 FVGT_m_MULTI_ODD 87523 28.45 33.32 26.28 19 XMSubLong 77541 23.83 25.06 23.28 20 T_KAM_HTML_FONT_INVALID 75549 24.82 29.60 22.68 21 MIME_HTML_ONLY 63311 22.43 30.09 19.01 22 XM_B_SpammyWords2 61409 24.92 39.42 18.44 23 RCVD_IN_MSPIKE_WL 57150 14.76 9.41 17.16 24 ALL_TRUSTED 54677 11.85 1.64 16.42 25 RCVD_IN_MSPIKE_H2 53567 16.66 17.97 16.08 26 TR_XM_DK_Unsub 47612 16.67 22.00 14.29 27 XM_Multi_Part_URI 44904 15.95 21.48 13.48 28 USER_IN_DEF_DKIM_WL 41419 9.46 2.79 12.44 29 UNPARSEABLE_RELAY 39322 13.66 17.80 11.81 30 XM_B_PhoneNumber 34296 9.16 6.63 10.30 31 BAYES_00 34103 7.29 0.70 10.24 32 XM_Evil_Numbers_Gen 32853 9.92 10.05 9.86 33 FSL_BULK_SIG 31501 10.20 11.85 9.46 34 TooManyTo_001 29688 7.53 4.44 8.91 35 XM_B_Unsub 28238 11.83 19.35 8.48 36 RCVD_IN_MSPIKE_H3 27536 7.37 5.36 8.27 37 LotsOfNums_01 27112 7.93 7.47 8.14 38 BAYES_60 26078 8.00 8.38 7.83 39 TR_XM_DK_Bayes 22663 4.86 0.50 6.80 40 TR_XM_DK_Bayes1 22317 4.78 0.49 6.70 41 TR_XM_BayesUnsub 22181 10.35 18.62 6.66 42 XM_DKIMWhitelistDomains 22114 4.59 0.01 6.64 43 TR_MAX_INTL_RELAY 20991 9.25 15.84 6.30 44 LOTS_OF_MONEY 20524 8.01 12.14 6.16 45 XM_B_Phish_Phrases 19903 6.90 8.98 5.98 46 T_TooManySym_01 19529 4.88 2.67 5.86 47 XM_H_Long_From01 19498 5.86 5.88 5.85 48 TR_XM_DK_Bayes2 19082 4.06 0.32 5.73 49 XM_H_GMP 18932 5.32 4.50 5.68 50 BAYES_40 18580 4.43 1.87 5.58 51 RCVD_IN_MSPIKE_H5 18454 4.42 1.91 5.54 52 MIME_QP_LONG_LINE 17706 4.75 3.48 5.32 53 XMStrtUSub 17595 5.11 4.74 5.28 54 XM_B_SpammyWords3 17153 8.25 15.20 5.15 55 BAYES_20 16297 3.79 1.33 4.89 56 MPART_ALT_DIFF 16063 5.33 6.48 4.82 57 ANY_BOUNCE_MESSAGE 15992 3.71 1.28 4.80 58 BOUNCE_MESSAGE 15989 3.71 1.28 4.80 59 HTML_IMAGE_RATIO_04 15345 4.56 4.47 4.61 60 XM_DK_Undo_02 14761 15.11 39.00 4.43 61 XM_PDF 14563 3.28 0.84 4.37 62 HTML_IMAGE_RATIO_02 14326 4.99 6.54 4.30 63 TR_XM_SpammyWords4 13703 6.21 10.89 4.11 64 XM_UncommonTLD01 13650 4.78 6.30 4.10 65 BAYES_80 13343 5.77 9.73 4.01 66 T_REMOTE_IMAGE 13174 3.28 1.78 3.96 67 RCVD_IN_VALIDITY_SAFE 13054 3.44 2.37 3.92 68 RELAYCOUNTRY_META 12947 8.34 18.32 3.89 69 RCVD_IN_IADB_LISTED 12126 3.12 1.96 3.64 70 HTML_IMAGE_RATIO_06 11861 3.58 3.61 3.56 71 XMSubMetaSx_00 11475 4.02 5.31 3.45 72 HTML_MIME_NO_HTML_TAG 11435 3.03 2.14 3.43 73 RCVD_IN_MSPIKE_H4 11160 2.98 2.14 3.35 74 XMNumbers 10978 3.49 3.94 3.30 75 RCVD_IN_VALIDITY_CERTIFIED 10884 2.87 1.99 3.27 76 MAILING_LIST_MULTI 10786 2.90 2.15 3.24 77 RCVD_IN_IADB_SPF 10664 2.74 1.72 3.20 78 BAYES_99 10462 11.36 29.75 3.14 79 BOTNET_IPINHOSTNAME 10375 6.11 12.80 3.11 80 T_TooManySym_02 10173 2.31 0.64 3.05 81 RCVD_IN_IADB_SENDERID 9501 2.46 1.59 2.85 82 XM_Body_Dirty_Words 9385 3.80 6.01 2.82 83 MIME_HTML_MOSTLY 9356 3.01 3.47 2.81 84 RCVD_IN_IADB_DK 9289 2.43 1.62 2.79 85 TooManyTo_002 8499 1.98 0.71 2.55 86 XM_B_SpammyTLD 8339 2.81 3.48 2.50 87 BAYES_05 8337 1.94 0.67 2.50 88 RCVD_IN_IADB_VOUCHED 7923 1.95 0.99 2.38 89 HTML_IMAGE_RATIO_08 7826 2.70 3.49 2.35 90 MIME_HTML_ONLY_MULTI 7751 2.68 3.48 2.33 91 BAYES_95 7645 3.33 5.66 2.30 92 BAYES_999 7620 8.55 22.56 2.29 93 T_XMDrugObfuBody_14 7516 2.87 4.24 2.26 94 INVALID_MSGID 7354 1.60 0.25 2.21 95 DKIM_INVALID 6929 3.10 5.37 2.08 96 XM_CamelCaseFrm001 6901 2.48 3.39 2.07 97 T_XMDrugObfuBody_08 6857 2.61 3.84 2.06 98 MSGID_NOFQDN1 6638 1.38 0.02 1.99 99 XM_B_URI_Unicode 6500 2.19 2.72 1.95 100 XM_DK_Undo_01 6429 1.78 1.44 1.93 101 TO_MALFORMED 6375 1.33 0.01 1.91 102 UNTRUSTED_Relay 6186 3.43 6.94 1.86 103 TM2_M_URI_OPT_OUT 6151 2.17 2.88 1.85 104 TR_XM_SpammyRelay 5926 5.16 12.72 1.78 105 TR_XM_DKIM_Undo 5721 9.98 28.49 1.72 106 XM_B_Investor 5687 2.75 5.08 1.71 107 FROM_EXCESS_BASE64 5622 1.69 1.68 1.69 108 TR_XM_UnparsRelay 5519 4.15 9.71 1.66 109 TR_XM_PhishingBody 5473 2.63 4.84 1.64 110 RCVD_IN_IADB_OPTIN 5430 1.33 0.64 1.63 111 TooManyTo_003 5417 1.30 0.58 1.63 112 TR_Symld_Words 5329 1.44 1.09 1.60 113 TM2_M_VERY_LONG_WORD 4970 2.20 3.79 1.49 114 SUBJ_ALL_CAPS 4919 1.59 1.85 1.48 115 XM_GoogleGroups 4902 1.30 0.92 1.47 116 KHOP_HELO_FCRDNS 4877 1.63 2.00 1.46 117 XMDiploma_00 4814 1.92 2.98 1.45 118 XM_SendGrid 4719 1.48 1.61 1.42 119 HELO_NODOT 4708 1.01 0.12 1.41 120 HELO_NO_DOMAIN 4702 1.00 0.09 1.41 121 XM_B_Unsub2 4668 1.98 3.28 1.40 122 XM_SPF_SoftFail 4623 1.90 3.04 1.39 123 TR_XM_SpammyWords5 4606 2.11 3.75 1.38 124 URI_HEX 4472 1.43 1.61 1.34 125 IN_HORDE_ADDRESS_BOOK 4375 0.93 0.08 1.31 126 RCVD_IN_MSPIKE_BL 4265 2.69 5.83 1.28 127 TR_XM_MSPIKECOMBO 4264 2.68 5.83 1.28 128 URI_NOVOWEL 4246 1.29 1.33 1.27 129 TR_DCC_Bayes_99 4238 7.19 20.44 1.27 130 TooManyTo_004 4109 0.99 0.45 1.23 131 XMStockSpam_06 4072 1.51 2.16 1.22 132 T_TooManySym_03 3973 0.87 0.16 1.19 133 XMCapTrack 3965 0.98 0.52 1.19 134 BOTNET 3943 4.35 11.42 1.18 135 RCVD_IN_MSPIKE_L3 3698 1.83 3.44 1.11 136 XM_UB50 3674 1.68 2.97 1.10 137 XMSexyCombo_05 3622 1.99 4.02 1.09 138 XMGappySubj_01 3487 0.80 0.23 1.05 139 XM_ShortIntro_01 3455 0.88 0.53 1.04 140 XM_B_COPY_HTML 3424 1.08 1.19 1.03 141 TooManyTo_005 3327 0.81 0.40 1.00 142 XM_ProductURIs 3241 1.12 1.46 0.97 143 TR_XM_DK_SendGrid 3215 1.01 1.11 0.97 144 T_XMDrugObfuBody_00 3100 1.27 2.03 0.93 145 HTTPS_HTTP_MISMATCH 3100 1.05 1.33 0.93 146 TR_MetaPhish_Combo_01 3073 1.03 1.27 0.92 147 TVD_SPACE_RATIO 3067 0.68 0.14 0.92 148 T_TVD_MIME_NO_HEADERS 2993 0.63 0.04 0.90 149 TVD_RCVD_IP 2957 0.98 1.20 0.89 150 XM_H_PHPMailer 2928 0.72 0.38 0.88 151 T_FILL_THIS_FORM_SHORT 2729 1.30 2.37 0.82 152 XM_OfRef6 2645 1.64 3.53 0.79 153 DKIM_ADSP_CUSTOM_MED 2619 0.83 0.93 0.79 154 SpammyFromTLD_01 2595 1.09 1.78 0.78 155 XMBrknScrpt_02 2570 1.12 1.91 0.77 156 XMGenDplmaNmb 2569 0.99 1.47 0.77 157 FROM_GOV_DKIM_AU 2504 0.57 0.17 0.75 158 XMNoVowels 2484 0.74 0.72 0.75 159 RCVD_IN_PBL 2477 0.94 1.37 0.74 160 XMSlimDrugH 2414 0.76 0.84 0.72 161 XM_H_Long_From02 2361 1.20 2.31 0.71 162 HTML_TAG_BALANCE_BODY 2343 0.78 0.94 0.70 163 RELAYCOUNTRY_CA 2325 2.55 6.68 0.70 164 XMMoneyMeta_00 2278 0.71 0.76 0.68 165 RELAYCOUNTRY_GB 2247 0.74 0.89 0.67 166 XMBSHREFv2 2184 0.58 0.41 0.66 167 TR_XM_SpammyWords3 2118 1.79 4.38 0.64 168 RELAYCOUNTRY_FR 2113 0.78 1.11 0.63 169 TR_XM_Base64_M1 2109 0.67 0.75 0.63 170 MPART_ALT_DIFF_COUNT 2016 0.79 1.20 0.61 171 RELAYCOUNTRY_AU 1991 1.42 3.28 0.60 172 HTML_IMAGE_ONLY_20 1984 0.67 0.83 0.60 173 TO_NO_BRKTS_HTML_ONLY 1976 0.46 0.17 0.59 174 T_Symld_Words_02 1957 0.71 1.00 0.59 175 T_OBFU_PDF_ATTACH 1934 0.45 0.16 0.58 176 SpammyFromTLD_02 1862 1.15 2.48 0.56 177 XM_B_SpammyWords4 1837 1.25 2.81 0.55 178 XMPhish30 1708 0.83 1.55 0.51 179 XMDateMe_00 1705 0.51 0.49 0.51 180 XMPhish14 1702 0.66 1.00 0.51 181 RCVD_IN_PSBL 1681 0.85 1.63 0.50 182 RCVD_IN_BL_SPAMCOP_NET 1665 2.88 8.21 0.50 183 T_XMHurry_00 1662 0.81 1.49 0.50 184 FORGED_GMAIL_RCVD 1620 0.55 0.69 0.49 185 XMLngstWrd_00 1596 0.44 0.37 0.48 186 NML_ADSP_CUSTOM_MED 1587 0.55 0.73 0.48 187 MSGID_FROM_MTA_HEADER 1569 0.40 0.23 0.47 188 TR_XM_SpammyWords2 1557 3.27 9.53 0.47 189 XMGappySubj_02 1546 0.34 0.07 0.46 190 XM_B_DNDMA 1510 0.56 0.79 0.45 191 LongTLD 1495 0.66 1.14 0.45 192 XMSubMetaI_00 1495 0.68 1.19 0.45 193 URI_TRY_3LD 1494 0.67 1.17 0.45 194 PLING_QUERY 1487 0.51 0.64 0.45 195 HTML_IMAGE_ONLY_32 1480 0.35 0.15 0.44 196 T_MANY_PILL_PRICE 1448 0.30 0.01 0.43 197 XMBody_17 1447 1.00 2.28 0.43 198 XMLngstWrd_01 1388 0.39 0.32 0.42 199 XMBody_95 1359 0.32 0.13 0.41 200 TR_XM_GMP_MSPIKE_UNDO2 1308 0.33 0.20 0.39 ----------------------------------------------------------------------