Email: 508426 Autolearn: 0 AvgScore: 5.29 AvgScanTime: 1.32 sec Spam: 157681 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 1.51 sec Ham: 350745 Autolearn: 0 AvgScore: 1.19 AvgScanTime: 1.24 sec Time Spent Running SA: 186.59 hours Time Spent Processing Spam: 66.26 hours Time Spent Processing Ham: 120.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150150 89.09 95.22 86.33 2 XM_B_Unicode 132824 74.72 84.24 70.44 3 DKIM_SIGNED 131774 73.13 83.57 68.43 4 RELAYCOUNTRY_US 130207 81.04 82.58 80.35 5 XM_DK_Pass 124215 70.89 78.78 67.34 6 DKIM_VALID 122755 69.95 77.85 66.40 7 DCC_CHECK 119592 54.19 75.84 44.46 8 XM_B_SpammyWords 101031 50.53 64.07 44.43 9 XMListUnsubscribeExists 97311 49.65 61.71 44.22 10 DKIM_VALID_AU 96410 56.65 61.14 54.63 11 XM_B_Unicode3 80695 44.02 51.18 40.80 12 LOC_TINY_FONT_1 68998 30.90 43.76 25.11 13 BAYES_50 66347 50.73 42.08 54.62 14 XM_DK_Undo_02 59279 14.63 37.59 4.31 15 XM_B_SpammyWords2 59042 23.32 37.44 16.97 16 HTML_FONT_LOW_CONTRAST 51636 26.94 32.75 24.33 17 MIME_HTML_ONLY 48609 25.04 30.83 22.43 18 FVGT_m_MULTI_ODD 48549 25.50 30.79 23.12 19 DKIM_VALID_EF 45932 27.94 29.13 27.40 20 XMSubLong 45701 23.83 28.98 21.52 21 BAYES_99 44450 10.84 28.19 3.05 22 T_KAM_HTML_FONT_INVALID 44076 22.65 27.95 20.27 23 TR_XM_DKIM_Undo 42084 9.36 26.69 1.57 24 DCC_CHECK_NEGATIVE 35906 45.35 22.77 55.50 25 BAYES_999 34190 8.28 21.68 2.25 26 TR_XM_DK_Unsub 31952 14.78 20.26 12.32 27 T_TM2_M_HEADER_IN_MSG 31857 25.30 20.20 27.59 28 XM_Multi_Part_URI 30767 14.60 19.51 12.39 29 TR_DCC_Bayes_99 29967 6.66 19.00 1.11 30 RCVD_IN_MSPIKE_H2 29265 15.83 18.56 14.60 31 BOTNET_IPINHOSTNAME 28929 13.28 18.35 11.00 32 XM_B_Unsub 27341 10.56 17.34 7.51 33 UNPARSEABLE_RELAY 27039 12.61 17.15 10.58 34 TR_XM_BayesUnsub 26327 9.25 16.70 5.90 35 RELAYCOUNTRY_META 26102 7.32 16.55 3.16 36 FSL_BULK_SIG 25910 15.57 16.43 15.18 37 XM_B_SpammyWords3 22546 7.44 14.30 4.35 38 TR_MAX_INTL_RELAY 21835 7.96 13.85 5.32 39 TR_XM_SpammyRelay 18757 4.77 11.90 1.57 40 LOTS_OF_MONEY 18297 7.57 11.60 5.76 41 RCVD_IN_BL_SPAMCOP_NET 17499 3.87 11.10 0.62 42 TR_XM_SpammyWords4 16566 6.08 10.51 4.09 43 BOTNET 16383 3.95 10.39 1.05 44 RCVD_IN_MSPIKE_WL 15254 13.70 9.67 15.51 45 TR_XM_SpammyWords2 14849 3.18 9.42 0.38 46 TR_XM_UnparsRelay 14611 3.90 9.27 1.49 47 XM_Evil_Numbers_Gen 14369 8.96 9.11 8.90 48 XM_B_Phish_Phrases 13544 6.01 8.59 4.84 49 BAYES_80 13419 4.93 8.51 3.32 50 MPART_ALT_DIFF 13383 8.44 8.49 8.43 51 HTML_IMAGE_RATIO_04 12990 10.68 8.24 11.78 52 BAYES_60 11915 6.71 7.56 6.32 53 HTML_FONT_FACE_BAD 10906 8.44 6.92 9.13 54 LotsOfNums_01 10081 6.58 6.39 6.67 55 UNTRUSTED_Relay 10076 2.97 6.39 1.43 56 RCVD_IN_MSPIKE_BL 9939 2.73 6.30 1.12 57 TR_XM_MSPIKECOMBO 9932 2.72 6.30 1.12 58 XMSubNoVowel 9650 3.05 6.12 1.67 59 XM_B_PhoneNumber 9592 8.00 6.08 8.86 60 RELAYCOUNTRY_CA 9522 2.35 6.04 0.69 61 DKIM_INVALID 9019 3.17 5.72 2.03 62 XMSubMetaSx_00 8996 3.81 5.71 2.96 63 XM_UncommonTLD01 8886 4.30 5.64 3.70 64 HTML_IMAGE_RATIO_06 8722 4.18 5.53 3.57 65 XM_Body_Dirty_Words 8676 3.20 5.50 2.17 66 RCVD_IN_MSPIKE_H3 8582 6.73 5.44 7.31 67 MIME_HTML_ONLY_MULTI 8508 6.05 5.40 6.34 68 HTML_IMAGE_RATIO_02 8413 4.28 5.34 3.80 69 XM_H_Long_From01 8365 5.43 5.31 5.48 70 TR_XM_SPAMCOP 8206 1.72 5.20 0.15 71 XM_H_GMP 7973 5.24 5.06 5.32 72 BAYES_95 7853 2.92 4.98 2.00 73 XMSubLongNoVowel 7631 1.52 4.84 0.02 74 TR_XM_SpammyWords3 7596 1.91 4.82 0.60 75 XM_B_Investor 7512 2.43 4.76 1.38 76 XMSubGarbage 7284 1.44 4.62 0.00 77 TR_XM_PhishingBody 7047 2.53 4.47 1.66 78 XMStrtUSub 6516 8.58 4.13 10.58 79 XMNumbers 6344 3.42 4.02 3.15 80 T_XMDrugObfuBody_14 6193 2.35 3.93 1.64 81 BAYES_40 6101 4.88 3.87 5.33 82 TooManyTo_001 5884 6.24 3.73 7.36 83 XMSexyCombo_05 5870 1.84 3.72 1.00 84 TR_XM_SpammyWords5 5581 1.97 3.54 1.26 85 RCVD_IN_MSPIKE_L3 5491 1.72 3.48 0.93 86 XM_B_SpammyTLD 5450 2.74 3.46 2.42 87 XM_OfRef6 5375 1.64 3.41 0.85 88 TM2_M_VERY_LONG_WORD 5302 1.95 3.36 1.31 89 T_XMDrugObfuBody_08 5279 2.03 3.35 1.44 90 MIME_HTML_MOSTLY 5278 2.59 3.35 2.25 91 XM_URI_RBL 5156 1.21 3.27 0.29 92 XM_B_Unsub2 5098 1.81 3.23 1.17 93 XM_UB50 5010 1.60 3.18 0.89 94 MIME_QP_LONG_LINE 4745 4.16 3.01 4.68 95 XM_CamelCaseFrm001 4680 2.20 2.97 1.85 96 RELAYCOUNTRY_AU 4567 1.16 2.90 0.37 97 XM_B_URI_Unicode 4566 2.39 2.90 2.17 98 XM_SPF_SoftFail 4420 1.73 2.80 1.24 99 TR_XM_INV_DKIM 4361 0.87 2.77 0.01 100 T_TooManySym_01 4335 4.50 2.75 5.28 101 TR_XM_NoHeaderRelay 4075 0.91 2.58 0.15 102 XM_B_SpammyWords4 3956 1.30 2.51 0.75 103 XMDiploma_00 3929 1.68 2.49 1.31 104 RCVD_IN_VALIDITY_RPBL 3908 0.80 2.48 0.04 105 TM2_M_URI_OPT_OUT 3792 2.01 2.40 1.83 106 XMBody_17 3735 0.94 2.37 0.30 107 HTML_IMAGE_RATIO_08 3708 2.26 2.35 2.23 108 KHOP_HELO_FCRDNS 3628 1.54 2.30 1.20 109 MAILING_LIST_MULTI 3518 2.90 2.23 3.20 110 RCVD_IN_VALIDITY_SAFE 3451 2.96 2.19 3.31 111 XMStockSpam_06 3410 1.49 2.16 1.19 112 USER_IN_DEF_DKIM_WL 3404 8.93 2.16 11.97 113 RCVD_IN_MSPIKE_H5 3337 4.26 2.12 5.22 114 RCVD_IN_MSPIKE_H4 3335 2.72 2.12 2.98 115 XM_ProductURIs 3215 1.36 2.04 1.05 116 SpammyFromTLD_02 3153 1.00 2.00 0.56 117 TR_XM_MSPIKECOMBO2 3143 0.67 1.99 0.07 118 T_REMOTE_IMAGE 3133 2.85 1.99 3.24 119 T_FILL_THIS_FORM_SHORT 3028 1.10 1.92 0.73 120 RCVD_IN_VALIDITY_CERTIFIED 3009 2.61 1.91 2.93 121 RCVD_IN_PSBL 3004 0.92 1.91 0.48 122 XM_DK_Undo_01 2976 1.78 1.89 1.73 123 FROM_EXCESS_BASE64 2942 1.62 1.87 1.51 124 URI_HEX 2914 1.34 1.85 1.11 125 HTML_MIME_NO_HTML_TAG 2897 2.95 1.84 3.44 126 RCVD_IN_MSPIKE_L4 2887 0.67 1.83 0.15 127 BAYES_20 2836 4.90 1.80 6.30 128 TR_XM_INTL_Spamhaus 2753 0.66 1.75 0.17 129 SUBJ_ALL_CAPS 2711 1.39 1.72 1.24 130 TM2_M_OBFU_COMMENT 2663 0.72 1.69 0.28 131 T_XMHurry_00 2643 0.89 1.68 0.54 132 RCVD_IN_IADB_LISTED 2641 2.59 1.67 3.00 133 XMBdyGiftCard01 2609 0.67 1.65 0.23 134 XM_B_COVIDMETA 2555 0.65 1.62 0.21 135 XMPhish30 2480 0.91 1.57 0.61 136 T_XMDrugObfuBody_00 2465 1.05 1.56 0.82 137 HTML_IMAGE_ONLY_20 2446 0.85 1.55 0.53 138 XMBrknScrpt_02 2434 0.95 1.54 0.68 139 XMGenDplmaNmb 2387 0.97 1.51 0.72 140 SpammyFromTLD_01 2375 0.94 1.51 0.68 141 TR_LOTS_OF_MONEY3 2351 0.64 1.49 0.26 142 URI_TRY_3LD 2315 0.81 1.47 0.52 143 RCVD_IN_IADB_SPF 2247 2.30 1.43 2.70 144 RCVD_IN_ZEN_LASTEXTERNAL 2152 0.42 1.36 0.00 145 SHORTCIRCUIT 2152 0.42 1.36 0.00 146 ALL_TRUSTED 2133 12.14 1.35 16.99 147 RCVD_IN_IADB_DK 2114 2.04 1.34 2.36 148 RCVD_IN_IADB_SENDERID 2078 2.09 1.32 2.44 149 TR_XM_MaxSPIKE 2072 0.43 1.31 0.04 150 XM_H_Long_From02 2049 0.92 1.30 0.75 151 XM_B_SEO 2038 0.53 1.29 0.19 152 XM_SendGrid 2034 1.43 1.29 1.49 153 RCVD_IN_SBL_CSS 2027 0.43 1.29 0.05 154 URI_NOVOWEL 2001 1.18 1.27 1.14 155 RCVD_IN_XBL 1995 0.40 1.27 0.01 156 RELAYCOUNTRY_FR 1974 0.59 1.25 0.29 157 TR_XM_RelayPhish 1969 0.44 1.25 0.08 158 HTML_FONT_TINY_NORDNS 1960 0.44 1.24 0.08 159 HTML_TAG_BALANCE_BODY 1943 0.77 1.23 0.57 160 XM_B_Phish66 1897 0.65 1.20 0.40 161 DKIM_ADSP_NXDOMAIN 1896 0.57 1.20 0.28 162 RCVD_IN_PBL 1877 0.81 1.19 0.65 163 XM_HighProb1 1864 0.37 1.18 0.00 164 TVD_RCVD_IP 1847 1.10 1.17 1.07 165 TR_Mismatch_TLD_02 1832 0.42 1.16 0.08 166 XM_GoogleGroups 1769 1.40 1.12 1.52 167 RDNS_DYNAMIC 1759 0.45 1.12 0.14 168 MPART_ALT_DIFF_COUNT 1732 0.68 1.10 0.49 169 XM_B_COPY_HTML 1727 0.77 1.10 0.63 170 PDS_RDNS_DYNAMIC_FP 1725 0.36 1.09 0.03 171 BOTNET_NORDNS 1722 0.34 1.09 0.00 172 XMClaimOffer 1720 0.46 1.09 0.17 173 STY_INVIS_DIRECT 1715 0.57 1.09 0.34 174 TR_XM_SEO4 1696 0.40 1.08 0.10 175 MultiRelay_CC 1690 0.44 1.07 0.16 176 THIS_AD 1678 0.53 1.06 0.29 177 TR_XM_GMP_BULK_SIG 1648 0.42 1.05 0.14 178 TR_MetaPhish_Combo_01 1627 0.79 1.03 0.69 179 XM_UB99 1627 0.32 1.03 0.00 180 PLING_QUERY 1624 0.48 1.03 0.23 181 DKIM_ADSP_CUSTOM_MED 1603 0.78 1.02 0.67 182 TR_LOTS_OF_MONEY2 1574 0.40 1.00 0.13 183 T_MONEY_PERCENT 1574 0.40 1.00 0.13 184 HTTPS_HTTP_MISMATCH 1568 0.74 0.99 0.62 185 RCVD_IN_MSPIKE_L5 1554 0.33 0.99 0.03 186 T_Symld_Words_02 1540 0.76 0.98 0.66 187 ANY_BOUNCE_MESSAGE 1524 4.47 0.97 6.05 188 BOUNCE_MESSAGE 1521 4.47 0.96 6.05 189 LongTLD 1507 0.57 0.96 0.40 190 RCVD_IN_IADB_VOUCHED 1446 1.63 0.92 1.96 191 URIBL_SBL 1442 0.29 0.91 0.00 192 URIBL_SBL_A 1442 0.29 0.91 0.00 193 TR_XM_PHPForged 1439 0.46 0.91 0.26 194 SH_BODYURI_REVERSE_SBL 1439 0.29 0.91 0.00 195 TR_XM_FormFill2 1429 0.46 0.91 0.26 196 TR_XM_PHPDW 1425 0.46 0.90 0.26 197 BAYES_00 1415 11.69 0.90 16.54 198 XMHTML_After_End 1414 0.51 0.90 0.34 199 T_HTML_ATTACH 1386 0.30 0.88 0.04 200 XM_H_PHPOS 1374 0.44 0.87 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 302814 89.09 95.22 86.33 2 RELAYCOUNTRY_US 281822 81.04 82.58 80.35 3 XM_B_Unicode 247057 74.72 84.24 70.44 4 DKIM_SIGNED 240022 73.13 83.57 68.43 5 XM_DK_Pass 236193 70.89 78.78 67.34 6 DKIM_VALID 232903 69.95 77.85 66.40 7 DCC_CHECK_NEGATIVE 194651 45.35 22.77 55.50 8 DKIM_VALID_AU 191623 56.65 61.14 54.63 9 BAYES_50 191575 50.73 42.08 54.62 10 DCC_CHECK 155933 54.19 75.84 44.46 11 XM_B_SpammyWords 155853 50.53 64.07 44.43 12 XMListUnsubscribeExists 155105 49.65 61.71 44.22 13 XM_B_Unicode3 143097 44.02 51.18 40.80 14 T_TM2_M_HEADER_IN_MSG 96772 25.30 20.20 27.59 15 DKIM_VALID_EF 96114 27.94 29.13 27.40 16 LOC_TINY_FONT_1 88086 30.90 43.76 25.11 17 HTML_FONT_LOW_CONTRAST 85352 26.94 32.75 24.33 18 FVGT_m_MULTI_ODD 81090 25.50 30.79 23.12 19 MIME_HTML_ONLY 78682 25.04 30.83 22.43 20 XMSubLong 75473 23.83 28.98 21.52 21 T_KAM_HTML_FONT_INVALID 71096 22.65 27.95 20.27 22 ALL_TRUSTED 59583 12.14 1.35 16.99 23 XM_B_SpammyWords2 59527 23.32 37.44 16.97 24 BAYES_00 58007 11.69 0.90 16.54 25 RCVD_IN_MSPIKE_WL 54393 13.70 9.67 15.51 26 FSL_BULK_SIG 53235 15.57 16.43 15.18 27 RCVD_IN_MSPIKE_H2 51224 15.83 18.56 14.60 28 XM_Multi_Part_URI 43464 14.60 19.51 12.39 29 TR_XM_DK_Unsub 43203 14.78 20.26 12.32 30 USER_IN_DEF_DKIM_WL 41991 8.93 2.16 11.97 31 HTML_IMAGE_RATIO_04 41314 10.68 8.24 11.78 32 BOTNET_IPINHOSTNAME 38596 13.28 18.35 11.00 33 XMStrtUSub 37100 8.58 4.13 10.58 34 UNPARSEABLE_RELAY 37097 12.61 17.15 10.58 35 HTML_FONT_FACE_BAD 32010 8.44 6.92 9.13 36 XM_Evil_Numbers_Gen 31208 8.96 9.11 8.90 37 XM_B_PhoneNumber 31090 8.00 6.08 8.86 38 MPART_ALT_DIFF 29551 8.44 8.49 8.43 39 XM_B_Unsub 26326 10.56 17.34 7.51 40 TooManyTo_001 25826 6.24 3.73 7.36 41 RCVD_IN_MSPIKE_H3 25626 6.73 5.44 7.31 42 LotsOfNums_01 23392 6.58 6.39 6.67 43 TR_XM_DK_Bayes 22761 4.69 0.68 6.49 44 TR_XM_DK_Bayes1 22407 4.61 0.67 6.39 45 MIME_HTML_ONLY_MULTI 22241 6.05 5.40 6.34 46 BAYES_60 22178 6.71 7.56 6.32 47 BAYES_20 22101 4.90 1.80 6.30 48 XM_DKIMWhitelistDomains 21851 4.30 0.00 6.23 49 ANY_BOUNCE_MESSAGE 21218 4.47 0.97 6.05 50 BOUNCE_MESSAGE 21216 4.47 0.96 6.05 51 TR_XM_BayesUnsub 20696 9.25 16.70 5.90 52 LOTS_OF_MONEY 20189 7.57 11.60 5.76 53 TR_XM_DK_Bayes2 19261 3.90 0.37 5.49 54 XM_H_Long_From01 19238 5.43 5.31 5.48 55 BAYES_40 18692 4.88 3.87 5.33 56 XM_H_GMP 18674 5.24 5.06 5.32 57 TR_MAX_INTL_RELAY 18649 7.96 13.85 5.32 58 T_TooManySym_01 18524 4.50 2.75 5.28 59 RCVD_IN_MSPIKE_H5 18298 4.26 2.12 5.22 60 XM_B_Phish_Phrases 16990 6.01 8.59 4.84 61 MIME_QP_LONG_LINE 16400 4.16 3.01 4.68 62 XM_B_SpammyWords3 15263 7.44 14.30 4.35 63 XM_DK_Undo_02 15108 14.63 37.59 4.31 64 TR_XM_SpammyWords4 14348 6.08 10.51 4.09 65 XM_PDF 13724 2.94 0.77 3.91 66 HTML_IMAGE_RATIO_02 13335 4.28 5.34 3.80 67 XM_UncommonTLD01 12986 4.30 5.64 3.70 68 HTML_IMAGE_RATIO_06 12528 4.18 5.53 3.57 69 HTML_MIME_NO_HTML_TAG 12082 2.95 1.84 3.44 70 BAYES_80 11633 4.93 8.51 3.32 71 RCVD_IN_VALIDITY_SAFE 11612 2.96 2.19 3.31 72 T_REMOTE_IMAGE 11367 2.85 1.99 3.24 73 MAILING_LIST_MULTI 11236 2.90 2.23 3.20 74 RELAYCOUNTRY_META 11097 7.32 16.55 3.16 75 XMNumbers 11062 3.42 4.02 3.15 76 BAYES_99 10685 10.84 28.19 3.05 77 RCVD_IN_IADB_LISTED 10535 2.59 1.67 3.00 78 RCVD_IN_MSPIKE_H4 10469 2.72 2.12 2.98 79 XMSubMetaSx_00 10376 3.81 5.71 2.96 80 RCVD_IN_VALIDITY_CERTIFIED 10268 2.61 1.91 2.93 81 T_TooManySym_02 9955 2.18 0.71 2.84 82 RCVD_IN_IADB_SPF 9460 2.30 1.43 2.70 83 BAYES_05 8856 1.98 0.76 2.52 84 RCVD_IN_IADB_SENDERID 8544 2.09 1.32 2.44 85 XM_B_SpammyTLD 8501 2.74 3.46 2.42 86 RCVD_IN_IADB_DK 8276 2.04 1.34 2.36 87 BAYES_999 7903 8.28 21.68 2.25 88 MIME_HTML_MOSTLY 7884 2.59 3.35 2.25 89 TooManyTo_002 7817 1.74 0.64 2.23 90 HTML_IMAGE_RATIO_08 7807 2.26 2.35 2.23 91 XM_Body_Dirty_Words 7602 3.20 5.50 2.17 92 XM_B_URI_Unicode 7596 2.39 2.90 2.17 93 INVALID_MSGID 7282 1.56 0.40 2.08 94 DKIM_INVALID 7119 3.17 5.72 2.03 95 BAYES_95 7015 2.92 4.98 2.00 96 RCVD_IN_IADB_VOUCHED 6864 1.63 0.92 1.96 97 MSGID_NOFQDN1 6535 1.32 0.13 1.86 98 XM_CamelCaseFrm001 6482 2.20 2.97 1.85 99 TM2_M_URI_OPT_OUT 6414 2.01 2.40 1.83 100 TO_MALFORMED 6343 1.25 0.01 1.81 101 XM_DK_Undo_01 6068 1.78 1.89 1.73 102 XMSubNoVowel 5850 3.05 6.12 1.67 103 TR_XM_PhishingBody 5832 2.53 4.47 1.66 104 T_XMDrugObfuBody_14 5763 2.35 3.93 1.64 105 TR_XM_SpammyRelay 5510 4.77 11.90 1.57 106 TR_XM_DKIM_Undo 5500 9.36 26.69 1.57 107 XM_GoogleGroups 5329 1.40 1.12 1.52 108 FROM_EXCESS_BASE64 5296 1.62 1.87 1.51 109 TR_XM_UnparsRelay 5241 3.90 9.27 1.49 110 XM_SendGrid 5239 1.43 1.29 1.49 111 TooManyTo_003 5064 1.15 0.50 1.44 112 T_XMDrugObfuBody_08 5042 2.03 3.35 1.44 113 UNTRUSTED_Relay 5004 2.97 6.39 1.43 114 RCVD_IN_IADB_OPTIN 4843 1.13 0.57 1.38 115 XM_B_Investor 4825 2.43 4.76 1.38 116 TR_Symld_Words 4815 1.19 0.79 1.37 117 XMDiploma_00 4610 1.68 2.49 1.31 118 TM2_M_VERY_LONG_WORD 4605 1.95 3.36 1.31 119 TR_XM_SpammyWords5 4423 1.97 3.54 1.26 120 XM_SPF_SoftFail 4366 1.73 2.80 1.24 121 HELO_NODOT 4363 0.90 0.14 1.24 122 SUBJ_ALL_CAPS 4354 1.39 1.72 1.24 123 HELO_NO_DOMAIN 4354 0.90 0.13 1.24 124 KHOP_HELO_FCRDNS 4208 1.54 2.30 1.20 125 IN_HORDE_ADDRESS_BOOK 4186 0.85 0.08 1.19 126 XMStockSpam_06 4180 1.49 2.16 1.19 127 T_TooManySym_03 4109 0.88 0.22 1.17 128 XM_B_Unsub2 4107 1.81 3.23 1.17 129 XMGappySubj_01 4077 0.88 0.25 1.16 130 URI_NOVOWEL 4000 1.18 1.27 1.14 131 TooManyTo_004 3939 0.89 0.38 1.12 132 RCVD_IN_MSPIKE_BL 3918 2.73 6.30 1.12 133 TR_XM_MSPIKECOMBO 3911 2.72 6.30 1.12 134 TR_DCC_Bayes_99 3906 6.66 19.00 1.11 135 URI_HEX 3884 1.34 1.85 1.11 136 TVD_RCVD_IP 3751 1.10 1.17 1.07 137 BOTNET 3694 3.95 10.39 1.05 138 XM_ProductURIs 3686 1.36 2.04 1.05 139 XMCapTrack 3570 0.85 0.47 1.02 140 XMSexyCombo_05 3494 1.84 3.72 1.00 141 XM_ShortIntro_01 3430 0.82 0.48 0.98 142 RCVD_IN_MSPIKE_L3 3269 1.72 3.48 0.93 143 TR_XM_DK_SendGrid 3267 0.86 0.71 0.93 144 TooManyTo_005 3250 0.74 0.33 0.93 145 XM_UB50 3135 1.60 3.18 0.89 146 XM_E_Blogspot 3017 0.68 0.26 0.86 147 XM_OfRef6 2970 1.64 3.41 0.85 148 TVD_SPACE_RATIO 2964 0.66 0.23 0.85 149 T_XMDrugObfuBody_00 2882 1.05 1.56 0.82 150 XM_H_Long_From02 2634 0.92 1.30 0.75 151 XM_B_SpammyWords4 2629 1.30 2.51 0.75 152 T_FILL_THIS_FORM_SHORT 2577 1.10 1.92 0.73 153 XMGenDplmaNmb 2540 0.97 1.51 0.72 154 TR_XM_Base64_M1 2524 0.70 0.65 0.72 155 RELAYCOUNTRY_CA 2420 2.35 6.04 0.69 156 XM_B_DNDMA 2417 0.74 0.85 0.69 157 TR_MetaPhish_Combo_01 2410 0.79 1.03 0.69 158 FROM_GOV_DKIM_AU 2398 0.62 0.47 0.68 159 XMBrknScrpt_02 2388 0.95 1.54 0.68 160 XMNoVowels 2387 0.64 0.54 0.68 161 SpammyFromTLD_01 2383 0.94 1.51 0.68 162 XM_H_PHPMailer 2374 0.60 0.42 0.68 163 DKIM_ADSP_CUSTOM_MED 2365 0.78 1.02 0.67 164 XMBSHREFv2 2327 0.56 0.33 0.66 165 LOW_PRICE 2317 0.53 0.23 0.66 166 T_Symld_Words_02 2316 0.76 0.98 0.66 167 RCVD_IN_PBL 2264 0.81 1.19 0.65 168 XM_B_COPY_HTML 2207 0.77 1.10 0.63 169 RCVD_IN_BL_SPAMCOP_NET 2189 3.87 11.10 0.62 170 HTTPS_HTTP_MISMATCH 2187 0.74 0.99 0.62 171 XMPhish30 2142 0.91 1.57 0.61 172 TR_XM_SpammyWords3 2093 1.91 4.82 0.60 173 RELAYCOUNTRY_GB 2091 0.66 0.79 0.60 174 TO_NO_BRKTS_HTML_ONLY 2078 0.48 0.24 0.59 175 XMLngstWrd_00 1989 0.52 0.42 0.57 176 HTML_TAG_BALANCE_BODY 1983 0.77 1.23 0.57 177 XMSlimDrugH 1983 0.57 0.58 0.57 178 XMGappySubj_02 1961 0.40 0.04 0.56 179 SpammyFromTLD_02 1954 1.00 2.00 0.56 180 T_XMHurry_00 1905 0.89 1.68 0.54 181 HTML_IMAGE_ONLY_20 1851 0.85 1.55 0.53 182 URI_TRY_3LD 1810 0.81 1.47 0.52 183 TR_XM_Spammywords 1750 0.50 0.49 0.50 184 XM_S_SpammyWords 1750 0.50 0.49 0.50 185 HTML_IMAGE_ONLY_32 1746 0.41 0.22 0.50 186 MPART_ALT_DIFF_COUNT 1707 0.68 1.10 0.49 187 RCVD_IN_PSBL 1680 0.92 1.91 0.48 188 T_OBFU_PDF_ATTACH 1654 0.37 0.15 0.47 189 XMLngstWrd_01 1561 0.42 0.36 0.45 190 XMPhish14 1551 0.57 0.86 0.44 191 TM2_M_BODY_EMPTY 1526 0.36 0.18 0.44 192 XMMoneyMeta_00 1525 0.52 0.71 0.43 193 XMSolicitRefs_0 1479 0.43 0.46 0.42 194 MSGID_FROM_MTA_HEADER 1467 0.38 0.28 0.42 195 XMDateMe_00 1448 0.44 0.49 0.41 196 FORGED_GMAIL_RCVD 1443 0.47 0.59 0.41 197 LongTLD 1412 0.57 0.96 0.40 198 T_TVD_MIME_NO_HEADERS 1401 0.28 0.03 0.40 199 XM_B_Phish66 1386 0.65 1.20 0.40 200 NML_ADSP_CUSTOM_MED 1370 0.53 0.85 0.39 ----------------------------------------------------------------------