Email: 482450 Autolearn: 0 AvgScore: 5.46 AvgScanTime: 1.48 sec Spam: 159629 Autolearn: 0 AvgScore: 14.52 AvgScanTime: 1.63 sec Ham: 322821 Autolearn: 0 AvgScore: 0.98 AvgScanTime: 1.41 sec Time Spent Running SA: 198.50 hours Time Spent Processing Spam: 72.27 hours Time Spent Processing Ham: 126.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152734 89.71 95.68 86.76 2 DKIM_SIGNED 135607 80.02 84.95 77.58 3 XM_B_Unicode 127864 74.46 80.10 71.68 4 XM_DK_Pass 127409 77.62 79.82 76.54 5 DKIM_VALID 125889 76.65 78.86 75.55 6 RELAYCOUNTRY_US 123321 80.28 77.25 81.77 7 DCC_CHECK 111880 52.94 70.09 44.46 8 XM_B_SpammyWords 103826 51.77 65.04 45.20 9 XMListUnsubscribeExists 102253 55.57 64.06 51.37 10 DKIM_VALID_AU 98480 61.67 61.69 61.66 11 XM_B_Unicode3 72984 43.08 45.72 41.78 12 LOC_TINY_FONT_1 72622 34.55 45.49 29.13 13 BAYES_50 69069 54.64 43.27 60.26 14 XM_DK_Undo_02 62965 16.43 39.44 5.05 15 XM_B_SpammyWords2 59952 25.59 37.56 19.68 16 HTML_FONT_LOW_CONTRAST 55101 30.47 34.52 28.46 17 MIME_HTML_ONLY 53552 23.78 33.55 18.95 18 FVGT_m_MULTI_ODD 51155 28.45 32.05 26.68 19 BAYES_99 46829 12.00 29.34 3.43 20 DKIM_VALID_EF 46391 29.91 29.06 30.33 21 DCC_CHECK_NEGATIVE 45765 46.61 28.67 55.48 22 T_KAM_HTML_FONT_INVALID 45089 24.96 28.25 23.33 23 TR_XM_DKIM_Undo 44720 10.46 28.01 1.77 24 T_TM2_M_HEADER_IN_MSG 41133 27.97 25.77 29.06 25 XM_B_Unsub 37108 13.32 23.25 8.42 26 XMSubLong 36537 23.42 22.89 23.68 27 BAYES_999 36230 9.27 22.70 2.63 28 TR_XM_BayesUnsub 35526 11.82 22.26 6.66 29 TR_XM_DK_Unsub 33512 16.44 20.99 14.19 30 XM_Multi_Part_URI 32839 16.21 20.57 14.05 31 TR_DCC_Bayes_99 32591 7.61 20.42 1.28 32 RCVD_IN_MSPIKE_H2 28611 17.07 17.92 16.65 33 UNPARSEABLE_RELAY 27608 13.74 17.30 11.99 34 RELAYCOUNTRY_META 26412 7.70 16.55 3.32 35 TR_MAX_INTL_RELAY 23067 8.88 14.45 6.12 36 LOTS_OF_MONEY 20748 8.99 13.00 7.01 37 XM_B_SpammyWords3 20572 8.00 12.89 5.59 38 BOTNET_IPINHOSTNAME 19342 6.21 12.12 3.29 39 TR_XM_SpammyWords4 18651 7.18 11.68 4.96 40 TR_XM_SpammyRelay 18584 4.95 11.64 1.64 41 RCVD_IN_BL_SPAMCOP_NET 17536 4.12 10.99 0.73 42 BOTNET 17462 4.48 10.94 1.28 43 FSL_BULK_SIG 15799 10.24 9.90 10.41 44 TR_XM_SpammyWords2 15506 3.56 9.71 0.51 45 XM_Evil_Numbers_Gen 15447 8.65 9.68 8.14 46 RCVD_IN_MSPIKE_WL 15375 14.56 9.63 16.99 47 TR_XM_UnparsRelay 14728 4.08 9.23 1.53 48 BAYES_80 14476 5.53 9.07 3.78 49 XM_URI_RBL 13720 3.08 8.59 0.36 50 XM_B_Phish_Phrases 13455 6.42 8.43 5.42 51 BAYES_60 12760 7.34 7.99 7.02 52 HTML_MIME_NO_HTML_TAG 11738 4.17 7.35 2.60 53 RCVD_IN_MSPIKE_BL 11439 3.28 7.17 1.36 54 TR_XM_MSPIKECOMBO 11426 3.28 7.16 1.36 55 ALL_TRUSTED 10900 12.44 6.83 15.21 56 HTML_IMAGE_RATIO_02 10798 5.49 6.76 4.86 57 UNTRUSTED_Relay 10299 3.20 6.45 1.59 58 XMSubMetaSx_00 10244 4.45 6.42 3.47 59 T_HTML_ATTACH 9980 2.09 6.25 0.03 60 DKIM_INVALID 9718 3.37 6.09 2.03 61 LotsOfNums_01 9637 7.37 6.04 8.03 62 RELAYCOUNTRY_CA 9499 2.40 5.95 0.64 63 XM_UncommonTLD01 9267 4.59 5.81 3.99 64 MPART_ALT_DIFF 9090 5.31 5.69 5.12 65 HTML_ENTITY_ASCII 8855 1.84 5.55 0.00 66 XM_B_PhoneNumber 8848 8.53 5.54 10.01 67 RCVD_IN_MSPIKE_H3 8731 7.25 5.47 8.14 68 XM_Body_Dirty_Words 8654 3.38 5.42 2.36 69 TR_XM_SPAMCOP 8335 1.86 5.22 0.20 70 XM_H_Long_From01 8261 5.82 5.18 6.14 71 BAYES_95 8100 3.25 5.07 2.34 72 XM_B_Investor 8063 2.74 5.05 1.60 73 XM_H_GMP 7748 5.41 4.85 5.69 74 TR_XM_SpammyWords3 7705 2.05 4.83 0.67 75 HTML_IMAGE_RATIO_04 6893 3.99 4.32 3.83 76 XM_B_SpammyTLD 6820 3.31 4.27 2.84 77 TooManyTo_001 6654 6.78 4.17 8.07 78 T_XMDrugObfuBody_14 6647 2.66 4.16 1.92 79 XMStrtUSub 6552 5.06 4.10 5.53 80 TR_XM_PhishingBody 6404 2.56 4.01 1.85 81 RCVD_IN_MSPIKE_L3 6191 2.09 3.88 1.21 82 XMSexyCombo_05 6147 1.98 3.85 1.05 83 MIME_HTML_MOSTLY 6096 3.19 3.82 2.88 84 XM_OfRef6 5995 1.76 3.76 0.77 85 TM2_M_VERY_LONG_WORD 5965 2.43 3.74 1.79 86 MIME_QP_LONG_LINE 5606 4.83 3.51 5.48 87 XMNumbers 5296 3.36 3.32 3.38 88 XM_SPF_SoftFail 5226 2.24 3.27 1.74 89 TR_XM_SpammyWords5 5030 1.98 3.15 1.41 90 HTML_IMAGE_RATIO_06 4881 3.46 3.06 3.66 91 TR_XM_NoHeaderRelay 4787 1.10 3.00 0.16 92 HTML_IMAGE_RATIO_08 4679 2.96 2.93 2.97 93 RELAYCOUNTRY_AU 4530 1.28 2.84 0.51 94 TR_XM_INV_DKIM 4405 0.93 2.76 0.03 95 T_TooManySym_01 4382 4.52 2.75 5.39 96 MIME_HTML_ONLY_MULTI 4359 2.62 2.73 2.56 97 XM_CamelCaseFrm001 4354 2.26 2.73 2.03 98 XM_B_Unsub2 4316 1.80 2.70 1.36 99 T_XMDrugObfuBody_08 4257 1.84 2.67 1.43 100 XM_UB50 4211 1.53 2.64 0.98 101 TM2_M_URI_OPT_OUT 4170 2.09 2.61 1.84 102 USER_IN_DEF_DKIM_WL 4166 9.87 2.61 13.46 103 XM_B_URI_Unicode 3959 2.27 2.48 2.17 104 XMDiploma_00 3840 1.64 2.41 1.26 105 SpammyFromTLD_02 3605 1.06 2.26 0.47 106 RCVD_IN_MSPIKE_H5 3539 4.45 2.22 5.55 107 KHOP_HELO_FCRDNS 3447 1.61 2.16 1.34 108 TR_XM_MSPIKECOMBO2 3369 0.73 2.11 0.05 109 XMBody_17 3327 0.94 2.08 0.37 110 T_FILL_THIS_FORM_SHORT 3302 1.27 2.07 0.87 111 RCVD_IN_PSBL 3299 1.04 2.07 0.53 112 RCVD_IN_VALIDITY_RPBL 3265 0.70 2.05 0.03 113 XM_B_SpammyWords4 3263 1.07 2.04 0.58 114 XMStockSpam_06 3150 1.19 1.97 0.81 115 URI_HEX 3109 1.64 1.95 1.48 116 RCVD_IN_MSPIKE_H4 3105 2.85 1.95 3.30 117 RCVD_IN_VALIDITY_SAFE 3092 3.54 1.94 4.33 118 MAILING_LIST_MULTI 3045 2.72 1.91 3.13 119 XM_H_Long_From02 3033 1.19 1.90 0.84 120 FROM_EXCESS_BASE64 3018 1.71 1.89 1.63 121 RCVD_IN_MSPIKE_L4 2905 0.68 1.82 0.11 122 BAYES_40 2881 4.33 1.80 5.58 123 SpammyFromTLD_01 2844 1.12 1.78 0.79 124 TR_XM_INTL_Spamhaus 2721 0.67 1.70 0.16 125 RCVD_IN_VALIDITY_CERTIFIED 2661 3.01 1.67 3.68 126 RCVD_IN_IADB_LISTED 2633 3.00 1.65 3.66 127 XM_SendGrid 2626 1.62 1.65 1.61 128 BOUNCE_MESSAGE 2596 3.41 1.63 4.29 129 ANY_BOUNCE_MESSAGE 2596 3.41 1.63 4.29 130 XM_DK_Undo_01 2551 1.66 1.60 1.69 131 XM_ProductURIs 2529 0.91 1.58 0.58 132 T_XMHurry_00 2520 0.86 1.58 0.50 133 XMBrknScrpt_02 2398 1.00 1.50 0.75 134 XMGenDplmaNmb 2390 1.02 1.50 0.78 135 TR_XM_MaxSPIKE 2382 0.52 1.49 0.04 136 TR_LOTS_OF_MONEY3 2372 0.68 1.49 0.28 137 SUBJ_ALL_CAPS 2366 1.38 1.48 1.33 138 RCVD_IN_MSPIKE_L5 2330 0.51 1.46 0.04 139 DIET_1 2294 0.65 1.44 0.27 140 RCVD_IN_IADB_SPF 2276 2.65 1.43 3.26 141 T_REMOTE_IMAGE 2242 3.02 1.40 3.82 142 XM_B_COPY_HTML 2202 0.84 1.38 0.57 143 T_XMDrugObfuBody_00 2188 1.11 1.37 0.98 144 XMPhish30 2184 0.94 1.37 0.72 145 XM_B_COVIDMETA 2170 0.57 1.36 0.19 146 MPART_ALT_DIFF_COUNT 2155 0.98 1.35 0.80 147 RCVD_IN_IADB_DK 2119 2.34 1.33 2.84 148 URI_NOVOWEL 2110 1.30 1.32 1.29 149 RELAYCOUNTRY_FR 2095 0.62 1.31 0.28 150 RCVD_IN_IADB_SENDERID 2085 2.39 1.31 2.92 151 XMBdyGiftCard01 2056 0.68 1.29 0.37 152 RCVD_IN_PBL 2047 0.85 1.28 0.64 153 MultiRelay_CC 2026 0.52 1.27 0.16 154 URI_TRY_3LD 1979 0.75 1.24 0.51 155 SHORTCIRCUIT 1958 0.41 1.23 0.00 156 RCVD_IN_ZEN_LASTEXTERNAL 1958 0.41 1.23 0.00 157 XM_B_Phish66 1955 0.65 1.22 0.37 158 RCVD_IN_XBL 1935 0.41 1.21 0.01 159 DKIM_ADSP_NXDOMAIN 1924 0.59 1.21 0.29 160 XM_HighProb1 1913 0.40 1.20 0.00 161 TM2_M_OBFU_COMMENT 1896 0.52 1.19 0.19 162 XM_B_SEO 1842 0.49 1.15 0.17 163 TR_XM_PHPForged 1795 0.53 1.12 0.23 164 TR_XM_PHPDW 1777 0.52 1.11 0.23 165 TR_XM_FormFill2 1773 0.52 1.11 0.23 166 XM_H_PHPOS 1734 0.51 1.09 0.22 167 HK_RANDOM_REPLYTO 1727 0.41 1.08 0.08 168 RCVD_IN_SBL_CSS 1714 0.38 1.07 0.04 169 XMSubMetaSxObfu_03 1700 0.59 1.06 0.35 170 BOTNET_NORDNS 1692 0.35 1.06 0.00 171 HTTPS_HTTP_MISMATCH 1682 0.82 1.05 0.70 172 XM_UB99 1681 0.35 1.05 0.00 173 XM_UB60 1677 0.42 1.05 0.11 174 HTML_IMAGE_ONLY_20 1675 0.71 1.05 0.54 175 TR_LOTS_OF_MONEY2 1651 0.44 1.03 0.15 176 T_MONEY_PERCENT 1651 0.44 1.03 0.15 177 BAYES_20 1649 3.60 1.03 4.88 178 XM_UB80 1637 0.35 1.03 0.02 179 STY_INVIS_DIRECT 1625 0.54 1.02 0.30 180 TR_Mismatch_TLD_02 1621 0.39 1.02 0.08 181 RDNS_DYNAMIC 1618 0.45 1.01 0.17 182 XMBody_78 1614 0.58 1.01 0.37 183 LongTLD 1598 0.66 1.00 0.49 184 XMHTML_After_End 1556 0.58 0.97 0.38 185 TR_XM_GMP_BULK_SIG 1512 0.46 0.95 0.22 186 HTML_TAG_BALANCE_BODY 1510 0.65 0.95 0.50 187 T_Symld_Words_02 1508 0.83 0.94 0.78 188 TR_XM_RelayPhish 1506 0.38 0.94 0.10 189 HTML_FONT_TINY_NORDNS 1502 0.37 0.94 0.09 190 TR_XM_InvalidRelay 1482 0.31 0.93 0.01 191 TR_XM_SEO4 1480 0.36 0.93 0.08 192 DKIM_ADSP_CUSTOM_MED 1478 0.85 0.93 0.82 193 XM_B_DNDMA 1461 0.77 0.92 0.70 194 TR_XM_DK_SendGrid 1446 0.98 0.91 1.01 195 SHOPIFY_IMG_NOT_RCVD_SFY 1430 0.44 0.90 0.21 196 RCVD_IN_IADB_VOUCHED 1414 1.89 0.89 2.38 197 XMMoneyMeta_00 1410 0.69 0.88 0.59 198 XM_PDF 1392 3.37 0.87 4.61 199 TR_MetaPhish_Combo_01 1379 0.89 0.86 0.90 200 RELAYCOUNTRY_GB 1359 0.73 0.85 0.67 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 280077 89.71 95.68 86.76 2 RELAYCOUNTRY_US 263979 80.28 77.25 81.77 3 DKIM_SIGNED 250448 80.02 84.95 77.58 4 XM_DK_Pass 247076 77.62 79.82 76.54 5 DKIM_VALID 243907 76.65 78.86 75.55 6 XM_B_Unicode 231385 74.46 80.10 71.68 7 DKIM_VALID_AU 199049 61.67 61.69 61.66 8 BAYES_50 194529 54.64 43.27 60.26 9 DCC_CHECK_NEGATIVE 179096 46.61 28.67 55.48 10 XMListUnsubscribeExists 165849 55.57 64.06 51.37 11 XM_B_SpammyWords 145929 51.77 65.04 45.20 12 DCC_CHECK 143541 52.94 70.09 44.46 13 XM_B_Unicode3 134859 43.08 45.72 41.78 14 DKIM_VALID_EF 97912 29.91 29.06 30.33 15 LOC_TINY_FONT_1 94049 34.55 45.49 29.13 16 T_TM2_M_HEADER_IN_MSG 93804 27.97 25.77 29.06 17 HTML_FONT_LOW_CONTRAST 91888 30.47 34.52 28.46 18 FVGT_m_MULTI_ODD 86122 28.45 32.05 26.68 19 XMSubLong 76450 23.42 22.89 23.68 20 T_KAM_HTML_FONT_INVALID 75322 24.96 28.25 23.33 21 XM_B_SpammyWords2 63523 25.59 37.56 19.68 22 MIME_HTML_ONLY 61186 23.78 33.55 18.95 23 RCVD_IN_MSPIKE_WL 54853 14.56 9.63 16.99 24 RCVD_IN_MSPIKE_H2 53742 17.07 17.92 16.65 25 ALL_TRUSTED 49109 12.44 6.83 15.21 26 TR_XM_DK_Unsub 45801 16.44 20.99 14.19 27 XM_Multi_Part_URI 45347 16.21 20.57 14.05 28 USER_IN_DEF_DKIM_WL 43445 9.87 2.61 13.46 29 UNPARSEABLE_RELAY 38693 13.74 17.30 11.99 30 FSL_BULK_SIG 33595 10.24 9.90 10.41 31 BAYES_00 33300 7.11 0.62 10.32 32 XM_B_PhoneNumber 32328 8.53 5.54 10.01 33 XM_B_Unsub 27166 13.32 23.25 8.42 34 XM_Evil_Numbers_Gen 26293 8.65 9.68 8.14 35 RCVD_IN_MSPIKE_H3 26262 7.25 5.47 8.14 36 TooManyTo_001 26062 6.78 4.17 8.07 37 LotsOfNums_01 25928 7.37 6.04 8.03 38 TR_XM_DK_Bayes 23936 5.13 0.51 7.41 39 TR_XM_DK_Bayes1 23614 5.06 0.51 7.31 40 BAYES_60 22654 7.34 7.99 7.02 41 LOTS_OF_MONEY 22619 8.99 13.00 7.01 42 XM_DKIMWhitelistDomains 21999 4.58 0.07 6.81 43 TR_XM_BayesUnsub 21491 11.82 22.26 6.66 44 TR_XM_DK_Bayes2 20075 4.27 0.33 6.22 45 XM_H_Long_From01 19824 5.82 5.18 6.14 46 TR_MAX_INTL_RELAY 19758 8.88 14.45 6.12 47 XM_H_GMP 18367 5.41 4.85 5.69 48 XM_B_SpammyWords3 18030 8.00 12.89 5.59 49 BAYES_40 18019 4.33 1.80 5.58 50 RCVD_IN_MSPIKE_H5 17927 4.45 2.22 5.55 51 XMStrtUSub 17848 5.06 4.10 5.53 52 MIME_QP_LONG_LINE 17706 4.83 3.51 5.48 53 XM_B_Phish_Phrases 17507 6.42 8.43 5.42 54 T_TooManySym_01 17412 4.52 2.75 5.39 55 MPART_ALT_DIFF 16516 5.31 5.69 5.12 56 XM_DK_Undo_02 16299 16.43 39.44 5.05 57 TR_XM_SpammyWords4 16005 7.18 11.68 4.96 58 BAYES_20 15743 3.60 1.03 4.88 59 HTML_IMAGE_RATIO_02 15674 5.49 6.76 4.86 60 XM_PDF 14874 3.37 0.87 4.61 61 RCVD_IN_VALIDITY_SAFE 13980 3.54 1.94 4.33 62 ANY_BOUNCE_MESSAGE 13861 3.41 1.63 4.29 63 BOUNCE_MESSAGE 13858 3.41 1.63 4.29 64 XM_UncommonTLD01 12880 4.59 5.81 3.99 65 HTML_IMAGE_RATIO_04 12354 3.99 4.32 3.83 66 T_REMOTE_IMAGE 12317 3.02 1.40 3.82 67 BAYES_80 12199 5.53 9.07 3.78 68 RCVD_IN_VALIDITY_CERTIFIED 11867 3.01 1.67 3.68 69 RCVD_IN_IADB_LISTED 11822 3.00 1.65 3.66 70 HTML_IMAGE_RATIO_06 11807 3.46 3.06 3.66 71 XMSubMetaSx_00 11203 4.45 6.42 3.47 72 BAYES_99 11072 12.00 29.34 3.43 73 XMNumbers 10902 3.36 3.32 3.38 74 RELAYCOUNTRY_META 10727 7.70 16.55 3.32 75 RCVD_IN_MSPIKE_H4 10664 2.85 1.95 3.30 76 BOTNET_IPINHOSTNAME 10618 6.21 12.12 3.29 77 RCVD_IN_IADB_SPF 10526 2.65 1.43 3.26 78 MAILING_LIST_MULTI 10094 2.72 1.91 3.13 79 HTML_IMAGE_RATIO_08 9589 2.96 2.93 2.97 80 RCVD_IN_IADB_SENDERID 9441 2.39 1.31 2.92 81 T_TooManySym_02 9387 2.15 0.62 2.91 82 MIME_HTML_MOSTLY 9300 3.19 3.82 2.88 83 RCVD_IN_IADB_DK 9168 2.34 1.33 2.84 84 XM_B_SpammyTLD 9161 3.31 4.27 2.84 85 BAYES_999 8483 9.27 22.70 2.63 86 HTML_MIME_NO_HTML_TAG 8398 4.17 7.35 2.60 87 MIME_HTML_ONLY_MULTI 8275 2.62 2.73 2.56 88 BAYES_05 7746 1.79 0.57 2.40 89 RCVD_IN_IADB_VOUCHED 7691 1.89 0.89 2.38 90 XM_Body_Dirty_Words 7629 3.38 5.42 2.36 91 BAYES_95 7557 3.25 5.07 2.34 92 TooManyTo_002 7428 1.73 0.59 2.30 93 INVALID_MSGID 7271 1.58 0.23 2.25 94 XM_B_URI_Unicode 6990 2.27 2.48 2.17 95 MSGID_NOFQDN1 6548 1.36 0.02 2.03 96 XM_CamelCaseFrm001 6546 2.26 2.73 2.03 97 DKIM_INVALID 6541 3.37 6.09 2.03 98 TO_MALFORMED 6361 1.32 0.01 1.97 99 T_XMDrugObfuBody_14 6191 2.66 4.16 1.92 100 TR_XM_PhishingBody 5957 2.56 4.01 1.85 101 TM2_M_URI_OPT_OUT 5931 2.09 2.61 1.84 102 TR_Symld_Words 5899 1.50 0.83 1.83 103 TM2_M_VERY_LONG_WORD 5779 2.43 3.74 1.79 104 TR_XM_DKIM_Undo 5730 10.46 28.01 1.77 105 XM_SPF_SoftFail 5604 2.24 3.27 1.74 106 RCVD_IN_IADB_OPTIN 5491 1.33 0.57 1.70 107 XM_DK_Undo_01 5448 1.66 1.60 1.69 108 IN_HORDE_ADDRESS_BOOK 5429 1.15 0.08 1.68 109 TR_XM_SpammyRelay 5287 4.95 11.64 1.64 110 FROM_EXCESS_BASE64 5251 1.71 1.89 1.63 111 XM_SendGrid 5200 1.62 1.65 1.61 112 XM_B_Investor 5165 2.74 5.05 1.60 113 UNTRUSTED_Relay 5125 3.20 6.45 1.59 114 TR_XM_UnparsRelay 4950 4.08 9.23 1.53 115 URI_HEX 4793 1.64 1.95 1.48 116 TooManyTo_003 4691 1.14 0.51 1.45 117 T_XMDrugObfuBody_08 4606 1.84 2.67 1.43 118 TR_XM_SpammyWords5 4542 1.98 3.15 1.41 119 RCVD_IN_MSPIKE_BL 4390 3.28 7.17 1.36 120 TR_XM_MSPIKECOMBO 4388 3.28 7.16 1.36 121 XM_B_Unsub2 4386 1.80 2.70 1.36 122 XMGappySubj_01 4355 0.95 0.16 1.35 123 KHOP_HELO_FCRDNS 4339 1.61 2.16 1.34 124 HELO_NODOT 4306 0.95 0.16 1.33 125 SUBJ_ALL_CAPS 4305 1.38 1.48 1.33 126 HELO_NO_DOMAIN 4302 0.94 0.15 1.33 127 XM_GoogleGroups 4293 1.15 0.78 1.33 128 URI_NOVOWEL 4161 1.30 1.32 1.29 129 TR_DCC_Bayes_99 4147 7.61 20.42 1.28 130 BOTNET 4132 4.48 10.94 1.28 131 XMDiploma_00 4055 1.64 2.41 1.26 132 RCVD_IN_MSPIKE_L3 3892 2.09 3.88 1.21 133 T_TooManySym_03 3735 0.85 0.22 1.16 134 TooManyTo_004 3460 0.86 0.42 1.07 135 XMCapTrack 3445 0.88 0.50 1.07 136 XMSexyCombo_05 3400 1.98 3.85 1.05 137 XM_ShortIntro_01 3399 0.83 0.37 1.05 138 TVD_RCVD_IP 3281 0.96 0.84 1.02 139 TR_XM_DK_SendGrid 3274 0.98 0.91 1.01 140 T_XMDrugObfuBody_00 3158 1.11 1.37 0.98 141 XM_UB50 3150 1.53 2.64 0.98 142 TR_MetaPhish_Combo_01 2906 0.89 0.86 0.90 143 TooManyTo_005 2891 0.72 0.38 0.90 144 TVD_SPACE_RATIO 2881 0.64 0.13 0.89 145 T_FILL_THIS_FORM_SHORT 2816 1.27 2.07 0.87 146 XM_H_Long_From02 2708 1.19 1.90 0.84 147 DKIM_ADSP_CUSTOM_MED 2633 0.85 0.93 0.82 148 XMStockSpam_06 2611 1.19 1.97 0.81 149 MPART_ALT_DIFF_COUNT 2572 0.98 1.35 0.80 150 SpammyFromTLD_01 2561 1.12 1.78 0.79 151 XMGenDplmaNmb 2534 1.02 1.50 0.78 152 FROM_GOV_DKIM_AU 2516 0.58 0.19 0.78 153 T_Symld_Words_02 2510 0.83 0.94 0.78 154 XMBSHREFv2 2500 0.70 0.54 0.77 155 XM_OfRef6 2483 1.76 3.76 0.77 156 XMBrknScrpt_02 2418 1.00 1.50 0.75 157 HTML_IMAGE_ONLY_32 2392 0.62 0.39 0.74 158 XMNoVowels 2380 0.65 0.47 0.74 159 RCVD_IN_BL_SPAMCOP_NET 2349 4.12 10.99 0.73 160 XMPhish30 2339 0.94 1.37 0.72 161 XM_H_PHPMailer 2322 0.61 0.40 0.72 162 TRACKER_ID 2307 0.53 0.16 0.71 163 XMGappySubj_02 2264 0.49 0.05 0.70 164 HTTPS_HTTP_MISMATCH 2259 0.82 1.05 0.70 165 XM_B_DNDMA 2253 0.77 0.92 0.70 166 TR_XM_SpammyWords3 2173 2.05 4.83 0.67 167 RELAYCOUNTRY_GB 2149 0.73 0.85 0.67 168 TO_NO_BRKTS_HTML_ONLY 2131 0.48 0.13 0.66 169 RCVD_IN_PBL 2070 0.85 1.28 0.64 170 RELAYCOUNTRY_CA 2056 2.40 5.95 0.64 171 T_OBFU_PDF_ATTACH 1995 0.48 0.21 0.62 172 XM_Superlative01 1969 0.42 0.04 0.61 173 XMMoneyMeta_00 1909 0.69 0.88 0.59 174 XM_B_SpammyWords4 1886 1.07 2.04 0.58 175 TR_XM_Base64_M1 1871 0.66 0.82 0.58 176 XM_ProductURIs 1870 0.91 1.58 0.58 177 XM_B_COPY_HTML 1828 0.84 1.38 0.57 178 MSGID_FROM_MTA_HEADER 1797 0.46 0.27 0.56 179 XMSlimDrugH 1784 0.57 0.62 0.55 180 HTML_IMAGE_ONLY_20 1741 0.71 1.05 0.54 181 FORGED_GMAIL_RCVD 1711 0.59 0.72 0.53 182 RCVD_IN_PSBL 1695 1.04 2.07 0.53 183 NML_ADSP_CUSTOM_MED 1687 0.61 0.80 0.52 184 TR_XM_SpammyWords2 1654 3.56 9.71 0.51 185 URI_TRY_3LD 1651 0.75 1.24 0.51 186 RELAYCOUNTRY_AU 1635 1.28 2.84 0.51 187 T_XMHurry_00 1617 0.86 1.58 0.50 188 HTML_TAG_BALANCE_BODY 1602 0.65 0.95 0.50 189 LongTLD 1586 0.66 1.00 0.49 190 SpammyFromTLD_02 1521 1.06 2.26 0.47 191 SHORT_HELO_AND_INLINE_IMAGE 1455 0.31 0.03 0.45 192 XMDateMe_00 1370 0.46 0.53 0.42 193 T_TVD_MIME_NO_HEADERS 1357 0.30 0.07 0.42 194 HTML_FONT_FACE_BAD 1325 0.46 0.55 0.41 195 TR_XM_GMP_MSPIKE_UNDO2 1307 0.32 0.15 0.40 196 XMPhish14 1289 0.55 0.85 0.40 197 XMLngstWrd_00 1285 0.45 0.55 0.40 198 SUBJ_DOLLARS 1253 0.41 0.44 0.39 199 XMBody_95 1238 0.29 0.11 0.38 200 TR_Mismatch_TLD_01 1235 0.51 0.76 0.38 ----------------------------------------------------------------------