Email: 426395 Autolearn: 0 AvgScore: 5.47 AvgScanTime: 1.38 sec Spam: 139759 Autolearn: 0 AvgScore: 14.79 AvgScanTime: 1.50 sec Ham: 286636 Autolearn: 0 AvgScore: 0.93 AvgScanTime: 1.32 sec Time Spent Running SA: 163.62 hours Time Spent Processing Spam: 58.13 hours Time Spent Processing Ham: 105.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132652 89.39 94.91 86.70 2 DKIM_SIGNED 125902 82.56 90.09 78.89 3 XM_DK_Pass 120202 80.48 86.01 77.79 4 DKIM_VALID 118741 79.48 84.96 76.80 5 XM_B_Unicode 117584 76.00 84.13 72.03 6 RELAYCOUNTRY_US 113330 82.22 81.09 82.78 7 DCC_CHECK 104046 52.93 74.45 42.43 8 XM_B_SpammyWords 96393 53.75 68.97 46.33 9 XMListUnsubscribeExists 93954 56.38 67.23 51.10 10 DKIM_VALID_AU 93445 63.96 66.86 62.55 11 XM_B_Unicode3 67075 44.32 47.99 42.53 12 LOC_TINY_FONT_1 66281 34.77 47.43 28.60 13 XM_DK_Undo_02 60142 17.76 43.03 5.44 14 XM_B_SpammyWords2 56441 26.04 40.38 19.04 15 BAYES_50 53830 54.13 38.52 61.74 16 HTML_FONT_LOW_CONTRAST 49509 29.88 35.42 27.18 17 FVGT_m_MULTI_ODD 48181 28.68 34.47 25.85 18 DKIM_VALID_EF 44170 31.54 31.60 31.51 19 BAYES_99 43709 12.69 31.27 3.62 20 TR_XM_DKIM_Undo 42546 11.48 30.44 2.23 21 T_KAM_HTML_FONT_INVALID 41568 26.22 29.74 24.51 22 MIME_HTML_ONLY 39115 22.14 27.99 19.29 23 DCC_CHECK_NEGATIVE 33832 46.60 24.21 57.52 24 BAYES_999 33517 9.70 23.98 2.73 25 XMSubLong 32363 23.20 23.16 23.23 26 TR_XM_DK_Unsub 31184 16.94 22.31 14.32 27 TR_DCC_Bayes_99 31054 8.21 22.22 1.38 28 XM_Multi_Part_URI 30572 16.89 21.87 14.46 29 T_TM2_M_HEADER_IN_MSG 27634 26.10 19.77 29.19 30 XM_B_Unsub 26874 12.44 19.23 9.13 31 RCVD_IN_MSPIKE_H2 26437 17.00 18.92 16.06 32 UNPARSEABLE_RELAY 26063 14.51 18.65 12.48 33 TR_XM_BayesUnsub 25755 10.75 18.43 7.01 34 RELAYCOUNTRY_META 24939 8.27 17.84 3.59 35 TR_MAX_INTL_RELAY 23314 9.61 16.68 6.16 36 XM_B_SpammyWords3 20297 8.76 14.52 5.95 37 LOTS_OF_MONEY 18769 9.03 13.43 6.88 38 RCVD_IN_BL_SPAMCOP_NET 18741 4.84 13.41 0.66 39 TR_XM_SpammyRelay 18173 5.52 13.00 1.87 40 BOTNET_IPINHOSTNAME 17226 6.66 12.33 3.90 41 TR_XM_SpammyWords4 16860 7.05 12.06 4.61 42 FSL_BULK_SIG 15712 10.26 11.24 9.78 43 TR_XM_SpammyWords2 14977 3.83 10.72 0.47 44 BOTNET 14661 4.52 10.49 1.61 45 BAYES_80 14299 5.88 10.23 3.76 46 RCVD_IN_MSPIKE_WL 14282 15.68 10.22 18.34 47 TR_XM_UnparsRelay 13836 4.33 9.90 1.62 48 XM_Evil_Numbers_Gen 13211 8.64 9.45 8.24 49 BAYES_60 11896 7.65 8.51 7.23 50 RCVD_IN_MSPIKE_BL 11818 3.76 8.46 1.47 51 TR_XM_MSPIKECOMBO 11817 3.76 8.46 1.47 52 XM_B_Phish_Phrases 11746 6.31 8.40 5.29 53 UNTRUSTED_Relay 10182 3.41 7.29 1.52 54 HTML_IMAGE_RATIO_02 9469 5.26 6.78 4.52 55 LotsOfNums_01 9212 7.68 6.59 8.21 56 RELAYCOUNTRY_CA 9068 2.60 6.49 0.71 57 XM_UncommonTLD01 8936 4.89 6.39 4.15 58 XMSubMetaSx_00 8834 4.05 6.32 2.94 59 XM_Body_Dirty_Words 8786 3.86 6.29 2.67 60 BAYES_95 8423 3.58 6.03 2.39 61 TR_XM_SPAMCOP 8375 2.08 5.99 0.17 62 XM_H_Long_From01 8321 5.71 5.95 5.59 63 RCVD_IN_MSPIKE_H3 8296 7.76 5.94 8.65 64 MPART_ALT_DIFF 8255 5.15 5.91 4.79 65 XM_H_GMP 8063 5.94 5.77 6.02 66 XM_B_PhoneNumber 7821 7.82 5.60 8.90 67 TooManyTo_001 7730 7.35 5.53 8.23 68 TR_XM_SpammyWords3 7611 2.26 5.45 0.71 69 DKIM_INVALID 7161 3.08 5.12 2.09 70 HTML_IMAGE_RATIO_04 6213 4.47 4.45 4.48 71 T_XMDrugObfuBody_14 6117 2.65 4.38 1.81 72 XM_B_Investor 6088 2.56 4.36 1.69 73 XM_B_SpammyTLD 5927 3.29 4.24 2.82 74 MIME_QP_LONG_LINE 5794 5.17 4.15 5.67 75 TR_XM_PhishingBody 5790 2.45 4.14 1.62 76 XM_CamelCaseFrm001 5765 3.17 4.12 2.70 77 XMStrtUSub 5567 4.43 3.98 4.64 78 XMSexyCombo_05 5554 1.92 3.97 0.91 79 RCVD_IN_MSPIKE_L3 5309 2.13 3.80 1.31 80 MIME_HTML_MOSTLY 5305 3.07 3.80 2.72 81 TR_XM_SpammyWords5 5135 2.30 3.67 1.64 82 T_XMDrugObfuBody_08 5020 2.22 3.59 1.56 83 HTML_IMAGE_RATIO_08 5018 2.85 3.59 2.49 84 XM_URI_RBL 4993 1.47 3.57 0.45 85 XM_SPF_SoftFail 4892 2.02 3.50 1.30 86 TM2_M_VERY_LONG_WORD 4888 2.25 3.50 1.65 87 XMNumbers 4742 3.49 3.39 3.54 88 XM_OfRef6 4646 1.69 3.32 0.89 89 TR_XM_NoHeaderRelay 4506 1.20 3.22 0.21 90 RCVD_IN_MSPIKE_L5 4480 1.07 3.21 0.03 91 SUBJ_ALL_CAPS 4393 2.15 3.14 1.67 92 RELAYCOUNTRY_AU 4245 1.46 3.04 0.69 93 XM_B_Unsub2 4238 2.09 3.03 1.63 94 MIME_HTML_ONLY_MULTI 4160 2.69 2.98 2.54 95 USER_IN_DEF_DKIM_WL 4131 10.76 2.96 14.57 96 XMDiploma_00 4056 2.23 2.90 1.90 97 RCVD_IN_PSBL 3982 1.36 2.85 0.63 98 XM_B_SpammyWords4 3975 1.67 2.84 1.10 99 XM_B_URI_Unicode 3823 2.30 2.74 2.09 100 TR_XM_MSPIKECOMBO2 3604 0.90 2.58 0.08 101 T_TooManySym_01 3588 4.88 2.57 6.01 102 XM_UB50 3575 1.50 2.56 0.99 103 T_REMOTE_IMAGE 3562 3.30 2.55 3.67 104 HTML_IMAGE_RATIO_06 3475 2.78 2.49 2.92 105 RCVD_IN_VALIDITY_SAFE 3448 3.34 2.47 3.77 106 FROM_EXCESS_BASE64 3375 1.86 2.41 1.59 107 SpammyFromTLD_02 3371 1.08 2.41 0.44 108 RCVD_IN_VALIDITY_RPBL 3325 0.80 2.38 0.03 109 XM_ProductURIs 3083 1.33 2.21 0.90 110 HTML_FONT_TINY_NORDNS 3047 0.76 2.18 0.06 111 RCVD_IN_MSPIKE_H5 3028 4.73 2.17 5.98 112 TM2_M_URI_OPT_OUT 3009 1.85 2.15 1.71 113 RCVD_IN_VALIDITY_CERTIFIED 3000 2.79 2.15 3.11 114 RCVD_IN_MSPIKE_H4 2958 3.18 2.12 3.70 115 T_FILL_THIS_FORM_SHORT 2949 1.45 2.11 1.12 116 XMStockSpam_06 2937 1.67 2.10 1.46 117 XM_SendGrid 2860 1.84 2.05 1.75 118 TR_XM_INV_DKIM 2836 0.67 2.03 0.01 119 XMBrknScrpt_02 2785 1.28 1.99 0.93 120 ANY_BOUNCE_MESSAGE 2694 2.98 1.93 3.49 121 BOUNCE_MESSAGE 2694 2.97 1.93 3.49 122 TR_XM_INTL_Spamhaus 2649 0.77 1.90 0.21 123 DKIM_ADSP_NXDOMAIN 2589 0.83 1.85 0.33 124 XMGenDplmaNmb 2583 1.33 1.85 1.08 125 MAILING_LIST_MULTI 2573 3.11 1.84 3.73 126 SpammyFromTLD_01 2481 1.03 1.78 0.67 127 RCVD_IN_IADB_LISTED 2480 3.19 1.77 3.87 128 URI_TRY_3LD 2421 0.93 1.73 0.54 129 XMBody_17 2373 0.81 1.70 0.37 130 T_XMHurry_00 2350 0.95 1.68 0.59 131 BAYES_40 2327 4.01 1.67 5.16 132 SUBJ_DOLLARS 2270 0.74 1.62 0.31 133 TR_LOTS_OF_MONEY3 2266 0.83 1.62 0.45 134 XM_HighProb1 2250 0.53 1.61 0.01 135 TR_Caps_n_Bayes_99 2190 0.53 1.57 0.02 136 T_XMDrugObfuBody_00 2164 1.21 1.55 1.04 137 HTML_MIME_NO_HTML_TAG 2151 2.23 1.54 2.57 138 XMBdyGiftCard01 2148 0.74 1.54 0.35 139 RCVD_IN_XBL 2139 0.51 1.53 0.01 140 RCVD_IN_SBL_CSS 2119 0.52 1.52 0.04 141 RCVD_IN_IADB_SPF 2114 2.79 1.51 3.42 142 TR_XM_MaxSPIKE 2110 0.54 1.51 0.07 143 XMPhish30 2108 0.87 1.51 0.56 144 KHOP_HELO_FCRDNS 2090 1.48 1.50 1.48 145 TVD_RATWARE_MSGID_01 2051 0.54 1.47 0.09 146 MultiRelay_CC 2046 0.59 1.46 0.17 147 RCVD_IN_MSPIKE_L4 2028 0.56 1.45 0.12 148 ALL_TRUSTED 1977 9.91 1.41 14.05 149 RCVD_IN_IADB_DK 1970 2.44 1.41 2.94 150 XM_B_SEO 1969 0.60 1.41 0.21 151 URI_HEX 1958 1.37 1.40 1.35 152 T_Symld_Words_02 1956 0.94 1.40 0.71 153 RCVD_IN_IADB_SENDERID 1947 2.52 1.39 3.06 154 XM_UB99 1942 0.46 1.39 0.00 155 XMBounce_01 1920 0.46 1.37 0.01 156 XM_B_DNDMA 1858 0.66 1.33 0.33 157 XM_DK_Undo_01 1855 1.50 1.33 1.59 158 RCVD_IN_ZEN_LASTEXTERNAL 1849 0.43 1.32 0.00 159 SHORTCIRCUIT 1849 0.43 1.32 0.00 160 TR_XM_GMP_BULK_SIG 1840 0.55 1.32 0.18 161 RELAYCOUNTRY_TH 1836 0.43 1.31 0.00 162 RCVD_IN_PBL 1826 0.93 1.31 0.75 163 XM_B_COPY_HTML 1781 0.92 1.27 0.75 164 XM_H_Long_From02 1764 0.99 1.26 0.86 165 DIET_1 1758 0.59 1.26 0.27 166 XM_B_Phish66 1689 0.66 1.21 0.40 167 BAYES_20 1660 2.89 1.19 3.72 168 XM_UB80 1656 0.40 1.18 0.02 169 XMBody_78 1640 0.65 1.17 0.40 170 TR_XM_PHPDW 1639 0.58 1.17 0.29 171 MPART_ALT_DIFF_COUNT 1630 0.84 1.17 0.69 172 TR_XM_PHPForged 1628 0.58 1.16 0.29 173 TR_XM_FormFill2 1620 0.57 1.16 0.29 174 TR_XM_InvalidRelay 1600 0.38 1.14 0.01 175 URI_NOVOWEL 1598 1.20 1.14 1.23 176 XM_H_PHPOS 1579 0.56 1.13 0.28 177 LongTLD 1550 0.68 1.11 0.47 178 XMClaimOffer 1542 0.49 1.10 0.20 179 TR_XM_SEO4 1517 0.43 1.09 0.11 180 TR_Mismatch_TLD_02 1491 0.40 1.07 0.08 181 SHOPIFY_IMG_NOT_RCVD_SFY 1479 0.54 1.06 0.29 182 RDNS_DYNAMIC 1471 0.45 1.05 0.15 183 TR_Symld_Words 1450 1.33 1.04 1.47 184 TR_XM_Base64_M1 1449 0.78 1.04 0.66 185 TM2_M_OBFU_COMMENT 1440 0.51 1.03 0.26 186 TR_XM_DK_SendGrid 1440 1.06 1.03 1.07 187 XM_UB60 1439 0.40 1.03 0.09 188 STY_INVIS_DIRECT 1427 0.58 1.02 0.36 189 DKIM_ADSP_CUSTOM_MED 1420 0.91 1.02 0.86 190 THIS_AD 1400 0.48 1.00 0.23 191 XM_OfRef7 1395 0.41 1.00 0.12 192 XM_DIRTYINTL 1394 0.36 1.00 0.06 193 RCVD_IN_IADB_VOUCHED 1384 2.04 0.99 2.56 194 T_MONEY_PERCENT 1364 0.51 0.98 0.28 195 TR_LOTS_OF_MONEY2 1364 0.51 0.98 0.28 196 HTML_TAG_BALANCE_BODY 1362 0.69 0.97 0.56 197 HTTPS_HTTP_MISMATCH 1331 0.79 0.95 0.70 198 PLING_QUERY 1317 0.52 0.94 0.32 199 XMSlimDrugH 1313 0.69 0.94 0.56 200 HK_RANDOM_REPLYTO 1295 0.36 0.93 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 248510 89.39 94.91 86.70 2 RELAYCOUNTRY_US 237271 82.22 81.09 82.78 3 DKIM_SIGNED 226126 82.56 90.09 78.89 4 XM_DK_Pass 222972 80.48 86.01 77.79 5 DKIM_VALID 220138 79.48 84.96 76.80 6 XM_B_Unicode 206468 76.00 84.13 72.03 7 DKIM_VALID_AU 179294 63.96 66.86 62.55 8 BAYES_50 176983 54.13 38.52 61.74 9 DCC_CHECK_NEGATIVE 164867 46.60 24.21 57.52 10 XMListUnsubscribeExists 146458 56.38 67.23 51.10 11 XM_B_SpammyWords 132787 53.75 68.97 46.33 12 XM_B_Unicode3 121912 44.32 47.99 42.53 13 DCC_CHECK 121633 52.93 74.45 42.43 14 DKIM_VALID_EF 90320 31.54 31.60 31.51 15 T_TM2_M_HEADER_IN_MSG 83674 26.10 19.77 29.19 16 LOC_TINY_FONT_1 81969 34.77 47.43 28.60 17 HTML_FONT_LOW_CONTRAST 77898 29.88 35.42 27.18 18 FVGT_m_MULTI_ODD 74103 28.68 34.47 25.85 19 T_KAM_HTML_FONT_INVALID 70245 26.22 29.74 24.51 20 XMSubLong 66572 23.20 23.16 23.23 21 MIME_HTML_ONLY 55281 22.14 27.99 19.29 22 XM_B_SpammyWords2 54575 26.04 40.38 19.04 23 RCVD_IN_MSPIKE_WL 52558 15.68 10.22 18.34 24 RCVD_IN_MSPIKE_H2 46047 17.00 18.92 16.06 25 USER_IN_DEF_DKIM_WL 41750 10.76 2.96 14.57 26 XM_Multi_Part_URI 41458 16.89 21.87 14.46 27 TR_XM_DK_Unsub 41060 16.94 22.31 14.32 28 ALL_TRUSTED 40279 9.91 1.41 14.05 29 UNPARSEABLE_RELAY 35786 14.51 18.65 12.48 30 BAYES_00 28898 6.95 0.52 10.08 31 FSL_BULK_SIG 28047 10.26 11.24 9.78 32 XM_B_Unsub 26177 12.44 19.23 9.13 33 XM_B_PhoneNumber 25506 7.82 5.60 8.90 34 RCVD_IN_MSPIKE_H3 24805 7.76 5.94 8.65 35 XM_Evil_Numbers_Gen 23610 8.64 9.45 8.24 36 TooManyTo_001 23594 7.35 5.53 8.23 37 LotsOfNums_01 23526 7.68 6.59 8.21 38 TR_XM_DK_Bayes 20829 5.02 0.41 7.27 39 BAYES_60 20712 7.65 8.51 7.23 40 TR_XM_DK_Bayes1 20493 4.94 0.40 7.15 41 XM_DKIMWhitelistDomains 20480 4.81 0.02 7.14 42 TR_XM_BayesUnsub 20084 10.75 18.43 7.01 43 LOTS_OF_MONEY 19716 9.03 13.43 6.88 44 TR_MAX_INTL_RELAY 17652 9.61 16.68 6.16 45 TR_XM_DK_Bayes2 17417 4.16 0.24 6.08 46 XM_H_GMP 17248 5.94 5.77 6.02 47 T_TooManySym_01 17240 4.88 2.57 6.01 48 RCVD_IN_MSPIKE_H5 17141 4.73 2.17 5.98 49 XM_B_SpammyWords3 17059 8.76 14.52 5.95 50 MIME_QP_LONG_LINE 16248 5.17 4.15 5.67 51 XM_H_Long_From01 16011 5.71 5.95 5.59 52 XM_DK_Undo_02 15605 17.76 43.03 5.44 53 XM_B_Phish_Phrases 15164 6.31 8.40 5.29 54 BAYES_40 14777 4.01 1.67 5.16 55 MPART_ALT_DIFF 13719 5.15 5.91 4.79 56 XMStrtUSub 13302 4.43 3.98 4.64 57 TR_XM_SpammyWords4 13215 7.05 12.06 4.61 58 XM_PDF 13204 3.40 0.92 4.61 59 HTML_IMAGE_RATIO_02 12953 5.26 6.78 4.52 60 HTML_IMAGE_RATIO_04 12828 4.47 4.45 4.48 61 XM_UncommonTLD01 11901 4.89 6.39 4.15 62 BOTNET_IPINHOSTNAME 11183 6.66 12.33 3.90 63 RCVD_IN_IADB_LISTED 11102 3.19 1.77 3.87 64 RCVD_IN_VALIDITY_SAFE 10797 3.34 2.47 3.77 65 BAYES_80 10790 5.88 10.23 3.76 66 MAILING_LIST_MULTI 10690 3.11 1.84 3.73 67 BAYES_20 10668 2.89 1.19 3.72 68 RCVD_IN_MSPIKE_H4 10612 3.18 2.12 3.70 69 T_REMOTE_IMAGE 10529 3.30 2.55 3.67 70 BAYES_99 10383 12.69 31.27 3.62 71 RELAYCOUNTRY_META 10304 8.27 17.84 3.59 72 XMNumbers 10144 3.49 3.39 3.54 73 ANY_BOUNCE_MESSAGE 9992 2.98 1.93 3.49 74 BOUNCE_MESSAGE 9991 2.97 1.93 3.49 75 RCVD_IN_IADB_SPF 9796 2.79 1.51 3.42 76 T_TooManySym_02 9323 2.38 0.58 3.25 77 RCVD_IN_VALIDITY_CERTIFIED 8905 2.79 2.15 3.11 78 RCVD_IN_IADB_SENDERID 8777 2.52 1.39 3.06 79 RCVD_IN_IADB_DK 8440 2.44 1.41 2.94 80 XMSubMetaSx_00 8422 4.05 6.32 2.94 81 HTML_IMAGE_RATIO_06 8378 2.78 2.49 2.92 82 XM_B_SpammyTLD 8082 3.29 4.24 2.82 83 BAYES_999 7828 9.70 23.98 2.73 84 MIME_HTML_MOSTLY 7787 3.07 3.80 2.72 85 XM_CamelCaseFrm001 7745 3.17 4.12 2.70 86 XM_Body_Dirty_Words 7663 3.86 6.29 2.67 87 TooManyTo_002 7491 2.05 0.89 2.61 88 HTML_MIME_NO_HTML_TAG 7356 2.23 1.54 2.57 89 RCVD_IN_IADB_VOUCHED 7334 2.04 0.99 2.56 90 MIME_HTML_ONLY_MULTI 7294 2.69 2.98 2.54 91 INVALID_MSGID 7209 1.77 0.23 2.52 92 HTML_IMAGE_RATIO_08 7145 2.85 3.59 2.49 93 BAYES_95 6860 3.58 6.03 2.39 94 BAYES_05 6564 1.78 0.74 2.29 95 MSGID_NOFQDN1 6440 1.52 0.02 2.25 96 TR_XM_DKIM_Undo 6394 11.48 30.44 2.23 97 TO_MALFORMED 6327 1.49 0.01 2.21 98 DKIM_INVALID 5988 3.08 5.12 2.09 99 XM_B_URI_Unicode 5982 2.30 2.74 2.09 100 XMDiploma_00 5435 2.23 2.90 1.90 101 TR_XM_SpammyRelay 5368 5.52 13.00 1.87 102 RCVD_IN_IADB_OPTIN 5279 1.44 0.63 1.84 103 T_XMDrugObfuBody_14 5198 2.65 4.38 1.81 104 XM_SendGrid 5003 1.84 2.05 1.75 105 TM2_M_URI_OPT_OUT 4897 1.85 2.15 1.71 106 XM_B_Investor 4836 2.56 4.36 1.69 107 SUBJ_ALL_CAPS 4775 2.15 3.14 1.67 108 TM2_M_VERY_LONG_WORD 4720 2.25 3.50 1.65 109 TR_XM_SpammyWords5 4692 2.30 3.67 1.64 110 XM_B_Unsub2 4686 2.09 3.03 1.63 111 TR_XM_PhishingBody 4649 2.45 4.14 1.62 112 TR_XM_UnparsRelay 4645 4.33 9.90 1.62 113 BOTNET 4619 4.52 10.49 1.61 114 XM_DK_Undo_01 4559 1.50 1.33 1.59 115 TooManyTo_003 4556 1.32 0.77 1.59 116 FROM_EXCESS_BASE64 4553 1.86 2.41 1.59 117 T_XMDrugObfuBody_08 4459 2.22 3.59 1.56 118 TR_MetaPhish_Combo_01 4427 1.31 0.82 1.54 119 XMGappySubj_01 4417 1.12 0.25 1.54 120 UNTRUSTED_Relay 4364 3.41 7.29 1.52 121 KHOP_HELO_FCRDNS 4233 1.48 1.50 1.48 122 TR_Symld_Words 4217 1.33 1.04 1.47 123 XM_GoogleGroups 4209 1.24 0.77 1.47 124 RCVD_IN_MSPIKE_BL 4209 3.76 8.46 1.47 125 TR_XM_MSPIKECOMBO 4208 3.76 8.46 1.47 126 XMStockSpam_06 4181 1.67 2.10 1.46 127 IN_HORDE_ADDRESS_BOOK 4038 0.98 0.09 1.41 128 TR_DCC_Bayes_99 3950 8.21 22.22 1.38 129 T_TooManySym_03 3943 0.99 0.20 1.38 130 URI_HEX 3880 1.37 1.40 1.35 131 RCVD_IN_MSPIKE_L3 3761 2.13 3.80 1.31 132 XM_SPF_SoftFail 3725 2.02 3.50 1.30 133 URI_NOVOWEL 3515 1.20 1.14 1.23 134 TooManyTo_004 3495 1.03 0.65 1.22 135 TVD_RCVD_IP 3371 1.07 0.84 1.18 136 T_FILL_THIS_FORM_SHORT 3215 1.45 2.11 1.12 137 HELO_NODOT 3167 0.80 0.17 1.10 138 HELO_NO_DOMAIN 3159 0.79 0.16 1.10 139 XM_B_SpammyWords4 3145 1.67 2.84 1.10 140 XMGenDplmaNmb 3102 1.33 1.85 1.08 141 TR_XM_DK_SendGrid 3074 1.06 1.03 1.07 142 T_XMDrugObfuBody_00 2981 1.21 1.55 1.04 143 XM_ShortIntro_01 2874 0.83 0.47 1.00 144 TooManyTo_005 2848 0.87 0.60 0.99 145 XMCapTrack 2844 0.85 0.56 0.99 146 XM_UB50 2839 1.50 2.56 0.99 147 TVD_SPACE_RATIO 2804 0.69 0.08 0.98 148 FROM_GOV_DKIM_AU 2676 0.67 0.12 0.93 149 XMBrknScrpt_02 2654 1.28 1.99 0.93 150 XMSexyCombo_05 2616 1.92 3.97 0.91 151 XM_ProductURIs 2592 1.33 2.21 0.90 152 XM_OfRef6 2552 1.69 3.32 0.89 153 DKIM_ADSP_CUSTOM_MED 2472 0.91 1.02 0.86 154 XM_H_Long_From02 2468 0.99 1.26 0.86 155 XMGappySubj_02 2353 0.56 0.04 0.82 156 XM_H_PHPMailer 2289 0.69 0.47 0.80 157 T_TVD_MIME_NO_HEADERS 2274 0.56 0.07 0.79 158 XMBSHREFv2 2267 0.69 0.49 0.79 159 XMNoVowels 2186 0.66 0.46 0.76 160 XM_B_COPY_HTML 2144 0.92 1.27 0.75 161 RCVD_IN_PBL 2138 0.93 1.31 0.75 162 T_Symld_Words_02 2035 0.94 1.40 0.71 163 TR_XM_SpammyWords3 2033 2.26 5.45 0.71 164 RELAYCOUNTRY_CA 2026 2.60 6.49 0.71 165 HTTPS_HTTP_MISMATCH 2020 0.79 0.95 0.70 166 RELAYCOUNTRY_AU 1979 1.46 3.04 0.69 167 MPART_ALT_DIFF_COUNT 1966 0.84 1.17 0.69 168 SpammyFromTLD_01 1913 1.03 1.78 0.67 169 RCVD_IN_BL_SPAMCOP_NET 1906 4.84 13.41 0.66 170 TR_XM_Base64_M1 1894 0.78 1.04 0.66 171 RELAYCOUNTRY_GB 1887 0.70 0.79 0.66 172 RCVD_IN_PSBL 1813 1.36 2.85 0.63 173 HTML_IMAGE_ONLY_32 1797 0.52 0.29 0.63 174 T_OBFU_PDF_ATTACH 1781 0.46 0.12 0.62 175 T_XMHurry_00 1682 0.95 1.68 0.59 176 FORGED_GMAIL_RCVD 1661 0.64 0.78 0.58 177 XMSlimDrugH 1616 0.69 0.94 0.56 178 TRACKER_ID 1610 0.45 0.21 0.56 179 XMPhish30 1607 0.87 1.51 0.56 180 HTML_TAG_BALANCE_BODY 1597 0.69 0.97 0.56 181 URI_TRY_3LD 1559 0.93 1.73 0.54 182 NML_ADSP_CUSTOM_MED 1473 0.61 0.82 0.51 183 T_MANY_PILL_PRICE 1451 0.34 0.00 0.51 184 TR_XM_GMP_MSPIKE_UNDO2 1446 0.40 0.19 0.50 185 HTML_IMAGE_ONLY_20 1443 0.60 0.80 0.50 186 TO_NO_BRKTS_HTML_ONLY 1437 0.41 0.22 0.50 187 HTML_FONT_FACE_BAD 1381 0.52 0.60 0.48 188 MSGID_FROM_MTA_HEADER 1351 0.41 0.29 0.47 189 TR_XM_SpammyWords2 1350 3.83 10.72 0.47 190 LongTLD 1350 0.68 1.11 0.47 191 XMDateMe_00 1341 0.55 0.72 0.47 192 XMSubMetaSxObfu_03 1308 0.58 0.82 0.46 193 TR_LOTS_OF_MONEY3 1284 0.83 1.62 0.45 194 XM_URI_RBL 1276 1.47 3.57 0.45 195 SpammyFromTLD_02 1248 1.08 2.41 0.44 196 XMBody_95 1225 0.32 0.11 0.43 197 XMMoneyMeta_00 1173 0.46 0.56 0.41 198 XMPhish14 1160 0.55 0.84 0.40 199 XM_B_Phish66 1140 0.66 1.21 0.40 200 XMBody_78 1140 0.65 1.17 0.40 ----------------------------------------------------------------------