Email: 530322 Autolearn: 0 AvgScore: 4.45 AvgScanTime: 1.35 sec Spam: 142830 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.63 sec Ham: 387492 Autolearn: 0 AvgScore: 0.81 AvgScanTime: 1.24 sec Time Spent Running SA: 198.52 hours Time Spent Processing Spam: 64.55 hours Time Spent Processing Ham: 133.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135680 89.93 94.99 88.06 2 DKIM_SIGNED 126889 70.31 88.84 63.48 3 XM_B_Unicode 122495 75.57 85.76 71.82 4 XM_DK_Pass 119310 68.11 83.53 62.43 5 DKIM_VALID 118285 67.28 82.82 61.55 6 RELAYCOUNTRY_US 116146 79.60 81.32 78.97 7 XM_B_SpammyWords 97142 49.25 68.01 42.33 8 DCC_CHECK 95411 37.65 66.80 26.91 9 XMListUnsubscribeExists 93533 46.83 65.49 39.95 10 DKIM_VALID_AU 92151 54.31 64.52 50.55 11 XM_B_Unicode3 71625 45.24 50.15 43.43 12 LOC_TINY_FONT_1 65427 30.03 45.81 24.22 13 XM_DK_Undo_02 58207 14.30 40.75 4.55 14 BAYES_50 57352 53.13 40.15 57.91 15 XM_B_SpammyWords2 56466 22.80 39.53 16.63 16 HTML_FONT_LOW_CONTRAST 49754 26.05 34.83 22.81 17 FVGT_m_MULTI_ODD 48405 24.59 33.89 21.16 18 DCC_CHECK_NEGATIVE 45481 61.94 31.84 73.04 19 DKIM_VALID_EF 45030 27.37 31.53 25.84 20 MIME_HTML_ONLY 42952 26.75 30.07 25.53 21 BAYES_99 42592 10.27 29.82 3.07 22 T_KAM_HTML_FONT_INVALID 41354 23.53 28.95 21.54 23 TR_XM_DKIM_Undo 41282 9.11 28.90 1.81 24 XMSubLong 38371 24.74 26.86 23.96 25 BAYES_999 32288 7.79 22.61 2.33 26 TR_XM_DK_Unsub 31687 14.08 22.19 11.09 27 T_TM2_M_HEADER_IN_MSG 30804 25.71 21.57 27.24 28 XM_Multi_Part_URI 30189 14.04 21.14 11.43 29 RCVD_IN_MSPIKE_H2 28587 15.51 20.01 13.84 30 UNPARSEABLE_RELAY 27636 12.42 19.35 9.87 31 XM_B_Unsub 27044 10.45 18.93 7.32 32 TR_DCC_Bayes_99 26595 5.72 18.62 0.97 33 TR_XM_BayesUnsub 26094 9.02 18.27 5.61 34 RELAYCOUNTRY_META 25372 6.70 17.76 2.62 35 TR_MAX_INTL_RELAY 22673 8.01 15.87 5.12 36 XM_B_SpammyWords3 22269 7.18 15.59 4.08 37 BOTNET_IPINHOSTNAME 19582 13.70 13.71 13.70 38 LOTS_OF_MONEY 19489 7.97 13.64 5.88 39 TR_XM_SpammyRelay 19049 4.54 13.34 1.30 40 RCVD_IN_BL_SPAMCOP_NET 17370 3.66 12.16 0.52 41 TR_XM_SpammyWords4 17163 6.27 12.02 4.15 42 XM_Evil_Numbers_Gen 15199 9.62 10.64 9.25 43 TR_XM_UnparsRelay 15107 3.99 10.58 1.56 44 RCVD_IN_MSPIKE_WL 14985 13.96 10.49 15.24 45 BOTNET 14198 3.70 9.94 1.40 46 BAYES_80 14022 5.03 9.82 3.27 47 TR_XM_SpammyWords2 13120 2.78 9.19 0.41 48 XM_B_Phish_Phrases 12729 5.47 8.91 4.20 49 FSL_BULK_SIG 12246 4.64 8.57 3.19 50 BAYES_60 11305 6.43 7.92 5.88 51 MPART_ALT_DIFF 10173 8.43 7.12 8.91 52 RELAYCOUNTRY_CA 9751 2.23 6.83 0.54 53 XM_UncommonTLD01 9503 4.18 6.65 3.27 54 UNTRUSTED_Relay 9370 2.68 6.56 1.25 55 XM_Body_Dirty_Words 9185 3.35 6.43 2.21 56 LotsOfNums_01 9135 7.10 6.40 7.37 57 XM_B_PhoneNumber 8980 7.47 6.29 7.90 58 TR_XM_SPAMCOP 8864 1.80 6.21 0.18 59 TR_XM_MSPIKECOMBO 8776 2.34 6.14 0.93 60 RCVD_IN_MSPIKE_BL 8776 2.34 6.14 0.93 61 DKIM_INVALID 8604 3.03 6.02 1.93 62 HTML_IMAGE_RATIO_04 8520 11.89 5.97 14.07 63 XMSubMetaSx_00 8415 3.48 5.89 2.59 64 XM_B_Investor 8236 2.58 5.77 1.41 65 RCVD_IN_MSPIKE_H3 8183 6.64 5.73 6.97 66 BAYES_95 8126 2.88 5.69 1.85 67 XM_H_Long_From01 7469 4.65 5.23 4.44 68 HTML_IMAGE_RATIO_02 7416 3.92 5.19 3.45 69 XM_H_GMP 7316 5.19 5.12 5.22 70 TR_XM_SpammyWords3 6933 1.65 4.85 0.47 71 TR_XM_PhishingBody 6517 2.32 4.56 1.50 72 XM_OfRef6 6347 1.69 4.44 0.67 73 T_XMDrugObfuBody_14 6087 2.26 4.26 1.52 74 MIME_HTML_MOSTLY 5916 2.55 4.14 1.96 75 XMStrtUSub 5886 8.72 4.12 10.42 76 HTML_IMAGE_RATIO_06 5770 4.42 4.04 4.55 77 XMSexyCombo_05 5758 1.88 4.03 1.09 78 RCVD_IN_MSPIKE_L3 5537 1.63 3.88 0.81 79 MIME_HTML_ONLY_MULTI 5532 6.25 3.87 7.13 80 XM_B_SpammyTLD 5482 2.98 3.84 2.66 81 TooManyTo_001 5309 5.96 3.72 6.78 82 TM2_M_VERY_LONG_WORD 5293 2.62 3.71 2.22 83 XM_URI_RBL 5220 1.16 3.65 0.24 84 TR_XM_SpammyWords5 5156 1.83 3.61 1.18 85 XMNumbers 5025 3.06 3.52 2.89 86 T_XMDrugObfuBody_08 4918 1.82 3.44 1.23 87 XM_B_Unsub2 4897 1.88 3.43 1.31 88 MIME_QP_LONG_LINE 4865 4.37 3.41 4.72 89 XM_UB50 4559 1.48 3.19 0.85 90 XMDiploma_00 4456 1.78 3.12 1.29 91 USER_IN_DEF_DKIM_WL 4278 8.42 3.00 10.42 92 TR_XM_INV_DKIM 4275 0.82 2.99 0.01 93 T_TooManySym_01 4256 4.54 2.98 5.12 94 RELAYCOUNTRY_AU 4200 1.07 2.94 0.38 95 XM_B_URI_Unicode 4186 2.29 2.93 2.05 96 XM_SPF_SoftFail 4135 2.08 2.90 1.78 97 TR_XM_NoHeaderRelay 3982 0.84 2.79 0.12 98 HTML_FONT_FACE_BAD 3976 9.10 2.78 11.42 99 XM_CamelCaseFrm001 3950 1.86 2.77 1.53 100 HTML_IMAGE_RATIO_08 3711 2.33 2.60 2.23 101 XMSubNoVowel 3680 3.02 2.58 3.18 102 RCVD_IN_MSPIKE_H5 3580 4.42 2.51 5.13 103 SpammyFromTLD_02 3546 0.96 2.48 0.40 104 BAYES_40 3519 5.28 2.46 6.32 105 RCVD_IN_VALIDITY_SAFE 3409 2.94 2.39 3.14 106 T_FILL_THIS_FORM_SHORT 3373 1.16 2.36 0.71 107 XMSubLongNoVowel 3263 1.49 2.28 1.19 108 XM_B_SpammyWords4 3247 1.07 2.27 0.63 109 RCVD_IN_MSPIKE_H4 3222 2.90 2.26 3.14 110 XMSubGarbage 3133 1.45 2.19 1.18 111 XMStockSpam_06 3057 1.34 2.14 1.05 112 RCVD_IN_VALIDITY_CERTIFIED 3056 2.50 2.14 2.63 113 XMBody_17 2950 0.79 2.07 0.32 114 XMGenDplmaNmb 2912 1.04 2.04 0.67 115 TR_XM_INTL_Spamhaus 2873 0.65 2.01 0.15 116 MAILING_LIST_MULTI 2847 2.82 1.99 3.12 117 TM2_M_URI_OPT_OUT 2847 1.68 1.99 1.57 118 RCVD_IN_VALIDITY_RPBL 2788 0.55 1.95 0.03 119 KHOP_HELO_FCRDNS 2753 2.06 1.93 2.11 120 XM_SendGrid 2751 1.45 1.93 1.28 121 SpammyFromTLD_01 2704 0.99 1.89 0.66 122 DATE_IN_PAST_03_06 2668 0.76 1.87 0.35 123 FROM_EXCESS_BASE64 2505 1.40 1.75 1.27 124 RCVD_IN_MSPIKE_L4 2474 0.54 1.73 0.11 125 T_XMHurry_00 2455 0.86 1.72 0.54 126 TR_LOTS_OF_MONEY3 2416 0.71 1.69 0.34 127 TR_XM_MSPIKECOMBO2 2395 0.51 1.68 0.08 128 XMBrknScrpt_02 2386 0.92 1.67 0.64 129 TR_Mismatch_TLD_02 2357 0.49 1.65 0.06 130 SUBJ_ALL_CAPS 2318 1.30 1.62 1.18 131 HTML_MIME_NO_HTML_TAG 2315 3.81 1.62 4.61 132 URI_TRY_3LD 2267 0.73 1.59 0.41 133 XMBdyGiftCard01 2233 0.59 1.56 0.23 134 RCVD_IN_SBL_CSS 2225 0.46 1.56 0.06 135 RCVD_IN_IADB_LISTED 2201 2.29 1.54 2.57 136 RCVD_IN_XBL 2151 0.41 1.51 0.01 137 RCVD_IN_PSBL 2135 0.77 1.49 0.51 138 URI_HEX 2127 1.14 1.49 1.01 139 T_XMDrugObfuBody_00 2115 0.93 1.48 0.72 140 XM_ProductURIs 2098 0.72 1.47 0.44 141 XM_B_SEO 2088 0.51 1.46 0.16 142 XMPhish30 2064 0.72 1.45 0.45 143 BAYES_20 2059 3.61 1.44 4.40 144 HTML_IMAGE_ONLY_20 2058 0.74 1.44 0.49 145 ALL_TRUSTED 2044 14.07 1.43 18.72 146 XM_H_Long_From02 2043 0.97 1.43 0.81 147 T_Symld_Words_02 2041 0.94 1.43 0.76 148 RDNS_DYNAMIC 2034 0.48 1.42 0.13 149 DIET_1 1984 0.56 1.39 0.25 150 URI_NOVOWEL 1975 1.05 1.38 0.92 151 T_REMOTE_IMAGE 1944 2.67 1.36 3.15 152 RCVD_IN_PBL 1934 0.78 1.35 0.57 153 SHORTCIRCUIT 1920 0.36 1.34 0.00 154 RCVD_IN_ZEN_LASTEXTERNAL 1920 0.36 1.34 0.00 155 RCVD_IN_IADB_SPF 1908 2.05 1.34 2.32 156 BOTNET_NORDNS 1900 0.36 1.33 0.00 157 TR_XM_MaxSPIKE 1897 0.39 1.33 0.04 158 XM_B_Phish66 1884 0.58 1.32 0.31 159 XM_HighProb1 1846 0.35 1.29 0.00 160 XM_DK_Undo_01 1834 1.38 1.28 1.42 161 RCVD_IN_IADB_DK 1793 1.82 1.26 2.03 162 TR_XM_RelayPhish 1761 0.38 1.23 0.07 163 RCVD_IN_IADB_SENDERID 1759 1.87 1.23 2.10 164 HTTPS_HTTP_MISMATCH 1754 0.79 1.23 0.63 165 TR_XM_SEO4 1728 0.37 1.21 0.07 166 TR_LOTS_OF_MONEY2 1722 0.48 1.21 0.21 167 T_MONEY_PERCENT 1722 0.48 1.21 0.21 168 TM2_M_OBFU_COMMENT 1720 0.52 1.20 0.27 169 XMMoneyMeta_00 1717 0.59 1.20 0.36 170 MPART_ALT_DIFF_COUNT 1706 0.71 1.19 0.53 171 XM_B_COPY_HTML 1675 0.87 1.17 0.75 172 RELAYCOUNTRY_FR 1650 0.48 1.16 0.23 173 HTML_FONT_TINY_NORDNS 1632 0.37 1.14 0.08 174 HTML_TAG_BALANCE_BODY 1619 0.60 1.13 0.40 175 LOW_PRICE 1614 0.43 1.13 0.17 176 STY_INVIS_DIRECT 1612 0.48 1.13 0.24 177 XMBody_78 1599 0.51 1.12 0.28 178 MultiRelay_CC 1550 0.37 1.09 0.10 179 THIS_AD 1530 0.51 1.07 0.30 180 XMReplyNow 1469 0.42 1.03 0.19 181 TVD_RCVD_IP 1452 1.22 1.02 1.29 182 XM_B_DNDMA 1451 0.59 1.02 0.43 183 RELAYCOUNTRY_GB 1432 0.64 1.00 0.50 184 TR_XM_PHPForged 1428 0.44 1.00 0.24 185 SHOPIFY_IMG_NOT_RCVD_SFY 1418 0.40 0.99 0.18 186 XM_OfRef7 1399 0.34 0.98 0.10 187 TR_XM_FormFill2 1399 0.45 0.98 0.25 188 URIBL_SBL 1398 0.27 0.98 0.01 189 SH_BODYURI_REVERSE_SBL 1398 0.27 0.98 0.01 190 URIBL_SBL_A 1398 0.27 0.98 0.01 191 TR_XM_PHPDW 1388 0.44 0.97 0.24 192 XMHTML_After_End 1383 0.51 0.97 0.34 193 XMSubMetaI_00 1361 0.53 0.95 0.37 194 XM_H_PHPOS 1351 0.43 0.95 0.23 195 LongTLD 1344 0.50 0.94 0.33 196 XM_UB60 1342 0.31 0.94 0.08 197 DKIM_ADSP_CUSTOM_MED 1339 0.76 0.94 0.69 198 HELO_DYNAMIC_SPLIT_IP 1326 0.25 0.93 0.01 199 XM_DIRTYINTL 1310 0.31 0.92 0.08 200 XMSlimDrugH 1296 0.55 0.91 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 341214 89.93 94.99 88.06 2 RELAYCOUNTRY_US 306008 79.60 81.32 78.97 3 DCC_CHECK_NEGATIVE 283013 61.94 31.84 73.04 4 XM_B_Unicode 278292 75.57 85.76 71.82 5 DKIM_SIGNED 245965 70.31 88.84 63.48 6 XM_DK_Pass 241909 68.11 83.53 62.43 7 DKIM_VALID 238497 67.28 82.82 61.55 8 BAYES_50 224392 53.13 40.15 57.91 9 DKIM_VALID_AU 195874 54.31 64.52 50.55 10 XM_B_Unicode3 168283 45.24 50.15 43.43 11 XM_B_SpammyWords 164043 49.25 68.01 42.33 12 XMListUnsubscribeExists 154809 46.83 65.49 39.95 13 T_TM2_M_HEADER_IN_MSG 105545 25.71 21.57 27.24 14 DCC_CHECK 104267 37.65 66.80 26.91 15 DKIM_VALID_EF 100143 27.37 31.53 25.84 16 MIME_HTML_ONLY 98934 26.75 30.07 25.53 17 LOC_TINY_FONT_1 93849 30.03 45.81 24.22 18 XMSubLong 92846 24.74 26.86 23.96 19 HTML_FONT_LOW_CONTRAST 88389 26.05 34.83 22.81 20 T_KAM_HTML_FONT_INVALID 83450 23.53 28.95 21.54 21 FVGT_m_MULTI_ODD 81981 24.59 33.89 21.16 22 ALL_TRUSTED 72557 14.07 1.43 18.72 23 XM_B_SpammyWords2 64421 22.80 39.53 16.63 24 RCVD_IN_MSPIKE_WL 59045 13.96 10.49 15.24 25 BAYES_00 56877 10.93 0.77 14.68 26 HTML_IMAGE_RATIO_04 54524 11.89 5.97 14.07 27 RCVD_IN_MSPIKE_H2 53646 15.51 20.01 13.84 28 BOTNET_IPINHOSTNAME 53082 13.70 13.71 13.70 29 XM_Multi_Part_URI 44293 14.04 21.14 11.43 30 HTML_FONT_FACE_BAD 44263 9.10 2.78 11.42 31 TR_XM_DK_Unsub 42981 14.08 22.19 11.09 32 USER_IN_DEF_DKIM_WL 40379 8.42 3.00 10.42 33 XMStrtUSub 40368 8.72 4.12 10.42 34 UNPARSEABLE_RELAY 38232 12.42 19.35 9.87 35 XM_Evil_Numbers_Gen 35842 9.62 10.64 9.25 36 MPART_ALT_DIFF 34530 8.43 7.12 8.91 37 XM_B_PhoneNumber 30616 7.47 6.29 7.90 38 LotsOfNums_01 28540 7.10 6.40 7.37 39 XM_B_Unsub 28351 10.45 18.93 7.32 40 MIME_HTML_ONLY_MULTI 27609 6.25 3.87 7.13 41 RCVD_IN_MSPIKE_H3 27018 6.64 5.73 6.97 42 TooManyTo_001 26284 5.96 3.72 6.78 43 BAYES_40 24473 5.28 2.46 6.32 44 TR_XM_DK_Bayes 23163 4.51 0.55 5.98 45 TR_XM_DK_Bayes1 22816 4.45 0.54 5.89 46 LOTS_OF_MONEY 22792 7.97 13.64 5.88 47 BAYES_60 22784 6.43 7.92 5.88 48 XM_DKIMWhitelistDomains 22029 4.16 0.02 5.69 49 TR_XM_BayesUnsub 21746 9.02 18.27 5.61 50 XM_H_GMP 20208 5.19 5.12 5.22 51 RCVD_IN_MSPIKE_H5 19877 4.42 2.51 5.13 52 T_TooManySym_01 19822 4.54 2.98 5.12 53 TR_MAX_INTL_RELAY 19821 8.01 15.87 5.12 54 TR_XM_DK_Bayes2 19072 3.66 0.23 4.92 55 MIME_QP_LONG_LINE 18284 4.37 3.41 4.72 56 ANY_BOUNCE_MESSAGE 18197 3.66 0.86 4.70 57 BOUNCE_MESSAGE 18194 3.66 0.86 4.70 58 HTML_MIME_NO_HTML_TAG 17882 3.81 1.62 4.61 59 HTML_IMAGE_RATIO_06 17647 4.42 4.04 4.55 60 XM_DK_Undo_02 17612 14.30 40.75 4.55 61 XM_H_Long_From01 17206 4.65 5.23 4.44 62 BAYES_20 17062 3.61 1.44 4.40 63 XM_B_Phish_Phrases 16273 5.47 8.91 4.20 64 TR_XM_SpammyWords4 16076 6.27 12.02 4.15 65 XM_B_SpammyWords3 15808 7.18 15.59 4.08 66 XM_PDF 14235 2.87 0.70 3.67 67 HTML_IMAGE_RATIO_02 13360 3.92 5.19 3.45 68 BAYES_80 12669 5.03 9.82 3.27 69 XM_UncommonTLD01 12665 4.18 6.65 3.27 70 FSL_BULK_SIG 12369 4.64 8.57 3.19 71 XMSubNoVowel 12326 3.02 2.58 3.18 72 T_REMOTE_IMAGE 12192 2.67 1.36 3.15 73 RCVD_IN_VALIDITY_SAFE 12186 2.94 2.39 3.14 74 RCVD_IN_MSPIKE_H4 12150 2.90 2.26 3.14 75 MAILING_LIST_MULTI 12106 2.82 1.99 3.12 76 BAYES_99 11894 10.27 29.82 3.07 77 TO_NO_BRKTS_HTML_ONLY 11236 2.15 0.13 2.90 78 XMNumbers 11182 3.06 3.52 2.89 79 T_TooManySym_02 11003 2.26 0.70 2.84 80 UNICODE_OBFU_ASC 10948 2.10 0.13 2.83 81 XM_B_SpammyTLD 10319 2.98 3.84 2.66 82 RCVD_IN_VALIDITY_CERTIFIED 10210 2.50 2.14 2.63 83 BAYES_05 10187 2.08 0.58 2.63 84 RELAYCOUNTRY_META 10171 6.70 17.76 2.62 85 XMSubMetaSx_00 10039 3.48 5.89 2.59 86 MIME_HEADER_CTYPE_ONLY 10033 1.91 0.06 2.59 87 RCVD_IN_IADB_LISTED 9963 2.29 1.54 2.57 88 BAYES_999 9023 7.79 22.61 2.33 89 RCVD_IN_IADB_SPF 8981 2.05 1.34 2.32 90 HTML_IMAGE_RATIO_08 8654 2.33 2.60 2.23 91 TM2_M_VERY_LONG_WORD 8598 2.62 3.71 2.22 92 XM_Body_Dirty_Words 8562 3.35 6.43 2.21 93 KHOP_HELO_FCRDNS 8164 2.06 1.93 2.11 94 RCVD_IN_IADB_SENDERID 8145 1.87 1.23 2.10 95 TooManyTo_002 8028 1.68 0.60 2.07 96 XM_B_URI_Unicode 7961 2.29 2.93 2.05 97 RCVD_IN_IADB_DK 7855 1.82 1.26 2.03 98 MIME_HTML_MOSTLY 7593 2.55 4.14 1.96 99 DKIM_INVALID 7468 3.03 6.02 1.93 100 INVALID_MSGID 7178 1.44 0.33 1.85 101 BAYES_95 7151 2.88 5.69 1.85 102 TR_XM_DKIM_Undo 7020 9.11 28.90 1.81 103 XM_SPF_SoftFail 6880 2.08 2.90 1.78 104 MSGID_NOFQDN1 6374 1.23 0.12 1.64 105 TO_MALFORMED 6340 1.20 0.02 1.64 106 RCVD_IN_IADB_VOUCHED 6169 1.37 0.78 1.59 107 TM2_M_URI_OPT_OUT 6075 1.68 1.99 1.57 108 TR_XM_UnparsRelay 6061 3.99 10.58 1.56 109 XM_CamelCaseFrm001 5924 1.86 2.77 1.53 110 T_XMDrugObfuBody_14 5877 2.26 4.26 1.52 111 TR_XM_PhishingBody 5794 2.32 4.56 1.50 112 XM_DK_Undo_01 5508 1.38 1.28 1.42 113 XM_B_Investor 5458 2.58 5.77 1.41 114 BOTNET 5423 3.70 9.94 1.40 115 TR_Symld_Words 5291 1.20 0.75 1.37 116 XM_B_Unsub2 5088 1.88 3.43 1.31 117 TR_XM_SpammyRelay 5026 4.54 13.34 1.30 118 XMDiploma_00 5003 1.78 3.12 1.29 119 TVD_RCVD_IP 4996 1.22 1.02 1.29 120 XM_SendGrid 4960 1.45 1.93 1.28 121 FROM_EXCESS_BASE64 4925 1.40 1.75 1.27 122 UNTRUSTED_Relay 4858 2.68 6.56 1.25 123 TooManyTo_003 4817 1.05 0.52 1.24 124 T_XMDrugObfuBody_08 4749 1.82 3.44 1.23 125 XMSubLongNoVowel 4628 1.49 2.28 1.19 126 TR_XM_SpammyWords5 4571 1.83 3.61 1.18 127 XMSubGarbage 4556 1.45 2.19 1.18 128 SUBJ_ALL_CAPS 4554 1.30 1.62 1.18 129 XM_GoogleGroups 4476 1.08 0.87 1.16 130 RCVD_IN_IADB_OPTIN 4392 0.96 0.48 1.13 131 T_TooManySym_03 4388 0.88 0.19 1.13 132 XMGappySubj_01 4231 0.83 0.13 1.09 133 IN_HORDE_ADDRESS_BOOK 4226 0.82 0.08 1.09 134 XMSexyCombo_05 4224 1.88 4.03 1.09 135 HELO_NODOT 4135 0.83 0.18 1.07 136 HELO_NO_DOMAIN 4118 0.81 0.11 1.06 137 XMStockSpam_06 4060 1.34 2.14 1.05 138 FROM_GOV_DKIM_AU 4006 0.89 0.49 1.03 139 URI_HEX 3924 1.14 1.49 1.01 140 XM_E_Blogspot 3825 0.74 0.08 0.99 141 TR_DCC_Bayes_99 3742 5.72 18.62 0.97 142 RCVD_IN_MSPIKE_BL 3612 2.34 6.14 0.93 143 TR_XM_MSPIKECOMBO 3611 2.34 6.14 0.93 144 XMCapTrack 3593 0.82 0.54 0.93 145 URI_NOVOWEL 3583 1.05 1.38 0.92 146 TooManyTo_004 3553 0.79 0.45 0.92 147 XMNoVowels 3380 0.81 0.63 0.87 148 XM_UB50 3277 1.48 3.19 0.85 149 TR_XM_DK_SendGrid 3173 0.83 0.88 0.82 150 RCVD_IN_MSPIKE_L3 3130 1.63 3.88 0.81 151 XM_H_Long_From02 3121 0.97 1.43 0.81 152 XM_ShortIntro_01 3062 0.70 0.45 0.79 153 TVD_SPACE_RATIO 3007 0.59 0.10 0.78 154 TooManyTo_005 2961 0.67 0.42 0.76 155 T_Symld_Words_02 2940 0.94 1.43 0.76 156 XM_B_COPY_HTML 2918 0.87 1.17 0.75 157 TR_MetaPhish_Combo_01 2863 0.73 0.71 0.74 158 T_XMDrugObfuBody_00 2793 0.93 1.48 0.72 159 T_FILL_THIS_FORM_SHORT 2754 1.16 2.36 0.71 160 DKIM_ADSP_CUSTOM_MED 2673 0.76 0.94 0.69 161 XM_OfRef6 2604 1.69 4.44 0.67 162 XMGenDplmaNmb 2588 1.04 2.04 0.67 163 SpammyFromTLD_01 2556 0.99 1.89 0.66 164 XM_H_PHPMailer 2536 0.60 0.45 0.65 165 XMBrknScrpt_02 2490 0.92 1.67 0.64 166 XMLngstWrd_00 2489 0.68 0.79 0.64 167 HTTPS_HTTP_MISMATCH 2436 0.79 1.23 0.63 168 XM_B_SpammyWords4 2436 1.07 2.27 0.63 169 TR_XM_Base64_M1 2250 0.62 0.74 0.58 170 TM2_M_BODY_EMPTY 2235 0.47 0.16 0.58 171 RCVD_IN_PBL 2213 0.78 1.35 0.57 172 XMBSHREFv2 2182 0.52 0.39 0.56 173 T_XMHurry_00 2089 0.86 1.72 0.54 174 RELAYCOUNTRY_CA 2087 2.23 6.83 0.54 175 MPART_ALT_DIFF_COUNT 2053 0.71 1.19 0.53 176 XMGappySubj_02 2053 0.39 0.03 0.53 177 RCVD_IN_BL_SPAMCOP_NET 2021 3.66 12.16 0.52 178 HTML_IMAGE_ONLY_32 1996 0.41 0.14 0.52 179 RCVD_IN_PSBL 1974 0.77 1.49 0.51 180 RELAYCOUNTRY_GB 1956 0.64 1.00 0.50 181 XMPhish14 1902 0.60 0.89 0.49 182 T_OBFU_PDF_ATTACH 1891 0.39 0.14 0.49 183 HTML_IMAGE_ONLY_20 1887 0.74 1.44 0.49 184 XMLngstWrd_01 1871 0.55 0.75 0.48 185 TR_XM_SpammyWords3 1812 1.65 4.85 0.47 186 XMPhish30 1749 0.72 1.45 0.45 187 XM_ProductURIs 1704 0.72 1.47 0.44 188 XM_shorewaves_Whitelist 1703 0.32 0.00 0.44 189 XM_B_DNDMA 1683 0.59 1.02 0.43 190 FORGED_GMAIL_RCVD 1665 0.50 0.68 0.43 191 XMSlimDrugH 1609 0.55 0.91 0.42 192 TR_XM_SpammyWords2 1602 2.78 9.19 0.41 193 URI_TRY_3LD 1599 0.73 1.59 0.41 194 MIME_CHARSET_FARAWAY 1592 0.38 0.29 0.41 195 NML_ADSP_CUSTOM_MED 1584 0.51 0.78 0.41 196 HTML_TAG_BALANCE_BODY 1561 0.60 1.13 0.40 197 MSGID_FROM_MTA_HEADER 1555 0.37 0.29 0.40 198 SpammyFromTLD_02 1543 0.96 2.48 0.40 199 XMEmptyBody_01 1521 0.32 0.12 0.39 200 T_TVD_MIME_NO_HEADERS 1510 0.29 0.03 0.39 ----------------------------------------------------------------------