Email: 473121 Autolearn: 0 AvgScore: 5.14 AvgScanTime: 1.41 sec Spam: 146589 Autolearn: 0 AvgScore: 14.64 AvgScanTime: 1.58 sec Ham: 326532 Autolearn: 0 AvgScore: 0.88 AvgScanTime: 1.33 sec Time Spent Running SA: 185.06 hours Time Spent Processing Spam: 64.49 hours Time Spent Processing Ham: 120.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138922 89.82 94.77 87.60 2 DKIM_SIGNED 131206 81.63 89.51 78.09 3 XM_DK_Pass 124973 79.24 85.25 76.55 4 DKIM_VALID 123871 78.23 84.50 75.41 5 XM_B_Unicode 123027 74.75 83.93 70.63 6 RELAYCOUNTRY_US 119486 81.81 81.51 81.94 7 DCC_CHECK 106301 46.61 72.52 34.97 8 XM_B_SpammyWords 101850 53.70 69.48 46.61 9 XMListUnsubscribeExists 100160 55.33 68.33 49.50 10 DKIM_VALID_AU 97675 63.40 66.63 61.95 11 LOC_TINY_FONT_1 71669 35.59 48.89 29.62 12 XM_B_Unicode3 71045 43.36 48.47 41.06 13 BAYES_50 60214 55.08 41.08 61.36 14 XM_DK_Undo_02 58302 15.52 39.77 4.64 15 XM_B_SpammyWords2 57436 25.02 39.18 18.67 16 HTML_FONT_LOW_CONTRAST 53464 30.83 36.47 28.29 17 FVGT_m_MULTI_ODD 48925 28.19 33.38 25.87 18 DKIM_VALID_EF 45454 30.87 31.01 30.81 19 BAYES_99 44103 11.74 30.09 3.51 20 T_KAM_HTML_FONT_INVALID 43513 25.47 29.68 23.58 21 MIME_HTML_ONLY 42550 22.27 29.03 19.23 22 TR_XM_DKIM_Undo 41069 10.05 28.02 1.98 23 DCC_CHECK_NEGATIVE 38253 52.92 26.10 64.96 24 XMSubLong 36021 24.32 24.57 24.21 25 XM_Multi_Part_URI 33766 17.41 23.03 14.89 26 BAYES_999 33558 8.89 22.89 2.61 27 TR_XM_DK_Unsub 33311 16.54 22.72 13.76 28 T_TM2_M_HEADER_IN_MSG 31608 27.36 21.56 29.96 29 TR_DCC_Bayes_99 29894 7.24 20.39 1.33 30 RCVD_IN_MSPIKE_H2 29206 18.44 19.92 17.77 31 XM_B_Unsub 26504 11.70 18.08 8.84 32 UNPARSEABLE_RELAY 26309 13.92 17.95 12.12 33 RELAYCOUNTRY_META 26205 7.96 17.88 3.50 34 TR_XM_BayesUnsub 25751 10.33 17.57 7.08 35 TR_MAX_INTL_RELAY 23273 9.28 15.88 6.32 36 LOTS_OF_MONEY 22423 9.06 15.30 6.26 37 XM_B_SpammyWords3 21832 7.94 14.89 4.82 38 TR_XM_SpammyWords4 19964 7.06 13.62 4.12 39 TR_XM_SpammyRelay 18199 5.17 12.41 1.92 40 BOTNET_IPINHOSTNAME 16707 5.70 11.40 3.14 41 RCVD_IN_BL_SPAMCOP_NET 16167 3.69 11.03 0.40 42 BOTNET 14613 3.90 9.97 1.17 43 BAYES_80 14537 5.80 9.92 3.95 44 XM_Evil_Numbers_Gen 14278 9.26 9.74 9.05 45 RCVD_IN_MSPIKE_WL 14060 16.11 9.59 19.04 46 TR_XM_UnparsRelay 13819 4.24 9.43 1.92 47 XM_B_Phish_Phrases 13630 7.08 9.30 6.08 48 TR_XM_SpammyWords2 13207 3.08 9.01 0.42 49 BAYES_60 12437 7.86 8.48 7.57 50 FSL_BULK_SIG 12387 5.74 8.45 4.52 51 LotsOfNums_01 11468 7.89 7.82 7.92 52 RCVD_IN_MSPIKE_BL 10934 3.11 7.46 1.16 53 TR_XM_MSPIKECOMBO 10933 3.11 7.46 1.16 54 XM_Body_Dirty_Words 10168 4.00 6.94 2.69 55 XMSubMetaSx_00 9965 4.42 6.80 3.35 56 UNTRUSTED_Relay 9862 3.14 6.73 1.53 57 HTML_IMAGE_RATIO_02 9804 4.96 6.69 4.19 58 RELAYCOUNTRY_CA 9750 2.49 6.65 0.62 59 MPART_ALT_DIFF 9675 5.67 6.60 5.25 60 XM_B_Investor 8991 3.32 6.13 2.06 61 XM_UncommonTLD01 8858 4.61 6.04 3.97 62 XM_B_PhoneNumber 8701 8.62 5.94 9.82 63 BAYES_95 7973 3.32 5.44 2.36 64 XM_H_Long_From01 7927 5.36 5.41 5.33 65 TR_XM_PhishingBody 7768 2.92 5.30 1.85 66 XM_H_GMP 7599 6.22 5.18 6.68 67 RCVD_IN_MSPIKE_H3 7547 7.76 5.15 8.93 68 DKIM_INVALID 7335 3.40 5.00 2.68 69 TR_XM_SPAMCOP 7298 1.61 4.98 0.10 70 TR_XM_SpammyWords3 7069 1.91 4.82 0.60 71 XM_OfRef6 7032 2.04 4.80 0.81 72 XM_B_SpammyTLD 7011 3.32 4.78 2.67 73 XMSexyCombo_05 6932 2.09 4.73 0.91 74 MIME_HTML_MOSTLY 6680 4.02 4.56 3.78 75 HTML_IMAGE_RATIO_04 6379 3.72 4.35 3.43 76 RCVD_IN_MSPIKE_L3 6195 2.05 4.23 1.07 77 XM_URI_RBL 5936 1.48 4.05 0.33 78 XM_SPF_SoftFail 5783 2.06 3.95 1.21 79 XMStrtUSub 5702 4.60 3.89 4.92 80 T_XMDrugObfuBody_14 5662 2.38 3.86 1.71 81 TooManyTo_001 5431 6.59 3.70 7.89 82 T_FILL_THIS_FORM_SHORT 5242 1.74 3.58 0.91 83 XMNumbers 5201 3.36 3.55 3.28 84 TR_XM_SpammyWords5 5112 2.09 3.49 1.46 85 XMDiploma_00 5023 2.13 3.43 1.54 86 TM2_M_VERY_LONG_WORD 5015 2.07 3.42 1.46 87 MIME_QP_LONG_LINE 4828 4.91 3.29 5.64 88 XM_B_Unsub2 4713 1.96 3.22 1.40 89 HTML_IMAGE_RATIO_06 4702 3.31 3.21 3.36 90 TM2_M_URI_OPT_OUT 4463 2.15 3.04 1.74 91 MIME_HTML_ONLY_MULTI 4379 2.54 2.99 2.34 92 RCVD_IN_VALIDITY_RPBL 4311 0.93 2.94 0.03 93 HTML_IMAGE_RATIO_08 4262 2.58 2.91 2.43 94 RELAYCOUNTRY_AU 4182 1.33 2.85 0.65 95 XM_B_URI_Unicode 4103 2.17 2.80 1.89 96 XM_UB50 4097 1.58 2.79 1.03 97 XM_CamelCaseFrm001 4054 2.29 2.77 2.08 98 USER_IN_DEF_DKIM_WL 4051 9.55 2.76 12.60 99 TR_XM_NoHeaderRelay 3956 1.04 2.70 0.29 100 T_TooManySym_01 3875 4.84 2.64 5.83 101 T_XMDrugObfuBody_08 3816 1.75 2.60 1.37 102 XM_B_SpammyWords4 3612 1.19 2.46 0.61 103 XMBody_17 3558 1.08 2.43 0.48 104 TR_XM_MSPIKECOMBO2 3557 0.78 2.43 0.05 105 TR_LOTS_OF_MONEY3 3497 1.01 2.39 0.40 106 XMStockSpam_06 3472 1.72 2.37 1.43 107 TR_XM_INTL_Spamhaus 3461 0.86 2.36 0.18 108 RCVD_IN_MSPIKE_H5 3262 5.04 2.23 6.31 109 RCVD_IN_MSPIKE_L4 3262 0.74 2.23 0.08 110 MAILING_LIST_MULTI 3256 2.92 2.22 3.23 111 RCVD_IN_VALIDITY_SAFE 3251 3.27 2.22 3.74 112 RCVD_IN_MSPIKE_H4 3251 3.31 2.22 3.80 113 XM_DK_Undo_01 3230 1.95 2.20 1.84 114 KHOP_HELO_FCRDNS 3127 1.63 2.13 1.40 115 XM_H_Long_From02 3102 1.27 2.12 0.89 116 T_XMHurry_00 3039 1.05 2.07 0.58 117 FROM_EXCESS_BASE64 3010 1.94 2.05 1.89 118 RCVD_IN_PSBL 3010 0.94 2.05 0.44 119 TR_XM_INV_DKIM 2983 0.67 2.03 0.05 120 RCVD_IN_XBL 2911 0.63 1.99 0.02 121 SpammyFromTLD_02 2870 0.98 1.96 0.55 122 T_REMOTE_IMAGE 2848 3.29 1.94 3.90 123 XMGenDplmaNmb 2822 1.23 1.93 0.92 124 T_XMDrugObfuBody_00 2792 1.33 1.90 1.07 125 XMPhish30 2789 0.97 1.90 0.55 126 RCVD_IN_SBL_CSS 2775 0.63 1.89 0.06 127 XM_SendGrid 2760 1.74 1.88 1.68 128 BOTNET_NORDNS 2756 0.59 1.88 0.01 129 XM_B_Phish66 2736 0.85 1.87 0.39 130 MultiRelay_CC 2696 0.65 1.84 0.12 131 XM_HighProb1 2629 0.56 1.79 0.00 132 RCVD_IN_IADB_LISTED 2602 3.17 1.78 3.80 133 SpammyFromTLD_01 2563 1.08 1.75 0.78 134 RCVD_IN_VALIDITY_CERTIFIED 2562 2.83 1.75 3.32 135 TR_XM_MaxSPIKE 2524 0.56 1.72 0.04 136 SUBJ_ALL_CAPS 2451 1.59 1.67 1.55 137 XM_ProductURIs 2345 1.15 1.60 0.94 138 RCVD_IN_PBL 2308 1.01 1.57 0.76 139 BAYES_40 2277 4.32 1.55 5.56 140 URI_TRY_3LD 2277 0.82 1.55 0.49 141 RCVD_IN_IADB_SPF 2216 2.80 1.51 3.37 142 DKIM_ADSP_CUSTOM_MED 2163 1.02 1.48 0.82 143 HTML_MIME_NO_HTML_TAG 2146 2.61 1.46 3.12 144 XMBrknScrpt_02 2139 0.99 1.46 0.78 145 RDNS_DYNAMIC 2094 0.55 1.43 0.15 146 TR_XM_InvalidRelay 2071 0.44 1.41 0.01 147 RCVD_IN_IADB_DK 2044 2.45 1.39 2.92 148 SHORTCIRCUIT 2004 0.42 1.37 0.00 149 RCVD_IN_ZEN_LASTEXTERNAL 2004 0.42 1.37 0.00 150 RCVD_IN_IADB_SENDERID 2001 2.49 1.37 3.00 151 URI_NOVOWEL 1982 1.26 1.35 1.22 152 MPART_ALT_DIFF_COUNT 1963 0.84 1.34 0.61 153 STY_INVIS_DIRECT 1951 0.66 1.33 0.36 154 URI_HEX 1924 1.28 1.31 1.27 155 TM2_M_A_HREF_HREF 1848 0.61 1.26 0.31 156 XMBdyGiftCard01 1842 0.52 1.26 0.19 157 ALL_TRUSTED 1804 10.75 1.23 15.02 158 DIET_1 1803 0.52 1.23 0.20 159 XM_B_SEO 1763 0.54 1.20 0.24 160 TR_MetaPhish_Combo_01 1748 1.11 1.19 1.07 161 HTML_FONT_TINY_NORDNS 1628 0.41 1.11 0.09 162 XMBody_78 1596 0.55 1.09 0.30 163 XM_UB60 1588 0.40 1.08 0.09 164 T_Symld_Words_02 1569 0.81 1.07 0.69 165 TR_XM_SEO4 1569 0.43 1.07 0.14 166 XM_UB80 1562 0.34 1.07 0.02 167 TM2_M_OBFU_COMMENT 1555 0.44 1.06 0.17 168 BAYES_20 1555 3.07 1.06 3.98 169 TR_XM_RelayPhish 1553 0.37 1.06 0.06 170 THIS_AD 1549 0.56 1.06 0.34 171 XM_DIRTYINTL 1542 0.36 1.05 0.06 172 XM_GoogleGroups 1538 1.24 1.05 1.33 173 TR_XM_GMP_BULK_SIG 1524 0.41 1.04 0.13 174 TR_XM_DK_SendGrid 1521 1.03 1.04 1.03 175 RELAYCOUNTRY_FR 1521 0.50 1.04 0.26 176 TVD_RCVD_IP 1503 1.02 1.03 1.02 177 XM_UB99 1500 0.32 1.02 0.00 178 TR_LOTS_OF_MONEY2 1496 0.43 1.02 0.17 179 T_MONEY_PERCENT 1496 0.43 1.02 0.17 180 NML_ADSP_CUSTOM_MED 1491 0.67 1.02 0.51 181 HTTPS_HTTP_MISMATCH 1485 0.84 1.01 0.77 182 RCVD_IN_MSPIKE_L5 1476 0.32 1.01 0.02 183 FORGED_GMAIL_RCVD 1474 0.66 1.01 0.51 184 RCVD_IN_IADB_VOUCHED 1451 1.97 0.99 2.41 185 XM_B_COPY_HTML 1445 0.79 0.99 0.70 186 TR_XM_Base64_M1 1439 0.76 0.98 0.66 187 XMHTML_After_End 1431 0.62 0.98 0.46 188 TR_XM_PHPForged 1429 0.47 0.97 0.25 189 TR_XM_FormFill2 1399 0.47 0.95 0.26 190 HTML_TAG_BALANCE_BODY 1399 0.67 0.95 0.55 191 TR_XM_PHPDW 1393 0.47 0.95 0.25 192 XMSlimDrugH 1390 0.67 0.95 0.54 193 SHOPIFY_IMG_NOT_RCVD_SFY 1386 0.47 0.95 0.25 194 HELO_DYNAMIC_SPLIT_IP 1383 0.29 0.94 0.00 195 XM_B_DNDMA 1377 0.55 0.94 0.37 196 RELAYCOUNTRY_GB 1371 0.75 0.94 0.67 197 HTML_IMAGE_ONLY_20 1369 0.69 0.93 0.58 198 XM_H_PHPOS 1368 0.45 0.93 0.24 199 XMPhish14 1321 0.62 0.90 0.50 200 XM_B_COVIDMETA 1318 0.36 0.90 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 286046 89.82 94.77 87.60 2 RELAYCOUNTRY_US 267574 81.81 81.51 81.94 3 DKIM_SIGNED 255004 81.63 89.51 78.09 4 XM_DK_Pass 249951 79.24 85.25 76.55 5 DKIM_VALID 246243 78.23 84.50 75.41 6 XM_B_Unicode 230643 74.75 83.93 70.63 7 DCC_CHECK_NEGATIVE 212129 52.92 26.10 64.96 8 DKIM_VALID_AU 202301 63.40 66.63 61.95 9 BAYES_50 200372 55.08 41.08 61.36 10 XMListUnsubscribeExists 161631 55.33 68.33 49.50 11 XM_B_SpammyWords 152204 53.70 69.48 46.61 12 XM_B_Unicode3 134087 43.36 48.47 41.06 13 DCC_CHECK 114203 46.61 72.52 34.97 14 DKIM_VALID_EF 100596 30.87 31.01 30.81 15 T_TM2_M_HEADER_IN_MSG 97833 27.36 21.56 29.96 16 LOC_TINY_FONT_1 96715 35.59 48.89 29.62 17 HTML_FONT_LOW_CONTRAST 92382 30.83 36.47 28.29 18 FVGT_m_MULTI_ODD 84463 28.19 33.38 25.87 19 XMSubLong 79053 24.32 24.57 24.21 20 T_KAM_HTML_FONT_INVALID 77005 25.47 29.68 23.58 21 MIME_HTML_ONLY 62801 22.27 29.03 19.23 22 RCVD_IN_MSPIKE_WL 62169 16.11 9.59 19.04 23 XM_B_SpammyWords2 60948 25.02 39.18 18.67 24 RCVD_IN_MSPIKE_H2 58015 18.44 19.92 17.77 25 ALL_TRUSTED 49049 10.75 1.23 15.02 26 XM_Multi_Part_URI 48606 17.41 23.03 14.89 27 TR_XM_DK_Unsub 44928 16.54 22.72 13.76 28 USER_IN_DEF_DKIM_WL 41134 9.55 2.76 12.60 29 UNPARSEABLE_RELAY 39571 13.92 17.95 12.12 30 XM_B_PhoneNumber 32068 8.62 5.94 9.82 31 BAYES_00 30999 6.71 0.50 9.49 32 XM_Evil_Numbers_Gen 29543 9.26 9.74 9.05 33 RCVD_IN_MSPIKE_H3 29159 7.76 5.15 8.93 34 XM_B_Unsub 28852 11.70 18.08 8.84 35 LotsOfNums_01 25876 7.89 7.82 7.92 36 TooManyTo_001 25756 6.59 3.70 7.89 37 BAYES_60 24732 7.86 8.48 7.57 38 TR_XM_BayesUnsub 23127 10.33 17.57 7.08 39 XM_DKIMWhitelistDomains 22880 4.85 0.03 7.01 40 XM_H_GMP 21806 6.22 5.18 6.68 41 TR_XM_DK_Bayes 21681 4.70 0.39 6.64 42 TR_XM_DK_Bayes1 21278 4.62 0.38 6.52 43 TR_MAX_INTL_RELAY 20624 9.28 15.88 6.32 44 RCVD_IN_MSPIKE_H5 20599 5.04 2.23 6.31 45 LOTS_OF_MONEY 20456 9.06 15.30 6.26 46 XM_B_Phish_Phrases 19846 7.08 9.30 6.08 47 T_TooManySym_01 19042 4.84 2.64 5.83 48 MIME_QP_LONG_LINE 18425 4.91 3.29 5.64 49 BAYES_40 18141 4.32 1.55 5.56 50 TR_XM_DK_Bayes2 17722 3.82 0.25 5.43 51 XM_H_Long_From01 17411 5.36 5.41 5.33 52 ANY_BOUNCE_MESSAGE 17303 3.84 0.61 5.30 53 BOUNCE_MESSAGE 17302 3.84 0.60 5.30 54 MPART_ALT_DIFF 17158 5.67 6.60 5.25 55 XMStrtUSub 16053 4.60 3.89 4.92 56 XM_B_SpammyWords3 15742 7.94 14.89 4.82 57 XM_PDF 15479 3.49 0.72 4.74 58 XM_DK_Undo_02 15140 15.52 39.77 4.64 59 FSL_BULK_SIG 14753 5.74 8.45 4.52 60 HTML_IMAGE_RATIO_02 13668 4.96 6.69 4.19 61 TR_XM_SpammyWords4 13443 7.06 13.62 4.12 62 BAYES_20 12981 3.07 1.06 3.98 63 XM_UncommonTLD01 12954 4.61 6.04 3.97 64 BAYES_80 12898 5.80 9.92 3.95 65 T_REMOTE_IMAGE 12740 3.29 1.94 3.90 66 RCVD_IN_MSPIKE_H4 12411 3.31 2.22 3.80 67 RCVD_IN_IADB_LISTED 12397 3.17 1.78 3.80 68 MIME_HTML_MOSTLY 12352 4.02 4.56 3.78 69 RCVD_IN_VALIDITY_SAFE 12208 3.27 2.22 3.74 70 BAYES_99 11447 11.74 30.09 3.51 71 RELAYCOUNTRY_META 11437 7.96 17.88 3.50 72 HTML_IMAGE_RATIO_04 11212 3.72 4.35 3.43 73 RCVD_IN_IADB_SPF 11009 2.80 1.51 3.37 74 HTML_IMAGE_RATIO_06 10960 3.31 3.21 3.36 75 XMSubMetaSx_00 10947 4.42 6.80 3.35 76 RCVD_IN_VALIDITY_CERTIFIED 10838 2.83 1.75 3.32 77 XMNumbers 10696 3.36 3.55 3.28 78 MAILING_LIST_MULTI 10537 2.92 2.22 3.23 79 BOTNET_IPINHOSTNAME 10266 5.70 11.40 3.14 80 HTML_MIME_NO_HTML_TAG 10202 2.61 1.46 3.12 81 RCVD_IN_IADB_SENDERID 9801 2.49 1.37 3.00 82 T_TooManySym_02 9724 2.25 0.63 2.98 83 RCVD_IN_IADB_DK 9543 2.45 1.39 2.92 84 XM_Body_Dirty_Words 8774 4.00 6.94 2.69 85 DKIM_INVALID 8761 3.40 5.00 2.68 86 XM_B_SpammyTLD 8710 3.32 4.78 2.67 87 BAYES_999 8508 8.89 22.89 2.61 88 HTML_IMAGE_RATIO_08 7929 2.58 2.91 2.43 89 TooManyTo_002 7883 1.81 0.47 2.41 90 RCVD_IN_IADB_VOUCHED 7869 1.97 0.99 2.41 91 BAYES_95 7722 3.32 5.44 2.36 92 MIME_HTML_ONLY_MULTI 7637 2.54 2.99 2.34 93 BAYES_05 7240 1.69 0.52 2.22 94 INVALID_MSGID 7137 1.59 0.26 2.19 95 XM_CamelCaseFrm001 6803 2.29 2.77 2.08 96 XM_B_Investor 6719 3.32 6.13 2.06 97 TR_XM_DKIM_Undo 6464 10.05 28.02 1.98 98 MSGID_NOFQDN1 6422 1.36 0.01 1.97 99 TO_MALFORMED 6384 1.36 0.03 1.96 100 TR_XM_SpammyRelay 6256 5.17 12.41 1.92 101 TR_XM_UnparsRelay 6254 4.24 9.43 1.92 102 FROM_EXCESS_BASE64 6184 1.94 2.05 1.89 103 XM_B_URI_Unicode 6171 2.17 2.80 1.89 104 TR_XM_PhishingBody 6033 2.92 5.30 1.85 105 XM_DK_Undo_01 6016 1.95 2.20 1.84 106 TM2_M_URI_OPT_OUT 5697 2.15 3.04 1.74 107 T_XMDrugObfuBody_14 5583 2.38 3.86 1.71 108 XM_SendGrid 5493 1.74 1.88 1.68 109 RCVD_IN_IADB_OPTIN 5487 1.37 0.66 1.68 110 TR_Symld_Words 5102 1.31 0.73 1.56 111 SUBJ_ALL_CAPS 5052 1.59 1.67 1.55 112 TooManyTo_003 5035 1.19 0.39 1.54 113 XMDiploma_00 5031 2.13 3.43 1.54 114 UNTRUSTED_Relay 4987 3.14 6.73 1.53 115 TR_XM_SpammyWords5 4783 2.09 3.49 1.46 116 TM2_M_VERY_LONG_WORD 4772 2.07 3.42 1.46 117 XMStockSpam_06 4674 1.72 2.37 1.43 118 KHOP_HELO_FCRDNS 4581 1.63 2.13 1.40 119 XM_B_Unsub2 4578 1.96 3.22 1.40 120 IN_HORDE_ADDRESS_BOOK 4501 0.98 0.09 1.38 121 T_XMDrugObfuBody_08 4480 1.75 2.60 1.37 122 TR_DCC_Bayes_99 4343 7.24 20.39 1.33 123 XM_GoogleGroups 4342 1.24 1.05 1.33 124 HELO_NODOT 4263 0.95 0.15 1.31 125 HELO_NO_DOMAIN 4253 0.93 0.11 1.30 126 URI_HEX 4144 1.28 1.31 1.27 127 URI_NOVOWEL 3996 1.26 1.35 1.22 128 XM_SPF_SoftFail 3953 2.06 3.95 1.21 129 XMGappySubj_01 3872 0.90 0.27 1.19 130 BOTNET 3832 3.90 9.97 1.17 131 RCVD_IN_MSPIKE_BL 3795 3.11 7.46 1.16 132 TR_XM_MSPIKECOMBO 3793 3.11 7.46 1.16 133 XMCapTrack 3786 1.04 0.77 1.16 134 T_TooManySym_03 3732 0.83 0.15 1.14 135 TooManyTo_004 3566 0.85 0.32 1.09 136 TR_MetaPhish_Combo_01 3495 1.11 1.19 1.07 137 T_XMDrugObfuBody_00 3486 1.33 1.90 1.07 138 RCVD_IN_MSPIKE_L3 3483 2.05 4.23 1.07 139 XM_UB50 3376 1.58 2.79 1.03 140 TR_XM_DK_SendGrid 3347 1.03 1.04 1.03 141 TVD_RCVD_IP 3332 1.02 1.03 1.02 142 XM_ShortIntro_01 3257 0.87 0.58 1.00 143 TVD_SPACE_RATIO 3216 0.72 0.14 0.98 144 XM_ProductURIs 3079 1.15 1.60 0.94 145 XMGenDplmaNmb 3012 1.23 1.93 0.92 146 T_FILL_THIS_FORM_SHORT 2974 1.74 3.58 0.91 147 XMSexyCombo_05 2962 2.09 4.73 0.91 148 TooManyTo_005 2917 0.71 0.29 0.89 149 XM_H_Long_From02 2906 1.27 2.12 0.89 150 DKIM_ADSP_CUSTOM_MED 2667 1.02 1.48 0.82 151 XM_OfRef6 2636 2.04 4.80 0.81 152 TO_IN_SUBJ 2631 0.58 0.08 0.81 153 URI_OPTOUT_3LD 2619 0.61 0.18 0.80 154 T_TVD_MIME_NO_HEADERS 2618 0.57 0.04 0.80 155 XM_H_PHPMailer 2568 0.69 0.49 0.79 156 FROM_GOV_DKIM_AU 2567 0.58 0.11 0.79 157 XMBrknScrpt_02 2543 0.99 1.46 0.78 158 SpammyFromTLD_01 2542 1.08 1.75 0.78 159 HTTPS_HTTP_MISMATCH 2509 0.84 1.01 0.77 160 RCVD_IN_PBL 2477 1.01 1.57 0.76 161 XMNoVowels 2313 0.66 0.57 0.71 162 XM_B_COPY_HTML 2302 0.79 0.99 0.70 163 T_Symld_Words_02 2253 0.81 1.07 0.69 164 RELAYCOUNTRY_GB 2178 0.75 0.94 0.67 165 XMBSHREFv2 2171 0.55 0.29 0.66 166 TR_XM_Base64_M1 2147 0.76 0.98 0.66 167 RELAYCOUNTRY_AU 2133 1.33 2.85 0.65 168 RELAYCOUNTRY_CA 2026 2.49 6.65 0.62 169 XM_B_SpammyWords4 2004 1.19 2.46 0.61 170 T_OBFU_PDF_ATTACH 2003 0.47 0.14 0.61 171 MPART_ALT_DIFF_COUNT 1999 0.84 1.34 0.61 172 TR_XM_SpammyWords3 1949 1.91 4.82 0.60 173 T_XMHurry_00 1908 1.05 2.07 0.58 174 HTML_IMAGE_ONLY_20 1892 0.69 0.93 0.58 175 HTML_IMAGE_ONLY_32 1888 0.46 0.19 0.58 176 TO_NO_BRKTS_HTML_ONLY 1823 0.44 0.16 0.56 177 XMPhish30 1795 0.97 1.90 0.55 178 HTML_TAG_BALANCE_BODY 1793 0.67 0.95 0.55 179 SpammyFromTLD_02 1790 0.98 1.96 0.55 180 XMSlimDrugH 1773 0.67 0.95 0.54 181 XMLngstWrd_00 1764 0.51 0.44 0.54 182 NML_ADSP_CUSTOM_MED 1676 0.67 1.02 0.51 183 FORGED_GMAIL_RCVD 1663 0.66 1.01 0.51 184 XMPhish14 1629 0.62 0.90 0.50 185 MSGID_FROM_MTA_HEADER 1606 0.43 0.29 0.49 186 URI_TRY_3LD 1598 0.82 1.55 0.49 187 XMMoneyMeta_00 1589 0.58 0.80 0.49 188 HTML_IMAGE_ONLY_28 1586 0.49 0.49 0.49 189 XMGappySubj_02 1584 0.35 0.04 0.49 190 XMBody_17 1563 1.08 2.43 0.48 191 MISSING_HEADERS 1505 0.48 0.53 0.46 192 XMHTML_After_End 1489 0.62 0.98 0.46 193 HTML_FONT_FACE_BAD 1488 0.46 0.47 0.46 194 RCVD_IN_PSBL 1450 0.94 2.05 0.44 195 XMDateMe_00 1408 0.45 0.50 0.43 196 LongTLD 1388 0.49 0.65 0.43 197 XMSubMetaI_00 1387 0.54 0.78 0.42 198 TR_XM_SpammyWords2 1364 3.08 9.01 0.42 199 PLING_QUERY 1344 0.53 0.79 0.41 200 NUMERIC_HTTP_ADDR 1310 0.36 0.28 0.40 ----------------------------------------------------------------------