Email: 499806 Autolearn: 0 AvgScore: 5.27 AvgScanTime: 1.41 sec Spam: 151491 Autolearn: 0 AvgScore: 14.87 AvgScanTime: 1.62 sec Ham: 348315 Autolearn: 0 AvgScore: 1.10 AvgScanTime: 1.31 sec Time Spent Running SA: 195.29 hours Time Spent Processing Spam: 68.33 hours Time Spent Processing Ham: 126.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144103 90.02 95.12 87.80 2 DKIM_SIGNED 135187 75.30 89.24 69.23 3 XM_DK_Pass 127587 72.88 84.22 67.95 4 DKIM_VALID 126542 71.98 83.53 66.96 5 XM_B_Unicode 125560 75.77 82.88 72.68 6 RELAYCOUNTRY_US 121550 82.19 80.24 83.03 7 DCC_CHECK 107289 43.22 70.82 31.21 8 XM_B_SpammyWords 103935 51.00 68.61 43.34 9 DKIM_VALID_AU 100865 58.64 66.58 55.19 10 XMListUnsubscribeExists 99417 50.53 65.63 43.97 11 XM_B_Unicode3 70669 43.97 46.65 42.80 12 LOC_TINY_FONT_1 70648 31.90 46.64 25.49 13 XM_DK_Undo_02 60341 15.19 39.83 4.47 14 XM_B_SpammyWords2 60006 23.88 39.61 17.03 15 BAYES_50 59956 51.53 39.58 56.73 16 HTML_FONT_LOW_CONTRAST 52729 27.61 34.81 24.48 17 FVGT_m_MULTI_ODD 49535 25.66 32.70 22.60 18 MIME_HTML_ONLY 49206 25.24 32.48 22.09 19 DKIM_VALID_EF 48004 29.28 31.69 28.23 20 BAYES_99 45968 11.47 30.34 3.26 21 T_KAM_HTML_FONT_INVALID 45211 23.37 29.84 20.56 22 TR_XM_DKIM_Undo 45051 10.26 29.74 1.79 23 DCC_CHECK_NEGATIVE 42036 56.31 27.75 68.73 24 XMSubLong 40337 24.15 26.63 23.07 25 BAYES_999 34968 8.74 23.08 2.50 26 TR_XM_DK_Unsub 33084 15.36 21.84 12.54 27 XM_Multi_Part_URI 32847 15.75 21.68 13.17 28 T_TM2_M_HEADER_IN_MSG 32110 24.83 21.20 26.41 29 TR_DCC_Bayes_99 29076 6.56 19.19 1.07 30 RCVD_IN_MSPIKE_H2 28733 16.23 18.97 15.05 31 XM_B_Unsub 28710 11.28 18.95 7.95 32 RELAYCOUNTRY_META 27751 7.72 18.32 3.11 33 TR_XM_BayesUnsub 27556 9.93 18.19 6.34 34 UNPARSEABLE_RELAY 26600 12.71 17.56 10.61 35 TR_MAX_INTL_RELAY 23943 8.86 15.80 5.84 36 XM_B_SpammyWords3 23391 8.00 15.44 4.76 37 LOTS_OF_MONEY 22915 8.60 15.13 5.76 38 TR_XM_SpammyWords4 20872 6.78 13.78 3.74 39 RCVD_IN_BL_SPAMCOP_NET 18143 4.02 11.98 0.56 40 TR_XM_SpammyRelay 18088 4.68 11.94 1.52 41 BOTNET_IPINHOSTNAME 17615 12.93 11.63 13.50 42 RCVD_IN_MSPIKE_WL 16113 15.42 10.64 17.49 43 FSL_BULK_SIG 15709 5.98 10.37 4.06 44 XM_Evil_Numbers_Gen 15622 9.08 10.31 8.55 45 TR_XM_SpammyWords2 15232 3.31 10.05 0.38 46 BOTNET 14916 3.70 9.85 1.02 47 BAYES_80 14899 5.47 9.83 3.57 48 TR_XM_UnparsRelay 14575 3.97 9.62 1.51 49 XM_B_Phish_Phrases 13973 6.19 9.22 4.87 50 BAYES_60 12440 7.27 8.21 6.86 51 UNTRUSTED_Relay 12326 3.47 8.14 1.44 52 MPART_ALT_DIFF 11239 8.47 7.42 8.92 53 XM_UncommonTLD01 11173 4.81 7.38 3.70 54 RCVD_IN_MSPIKE_BL 10994 2.87 7.26 0.96 55 TR_XM_MSPIKECOMBO 10994 2.87 7.26 0.96 56 XM_Body_Dirty_Words 10337 3.57 6.82 2.15 57 XMSubMetaSx_00 10125 4.48 6.68 3.52 58 XM_B_PhoneNumber 9948 7.99 6.57 8.61 59 RELAYCOUNTRY_CA 9871 2.36 6.52 0.55 60 LotsOfNums_01 9289 6.53 6.13 6.70 61 DKIM_INVALID 8645 3.31 5.71 2.27 62 BAYES_95 8160 3.21 5.39 2.27 63 HTML_IMAGE_RATIO_02 8071 4.29 5.33 3.83 64 XM_OfRef6 7930 2.22 5.23 0.90 65 RCVD_IN_MSPIKE_H3 7912 7.21 5.22 8.07 66 TR_XM_SPAMCOP 7732 1.71 5.10 0.23 67 TR_XM_PhishingBody 7656 2.65 5.05 1.60 68 XM_H_Long_From01 7522 5.18 4.97 5.28 69 XM_H_GMP 7452 5.35 4.92 5.54 70 XMSexyCombo_05 7421 2.20 4.90 1.02 71 TR_XM_SpammyWords3 7286 1.76 4.81 0.44 72 XMStrtUSub 7203 8.74 4.75 10.47 73 XM_B_Investor 7133 2.49 4.71 1.53 74 HTML_IMAGE_RATIO_04 7082 10.54 4.67 13.10 75 MIME_HTML_MOSTLY 6731 2.87 4.44 2.18 76 RCVD_IN_MSPIKE_L3 6458 1.91 4.26 0.88 77 XM_URI_RBL 6209 1.43 4.10 0.27 78 TM2_M_VERY_LONG_WORD 5972 2.04 3.94 1.21 79 XM_B_SpammyTLD 5810 2.76 3.84 2.29 80 MIME_HTML_ONLY_MULTI 5679 6.00 3.75 6.98 81 HTML_IMAGE_RATIO_06 5659 4.60 3.74 4.98 82 T_XMDrugObfuBody_14 5637 2.27 3.72 1.63 83 XMNumbers 5528 3.05 3.65 2.79 84 XM_UB50 5513 1.76 3.64 0.95 85 XM_B_Unsub2 5267 1.88 3.48 1.18 86 TR_XM_SpammyWords5 5186 1.80 3.42 1.09 87 XMDiploma_00 5176 2.02 3.42 1.42 88 XM_SPF_SoftFail 5007 1.91 3.31 1.31 89 HTML_MIME_NO_HTML_TAG 4935 2.65 3.26 2.39 90 TooManyTo_001 4870 6.09 3.21 7.34 91 USER_IN_DEF_DKIM_WL 4669 9.22 3.08 11.89 92 SpammyFromTLD_01 4652 1.43 3.07 0.72 93 XM_CamelCaseFrm001 4651 2.13 3.07 1.72 94 MIME_QP_LONG_LINE 4560 4.39 3.01 4.98 95 TR_XM_INV_DKIM 4488 0.91 2.96 0.02 96 HTML_IMAGE_RATIO_08 4319 2.57 2.85 2.45 97 T_XMHurry_00 4246 1.25 2.80 0.57 98 RELAYCOUNTRY_AU 4238 1.19 2.80 0.49 99 RCVD_IN_MSPIKE_H5 4225 4.77 2.79 5.64 100 XM_B_SpammyWords4 4186 1.30 2.76 0.66 101 XMStockSpam_06 4179 1.64 2.76 1.16 102 T_FILL_THIS_FORM_SHORT 4168 1.35 2.75 0.74 103 TR_XM_NoHeaderRelay 4101 0.95 2.71 0.19 104 MultiRelay_CC 4074 0.92 2.69 0.15 105 T_XMDrugObfuBody_08 4066 1.74 2.68 1.33 106 T_TooManySym_01 4054 4.71 2.68 5.59 107 RCVD_IN_MSPIKE_H4 3976 3.44 2.62 3.79 108 XMBody_17 3910 1.08 2.58 0.43 109 XM_B_URI_Unicode 3657 2.00 2.41 1.81 110 RCVD_IN_VALIDITY_SAFE 3499 3.06 2.31 3.39 111 BAYES_40 3446 4.87 2.27 6.01 112 TM2_M_URI_OPT_OUT 3407 1.86 2.25 1.70 113 RELAYCOUNTRY_RU 3327 0.68 2.20 0.02 114 XMGenDplmaNmb 3324 1.13 2.19 0.66 115 RCVD_IN_VALIDITY_RPBL 3283 0.68 2.17 0.04 116 RCVD_IN_MSPIKE_L4 3148 0.68 2.08 0.07 117 URI_TRY_3LD 3119 1.02 2.06 0.56 118 MAILING_LIST_MULTI 3117 2.62 2.06 2.86 119 TR_XM_MSPIKECOMBO2 3104 0.67 2.05 0.06 120 RELAYCOUNTRY_DE 3091 0.78 2.04 0.23 121 KHOP_HELO_FCRDNS 2964 1.32 1.96 1.05 122 XMBrknScrpt_02 2922 1.09 1.93 0.73 123 SpammyFromTLD_02 2867 0.94 1.89 0.53 124 RCVD_IN_VALIDITY_CERTIFIED 2867 2.58 1.89 2.88 125 RCVD_IN_PSBL 2860 0.85 1.89 0.40 126 TR_XM_INTL_Spamhaus 2860 0.71 1.89 0.20 127 XM_HighProb1 2833 0.57 1.87 0.00 128 RCVD_IN_XBL 2780 0.58 1.84 0.03 129 TR_LOTS_OF_MONEY3 2748 0.87 1.81 0.46 130 BOTNET_NORDNS 2726 0.55 1.80 0.01 131 T_XMDrugObfuBody_00 2692 1.03 1.78 0.70 132 SUBJ_ALL_CAPS 2615 1.42 1.73 1.29 133 FROM_EXCESS_BASE64 2568 1.43 1.70 1.31 134 RCVD_IN_IADB_LISTED 2526 2.65 1.67 3.08 135 XMGappySubj_01 2491 1.33 1.64 1.19 136 URI_HEX 2481 1.29 1.64 1.13 137 BAYES_20 2470 3.76 1.63 4.69 138 XM_H_Long_From02 2453 1.00 1.62 0.73 139 XMPhish30 2435 0.86 1.61 0.54 140 MIME_HEADER_CTYPE_ONLY 2416 0.57 1.59 0.12 141 XMBdyGiftCard01 2401 0.68 1.58 0.29 142 TR_XM_MaxSPIKE 2357 0.51 1.56 0.06 143 TM2_M_OBFU_COMMENT 2357 0.63 1.56 0.23 144 T_REMOTE_IMAGE 2315 2.95 1.53 3.57 145 XM_B_Phish66 2300 0.70 1.52 0.34 146 ALL_TRUSTED 2248 10.41 1.48 14.29 147 URI_NOVOWEL 2226 1.13 1.47 0.98 148 HTTPS_HTTP_MISMATCH 2207 0.90 1.46 0.66 149 RCVD_IN_SBL_CSS 2206 0.48 1.46 0.05 150 DKIM_ADSP_NXDOMAIN 2169 0.62 1.43 0.26 151 TR_XM_SpoofStaff 2149 0.52 1.42 0.13 152 RCVD_IN_ZEN_LASTEXTERNAL 2137 0.43 1.41 0.00 153 SHORTCIRCUIT 2137 0.43 1.41 0.00 154 XMSpoofStaff2 2115 0.51 1.40 0.13 155 XM_H_SpoofStaff4 2092 0.51 1.38 0.13 156 TR_XM_PSC1 2092 0.51 1.38 0.13 157 RCVD_IN_IADB_SPF 2060 2.32 1.36 2.74 158 HTML_IMAGE_ONLY_20 2036 0.79 1.34 0.55 159 MPART_ALT_DIFF_COUNT 2031 0.79 1.34 0.55 160 XM_ProductURIs 2003 0.97 1.32 0.82 161 TR_XM_SpoofStaff2 1993 0.40 1.32 0.00 162 XM_B_SEO 1959 0.59 1.29 0.29 163 XM_DK_Undo_01 1932 1.43 1.28 1.50 164 RCVD_IN_PBL 1926 0.94 1.27 0.80 165 RDNS_DYNAMIC 1907 0.47 1.26 0.13 166 RCVD_IN_IADB_DK 1904 2.03 1.26 2.36 167 HTML_FONT_TINY_NORDNS 1900 0.43 1.25 0.07 168 STY_INVIS_DIRECT 1897 0.58 1.25 0.28 169 XM_UB99 1891 0.38 1.25 0.00 170 HTML_FONT_FACE_BAD 1831 8.41 1.21 11.54 171 RCVD_IN_IADB_SENDERID 1824 2.08 1.20 2.46 172 XM_B_DNDMA 1820 0.66 1.20 0.43 173 XM_SendGrid 1804 1.35 1.19 1.42 174 XM_B_COPY_HTML 1776 0.95 1.17 0.86 175 THIS_AD 1775 0.54 1.17 0.27 176 XMPhish14 1684 0.66 1.11 0.47 177 TR_XM_SEO4 1666 0.41 1.10 0.11 178 TR_XM_GMP_BULK_SIG 1658 0.42 1.09 0.13 179 XM_UB60 1656 0.39 1.09 0.09 180 DIET_1 1633 0.46 1.08 0.20 181 XMBody_78 1627 0.55 1.07 0.33 182 XMSubNoVowel 1622 3.00 1.07 3.84 183 TVD_RCVD_IP 1619 0.94 1.07 0.89 184 TR_LOTS_OF_MONEY2 1612 0.42 1.06 0.14 185 T_MONEY_PERCENT 1612 0.42 1.06 0.14 186 RCVD_IN_IADB_VOUCHED 1607 1.72 1.06 2.01 187 RELAYCOUNTRY_FR 1542 0.52 1.02 0.31 188 XM_OfRef7 1516 0.44 1.00 0.19 189 DKIM_ADSP_CUSTOM_MED 1513 0.81 1.00 0.73 190 XMSlimDrugH 1502 0.60 0.99 0.43 191 TR_XM_InvalidRelay 1476 0.30 0.97 0.01 192 XM_UB80 1471 0.31 0.97 0.02 193 URIBL_SBL_A 1458 0.30 0.96 0.00 194 URIBL_SBL 1458 0.30 0.96 0.00 195 TR_MetaPhish_Combo_01 1453 0.79 0.96 0.71 196 SH_BODYURI_REVERSE_SBL 1452 0.29 0.96 0.01 197 TR_XM_Base64_M1 1424 0.62 0.94 0.48 198 XM_B_COVIDMETA 1417 0.37 0.94 0.12 199 RCVD_IN_MSPIKE_L5 1388 0.28 0.92 0.01 200 TR_Mismatch_TLD_02 1383 0.33 0.91 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 305815 90.02 95.12 87.80 2 RELAYCOUNTRY_US 289219 82.19 80.24 83.03 3 XM_B_Unicode 253155 75.77 82.88 72.68 4 DKIM_SIGNED 241155 75.30 89.24 69.23 5 DCC_CHECK_NEGATIVE 239413 56.31 27.75 68.73 6 XM_DK_Pass 236691 72.88 84.22 67.95 7 DKIM_VALID 233243 71.98 83.53 66.96 8 BAYES_50 197591 51.53 39.58 56.73 9 DKIM_VALID_AU 192221 58.64 66.58 55.19 10 XMListUnsubscribeExists 153140 50.53 65.63 43.97 11 XM_B_SpammyWords 150957 51.00 68.61 43.34 12 XM_B_Unicode3 149094 43.97 46.65 42.80 13 DCC_CHECK 108716 43.22 70.82 31.21 14 DKIM_VALID_EF 98326 29.28 31.69 28.23 15 T_TM2_M_HEADER_IN_MSG 92005 24.83 21.20 26.41 16 LOC_TINY_FONT_1 88771 31.90 46.64 25.49 17 HTML_FONT_LOW_CONTRAST 85272 27.61 34.81 24.48 18 XMSubLong 80359 24.15 26.63 23.07 19 FVGT_m_MULTI_ODD 78731 25.66 32.70 22.60 20 MIME_HTML_ONLY 76953 25.24 32.48 22.09 21 T_KAM_HTML_FONT_INVALID 71601 23.37 29.84 20.56 22 RCVD_IN_MSPIKE_WL 60933 15.42 10.64 17.49 23 XM_B_SpammyWords2 59328 23.88 39.61 17.03 24 RCVD_IN_MSPIKE_H2 52409 16.23 18.97 15.05 25 ALL_TRUSTED 49784 10.41 1.48 14.29 26 BAYES_00 48980 10.02 0.71 14.06 27 BOTNET_IPINHOSTNAME 47034 12.93 11.63 13.50 28 XM_Multi_Part_URI 45862 15.75 21.68 13.17 29 HTML_IMAGE_RATIO_04 45616 10.54 4.67 13.10 30 TR_XM_DK_Unsub 43695 15.36 21.84 12.54 31 USER_IN_DEF_DKIM_WL 41419 9.22 3.08 11.89 32 HTML_FONT_FACE_BAD 40202 8.41 1.21 11.54 33 UNPARSEABLE_RELAY 36941 12.71 17.56 10.61 34 XMStrtUSub 36469 8.74 4.75 10.47 35 MPART_ALT_DIFF 31075 8.47 7.42 8.92 36 XM_B_PhoneNumber 30001 7.99 6.57 8.61 37 XM_Evil_Numbers_Gen 29782 9.08 10.31 8.55 38 RCVD_IN_MSPIKE_H3 28109 7.21 5.22 8.07 39 XM_B_Unsub 27683 11.28 18.95 7.95 40 TooManyTo_001 25576 6.09 3.21 7.34 41 MIME_HTML_ONLY_MULTI 24322 6.00 3.75 6.98 42 BAYES_60 23901 7.27 8.21 6.86 43 LotsOfNums_01 23336 6.53 6.13 6.70 44 TR_XM_BayesUnsub 22070 9.93 18.19 6.34 45 BAYES_40 20917 4.87 2.27 6.01 46 XM_DKIMWhitelistDomains 20789 4.19 0.09 5.97 47 TR_MAX_INTL_RELAY 20357 8.86 15.80 5.84 48 LOTS_OF_MONEY 20048 8.60 15.13 5.76 49 TR_XM_DK_Bayes 19800 4.14 0.58 5.68 50 RCVD_IN_MSPIKE_H5 19629 4.77 2.79 5.64 51 T_TooManySym_01 19481 4.71 2.68 5.59 52 TR_XM_DK_Bayes1 19456 4.07 0.58 5.59 53 XM_H_GMP 19281 5.35 4.92 5.54 54 XM_H_Long_From01 18377 5.18 4.97 5.28 55 MIME_QP_LONG_LINE 17361 4.39 3.01 4.98 56 HTML_IMAGE_RATIO_06 17329 4.60 3.74 4.98 57 XM_B_Phish_Phrases 16964 6.19 9.22 4.87 58 TR_XM_DK_Bayes2 16895 3.48 0.33 4.85 59 XM_B_SpammyWords3 16583 8.00 15.44 4.76 60 BAYES_20 16327 3.76 1.63 4.69 61 XM_DK_Undo_02 15570 15.19 39.83 4.47 62 XM_PDF 14510 3.13 0.76 4.17 63 FSL_BULK_SIG 14158 5.98 10.37 4.06 64 ANY_BOUNCE_MESSAGE 13607 2.96 0.77 3.91 65 BOUNCE_MESSAGE 13601 2.95 0.77 3.90 66 XMSubNoVowel 13392 3.00 1.07 3.84 67 HTML_IMAGE_RATIO_02 13351 4.29 5.33 3.83 68 RCVD_IN_MSPIKE_H4 13195 3.44 2.62 3.79 69 TR_XM_SpammyWords4 13013 6.78 13.78 3.74 70 XM_UncommonTLD01 12891 4.81 7.38 3.70 71 T_REMOTE_IMAGE 12449 2.95 1.53 3.57 72 BAYES_80 12449 5.47 9.83 3.57 73 XMSubMetaSx_00 12260 4.48 6.68 3.52 74 RCVD_IN_VALIDITY_SAFE 11800 3.06 2.31 3.39 75 BAYES_99 11360 11.47 30.34 3.26 76 RELAYCOUNTRY_META 10839 7.72 18.32 3.11 77 RCVD_IN_IADB_LISTED 10743 2.65 1.67 3.08 78 RCVD_IN_VALIDITY_CERTIFIED 10030 2.58 1.89 2.88 79 T_TooManySym_02 9978 2.23 0.78 2.86 80 MAILING_LIST_MULTI 9959 2.62 2.06 2.86 81 XMNumbers 9705 3.05 3.65 2.79 82 RCVD_IN_IADB_SPF 9533 2.32 1.36 2.74 83 BAYES_05 8879 1.96 0.62 2.55 84 BAYES_999 8694 8.74 23.08 2.50 85 RCVD_IN_IADB_SENDERID 8564 2.08 1.20 2.46 86 HTML_IMAGE_RATIO_08 8518 2.57 2.85 2.45 87 HTML_MIME_NO_HTML_TAG 8334 2.65 3.26 2.39 88 RCVD_IN_IADB_DK 8224 2.03 1.26 2.36 89 TooManyTo_002 8140 1.79 0.53 2.34 90 XM_B_SpammyTLD 7985 2.76 3.84 2.29 91 DKIM_INVALID 7912 3.31 5.71 2.27 92 BAYES_95 7906 3.21 5.39 2.27 93 MIME_HTML_MOSTLY 7596 2.87 4.44 2.18 94 XM_Body_Dirty_Words 7495 3.57 6.82 2.15 95 INVALID_MSGID 7068 1.52 0.35 2.03 96 RCVD_IN_IADB_VOUCHED 6988 1.72 1.06 2.01 97 MSGID_NOFQDN1 6350 1.31 0.12 1.82 98 TO_MALFORMED 6345 1.27 0.01 1.82 99 XM_B_URI_Unicode 6319 2.00 2.41 1.81 100 XMSubLongNoVowel 6248 1.50 0.82 1.79 101 TR_XM_DKIM_Undo 6230 10.26 29.74 1.79 102 XMSubGarbage 6173 1.43 0.65 1.77 103 XM_CamelCaseFrm001 5991 2.13 3.07 1.72 104 TM2_M_URI_OPT_OUT 5914 1.86 2.25 1.70 105 T_XMDrugObfuBody_14 5693 2.27 3.72 1.63 106 TR_XM_PhishingBody 5567 2.65 5.05 1.60 107 XM_B_Investor 5325 2.49 4.71 1.53 108 TR_XM_SpammyRelay 5301 4.68 11.94 1.52 109 TR_XM_UnparsRelay 5269 3.97 9.62 1.51 110 TooManyTo_003 5254 1.19 0.44 1.51 111 XM_DK_Undo_01 5211 1.43 1.28 1.50 112 TR_Symld_Words 5041 1.24 0.76 1.45 113 UNTRUSTED_Relay 5028 3.47 8.14 1.44 114 XM_SendGrid 4947 1.35 1.19 1.42 115 XMDiploma_00 4937 2.02 3.42 1.42 116 RCVD_IN_IADB_OPTIN 4915 1.19 0.67 1.41 117 T_XMDrugObfuBody_08 4627 1.74 2.68 1.33 118 FROM_EXCESS_BASE64 4574 1.43 1.70 1.31 119 XM_SPF_SoftFail 4560 1.91 3.31 1.31 120 XM_GoogleGroups 4519 1.13 0.75 1.30 121 SUBJ_ALL_CAPS 4488 1.42 1.73 1.29 122 IN_HORDE_ADDRESS_BOOK 4465 0.92 0.10 1.28 123 TM2_M_VERY_LONG_WORD 4224 2.04 3.94 1.21 124 XMGappySubj_01 4147 1.33 1.64 1.19 125 XM_B_Unsub2 4111 1.88 3.48 1.18 126 XMStockSpam_06 4025 1.64 2.76 1.16 127 HELO_NODOT 4012 0.85 0.14 1.15 128 HELO_NO_DOMAIN 3995 0.84 0.12 1.15 129 URI_HEX 3946 1.29 1.64 1.13 130 T_TooManySym_03 3903 0.84 0.18 1.12 131 TooManyTo_004 3827 0.88 0.38 1.10 132 TR_XM_SpammyWords5 3809 1.80 3.42 1.09 133 TR_DCC_Bayes_99 3710 6.56 19.19 1.07 134 KHOP_HELO_FCRDNS 3656 1.32 1.96 1.05 135 XMSexyCombo_05 3567 2.20 4.90 1.02 136 BOTNET 3567 3.70 9.85 1.02 137 XMCapTrack 3533 0.87 0.53 1.01 138 URI_NOVOWEL 3428 1.13 1.47 0.98 139 RCVD_IN_MSPIKE_BL 3348 2.87 7.26 0.96 140 TR_XM_MSPIKECOMBO 3344 2.87 7.26 0.96 141 XM_UB50 3306 1.76 3.64 0.95 142 TR_XM_DK_SendGrid 3257 0.89 0.80 0.94 143 XM_ShortIntro_01 3210 0.82 0.57 0.92 144 XM_OfRef6 3147 2.22 5.23 0.90 145 TVD_RCVD_IP 3104 0.94 1.07 0.89 146 TooManyTo_005 3091 0.72 0.34 0.89 147 RCVD_IN_MSPIKE_L3 3081 1.91 4.26 0.88 148 XM_E_Blogspot 3077 0.63 0.06 0.88 149 TVD_SPACE_RATIO 3021 0.64 0.11 0.87 150 XM_B_COPY_HTML 2980 0.95 1.17 0.86 151 XM_ProductURIs 2868 0.97 1.32 0.82 152 RCVD_IN_PBL 2795 0.94 1.27 0.80 153 FROM_GOV_DKIM_AU 2616 0.65 0.40 0.75 154 T_FILL_THIS_FORM_SHORT 2568 1.35 2.75 0.74 155 XM_H_Long_From02 2557 1.00 1.62 0.73 156 T_Symld_Words_02 2556 0.78 0.87 0.73 157 DKIM_ADSP_CUSTOM_MED 2550 0.81 1.00 0.73 158 XMBrknScrpt_02 2544 1.09 1.93 0.73 159 SpammyFromTLD_01 2505 1.43 3.07 0.72 160 TR_MetaPhish_Combo_01 2472 0.79 0.96 0.71 161 T_XMDrugObfuBody_00 2444 1.03 1.78 0.70 162 XMBSHREFv2 2397 0.56 0.27 0.69 163 XMNoVowels 2384 0.64 0.54 0.68 164 XM_H_PHPMailer 2328 0.62 0.51 0.67 165 XMGenDplmaNmb 2304 1.13 2.19 0.66 166 XM_B_SpammyWords4 2298 1.30 2.76 0.66 167 HTTPS_HTTP_MISMATCH 2292 0.90 1.46 0.66 168 TO_NO_BRKTS_HTML_ONLY 2156 0.54 0.35 0.62 169 RELAYCOUNTRY_GB 2078 0.66 0.82 0.60 170 T_XMHurry_00 1979 1.25 2.80 0.57 171 URI_TRY_3LD 1958 1.02 2.06 0.56 172 RCVD_IN_BL_SPAMCOP_NET 1950 4.02 11.98 0.56 173 XMLngstWrd_00 1944 0.51 0.39 0.56 174 HTML_IMAGE_ONLY_20 1932 0.79 1.34 0.55 175 MPART_ALT_DIFF_COUNT 1923 0.79 1.34 0.55 176 T_OBFU_PDF_ATTACH 1919 0.43 0.16 0.55 177 RELAYCOUNTRY_CA 1912 2.36 6.52 0.55 178 XMPhish30 1882 0.86 1.61 0.54 179 XMGappySubj_02 1860 0.38 0.03 0.53 180 HTML_TAG_BALANCE_BODY 1857 0.61 0.79 0.53 181 SpammyFromTLD_02 1855 0.94 1.89 0.53 182 RELAYCOUNTRY_AU 1703 1.19 2.80 0.49 183 TR_XM_Base64_M1 1681 0.62 0.94 0.48 184 XMPhish14 1628 0.66 1.11 0.47 185 TR_LOTS_OF_MONEY3 1610 0.87 1.81 0.46 186 MSGID_FROM_MTA_HEADER 1602 0.41 0.30 0.46 187 XMMoneyMeta_00 1544 0.56 0.82 0.44 188 FORGED_GMAIL_RCVD 1535 0.51 0.67 0.44 189 TR_XM_SpammyWords3 1525 1.76 4.81 0.44 190 XMSlimDrugH 1508 0.60 0.99 0.43 191 XMSubMetaI_00 1500 0.54 0.79 0.43 192 XMBody_17 1499 1.08 2.58 0.43 193 NML_ADSP_CUSTOM_MED 1490 0.55 0.84 0.43 194 XM_B_DNDMA 1486 0.66 1.20 0.43 195 XMSubMetaSxObfu_03 1463 0.45 0.52 0.42 196 XMDateMe_00 1442 0.42 0.43 0.41 197 XMHTML_After_End 1418 0.56 0.90 0.41 198 RCVD_IN_PSBL 1382 0.85 1.89 0.40 199 HTML_IMAGE_ONLY_32 1351 0.31 0.13 0.39 200 XMLngstWrd_01 1324 0.37 0.33 0.38 ----------------------------------------------------------------------