Email: 262629 Autolearn: 0 AvgScore: 5.41 AvgScanTime: 1.48 sec Spam: 91403 Autolearn: 0 AvgScore: 14.06 AvgScanTime: 1.60 sec Ham: 171226 Autolearn: 0 AvgScore: 0.79 AvgScanTime: 1.41 sec Time Spent Running SA: 107.90 hours Time Spent Processing Spam: 40.72 hours Time Spent Processing Ham: 67.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86384 87.68 94.51 84.04 2 DKIM_SIGNED 82564 82.20 90.33 77.85 3 XM_DK_Pass 78112 79.94 85.46 76.99 4 DKIM_VALID 77763 79.57 85.08 76.62 5 XM_B_Unicode 77089 77.17 84.34 73.34 6 RELAYCOUNTRY_US 72938 81.66 79.80 82.65 7 DCC_CHECK 69414 53.82 75.94 42.00 8 XM_B_SpammyWords 64982 55.52 71.09 47.21 9 DKIM_VALID_AU 62617 67.04 68.51 66.26 10 XMListUnsubscribeExists 61898 58.44 67.72 53.48 11 LOC_TINY_FONT_1 46970 41.46 51.39 36.15 12 XM_B_Unicode3 46010 48.40 50.34 47.36 13 XM_DK_Undo_02 40119 19.72 43.89 6.81 14 XM_B_SpammyWords2 37246 29.15 40.75 22.96 15 BAYES_50 33059 52.39 36.17 61.05 16 HTML_FONT_LOW_CONTRAST 33001 34.02 36.10 32.91 17 BAYES_99 31134 15.34 34.06 5.35 18 FVGT_m_MULTI_ODD 29792 29.02 32.59 27.11 19 TR_XM_DKIM_Undo 29682 13.14 32.47 2.81 20 T_KAM_HTML_FONT_INVALID 27920 25.11 30.55 22.21 21 DKIM_VALID_EF 27164 30.40 29.72 30.76 22 MIME_HTML_ONLY 24415 22.80 26.71 20.71 23 BAYES_999 23688 11.80 25.92 4.27 24 TR_DCC_Bayes_99 22357 10.21 24.46 2.60 25 DCC_CHECK_NEGATIVE 21535 45.98 23.56 57.95 26 TR_XM_DK_Unsub 20888 17.99 22.85 15.40 27 XM_Multi_Part_URI 19995 18.01 21.88 15.95 28 XM_B_Unsub 19621 14.84 21.47 11.30 29 XMSubLong 19611 22.82 21.46 23.55 30 TR_XM_BayesUnsub 18928 12.94 20.71 8.80 31 RELAYCOUNTRY_META 18279 8.82 20.00 2.85 32 RCVD_IN_MSPIKE_H2 18049 16.58 19.75 14.89 33 T_TM2_M_HEADER_IN_MSG 16380 21.01 17.92 22.66 34 UNPARSEABLE_RELAY 15559 14.88 17.02 13.74 35 TR_MAX_INTL_RELAY 15411 10.75 16.86 7.49 36 RCVD_IN_BL_SPAMCOP_NET 13251 5.63 14.50 0.90 37 TR_XM_SpammyRelay 13184 5.97 14.42 1.46 38 XM_B_SpammyWords3 13123 10.98 14.36 9.17 39 TR_XM_SpammyWords2 11347 5.05 12.41 1.11 40 LOTS_OF_MONEY 10537 7.99 11.53 6.10 41 BOTNET_IPINHOSTNAME 10063 6.53 11.01 4.15 42 RCVD_IN_MSPIKE_WL 9950 16.44 10.89 19.41 43 BOTNET 9598 4.32 10.50 1.02 44 BAYES_80 9521 6.53 10.42 4.46 45 TR_XM_SpammyWords4 9499 6.60 10.39 4.58 46 FSL_BULK_SIG 8644 6.41 9.46 4.78 47 XM_Evil_Numbers_Gen 8452 9.96 9.25 10.34 48 BAYES_60 7905 7.86 8.65 7.44 49 MPART_ALT_DIFF 7750 7.05 8.48 6.29 50 UNTRUSTED_Relay 7623 3.96 8.34 1.63 51 TR_XM_UnparsRelay 7556 4.02 8.27 1.76 52 RELAYCOUNTRY_CA 7548 3.42 8.26 0.83 53 XMSubMetaSx_00 7486 5.50 8.19 4.06 54 XM_B_Phish_Phrases 6735 5.66 7.37 4.75 55 RCVD_IN_MSPIKE_BL 6007 2.80 6.57 0.79 56 TR_XM_MSPIKECOMBO 6007 2.80 6.57 0.79 57 XMStrtUSub 5951 6.10 6.51 5.88 58 HTML_IMAGE_RATIO_02 5865 5.76 6.42 5.42 59 TR_XM_SPAMCOP 5585 2.26 6.11 0.21 60 MIME_HTML_MOSTLY 5580 4.53 6.10 3.68 61 BAYES_95 5511 4.08 6.03 3.04 62 XM_UncommonTLD01 5308 5.22 5.81 4.91 63 XM_Body_Dirty_Words 4974 3.83 5.44 2.97 64 XM_H_GMP 4913 6.03 5.38 6.38 65 TooManyTo_001 4880 5.85 5.34 6.13 66 DKIM_INVALID 4801 2.63 5.25 1.23 67 HTML_IMAGE_RATIO_04 4702 4.68 5.14 4.43 68 TR_XM_SpammyWords3 4444 1.95 4.86 0.40 69 RCVD_IN_MSPIKE_L3 4428 2.10 4.84 0.63 70 RCVD_IN_MSPIKE_H3 4413 7.16 4.83 8.40 71 TR_XM_NoHeaderRelay 4282 1.73 4.68 0.16 72 XM_H_Long_From01 4173 4.99 4.57 5.21 73 T_XMDrugObfuBody_14 4149 2.79 4.54 1.85 74 LotsOfNums_01 4078 6.18 4.46 7.09 75 XM_URI_RBL 3953 1.75 4.32 0.37 76 XM_B_SpammyTLD 3909 3.28 4.28 2.75 77 MIME_QP_LONG_LINE 3847 3.50 4.21 3.12 78 USER_IN_DEF_DKIM_WL 3843 13.70 4.20 18.76 79 XM_CamelCaseFrm001 3683 2.70 4.03 1.98 80 XM_B_Investor 3610 2.34 3.95 1.49 81 TR_XM_PhishingBody 3553 2.49 3.89 1.74 82 XMSexyCombo_05 3411 2.22 3.73 1.42 83 XM_B_PhoneNumber 3333 5.66 3.65 6.74 84 XM_OfRef6 3301 1.88 3.61 0.96 85 XMNumbers 3182 4.38 3.48 4.86 86 TM2_M_VERY_LONG_WORD 3180 2.21 3.48 1.53 87 HTML_IMAGE_RATIO_06 3174 3.44 3.47 3.43 88 T_XMDrugObfuBody_08 3157 2.36 3.45 1.78 89 XMBody_17 3157 1.58 3.45 0.58 90 DKIM_ADSP_NXDOMAIN 3089 1.46 3.38 0.44 91 XM_B_Unsub2 3015 2.05 3.30 1.38 92 XMStockSpam_06 2952 2.21 3.23 1.67 93 TR_XM_SpammyWords5 2885 2.03 3.16 1.43 94 RCVD_IN_MSPIKE_H5 2847 5.50 3.11 6.77 95 RCVD_IN_MSPIKE_H4 2690 3.78 2.94 4.23 96 XM_UB50 2614 1.67 2.86 1.04 97 MIME_HTML_ONLY_MULTI 2529 2.83 2.77 2.86 98 RCVD_IN_VALIDITY_RPBL 2494 0.97 2.73 0.03 99 BOTNET_NORDNS 2470 0.95 2.70 0.01 100 T_TooManySym_01 2377 6.05 2.60 7.89 101 XM_SPF_SoftFail 2377 1.60 2.60 1.07 102 TR_XM_INTL_Spamhaus 2364 0.98 2.59 0.12 103 RELAYCOUNTRY_AU 2250 1.11 2.46 0.39 104 ANY_BOUNCE_MESSAGE 2214 4.41 2.42 5.47 105 BOUNCE_MESSAGE 2210 4.41 2.42 5.47 106 T_XMHurry_00 2158 1.38 2.36 0.86 107 TR_XM_MSPIKECOMBO2 2114 0.82 2.31 0.02 108 XM_B_URI_Unicode 2064 1.67 2.26 1.35 109 RCVD_IN_XBL 2059 0.79 2.25 0.01 110 FROM_EXCESS_BASE64 1956 1.91 2.14 1.79 111 HTML_IMAGE_RATIO_08 1949 2.32 2.13 2.42 112 XMDiploma_00 1949 1.65 2.13 1.39 113 T_FILL_THIS_FORM_SHORT 1945 1.21 2.13 0.72 114 DIET_1 1889 0.94 2.07 0.34 115 XM_HighProb1 1842 0.70 2.02 0.00 116 RCVD_IN_VALIDITY_SAFE 1826 4.64 2.00 6.06 117 T_XMDrugObfuBody_00 1790 1.54 1.96 1.31 118 XMSubMetaSxObfu_03 1786 0.89 1.95 0.33 119 TR_XM_INV_DKIM 1756 0.68 1.92 0.01 120 XM_H_Long_From02 1744 1.12 1.91 0.70 121 XMSubMetaSx_01 1726 0.71 1.89 0.08 122 XM_B_SpammyWords4 1709 1.74 1.87 1.67 123 MAILING_LIST_MULTI 1684 2.27 1.84 2.50 124 TR_XM_MaxSPIKE 1673 0.65 1.83 0.01 125 SpammyFromTLD_02 1670 0.83 1.83 0.30 126 XMPhish30 1654 1.22 1.81 0.91 127 KHOP_HELO_FCRDNS 1654 1.77 1.81 1.74 128 XMBrknScrpt_02 1610 1.62 1.76 1.55 129 TM2_M_URI_OPT_OUT 1583 2.06 1.73 2.23 130 RCVD_IN_SBL_CSS 1568 0.62 1.72 0.03 131 SpammyFromTLD_01 1552 0.82 1.70 0.35 132 SUBJ_ALL_CAPS 1542 1.17 1.69 0.90 133 RCVD_IN_PBL 1525 0.96 1.67 0.58 134 URI_NOVOWEL 1511 1.33 1.65 1.16 135 RELAYCOUNTRY_FR 1505 0.77 1.65 0.29 136 BAYES_40 1474 3.54 1.61 4.57 137 THIS_AD 1431 0.86 1.57 0.48 138 URI_HEX 1412 1.35 1.54 1.24 139 XM_UB60 1411 0.60 1.54 0.10 140 MultiRelay_CC 1409 0.60 1.54 0.09 141 XM_B_SEO 1402 0.66 1.53 0.19 142 XM_UB99 1387 0.53 1.52 0.00 143 XM_UB80 1387 0.55 1.52 0.03 144 XM_B_COPY_HTML 1363 1.05 1.49 0.81 145 BAYES_20 1330 2.53 1.46 3.10 146 XMBounce_01 1300 0.51 1.42 0.02 147 SHOPIFY_IMG_NOT_RCVD_SFY 1291 0.73 1.41 0.37 148 XM_B_DNDMA 1288 0.71 1.41 0.34 149 TR_XM_InvalidRelay 1268 0.49 1.39 0.01 150 STY_INVIS_DIRECT 1256 0.74 1.37 0.40 151 RCVD_IN_VALIDITY_CERTIFIED 1241 3.74 1.36 5.01 152 RCVD_IN_MSPIKE_L4 1228 0.56 1.34 0.14 153 XM_ProductURIs 1228 1.02 1.34 0.84 154 XMSlimDrugH 1173 0.76 1.28 0.48 155 XMGenDplmaNmb 1171 0.76 1.28 0.49 156 RDNS_DYNAMIC 1129 0.59 1.24 0.25 157 T_REMOTE_IMAGE 1127 2.84 1.23 3.70 158 HTML_IMAGE_ONLY_20 1114 0.77 1.22 0.53 159 TR_XM_SEO4 1114 0.49 1.22 0.10 160 MPART_ALT_DIFF_COUNT 1112 0.89 1.22 0.71 161 SCC_SPAMMER_ADDR_2 1108 0.42 1.21 0.00 162 TR_LOTS_OF_MONEY3 1101 0.60 1.20 0.28 163 XMBdyGiftCard01 1101 1.09 1.20 1.03 164 TR_XM_PHPForged 1088 0.60 1.19 0.29 165 TR_XM_FormFill2 1082 0.60 1.18 0.29 166 PLING_QUERY 1078 0.73 1.18 0.50 167 RCVD_IN_PSBL 1077 0.42 1.18 0.02 168 ALL_TRUSTED 1076 9.85 1.18 14.47 169 XMSubMetaI_00 1075 0.75 1.18 0.52 170 XM_SendGrid 1072 1.42 1.17 1.55 171 TR_XM_PHPDW 1070 0.59 1.17 0.29 172 XMBody_78 1067 0.68 1.17 0.42 173 XM_H_PHPOS 1049 0.58 1.15 0.27 174 TVD_RCVD_IP 1030 1.50 1.13 1.70 175 TR_Mismatch_TLD_02 1027 0.45 1.12 0.09 176 XM_B_Phish66 980 0.54 1.07 0.26 177 HTML_FONT_TINY_NORDNS 956 0.39 1.05 0.05 178 XM_H_DKIM_GOOG 954 0.37 1.04 0.01 179 RCVD_IN_IADB_LISTED 951 1.87 1.04 2.31 180 URI_TRY_3LD 945 0.74 1.03 0.58 181 XM_DK_Undo_01 924 1.26 1.01 1.40 182 TR_XM_GMP_BULK_SIG 923 0.44 1.01 0.13 183 XMReplyNow 914 0.51 1.00 0.25 184 TM2_M_OBFU_COMMENT 910 0.68 1.00 0.51 185 SCC_CANSPAM_2 907 0.35 0.99 0.00 186 TR_XM_RelayPhish 902 0.40 0.99 0.08 187 XM_OfRef7 901 0.51 0.99 0.25 188 XM_DIRTYINTL 888 0.38 0.97 0.07 189 XMSubMetaSxObfu_02 887 0.80 0.97 0.70 190 FROMSPACE 879 0.35 0.96 0.02 191 HELO_DYNAMIC_SPLIT_IP 862 0.33 0.94 0.01 192 HTML_TAG_BALANCE_BODY 861 0.72 0.94 0.60 193 RELAYCOUNTRY_ID 845 0.32 0.92 0.00 194 TR_Mismatch_TLD_01 832 0.55 0.91 0.35 195 TR_XM_FormFill 826 0.32 0.90 0.00 196 TR_XM_DK_SendGrid 823 1.08 0.90 1.18 197 TR_XM_Spammywords 816 0.40 0.89 0.13 198 XM_S_SpammyWords 816 0.40 0.89 0.13 199 NO_DNS_FOR_FROM 804 0.55 0.88 0.38 200 HTML_MIME_NO_HTML_TAG 801 1.46 0.88 1.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143900 87.68 94.51 84.04 2 RELAYCOUNTRY_US 141513 81.66 79.80 82.65 3 DKIM_SIGNED 133304 82.20 90.33 77.85 4 XM_DK_Pass 131830 79.94 85.46 76.99 5 DKIM_VALID 131201 79.57 85.08 76.62 6 XM_B_Unicode 125576 77.17 84.34 73.34 7 DKIM_VALID_AU 113450 67.04 68.51 66.26 8 BAYES_50 104536 52.39 36.17 61.05 9 DCC_CHECK_NEGATIVE 99223 45.98 23.56 57.95 10 XMListUnsubscribeExists 91576 58.44 67.72 53.48 11 XM_B_Unicode3 81092 48.40 50.34 47.36 12 XM_B_SpammyWords 80831 55.52 71.09 47.21 13 DCC_CHECK 71921 53.82 75.94 42.00 14 LOC_TINY_FONT_1 61904 41.46 51.39 36.15 15 HTML_FONT_LOW_CONTRAST 56356 34.02 36.10 32.91 16 DKIM_VALID_EF 52673 30.40 29.72 30.76 17 FVGT_m_MULTI_ODD 46414 29.02 32.59 27.11 18 XMSubLong 40322 22.82 21.46 23.55 19 XM_B_SpammyWords2 39318 29.15 40.75 22.96 20 T_TM2_M_HEADER_IN_MSG 38797 21.01 17.92 22.66 21 T_KAM_HTML_FONT_INVALID 38023 25.11 30.55 22.21 22 MIME_HTML_ONLY 35459 22.80 26.71 20.71 23 RCVD_IN_MSPIKE_WL 33231 16.44 10.89 19.41 24 USER_IN_DEF_DKIM_WL 32130 13.70 4.20 18.76 25 XM_Multi_Part_URI 27305 18.01 21.88 15.95 26 TR_XM_DK_Unsub 26367 17.99 22.85 15.40 27 RCVD_IN_MSPIKE_H2 25492 16.58 19.75 14.89 28 ALL_TRUSTED 24784 9.85 1.18 14.47 29 UNPARSEABLE_RELAY 23524 14.88 17.02 13.74 30 XM_B_Unsub 19350 14.84 21.47 11.30 31 XM_Evil_Numbers_Gen 17699 9.96 9.25 10.34 32 XM_B_SpammyWords3 15705 10.98 14.36 9.17 33 BAYES_00 15636 6.09 0.39 9.13 34 XM_DKIMWhitelistDomains 15120 5.78 0.05 8.83 35 TR_XM_BayesUnsub 15065 12.94 20.71 8.80 36 RCVD_IN_MSPIKE_H3 14389 7.16 4.83 8.40 37 T_TooManySym_01 13516 6.05 2.60 7.89 38 TR_MAX_INTL_RELAY 12833 10.75 16.86 7.49 39 BAYES_60 12740 7.86 8.65 7.44 40 TR_XM_DK_Bayes 12546 4.88 0.30 7.33 41 TR_XM_DK_Bayes1 12487 4.86 0.30 7.29 42 LotsOfNums_01 12143 6.18 4.46 7.09 43 XM_DK_Undo_02 11669 19.72 43.89 6.81 44 RCVD_IN_MSPIKE_H5 11600 5.50 3.11 6.77 45 XM_B_PhoneNumber 11536 5.66 3.65 6.74 46 XM_H_GMP 10920 6.03 5.38 6.38 47 TR_XM_DK_Bayes2 10914 4.24 0.23 6.37 48 MPART_ALT_DIFF 10768 7.05 8.48 6.29 49 TooManyTo_001 10493 5.85 5.34 6.13 50 LOTS_OF_MONEY 10439 7.99 11.53 6.10 51 RCVD_IN_VALIDITY_SAFE 10373 4.64 2.00 6.06 52 XMStrtUSub 10062 6.10 6.51 5.88 53 ANY_BOUNCE_MESSAGE 9374 4.41 2.42 5.47 54 BOUNCE_MESSAGE 9372 4.41 2.42 5.47 55 HTML_IMAGE_RATIO_02 9275 5.76 6.42 5.42 56 BAYES_99 9161 15.34 34.06 5.35 57 XM_H_Long_From01 8923 4.99 4.57 5.21 58 RCVD_IN_VALIDITY_CERTIFIED 8584 3.74 1.36 5.01 59 XM_UncommonTLD01 8406 5.22 5.81 4.91 60 XMNumbers 8320 4.38 3.48 4.86 61 FSL_BULK_SIG 8183 6.41 9.46 4.78 62 XM_B_Phish_Phrases 8129 5.66 7.37 4.75 63 T_TooManySym_02 7890 3.22 0.61 4.61 64 TR_XM_SpammyWords4 7838 6.60 10.39 4.58 65 BAYES_40 7817 3.54 1.61 4.57 66 BAYES_80 7635 6.53 10.42 4.46 67 HTML_IMAGE_RATIO_04 7581 4.68 5.14 4.43 68 BAYES_999 7308 11.80 25.92 4.27 69 RCVD_IN_MSPIKE_H4 7242 3.78 2.94 4.23 70 BOTNET_IPINHOSTNAME 7098 6.53 11.01 4.15 71 XMSubMetaSx_00 6959 5.50 8.19 4.06 72 INVALID_MSGID 6731 2.71 0.42 3.93 73 T_REMOTE_IMAGE 6338 2.84 1.23 3.70 74 MIME_HTML_MOSTLY 6307 4.53 6.10 3.68 75 TO_MALFORMED 6281 2.39 0.00 3.67 76 MSGID_NOFQDN1 5894 2.25 0.03 3.44 77 HTML_IMAGE_RATIO_06 5873 3.44 3.47 3.43 78 MIME_QP_LONG_LINE 5343 3.50 4.21 3.12 79 BAYES_20 5303 2.53 1.46 3.10 80 BAYES_95 5197 4.08 6.03 3.04 81 XM_Body_Dirty_Words 5078 3.83 5.44 2.97 82 MIME_HTML_ONLY_MULTI 4893 2.83 2.77 2.86 83 RELAYCOUNTRY_META 4882 8.82 20.00 2.85 84 TR_XM_DKIM_Undo 4820 13.14 32.47 2.81 85 XM_B_SpammyTLD 4701 3.28 4.28 2.75 86 T_TVD_MIME_NO_HEADERS 4536 1.74 0.05 2.65 87 TR_DCC_Bayes_99 4447 10.21 24.46 2.60 88 MAILING_LIST_MULTI 4274 2.27 1.84 2.50 89 XM_PDF 4259 1.79 0.48 2.49 90 HTML_IMAGE_RATIO_08 4138 2.32 2.13 2.42 91 RCVD_IN_IADB_LISTED 3954 1.87 1.04 2.31 92 TM2_M_URI_OPT_OUT 3824 2.06 1.73 2.23 93 TooManyTo_002 3779 1.66 0.62 2.21 94 RCVD_IN_IADB_SPF 3541 1.64 0.83 2.07 95 XM_CamelCaseFrm001 3397 2.70 4.03 1.98 96 T_TooManySym_03 3215 1.28 0.15 1.88 97 BAYES_05 3201 1.48 0.75 1.87 98 RCVD_IN_IADB_SENDERID 3199 1.47 0.73 1.87 99 T_XMDrugObfuBody_14 3176 2.79 4.54 1.85 100 RCVD_IN_IADB_DK 3085 1.43 0.75 1.80 101 FROM_EXCESS_BASE64 3068 1.91 2.14 1.79 102 T_XMDrugObfuBody_08 3045 2.36 3.45 1.78 103 HTML_MIME_NO_HTML_TAG 3043 1.46 0.88 1.78 104 TR_XM_UnparsRelay 3014 4.02 8.27 1.76 105 KHOP_HELO_FCRDNS 2986 1.77 1.81 1.74 106 TR_XM_PhishingBody 2985 2.49 3.89 1.74 107 TVD_RCVD_IP 2916 1.50 1.13 1.70 108 XM_B_SpammyWords4 2857 1.74 1.87 1.67 109 XMStockSpam_06 2853 2.21 3.23 1.67 110 IN_HORDE_ADDRESS_BOOK 2808 1.12 0.14 1.64 111 UNTRUSTED_Relay 2784 3.96 8.34 1.63 112 RCVD_IN_IADB_VOUCHED 2723 1.28 0.70 1.59 113 XM_SendGrid 2655 1.42 1.17 1.55 114 XMBrknScrpt_02 2654 1.62 1.76 1.55 115 TM2_M_VERY_LONG_WORD 2619 2.21 3.48 1.53 116 XMGappySubj_01 2595 1.03 0.13 1.52 117 XM_B_Investor 2548 2.34 3.95 1.49 118 TR_Symld_Words 2520 1.26 0.86 1.47 119 TR_XM_SpammyRelay 2494 5.97 14.42 1.46 120 TR_XM_SpammyWords5 2446 2.03 3.16 1.43 121 TVD_SPACE_RATIO 2440 0.98 0.14 1.43 122 XMSexyCombo_05 2430 2.22 3.73 1.42 123 XM_DK_Undo_01 2395 1.26 1.01 1.40 124 XMDiploma_00 2383 1.65 2.13 1.39 125 XM_B_Unsub2 2360 2.05 3.30 1.38 126 XM_B_URI_Unicode 2313 1.67 2.26 1.35 127 T_XMDrugObfuBody_00 2247 1.54 1.96 1.31 128 URI_HEX 2126 1.35 1.54 1.24 129 DKIM_INVALID 2103 2.63 5.25 1.23 130 XMBSHREFv2 2039 0.88 0.31 1.19 131 RCVD_IN_IADB_OPTIN 2036 0.94 0.48 1.19 132 TR_XM_DK_SendGrid 2013 1.08 0.90 1.18 133 URI_NOVOWEL 1991 1.33 1.65 1.16 134 XMBody_95 1983 0.78 0.08 1.16 135 XM_GoogleGroups 1977 0.98 0.65 1.15 136 TR_XM_SpammyWords2 1903 5.05 12.41 1.11 137 XM_SPF_SoftFail 1826 1.60 2.60 1.07 138 XMGappySubj_02 1798 0.69 0.03 1.05 139 XM_UB50 1779 1.67 2.86 1.04 140 XMBdyGiftCard01 1769 1.09 1.20 1.03 141 BOTNET 1752 4.32 10.50 1.02 142 TooManyTo_003 1715 0.84 0.55 1.00 143 LOW_PRICE 1697 0.75 0.29 0.99 144 TR_MetaPhish_Combo_01 1693 0.92 0.80 0.99 145 XM_OfRef6 1637 1.88 3.61 0.96 146 XMPhish30 1556 1.22 1.81 0.91 147 RCVD_IN_BL_SPAMCOP_NET 1540 5.63 14.50 0.90 148 SUBJ_ALL_CAPS 1537 1.17 1.69 0.90 149 XM_H_PHPMailer 1520 0.74 0.47 0.89 150 XM_B_FormFill 1496 0.58 0.03 0.87 151 T_XMHurry_00 1473 1.38 2.36 0.86 152 TR_XM_GMP_MSPIKE_UNDO2 1460 0.62 0.18 0.85 153 XM_ProductURIs 1442 1.02 1.34 0.84 154 RELAYCOUNTRY_CA 1427 3.42 8.26 0.83 155 XM_B_COPY_HTML 1383 1.05 1.49 0.81 156 TR_XM_MSPIKECOMBO 1353 2.80 6.57 0.79 157 RCVD_IN_MSPIKE_BL 1353 2.80 6.57 0.79 158 TooManyTo_004 1301 0.68 0.52 0.76 159 T_FILL_THIS_FORM_SHORT 1237 1.21 2.13 0.72 160 DKIM_ADSP_CUSTOM_MED 1219 0.75 0.83 0.71 161 MPART_ALT_DIFF_COUNT 1218 0.89 1.22 0.71 162 XMSubMetaSxObfu_02 1202 0.80 0.97 0.70 163 XM_H_Long_From02 1193 1.12 1.91 0.70 164 TooManyTo_005 1126 0.59 0.47 0.66 165 RCVD_IN_MSPIKE_L3 1079 2.10 4.84 0.63 166 XMBody_106 1068 0.48 0.21 0.62 167 HTML_TAG_BALANCE_BODY 1029 0.72 0.94 0.60 168 XMBody_17 998 1.58 3.45 0.58 169 RCVD_IN_PBL 992 0.96 1.67 0.58 170 URI_TRY_3LD 989 0.74 1.03 0.58 171 ONE_TIME 932 0.37 0.04 0.54 172 T_TooManySym_04 919 0.36 0.03 0.54 173 HTML_IMAGE_ONLY_20 899 0.77 1.22 0.53 174 XMNoVowels 899 0.55 0.58 0.53 175 XMSubMetaI_00 895 0.75 1.18 0.52 176 TM2_M_OBFU_COMMENT 866 0.68 1.00 0.51 177 XMHTML_After_End 853 0.53 0.59 0.50 178 FORGED_GMAIL_RCVD 852 0.55 0.65 0.50 179 PLING_QUERY 851 0.73 1.18 0.50 180 XMGenDplmaNmb 831 0.76 1.28 0.49 181 XMSlimDrugH 830 0.76 1.28 0.48 182 THIS_AD 824 0.86 1.57 0.48 183 TRACKER_ID 801 0.36 0.17 0.47 184 XMLngstWrd_00 795 0.40 0.28 0.46 185 MSGID_FROM_MTA_HEADER 788 0.37 0.20 0.46 186 TR_XM_Base64_M1 781 0.53 0.67 0.46 187 XM_S_SubURI 779 0.30 0.02 0.45 188 DKIM_ADSP_NXDOMAIN 754 1.46 3.38 0.44 189 XMBody_78 725 0.68 1.17 0.42 190 FROM_GOV_DKIM_AU 711 0.28 0.02 0.42 191 FILL_THIS_FORM 694 0.40 0.39 0.41 192 TR_XM_SpammyWords3 688 1.95 4.86 0.40 193 HTML_FONT_FACE_BAD 686 0.41 0.41 0.40 194 HTTPS_HTTP_MISMATCH 685 0.43 0.48 0.40 195 STY_INVIS_DIRECT 682 0.74 1.37 0.40 196 T_OBFU_PDF_ATTACH 679 0.27 0.04 0.40 197 XM_ShortIntro_01 673 0.43 0.49 0.39 198 RELAYCOUNTRY_AU 667 1.11 2.46 0.39 199 NML_ADSP_CUSTOM_MED 667 0.50 0.70 0.39 200 TR_LOTS_OF_MONEY2 654 0.46 0.61 0.38 ----------------------------------------------------------------------