Email: 507719 Autolearn: 0 AvgScore: 4.98 AvgScanTime: 1.49 sec Spam: 146898 Autolearn: 0 AvgScore: 14.46 AvgScanTime: 1.70 sec Ham: 360821 Autolearn: 0 AvgScore: 1.12 AvgScanTime: 1.41 sec Time Spent Running SA: 210.22 hours Time Spent Processing Spam: 69.29 hours Time Spent Processing Ham: 140.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137605 90.44 93.67 89.12 2 DKIM_SIGNED 131377 75.32 89.43 69.57 3 XM_DK_Pass 123235 72.92 83.89 68.45 4 XM_B_Unicode 122006 76.21 83.05 73.42 5 DKIM_VALID 122000 72.02 83.05 67.53 6 RELAYCOUNTRY_US 118407 82.51 80.60 83.28 7 DCC_CHECK 104490 43.09 71.13 31.67 8 XM_B_SpammyWords 98823 51.39 67.27 44.92 9 DKIM_VALID_AU 97217 59.11 66.18 56.24 10 XMListUnsubscribeExists 96650 50.11 65.79 43.72 11 XM_B_Unicode3 72188 45.45 49.14 43.95 12 LOC_TINY_FONT_1 70142 32.98 47.75 26.96 13 XM_DK_Undo_02 60569 15.26 41.23 4.68 14 XM_B_SpammyWords2 56808 24.11 38.67 18.19 15 BAYES_50 56496 51.28 38.46 56.50 16 HTML_FONT_LOW_CONTRAST 54504 29.64 37.10 26.60 17 FVGT_m_MULTI_ODD 48111 26.46 32.75 23.90 18 DKIM_VALID_EF 46249 29.01 31.48 28.01 19 BAYES_99 45527 11.31 30.99 3.30 20 TR_XM_DKIM_Undo 43699 10.11 29.75 2.12 21 T_KAM_HTML_FONT_INVALID 43330 23.27 29.50 20.74 22 MIME_HTML_ONLY 42726 23.98 29.09 21.91 23 DCC_CHECK_NEGATIVE 40162 56.43 27.34 68.28 24 XMSubLong 37470 24.00 25.51 23.39 25 BAYES_999 34867 8.64 23.74 2.49 26 T_TM2_M_HEADER_IN_MSG 33058 25.69 22.50 26.99 27 XM_Multi_Part_URI 32892 16.12 22.39 13.57 28 TR_XM_DK_Unsub 31261 14.84 21.28 12.22 29 RCVD_IN_MSPIKE_H2 30896 16.96 21.03 15.30 30 TR_DCC_Bayes_99 30585 6.68 20.82 0.93 31 XM_B_Unsub 26518 11.27 18.05 8.51 32 UNPARSEABLE_RELAY 25930 12.94 17.65 11.03 33 TR_XM_BayesUnsub 24879 9.68 16.94 6.72 34 RELAYCOUNTRY_META 24804 7.41 16.89 3.55 35 TR_MAX_INTL_RELAY 21147 8.16 14.40 5.62 36 LOTS_OF_MONEY 19467 8.49 13.25 6.56 37 XM_B_SpammyWords3 19302 7.00 13.14 4.50 38 BOTNET_IPINHOSTNAME 18738 13.42 12.76 13.69 39 RCVD_IN_BL_SPAMCOP_NET 17439 3.92 11.87 0.68 40 TR_XM_SpammyRelay 17198 4.56 11.71 1.65 41 TR_XM_SpammyWords4 16892 6.44 11.50 4.39 42 RCVD_IN_MSPIKE_WL 16309 15.53 11.10 17.34 43 BOTNET 15626 3.80 10.64 1.02 44 TR_XM_SpammyWords2 15130 3.31 10.30 0.46 45 XM_Evil_Numbers_Gen 14074 10.07 9.58 10.27 46 XM_B_Phish_Phrases 13495 6.77 9.19 5.79 47 BAYES_80 13266 4.99 9.03 3.34 48 TR_XM_UnparsRelay 13148 3.52 8.95 1.31 49 FSL_BULK_SIG 12079 4.91 8.22 3.56 50 BAYES_60 11924 6.72 8.12 6.15 51 MPART_ALT_DIFF 11786 8.87 8.02 9.22 52 UNTRUSTED_Relay 10210 3.03 6.95 1.43 53 RELAYCOUNTRY_CA 9442 2.55 6.43 0.97 54 XMSubMetaSx_00 9380 3.86 6.39 2.83 55 DKIM_INVALID 9377 3.30 6.38 2.04 56 XM_B_PhoneNumber 9217 8.43 6.27 9.30 57 XM_H_Long_From01 9188 5.25 6.25 4.83 58 XM_H_GMP 8759 5.75 5.96 5.66 59 RCVD_IN_MSPIKE_BL 8666 2.38 5.90 0.95 60 TR_XM_MSPIKECOMBO 8663 2.38 5.90 0.95 61 TR_XM_SPAMCOP 8312 1.82 5.66 0.26 62 HTML_IMAGE_RATIO_02 8312 4.55 5.66 4.09 63 XM_Body_Dirty_Words 8130 3.37 5.53 2.49 64 RCVD_IN_MSPIKE_H3 7853 7.24 5.35 8.02 65 XM_UncommonTLD01 7807 4.11 5.31 3.62 66 LotsOfNums_01 7723 6.72 5.26 7.31 67 XMStrtUSub 7440 9.43 5.06 11.21 68 BAYES_95 7345 3.06 5.00 2.28 69 TR_XM_SpammyWords5 6871 2.29 4.68 1.32 70 TR_XM_PhishingBody 6810 2.39 4.64 1.48 71 RCVD_IN_MSPIKE_L3 6634 1.90 4.52 0.84 72 HTML_IMAGE_RATIO_04 6628 10.75 4.51 13.29 73 XM_B_Investor 6596 2.33 4.49 1.45 74 TooManyTo_001 6546 6.55 4.46 7.40 75 XM_OfRef6 6365 1.89 4.33 0.89 76 MIME_HTML_MOSTLY 6298 3.63 4.29 3.36 77 XM_SPF_SoftFail 6233 2.04 4.24 1.14 78 TR_XM_SpammyWords3 6086 1.49 4.14 0.41 79 TM2_M_VERY_LONG_WORD 6041 2.19 4.11 1.40 80 XMNumbers 5943 3.24 4.05 2.91 81 T_XMDrugObfuBody_08 5802 2.50 3.95 1.91 82 MIME_HTML_ONLY_MULTI 5768 6.05 3.93 6.91 83 XM_B_SpammyTLD 5581 2.68 3.80 2.23 84 T_XMDrugObfuBody_14 5541 2.30 3.77 1.70 85 HTML_IMAGE_RATIO_08 5462 2.59 3.72 2.13 86 HTML_IMAGE_RATIO_06 5245 4.03 3.57 4.22 87 XMSexyCombo_05 5102 1.54 3.47 0.76 88 XM_URI_RBL 5073 1.23 3.45 0.33 89 RELAYCOUNTRY_AU 4862 1.28 3.31 0.46 90 TR_XM_INV_DKIM 4806 0.97 3.27 0.04 91 XM_UB50 4788 1.59 3.26 0.91 92 XM_CamelCaseFrm001 4650 2.11 3.17 1.69 93 XM_B_Unsub2 4616 1.67 3.14 1.07 94 XM_B_URI_Unicode 4451 2.19 3.03 1.85 95 TR_XM_NoHeaderRelay 4287 0.96 2.92 0.16 96 MIME_QP_LONG_LINE 4253 4.30 2.90 4.87 97 RCVD_IN_MSPIKE_H5 4234 4.99 2.88 5.85 98 RCVD_IN_MSPIKE_H4 4222 3.30 2.87 3.47 99 T_TooManySym_01 3919 4.63 2.67 5.42 100 BAYES_40 3888 5.23 2.65 6.28 101 FROM_EXCESS_BASE64 3884 1.84 2.64 1.51 102 XMDiploma_00 3766 1.64 2.56 1.27 103 SUBJ_ALL_CAPS 3716 1.70 2.53 1.36 104 XMBody_17 3646 1.00 2.48 0.40 105 TR_LOTS_OF_MONEY3 3539 0.85 2.41 0.22 106 TR_Symld_Words 3508 1.69 2.39 1.40 107 USER_IN_DEF_DKIM_WL 3430 9.35 2.33 12.21 108 MAILING_LIST_MULTI 3235 2.52 2.20 2.65 109 TR_XM_MSPIKECOMBO2 3141 0.68 2.14 0.08 110 TM2_M_URI_OPT_OUT 3102 1.86 2.11 1.76 111 XM_H_Long_From02 3040 1.14 2.07 0.76 112 T_XMHurry_00 3008 1.09 2.05 0.71 113 TR_XM_InvalidRelay 2983 0.60 2.03 0.01 114 TR_XM_INTL_Spamhaus 2841 0.68 1.93 0.17 115 XMPhish30 2786 0.88 1.90 0.46 116 MISSING_HEADERS 2768 0.77 1.88 0.32 117 SpammyFromTLD_02 2727 0.82 1.86 0.40 118 RCVD_IN_VALIDITY_RPBL 2709 0.57 1.84 0.05 119 BAYES_20 2709 3.45 1.84 4.10 120 XM_B_Phish66 2586 0.71 1.76 0.29 121 XMStockSpam_06 2570 1.26 1.75 1.05 122 XM_B_SpammyWords4 2487 0.86 1.69 0.51 123 XMGenDplmaNmb 2476 1.00 1.69 0.72 124 T_FILL_THIS_FORM_SHORT 2461 0.98 1.68 0.70 125 BAYES_00 2441 11.43 1.66 15.41 126 BOTNET_NORDNS 2423 0.48 1.65 0.00 127 RCVD_IN_IADB_LISTED 2401 2.40 1.63 2.72 128 MultiRelay_CC 2393 0.80 1.63 0.46 129 TR_XM_MaxSPIKE 2362 0.50 1.61 0.04 130 RCVD_IN_XBL 2343 0.48 1.59 0.03 131 XM_DK_Undo_01 2316 1.68 1.58 1.72 132 T_XMDrugObfuBody_00 2271 1.02 1.55 0.81 133 TR_XM_DK_Bayes 2270 5.19 1.55 6.67 134 RCVD_IN_SBL_CSS 2250 0.48 1.53 0.05 135 TR_XM_DK_Bayes1 2226 5.11 1.52 6.58 136 XM_ProductURIs 2224 1.13 1.51 0.98 137 RCVD_IN_ZEN_LASTEXTERNAL 2208 0.43 1.50 0.00 138 SHORTCIRCUIT 2208 0.43 1.50 0.00 139 SpammyFromTLD_01 2207 0.96 1.50 0.74 140 ALL_TRUSTED 2161 10.06 1.47 13.55 141 URI_HEX 2145 1.23 1.46 1.14 142 HTML_IMAGE_ONLY_20 2138 0.82 1.46 0.56 143 XM_OfRef7 2122 0.50 1.44 0.12 144 TVD_SPACE_RATIO 2099 0.97 1.43 0.78 145 TR_LOTS_OF_MONEY1 2093 0.43 1.42 0.02 146 XMBrknScrpt_02 2063 0.91 1.40 0.70 147 URI_TRY_3LD 2040 0.74 1.39 0.48 148 RCVD_IN_IADB_SPF 2038 2.15 1.39 2.46 149 HTML_MIME_NO_HTML_TAG 2023 2.06 1.38 2.34 150 RCVD_IN_VALIDITY_SAFE 1990 3.03 1.35 3.71 151 KHOP_HELO_FCRDNS 1987 1.22 1.35 1.17 152 XM_B_DNDMA 1975 0.78 1.34 0.55 153 TR_XM_Base64_M1 1955 0.79 1.33 0.57 154 TVD_SPACE_RATIO_MINFP 1941 0.39 1.32 0.00 155 XM_SendGrid 1895 1.34 1.29 1.36 156 RCVD_IN_IADB_DK 1873 1.90 1.28 2.16 157 RELAYCOUNTRY_FR 1871 0.57 1.27 0.28 158 XMSubMetaI_00 1865 0.85 1.27 0.68 159 RDNS_DYNAMIC 1861 0.45 1.27 0.12 160 XMBody_78 1847 0.64 1.26 0.38 161 RCVD_IN_IADB_SENDERID 1847 1.95 1.26 2.23 162 XM_B_SEO 1845 0.48 1.26 0.17 163 TR_XM_GMP_MissingTo 1828 0.40 1.24 0.06 164 TR_XM_DK_Bayes2 1822 4.37 1.24 5.64 165 DKIM_ADSP_NXDOMAIN 1800 0.54 1.23 0.26 166 XM_B_COPY_HTML 1777 0.75 1.21 0.57 167 RCVD_IN_PBL 1760 0.81 1.20 0.65 168 HTML_FONT_FACE_BAD 1758 8.82 1.20 11.92 169 MPART_ALT_DIFF_COUNT 1740 0.69 1.18 0.49 170 T_REMOTE_IMAGE 1740 2.61 1.18 3.19 171 SHOPIFY_IMG_NOT_RCVD_SFY 1694 0.48 1.15 0.21 172 TR_Mismatch_TLD_02 1692 0.39 1.15 0.09 173 URI_NOVOWEL 1689 1.10 1.15 1.07 174 HTML_FONT_TINY_NORDNS 1659 0.37 1.13 0.06 175 T_MONEY_PERCENT 1647 0.82 1.12 0.70 176 TR_LOTS_OF_MONEY2 1647 0.82 1.12 0.70 177 TM2_M_OBFU_COMMENT 1643 0.65 1.12 0.46 178 TR_XM_GMP_BULK_SIG 1639 0.47 1.12 0.20 179 TR_XM_Base64_L1 1628 0.39 1.11 0.10 180 FROM_GOV_DKIM_AU 1620 0.80 1.10 0.68 181 XMBdyGiftCard01 1616 0.83 1.10 0.72 182 DIET_1 1592 0.60 1.08 0.40 183 RCVD_IN_MSPIKE_L4 1536 0.37 1.05 0.10 184 TVD_RCVD_IP 1522 0.97 1.04 0.95 185 XMSubNoVowel 1516 3.05 1.03 3.88 186 XM_HighProb1 1511 0.30 1.03 0.00 187 RCVD_IN_VALIDITY_CERTIFIED 1493 2.57 1.02 3.20 188 XMSubMetaSxObfu_02 1486 0.54 1.01 0.35 189 RCVD_IN_IADB_VOUCHED 1469 1.48 1.00 1.67 190 TM2_M_A_HREF_HREF 1469 0.52 1.00 0.32 191 T_Symld_Words_02 1458 0.85 0.99 0.79 192 DKIM_ADSP_CUSTOM_MED 1456 0.76 0.99 0.67 193 ANY_BOUNCE_MESSAGE 1448 3.73 0.99 4.85 194 BOUNCE_MESSAGE 1446 3.73 0.98 4.85 195 TR_XM_SEO4 1442 0.35 0.98 0.09 196 XM_GoogleGroups 1442 1.19 0.98 1.28 197 MILLION_USD 1441 0.29 0.98 0.01 198 HELO_DYNAMIC_SPLIT_IP 1431 0.29 0.97 0.01 199 XMClaimOffer 1397 0.45 0.95 0.25 200 XM_UB99 1362 0.27 0.93 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 321557 90.44 93.67 89.12 2 RELAYCOUNTRY_US 300509 82.51 80.60 83.28 3 XM_B_Unicode 264915 76.21 83.05 73.42 4 DKIM_SIGNED 251040 75.32 89.43 69.57 5 XM_DK_Pass 246990 72.92 83.89 68.45 6 DCC_CHECK_NEGATIVE 246352 56.43 27.34 68.28 7 DKIM_VALID 243667 72.02 83.05 67.53 8 BAYES_50 203863 51.28 38.46 56.50 9 DKIM_VALID_AU 202910 59.11 66.18 56.24 10 XM_B_SpammyWords 162097 51.39 67.27 44.92 11 XM_B_Unicode3 158576 45.45 49.14 43.95 12 XMListUnsubscribeExists 157744 50.11 65.79 43.72 13 DCC_CHECK 114284 43.09 71.13 31.67 14 DKIM_VALID_EF 101055 29.01 31.48 28.01 15 T_TM2_M_HEADER_IN_MSG 97388 25.69 22.50 26.99 16 LOC_TINY_FONT_1 97280 32.98 47.75 26.96 17 HTML_FONT_LOW_CONTRAST 95982 29.64 37.10 26.60 18 FVGT_m_MULTI_ODD 86222 26.46 32.75 23.90 19 XMSubLong 84397 24.00 25.51 23.39 20 MIME_HTML_ONLY 79047 23.98 29.09 21.91 21 T_KAM_HTML_FONT_INVALID 74837 23.27 29.50 20.74 22 XM_B_SpammyWords2 65625 24.11 38.67 18.19 23 RCVD_IN_MSPIKE_WL 62560 15.53 11.10 17.34 24 BAYES_00 55610 11.43 1.66 15.41 25 RCVD_IN_MSPIKE_H2 55219 16.96 21.03 15.30 26 BOTNET_IPINHOSTNAME 49387 13.42 12.76 13.69 27 XM_Multi_Part_URI 48948 16.12 22.39 13.57 28 ALL_TRUSTED 48904 10.06 1.47 13.55 29 HTML_IMAGE_RATIO_04 47966 10.75 4.51 13.29 30 TR_XM_DK_Unsub 44087 14.84 21.28 12.22 31 USER_IN_DEF_DKIM_WL 44054 9.35 2.33 12.21 32 HTML_FONT_FACE_BAD 43005 8.82 1.20 11.92 33 XMStrtUSub 40462 9.43 5.06 11.21 34 UNPARSEABLE_RELAY 39789 12.94 17.65 11.03 35 XM_Evil_Numbers_Gen 37059 10.07 9.58 10.27 36 XM_B_PhoneNumber 33573 8.43 6.27 9.30 37 MPART_ALT_DIFF 33274 8.87 8.02 9.22 38 XM_B_Unsub 30698 11.27 18.05 8.51 39 RCVD_IN_MSPIKE_H3 28928 7.24 5.35 8.02 40 TooManyTo_001 26698 6.55 4.46 7.40 41 LotsOfNums_01 26383 6.72 5.26 7.31 42 MIME_HTML_ONLY_MULTI 24937 6.05 3.93 6.91 43 TR_XM_BayesUnsub 24265 9.68 16.94 6.72 44 TR_XM_DK_Bayes 24058 5.19 1.55 6.67 45 TR_XM_DK_Bayes1 23734 5.11 1.52 6.58 46 LOTS_OF_MONEY 23662 8.49 13.25 6.56 47 XM_DKIMWhitelistDomains 22658 4.47 0.03 6.28 48 BAYES_40 22652 5.23 2.65 6.28 49 BAYES_60 22192 6.72 8.12 6.15 50 RCVD_IN_MSPIKE_H5 21107 4.99 2.88 5.85 51 XM_B_Phish_Phrases 20884 6.77 9.19 5.79 52 XM_H_GMP 20439 5.75 5.96 5.66 53 TR_XM_DK_Bayes2 20368 4.37 1.24 5.64 54 TR_MAX_INTL_RELAY 20283 8.16 14.40 5.62 55 T_TooManySym_01 19565 4.63 2.67 5.42 56 MIME_QP_LONG_LINE 17588 4.30 2.90 4.87 57 ANY_BOUNCE_MESSAGE 17495 3.73 0.99 4.85 58 BOUNCE_MESSAGE 17492 3.73 0.98 4.85 59 XM_H_Long_From01 17444 5.25 6.25 4.83 60 XM_DK_Undo_02 16886 15.26 41.23 4.68 61 XM_B_SpammyWords3 16252 7.00 13.14 4.50 62 TR_XM_SpammyWords4 15828 6.44 11.50 4.39 63 HTML_IMAGE_RATIO_06 15213 4.03 3.57 4.22 64 BAYES_20 14801 3.45 1.84 4.10 65 HTML_IMAGE_RATIO_02 14768 4.55 5.66 4.09 66 XM_PDF 14079 2.99 0.77 3.90 67 XMSubNoVowel 13986 3.05 1.03 3.88 68 RCVD_IN_VALIDITY_SAFE 13394 3.03 1.35 3.71 69 XM_UncommonTLD01 13058 4.11 5.31 3.62 70 FSL_BULK_SIG 12842 4.91 8.22 3.56 71 RELAYCOUNTRY_META 12797 7.41 16.89 3.55 72 RCVD_IN_MSPIKE_H4 12525 3.30 2.87 3.47 73 MIME_HTML_MOSTLY 12126 3.63 4.29 3.36 74 BAYES_80 12065 4.99 9.03 3.34 75 BAYES_99 11919 11.31 30.99 3.30 76 RCVD_IN_VALIDITY_CERTIFIED 11564 2.57 1.02 3.20 77 T_REMOTE_IMAGE 11498 2.61 1.18 3.19 78 XMNumbers 10500 3.24 4.05 2.91 79 T_TooManySym_02 10240 2.20 0.62 2.84 80 XMSubMetaSx_00 10199 3.86 6.39 2.83 81 RCVD_IN_IADB_LISTED 9809 2.40 1.63 2.72 82 MAILING_LIST_MULTI 9545 2.52 2.20 2.65 83 BAYES_05 9506 2.09 0.74 2.63 84 BAYES_999 8982 8.64 23.74 2.49 85 XM_Body_Dirty_Words 8977 3.37 5.53 2.49 86 RCVD_IN_IADB_SPF 8869 2.15 1.39 2.46 87 HTML_MIME_NO_HTML_TAG 8448 2.06 1.38 2.34 88 BAYES_95 8213 3.06 5.00 2.28 89 XM_B_SpammyTLD 8050 2.68 3.80 2.23 90 RCVD_IN_IADB_SENDERID 8047 1.95 1.26 2.23 91 RCVD_IN_IADB_DK 7782 1.90 1.28 2.16 92 TooManyTo_002 7679 1.68 0.57 2.13 93 HTML_IMAGE_RATIO_08 7676 2.59 3.72 2.13 94 TR_XM_DKIM_Undo 7644 10.11 29.75 2.12 95 DKIM_INVALID 7373 3.30 6.38 2.04 96 INVALID_MSGID 7080 1.50 0.35 1.96 97 T_XMDrugObfuBody_08 6876 2.50 3.95 1.91 98 XM_B_URI_Unicode 6679 2.19 3.03 1.85 99 XMSubLongNoVowel 6502 1.51 0.81 1.80 100 TO_MALFORMED 6469 1.28 0.03 1.79 101 XMSubGarbage 6451 1.47 0.69 1.79 102 TM2_M_URI_OPT_OUT 6351 1.86 2.11 1.76 103 MSGID_NOFQDN1 6295 1.28 0.14 1.74 104 XM_DK_Undo_01 6216 1.68 1.58 1.72 105 T_XMDrugObfuBody_14 6141 2.30 3.77 1.70 106 XM_CamelCaseFrm001 6084 2.11 3.17 1.69 107 RCVD_IN_IADB_VOUCHED 6035 1.48 1.00 1.67 108 TR_XM_SpammyRelay 5944 4.56 11.71 1.65 109 FROM_EXCESS_BASE64 5466 1.84 2.64 1.51 110 TR_XM_PhishingBody 5334 2.39 4.64 1.48 111 XM_B_Investor 5215 2.33 4.49 1.45 112 UNTRUSTED_Relay 5155 3.03 6.95 1.43 113 TM2_M_VERY_LONG_WORD 5060 2.19 4.11 1.40 114 TR_Symld_Words 5049 1.69 2.39 1.40 115 SUBJ_ALL_CAPS 4917 1.70 2.53 1.36 116 XM_SendGrid 4917 1.34 1.29 1.36 117 TR_XM_SpammyWords5 4773 2.29 4.68 1.32 118 TR_XM_UnparsRelay 4742 3.52 8.95 1.31 119 TooManyTo_003 4734 1.07 0.48 1.31 120 XM_GoogleGroups 4617 1.19 0.98 1.28 121 XMDiploma_00 4572 1.64 2.56 1.27 122 RCVD_IN_IADB_OPTIN 4304 1.06 0.73 1.19 123 KHOP_HELO_FCRDNS 4224 1.22 1.35 1.17 124 HELO_NODOT 4214 0.88 0.19 1.17 125 HELO_NO_DOMAIN 4203 0.88 0.18 1.16 126 IN_HORDE_ADDRESS_BOOK 4167 0.84 0.05 1.15 127 XM_SPF_SoftFail 4123 2.04 4.24 1.14 128 URI_HEX 4099 1.23 1.46 1.14 129 T_TooManySym_03 4051 0.85 0.17 1.12 130 XMGappySubj_01 3892 0.80 0.13 1.08 131 URI_NOVOWEL 3876 1.10 1.15 1.07 132 XM_B_Unsub2 3849 1.67 3.14 1.07 133 XMStockSpam_06 3802 1.26 1.75 1.05 134 XMCapTrack 3695 0.88 0.53 1.02 135 BOTNET 3679 3.80 10.64 1.02 136 TooManyTo_004 3554 0.82 0.41 0.98 137 XM_ProductURIs 3528 1.13 1.51 0.98 138 RELAYCOUNTRY_CA 3500 2.55 6.43 0.97 139 RCVD_IN_MSPIKE_BL 3431 2.38 5.90 0.95 140 TR_XM_MSPIKECOMBO 3430 2.38 5.90 0.95 141 TVD_RCVD_IP 3410 0.97 1.04 0.95 142 TR_XM_DK_SendGrid 3382 0.91 0.85 0.94 143 TR_DCC_Bayes_99 3348 6.68 20.82 0.93 144 XM_E_Blogspot 3330 0.67 0.04 0.92 145 XM_UB50 3280 1.59 3.26 0.91 146 XM_OfRef6 3222 1.89 4.33 0.89 147 XM_ShortIntro_01 3174 0.83 0.72 0.88 148 RCVD_IN_MSPIKE_L3 3035 1.90 4.52 0.84 149 T_XMDrugObfuBody_00 2919 1.02 1.55 0.81 150 TooManyTo_005 2868 0.67 0.36 0.79 151 T_Symld_Words_02 2849 0.85 0.99 0.79 152 TVD_SPACE_RATIO 2832 0.97 1.43 0.78 153 XM_H_Long_From02 2757 1.14 2.07 0.76 154 XMSexyCombo_05 2727 1.54 3.47 0.76 155 SpammyFromTLD_01 2673 0.96 1.50 0.74 156 XMGenDplmaNmb 2610 1.00 1.69 0.72 157 XMBdyGiftCard01 2599 0.83 1.10 0.72 158 XM_H_PHPMailer 2599 0.73 0.77 0.72 159 T_TVD_MIME_NO_HEADERS 2595 0.52 0.04 0.72 160 T_XMHurry_00 2549 1.09 2.05 0.71 161 XMBrknScrpt_02 2542 0.91 1.40 0.70 162 TR_LOTS_OF_MONEY2 2526 0.82 1.12 0.70 163 T_MONEY_PERCENT 2526 0.82 1.12 0.70 164 T_FILL_THIS_FORM_SHORT 2518 0.98 1.68 0.70 165 RELAYCOUNTRY_GB 2488 0.73 0.81 0.69 166 URI_OPTOUT_3LD 2478 0.57 0.29 0.69 167 XMSubMetaI_00 2460 0.85 1.27 0.68 168 TR_MetaPhish_Combo_01 2453 0.65 0.57 0.68 169 RCVD_IN_BL_SPAMCOP_NET 2445 3.92 11.87 0.68 170 TO_IN_SUBJ 2444 0.50 0.07 0.68 171 FROM_GOV_DKIM_AU 2441 0.80 1.10 0.68 172 DKIM_ADSP_CUSTOM_MED 2423 0.76 0.99 0.67 173 RCVD_IN_PBL 2339 0.81 1.20 0.65 174 HTTPS_HTTP_MISMATCH 2193 0.67 0.83 0.61 175 TR_XM_Base64_M1 2065 0.79 1.33 0.57 176 XM_B_COPY_HTML 2047 0.75 1.21 0.57 177 XMNoVowels 2043 0.56 0.54 0.57 178 TO_NO_BRKTS_HTML_ONLY 2038 0.43 0.08 0.56 179 XMLngstWrd_00 2017 0.53 0.45 0.56 180 T_OBFU_PDF_ATTACH 2014 0.43 0.13 0.56 181 HTML_IMAGE_ONLY_20 2003 0.82 1.46 0.56 182 XMGappySubj_02 2001 0.41 0.04 0.55 183 XM_B_DNDMA 2000 0.78 1.34 0.55 184 XMPhish14 1955 0.59 0.72 0.54 185 XMBSHREFv2 1916 0.48 0.37 0.53 186 XM_B_SpammyWords4 1858 0.86 1.69 0.51 187 HTML_TAG_BALANCE_BODY 1800 0.58 0.78 0.50 188 MPART_ALT_DIFF_COUNT 1770 0.69 1.18 0.49 189 URI_TRY_3LD 1738 0.74 1.39 0.48 190 HTML_EXTRA_CLOSE 1731 0.41 0.26 0.48 191 TR_XM_SpammyWords2 1670 3.31 10.30 0.46 192 XMPhish30 1665 0.88 1.90 0.46 193 TM2_M_OBFU_COMMENT 1662 0.65 1.12 0.46 194 RELAYCOUNTRY_AU 1661 1.28 3.31 0.46 195 MultiRelay_CC 1655 0.80 1.63 0.46 196 XMMoneyMeta_00 1624 0.50 0.61 0.45 197 XMSlimDrugH 1565 0.51 0.70 0.43 198 NML_ADSP_CUSTOM_MED 1540 0.55 0.84 0.43 199 XMSolicitRefs_0 1519 0.42 0.41 0.42 200 TR_XM_SpammyWords3 1489 1.49 4.14 0.41 ----------------------------------------------------------------------