Email: 477118 Autolearn: 0 AvgScore: 5.24 AvgScanTime: 1.56 sec Spam: 147084 Autolearn: 0 AvgScore: 14.93 AvgScanTime: 1.72 sec Ham: 330034 Autolearn: 0 AvgScore: 0.93 AvgScanTime: 1.49 sec Time Spent Running SA: 207.07 hours Time Spent Processing Spam: 70.24 hours Time Spent Processing Ham: 136.83 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139043 89.25 94.53 86.90 2 DKIM_SIGNED 130933 82.16 89.02 79.11 3 XM_DK_Pass 124110 79.85 84.38 77.83 4 DKIM_VALID 122665 78.89 83.40 76.87 5 XM_B_Unicode 122342 74.25 83.18 70.27 6 RELAYCOUNTRY_US 118957 81.71 80.88 82.07 7 DCC_CHECK 105706 48.09 71.87 37.50 8 XM_B_SpammyWords 101742 54.27 69.17 47.63 9 XMListUnsubscribeExists 97773 55.27 66.47 50.28 10 DKIM_VALID_AU 96202 63.80 65.41 63.09 11 LOC_TINY_FONT_1 70157 35.22 47.70 29.66 12 XM_B_Unicode3 69927 43.35 47.54 41.48 13 XM_DK_Undo_02 61875 16.88 42.07 5.65 14 BAYES_50 56815 53.95 38.63 60.78 15 XM_B_SpammyWords2 56805 25.95 38.62 20.31 16 HTML_FONT_LOW_CONTRAST 53945 30.91 36.68 28.34 17 BAYES_99 48327 12.92 32.86 4.04 18 FVGT_m_MULTI_ODD 47354 28.39 32.20 26.69 19 T_KAM_HTML_FONT_INVALID 46679 25.73 31.74 23.05 20 TR_XM_DKIM_Undo 45426 11.25 30.88 2.50 21 DKIM_VALID_EF 44914 31.63 30.54 32.11 22 MIME_HTML_ONLY 42960 23.15 29.21 20.45 23 DCC_CHECK_NEGATIVE 39085 51.38 26.57 62.44 24 XMSubLong 36937 24.41 25.11 24.10 25 BAYES_999 36666 9.90 24.93 3.20 26 TR_DCC_Bayes_99 33084 7.93 22.49 1.44 27 T_TM2_M_HEADER_IN_MSG 32775 26.79 22.28 28.80 28 XM_Multi_Part_URI 31836 16.64 21.64 14.40 29 TR_XM_DK_Unsub 31744 16.50 21.58 14.24 30 RCVD_IN_MSPIKE_H2 30481 18.21 20.72 17.09 31 XM_B_Unsub 28078 12.20 19.09 9.13 32 TR_XM_BayesUnsub 26951 10.70 18.32 7.31 33 RELAYCOUNTRY_META 25945 7.92 17.64 3.59 34 UNPARSEABLE_RELAY 24569 13.69 16.70 12.35 35 TR_MAX_INTL_RELAY 23133 9.18 15.73 6.27 36 LOTS_OF_MONEY 20724 8.38 14.09 5.83 37 TR_XM_SpammyRelay 19186 5.42 13.04 2.02 38 XM_B_SpammyWords3 19175 7.23 13.04 4.65 39 RCVD_IN_BL_SPAMCOP_NET 18920 4.48 12.86 0.75 40 TR_XM_SpammyWords4 17598 6.39 11.96 3.90 41 RCVD_IN_MSPIKE_WL 16302 17.83 11.08 20.84 42 BOTNET_IPINHOSTNAME 15935 5.63 10.83 3.31 43 TR_XM_SpammyWords2 15733 3.65 10.70 0.52 44 BOTNET 15095 4.03 10.26 1.25 45 XM_Evil_Numbers_Gen 14522 8.89 9.87 8.46 46 BAYES_80 14304 5.67 9.73 3.87 47 FSL_BULK_SIG 14228 6.38 9.67 4.91 48 XM_B_Phish_Phrases 13006 6.51 8.84 5.46 49 TR_XM_UnparsRelay 12229 3.73 8.31 1.69 50 BAYES_60 11925 7.52 8.11 7.26 51 RCVD_IN_MSPIKE_BL 10645 2.99 7.24 1.09 52 TR_XM_MSPIKECOMBO 10640 2.98 7.23 1.09 53 UNTRUSTED_Relay 10220 3.18 6.95 1.50 54 XM_H_GMP 10183 6.23 6.92 5.92 55 RELAYCOUNTRY_CA 9541 2.49 6.49 0.71 56 MPART_ALT_DIFF 9254 5.47 6.29 5.11 57 XM_UncommonTLD01 9131 4.54 6.21 3.80 58 XM_B_PhoneNumber 8886 8.64 6.04 9.80 59 HTML_IMAGE_RATIO_02 8752 5.30 5.95 5.01 60 XMSubMetaSx_00 8699 4.09 5.91 3.28 61 XM_H_Long_From01 8656 5.76 5.89 5.70 62 XM_Body_Dirty_Words 8621 3.77 5.86 2.83 63 LotsOfNums_01 8612 7.61 5.86 8.40 64 TR_XM_SPAMCOP 8305 1.88 5.65 0.20 65 DKIM_INVALID 8268 3.28 5.62 2.23 66 BAYES_95 7975 3.33 5.42 2.40 67 RCVD_IN_MSPIKE_H3 7900 8.15 5.37 9.38 68 TR_XM_SpammyWords3 7855 2.02 5.34 0.54 69 RCVD_IN_MSPIKE_L3 7218 2.16 4.91 0.93 70 HTML_IMAGE_RATIO_04 7211 4.53 4.90 4.37 71 TooManyTo_001 6975 7.21 4.74 8.32 72 XM_B_Investor 6973 2.61 4.74 1.66 73 T_XMDrugObfuBody_08 6798 2.71 4.62 1.85 74 XMStrtUSub 6795 5.21 4.62 5.48 75 TR_XM_SpammyWords5 6687 2.49 4.55 1.58 76 XM_OfRef6 6578 2.11 4.47 1.06 77 MIME_QP_LONG_LINE 6438 5.23 4.38 5.62 78 TR_XM_PhishingBody 6295 2.39 4.28 1.55 79 XMNumbers 6215 3.46 4.23 3.12 80 TR_XM_NoHeaderRelay 6212 1.45 4.22 0.21 81 XM_B_SpammyTLD 6063 3.04 4.12 2.55 82 T_XMDrugObfuBody_14 5890 2.57 4.00 1.93 83 XMSexyCombo_05 5620 1.82 3.82 0.92 84 MIME_HTML_MOSTLY 5611 3.14 3.81 2.84 85 TM2_M_VERY_LONG_WORD 5015 2.07 3.41 1.48 86 HTML_IMAGE_RATIO_06 4974 3.77 3.38 3.94 87 XM_SPF_SoftFail 4935 1.91 3.36 1.27 88 XMDiploma_00 4630 2.75 3.15 2.57 89 XM_URI_RBL 4595 1.15 3.12 0.27 90 TM2_M_URI_OPT_OUT 4511 2.24 3.07 1.88 91 RCVD_IN_MSPIKE_H5 4317 5.99 2.94 7.35 92 TR_XM_MSPIKECOMBO2 4243 0.97 2.88 0.12 93 HTML_IMAGE_RATIO_08 4194 2.60 2.85 2.48 94 XMBody_17 4146 1.16 2.82 0.42 95 XM_B_Unsub2 4143 1.84 2.82 1.41 96 RCVD_IN_MSPIKE_H4 4085 3.70 2.78 4.11 97 XM_CamelCaseFrm001 4079 2.24 2.77 2.00 98 TR_XM_INV_DKIM 4011 0.89 2.73 0.07 99 ANY_BOUNCE_MESSAGE 3977 3.34 2.70 3.62 100 BOUNCE_MESSAGE 3976 3.34 2.70 3.62 101 MIME_HTML_ONLY_MULTI 3951 2.73 2.69 2.75 102 RELAYCOUNTRY_AU 3889 1.32 2.64 0.73 103 XM_UB50 3844 1.51 2.61 1.02 104 XM_B_URI_Unicode 3817 2.18 2.60 2.00 105 DKIM_ADSP_NXDOMAIN 3516 0.94 2.39 0.29 106 RCVD_IN_VALIDITY_RPBL 3497 0.84 2.38 0.15 107 USER_IN_DEF_DKIM_WL 3488 10.21 2.37 13.70 108 T_TooManySym_01 3459 4.80 2.35 5.88 109 BOTNET_NORDNS 3370 0.71 2.29 0.01 110 TR_XM_INTL_Spamhaus 3355 0.82 2.28 0.17 111 SUBJ_ALL_CAPS 3298 1.72 2.24 1.49 112 MAILING_LIST_MULTI 3258 2.84 2.22 3.12 113 XM_B_SpammyWords4 3234 1.08 2.20 0.58 114 T_XMDrugObfuBody_00 3171 1.57 2.16 1.30 115 T_XMHurry_00 3139 1.41 2.13 1.09 116 SpammyFromTLD_02 3045 0.97 2.07 0.48 117 XM_H_Long_From02 2944 1.26 2.00 0.93 118 T_FILL_THIS_FORM_SHORT 2916 1.15 1.98 0.78 119 XMStockSpam_06 2880 1.52 1.96 1.33 120 FROM_EXCESS_BASE64 2861 1.57 1.95 1.41 121 RCVD_IN_XBL 2819 0.60 1.92 0.02 122 TR_XM_MaxSPIKE 2800 0.63 1.90 0.06 123 RCVD_IN_SBL_CSS 2748 0.60 1.87 0.03 124 XMGenDplmaNmb 2718 1.90 1.85 1.92 125 RCVD_IN_IADB_LISTED 2706 2.96 1.84 3.45 126 HTML_FONT_TINY_NORDNS 2698 0.62 1.83 0.08 127 URI_HEX 2597 1.41 1.77 1.25 128 RCVD_IN_MSPIKE_L4 2590 0.64 1.76 0.14 129 MISSING_HEADERS 2589 0.79 1.76 0.35 130 XM_DK_Undo_01 2505 1.76 1.70 1.78 131 TR_LOTS_OF_MONEY3 2482 0.71 1.69 0.27 132 ALL_TRUSTED 2431 10.68 1.65 14.71 133 BAYES_40 2360 4.06 1.60 5.15 134 RCVD_IN_VALIDITY_SAFE 2355 3.45 1.60 4.28 135 XM_B_SEO 2354 0.64 1.60 0.21 136 XM_B_Phish66 2265 0.70 1.54 0.32 137 RCVD_IN_IADB_SPF 2260 2.61 1.54 3.08 138 RCVD_IN_ZEN_LASTEXTERNAL 2250 0.47 1.53 0.00 139 SHORTCIRCUIT 2250 0.47 1.53 0.00 140 XMBrknScrpt_02 2224 1.07 1.51 0.87 141 HTML_MIME_NO_HTML_TAG 2219 3.06 1.51 3.76 142 XM_ProductURIs 2184 0.81 1.48 0.51 143 XMPhish30 2175 0.86 1.48 0.59 144 SpammyFromTLD_01 2141 0.92 1.46 0.68 145 DIET_1 2093 0.58 1.42 0.20 146 XM_SendGrid 2061 1.84 1.40 2.04 147 XM_UB99 2052 0.43 1.40 0.00 148 KHOP_HELO_FCRDNS 2048 1.23 1.39 1.16 149 RCVD_IN_IADB_DK 2045 2.29 1.39 2.69 150 T_REMOTE_IMAGE 2014 2.84 1.37 3.49 151 RCVD_IN_IADB_SENDERID 2014 2.34 1.37 2.77 152 XMBounce_01 1998 0.43 1.36 0.01 153 TR_LOTS_OF_MONEY1 1987 0.43 1.35 0.02 154 XMBdyGiftCard01 1984 0.77 1.35 0.52 155 TR_Mismatch_TLD_02 1977 0.49 1.34 0.10 156 URI_NOVOWEL 1976 1.35 1.34 1.36 157 MPART_ALT_DIFF_COUNT 1881 0.84 1.28 0.65 158 URI_TRY_3LD 1866 0.76 1.27 0.53 159 RCVD_IN_PSBL 1830 0.40 1.24 0.03 160 TR_XM_GMP_BULK_SIG 1821 0.50 1.24 0.17 161 RCVD_IN_PBL 1806 0.84 1.23 0.66 162 TR_XM_SEO4 1803 0.45 1.23 0.11 163 TR_Symld_Words 1776 1.50 1.21 1.64 164 MultiRelay_CC 1734 0.48 1.18 0.16 165 XMReplyNow 1700 0.49 1.16 0.20 166 XM_B_DNDMA 1684 0.77 1.14 0.60 167 XMBody_78 1678 0.62 1.14 0.38 168 NO_DNS_FOR_FROM 1673 0.52 1.14 0.24 169 TM2_M_OBFU_COMMENT 1657 0.70 1.13 0.51 170 RCVD_IN_IADB_VOUCHED 1652 1.85 1.12 2.18 171 RCVD_IN_VALIDITY_CERTIFIED 1651 2.91 1.12 3.70 172 XM_UB80 1644 0.36 1.12 0.02 173 XM_UB60 1626 0.39 1.11 0.08 174 XM_GoogleGroups 1601 1.35 1.09 1.47 175 TR_XM_MaxWHORU 1577 0.46 1.07 0.19 176 XMHTML_After_End 1576 0.57 1.07 0.34 177 BAYES_20 1575 2.93 1.07 3.76 178 XM_HighProb1 1561 0.33 1.06 0.00 179 T_Symld_Words_02 1554 1.03 1.06 1.02 180 TR_XM_GMP_MissingTo 1549 0.38 1.05 0.07 181 STY_INVIS_DIRECT 1544 0.51 1.05 0.27 182 XMSubMetaI_00 1536 0.56 1.04 0.34 183 RDNS_DYNAMIC 1532 0.42 1.04 0.15 184 XM_B_COPY_HTML 1510 0.87 1.03 0.80 185 SHOPIFY_IMG_NOT_RCVD_SFY 1465 0.48 1.00 0.25 186 T_MONEY_PERCENT 1443 0.46 0.98 0.23 187 TR_LOTS_OF_MONEY2 1443 0.46 0.98 0.23 188 HTML_IMAGE_ONLY_20 1434 0.70 0.97 0.58 189 XMSlimDrugH 1399 0.80 0.95 0.73 190 XM_Lotto 1374 0.38 0.93 0.13 191 LongTLD 1373 0.57 0.93 0.41 192 XM_UB999 1367 0.29 0.93 0.00 193 HTTPS_HTTP_MISMATCH 1364 0.84 0.93 0.81 194 TM2_M_A_HREF_HREF 1361 0.48 0.93 0.28 195 TR_Mismatch_TLD_01 1351 0.45 0.92 0.25 196 DKIM_ADSP_CUSTOM_MED 1334 0.82 0.91 0.78 197 TR_XM_PHPForged 1331 0.46 0.90 0.26 198 TVD_RCVD_IP 1314 1.10 0.89 1.19 199 XM_OfRef7 1303 0.37 0.89 0.13 200 XM_S_SpammyWords 1294 0.38 0.88 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 286785 89.25 94.53 86.90 2 RELAYCOUNTRY_US 270875 81.71 80.88 82.07 3 DKIM_SIGNED 261080 82.16 89.02 79.11 4 XM_DK_Pass 256878 79.85 84.38 77.83 5 DKIM_VALID 253712 78.89 83.40 76.87 6 XM_B_Unicode 231914 74.25 83.18 70.27 7 DKIM_VALID_AU 208219 63.80 65.41 63.09 8 DCC_CHECK_NEGATIVE 206061 51.38 26.57 62.44 9 BAYES_50 200610 53.95 38.63 60.78 10 XMListUnsubscribeExists 165929 55.27 66.47 50.28 11 XM_B_SpammyWords 157194 54.27 69.17 47.63 12 XM_B_Unicode3 136893 43.35 47.54 41.48 13 DCC_CHECK 123757 48.09 71.87 37.50 14 DKIM_VALID_EF 105984 31.63 30.54 32.11 15 LOC_TINY_FONT_1 97900 35.22 47.70 29.66 16 T_TM2_M_HEADER_IN_MSG 95057 26.79 22.28 28.80 17 HTML_FONT_LOW_CONTRAST 93539 30.91 36.68 28.34 18 FVGT_m_MULTI_ODD 88098 28.39 32.20 26.69 19 XMSubLong 79527 24.41 25.11 24.10 20 T_KAM_HTML_FONT_INVALID 76086 25.73 31.74 23.05 21 RCVD_IN_MSPIKE_WL 68782 17.83 11.08 20.84 22 MIME_HTML_ONLY 67507 23.15 29.21 20.45 23 XM_B_SpammyWords2 67028 25.95 38.62 20.31 24 RCVD_IN_MSPIKE_H2 56401 18.21 20.72 17.09 25 ALL_TRUSTED 48540 10.68 1.65 14.71 26 XM_Multi_Part_URI 47541 16.64 21.64 14.40 27 TR_XM_DK_Unsub 46998 16.50 21.58 14.24 28 USER_IN_DEF_DKIM_WL 45216 10.21 2.37 13.70 29 UNPARSEABLE_RELAY 40762 13.69 16.70 12.35 30 BAYES_00 33583 7.21 0.57 10.18 31 XM_B_PhoneNumber 32340 8.64 6.04 9.80 32 RCVD_IN_MSPIKE_H3 30969 8.15 5.37 9.38 33 XM_B_Unsub 30139 12.20 19.09 9.13 34 XM_Evil_Numbers_Gen 27910 8.89 9.87 8.46 35 LotsOfNums_01 27714 7.61 5.86 8.40 36 TooManyTo_001 27444 7.21 4.74 8.32 37 RCVD_IN_MSPIKE_H5 24256 5.99 2.94 7.35 38 TR_XM_BayesUnsub 24124 10.70 18.32 7.31 39 BAYES_60 23965 7.52 8.11 7.26 40 TR_XM_DK_Bayes 22824 4.91 0.42 6.92 41 XM_DKIMWhitelistDomains 22661 4.75 0.01 6.87 42 TR_XM_DK_Bayes1 22530 4.85 0.42 6.83 43 TR_MAX_INTL_RELAY 20681 9.18 15.73 6.27 44 XM_H_GMP 19539 6.23 6.92 5.92 45 TR_XM_DK_Bayes2 19502 4.20 0.36 5.91 46 T_TooManySym_01 19422 4.80 2.35 5.88 47 LOTS_OF_MONEY 19243 8.38 14.09 5.83 48 XM_H_Long_From01 18827 5.76 5.89 5.70 49 XM_DK_Undo_02 18642 16.88 42.07 5.65 50 MIME_QP_LONG_LINE 18539 5.23 4.38 5.62 51 XMStrtUSub 18070 5.21 4.62 5.48 52 XM_B_Phish_Phrases 18031 6.51 8.84 5.46 53 BAYES_40 17009 4.06 1.60 5.15 54 MPART_ALT_DIFF 16861 5.47 6.29 5.11 55 HTML_IMAGE_RATIO_02 16519 5.30 5.95 5.01 56 FSL_BULK_SIG 16193 6.38 9.67 4.91 57 XM_B_SpammyWords3 15338 7.23 13.04 4.65 58 HTML_IMAGE_RATIO_04 14414 4.53 4.90 4.37 59 RCVD_IN_VALIDITY_SAFE 14129 3.45 1.60 4.28 60 XM_PDF 13921 3.16 0.78 4.22 61 RCVD_IN_MSPIKE_H4 13557 3.70 2.78 4.11 62 BAYES_99 13339 12.92 32.86 4.04 63 HTML_IMAGE_RATIO_06 12993 3.77 3.38 3.94 64 TR_XM_SpammyWords4 12871 6.39 11.96 3.90 65 BAYES_80 12763 5.67 9.73 3.87 66 XM_UncommonTLD01 12543 4.54 6.21 3.80 67 BAYES_20 12421 2.93 1.07 3.76 68 HTML_MIME_NO_HTML_TAG 12393 3.06 1.51 3.76 69 RCVD_IN_VALIDITY_CERTIFIED 12220 2.91 1.12 3.70 70 ANY_BOUNCE_MESSAGE 11939 3.34 2.70 3.62 71 BOUNCE_MESSAGE 11936 3.34 2.70 3.62 72 RELAYCOUNTRY_META 11863 7.92 17.64 3.59 73 T_REMOTE_IMAGE 11528 2.84 1.37 3.49 74 RCVD_IN_IADB_LISTED 11400 2.96 1.84 3.45 75 BOTNET_IPINHOSTNAME 10935 5.63 10.83 3.31 76 XMSubMetaSx_00 10835 4.09 5.91 3.28 77 BAYES_999 10548 9.90 24.93 3.20 78 TooManyTo_002 10431 2.36 0.56 3.16 79 XMNumbers 10283 3.46 4.23 3.12 80 MAILING_LIST_MULTI 10281 2.84 2.22 3.12 81 RCVD_IN_IADB_SPF 10171 2.61 1.54 3.08 82 T_TooManySym_02 9761 2.24 0.63 2.96 83 MIME_HTML_MOSTLY 9378 3.14 3.81 2.84 84 XM_Body_Dirty_Words 9347 3.77 5.86 2.83 85 RCVD_IN_IADB_SENDERID 9139 2.34 1.37 2.77 86 MIME_HTML_ONLY_MULTI 9071 2.73 2.69 2.75 87 RCVD_IN_IADB_DK 8873 2.29 1.39 2.69 88 XMDiploma_00 8481 2.75 3.15 2.57 89 XM_B_SpammyTLD 8430 3.04 4.12 2.55 90 BAYES_05 8427 1.92 0.48 2.55 91 TR_XM_DKIM_Undo 8243 11.25 30.88 2.50 92 HTML_IMAGE_RATIO_08 8198 2.60 2.85 2.48 93 BAYES_95 7916 3.33 5.42 2.40 94 DKIM_INVALID 7368 3.28 5.62 2.23 95 RCVD_IN_IADB_VOUCHED 7183 1.85 1.12 2.18 96 INVALID_MSGID 7078 1.57 0.28 2.14 97 XM_SendGrid 6730 1.84 1.40 2.04 98 TR_XM_SpammyRelay 6665 5.42 13.04 2.02 99 XM_B_URI_Unicode 6605 2.18 2.60 2.00 100 XM_CamelCaseFrm001 6589 2.24 2.77 2.00 101 TO_MALFORMED 6442 1.35 0.00 1.95 102 MSGID_NOFQDN1 6363 1.34 0.02 1.93 103 T_XMDrugObfuBody_14 6354 2.57 4.00 1.93 104 XMGenDplmaNmb 6330 1.90 1.85 1.92 105 TM2_M_URI_OPT_OUT 6197 2.24 3.07 1.88 106 T_XMDrugObfuBody_08 6112 2.71 4.62 1.85 107 XM_DK_Undo_01 5880 1.76 1.70 1.78 108 TR_XM_UnparsRelay 5564 3.73 8.31 1.69 109 XM_B_Investor 5495 2.61 4.74 1.66 110 TR_Symld_Words 5404 1.50 1.21 1.64 111 TR_XM_SpammyWords5 5201 2.49 4.55 1.58 112 RCVD_IN_IADB_OPTIN 5181 1.33 0.79 1.57 113 TR_XM_PhishingBody 5116 2.39 4.28 1.55 114 UNTRUSTED_Relay 4959 3.18 6.95 1.50 115 SUBJ_ALL_CAPS 4905 1.72 2.24 1.49 116 TM2_M_VERY_LONG_WORD 4873 2.07 3.41 1.48 117 XM_GoogleGroups 4858 1.35 1.09 1.47 118 TooManyTo_003 4797 1.15 0.47 1.45 119 TR_DCC_Bayes_99 4742 7.93 22.49 1.44 120 XM_B_Unsub2 4646 1.84 2.82 1.41 121 FROM_EXCESS_BASE64 4643 1.57 1.95 1.41 122 URI_NOVOWEL 4475 1.35 1.34 1.36 123 XMStockSpam_06 4393 1.52 1.96 1.33 124 T_XMDrugObfuBody_00 4298 1.57 2.16 1.30 125 IN_HORDE_ADDRESS_BOOK 4206 0.91 0.10 1.27 126 XM_SPF_SoftFail 4190 1.91 3.36 1.27 127 URI_HEX 4141 1.41 1.77 1.25 128 BOTNET 4140 4.03 10.26 1.25 129 HELO_NODOT 3948 0.88 0.17 1.20 130 HELO_NO_DOMAIN 3944 0.88 0.16 1.20 131 TVD_RCVD_IP 3933 1.10 0.89 1.19 132 T_TooManySym_03 3855 0.87 0.19 1.17 133 XMGappySubj_01 3828 0.86 0.19 1.16 134 KHOP_HELO_FCRDNS 3815 1.23 1.39 1.16 135 XM_B_FormFill 3707 0.78 0.01 1.12 136 TooManyTo_004 3620 0.89 0.42 1.10 137 RCVD_IN_MSPIKE_BL 3603 2.99 7.24 1.09 138 TR_XM_MSPIKECOMBO 3599 2.98 7.23 1.09 139 T_XMHurry_00 3598 1.41 2.13 1.09 140 XM_OfRef6 3503 2.11 4.47 1.06 141 XM_UB50 3376 1.51 2.61 1.02 142 XMCapTrack 3361 0.84 0.45 1.02 143 T_Symld_Words_02 3355 1.03 1.06 1.02 144 TR_MetaPhish_Combo_01 3305 0.93 0.76 1.00 145 TR_XM_DK_SendGrid 3302 0.96 0.87 1.00 146 XM_ShortIntro_01 3124 0.84 0.60 0.95 147 RCVD_IN_MSPIKE_L3 3085 2.16 4.91 0.93 148 XM_H_Long_From02 3077 1.26 2.00 0.93 149 XMSexyCombo_05 3052 1.82 3.82 0.92 150 TVD_SPACE_RATIO 2968 0.69 0.22 0.90 151 TooManyTo_005 2965 0.74 0.38 0.90 152 FROM_GOV_DKIM_AU 2963 0.78 0.50 0.90 153 XMBrknScrpt_02 2864 1.07 1.51 0.87 154 XM_H_PHPMailer 2678 0.83 0.86 0.81 155 HTTPS_HTTP_MISMATCH 2661 0.84 0.93 0.81 156 XM_B_COPY_HTML 2632 0.87 1.03 0.80 157 DKIM_ADSP_CUSTOM_MED 2582 0.82 0.91 0.78 158 T_FILL_THIS_FORM_SHORT 2571 1.15 1.98 0.78 159 RCVD_IN_BL_SPAMCOP_NET 2460 4.48 12.86 0.75 160 RELAYCOUNTRY_AU 2417 1.32 2.64 0.73 161 XMSlimDrugH 2400 0.80 0.95 0.73 162 RELAYCOUNTRY_CA 2356 2.49 6.49 0.71 163 SpammyFromTLD_01 2256 0.92 1.46 0.68 164 XMBSHREFv2 2208 0.60 0.43 0.67 165 RELAYCOUNTRY_GB 2192 0.72 0.84 0.66 166 RCVD_IN_PBL 2179 0.84 1.23 0.66 167 MPART_ALT_DIFF_COUNT 2146 0.84 1.28 0.65 168 XMGappySubj_02 1992 0.45 0.10 0.60 169 XM_B_DNDMA 1967 0.77 1.14 0.60 170 XMPhish30 1949 0.86 1.48 0.59 171 TO_NO_BRKTS_HTML_ONLY 1946 0.44 0.11 0.59 172 XM_B_SpammyWords4 1930 1.08 2.20 0.58 173 HTML_IMAGE_ONLY_20 1922 0.70 0.97 0.58 174 XMDiploma_06 1877 0.63 0.76 0.57 175 XMNoVowels 1801 0.54 0.51 0.55 176 T_OBFU_PDF_ATTACH 1795 0.43 0.16 0.54 177 HTML_TAG_BALANCE_BODY 1790 0.63 0.82 0.54 178 TR_XM_SpammyWords3 1784 2.02 5.34 0.54 179 URI_TRY_3LD 1756 0.76 1.27 0.53 180 T_TVD_MIME_NO_HEADERS 1713 0.37 0.05 0.52 181 MSGID_FROM_MTA_HEADER 1708 0.42 0.20 0.52 182 XMBdyGiftCard01 1706 0.77 1.35 0.52 183 TR_XM_SpammyWords2 1705 3.65 10.70 0.52 184 XM_ProductURIs 1697 0.81 1.48 0.51 185 TM2_M_OBFU_COMMENT 1688 0.70 1.13 0.51 186 FORGED_GMAIL_RCVD 1683 0.56 0.68 0.51 187 NML_ADSP_CUSTOM_MED 1639 0.58 0.77 0.50 188 SpammyFromTLD_02 1572 0.97 2.07 0.48 189 XMPhish14 1490 0.57 0.85 0.45 190 XMLngstWrd_00 1460 0.47 0.53 0.44 191 TR_XM_Base64_M1 1458 0.57 0.86 0.44 192 TR_XM_GMP_MSPIKE_UNDO2 1452 0.37 0.21 0.44 193 PLING_QUERY 1406 0.49 0.64 0.43 194 XMBody_17 1373 1.16 2.82 0.42 195 SHORT_HELO_AND_INLINE_IMAGE 1371 0.29 0.02 0.42 196 XMMoneyMeta_00 1369 0.53 0.78 0.41 197 LongTLD 1364 0.57 0.93 0.41 198 HTML_IMAGE_ONLY_32 1346 0.33 0.16 0.41 199 XMBody_95 1291 0.35 0.24 0.39 200 XM_Ancestry_Forge 1290 0.27 0.01 0.39 ----------------------------------------------------------------------