Email: 455812 Autolearn: 0 AvgScore: 5.07 AvgScanTime: 1.40 sec Spam: 133403 Autolearn: 0 AvgScore: 15.09 AvgScanTime: 1.59 sec Ham: 322409 Autolearn: 0 AvgScore: 0.93 AvgScanTime: 1.32 sec Time Spent Running SA: 177.30 hours Time Spent Processing Spam: 58.86 hours Time Spent Processing Ham: 118.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125758 87.36 94.27 84.50 2 DKIM_SIGNED 119539 77.87 89.61 73.01 3 XM_DK_Pass 111286 75.06 83.42 71.59 4 XM_B_Unicode 110183 71.93 82.59 67.51 5 DKIM_VALID 110029 74.00 82.48 70.49 6 RELAYCOUNTRY_US 106521 79.75 79.85 79.70 7 DCC_CHECK 96265 46.20 72.16 35.45 8 XM_B_SpammyWords 91810 50.72 68.82 43.23 9 XMListUnsubscribeExists 87377 50.47 65.50 44.25 10 DKIM_VALID_AU 87191 59.70 65.36 57.36 11 XM_B_Unicode3 65883 42.84 49.39 40.13 12 LOC_TINY_FONT_1 61303 32.98 45.95 27.61 13 XM_DK_Undo_02 54413 15.55 40.79 5.10 14 BAYES_50 51434 53.13 38.56 59.16 15 XM_B_SpammyWords2 50794 23.44 38.08 17.38 16 HTML_FONT_LOW_CONTRAST 47286 30.04 35.45 27.80 17 FVGT_m_MULTI_ODD 44527 26.60 33.38 23.79 18 BAYES_99 42237 11.84 31.66 3.64 19 DKIM_VALID_EF 40649 31.01 30.47 31.23 20 TR_XM_DKIM_Undo 39861 10.29 29.88 2.19 21 T_KAM_HTML_FONT_INVALID 39750 22.83 29.80 19.95 22 MIME_HTML_ONLY 38582 22.47 28.92 19.80 23 DCC_CHECK_NEGATIVE 34818 53.25 26.10 64.48 24 BAYES_999 32130 9.00 24.08 2.76 25 T_TM2_M_HEADER_IN_MSG 31223 28.89 23.41 31.15 26 XMSubLong 31034 22.62 23.26 22.35 27 XM_Multi_Part_URI 29028 15.09 21.76 12.33 28 TR_DCC_Bayes_99 29015 7.17 21.75 1.13 29 TR_XM_DK_Unsub 27840 15.46 20.87 13.23 30 XM_B_Unsub 27338 12.43 20.49 9.10 31 TR_XM_BayesUnsub 25663 10.76 19.24 7.25 32 RCVD_IN_MSPIKE_H2 25042 17.03 18.77 16.30 33 RELAYCOUNTRY_META 24723 7.87 18.53 3.46 34 UNPARSEABLE_RELAY 22410 13.45 16.80 12.06 35 TR_MAX_INTL_RELAY 20953 8.54 15.71 5.58 36 XM_B_SpammyWords3 17467 6.97 13.09 4.43 37 TR_XM_SpammyRelay 17319 5.01 12.98 1.71 38 RCVD_IN_BL_SPAMCOP_NET 17003 4.14 12.75 0.58 39 LOTS_OF_MONEY 15814 7.93 11.85 6.30 40 RCVD_IN_MSPIKE_WL 15407 16.97 11.55 19.21 41 BOTNET 15394 4.30 11.54 1.31 42 BOTNET_IPINHOSTNAME 14768 5.52 11.07 3.22 43 FSL_BULK_SIG 14763 8.48 11.07 7.42 44 TR_XM_SpammyWords4 14028 6.18 10.52 4.39 45 TR_XM_SpammyWords2 13798 3.34 10.34 0.44 46 BAYES_80 12637 5.21 9.47 3.45 47 XM_Evil_Numbers_Gen 12148 9.49 9.11 9.64 48 TR_XM_UnparsRelay 11349 3.61 8.51 1.58 49 BAYES_60 11034 6.97 8.27 6.43 50 XM_B_Phish_Phrases 11032 6.13 8.27 5.25 51 RCVD_IN_MSPIKE_BL 10609 2.97 7.95 0.91 52 TR_XM_MSPIKECOMBO 10606 2.97 7.95 0.91 53 MPART_ALT_DIFF 9842 5.69 7.38 4.98 54 UNTRUSTED_Relay 9800 3.17 7.35 1.44 55 DKIM_INVALID 9510 3.87 7.13 2.52 56 XMStrtUSub 8810 5.47 6.60 5.00 57 HTML_IMAGE_RATIO_02 8807 5.32 6.60 4.80 58 XM_B_PhoneNumber 8495 8.58 6.37 9.50 59 RELAYCOUNTRY_CA 8357 2.31 6.26 0.68 60 XMSubMetaSx_00 8080 3.95 6.06 3.08 61 RCVD_IN_MSPIKE_L3 7656 2.22 5.74 0.77 62 XM_UncommonTLD01 7550 5.11 5.66 4.88 63 BAYES_95 7516 3.16 5.63 2.13 64 RCVD_IN_MSPIKE_H3 7494 7.85 5.62 8.77 65 XM_Body_Dirty_Words 7293 3.05 5.47 2.05 66 TR_XM_SpammyWords5 7279 2.42 5.46 1.16 67 TR_XM_SPAMCOP 7125 1.71 5.34 0.21 68 TR_XM_SpammyWords3 7023 1.85 5.26 0.43 69 XM_H_GMP 6921 5.52 5.19 5.66 70 LotsOfNums_01 6877 7.51 5.16 8.49 71 XM_H_Long_From01 6803 5.13 5.10 5.15 72 XMNumbers 6734 3.86 5.05 3.37 73 XM_B_Investor 6425 2.47 4.82 1.50 74 TooManyTo_001 6399 7.22 4.80 8.22 75 MIME_QP_LONG_LINE 6344 4.92 4.76 4.99 76 TR_XM_PhishingBody 6300 2.44 4.72 1.49 77 HTML_IMAGE_RATIO_04 6213 4.28 4.66 4.12 78 XM_B_SpammyTLD 6109 3.09 4.58 2.47 79 T_XMDrugObfuBody_14 5414 2.33 4.06 1.61 80 T_XMDrugObfuBody_08 5323 2.49 3.99 1.87 81 MIME_HTML_MOSTLY 5107 3.18 3.83 2.91 82 XM_OfRef6 5089 1.69 3.81 0.80 83 TR_XM_NoHeaderRelay 5045 1.20 3.78 0.13 84 TM2_M_VERY_LONG_WORD 4955 3.21 3.71 3.00 85 RELAYCOUNTRY_AU 4827 1.45 3.62 0.55 86 XMSexyCombo_05 4819 1.77 3.61 1.01 87 DKIM_ADSP_NXDOMAIN 4771 1.30 3.58 0.36 88 XM_CamelCaseFrm001 4523 2.31 3.39 1.87 89 RCVD_IN_MSPIKE_H5 4277 5.45 3.21 6.38 90 HTML_IMAGE_RATIO_06 4181 2.97 3.13 2.90 91 XM_B_Unsub2 4124 1.83 3.09 1.31 92 XM_SPF_SoftFail 4059 1.80 3.04 1.28 93 XM_URI_RBL 3917 1.17 2.94 0.43 94 TR_XM_MSPIKECOMBO2 3914 0.92 2.93 0.09 95 XMDiploma_00 3821 2.03 2.86 1.69 96 XM_UB50 3740 1.50 2.80 0.97 97 MIME_HTML_ONLY_MULTI 3708 2.65 2.78 2.60 98 RCVD_IN_MSPIKE_H4 3636 3.67 2.73 4.06 99 T_TooManySym_01 3603 5.13 2.70 6.14 100 TR_XM_INV_DKIM 3368 0.75 2.52 0.01 101 RCVD_IN_VALIDITY_RPBL 3292 0.74 2.47 0.03 102 FROM_EXCESS_BASE64 3278 1.64 2.46 1.30 103 TM2_M_URI_OPT_OUT 3260 2.07 2.44 1.92 104 XM_B_URI_Unicode 3234 1.99 2.42 1.81 105 XMBody_17 3109 0.98 2.33 0.43 106 SUBJ_ALL_CAPS 2914 1.78 2.18 1.61 107 TR_XM_MaxSPIKE 2910 0.67 2.18 0.05 108 HTML_IMAGE_RATIO_08 2850 2.44 2.14 2.57 109 T_XMHurry_00 2818 0.98 2.11 0.51 110 MAILING_LIST_MULTI 2764 2.87 2.07 3.21 111 XM_H_DKIM_GOOG 2761 0.61 2.07 0.01 112 XM_B_SpammyWords4 2710 1.02 2.03 0.60 113 XM_H_Long_From02 2703 1.23 2.03 0.91 114 USER_IN_DEF_DKIM_WL 2700 9.26 2.02 12.25 115 BAYES_40 2661 4.55 1.99 5.61 116 SpammyFromTLD_02 2634 0.76 1.97 0.26 117 XMBrknScrpt_02 2558 1.50 1.92 1.33 118 XMPhish30 2524 0.93 1.89 0.53 119 MultiRelay_CC 2521 0.66 1.89 0.16 120 XMStockSpam_06 2495 1.74 1.87 1.69 121 SpammyFromTLD_01 2483 1.70 1.86 1.64 122 XM_B_Phish66 2474 0.77 1.85 0.31 123 T_FILL_THIS_FORM_SHORT 2462 1.16 1.85 0.88 124 TR_XM_INTL_Spamhaus 2444 0.69 1.83 0.21 125 XMGenDplmaNmb 2423 1.16 1.82 0.88 126 ANY_BOUNCE_MESSAGE 2323 6.73 1.74 8.80 127 BOUNCE_MESSAGE 2323 6.73 1.74 8.80 128 TR_LOTS_OF_MONEY3 2309 0.71 1.73 0.29 129 HTML_IMAGE_ONLY_20 2289 0.98 1.72 0.67 130 HK_RANDOM_REPLYTO 2272 0.55 1.70 0.08 131 SHORTCIRCUIT 2257 0.50 1.69 0.00 132 RCVD_IN_ZEN_LASTEXTERNAL 2257 0.50 1.69 0.00 133 KHOP_HELO_FCRDNS 2233 2.34 1.67 2.62 134 URI_HEX 2215 1.27 1.66 1.11 135 XM_B_SEO 2161 0.70 1.62 0.32 136 RCVD_IN_MSPIKE_L4 2123 0.56 1.59 0.13 137 RCVD_IN_IADB_LISTED 2121 2.55 1.59 2.94 138 T_XMDrugObfuBody_00 2110 1.09 1.58 0.89 139 DIET_1 2101 0.61 1.57 0.22 140 XM_SendGrid 2080 1.54 1.56 1.53 141 RDNS_DYNAMIC 2023 0.56 1.52 0.16 142 RCVD_IN_VALIDITY_SAFE 2012 2.63 1.51 3.09 143 BAYES_20 1959 5.09 1.47 6.58 144 ALL_TRUSTED 1895 12.74 1.42 17.42 145 XM_UB99 1882 0.41 1.41 0.00 146 XM_DK_Undo_01 1874 1.66 1.40 1.76 147 URI_NOVOWEL 1866 1.16 1.40 1.06 148 URI_TRY_3LD 1832 0.78 1.37 0.54 149 TR_XM_SEO4 1818 0.56 1.36 0.23 150 HTML_MIME_NO_HTML_TAG 1799 3.00 1.35 3.68 151 HTTPS_HTTP_MISMATCH 1795 0.93 1.35 0.75 152 RCVD_IN_PBL 1750 0.89 1.31 0.72 153 T_Symld_Words_02 1744 0.93 1.31 0.78 154 RCVD_IN_XBL 1729 0.40 1.30 0.03 155 RELAYCOUNTRY_RU 1701 0.39 1.28 0.02 156 XMBody_78 1692 0.58 1.27 0.29 157 HTML_FONT_TINY_NORDNS 1685 0.41 1.26 0.06 158 RCVD_IN_IADB_SPF 1662 2.23 1.25 2.63 159 TR_LOTS_OF_MONEY2 1654 0.55 1.24 0.27 160 T_MONEY_PERCENT 1654 0.55 1.24 0.27 161 MPART_ALT_DIFF_COUNT 1622 0.79 1.22 0.61 162 T_REMOTE_IMAGE 1608 2.84 1.21 3.52 163 RCVD_IN_SBL_CSS 1599 0.39 1.20 0.06 164 XM_B_COPY_HTML 1560 0.80 1.17 0.65 165 XM_UB80 1520 0.35 1.14 0.02 166 XM_B_DNDMA 1513 0.56 1.13 0.33 167 XMSubMetaI_00 1506 0.66 1.13 0.47 168 RCVD_IN_IADB_DK 1492 1.94 1.12 2.28 169 STY_INVIS_DIRECT 1473 0.55 1.10 0.32 170 RCVD_IN_IADB_SENDERID 1472 2.00 1.10 2.38 171 TR_Symld_Words 1448 1.52 1.09 1.69 172 RELAYCOUNTRY_FR 1448 0.51 1.09 0.27 173 XMSlimDrugH 1440 0.73 1.08 0.59 174 TR_XM_PHPForged 1439 0.63 1.08 0.44 175 TR_XM_RelayPhish 1438 0.39 1.08 0.11 176 RCVD_IN_IADB_VOUCHED 1434 1.59 1.07 1.80 177 TR_XM_FormFill2 1410 0.62 1.06 0.44 178 XM_UB60 1408 0.36 1.06 0.07 179 TR_XM_PHPDW 1404 0.62 1.05 0.44 180 XM_H_PHPOS 1378 0.61 1.03 0.43 181 RCVD_IN_VALIDITY_CERTIFIED 1378 2.13 1.03 2.59 182 TR_Mismatch_TLD_02 1378 0.39 1.03 0.12 183 TVD_RCVD_IP 1367 0.92 1.02 0.88 184 XMHTML_After_End 1364 0.56 1.02 0.37 185 HTML_SHORT_LINK_IMG_3 1354 0.36 1.01 0.08 186 DKIM_ADSP_CUSTOM_MED 1348 0.83 1.01 0.76 187 THIS_AD 1342 0.49 1.01 0.28 188 XMPhish14 1341 0.56 1.01 0.37 189 XMSexyCombo_01 1340 0.38 1.00 0.12 190 BOTNET_NORDNS 1327 0.30 0.99 0.02 191 TM2_M_A_HREF_HREF 1326 0.52 0.99 0.33 192 XM_ProductURIs 1295 0.60 0.97 0.45 193 TR_XM_InvalidRelay 1260 0.29 0.94 0.01 194 TR_XM_GMP_BULK_SIG 1255 0.38 0.94 0.14 195 XMNoVowels 1250 0.77 0.94 0.70 196 HELO_DYNAMIC_SPLIT_IP 1236 0.28 0.93 0.01 197 RCVD_IN_PSBL 1223 0.29 0.92 0.04 198 XM_DIRTYINTL 1219 0.30 0.91 0.05 199 XM_HighProb1 1217 0.27 0.91 0.00 200 XM_H_Undi_Recip 1215 0.43 0.91 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 272425 87.36 94.27 84.50 2 RELAYCOUNTRY_US 256968 79.75 79.85 79.70 3 DKIM_SIGNED 235404 77.87 89.61 73.01 4 XM_DK_Pass 230827 75.06 83.42 71.59 5 DKIM_VALID 227273 74.00 82.48 70.49 6 XM_B_Unicode 217667 71.93 82.59 67.51 7 DCC_CHECK_NEGATIVE 207900 53.25 26.10 64.48 8 BAYES_50 190743 53.13 38.56 59.16 9 DKIM_VALID_AU 184949 59.70 65.36 57.36 10 XMListUnsubscribeExists 142675 50.47 65.50 44.25 11 XM_B_SpammyWords 139371 50.72 68.82 43.23 12 XM_B_Unicode3 129393 42.84 49.39 40.13 13 DCC_CHECK 114310 46.20 72.16 35.45 14 DKIM_VALID_EF 100703 31.01 30.47 31.23 15 T_TM2_M_HEADER_IN_MSG 100445 28.89 23.41 31.15 16 HTML_FONT_LOW_CONTRAST 89625 30.04 35.45 27.80 17 LOC_TINY_FONT_1 89029 32.98 45.95 27.61 18 FVGT_m_MULTI_ODD 76703 26.60 33.38 23.79 19 XMSubLong 72073 22.62 23.26 22.35 20 T_KAM_HTML_FONT_INVALID 64326 22.83 29.80 19.95 21 MIME_HTML_ONLY 63836 22.47 28.92 19.80 22 RCVD_IN_MSPIKE_WL 61950 16.97 11.55 19.21 23 ALL_TRUSTED 56163 12.74 1.42 17.42 24 XM_B_SpammyWords2 56032 23.44 38.08 17.38 25 RCVD_IN_MSPIKE_H2 52566 17.03 18.77 16.30 26 TR_XM_DK_Unsub 42643 15.46 20.87 13.23 27 XM_Multi_Part_URI 39746 15.09 21.76 12.33 28 USER_IN_DEF_DKIM_WL 39501 9.26 2.02 12.25 29 UNPARSEABLE_RELAY 38876 13.45 16.80 12.06 30 BAYES_00 34855 7.82 0.60 10.81 31 XM_Evil_Numbers_Gen 31095 9.49 9.11 9.64 32 XM_B_PhoneNumber 30622 8.58 6.37 9.50 33 XM_B_Unsub 29326 12.43 20.49 9.10 34 BOUNCE_MESSAGE 28366 6.73 1.74 8.80 35 ANY_BOUNCE_MESSAGE 28366 6.73 1.74 8.80 36 RCVD_IN_MSPIKE_H3 28279 7.85 5.62 8.77 37 LotsOfNums_01 27372 7.51 5.16 8.49 38 TooManyTo_001 26491 7.22 4.80 8.22 39 TR_XM_DK_Bayes 25271 5.67 0.43 7.84 40 TR_XM_DK_Bayes1 24940 5.60 0.43 7.74 41 FSL_BULK_SIG 23909 8.48 11.07 7.42 42 TR_XM_BayesUnsub 23376 10.76 19.24 7.25 43 BAYES_20 21224 5.09 1.47 6.58 44 BAYES_60 20738 6.97 8.27 6.43 45 RCVD_IN_MSPIKE_H5 20568 5.45 3.21 6.38 46 LOTS_OF_MONEY 20320 7.93 11.85 6.30 47 XM_DKIMWhitelistDomains 19989 4.41 0.07 6.20 48 T_TooManySym_01 19797 5.13 2.70 6.14 49 TR_XM_DK_Bayes2 18509 4.17 0.36 5.74 50 XM_H_GMP 18256 5.52 5.19 5.66 51 BAYES_40 18088 4.55 1.99 5.61 52 TR_MAX_INTL_RELAY 17990 8.54 15.71 5.58 53 XM_B_Phish_Phrases 16913 6.13 8.27 5.25 54 XM_H_Long_From01 16598 5.13 5.10 5.15 55 XM_DK_Undo_02 16455 15.55 40.79 5.10 56 XMStrtUSub 16121 5.47 6.60 5.00 57 MIME_QP_LONG_LINE 16103 4.92 4.76 4.99 58 MPART_ALT_DIFF 16072 5.69 7.38 4.98 59 XM_UncommonTLD01 15721 5.11 5.66 4.88 60 HTML_IMAGE_RATIO_02 15464 5.32 6.60 4.80 61 XM_PDF 14737 3.49 0.87 4.57 62 XM_B_SpammyWords3 14290 6.97 13.09 4.43 63 TR_XM_SpammyWords4 14139 6.18 10.52 4.39 64 HTML_IMAGE_RATIO_04 13296 4.28 4.66 4.12 65 RCVD_IN_MSPIKE_H4 13103 3.67 2.73 4.06 66 HTML_MIME_NO_HTML_TAG 11864 3.00 1.35 3.68 67 BAYES_99 11738 11.84 31.66 3.64 68 T_REMOTE_IMAGE 11349 2.84 1.21 3.52 69 RELAYCOUNTRY_META 11163 7.87 18.53 3.46 70 BAYES_80 11115 5.21 9.47 3.45 71 XMNumbers 10851 3.86 5.05 3.37 72 BOTNET_IPINHOSTNAME 10376 5.52 11.07 3.22 73 MAILING_LIST_MULTI 10338 2.87 2.07 3.21 74 T_TooManySym_02 10121 2.40 0.62 3.14 75 RCVD_IN_VALIDITY_SAFE 9966 2.63 1.51 3.09 76 XMSubMetaSx_00 9918 3.95 6.06 3.08 77 TM2_M_VERY_LONG_WORD 9685 3.21 3.71 3.00 78 RCVD_IN_IADB_LISTED 9490 2.55 1.59 2.94 79 MIME_HTML_MOSTLY 9396 3.18 3.83 2.91 80 HTML_IMAGE_RATIO_06 9334 2.97 3.13 2.90 81 TooManyTo_002 9158 2.26 0.86 2.84 82 BAYES_999 8909 9.00 24.08 2.76 83 RCVD_IN_IADB_SPF 8489 2.23 1.25 2.63 84 KHOP_HELO_FCRDNS 8435 2.34 1.67 2.62 85 MIME_HTML_ONLY_MULTI 8392 2.65 2.78 2.60 86 RCVD_IN_VALIDITY_CERTIFIED 8338 2.13 1.03 2.59 87 HTML_IMAGE_RATIO_08 8272 2.44 2.14 2.57 88 DKIM_INVALID 8131 3.87 7.13 2.52 89 XM_B_SpammyTLD 7971 3.09 4.58 2.47 90 RCVD_IN_IADB_SENDERID 7658 2.00 1.10 2.38 91 RCVD_IN_IADB_DK 7358 1.94 1.12 2.28 92 INVALID_MSGID 7053 1.61 0.22 2.19 93 TR_XM_DKIM_Undo 7045 10.29 29.88 2.19 94 BAYES_05 7033 1.73 0.65 2.18 95 BAYES_95 6873 3.16 5.63 2.13 96 XM_Body_Dirty_Words 6600 3.05 5.47 2.05 97 TO_MALFORMED 6452 1.42 0.02 2.00 98 MSGID_NOFQDN1 6362 1.40 0.01 1.97 99 TM2_M_URI_OPT_OUT 6190 2.07 2.44 1.92 100 T_XMDrugObfuBody_08 6043 2.49 3.99 1.87 101 XM_CamelCaseFrm001 6016 2.31 3.39 1.87 102 XM_B_URI_Unicode 5820 1.99 2.42 1.81 103 RCVD_IN_IADB_VOUCHED 5805 1.59 1.07 1.80 104 XM_DK_Undo_01 5686 1.66 1.40 1.76 105 TR_XM_SpammyRelay 5501 5.01 12.98 1.71 106 TooManyTo_003 5494 1.43 0.75 1.70 107 TR_Symld_Words 5458 1.52 1.09 1.69 108 XMStockSpam_06 5446 1.74 1.87 1.69 109 XMDiploma_00 5438 2.03 2.86 1.69 110 SpammyFromTLD_01 5284 1.70 1.86 1.64 111 T_XMDrugObfuBody_14 5198 2.33 4.06 1.61 112 SUBJ_ALL_CAPS 5192 1.78 2.18 1.61 113 TR_XM_UnparsRelay 5085 3.61 8.51 1.58 114 XM_SendGrid 4938 1.54 1.56 1.53 115 XM_B_Investor 4842 2.47 4.82 1.50 116 TR_XM_PhishingBody 4802 2.44 4.72 1.49 117 XM_GoogleGroups 4685 1.29 0.91 1.45 118 UNTRUSTED_Relay 4628 3.17 7.35 1.44 119 HELO_NODOT 4277 0.99 0.17 1.33 120 XMBrknScrpt_02 4275 1.50 1.92 1.33 121 HELO_NO_DOMAIN 4266 0.98 0.15 1.32 122 XM_B_Unsub2 4226 1.83 3.09 1.31 123 BOTNET 4214 4.30 11.54 1.31 124 T_TVD_MIME_NO_HEADERS 4214 0.94 0.05 1.31 125 TooManyTo_004 4187 1.12 0.69 1.30 126 RCVD_IN_IADB_OPTIN 4176 1.12 0.71 1.30 127 FROM_EXCESS_BASE64 4176 1.64 2.46 1.30 128 IN_HORDE_ADDRESS_BOOK 4162 0.93 0.07 1.29 129 XM_SPF_SoftFail 4130 1.80 3.04 1.28 130 T_TooManySym_03 4022 0.94 0.18 1.25 131 XMCapTrack 3997 1.03 0.53 1.24 132 MIME_CHARSET_FARAWAY 3965 0.97 0.35 1.23 133 TR_XM_SpammyWords5 3755 2.42 5.46 1.16 134 CHARSET_FARAWAY_HEADER 3715 0.87 0.18 1.15 135 TR_DCC_Bayes_99 3645 7.17 21.75 1.13 136 URI_HEX 3584 1.27 1.66 1.11 137 XM_ShortIntro_01 3576 0.99 0.69 1.11 138 URI_NOVOWEL 3405 1.16 1.40 1.06 139 TooManyTo_005 3395 0.94 0.65 1.05 140 TR_XM_DK_SendGrid 3269 0.95 0.80 1.01 141 XMSexyCombo_05 3265 1.77 3.61 1.01 142 XMLngstWrd_00 3259 0.84 0.43 1.01 143 XM_UB50 3116 1.50 2.80 0.97 144 TVD_SPACE_RATIO 3045 0.72 0.18 0.94 145 TR_XM_MSPIKECOMBO 2931 2.97 7.95 0.91 146 RCVD_IN_MSPIKE_BL 2931 2.97 7.95 0.91 147 XM_H_Long_From02 2919 1.23 2.03 0.91 148 XMGappySubj_01 2896 0.71 0.27 0.90 149 T_XMDrugObfuBody_00 2855 1.09 1.58 0.89 150 T_FILL_THIS_FORM_SHORT 2846 1.16 1.85 0.88 151 TVD_RCVD_IP 2843 0.92 1.02 0.88 152 XMGenDplmaNmb 2842 1.16 1.82 0.88 153 XM_OfRef6 2592 1.69 3.81 0.80 154 T_Symld_Words_02 2508 0.93 1.31 0.78 155 RCVD_IN_MSPIKE_L3 2472 2.22 5.74 0.77 156 DKIM_ADSP_CUSTOM_MED 2445 0.83 1.01 0.76 157 HTTPS_HTTP_MISMATCH 2427 0.93 1.35 0.75 158 TO_NO_BRKTS_HTML_ONLY 2418 0.58 0.15 0.75 159 RELAYCOUNTRY_GB 2359 0.78 0.89 0.73 160 RCVD_IN_PBL 2306 0.89 1.31 0.72 161 XM_H_PHPMailer 2285 0.65 0.49 0.71 162 T_OBFU_PDF_ATTACH 2274 0.55 0.18 0.71 163 XMNoVowels 2271 0.77 0.94 0.70 164 RELAYCOUNTRY_CA 2188 2.31 6.26 0.68 165 TR_MetaPhish_Combo_01 2185 0.70 0.75 0.68 166 HTML_IMAGE_ONLY_20 2172 0.98 1.72 0.67 167 XMBSHREFv2 2100 0.60 0.48 0.65 168 XM_B_COPY_HTML 2089 0.80 1.17 0.65 169 MPART_ALT_DIFF_COUNT 1973 0.79 1.22 0.61 170 MSGID_FROM_MTA_HEADER 1936 0.49 0.24 0.60 171 XM_B_SpammyWords4 1929 1.02 2.03 0.60 172 FROM_GOV_DKIM_AU 1908 0.47 0.17 0.59 173 XMGappySubj_02 1898 0.43 0.06 0.59 174 XMSlimDrugH 1889 0.73 1.08 0.59 175 RCVD_IN_BL_SPAMCOP_NET 1870 4.14 12.75 0.58 176 XMBdyGiftCard01 1816 0.62 0.75 0.56 177 RELAYCOUNTRY_AU 1777 1.45 3.62 0.55 178 URI_TRY_3LD 1731 0.78 1.37 0.54 179 XMPhish30 1699 0.93 1.89 0.53 180 T_XMHurry_00 1657 0.98 2.11 0.51 181 XMMoneyMeta_00 1636 0.57 0.72 0.51 182 TR_XM_Base64_M1 1621 0.59 0.81 0.50 183 HTML_TAG_BALANCE_BODY 1548 0.57 0.78 0.48 184 XMSubMetaI_00 1516 0.66 1.13 0.47 185 NML_ADSP_CUSTOM_MED 1504 0.57 0.83 0.47 186 FORGED_GMAIL_RCVD 1501 0.53 0.70 0.47 187 FILL_THIS_FORM 1491 0.43 0.34 0.46 188 XM_ProductURIs 1435 0.60 0.97 0.45 189 LongTLD 1431 0.47 0.53 0.44 190 TR_XM_FormFill2 1431 0.62 1.06 0.44 191 TR_XM_PHPDW 1429 0.62 1.05 0.44 192 TR_XM_PHPForged 1422 0.63 1.08 0.44 193 TR_XM_SpammyWords2 1418 3.34 10.34 0.44 194 XMDateMe_00 1418 0.44 0.44 0.44 195 HTML_IMAGE_ONLY_32 1415 0.37 0.21 0.44 196 XM_B_FormFill 1412 0.32 0.03 0.44 197 XMLngstWrd_01 1411 0.42 0.38 0.44 198 XM_URI_RBL 1397 1.17 2.94 0.43 199 TVD_PH_SEC 1395 0.33 0.07 0.43 200 XM_H_PHPOS 1390 0.61 1.03 0.43 ----------------------------------------------------------------------