Email: 467514 Autolearn: 0 AvgScore: 5.26 AvgScanTime: 1.48 sec Spam: 144838 Autolearn: 0 AvgScore: 14.87 AvgScanTime: 1.67 sec Ham: 322676 Autolearn: 0 AvgScore: 0.95 AvgScanTime: 1.39 sec Time Spent Running SA: 192.01 hours Time Spent Processing Spam: 67.15 hours Time Spent Processing Ham: 124.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136332 89.99 94.13 88.14 2 DKIM_SIGNED 130341 81.33 89.99 77.44 3 XM_DK_Pass 123519 78.96 85.28 76.12 4 XM_B_Unicode 122660 77.20 84.69 73.84 5 DKIM_VALID 122097 78.00 84.30 75.17 6 RELAYCOUNTRY_US 117755 81.04 81.30 80.92 7 DCC_CHECK 105349 48.78 72.74 38.02 8 XM_B_SpammyWords 99649 54.46 68.80 48.02 9 XMListUnsubscribeExists 97916 55.94 67.60 50.71 10 DKIM_VALID_AU 94425 63.06 65.19 62.10 11 XM_B_Unicode3 71330 44.08 49.25 41.76 12 LOC_TINY_FONT_1 70586 36.13 48.73 30.48 13 XM_DK_Undo_02 61551 16.89 42.50 5.39 14 BAYES_50 58599 55.29 40.46 61.95 15 XM_B_SpammyWords2 55893 27.30 38.59 22.23 16 HTML_FONT_LOW_CONTRAST 53044 30.56 36.62 27.83 17 FVGT_m_MULTI_ODD 49982 28.53 34.51 25.85 18 BAYES_99 45185 12.23 31.20 3.72 19 DKIM_VALID_EF 44420 30.51 30.67 30.43 20 TR_XM_DKIM_Undo 43531 10.70 30.05 2.02 21 T_KAM_HTML_FONT_INVALID 42597 25.35 29.41 23.52 22 MIME_HTML_ONLY 40736 21.64 28.13 18.73 23 XMSubLong 37235 24.22 25.71 23.55 24 DCC_CHECK_NEGATIVE 37224 50.68 25.70 61.90 25 BAYES_999 34610 9.36 23.90 2.83 26 TR_XM_DK_Unsub 32676 16.87 22.56 14.31 27 XM_Multi_Part_URI 32360 16.88 22.34 14.43 28 TR_DCC_Bayes_99 31377 7.70 21.66 1.43 29 T_TM2_M_HEADER_IN_MSG 31131 28.27 21.49 31.32 30 RCVD_IN_MSPIKE_H2 28427 17.07 19.63 15.92 31 XM_B_Unsub 27745 12.55 19.16 9.59 32 TR_XM_BayesUnsub 26743 11.05 18.46 7.73 33 UNPARSEABLE_RELAY 25903 13.79 17.88 11.95 34 RELAYCOUNTRY_META 25212 7.79 17.41 3.47 35 TR_MAX_INTL_RELAY 22276 9.12 15.38 6.31 36 XM_B_SpammyWords3 20885 8.28 14.42 5.52 37 LOTS_OF_MONEY 19888 10.10 13.73 8.47 38 RCVD_IN_BL_SPAMCOP_NET 18201 4.53 12.57 0.93 39 BOTNET_IPINHOSTNAME 17987 6.05 12.42 3.19 40 TR_XM_SpammyRelay 17650 4.96 12.19 1.71 41 TR_XM_SpammyWords4 17279 8.21 11.93 6.54 42 RCVD_IN_MSPIKE_WL 16449 17.25 11.36 19.90 43 BOTNET 15164 4.07 10.47 1.20 44 TR_XM_SpammyWords2 14114 3.34 9.74 0.46 45 BAYES_80 14000 5.66 9.67 3.87 46 XM_B_Phish_Phrases 13642 6.81 9.42 5.65 47 XM_Evil_Numbers_Gen 13431 8.77 9.27 8.54 48 TR_XM_UnparsRelay 13398 4.05 9.25 1.72 49 FSL_BULK_SIG 13135 6.13 9.07 4.81 50 BAYES_60 11419 7.28 7.88 7.00 51 UNTRUSTED_Relay 9986 3.23 6.89 1.59 52 XMSubMetaSx_00 9767 4.52 6.74 3.53 53 RCVD_IN_MSPIKE_BL 9671 2.85 6.68 1.13 54 TR_XM_MSPIKECOMBO 9650 2.84 6.66 1.13 55 HTML_IMAGE_RATIO_02 9621 5.61 6.64 5.14 56 XM_B_PhoneNumber 9191 8.56 6.35 9.55 57 XM_UncommonTLD01 9144 4.75 6.31 4.05 58 RELAYCOUNTRY_CA 9139 2.41 6.31 0.66 59 XM_Body_Dirty_Words 8830 3.45 6.10 2.26 60 TR_XM_SPAMCOP 8800 2.10 6.08 0.32 61 LotsOfNums_01 8426 7.74 5.82 8.60 62 DKIM_INVALID 8244 3.33 5.69 2.27 63 RCVD_IN_MSPIKE_H3 8124 7.96 5.61 9.02 64 MPART_ALT_DIFF 7926 5.10 5.47 4.93 65 XM_H_Long_From01 7811 5.61 5.39 5.71 66 BAYES_95 7789 3.35 5.38 2.44 67 XM_H_GMP 7474 5.25 5.16 5.29 68 T_XMDrugObfuBody_14 6900 2.71 4.76 1.79 69 XMSexyCombo_05 6729 2.03 4.65 0.86 70 XMStrtUSub 6663 4.86 4.60 4.98 71 TR_XM_SpammyWords3 6590 1.75 4.55 0.49 72 XM_B_Investor 6587 2.47 4.55 1.54 73 TR_XM_PhishingBody 6422 2.48 4.43 1.61 74 XM_OfRef6 6257 1.92 4.32 0.84 75 RCVD_IN_MSPIKE_L3 6257 2.01 4.32 0.98 76 HTML_IMAGE_RATIO_04 6231 4.23 4.30 4.20 77 XM_B_SpammyTLD 6054 3.23 4.18 2.81 78 TM2_M_VERY_LONG_WORD 5967 2.15 4.12 1.27 79 T_XMDrugObfuBody_08 5853 2.58 4.04 1.93 80 MIME_HTML_MOSTLY 5412 3.01 3.74 2.68 81 XM_B_Unsub2 5200 2.01 3.59 1.31 82 TR_XM_SpammyWords5 5082 1.94 3.51 1.24 83 HTML_IMAGE_RATIO_06 4924 3.58 3.40 3.66 84 XMNumbers 4850 3.22 3.35 3.16 85 XM_CamelCaseFrm001 4817 2.32 3.33 1.87 86 TR_XM_NoHeaderRelay 4731 1.11 3.27 0.14 87 TooManyTo_001 4591 6.14 3.17 7.47 88 XMDiploma_00 4405 2.04 3.04 1.59 89 HTML_IMAGE_RATIO_08 4381 2.69 3.02 2.53 90 XM_UB50 4369 1.66 3.02 1.05 91 XM_URI_RBL 4311 1.15 2.98 0.33 92 RCVD_IN_MSPIKE_H5 4247 5.48 2.93 6.63 93 TM2_M_URI_OPT_OUT 4126 2.16 2.85 1.84 94 RELAYCOUNTRY_AU 4118 1.23 2.84 0.51 95 XM_SPF_SoftFail 4106 1.74 2.83 1.25 96 MIME_QP_LONG_LINE 4106 4.86 2.83 5.77 97 RCVD_IN_MSPIKE_H4 4078 3.80 2.82 4.25 98 XM_B_URI_Unicode 4017 2.13 2.77 1.84 99 TR_XM_INV_DKIM 3930 0.86 2.71 0.02 100 MIME_HTML_ONLY_MULTI 3886 2.62 2.68 2.59 101 TR_XM_MSPIKECOMBO2 3861 0.91 2.67 0.12 102 XM_B_SpammyWords4 3746 1.28 2.59 0.70 103 RCVD_IN_XBL 3660 0.80 2.53 0.03 104 USER_IN_DEF_DKIM_WL 3538 10.28 2.44 13.80 105 TR_XM_INTL_Spamhaus 3412 0.86 2.36 0.19 106 XMStockSpam_06 3353 1.57 2.32 1.24 107 XMBody_17 3325 0.97 2.30 0.37 108 T_TooManySym_01 3304 4.55 2.28 5.57 109 T_FILL_THIS_FORM_SHORT 3065 1.21 2.12 0.81 110 SpammyFromTLD_01 2971 1.13 2.05 0.71 111 HK_RANDOM_REPLYTO 2959 0.68 2.04 0.07 112 TR_XM_MaxSPIKE 2949 0.67 2.04 0.06 113 SUBJ_ALL_CAPS 2947 1.70 2.03 1.55 114 XMGenDplmaNmb 2912 1.31 2.01 1.00 115 MAILING_LIST_MULTI 2898 2.74 2.00 3.08 116 RCVD_IN_VALIDITY_RPBL 2815 0.63 1.94 0.03 117 RCVD_IN_SBL_CSS 2754 0.61 1.90 0.04 118 KHOP_HELO_FCRDNS 2744 1.34 1.89 1.10 119 XM_H_Long_From02 2742 1.13 1.89 0.79 120 RCVD_IN_MSPIKE_L4 2700 0.67 1.86 0.14 121 T_XMHurry_00 2692 0.91 1.86 0.49 122 RCVD_IN_IADB_LISTED 2659 3.06 1.84 3.60 123 SpammyFromTLD_02 2608 0.90 1.80 0.49 124 FROM_EXCESS_BASE64 2550 1.57 1.76 1.49 125 URI_TRY_3LD 2520 0.92 1.74 0.55 126 URI_NOVOWEL 2499 1.31 1.73 1.13 127 TR_Symld_Words 2465 1.55 1.70 1.48 128 DIET_1 2405 0.68 1.66 0.24 129 T_XMDrugObfuBody_00 2359 1.17 1.63 0.96 130 RCVD_IN_PBL 2335 0.97 1.61 0.68 131 RCVD_IN_VALIDITY_SAFE 2335 3.64 1.61 4.56 132 XM_DK_Undo_01 2323 1.69 1.60 1.73 133 BOTNET_NORDNS 2303 0.50 1.59 0.01 134 XM_SendGrid 2300 1.59 1.59 1.59 135 XMPhish30 2299 0.91 1.59 0.60 136 URI_HEX 2290 1.46 1.58 1.40 137 ANY_BOUNCE_MESSAGE 2245 2.85 1.55 3.43 138 BOUNCE_MESSAGE 2243 2.85 1.55 3.43 139 BAYES_40 2228 4.42 1.54 5.71 140 RCVD_IN_ZEN_LASTEXTERNAL 2205 0.47 1.52 0.00 141 SHORTCIRCUIT 2205 0.47 1.52 0.00 142 RCVD_IN_IADB_SPF 2195 2.66 1.52 3.17 143 MISSING_HEADERS 2177 0.75 1.50 0.42 144 HTML_MIME_NO_HTML_TAG 2164 2.17 1.49 2.47 145 TR_Mismatch_TLD_02 2160 0.56 1.49 0.15 146 XMBrknScrpt_02 2156 1.05 1.49 0.85 147 XM_B_SEO 2110 0.57 1.46 0.17 148 TR_LOTS_OF_MONEY3 2031 0.60 1.40 0.23 149 MultiRelay_CC 2029 0.54 1.40 0.16 150 HTML_FONT_TINY_NORDNS 2012 0.47 1.39 0.06 151 RCVD_IN_IADB_DK 1987 2.32 1.37 2.74 152 MPART_ALT_DIFF_COUNT 1984 0.81 1.37 0.56 153 XM_ProductURIs 1966 0.80 1.36 0.55 154 RCVD_IN_PSBL 1954 0.44 1.35 0.03 155 RCVD_IN_IADB_SENDERID 1938 2.38 1.34 2.85 156 XM_B_Phish66 1929 0.64 1.33 0.33 157 RDNS_DYNAMIC 1848 0.50 1.28 0.15 158 XM_B_DNDMA 1835 0.74 1.27 0.50 159 TR_Mismatch_TLD_01 1814 0.55 1.25 0.24 160 TR_XM_SEO4 1808 0.44 1.25 0.08 161 T_REMOTE_IMAGE 1783 2.66 1.23 3.30 162 FORGED_MUA_OUTLOOK 1761 0.39 1.22 0.02 163 AXB_XMAILER_MIMEOLE_OL_024C2 1745 0.37 1.20 0.00 164 XMBody_78 1741 0.63 1.20 0.38 165 FSL_CTYPE_WIN1251 1736 0.37 1.20 0.00 166 FSL_NEW_HELO_USER 1735 0.37 1.20 0.00 167 TR_XM_XBL_BULK_SIG 1734 0.37 1.20 0.00 168 RCVD_IN_IADB_VOUCHED 1716 1.95 1.18 2.29 169 REPLYTO_WITHOUT_TO_CC 1713 0.38 1.18 0.02 170 RCVD_IN_SBL 1710 0.37 1.18 0.00 171 FROM_MISSP_XPRIO 1692 0.36 1.17 0.00 172 RELAYCOUNTRY_FR 1690 0.58 1.17 0.32 173 FROM_MISSPACED 1687 0.36 1.16 0.00 174 TO_NO_BRKTS_MSFT 1682 0.36 1.16 0.00 175 BAYES_20 1679 2.98 1.16 3.80 176 RCVD_IN_SBL_DROP 1663 0.36 1.15 0.00 177 MONEY_FROM_MISSP 1657 0.36 1.14 0.00 178 XM_UB80 1644 0.36 1.14 0.02 179 TR_LOTS_OF_MONEY1 1642 0.36 1.13 0.01 180 TVD_RCVD_IP 1637 0.96 1.13 0.89 181 ALL_TRUSTED 1620 11.42 1.12 16.05 182 HTTPS_HTTP_MISMATCH 1605 0.82 1.11 0.69 183 RELAYCOUNTRY_GB 1580 0.83 1.09 0.71 184 TR_MetaPhish_Combo_01 1569 0.86 1.08 0.75 185 TR_XM_RelayPhish 1562 0.38 1.08 0.07 186 XM_HighProb1 1525 0.33 1.05 0.00 187 XM_B_COPY_HTML 1523 0.90 1.05 0.83 188 SHOPIFY_IMG_NOT_RCVD_SFY 1521 0.47 1.05 0.21 189 RCVD_IN_VALIDITY_CERTIFIED 1517 3.13 1.05 4.07 190 HTML_IMAGE_ONLY_20 1516 0.73 1.05 0.59 191 XM_ShortIntro_01 1501 1.05 1.04 1.06 192 XM_DIRTYINTL 1499 0.36 1.03 0.06 193 XM_UB99 1497 0.32 1.03 0.00 194 STY_INVIS_DIRECT 1477 0.50 1.02 0.27 195 TR_XM_GMP_BULK_SIG 1477 0.41 1.02 0.14 196 XMSlimDrugH 1465 0.77 1.01 0.66 197 T_Symld_Words_02 1462 0.88 1.01 0.82 198 TR_XM_DK_SendGrid 1455 1.06 1.00 1.09 199 HELO_DYNAMIC_SPLIT_IP 1446 0.32 1.00 0.02 200 XM_UB60 1428 0.37 0.99 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 284394 89.99 94.13 88.14 2 RELAYCOUNTRY_US 261120 81.04 81.30 80.92 3 DKIM_SIGNED 249872 81.33 89.99 77.44 4 XM_DK_Pass 245616 78.96 85.28 76.12 5 DKIM_VALID 242548 78.00 84.30 75.17 6 XM_B_Unicode 238250 77.20 84.69 73.84 7 DKIM_VALID_AU 200376 63.06 65.19 62.10 8 BAYES_50 199897 55.29 40.46 61.95 9 DCC_CHECK_NEGATIVE 199723 50.68 25.70 61.90 10 XMListUnsubscribeExists 163616 55.94 67.60 50.71 11 XM_B_SpammyWords 154942 54.46 68.80 48.02 12 XM_B_Unicode3 134758 44.08 49.25 41.76 13 DCC_CHECK 122689 48.78 72.74 38.02 14 T_TM2_M_HEADER_IN_MSG 101048 28.27 21.49 31.32 15 LOC_TINY_FONT_1 98340 36.13 48.73 30.48 16 DKIM_VALID_EF 98203 30.51 30.67 30.43 17 HTML_FONT_LOW_CONTRAST 89807 30.56 36.62 27.83 18 FVGT_m_MULTI_ODD 83422 28.53 34.51 25.85 19 XMSubLong 76004 24.22 25.71 23.55 20 T_KAM_HTML_FONT_INVALID 75897 25.35 29.41 23.52 21 XM_B_SpammyWords2 71735 27.30 38.59 22.23 22 RCVD_IN_MSPIKE_WL 64204 17.25 11.36 19.90 23 MIME_HTML_ONLY 60449 21.64 28.13 18.73 24 ALL_TRUSTED 51792 11.42 1.12 16.05 25 RCVD_IN_MSPIKE_H2 51381 17.07 19.63 15.92 26 XM_Multi_Part_URI 46555 16.88 22.34 14.43 27 TR_XM_DK_Unsub 46176 16.87 22.56 14.31 28 USER_IN_DEF_DKIM_WL 44519 10.28 2.44 13.80 29 UNPARSEABLE_RELAY 38563 13.79 17.88 11.95 30 XM_B_Unsub 30932 12.55 19.16 9.59 31 XM_B_PhoneNumber 30824 8.56 6.35 9.55 32 BAYES_00 30203 6.66 0.63 9.36 33 RCVD_IN_MSPIKE_H3 29106 7.96 5.61 9.02 34 LotsOfNums_01 27741 7.74 5.82 8.60 35 XM_Evil_Numbers_Gen 27554 8.77 9.27 8.54 36 LOTS_OF_MONEY 27338 10.10 13.73 8.47 37 TR_XM_BayesUnsub 24929 11.05 18.46 7.73 38 TooManyTo_001 24110 6.14 3.17 7.47 39 BAYES_60 22600 7.28 7.88 7.00 40 TR_XM_DK_Bayes 21965 4.86 0.52 6.81 41 TR_XM_DK_Bayes1 21713 4.80 0.51 6.73 42 XM_DKIMWhitelistDomains 21597 4.64 0.08 6.69 43 RCVD_IN_MSPIKE_H5 21394 5.48 2.93 6.63 44 TR_XM_SpammyWords4 21102 8.21 11.93 6.54 45 TR_MAX_INTL_RELAY 20358 9.12 15.38 6.31 46 TR_XM_DK_Bayes2 18841 4.16 0.42 5.84 47 MIME_QP_LONG_LINE 18608 4.86 2.83 5.77 48 XM_H_Long_From01 18439 5.61 5.39 5.71 49 BAYES_40 18418 4.42 1.54 5.71 50 XM_B_Phish_Phrases 18217 6.81 9.42 5.65 51 T_TooManySym_01 17965 4.55 2.28 5.57 52 XM_B_SpammyWords3 17802 8.28 14.42 5.52 53 XM_DK_Undo_02 17407 16.89 42.50 5.39 54 XM_H_GMP 17065 5.25 5.16 5.29 55 HTML_IMAGE_RATIO_02 16590 5.61 6.64 5.14 56 XMStrtUSub 16073 4.86 4.60 4.98 57 MPART_ALT_DIFF 15920 5.10 5.47 4.93 58 FSL_BULK_SIG 15519 6.13 9.07 4.81 59 RCVD_IN_VALIDITY_SAFE 14703 3.64 1.61 4.56 60 RCVD_IN_MSPIKE_H4 13704 3.80 2.82 4.25 61 XM_PDF 13642 3.14 0.71 4.23 62 HTML_IMAGE_RATIO_04 13553 4.23 4.30 4.20 63 RCVD_IN_VALIDITY_CERTIFIED 13122 3.13 1.05 4.07 64 XM_UncommonTLD01 13056 4.75 6.31 4.05 65 BAYES_80 12472 5.66 9.67 3.87 66 BAYES_20 12271 2.98 1.16 3.80 67 BAYES_99 12003 12.23 31.20 3.72 68 HTML_IMAGE_RATIO_06 11805 3.58 3.40 3.66 69 RCVD_IN_IADB_LISTED 11624 3.06 1.84 3.60 70 XMSubMetaSx_00 11386 4.52 6.74 3.53 71 RELAYCOUNTRY_META 11208 7.79 17.41 3.47 72 ANY_BOUNCE_MESSAGE 11079 2.85 1.55 3.43 73 BOUNCE_MESSAGE 11078 2.85 1.55 3.43 74 T_REMOTE_IMAGE 10656 2.66 1.23 3.30 75 BOTNET_IPINHOSTNAME 10307 6.05 12.42 3.19 76 RCVD_IN_IADB_SPF 10240 2.66 1.52 3.17 77 XMNumbers 10185 3.22 3.35 3.16 78 MAILING_LIST_MULTI 9931 2.74 2.00 3.08 79 T_TooManySym_02 9354 2.18 0.59 2.90 80 RCVD_IN_IADB_SENDERID 9193 2.38 1.34 2.85 81 BAYES_999 9143 9.36 23.90 2.83 82 XM_B_SpammyTLD 9057 3.23 4.18 2.81 83 RCVD_IN_IADB_DK 8853 2.32 1.37 2.74 84 MIME_HTML_MOSTLY 8647 3.01 3.74 2.68 85 MIME_HTML_ONLY_MULTI 8367 2.62 2.68 2.59 86 HTML_IMAGE_RATIO_08 8176 2.69 3.02 2.53 87 HTML_MIME_NO_HTML_TAG 7963 2.17 1.49 2.47 88 BAYES_95 7881 3.35 5.38 2.44 89 TooManyTo_002 7507 1.78 0.57 2.33 90 RCVD_IN_IADB_VOUCHED 7386 1.95 1.18 2.29 91 DKIM_INVALID 7324 3.33 5.69 2.27 92 XM_Body_Dirty_Words 7280 3.45 6.10 2.26 93 INVALID_MSGID 7076 1.62 0.35 2.19 94 BAYES_05 6930 1.66 0.57 2.15 95 TR_XM_DKIM_Undo 6516 10.70 30.05 2.02 96 TO_MALFORMED 6442 1.39 0.02 2.00 97 MSGID_NOFQDN1 6358 1.40 0.14 1.97 98 T_XMDrugObfuBody_08 6231 2.58 4.04 1.93 99 XM_CamelCaseFrm001 6030 2.32 3.33 1.87 100 TM2_M_URI_OPT_OUT 5952 2.16 2.85 1.84 101 XM_B_URI_Unicode 5942 2.13 2.77 1.84 102 T_XMDrugObfuBody_14 5762 2.71 4.76 1.79 103 XM_DK_Undo_01 5581 1.69 1.60 1.73 104 TR_XM_UnparsRelay 5543 4.05 9.25 1.72 105 TR_XM_SpammyRelay 5526 4.96 12.19 1.71 106 TR_XM_PhishingBody 5195 2.48 4.43 1.61 107 XMDiploma_00 5141 2.04 3.04 1.59 108 XM_SendGrid 5136 1.59 1.59 1.59 109 UNTRUSTED_Relay 5135 3.23 6.89 1.59 110 RCVD_IN_IADB_OPTIN 5123 1.35 0.83 1.59 111 SUBJ_ALL_CAPS 5011 1.70 2.03 1.55 112 XM_B_Investor 4958 2.47 4.55 1.54 113 FROM_EXCESS_BASE64 4795 1.57 1.76 1.49 114 TR_Symld_Words 4761 1.55 1.70 1.48 115 TooManyTo_003 4682 1.15 0.48 1.45 116 TR_DCC_Bayes_99 4609 7.70 21.66 1.43 117 URI_HEX 4521 1.46 1.58 1.40 118 XM_GoogleGroups 4394 1.22 0.89 1.36 119 IN_HORDE_ADDRESS_BOOK 4245 0.93 0.07 1.32 120 XM_B_Unsub2 4219 2.01 3.59 1.31 121 TM2_M_VERY_LONG_WORD 4084 2.15 4.12 1.27 122 XM_SPF_SoftFail 4033 1.74 2.83 1.25 123 TR_XM_SpammyWords5 4001 1.94 3.51 1.24 124 XMStockSpam_06 3994 1.57 2.32 1.24 125 BOTNET 3857 4.07 10.47 1.20 126 T_TooManySym_03 3765 0.85 0.15 1.17 127 URI_NOVOWEL 3647 1.31 1.73 1.13 128 RCVD_IN_MSPIKE_BL 3645 2.85 6.68 1.13 129 TR_XM_MSPIKECOMBO 3642 2.84 6.66 1.13 130 HELO_NODOT 3606 0.80 0.10 1.12 131 HELO_NO_DOMAIN 3596 0.80 0.09 1.11 132 XMGappySubj_01 3565 0.82 0.20 1.10 133 KHOP_HELO_FCRDNS 3537 1.34 1.89 1.10 134 TR_XM_DK_SendGrid 3519 1.06 1.00 1.09 135 TooManyTo_004 3452 0.86 0.41 1.07 136 XMCapTrack 3440 0.93 0.62 1.07 137 XM_ShortIntro_01 3419 1.05 1.04 1.06 138 XM_UB50 3372 1.66 3.02 1.05 139 XMGenDplmaNmb 3211 1.31 2.01 1.00 140 RCVD_IN_MSPIKE_L3 3147 2.01 4.32 0.98 141 T_XMDrugObfuBody_00 3095 1.17 1.63 0.96 142 RCVD_IN_BL_SPAMCOP_NET 2985 4.53 12.57 0.93 143 TVD_SPACE_RATIO 2895 0.71 0.28 0.90 144 TVD_RCVD_IP 2866 0.96 1.13 0.89 145 XMSexyCombo_05 2779 2.03 4.65 0.86 146 XMBrknScrpt_02 2743 1.05 1.49 0.85 147 TooManyTo_005 2728 0.69 0.35 0.85 148 XM_OfRef6 2701 1.92 4.32 0.84 149 XM_B_COPY_HTML 2686 0.90 1.05 0.83 150 T_Symld_Words_02 2653 0.88 1.01 0.82 151 T_FILL_THIS_FORM_SHORT 2610 1.21 2.12 0.81 152 XM_H_Long_From02 2563 1.13 1.89 0.79 153 TR_MetaPhish_Combo_01 2435 0.86 1.08 0.75 154 FROM_GOV_DKIM_AU 2413 0.62 0.35 0.75 155 XM_H_PHPMailer 2385 0.64 0.43 0.74 156 DKIM_ADSP_CUSTOM_MED 2365 0.78 0.90 0.73 157 SpammyFromTLD_01 2301 1.13 2.05 0.71 158 RELAYCOUNTRY_GB 2277 0.83 1.09 0.71 159 XM_B_SpammyWords4 2257 1.28 2.59 0.70 160 SUBJ_DOLLARS 2243 0.68 0.65 0.70 161 HTTPS_HTTP_MISMATCH 2213 0.82 1.11 0.69 162 RCVD_IN_PBL 2203 0.97 1.61 0.68 163 LOW_PRICE 2191 0.57 0.32 0.68 164 XMSlimDrugH 2134 0.77 1.01 0.66 165 RELAYCOUNTRY_CA 2115 2.41 6.31 0.66 166 PLING_QUERY 2056 0.62 0.57 0.64 167 T_OBFU_PDF_ATTACH 1983 0.46 0.12 0.61 168 XMBSHREFv2 1971 0.53 0.36 0.61 169 XMPhish30 1946 0.91 1.59 0.60 170 HTML_IMAGE_ONLY_20 1902 0.73 1.05 0.59 171 TRACKER_ID 1889 0.46 0.18 0.59 172 XMSubMetaI_00 1857 0.65 0.82 0.58 173 TO_NO_BRKTS_HTML_ONLY 1836 0.43 0.13 0.57 174 XMGappySubj_02 1817 0.40 0.05 0.56 175 MPART_ALT_DIFF_COUNT 1816 0.81 1.37 0.56 176 XMNoVowels 1800 0.54 0.49 0.56 177 XM_ProductURIs 1781 0.80 1.36 0.55 178 T_TVD_MIME_NO_HEADERS 1768 0.44 0.21 0.55 179 URI_TRY_3LD 1759 0.92 1.74 0.55 180 TR_XM_Base64_M1 1758 0.60 0.71 0.54 181 MSGID_FROM_MTA_HEADER 1750 0.53 0.51 0.54 182 XMLngstWrd_00 1688 0.53 0.54 0.52 183 RELAYCOUNTRY_AU 1649 1.23 2.84 0.51 184 XMDateMe_00 1616 0.48 0.42 0.50 185 HTML_TAG_BALANCE_BODY 1616 0.63 0.91 0.50 186 XM_B_DNDMA 1613 0.74 1.27 0.50 187 SpammyFromTLD_02 1594 0.90 1.80 0.49 188 TR_XM_SpammyWords3 1590 1.75 4.55 0.49 189 T_XMHurry_00 1580 0.91 1.86 0.49 190 XMBdyGiftCard01 1570 0.57 0.76 0.49 191 LongTLD 1570 0.57 0.76 0.49 192 NML_ADSP_CUSTOM_MED 1499 0.56 0.77 0.46 193 TR_XM_SpammyWords2 1483 3.34 9.74 0.46 194 XMLngstWrd_01 1467 0.47 0.50 0.45 195 FORGED_GMAIL_RCVD 1418 0.49 0.59 0.44 196 HTML_FONT_FACE_BAD 1399 0.46 0.52 0.43 197 XMBody_95 1395 0.35 0.17 0.43 198 LOADSA_MONEY_COMBO 1364 0.35 0.19 0.42 199 XMMoneyMeta_00 1359 0.57 0.90 0.42 200 XMSubMetaSxObfu_03 1352 0.41 0.38 0.42 ----------------------------------------------------------------------