Email: 571273 Autolearn: 0 AvgScore: 5.46 AvgScanTime: 1.28 sec Spam: 175589 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 1.49 sec Ham: 395684 Autolearn: 0 AvgScore: 1.66 AvgScanTime: 1.19 sec Time Spent Running SA: 203.46 hours Time Spent Processing Spam: 72.80 hours Time Spent Processing Ham: 130.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167724 91.45 95.52 89.64 2 DKIM_SIGNED 132368 65.34 75.39 60.89 3 RELAYCOUNTRY_US 129341 76.56 73.66 77.84 4 XM_B_Unicode 128963 70.10 73.45 68.61 5 DCC_CHECK 125824 47.18 71.66 36.31 6 XM_DK_Pass 122761 62.92 69.91 59.81 7 DKIM_VALID 121759 62.19 69.34 59.02 8 XM_B_SpammyWords 104025 47.39 59.24 42.13 9 DKIM_VALID_AU 97121 51.31 55.31 49.53 10 XMListUnsubscribeExists 94839 43.95 54.01 39.48 11 XM_B_Unicode3 78476 41.93 44.69 40.71 12 LOC_TINY_FONT_1 70657 28.21 40.24 22.87 13 BAYES_50 66908 51.85 38.10 57.96 14 MIME_HTML_ONLY 61950 30.75 35.28 28.75 15 XM_DK_Undo_02 60176 13.43 34.27 4.18 16 XM_B_SpammyWords2 60111 22.19 34.23 16.85 17 HTML_FONT_LOW_CONTRAST 54452 25.67 31.01 23.29 18 FVGT_m_MULTI_ODD 50319 23.12 28.66 20.66 19 DCC_CHECK_NEGATIVE 47477 52.38 27.04 63.62 20 T_KAM_HTML_FONT_INVALID 45666 20.30 26.01 17.76 21 BAYES_99 45505 9.95 25.92 2.86 22 DKIM_VALID_EF 43981 24.94 25.05 24.89 23 XMSubLong 43847 22.00 24.97 20.69 24 TR_XM_DKIM_Undo 42560 8.60 24.24 1.66 25 BAYES_999 34910 7.64 19.88 2.21 26 XM_Multi_Part_URI 33689 13.64 19.19 11.18 27 T_TM2_M_HEADER_IN_MSG 33068 22.00 18.83 23.41 28 XM_B_Unsub 33024 10.59 18.81 6.94 29 TR_XM_DK_Unsub 32108 13.31 18.29 11.10 30 TR_XM_BayesUnsub 31632 9.24 18.01 5.34 31 TR_DCC_Bayes_99 30441 6.08 17.34 1.08 32 RCVD_IN_MSPIKE_H2 30429 14.26 17.33 12.89 33 BAYES_60 29478 9.18 16.79 5.80 34 UNPARSEABLE_RELAY 27193 11.26 15.49 9.38 35 RELAYCOUNTRY_META 24690 6.30 14.06 2.85 36 BOTNET_IPINHOSTNAME 24632 15.25 14.03 15.80 37 XM_B_SpammyWords3 23418 7.85 13.34 5.42 38 TR_MAX_INTL_RELAY 22738 7.50 12.95 5.08 39 ALL_TRUSTED 21991 17.49 12.52 19.69 40 HTML_MIME_NO_HTML_TAG 21688 9.99 12.35 8.95 41 LOTS_OF_MONEY 20911 6.75 11.91 4.46 42 RCVD_IN_BL_SPAMCOP_NET 20318 4.03 11.57 0.68 43 HTML_IMAGE_ONLY_08 19657 8.08 11.19 6.69 44 HTML_SHORT_LINK_IMG_1 19554 7.99 11.14 6.59 45 BOTNET 19143 4.02 10.90 0.96 46 TR_XM_SpammyWords4 18040 5.14 10.27 2.86 47 TR_XM_SpammyRelay 17624 4.10 10.04 1.47 48 RCVD_IN_MSPIKE_WL 16660 13.72 9.49 15.60 49 FSL_BULK_SIG 15955 5.79 9.09 4.32 50 TR_XM_SpammyWords2 15669 2.98 8.92 0.34 51 XM_B_Phish_Phrases 15604 6.24 8.89 5.06 52 XM_Evil_Numbers_Gen 15445 8.32 8.80 8.11 53 MPART_ALT_DIFF 14767 9.44 8.41 9.89 54 BAYES_80 14114 4.63 8.04 3.12 55 TR_XM_UnparsRelay 13656 3.26 7.78 1.25 56 XMSubMetaSx_00 11757 3.97 6.70 2.76 57 HTML_IMAGE_RATIO_04 10655 12.79 6.07 15.77 58 TR_XM_SPAMCOP 10623 2.03 6.05 0.24 59 LotsOfNums_01 10616 6.87 6.05 7.24 60 DKIM_INVALID 10609 3.15 6.04 1.87 61 UNTRUSTED_Relay 10510 2.71 5.99 1.25 62 HTML_IMAGE_RATIO_02 9941 4.60 5.66 4.13 63 XM_B_PhoneNumber 9043 7.01 5.15 7.83 64 RCVD_IN_MSPIKE_BL 8763 2.12 4.99 0.85 65 XM_H_GMP 8731 4.40 4.97 4.14 66 XM_Body_Dirty_Words 8551 2.79 4.87 1.86 67 TR_XM_MSPIKECOMBO 8539 2.08 4.86 0.85 68 XMStrtUSub 8513 9.21 4.85 11.14 69 HTML_IMAGE_RATIO_06 8248 4.39 4.70 4.25 70 MIME_HTML_MOSTLY 7995 2.77 4.55 1.98 71 XM_H_Long_From01 7964 4.55 4.54 4.56 72 RCVD_IN_MSPIKE_H3 7870 6.50 4.48 7.40 73 XM_UncommonTLD01 7819 3.60 4.45 3.22 74 BAYES_95 7814 2.72 4.45 1.95 75 TR_XM_PhishingBody 7716 2.21 4.39 1.24 76 HTML_FONT_FACE_BAD 7693 11.46 4.38 14.60 77 T_XMDrugObfuBody_14 7549 2.11 4.30 1.13 78 RELAYCOUNTRY_CA 7505 1.69 4.27 0.54 79 XMNumbers 7387 3.21 4.21 2.76 80 XMSubNoVowel 7308 4.07 4.16 4.03 81 TR_XM_SpammyWords5 7270 2.31 4.14 1.50 82 XMSubLongNoVowel 7032 2.06 4.00 1.20 83 TM2_M_VERY_LONG_WORD 6812 2.56 3.88 1.97 84 XMSubGarbage 6774 2.01 3.86 1.19 85 MIME_HTML_ONLY_MULTI 6505 6.84 3.70 8.23 86 DATE_IN_PAST_03_06 6408 3.91 3.65 4.02 87 XM_B_SpammyTLD 6347 2.56 3.61 2.09 88 XM_B_Investor 6170 1.81 3.51 1.05 89 MIME_QP_LONG_LINE 5987 4.14 3.41 4.46 90 TR_XM_SpammyWords3 5916 1.27 3.37 0.34 91 TR_XM_NoHeaderRelay 5847 1.11 3.33 0.13 92 XM_OfRef6 5757 1.47 3.28 0.67 93 HTML_IMAGE_RATIO_08 5498 2.45 3.13 2.15 94 XMSexyCombo_05 5469 1.50 3.11 0.78 95 TooManyTo_001 5357 5.22 3.05 6.18 96 BAYES_40 5256 4.87 2.99 5.71 97 USER_IN_DEF_DKIM_WL 5056 8.18 2.88 10.53 98 RCVD_IN_MSPIKE_L3 4869 1.29 2.77 0.63 99 XM_B_Unsub2 4799 1.60 2.73 1.10 100 RCVD_IN_MSPIKE_H5 4788 4.32 2.73 5.03 101 T_XMDrugObfuBody_08 4692 1.84 2.67 1.47 102 XM_B_URI_Unicode 4688 1.99 2.67 1.69 103 XM_UB50 4655 1.40 2.65 0.84 104 TR_XM_INV_DKIM 4524 0.80 2.58 0.01 105 XMDiploma_00 4367 1.64 2.49 1.26 106 XM_CamelCaseFrm001 4237 1.84 2.41 1.58 107 DKIM_ADSP_NXDOMAIN 4219 0.90 2.40 0.23 108 XM_URI_RBL 4151 0.91 2.36 0.27 109 XM_SPF_SoftFail 4062 1.40 2.31 0.99 110 RELAYCOUNTRY_AU 4012 0.96 2.28 0.37 111 RCVD_IN_MSPIKE_H4 4002 2.90 2.28 3.17 112 XMStockSpam_06 3977 1.18 2.26 0.71 113 BOTNET_NORDNS 3852 0.68 2.19 0.01 114 RCVD_IN_VALIDITY_RPBL 3805 0.73 2.17 0.09 115 T_TooManySym_01 3786 3.90 2.16 4.68 116 TM2_M_URI_OPT_OUT 3718 1.71 2.12 1.52 117 T_FILL_THIS_FORM_SHORT 3584 1.13 2.04 0.73 118 BOUNCE_MESSAGE 3567 4.54 2.03 5.65 119 ANY_BOUNCE_MESSAGE 3567 4.54 2.03 5.65 120 XM_B_SpammyWords4 3460 0.94 1.97 0.49 121 KHOP_HELO_FCRDNS 3347 1.63 1.91 1.51 122 RCVD_IN_VALIDITY_SAFE 3298 3.08 1.88 3.61 123 TR_XM_INTL_Spamhaus 3274 0.68 1.86 0.15 124 HTML_FONT_TINY_NORDNS 3189 0.59 1.82 0.05 125 MAILING_LIST_MULTI 3066 2.25 1.75 2.47 126 TR_XM_MSPIKECOMBO2 3039 0.59 1.73 0.08 127 XMBody_17 3028 0.76 1.72 0.33 128 XM_H_Long_From02 2976 0.95 1.69 0.62 129 FROM_EXCESS_BASE64 2814 1.45 1.60 1.38 130 RCVD_IN_PSBL 2768 0.53 1.58 0.06 131 TO_NO_BRKTS_HTML_IMG 2765 0.51 1.57 0.04 132 RCVD_IN_XBL 2694 0.48 1.53 0.02 133 XMPhish30 2620 0.74 1.49 0.41 134 T_REMOTE_IMAGE 2596 2.40 1.48 2.82 135 T_XMHurry_00 2578 0.83 1.47 0.55 136 SpammyFromTLD_02 2516 0.69 1.43 0.36 137 URI_HEX 2502 1.19 1.42 1.08 138 SUBJ_ALL_CAPS 2470 1.29 1.41 1.24 139 RCVD_IN_IADB_LISTED 2449 2.06 1.39 2.36 140 URI_TRY_3LD 2424 0.69 1.38 0.39 141 TM2_M_OBFU_COMMENT 2415 0.60 1.38 0.25 142 XMSubMetaSxObfu_03 2410 0.65 1.37 0.32 143 XMGenDplmaNmb 2395 0.87 1.36 0.65 144 RCVD_IN_PBL 2390 0.80 1.36 0.55 145 XM_SendGrid 2385 1.23 1.36 1.17 146 XM_H_DKIM_GOOG 2372 0.42 1.35 0.01 147 XMBrknScrpt_02 2371 0.89 1.35 0.68 148 XM_DK_Undo_01 2349 1.35 1.34 1.36 149 T_XMDrugObfuBody_00 2317 1.00 1.32 0.86 150 TR_XM_MaxSPIKE 2304 0.43 1.31 0.04 151 MPART_ALT_DIFF_COUNT 2297 0.72 1.31 0.46 152 RCVD_IN_SBL_CSS 2287 0.42 1.30 0.03 153 XM_B_SEO 2278 0.52 1.30 0.18 154 RCVD_IN_VALIDITY_CERTIFIED 2268 2.43 1.29 2.94 155 BAYES_20 2256 3.68 1.28 4.74 156 SHORTCIRCUIT 2224 0.39 1.27 0.00 157 RCVD_IN_ZEN_LASTEXTERNAL 2224 0.39 1.27 0.00 158 XMBdyGiftCard01 2179 1.02 1.24 0.92 159 URI_NOVOWEL 2160 1.03 1.23 0.94 160 TR_XM_InvalidRelay 2131 0.38 1.21 0.01 161 SpammyFromTLD_01 2131 0.77 1.21 0.57 162 DIET_1 2100 0.56 1.20 0.27 163 TR_XM_GMP_BULK_SIG 2098 0.47 1.19 0.14 164 RELAYCOUNTRY_FR 2094 0.54 1.19 0.25 165 RCVD_IN_MSPIKE_L4 2089 0.46 1.19 0.14 166 T_MONEY_PERCENT 2082 0.45 1.19 0.12 167 TR_LOTS_OF_MONEY2 2082 0.45 1.19 0.12 168 XM_B_COPY_HTML 2034 0.77 1.16 0.59 169 STY_INVIS_DIRECT 1988 0.45 1.13 0.14 170 RCVD_IN_IADB_SPF 1987 1.82 1.13 2.12 171 HTML_IMAGE_ONLY_12 1972 0.58 1.12 0.34 172 RELAYCOUNTRY_GB 1970 0.80 1.12 0.65 173 HTML_IMAGE_ONLY_20 1949 0.68 1.11 0.50 174 TR_XM_SEO4 1928 0.40 1.10 0.09 175 XM_B_Phish66 1923 0.56 1.10 0.32 176 XM_ProductURIs 1905 0.65 1.08 0.46 177 TR_LOTS_OF_MONEY3 1859 0.52 1.06 0.27 178 TR_Symld_Words 1853 1.27 1.06 1.36 179 XM_UB60 1851 0.38 1.05 0.08 180 RCVD_IN_IADB_DK 1807 1.60 1.03 1.85 181 TR_Mismatch_TLD_01 1786 0.49 1.02 0.25 182 RCVD_IN_IADB_SENDERID 1779 1.64 1.01 1.92 183 NO_DNS_FOR_FROM 1726 0.43 0.98 0.19 184 MISSING_HEADERS 1721 0.48 0.98 0.26 185 TR_XM_MaxWHORU 1715 0.41 0.98 0.15 186 XMPhish14 1625 0.54 0.93 0.37 187 XM_B_DNDMA 1600 0.58 0.91 0.43 188 T_Symld_Words_02 1587 0.71 0.90 0.63 189 RCVD_IN_MSPIKE_L5 1581 0.33 0.90 0.08 190 RCVD_IN_IADB_VOUCHED 1562 1.27 0.89 1.44 191 HTTPS_HTTP_MISMATCH 1559 0.67 0.89 0.57 192 XM_UB99 1552 0.27 0.88 0.00 193 RDNS_DYNAMIC 1544 0.36 0.88 0.13 194 DKIM_ADSP_CUSTOM_MED 1543 0.67 0.88 0.57 195 MultiRelay_CC 1540 0.35 0.88 0.12 196 HTML_TAG_BALANCE_BODY 1520 0.57 0.87 0.43 197 FORGED_MUA_OUTLOOK 1509 0.28 0.86 0.02 198 XM_HighProb1 1498 0.26 0.85 0.00 199 FSL_CTYPE_WIN1251 1496 0.26 0.85 0.00 200 FSL_NEW_HELO_USER 1489 0.26 0.85 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 354686 91.45 95.52 89.64 2 RELAYCOUNTRY_US 308019 76.56 73.66 77.84 3 XM_B_Unicode 271494 70.10 73.45 68.61 4 DCC_CHECK_NEGATIVE 251737 52.38 27.04 63.62 5 DKIM_SIGNED 240923 65.34 75.39 60.89 6 XM_DK_Pass 236677 62.92 69.91 59.81 7 DKIM_VALID 233525 62.19 69.34 59.02 8 BAYES_50 229324 51.85 38.10 57.96 9 DKIM_VALID_AU 195997 51.31 55.31 49.53 10 XM_B_SpammyWords 166712 47.39 59.24 42.13 11 XM_B_Unicode3 161081 41.93 44.69 40.71 12 XMListUnsubscribeExists 156212 43.95 54.01 39.48 13 DCC_CHECK 143686 47.18 71.66 36.31 14 MIME_HTML_ONLY 113744 30.75 35.28 28.75 15 DKIM_VALID_EF 98468 24.94 25.05 24.89 16 T_TM2_M_HEADER_IN_MSG 92635 22.00 18.83 23.41 17 HTML_FONT_LOW_CONTRAST 92166 25.67 31.01 23.29 18 LOC_TINY_FONT_1 90485 28.21 40.24 22.87 19 XMSubLong 81848 22.00 24.97 20.69 20 FVGT_m_MULTI_ODD 81740 23.12 28.66 20.66 21 ALL_TRUSTED 77927 17.49 12.52 19.69 22 T_KAM_HTML_FONT_INVALID 70274 20.30 26.01 17.76 23 XM_B_SpammyWords2 66678 22.19 34.23 16.85 24 BOTNET_IPINHOSTNAME 62501 15.25 14.03 15.80 25 HTML_IMAGE_RATIO_04 62396 12.79 6.07 15.77 26 RCVD_IN_MSPIKE_WL 61738 13.72 9.49 15.60 27 BAYES_00 60439 10.80 0.71 15.27 28 HTML_FONT_FACE_BAD 57757 11.46 4.38 14.60 29 RCVD_IN_MSPIKE_H2 51011 14.26 17.33 12.89 30 XM_Multi_Part_URI 44229 13.64 19.19 11.18 31 XMStrtUSub 44077 9.21 4.85 11.14 32 TR_XM_DK_Unsub 43938 13.31 18.29 11.10 33 USER_IN_DEF_DKIM_WL 41646 8.18 2.88 10.53 34 MPART_ALT_DIFF 39136 9.44 8.41 9.89 35 UNPARSEABLE_RELAY 37128 11.26 15.49 9.38 36 HTML_MIME_NO_HTML_TAG 35403 9.99 12.35 8.95 37 MIME_HTML_ONLY_MULTI 32578 6.84 3.70 8.23 38 XM_Evil_Numbers_Gen 32081 8.32 8.80 8.11 39 XM_B_PhoneNumber 30976 7.01 5.15 7.83 40 RCVD_IN_MSPIKE_H3 29268 6.50 4.48 7.40 41 LotsOfNums_01 28639 6.87 6.05 7.24 42 XM_B_Unsub 27448 10.59 18.81 6.94 43 HTML_IMAGE_ONLY_08 26487 8.08 11.19 6.69 44 HTML_SHORT_LINK_IMG_1 26067 7.99 11.14 6.59 45 TooManyTo_001 24445 5.22 3.05 6.18 46 BAYES_60 22955 9.18 16.79 5.80 47 BAYES_40 22585 4.87 2.99 5.71 48 ANY_BOUNCE_MESSAGE 22358 4.54 2.03 5.65 49 BOUNCE_MESSAGE 22356 4.54 2.03 5.65 50 TR_XM_DK_Bayes 21899 4.02 0.61 5.53 51 TR_XM_DK_Bayes1 21595 3.96 0.60 5.46 52 XM_B_SpammyWords3 21434 7.85 13.34 5.42 53 TR_XM_BayesUnsub 21137 9.24 18.01 5.34 54 XM_DKIMWhitelistDomains 20989 3.69 0.05 5.30 55 TR_MAX_INTL_RELAY 20095 7.50 12.95 5.08 56 XM_B_Phish_Phrases 20036 6.24 8.89 5.06 57 RCVD_IN_MSPIKE_H5 19910 4.32 2.73 5.03 58 BAYES_20 18740 3.68 1.28 4.74 59 TR_XM_DK_Bayes2 18521 3.37 0.41 4.68 60 T_TooManySym_01 18508 3.90 2.16 4.68 61 XM_H_Long_From01 18040 4.55 4.54 4.56 62 LOTS_OF_MONEY 17664 6.75 11.91 4.46 63 MIME_QP_LONG_LINE 17653 4.14 3.41 4.46 64 FSL_BULK_SIG 17097 5.79 9.09 4.32 65 HTML_IMAGE_RATIO_06 16812 4.39 4.70 4.25 66 XM_DK_Undo_02 16553 13.43 34.27 4.18 67 XM_H_GMP 16400 4.40 4.97 4.14 68 HTML_IMAGE_RATIO_02 16341 4.60 5.66 4.13 69 XMSubNoVowel 15952 4.07 4.16 4.03 70 DATE_IN_PAST_03_06 15906 3.91 3.65 4.02 71 XM_PDF 14679 2.79 0.71 3.71 72 RCVD_IN_VALIDITY_SAFE 14298 3.08 1.88 3.61 73 XM_UncommonTLD01 12753 3.60 4.45 3.22 74 RCVD_IN_MSPIKE_H4 12560 2.90 2.28 3.17 75 BAYES_80 12359 4.63 8.04 3.12 76 RCVD_IN_VALIDITY_CERTIFIED 11618 2.43 1.29 2.94 77 TR_XM_SpammyWords4 11329 5.14 10.27 2.86 78 BAYES_99 11322 9.95 25.92 2.86 79 RELAYCOUNTRY_META 11291 6.30 14.06 2.85 80 T_REMOTE_IMAGE 11140 2.40 1.48 2.82 81 XMNumbers 10938 3.21 4.21 2.76 82 XMSubMetaSx_00 10908 3.97 6.70 2.76 83 BAYES_05 10225 1.93 0.45 2.58 84 MAILING_LIST_MULTI 9770 2.25 1.75 2.47 85 T_TooManySym_02 9510 1.85 0.62 2.40 86 RCVD_IN_IADB_LISTED 9342 2.06 1.39 2.36 87 BAYES_999 8729 7.64 19.88 2.21 88 HTML_IMAGE_RATIO_08 8493 2.45 3.13 2.15 89 RCVD_IN_IADB_SPF 8400 1.82 1.13 2.12 90 XM_B_SpammyTLD 8269 2.56 3.61 2.09 91 MIME_HTML_MOSTLY 7830 2.77 4.55 1.98 92 TM2_M_VERY_LONG_WORD 7805 2.56 3.88 1.97 93 BAYES_95 7731 2.72 4.45 1.95 94 RCVD_IN_IADB_SENDERID 7607 1.64 1.01 1.92 95 DKIM_INVALID 7398 3.15 6.04 1.87 96 XM_Body_Dirty_Words 7362 2.79 4.87 1.86 97 INVALID_MSGID 7343 1.37 0.28 1.86 98 RCVD_IN_IADB_DK 7336 1.60 1.03 1.85 99 TooManyTo_002 7064 1.41 0.57 1.79 100 MSGID_NOFQDN1 6717 1.21 0.11 1.70 101 XM_B_URI_Unicode 6683 1.99 2.67 1.69 102 TR_XM_DKIM_Undo 6584 8.60 24.24 1.66 103 TO_MALFORMED 6483 1.14 0.01 1.64 104 XM_CamelCaseFrm001 6260 1.84 2.41 1.58 105 TM2_M_URI_OPT_OUT 6024 1.71 2.12 1.52 106 KHOP_HELO_FCRDNS 5977 1.63 1.91 1.51 107 TR_XM_SpammyWords5 5945 2.31 4.14 1.50 108 TR_XM_SpammyRelay 5818 4.10 10.04 1.47 109 T_XMDrugObfuBody_08 5814 1.84 2.67 1.47 110 RCVD_IN_IADB_VOUCHED 5688 1.27 0.89 1.44 111 FROM_EXCESS_BASE64 5455 1.45 1.60 1.38 112 XM_E_Blogspot 5439 0.98 0.09 1.37 113 TR_Symld_Words 5389 1.27 1.06 1.36 114 XM_DK_Undo_01 5385 1.35 1.34 1.36 115 XMDiploma_00 4995 1.64 2.49 1.26 116 TR_XM_UnparsRelay 4955 3.26 7.78 1.25 117 UNTRUSTED_Relay 4943 2.71 5.99 1.25 118 SUBJ_ALL_CAPS 4921 1.29 1.41 1.24 119 TR_XM_PhishingBody 4900 2.21 4.39 1.24 120 XMSubLongNoVowel 4761 2.06 4.00 1.20 121 TooManyTo_003 4725 0.97 0.47 1.19 122 XMSubGarbage 4700 2.01 3.86 1.19 123 XM_SendGrid 4622 1.23 1.36 1.17 124 T_XMDrugObfuBody_14 4490 2.11 4.30 1.13 125 XM_GoogleGroups 4366 0.97 0.68 1.10 126 XM_B_Unsub2 4356 1.60 2.73 1.10 127 URI_HEX 4290 1.19 1.42 1.08 128 TR_DCC_Bayes_99 4267 6.08 17.34 1.08 129 XM_B_Investor 4169 1.81 3.51 1.05 130 IN_HORDE_ADDRESS_BOOK 4095 0.75 0.11 1.03 131 RCVD_IN_IADB_OPTIN 4048 0.89 0.58 1.02 132 XM_SPF_SoftFail 3911 1.40 2.31 0.99 133 TVD_RCVD_IP 3860 0.93 0.81 0.98 134 T_TooManySym_03 3829 0.72 0.17 0.97 135 BOTNET 3813 4.02 10.90 0.96 136 URI_NOVOWEL 3738 1.03 1.23 0.94 137 XM_ShortIntro_01 3649 0.77 0.42 0.92 138 HELO_NODOT 3626 0.69 0.18 0.92 139 XMBdyGiftCard01 3622 1.02 1.24 0.92 140 HELO_NO_DOMAIN 3620 0.68 0.17 0.91 141 TooManyTo_004 3462 0.72 0.36 0.87 142 T_XMDrugObfuBody_00 3409 1.00 1.32 0.86 143 RCVD_IN_MSPIKE_BL 3357 2.12 4.99 0.85 144 XMGappySubj_01 3351 0.63 0.13 0.85 145 TR_XM_MSPIKECOMBO 3349 2.08 4.86 0.85 146 XMCapTrack 3333 0.70 0.37 0.84 147 XM_UB50 3316 1.40 2.65 0.84 148 TR_XM_DK_SendGrid 3286 0.81 0.78 0.83 149 FROM_GOV_DKIM_AU 3258 0.68 0.36 0.82 150 XMLngstWrd_00 3144 0.69 0.47 0.79 151 XMSexyCombo_05 3098 1.50 3.11 0.78 152 TVD_SPACE_RATIO 2905 0.55 0.15 0.73 153 T_FILL_THIS_FORM_SHORT 2880 1.13 2.04 0.73 154 TooManyTo_005 2826 0.59 0.32 0.71 155 XMStockSpam_06 2790 1.18 2.26 0.71 156 TR_MetaPhish_Combo_01 2782 0.72 0.77 0.70 157 XMBrknScrpt_02 2710 0.89 1.35 0.68 158 RCVD_IN_BL_SPAMCOP_NET 2708 4.03 11.57 0.68 159 XM_OfRef6 2646 1.47 3.28 0.67 160 XM_H_PHPMailer 2637 0.57 0.35 0.67 161 T_OBFU_PDF_ATTACH 2626 0.53 0.24 0.66 162 HTML_IMAGE_ONLY_16 2603 0.49 0.12 0.66 163 TR_XM_Base64_M1 2594 0.66 0.66 0.66 164 RELAYCOUNTRY_GB 2583 0.80 1.12 0.65 165 XMGenDplmaNmb 2574 0.87 1.36 0.65 166 RCVD_IN_MSPIKE_L3 2495 1.29 2.77 0.63 167 T_Symld_Words_02 2480 0.71 0.90 0.63 168 XM_H_Long_From02 2456 0.95 1.69 0.62 169 XM_B_COPY_HTML 2341 0.77 1.16 0.59 170 DKIM_ADSP_CUSTOM_MED 2275 0.67 0.88 0.57 171 SpammyFromTLD_01 2271 0.77 1.21 0.57 172 HTTPS_HTTP_MISMATCH 2261 0.67 0.89 0.57 173 RCVD_IN_PBL 2188 0.80 1.36 0.55 174 T_XMHurry_00 2169 0.83 1.47 0.55 175 XMBSHREFv2 2148 0.48 0.34 0.54 176 RELAYCOUNTRY_CA 2138 1.69 4.27 0.54 177 XMNoVowels 2098 0.52 0.50 0.53 178 XMLngstWrd_01 2087 0.50 0.43 0.53 179 TO_NO_BRKTS_HTML_ONLY 2078 0.40 0.11 0.53 180 HTML_IMAGE_ONLY_20 1964 0.68 1.11 0.50 181 XM_B_SpammyWords4 1927 0.94 1.97 0.49 182 LongTLD 1842 0.48 0.52 0.47 183 MPART_ALT_DIFF_COUNT 1829 0.72 1.31 0.46 184 XM_ProductURIs 1811 0.65 1.08 0.46 185 HTML_TAG_BALANCE_BODY 1715 0.57 0.87 0.43 186 XM_B_DNDMA 1693 0.58 0.91 0.43 187 XMGappySubj_02 1628 0.29 0.03 0.41 188 XMPhish30 1618 0.74 1.49 0.41 189 MSGID_FROM_MTA_HEADER 1594 0.52 0.80 0.40 190 PLING_QUERY 1551 0.49 0.69 0.39 191 URI_TRY_3LD 1527 0.69 1.38 0.39 192 NML_ADSP_CUSTOM_MED 1524 0.50 0.75 0.39 193 XMSubMetaI_00 1489 0.44 0.59 0.38 194 RELAYCOUNTRY_AU 1472 0.96 2.28 0.37 195 XMPhish14 1450 0.54 0.93 0.37 196 TR_XM_GMP_MSPIKE_UNDO2 1441 0.31 0.18 0.36 197 HTML_IMAGE_ONLY_32 1437 0.40 0.49 0.36 198 T_TVD_MIME_NO_HEADERS 1417 0.26 0.03 0.36 199 SpammyFromTLD_02 1412 0.69 1.43 0.36 200 XMLngstWrd_02 1409 0.35 0.33 0.36 ----------------------------------------------------------------------