Email: 507240 Autolearn: 0 AvgScore: 5.67 AvgScanTime: 1.31 sec Spam: 178969 Autolearn: 0 AvgScore: 13.91 AvgScanTime: 1.31 sec Ham: 328271 Autolearn: 0 AvgScore: 1.18 AvgScanTime: 1.30 sec Time Spent Running SA: 184.03 hours Time Spent Processing Spam: 65.20 hours Time Spent Processing Ham: 118.84 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171056 89.84 95.58 86.72 2 DCC_CHECK 138540 49.94 77.41 34.97 3 DKIM_SIGNED 127307 72.57 71.13 73.35 4 XM_DK_Pass 118492 69.94 66.21 71.97 5 DKIM_VALID 117491 69.00 65.65 70.82 6 XM_B_Unicode 117490 68.13 65.65 69.48 7 RELAYCOUNTRY_US 116835 75.86 65.28 81.63 8 XM_B_SpammyWords 96898 47.40 54.14 43.72 9 DKIM_VALID_AU 92579 56.16 51.73 58.58 10 XMListUnsubscribeExists 92489 47.55 51.68 45.30 11 BAYES_50 88901 55.95 49.67 59.37 12 MIME_HTML_ONLY 74133 27.08 41.42 19.26 13 XM_B_Unicode3 65708 39.63 36.71 41.23 14 LOC_TINY_FONT_1 65260 31.58 36.46 28.92 15 XM_DK_Undo_02 57057 14.49 31.88 5.01 16 XM_B_SpammyWords2 54096 22.13 30.23 17.72 17 XMSubLong 53901 26.58 30.12 24.65 18 HTML_FONT_LOW_CONTRAST 51978 29.87 29.04 30.32 19 FVGT_m_MULTI_ODD 50614 25.95 28.28 24.68 20 BAYES_99 44775 11.56 25.02 4.22 21 DKIM_VALID_EF 42780 27.91 23.90 30.10 22 T_KAM_HTML_FONT_INVALID 41710 21.31 23.31 20.22 23 XMNumbers 40667 10.40 22.72 3.68 24 TR_XM_DKIM_Undo 39784 9.03 22.23 1.84 25 HTML_MIME_NO_HTML_TAG 38249 9.48 21.37 3.00 26 ALL_TRUSTED 38155 17.60 21.32 15.58 27 DCC_CHECK_NEGATIVE 37963 49.52 21.21 64.95 28 HTML_IMAGE_ONLY_08 37184 7.63 20.78 0.46 29 HTML_SHORT_LINK_IMG_1 37072 7.53 20.71 0.34 30 BAYES_999 34522 8.74 19.29 2.98 31 T_TM2_M_HEADER_IN_MSG 34320 28.25 19.18 33.20 32 XM_Multi_Part_URI 32661 14.81 18.25 12.94 33 TR_DCC_Bayes_99 31383 7.09 17.54 1.40 34 TR_XM_DK_Unsub 30439 14.52 17.01 13.16 35 XM_B_Unsub 29994 11.79 16.76 9.08 36 RCVD_IN_MSPIKE_H2 29030 16.54 16.22 16.71 37 TR_XM_BayesUnsub 28687 10.16 16.03 6.96 38 UNPARSEABLE_RELAY 24696 12.29 13.80 11.47 39 RELAYCOUNTRY_META 24260 6.97 13.56 3.38 40 TR_MAX_INTL_RELAY 22866 8.65 12.78 6.39 41 LOTS_OF_MONEY 18377 7.45 10.27 5.91 42 RCVD_IN_BL_SPAMCOP_NET 18211 4.08 10.18 0.76 43 XM_B_SpammyWords3 17979 6.60 10.05 4.72 44 TR_XM_SpammyRelay 17420 4.47 9.73 1.60 45 RCVD_IN_MSPIKE_WL 16202 15.74 9.05 19.38 46 TR_XM_SpammyWords4 15663 5.63 8.75 3.93 47 BOTNET 15403 3.69 8.61 1.01 48 BOTNET_IPINHOSTNAME 15390 4.84 8.60 2.79 49 FSL_BULK_SIG 15020 6.12 8.39 4.88 50 TR_XM_SpammyWords2 14508 3.16 8.11 0.46 51 BAYES_80 14172 5.25 7.92 3.80 52 BAYES_60 13471 7.09 7.53 6.85 53 XM_Evil_Numbers_Gen 12744 8.92 7.12 9.91 54 TR_XM_UnparsRelay 12461 3.50 6.96 1.61 55 XM_B_Phish_Phrases 11847 5.34 6.62 4.65 56 T_TooManySym_01 9872 5.72 5.52 5.84 57 XMSubMetaSx_00 9852 3.75 5.50 2.80 58 DKIM_INVALID 9816 3.57 5.48 2.52 59 RCVD_IN_MSPIKE_BL 9801 2.58 5.48 1.00 60 TR_XM_MSPIKECOMBO 9794 2.58 5.47 1.00 61 UNTRUSTED_Relay 9777 2.93 5.46 1.55 62 XM_B_SpammyTLD 9566 3.36 5.35 2.28 63 MPART_ALT_DIFF 9196 4.71 5.14 4.47 64 XM_H_GMP 8953 5.68 5.00 6.05 65 TR_XM_SPAMCOP 8706 1.88 4.86 0.26 66 XM_UncommonTLD01 8660 4.38 4.84 4.12 67 LotsOfNums_01 8654 8.31 4.84 10.21 68 XM_B_PhoneNumber 8575 8.11 4.79 9.93 69 XM_Body_Dirty_Words 8439 2.90 4.72 1.92 70 HTML_IMAGE_RATIO_02 8121 4.79 4.54 4.93 71 RELAYCOUNTRY_CA 8105 1.98 4.53 0.58 72 BAYES_95 7836 3.22 4.38 2.60 73 RCVD_IN_MSPIKE_H3 7641 7.13 4.27 8.69 74 T_XMDrugObfuBody_14 7299 2.37 4.08 1.43 75 XM_H_Long_From01 7224 4.82 4.04 5.25 76 TR_XM_SpammyWords3 6834 1.67 3.82 0.50 77 TR_XM_PhishingBody 6717 2.22 3.75 1.38 78 MIME_QP_LONG_LINE 6534 4.53 3.65 5.01 79 XM_B_Investor 6484 2.26 3.62 1.52 80 XMStrtUSub 6379 4.16 3.56 4.48 81 TM2_M_VERY_LONG_WORD 6351 4.24 3.55 4.61 82 HTML_IMAGE_RATIO_04 5951 3.38 3.33 3.40 83 RCVD_IN_MSPIKE_L3 5730 1.66 3.20 0.82 84 T_XMDrugObfuBody_08 5624 2.21 3.14 1.70 85 XM_CamelCaseFrm001 5547 2.68 3.10 2.45 86 XM_B_Unsub2 5395 1.87 3.01 1.24 87 XMSexyCombo_05 5154 1.70 2.88 1.06 88 MIME_HTML_MOSTLY 5094 2.95 2.85 3.01 89 TR_XM_SpammyWords5 5044 1.74 2.82 1.15 90 HTML_IMAGE_RATIO_06 4683 3.14 2.62 3.42 91 TooManyTo_001 4578 5.84 2.56 7.63 92 TR_XM_NoHeaderRelay 4523 1.01 2.53 0.18 93 XM_SPF_SoftFail 4468 1.68 2.50 1.24 94 XM_OfRef6 4464 1.46 2.49 0.90 95 RCVD_IN_MSPIKE_H5 4435 5.04 2.48 6.43 96 RELAYCOUNTRY_AU 4417 1.18 2.47 0.48 97 BOTNET_NORDNS 4279 0.85 2.39 0.01 98 XMDiploma_00 4234 1.83 2.37 1.53 99 RCVD_IN_MSPIKE_H4 4126 3.57 2.31 4.26 100 XM_B_URI_Unicode 3999 1.93 2.23 1.77 101 T_FILL_THIS_FORM_SHORT 3984 1.43 2.23 0.99 102 DKIM_ADSP_NXDOMAIN 3964 0.99 2.21 0.32 103 RCVD_IN_VALIDITY_RPBL 3849 0.82 2.15 0.09 104 T_XMHurry_00 3843 1.28 2.15 0.80 105 XM_URI_RBL 3769 0.92 2.11 0.27 106 XM_UB50 3761 1.44 2.10 1.07 107 TR_XM_MSPIKECOMBO2 3729 0.80 2.08 0.10 108 HTML_IMAGE_RATIO_08 3602 2.02 2.01 2.02 109 XMBody_17 3549 1.13 1.98 0.66 110 TR_XM_INV_DKIM 3519 0.71 1.97 0.02 111 BAYES_40 3477 4.81 1.94 6.37 112 URI_TRY_3LD 3435 0.96 1.92 0.44 113 MIME_HTML_ONLY_MULTI 3430 2.16 1.92 2.29 114 BOUNCE_MESSAGE 3292 6.64 1.84 9.25 115 ANY_BOUNCE_MESSAGE 3292 6.64 1.84 9.25 116 TR_LOTS_OF_MONEY3 3232 0.89 1.81 0.40 117 MAILING_LIST_MULTI 3074 2.52 1.72 2.96 118 TM2_M_URI_OPT_OUT 2984 1.77 1.67 1.82 119 XM_B_SpammyWords4 2983 0.85 1.67 0.41 120 XM_H_DKIM_GOOG 2944 0.59 1.64 0.01 121 SUBJ_ALL_CAPS 2862 1.40 1.60 1.30 122 XMPhish30 2775 0.81 1.55 0.41 123 KHOP_HELO_FCRDNS 2757 2.84 1.54 3.55 124 TR_XM_INTL_Spamhaus 2754 0.67 1.54 0.20 125 XMStockSpam_06 2727 1.36 1.52 1.27 126 RCVD_IN_MSPIKE_L4 2709 0.64 1.51 0.16 127 SpammyFromTLD_02 2697 0.68 1.51 0.24 128 TR_XM_MaxSPIKE 2655 0.55 1.48 0.04 129 XMGenDplmaNmb 2627 1.04 1.47 0.80 130 XM_H_Long_From02 2602 0.97 1.45 0.71 131 SpammyFromTLD_01 2598 1.07 1.45 0.86 132 T_REMOTE_IMAGE 2533 2.67 1.42 3.36 133 FROM_EXCESS_BASE64 2522 1.60 1.41 1.70 134 RCVD_IN_IADB_LISTED 2458 2.35 1.37 2.89 135 XMBrknScrpt_02 2450 1.12 1.37 0.99 136 HK_RANDOM_REPLYTO 2425 0.53 1.35 0.08 137 BAYES_20 2417 3.61 1.35 4.84 138 SHORTCIRCUIT 2404 0.47 1.34 0.00 139 RCVD_IN_ZEN_LASTEXTERNAL 2404 0.47 1.34 0.00 140 RCVD_IN_VALIDITY_SAFE 2399 3.07 1.34 4.01 141 MPART_ALT_DIFF_COUNT 2373 0.84 1.33 0.58 142 XM_B_Phish66 2351 0.66 1.31 0.31 143 USER_IN_DEF_DKIM_WL 2278 8.43 1.27 12.33 144 T_XMDrugObfuBody_00 2270 1.04 1.27 0.92 145 URI_NOVOWEL 2168 1.01 1.21 0.90 146 URI_HEX 2142 1.05 1.20 0.96 147 RELAYCOUNTRY_FR 2131 0.63 1.19 0.32 148 THIS_AD 2129 0.68 1.19 0.40 149 RCVD_IN_PSBL 2116 0.43 1.18 0.03 150 XM_UB99 2112 0.42 1.18 0.00 151 XM_B_SEO 2110 0.59 1.18 0.26 152 HTML_FONT_TINY_NORDNS 2046 0.45 1.14 0.07 153 RCVD_IN_XBL 2017 0.42 1.13 0.03 154 RCVD_IN_IADB_SPF 2003 2.06 1.12 2.58 155 XM_DK_Undo_01 1968 1.46 1.10 1.65 156 XM_SendGrid 1962 1.43 1.10 1.61 157 XM_B_COPY_HTML 1909 1.02 1.07 0.99 158 TR_XM_SEO4 1907 0.44 1.07 0.11 159 XMSubMetaI_00 1901 0.72 1.06 0.53 160 XM_B_DNDMA 1889 0.70 1.06 0.50 161 RDNS_DYNAMIC 1889 0.46 1.06 0.14 162 RCVD_IN_PBL 1822 0.85 1.02 0.76 163 MultiRelay_CC 1780 0.46 0.99 0.17 164 RCVD_IN_IADB_DK 1771 1.79 0.99 2.23 165 RCVD_IN_IADB_SENDERID 1734 1.85 0.97 2.32 166 DIET_1 1726 0.58 0.96 0.36 167 TR_XM_GMP_BULK_SIG 1703 0.40 0.95 0.11 168 STY_INVIS_DIRECT 1686 0.45 0.94 0.18 169 DKIM_ADSP_CUSTOM_MED 1682 0.90 0.94 0.89 170 RCVD_IN_IADB_VOUCHED 1677 1.51 0.94 1.83 171 RCVD_IN_SBL_CSS 1664 0.35 0.93 0.04 172 RCVD_IN_VALIDITY_CERTIFIED 1632 2.53 0.91 3.42 173 XMBody_78 1598 0.59 0.89 0.42 174 TR_Symld_Words 1577 1.28 0.88 1.50 175 T_Symld_Words_02 1570 0.69 0.88 0.59 176 TR_Mismatch_TLD_02 1564 0.37 0.87 0.10 177 TR_XM_FormFill 1560 0.31 0.87 0.01 178 TR_LOTS_OF_MONEY2 1549 0.45 0.87 0.23 179 T_MONEY_PERCENT 1549 0.45 0.87 0.23 180 XMSubMetaSxObfu_03 1531 0.53 0.86 0.36 181 TVD_RCVD_IP 1530 0.81 0.85 0.79 182 NML_ADSP_CUSTOM_MED 1500 0.67 0.84 0.57 183 XM_GoogleGroups 1497 1.18 0.84 1.36 184 TR_XM_RelayPhish 1492 0.35 0.83 0.08 185 XM_UB999 1488 0.29 0.83 0.00 186 TR_XM_InvalidRelay 1451 0.29 0.81 0.01 187 MIME_CHARSET_FARAWAY 1442 1.58 0.81 2.00 188 XMPhish14 1439 0.55 0.80 0.40 189 XM_HighProb1 1439 0.28 0.80 0.00 190 NO_DNS_FOR_FROM 1408 0.47 0.79 0.29 191 XM_UB60 1364 0.33 0.76 0.09 192 RCVD_IN_MSPIKE_L5 1355 0.28 0.76 0.02 193 XM_ProductURIs 1354 0.84 0.76 0.88 194 FORGED_GMAIL_RCVD 1344 0.64 0.75 0.57 195 TR_XM_MaxWHORU 1341 0.42 0.75 0.23 196 URI_OPTOUT_3LD 1337 0.61 0.75 0.53 197 HELO_DYNAMIC_SPLIT_IP 1336 0.26 0.75 0.00 198 XMBdyGiftCard01 1334 0.69 0.75 0.66 199 XM_DIRTYINTL 1312 0.29 0.73 0.05 200 HTTPS_HTTP_MISMATCH 1304 0.77 0.73 0.80 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 284662 89.84 95.58 86.72 2 RELAYCOUNTRY_US 267963 75.86 65.28 81.63 3 DKIM_SIGNED 240773 72.57 71.13 73.35 4 XM_DK_Pass 236252 69.94 66.21 71.97 5 DKIM_VALID 232496 69.00 65.65 70.82 6 XM_B_Unicode 228087 68.13 65.65 69.48 7 DCC_CHECK_NEGATIVE 213208 49.52 21.21 64.95 8 BAYES_50 194903 55.95 49.67 59.37 9 DKIM_VALID_AU 192285 56.16 51.73 58.58 10 XMListUnsubscribeExists 148697 47.55 51.68 45.30 11 XM_B_SpammyWords 143518 47.40 54.14 43.72 12 XM_B_Unicode3 135332 39.63 36.71 41.23 13 DCC_CHECK 114788 49.94 77.41 34.97 14 T_TM2_M_HEADER_IN_MSG 108974 28.25 19.18 33.20 15 HTML_FONT_LOW_CONTRAST 99531 29.87 29.04 30.32 16 DKIM_VALID_EF 98797 27.91 23.90 30.10 17 LOC_TINY_FONT_1 94944 31.58 36.46 28.92 18 FVGT_m_MULTI_ODD 81018 25.95 28.28 24.68 19 XMSubLong 80935 26.58 30.12 24.65 20 T_KAM_HTML_FONT_INVALID 66378 21.31 23.31 20.22 21 RCVD_IN_MSPIKE_WL 63620 15.74 9.05 19.38 22 MIME_HTML_ONLY 63236 27.08 41.42 19.26 23 XM_B_SpammyWords2 58158 22.13 30.23 17.72 24 RCVD_IN_MSPIKE_H2 54847 16.54 16.22 16.71 25 ALL_TRUSTED 51142 17.60 21.32 15.58 26 TR_XM_DK_Unsub 43190 14.52 17.01 13.16 27 XM_Multi_Part_URI 42475 14.81 18.25 12.94 28 USER_IN_DEF_DKIM_WL 40480 8.43 1.27 12.33 29 UNPARSEABLE_RELAY 37664 12.29 13.80 11.47 30 LotsOfNums_01 33512 8.31 4.84 10.21 31 XM_B_PhoneNumber 32584 8.11 4.79 9.93 32 XM_Evil_Numbers_Gen 32518 8.92 7.12 9.91 33 BAYES_00 31495 6.34 0.36 9.59 34 ANY_BOUNCE_MESSAGE 30376 6.64 1.84 9.25 35 BOUNCE_MESSAGE 30374 6.64 1.84 9.25 36 XM_B_Unsub 29812 11.79 16.76 9.08 37 RCVD_IN_MSPIKE_H3 28522 7.13 4.27 8.69 38 TooManyTo_001 25033 5.84 2.56 7.63 39 TR_XM_BayesUnsub 22863 10.16 16.03 6.96 40 BAYES_60 22488 7.09 7.53 6.85 41 TR_XM_DK_Bayes 21555 4.33 0.23 6.57 42 TR_XM_DK_Bayes1 21174 4.25 0.22 6.45 43 RCVD_IN_MSPIKE_H5 21112 5.04 2.48 6.43 44 TR_MAX_INTL_RELAY 20988 8.65 12.78 6.39 45 BAYES_40 20908 4.81 1.94 6.37 46 XM_H_GMP 19863 5.68 5.00 6.05 47 LOTS_OF_MONEY 19388 7.45 10.27 5.91 48 T_TooManySym_01 19163 5.72 5.52 5.84 49 XM_DKIMWhitelistDomains 18736 3.70 0.02 5.71 50 TR_XM_DK_Bayes2 18264 3.66 0.18 5.56 51 XM_H_Long_From01 17230 4.82 4.04 5.25 52 MIME_QP_LONG_LINE 16458 4.53 3.65 5.01 53 XM_DK_Undo_02 16432 14.49 31.88 5.01 54 HTML_IMAGE_RATIO_02 16183 4.79 4.54 4.93 55 FSL_BULK_SIG 16024 6.12 8.39 4.88 56 BAYES_20 15880 3.61 1.35 4.84 57 XM_B_SpammyWords3 15485 6.60 10.05 4.72 58 XM_B_Phish_Phrases 15250 5.34 6.62 4.65 59 TM2_M_VERY_LONG_WORD 15141 4.24 3.55 4.61 60 XMStrtUSub 14713 4.16 3.56 4.48 61 MPART_ALT_DIFF 14682 4.71 5.14 4.47 62 XM_PDF 14356 3.01 0.52 4.37 63 RCVD_IN_MSPIKE_H4 13986 3.57 2.31 4.26 64 BAYES_99 13843 11.56 25.02 4.22 65 XM_UncommonTLD01 13535 4.38 4.84 4.12 66 RCVD_IN_VALIDITY_SAFE 13172 3.07 1.34 4.01 67 TR_XM_SpammyWords4 12915 5.63 8.75 3.93 68 BAYES_80 12462 5.25 7.92 3.80 69 XMNumbers 12076 10.40 22.72 3.68 70 KHOP_HELO_FCRDNS 11646 2.84 1.54 3.55 71 RCVD_IN_VALIDITY_CERTIFIED 11226 2.53 0.91 3.42 72 HTML_IMAGE_RATIO_06 11222 3.14 2.62 3.42 73 HTML_IMAGE_RATIO_04 11175 3.38 3.33 3.40 74 RELAYCOUNTRY_META 11089 6.97 13.56 3.38 75 T_REMOTE_IMAGE 11020 2.67 1.42 3.36 76 MIME_HTML_MOSTLY 9876 2.95 2.85 3.01 77 HTML_MIME_NO_HTML_TAG 9849 9.48 21.37 3.00 78 BAYES_999 9789 8.74 19.29 2.98 79 MAILING_LIST_MULTI 9715 2.52 1.72 2.96 80 T_TooManySym_02 9546 2.08 0.57 2.91 81 RCVD_IN_IADB_LISTED 9473 2.35 1.37 2.89 82 XMSubMetaSx_00 9192 3.75 5.50 2.80 83 BOTNET_IPINHOSTNAME 9166 4.84 8.60 2.79 84 BAYES_95 8521 3.22 4.38 2.60 85 RCVD_IN_IADB_SPF 8468 2.06 1.12 2.58 86 TooManyTo_002 8353 1.81 0.45 2.54 87 DKIM_INVALID 8277 3.57 5.48 2.52 88 XM_CamelCaseFrm001 8043 2.68 3.10 2.45 89 BAYES_05 7767 1.70 0.48 2.37 90 RCVD_IN_IADB_SENDERID 7627 1.85 0.97 2.32 91 MIME_HTML_ONLY_MULTI 7531 2.16 1.92 2.29 92 XM_B_SpammyTLD 7476 3.36 5.35 2.28 93 RCVD_IN_IADB_DK 7317 1.79 0.99 2.23 94 INVALID_MSGID 7122 1.45 0.14 2.17 95 TO_MALFORMED 6683 1.32 0.00 2.04 96 HTML_IMAGE_RATIO_08 6640 2.02 2.01 2.02 97 MIME_CHARSET_FARAWAY 6578 1.58 0.81 2.00 98 MSGID_NOFQDN1 6345 1.26 0.01 1.93 99 XM_Body_Dirty_Words 6290 2.90 4.72 1.92 100 CHARSET_FARAWAY_HEADER 6223 1.45 0.62 1.90 101 TR_XM_DKIM_Undo 6039 9.03 22.23 1.84 102 RCVD_IN_IADB_VOUCHED 5991 1.51 0.94 1.83 103 TM2_M_URI_OPT_OUT 5985 1.77 1.67 1.82 104 XM_B_URI_Unicode 5807 1.93 2.23 1.77 105 FROM_EXCESS_BASE64 5597 1.60 1.41 1.70 106 T_XMDrugObfuBody_08 5567 2.21 3.14 1.70 107 XM_DK_Undo_01 5417 1.46 1.10 1.65 108 XM_SendGrid 5301 1.43 1.10 1.61 109 TR_XM_UnparsRelay 5295 3.50 6.96 1.61 110 TR_XM_SpammyRelay 5255 4.47 9.73 1.60 111 TooManyTo_003 5107 1.13 0.36 1.56 112 UNTRUSTED_Relay 5072 2.93 5.46 1.55 113 XMDiploma_00 5028 1.83 2.37 1.53 114 XM_B_Investor 4986 2.26 3.62 1.52 115 TR_Symld_Words 4916 1.28 0.88 1.50 116 T_XMDrugObfuBody_14 4698 2.37 4.08 1.43 117 TR_DCC_Bayes_99 4603 7.09 17.54 1.40 118 TR_XM_PhishingBody 4523 2.22 3.75 1.38 119 XM_GoogleGroups 4469 1.18 0.84 1.36 120 XMLngstWrd_00 4331 1.01 0.46 1.32 121 RCVD_IN_IADB_OPTIN 4281 1.07 0.64 1.30 122 SUBJ_ALL_CAPS 4252 1.40 1.60 1.30 123 XMStockSpam_06 4176 1.36 1.52 1.27 124 IN_HORDE_ADDRESS_BOOK 4080 0.82 0.05 1.24 125 XM_B_Unsub2 4066 1.87 3.01 1.24 126 XM_SPF_SoftFail 4062 1.68 2.50 1.24 127 HELO_NODOT 4009 0.83 0.13 1.22 128 HELO_NO_DOMAIN 4005 0.83 0.11 1.22 129 XM_H_PHPMailer 3856 0.96 0.56 1.17 130 TooManyTo_004 3855 0.87 0.31 1.17 131 TR_XM_SpammyWords5 3780 1.74 2.82 1.15 132 TR_XM_DK_SendGrid 3762 0.97 0.64 1.15 133 T_TooManySym_03 3757 0.81 0.18 1.14 134 XMCapTrack 3743 0.95 0.60 1.14 135 XM_UB50 3528 1.44 2.10 1.07 136 XMSexyCombo_05 3486 1.70 2.88 1.06 137 T_TVD_MIME_NO_HEADERS 3447 0.69 0.02 1.05 138 BOTNET 3324 3.69 8.61 1.01 139 XMGappySubj_01 3301 0.73 0.21 1.01 140 RCVD_IN_MSPIKE_BL 3281 2.58 5.48 1.00 141 TR_XM_MSPIKECOMBO 3278 2.58 5.47 1.00 142 XM_B_COPY_HTML 3253 1.02 1.07 0.99 143 T_FILL_THIS_FORM_SHORT 3250 1.43 2.23 0.99 144 XMBrknScrpt_02 3243 1.12 1.37 0.99 145 XM_ShortIntro_01 3229 0.79 0.43 0.98 146 TooManyTo_005 3222 0.73 0.28 0.98 147 URI_HEX 3162 1.05 1.20 0.96 148 TVD_SPACE_RATIO 3072 0.67 0.19 0.94 149 TR_MetaPhish_Combo_01 3041 0.78 0.52 0.93 150 T_XMDrugObfuBody_00 3005 1.04 1.27 0.92 151 XM_OfRef6 2965 1.46 2.49 0.90 152 URI_NOVOWEL 2945 1.01 1.21 0.90 153 DKIM_ADSP_CUSTOM_MED 2906 0.90 0.94 0.89 154 XM_ProductURIs 2888 0.84 0.76 0.88 155 TR_XM_Base64_M1 2840 0.80 0.67 0.87 156 SpammyFromTLD_01 2819 1.07 1.45 0.86 157 RCVD_IN_MSPIKE_L3 2685 1.66 3.20 0.82 158 T_XMHurry_00 2634 1.28 2.15 0.80 159 XMGenDplmaNmb 2634 1.04 1.47 0.80 160 HTTPS_HTTP_MISMATCH 2615 0.77 0.73 0.80 161 TVD_RCVD_IP 2600 0.81 0.85 0.79 162 RCVD_IN_PBL 2497 0.85 1.02 0.76 163 RCVD_IN_BL_SPAMCOP_NET 2489 4.08 10.18 0.76 164 XM_H_Long_From02 2333 0.97 1.45 0.71 165 TO_NO_BRKTS_HTML_ONLY 2281 0.52 0.21 0.69 166 RELAYCOUNTRY_GB 2204 0.65 0.62 0.67 167 XMGappySubj_02 2196 0.44 0.03 0.67 168 XMBody_17 2165 1.13 1.98 0.66 169 XMBdyGiftCard01 2157 0.69 0.75 0.66 170 TR_XM_PHPForged 2153 0.67 0.70 0.66 171 TR_XM_FormFill2 2143 0.66 0.69 0.65 172 TR_XM_PHPDW 2142 0.66 0.67 0.65 173 XM_H_PHPOS 2112 0.65 0.66 0.64 174 T_OBFU_PDF_ATTACH 2107 0.46 0.11 0.64 175 HTML_IMAGE_ONLY_20 2005 0.63 0.67 0.61 176 XMNoVowels 1991 0.51 0.34 0.61 177 T_Symld_Words_02 1943 0.69 0.88 0.59 178 XMHTML_After_End 1934 0.61 0.64 0.59 179 RELAYCOUNTRY_CA 1917 1.98 4.53 0.58 180 MPART_ALT_DIFF_COUNT 1910 0.84 1.33 0.58 181 FORGED_GMAIL_RCVD 1886 0.64 0.75 0.57 182 NML_ADSP_CUSTOM_MED 1878 0.67 0.84 0.57 183 XMBSHREFv2 1825 0.44 0.24 0.56 184 TO_IN_SUBJ 1792 0.38 0.07 0.55 185 URI_OPTOUT_3LD 1754 0.61 0.75 0.53 186 XMSubMetaI_00 1736 0.72 1.06 0.53 187 MSGID_FROM_MTA_HEADER 1722 0.44 0.30 0.52 188 HTML_IMAGE_ONLY_32 1719 0.39 0.15 0.52 189 LONGLN_LOW_CONTRAST 1673 0.44 0.32 0.51 190 FROM_GOV_DKIM_AU 1669 0.36 0.10 0.51 191 XM_B_DNDMA 1648 0.70 1.06 0.50 192 TR_XM_SpammyWords3 1632 1.67 3.82 0.50 193 HTML_TAG_BALANCE_BODY 1618 0.54 0.63 0.49 194 RELAYCOUNTRY_AU 1586 1.18 2.47 0.48 195 XMLngstWrd_01 1582 0.46 0.41 0.48 196 XMSlimDrugH 1559 0.55 0.70 0.47 197 TR_XM_SpammyWords2 1522 3.16 8.11 0.46 198 HTML_IMAGE_ONLY_08 1502 7.63 20.78 0.46 199 TM2_M_HAS_BSLASH_URI 1459 0.32 0.08 0.44 200 URI_TRY_3LD 1458 0.96 1.92 0.44 ----------------------------------------------------------------------