Email: 478543 Autolearn: 0 AvgScore: 5.08 AvgScanTime: 1.57 sec Spam: 148548 Autolearn: 0 AvgScore: 14.24 AvgScanTime: 1.77 sec Ham: 329995 Autolearn: 0 AvgScore: 0.96 AvgScanTime: 1.48 sec Time Spent Running SA: 208.89 hours Time Spent Processing Spam: 73.07 hours Time Spent Processing Ham: 135.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141871 90.29 95.51 87.94 2 DKIM_SIGNED 131865 81.34 88.77 77.99 3 RELAYCOUNTRY_US 123875 83.14 83.39 83.03 4 XM_DK_Pass 122976 78.59 82.79 76.70 5 XM_B_Unicode 122031 74.26 82.15 70.70 6 DKIM_VALID 121892 77.66 82.06 75.68 7 DCC_CHECK 107758 48.77 72.54 38.08 8 XM_B_SpammyWords 102043 54.35 68.69 47.89 9 DKIM_VALID_AU 96168 63.35 64.74 62.72 10 XMListUnsubscribeExists 95385 54.54 64.21 50.18 11 LOC_TINY_FONT_1 70928 36.39 47.75 31.27 12 XM_B_Unicode3 69174 43.52 46.57 42.15 13 XM_DK_Undo_02 61385 16.45 41.32 5.25 14 BAYES_50 59259 54.60 39.89 61.22 15 XM_B_SpammyWords2 56242 25.63 37.86 20.13 16 HTML_FONT_LOW_CONTRAST 55545 31.73 37.39 29.18 17 FVGT_m_MULTI_ODD 54302 29.29 36.56 26.03 18 BAYES_99 45296 12.05 30.49 3.74 19 DKIM_VALID_EF 43923 30.50 29.57 30.92 20 T_KAM_HTML_FONT_INVALID 43372 25.57 29.20 23.94 21 TR_XM_DKIM_Undo 42179 10.25 28.39 2.08 22 MIME_HTML_ONLY 40487 22.81 27.26 20.81 23 DCC_CHECK_NEGATIVE 39292 50.87 26.45 61.86 24 T_SCC_BODY_TEXT_LINE 39246 26.38 26.42 26.37 25 XMSubLong 37885 25.00 25.50 24.77 26 BAYES_999 34555 9.18 23.26 2.84 27 RCVD_IN_MSPIKE_H2 33675 18.90 22.67 17.20 28 T_TM2_M_HEADER_IN_MSG 33145 27.16 22.31 29.34 29 XM_B_Unsub 33119 13.56 22.30 9.63 30 TR_DCC_Bayes_99 32100 7.61 21.61 1.30 31 XM_Multi_Part_URI 31728 16.51 21.36 14.33 32 TR_XM_BayesUnsub 31467 11.60 21.18 7.29 33 TR_XM_DK_Unsub 31245 15.93 21.03 13.63 34 UNPARSEABLE_RELAY 27417 14.03 18.46 12.04 35 RELAYCOUNTRY_META 23201 7.33 15.62 3.60 36 TR_MAX_INTL_RELAY 22122 8.94 14.89 6.26 37 RCVD_IN_BL_SPAMCOP_NET 20660 4.89 13.91 0.83 38 XM_B_SpammyWords3 19307 7.74 13.00 5.38 39 BOTNET 18515 4.64 12.46 1.11 40 LOTS_OF_MONEY 18029 8.11 12.14 6.30 41 FSL_BULK_SIG 17915 7.50 12.06 5.44 42 RCVD_IN_MSPIKE_WL 17124 17.73 11.53 20.52 43 BOTNET_IPINHOSTNAME 17005 5.68 11.45 3.08 44 TR_XM_SpammyRelay 16857 4.82 11.35 1.89 45 TR_XM_SpammyWords4 15774 6.16 10.62 4.16 46 TR_XM_UnparsRelay 15068 4.33 10.14 1.71 47 TR_XM_SpammyWords2 14521 3.26 9.78 0.32 48 XM_Evil_Numbers_Gen 14120 9.69 9.51 9.77 49 BAYES_80 13571 5.52 9.14 3.89 50 XM_B_Phish_Phrases 12919 6.26 8.70 5.16 51 BAYES_60 12515 7.48 8.42 7.06 52 XM_H_GMP 11193 6.36 7.53 5.83 53 MPART_ALT_DIFF 10742 5.66 7.23 4.95 54 XM_B_PhoneNumber 10665 9.94 7.18 11.18 55 TR_XM_SPAMCOP 10624 2.47 7.15 0.36 56 LotsOfNums_01 10220 8.49 6.88 9.21 57 DKIM_INVALID 9973 3.67 6.71 2.31 58 RCVD_IN_MSPIKE_BL 9726 2.85 6.55 1.18 59 TR_XM_MSPIKECOMBO 9708 2.84 6.54 1.18 60 HTML_IMAGE_RATIO_02 9702 5.53 6.53 5.08 61 UNTRUSTED_Relay 9611 2.99 6.47 1.42 62 XM_H_Long_From01 8862 5.93 5.97 5.92 63 XMStrtUSub 8744 5.94 5.89 5.97 64 XMSubMetaSx_00 8434 4.32 5.68 3.72 65 XM_UncommonTLD01 8277 4.47 5.57 3.98 66 RELAYCOUNTRY_CA 8222 2.18 5.53 0.67 67 BAYES_95 8024 3.31 5.40 2.37 68 RCVD_IN_MSPIKE_H3 7918 8.01 5.33 9.21 69 XM_B_Investor 7528 2.67 5.07 1.59 70 XM_Body_Dirty_Words 7508 3.38 5.05 2.62 71 TR_XM_PhishingBody 7446 2.85 5.01 1.87 72 T_XMDrugObfuBody_14 7101 2.51 4.78 1.49 73 TR_XM_SpammyWords3 6951 1.81 4.68 0.52 74 XM_B_SpammyTLD 6718 3.43 4.52 2.94 75 XMNumbers 6513 3.69 4.38 3.38 76 TR_XM_SpammyWords5 6371 2.24 4.29 1.32 77 HTML_IMAGE_RATIO_04 6228 4.17 4.19 4.17 78 MIME_HTML_MOSTLY 6215 3.26 4.18 2.84 79 TooManyTo_001 6017 6.66 4.05 7.84 80 T_XMDrugObfuBody_08 5858 2.33 3.94 1.60 81 TM2_M_VERY_LONG_WORD 5531 2.38 3.72 1.77 82 XMSexyCombo_05 5185 2.18 3.49 1.58 83 RCVD_IN_MSPIKE_L3 5122 1.76 3.45 1.01 84 RCVD_IN_MSPIKE_H5 4838 5.85 3.26 7.02 85 MIME_QP_LONG_LINE 4814 4.83 3.24 5.55 86 XMDiploma_00 4811 2.30 3.24 1.88 87 XM_SPF_SoftFail 4783 1.87 3.22 1.26 88 HTML_IMAGE_RATIO_06 4741 3.47 3.19 3.60 89 T_TooManySym_01 4645 4.97 3.13 5.80 90 XM_CamelCaseFrm001 4595 2.38 3.09 2.06 91 KHOP_HELO_FCRDNS 4594 2.53 3.09 2.28 92 RCVD_IN_MSPIKE_H4 4368 3.87 2.94 4.28 93 HTML_IMAGE_RATIO_08 4331 3.07 2.92 3.14 94 XM_B_Unsub2 4241 1.88 2.85 1.44 95 BOTNET_NORDNS 4158 0.87 2.80 0.01 96 XM_OfRef6 4102 1.47 2.76 0.89 97 XM_UB50 4100 1.52 2.76 0.96 98 DKIM_ADSP_NXDOMAIN 4025 1.04 2.71 0.29 99 RELAYCOUNTRY_AU 4003 1.31 2.69 0.68 100 XM_B_URI_Unicode 3987 2.23 2.68 2.02 101 MIME_HTML_ONLY_MULTI 3717 2.45 2.50 2.43 102 TR_XM_NoHeaderRelay 3713 0.94 2.50 0.24 103 XM_URI_RBL 3700 1.00 2.49 0.33 104 TR_XM_INV_DKIM 3509 0.76 2.36 0.03 105 XM_H_Long_From02 3438 1.38 2.31 0.96 106 RCVD_IN_MSPIKE_L4 3424 0.82 2.30 0.16 107 XM_B_SpammyWords4 3424 1.11 2.30 0.57 108 T_FILL_THIS_FORM_SHORT 3418 1.36 2.30 0.94 109 RCVD_IN_VALIDITY_RPBL 3403 0.75 2.29 0.05 110 TM2_M_URI_OPT_OUT 3369 2.07 2.27 1.99 111 USER_IN_DEF_DKIM_WL 3267 10.64 2.20 14.44 112 XM_H_DKIM_GOOG 3215 0.68 2.16 0.01 113 BAYES_40 3209 4.44 2.16 5.46 114 URI_NOVOWEL 3128 1.46 2.11 1.17 115 TR_XM_MSPIKECOMBO2 3127 0.72 2.11 0.10 116 XMStockSpam_06 3113 1.51 2.10 1.25 117 XMHTML_After_End 3074 1.30 2.07 0.96 118 ANY_BOUNCE_MESSAGE 3011 3.70 2.03 4.45 119 BOUNCE_MESSAGE 3011 3.70 2.03 4.45 120 ALL_TRUSTED 2995 10.22 2.02 13.91 121 XM_SendGrid 2937 1.58 1.98 1.40 122 XM_DK_Undo_01 2915 1.96 1.96 1.96 123 FROM_EXCESS_BASE64 2908 1.63 1.96 1.48 124 SUBJ_ALL_CAPS 2888 1.73 1.94 1.64 125 HTML_MIME_NO_HTML_TAG 2866 2.44 1.93 2.67 126 XMBody_17 2809 0.87 1.89 0.41 127 DIET_1 2754 0.80 1.85 0.32 128 XMBrknScrpt_02 2749 1.30 1.85 1.05 129 T_XMHurry_00 2690 0.92 1.81 0.52 130 XMGenDplmaNmb 2640 1.33 1.78 1.13 131 T_REMOTE_IMAGE 2622 3.27 1.77 3.94 132 MAILING_LIST_MULTI 2621 2.64 1.76 3.04 133 SpammyFromTLD_02 2576 0.88 1.73 0.49 134 URI_HEX 2572 1.43 1.73 1.30 135 T_XMDrugObfuBody_00 2471 1.28 1.66 1.10 136 BAYES_20 2430 3.12 1.64 3.79 137 SpammyFromTLD_01 2401 1.02 1.62 0.75 138 XMPhish30 2400 0.98 1.62 0.70 139 XM_B_Phish66 2372 0.74 1.60 0.35 140 DKIM_ADSP_CUSTOM_MED 2366 1.05 1.59 0.80 141 TR_XM_PHPForged 2281 0.70 1.54 0.33 142 RCVD_IN_VALIDITY_SAFE 2276 3.75 1.53 4.74 143 RELAYCOUNTRY_FR 2267 0.68 1.53 0.30 144 TR_XM_FormFill2 2261 0.70 1.52 0.32 145 TR_XM_PHPDW 2244 0.69 1.51 0.33 146 XM_H_PHPMailer 2244 1.01 1.51 0.78 147 TR_LOTS_OF_MONEY3 2228 0.79 1.50 0.47 148 XM_H_PHPOS 2221 0.68 1.50 0.31 149 TR_XM_GMP_BULK_SIG 2208 0.54 1.49 0.11 150 NML_ADSP_CUSTOM_MED 2157 0.78 1.45 0.47 151 RCVD_IN_IADB_LISTED 2143 2.72 1.44 3.29 152 XM_B_DNDMA 2138 0.86 1.44 0.60 153 RCVD_IN_PSBL 2120 0.46 1.43 0.02 154 XM_B_SEO 2062 0.59 1.39 0.22 155 TR_XM_MaxSPIKE 2038 0.46 1.37 0.05 156 TM2_M_OBFU_COMMENT 2008 0.59 1.35 0.25 157 TooManyTo_002 2001 2.09 1.35 2.42 158 HTML_FONT_TINY_NORDNS 1939 0.45 1.31 0.06 159 MPART_ALT_DIFF_COUNT 1922 0.77 1.29 0.53 160 HOSTED_IMG_DIRECT_MX 1920 0.91 1.29 0.74 161 TR_LOTS_OF_MONEY2 1904 0.55 1.28 0.22 162 T_MONEY_PERCENT 1904 0.55 1.28 0.22 163 XM_PDF 1896 3.98 1.28 5.19 164 T_Symld_Words_02 1848 0.88 1.24 0.71 165 TooManyTo_003 1828 1.30 1.23 1.34 166 RDNS_DYNAMIC 1763 0.46 1.19 0.14 167 RCVD_IN_IADB_SPF 1754 2.39 1.18 2.93 168 FORGED_GMAIL_RCVD 1734 0.73 1.17 0.54 169 TR_XM_SEO4 1704 0.45 1.15 0.14 170 XMBody_78 1654 0.64 1.11 0.43 171 XM_ProductURIs 1649 0.65 1.11 0.44 172 XMBdyGiftCard01 1628 0.77 1.10 0.62 173 TR_XM_RelayPhish 1626 0.41 1.09 0.10 174 XM_UB60 1612 0.39 1.09 0.07 175 TR_XM_INTL_Spamhaus 1610 0.46 1.08 0.18 176 TR_XM_DK_SendGrid 1608 1.01 1.08 0.98 177 RCVD_IN_IADB_DK 1588 2.08 1.07 2.54 178 HTTPS_HTTP_MISMATCH 1575 0.87 1.06 0.79 179 RCVD_IN_IADB_SENDERID 1570 2.15 1.06 2.64 180 HTML_TAG_BALANCE_BODY 1568 0.78 1.06 0.65 181 XM_B_COPY_HTML 1560 0.84 1.05 0.74 182 TVD_RCVD_IP 1551 0.91 1.04 0.85 183 RCVD_IN_VALIDITY_CERTIFIED 1534 3.05 1.03 3.96 184 XM_UB99 1503 0.31 1.01 0.00 185 RCVD_IN_PBL 1496 0.66 1.01 0.50 186 URI_TRY_3LD 1496 0.63 1.01 0.46 187 BAYES_00 1480 7.35 1.00 10.21 188 XMNoVowels 1477 0.73 0.99 0.61 189 RCVD_IN_IADB_VOUCHED 1444 1.76 0.97 2.11 190 SHORTCIRCUIT 1438 0.30 0.97 0.00 191 RCVD_IN_ZEN_LASTEXTERNAL 1438 0.30 0.97 0.00 192 TR_MetaPhish_Combo_01 1425 0.86 0.96 0.82 193 PLING_QUERY 1408 0.53 0.95 0.34 194 HTML_IMAGE_ONLY_20 1393 0.65 0.94 0.52 195 TR_Mismatch_TLD_02 1366 0.36 0.92 0.11 196 SHOPIFY_IMG_NOT_RCVD_SFY 1351 0.39 0.91 0.16 197 TR_XM_InvalidRelay 1348 0.29 0.91 0.01 198 XM_B_COVIDMETA 1326 0.42 0.89 0.21 199 TR_Symld_Words 1325 1.37 0.89 1.58 200 BAYES_05 1323 1.83 0.89 2.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 290202 90.29 95.51 87.94 2 RELAYCOUNTRY_US 273999 83.14 83.39 83.03 3 DKIM_SIGNED 257366 81.34 88.77 77.99 4 XM_DK_Pass 253104 78.59 82.79 76.70 5 DKIM_VALID 249755 77.66 82.06 75.68 6 XM_B_Unicode 233317 74.26 82.15 70.70 7 DKIM_VALID_AU 206978 63.35 64.74 62.72 8 DCC_CHECK_NEGATIVE 204141 50.87 26.45 61.86 9 BAYES_50 202015 54.60 39.89 61.22 10 XMListUnsubscribeExists 165600 54.54 64.21 50.18 11 XM_B_SpammyWords 158030 54.35 68.69 47.89 12 XM_B_Unicode3 139079 43.52 46.57 42.15 13 DCC_CHECK 125646 48.77 72.54 38.08 14 LOC_TINY_FONT_1 103192 36.39 47.75 31.27 15 DKIM_VALID_EF 102024 30.50 29.57 30.92 16 T_TM2_M_HEADER_IN_MSG 96820 27.16 22.31 29.34 17 HTML_FONT_LOW_CONTRAST 96305 31.73 37.39 29.18 18 T_SCC_BODY_TEXT_LINE 87005 26.38 26.42 26.37 19 FVGT_m_MULTI_ODD 85886 29.29 36.56 26.03 20 XMSubLong 81741 25.00 25.50 24.77 21 T_KAM_HTML_FONT_INVALID 78994 25.57 29.20 23.94 22 MIME_HTML_ONLY 68661 22.81 27.26 20.81 23 RCVD_IN_MSPIKE_WL 67700 17.73 11.53 20.52 24 XM_B_SpammyWords2 66430 25.63 37.86 20.13 25 RCVD_IN_MSPIKE_H2 56757 18.90 22.67 17.20 26 USER_IN_DEF_DKIM_WL 47665 10.64 2.20 14.44 27 XM_Multi_Part_URI 47298 16.51 21.36 14.33 28 ALL_TRUSTED 45917 10.22 2.02 13.91 29 TR_XM_DK_Unsub 44967 15.93 21.03 13.63 30 UNPARSEABLE_RELAY 39728 14.03 18.46 12.04 31 XM_B_PhoneNumber 36896 9.94 7.18 11.18 32 BAYES_00 33682 7.35 1.00 10.21 33 XM_Evil_Numbers_Gen 32232 9.69 9.51 9.77 34 XM_B_Unsub 31770 13.56 22.30 9.63 35 RCVD_IN_MSPIKE_H3 30401 8.01 5.33 9.21 36 LotsOfNums_01 30394 8.49 6.88 9.21 37 TooManyTo_001 25860 6.66 4.05 7.84 38 TR_XM_BayesUnsub 24061 11.60 21.18 7.29 39 TR_XM_DK_Bayes 23824 5.14 0.50 7.22 40 TR_XM_DK_Bayes1 23520 5.07 0.50 7.13 41 BAYES_60 23300 7.48 8.42 7.06 42 RCVD_IN_MSPIKE_H5 23165 5.85 3.26 7.02 43 LOTS_OF_MONEY 20776 8.11 12.14 6.30 44 XM_DKIMWhitelistDomains 20768 4.38 0.12 6.29 45 TR_MAX_INTL_RELAY 20669 8.94 14.89 6.26 46 TR_XM_DK_Bayes2 19978 4.29 0.39 6.05 47 XMStrtUSub 19687 5.94 5.89 5.97 48 XM_H_Long_From01 19535 5.93 5.97 5.92 49 XM_H_GMP 19226 6.36 7.53 5.83 50 T_TooManySym_01 19137 4.97 3.13 5.80 51 MIME_QP_LONG_LINE 18301 4.83 3.24 5.55 52 BAYES_40 18032 4.44 2.16 5.46 53 FSL_BULK_SIG 17958 7.50 12.06 5.44 54 XM_B_SpammyWords3 17756 7.74 13.00 5.38 55 XM_DK_Undo_02 17327 16.45 41.32 5.25 56 XM_PDF 17143 3.98 1.28 5.19 57 XM_B_Phish_Phrases 17043 6.26 8.70 5.16 58 HTML_IMAGE_RATIO_02 16762 5.53 6.53 5.08 59 MPART_ALT_DIFF 16343 5.66 7.23 4.95 60 RCVD_IN_VALIDITY_SAFE 15655 3.75 1.53 4.74 61 ANY_BOUNCE_MESSAGE 14690 3.70 2.03 4.45 62 BOUNCE_MESSAGE 14687 3.70 2.03 4.45 63 RCVD_IN_MSPIKE_H4 14134 3.87 2.94 4.28 64 HTML_IMAGE_RATIO_04 13750 4.17 4.19 4.17 65 TR_XM_SpammyWords4 13724 6.16 10.62 4.16 66 XM_UncommonTLD01 13121 4.47 5.57 3.98 67 RCVD_IN_VALIDITY_CERTIFIED 13061 3.05 1.03 3.96 68 T_REMOTE_IMAGE 13009 3.27 1.77 3.94 69 BAYES_80 12838 5.52 9.14 3.89 70 BAYES_20 12496 3.12 1.64 3.79 71 BAYES_99 12345 12.05 30.49 3.74 72 XMSubMetaSx_00 12260 4.32 5.68 3.72 73 RELAYCOUNTRY_META 11893 7.33 15.62 3.60 74 HTML_IMAGE_RATIO_06 11873 3.47 3.19 3.60 75 XMNumbers 11152 3.69 4.38 3.38 76 RCVD_IN_IADB_LISTED 10851 2.72 1.44 3.29 77 HTML_IMAGE_RATIO_08 10361 3.07 2.92 3.14 78 BOTNET_IPINHOSTNAME 10164 5.68 11.45 3.08 79 MAILING_LIST_MULTI 10017 2.64 1.76 3.04 80 T_TooManySym_02 9798 2.22 0.55 2.97 81 XM_B_SpammyTLD 9708 3.43 4.52 2.94 82 RCVD_IN_IADB_SPF 9678 2.39 1.18 2.93 83 MIME_HTML_MOSTLY 9379 3.26 4.18 2.84 84 BAYES_999 9360 9.18 23.26 2.84 85 HTML_MIME_NO_HTML_TAG 8822 2.44 1.93 2.67 86 RCVD_IN_IADB_SENDERID 8696 2.15 1.06 2.64 87 XM_Body_Dirty_Words 8643 3.38 5.05 2.62 88 RCVD_IN_IADB_DK 8376 2.08 1.07 2.54 89 MIME_HTML_ONLY_MULTI 8003 2.45 2.50 2.43 90 TooManyTo_002 8001 2.09 1.35 2.42 91 BAYES_95 7827 3.31 5.40 2.37 92 DKIM_INVALID 7611 3.67 6.71 2.31 93 KHOP_HELO_FCRDNS 7511 2.53 3.09 2.28 94 BAYES_05 7456 1.83 0.89 2.26 95 INVALID_MSGID 7181 1.60 0.31 2.18 96 RCVD_IN_IADB_VOUCHED 6979 1.76 0.97 2.11 97 TR_XM_DKIM_Undo 6873 10.25 28.39 2.08 98 XM_CamelCaseFrm001 6804 2.38 3.09 2.06 99 TO_MALFORMED 6750 1.41 0.01 2.05 100 XM_B_URI_Unicode 6663 2.23 2.68 2.02 101 TM2_M_URI_OPT_OUT 6554 2.07 2.27 1.99 102 XM_DK_Undo_01 6470 1.96 1.96 1.96 103 TR_XM_SpammyRelay 6222 4.82 11.35 1.89 104 XMDiploma_00 6209 2.30 3.24 1.88 105 TR_XM_PhishingBody 6177 2.85 5.01 1.87 106 TM2_M_VERY_LONG_WORD 5847 2.38 3.72 1.77 107 TR_XM_UnparsRelay 5651 4.33 10.14 1.71 108 SUBJ_ALL_CAPS 5399 1.73 1.94 1.64 109 T_XMDrugObfuBody_08 5287 2.33 3.94 1.60 110 XM_B_Investor 5241 2.67 5.07 1.59 111 XMSexyCombo_05 5225 2.18 3.49 1.58 112 TR_Symld_Words 5218 1.37 0.89 1.58 113 T_XMDrugObfuBody_14 4930 2.51 4.78 1.49 114 RCVD_IN_IADB_OPTIN 4920 1.23 0.66 1.49 115 FROM_EXCESS_BASE64 4878 1.63 1.96 1.48 116 XM_GoogleGroups 4778 1.25 0.81 1.45 117 XM_B_Unsub2 4739 1.88 2.85 1.44 118 UNTRUSTED_Relay 4675 2.99 6.47 1.42 119 XM_SendGrid 4632 1.58 1.98 1.40 120 IN_HORDE_ADDRESS_BOOK 4423 0.95 0.08 1.34 121 TooManyTo_003 4409 1.30 1.23 1.34 122 TR_XM_SpammyWords5 4351 2.24 4.29 1.32 123 HELO_NODOT 4315 1.00 0.32 1.31 124 HELO_NO_DOMAIN 4310 0.99 0.30 1.31 125 TR_DCC_Bayes_99 4297 7.61 21.61 1.30 126 URI_HEX 4293 1.43 1.73 1.30 127 XMGappySubj_01 4232 0.93 0.15 1.28 128 XM_SPF_SoftFail 4168 1.87 3.22 1.26 129 T_TooManySym_03 4159 0.92 0.16 1.26 130 T_OBFU_PDF_ATTACH 4132 1.08 0.69 1.25 131 XMStockSpam_06 4111 1.51 2.10 1.25 132 MSGID_NOFQDN1 3953 0.83 0.01 1.20 133 RCVD_IN_MSPIKE_BL 3900 2.85 6.55 1.18 134 TR_XM_MSPIKECOMBO 3896 2.84 6.54 1.18 135 URI_NOVOWEL 3873 1.46 2.11 1.17 136 XMGenDplmaNmb 3720 1.33 1.78 1.13 137 BOTNET 3671 4.64 12.46 1.11 138 T_XMDrugObfuBody_00 3645 1.28 1.66 1.10 139 XMBrknScrpt_02 3450 1.30 1.85 1.05 140 XMCapTrack 3415 0.88 0.52 1.03 141 RCVD_IN_MSPIKE_L3 3318 1.76 3.45 1.01 142 TooManyTo_004 3237 0.83 0.48 0.98 143 TR_XM_DK_SendGrid 3236 1.01 1.08 0.98 144 XM_H_Long_From02 3175 1.38 2.31 0.96 145 XMHTML_After_End 3168 1.30 2.07 0.96 146 XM_UB50 3166 1.52 2.76 0.96 147 T_FILL_THIS_FORM_SHORT 3112 1.36 2.30 0.94 148 FROM_GOV_DKIM_AU 3070 0.71 0.22 0.93 149 TVD_SPACE_RATIO 2987 0.69 0.20 0.91 150 XM_OfRef6 2951 1.47 2.76 0.89 151 TVD_RCVD_IP 2797 0.91 1.04 0.85 152 XM_ShortIntro_01 2781 0.72 0.44 0.84 153 RCVD_IN_BL_SPAMCOP_NET 2732 4.89 13.91 0.83 154 TR_MetaPhish_Combo_01 2704 0.86 0.96 0.82 155 TooManyTo_005 2670 0.69 0.43 0.81 156 DKIM_ADSP_CUSTOM_MED 2656 1.05 1.59 0.80 157 HTTPS_HTTP_MISMATCH 2610 0.87 1.06 0.79 158 XM_H_PHPMailer 2575 1.01 1.51 0.78 159 RELAYCOUNTRY_GB 2496 0.77 0.80 0.76 160 SpammyFromTLD_01 2462 1.02 1.62 0.75 161 XM_B_COPY_HTML 2441 0.84 1.05 0.74 162 HOSTED_IMG_DIRECT_MX 2433 0.91 1.29 0.74 163 TRACKER_ID 2424 0.56 0.16 0.73 164 T_Symld_Words_02 2347 0.88 1.24 0.71 165 XMPhish30 2308 0.98 1.62 0.70 166 RELAYCOUNTRY_AU 2248 1.31 2.69 0.68 167 RELAYCOUNTRY_CA 2201 2.18 5.53 0.67 168 HTML_TAG_BALANCE_BODY 2152 0.78 1.06 0.65 169 XMGappySubj_02 2123 0.45 0.03 0.64 170 XMBdyGiftCard01 2034 0.77 1.10 0.62 171 XMBSHREFv2 2027 0.53 0.36 0.61 172 XMNoVowels 2019 0.73 0.99 0.61 173 XM_B_DNDMA 1967 0.86 1.44 0.60 174 XM_B_SpammyWords4 1881 1.11 2.30 0.57 175 T_TVD_MIME_NO_HEADERS 1842 0.40 0.04 0.56 176 FORGED_GMAIL_RCVD 1779 0.73 1.17 0.54 177 TO_NO_BRKTS_HTML_ONLY 1757 0.40 0.09 0.53 178 MSGID_FROM_MTA_HEADER 1744 0.48 0.37 0.53 179 MPART_ALT_DIFF_COUNT 1740 0.77 1.29 0.53 180 T_XMHurry_00 1729 0.92 1.81 0.52 181 TR_XM_SpammyWords3 1724 1.81 4.68 0.52 182 HTML_IMAGE_ONLY_20 1708 0.65 0.94 0.52 183 XMSlimDrugH 1680 0.53 0.58 0.51 184 RCVD_IN_PBL 1655 0.66 1.01 0.50 185 SpammyFromTLD_02 1621 0.88 1.73 0.49 186 XMSubMetaI_00 1607 0.60 0.84 0.49 187 T_TooManySym_04 1565 0.34 0.05 0.47 188 HTML_IMAGE_ONLY_32 1563 0.38 0.17 0.47 189 NML_ADSP_CUSTOM_MED 1562 0.78 1.45 0.47 190 TR_XM_Base64_M1 1553 0.53 0.67 0.47 191 XMMoneyMeta_00 1541 0.53 0.67 0.47 192 TR_LOTS_OF_MONEY3 1540 0.79 1.50 0.47 193 XM_Ancestry_Forge 1540 0.32 0.01 0.47 194 XM_B_FormFill 1535 0.33 0.03 0.47 195 URI_TRY_3LD 1509 0.63 1.01 0.46 196 XMDateMe_00 1501 0.46 0.46 0.45 197 LongTLD 1488 0.53 0.71 0.45 198 XM_ProductURIs 1451 0.65 1.11 0.44 199 XMPhish14 1441 0.53 0.73 0.44 200 XMLngstWrd_00 1420 0.41 0.37 0.43 ----------------------------------------------------------------------