Email: 431835 Autolearn: 0 AvgScore: 4.91 AvgScanTime: 1.30 sec Spam: 139399 Autolearn: 0 AvgScore: 13.30 AvgScanTime: 1.51 sec Ham: 292436 Autolearn: 0 AvgScore: 0.92 AvgScanTime: 1.21 sec Time Spent Running SA: 156.49 hours Time Spent Processing Spam: 58.43 hours Time Spent Processing Ham: 98.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 139090 99.51 99.78 99.38 2 HTML_MESSAGE 135003 90.19 96.85 87.01 3 DKIM_SIGNED 127605 81.96 91.54 77.39 4 XM_DK_Pass 121001 79.61 86.80 76.18 5 XM_B_Unicode 120105 76.37 86.16 71.71 6 DKIM_VALID 120099 78.76 86.15 75.23 7 RELAYCOUNTRY_US 116843 83.00 83.82 82.61 8 DCC_CHECK 103359 48.52 74.15 36.30 9 XM_B_SpammyWords 97797 53.81 70.16 46.01 10 DKIM_VALID_AU 94969 64.09 68.13 62.16 11 XMListUnsubscribeExists 93931 55.47 67.38 49.79 12 LOC_TINY_FONT_1 71442 37.25 51.25 30.58 13 XM_B_Unicode3 70004 45.60 50.22 43.40 14 XM_DK_Undo_02 60879 18.20 43.67 6.05 15 BAYES_50 56514 54.83 40.54 61.64 16 XM_B_SpammyWords2 55306 27.11 39.67 21.12 17 HTML_FONT_LOW_CONTRAST 54575 31.41 39.15 27.72 18 FVGT_m_MULTI_ODD 50634 30.11 36.32 27.14 19 BAYES_99 45302 13.40 32.50 4.30 20 DKIM_VALID_EF 44048 31.73 31.60 31.79 21 TR_XM_DKIM_Undo 42756 11.49 30.67 2.34 22 T_KAM_HTML_FONT_INVALID 41133 24.69 29.51 22.39 23 MIME_HTML_ONLY 38399 22.77 27.55 20.49 24 DCC_CHECK_NEGATIVE 35974 51.42 25.81 63.63 25 BAYES_999 34949 10.31 25.07 3.27 26 XMSubLong 33425 23.31 23.98 22.99 27 XM_Multi_Part_URI 31518 17.48 22.61 15.04 28 TR_DCC_Bayes_99 31425 8.23 22.54 1.40 29 RCVD_IN_MSPIKE_H2 31311 18.57 22.46 16.72 30 TR_XM_DK_Unsub 31171 16.89 22.36 14.28 31 T_TM2_M_HEADER_IN_MSG 30034 27.12 21.55 29.78 32 XM_B_Unsub 29413 13.14 21.10 9.35 33 TR_XM_BayesUnsub 28494 11.46 20.44 7.18 34 UNPARSEABLE_RELAY 27686 14.87 19.86 12.50 35 RELAYCOUNTRY_META 21638 7.35 15.52 3.45 36 TR_MAX_INTL_RELAY 20798 9.22 14.92 6.50 37 RCVD_IN_BL_SPAMCOP_NET 19704 5.01 14.13 0.66 38 LOTS_OF_MONEY 18877 8.30 13.54 5.80 39 XM_B_SpammyWords3 18544 8.19 13.30 5.75 40 RCVD_IN_MSPIKE_WL 16653 18.42 11.95 21.51 41 TR_XM_SpammyWords4 16392 6.28 11.76 3.67 42 TR_XM_SpammyRelay 16239 5.03 11.65 1.88 43 TR_XM_UnparsRelay 15431 4.73 11.07 1.70 44 BOTNET_IPINHOSTNAME 15244 5.94 10.94 3.56 45 BOTNET 14996 4.47 10.76 1.47 46 TR_XM_SpammyWords2 14821 3.84 10.63 0.61 47 XM_Evil_Numbers_Gen 14404 9.75 10.33 9.47 48 FSL_BULK_SIG 13978 6.53 10.03 4.86 49 XM_B_Phish_Phrases 13307 6.91 9.55 5.65 50 BAYES_80 12740 5.62 9.14 3.94 51 TR_XM_SPAMCOP 11554 2.84 8.29 0.24 52 BAYES_60 11155 7.40 8.00 7.12 53 XMSubMetaSx_00 11014 5.01 7.90 3.63 54 RCVD_IN_MSPIKE_BL 10392 3.16 7.45 1.12 55 TR_XM_MSPIKECOMBO 10367 3.14 7.44 1.09 56 MPART_ALT_DIFF 10282 5.49 7.38 4.58 57 UNTRUSTED_Relay 10132 3.36 7.27 1.50 58 LotsOfNums_01 9336 8.48 6.70 9.34 59 HTML_IMAGE_RATIO_02 9226 5.59 6.62 5.10 60 XM_H_GMP 8977 5.89 6.44 5.63 61 XM_Body_Dirty_Words 8805 3.35 6.32 1.93 62 XM_H_Long_From01 8653 6.00 6.21 5.90 63 XM_B_PhoneNumber 8410 8.73 6.03 10.02 64 XM_B_Investor 7735 2.83 5.55 1.53 65 XM_UncommonTLD01 7553 4.57 5.42 4.16 66 BAYES_95 7523 3.47 5.40 2.56 67 DKIM_INVALID 7506 3.20 5.38 2.16 68 RELAYCOUNTRY_CA 7390 2.16 5.30 0.66 69 MIME_HTML_MOSTLY 7369 3.38 5.29 2.48 70 RCVD_IN_MSPIKE_H3 7285 7.96 5.23 9.26 71 HTML_IMAGE_RATIO_04 7273 5.02 5.22 4.93 72 TR_XM_SpammyWords3 6993 1.98 5.02 0.53 73 T_XMDrugObfuBody_14 6664 2.67 4.78 1.66 74 TR_XM_PhishingBody 6508 2.88 4.67 2.03 75 XM_B_SpammyTLD 6496 3.78 4.66 3.36 76 XMStrtUSub 6453 5.08 4.63 5.29 77 TR_XM_SpammyWords5 6002 2.36 4.31 1.44 78 XM_CamelCaseFrm001 5943 2.79 4.26 2.09 79 RCVD_IN_MSPIKE_L3 5660 1.94 4.06 0.92 80 XMSexyCombo_05 5321 1.93 3.82 1.03 81 TM2_M_VERY_LONG_WORD 5230 2.88 3.75 2.46 82 T_XMDrugObfuBody_08 5185 2.59 3.72 2.05 83 XMNumbers 5111 3.50 3.67 3.42 84 USER_IN_DEF_DKIM_WL 5097 10.76 3.66 14.15 85 XM_B_Unsub2 5068 2.48 3.64 1.93 86 RCVD_IN_MSPIKE_H5 4991 6.43 3.58 7.79 87 XMStockSpam_06 4878 1.79 3.50 0.98 88 XMDiploma_00 4589 2.39 3.29 1.97 89 XM_UB50 4552 1.74 3.27 1.01 90 RCVD_IN_MSPIKE_H4 4377 4.03 3.14 4.46 91 SUBJ_ALL_CAPS 4326 2.06 3.10 1.56 92 XM_OfRef6 4319 1.59 3.10 0.88 93 XM_SPF_SoftFail 4288 1.82 3.08 1.23 94 TooManyTo_001 4220 6.01 3.03 7.43 95 RELAYCOUNTRY_AU 4097 1.45 2.94 0.74 96 TR_XM_NoHeaderRelay 4014 1.05 2.88 0.18 97 HTML_IMAGE_RATIO_08 3913 2.60 2.81 2.50 98 MIME_HTML_ONLY_MULTI 3900 2.70 2.80 2.66 99 MIME_QP_LONG_LINE 3783 4.56 2.71 5.44 100 TM2_M_URI_OPT_OUT 3749 2.20 2.69 1.97 101 XM_ProductURIs 3703 1.38 2.66 0.77 102 T_XMHurry_00 3608 1.44 2.59 0.90 103 TR_XM_MSPIKECOMBO2 3602 0.92 2.58 0.12 104 T_TooManySym_01 3578 4.86 2.57 5.95 105 TR_XM_INV_DKIM 3496 0.82 2.51 0.01 106 HTML_IMAGE_RATIO_06 3482 2.84 2.50 3.00 107 XM_URI_RBL 3313 1.02 2.38 0.37 108 XMBdyGiftCard01 3284 1.35 2.36 0.86 109 RCVD_IN_VALIDITY_RPBL 3279 0.77 2.35 0.02 110 MAILING_LIST_MULTI 3079 2.88 2.21 3.20 111 T_XMDrugObfuBody_00 3053 1.51 2.19 1.19 112 T_FILL_THIS_FORM_SHORT 3018 1.32 2.17 0.91 113 XM_B_URI_Unicode 2923 1.82 2.10 1.69 114 KHOP_HELO_FCRDNS 2878 2.21 2.06 2.28 115 XM_B_SpammyWords4 2871 1.29 2.06 0.92 116 RCVD_IN_PSBL 2863 0.68 2.05 0.02 117 RCVD_IN_VALIDITY_SAFE 2848 3.53 2.04 4.24 118 FROM_EXCESS_BASE64 2812 1.73 2.02 1.59 119 XM_DK_Undo_01 2758 1.94 1.98 1.92 120 XM_H_Long_From02 2735 1.23 1.96 0.88 121 XMBody_17 2709 0.93 1.94 0.44 122 BAYES_40 2703 4.21 1.94 5.29 123 XMPhish30 2667 1.01 1.91 0.59 124 RELAYCOUNTRY_FR 2583 0.78 1.85 0.27 125 XMGenDplmaNmb 2581 1.30 1.85 1.03 126 XM_B_DNDMA 2476 0.79 1.78 0.33 127 TR_LOTS_OF_MONEY3 2460 0.88 1.76 0.45 128 TR_XM_MaxSPIKE 2459 0.63 1.76 0.08 129 XMBrknScrpt_02 2447 1.61 1.76 1.54 130 URI_TRY_3LD 2423 0.96 1.74 0.58 131 SpammyFromTLD_02 2408 1.00 1.73 0.65 132 RCVD_IN_MSPIKE_L4 2407 0.66 1.73 0.15 133 RCVD_IN_IADB_LISTED 2407 2.92 1.73 3.49 134 RCVD_IN_MSPIKE_L5 2300 0.54 1.65 0.02 135 SpammyFromTLD_01 2299 1.04 1.65 0.75 136 URI_HEX 2266 1.34 1.63 1.21 137 XM_SendGrid 2255 1.56 1.62 1.54 138 XM_B_SEO 2208 0.66 1.58 0.22 139 T_REMOTE_IMAGE 2201 3.19 1.58 3.96 140 BOTNET_NORDNS 2146 0.50 1.54 0.01 141 LOW_PRICE 2119 0.62 1.52 0.19 142 HTML_MIME_NO_HTML_TAG 2020 2.15 1.45 2.48 143 DKIM_ADSP_NXDOMAIN 1968 0.67 1.41 0.32 144 RCVD_IN_IADB_SPF 1959 2.58 1.41 3.15 145 RCVD_IN_VALIDITY_CERTIFIED 1925 2.85 1.38 3.55 146 URI_NOVOWEL 1921 1.25 1.38 1.19 147 XM_UB99 1898 0.44 1.36 0.00 148 TR_XM_GMP_BULK_SIG 1887 0.50 1.35 0.10 149 XMBody_78 1840 0.62 1.32 0.28 150 BAYES_20 1822 2.86 1.31 3.60 151 TR_XM_SEO4 1808 0.49 1.30 0.10 152 DKIM_ADSP_CUSTOM_MED 1801 0.95 1.29 0.78 153 RCVD_IN_IADB_DK 1788 2.28 1.28 2.75 154 RCVD_IN_IADB_SENDERID 1755 2.34 1.26 2.85 155 XMClaimOffer 1754 0.49 1.26 0.13 156 ALL_TRUSTED 1745 10.10 1.25 14.31 157 XMSexyCombo_01 1734 0.47 1.24 0.10 158 TM2_M_OBFU_COMMENT 1701 0.68 1.22 0.42 159 RDNS_DYNAMIC 1679 0.50 1.20 0.17 160 XM_B_COPY_HTML 1677 0.86 1.20 0.69 161 NML_ADSP_CUSTOM_MED 1610 0.68 1.15 0.46 162 TR_XM_InvalidRelay 1606 0.38 1.15 0.02 163 GOOG_STO_NOIMG_HTML 1593 0.39 1.14 0.03 164 XM_UB60 1586 0.42 1.14 0.07 165 MPART_ALT_DIFF_COUNT 1563 0.70 1.12 0.50 166 TR_Caps_n_Bayes_99 1561 0.39 1.12 0.04 167 XM_B_Phish66 1547 0.85 1.11 0.72 168 RCVD_IN_IADB_VOUCHED 1519 1.82 1.09 2.16 169 HK_RANDOM_REPLYTO 1477 0.40 1.06 0.09 170 T_Symld_Words_02 1461 0.73 1.05 0.58 171 XM_DIRTYINTL 1459 0.37 1.05 0.05 172 HTTPS_HTTP_MISMATCH 1441 0.80 1.03 0.68 173 ANY_BOUNCE_MESSAGE 1416 3.69 1.02 4.96 174 BOUNCE_MESSAGE 1415 3.69 1.02 4.96 175 T_MONEY_PERCENT 1411 0.51 1.01 0.27 176 TR_LOTS_OF_MONEY2 1411 0.51 1.01 0.27 177 TVD_RCVD_IP 1365 0.94 0.98 0.92 178 TR_MetaPhish_Combo_01 1361 0.92 0.98 0.89 179 XM_UB999 1356 0.31 0.97 0.00 180 SHOPIFY_IMG_NOT_RCVD_SFY 1354 0.46 0.97 0.22 181 DIET_1 1342 0.55 0.96 0.36 182 TR_XM_DK_SendGrid 1341 1.06 0.96 1.11 183 XMSubMetaSxObfu_03 1322 0.86 0.95 0.82 184 HDRS_MISSP 1317 0.32 0.94 0.02 185 THIS_AD 1264 0.47 0.91 0.26 186 HELO_DYNAMIC_SPLIT_IP 1261 0.29 0.90 0.00 187 TM2_M_A_HREF_HREF 1259 0.51 0.90 0.33 188 TR_XM_PHPForged 1253 0.46 0.90 0.25 189 TR_XM_RelayPhish 1249 0.34 0.90 0.08 190 TR_XM_FormFill2 1239 0.46 0.89 0.25 191 TR_XM_PHPDW 1228 0.45 0.88 0.25 192 XMHTML_After_End 1227 0.56 0.88 0.41 193 HTML_IMAGE_ONLY_20 1221 0.67 0.88 0.57 194 MultiRelay_CC 1214 0.37 0.87 0.13 195 TR_XM_Base64_M1 1210 0.69 0.87 0.60 196 XM_H_PHPOS 1208 0.44 0.87 0.24 197 FORGED_GMAIL_RCVD 1208 0.63 0.87 0.52 198 TR_Symld_Words 1207 1.31 0.87 1.52 199 XM_GoogleGroups 1200 1.10 0.86 1.22 200 XM_UB80 1149 0.28 0.82 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 290625 99.51 99.78 99.38 2 HTML_MESSAGE 254459 90.19 96.85 87.01 3 RELAYCOUNTRY_US 241575 83.00 83.82 82.61 4 DKIM_SIGNED 226312 81.96 91.54 77.39 5 XM_DK_Pass 222781 79.61 86.80 76.18 6 DKIM_VALID 219999 78.76 86.15 75.23 7 XM_B_Unicode 209693 76.37 86.16 71.71 8 DCC_CHECK_NEGATIVE 186076 51.42 25.81 63.63 9 DKIM_VALID_AU 181783 64.09 68.13 62.16 10 BAYES_50 180268 54.83 40.54 61.64 11 XMListUnsubscribeExists 145601 55.47 67.38 49.79 12 XM_B_SpammyWords 134554 53.81 70.16 46.01 13 XM_B_Unicode3 126922 45.60 50.22 43.40 14 DCC_CHECK 106159 48.52 74.15 36.30 15 DKIM_VALID_EF 92969 31.73 31.60 31.79 16 LOC_TINY_FONT_1 89425 37.25 51.25 30.58 17 T_TM2_M_HEADER_IN_MSG 87083 27.12 21.55 29.78 18 HTML_FONT_LOW_CONTRAST 81074 31.41 39.15 27.72 19 FVGT_m_MULTI_ODD 79372 30.11 36.32 27.14 20 XMSubLong 67227 23.31 23.98 22.99 21 T_KAM_HTML_FONT_INVALID 65477 24.69 29.51 22.39 22 RCVD_IN_MSPIKE_WL 62891 18.42 11.95 21.51 23 XM_B_SpammyWords2 61755 27.11 39.67 21.12 24 MIME_HTML_ONLY 59923 22.77 27.55 20.49 25 RCVD_IN_MSPIKE_H2 48884 18.57 22.46 16.72 26 XM_Multi_Part_URI 43982 17.48 22.61 15.04 27 ALL_TRUSTED 41856 10.10 1.25 14.31 28 TR_XM_DK_Unsub 41768 16.89 22.36 14.28 29 USER_IN_DEF_DKIM_WL 41380 10.76 3.66 14.15 30 UNPARSEABLE_RELAY 36548 14.87 19.86 12.50 31 XM_B_PhoneNumber 29289 8.73 6.03 10.02 32 XM_Evil_Numbers_Gen 27697 9.75 10.33 9.47 33 BAYES_00 27658 6.58 0.54 9.46 34 XM_B_Unsub 27345 13.14 21.10 9.35 35 LotsOfNums_01 27304 8.48 6.70 9.34 36 RCVD_IN_MSPIKE_H3 27078 7.96 5.23 9.26 37 RCVD_IN_MSPIKE_H5 22783 6.43 3.58 7.79 38 TooManyTo_001 21715 6.01 3.03 7.43 39 XM_DKIMWhitelistDomains 21468 4.98 0.04 7.34 40 TR_XM_BayesUnsub 21010 11.46 20.44 7.18 41 BAYES_60 20818 7.40 8.00 7.12 42 TR_XM_DK_Bayes 19807 4.71 0.38 6.77 43 TR_XM_DK_Bayes1 19540 4.65 0.37 6.68 44 TR_MAX_INTL_RELAY 19009 9.22 14.92 6.50 45 XM_DK_Undo_02 17699 18.20 43.67 6.05 46 T_TooManySym_01 17389 4.86 2.57 5.95 47 XM_H_Long_From01 17264 6.00 6.21 5.90 48 LOTS_OF_MONEY 16974 8.30 13.54 5.80 49 XM_B_SpammyWords3 16807 8.19 13.30 5.75 50 TR_XM_DK_Bayes2 16578 3.93 0.27 5.67 51 XM_B_Phish_Phrases 16523 6.91 9.55 5.65 52 XM_H_GMP 16473 5.89 6.44 5.63 53 MIME_QP_LONG_LINE 15916 4.56 2.71 5.44 54 XMStrtUSub 15479 5.08 4.63 5.29 55 BAYES_40 15471 4.21 1.94 5.29 56 HTML_IMAGE_RATIO_02 14907 5.59 6.62 5.10 57 ANY_BOUNCE_MESSAGE 14502 3.69 1.02 4.96 58 BOUNCE_MESSAGE 14499 3.69 1.02 4.96 59 HTML_IMAGE_RATIO_04 14417 5.02 5.22 4.93 60 FSL_BULK_SIG 14224 6.53 10.03 4.86 61 XM_PDF 14119 3.52 0.77 4.83 62 MPART_ALT_DIFF 13406 5.49 7.38 4.58 63 RCVD_IN_MSPIKE_H4 13030 4.03 3.14 4.46 64 BAYES_99 12574 13.40 32.50 4.30 65 RCVD_IN_VALIDITY_SAFE 12401 3.53 2.04 4.24 66 XM_UncommonTLD01 12167 4.57 5.42 4.16 67 T_REMOTE_IMAGE 11566 3.19 1.58 3.96 68 BAYES_80 11524 5.62 9.14 3.94 69 TR_XM_SpammyWords4 10736 6.28 11.76 3.67 70 XMSubMetaSx_00 10626 5.01 7.90 3.63 71 BAYES_20 10519 2.86 1.31 3.60 72 BOTNET_IPINHOSTNAME 10411 5.94 10.94 3.56 73 RCVD_IN_VALIDITY_CERTIFIED 10395 2.85 1.38 3.55 74 RCVD_IN_IADB_LISTED 10209 2.92 1.73 3.49 75 RELAYCOUNTRY_META 10088 7.35 15.52 3.45 76 XMNumbers 9992 3.50 3.67 3.42 77 XM_B_SpammyTLD 9832 3.78 4.66 3.36 78 BAYES_999 9576 10.31 25.07 3.27 79 MAILING_LIST_MULTI 9362 2.88 2.21 3.20 80 T_TooManySym_02 9294 2.38 0.70 3.18 81 RCVD_IN_IADB_SPF 9200 2.58 1.41 3.15 82 HTML_IMAGE_RATIO_06 8780 2.84 2.50 3.00 83 RCVD_IN_IADB_SENDERID 8337 2.34 1.26 2.85 84 RCVD_IN_IADB_DK 8053 2.28 1.28 2.75 85 MIME_HTML_ONLY_MULTI 7765 2.70 2.80 2.66 86 BAYES_95 7478 3.47 5.40 2.56 87 HTML_IMAGE_RATIO_08 7316 2.60 2.81 2.50 88 HTML_MIME_NO_HTML_TAG 7264 2.15 1.45 2.48 89 MIME_HTML_MOSTLY 7247 3.38 5.29 2.48 90 TM2_M_VERY_LONG_WORD 7197 2.88 3.75 2.46 91 INVALID_MSGID 7152 1.77 0.35 2.45 92 TR_XM_DKIM_Undo 6856 11.49 30.67 2.34 93 TO_MALFORMED 6720 1.56 0.01 2.30 94 TooManyTo_002 6670 1.73 0.59 2.28 95 KHOP_HELO_FCRDNS 6657 2.21 2.06 2.28 96 RCVD_IN_IADB_VOUCHED 6324 1.82 1.09 2.16 97 DKIM_INVALID 6313 3.20 5.38 2.16 98 BAYES_05 6124 1.62 0.64 2.09 99 XM_CamelCaseFrm001 6113 2.79 4.26 2.09 100 T_XMDrugObfuBody_08 6006 2.59 3.72 2.05 101 TR_XM_PhishingBody 5926 2.88 4.67 2.03 102 TM2_M_URI_OPT_OUT 5758 2.20 2.69 1.97 103 XMDiploma_00 5753 2.39 3.29 1.97 104 XM_Body_Dirty_Words 5657 3.35 6.32 1.93 105 XM_B_Unsub2 5653 2.48 3.64 1.93 106 XM_DK_Undo_01 5619 1.94 1.98 1.92 107 TR_XM_SpammyRelay 5498 5.03 11.65 1.88 108 TR_XM_UnparsRelay 4977 4.73 11.07 1.70 109 XM_B_URI_Unicode 4939 1.82 2.10 1.69 110 T_XMDrugObfuBody_14 4854 2.67 4.78 1.66 111 RCVD_IN_IADB_OPTIN 4714 1.33 0.73 1.61 112 FROM_EXCESS_BASE64 4643 1.73 2.02 1.59 113 SUBJ_ALL_CAPS 4559 2.06 3.10 1.56 114 HELO_NODOT 4536 1.14 0.28 1.55 115 HELO_NO_DOMAIN 4523 1.13 0.26 1.55 116 XMBrknScrpt_02 4505 1.61 1.76 1.54 117 XM_SendGrid 4495 1.56 1.62 1.54 118 XM_B_Investor 4475 2.83 5.55 1.53 119 TR_Symld_Words 4431 1.31 0.87 1.52 120 XMGappySubj_01 4397 1.06 0.14 1.50 121 TooManyTo_003 4392 1.18 0.49 1.50 122 UNTRUSTED_Relay 4388 3.36 7.27 1.50 123 BOTNET 4304 4.47 10.76 1.47 124 IN_HORDE_ADDRESS_BOOK 4218 0.99 0.05 1.44 125 TR_XM_SpammyWords5 4207 2.36 4.31 1.44 126 TR_DCC_Bayes_99 4094 8.23 22.54 1.40 127 T_TooManySym_03 3742 0.93 0.20 1.28 128 XM_SPF_SoftFail 3583 1.82 3.08 1.23 129 FROM_GOV_DKIM_AU 3558 0.98 0.48 1.22 130 XM_GoogleGroups 3556 1.10 0.86 1.22 131 URI_HEX 3536 1.34 1.63 1.21 132 URI_NOVOWEL 3491 1.25 1.38 1.19 133 T_XMDrugObfuBody_00 3466 1.51 2.19 1.19 134 RCVD_IN_MSPIKE_BL 3275 3.16 7.45 1.12 135 TooManyTo_004 3272 0.88 0.38 1.12 136 TR_XM_DK_SendGrid 3242 1.06 0.96 1.11 137 TR_XM_MSPIKECOMBO 3182 3.14 7.44 1.09 138 TVD_SPACE_RATIO 3073 0.78 0.22 1.05 139 XMSexyCombo_05 3017 1.93 3.82 1.03 140 XMGenDplmaNmb 3013 1.30 1.85 1.03 141 XM_UB50 2945 1.74 3.27 1.01 142 XMStockSpam_06 2857 1.79 3.50 0.98 143 MAY_BE_FORGED 2775 0.73 0.28 0.95 144 T_OBFU_PDF_ATTACH 2751 0.69 0.16 0.94 145 XMCapTrack 2738 0.78 0.45 0.94 146 XM_ShortIntro_01 2719 0.79 0.49 0.93 147 RCVD_IN_MSPIKE_L3 2704 1.94 4.06 0.92 148 TVD_RCVD_IP 2690 0.94 0.98 0.92 149 XM_B_SpammyWords4 2689 1.29 2.06 0.92 150 T_FILL_THIS_FORM_SHORT 2663 1.32 2.17 0.91 151 T_XMHurry_00 2629 1.44 2.59 0.90 152 TR_MetaPhish_Combo_01 2599 0.92 0.98 0.89 153 TooManyTo_005 2591 0.71 0.33 0.89 154 XM_H_Long_From02 2577 1.23 1.96 0.88 155 XM_OfRef6 2564 1.59 3.10 0.88 156 XMBdyGiftCard01 2527 1.35 2.36 0.86 157 T_TVD_MIME_NO_HEADERS 2515 0.59 0.03 0.86 158 XMSubMetaSxObfu_03 2389 0.86 0.95 0.82 159 XM_H_PHPMailer 2364 0.76 0.65 0.81 160 DKIM_ADSP_CUSTOM_MED 2286 0.95 1.29 0.78 161 XM_ProductURIs 2265 1.38 2.66 0.77 162 SpammyFromTLD_01 2202 1.04 1.65 0.75 163 XMBSHREFv2 2195 0.62 0.34 0.75 164 RELAYCOUNTRY_AU 2154 1.45 2.94 0.74 165 XM_B_Phish66 2116 0.85 1.11 0.72 166 XM_B_COPY_HTML 2031 0.86 1.20 0.69 167 HTTPS_HTTP_MISMATCH 1994 0.80 1.03 0.68 168 XMGappySubj_02 1959 0.47 0.04 0.67 169 RCVD_IN_BL_SPAMCOP_NET 1920 5.01 14.13 0.66 170 RELAYCOUNTRY_CA 1918 2.16 5.30 0.66 171 SpammyFromTLD_02 1902 1.00 1.73 0.65 172 TRACKER_ID 1784 0.52 0.34 0.61 173 TR_XM_SpammyWords2 1776 3.84 10.63 0.61 174 TR_XM_Base64_M1 1762 0.69 0.87 0.60 175 XMNoVowels 1728 0.53 0.41 0.59 176 XMPhish30 1711 1.01 1.91 0.59 177 T_Symld_Words_02 1710 0.73 1.05 0.58 178 URI_TRY_3LD 1708 0.96 1.74 0.58 179 HTML_IMAGE_ONLY_20 1663 0.67 0.88 0.57 180 RELAYCOUNTRY_GB 1626 0.58 0.62 0.56 181 TVD_PH_BODY_ACCOUNTS_PRE 1609 0.60 0.71 0.55 182 TO_NO_BRKTS_HTML_ONLY 1577 0.40 0.10 0.54 183 TR_XM_SpammyWords3 1544 1.98 5.02 0.53 184 HOSTED_IMG_DIRECT_MX 1526 0.41 0.18 0.52 185 FORGED_GMAIL_RCVD 1508 0.63 0.87 0.52 186 XMLngstWrd_00 1475 0.48 0.44 0.50 187 XMSlimDrugH 1469 0.53 0.59 0.50 188 MPART_ALT_DIFF_COUNT 1456 0.70 1.12 0.50 189 PLING_QUERY 1435 0.59 0.81 0.49 190 XMMoneyMeta_00 1409 0.49 0.52 0.48 191 XMSolicitRefs_0 1390 0.47 0.46 0.48 192 HTML_IMAGE_ONLY_32 1382 0.43 0.35 0.47 193 MSGID_FROM_MTA_HEADER 1375 0.41 0.29 0.47 194 HTML_FONT_FACE_BAD 1366 0.48 0.52 0.47 195 LongTLD 1359 0.49 0.53 0.46 196 NML_ADSP_CUSTOM_MED 1335 0.68 1.15 0.46 197 XMSubMetaSSx_00 1333 0.46 0.48 0.46 198 TR_LOTS_OF_MONEY3 1322 0.88 1.76 0.45 199 SHORT_HELO_AND_INLINE_IMAGE 1303 0.33 0.07 0.45 200 XMBody_17 1292 0.93 1.94 0.44 ----------------------------------------------------------------------