Email: 492549 Autolearn: 0 AvgScore: 4.89 AvgScanTime: 1.46 sec Spam: 160986 Autolearn: 0 AvgScore: 13.29 AvgScanTime: 1.73 sec Ham: 331563 Autolearn: 0 AvgScore: 0.82 AvgScanTime: 1.33 sec Time Spent Running SA: 200.21 hours Time Spent Processing Spam: 77.33 hours Time Spent Processing Ham: 122.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 160775 99.65 99.87 99.55 2 HTML_MESSAGE 157032 90.64 97.54 87.29 3 DKIM_SIGNED 149253 84.17 92.71 80.02 4 XM_DK_Pass 140036 81.41 86.99 78.71 5 DKIM_VALID 138695 80.48 86.15 77.72 6 RELAYCOUNTRY_US 137105 83.51 85.17 82.71 7 XM_B_Unicode 136605 76.75 84.86 72.81 8 DCC_CHECK 114239 47.65 70.96 36.33 9 XM_B_SpammyWords 111021 54.55 68.96 47.55 10 XMListUnsubscribeExists 110332 58.59 68.54 53.77 11 DKIM_VALID_AU 108056 65.25 67.12 64.35 12 LOC_TINY_FONT_1 82006 39.01 50.94 33.21 13 XM_B_Unicode3 79861 45.66 49.61 43.74 14 XM_DK_Undo_02 68090 17.57 42.30 5.57 15 HTML_FONT_LOW_CONTRAST 67438 33.78 41.89 29.85 16 BAYES_50 65860 54.58 40.91 61.22 17 XM_B_SpammyWords2 61333 26.38 38.10 20.70 18 FVGT_m_MULTI_ODD 61147 30.36 37.98 26.66 19 BAYES_99 50027 12.75 31.08 3.85 20 DKIM_VALID_EF 49332 30.75 30.64 30.81 21 T_KAM_HTML_FONT_INVALID 47699 25.83 29.63 23.98 22 TR_XM_DKIM_Undo 46701 10.86 29.01 2.05 23 DCC_CHECK_NEGATIVE 46620 52.26 28.96 63.58 24 MIME_HTML_ONLY 42697 22.04 26.52 19.86 25 XMSubLong 40867 24.87 25.39 24.62 26 XM_Multi_Part_URI 39303 18.85 24.41 16.15 27 BAYES_999 37921 9.69 23.56 2.95 28 RCVD_IN_MSPIKE_H2 37431 19.08 23.25 17.05 29 TR_XM_DK_Unsub 36371 17.11 22.59 14.44 30 XM_B_Unsub 34909 13.22 21.68 9.12 31 UNPARSEABLE_RELAY 34152 15.49 21.21 12.72 32 T_TM2_M_HEADER_IN_MSG 33449 24.95 20.78 26.97 33 TR_XM_BayesUnsub 32675 11.49 20.30 7.21 34 TR_DCC_Bayes_99 32264 7.18 20.04 0.93 35 TR_MAX_INTL_RELAY 24682 9.55 15.33 6.75 36 RELAYCOUNTRY_META 24528 7.58 15.24 3.86 37 XM_B_SpammyWords3 22296 8.95 13.85 6.57 38 RCVD_IN_MSPIKE_WL 21598 20.37 13.42 23.75 39 LOTS_OF_MONEY 21275 8.39 13.22 6.05 40 RCVD_IN_BL_SPAMCOP_NET 19940 4.58 12.39 0.79 41 TR_XM_SpammyWords4 19119 6.62 11.88 4.07 42 BOTNET 18352 4.63 11.40 1.34 43 BOTNET_IPINHOSTNAME 18306 5.94 11.37 3.30 44 TR_XM_SpammyRelay 17962 5.03 11.16 2.06 45 TR_XM_UnparsRelay 17719 4.95 11.01 2.01 46 XM_Evil_Numbers_Gen 17425 9.36 10.82 8.65 47 TR_XM_SpammyWords2 15967 3.46 9.92 0.33 48 BAYES_80 15147 5.90 9.41 4.19 49 FSL_BULK_SIG 15123 5.71 9.39 3.92 50 XM_B_Phish_Phrases 14650 6.74 9.10 5.59 51 BAYES_60 13400 8.12 8.32 8.02 52 MPART_ALT_DIFF 12750 5.90 7.92 4.91 53 RCVD_IN_MSPIKE_BL 11735 3.36 7.29 1.46 54 TR_XM_MSPIKECOMBO 11712 3.35 7.28 1.45 55 HTML_IMAGE_RATIO_02 11672 6.11 7.25 5.56 56 TR_XM_SPAMCOP 10823 2.40 6.72 0.31 57 XM_B_PhoneNumber 10722 8.96 6.66 10.08 58 LotsOfNums_01 10711 8.60 6.65 9.55 59 XMSubMetaSx_00 10605 4.53 6.59 3.54 60 DKIM_INVALID 10558 3.69 6.56 2.30 61 RCVD_IN_MSPIKE_H3 10482 8.98 6.51 10.18 62 UNTRUSTED_Relay 10199 3.16 6.34 1.62 63 HTML_IMAGE_RATIO_04 9317 4.93 5.79 4.51 64 XM_H_Long_From01 9208 6.03 5.72 6.18 65 XM_H_GMP 8990 5.18 5.58 4.98 66 BAYES_95 8853 3.51 5.50 2.55 67 XMStrtUSub 8590 5.40 5.34 5.44 68 XM_UncommonTLD01 8390 4.34 5.21 3.92 69 XM_Body_Dirty_Words 8312 2.92 5.16 1.84 70 TR_XM_SpammyWords3 8233 2.18 5.11 0.75 71 XM_B_SpammyTLD 7903 3.78 4.91 3.24 72 MIME_HTML_MOSTLY 7883 3.20 4.90 2.38 73 TR_XM_PhishingBody 7653 2.67 4.75 1.67 74 T_XMDrugObfuBody_14 7382 2.46 4.59 1.43 75 MIME_QP_LONG_LINE 7257 5.61 4.51 6.15 76 TR_XM_SpammyWords5 7172 2.40 4.46 1.40 77 RELAYCOUNTRY_CA 7172 1.91 4.46 0.68 78 RCVD_IN_MSPIKE_L3 6980 2.19 4.34 1.15 79 XM_B_Investor 6963 2.69 4.33 1.89 80 TM2_M_VERY_LONG_WORD 6478 2.26 4.02 1.40 81 TooManyTo_001 6257 6.12 3.89 7.20 82 XMSexyCombo_05 6076 1.93 3.77 1.04 83 HTML_IMAGE_RATIO_06 5770 3.47 3.58 3.41 84 RCVD_IN_MSPIKE_H5 5687 6.67 3.53 8.20 85 XMNumbers 5444 3.37 3.38 3.36 86 RCVD_IN_MSPIKE_H4 5429 4.71 3.37 5.37 87 TM2_M_URI_OPT_OUT 5098 2.37 3.17 1.99 88 XMDiploma_00 5035 2.02 3.13 1.48 89 XM_OfRef6 5001 1.49 3.11 0.71 90 XMStockSpam_06 4909 1.67 3.05 1.00 91 XM_B_Unsub2 4867 2.21 3.02 1.82 92 RELAYCOUNTRY_AU 4830 1.40 3.00 0.62 93 TR_XM_MSPIKECOMBO2 4809 1.05 2.99 0.12 94 XM_CamelCaseFrm001 4799 2.49 2.98 2.25 95 USER_IN_DEF_DKIM_WL 4690 10.69 2.91 14.46 96 T_XMDrugObfuBody_08 4627 2.27 2.87 1.97 97 XM_UB50 4616 1.68 2.87 1.11 98 SUBJ_ALL_CAPS 4595 2.00 2.85 1.59 99 TR_XM_NoHeaderRelay 4493 1.04 2.79 0.18 100 URIBL_SBL_A 4486 0.94 2.79 0.04 101 URIBL_SBL 4486 0.94 2.79 0.04 102 SH_BODYURI_REVERSE_SBL 4474 0.94 2.78 0.04 103 XM_SPF_SoftFail 4454 1.71 2.77 1.20 104 XM_URI_RBL 4382 1.11 2.72 0.33 105 HTML_IMAGE_RATIO_08 4233 2.47 2.63 2.39 106 XM_B_URI_Unicode 4132 2.05 2.57 1.81 107 XM_B_SpammyWords4 4108 1.71 2.55 1.30 108 DKIM_ADSP_NXDOMAIN 4059 1.03 2.52 0.31 109 MIME_HTML_ONLY_MULTI 3978 2.73 2.47 2.86 110 T_XMHurry_00 3923 1.30 2.44 0.75 111 TR_XM_INV_DKIM 3584 0.73 2.23 0.01 112 BOTNET_NORDNS 3538 0.73 2.20 0.01 113 RCVD_IN_MSPIKE_L4 3489 0.89 2.17 0.27 114 TR_XM_MaxSPIKE 3462 0.77 2.15 0.11 115 T_TooManySym_01 3457 5.05 2.15 6.47 116 T_XMDrugObfuBody_00 3374 1.56 2.10 1.30 117 RCVD_IN_IADB_LISTED 3324 3.20 2.06 3.75 118 XM_H_Long_From02 3246 1.26 2.02 0.89 119 T_REMOTE_IMAGE 3236 3.12 2.01 3.66 120 MAILING_LIST_MULTI 3196 2.84 1.99 3.26 121 RCVD_IN_VALIDITY_RPBL 3169 0.67 1.97 0.04 122 SpammyFromTLD_02 3147 0.99 1.95 0.52 123 XMBody_17 3120 1.06 1.94 0.63 124 T_FILL_THIS_FORM_SHORT 3101 1.19 1.93 0.83 125 URI_NOVOWEL 2972 1.53 1.85 1.37 126 HTML_MIME_NO_HTML_TAG 2861 2.22 1.78 2.43 127 FROM_EXCESS_BASE64 2843 2.03 1.77 2.16 128 BAYES_40 2788 3.93 1.73 5.00 129 XM_HighProb1 2766 0.56 1.72 0.00 130 RCVD_IN_IADB_SPF 2758 2.83 1.71 3.37 131 XMBrknScrpt_02 2743 1.28 1.70 1.08 132 XMPhish30 2697 0.96 1.68 0.62 133 XM_SendGrid 2664 1.58 1.65 1.55 134 XMGenDplmaNmb 2622 1.05 1.63 0.77 135 XM_H_DKIM_GOOG 2597 0.54 1.61 0.01 136 RCVD_IN_VALIDITY_SAFE 2588 3.83 1.61 4.92 137 TR_LOTS_OF_MONEY3 2532 0.92 1.57 0.60 138 RCVD_IN_IADB_DK 2524 2.50 1.57 2.95 139 XMSubMetaI_00 2494 0.89 1.55 0.57 140 RCVD_IN_IADB_SENDERID 2474 2.55 1.54 3.05 141 XM_ProductURIs 2375 0.79 1.48 0.46 142 ALL_TRUSTED 2343 9.90 1.46 14.00 143 RELAYCOUNTRY_FR 2299 0.69 1.43 0.34 144 RDNS_DYNAMIC 2273 0.57 1.41 0.16 145 LOW_PRICE 2167 0.60 1.35 0.23 146 URI_HEX 2127 1.24 1.32 1.20 147 XM_B_COPY_HTML 2115 0.93 1.31 0.74 148 HTML_IMAGE_ONLY_16 2098 0.60 1.30 0.26 149 XM_DK_Undo_01 2075 1.95 1.29 2.27 150 URI_TRY_3LD 2067 0.81 1.28 0.58 151 RCVD_IN_IADB_VOUCHED 2060 1.98 1.28 2.32 152 KHOP_HELO_FCRDNS 2046 1.08 1.27 0.99 153 XMPhish14 2028 0.65 1.26 0.35 154 TVD_RCVD_IP 2010 1.01 1.25 0.90 155 HTTPS_HTTP_MISMATCH 2003 0.94 1.24 0.79 156 XM_UB99 2002 0.41 1.24 0.00 157 SHOPIFY_IMG_NOT_RCVD_SFY 2002 0.58 1.24 0.25 158 BAYES_20 1953 3.10 1.21 4.02 159 XM_B_SEO 1950 0.55 1.21 0.23 160 THIS_AD 1924 0.67 1.20 0.42 161 XM_B_Phish66 1915 0.65 1.19 0.39 162 XMBdyGiftCard01 1902 0.92 1.18 0.79 163 SpammyFromTLD_01 1882 0.88 1.17 0.74 164 MPART_ALT_DIFF_COUNT 1861 0.68 1.16 0.45 165 BAYES_00 1773 6.45 1.10 9.05 166 XM_S_SpammyWords 1767 0.52 1.10 0.25 167 TR_XM_Spammywords 1766 0.52 1.10 0.25 168 TR_Symld_Words 1763 1.39 1.10 1.53 169 XM_B_DNDMA 1749 0.75 1.09 0.58 170 TR_XM_GMP_BULK_SIG 1741 0.40 1.08 0.07 171 TR_XM_SEO4 1734 0.45 1.08 0.14 172 RCVD_IN_VALIDITY_CERTIFIED 1717 3.01 1.07 3.96 173 TR_XM_DK_SendGrid 1715 1.10 1.07 1.12 174 ANY_BOUNCE_MESSAGE 1698 2.81 1.05 3.66 175 BOUNCE_MESSAGE 1695 2.81 1.05 3.66 176 HELO_DYNAMIC_SPLIT_IP 1675 0.36 1.04 0.03 177 RCVD_IN_PSBL 1655 0.34 1.03 0.01 178 TR_LOTS_OF_MONEY2 1632 0.47 1.01 0.21 179 T_MONEY_PERCENT 1632 0.47 1.01 0.21 180 HK_RANDOM_REPLYTO 1599 0.39 0.99 0.10 181 XMBody_78 1582 0.56 0.98 0.36 182 TM2_M_A_HREF_HREF 1579 0.49 0.98 0.25 183 TR_XM_Base64_M1 1560 0.92 0.97 0.89 184 XMHTML_After_End 1559 0.55 0.97 0.35 185 DIET_1 1546 0.54 0.96 0.33 186 TR_XM_InvalidRelay 1546 0.32 0.96 0.02 187 TR_Mismatch_TLD_02 1513 0.39 0.94 0.13 188 T_Symld_Words_02 1446 0.87 0.90 0.86 189 DKIM_ADSP_CUSTOM_MED 1442 0.79 0.90 0.74 190 RCVD_IN_IADB_OPTIN 1440 1.38 0.89 1.62 191 HTML_IMAGE_ONLY_20 1404 0.65 0.87 0.54 192 NORDNS_LOW_CONTRAST 1399 0.30 0.87 0.02 193 XM_UB999 1379 0.28 0.86 0.00 194 HTML_TAG_BALANCE_BODY 1344 0.58 0.83 0.45 195 MultiRelay_CC 1311 0.37 0.81 0.15 196 TR_BOTNET_NEGATE 1310 0.39 0.81 0.18 197 TR_MetaPhish_Combo_01 1310 0.86 0.81 0.88 198 XM_GoogleGroups 1297 1.11 0.81 1.26 199 TR_XM_DK_Bayes 1294 4.64 0.80 6.50 200 XM_UB60 1292 0.33 0.80 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 330065 99.65 99.87 99.55 2 HTML_MESSAGE 289411 90.64 97.54 87.29 3 RELAYCOUNTRY_US 274242 83.51 85.17 82.71 4 DKIM_SIGNED 265311 84.17 92.71 80.02 5 XM_DK_Pass 260961 81.41 86.99 78.71 6 DKIM_VALID 257695 80.48 86.15 77.72 7 XM_B_Unicode 241420 76.75 84.86 72.81 8 DKIM_VALID_AU 213347 65.25 67.12 64.35 9 DCC_CHECK_NEGATIVE 210799 52.26 28.96 63.58 10 BAYES_50 202971 54.58 40.91 61.22 11 XMListUnsubscribeExists 178265 58.59 68.54 53.77 12 XM_B_SpammyWords 157659 54.55 68.96 47.55 13 XM_B_Unicode3 145024 45.66 49.61 43.74 14 DCC_CHECK 120448 47.65 70.96 36.33 15 LOC_TINY_FONT_1 110113 39.01 50.94 33.21 16 DKIM_VALID_EF 102140 30.75 30.64 30.81 17 HTML_FONT_LOW_CONTRAST 98963 33.78 41.89 29.85 18 T_TM2_M_HEADER_IN_MSG 89419 24.95 20.78 26.97 19 FVGT_m_MULTI_ODD 88398 30.36 37.98 26.66 20 XMSubLong 81623 24.87 25.39 24.62 21 T_KAM_HTML_FONT_INVALID 79507 25.83 29.63 23.98 22 RCVD_IN_MSPIKE_WL 78730 20.37 13.42 23.75 23 XM_B_SpammyWords2 68626 26.38 38.10 20.70 24 MIME_HTML_ONLY 65850 22.04 26.52 19.86 25 RCVD_IN_MSPIKE_H2 56534 19.08 23.25 17.05 26 XM_Multi_Part_URI 53555 18.85 24.41 16.15 27 USER_IN_DEF_DKIM_WL 47958 10.69 2.91 14.46 28 TR_XM_DK_Unsub 47883 17.11 22.59 14.44 29 ALL_TRUSTED 46429 9.90 1.46 14.00 30 UNPARSEABLE_RELAY 42161 15.49 21.21 12.72 31 RCVD_IN_MSPIKE_H3 33762 8.98 6.51 10.18 32 XM_B_PhoneNumber 33424 8.96 6.66 10.08 33 LotsOfNums_01 31660 8.60 6.65 9.55 34 XM_B_Unsub 30222 13.22 21.68 9.12 35 BAYES_00 30012 6.45 1.10 9.05 36 XM_Evil_Numbers_Gen 28683 9.36 10.82 8.65 37 RCVD_IN_MSPIKE_H5 27177 6.67 3.53 8.20 38 BAYES_60 26575 8.12 8.32 8.02 39 XM_DKIMWhitelistDomains 25988 5.28 0.03 7.84 40 TR_XM_BayesUnsub 23905 11.49 20.30 7.21 41 TooManyTo_001 23885 6.12 3.89 7.20 42 TR_MAX_INTL_RELAY 22369 9.55 15.33 6.75 43 XM_B_SpammyWords3 21792 8.95 13.85 6.57 44 TR_XM_DK_Bayes 21561 4.64 0.80 6.50 45 T_TooManySym_01 21439 5.05 2.15 6.47 46 TR_XM_DK_Bayes1 21220 4.57 0.80 6.40 47 XM_H_Long_From01 20501 6.03 5.72 6.18 48 MIME_QP_LONG_LINE 20393 5.61 4.51 6.15 49 LOTS_OF_MONEY 20046 8.39 13.22 6.05 50 XM_B_Phish_Phrases 18545 6.74 9.10 5.59 51 TR_XM_DK_Bayes2 18532 3.99 0.71 5.59 52 XM_DK_Undo_02 18467 17.57 42.30 5.57 53 HTML_IMAGE_RATIO_02 18440 6.11 7.25 5.56 54 XMStrtUSub 18025 5.40 5.34 5.44 55 RCVD_IN_MSPIKE_H4 17791 4.71 3.37 5.37 56 BAYES_40 16589 3.93 1.73 5.00 57 XM_H_GMP 16528 5.18 5.58 4.98 58 RCVD_IN_VALIDITY_SAFE 16301 3.83 1.61 4.92 59 MPART_ALT_DIFF 16291 5.90 7.92 4.91 60 HTML_IMAGE_RATIO_04 14954 4.93 5.79 4.51 61 XM_PDF 14369 3.16 0.74 4.33 62 BAYES_80 13905 5.90 9.41 4.19 63 TR_XM_SpammyWords4 13483 6.62 11.88 4.07 64 BAYES_20 13337 3.10 1.21 4.02 65 RCVD_IN_VALIDITY_CERTIFIED 13115 3.01 1.07 3.96 66 XM_UncommonTLD01 13007 4.34 5.21 3.92 67 FSL_BULK_SIG 12988 5.71 9.39 3.92 68 RELAYCOUNTRY_META 12786 7.58 15.24 3.86 69 BAYES_99 12769 12.75 31.08 3.85 70 RCVD_IN_IADB_LISTED 12450 3.20 2.06 3.75 71 ANY_BOUNCE_MESSAGE 12146 2.81 1.05 3.66 72 BOUNCE_MESSAGE 12145 2.81 1.05 3.66 73 T_REMOTE_IMAGE 12121 3.12 2.01 3.66 74 XMSubMetaSx_00 11723 4.53 6.59 3.54 75 HTML_IMAGE_RATIO_06 11318 3.47 3.58 3.41 76 RCVD_IN_IADB_SPF 11183 2.83 1.71 3.37 77 XMNumbers 11142 3.37 3.38 3.36 78 BOTNET_IPINHOSTNAME 10934 5.94 11.37 3.30 79 MAILING_LIST_MULTI 10815 2.84 1.99 3.26 80 XM_B_SpammyTLD 10730 3.78 4.91 3.24 81 T_TooManySym_02 10291 2.27 0.56 3.10 82 RCVD_IN_IADB_SENDERID 10105 2.55 1.54 3.05 83 RCVD_IN_IADB_DK 9792 2.50 1.57 2.95 84 BAYES_999 9787 9.69 23.56 2.95 85 MIME_HTML_ONLY_MULTI 9485 2.73 2.47 2.86 86 BAYES_95 8459 3.51 5.50 2.55 87 HTML_MIME_NO_HTML_TAG 8058 2.22 1.78 2.43 88 HTML_IMAGE_RATIO_08 7921 2.47 2.63 2.39 89 MIME_HTML_MOSTLY 7891 3.20 4.90 2.38 90 RCVD_IN_IADB_VOUCHED 7695 1.98 1.28 2.32 91 DKIM_INVALID 7616 3.69 6.56 2.30 92 XM_DK_Undo_01 7534 1.95 1.29 2.27 93 TO_MALFORMED 7496 1.53 0.02 2.26 94 XM_CamelCaseFrm001 7459 2.49 2.98 2.25 95 FROM_EXCESS_BASE64 7169 2.03 1.77 2.16 96 INVALID_MSGID 6988 1.49 0.22 2.11 97 BAYES_05 6919 1.64 0.73 2.09 98 TR_XM_SpammyRelay 6834 5.03 11.16 2.06 99 TooManyTo_002 6818 1.54 0.47 2.06 100 TR_XM_DKIM_Undo 6784 10.86 29.01 2.05 101 TR_XM_UnparsRelay 6673 4.95 11.01 2.01 102 TM2_M_URI_OPT_OUT 6595 2.37 3.17 1.99 103 T_XMDrugObfuBody_08 6545 2.27 2.87 1.97 104 XM_B_Investor 6273 2.69 4.33 1.89 105 XM_Body_Dirty_Words 6087 2.92 5.16 1.84 106 XM_B_Unsub2 6019 2.21 3.02 1.82 107 XM_B_URI_Unicode 5989 2.05 2.57 1.81 108 TR_XM_PhishingBody 5521 2.67 4.75 1.67 109 UNTRUSTED_Relay 5366 3.16 6.34 1.62 110 RCVD_IN_IADB_OPTIN 5359 1.38 0.89 1.62 111 SUBJ_ALL_CAPS 5273 2.00 2.85 1.59 112 XM_SendGrid 5134 1.58 1.65 1.55 113 TR_Symld_Words 5080 1.39 1.10 1.53 114 XMDiploma_00 4897 2.02 3.13 1.48 115 HELO_NODOT 4873 1.15 0.49 1.47 116 HELO_NO_DOMAIN 4872 1.15 0.48 1.47 117 RCVD_IN_MSPIKE_BL 4831 3.36 7.29 1.46 118 TR_XM_MSPIKECOMBO 4792 3.35 7.28 1.45 119 T_XMDrugObfuBody_14 4741 2.46 4.59 1.43 120 TM2_M_VERY_LONG_WORD 4653 2.26 4.02 1.40 121 TR_XM_SpammyWords5 4645 2.40 4.46 1.40 122 URI_NOVOWEL 4557 1.53 1.85 1.37 123 TooManyTo_003 4465 1.03 0.37 1.35 124 BOTNET 4450 4.63 11.40 1.34 125 T_TooManySym_03 4387 0.96 0.20 1.32 126 IN_HORDE_ADDRESS_BOOK 4374 0.92 0.09 1.32 127 T_XMDrugObfuBody_00 4314 1.56 2.10 1.30 128 XM_B_SpammyWords4 4311 1.71 2.55 1.30 129 XM_GoogleGroups 4194 1.11 0.81 1.26 130 XMGappySubj_01 4176 0.92 0.22 1.26 131 XM_SPF_SoftFail 3965 1.71 2.77 1.20 132 URI_HEX 3964 1.24 1.32 1.20 133 RCVD_IN_MSPIKE_L3 3824 2.19 4.34 1.15 134 TR_XM_DK_SendGrid 3719 1.10 1.07 1.12 135 XM_UB50 3680 1.68 2.87 1.11 136 XMBrknScrpt_02 3573 1.28 1.70 1.08 137 XMSexyCombo_05 3452 1.93 3.77 1.04 138 TooManyTo_004 3431 0.80 0.31 1.03 139 XMStockSpam_06 3306 1.67 3.05 1.00 140 KHOP_HELO_FCRDNS 3284 1.08 1.27 0.99 141 XMCapTrack 3250 0.80 0.43 0.98 142 FROM_GOV_DKIM_AU 3105 0.79 0.49 0.94 143 TR_DCC_Bayes_99 3096 7.18 20.04 0.93 144 TVD_SPACE_RATIO 3016 0.68 0.19 0.91 145 XM_ShortIntro_01 2996 0.78 0.52 0.90 146 TVD_RCVD_IP 2985 1.01 1.25 0.90 147 TR_XM_Base64_M1 2958 0.92 0.97 0.89 148 XM_H_Long_From02 2956 1.26 2.02 0.89 149 TR_MetaPhish_Combo_01 2911 0.86 0.81 0.88 150 T_Symld_Words_02 2836 0.87 0.90 0.86 151 TooManyTo_005 2818 0.66 0.27 0.85 152 T_FILL_THIS_FORM_SHORT 2752 1.19 1.93 0.83 153 RELAYCOUNTRY_GB 2720 0.81 0.80 0.82 154 HTTPS_HTTP_MISMATCH 2616 0.94 1.24 0.79 155 RCVD_IN_BL_SPAMCOP_NET 2611 4.58 12.39 0.79 156 XMBdyGiftCard01 2610 0.92 1.18 0.79 157 XMBSHREFv2 2590 0.66 0.40 0.78 158 XMGenDplmaNmb 2543 1.05 1.63 0.77 159 TR_XM_SpammyWords3 2482 2.18 5.11 0.75 160 T_XMHurry_00 2471 1.30 2.44 0.75 161 SpammyFromTLD_01 2465 0.88 1.17 0.74 162 XM_B_COPY_HTML 2445 0.93 1.31 0.74 163 DKIM_ADSP_CUSTOM_MED 2443 0.79 0.90 0.74 164 XM_OfRef6 2350 1.49 3.11 0.71 165 RELAYCOUNTRY_CA 2241 1.91 4.46 0.68 166 T_OBFU_PDF_ATTACH 2112 0.46 0.08 0.64 167 XM_H_PHPMailer 2087 0.60 0.54 0.63 168 XMBody_17 2085 1.06 1.94 0.63 169 XMPhish30 2052 0.96 1.68 0.62 170 RELAYCOUNTRY_AU 2043 1.40 3.00 0.62 171 TR_LOTS_OF_MONEY3 1991 0.92 1.57 0.60 172 XMNoVowels 1988 0.62 0.66 0.60 173 XM_B_DNDMA 1933 0.75 1.09 0.58 174 URI_TRY_3LD 1916 0.81 1.28 0.58 175 XMSubMetaI_00 1904 0.89 1.55 0.57 176 XMGappySubj_02 1870 0.39 0.04 0.56 177 HTML_IMAGE_ONLY_20 1797 0.65 0.87 0.54 178 SpammyFromTLD_02 1717 0.99 1.95 0.52 179 TO_NO_BRKTS_HTML_ONLY 1714 0.46 0.35 0.52 180 FORGED_GMAIL_RCVD 1691 0.59 0.77 0.51 181 XMSubMetaSxObfu_03 1675 0.52 0.56 0.51 182 SUBJ_DOLLARS 1654 0.51 0.54 0.50 183 PLING_QUERY 1625 0.55 0.69 0.49 184 SHORT_HELO_AND_INLINE_IMAGE 1597 0.37 0.13 0.48 185 XMMoneyMeta_00 1579 0.55 0.71 0.48 186 T_TooManySym_04 1554 0.33 0.03 0.47 187 XM_ProductURIs 1521 0.79 1.48 0.46 188 MPART_ALT_DIFF_COUNT 1503 0.68 1.16 0.45 189 HTML_TAG_BALANCE_BODY 1495 0.58 0.83 0.45 190 NML_ADSP_CUSTOM_MED 1482 0.53 0.70 0.45 191 XMLngstWrd_00 1460 0.43 0.41 0.44 192 XMSlimDrugH 1437 0.49 0.61 0.43 193 THIS_AD 1378 0.67 1.20 0.42 194 XMClaimOffer 1367 0.44 0.51 0.41 195 XMSolicitRefs_0 1362 0.43 0.46 0.41 196 TR_XM_GMP_MSPIKE_UNDO2 1348 0.36 0.26 0.41 197 LongTLD 1336 0.52 0.77 0.40 198 FILL_THIS_FORM 1297 0.32 0.17 0.39 199 XM_B_Phish66 1277 0.65 1.19 0.39 200 XMLngstWrd_01 1271 0.38 0.37 0.38 ----------------------------------------------------------------------