Email: 553845 Autolearn: 0 AvgScore: 4.91 AvgScanTime: 1.84 sec Spam: 187784 Autolearn: 0 AvgScore: 14.10 AvgScanTime: 2.06 sec Ham: 366061 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 1.73 sec Time Spent Running SA: 283.08 hours Time Spent Processing Spam: 107.46 hours Time Spent Processing Ham: 175.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 180539 89.35 96.14 85.87 2 DKIM_SIGNED 172665 81.69 91.95 76.42 3 XM_DK_Pass 166547 79.65 88.69 75.02 4 DKIM_VALID 164010 78.53 87.34 74.01 5 XM_B_Unicode 161160 75.72 85.82 70.54 6 RELAYCOUNTRY_US 160743 82.82 85.60 81.40 7 DCC_CHECK 143963 52.61 76.66 40.28 8 XMListUnsubscribeExists 137059 59.37 72.99 52.38 9 XM_B_SpammyWords 135390 54.73 72.10 45.83 10 DKIM_VALID_AU 131021 62.50 69.77 58.77 11 LOC_TINY_FONT_1 90464 34.67 48.17 27.75 12 XM_B_Unicode3 89855 44.23 47.85 42.37 13 XM_DK_Undo_02 81330 18.37 43.31 5.57 14 HTML_FONT_LOW_CONTRAST 78505 33.21 41.81 28.80 15 XM_B_SpammyWords2 75891 26.44 40.41 19.27 16 BAYES_50 74233 53.56 39.53 60.76 17 RCVD_IN_MSPIKE_H2 73733 34.63 39.26 32.25 18 FVGT_m_MULTI_ODD 66043 29.07 35.17 25.94 19 BAYES_99 63692 14.13 33.92 3.97 20 TR_XM_DKIM_Undo 59277 12.27 31.57 2.37 21 T_KAM_HTML_FONT_INVALID 56294 25.06 29.98 22.53 22 BAYES_999 51169 11.23 27.25 3.01 23 MIME_HTML_ONLY 50376 21.51 26.83 18.79 24 DKIM_VALID_EF 48838 27.31 26.01 27.97 25 TR_DCC_Bayes_99 47960 9.65 25.54 1.49 26 XM_Multi_Part_URI 42460 18.49 22.61 16.37 27 XMSubLong 42019 22.09 22.38 21.95 28 DCC_CHECK_NEGATIVE 41355 46.91 22.02 59.67 29 T_TM2_M_HEADER_IN_MSG 40069 26.14 21.34 28.61 30 TR_XM_DK_Unsub 34274 14.92 18.25 13.21 31 UNPARSEABLE_RELAY 31665 13.12 16.86 11.19 32 XM_B_Unsub 31256 11.58 16.64 8.99 33 TR_XM_BayesUnsub 30204 10.24 16.08 7.25 34 XM_B_SpammyWords3 28502 9.15 15.18 6.06 35 TR_MAX_INTL_RELAY 26533 9.30 14.13 6.82 36 RELAYCOUNTRY_META 25855 7.40 13.77 4.14 37 BOTNET_IPINHOSTNAME 25758 6.90 13.72 3.40 38 TR_XM_SpammyWords2 24221 4.75 12.90 0.57 39 LOTS_OF_MONEY 23510 8.18 12.52 5.95 40 TR_XM_SpammyWords4 21021 6.53 11.19 4.14 41 TR_XM_UnparsRelay 18714 4.65 9.97 1.92 42 TR_XM_SpammyRelay 18601 4.87 9.91 2.28 43 XM_Evil_Numbers_Gen 18564 9.01 9.89 8.55 44 FSL_BULK_SIG 17134 6.96 9.12 5.86 45 BOTNET 16918 4.00 9.01 1.43 46 BAYES_80 16650 5.80 8.87 4.22 47 LotsOfNums_01 15241 8.47 8.12 8.66 48 BAYES_60 14380 8.95 7.66 9.61 49 RCVD_IN_BL_SPAMCOP_NET 13544 2.89 7.21 0.67 50 HTML_IMAGE_RATIO_02 12943 6.17 6.89 5.81 51 XM_B_PhoneNumber 12936 8.53 6.89 9.37 52 XM_Body_Dirty_Words 12061 3.78 6.42 2.43 53 UNTRUSTED_Relay 11941 3.16 6.36 1.52 54 MPART_ALT_DIFF 11735 4.76 6.25 4.00 55 HTML_IMAGE_RATIO_04 10621 4.88 5.66 4.48 56 XM_H_Long_From01 10605 5.42 5.65 5.30 57 TR_XM_SPAMCOP 10543 2.11 5.61 0.32 58 TooManyTo_001 10475 7.37 5.58 8.28 59 XMSubMetaSx_00 10390 3.95 5.53 3.14 60 XM_UncommonTLD01 9770 4.33 5.20 3.88 61 HTML_IMAGE_RATIO_06 9703 4.06 5.17 3.49 62 XM_B_Phish_Phrases 9647 4.25 5.14 3.80 63 BAYES_95 9194 3.37 4.90 2.59 64 TR_XM_SpammyWords5 8997 2.73 4.79 1.67 65 XM_SPF_SoftFail 8662 2.81 4.61 1.88 66 DKIM_INVALID 8655 3.16 4.61 2.41 67 XM_B_SEO 8270 2.43 4.40 1.41 68 XM_H_GMP 8186 4.67 4.36 4.83 69 RELAYCOUNTRY_CA 8038 2.31 4.28 1.30 70 XM_B_Investor 7990 2.55 4.25 1.67 71 XMSexyCombo_05 7953 2.26 4.24 1.25 72 XM_CamelCaseFrm001 7916 3.03 4.22 2.42 73 USER_IN_DEF_DKIM_WL 7875 10.54 4.19 13.80 74 TR_XM_PhishingBody 7784 2.65 4.15 1.88 75 HTML_IMAGE_RATIO_08 7601 2.89 4.05 2.30 76 TR_XM_SEO4 7376 1.98 3.93 0.97 77 XM_B_SpammyTLD 7296 4.33 3.89 4.56 78 MIME_HTML_ONLY_MULTI 7000 2.86 3.73 2.41 79 RCVD_IN_VALIDITY_SAFE 6932 4.34 3.69 4.67 80 XMStrtUSub 6865 4.24 3.66 4.54 81 T_XMDrugObfuBody_14 6853 2.42 3.65 1.79 82 TM2_M_URI_OPT_OUT 6763 2.44 3.60 1.84 83 XMNumbers 6744 3.01 3.59 2.72 84 XM_UB50 6651 1.86 3.54 0.99 85 T_XMDrugObfuBody_08 6613 2.13 3.52 1.42 86 TM2_M_VERY_LONG_WORD 6595 1.92 3.51 1.10 87 MIME_HTML_MOSTLY 6454 2.85 3.44 2.55 88 MIME_QP_LONG_LINE 6369 4.77 3.39 5.47 89 SUBJ_ALL_CAPS 6029 2.25 3.21 1.75 90 XM_URI_RBL 5983 1.32 3.19 0.36 91 RCVD_IN_MSPIKE_H3 5775 4.79 3.08 5.67 92 RCVD_IN_MSPIKE_WL 5775 4.79 3.08 5.67 93 XMBody_17 5436 1.29 2.89 0.46 94 RCVD_IN_VALIDITY_CERTIFIED 5428 3.59 2.89 3.95 95 XM_B_URI_Unicode 5373 2.20 2.86 1.86 96 XMBrknScrpt_02 5166 1.85 2.75 1.39 97 XM_B_SpammyWords4 4852 1.54 2.58 1.01 98 TR_LOTS_OF_MONEY3 4763 1.20 2.54 0.52 99 XM_OfRef6 4749 1.55 2.53 1.04 100 XM_B_Unsub2 4699 1.86 2.50 1.53 101 RELAYCOUNTRY_AU 4444 1.34 2.37 0.81 102 XMDiploma_00 4347 1.77 2.31 1.49 103 T_TooManySym_01 4276 4.10 2.28 5.03 104 T_XMHurry_00 4258 1.17 2.27 0.61 105 FROM_EXCESS_BASE64 4010 2.34 2.14 2.44 106 TR_XM_NoHeaderRelay 4007 0.83 2.13 0.16 107 RCVD_IN_VALIDITY_RPBL 3953 0.81 2.11 0.14 108 T_XMDrugObfuBody_00 3729 1.46 1.99 1.18 109 MAILING_LIST_MULTI 3609 2.77 1.92 3.21 110 URI_HEX 3591 1.43 1.91 1.18 111 XM_DK_Undo_01 3456 1.68 1.84 1.60 112 XMStockSpam_06 3306 1.30 1.76 1.06 113 SpammyFromTLD_01 3192 1.13 1.70 0.84 114 T_REMOTE_IMAGE 3099 2.67 1.65 3.19 115 SpammyFromTLD_02 3015 0.85 1.61 0.46 116 RCVD_IN_IADB_LISTED 2989 3.45 1.59 4.40 117 URI_TRY_3LD 2987 0.95 1.59 0.62 118 T_FILL_THIS_FORM_SHORT 2831 1.18 1.51 1.00 119 URI_NOVOWEL 2775 2.82 1.48 3.51 120 BAYES_40 2766 3.82 1.47 5.02 121 HTML_TAG_BALANCE_BODY 2724 0.89 1.45 0.61 122 ANY_BOUNCE_MESSAGE 2683 2.75 1.43 3.42 123 BOUNCE_MESSAGE 2681 2.75 1.43 3.42 124 XMPhish30 2623 0.82 1.40 0.53 125 RCVD_IN_IADB_SPF 2610 3.01 1.39 3.85 126 XMSubMetaI_00 2610 0.92 1.39 0.68 127 TR_LOTS_OF_MONEY2 2586 0.63 1.38 0.24 128 T_MONEY_PERCENT 2586 0.63 1.38 0.24 129 DKIM_ADSP_NXDOMAIN 2579 0.66 1.37 0.29 130 XM_SendGrid 2562 1.43 1.36 1.46 131 XMGenDplmaNmb 2561 0.97 1.36 0.76 132 XM_ProductURIs 2561 0.88 1.36 0.63 133 XM_B_REG_HTML 2507 0.65 1.34 0.30 134 RCVD_IN_IADB_DK 2470 2.63 1.32 3.31 135 RCVD_IN_IADB_SENDERID 2462 2.71 1.31 3.42 136 XM_HighProb1 2448 0.45 1.30 0.01 137 RCVD_IN_ZEN_LASTEXTERNAL 2441 0.44 1.30 0.00 138 SHORTCIRCUIT 2441 0.44 1.30 0.00 139 THIS_AD 2423 0.90 1.29 0.70 140 XMBdyGiftCard01 2402 1.18 1.28 1.12 141 XM_H_Long_From02 2385 1.19 1.27 1.15 142 XM_B_DNDMA 2328 0.71 1.24 0.44 143 TM2_M_OBFU_COMMENT 2315 0.62 1.23 0.30 144 TR_Caps_n_Bayes_99 2297 0.46 1.22 0.06 145 TR_XM_INV_DKIM 2293 0.45 1.22 0.05 146 TR_XM_PHPForged 2270 0.63 1.21 0.33 147 HTML_MIME_NO_HTML_TAG 2259 1.76 1.20 2.05 148 TR_XM_PHPDW 2257 0.62 1.20 0.33 149 TR_XM_FormFill2 2230 0.63 1.19 0.34 150 XM_B_COPY_HTML 2214 0.90 1.18 0.76 151 XM_H_PHPOS 2210 0.61 1.18 0.32 152 TR_XM_Base64_M1 2127 0.96 1.13 0.87 153 TR_XM_InvalidRelay 2000 0.37 1.07 0.02 154 BOTNET_NORDNS 1977 0.36 1.05 0.01 155 XM_H_Undi_Recip 1969 0.45 1.05 0.15 156 KHOP_HELO_FCRDNS 1960 1.25 1.04 1.35 157 DKIM_ADSP_CUSTOM_MED 1958 0.94 1.04 0.89 158 ALL_TRUSTED 1953 10.44 1.04 15.26 159 XM_B_Phish66 1946 0.57 1.04 0.34 160 TR_Symld_Words 1926 1.81 1.03 2.22 161 XMHTML_After_End 1909 0.60 1.02 0.39 162 BAYES_20 1891 2.41 1.01 3.12 163 XMHTMLBadTable_001 1863 0.54 0.99 0.30 164 RELAYCOUNTRY_FR 1862 0.51 0.99 0.26 165 HTTPS_HTTP_MISMATCH 1817 0.87 0.97 0.82 166 XMClaimOffer 1770 0.55 0.94 0.34 167 TR_MetaPhish_Combo_01 1766 0.96 0.94 0.96 168 TR_XM_Undi_Recip19 1735 0.36 0.92 0.07 169 URIBL_CSS_A 1721 0.34 0.92 0.04 170 URIBL_CSS 1721 0.34 0.92 0.04 171 SH_BODYURI_REVERSE_CSS 1720 0.34 0.92 0.04 172 XMPhish14 1718 0.77 0.91 0.69 173 SHOPIFY_IMG_NOT_RCVD_SFY 1716 0.53 0.91 0.34 174 XM_UB99 1680 0.31 0.89 0.01 175 RCVD_IN_PBL 1642 0.70 0.87 0.61 176 TooManyTo_002 1630 2.03 0.87 2.62 177 XMBounce_01 1626 0.30 0.87 0.01 178 TR_XM_DK_SendGrid 1603 0.88 0.85 0.90 179 RDNS_DYNAMIC 1592 0.58 0.85 0.44 180 PLING_QUERY 1584 0.53 0.84 0.38 181 PDS_RDNS_DYNAMIC_FP 1565 0.47 0.83 0.29 182 T_STY_INVIS_DIRECT 1553 0.49 0.83 0.32 183 BAYES_00 1542 6.14 0.82 8.87 184 PDS_OTHER_BAD_TLD 1509 0.35 0.80 0.11 185 MPART_ALT_DIFF_COUNT 1508 0.59 0.80 0.48 186 XMSubMetaSxObfu_03 1501 0.50 0.80 0.35 187 NML_ADSP_CUSTOM_MED 1484 0.63 0.79 0.55 188 T_TooManySym_02 1468 1.87 0.78 2.43 189 T_Symld_Words_02 1434 0.61 0.76 0.53 190 RCVD_IN_IADB_VOUCHED 1432 2.25 0.76 3.01 191 XMSolicitRefs_0 1417 0.53 0.75 0.42 192 RELAYCOUNTRY_CN 1413 0.32 0.75 0.09 193 TM2_M_A_HREF_HREF 1394 0.42 0.74 0.26 194 TVD_RCVD_IP 1393 0.56 0.74 0.46 195 RELAYCOUNTRY_GB 1389 0.56 0.74 0.47 196 URIBL_BLACK 1385 0.29 0.74 0.06 197 TR_XM_DK_Bayes 1380 4.11 0.73 5.85 198 DIET_1 1375 0.45 0.73 0.30 199 TR_XM_DK_Bayes1 1368 4.05 0.73 5.76 200 HOSTED_IMG_MULTI_PUB_01 1366 0.26 0.73 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 314347 89.35 96.14 85.87 2 RELAYCOUNTRY_US 297978 82.82 85.60 81.40 3 DKIM_SIGNED 279761 81.69 91.95 76.42 4 XM_DK_Pass 274608 79.65 88.69 75.02 5 DKIM_VALID 270924 78.53 87.34 74.01 6 XM_B_Unicode 258209 75.72 85.82 70.54 7 BAYES_50 222417 53.56 39.53 60.76 8 DCC_CHECK_NEGATIVE 218443 46.91 22.02 59.67 9 DKIM_VALID_AU 215120 62.50 69.77 58.77 10 XMListUnsubscribeExists 191749 59.37 72.99 52.38 11 XM_B_SpammyWords 167752 54.73 72.10 45.83 12 XM_B_Unicode3 155109 44.23 47.85 42.37 13 DCC_CHECK 147437 52.61 76.66 40.28 14 RCVD_IN_MSPIKE_H2 118068 34.63 39.26 32.25 15 HTML_FONT_LOW_CONTRAST 105408 33.21 41.81 28.80 16 T_TM2_M_HEADER_IN_MSG 104717 26.14 21.34 28.61 17 DKIM_VALID_EF 102395 27.31 26.01 27.97 18 LOC_TINY_FONT_1 101566 34.67 48.17 27.75 19 FVGT_m_MULTI_ODD 94968 29.07 35.17 25.94 20 T_KAM_HTML_FONT_INVALID 82491 25.06 29.98 22.53 21 XMSubLong 80349 22.09 22.38 21.95 22 XM_B_SpammyWords2 70522 26.44 40.41 19.27 23 MIME_HTML_ONLY 68774 21.51 26.83 18.79 24 XM_Multi_Part_URI 59922 18.49 22.61 16.37 25 ALL_TRUSTED 55869 10.44 1.04 15.26 26 USER_IN_DEF_DKIM_WL 50527 10.54 4.19 13.80 27 TR_XM_DK_Unsub 48374 14.92 18.25 13.21 28 UNPARSEABLE_RELAY 40975 13.12 16.86 11.19 29 BAYES_60 35169 8.95 7.66 9.61 30 XM_B_PhoneNumber 34296 8.53 6.89 9.37 31 XM_B_Unsub 32892 11.58 16.64 8.99 32 BAYES_00 32472 6.14 0.82 8.87 33 LotsOfNums_01 31687 8.47 8.12 8.66 34 XM_Evil_Numbers_Gen 31315 9.01 9.89 8.55 35 TooManyTo_001 30320 7.37 5.58 8.28 36 TR_XM_BayesUnsub 26529 10.24 16.08 7.25 37 TR_MAX_INTL_RELAY 24964 9.30 14.13 6.82 38 XM_DKIMWhitelistDomains 24947 4.58 0.22 6.81 39 IN_ZIMBRA_NJ_WHITELIST 24736 4.49 0.08 6.76 40 XM_B_SpammyWords3 22187 9.15 15.18 6.06 41 LOTS_OF_MONEY 21794 8.18 12.52 5.95 42 FSL_BULK_SIG 21434 6.96 9.12 5.86 43 TR_XM_DK_Bayes 21403 4.11 0.73 5.85 44 HTML_IMAGE_RATIO_02 21256 6.17 6.89 5.81 45 TR_XM_DK_Bayes1 21077 4.05 0.73 5.76 46 RCVD_IN_MSPIKE_WL 20762 4.79 3.08 5.67 47 RCVD_IN_MSPIKE_H3 20761 4.79 3.08 5.67 48 XM_DK_Undo_02 20388 18.37 43.31 5.57 49 MIME_QP_LONG_LINE 20040 4.77 3.39 5.47 50 XM_H_Long_From01 19410 5.42 5.65 5.30 51 T_TooManySym_01 18428 4.10 2.28 5.03 52 BAYES_40 18380 3.82 1.47 5.02 53 TR_XM_DK_Bayes2 17755 3.40 0.58 4.85 54 XM_H_GMP 17686 4.67 4.36 4.83 55 RCVD_IN_VALIDITY_SAFE 17085 4.34 3.69 4.67 56 XM_B_SpammyTLD 16680 4.33 3.89 4.56 57 XMStrtUSub 16615 4.24 3.66 4.54 58 HTML_IMAGE_RATIO_04 16384 4.88 5.66 4.48 59 RCVD_IN_IADB_LISTED 16099 3.45 1.59 4.40 60 BAYES_80 15460 5.80 8.87 4.22 61 RELAYCOUNTRY_META 15152 7.40 13.77 4.14 62 TR_XM_SpammyWords4 15152 6.53 11.19 4.14 63 XM_PDF 14728 2.87 0.62 4.02 64 MPART_ALT_DIFF 14633 4.76 6.25 4.00 65 BAYES_99 14541 14.13 33.92 3.97 66 RCVD_IN_VALIDITY_CERTIFIED 14455 3.59 2.89 3.95 67 XM_UncommonTLD01 14195 4.33 5.20 3.88 68 RCVD_IN_IADB_SPF 14084 3.01 1.39 3.85 69 XM_B_Phish_Phrases 13918 4.25 5.14 3.80 70 URI_NOVOWEL 12865 2.82 1.48 3.51 71 HTML_IMAGE_RATIO_06 12767 4.06 5.17 3.49 72 ANY_BOUNCE_MESSAGE 12528 2.75 1.43 3.42 73 BOUNCE_MESSAGE 12527 2.75 1.43 3.42 74 RCVD_IN_IADB_SENDERID 12525 2.71 1.31 3.42 75 BOTNET_IPINHOSTNAME 12455 6.90 13.72 3.40 76 RCVD_IN_IADB_DK 12110 2.63 1.32 3.31 77 MAILING_LIST_MULTI 11746 2.77 1.92 3.21 78 T_REMOTE_IMAGE 11695 2.67 1.65 3.19 79 XMSubMetaSx_00 11504 3.95 5.53 3.14 80 BAYES_20 11437 2.41 1.01 3.12 81 RCVD_IN_IADB_VOUCHED 11007 2.25 0.76 3.01 82 BAYES_999 11007 11.23 27.25 3.01 83 XMNumbers 9945 3.01 3.59 2.72 84 TooManyTo_002 9608 2.03 0.87 2.62 85 BAYES_95 9497 3.37 4.90 2.59 86 MIME_HTML_MOSTLY 9347 2.85 3.44 2.55 87 FROM_EXCESS_BASE64 8937 2.34 2.14 2.44 88 T_TooManySym_02 8889 1.87 0.78 2.43 89 XM_Body_Dirty_Words 8880 3.78 6.42 2.43 90 XM_CamelCaseFrm001 8855 3.03 4.22 2.42 91 DKIM_INVALID 8837 3.16 4.61 2.41 92 MIME_HTML_ONLY_MULTI 8833 2.86 3.73 2.41 93 TR_XM_DKIM_Undo 8661 12.27 31.57 2.37 94 HTML_IMAGE_RATIO_08 8432 2.89 4.05 2.30 95 TR_XM_SpammyRelay 8347 4.87 9.91 2.28 96 TR_Symld_Words 8116 1.81 1.03 2.22 97 RCVD_IN_IADB_OPTIN 7673 1.56 0.51 2.10 98 HTML_MIME_NO_HTML_TAG 7505 1.76 1.20 2.05 99 INVALID_MSGID 7370 1.37 0.12 2.01 100 TR_XM_UnparsRelay 7034 4.65 9.97 1.92 101 TR_XM_PhishingBody 6893 2.65 4.15 1.88 102 XM_SPF_SoftFail 6880 2.81 4.61 1.88 103 XM_B_URI_Unicode 6798 2.20 2.86 1.86 104 TM2_M_URI_OPT_OUT 6730 2.44 3.60 1.84 105 BAYES_05 6632 1.38 0.53 1.81 106 T_XMDrugObfuBody_14 6553 2.42 3.65 1.79 107 TO_MALFORMED 6494 1.18 0.02 1.77 108 SUBJ_ALL_CAPS 6421 2.25 3.21 1.75 109 XM_B_Investor 6125 2.55 4.25 1.67 110 TR_XM_SpammyWords5 6114 2.73 4.79 1.67 111 XM_DK_Undo_01 5846 1.68 1.84 1.60 112 XM_B_Unsub2 5593 1.86 2.50 1.53 113 UNTRUSTED_Relay 5560 3.16 6.36 1.52 114 TR_DCC_Bayes_99 5462 9.65 25.54 1.49 115 XMDiploma_00 5460 1.77 2.31 1.49 116 XM_SendGrid 5344 1.43 1.36 1.46 117 BOTNET 5231 4.00 9.01 1.43 118 T_XMDrugObfuBody_08 5203 2.13 3.52 1.42 119 XM_B_SEO 5165 2.43 4.40 1.41 120 TooManyTo_003 5113 1.16 0.69 1.40 121 XMBrknScrpt_02 5082 1.85 2.75 1.39 122 KHOP_HELO_FCRDNS 4948 1.25 1.04 1.35 123 XM_TLDProd2 4899 1.08 0.56 1.34 124 IN_HORDE_ADDRESS_BOOK 4776 0.89 0.09 1.30 125 RELAYCOUNTRY_CA 4760 2.31 4.28 1.30 126 XMSexyCombo_05 4589 2.26 4.24 1.25 127 XMGappySubj_01 4521 0.86 0.14 1.24 128 T_XMDrugObfuBody_00 4334 1.46 1.99 1.18 129 URI_HEX 4328 1.43 1.91 1.18 130 XM_GoogleGroups 4245 0.94 0.50 1.16 131 XM_H_Long_From02 4213 1.19 1.27 1.15 132 XMBdyGiftCard01 4117 1.18 1.28 1.12 133 TM2_M_VERY_LONG_WORD 4028 1.92 3.51 1.10 134 HELO_NODOT 3913 0.78 0.21 1.07 135 HELO_NO_DOMAIN 3906 0.78 0.21 1.07 136 XMStockSpam_06 3886 1.30 1.76 1.06 137 XM_OfRef6 3811 1.55 2.53 1.04 138 TooManyTo_004 3802 0.90 0.63 1.04 139 TVD_SPACE_RATIO 3715 0.71 0.12 1.01 140 XMCapTrack 3687 0.86 0.58 1.01 141 XM_B_SpammyWords4 3683 1.54 2.58 1.01 142 T_FILL_THIS_FORM_SHORT 3677 1.18 1.51 1.00 143 XM_UB50 3631 1.86 3.54 0.99 144 TR_XM_SEO4 3563 1.98 3.93 0.97 145 FROM_GOV_DKIM_AU 3561 0.79 0.42 0.97 146 TR_MetaPhish_Combo_01 3529 0.96 0.94 0.96 147 XM_H_Trusted_IP 3415 0.62 0.00 0.93 148 T_TooManySym_03 3338 0.66 0.18 0.91 149 XMBody_95 3301 0.66 0.19 0.90 150 TR_XM_DK_SendGrid 3282 0.88 0.85 0.90 151 DKIM_ADSP_CUSTOM_MED 3249 0.94 1.04 0.89 152 TR_XM_Base64_M1 3185 0.96 1.13 0.87 153 TooManyTo_005 3158 0.78 0.61 0.86 154 SpammyFromTLD_01 3057 1.13 1.70 0.84 155 HTTPS_HTTP_MISMATCH 2994 0.87 0.97 0.82 156 RELAYCOUNTRY_AU 2969 1.34 2.37 0.81 157 XM_B_COPY_HTML 2790 0.90 1.18 0.76 158 XMGenDplmaNmb 2789 0.97 1.36 0.76 159 THIS_AD 2549 0.90 1.29 0.70 160 XM_ShortIntro_01 2534 0.59 0.40 0.69 161 XMPhish14 2530 0.77 0.91 0.69 162 XMSubMetaI_00 2487 0.92 1.39 0.68 163 XMGappySubj_02 2472 0.46 0.04 0.68 164 RCVD_IN_BL_SPAMCOP_NET 2467 2.89 7.21 0.67 165 XM_ProductURIs 2320 0.88 1.36 0.63 166 XMNoVowels 2300 0.59 0.51 0.63 167 XMSubNoVowel 2269 0.56 0.44 0.62 168 URI_TRY_3LD 2262 0.95 1.59 0.62 169 T_OBFU_PDF_ATTACH 2254 0.46 0.17 0.62 170 T_XMHurry_00 2241 1.17 2.27 0.61 171 HTML_TAG_BALANCE_BODY 2227 0.89 1.45 0.61 172 RCVD_IN_PBL 2224 0.70 0.87 0.61 173 XM_B_FormFill 2165 0.45 0.16 0.59 174 FORGED_GMAIL_RCVD 2074 0.61 0.70 0.57 175 TR_XM_SpammyWords2 2072 4.75 12.90 0.57 176 XM_H_PHPMailer 2018 0.54 0.52 0.55 177 NML_ADSP_CUSTOM_MED 2013 0.63 0.79 0.55 178 T_Symld_Words_02 1949 0.61 0.76 0.53 179 XMPhish30 1928 0.82 1.40 0.53 180 TR_LOTS_OF_MONEY3 1907 1.20 2.54 0.52 181 XMMoneyMeta_00 1893 0.52 0.53 0.52 182 MPART_ALT_DIFF_COUNT 1745 0.59 0.80 0.48 183 RELAYCOUNTRY_GB 1717 0.56 0.74 0.47 184 HTML_IMAGE_ONLY_20 1711 0.46 0.45 0.47 185 XMBody_17 1701 1.29 2.89 0.46 186 XMLngstWrd_00 1693 0.43 0.38 0.46 187 TVD_RCVD_IP 1684 0.56 0.74 0.46 188 SpammyFromTLD_02 1671 0.85 1.61 0.46 189 XM_B_DNDMA 1623 0.71 1.24 0.44 190 RDNS_DYNAMIC 1594 0.58 0.85 0.44 191 FILL_THIS_FORM 1571 0.36 0.24 0.43 192 LongTLD 1565 0.53 0.73 0.43 193 TRACKER_ID 1564 0.32 0.11 0.43 194 USER_IN_WELCOMELIST 1560 0.28 0.00 0.43 195 USER_IN_WHITELIST 1560 0.28 0.00 0.43 196 XMSolicitRefs_0 1523 0.53 0.75 0.42 197 XMOemUri 1514 0.34 0.20 0.41 198 HTML_IMAGE_ONLY_32 1494 0.31 0.13 0.41 199 FROM_GOV_SPOOF 1456 0.30 0.10 0.40 200 HTML_IMAGE_ONLY_28 1427 0.38 0.36 0.39 ----------------------------------------------------------------------