Email: 510080 Autolearn: 0 AvgScore: 4.25 AvgScanTime: 1.47 sec Spam: 165066 Autolearn: 0 AvgScore: 13.52 AvgScanTime: 1.64 sec Ham: 345014 Autolearn: 0 AvgScore: -0.19 AvgScanTime: 1.39 sec Time Spent Running SA: 208.65 hours Time Spent Processing Spam: 75.37 hours Time Spent Processing Ham: 133.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158915 90.62 96.27 87.91 2 DKIM_SIGNED 151972 80.15 92.07 74.45 3 XM_DK_Pass 147970 78.11 89.64 72.59 4 DKIM_VALID 146498 77.18 88.75 71.65 5 XM_B_Unicode 138685 75.87 84.02 71.97 6 RELAYCOUNTRY_US 133897 78.90 81.12 77.84 7 XMListUnsubscribeExists 124363 58.61 75.34 50.60 8 XM_B_SpammyWords 118576 53.19 71.84 44.27 9 DCC_CHECK 114487 46.68 69.36 35.82 10 DKIM_VALID_AU 109206 60.22 66.16 57.37 11 RCVD_IN_MSPIKE_H2 81978 42.86 49.66 39.60 12 XM_B_Unicode3 75850 44.20 45.95 43.36 13 BAYES_50 71037 54.62 43.04 60.16 14 XM_DK_Undo_02 69855 18.08 42.32 6.48 15 XM_B_SpammyWords2 66965 25.95 40.57 18.95 16 FVGT_m_MULTI_ODD 66379 30.95 40.21 26.52 17 LOC_TINY_FONT_1 64977 29.32 39.36 24.52 18 HTML_FONT_LOW_CONTRAST 57179 30.41 34.64 28.38 19 TR_XM_DKIM_Undo 55109 13.75 33.39 4.36 20 DKIM_VALID_EF 53810 29.18 32.60 27.54 21 BAYES_99 51967 13.39 31.48 4.74 22 T_KAM_HTML_FONT_INVALID 51642 23.47 31.29 19.73 23 DCC_CHECK_NEGATIVE 50510 53.27 30.60 64.12 24 MIME_HTML_ONLY 47086 24.68 28.53 22.84 25 XMSubLong 41221 22.62 24.97 21.49 26 XM_Body_Dirty_Words 40328 18.40 24.43 15.52 27 BAYES_999 40313 10.40 24.42 3.69 28 TR_DCC_Bayes_99 37501 8.61 22.72 1.87 29 T_TM2_M_HEADER_IN_MSG 33479 24.71 20.28 26.83 30 RELAYCOUNTRY_META 32546 9.05 19.72 3.95 31 XM_Multi_Part_URI 31536 14.74 19.11 12.65 32 BOTNET_IPINHOSTNAME 27423 8.74 16.61 4.97 33 RCVD_IN_MSPIKE_WL 24570 16.97 14.88 17.96 34 XM_B_Unsub 24477 12.63 14.83 11.58 35 TR_XM_BayesUnsub 24057 11.60 14.57 10.18 36 TR_XM_SpammyRelay 22606 5.69 13.70 1.86 37 XM_B_SpammyWords3 21578 7.34 13.07 4.60 38 LOTS_OF_MONEY 21441 8.15 12.99 5.83 39 RCVD_IN_MSPIKE_H3 20114 11.80 12.19 11.62 40 UNPARSEABLE_RELAY 19079 9.75 11.56 8.89 41 TR_XM_SpammyWords4 18625 6.17 11.28 3.72 42 TR_XM_SpammyWords2 18376 4.21 11.13 0.90 43 XMSexyCombo_05 16182 7.93 9.80 7.03 44 BOTNET 15252 4.09 9.24 1.63 45 XM_Evil_Numbers_Gen 14940 8.54 9.05 8.30 46 MPART_ALT_DIFF 14815 6.19 8.98 4.86 47 RELAYCOUNTRY_CA 14565 3.60 8.82 1.11 48 BAYES_80 14477 5.83 8.77 4.43 49 XM_UncommonTLD01 13989 5.45 8.47 4.00 50 FSL_BULK_SIG 13800 5.01 8.36 3.41 51 RCVD_IN_BL_SPAMCOP_NET 13179 2.92 7.98 0.50 52 UNTRUSTED_Relay 13042 3.72 7.90 1.71 53 BAYES_60 12819 8.81 7.77 9.31 54 TR_XM_PhishingBody 12652 4.83 7.66 3.47 55 TR_XM_UnparsRelay 11729 3.59 7.11 1.91 56 HTML_IMAGE_RATIO_02 11464 6.65 6.95 6.52 57 LotsOfNums_01 11151 8.10 6.76 8.75 58 XM_SendGrid 10883 6.08 6.59 5.84 59 TR_XM_SPAMCOP 10868 2.32 6.58 0.28 60 XM_B_SpammyTLD 10728 3.69 6.50 2.35 61 XM_B_Phish_Phrases 10689 4.04 6.48 2.87 62 RCVD_IN_MSPIKE_BL 10661 2.48 6.46 0.57 63 TR_XM_MSPIKECOMBO 10597 2.46 6.42 0.57 64 XMSubMetaSx_00 9913 3.99 6.01 3.02 65 XM_B_Investor 9408 2.81 5.70 1.43 66 TR_XM_SpammyWords3 9367 2.09 5.67 0.37 67 URIBL_DBL_SPAM 9218 1.81 5.58 0.01 68 TM2_M_VERY_LONG_WORD 9083 2.98 5.50 1.77 69 MIME_HTML_ONLY_MULTI 8736 3.71 5.29 2.95 70 MIME_HTML_MOSTLY 8270 3.52 5.01 2.81 71 XM_H_Long_From01 8218 5.62 4.98 5.93 72 URI_PHP_REDIR 8046 1.58 4.87 0.00 73 XM_B_Phish66 8040 2.86 4.87 1.90 74 BAYES_95 7848 3.41 4.75 2.77 75 T_XMDrugObfuBody_14 7810 2.60 4.73 1.59 76 HTML_IMAGE_RATIO_04 7595 5.03 4.60 5.23 77 XMStrtUSub 7538 4.55 4.57 4.55 78 T_XMDrugObfuBody_08 7162 2.28 4.34 1.30 79 TR_XM_DK_SendGrid 7062 4.02 4.28 3.89 80 TooManyTo_001 6961 8.81 4.22 11.01 81 RCVD_IN_MSPIKE_L5 6950 1.38 4.21 0.02 82 HTML_MIME_NO_HTML_TAG 6670 2.87 4.04 2.31 83 HTML_IMAGE_RATIO_06 6604 3.80 4.00 3.70 84 URI_NOVOWEL 6596 3.09 4.00 2.66 85 XM_DIRTYINTL 6524 1.47 3.95 0.29 86 T_FILL_THIS_FORM_SHORT 6491 1.80 3.93 0.78 87 XM_OfRef6 6461 1.91 3.91 0.95 88 XM_SPF_SoftFail 6068 2.47 3.68 1.89 89 XM_UB50 5805 1.93 3.52 1.18 90 XMNumbers 5794 3.88 3.51 4.06 91 TR_XM_SpammyWords5 5611 1.98 3.40 1.29 92 DKIM_INVALID 5474 2.97 3.32 2.80 93 MIME_QP_LONG_LINE 5326 4.49 3.23 5.10 94 XMBody_17 5299 1.40 3.21 0.54 95 XM_GoogleGroups 5069 2.13 3.07 1.68 96 PDS_OTHER_BAD_TLD 5066 1.16 3.07 0.25 97 HTML_IMAGE_RATIO_08 4990 2.44 3.02 2.16 98 TM2_M_URI_OPT_OUT 4931 2.18 2.99 1.79 99 RCVD_IN_VALIDITY_SAFE 4920 4.27 2.98 4.89 100 XMLngstWrd_00 4824 1.58 2.92 0.94 101 XMLngstWrd_01 4781 1.54 2.90 0.89 102 SpammyFromTLD_02 4760 1.23 2.88 0.44 103 XMLngstWrd_02 4661 1.46 2.82 0.80 104 USER_IN_DEF_DKIM_WL 4415 9.65 2.67 12.99 105 SpammyFromTLD_01 4390 1.40 2.66 0.80 106 HTML_TITLE_SUBJ_DIFF 4348 1.22 2.63 0.54 107 XMLngstWrd_03 4262 1.33 2.58 0.74 108 XMLngstWrd_04 4185 1.28 2.54 0.68 109 RCVD_IN_MSPIKE_H4 4162 4.48 2.52 5.41 110 XMDiploma_00 4160 4.27 2.52 5.11 111 UPPERCASE_75_100 4057 1.16 2.46 0.53 112 FROM_EXCESS_BASE64 4019 2.50 2.43 2.54 113 RCVD_IN_VALIDITY_CERTIFIED 4011 3.75 2.43 4.39 114 T_TooManySym_01 3780 4.97 2.29 6.26 115 XM_B_Unsub2 3727 1.70 2.26 1.43 116 TR_XM_FormFill 3709 0.74 2.25 0.01 117 XM_B_SpammyWords4 3677 1.37 2.23 0.96 118 HTTPS_HTTP_MISMATCH 3664 1.36 2.22 0.94 119 XM_B_COVIDMETA 3649 0.93 2.21 0.32 120 XM_DK_Undo_01 3616 1.67 2.19 1.42 121 RELAYCOUNTRY_IN 3530 0.74 2.14 0.07 122 RCVD_IN_IADB_LISTED 3423 3.85 2.07 4.70 123 XM_CamelCaseFrm001 3416 1.97 2.07 1.92 124 XMSexyCombo_01 3354 1.04 2.03 0.57 125 RCVD_IN_MSPIKE_L3 3298 0.97 2.00 0.48 126 MAILING_LIST_MULTI 3210 2.27 1.94 2.42 127 T_XMHurry_00 3106 0.96 1.88 0.52 128 T_REMOTE_IMAGE 3098 2.98 1.88 3.51 129 TR_XM_NoHeaderRelay 3059 0.67 1.85 0.11 130 RCVD_IN_IADB_SPF 3024 3.46 1.83 4.24 131 XMBdyGiftCard01 2933 1.44 1.78 1.27 132 XM_B_SEO 2841 0.64 1.72 0.13 133 RCVD_IN_IADB_DK 2839 3.11 1.72 3.78 134 RCVD_IN_IADB_SENDERID 2816 3.17 1.71 3.87 135 TR_XM_COVIDMETA4 2807 0.65 1.70 0.15 136 XMStockSpam_06 2773 1.41 1.68 1.28 137 TR_XM_SEO4 2683 0.57 1.63 0.07 138 SUBJ_ALL_CAPS 2655 1.77 1.61 1.85 139 TR_XM_SB_Phish 2617 2.07 1.59 2.30 140 BAYES_40 2541 3.64 1.54 4.65 141 XMSubPhish11 2515 2.03 1.52 2.27 142 FONT_INVIS_LONG_LINE 2482 0.53 1.50 0.06 143 XM_URI_RBL 2406 0.57 1.46 0.14 144 XMHTML_After_End 2402 1.09 1.46 0.92 145 TR_XM_InvalidRelay 2376 0.48 1.44 0.02 146 ALL_TRUSTED 2368 13.24 1.43 18.88 147 T_XMDrugObfuBody_00 2359 0.84 1.43 0.55 148 KHOP_HELO_FCRDNS 2305 1.35 1.40 1.33 149 HK_RANDOM_REPLYTO 2295 0.50 1.39 0.08 150 XM_UB99 2275 0.45 1.38 0.01 151 T_Symld_Words_02 2273 0.76 1.38 0.46 152 URI_HEX 2253 1.37 1.36 1.37 153 URIBL_BLACK 2253 0.48 1.36 0.06 154 TR_XM_Base64_M1 2232 1.00 1.35 0.82 155 TR_XM_PHPDW 2190 0.63 1.33 0.30 156 TR_XM_PHPForged 2126 0.60 1.29 0.27 157 XMGenDplmaNmb 2095 0.84 1.27 0.63 158 TR_XM_FormFill2 2082 0.59 1.26 0.26 159 XM_H_PHPOS 2079 0.58 1.26 0.26 160 URI_TRY_3LD 2070 0.83 1.25 0.62 161 TR_XM_COVIDMETA1 2066 0.50 1.25 0.14 162 RELAYCOUNTRY_AU 2042 0.60 1.24 0.30 163 TR_XM_BayesRelay 1959 0.39 1.19 0.00 164 HTML_TAG_BALANCE_BODY 1949 0.89 1.18 0.75 165 TR_LOTS_OF_MONEY3 1941 0.53 1.18 0.23 166 RELAYCOUNTRY_FR 1889 0.55 1.14 0.26 167 RCVD_IN_VALIDITY_RPBL 1877 0.42 1.14 0.07 168 NORDNS_LOW_CONTRAST 1819 0.41 1.10 0.08 169 SHOPIFY_IMG_NOT_RCVD_SFY 1807 0.54 1.09 0.27 170 BAYES_20 1805 2.90 1.09 3.77 171 REMOVE_BEFORE_LINK 1804 0.50 1.09 0.22 172 LongTLD 1804 0.54 1.09 0.27 173 XMReplyNow 1773 0.51 1.07 0.24 174 NO_DNS_FOR_FROM 1764 0.53 1.07 0.27 175 XMPhish30 1747 0.76 1.06 0.62 176 MPART_ALT_DIFF_COUNT 1730 0.75 1.05 0.60 177 TR_XM_MSPIKECOMBO2 1711 0.36 1.04 0.03 178 DKIM_ADSP_NXDOMAIN 1696 0.51 1.03 0.26 179 TR_XM_MaxWHORU 1688 0.47 1.02 0.21 180 XM_UB60 1686 0.42 1.02 0.13 181 XM_Body_Dirty_Words_01 1679 0.40 1.02 0.10 182 XM_H_Undi_Recip 1674 0.46 1.01 0.20 183 XM_B_DNDMA 1666 0.59 1.01 0.38 184 TR_XM_PhishingBody3 1656 0.40 1.00 0.12 185 XMBrknScrpt_02 1626 0.76 0.99 0.65 186 BAYES_00 1592 5.84 0.96 8.17 187 XM_UB999 1564 0.31 0.95 0.00 188 XMHTMLBadTable_001 1561 0.71 0.95 0.59 189 XM_UB80 1554 0.32 0.94 0.02 190 RCVD_IN_IADB_VOUCHED 1552 2.19 0.94 2.79 191 XMSubMetaI_00 1530 0.66 0.93 0.53 192 BOTNET_NORDNS 1526 0.31 0.92 0.01 193 TR_Symld_Words 1522 1.41 0.92 1.64 194 RCVD_IN_PSBL 1480 0.56 0.90 0.40 195 XM_H_Long_From02 1436 1.11 0.87 1.23 196 XM_OfRef7 1382 0.35 0.84 0.12 197 TR_XM_MaxSPIKE 1365 0.28 0.83 0.02 198 FROM_SUSPICIOUS_NTLD 1362 0.31 0.83 0.06 199 DKIM_ADSP_CUSTOM_MED 1354 0.90 0.82 0.94 200 XMPhish14 1345 0.57 0.81 0.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 303301 90.62 96.27 87.91 2 RELAYCOUNTRY_US 268557 78.90 81.12 77.84 3 DKIM_SIGNED 256852 80.15 92.07 74.45 4 XM_DK_Pass 250462 78.11 89.64 72.59 5 XM_B_Unicode 248311 75.87 84.02 71.97 6 DKIM_VALID 247191 77.18 88.75 71.65 7 DCC_CHECK_NEGATIVE 221231 53.27 30.60 64.12 8 BAYES_50 207563 54.62 43.04 60.16 9 DKIM_VALID_AU 197950 60.22 66.16 57.37 10 XMListUnsubscribeExists 174582 58.61 75.34 50.60 11 XM_B_SpammyWords 152738 53.19 71.84 44.27 12 XM_B_Unicode3 149600 44.20 45.95 43.36 13 RCVD_IN_MSPIKE_H2 136630 42.86 49.66 39.60 14 DCC_CHECK 123598 46.68 69.36 35.82 15 HTML_FONT_LOW_CONTRAST 97914 30.41 34.64 28.38 16 DKIM_VALID_EF 95025 29.18 32.60 27.54 17 T_TM2_M_HEADER_IN_MSG 92554 24.71 20.28 26.83 18 FVGT_m_MULTI_ODD 91510 30.95 40.21 26.52 19 LOC_TINY_FONT_1 84589 29.32 39.36 24.52 20 MIME_HTML_ONLY 78812 24.68 28.53 22.84 21 XMSubLong 74147 22.62 24.97 21.49 22 T_KAM_HTML_FONT_INVALID 68088 23.47 31.29 19.73 23 XM_B_SpammyWords2 65378 25.95 40.57 18.95 24 ALL_TRUSTED 65152 13.24 1.43 18.88 25 RCVD_IN_MSPIKE_WL 61968 16.97 14.88 17.96 26 XM_Body_Dirty_Words 53544 18.40 24.43 15.52 27 USER_IN_DEF_DKIM_WL 44810 9.65 2.67 12.99 28 XM_Multi_Part_URI 43637 14.74 19.11 12.65 29 RCVD_IN_MSPIKE_H3 40077 11.80 12.19 11.62 30 XM_B_Unsub 39941 12.63 14.83 11.58 31 TooManyTo_001 37980 8.81 4.22 11.01 32 TR_XM_BayesUnsub 35110 11.60 14.57 10.18 33 BAYES_60 32138 8.81 7.77 9.31 34 UNPARSEABLE_RELAY 30666 9.75 11.56 8.89 35 LotsOfNums_01 30176 8.10 6.76 8.75 36 XM_DKIMWhitelistDomains 30061 5.94 0.13 8.71 37 XM_Evil_Numbers_Gen 28644 8.54 9.05 8.30 38 BAYES_00 28173 5.84 0.96 8.17 39 XMSexyCombo_05 24262 7.93 9.80 7.03 40 HTML_IMAGE_RATIO_02 22479 6.65 6.95 6.52 41 XM_DK_Undo_02 22365 18.08 42.32 6.48 42 T_TooManySym_01 21590 4.97 2.29 6.26 43 IN_ZIMBRA_NJ_WHITELIST 20964 4.14 0.08 6.08 44 XM_H_Long_From01 20466 5.62 4.98 5.93 45 XM_SendGrid 20141 6.08 6.59 5.84 46 LOTS_OF_MONEY 20110 8.15 12.99 5.83 47 TR_XM_DK_Bayes 19260 4.00 0.70 5.58 48 TR_XM_DK_Bayes1 18859 3.86 0.51 5.47 49 RCVD_IN_MSPIKE_H4 18675 4.48 2.52 5.41 50 HTML_IMAGE_RATIO_04 18050 5.03 4.60 5.23 51 XMDiploma_00 17640 4.27 2.52 5.11 52 MIME_QP_LONG_LINE 17597 4.49 3.23 5.10 53 BOTNET_IPINHOSTNAME 17161 8.74 16.61 4.97 54 RCVD_IN_VALIDITY_SAFE 16865 4.27 2.98 4.89 55 MPART_ALT_DIFF 16781 6.19 8.98 4.86 56 TR_XM_DK_Bayes2 16752 3.43 0.44 4.86 57 BAYES_99 16355 13.39 31.48 4.74 58 RCVD_IN_IADB_LISTED 16206 3.85 2.07 4.70 59 BAYES_40 16033 3.64 1.54 4.65 60 XM_B_SpammyWords3 15855 7.34 13.07 4.60 61 XMStrtUSub 15687 4.55 4.57 4.55 62 BAYES_80 15275 5.83 8.77 4.43 63 RCVD_IN_VALIDITY_CERTIFIED 15141 3.75 2.43 4.39 64 TR_XM_DKIM_Undo 15046 13.75 33.39 4.36 65 RCVD_IN_IADB_SPF 14637 3.46 1.83 4.24 66 XM_PDF 14091 2.95 0.59 4.08 67 XMNumbers 14008 3.88 3.51 4.06 68 T_TooManySym_02 13914 2.99 0.81 4.03 69 XM_UncommonTLD01 13814 5.45 8.47 4.00 70 RELAYCOUNTRY_META 13611 9.05 19.72 3.95 71 TR_XM_DK_SendGrid 13433 4.02 4.28 3.89 72 RCVD_IN_IADB_SENDERID 13341 3.17 1.71 3.87 73 RCVD_IN_IADB_DK 13028 3.11 1.72 3.78 74 BAYES_20 13005 2.90 1.09 3.77 75 TR_XM_SpammyWords4 12845 6.17 11.28 3.72 76 HTML_IMAGE_RATIO_06 12765 3.80 4.00 3.70 77 BAYES_999 12744 10.40 24.42 3.69 78 LONGWORDS 12640 2.49 0.02 3.66 79 T_REMOTE_IMAGE 12103 2.98 1.88 3.51 80 TR_XM_PhishingBody 11989 4.83 7.66 3.47 81 FSL_BULK_SIG 11764 5.01 8.36 3.41 82 XMSubMetaSx_00 10415 3.99 6.01 3.02 83 MIME_HTML_ONLY_MULTI 10170 3.71 5.29 2.95 84 XM_B_Phish_Phrases 9897 4.04 6.48 2.87 85 MIME_HTML_MOSTLY 9695 3.52 5.01 2.81 86 DKIM_INVALID 9661 2.97 3.32 2.80 87 RCVD_IN_IADB_VOUCHED 9641 2.19 0.94 2.79 88 BAYES_95 9552 3.41 4.75 2.77 89 URI_NOVOWEL 9188 3.09 4.00 2.66 90 FROM_EXCESS_BASE64 8751 2.50 2.43 2.54 91 MAILING_LIST_MULTI 8362 2.27 1.94 2.42 92 XM_B_SpammyTLD 8100 3.69 6.50 2.35 93 HTML_MIME_NO_HTML_TAG 7975 2.87 4.04 2.31 94 TR_XM_SB_Phish 7919 2.07 1.59 2.30 95 XMSubPhish11 7842 2.03 1.52 2.27 96 HTML_IMAGE_RATIO_08 7447 2.44 3.02 2.16 97 BAYES_05 6918 1.55 0.59 2.01 98 INVALID_MSGID 6734 1.36 0.12 1.95 99 XM_CamelCaseFrm001 6613 1.97 2.07 1.92 100 TR_XM_UnparsRelay 6602 3.59 7.11 1.91 101 XM_B_Phish66 6565 2.86 4.87 1.90 102 XM_SPF_SoftFail 6530 2.47 3.68 1.89 103 TooManyTo_002 6466 1.42 0.46 1.87 104 TR_DCC_Bayes_99 6435 8.61 22.72 1.87 105 TR_XM_SpammyRelay 6418 5.69 13.70 1.86 106 TO_MALFORMED 6390 1.26 0.02 1.85 107 SUBJ_ALL_CAPS 6376 1.77 1.61 1.85 108 IN_HORDE_ADDRESS_BOOK 6337 1.27 0.09 1.84 109 RCVD_IN_IADB_OPTIN 6298 1.40 0.51 1.83 110 MSGID_NOFQDN1 6259 1.23 0.02 1.81 111 TM2_M_URI_OPT_OUT 6184 2.18 2.99 1.79 112 TM2_M_VERY_LONG_WORD 6102 2.98 5.50 1.77 113 ANY_BOUNCE_MESSAGE 5938 1.39 0.70 1.72 114 BOUNCE_MESSAGE 5937 1.39 0.70 1.72 115 UNTRUSTED_Relay 5915 3.72 7.90 1.71 116 TVD_RCVD_IP 5791 1.21 0.24 1.68 117 XM_GoogleGroups 5785 2.13 3.07 1.68 118 TR_Symld_Words 5649 1.41 0.92 1.64 119 BOTNET 5624 4.09 9.24 1.63 120 T_XMDrugObfuBody_14 5472 2.60 4.73 1.59 121 HTML_FONT_FACE_BAD 5471 1.30 0.70 1.59 122 T_TooManySym_03 5424 1.16 0.30 1.57 123 TVD_SPACE_RATIO 5229 1.04 0.05 1.52 124 XM_H_Trusted_IP 5044 0.99 0.00 1.46 125 XM_B_Investor 4936 2.81 5.70 1.43 126 XM_B_Unsub2 4934 1.70 2.26 1.43 127 XM_DK_Undo_01 4910 1.67 2.19 1.42 128 HELO_NODOT 4757 1.10 0.51 1.38 129 HELO_NO_DOMAIN 4755 1.10 0.51 1.38 130 URI_HEX 4710 1.37 1.36 1.37 131 KHOP_HELO_FCRDNS 4582 1.35 1.40 1.33 132 T_XMDrugObfuBody_08 4483 2.28 4.34 1.30 133 TR_XM_SpammyWords5 4466 1.98 3.40 1.29 134 XMStockSpam_06 4406 1.41 1.68 1.28 135 XMGappySubj_01 4393 0.97 0.32 1.27 136 XMBdyGiftCard01 4393 1.44 1.78 1.27 137 TooManyTo_003 4370 0.98 0.40 1.27 138 XM_H_Long_From02 4248 1.11 0.87 1.23 139 XMBSHREFv2 4087 0.92 0.36 1.18 140 XM_UB50 4056 1.93 3.52 1.18 141 RELAYCOUNTRY_CA 3821 3.60 8.82 1.11 142 XMCapTrack 3655 0.82 0.32 1.06 143 RCVD_IN_RP_SAFE 3353 0.87 0.66 0.97 144 XMBody_95 3349 0.70 0.14 0.97 145 TR_MetaPhish_Combo_01 3340 0.91 0.80 0.97 146 XM_B_SpammyWords4 3310 1.37 2.23 0.96 147 XM_OfRef6 3266 1.91 3.91 0.95 148 HTTPS_HTTP_MISMATCH 3260 1.36 2.22 0.94 149 XMLngstWrd_00 3260 1.58 2.92 0.94 150 DKIM_ADSP_CUSTOM_MED 3250 0.90 0.82 0.94 151 RCVD_IN_MSPIKE_H5 3216 0.69 0.18 0.93 152 XMHTML_After_End 3172 1.09 1.46 0.92 153 TooManyTo_004 3113 0.72 0.34 0.90 154 TR_XM_SpammyWords2 3107 4.21 11.13 0.90 155 XMLngstWrd_01 3060 1.54 2.90 0.89 156 FVGT_m_MULTI_ODD_EMAIL 3035 0.64 0.14 0.88 157 RCVD_IN_RP_CERTIFIED 3032 0.77 0.53 0.88 158 TR_XM_Base64_M1 2844 1.00 1.35 0.82 159 XMLngstWrd_02 2766 1.46 2.82 0.80 160 SpammyFromTLD_01 2753 1.40 2.66 0.80 161 T_FILL_THIS_FORM_SHORT 2675 1.80 3.93 0.78 162 HTML_TAG_BALANCE_BODY 2579 0.89 1.18 0.75 163 XMLngstWrd_03 2544 1.33 2.58 0.74 164 TooManyTo_005 2471 0.58 0.30 0.72 165 XMLngstWrd_04 2359 1.28 2.54 0.68 166 URI_GOOGLE_PROXY 2281 0.50 0.15 0.66 167 FROM_GOV_DKIM_AU 2269 0.54 0.29 0.66 168 XMBrknScrpt_02 2259 0.76 0.99 0.65 169 XMGenDplmaNmb 2182 0.84 1.27 0.63 170 XMPhish30 2148 0.76 1.06 0.62 171 URI_TRY_3LD 2141 0.83 1.25 0.62 172 MPART_ALT_DIFF_COUNT 2075 0.75 1.05 0.60 173 NML_ADSP_CUSTOM_MED 2060 0.63 0.69 0.60 174 XM_B_COPY_HTML 2052 0.59 0.59 0.59 175 XMHTMLBadTable_001 2051 0.71 0.95 0.59 176 MISSING_HEADERS 2043 0.52 0.35 0.59 177 RCVD_IN_MSPIKE_BL 1966 2.48 6.46 0.57 178 XMSexyCombo_01 1962 1.04 2.03 0.57 179 TR_XM_MSPIKECOMBO 1951 2.46 6.42 0.57 180 HTML_IMAGE_ONLY_20 1929 0.54 0.51 0.56 181 FORGED_GMAIL_RCVD 1925 0.60 0.69 0.56 182 T_OBFU_PDF_ATTACH 1911 0.42 0.13 0.55 183 T_XMDrugObfuBody_00 1905 0.84 1.43 0.55 184 XM_ShortIntro_01 1881 0.48 0.35 0.55 185 HTML_TITLE_SUBJ_DIFF 1879 1.22 2.63 0.54 186 XMBody_17 1867 1.40 3.21 0.54 187 XMSubMetaI_00 1843 0.66 0.93 0.53 188 XMNoVowels 1843 0.53 0.53 0.53 189 UPPERCASE_75_100 1843 1.16 2.46 0.53 190 T_XMHurry_00 1796 0.96 1.88 0.52 191 XMhairloss01 1784 0.37 0.05 0.52 192 RELAYCOUNTRY_GB 1724 0.56 0.69 0.50 193 RCVD_IN_BL_SPAMCOP_NET 1724 2.92 7.98 0.50 194 XM_H_PHPMailer 1693 0.55 0.68 0.49 195 RCVD_IN_MSPIKE_L3 1671 0.97 2.00 0.48 196 XMOemUri 1657 0.41 0.27 0.48 197 XM_ProductURIs 1652 0.53 0.63 0.48 198 XMSubNoVowel 1604 0.43 0.35 0.46 199 T_Symld_Words_02 1603 0.76 1.38 0.46 200 XMPhish14 1567 0.57 0.81 0.45 ----------------------------------------------------------------------