Email: 516639 Autolearn: 0 AvgScore: 3.93 AvgScanTime: 1.37 sec Spam: 163581 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.50 sec Ham: 353058 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.31 sec Time Spent Running SA: 196.95 hours Time Spent Processing Spam: 68.15 hours Time Spent Processing Ham: 128.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155686 88.41 95.17 85.27 2 DKIM_SIGNED 144963 78.37 88.62 73.63 3 XM_B_Unicode 140190 74.40 85.70 69.17 4 XM_DK_Pass 139561 76.41 85.32 72.29 5 DKIM_VALID 137963 75.35 84.34 71.19 6 T_SCC_BODY_TEXT_LINE 133567 82.65 81.65 83.11 7 RELAYCOUNTRY_US 130122 80.42 79.55 80.82 8 DCC_CHECK 121470 46.11 74.26 33.07 9 XM_B_SpammyWords 117913 52.06 72.08 42.79 10 XMListUnsubscribeExists 116676 55.62 71.33 48.34 11 DKIM_VALID_AU 100437 57.86 61.40 56.23 12 XM_B_Unicode3 76704 41.72 46.89 39.32 13 XM_DK_Undo_02 74253 18.26 45.39 5.69 14 XM_B_SpammyWords2 68956 25.47 42.15 17.75 15 LOC_TINY_FONT_1 65435 28.76 40.00 23.54 16 BAYES_50 63544 52.06 38.85 58.18 17 HTML_FONT_LOW_CONTRAST 58853 28.76 35.98 25.42 18 TR_XM_DKIM_Undo 57764 12.77 35.31 2.33 19 BAYES_99 57694 14.20 35.27 4.44 20 MIME_HTML_ONLY 56280 23.58 34.40 18.57 21 DKIM_VALID_EF 53937 29.60 32.97 28.04 22 FVGT_m_MULTI_ODD 51625 26.75 31.56 24.52 23 T_KAM_HTML_FONT_INVALID 47858 23.63 29.26 21.03 24 BAYES_999 45807 11.18 28.00 3.38 25 TR_DCC_Bayes_99 42332 9.40 25.88 1.76 26 DCC_CHECK_NEGATIVE 42089 53.85 25.73 66.88 27 XMSubLong 40247 23.74 24.60 23.33 28 TR_XM_DK_Unsub 39883 16.52 24.38 12.88 29 RCVD_IN_MSPIKE_H2 36937 22.11 22.58 21.89 30 T_TM2_M_HEADER_IN_MSG 36353 27.09 22.22 29.34 31 RELAYCOUNTRY_META 32937 9.12 20.13 4.01 32 XM_Multi_Part_URI 32428 14.98 19.82 12.74 33 XM_B_Unsub 27629 10.89 16.89 8.11 34 TR_XM_SpammyRelay 27073 6.72 16.55 2.16 35 TR_XM_BayesUnsub 26532 9.57 16.22 6.49 36 BOTNET_IPINHOSTNAME 25662 8.04 15.69 4.49 37 RCVD_IN_BL_SPAMCOP_NET 24112 5.17 14.74 0.73 38 UNPARSEABLE_RELAY 23316 11.23 14.25 9.84 39 TR_XM_SpammyWords2 21824 4.50 13.34 0.40 40 XM_B_SpammyWords3 21780 6.88 13.31 3.91 41 XM_Body_Dirty_Words 21174 8.04 12.94 5.77 42 LOTS_OF_MONEY 19975 7.65 12.21 5.54 43 RELAYCOUNTRY_CA 19555 4.43 11.95 0.94 44 TR_XM_SPAMCOP 18983 3.85 11.60 0.26 45 BOTNET 18936 4.58 11.58 1.35 46 RCVD_IN_MSPIKE_H3 17875 7.89 10.93 6.49 47 RCVD_IN_MSPIKE_WL 17875 7.89 10.93 6.49 48 TR_XM_SpammyWords4 17712 5.95 10.83 3.69 49 FSL_BULK_SIG 16376 5.45 10.01 3.34 50 XM_Evil_Numbers_Gen 15757 8.44 9.63 7.89 51 BAYES_80 14184 5.41 8.67 3.90 52 BAYES_60 12964 8.48 7.93 8.73 53 LotsOfNums_01 11956 8.07 7.31 8.42 54 TR_XM_UnparsRelay 11761 3.27 7.19 1.45 55 HTML_IMAGE_RATIO_02 11609 5.61 7.10 4.92 56 XM_UncommonTLD01 10728 4.62 6.56 3.72 57 XMSexyCombo_05 10449 3.39 6.39 2.01 58 XMSubMetaSx_00 9466 4.30 5.79 3.61 59 XM_H_Long_From01 9386 5.82 5.74 5.85 60 MPART_ALT_DIFF 9249 4.58 5.65 4.08 61 XMBody_17 9201 2.13 5.62 0.51 62 UNTRUSTED_Relay 8941 2.80 5.47 1.56 63 TooManyTo_001 8920 7.91 5.45 9.05 64 TR_XM_SpammyWords5 8685 2.64 5.31 1.41 65 BAYES_95 8497 3.36 5.19 2.51 66 XM_H_GMP 8255 6.00 5.05 6.44 67 HTML_IMAGE_RATIO_06 8176 3.89 5.00 3.38 68 HTML_IMAGE_RATIO_04 8101 4.49 4.95 4.28 69 XM_OfRef6 7856 2.29 4.80 1.13 70 XM_B_Investor 7784 2.79 4.76 1.88 71 XM_B_Phish_Phrases 7738 3.80 4.73 3.36 72 TR_XM_BayesRelay 7672 1.49 4.69 0.00 73 XMNumbers 7227 3.13 4.42 2.54 74 DKIM_INVALID 7000 3.02 4.28 2.44 75 T_FILL_THIS_FORM_SHORT 6982 2.03 4.27 1.00 76 TR_XM_PhishingBody 6772 2.68 4.14 2.00 77 XM_SPF_SoftFail 6702 3.45 4.10 3.15 78 XM_B_SpammyTLD 6179 3.16 3.78 2.87 79 MIME_HTML_ONLY_MULTI 5930 2.88 3.63 2.54 80 XMStrtUSub 5756 4.29 3.52 4.65 81 RCVD_IN_VALIDITY_SAFE 5752 3.83 3.52 3.97 82 HTML_IMAGE_RATIO_08 5646 2.87 3.45 2.60 83 MIME_HTML_MOSTLY 5491 2.47 3.36 2.06 84 T_XMDrugObfuBody_14 5407 2.26 3.31 1.78 85 TM2_M_URI_OPT_OUT 5365 2.33 3.28 1.89 86 T_TooManySym_01 5297 4.82 3.24 5.56 87 MIME_QP_LONG_LINE 5188 4.67 3.17 5.37 88 SpammyFromTLD_01 5163 1.57 3.16 0.83 89 FONT_INVIS_LONG_LINE 5118 1.03 3.13 0.05 90 T_XMDrugObfuBody_08 5056 2.09 3.09 1.63 91 RCVD_IN_VALIDITY_CERTIFIED 4864 3.24 2.97 3.36 92 TR_XM_FormFill 4726 0.93 2.89 0.02 93 XM_CamelCaseFrm001 4664 2.30 2.85 2.05 94 XM_UB50 4503 1.46 2.75 0.85 95 TM2_M_VERY_LONG_WORD 4420 1.66 2.70 1.18 96 HK_RANDOM_REPLYTO 4239 0.88 2.59 0.08 97 T_XMHurry_00 4200 1.28 2.57 0.68 98 XM_B_Unsub2 4144 1.85 2.53 1.54 99 SUBJ_ALL_CAPS 4139 1.87 2.53 1.56 100 XM_B_SpammyWords4 4084 1.15 2.50 0.53 101 TR_Mismatch_TLD_02 4060 0.86 2.48 0.10 102 USER_IN_DEF_DKIM_WL 3979 8.81 2.43 11.76 103 T_XMDrugObfuBody_00 3909 1.19 2.39 0.63 104 XM_URI_RBL 3901 0.86 2.38 0.15 105 XMDiploma_00 3845 1.67 2.35 1.36 106 FROM_EXCESS_BASE64 3446 2.17 2.11 2.20 107 RELAYCOUNTRY_AU 3438 1.27 2.10 0.89 108 XM_DIRTYINTL 3295 0.85 2.01 0.31 109 TR_LOTS_OF_MONEY3 3248 0.84 1.99 0.31 110 TR_XM_NoHeaderRelay 3167 0.70 1.94 0.13 111 URI_HEX 3061 1.29 1.87 1.02 112 ANY_BOUNCE_MESSAGE 3053 3.81 1.87 4.71 113 BOUNCE_MESSAGE 3053 3.81 1.87 4.71 114 HTML_MIME_NO_HTML_TAG 3045 1.91 1.86 1.94 115 MAILING_LIST_MULTI 3024 2.41 1.85 2.67 116 SpammyFromTLD_02 2973 0.91 1.82 0.50 117 XMBdyGiftCard01 2948 0.94 1.80 0.54 118 BOTNET_NORDNS 2858 0.56 1.75 0.01 119 T_REMOTE_IMAGE 2821 2.92 1.72 3.47 120 TR_XM_PHPDW 2770 0.79 1.69 0.38 121 XMStockSpam_06 2747 1.36 1.68 1.21 122 RCVD_IN_IADB_LISTED 2714 3.75 1.66 4.72 123 TR_XM_PHPForged 2706 0.78 1.65 0.37 124 XM_H_Long_From02 2690 1.18 1.64 0.96 125 HTML_TAG_BALANCE_BODY 2662 0.83 1.63 0.46 126 XM_H_Undi_Recip 2586 0.65 1.58 0.21 127 TR_XM_INV_DKIM 2580 0.54 1.58 0.06 128 TR_XM_FormFill2 2578 0.75 1.58 0.37 129 BAYES_40 2568 3.84 1.57 4.90 130 XM_H_PHPOS 2555 0.73 1.56 0.34 131 XMPhish30 2526 0.91 1.54 0.61 132 DIET_1 2498 0.63 1.53 0.21 133 RCVD_IN_IADB_SPF 2467 3.34 1.51 4.19 134 TR_Mismatch_TLD_01 2442 0.74 1.49 0.39 135 ALL_TRUSTED 2343 11.50 1.43 16.16 136 RCVD_IN_IADB_SENDERID 2342 3.05 1.43 3.80 137 RCVD_IN_IADB_DK 2340 2.99 1.43 3.71 138 XM_DK_Undo_01 2339 1.77 1.43 1.93 139 KHOP_HELO_FCRDNS 2333 1.37 1.43 1.35 140 XM_SendGrid 2320 1.34 1.42 1.31 141 AC_BR_BONANZA 2291 0.50 1.40 0.08 142 TR_Caps_n_Bayes_99 2261 0.50 1.38 0.10 143 URI_TRY_3LD 2207 0.79 1.35 0.53 144 FILL_THIS_FORM 2169 0.78 1.33 0.52 145 TR_LOTS_OF_MONEY2 2093 0.48 1.28 0.11 146 T_MONEY_PERCENT 2093 0.48 1.28 0.11 147 XMBody_78 2032 0.59 1.24 0.29 148 XMSexyCombo_01 2030 0.60 1.24 0.30 149 XMGenDplmaNmb 1999 0.89 1.22 0.73 150 HTTPS_HTTP_MISMATCH 1980 1.01 1.21 0.91 151 SHOPIFY_IMG_NOT_RCVD_SFY 1979 0.55 1.21 0.24 152 XMReplyNow 1969 0.57 1.20 0.27 153 TR_XM_Undi_Recip5 1965 0.39 1.20 0.02 154 RCVD_IN_PSBL 1953 0.55 1.19 0.25 155 TR_XM_Undi_Recip11 1952 0.41 1.19 0.05 156 DKIM_ADSP_CUSTOM_MED 1930 1.00 1.18 0.91 157 BAYES_20 1928 2.78 1.18 3.52 158 RDNS_DYNAMIC 1838 0.65 1.12 0.43 159 URI_NOVOWEL 1816 1.54 1.11 1.74 160 TR_XM_Undi_RecipCombo2 1813 0.35 1.11 0.01 161 RCVD_IN_VALIDITY_RPBL 1794 0.38 1.10 0.04 162 UNDISC_MONEY 1750 0.35 1.07 0.01 163 NML_ADSP_CUSTOM_MED 1749 0.77 1.07 0.63 164 FILL_THIS_FORM_LONG 1733 0.52 1.06 0.27 165 XMBrknScrpt_02 1732 0.60 1.06 0.38 166 TM2_M_OBFU_COMMENT 1721 0.48 1.05 0.22 167 FORGED_GMAIL_RCVD 1711 0.67 1.05 0.50 168 XMLngstWrd_00 1703 0.83 1.04 0.74 169 TR_XM_Base64_M1 1686 0.73 1.03 0.59 170 XMSubMetaSxObfu_03 1667 0.58 1.02 0.38 171 XM_HighProb1 1636 0.32 1.00 0.00 172 XM_H_PHPMailer 1635 0.96 1.00 0.94 173 XM_ProductURIs 1616 0.62 0.99 0.44 174 XMPhish14 1583 0.79 0.97 0.71 175 XM_UB99 1548 0.30 0.95 0.00 176 PDS_OTHER_BAD_TLD 1548 0.41 0.95 0.17 177 MONEY_FORM 1548 0.31 0.95 0.01 178 XM_B_COVIDMETA 1539 0.48 0.94 0.26 179 MONEY_FRAUD_8 1529 0.30 0.93 0.00 180 XMSubMetaI_00 1527 0.75 0.93 0.66 181 XM_B_Phish66 1507 0.50 0.92 0.30 182 RELAYCOUNTRY_FR 1500 0.43 0.92 0.21 183 PLING_QUERY 1493 0.51 0.91 0.32 184 TR_Symld_Words 1489 1.33 0.91 1.52 185 XMHTML_After_End 1488 0.90 0.91 0.90 186 TR_XM_Undi_Recip9 1488 0.29 0.91 0.00 187 T_XMDrugObfuBody_10 1483 0.30 0.91 0.02 188 XMSlimDrugH 1476 0.47 0.90 0.28 189 DEAR_BENEFICIARY 1460 0.28 0.89 0.00 190 T_FILL_THIS_FORM_FRAUD_PHISH 1455 0.36 0.89 0.11 191 TR_XM_DK_SendGrid 1450 0.88 0.89 0.87 192 TR_XM_InvalidRelay 1431 0.30 0.87 0.03 193 ADVANCE_FEE_5_NEW_FRM_MNY 1428 0.28 0.87 0.00 194 MONEY_ATM_CARD 1400 0.27 0.86 0.00 195 TR_XM_Spammywords 1359 0.47 0.83 0.30 196 XM_S_SpammyWords 1359 0.47 0.83 0.30 197 URIBL_DBL_SPAM 1355 0.27 0.83 0.01 198 NO_DNS_FOR_FROM 1342 0.42 0.82 0.23 199 NORDNS_LOW_CONTRAST 1336 0.32 0.82 0.09 200 REMOVE_BEFORE_LINK 1330 0.38 0.81 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301061 88.41 95.17 85.27 2 T_SCC_BODY_TEXT_LINE 293431 82.65 81.65 83.11 3 RELAYCOUNTRY_US 285349 80.42 79.55 80.82 4 DKIM_SIGNED 259941 78.37 88.62 73.63 5 XM_DK_Pass 255213 76.41 85.32 72.29 6 DKIM_VALID 251339 75.35 84.34 71.19 7 XM_B_Unicode 244206 74.40 85.70 69.17 8 DCC_CHECK_NEGATIVE 236125 53.85 25.73 66.88 9 BAYES_50 205423 52.06 38.85 58.18 10 DKIM_VALID_AU 198513 57.86 61.40 56.23 11 XMListUnsubscribeExists 170682 55.62 71.33 48.34 12 XM_B_SpammyWords 151056 52.06 72.08 42.79 13 XM_B_Unicode3 138833 41.72 46.89 39.32 14 DCC_CHECK 116741 46.11 74.26 33.07 15 T_TM2_M_HEADER_IN_MSG 103601 27.09 22.22 29.34 16 DKIM_VALID_EF 99005 29.60 32.97 28.04 17 HTML_FONT_LOW_CONTRAST 89735 28.76 35.98 25.42 18 FVGT_m_MULTI_ODD 86577 26.75 31.56 24.52 19 LOC_TINY_FONT_1 83126 28.76 40.00 23.54 20 XMSubLong 82383 23.74 24.60 23.33 21 RCVD_IN_MSPIKE_H2 77284 22.11 22.58 21.89 22 T_KAM_HTML_FONT_INVALID 74236 23.63 29.26 21.03 23 MIME_HTML_ONLY 65547 23.58 34.40 18.57 24 XM_B_SpammyWords2 62655 25.47 42.15 17.75 25 ALL_TRUSTED 57062 11.50 1.43 16.16 26 TR_XM_DK_Unsub 45476 16.52 24.38 12.88 27 XM_Multi_Part_URI 44989 14.98 19.82 12.74 28 USER_IN_DEF_DKIM_WL 41522 8.81 2.43 11.76 29 BAYES_00 38814 7.74 0.72 10.99 30 UNPARSEABLE_RELAY 34726 11.23 14.25 9.84 31 TooManyTo_001 31947 7.91 5.45 9.05 32 BAYES_60 30832 8.48 7.93 8.73 33 LotsOfNums_01 29724 8.07 7.31 8.42 34 XM_B_Unsub 28617 10.89 16.89 8.11 35 XM_DKIMWhitelistDomains 28079 5.45 0.03 7.95 36 XM_Evil_Numbers_Gen 27868 8.44 9.63 7.89 37 TR_XM_DK_Bayes 24974 5.01 0.56 7.07 38 IN_ZIMBRA_NJ_WHITELIST 24887 4.85 0.09 7.05 39 TR_XM_DK_Bayes1 24550 4.93 0.56 6.95 40 TR_XM_BayesUnsub 22927 9.57 16.22 6.49 41 RCVD_IN_MSPIKE_H3 22909 7.89 10.93 6.49 42 RCVD_IN_MSPIKE_WL 22909 7.89 10.93 6.49 43 XM_H_GMP 22731 6.00 5.05 6.44 44 XM_H_Long_From01 20659 5.82 5.74 5.85 45 TR_XM_DK_Bayes2 20572 4.09 0.34 5.83 46 XM_Body_Dirty_Words 20372 8.04 12.94 5.77 47 XM_DK_Undo_02 20087 18.26 45.39 5.69 48 T_TooManySym_01 19622 4.82 3.24 5.56 49 LOTS_OF_MONEY 19560 7.65 12.21 5.54 50 MIME_QP_LONG_LINE 18946 4.67 3.17 5.37 51 HTML_IMAGE_RATIO_02 17369 5.61 7.10 4.92 52 BAYES_40 17284 3.84 1.57 4.90 53 RCVD_IN_IADB_LISTED 16648 3.75 1.66 4.72 54 ANY_BOUNCE_MESSAGE 16638 3.81 1.87 4.71 55 BOUNCE_MESSAGE 16636 3.81 1.87 4.71 56 XMStrtUSub 16411 4.29 3.52 4.65 57 XM_PDF 16174 3.29 0.52 4.58 58 BOTNET_IPINHOSTNAME 15868 8.04 15.69 4.49 59 BAYES_99 15681 14.20 35.27 4.44 60 HTML_IMAGE_RATIO_04 15105 4.49 4.95 4.28 61 RCVD_IN_IADB_SPF 14804 3.34 1.51 4.19 62 MPART_ALT_DIFF 14403 4.58 5.65 4.08 63 RELAYCOUNTRY_META 14171 9.12 20.13 4.01 64 RCVD_IN_VALIDITY_SAFE 14016 3.83 3.52 3.97 65 XM_B_SpammyWords3 13789 6.88 13.31 3.91 66 BAYES_80 13785 5.41 8.67 3.90 67 RCVD_IN_IADB_SENDERID 13432 3.05 1.43 3.80 68 XM_UncommonTLD01 13131 4.62 6.56 3.72 69 RCVD_IN_IADB_DK 13094 2.99 1.43 3.71 70 TR_XM_SpammyWords4 13025 5.95 10.83 3.69 71 XMSubMetaSx_00 12760 4.30 5.79 3.61 72 BAYES_20 12433 2.78 1.18 3.52 73 T_REMOTE_IMAGE 12252 2.92 1.72 3.47 74 BAYES_999 11949 11.18 28.00 3.38 75 HTML_IMAGE_RATIO_06 11925 3.89 5.00 3.38 76 XM_B_Phish_Phrases 11879 3.80 4.73 3.36 77 RCVD_IN_VALIDITY_CERTIFIED 11879 3.24 2.97 3.36 78 FSL_BULK_SIG 11806 5.45 10.01 3.34 79 XM_SPF_SoftFail 11117 3.45 4.10 3.15 80 XM_B_SpammyTLD 10139 3.16 3.78 2.87 81 BAYES_05 9937 2.12 0.62 2.81 82 RCVD_IN_IADB_VOUCHED 9863 2.12 0.67 2.79 83 MAILING_LIST_MULTI 9432 2.41 1.85 2.67 84 TooManyTo_002 9265 2.03 0.74 2.62 85 SCC_BODY_URI_ONLY 9238 2.01 0.70 2.62 86 HTML_IMAGE_RATIO_08 9164 2.87 3.45 2.60 87 MIME_HTML_ONLY_MULTI 8974 2.88 3.63 2.54 88 XMNumbers 8959 3.13 4.42 2.54 89 BAYES_95 8868 3.36 5.19 2.51 90 T_TooManySym_02 8760 1.88 0.58 2.48 91 DKIM_INVALID 8602 3.02 4.28 2.44 92 TR_XM_DKIM_Undo 8216 12.77 35.31 2.33 93 FROM_EXCESS_BASE64 7769 2.17 2.11 2.20 94 TR_XM_SpammyRelay 7634 6.72 16.55 2.16 95 MIME_HTML_MOSTLY 7270 2.47 3.36 2.06 96 XM_CamelCaseFrm001 7244 2.30 2.85 2.05 97 XMSexyCombo_05 7086 3.39 6.39 2.01 98 TR_XM_PhishingBody 7060 2.68 4.14 2.00 99 HELO_NODOT 7037 1.49 0.40 1.99 100 HELO_NO_DOMAIN 7036 1.49 0.40 1.99 101 INVALID_MSGID 6992 1.40 0.16 1.98 102 HTML_MIME_NO_HTML_TAG 6848 1.91 1.86 1.94 103 XM_DK_Undo_01 6806 1.77 1.43 1.93 104 TM2_M_URI_OPT_OUT 6663 2.33 3.28 1.89 105 XM_B_Investor 6648 2.79 4.76 1.88 106 RCVD_IN_IADB_OPTIN 6561 1.40 0.42 1.86 107 T_XMDrugObfuBody_14 6279 2.26 3.31 1.78 108 TR_DCC_Bayes_99 6227 9.40 25.88 1.76 109 URI_NOVOWEL 6160 1.54 1.11 1.74 110 TO_MALFORMED 6159 1.20 0.02 1.74 111 XMGappySubj_01 5763 1.20 0.26 1.63 112 T_XMDrugObfuBody_08 5750 2.09 3.09 1.63 113 SUBJ_ALL_CAPS 5515 1.87 2.53 1.56 114 UNTRUSTED_Relay 5505 2.80 5.47 1.56 115 XM_H_Trusted_IP 5495 1.06 0.00 1.56 116 IN_HORDE_ADDRESS_BOOK 5464 1.08 0.07 1.55 117 XM_B_Unsub2 5425 1.85 2.53 1.54 118 TR_Symld_Words 5367 1.33 0.91 1.52 119 TVD_RCVD_IP 5294 1.21 0.58 1.50 120 TooManyTo_003 5275 1.22 0.63 1.49 121 TR_XM_UnparsRelay 5111 3.27 7.19 1.45 122 TR_XM_SpammyWords5 4979 2.64 5.31 1.41 123 XMDiploma_00 4788 1.67 2.35 1.36 124 KHOP_HELO_FCRDNS 4752 1.37 1.43 1.35 125 BOTNET 4750 4.58 11.58 1.35 126 XMCapTrack 4696 1.02 0.34 1.33 127 XM_SendGrid 4612 1.34 1.42 1.31 128 XM_GoogleGroups 4431 0.99 0.43 1.26 129 XMStockSpam_06 4264 1.36 1.68 1.21 130 XMBody_95 4226 0.88 0.18 1.20 131 TM2_M_VERY_LONG_WORD 4150 1.66 2.70 1.18 132 TVD_SPACE_RATIO 4132 0.83 0.09 1.17 133 XMBSHREFv2 4022 0.90 0.38 1.14 134 XM_OfRef6 3976 2.29 4.80 1.13 135 TooManyTo_004 3753 0.91 0.57 1.06 136 URI_HEX 3593 1.29 1.87 1.02 137 T_FILL_THIS_FORM_SHORT 3521 2.03 4.27 1.00 138 XM_H_Long_From02 3383 1.18 1.64 0.96 139 RELAYCOUNTRY_CA 3327 4.43 11.95 0.94 140 XM_H_PHPMailer 3319 0.96 1.00 0.94 141 XMGappySubj_02 3263 0.65 0.06 0.92 142 FROM_GOV_DKIM_AU 3233 0.66 0.12 0.92 143 DKIM_ADSP_CUSTOM_MED 3223 1.00 1.18 0.91 144 HTTPS_HTTP_MISMATCH 3217 1.01 1.21 0.91 145 XMSubNoVowel 3181 0.73 0.36 0.90 146 TooManyTo_005 3161 0.78 0.54 0.90 147 XMHTML_After_End 3160 0.90 0.91 0.90 148 RELAYCOUNTRY_AU 3130 1.27 2.10 0.89 149 TR_XM_DK_SendGrid 3083 0.88 0.89 0.87 150 XM_UB50 3016 1.46 2.75 0.85 151 T_TooManySym_03 2986 0.65 0.22 0.85 152 TR_MetaPhish_Combo_01 2982 0.81 0.73 0.84 153 SpammyFromTLD_01 2948 1.57 3.16 0.83 154 RCVD_IN_RP_SAFE 2826 0.76 0.68 0.80 155 XMLngstWrd_00 2598 0.83 1.04 0.74 156 XM_ShortIntro_01 2591 0.65 0.46 0.73 157 XMGenDplmaNmb 2575 0.89 1.22 0.73 158 RCVD_IN_BL_SPAMCOP_NET 2574 5.17 14.74 0.73 159 XMPhish14 2516 0.79 0.97 0.71 160 T_XMHurry_00 2411 1.28 2.57 0.68 161 RCVD_IN_RP_CERTIFIED 2392 0.64 0.54 0.68 162 XMMoneyMeta_00 2383 0.70 0.77 0.67 163 MSGID_NOFQDN1 2353 0.46 0.01 0.67 164 XMSubMetaI_00 2322 0.75 0.93 0.66 165 XMNoVowels 2250 0.59 0.49 0.64 166 SHORT_HELO_AND_INLINE_IMAGE 2246 0.45 0.05 0.64 167 T_XMDrugObfuBody_00 2241 1.19 2.39 0.63 168 NML_ADSP_CUSTOM_MED 2226 0.77 1.07 0.63 169 T_OBFU_PDF_ATTACH 2221 0.46 0.09 0.63 170 XMPhish30 2167 0.91 1.54 0.61 171 TR_XM_Base64_M1 2090 0.73 1.03 0.59 172 XM_B_COPY_HTML 1942 0.62 0.78 0.55 173 MPART_ALT_DIFF_COUNT 1919 0.62 0.77 0.54 174 T_Symld_Words_02 1902 0.62 0.80 0.54 175 XMBdyGiftCard01 1896 0.94 1.80 0.54 176 USER_IN_WELCOMELIST 1891 0.37 0.00 0.54 177 USER_IN_WHITELIST 1891 0.37 0.00 0.54 178 URI_TRY_3LD 1881 0.79 1.35 0.53 179 HTML_IMAGE_ONLY_28 1872 0.43 0.22 0.53 180 XM_B_SpammyWords4 1862 1.15 2.50 0.53 181 FILL_THIS_FORM 1841 0.78 1.33 0.52 182 XMBody_17 1799 2.13 5.62 0.51 183 FORGED_GMAIL_RCVD 1761 0.67 1.05 0.50 184 RELAYCOUNTRY_GB 1758 0.55 0.66 0.50 185 SpammyFromTLD_02 1750 0.91 1.82 0.50 186 HTML_IMAGE_ONLY_32 1699 0.37 0.13 0.48 187 XM_B_FormFill 1625 0.33 0.05 0.46 188 HTML_TAG_BALANCE_BODY 1609 0.83 1.63 0.46 189 HTML_IMAGE_ONLY_20 1589 0.39 0.26 0.45 190 XM_ProductURIs 1571 0.62 0.99 0.44 191 TO_NO_BRKTS_HTML_ONLY 1558 0.38 0.24 0.44 192 RDNS_DYNAMIC 1516 0.65 1.12 0.43 193 XMDateMe_00 1501 0.43 0.45 0.43 194 RCVD_IN_SORBS_DUL 1495 0.31 0.05 0.42 195 MISSING_HEADERS 1433 0.48 0.63 0.41 196 XMSubMetaSxObfu_02 1417 0.35 0.25 0.40 197 TR_XM_SpammyWords2 1408 4.50 13.34 0.40 198 TR_Mismatch_TLD_01 1386 0.74 1.49 0.39 199 TM2_M_BODY_EMPTY 1355 0.30 0.13 0.38 200 XMBrknScrpt_02 1343 0.60 1.06 0.38 ----------------------------------------------------------------------