Email: 494569 Autolearn: 0 AvgScore: 4.07 AvgScanTime: 1.26 sec Spam: 159392 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 1.38 sec Ham: 335177 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.20 sec Time Spent Running SA: 172.47 hours Time Spent Processing Spam: 61.15 hours Time Spent Processing Ham: 111.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153748 88.33 96.46 84.46 2 DKIM_SIGNED 146115 79.64 91.67 73.92 3 XM_DK_Pass 141321 77.80 88.66 72.63 4 XM_B_Unicode 139667 75.30 87.62 69.45 5 DKIM_VALID 138894 76.71 87.14 71.76 6 T_SCC_BODY_TEXT_LINE 129560 82.77 81.28 83.48 7 RELAYCOUNTRY_US 126882 80.14 79.60 80.40 8 DCC_CHECK 119316 47.37 74.86 34.30 9 XMListUnsubscribeExists 117164 57.43 73.51 49.78 10 XM_B_SpammyWords 116725 52.92 73.23 43.26 11 DKIM_VALID_AU 99434 58.75 62.38 57.03 12 XM_DK_Undo_02 78203 20.21 49.06 6.49 13 XM_B_Unicode3 75590 43.61 47.42 41.80 14 XM_B_SpammyWords2 66849 25.77 41.94 18.09 15 LOC_TINY_FONT_1 64096 30.07 40.21 25.25 16 TR_XM_DKIM_Undo 60990 14.03 38.26 2.51 17 BAYES_99 59770 15.71 37.50 5.35 18 BAYES_50 59597 51.58 37.39 58.33 19 HTML_FONT_LOW_CONTRAST 58723 31.15 36.84 28.44 20 MIME_HTML_ONLY 55223 24.58 34.65 19.79 21 DKIM_VALID_EF 53831 29.89 33.77 28.05 22 FVGT_m_MULTI_ODD 52604 27.56 33.00 24.97 23 BAYES_999 48204 12.64 30.24 4.27 24 T_KAM_HTML_FONT_INVALID 46457 22.76 29.15 19.73 25 TR_DCC_Bayes_99 44763 10.39 28.08 1.97 26 TR_XM_DK_Unsub 40947 17.23 25.69 13.20 27 DCC_CHECK_NEGATIVE 40052 52.60 25.13 65.67 28 RCVD_IN_MSPIKE_H2 37883 22.73 23.77 22.23 29 XMSubLong 36428 22.97 22.85 23.02 30 T_TM2_M_HEADER_IN_MSG 35872 25.16 22.51 26.42 31 RELAYCOUNTRY_META 33538 9.34 21.04 3.78 32 XM_Multi_Part_URI 31520 16.05 19.78 14.28 33 TR_XM_SpammyRelay 28560 7.10 17.92 1.96 34 RCVD_IN_BL_SPAMCOP_NET 26321 5.88 16.51 0.83 35 XM_B_Unsub 25833 11.63 16.21 9.45 36 UNPARSEABLE_RELAY 24790 11.85 15.55 10.08 37 TR_XM_BayesUnsub 24567 10.00 15.41 7.42 38 TR_XM_SpammyWords2 23478 5.20 14.73 0.67 39 BOTNET_IPINHOSTNAME 23124 7.95 14.51 4.84 40 TR_XM_SPAMCOP 22181 4.70 13.92 0.32 41 LOTS_OF_MONEY 21830 8.51 13.70 6.04 42 RELAYCOUNTRY_CA 21731 5.07 13.63 1.00 43 XM_Body_Dirty_Words 20324 8.40 12.75 6.33 44 XM_B_SpammyWords3 20049 6.92 12.58 4.23 45 RCVD_IN_MSPIKE_H3 19215 8.12 12.06 6.25 46 RCVD_IN_MSPIKE_WL 19215 8.12 12.06 6.25 47 TR_XM_SpammyWords4 18974 6.56 11.90 4.02 48 BOTNET 15690 4.09 9.84 1.35 49 XM_Evil_Numbers_Gen 14774 8.70 9.27 8.44 50 BAYES_80 13930 5.61 8.74 4.12 51 FSL_BULK_SIG 13325 5.05 8.36 3.47 52 TR_XM_UnparsRelay 13152 3.83 8.25 1.73 53 XMBody_17 12058 2.76 7.56 0.48 54 BAYES_60 11520 8.48 7.23 9.07 55 HTML_IMAGE_RATIO_02 11146 5.35 6.99 4.57 56 LotsOfNums_01 10462 8.46 6.56 9.36 57 XM_UncommonTLD01 10052 4.41 6.31 3.51 58 MPART_ALT_DIFF 9774 5.34 6.13 4.97 59 HTML_IMAGE_RATIO_04 9156 5.11 5.74 4.81 60 XMSubMetaSx_00 9111 4.72 5.72 4.24 61 XMSexyCombo_05 9100 3.39 5.71 2.29 62 XM_H_Long_From01 8767 5.33 5.50 5.26 63 TR_XM_BayesRelay 8578 1.74 5.38 0.00 64 BAYES_95 8195 3.43 5.14 2.61 65 TooManyTo_001 8142 6.96 5.11 7.84 66 T_FILL_THIS_FORM_SHORT 8016 2.12 5.03 0.74 67 HTML_IMAGE_RATIO_06 7542 3.16 4.73 2.41 68 XM_B_Investor 7390 2.58 4.64 1.61 69 XM_B_Phish_Phrases 7278 3.82 4.57 3.46 70 TR_XM_SpammyWords5 7241 2.46 4.54 1.46 71 DKIM_INVALID 7221 2.93 4.53 2.17 72 UNTRUSTED_Relay 6868 2.39 4.31 1.48 73 MIME_HTML_ONLY_MULTI 6282 3.25 3.94 2.92 74 XMStrtUSub 6188 4.06 3.88 4.15 75 XM_H_GMP 6038 5.28 3.79 5.99 76 XMNumbers 6001 3.04 3.76 2.70 77 MIME_HTML_MOSTLY 5992 2.99 3.76 2.62 78 SpammyFromTLD_01 5975 1.63 3.75 0.63 79 XM_SPF_SoftFail 5927 3.25 3.72 3.02 80 XM_B_SpammyTLD 5731 2.93 3.60 2.61 81 HTML_IMAGE_RATIO_08 5689 2.75 3.57 2.36 82 TR_XM_FormFill 5594 1.14 3.51 0.01 83 XM_OfRef6 5491 1.78 3.44 0.99 84 TR_XM_PhishingBody 5486 2.42 3.44 1.93 85 T_XMDrugObfuBody_08 5085 2.14 3.19 1.64 86 T_XMDrugObfuBody_14 5018 2.03 3.15 1.50 87 MIME_QP_LONG_LINE 4642 4.51 2.91 5.27 88 FROM_EXCESS_BASE64 4464 2.38 2.80 2.18 89 TM2_M_URI_OPT_OUT 4452 3.12 2.79 3.28 90 RCVD_IN_VALIDITY_SAFE 4430 4.09 2.78 4.72 91 FONT_INVIS_LONG_LINE 4376 0.91 2.75 0.04 92 TR_LOTS_OF_MONEY3 4335 1.25 2.72 0.55 93 TM2_M_VERY_LONG_WORD 4219 1.70 2.65 1.26 94 XMDiploma_00 4174 1.70 2.62 1.26 95 XMBrknScrpt_02 4088 1.16 2.56 0.49 96 XM_CamelCaseFrm001 3988 2.32 2.50 2.23 97 TR_Mismatch_TLD_02 3923 0.87 2.46 0.12 98 XM_URI_RBL 3903 0.91 2.45 0.17 99 RELAYCOUNTRY_AU 3886 1.21 2.44 0.62 100 USER_IN_DEF_DKIM_WL 3746 9.34 2.35 12.66 101 SUBJ_ALL_CAPS 3706 1.94 2.33 1.76 102 XM_B_Unsub2 3586 2.11 2.25 2.05 103 XM_UB50 3564 1.31 2.24 0.86 104 XM_B_SpammyWords4 3477 1.21 2.18 0.75 105 RCVD_IN_VALIDITY_CERTIFIED 3325 3.49 2.09 4.15 106 T_TooManySym_01 3288 4.53 2.06 5.70 107 HK_RANDOM_REPLYTO 3191 0.70 2.00 0.08 108 AC_BR_BONANZA 3050 0.67 1.91 0.08 109 HTML_MIME_NO_HTML_TAG 3031 1.98 1.90 2.02 110 T_XMHurry_00 2978 0.96 1.87 0.53 111 XM_DK_Undo_01 2915 1.94 1.83 2.00 112 URI_TRY_3LD 2876 1.05 1.80 0.69 113 BOUNCE_MESSAGE 2814 4.04 1.77 5.13 114 ANY_BOUNCE_MESSAGE 2814 4.04 1.77 5.13 115 XMStockSpam_06 2789 1.40 1.75 1.24 116 T_REMOTE_IMAGE 2784 2.87 1.75 3.40 117 TR_XM_PHPForged 2703 0.80 1.70 0.37 118 TR_XM_PHPDW 2691 0.79 1.69 0.37 119 XM_DIRTYINTL 2661 0.74 1.67 0.30 120 TR_XM_FormFill2 2625 0.78 1.65 0.37 121 TR_XM_NoHeaderRelay 2596 0.59 1.63 0.10 122 XM_H_PHPOS 2592 0.76 1.63 0.35 123 HTML_TAG_BALANCE_BODY 2537 0.76 1.59 0.37 124 TR_XM_INV_DKIM 2535 0.54 1.59 0.04 125 RCVD_IN_IADB_LISTED 2452 3.94 1.54 5.08 126 XM_SendGrid 2420 1.37 1.52 1.29 127 XMSubMetaI_00 2401 1.15 1.51 0.99 128 BAYES_40 2391 3.50 1.50 4.44 129 XMSexyCombo_01 2280 0.69 1.43 0.34 130 T_XMDrugObfuBody_00 2271 0.93 1.42 0.69 131 URI_HEX 2248 1.23 1.41 1.14 132 RCVD_IN_IADB_SPF 2213 3.52 1.39 4.54 133 MAILING_LIST_MULTI 2210 2.42 1.39 2.91 134 XMPhish30 2172 1.08 1.36 0.95 135 SpammyFromTLD_02 2160 0.80 1.36 0.54 136 THIS_AD 2133 0.74 1.34 0.45 137 RCVD_IN_PSBL 2123 0.58 1.33 0.22 138 RCVD_IN_IADB_DK 2109 3.16 1.32 4.03 139 RCVD_IN_IADB_SENDERID 2107 3.22 1.32 4.13 140 BOTNET_NORDNS 2081 0.43 1.31 0.01 141 T_XMDrugObfuBody_10 2055 0.44 1.29 0.04 142 TR_XM_Base64_M1 2017 0.81 1.27 0.59 143 SHOPIFY_IMG_NOT_RCVD_SFY 1995 0.62 1.25 0.32 144 XM_HighProb1 1992 0.40 1.25 0.00 145 XM_ProductURIs 1980 1.03 1.24 0.93 146 HTTPS_HTTP_MISMATCH 1964 0.89 1.23 0.72 147 XM_B_DNDMA 1926 0.63 1.21 0.35 148 T_MONEY_PERCENT 1888 0.52 1.18 0.21 149 TR_LOTS_OF_MONEY2 1888 0.52 1.18 0.21 150 XMGenDplmaNmb 1857 0.81 1.17 0.64 151 ALL_TRUSTED 1821 11.69 1.14 16.71 152 XM_B_COPY_HTML 1814 0.74 1.14 0.55 153 XMReplyNow 1777 0.54 1.11 0.26 154 TR_XM_InvalidRelay 1689 0.36 1.06 0.03 155 BAYES_20 1660 2.52 1.04 3.22 156 TR_XM_DK_SendGrid 1629 0.93 1.02 0.89 157 XM_H_PHPMailer 1616 0.88 1.01 0.82 158 MPART_ALT_DIFF_COUNT 1599 0.74 1.00 0.62 159 TR_Caps_n_Bayes_99 1588 0.38 1.00 0.09 160 URI_NOVOWEL 1568 1.51 0.98 1.76 161 KHOP_HELO_FCRDNS 1560 1.14 0.98 1.21 162 XM_B_COVIDMETA 1548 0.48 0.97 0.24 163 XMBdyGiftCard01 1523 0.76 0.96 0.67 164 TM2_M_OBFU_COMMENT 1489 0.46 0.93 0.23 165 TR_Mismatch_TLD_01 1482 0.60 0.93 0.44 166 RCVD_IN_VALIDITY_RPBL 1435 0.32 0.90 0.04 167 TR_MetaPhish_Combo_01 1413 0.64 0.89 0.52 168 XM_S_SpammyWords 1403 0.49 0.88 0.31 169 TR_XM_Spammywords 1403 0.49 0.88 0.31 170 XM_H_Undi_Recip 1402 0.40 0.88 0.17 171 DIET_1 1398 0.46 0.88 0.26 172 XM_B_Phish66 1389 0.49 0.87 0.31 173 BAYES_00 1381 7.15 0.87 10.15 174 TR_XM_Base64_L1 1378 0.42 0.86 0.20 175 SCC_BODY_URI_ONLY 1354 2.19 0.85 2.83 176 XMHTML_After_End 1335 0.71 0.84 0.65 177 XM_B_SEO 1321 0.35 0.83 0.12 178 HTML_FONT_FACE_BAD 1307 0.55 0.82 0.43 179 XMBody_78 1295 0.51 0.81 0.36 180 XMSubMetaSxObfu_03 1289 0.56 0.81 0.45 181 DKIM_ADSP_CUSTOM_MED 1237 0.84 0.78 0.88 182 T_Symld_Words_02 1230 0.56 0.77 0.47 183 XM_H_Long_From02 1224 0.97 0.77 1.06 184 HOSTED_IMG_MULTI_PUB_01 1222 0.25 0.77 0.01 185 XMSlimDrugH 1198 0.39 0.75 0.21 186 TR_XM_SEO4 1191 0.28 0.75 0.06 187 REMOVE_BEFORE_LINK 1187 0.38 0.74 0.21 188 PDS_OTHER_BAD_TLD 1150 0.31 0.72 0.12 189 TooManyTo_002 1120 1.69 0.70 2.16 190 RDNS_DYNAMIC 1120 0.46 0.70 0.35 191 SUBJ_DOLLARS 1117 0.37 0.70 0.21 192 TM2_M_A_HREF_HREF 1096 0.37 0.69 0.21 193 TR_XM_DK_Bayes 1058 4.85 0.66 6.83 194 XMPhish14 1055 0.47 0.66 0.38 195 TR_XM_DK_Bayes1 1045 4.77 0.66 6.73 196 FORGED_GMAIL_RCVD 1041 0.59 0.65 0.55 197 T_TooManySym_02 1036 2.06 0.65 2.73 198 URIBL_DBL_SPAM 1031 0.21 0.65 0.01 199 TR_Symld_Words 1030 1.25 0.65 1.54 200 NO_DNS_FOR_FROM 1020 0.36 0.64 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 283088 88.33 96.46 84.46 2 T_SCC_BODY_TEXT_LINE 279794 82.77 81.28 83.48 3 RELAYCOUNTRY_US 269475 80.14 79.60 80.40 4 DKIM_SIGNED 247766 79.64 91.67 73.92 5 XM_DK_Pass 243437 77.80 88.66 72.63 6 DKIM_VALID 240507 76.71 87.14 71.76 7 XM_B_Unicode 232764 75.30 87.62 69.45 8 DCC_CHECK_NEGATIVE 220108 52.60 25.13 65.67 9 BAYES_50 195518 51.58 37.39 58.33 10 DKIM_VALID_AU 191144 58.75 62.38 57.03 11 XMListUnsubscribeExists 166859 57.43 73.51 49.78 12 XM_B_SpammyWords 144996 52.92 73.23 43.26 13 XM_B_Unicode3 140104 43.61 47.42 41.80 14 DCC_CHECK 114960 47.37 74.86 34.30 15 HTML_FONT_LOW_CONTRAST 95335 31.15 36.84 28.44 16 DKIM_VALID_EF 94005 29.89 33.77 28.05 17 T_TM2_M_HEADER_IN_MSG 88568 25.16 22.51 26.42 18 LOC_TINY_FONT_1 84633 30.07 40.21 25.25 19 FVGT_m_MULTI_ODD 83684 27.56 33.00 24.97 20 XMSubLong 77156 22.97 22.85 23.02 21 RCVD_IN_MSPIKE_H2 74517 22.73 23.77 22.23 22 MIME_HTML_ONLY 66345 24.58 34.65 19.79 23 T_KAM_HTML_FONT_INVALID 66123 22.76 29.15 19.73 24 XM_B_SpammyWords2 60625 25.77 41.94 18.09 25 ALL_TRUSTED 56012 11.69 1.14 16.71 26 XM_Multi_Part_URI 47858 16.05 19.78 14.28 27 TR_XM_DK_Unsub 44259 17.23 25.69 13.20 28 USER_IN_DEF_DKIM_WL 42436 9.34 2.35 12.66 29 BAYES_00 34004 7.15 0.87 10.15 30 UNPARSEABLE_RELAY 33796 11.85 15.55 10.08 31 XM_B_Unsub 31664 11.63 16.21 9.45 32 LotsOfNums_01 31359 8.46 6.56 9.36 33 BAYES_60 30417 8.48 7.23 9.07 34 XM_Evil_Numbers_Gen 28276 8.70 9.27 8.44 35 XM_DKIMWhitelistDomains 27145 5.50 0.02 8.10 36 TooManyTo_001 26265 6.96 5.11 7.84 37 TR_XM_BayesUnsub 24867 10.00 15.41 7.42 38 TR_XM_DK_Bayes 22905 4.85 0.66 6.83 39 IN_ZIMBRA_NJ_WHITELIST 22852 4.66 0.11 6.82 40 TR_XM_DK_Bayes1 22568 4.77 0.66 6.73 41 XM_DK_Undo_02 21743 20.21 49.06 6.49 42 XM_Body_Dirty_Words 21206 8.40 12.75 6.33 43 RCVD_IN_MSPIKE_H3 20948 8.12 12.06 6.25 44 RCVD_IN_MSPIKE_WL 20948 8.12 12.06 6.25 45 LOTS_OF_MONEY 20250 8.51 13.70 6.04 46 XM_H_GMP 20073 5.28 3.79 5.99 47 TR_XM_DK_Bayes2 19542 4.12 0.52 5.83 48 T_TooManySym_01 19107 4.53 2.06 5.70 49 BAYES_99 17923 15.71 37.50 5.35 50 MIME_QP_LONG_LINE 17665 4.51 2.91 5.27 51 XM_H_Long_From01 17614 5.33 5.50 5.26 52 BOUNCE_MESSAGE 17187 4.04 1.77 5.13 53 ANY_BOUNCE_MESSAGE 17187 4.04 1.77 5.13 54 RCVD_IN_IADB_LISTED 17022 3.94 1.54 5.08 55 MPART_ALT_DIFF 16649 5.34 6.13 4.97 56 BOTNET_IPINHOSTNAME 16211 7.95 14.51 4.84 57 HTML_IMAGE_RATIO_04 16118 5.11 5.74 4.81 58 RCVD_IN_VALIDITY_SAFE 15815 4.09 2.78 4.72 59 HTML_IMAGE_RATIO_02 15303 5.35 6.99 4.57 60 RCVD_IN_IADB_SPF 15218 3.52 1.39 4.54 61 BAYES_40 14895 3.50 1.50 4.44 62 XM_PDF 14424 3.09 0.55 4.30 63 BAYES_999 14324 12.64 30.24 4.27 64 XMSubMetaSx_00 14210 4.72 5.72 4.24 65 XM_B_SpammyWords3 14173 6.92 12.58 4.23 66 RCVD_IN_VALIDITY_CERTIFIED 13926 3.49 2.09 4.15 67 XMStrtUSub 13905 4.06 3.88 4.15 68 RCVD_IN_IADB_SENDERID 13834 3.22 1.32 4.13 69 BAYES_80 13805 5.61 8.74 4.12 70 RCVD_IN_IADB_DK 13498 3.16 1.32 4.03 71 TR_XM_SpammyWords4 13487 6.56 11.90 4.02 72 RELAYCOUNTRY_META 12665 9.34 21.04 3.78 73 XM_UncommonTLD01 11761 4.41 6.31 3.51 74 FSL_BULK_SIG 11634 5.05 8.36 3.47 75 XM_B_Phish_Phrases 11594 3.82 4.57 3.46 76 T_REMOTE_IMAGE 11387 2.87 1.75 3.40 77 TM2_M_URI_OPT_OUT 11000 3.12 2.79 3.28 78 BAYES_20 10808 2.52 1.04 3.22 79 XM_SPF_SoftFail 10136 3.25 3.72 3.02 80 RCVD_IN_IADB_VOUCHED 10030 2.22 0.61 2.99 81 MIME_HTML_ONLY_MULTI 9791 3.25 3.94 2.92 82 MAILING_LIST_MULTI 9743 2.42 1.39 2.91 83 SCC_BODY_URI_ONLY 9481 2.19 0.85 2.83 84 T_TooManySym_02 9161 2.06 0.65 2.73 85 BAYES_05 9049 2.02 0.59 2.70 86 XMNumbers 9035 3.04 3.76 2.70 87 MIME_HTML_MOSTLY 8773 2.99 3.76 2.62 88 XM_B_SpammyTLD 8763 2.93 3.60 2.61 89 BAYES_95 8757 3.43 5.14 2.61 90 TR_XM_DKIM_Undo 8409 14.03 38.26 2.51 91 HTML_IMAGE_RATIO_06 8090 3.16 4.73 2.41 92 HTML_IMAGE_RATIO_08 7909 2.75 3.57 2.36 93 XMSexyCombo_05 7664 3.39 5.71 2.29 94 XM_CamelCaseFrm001 7489 2.32 2.50 2.23 95 FROM_EXCESS_BASE64 7299 2.38 2.80 2.18 96 DKIM_INVALID 7259 2.93 4.53 2.17 97 TooManyTo_002 7244 1.69 0.70 2.16 98 INVALID_MSGID 6988 1.47 0.17 2.08 99 RCVD_IN_IADB_OPTIN 6924 1.53 0.40 2.07 100 XM_B_Unsub2 6863 2.11 2.25 2.05 101 HTML_MIME_NO_HTML_TAG 6781 1.98 1.90 2.02 102 XM_DK_Undo_01 6697 1.94 1.83 2.00 103 TR_DCC_Bayes_99 6599 10.39 28.08 1.97 104 XM_H_Trusted_IP 6577 1.33 0.00 1.96 105 TR_XM_SpammyRelay 6571 7.10 17.92 1.96 106 TR_XM_PhishingBody 6460 2.42 3.44 1.93 107 TO_MALFORMED 6376 1.30 0.02 1.90 108 XMBody_95 5901 1.25 0.18 1.76 109 URI_NOVOWEL 5895 1.51 0.98 1.76 110 SUBJ_ALL_CAPS 5884 1.94 2.33 1.76 111 TR_XM_UnparsRelay 5814 3.83 8.25 1.73 112 TVD_RCVD_IP 5749 1.35 0.59 1.72 113 T_XMDrugObfuBody_08 5512 2.14 3.19 1.64 114 XM_B_Investor 5383 2.58 4.64 1.61 115 IN_HORDE_ADDRESS_BOOK 5261 1.09 0.08 1.57 116 TR_Symld_Words 5151 1.25 0.65 1.54 117 T_XMDrugObfuBody_14 5038 2.03 3.15 1.50 118 UNTRUSTED_Relay 4966 2.39 4.31 1.48 119 TR_XM_SpammyWords5 4902 2.46 4.54 1.46 120 HELO_NODOT 4840 1.16 0.55 1.44 121 HELO_NO_DOMAIN 4835 1.16 0.55 1.44 122 XMBSHREFv2 4686 1.03 0.26 1.40 123 BOTNET 4532 4.09 9.84 1.35 124 TooManyTo_003 4458 1.10 0.61 1.33 125 XMGappySubj_01 4423 0.96 0.19 1.32 126 XM_SendGrid 4332 1.37 1.52 1.29 127 XMDiploma_00 4225 1.70 2.62 1.26 128 TM2_M_VERY_LONG_WORD 4211 1.70 2.65 1.26 129 XMStockSpam_06 4141 1.40 1.75 1.24 130 XM_GoogleGroups 4133 0.99 0.47 1.23 131 KHOP_HELO_FCRDNS 4068 1.14 0.98 1.21 132 TVD_SPACE_RATIO 3984 0.84 0.11 1.19 133 URI_HEX 3822 1.23 1.41 1.14 134 XM_H_Long_From02 3555 0.97 0.77 1.06 135 RELAYCOUNTRY_CA 3336 5.07 13.63 1.00 136 XMSubMetaI_00 3309 1.15 1.51 0.99 137 XM_OfRef6 3304 1.78 3.44 0.99 138 TooManyTo_004 3260 0.84 0.57 0.97 139 T_TooManySym_03 3226 0.73 0.25 0.96 140 XMPhish30 3178 1.08 1.36 0.95 141 XMCapTrack 3127 0.75 0.36 0.93 142 XM_ProductURIs 3124 1.03 1.24 0.93 143 RCVD_IN_RP_SAFE 3120 0.82 0.60 0.93 144 XMNoVowels 3034 0.75 0.44 0.91 145 FROM_GOV_DKIM_AU 3008 0.72 0.35 0.90 146 TR_XM_DK_SendGrid 2981 0.93 1.02 0.89 147 XMSubNoVowel 2947 0.72 0.39 0.88 148 DKIM_ADSP_CUSTOM_MED 2935 0.84 0.78 0.88 149 XM_UB50 2899 1.31 2.24 0.86 150 RCVD_IN_BL_SPAMCOP_NET 2777 5.88 16.51 0.83 151 RCVD_IN_RP_CERTIFIED 2751 0.71 0.46 0.82 152 XM_H_PHPMailer 2745 0.88 1.01 0.82 153 TooManyTo_005 2646 0.71 0.54 0.79 154 XMGappySubj_02 2605 0.55 0.07 0.78 155 XM_B_SpammyWords4 2498 1.21 2.18 0.75 156 T_FILL_THIS_FORM_SHORT 2475 2.12 5.03 0.74 157 HTTPS_HTTP_MISMATCH 2420 0.89 1.23 0.72 158 MSGID_NOFQDN1 2332 0.48 0.03 0.70 159 T_XMDrugObfuBody_00 2321 0.93 1.42 0.69 160 URI_TRY_3LD 2313 1.05 1.80 0.69 161 TR_XM_SpammyWords2 2258 5.20 14.73 0.67 162 XMBdyGiftCard01 2245 0.76 0.96 0.67 163 XMHTML_After_End 2190 0.71 0.84 0.65 164 T_OBFU_PDF_ATTACH 2171 0.46 0.08 0.65 165 XMGenDplmaNmb 2136 0.81 1.17 0.64 166 XM_ShortIntro_01 2120 0.55 0.36 0.63 167 XM_RXBody 2107 0.60 0.55 0.63 168 SpammyFromTLD_01 2102 1.63 3.75 0.63 169 RELAYCOUNTRY_AU 2082 1.21 2.44 0.62 170 MPART_ALT_DIFF_COUNT 2071 0.74 1.00 0.62 171 LOW_PRICE 1970 0.47 0.22 0.59 172 TR_XM_Base64_M1 1966 0.81 1.27 0.59 173 TVD_SPACE_RATIO_MINFP 1883 0.44 0.17 0.56 174 NML_ADSP_CUSTOM_MED 1858 0.56 0.57 0.55 175 TR_LOTS_OF_MONEY3 1858 1.25 2.72 0.55 176 XM_B_COPY_HTML 1855 0.74 1.14 0.55 177 FORGED_GMAIL_RCVD 1854 0.59 0.65 0.55 178 SpammyFromTLD_02 1804 0.80 1.36 0.54 179 T_XMHurry_00 1780 0.96 1.87 0.53 180 USER_IN_WELCOMELIST 1762 0.36 0.00 0.53 181 USER_IN_WHITELIST 1762 0.36 0.00 0.53 182 TR_MetaPhish_Combo_01 1757 0.64 0.89 0.52 183 RELAYCOUNTRY_GB 1697 0.49 0.44 0.51 184 TO_NO_BRKTS_HTML_ONLY 1690 0.43 0.26 0.50 185 XMBrknScrpt_02 1649 1.16 2.56 0.49 186 XMBody_17 1597 2.76 7.56 0.48 187 SHORT_HELO_AND_INLINE_IMAGE 1590 0.33 0.03 0.47 188 T_MANY_PILL_PRICE 1580 0.32 0.00 0.47 189 T_Symld_Words_02 1561 0.56 0.77 0.47 190 THIS_AD 1520 0.74 1.34 0.45 191 XMLngstWrd_00 1509 0.43 0.39 0.45 192 XMSubMetaSxObfu_03 1503 0.56 0.81 0.45 193 TR_Mismatch_TLD_01 1487 0.60 0.93 0.44 194 XMSubMetaSxObfu_02 1458 0.40 0.32 0.43 195 HTML_IMAGE_ONLY_28 1456 0.36 0.19 0.43 196 HTML_IMAGE_ONLY_20 1446 0.36 0.22 0.43 197 HTML_FONT_FACE_BAD 1431 0.55 0.82 0.43 198 FILL_THIS_FORM 1332 0.38 0.34 0.40 199 PLING_QUERY 1312 0.40 0.43 0.39 200 XMPhish14 1285 0.47 0.66 0.38 ----------------------------------------------------------------------