Email: 294309 Autolearn: 0 AvgScore: 4.18 AvgScanTime: 1.11 sec Spam: 100548 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 1.17 sec Ham: 193761 Autolearn: 0 AvgScore: -0.76 AvgScanTime: 1.08 sec Time Spent Running SA: 90.91 hours Time Spent Processing Spam: 32.75 hours Time Spent Processing Ham: 58.16 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 93788 79.83 93.28 72.85 2 HTML_MESSAGE 93362 86.13 92.85 82.64 3 XM_DK_Pass 91381 78.38 90.88 71.89 4 DKIM_VALID 90095 77.68 89.60 71.49 5 XM_B_Unicode 85030 73.38 84.57 67.58 6 T_SCC_BODY_TEXT_LINE 79508 81.91 79.07 83.39 7 RELAYCOUNTRY_US 77174 75.75 76.75 75.23 8 XMListUnsubscribeExists 76378 61.25 75.96 53.62 9 XM_B_SpammyWords 73315 52.79 72.92 42.35 10 DCC_CHECK 71672 49.42 71.28 38.07 11 DKIM_VALID_AU 69138 64.44 68.76 62.20 12 XM_DK_Undo_02 48457 20.64 48.19 6.34 13 XM_B_Unicode3 44391 43.17 44.15 42.66 14 XM_B_SpammyWords2 44089 27.86 43.85 19.57 15 BAYES_99 38527 16.77 38.32 5.59 16 TR_XM_DKIM_Undo 38486 14.85 38.28 2.70 17 LOC_TINY_FONT_1 37774 31.40 37.57 28.20 18 HTML_FONT_LOW_CONTRAST 36795 37.20 36.59 37.52 19 BAYES_50 33131 50.95 32.95 60.29 20 DKIM_VALID_EF 33020 28.99 32.84 27.00 21 FVGT_m_MULTI_ODD 30678 28.42 30.51 27.34 22 MIME_HTML_ONLY 30554 22.50 30.39 18.41 23 BAYES_999 30167 13.17 30.00 4.43 24 DCC_CHECK_NEGATIVE 28859 50.56 28.70 61.91 25 TR_DCC_Bayes_99 27400 10.49 27.25 1.79 26 T_KAM_HTML_FONT_INVALID 26577 21.38 26.43 18.76 27 TR_XM_DK_Unsub 25447 18.13 25.31 14.40 28 RCVD_IN_MSPIKE_H2 25148 24.43 25.01 24.13 29 RELAYCOUNTRY_META 22839 10.21 22.71 3.72 30 T_TM2_M_HEADER_IN_MSG 21263 20.83 21.15 20.66 31 TR_XM_SpammyRelay 19580 7.96 19.47 1.98 32 XMSubLong 18955 20.11 18.85 20.77 33 XM_Multi_Part_URI 17410 16.28 17.32 15.74 34 TR_XM_SpammyWords2 16467 5.95 16.38 0.53 35 TR_MAX_INTL_RELAY 16037 10.13 15.95 7.12 36 RCVD_IN_BL_SPAMCOP_NET 15756 5.85 15.67 0.75 37 RELAYCOUNTRY_CA 14745 5.98 14.66 1.48 38 XM_B_Unsub 14451 10.14 14.37 7.94 39 TR_XM_BayesUnsub 13938 9.11 13.86 6.65 40 XM_B_SpammyWords3 13468 8.21 13.39 5.52 41 BOTNET_IPINHOSTNAME 13324 8.16 13.25 5.52 42 UNPARSEABLE_RELAY 13071 11.16 13.00 10.20 43 TR_XM_SPAMCOP 12551 4.42 12.48 0.24 44 LOTS_OF_MONEY 12487 8.07 12.42 5.81 45 RCVD_IN_MSPIKE_H3 11684 7.62 11.62 5.55 46 RCVD_IN_MSPIKE_WL 11684 7.62 11.62 5.55 47 TR_XM_SpammyWords4 11106 6.61 11.05 4.31 48 XM_Body_Dirty_Words 10252 6.11 10.20 3.99 49 BAYES_80 9609 6.06 9.56 4.24 50 XM_UncommonTLD01 9456 6.24 9.40 4.60 51 BAYES_60 7893 9.83 7.85 10.85 52 XMBody_17 7791 3.19 7.75 0.83 53 XM_Evil_Numbers_Gen 7740 8.50 7.70 8.91 54 HTML_IMAGE_RATIO_02 7597 6.84 7.56 6.47 55 TR_XM_UnparsRelay 7331 3.54 7.29 1.59 56 BOTNET 7302 3.13 7.26 0.99 57 FSL_BULK_SIG 7188 5.05 7.15 3.96 58 SpammyFromTLD_01 6689 2.66 6.65 0.58 59 XMNumbers 6368 4.11 6.33 2.96 60 TooManyTo_001 6196 6.31 6.16 6.39 61 BAYES_95 6046 3.95 6.01 2.87 62 UNTRUSTED_Relay 5804 3.18 5.77 1.83 63 MPART_ALT_DIFF 5701 7.96 5.67 9.16 64 HTML_IMAGE_RATIO_04 5671 5.25 5.64 5.05 65 XMSubMetaSx_00 5644 5.30 5.61 5.13 66 XM_OfRef6 5603 2.77 5.57 1.31 67 LotsOfNums_01 5453 6.73 5.42 7.41 68 T_FILL_THIS_FORM_SHORT 5443 2.58 5.41 1.10 69 TR_XM_PHPDW 5329 2.02 5.30 0.31 70 TR_XM_PHPForged 5327 2.02 5.30 0.31 71 TR_XM_FormFill2 5278 2.00 5.25 0.32 72 XM_H_PHPOS 5259 1.98 5.23 0.29 73 XMSexyCombo_05 5070 3.05 5.04 2.01 74 TR_XM_PhishingBody 4953 3.39 4.93 2.59 75 XM_SPF_SoftFail 4832 3.14 4.81 2.27 76 MIME_HTML_MOSTLY 4787 7.25 4.76 8.55 77 TR_XM_BayesRelay 4700 1.60 4.67 0.00 78 XMStrtUSub 4675 5.11 4.65 5.35 79 XM_H_GMP 4499 6.32 4.47 7.28 80 HTML_IMAGE_RATIO_06 4499 3.42 4.47 2.87 81 TR_LOTS_OF_MONEY3 4482 1.88 4.46 0.55 82 XM_B_Phish_Phrases 4400 3.31 4.38 2.75 83 XM_H_Long_From01 4331 4.63 4.31 4.80 84 T_XMDrugObfuBody_14 4326 2.75 4.30 1.95 85 T_XMDrugObfuBody_08 4051 2.39 4.03 1.54 86 TR_XM_FormFill 3991 1.36 3.97 0.01 87 RCVD_IN_VALIDITY_SAFE 3969 6.56 3.95 7.92 88 XM_B_Investor 3819 2.20 3.80 1.37 89 TR_XM_SpammyWords5 3779 1.94 3.76 1.00 90 DKIM_INVALID 3693 2.15 3.67 1.37 91 RCVD_IN_VALIDITY_CERTIFIED 3285 5.59 3.27 6.80 92 SCC_BODY_URI_ONLY 3217 3.28 3.20 3.32 93 USER_IN_DEF_DKIM_WL 3204 11.44 3.19 15.73 94 XM_URI_RBL 3155 1.19 3.14 0.18 95 HTML_IMAGE_RATIO_08 3150 2.77 3.13 2.58 96 MIME_HTML_ONLY_MULTI 3065 2.36 3.05 2.00 97 XM_CamelCaseFrm001 3000 2.50 2.98 2.24 98 FONT_INVIS_LONG_LINE 2949 1.05 2.93 0.07 99 XM_B_SpammyTLD 2933 3.45 2.92 3.72 100 TM2_M_BODY_EMPTY 2932 1.10 2.92 0.15 101 XMEmptyBody_01 2897 1.01 2.88 0.04 102 TM2_M_URI_OPT_OUT 2861 2.10 2.85 1.71 103 XM_UB50 2826 1.62 2.81 1.01 104 SUBJ_ALL_CAPS 2756 1.50 2.74 0.85 105 AC_BR_BONANZA 2739 1.11 2.72 0.28 106 TM2_M_VERY_LONG_WORD 2569 1.64 2.55 1.16 107 TR_Mismatch_TLD_02 2471 0.88 2.46 0.06 108 T_TooManySym_01 2443 4.64 2.43 5.79 109 XMBrknScrpt_02 2397 1.28 2.38 0.71 110 FROM_EXCESS_BASE64 2379 2.32 2.37 2.29 111 TR_XM_NoHeaderRelay 2360 0.86 2.35 0.10 112 HTML_TAG_BALANCE_BODY 2326 1.09 2.31 0.46 113 HK_RANDOM_REPLYTO 2304 0.83 2.29 0.06 114 RELAYCOUNTRY_AU 2209 1.01 2.20 0.39 115 XMReplyNow 2138 0.85 2.13 0.19 116 XM_HighProb1 2080 0.71 2.07 0.00 117 XM_B_Unsub2 2036 1.32 2.02 0.96 118 T_XMHurry_00 2029 1.12 2.02 0.66 119 BAYES_40 2028 3.13 2.02 3.71 120 URI_TRY_3LD 2005 1.22 1.99 0.81 121 BAYES_20 1954 2.39 1.94 2.63 122 XM_B_SpammyWords4 1931 1.13 1.92 0.72 123 MIME_QP_LONG_LINE 1791 2.66 1.78 3.12 124 XM_DIRTYINTL 1772 0.70 1.76 0.15 125 XMDiploma_00 1723 1.34 1.71 1.14 126 XMBdyGiftCard01 1685 1.45 1.68 1.33 127 XMPhish30 1672 1.45 1.66 1.35 128 BOTNET_NORDNS 1642 0.56 1.63 0.00 129 T_XMDrugObfuBody_10 1616 0.57 1.61 0.03 130 T_REMOTE_IMAGE 1593 2.34 1.58 2.73 131 XMStockSpam_06 1583 1.54 1.57 1.52 132 URI_HEX 1493 1.12 1.48 0.93 133 XMPhish14 1449 0.89 1.44 0.60 134 XM_H_Undi_Recip 1393 0.55 1.39 0.12 135 TR_Caps_n_Bayes_99 1382 0.48 1.37 0.01 136 XM_H_PHPMailer 1347 0.97 1.34 0.77 137 HTTPS_HTTP_MISMATCH 1344 0.80 1.34 0.53 138 SpammyFromTLD_02 1341 0.58 1.33 0.18 139 XM_H_Long_From02 1317 1.03 1.31 0.89 140 MAILING_LIST_MULTI 1317 1.86 1.31 2.15 141 XM_RXBody 1303 0.92 1.30 0.72 142 XMSexyCombo_01 1265 0.61 1.26 0.28 143 T_XMDrugObfuBody_00 1239 0.78 1.23 0.54 144 SHOPIFY_IMG_NOT_RCVD_SFY 1191 0.60 1.18 0.30 145 RCVD_IN_PSBL 1179 0.73 1.17 0.50 146 TR_XM_INV_DKIM 1162 0.43 1.16 0.06 147 ALL_TRUSTED 1159 14.35 1.15 21.20 148 THIS_AD 1148 0.68 1.14 0.44 149 XM_SendGrid 1143 1.20 1.14 1.23 150 XM_B_Phish66 1138 0.57 1.13 0.28 151 DIET_1 1106 0.68 1.10 0.47 152 XM_OfRef7 1102 0.46 1.10 0.13 153 XMSubMetaI_00 1079 0.70 1.07 0.51 154 RDNS_DYNAMIC 1073 0.62 1.07 0.39 155 TR_XM_Base64_M1 1068 1.11 1.06 1.14 156 KHOP_HELO_FCRDNS 1051 0.66 1.05 0.46 157 TR_XM_Undi_Recip5 1047 0.36 1.04 0.01 158 XM_DK_Undo_01 1031 1.35 1.03 1.52 159 HTML_MIME_NO_HTML_TAG 1020 1.11 1.01 1.16 160 XM_B_COPY_HTML 999 1.23 0.99 1.35 161 URI_NOVOWEL 992 1.06 0.99 1.09 162 RCVD_IN_VALIDITY_RPBL 983 0.39 0.98 0.09 163 TR_XM_Undi_Recip2 971 0.34 0.97 0.01 164 TVD_RCVD_IP 956 1.93 0.95 2.43 165 ANY_BOUNCE_MESSAGE 954 3.85 0.95 5.36 166 BOUNCE_MESSAGE 954 3.85 0.95 5.36 167 TR_XM_Undi_RecipCombo2 932 0.32 0.93 0.00 168 UNDISC_MONEY 921 0.32 0.92 0.01 169 XM_UB99 919 0.31 0.91 0.00 170 XM_UB60 918 0.36 0.91 0.07 171 TR_Sbj_FN_Bdy 884 0.36 0.88 0.10 172 MPART_ALT_DIFF_COUNT 884 0.87 0.88 0.86 173 TooManyTo_002 882 1.42 0.88 1.70 174 PDS_OTHER_BAD_TLD 869 3.98 0.86 5.60 175 T_STY_INVIS_DIRECT 868 0.44 0.86 0.21 176 TR_MetaPhish_Combo_01 858 0.64 0.85 0.53 177 HELO_DYNAMIC_SPLIT_IP 858 0.30 0.85 0.01 178 AC_HTML_NONSENSE_TAGS 855 0.31 0.85 0.02 179 XM_H_PHPOS_M 822 0.32 0.82 0.05 180 TooManyTo_003 821 0.83 0.82 0.83 181 RCVD_IN_IADB_LISTED 810 1.91 0.81 2.48 182 TR_Mismatch_TLD_01 805 0.46 0.80 0.28 183 HTML_FONT_FACE_BAD 802 0.72 0.80 0.68 184 BAYES_05 796 2.10 0.79 2.78 185 TooManyTo_004 794 0.71 0.79 0.66 186 XMSlimDrugH 793 0.56 0.79 0.44 187 TR_XM_DK_SendGrid 784 0.89 0.78 0.95 188 TR_XM_Undi_Recip6 782 0.27 0.78 0.00 189 HTML_TAG_BALANCE_CENTER 773 0.33 0.77 0.10 190 TooManyTo_005 768 0.64 0.76 0.58 191 TR_XM_InvalidRelay 752 0.27 0.75 0.03 192 XM_ProductURIs 746 0.69 0.74 0.66 193 TR_XM_Base64_L1 743 0.34 0.74 0.13 194 MONEY_FORM_SHORT 736 0.25 0.73 0.00 195 HTML_TEXT_INVISIBLE_STYLE 735 0.34 0.73 0.13 196 RCVD_IN_RP_SAFE 719 1.30 0.72 1.60 197 DEAR_BENEFICIARY 717 0.24 0.71 0.00 198 SUBJ_DOLLARS 710 0.32 0.71 0.12 199 RCVD_IN_IADB_SPF 708 1.71 0.70 2.23 200 TR_XM_RelayPhish 704 0.29 0.70 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 161568 81.91 79.07 83.39 2 HTML_MESSAGE 160117 86.13 92.85 82.64 3 RELAYCOUNTRY_US 145767 75.75 76.75 75.23 4 DKIM_SIGNED 141163 79.83 93.28 72.85 5 XM_DK_Pass 139294 78.38 90.88 71.89 6 DKIM_VALID 138514 77.68 89.60 71.49 7 XM_B_Unicode 130942 73.38 84.57 67.58 8 DKIM_VALID_AU 120518 64.44 68.76 62.20 9 DCC_CHECK_NEGATIVE 119958 50.56 28.70 61.91 10 BAYES_50 116813 50.95 32.95 60.29 11 XMListUnsubscribeExists 103894 61.25 75.96 53.62 12 XM_B_Unicode3 82652 43.17 44.15 42.66 13 XM_B_SpammyWords 82049 52.79 72.92 42.35 14 DCC_CHECK 73761 49.42 71.28 38.07 15 HTML_FONT_LOW_CONTRAST 72698 37.20 36.59 37.52 16 LOC_TINY_FONT_1 54633 31.40 37.57 28.20 17 FVGT_m_MULTI_ODD 52971 28.42 30.51 27.34 18 DKIM_VALID_EF 52308 28.99 32.84 27.00 19 RCVD_IN_MSPIKE_H2 46752 24.43 25.01 24.13 20 ALL_TRUSTED 41078 14.35 1.15 21.20 21 XMSubLong 40236 20.11 18.85 20.77 22 T_TM2_M_HEADER_IN_MSG 40038 20.83 21.15 20.66 23 XM_B_SpammyWords2 37914 27.86 43.85 19.57 24 T_KAM_HTML_FONT_INVALID 36351 21.38 26.43 18.76 25 MIME_HTML_ONLY 35669 22.50 30.39 18.41 26 XM_Multi_Part_URI 30495 16.28 17.32 15.74 27 USER_IN_DEF_DKIM_WL 30469 11.44 3.19 15.73 28 TR_XM_DK_Unsub 27905 18.13 25.31 14.40 29 XM_DKIMWhitelistDomains 22459 7.64 0.02 11.59 30 BAYES_60 21026 9.83 7.85 10.85 31 UNPARSEABLE_RELAY 19761 11.16 13.00 10.20 32 MPART_ALT_DIFF 17740 7.96 5.67 9.16 33 XM_Evil_Numbers_Gen 17273 8.50 7.70 8.91 34 MIME_HTML_MOSTLY 16561 7.25 4.76 8.55 35 XM_B_Unsub 15380 10.14 14.37 7.94 36 RCVD_IN_VALIDITY_SAFE 15343 6.56 3.95 7.92 37 LotsOfNums_01 14354 6.73 5.42 7.41 38 XM_H_GMP 14100 6.32 4.47 7.28 39 TR_MAX_INTL_RELAY 13791 10.13 15.95 7.12 40 BAYES_00 13650 4.83 0.56 7.04 41 RCVD_IN_VALIDITY_CERTIFIED 13171 5.59 3.27 6.80 42 TR_XM_BayesUnsub 12883 9.11 13.86 6.65 43 HTML_IMAGE_RATIO_02 12531 6.84 7.56 6.47 44 TooManyTo_001 12388 6.31 6.16 6.39 45 XM_DK_Undo_02 12291 20.64 48.19 6.34 46 LOTS_OF_MONEY 11264 8.07 12.42 5.81 47 TR_XM_DK_Bayes 11239 3.97 0.46 5.80 48 T_TooManySym_01 11216 4.64 2.43 5.79 49 TR_XM_DK_Bayes1 11193 3.96 0.45 5.78 50 PDS_OTHER_BAD_TLD 10849 3.98 0.86 5.60 51 BAYES_99 10823 16.77 38.32 5.59 52 RCVD_IN_MSPIKE_H3 10746 7.62 11.62 5.55 53 RCVD_IN_MSPIKE_WL 10746 7.62 11.62 5.55 54 BOTNET_IPINHOSTNAME 10687 8.16 13.25 5.52 55 XM_B_SpammyWords3 10686 8.21 13.39 5.52 56 HTML_EXTRA_CLOSE 10659 3.65 0.09 5.50 57 ANY_BOUNCE_MESSAGE 10386 3.85 0.95 5.36 58 BOUNCE_MESSAGE 10386 3.85 0.95 5.36 59 XMStrtUSub 10368 5.11 4.65 5.35 60 TR_XM_DK_Bayes2 9956 3.48 0.28 5.14 61 XMSubMetaSx_00 9945 5.30 5.61 5.13 62 HTML_IMAGE_RATIO_04 9791 5.25 5.64 5.05 63 IN_ZIMBRA_NJ_WHITELIST 9673 3.30 0.03 4.99 64 XM_H_Long_From01 9304 4.63 4.31 4.80 65 XM_UncommonTLD01 8914 6.24 9.40 4.60 66 BAYES_999 8593 13.17 30.00 4.43 67 TR_XM_SpammyWords4 8360 6.61 11.05 4.31 68 BAYES_80 8222 6.06 9.56 4.24 69 XM_Body_Dirty_Words 7723 6.11 10.20 3.99 70 FSL_BULK_SIG 7674 5.05 7.15 3.96 71 XM_B_SpammyTLD 7215 3.45 2.92 3.72 72 RELAYCOUNTRY_META 7205 10.21 22.71 3.72 73 BAYES_40 7193 3.13 2.02 3.71 74 INVALID_MSGID 6825 2.43 0.33 3.52 75 T_TooManySym_02 6698 2.47 0.58 3.46 76 SCC_BODY_URI_ONLY 6426 3.28 3.20 3.32 77 TO_MALFORMED 6348 2.16 0.01 3.28 78 MIME_QP_LONG_LINE 6036 2.66 1.78 3.12 79 XMNumbers 5729 4.11 6.33 2.96 80 BAYES_95 5565 3.95 6.01 2.87 81 HTML_IMAGE_RATIO_06 5554 3.42 4.47 2.87 82 BAYES_05 5378 2.10 0.79 2.78 83 XM_B_Phish_Phrases 5329 3.31 4.38 2.75 84 T_REMOTE_IMAGE 5292 2.34 1.58 2.73 85 TR_XM_DKIM_Undo 5228 14.85 38.28 2.70 86 BAYES_20 5090 2.39 1.94 2.63 87 TR_XM_PhishingBody 5015 3.39 4.93 2.59 88 HTML_IMAGE_RATIO_08 4993 2.77 3.13 2.58 89 RCVD_IN_IADB_LISTED 4801 1.91 0.81 2.48 90 TVD_RCVD_IP 4714 1.93 0.95 2.43 91 FROM_EXCESS_BASE64 4445 2.32 2.37 2.29 92 XM_SPF_SoftFail 4401 3.14 4.81 2.27 93 XM_CamelCaseFrm001 4344 2.50 2.98 2.24 94 RCVD_IN_IADB_SPF 4329 1.71 0.70 2.23 95 MAILING_LIST_MULTI 4171 1.86 1.31 2.15 96 RCVD_IN_IADB_SENDERID 3999 1.59 0.67 2.06 97 RCVD_IN_IADB_DK 3912 1.56 0.68 2.02 98 XMSexyCombo_05 3899 3.05 5.04 2.01 99 XMBSHREFv2 3881 1.39 0.22 2.00 100 MIME_HTML_ONLY_MULTI 3868 2.36 3.05 2.00 101 TR_XM_SpammyRelay 3840 7.96 19.47 1.98 102 T_XMDrugObfuBody_14 3781 2.75 4.30 1.95 103 UNTRUSTED_Relay 3541 3.18 5.77 1.83 104 TR_DCC_Bayes_99 3460 10.49 27.25 1.79 105 TM2_M_URI_OPT_OUT 3313 2.10 2.85 1.71 106 TooManyTo_002 3300 1.42 0.88 1.70 107 TVD_SPACE_RATIO 3255 1.16 0.16 1.68 108 XM_PDF 3203 1.25 0.48 1.65 109 IN_HORDE_ADDRESS_BOOK 3172 1.09 0.05 1.64 110 RCVD_IN_RP_SAFE 3098 1.30 0.72 1.60 111 TR_XM_UnparsRelay 3073 3.54 7.29 1.59 112 XMGappySubj_01 3051 1.10 0.19 1.57 113 T_XMDrugObfuBody_08 2978 2.39 4.03 1.54 114 XM_DK_Undo_01 2948 1.35 1.03 1.52 115 XMStockSpam_06 2940 1.54 1.57 1.52 116 XMBody_95 2929 1.03 0.10 1.51 117 RCVD_IN_IADB_VOUCHED 2881 1.11 0.38 1.49 118 RELAYCOUNTRY_CA 2860 5.98 14.66 1.48 119 RCVD_IN_RP_CERTIFIED 2717 1.12 0.58 1.40 120 XM_B_Investor 2656 2.20 3.80 1.37 121 DKIM_INVALID 2649 2.15 3.67 1.37 122 XM_B_COPY_HTML 2613 1.23 0.99 1.35 123 XMPhish30 2608 1.45 1.66 1.35 124 XMGappySubj_02 2585 0.91 0.08 1.33 125 XMBdyGiftCard01 2582 1.45 1.68 1.33 126 XM_OfRef6 2542 2.77 5.57 1.31 127 XM_GoogleGroups 2400 0.97 0.45 1.24 128 XM_SendGrid 2388 1.20 1.14 1.23 129 T_TooManySym_03 2349 0.88 0.24 1.21 130 MSGID_NOFQDN1 2302 0.79 0.03 1.19 131 TM2_M_VERY_LONG_WORD 2255 1.64 2.55 1.16 132 HTML_MIME_NO_HTML_TAG 2240 1.11 1.01 1.16 133 XMDiploma_00 2217 1.34 1.71 1.14 134 TR_XM_Base64_M1 2210 1.11 1.06 1.14 135 T_FILL_THIS_FORM_SHORT 2138 2.58 5.41 1.10 136 URI_NOVOWEL 2120 1.06 0.99 1.09 137 RCVD_IN_IADB_OPTIN 2021 0.78 0.27 1.04 138 XM_UB50 1956 1.62 2.81 1.01 139 XMSubMetaSxObfu_02 1933 0.77 0.33 1.00 140 TR_XM_SpammyWords5 1929 1.94 3.76 1.00 141 BOTNET 1910 3.13 7.26 0.99 142 USER_IN_WHITELIST 1900 0.65 0.00 0.98 143 USER_IN_WELCOMELIST 1900 0.65 0.00 0.98 144 TR_Symld_Words 1895 0.86 0.62 0.98 145 XM_B_Unsub2 1855 1.32 2.02 0.96 146 TR_XM_DK_SendGrid 1838 0.89 0.78 0.95 147 URI_HEX 1811 1.12 1.48 0.93 148 XM_H_Long_From02 1724 1.03 1.31 0.89 149 MPART_ALT_DIFF_COUNT 1676 0.87 0.88 0.86 150 SUBJ_ALL_CAPS 1654 1.50 2.74 0.85 151 TooManyTo_003 1614 0.83 0.82 0.83 152 XMBody_17 1601 3.19 7.75 0.83 153 URI_TRY_3LD 1571 1.22 1.99 0.81 154 XM_H_PHPMailer 1501 0.97 1.34 0.77 155 RCVD_IN_BL_SPAMCOP_NET 1452 5.85 15.67 0.75 156 XM_H_Trusted_IP 1424 0.48 0.00 0.73 157 DKIM_ADSP_CUSTOM_MED 1417 0.64 0.47 0.73 158 XM_RXBody 1403 0.92 1.30 0.72 159 XM_B_SpammyWords4 1391 1.13 1.92 0.72 160 XMBrknScrpt_02 1383 1.28 2.38 0.71 161 HTML_FONT_FACE_BAD 1314 0.72 0.80 0.68 162 XMSubNoVowel 1298 0.59 0.43 0.67 163 TooManyTo_004 1283 0.71 0.79 0.66 164 T_XMHurry_00 1279 1.12 2.02 0.66 165 XM_ProductURIs 1276 0.69 0.74 0.66 166 XM_B_FormFill 1189 0.43 0.09 0.61 167 XMPhish14 1165 0.89 1.44 0.60 168 SpammyFromTLD_01 1127 2.66 6.65 0.58 169 TooManyTo_005 1124 0.64 0.76 0.58 170 XM_B_REG_HTML 1088 0.53 0.47 0.56 171 TR_LOTS_OF_MONEY3 1060 1.88 4.46 0.55 172 T_XMDrugObfuBody_00 1045 0.78 1.23 0.54 173 TR_XM_SpammyWords2 1033 5.95 16.38 0.53 174 XMNoVowels 1030 0.48 0.38 0.53 175 HTTPS_HTTP_MISMATCH 1024 0.80 1.34 0.53 176 TR_MetaPhish_Combo_01 1023 0.64 0.85 0.53 177 FILL_THIS_FORM 1012 0.55 0.61 0.52 178 XMLngstWrd_00 991 0.51 0.51 0.51 179 XMSubMetaI_00 990 0.70 1.07 0.51 180 RCVD_IN_PSBL 976 0.73 1.17 0.50 181 TR_XM_Spammywords 931 0.50 0.54 0.48 182 XM_S_SpammyWords 931 0.50 0.54 0.48 183 DIET_1 908 0.68 1.10 0.47 184 T_TooManySym_04 900 0.35 0.14 0.46 185 KHOP_HELO_FCRDNS 899 0.66 1.05 0.46 186 HTML_TAG_BALANCE_BODY 882 1.09 2.31 0.46 187 NML_ADSP_CUSTOM_MED 869 0.43 0.41 0.45 188 FORGED_GMAIL_RCVD 867 0.44 0.42 0.45 189 THIS_AD 852 0.68 1.14 0.44 190 XMSlimDrugH 845 0.56 0.79 0.44 191 XM_ShortIntro_01 840 0.41 0.37 0.43 192 XMGenDplmaNmb 818 0.48 0.59 0.42 193 FILL_THIS_FORM_LONG 815 0.47 0.55 0.42 194 XMHTML_After_End 781 0.42 0.45 0.40 195 XM_S_SubURI 779 0.29 0.06 0.40 196 RELAYCOUNTRY_AU 764 1.01 2.20 0.39 197 RDNS_DYNAMIC 751 0.62 1.07 0.39 198 DKIM_ADSP_NXDOMAIN 747 0.42 0.48 0.39 199 XMWhlSbjSex 733 0.30 0.14 0.38 200 CTE_8BIT_MISMATCH 724 0.25 0.01 0.37 ----------------------------------------------------------------------