Email: 502126 Autolearn: 0 AvgScore: 4.20 AvgScanTime: 1.35 sec Spam: 180521 Autolearn: 0 AvgScore: 12.59 AvgScanTime: 1.30 sec Ham: 321605 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.38 sec Time Spent Running SA: 188.31 hours Time Spent Processing Spam: 65.13 hours Time Spent Processing Ham: 123.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 151987 78.52 84.19 75.33 2 HTML_MESSAGE 151543 84.72 83.95 85.15 3 XM_DK_Pass 147291 76.69 81.59 73.94 4 DKIM_VALID 145577 75.72 80.64 72.95 5 XM_B_Unicode 136492 72.01 75.61 69.99 6 RELAYCOUNTRY_US 132881 78.34 73.61 81.00 7 XMListUnsubscribeExists 125082 57.86 69.29 51.44 8 DCC_CHECK 118310 45.82 65.54 34.75 9 DKIM_VALID_AU 115243 60.26 63.84 58.26 10 XM_B_SpammyWords 101057 48.11 55.98 43.69 11 BAYES_50 66777 50.92 36.99 58.74 12 XM_B_Unicode3 64430 39.58 35.69 41.76 13 XM_DK_Undo_02 64096 16.86 35.51 6.40 14 DCC_CHECK_NEGATIVE 62198 54.15 34.45 65.20 15 MIME_HTML_ONLY 60379 25.28 33.45 20.69 16 XM_B_SpammyWords2 58129 23.72 32.20 18.97 17 LOC_TINY_FONT_1 55422 27.98 30.70 26.46 18 HTML_FONT_LOW_CONTRAST 50287 28.50 27.86 28.86 19 BAYES_99 50213 13.52 27.82 5.49 20 XM_UncommonTLD01 49442 12.58 27.39 4.27 21 TR_XM_DKIM_Undo 48916 11.40 27.10 2.58 22 DKIM_VALID_EF 45987 27.09 25.47 28.00 23 FVGT_m_MULTI_ODD 45577 25.45 25.25 25.56 24 RCVD_IN_MSPIKE_H2 41022 25.58 22.72 27.19 25 T_KAM_HTML_FONT_INVALID 40469 21.03 22.42 20.25 26 XMSubLong 39389 21.71 21.82 21.65 27 BAYES_999 39141 10.63 21.68 4.43 28 TR_DCC_Bayes_99 35180 8.13 19.49 1.76 29 XM_SPF_SoftFail 35062 9.31 19.42 3.63 30 TR_XM_DK_Unsub 32962 15.43 18.26 13.84 31 T_TM2_M_HEADER_IN_MSG 32496 24.19 18.00 27.67 32 RELAYCOUNTRY_META 28678 8.61 15.89 4.52 33 FSL_BULK_SIG 27503 7.68 15.24 3.45 34 XMNumbers 27305 7.30 15.13 2.91 35 SpammyFromTLD_01 26359 5.82 14.60 0.89 36 XM_Multi_Part_URI 26264 14.25 14.55 14.08 37 TR_XM_PHPForged 25277 5.42 14.00 0.61 38 TR_XM_PHPDW 25201 5.42 13.96 0.63 39 TR_XM_FormFill2 25161 5.40 13.94 0.61 40 XM_H_PHPOS 25138 5.39 13.93 0.60 41 TR_XM_SpammyRelay 22962 6.22 12.72 2.58 42 TM2_M_BODY_EMPTY 22790 4.88 12.62 0.53 43 TR_MAX_INTL_RELAY 22784 8.84 12.62 6.71 44 XMEmptyBody_01 22728 4.63 12.59 0.17 45 LOTS_OF_MONEY 20970 8.91 11.62 7.40 46 XM_B_Unsub 20928 9.32 11.59 8.04 47 XM_B_SpammyWords3 20444 7.03 11.32 4.62 48 TR_XM_BayesUnsub 20209 7.97 11.19 6.15 49 ALL_TRUSTED 19881 13.89 11.01 15.51 50 TR_XM_SpammyWords2 19694 4.33 10.91 0.64 51 BOTNET_IPINHOSTNAME 19604 7.03 10.86 4.88 52 SpammyFromTLD_02 19508 4.47 10.81 0.92 53 UNPARSEABLE_RELAY 19000 10.24 10.53 10.09 54 TR_XM_SpammyWords4 18461 7.05 10.23 5.26 55 MIME_HEADER_CTYPE_ONLY 17619 3.92 9.76 0.64 56 RCVD_IN_BL_SPAMCOP_NET 17538 3.90 9.72 0.64 57 RELAYCOUNTRY_CA 17223 4.37 9.54 1.47 58 BAYES_80 13785 5.38 7.64 4.12 59 TR_XM_SPAMCOP 13784 2.94 7.64 0.30 60 BAYES_40 13567 5.64 7.52 4.59 61 RCVD_IN_MSPIKE_WL 12830 6.53 7.11 6.21 62 RCVD_IN_MSPIKE_H3 12830 6.53 7.11 6.21 63 BOTNET 12560 3.44 6.96 1.47 64 XM_Evil_Numbers_Gen 12162 7.39 6.74 7.76 65 BAYES_20 11694 4.47 6.48 3.34 66 XMBody_17 11075 2.62 6.14 0.64 67 TR_XM_UnparsRelay 10611 3.07 5.88 1.49 68 BAYES_60 10585 8.08 5.86 9.32 69 LotsOfNums_01 10340 7.51 5.73 8.50 70 MPART_ALT_DIFF 9468 5.03 5.24 4.91 71 XM_Body_Dirty_Words 9264 3.82 5.13 3.09 72 HTML_IMAGE_RATIO_02 8732 5.17 4.84 5.36 73 XMSubMetaSx_00 8635 4.53 4.78 4.38 74 BAYES_95 8496 3.35 4.71 2.59 75 TooManyTo_001 8471 7.15 4.69 8.53 76 XM_H_GMP 8177 5.74 4.53 6.42 77 XM_H_Long_From01 7559 4.90 4.19 5.31 78 UNTRUSTED_Relay 7391 2.42 4.09 1.48 79 T_FILL_THIS_FORM_SHORT 7364 2.04 4.08 0.90 80 HTML_IMAGE_RATIO_04 7347 4.65 4.07 4.98 81 XM_B_Investor 7004 2.49 3.88 1.71 82 XM_B_Phish_Phrases 6620 4.02 3.67 4.22 83 HTML_IMAGE_RATIO_06 6451 2.80 3.57 2.36 84 DKIM_INVALID 6410 2.80 3.55 2.39 85 MIME_HTML_MOSTLY 6306 2.99 3.49 2.71 86 TR_XM_SpammyWords5 6213 2.10 3.44 1.34 87 XMSexyCombo_05 5998 2.64 3.32 2.26 88 T_XMDrugObfuBody_14 5913 2.31 3.28 1.77 89 TR_XM_PhishingBody 5669 2.08 3.14 1.48 90 T_XMDrugObfuBody_08 5449 2.22 3.02 1.77 91 MIME_HTML_ONLY_MULTI 5320 2.91 2.95 2.89 92 XM_OfRef6 5299 1.96 2.94 1.41 93 TM2_M_URI_OPT_OUT 5213 2.59 2.89 2.42 94 TR_LOTS_OF_MONEY3 4995 1.25 2.77 0.40 95 MIME_QP_LONG_LINE 4870 4.30 2.70 5.20 96 XM_B_SpammyTLD 4846 2.75 2.68 2.78 97 BAYES_05 4669 2.65 2.59 2.68 98 XMStrtUSub 4633 3.95 2.57 4.72 99 TM2_M_VERY_LONG_WORD 4592 1.79 2.54 1.37 100 TR_XM_FormFill 4494 0.91 2.49 0.02 101 RCVD_IN_VALIDITY_SAFE 4491 4.11 2.49 5.02 102 HTML_IMAGE_RATIO_08 4462 2.05 2.47 1.82 103 SUBJ_ALL_CAPS 4142 1.78 2.29 1.49 104 FROM_EXCESS_BASE64 4089 1.96 2.27 1.80 105 TR_XM_BayesRelay 4033 0.80 2.23 0.00 106 FONT_INVIS_LONG_LINE 3973 0.81 2.20 0.03 107 USER_IN_DEF_DKIM_WL 3966 10.38 2.20 14.97 108 RCVD_IN_VALIDITY_CERTIFIED 3750 3.60 2.08 4.45 109 XM_CamelCaseFrm001 3717 2.16 2.06 2.21 110 XMBrknScrpt_02 3684 1.15 2.04 0.65 111 XMDiploma_00 3619 1.68 2.00 1.50 112 XM_UB50 3539 1.27 1.96 0.88 113 XM_URI_RBL 3483 0.79 1.93 0.16 114 XM_B_SpammyWords4 3466 1.17 1.92 0.75 115 T_TooManySym_01 3339 4.52 1.85 6.02 116 XM_H_Undi_Recip 3143 0.77 1.74 0.22 117 RELAYCOUNTRY_AU 3018 1.17 1.67 0.89 118 T_XMHurry_00 2991 0.93 1.66 0.52 119 TR_XM_Undi_Recip19 2915 0.63 1.61 0.08 120 MAILING_LIST_MULTI 2862 2.34 1.59 2.77 121 XMStockSpam_06 2841 1.70 1.57 1.77 122 XMReplyNow 2580 0.68 1.43 0.26 123 ANY_BOUNCE_MESSAGE 2376 3.37 1.32 4.52 124 BOUNCE_MESSAGE 2373 3.37 1.31 4.52 125 AC_BR_BONANZA 2372 0.51 1.31 0.06 126 TR_XM_Undi_RecipCombo2 2369 0.48 1.31 0.02 127 T_REMOTE_IMAGE 2292 2.71 1.27 3.51 128 XM_B_Unsub2 2279 1.29 1.26 1.30 129 HTML_MIME_NO_HTML_TAG 2261 1.69 1.25 1.94 130 XM_DK_Undo_01 2241 1.56 1.24 1.74 131 TR_Mismatch_TLD_02 2215 0.49 1.23 0.07 132 T_XMDrugObfuBody_00 2199 0.83 1.22 0.62 133 TR_XM_NoHeaderRelay 2177 0.50 1.21 0.10 134 XMGenDplmaNmb 2171 0.90 1.20 0.73 135 RCVD_IN_IADB_LISTED 2168 3.25 1.20 4.41 136 XM_H_Long_From02 2130 1.13 1.18 1.10 137 URI_HEX 2123 1.21 1.18 1.22 138 URI_NOVOWEL 2111 1.36 1.17 1.47 139 XM_SendGrid 2103 1.33 1.16 1.43 140 TR_XM_INV_DKIM 2089 0.45 1.16 0.06 141 TR_Caps_n_Bayes_99 2025 0.41 1.12 0.01 142 URI_TRY_3LD 2014 0.85 1.12 0.71 143 RCVD_IN_IADB_SPF 1992 2.93 1.10 3.95 144 XMPhish30 1990 0.74 1.10 0.54 145 HTML_TAG_BALANCE_BODY 1946 0.62 1.08 0.36 146 TR_XM_Base64_M1 1938 0.83 1.07 0.70 147 XM_HighProb1 1934 0.39 1.07 0.00 148 HK_RANDOM_REPLYTO 1926 0.43 1.07 0.07 149 DIET_1 1919 0.80 1.06 0.65 150 RCVD_IN_IADB_DK 1915 2.64 1.06 3.52 151 RCVD_IN_IADB_SENDERID 1912 2.68 1.06 3.59 152 XMHTML_After_End 1899 0.66 1.05 0.44 153 BOTNET_NORDNS 1800 0.37 1.00 0.01 154 T_Symld_Words_02 1790 0.73 0.99 0.58 155 KHOP_HELO_FCRDNS 1743 1.03 0.97 1.06 156 HTTPS_HTTP_MISMATCH 1722 0.79 0.95 0.69 157 LongTLD 1670 0.53 0.93 0.31 158 URIBL_DBL_SPAM 1644 0.34 0.91 0.02 159 TR_MetaPhish_Combo_01 1584 0.77 0.88 0.71 160 TR_XM_Base64_L1 1565 0.41 0.87 0.15 161 DKIM_ADSP_CUSTOM_MED 1541 0.90 0.85 0.93 162 XM_H_PHPMailer 1500 0.74 0.83 0.68 163 XM_B_DNDMA 1497 0.49 0.83 0.31 164 THIS_AD 1496 0.55 0.83 0.39 165 XMBdyGiftCard01 1482 0.81 0.82 0.81 166 XM_B_COVIDMETA 1473 0.50 0.82 0.32 167 TR_Symld_Words 1469 1.19 0.81 1.40 168 TR_XM_Undi_Recip2 1452 0.30 0.80 0.02 169 RDNS_DYNAMIC 1409 0.54 0.78 0.41 170 XM_S_SpammyWords 1397 0.46 0.77 0.29 171 TR_XM_Spammywords 1397 0.46 0.77 0.29 172 XMSexyCombo_01 1388 0.42 0.77 0.23 173 URG_BIZ 1385 0.30 0.77 0.04 174 TR_Sbj_FN_Bdy 1367 0.37 0.76 0.15 175 TR_XM_InvalidRelay 1363 0.28 0.76 0.02 176 TR_XM_DK_SendGrid 1330 0.88 0.74 0.97 177 XM_B_Phish66 1322 0.44 0.73 0.27 178 TM2_M_OBFU_COMMENT 1284 0.45 0.71 0.30 179 PDS_OTHER_BAD_TLD 1269 0.32 0.70 0.10 180 RCVD_IN_VALIDITY_RPBL 1257 0.29 0.70 0.06 181 SHOPIFY_IMG_NOT_RCVD_SFY 1254 0.51 0.69 0.40 182 RELAYCOUNTRY_GB 1237 0.58 0.69 0.53 183 XM_RXBody 1232 0.35 0.68 0.17 184 TVD_RCVD_IP 1231 1.26 0.68 1.59 185 T_MONEY_PERCENT 1229 0.40 0.68 0.24 186 TR_LOTS_OF_MONEY2 1229 0.40 0.68 0.24 187 RCVD_IN_PSBL 1223 0.50 0.68 0.40 188 XMPhish14 1223 0.48 0.68 0.38 189 XM_B_COPY_HTML 1212 0.71 0.67 0.74 190 XM_UB99 1198 0.24 0.66 0.00 191 RELAYCOUNTRY_FR 1196 0.40 0.66 0.25 192 NML_ADSP_CUSTOM_MED 1194 0.62 0.66 0.59 193 XM_ProductURIs 1193 0.91 0.66 1.04 194 TR_XM_Undi_RecipCombo3 1193 0.24 0.66 0.00 195 TooManyTo_002 1162 1.77 0.64 2.40 196 TR_XM_Undi_Recip6 1141 0.23 0.63 0.00 197 XMClaimOffer 1141 0.33 0.63 0.16 198 TR_Mismatch_TLD_01 1105 0.42 0.61 0.32 199 XMBody_78 1089 0.39 0.60 0.27 200 TR_XM_Undi_Recip4 1076 0.22 0.60 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 273862 84.72 83.95 85.15 2 RELAYCOUNTRY_US 260495 78.34 73.61 81.00 3 DKIM_SIGNED 242281 78.52 84.19 75.33 4 XM_DK_Pass 237791 76.69 81.59 73.94 5 DKIM_VALID 234608 75.72 80.64 72.95 6 XM_B_Unicode 225094 72.01 75.61 69.99 7 DCC_CHECK_NEGATIVE 209694 54.15 34.45 65.20 8 BAYES_50 188922 50.92 36.99 58.74 9 DKIM_VALID_AU 187353 60.26 63.84 58.26 10 XMListUnsubscribeExists 165435 57.86 69.29 51.44 11 XM_B_SpammyWords 140515 48.11 55.98 43.69 12 XM_B_Unicode3 134294 39.58 35.69 41.76 13 DCC_CHECK 111772 45.82 65.54 34.75 14 HTML_FONT_LOW_CONTRAST 92812 28.50 27.86 28.86 15 DKIM_VALID_EF 90047 27.09 25.47 28.00 16 T_TM2_M_HEADER_IN_MSG 88989 24.19 18.00 27.67 17 RCVD_IN_MSPIKE_H2 87434 25.58 22.72 27.19 18 LOC_TINY_FONT_1 85086 27.98 30.70 26.46 19 FVGT_m_MULTI_ODD 82190 25.45 25.25 25.56 20 XMSubLong 69629 21.71 21.82 21.65 21 MIME_HTML_ONLY 66554 25.28 33.45 20.69 22 T_KAM_HTML_FONT_INVALID 65141 21.03 22.42 20.25 23 XM_B_SpammyWords2 60998 23.72 32.20 18.97 24 ALL_TRUSTED 49872 13.89 11.01 15.51 25 USER_IN_DEF_DKIM_WL 48145 10.38 2.20 14.97 26 XM_Multi_Part_URI 45293 14.25 14.55 14.08 27 TR_XM_DK_Unsub 44505 15.43 18.26 13.84 28 UNPARSEABLE_RELAY 32434 10.24 10.53 10.09 29 BAYES_60 29980 8.08 5.86 9.32 30 BAYES_00 29359 5.99 0.41 9.13 31 XM_DKIMWhitelistDomains 28757 5.73 0.01 8.94 32 TooManyTo_001 27438 7.15 4.69 8.53 33 LotsOfNums_01 27349 7.51 5.73 8.50 34 XM_B_Unsub 25857 9.32 11.59 8.04 35 XM_Evil_Numbers_Gen 24952 7.39 6.74 7.76 36 LOTS_OF_MONEY 23785 8.91 11.62 7.40 37 IN_ZIMBRA_NJ_WHITELIST 22938 4.59 0.07 7.13 38 TR_MAX_INTL_RELAY 21583 8.84 12.62 6.71 39 TR_XM_DK_Bayes 21390 4.36 0.29 6.65 40 TR_XM_DK_Bayes1 21043 4.29 0.29 6.54 41 XM_H_GMP 20649 5.74 4.53 6.42 42 XM_DK_Undo_02 20569 16.86 35.51 6.40 43 RCVD_IN_MSPIKE_WL 19973 6.53 7.11 6.21 44 RCVD_IN_MSPIKE_H3 19973 6.53 7.11 6.21 45 TR_XM_BayesUnsub 19790 7.97 11.19 6.15 46 T_TooManySym_01 19358 4.52 1.85 6.02 47 TR_XM_DK_Bayes2 18403 3.75 0.23 5.72 48 BAYES_99 17662 13.52 27.82 5.49 49 HTML_IMAGE_RATIO_02 17252 5.17 4.84 5.36 50 XM_H_Long_From01 17065 4.90 4.19 5.31 51 TR_XM_SpammyWords4 16923 7.05 10.23 5.26 52 MIME_QP_LONG_LINE 16729 4.30 2.70 5.20 53 RCVD_IN_VALIDITY_SAFE 16148 4.11 2.49 5.02 54 HTML_IMAGE_RATIO_04 16024 4.65 4.07 4.98 55 MPART_ALT_DIFF 15777 5.03 5.24 4.91 56 BOTNET_IPINHOSTNAME 15685 7.03 10.86 4.88 57 XMStrtUSub 15190 3.95 2.57 4.72 58 XM_B_SpammyWords3 14846 7.03 11.32 4.62 59 BAYES_40 14757 5.64 7.52 4.59 60 RELAYCOUNTRY_META 14540 8.61 15.89 4.52 61 ANY_BOUNCE_MESSAGE 14528 3.37 1.32 4.52 62 BOUNCE_MESSAGE 14526 3.37 1.31 4.52 63 RCVD_IN_VALIDITY_CERTIFIED 14317 3.60 2.08 4.45 64 BAYES_999 14233 10.63 21.68 4.43 65 RCVD_IN_IADB_LISTED 14173 3.25 1.20 4.41 66 XMSubMetaSx_00 14095 4.53 4.78 4.38 67 XM_PDF 13989 2.94 0.43 4.35 68 XM_UncommonTLD01 13727 12.58 27.39 4.27 69 XM_B_Phish_Phrases 13578 4.02 3.67 4.22 70 BAYES_80 13250 5.38 7.64 4.12 71 RCVD_IN_IADB_SPF 12718 2.93 1.10 3.95 72 XM_SPF_SoftFail 11686 9.31 19.42 3.63 73 RCVD_IN_IADB_SENDERID 11553 2.68 1.06 3.59 74 RCVD_IN_IADB_DK 11326 2.64 1.06 3.52 75 T_REMOTE_IMAGE 11298 2.71 1.27 3.51 76 FSL_BULK_SIG 11085 7.68 15.24 3.45 77 BAYES_20 10735 4.47 6.48 3.34 78 XM_Body_Dirty_Words 9928 3.82 5.13 3.09 79 XMNumbers 9364 7.30 15.13 2.91 80 MIME_HTML_ONLY_MULTI 9305 2.91 2.95 2.89 81 XM_B_SpammyTLD 8954 2.75 2.68 2.78 82 MAILING_LIST_MULTI 8903 2.34 1.59 2.77 83 MIME_HTML_MOSTLY 8700 2.99 3.49 2.71 84 T_TooManySym_02 8658 1.91 0.51 2.69 85 BAYES_05 8620 2.65 2.59 2.68 86 BAYES_95 8320 3.35 4.71 2.59 87 RCVD_IN_IADB_VOUCHED 8318 1.80 0.40 2.59 88 TR_XM_DKIM_Undo 8310 11.40 27.10 2.58 89 TR_XM_SpammyRelay 8282 6.22 12.72 2.58 90 TM2_M_URI_OPT_OUT 7786 2.59 2.89 2.42 91 TooManyTo_002 7734 1.77 0.64 2.40 92 DKIM_INVALID 7673 2.80 3.55 2.39 93 HTML_IMAGE_RATIO_06 7586 2.80 3.57 2.36 94 XMSexyCombo_05 7260 2.64 3.32 2.26 95 XM_CamelCaseFrm001 7117 2.16 2.06 2.21 96 INVALID_MSGID 6975 1.46 0.19 2.17 97 MSGID_NOFQDN1 6502 1.34 0.12 2.02 98 TO_MALFORMED 6305 1.27 0.04 1.96 99 HTML_MIME_NO_HTML_TAG 6232 1.69 1.25 1.94 100 HTML_IMAGE_RATIO_08 5839 2.05 2.47 1.82 101 FROM_EXCESS_BASE64 5773 1.96 2.27 1.80 102 XMStockSpam_06 5704 1.70 1.57 1.77 103 T_XMDrugObfuBody_14 5701 2.31 3.28 1.77 104 T_XMDrugObfuBody_08 5682 2.22 3.02 1.77 105 TR_DCC_Bayes_99 5650 8.13 19.49 1.76 106 XM_DK_Undo_01 5587 1.56 1.24 1.74 107 RCVD_IN_IADB_OPTIN 5552 1.20 0.27 1.73 108 XM_B_Investor 5504 2.49 3.88 1.71 109 TVD_RCVD_IP 5115 1.26 0.68 1.59 110 XM_H_Trusted_IP 5094 1.01 0.00 1.58 111 XMGappySubj_01 5053 1.08 0.21 1.57 112 IN_HORDE_ADDRESS_BOOK 4837 0.99 0.07 1.50 113 HELO_NODOT 4836 1.12 0.44 1.50 114 XMDiploma_00 4829 1.68 2.00 1.50 115 HELO_NO_DOMAIN 4825 1.12 0.44 1.50 116 SUBJ_ALL_CAPS 4804 1.78 2.29 1.49 117 TR_XM_UnparsRelay 4789 3.07 5.88 1.49 118 TR_XM_PhishingBody 4775 2.08 3.14 1.48 119 UNTRUSTED_Relay 4763 2.42 4.09 1.48 120 RELAYCOUNTRY_CA 4733 4.37 9.54 1.47 121 URI_NOVOWEL 4729 1.36 1.17 1.47 122 BOTNET 4714 3.44 6.96 1.47 123 TooManyTo_003 4614 1.12 0.57 1.43 124 XM_SendGrid 4597 1.33 1.16 1.43 125 XM_OfRef6 4523 1.96 2.94 1.41 126 TR_Symld_Words 4512 1.19 0.81 1.40 127 TM2_M_VERY_LONG_WORD 4398 1.79 2.54 1.37 128 TR_XM_SpammyWords5 4315 2.10 3.44 1.34 129 XM_B_Unsub2 4192 1.29 1.26 1.30 130 XMBSHREFv2 4155 0.95 0.33 1.29 131 XM_GoogleGroups 3953 0.96 0.48 1.23 132 URI_HEX 3931 1.21 1.18 1.22 133 TVD_SPACE_RATIO 3881 0.81 0.10 1.21 134 XMBody_95 3556 0.75 0.13 1.11 135 XM_H_Long_From02 3551 1.13 1.18 1.10 136 KHOP_HELO_FCRDNS 3418 1.03 0.97 1.06 137 TooManyTo_004 3376 0.85 0.51 1.05 138 XM_ProductURIs 3359 0.91 0.66 1.04 139 XMSubNoVowel 3331 0.77 0.28 1.04 140 T_TooManySym_03 3287 0.74 0.23 1.02 141 XMCapTrack 3116 0.73 0.32 0.97 142 TR_XM_DK_SendGrid 3112 0.88 0.74 0.97 143 DKIM_ADSP_CUSTOM_MED 2996 0.90 0.85 0.93 144 SpammyFromTLD_02 2958 4.47 10.81 0.92 145 T_FILL_THIS_FORM_SHORT 2896 2.04 4.08 0.90 146 SpammyFromTLD_01 2863 5.82 14.60 0.89 147 RELAYCOUNTRY_AU 2857 1.17 1.67 0.89 148 XMGappySubj_02 2848 0.59 0.06 0.89 149 XM_UB50 2827 1.27 1.96 0.88 150 XMSubMetaSxObfu_03 2721 0.74 0.54 0.85 151 TooManyTo_005 2718 0.72 0.49 0.85 152 XMBdyGiftCard01 2599 0.81 0.82 0.81 153 FROM_GOV_DKIM_AU 2510 0.53 0.08 0.78 154 XM_B_SpammyWords4 2414 1.17 1.92 0.75 155 XM_B_COPY_HTML 2366 0.71 0.67 0.74 156 XMGenDplmaNmb 2336 0.90 1.20 0.73 157 TR_MetaPhish_Combo_01 2283 0.77 0.88 0.71 158 URI_TRY_3LD 2268 0.85 1.12 0.71 159 XMNoVowels 2256 0.60 0.43 0.70 160 TR_XM_Base64_M1 2251 0.83 1.07 0.70 161 HTTPS_HTTP_MISMATCH 2225 0.79 0.95 0.69 162 XM_H_PHPMailer 2192 0.74 0.83 0.68 163 T_OBFU_PDF_ATTACH 2104 0.43 0.04 0.65 164 DIET_1 2097 0.80 1.06 0.65 165 XMBrknScrpt_02 2097 1.15 2.04 0.65 166 MIME_HEADER_CTYPE_ONLY 2072 3.92 9.76 0.64 167 XMBody_17 2068 2.62 6.14 0.64 168 TR_XM_SpammyWords2 2058 4.33 10.91 0.64 169 XMSubMetaI_00 2054 0.60 0.54 0.64 170 RCVD_IN_BL_SPAMCOP_NET 2051 3.90 9.72 0.64 171 XM_ShortIntro_01 2050 0.57 0.44 0.64 172 TR_XM_PHPDW 2033 5.42 13.96 0.63 173 T_XMDrugObfuBody_00 1990 0.83 1.22 0.62 174 TR_XM_FormFill2 1968 5.40 13.94 0.61 175 TR_XM_PHPForged 1958 5.42 14.00 0.61 176 USER_IN_WELCOMELIST 1949 0.39 0.00 0.61 177 USER_IN_WHITELIST 1949 0.39 0.00 0.61 178 XM_H_PHPOS 1936 5.39 13.93 0.60 179 NML_ADSP_CUSTOM_MED 1910 0.62 0.66 0.59 180 XMSubMetaSx_01 1905 0.43 0.14 0.59 181 T_Symld_Words_02 1872 0.73 0.99 0.58 182 FORGED_GMAIL_RCVD 1851 0.58 0.59 0.58 183 MPART_ALT_DIFF_COUNT 1847 0.53 0.46 0.57 184 FILL_THIS_FORM 1837 0.44 0.21 0.57 185 PLING_QUERY 1754 0.56 0.58 0.55 186 XMPhish30 1746 0.74 1.10 0.54 187 TM2_M_BODY_EMPTY 1713 4.88 12.62 0.53 188 RELAYCOUNTRY_GB 1691 0.58 0.69 0.53 189 T_XMHurry_00 1666 0.93 1.66 0.52 190 T_MANY_PILL_PRICE 1613 0.32 0.00 0.50 191 TO_NO_BRKTS_HTML_ONLY 1555 0.41 0.28 0.48 192 XMMoneyMeta_00 1543 0.52 0.59 0.48 193 HTML_IMAGE_ONLY_32 1492 0.35 0.14 0.46 194 XMSlimDrugH 1489 0.40 0.30 0.46 195 SHORT_HELO_AND_INLINE_IMAGE 1473 0.30 0.03 0.46 196 XMHTML_After_End 1426 0.66 1.05 0.44 197 XMSolicitRefs_0 1375 0.38 0.30 0.43 198 HTML_FONT_FACE_BAD 1348 0.47 0.55 0.42 199 XMSubMetaSxObfu_02 1316 0.40 0.40 0.41 200 TM2_M_A_HREF_HREF 1306 0.47 0.57 0.41 ----------------------------------------------------------------------