Email: 534968 Autolearn: 0 AvgScore: 3.89 AvgScanTime: 1.40 sec Spam: 168256 Autolearn: 0 AvgScore: 13.15 AvgScanTime: 1.49 sec Ham: 366712 Autolearn: 0 AvgScore: -0.36 AvgScanTime: 1.36 sec Time Spent Running SA: 208.17 hours Time Spent Processing Spam: 69.82 hours Time Spent Processing Ham: 138.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162117 89.51 96.35 86.37 2 XM_B_Unicode 143160 74.31 85.08 69.37 3 DKIM_SIGNED 140797 75.66 83.68 71.98 4 XM_DK_Pass 135376 73.71 80.46 70.62 5 DKIM_VALID 133532 72.71 79.36 69.66 6 RELAYCOUNTRY_US 120945 76.33 71.88 78.37 7 XM_B_SpammyWords 119185 51.15 70.84 42.11 8 DCC_CHECK 118147 45.78 70.22 34.56 9 XMListUnsubscribeExists 113333 53.14 67.36 46.61 10 DKIM_VALID_AU 98405 56.75 58.49 55.95 11 XM_B_Unicode3 80595 41.54 47.90 38.62 12 XM_B_SpammyWords2 72383 25.71 43.02 17.77 13 XM_DK_Undo_02 69153 16.57 41.10 5.32 14 BAYES_50 68797 52.62 40.89 58.00 15 LOC_TINY_FONT_1 62446 27.63 37.11 23.28 16 HTML_FONT_LOW_CONTRAST 61976 31.61 36.83 29.22 17 MIME_HTML_ONLY 58298 24.17 34.65 19.36 18 TR_XM_DKIM_Undo 53588 11.59 31.85 2.29 19 BAYES_99 53122 12.91 31.57 4.35 20 DCC_CHECK_NEGATIVE 50087 54.19 29.77 65.39 21 DKIM_VALID_EF 48412 28.01 28.77 27.66 22 FVGT_m_MULTI_ODD 48309 25.84 28.71 24.52 23 T_KAM_HTML_FONT_INVALID 44260 22.11 26.31 20.19 24 RCVD_IN_MSPIKE_H2 44222 26.46 26.28 26.54 25 XMSubLong 43537 22.62 25.88 21.13 26 BAYES_999 41002 9.99 24.37 3.39 27 TR_DCC_Bayes_99 38305 8.20 22.77 1.51 28 TR_XM_DK_Unsub 37208 15.47 22.11 12.43 29 T_TM2_M_HEADER_IN_MSG 36208 26.23 21.52 28.39 30 RELAYCOUNTRY_META 33544 9.21 19.94 4.28 31 XM_B_Unsub 33408 11.76 19.86 8.04 32 TR_XM_BayesUnsub 32641 10.52 19.40 6.45 33 XM_Multi_Part_URI 30268 15.21 17.99 13.94 34 TR_XM_SpammyRelay 26411 6.47 15.70 2.24 35 TR_MAX_INTL_RELAY 23382 8.82 13.90 6.49 36 TR_XM_SpammyWords2 22163 4.44 13.17 0.43 37 BOTNET_IPINHOSTNAME 21659 6.91 12.87 4.18 38 XM_B_SpammyWords3 21552 7.12 12.81 4.51 39 LOTS_OF_MONEY 21210 8.44 12.61 6.53 40 UNPARSEABLE_RELAY 21085 10.80 12.53 10.01 41 RCVD_IN_BL_SPAMCOP_NET 21068 4.41 12.52 0.69 42 TR_XM_SpammyWords4 19182 6.72 11.40 4.57 43 XM_Body_Dirty_Words 18966 5.36 11.27 2.64 44 RELAYCOUNTRY_CA 18402 4.55 10.94 1.62 45 FSL_BULK_SIG 18400 7.38 10.94 5.74 46 XM_UncommonTLD01 18384 7.63 10.93 6.11 47 TR_XM_SPAMCOP 17908 3.64 10.64 0.43 48 XMSubMetaSx_00 16989 5.59 10.10 3.52 49 TooManyTo_001 15891 8.74 9.44 8.42 50 XMSexyCombo_05 15661 3.91 9.31 1.43 51 RCVD_IN_MSPIKE_WL 15056 6.93 8.95 6.00 52 RCVD_IN_MSPIKE_H3 15056 6.93 8.95 6.00 53 XM_Evil_Numbers_Gen 14771 8.12 8.78 7.82 54 ALL_TRUSTED 14545 15.13 8.64 18.10 55 BAYES_80 14365 5.40 8.54 3.96 56 BOTNET 14326 3.57 8.51 1.30 57 XM_SPF_SoftFail 13674 6.39 8.13 5.60 58 BAYES_60 12797 8.40 7.61 8.76 59 HTML_IMAGE_RATIO_02 11484 5.41 6.83 4.76 60 UNTRUSTED_Relay 11434 3.14 6.80 1.47 61 LotsOfNums_01 11134 7.71 6.62 8.21 62 TR_XM_UnparsRelay 11094 3.05 6.59 1.42 63 MPART_ALT_DIFF 10400 4.79 6.18 4.15 64 XMStrtUSub 9749 6.85 5.79 7.33 65 XMSexyCombo_01 8851 1.78 5.26 0.18 66 XM_H_Long_From01 8352 5.23 4.96 5.35 67 XMNumbers 8333 3.29 4.95 2.53 68 XM_B_Phish_Phrases 8327 3.98 4.95 3.53 69 BAYES_95 8308 3.29 4.94 2.53 70 HTML_IMAGE_RATIO_04 8294 3.98 4.93 3.54 71 XMBody_17 8150 1.92 4.84 0.58 72 TR_XM_SpammyWords5 8072 2.41 4.80 1.31 73 XMSexyCombo_04 8021 1.52 4.77 0.03 74 XM_B_Investor 7526 2.63 4.47 1.79 75 MIME_HTML_MOSTLY 7519 3.09 4.47 2.45 76 SpammyFromTLD_01 7358 1.97 4.37 0.87 77 SpammyFromTLD_02 7347 3.26 4.37 2.76 78 DKIM_INVALID 7265 2.95 4.32 2.32 79 TM2_M_URI_OPT_OUT 7215 2.72 4.29 2.00 80 XM_H_GMP 6740 5.59 4.01 6.32 81 T_FILL_THIS_FORM_SHORT 6707 1.95 3.99 1.01 82 HTML_IMAGE_RATIO_08 6222 2.81 3.70 2.40 83 TR_XM_PhishingBody 6133 2.46 3.65 1.91 84 XM_OfRef6 6057 2.03 3.60 1.30 85 XM_UB50 5860 1.72 3.48 0.91 86 T_XMDrugObfuBody_14 5790 2.15 3.44 1.56 87 MIME_QP_LONG_LINE 5419 4.36 3.22 4.88 88 HK_RANDOM_REPLYTO 5393 1.09 3.21 0.12 89 HTML_IMAGE_RATIO_06 5240 3.41 3.11 3.55 90 TR_XM_BayesRelay 5223 0.98 3.10 0.00 91 MIME_HTML_ONLY_MULTI 5142 2.52 3.06 2.28 92 RCVD_IN_VALIDITY_SAFE 5045 3.89 3.00 4.29 93 T_XMDrugObfuBody_08 4830 1.88 2.87 1.42 94 USER_IN_DEF_DKIM_WL 4797 10.03 2.85 13.32 95 XM_B_SpammyTLD 4723 2.68 2.81 2.62 96 XM_CamelCaseFrm001 4707 2.56 2.80 2.45 97 TM2_M_VERY_LONG_WORD 4523 1.60 2.69 1.10 98 RCVD_IN_VALIDITY_CERTIFIED 4394 3.33 2.61 3.66 99 FONT_INVIS_LONG_LINE 4360 0.84 2.59 0.03 100 TR_XM_PHPForged 4199 1.12 2.50 0.49 101 BAYES_20 4074 3.12 2.42 3.45 102 XM_URI_RBL 4063 0.88 2.41 0.18 103 TR_XM_PHPDW 4040 1.09 2.40 0.48 104 TR_XM_FormFill 4034 0.78 2.40 0.03 105 SUBJ_ALL_CAPS 4033 1.77 2.40 1.48 106 T_TooManySym_01 4022 4.37 2.39 5.27 107 TR_XM_FormFill2 4012 1.09 2.38 0.50 108 XM_H_PHPOS 3998 1.07 2.38 0.48 109 BAYES_40 3964 4.03 2.36 4.79 110 XMDiploma_00 3882 2.00 2.31 1.86 111 TR_XM_NoHeaderRelay 3879 0.83 2.31 0.16 112 RELAYCOUNTRY_AU 3771 1.19 2.24 0.71 113 TR_LOTS_OF_MONEY3 3761 1.02 2.24 0.46 114 FROM_EXCESS_BASE64 3686 1.98 2.19 1.88 115 XM_B_Unsub2 3534 1.85 2.10 1.73 116 XMBrknScrpt_02 3494 1.07 2.08 0.61 117 XM_B_SpammyWords4 3419 1.09 2.03 0.66 118 URI_NOVOWEL 3241 1.69 1.93 1.59 119 ANY_BOUNCE_MESSAGE 3207 3.60 1.91 4.38 120 TR_Mismatch_TLD_02 3147 0.64 1.87 0.07 121 BOUNCE_MESSAGE 3146 3.59 1.87 4.38 122 URI_HEX 3090 1.36 1.84 1.14 123 MAILING_LIST_MULTI 2907 2.29 1.73 2.55 124 XMReplyNow 2708 0.65 1.61 0.21 125 HTML_MIME_NO_HTML_TAG 2643 2.07 1.57 2.30 126 T_XMHurry_00 2572 0.76 1.53 0.41 127 XM_DK_Undo_01 2550 1.79 1.52 1.91 128 URI_TRY_3LD 2546 0.95 1.51 0.69 129 T_REMOTE_IMAGE 2539 3.07 1.51 3.79 130 TR_XM_INV_DKIM 2509 0.51 1.49 0.06 131 RCVD_IN_IADB_LISTED 2487 3.39 1.48 4.27 132 XM_H_Long_From02 2483 1.19 1.48 1.06 133 BOTNET_NORDNS 2404 0.46 1.43 0.01 134 KHOP_HELO_FCRDNS 2396 1.29 1.42 1.23 135 TR_MetaPhish_Combo_01 2368 1.12 1.41 0.99 136 XM_SendGrid 2326 1.38 1.38 1.38 137 T_XMDrugObfuBody_00 2301 0.88 1.37 0.65 138 XMBdyGiftCard01 2293 0.78 1.36 0.52 139 RCVD_IN_IADB_SPF 2271 3.02 1.35 3.78 140 HTML_TAG_BALANCE_BODY 2218 0.74 1.32 0.48 141 XMSubMetaI_00 2194 0.78 1.30 0.54 142 RCVD_IN_IADB_DK 2171 2.69 1.29 3.34 143 RCVD_IN_IADB_SENDERID 2169 2.75 1.29 3.42 144 LongTLD 2088 0.67 1.24 0.40 145 XMStockSpam_06 2060 1.22 1.22 1.22 146 TR_XM_Base64_M1 2059 0.95 1.22 0.82 147 BAYES_05 2039 2.16 1.21 2.59 148 XMHTML_After_End 2032 0.66 1.21 0.41 149 JH_SPAMMY_HEADERS 1940 0.36 1.15 0.00 150 TM2_M_BODY_EMPTY 1939 0.66 1.15 0.44 151 HTTPS_HTTP_MISMATCH 1925 0.88 1.14 0.76 152 TR_Symld_Words 1912 1.40 1.14 1.53 153 XMPhish30 1891 0.65 1.12 0.43 154 RDNS_DYNAMIC 1876 0.66 1.11 0.46 155 XMEmptyBody_01 1872 0.39 1.11 0.06 156 RELAYCOUNTRY_RU 1850 0.36 1.10 0.02 157 XMGenDplmaNmb 1800 0.98 1.07 0.94 158 XMSlimDrugH 1800 0.51 1.07 0.25 159 TR_XM_Base64_L1 1797 0.42 1.07 0.12 160 THIS_AD 1787 0.57 1.06 0.35 161 XM_HighProb1 1782 0.34 1.06 0.01 162 DKIM_ADSP_CUSTOM_MED 1768 0.97 1.05 0.94 163 XMPhish14 1751 0.84 1.04 0.75 164 RCVD_IN_VALIDITY_RPBL 1736 0.39 1.03 0.09 165 XM_UB60 1729 0.36 1.03 0.06 166 T_MONEY_PERCENT 1705 0.45 1.01 0.19 167 TR_LOTS_OF_MONEY2 1705 0.45 1.01 0.19 168 XM_B_COVIDMETA 1680 0.47 1.00 0.23 169 AC_BR_BONANZA 1628 0.33 0.97 0.04 170 XMLngstWrd_00 1615 0.69 0.96 0.57 171 XM_UB99 1589 0.30 0.94 0.00 172 TR_XM_InvalidRelay 1582 0.31 0.94 0.01 173 URIBL_DBL_SPAM 1550 0.29 0.92 0.00 174 TVD_RCVD_IP 1545 1.21 0.92 1.34 175 XM_DIRTYINTL 1537 0.34 0.91 0.08 176 TR_XM_DK_SendGrid 1487 0.92 0.88 0.93 177 GOOG_STO_NOIMG_HTML 1456 0.27 0.87 0.00 178 T_Symld_Words_02 1452 0.71 0.86 0.64 179 T_STY_INVIS_DIRECT 1430 0.46 0.85 0.28 180 XM_B_Phish66 1419 0.47 0.84 0.30 181 RELAYCOUNTRY_FR 1352 0.43 0.80 0.26 182 NML_ADSP_CUSTOM_MED 1345 0.68 0.80 0.63 183 FORGED_GMAIL_RCVD 1321 0.62 0.79 0.54 184 XM_UB80 1320 0.26 0.78 0.02 185 RELAYCOUNTRY_IN 1318 0.28 0.78 0.05 186 TR_Caps_n_Bayes_99 1312 0.26 0.78 0.02 187 PLING_QUERY 1305 0.56 0.78 0.46 188 XM_H_Undi_Recip 1297 0.35 0.77 0.16 189 XM_B_DNDMA 1291 0.52 0.77 0.41 190 MPART_ALT_DIFF_COUNT 1288 0.59 0.77 0.52 191 XMBody_78 1270 0.44 0.75 0.29 192 XM_B_SEO 1253 0.32 0.74 0.13 193 DIET_1 1250 0.45 0.74 0.31 194 TooManyTo_002 1244 1.91 0.74 2.45 195 RELAYCOUNTRY_GB 1239 0.51 0.74 0.40 196 XM_Combo_Sbj 1191 0.36 0.71 0.20 197 XM_OfRef7 1185 0.35 0.70 0.18 198 XM_ProductURIs 1164 0.53 0.69 0.45 199 T_XMDrugObfuBody_10 1161 0.24 0.69 0.03 200 TM2_M_A_HREF_HREF 1154 0.37 0.69 0.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316724 89.51 96.35 86.37 2 RELAYCOUNTRY_US 287399 76.33 71.88 78.37 3 DKIM_SIGNED 263957 75.66 83.68 71.98 4 XM_DK_Pass 258963 73.71 80.46 70.62 5 DKIM_VALID 255438 72.71 79.36 69.66 6 XM_B_Unicode 254386 74.31 85.08 69.37 7 DCC_CHECK_NEGATIVE 239802 54.19 29.77 65.39 8 BAYES_50 212684 52.62 40.89 58.00 9 DKIM_VALID_AU 205188 56.75 58.49 55.95 10 XMListUnsubscribeExists 170931 53.14 67.36 46.61 11 XM_B_SpammyWords 154431 51.15 70.84 42.11 12 XM_B_Unicode3 141609 41.54 47.90 38.62 13 DCC_CHECK 126745 45.78 70.22 34.56 14 HTML_FONT_LOW_CONTRAST 107140 31.61 36.83 29.22 15 T_TM2_M_HEADER_IN_MSG 104093 26.23 21.52 28.39 16 DKIM_VALID_EF 101437 28.01 28.77 27.66 17 RCVD_IN_MSPIKE_H2 97310 26.46 26.28 26.54 18 FVGT_m_MULTI_ODD 89906 25.84 28.71 24.52 19 LOC_TINY_FONT_1 85362 27.63 37.11 23.28 20 XMSubLong 77488 22.62 25.88 21.13 21 T_KAM_HTML_FONT_INVALID 74037 22.11 26.31 20.19 22 MIME_HTML_ONLY 70987 24.17 34.65 19.36 23 ALL_TRUSTED 66373 15.13 8.64 18.10 24 XM_B_SpammyWords2 65166 25.71 43.02 17.77 25 XM_Multi_Part_URI 51111 15.21 17.99 13.94 26 USER_IN_DEF_DKIM_WL 48847 10.03 2.85 13.32 27 TR_XM_DK_Unsub 45567 15.47 22.11 12.43 28 BAYES_00 42430 8.08 0.47 11.57 29 UNPARSEABLE_RELAY 36692 10.80 12.53 10.01 30 BAYES_60 32140 8.40 7.61 8.76 31 TooManyTo_001 30885 8.74 9.44 8.42 32 LotsOfNums_01 30120 7.71 6.62 8.21 33 XM_B_Unsub 29492 11.76 19.86 8.04 34 XM_Evil_Numbers_Gen 28666 8.12 8.78 7.82 35 XM_DKIMWhitelistDomains 28221 5.28 0.03 7.70 36 XMStrtUSub 26881 6.85 5.79 7.33 37 IN_ZIMBRA_NJ_WHITELIST 25807 4.85 0.07 7.04 38 LOTS_OF_MONEY 23940 8.44 12.61 6.53 39 TR_MAX_INTL_RELAY 23800 8.82 13.90 6.49 40 TR_XM_BayesUnsub 23654 10.52 19.40 6.45 41 TR_XM_DK_Bayes 23210 4.44 0.31 6.33 42 XM_H_GMP 23185 5.59 4.01 6.32 43 TR_XM_DK_Bayes1 22879 4.37 0.30 6.24 44 XM_UncommonTLD01 22408 7.63 10.93 6.11 45 RCVD_IN_MSPIKE_WL 22008 6.93 8.95 6.00 46 RCVD_IN_MSPIKE_H3 22008 6.93 8.95 6.00 47 FSL_BULK_SIG 21054 7.38 10.94 5.74 48 XM_SPF_SoftFail 20518 6.39 8.13 5.60 49 TR_XM_DK_Bayes2 20026 3.82 0.25 5.46 50 XM_H_Long_From01 19604 5.23 4.96 5.35 51 XM_DK_Undo_02 19513 16.57 41.10 5.32 52 T_TooManySym_01 19339 4.37 2.39 5.27 53 XM_PDF 18099 3.58 0.62 4.94 54 MIME_QP_LONG_LINE 17905 4.36 3.22 4.88 55 BAYES_40 17571 4.03 2.36 4.79 56 HTML_IMAGE_RATIO_02 17456 5.41 6.83 4.76 57 TR_XM_SpammyWords4 16773 6.72 11.40 4.57 58 XM_B_SpammyWords3 16556 7.12 12.81 4.51 59 ANY_BOUNCE_MESSAGE 16060 3.60 1.91 4.38 60 BOUNCE_MESSAGE 16055 3.59 1.87 4.38 61 BAYES_99 15955 12.91 31.57 4.35 62 RCVD_IN_VALIDITY_SAFE 15747 3.89 3.00 4.29 63 RELAYCOUNTRY_META 15706 9.21 19.94 4.28 64 RCVD_IN_IADB_LISTED 15656 3.39 1.48 4.27 65 BOTNET_IPINHOSTNAME 15314 6.91 12.87 4.18 66 MPART_ALT_DIFF 15203 4.79 6.18 4.15 67 BAYES_80 14515 5.40 8.54 3.96 68 T_REMOTE_IMAGE 13910 3.07 1.51 3.79 69 RCVD_IN_IADB_SPF 13873 3.02 1.35 3.78 70 RCVD_IN_VALIDITY_CERTIFIED 13438 3.33 2.61 3.66 71 HTML_IMAGE_RATIO_06 13004 3.41 3.11 3.55 72 HTML_IMAGE_RATIO_04 12977 3.98 4.93 3.54 73 XM_B_Phish_Phrases 12960 3.98 4.95 3.53 74 XMSubMetaSx_00 12898 5.59 10.10 3.52 75 BAYES_20 12635 3.12 2.42 3.45 76 RCVD_IN_IADB_SENDERID 12555 2.75 1.29 3.42 77 BAYES_999 12422 9.99 24.37 3.39 78 RCVD_IN_IADB_DK 12237 2.69 1.29 3.34 79 SpammyFromTLD_02 10106 3.26 4.37 2.76 80 XM_Body_Dirty_Words 9691 5.36 11.27 2.64 81 XM_B_SpammyTLD 9621 2.68 2.81 2.62 82 BAYES_05 9499 2.16 1.21 2.59 83 RCVD_IN_IADB_VOUCHED 9359 1.92 0.56 2.55 84 MAILING_LIST_MULTI 9357 2.29 1.73 2.55 85 BAYES_95 9276 3.29 4.94 2.53 86 XMNumbers 9263 3.29 4.95 2.53 87 TooManyTo_002 8996 1.91 0.74 2.45 88 XM_CamelCaseFrm001 8995 2.56 2.80 2.45 89 MIME_HTML_MOSTLY 8988 3.09 4.47 2.45 90 T_TooManySym_02 8940 1.89 0.68 2.44 91 HTML_IMAGE_RATIO_08 8812 2.81 3.70 2.40 92 DKIM_INVALID 8519 2.95 4.32 2.32 93 HTML_MIME_NO_HTML_TAG 8425 2.07 1.57 2.30 94 TR_XM_DKIM_Undo 8398 11.59 31.85 2.29 95 MIME_HTML_ONLY_MULTI 8356 2.52 3.06 2.28 96 TR_XM_SpammyRelay 8228 6.47 15.70 2.24 97 TM2_M_URI_OPT_OUT 7317 2.72 4.29 2.00 98 INVALID_MSGID 7123 1.42 0.29 1.94 99 XM_DK_Undo_01 7016 1.79 1.52 1.91 100 TR_XM_PhishingBody 7016 2.46 3.65 1.91 101 FROM_EXCESS_BASE64 6907 1.98 2.19 1.88 102 XMDiploma_00 6810 2.00 2.31 1.86 103 HELO_NODOT 6725 1.32 0.21 1.83 104 HELO_NO_DOMAIN 6717 1.32 0.21 1.83 105 TO_MALFORMED 6627 1.24 0.01 1.81 106 XM_B_Investor 6560 2.63 4.47 1.79 107 MSGID_NOFQDN1 6528 1.26 0.13 1.78 108 RCVD_IN_IADB_OPTIN 6393 1.32 0.38 1.74 109 XM_B_Unsub2 6353 1.85 2.10 1.73 110 RELAYCOUNTRY_CA 5936 4.55 10.94 1.62 111 URI_NOVOWEL 5823 1.69 1.93 1.59 112 T_XMDrugObfuBody_14 5708 2.15 3.44 1.56 113 TR_Symld_Words 5600 1.40 1.14 1.53 114 IN_HORDE_ADDRESS_BOOK 5554 1.06 0.06 1.51 115 TR_DCC_Bayes_99 5538 8.20 22.77 1.51 116 SUBJ_ALL_CAPS 5434 1.77 2.40 1.48 117 UNTRUSTED_Relay 5383 3.14 6.80 1.47 118 XM_H_Trusted_IP 5273 0.99 0.00 1.44 119 XMSexyCombo_05 5258 3.91 9.31 1.43 120 T_XMDrugObfuBody_08 5213 1.88 2.87 1.42 121 TR_XM_UnparsRelay 5205 3.05 6.59 1.42 122 XM_SendGrid 5076 1.38 1.38 1.38 123 TooManyTo_003 5049 1.15 0.65 1.38 124 TVD_RCVD_IP 4917 1.21 0.92 1.34 125 TR_XM_SpammyWords5 4806 2.41 4.80 1.31 126 XM_OfRef6 4778 2.03 3.60 1.30 127 BOTNET 4772 3.57 8.51 1.30 128 KHOP_HELO_FCRDNS 4521 1.29 1.42 1.23 129 XMStockSpam_06 4475 1.22 1.22 1.22 130 XMGappySubj_01 4309 0.86 0.17 1.18 131 TVD_SPACE_RATIO 4259 0.83 0.10 1.16 132 XM_GoogleGroups 4175 0.91 0.42 1.14 133 URI_HEX 4165 1.36 1.84 1.14 134 XMCapTrack 4149 0.88 0.35 1.13 135 TM2_M_VERY_LONG_WORD 4039 1.60 2.69 1.10 136 XMBody_95 4005 0.79 0.13 1.09 137 XM_H_Long_From02 3869 1.19 1.48 1.06 138 XMBSHREFv2 3857 0.81 0.28 1.05 139 XMNoVowels 3738 0.85 0.47 1.02 140 T_FILL_THIS_FORM_SHORT 3722 1.95 3.99 1.01 141 TooManyTo_004 3646 0.87 0.59 0.99 142 TR_MetaPhish_Combo_01 3613 1.12 1.41 0.99 143 XMGenDplmaNmb 3441 0.98 1.07 0.94 144 DKIM_ADSP_CUSTOM_MED 3430 0.97 1.05 0.94 145 TR_XM_DK_SendGrid 3413 0.92 0.88 0.93 146 XM_UB50 3342 1.72 3.48 0.91 147 XMSubNoVowel 3236 0.74 0.43 0.88 148 SpammyFromTLD_01 3174 1.97 4.37 0.87 149 T_OBFU_PDF_ATTACH 3161 0.64 0.14 0.86 150 T_TooManySym_03 3098 0.63 0.16 0.84 151 TR_XM_Base64_M1 2998 0.95 1.22 0.82 152 TooManyTo_005 2924 0.73 0.57 0.80 153 HTTPS_HTTP_MISMATCH 2801 0.88 1.14 0.76 154 XM_ShortIntro_01 2784 0.72 0.62 0.76 155 XMPhish14 2766 0.84 1.04 0.75 156 XM_H_PHPMailer 2654 0.69 0.63 0.72 157 RELAYCOUNTRY_AU 2601 1.19 2.24 0.71 158 RCVD_IN_BL_SPAMCOP_NET 2537 4.41 12.52 0.69 159 URI_TRY_3LD 2531 0.95 1.51 0.69 160 XMGappySubj_02 2403 0.47 0.07 0.66 161 XM_B_SpammyWords4 2403 1.09 2.03 0.66 162 T_XMDrugObfuBody_00 2397 0.88 1.37 0.65 163 T_Symld_Words_02 2357 0.71 0.86 0.64 164 FROM_GOV_DKIM_AU 2346 0.47 0.08 0.64 165 NML_ADSP_CUSTOM_MED 2316 0.68 0.80 0.63 166 XMMoneyMeta_00 2307 0.64 0.65 0.63 167 XMBrknScrpt_02 2237 1.07 2.08 0.61 168 XM_B_COPY_HTML 2226 0.63 0.68 0.61 169 FILL_THIS_FORM 2208 0.53 0.38 0.60 170 SHORT_HELO_AND_INLINE_IMAGE 2191 0.42 0.03 0.60 171 XM_B_FormFill 2163 0.41 0.01 0.59 172 XMBody_17 2126 1.92 4.84 0.58 173 XMLngstWrd_00 2076 0.69 0.96 0.57 174 USER_IN_WHITELIST 2004 0.37 0.00 0.55 175 USER_IN_WELCOMELIST 2004 0.37 0.00 0.55 176 FORGED_GMAIL_RCVD 1992 0.62 0.79 0.54 177 XMSubMetaI_00 1972 0.78 1.30 0.54 178 XMBdyGiftCard01 1900 0.78 1.36 0.52 179 MPART_ALT_DIFF_COUNT 1892 0.59 0.77 0.52 180 TR_XM_FormFill2 1830 1.09 2.38 0.50 181 TR_XM_PHPForged 1796 1.12 2.50 0.49 182 TO_NO_BRKTS_HTML_ONLY 1789 0.43 0.31 0.49 183 TR_XM_PHPDW 1772 1.09 2.40 0.48 184 XM_H_PHPOS 1752 1.07 2.38 0.48 185 HTML_TAG_BALANCE_BODY 1744 0.74 1.32 0.48 186 PLING_QUERY 1690 0.56 0.78 0.46 187 TR_LOTS_OF_MONEY3 1682 1.02 2.24 0.46 188 RDNS_DYNAMIC 1677 0.66 1.11 0.46 189 XM_ProductURIs 1657 0.53 0.69 0.45 190 RELAYCOUNTRY_NL 1644 0.44 0.41 0.45 191 HTML_IMAGE_ONLY_32 1617 0.41 0.34 0.44 192 TM2_M_BODY_EMPTY 1614 0.66 1.15 0.44 193 XMSolicitRefs_0 1608 0.42 0.37 0.44 194 XMPhish30 1587 0.65 1.12 0.43 195 TR_XM_SPAMCOP 1586 3.64 10.64 0.43 196 TR_XM_SpammyWords2 1586 4.44 13.17 0.43 197 HTML_IMAGE_ONLY_28 1561 0.37 0.25 0.43 198 MISSING_HEADERS 1552 0.49 0.64 0.42 199 XMOemUri 1539 0.33 0.13 0.42 200 XMHTML_After_End 1510 0.66 1.21 0.41 ----------------------------------------------------------------------