Email: 632142 Autolearn: 0 AvgScore: 2.93 AvgScanTime: 1.21 sec Spam: 155487 Autolearn: 0 AvgScore: 13.74 AvgScanTime: 1.51 sec Ham: 476655 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 1.11 sec Time Spent Running SA: 212.18 hours Time Spent Processing Spam: 65.09 hours Time Spent Processing Ham: 147.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 152040 99.08 97.78 99.50 2 HTML_MESSAGE 144055 66.23 92.65 57.61 3 DKIM_SIGNED 140907 60.81 90.62 51.09 4 XM_DK_Pass 133314 58.92 85.74 50.17 5 DKIM_VALID 130673 58.02 84.04 49.53 6 XM_B_Unicode 124844 55.41 80.29 47.29 7 RELAYCOUNTRY_US 122526 60.42 78.80 54.42 8 XM_B_SpammyWords 108401 39.57 69.72 29.73 9 XMListUnsubscribeExists 108076 43.55 69.51 35.09 10 DCC_CHECK 108039 33.98 69.48 22.40 11 DKIM_VALID_AU 97558 45.41 62.74 39.76 12 XM_DK_Undo_02 70028 14.40 45.04 4.41 13 XM_B_Unicode3 66496 31.38 42.77 27.66 14 XM_B_SpammyWords2 62925 19.38 40.47 12.51 15 LOC_TINY_FONT_1 57733 22.51 37.13 17.74 16 BAYES_99 55952 11.35 35.99 3.31 17 BAYES_50 55247 47.63 35.53 51.58 18 TR_XM_DKIM_Undo 50891 9.50 32.73 1.92 19 HTML_FONT_LOW_CONTRAST 49290 21.96 31.70 18.78 20 RCVD_IN_MSPIKE_H2 48821 22.16 31.40 19.15 21 MIME_HTML_ONLY 47544 17.45 30.58 13.17 22 DCC_CHECK_NEGATIVE 47428 66.00 30.50 77.57 23 FVGT_m_MULTI_ODD 47135 20.46 30.31 17.24 24 DKIM_VALID_EF 47101 22.00 30.29 19.29 25 BAYES_999 44568 8.98 28.66 2.56 26 T_KAM_HTML_FONT_INVALID 42226 17.14 27.16 13.88 27 TR_DCC_Bayes_99 40111 7.24 25.80 1.18 28 RELAYCOUNTRY_META 36103 7.89 23.22 2.89 29 XMSubLong 36066 17.29 23.20 15.37 30 T_TM2_M_HEADER_IN_MSG 35871 19.80 23.07 18.74 31 TR_XM_DK_Unsub 33548 12.50 21.58 9.54 32 XM_Multi_Part_URI 29927 12.13 19.25 9.81 33 TR_XM_SpammyRelay 27475 5.65 17.67 1.72 34 XM_B_Unsub 25245 7.88 16.24 5.15 35 TR_XM_BayesUnsub 24156 6.92 15.54 4.11 36 TR_MAX_INTL_RELAY 22577 7.07 14.52 4.64 37 XM_B_SpammyWords3 21324 5.65 13.71 3.01 38 UNPARSEABLE_RELAY 21224 8.89 13.65 7.34 39 RCVD_IN_BL_SPAMCOP_NET 21168 3.70 13.61 0.47 40 TR_XM_SpammyWords2 20241 3.47 13.02 0.35 41 LOTS_OF_MONEY 20184 6.86 12.98 4.87 42 TR_XM_SpammyWords4 18345 5.51 11.80 3.46 43 BOTNET_IPINHOSTNAME 18207 5.36 11.71 3.29 44 TR_XM_SPAMCOP 17836 3.04 11.47 0.28 45 RELAYCOUNTRY_CA 17420 3.52 11.20 1.02 46 BOTNET 17283 3.54 11.12 1.06 47 XM_UncommonTLD01 14957 4.39 9.62 2.68 48 BAYES_80 14253 4.38 9.17 2.82 49 XM_Evil_Numbers_Gen 13320 6.04 8.57 5.21 50 BAYES_60 12751 6.84 8.20 6.40 51 RCVD_IN_MSPIKE_H3 12424 4.99 7.99 4.01 52 RCVD_IN_MSPIKE_WL 12424 4.99 7.99 4.01 53 TR_XM_UnparsRelay 11576 2.57 7.44 0.97 54 UNTRUSTED_Relay 11557 2.55 7.43 0.96 55 FSL_BULK_SIG 11405 3.26 7.34 1.93 56 XM_Body_Dirty_Words 10754 3.12 6.92 1.88 57 LotsOfNums_01 10319 6.18 6.64 6.04 58 DKIM_INVALID 10234 2.79 6.58 1.56 59 XM_SPF_SoftFail 9708 3.15 6.24 2.14 60 MPART_ALT_DIFF 9559 3.62 6.15 2.79 61 HTML_IMAGE_RATIO_02 9493 4.02 6.11 3.34 62 XMBody_17 8868 1.72 5.70 0.41 63 SCC_BODY_URI_ONLY 8423 15.45 5.42 18.72 64 XMSubMetaSx_00 8143 3.50 5.24 2.93 65 XMNumbers 7892 2.56 5.08 1.73 66 BAYES_95 7853 2.62 5.05 1.82 67 XM_OfRef6 7718 1.91 4.96 0.92 68 TooManyTo_001 7172 5.46 4.61 5.73 69 XM_H_GMP 7132 4.31 4.59 4.22 70 XM_H_Long_From01 6901 3.72 4.44 3.48 71 MIME_HTML_MOSTLY 6785 2.48 4.36 1.87 72 XM_B_Investor 6747 1.93 4.34 1.15 73 TR_XM_PhishingBody 6698 1.94 4.31 1.17 74 T_XMDrugObfuBody_14 6550 1.90 4.21 1.15 75 XM_B_Phish_Phrases 6491 2.61 4.17 2.10 76 HTML_IMAGE_RATIO_04 6344 3.10 4.08 2.78 77 T_FILL_THIS_FORM_SHORT 6270 1.50 4.03 0.67 78 XMSexyCombo_05 6247 1.99 4.02 1.33 79 TM2_M_URI_OPT_OUT 6235 1.90 4.01 1.21 80 SpammyFromTLD_01 6221 1.39 4.00 0.54 81 TR_XM_SpammyWords5 6050 1.71 3.89 1.00 82 HTML_IMAGE_RATIO_06 5553 2.37 3.57 1.97 83 XM_UB50 5515 1.30 3.55 0.57 84 TR_XM_PHPDW 5451 1.10 3.51 0.31 85 TR_XM_PHPForged 5440 1.09 3.50 0.31 86 TR_XM_FormFill2 5371 1.09 3.45 0.31 87 XM_H_PHPOS 5354 1.08 3.44 0.30 88 T_XMDrugObfuBody_08 5275 1.65 3.39 1.08 89 XMStrtUSub 5179 3.08 3.33 3.00 90 TR_XM_InvalidRelay 5109 0.82 3.29 0.02 91 RCVD_IN_VALIDITY_SAFE 5030 3.64 3.23 3.77 92 XM_B_SpammyWords4 4965 1.12 3.19 0.44 93 HTML_MIME_NO_HTML_TAG 4862 1.78 3.13 1.33 94 USER_IN_DEF_DKIM_WL 4833 8.19 3.11 9.84 95 HTML_IMAGE_RATIO_08 4814 1.90 3.10 1.51 96 XM_B_SpammyTLD 4783 2.03 3.08 1.68 97 MIME_HTML_ONLY_MULTI 4751 1.82 3.06 1.42 98 RCVD_IN_VALIDITY_RPBL 4529 0.77 2.91 0.07 99 TM2_M_VERY_LONG_WORD 4456 1.51 2.87 1.07 100 TR_Mismatch_TLD_02 4395 0.73 2.83 0.04 101 TR_XM_BayesRelay 4335 0.69 2.79 0.00 102 TR_XM_FormFill 4321 0.69 2.78 0.01 103 RCVD_IN_VALIDITY_CERTIFIED 4243 3.05 2.73 3.16 104 MIME_QP_LONG_LINE 4188 3.29 2.69 3.49 105 TR_LOTS_OF_MONEY3 4180 1.08 2.69 0.56 106 XM_CamelCaseFrm001 4169 1.72 2.68 1.40 107 SUBJ_ALL_CAPS 4159 1.56 2.67 1.20 108 BOTNET_NORDNS 4096 0.65 2.63 0.01 109 BAYES_40 3695 6.37 2.38 7.67 110 TM2_M_A_HREF_HREF 3590 0.72 2.31 0.20 111 TR_XM_NoHeaderRelay 3575 0.61 2.30 0.06 112 XM_URI_RBL 3496 0.64 2.25 0.12 113 SpammyFromTLD_02 3437 0.76 2.21 0.28 114 T_TooManySym_01 3342 3.14 2.15 3.47 115 TM2_M_BODY_EMPTY 3336 0.73 2.15 0.27 116 XMEmptyBody_01 3256 0.55 2.09 0.05 117 FROM_EXCESS_BASE64 3169 1.47 2.04 1.29 118 BAYES_20 3110 2.16 2.00 2.21 119 XM_B_Unsub2 3102 1.20 2.00 0.94 120 TR_Symld_Words 3086 1.22 1.98 0.97 121 RELAYCOUNTRY_AU 3050 0.91 1.96 0.56 122 HOSTED_IMG_MULTI_PUB_01 3010 0.48 1.94 0.01 123 TO_MALFORMED 2882 1.52 1.85 1.40 124 XMDiploma_00 2879 1.29 1.85 1.11 125 FONT_INVIS_LONG_LINE 2839 0.47 1.83 0.02 126 T_HTML_TAG_BALANCE_CENTER 2781 0.48 1.79 0.06 127 T_XMDrugObfuBody_00 2744 0.73 1.76 0.39 128 RELAYCOUNTRY_VN 2738 0.43 1.76 0.00 129 HTML_SHORT_LINK_IMG_1 2650 0.43 1.70 0.01 130 HTML_IMAGE_ONLY_12 2615 0.53 1.68 0.15 131 RELAYCOUNTRY_UA 2526 0.40 1.62 0.00 132 CANT_SEE_AD 2518 0.40 1.62 0.00 133 THIS_AD 2516 0.69 1.62 0.38 134 XM_ShortIntro_01 2470 0.77 1.59 0.50 135 MAILING_LIST_MULTI 2432 1.63 1.56 1.66 136 ANY_BOUNCE_MESSAGE 2430 27.45 1.56 35.89 137 BOUNCE_MESSAGE 2423 27.45 1.56 35.89 138 T_REMOTE_IMAGE 2414 2.20 1.55 2.40 139 XMReplyNow 2406 0.51 1.55 0.18 140 TR_XM_INV_DKIM 2382 0.40 1.53 0.04 141 XM_DIRTYINTL 2374 0.41 1.53 0.05 142 XMPhish14 2332 0.64 1.50 0.36 143 XMBrknScrpt_02 2309 0.79 1.49 0.56 144 URI_TRY_3LD 2302 0.75 1.48 0.51 145 XM_DK_Undo_01 2216 1.27 1.43 1.23 146 XM_B_COPY_HTML 2204 0.73 1.42 0.51 147 XMStockSpam_06 2146 1.04 1.38 0.93 148 URI_HEX 2133 0.96 1.37 0.82 149 XM_E_VN 2097 0.33 1.35 0.00 150 XM_SendGrid 2050 1.03 1.32 0.94 151 RCVD_IN_IADB_LISTED 2002 2.62 1.29 3.06 152 HK_RANDOM_REPLYTO 1997 0.38 1.28 0.08 153 TR_Caps_n_Bayes_99 1923 0.31 1.24 0.01 154 KHOP_HELO_FCRDNS 1910 0.89 1.23 0.78 155 FILL_THIS_FORM 1909 0.60 1.23 0.40 156 T_XMHurry_00 1893 0.54 1.22 0.32 157 AC_BR_BONANZA 1885 0.35 1.21 0.06 158 HTTPS_HTTP_MISMATCH 1884 0.72 1.21 0.56 159 XMPhish30 1877 0.58 1.21 0.37 160 TVD_PH_BODY_ACCOUNTS_PRE 1836 0.36 1.18 0.09 161 RCVD_IN_IADB_SPF 1819 2.35 1.17 2.74 162 XM_HighProb1 1793 0.29 1.15 0.00 163 XMMoneyMeta_00 1750 0.47 1.13 0.26 164 RCVD_IN_IADB_DK 1736 2.11 1.12 2.43 165 TR_XM_SpoofStaff 1735 0.32 1.12 0.06 166 RCVD_IN_IADB_SENDERID 1732 2.15 1.11 2.48 167 XMSpoofStaff2 1729 0.32 1.11 0.06 168 TR_XM_PSC1 1711 0.31 1.10 0.05 169 XM_H_SpoofStaff4 1710 0.33 1.10 0.08 170 ALL_TRUSTED 1707 32.95 1.10 43.34 171 TR_XM_Base64_M1 1689 0.75 1.09 0.64 172 T_STY_INVIS_DIRECT 1688 0.39 1.09 0.16 173 XMSubMetaI_00 1676 0.63 1.08 0.49 174 TR_XM_Spammywords 1603 0.37 1.03 0.15 175 XM_S_SpammyWords 1603 0.37 1.03 0.15 176 XM_UB60 1595 0.28 1.03 0.03 177 HTML_TAG_BALANCE_BODY 1590 0.48 1.02 0.30 178 XM_H_Undi_Recip 1570 0.33 1.01 0.11 179 XMBdyGiftCard01 1565 0.56 1.01 0.41 180 URI_NOVOWEL 1537 1.00 0.99 1.01 181 TR_XM_SpoofStaff2 1530 0.24 0.98 0.00 182 XM_ProductURIs 1507 0.61 0.97 0.50 183 DKIM_ADSP_CUSTOM_MED 1499 0.65 0.96 0.54 184 HTML_FONT_FACE_BAD 1491 0.50 0.96 0.35 185 FILL_THIS_FORM_LONG 1468 0.38 0.94 0.19 186 RDNS_DYNAMIC 1467 0.40 0.94 0.23 187 LongTLD 1446 0.45 0.93 0.30 188 XMSexyCombo_01 1427 0.36 0.92 0.18 189 XM_B_Phish66 1425 0.44 0.92 0.28 190 XMGenDplmaNmb 1398 0.68 0.90 0.61 191 BAYES_05 1396 1.59 0.90 1.81 192 XM_UB80 1386 0.23 0.89 0.01 193 XM_B_DNDMA 1370 0.48 0.88 0.35 194 TR_XM_Base64_L1 1364 0.30 0.88 0.11 195 RCVD_IN_PSBL 1342 0.46 0.86 0.33 196 TR_MetaPhish_Combo_01 1341 0.62 0.86 0.54 197 TR_XM_Undi_Recip19 1336 0.25 0.86 0.04 198 XM_UB99 1334 0.21 0.86 0.00 199 T_MONEY_PERCENT 1332 0.40 0.86 0.25 200 TR_LOTS_OF_MONEY2 1332 0.40 0.86 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 474287 99.08 97.78 99.50 2 DCC_CHECK_NEGATIVE 369765 66.00 30.50 77.57 3 HTML_MESSAGE 274583 66.23 92.65 57.61 4 RELAYCOUNTRY_US 259399 60.42 78.80 54.42 5 BAYES_50 245853 47.63 35.53 51.58 6 DKIM_SIGNED 243504 60.81 90.62 51.09 7 XM_DK_Pass 239155 58.92 85.74 50.17 8 DKIM_VALID 236079 58.02 84.04 49.53 9 XM_B_Unicode 225432 55.41 80.29 47.29 10 ALL_TRUSTED 206562 32.95 1.10 43.34 11 DKIM_VALID_AU 189495 45.41 62.74 39.76 12 ANY_BOUNCE_MESSAGE 171077 27.45 1.56 35.89 13 BOUNCE_MESSAGE 171074 27.45 1.56 35.89 14 XMListUnsubscribeExists 167241 43.55 69.51 35.09 15 XM_B_SpammyWords 141713 39.57 69.72 29.73 16 XM_B_Unicode3 131865 31.38 42.77 27.66 17 DCC_CHECK 106760 33.98 69.48 22.40 18 BAYES_00 106621 17.05 0.73 22.37 19 DKIM_VALID_EF 91966 22.00 30.29 19.29 20 RCVD_IN_MSPIKE_H2 91285 22.16 31.40 19.15 21 HTML_FONT_LOW_CONTRAST 89535 21.96 31.70 18.78 22 T_TM2_M_HEADER_IN_MSG 89319 19.80 23.07 18.74 23 SCC_BODY_URI_ONLY 89227 15.45 5.42 18.72 24 LOC_TINY_FONT_1 84577 22.51 37.13 17.74 25 FVGT_m_MULTI_ODD 82177 20.46 30.31 17.24 26 XMSubLong 73253 17.29 23.20 15.37 27 T_KAM_HTML_FONT_INVALID 66139 17.14 27.16 13.88 28 MIME_HTML_ONLY 62793 17.45 30.58 13.17 29 XM_B_SpammyWords2 59610 19.38 40.47 12.51 30 USER_IN_DEF_DKIM_WL 46911 8.19 3.11 9.84 31 XM_Multi_Part_URI 46778 12.13 19.25 9.81 32 TR_XM_DK_Unsub 45453 12.50 21.58 9.54 33 BAYES_40 36568 6.37 2.38 7.67 34 UNPARSEABLE_RELAY 34991 8.89 13.65 7.34 35 BAYES_60 30519 6.84 8.20 6.40 36 LotsOfNums_01 28769 6.18 6.64 6.04 37 TooManyTo_001 27322 5.46 4.61 5.73 38 XM_DKIMWhitelistDomains 26434 4.18 0.01 5.55 39 XM_Evil_Numbers_Gen 24843 6.04 8.57 5.21 40 XM_B_Unsub 24542 7.88 16.24 5.15 41 LOTS_OF_MONEY 23195 6.86 12.98 4.87 42 IN_ZIMBRA_NJ_WHITELIST 22420 3.56 0.05 4.70 43 TR_MAX_INTL_RELAY 22121 7.07 14.52 4.64 44 XM_DK_Undo_02 21005 14.40 45.04 4.41 45 XM_H_GMP 20117 4.31 4.59 4.22 46 TR_XM_DK_Bayes 19848 3.25 0.43 4.16 47 TR_XM_BayesUnsub 19612 6.92 15.54 4.11 48 TR_XM_DK_Bayes1 19576 3.20 0.43 4.11 49 RCVD_IN_MSPIKE_H3 19110 4.99 7.99 4.01 50 RCVD_IN_MSPIKE_WL 19110 4.99 7.99 4.01 51 RCVD_IN_VALIDITY_SAFE 17988 3.64 3.23 3.77 52 TR_XM_DK_Bayes2 17022 2.76 0.26 3.57 53 MIME_QP_LONG_LINE 16619 3.29 2.69 3.49 54 XM_H_Long_From01 16588 3.72 4.44 3.48 55 T_TooManySym_01 16536 3.14 2.15 3.47 56 TR_XM_SpammyWords4 16471 5.51 11.80 3.46 57 HTML_IMAGE_RATIO_02 15918 4.02 6.11 3.34 58 BAYES_99 15799 11.35 35.99 3.31 59 BOTNET_IPINHOSTNAME 15660 5.36 11.71 3.29 60 RCVD_IN_VALIDITY_CERTIFIED 15053 3.05 2.73 3.16 61 RCVD_IN_IADB_LISTED 14571 2.62 1.29 3.06 62 XM_PDF 14544 2.42 0.48 3.05 63 XM_B_SpammyWords3 14370 5.65 13.71 3.01 64 XMStrtUSub 14292 3.08 3.33 3.00 65 XMSubMetaSx_00 13985 3.50 5.24 2.93 66 RELAYCOUNTRY_META 13799 7.89 23.22 2.89 67 BAYES_80 13420 4.38 9.17 2.82 68 MPART_ALT_DIFF 13321 3.62 6.15 2.79 69 HTML_IMAGE_RATIO_04 13268 3.10 4.08 2.78 70 RCVD_IN_IADB_SPF 13059 2.35 1.17 2.74 71 XM_UncommonTLD01 12778 4.39 9.62 2.68 72 BAYES_999 12198 8.98 28.66 2.56 73 RCVD_IN_IADB_SENDERID 11830 2.15 1.11 2.48 74 RCVD_IN_IADB_DK 11586 2.11 1.12 2.43 75 T_REMOTE_IMAGE 11463 2.20 1.55 2.40 76 BAYES_20 10556 2.16 2.00 2.21 77 XM_SPF_SoftFail 10220 3.15 6.24 2.14 78 XM_B_Phish_Phrases 10015 2.61 4.17 2.10 79 HTML_IMAGE_RATIO_06 9401 2.37 3.57 1.97 80 FSL_BULK_SIG 9182 3.26 7.34 1.93 81 TR_XM_DKIM_Undo 9158 9.50 32.73 1.92 82 XM_Body_Dirty_Words 8939 3.12 6.92 1.88 83 MIME_HTML_MOSTLY 8922 2.48 4.36 1.87 84 BAYES_95 8692 2.62 5.05 1.82 85 BAYES_05 8627 1.59 0.90 1.81 86 TooManyTo_002 8560 1.55 0.82 1.80 87 RCVD_IN_IADB_VOUCHED 8421 1.47 0.56 1.77 88 XMNumbers 8269 2.56 5.08 1.73 89 TR_XM_SpammyRelay 8220 5.65 17.67 1.72 90 XM_B_SpammyTLD 8029 2.03 3.08 1.68 91 T_TooManySym_02 7994 1.42 0.65 1.68 92 MAILING_LIST_MULTI 7893 1.63 1.56 1.66 93 INVALID_MSGID 7439 1.21 0.13 1.56 94 DKIM_INVALID 7425 2.79 6.58 1.56 95 HTML_IMAGE_RATIO_08 7182 1.90 3.10 1.51 96 MSGID_NOFQDN1 6897 1.10 0.03 1.45 97 MIME_HTML_ONLY_MULTI 6763 1.82 3.06 1.42 98 TO_MALFORMED 6697 1.52 1.85 1.40 99 XM_CamelCaseFrm001 6692 1.72 2.68 1.40 100 HTML_MIME_NO_HTML_TAG 6362 1.78 3.13 1.33 101 XMSexyCombo_05 6351 1.99 4.02 1.33 102 FROM_EXCESS_BASE64 6147 1.47 2.04 1.29 103 TVD_RCVD_IP 5870 1.11 0.74 1.23 104 XM_DK_Undo_01 5840 1.27 1.43 1.23 105 TM2_M_URI_OPT_OUT 5773 1.90 4.01 1.21 106 SUBJ_ALL_CAPS 5717 1.56 2.67 1.20 107 TR_DCC_Bayes_99 5635 7.24 25.80 1.18 108 TR_XM_PhishingBody 5596 1.94 4.31 1.17 109 RCVD_IN_IADB_OPTIN 5582 0.99 0.44 1.17 110 HELO_NODOT 5520 0.94 0.28 1.16 111 HELO_NO_DOMAIN 5515 0.94 0.28 1.16 112 XM_B_Investor 5476 1.93 4.34 1.15 113 T_XMDrugObfuBody_14 5461 1.90 4.21 1.15 114 XMDiploma_00 5286 1.29 1.85 1.11 115 T_XMDrugObfuBody_08 5130 1.65 3.39 1.08 116 TM2_M_VERY_LONG_WORD 5088 1.51 2.87 1.07 117 BOTNET 5064 3.54 11.12 1.06 118 RELAYCOUNTRY_CA 4845 3.52 11.20 1.02 119 URI_NOVOWEL 4800 1.00 0.99 1.01 120 IN_HORDE_ADDRESS_BOOK 4786 0.78 0.07 1.00 121 TR_XM_SpammyWords5 4772 1.71 3.89 1.00 122 TooManyTo_003 4680 0.91 0.68 0.98 123 TR_XM_UnparsRelay 4643 2.57 7.44 0.97 124 TR_Symld_Words 4612 1.22 1.98 0.97 125 UNTRUSTED_Relay 4594 2.55 7.43 0.96 126 XM_SendGrid 4491 1.03 1.32 0.94 127 XM_B_Unsub2 4462 1.20 2.00 0.94 128 XMStockSpam_06 4451 1.04 1.38 0.93 129 XM_OfRef6 4377 1.91 4.96 0.92 130 XMBSHREFv2 4057 0.73 0.37 0.85 131 XMGappySubj_01 3967 0.65 0.10 0.83 132 URI_HEX 3920 0.96 1.37 0.82 133 XMBody_95 3800 0.64 0.16 0.80 134 KHOP_HELO_FCRDNS 3737 0.89 1.23 0.78 135 TVD_SPACE_RATIO 3725 0.61 0.08 0.78 136 XM_GoogleGroups 3588 0.69 0.50 0.75 137 XM_H_Long_From02 3501 0.75 0.79 0.73 138 TooManyTo_004 3423 0.70 0.64 0.72 139 XMCapTrack 3251 0.60 0.34 0.68 140 T_FILL_THIS_FORM_SHORT 3203 1.50 4.03 0.67 141 TR_XM_Base64_M1 3067 0.75 1.09 0.64 142 TR_XM_DK_SendGrid 3061 0.67 0.76 0.64 143 XMGenDplmaNmb 2898 0.68 0.90 0.61 144 T_TooManySym_03 2789 0.51 0.27 0.59 145 XM_UB50 2701 1.30 3.55 0.57 146 TooManyTo_005 2693 0.58 0.61 0.56 147 RELAYCOUNTRY_AU 2679 0.91 1.96 0.56 148 HTTPS_HTTP_MISMATCH 2678 0.72 1.21 0.56 149 TR_LOTS_OF_MONEY3 2664 1.08 2.69 0.56 150 XMBrknScrpt_02 2659 0.79 1.49 0.56 151 DKIM_ADSP_CUSTOM_MED 2596 0.65 0.96 0.54 152 TR_MetaPhish_Combo_01 2594 0.62 0.86 0.54 153 SpammyFromTLD_01 2591 1.39 4.00 0.54 154 XMGappySubj_02 2500 0.41 0.05 0.52 155 URI_TRY_3LD 2422 0.75 1.48 0.51 156 XM_B_COPY_HTML 2412 0.73 1.42 0.51 157 XM_ProductURIs 2380 0.61 0.97 0.50 158 XM_ShortIntro_01 2375 0.77 1.59 0.50 159 XMSubMetaI_00 2326 0.63 1.08 0.49 160 RCVD_IN_BL_SPAMCOP_NET 2236 3.70 13.61 0.47 161 XM_B_FormFill 2132 0.36 0.10 0.45 162 FROM_GOV_DKIM_AU 2093 0.36 0.11 0.44 163 XM_B_SpammyWords4 2090 1.12 3.19 0.44 164 XMLngstWrd_00 1988 0.41 0.37 0.42 165 XMBody_17 1976 1.72 5.70 0.41 166 XMBdyGiftCard01 1974 0.56 1.01 0.41 167 LOW_PRICE 1963 0.35 0.17 0.41 168 T_OBFU_PDF_ATTACH 1949 0.33 0.08 0.41 169 XM_H_PHPMailer 1913 0.46 0.62 0.40 170 FILL_THIS_FORM 1912 0.60 1.23 0.40 171 USER_IN_WELCOMELIST 1910 0.30 0.00 0.40 172 USER_IN_WHITELIST 1910 0.30 0.00 0.40 173 T_XMDrugObfuBody_00 1864 0.73 1.76 0.39 174 THIS_AD 1835 0.69 1.62 0.38 175 SHORT_HELO_AND_INLINE_IMAGE 1808 0.30 0.04 0.38 176 XMPhish30 1760 0.58 1.21 0.37 177 MPART_ALT_DIFF_COUNT 1725 0.47 0.81 0.36 178 XMPhish14 1707 0.64 1.50 0.36 179 PLING_QUERY 1705 0.46 0.79 0.36 180 HTML_FONT_FACE_BAD 1687 0.50 0.96 0.35 181 TR_XM_SpammyWords2 1682 3.47 13.02 0.35 182 NML_ADSP_CUSTOM_MED 1674 0.46 0.78 0.35 183 XM_B_DNDMA 1668 0.48 0.88 0.35 184 NUMERIC_HTTP_ADDR 1661 0.33 0.28 0.35 185 SHOPIFY_IMG_NOT_RCVD_SFY 1589 0.41 0.63 0.33 186 T_HTML_ATTACH 1581 0.26 0.05 0.33 187 RCVD_IN_PSBL 1558 0.46 0.86 0.33 188 T_XMHurry_00 1526 0.54 1.22 0.32 189 MISSING_HEADERS 1524 0.39 0.61 0.32 190 GMD_PDF_EMPTY_BODY 1524 0.25 0.05 0.32 191 TR_XM_FormFill2 1497 1.09 3.45 0.31 192 TR_XM_PHPDW 1490 1.10 3.51 0.31 193 TO_NO_BRKTS_HTML_ONLY 1484 0.28 0.19 0.31 194 XMNoVowels 1474 0.31 0.32 0.31 195 TR_XM_PHPForged 1467 1.09 3.50 0.31 196 XM_H_PHPOS 1449 1.08 3.44 0.30 197 FORGED_GMAIL_RCVD 1440 0.41 0.72 0.30 198 HTML_TAG_BALANCE_BODY 1437 0.48 1.02 0.30 199 LongTLD 1423 0.45 0.93 0.30 200 HTML_IMAGE_ONLY_28 1421 0.26 0.14 0.30 ----------------------------------------------------------------------