Email: 539762 Autolearn: 0 AvgScore: 4.43 AvgScanTime: 1.42 sec Spam: 178280 Autolearn: 0 AvgScore: 13.64 AvgScanTime: 1.53 sec Ham: 361482 Autolearn: 0 AvgScore: -0.11 AvgScanTime: 1.36 sec Time Spent Running SA: 212.22 hours Time Spent Processing Spam: 75.96 hours Time Spent Processing Ham: 136.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 172475 90.13 96.74 86.86 2 DKIM_SIGNED 161582 81.25 90.63 76.63 3 XM_DK_Pass 155315 79.11 87.12 75.16 4 DKIM_VALID 153240 78.05 85.95 74.15 5 XM_B_Unicode 151943 75.30 85.23 70.41 6 RELAYCOUNTRY_US 140258 81.06 78.67 82.24 7 XMListUnsubscribeExists 131806 58.99 73.93 51.61 8 XM_B_SpammyWords 131498 54.84 73.76 45.50 9 DCC_CHECK 130083 46.88 72.97 34.02 10 T_SCC_BODY_TEXT_LINE 119115 66.35 66.81 66.12 11 DKIM_VALID_AU 114671 61.21 64.32 59.68 12 XM_DK_Undo_02 80640 18.55 45.23 5.39 13 XM_B_SpammyWords2 79737 27.99 44.73 19.73 14 XM_B_Unicode3 78811 41.66 44.21 40.40 15 LOC_TINY_FONT_1 73763 31.43 41.37 26.52 16 BAYES_50 68468 52.84 38.40 59.96 17 HTML_FONT_LOW_CONTRAST 65494 31.12 36.74 28.34 18 BAYES_99 61977 14.16 34.76 4.00 19 TR_XM_DKIM_Undo 61852 13.01 34.69 2.32 20 FVGT_m_MULTI_ODD 60293 28.49 33.82 25.87 21 RCVD_IN_MSPIKE_H2 57957 30.71 32.51 29.82 22 DKIM_VALID_EF 55881 29.86 31.34 29.13 23 T_KAM_HTML_FONT_INVALID 54401 25.09 30.51 22.41 24 MIME_HTML_ONLY 53665 22.35 30.10 18.53 25 DCC_CHECK_NEGATIVE 48165 53.07 27.02 65.93 26 BAYES_999 47731 10.84 26.77 2.97 27 TR_DCC_Bayes_99 44241 9.18 24.82 1.47 28 TR_XM_DK_Unsub 42651 17.26 23.92 13.98 29 T_TM2_M_HEADER_IN_MSG 40467 27.34 22.70 29.64 30 XMSubLong 39811 22.87 22.33 23.14 31 RELAYCOUNTRY_META 38347 9.82 21.51 4.05 32 XM_Multi_Part_URI 34657 15.18 19.44 13.07 33 TR_XM_SpammyRelay 30413 7.18 17.06 2.31 34 XM_B_SpammyWords3 27700 8.38 15.54 4.85 35 XM_B_Unsub 27431 10.61 15.39 8.25 36 TR_MAX_INTL_RELAY 27093 9.60 15.20 6.84 37 TR_XM_SpammyWords2 27066 5.46 15.18 0.66 38 TR_XM_BayesUnsub 26554 9.46 14.89 6.78 39 LOTS_OF_MONEY 25282 9.20 14.18 6.74 40 BOTNET_IPINHOSTNAME 24958 7.28 14.00 3.97 41 UNPARSEABLE_RELAY 23399 11.82 13.12 11.17 42 RCVD_IN_BL_SPAMCOP_NET 23383 4.81 13.12 0.72 43 TR_XM_SpammyWords4 23358 7.52 13.10 4.77 44 TR_XM_SPAMCOP 20282 4.04 11.38 0.42 45 RELAYCOUNTRY_CA 19346 4.33 10.85 1.11 46 BOTNET 17835 4.19 10.00 1.32 47 BAYES_80 16368 5.82 9.18 4.16 48 XM_Evil_Numbers_Gen 15864 8.52 8.90 8.34 49 RCVD_IN_MSPIKE_WL 15690 6.98 8.80 6.08 50 RCVD_IN_MSPIKE_H3 15690 6.98 8.80 6.08 51 BAYES_60 14519 9.10 8.14 9.57 52 FSL_BULK_SIG 13779 4.48 7.73 2.88 53 MPART_ALT_DIFF 13273 4.99 7.45 3.78 54 UNTRUSTED_Relay 13075 3.41 7.33 1.47 55 TR_XM_UnparsRelay 12386 3.45 6.95 1.72 56 XMBody_17 11847 2.71 6.65 0.76 57 LotsOfNums_01 11794 8.20 6.62 8.98 58 XM_Body_Dirty_Words 11717 3.94 6.57 2.65 59 XM_UncommonTLD01 11330 4.52 6.36 3.62 60 TooManyTo_001 10671 7.43 5.99 8.14 61 XMSubMetaSx_00 10211 4.27 5.73 3.55 62 BAYES_95 9911 3.63 5.56 2.68 63 HTML_IMAGE_RATIO_02 9785 4.95 5.49 4.68 64 XMSexyCombo_05 9352 2.64 5.25 1.36 65 RCVD_IN_VALIDITY_RPBL 9253 1.83 5.19 0.18 66 XM_B_SEO 8979 2.54 5.04 1.31 67 TR_XM_SpammyWords5 8785 2.64 4.93 1.52 68 XM_H_Long_From01 8678 5.26 4.87 5.45 69 MIME_QP_LONG_LINE 8621 5.09 4.84 5.21 70 XM_B_Phish_Phrases 8553 3.83 4.80 3.35 71 XM_B_Investor 8460 2.76 4.75 1.79 72 XM_SPF_SoftFail 8409 3.73 4.72 3.24 73 DKIM_INVALID 8342 3.20 4.68 2.47 74 XM_OfRef6 8048 2.14 4.51 0.97 75 HTML_IMAGE_RATIO_06 7892 3.43 4.43 2.93 76 HTML_IMAGE_RATIO_04 7879 4.41 4.42 4.41 77 TR_XM_SEO4 7546 1.89 4.23 0.74 78 XM_UB50 7394 1.97 4.15 0.90 79 XM_H_GMP 7321 5.51 4.11 6.20 80 TR_LOTS_OF_MONEY3 7186 1.74 4.03 0.61 81 TR_XM_PhishingBody 7129 2.45 4.00 1.69 82 XMNumbers 6983 3.22 3.92 2.88 83 MIME_HTML_MOSTLY 6753 2.89 3.79 2.45 84 XMStrtUSub 6724 4.18 3.77 4.39 85 T_XMDrugObfuBody_14 6718 2.28 3.77 1.55 86 T_FILL_THIS_FORM_SHORT 6446 1.92 3.62 1.09 87 HTML_IMAGE_RATIO_08 6239 2.70 3.50 2.30 88 MIME_HTML_ONLY_MULTI 6141 2.63 3.44 2.23 89 TR_XM_NoHeaderRelay 5888 1.19 3.30 0.15 90 XM_B_SpammyTLD 5870 2.82 3.29 2.58 91 TM2_M_VERY_LONG_WORD 5759 1.92 3.23 1.27 92 TM2_M_URI_OPT_OUT 5663 2.08 3.18 1.54 93 T_XMDrugObfuBody_08 5405 1.96 3.03 1.42 94 ANY_BOUNCE_MESSAGE 5390 3.14 3.02 3.19 95 BOUNCE_MESSAGE 5390 3.14 3.02 3.19 96 T_TooManySym_01 5107 4.91 2.86 5.91 97 XM_B_SpammyWords4 5027 1.40 2.82 0.70 98 XM_CamelCaseFrm001 4948 2.48 2.78 2.33 99 FONT_INVIS_LONG_LINE 4853 0.93 2.72 0.04 100 SUBJ_ALL_CAPS 4776 2.11 2.68 1.83 101 SpammyFromTLD_01 4770 1.41 2.68 0.79 102 USER_IN_DEF_DKIM_WL 4703 10.61 2.64 14.54 103 TR_XM_BayesRelay 4506 0.84 2.53 0.00 104 DKIM_ADSP_NXDOMAIN 4476 1.04 2.51 0.31 105 XMDiploma_00 4328 1.98 2.43 1.75 106 XM_URI_RBL 4028 0.86 2.26 0.17 107 XM_B_Unsub2 3921 1.87 2.20 1.71 108 RCVD_IN_VALIDITY_SAFE 3877 3.99 2.17 4.89 109 HOSTED_IMG_MULTI_PUB_01 3867 0.73 2.17 0.02 110 TR_XM_FormFill 3818 0.72 2.14 0.02 111 T_XMHurry_00 3618 1.02 2.03 0.52 112 URI_TRY_3LD 3604 1.19 2.02 0.78 113 FROM_EXCESS_BASE64 3531 1.92 1.98 1.90 114 RELAYCOUNTRY_AU 3523 1.20 1.98 0.81 115 XMBrknScrpt_02 3326 1.17 1.87 0.83 116 T_REMOTE_IMAGE 3225 3.23 1.81 3.92 117 MAILING_LIST_MULTI 3222 2.42 1.81 2.72 118 HTTPS_HTTP_MISMATCH 3166 1.26 1.78 1.01 119 TR_XM_INV_DKIM 3137 0.63 1.76 0.07 120 TR_Mismatch_TLD_02 3087 0.63 1.73 0.08 121 ALL_TRUSTED 3059 10.37 1.72 14.63 122 HTML_MIME_NO_HTML_TAG 3049 1.96 1.71 2.09 123 XMBounce_01 3029 0.58 1.70 0.03 124 RCVD_IN_VALIDITY_CERTIFIED 3015 3.26 1.69 4.03 125 SpammyFromTLD_02 2831 0.81 1.59 0.42 126 HK_RANDOM_REPLYTO 2801 0.58 1.57 0.09 127 XM_H_Long_From02 2775 1.17 1.56 0.97 128 XM_DK_Undo_01 2770 1.89 1.55 2.05 129 XM_DIRTYINTL 2752 0.59 1.54 0.12 130 BAYES_40 2641 3.78 1.48 4.91 131 URIBL_DBL_SPAM 2636 0.50 1.48 0.01 132 URI_NOVOWEL 2514 1.29 1.41 1.24 133 XMStockSpam_06 2508 1.20 1.41 1.09 134 TR_Symld_Words 2498 1.55 1.40 1.62 135 RCVD_IN_IADB_LISTED 2434 3.09 1.37 3.94 136 THIS_AD 2426 0.78 1.36 0.49 137 XM_SendGrid 2422 1.50 1.36 1.57 138 TR_XM_PHPForged 2415 0.70 1.35 0.38 139 TR_XM_PHPDW 2385 0.70 1.34 0.38 140 T_XMDrugObfuBody_00 2355 1.14 1.32 1.05 141 TR_XM_FormFill2 2319 0.68 1.30 0.38 142 XMHTML_After_End 2300 0.77 1.29 0.51 143 XM_H_PHPOS 2295 0.67 1.29 0.37 144 XM_B_PhoneNumber 2287 2.69 1.28 3.38 145 KHOP_HELO_FCRDNS 2273 1.25 1.27 1.24 146 URI_HEX 2264 1.16 1.27 1.11 147 RELAYCOUNTRY_CN 2259 0.48 1.27 0.10 148 RELAYCOUNTRY_IN 2253 0.46 1.26 0.07 149 XM_HighProb1 2232 0.42 1.25 0.00 150 XMGenDplmaNmb 2220 1.01 1.25 0.89 151 RCVD_IN_IADB_SPF 2192 2.72 1.23 3.45 152 XMPhish30 2174 0.73 1.22 0.50 153 BOTNET_NORDNS 2079 0.39 1.17 0.01 154 RCVD_IN_IADB_SENDERID 2075 2.46 1.16 3.09 155 DKIM_ADSP_CUSTOM_MED 2059 0.97 1.15 0.87 156 TR_Caps_n_Bayes_99 2052 0.40 1.15 0.03 157 HTML_TAG_BALANCE_BODY 2049 0.74 1.15 0.54 158 RCVD_IN_IADB_DK 2042 2.40 1.15 3.02 159 TR_XM_InvalidRelay 2006 0.38 1.13 0.02 160 XMSubMetaI_00 1997 0.78 1.12 0.61 161 XM_UB60 1996 0.42 1.12 0.07 162 XMReplyNow 1995 0.54 1.12 0.26 163 XMPhish14 1921 0.66 1.08 0.45 164 XM_B_Phish66 1887 0.58 1.06 0.35 165 BAYES_20 1870 2.75 1.05 3.59 166 AC_BR_BONANZA 1864 0.42 1.05 0.11 167 XMBdyGiftCard01 1841 0.87 1.03 0.78 168 MPART_ALT_DIFF_COUNT 1759 0.80 0.99 0.70 169 TR_MetaPhish_Combo_01 1751 0.92 0.98 0.89 170 NML_ADSP_CUSTOM_MED 1725 0.71 0.97 0.59 171 XM_ProductURIs 1712 0.87 0.96 0.83 172 TM2_M_A_HREF_HREF 1711 0.49 0.96 0.25 173 PDS_OTHER_BAD_TLD 1703 0.45 0.96 0.20 174 XM_H_Undi_Recip 1702 0.44 0.95 0.19 175 RDNS_DYNAMIC 1677 0.54 0.94 0.35 176 TooManyTo_002 1651 1.94 0.93 2.43 177 XMSexyCombo_01 1606 0.43 0.90 0.20 178 TR_XM_Base64_L1 1578 0.38 0.89 0.12 179 XMMoneyMeta_00 1574 0.80 0.88 0.77 180 XM_UB99 1571 0.29 0.88 0.00 181 BAYES_00 1561 6.42 0.88 9.16 182 T_MONEY_PERCENT 1548 0.43 0.87 0.21 183 TR_LOTS_OF_MONEY2 1548 0.43 0.87 0.21 184 XMHTMLBadTable_001 1536 0.44 0.86 0.23 185 RELAYCOUNTRY_FR 1520 0.44 0.85 0.24 186 PLING_QUERY 1511 0.60 0.85 0.48 187 TooManyTo_003 1492 1.28 0.84 1.49 188 XM_ShortIntro_01 1482 0.73 0.83 0.68 189 T_STY_INVIS_DIRECT 1481 0.50 0.83 0.33 190 LongTLD 1462 0.48 0.82 0.31 191 TR_XM_DK_SendGrid 1450 0.89 0.81 0.92 192 TR_XM_Base64_M1 1441 0.63 0.81 0.54 193 TR_XM_Undi_Recip19 1431 0.31 0.80 0.07 194 XM_B_DNDMA 1424 0.50 0.80 0.36 195 XM_B_COPY_HTML 1412 0.61 0.79 0.52 196 XMBody_78 1408 0.47 0.79 0.31 197 TooManyTo_004 1405 1.01 0.79 1.12 198 XM_S_SpammyWords 1396 0.51 0.78 0.38 199 TR_XM_Spammywords 1391 0.51 0.78 0.38 200 TR_XM_RelayPhish 1379 0.28 0.77 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 313992 90.13 96.74 86.86 2 RELAYCOUNTRY_US 297293 81.06 78.67 82.24 3 DKIM_SIGNED 276986 81.25 90.63 76.63 4 XM_DK_Pass 271679 79.11 87.12 75.16 5 DKIM_VALID 268054 78.05 85.95 74.15 6 XM_B_Unicode 254522 75.30 85.23 70.41 7 T_SCC_BODY_TEXT_LINE 239027 66.35 66.81 66.12 8 DCC_CHECK_NEGATIVE 238309 53.07 27.02 65.93 9 BAYES_50 216752 52.84 38.40 59.96 10 DKIM_VALID_AU 215715 61.21 64.32 59.68 11 XMListUnsubscribeExists 186574 58.99 73.93 51.61 12 XM_B_SpammyWords 164483 54.84 73.76 45.50 13 XM_B_Unicode3 146040 41.66 44.21 40.40 14 DCC_CHECK 122968 46.88 72.97 34.02 15 RCVD_IN_MSPIKE_H2 107803 30.71 32.51 29.82 16 T_TM2_M_HEADER_IN_MSG 107130 27.34 22.70 29.64 17 DKIM_VALID_EF 105297 29.86 31.34 29.13 18 HTML_FONT_LOW_CONTRAST 102462 31.12 36.74 28.34 19 LOC_TINY_FONT_1 95871 31.43 41.37 26.52 20 FVGT_m_MULTI_ODD 93508 28.49 33.82 25.87 21 XMSubLong 83636 22.87 22.33 23.14 22 T_KAM_HTML_FONT_INVALID 81007 25.09 30.51 22.41 23 XM_B_SpammyWords2 71316 27.99 44.73 19.73 24 MIME_HTML_ONLY 66993 22.35 30.10 18.53 25 ALL_TRUSTED 52901 10.37 1.72 14.63 26 USER_IN_DEF_DKIM_WL 52542 10.61 2.64 14.54 27 TR_XM_DK_Unsub 50523 17.26 23.92 13.98 28 XM_Multi_Part_URI 47259 15.18 19.44 13.07 29 UNPARSEABLE_RELAY 40380 11.82 13.12 11.17 30 BAYES_60 34577 9.10 8.14 9.57 31 BAYES_00 33108 6.42 0.88 9.16 32 LotsOfNums_01 32453 8.20 6.62 8.98 33 XM_Evil_Numbers_Gen 30135 8.52 8.90 8.34 34 XM_B_Unsub 29823 10.61 15.39 8.25 35 TooManyTo_001 29407 7.43 5.99 8.14 36 XM_DKIMWhitelistDomains 25365 4.70 0.01 7.02 37 IN_ZIMBRA_NJ_WHITELIST 25213 4.70 0.07 6.97 38 TR_MAX_INTL_RELAY 24741 9.60 15.20 6.84 39 TR_XM_BayesUnsub 24524 9.46 14.89 6.78 40 LOTS_OF_MONEY 24371 9.20 14.18 6.74 41 TR_XM_DK_Bayes 22581 4.42 0.72 6.25 42 XM_H_GMP 22404 5.51 4.11 6.20 43 TR_XM_DK_Bayes1 22199 4.35 0.71 6.14 44 RCVD_IN_MSPIKE_WL 21977 6.98 8.80 6.08 45 RCVD_IN_MSPIKE_H3 21976 6.98 8.80 6.08 46 T_TooManySym_01 21379 4.91 2.86 5.91 47 XM_H_Long_From01 19702 5.26 4.87 5.45 48 XM_DK_Undo_02 19479 18.55 45.23 5.39 49 TR_XM_DK_Bayes2 19292 3.78 0.64 5.34 50 MIME_QP_LONG_LINE 18827 5.09 4.84 5.21 51 BAYES_40 17747 3.78 1.48 4.91 52 RCVD_IN_VALIDITY_SAFE 17663 3.99 2.17 4.89 53 XM_B_SpammyWords3 17525 8.38 15.54 4.85 54 TR_XM_SpammyWords4 17244 7.52 13.10 4.77 55 HTML_IMAGE_RATIO_02 16928 4.95 5.49 4.68 56 XM_PDF 16176 3.22 0.67 4.47 57 HTML_IMAGE_RATIO_04 15944 4.41 4.42 4.41 58 XMStrtUSub 15855 4.18 3.77 4.39 59 BAYES_80 15043 5.82 9.18 4.16 60 RELAYCOUNTRY_META 14655 9.82 21.51 4.05 61 RCVD_IN_VALIDITY_CERTIFIED 14565 3.26 1.69 4.03 62 BAYES_99 14469 14.16 34.76 4.00 63 BOTNET_IPINHOSTNAME 14335 7.28 14.00 3.97 64 RCVD_IN_IADB_LISTED 14258 3.09 1.37 3.94 65 T_REMOTE_IMAGE 14188 3.23 1.81 3.92 66 MPART_ALT_DIFF 13682 4.99 7.45 3.78 67 XM_UncommonTLD01 13088 4.52 6.36 3.62 68 BAYES_20 12975 2.75 1.05 3.59 69 XMSubMetaSx_00 12834 4.27 5.73 3.55 70 RCVD_IN_IADB_SPF 12489 2.72 1.23 3.45 71 XM_B_PhoneNumber 12215 2.69 1.28 3.38 72 XM_B_Phish_Phrases 12126 3.83 4.80 3.35 73 XM_SPF_SoftFail 11728 3.73 4.72 3.24 74 ANY_BOUNCE_MESSAGE 11545 3.14 3.02 3.19 75 BOUNCE_MESSAGE 11542 3.14 3.02 3.19 76 RCVD_IN_IADB_SENDERID 11182 2.46 1.16 3.09 77 RCVD_IN_IADB_DK 10925 2.40 1.15 3.02 78 BAYES_999 10754 10.84 26.77 2.97 79 HTML_IMAGE_RATIO_06 10605 3.43 4.43 2.93 80 XMNumbers 10405 3.22 3.92 2.88 81 FSL_BULK_SIG 10404 4.48 7.73 2.88 82 MAILING_LIST_MULTI 9838 2.42 1.81 2.72 83 BAYES_95 9692 3.63 5.56 2.68 84 XM_Body_Dirty_Words 9572 3.94 6.57 2.65 85 XM_B_SpammyTLD 9331 2.82 3.29 2.58 86 RCVD_IN_IADB_VOUCHED 9312 1.92 0.59 2.58 87 T_TooManySym_02 9058 1.91 0.71 2.51 88 DKIM_INVALID 8932 3.20 4.68 2.47 89 MIME_HTML_MOSTLY 8873 2.89 3.79 2.45 90 TooManyTo_002 8800 1.94 0.93 2.43 91 XM_CamelCaseFrm001 8420 2.48 2.78 2.33 92 TR_XM_DKIM_Undo 8398 13.01 34.69 2.32 93 TR_XM_SpammyRelay 8356 7.18 17.06 2.31 94 HTML_IMAGE_RATIO_08 8325 2.70 3.50 2.30 95 MIME_HTML_ONLY_MULTI 8053 2.63 3.44 2.23 96 HTML_MIME_NO_HTML_TAG 7549 1.96 1.71 2.09 97 XM_DK_Undo_01 7412 1.89 1.55 2.05 98 INVALID_MSGID 7194 1.38 0.14 1.99 99 BAYES_05 7116 1.50 0.54 1.97 100 HELO_NODOT 6989 1.37 0.22 1.93 101 HELO_NO_DOMAIN 6978 1.37 0.22 1.93 102 FROM_EXCESS_BASE64 6851 1.92 1.98 1.90 103 TO_MALFORMED 6818 1.31 0.13 1.89 104 SUBJ_ALL_CAPS 6611 2.11 2.68 1.83 105 RCVD_IN_IADB_OPTIN 6469 1.32 0.37 1.79 106 XM_B_Investor 6457 2.76 4.75 1.79 107 XMDiploma_00 6337 1.98 2.43 1.75 108 TR_XM_UnparsRelay 6229 3.45 6.95 1.72 109 XM_B_Unsub2 6172 1.87 2.20 1.71 110 TR_XM_PhishingBody 6091 2.45 4.00 1.69 111 TR_Symld_Words 5861 1.55 1.40 1.62 112 XM_SendGrid 5676 1.50 1.36 1.57 113 T_XMDrugObfuBody_14 5594 2.28 3.77 1.55 114 TM2_M_URI_OPT_OUT 5550 2.08 3.18 1.54 115 TR_XM_SpammyWords5 5485 2.64 4.93 1.52 116 TooManyTo_003 5399 1.28 0.84 1.49 117 TR_DCC_Bayes_99 5328 9.18 24.82 1.47 118 UNTRUSTED_Relay 5307 3.41 7.33 1.47 119 T_XMDrugObfuBody_08 5149 1.96 3.03 1.42 120 SCC_BODY_URI_ONLY 5066 1.08 0.43 1.40 121 IN_HORDE_ADDRESS_BOOK 5011 0.95 0.07 1.39 122 XMSexyCombo_05 4912 2.64 5.25 1.36 123 BOTNET 4773 4.19 10.00 1.32 124 XM_B_SEO 4738 2.54 5.04 1.31 125 TVD_RCVD_IP 4696 1.12 0.77 1.30 126 TM2_M_VERY_LONG_WORD 4586 1.92 3.23 1.27 127 KHOP_HELO_FCRDNS 4484 1.25 1.27 1.24 128 URI_NOVOWEL 4475 1.29 1.41 1.24 129 XM_GoogleGroups 4355 0.99 0.55 1.20 130 XMGappySubj_01 4255 0.83 0.12 1.18 131 TooManyTo_004 4051 1.01 0.79 1.12 132 RELAYCOUNTRY_CA 4006 4.33 10.85 1.11 133 URI_HEX 4006 1.16 1.27 1.11 134 XMStockSpam_06 3956 1.20 1.41 1.09 135 XMCapTrack 3945 0.88 0.44 1.09 136 T_FILL_THIS_FORM_SHORT 3934 1.92 3.62 1.09 137 TVD_SPACE_RATIO 3826 0.75 0.12 1.06 138 T_XMDrugObfuBody_00 3801 1.14 1.32 1.05 139 XMBSHREFv2 3646 0.76 0.24 1.01 140 HTTPS_HTTP_MISMATCH 3643 1.26 1.78 1.01 141 XM_H_Long_From02 3517 1.17 1.56 0.97 142 XM_OfRef6 3502 2.14 4.51 0.97 143 TooManyTo_005 3367 0.87 0.75 0.93 144 T_TooManySym_03 3352 0.70 0.24 0.93 145 T_Symld_Words_02 3344 0.83 0.65 0.93 146 TR_XM_DK_SendGrid 3338 0.89 0.81 0.92 147 XM_UB50 3263 1.97 4.15 0.90 148 XMGenDplmaNmb 3224 1.01 1.25 0.89 149 TR_MetaPhish_Combo_01 3207 0.92 0.98 0.89 150 DKIM_ADSP_CUSTOM_MED 3160 0.97 1.15 0.87 151 XM_ProductURIs 3004 0.87 0.96 0.83 152 XMBrknScrpt_02 2983 1.17 1.87 0.83 153 RELAYCOUNTRY_AU 2945 1.20 1.98 0.81 154 SpammyFromTLD_01 2840 1.41 2.68 0.79 155 XMBdyGiftCard01 2830 0.87 1.03 0.78 156 URI_TRY_3LD 2808 1.19 2.02 0.78 157 XMMoneyMeta_00 2769 0.80 0.88 0.77 158 XMBody_17 2761 2.71 6.65 0.76 159 TR_XM_SEO4 2676 1.89 4.23 0.74 160 FROM_GOV_DKIM_AU 2664 0.54 0.14 0.74 161 RCVD_IN_BL_SPAMCOP_NET 2591 4.81 13.12 0.72 162 T_OBFU_PDF_ATTACH 2543 0.51 0.13 0.70 163 MPART_ALT_DIFF_COUNT 2535 0.80 0.99 0.70 164 XM_B_SpammyWords4 2517 1.40 2.82 0.70 165 XM_ShortIntro_01 2469 0.73 0.83 0.68 166 TR_XM_SpammyWords2 2402 5.46 15.18 0.66 167 XM_H_PHPMailer 2331 0.63 0.61 0.64 168 XMGappySubj_02 2279 0.43 0.04 0.63 169 XMSubMetaI_00 2220 0.78 1.12 0.61 170 TR_LOTS_OF_MONEY3 2188 1.74 4.03 0.61 171 NML_ADSP_CUSTOM_MED 2120 0.71 0.97 0.59 172 XMNoVowels 2101 0.64 0.75 0.58 173 SHORT_HELO_AND_INLINE_IMAGE 2074 0.40 0.06 0.57 174 TR_XM_Base64_M1 1968 0.63 0.81 0.54 175 HTML_TAG_BALANCE_BODY 1967 0.74 1.15 0.54 176 XMBody_95 1944 0.42 0.19 0.54 177 T_XMHurry_00 1869 1.02 2.03 0.52 178 XM_B_COPY_HTML 1868 0.61 0.79 0.52 179 XMHTML_After_End 1854 0.77 1.29 0.51 180 HTML_IMAGE_ONLY_28 1798 0.44 0.31 0.50 181 XMPhish30 1791 0.73 1.22 0.50 182 RELAYCOUNTRY_GB 1775 0.58 0.75 0.49 183 THIS_AD 1774 0.78 1.36 0.49 184 PLING_QUERY 1744 0.60 0.85 0.48 185 FORGED_GMAIL_RCVD 1742 0.56 0.73 0.48 186 HTML_FONT_FACE_BAD 1662 0.50 0.59 0.46 187 HTML_IMAGE_ONLY_24 1641 0.49 0.57 0.45 188 HTML_IMAGE_ONLY_20 1638 0.41 0.32 0.45 189 XMPhish14 1636 0.66 1.08 0.45 190 SUBJ_DOLLARS 1614 0.44 0.43 0.45 191 USER_IN_WELCOMELIST 1601 0.30 0.00 0.44 192 USER_IN_WHITELIST 1601 0.30 0.00 0.44 193 XM_B_FormFill 1580 0.31 0.04 0.44 194 XMLngstWrd_00 1567 0.40 0.33 0.43 195 TR_XM_SPAMCOP 1531 4.04 11.38 0.42 196 SpammyFromTLD_02 1527 0.81 1.59 0.42 197 HTML_IMAGE_ONLY_32 1510 0.34 0.18 0.42 198 FILL_THIS_FORM 1498 0.35 0.22 0.41 199 XMSolicitRefs_0 1497 0.45 0.51 0.41 200 XMDateMe_00 1483 0.36 0.25 0.41 ----------------------------------------------------------------------