Email: 534417 Autolearn: 0 AvgScore: 4.70 AvgScanTime: 1.15 sec Spam: 184832 Autolearn: 0 AvgScore: 13.62 AvgScanTime: 1.23 sec Ham: 349585 Autolearn: 0 AvgScore: -0.02 AvgScanTime: 1.10 sec Time Spent Running SA: 170.42 hours Time Spent Processing Spam: 63.15 hours Time Spent Processing Ham: 107.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 179678 91.17 97.21 87.98 2 DKIM_SIGNED 171349 82.68 92.71 77.38 3 XM_DK_Pass 164638 80.51 89.07 75.99 4 DKIM_VALID 161821 79.37 87.55 75.04 5 XM_B_Unicode 160953 76.86 87.08 71.45 6 RELAYCOUNTRY_US 146162 81.87 79.08 83.35 7 DCC_CHECK 141922 52.18 76.78 39.17 8 XMListUnsubscribeExists 141270 61.42 76.43 53.48 9 XM_B_SpammyWords 136605 55.06 73.91 45.09 10 DKIM_VALID_AU 119268 62.23 64.53 61.01 11 XM_DK_Undo_02 86788 20.03 46.96 5.80 12 XM_B_Unicode3 83133 42.13 44.98 40.63 13 XM_B_SpammyWords2 81769 27.97 44.24 19.36 14 LOC_TINY_FONT_1 75108 31.28 40.64 26.34 15 BAYES_50 70434 53.22 38.11 61.21 16 HTML_FONT_LOW_CONTRAST 69305 33.12 37.50 30.81 17 TR_XM_DKIM_Undo 66043 13.87 35.73 2.31 18 BAYES_99 65345 14.72 35.35 3.82 19 FVGT_m_MULTI_ODD 62748 29.22 33.95 26.73 20 RCVD_IN_MSPIKE_H2 60165 30.16 32.55 28.90 21 DKIM_VALID_EF 59587 29.87 32.24 28.62 22 T_KAM_HTML_FONT_INVALID 57997 25.36 31.38 22.18 23 MIME_HTML_ONLY 54812 23.08 29.66 19.60 24 BAYES_999 50495 11.32 27.32 2.86 25 TR_DCC_Bayes_99 49212 10.21 26.63 1.53 26 TR_XM_DK_Unsub 46811 17.92 25.33 14.01 27 DCC_CHECK_NEGATIVE 42895 47.79 23.21 60.78 28 RELAYCOUNTRY_META 40456 10.40 21.89 4.33 29 T_TM2_M_HEADER_IN_MSG 38951 26.42 21.07 29.24 30 XMSubLong 38393 22.08 20.77 22.77 31 XM_Multi_Part_URI 34014 14.79 18.40 12.88 32 LOTS_OF_MONEY 33483 10.98 18.12 7.21 33 TR_XM_SpammyRelay 33152 7.81 17.94 2.45 34 TR_XM_SpammyWords4 30952 9.10 16.75 5.06 35 RCVD_IN_BL_SPAMCOP_NET 29232 6.18 15.82 1.08 36 XM_B_SpammyWords3 28907 8.73 15.64 5.07 37 TR_MAX_INTL_RELAY 28338 9.71 15.33 6.73 38 UNPARSEABLE_RELAY 26140 12.22 14.14 11.21 39 TR_XM_SpammyWords2 26078 5.18 14.11 0.46 40 XM_B_Unsub 25866 10.01 13.99 7.90 41 BOTNET_IPINHOSTNAME 25424 7.79 13.76 4.64 42 TR_XM_SPAMCOP 25419 5.15 13.75 0.61 43 TR_XM_BayesUnsub 24913 8.80 13.48 6.32 44 RELAYCOUNTRY_CA 24138 5.40 13.06 1.36 45 RCVD_IN_MSPIKE_WL 19874 7.83 10.75 6.29 46 RCVD_IN_MSPIKE_H3 19874 7.83 10.75 6.29 47 BAYES_80 17207 5.91 9.31 4.11 48 BOTNET 15378 3.89 8.32 1.55 49 XM_Evil_Numbers_Gen 14940 7.94 8.08 7.87 50 BAYES_60 14418 8.85 7.80 9.41 51 TR_XM_UnparsRelay 13672 3.70 7.40 1.74 52 XMBody_17 13542 3.04 7.33 0.77 53 FSL_BULK_SIG 13450 6.29 7.28 5.77 54 TR_LOTS_OF_MONEY3 12430 3.17 6.73 1.29 55 XM_UncommonTLD01 12188 4.76 6.59 3.79 56 LotsOfNums_01 12104 7.73 6.55 8.36 57 HTML_IMAGE_RATIO_02 10941 5.40 5.92 5.13 58 XM_B_PhoneNumber 10607 8.89 5.74 10.55 59 XM_Body_Dirty_Words 10497 4.25 5.68 3.49 60 BAYES_95 10494 3.68 5.68 2.62 61 XMSubMetaSx_00 10140 4.58 5.49 4.10 62 UNTRUSTED_Relay 9616 2.72 5.20 1.40 63 DKIM_INVALID 9528 3.31 5.15 2.34 64 XM_B_SEO 8984 2.79 4.86 1.70 65 XM_OfRef6 8882 2.42 4.81 1.16 66 MPART_ALT_DIFF 8862 4.20 4.79 3.88 67 TooManyTo_001 8608 7.03 4.66 8.29 68 HTML_IMAGE_RATIO_06 8518 3.62 4.61 3.10 69 XM_H_Long_From01 8167 4.90 4.42 5.16 70 XM_SPF_SoftFail 8061 3.77 4.36 3.45 71 XM_B_Phish_Phrases 8021 4.16 4.34 4.06 72 TR_XM_SEO4 7864 1.95 4.25 0.73 73 HTML_IMAGE_RATIO_04 7831 3.76 4.24 3.50 74 XM_B_Investor 7820 2.81 4.23 2.07 75 XM_H_GMP 7774 5.36 4.21 5.96 76 TR_XM_SpammyWords5 7345 2.32 3.97 1.45 77 RCVD_IN_VALIDITY_RPBL 7043 1.42 3.81 0.16 78 XMNumbers 7043 3.36 3.81 3.13 79 TR_XM_PhishingBody 6925 2.45 3.75 1.77 80 XMStrtUSub 6872 4.08 3.72 4.27 81 T_XMDrugObfuBody_08 6672 2.41 3.61 1.77 82 T_XMDrugObfuBody_14 6558 2.36 3.55 1.72 83 TR_XM_BayesRelay 6246 1.17 3.38 0.00 84 XMSexyCombo_05 6228 2.58 3.37 2.16 85 HOSTED_IMG_MULTI_PUB_01 6032 1.15 3.26 0.03 86 T_FILL_THIS_FORM_SHORT 6005 1.75 3.25 0.95 87 FONT_INVIS_LONG_LINE 5863 1.22 3.17 0.20 88 SpammyFromTLD_01 5783 1.65 3.13 0.87 89 MIME_QP_LONG_LINE 5748 4.47 3.11 5.20 90 MIME_HTML_MOSTLY 5726 2.52 3.10 2.22 91 TM2_M_URI_OPT_OUT 5623 2.17 3.04 1.71 92 HTML_IMAGE_RATIO_08 5600 2.53 3.03 2.27 93 XMDiploma_00 5434 2.20 2.94 1.81 94 XM_B_SpammyTLD 5249 2.55 2.84 2.39 95 TM2_M_VERY_LONG_WORD 5217 1.91 2.82 1.43 96 MIME_HTML_ONLY_MULTI 5143 2.39 2.78 2.18 97 XM_B_SpammyWords4 5038 1.45 2.73 0.77 98 XM_CamelCaseFrm001 4965 2.34 2.69 2.16 99 T_XMHurry_00 4942 1.40 2.67 0.73 100 XM_UB50 4841 1.49 2.62 0.89 101 XMBrknScrpt_02 4655 1.61 2.52 1.13 102 TR_Mismatch_TLD_02 4490 0.90 2.43 0.09 103 XM_URI_RBL 4108 0.92 2.22 0.23 104 URI_TRY_3LD 4064 1.40 2.20 0.97 105 XM_B_Unsub2 3981 1.73 2.15 1.51 106 RELAYCOUNTRY_AU 3792 1.30 2.05 0.91 107 T_TooManySym_01 3791 4.16 2.05 5.27 108 SUBJ_ALL_CAPS 3684 1.62 1.99 1.43 109 TR_XM_FormFill 3674 0.69 1.99 0.01 110 HK_RANDOM_REPLYTO 3569 0.73 1.93 0.09 111 RCVD_IN_VALIDITY_SAFE 3408 4.28 1.84 5.57 112 USER_IN_DEF_DKIM_WL 3291 10.01 1.78 14.37 113 MAILING_LIST_MULTI 3242 2.39 1.75 2.72 114 TR_XM_INV_DKIM 3202 0.65 1.73 0.08 115 TR_XM_NoHeaderRelay 3093 0.65 1.67 0.11 116 XM_DK_Undo_01 3025 1.74 1.64 1.80 117 HTML_MIME_NO_HTML_TAG 2842 1.94 1.54 2.15 118 T_REMOTE_IMAGE 2812 2.81 1.52 3.49 119 RCVD_IN_IADB_LISTED 2771 3.01 1.50 3.82 120 BAYES_40 2758 3.56 1.49 4.65 121 TR_MetaPhish_Combo_01 2755 1.31 1.49 1.21 122 AC_BR_BONANZA 2692 0.59 1.46 0.13 123 ANY_BOUNCE_MESSAGE 2666 2.58 1.44 3.18 124 XM_H_Long_From02 2666 1.23 1.44 1.12 125 BOUNCE_MESSAGE 2666 2.58 1.44 3.18 126 XM_SendGrid 2647 1.42 1.43 1.41 127 XMStockSpam_06 2575 1.25 1.39 1.18 128 HTTPS_HTTP_MISMATCH 2522 1.01 1.36 0.82 129 XMGenDplmaNmb 2493 1.01 1.35 0.83 130 RCVD_IN_IADB_SPF 2472 2.64 1.34 3.34 131 RCVD_IN_VALIDITY_CERTIFIED 2453 3.70 1.33 4.95 132 RCVD_IN_PSBL 2439 0.80 1.32 0.53 133 XMPhish30 2419 0.83 1.31 0.58 134 URI_HEX 2412 1.24 1.30 1.21 135 T_XMDrugObfuBody_00 2409 0.88 1.30 0.66 136 DKIM_ADSP_CUSTOM_MED 2396 1.02 1.30 0.87 137 XMSlimDrugH 2351 0.69 1.27 0.38 138 FROM_EXCESS_BASE64 2333 1.62 1.26 1.80 139 SpammyFromTLD_02 2301 0.68 1.24 0.38 140 HTML_TAG_BALANCE_BODY 2297 0.87 1.24 0.67 141 ALL_TRUSTED 2269 9.19 1.23 13.41 142 RCVD_IN_IADB_SENDERID 2254 2.38 1.22 3.00 143 RCVD_IN_IADB_DK 2215 2.33 1.20 2.93 144 XM_HighProb1 2142 0.40 1.16 0.01 145 TR_XM_PHPForged 2053 0.60 1.11 0.33 146 NML_ADSP_CUSTOM_MED 2045 0.75 1.11 0.56 147 URI_NOVOWEL 2029 1.29 1.10 1.40 148 TR_XM_PHPDW 2028 0.60 1.10 0.33 149 TR_XM_FormFill2 1992 0.59 1.08 0.34 150 XM_H_PHPOS 1978 0.58 1.07 0.32 151 XMHTML_After_End 1972 0.60 1.07 0.36 152 XMMoneyMeta_00 1965 0.72 1.06 0.54 153 T_Symld_Words_02 1965 0.88 1.06 0.78 154 XMReplyNow 1937 0.52 1.05 0.25 155 TVD_RCVD_IP 1917 1.49 1.04 1.73 156 TR_Symld_Words 1901 1.35 1.03 1.52 157 BAYES_20 1867 2.53 1.01 3.34 158 T_XMDrugObfuBody_10 1808 0.36 0.98 0.03 159 DIET_1 1802 0.49 0.97 0.23 160 URIBL_DBL_SPAM 1795 0.34 0.97 0.01 161 KHOP_HELO_FCRDNS 1781 1.23 0.96 1.37 162 MPART_ALT_DIFF_COUNT 1776 0.75 0.96 0.64 163 XMPhish14 1746 0.62 0.94 0.45 164 TR_XM_InvalidRelay 1732 0.34 0.94 0.02 165 DKIM_ADSP_NXDOMAIN 1701 0.55 0.92 0.35 166 XM_H_Undi_Recip 1664 0.42 0.90 0.17 167 XM_B_COPY_HTML 1659 0.75 0.90 0.68 168 XMBdyGiftCard01 1658 0.77 0.90 0.71 169 XM_DIRTYINTL 1651 0.47 0.89 0.25 170 XMBody_78 1639 0.56 0.89 0.38 171 RELAYCOUNTRY_FR 1623 0.44 0.88 0.21 172 TR_XM_DK_SendGrid 1605 0.92 0.87 0.95 173 XM_UB99 1593 0.30 0.86 0.00 174 RELAYCOUNTRY_GB 1576 0.60 0.85 0.46 175 RCVD_IN_IADB_VOUCHED 1576 1.99 0.85 2.59 176 T_STY_INVIS_DIRECT 1575 0.52 0.85 0.35 177 LongTLD 1539 0.52 0.83 0.35 178 XM_B_Phish66 1537 0.49 0.83 0.31 179 XM_Combo_Sbj 1528 0.43 0.83 0.22 180 FORGED_GMAIL_RCVD 1527 0.63 0.83 0.53 181 XMSexyCombo_01 1484 0.41 0.80 0.21 182 BOTNET_NORDNS 1450 0.28 0.78 0.01 183 T_MONEY_PERCENT 1435 0.75 0.78 0.74 184 TR_LOTS_OF_MONEY2 1435 0.75 0.78 0.74 185 TooManyTo_002 1409 1.96 0.76 2.59 186 THIS_AD 1405 0.48 0.76 0.33 187 RDNS_DYNAMIC 1369 0.46 0.74 0.31 188 HTML_FONT_FACE_BAD 1367 0.54 0.74 0.43 189 BAYES_00 1363 6.05 0.74 8.86 190 TR_Caps_n_Bayes_99 1357 0.26 0.73 0.02 191 XM_B_DNDMA 1337 0.65 0.72 0.62 192 MIME_CHARSET_FARAWAY 1333 0.43 0.72 0.28 193 AC_HTML_NONSENSE_TAGS 1295 0.26 0.70 0.03 194 XMHTMLBadTable_001 1279 0.43 0.69 0.29 195 XM_ProductURIs 1252 0.63 0.68 0.60 196 XM_PDF 1237 3.20 0.67 4.54 197 DATE_IN_PAST_03_06 1218 0.29 0.66 0.10 198 XMSubMetaI_00 1191 0.56 0.64 0.51 199 TooManyTo_003 1190 1.17 0.64 1.45 200 XM_H_PHPMailer 1185 0.61 0.64 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 307571 91.17 97.21 87.98 2 RELAYCOUNTRY_US 291377 81.87 79.08 83.35 3 DKIM_SIGNED 270511 82.68 92.71 77.38 4 XM_DK_Pass 265647 80.51 89.07 75.99 5 DKIM_VALID 262324 79.37 87.55 75.04 6 XM_B_Unicode 249780 76.86 87.08 71.45 7 BAYES_50 213985 53.22 38.11 61.21 8 DKIM_VALID_AU 213295 62.23 64.53 61.01 9 DCC_CHECK_NEGATIVE 212482 47.79 23.21 60.78 10 XMListUnsubscribeExists 186952 61.42 76.43 53.48 11 XM_B_SpammyWords 157640 55.06 73.91 45.09 12 XM_B_Unicode3 142030 42.13 44.98 40.63 13 DCC_CHECK 136939 52.18 76.78 39.17 14 HTML_FONT_LOW_CONTRAST 107713 33.12 37.50 30.81 15 T_TM2_M_HEADER_IN_MSG 102223 26.42 21.07 29.24 16 RCVD_IN_MSPIKE_H2 101021 30.16 32.55 28.90 17 DKIM_VALID_EF 100049 29.87 32.24 28.62 18 FVGT_m_MULTI_ODD 93428 29.22 33.95 26.73 19 LOC_TINY_FONT_1 92064 31.28 40.64 26.34 20 XMSubLong 79598 22.08 20.77 22.77 21 T_KAM_HTML_FONT_INVALID 77553 25.36 31.38 22.18 22 MIME_HTML_ONLY 68520 23.08 29.66 19.60 23 XM_B_SpammyWords2 67686 27.97 44.24 19.36 24 USER_IN_DEF_DKIM_WL 50225 10.01 1.78 14.37 25 TR_XM_DK_Unsub 48980 17.92 25.33 14.01 26 ALL_TRUSTED 46868 9.19 1.23 13.41 27 XM_Multi_Part_URI 45036 14.79 18.40 12.88 28 UNPARSEABLE_RELAY 39176 12.22 14.14 11.21 29 XM_B_PhoneNumber 36895 8.89 5.74 10.55 30 BAYES_60 32893 8.85 7.80 9.41 31 BAYES_00 30979 6.05 0.74 8.86 32 LotsOfNums_01 29217 7.73 6.55 8.36 33 TooManyTo_001 28980 7.03 4.66 8.29 34 XM_B_Unsub 27603 10.01 13.99 7.90 35 XM_Evil_Numbers_Gen 27518 7.94 8.08 7.87 36 XM_DKIMWhitelistDomains 25224 4.73 0.02 7.22 37 LOTS_OF_MONEY 25202 10.98 18.12 7.21 38 IN_ZIMBRA_NJ_WHITELIST 25044 4.72 0.08 7.16 39 TR_MAX_INTL_RELAY 23536 9.71 15.33 6.73 40 TR_XM_BayesUnsub 22101 8.80 13.48 6.32 41 RCVD_IN_MSPIKE_WL 21972 7.83 10.75 6.29 42 RCVD_IN_MSPIKE_H3 21972 7.83 10.75 6.29 43 TR_XM_DK_Bayes 21208 4.17 0.60 6.07 44 TR_XM_DK_Bayes1 20947 4.12 0.59 5.99 45 XM_H_GMP 20850 5.36 4.21 5.96 46 XM_DK_Undo_02 20279 20.03 46.96 5.80 47 FSL_BULK_SIG 20159 6.29 7.28 5.77 48 RCVD_IN_VALIDITY_SAFE 19475 4.28 1.84 5.57 49 T_TooManySym_01 18426 4.16 2.05 5.27 50 MIME_QP_LONG_LINE 18165 4.47 3.11 5.20 51 TR_XM_DK_Bayes2 18105 3.54 0.45 5.18 52 XM_H_Long_From01 18029 4.90 4.42 5.16 53 HTML_IMAGE_RATIO_02 17932 5.40 5.92 5.13 54 XM_B_SpammyWords3 17736 8.73 15.64 5.07 55 TR_XM_SpammyWords4 17700 9.10 16.75 5.06 56 RCVD_IN_VALIDITY_CERTIFIED 17318 3.70 1.33 4.95 57 BAYES_40 16249 3.56 1.49 4.65 58 BOTNET_IPINHOSTNAME 16226 7.79 13.76 4.64 59 XM_PDF 15856 3.20 0.67 4.54 60 RELAYCOUNTRY_META 15146 10.40 21.89 4.33 61 XMStrtUSub 14917 4.08 3.72 4.27 62 BAYES_80 14367 5.91 9.31 4.11 63 XMSubMetaSx_00 14338 4.58 5.49 4.10 64 XM_B_Phish_Phrases 14205 4.16 4.34 4.06 65 MPART_ALT_DIFF 13581 4.20 4.79 3.88 66 RCVD_IN_IADB_LISTED 13340 3.01 1.50 3.82 67 BAYES_99 13337 14.72 35.35 3.82 68 XM_UncommonTLD01 13245 4.76 6.59 3.79 69 HTML_IMAGE_RATIO_04 12242 3.76 4.24 3.50 70 XM_Body_Dirty_Words 12209 4.25 5.68 3.49 71 T_REMOTE_IMAGE 12190 2.81 1.52 3.49 72 XM_SPF_SoftFail 12068 3.77 4.36 3.45 73 BAYES_20 11675 2.53 1.01 3.34 74 RCVD_IN_IADB_SPF 11660 2.64 1.34 3.34 75 ANY_BOUNCE_MESSAGE 11117 2.58 1.44 3.18 76 BOUNCE_MESSAGE 11114 2.58 1.44 3.18 77 XMNumbers 10930 3.36 3.81 3.13 78 HTML_IMAGE_RATIO_06 10832 3.62 4.61 3.10 79 RCVD_IN_IADB_SENDERID 10482 2.38 1.22 3.00 80 RCVD_IN_IADB_DK 10238 2.33 1.20 2.93 81 BAYES_999 9988 11.32 27.32 2.86 82 MAILING_LIST_MULTI 9510 2.39 1.75 2.72 83 BAYES_95 9158 3.68 5.68 2.62 84 TooManyTo_002 9062 1.96 0.76 2.59 85 RCVD_IN_IADB_VOUCHED 9044 1.99 0.85 2.59 86 T_TooManySym_02 8977 1.87 0.54 2.57 87 TR_XM_SpammyRelay 8580 7.81 17.94 2.45 88 XM_B_SpammyTLD 8356 2.55 2.84 2.39 89 DKIM_INVALID 8187 3.31 5.15 2.34 90 TR_XM_DKIM_Undo 8076 13.87 35.73 2.31 91 HTML_IMAGE_RATIO_08 7925 2.53 3.03 2.27 92 MIME_HTML_MOSTLY 7750 2.52 3.10 2.22 93 MIME_HTML_ONLY_MULTI 7607 2.39 2.78 2.18 94 XMSexyCombo_05 7565 2.58 3.37 2.16 95 XM_CamelCaseFrm001 7561 2.34 2.69 2.16 96 HTML_MIME_NO_HTML_TAG 7533 1.94 1.54 2.15 97 XM_B_Investor 7222 2.81 4.23 2.07 98 INVALID_MSGID 7208 1.38 0.10 2.06 99 BAYES_05 6935 1.47 0.51 1.98 100 HELO_NODOT 6690 1.34 0.26 1.91 101 HELO_NO_DOMAIN 6687 1.34 0.26 1.91 102 TO_MALFORMED 6670 1.43 0.53 1.91 103 XMDiploma_00 6311 2.20 2.94 1.81 104 FROM_EXCESS_BASE64 6303 1.62 1.26 1.80 105 XM_DK_Undo_01 6279 1.74 1.64 1.80 106 RCVD_IN_IADB_OPTIN 6220 1.34 0.51 1.78 107 T_XMDrugObfuBody_08 6198 2.41 3.61 1.77 108 TR_XM_PhishingBody 6178 2.45 3.75 1.77 109 TR_XM_UnparsRelay 6076 3.70 7.40 1.74 110 TVD_RCVD_IP 6045 1.49 1.04 1.73 111 T_XMDrugObfuBody_14 6029 2.36 3.55 1.72 112 TM2_M_URI_OPT_OUT 5974 2.17 3.04 1.71 113 XM_B_SEO 5944 2.79 4.86 1.70 114 BOTNET 5421 3.89 8.32 1.55 115 TR_DCC_Bayes_99 5354 10.21 26.63 1.53 116 TR_Symld_Words 5315 1.35 1.03 1.52 117 XM_B_Unsub2 5266 1.73 2.15 1.51 118 TooManyTo_003 5058 1.17 0.64 1.45 119 TR_XM_SpammyWords5 5057 2.32 3.97 1.45 120 TM2_M_VERY_LONG_WORD 5013 1.91 2.82 1.43 121 IN_HORDE_ADDRESS_BOOK 4986 0.95 0.06 1.43 122 SUBJ_ALL_CAPS 4985 1.62 1.99 1.43 123 XM_SendGrid 4941 1.42 1.43 1.41 124 UNTRUSTED_Relay 4904 2.72 5.20 1.40 125 URI_NOVOWEL 4883 1.29 1.10 1.40 126 KHOP_HELO_FCRDNS 4804 1.23 0.96 1.37 127 RELAYCOUNTRY_CA 4737 5.40 13.06 1.36 128 TR_LOTS_OF_MONEY3 4512 3.17 6.73 1.29 129 XMGappySubj_01 4449 0.89 0.16 1.27 130 TR_MetaPhish_Combo_01 4241 1.31 1.49 1.21 131 URI_HEX 4238 1.24 1.30 1.21 132 XMStockSpam_06 4120 1.25 1.39 1.18 133 XM_OfRef6 4061 2.42 4.81 1.16 134 XMBrknScrpt_02 3950 1.61 2.52 1.13 135 TVD_SPACE_RATIO 3929 0.79 0.15 1.12 136 XM_H_Long_From02 3927 1.23 1.44 1.12 137 XMBSHREFv2 3913 0.83 0.28 1.12 138 XM_GoogleGroups 3847 0.94 0.64 1.10 139 RCVD_IN_BL_SPAMCOP_NET 3785 6.18 15.82 1.08 140 TooManyTo_004 3751 0.91 0.60 1.07 141 XMCapTrack 3470 0.79 0.40 0.99 142 URI_TRY_3LD 3394 1.40 2.20 0.97 143 T_FILL_THIS_FORM_SHORT 3325 1.75 3.25 0.95 144 TR_XM_DK_SendGrid 3316 0.92 0.87 0.95 145 T_TooManySym_03 3224 0.68 0.22 0.92 146 RELAYCOUNTRY_AU 3176 1.30 2.05 0.91 147 XM_UB50 3107 1.49 2.62 0.89 148 TooManyTo_005 3105 0.77 0.56 0.89 149 SpammyFromTLD_01 3056 1.65 3.13 0.87 150 DKIM_ADSP_CUSTOM_MED 3033 1.02 1.30 0.87 151 FROM_GOV_DKIM_AU 3001 0.61 0.14 0.86 152 XMGenDplmaNmb 2890 1.01 1.35 0.83 153 HTTPS_HTTP_MISMATCH 2866 1.01 1.36 0.82 154 XMBody_95 2866 0.60 0.19 0.82 155 XMGappySubj_02 2751 0.54 0.08 0.79 156 T_Symld_Words_02 2728 0.88 1.06 0.78 157 XMBody_17 2703 3.04 7.33 0.77 158 XM_B_SpammyWords4 2687 1.45 2.73 0.77 159 T_MONEY_PERCENT 2597 0.75 0.78 0.74 160 TR_LOTS_OF_MONEY2 2597 0.75 0.78 0.74 161 T_XMHurry_00 2545 1.40 2.67 0.73 162 TR_XM_SEO4 2538 1.95 4.25 0.73 163 XMBdyGiftCard01 2481 0.77 0.90 0.71 164 XM_B_FormFill 2468 0.50 0.10 0.71 165 XM_ShortIntro_01 2403 0.60 0.45 0.69 166 TR_XM_Base64_M1 2390 0.63 0.54 0.68 167 XM_B_COPY_HTML 2363 0.75 0.90 0.68 168 HTML_TAG_BALANCE_BODY 2349 0.87 1.24 0.67 169 SHORT_HELO_AND_INLINE_IMAGE 2325 0.45 0.05 0.67 170 T_XMDrugObfuBody_00 2320 0.88 1.30 0.66 171 MPART_ALT_DIFF_COUNT 2250 0.75 0.96 0.64 172 T_OBFU_PDF_ATTACH 2236 0.45 0.10 0.64 173 XMNoVowels 2222 0.60 0.52 0.64 174 XM_B_DNDMA 2153 0.65 0.72 0.62 175 XMSubMetaSxObfu_02 2126 0.49 0.27 0.61 176 TR_XM_SPAMCOP 2123 5.15 13.75 0.61 177 XM_ProductURIs 2114 0.63 0.68 0.60 178 XM_H_PHPMailer 2090 0.61 0.64 0.60 179 XM_B_COVIDMETA 2051 0.59 0.58 0.59 180 USER_IN_WHITELIST 2042 0.38 0.00 0.58 181 USER_IN_WELCOMELIST 2042 0.38 0.00 0.58 182 XMPhish30 2021 0.83 1.31 0.58 183 NML_ADSP_CUSTOM_MED 1956 0.75 1.11 0.56 184 XMMoneyMeta_00 1895 0.72 1.06 0.54 185 RCVD_IN_PSBL 1861 0.80 1.32 0.53 186 FORGED_GMAIL_RCVD 1857 0.63 0.83 0.53 187 XMSubMetaI_00 1791 0.56 0.64 0.51 188 TO_NO_BRKTS_HTML_ONLY 1748 0.39 0.19 0.50 189 HTML_IMAGE_ONLY_24 1711 0.39 0.19 0.49 190 HTML_IMAGE_ONLY_28 1673 0.43 0.35 0.48 191 TR_XM_SpammyWords2 1615 5.18 14.11 0.46 192 FILL_THIS_FORM 1609 0.36 0.17 0.46 193 RELAYCOUNTRY_GB 1608 0.60 0.85 0.46 194 XMPhish14 1574 0.62 0.94 0.45 195 HTML_IMAGE_ONLY_32 1562 0.37 0.21 0.45 196 HTML_FONT_FACE_BAD 1506 0.54 0.74 0.43 197 PLING_QUERY 1425 0.46 0.57 0.41 198 TM2_M_BODY_EMPTY 1401 0.28 0.06 0.40 199 XM_Walgreens_Forge 1333 0.26 0.02 0.38 200 XMBody_78 1330 0.56 0.89 0.38 ----------------------------------------------------------------------