Email: 533492 Autolearn: 0 AvgScore: 3.60 AvgScanTime: 1.19 sec Spam: 161525 Autolearn: 0 AvgScore: 12.71 AvgScanTime: 1.34 sec Ham: 371967 Autolearn: 0 AvgScore: -0.35 AvgScanTime: 1.13 sec Time Spent Running SA: 176.95 hours Time Spent Processing Spam: 60.02 hours Time Spent Processing Ham: 116.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155940 90.98 96.54 88.56 2 DKIM_SIGNED 146163 81.05 90.49 76.95 3 XM_DK_Pass 140396 79.04 86.92 75.62 4 DKIM_VALID 138782 78.01 85.92 74.57 5 RELAYCOUNTRY_US 137890 83.17 85.37 82.22 6 XM_B_Unicode 136791 74.34 84.69 69.85 7 DCC_CHECK 120143 50.28 74.38 39.82 8 XMListUnsubscribeExists 116131 57.52 71.90 51.28 9 XM_B_SpammyWords 115760 53.28 71.67 45.30 10 DKIM_VALID_AU 111788 63.23 69.21 60.63 11 XM_B_Unicode3 75038 42.03 46.46 40.11 12 LOC_TINY_FONT_1 69897 30.94 43.27 25.58 13 XM_B_SpammyWords2 67935 26.29 42.06 19.44 14 BAYES_50 66892 54.94 41.41 60.81 15 XM_DK_Undo_02 63970 15.85 39.60 5.54 16 HTML_FONT_LOW_CONTRAST 63214 31.87 39.14 28.71 17 FVGT_m_MULTI_ODD 57461 28.87 35.57 25.96 18 RCVD_IN_MSPIKE_H2 56180 31.24 34.78 29.70 19 BAYES_99 52695 12.72 32.62 4.08 20 T_KAM_HTML_FONT_INVALID 47748 23.83 29.56 21.35 21 TR_XM_DKIM_Undo 45410 10.19 28.11 2.41 22 DKIM_VALID_EF 42928 28.78 26.58 29.74 23 DCC_CHECK_NEGATIVE 41356 49.67 25.60 60.13 24 BAYES_999 40971 9.80 25.37 3.05 25 MIME_HTML_ONLY 40793 21.15 25.25 19.36 26 T_TM2_M_HEADER_IN_MSG 40131 28.03 24.85 29.41 27 TR_DCC_Bayes_99 37760 8.35 23.38 1.83 28 XMSubLong 35215 21.80 21.80 21.79 29 XM_Multi_Part_URI 34194 15.82 21.17 13.50 30 TR_XM_DK_Unsub 29437 15.26 18.22 13.97 31 LOTS_OF_MONEY 26451 9.43 16.38 6.42 32 XM_B_Unsub 25600 9.93 15.85 7.36 33 XM_B_SpammyWords3 25543 7.96 15.81 4.55 34 TR_XM_BayesUnsub 24634 8.75 15.25 5.93 35 TR_XM_SpammyWords4 24181 7.70 14.97 4.54 36 UNPARSEABLE_RELAY 24004 12.03 14.86 10.80 37 TR_MAX_INTL_RELAY 23265 9.10 14.40 6.79 38 BOTNET_IPINHOSTNAME 22893 7.11 14.17 4.04 39 RELAYCOUNTRY_META 22820 7.82 14.13 5.08 40 TR_XM_SpammyWords2 19032 4.06 11.78 0.70 41 XM_Evil_Numbers_Gen 17468 9.07 10.81 8.31 42 TR_XM_SpammyRelay 16363 4.66 10.13 2.28 43 BOTNET 15029 3.71 9.30 1.27 44 BAYES_80 14401 5.57 8.92 4.12 45 LotsOfNums_01 12758 8.68 7.90 9.02 46 BAYES_60 12547 8.74 7.77 9.16 47 FSL_BULK_SIG 12540 6.16 7.76 5.46 48 TR_XM_UnparsRelay 11997 3.25 7.43 1.43 49 HTML_IMAGE_RATIO_02 11300 5.36 7.00 4.65 50 XM_B_PhoneNumber 11150 9.24 6.90 10.26 51 XM_Body_Dirty_Words 10402 4.21 6.44 3.24 52 RCVD_IN_BL_SPAMCOP_NET 10397 2.47 6.44 0.75 53 XMSubMetaSx_00 9327 4.30 5.77 3.66 54 MPART_ALT_DIFF 9072 5.27 5.62 5.12 55 HTML_IMAGE_RATIO_04 9000 4.13 5.57 3.51 56 XM_UncommonTLD01 8871 4.15 5.49 3.57 57 XM_B_Phish_Phrases 8782 4.02 5.44 3.41 58 UNTRUSTED_Relay 8623 2.62 5.34 1.43 59 TooManyTo_001 8334 7.46 5.16 8.46 60 BAYES_95 8191 3.40 5.07 2.67 61 XM_B_SEO 8177 2.37 5.06 1.20 62 XM_H_Long_From01 8170 5.28 5.06 5.38 63 TR_XM_SPAMCOP 8128 1.85 5.03 0.46 64 XM_SPF_SoftFail 8032 3.95 4.97 3.50 65 RELAYCOUNTRY_CA 7984 2.33 4.94 1.20 66 TR_XM_SpammyWords5 7815 2.49 4.84 1.47 67 HTML_IMAGE_RATIO_06 7754 3.82 4.80 3.40 68 XMBody_17 7715 1.90 4.78 0.65 69 TR_XM_PhishingBody 7512 2.58 4.65 1.68 70 DKIM_INVALID 7381 3.04 4.57 2.38 71 TR_XM_SEO4 7340 1.90 4.54 0.75 72 XM_B_Investor 7260 2.55 4.49 1.71 73 XM_H_GMP 7202 5.68 4.46 6.21 74 TR_LOTS_OF_MONEY3 6403 1.60 3.96 0.57 75 MIME_HTML_MOSTLY 6306 3.65 3.90 3.54 76 T_XMDrugObfuBody_14 6215 2.35 3.85 1.70 77 XMNumbers 6093 3.05 3.77 2.74 78 XM_OfRef6 6045 1.78 3.74 0.93 79 TM2_M_URI_OPT_OUT 5980 2.34 3.70 1.75 80 HTML_IMAGE_RATIO_08 5978 2.99 3.70 2.68 81 XMSexyCombo_05 5944 2.23 3.68 1.61 82 MIME_QP_LONG_LINE 5909 4.76 3.66 5.23 83 XMStrtUSub 5672 4.50 3.51 4.93 84 XM_B_SpammyTLD 5577 2.67 3.45 2.33 85 T_XMDrugObfuBody_08 5520 2.19 3.42 1.65 86 MIME_HTML_ONLY_MULTI 5512 2.61 3.41 2.26 87 TM2_M_VERY_LONG_WORD 5110 1.95 3.16 1.42 88 XM_CamelCaseFrm001 4695 2.51 2.91 2.34 89 RCVD_IN_VALIDITY_RPBL 4654 0.95 2.88 0.11 90 XM_B_SpammyWords4 4590 1.33 2.84 0.67 91 XM_B_Unsub2 4456 1.87 2.76 1.48 92 XM_UB50 4223 1.38 2.61 0.84 93 ALL_TRUSTED 4128 10.18 2.56 13.49 94 RCVD_IN_VALIDITY_SAFE 4076 4.62 2.52 5.52 95 T_TooManySym_01 4054 4.21 2.51 4.95 96 SUBJ_ALL_CAPS 3980 1.74 2.46 1.42 97 USER_IN_DEF_DKIM_WL 3942 10.70 2.44 14.28 98 T_XMHurry_00 3922 1.08 2.43 0.49 99 XM_URI_RBL 3904 0.83 2.42 0.14 100 RELAYCOUNTRY_AU 3792 1.22 2.35 0.72 101 XMDiploma_00 3779 1.77 2.34 1.52 102 RCVD_IN_MSPIKE_WL 3714 5.12 2.30 6.34 103 RCVD_IN_MSPIKE_H3 3714 5.12 2.30 6.34 104 URI_TRY_3LD 3681 1.25 2.28 0.80 105 RCVD_IN_VALIDITY_CERTIFIED 3277 3.96 2.03 4.79 106 XMBrknScrpt_02 3198 1.24 1.98 0.92 107 XM_DK_Undo_01 3139 2.04 1.94 2.08 108 T_REMOTE_IMAGE 3083 3.12 1.91 3.65 109 SpammyFromTLD_01 3034 1.12 1.88 0.79 110 HTML_MIME_NO_HTML_TAG 2958 2.08 1.83 2.18 111 XMStockSpam_06 2936 1.00 1.82 0.64 112 TR_XM_NoHeaderRelay 2882 0.62 1.78 0.12 113 FROM_EXCESS_BASE64 2865 1.86 1.77 1.90 114 MAILING_LIST_MULTI 2763 2.40 1.71 2.69 115 TR_XM_PHPForged 2730 0.75 1.69 0.35 116 TR_XM_PHPDW 2702 0.75 1.67 0.35 117 TR_XM_FormFill2 2664 0.74 1.65 0.35 118 XM_H_PHPOS 2652 0.73 1.64 0.34 119 URI_HEX 2637 1.32 1.63 1.18 120 BOUNCE_MESSAGE 2635 2.88 1.63 3.43 121 ANY_BOUNCE_MESSAGE 2635 2.88 1.63 3.43 122 RCVD_IN_IADB_LISTED 2543 3.34 1.57 4.10 123 XMReplyNow 2521 0.65 1.56 0.25 124 HTML_TAG_BALANCE_BODY 2487 0.89 1.54 0.61 125 BAYES_40 2450 3.70 1.52 4.65 126 TR_XM_INV_DKIM 2435 0.52 1.51 0.10 127 XM_H_Long_From02 2435 1.21 1.51 1.09 128 SpammyFromTLD_02 2413 0.74 1.49 0.41 129 HTTPS_HTTP_MISMATCH 2363 1.10 1.46 0.95 130 KHOP_HELO_FCRDNS 2360 1.60 1.46 1.65 131 T_XMDrugObfuBody_00 2341 0.81 1.45 0.53 132 XMPhish30 2294 0.78 1.42 0.50 133 DIET_1 2268 0.57 1.40 0.20 134 XM_SendGrid 2267 1.38 1.40 1.38 135 RCVD_IN_IADB_SPF 2228 2.91 1.38 3.57 136 XMBdyGiftCard01 2120 0.94 1.31 0.78 137 AC_BR_BONANZA 2084 0.46 1.29 0.10 138 RCVD_IN_IADB_SENDERID 2083 2.61 1.29 3.18 139 RCVD_IN_IADB_DK 2072 2.54 1.28 3.08 140 XMGenDplmaNmb 2042 0.96 1.26 0.83 141 HOSTED_IMG_MULTI_PUB_01 2005 0.39 1.24 0.02 142 TooManyTo_002 1994 2.33 1.23 2.80 143 XM_HighProb1 1992 0.38 1.23 0.00 144 XMHTML_After_End 1985 0.61 1.23 0.34 145 TR_Symld_Words 1962 1.54 1.21 1.69 146 T_FILL_THIS_FORM_SHORT 1910 0.95 1.18 0.84 147 XM_B_Phish66 1875 0.60 1.16 0.35 148 XMPhish14 1874 0.69 1.16 0.48 149 TR_LOTS_OF_MONEY2 1874 0.50 1.16 0.21 150 T_MONEY_PERCENT 1874 0.50 1.16 0.21 151 TooManyTo_003 1859 1.40 1.15 1.50 152 XM_DIRTYINTL 1835 0.51 1.14 0.24 153 BAYES_20 1831 2.61 1.13 3.25 154 URI_NOVOWEL 1801 1.22 1.11 1.27 155 TooManyTo_004 1765 1.11 1.09 1.12 156 DKIM_ADSP_NXDOMAIN 1761 0.54 1.09 0.30 157 T_STY_INVIS_DIRECT 1738 0.55 1.08 0.32 158 TooManyTo_005 1701 0.97 1.05 0.93 159 XMSexyCombo_01 1697 0.49 1.05 0.24 160 MPART_ALT_DIFF_COUNT 1682 0.74 1.04 0.62 161 RELAYCOUNTRY_GB 1662 1.45 1.03 1.64 162 XM_B_COVIDMETA 1616 0.43 1.00 0.18 163 TR_Caps_n_Bayes_99 1592 0.31 0.99 0.01 164 XMMoneyMeta_00 1591 0.71 0.98 0.60 165 DKIM_ADSP_CUSTOM_MED 1586 0.84 0.98 0.77 166 RDNS_DYNAMIC 1553 0.55 0.96 0.37 167 BOTNET_NORDNS 1551 0.29 0.96 0.01 168 XMLngstWrd_00 1546 0.74 0.96 0.64 169 THIS_AD 1539 0.50 0.95 0.31 170 XM_B_DNDMA 1521 0.63 0.94 0.49 171 XMSlimDrugH 1489 0.60 0.92 0.47 172 TR_MetaPhish_Combo_01 1485 0.79 0.92 0.74 173 XM_B_COPY_HTML 1483 0.90 0.92 0.89 174 PLING_QUERY 1467 0.75 0.91 0.69 175 TR_XM_Base64_M1 1452 0.66 0.90 0.55 176 RELAYCOUNTRY_FR 1442 0.43 0.89 0.22 177 TR_XM_InvalidRelay 1384 0.27 0.86 0.01 178 BAYES_00 1377 6.77 0.85 9.34 179 LONGLN_LOW_CONTRAST 1358 0.40 0.84 0.21 180 NML_ADSP_CUSTOM_MED 1350 0.59 0.84 0.48 181 XM_PDF 1350 3.64 0.84 4.86 182 TR_XM_DK_SendGrid 1329 0.86 0.82 0.88 183 T_Symld_Words_02 1308 0.70 0.81 0.65 184 HTML_FONT_FACE_BAD 1298 0.56 0.80 0.46 185 XM_UB99 1295 0.24 0.80 0.00 186 XM_ProductURIs 1279 0.58 0.79 0.49 187 TM2_M_A_HREF_HREF 1271 0.40 0.79 0.23 188 XMHTMLBadTable_001 1257 0.41 0.78 0.25 189 RCVD_IN_IADB_VOUCHED 1223 2.22 0.76 2.85 190 FORGED_GMAIL_RCVD 1204 0.53 0.75 0.44 191 URIBL_DBL_SPAM 1189 0.23 0.74 0.00 192 T_TooManySym_02 1184 1.87 0.73 2.36 193 LongTLD 1172 0.47 0.73 0.37 194 NO_DNS_FOR_FROM 1171 0.39 0.72 0.24 195 TR_Mismatch_TLD_02 1170 0.27 0.72 0.07 196 TR_XM_MaxWHORU 1149 0.35 0.71 0.20 197 XM_S_SpammyWords 1142 0.37 0.71 0.22 198 XM_H_PHPMailer 1139 0.70 0.71 0.70 199 BAYES_05 1138 1.56 0.70 1.92 200 TR_XM_Spammywords 1137 0.37 0.70 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 329407 90.98 96.54 88.56 2 RELAYCOUNTRY_US 305820 83.17 85.37 82.22 3 DKIM_SIGNED 286221 81.05 90.49 76.95 4 XM_DK_Pass 281287 79.04 86.92 75.62 5 DKIM_VALID 277382 78.01 85.92 74.57 6 XM_B_Unicode 259827 74.34 84.69 69.85 7 BAYES_50 226192 54.94 41.41 60.81 8 DKIM_VALID_AU 225538 63.23 69.21 60.63 9 DCC_CHECK_NEGATIVE 223647 49.67 25.60 60.13 10 XMListUnsubscribeExists 190733 57.52 71.90 51.28 11 XM_B_SpammyWords 168506 53.28 71.67 45.30 12 XM_B_Unicode3 149198 42.03 46.46 40.11 13 DCC_CHECK 148117 50.28 74.38 39.82 14 DKIM_VALID_EF 110637 28.78 26.58 29.74 15 RCVD_IN_MSPIKE_H2 110474 31.24 34.78 29.70 16 T_TM2_M_HEADER_IN_MSG 109407 28.03 24.85 29.41 17 HTML_FONT_LOW_CONTRAST 106808 31.87 39.14 28.71 18 FVGT_m_MULTI_ODD 96581 28.87 35.57 25.96 19 LOC_TINY_FONT_1 95147 30.94 43.27 25.58 20 XMSubLong 81061 21.80 21.80 21.79 21 T_KAM_HTML_FONT_INVALID 79403 23.83 29.56 21.35 22 XM_B_SpammyWords2 72313 26.29 42.06 19.44 23 MIME_HTML_ONLY 72021 21.15 25.25 19.36 24 USER_IN_DEF_DKIM_WL 53122 10.70 2.44 14.28 25 TR_XM_DK_Unsub 51959 15.26 18.22 13.97 26 XM_Multi_Part_URI 50210 15.82 21.17 13.50 27 ALL_TRUSTED 50182 10.18 2.56 13.49 28 UNPARSEABLE_RELAY 40184 12.03 14.86 10.80 29 XM_B_PhoneNumber 38169 9.24 6.90 10.26 30 BAYES_00 34743 6.77 0.85 9.34 31 BAYES_60 34064 8.74 7.77 9.16 32 LotsOfNums_01 33533 8.68 7.90 9.02 33 TooManyTo_001 31472 7.46 5.16 8.46 34 XM_Evil_Numbers_Gen 30902 9.07 10.81 8.31 35 XM_B_Unsub 27373 9.93 15.85 7.36 36 XM_DKIMWhitelistDomains 26509 4.97 0.02 7.13 37 IN_ZIMBRA_NJ_WHITELIST 25869 4.88 0.09 6.95 38 TR_MAX_INTL_RELAY 25266 9.10 14.40 6.79 39 LOTS_OF_MONEY 23866 9.43 16.38 6.42 40 RCVD_IN_MSPIKE_WL 23580 5.12 2.30 6.34 41 RCVD_IN_MSPIKE_H3 23580 5.12 2.30 6.34 42 TR_XM_DK_Bayes 23329 4.58 0.68 6.27 43 XM_H_GMP 23083 5.68 4.46 6.21 44 TR_XM_DK_Bayes1 22995 4.51 0.67 6.18 45 TR_XM_BayesUnsub 22048 8.75 15.25 5.93 46 XM_DK_Undo_02 20607 15.85 39.60 5.54 47 RCVD_IN_VALIDITY_SAFE 20547 4.62 2.52 5.52 48 FSL_BULK_SIG 20321 6.16 7.76 5.46 49 XM_H_Long_From01 20016 5.28 5.06 5.38 50 TR_XM_DK_Bayes2 19796 3.88 0.55 5.32 51 MIME_QP_LONG_LINE 19459 4.76 3.66 5.23 52 MPART_ALT_DIFF 19040 5.27 5.62 5.12 53 RELAYCOUNTRY_META 18912 7.82 14.13 5.08 54 T_TooManySym_01 18405 4.21 2.51 4.95 55 XMStrtUSub 18339 4.50 3.51 4.93 56 XM_PDF 18063 3.64 0.84 4.86 57 RCVD_IN_VALIDITY_CERTIFIED 17826 3.96 2.03 4.79 58 HTML_IMAGE_RATIO_02 17295 5.36 7.00 4.65 59 BAYES_40 17282 3.70 1.52 4.65 60 XM_B_SpammyWords3 16921 7.96 15.81 4.55 61 TR_XM_SpammyWords4 16878 7.70 14.97 4.54 62 BAYES_80 15311 5.57 8.92 4.12 63 RCVD_IN_IADB_LISTED 15258 3.34 1.57 4.10 64 BAYES_99 15175 12.72 32.62 4.08 65 BOTNET_IPINHOSTNAME 15021 7.11 14.17 4.04 66 XMSubMetaSx_00 13604 4.30 5.77 3.66 67 T_REMOTE_IMAGE 13567 3.12 1.91 3.65 68 XM_UncommonTLD01 13291 4.15 5.49 3.57 69 RCVD_IN_IADB_SPF 13284 2.91 1.38 3.57 70 MIME_HTML_MOSTLY 13176 3.65 3.90 3.54 71 HTML_IMAGE_RATIO_04 13039 4.13 5.57 3.51 72 XM_SPF_SoftFail 13026 3.95 4.97 3.50 73 ANY_BOUNCE_MESSAGE 12749 2.88 1.63 3.43 74 BOUNCE_MESSAGE 12745 2.88 1.63 3.43 75 XM_B_Phish_Phrases 12686 4.02 5.44 3.41 76 HTML_IMAGE_RATIO_06 12639 3.82 4.80 3.40 77 BAYES_20 12092 2.61 1.13 3.25 78 XM_Body_Dirty_Words 12051 4.21 6.44 3.24 79 RCVD_IN_IADB_SENDERID 11826 2.61 1.29 3.18 80 RCVD_IN_IADB_DK 11453 2.54 1.28 3.08 81 BAYES_999 11336 9.80 25.37 3.05 82 RCVD_IN_IADB_VOUCHED 10613 2.22 0.76 2.85 83 TooManyTo_002 10432 2.33 1.23 2.80 84 XMNumbers 10204 3.05 3.77 2.74 85 MAILING_LIST_MULTI 10022 2.40 1.71 2.69 86 HTML_IMAGE_RATIO_08 9960 2.99 3.70 2.68 87 BAYES_95 9949 3.40 5.07 2.67 88 TR_XM_DKIM_Undo 8947 10.19 28.11 2.41 89 DKIM_INVALID 8839 3.04 4.57 2.38 90 T_TooManySym_02 8796 1.87 0.73 2.36 91 XM_CamelCaseFrm001 8704 2.51 2.91 2.34 92 XM_B_SpammyTLD 8658 2.67 3.45 2.33 93 TR_XM_SpammyRelay 8476 4.66 10.13 2.28 94 MIME_HTML_ONLY_MULTI 8409 2.61 3.41 2.26 95 HTML_MIME_NO_HTML_TAG 8124 2.08 1.83 2.18 96 XM_DK_Undo_01 7728 2.04 1.94 2.08 97 INVALID_MSGID 7392 1.44 0.17 1.99 98 RCVD_IN_IADB_OPTIN 7230 1.50 0.47 1.94 99 BAYES_05 7158 1.56 0.70 1.92 100 FROM_EXCESS_BASE64 7073 1.86 1.77 1.90 101 HELO_NODOT 7053 1.43 0.34 1.90 102 HELO_NO_DOMAIN 7046 1.42 0.34 1.89 103 TR_DCC_Bayes_99 6797 8.35 23.38 1.83 104 TM2_M_URI_OPT_OUT 6527 2.34 3.70 1.75 105 TVD_RCVD_IP 6349 1.40 0.69 1.71 106 XM_B_Investor 6344 2.55 4.49 1.71 107 TO_MALFORMED 6329 1.20 0.04 1.70 108 T_XMDrugObfuBody_14 6321 2.35 3.85 1.70 109 TR_Symld_Words 6268 1.54 1.21 1.69 110 TR_XM_PhishingBody 6253 2.58 4.65 1.68 111 HTML_IMAGE_ONLY_32 6234 1.29 0.41 1.68 112 T_XMDrugObfuBody_08 6154 2.19 3.42 1.65 113 KHOP_HELO_FCRDNS 6151 1.60 1.46 1.65 114 RELAYCOUNTRY_GB 6084 1.45 1.03 1.64 115 XMSexyCombo_05 5971 2.23 3.68 1.61 116 XMDiploma_00 5651 1.77 2.34 1.52 117 TooManyTo_003 5587 1.40 1.15 1.50 118 XM_B_Unsub2 5502 1.87 2.76 1.48 119 TR_XM_SpammyWords5 5480 2.49 4.84 1.47 120 UNTRUSTED_Relay 5337 2.62 5.34 1.43 121 TR_XM_UnparsRelay 5333 3.25 7.43 1.43 122 SUBJ_ALL_CAPS 5287 1.74 2.46 1.42 123 TM2_M_VERY_LONG_WORD 5276 1.95 3.16 1.42 124 IN_HORDE_ADDRESS_BOOK 5240 1.00 0.07 1.41 125 XM_SendGrid 5116 1.38 1.40 1.38 126 XM_GoogleGroups 4777 1.09 0.66 1.28 127 BOTNET 4739 3.71 9.30 1.27 128 URI_NOVOWEL 4720 1.22 1.11 1.27 129 RELAYCOUNTRY_CA 4457 2.33 4.94 1.20 130 XM_B_SEO 4448 2.37 5.06 1.20 131 URI_HEX 4388 1.32 1.63 1.18 132 XMGappySubj_01 4183 0.87 0.27 1.12 133 TooManyTo_004 4161 1.11 1.09 1.12 134 TVD_SPACE_RATIO 4097 0.80 0.11 1.10 135 XMBSHREFv2 4061 0.87 0.35 1.09 136 XM_H_Long_From02 4042 1.21 1.51 1.09 137 XMCapTrack 3881 0.88 0.50 1.04 138 HTTPS_HTTP_MISMATCH 3524 1.10 1.46 0.95 139 XM_OfRef6 3472 1.78 3.74 0.93 140 TooManyTo_005 3448 0.97 1.05 0.93 141 XMBrknScrpt_02 3435 1.24 1.98 0.92 142 T_OBFU_PDF_ATTACH 3421 0.70 0.19 0.92 143 XM_B_COPY_HTML 3301 0.90 0.92 0.89 144 TR_XM_DK_SendGrid 3260 0.86 0.82 0.88 145 T_TooManySym_03 3172 0.66 0.22 0.85 146 T_FILL_THIS_FORM_SHORT 3137 0.95 1.18 0.84 147 XM_UB50 3114 1.38 2.61 0.84 148 XMGenDplmaNmb 3076 0.96 1.26 0.83 149 URI_TRY_3LD 2976 1.25 2.28 0.80 150 XM_H_Trusted_IP 2937 0.55 0.00 0.79 151 SpammyFromTLD_01 2932 1.12 1.88 0.79 152 FROM_GOV_DKIM_AU 2922 0.59 0.13 0.79 153 XMBdyGiftCard01 2884 0.94 1.31 0.78 154 DKIM_ADSP_CUSTOM_MED 2880 0.84 0.98 0.77 155 TR_XM_SEO4 2784 1.90 4.54 0.75 156 RCVD_IN_BL_SPAMCOP_NET 2777 2.47 6.44 0.75 157 XMBody_95 2762 0.59 0.25 0.74 158 TR_MetaPhish_Combo_01 2736 0.79 0.92 0.74 159 RELAYCOUNTRY_AU 2694 1.22 2.35 0.72 160 XM_ShortIntro_01 2639 0.70 0.66 0.71 161 XM_H_PHPMailer 2608 0.70 0.71 0.70 162 TR_XM_SpammyWords2 2603 4.06 11.78 0.70 163 PLING_QUERY 2548 0.75 0.91 0.69 164 XM_B_SpammyWords4 2492 1.33 2.84 0.67 165 XMBody_17 2429 1.90 4.78 0.65 166 T_Symld_Words_02 2402 0.70 0.81 0.65 167 XMLngstWrd_00 2396 0.74 0.96 0.64 168 XMStockSpam_06 2387 1.00 1.82 0.64 169 XMGappySubj_02 2306 0.45 0.06 0.62 170 MPART_ALT_DIFF_COUNT 2289 0.74 1.04 0.62 171 XM_B_FormFill 2266 0.46 0.10 0.61 172 HTML_TAG_BALANCE_BODY 2258 0.89 1.54 0.61 173 XMMoneyMeta_00 2218 0.71 0.98 0.60 174 SHORT_HELO_AND_INLINE_IMAGE 2201 0.43 0.06 0.59 175 TR_LOTS_OF_MONEY3 2128 1.60 3.96 0.57 176 XMSubNoVowel 2100 0.52 0.40 0.56 177 XMNoVowels 2076 0.52 0.44 0.56 178 TR_XM_Base64_M1 2049 0.66 0.90 0.55 179 USER_IN_WELCOMELIST 2042 0.38 0.00 0.55 180 USER_IN_WHITELIST 2042 0.38 0.00 0.55 181 T_XMDrugObfuBody_00 1990 0.81 1.45 0.53 182 TO_NO_BRKTS_HTML_ONLY 1979 0.44 0.23 0.53 183 XMPhish30 1863 0.78 1.42 0.50 184 T_XMHurry_00 1841 1.08 2.43 0.49 185 XM_ProductURIs 1832 0.58 0.79 0.49 186 XM_B_DNDMA 1821 0.63 0.94 0.49 187 RCVD_IN_PSBL 1814 0.48 0.45 0.49 188 NML_ADSP_CUSTOM_MED 1792 0.59 0.84 0.48 189 XMPhish14 1789 0.69 1.16 0.48 190 HTML_IMAGE_ONLY_28 1780 0.47 0.43 0.48 191 XMSlimDrugH 1736 0.60 0.92 0.47 192 TR_XM_SPAMCOP 1715 1.85 5.03 0.46 193 HTML_FONT_FACE_BAD 1709 0.56 0.80 0.46 194 TM2_M_BODY_EMPTY 1684 0.52 0.68 0.45 195 HTML_IMAGE_ONLY_24 1644 0.36 0.17 0.44 196 FORGED_GMAIL_RCVD 1631 0.53 0.75 0.44 197 XMSubMetaI_00 1627 0.50 0.65 0.44 198 MISSING_HEADERS 1579 0.48 0.61 0.42 199 XMDateMe_00 1564 0.38 0.28 0.42 200 XMClaimOffer 1533 0.47 0.61 0.41 ----------------------------------------------------------------------