Email: 538435 Autolearn: 0 AvgScore: 4.06 AvgScanTime: 1.20 sec Spam: 167986 Autolearn: 0 AvgScore: 12.85 AvgScanTime: 1.35 sec Ham: 370449 Autolearn: 0 AvgScore: 0.07 AvgScanTime: 1.12 sec Time Spent Running SA: 178.89 hours Time Spent Processing Spam: 63.15 hours Time Spent Processing Ham: 115.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162348 90.75 96.64 88.07 2 DKIM_SIGNED 153528 80.21 91.39 75.14 3 XM_DK_Pass 148235 78.35 88.24 73.87 4 DKIM_VALID 146415 77.36 87.16 72.91 5 XM_B_Unicode 145022 76.16 86.33 71.55 6 RELAYCOUNTRY_US 144905 83.41 86.26 82.11 7 DCC_CHECK 126485 50.65 75.29 39.47 8 XMListUnsubscribeExists 121622 57.83 72.40 51.22 9 XM_B_SpammyWords 120545 55.38 71.76 47.96 10 DKIM_VALID_AU 116139 62.70 69.14 59.78 11 XM_B_Unicode3 79361 42.42 47.24 40.23 12 LOC_TINY_FONT_1 76504 32.54 45.54 26.64 13 XM_B_SpammyWords2 71504 27.82 42.57 21.13 14 BAYES_50 70002 54.84 41.67 60.81 15 XM_DK_Undo_02 68908 16.70 41.02 5.68 16 HTML_FONT_LOW_CONTRAST 66563 32.46 39.62 29.22 17 FVGT_m_MULTI_ODD 61854 29.43 36.82 26.07 18 RCVD_IN_MSPIKE_H2 60700 31.19 36.13 28.95 19 BAYES_99 53293 12.64 31.72 3.99 20 T_KAM_HTML_FONT_INVALID 51322 24.49 30.55 21.73 21 TR_XM_DKIM_Undo 49354 11.03 29.38 2.70 22 DKIM_VALID_EF 48095 28.63 28.63 28.63 23 BAYES_999 41752 9.77 24.85 2.94 24 T_TM2_M_HEADER_IN_MSG 41735 28.55 24.84 30.23 25 DCC_CHECK_NEGATIVE 41486 49.31 24.70 60.47 26 MIME_HTML_ONLY 41471 20.14 24.69 18.08 27 TR_DCC_Bayes_99 38936 8.48 23.18 1.81 28 XMSubLong 37346 22.90 22.23 23.20 29 TR_XM_DK_Unsub 34293 15.94 20.41 13.91 30 XM_Multi_Part_URI 33917 15.49 20.19 13.36 31 LOTS_OF_MONEY 28332 10.61 16.87 7.78 32 XM_B_Unsub 26674 10.58 15.88 8.18 33 TR_XM_SpammyWords4 25544 8.75 15.21 5.83 34 TR_XM_BayesUnsub 25533 9.24 15.20 6.53 35 UNPARSEABLE_RELAY 25419 12.10 15.13 10.73 36 BOTNET_IPINHOSTNAME 24664 7.45 14.68 4.17 37 RELAYCOUNTRY_META 24197 7.10 14.40 3.79 38 TR_MAX_INTL_RELAY 23893 9.19 14.22 6.91 39 XM_B_SpammyWords3 23417 8.26 13.94 5.68 40 TR_XM_SpammyWords2 19254 3.98 11.46 0.58 41 TR_XM_SpammyRelay 16733 4.58 9.96 2.14 42 BOTNET 15449 3.85 9.20 1.42 43 FSL_BULK_SIG 15097 6.70 8.99 5.67 44 BAYES_80 14894 5.78 8.87 4.37 45 XM_Evil_Numbers_Gen 14636 7.90 8.71 7.53 46 BAYES_60 14131 9.24 8.41 9.61 47 RCVD_IN_BL_SPAMCOP_NET 12864 2.88 7.66 0.71 48 XM_Body_Dirty_Words 12673 4.80 7.54 3.55 49 TR_XM_UnparsRelay 12435 3.31 7.40 1.45 50 LotsOfNums_01 11838 8.70 7.05 9.44 51 XM_B_PhoneNumber 11579 9.28 6.89 10.37 52 HTML_IMAGE_RATIO_02 10125 5.65 6.03 5.48 53 TR_XM_SPAMCOP 9965 2.19 5.93 0.50 54 XMSubMetaSx_00 9531 4.12 5.67 3.41 55 MPART_ALT_DIFF 9243 4.31 5.50 3.77 56 UNTRUSTED_Relay 9214 2.64 5.48 1.36 57 XM_UncommonTLD01 9155 4.14 5.45 3.55 58 XMBody_17 9073 2.21 5.40 0.76 59 HTML_IMAGE_RATIO_04 8971 4.54 5.34 4.18 60 XM_B_SEO 8743 2.44 5.20 1.19 61 XM_B_Phish_Phrases 8645 4.91 5.15 4.81 62 HTML_IMAGE_RATIO_06 8641 3.74 5.14 3.11 63 XM_SPF_SoftFail 8574 3.82 5.10 3.23 64 TR_LOTS_OF_MONEY3 8475 2.09 5.05 0.75 65 BAYES_95 8293 3.28 4.94 2.53 66 TooManyTo_001 8236 6.79 4.90 7.65 67 RELAYCOUNTRY_CA 8224 2.33 4.90 1.16 68 XM_H_Long_From01 8011 5.06 4.77 5.19 69 TR_XM_SEO4 7707 1.94 4.59 0.73 70 TR_XM_PhishingBody 7484 2.52 4.46 1.64 71 XM_B_Investor 7466 2.45 4.44 1.54 72 XM_H_GMP 7159 5.54 4.26 6.12 73 DKIM_INVALID 7113 2.85 4.23 2.22 74 TR_XM_SpammyWords5 6813 2.29 4.06 1.49 75 T_XMDrugObfuBody_08 6689 2.29 3.98 1.53 76 XMStrtUSub 6557 4.14 3.90 4.24 77 T_XMDrugObfuBody_14 6528 2.44 3.89 1.79 78 XMSexyCombo_05 6382 2.47 3.80 1.87 79 MIME_HTML_MOSTLY 6027 2.68 3.59 2.26 80 XM_OfRef6 5972 1.84 3.56 1.06 81 XMNumbers 5941 3.01 3.54 2.77 82 XM_B_SpammyTLD 5743 2.79 3.42 2.50 83 TM2_M_VERY_LONG_WORD 5674 3.00 3.38 2.83 84 MIME_HTML_ONLY_MULTI 5445 2.30 3.24 1.88 85 TM2_M_URI_OPT_OUT 5374 2.15 3.20 1.68 86 HTML_IMAGE_RATIO_08 5320 2.33 3.17 1.95 87 MIME_QP_LONG_LINE 5190 4.47 3.09 5.10 88 RCVD_IN_VALIDITY_RPBL 5139 1.04 3.06 0.13 89 XM_CamelCaseFrm001 5031 3.02 2.99 3.04 90 XM_URI_RBL 4734 0.98 2.82 0.14 91 XMDiploma_00 4712 2.01 2.80 1.65 92 SUBJ_ALL_CAPS 4689 1.90 2.79 1.50 93 T_TooManySym_01 4685 4.68 2.79 5.53 94 XM_UB50 4423 1.41 2.63 0.85 95 XM_B_Unsub2 4345 1.84 2.59 1.50 96 RELAYCOUNTRY_AU 4330 1.30 2.58 0.72 97 XM_B_SpammyWords4 4033 1.08 2.40 0.49 98 RCVD_IN_MSPIKE_WL 3990 4.87 2.38 6.00 99 RCVD_IN_MSPIKE_H3 3990 4.87 2.38 6.00 100 USER_IN_DEF_DKIM_WL 3652 10.30 2.17 13.98 101 HTML_MIME_NO_HTML_TAG 3646 2.05 2.17 2.00 102 URI_TRY_3LD 3519 1.19 2.09 0.78 103 XMBrknScrpt_02 3506 1.36 2.09 1.03 104 RCVD_IN_VALIDITY_SAFE 3338 4.48 1.99 5.61 105 T_XMHurry_00 3230 0.90 1.92 0.44 106 BOUNCE_MESSAGE 3215 3.91 1.91 4.81 107 ANY_BOUNCE_MESSAGE 3215 3.91 1.91 4.81 108 T_REMOTE_IMAGE 3203 3.18 1.91 3.75 109 MAILING_LIST_MULTI 3198 2.27 1.90 2.44 110 T_FILL_THIS_FORM_SHORT 3067 1.17 1.83 0.88 111 XM_DK_Undo_01 3034 1.86 1.81 1.88 112 SpammyFromTLD_01 2927 1.09 1.74 0.79 113 TR_XM_NoHeaderRelay 2876 0.62 1.71 0.12 114 XMStockSpam_06 2869 1.35 1.71 1.19 115 T_XMDrugObfuBody_00 2797 1.00 1.67 0.70 116 BAYES_40 2783 3.62 1.66 4.52 117 XMReplyNow 2694 0.73 1.60 0.33 118 HTML_TAG_BALANCE_BODY 2650 0.88 1.58 0.57 119 XM_H_Long_From02 2609 1.19 1.55 1.03 120 XM_DIRTYINTL 2543 0.60 1.51 0.19 121 RCVD_IN_VALIDITY_CERTIFIED 2536 3.92 1.51 5.01 122 URI_NOVOWEL 2535 1.40 1.51 1.35 123 ALL_TRUSTED 2524 10.70 1.50 14.88 124 XM_HighProb1 2487 0.46 1.48 0.00 125 LONGLN_LOW_CONTRAST 2414 0.62 1.44 0.25 126 HTTPS_HTTP_MISMATCH 2411 0.99 1.44 0.78 127 XM_SendGrid 2409 1.41 1.43 1.40 128 SpammyFromTLD_02 2365 0.71 1.41 0.39 129 XMPhish30 2350 0.82 1.40 0.55 130 AC_BR_BONANZA 2345 0.50 1.40 0.09 131 FROM_EXCESS_BASE64 2320 1.74 1.38 1.90 132 URIBL_DBL_SPAM 2301 0.43 1.37 0.00 133 DIET_1 2267 0.61 1.35 0.27 134 KHOP_HELO_FCRDNS 2258 1.96 1.34 2.23 135 HOSTED_IMG_MULTI_PUB_01 2258 0.44 1.34 0.03 136 XMGenDplmaNmb 2230 1.06 1.33 0.94 137 TR_XM_INV_DKIM 2213 0.46 1.32 0.07 138 BAYES_20 2202 2.62 1.31 3.22 139 RCVD_IN_IADB_LISTED 2141 2.89 1.27 3.62 140 XMPhish14 2139 0.67 1.27 0.40 141 TR_Mismatch_TLD_01 2125 0.53 1.26 0.19 142 TR_XM_PHPForged 2095 0.57 1.25 0.27 143 URI_HEX 2089 1.21 1.24 1.19 144 TR_XM_PHPDW 2072 0.57 1.23 0.26 145 TR_XM_FormFill2 2008 0.55 1.20 0.26 146 XMBdyGiftCard01 1996 1.07 1.19 1.02 147 XM_H_PHPOS 1990 0.54 1.18 0.25 148 XMSexyCombo_01 1976 0.55 1.18 0.27 149 HTML_FONT_TINY_NORDNS 1934 0.42 1.15 0.09 150 TR_XM_FormFill 1908 0.36 1.14 0.01 151 XM_B_COPY_HTML 1898 0.72 1.13 0.53 152 XM_B_Phish66 1849 0.54 1.10 0.29 153 RCVD_IN_IADB_SPF 1816 2.52 1.08 3.18 154 TR_Caps_n_Bayes_99 1801 0.35 1.07 0.02 155 THIS_AD 1797 0.64 1.07 0.45 156 RELAYCOUNTRY_FR 1793 0.47 1.07 0.20 157 XMHTML_After_End 1786 0.55 1.06 0.31 158 TR_XM_InvalidRelay 1743 0.34 1.04 0.03 159 T_STY_INVIS_DIRECT 1712 0.54 1.02 0.32 160 TR_MetaPhish_Combo_01 1693 0.73 1.01 0.61 161 RCVD_IN_IADB_DK 1675 2.21 1.00 2.76 162 XMHTMLBadTable_001 1673 0.49 1.00 0.27 163 RCVD_IN_IADB_SENDERID 1669 2.26 0.99 2.83 164 TR_XM_DK_SendGrid 1668 0.93 0.99 0.90 165 XM_UB99 1656 0.31 0.99 0.00 166 TR_XM_Spammywords 1642 0.50 0.98 0.28 167 XM_S_SpammyWords 1642 0.50 0.98 0.28 168 DKIM_ADSP_CUSTOM_MED 1594 0.85 0.95 0.80 169 RDNS_DYNAMIC 1574 0.51 0.94 0.31 170 PDS_RDNS_DYNAMIC_FP 1535 0.40 0.91 0.16 171 DKIM_ADSP_NXDOMAIN 1530 0.48 0.91 0.29 172 FIN_FREE 1498 0.33 0.89 0.07 173 T_MONEY_PERCENT 1488 0.41 0.89 0.20 174 TR_LOTS_OF_MONEY2 1488 0.41 0.89 0.20 175 TR_Symld_Words 1476 1.24 0.88 1.40 176 TooManyTo_002 1470 1.94 0.88 2.42 177 PLING_QUERY 1455 0.49 0.87 0.33 178 MPART_ALT_DIFF_COUNT 1447 0.65 0.86 0.55 179 SHOPIFY_IMG_NOT_RCVD_SFY 1418 0.48 0.84 0.32 180 XM_PDF 1415 3.31 0.84 4.43 181 LongTLD 1406 0.50 0.84 0.35 182 XMSubMetaI_00 1399 0.58 0.83 0.47 183 AC_HTML_NONSENSE_TAGS 1395 0.28 0.83 0.03 184 BOTNET_NORDNS 1393 0.26 0.83 0.00 185 XMMoneyMeta_00 1383 0.57 0.82 0.46 186 XM_B_DNDMA 1344 0.74 0.80 0.71 187 RELAYCOUNTRY_GB 1340 0.54 0.80 0.43 188 TooManyTo_003 1334 1.21 0.79 1.40 189 XMSlimDrugH 1331 0.45 0.79 0.29 190 TVD_RCVD_IP 1330 1.29 0.79 1.52 191 BAYES_00 1326 6.53 0.79 9.13 192 TR_XM_RelayPhish 1315 0.27 0.78 0.04 193 NML_ADSP_CUSTOM_MED 1299 0.61 0.77 0.54 194 TM2_M_OBFU_COMMENT 1294 0.45 0.77 0.30 195 XM_ProductURIs 1287 0.55 0.77 0.46 196 URIBL_BLACK 1280 0.27 0.76 0.05 197 RELAYCOUNTRY_DE 1278 0.45 0.76 0.30 198 TR_Mismatch_TLD_02 1270 0.28 0.76 0.06 199 XM_B_COVIDMETA 1253 0.35 0.75 0.17 200 HTML_FONT_FACE_BAD 1234 0.53 0.73 0.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 326258 90.75 96.64 88.07 2 RELAYCOUNTRY_US 304187 83.41 86.26 82.11 3 DKIM_SIGNED 278340 80.21 91.39 75.14 4 XM_DK_Pass 273643 78.35 88.24 73.87 5 DKIM_VALID 270105 77.36 87.16 72.91 6 XM_B_Unicode 265038 76.16 86.33 71.55 7 BAYES_50 225259 54.84 41.67 60.81 8 DCC_CHECK_NEGATIVE 224024 49.31 24.70 60.47 9 DKIM_VALID_AU 221466 62.70 69.14 59.78 10 XMListUnsubscribeExists 189745 57.83 72.40 51.22 11 XM_B_SpammyWords 177660 55.38 71.76 47.96 12 XM_B_Unicode3 149039 42.42 47.24 40.23 13 DCC_CHECK 146220 50.65 75.29 39.47 14 T_TM2_M_HEADER_IN_MSG 111990 28.55 24.84 30.23 15 HTML_FONT_LOW_CONTRAST 108231 32.46 39.62 29.22 16 RCVD_IN_MSPIKE_H2 107256 31.19 36.13 28.95 17 DKIM_VALID_EF 106075 28.63 28.63 28.63 18 LOC_TINY_FONT_1 98679 32.54 45.54 26.64 19 FVGT_m_MULTI_ODD 96594 29.43 36.82 26.07 20 XMSubLong 85957 22.90 22.23 23.20 21 T_KAM_HTML_FONT_INVALID 80516 24.49 30.55 21.73 22 XM_B_SpammyWords2 78272 27.82 42.57 21.13 23 MIME_HTML_ONLY 66991 20.14 24.69 18.08 24 ALL_TRUSTED 55108 10.70 1.50 14.88 25 USER_IN_DEF_DKIM_WL 51804 10.30 2.17 13.98 26 TR_XM_DK_Unsub 51538 15.94 20.41 13.91 27 XM_Multi_Part_URI 49508 15.49 20.19 13.36 28 UNPARSEABLE_RELAY 39738 12.10 15.13 10.73 29 XM_B_PhoneNumber 38411 9.28 6.89 10.37 30 BAYES_60 35600 9.24 8.41 9.61 31 LotsOfNums_01 34986 8.70 7.05 9.44 32 BAYES_00 33819 6.53 0.79 9.13 33 XM_B_Unsub 30309 10.58 15.88 8.18 34 LOTS_OF_MONEY 28821 10.61 16.87 7.78 35 TooManyTo_001 28344 6.79 4.90 7.65 36 XM_Evil_Numbers_Gen 27899 7.90 8.71 7.53 37 XM_DKIMWhitelistDomains 27503 5.11 0.01 7.42 38 IN_ZIMBRA_NJ_WHITELIST 25612 4.80 0.13 6.91 39 TR_MAX_INTL_RELAY 25597 9.19 14.22 6.91 40 TR_XM_DK_Bayes 24453 4.73 0.60 6.60 41 TR_XM_BayesUnsub 24199 9.24 15.20 6.53 42 TR_XM_DK_Bayes1 24187 4.66 0.54 6.53 43 XM_H_GMP 22672 5.54 4.26 6.12 44 RCVD_IN_MSPIKE_WL 22237 4.87 2.38 6.00 45 RCVD_IN_MSPIKE_H3 22237 4.87 2.38 6.00 46 TR_XM_SpammyWords4 21584 8.75 15.21 5.83 47 TR_XM_DK_Bayes2 21363 4.11 0.44 5.77 48 XM_B_SpammyWords3 21044 8.26 13.94 5.68 49 XM_DK_Undo_02 21030 16.70 41.02 5.68 50 FSL_BULK_SIG 21002 6.70 8.99 5.67 51 RCVD_IN_VALIDITY_SAFE 20793 4.48 1.99 5.61 52 T_TooManySym_01 20493 4.68 2.79 5.53 53 HTML_IMAGE_RATIO_02 20307 5.65 6.03 5.48 54 XM_H_Long_From01 19239 5.06 4.77 5.19 55 MIME_QP_LONG_LINE 18877 4.47 3.09 5.10 56 RCVD_IN_VALIDITY_CERTIFIED 18574 3.92 1.51 5.01 57 BOUNCE_MESSAGE 17813 3.91 1.91 4.81 58 ANY_BOUNCE_MESSAGE 17813 3.91 1.91 4.81 59 XM_B_Phish_Phrases 17810 4.91 5.15 4.81 60 BAYES_40 16726 3.62 1.66 4.52 61 XM_PDF 16401 3.31 0.84 4.43 62 BAYES_80 16201 5.78 8.87 4.37 63 XMStrtUSub 15719 4.14 3.90 4.24 64 HTML_IMAGE_RATIO_04 15477 4.54 5.34 4.18 65 BOTNET_IPINHOSTNAME 15453 7.45 14.68 4.17 66 BAYES_99 14764 12.64 31.72 3.99 67 RELAYCOUNTRY_META 14031 7.10 14.40 3.79 68 MPART_ALT_DIFF 13975 4.31 5.50 3.77 69 T_REMOTE_IMAGE 13909 3.18 1.91 3.75 70 RCVD_IN_IADB_LISTED 13394 2.89 1.27 3.62 71 XM_UncommonTLD01 13162 4.14 5.45 3.55 72 XM_Body_Dirty_Words 13159 4.80 7.54 3.55 73 XMSubMetaSx_00 12638 4.12 5.67 3.41 74 XM_SPF_SoftFail 11981 3.82 5.10 3.23 75 BAYES_20 11915 2.62 1.31 3.22 76 RCVD_IN_IADB_SPF 11777 2.52 1.08 3.18 77 HTML_IMAGE_RATIO_06 11516 3.74 5.14 3.11 78 XM_CamelCaseFrm001 11248 3.02 2.99 3.04 79 BAYES_999 10874 9.77 24.85 2.94 80 TM2_M_VERY_LONG_WORD 10500 3.00 3.38 2.83 81 RCVD_IN_IADB_SENDERID 10496 2.26 0.99 2.83 82 XMNumbers 10243 3.01 3.54 2.77 83 RCVD_IN_IADB_DK 10208 2.21 1.00 2.76 84 TR_XM_DKIM_Undo 10020 11.03 29.38 2.70 85 T_TooManySym_02 9723 1.99 0.60 2.62 86 BAYES_95 9389 3.28 4.94 2.53 87 XM_B_SpammyTLD 9274 2.79 3.42 2.50 88 MAILING_LIST_MULTI 9037 2.27 1.90 2.44 89 TooManyTo_002 8952 1.94 0.88 2.42 90 RCVD_IN_IADB_VOUCHED 8870 1.87 0.71 2.39 91 MIME_HTML_MOSTLY 8390 2.68 3.59 2.26 92 KHOP_HELO_FCRDNS 8277 1.96 1.34 2.23 93 DKIM_INVALID 8235 2.85 4.23 2.22 94 TR_XM_SpammyRelay 7915 4.58 9.96 2.14 95 INVALID_MSGID 7404 1.42 0.13 2.00 96 HTML_MIME_NO_HTML_TAG 7391 2.05 2.17 2.00 97 HTML_IMAGE_RATIO_08 7211 2.33 3.17 1.95 98 TO_MALFORMED 7059 1.31 0.01 1.91 99 FROM_EXCESS_BASE64 7038 1.74 1.38 1.90 100 XM_DK_Undo_01 6967 1.86 1.81 1.88 101 MIME_HTML_ONLY_MULTI 6965 2.30 3.24 1.88 102 XMSexyCombo_05 6936 2.47 3.80 1.87 103 BAYES_05 6776 1.46 0.63 1.83 104 TR_DCC_Bayes_99 6720 8.48 23.18 1.81 105 T_XMDrugObfuBody_14 6626 2.44 3.89 1.79 106 HELO_NODOT 6302 1.26 0.28 1.70 107 HELO_NO_DOMAIN 6298 1.26 0.27 1.70 108 TM2_M_URI_OPT_OUT 6216 2.15 3.20 1.68 109 RCVD_IN_IADB_OPTIN 6144 1.27 0.43 1.66 110 XMDiploma_00 6105 2.01 2.80 1.65 111 TR_XM_PhishingBody 6071 2.52 4.46 1.64 112 HTML_EXTRA_CLOSE 5981 1.12 0.03 1.61 113 XM_B_Investor 5704 2.45 4.44 1.54 114 T_XMDrugObfuBody_08 5653 2.29 3.98 1.53 115 TVD_RCVD_IP 5624 1.29 0.79 1.52 116 SUBJ_ALL_CAPS 5563 1.90 2.79 1.50 117 XM_B_Unsub2 5539 1.84 2.59 1.50 118 TR_XM_SpammyWords5 5511 2.29 4.06 1.49 119 IN_HORDE_ADDRESS_BOOK 5416 1.03 0.07 1.46 120 TR_XM_UnparsRelay 5377 3.31 7.40 1.45 121 BOTNET 5255 3.85 9.20 1.42 122 TR_Symld_Words 5184 1.24 0.88 1.40 123 XM_SendGrid 5179 1.41 1.43 1.40 124 TooManyTo_003 5177 1.21 0.79 1.40 125 UNTRUSTED_Relay 5022 2.64 5.48 1.36 126 URI_NOVOWEL 4990 1.40 1.51 1.35 127 URI_HEX 4422 1.21 1.24 1.19 128 XMStockSpam_06 4420 1.35 1.71 1.19 129 XM_B_SEO 4390 2.44 5.20 1.19 130 RELAYCOUNTRY_CA 4309 2.33 4.90 1.16 131 XM_GoogleGroups 4255 1.01 0.69 1.15 132 XMBSHREFv2 4212 0.94 0.50 1.14 133 TVD_SPACE_RATIO 4104 0.80 0.12 1.11 134 XMGappySubj_01 4059 0.84 0.28 1.10 135 XM_OfRef6 3927 1.84 3.56 1.06 136 XMBrknScrpt_02 3813 1.36 2.09 1.03 137 XM_H_Long_From02 3799 1.19 1.55 1.03 138 XMBdyGiftCard01 3775 1.07 1.19 1.02 139 TooManyTo_004 3764 0.93 0.73 1.02 140 FROM_GOV_DKIM_AU 3741 0.78 0.27 1.01 141 XMCapTrack 3635 0.83 0.48 0.98 142 XMGenDplmaNmb 3486 1.06 1.33 0.94 143 T_TooManySym_03 3378 0.69 0.21 0.91 144 TR_XM_DK_SendGrid 3346 0.93 0.99 0.90 145 T_FILL_THIS_FORM_SHORT 3248 1.17 1.83 0.88 146 XM_UB50 3154 1.41 2.63 0.85 147 TooManyTo_005 3067 0.79 0.71 0.83 148 DKIM_ADSP_CUSTOM_MED 2982 0.85 0.95 0.80 149 SpammyFromTLD_01 2916 1.09 1.74 0.79 150 URI_TRY_3LD 2908 1.19 2.09 0.78 151 HTTPS_HTTP_MISMATCH 2897 0.99 1.44 0.78 152 XMBody_17 2821 2.21 5.40 0.76 153 TR_LOTS_OF_MONEY3 2763 2.09 5.05 0.75 154 TR_XM_SEO4 2712 1.94 4.59 0.73 155 RELAYCOUNTRY_AU 2682 1.30 2.58 0.72 156 XM_ShortIntro_01 2642 0.70 0.68 0.71 157 RCVD_IN_BL_SPAMCOP_NET 2639 2.88 7.66 0.71 158 XM_B_DNDMA 2637 0.74 0.80 0.71 159 T_XMDrugObfuBody_00 2598 1.00 1.67 0.70 160 T_OBFU_PDF_ATTACH 2463 0.53 0.22 0.66 161 XMGappySubj_02 2390 0.48 0.11 0.65 162 XMBody_95 2305 0.47 0.14 0.62 163 HTML_IMAGE_ONLY_28 2264 0.54 0.40 0.61 164 TR_MetaPhish_Combo_01 2260 0.73 1.01 0.61 165 XMNoVowels 2209 0.60 0.62 0.60 166 XM_H_PHPMailer 2200 0.63 0.70 0.59 167 XMLngstWrd_00 2184 0.62 0.69 0.59 168 TR_XM_SpammyWords2 2164 3.98 11.46 0.58 169 XM_B_FormFill 2155 0.43 0.10 0.58 170 HTML_TAG_BALANCE_BODY 2108 0.88 1.58 0.57 171 MPART_ALT_DIFF_COUNT 2052 0.65 0.86 0.55 172 XMPhish30 2043 0.82 1.40 0.55 173 SUBJ_BUY 2014 0.43 0.17 0.54 174 NML_ADSP_CUSTOM_MED 1989 0.61 0.77 0.54 175 XMSubMetaSxObfu_03 1973 0.56 0.61 0.53 176 USER_IN_WELCOMELIST 1973 0.37 0.00 0.53 177 USER_IN_WHITELIST 1973 0.37 0.00 0.53 178 TR_XM_Base64_M1 1971 0.59 0.73 0.53 179 XM_B_COPY_HTML 1966 0.72 1.13 0.53 180 SHORT_HELO_AND_INLINE_IMAGE 1915 0.37 0.04 0.52 181 T_Symld_Words_02 1863 0.53 0.58 0.50 182 TR_XM_SPAMCOP 1841 2.19 5.93 0.50 183 XM_B_SpammyWords4 1801 1.08 2.40 0.49 184 XMSubMetaI_00 1743 0.58 0.83 0.47 185 HTML_IMAGE_ONLY_32 1732 0.38 0.19 0.47 186 FILL_THIS_FORM 1723 0.36 0.14 0.47 187 FORGED_GMAIL_RCVD 1720 0.53 0.66 0.46 188 TM2_M_BODY_EMPTY 1704 0.35 0.10 0.46 189 XM_ProductURIs 1697 0.55 0.77 0.46 190 XMOemUri 1693 0.40 0.26 0.46 191 XMMoneyMeta_00 1692 0.57 0.82 0.46 192 THIS_AD 1653 0.64 1.07 0.45 193 HTML_FONT_FACE_BAD 1644 0.53 0.73 0.44 194 T_XMHurry_00 1634 0.90 1.92 0.44 195 RELAYCOUNTRY_GB 1577 0.54 0.80 0.43 196 RCVD_IN_PSBL 1569 0.44 0.49 0.42 197 XMDateMe_00 1493 0.39 0.36 0.40 198 XMSubMetaSxObfu_02 1490 0.36 0.28 0.40 199 XMPhish14 1484 0.67 1.27 0.40 200 SpammyFromTLD_02 1462 0.71 1.41 0.39 ----------------------------------------------------------------------