Email: 486625 Autolearn: 0 AvgScore: 4.24 AvgScanTime: 1.21 sec Spam: 160428 Autolearn: 0 AvgScore: 12.98 AvgScanTime: 1.33 sec Ham: 326197 Autolearn: 0 AvgScore: -0.06 AvgScanTime: 1.15 sec Time Spent Running SA: 163.43 hours Time Spent Processing Spam: 59.15 hours Time Spent Processing Ham: 104.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154588 90.59 96.36 87.75 2 DKIM_SIGNED 147722 82.93 92.08 78.43 3 XM_DK_Pass 142666 81.06 88.93 77.19 4 XM_B_Unicode 139754 77.59 87.11 72.90 5 RELAYCOUNTRY_US 139737 84.51 87.10 83.24 6 DKIM_VALID 139704 79.82 87.08 76.26 7 DCC_CHECK 121160 52.72 75.52 41.51 8 XM_B_SpammyWords 117940 56.15 73.52 47.61 9 XMListUnsubscribeExists 117610 60.48 73.31 54.17 10 DKIM_VALID_AU 111878 64.88 69.74 62.50 11 XM_B_Unicode3 73235 43.13 45.65 41.89 12 LOC_TINY_FONT_1 69644 33.09 43.41 28.01 13 XM_DK_Undo_02 68446 18.40 42.66 6.46 14 XM_B_SpammyWords2 66781 27.87 41.63 21.11 15 BAYES_50 64183 53.95 40.01 60.80 16 FVGT_m_MULTI_ODD 63857 31.16 39.80 26.92 17 HTML_FONT_LOW_CONTRAST 61793 33.97 38.52 31.74 18 RCVD_IN_MSPIKE_H2 60289 33.96 37.58 32.18 19 BAYES_99 54043 14.38 33.69 4.89 20 TR_XM_DKIM_Undo 50407 12.42 31.42 3.07 21 T_KAM_HTML_FONT_INVALID 46080 23.30 28.72 20.63 22 DKIM_VALID_EF 44881 29.27 27.98 29.91 23 BAYES_999 42811 11.29 26.69 3.72 24 TR_DCC_Bayes_99 40091 9.56 24.99 1.98 25 DCC_CHECK_NEGATIVE 39246 47.25 24.46 58.46 26 T_TM2_M_HEADER_IN_MSG 39177 26.74 24.42 27.89 27 MIME_HTML_ONLY 36724 20.81 22.89 19.78 28 XMSubLong 35545 22.62 22.16 22.84 29 TR_XM_DK_Unsub 32979 16.70 20.56 14.80 30 XM_Multi_Part_URI 32528 16.00 20.28 13.89 31 LOTS_OF_MONEY 28377 11.21 17.69 8.02 32 TR_XM_SpammyWords4 25938 9.06 16.17 5.57 33 XM_B_Unsub 24515 10.71 15.28 8.47 34 UNPARSEABLE_RELAY 23670 12.43 14.75 11.28 35 TR_XM_BayesUnsub 23563 9.53 14.69 6.99 36 TR_MAX_INTL_RELAY 22776 9.18 14.20 6.71 37 BOTNET_IPINHOSTNAME 22578 7.80 14.07 4.71 38 RELAYCOUNTRY_META 22437 7.39 13.99 4.15 39 XM_B_SpammyWords3 21892 8.01 13.65 5.24 40 TR_XM_SpammyWords2 19997 4.54 12.46 0.65 41 TR_XM_SpammyRelay 16292 5.07 10.16 2.57 42 BAYES_80 14377 5.72 8.96 4.12 43 XM_Evil_Numbers_Gen 14122 8.73 8.80 8.69 44 BOTNET 13805 3.96 8.61 1.68 45 FSL_BULK_SIG 13358 6.55 8.33 5.67 46 BAYES_60 13065 8.99 8.14 9.41 47 XM_Body_Dirty_Words 12950 4.78 8.07 3.17 48 RCVD_IN_BL_SPAMCOP_NET 12754 3.08 7.95 0.68 49 LotsOfNums_01 12294 8.56 7.66 8.99 50 TR_XM_UnparsRelay 11518 3.43 7.18 1.58 51 XMBody_17 10339 2.63 6.44 0.75 52 TR_XM_SPAMCOP 10143 2.37 6.32 0.43 53 XMSubMetaSx_00 9730 5.20 6.07 4.77 54 MPART_ALT_DIFF 9659 4.55 6.02 3.82 55 HTML_IMAGE_RATIO_02 9553 5.10 5.95 4.68 56 UNTRUSTED_Relay 9270 2.90 5.78 1.49 57 TR_LOTS_OF_MONEY3 9157 2.60 5.71 1.08 58 HTML_IMAGE_RATIO_04 8438 5.16 5.26 5.10 59 XM_B_PhoneNumber 8277 7.89 5.16 9.23 60 XM_H_Long_From01 8221 5.36 5.12 5.48 61 XM_SPF_SoftFail 8115 3.72 5.06 3.07 62 XM_B_SEO 8112 2.89 5.06 1.82 63 XM_B_Investor 8081 2.80 5.04 1.70 64 DKIM_INVALID 8018 3.11 5.00 2.18 65 BAYES_95 7906 3.36 4.93 2.59 66 TooManyTo_001 7779 6.98 4.85 8.03 67 XM_UncommonTLD01 7578 4.09 4.72 3.78 68 RELAYCOUNTRY_CA 7424 2.37 4.63 1.27 69 TR_XM_SEO4 7261 2.34 4.53 1.27 70 XM_B_Phish_Phrases 7254 3.85 4.52 3.51 71 XMStrtUSub 7193 4.44 4.48 4.42 72 TR_XM_PhishingBody 6910 2.59 4.31 1.75 73 XMSexyCombo_05 6864 2.74 4.28 1.98 74 XM_H_GMP 6860 5.66 4.28 6.34 75 XM_OfRef6 6817 2.06 4.25 0.98 76 HTML_IMAGE_RATIO_06 6811 3.25 4.25 2.75 77 T_XMDrugObfuBody_14 6342 2.51 3.95 1.80 78 MIME_HTML_MOSTLY 6181 2.83 3.85 2.33 79 RCVD_IN_VALIDITY_RPBL 6140 1.35 3.83 0.14 80 TM2_M_VERY_LONG_WORD 5974 2.13 3.72 1.34 81 TR_XM_SpammyWords5 5941 2.29 3.70 1.59 82 T_XMDrugObfuBody_08 5867 2.25 3.66 1.56 83 HTML_IMAGE_RATIO_08 5761 2.60 3.59 2.11 84 MIME_HTML_ONLY_MULTI 5426 2.52 3.38 2.10 85 MIME_QP_LONG_LINE 5262 4.51 3.28 5.12 86 XMNumbers 5012 2.94 3.12 2.85 87 XM_B_SpammyTLD 4984 2.89 3.11 2.79 88 XM_UB50 4835 1.57 3.01 0.86 89 XMDiploma_00 4562 2.08 2.84 1.71 90 XM_CamelCaseFrm001 4535 2.24 2.83 1.95 91 XM_B_Unsub2 4307 2.00 2.68 1.66 92 USER_IN_DEF_DKIM_WL 4223 11.20 2.63 15.42 93 XM_URI_RBL 3953 0.91 2.46 0.15 94 TM2_M_URI_OPT_OUT 3871 1.94 2.41 1.71 95 T_XMHurry_00 3866 1.31 2.41 0.77 96 RCVD_IN_MSPIKE_H3 3728 4.78 2.32 5.98 97 RCVD_IN_MSPIKE_WL 3728 4.78 2.32 5.98 98 T_TooManySym_01 3698 4.83 2.31 6.07 99 SUBJ_ALL_CAPS 3561 1.82 2.22 1.63 100 RELAYCOUNTRY_AU 3560 1.37 2.22 0.95 101 RCVD_IN_VALIDITY_SAFE 3438 4.69 2.14 5.95 102 XMBrknScrpt_02 3285 1.40 2.05 1.08 103 HOSTED_IMG_MULTI_PUB_01 3211 0.68 2.00 0.03 104 XM_B_SpammyWords4 3211 1.49 2.00 1.25 105 TR_XM_NoHeaderRelay 3153 0.75 1.97 0.16 106 KHOP_HELO_FCRDNS 3139 1.61 1.96 1.44 107 XM_DK_Undo_01 3138 2.05 1.96 2.10 108 URI_TRY_3LD 3081 1.16 1.92 0.78 109 T_FILL_THIS_FORM_SHORT 2916 1.23 1.82 0.94 110 FROM_EXCESS_BASE64 2912 1.82 1.82 1.82 111 T_REMOTE_IMAGE 2885 2.92 1.80 3.47 112 MAILING_LIST_MULTI 2870 2.24 1.79 2.46 113 AC_BR_BONANZA 2796 0.67 1.74 0.14 114 ANY_BOUNCE_MESSAGE 2746 3.09 1.71 3.77 115 BOUNCE_MESSAGE 2743 3.09 1.71 3.77 116 XMStockSpam_06 2734 1.63 1.70 1.59 117 TR_Mismatch_TLD_01 2665 0.67 1.66 0.19 118 TR_XM_InvalidRelay 2617 0.55 1.63 0.02 119 XMGenDplmaNmb 2573 1.12 1.60 0.88 120 HTML_MIME_NO_HTML_TAG 2552 1.83 1.59 1.94 121 SpammyFromTLD_02 2488 0.76 1.55 0.38 122 BAYES_40 2462 3.42 1.53 4.34 123 T_Symld_Words_02 2437 0.84 1.52 0.50 124 RCVD_IN_VALIDITY_CERTIFIED 2417 3.76 1.51 4.87 125 SpammyFromTLD_01 2409 1.00 1.50 0.76 126 T_XMDrugObfuBody_00 2365 1.00 1.47 0.77 127 XM_DIRTYINTL 2364 0.58 1.47 0.14 128 HTML_TAG_BALANCE_BODY 2285 0.85 1.42 0.56 129 XM_HighProb1 2221 0.46 1.38 0.00 130 XM_PDF 2196 3.38 1.37 4.37 131 XMBdyGiftCard01 2196 0.99 1.37 0.80 132 XMPhish30 2145 0.95 1.34 0.76 133 TR_XM_INV_DKIM 2144 0.48 1.34 0.06 134 LONGLN_LOW_CONTRAST 2126 0.63 1.33 0.29 135 TR_XM_PHPForged 2092 0.69 1.30 0.38 136 TR_XM_PHPDW 2092 0.70 1.30 0.40 137 RCVD_IN_IADB_LISTED 2056 2.92 1.28 3.72 138 TR_XM_FormFill2 2024 0.67 1.26 0.38 139 XM_H_PHPOS 2014 0.67 1.26 0.38 140 THIS_AD 2003 0.80 1.25 0.58 141 RELAYCOUNTRY_DE 1996 0.64 1.24 0.35 142 BAYES_20 1966 2.46 1.23 3.07 143 URI_HEX 1953 1.18 1.22 1.17 144 HTTPS_HTTP_MISMATCH 1951 0.92 1.22 0.78 145 XMPhish14 1950 0.68 1.22 0.42 146 MIME_CHARSET_FARAWAY 1917 0.60 1.19 0.31 147 RDNS_DYNAMIC 1853 0.59 1.16 0.31 148 URI_NOVOWEL 1850 1.22 1.15 1.26 149 ALL_TRUSTED 1844 9.41 1.15 13.47 150 TooManyTo_002 1825 2.03 1.14 2.47 151 MPART_ALT_DIFF_COUNT 1821 0.76 1.14 0.57 152 RCVD_IN_IADB_SPF 1808 2.54 1.13 3.24 153 PDS_RDNS_DYNAMIC_FP 1804 0.47 1.12 0.15 154 XM_B_COPY_HTML 1796 0.78 1.12 0.61 155 TR_XM_Base64_M1 1766 0.85 1.10 0.72 156 URIBL_DBL_SPAM 1738 0.36 1.08 0.01 157 XMSexyCombo_01 1708 0.55 1.06 0.29 158 RCVD_IN_IADB_DK 1700 2.24 1.06 2.82 159 RCVD_IN_IADB_SENDERID 1697 2.30 1.06 2.91 160 XM_B_DNDMA 1693 0.70 1.06 0.52 161 XMReplyNow 1691 0.50 1.05 0.23 162 XM_SendGrid 1683 1.25 1.05 1.34 163 TR_XM_FormFill 1679 0.35 1.05 0.01 164 TooManyTo_003 1662 1.29 1.04 1.42 165 XM_B_Phish66 1616 0.55 1.01 0.32 166 TooManyTo_004 1583 1.02 0.99 1.04 167 XMSubMetaI_00 1577 0.77 0.98 0.66 168 RCVD_IN_PSBL 1577 0.62 0.98 0.44 169 AC_HTML_NONSENSE_TAGS 1572 0.34 0.98 0.02 170 TVD_RCVD_IP 1549 1.37 0.97 1.57 171 HTML_FONT_TINY_NORDNS 1547 0.39 0.96 0.11 172 TooManyTo_005 1530 0.89 0.95 0.86 173 FIN_FREE 1510 0.34 0.94 0.05 174 XM_ProductURIs 1496 1.36 0.93 1.57 175 TR_XM_Spammywords 1495 0.46 0.93 0.23 176 XM_S_SpammyWords 1495 0.46 0.93 0.23 177 TM2_M_OBFU_COMMENT 1459 0.51 0.91 0.31 178 DKIM_ADSP_NXDOMAIN 1434 0.52 0.89 0.34 179 TR_Mismatch_TLD_02 1432 0.33 0.89 0.06 180 XMHTMLBadTable_001 1430 0.46 0.89 0.25 181 T_STY_INVIS_DIRECT 1417 0.51 0.88 0.33 182 TR_Symld_Words 1413 1.29 0.88 1.49 183 TR_LOTS_OF_MONEY2 1411 0.49 0.88 0.30 184 T_MONEY_PERCENT 1411 0.49 0.88 0.30 185 XM_H_Long_From02 1405 0.97 0.88 1.02 186 DKIM_ADSP_CUSTOM_MED 1396 0.82 0.87 0.79 187 TR_MetaPhish_Combo_01 1388 0.69 0.87 0.60 188 XM_ShortIntro_01 1352 0.72 0.84 0.65 189 XMHTML_After_End 1351 0.47 0.84 0.29 190 RELAYCOUNTRY_IN 1327 0.31 0.83 0.05 191 BOTNET_NORDNS 1307 0.27 0.81 0.01 192 XMBody_29 1303 0.32 0.81 0.07 193 BAYES_00 1288 6.29 0.80 8.99 194 TR_Caps_n_Bayes_99 1272 0.27 0.79 0.01 195 LongTLD 1266 0.52 0.79 0.39 196 RELAYCOUNTRY_FR 1261 0.39 0.79 0.20 197 RELAYCOUNTRY_UA 1254 0.26 0.78 0.00 198 PLING_QUERY 1240 0.57 0.77 0.47 199 REMOVE_BEFORE_LINK 1230 0.35 0.77 0.15 200 XMLngstWrd_00 1223 0.68 0.76 0.63 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 286236 90.59 96.36 87.75 2 RELAYCOUNTRY_US 271531 84.51 87.10 83.24 3 DKIM_SIGNED 255852 82.93 92.08 78.43 4 XM_DK_Pass 251798 81.06 88.93 77.19 5 DKIM_VALID 248744 79.82 87.08 76.26 6 XM_B_Unicode 237804 77.59 87.11 72.90 7 DKIM_VALID_AU 203861 64.88 69.74 62.50 8 BAYES_50 198330 53.95 40.01 60.80 9 DCC_CHECK_NEGATIVE 190689 47.25 24.46 58.46 10 XMListUnsubscribeExists 176701 60.48 73.31 54.17 11 XM_B_SpammyWords 155306 56.15 73.52 47.61 12 XM_B_Unicode3 136651 43.13 45.65 41.89 13 DCC_CHECK 135413 52.72 75.52 41.51 14 RCVD_IN_MSPIKE_H2 104968 33.96 37.58 32.18 15 HTML_FONT_LOW_CONTRAST 103519 33.97 38.52 31.74 16 DKIM_VALID_EF 97560 29.27 27.98 29.91 17 LOC_TINY_FONT_1 91375 33.09 43.41 28.01 18 T_TM2_M_HEADER_IN_MSG 90963 26.74 24.42 27.89 19 FVGT_m_MULTI_ODD 87799 31.16 39.80 26.92 20 XMSubLong 74506 22.62 22.16 22.84 21 XM_B_SpammyWords2 68855 27.87 41.63 21.11 22 T_KAM_HTML_FONT_INVALID 67307 23.30 28.72 20.63 23 MIME_HTML_ONLY 64527 20.81 22.89 19.78 24 USER_IN_DEF_DKIM_WL 50289 11.20 2.63 15.42 25 TR_XM_DK_Unsub 48269 16.70 20.56 14.80 26 XM_Multi_Part_URI 45310 16.00 20.28 13.89 27 ALL_TRUSTED 43942 9.41 1.15 13.47 28 UNPARSEABLE_RELAY 36811 12.43 14.75 11.28 29 BAYES_60 30703 8.99 8.14 9.41 30 XM_B_PhoneNumber 30121 7.89 5.16 9.23 31 XM_DKIMWhitelistDomains 30009 6.20 0.11 9.20 32 LotsOfNums_01 29337 8.56 7.66 8.99 33 BAYES_00 29318 6.29 0.80 8.99 34 XM_Evil_Numbers_Gen 28351 8.73 8.80 8.69 35 XM_B_Unsub 27623 10.71 15.28 8.47 36 TooManyTo_001 26202 6.98 4.85 8.03 37 LOTS_OF_MONEY 26172 11.21 17.69 8.02 38 TR_XM_BayesUnsub 22801 9.53 14.69 6.99 39 IN_ZIMBRA_NJ_WHITELIST 22427 4.63 0.07 6.88 40 TR_MAX_INTL_RELAY 21900 9.18 14.20 6.71 41 TR_XM_DK_Bayes 21586 4.61 0.52 6.62 42 TR_XM_DK_Bayes1 21331 4.53 0.45 6.54 43 XM_DK_Undo_02 21069 18.40 42.66 6.46 44 XM_H_GMP 20684 5.66 4.28 6.34 45 T_TooManySym_01 19814 4.83 2.31 6.07 46 RCVD_IN_MSPIKE_H3 19520 4.78 2.32 5.98 47 RCVD_IN_MSPIKE_WL 19520 4.78 2.32 5.98 48 RCVD_IN_VALIDITY_SAFE 19396 4.69 2.14 5.95 49 FSL_BULK_SIG 18509 6.55 8.33 5.67 50 TR_XM_DK_Bayes2 18365 3.90 0.38 5.63 51 TR_XM_SpammyWords4 18173 9.06 16.17 5.57 52 XM_H_Long_From01 17861 5.36 5.12 5.48 53 XM_B_SpammyWords3 17092 8.01 13.65 5.24 54 MIME_QP_LONG_LINE 16699 4.51 3.28 5.12 55 HTML_IMAGE_RATIO_04 16649 5.16 5.26 5.10 56 BAYES_99 15946 14.38 33.69 4.89 57 RCVD_IN_VALIDITY_CERTIFIED 15896 3.76 1.51 4.87 58 XMSubMetaSx_00 15557 5.20 6.07 4.77 59 BOTNET_IPINHOSTNAME 15359 7.80 14.07 4.71 60 HTML_IMAGE_RATIO_02 15281 5.10 5.95 4.68 61 XMStrtUSub 14418 4.44 4.48 4.42 62 XM_PDF 14258 3.38 1.37 4.37 63 BAYES_40 14160 3.42 1.53 4.34 64 RELAYCOUNTRY_META 13540 7.39 13.99 4.15 65 BAYES_80 13448 5.72 8.96 4.12 66 MPART_ALT_DIFF 12466 4.55 6.02 3.82 67 XM_UncommonTLD01 12328 4.09 4.72 3.78 68 ANY_BOUNCE_MESSAGE 12285 3.09 1.71 3.77 69 BOUNCE_MESSAGE 12282 3.09 1.71 3.77 70 BAYES_999 12147 11.29 26.69 3.72 71 RCVD_IN_IADB_LISTED 12145 2.92 1.28 3.72 72 XM_B_Phish_Phrases 11458 3.85 4.52 3.51 73 T_REMOTE_IMAGE 11313 2.92 1.80 3.47 74 RCVD_IN_IADB_SPF 10574 2.54 1.13 3.24 75 XM_Body_Dirty_Words 10334 4.78 8.07 3.17 76 TR_XM_DKIM_Undo 10029 12.42 31.42 3.07 77 BAYES_20 10012 2.46 1.23 3.07 78 XM_SPF_SoftFail 9999 3.72 5.06 3.07 79 RCVD_IN_IADB_SENDERID 9485 2.30 1.06 2.91 80 XMNumbers 9281 2.94 3.12 2.85 81 RCVD_IN_IADB_DK 9184 2.24 1.06 2.82 82 T_TooManySym_02 9106 2.07 0.60 2.79 83 XM_B_SpammyTLD 9087 2.89 3.11 2.79 84 HTML_IMAGE_RATIO_06 8981 3.25 4.25 2.75 85 BAYES_95 8449 3.36 4.93 2.59 86 TR_XM_SpammyRelay 8380 5.07 10.16 2.57 87 RCVD_IN_IADB_VOUCHED 8217 1.90 0.63 2.52 88 TooManyTo_002 8072 2.03 1.14 2.47 89 MAILING_LIST_MULTI 8033 2.24 1.79 2.46 90 MIME_HTML_MOSTLY 7586 2.83 3.85 2.33 91 INVALID_MSGID 7256 1.55 0.19 2.22 92 DKIM_INVALID 7108 3.11 5.00 2.18 93 TO_MALFORMED 6975 1.44 0.02 2.14 94 HTML_IMAGE_RATIO_08 6890 2.60 3.59 2.11 95 XM_DK_Undo_01 6848 2.05 1.96 2.10 96 MIME_HTML_ONLY_MULTI 6844 2.52 3.38 2.10 97 TR_DCC_Bayes_99 6449 9.56 24.99 1.98 98 XMSexyCombo_05 6448 2.74 4.28 1.98 99 XM_CamelCaseFrm001 6377 2.24 2.83 1.95 100 HTML_MIME_NO_HTML_TAG 6343 1.83 1.59 1.94 101 FROM_EXCESS_BASE64 5951 1.82 1.82 1.82 102 XM_B_SEO 5936 2.89 5.06 1.82 103 T_XMDrugObfuBody_14 5883 2.51 3.95 1.80 104 BAYES_05 5830 1.43 0.71 1.79 105 TR_XM_PhishingBody 5706 2.59 4.31 1.75 106 RCVD_IN_IADB_OPTIN 5604 1.28 0.39 1.72 107 TM2_M_URI_OPT_OUT 5580 1.94 2.41 1.71 108 XMDiploma_00 5571 2.08 2.84 1.71 109 XM_B_Investor 5547 2.80 5.04 1.70 110 BOTNET 5469 3.96 8.61 1.68 111 XM_B_Unsub2 5409 2.00 2.68 1.66 112 SUBJ_ALL_CAPS 5306 1.82 2.22 1.63 113 HELO_NODOT 5282 1.18 0.27 1.62 114 HELO_NO_DOMAIN 5276 1.17 0.27 1.62 115 XMStockSpam_06 5195 1.63 1.70 1.59 116 TR_XM_SpammyWords5 5183 2.29 3.70 1.59 117 TR_XM_UnparsRelay 5160 3.43 7.18 1.58 118 IN_HORDE_ADDRESS_BOOK 5122 1.08 0.09 1.57 119 XM_ProductURIs 5121 1.36 0.93 1.57 120 TVD_RCVD_IP 5110 1.37 0.97 1.57 121 T_XMDrugObfuBody_08 5090 2.25 3.66 1.56 122 TR_Symld_Words 4859 1.29 0.88 1.49 123 UNTRUSTED_Relay 4855 2.90 5.78 1.49 124 KHOP_HELO_FCRDNS 4699 1.61 1.96 1.44 125 TooManyTo_003 4623 1.29 1.04 1.42 126 XM_SendGrid 4381 1.25 1.05 1.34 127 TM2_M_VERY_LONG_WORD 4379 2.13 3.72 1.34 128 XMBSHREFv2 4275 0.99 0.34 1.31 129 TR_XM_SEO4 4150 2.34 4.53 1.27 130 RELAYCOUNTRY_CA 4127 2.37 4.63 1.27 131 URI_NOVOWEL 4099 1.22 1.15 1.26 132 XM_B_SpammyWords4 4063 1.49 2.00 1.25 133 TVD_SPACE_RATIO 3887 0.84 0.14 1.19 134 URI_HEX 3813 1.18 1.22 1.17 135 XM_GoogleGroups 3705 0.99 0.69 1.14 136 XMGappySubj_01 3621 0.80 0.16 1.11 137 XMBrknScrpt_02 3520 1.40 2.05 1.08 138 TR_LOTS_OF_MONEY3 3507 2.60 5.71 1.08 139 TooManyTo_004 3378 1.02 0.99 1.04 140 XM_H_Long_From02 3325 0.97 0.88 1.02 141 T_TooManySym_03 3259 0.74 0.22 1.00 142 XM_OfRef6 3184 2.06 4.25 0.98 143 XMCapTrack 3179 0.80 0.44 0.97 144 FROM_GOV_DKIM_AU 3140 0.71 0.20 0.96 145 RELAYCOUNTRY_AU 3092 1.37 2.22 0.95 146 T_FILL_THIS_FORM_SHORT 3074 1.23 1.82 0.94 147 TR_XM_DK_SendGrid 2929 0.83 0.69 0.90 148 XMGenDplmaNmb 2858 1.12 1.60 0.88 149 XMSubMetaSxObfu_03 2833 0.80 0.66 0.87 150 XM_UB50 2817 1.57 3.01 0.86 151 TooManyTo_005 2813 0.89 0.95 0.86 152 XMBody_95 2774 0.63 0.18 0.85 153 XMBdyGiftCard01 2612 0.99 1.37 0.80 154 XMSubMetaSxObfu_02 2600 0.62 0.27 0.80 155 DKIM_ADSP_CUSTOM_MED 2589 0.82 0.87 0.79 156 URI_TRY_3LD 2552 1.16 1.92 0.78 157 HTTPS_HTTP_MISMATCH 2538 0.92 1.22 0.78 158 T_XMHurry_00 2503 1.31 2.41 0.77 159 T_XMDrugObfuBody_00 2499 1.00 1.47 0.77 160 SpammyFromTLD_01 2473 1.00 1.50 0.76 161 XMPhish30 2469 0.95 1.34 0.76 162 XMBody_17 2458 2.63 6.44 0.75 163 TR_XM_Base64_M1 2355 0.85 1.10 0.72 164 RCVD_IN_BL_SPAMCOP_NET 2213 3.08 7.95 0.68 165 XMGappySubj_02 2211 0.47 0.06 0.68 166 XMSubMetaI_00 2153 0.77 0.98 0.66 167 XMSubMetaSx_01 2145 0.54 0.31 0.66 168 XM_ShortIntro_01 2133 0.72 0.84 0.65 169 TR_XM_SpammyWords2 2115 4.54 12.46 0.65 170 XMNoVowels 2075 0.56 0.42 0.64 171 XMLngstWrd_00 2064 0.68 0.76 0.63 172 XM_B_FormFill 2024 0.45 0.10 0.62 173 USER_IN_WELCOMELIST 2018 0.41 0.00 0.62 174 USER_IN_WHITELIST 2018 0.41 0.00 0.62 175 T_OBFU_PDF_ATTACH 2013 0.45 0.11 0.62 176 XM_B_COPY_HTML 1985 0.78 1.12 0.61 177 TR_MetaPhish_Combo_01 1959 0.69 0.87 0.60 178 THIS_AD 1881 0.80 1.25 0.58 179 MPART_ALT_DIFF_COUNT 1854 0.76 1.14 0.57 180 HTML_TAG_BALANCE_BODY 1842 0.85 1.42 0.56 181 XM_H_PHPMailer 1832 0.58 0.62 0.56 182 XM_B_DNDMA 1690 0.70 1.06 0.52 183 XMLngstWrd_01 1668 0.56 0.66 0.51 184 NML_ADSP_CUSTOM_MED 1651 0.58 0.72 0.51 185 T_Symld_Words_02 1635 0.84 1.52 0.50 186 FILL_THIS_FORM 1635 0.40 0.19 0.50 187 HTML_IMAGE_ONLY_28 1585 0.43 0.32 0.49 188 SHORT_HELO_AND_INLINE_IMAGE 1581 0.34 0.06 0.48 189 PLING_QUERY 1526 0.57 0.77 0.47 190 HTML_FONT_FACE_BAD 1503 0.53 0.66 0.46 191 XMOemUri 1493 0.39 0.25 0.46 192 FORGED_GMAIL_RCVD 1489 0.51 0.62 0.46 193 RELAYCOUNTRY_GB 1458 0.50 0.61 0.45 194 RCVD_IN_PSBL 1449 0.62 0.98 0.44 195 T_TVD_MIME_NO_HEADERS 1432 0.34 0.15 0.44 196 XM_B_COVIDMETA 1424 0.50 0.64 0.44 197 HTML_IMAGE_ONLY_32 1423 0.34 0.16 0.44 198 TR_XM_SPAMCOP 1402 2.37 6.32 0.43 199 XMPhish14 1365 0.68 1.22 0.42 200 MISSING_HEADERS 1361 0.43 0.46 0.42 ----------------------------------------------------------------------