Email: 528389 Autolearn: 0 AvgScore: 4.43 AvgScanTime: 1.15 sec Spam: 176488 Autolearn: 0 AvgScore: 13.22 AvgScanTime: 1.27 sec Ham: 351901 Autolearn: 0 AvgScore: 0.02 AvgScanTime: 1.08 sec Time Spent Running SA: 168.14 hours Time Spent Processing Spam: 62.34 hours Time Spent Processing Ham: 105.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170525 90.91 96.62 88.04 2 DKIM_SIGNED 159630 82.37 90.45 78.32 3 XM_DK_Pass 154432 80.54 87.50 77.04 4 RELAYCOUNTRY_US 152999 84.74 86.69 83.76 5 DKIM_VALID 152622 79.51 86.48 76.01 6 XM_B_Unicode 150921 76.70 85.51 72.28 7 DCC_CHECK 133458 52.03 75.62 40.20 8 XMListUnsubscribeExists 128133 60.19 72.60 53.96 9 XM_B_SpammyWords 127378 54.84 72.17 46.14 10 DKIM_VALID_AU 121722 64.19 68.97 61.80 11 XM_B_Unicode3 80597 42.45 45.67 40.84 12 XM_DK_Undo_02 75589 18.62 42.83 6.49 13 LOC_TINY_FONT_1 75173 32.12 42.59 26.87 14 XM_B_SpammyWords2 72040 26.57 40.82 19.43 15 HTML_FONT_LOW_CONTRAST 71931 33.86 40.76 30.41 16 RCVD_IN_MSPIKE_H2 71238 35.13 40.36 32.50 17 BAYES_50 70871 53.36 40.16 59.99 18 FVGT_m_MULTI_ODD 65505 30.45 37.12 27.11 19 BAYES_99 57936 13.87 32.83 4.36 20 TR_XM_DKIM_Undo 55651 12.45 31.53 2.88 21 T_KAM_HTML_FONT_INVALID 51202 24.52 29.01 22.26 22 DKIM_VALID_EF 49039 29.39 27.79 30.20 23 BAYES_999 45214 10.79 25.62 3.35 24 T_TM2_M_HEADER_IN_MSG 43917 27.53 24.88 28.86 25 MIME_HTML_ONLY 43126 20.90 24.44 19.13 26 DCC_CHECK_NEGATIVE 42992 47.92 24.36 59.74 27 TR_DCC_Bayes_99 42600 9.20 24.14 1.71 28 XMSubLong 39172 23.52 22.20 24.19 29 XM_Multi_Part_URI 36907 16.39 20.91 14.12 30 TR_XM_DK_Unsub 35034 16.67 19.85 15.08 31 LOTS_OF_MONEY 29036 10.36 16.45 7.30 32 XM_B_Unsub 27766 10.61 15.73 8.05 33 UNPARSEABLE_RELAY 26752 12.59 15.16 11.30 34 BOTNET_IPINHOSTNAME 26552 7.96 15.04 4.41 35 TR_XM_SpammyWords4 26551 8.37 15.04 5.02 36 TR_XM_BayesUnsub 26451 9.38 14.99 6.57 37 TR_MAX_INTL_RELAY 26335 9.57 14.92 6.89 38 XM_B_SpammyWords3 24541 8.11 13.91 5.21 39 RELAYCOUNTRY_META 24478 7.44 13.87 4.21 40 TR_XM_SpammyWords2 21815 4.54 12.36 0.62 41 TR_XM_SpammyRelay 18181 5.02 10.30 2.37 42 BOTNET 17320 4.34 9.81 1.59 43 FSL_BULK_SIG 16962 6.80 9.61 5.39 44 RCVD_IN_BL_SPAMCOP_NET 16684 3.85 9.45 1.03 45 BAYES_80 16168 5.88 9.16 4.23 46 XM_Evil_Numbers_Gen 15145 8.03 8.58 7.75 47 BAYES_60 14366 8.94 8.14 9.34 48 TR_XM_SPAMCOP 13693 3.01 7.76 0.62 49 TR_XM_UnparsRelay 13252 3.60 7.51 1.64 50 XM_Body_Dirty_Words 12649 4.65 7.17 3.39 51 LotsOfNums_01 12475 8.29 7.07 8.91 52 XM_SPF_SoftFail 11362 4.43 6.44 3.42 53 XM_B_PhoneNumber 11008 8.94 6.24 10.30 54 HTML_IMAGE_RATIO_02 10972 5.72 6.22 5.48 55 UNTRUSTED_Relay 10394 3.00 5.89 1.55 56 XMSubMetaSx_00 10056 4.43 5.70 3.79 57 XMBody_17 9712 2.37 5.50 0.80 58 TR_LOTS_OF_MONEY3 9347 2.35 5.30 0.87 59 BAYES_95 9217 3.51 5.22 2.65 60 XM_UncommonTLD01 8993 4.29 5.10 3.89 61 TR_XM_PhishingBody 8947 2.81 5.07 1.68 62 MPART_ALT_DIFF 8925 4.11 5.06 3.63 63 XM_B_SEO 8829 2.45 5.00 1.17 64 XM_B_Phish_Phrases 8798 3.74 4.99 3.11 65 XM_H_Long_From01 8632 5.40 4.89 5.65 66 TooManyTo_001 8315 7.16 4.71 8.39 67 HTML_IMAGE_RATIO_04 8276 4.41 4.69 4.27 68 HTML_IMAGE_RATIO_06 8067 3.83 4.57 3.46 69 XM_B_Investor 7991 2.69 4.53 1.77 70 TR_XM_SEO4 7987 1.95 4.53 0.66 71 RELAYCOUNTRY_CA 7907 2.33 4.48 1.26 72 XM_H_GMP 7893 5.63 4.47 6.22 73 XM_B_SpammyTLD 7832 3.18 4.44 2.55 74 XMStrtUSub 7467 4.52 4.23 4.66 75 XMNumbers 7202 2.97 4.08 2.41 76 TR_XM_SpammyWords5 7112 2.12 4.03 1.16 77 T_XMDrugObfuBody_14 7111 2.51 4.03 1.75 78 DKIM_INVALID 7008 2.86 3.97 2.31 79 XM_OfRef6 6589 1.91 3.73 1.00 80 XMSexyCombo_05 6478 2.74 3.67 2.27 81 MIME_QP_LONG_LINE 6297 4.72 3.57 5.29 82 T_XMDrugObfuBody_08 6185 2.28 3.50 1.66 83 RCVD_IN_VALIDITY_RPBL 6156 1.26 3.49 0.15 84 TM2_M_URI_OPT_OUT 6140 2.32 3.48 1.73 85 HTML_IMAGE_RATIO_08 6114 2.76 3.46 2.40 86 TM2_M_VERY_LONG_WORD 5664 1.92 3.21 1.28 87 MIME_HTML_MOSTLY 5635 2.62 3.19 2.33 88 XM_UB50 5491 1.68 3.11 0.96 89 MIME_HTML_ONLY_MULTI 5380 2.44 3.05 2.13 90 XM_URI_RBL 5274 1.09 2.99 0.14 91 XM_CamelCaseFrm001 5025 2.60 2.85 2.48 92 T_FILL_THIS_FORM_SHORT 4896 1.51 2.77 0.88 93 RCVD_IN_VALIDITY_SAFE 4836 4.32 2.74 5.11 94 RCVD_IN_MSPIKE_WL 4795 5.09 2.72 6.27 95 RCVD_IN_MSPIKE_H3 4795 5.09 2.72 6.27 96 USER_IN_DEF_DKIM_WL 4642 10.42 2.63 14.33 97 T_TooManySym_01 4555 4.53 2.58 5.50 98 T_XMHurry_00 4472 1.29 2.53 0.67 99 XMDiploma_00 4162 2.11 2.36 1.99 100 SUBJ_ALL_CAPS 4158 1.67 2.36 1.33 101 RELAYCOUNTRY_AU 4014 1.34 2.27 0.87 102 XM_B_SpammyWords4 3888 1.21 2.20 0.71 103 RCVD_IN_VALIDITY_CERTIFIED 3841 3.52 2.18 4.19 104 URI_TRY_3LD 3817 1.35 2.16 0.94 105 HTML_TAG_BALANCE_BODY 3802 1.10 2.15 0.57 106 XM_B_Unsub2 3668 1.57 2.08 1.31 107 TR_XM_NoHeaderRelay 3578 0.80 2.03 0.19 108 ANY_BOUNCE_MESSAGE 3563 2.75 2.02 3.11 109 BOUNCE_MESSAGE 3560 2.75 2.02 3.11 110 XMStockSpam_06 3538 1.57 2.00 1.35 111 SpammyFromTLD_01 3450 1.25 1.95 0.90 112 BAYES_40 3279 3.66 1.86 4.56 113 FROM_EXCESS_BASE64 3213 1.75 1.82 1.71 114 XM_H_Long_From02 3181 1.34 1.80 1.10 115 MAILING_LIST_MULTI 3148 2.49 1.78 2.85 116 XMBrknScrpt_02 3032 1.18 1.72 0.91 117 AC_BR_BONANZA 2959 0.64 1.68 0.12 118 XM_DK_Undo_01 2935 1.85 1.66 1.94 119 XM_HighProb1 2911 0.55 1.65 0.00 120 TR_Symld_Words 2865 1.60 1.62 1.59 121 LONGLN_LOW_CONTRAST 2841 0.73 1.61 0.29 122 T_STY_INVIS_DIRECT 2837 0.71 1.61 0.27 123 T_REMOTE_IMAGE 2790 3.26 1.58 4.11 124 XMReplyNow 2715 0.71 1.54 0.30 125 XMPhish30 2703 0.87 1.53 0.54 126 HTML_MIME_NO_HTML_TAG 2687 1.97 1.52 2.19 127 SpammyFromTLD_02 2619 0.78 1.48 0.43 128 T_XMDrugObfuBody_00 2540 0.98 1.44 0.76 129 XM_SendGrid 2449 1.35 1.39 1.34 130 BAYES_20 2438 2.68 1.38 3.33 131 RCVD_IN_IADB_LISTED 2436 3.15 1.38 4.04 132 ALL_TRUSTED 2395 8.96 1.36 12.77 133 URI_HEX 2381 1.22 1.35 1.16 134 TR_XM_InvalidRelay 2377 0.47 1.35 0.02 135 TR_XM_INV_DKIM 2277 0.48 1.29 0.07 136 RCVD_IN_PSBL 2268 0.67 1.29 0.36 137 HOSTED_IMG_MULTI_PUB_01 2228 0.44 1.26 0.03 138 KHOP_HELO_FCRDNS 2206 1.22 1.25 1.20 139 XM_B_DNDMA 2182 0.68 1.24 0.40 140 URI_NOVOWEL 2152 1.32 1.22 1.37 141 XMGenDplmaNmb 2138 1.12 1.21 1.07 142 XM_B_SpammyTLD2 2117 0.43 1.20 0.04 143 DKIM_ADSP_NXDOMAIN 2098 0.60 1.19 0.31 144 TR_XM_FormFill 2088 0.40 1.18 0.01 145 TR_XM_PHPDW 2086 0.62 1.18 0.34 146 HTML_FONT_TINY_NORDNS 2083 0.46 1.18 0.10 147 TR_XM_PHPForged 2069 0.61 1.17 0.33 148 XM_B_Phish66 2042 0.57 1.16 0.28 149 RCVD_IN_IADB_SPF 2032 2.74 1.15 3.54 150 XMHTML_After_End 2014 0.60 1.14 0.34 151 XM_B_COPY_HTML 2000 0.81 1.13 0.64 152 TR_XM_FormFill2 1988 0.60 1.13 0.34 153 XM_H_PHPOS 1979 0.59 1.12 0.33 154 TR_LOTS_OF_MONEY2 1950 0.55 1.10 0.27 155 T_MONEY_PERCENT 1950 0.55 1.10 0.27 156 XM_DIRTYINTL 1918 0.46 1.09 0.15 157 MPART_ALT_DIFF_COUNT 1897 0.98 1.07 0.93 158 RCVD_IN_IADB_DK 1882 2.38 1.07 3.05 159 RCVD_IN_IADB_SENDERID 1879 2.44 1.06 3.14 160 HTTPS_HTTP_MISMATCH 1830 0.89 1.04 0.81 161 XMSexyCombo_01 1811 0.49 1.03 0.23 162 XMPhish14 1799 0.69 1.02 0.52 163 PLING_QUERY 1767 0.60 1.00 0.39 164 XM_PDF 1754 3.28 0.99 4.42 165 XMBdyGiftCard01 1731 0.78 0.98 0.68 166 XM_ProductURIs 1708 0.61 0.97 0.42 167 TR_XM_Base64_M1 1689 0.69 0.96 0.56 168 DKIM_ADSP_CUSTOM_MED 1672 0.87 0.95 0.83 169 RELAYCOUNTRY_FR 1670 0.47 0.95 0.23 170 TR_Mismatch_TLD_02 1625 0.35 0.92 0.06 171 BOTNET_NORDNS 1623 0.31 0.92 0.01 172 TVD_RCVD_IP 1498 1.30 0.85 1.53 173 TR_XM_RelayPhish 1467 0.31 0.83 0.05 174 NML_ADSP_CUSTOM_MED 1442 0.64 0.82 0.55 175 XMMoneyMeta_00 1433 0.78 0.81 0.76 176 XM_UB99 1433 0.27 0.81 0.00 177 XMLngstWrd_00 1416 0.66 0.80 0.59 178 XMSubMetaI_00 1411 0.67 0.80 0.61 179 TR_XM_DK_SendGrid 1385 0.82 0.78 0.84 180 RCVD_IN_IADB_VOUCHED 1379 2.07 0.78 2.72 181 TR_Mismatch_TLD_01 1373 0.42 0.78 0.25 182 AC_HTML_NONSENSE_TAGS 1372 0.28 0.78 0.04 183 TR_MetaPhish_Combo_01 1368 0.90 0.78 0.97 184 FORGED_GMAIL_RCVD 1347 0.60 0.76 0.52 185 XMBody_78 1332 0.43 0.75 0.27 186 FROM_SUSPICIOUS_NTLD 1322 0.27 0.75 0.03 187 XM_H_Undi_Recip 1306 0.34 0.74 0.14 188 T_Symld_Words_02 1303 0.66 0.74 0.62 189 T_HTML_ATTACH 1303 0.29 0.74 0.07 190 RDNS_DYNAMIC 1302 0.45 0.74 0.30 191 LongTLD 1285 0.52 0.73 0.41 192 TR_Caps_n_Bayes_99 1281 0.26 0.73 0.02 193 PDS_RDNS_DYNAMIC_FP 1280 0.34 0.73 0.14 194 XM_S_SpammyWords 1275 0.46 0.72 0.34 195 TR_XM_Spammywords 1275 0.46 0.72 0.33 196 URIBL_BLACK 1272 0.28 0.72 0.06 197 XMHTMLBadTable_001 1265 0.41 0.72 0.26 198 REMOVE_BEFORE_LINK 1251 0.36 0.71 0.18 199 HTML_FONT_FACE_BAD 1247 0.54 0.71 0.45 200 RELAYCOUNTRY_GB 1244 0.58 0.70 0.52 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 309812 90.91 96.62 88.04 2 RELAYCOUNTRY_US 294740 84.74 86.69 83.76 3 DKIM_SIGNED 275614 82.37 90.45 78.32 4 XM_DK_Pass 271116 80.54 87.50 77.04 5 DKIM_VALID 267492 79.51 86.48 76.01 6 XM_B_Unicode 254366 76.70 85.51 72.28 7 DKIM_VALID_AU 217471 64.19 68.97 61.80 8 BAYES_50 211103 53.36 40.16 59.99 9 DCC_CHECK_NEGATIVE 210236 47.92 24.36 59.74 10 XMListUnsubscribeExists 189903 60.19 72.60 53.96 11 XM_B_SpammyWords 162373 54.84 72.17 46.14 12 XM_B_Unicode3 143718 42.45 45.67 40.84 13 DCC_CHECK 141465 52.03 75.62 40.20 14 RCVD_IN_MSPIKE_H2 114384 35.13 40.36 32.50 15 HTML_FONT_LOW_CONTRAST 107000 33.86 40.76 30.41 16 DKIM_VALID_EF 106263 29.39 27.79 30.20 17 T_TM2_M_HEADER_IN_MSG 101543 27.53 24.88 28.86 18 FVGT_m_MULTI_ODD 95392 30.45 37.12 27.11 19 LOC_TINY_FONT_1 94539 32.12 42.59 26.87 20 XMSubLong 85125 23.52 22.20 24.19 21 T_KAM_HTML_FONT_INVALID 78337 24.52 29.01 22.26 22 XM_B_SpammyWords2 68371 26.57 40.82 19.43 23 MIME_HTML_ONLY 67316 20.90 24.44 19.13 24 TR_XM_DK_Unsub 53072 16.67 19.85 15.08 25 USER_IN_DEF_DKIM_WL 50433 10.42 2.63 14.33 26 XM_Multi_Part_URI 49679 16.39 20.91 14.12 27 ALL_TRUSTED 44925 8.96 1.36 12.77 28 UNPARSEABLE_RELAY 39748 12.59 15.16 11.30 29 XM_B_PhoneNumber 36246 8.94 6.24 10.30 30 BAYES_00 33327 6.50 0.59 9.47 31 BAYES_60 32877 8.94 8.14 9.34 32 LotsOfNums_01 31350 8.29 7.07 8.91 33 TooManyTo_001 29531 7.16 4.71 8.39 34 XM_B_Unsub 28316 10.61 15.73 8.05 35 XM_Evil_Numbers_Gen 27285 8.03 8.58 7.75 36 XM_DKIMWhitelistDomains 26837 5.08 0.01 7.63 37 LOTS_OF_MONEY 25685 10.36 16.45 7.30 38 IN_ZIMBRA_NJ_WHITELIST 24946 4.75 0.09 7.09 39 TR_MAX_INTL_RELAY 24233 9.57 14.92 6.89 40 TR_XM_DK_Bayes 23997 4.70 0.47 6.82 41 TR_XM_DK_Bayes1 23550 4.61 0.46 6.69 42 TR_XM_BayesUnsub 23110 9.38 14.99 6.57 43 XM_DK_Undo_02 22821 18.62 42.83 6.49 44 RCVD_IN_MSPIKE_WL 22079 5.09 2.72 6.27 45 RCVD_IN_MSPIKE_H3 22079 5.09 2.72 6.27 46 XM_H_GMP 21874 5.63 4.47 6.22 47 TR_XM_DK_Bayes2 20721 4.05 0.37 5.89 48 XM_H_Long_From01 19880 5.40 4.89 5.65 49 T_TooManySym_01 19357 4.53 2.58 5.50 50 HTML_IMAGE_RATIO_02 19277 5.72 6.22 5.48 51 FSL_BULK_SIG 18952 6.80 9.61 5.39 52 MIME_QP_LONG_LINE 18629 4.72 3.57 5.29 53 XM_B_SpammyWords3 18326 8.11 13.91 5.21 54 RCVD_IN_VALIDITY_SAFE 17968 4.32 2.74 5.11 55 TR_XM_SpammyWords4 17672 8.37 15.04 5.02 56 XMStrtUSub 16393 4.52 4.23 4.66 57 BAYES_40 16049 3.66 1.86 4.56 58 XM_PDF 15551 3.28 0.99 4.42 59 BOTNET_IPINHOSTNAME 15512 7.96 15.04 4.41 60 BAYES_99 15343 13.87 32.83 4.36 61 HTML_IMAGE_RATIO_04 15038 4.41 4.69 4.27 62 BAYES_80 14893 5.88 9.16 4.23 63 RELAYCOUNTRY_META 14825 7.44 13.87 4.21 64 RCVD_IN_VALIDITY_CERTIFIED 14755 3.52 2.18 4.19 65 T_REMOTE_IMAGE 14453 3.26 1.58 4.11 66 RCVD_IN_IADB_LISTED 14213 3.15 1.38 4.04 67 XM_UncommonTLD01 13695 4.29 5.10 3.89 68 XMSubMetaSx_00 13341 4.43 5.70 3.79 69 MPART_ALT_DIFF 12789 4.11 5.06 3.63 70 RCVD_IN_IADB_SPF 12444 2.74 1.15 3.54 71 HTML_IMAGE_RATIO_06 12161 3.83 4.57 3.46 72 XM_SPF_SoftFail 12050 4.43 6.44 3.42 73 XM_Body_Dirty_Words 11921 4.65 7.17 3.39 74 BAYES_999 11774 10.79 25.62 3.35 75 BAYES_20 11721 2.68 1.38 3.33 76 RCVD_IN_IADB_SENDERID 11038 2.44 1.06 3.14 77 ANY_BOUNCE_MESSAGE 10961 2.75 2.02 3.11 78 XM_B_Phish_Phrases 10952 3.74 4.99 3.11 79 BOUNCE_MESSAGE 10945 2.75 2.02 3.11 80 RCVD_IN_IADB_DK 10719 2.38 1.07 3.05 81 TR_XM_DKIM_Undo 10142 12.45 31.53 2.88 82 MAILING_LIST_MULTI 10032 2.49 1.78 2.85 83 T_TooManySym_02 9619 2.05 0.67 2.73 84 RCVD_IN_IADB_VOUCHED 9577 2.07 0.78 2.72 85 TooManyTo_002 9358 1.99 0.65 2.66 86 BAYES_95 9331 3.51 5.22 2.65 87 XM_B_SpammyTLD 8960 3.18 4.44 2.55 88 XM_CamelCaseFrm001 8715 2.60 2.85 2.48 89 XMNumbers 8486 2.97 4.08 2.41 90 HTML_IMAGE_RATIO_08 8455 2.76 3.46 2.40 91 TR_XM_SpammyRelay 8332 5.02 10.30 2.37 92 MIME_HTML_MOSTLY 8213 2.62 3.19 2.33 93 DKIM_INVALID 8122 2.86 3.97 2.31 94 XMSexyCombo_05 7998 2.74 3.67 2.27 95 HTML_MIME_NO_HTML_TAG 7700 1.97 1.52 2.19 96 MIME_HTML_ONLY_MULTI 7491 2.44 3.05 2.13 97 INVALID_MSGID 7398 1.45 0.14 2.10 98 BAYES_05 7257 1.60 0.67 2.06 99 XMDiploma_00 7008 2.11 2.36 1.99 100 XM_DK_Undo_01 6819 1.85 1.66 1.94 101 RCVD_IN_IADB_OPTIN 6817 1.44 0.45 1.94 102 HELO_NODOT 6410 1.33 0.35 1.82 103 HELO_NO_DOMAIN 6400 1.32 0.34 1.82 104 TO_MALFORMED 6253 1.20 0.04 1.78 105 XM_B_Investor 6216 2.69 4.53 1.77 106 T_XMDrugObfuBody_14 6166 2.51 4.03 1.75 107 TM2_M_URI_OPT_OUT 6098 2.32 3.48 1.73 108 TR_DCC_Bayes_99 6016 9.20 24.14 1.71 109 FROM_EXCESS_BASE64 6016 1.75 1.82 1.71 110 TR_XM_PhishingBody 5910 2.81 5.07 1.68 111 T_XMDrugObfuBody_08 5853 2.28 3.50 1.66 112 TR_XM_UnparsRelay 5786 3.60 7.51 1.64 113 TR_Symld_Words 5610 1.60 1.62 1.59 114 BOTNET 5596 4.34 9.81 1.59 115 UNTRUSTED_Relay 5441 3.00 5.89 1.55 116 TVD_RCVD_IP 5397 1.30 0.85 1.53 117 IN_HORDE_ADDRESS_BOOK 4894 0.95 0.08 1.39 118 XMGappySubj_01 4841 0.96 0.14 1.38 119 TooManyTo_003 4821 1.10 0.55 1.37 120 URI_NOVOWEL 4808 1.32 1.22 1.37 121 XMStockSpam_06 4745 1.57 2.00 1.35 122 XM_SendGrid 4708 1.35 1.39 1.34 123 SUBJ_ALL_CAPS 4683 1.67 2.36 1.33 124 XM_B_Unsub2 4614 1.57 2.08 1.31 125 TM2_M_VERY_LONG_WORD 4499 1.92 3.21 1.28 126 RELAYCOUNTRY_CA 4424 2.33 4.48 1.26 127 KHOP_HELO_FCRDNS 4231 1.22 1.25 1.20 128 XM_B_SEO 4132 2.45 5.00 1.17 129 XM_GoogleGroups 4114 1.00 0.67 1.17 130 URI_HEX 4088 1.22 1.35 1.16 131 TR_XM_SpammyWords5 4070 2.12 4.03 1.16 132 XM_H_Long_From02 3882 1.34 1.80 1.10 133 FROM_GOV_DKIM_AU 3875 0.82 0.25 1.10 134 XMBSHREFv2 3806 0.82 0.31 1.08 135 TVD_SPACE_RATIO 3798 0.75 0.09 1.08 136 XMGenDplmaNmb 3775 1.12 1.21 1.07 137 TooManyTo_004 3638 0.85 0.49 1.03 138 RCVD_IN_BL_SPAMCOP_NET 3637 3.85 9.45 1.03 139 XM_OfRef6 3522 1.91 3.73 1.00 140 XMCapTrack 3517 0.81 0.43 1.00 141 TR_MetaPhish_Combo_01 3410 0.90 0.78 0.97 142 T_TooManySym_03 3387 0.73 0.26 0.96 143 XM_UB50 3364 1.68 3.11 0.96 144 URI_TRY_3LD 3298 1.35 2.16 0.94 145 MPART_ALT_DIFF_COUNT 3278 0.98 1.07 0.93 146 XMBrknScrpt_02 3217 1.18 1.72 0.91 147 SpammyFromTLD_01 3181 1.25 1.95 0.90 148 T_FILL_THIS_FORM_SHORT 3097 1.51 2.77 0.88 149 TR_LOTS_OF_MONEY3 3068 2.35 5.30 0.87 150 RELAYCOUNTRY_AU 3056 1.34 2.27 0.87 151 TooManyTo_005 3002 0.72 0.47 0.85 152 XMBody_95 3001 0.63 0.18 0.85 153 TR_XM_DK_SendGrid 2952 0.82 0.78 0.84 154 DKIM_ADSP_CUSTOM_MED 2929 0.87 0.95 0.83 155 HTTPS_HTTP_MISMATCH 2857 0.89 1.04 0.81 156 XMBody_17 2807 2.37 5.50 0.80 157 XMMoneyMeta_00 2692 0.78 0.81 0.76 158 T_XMDrugObfuBody_00 2662 0.98 1.44 0.76 159 XMGappySubj_02 2516 0.50 0.07 0.71 160 XM_B_SpammyWords4 2512 1.21 2.20 0.71 161 XM_ShortIntro_01 2472 0.66 0.59 0.70 162 XM_B_FormFill 2466 0.49 0.06 0.70 163 XMBdyGiftCard01 2376 0.78 0.98 0.68 164 T_XMHurry_00 2349 1.29 2.53 0.67 165 TR_XM_SEO4 2329 1.95 4.53 0.66 166 XM_B_COPY_HTML 2258 0.81 1.13 0.64 167 XMNoVowels 2256 0.64 0.63 0.64 168 TR_XM_SPAMCOP 2193 3.01 7.76 0.62 169 T_Symld_Words_02 2191 0.66 0.74 0.62 170 TR_XM_SpammyWords2 2189 4.54 12.36 0.62 171 T_OBFU_PDF_ATTACH 2149 0.51 0.30 0.61 172 XMSubMetaI_00 2144 0.67 0.80 0.61 173 XMLngstWrd_00 2061 0.66 0.80 0.59 174 USER_IN_WHITELIST 2010 0.38 0.00 0.57 175 USER_IN_WELCOMELIST 2010 0.38 0.00 0.57 176 HTML_TAG_BALANCE_BODY 2006 1.10 2.15 0.57 177 TR_XM_Base64_M1 1963 0.69 0.96 0.56 178 NML_ADSP_CUSTOM_MED 1945 0.64 0.82 0.55 179 XM_H_PHPMailer 1943 0.56 0.57 0.55 180 SHORT_HELO_AND_INLINE_IMAGE 1935 0.38 0.05 0.55 181 XMPhish30 1913 0.87 1.53 0.54 182 XMPhish14 1832 0.69 1.02 0.52 183 FORGED_GMAIL_RCVD 1821 0.60 0.76 0.52 184 XMSubMetaSxObfu_02 1819 0.46 0.35 0.52 185 RELAYCOUNTRY_GB 1819 0.58 0.70 0.52 186 TO_NO_BRKTS_HTML_ONLY 1780 0.41 0.22 0.51 187 XMhairloss01 1698 0.36 0.11 0.48 188 HTML_IMAGE_ONLY_28 1630 0.46 0.46 0.46 189 HTML_IMAGE_ONLY_32 1616 0.40 0.28 0.46 190 T_MANY_PILL_PRICE 1589 0.31 0.01 0.45 191 TM2_M_BODY_EMPTY 1588 0.40 0.29 0.45 192 HTML_FONT_FACE_BAD 1586 0.54 0.71 0.45 193 SpammyFromTLD_02 1521 0.78 1.48 0.43 194 THIS_AD 1519 0.51 0.68 0.43 195 HTML_IMAGE_ONLY_20 1510 0.44 0.47 0.43 196 XM_ProductURIs 1494 0.61 0.97 0.42 197 XMSlimDrugH 1493 0.49 0.62 0.42 198 XMOemUri 1478 0.36 0.24 0.42 199 MSGID_FROM_MTA_HEADER 1459 0.30 0.07 0.41 200 LongTLD 1456 0.52 0.73 0.41 ----------------------------------------------------------------------