Email: 534189 Autolearn: 0 AvgScore: 4.67 AvgScanTime: 1.20 sec Spam: 188358 Autolearn: 0 AvgScore: 13.13 AvgScanTime: 1.35 sec Ham: 345831 Autolearn: 0 AvgScore: 0.06 AvgScanTime: 1.12 sec Time Spent Running SA: 177.82 hours Time Spent Processing Spam: 70.46 hours Time Spent Processing Ham: 107.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 183456 90.10 97.40 86.12 2 DKIM_SIGNED 174659 81.42 92.73 75.26 3 XM_DK_Pass 168009 79.39 89.20 74.06 4 DKIM_VALID 165797 78.37 88.02 73.11 5 XM_B_Unicode 163663 75.73 86.89 69.66 6 RELAYCOUNTRY_US 163451 83.17 86.78 81.21 7 DCC_CHECK 146235 52.91 77.64 39.45 8 XMListUnsubscribeExists 142596 59.79 75.70 51.12 9 XM_B_SpammyWords 138670 54.30 73.62 43.78 10 DKIM_VALID_AU 133675 63.22 70.97 59.00 11 XM_DK_Undo_02 87070 20.21 46.23 6.04 12 LOC_TINY_FONT_1 83616 32.64 44.39 26.23 13 XM_B_Unicode3 82884 41.34 44.00 39.88 14 XM_B_SpammyWords2 80560 26.37 42.77 17.44 15 HTML_FONT_LOW_CONTRAST 78757 33.29 41.81 28.64 16 RCVD_IN_MSPIKE_H2 74380 33.88 39.49 30.82 17 BAYES_99 70767 16.30 37.57 4.71 18 BAYES_50 70066 52.74 37.20 61.21 19 FVGT_m_MULTI_ODD 69168 30.09 36.72 26.48 20 TR_XM_DKIM_Undo 65323 13.89 34.68 2.57 21 BAYES_999 58039 13.22 30.81 3.64 22 T_KAM_HTML_FONT_INVALID 55993 24.76 29.73 22.06 23 TR_DCC_Bayes_99 53641 11.45 28.48 2.18 24 DKIM_VALID_EF 53264 28.63 28.28 28.83 25 MIME_HTML_ONLY 47245 21.30 25.08 19.24 26 T_TM2_M_HEADER_IN_MSG 45325 27.42 24.06 29.24 27 XMSubLong 42452 22.74 22.54 22.85 28 DCC_CHECK_NEGATIVE 42107 47.04 22.35 60.49 29 TR_XM_DK_Unsub 39489 16.29 20.96 13.74 30 XM_Multi_Part_URI 37668 16.97 20.00 15.32 31 LOTS_OF_MONEY 34352 10.77 18.24 6.70 32 TR_XM_SpammyWords4 31509 8.90 16.73 4.64 33 UNPARSEABLE_RELAY 28602 12.07 15.18 10.37 34 XM_B_SpammyWords3 28266 7.88 15.01 4.00 35 XM_B_Unsub 27665 10.43 14.69 8.12 36 TR_XM_SpammyWords2 26837 5.49 14.25 0.73 37 TR_XM_BayesUnsub 26387 9.23 14.01 6.63 38 TR_MAX_INTL_RELAY 26039 9.27 13.82 6.79 39 BOTNET_IPINHOSTNAME 25729 7.51 13.66 4.16 40 RELAYCOUNTRY_META 25115 7.50 13.33 4.32 41 TR_XM_SpammyRelay 18095 5.02 9.61 2.52 42 XM_Evil_Numbers_Gen 16506 8.15 8.76 7.81 43 BOTNET 16400 3.92 8.71 1.32 44 BAYES_80 16168 5.70 8.58 4.14 45 RCVD_IN_BL_SPAMCOP_NET 15104 3.27 8.02 0.68 46 XM_Body_Dirty_Words 14948 4.64 7.94 2.85 47 FSL_BULK_SIG 14837 6.53 7.88 5.79 48 TR_XM_UnparsRelay 14814 4.00 7.86 1.89 49 LotsOfNums_01 14411 8.14 7.65 8.41 50 BAYES_60 13578 8.67 7.21 9.47 51 TR_XM_SPAMCOP 12753 2.62 6.77 0.37 52 XMSubMetaSx_00 11593 5.17 6.15 4.63 53 HTML_IMAGE_RATIO_02 11369 5.39 6.04 5.03 54 XM_B_PhoneNumber 10818 9.04 5.74 10.83 55 TR_LOTS_OF_MONEY3 10577 2.39 5.62 0.63 56 UNTRUSTED_Relay 10425 3.09 5.53 1.76 57 MPART_ALT_DIFF 10191 4.23 5.41 3.59 58 XM_UncommonTLD01 10128 4.76 5.38 4.42 59 XM_B_SEO 9591 2.65 5.09 1.31 60 BAYES_95 9256 3.45 4.91 2.65 61 XM_H_Long_From01 9232 5.25 4.90 5.44 62 HTML_IMAGE_RATIO_04 9213 4.08 4.89 3.63 63 XM_SPF_SoftFail 9040 3.90 4.80 3.41 64 RELAYCOUNTRY_CA 9018 2.64 4.79 1.47 65 DKIM_INVALID 8862 3.05 4.70 2.15 66 XMBody_17 8777 1.99 4.66 0.53 67 XM_B_Phish_Phrases 8754 3.99 4.65 3.63 68 XM_B_Investor 8412 2.56 4.47 1.52 69 XMSexyCombo_05 8308 2.63 4.41 1.66 70 TooManyTo_001 8266 7.01 4.39 8.43 71 TR_XM_SEO4 8102 2.01 4.30 0.76 72 HTML_IMAGE_RATIO_08 8010 2.94 4.25 2.22 73 TR_XM_SpammyWords5 7916 2.36 4.20 1.36 74 HTML_IMAGE_RATIO_06 7898 3.52 4.19 3.16 75 XM_H_GMP 7249 5.44 3.85 6.31 76 TR_XM_PhishingBody 7220 2.38 3.83 1.60 77 RCVD_IN_VALIDITY_SAFE 7155 4.03 3.80 4.15 78 XMNumbers 7104 3.00 3.77 2.58 79 MIME_QP_LONG_LINE 7057 4.52 3.75 4.94 80 XMStrtUSub 6816 4.22 3.62 4.55 81 XM_OfRef6 6697 1.85 3.56 0.93 82 T_XMDrugObfuBody_14 6655 2.25 3.53 1.56 83 XM_URI_RBL 6429 1.35 3.41 0.23 84 MIME_HTML_ONLY_MULTI 6266 2.45 3.33 1.96 85 T_XMDrugObfuBody_08 6245 2.26 3.32 1.68 86 MIME_HTML_MOSTLY 6208 2.60 3.30 2.22 87 TM2_M_VERY_LONG_WORD 6110 1.96 3.24 1.26 88 XM_B_SpammyTLD 6048 4.08 3.21 4.56 89 XM_UB50 5422 1.61 2.88 0.93 90 XMDiploma_00 5404 2.11 2.87 1.69 91 TM2_M_URI_OPT_OUT 5230 2.09 2.78 1.72 92 T_TooManySym_01 5155 4.11 2.74 4.86 93 RCVD_IN_VALIDITY_CERTIFIED 5080 3.09 2.70 3.30 94 RCVD_IN_MSPIKE_H3 5053 5.22 2.68 6.60 95 RCVD_IN_MSPIKE_WL 5053 5.22 2.68 6.60 96 XM_CamelCaseFrm001 5040 2.56 2.68 2.49 97 USER_IN_DEF_DKIM_WL 5002 10.49 2.66 14.76 98 XM_B_Unsub2 4696 1.81 2.49 1.44 99 XM_B_SpammyWords4 4478 1.26 2.38 0.65 100 T_XMHurry_00 4291 1.25 2.28 0.69 101 T_REMOTE_IMAGE 4280 3.10 2.27 3.55 102 SUBJ_ALL_CAPS 4227 1.81 2.24 1.58 103 XMBrknScrpt_02 4085 1.35 2.17 0.91 104 RELAYCOUNTRY_AU 3980 1.32 2.11 0.89 105 MAILING_LIST_MULTI 3823 2.57 2.03 2.86 106 URI_TRY_3LD 3707 1.14 1.97 0.69 107 HTML_MIME_NO_HTML_TAG 3510 2.21 1.86 2.39 108 SpammyFromTLD_01 3459 1.24 1.84 0.91 109 BAYES_40 3343 3.85 1.77 4.98 110 AC_BR_BONANZA 3239 0.70 1.72 0.15 111 XM_HighProb1 3203 0.61 1.70 0.01 112 XM_H_Long_From02 3185 1.40 1.69 1.25 113 RCVD_IN_VALIDITY_RPBL 3182 0.67 1.69 0.11 114 HTML_TAG_BALANCE_BODY 3135 0.95 1.66 0.56 115 SpammyFromTLD_02 3093 0.94 1.64 0.55 116 TR_XM_NoHeaderRelay 3065 0.66 1.63 0.14 117 TR_XM_INV_DKIM 3032 0.61 1.61 0.07 118 XM_DK_Undo_01 2978 1.92 1.58 2.10 119 XMStockSpam_06 2975 1.29 1.58 1.13 120 RCVD_IN_IADB_LISTED 2942 3.08 1.56 3.90 121 XM_ProductURIs 2886 0.90 1.53 0.55 122 T_XMDrugObfuBody_00 2830 0.95 1.50 0.65 123 ALL_TRUSTED 2825 10.32 1.50 15.12 124 XMGenDplmaNmb 2785 1.07 1.48 0.84 125 FROM_EXCESS_BASE64 2666 1.62 1.42 1.73 126 RCVD_IN_IADB_SPF 2550 2.69 1.35 3.41 127 BAYES_20 2471 2.43 1.31 3.04 128 URI_HEX 2465 1.19 1.31 1.12 129 HOSTED_IMG_MULTI_PUB_01 2428 0.47 1.29 0.02 130 RCVD_IN_IADB_DK 2407 2.34 1.28 2.92 131 RCVD_IN_IADB_SENDERID 2371 2.41 1.26 3.04 132 ANY_BOUNCE_MESSAGE 2346 2.42 1.25 3.06 133 BOUNCE_MESSAGE 2344 2.42 1.24 3.06 134 URI_NOVOWEL 2325 2.66 1.23 3.44 135 THIS_AD 2308 0.71 1.23 0.44 136 LONGLN_LOW_CONTRAST 2301 0.57 1.22 0.21 137 T_FILL_THIS_FORM_SHORT 2275 0.99 1.21 0.87 138 XMSexyCombo_01 2274 0.55 1.21 0.20 139 TR_XM_PHPForged 2188 0.61 1.16 0.32 140 XM_SendGrid 2159 1.25 1.15 1.31 141 TR_XM_PHPDW 2141 0.61 1.14 0.32 142 XMBdyGiftCard01 2134 0.86 1.13 0.70 143 TR_Symld_Words 2123 1.40 1.13 1.56 144 TR_XM_FormFill2 2122 0.61 1.13 0.32 145 XM_H_PHPOS 2112 0.60 1.12 0.31 146 XM_B_Phish66 2093 0.57 1.11 0.27 147 HTTPS_HTTP_MISMATCH 2076 0.92 1.10 0.83 148 DIET_1 2071 0.62 1.10 0.36 149 LongTLD 2071 0.65 1.10 0.41 150 KHOP_HELO_FCRDNS 2056 1.18 1.09 1.23 151 XMPhish30 2049 0.64 1.09 0.39 152 TR_LOTS_OF_MONEY2 2008 0.53 1.07 0.24 153 T_MONEY_PERCENT 2008 0.53 1.07 0.24 154 XMHTML_After_End 1992 0.55 1.06 0.27 155 TM2_M_A_HREF_HREF 1938 0.68 1.03 0.49 156 XMMoneyMeta_00 1931 0.68 1.03 0.49 157 TR_XM_InvalidRelay 1897 0.37 1.01 0.03 158 XMHTMLBadTable_001 1840 0.54 0.98 0.30 159 RELAYCOUNTRY_FR 1835 0.49 0.97 0.23 160 XM_B_COPY_HTML 1759 0.70 0.93 0.57 161 AC_HTML_NONSENSE_TAGS 1739 0.34 0.92 0.03 162 URIBL_DBL_SPAM 1720 0.33 0.91 0.01 163 XMReplyNow 1714 0.44 0.91 0.18 164 XM_DIRTYINTL 1707 0.39 0.91 0.10 165 XM_B_DNDMA 1670 0.60 0.89 0.44 166 DKIM_ADSP_CUSTOM_MED 1643 0.85 0.87 0.84 167 DKIM_ADSP_NXDOMAIN 1639 0.49 0.87 0.28 168 TR_Caps_n_Bayes_99 1630 0.33 0.87 0.03 169 TR_Mismatch_TLD_02 1629 0.36 0.86 0.08 170 TR_MetaPhish_Combo_01 1626 0.75 0.86 0.69 171 XMPhish14 1623 0.56 0.86 0.39 172 XMSubMetaSxObfu_03 1578 0.68 0.84 0.59 173 T_TooManySym_02 1573 1.92 0.84 2.52 174 PLING_QUERY 1551 0.55 0.82 0.40 175 RDNS_DYNAMIC 1550 0.51 0.82 0.34 176 FROM_GOV_DKIM_AU 1546 0.75 0.82 0.71 177 XMSubMetaI_00 1541 0.64 0.82 0.54 178 T_Symld_Words_02 1530 0.60 0.81 0.48 179 PDS_RDNS_DYNAMIC_FP 1518 0.40 0.81 0.18 180 XM_UB99 1516 0.29 0.80 0.00 181 XMSlimDrugH 1494 0.56 0.79 0.43 182 BOTNET_NORDNS 1471 0.28 0.78 0.00 183 XM_Dr_From 1470 0.34 0.78 0.10 184 RCVD_IN_IADB_VOUCHED 1467 1.99 0.78 2.65 185 BAYES_05 1404 1.44 0.75 1.82 186 MPART_ALT_DIFF_COUNT 1391 0.50 0.74 0.38 187 TVD_RCVD_IP 1387 1.29 0.74 1.59 188 TR_XM_DK_SendGrid 1382 0.76 0.73 0.77 189 TooManyTo_002 1373 2.11 0.73 2.86 190 RELAYCOUNTRY_GB 1372 0.51 0.73 0.40 191 HTML_FONT_TINY_NORDNS 1367 0.32 0.73 0.10 192 XM_B_COVIDMETA 1363 0.38 0.72 0.19 193 T_STY_INVIS_DIRECT 1356 0.46 0.72 0.32 194 XM_PDF 1349 3.13 0.72 4.45 195 SHOPIFY_IMG_NOT_RCVD_SFY 1336 0.45 0.71 0.31 196 XM_B_REG_HTML 1329 0.34 0.71 0.14 197 HTML_FONT_FACE_BAD 1328 0.51 0.71 0.40 198 XMLngstWrd_00 1314 0.68 0.70 0.66 199 NML_ADSP_CUSTOM_MED 1309 0.59 0.69 0.53 200 BAYES_00 1305 5.41 0.69 7.98 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297841 90.10 97.40 86.12 2 RELAYCOUNTRY_US 280833 83.17 86.78 81.21 3 DKIM_SIGNED 260262 81.42 92.73 75.26 4 XM_DK_Pass 256110 79.39 89.20 74.06 5 DKIM_VALID 252823 78.37 88.02 73.11 6 XM_B_Unicode 240897 75.73 86.89 69.66 7 BAYES_50 211689 52.74 37.20 61.21 8 DCC_CHECK_NEGATIVE 209179 47.04 22.35 60.49 9 DKIM_VALID_AU 204037 63.22 70.97 59.00 10 XMListUnsubscribeExists 176780 59.79 75.70 51.12 11 XM_B_SpammyWords 151414 54.30 73.62 43.78 12 XM_B_Unicode3 137924 41.34 44.00 39.88 13 DCC_CHECK 136427 52.91 77.64 39.45 14 RCVD_IN_MSPIKE_H2 106588 33.88 39.49 30.82 15 T_TM2_M_HEADER_IN_MSG 101135 27.42 24.06 29.24 16 DKIM_VALID_EF 99691 28.63 28.28 28.83 17 HTML_FONT_LOW_CONTRAST 99050 33.29 41.81 28.64 18 FVGT_m_MULTI_ODD 91579 30.09 36.72 26.48 19 LOC_TINY_FONT_1 90719 32.64 44.39 26.23 20 XMSubLong 79021 22.74 22.54 22.85 21 T_KAM_HTML_FONT_INVALID 76276 24.76 29.73 22.06 22 MIME_HTML_ONLY 66552 21.30 25.08 19.24 23 XM_B_SpammyWords2 60304 26.37 42.77 17.44 24 XM_Multi_Part_URI 52971 16.97 20.00 15.32 25 ALL_TRUSTED 52295 10.32 1.50 15.12 26 USER_IN_DEF_DKIM_WL 51055 10.49 2.66 14.76 27 TR_XM_DK_Unsub 47512 16.29 20.96 13.74 28 XM_B_PhoneNumber 37465 9.04 5.74 10.83 29 UNPARSEABLE_RELAY 35849 12.07 15.18 10.37 30 BAYES_60 32739 8.67 7.21 9.47 31 TooManyTo_001 29159 7.01 4.39 8.43 32 LotsOfNums_01 29097 8.14 7.65 8.41 33 XM_DKIMWhitelistDomains 28114 5.31 0.12 8.13 34 XM_B_Unsub 28068 10.43 14.69 8.12 35 BAYES_00 27604 5.41 0.69 7.98 36 XM_Evil_Numbers_Gen 27015 8.15 8.76 7.81 37 IN_ZIMBRA_NJ_WHITELIST 24370 4.60 0.11 7.05 38 TR_MAX_INTL_RELAY 23469 9.27 13.82 6.79 39 LOTS_OF_MONEY 23181 10.77 18.24 6.70 40 TR_XM_BayesUnsub 22922 9.23 14.01 6.63 41 RCVD_IN_MSPIKE_H3 22841 5.22 2.68 6.60 42 RCVD_IN_MSPIKE_WL 22841 5.22 2.68 6.60 43 XM_H_GMP 21833 5.44 3.85 6.31 44 XM_DK_Undo_02 20886 20.21 46.23 6.04 45 FSL_BULK_SIG 20020 6.53 7.88 5.79 46 TR_XM_DK_Bayes 19915 3.90 0.50 5.76 47 TR_XM_DK_Bayes1 19610 3.84 0.49 5.67 48 XM_H_Long_From01 18814 5.25 4.90 5.44 49 HTML_IMAGE_RATIO_02 17409 5.39 6.04 5.03 50 BAYES_40 17234 3.85 1.77 4.98 51 MIME_QP_LONG_LINE 17091 4.52 3.75 4.94 52 TR_XM_DK_Bayes2 16879 3.29 0.36 4.88 53 T_TooManySym_01 16800 4.11 2.74 4.86 54 BAYES_99 16305 16.30 37.57 4.71 55 TR_XM_SpammyWords4 16042 8.90 16.73 4.64 56 XMSubMetaSx_00 16029 5.17 6.15 4.63 57 XM_B_SpammyTLD 15756 4.08 3.21 4.56 58 XMStrtUSub 15732 4.22 3.62 4.55 59 XM_PDF 15376 3.13 0.72 4.45 60 XM_UncommonTLD01 15289 4.76 5.38 4.42 61 RELAYCOUNTRY_META 14937 7.50 13.33 4.32 62 BOTNET_IPINHOSTNAME 14394 7.51 13.66 4.16 63 RCVD_IN_VALIDITY_SAFE 14360 4.03 3.80 4.15 64 BAYES_80 14303 5.70 8.58 4.14 65 XM_B_SpammyWords3 13839 7.88 15.01 4.00 66 RCVD_IN_IADB_LISTED 13502 3.08 1.56 3.90 67 BAYES_999 12596 13.22 30.81 3.64 68 XM_B_Phish_Phrases 12566 3.99 4.65 3.63 69 HTML_IMAGE_RATIO_04 12560 4.08 4.89 3.63 70 MPART_ALT_DIFF 12405 4.23 5.41 3.59 71 T_REMOTE_IMAGE 12265 3.10 2.27 3.55 72 URI_NOVOWEL 11907 2.66 1.23 3.44 73 RCVD_IN_IADB_SPF 11809 2.69 1.35 3.41 74 XM_SPF_SoftFail 11794 3.90 4.80 3.41 75 RCVD_IN_VALIDITY_CERTIFIED 11411 3.09 2.70 3.30 76 HTML_IMAGE_RATIO_06 10932 3.52 4.19 3.16 77 ANY_BOUNCE_MESSAGE 10590 2.42 1.25 3.06 78 BOUNCE_MESSAGE 10589 2.42 1.24 3.06 79 RCVD_IN_IADB_SENDERID 10520 2.41 1.26 3.04 80 BAYES_20 10514 2.43 1.31 3.04 81 RCVD_IN_IADB_DK 10102 2.34 1.28 2.92 82 TooManyTo_002 9906 2.11 0.73 2.86 83 MAILING_LIST_MULTI 9889 2.57 2.03 2.86 84 XM_Body_Dirty_Words 9856 4.64 7.94 2.85 85 RCVD_IN_IADB_VOUCHED 9160 1.99 0.78 2.65 86 BAYES_95 9157 3.45 4.91 2.65 87 XMNumbers 8931 3.00 3.77 2.58 88 TR_XM_DKIM_Undo 8896 13.89 34.68 2.57 89 TR_XM_SpammyRelay 8729 5.02 9.61 2.52 90 T_TooManySym_02 8700 1.92 0.84 2.52 91 XM_CamelCaseFrm001 8627 2.56 2.68 2.49 92 HTML_MIME_NO_HTML_TAG 8278 2.21 1.86 2.39 93 HTML_IMAGE_RATIO_08 7683 2.94 4.25 2.22 94 MIME_HTML_MOSTLY 7673 2.60 3.30 2.22 95 TR_DCC_Bayes_99 7541 11.45 28.48 2.18 96 DKIM_INVALID 7439 3.05 4.70 2.15 97 INVALID_MSGID 7404 1.43 0.14 2.14 98 XM_DK_Undo_01 7260 1.92 1.58 2.10 99 TO_MALFORMED 7092 1.33 0.02 2.05 100 MIME_HTML_ONLY_MULTI 6795 2.45 3.33 1.96 101 TR_XM_UnparsRelay 6531 4.00 7.86 1.89 102 BAYES_05 6286 1.44 0.75 1.82 103 RCVD_IN_IADB_OPTIN 6284 1.32 0.42 1.82 104 HELO_NODOT 6213 1.27 0.32 1.80 105 HELO_NO_DOMAIN 6209 1.27 0.31 1.80 106 UNTRUSTED_Relay 6074 3.09 5.53 1.76 107 FROM_EXCESS_BASE64 5979 1.62 1.42 1.73 108 TM2_M_URI_OPT_OUT 5943 2.09 2.78 1.72 109 XMDiploma_00 5856 2.11 2.87 1.69 110 T_XMDrugObfuBody_08 5805 2.26 3.32 1.68 111 XMSexyCombo_05 5752 2.63 4.41 1.66 112 TR_XM_PhishingBody 5519 2.38 3.83 1.60 113 TVD_RCVD_IP 5491 1.29 0.74 1.59 114 SUBJ_ALL_CAPS 5449 1.81 2.24 1.58 115 T_XMDrugObfuBody_14 5380 2.25 3.53 1.56 116 TR_Symld_Words 5379 1.40 1.13 1.56 117 XM_B_Investor 5271 2.56 4.47 1.52 118 RELAYCOUNTRY_CA 5087 2.64 4.79 1.47 119 IN_HORDE_ADDRESS_BOOK 5035 0.97 0.08 1.46 120 XM_B_Unsub2 4973 1.81 2.49 1.44 121 TooManyTo_003 4952 1.15 0.62 1.43 122 TR_XM_SpammyWords5 4708 2.36 4.20 1.36 123 XM_GoogleGroups 4615 1.09 0.64 1.33 124 BOTNET 4564 3.92 8.71 1.32 125 XM_SendGrid 4544 1.25 1.15 1.31 126 XM_B_SEO 4542 2.65 5.09 1.31 127 TM2_M_VERY_LONG_WORD 4366 1.96 3.24 1.26 128 XM_H_Long_From02 4318 1.40 1.69 1.25 129 KHOP_HELO_FCRDNS 4269 1.18 1.09 1.23 130 XMGappySubj_01 4203 0.86 0.19 1.22 131 XMBSHREFv2 4037 0.85 0.28 1.17 132 XM_TLDProd2 3984 0.84 0.26 1.15 133 TVD_SPACE_RATIO 3924 0.78 0.14 1.13 134 XMStockSpam_06 3906 1.29 1.58 1.13 135 XMCapTrack 3889 0.90 0.48 1.12 136 URI_HEX 3868 1.19 1.31 1.12 137 TooManyTo_004 3616 0.88 0.58 1.05 138 T_TooManySym_03 3229 0.69 0.26 0.93 139 XM_OfRef6 3209 1.85 3.56 0.93 140 XM_UB50 3201 1.61 2.88 0.93 141 XMBrknScrpt_02 3153 1.35 2.17 0.91 142 SpammyFromTLD_01 3140 1.24 1.84 0.91 143 RELAYCOUNTRY_AU 3068 1.32 2.11 0.89 144 XM_B_FormFill 3018 0.59 0.07 0.87 145 T_FILL_THIS_FORM_SHORT 3017 0.99 1.21 0.87 146 TooManyTo_005 2958 0.75 0.55 0.86 147 XMGenDplmaNmb 2919 1.07 1.48 0.84 148 DKIM_ADSP_CUSTOM_MED 2912 0.85 0.87 0.84 149 HTTPS_HTTP_MISMATCH 2855 0.92 1.10 0.83 150 TR_XM_DK_SendGrid 2665 0.76 0.73 0.77 151 TR_XM_SEO4 2621 2.01 4.30 0.76 152 TR_XM_SpammyWords2 2514 5.49 14.25 0.73 153 XM_ShortIntro_01 2451 0.68 0.62 0.71 154 XMBody_95 2449 0.60 0.39 0.71 155 FROM_GOV_DKIM_AU 2444 0.75 0.82 0.71 156 XMBdyGiftCard01 2437 0.86 1.13 0.70 157 XMNoVowels 2423 0.62 0.46 0.70 158 T_XMHurry_00 2402 1.25 2.28 0.69 159 TR_MetaPhish_Combo_01 2394 0.75 0.86 0.69 160 URI_TRY_3LD 2393 1.14 1.97 0.69 161 RCVD_IN_BL_SPAMCOP_NET 2356 3.27 8.02 0.68 162 XMGappySubj_02 2295 0.45 0.06 0.66 163 XMLngstWrd_00 2293 0.68 0.70 0.66 164 XM_B_SpammyWords4 2260 1.26 2.38 0.65 165 T_OBFU_PDF_ATTACH 2251 0.48 0.15 0.65 166 T_XMDrugObfuBody_00 2244 0.95 1.50 0.65 167 TR_LOTS_OF_MONEY3 2189 2.39 5.62 0.63 168 XM_H_PHPMailer 2182 0.58 0.50 0.63 169 XMSubMetaSxObfu_03 2039 0.68 0.84 0.59 170 SHORT_HELO_AND_INLINE_IMAGE 1998 0.39 0.05 0.58 171 USER_IN_WELCOMELIST 1997 0.37 0.00 0.58 172 USER_IN_WHITELIST 1997 0.37 0.00 0.58 173 XM_B_COPY_HTML 1969 0.70 0.93 0.57 174 HTML_TAG_BALANCE_BODY 1953 0.95 1.66 0.56 175 XM_ProductURIs 1913 0.90 1.53 0.55 176 SpammyFromTLD_02 1911 0.94 1.64 0.55 177 XMSubMetaI_00 1855 0.64 0.82 0.54 178 XMBody_17 1844 1.99 4.66 0.53 179 NML_ADSP_CUSTOM_MED 1842 0.59 0.69 0.53 180 TR_XM_Base64_M1 1816 0.56 0.62 0.53 181 XMSolicitRefs_0 1795 0.58 0.69 0.52 182 XMSubMetaSxObfu_02 1788 0.53 0.55 0.52 183 FORGED_GMAIL_RCVD 1773 0.57 0.68 0.51 184 NO_DNS_FOR_FROM 1762 0.50 0.47 0.51 185 TO_NO_BRKTS_HTML_ONLY 1744 0.39 0.18 0.50 186 XMDateMe_00 1705 0.42 0.29 0.49 187 TM2_M_A_HREF_HREF 1702 0.68 1.03 0.49 188 XMMoneyMeta_00 1691 0.68 1.03 0.49 189 XMPhish08 1676 0.54 0.63 0.48 190 T_Symld_Words_02 1667 0.60 0.81 0.48 191 XMOemUri 1660 0.52 0.58 0.48 192 MSGID_FROM_MTA_HEADER 1626 0.33 0.07 0.47 193 HTML_IMAGE_ONLY_20 1521 0.46 0.49 0.44 194 XM_B_DNDMA 1521 0.60 0.89 0.44 195 THIS_AD 1510 0.71 1.23 0.44 196 TRACKER_ID 1480 0.32 0.11 0.43 197 XMSlimDrugH 1472 0.56 0.79 0.43 198 TM2_M_BODY_EMPTY 1450 0.30 0.09 0.42 199 HTML_IMAGE_ONLY_28 1427 0.38 0.33 0.41 200 HTML_IMAGE_ONLY_32 1409 0.33 0.19 0.41 ----------------------------------------------------------------------