Email: 507669 Autolearn: 0 AvgScore: 4.45 AvgScanTime: 1.15 sec Spam: 172725 Autolearn: 0 AvgScore: 13.32 AvgScanTime: 1.29 sec Ham: 334944 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 1.08 sec Time Spent Running SA: 162.83 hours Time Spent Processing Spam: 61.93 hours Time Spent Processing Ham: 100.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167501 88.80 96.98 84.59 2 DKIM_SIGNED 159480 80.73 92.33 74.74 3 XM_DK_Pass 153719 78.66 89.00 73.34 4 DKIM_VALID 150109 77.14 86.91 72.10 5 RELAYCOUNTRY_US 149034 82.16 86.28 80.04 6 XM_B_Unicode 148942 73.69 86.23 67.22 7 DCC_CHECK 134420 50.44 77.82 36.32 8 XMListUnsubscribeExists 131357 57.33 76.05 47.67 9 XM_B_SpammyWords 128957 53.48 74.66 42.55 10 DKIM_VALID_AU 123934 63.09 71.75 58.62 11 XM_DK_Undo_02 80171 19.58 46.42 5.74 12 XM_B_Unicode3 75022 40.00 43.43 38.23 13 XM_B_SpammyWords2 74401 25.74 43.07 16.80 14 LOC_TINY_FONT_1 73526 30.58 42.57 24.39 15 RCVD_IN_MSPIKE_H2 72800 35.58 42.15 32.19 16 HTML_FONT_LOW_CONTRAST 71781 32.40 41.56 27.68 17 FVGT_m_MULTI_ODD 67144 30.24 38.87 25.79 18 BAYES_99 67142 16.27 38.87 4.61 19 TR_XM_DKIM_Undo 62023 13.66 35.91 2.19 20 BAYES_50 61856 52.10 35.81 60.49 21 BAYES_999 54920 13.17 31.80 3.56 22 T_KAM_HTML_FONT_INVALID 54557 23.73 31.59 19.68 23 TR_DCC_Bayes_99 50480 11.08 29.23 1.72 24 DKIM_VALID_EF 49858 29.52 28.87 29.86 25 T_TM2_M_HEADER_IN_MSG 43369 29.78 25.11 32.19 26 MIME_HTML_ONLY 42731 21.02 24.74 19.10 27 DCC_CHECK_NEGATIVE 38287 49.52 22.17 63.63 28 XMSubLong 37983 23.03 21.99 23.56 29 TR_XM_DK_Unsub 36490 16.30 21.13 13.82 30 XM_Multi_Part_URI 34700 16.67 20.09 14.91 31 LOTS_OF_MONEY 31031 10.27 17.97 6.30 32 TR_XM_SpammyWords4 28596 8.54 16.56 4.40 33 TR_XM_SpammyWords2 28551 6.04 16.53 0.63 34 XM_B_Unsub 24858 10.00 14.39 7.73 35 UNPARSEABLE_RELAY 24823 11.79 14.37 10.45 36 XM_B_SpammyWords3 24554 7.71 14.22 4.35 37 RELAYCOUNTRY_META 24217 7.71 14.02 4.45 38 TR_MAX_INTL_RELAY 23678 9.24 13.71 6.94 39 TR_XM_BayesUnsub 23593 8.83 13.66 6.34 40 BOTNET_IPINHOSTNAME 22240 6.88 12.88 3.79 41 XM_Evil_Numbers_Gen 16574 8.67 9.60 8.20 42 TR_XM_SpammyRelay 16283 4.47 9.43 1.92 43 BOTNET 14877 3.68 8.61 1.13 44 BAYES_80 14424 5.68 8.35 4.31 45 FSL_BULK_SIG 13227 6.26 7.66 5.54 46 LotsOfNums_01 13206 7.92 7.65 8.06 47 TR_XM_UnparsRelay 12948 3.54 7.50 1.50 48 RCVD_IN_BL_SPAMCOP_NET 12850 2.94 7.44 0.62 49 BAYES_60 12704 8.89 7.36 9.69 50 XM_Body_Dirty_Words 12290 4.22 7.12 2.72 51 UNTRUSTED_Relay 11290 3.44 6.54 1.85 52 TR_LOTS_OF_MONEY3 10643 2.63 6.16 0.81 53 TR_XM_SPAMCOP 10363 2.26 6.00 0.34 54 HTML_IMAGE_RATIO_02 9906 5.27 5.74 5.03 55 XMSubMetaSx_00 9854 4.25 5.71 3.51 56 DKIM_INVALID 9371 3.59 5.43 2.64 57 TooManyTo_001 9337 7.68 5.41 8.85 58 MPART_ALT_DIFF 9260 4.01 5.36 3.31 59 XM_B_PhoneNumber 8999 8.32 5.21 9.93 60 XM_UncommonTLD01 8930 4.58 5.17 4.28 61 BAYES_95 8724 3.45 5.05 2.63 62 XMBody_17 8624 2.20 4.99 0.76 63 HTML_IMAGE_RATIO_04 8283 3.79 4.80 3.27 64 XM_SPF_SoftFail 8042 3.85 4.66 3.44 65 XM_B_SEO 7706 2.37 4.46 1.29 66 XMSexyCombo_05 7613 2.45 4.41 1.44 67 XMStrtUSub 7600 4.62 4.40 4.73 68 XM_H_Long_From01 7555 4.83 4.37 5.06 69 XM_B_Investor 7471 2.58 4.33 1.67 70 XM_OfRef6 7468 2.14 4.32 1.01 71 RELAYCOUNTRY_CA 7455 2.22 4.32 1.14 72 HTML_IMAGE_RATIO_08 7247 2.85 4.20 2.16 73 XM_B_Phish_Phrases 7135 3.96 4.13 3.87 74 TR_XM_SpammyWords5 6839 2.13 3.96 1.19 75 MIME_QP_LONG_LINE 6708 4.40 3.88 4.67 76 MIME_HTML_MOSTLY 6673 2.71 3.86 2.11 77 TR_XM_SEO4 6633 1.85 3.84 0.82 78 TR_XM_PhishingBody 6404 2.20 3.71 1.42 79 XMNumbers 6355 3.00 3.68 2.66 80 RCVD_IN_VALIDITY_SAFE 6280 3.95 3.64 4.11 81 TM2_M_VERY_LONG_WORD 6031 2.10 3.49 1.39 82 XM_URI_RBL 6029 1.33 3.49 0.22 83 XM_H_GMP 6029 5.49 3.49 6.53 84 RCVD_IN_VALIDITY_RPBL 5868 1.24 3.40 0.13 85 XM_UB50 5862 1.77 3.39 0.93 86 MIME_HTML_ONLY_MULTI 5734 2.42 3.32 1.96 87 HTML_IMAGE_RATIO_06 5722 2.68 3.31 2.35 88 T_XMDrugObfuBody_14 5646 2.57 3.27 2.21 89 T_XMDrugObfuBody_08 5592 2.19 3.24 1.65 90 XM_B_SpammyTLD 5406 3.94 3.13 4.36 91 XMDiploma_00 5388 2.26 3.12 1.81 92 USER_IN_DEF_DKIM_WL 5034 9.42 2.91 12.78 93 RCVD_IN_VALIDITY_CERTIFIED 4841 3.13 2.80 3.30 94 SpammyFromTLD_01 4574 1.56 2.65 1.00 95 T_REMOTE_IMAGE 4557 3.38 2.64 3.76 96 URI_TRY_3LD 4505 1.45 2.61 0.85 97 RCVD_IN_MSPIKE_H3 4473 4.64 2.59 5.69 98 RCVD_IN_MSPIKE_WL 4473 4.64 2.59 5.69 99 TM2_M_URI_OPT_OUT 4413 1.80 2.55 1.41 100 XM_CamelCaseFrm001 4401 2.15 2.55 1.94 101 T_TooManySym_01 4396 5.19 2.55 6.56 102 XMBrknScrpt_02 4318 1.46 2.50 0.93 103 T_XMHurry_00 4250 1.14 2.46 0.46 104 XM_B_SpammyWords4 4179 1.17 2.42 0.53 105 TR_XM_NoHeaderRelay 3992 0.88 2.31 0.15 106 SUBJ_ALL_CAPS 3837 1.70 2.22 1.44 107 RELAYCOUNTRY_AU 3821 1.23 2.21 0.72 108 XM_B_Unsub2 3655 1.61 2.12 1.35 109 URI_NOVOWEL 3291 2.84 1.91 3.32 110 XMStockSpam_06 3188 1.49 1.85 1.31 111 MAILING_LIST_MULTI 3178 3.16 1.84 3.85 112 BAYES_40 3163 3.99 1.83 5.10 113 XM_HighProb1 3116 0.62 1.80 0.01 114 HOSTED_IMG_MULTI_PUB_01 3051 0.61 1.77 0.02 115 XM_DK_Undo_01 3018 1.72 1.75 1.71 116 T_XMDrugObfuBody_00 2960 0.94 1.71 0.55 117 HTML_TAG_BALANCE_BODY 2958 0.97 1.71 0.59 118 TR_XM_INV_DKIM 2941 0.63 1.70 0.07 119 FROM_EXCESS_BASE64 2828 1.63 1.64 1.62 120 AC_BR_BONANZA 2805 0.64 1.62 0.14 121 DKIM_ADSP_NXDOMAIN 2603 0.72 1.51 0.31 122 HTML_MIME_NO_HTML_TAG 2577 2.13 1.49 2.47 123 T_FILL_THIS_FORM_SHORT 2568 1.09 1.49 0.89 124 URI_HEX 2555 1.21 1.48 1.07 125 XMGenDplmaNmb 2486 1.06 1.44 0.86 126 LONGLN_LOW_CONTRAST 2419 0.67 1.40 0.30 127 ANY_BOUNCE_MESSAGE 2373 2.61 1.37 3.25 128 BOUNCE_MESSAGE 2373 2.61 1.37 3.25 129 KHOP_HELO_FCRDNS 2341 1.41 1.36 1.43 130 XM_ProductURIs 2304 0.84 1.33 0.58 131 BAYES_20 2275 2.70 1.32 3.41 132 ALL_TRUSTED 2231 11.37 1.29 16.57 133 TR_Symld_Words 2187 1.43 1.27 1.51 134 XM_SendGrid 2173 1.28 1.26 1.29 135 TR_LOTS_OF_MONEY2 2137 0.62 1.24 0.30 136 T_MONEY_PERCENT 2137 0.62 1.24 0.30 137 TR_XM_PHPForged 2103 0.71 1.22 0.45 138 TR_XM_PHPDW 2095 0.71 1.21 0.45 139 RCVD_IN_IADB_LISTED 2083 2.68 1.21 3.44 140 RELAYCOUNTRY_CN 2041 0.45 1.18 0.08 141 TR_XM_FormFill2 2039 0.70 1.18 0.46 142 XM_H_PHPOS 2017 0.69 1.17 0.44 143 RDNS_DYNAMIC 1994 0.61 1.15 0.33 144 XM_B_Phish66 1963 0.59 1.14 0.31 145 SpammyFromTLD_02 1948 0.53 1.13 0.22 146 URIBL_DBL_SPAM 1938 0.40 1.12 0.02 147 PDS_RDNS_DYNAMIC_FP 1935 0.49 1.12 0.16 148 XMSubMetaI_00 1902 0.82 1.10 0.67 149 HTTPS_HTTP_MISMATCH 1838 0.97 1.06 0.92 150 TR_Mismatch_TLD_02 1823 0.39 1.06 0.05 151 DIET_1 1816 0.52 1.05 0.25 152 XMPhish30 1806 0.62 1.05 0.40 153 RCVD_IN_IADB_SPF 1802 2.36 1.04 3.04 154 AC_HTML_NONSENSE_TAGS 1763 0.38 1.02 0.04 155 HTML_FONT_TINY_NORDNS 1759 0.41 1.02 0.10 156 XM_B_COPY_HTML 1756 0.68 1.02 0.50 157 TVD_RCVD_IP 1709 1.31 0.99 1.48 158 XMReplyNow 1696 0.55 0.98 0.32 159 BOTNET_NORDNS 1692 0.34 0.98 0.01 160 XMMoneyMeta_00 1678 0.63 0.97 0.46 161 XM_UB60 1678 0.38 0.97 0.08 162 TR_MetaPhish_Combo_01 1675 0.76 0.97 0.66 163 RCVD_IN_IADB_DK 1653 2.05 0.96 2.61 164 THIS_AD 1641 0.63 0.95 0.47 165 TR_Caps_n_Bayes_99 1638 0.33 0.95 0.02 166 RCVD_IN_IADB_SENDERID 1626 2.11 0.94 2.71 167 TR_XM_InvalidRelay 1613 0.34 0.93 0.03 168 DKIM_ADSP_CUSTOM_MED 1612 0.89 0.93 0.87 169 XMHTML_After_End 1602 0.54 0.93 0.33 170 RELAYCOUNTRY_GB 1587 0.66 0.92 0.53 171 TR_XM_FormFill 1553 0.31 0.90 0.01 172 T_Symld_Words_02 1534 0.58 0.89 0.42 173 HTML_FONT_FACE_BAD 1521 0.55 0.88 0.38 174 XMHTMLBadTable_001 1503 0.48 0.87 0.27 175 XMSlimDrugH 1503 0.58 0.87 0.43 176 XMBounce_01 1466 0.30 0.85 0.02 177 XM_B_DNDMA 1448 0.78 0.84 0.75 178 RCVD_IN_PSBL 1447 0.51 0.84 0.33 179 TR_XM_Base64_M1 1401 0.76 0.81 0.74 180 XMBdyGiftCard01 1393 0.78 0.81 0.76 181 TM2_M_A_HREF_HREF 1387 0.41 0.80 0.21 182 T_TooManySym_02 1381 2.56 0.80 3.47 183 RELAYCOUNTRY_FR 1377 0.45 0.80 0.27 184 XM_H_Long_From02 1351 0.97 0.78 1.06 185 TM2_M_OBFU_COMMENT 1344 0.48 0.78 0.33 186 XM_OfRef7 1324 0.38 0.77 0.19 187 XMSubMetaSxObfu_03 1310 0.54 0.76 0.42 188 XM_UB99 1299 0.26 0.75 0.00 189 BAYES_00 1293 5.34 0.75 7.71 190 NML_ADSP_CUSTOM_MED 1293 0.64 0.75 0.58 191 T_STY_INVIS_DIRECT 1292 0.51 0.75 0.38 192 HELO_DYNAMIC_SPLIT_IP 1283 0.26 0.74 0.01 193 TooManyTo_002 1276 2.22 0.74 2.99 194 LongTLD 1275 0.52 0.74 0.41 195 TR_XM_DK_SendGrid 1275 0.80 0.74 0.83 196 XM_B_REG_HTML 1263 0.41 0.73 0.24 197 XMPhish08 1254 0.37 0.73 0.18 198 TR_XM_COVIDMETA4 1223 0.29 0.71 0.08 199 FORGED_GMAIL_RCVD 1203 0.54 0.70 0.46 200 XMPhish14 1197 0.56 0.69 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 283323 88.80 96.98 84.59 2 RELAYCOUNTRY_US 268074 82.16 86.28 80.04 3 DKIM_SIGNED 250346 80.73 92.33 74.74 4 XM_DK_Pass 245638 78.66 89.00 73.34 5 DKIM_VALID 241488 77.14 86.91 72.10 6 XM_B_Unicode 225140 73.69 86.23 67.22 7 DCC_CHECK_NEGATIVE 213116 49.52 22.17 63.63 8 BAYES_50 202622 52.10 35.81 60.49 9 DKIM_VALID_AU 196342 63.09 71.75 58.62 10 XMListUnsubscribeExists 159666 57.33 76.05 47.67 11 XM_B_SpammyWords 142534 53.48 74.66 42.55 12 XM_B_Unicode3 128056 40.00 43.43 38.23 13 DCC_CHECK 121647 50.44 77.82 36.32 14 T_TM2_M_HEADER_IN_MSG 107834 29.78 25.11 32.19 15 RCVD_IN_MSPIKE_H2 107807 35.58 42.15 32.19 16 DKIM_VALID_EF 100011 29.52 28.87 29.86 17 HTML_FONT_LOW_CONTRAST 92729 32.40 41.56 27.68 18 FVGT_m_MULTI_ODD 86368 30.24 38.87 25.79 19 LOC_TINY_FONT_1 81707 30.58 42.57 24.39 20 XMSubLong 78918 23.03 21.99 23.56 21 T_KAM_HTML_FONT_INVALID 65918 23.73 31.59 19.68 22 MIME_HTML_ONLY 63967 21.02 24.74 19.10 23 XM_B_SpammyWords2 56267 25.74 43.07 16.80 24 ALL_TRUSTED 55508 11.37 1.29 16.57 25 XM_Multi_Part_URI 49948 16.67 20.09 14.91 26 TR_XM_DK_Unsub 46282 16.30 21.13 13.82 27 USER_IN_DEF_DKIM_WL 42802 9.42 2.91 12.78 28 UNPARSEABLE_RELAY 35017 11.79 14.37 10.45 29 XM_B_PhoneNumber 33251 8.32 5.21 9.93 30 BAYES_60 32453 8.89 7.36 9.69 31 TooManyTo_001 29646 7.68 5.41 8.85 32 XM_DKIMWhitelistDomains 29270 5.78 0.05 8.74 33 XM_Evil_Numbers_Gen 27456 8.67 9.60 8.20 34 LotsOfNums_01 27002 7.92 7.65 8.06 35 XM_B_Unsub 25887 10.00 14.39 7.73 36 BAYES_00 25816 5.34 0.75 7.71 37 IN_ZIMBRA_NJ_WHITELIST 23474 4.65 0.08 7.01 38 TR_MAX_INTL_RELAY 23240 9.24 13.71 6.94 39 T_TooManySym_01 21957 5.19 2.55 6.56 40 XM_H_GMP 21867 5.49 3.49 6.53 41 TR_XM_BayesUnsub 21245 8.83 13.66 6.34 42 LOTS_OF_MONEY 21086 10.27 17.97 6.30 43 XM_DK_Undo_02 19222 19.58 46.42 5.74 44 RCVD_IN_MSPIKE_H3 19061 4.64 2.59 5.69 45 RCVD_IN_MSPIKE_WL 19061 4.64 2.59 5.69 46 FSL_BULK_SIG 18564 6.26 7.66 5.54 47 TR_XM_DK_Bayes 17959 3.69 0.46 5.36 48 TR_XM_DK_Bayes1 17395 3.58 0.44 5.19 49 BAYES_40 17071 3.99 1.83 5.10 50 XM_H_Long_From01 16945 4.83 4.37 5.06 51 HTML_IMAGE_RATIO_02 16850 5.27 5.74 5.03 52 XM_PDF 16079 3.40 0.68 4.80 53 XMStrtUSub 15836 4.62 4.40 4.73 54 MIME_QP_LONG_LINE 15654 4.40 3.88 4.67 55 BAYES_99 15432 16.27 38.87 4.61 56 RELAYCOUNTRY_META 14904 7.71 14.02 4.45 57 TR_XM_DK_Bayes2 14776 3.04 0.37 4.41 58 TR_XM_SpammyWords4 14740 8.54 16.56 4.40 59 XM_B_SpammyTLD 14606 3.94 3.13 4.36 60 XM_B_SpammyWords3 14577 7.71 14.22 4.35 61 BAYES_80 14434 5.68 8.35 4.31 62 XM_UncommonTLD01 14321 4.58 5.17 4.28 63 RCVD_IN_VALIDITY_SAFE 13750 3.95 3.64 4.11 64 XM_B_Phish_Phrases 12977 3.96 4.13 3.87 65 MAILING_LIST_MULTI 12882 3.16 1.84 3.85 66 BOTNET_IPINHOSTNAME 12703 6.88 12.88 3.79 67 T_REMOTE_IMAGE 12599 3.38 2.64 3.76 68 BAYES_999 11921 13.17 31.80 3.56 69 XMSubMetaSx_00 11746 4.25 5.71 3.51 70 T_TooManySym_02 11633 2.56 0.80 3.47 71 RCVD_IN_IADB_LISTED 11517 2.68 1.21 3.44 72 XM_SPF_SoftFail 11508 3.85 4.66 3.44 73 BAYES_20 11420 2.70 1.32 3.41 74 URI_NOVOWEL 11119 2.84 1.91 3.32 75 MPART_ALT_DIFF 11095 4.01 5.36 3.31 76 RCVD_IN_VALIDITY_CERTIFIED 11043 3.13 2.80 3.30 77 HTML_IMAGE_RATIO_04 10959 3.79 4.80 3.27 78 ANY_BOUNCE_MESSAGE 10871 2.61 1.37 3.25 79 BOUNCE_MESSAGE 10871 2.61 1.37 3.25 80 RCVD_IN_IADB_SPF 10194 2.36 1.04 3.04 81 TooManyTo_002 10008 2.22 0.74 2.99 82 XM_Body_Dirty_Words 9117 4.22 7.12 2.72 83 RCVD_IN_IADB_SENDERID 9081 2.11 0.94 2.71 84 XMNumbers 8899 3.00 3.68 2.66 85 DKIM_INVALID 8858 3.59 5.43 2.64 86 BAYES_95 8793 3.45 5.05 2.63 87 RCVD_IN_IADB_DK 8738 2.05 0.96 2.61 88 HTML_MIME_NO_HTML_TAG 8257 2.13 1.49 2.47 89 HTML_IMAGE_RATIO_06 7863 2.68 3.31 2.35 90 RCVD_IN_IADB_VOUCHED 7860 1.76 0.63 2.35 91 T_XMDrugObfuBody_14 7392 2.57 3.27 2.21 92 TR_XM_DKIM_Undo 7341 13.66 35.91 2.19 93 INVALID_MSGID 7249 1.47 0.11 2.16 94 HTML_IMAGE_RATIO_08 7222 2.85 4.20 2.16 95 MIME_HTML_MOSTLY 7071 2.71 3.86 2.11 96 TO_MALFORMED 7067 1.41 0.07 2.11 97 BAYES_05 6903 1.58 0.66 2.06 98 MIME_HTML_ONLY_MULTI 6550 2.42 3.32 1.96 99 XM_CamelCaseFrm001 6504 2.15 2.55 1.94 100 HELO_NODOT 6495 1.42 0.40 1.94 101 HELO_NO_DOMAIN 6491 1.41 0.39 1.94 102 TR_XM_SpammyRelay 6429 4.47 9.43 1.92 103 UNTRUSTED_Relay 6192 3.44 6.54 1.85 104 XMDiploma_00 6061 2.26 3.12 1.81 105 XMNoVowels 5896 1.31 0.45 1.76 106 TR_DCC_Bayes_99 5752 11.08 29.23 1.72 107 XM_DK_Undo_01 5723 1.72 1.75 1.71 108 TooManyTo_003 5664 1.34 0.66 1.69 109 XM_B_Investor 5604 2.58 4.33 1.67 110 T_XMDrugObfuBody_08 5533 2.19 3.24 1.65 111 FROM_EXCESS_BASE64 5429 1.63 1.64 1.62 112 RCVD_IN_IADB_OPTIN 5419 1.20 0.38 1.62 113 TR_Symld_Words 5071 1.43 1.27 1.51 114 TR_XM_UnparsRelay 5033 3.54 7.50 1.50 115 IN_HORDE_ADDRESS_BOOK 5004 1.01 0.07 1.49 116 TVD_RCVD_IP 4950 1.31 0.99 1.48 117 SUBJ_ALL_CAPS 4817 1.70 2.22 1.44 118 XMSexyCombo_05 4809 2.45 4.41 1.44 119 KHOP_HELO_FCRDNS 4796 1.41 1.36 1.43 120 TR_XM_PhishingBody 4769 2.20 3.71 1.42 121 TM2_M_URI_OPT_OUT 4737 1.80 2.55 1.41 122 TM2_M_VERY_LONG_WORD 4645 2.10 3.49 1.39 123 XM_B_Unsub2 4538 1.61 2.12 1.35 124 T_TooManySym_03 4537 1.00 0.30 1.35 125 XMStockSpam_06 4384 1.49 1.85 1.31 126 XM_B_SEO 4337 2.37 4.46 1.29 127 XM_SendGrid 4318 1.28 1.26 1.29 128 XMGappySubj_01 4245 0.90 0.19 1.27 129 TooManyTo_004 4179 1.03 0.61 1.25 130 XM_GoogleGroups 4157 1.04 0.65 1.24 131 TR_XM_SpammyWords5 3973 2.13 3.96 1.19 132 XM_TLDProd2 3944 0.87 0.27 1.18 133 XMCapTrack 3938 0.93 0.45 1.18 134 TVD_SPACE_RATIO 3803 0.79 0.11 1.14 135 RELAYCOUNTRY_CA 3802 2.22 4.32 1.14 136 BOTNET 3784 3.68 8.61 1.13 137 XMBSHREFv2 3615 0.86 0.43 1.08 138 URI_HEX 3568 1.21 1.48 1.07 139 XM_H_Long_From02 3558 0.97 0.78 1.06 140 TooManyTo_005 3548 0.90 0.59 1.06 141 TO_NO_BRKTS_HTML_ONLY 3471 0.75 0.20 1.04 142 XM_OfRef6 3396 2.14 4.32 1.01 143 SpammyFromTLD_01 3340 1.56 2.65 1.00 144 XMBrknScrpt_02 3119 1.46 2.50 0.93 145 XM_UB50 3116 1.77 3.39 0.93 146 HTTPS_HTTP_MISMATCH 3071 0.97 1.06 0.92 147 T_FILL_THIS_FORM_SHORT 2985 1.09 1.49 0.89 148 HTML_IMAGE_ONLY_32 2984 0.68 0.28 0.89 149 DKIM_ADSP_CUSTOM_MED 2928 0.89 0.93 0.87 150 XMGenDplmaNmb 2888 1.06 1.44 0.86 151 URI_TRY_3LD 2850 1.45 2.61 0.85 152 XMGappySubj_02 2849 0.59 0.08 0.85 153 TR_XM_DK_SendGrid 2766 0.80 0.74 0.83 154 TR_XM_SEO4 2758 1.85 3.84 0.82 155 TR_LOTS_OF_MONEY3 2704 2.63 6.16 0.81 156 XM_ShortIntro_01 2687 0.72 0.57 0.80 157 XMBody_95 2608 0.59 0.22 0.78 158 XMBdyGiftCard01 2549 0.78 0.81 0.76 159 XMBody_17 2546 2.20 4.99 0.76 160 XM_B_DNDMA 2525 0.78 0.84 0.75 161 TR_XM_Base64_M1 2482 0.76 0.81 0.74 162 RELAYCOUNTRY_AU 2416 1.23 2.21 0.72 163 XM_H_PHPMailer 2407 0.70 0.67 0.72 164 XMSubMetaI_00 2256 0.82 1.10 0.67 165 XM_RXBody 2256 0.55 0.32 0.67 166 TR_MetaPhish_Combo_01 2199 0.76 0.97 0.66 167 T_TooManySym_04 2197 0.45 0.05 0.66 168 T_OBFU_PDF_ATTACH 2158 0.47 0.12 0.64 169 TR_XM_SpammyWords2 2124 6.04 16.53 0.63 170 RCVD_IN_BL_SPAMCOP_NET 2075 2.94 7.44 0.62 171 SHORT_HELO_AND_INLINE_IMAGE 2007 0.41 0.06 0.60 172 USER_IN_WHITELIST 2006 0.40 0.00 0.60 173 USER_IN_WELCOMELIST 2006 0.40 0.00 0.60 174 HTML_TAG_BALANCE_BODY 1981 0.97 1.71 0.59 175 XM_ProductURIs 1937 0.84 1.33 0.58 176 NML_ADSP_CUSTOM_MED 1936 0.64 0.75 0.58 177 FROM_GOV_DKIM_AU 1875 0.42 0.16 0.56 178 T_XMDrugObfuBody_00 1832 0.94 1.71 0.55 179 NO_DNS_FOR_FROM 1819 0.49 0.38 0.54 180 XM_B_FormFill 1814 0.38 0.07 0.54 181 XM_B_SpammyWords4 1765 1.17 2.42 0.53 182 RELAYCOUNTRY_GB 1762 0.66 0.92 0.53 183 MSGID_FROM_MTA_HEADER 1732 0.38 0.10 0.52 184 XM_B_COPY_HTML 1675 0.68 1.02 0.50 185 MISSING_HEADERS 1623 0.53 0.61 0.48 186 XMPhish14 1622 0.56 0.69 0.48 187 MPART_ALT_DIFF_COUNT 1612 0.55 0.68 0.48 188 XMLngstWrd_00 1597 0.46 0.43 0.48 189 T_TVD_MIME_NO_HEADERS 1585 0.32 0.03 0.47 190 THIS_AD 1569 0.63 0.95 0.47 191 T_XMHurry_00 1553 1.14 2.46 0.46 192 RELAYCOUNTRY_NL 1547 0.37 0.18 0.46 193 XMMoneyMeta_00 1542 0.63 0.97 0.46 194 FORGED_GMAIL_RCVD 1528 0.54 0.70 0.46 195 TR_XM_FormFill2 1525 0.70 1.18 0.46 196 HTML_IMAGE_ONLY_20 1524 0.44 0.42 0.46 197 TR_XM_PHPDW 1517 0.71 1.21 0.45 198 TR_XM_PHPForged 1512 0.71 1.22 0.45 199 HTML_IMAGE_ONLY_28 1502 0.38 0.24 0.45 200 XM_H_PHPOS 1467 0.69 1.17 0.44 ----------------------------------------------------------------------