Email: 541721 Autolearn: 0 AvgScore: 4.28 AvgScanTime: 1.27 sec Spam: 177808 Autolearn: 0 AvgScore: 13.07 AvgScanTime: 1.45 sec Ham: 363913 Autolearn: 0 AvgScore: -0.01 AvgScanTime: 1.19 sec Time Spent Running SA: 191.74 hours Time Spent Processing Spam: 71.52 hours Time Spent Processing Ham: 120.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 173108 90.09 97.36 86.55 2 DKIM_SIGNED 163898 80.97 92.18 75.49 3 XM_DK_Pass 158564 79.07 89.18 74.13 4 DKIM_VALID 156941 78.08 88.26 73.10 5 XM_B_Unicode 156034 76.48 87.75 70.98 6 RELAYCOUNTRY_US 152318 82.23 85.66 80.56 7 DCC_CHECK 134409 51.13 75.59 39.17 8 XMListUnsubscribeExists 133539 58.38 75.10 50.21 9 XM_B_SpammyWords 130564 53.81 73.43 44.23 10 DKIM_VALID_AU 125459 62.68 70.56 58.83 11 XM_DK_Undo_02 84659 19.34 47.61 5.52 12 XM_B_Unicode3 83812 42.99 47.14 40.96 13 LOC_TINY_FONT_1 80373 32.31 45.20 26.00 14 XM_B_SpammyWords2 73599 26.05 41.39 18.56 15 HTML_FONT_LOW_CONTRAST 73521 33.11 41.35 29.09 16 BAYES_99 70231 15.72 39.50 4.10 17 RCVD_IN_MSPIKE_H2 65652 32.32 36.92 30.07 18 FVGT_m_MULTI_ODD 65333 28.96 36.74 25.15 19 BAYES_50 63800 52.18 35.88 60.15 20 TR_XM_DKIM_Undo 63539 13.52 35.73 2.66 21 BAYES_999 57036 12.66 32.08 3.17 22 T_KAM_HTML_FONT_INVALID 54963 24.47 30.91 21.33 23 TR_DCC_Bayes_99 51175 10.67 28.78 1.81 24 DKIM_VALID_EF 48822 28.06 27.46 28.35 25 MIME_HTML_ONLY 44954 21.14 25.28 19.11 26 DCC_CHECK_NEGATIVE 43382 48.84 24.40 60.78 27 T_TM2_M_HEADER_IN_MSG 41481 27.34 23.33 29.30 28 XMSubLong 38665 22.04 21.75 22.19 29 XM_Multi_Part_URI 37146 17.45 20.89 15.76 30 TR_XM_DK_Unsub 35384 14.93 19.90 12.50 31 XM_B_Unsub 28583 11.54 16.08 9.32 32 TR_XM_SpammyWords2 27798 5.70 15.63 0.84 33 TR_XM_BayesUnsub 27770 10.11 15.62 7.41 34 UNPARSEABLE_RELAY 26414 12.11 14.86 10.76 35 XM_B_SpammyWords3 25428 7.73 14.30 4.52 36 TR_MAX_INTL_RELAY 25093 9.03 14.11 6.54 37 LOTS_OF_MONEY 24552 8.53 13.81 5.94 38 BOTNET_IPINHOSTNAME 23854 6.62 13.42 3.30 39 RELAYCOUNTRY_META 23369 7.55 13.14 4.81 40 TR_XM_SpammyWords4 22280 6.81 12.53 4.02 41 XM_Evil_Numbers_Gen 17077 9.21 9.60 9.01 42 TR_XM_SpammyRelay 17055 4.75 9.59 2.38 43 BAYES_80 15455 5.51 8.69 3.95 44 TR_XM_UnparsRelay 15217 4.00 8.56 1.77 45 LotsOfNums_01 14216 8.26 8.00 8.39 46 RCVD_IN_BL_SPAMCOP_NET 14170 3.10 7.97 0.72 47 FSL_BULK_SIG 13358 6.49 7.51 5.99 48 BOTNET 13310 3.33 7.49 1.30 49 BAYES_60 13157 8.63 7.40 9.23 50 TR_XM_SPAMCOP 11810 2.45 6.64 0.40 51 HTML_IMAGE_RATIO_02 11629 5.25 6.54 4.62 52 XM_Body_Dirty_Words 11502 4.03 6.47 2.83 53 MPART_ALT_DIFF 10662 5.04 6.00 4.57 54 XM_B_PhoneNumber 10546 8.11 5.93 9.18 55 UNTRUSTED_Relay 9510 2.73 5.35 1.45 56 XM_H_Long_From01 9183 5.25 5.16 5.29 57 HTML_IMAGE_RATIO_08 9145 3.42 5.14 2.58 58 XMSubMetaSx_00 9143 3.70 5.14 2.99 59 HTML_IMAGE_RATIO_04 9125 4.58 5.13 4.31 60 BAYES_95 9072 3.41 5.10 2.59 61 XM_B_Investor 8939 2.84 5.03 1.77 62 HTML_IMAGE_RATIO_06 8852 3.71 4.98 3.09 63 XM_B_SEO 8820 2.50 4.96 1.29 64 XM_UncommonTLD01 8725 4.16 4.91 3.80 65 TR_XM_SpammyWords5 8607 2.42 4.84 1.24 66 XMBody_17 8255 1.85 4.64 0.48 67 RELAYCOUNTRY_CA 8152 2.63 4.58 1.68 68 XM_SPF_SoftFail 8117 3.17 4.57 2.48 69 TooManyTo_001 8075 6.98 4.54 8.17 70 XM_OfRef6 7983 2.18 4.49 1.05 71 TR_XM_SEO4 7950 2.03 4.47 0.84 72 XM_B_Phish_Phrases 7894 4.14 4.44 3.99 73 XMBrknScrpt_02 7608 2.24 4.28 1.24 74 XM_H_GMP 7565 4.84 4.25 5.12 75 TR_LOTS_OF_MONEY3 7084 1.64 3.98 0.49 76 DKIM_INVALID 6957 2.89 3.91 2.39 77 XMStrtUSub 6944 4.35 3.91 4.56 78 T_XMDrugObfuBody_14 6817 2.44 3.83 1.76 79 MIME_HTML_MOSTLY 6782 3.16 3.81 2.85 80 XMNumbers 6459 2.86 3.63 2.48 81 TR_XM_PhishingBody 6448 2.25 3.63 1.58 82 RCVD_IN_VALIDITY_SAFE 6445 4.27 3.62 4.58 83 MIME_QP_LONG_LINE 6442 4.86 3.62 5.47 84 XMSexyCombo_05 6359 2.30 3.58 1.68 85 XM_B_SpammyTLD 6078 4.14 3.42 4.50 86 SUBJ_ALL_CAPS 5991 2.11 3.37 1.49 87 MIME_HTML_ONLY_MULTI 5910 2.75 3.32 2.47 88 XM_CamelCaseFrm001 5808 2.65 3.27 2.35 89 USER_IN_DEF_DKIM_WL 5742 10.26 3.23 13.69 90 TM2_M_VERY_LONG_WORD 5709 1.86 3.21 1.20 91 XM_URI_RBL 5552 1.27 3.12 0.36 92 TM2_M_URI_OPT_OUT 5534 2.10 3.11 1.61 93 RCVD_IN_VALIDITY_RPBL 5361 1.13 3.02 0.21 94 XM_B_SpammyWords4 5294 1.42 2.98 0.65 95 T_XMDrugObfuBody_08 5272 1.91 2.96 1.39 96 RCVD_IN_VALIDITY_CERTIFIED 5033 3.36 2.83 3.62 97 XM_UB50 4983 1.54 2.80 0.93 98 ALL_TRUSTED 4809 11.80 2.70 16.25 99 T_TooManySym_01 4797 4.36 2.70 5.17 100 RCVD_IN_MSPIKE_WL 4785 4.49 2.69 5.37 101 RCVD_IN_MSPIKE_H3 4785 4.49 2.69 5.37 102 RELAYCOUNTRY_AU 4150 1.43 2.33 1.00 103 XM_B_Unsub2 4078 2.42 2.29 2.48 104 TR_Caps_n_Bayes_99 3786 0.73 2.13 0.05 105 XMDiploma_00 3773 1.85 2.12 1.72 106 XMSlimDrugH 3412 1.12 1.92 0.72 107 T_REMOTE_IMAGE 3374 2.96 1.90 3.47 108 MAILING_LIST_MULTI 3364 2.74 1.89 3.16 109 T_XMHurry_00 3341 0.93 1.88 0.47 110 HTML_TAG_BALANCE_BODY 3090 1.00 1.74 0.64 111 FROM_EXCESS_BASE64 3064 1.93 1.72 2.03 112 URI_HEX 2978 1.24 1.67 1.02 113 T_FILL_THIS_FORM_SHORT 2954 1.17 1.66 0.94 114 URI_TRY_3LD 2899 1.22 1.63 1.03 115 XMStockSpam_06 2893 1.34 1.63 1.21 116 XMBdyGiftCard01 2889 1.13 1.62 0.89 117 TR_XM_NoHeaderRelay 2817 0.63 1.58 0.16 118 SpammyFromTLD_01 2770 1.10 1.56 0.87 119 SpammyFromTLD_02 2738 0.82 1.54 0.47 120 AC_BR_BONANZA 2675 0.55 1.50 0.08 121 RCVD_IN_IADB_LISTED 2653 3.01 1.49 3.75 122 XM_H_Long_From02 2602 1.19 1.46 1.06 123 XM_DK_Undo_01 2574 1.69 1.45 1.81 124 BAYES_40 2511 4.14 1.41 5.47 125 XMSlimDrugs 2444 0.62 1.37 0.26 126 MY_SERVERS_FOUND 2354 0.69 1.32 0.38 127 XM_HighProb1 2351 0.45 1.32 0.02 128 XMClaimOffer 2338 0.53 1.31 0.15 129 RCVD_IN_IADB_SPF 2325 2.64 1.31 3.29 130 T_MONEY_PERCENT 2307 0.58 1.30 0.24 131 TR_LOTS_OF_MONEY2 2307 0.58 1.30 0.24 132 HTML_MIME_NO_HTML_TAG 2291 1.75 1.29 1.97 133 XMHTML_After_End 2222 0.63 1.25 0.32 134 T_XMDrugObfuBody_00 2207 0.86 1.24 0.68 135 KHOP_HELO_FCRDNS 2194 1.17 1.23 1.14 136 XM_SendGrid 2176 1.28 1.22 1.31 137 RCVD_IN_IADB_DK 2167 2.32 1.22 2.86 138 RCVD_IN_IADB_SENDERID 2158 2.37 1.21 2.93 139 THIS_AD 2112 0.66 1.19 0.40 140 TR_XM_INV_DKIM 2087 0.42 1.17 0.05 141 TR_MetaPhish_Combo_01 2057 0.86 1.16 0.71 142 XMSubMetaI_00 2045 0.90 1.15 0.78 143 XMPhish30 2038 0.75 1.15 0.56 144 URI_NOVOWEL 1991 2.56 1.12 3.27 145 XMGenDplmaNmb 1983 0.95 1.12 0.87 146 TR_XM_PHPForged 1971 0.62 1.11 0.39 147 XM_B_COPY_HTML 1957 0.83 1.10 0.70 148 URIBL_DBL_SPAM 1941 0.37 1.09 0.01 149 TR_XM_PHPDW 1933 0.62 1.09 0.39 150 HOSTED_IMG_MULTI_PUB_01 1930 0.41 1.09 0.08 151 TR_XM_FormFill2 1906 0.62 1.07 0.39 152 XM_H_PHPOS 1897 0.61 1.07 0.38 153 XM_ProductURIs 1878 0.75 1.06 0.59 154 TR_Symld_Words 1837 1.37 1.03 1.53 155 BAYES_20 1771 2.61 1.00 3.39 156 TM2_M_OBFU_COMMENT 1767 0.55 0.99 0.34 157 RDNS_DYNAMIC 1729 0.53 0.97 0.32 158 XMReplyNow 1729 0.47 0.97 0.23 159 PDS_RDNS_DYNAMIC_FP 1695 0.43 0.95 0.17 160 XMHTMLBadTable_001 1673 0.44 0.94 0.19 161 DIET_1 1649 0.51 0.93 0.30 162 TR_XM_FormFill 1624 0.31 0.91 0.02 163 XM_B_Phish66 1623 0.50 0.91 0.29 164 XMDateMe_00 1622 0.61 0.91 0.46 165 T_TooManySym_02 1619 2.10 0.91 2.68 166 HTML_FONT_FACE_BAD 1618 0.64 0.91 0.51 167 RELAYCOUNTRY_FR 1616 0.44 0.91 0.21 168 TR_XM_InvalidRelay 1598 0.31 0.90 0.03 169 LongTLD 1577 0.56 0.89 0.40 170 T_Symld_Words_02 1569 0.97 0.88 1.01 171 XMPhish14 1561 0.59 0.88 0.45 172 XM_B_DNDMA 1555 0.74 0.87 0.67 173 HTTPS_HTTP_MISMATCH 1548 0.88 0.87 0.88 174 TVD_RCVD_IP 1530 0.58 0.86 0.44 175 DKIM_ADSP_CUSTOM_MED 1527 0.81 0.86 0.79 176 XM_H_Undi_Recip 1521 0.39 0.86 0.17 177 T_STY_INVIS_DIRECT 1507 0.48 0.85 0.30 178 XM_S_SpammyWords 1448 0.36 0.81 0.14 179 TR_XM_Spammywords 1448 0.36 0.81 0.14 180 MPART_ALT_DIFF_COUNT 1440 0.58 0.81 0.47 181 RELAYCOUNTRY_GB 1381 0.56 0.78 0.46 182 SHOPIFY_IMG_NOT_RCVD_SFY 1377 0.47 0.77 0.32 183 XM_UB99 1374 0.26 0.77 0.00 184 TR_XM_DK_SendGrid 1357 0.80 0.76 0.82 185 RCVD_IN_IADB_VOUCHED 1349 1.94 0.76 2.51 186 TR_XM_Base64_M1 1317 0.69 0.74 0.67 187 TR_XM_Undi_Recip19 1278 0.28 0.72 0.07 188 HELO_DYNAMIC_SPLIT_IP 1276 0.24 0.72 0.01 189 BOTNET_NORDNS 1274 0.24 0.72 0.01 190 XMBody_78 1258 0.40 0.71 0.24 191 XM_UB60 1235 0.27 0.69 0.06 192 XMSexyCombo_01 1232 0.31 0.69 0.13 193 XMSubMetaSxObfu_03 1221 0.48 0.69 0.38 194 XM_DIRTYINTL 1213 0.30 0.68 0.12 195 TooManyTo_002 1205 1.89 0.68 2.48 196 DKIM_ADSP_NXDOMAIN 1203 0.40 0.68 0.27 197 PLING_QUERY 1201 0.68 0.68 0.68 198 TR_Mismatch_TLD_01 1189 0.35 0.67 0.20 199 PDS_OTHER_BAD_TLD 1188 0.29 0.67 0.11 200 TR_Mismatch_TLD_02 1179 0.26 0.66 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 314949 90.09 97.36 86.55 2 RELAYCOUNTRY_US 293164 82.23 85.66 80.56 3 DKIM_SIGNED 274720 80.97 92.18 75.49 4 XM_DK_Pass 269781 79.07 89.18 74.13 5 DKIM_VALID 266034 78.08 88.26 73.10 6 XM_B_Unicode 258297 76.48 87.75 70.98 7 DCC_CHECK_NEGATIVE 221187 48.84 24.40 60.78 8 BAYES_50 218888 52.18 35.88 60.15 9 DKIM_VALID_AU 214096 62.68 70.56 58.83 10 XMListUnsubscribeExists 182728 58.38 75.10 50.21 11 XM_B_SpammyWords 160957 53.81 73.43 44.23 12 XM_B_Unicode3 149062 42.99 47.14 40.96 13 DCC_CHECK 142562 51.13 75.59 39.17 14 RCVD_IN_MSPIKE_H2 109415 32.32 36.92 30.07 15 T_TM2_M_HEADER_IN_MSG 106634 27.34 23.33 29.30 16 HTML_FONT_LOW_CONTRAST 105849 33.11 41.35 29.09 17 DKIM_VALID_EF 103184 28.06 27.46 28.35 18 LOC_TINY_FONT_1 94630 32.31 45.20 26.00 19 FVGT_m_MULTI_ODD 91523 28.96 36.74 25.15 20 XMSubLong 80756 22.04 21.75 22.19 21 T_KAM_HTML_FONT_INVALID 77621 24.47 30.91 21.33 22 MIME_HTML_ONLY 69546 21.14 25.28 19.11 23 XM_B_SpammyWords2 67532 26.05 41.39 18.56 24 ALL_TRUSTED 59131 11.80 2.70 16.25 25 XM_Multi_Part_URI 57370 17.45 20.89 15.76 26 USER_IN_DEF_DKIM_WL 49826 10.26 3.23 13.69 27 TR_XM_DK_Unsub 45474 14.93 19.90 12.50 28 UNPARSEABLE_RELAY 39169 12.11 14.86 10.76 29 XM_B_Unsub 33934 11.54 16.08 9.32 30 BAYES_60 33606 8.63 7.40 9.23 31 XM_B_PhoneNumber 33414 8.11 5.93 9.18 32 BAYES_00 33361 6.33 0.53 9.17 33 XM_Evil_Numbers_Gen 32806 9.21 9.60 9.01 34 LotsOfNums_01 30521 8.26 8.00 8.39 35 TooManyTo_001 29749 6.98 4.54 8.17 36 XM_DKIMWhitelistDomains 27505 5.11 0.10 7.56 37 TR_XM_BayesUnsub 26979 10.11 15.62 7.41 38 IN_ZIMBRA_NJ_WHITELIST 24861 4.61 0.07 6.83 39 TR_MAX_INTL_RELAY 23806 9.03 14.11 6.54 40 TR_XM_DK_Bayes 23266 4.43 0.43 6.39 41 TR_XM_DK_Bayes1 22921 4.37 0.42 6.30 42 FSL_BULK_SIG 21789 6.49 7.51 5.99 43 LOTS_OF_MONEY 21633 8.53 13.81 5.94 44 XM_DK_Undo_02 20086 19.34 47.61 5.52 45 BAYES_40 19921 4.14 1.41 5.47 46 MIME_QP_LONG_LINE 19889 4.86 3.62 5.47 47 RCVD_IN_MSPIKE_WL 19544 4.49 2.69 5.37 48 RCVD_IN_MSPIKE_H3 19542 4.49 2.69 5.37 49 XM_H_Long_From01 19260 5.25 5.16 5.29 50 TR_XM_DK_Bayes2 18898 3.58 0.29 5.19 51 T_TooManySym_01 18823 4.36 2.70 5.17 52 XM_H_GMP 18633 4.84 4.25 5.12 53 RELAYCOUNTRY_META 17519 7.55 13.14 4.81 54 HTML_IMAGE_RATIO_02 16806 5.25 6.54 4.62 55 RCVD_IN_VALIDITY_SAFE 16669 4.27 3.62 4.58 56 MPART_ALT_DIFF 16637 5.04 6.00 4.57 57 XMStrtUSub 16601 4.35 3.91 4.56 58 XM_B_SpammyWords3 16449 7.73 14.30 4.52 59 XM_B_SpammyTLD 16363 4.14 3.42 4.50 60 HTML_IMAGE_RATIO_04 15693 4.58 5.13 4.31 61 XM_PDF 15528 3.05 0.55 4.27 62 BAYES_99 14921 15.72 39.50 4.10 63 TR_XM_SpammyWords4 14620 6.81 12.53 4.02 64 XM_B_Phish_Phrases 14530 4.14 4.44 3.99 65 BAYES_80 14371 5.51 8.69 3.95 66 XM_UncommonTLD01 13821 4.16 4.91 3.80 67 RCVD_IN_IADB_LISTED 13655 3.01 1.49 3.75 68 RCVD_IN_VALIDITY_CERTIFIED 13187 3.36 2.83 3.62 69 T_REMOTE_IMAGE 12634 2.96 1.90 3.47 70 BAYES_20 12341 2.61 1.00 3.39 71 BOTNET_IPINHOSTNAME 12018 6.62 13.42 3.30 72 RCVD_IN_IADB_SPF 11973 2.64 1.31 3.29 73 URI_NOVOWEL 11891 2.56 1.12 3.27 74 BAYES_999 11541 12.66 32.08 3.17 75 MAILING_LIST_MULTI 11502 2.74 1.89 3.16 76 HTML_IMAGE_RATIO_06 11245 3.71 4.98 3.09 77 BOUNCE_MESSAGE 11070 2.24 0.61 3.04 78 ANY_BOUNCE_MESSAGE 11070 2.24 0.61 3.04 79 XMSubMetaSx_00 10892 3.70 5.14 2.99 80 RCVD_IN_IADB_SENDERID 10662 2.37 1.21 2.93 81 RCVD_IN_IADB_DK 10417 2.32 1.22 2.86 82 MIME_HTML_MOSTLY 10359 3.16 3.81 2.85 83 XM_Body_Dirty_Words 10305 4.03 6.47 2.83 84 T_TooManySym_02 9771 2.10 0.91 2.68 85 TR_XM_DKIM_Undo 9687 13.52 35.73 2.66 86 BAYES_95 9425 3.41 5.10 2.59 87 HTML_IMAGE_RATIO_08 9394 3.42 5.14 2.58 88 RCVD_IN_IADB_VOUCHED 9152 1.94 0.76 2.51 89 XM_SPF_SoftFail 9038 3.17 4.57 2.48 90 XMNumbers 9034 2.86 3.63 2.48 91 TooManyTo_002 9031 1.89 0.68 2.48 92 XM_B_Unsub2 9029 2.42 2.29 2.48 93 MIME_HTML_ONLY_MULTI 8989 2.75 3.32 2.47 94 DKIM_INVALID 8686 2.89 3.91 2.39 95 TR_XM_SpammyRelay 8659 4.75 9.59 2.38 96 XM_CamelCaseFrm001 8543 2.65 3.27 2.35 97 FROM_EXCESS_BASE64 7390 1.93 1.72 2.03 98 INVALID_MSGID 7207 1.37 0.12 1.98 99 HTML_MIME_NO_HTML_TAG 7174 1.75 1.29 1.97 100 BAYES_05 7076 1.47 0.49 1.94 101 HELO_NODOT 6873 1.37 0.31 1.89 102 HELO_NO_DOMAIN 6870 1.37 0.31 1.89 103 TR_DCC_Bayes_99 6605 10.67 28.78 1.81 104 XM_DK_Undo_01 6586 1.69 1.45 1.81 105 TO_MALFORMED 6518 1.21 0.01 1.79 106 TR_XM_UnparsRelay 6430 4.00 8.56 1.77 107 XM_B_Investor 6428 2.84 5.03 1.77 108 T_XMDrugObfuBody_14 6397 2.44 3.83 1.76 109 RCVD_IN_IADB_OPTIN 6283 1.31 0.45 1.73 110 XMDiploma_00 6269 1.85 2.12 1.72 111 RELAYCOUNTRY_CA 6116 2.63 4.58 1.68 112 XMSexyCombo_05 6110 2.30 3.58 1.68 113 TM2_M_URI_OPT_OUT 5867 2.10 3.11 1.61 114 TR_XM_PhishingBody 5764 2.25 3.63 1.58 115 TR_Symld_Words 5569 1.37 1.03 1.53 116 SUBJ_ALL_CAPS 5414 2.11 3.37 1.49 117 UNTRUSTED_Relay 5283 2.73 5.35 1.45 118 TooManyTo_003 5282 1.17 0.59 1.45 119 IN_HORDE_ADDRESS_BOOK 5167 0.98 0.07 1.42 120 T_XMDrugObfuBody_08 5060 1.91 2.96 1.39 121 XM_GoogleGroups 4970 1.12 0.62 1.37 122 XM_SendGrid 4757 1.28 1.22 1.31 123 BOTNET 4730 3.33 7.49 1.30 124 XM_B_SEO 4712 2.50 4.96 1.29 125 XMBrknScrpt_02 4519 2.24 4.28 1.24 126 TR_XM_SpammyWords5 4507 2.42 4.84 1.24 127 XMStockSpam_06 4389 1.34 1.63 1.21 128 TM2_M_VERY_LONG_WORD 4358 1.86 3.21 1.20 129 KHOP_HELO_FCRDNS 4151 1.17 1.23 1.14 130 XMCapTrack 4067 0.90 0.47 1.12 131 XMGappySubj_01 4044 0.81 0.19 1.11 132 TVD_SPACE_RATIO 3977 0.77 0.11 1.09 133 XM_TLDProd2 3946 0.83 0.31 1.08 134 XM_H_Long_From02 3845 1.19 1.46 1.06 135 TooManyTo_004 3840 0.89 0.55 1.06 136 TR_XM_SpoofStaff 3839 0.74 0.09 1.05 137 XM_OfRef6 3830 2.18 4.49 1.05 138 XM_H_SpoofStaff4 3828 0.73 0.08 1.05 139 URI_TRY_3LD 3732 1.22 1.63 1.03 140 URI_HEX 3727 1.24 1.67 1.02 141 T_Symld_Words_02 3659 0.97 0.88 1.01 142 RELAYCOUNTRY_AU 3623 1.43 2.33 1.00 143 T_TooManySym_03 3528 0.73 0.23 0.97 144 T_FILL_THIS_FORM_SHORT 3405 1.17 1.66 0.94 145 XM_UB50 3372 1.54 2.80 0.93 146 FROM_GOV_DKIM_AU 3271 0.67 0.20 0.90 147 XMBdyGiftCard01 3226 1.13 1.62 0.89 148 HTTPS_HTTP_MISMATCH 3193 0.88 0.87 0.88 149 TooManyTo_005 3180 0.76 0.52 0.87 150 XMGenDplmaNmb 3174 0.95 1.12 0.87 151 SpammyFromTLD_01 3165 1.10 1.56 0.87 152 XM_H_Trusted_IP 3129 0.58 0.00 0.86 153 XMNoVowels 3118 0.73 0.48 0.86 154 TR_XM_SpammyWords2 3071 5.70 15.63 0.84 155 TR_XM_SEO4 3062 2.03 4.47 0.84 156 TR_XM_DK_SendGrid 2977 0.80 0.76 0.82 157 DKIM_ADSP_CUSTOM_MED 2868 0.81 0.86 0.79 158 XMSubMetaI_00 2824 0.90 1.15 0.78 159 XM_H_PHPMailer 2753 0.69 0.56 0.76 160 XM_ShortIntro_01 2674 0.63 0.41 0.73 161 XMSlimDrugH 2635 1.12 1.92 0.72 162 RCVD_IN_BL_SPAMCOP_NET 2619 3.10 7.97 0.72 163 TR_MetaPhish_Combo_01 2591 0.86 1.16 0.71 164 XM_B_COPY_HTML 2535 0.83 1.10 0.70 165 PLING_QUERY 2477 0.68 0.68 0.68 166 T_XMDrugObfuBody_00 2469 0.86 1.24 0.68 167 TR_XM_Base64_M1 2441 0.69 0.74 0.67 168 XM_B_DNDMA 2434 0.74 0.87 0.67 169 XM_B_SpammyWords4 2380 1.42 2.98 0.65 170 HTML_TAG_BALANCE_BODY 2345 1.00 1.74 0.64 171 XMBody_95 2220 0.55 0.41 0.61 172 HTML_EXTRA_CLOSE 2210 0.42 0.02 0.61 173 T_OBFU_PDF_ATTACH 2203 0.45 0.12 0.61 174 XM_ProductURIs 2159 0.75 1.06 0.59 175 SHORT_HELO_AND_INLINE_IMAGE 2150 0.41 0.04 0.59 176 TO_NO_BRKTS_HTML_ONLY 2123 0.46 0.21 0.58 177 XMSubNoVowel 2024 0.56 0.56 0.56 178 XMPhish30 2023 0.75 1.15 0.56 179 XMMoneyMeta_00 1887 0.56 0.65 0.52 180 NML_ADSP_CUSTOM_MED 1885 0.55 0.61 0.52 181 T_MANY_PILL_PRICE 1866 0.35 0.00 0.51 182 HTML_FONT_FACE_BAD 1855 0.64 0.91 0.51 183 XMLngstWrd_00 1797 0.44 0.34 0.49 184 TR_LOTS_OF_MONEY3 1788 1.64 3.98 0.49 185 XMGappySubj_02 1788 0.36 0.09 0.49 186 XMBody_17 1761 1.85 4.64 0.48 187 SpammyFromTLD_02 1714 0.82 1.54 0.47 188 T_XMHurry_00 1704 0.93 1.88 0.47 189 MPART_ALT_DIFF_COUNT 1695 0.58 0.81 0.47 190 XMDateMe_00 1688 0.61 0.91 0.46 191 RELAYCOUNTRY_GB 1669 0.56 0.78 0.46 192 HTML_IMAGE_ONLY_28 1659 0.42 0.36 0.46 193 XMPhish14 1647 0.59 0.88 0.45 194 HTML_IMAGE_ONLY_20 1637 0.42 0.36 0.45 195 TVD_RCVD_IP 1599 0.58 0.86 0.44 196 HTML_IMAGE_ONLY_32 1596 0.35 0.18 0.44 197 FORGED_GMAIL_RCVD 1584 0.51 0.65 0.44 198 USER_IN_WELCOMELIST 1581 0.29 0.00 0.43 199 USER_IN_WHITELIST 1581 0.29 0.00 0.43 200 T_TooManySym_04 1463 0.29 0.07 0.40 ----------------------------------------------------------------------