Email: 626567 Autolearn: 0 AvgScore: 5.04 AvgScanTime: 1.97 sec Spam: 219614 Autolearn: 0 AvgScore: 14.04 AvgScanTime: 2.22 sec Ham: 406953 Autolearn: 0 AvgScore: 0.18 AvgScanTime: 1.84 sec Time Spent Running SA: 342.67 hours Time Spent Processing Spam: 135.17 hours Time Spent Processing Ham: 207.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 211161 90.82 96.15 87.94 2 DKIM_SIGNED 198195 82.45 90.25 78.25 3 XM_B_Unicode 192493 78.09 87.65 72.94 4 RELAYCOUNTRY_US 191861 84.79 87.36 83.39 5 XM_DK_Pass 189909 80.26 86.47 76.90 6 DKIM_VALID 187194 79.21 85.24 75.96 7 DCC_CHECK 166881 52.75 75.99 40.21 8 XM_B_SpammyWords 159016 56.90 72.41 48.52 9 XMListUnsubscribeExists 158534 60.53 72.19 54.24 10 DKIM_VALID_AU 151467 62.91 68.97 59.63 11 XM_B_Unicode3 108267 45.20 49.30 42.99 12 LOC_TINY_FONT_1 106687 35.55 48.58 28.51 13 HTML_FONT_LOW_CONTRAST 95188 34.12 43.34 29.14 14 XM_DK_Undo_02 93132 18.46 42.41 5.53 15 BAYES_50 90013 53.86 40.99 60.81 16 XM_B_SpammyWords2 89474 26.98 40.74 19.55 17 FVGT_m_MULTI_ODD 81478 29.50 37.10 25.40 18 RCVD_IN_MSPIKE_H2 79121 32.56 36.03 30.68 19 BAYES_99 70643 13.60 32.17 3.59 20 TR_XM_DKIM_Undo 67393 12.29 30.69 2.36 21 T_KAM_HTML_FONT_INVALID 62921 24.71 28.65 22.58 22 DKIM_VALID_EF 57227 27.11 26.06 27.68 23 BAYES_999 56116 10.68 25.55 2.65 24 MIME_HTML_ONLY 54761 20.71 24.94 18.43 25 TR_DCC_Bayes_99 52800 9.23 24.04 1.24 26 XMSubLong 50518 21.54 23.00 20.76 27 DCC_CHECK_NEGATIVE 50046 46.79 22.79 59.74 28 T_TM2_M_HEADER_IN_MSG 49680 26.04 22.62 27.88 29 XM_Multi_Part_URI 47701 17.12 21.72 14.64 30 TR_XM_DK_Unsub 40826 14.76 18.59 12.69 31 LOTS_OF_MONEY 40383 11.86 18.39 8.34 32 UNPARSEABLE_RELAY 38492 12.96 17.53 10.50 33 XM_B_Unsub 37847 11.54 17.23 8.47 34 TR_XM_BayesUnsub 36747 10.43 16.73 7.03 35 TR_XM_SpammyWords4 35634 9.25 16.23 5.49 36 XM_B_SpammyWords3 31097 8.09 14.16 4.81 37 TR_MAX_INTL_RELAY 30333 9.11 13.81 6.56 38 XM_Evil_Numbers_Gen 27932 10.99 12.72 10.05 39 BOTNET_IPINHOSTNAME 27234 6.51 12.40 3.33 40 RELAYCOUNTRY_META 26644 6.72 12.13 3.80 41 TR_XM_SpammyWords2 24835 4.27 11.31 0.47 42 LotsOfNums_01 20939 9.90 9.53 10.10 43 RCVD_IN_BL_SPAMCOP_NET 20488 3.87 9.33 0.93 44 TR_XM_UnparsRelay 19708 4.26 8.97 1.72 45 BAYES_80 19264 5.65 8.77 3.97 46 TR_XM_SpammyRelay 18364 4.27 8.36 2.06 47 BOTNET 18031 3.86 8.21 1.51 48 BAYES_60 18022 8.86 8.21 9.21 49 FSL_BULK_SIG 17792 6.43 8.10 5.53 50 TR_LOTS_OF_MONEY3 16895 4.53 7.69 2.83 51 TR_XM_SPAMCOP 15980 2.88 7.28 0.50 52 XM_B_PhoneNumber 15602 8.55 7.10 9.34 53 HTML_IMAGE_RATIO_02 15225 5.68 6.93 5.00 54 XM_Body_Dirty_Words 14439 3.83 6.57 2.36 55 HTML_IMAGE_RATIO_04 14051 5.93 6.40 5.67 56 XM_B_Phish_Phrases 13397 4.97 6.10 4.36 57 MPART_ALT_DIFF 12238 4.65 5.57 4.15 58 UNTRUSTED_Relay 12164 2.89 5.54 1.47 59 XM_H_Long_From01 11825 5.39 5.38 5.40 60 XMSubMetaSx_00 11825 3.61 5.38 2.65 61 XM_UncommonTLD01 11603 4.05 5.28 3.38 62 TooManyTo_001 11163 6.50 5.08 7.27 63 TM2_M_VERY_LONG_WORD 11154 3.43 5.08 2.55 64 DKIM_INVALID 11001 3.24 5.01 2.28 65 XM_B_SEO 10900 2.62 4.96 1.35 66 TR_XM_SpammyWords5 10596 3.06 4.82 2.11 67 BAYES_95 10511 3.36 4.79 2.59 68 XM_B_SpammyTLD 10405 4.07 4.74 3.71 69 XMSexyCombo_05 9753 2.09 4.44 0.82 70 XM_SPF_SoftFail 9689 2.71 4.41 1.80 71 XMStrtUSub 9631 4.67 4.39 4.82 72 XM_B_Investor 9392 2.47 4.28 1.49 73 HTML_IMAGE_RATIO_06 9359 3.70 4.26 3.40 74 TR_XM_SEO4 9340 2.05 4.25 0.86 75 HTML_IMAGE_RATIO_08 8748 3.18 3.98 2.75 76 TR_XM_PhishingBody 8612 2.56 3.92 1.82 77 XMNumbers 8428 3.05 3.84 2.62 78 USER_IN_DEF_DKIM_WL 8387 10.20 3.82 13.65 79 XM_H_GMP 8297 4.49 3.78 4.87 80 RELAYCOUNTRY_CA 8170 1.95 3.72 1.00 81 MIME_QP_LONG_LINE 8024 5.36 3.65 6.28 82 XMBody_17 7512 1.63 3.42 0.66 83 T_XMDrugObfuBody_14 7497 2.36 3.41 1.80 84 T_XMHurry_00 7356 1.81 3.35 0.98 85 MIME_HTML_ONLY_MULTI 7215 2.61 3.29 2.25 86 RCVD_IN_VALIDITY_SAFE 7026 3.97 3.20 4.39 87 RCVD_IN_MSPIKE_WL 6828 4.79 3.11 5.70 88 RCVD_IN_MSPIKE_H3 6827 4.79 3.11 5.70 89 T_XMDrugObfuBody_08 6751 1.98 3.07 1.39 90 SUBJ_ALL_CAPS 6745 2.50 3.07 2.19 91 TM2_M_URI_OPT_OUT 6573 2.23 2.99 1.82 92 XM_URI_RBL 6561 1.29 2.99 0.37 93 XM_UB50 6516 1.64 2.97 0.93 94 XM_B_SpammyWords4 6505 1.38 2.96 0.52 95 XMBrknScrpt_02 6319 1.63 2.88 0.96 96 XM_CamelCaseFrm001 6185 2.35 2.82 2.10 97 MIME_HTML_MOSTLY 6120 2.48 2.79 2.31 98 XM_OfRef6 6111 1.52 2.78 0.84 99 RCVD_IN_VALIDITY_RPBL 6011 1.06 2.74 0.16 100 XM_B_URI_Unicode 5868 2.18 2.67 1.92 101 XMDiploma_00 5818 2.12 2.65 1.84 102 XM_B_Unsub2 5637 1.79 2.57 1.37 103 ANY_BOUNCE_MESSAGE 5530 3.63 2.52 4.23 104 BOUNCE_MESSAGE 5530 3.63 2.52 4.23 105 RCVD_IN_VALIDITY_CERTIFIED 5292 3.17 2.41 3.57 106 URI_HEX 5081 1.66 2.31 1.31 107 T_TooManySym_01 4821 4.20 2.20 5.28 108 TR_LOTS_OF_MONEY2 4719 1.05 2.15 0.46 109 T_MONEY_PERCENT 4719 1.05 2.15 0.46 110 RELAYCOUNTRY_AU 4593 1.26 2.09 0.81 111 KHOP_HELO_FCRDNS 4452 1.83 2.03 1.72 112 TR_XM_NoHeaderRelay 4352 0.77 1.98 0.12 113 SpammyFromTLD_02 4235 0.92 1.93 0.37 114 XMSubMetaI_00 4089 1.17 1.86 0.80 115 FROM_EXCESS_BASE64 3895 1.92 1.77 2.00 116 XMStockSpam_06 3829 1.26 1.74 0.99 117 SpammyFromTLD_01 3825 1.09 1.74 0.73 118 THIS_AD 3820 0.99 1.74 0.58 119 MAILING_LIST_MULTI 3637 2.45 1.66 2.88 120 XMGenDplmaNmb 3571 1.16 1.63 0.91 121 RCVD_IN_IADB_LISTED 3532 3.88 1.61 5.10 122 T_XMDrugObfuBody_00 3476 1.23 1.58 1.04 123 BAYES_40 3374 3.73 1.54 4.91 124 T_FILL_THIS_FORM_SHORT 3359 1.12 1.53 0.89 125 T_REMOTE_IMAGE 3319 2.56 1.51 3.13 126 XM_B_REG_HTML 3293 0.64 1.50 0.17 127 RCVD_IN_IADB_SPF 3176 3.41 1.45 4.47 128 URI_NOVOWEL 3165 2.47 1.44 3.02 129 XM_B_Phish66 3156 0.92 1.44 0.65 130 MIME_CHARSET_FARAWAY 3128 0.76 1.42 0.40 131 XM_DK_Undo_01 3088 1.53 1.41 1.60 132 RCVD_IN_IADB_DK 3008 2.99 1.37 3.87 133 RCVD_IN_IADB_SENDERID 3003 3.07 1.37 3.99 134 URI_TRY_3LD 2919 0.98 1.33 0.79 135 XMBdyGiftCard01 2873 1.00 1.31 0.83 136 TR_Caps_n_Bayes_99 2809 0.50 1.28 0.09 137 XM_SendGrid 2734 1.38 1.24 1.45 138 XM_H_Long_From02 2707 1.07 1.23 0.99 139 HTML_TAG_BALANCE_BODY 2701 0.85 1.23 0.64 140 T_Symld_Words_02 2669 0.88 1.22 0.70 141 SHORTCIRCUIT 2665 0.43 1.21 0.00 142 RCVD_IN_ZEN_LASTEXTERNAL 2665 0.43 1.21 0.00 143 TR_XM_FormFill 2619 0.42 1.19 0.01 144 MPART_ALT_DIFF_COUNT 2603 0.74 1.19 0.50 145 SHOPIFY_IMG_NOT_RCVD_SFY 2564 0.53 1.17 0.19 146 BAYES_20 2548 2.62 1.16 3.40 147 TR_XM_PHPDW 2528 0.81 1.15 0.62 148 TR_XM_PHPForged 2526 0.81 1.15 0.62 149 TooManyTo_002 2520 1.73 1.15 2.05 150 TR_XM_INV_DKIM 2473 0.43 1.13 0.05 151 TR_XM_FormFill2 2464 0.80 1.12 0.62 152 XM_H_PHPOS 2451 0.79 1.12 0.61 153 HTML_MIME_NO_HTML_TAG 2418 1.55 1.10 1.79 154 RELAYCOUNTRY_FR 2383 0.54 1.09 0.25 155 DKIM_ADSP_CUSTOM_MED 2375 0.98 1.08 0.92 156 XMPhish30 2373 0.68 1.08 0.47 157 TR_Mismatch_TLD_02 2332 0.41 1.06 0.06 158 DKIM_ADSP_NXDOMAIN 2276 0.54 1.04 0.27 159 XM_B_COPY_HTML 2270 0.70 1.03 0.52 160 TR_MetaPhish_Combo_01 2264 0.81 1.03 0.69 161 XM_HighProb1 2263 0.37 1.03 0.01 162 XM_ProductURIs 2194 0.70 1.00 0.53 163 HTTPS_HTTP_MISMATCH 2192 0.92 1.00 0.88 164 CHARSET_FARAWAY_HEADER 2165 0.44 0.99 0.15 165 TM2_M_OBFU_COMMENT 2048 0.56 0.93 0.36 166 LongTLD 2004 0.53 0.91 0.33 167 ALL_TRUSTED 1993 9.15 0.91 13.59 168 XM_BadFromFormat 1987 0.40 0.90 0.12 169 TVD_RCVD_IP 1975 0.57 0.90 0.39 170 XMHTMLBadTable_001 1963 0.52 0.89 0.32 171 TM2_M_A_HREF_HREF 1924 0.45 0.88 0.22 172 XMSolicitRefs_0 1893 0.50 0.86 0.31 173 AC_BR_BONANZA 1873 0.34 0.85 0.07 174 RDNS_DYNAMIC 1866 0.48 0.85 0.28 175 XMHTML_After_End 1862 0.49 0.85 0.29 176 DIET_1 1830 0.45 0.83 0.24 177 PDS_RDNS_DYNAMIC_FP 1827 0.39 0.83 0.15 178 XM_B_DNDMA 1765 0.57 0.80 0.45 179 XMLngstWrd_00 1762 0.72 0.80 0.67 180 XM_UB99 1727 0.28 0.79 0.00 181 TR_Symld_Words 1714 1.38 0.78 1.71 182 FORGED_GMAIL_RCVD 1682 0.66 0.77 0.61 183 TR_XM_InvalidRelay 1676 0.28 0.76 0.02 184 T_STY_INVIS_DIRECT 1654 0.47 0.75 0.31 185 LOW_PRICE 1647 0.37 0.75 0.17 186 NML_ADSP_CUSTOM_MED 1645 0.66 0.75 0.61 187 TR_XM_DK_SendGrid 1630 0.85 0.74 0.91 188 XMPhish14 1610 0.48 0.73 0.34 189 XM_H_Undi_Recip 1593 0.36 0.73 0.16 190 XMReplyNow 1565 0.42 0.71 0.26 191 XMMoneyMeta_00 1521 0.50 0.69 0.39 192 TR_XM_Base64_M1 1504 0.78 0.68 0.84 193 HELO_DYNAMIC_SPLIT_IP 1498 0.24 0.68 0.01 194 RCVD_IN_IADB_VOUCHED 1488 2.40 0.68 3.34 195 XM_UB60 1479 0.27 0.67 0.06 196 XMBody_78 1468 0.37 0.67 0.22 197 XM_Body_Obfu01 1468 0.65 0.67 0.64 198 XMPhish08 1450 0.43 0.66 0.31 199 XMSexyCombo_01 1445 0.36 0.66 0.20 200 DEAR_FRIEND 1432 0.40 0.65 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 357868 90.82 96.15 87.94 2 RELAYCOUNTRY_US 339378 84.79 87.36 83.39 3 DKIM_SIGNED 318429 82.45 90.25 78.25 4 XM_DK_Pass 312944 80.26 86.47 76.90 5 DKIM_VALID 309136 79.21 85.24 75.96 6 XM_B_Unicode 296816 78.09 87.65 72.94 7 BAYES_50 247474 53.86 40.99 60.81 8 DCC_CHECK_NEGATIVE 243100 46.79 22.79 59.74 9 DKIM_VALID_AU 242686 62.91 68.97 59.63 10 XMListUnsubscribeExists 220725 60.53 72.19 54.24 11 XM_B_SpammyWords 197472 56.90 72.41 48.52 12 XM_B_Unicode3 174963 45.20 49.30 42.99 13 DCC_CHECK 163638 52.75 75.99 40.21 14 RCVD_IN_MSPIKE_H2 124868 32.56 36.03 30.68 15 HTML_FONT_LOW_CONTRAST 118566 34.12 43.34 29.14 16 LOC_TINY_FONT_1 116029 35.55 48.58 28.51 17 T_TM2_M_HEADER_IN_MSG 113458 26.04 22.62 27.88 18 DKIM_VALID_EF 112628 27.11 26.06 27.68 19 FVGT_m_MULTI_ODD 103359 29.50 37.10 25.40 20 T_KAM_HTML_FONT_INVALID 91886 24.71 28.65 22.58 21 XMSubLong 84472 21.54 23.00 20.76 22 XM_B_SpammyWords2 79570 26.98 40.74 19.55 23 MIME_HTML_ONLY 74996 20.71 24.94 18.43 24 XM_Multi_Part_URI 59558 17.12 21.72 14.64 25 USER_IN_DEF_DKIM_WL 55538 10.20 3.82 13.65 26 ALL_TRUSTED 55314 9.15 0.91 13.59 27 TR_XM_DK_Unsub 51630 14.76 18.59 12.69 28 UNPARSEABLE_RELAY 42738 12.96 17.53 10.50 29 LotsOfNums_01 41083 9.90 9.53 10.10 30 XM_Evil_Numbers_Gen 40912 10.99 12.72 10.05 31 BAYES_00 38573 6.38 0.63 9.48 32 XM_B_PhoneNumber 37997 8.55 7.10 9.34 33 BAYES_60 37475 8.86 8.21 9.21 34 XM_B_Unsub 34463 11.54 17.23 8.47 35 LOTS_OF_MONEY 33942 11.86 18.39 8.34 36 TooManyTo_001 29584 6.50 5.08 7.27 37 TR_XM_BayesUnsub 28621 10.43 16.73 7.03 38 XM_DKIMWhitelistDomains 28092 4.50 0.03 6.90 39 TR_MAX_INTL_RELAY 26716 9.11 13.81 6.56 40 IN_ZIMBRA_NJ_WHITELIST 26655 4.28 0.08 6.55 41 TR_XM_DK_Bayes 26621 4.43 0.51 6.54 42 TR_XM_DK_Bayes1 26058 4.33 0.50 6.40 43 MIME_QP_LONG_LINE 25560 5.36 3.65 6.28 44 RCVD_IN_MSPIKE_WL 23179 4.79 3.11 5.70 45 RCVD_IN_MSPIKE_H3 23179 4.79 3.11 5.70 46 HTML_IMAGE_RATIO_04 23080 5.93 6.40 5.67 47 XM_DK_Undo_02 22519 18.46 42.41 5.53 48 FSL_BULK_SIG 22517 6.43 8.10 5.53 49 TR_XM_SpammyWords4 22344 9.25 16.23 5.49 50 XM_H_Long_From01 21961 5.39 5.38 5.40 51 TR_XM_DK_Bayes2 21798 3.60 0.34 5.36 52 T_TooManySym_01 21467 4.20 2.20 5.28 53 RCVD_IN_IADB_LISTED 20763 3.88 1.61 5.10 54 HTML_IMAGE_RATIO_02 20366 5.68 6.93 5.00 55 BAYES_40 19987 3.73 1.54 4.91 56 XM_H_GMP 19835 4.49 3.78 4.87 57 XMStrtUSub 19611 4.67 4.39 4.82 58 XM_B_SpammyWords3 19584 8.09 14.16 4.81 59 RCVD_IN_IADB_SPF 18195 3.41 1.45 4.47 60 RCVD_IN_VALIDITY_SAFE 17848 3.97 3.20 4.39 61 XM_B_Phish_Phrases 17757 4.97 6.10 4.36 62 ANY_BOUNCE_MESSAGE 17198 3.63 2.52 4.23 63 BOUNCE_MESSAGE 17198 3.63 2.52 4.23 64 MPART_ALT_DIFF 16872 4.65 5.57 4.15 65 RCVD_IN_IADB_SENDERID 16256 3.07 1.37 3.99 66 BAYES_80 16150 5.65 8.77 3.97 67 RCVD_IN_IADB_DK 15743 2.99 1.37 3.87 68 RELAYCOUNTRY_META 15454 6.72 12.13 3.80 69 XM_B_SpammyTLD 15114 4.07 4.74 3.71 70 XM_PDF 14977 2.52 0.36 3.68 71 BAYES_99 14601 13.60 32.17 3.59 72 RCVD_IN_VALIDITY_CERTIFIED 14539 3.17 2.41 3.57 73 BAYES_20 13847 2.62 1.16 3.40 74 HTML_IMAGE_RATIO_06 13823 3.70 4.26 3.40 75 XM_UncommonTLD01 13744 4.05 5.28 3.38 76 RCVD_IN_IADB_VOUCHED 13575 2.40 0.68 3.34 77 BOTNET_IPINHOSTNAME 13569 6.51 12.40 3.33 78 T_REMOTE_IMAGE 12735 2.56 1.51 3.13 79 URI_NOVOWEL 12306 2.47 1.44 3.02 80 MAILING_LIST_MULTI 11734 2.45 1.66 2.88 81 TR_LOTS_OF_MONEY3 11503 4.53 7.69 2.83 82 HTML_IMAGE_RATIO_08 11172 3.18 3.98 2.75 83 XMSubMetaSx_00 10779 3.61 5.38 2.65 84 BAYES_999 10777 10.68 25.55 2.65 85 XMNumbers 10679 3.05 3.84 2.62 86 BAYES_95 10551 3.36 4.79 2.59 87 TM2_M_VERY_LONG_WORD 10361 3.43 5.08 2.55 88 TR_XM_DKIM_Undo 9589 12.29 30.69 2.36 89 XM_Body_Dirty_Words 9588 3.83 6.57 2.36 90 MIME_HTML_MOSTLY 9417 2.48 2.79 2.31 91 DKIM_INVALID 9293 3.24 5.01 2.28 92 RCVD_IN_IADB_OPTIN 9254 1.63 0.44 2.27 93 T_TooManySym_02 9227 1.70 0.64 2.27 94 MIME_HTML_ONLY_MULTI 9154 2.61 3.29 2.25 95 SUBJ_ALL_CAPS 8916 2.50 3.07 2.19 96 TR_XM_SpammyWords5 8589 3.06 4.82 2.11 97 XM_CamelCaseFrm001 8546 2.35 2.82 2.10 98 TR_XM_SpammyRelay 8403 4.27 8.36 2.06 99 TooManyTo_002 8338 1.73 1.15 2.05 100 BAYES_05 8281 1.51 0.54 2.03 101 FROM_EXCESS_BASE64 8158 1.92 1.77 2.00 102 XM_B_URI_Unicode 7806 2.18 2.67 1.92 103 XMDiploma_00 7477 2.12 2.65 1.84 104 TR_XM_PhishingBody 7417 2.56 3.92 1.82 105 TM2_M_URI_OPT_OUT 7411 2.23 2.99 1.82 106 INVALID_MSGID 7327 1.20 0.09 1.80 107 XM_SPF_SoftFail 7321 2.71 4.41 1.80 108 T_XMDrugObfuBody_14 7305 2.36 3.41 1.80 109 HTML_MIME_NO_HTML_TAG 7286 1.55 1.10 1.79 110 KHOP_HELO_FCRDNS 7017 1.83 2.03 1.72 111 TR_XM_UnparsRelay 6996 4.26 8.97 1.72 112 TR_Symld_Words 6962 1.38 0.78 1.71 113 TO_MALFORMED 6564 1.07 0.05 1.61 114 XM_DK_Undo_01 6496 1.53 1.41 1.60 115 BOTNET 6150 3.86 8.21 1.51 116 XM_B_Investor 6072 2.47 4.28 1.49 117 IN_HORDE_ADDRESS_BOOK 6055 1.00 0.10 1.49 118 UNTRUSTED_Relay 5968 2.89 5.54 1.47 119 XM_SendGrid 5898 1.38 1.24 1.45 120 T_XMDrugObfuBody_08 5661 1.98 3.07 1.39 121 XM_B_Unsub2 5583 1.79 2.57 1.37 122 XM_B_SEO 5503 2.62 4.96 1.35 123 TooManyTo_003 5474 1.06 0.52 1.35 124 URI_HEX 5325 1.66 2.31 1.31 125 TR_DCC_Bayes_99 5039 9.23 24.04 1.24 126 XMGappySubj_01 4506 0.78 0.17 1.11 127 TVD_SPACE_RATIO 4401 0.73 0.08 1.08 128 XM_GoogleGroups 4350 0.88 0.54 1.07 129 T_XMDrugObfuBody_00 4228 1.23 1.58 1.04 130 HELO_NODOT 4122 0.73 0.19 1.01 131 HELO_NO_DOMAIN 4115 0.72 0.19 1.01 132 XMCapTrack 4095 0.84 0.53 1.01 133 RELAYCOUNTRY_CA 4054 1.95 3.72 1.00 134 XMStockSpam_06 4045 1.26 1.74 0.99 135 XM_H_Long_From02 4023 1.07 1.23 0.99 136 T_XMHurry_00 3975 1.81 3.35 0.98 137 TooManyTo_004 3947 0.80 0.50 0.97 138 XMBrknScrpt_02 3905 1.63 2.88 0.96 139 RCVD_IN_BL_SPAMCOP_NET 3790 3.87 9.33 0.93 140 XM_UB50 3790 1.64 2.97 0.93 141 DKIM_ADSP_CUSTOM_MED 3752 0.98 1.08 0.92 142 TR_XM_DK_SendGrid 3723 0.85 0.74 0.91 143 XMGenDplmaNmb 3687 1.16 1.63 0.91 144 T_FILL_THIS_FORM_SHORT 3634 1.12 1.53 0.89 145 HTTPS_HTTP_MISMATCH 3566 0.92 1.00 0.88 146 TR_XM_SEO4 3499 2.05 4.25 0.86 147 FROM_GOV_DKIM_AU 3449 0.66 0.31 0.85 148 XM_OfRef6 3406 1.52 2.78 0.84 149 TR_XM_Base64_M1 3404 0.78 0.68 0.84 150 XMBdyGiftCard01 3362 1.00 1.31 0.83 151 XMSexyCombo_05 3354 2.09 4.44 0.82 152 RELAYCOUNTRY_AU 3311 1.26 2.09 0.81 153 TooManyTo_005 3277 0.69 0.48 0.81 154 XMSubMetaI_00 3266 1.17 1.86 0.80 155 T_TooManySym_03 3266 0.60 0.23 0.80 156 URI_TRY_3LD 3206 0.98 1.33 0.79 157 XM_H_Trusted_IP 3200 0.51 0.00 0.79 158 XM_TLDProd2 3021 0.60 0.33 0.74 159 SpammyFromTLD_01 2978 1.09 1.74 0.73 160 T_Symld_Words_02 2859 0.88 1.22 0.70 161 TR_MetaPhish_Combo_01 2823 0.81 1.03 0.69 162 XM_ShortIntro_01 2765 0.66 0.63 0.68 163 XM_H_PHPMailer 2756 0.60 0.46 0.68 164 XMLngstWrd_00 2730 0.72 0.80 0.67 165 XMBody_17 2694 1.63 3.42 0.66 166 XM_B_Phish66 2632 0.92 1.44 0.65 167 HTML_TAG_BALANCE_BODY 2603 0.85 1.23 0.64 168 XM_Body_Obfu01 2601 0.65 0.67 0.64 169 TR_XM_PHPDW 2528 0.81 1.15 0.62 170 TR_XM_FormFill2 2527 0.80 1.12 0.62 171 TR_XM_PHPForged 2524 0.81 1.15 0.62 172 XM_H_PHPOS 2492 0.79 1.12 0.61 173 FORGED_GMAIL_RCVD 2468 0.66 0.77 0.61 174 NML_ADSP_CUSTOM_MED 2464 0.66 0.75 0.61 175 XMGappySubj_02 2451 0.43 0.10 0.60 176 THIS_AD 2358 0.99 1.74 0.58 177 XMNoVowels 2332 0.53 0.46 0.57 178 XMSubNoVowel 2302 0.45 0.25 0.57 179 RCVD_IN_PBL 2263 0.59 0.65 0.56 180 XMBody_95 2174 0.40 0.16 0.53 181 XM_ProductURIs 2170 0.70 1.00 0.53 182 XM_B_SpammyWords4 2117 1.38 2.96 0.52 183 XM_B_COPY_HTML 2102 0.70 1.03 0.52 184 TR_XM_SPAMCOP 2049 2.88 7.28 0.50 185 MPART_ALT_DIFF_COUNT 2034 0.74 1.19 0.50 186 HTML_IMAGE_ONLY_32 2031 0.36 0.11 0.50 187 T_OBFU_PDF_ATTACH 2017 0.35 0.08 0.50 188 XMLngstWrd_01 1989 0.53 0.60 0.49 189 TR_XM_SpammyWords2 1900 4.27 11.31 0.47 190 XMPhish30 1898 0.68 1.08 0.47 191 RELAYCOUNTRY_GB 1857 0.52 0.62 0.46 192 TR_LOTS_OF_MONEY2 1853 1.05 2.15 0.46 193 T_MONEY_PERCENT 1853 1.05 2.15 0.46 194 XM_B_DNDMA 1828 0.57 0.80 0.45 195 TO_NO_BRKTS_HTML_ONLY 1808 0.35 0.16 0.44 196 USER_IN_WELCOMELIST 1796 0.29 0.00 0.44 197 USER_IN_WHITELIST 1796 0.29 0.00 0.44 198 HTML_FONT_FACE_BAD 1773 0.47 0.53 0.44 199 HTML_IMAGE_ONLY_20 1690 0.46 0.55 0.42 200 MIME_CHARSET_FARAWAY 1612 0.76 1.42 0.40 ----------------------------------------------------------------------