Email: 601996 Autolearn: 0 AvgScore: 4.80 AvgScanTime: 1.52 sec Spam: 201063 Autolearn: 0 AvgScore: 13.99 AvgScanTime: 1.63 sec Ham: 400933 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 1.46 sec Time Spent Running SA: 253.42 hours Time Spent Processing Spam: 91.06 hours Time Spent Processing Ham: 162.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 192911 89.82 95.95 86.74 2 RELAYCOUNTRY_US 171795 83.10 85.44 81.92 3 DKIM_SIGNED 167092 75.74 83.10 72.04 4 XM_B_Unicode 157439 72.39 78.30 69.42 5 XM_DK_Pass 156444 73.08 77.81 70.71 6 DKIM_VALID 153657 71.97 76.42 69.74 7 XM_B_SpammyWords 143559 54.18 71.40 45.55 8 DCC_CHECK 143248 48.70 71.25 37.39 9 XMListUnsubscribeExists 129710 52.66 64.51 46.71 10 DKIM_VALID_AU 122961 57.71 61.16 55.98 11 BAYES_50 91656 56.87 45.59 62.52 12 XM_B_Unicode3 88937 43.41 44.23 43.00 13 HTML_FONT_LOW_CONTRAST 86407 35.70 42.98 32.05 14 LOC_TINY_FONT_1 83851 30.47 41.70 24.84 15 XM_B_SpammyWords2 75003 24.53 37.30 18.12 16 XM_DK_Undo_02 73931 15.57 36.77 4.93 17 RCVD_IN_MSPIKE_H2 68685 30.99 34.16 29.40 18 FVGT_m_MULTI_ODD 64052 26.51 31.86 23.83 19 MIME_HTML_ONLY 60309 22.70 30.00 19.05 20 BAYES_99 57411 11.65 28.55 3.17 21 T_KAM_HTML_FONT_INVALID 56096 22.55 27.90 19.87 22 XMSubLong 55595 25.79 27.65 24.86 23 DCC_CHECK_NEGATIVE 55302 50.84 27.50 62.55 24 T_TM2_M_HEADER_IN_MSG 52654 30.11 26.19 32.08 25 TR_XM_DKIM_Undo 51909 10.06 25.82 2.16 26 DKIM_VALID_EF 49488 26.36 24.61 27.24 27 BAYES_999 45947 9.22 22.85 2.38 28 TR_DCC_Bayes_99 40779 7.47 20.28 1.04 29 XM_Multi_Part_URI 40410 15.93 20.10 13.84 30 XM_B_Unsub 36691 11.55 18.25 8.18 31 TR_XM_BayesUnsub 35459 10.25 17.64 6.54 32 UNPARSEABLE_RELAY 34720 12.97 17.27 10.82 33 TR_XM_DK_Unsub 33878 13.34 16.85 11.59 34 XM_Evil_Numbers_Gen 30108 11.96 14.97 10.45 35 XM_B_SpammyWords3 27511 7.43 13.68 4.29 36 LOTS_OF_MONEY 27444 8.45 13.65 5.85 37 TR_MAX_INTL_RELAY 26489 8.21 13.17 5.72 38 RELAYCOUNTRY_META 26335 7.09 13.10 4.08 39 BOTNET_IPINHOSTNAME 25583 6.44 12.72 3.29 40 LotsOfNums_01 25008 11.83 12.44 11.52 41 TR_XM_SpammyWords4 24272 6.57 12.07 3.81 42 FSL_BULK_SIG 21961 8.25 10.92 6.91 43 BOTNET 20916 4.45 10.40 1.46 44 TR_XM_SpammyWords2 19325 3.52 9.61 0.46 45 TR_XM_UnparsRelay 17731 4.00 8.82 1.58 46 TM2_M_VERY_LONG_WORD 17135 7.24 8.52 6.60 47 TR_XM_SpammyRelay 17072 4.20 8.49 2.04 48 BAYES_80 16406 5.10 8.16 3.57 49 RCVD_IN_BL_SPAMCOP_NET 16398 3.28 8.16 0.84 50 BAYES_60 16072 8.03 7.99 8.05 51 HTML_IMAGE_RATIO_02 14513 5.76 7.22 5.02 52 XM_Body_Dirty_Words 14169 3.82 7.05 2.20 53 XM_B_PhoneNumber 13871 8.23 6.90 8.90 54 ANY_BOUNCE_MESSAGE 13483 8.07 6.71 8.76 55 BOUNCE_MESSAGE 13476 8.07 6.70 8.76 56 TR_XM_SPAMCOP 13468 2.50 6.70 0.39 57 DKIM_INVALID 13435 3.76 6.68 2.30 58 UNTRUSTED_Relay 12659 3.16 6.30 1.59 59 XMSubMetaSx_00 12348 4.04 6.14 2.98 60 MPART_ALT_DIFF 11603 4.63 5.77 4.06 61 TooManyTo_001 11432 6.95 5.69 7.59 62 XM_UncommonTLD01 11243 4.71 5.59 4.27 63 SHORT_URI_2 11140 3.63 5.54 2.67 64 SHORT_URI_3 10952 4.24 5.45 3.64 65 XM_H_Long_From01 10581 5.38 5.26 5.43 66 HTML_IMAGE_ONLY_32 10393 3.33 5.17 2.41 67 XM_B_Phish_Phrases 10381 4.24 5.16 3.77 68 XM_SPF_SoftFail 10088 2.93 5.02 1.89 69 XM_B_SEO 9387 2.50 4.67 1.41 70 BAYES_95 9231 2.96 4.59 2.14 71 XMSexyCombo_05 8936 2.07 4.44 0.89 72 KHOP_HELO_FCRDNS 8880 4.37 4.42 4.34 73 HTML_IMAGE_RATIO_06 8770 3.19 4.36 2.60 74 RCVD_IN_VALIDITY_RPBL 8752 1.58 4.35 0.19 75 TR_XM_SEO4 8388 1.98 4.17 0.88 76 HTML_IMAGE_RATIO_04 8252 4.10 4.10 4.10 77 RELAYCOUNTRY_CA 8236 2.09 4.10 1.08 78 XM_B_Investor 8179 2.30 4.07 1.42 79 XMStrtUSub 7875 4.79 3.92 5.23 80 XM_H_GMP 7845 4.47 3.90 4.75 81 TR_XM_PhishingBody 7541 2.30 3.75 1.58 82 MIME_HTML_ONLY_MULTI 7435 2.67 3.70 2.15 83 XMBody_17 7131 1.51 3.55 0.49 84 T_XMDrugObfuBody_14 7127 2.43 3.54 1.87 85 TR_XM_SpammyWords5 6916 2.13 3.44 1.47 86 XMNumbers 6768 2.93 3.37 2.72 87 XM_UB50 6607 1.76 3.29 1.00 88 HTML_IMAGE_RATIO_08 6454 2.58 3.21 2.26 89 XM_OfRef6 6388 1.59 3.18 0.79 90 RCVD_IN_MSPIKE_WL 6324 4.68 3.15 5.44 91 RCVD_IN_MSPIKE_H3 6324 4.68 3.15 5.44 92 XM_B_SpammyTLD 6264 3.42 3.12 3.58 93 MIME_QP_LONG_LINE 6260 4.33 3.11 4.95 94 MIME_HTML_MOSTLY 6196 2.46 3.08 2.15 95 TM2_M_URI_OPT_OUT 6091 2.02 3.03 1.51 96 TR_LOTS_OF_MONEY3 6085 1.39 3.03 0.57 97 HTML_MIME_NO_HTML_TAG 5508 2.59 2.74 2.51 98 T_XMDrugObfuBody_08 5412 1.80 2.69 1.35 99 XM_B_SpammyWords4 5311 1.33 2.64 0.68 100 XM_CamelCaseFrm001 5223 2.42 2.60 2.32 101 T_XMHurry_00 5218 1.30 2.60 0.65 102 XM_URI_RBL 5181 1.16 2.58 0.46 103 XMDiploma_00 4975 1.73 2.47 1.36 104 XMBrknScrpt_02 4918 1.51 2.45 1.04 105 XM_B_Unsub2 4838 1.75 2.41 1.42 106 XM_B_URI_Unicode 4799 2.00 2.39 1.80 107 XM_BadFromFormat 4530 0.90 2.25 0.22 108 TR_XM_NoHeaderRelay 4374 0.84 2.18 0.17 109 USER_IN_DEF_DKIM_WL 4362 9.70 2.17 13.48 110 T_TooManySym_01 4352 4.03 2.16 4.96 111 RCVD_IN_VALIDITY_SAFE 4241 3.59 2.11 4.33 112 RELAYCOUNTRY_AU 3944 1.21 1.96 0.83 113 SpammyFromTLD_01 3833 1.21 1.91 0.86 114 T_REMOTE_IMAGE 3821 3.09 1.90 3.68 115 FROM_EXCESS_BASE64 3782 2.03 1.88 2.10 116 XMStockSpam_06 3564 1.32 1.77 1.09 117 ALL_TRUSTED 3487 10.42 1.73 14.78 118 T_FILL_THIS_FORM_SHORT 3452 1.20 1.72 0.93 119 SpammyFromTLD_02 3430 0.83 1.71 0.40 120 SUBJ_ALL_CAPS 3335 1.62 1.66 1.60 121 XMSubMetaI_00 3301 1.01 1.64 0.69 122 TR_Symld_Words 3253 1.58 1.62 1.56 123 MAILING_LIST_MULTI 3154 2.45 1.57 2.89 124 TooManyTo_002 3132 1.90 1.56 2.08 125 BAYES_40 3121 3.72 1.55 4.81 126 XM_DK_Undo_01 3078 1.58 1.53 1.61 127 TR_XM_FormFill 3073 0.52 1.53 0.01 128 URI_TRY_3LD 3060 0.99 1.52 0.72 129 TR_XM_PHPDW 3040 0.80 1.51 0.44 130 TR_XM_PHPForged 3036 0.79 1.51 0.43 131 TR_XM_FormFill2 2960 0.78 1.47 0.43 132 XM_H_PHPOS 2932 0.77 1.46 0.43 133 XM_H_Long_From02 2921 1.20 1.45 1.07 134 RCVD_IN_IADB_LISTED 2867 3.11 1.43 3.95 135 XMGenDplmaNmb 2864 0.94 1.42 0.70 136 T_MONEY_PERCENT 2795 0.60 1.39 0.20 137 TR_LOTS_OF_MONEY2 2795 0.60 1.39 0.20 138 RCVD_IN_VALIDITY_CERTIFIED 2766 2.72 1.38 3.39 139 T_XMDrugObfuBody_00 2738 0.96 1.36 0.76 140 XM_SendGrid 2708 1.48 1.35 1.55 141 URI_HEX 2668 1.15 1.33 1.06 142 RCVD_IN_IADB_SPF 2494 2.72 1.24 3.47 143 SHORTCIRCUIT 2487 0.41 1.24 0.00 144 RCVD_IN_ZEN_LASTEXTERNAL 2487 0.41 1.24 0.00 145 URI_NOVOWEL 2469 2.20 1.23 2.68 146 THIS_AD 2426 0.63 1.21 0.33 147 XM_B_FormFill 2405 0.47 1.20 0.10 148 XM_PDF 2401 4.17 1.19 5.66 149 LongTLD 2337 0.63 1.16 0.36 150 RCVD_IN_IADB_SENDERID 2328 2.44 1.16 3.08 151 RCVD_IN_IADB_DK 2323 2.37 1.16 2.98 152 DKIM_ADSP_NXDOMAIN 2291 0.56 1.14 0.27 153 XM_B_COPY_HTML 2277 0.91 1.13 0.80 154 SHOPIFY_IMG_NOT_RCVD_SFY 2261 0.48 1.12 0.16 155 BAYES_20 2235 2.70 1.11 3.49 156 XMPhish14 2224 0.64 1.11 0.40 157 XM_UB99 2213 0.37 1.10 0.01 158 HTML_TAG_BALANCE_BODY 2211 0.80 1.10 0.65 159 XM_B_REG_HTML 2210 0.46 1.10 0.15 160 XMSexyCombo_01 2209 0.44 1.10 0.12 161 XMPhish30 2195 0.72 1.09 0.54 162 XMBody_78 2185 0.60 1.09 0.36 163 XMHTML_After_End 2144 0.63 1.07 0.41 164 TR_XM_INV_DKIM 2142 0.39 1.07 0.05 165 XM_Appointment_Request 2085 0.35 1.04 0.00 166 TR_XM_InvalidRelay 2057 0.36 1.02 0.03 167 RCVD_IN_PSBL 2039 0.38 1.01 0.07 168 HTTPS_HTTP_MISMATCH 2037 0.96 1.01 0.94 169 RELAYCOUNTRY_FR 2018 0.52 1.00 0.28 170 XM_B_Phish66 1967 0.55 0.98 0.33 171 XMBdyGiftCard01 1965 0.88 0.98 0.83 172 RELAYCOUNTRY_CN 1892 0.36 0.94 0.08 173 DKIM_ADSP_CUSTOM_MED 1839 0.88 0.91 0.87 174 XM_DIRTYINTL 1802 0.38 0.90 0.12 175 MPART_ALT_DIFF_COUNT 1764 0.67 0.88 0.56 176 XM_B_DNDMA 1728 0.77 0.86 0.72 177 XM_H_PHPMailer 1728 0.78 0.86 0.74 178 T_STY_INVIS_DIRECT 1695 0.54 0.84 0.39 179 TR_XM_Base64_M1 1690 0.78 0.84 0.75 180 TR_XM_DK_SendGrid 1657 0.91 0.82 0.96 181 XM_ProductURIs 1656 0.52 0.82 0.37 182 XMHTMLBadTable_001 1647 0.48 0.82 0.31 183 XM_UB999 1634 0.27 0.81 0.00 184 XMSolicitRefs_0 1626 0.51 0.81 0.36 185 XM_HighProb1 1621 0.27 0.81 0.01 186 TR_Mismatch_TLD_02 1613 0.33 0.80 0.09 187 URIBL_BLACK 1589 0.31 0.79 0.08 188 TR_Mismatch_TLD_01 1559 0.38 0.78 0.19 189 XMMoneyMeta_00 1554 0.57 0.77 0.47 190 DIET_1 1520 0.44 0.76 0.29 191 NML_ADSP_CUSTOM_MED 1514 0.61 0.75 0.54 192 TR_MetaPhish_Combo_01 1500 0.72 0.75 0.71 193 BASE64_LENGTH_79_INF 1494 0.47 0.74 0.34 194 TM2_M_A_HREF_HREF 1489 0.38 0.74 0.20 195 XMBounce_01 1487 0.26 0.74 0.02 196 RCVD_IN_IADB_VOUCHED 1487 1.99 0.74 2.62 197 SH_BODYURI_REVERSE_CSS 1477 0.26 0.73 0.03 198 URIBL_CSS 1466 0.27 0.73 0.03 199 URIBL_CSS_A 1466 0.27 0.73 0.03 200 HTML_FONT_TINY_NORDNS 1442 0.29 0.72 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 347784 89.82 95.95 86.74 2 RELAYCOUNTRY_US 328455 83.10 85.44 81.92 3 DKIM_SIGNED 288844 75.74 83.10 72.04 4 XM_DK_Pass 283512 73.08 77.81 70.71 5 DKIM_VALID 279618 71.97 76.42 69.74 6 XM_B_Unicode 278333 72.39 78.30 69.42 7 DCC_CHECK_NEGATIVE 250770 50.84 27.50 62.55 8 BAYES_50 250681 56.87 45.59 62.52 9 DKIM_VALID_AU 224423 57.71 61.16 55.98 10 XMListUnsubscribeExists 187272 52.66 64.51 46.71 11 XM_B_SpammyWords 182629 54.18 71.40 45.55 12 XM_B_Unicode3 172419 43.41 44.23 43.00 13 DCC_CHECK 149921 48.70 71.25 37.39 14 T_TM2_M_HEADER_IN_MSG 128635 30.11 26.19 32.08 15 HTML_FONT_LOW_CONTRAST 128482 35.70 42.98 32.05 16 RCVD_IN_MSPIKE_H2 117881 30.99 34.16 29.40 17 DKIM_VALID_EF 109224 26.36 24.61 27.24 18 XMSubLong 99675 25.79 27.65 24.86 19 LOC_TINY_FONT_1 99605 30.47 41.70 24.84 20 FVGT_m_MULTI_ODD 95553 26.51 31.86 23.83 21 T_KAM_HTML_FONT_INVALID 79671 22.55 27.90 19.87 22 MIME_HTML_ONLY 76361 22.70 30.00 19.05 23 XM_B_SpammyWords2 72638 24.53 37.30 18.12 24 ALL_TRUSTED 59270 10.42 1.73 14.78 25 XM_Multi_Part_URI 55471 15.93 20.10 13.84 26 USER_IN_DEF_DKIM_WL 54037 9.70 2.17 13.48 27 TR_XM_DK_Unsub 46453 13.34 16.85 11.59 28 LotsOfNums_01 46185 11.83 12.44 11.52 29 UNPARSEABLE_RELAY 43378 12.97 17.27 10.82 30 XM_Evil_Numbers_Gen 41887 11.96 14.97 10.45 31 BAYES_00 40166 6.90 0.67 10.02 32 XM_B_PhoneNumber 35684 8.23 6.90 8.90 33 ANY_BOUNCE_MESSAGE 35111 8.07 6.71 8.76 34 BOUNCE_MESSAGE 35109 8.07 6.70 8.76 35 XM_B_Unsub 32814 11.55 18.25 8.18 36 BAYES_60 32264 8.03 7.99 8.05 37 TooManyTo_001 30428 6.95 5.69 7.59 38 TR_XM_DK_Bayes 29584 5.08 0.49 7.38 39 TR_XM_DK_Bayes1 29097 4.99 0.48 7.26 40 FSL_BULK_SIG 27719 8.25 10.92 6.91 41 XM_DKIMWhitelistDomains 26933 4.48 0.03 6.72 42 IN_ZIMBRA_NJ_WHITELIST 26693 4.47 0.10 6.66 43 TM2_M_VERY_LONG_WORD 26473 7.24 8.52 6.60 44 TR_XM_BayesUnsub 26217 10.25 17.64 6.54 45 TR_XM_DK_Bayes2 24349 4.17 0.37 6.07 46 LOTS_OF_MONEY 23440 8.45 13.65 5.85 47 TR_MAX_INTL_RELAY 22917 8.21 13.17 5.72 48 XM_PDF 22702 4.17 1.19 5.66 49 RCVD_IN_MSPIKE_H3 21824 4.68 3.15 5.44 50 RCVD_IN_MSPIKE_WL 21824 4.68 3.15 5.44 51 XM_H_Long_From01 21781 5.38 5.26 5.43 52 XMStrtUSub 20960 4.79 3.92 5.23 53 HTML_IMAGE_RATIO_02 20146 5.76 7.22 5.02 54 T_TooManySym_01 19901 4.03 2.16 4.96 55 MIME_QP_LONG_LINE 19834 4.33 3.11 4.95 56 XM_DK_Undo_02 19772 15.57 36.77 4.93 57 BAYES_40 19274 3.72 1.55 4.81 58 XM_H_GMP 19045 4.47 3.90 4.75 59 KHOP_HELO_FCRDNS 17410 4.37 4.42 4.34 60 RCVD_IN_VALIDITY_SAFE 17346 3.59 2.11 4.33 61 XM_B_SpammyWords3 17192 7.43 13.68 4.29 62 XM_UncommonTLD01 17119 4.71 5.59 4.27 63 HTML_IMAGE_RATIO_04 16448 4.10 4.10 4.10 64 RELAYCOUNTRY_META 16352 7.09 13.10 4.08 65 MPART_ALT_DIFF 16293 4.63 5.77 4.06 66 RCVD_IN_IADB_LISTED 15839 3.11 1.43 3.95 67 TR_XM_SpammyWords4 15283 6.57 12.07 3.81 68 XM_B_Phish_Phrases 15117 4.24 5.16 3.77 69 T_REMOTE_IMAGE 14774 3.09 1.90 3.68 70 SHORT_URI_3 14583 4.24 5.45 3.64 71 XM_B_SpammyTLD 14337 3.42 3.12 3.58 72 BAYES_80 14310 5.10 8.16 3.57 73 BAYES_20 13995 2.70 1.11 3.49 74 RCVD_IN_IADB_SPF 13899 2.72 1.24 3.47 75 RCVD_IN_VALIDITY_CERTIFIED 13590 2.72 1.38 3.39 76 BOTNET_IPINHOSTNAME 13182 6.44 12.72 3.29 77 BAYES_99 12697 11.65 28.55 3.17 78 RCVD_IN_IADB_SENDERID 12357 2.44 1.16 3.08 79 MIME_CHARSET_FARAWAY 12351 2.23 0.54 3.08 80 RCVD_IN_IADB_DK 11965 2.37 1.16 2.98 81 XMSubMetaSx_00 11960 4.04 6.14 2.98 82 MAILING_LIST_MULTI 11577 2.45 1.57 2.89 83 CHARSET_FARAWAY_HEADER 11091 1.89 0.14 2.77 84 XMNumbers 10895 2.93 3.37 2.72 85 URI_NOVOWEL 10755 2.20 1.23 2.68 86 SHORT_URI_2 10706 3.63 5.54 2.67 87 RCVD_IN_IADB_VOUCHED 10507 1.99 0.74 2.62 88 HTML_IMAGE_RATIO_06 10441 3.19 4.36 2.60 89 HTML_MIME_NO_HTML_TAG 10058 2.59 2.74 2.51 90 HTML_IMAGE_ONLY_32 9653 3.33 5.17 2.41 91 BAYES_999 9551 9.22 22.85 2.38 92 T_TooManySym_02 9400 1.75 0.57 2.34 93 XM_CamelCaseFrm001 9319 2.42 2.60 2.32 94 DKIM_INVALID 9226 3.76 6.68 2.30 95 HTML_IMAGE_RATIO_08 9073 2.58 3.21 2.26 96 BAYES_05 8943 1.67 0.54 2.23 97 XM_Body_Dirty_Words 8825 3.82 7.05 2.20 98 TR_XM_DKIM_Undo 8647 10.06 25.82 2.16 99 MIME_HTML_MOSTLY 8640 2.46 3.08 2.15 100 MIME_HTML_ONLY_MULTI 8617 2.67 3.70 2.15 101 BAYES_95 8600 2.96 4.59 2.14 102 FROM_EXCESS_BASE64 8423 2.03 1.88 2.10 103 TooManyTo_002 8326 1.90 1.56 2.08 104 TR_XM_SpammyRelay 8198 4.20 8.49 2.04 105 INVALID_MSGID 7679 1.31 0.10 1.92 106 XM_SPF_SoftFail 7564 2.93 5.02 1.89 107 T_XMDrugObfuBody_14 7484 2.43 3.54 1.87 108 RCVD_IN_IADB_OPTIN 7369 1.38 0.47 1.84 109 XM_B_URI_Unicode 7218 2.00 2.39 1.80 110 XM_DK_Undo_01 6454 1.58 1.53 1.61 111 SUBJ_ALL_CAPS 6433 1.62 1.66 1.60 112 UNTRUSTED_Relay 6393 3.16 6.30 1.59 113 TR_XM_UnparsRelay 6331 4.00 8.82 1.58 114 TR_XM_PhishingBody 6315 2.30 3.75 1.58 115 TO_MALFORMED 6281 1.05 0.00 1.57 116 TR_Symld_Words 6258 1.58 1.62 1.56 117 XM_SendGrid 6225 1.48 1.35 1.55 118 TM2_M_URI_OPT_OUT 6052 2.02 3.03 1.51 119 TR_XM_SpammyWords5 5900 2.13 3.44 1.47 120 BOTNET 5870 4.45 10.40 1.46 121 T_OBFU_PDF_ATTACH 5755 1.15 0.59 1.44 122 XM_B_Investor 5687 2.30 4.07 1.42 123 XM_B_Unsub2 5678 1.75 2.41 1.42 124 TooManyTo_003 5672 1.08 0.42 1.41 125 XM_B_SEO 5670 2.50 4.67 1.41 126 XMDiploma_00 5461 1.73 2.47 1.36 127 T_XMDrugObfuBody_08 5395 1.80 2.69 1.35 128 IN_HORDE_ADDRESS_BOOK 5117 0.89 0.11 1.28 129 XM_GoogleGroups 4768 0.97 0.55 1.19 130 XMGappySubj_01 4681 0.84 0.20 1.17 131 XMStockSpam_06 4378 1.32 1.77 1.09 132 RELAYCOUNTRY_CA 4339 2.09 4.10 1.08 133 HELO_NODOT 4291 0.80 0.25 1.07 134 XM_H_Long_From02 4286 1.20 1.45 1.07 135 HELO_NO_DOMAIN 4285 0.80 0.25 1.07 136 URI_HEX 4246 1.15 1.33 1.06 137 TR_DCC_Bayes_99 4161 7.47 20.28 1.04 138 XMBrknScrpt_02 4150 1.51 2.45 1.04 139 TooManyTo_004 4136 0.81 0.38 1.03 140 TVD_SPACE_RATIO 4032 0.71 0.11 1.01 141 XMCapTrack 4024 0.82 0.46 1.00 142 XM_UB50 3993 1.76 3.29 1.00 143 FROM_GOV_DKIM_AU 3978 0.72 0.19 0.99 144 T_TVD_MIME_NO_HEADERS 3890 0.68 0.09 0.97 145 TR_XM_DK_SendGrid 3835 0.91 0.82 0.96 146 HTTPS_HTTP_MISMATCH 3754 0.96 1.01 0.94 147 T_FILL_THIS_FORM_SHORT 3745 1.20 1.72 0.93 148 XMSexyCombo_05 3554 2.07 4.44 0.89 149 TR_XM_SEO4 3520 1.98 4.17 0.88 150 DKIM_ADSP_CUSTOM_MED 3480 0.88 0.91 0.87 151 SpammyFromTLD_01 3456 1.21 1.91 0.86 152 RCVD_IN_BL_SPAMCOP_NET 3359 3.28 8.16 0.84 153 XMBdyGiftCard01 3347 0.88 0.98 0.83 154 TooManyTo_005 3320 0.67 0.36 0.83 155 RELAYCOUNTRY_AU 3312 1.21 1.96 0.83 156 T_TooManySym_03 3207 0.59 0.18 0.80 157 XM_B_COPY_HTML 3198 0.91 1.13 0.80 158 XM_OfRef6 3161 1.59 3.18 0.79 159 XM_TLDProd2 3104 0.61 0.28 0.77 160 T_XMDrugObfuBody_00 3056 0.96 1.36 0.76 161 TR_XM_Base64_M1 2989 0.78 0.84 0.75 162 XM_H_PHPMailer 2961 0.78 0.86 0.74 163 XM_B_DNDMA 2899 0.77 0.86 0.72 164 URI_TRY_3LD 2877 0.99 1.52 0.72 165 TR_MetaPhish_Combo_01 2844 0.72 0.75 0.71 166 XMGenDplmaNmb 2789 0.94 1.42 0.70 167 XMSubMetaI_00 2767 1.01 1.64 0.69 168 XM_B_SpammyWords4 2724 1.33 2.64 0.68 169 XMBody_95 2659 0.60 0.46 0.66 170 XMGappySubj_02 2644 0.46 0.06 0.66 171 T_XMHurry_00 2621 1.30 2.60 0.65 172 HTML_TAG_BALANCE_BODY 2600 0.80 1.10 0.65 173 RCVD_IN_PBL 2555 0.62 0.57 0.64 174 XM_ShortIntro_01 2537 0.55 0.40 0.63 175 T_Symld_Words_02 2507 0.64 0.66 0.63 176 TR_LOTS_OF_MONEY3 2290 1.39 3.03 0.57 177 MPART_ALT_DIFF_COUNT 2249 0.67 0.88 0.56 178 XMNoVowels 2228 0.54 0.51 0.56 179 FORGED_GMAIL_RCVD 2206 0.59 0.66 0.55 180 NML_ADSP_CUSTOM_MED 2166 0.61 0.75 0.54 181 XMPhish30 2145 0.72 1.09 0.54 182 XMBody_17 1978 1.51 3.55 0.49 183 RELAYCOUNTRY_GB 1938 0.55 0.68 0.48 184 HTML_IMAGE_ONLY_28 1901 0.44 0.37 0.47 185 TM2_M_BODY_EMPTY 1876 0.39 0.23 0.47 186 XMMoneyMeta_00 1868 0.57 0.77 0.47 187 TR_XM_SpammyWords2 1839 3.52 9.61 0.46 188 XM_URI_RBL 1826 1.16 2.58 0.46 189 TVD_RCVD_IP 1808 0.50 0.59 0.45 190 USER_IN_WHITELIST 1787 0.30 0.00 0.45 191 USER_IN_WELCOMELIST 1787 0.30 0.00 0.45 192 XMLngstWrd_00 1786 0.41 0.33 0.45 193 SUBJ_BUY 1767 0.34 0.14 0.44 194 TR_XM_PHPDW 1756 0.80 1.51 0.44 195 TR_XM_FormFill2 1739 0.78 1.47 0.43 196 TR_XM_PHPForged 1736 0.79 1.51 0.43 197 RELAYCOUNTRY_DE 1718 0.51 0.66 0.43 198 XM_H_PHPOS 1713 0.77 1.46 0.43 199 HTML_IMAGE_ONLY_20 1698 0.42 0.41 0.42 200 XMSubMetaSxObfu_03 1685 0.51 0.68 0.42 ----------------------------------------------------------------------