Email: 513547 Autolearn: 0 AvgScore: 4.90 AvgScanTime: 1.35 sec Spam: 169342 Autolearn: 0 AvgScore: 14.70 AvgScanTime: 1.45 sec Ham: 344205 Autolearn: 0 AvgScore: 0.07 AvgScanTime: 1.30 sec Time Spent Running SA: 192.44 hours Time Spent Processing Spam: 68.18 hours Time Spent Processing Ham: 124.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161926 88.48 95.62 84.96 2 DKIM_SIGNED 152644 80.73 90.14 76.11 3 RELAYCOUNTRY_US 143418 82.38 84.69 81.24 4 XM_DK_Pass 142288 77.90 84.02 74.89 5 DKIM_VALID 140065 76.86 82.71 73.99 6 XM_B_Unicode 139306 73.43 82.26 69.09 7 DCC_CHECK 130850 52.42 77.27 40.19 8 XM_B_SpammyWords 120902 54.29 71.40 45.87 9 XMListUnsubscribeExists 116597 55.82 68.85 49.42 10 DKIM_VALID_AU 111349 61.96 65.75 60.10 11 XM_B_Unicode3 77780 42.64 45.93 41.01 12 LOC_TINY_FONT_1 76219 32.91 45.01 26.96 13 XM_B_SpammyWords2 69543 26.49 41.07 19.32 14 BAYES_50 69006 54.74 40.75 61.63 15 XM_DK_Undo_02 68175 17.04 40.26 5.62 16 HTML_FONT_LOW_CONTRAST 66044 31.91 39.00 28.42 17 RCVD_IN_MSPIKE_H2 61793 33.02 36.49 31.31 18 BAYES_99 55278 13.55 32.64 4.15 19 FVGT_m_MULTI_ODD 54116 26.63 31.96 24.02 20 MIME_HTML_ONLY 51776 23.59 30.57 20.15 21 T_KAM_HTML_FONT_INVALID 50923 23.74 30.07 20.62 22 TR_XM_DKIM_Undo 49559 11.37 29.27 2.56 23 BAYES_999 44358 10.85 26.19 3.31 24 DKIM_VALID_EF 44130 27.99 26.06 28.94 25 TR_DCC_Bayes_99 41100 9.12 24.27 1.67 26 XMSubLong 36741 21.89 21.70 21.98 27 DCC_CHECK_NEGATIVE 36370 47.14 21.48 59.77 28 T_TM2_M_HEADER_IN_MSG 35735 26.66 21.10 29.39 29 XM_Multi_Part_URI 35696 17.90 21.08 16.34 30 XM_B_Unsub 34191 12.52 20.19 8.75 31 TR_XM_BayesUnsub 33186 11.09 19.60 6.91 32 UNPARSEABLE_RELAY 30954 13.47 18.28 11.10 33 TR_XM_DK_Unsub 29945 14.15 17.68 12.41 34 RELAYCOUNTRY_META 25299 7.73 14.94 4.18 35 XM_B_SpammyWords3 24012 8.61 14.18 5.87 36 TR_MAX_INTL_RELAY 23186 8.37 13.69 5.75 37 BOTNET_IPINHOSTNAME 22824 6.69 13.48 3.35 38 LOTS_OF_MONEY 21813 8.64 12.88 6.55 39 FSL_BULK_SIG 20774 9.08 12.27 7.52 40 TR_XM_SpammyWords2 20523 4.35 12.12 0.52 41 BOTNET 19724 4.79 11.65 1.42 42 TR_XM_SpammyWords4 19261 6.79 11.37 4.53 43 TR_XM_SpammyRelay 18519 5.16 10.94 2.32 44 TR_XM_UnparsRelay 17860 4.71 10.55 1.85 45 XM_Evil_Numbers_Gen 14973 9.39 8.84 9.66 46 BAYES_80 14629 5.23 8.64 3.55 47 HTML_IMAGE_RATIO_02 13343 5.82 7.88 4.81 48 LotsOfNums_01 13281 8.04 7.84 8.14 49 BAYES_60 13152 8.26 7.77 8.50 50 DKIM_INVALID 12579 3.87 7.43 2.12 51 XM_Body_Dirty_Words 11911 4.02 7.03 2.54 52 MPART_ALT_DIFF 11749 5.42 6.94 4.68 53 UNTRUSTED_Relay 11709 3.30 6.91 1.52 54 RCVD_IN_BL_SPAMCOP_NET 11648 2.81 6.88 0.81 55 XM_B_Phish_Phrases 11599 6.66 6.85 6.57 56 XM_UncommonTLD01 11026 4.62 6.51 3.69 57 TooManyTo_001 10737 7.07 6.34 7.43 58 XM_B_PhoneNumber 10319 7.66 6.09 8.44 59 XMSubMetaSx_00 10154 4.24 6.00 3.38 60 XM_H_Long_From01 10120 5.94 5.98 5.93 61 TR_XM_SPAMCOP 9095 1.99 5.37 0.33 62 RCVD_IN_VALIDITY_RPBL 9021 1.87 5.33 0.17 63 XM_B_SEO 8810 2.72 5.20 1.50 64 HTML_IMAGE_RATIO_04 8374 4.84 4.95 4.79 65 XMStrtUSub 8329 5.26 4.92 5.43 66 XM_B_Investor 8324 2.54 4.92 1.37 67 BAYES_95 8126 3.06 4.80 2.20 68 XMBody_17 7960 1.91 4.70 0.54 69 RELAYCOUNTRY_CA 7907 2.35 4.67 1.21 70 XMSexyCombo_05 7829 2.50 4.62 1.45 71 XM_SPF_SoftFail 7716 2.67 4.56 1.74 72 TR_XM_SEO4 7554 2.15 4.46 1.02 73 XM_H_GMP 7512 4.64 4.44 4.75 74 MIME_HTML_MOSTLY 7221 3.33 4.26 2.88 75 T_XMDrugObfuBody_14 7081 2.46 4.18 1.61 76 TR_XM_SpammyWords5 7031 2.45 4.15 1.62 77 XM_UB50 6999 1.97 4.13 0.90 78 XMNumbers 6922 3.29 4.09 2.90 79 HTML_IMAGE_RATIO_06 6704 3.16 3.96 2.76 80 MIME_HTML_ONLY_MULTI 6691 2.87 3.95 2.35 81 XM_B_SpammyTLD 6243 4.35 3.69 4.67 82 TR_XM_PhishingBody 6163 2.20 3.64 1.49 83 TM2_M_VERY_LONG_WORD 5911 3.32 3.49 3.24 84 MIME_QP_LONG_LINE 5627 4.64 3.32 5.28 85 XM_OfRef6 5538 1.78 3.27 1.05 86 TR_XM_NoHeaderRelay 5525 1.17 3.26 0.14 87 RCVD_IN_MSPIKE_WL 5334 4.76 3.15 5.55 88 RCVD_IN_MSPIKE_H3 5334 4.76 3.15 5.55 89 T_XMDrugObfuBody_08 5122 1.96 3.02 1.43 90 XM_URI_RBL 5038 1.28 2.98 0.45 91 XM_CamelCaseFrm001 5019 3.07 2.96 3.12 92 XMDiploma_00 4964 2.17 2.93 1.79 93 XM_B_URI_Unicode 4933 2.26 2.91 1.94 94 HTML_IMAGE_RATIO_08 4873 2.36 2.88 2.10 95 TM2_M_URI_OPT_OUT 4770 2.06 2.82 1.69 96 FROM_EXCESS_BASE64 4605 2.27 2.72 2.05 97 RCVD_IN_VALIDITY_SAFE 4461 4.27 2.63 5.07 98 T_TooManySym_01 4363 4.68 2.58 5.71 99 SpammyFromTLD_01 4354 1.41 2.57 0.83 100 TR_LOTS_OF_MONEY3 4348 1.18 2.57 0.49 101 RELAYCOUNTRY_AU 4309 1.51 2.54 1.00 102 XMBrknScrpt_02 4264 1.57 2.52 1.11 103 XM_B_Unsub2 4184 1.68 2.47 1.29 104 T_FILL_THIS_FORM_SHORT 3963 1.34 2.34 0.84 105 USER_IN_DEF_DKIM_WL 3877 10.64 2.29 14.75 106 XM_B_SpammyWords4 3859 1.25 2.28 0.74 107 HTML_MIME_NO_HTML_TAG 3835 2.18 2.26 2.14 108 XMStockSpam_06 3754 1.81 2.22 1.61 109 SpammyFromTLD_02 3657 1.04 2.16 0.48 110 T_XMHurry_00 3574 1.14 2.11 0.66 111 T_REMOTE_IMAGE 3457 3.33 2.04 3.97 112 TR_XM_INV_DKIM 3119 0.65 1.84 0.07 113 XM_BadFromFormat 3033 0.69 1.79 0.15 114 MAILING_LIST_MULTI 2970 2.60 1.75 3.02 115 RCVD_IN_VALIDITY_CERTIFIED 2965 3.26 1.75 4.00 116 URI_NOVOWEL 2961 2.86 1.75 3.41 117 XM_H_DKIM_GOOG 2868 0.57 1.69 0.01 118 BAYES_40 2838 3.65 1.68 4.62 119 ANY_BOUNCE_MESSAGE 2772 4.45 1.64 5.83 120 BOUNCE_MESSAGE 2772 4.45 1.64 5.83 121 XM_SendGrid 2721 1.51 1.61 1.46 122 SUBJ_ALL_CAPS 2677 1.57 1.58 1.57 123 XMGenDplmaNmb 2676 1.16 1.58 0.95 124 DKIM_ADSP_NXDOMAIN 2648 0.70 1.56 0.28 125 KHOP_HELO_FCRDNS 2616 1.96 1.54 2.16 126 XMSubMetaI_00 2578 0.82 1.52 0.48 127 RCVD_IN_IADB_LISTED 2523 3.23 1.49 4.09 128 T_XMDrugObfuBody_00 2478 1.04 1.46 0.83 129 XM_B_REG_HTML 2454 0.58 1.45 0.14 130 HDRS_MISSP 2434 0.49 1.44 0.03 131 XM_DK_Undo_01 2391 1.58 1.41 1.66 132 RELAYCOUNTRY_FR 2353 0.62 1.39 0.25 133 THIS_AD 2308 0.67 1.36 0.33 134 TR_Mismatch_TLD_02 2281 0.48 1.35 0.05 135 LONGLN_LOW_CONTRAST 2260 0.62 1.33 0.27 136 TR_XM_FormFill 2257 0.45 1.33 0.01 137 ALL_TRUSTED 2250 10.86 1.33 15.55 138 RELAYCOUNTRY_CN 2206 0.47 1.30 0.06 139 TR_Symld_Words 2174 1.46 1.28 1.55 140 RCVD_IN_IADB_SPF 2160 2.83 1.28 3.60 141 XM_ProductURIs 2121 1.15 1.25 1.11 142 XMBdyGiftCard01 2121 1.03 1.25 0.93 143 URI_HEX 2104 1.21 1.24 1.19 144 XMPhish30 2091 0.81 1.23 0.60 145 SHORTCIRCUIT 2089 0.41 1.23 0.00 146 RCVD_IN_ZEN_LASTEXTERNAL 2089 0.41 1.23 0.00 147 T_MONEY_PERCENT 2067 0.89 1.22 0.72 148 TR_LOTS_OF_MONEY2 2067 0.89 1.22 0.72 149 RCVD_IN_IADB_SENDERID 2037 2.55 1.20 3.21 150 MPART_ALT_DIFF_COUNT 2030 0.72 1.20 0.48 151 RCVD_IN_IADB_DK 2028 2.49 1.20 3.12 152 XMHTMLBadTable_001 2012 0.60 1.19 0.30 153 SHOPIFY_IMG_NOT_RCVD_SFY 1991 0.54 1.18 0.23 154 BAYES_20 1978 2.63 1.17 3.35 155 TR_XM_PHPForged 1968 0.70 1.16 0.48 156 URIBL_CSS_A 1954 0.43 1.15 0.07 157 SH_BODYURI_REVERSE_CSS 1954 0.42 1.15 0.06 158 URIBL_CSS 1954 0.43 1.15 0.07 159 TooManyTo_002 1953 1.76 1.15 2.06 160 TR_XM_PHPDW 1950 0.70 1.15 0.47 161 TR_XM_FormFill2 1904 0.69 1.12 0.48 162 XM_DIRTYINTL 1890 0.45 1.12 0.12 163 XM_H_PHPOS 1889 0.68 1.12 0.47 164 XM_H_Long_From02 1873 0.99 1.11 0.93 165 RELAYCOUNTRY_IN 1834 0.39 1.08 0.04 166 XMSexyCombo_01 1818 0.48 1.07 0.19 167 HOSTED_IMG_MULTI_PUB_01 1814 0.41 1.07 0.09 168 XM_B_COPY_HTML 1793 0.86 1.06 0.76 169 LongTLD 1787 0.55 1.06 0.31 170 TR_XM_Base64_L1 1753 0.48 1.04 0.21 171 XMBounce_01 1752 0.35 1.03 0.02 172 TR_XM_InvalidRelay 1738 0.35 1.03 0.02 173 TR_XM_DK_SendGrid 1684 0.93 0.99 0.90 174 DIET_1 1637 0.51 0.97 0.28 175 RDNS_DYNAMIC 1627 0.54 0.96 0.33 176 TR_XM_Base64_M1 1625 0.64 0.96 0.49 177 XM_B_Phish66 1625 0.51 0.96 0.29 178 T_STY_INVIS_DIRECT 1618 0.51 0.96 0.29 179 XM_HighProb1 1615 0.32 0.95 0.00 180 XMReplyNow 1588 0.47 0.94 0.24 181 PDS_RDNS_DYNAMIC_FP 1587 0.43 0.94 0.18 182 TM2_M_OBFU_COMMENT 1528 0.61 0.90 0.46 183 URI_TRY_3LD 1510 0.76 0.89 0.69 184 XM_B_COVIDMETA 1505 0.42 0.89 0.18 185 TR_MetaPhish_Combo_01 1500 0.78 0.89 0.73 186 RCVD_IN_PBL 1490 0.71 0.88 0.63 187 HTML_TAG_BALANCE_BODY 1484 0.71 0.88 0.63 188 XM_B_DNDMA 1482 0.76 0.88 0.71 189 DKIM_ADSP_CUSTOM_MED 1463 0.79 0.86 0.76 190 TVD_RCVD_IP 1419 0.59 0.84 0.47 191 XM_UB60 1416 0.32 0.84 0.07 192 T_TooManySym_02 1413 2.20 0.83 2.87 193 HTTPS_HTTP_MISMATCH 1410 0.77 0.83 0.74 194 XMSubMetaSSx_00 1406 0.37 0.83 0.14 195 XM_H_Undi_Recip 1393 0.38 0.82 0.17 196 XMHTML_After_End 1341 0.46 0.79 0.30 197 HELO_DYNAMIC_SPLIT_IP 1333 0.26 0.79 0.01 198 XM_UB99 1331 0.26 0.79 0.00 199 NORDNS_LOW_CONTRAST 1312 0.27 0.77 0.01 200 RCVD_IN_IADB_VOUCHED 1312 2.04 0.77 2.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 292452 88.48 95.62 84.96 2 RELAYCOUNTRY_US 279646 82.38 84.69 81.24 3 DKIM_SIGNED 261968 80.73 90.14 76.11 4 XM_DK_Pass 257783 77.90 84.02 74.89 5 DKIM_VALID 254664 76.86 82.71 73.99 6 XM_B_Unicode 237802 73.43 82.26 69.09 7 BAYES_50 212117 54.74 40.75 61.63 8 DKIM_VALID_AU 206853 61.96 65.75 60.10 9 DCC_CHECK_NEGATIVE 205715 47.14 21.48 59.77 10 XMListUnsubscribeExists 170089 55.82 68.85 49.42 11 XM_B_SpammyWords 157888 54.29 71.40 45.87 12 XM_B_Unicode3 141173 42.64 45.93 41.01 13 DCC_CHECK 138345 52.42 77.27 40.19 14 RCVD_IN_MSPIKE_H2 107761 33.02 36.49 31.31 15 T_TM2_M_HEADER_IN_MSG 101161 26.66 21.10 29.39 16 DKIM_VALID_EF 99619 27.99 26.06 28.94 17 HTML_FONT_LOW_CONTRAST 97817 31.91 39.00 28.42 18 LOC_TINY_FONT_1 92809 32.91 45.01 26.96 19 FVGT_m_MULTI_ODD 82661 26.63 31.96 24.02 20 XMSubLong 75672 21.89 21.70 21.98 21 T_KAM_HTML_FONT_INVALID 70991 23.74 30.07 20.62 22 MIME_HTML_ONLY 69345 23.59 30.57 20.15 23 XM_B_SpammyWords2 66511 26.49 41.07 19.32 24 XM_Multi_Part_URI 56235 17.90 21.08 16.34 25 ALL_TRUSTED 53528 10.86 1.33 15.55 26 USER_IN_DEF_DKIM_WL 50780 10.64 2.29 14.75 27 TR_XM_DK_Unsub 42701 14.15 17.68 12.41 28 UNPARSEABLE_RELAY 38205 13.47 18.28 11.10 29 BAYES_00 34201 6.89 0.71 9.94 30 XM_Evil_Numbers_Gen 33240 9.39 8.84 9.66 31 XM_B_Unsub 30110 12.52 20.19 8.75 32 BAYES_60 29274 8.26 7.77 8.50 33 XM_B_PhoneNumber 29041 7.66 6.09 8.44 34 LotsOfNums_01 28009 8.04 7.84 8.14 35 XM_DKIMWhitelistDomains 26892 5.28 0.14 7.81 36 TR_XM_DK_Bayes 26745 5.38 0.54 7.77 37 TR_XM_DK_Bayes1 26362 5.31 0.53 7.66 38 FSL_BULK_SIG 25875 9.08 12.27 7.52 39 TooManyTo_001 25563 7.07 6.34 7.43 40 TR_XM_BayesUnsub 23790 11.09 19.60 6.91 41 IN_ZIMBRA_NJ_WHITELIST 23308 4.61 0.23 6.77 42 TR_XM_DK_Bayes2 22612 4.53 0.38 6.57 43 XM_B_Phish_Phrases 22608 6.66 6.85 6.57 44 LOTS_OF_MONEY 22557 8.64 12.88 6.55 45 XM_H_Long_From01 20396 5.94 5.98 5.93 46 XM_B_SpammyWords3 20189 8.61 14.18 5.87 47 ANY_BOUNCE_MESSAGE 20084 4.45 1.64 5.83 48 BOUNCE_MESSAGE 20084 4.45 1.64 5.83 49 TR_MAX_INTL_RELAY 19790 8.37 13.69 5.75 50 T_TooManySym_01 19654 4.68 2.58 5.71 51 XM_DK_Undo_02 19346 17.04 40.26 5.62 52 RCVD_IN_MSPIKE_H3 19111 4.76 3.15 5.55 53 RCVD_IN_MSPIKE_WL 19111 4.76 3.15 5.55 54 XMStrtUSub 18707 5.26 4.92 5.43 55 MIME_QP_LONG_LINE 18185 4.64 3.32 5.28 56 RCVD_IN_VALIDITY_SAFE 17444 4.27 2.63 5.07 57 HTML_IMAGE_RATIO_02 16568 5.82 7.88 4.81 58 HTML_IMAGE_RATIO_04 16477 4.84 4.95 4.79 59 XM_H_GMP 16340 4.64 4.44 4.75 60 MPART_ALT_DIFF 16104 5.42 6.94 4.68 61 XM_B_SpammyTLD 16085 4.35 3.69 4.67 62 BAYES_40 15918 3.65 1.68 4.62 63 TR_XM_SpammyWords4 15589 6.79 11.37 4.53 64 RELAYCOUNTRY_META 14398 7.73 14.94 4.18 65 BAYES_99 14296 13.55 32.64 4.15 66 XM_PDF 14250 3.03 0.77 4.14 67 RCVD_IN_IADB_LISTED 14062 3.23 1.49 4.09 68 RCVD_IN_VALIDITY_CERTIFIED 13779 3.26 1.75 4.00 69 T_REMOTE_IMAGE 13649 3.33 2.04 3.97 70 XM_UncommonTLD01 12693 4.62 6.51 3.69 71 RCVD_IN_IADB_SPF 12390 2.83 1.28 3.60 72 BAYES_80 12205 5.23 8.64 3.55 73 URI_NOVOWEL 11749 2.86 1.75 3.41 74 XMSubMetaSx_00 11645 4.24 6.00 3.38 75 BOTNET_IPINHOSTNAME 11542 6.69 13.48 3.35 76 BAYES_20 11516 2.63 1.17 3.35 77 BAYES_999 11383 10.85 26.19 3.31 78 TM2_M_VERY_LONG_WORD 11138 3.32 3.49 3.24 79 RCVD_IN_IADB_SENDERID 11039 2.55 1.20 3.21 80 RCVD_IN_IADB_DK 10734 2.49 1.20 3.12 81 XM_CamelCaseFrm001 10723 3.07 2.96 3.12 82 MAILING_LIST_MULTI 10381 2.60 1.75 3.02 83 XMNumbers 9988 3.29 4.09 2.90 84 MIME_HTML_MOSTLY 9900 3.33 4.26 2.88 85 T_TooManySym_02 9869 2.20 0.83 2.87 86 HTML_IMAGE_RATIO_06 9508 3.16 3.96 2.76 87 RCVD_IN_IADB_VOUCHED 9171 2.04 0.77 2.66 88 TR_XM_DKIM_Undo 8808 11.37 29.27 2.56 89 XM_Body_Dirty_Words 8727 4.02 7.03 2.54 90 MIME_HTML_ONLY_MULTI 8073 2.87 3.95 2.35 91 TR_XM_SpammyRelay 8000 5.16 10.94 2.32 92 BAYES_95 7579 3.06 4.80 2.20 93 KHOP_HELO_FCRDNS 7447 1.96 1.54 2.16 94 INVALID_MSGID 7362 1.48 0.15 2.14 95 HTML_MIME_NO_HTML_TAG 7354 2.18 2.26 2.14 96 DKIM_INVALID 7304 3.87 7.43 2.12 97 HTML_IMAGE_RATIO_08 7231 2.36 2.88 2.10 98 TooManyTo_002 7102 1.76 1.15 2.06 99 BAYES_05 7098 1.59 0.62 2.06 100 FROM_EXCESS_BASE64 7046 2.27 2.72 2.05 101 XM_B_URI_Unicode 6671 2.26 2.91 1.94 102 RCVD_IN_IADB_OPTIN 6431 1.41 0.47 1.87 103 TR_XM_UnparsRelay 6351 4.71 10.55 1.85 104 TO_MALFORMED 6221 1.23 0.07 1.81 105 XMDiploma_00 6168 2.17 2.93 1.79 106 XM_SPF_SoftFail 5988 2.67 4.56 1.74 107 TM2_M_URI_OPT_OUT 5818 2.06 2.82 1.69 108 TR_DCC_Bayes_99 5757 9.12 24.27 1.67 109 XM_DK_Undo_01 5717 1.58 1.41 1.66 110 TR_XM_SpammyWords5 5568 2.45 4.15 1.62 111 XMStockSpam_06 5544 1.81 2.22 1.61 112 T_XMDrugObfuBody_14 5533 2.46 4.18 1.61 113 SUBJ_ALL_CAPS 5409 1.57 1.58 1.57 114 TR_Symld_Words 5343 1.46 1.28 1.55 115 UNTRUSTED_Relay 5215 3.30 6.91 1.52 116 XM_B_SEO 5174 2.72 5.20 1.50 117 IN_HORDE_ADDRESS_BOOK 5141 1.06 0.17 1.49 118 TR_XM_PhishingBody 5115 2.20 3.64 1.49 119 XM_SendGrid 5025 1.51 1.61 1.46 120 XMSexyCombo_05 5002 2.50 4.62 1.45 121 TooManyTo_003 4990 1.14 0.52 1.45 122 T_XMDrugObfuBody_08 4919 1.96 3.02 1.43 123 BOTNET 4895 4.79 11.65 1.42 124 XM_B_Investor 4710 2.54 4.92 1.37 125 XMGappySubj_01 4701 0.97 0.16 1.37 126 HTML_EXTRA_CLOSE 4503 0.88 0.01 1.31 127 XM_B_Unsub2 4430 1.68 2.47 1.29 128 RELAYCOUNTRY_CA 4159 2.35 4.67 1.21 129 XM_TLDProd2 4119 0.89 0.25 1.20 130 XM_GoogleGroups 4114 0.98 0.55 1.20 131 URI_HEX 4088 1.21 1.24 1.19 132 XM_ShortIntro_01 3877 0.94 0.55 1.13 133 XMBrknScrpt_02 3822 1.57 2.52 1.11 134 XM_ProductURIs 3804 1.15 1.25 1.11 135 TooManyTo_004 3725 0.89 0.49 1.08 136 TVD_SPACE_RATIO 3635 0.75 0.12 1.06 137 XM_OfRef6 3612 1.78 3.27 1.05 138 HTML_IMAGE_ONLY_32 3567 0.73 0.09 1.04 139 XMCapTrack 3547 0.84 0.44 1.03 140 TR_XM_SEO4 3510 2.15 4.46 1.02 141 RELAYCOUNTRY_AU 3446 1.51 2.54 1.00 142 T_TooManySym_03 3391 0.72 0.19 0.99 143 XMGenDplmaNmb 3283 1.16 1.58 0.95 144 HELO_NODOT 3276 0.67 0.11 0.95 145 HELO_NO_DOMAIN 3273 0.67 0.11 0.95 146 XM_H_Long_From02 3202 0.99 1.11 0.93 147 XMBdyGiftCard01 3185 1.03 1.25 0.93 148 TooManyTo_005 3114 0.76 0.46 0.90 149 XM_UB50 3106 1.97 4.13 0.90 150 TR_XM_DK_SendGrid 3083 0.93 0.99 0.90 151 T_FILL_THIS_FORM_SHORT 2899 1.34 2.34 0.84 152 XMSubMetaSxObfu_03 2885 0.72 0.48 0.84 153 SpammyFromTLD_01 2869 1.41 2.57 0.83 154 T_XMDrugObfuBody_00 2849 1.04 1.46 0.83 155 XMBody_95 2830 0.62 0.21 0.82 156 RCVD_IN_BL_SPAMCOP_NET 2777 2.81 6.88 0.81 157 XMGappySubj_02 2721 0.54 0.04 0.79 158 XM_B_COPY_HTML 2622 0.86 1.06 0.76 159 DKIM_ADSP_CUSTOM_MED 2615 0.79 0.86 0.76 160 FROM_GOV_DKIM_AU 2584 0.55 0.13 0.75 161 XM_B_SpammyWords4 2541 1.25 2.28 0.74 162 HTTPS_HTTP_MISMATCH 2535 0.77 0.83 0.74 163 TR_MetaPhish_Combo_01 2526 0.78 0.89 0.73 164 T_MONEY_PERCENT 2485 0.89 1.22 0.72 165 TR_LOTS_OF_MONEY2 2485 0.89 1.22 0.72 166 T_OBFU_PDF_ATTACH 2453 0.61 0.39 0.71 167 XM_B_DNDMA 2434 0.76 0.88 0.71 168 URI_TRY_3LD 2389 0.76 0.89 0.69 169 XMLngstWrd_00 2366 0.59 0.39 0.69 170 XM_H_PHPMailer 2275 0.61 0.52 0.66 171 T_XMHurry_00 2262 1.14 2.11 0.66 172 RCVD_IN_PBL 2177 0.71 0.88 0.63 173 HTML_TAG_BALANCE_BODY 2174 0.71 0.88 0.63 174 XMNoVowels 2072 0.54 0.41 0.60 175 XMPhish30 2050 0.81 1.23 0.60 176 T_Symld_Words_02 1973 0.59 0.64 0.57 177 T_TVD_MIME_NO_HEADERS 1936 0.40 0.06 0.56 178 XMBody_17 1873 1.91 4.70 0.54 179 XMLngstWrd_01 1862 0.48 0.36 0.54 180 SUBJ_DOLLARS 1817 0.54 0.57 0.53 181 TR_XM_SpammyWords2 1794 4.35 12.12 0.52 182 HTML_IMAGE_ONLY_20 1712 0.48 0.45 0.50 183 TR_LOTS_OF_MONEY3 1698 1.18 2.57 0.49 184 USER_IN_WELCOMELIST 1697 0.33 0.00 0.49 185 USER_IN_WHITELIST 1697 0.33 0.00 0.49 186 TR_XM_Base64_M1 1670 0.64 0.96 0.49 187 MPART_ALT_DIFF_COUNT 1666 0.72 1.20 0.48 188 SpammyFromTLD_02 1665 1.04 2.16 0.48 189 TR_XM_FormFill2 1664 0.69 1.12 0.48 190 XMSubMetaI_00 1655 0.82 1.52 0.48 191 TR_XM_PHPForged 1647 0.70 1.16 0.48 192 TR_XM_PHPDW 1632 0.70 1.15 0.47 193 TVD_RCVD_IP 1630 0.59 0.84 0.47 194 XM_H_PHPOS 1614 0.68 1.12 0.47 195 MIME_CHARSET_FARAWAY 1610 0.56 0.75 0.47 196 NML_ADSP_CUSTOM_MED 1610 0.51 0.61 0.47 197 TM2_M_OBFU_COMMENT 1597 0.61 0.90 0.46 198 FORGED_GMAIL_RCVD 1583 0.51 0.63 0.46 199 XM_URI_RBL 1559 1.28 2.98 0.45 200 TRACKER_ID 1487 0.31 0.08 0.43 ----------------------------------------------------------------------