Email: 562642 Autolearn: 0 AvgScore: 4.69 AvgScanTime: 1.59 sec Spam: 179328 Autolearn: 0 AvgScore: 14.75 AvgScanTime: 1.76 sec Ham: 383314 Autolearn: 0 AvgScore: -0.01 AvgScanTime: 1.50 sec Time Spent Running SA: 247.93 hours Time Spent Processing Spam: 87.83 hours Time Spent Processing Ham: 160.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170647 89.82 95.16 87.33 2 DKIM_SIGNED 159616 79.83 89.01 75.53 3 RELAYCOUNTRY_US 151676 81.03 84.58 79.36 4 XM_DK_Pass 151449 77.53 84.45 74.29 5 XM_B_Unicode 151250 76.45 84.34 72.75 6 DKIM_VALID 150135 76.64 83.72 73.33 7 DCC_CHECK 135015 51.56 75.29 40.46 8 XM_B_SpammyWords 126043 55.88 70.29 49.15 9 XMListUnsubscribeExists 123714 55.66 68.99 49.43 10 DKIM_VALID_AU 119357 61.34 66.56 58.90 11 XM_B_Unicode3 86379 43.30 48.17 41.03 12 LOC_TINY_FONT_1 79568 32.46 44.37 26.89 13 BAYES_50 72253 54.38 40.29 60.97 14 XM_B_SpammyWords2 71346 28.34 39.79 22.99 15 XM_DK_Undo_02 69874 15.88 38.96 5.08 16 HTML_FONT_LOW_CONTRAST 69069 31.78 38.52 28.63 17 RCVD_IN_MSPIKE_H2 66934 34.21 37.32 32.76 18 BAYES_99 58071 12.64 32.38 3.41 19 FVGT_m_MULTI_ODD 56851 26.42 31.70 23.94 20 MIME_HTML_ONLY 54612 22.51 30.45 18.80 21 T_KAM_HTML_FONT_INVALID 51036 23.16 28.46 20.69 22 TR_XM_DKIM_Undo 50032 10.61 27.90 2.53 23 DKIM_VALID_EF 47697 27.85 26.60 28.43 24 BAYES_999 46464 10.05 25.91 2.63 25 TR_DCC_Bayes_99 42176 8.54 23.52 1.54 26 DCC_CHECK_NEGATIVE 41700 47.95 23.25 59.50 27 XM_Multi_Part_URI 41440 18.55 23.11 16.41 28 XMSubLong 39743 21.28 22.16 20.86 29 T_TM2_M_HEADER_IN_MSG 39618 27.88 22.09 30.59 30 XM_B_Unsub 33204 11.75 18.52 8.59 31 TR_XM_BayesUnsub 32050 10.31 17.87 6.77 32 TR_XM_DK_Unsub 31689 14.07 17.67 12.39 33 UNPARSEABLE_RELAY 30621 13.07 17.08 11.19 34 RELAYCOUNTRY_META 26905 7.62 15.00 4.17 35 XM_B_SpammyWords3 25736 7.99 14.35 5.02 36 TR_MAX_INTL_RELAY 25550 8.44 14.25 5.72 37 LOTS_OF_MONEY 25325 10.07 14.12 8.17 38 BOTNET_IPINHOSTNAME 23581 6.53 13.15 3.43 39 TR_XM_SpammyWords4 23080 8.51 12.87 6.47 40 TR_XM_SpammyWords2 19433 3.77 10.84 0.47 41 BOTNET 18225 4.31 10.16 1.57 42 TR_XM_SpammyRelay 18063 4.77 10.07 2.29 43 XM_Evil_Numbers_Gen 17663 9.39 9.85 9.18 44 FSL_BULK_SIG 17540 7.74 9.78 6.79 45 TR_XM_UnparsRelay 16618 4.19 9.27 1.81 46 BAYES_80 15556 5.16 8.67 3.52 47 LotsOfNums_01 15369 8.20 8.57 8.03 48 BAYES_60 14691 8.32 8.19 8.38 49 XM_UncommonTLD01 14623 5.17 8.15 3.78 50 XM_Body_Dirty_Words 14134 4.30 7.88 2.62 51 XM_B_PhoneNumber 14102 8.39 7.86 8.64 52 HTML_IMAGE_RATIO_02 13607 5.68 7.59 4.78 53 XM_B_Phish_Phrases 13581 5.63 7.57 4.73 54 UNTRUSTED_Relay 12370 3.34 6.90 1.68 55 XMSubMetaSx_00 10997 4.17 6.13 3.25 56 XM_B_SEO 10976 3.04 6.12 1.59 57 RCVD_IN_BL_SPAMCOP_NET 10678 2.33 5.95 0.63 58 XM_H_Long_From01 10517 5.52 5.86 5.35 59 MPART_ALT_DIFF 10487 4.78 5.85 4.28 60 TooManyTo_001 9867 6.89 5.50 7.53 61 TR_XM_SEO4 9844 2.52 5.49 1.14 62 DKIM_INVALID 9481 3.19 5.29 2.21 63 HTML_IMAGE_RATIO_04 9344 4.16 5.21 3.66 64 XMSexyCombo_05 9307 2.32 5.19 0.97 65 XM_B_Investor 8945 2.79 4.99 1.77 66 BAYES_95 8936 3.09 4.98 2.20 67 RELAYCOUNTRY_CA 8449 2.26 4.71 1.11 68 TR_XM_SPAMCOP 8435 1.69 4.70 0.28 69 XM_SPF_SoftFail 8294 2.65 4.63 1.73 70 HTML_IMAGE_RATIO_06 8221 3.82 4.58 3.46 71 XMStrtUSub 8050 4.88 4.49 5.07 72 XM_H_GMP 7537 4.76 4.20 5.02 73 MIME_QP_LONG_LINE 7214 4.64 4.02 4.93 74 TR_XM_PhishingBody 7119 2.66 3.97 2.04 75 T_XMDrugObfuBody_14 7085 2.51 3.95 1.84 76 XM_B_SpammyTLD 6928 4.04 3.86 4.13 77 HTML_IMAGE_RATIO_08 6832 3.29 3.81 3.05 78 XM_OfRef6 6694 1.70 3.73 0.75 79 MIME_HTML_MOSTLY 6510 2.67 3.63 2.22 80 TM2_M_URI_OPT_OUT 6361 2.15 3.55 1.50 81 TR_XM_SpammyWords5 6217 2.02 3.47 1.35 82 T_XMDrugObfuBody_08 6202 2.16 3.46 1.55 83 XMBody_17 6154 1.40 3.43 0.45 84 RCVD_IN_VALIDITY_RPBL 6054 1.16 3.38 0.13 85 MIME_HTML_ONLY_MULTI 5894 2.73 3.29 2.47 86 TR_LOTS_OF_MONEY3 5871 1.34 3.27 0.44 87 XM_CamelCaseFrm001 5868 2.82 3.27 2.61 88 XMNumbers 5683 2.73 3.17 2.52 89 XM_URI_RBL 5509 1.34 3.07 0.53 90 TM2_M_VERY_LONG_WORD 5413 1.83 3.02 1.27 91 XM_UB50 5371 1.67 3.00 1.05 92 XMDiploma_00 5366 1.89 2.99 1.37 93 XMStockSpam_06 5066 1.82 2.82 1.34 94 RCVD_IN_VALIDITY_SAFE 4951 4.45 2.76 5.24 95 RCVD_IN_MSPIKE_WL 4928 4.62 2.75 5.50 96 RCVD_IN_MSPIKE_H3 4928 4.62 2.75 5.50 97 XM_B_Unsub2 4790 1.89 2.67 1.52 98 T_REMOTE_IMAGE 4759 3.12 2.65 3.33 99 XMBrknScrpt_02 4668 1.54 2.60 1.04 100 RELAYCOUNTRY_AU 4512 1.35 2.52 0.80 101 XM_B_SpammyWords4 4488 1.29 2.50 0.72 102 XM_B_URI_Unicode 4395 1.98 2.45 1.75 103 SpammyFromTLD_01 4366 1.37 2.43 0.87 104 T_TooManySym_01 4191 4.24 2.34 5.13 105 FROM_EXCESS_BASE64 4146 2.31 2.31 2.31 106 T_FILL_THIS_FORM_SHORT 3843 1.31 2.14 0.92 107 SpammyFromTLD_02 3640 0.93 2.03 0.42 108 T_XMHurry_00 3639 1.05 2.03 0.59 109 SUBJ_ALL_CAPS 3563 1.55 1.99 1.35 110 MAILING_LIST_MULTI 3490 2.65 1.95 2.98 111 RCVD_IN_VALIDITY_CERTIFIED 3474 3.50 1.94 4.23 112 USER_IN_DEF_DKIM_WL 3382 10.33 1.89 14.28 113 TR_XM_NoHeaderRelay 3364 0.71 1.88 0.17 114 BOTNET_NORDNS 3331 0.60 1.86 0.01 115 HTML_MIME_NO_HTML_TAG 3298 1.92 1.84 1.96 116 TR_XM_FormFill 3256 0.59 1.82 0.01 117 XM_DK_Undo_01 3196 1.88 1.78 1.92 118 TooManyTo_002 3060 1.95 1.71 2.06 119 XM_H_Long_From02 3031 1.20 1.69 0.97 120 RCVD_IN_PSBL 2974 0.58 1.66 0.08 121 BAYES_40 2948 4.33 1.64 5.59 122 TR_XM_PHPForged 2894 0.80 1.61 0.42 123 TR_XM_PHPDW 2849 0.80 1.59 0.42 124 TR_XM_FormFill2 2783 0.78 1.55 0.42 125 T_XMDrugObfuBody_00 2773 0.99 1.55 0.73 126 XM_H_PHPOS 2767 0.77 1.54 0.41 127 URI_HEX 2767 1.25 1.54 1.12 128 RCVD_IN_ZEN_LASTEXTERNAL 2594 0.46 1.45 0.00 129 SHORTCIRCUIT 2594 0.46 1.45 0.00 130 TR_XM_INV_DKIM 2580 0.54 1.44 0.13 131 XM_UB99 2569 0.46 1.43 0.01 132 THIS_AD 2500 0.71 1.39 0.40 133 RCVD_IN_IADB_LISTED 2498 3.05 1.39 3.82 134 XMGenDplmaNmb 2448 0.95 1.37 0.76 135 XM_SendGrid 2363 1.51 1.32 1.60 136 DIET_1 2334 0.59 1.30 0.26 137 SHOPIFY_IMG_NOT_RCVD_SFY 2319 0.56 1.29 0.22 138 URI_TRUNCATED 2314 0.48 1.29 0.09 139 XMBdyGiftCard01 2312 0.93 1.29 0.76 140 TR_LOTS_OF_MONEY2 2289 0.55 1.28 0.21 141 T_MONEY_PERCENT 2289 0.55 1.28 0.21 142 XM_B_Phish66 2221 0.67 1.24 0.41 143 RCVD_IN_IADB_SPF 2180 2.65 1.22 3.33 144 LONGLN_LOW_CONTRAST 2171 0.60 1.21 0.31 145 LongTLD 2165 0.61 1.21 0.33 146 XMPhish30 2163 0.97 1.21 0.86 147 TR_XM_InvalidRelay 2162 0.40 1.21 0.02 148 XMHTML_After_End 2099 0.58 1.17 0.30 149 XMHTMLBadTable_001 2074 0.55 1.16 0.26 150 BAYES_20 2063 2.70 1.15 3.43 151 RCVD_IN_IADB_DK 2057 2.29 1.15 2.82 152 RCVD_IN_IADB_SENDERID 2049 2.36 1.14 2.93 153 XM_B_FormFill 2049 0.43 1.14 0.09 154 TR_Mismatch_TLD_02 2031 0.42 1.13 0.08 155 XMSubMetaI_00 2023 0.88 1.13 0.76 156 XM_Appointment_Request 2015 0.36 1.12 0.00 157 XM_HighProb1 1975 0.36 1.10 0.01 158 XM_DIRTYINTL 1968 0.42 1.10 0.11 159 TR_XM_Base64_M1 1946 0.76 1.09 0.61 160 XM_B_REG_HTML 1923 0.44 1.07 0.14 161 XM_UB999 1923 0.35 1.07 0.01 162 ALL_TRUSTED 1910 12.16 1.07 17.35 163 KHOP_HELO_FCRDNS 1898 1.16 1.06 1.21 164 HOSTED_IMG_MULTI_PUB_01 1844 0.37 1.03 0.06 165 RELAYCOUNTRY_FR 1832 0.53 1.02 0.29 166 URI_NOVOWEL 1829 2.54 1.02 3.25 167 XMSlimDrugH 1819 0.53 1.01 0.30 168 XMSexyCombo_01 1813 0.49 1.01 0.25 169 URI_TRY_3LD 1772 0.84 0.99 0.77 170 DKIM_ADSP_CUSTOM_MED 1756 0.83 0.98 0.77 171 XM_ProductURIs 1744 0.71 0.97 0.59 172 XM_H_DKIM_GOOG 1705 0.31 0.95 0.01 173 HTTPS_HTTP_MISMATCH 1670 0.79 0.93 0.72 174 XM_BadFromFormat 1629 0.36 0.91 0.10 175 XM_H_Undi_Recip 1626 0.41 0.91 0.18 176 RDNS_DYNAMIC 1625 0.52 0.91 0.34 177 PDS_RDNS_DYNAMIC_FP 1605 0.42 0.90 0.20 178 TR_Symld_Words 1603 1.28 0.89 1.46 179 TR_Caps_n_Bayes_99 1592 0.31 0.89 0.03 180 HTML_TAG_BALANCE_BODY 1573 0.65 0.88 0.55 181 XM_UB60 1562 0.36 0.87 0.11 182 XM_B_COPY_HTML 1553 0.63 0.87 0.53 183 XM_B_DNDMA 1514 0.76 0.84 0.72 184 RELAYCOUNTRY_GB 1487 0.58 0.83 0.46 185 XM_H_PHPMailer 1475 0.66 0.82 0.58 186 MPART_ALT_DIFF_COUNT 1473 0.64 0.82 0.55 187 XM_B_COVIDMETA 1456 0.37 0.81 0.16 188 RCVD_IN_PBL 1454 0.69 0.81 0.63 189 PLING_QUERY 1437 0.55 0.80 0.44 190 TM2_M_OBFU_COMMENT 1404 0.65 0.78 0.58 191 HTML_FONT_TINY_NORDNS 1391 0.30 0.78 0.07 192 XM_UB80 1388 0.27 0.77 0.03 193 TR_XM_DK_SendGrid 1384 0.87 0.77 0.92 194 TM2_M_A_HREF_HREF 1378 0.41 0.77 0.24 195 T_STY_INVIS_DIRECT 1371 0.42 0.76 0.26 196 FORGED_GMAIL_RCVD 1356 0.56 0.76 0.46 197 TR_XM_RelayPhish 1355 0.28 0.76 0.06 198 TVD_RCVD_IP 1350 0.54 0.75 0.45 199 T_Symld_Words_02 1349 0.56 0.75 0.47 200 FROM_SUSPICIOUS_NTLD 1348 0.26 0.75 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 334729 89.82 95.16 87.33 2 RELAYCOUNTRY_US 304214 81.03 84.58 79.36 3 DKIM_SIGNED 289530 79.83 89.01 75.53 4 XM_DK_Pass 284750 77.53 84.45 74.29 5 DKIM_VALID 281072 76.64 83.72 73.33 6 XM_B_Unicode 278879 76.45 84.34 72.75 7 BAYES_50 233694 54.38 40.29 60.97 8 DCC_CHECK_NEGATIVE 228064 47.95 23.25 59.50 9 DKIM_VALID_AU 225765 61.34 66.56 58.90 10 XMListUnsubscribeExists 189466 55.66 68.99 49.43 11 XM_B_SpammyWords 188389 55.88 70.29 49.15 12 XM_B_Unicode3 157257 43.30 48.17 41.03 13 DCC_CHECK 155080 51.56 75.29 40.46 14 RCVD_IN_MSPIKE_H2 125564 34.21 37.32 32.76 15 T_TM2_M_HEADER_IN_MSG 117251 27.88 22.09 30.59 16 HTML_FONT_LOW_CONTRAST 109749 31.78 38.52 28.63 17 DKIM_VALID_EF 108987 27.85 26.60 28.43 18 LOC_TINY_FONT_1 103056 32.46 44.37 26.89 19 FVGT_m_MULTI_ODD 91780 26.42 31.70 23.94 20 XM_B_SpammyWords2 88132 28.34 39.79 22.99 21 XMSubLong 79960 21.28 22.16 20.86 22 T_KAM_HTML_FONT_INVALID 79293 23.16 28.46 20.69 23 MIME_HTML_ONLY 72063 22.51 30.45 18.80 24 ALL_TRUSTED 66496 12.16 1.07 17.35 25 XM_Multi_Part_URI 62919 18.55 23.11 16.41 26 USER_IN_DEF_DKIM_WL 54750 10.33 1.89 14.28 27 TR_XM_DK_Unsub 47491 14.07 17.67 12.39 28 UNPARSEABLE_RELAY 42889 13.07 17.08 11.19 29 BAYES_00 40240 7.36 0.66 10.50 30 XM_Evil_Numbers_Gen 35181 9.39 9.85 9.18 31 XM_B_PhoneNumber 33125 8.39 7.86 8.64 32 XM_B_Unsub 32925 11.75 18.52 8.59 33 BAYES_60 32126 8.32 8.19 8.38 34 LOTS_OF_MONEY 31319 10.07 14.12 8.17 35 LotsOfNums_01 30762 8.20 8.57 8.03 36 TR_XM_DK_Bayes 29940 5.50 0.55 7.81 37 TR_XM_DK_Bayes1 29538 5.42 0.54 7.71 38 TooManyTo_001 28874 6.89 5.50 7.53 39 XM_DKIMWhitelistDomains 28638 5.16 0.21 7.47 40 FSL_BULK_SIG 26008 7.74 9.78 6.79 41 TR_XM_BayesUnsub 25945 10.31 17.87 6.77 42 TR_XM_DK_Bayes2 25832 4.71 0.36 6.74 43 IN_ZIMBRA_NJ_WHITELIST 25365 4.55 0.14 6.62 44 TR_XM_SpammyWords4 24793 8.51 12.87 6.47 45 TR_MAX_INTL_RELAY 21933 8.44 14.25 5.72 46 BAYES_40 21415 4.33 1.64 5.59 47 RCVD_IN_MSPIKE_WL 21073 4.62 2.75 5.50 48 RCVD_IN_MSPIKE_H3 21072 4.62 2.75 5.50 49 XM_H_Long_From01 20526 5.52 5.86 5.35 50 RCVD_IN_VALIDITY_SAFE 20083 4.45 2.76 5.24 51 T_TooManySym_01 19672 4.24 2.34 5.13 52 XM_DK_Undo_02 19488 15.88 38.96 5.08 53 XMStrtUSub 19420 4.88 4.49 5.07 54 XM_H_GMP 19240 4.76 4.20 5.02 55 XM_B_SpammyWords3 19226 7.99 14.35 5.02 56 MIME_QP_LONG_LINE 18892 4.64 4.02 4.93 57 HTML_IMAGE_RATIO_02 18324 5.68 7.59 4.78 58 XM_B_Phish_Phrases 18118 5.63 7.57 4.73 59 MPART_ALT_DIFF 16417 4.78 5.85 4.28 60 RCVD_IN_VALIDITY_CERTIFIED 16233 3.50 1.94 4.23 61 RELAYCOUNTRY_META 15983 7.62 15.00 4.17 62 XM_B_SpammyTLD 15825 4.04 3.86 4.13 63 XM_PDF 15585 2.95 0.58 4.07 64 RCVD_IN_IADB_LISTED 14635 3.05 1.39 3.82 65 XM_UncommonTLD01 14472 5.17 8.15 3.78 66 HTML_IMAGE_RATIO_04 14041 4.16 5.21 3.66 67 BAYES_80 13491 5.16 8.67 3.52 68 HTML_IMAGE_RATIO_06 13280 3.82 4.58 3.46 69 BOTNET_IPINHOSTNAME 13157 6.53 13.15 3.43 70 BAYES_20 13149 2.70 1.15 3.43 71 BAYES_99 13067 12.64 32.38 3.41 72 T_REMOTE_IMAGE 12773 3.12 2.65 3.33 73 RCVD_IN_IADB_SPF 12755 2.65 1.22 3.33 74 XMSubMetaSx_00 12461 4.17 6.13 3.25 75 URI_NOVOWEL 12439 2.54 1.02 3.25 76 HTML_IMAGE_RATIO_08 11672 3.29 3.81 3.05 77 MAILING_LIST_MULTI 11440 2.65 1.95 2.98 78 RCVD_IN_IADB_SENDERID 11230 2.36 1.14 2.93 79 RCVD_IN_IADB_DK 10809 2.29 1.15 2.82 80 ANY_BOUNCE_MESSAGE 10486 2.04 0.55 2.74 81 BOUNCE_MESSAGE 10485 2.04 0.55 2.74 82 RCVD_IN_IADB_VOUCHED 10205 2.04 0.70 2.66 83 BAYES_999 10077 10.05 25.91 2.63 84 XM_Body_Dirty_Words 10057 4.30 7.88 2.62 85 XM_CamelCaseFrm001 9989 2.82 3.27 2.61 86 T_TooManySym_02 9803 1.96 0.70 2.56 87 TR_XM_DKIM_Undo 9689 10.61 27.90 2.53 88 XMNumbers 9669 2.73 3.17 2.52 89 MIME_HTML_ONLY_MULTI 9482 2.73 3.29 2.47 90 FROM_EXCESS_BASE64 8842 2.31 2.31 2.31 91 TR_XM_SpammyRelay 8778 4.77 10.07 2.29 92 MIME_HTML_MOSTLY 8519 2.67 3.63 2.22 93 DKIM_INVALID 8458 3.19 5.29 2.21 94 BAYES_95 8424 3.09 4.98 2.20 95 TooManyTo_002 7892 1.95 1.71 2.06 96 TR_XM_PhishingBody 7831 2.66 3.97 2.04 97 BAYES_05 7700 1.55 0.57 2.01 98 HTML_MIME_NO_HTML_TAG 7501 1.92 1.84 1.96 99 XM_DK_Undo_01 7374 1.88 1.78 1.92 100 INVALID_MSGID 7293 1.34 0.14 1.90 101 RCVD_IN_IADB_OPTIN 7207 1.41 0.39 1.88 102 T_XMDrugObfuBody_14 7038 2.51 3.95 1.84 103 TR_XM_UnparsRelay 6946 4.19 9.27 1.81 104 XM_B_Investor 6774 2.79 4.99 1.77 105 XM_B_URI_Unicode 6727 1.98 2.45 1.75 106 XM_SPF_SoftFail 6643 2.65 4.63 1.73 107 UNTRUSTED_Relay 6437 3.34 6.90 1.68 108 TO_MALFORMED 6238 1.11 0.01 1.63 109 XM_SendGrid 6143 1.51 1.32 1.60 110 XM_B_SEO 6111 3.04 6.12 1.59 111 BOTNET 6031 4.31 10.16 1.57 112 T_XMDrugObfuBody_08 5931 2.16 3.46 1.55 113 TR_DCC_Bayes_99 5898 8.54 23.52 1.54 114 XM_B_Unsub2 5819 1.89 2.67 1.52 115 TM2_M_URI_OPT_OUT 5753 2.15 3.55 1.50 116 TR_Symld_Words 5613 1.28 0.89 1.46 117 TooManyTo_003 5276 1.11 0.53 1.38 118 XMDiploma_00 5264 1.89 2.99 1.37 119 IN_HORDE_ADDRESS_BOOK 5206 0.97 0.14 1.36 120 SUBJ_ALL_CAPS 5177 1.55 1.99 1.35 121 TR_XM_SpammyWords5 5158 2.02 3.47 1.35 122 XMStockSpam_06 5146 1.82 2.82 1.34 123 TM2_M_VERY_LONG_WORD 4864 1.83 3.02 1.27 124 KHOP_HELO_FCRDNS 4636 1.16 1.06 1.21 125 XMGappySubj_01 4624 0.89 0.21 1.21 126 XM_GoogleGroups 4604 1.04 0.69 1.20 127 FROM_GOV_DKIM_AU 4358 0.83 0.17 1.14 128 TR_XM_SEO4 4351 2.52 5.49 1.14 129 URI_HEX 4288 1.25 1.54 1.12 130 RELAYCOUNTRY_CA 4258 2.26 4.71 1.11 131 XMCapTrack 4145 0.90 0.50 1.08 132 HELO_NODOT 4113 0.77 0.12 1.07 133 HELO_NO_DOMAIN 4103 0.77 0.12 1.07 134 XM_UB50 4043 1.67 3.00 1.05 135 XMBrknScrpt_02 4004 1.54 2.60 1.04 136 TVD_SPACE_RATIO 3953 0.73 0.09 1.03 137 XM_TLDProd2 3939 0.77 0.21 1.03 138 TooManyTo_004 3893 0.85 0.49 1.02 139 XMSexyCombo_05 3723 2.32 5.19 0.97 140 XM_H_Long_From02 3704 1.20 1.69 0.97 141 T_TooManySym_03 3667 0.75 0.29 0.96 142 TR_XM_DK_SendGrid 3539 0.87 0.77 0.92 143 T_FILL_THIS_FORM_SHORT 3526 1.31 2.14 0.92 144 SpammyFromTLD_01 3338 1.37 2.43 0.87 145 XM_H_Trusted_IP 3303 0.59 0.00 0.86 146 XMPhish30 3296 0.97 1.21 0.86 147 TooManyTo_005 3204 0.72 0.46 0.84 148 RELAYCOUNTRY_AU 3058 1.35 2.52 0.80 149 URI_TRY_3LD 2960 0.84 0.99 0.77 150 DKIM_ADSP_CUSTOM_MED 2935 0.83 0.98 0.77 151 XMSubMetaI_00 2926 0.88 1.13 0.76 152 XMBdyGiftCard01 2915 0.93 1.29 0.76 153 XMGenDplmaNmb 2898 0.95 1.37 0.76 154 XM_OfRef6 2876 1.70 3.73 0.75 155 T_XMDrugObfuBody_00 2798 0.99 1.55 0.73 156 HTTPS_HTTP_MISMATCH 2773 0.79 0.93 0.72 157 XM_B_DNDMA 2763 0.76 0.84 0.72 158 XM_B_SpammyWords4 2748 1.29 2.50 0.72 159 TR_MetaPhish_Combo_01 2598 0.67 0.65 0.68 160 XMSubNoVowel 2580 0.65 0.60 0.67 161 XMGappySubj_02 2556 0.48 0.08 0.67 162 XM_ShortIntro_01 2544 0.58 0.41 0.66 163 RCVD_IN_PBL 2433 0.69 0.81 0.63 164 RCVD_IN_BL_SPAMCOP_NET 2406 2.33 5.95 0.63 165 TR_XM_Base64_M1 2350 0.76 1.09 0.61 166 XMNoVowels 2342 0.53 0.36 0.61 167 T_XMHurry_00 2254 1.05 2.03 0.59 168 XM_ProductURIs 2252 0.71 0.97 0.59 169 XM_H_PHPMailer 2238 0.66 0.82 0.58 170 TM2_M_OBFU_COMMENT 2230 0.65 0.78 0.58 171 T_OBFU_PDF_ATTACH 2213 0.46 0.22 0.58 172 XMBody_95 2159 0.45 0.20 0.56 173 HTML_TAG_BALANCE_BODY 2109 0.65 0.88 0.55 174 MPART_ALT_DIFF_COUNT 2103 0.64 0.82 0.55 175 XM_URI_RBL 2018 1.34 3.07 0.53 176 XM_B_COPY_HTML 2015 0.63 0.87 0.53 177 TRACKER_ID 1925 0.40 0.18 0.50 178 HTML_IMAGE_ONLY_32 1895 0.39 0.18 0.49 179 XMLngstWrd_00 1811 0.45 0.40 0.47 180 T_Symld_Words_02 1809 0.56 0.75 0.47 181 NML_ADSP_CUSTOM_MED 1802 0.55 0.71 0.47 182 HTML_IMAGE_ONLY_28 1795 0.44 0.37 0.47 183 TR_XM_SpammyWords2 1790 3.77 10.84 0.47 184 FORGED_GMAIL_RCVD 1781 0.56 0.76 0.46 185 RELAYCOUNTRY_GB 1769 0.58 0.83 0.46 186 XMBody_17 1737 1.40 3.43 0.45 187 HTML_FONT_FACE_BAD 1736 0.51 0.64 0.45 188 TVD_RCVD_IP 1710 0.54 0.75 0.45 189 HTML_IMAGE_ONLY_20 1692 0.42 0.36 0.44 190 TR_LOTS_OF_MONEY3 1687 1.34 3.27 0.44 191 PLING_QUERY 1669 0.55 0.80 0.44 192 TR_XM_PHPForged 1627 0.80 1.61 0.42 193 TR_XM_FormFill2 1627 0.78 1.55 0.42 194 TR_XM_PHPDW 1625 0.80 1.59 0.42 195 SpammyFromTLD_02 1598 0.93 2.03 0.42 196 XMMoneyMeta_00 1596 0.52 0.74 0.42 197 XM_H_PHPOS 1587 0.77 1.54 0.41 198 XM_B_Phish66 1565 0.67 1.24 0.41 199 HTML_IMAGE_ONLY_24 1531 0.33 0.17 0.40 200 XMSubMetaSxObfu_03 1520 0.48 0.67 0.40 ----------------------------------------------------------------------