Email: 576967 Autolearn: 0 AvgScore: 4.53 AvgScanTime: 1.40 sec Spam: 170055 Autolearn: 0 AvgScore: 14.16 AvgScanTime: 1.62 sec Ham: 406912 Autolearn: 0 AvgScore: 0.50 AvgScanTime: 1.31 sec Time Spent Running SA: 224.69 hours Time Spent Processing Spam: 76.55 hours Time Spent Processing Ham: 148.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162787 91.80 95.73 90.16 2 DKIM_SIGNED 150571 73.75 88.54 67.57 3 XM_DK_Pass 145318 72.10 85.45 66.52 4 XM_B_Unicode 143399 76.49 84.33 73.21 5 DKIM_VALID 142773 71.05 83.96 65.66 6 RELAYCOUNTRY_US 140683 74.20 82.73 70.64 7 DCC_CHECK 125467 51.54 73.78 42.24 8 XMListUnsubscribeExists 116982 52.25 68.79 45.34 9 XM_B_SpammyWords 116186 48.72 68.32 40.53 10 DKIM_VALID_AU 113151 56.92 66.54 52.89 11 XM_B_Unicode3 83372 42.08 49.03 39.18 12 LOC_TINY_FONT_1 80901 31.10 47.57 24.21 13 BAYES_50 72039 50.94 42.36 54.52 14 HTML_FONT_LOW_CONTRAST 66178 29.54 38.92 25.63 15 XM_B_SpammyWords2 65863 22.94 38.73 16.34 16 XM_DK_Undo_02 64168 14.19 37.73 4.35 17 RCVD_IN_MSPIKE_H2 64135 31.59 37.71 29.04 18 FVGT_m_MULTI_ODD 57351 27.23 33.72 24.51 19 BAYES_99 50564 11.20 29.73 3.45 20 MIME_HTML_ONLY 50317 27.33 29.59 26.39 21 T_KAM_HTML_FONT_INVALID 49757 24.61 29.26 22.67 22 DKIM_VALID_EF 46200 25.86 27.17 25.32 23 TR_XM_DKIM_Undo 45319 9.13 26.65 1.81 24 DCC_CHECK_NEGATIVE 42147 48.02 24.78 57.73 25 T_TM2_M_HEADER_IN_MSG 41774 25.24 24.56 25.53 26 XMSubLong 40338 20.98 23.72 19.83 27 BAYES_999 37520 8.08 22.06 2.23 28 XM_Multi_Part_URI 37394 15.28 21.99 12.47 29 TR_DCC_Bayes_99 34474 6.69 20.27 1.02 30 TR_XM_DK_Unsub 30225 13.14 17.77 11.21 31 XM_B_Unsub 29811 10.43 17.53 7.47 32 UNPARSEABLE_RELAY 29384 12.28 17.28 10.19 33 TR_XM_BayesUnsub 28887 9.23 16.99 5.99 34 XM_B_SpammyWords3 26434 7.67 15.54 4.38 35 RELAYCOUNTRY_META 26000 7.13 15.29 3.72 36 TR_MAX_INTL_RELAY 24711 13.55 14.53 13.13 37 LOTS_OF_MONEY 22246 9.04 13.08 7.35 38 BOTNET_IPINHOSTNAME 21410 5.72 12.59 2.84 39 TR_XM_SpammyWords4 18063 5.86 10.62 3.87 40 XM_Evil_Numbers_Gen 17753 8.80 10.44 8.11 41 TR_XM_SpammyRelay 17507 4.44 10.29 1.99 42 TR_XM_SpammyWords2 15989 3.00 9.40 0.33 43 BAYES_80 15349 8.68 9.03 8.54 44 TR_XM_UnparsRelay 15031 3.74 8.84 1.61 45 BOTNET 15013 3.45 8.83 1.21 46 XM_B_Phish_Phrases 14831 5.97 8.72 4.82 47 LotsOfNums_01 14422 7.59 8.48 7.22 48 FSL_BULK_SIG 14408 10.89 8.47 11.90 49 BAYES_60 12795 10.06 7.52 11.12 50 XM_Body_Dirty_Words 12583 4.05 7.40 2.66 51 XM_UncommonTLD01 12397 7.06 7.29 6.96 52 HTML_IMAGE_RATIO_02 12323 5.53 7.25 4.81 53 MPART_ALT_DIFF 12185 4.90 7.17 3.95 54 XMSubMetaSx_00 12160 4.10 7.15 2.83 55 XM_B_PhoneNumber 11738 7.43 6.90 7.65 56 UNTRUSTED_Relay 11505 3.04 6.77 1.49 57 RCVD_IN_BL_SPAMCOP_NET 11298 2.42 6.64 0.66 58 XM_H_Long_From01 10632 5.26 6.25 4.85 59 XMStrtUSub 9655 5.95 5.68 6.06 60 XMSexyCombo_05 9515 2.71 5.60 1.51 61 TooManyTo_001 9481 6.42 5.58 6.78 62 XM_B_SEO 9405 2.49 5.53 1.22 63 BAYES_95 8736 4.75 5.14 4.59 64 HTML_IMAGE_RATIO_04 8725 4.25 5.13 3.88 65 TR_XM_SPAMCOP 8599 1.70 5.06 0.30 66 XM_H_GMP 8339 4.53 4.90 4.37 67 XM_SPF_SoftFail 8151 2.53 4.79 1.59 68 TR_XM_SEO4 8036 1.97 4.73 0.82 69 DKIM_INVALID 7798 2.70 4.59 1.91 70 RELAYCOUNTRY_CA 7705 2.06 4.53 1.02 71 TR_XM_PhishingBody 6979 2.30 4.10 1.54 72 MIME_HTML_ONLY_MULTI 6962 2.76 4.09 2.20 73 XM_B_Investor 6934 2.08 4.08 1.25 74 MIME_HTML_MOSTLY 6734 2.84 3.96 2.37 75 HTML_IMAGE_RATIO_06 6427 3.06 3.78 2.76 76 XM_B_SpammyTLD 6405 2.69 3.77 2.25 77 T_XMDrugObfuBody_14 6320 2.06 3.72 1.36 78 XMNumbers 5977 5.46 3.51 6.27 79 TM2_M_URI_OPT_OUT 5913 2.13 3.48 1.57 80 MIME_QP_LONG_LINE 5828 4.37 3.43 4.76 81 TM2_M_VERY_LONG_WORD 5820 1.79 3.42 1.11 82 TR_XM_SpammyWords5 5544 1.76 3.26 1.14 83 XM_B_SpammyWords4 5523 1.44 3.25 0.69 84 XM_UB50 5477 1.58 3.22 0.90 85 XM_CamelCaseFrm001 5201 2.43 3.06 2.17 86 T_XMDrugObfuBody_08 5119 1.97 3.01 1.54 87 XM_URI_RBL 5074 1.24 2.98 0.52 88 ALL_TRUSTED 5048 19.49 2.97 26.40 89 T_TooManySym_01 4977 4.05 2.93 4.52 90 RCVD_IN_MSPIKE_H3 4972 4.38 2.92 4.99 91 RCVD_IN_MSPIKE_WL 4972 4.38 2.92 4.99 92 XMDiploma_00 4865 1.71 2.86 1.23 93 HTML_IMAGE_RATIO_08 4674 2.06 2.75 1.78 94 XM_B_URI_Unicode 4667 2.24 2.74 2.02 95 SpammyFromTLD_02 4541 1.07 2.67 0.40 96 XM_OfRef6 4460 1.25 2.62 0.67 97 RCVD_IN_VALIDITY_SAFE 4435 3.82 2.61 4.33 98 XM_B_Unsub2 4324 1.69 2.54 1.33 99 RELAYCOUNTRY_AU 4180 1.18 2.46 0.65 100 RCVD_IN_VALIDITY_RPBL 4037 0.78 2.37 0.11 101 XMBody_17 4016 0.96 2.36 0.38 102 XMStockSpam_06 3927 1.84 2.31 1.64 103 XMBrknScrpt_02 3874 1.28 2.28 0.87 104 USER_IN_DEF_DKIM_WL 3871 9.96 2.28 13.17 105 MAILING_LIST_MULTI 3704 2.40 2.18 2.49 106 XM_DK_Undo_01 3602 1.66 2.12 1.48 107 SpammyFromTLD_01 3412 1.32 2.01 1.04 108 TR_XM_NoHeaderRelay 3399 0.70 2.00 0.16 109 FROM_EXCESS_BASE64 3386 1.99 1.99 1.99 110 T_XMHurry_00 3256 1.08 1.91 0.73 111 RCVD_IN_VALIDITY_CERTIFIED 3182 3.06 1.87 3.56 112 T_FILL_THIS_FORM_SHORT 3082 0.98 1.81 0.64 113 BAYES_40 3079 3.33 1.81 3.97 114 RELAYCOUNTRY_FR 3020 0.78 1.78 0.37 115 TR_Symld_Words 2977 4.33 1.75 5.41 116 URI_HEX 2887 1.37 1.70 1.24 117 HTML_MIME_NO_HTML_TAG 2838 1.83 1.67 1.90 118 XM_B_REG_HTML 2828 0.59 1.66 0.14 119 XM_H_Long_From02 2754 1.12 1.62 0.92 120 XM_BadFromFormat 2688 1.82 1.58 1.93 121 XMSubMetaI_00 2604 1.00 1.53 0.77 122 T_XMDrugObfuBody_00 2544 0.82 1.50 0.54 123 RCVD_IN_IADB_LISTED 2539 2.90 1.49 3.49 124 XMBdyGiftCard01 2515 1.07 1.48 0.90 125 URI_NOVOWEL 2495 1.27 1.47 1.19 126 HTML_IMAGE_ONLY_32 2459 1.95 1.45 2.17 127 SHORTCIRCUIT 2422 0.42 1.42 0.00 128 RCVD_IN_ZEN_LASTEXTERNAL 2422 0.42 1.42 0.00 129 SUBJ_ALL_CAPS 2403 1.22 1.41 1.14 130 XM_SendGrid 2388 1.30 1.40 1.25 131 TR_LOTS_OF_MONEY3 2358 0.58 1.39 0.25 132 XMPhish30 2334 0.77 1.37 0.52 133 SHOPIFY_IMG_NOT_RCVD_SFY 2310 0.55 1.36 0.21 134 TooManyTo_002 2290 1.71 1.35 1.86 135 XM_B_COVIDMETA 2284 0.52 1.34 0.17 136 TR_Mismatch_TLD_02 2273 0.44 1.34 0.06 137 XMSexyCombo_01 2265 0.59 1.33 0.28 138 RCVD_IN_IADB_SPF 2242 2.56 1.32 3.08 139 BAYES_00 2175 6.73 1.28 9.01 140 PDS_FROM_2_EMAILS 2159 1.66 1.27 1.83 141 TR_XM_InvalidRelay 2145 0.39 1.26 0.02 142 RCVD_IN_IADB_DK 2129 2.26 1.25 2.68 143 RCVD_IN_IADB_SENDERID 2106 2.32 1.24 2.77 144 XMHTML_After_End 2062 0.52 1.21 0.23 145 T_TooManySym_02 2057 1.96 1.21 2.27 146 XMGenDplmaNmb 2032 0.79 1.19 0.62 147 TR_XM_DK_Bayes 2019 5.11 1.19 6.75 148 TR_XM_DK_Bayes1 2004 5.04 1.18 6.65 149 THIS_AD 2003 0.52 1.18 0.25 150 XMHTMLBadTable_001 1994 0.53 1.17 0.27 151 DIET_1 1990 0.51 1.17 0.23 152 T_REMOTE_IMAGE 1967 2.61 1.16 3.22 153 HTTPS_HTTP_MISMATCH 1950 0.78 1.15 0.63 154 LongTLD 1940 0.60 1.14 0.37 155 DKIM_ADSP_CUSTOM_MED 1937 0.87 1.14 0.76 156 PLING_QUERY 1935 0.55 1.14 0.30 157 KHOP_HELO_FCRDNS 1935 1.10 1.14 1.09 158 TR_XM_FormFill 1927 0.34 1.13 0.01 159 RCVD_IN_PSBL 1921 0.39 1.13 0.08 160 XM_B_Phish66 1914 0.54 1.13 0.30 161 URI_TRY_3LD 1894 0.73 1.11 0.58 162 BAYES_20 1889 2.44 1.11 2.99 163 XM_UB99 1838 0.32 1.08 0.01 164 HTML_TAG_BALANCE_BODY 1824 0.72 1.07 0.58 165 XM_ProductURIs 1775 0.75 1.04 0.63 166 TR_XM_DK_Bayes2 1766 4.35 1.04 5.73 167 TR_XM_INV_DKIM 1729 0.36 1.02 0.08 168 T_MONEY_PERCENT 1718 0.53 1.01 0.33 169 TR_LOTS_OF_MONEY2 1718 0.53 1.01 0.33 170 XM_UB60 1713 0.38 1.01 0.12 171 XM_DIRTYINTL 1713 0.39 1.01 0.13 172 MPART_ALT_DIFF_COUNT 1706 0.86 1.00 0.80 173 XM_H_Undi_Recip 1642 0.40 0.97 0.16 174 NML_ADSP_CUSTOM_MED 1637 0.65 0.96 0.52 175 XM_B_COPY_HTML 1628 0.70 0.96 0.59 176 TR_XM_PHPForged 1625 0.54 0.96 0.36 177 TR_XM_PHPDW 1592 0.53 0.94 0.36 178 T_STY_INVIS_DIRECT 1580 0.44 0.93 0.23 179 TR_XM_RelayPhish 1552 0.31 0.91 0.06 180 TR_XM_FormFill2 1545 0.52 0.91 0.36 181 SUBJ_DOLLARS 1540 0.48 0.91 0.31 182 T_Symld_Words_02 1536 0.67 0.90 0.58 183 XM_H_PHPOS 1527 0.51 0.90 0.35 184 TR_XM_DK_SendGrid 1512 0.84 0.89 0.81 185 XM_HighProb1 1471 0.26 0.87 0.00 186 RDNS_DYNAMIC 1463 0.45 0.86 0.28 187 RELAYCOUNTRY_GB 1458 0.54 0.86 0.40 188 HOSTED_IMG_MULTI_PUB_01 1454 0.30 0.86 0.07 189 T_TooManySym_03 1427 0.86 0.84 0.87 190 PDS_RDNS_DYNAMIC_FP 1413 0.35 0.83 0.15 191 RCVD_IN_PBL 1399 0.61 0.82 0.53 192 HTML_IMAGE_ONLY_20 1396 0.61 0.82 0.52 193 TR_XM_Undi_Recip19 1379 0.29 0.81 0.07 194 XMPhish14 1377 0.51 0.81 0.39 195 TR_XM_Base64_M1 1369 0.64 0.81 0.57 196 TM2_M_OBFU_COMMENT 1368 0.45 0.80 0.30 197 XM_UB80 1360 0.25 0.80 0.02 198 XMSlimDrugH 1357 0.49 0.80 0.36 199 LONGLN_LOW_CONTRAST 1355 0.37 0.80 0.20 200 XM_UB999 1354 0.24 0.80 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 366890 91.80 95.73 90.16 2 XM_B_Unicode 297917 76.49 84.33 73.21 3 RELAYCOUNTRY_US 287446 74.20 82.73 70.64 4 DKIM_SIGNED 274942 73.75 88.54 67.57 5 XM_DK_Pass 270693 72.10 85.45 66.52 6 DKIM_VALID 267189 71.05 83.96 65.66 7 DCC_CHECK_NEGATIVE 234894 48.02 24.78 57.73 8 BAYES_50 221852 50.94 42.36 54.52 9 DKIM_VALID_AU 215235 56.92 66.54 52.89 10 XMListUnsubscribeExists 184476 52.25 68.79 45.34 11 DCC_CHECK 171891 51.54 73.78 42.24 12 XM_B_SpammyWords 164917 48.72 68.32 40.53 13 XM_B_Unicode3 159439 42.08 49.03 39.18 14 RCVD_IN_MSPIKE_H2 118156 31.59 37.71 29.04 15 ALL_TRUSTED 107421 19.49 2.97 26.40 16 MIME_HTML_ONLY 107389 27.33 29.59 26.39 17 HTML_FONT_LOW_CONTRAST 104285 29.54 38.92 25.63 18 T_TM2_M_HEADER_IN_MSG 103881 25.24 24.56 25.53 19 DKIM_VALID_EF 103026 25.86 27.17 25.32 20 FVGT_m_MULTI_ODD 99750 27.23 33.72 24.51 21 LOC_TINY_FONT_1 98519 31.10 47.57 24.21 22 T_KAM_HTML_FONT_INVALID 92242 24.61 29.26 22.67 23 XMSubLong 80694 20.98 23.72 19.83 24 XM_B_SpammyWords2 66489 22.94 38.73 16.34 25 USER_IN_DEF_DKIM_WL 53588 9.96 2.28 13.17 26 TR_MAX_INTL_RELAY 53442 13.55 14.53 13.13 27 XM_Multi_Part_URI 50758 15.28 21.99 12.47 28 FSL_BULK_SIG 48439 10.89 8.47 11.90 29 TR_XM_DK_Unsub 45610 13.14 17.77 11.21 30 BAYES_60 45263 10.06 7.52 11.12 31 UNPARSEABLE_RELAY 41467 12.28 17.28 10.19 32 BAYES_00 36654 6.73 1.28 9.01 33 BAYES_80 34751 8.68 9.03 8.54 34 XM_Evil_Numbers_Gen 33009 8.80 10.44 8.11 35 XM_B_PhoneNumber 31139 7.43 6.90 7.65 36 XM_B_Unsub 30387 10.43 17.53 7.47 37 LOTS_OF_MONEY 29898 9.04 13.08 7.35 38 HTML_FONT_SIZE_LARGE 29776 5.29 0.45 7.32 39 LotsOfNums_01 29392 7.59 8.48 7.22 40 XM_DKIMWhitelistDomains 28386 4.93 0.05 6.98 41 XM_UncommonTLD01 28314 7.06 7.29 6.96 42 TooManyTo_001 27571 6.42 5.58 6.78 43 TR_XM_DK_Bayes 27453 5.11 1.19 6.75 44 TR_XM_DK_Bayes1 27054 5.04 1.18 6.65 45 XMNumbers 25523 5.46 3.51 6.27 46 XMStrtUSub 24669 5.95 5.68 6.06 47 TR_XM_BayesUnsub 24366 9.23 16.99 5.99 48 IN_ZIMBRA_NJ_WHITELIST 23812 4.16 0.10 5.85 49 TR_XM_DK_Bayes2 23313 4.35 1.04 5.73 50 TR_Symld_Words 22017 4.33 1.75 5.41 51 RCVD_IN_MSPIKE_H3 20308 4.38 2.92 4.99 52 RCVD_IN_MSPIKE_WL 20308 4.38 2.92 4.99 53 XM_H_Long_From01 19723 5.26 6.25 4.85 54 XM_B_Phish_Phrases 19600 5.97 8.72 4.82 55 HTML_IMAGE_RATIO_02 19567 5.53 7.25 4.81 56 MIME_QP_LONG_LINE 19360 4.37 3.43 4.76 57 BAYES_95 18680 4.75 5.14 4.59 58 T_TooManySym_01 18404 4.05 2.93 4.52 59 XM_B_SpammyWords3 17843 7.67 15.54 4.38 60 XM_H_GMP 17775 4.53 4.90 4.37 61 XM_DK_Undo_02 17688 14.19 37.73 4.35 62 RCVD_IN_VALIDITY_SAFE 17612 3.82 2.61 4.33 63 BAYES_40 16151 3.33 1.81 3.97 64 MPART_ALT_DIFF 16058 4.90 7.17 3.95 65 HTML_IMAGE_RATIO_04 15777 4.25 5.13 3.88 66 TR_XM_SpammyWords4 15762 5.86 10.62 3.87 67 RELAYCOUNTRY_META 15126 7.13 15.29 3.72 68 XM_PDF 14770 2.74 0.62 3.63 69 RCVD_IN_VALIDITY_CERTIFIED 14495 3.06 1.87 3.56 70 RCVD_IN_IADB_LISTED 14221 2.90 1.49 3.49 71 BAYES_99 14042 11.20 29.73 3.45 72 T_REMOTE_IMAGE 13120 2.61 1.16 3.22 73 RCVD_IN_IADB_SPF 12536 2.56 1.32 3.08 74 BAYES_20 12184 2.44 1.11 2.99 75 BOTNET_IPINHOSTNAME 11567 5.72 12.59 2.84 76 XMSubMetaSx_00 11521 4.10 7.15 2.83 77 RCVD_IN_IADB_SENDERID 11252 2.32 1.24 2.77 78 HTML_IMAGE_RATIO_06 11240 3.06 3.78 2.76 79 ANY_BOUNCE_MESSAGE 11071 2.11 0.65 2.72 80 BOUNCE_MESSAGE 11071 2.11 0.65 2.72 81 RCVD_IN_IADB_DK 10888 2.26 1.25 2.68 82 XM_Body_Dirty_Words 10810 4.05 7.40 2.66 83 MAILING_LIST_MULTI 10145 2.40 2.18 2.49 84 MIME_HTML_MOSTLY 9659 2.84 3.96 2.37 85 T_TooManySym_02 9239 1.96 1.21 2.27 86 RCVD_IN_IADB_VOUCHED 9238 1.83 0.77 2.27 87 XM_B_SpammyTLD 9139 2.69 3.77 2.25 88 BAYES_999 9079 8.08 22.06 2.23 89 MIME_HTML_ONLY_MULTI 8968 2.76 4.09 2.20 90 XM_CamelCaseFrm001 8835 2.43 3.06 2.17 91 HTML_IMAGE_ONLY_32 8819 1.95 1.45 2.17 92 XM_B_URI_Unicode 8231 2.24 2.74 2.02 93 TR_XM_SpammyRelay 8111 4.44 10.29 1.99 94 FROM_EXCESS_BASE64 8092 1.99 1.99 1.99 95 XM_BadFromFormat 7835 1.82 1.58 1.93 96 DKIM_INVALID 7753 2.70 4.59 1.91 97 HTML_MIME_NO_HTML_TAG 7748 1.83 1.67 1.90 98 TooManyTo_002 7558 1.71 1.35 1.86 99 PDS_FROM_2_EMAILS 7441 1.66 1.27 1.83 100 INVALID_MSGID 7377 1.32 0.12 1.81 101 TR_XM_DKIM_Undo 7349 9.13 26.65 1.81 102 BAYES_05 7333 1.45 0.59 1.80 103 HTML_IMAGE_RATIO_08 7225 2.06 2.75 1.78 104 XMStockSpam_06 6685 1.84 2.31 1.64 105 TR_XM_UnparsRelay 6571 3.74 8.84 1.61 106 XM_SPF_SoftFail 6466 2.53 4.79 1.59 107 TM2_M_URI_OPT_OUT 6396 2.13 3.48 1.57 108 RCVD_IN_IADB_OPTIN 6341 1.23 0.43 1.56 109 TR_XM_PhishingBody 6274 2.30 4.10 1.54 110 T_XMDrugObfuBody_08 6261 1.97 3.01 1.54 111 TO_MALFORMED 6210 1.09 0.05 1.53 112 XMSexyCombo_05 6134 2.71 5.60 1.51 113 UNTRUSTED_Relay 6054 3.04 6.77 1.49 114 XM_DK_Undo_01 6003 1.66 2.12 1.48 115 T_XMDrugObfuBody_14 5549 2.06 3.72 1.36 116 XM_B_Unsub2 5427 1.69 2.54 1.33 117 XM_SendGrid 5095 1.30 1.40 1.25 118 XM_B_Investor 5068 2.08 4.08 1.25 119 URI_HEX 5040 1.37 1.70 1.24 120 XMDiploma_00 5007 1.71 2.86 1.23 121 IN_HORDE_ADDRESS_BOOK 5005 0.90 0.12 1.23 122 XM_B_SEO 4952 2.49 5.53 1.22 123 BOTNET 4915 3.45 8.83 1.21 124 TooManyTo_003 4842 1.01 0.58 1.19 125 URI_NOVOWEL 4824 1.27 1.47 1.19 126 XMGappySubj_01 4719 0.88 0.20 1.16 127 SUBJ_ALL_CAPS 4636 1.22 1.41 1.14 128 TR_XM_SpammyWords5 4625 1.76 3.26 1.14 129 TM2_M_VERY_LONG_WORD 4527 1.79 3.42 1.11 130 NAME_EMAIL_DIFF 4439 0.97 0.69 1.09 131 KHOP_HELO_FCRDNS 4429 1.10 1.14 1.09 132 XM_GoogleGroups 4258 0.92 0.63 1.05 133 SpammyFromTLD_01 4231 1.32 2.01 1.04 134 RELAYCOUNTRY_CA 4166 2.06 4.53 1.02 135 TR_DCC_Bayes_99 4152 6.69 20.27 1.02 136 TVD_SPACE_RATIO 3815 0.70 0.14 0.94 137 HELO_NODOT 3792 0.69 0.11 0.93 138 HELO_NO_DOMAIN 3789 0.69 0.11 0.93 139 XM_H_Long_From02 3727 1.12 1.62 0.92 140 XMCapTrack 3710 0.80 0.55 0.91 141 XMBdyGiftCard01 3653 1.07 1.48 0.90 142 XM_UB50 3649 1.58 3.22 0.90 143 XMBrknScrpt_02 3521 1.28 2.28 0.87 144 T_TooManySym_03 3520 0.86 0.84 0.87 145 TooManyTo_004 3470 0.76 0.52 0.85 146 FROM_GOV_DKIM_AU 3451 0.66 0.21 0.85 147 TR_XM_SEO4 3333 1.97 4.73 0.82 148 TR_XM_DK_SendGrid 3308 0.84 0.89 0.81 149 MPART_ALT_DIFF_COUNT 3268 0.86 1.00 0.80 150 XMSubMetaI_00 3148 1.00 1.53 0.77 151 DKIM_ADSP_CUSTOM_MED 3098 0.87 1.14 0.76 152 T_XMHurry_00 2951 1.08 1.91 0.73 153 XMGappySubj_02 2919 0.54 0.12 0.72 154 XM_B_SpammyWords4 2811 1.44 3.25 0.69 155 TooManyTo_005 2771 0.62 0.48 0.68 156 XM_B_DNDMA 2750 0.68 0.69 0.68 157 XMBody_95 2733 0.61 0.46 0.67 158 XM_OfRef6 2725 1.25 2.62 0.67 159 RCVD_IN_BL_SPAMCOP_NET 2677 2.42 6.64 0.66 160 RELAYCOUNTRY_AU 2637 1.18 2.46 0.65 161 T_FILL_THIS_FORM_SHORT 2588 0.98 1.81 0.64 162 XM_ShortIntro_01 2571 0.57 0.44 0.63 163 HTTPS_HTTP_MISMATCH 2571 0.78 1.15 0.63 164 XM_ProductURIs 2564 0.75 1.04 0.63 165 XMGenDplmaNmb 2515 0.79 1.19 0.62 166 T_OBFU_PDF_ATTACH 2432 0.47 0.15 0.60 167 XM_B_COPY_HTML 2392 0.70 0.96 0.59 168 HTML_TAG_BALANCE_BODY 2355 0.72 1.07 0.58 169 T_Symld_Words_02 2347 0.67 0.90 0.58 170 URI_TRY_3LD 2346 0.73 1.11 0.58 171 TR_XM_Base64_M1 2325 0.64 0.81 0.57 172 TR_MetaPhish_Combo_01 2244 0.60 0.71 0.55 173 T_XMDrugObfuBody_00 2184 0.82 1.50 0.54 174 XM_H_PHPMailer 2169 0.56 0.61 0.53 175 RCVD_IN_PBL 2146 0.61 0.82 0.53 176 XMPhish30 2129 0.77 1.37 0.52 177 NML_ADSP_CUSTOM_MED 2125 0.65 0.96 0.52 178 XMNoVowels 2124 0.50 0.46 0.52 179 HTML_IMAGE_ONLY_20 2120 0.61 0.82 0.52 180 XM_URI_RBL 2100 1.24 2.98 0.52 181 FORGED_GMAIL_RCVD 1996 0.55 0.70 0.49 182 TVD_RCVD_IP 1870 0.52 0.66 0.46 183 XMMoneyMeta_00 1735 0.51 0.71 0.43 184 RELAYCOUNTRY_GB 1638 0.54 0.86 0.40 185 SpammyFromTLD_02 1637 1.07 2.67 0.40 186 XMSubNoVowel 1609 0.40 0.42 0.40 187 T_MANY_PILL_PRICE 1608 0.28 0.01 0.40 188 XMPhish14 1575 0.51 0.81 0.39 189 MSGID_FROM_MTA_HEADER 1561 0.30 0.10 0.38 190 XMLngstWrd_00 1560 0.42 0.52 0.38 191 HTML_IMAGE_ONLY_28 1560 0.33 0.22 0.38 192 XMBody_17 1534 0.96 2.36 0.38 193 LongTLD 1520 0.60 1.14 0.37 194 USER_IN_WHITELIST 1517 0.26 0.00 0.37 195 USER_IN_WELCOMELIST 1517 0.26 0.00 0.37 196 RELAYCOUNTRY_FR 1508 0.78 1.78 0.37 197 TR_XM_PHPForged 1478 0.54 0.96 0.36 198 XMSlimDrugH 1472 0.49 0.80 0.36 199 TR_XM_PHPDW 1464 0.53 0.94 0.36 200 TR_XM_FormFill2 1462 0.52 0.91 0.36 ----------------------------------------------------------------------