Email: 520578 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.38 sec Spam: 159994 Autolearn: 0 AvgScore: 15.26 AvgScanTime: 1.48 sec Ham: 360584 Autolearn: 0 AvgScore: -0.04 AvgScanTime: 1.33 sec Time Spent Running SA: 198.84 hours Time Spent Processing Spam: 65.58 hours Time Spent Processing Ham: 133.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147789 87.85 92.37 85.85 2 DKIM_SIGNED 140100 79.73 87.57 76.26 3 RELAYCOUNTRY_US 135040 82.31 84.40 81.38 4 XM_DK_Pass 133994 77.67 83.75 74.97 5 DKIM_VALID 132370 76.64 82.73 73.93 6 XM_B_Unicode 130942 73.30 81.84 69.51 7 DCC_CHECK 120231 51.29 75.15 40.70 8 XM_B_SpammyWords 111378 53.34 69.61 46.12 9 XMListUnsubscribeExists 111028 55.31 69.40 49.06 10 DKIM_VALID_AU 104859 61.74 65.54 60.05 11 XM_B_Unicode3 79774 44.43 49.86 42.02 12 LOC_TINY_FONT_1 74511 33.83 46.57 28.18 13 BAYES_50 67714 55.74 42.32 61.70 14 XM_B_SpammyWords2 64040 26.43 40.03 20.39 15 HTML_FONT_LOW_CONTRAST 60227 32.07 37.64 29.59 16 RCVD_IN_MSPIKE_H2 59136 34.43 36.96 33.31 17 XM_DK_Undo_02 58296 14.66 36.44 5.00 18 FVGT_m_MULTI_ODD 50931 26.81 31.83 24.58 19 BAYES_99 48536 11.77 30.34 3.54 20 T_KAM_HTML_FONT_INVALID 47141 23.32 29.46 20.59 21 MIME_HTML_ONLY 46879 21.92 29.30 18.65 22 DKIM_VALID_EF 41961 28.86 26.23 30.03 23 TR_XM_DKIM_Undo 40707 9.12 25.44 1.87 24 BAYES_999 38047 9.16 23.78 2.68 25 XMSubLong 37961 22.70 23.73 22.24 26 DCC_CHECK_NEGATIVE 37060 48.16 23.16 59.25 27 XM_Multi_Part_URI 35904 19.19 22.44 17.75 28 T_TM2_M_HEADER_IN_MSG 35276 28.03 22.05 30.68 29 TR_DCC_Bayes_99 34537 7.57 21.59 1.35 30 TR_XM_DK_Unsub 28372 14.00 17.73 12.35 31 UNPARSEABLE_RELAY 27761 13.51 17.35 11.80 32 XM_B_Unsub 26234 11.50 16.40 9.33 33 TR_XM_BayesUnsub 25322 10.19 15.83 7.69 34 RELAYCOUNTRY_META 25107 7.41 15.69 3.74 35 TR_MAX_INTL_RELAY 22502 8.55 14.06 6.11 36 LOTS_OF_MONEY 21489 8.33 13.43 6.07 37 BOTNET_IPINHOSTNAME 21166 6.15 13.23 3.01 38 XM_B_SpammyWords3 21083 8.57 13.18 6.53 39 TR_XM_SpammyWords4 19600 6.75 12.25 4.31 40 XM_Evil_Numbers_Gen 18833 9.82 11.77 8.95 41 TR_XM_SpammyRelay 18786 4.93 11.74 1.91 42 TR_XM_SpammyWords2 16789 3.50 10.49 0.39 43 BOTNET 16775 4.16 10.48 1.36 44 FSL_BULK_SIG 15424 7.22 9.64 6.15 45 BAYES_80 13967 5.31 8.73 3.80 46 TR_XM_UnparsRelay 13628 3.87 8.52 1.81 47 XM_B_Phish_Phrases 13092 7.58 8.18 7.31 48 LotsOfNums_01 12818 8.39 8.01 8.56 49 BAYES_60 12402 8.61 7.75 9.00 50 HTML_IMAGE_RATIO_02 12359 5.95 7.72 5.16 51 XM_Body_Dirty_Words 12346 3.90 7.72 2.21 52 XM_B_PhoneNumber 11979 8.37 7.49 8.77 53 XM_H_Long_From01 10498 5.59 6.56 5.16 54 MPART_ALT_DIFF 10305 5.45 6.44 5.02 55 TooManyTo_001 10031 7.48 6.27 8.01 56 XM_UncommonTLD01 9980 4.48 6.24 3.70 57 RCVD_IN_BL_SPAMCOP_NET 9888 2.38 6.18 0.69 58 XMSubMetaSx_00 9863 4.51 6.16 3.78 59 XM_H_GMP 9698 5.51 6.06 5.26 60 XM_SPF_SoftFail 9570 3.11 5.98 1.83 61 UNTRUSTED_Relay 9247 2.82 5.78 1.51 62 XMSexyCombo_05 9123 2.85 5.70 1.58 63 XM_B_Investor 8577 2.53 5.36 1.28 64 XM_B_SEO 8442 2.46 5.28 1.21 65 XMStrtUSub 8128 4.86 5.08 4.76 66 BAYES_95 8045 3.14 5.03 2.31 67 HTML_IMAGE_RATIO_04 7898 5.33 4.94 5.50 68 DKIM_INVALID 7730 3.10 4.83 2.33 69 RELAYCOUNTRY_CA 7694 2.18 4.81 1.01 70 TR_XM_SEO4 7403 1.97 4.63 0.79 71 T_XMDrugObfuBody_08 7389 2.43 4.62 1.45 72 TR_XM_SPAMCOP 6719 1.53 4.20 0.35 73 MIME_HTML_ONLY_MULTI 6687 2.88 4.18 2.31 74 TR_XM_PhishingBody 6448 2.26 4.03 1.48 75 T_XMDrugObfuBody_14 6260 2.37 3.91 1.69 76 RCVD_IN_VALIDITY_RPBL 6256 1.31 3.91 0.16 77 XM_B_SpammyTLD 5727 4.06 3.58 4.27 78 HTML_IMAGE_RATIO_06 5668 3.36 3.54 3.28 79 TR_XM_SpammyWords5 5583 2.14 3.49 1.53 80 T_FILL_THIS_FORM_SHORT 5400 1.71 3.38 0.97 81 XMNumbers 5293 2.86 3.31 2.66 82 MIME_QP_LONG_LINE 5280 4.34 3.30 4.80 83 MIME_HTML_MOSTLY 5166 3.32 3.23 3.37 84 RCVD_IN_MSPIKE_H3 4974 4.68 3.11 5.38 85 RCVD_IN_MSPIKE_WL 4974 4.68 3.11 5.38 86 HTML_IMAGE_RATIO_08 4964 2.31 3.10 1.96 87 XM_URI_RBL 4887 1.20 3.05 0.38 88 TM2_M_VERY_LONG_WORD 4878 2.57 3.05 2.36 89 XM_CamelCaseFrm001 4779 2.51 2.99 2.29 90 XM_UB50 4691 1.52 2.93 0.89 91 TM2_M_URI_OPT_OUT 4610 1.93 2.88 1.52 92 RCVD_IN_VALIDITY_SAFE 4479 4.00 2.80 4.53 93 XM_OfRef6 4459 1.42 2.79 0.82 94 RELAYCOUNTRY_AU 4380 1.28 2.74 0.63 95 XMDiploma_00 4368 2.00 2.73 1.68 96 XMBody_17 4285 1.09 2.68 0.38 97 T_MONEY_PERCENT 4280 0.97 2.68 0.21 98 TR_LOTS_OF_MONEY2 4280 0.97 2.68 0.21 99 XM_B_SpammyWords4 4228 1.46 2.64 0.93 100 XM_H_Long_From02 4207 1.43 2.63 0.90 101 XM_B_Unsub2 4148 1.94 2.59 1.65 102 TR_LOTS_OF_MONEY3 4138 1.01 2.59 0.31 103 TR_XM_FormFill 4118 0.80 2.57 0.01 104 XM_B_URI_Unicode 4087 2.26 2.55 2.13 105 T_TooManySym_01 3793 4.55 2.37 5.51 106 DKIM_ADSP_CUSTOM_MED 3756 1.28 2.35 0.80 107 SpammyFromTLD_01 3710 1.21 2.32 0.72 108 RCVD_IN_XBL 3484 0.68 2.18 0.02 109 XM_DK_Undo_01 3474 1.87 2.17 1.73 110 BOTNET_NORDNS 3431 0.67 2.14 0.01 111 T_XMHurry_00 3427 1.16 2.14 0.72 112 NML_ADSP_CUSTOM_MED 3410 1.04 2.13 0.55 113 FROM_EXCESS_BASE64 3311 2.17 2.07 2.21 114 MAILING_LIST_MULTI 3292 2.60 2.06 2.84 115 XMStockSpam_06 3277 1.81 2.05 1.71 116 TR_XM_NoHeaderRelay 3250 0.71 2.03 0.13 117 FORGED_GMAIL_RCVD 3226 0.94 2.02 0.46 118 ALL_TRUSTED 3222 11.42 2.01 15.59 119 XMSubMetaI_00 3218 1.17 2.01 0.80 120 USER_IN_DEF_DKIM_WL 3199 10.38 2.00 14.10 121 RCVD_IN_VALIDITY_CERTIFIED 3170 3.10 1.98 3.59 122 XM_Nigeria_01 3133 0.62 1.96 0.02 123 RCVD_IN_PSBL 3003 0.64 1.88 0.09 124 DEAR_FRIEND 2860 0.58 1.79 0.04 125 TR_XM_PHPForged 2849 0.90 1.78 0.51 126 TR_XM_PHPDW 2816 0.89 1.76 0.50 127 DIET_1 2794 0.76 1.75 0.33 128 TR_XM_FormFill2 2790 0.89 1.74 0.51 129 RCVD_IN_SBL_CSS 2775 0.55 1.73 0.02 130 HK_SCAM 2765 0.53 1.73 0.01 131 XM_H_PHPOS 2758 0.87 1.72 0.49 132 XMBrknScrpt_02 2750 1.19 1.72 0.95 133 BAYES_40 2746 3.97 1.72 4.97 134 KHOP_HELO_FCRDNS 2730 1.78 1.71 1.81 135 TooManyTo_002 2717 2.12 1.70 2.30 136 MONEY_FRAUD_8 2699 0.52 1.69 0.00 137 SHORTCIRCUIT 2676 0.51 1.67 0.00 138 RCVD_IN_ZEN_LASTEXTERNAL 2676 0.51 1.67 0.00 139 TO_NO_BRKTS_FROM_MSSP 2663 0.53 1.66 0.02 140 MONEY_FORM_SHORT 2645 0.52 1.65 0.01 141 SUBJ_ALL_CAPS 2644 1.45 1.65 1.36 142 URG_BIZ 2624 0.55 1.64 0.06 143 LOADSA_MONEY_COMBO 2617 0.58 1.64 0.10 144 TVD_PH_SEC 2606 0.62 1.63 0.17 145 FROM_MISSP_REPLYTO 2602 0.50 1.63 0.00 146 FORGED_MUA_OUTLOOK 2587 0.51 1.62 0.02 147 RCVD_IN_SBL 2577 0.50 1.61 0.00 148 RCVD_IN_IADB_LISTED 2576 3.00 1.61 3.61 149 FROM_MISSP_MSFT 2573 0.49 1.61 0.00 150 AXB_XMAILER_MIMEOLE_OL_024C2 2567 0.49 1.60 0.00 151 FSL_CTYPE_WIN1251 2563 0.49 1.60 0.00 152 FSL_NEW_HELO_USER 2561 0.49 1.60 0.00 153 T_REMOTE_IMAGE 2554 2.79 1.60 3.32 154 URI_HEX 2536 1.28 1.59 1.15 155 XFER_LOTSA_MONEY 2525 0.50 1.58 0.02 156 TO_NO_BRKTS_MSFT 2522 0.48 1.58 0.00 157 NSL_RCVD_FROM_USER 2506 0.48 1.57 0.00 158 SpammyFromTLD_02 2504 0.63 1.57 0.22 159 ADVANCE_FEE_5_NEW_MONEY 2476 0.48 1.55 0.00 160 XM_Nigeria_02 2475 0.48 1.55 0.00 161 FROM_MISSP_USER 2464 0.47 1.54 0.00 162 THIS_AD 2375 0.84 1.48 0.56 163 XMBdyGiftCard01 2375 1.24 1.48 1.14 164 TR_Mismatch_TLD_01 2351 0.59 1.47 0.20 165 MONEY_FROM_MISSP 2331 0.45 1.46 0.00 166 XM_B_REG_HTML 2307 0.54 1.44 0.14 167 TR_XM_INV_DKIM 2300 0.52 1.44 0.11 168 SHOPIFY_IMG_NOT_RCVD_SFY 2272 0.61 1.42 0.26 169 XMPhish30 2244 0.76 1.40 0.47 170 MILLION_HUNDRED 2236 0.43 1.40 0.00 171 XMGenDplmaNmb 2229 0.95 1.39 0.75 172 XM_SendGrid 2200 1.41 1.38 1.42 173 XMReplyNow 2191 0.62 1.37 0.29 174 HTML_MIME_NO_HTML_TAG 2190 1.94 1.37 2.20 175 RCVD_IN_IADB_SPF 2189 2.65 1.37 3.22 176 HTTPS_HTTP_MISMATCH 2183 1.09 1.36 0.97 177 SHORT_URI 2158 0.43 1.35 0.02 178 T_XMDrugObfuBody_00 2138 0.73 1.34 0.47 179 FORM_FRAUD_5 2086 0.40 1.30 0.00 180 NO_DNS_FOR_FROM 2038 0.62 1.27 0.33 181 RCVD_IN_IADB_DK 2032 2.33 1.27 2.81 182 TR_XM_MaxWHORU 2022 0.57 1.26 0.27 183 RCVD_IN_IADB_SENDERID 2021 2.38 1.26 2.88 184 URI_NOVOWEL 2013 2.65 1.26 3.26 185 URI_TRY_3LD 2011 0.87 1.26 0.70 186 RELAYCOUNTRY_MD 1992 0.38 1.25 0.00 187 XM_S_SpammyWords 1961 0.56 1.23 0.27 188 XMSlimDrugH 1960 0.59 1.23 0.31 189 TR_XM_Spammywords 1954 0.56 1.22 0.27 190 HDR_ORDER_FTSDMCXX_NORDNS 1935 0.37 1.21 0.00 191 XM_ProductURIs 1874 0.86 1.17 0.73 192 BAYES_20 1870 2.72 1.17 3.41 193 XMHTML_After_End 1744 0.52 1.09 0.27 194 RCVD_IN_PBL 1693 0.77 1.06 0.64 195 XMHTMLBadTable_001 1648 0.51 1.03 0.28 196 HTML_TAG_BALANCE_BODY 1641 0.85 1.03 0.77 197 TR_XM_Base64_M1 1640 0.83 1.03 0.74 198 XM_B_FormFill 1638 0.39 1.02 0.11 199 XM_H_Undi_Recip 1605 0.48 1.00 0.25 200 TR_XM_InvalidRelay 1576 0.32 0.99 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 309546 87.85 92.37 85.85 2 RELAYCOUNTRY_US 293433 82.31 84.40 81.38 3 DKIM_SIGNED 274964 79.73 87.57 76.26 4 XM_DK_Pass 270327 77.67 83.75 74.97 5 DKIM_VALID 266578 76.64 82.73 73.93 6 XM_B_Unicode 250649 73.30 81.84 69.51 7 BAYES_50 222481 55.74 42.32 61.70 8 DKIM_VALID_AU 216537 61.74 65.54 60.05 9 DCC_CHECK_NEGATIVE 213648 48.16 23.16 59.25 10 XMListUnsubscribeExists 176905 55.31 69.40 49.06 11 XM_B_SpammyWords 166311 53.34 69.61 46.12 12 XM_B_Unicode3 151535 44.43 49.86 42.02 13 DCC_CHECK 146756 51.29 75.15 40.70 14 RCVD_IN_MSPIKE_H2 120110 34.43 36.96 33.31 15 T_TM2_M_HEADER_IN_MSG 110639 28.03 22.05 30.68 16 DKIM_VALID_EF 108294 28.86 26.23 30.03 17 HTML_FONT_LOW_CONTRAST 106699 32.07 37.64 29.59 18 LOC_TINY_FONT_1 101600 33.83 46.57 28.18 19 FVGT_m_MULTI_ODD 88628 26.81 31.83 24.58 20 XMSubLong 80201 22.70 23.73 22.24 21 T_KAM_HTML_FONT_INVALID 74232 23.32 29.46 20.59 22 XM_B_SpammyWords2 73540 26.43 40.03 20.39 23 MIME_HTML_ONLY 67241 21.92 29.30 18.65 24 XM_Multi_Part_URI 64006 19.19 22.44 17.75 25 ALL_TRUSTED 56228 11.42 2.01 15.59 26 USER_IN_DEF_DKIM_WL 50848 10.38 2.00 14.10 27 TR_XM_DK_Unsub 44532 14.00 17.73 12.35 28 UNPARSEABLE_RELAY 42548 13.51 17.35 11.80 29 XM_DKIMWhitelistDomains 34292 6.63 0.13 9.51 30 XM_B_Unsub 33630 11.50 16.40 9.33 31 BAYES_00 33378 6.62 0.66 9.26 32 BAYES_60 32440 8.61 7.75 9.00 33 XM_Evil_Numbers_Gen 32290 9.82 11.77 8.95 34 XM_B_PhoneNumber 31616 8.37 7.49 8.77 35 LotsOfNums_01 30852 8.39 8.01 8.56 36 TooManyTo_001 28893 7.48 6.27 8.01 37 TR_XM_BayesUnsub 27728 10.19 15.83 7.69 38 XM_B_Phish_Phrases 26342 7.58 8.18 7.31 39 TR_XM_DK_Bayes 24228 4.80 0.47 6.72 40 TR_XM_DK_Bayes1 23822 4.72 0.47 6.61 41 XM_B_SpammyWords3 23554 8.57 13.18 6.53 42 IN_ZIMBRA_NJ_WHITELIST 23524 4.55 0.11 6.52 43 FSL_BULK_SIG 22161 7.22 9.64 6.15 44 TR_MAX_INTL_RELAY 22025 8.55 14.06 6.11 45 LOTS_OF_MONEY 21894 8.33 13.43 6.07 46 TR_XM_DK_Bayes2 20464 4.04 0.34 5.68 47 T_TooManySym_01 19885 4.55 2.37 5.51 48 HTML_IMAGE_RATIO_04 19831 5.33 4.94 5.50 49 RCVD_IN_MSPIKE_H3 19385 4.68 3.11 5.38 50 RCVD_IN_MSPIKE_WL 19385 4.68 3.11 5.38 51 XM_H_GMP 18967 5.51 6.06 5.26 52 HTML_IMAGE_RATIO_02 18594 5.95 7.72 5.16 53 XM_H_Long_From01 18590 5.59 6.56 5.16 54 MPART_ALT_DIFF 18090 5.45 6.44 5.02 55 XM_DK_Undo_02 18037 14.66 36.44 5.00 56 BAYES_40 17937 3.97 1.72 4.97 57 MIME_QP_LONG_LINE 17316 4.34 3.30 4.80 58 XMStrtUSub 17153 4.86 5.08 4.76 59 BOUNCE_MESSAGE 16846 3.46 0.74 4.67 60 ANY_BOUNCE_MESSAGE 16846 3.46 0.74 4.67 61 RCVD_IN_VALIDITY_SAFE 16330 4.00 2.80 4.53 62 TR_XM_SpammyWords4 15529 6.75 12.25 4.31 63 XM_PDF 15447 3.18 0.70 4.28 64 XM_B_SpammyTLD 15394 4.06 3.58 4.27 65 BAYES_80 13698 5.31 8.73 3.80 66 XMSubMetaSx_00 13617 4.51 6.16 3.78 67 RELAYCOUNTRY_META 13483 7.41 15.69 3.74 68 XM_UncommonTLD01 13359 4.48 6.24 3.70 69 RCVD_IN_IADB_LISTED 13028 3.00 1.61 3.61 70 RCVD_IN_VALIDITY_CERTIFIED 12946 3.10 1.98 3.59 71 BAYES_99 12753 11.77 30.34 3.54 72 BAYES_20 12304 2.72 1.17 3.41 73 MIME_HTML_MOSTLY 12141 3.32 3.23 3.37 74 T_REMOTE_IMAGE 11976 2.79 1.60 3.32 75 HTML_IMAGE_RATIO_06 11811 3.36 3.54 3.28 76 URI_NOVOWEL 11760 2.65 1.26 3.26 77 RCVD_IN_IADB_SPF 11602 2.65 1.37 3.22 78 BOTNET_IPINHOSTNAME 10852 6.15 13.23 3.01 79 RCVD_IN_IADB_SENDERID 10372 2.38 1.26 2.88 80 T_TooManySym_02 10264 2.21 0.78 2.85 81 MAILING_LIST_MULTI 10237 2.60 2.06 2.84 82 RCVD_IN_IADB_DK 10116 2.33 1.27 2.81 83 BAYES_999 9650 9.16 23.78 2.68 84 XMNumbers 9608 2.86 3.31 2.66 85 TM2_M_VERY_LONG_WORD 8517 2.57 3.05 2.36 86 RCVD_IN_IADB_VOUCHED 8461 1.91 0.93 2.35 87 DKIM_INVALID 8386 3.10 4.83 2.33 88 BAYES_95 8322 3.14 5.03 2.31 89 MIME_HTML_ONLY_MULTI 8319 2.88 4.18 2.31 90 TooManyTo_002 8310 2.12 1.70 2.30 91 XM_CamelCaseFrm001 8275 2.51 2.99 2.29 92 FROM_EXCESS_BASE64 7963 2.17 2.07 2.21 93 XM_Body_Dirty_Words 7953 3.90 7.72 2.21 94 HTML_MIME_NO_HTML_TAG 7934 1.94 1.37 2.20 95 XM_B_URI_Unicode 7678 2.26 2.55 2.13 96 BAYES_05 7265 1.58 0.61 2.01 97 INVALID_MSGID 7159 1.41 0.12 1.99 98 HTML_IMAGE_RATIO_08 7065 2.31 3.10 1.96 99 TR_XM_SpammyRelay 6871 4.93 11.74 1.91 100 TR_XM_DKIM_Undo 6754 9.12 25.44 1.87 101 XM_SPF_SoftFail 6598 3.11 5.98 1.83 102 KHOP_HELO_FCRDNS 6536 1.78 1.71 1.81 103 TR_XM_UnparsRelay 6525 3.87 8.52 1.81 104 TR_Symld_Words 6344 1.52 0.97 1.76 105 XM_DK_Undo_01 6252 1.87 2.17 1.73 106 TO_MALFORMED 6199 1.20 0.02 1.72 107 XMStockSpam_06 6160 1.81 2.05 1.71 108 T_XMDrugObfuBody_14 6101 2.37 3.91 1.69 109 XMDiploma_00 6048 2.00 2.73 1.68 110 XM_B_Unsub2 5932 1.94 2.59 1.65 111 RCVD_IN_IADB_OPTIN 5889 1.28 0.50 1.63 112 XMSexyCombo_05 5696 2.85 5.70 1.58 113 TR_XM_SpammyWords5 5534 2.14 3.49 1.53 114 TooManyTo_003 5521 1.25 0.62 1.53 115 TM2_M_URI_OPT_OUT 5463 1.93 2.88 1.52 116 UNTRUSTED_Relay 5449 2.82 5.78 1.51 117 TR_XM_PhishingBody 5327 2.26 4.03 1.48 118 T_XMDrugObfuBody_08 5241 2.43 4.62 1.45 119 XMGappySubj_01 5177 1.03 0.13 1.44 120 IN_HORDE_ADDRESS_BOOK 5148 1.03 0.12 1.43 121 XM_SendGrid 5127 1.41 1.38 1.42 122 SUBJ_ALL_CAPS 4918 1.45 1.65 1.36 123 BOTNET 4899 4.16 10.48 1.36 124 TR_DCC_Bayes_99 4860 7.57 21.59 1.35 125 XM_B_Investor 4604 2.53 5.36 1.28 126 XM_B_SEO 4378 2.46 5.28 1.21 127 XMCapTrack 4336 1.01 0.58 1.20 128 XM_TLDProd2 4282 0.90 0.26 1.19 129 XM_GoogleGroups 4245 1.05 0.76 1.18 130 URI_HEX 4131 1.28 1.59 1.15 131 XMBdyGiftCard01 4094 1.24 1.48 1.14 132 TooManyTo_004 4048 0.95 0.56 1.12 133 MAY_BE_FORGED 3968 0.77 0.04 1.10 134 HELO_NODOT 3968 0.87 0.35 1.10 135 HELO_NO_DOMAIN 3963 0.87 0.35 1.10 136 TVD_SPACE_RATIO 3874 0.80 0.17 1.07 137 HTML_EXTRA_CLOSE 3854 0.75 0.03 1.07 138 T_TooManySym_03 3816 0.83 0.32 1.06 139 RELAYCOUNTRY_CA 3647 2.18 4.81 1.01 140 XM_RXBody 3582 0.91 0.71 0.99 141 XMBody_95 3560 0.76 0.26 0.99 142 HTTPS_HTTP_MISMATCH 3496 1.09 1.36 0.97 143 T_FILL_THIS_FORM_SHORT 3491 1.71 3.38 0.97 144 XMBrknScrpt_02 3422 1.19 1.72 0.95 145 XMSubMetaSxObfu_03 3368 0.81 0.54 0.93 146 XM_B_SpammyWords4 3367 1.46 2.64 0.93 147 TooManyTo_005 3325 0.80 0.53 0.92 148 XM_H_Long_From02 3232 1.43 2.63 0.90 149 TR_XM_DK_SendGrid 3215 0.86 0.78 0.89 150 XM_UB50 3214 1.52 2.93 0.89 151 XMGappySubj_02 3191 0.63 0.05 0.88 152 XMLngstWrd_00 3095 0.74 0.47 0.86 153 XM_B_DNDMA 3036 0.82 0.76 0.84 154 XM_OfRef6 2953 1.42 2.79 0.82 155 HTML_IMAGE_ONLY_32 2948 0.61 0.13 0.82 156 DKIM_ADSP_CUSTOM_MED 2886 1.28 2.35 0.80 157 XMSubMetaI_00 2879 1.17 2.01 0.80 158 TR_XM_SEO4 2854 1.97 4.63 0.79 159 HTML_TAG_BALANCE_BODY 2759 0.85 1.03 0.77 160 XM_ShortIntro_01 2749 0.70 0.56 0.76 161 XMLngstWrd_01 2734 0.66 0.43 0.76 162 XMGenDplmaNmb 2718 0.95 1.39 0.75 163 TR_XM_Base64_M1 2658 0.83 1.03 0.74 164 XM_ProductURIs 2628 0.86 1.17 0.73 165 T_XMHurry_00 2602 1.16 2.14 0.72 166 SpammyFromTLD_01 2591 1.21 2.32 0.72 167 FROM_GOV_DKIM_AU 2552 0.52 0.09 0.71 168 URI_TRY_3LD 2541 0.87 1.26 0.70 169 RCVD_IN_BL_SPAMCOP_NET 2483 2.38 6.18 0.69 170 XMNoVowels 2478 0.61 0.43 0.69 171 T_Symld_Words_02 2431 0.75 0.91 0.67 172 XM_B_COPY_HTML 2319 0.72 0.90 0.64 173 RCVD_IN_PBL 2318 0.77 1.06 0.64 174 T_OBFU_PDF_ATTACH 2272 0.51 0.22 0.63 175 RELAYCOUNTRY_AU 2260 1.28 2.74 0.63 176 XMLngstWrd_02 2255 0.54 0.36 0.63 177 HTML_IMAGE_ONLY_20 2135 0.57 0.51 0.59 178 XM_H_PHPMailer 2100 0.60 0.63 0.58 179 TR_MetaPhish_Combo_01 2081 0.63 0.76 0.58 180 THIS_AD 2022 0.84 1.48 0.56 181 NML_ADSP_CUSTOM_MED 1979 1.04 2.13 0.55 182 XMSubMetaSx_01 1870 0.47 0.35 0.52 183 TR_XM_PHPForged 1829 0.90 1.78 0.51 184 TR_XM_FormFill2 1825 0.89 1.74 0.51 185 TR_XM_PHPDW 1810 0.89 1.76 0.50 186 HTML_IMAGE_ONLY_28 1794 0.42 0.26 0.50 187 XM_H_PHPOS 1781 0.87 1.72 0.49 188 MPART_ALT_DIFF_COUNT 1777 0.63 0.95 0.49 189 TVD_RCVD_IP 1766 0.57 0.76 0.49 190 LOW_PRICE 1735 0.44 0.36 0.48 191 XMMoneyMeta_00 1721 0.58 0.80 0.48 192 XMPhish30 1701 0.76 1.40 0.47 193 T_XMDrugObfuBody_00 1678 0.73 1.34 0.47 194 FORGED_GMAIL_RCVD 1657 0.94 2.02 0.46 195 RELAYCOUNTRY_GB 1641 0.55 0.76 0.46 196 XMPhish14 1585 0.53 0.73 0.44 197 XMSubNoVowel 1580 0.41 0.34 0.44 198 T_TVD_MIME_NO_HEADERS 1558 0.36 0.18 0.43 199 PLING_QUERY 1525 0.52 0.73 0.42 200 XMLngstWrd_03 1510 0.38 0.29 0.42 ----------------------------------------------------------------------