Email: 529282 Autolearn: 0 AvgScore: 4.35 AvgScanTime: 1.47 sec Spam: 167413 Autolearn: 0 AvgScore: 14.32 AvgScanTime: 1.61 sec Ham: 361869 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.40 sec Time Spent Running SA: 215.78 hours Time Spent Processing Spam: 75.04 hours Time Spent Processing Ham: 140.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159638 89.83 95.36 87.27 2 DKIM_SIGNED 151773 82.16 90.66 78.24 3 XM_DK_Pass 146286 80.26 87.38 76.97 4 DKIM_VALID 143671 79.12 85.82 76.02 5 XM_B_Unicode 142507 76.24 85.12 72.12 6 RELAYCOUNTRY_US 141556 82.78 84.55 81.96 7 DCC_CHECK 125621 52.60 75.04 42.21 8 XM_B_SpammyWords 118343 54.60 70.69 47.15 9 XMListUnsubscribeExists 118279 57.91 70.65 52.01 10 DKIM_VALID_AU 112425 63.03 67.15 61.13 11 XM_B_Unicode3 85531 45.61 51.09 43.07 12 LOC_TINY_FONT_1 80897 35.15 48.32 29.05 13 BAYES_50 71704 55.37 42.83 61.17 14 XM_B_SpammyWords2 69915 26.39 41.76 19.28 15 HTML_FONT_LOW_CONTRAST 67463 33.02 40.30 29.65 16 XM_DK_Undo_02 64804 15.77 38.71 5.16 17 RCVD_IN_MSPIKE_H2 62118 34.99 37.10 34.01 18 FVGT_m_MULTI_ODD 58073 27.74 34.69 24.52 19 T_KAM_HTML_FONT_INVALID 51870 25.31 30.98 22.69 20 MIME_HTML_ONLY 48620 22.54 29.04 19.53 21 BAYES_99 48176 11.38 28.78 3.33 22 DKIM_VALID_EF 47389 28.82 28.31 29.06 23 TR_XM_DKIM_Undo 46751 10.54 27.93 2.50 24 XM_Multi_Part_URI 40219 18.91 24.02 16.54 25 XMSubLong 39993 23.60 23.89 23.46 26 DCC_CHECK_NEGATIVE 39270 46.89 23.46 57.74 27 T_TM2_M_HEADER_IN_MSG 38726 26.37 23.13 27.87 28 BAYES_999 37072 8.74 22.14 2.54 29 TR_DCC_Bayes_99 34266 7.37 20.47 1.31 30 TR_XM_DK_Unsub 32769 14.88 19.57 12.71 31 XM_B_Unsub 30590 12.23 18.27 9.43 32 UNPARSEABLE_RELAY 29466 13.50 17.60 11.60 33 TR_XM_BayesUnsub 29247 10.70 17.47 7.57 34 XM_B_SpammyWords3 27169 8.22 16.23 4.51 35 RELAYCOUNTRY_META 24689 7.38 14.75 3.98 36 TR_MAX_INTL_RELAY 24439 9.08 14.60 6.53 37 BOTNET_IPINHOSTNAME 22302 6.75 13.32 3.71 38 LOTS_OF_MONEY 21486 8.24 12.83 6.11 39 TR_XM_SpammyWords4 19219 6.40 11.48 4.05 40 TR_XM_SpammyRelay 18080 4.93 10.80 2.21 41 XM_Evil_Numbers_Gen 17340 9.47 10.36 9.05 42 TR_XM_SpammyWords2 17325 3.56 10.35 0.42 43 BAYES_80 15126 5.69 9.04 4.14 44 TR_XM_UnparsRelay 14818 4.05 8.85 1.83 45 FSL_BULK_SIG 14675 7.97 8.77 7.60 46 BOTNET 14536 3.90 8.68 1.68 47 LotsOfNums_01 14366 8.63 8.58 8.65 48 XM_B_Phish_Phrases 14266 6.58 8.52 5.68 49 HTML_IMAGE_RATIO_02 13690 6.15 8.18 5.21 50 BAYES_60 13495 8.75 8.06 9.08 51 RCVD_IN_BL_SPAMCOP_NET 13480 3.10 8.05 0.81 52 XM_Body_Dirty_Words 12656 3.83 7.56 2.11 53 XM_B_PhoneNumber 11831 8.96 7.07 9.84 54 XMSubMetaSx_00 11171 5.29 6.67 4.65 55 MPART_ALT_DIFF 10673 5.59 6.38 5.23 56 XM_H_Long_From01 10242 5.91 6.12 5.82 57 TR_XM_SPAMCOP 10234 2.19 6.11 0.37 58 XM_UncommonTLD01 10107 4.46 6.04 3.74 59 RELAYCOUNTRY_CA 9471 2.53 5.66 1.08 60 TooManyTo_001 9066 6.96 5.42 7.68 61 UNTRUSTED_Relay 8919 2.71 5.33 1.49 62 XM_B_SEO 8809 2.54 5.26 1.28 63 BAYES_95 8773 3.29 5.24 2.38 64 XMSexyCombo_05 8562 2.65 5.11 1.50 65 HTML_IMAGE_RATIO_04 8501 5.07 5.08 5.07 66 XM_B_Investor 8330 2.56 4.98 1.44 67 DKIM_INVALID 8102 3.05 4.84 2.22 68 XM_H_GMP 8035 4.89 4.80 4.93 69 TR_XM_PhishingBody 8028 2.83 4.80 1.93 70 XMStrtUSub 8027 4.76 4.79 4.74 71 XM_SPF_SoftFail 7819 2.82 4.67 1.96 72 TR_XM_SEO4 7605 2.00 4.54 0.83 73 HTML_IMAGE_RATIO_06 7304 3.47 4.36 3.06 74 T_XMDrugObfuBody_14 6794 2.38 4.06 1.60 75 RCVD_IN_MSPIKE_WL 6735 5.26 4.02 5.84 76 RCVD_IN_MSPIKE_H3 6735 5.26 4.02 5.84 77 XM_B_SpammyTLD 6687 4.04 3.99 4.06 78 MIME_HTML_ONLY_MULTI 6656 3.17 3.98 2.80 79 TM2_M_VERY_LONG_WORD 6373 2.07 3.81 1.27 80 MIME_HTML_MOSTLY 6371 3.15 3.81 2.85 81 XMDiploma_00 6315 2.48 3.77 1.88 82 TR_XM_SpammyWords5 6172 2.34 3.69 1.71 83 XMNumbers 5845 3.05 3.49 2.84 84 MIME_QP_LONG_LINE 5616 4.92 3.35 5.65 85 TM2_M_URI_OPT_OUT 5359 2.32 3.20 1.91 86 XM_CamelCaseFrm001 5351 2.83 3.20 2.67 87 XM_URI_RBL 5243 1.39 3.13 0.58 88 T_XMDrugObfuBody_08 5232 1.93 3.13 1.38 89 RELAYCOUNTRY_AU 5191 1.64 3.10 0.97 90 HTML_IMAGE_RATIO_08 5115 2.48 3.06 2.21 91 RCVD_IN_VALIDITY_SAFE 5065 4.30 3.03 4.89 92 XM_OfRef6 4821 1.42 2.88 0.75 93 XM_B_SpammyWords4 4730 1.31 2.83 0.61 94 XM_B_URI_Unicode 4531 2.16 2.71 1.91 95 XM_UB50 4515 1.49 2.70 0.92 96 USER_IN_DEF_DKIM_WL 4425 11.30 2.64 15.31 97 XM_B_Unsub2 4245 1.94 2.54 1.67 98 FROM_EXCESS_BASE64 4217 2.29 2.52 2.18 99 RCVD_IN_VALIDITY_CERTIFIED 3943 3.47 2.36 3.99 100 XMBody_17 3923 1.03 2.34 0.42 101 T_TooManySym_01 3638 4.28 2.17 5.26 102 URI_HEX 3597 1.64 2.15 1.40 103 TR_XM_NoHeaderRelay 3546 0.79 2.12 0.18 104 T_XMHurry_00 3487 1.23 2.08 0.84 105 MAILING_LIST_MULTI 3427 2.59 2.05 2.84 106 SUBJ_ALL_CAPS 3396 1.60 2.03 1.40 107 XMStockSpam_06 3222 1.46 1.92 1.25 108 BAYES_40 3201 3.98 1.91 4.93 109 SpammyFromTLD_02 3137 0.87 1.87 0.40 110 XM_H_Long_From02 3116 1.34 1.86 1.10 111 RCVD_IN_VALIDITY_RPBL 3058 0.69 1.83 0.16 112 XMGenDplmaNmb 3038 1.24 1.81 0.97 113 XMBrknScrpt_02 3021 1.23 1.80 0.96 114 SpammyFromTLD_01 3005 1.13 1.79 0.82 115 TR_LOTS_OF_MONEY3 2944 0.97 1.76 0.60 116 T_REMOTE_IMAGE 2888 2.91 1.73 3.46 117 XM_DK_Undo_01 2886 1.73 1.72 1.73 118 URI_NOVOWEL 2811 2.62 1.68 3.05 119 HTTPS_HTTP_MISMATCH 2597 1.06 1.55 0.83 120 HTML_MIME_NO_HTML_TAG 2584 2.18 1.54 2.47 121 XM_B_REG_HTML 2558 0.58 1.53 0.14 122 XMPhish30 2548 0.93 1.52 0.66 123 RCVD_IN_ZEN_LASTEXTERNAL 2506 0.47 1.50 0.00 124 SHORTCIRCUIT 2506 0.47 1.50 0.00 125 TooManyTo_002 2465 1.95 1.47 2.18 126 RCVD_IN_IADB_LISTED 2454 3.38 1.47 4.27 127 DIET_1 2436 0.63 1.46 0.25 128 T_FILL_THIS_FORM_SHORT 2425 1.07 1.45 0.89 129 XMBdyGiftCard01 2403 1.00 1.44 0.79 130 XM_B_Phish66 2343 0.74 1.40 0.43 131 XM_SendGrid 2343 1.49 1.40 1.53 132 THIS_AD 2293 0.67 1.37 0.34 133 SHOPIFY_IMG_NOT_RCVD_SFY 2266 0.62 1.35 0.28 134 RCVD_IN_IADB_SPF 2117 2.97 1.26 3.76 135 XM_ProductURIs 2100 0.73 1.25 0.49 136 T_XMDrugObfuBody_00 2095 0.97 1.25 0.84 137 DKIM_ADSP_CUSTOM_MED 2035 0.95 1.22 0.83 138 RCVD_IN_IADB_DK 2012 2.61 1.20 3.26 139 LongTLD 2012 0.61 1.20 0.34 140 TR_XM_Base64_M1 2010 0.96 1.20 0.85 141 RCVD_IN_IADB_SENDERID 2004 2.68 1.20 3.37 142 XM_B_COVIDMETA 1991 0.55 1.19 0.26 143 BAYES_20 1989 2.65 1.19 3.33 144 TR_XM_FormFill 1975 0.38 1.18 0.01 145 TR_XM_PHPForged 1964 0.59 1.17 0.32 146 ALL_TRUSTED 1948 10.59 1.16 14.95 147 TR_Symld_Words 1948 1.29 1.16 1.35 148 TR_XM_PHPDW 1913 0.58 1.14 0.32 149 TR_XM_FormFill2 1912 0.58 1.14 0.32 150 RDNS_DYNAMIC 1905 0.57 1.14 0.31 151 XM_H_PHPOS 1873 0.57 1.12 0.31 152 TR_XM_INV_DKIM 1858 0.41 1.11 0.08 153 PDS_RDNS_DYNAMIC_FP 1852 0.46 1.11 0.16 154 HK_RANDOM_REPLYTO 1829 0.43 1.09 0.13 155 XMSubMetaI_00 1817 0.81 1.09 0.69 156 XM_B_COPY_HTML 1780 0.81 1.06 0.69 157 XM_B_DNDMA 1756 0.94 1.05 0.89 158 MPART_ALT_DIFF_COUNT 1731 0.75 1.03 0.62 159 URI_TRY_3LD 1724 0.68 1.03 0.52 160 HTML_TAG_BALANCE_BODY 1721 0.80 1.03 0.69 161 XM_H_Undi_Recip 1717 0.43 1.03 0.16 162 NML_ADSP_CUSTOM_MED 1714 0.69 1.02 0.54 163 KHOP_HELO_FCRDNS 1712 1.26 1.02 1.37 164 XMReplyNow 1711 0.48 1.02 0.22 165 TR_XM_InvalidRelay 1705 0.34 1.02 0.02 166 XM_S_SpammyWords 1704 0.50 1.02 0.26 167 TR_XM_Spammywords 1704 0.50 1.02 0.26 168 XMHTML_After_End 1662 0.50 0.99 0.27 169 T_STY_INVIS_DIRECT 1600 0.55 0.96 0.36 170 XMPhish14 1570 0.57 0.94 0.40 171 XMSexyCombo_01 1555 0.38 0.93 0.13 172 TVD_RCVD_IP 1535 0.76 0.92 0.69 173 TR_LOTS_OF_MONEY2 1520 0.40 0.91 0.17 174 T_MONEY_PERCENT 1520 0.40 0.91 0.17 175 TR_Mismatch_TLD_02 1519 0.34 0.91 0.07 176 BOTNET_NORDNS 1454 0.28 0.87 0.00 177 PLING_QUERY 1442 0.60 0.86 0.48 178 XMMoneyMeta_00 1439 0.80 0.86 0.77 179 XM_HighProb1 1431 0.28 0.85 0.02 180 HELO_DYNAMIC_SPLIT_IP 1427 0.27 0.85 0.00 181 XM_UB99 1423 0.27 0.85 0.01 182 XMSlimDrugH 1415 0.50 0.85 0.34 183 TR_XM_Undi_Recip19 1414 0.31 0.84 0.07 184 BAYES_00 1414 6.87 0.84 9.66 185 RCVD_IN_PBL 1395 0.68 0.83 0.60 186 XMHTMLBadTable_001 1369 0.50 0.82 0.35 187 RELAYCOUNTRY_GB 1368 0.54 0.82 0.41 188 TR_XM_DK_SendGrid 1365 0.93 0.82 0.98 189 FORGED_GMAIL_RCVD 1348 0.62 0.81 0.54 190 RELAYCOUNTRY_FR 1347 0.43 0.80 0.25 191 LONGLN_LOW_CONTRAST 1338 0.44 0.80 0.28 192 TR_XM_RelayPhish 1338 0.30 0.80 0.07 193 XM_B_FormFill 1338 0.32 0.80 0.10 194 XMBody_78 1313 0.46 0.78 0.31 195 TR_MetaPhish_Combo_01 1306 0.77 0.78 0.76 196 XMSubMetaSxObfu_02 1305 0.42 0.78 0.25 197 RCVD_IN_SORBS_DUL 1272 0.27 0.76 0.05 198 TR_XM_COVIDMETA4 1256 0.28 0.75 0.06 199 RCVD_IN_PSBL 1255 0.29 0.75 0.08 200 TR_XM_Undi_RecipCombo2 1254 0.24 0.75 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 315814 89.83 95.36 87.27 2 RELAYCOUNTRY_US 296593 82.78 84.55 81.96 3 DKIM_SIGNED 283109 82.16 90.66 78.24 4 XM_DK_Pass 278540 80.26 87.38 76.97 5 DKIM_VALID 275086 79.12 85.82 76.02 6 XM_B_Unicode 260995 76.24 85.12 72.12 7 BAYES_50 221344 55.37 42.83 61.17 8 DKIM_VALID_AU 221204 63.03 67.15 61.13 9 DCC_CHECK_NEGATIVE 208930 46.89 23.46 57.74 10 XMListUnsubscribeExists 188210 57.91 70.65 52.01 11 XM_B_SpammyWords 170632 54.60 70.69 47.15 12 XM_B_Unicode3 155863 45.61 51.09 43.07 13 DCC_CHECK 152757 52.60 75.04 42.21 14 RCVD_IN_MSPIKE_H2 123067 34.99 37.10 34.01 15 HTML_FONT_LOW_CONTRAST 107286 33.02 40.30 29.65 16 DKIM_VALID_EF 105150 28.82 28.31 29.06 17 LOC_TINY_FONT_1 105123 35.15 48.32 29.05 18 T_TM2_M_HEADER_IN_MSG 100839 26.37 23.13 27.87 19 FVGT_m_MULTI_ODD 88745 27.74 34.69 24.52 20 XMSubLong 84907 23.60 23.89 23.46 21 T_KAM_HTML_FONT_INVALID 82107 25.31 30.98 22.69 22 MIME_HTML_ONLY 70678 22.54 29.04 19.53 23 XM_B_SpammyWords2 69755 26.39 41.76 19.28 24 XM_Multi_Part_URI 59844 18.91 24.02 16.54 25 USER_IN_DEF_DKIM_WL 55409 11.30 2.64 15.31 26 ALL_TRUSTED 54084 10.59 1.16 14.95 27 TR_XM_DK_Unsub 45996 14.88 19.57 12.71 28 UNPARSEABLE_RELAY 41978 13.50 17.60 11.60 29 XM_B_PhoneNumber 35613 8.96 7.07 9.84 30 BAYES_00 34947 6.87 0.84 9.66 31 XM_B_Unsub 34135 12.23 18.27 9.43 32 BAYES_60 32843 8.75 8.06 9.08 33 XM_Evil_Numbers_Gen 32761 9.47 10.36 9.05 34 LotsOfNums_01 31314 8.63 8.58 8.65 35 XM_DKIMWhitelistDomains 28744 5.45 0.07 7.94 36 TooManyTo_001 27795 6.96 5.42 7.68 37 FSL_BULK_SIG 27489 7.97 8.77 7.60 38 TR_XM_BayesUnsub 27399 10.70 17.47 7.57 39 TR_XM_DK_Bayes 26286 5.20 0.75 7.26 40 TR_XM_DK_Bayes1 25974 5.14 0.74 7.18 41 IN_ZIMBRA_NJ_WHITELIST 24809 4.72 0.12 6.86 42 TR_MAX_INTL_RELAY 23614 9.08 14.60 6.53 43 TR_XM_DK_Bayes2 22492 4.46 0.65 6.22 44 LOTS_OF_MONEY 22104 8.24 12.83 6.11 45 RCVD_IN_MSPIKE_H3 21117 5.26 4.02 5.84 46 RCVD_IN_MSPIKE_WL 21117 5.26 4.02 5.84 47 XM_H_Long_From01 21051 5.91 6.12 5.82 48 XM_B_Phish_Phrases 20557 6.58 8.52 5.68 49 MIME_QP_LONG_LINE 20450 4.92 3.35 5.65 50 T_TooManySym_01 19021 4.28 2.17 5.26 51 MPART_ALT_DIFF 18927 5.59 6.38 5.23 52 HTML_IMAGE_RATIO_02 18844 6.15 8.18 5.21 53 XM_DK_Undo_02 18665 15.77 38.71 5.16 54 HTML_IMAGE_RATIO_04 18350 5.07 5.08 5.07 55 BAYES_40 17853 3.98 1.91 4.93 56 XM_H_GMP 17849 4.89 4.80 4.93 57 RCVD_IN_VALIDITY_SAFE 17683 4.30 3.03 4.89 58 XMStrtUSub 17169 4.76 4.79 4.74 59 XMSubMetaSx_00 16830 5.29 6.67 4.65 60 XM_B_SpammyWords3 16334 8.22 16.23 4.51 61 RCVD_IN_IADB_LISTED 15447 3.38 1.47 4.27 62 BAYES_80 14984 5.69 9.04 4.14 63 XM_B_SpammyTLD 14705 4.04 3.99 4.06 64 TR_XM_SpammyWords4 14651 6.40 11.48 4.05 65 RCVD_IN_VALIDITY_CERTIFIED 14430 3.47 2.36 3.99 66 RELAYCOUNTRY_META 14391 7.38 14.75 3.98 67 XM_PDF 13818 2.79 0.55 3.82 68 RCVD_IN_IADB_SPF 13613 2.97 1.26 3.76 69 XM_UncommonTLD01 13518 4.46 6.04 3.74 70 BOTNET_IPINHOSTNAME 13420 6.75 13.32 3.71 71 T_REMOTE_IMAGE 12506 2.91 1.73 3.46 72 RCVD_IN_IADB_SENDERID 12187 2.68 1.20 3.37 73 BAYES_20 12058 2.65 1.19 3.33 74 BAYES_99 12052 11.38 28.78 3.33 75 RCVD_IN_IADB_DK 11791 2.61 1.20 3.26 76 HTML_IMAGE_RATIO_06 11070 3.47 4.36 3.06 77 URI_NOVOWEL 11054 2.62 1.68 3.05 78 T_TooManySym_02 10479 2.18 0.65 2.90 79 MIME_HTML_MOSTLY 10306 3.15 3.81 2.85 80 MAILING_LIST_MULTI 10281 2.59 2.05 2.84 81 XMNumbers 10280 3.05 3.49 2.84 82 MIME_HTML_ONLY_MULTI 10126 3.17 3.98 2.80 83 RCVD_IN_IADB_VOUCHED 9893 2.08 0.66 2.73 84 XM_CamelCaseFrm001 9648 2.83 3.20 2.67 85 ANY_BOUNCE_MESSAGE 9563 2.01 0.66 2.64 86 BOUNCE_MESSAGE 9561 2.01 0.66 2.64 87 BAYES_999 9176 8.74 22.14 2.54 88 TR_XM_DKIM_Undo 9034 10.54 27.93 2.50 89 HTML_MIME_NO_HTML_TAG 8933 2.18 1.54 2.47 90 BAYES_95 8622 3.29 5.24 2.38 91 DKIM_INVALID 8023 3.05 4.84 2.22 92 TR_XM_SpammyRelay 7990 4.93 10.80 2.21 93 HTML_IMAGE_RATIO_08 7988 2.48 3.06 2.21 94 FROM_EXCESS_BASE64 7880 2.29 2.52 2.18 95 TooManyTo_002 7873 1.95 1.47 2.18 96 XM_Body_Dirty_Words 7639 3.83 7.56 2.11 97 BAYES_05 7164 1.55 0.61 1.98 98 XM_SPF_SoftFail 7097 2.82 4.67 1.96 99 INVALID_MSGID 7058 1.40 0.22 1.95 100 TR_XM_PhishingBody 6968 2.83 4.80 1.93 101 XM_B_URI_Unicode 6913 2.16 2.71 1.91 102 TM2_M_URI_OPT_OUT 6903 2.32 3.20 1.91 103 RCVD_IN_IADB_OPTIN 6844 1.42 0.40 1.89 104 XMDiploma_00 6795 2.48 3.77 1.88 105 TR_XM_UnparsRelay 6608 4.05 8.85 1.83 106 XM_DK_Undo_01 6275 1.73 1.72 1.73 107 TR_XM_SpammyWords5 6191 2.34 3.69 1.71 108 TO_MALFORMED 6183 1.18 0.03 1.71 109 BOTNET 6090 3.90 8.68 1.68 110 XM_B_Unsub2 6049 1.94 2.54 1.67 111 T_XMDrugObfuBody_14 5806 2.38 4.06 1.60 112 XM_SendGrid 5542 1.49 1.40 1.53 113 XMSexyCombo_05 5439 2.65 5.11 1.50 114 UNTRUSTED_Relay 5403 2.71 5.33 1.49 115 XM_B_Investor 5197 2.56 4.98 1.44 116 URI_HEX 5083 1.64 2.15 1.40 117 XMGappySubj_01 5067 1.00 0.14 1.40 118 SUBJ_ALL_CAPS 5054 1.60 2.03 1.40 119 IN_HORDE_ADDRESS_BOOK 5042 0.99 0.11 1.39 120 T_XMDrugObfuBody_08 5005 1.93 3.13 1.38 121 KHOP_HELO_FCRDNS 4944 1.26 1.02 1.37 122 TR_Symld_Words 4870 1.29 1.16 1.35 123 TR_DCC_Bayes_99 4735 7.37 20.47 1.31 124 XM_B_SEO 4649 2.54 5.26 1.28 125 TM2_M_VERY_LONG_WORD 4591 2.07 3.81 1.27 126 XMStockSpam_06 4531 1.46 1.92 1.25 127 TooManyTo_003 4528 1.06 0.63 1.25 128 XM_GoogleGroups 4302 1.03 0.68 1.19 129 XM_H_Long_From02 3992 1.34 1.86 1.10 130 RELAYCOUNTRY_CA 3923 2.53 5.66 1.08 131 TVD_SPACE_RATIO 3777 0.74 0.10 1.04 132 FROM_GOV_DKIM_AU 3654 0.82 0.40 1.01 133 HELO_NODOT 3561 0.74 0.21 0.98 134 HELO_NO_DOMAIN 3559 0.74 0.21 0.98 135 TR_XM_DK_SendGrid 3553 0.93 0.82 0.98 136 RELAYCOUNTRY_AU 3503 1.64 3.10 0.97 137 XMGenDplmaNmb 3501 1.24 1.81 0.97 138 XM_TLDProd2 3476 0.74 0.27 0.96 139 XMBrknScrpt_02 3471 1.23 1.80 0.96 140 XMCapTrack 3453 0.84 0.58 0.95 141 XM_UB50 3347 1.49 2.70 0.92 142 T_TooManySym_03 3266 0.70 0.26 0.90 143 TooManyTo_004 3253 0.80 0.59 0.90 144 XM_B_DNDMA 3238 0.94 1.05 0.89 145 T_FILL_THIS_FORM_SHORT 3235 1.07 1.45 0.89 146 TR_XM_Base64_M1 3092 0.96 1.20 0.85 147 T_XMHurry_00 3038 1.23 2.08 0.84 148 T_XMDrugObfuBody_00 3024 0.97 1.25 0.84 149 HTTPS_HTTP_MISMATCH 3019 1.06 1.55 0.83 150 DKIM_ADSP_CUSTOM_MED 3011 0.95 1.22 0.83 151 TR_XM_SEO4 2990 2.00 4.54 0.83 152 XMGappySubj_02 2976 0.58 0.05 0.82 153 SpammyFromTLD_01 2971 1.13 1.79 0.82 154 RCVD_IN_BL_SPAMCOP_NET 2942 3.10 8.05 0.81 155 XMBdyGiftCard01 2866 1.00 1.44 0.79 156 XM_H_PHPMailer 2806 0.72 0.59 0.78 157 XMMoneyMeta_00 2782 0.80 0.86 0.77 158 TR_MetaPhish_Combo_01 2749 0.77 0.78 0.76 159 XM_OfRef6 2704 1.42 2.88 0.75 160 XMBody_95 2656 0.64 0.44 0.73 161 TO_NO_BRKTS_HTML_ONLY 2585 0.55 0.20 0.71 162 TooManyTo_005 2541 0.65 0.55 0.70 163 TVD_RCVD_IP 2508 0.76 0.92 0.69 164 HTML_TAG_BALANCE_BODY 2499 0.80 1.03 0.69 165 XM_B_COPY_HTML 2498 0.81 1.06 0.69 166 XMSubMetaI_00 2482 0.81 1.09 0.69 167 XMNoVowels 2412 0.61 0.48 0.67 168 XMPhish30 2384 0.93 1.52 0.66 169 XM_ShortIntro_01 2227 0.58 0.49 0.62 170 MPART_ALT_DIFF_COUNT 2227 0.75 1.03 0.62 171 XM_B_SpammyWords4 2193 1.31 2.83 0.61 172 RCVD_IN_PBL 2186 0.68 0.83 0.60 173 TR_LOTS_OF_MONEY3 2170 0.97 1.76 0.60 174 XM_URI_RBL 2097 1.39 3.13 0.58 175 T_Symld_Words_02 2084 0.59 0.61 0.58 176 XM_RXBody 2059 0.52 0.42 0.57 177 NML_ADSP_CUSTOM_MED 1961 0.69 1.02 0.54 178 FORGED_GMAIL_RCVD 1956 0.62 0.81 0.54 179 URI_TRY_3LD 1890 0.68 1.03 0.52 180 T_OBFU_PDF_ATTACH 1796 0.39 0.15 0.50 181 XM_ProductURIs 1785 0.73 1.25 0.49 182 PLING_QUERY 1732 0.60 0.86 0.48 183 TM2_M_BODY_EMPTY 1666 0.34 0.07 0.46 184 HTML_IMAGE_ONLY_28 1657 0.40 0.27 0.46 185 MIME_CHARSET_FARAWAY 1633 0.53 0.70 0.45 186 USER_IN_WHITELIST 1573 0.30 0.00 0.43 187 XM_B_Phish66 1573 0.74 1.40 0.43 188 USER_IN_WELCOMELIST 1573 0.30 0.00 0.43 189 HTML_IMAGE_ONLY_20 1548 0.42 0.40 0.43 190 HTML_FONT_FACE_BAD 1527 0.50 0.66 0.42 191 TR_XM_SpammyWords2 1517 3.56 10.35 0.42 192 XMBody_17 1517 1.03 2.34 0.42 193 RELAYCOUNTRY_GB 1490 0.54 0.82 0.41 194 TM2_M_OBFU_COMMENT 1476 0.51 0.74 0.41 195 MSGID_FROM_MTA_HEADER 1471 0.35 0.21 0.41 196 HTML_IMAGE_ONLY_32 1459 0.32 0.15 0.40 197 SpammyFromTLD_02 1446 0.87 1.87 0.40 198 XMPhish14 1444 0.57 0.94 0.40 199 XMOemUri 1407 0.37 0.32 0.39 200 XMLngstWrd_00 1361 0.36 0.33 0.38 ----------------------------------------------------------------------