Email: 403306 Autolearn: 0 AvgScore: 4.95 AvgScanTime: 1.38 sec Spam: 141164 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 1.44 sec Ham: 262142 Autolearn: 0 AvgScore: 0.06 AvgScanTime: 1.34 sec Time Spent Running SA: 154.39 hours Time Spent Processing Spam: 56.63 hours Time Spent Processing Ham: 97.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135277 88.29 95.83 84.24 2 RELAYCOUNTRY_US 120506 82.20 85.37 80.50 3 DKIM_SIGNED 119985 79.99 85.00 77.29 4 XM_DK_Pass 114897 77.95 81.39 76.09 5 DKIM_VALID 113972 77.28 80.74 75.41 6 XM_B_Unicode 112163 74.53 79.46 71.88 7 DCC_CHECK 101620 54.54 71.99 45.14 8 XMListUnsubscribeExists 95383 59.07 67.57 54.49 9 XM_B_SpammyWords 94284 52.96 66.79 45.52 10 DKIM_VALID_AU 89599 62.53 63.47 62.03 11 XM_B_Unicode3 65036 45.07 46.07 44.54 12 LOC_TINY_FONT_1 63136 34.99 44.73 29.75 13 XM_B_SpammyWords2 54379 26.03 38.52 19.30 14 XM_DK_Undo_02 54191 17.61 38.39 6.43 15 BAYES_50 53653 52.29 38.01 59.97 16 RCVD_IN_MSPIKE_H2 52075 35.19 36.89 34.27 17 BAYES_99 49735 15.45 35.23 4.80 18 HTML_FONT_LOW_CONTRAST 49269 32.25 34.90 30.81 19 MIME_HTML_ONLY 46511 23.97 32.95 19.13 20 FVGT_m_MULTI_ODD 45161 27.58 31.99 25.20 21 T_KAM_HTML_FONT_INVALID 41855 24.48 29.65 21.69 22 BAYES_999 40264 12.38 28.52 3.69 23 DCC_CHECK_NEGATIVE 38559 45.19 27.32 54.82 24 TR_XM_DKIM_Undo 37790 10.90 26.77 2.36 25 DKIM_VALID_EF 36335 27.26 25.74 28.08 26 XM_B_Unsub 32825 13.74 23.25 8.61 27 TR_XM_BayesUnsub 32024 12.46 22.69 6.96 28 XMSubLong 30038 21.98 21.28 22.36 29 XM_Multi_Part_URI 29944 19.38 21.21 18.39 30 TR_DCC_Bayes_99 29862 8.53 21.15 1.74 31 T_TM2_M_HEADER_IN_MSG 29674 23.82 21.02 25.32 32 TR_XM_DK_Unsub 26213 15.18 18.57 13.35 33 UNPARSEABLE_RELAY 24037 13.21 17.03 11.15 34 RELAYCOUNTRY_META 22652 8.34 16.05 4.19 35 TR_MAX_INTL_RELAY 20620 9.55 14.61 6.82 36 XM_B_SpammyWords3 19473 7.88 13.79 4.70 37 BOTNET_IPINHOSTNAME 17501 6.62 12.40 3.52 38 TR_XM_SpammyRelay 17311 5.84 12.26 2.37 39 TooManyTo_001 16752 8.52 11.87 6.71 40 LOTS_OF_MONEY 16253 7.80 11.51 5.81 41 XM_B_PhoneNumber 14908 8.41 10.56 7.26 42 XMSubMetaSx_00 14466 6.54 10.25 4.54 43 TR_XM_SpammyWords4 14319 6.15 10.14 4.00 44 TR_XM_SpammyWords2 13869 3.74 9.82 0.46 45 FSL_BULK_SIG 13799 8.50 9.78 7.81 46 RCVD_IN_BL_SPAMCOP_NET 12788 3.72 9.06 0.84 47 XM_Evil_Numbers_Gen 12773 9.37 9.05 9.54 48 BAYES_80 12722 5.89 9.01 4.21 49 XMSexyCombo_05 12661 4.16 8.97 1.56 50 TR_XM_UnparsRelay 12631 4.25 8.95 1.73 51 BOTNET 12161 3.94 8.61 1.43 52 BAYES_60 11374 9.21 8.06 9.84 53 XM_B_Phish_Phrases 11324 6.07 8.02 5.02 54 TR_XM_SPAMCOP 11209 3.06 7.94 0.43 55 XM_Body_Dirty_Words 11081 4.68 7.85 2.97 56 LotsOfNums_01 10658 8.43 7.55 8.90 57 HTML_IMAGE_RATIO_02 10037 6.26 7.11 5.81 58 TR_XM_FormFill 9844 2.47 6.97 0.05 59 TooManyTo_002 9745 3.35 6.90 1.44 60 MPART_ALT_DIFF 9218 5.76 6.53 5.34 61 RELAYCOUNTRY_CA 9018 3.20 6.39 1.48 62 XM_B_FormFill 8920 2.32 6.32 0.16 63 XM_Appointment_Request 8879 2.23 6.29 0.05 64 UNTRUSTED_Relay 8217 3.17 5.82 1.74 65 XM_UncommonTLD01 7698 4.62 5.45 4.17 66 BAYES_95 7385 3.53 5.23 2.62 67 XM_H_Long_From01 7182 5.09 5.09 5.10 68 XM_H_GMP 7134 4.77 5.05 4.62 69 T_XMDrugObfuBody_14 6700 2.75 4.75 1.67 70 HTML_IMAGE_RATIO_04 6698 5.18 4.74 5.42 71 XM_B_Investor 6648 2.78 4.71 1.74 72 XMStrtUSub 6623 4.81 4.69 4.88 73 XM_B_SEO 6565 2.39 4.65 1.17 74 XM_SPF_SoftFail 6056 2.60 4.29 1.69 75 DKIM_INVALID 6013 2.72 4.26 1.88 76 TR_XM_SEO4 5891 1.90 4.17 0.67 77 TM2_M_VERY_LONG_WORD 5778 2.88 4.09 2.23 78 MIME_HTML_ONLY_MULTI 5627 3.07 3.99 2.57 79 RCVD_IN_VALIDITY_RPBL 5406 1.39 3.83 0.08 80 TR_XM_PhishingBody 5364 2.50 3.80 1.81 81 TR_XM_NoHeaderRelay 5236 1.42 3.71 0.18 82 XM_B_SpammyTLD 5200 4.40 3.68 4.78 83 RCVD_IN_MSPIKE_WL 5154 4.92 3.65 5.60 84 RCVD_IN_MSPIKE_H3 5154 4.92 3.65 5.60 85 HTML_IMAGE_RATIO_06 4845 3.32 3.43 3.26 86 TR_XM_SpammyWords5 4802 2.01 3.40 1.25 87 XMBody_17 4734 1.50 3.35 0.50 88 HTML_IMAGE_RATIO_08 4700 2.75 3.33 2.44 89 XMNumbers 4467 2.83 3.16 2.65 90 XM_CamelCaseFrm001 4464 2.77 3.16 2.55 91 T_XMDrugObfuBody_08 4441 2.60 3.15 2.31 92 MIME_QP_LONG_LINE 4387 4.83 3.11 5.76 93 XM_OfRef6 4361 1.54 3.09 0.71 94 XM_UB50 4285 1.69 3.04 0.97 95 MIME_HTML_MOSTLY 4284 3.13 3.03 3.18 96 XM_URI_RBL 3941 1.25 2.79 0.41 97 TM2_M_URI_OPT_OUT 3848 2.64 2.73 2.60 98 RELAYCOUNTRY_AU 3676 1.41 2.60 0.76 99 USER_IN_DEF_DKIM_WL 3495 11.12 2.48 15.77 100 SUBJ_ALL_CAPS 3447 1.63 2.44 1.20 101 T_FILL_THIS_FORM_SHORT 3378 1.31 2.39 0.73 102 XM_B_URI_Unicode 3289 2.03 2.33 1.87 103 RCVD_IN_VALIDITY_SAFE 3262 4.62 2.31 5.87 104 FROM_EXCESS_BASE64 3179 2.28 2.25 2.29 105 XM_B_Unsub2 3009 1.52 2.13 1.18 106 SpammyFromTLD_01 2984 1.24 2.11 0.78 107 T_TooManySym_01 2930 4.94 2.08 6.48 108 TR_LOTS_OF_MONEY3 2929 1.11 2.07 0.59 109 XM_DK_Undo_01 2853 1.83 2.02 1.73 110 T_XMHurry_00 2836 1.15 2.01 0.69 111 BOUNCE_MESSAGE 2777 3.29 1.97 4.00 112 ANY_BOUNCE_MESSAGE 2777 3.29 1.97 4.00 113 RCVD_IN_VALIDITY_CERTIFIED 2673 3.80 1.89 4.83 114 DKIM_ADSP_NXDOMAIN 2667 0.88 1.89 0.33 115 XM_B_SpammyWords4 2606 1.14 1.85 0.76 116 FILL_THIS_FORM 2538 0.81 1.80 0.27 117 XMDiploma_00 2518 1.39 1.78 1.18 118 KHOP_HELO_FCRDNS 2510 1.56 1.78 1.45 119 MAILING_LIST_MULTI 2471 2.24 1.75 2.50 120 FILL_THIS_FORM_LONG 2397 0.62 1.70 0.05 121 HOSTED_IMG_MULTI_PUB_01 2361 0.63 1.67 0.06 122 XMBrknScrpt_02 2190 1.12 1.55 0.89 123 XM_SendGrid 2171 1.42 1.54 1.36 124 XMStockSpam_06 2151 1.42 1.52 1.36 125 BOTNET_NORDNS 2136 0.54 1.51 0.01 126 SH_BODYURI_REVERSE_CSS 2128 0.56 1.51 0.05 127 URIBL_CSS_A 2127 0.56 1.51 0.06 128 URIBL_CSS 2127 0.56 1.51 0.06 129 XMBdyGiftCard01 2088 1.78 1.48 1.94 130 XMHTMLBadTable_001 2044 0.73 1.45 0.34 131 XMPhish30 1975 0.88 1.40 0.60 132 HTML_MIME_NO_HTML_TAG 1955 1.73 1.38 1.92 133 BAYES_40 1951 3.41 1.38 4.50 134 URI_HEX 1936 1.36 1.37 1.35 135 THIS_AD 1930 0.76 1.37 0.44 136 PLING_QUERY 1927 1.03 1.37 0.85 137 SHOPIFY_IMG_NOT_RCVD_SFY 1879 0.61 1.33 0.22 138 RELAYCOUNTRY_CN 1850 0.49 1.31 0.05 139 T_STY_INVIS_DIRECT 1824 0.63 1.29 0.27 140 HTTPS_HTTP_MISMATCH 1806 0.95 1.28 0.78 141 SpammyFromTLD_02 1761 0.71 1.25 0.43 142 XM_DIRTYINTL 1755 0.48 1.24 0.07 143 T_XMDrugObfuBody_00 1753 0.79 1.24 0.55 144 XM_B_COPY_HTML 1725 1.03 1.22 0.93 145 T_REMOTE_IMAGE 1693 2.59 1.20 3.34 146 XMReplyNow 1669 0.55 1.18 0.21 147 TR_XM_PHPForged 1668 0.64 1.18 0.34 148 TR_Caps_n_Bayes_99 1653 0.45 1.17 0.05 149 TR_XM_PHPDW 1652 0.63 1.17 0.34 150 XM_B_COVIDMETA 1644 0.57 1.16 0.25 151 TR_XM_FormFill2 1632 0.63 1.16 0.35 152 XM_H_PHPOS 1600 0.61 1.13 0.33 153 HTML_TAG_BALANCE_BODY 1578 0.79 1.12 0.61 154 TM2_M_OBFU_COMMENT 1566 0.77 1.11 0.59 155 RCVD_IN_XBL 1558 0.40 1.10 0.02 156 BAYES_20 1553 2.25 1.10 2.87 157 XMBounce_01 1544 0.39 1.09 0.01 158 XMSubMetaI_00 1520 0.67 1.08 0.45 159 XMSexyCombo_01 1497 0.48 1.06 0.17 160 TR_Symld_Words 1494 1.33 1.06 1.48 161 TR_XM_INV_DKIM 1487 0.40 1.05 0.05 162 XM_OfRef7 1476 0.43 1.05 0.09 163 RCVD_IN_IADB_LISTED 1471 3.11 1.04 4.22 164 DIET_1 1465 0.52 1.04 0.25 165 MIME_CHARSET_FARAWAY 1446 0.65 1.02 0.46 166 ALL_TRUSTED 1442 10.58 1.02 15.73 167 XM_B_REG_HTML 1439 0.50 1.02 0.21 168 LONGLN_LOW_CONTRAST 1431 0.53 1.01 0.27 169 MPART_ALT_DIFF_COUNT 1430 0.80 1.01 0.68 170 XM_H_Undi_Recip 1387 0.42 0.98 0.12 171 XMGenDplmaNmb 1386 0.69 0.98 0.54 172 TR_XM_InvalidRelay 1378 0.36 0.98 0.02 173 XM_H_Long_From02 1357 0.96 0.96 0.96 174 TR_XM_Base64_M1 1349 0.73 0.96 0.60 175 URI_NOVOWEL 1337 2.72 0.95 3.67 176 XM_B_DNDMA 1316 0.83 0.93 0.77 177 DKIM_ADSP_CUSTOM_MED 1311 0.89 0.93 0.87 178 RCVD_IN_PSBL 1309 0.40 0.93 0.11 179 XM_ProductURIs 1302 0.65 0.92 0.51 180 AC_BR_BONANZA 1300 0.41 0.92 0.14 181 RCVD_IN_IADB_SPF 1262 2.73 0.89 3.71 182 TR_XM_Undi_Recip19 1262 0.36 0.89 0.07 183 RCVD_IN_PBL 1258 0.69 0.89 0.59 184 RELAYCOUNTRY_FR 1248 0.48 0.88 0.27 185 SUSP_UTF8_WORD_SUBJ 1243 0.32 0.88 0.02 186 TR_Mismatch_TLD_01 1232 0.44 0.87 0.21 187 TR_XM_DK_SendGrid 1219 0.92 0.86 0.96 188 XM_B_Phish66 1217 0.65 0.86 0.54 189 URG_BIZ 1214 0.33 0.86 0.04 190 RCVD_IN_IADB_SENDERID 1212 2.47 0.86 3.33 191 RCVD_IN_IADB_DK 1206 2.40 0.85 3.23 192 RDNS_DYNAMIC 1189 0.56 0.84 0.40 193 LongTLD 1179 0.42 0.84 0.19 194 URI_TRY_3LD 1179 0.74 0.84 0.69 195 XM_HighProb1 1177 0.30 0.83 0.01 196 PDS_RDNS_DYNAMIC_FP 1169 0.43 0.83 0.22 197 TR_XM_RelayPhish 1169 0.33 0.83 0.06 198 TR_MetaPhish_Combo_01 1159 0.71 0.82 0.65 199 T_MONEY_PERCENT 1151 0.45 0.82 0.25 200 TR_LOTS_OF_MONEY2 1151 0.45 0.82 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 220817 88.29 95.83 84.24 2 RELAYCOUNTRY_US 211028 82.20 85.37 80.50 3 DKIM_SIGNED 202622 79.99 85.00 77.29 4 XM_DK_Pass 199474 77.95 81.39 76.09 5 DKIM_VALID 197684 77.28 80.74 75.41 6 XM_B_Unicode 188416 74.53 79.46 71.88 7 DKIM_VALID_AU 162606 62.53 63.47 62.03 8 BAYES_50 157217 52.29 38.01 59.97 9 DCC_CHECK_NEGATIVE 143701 45.19 27.32 54.82 10 XMListUnsubscribeExists 142833 59.07 67.57 54.49 11 XM_B_SpammyWords 119314 52.96 66.79 45.52 12 DCC_CHECK 118327 54.54 71.99 45.14 13 XM_B_Unicode3 116752 45.07 46.07 44.54 14 RCVD_IN_MSPIKE_H2 89847 35.19 36.89 34.27 15 HTML_FONT_LOW_CONTRAST 80779 32.25 34.90 30.81 16 LOC_TINY_FONT_1 77985 34.99 44.73 29.75 17 DKIM_VALID_EF 73601 27.26 25.74 28.08 18 T_TM2_M_HEADER_IN_MSG 66387 23.82 21.02 25.32 19 FVGT_m_MULTI_ODD 66056 27.58 31.99 25.20 20 XMSubLong 58608 21.98 21.28 22.36 21 T_KAM_HTML_FONT_INVALID 56867 24.48 29.65 21.69 22 XM_B_SpammyWords2 50592 26.03 38.52 19.30 23 MIME_HTML_ONLY 50143 23.97 32.95 19.13 24 XM_Multi_Part_URI 48216 19.38 21.21 18.39 25 USER_IN_DEF_DKIM_WL 41341 11.12 2.48 15.77 26 ALL_TRUSTED 41243 10.58 1.02 15.73 27 TR_XM_DK_Unsub 35002 15.18 18.57 13.35 28 UNPARSEABLE_RELAY 29237 13.21 17.03 11.15 29 BAYES_60 25790 9.21 8.06 9.84 30 XM_Evil_Numbers_Gen 25016 9.37 9.05 9.54 31 BAYES_00 24650 6.32 0.60 9.40 32 LotsOfNums_01 23334 8.43 7.55 8.90 33 XM_B_Unsub 22570 13.74 23.25 8.61 34 XM_DKIMWhitelistDomains 22188 5.52 0.05 8.46 35 FSL_BULK_SIG 20475 8.50 9.78 7.81 36 TR_XM_DK_Bayes 20049 5.14 0.48 7.65 37 TR_XM_DK_Bayes1 19915 5.10 0.48 7.60 38 XM_B_PhoneNumber 19022 8.41 10.56 7.26 39 TR_XM_BayesUnsub 18232 12.46 22.69 6.96 40 TR_MAX_INTL_RELAY 17890 9.55 14.61 6.82 41 TooManyTo_001 17592 8.52 11.87 6.71 42 TR_XM_DK_Bayes2 17528 4.43 0.24 6.69 43 T_TooManySym_01 16988 4.94 2.08 6.48 44 XM_DK_Undo_02 16849 17.61 38.39 6.43 45 IN_ZIMBRA_NJ_WHITELIST 16497 4.13 0.11 6.29 46 RCVD_IN_VALIDITY_SAFE 15377 4.62 2.31 5.87 47 LOTS_OF_MONEY 15225 7.80 11.51 5.81 48 HTML_IMAGE_RATIO_02 15224 6.26 7.11 5.81 49 MIME_QP_LONG_LINE 15111 4.83 3.11 5.76 50 RCVD_IN_MSPIKE_WL 14680 4.92 3.65 5.60 51 RCVD_IN_MSPIKE_H3 14679 4.92 3.65 5.60 52 HTML_IMAGE_RATIO_04 14195 5.18 4.74 5.42 53 MPART_ALT_DIFF 14009 5.76 6.53 5.34 54 XM_H_Long_From01 13362 5.09 5.09 5.10 55 XM_B_Phish_Phrases 13153 6.07 8.02 5.02 56 XMStrtUSub 12793 4.81 4.69 4.88 57 RCVD_IN_VALIDITY_CERTIFIED 12669 3.80 1.89 4.83 58 BAYES_99 12576 15.45 35.23 4.80 59 XM_B_SpammyTLD 12528 4.40 3.68 4.78 60 XM_B_SpammyWords3 12326 7.88 13.79 4.70 61 XM_H_GMP 12116 4.77 5.05 4.62 62 XMSubMetaSx_00 11911 6.54 10.25 4.54 63 BAYES_40 11792 3.41 1.38 4.50 64 RCVD_IN_IADB_LISTED 11069 3.11 1.04 4.22 65 BAYES_80 11026 5.89 9.01 4.21 66 RELAYCOUNTRY_META 10971 8.34 16.05 4.19 67 XM_UncommonTLD01 10935 4.62 5.45 4.17 68 ANY_BOUNCE_MESSAGE 10484 3.29 1.97 4.00 69 BOUNCE_MESSAGE 10483 3.29 1.97 4.00 70 TR_XM_SpammyWords4 10475 6.15 10.14 4.00 71 RCVD_IN_IADB_SPF 9730 2.73 0.89 3.71 72 BAYES_999 9672 12.38 28.52 3.69 73 URI_NOVOWEL 9622 2.72 0.95 3.67 74 BOTNET_IPINHOSTNAME 9215 6.62 12.40 3.52 75 T_REMOTE_IMAGE 8746 2.59 1.20 3.34 76 RCVD_IN_IADB_SENDERID 8739 2.47 0.86 3.33 77 HTML_IMAGE_RATIO_06 8545 3.32 3.43 3.26 78 RCVD_IN_IADB_DK 8471 2.40 0.85 3.23 79 MIME_HTML_MOSTLY 8330 3.13 3.03 3.18 80 XM_PDF 7860 2.06 0.32 3.00 81 XM_Body_Dirty_Words 7789 4.68 7.85 2.97 82 T_TooManySym_02 7682 2.04 0.38 2.93 83 BAYES_20 7526 2.25 1.10 2.87 84 RCVD_IN_IADB_VOUCHED 7425 2.03 0.53 2.83 85 XMNumbers 6937 2.83 3.16 2.65 86 BAYES_95 6861 3.53 5.23 2.62 87 TM2_M_URI_OPT_OUT 6818 2.64 2.73 2.60 88 MIME_HTML_ONLY_MULTI 6748 3.07 3.99 2.57 89 INVALID_MSGID 6717 1.72 0.15 2.56 90 XM_CamelCaseFrm001 6689 2.77 3.16 2.55 91 MAILING_LIST_MULTI 6560 2.24 1.75 2.50 92 HTML_IMAGE_RATIO_08 6394 2.75 3.33 2.44 93 TO_MALFORMED 6325 1.57 0.00 2.41 94 TR_XM_SpammyRelay 6225 5.84 12.26 2.37 95 TR_XM_DKIM_Undo 6176 10.90 26.77 2.36 96 T_XMDrugObfuBody_08 6056 2.60 3.15 2.31 97 FROM_EXCESS_BASE64 6002 2.28 2.25 2.29 98 TM2_M_VERY_LONG_WORD 5834 2.88 4.09 2.23 99 XMBdyGiftCard01 5078 1.78 1.48 1.94 100 HTML_MIME_NO_HTML_TAG 5030 1.73 1.38 1.92 101 RCVD_IN_IADB_OPTIN 4980 1.33 0.29 1.90 102 DKIM_INVALID 4938 2.72 4.26 1.88 103 XM_B_URI_Unicode 4911 2.03 2.33 1.87 104 XMGappySubj_01 4768 1.23 0.15 1.82 105 TR_XM_PhishingBody 4733 2.50 3.80 1.81 106 BAYES_05 4699 1.41 0.71 1.79 107 XM_B_Investor 4567 2.78 4.71 1.74 108 TR_DCC_Bayes_99 4555 8.53 21.15 1.74 109 UNTRUSTED_Relay 4551 3.17 5.82 1.74 110 XM_DK_Undo_01 4531 1.83 2.02 1.73 111 TR_XM_UnparsRelay 4525 4.25 8.95 1.73 112 XM_SPF_SoftFail 4428 2.60 4.29 1.69 113 T_XMDrugObfuBody_14 4375 2.75 4.75 1.67 114 IN_HORDE_ADDRESS_BOOK 4190 1.10 0.18 1.60 115 XMSexyCombo_05 4099 4.16 8.97 1.56 116 RELAYCOUNTRY_CA 3878 3.20 6.39 1.48 117 TR_Symld_Words 3868 1.33 1.06 1.48 118 KHOP_HELO_FCRDNS 3800 1.56 1.78 1.45 119 TooManyTo_002 3765 3.35 6.90 1.44 120 BOTNET 3749 3.94 8.61 1.43 121 XM_SendGrid 3567 1.42 1.54 1.36 122 XMStockSpam_06 3556 1.42 1.52 1.36 123 URI_HEX 3534 1.36 1.37 1.35 124 TVD_SPACE_RATIO 3436 0.89 0.10 1.31 125 XM_TLDProd2 3322 0.93 0.29 1.27 126 TR_XM_SpammyWords5 3286 2.01 3.40 1.25 127 SUBJ_ALL_CAPS 3146 1.63 2.44 1.20 128 XM_B_Unsub2 3105 1.52 2.13 1.18 129 XMDiploma_00 3097 1.39 1.78 1.18 130 XMGappySubj_02 3077 0.79 0.07 1.17 131 XM_B_SEO 3059 2.39 4.65 1.17 132 T_TooManySym_03 2789 0.74 0.15 1.06 133 XM_GoogleGroups 2646 0.86 0.59 1.01 134 TooManyTo_003 2601 0.83 0.54 0.99 135 XM_UB50 2547 1.69 3.04 0.97 136 XM_H_Long_From02 2528 0.96 0.96 0.96 137 TR_XM_DK_SendGrid 2505 0.92 0.86 0.96 138 XM_B_COPY_HTML 2433 1.03 1.22 0.93 139 XMBrknScrpt_02 2330 1.12 1.55 0.89 140 DKIM_ADSP_CUSTOM_MED 2274 0.89 0.93 0.87 141 PLING_QUERY 2216 1.03 1.37 0.85 142 RCVD_IN_BL_SPAMCOP_NET 2214 3.72 9.06 0.84 143 HTTPS_HTTP_MISMATCH 2040 0.95 1.28 0.78 144 SpammyFromTLD_01 2035 1.24 2.11 0.78 145 XM_B_DNDMA 2025 0.83 0.93 0.77 146 RELAYCOUNTRY_AU 1998 1.41 2.60 0.76 147 XM_B_SpammyWords4 1984 1.14 1.85 0.76 148 T_FILL_THIS_FORM_SHORT 1903 1.31 2.39 0.73 149 TooManyTo_004 1886 0.64 0.48 0.72 150 XM_OfRef6 1862 1.54 3.09 0.71 151 URI_TRY_3LD 1808 0.74 0.84 0.69 152 T_XMHurry_00 1798 1.15 2.01 0.69 153 MPART_ALT_DIFF_COUNT 1793 0.80 1.01 0.68 154 TR_XM_SEO4 1754 1.90 4.17 0.67 155 TVD_RCVD_IP 1749 0.70 0.75 0.67 156 TR_MetaPhish_Combo_01 1715 0.71 0.82 0.65 157 FORGED_GMAIL_RCVD 1613 0.66 0.74 0.62 158 HTML_TAG_BALANCE_BODY 1606 0.79 1.12 0.61 159 XMCapTrack 1593 0.59 0.57 0.61 160 TR_XM_Base64_M1 1580 0.73 0.96 0.60 161 XMPhish30 1566 0.88 1.40 0.60 162 TM2_M_OBFU_COMMENT 1546 0.77 1.11 0.59 163 RCVD_IN_PBL 1540 0.69 0.89 0.59 164 TR_LOTS_OF_MONEY3 1538 1.11 2.07 0.59 165 XMBody_95 1511 0.46 0.24 0.58 166 XM_H_PHPMailer 1507 0.57 0.55 0.57 167 TooManyTo_005 1507 0.54 0.47 0.57 168 NML_ADSP_CUSTOM_MED 1474 0.64 0.79 0.56 169 FROM_GOV_DKIM_AU 1447 0.40 0.13 0.55 170 USER_IN_WELCOMELIST 1443 0.36 0.00 0.55 171 USER_IN_WHITELIST 1443 0.36 0.00 0.55 172 XMSubMetaSxObfu_03 1441 0.55 0.55 0.55 173 T_XMDrugObfuBody_00 1429 0.79 1.24 0.55 174 XM_B_Phish66 1423 0.65 0.86 0.54 175 XMGenDplmaNmb 1414 0.69 0.98 0.54 176 MAY_BE_FORGED 1396 0.48 0.37 0.53 177 XM_ProductURIs 1332 0.65 0.92 0.51 178 XMBody_17 1321 1.50 3.35 0.50 179 XM_ShortIntro_01 1312 0.48 0.44 0.50 180 T_TVD_MIME_NO_HEADERS 1267 0.34 0.06 0.48 181 HTML_IMAGE_ONLY_20 1226 0.43 0.36 0.47 182 XMLngstWrd_00 1218 0.48 0.51 0.46 183 T_OBFU_PDF_ATTACH 1205 0.33 0.08 0.46 184 TR_XM_SpammyWords2 1197 3.74 9.82 0.46 185 MIME_CHARSET_FARAWAY 1193 0.65 1.02 0.46 186 XMNoVowels 1185 0.45 0.44 0.45 187 XMSubMetaI_00 1172 0.67 1.08 0.45 188 HTML_IMAGE_ONLY_32 1151 0.35 0.19 0.44 189 THIS_AD 1144 0.76 1.37 0.44 190 TR_XM_SPAMCOP 1122 3.06 7.94 0.43 191 SpammyFromTLD_02 1120 0.71 1.25 0.43 192 HTML_FONT_FACE_BAD 1108 0.55 0.79 0.42 193 XM_URI_RBL 1086 1.25 2.79 0.41 194 RDNS_DYNAMIC 1057 0.56 0.84 0.40 195 T_Symld_Words_02 1025 0.44 0.53 0.39 196 T_TooManySym_04 1025 0.27 0.04 0.39 197 XMBSHREFv2 1011 0.33 0.22 0.39 198 XMMoneyMeta_00 1005 0.43 0.53 0.38 199 XMPhish14 988 0.45 0.59 0.38 200 SUBJ_DOLLARS 987 0.40 0.45 0.38 ----------------------------------------------------------------------