Email: 494631 Autolearn: 0 AvgScore: 2.16 AvgScanTime: 1.31 sec Spam: 130831 Autolearn: 0 AvgScore: 14.93 AvgScanTime: 1.53 sec Ham: 363800 Autolearn: 0 AvgScore: -2.43 AvgScanTime: 1.24 sec Time Spent Running SA: 180.57 hours Time Spent Processing Spam: 55.67 hours Time Spent Processing Ham: 124.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124028 88.83 94.80 86.68 2 DKIM_SIGNED 113548 68.95 86.79 62.54 3 XM_DK_Pass 109221 67.16 83.48 61.29 4 RELAYCOUNTRY_US 108358 80.65 82.82 79.87 5 DKIM_VALID 107130 66.08 81.88 60.39 6 XM_B_Unicode 106682 73.64 81.54 70.80 7 DCC_CHECK 98942 43.44 75.63 31.87 8 XM_B_SpammyWords 92689 49.89 70.85 42.35 9 XMListUnsubscribeExists 89248 46.52 68.22 38.72 10 DKIM_VALID_AU 86415 53.10 66.05 48.45 11 XM_B_Unicode3 62754 42.90 47.97 41.08 12 LOC_TINY_FONT_1 61595 27.33 47.08 20.23 13 XM_B_SpammyWords2 57070 24.14 43.62 17.14 14 BAYES_50 51974 52.41 39.73 56.97 15 XM_DK_Undo_02 50969 13.44 38.96 4.26 16 HTML_FONT_LOW_CONTRAST 48237 27.15 36.87 23.65 17 RCVD_IN_MSPIKE_H2 47947 30.40 36.65 28.16 18 FVGT_m_MULTI_ODD 42893 23.57 32.79 20.26 19 T_KAM_HTML_FONT_INVALID 41002 20.74 31.34 16.93 20 BAYES_99 40433 10.20 30.90 2.75 21 MIME_HTML_ONLY 38068 24.01 29.10 22.18 22 TR_XM_DKIM_Undo 35696 8.37 27.28 1.57 23 DKIM_VALID_EF 34467 24.94 26.34 24.44 24 XMSubLong 31998 22.44 24.46 21.72 25 BAYES_999 31108 7.78 23.78 2.03 26 TR_DCC_Bayes_99 29646 6.60 22.66 0.83 27 DCC_CHECK_NEGATIVE 29612 56.06 22.63 68.08 28 XM_Multi_Part_URI 28857 15.12 22.06 12.62 29 T_TM2_M_HEADER_IN_MSG 28629 27.56 21.88 29.60 30 TR_XM_DK_Unsub 23517 12.16 17.98 10.07 31 XM_B_Unsub 22923 10.03 17.52 7.34 32 XM_B_SpammyWords3 21881 7.13 16.72 3.68 33 TR_XM_BayesUnsub 21759 8.56 16.63 5.66 34 UNPARSEABLE_RELAY 20534 10.66 15.70 8.85 35 TR_MAX_INTL_RELAY 20129 7.45 15.39 4.60 36 RELAYCOUNTRY_META 19731 6.40 15.08 3.28 37 LOTS_OF_MONEY 16763 8.03 12.81 6.31 38 TR_XM_SpammyWords2 15713 3.41 12.01 0.32 39 BOTNET_IPINHOSTNAME 15282 5.23 11.68 2.91 40 TR_XM_SpammyRelay 15171 4.24 11.60 1.60 41 TR_XM_SpammyWords4 15168 6.39 11.59 4.51 42 BOTNET 14086 3.91 10.77 1.44 43 FSL_BULK_SIG 13565 7.79 10.37 6.86 44 XM_Evil_Numbers_Gen 13301 9.25 10.17 8.92 45 BAYES_80 12475 4.60 9.54 2.83 46 LotsOfNums_01 11973 7.25 9.15 6.56 47 BAYES_60 11102 7.49 8.49 7.13 48 XM_Body_Dirty_Words 11074 3.79 8.46 2.11 49 TR_XM_UnparsRelay 10782 3.06 8.24 1.20 50 XM_B_Phish_Phrases 10712 5.69 8.19 4.79 51 XM_UncommonTLD01 9999 4.70 7.64 3.64 52 RCVD_IN_BL_SPAMCOP_NET 8624 2.09 6.59 0.47 53 UNTRUSTED_Relay 8421 2.60 6.44 1.23 54 MPART_ALT_DIFF 8390 8.53 6.41 9.29 55 XM_B_PhoneNumber 8294 7.88 6.34 8.43 56 XMSubMetaSx_00 7866 4.19 6.01 3.53 57 HTML_IMAGE_RATIO_02 7864 4.18 6.01 3.52 58 XM_H_Long_From01 7677 4.69 5.87 4.27 59 RELAYCOUNTRY_CA 7293 2.19 5.57 0.97 60 BAYES_95 7013 2.72 5.36 1.77 61 TooManyTo_001 6837 7.49 5.23 8.30 62 TR_XM_SPAMCOP 6811 1.57 5.21 0.27 63 DKIM_INVALID 6418 2.88 4.91 2.15 64 XM_H_GMP 6148 4.82 4.70 4.87 65 T_XMDrugObfuBody_14 5973 2.26 4.57 1.43 66 HTML_IMAGE_RATIO_04 5906 11.80 4.51 14.42 67 TM2_M_VERY_LONG_WORD 5859 2.17 4.48 1.33 68 XM_B_Investor 5628 2.13 4.30 1.35 69 TR_XM_PhishingBody 5619 2.30 4.29 1.58 70 HTML_IMAGE_RATIO_06 5555 4.03 4.25 3.95 71 MIME_HTML_ONLY_MULTI 5352 6.81 4.09 7.79 72 XMSexyCombo_05 5231 1.73 4.00 0.92 73 TR_XM_SpammyWords5 5013 1.86 3.83 1.15 74 XMStrtUSub 4945 8.99 3.78 10.86 75 XM_SPF_SoftFail 4781 1.92 3.65 1.29 76 XM_B_SpammyTLD 4757 3.54 3.64 3.50 77 XMNumbers 4609 2.78 3.52 2.52 78 DIET_1 4599 1.19 3.52 0.36 79 T_TooManySym_01 4494 4.71 3.43 5.16 80 RCVD_IN_VALIDITY_RPBL 4421 0.94 3.38 0.06 81 MIME_HTML_MOSTLY 4184 2.27 3.20 1.94 82 RCVD_IN_MSPIKE_H3 4146 4.12 3.17 4.46 83 RCVD_IN_MSPIKE_WL 4146 4.12 3.17 4.46 84 RELAYCOUNTRY_AU 4094 1.22 3.13 0.53 85 HTML_IMAGE_RATIO_08 4027 2.40 3.08 2.16 86 XMDiploma_00 3957 1.73 3.02 1.27 87 XM_CamelCaseFrm001 3941 2.09 3.01 1.75 88 XM_OfRef6 3937 1.43 3.01 0.87 89 XM_UB50 3925 1.32 3.00 0.71 90 XM_B_SpammyWords4 3884 1.28 2.97 0.68 91 XM_B_URI_Unicode 3846 2.15 2.94 1.87 92 T_XMDrugObfuBody_08 3737 1.65 2.86 1.22 93 MIME_QP_LONG_LINE 3727 4.33 2.85 4.87 94 TM2_M_URI_OPT_OUT 3703 2.32 2.83 2.14 95 TR_XM_NoHeaderRelay 3658 0.90 2.80 0.21 96 FROM_EXCESS_BASE64 3405 1.99 2.60 1.77 97 RCVD_IN_VALIDITY_SAFE 3398 3.39 2.60 3.68 98 XMBody_17 3286 0.90 2.51 0.32 99 XM_URI_RBL 3263 0.85 2.49 0.26 100 XM_B_Unsub2 3260 1.54 2.49 1.20 101 RCVD_IN_VALIDITY_CERTIFIED 3063 2.95 2.34 3.18 102 MAILING_LIST_MULTI 2853 2.50 2.18 2.62 103 SpammyFromTLD_01 2757 1.18 2.11 0.85 104 DKIM_ADSP_NXDOMAIN 2721 0.73 2.08 0.25 105 BOTNET_NORDNS 2705 0.56 2.07 0.01 106 XMBrknScrpt_02 2678 1.03 2.05 0.67 107 SUBJ_ALL_CAPS 2651 1.48 2.03 1.28 108 RCVD_IN_PSBL 2598 0.58 1.99 0.08 109 USER_IN_DEF_DKIM_WL 2577 8.36 1.97 10.66 110 T_XMHurry_00 2525 0.77 1.93 0.35 111 KHOP_HELO_FCRDNS 2498 1.52 1.91 1.38 112 RCVD_IN_XBL 2408 0.50 1.84 0.02 113 XMSlimDrugH 2374 0.70 1.81 0.30 114 SpammyFromTLD_02 2350 0.72 1.80 0.33 115 XMStockSpam_06 2346 1.26 1.79 1.06 116 BAYES_40 2293 4.67 1.75 5.72 117 XM_DK_Undo_01 2236 1.43 1.71 1.34 118 SHORTCIRCUIT 2225 0.45 1.70 0.00 119 RCVD_IN_ZEN_LASTEXTERNAL 2225 0.45 1.70 0.00 120 ANY_BOUNCE_MESSAGE 2196 2.76 1.68 3.15 121 BOUNCE_MESSAGE 2189 2.76 1.67 3.15 122 TR_XM_PHPForged 2165 0.69 1.65 0.34 123 XMBdyGiftCard01 2155 0.77 1.65 0.45 124 TR_XM_PHPDW 2140 0.69 1.64 0.35 125 TR_XM_FormFill2 2124 0.69 1.62 0.35 126 XMPhish30 2103 0.80 1.61 0.51 127 XM_H_PHPOS 2084 0.67 1.59 0.34 128 RCVD_IN_PBL 2051 0.86 1.57 0.61 129 T_XMDrugObfuBody_00 2010 0.88 1.54 0.65 130 XMGenDplmaNmb 1989 0.91 1.52 0.69 131 TR_Mismatch_TLD_02 1974 0.45 1.51 0.07 132 XM_B_REG_HTML 1971 0.58 1.51 0.25 133 ALL_TRUSTED 1965 13.28 1.50 17.52 134 PLING_QUERY 1941 0.63 1.48 0.32 135 XM_B_SEO 1941 0.55 1.48 0.22 136 T_REMOTE_IMAGE 1915 2.93 1.46 3.46 137 TVD_RCVD_IP 1915 0.88 1.46 0.67 138 NO_DNS_FOR_FROM 1882 0.58 1.44 0.27 139 TR_XM_MaxWHORU 1868 0.54 1.43 0.23 140 HTML_MIME_NO_HTML_TAG 1811 1.84 1.38 2.00 141 T_FILL_THIS_FORM_SHORT 1803 1.05 1.38 0.93 142 URI_HEX 1774 1.02 1.36 0.90 143 XM_B_COPY_HTML 1753 0.89 1.34 0.72 144 LongTLD 1739 0.60 1.33 0.34 145 TR_XM_InvalidRelay 1714 0.36 1.31 0.01 146 FSL_NEW_HELO_USER 1709 0.35 1.31 0.00 147 FORGED_MUA_OUTLOOK 1698 0.36 1.30 0.02 148 FSL_CTYPE_WIN1251 1695 0.34 1.30 0.00 149 AXB_XMAILER_MIMEOLE_OL_024C2 1693 0.34 1.29 0.00 150 XPRIO 1691 0.35 1.29 0.01 151 FROM_MISSPACED 1690 0.34 1.29 0.00 152 BAYES_20 1690 3.47 1.29 4.26 153 FROM_MISSP_REPLYTO 1688 0.34 1.29 0.00 154 NSL_RCVD_FROM_USER 1685 0.34 1.29 0.00 155 FROM_MISSP_MSFT 1680 0.34 1.28 0.00 156 T_TooManySym_02 1680 2.24 1.28 2.58 157 FROM_MISSP_USER 1661 0.34 1.27 0.00 158 T_MONEY_PERCENT 1646 0.43 1.26 0.13 159 TR_LOTS_OF_MONEY2 1646 0.43 1.26 0.13 160 XM_B_Phish66 1595 0.60 1.22 0.38 161 SH_BODYURI_REVERSE_CSS 1584 0.36 1.21 0.05 162 URIBL_CSS 1582 0.36 1.21 0.05 163 URIBL_CSS_A 1582 0.36 1.21 0.05 164 MISSING_HEADERS 1571 0.58 1.20 0.36 165 XM_SendGrid 1570 1.19 1.20 1.18 166 TR_XM_SEO4 1555 0.40 1.19 0.11 167 XM_OfRef7 1543 0.41 1.18 0.14 168 TR_XM_Base64_M1 1531 0.74 1.17 0.58 169 HTTPS_HTTP_MISMATCH 1502 0.81 1.15 0.69 170 TR_Symld_Words 1491 1.61 1.14 1.78 171 XM_H_Undi_Recip 1490 0.42 1.14 0.16 172 XMSexyCombo_01 1483 0.36 1.13 0.09 173 TooManyTo_002 1458 2.30 1.11 2.72 174 RDNS_DYNAMIC 1444 0.53 1.10 0.32 175 TR_XM_INV_DKIM 1435 0.32 1.10 0.04 176 XM_UB99 1423 0.29 1.09 0.00 177 PDS_RDNS_DYNAMIC_FP 1420 0.43 1.09 0.20 178 TM2_M_OBFU_COMMENT 1417 0.59 1.08 0.41 179 HTML_TAG_BALANCE_BODY 1416 0.62 1.08 0.45 180 XM_H_Long_From02 1405 0.95 1.07 0.91 181 XM_B_DNDMA 1384 0.70 1.06 0.57 182 TooManyTo_003 1353 1.45 1.03 1.60 183 T_STY_INVIS_DIRECT 1343 0.54 1.03 0.36 184 HTML_IMAGE_ONLY_20 1343 0.69 1.03 0.56 185 XMReplyNow 1312 0.43 1.00 0.22 186 SHOPIFY_IMG_NOT_RCVD_SFY 1302 0.40 1.00 0.19 187 RCVD_IN_IADB_LISTED 1294 2.36 0.99 2.86 188 XMMoneyMeta_00 1278 0.63 0.98 0.51 189 XM_UB80 1275 0.26 0.97 0.01 190 URI_NOVOWEL 1265 2.20 0.97 2.65 191 XM_B_COVIDMETA 1261 0.43 0.96 0.24 192 TooManyTo_004 1256 1.13 0.96 1.19 193 TO_NO_BRKTS_FROM_MSSP 1245 0.27 0.95 0.02 194 RCVD_IN_SORBS_DUL 1241 0.28 0.95 0.03 195 XMHTML_After_End 1236 0.47 0.94 0.30 196 TR_MetaPhish_Combo_01 1236 0.77 0.94 0.71 197 XMSubMetaI_00 1223 0.49 0.93 0.32 198 NORDNS_LOW_CONTRAST 1222 0.28 0.93 0.05 199 DKIM_ADSP_CUSTOM_MED 1218 0.72 0.93 0.65 200 XM_RXBody 1210 0.34 0.92 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 315337 88.83 94.80 86.68 2 RELAYCOUNTRY_US 290551 80.65 82.82 79.87 3 XM_B_Unicode 257559 73.64 81.54 70.80 4 DCC_CHECK_NEGATIVE 247666 56.06 22.63 68.08 5 DKIM_SIGNED 227524 68.95 86.79 62.54 6 XM_DK_Pass 222955 67.16 83.48 61.29 7 DKIM_VALID 219715 66.08 81.88 60.39 8 BAYES_50 207253 52.41 39.73 56.97 9 DKIM_VALID_AU 176255 53.10 66.05 48.45 10 XM_B_SpammyWords 154080 49.89 70.85 42.35 11 XM_B_Unicode3 149454 42.90 47.97 41.08 12 XMListUnsubscribeExists 140869 46.52 68.22 38.72 13 DCC_CHECK 115948 43.44 75.63 31.87 14 T_TM2_M_HEADER_IN_MSG 107685 27.56 21.88 29.60 15 RCVD_IN_MSPIKE_H2 102437 30.40 36.65 28.16 16 DKIM_VALID_EF 88904 24.94 26.34 24.44 17 HTML_FONT_LOW_CONTRAST 86039 27.15 36.87 23.65 18 MIME_HTML_ONLY 80687 24.01 29.10 22.18 19 XMSubLong 79011 22.44 24.46 21.72 20 FVGT_m_MULTI_ODD 73709 23.57 32.79 20.26 21 LOC_TINY_FONT_1 73610 27.33 47.08 20.23 22 ALL_TRUSTED 63727 13.28 1.50 17.52 23 XM_B_SpammyWords2 62340 24.14 43.62 17.14 24 T_KAM_HTML_FONT_INVALID 61591 20.74 31.34 16.93 25 BAYES_00 55872 11.47 0.65 15.36 26 HTML_IMAGE_RATIO_04 52449 11.80 4.51 14.42 27 HTML_FONT_FACE_BAD 48769 10.02 0.60 13.41 28 XM_H_Trusted_IP 46634 9.43 0.00 12.82 29 XM_Multi_Part_URI 45910 15.12 22.06 12.62 30 XMStrtUSub 39507 8.99 3.78 10.86 31 USER_IN_DEF_DKIM_WL 38766 8.36 1.97 10.66 32 TR_XM_DK_Unsub 36618 12.16 17.98 10.07 33 MPART_ALT_DIFF 33800 8.53 6.41 9.29 34 XM_Evil_Numbers_Gen 32440 9.25 10.17 8.92 35 UNPARSEABLE_RELAY 32200 10.66 15.70 8.85 36 XM_B_PhoneNumber 30664 7.88 6.34 8.43 37 TooManyTo_001 30208 7.49 5.23 8.30 38 MIME_HTML_ONLY_MULTI 28333 6.81 4.09 7.79 39 XM_B_Unsub 26699 10.03 17.52 7.34 40 BAYES_60 25957 7.49 8.49 7.13 41 FSL_BULK_SIG 24948 7.79 10.37 6.86 42 LotsOfNums_01 23871 7.25 9.15 6.56 43 LOTS_OF_MONEY 22965 8.03 12.81 6.31 44 XM_DKIMWhitelistDomains 22189 4.50 0.05 6.10 45 TR_XM_DK_Bayes 22012 4.59 0.52 6.05 46 TR_XM_DK_Bayes1 21777 4.54 0.52 5.99 47 IN_ZIMBRA_NJ_WHITELIST 21011 4.27 0.10 5.78 48 BAYES_40 20801 4.67 1.75 5.72 49 TR_XM_BayesUnsub 20599 8.56 16.63 5.66 50 TR_XM_DK_Bayes2 18963 3.93 0.35 5.21 51 T_TooManySym_01 18785 4.71 3.43 5.16 52 XM_H_GMP 17715 4.82 4.70 4.87 53 MIME_QP_LONG_LINE 17711 4.33 2.85 4.87 54 XM_B_Phish_Phrases 17409 5.69 8.19 4.79 55 XMSubNoVowel 17029 3.61 0.64 4.68 56 TR_MAX_INTL_RELAY 16718 7.45 15.39 4.60 57 TR_XM_SpammyWords4 16417 6.39 11.59 4.51 58 RCVD_IN_MSPIKE_WL 16242 4.12 3.17 4.46 59 RCVD_IN_MSPIKE_H3 16242 4.12 3.17 4.46 60 XM_H_Long_From01 15525 4.69 5.87 4.27 61 BAYES_20 15493 3.47 1.29 4.26 62 XM_DK_Undo_02 15486 13.44 38.96 4.26 63 XM_PDF 15266 3.27 0.71 4.20 64 HTML_IMAGE_RATIO_06 14380 4.03 4.25 3.95 65 XM_B_SpammyWords3 13385 7.13 16.72 3.68 66 RCVD_IN_VALIDITY_SAFE 13381 3.39 2.60 3.68 67 XM_UncommonTLD01 13231 4.70 7.64 3.64 68 XMSubMetaSx_00 12857 4.19 6.01 3.53 69 HTML_IMAGE_RATIO_02 12799 4.18 6.01 3.52 70 XM_B_SpammyTLD 12747 3.54 3.64 3.50 71 T_REMOTE_IMAGE 12579 2.93 1.46 3.46 72 RELAYCOUNTRY_META 11933 6.40 15.08 3.28 73 BAYES_05 11705 2.52 0.59 3.22 74 RCVD_IN_VALIDITY_CERTIFIED 11552 2.95 2.34 3.18 75 ANY_BOUNCE_MESSAGE 11452 2.76 1.68 3.15 76 BOUNCE_MESSAGE 11450 2.76 1.67 3.15 77 BOTNET_IPINHOSTNAME 10574 5.23 11.68 2.91 78 RCVD_IN_IADB_LISTED 10397 2.36 0.99 2.86 79 BAYES_80 10287 4.60 9.54 2.83 80 BAYES_99 10004 10.20 30.90 2.75 81 TooManyTo_002 9900 2.30 1.11 2.72 82 URI_NOVOWEL 9628 2.20 0.97 2.65 83 MAILING_LIST_MULTI 9528 2.50 2.18 2.62 84 T_TooManySym_02 9378 2.24 1.28 2.58 85 RCVD_IN_IADB_SPF 9170 2.09 0.88 2.52 86 XMNumbers 9151 2.78 3.52 2.52 87 RCVD_IN_IADB_SENDERID 8206 1.88 0.82 2.26 88 RCVD_IN_IADB_DK 8034 1.84 0.83 2.21 89 XMSubLongNoVowel 7898 1.69 0.37 2.17 90 HTML_IMAGE_RATIO_08 7861 2.40 3.08 2.16 91 DKIM_INVALID 7809 2.88 4.91 2.15 92 TM2_M_URI_OPT_OUT 7786 2.32 2.83 2.14 93 XMSubGarbage 7703 1.58 0.10 2.12 94 XM_Body_Dirty_Words 7663 3.79 8.46 2.11 95 BAYES_999 7388 7.78 23.78 2.03 96 HTML_MIME_NO_HTML_TAG 7273 1.84 1.38 2.00 97 INVALID_MSGID 7183 1.53 0.28 1.97 98 MIME_HTML_MOSTLY 7045 2.27 3.20 1.94 99 RCVD_IN_IADB_VOUCHED 6858 1.52 0.49 1.89 100 XM_B_URI_Unicode 6810 2.15 2.94 1.87 101 TO_MALFORMED 6606 1.35 0.05 1.82 102 TR_Symld_Words 6470 1.61 1.14 1.78 103 FROM_EXCESS_BASE64 6455 1.99 2.60 1.77 104 BAYES_95 6428 2.72 5.36 1.77 105 XM_CamelCaseFrm001 6376 2.09 3.01 1.75 106 TooManyTo_003 5826 1.45 1.03 1.60 107 TR_XM_SpammyRelay 5813 4.24 11.60 1.60 108 TR_XM_PhishingBody 5756 2.30 4.29 1.58 109 TR_XM_DKIM_Undo 5699 8.37 27.28 1.57 110 BOTNET 5233 3.91 10.77 1.44 111 T_XMDrugObfuBody_14 5193 2.26 4.57 1.43 112 KHOP_HELO_FCRDNS 5033 1.52 1.91 1.38 113 XM_B_Investor 4898 2.13 4.30 1.35 114 XM_DK_Undo_01 4861 1.43 1.71 1.34 115 TM2_M_VERY_LONG_WORD 4851 2.17 4.48 1.33 116 RCVD_IN_IADB_OPTIN 4817 1.06 0.32 1.32 117 XMGappySubj_01 4799 1.06 0.35 1.32 118 XM_SPF_SoftFail 4701 1.92 3.65 1.29 119 SUBJ_ALL_CAPS 4653 1.48 2.03 1.28 120 XMDiploma_00 4607 1.73 3.02 1.27 121 IN_HORDE_ADDRESS_BOOK 4507 0.94 0.11 1.24 122 UNTRUSTED_Relay 4464 2.60 6.44 1.23 123 T_XMDrugObfuBody_08 4421 1.65 2.86 1.22 124 TR_XM_UnparsRelay 4377 3.06 8.24 1.20 125 XM_B_Unsub2 4359 1.54 2.49 1.20 126 TooManyTo_004 4346 1.13 0.96 1.19 127 HELO_NODOT 4307 0.97 0.36 1.18 128 HELO_NO_DOMAIN 4303 0.96 0.36 1.18 129 XM_SendGrid 4297 1.19 1.20 1.18 130 TR_XM_SpammyWords5 4198 1.86 3.83 1.15 131 FROM_GOV_DKIM_AU 4060 0.94 0.46 1.12 132 XMCapTrack 3911 0.93 0.53 1.08 133 TVD_SPACE_RATIO 3883 0.83 0.16 1.07 134 XMStockSpam_06 3866 1.26 1.79 1.06 135 XM_GoogleGroups 3708 0.96 0.79 1.02 136 XM_TLDProd2 3635 0.81 0.27 1.00 137 XM_E_Blogspot 3610 0.78 0.19 0.99 138 T_TooManySym_03 3598 0.95 0.84 0.99 139 RELAYCOUNTRY_CA 3541 2.19 5.57 0.97 140 T_FILL_THIS_FORM_SHORT 3401 1.05 1.38 0.93 141 TooManyTo_005 3346 0.92 0.91 0.92 142 XMSexyCombo_05 3342 1.73 4.00 0.92 143 XM_H_Long_From02 3318 0.95 1.07 0.91 144 URI_HEX 3277 1.02 1.36 0.90 145 XM_OfRef6 3152 1.43 3.01 0.87 146 SpammyFromTLD_01 3100 1.18 2.11 0.85 147 TR_DCC_Bayes_99 3008 6.60 22.66 0.83 148 XMGappySubj_02 2983 0.62 0.06 0.82 149 TR_XM_DK_SendGrid 2842 0.76 0.70 0.78 150 XMSubMetaSxObfu_03 2667 0.78 0.92 0.73 151 XM_B_COPY_HTML 2629 0.89 1.34 0.72 152 XM_ShortIntro_01 2612 0.71 0.69 0.72 153 XM_UB50 2590 1.32 3.00 0.71 154 TR_MetaPhish_Combo_01 2574 0.77 0.94 0.71 155 HTTPS_HTTP_MISMATCH 2512 0.81 1.15 0.69 156 XMGenDplmaNmb 2496 0.91 1.52 0.69 157 XM_B_SpammyWords4 2466 1.28 2.97 0.68 158 XMBrknScrpt_02 2426 1.03 2.05 0.67 159 TVD_RCVD_IP 2421 0.88 1.46 0.67 160 XMNoVowels 2407 0.61 0.46 0.66 161 DKIM_ADSP_CUSTOM_MED 2368 0.72 0.93 0.65 162 T_XMDrugObfuBody_00 2352 0.88 1.54 0.65 163 XMLngstWrd_00 2278 0.64 0.67 0.63 164 T_OBFU_PDF_ATTACH 2231 0.50 0.17 0.61 165 XMBody_95 2225 0.49 0.16 0.61 166 RCVD_IN_PBL 2218 0.86 1.57 0.61 167 TR_XM_Base64_M1 2118 0.74 1.17 0.58 168 XM_H_PHPMailer 2077 0.61 0.74 0.57 169 XM_B_DNDMA 2074 0.70 1.06 0.57 170 XM_B_FormFill 2070 0.43 0.04 0.57 171 HTML_IMAGE_ONLY_20 2055 0.69 1.03 0.56 172 T_Symld_Words_02 2028 0.62 0.80 0.56 173 HTML_FONT_SIZE_LARGE 2018 0.45 0.17 0.55 174 RELAYCOUNTRY_AU 1928 1.22 3.13 0.53 175 MPART_ALT_DIFF_COUNT 1903 0.62 0.87 0.52 176 XMPhish30 1841 0.80 1.61 0.51 177 XMMoneyMeta_00 1841 0.63 0.98 0.51 178 URI_TRY_3LD 1798 0.58 0.83 0.49 179 HTML_IMAGE_ONLY_32 1760 0.41 0.20 0.48 180 RCVD_IN_BL_SPAMCOP_NET 1696 2.09 6.59 0.47 181 FILL_THIS_FORM 1663 0.55 0.80 0.46 182 HTML_TAG_BALANCE_BODY 1651 0.62 1.08 0.45 183 XMBdyGiftCard01 1644 0.77 1.65 0.45 184 XM_ProductURIs 1552 0.52 0.76 0.43 185 XMPhish14 1500 0.47 0.63 0.41 186 TM2_M_OBFU_COMMENT 1497 0.59 1.08 0.41 187 FORGED_GMAIL_RCVD 1487 0.47 0.64 0.41 188 NML_ADSP_CUSTOM_MED 1473 0.48 0.69 0.40 189 HTML_IMAGE_ONLY_28 1427 0.41 0.45 0.39 190 MIME_CHARSET_FARAWAY 1413 0.46 0.65 0.39 191 USER_IN_WELCOMELIST 1407 0.28 0.00 0.39 192 USER_IN_WHITELIST 1407 0.28 0.00 0.39 193 TM2_M_BODY_EMPTY 1402 0.30 0.07 0.39 194 XM_B_Phish66 1377 0.60 1.22 0.38 195 RELAYCOUNTRY_GB 1374 0.49 0.82 0.38 196 T_TooManySym_04 1333 0.28 0.05 0.37 197 MSGID_FROM_MTA_HEADER 1329 0.30 0.12 0.37 198 T_STY_INVIS_DIRECT 1324 0.54 1.03 0.36 199 MISSING_HEADERS 1310 0.58 1.20 0.36 200 DIET_1 1301 1.19 3.52 0.36 ----------------------------------------------------------------------