Email: 478960 Autolearn: 0 AvgScore: 4.27 AvgScanTime: 1.34 sec Spam: 138769 Autolearn: 0 AvgScore: 14.73 AvgScanTime: 1.50 sec Ham: 340191 Autolearn: 0 AvgScore: 0.00 AvgScanTime: 1.27 sec Time Spent Running SA: 177.74 hours Time Spent Processing Spam: 57.74 hours Time Spent Processing Ham: 120.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131754 89.61 94.94 87.43 2 DKIM_SIGNED 124623 78.90 89.81 74.45 3 XM_DK_Pass 119580 76.90 86.17 73.12 4 DKIM_VALID 117755 75.67 84.86 71.93 5 RELAYCOUNTRY_US 116552 80.94 83.99 79.70 6 XM_B_Unicode 116468 74.22 83.93 70.26 7 DCC_CHECK 105206 48.75 75.81 37.72 8 XMListUnsubscribeExists 97126 52.73 69.99 45.68 9 XM_B_SpammyWords 95331 52.48 68.70 45.87 10 DKIM_VALID_AU 92562 59.99 66.70 57.25 11 LOC_TINY_FONT_1 69542 31.73 50.11 24.24 12 XM_B_Unicode3 68515 41.49 49.37 38.28 13 BAYES_50 58124 55.37 41.89 60.87 14 XM_B_SpammyWords2 55716 25.90 40.15 20.09 15 HTML_FONT_LOW_CONTRAST 54618 29.55 39.36 25.55 16 XM_DK_Undo_02 53669 14.92 38.68 5.23 17 RCVD_IN_MSPIKE_H2 51898 34.56 37.40 33.40 18 FVGT_m_MULTI_ODD 47926 26.11 34.54 22.68 19 T_KAM_HTML_FONT_INVALID 43932 23.03 31.66 19.51 20 BAYES_99 42385 11.09 30.54 3.15 21 DKIM_VALID_EF 38313 28.96 27.61 29.51 22 MIME_HTML_ONLY 36950 20.87 26.63 18.52 23 TR_XM_DKIM_Undo 36926 9.42 26.61 2.41 24 XMSubLong 34304 23.03 24.72 22.34 25 BAYES_999 32859 8.50 23.68 2.31 26 XM_Multi_Part_URI 32021 16.32 23.08 13.57 27 T_TM2_M_HEADER_IN_MSG 31627 28.88 22.79 31.36 28 TR_DCC_Bayes_99 31467 7.42 22.68 1.20 29 DCC_CHECK_NEGATIVE 30848 50.65 22.23 62.24 30 TR_XM_DK_Unsub 26375 13.62 19.01 11.42 31 UNPARSEABLE_RELAY 24851 13.75 17.91 12.05 32 XM_B_Unsub 23643 11.80 17.04 9.67 33 TR_XM_BayesUnsub 22719 10.13 16.37 7.59 34 XM_B_SpammyWords3 20845 7.36 15.02 4.23 35 TR_MAX_INTL_RELAY 19997 8.22 14.41 5.69 36 RELAYCOUNTRY_META 19926 6.97 14.36 3.96 37 BOTNET_IPINHOSTNAME 17049 6.10 12.29 3.58 38 LOTS_OF_MONEY 16637 8.38 11.99 6.91 39 TR_XM_SpammyRelay 15051 4.55 10.85 1.99 40 TR_XM_SpammyWords4 14891 6.53 10.73 4.81 41 TR_XM_SpammyWords2 14788 3.31 10.66 0.31 42 XM_Evil_Numbers_Gen 13642 8.85 9.83 8.45 43 LotsOfNums_01 12865 8.67 9.27 8.42 44 TR_XM_UnparsRelay 12715 3.75 9.16 1.54 45 FSL_BULK_SIG 12369 7.52 8.91 6.95 46 BAYES_80 12183 5.07 8.78 3.56 47 BOTNET 11698 3.80 8.43 1.91 48 XM_B_Phish_Phrases 11511 5.90 8.30 4.92 49 BAYES_60 10690 8.02 7.70 8.14 50 HTML_IMAGE_RATIO_02 10573 5.23 7.62 4.25 51 XM_Body_Dirty_Words 10318 3.61 7.44 2.05 52 RCVD_IN_BL_SPAMCOP_NET 9740 2.54 7.02 0.71 53 XM_B_PhoneNumber 9381 9.05 6.76 9.99 54 XM_UncommonTLD01 8817 4.60 6.35 3.88 55 XM_B_Investor 8258 2.90 5.95 1.66 56 XMSubMetaSx_00 7917 5.12 5.71 4.88 57 MPART_ALT_DIFF 7885 4.61 5.68 4.17 58 UNTRUSTED_Relay 7855 2.67 5.66 1.46 59 XM_H_Long_From01 7844 5.16 5.65 4.96 60 TR_XM_PhishingBody 7776 2.88 5.60 1.77 61 TR_XM_SPAMCOP 7645 1.81 5.51 0.30 62 XM_H_GMP 7229 5.25 5.21 5.26 63 BAYES_95 7219 3.02 5.20 2.13 64 RELAYCOUNTRY_CA 7209 2.37 5.19 1.22 65 DKIM_INVALID 6868 3.23 4.95 2.53 66 T_XMDrugObfuBody_14 6588 2.52 4.75 1.62 67 XMStrtUSub 6323 4.44 4.56 4.40 68 HTML_IMAGE_RATIO_04 6213 3.82 4.48 3.55 69 TooManyTo_001 6188 8.48 4.46 10.12 70 TR_XM_SpammyWords5 5796 2.25 4.18 1.47 71 XM_B_SpammyTLD 5748 2.74 4.14 2.17 72 TM2_M_VERY_LONG_WORD 5541 2.21 3.99 1.48 73 HTML_IMAGE_RATIO_06 5374 3.34 3.87 3.13 74 MIME_HTML_MOSTLY 5367 2.64 3.87 2.14 75 XMNumbers 5321 3.03 3.83 2.70 76 XMSexyCombo_05 5226 1.75 3.77 0.93 77 HTML_IMAGE_RATIO_08 5144 3.29 3.71 3.12 78 TM2_M_URI_OPT_OUT 4947 2.79 3.56 2.48 79 XM_CamelCaseFrm001 4864 2.53 3.51 2.13 80 XM_SPF_SoftFail 4801 2.06 3.46 1.50 81 XMDiploma_00 4696 2.29 3.38 1.85 82 MIME_QP_LONG_LINE 4678 5.44 3.37 6.29 83 RCVD_IN_MSPIKE_WL 4627 4.91 3.33 5.56 84 RCVD_IN_MSPIKE_H3 4627 4.91 3.33 5.56 85 MIME_HTML_ONLY_MULTI 4609 2.81 3.32 2.61 86 T_XMDrugObfuBody_08 3954 1.98 2.85 1.63 87 RELAYCOUNTRY_AU 3689 1.21 2.66 0.62 88 XM_UB50 3632 1.39 2.62 0.90 89 XM_B_SpammyWords4 3478 1.21 2.51 0.68 90 XM_B_Unsub2 3443 2.12 2.48 1.98 91 XM_URI_RBL 3440 0.94 2.48 0.31 92 XM_B_URI_Unicode 3356 2.08 2.42 1.95 93 XM_OfRef6 3347 2.09 2.41 1.96 94 FROM_EXCESS_BASE64 3294 1.97 2.37 1.80 95 T_TooManySym_01 3283 4.58 2.37 5.48 96 RCVD_IN_VALIDITY_RPBL 3183 0.74 2.29 0.10 97 RCVD_IN_VALIDITY_SAFE 3133 3.30 2.26 3.73 98 T_XMDrugObfuBody_00 3077 1.19 2.22 0.76 99 SpammyFromTLD_02 2959 0.89 2.13 0.39 100 SUBJ_ALL_CAPS 2940 1.70 2.12 1.54 101 TR_XM_NoHeaderRelay 2939 0.79 2.12 0.25 102 MAILING_LIST_MULTI 2866 2.69 2.07 2.95 103 XM_B_Phish66 2826 0.93 2.04 0.48 104 SpammyFromTLD_01 2822 1.24 2.03 0.92 105 XM_DK_Undo_01 2796 1.88 2.01 1.83 106 XM_H_Long_From02 2722 1.25 1.96 0.95 107 XMBody_17 2709 0.80 1.95 0.33 108 RCVD_IN_ZEN_LASTEXTERNAL 2669 0.56 1.92 0.00 109 SHORTCIRCUIT 2669 0.56 1.92 0.00 110 RCVD_IN_VALIDITY_CERTIFIED 2553 2.53 1.84 2.82 111 T_XMHurry_00 2541 0.92 1.83 0.54 112 DIET_1 2535 0.89 1.83 0.51 113 URI_HEX 2506 1.39 1.81 1.21 114 T_REMOTE_IMAGE 2491 3.04 1.80 3.55 115 XMStockSpam_06 2459 1.04 1.77 0.74 116 XMBrknScrpt_02 2396 1.02 1.73 0.74 117 XM_SendGrid 2268 1.39 1.63 1.29 118 XM_B_SEO 2238 0.76 1.61 0.41 119 XMPhish30 2230 0.89 1.61 0.59 120 USER_IN_DEF_DKIM_WL 2191 9.02 1.58 12.05 121 ALL_TRUSTED 2177 12.59 1.57 17.08 122 HTML_MIME_NO_HTML_TAG 2115 1.95 1.52 2.12 123 XMGenDplmaNmb 2084 1.05 1.50 0.86 124 BAYES_40 2069 4.35 1.49 5.52 125 XMBody_78 2065 0.59 1.49 0.22 126 TR_MetaPhish_Combo_01 2053 1.04 1.48 0.86 127 SUSP_UTF8_WORD_SUBJ 2045 0.44 1.47 0.01 128 TR_XM_PHPForged 2033 0.68 1.47 0.35 129 HTTPS_HTTP_MISMATCH 2028 1.01 1.46 0.83 130 TR_XM_INV_DKIM 2024 0.48 1.46 0.09 131 TR_XM_PHPDW 2003 0.66 1.44 0.35 132 TR_XM_FormFill2 1989 0.67 1.43 0.36 133 TR_Symld_Words 1985 1.44 1.43 1.44 134 XM_B_COPY_HTML 1982 0.86 1.43 0.63 135 XM_H_PHPOS 1958 0.65 1.41 0.34 136 NO_DNS_FOR_FROM 1938 0.63 1.40 0.32 137 KHOP_HELO_FCRDNS 1892 1.35 1.36 1.34 138 RCVD_IN_IADB_LISTED 1889 3.18 1.36 3.93 139 LongTLD 1877 0.64 1.35 0.35 140 TR_Mismatch_TLD_02 1858 0.43 1.34 0.06 141 XMBdyGiftCard01 1841 0.82 1.33 0.61 142 XMSubMetaI_00 1837 0.66 1.32 0.39 143 T_MONEY_PERCENT 1836 0.68 1.32 0.42 144 TR_LOTS_OF_MONEY2 1836 0.68 1.32 0.42 145 DKIM_ADSP_NXDOMAIN 1771 0.56 1.28 0.27 146 T_FILL_THIS_FORM_SHORT 1739 1.06 1.25 0.97 147 TR_XM_SEO4 1724 0.53 1.24 0.25 148 DKIM_ADSP_CUSTOM_MED 1716 0.92 1.24 0.79 149 TR_XM_MaxWHORU 1684 0.54 1.21 0.27 150 RCVD_IN_IADB_SPF 1681 2.80 1.21 3.44 151 XMMoneyMeta_00 1677 0.97 1.21 0.87 152 XM_ProductURIs 1622 0.94 1.17 0.85 153 TR_XM_RelayPhish 1617 0.38 1.17 0.06 154 URI_NOVOWEL 1599 1.40 1.15 1.50 155 RCVD_IN_IADB_DK 1594 2.46 1.15 2.99 156 RCVD_IN_IADB_SENDERID 1588 2.51 1.14 3.06 157 XM_H_Undi_Recip 1570 0.45 1.13 0.17 158 XMHTML_After_End 1568 0.54 1.13 0.30 159 XM_UB99 1561 0.33 1.12 0.00 160 URI_TRY_3LD 1557 0.80 1.12 0.67 161 HTML_TAG_BALANCE_BODY 1541 0.68 1.11 0.50 162 SHOPIFY_IMG_NOT_RCVD_SFY 1507 0.47 1.09 0.22 163 XM_B_COVIDMETA 1484 0.71 1.07 0.57 164 BAYES_20 1462 2.77 1.05 3.47 165 XMReplyNow 1457 0.50 1.05 0.27 166 XMPhish14 1443 0.59 1.04 0.40 167 RELAYCOUNTRY_FR 1432 0.44 1.03 0.19 168 XMHTMLBadTable_001 1399 0.45 1.01 0.22 169 NML_ADSP_CUSTOM_MED 1395 0.66 1.01 0.52 170 MPART_ALT_DIFF_COUNT 1382 0.64 1.00 0.50 171 NORDNS_LOW_CONTRAST 1375 0.33 0.99 0.06 172 THIS_AD 1364 0.50 0.98 0.31 173 RDNS_DYNAMIC 1341 0.49 0.97 0.30 174 TooManyTo_002 1321 3.21 0.95 4.12 175 PDS_RDNS_DYNAMIC_FP 1317 0.39 0.95 0.16 176 XM_DIRTYINTL 1309 0.34 0.94 0.09 177 RCVD_IN_SORBS_DUL 1306 0.32 0.94 0.06 178 TR_XM_Base64_M1 1298 0.76 0.94 0.68 179 BOTNET_NORDNS 1291 0.28 0.93 0.01 180 TR_XM_Undi_Recip19 1282 0.32 0.92 0.07 181 T_STY_INVIS_DIRECT 1241 0.48 0.89 0.31 182 FROM_SUSPICIOUS_NTLD 1239 0.28 0.89 0.03 183 TooManyTo_003 1210 2.37 0.87 2.98 184 XM_B_REG_HTML 1201 0.46 0.87 0.29 185 RCVD_IN_XBL 1191 0.27 0.86 0.03 186 RCVD_IN_PSBL 1178 0.32 0.85 0.11 187 FORGED_GMAIL_RCVD 1174 0.57 0.85 0.46 188 FROM_SUSPICIOUS_NTLD_FP 1155 0.26 0.83 0.02 189 TR_XM_InvalidRelay 1152 0.25 0.83 0.01 190 XMSexyCombo_01 1147 0.35 0.83 0.16 191 XMPhish08 1145 0.39 0.83 0.21 192 TR_Caps_n_Bayes_99 1139 0.26 0.82 0.03 193 TooManyTo_004 1130 2.03 0.81 2.53 194 XM_B_DNDMA 1125 0.67 0.81 0.61 195 TR_Mismatch_TLD_01 1125 0.37 0.81 0.20 196 PLING_QUERY 1116 0.58 0.80 0.48 197 URIBL_BLACK 1112 0.26 0.80 0.04 198 RELAYCOUNTRY_GB 1111 0.58 0.80 0.50 199 TR_XM_DK_SendGrid 1107 0.81 0.80 0.81 200 TR_XM_Spammywords 1104 0.36 0.80 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 297435 89.61 94.94 87.43 2 RELAYCOUNTRY_US 271129 80.94 83.99 79.70 3 DKIM_SIGNED 253282 78.90 89.81 74.45 4 XM_DK_Pass 248752 76.90 86.17 73.12 5 DKIM_VALID 244688 75.67 84.86 71.93 6 XM_B_Unicode 239034 74.22 83.93 70.26 7 DCC_CHECK_NEGATIVE 211740 50.65 22.23 62.24 8 BAYES_50 207059 55.37 41.89 60.87 9 DKIM_VALID_AU 194756 59.99 66.70 57.25 10 XM_B_SpammyWords 156034 52.48 68.70 45.87 11 XMListUnsubscribeExists 155409 52.73 69.99 45.68 12 XM_B_Unicode3 130218 41.49 49.37 38.28 13 DCC_CHECK 128305 48.75 75.81 37.72 14 RCVD_IN_MSPIKE_H2 113628 34.56 37.40 33.40 15 T_TM2_M_HEADER_IN_MSG 106683 28.88 22.79 31.36 16 DKIM_VALID_EF 100399 28.96 27.61 29.51 17 HTML_FONT_LOW_CONTRAST 86906 29.55 39.36 25.55 18 LOC_TINY_FONT_1 82446 31.73 50.11 24.24 19 FVGT_m_MULTI_ODD 77148 26.11 34.54 22.68 20 XMSubLong 76007 23.03 24.72 22.34 21 XM_B_SpammyWords2 68331 25.90 40.15 20.09 22 T_KAM_HTML_FONT_INVALID 66380 23.03 31.66 19.51 23 MIME_HTML_ONLY 63005 20.87 26.63 18.52 24 ALL_TRUSTED 58116 12.59 1.57 17.08 25 XM_Multi_Part_URI 46153 16.32 23.08 13.57 26 USER_IN_DEF_DKIM_WL 40993 9.02 1.58 12.05 27 UNPARSEABLE_RELAY 40984 13.75 17.91 12.05 28 TR_XM_DK_Unsub 38860 13.62 19.01 11.42 29 BAYES_00 38042 8.17 0.79 11.18 30 TooManyTo_001 34437 8.48 4.46 10.12 31 XM_B_PhoneNumber 33982 9.05 6.76 9.99 32 XM_B_Unsub 32881 11.80 17.04 9.67 33 XM_Evil_Numbers_Gen 28731 8.85 9.83 8.45 34 LotsOfNums_01 28645 8.67 9.27 8.42 35 BAYES_60 27700 8.02 7.70 8.14 36 TR_XM_BayesUnsub 25813 10.13 16.37 7.59 37 XM_DKIMWhitelistDomains 25656 5.43 0.27 7.54 38 TR_XM_DK_Bayes 23961 5.15 0.50 7.04 39 IN_ZIMBRA_NJ_WHITELIST 23727 4.97 0.06 6.97 40 FSL_BULK_SIG 23648 7.52 8.91 6.95 41 LOTS_OF_MONEY 23509 8.38 11.99 6.91 42 TR_XM_DK_Bayes1 23264 5.00 0.49 6.84 43 MIME_QP_LONG_LINE 21399 5.44 3.37 6.29 44 TR_XM_DK_Bayes2 20527 4.39 0.37 6.03 45 TR_MAX_INTL_RELAY 19350 8.22 14.41 5.69 46 RCVD_IN_MSPIKE_WL 18909 4.91 3.33 5.56 47 RCVD_IN_MSPIKE_H3 18909 4.91 3.33 5.56 48 BAYES_40 18769 4.35 1.49 5.52 49 T_TooManySym_01 18658 4.58 2.37 5.48 50 XM_H_GMP 17908 5.25 5.21 5.26 51 XM_DK_Undo_02 17792 14.92 38.68 5.23 52 XM_H_Long_From01 16870 5.16 5.65 4.96 53 XM_B_Phish_Phrases 16744 5.90 8.30 4.92 54 XMSubMetaSx_00 16591 5.12 5.71 4.88 55 TR_XM_SpammyWords4 16362 6.53 10.73 4.81 56 XM_PDF 15208 3.37 0.68 4.47 57 XMStrtUSub 14963 4.44 4.56 4.40 58 HTML_IMAGE_RATIO_02 14467 5.23 7.62 4.25 59 XM_B_SpammyWords3 14401 7.36 15.02 4.23 60 MPART_ALT_DIFF 14183 4.61 5.68 4.17 61 TooManyTo_002 14030 3.21 0.95 4.12 62 RELAYCOUNTRY_META 13469 6.97 14.36 3.96 63 RCVD_IN_IADB_LISTED 13363 3.18 1.36 3.93 64 XM_UncommonTLD01 13206 4.60 6.35 3.88 65 RCVD_IN_VALIDITY_SAFE 12682 3.30 2.26 3.73 66 BOTNET_IPINHOSTNAME 12182 6.10 12.29 3.58 67 BAYES_80 12113 5.07 8.78 3.56 68 HTML_IMAGE_RATIO_04 12081 3.82 4.48 3.55 69 T_REMOTE_IMAGE 12076 3.04 1.80 3.55 70 ANY_BOUNCE_MESSAGE 11860 2.69 0.72 3.49 71 BOUNCE_MESSAGE 11856 2.69 0.72 3.49 72 BAYES_20 11801 2.77 1.05 3.47 73 RCVD_IN_IADB_SPF 11716 2.80 1.21 3.44 74 BAYES_99 10714 11.09 30.54 3.15 75 HTML_IMAGE_RATIO_06 10639 3.34 3.87 3.13 76 HTML_IMAGE_RATIO_08 10621 3.29 3.71 3.12 77 RCVD_IN_IADB_SENDERID 10425 2.51 1.14 3.06 78 RCVD_IN_IADB_DK 10184 2.46 1.15 2.99 79 TooManyTo_003 10136 2.37 0.87 2.98 80 MAILING_LIST_MULTI 10040 2.69 2.07 2.95 81 T_TooManySym_02 9754 2.24 0.70 2.87 82 RCVD_IN_VALIDITY_CERTIFIED 9587 2.53 1.84 2.82 83 XMNumbers 9191 3.03 3.83 2.70 84 RCVD_IN_IADB_VOUCHED 8895 2.04 0.63 2.61 85 MIME_HTML_ONLY_MULTI 8866 2.81 3.32 2.61 86 DKIM_INVALID 8594 3.23 4.95 2.53 87 TooManyTo_004 8590 2.03 0.81 2.53 88 TM2_M_URI_OPT_OUT 8421 2.79 3.56 2.48 89 TR_XM_DKIM_Undo 8191 9.42 26.61 2.41 90 BAYES_999 7856 8.50 23.68 2.31 91 TooManyTo_005 7851 1.86 0.77 2.31 92 XM_B_SpammyTLD 7372 2.74 4.14 2.17 93 INVALID_MSGID 7309 1.58 0.20 2.15 94 MIME_HTML_MOSTLY 7294 2.64 3.87 2.14 95 XM_CamelCaseFrm001 7233 2.53 3.51 2.13 96 BAYES_95 7230 3.02 5.20 2.13 97 HTML_MIME_NO_HTML_TAG 7204 1.95 1.52 2.12 98 XM_Body_Dirty_Words 6970 3.61 7.44 2.05 99 BAYES_05 6763 1.59 0.63 1.99 100 TR_XM_SpammyRelay 6758 4.55 10.85 1.99 101 XM_B_Unsub2 6729 2.12 2.48 1.98 102 XM_OfRef6 6669 2.09 2.41 1.96 103 XM_B_URI_Unicode 6629 2.08 2.42 1.95 104 TO_MALFORMED 6522 1.36 0.01 1.92 105 BOTNET 6508 3.80 8.43 1.91 106 XMDiploma_00 6279 2.29 3.38 1.85 107 XM_DK_Undo_01 6223 1.88 2.01 1.83 108 FROM_EXCESS_BASE64 6121 1.97 2.37 1.80 109 TR_XM_PhishingBody 6026 2.88 5.60 1.77 110 RCVD_IN_IADB_OPTIN 5946 1.36 0.42 1.75 111 XMSubMetaSxObfu_03 5791 1.41 0.68 1.70 112 XM_B_Investor 5640 2.90 5.95 1.66 113 T_XMDrugObfuBody_08 5541 1.98 2.85 1.63 114 T_XMDrugObfuBody_14 5500 2.52 4.75 1.62 115 FROM_GOV_DKIM_AU 5316 1.19 0.29 1.56 116 FILL_THIS_FORM 5286 1.23 0.44 1.55 117 TR_XM_UnparsRelay 5246 3.75 9.16 1.54 118 SUBJ_ALL_CAPS 5223 1.70 2.12 1.54 119 URI_NOVOWEL 5091 1.40 1.15 1.50 120 XM_SPF_SoftFail 5086 2.06 3.46 1.50 121 TM2_M_VERY_LONG_WORD 5037 2.21 3.99 1.48 122 TR_XM_SpammyWords5 4999 2.25 4.18 1.47 123 UNTRUSTED_Relay 4953 2.67 5.66 1.46 124 TR_Symld_Words 4891 1.44 1.43 1.44 125 IN_HORDE_ADDRESS_BOOK 4668 1.00 0.10 1.37 126 KHOP_HELO_FCRDNS 4574 1.35 1.36 1.34 127 XM_SendGrid 4403 1.39 1.63 1.29 128 XMCapTrack 4347 1.07 0.55 1.28 129 XMGappySubj_01 4262 0.94 0.16 1.25 130 HELO_NODOT 4185 0.94 0.22 1.23 131 HELO_NO_DOMAIN 4182 0.94 0.22 1.23 132 XM_GoogleGroups 4157 1.08 0.73 1.22 133 RELAYCOUNTRY_CA 4154 2.37 5.19 1.22 134 URI_HEX 4133 1.39 1.81 1.21 135 T_FILL_THIS_FORM_LOAN 4082 0.93 0.28 1.20 136 TR_DCC_Bayes_99 4075 7.42 22.68 1.20 137 TVD_SPACE_RATIO 3860 0.86 0.19 1.13 138 T_TooManySym_03 3427 0.78 0.24 1.01 139 T_FILL_THIS_FORM_SHORT 3315 1.06 1.25 0.97 140 XM_H_Long_From02 3246 1.25 1.96 0.95 141 XMSexyCombo_05 3150 1.75 3.77 0.93 142 XMNoVowels 3149 0.86 0.71 0.93 143 SpammyFromTLD_01 3131 1.24 2.03 0.92 144 XM_UB50 3048 1.39 2.62 0.90 145 XM_H_Trusted_IP 3003 0.63 0.00 0.88 146 XMMoneyMeta_00 2964 0.97 1.21 0.87 147 TR_MetaPhish_Combo_01 2926 1.04 1.48 0.86 148 XMGenDplmaNmb 2924 1.05 1.50 0.86 149 XM_ProductURIs 2888 0.94 1.17 0.85 150 HTML_IMAGE_ONLY_32 2833 0.66 0.24 0.83 151 HTTPS_HTTP_MISMATCH 2814 1.01 1.46 0.83 152 TR_XM_DK_SendGrid 2761 0.81 0.80 0.81 153 DKIM_ADSP_CUSTOM_MED 2700 0.92 1.24 0.79 154 T_XMDrugObfuBody_00 2601 1.19 2.22 0.76 155 XM_ShortIntro_01 2584 0.68 0.49 0.76 156 XMBrknScrpt_02 2511 1.02 1.73 0.74 157 RCVD_IN_PBL 2504 0.73 0.73 0.74 158 XMStockSpam_06 2502 1.04 1.77 0.74 159 XMGappySubj_02 2429 0.53 0.07 0.71 160 RCVD_IN_BL_SPAMCOP_NET 2403 2.54 7.02 0.71 161 TR_XM_Base64_M1 2325 0.76 0.94 0.68 162 XM_B_SpammyWords4 2304 1.21 2.51 0.68 163 URI_TRY_3LD 2269 0.80 1.12 0.67 164 XMBody_95 2171 0.51 0.21 0.64 165 XM_B_COPY_HTML 2157 0.86 1.43 0.63 166 XMSubNoVowel 2154 0.66 0.73 0.63 167 T_OBFU_PDF_ATTACH 2138 0.49 0.14 0.63 168 RELAYCOUNTRY_AU 2120 1.21 2.66 0.62 169 XMBdyGiftCard01 2084 0.82 1.33 0.61 170 XM_B_DNDMA 2080 0.67 0.81 0.61 171 XMSlimDrugH 2060 0.65 0.75 0.61 172 XMLngstWrd_00 2026 0.59 0.58 0.60 173 XMPhish30 2022 0.89 1.61 0.59 174 XM_B_FormFill 1933 0.42 0.04 0.57 175 XM_B_COVIDMETA 1931 0.71 1.07 0.57 176 T_Symld_Words_02 1893 0.62 0.77 0.56 177 XM_H_PHPMailer 1861 0.58 0.66 0.55 178 T_XMHurry_00 1852 0.92 1.83 0.54 179 TVD_RCVD_IP 1782 0.60 0.78 0.52 180 NML_ADSP_CUSTOM_MED 1776 0.66 1.01 0.52 181 DIET_1 1735 0.89 1.83 0.51 182 MPART_ALT_DIFF_COUNT 1706 0.64 1.00 0.50 183 HTML_TAG_BALANCE_BODY 1692 0.68 1.11 0.50 184 RELAYCOUNTRY_GB 1688 0.58 0.80 0.50 185 PLING_QUERY 1643 0.58 0.80 0.48 186 XM_B_Phish66 1635 0.93 2.04 0.48 187 HTML_IMAGE_ONLY_28 1609 0.42 0.29 0.47 188 FORGED_GMAIL_RCVD 1558 0.57 0.85 0.46 189 XMDateMe_00 1478 0.48 0.59 0.43 190 XMSolicitRefs_0 1439 0.43 0.46 0.42 191 T_MONEY_PERCENT 1430 0.68 1.32 0.42 192 TR_LOTS_OF_MONEY2 1430 0.68 1.32 0.42 193 TM2_M_OBFU_COMMENT 1411 0.50 0.72 0.41 194 HTML_FONT_FACE_BAD 1411 0.42 0.44 0.41 195 XM_B_SEO 1405 0.76 1.61 0.41 196 XMLngstWrd_01 1393 0.43 0.48 0.41 197 MSGID_FROM_MTA_HEADER 1382 0.31 0.09 0.41 198 XMPhish14 1373 0.59 1.04 0.40 199 MISSING_HEADERS 1335 0.48 0.70 0.39 200 XMSubMetaI_00 1326 0.66 1.32 0.39 ----------------------------------------------------------------------