Email: 495289 Autolearn: 0 AvgScore: 2.47 AvgScanTime: 1.44 sec Spam: 138032 Autolearn: 0 AvgScore: 14.85 AvgScanTime: 1.64 sec Ham: 357257 Autolearn: 0 AvgScore: -2.31 AvgScanTime: 1.36 sec Time Spent Running SA: 198.10 hours Time Spent Processing Spam: 62.82 hours Time Spent Processing Ham: 135.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130459 90.16 94.51 88.48 2 DKIM_SIGNED 122231 72.61 88.55 66.45 3 XM_DK_Pass 117179 70.64 84.89 65.14 4 DKIM_VALID 115185 69.54 83.45 64.17 5 RELAYCOUNTRY_US 115046 83.28 83.35 83.25 6 XM_B_Unicode 113255 74.65 82.05 71.80 7 DCC_CHECK 103078 45.35 74.68 34.02 8 XMListUnsubscribeExists 96052 48.83 69.59 40.81 9 XM_B_SpammyWords 95474 49.80 69.17 42.31 10 DKIM_VALID_AU 92022 55.53 66.67 51.22 11 XM_B_Unicode3 67461 44.05 48.87 42.18 12 LOC_TINY_FONT_1 67006 28.61 48.54 20.90 13 XM_B_SpammyWords2 56809 23.26 41.16 16.34 14 BAYES_50 56039 52.14 40.60 56.60 15 XM_DK_Undo_02 53724 13.77 38.92 4.06 16 RCVD_IN_MSPIKE_H2 51570 32.40 37.36 30.48 17 HTML_FONT_LOW_CONTRAST 50576 26.42 36.64 22.48 18 FVGT_m_MULTI_ODD 46055 24.13 33.37 20.56 19 T_KAM_HTML_FONT_INVALID 42834 21.24 31.03 17.46 20 BAYES_99 42583 10.58 30.85 2.75 21 TR_XM_DKIM_Undo 37331 8.57 27.05 1.43 22 DKIM_VALID_EF 36265 26.80 26.27 27.01 23 XMSubLong 35796 24.07 25.93 23.35 24 MIME_HTML_ONLY 35762 23.42 25.91 22.45 25 BAYES_999 32575 7.98 23.60 1.95 26 DCC_CHECK_NEGATIVE 32169 54.05 23.31 65.93 27 T_TM2_M_HEADER_IN_MSG 31757 25.99 23.01 27.14 28 TR_DCC_Bayes_99 30860 6.84 22.36 0.84 29 XM_Multi_Part_URI 30824 14.36 22.33 11.28 30 TR_XM_DK_Unsub 24564 12.87 17.80 10.96 31 XM_B_Unsub 22900 10.24 16.59 7.79 32 UNPARSEABLE_RELAY 22421 12.06 16.24 10.44 33 XM_B_SpammyWords3 21501 7.11 15.58 3.84 34 TR_XM_BayesUnsub 21482 8.67 15.56 6.01 35 RELAYCOUNTRY_META 20866 6.64 15.12 3.36 36 TR_MAX_INTL_RELAY 20124 7.75 14.58 5.11 37 LOTS_OF_MONEY 17006 7.24 12.32 5.28 38 BOTNET_IPINHOSTNAME 15843 5.38 11.48 3.03 39 TR_XM_SpammyWords4 15118 5.59 10.95 3.52 40 TR_XM_SpammyRelay 15071 4.22 10.92 1.63 41 TR_XM_SpammyWords2 14907 3.24 10.80 0.32 42 XM_Evil_Numbers_Gen 12919 9.31 9.36 9.29 43 BAYES_80 12390 4.78 8.98 3.16 44 XM_Body_Dirty_Words 12325 4.04 8.93 2.15 45 LotsOfNums_01 12239 7.77 8.87 7.34 46 BOTNET 11855 3.50 8.59 1.53 47 FSL_BULK_SIG 11673 7.42 8.46 7.02 48 TR_XM_UnparsRelay 11141 3.16 8.07 1.27 49 BAYES_60 10730 7.62 7.77 7.57 50 RCVD_IN_BL_SPAMCOP_NET 10472 2.46 7.59 0.48 51 XM_B_Phish_Phrases 10450 5.62 7.57 4.87 52 XMSubMetaSx_00 9956 5.50 7.21 4.84 53 XM_UncommonTLD01 9569 4.68 6.93 3.81 54 UNTRUSTED_Relay 8477 2.63 6.14 1.28 55 MPART_ALT_DIFF 8194 8.39 5.94 9.33 56 TR_XM_SPAMCOP 8180 1.85 5.93 0.28 57 XM_B_PhoneNumber 8007 7.71 5.80 8.45 58 HTML_IMAGE_RATIO_02 7844 4.45 5.68 3.97 59 XM_B_Investor 7792 2.64 5.65 1.48 60 XM_H_Long_From01 7754 4.94 5.62 4.67 61 TR_XM_PhishingBody 7674 2.63 5.56 1.50 62 RELAYCOUNTRY_CA 7142 2.14 5.17 0.97 63 XM_H_GMP 7095 4.96 5.14 4.89 64 BAYES_95 7067 2.83 5.12 1.95 65 DKIM_INVALID 7046 3.07 5.10 2.28 66 TooManyTo_001 6491 8.07 4.70 9.37 67 T_XMDrugObfuBody_14 6388 2.38 4.63 1.51 68 XMSexyCombo_05 6074 2.21 4.40 1.36 69 XM_B_SpammyTLD 5932 2.88 4.30 2.34 70 HTML_IMAGE_RATIO_04 5892 11.57 4.27 14.39 71 TM2_M_VERY_LONG_WORD 5504 2.08 3.99 1.35 72 TR_XM_SpammyWords5 5337 1.92 3.87 1.17 73 HTML_IMAGE_RATIO_06 5109 4.15 3.70 4.33 74 XM_SPF_SoftFail 5025 1.96 3.64 1.31 75 XMNumbers 5002 2.85 3.62 2.56 76 XMStrtUSub 4681 8.70 3.39 10.75 77 XMDiploma_00 4676 1.96 3.39 1.40 78 MIME_HTML_ONLY_MULTI 4613 6.59 3.34 7.84 79 MIME_HTML_MOSTLY 4580 2.56 3.32 2.26 80 XM_CamelCaseFrm001 4515 2.29 3.27 1.92 81 MIME_QP_LONG_LINE 4506 4.85 3.26 5.47 82 XM_B_URI_Unicode 4457 2.25 3.23 1.87 83 XM_OfRef6 4320 2.49 3.13 2.24 84 RCVD_IN_MSPIKE_H3 4136 4.53 3.00 5.13 85 RCVD_IN_MSPIKE_WL 4135 4.53 3.00 5.13 86 XM_B_Unsub2 4032 1.87 2.92 1.47 87 XM_B_SpammyWords4 3952 1.15 2.86 0.49 88 XMBody_17 3794 1.02 2.75 0.35 89 XM_UB50 3772 1.31 2.73 0.77 90 T_XMDrugObfuBody_08 3731 1.60 2.70 1.17 91 HTML_IMAGE_RATIO_08 3724 2.15 2.70 1.93 92 RELAYCOUNTRY_AU 3624 1.13 2.63 0.55 93 TR_XM_NoHeaderRelay 3560 0.89 2.58 0.24 94 T_XMDrugObfuBody_00 3499 1.22 2.53 0.72 95 XM_URI_RBL 3497 0.96 2.53 0.35 96 TM2_M_URI_OPT_OUT 3454 2.42 2.50 2.39 97 SpammyFromTLD_01 3449 1.34 2.50 0.89 98 XMPhish30 3434 0.99 2.49 0.42 99 RCVD_IN_VALIDITY_RPBL 3326 0.73 2.41 0.08 100 T_XMHurry_00 3289 0.97 2.38 0.42 101 MAILING_LIST_MULTI 3274 2.82 2.37 3.00 102 XMGenDplmaNmb 3191 1.22 2.31 0.80 103 T_TooManySym_01 3102 4.40 2.25 5.24 104 RCVD_IN_VALIDITY_SAFE 3045 3.32 2.21 3.75 105 FROM_EXCESS_BASE64 2849 1.57 2.06 1.38 106 SpammyFromTLD_02 2831 0.92 2.05 0.48 107 XMStockSpam_06 2738 1.39 1.98 1.15 108 RCVD_IN_ZEN_LASTEXTERNAL 2737 0.55 1.98 0.00 109 SHORTCIRCUIT 2737 0.55 1.98 0.00 110 RCVD_IN_VALIDITY_CERTIFIED 2636 2.88 1.91 3.26 111 HTML_MIME_NO_HTML_TAG 2538 2.09 1.84 2.19 112 USER_IN_DEF_DKIM_WL 2508 8.64 1.82 11.28 113 SUBJ_ALL_CAPS 2498 1.35 1.81 1.17 114 SUSP_UTF8_WORD_SUBJ 2446 0.50 1.77 0.01 115 BAYES_40 2413 4.43 1.75 5.46 116 XM_B_SEO 2405 0.66 1.74 0.24 117 DIET_1 2366 0.76 1.71 0.39 118 ALL_TRUSTED 2346 10.62 1.70 14.07 119 XM_DK_Undo_01 2277 1.52 1.65 1.47 120 TR_XM_PHPForged 2199 0.74 1.59 0.41 121 TR_XM_PHPDW 2161 0.73 1.57 0.41 122 TR_Mismatch_TLD_02 2154 0.51 1.56 0.10 123 TR_XM_FormFill2 2140 0.73 1.55 0.42 124 XM_H_PHPOS 2111 0.72 1.53 0.40 125 TR_XM_INV_DKIM 2093 0.47 1.52 0.07 126 XMBrknScrpt_02 2060 1.20 1.49 1.08 127 XMBody_78 2022 0.62 1.46 0.30 128 RELAYCOUNTRY_FR 2020 0.58 1.46 0.24 129 NO_DNS_FOR_FROM 2001 0.61 1.45 0.28 130 URI_HEX 1987 1.14 1.44 1.03 131 TR_XM_MaxWHORU 1982 0.57 1.44 0.23 132 LongTLD 1958 0.63 1.42 0.32 133 XM_B_COPY_HTML 1938 0.90 1.40 0.70 134 TR_XM_SEO4 1930 0.47 1.40 0.12 135 DKIM_ADSP_NXDOMAIN 1867 0.56 1.35 0.26 136 BAYES_20 1821 3.12 1.32 3.81 137 XM_UB99 1786 0.36 1.29 0.00 138 TR_XM_InvalidRelay 1765 0.38 1.28 0.04 139 RCVD_IN_IADB_LISTED 1762 2.85 1.28 3.46 140 XMBdyGiftCard01 1743 0.77 1.26 0.58 141 T_REMOTE_IMAGE 1725 2.86 1.25 3.48 142 HTTPS_HTTP_MISMATCH 1703 1.14 1.23 1.11 143 XM_B_REG_HTML 1684 0.44 1.22 0.14 144 XM_ProductURIs 1681 0.59 1.22 0.34 145 XM_H_Long_From02 1659 0.99 1.20 0.91 146 XM_SendGrid 1634 1.16 1.18 1.15 147 KHOP_HELO_FCRDNS 1623 1.24 1.18 1.27 148 T_MONEY_PERCENT 1611 0.41 1.17 0.12 149 TR_LOTS_OF_MONEY2 1611 0.41 1.17 0.12 150 DKIM_ADSP_CUSTOM_MED 1609 0.87 1.17 0.75 151 THIS_AD 1568 0.55 1.14 0.33 152 TR_Symld_Words 1557 1.35 1.13 1.44 153 HTML_TAG_BALANCE_BODY 1555 0.63 1.13 0.44 154 RCVD_IN_IADB_SPF 1551 2.51 1.12 3.05 155 XMHTML_After_End 1533 0.54 1.11 0.32 156 XM_B_DNDMA 1512 0.64 1.10 0.47 157 XMReplyNow 1507 0.47 1.09 0.23 158 RCVD_IN_IADB_SENDERID 1490 2.27 1.08 2.74 159 RCVD_IN_IADB_DK 1480 2.21 1.07 2.65 160 URI_NOVOWEL 1470 1.12 1.06 1.14 161 T_FILL_THIS_FORM_SHORT 1464 0.90 1.06 0.84 162 XMPhish14 1444 0.66 1.05 0.51 163 NORDNS_LOW_CONTRAST 1423 0.31 1.03 0.03 164 XM_S_SpammyWords 1415 0.43 1.03 0.20 165 TR_XM_Spammywords 1415 0.43 1.03 0.20 166 TooManyTo_002 1414 3.07 1.02 3.86 167 TM2_M_OBFU_COMMENT 1414 0.64 1.02 0.49 168 XM_ShortIntro_01 1376 0.80 1.00 0.72 169 XM_B_Phish66 1371 0.47 0.99 0.26 170 HTML_IMAGE_ONLY_20 1369 0.56 0.99 0.39 171 SHOPIFY_IMG_NOT_RCVD_SFY 1359 0.40 0.98 0.18 172 XMMoneyMeta_00 1351 0.62 0.98 0.48 173 FROM_SUSPICIOUS_NTLD 1327 0.30 0.96 0.04 174 MISSING_HEADERS 1319 0.60 0.96 0.47 175 TooManyTo_003 1313 2.33 0.95 2.86 176 XMSubNoVowel 1308 3.55 0.95 4.56 177 XM_H_Undi_Recip 1287 0.39 0.93 0.18 178 TR_LOTS_OF_MONEY3 1287 0.36 0.93 0.13 179 MPART_ALT_DIFF_COUNT 1275 0.67 0.92 0.58 180 RDNS_DYNAMIC 1271 0.54 0.92 0.40 181 T_STY_INVIS_DIRECT 1268 0.46 0.92 0.28 182 XM_B_COVIDMETA 1256 0.43 0.91 0.24 183 PDS_RDNS_DYNAMIC_FP 1246 0.44 0.90 0.26 184 TooManyTo_004 1242 2.05 0.90 2.50 185 FROM_SUSPICIOUS_NTLD_FP 1241 0.27 0.90 0.02 186 RCVD_IN_SORBS_DUL 1223 0.31 0.89 0.08 187 XMSubMetaI_00 1218 0.60 0.88 0.48 188 T_Symld_Words_02 1215 0.68 0.88 0.60 189 NML_ADSP_CUSTOM_MED 1211 0.61 0.88 0.51 190 BOTNET_NORDNS 1209 0.25 0.88 0.01 191 ANY_BOUNCE_MESSAGE 1192 2.64 0.86 3.33 192 BOUNCE_MESSAGE 1192 2.64 0.86 3.33 193 RCVD_IN_PBL 1185 0.70 0.86 0.64 194 RCVD_IN_XBL 1180 0.26 0.85 0.03 195 TooManyTo_005 1165 1.89 0.84 2.29 196 XM_UB999 1164 0.24 0.84 0.00 197 XMSexyCombo_01 1161 0.31 0.84 0.11 198 BAYES_05 1145 2.52 0.83 3.18 199 URI_TRY_3LD 1138 0.69 0.82 0.64 200 TR_XM_Base64_M1 1121 0.59 0.81 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316104 90.16 94.51 88.48 2 RELAYCOUNTRY_US 297426 83.28 83.35 83.25 3 XM_B_Unicode 256497 74.65 82.05 71.80 4 DKIM_SIGNED 237383 72.61 88.55 66.45 5 DCC_CHECK_NEGATIVE 235539 54.05 23.31 65.93 6 XM_DK_Pass 232710 70.64 84.89 65.14 7 DKIM_VALID 229235 69.54 83.45 64.17 8 BAYES_50 202191 52.14 40.60 56.60 9 DKIM_VALID_AU 182996 55.53 66.67 51.22 10 XM_B_SpammyWords 151156 49.80 69.17 42.31 11 XM_B_Unicode3 150707 44.05 48.87 42.18 12 XMListUnsubscribeExists 145795 48.83 69.59 40.81 13 DCC_CHECK 121547 45.35 74.68 34.02 14 RCVD_IN_MSPIKE_H2 108893 32.40 37.36 30.48 15 T_TM2_M_HEADER_IN_MSG 96974 25.99 23.01 27.14 16 DKIM_VALID_EF 96488 26.80 26.27 27.01 17 XMSubLong 83427 24.07 25.93 23.35 18 HTML_FONT_LOW_CONTRAST 80302 26.42 36.64 22.48 19 MIME_HTML_ONLY 80220 23.42 25.91 22.45 20 LOC_TINY_FONT_1 74678 28.61 48.54 20.90 21 FVGT_m_MULTI_ODD 73451 24.13 33.37 20.56 22 T_KAM_HTML_FONT_INVALID 62373 21.24 31.03 17.46 23 XM_B_SpammyWords2 58373 23.26 41.16 16.34 24 BAYES_00 55513 11.43 0.80 15.54 25 HTML_IMAGE_RATIO_04 51413 11.57 4.27 14.39 26 ALL_TRUSTED 50255 10.62 1.70 14.07 27 HTML_FONT_FACE_BAD 47456 9.72 0.50 13.28 28 XM_H_Trusted_IP 45253 9.14 0.00 12.67 29 USER_IN_DEF_DKIM_WL 40294 8.64 1.82 11.28 30 XM_Multi_Part_URI 40284 14.36 22.33 11.28 31 TR_XM_DK_Unsub 39172 12.87 17.80 10.96 32 XMStrtUSub 38416 8.70 3.39 10.75 33 UNPARSEABLE_RELAY 37303 12.06 16.24 10.44 34 TooManyTo_001 33475 8.07 4.70 9.37 35 MPART_ALT_DIFF 33346 8.39 5.94 9.33 36 XM_Evil_Numbers_Gen 33183 9.31 9.36 9.29 37 XM_B_PhoneNumber 30175 7.71 5.80 8.45 38 MIME_HTML_ONLY_MULTI 28026 6.59 3.34 7.84 39 XM_B_Unsub 27839 10.24 16.59 7.79 40 BAYES_60 27032 7.62 7.77 7.57 41 LotsOfNums_01 26228 7.77 8.87 7.34 42 FSL_BULK_SIG 25080 7.42 8.46 7.02 43 IN_ZIMBRA_NJ_WHITELIST 24280 4.93 0.08 6.80 44 XM_DKIMWhitelistDomains 22350 4.53 0.08 6.26 45 TR_XM_DK_Bayes 22143 4.65 0.65 6.20 46 TR_XM_DK_Bayes1 21888 4.60 0.64 6.13 47 TR_XM_BayesUnsub 21466 8.67 15.56 6.01 48 MIME_QP_LONG_LINE 19537 4.85 3.26 5.47 49 BAYES_40 19504 4.43 1.75 5.46 50 LOTS_OF_MONEY 18864 7.24 12.32 5.28 51 TR_XM_DK_Bayes2 18788 3.93 0.49 5.26 52 T_TooManySym_01 18703 4.40 2.25 5.24 53 RCVD_IN_MSPIKE_H3 18310 4.53 3.00 5.13 54 RCVD_IN_MSPIKE_WL 18310 4.53 3.00 5.13 55 TR_MAX_INTL_RELAY 18255 7.75 14.58 5.11 56 XM_H_GMP 17475 4.96 5.14 4.89 57 XM_B_Phish_Phrases 17383 5.62 7.57 4.87 58 XMSubMetaSx_00 17284 5.50 7.21 4.84 59 XM_H_Long_From01 16692 4.94 5.62 4.67 60 XMSubNoVowel 16284 3.55 0.95 4.56 61 HTML_IMAGE_RATIO_06 15459 4.15 3.70 4.33 62 XM_DK_Undo_02 14496 13.77 38.92 4.06 63 XM_PDF 14357 3.08 0.67 4.02 64 HTML_IMAGE_RATIO_02 14172 4.45 5.68 3.97 65 TooManyTo_002 13784 3.07 1.02 3.86 66 XM_B_SpammyWords3 13711 7.11 15.58 3.84 67 XM_UncommonTLD01 13627 4.68 6.93 3.81 68 BAYES_20 13608 3.12 1.32 3.81 69 RCVD_IN_VALIDITY_SAFE 13389 3.32 2.21 3.75 70 TR_XM_SpammyWords4 12592 5.59 10.95 3.52 71 T_REMOTE_IMAGE 12433 2.86 1.25 3.48 72 RCVD_IN_IADB_LISTED 12371 2.85 1.28 3.46 73 RELAYCOUNTRY_META 12017 6.64 15.12 3.36 74 BOUNCE_MESSAGE 11901 2.64 0.86 3.33 75 ANY_BOUNCE_MESSAGE 11901 2.64 0.86 3.33 76 RCVD_IN_VALIDITY_CERTIFIED 11629 2.88 1.91 3.26 77 BAYES_05 11347 2.52 0.83 3.18 78 BAYES_80 11276 4.78 8.98 3.16 79 RCVD_IN_IADB_SPF 10893 2.51 1.12 3.05 80 BOTNET_IPINHOSTNAME 10814 5.38 11.48 3.03 81 MAILING_LIST_MULTI 10716 2.82 2.37 3.00 82 TooManyTo_003 10235 2.33 0.95 2.86 83 BAYES_99 9814 10.58 30.85 2.75 84 RCVD_IN_IADB_SENDERID 9772 2.27 1.08 2.74 85 RCVD_IN_IADB_DK 9483 2.21 1.07 2.65 86 XMNumbers 9132 2.85 3.62 2.56 87 T_TooManySym_02 9039 2.03 0.74 2.53 88 TooManyTo_004 8930 2.05 0.90 2.50 89 TM2_M_URI_OPT_OUT 8535 2.42 2.50 2.39 90 XM_B_SpammyTLD 8348 2.88 4.30 2.34 91 TooManyTo_005 8196 1.89 0.84 2.29 92 DKIM_INVALID 8148 3.07 5.10 2.28 93 XMSubLongNoVowel 8148 1.84 0.70 2.28 94 MIME_HTML_MOSTLY 8081 2.56 3.32 2.26 95 XM_OfRef6 7993 2.49 3.13 2.24 96 XMSubGarbage 7955 1.65 0.17 2.23 97 RCVD_IN_IADB_VOUCHED 7955 1.77 0.60 2.23 98 HTML_MIME_NO_HTML_TAG 7808 2.09 1.84 2.19 99 XM_Body_Dirty_Words 7664 4.04 8.93 2.15 100 INVALID_MSGID 7359 1.56 0.25 2.06 101 BAYES_95 6971 2.83 5.12 1.95 102 BAYES_999 6963 7.98 23.60 1.95 103 HTML_IMAGE_RATIO_08 6908 2.15 2.70 1.93 104 XM_CamelCaseFrm001 6843 2.29 3.27 1.92 105 XM_B_URI_Unicode 6693 2.25 3.23 1.87 106 TO_MALFORMED 6499 1.31 0.01 1.82 107 TR_XM_SpammyRelay 5814 4.22 10.92 1.63 108 RCVD_IN_IADB_OPTIN 5569 1.23 0.39 1.56 109 XMSubMetaSxObfu_03 5477 1.32 0.78 1.53 110 BOTNET 5471 3.50 8.59 1.53 111 FILL_THIS_FORM 5428 1.16 0.25 1.52 112 T_XMDrugObfuBody_14 5397 2.38 4.63 1.51 113 TR_XM_PhishingBody 5347 2.63 5.56 1.50 114 XM_B_Investor 5288 2.64 5.65 1.48 115 XM_DK_Undo_01 5257 1.52 1.65 1.47 116 XM_B_Unsub2 5253 1.87 2.92 1.47 117 TR_Symld_Words 5145 1.35 1.13 1.44 118 TR_XM_DKIM_Undo 5106 8.57 27.05 1.43 119 XMDiploma_00 5012 1.96 3.39 1.40 120 FROM_EXCESS_BASE64 4914 1.57 2.06 1.38 121 XMSexyCombo_05 4874 2.21 4.40 1.36 122 TM2_M_VERY_LONG_WORD 4807 2.08 3.99 1.35 123 XM_SPF_SoftFail 4674 1.96 3.64 1.31 124 IN_HORDE_ADDRESS_BOOK 4645 0.97 0.11 1.30 125 UNTRUSTED_Relay 4559 2.63 6.14 1.28 126 TR_XM_UnparsRelay 4523 3.16 8.07 1.27 127 KHOP_HELO_FCRDNS 4521 1.24 1.18 1.27 128 T_FILL_THIS_FORM_LOAN 4368 0.89 0.04 1.22 129 HELO_NODOT 4326 0.98 0.37 1.21 130 HELO_NO_DOMAIN 4322 0.97 0.37 1.21 131 XMCapTrack 4298 1.02 0.56 1.20 132 SUBJ_ALL_CAPS 4185 1.35 1.81 1.17 133 T_XMDrugObfuBody_08 4180 1.60 2.70 1.17 134 TR_XM_SpammyWords5 4165 1.92 3.87 1.17 135 XMStockSpam_06 4122 1.39 1.98 1.15 136 XM_SendGrid 4118 1.16 1.18 1.15 137 XMGappySubj_01 4102 0.87 0.15 1.15 138 XM_GoogleGroups 4085 1.01 0.68 1.14 139 URI_NOVOWEL 4066 1.12 1.06 1.14 140 FROM_GOV_DKIM_AU 4064 0.97 0.54 1.14 141 HTTPS_HTTP_MISMATCH 3950 1.14 1.23 1.11 142 XMBrknScrpt_02 3872 1.20 1.49 1.08 143 TVD_SPACE_RATIO 3790 0.81 0.18 1.06 144 URI_HEX 3671 1.14 1.44 1.03 145 XM_E_Blogspot 3580 0.77 0.17 1.00 146 RELAYCOUNTRY_CA 3475 2.14 5.17 0.97 147 T_TooManySym_03 3303 0.73 0.22 0.92 148 XM_H_Long_From02 3241 0.99 1.20 0.91 149 SpammyFromTLD_01 3178 1.34 2.50 0.89 150 TR_DCC_Bayes_99 2999 6.84 22.36 0.84 151 T_FILL_THIS_FORM_SHORT 2986 0.90 1.06 0.84 152 XMSolicitRefs_0 2964 0.75 0.54 0.83 153 XMGenDplmaNmb 2859 1.22 2.31 0.80 154 XM_UB50 2739 1.31 2.73 0.77 155 TR_XM_DK_SendGrid 2725 0.73 0.64 0.76 156 DKIM_ADSP_CUSTOM_MED 2677 0.87 1.17 0.75 157 XMNoVowels 2658 0.72 0.65 0.74 158 XM_ShortIntro_01 2582 0.80 1.00 0.72 159 T_XMDrugObfuBody_00 2563 1.22 2.53 0.72 160 HTML_IMAGE_ONLY_32 2524 0.58 0.26 0.71 161 XM_B_COPY_HTML 2511 0.90 1.40 0.70 162 XMLngstWrd_00 2486 0.64 0.51 0.70 163 XMBody_95 2366 0.52 0.17 0.66 164 URI_TRY_3LD 2299 0.69 0.82 0.64 165 RCVD_IN_PBL 2280 0.70 0.86 0.64 166 TR_MetaPhish_Combo_01 2276 0.67 0.75 0.64 167 XMGappySubj_02 2210 0.46 0.05 0.62 168 T_Symld_Words_02 2133 0.68 0.88 0.60 169 TVD_RCVD_IP 2126 0.65 0.79 0.60 170 XMBdyGiftCard01 2070 0.77 1.26 0.58 171 MPART_ALT_DIFF_COUNT 2063 0.67 0.92 0.58 172 XM_H_PHPMailer 2037 0.61 0.72 0.57 173 RELAYCOUNTRY_AU 1975 1.13 2.63 0.55 174 XMPhish14 1820 0.66 1.05 0.51 175 TR_XM_Base64_M1 1807 0.59 0.81 0.51 176 NML_ADSP_CUSTOM_MED 1806 0.61 0.88 0.51 177 TM2_M_OBFU_COMMENT 1748 0.64 1.02 0.49 178 XM_B_SpammyWords4 1741 1.15 2.86 0.49 179 XMSubMetaI_00 1732 0.60 0.88 0.48 180 XMMoneyMeta_00 1732 0.62 0.98 0.48 181 RCVD_IN_BL_SPAMCOP_NET 1712 2.46 7.59 0.48 182 SpammyFromTLD_02 1708 0.92 2.05 0.48 183 T_MANY_PILL_PRICE 1701 0.34 0.00 0.48 184 XMLngstWrd_01 1687 0.46 0.42 0.47 185 T_OBFU_PDF_ATTACH 1683 0.38 0.14 0.47 186 XM_B_DNDMA 1681 0.64 1.10 0.47 187 MISSING_HEADERS 1677 0.60 0.96 0.47 188 XMSubMetaSxObfu_02 1631 0.44 0.40 0.46 189 HTML_IMAGE_ONLY_28 1616 0.40 0.25 0.45 190 RELAYCOUNTRY_GB 1605 0.54 0.77 0.45 191 XM_B_FormFill 1603 0.33 0.03 0.45 192 HTML_TAG_BALANCE_BODY 1569 0.63 1.13 0.44 193 FORGED_GMAIL_RCVD 1509 0.52 0.76 0.42 194 T_XMHurry_00 1500 0.97 2.38 0.42 195 XMPhish30 1488 0.99 2.49 0.42 196 TR_XM_FormFill2 1484 0.73 1.55 0.42 197 FROM_GOV_SPOOF 1473 0.32 0.08 0.41 198 TR_XM_PHPForged 1467 0.74 1.59 0.41 199 TO_NO_BRKTS_HTML_ONLY 1463 0.37 0.27 0.41 200 TR_XM_PHPDW 1449 0.73 1.57 0.41 ----------------------------------------------------------------------