Email: 471576 Autolearn: 0 AvgScore: 4.77 AvgScanTime: 1.27 sec Spam: 147719 Autolearn: 0 AvgScore: 14.63 AvgScanTime: 1.43 sec Ham: 323857 Autolearn: 0 AvgScore: 0.27 AvgScanTime: 1.20 sec Time Spent Running SA: 166.56 hours Time Spent Processing Spam: 58.54 hours Time Spent Processing Ham: 108.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138632 88.76 93.85 86.44 2 DKIM_SIGNED 132035 78.91 89.38 74.13 3 XM_DK_Pass 126875 76.78 85.89 72.63 4 RELAYCOUNTRY_US 125634 81.59 85.05 80.01 5 DKIM_VALID 125078 75.64 84.67 71.52 6 XM_B_Unicode 123859 73.18 83.85 68.31 7 DCC_CHECK 113226 50.60 76.65 38.71 8 XM_B_SpammyWords 100476 50.84 68.02 43.01 9 XMListUnsubscribeExists 100355 52.81 67.94 45.91 10 DKIM_VALID_AU 99183 60.26 67.14 57.11 11 XM_B_Unicode3 73144 42.17 49.52 38.82 12 LOC_TINY_FONT_1 72245 32.03 48.91 24.33 13 BAYES_50 62314 55.88 42.18 62.13 14 XM_B_SpammyWords2 59254 24.82 40.11 17.84 15 RCVD_IN_MSPIKE_H2 57419 35.06 38.87 33.32 16 HTML_FONT_LOW_CONTRAST 57031 30.43 38.61 26.71 17 XM_DK_Undo_02 56915 15.35 38.53 4.78 18 FVGT_m_MULTI_ODD 50966 27.01 34.50 23.59 19 BAYES_99 45020 11.85 30.48 3.35 20 T_KAM_HTML_FONT_INVALID 44323 22.56 30.00 19.16 21 DKIM_VALID_EF 43199 29.50 29.24 29.61 22 TR_XM_DKIM_Undo 39041 9.59 26.43 1.91 23 XM_Multi_Part_URI 36579 18.21 24.76 15.22 24 XMSubLong 36285 23.72 24.56 23.34 25 MIME_HTML_ONLY 36194 21.06 24.50 19.49 26 BAYES_999 34340 8.91 23.25 2.37 27 TR_DCC_Bayes_99 33368 7.86 22.59 1.14 28 T_TM2_M_HEADER_IN_MSG 32604 27.54 22.07 30.04 29 DCC_CHECK_NEGATIVE 31902 48.82 21.60 61.24 30 TR_XM_DK_Unsub 26345 13.76 17.83 11.90 31 UNPARSEABLE_RELAY 25071 12.92 16.97 11.07 32 XM_B_Unsub 24364 11.43 16.49 9.12 33 TR_XM_BayesUnsub 23570 9.80 15.96 6.99 34 XM_B_SpammyWords3 22830 8.04 15.46 4.65 35 TR_MAX_INTL_RELAY 20939 8.41 14.17 5.78 36 RELAYCOUNTRY_META 20663 7.17 13.99 4.06 37 LOTS_OF_MONEY 18639 7.98 12.62 5.86 38 BOTNET_IPINHOSTNAME 16959 6.02 11.48 3.53 39 TR_XM_SpammyWords4 16511 6.14 11.18 3.84 40 TR_XM_SpammyWords2 16408 3.74 11.11 0.38 41 FSL_BULK_SIG 14885 8.05 10.08 7.12 42 TR_XM_SpammyRelay 14755 4.43 9.99 1.90 43 TR_XM_UnparsRelay 13343 3.93 9.03 1.60 44 XM_Evil_Numbers_Gen 13160 8.17 8.91 7.83 45 BAYES_80 12777 5.17 8.65 3.58 46 XM_B_Phish_Phrases 12748 6.27 8.63 5.19 47 LotsOfNums_01 12705 8.21 8.60 8.03 48 BOTNET 12677 3.95 8.58 1.83 49 XM_Body_Dirty_Words 12512 4.79 8.47 3.12 50 BAYES_60 11816 8.27 8.00 8.39 51 MPART_ALT_DIFF 11418 7.19 7.73 6.94 52 RCVD_IN_BL_SPAMCOP_NET 11126 2.74 7.53 0.55 53 XMSubMetaSx_00 10239 5.16 6.93 4.36 54 HTML_IMAGE_RATIO_02 9898 5.50 6.70 4.95 55 XM_UncommonTLD01 9267 5.01 6.27 4.43 56 XM_B_PhoneNumber 8896 8.73 6.02 9.96 57 TR_XM_SPAMCOP 8818 2.07 5.97 0.29 58 BAYES_95 7722 3.14 5.23 2.18 59 MIME_HTML_MOSTLY 7576 4.96 5.13 4.89 60 XM_B_Investor 7470 2.62 5.06 1.50 61 UNTRUSTED_Relay 7365 2.53 4.99 1.42 62 XM_H_Long_From01 7312 5.11 4.95 5.18 63 RELAYCOUNTRY_CA 7094 2.30 4.80 1.16 64 DKIM_INVALID 6957 3.27 4.71 2.61 65 XM_H_GMP 6660 4.95 4.51 5.16 66 TR_XM_PhishingBody 6531 2.52 4.42 1.65 67 TooManyTo_001 6463 8.26 4.38 10.03 68 T_XMDrugObfuBody_14 6351 2.52 4.30 1.71 69 TM2_M_VERY_LONG_WORD 6254 2.37 4.23 1.52 70 HTML_IMAGE_RATIO_04 6214 3.75 4.21 3.55 71 XMStrtUSub 6172 4.36 4.18 4.44 72 XM_B_SpammyTLD 6081 2.98 4.12 2.46 73 XMSexyCombo_05 6006 2.05 4.07 1.13 74 HTML_IMAGE_RATIO_06 5441 3.26 3.68 3.07 75 TR_XM_SpammyWords5 5311 1.98 3.60 1.24 76 XM_CamelCaseFrm001 5271 2.73 3.57 2.35 77 XMNumbers 5266 2.92 3.56 2.63 78 MIME_HTML_ONLY_MULTI 4991 2.85 3.38 2.62 79 HTML_IMAGE_RATIO_08 4811 2.33 3.26 1.91 80 TM2_M_URI_OPT_OUT 4775 2.72 3.23 2.49 81 RCVD_IN_VALIDITY_RPBL 4587 1.07 3.11 0.14 82 XM_SPF_SoftFail 4399 1.92 2.98 1.44 83 RCVD_IN_MSPIKE_H3 4261 4.82 2.88 5.70 84 RCVD_IN_MSPIKE_WL 4261 4.82 2.88 5.70 85 T_XMDrugObfuBody_08 4198 1.83 2.84 1.37 86 XM_OfRef6 4189 1.63 2.84 1.07 87 MIME_QP_LONG_LINE 4159 4.89 2.82 5.84 88 XMDiploma_00 4101 1.94 2.78 1.56 89 HTML_IMAGE_ONLY_20 3990 2.96 2.70 3.08 90 T_XMDrugObfuBody_00 3923 1.38 2.66 0.80 91 RELAYCOUNTRY_AU 3856 1.28 2.61 0.68 92 XM_URI_RBL 3764 1.00 2.55 0.30 93 XM_B_SpammyWords4 3658 1.17 2.48 0.57 94 XM_UB50 3653 1.40 2.47 0.91 95 XM_B_URI_Unicode 3635 2.13 2.46 1.98 96 T_XMHurry_00 3538 1.18 2.40 0.63 97 XM_B_Unsub2 3460 1.86 2.34 1.64 98 T_TooManySym_01 3412 4.89 2.31 6.06 99 TR_XM_SpoofStaff 3364 0.89 2.28 0.26 100 XMSpoofStaff2 3312 0.85 2.24 0.21 101 SUSP_UTF8_WORD_SUBJ 3216 0.70 2.18 0.02 102 RCVD_IN_VALIDITY_SAFE 3209 3.42 2.17 3.99 103 XM_DK_Undo_01 3191 1.80 2.16 1.64 104 FROM_EXCESS_BASE64 3154 1.86 2.14 1.73 105 XMStockSpam_06 3098 1.14 2.10 0.71 106 SpammyFromTLD_02 3035 1.01 2.05 0.54 107 XMBody_17 2997 0.90 2.03 0.39 108 MAILING_LIST_MULTI 2990 2.97 2.02 3.40 109 TR_XM_NoHeaderRelay 2866 0.80 1.94 0.28 110 XM_H_Long_From02 2827 1.40 1.91 1.17 111 URI_HEX 2790 1.39 1.89 1.16 112 SpammyFromTLD_01 2784 1.35 1.88 1.10 113 USER_IN_DEF_DKIM_WL 2752 9.03 1.86 12.30 114 ALL_TRUSTED 2703 12.12 1.83 16.81 115 SUBJ_ALL_CAPS 2607 1.50 1.76 1.38 116 SHORTCIRCUIT 2545 0.54 1.72 0.00 117 RCVD_IN_ZEN_LASTEXTERNAL 2545 0.54 1.72 0.00 118 XMBody_78 2461 0.70 1.67 0.26 119 TR_Mismatch_TLD_01 2449 0.67 1.66 0.22 120 XM_SendGrid 2436 1.44 1.65 1.35 121 TR_XM_PHPForged 2382 0.87 1.61 0.53 122 TR_XM_PHPDW 2372 0.88 1.61 0.54 123 XM_B_COPY_HTML 2339 0.96 1.58 0.68 124 TR_XM_FormFill2 2311 0.86 1.56 0.54 125 HTML_MIME_NO_HTML_TAG 2307 2.21 1.56 2.51 126 HTTPS_HTTP_MISMATCH 2293 1.16 1.55 0.98 127 T_REMOTE_IMAGE 2289 2.93 1.55 3.55 128 XM_H_PHPOS 2285 0.84 1.55 0.52 129 XMPhish30 2267 0.82 1.53 0.49 130 T_FILL_THIS_FORM_SHORT 2254 1.01 1.53 0.77 131 RCVD_IN_VALIDITY_CERTIFIED 2233 2.80 1.51 3.39 132 BAYES_40 2189 3.63 1.48 4.60 133 NO_DNS_FOR_FROM 2181 0.69 1.48 0.32 134 TR_XM_MaxWHORU 2162 0.64 1.46 0.27 135 XMBrknScrpt_02 2154 0.96 1.46 0.73 136 DKIM_ADSP_NXDOMAIN 2112 0.64 1.43 0.28 137 KHOP_HELO_FCRDNS 2075 1.55 1.40 1.61 138 XMLngstWrd_00 2068 0.91 1.40 0.69 139 TR_XM_INV_DKIM 2022 0.49 1.37 0.08 140 XMGenDplmaNmb 1940 1.12 1.31 1.04 141 DIET_1 1907 0.59 1.29 0.27 142 THIS_AD 1903 0.60 1.29 0.28 143 XM_B_SEO 1895 0.56 1.28 0.23 144 XM_B_COVIDMETA 1875 0.59 1.27 0.28 145 RDNS_DYNAMIC 1863 0.77 1.26 0.54 146 PDS_RDNS_DYNAMIC_FP 1844 0.66 1.25 0.39 147 XMHTML_After_End 1821 0.62 1.23 0.34 148 LongTLD 1814 0.65 1.23 0.38 149 RELAYCOUNTRY_FR 1768 0.53 1.20 0.23 150 URI_TRY_3LD 1756 0.86 1.19 0.70 151 TVD_RCVD_IP 1739 0.90 1.18 0.78 152 XMSubMetaI_00 1732 0.76 1.17 0.57 153 XMBdyGiftCard01 1730 0.72 1.17 0.52 154 RCVD_IN_IADB_LISTED 1705 3.02 1.15 3.87 155 FIN_FREE 1698 0.38 1.15 0.03 156 HTML_TAG_BALANCE_BODY 1670 0.88 1.13 0.77 157 TR_Mismatch_TLD_02 1658 0.44 1.12 0.12 158 XMLngstWrd_01 1633 0.60 1.11 0.37 159 NORDNS_LOW_CONTRAST 1587 0.37 1.07 0.04 160 RCVD_IN_PBL 1563 0.84 1.06 0.74 161 XMSexyCombo_01 1555 0.50 1.05 0.25 162 SHOPIFY_IMG_NOT_RCVD_SFY 1553 0.50 1.05 0.24 163 URI_NOVOWEL 1548 1.26 1.05 1.36 164 BAYES_20 1507 2.65 1.02 3.40 165 TR_XM_SEO4 1495 0.38 1.01 0.09 166 TooManyTo_002 1474 2.47 1.00 3.14 167 RCVD_IN_IADB_SPF 1451 2.64 0.98 3.39 168 RCVD_IN_XBL 1447 0.33 0.98 0.03 169 XM_ProductURIs 1438 0.70 0.97 0.57 170 XMReplyNow 1436 0.48 0.97 0.26 171 DKIM_ADSP_CUSTOM_MED 1431 0.86 0.97 0.82 172 TR_XM_RelayPhish 1409 0.35 0.95 0.08 173 PLING_QUERY 1401 0.56 0.95 0.38 174 TR_XM_Base64_M1 1398 0.71 0.95 0.60 175 RCVD_IN_IADB_DK 1385 2.30 0.94 2.93 176 RCVD_IN_IADB_SENDERID 1383 2.37 0.94 3.02 177 TR_Symld_Words 1378 1.37 0.93 1.57 178 XM_B_Phish66 1362 0.57 0.92 0.41 179 XM_B_REG_HTML 1353 0.40 0.92 0.17 180 T_STY_INVIS_DIRECT 1347 0.50 0.91 0.31 181 T_MONEY_PERCENT 1342 0.37 0.91 0.12 182 TR_LOTS_OF_MONEY2 1342 0.37 0.91 0.12 183 TooManyTo_003 1336 1.56 0.90 1.86 184 XMMoneyMeta_00 1319 0.63 0.89 0.51 185 T_Symld_Words_02 1313 0.65 0.89 0.54 186 URIBL_BLACK 1313 0.31 0.89 0.04 187 MPART_ALT_DIFF_COUNT 1310 0.69 0.89 0.60 188 TR_LOTS_OF_MONEY3 1308 0.42 0.89 0.21 189 XM_DIRTYINTL 1300 0.32 0.88 0.07 190 XMLngstWrd_02 1295 0.48 0.88 0.29 191 XMSolicitRefs_0 1292 0.45 0.87 0.26 192 BOTNET_NORDNS 1292 0.28 0.87 0.01 193 TR_XM_DK_SendGrid 1262 0.84 0.85 0.84 194 TooManyTo_004 1255 1.25 0.85 1.44 195 XM_B_DNDMA 1243 0.71 0.84 0.65 196 XM_OfRef7 1242 0.38 0.84 0.17 197 XM_UB99 1238 0.27 0.84 0.01 198 TM2_M_OBFU_COMMENT 1237 0.55 0.84 0.42 199 RCVD_IN_SORBS_DUL 1232 0.28 0.83 0.03 200 XM_H_Undi_Recip 1231 0.40 0.83 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279929 88.76 93.85 86.44 2 RELAYCOUNTRY_US 259107 81.59 85.05 80.01 3 DKIM_SIGNED 240088 78.91 89.38 74.13 4 XM_DK_Pass 235206 76.78 85.89 72.63 5 DKIM_VALID 231638 75.64 84.67 71.52 6 XM_B_Unicode 221229 73.18 83.85 68.31 7 BAYES_50 201209 55.88 42.18 62.13 8 DCC_CHECK_NEGATIVE 198320 48.82 21.60 61.24 9 DKIM_VALID_AU 184966 60.26 67.14 57.11 10 XMListUnsubscribeExists 148682 52.81 67.94 45.91 11 XM_B_SpammyWords 139293 50.84 68.02 43.01 12 XM_B_Unicode3 125713 42.17 49.52 38.82 13 DCC_CHECK 125378 50.60 76.65 38.71 14 RCVD_IN_MSPIKE_H2 107922 35.06 38.87 33.32 15 T_TM2_M_HEADER_IN_MSG 97277 27.54 22.07 30.04 16 DKIM_VALID_EF 95910 29.50 29.24 29.61 17 HTML_FONT_LOW_CONTRAST 86492 30.43 38.61 26.71 18 LOC_TINY_FONT_1 78808 32.03 48.91 24.33 19 FVGT_m_MULTI_ODD 76391 27.01 34.50 23.59 20 XMSubLong 75588 23.72 24.56 23.34 21 MIME_HTML_ONLY 63106 21.06 24.50 19.49 22 T_KAM_HTML_FONT_INVALID 62052 22.56 30.00 19.16 23 XM_B_SpammyWords2 57769 24.82 40.11 17.84 24 ALL_TRUSTED 54448 12.12 1.83 16.81 25 XM_Multi_Part_URI 49276 18.21 24.76 15.22 26 USER_IN_DEF_DKIM_WL 39840 9.03 1.86 12.30 27 TR_XM_DK_Unsub 38529 13.76 17.83 11.90 28 UNPARSEABLE_RELAY 35838 12.92 16.97 11.07 29 BAYES_00 33543 7.33 0.71 10.36 30 TooManyTo_001 32494 8.26 4.38 10.03 31 XM_B_PhoneNumber 32257 8.73 6.02 9.96 32 XM_B_Unsub 29541 11.43 16.49 9.12 33 BAYES_60 27185 8.27 8.00 8.39 34 LotsOfNums_01 25993 8.21 8.60 8.03 35 XM_Evil_Numbers_Gen 25364 8.17 8.91 7.83 36 IN_ZIMBRA_NJ_WHITELIST 23238 4.96 0.09 7.18 37 FSL_BULK_SIG 23059 8.05 10.08 7.12 38 TR_XM_BayesUnsub 22640 9.80 15.96 6.99 39 MPART_ALT_DIFF 22482 7.19 7.73 6.94 40 XM_DKIMWhitelistDomains 21850 4.65 0.04 6.75 41 TR_XM_DK_Bayes 21383 4.72 0.60 6.60 42 TR_XM_DK_Bayes1 21133 4.67 0.60 6.53 43 T_TooManySym_01 19635 4.89 2.31 6.06 44 LOTS_OF_MONEY 18982 7.98 12.62 5.86 45 MIME_QP_LONG_LINE 18907 4.89 2.82 5.84 46 TR_MAX_INTL_RELAY 18703 8.41 14.17 5.78 47 RCVD_IN_MSPIKE_H3 18453 4.82 2.88 5.70 48 RCVD_IN_MSPIKE_WL 18453 4.82 2.88 5.70 49 TR_XM_DK_Bayes2 18063 3.98 0.48 5.58 50 XM_B_Phish_Phrases 16798 6.27 8.63 5.19 51 XM_H_Long_From01 16784 5.11 4.95 5.18 52 XM_H_GMP 16695 4.95 4.51 5.16 53 HTML_IMAGE_RATIO_02 16034 5.50 6.70 4.95 54 MIME_HTML_MOSTLY 15821 4.96 5.13 4.89 55 XM_DK_Undo_02 15472 15.35 38.53 4.78 56 XM_B_SpammyWords3 15066 8.04 15.46 4.65 57 ANY_BOUNCE_MESSAGE 14985 3.41 0.74 4.63 58 BOUNCE_MESSAGE 14985 3.41 0.74 4.63 59 BAYES_40 14913 3.63 1.48 4.60 60 XM_PDF 14417 3.25 0.60 4.45 61 XMStrtUSub 14379 4.36 4.18 4.44 62 XM_UncommonTLD01 14338 5.01 6.27 4.43 63 XMSubMetaSx_00 14107 5.16 6.93 4.36 64 RELAYCOUNTRY_META 13151 7.17 13.99 4.06 65 RCVD_IN_VALIDITY_SAFE 12934 3.42 2.17 3.99 66 RCVD_IN_IADB_LISTED 12546 3.02 1.15 3.87 67 TR_XM_SpammyWords4 12430 6.14 11.18 3.84 68 BAYES_80 11610 5.17 8.65 3.58 69 T_REMOTE_IMAGE 11507 2.93 1.55 3.55 70 HTML_IMAGE_RATIO_04 11488 3.75 4.21 3.55 71 BOTNET_IPINHOSTNAME 11421 6.02 11.48 3.53 72 MAILING_LIST_MULTI 11019 2.97 2.02 3.40 73 BAYES_20 10997 2.65 1.02 3.40 74 RCVD_IN_VALIDITY_CERTIFIED 10990 2.80 1.51 3.39 75 RCVD_IN_IADB_SPF 10987 2.64 0.98 3.39 76 BAYES_99 10846 11.85 30.48 3.35 77 TooManyTo_002 10172 2.47 1.00 3.14 78 XM_Body_Dirty_Words 10091 4.79 8.47 3.12 79 HTML_IMAGE_ONLY_20 9989 2.96 2.70 3.08 80 HTML_IMAGE_RATIO_06 9937 3.26 3.68 3.07 81 T_TooManySym_02 9806 2.28 0.64 3.03 82 RCVD_IN_IADB_SENDERID 9793 2.37 0.94 3.02 83 RCVD_IN_IADB_DK 9483 2.30 0.94 2.93 84 RCVD_IN_IADB_VOUCHED 8595 2.01 0.60 2.65 85 XMNumbers 8523 2.92 3.56 2.63 86 MIME_HTML_ONLY_MULTI 8470 2.85 3.38 2.62 87 DKIM_INVALID 8450 3.27 4.71 2.61 88 HTML_MIME_NO_HTML_TAG 8138 2.21 1.56 2.51 89 TM2_M_URI_OPT_OUT 8071 2.72 3.23 2.49 90 XM_B_SpammyTLD 7954 2.98 4.12 2.46 91 BAYES_999 7680 8.91 23.25 2.37 92 XM_CamelCaseFrm001 7603 2.73 3.57 2.35 93 INVALID_MSGID 7349 1.61 0.16 2.27 94 BAYES_95 7074 3.14 5.23 2.18 95 BAYES_05 6480 1.54 0.53 2.00 96 XM_B_URI_Unicode 6427 2.13 2.46 1.98 97 TO_MALFORMED 6426 1.37 0.03 1.98 98 TR_XM_DKIM_Undo 6195 9.59 26.43 1.91 99 HTML_IMAGE_RATIO_08 6177 2.33 3.26 1.91 100 TR_XM_SpammyRelay 6147 4.43 9.99 1.90 101 TooManyTo_003 6026 1.56 0.90 1.86 102 BOTNET 5937 3.95 8.58 1.83 103 RCVD_IN_IADB_OPTIN 5911 1.36 0.33 1.83 104 FROM_EXCESS_BASE64 5601 1.86 2.14 1.73 105 T_XMDrugObfuBody_14 5549 2.52 4.30 1.71 106 TR_XM_PhishingBody 5330 2.52 4.42 1.65 107 XM_DK_Undo_01 5309 1.80 2.16 1.64 108 XM_B_Unsub2 5299 1.86 2.34 1.64 109 KHOP_HELO_FCRDNS 5228 1.55 1.40 1.61 110 TR_XM_UnparsRelay 5175 3.93 9.03 1.60 111 TR_Symld_Words 5079 1.37 0.93 1.57 112 XMDiploma_00 5063 1.94 2.78 1.56 113 XMGappySubj_01 4944 1.17 0.39 1.53 114 TM2_M_VERY_LONG_WORD 4930 2.37 4.23 1.52 115 XM_B_Investor 4872 2.62 5.06 1.50 116 IN_HORDE_ADDRESS_BOOK 4767 1.04 0.10 1.47 117 TooManyTo_004 4661 1.25 0.85 1.44 118 XM_SPF_SoftFail 4654 1.92 2.98 1.44 119 XM_H_PHPMailer 4593 1.20 0.71 1.42 120 UNTRUSTED_Relay 4589 2.53 4.99 1.42 121 SUBJ_ALL_CAPS 4459 1.50 1.76 1.38 122 T_XMDrugObfuBody_08 4431 1.83 2.84 1.37 123 URI_NOVOWEL 4408 1.26 1.05 1.36 124 XM_SendGrid 4371 1.44 1.65 1.35 125 HELO_NODOT 4140 0.98 0.33 1.28 126 HELO_NO_DOMAIN 4136 0.98 0.33 1.28 127 FROM_GOV_DKIM_AU 4089 0.93 0.21 1.26 128 TR_XM_SpammyWords5 4009 1.98 3.60 1.24 129 TooManyTo_005 3944 1.09 0.82 1.22 130 XM_GoogleGroups 3814 1.01 0.65 1.18 131 TVD_SPACE_RATIO 3803 0.84 0.12 1.17 132 XM_H_Long_From02 3775 1.40 1.91 1.17 133 RELAYCOUNTRY_CA 3770 2.30 4.80 1.16 134 URI_HEX 3750 1.39 1.89 1.16 135 XMCapTrack 3734 0.95 0.49 1.15 136 TR_DCC_Bayes_99 3705 7.86 22.59 1.14 137 XMSexyCombo_05 3667 2.05 4.07 1.13 138 T_TooManySym_03 3665 0.86 0.27 1.13 139 SpammyFromTLD_01 3573 1.35 1.88 1.10 140 XM_OfRef6 3481 1.63 2.84 1.07 141 XMGenDplmaNmb 3355 1.12 1.31 1.04 142 XMNoVowels 3324 0.91 0.67 1.03 143 HTTPS_HTTP_MISMATCH 3168 1.16 1.55 0.98 144 XM_UB50 2958 1.40 2.47 0.91 145 TR_MetaPhish_Combo_01 2852 0.83 0.71 0.88 146 XMGappySubj_02 2760 0.60 0.04 0.85 147 TR_XM_DK_SendGrid 2705 0.84 0.85 0.84 148 XM_ShortIntro_01 2682 0.82 0.80 0.83 149 DKIM_ADSP_CUSTOM_MED 2641 0.86 0.97 0.82 150 T_XMDrugObfuBody_00 2591 1.38 2.66 0.80 151 TVD_RCVD_IP 2516 0.90 1.18 0.78 152 T_FILL_THIS_FORM_SHORT 2504 1.01 1.53 0.77 153 HTML_TAG_BALANCE_BODY 2497 0.88 1.13 0.77 154 XMBody_95 2455 0.57 0.17 0.76 155 RCVD_IN_PBL 2403 0.84 1.06 0.74 156 XMBrknScrpt_02 2374 0.96 1.46 0.73 157 XM_B_FormFill 2373 0.51 0.02 0.73 158 XMStockSpam_06 2298 1.14 2.10 0.71 159 URI_TRY_3LD 2281 0.86 1.19 0.70 160 XMLngstWrd_00 2246 0.91 1.40 0.69 161 RELAYCOUNTRY_AU 2200 1.28 2.61 0.68 162 XM_B_COPY_HTML 2192 0.96 1.58 0.68 163 XM_B_DNDMA 2113 0.71 0.84 0.65 164 T_XMHurry_00 2031 1.18 2.40 0.63 165 FILL_THIS_FORM 2026 0.58 0.47 0.63 166 TR_XM_Base64_M1 1950 0.71 0.95 0.60 167 MPART_ALT_DIFF_COUNT 1945 0.69 0.89 0.60 168 XM_B_SpammyWords4 1855 1.17 2.48 0.57 169 XM_ProductURIs 1842 0.70 0.97 0.57 170 XMSubMetaI_00 1832 0.76 1.17 0.57 171 RCVD_IN_BL_SPAMCOP_NET 1793 2.74 7.53 0.55 172 NML_ADSP_CUSTOM_MED 1785 0.62 0.77 0.55 173 T_Symld_Words_02 1761 0.65 0.89 0.54 174 RELAYCOUNTRY_GB 1761 0.63 0.82 0.54 175 RDNS_DYNAMIC 1757 0.77 1.26 0.54 176 TR_XM_PHPDW 1756 0.88 1.61 0.54 177 SpammyFromTLD_02 1748 1.01 2.05 0.54 178 TR_XM_FormFill2 1740 0.86 1.56 0.54 179 TR_XM_PHPForged 1729 0.87 1.61 0.53 180 HTML_IMAGE_ONLY_32 1692 0.45 0.29 0.52 181 XM_H_PHPOS 1687 0.84 1.55 0.52 182 XMBdyGiftCard01 1684 0.72 1.17 0.52 183 XMSlimDrugH 1678 0.58 0.71 0.52 184 XMMoneyMeta_00 1645 0.63 0.89 0.51 185 XMSubMetaSxObfu_03 1631 0.58 0.74 0.50 186 TO_NO_BRKTS_HTML_ONLY 1626 0.44 0.30 0.50 187 MIME_CHARSET_FARAWAY 1613 0.58 0.76 0.50 188 FORGED_GMAIL_RCVD 1602 0.56 0.69 0.49 189 XMPhish30 1581 0.82 1.53 0.49 190 T_TooManySym_04 1563 0.35 0.06 0.48 191 T_OBFU_PDF_ATTACH 1535 0.38 0.18 0.47 192 XMClaimOffer 1531 0.48 0.49 0.47 193 MSGID_FROM_MTA_HEADER 1450 0.33 0.09 0.45 194 XMDateMe_00 1413 0.44 0.44 0.44 195 HTML_IMAGE_ONLY_28 1382 0.36 0.23 0.43 196 TM2_M_OBFU_COMMENT 1375 0.55 0.84 0.42 197 XMPhish14 1356 0.53 0.79 0.42 198 MISSING_HEADERS 1356 0.47 0.57 0.42 199 XM_B_Phish66 1325 0.57 0.92 0.41 200 T_TVD_MIME_NO_HEADERS 1324 0.29 0.04 0.41 ----------------------------------------------------------------------