Email: 506305 Autolearn: 0 AvgScore: 4.97 AvgScanTime: 1.22 sec Spam: 153342 Autolearn: 0 AvgScore: 13.85 AvgScanTime: 1.39 sec Ham: 352963 Autolearn: 0 AvgScore: 1.11 AvgScanTime: 1.15 sec Time Spent Running SA: 171.42 hours Time Spent Processing Spam: 59.02 hours Time Spent Processing Ham: 112.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146234 90.70 95.36 88.68 2 XM_B_Unicode 130762 77.23 85.27 73.74 3 DKIM_SIGNED 119029 67.30 77.62 62.81 4 XM_DK_Pass 114585 65.60 74.73 61.63 5 RELAYCOUNTRY_US 114296 70.35 74.54 68.53 6 DKIM_VALID 112882 64.70 73.61 60.83 7 DCC_CHECK 112464 48.08 73.34 37.10 8 XMListUnsubscribeExists 93660 46.08 61.08 39.57 9 XM_B_SpammyWords 92271 44.06 60.17 37.07 10 DKIM_VALID_AU 90747 51.75 59.18 48.53 11 XM_B_Unicode3 68209 36.33 44.48 32.79 12 LOC_TINY_FONT_1 67454 28.08 43.99 21.17 13 BAYES_50 55621 47.98 36.27 53.07 14 XM_B_SpammyWords2 54321 21.35 35.42 15.23 15 XM_DK_Undo_02 52808 13.67 34.44 4.65 16 BAYES_99 52432 13.00 34.19 3.79 17 MIME_HTML_ONLY 52348 33.17 34.14 32.74 18 HTML_FONT_LOW_CONTRAST 51815 25.84 33.79 22.39 19 RCVD_IN_MSPIKE_H2 50503 29.48 32.93 27.98 20 XMSubLong 50354 30.34 32.84 29.26 21 FVGT_m_MULTI_ODD 46504 22.89 30.33 19.66 22 T_KAM_HTML_FONT_INVALID 42994 19.89 28.04 16.35 23 DCC_CHECK_NEGATIVE 38720 51.47 25.25 62.86 24 TR_XM_DKIM_Undo 35878 8.41 23.40 1.90 25 DKIM_VALID_EF 35529 24.18 23.17 24.62 26 TR_DCC_Bayes_99 34253 7.38 22.34 0.88 27 T_TM2_M_HEADER_IN_MSG 33414 30.13 21.79 33.76 28 BAYES_999 33065 8.10 21.56 2.25 29 XM_Multi_Part_URI 31876 14.11 20.79 11.21 30 TR_MAX_INTL_RELAY 26420 15.71 17.23 15.05 31 TR_XM_DK_Unsub 24058 11.97 15.69 10.35 32 UNPARSEABLE_RELAY 22497 10.79 14.67 9.10 33 XM_B_Unsub 22022 10.09 14.36 8.24 34 TR_XM_BayesUnsub 21419 8.56 13.97 6.20 35 XM_B_SpammyWords3 21089 6.66 13.75 3.57 36 RELAYCOUNTRY_META 20269 7.29 13.22 4.71 37 ALL_TRUSTED 19812 23.81 12.92 28.54 38 XMNoVowels 16872 9.06 11.00 8.21 39 T_HTML_ATTACH 16704 9.31 10.89 8.63 40 LOTS_OF_MONEY 16457 6.94 10.73 5.29 41 BAYES_80 15813 9.51 10.31 9.16 42 TR_XM_SpammyWords2 14550 3.09 9.49 0.31 43 TR_XM_SpammyWords4 14495 5.14 9.45 3.26 44 XM_B_SpammyTLD 14131 8.49 9.22 8.18 45 BOTNET_IPINHOSTNAME 14028 5.02 9.15 3.23 46 TR_XM_SpammyRelay 13069 3.89 8.52 1.87 47 XM_Evil_Numbers_Gen 12972 7.44 8.46 6.99 48 FSL_BULK_SIG 12349 6.60 8.05 5.97 49 LotsOfNums_01 12104 7.38 7.89 7.15 50 RCVD_IN_BL_SPAMCOP_NET 11986 2.78 7.82 0.59 51 XM_Body_Dirty_Words 11910 4.21 7.77 2.67 52 XM_B_Phish_Phrases 11836 5.65 7.72 4.76 53 BAYES_60 11527 9.98 7.52 11.05 54 TR_XM_UnparsRelay 11457 3.13 7.47 1.24 55 BOTNET 10622 3.28 6.93 1.70 56 XM_UncommonTLD01 10534 5.53 6.87 4.95 57 BAYES_95 10115 6.10 6.60 5.89 58 HTML_IMAGE_RATIO_02 9957 4.51 6.49 3.64 59 TR_XM_SPAMCOP 9339 2.05 6.09 0.30 60 XMSubMetaSx_00 8984 3.70 5.86 2.76 61 UNTRUSTED_Relay 8590 2.69 5.60 1.43 62 TR_XMSubLong 8551 2.03 5.58 0.49 63 MPART_ALT_DIFF 8011 4.15 5.22 3.69 64 XM_H_Long_From01 7377 4.53 4.81 4.40 65 XM_B_PhoneNumber 6846 6.65 4.46 7.60 66 HTML_IMAGE_RATIO_04 6780 3.73 4.42 3.43 67 XM_B_Investor 6650 2.13 4.34 1.17 68 XM_H_GMP 6604 4.29 4.31 4.29 69 T_XMDrugObfuBody_14 6460 2.34 4.21 1.53 70 RELAYCOUNTRY_CA 6419 1.99 4.19 1.03 71 XMSexyCombo_05 6409 2.04 4.18 1.10 72 XMStrtUSub 6314 3.91 4.12 3.82 73 TR_XM_PhishingBody 6169 1.92 4.02 1.01 74 DKIM_INVALID 6147 2.59 4.01 1.98 75 TooManyTo_001 5868 6.52 3.83 7.69 76 TM2_M_VERY_LONG_WORD 5801 2.38 3.78 1.77 77 HTML_IMAGE_RATIO_06 5402 2.78 3.52 2.46 78 TR_XM_SpammyWords5 5346 1.76 3.49 1.01 79 MIME_HTML_MOSTLY 5072 2.46 3.31 2.09 80 XMNumbers 4586 2.80 2.99 2.71 81 MIME_HTML_ONLY_MULTI 4552 2.38 2.97 2.13 82 XM_URI_RBL 4309 1.03 2.81 0.26 83 XMDiploma_00 4270 2.10 2.78 1.81 84 XM_CamelCaseFrm001 4265 2.18 2.78 1.92 85 XM_UB50 4241 1.42 2.77 0.84 86 RCVD_IN_VALIDITY_SAFE 4094 3.36 2.67 3.66 87 T_TooManySym_01 3989 4.38 2.60 5.15 88 RCVD_IN_MSPIKE_WL 3946 3.88 2.57 4.45 89 RCVD_IN_MSPIKE_H3 3946 3.88 2.57 4.45 90 MIME_QP_LONG_LINE 3883 4.26 2.53 5.01 91 XM_SPF_SoftFail 3859 1.60 2.52 1.20 92 HTML_IMAGE_RATIO_08 3650 1.80 2.38 1.55 93 XM_OfRef6 3625 1.30 2.36 0.84 94 TM2_M_URI_OPT_OUT 3604 2.13 2.35 2.04 95 XM_B_URI_Unicode 3574 1.84 2.33 1.63 96 RELAYCOUNTRY_AU 3525 1.15 2.30 0.65 97 T_XMDrugObfuBody_08 3519 1.59 2.29 1.28 98 SUSP_UTF8_WORD_SUBJ 3453 0.69 2.25 0.01 99 XMBody_17 3445 0.98 2.25 0.43 100 SpammyFromTLD_02 3440 1.16 2.24 0.69 101 RCVD_IN_VALIDITY_CERTIFIED 3303 2.66 2.15 2.88 102 XM_B_Unsub2 3298 1.81 2.15 1.67 103 RCVD_IN_VALIDITY_RPBL 3221 0.71 2.10 0.11 104 XM_B_SpammyWords4 3107 0.98 2.03 0.53 105 FROM_EXCESS_BASE64 3104 1.71 2.02 1.57 106 SUBJ_ALL_CAPS 2996 1.35 1.95 1.09 107 XMBody_78 2982 0.74 1.94 0.21 108 USER_IN_DEF_DKIM_WL 2935 8.31 1.91 11.08 109 ANY_BOUNCE_MESSAGE 2913 3.51 1.90 4.20 110 BOUNCE_MESSAGE 2912 3.50 1.90 4.20 111 T_XMDrugObfuBody_00 2879 1.00 1.88 0.61 112 MAILING_LIST_MULTI 2866 2.52 1.87 2.81 113 XM_B_COPY_HTML 2683 0.93 1.75 0.58 114 SpammyFromTLD_01 2630 1.03 1.72 0.74 115 XMStockSpam_06 2578 1.19 1.68 0.97 116 XMPhish30 2524 0.73 1.65 0.34 117 T_REMOTE_IMAGE 2479 2.51 1.62 2.90 118 TR_XM_NoHeaderRelay 2417 0.61 1.58 0.19 119 XMBrknScrpt_02 2347 1.02 1.53 0.80 120 TR_XM_PHPDW 2314 0.67 1.51 0.30 121 TR_XM_PHPForged 2300 0.66 1.50 0.29 122 XM_DK_Undo_01 2284 1.48 1.49 1.47 123 BAYES_40 2256 3.07 1.47 3.77 124 DKIM_ADSP_NXDOMAIN 2255 0.62 1.47 0.25 125 TR_XM_FormFill2 2250 0.66 1.47 0.30 126 T_FILL_THIS_FORM_SHORT 2247 0.95 1.47 0.73 127 URI_HEX 2237 1.14 1.46 1.00 128 XM_H_PHPOS 2221 0.64 1.45 0.29 129 T_XMHurry_00 2191 0.90 1.43 0.68 130 XM_SendGrid 2130 1.20 1.39 1.12 131 KHOP_HELO_FCRDNS 2121 1.36 1.38 1.35 132 RCVD_IN_ZEN_LASTEXTERNAL 2110 0.42 1.38 0.00 133 SHORTCIRCUIT 2110 0.42 1.38 0.00 134 HTML_MIME_NO_HTML_TAG 2075 1.93 1.35 2.19 135 DIET_1 2044 0.63 1.33 0.32 136 XM_B_SEO 2008 0.61 1.31 0.31 137 RELAYCOUNTRY_FR 1991 0.58 1.30 0.27 138 XMBdyGiftCard01 1952 0.73 1.27 0.49 139 XM_B_REG_HTML 1902 0.47 1.24 0.13 140 TR_XM_INV_DKIM 1878 0.41 1.22 0.05 141 TR_Mismatch_TLD_02 1839 0.41 1.20 0.07 142 SUSP_UTF8_WORD_COMBO 1818 0.37 1.19 0.02 143 HTML_TAG_BALANCE_BODY 1802 0.69 1.18 0.48 144 THIS_AD 1796 0.61 1.17 0.36 145 XM_H_Undi_Recip 1790 0.46 1.17 0.15 146 LongTLD 1777 0.59 1.16 0.35 147 XMSubMetaI_00 1756 0.70 1.15 0.51 148 XMSubNoVowel 1732 0.52 1.13 0.25 149 NO_DNS_FOR_FROM 1726 0.55 1.13 0.30 150 TR_XM_Base64_M1 1725 0.68 1.12 0.49 151 XMGenDplmaNmb 1703 1.13 1.11 1.13 152 TR_XM_MaxWHORU 1701 0.51 1.11 0.25 153 BAYES_20 1697 2.31 1.11 2.83 154 HTTPS_HTTP_MISMATCH 1694 0.81 1.10 0.68 155 TR_XM_SEO4 1675 0.45 1.09 0.18 156 XMReplyNow 1647 0.50 1.07 0.26 157 RCVD_IN_IADB_LISTED 1615 2.62 1.05 3.31 158 TM2_M_OBFU_COMMENT 1614 0.66 1.05 0.49 159 XM_B_COVIDMETA 1585 0.43 1.03 0.17 160 XM_UB99 1566 0.32 1.02 0.01 161 URI_OPTOUT_3LD 1553 0.39 1.01 0.11 162 XM_H_Long_From02 1542 0.87 1.01 0.81 163 DKIM_ADSP_CUSTOM_MED 1533 0.76 1.00 0.65 164 XMLngstWrd_00 1510 0.76 0.98 0.67 165 RCVD_IN_IADB_SPF 1471 2.32 0.96 2.91 166 XMSubLongNoVowel 1469 0.29 0.96 0.00 167 TR_Symld_Words 1446 1.18 0.94 1.28 168 RCVD_IN_PSBL 1445 0.34 0.94 0.08 169 XMSexyCombo_01 1442 0.38 0.94 0.13 170 SHOPIFY_IMG_NOT_RCVD_SFY 1427 0.46 0.93 0.25 171 T_MONEY_PERCENT 1405 0.38 0.92 0.15 172 TR_LOTS_OF_MONEY2 1405 0.38 0.92 0.15 173 RCVD_IN_IADB_DK 1403 2.05 0.91 2.54 174 TooManyTo_002 1401 2.17 0.91 2.71 175 RCVD_IN_IADB_SENDERID 1389 2.10 0.91 2.62 176 TR_MetaPhish_Combo_01 1376 0.73 0.90 0.66 177 URI_TRY_3LD 1367 0.71 0.89 0.64 178 XM_HighProb1 1347 0.27 0.88 0.00 179 URIBL_CSS 1340 0.33 0.87 0.09 180 URIBL_CSS_A 1340 0.33 0.87 0.09 181 URI_NOVOWEL 1328 0.95 0.87 0.99 182 XMLngstWrd_01 1324 0.53 0.86 0.38 183 TooManyTo_003 1298 1.36 0.85 1.58 184 XMPhish14 1296 0.42 0.85 0.24 185 T_STY_INVIS_DIRECT 1294 0.44 0.84 0.26 186 XMHTML_After_End 1283 0.64 0.84 0.55 187 SH_BODYURI_REVERSE_CSS 1282 0.30 0.84 0.07 188 FROM_SUSPICIOUS_NTLD 1270 0.28 0.83 0.04 189 XMLngstWrd_02 1262 0.46 0.82 0.30 190 BOTNET_NORDNS 1239 0.25 0.81 0.01 191 MPART_ALT_DIFF_COUNT 1220 0.54 0.80 0.43 192 TooManyTo_004 1208 1.09 0.79 1.22 193 XM_UB999 1201 0.24 0.78 0.01 194 RDNS_DYNAMIC 1198 0.42 0.78 0.27 195 TR_LOTS_OF_MONEY3 1197 0.35 0.78 0.16 196 XM_ProductURIs 1183 0.49 0.77 0.36 197 XM_B_Phish66 1169 0.38 0.76 0.22 198 FROM_SUSPICIOUS_NTLD_FP 1165 0.24 0.76 0.02 199 PDS_RDNS_DYNAMIC_FP 1162 0.33 0.76 0.14 200 TR_XM_RelayPhish 1162 0.27 0.76 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312994 90.70 95.36 88.68 2 XM_B_Unicode 260273 77.23 85.27 73.74 3 RELAYCOUNTRY_US 241880 70.35 74.54 68.53 4 DCC_CHECK_NEGATIVE 221887 51.47 25.25 62.86 5 DKIM_SIGNED 221706 67.30 77.62 62.81 6 XM_DK_Pass 217536 65.60 74.73 61.63 7 DKIM_VALID 214716 64.70 73.61 60.83 8 BAYES_50 187307 47.98 36.27 53.07 9 DKIM_VALID_AU 171288 51.75 59.18 48.53 10 XMListUnsubscribeExists 139650 46.08 61.08 39.57 11 DCC_CHECK 130955 48.08 73.34 37.10 12 XM_B_SpammyWords 130828 44.06 60.17 37.07 13 T_TM2_M_HEADER_IN_MSG 119160 30.13 21.79 33.76 14 XM_B_Unicode3 115727 36.33 44.48 32.79 15 MIME_HTML_ONLY 115572 33.17 34.14 32.74 16 XMSubLong 103270 30.34 32.84 29.26 17 ALL_TRUSTED 100736 23.81 12.92 28.54 18 RCVD_IN_MSPIKE_H2 98756 29.48 32.93 27.98 19 DKIM_VALID_EF 86908 24.18 23.17 24.62 20 HTML_FONT_LOW_CONTRAST 79036 25.84 33.79 22.39 21 LOC_TINY_FONT_1 74726 28.08 43.99 21.17 22 FVGT_m_MULTI_ODD 69404 22.89 30.33 19.66 23 T_KAM_HTML_FONT_INVALID 57692 19.89 28.04 16.35 24 XM_B_SpammyWords2 53772 21.35 35.42 15.23 25 TR_MAX_INTL_RELAY 53130 15.71 17.23 15.05 26 XM_Multi_Part_URI 39572 14.11 20.79 11.21 27 USER_IN_DEF_DKIM_WL 39122 8.31 1.91 11.08 28 BAYES_60 38990 9.98 7.52 11.05 29 TR_XM_DK_Unsub 36537 11.97 15.69 10.35 30 BAYES_80 32329 9.51 10.31 9.16 31 UNPARSEABLE_RELAY 32136 10.79 14.67 9.10 32 BAYES_00 30943 6.27 0.54 8.77 33 T_HTML_ATTACH 30454 9.31 10.89 8.63 34 XM_B_Unsub 29072 10.09 14.36 8.24 35 XMNoVowels 28981 9.06 11.00 8.21 36 XM_B_SpammyTLD 28876 8.49 9.22 8.18 37 TooManyTo_001 27126 6.52 3.83 7.69 38 XM_B_PhoneNumber 26827 6.65 4.46 7.60 39 LotsOfNums_01 25246 7.38 7.89 7.15 40 XM_Evil_Numbers_Gen 24682 7.44 8.46 6.99 41 TR_XM_BayesUnsub 21900 8.56 13.97 6.20 42 FSL_BULK_SIG 21089 6.60 8.05 5.97 43 IN_ZIMBRA_NJ_WHITELIST 20835 4.14 0.07 5.90 44 BAYES_95 20777 6.10 6.60 5.89 45 XM_DKIMWhitelistDomains 20718 4.11 0.05 5.87 46 TR_XM_DK_Bayes 20109 4.09 0.39 5.70 47 TR_XM_DK_Bayes1 19855 4.04 0.38 5.63 48 LOTS_OF_MONEY 18676 6.94 10.73 5.29 49 T_TooManySym_01 18191 4.38 2.60 5.15 50 MIME_QP_LONG_LINE 17676 4.26 2.53 5.01 51 XM_UncommonTLD01 17488 5.53 6.87 4.95 52 TR_XM_DK_Bayes2 17146 3.47 0.28 4.86 53 XM_B_Phish_Phrases 16794 5.65 7.72 4.76 54 RELAYCOUNTRY_META 16626 7.29 13.22 4.71 55 XM_DK_Undo_02 16414 13.67 34.44 4.65 56 RCVD_IN_MSPIKE_H3 15697 3.88 2.57 4.45 57 RCVD_IN_MSPIKE_WL 15697 3.88 2.57 4.45 58 XM_H_Long_From01 15537 4.53 4.81 4.40 59 XM_H_GMP 15131 4.29 4.31 4.29 60 ANY_BOUNCE_MESSAGE 14835 3.51 1.90 4.20 61 BOUNCE_MESSAGE 14833 3.50 1.90 4.20 62 XM_PDF 13710 2.88 0.58 3.88 63 XMStrtUSub 13487 3.91 4.12 3.82 64 BAYES_99 13383 13.00 34.19 3.79 65 BAYES_40 13295 3.07 1.47 3.77 66 MPART_ALT_DIFF 13021 4.15 5.22 3.69 67 RCVD_IN_VALIDITY_SAFE 12929 3.36 2.67 3.66 68 HTML_IMAGE_RATIO_02 12864 4.51 6.49 3.64 69 XM_B_SpammyWords3 12618 6.66 13.75 3.57 70 HTML_IMAGE_RATIO_04 12093 3.73 4.42 3.43 71 RCVD_IN_IADB_LISTED 11675 2.62 1.05 3.31 72 TR_XM_SpammyWords4 11505 5.14 9.45 3.26 73 BOTNET_IPINHOSTNAME 11402 5.02 9.15 3.23 74 RCVD_IN_IADB_SPF 10286 2.32 0.96 2.91 75 T_REMOTE_IMAGE 10227 2.51 1.62 2.90 76 RCVD_IN_VALIDITY_CERTIFIED 10153 2.66 2.15 2.88 77 BAYES_20 9988 2.31 1.11 2.83 78 MAILING_LIST_MULTI 9908 2.52 1.87 2.81 79 XMSubMetaSx_00 9725 3.70 5.86 2.76 80 TooManyTo_002 9577 2.17 0.91 2.71 81 XMNumbers 9569 2.80 2.99 2.71 82 XM_Body_Dirty_Words 9422 4.21 7.77 2.67 83 RCVD_IN_IADB_SENDERID 9236 2.10 0.91 2.62 84 T_TooManySym_02 9119 2.00 0.66 2.58 85 RCVD_IN_IADB_DK 8979 2.05 0.91 2.54 86 HTML_IMAGE_RATIO_06 8693 2.78 3.52 2.46 87 BAYES_999 7935 8.10 21.56 2.25 88 HTML_MIME_NO_HTML_TAG 7714 1.93 1.35 2.19 89 MIME_HTML_ONLY_MULTI 7519 2.38 2.97 2.13 90 RCVD_IN_IADB_VOUCHED 7438 1.60 0.44 2.11 91 MIME_HTML_MOSTLY 7391 2.46 3.31 2.09 92 TM2_M_URI_OPT_OUT 7186 2.13 2.35 2.04 93 INVALID_MSGID 7134 1.48 0.23 2.02 94 DKIM_INVALID 6990 2.59 4.01 1.98 95 XM_CamelCaseFrm001 6775 2.18 2.78 1.92 96 TR_XM_DKIM_Undo 6706 8.41 23.40 1.90 97 TR_XM_SpammyRelay 6610 3.89 8.52 1.87 98 XMDiploma_00 6379 2.10 2.78 1.81 99 TO_MALFORMED 6303 1.25 0.01 1.79 100 TM2_M_VERY_LONG_WORD 6238 2.38 3.78 1.77 101 BOTNET 5987 3.28 6.93 1.70 102 BAYES_05 5949 1.36 0.62 1.69 103 XM_B_Unsub2 5881 1.81 2.15 1.67 104 XM_B_URI_Unicode 5762 1.84 2.33 1.63 105 TooManyTo_003 5584 1.36 0.85 1.58 106 FROM_EXCESS_BASE64 5556 1.71 2.02 1.57 107 XMGappySubj_01 5531 1.15 0.19 1.57 108 HTML_IMAGE_RATIO_08 5478 1.80 2.38 1.55 109 T_XMDrugObfuBody_14 5400 2.34 4.21 1.53 110 XM_DK_Undo_01 5201 1.48 1.49 1.47 111 RCVD_IN_IADB_OPTIN 5072 1.08 0.27 1.44 112 UNTRUSTED_Relay 5039 2.69 5.60 1.43 113 KHOP_HELO_FCRDNS 4769 1.36 1.38 1.35 114 FROM_GOV_DKIM_AU 4554 0.94 0.14 1.29 115 TR_Symld_Words 4523 1.18 0.94 1.28 116 T_XMDrugObfuBody_08 4519 1.59 2.29 1.28 117 RELAYCOUNTRY_NL 4502 0.93 0.15 1.28 118 IN_HORDE_ADDRESS_BOOK 4483 0.92 0.10 1.27 119 TR_XM_UnparsRelay 4368 3.13 7.47 1.24 120 TooManyTo_004 4289 1.09 0.79 1.22 121 XM_SPF_SoftFail 4250 1.60 2.52 1.20 122 XM_B_Investor 4132 2.13 4.34 1.17 123 XMGenDplmaNmb 4006 1.13 1.11 1.13 124 XM_SendGrid 3940 1.20 1.39 1.12 125 XMSexyCombo_05 3899 2.04 4.18 1.10 126 SUBJ_ALL_CAPS 3843 1.35 1.95 1.09 127 TVD_SPACE_RATIO 3834 0.80 0.13 1.09 128 XM_GoogleGroups 3791 0.93 0.60 1.07 129 TooManyTo_005 3681 0.95 0.75 1.04 130 RELAYCOUNTRY_CA 3649 1.99 4.19 1.03 131 TR_XM_PhishingBody 3556 1.92 4.02 1.01 132 TR_XM_SpammyWords5 3555 1.76 3.49 1.01 133 URI_HEX 3547 1.14 1.46 1.00 134 URI_NOVOWEL 3493 0.95 0.87 0.99 135 XMStockSpam_06 3428 1.19 1.68 0.97 136 XMCapTrack 3277 0.79 0.46 0.93 137 T_TooManySym_03 3212 0.70 0.22 0.91 138 HELO_NODOT 3153 0.70 0.25 0.89 139 HELO_NO_DOMAIN 3152 0.70 0.25 0.89 140 TR_DCC_Bayes_99 3117 7.38 22.34 0.88 141 XMGappySubj_02 3012 0.61 0.06 0.85 142 XM_OfRef6 2970 1.30 2.36 0.84 143 XM_UB50 2952 1.42 2.77 0.84 144 XM_H_Long_From02 2842 0.87 1.01 0.81 145 XMBrknScrpt_02 2822 1.02 1.53 0.80 146 SpammyFromTLD_01 2606 1.03 1.72 0.74 147 T_FILL_THIS_FORM_SHORT 2564 0.95 1.47 0.73 148 XM_B_DNDMA 2467 0.67 0.61 0.70 149 XMBody_95 2449 0.54 0.18 0.69 150 SpammyFromTLD_02 2443 1.16 2.24 0.69 151 TR_XM_DK_SendGrid 2429 0.70 0.74 0.69 152 HTTPS_HTTP_MISMATCH 2387 0.81 1.10 0.68 153 XM_B_FormFill 2387 0.48 0.04 0.68 154 T_XMHurry_00 2383 0.90 1.43 0.68 155 XMLngstWrd_00 2350 0.76 0.98 0.67 156 TR_MetaPhish_Combo_01 2333 0.73 0.90 0.66 157 RELAYCOUNTRY_AU 2307 1.15 2.30 0.65 158 DKIM_ADSP_CUSTOM_MED 2298 0.76 1.00 0.65 159 URI_TRY_3LD 2245 0.71 0.89 0.64 160 T_XMDrugObfuBody_00 2159 1.00 1.88 0.61 161 RCVD_IN_BL_SPAMCOP_NET 2091 2.78 7.82 0.59 162 XMWhlSbjSex 2054 0.50 0.32 0.58 163 XM_B_COPY_HTML 2035 0.93 1.75 0.58 164 T_TVD_MIME_NO_HEADERS 2023 0.42 0.06 0.57 165 XM_ShortIntro_01 2002 0.58 0.60 0.57 166 RCVD_IN_PBL 1983 0.58 0.61 0.56 167 XMHTML_After_End 1947 0.64 0.84 0.55 168 FILL_THIS_FORM 1935 0.42 0.13 0.55 169 XM_B_SpammyWords4 1855 0.98 2.03 0.53 170 XM_H_PHPMailer 1826 0.54 0.60 0.52 171 XMSubMetaI_00 1809 0.70 1.15 0.51 172 TM2_M_OBFU_COMMENT 1747 0.66 1.05 0.49 173 TR_XMSubLong 1727 2.03 5.58 0.49 174 TR_XM_Base64_M1 1719 0.68 1.12 0.49 175 XMBdyGiftCard01 1719 0.73 1.27 0.49 176 HTML_TAG_BALANCE_BODY 1677 0.69 1.18 0.48 177 TVD_RCVD_IP 1624 0.53 0.69 0.46 178 T_OBFU_PDF_ATTACH 1601 0.36 0.14 0.45 179 HTML_IMAGE_ONLY_32 1555 0.39 0.27 0.44 180 TO_NO_BRKTS_HTML_ONLY 1548 0.37 0.22 0.44 181 MPART_ALT_DIFF_COUNT 1521 0.54 0.80 0.43 182 XMDateMe_00 1520 0.43 0.42 0.43 183 XMBody_17 1511 0.98 2.25 0.43 184 XMSlimDrugH 1491 0.48 0.62 0.42 185 NML_ADSP_CUSTOM_MED 1481 0.52 0.74 0.42 186 XMMoneyMeta_00 1467 0.51 0.74 0.42 187 HTML_IMAGE_ONLY_20 1390 0.46 0.61 0.39 188 RELAYCOUNTRY_GB 1370 0.45 0.58 0.39 189 T_Symld_Words_02 1361 0.50 0.75 0.39 190 FORGED_GMAIL_RCVD 1351 0.46 0.64 0.38 191 XMLngstWrd_01 1349 0.53 0.86 0.38 192 TM2_M_BODY_EMPTY 1325 0.28 0.06 0.38 193 HTML_FONT_FACE_BAD 1321 0.39 0.43 0.37 194 MIME_CHARSET_FARAWAY 1316 0.47 0.69 0.37 195 XMSubMetaSxObfu_03 1305 0.47 0.71 0.37 196 XM_ProductURIs 1285 0.49 0.77 0.36 197 THIS_AD 1278 0.61 1.17 0.36 198 SUBJ_DOLLARS 1277 0.40 0.50 0.36 199 HTML_IMAGE_ONLY_28 1232 0.30 0.18 0.35 200 LongTLD 1225 0.59 1.16 0.35 ----------------------------------------------------------------------