Email: 437625 Autolearn: 0 AvgScore: 4.82 AvgScanTime: 1.35 sec Spam: 139785 Autolearn: 0 AvgScore: 14.62 AvgScanTime: 1.49 sec Ham: 297840 Autolearn: 0 AvgScore: 0.23 AvgScanTime: 1.29 sec Time Spent Running SA: 164.37 hours Time Spent Processing Spam: 57.77 hours Time Spent Processing Ham: 106.60 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132183 88.55 94.56 85.73 2 DKIM_SIGNED 126186 80.93 90.27 76.54 3 XM_DK_Pass 120515 78.72 86.21 75.20 4 DKIM_VALID 119294 77.72 85.34 74.15 5 RELAYCOUNTRY_US 118662 83.17 84.89 82.36 6 XM_B_Unicode 116803 74.06 83.56 69.60 7 DCC_CHECK 107554 52.10 76.94 40.44 8 XMListUnsubscribeExists 100152 55.81 71.65 48.38 9 XM_B_SpammyWords 99346 53.66 71.07 45.49 10 DKIM_VALID_AU 94792 62.35 67.81 59.79 11 LOC_TINY_FONT_1 71336 34.64 51.03 26.94 12 XM_B_Unicode3 70735 44.74 50.60 41.99 13 XM_B_SpammyWords2 58330 25.89 41.73 18.46 14 BAYES_50 56091 53.57 40.13 59.88 15 XM_DK_Undo_02 54732 16.36 39.15 5.67 16 RCVD_IN_MSPIKE_H2 53100 35.65 37.99 34.55 17 HTML_FONT_LOW_CONTRAST 52358 30.96 37.46 27.91 18 FVGT_m_MULTI_ODD 46503 27.84 33.27 25.30 19 T_KAM_HTML_FONT_INVALID 44870 24.14 32.10 20.40 20 DKIM_VALID_EF 41727 29.37 29.85 29.14 21 BAYES_99 40398 11.83 28.90 3.81 22 TR_XM_DKIM_Undo 38888 10.36 27.82 2.16 23 MIME_HTML_ONLY 35597 22.10 25.47 20.52 24 XMSubLong 33792 23.94 24.17 23.83 25 XM_Multi_Part_URI 32777 16.54 23.45 13.30 26 BAYES_999 30526 9.00 21.84 2.97 27 TR_DCC_Bayes_99 30090 7.81 21.53 1.37 28 DCC_CHECK_NEGATIVE 29850 47.33 21.35 59.52 29 T_TM2_M_HEADER_IN_MSG 29350 27.21 21.00 30.12 30 TR_XM_DK_Unsub 28939 15.07 20.70 12.42 31 UNPARSEABLE_RELAY 25027 13.23 17.90 11.04 32 TR_MAX_INTL_RELAY 22885 9.27 16.37 5.94 33 XM_B_Unsub 21918 11.50 15.68 9.55 34 TR_XM_BayesUnsub 21162 9.71 15.14 7.17 35 XM_B_SpammyWords3 20881 8.21 14.94 5.06 36 RELAYCOUNTRY_META 19815 7.05 14.18 3.70 37 LOTS_OF_MONEY 18596 8.52 13.30 6.27 38 TR_XM_SpammyWords4 16552 6.81 11.84 4.45 39 TR_XM_SpammyWords2 16452 4.05 11.77 0.43 40 XM_Body_Dirty_Words 15622 5.61 11.18 3.00 41 BOTNET_IPINHOSTNAME 14817 6.14 10.60 4.04 42 TR_XM_SpammyRelay 14731 4.78 10.54 2.07 43 RCVD_IN_BL_SPAMCOP_NET 14574 3.91 10.43 0.85 44 BAYES_80 14013 5.75 10.02 3.75 45 TR_XM_SPAMCOP 13181 3.37 9.43 0.52 46 FSL_BULK_SIG 12961 8.56 9.27 8.23 47 XM_Evil_Numbers_Gen 12916 9.25 9.24 9.26 48 BAYES_60 12706 8.64 9.09 8.43 49 TR_XM_UnparsRelay 12472 3.80 8.92 1.39 50 BOTNET 11690 3.88 8.36 1.78 51 LotsOfNums_01 11532 8.31 8.25 8.34 52 XM_B_Phish_Phrases 11506 6.41 8.23 5.56 53 XMSubMetaSx_00 9715 5.45 6.95 4.74 54 XM_H_Long_From01 9008 5.97 6.44 5.75 55 MPART_ALT_DIFF 8906 5.16 6.37 4.59 56 XM_H_GMP 8635 5.37 6.18 4.99 57 HTML_IMAGE_RATIO_02 8579 5.33 6.14 4.95 58 BAYES_95 8501 3.43 6.08 2.19 59 XM_UncommonTLD01 8156 4.78 5.83 4.29 60 UNTRUSTED_Relay 7407 2.65 5.30 1.40 61 XM_B_PhoneNumber 7250 7.89 5.19 9.16 62 RELAYCOUNTRY_CA 7206 2.33 5.16 1.00 63 XMSexyCombo_05 6980 2.88 4.99 1.89 64 DKIM_INVALID 6892 3.20 4.93 2.39 65 XM_B_Investor 6504 2.57 4.65 1.59 66 HTML_IMAGE_RATIO_04 6427 4.41 4.60 4.32 67 T_XMDrugObfuBody_14 6365 2.69 4.55 1.82 68 TM2_M_VERY_LONG_WORD 6113 2.75 4.37 1.99 69 XM_B_SpammyTLD 6053 3.14 4.33 2.59 70 RCVD_IN_MSPIKE_WL 5971 5.13 4.27 5.54 71 RCVD_IN_MSPIKE_H3 5971 5.13 4.27 5.54 72 TR_XM_PhishingBody 5550 2.28 3.97 1.49 73 HTML_IMAGE_RATIO_06 5332 3.20 3.81 2.91 74 XM_OfRef6 5326 1.94 3.81 1.06 75 MIME_HTML_ONLY_MULTI 5190 2.95 3.71 2.59 76 TooManyTo_001 5110 6.87 3.66 8.37 77 XMStrtUSub 4910 4.40 3.51 4.82 78 TR_XM_SpammyWords5 4746 1.92 3.40 1.22 79 XMNumbers 4711 2.98 3.37 2.79 80 XM_CamelCaseFrm001 4498 2.85 3.22 2.67 81 MIME_HTML_MOSTLY 4497 2.74 3.22 2.52 82 XM_SPF_SoftFail 4201 1.94 3.01 1.43 83 HTML_IMAGE_RATIO_08 4172 2.23 2.98 1.87 84 RCVD_IN_VALIDITY_RPBL 4092 0.98 2.93 0.07 85 MIME_QP_LONG_LINE 4042 4.48 2.89 5.22 86 T_XMDrugObfuBody_00 3855 1.50 2.76 0.92 87 T_XMDrugObfuBody_08 3824 1.78 2.74 1.33 88 RCVD_IN_VALIDITY_SAFE 3814 4.16 2.73 4.83 89 RELAYCOUNTRY_AU 3673 1.36 2.63 0.76 90 SUSP_UTF8_WORD_SUBJ 3665 0.85 2.62 0.02 91 SUSP_UTF8_WORD_COMBO 3644 0.86 2.61 0.04 92 XMBody_17 3580 1.11 2.56 0.43 93 T_TooManySym_01 3563 5.37 2.55 6.70 94 XM_UB50 3521 1.36 2.52 0.82 95 XM_URI_RBL 3507 1.01 2.51 0.30 96 DKIM_ADSP_NXDOMAIN 3501 1.00 2.50 0.29 97 TM2_M_URI_OPT_OUT 3475 1.98 2.49 1.74 98 T_XMHurry_00 3464 1.16 2.48 0.54 99 XM_B_SpammyWords4 3396 1.23 2.43 0.66 100 XM_B_URI_Unicode 3280 1.92 2.35 1.72 101 XMDiploma_00 3228 1.82 2.31 1.59 102 NO_DNS_FOR_FROM 3065 0.88 2.19 0.27 103 TR_XM_MaxWHORU 3055 0.85 2.19 0.22 104 FROM_EXCESS_BASE64 3010 2.25 2.15 2.30 105 XM_B_Unsub2 2968 1.82 2.12 1.68 106 MAILING_LIST_MULTI 2899 2.71 2.07 3.00 107 USER_IN_DEF_DKIM_WL 2880 10.11 2.06 13.89 108 XM_H_Undi_Recip 2869 0.77 2.05 0.17 109 XM_DK_Undo_01 2705 1.81 1.94 1.75 110 SpammyFromTLD_02 2660 1.06 1.90 0.67 111 T_REMOTE_IMAGE 2582 3.22 1.85 3.86 112 TR_LOTS_OF_MONEY3 2532 0.80 1.81 0.33 113 TR_XM_Undi_Recip19 2517 0.63 1.80 0.08 114 XMBrknScrpt_02 2490 1.23 1.78 0.97 115 TR_XM_NoHeaderRelay 2482 0.76 1.78 0.28 116 XMStockSpam_06 2447 1.42 1.75 1.26 117 RCVD_IN_VALIDITY_CERTIFIED 2423 3.10 1.73 3.73 118 SHORTCIRCUIT 2337 0.53 1.67 0.00 119 RCVD_IN_ZEN_LASTEXTERNAL 2337 0.53 1.67 0.00 120 TR_XM_Undi_RecipCombo2 2332 0.54 1.67 0.01 121 XMReplyNow 2306 0.72 1.65 0.28 122 TR_XM_INV_DKIM 2301 0.57 1.65 0.06 123 XMPhish30 2299 0.88 1.64 0.52 124 SpammyFromTLD_01 2253 1.15 1.61 0.93 125 XM_B_COPY_HTML 2226 1.18 1.59 0.99 126 SUBJ_ALL_CAPS 2182 1.38 1.56 1.29 127 BAYES_40 2154 3.59 1.54 4.56 128 XMBody_78 2073 0.70 1.48 0.34 129 XMSubMetaI_00 2051 0.85 1.47 0.56 130 XM_SendGrid 2043 1.43 1.46 1.41 131 TR_XM_PHPDW 2032 0.73 1.45 0.39 132 TR_XM_Undi_Recip11 2025 0.49 1.45 0.05 133 HTML_MIME_NO_HTML_TAG 2023 2.13 1.45 2.46 134 TR_XM_PHPForged 2019 0.73 1.44 0.39 135 TR_XM_FormFill2 1976 0.72 1.41 0.40 136 DIET_1 1962 0.81 1.40 0.53 137 XM_H_PHPOS 1949 0.70 1.39 0.38 138 T_FILL_THIS_FORM_SHORT 1889 1.09 1.35 0.97 139 DKIM_ADSP_CUSTOM_MED 1873 0.98 1.34 0.82 140 TR_XM_Undi_RecipCombo3 1865 0.43 1.33 0.00 141 ALL_TRUSTED 1854 10.41 1.33 14.67 142 URI_HEX 1837 1.16 1.31 1.09 143 URI_NOVOWEL 1828 1.33 1.31 1.33 144 XM_H_Long_From02 1802 1.06 1.29 0.95 145 XMGenDplmaNmb 1760 0.92 1.26 0.76 146 RCVD_IN_IADB_LISTED 1750 3.11 1.25 3.98 147 HTML_TAG_BALANCE_BODY 1718 0.77 1.23 0.55 148 XM_B_SEO 1696 0.56 1.21 0.25 149 URI_TRY_3LD 1692 0.79 1.21 0.59 150 XM_DIRTYINTL 1683 0.46 1.20 0.11 151 TR_XM_Spammywords 1650 0.57 1.18 0.29 152 XM_S_SpammyWords 1650 0.57 1.18 0.29 153 LongTLD 1639 0.65 1.17 0.40 154 SHOPIFY_IMG_NOT_RCVD_SFY 1626 0.52 1.16 0.22 155 TR_Symld_Words 1619 1.33 1.16 1.41 156 HTTPS_HTTP_MISMATCH 1618 1.11 1.16 1.09 157 BAYES_20 1606 2.64 1.15 3.34 158 XMBdyGiftCard01 1597 0.82 1.14 0.66 159 TR_XM_Base64_M1 1592 0.89 1.14 0.77 160 XMMoneyMeta_00 1591 0.74 1.14 0.55 161 TM2_M_OBFU_COMMENT 1588 0.79 1.14 0.62 162 T_STY_INVIS_DIRECT 1580 0.63 1.13 0.40 163 RCVD_IN_IADB_SPF 1545 2.75 1.11 3.51 164 THIS_AD 1526 0.70 1.09 0.51 165 XM_B_COVIDMETA 1502 0.51 1.07 0.25 166 TR_XM_RelayPhish 1491 0.39 1.07 0.07 167 RCVD_IN_IADB_DK 1483 2.44 1.06 3.08 168 RCVD_IN_IADB_SENDERID 1476 2.49 1.06 3.16 169 MPART_ALT_DIFF_COUNT 1468 0.73 1.05 0.58 170 NML_ADSP_CUSTOM_MED 1460 0.70 1.04 0.53 171 TR_XM_SEO4 1457 0.42 1.04 0.13 172 MIME_CHARSET_FARAWAY 1438 0.58 1.03 0.37 173 XM_OfRef7 1438 0.45 1.03 0.18 174 UNDISC_MONEY 1402 0.32 1.00 0.00 175 TM2_M_A_HREF_HREF 1368 0.56 0.98 0.36 176 XM_ProductURIs 1368 0.95 0.98 0.94 177 KHOP_HELO_FCRDNS 1360 1.75 0.97 2.11 178 XMSexyCombo_01 1359 0.43 0.97 0.18 179 RELAYCOUNTRY_FR 1359 0.47 0.97 0.24 180 RDNS_DYNAMIC 1337 0.85 0.96 0.80 181 XM_B_Phish66 1334 0.54 0.95 0.34 182 TR_XM_Undi_Recip5 1332 0.31 0.95 0.00 183 PDS_RDNS_DYNAMIC_FP 1321 0.72 0.95 0.62 184 XMSubMetaSxObfu_03 1313 0.72 0.94 0.61 185 FORGED_GMAIL_RCVD 1287 0.63 0.92 0.50 186 TR_LOTS_OF_MONEY2 1272 0.43 0.91 0.21 187 T_MONEY_PERCENT 1272 0.43 0.91 0.21 188 BOTNET_NORDNS 1268 0.31 0.91 0.03 189 URG_BIZ 1223 0.31 0.87 0.05 190 RELAYCOUNTRY_GB 1222 0.62 0.87 0.51 191 TooManyTo_002 1206 2.34 0.86 3.03 192 FROM_SUSPICIOUS_NTLD 1172 0.29 0.84 0.03 193 T_TooManySym_02 1166 2.31 0.83 3.01 194 URIBL_BLACK 1166 0.31 0.83 0.07 195 BAYES_00 1145 8.41 0.82 11.97 196 XMHTML_After_End 1144 0.45 0.82 0.28 197 TVD_RCVD_IP 1141 0.65 0.82 0.57 198 J_POPCORN_W_RD 1137 0.46 0.81 0.29 199 XM_UB60 1107 0.29 0.79 0.06 200 TR_XM_Undi_Recip4 1103 0.25 0.79 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 255352 88.55 94.56 85.73 2 RELAYCOUNTRY_US 245294 83.17 84.89 82.36 3 DKIM_SIGNED 227968 80.93 90.27 76.54 4 XM_DK_Pass 223989 78.72 86.21 75.20 5 DKIM_VALID 220837 77.72 85.34 74.15 6 XM_B_Unicode 207287 74.06 83.56 69.60 7 BAYES_50 178341 53.57 40.13 59.88 8 DKIM_VALID_AU 178089 62.35 67.81 59.79 9 DCC_CHECK_NEGATIVE 177266 47.33 21.35 59.52 10 XMListUnsubscribeExists 144081 55.81 71.65 48.38 11 XM_B_SpammyWords 135491 53.66 71.07 45.49 12 XM_B_Unicode3 125050 44.74 50.60 41.99 13 DCC_CHECK 120439 52.10 76.94 40.44 14 RCVD_IN_MSPIKE_H2 102906 35.65 37.99 34.55 15 T_TM2_M_HEADER_IN_MSG 89719 27.21 21.00 30.12 16 DKIM_VALID_EF 86792 29.37 29.85 29.14 17 HTML_FONT_LOW_CONTRAST 83122 30.96 37.46 27.91 18 LOC_TINY_FONT_1 80246 34.64 51.03 26.94 19 FVGT_m_MULTI_ODD 75340 27.84 33.27 25.30 20 XMSubLong 70968 23.94 24.17 23.83 21 MIME_HTML_ONLY 61109 22.10 25.47 20.52 22 T_KAM_HTML_FONT_INVALID 60759 24.14 32.10 20.40 23 XM_B_SpammyWords2 54990 25.89 41.73 18.46 24 ALL_TRUSTED 43708 10.41 1.33 14.67 25 USER_IN_DEF_DKIM_WL 41359 10.11 2.06 13.89 26 XM_Multi_Part_URI 39620 16.54 23.45 13.30 27 TR_XM_DK_Unsub 37002 15.07 20.70 12.42 28 BAYES_00 35659 8.41 0.82 11.97 29 UNPARSEABLE_RELAY 32869 13.23 17.90 11.04 30 XM_B_Unsub 28430 11.50 15.68 9.55 31 XM_Evil_Numbers_Gen 27572 9.25 9.24 9.26 32 XM_B_PhoneNumber 27269 7.89 5.19 9.16 33 BAYES_60 25105 8.64 9.09 8.43 34 TooManyTo_001 24939 6.87 3.66 8.37 35 LotsOfNums_01 24839 8.31 8.25 8.34 36 FSL_BULK_SIG 24512 8.56 9.27 8.23 37 TR_XM_DK_Bayes 23630 5.62 0.67 7.93 38 TR_XM_DK_Bayes1 23391 5.56 0.67 7.85 39 IN_ZIMBRA_NJ_WHITELIST 21856 5.02 0.08 7.34 40 XM_DKIMWhitelistDomains 21707 4.98 0.05 7.29 41 TR_XM_BayesUnsub 21342 9.71 15.14 7.17 42 TR_XM_DK_Bayes2 20296 4.78 0.43 6.81 43 T_TooManySym_01 19946 5.37 2.55 6.70 44 LOTS_OF_MONEY 18674 8.52 13.30 6.27 45 TR_MAX_INTL_RELAY 17698 9.27 16.37 5.94 46 XM_H_Long_From01 17134 5.97 6.44 5.75 47 XM_DK_Undo_02 16883 16.36 39.15 5.67 48 XM_B_Phish_Phrases 16553 6.41 8.23 5.56 49 RCVD_IN_MSPIKE_WL 16489 5.13 4.27 5.54 50 RCVD_IN_MSPIKE_H3 16488 5.13 4.27 5.54 51 MIME_QP_LONG_LINE 15543 4.48 2.89 5.22 52 XM_B_SpammyWords3 15058 8.21 14.94 5.06 53 XM_H_GMP 14869 5.37 6.18 4.99 54 HTML_IMAGE_RATIO_02 14732 5.33 6.14 4.95 55 RCVD_IN_VALIDITY_SAFE 14399 4.16 2.73 4.83 56 XMStrtUSub 14352 4.40 3.51 4.82 57 XMSubMetaSx_00 14127 5.45 6.95 4.74 58 XM_PDF 13959 3.38 0.61 4.69 59 MPART_ALT_DIFF 13666 5.16 6.37 4.59 60 BAYES_40 13578 3.59 1.54 4.56 61 TR_XM_SpammyWords4 13257 6.81 11.84 4.45 62 HTML_IMAGE_RATIO_04 12880 4.41 4.60 4.32 63 XM_UncommonTLD01 12772 4.78 5.83 4.29 64 BOTNET_IPINHOSTNAME 12039 6.14 10.60 4.04 65 RCVD_IN_IADB_LISTED 11845 3.11 1.25 3.98 66 T_REMOTE_IMAGE 11509 3.22 1.85 3.86 67 BAYES_99 11362 11.83 28.90 3.81 68 BAYES_80 11171 5.75 10.02 3.75 69 RCVD_IN_VALIDITY_CERTIFIED 11124 3.10 1.73 3.73 70 RELAYCOUNTRY_META 11032 7.05 14.18 3.70 71 ANY_BOUNCE_MESSAGE 10786 2.67 0.64 3.62 72 BOUNCE_MESSAGE 10785 2.67 0.64 3.62 73 RCVD_IN_IADB_SPF 10469 2.75 1.11 3.51 74 BAYES_20 9959 2.64 1.15 3.34 75 RCVD_IN_IADB_SENDERID 9404 2.49 1.06 3.16 76 RCVD_IN_IADB_DK 9174 2.44 1.06 3.08 77 TooManyTo_002 9034 2.34 0.86 3.03 78 T_TooManySym_02 8964 2.31 0.83 3.01 79 MAILING_LIST_MULTI 8950 2.71 2.07 3.00 80 XM_Body_Dirty_Words 8937 5.61 11.18 3.00 81 BAYES_999 8842 9.00 21.84 2.97 82 HTML_IMAGE_RATIO_06 8677 3.20 3.81 2.91 83 XMNumbers 8313 2.98 3.37 2.79 84 XM_CamelCaseFrm001 7958 2.85 3.22 2.67 85 MIME_HTML_ONLY_MULTI 7724 2.95 3.71 2.59 86 XM_B_SpammyTLD 7703 3.14 4.33 2.59 87 MIME_HTML_MOSTLY 7500 2.74 3.22 2.52 88 RCVD_IN_IADB_VOUCHED 7412 1.86 0.53 2.49 89 HTML_MIME_NO_HTML_TAG 7313 2.13 1.45 2.46 90 DKIM_INVALID 7131 3.20 4.93 2.39 91 INVALID_MSGID 7103 1.67 0.16 2.38 92 FROM_EXCESS_BASE64 6838 2.25 2.15 2.30 93 BAYES_95 6521 3.43 6.08 2.19 94 TR_XM_DKIM_Undo 6445 10.36 27.82 2.16 95 KHOP_HELO_FCRDNS 6278 1.75 0.97 2.11 96 TO_MALFORMED 6236 1.43 0.03 2.09 97 TR_XM_SpammyRelay 6166 4.78 10.54 2.07 98 BAYES_05 6140 1.59 0.59 2.06 99 TM2_M_VERY_LONG_WORD 5923 2.75 4.37 1.99 100 XMSexyCombo_05 5636 2.88 4.99 1.89 101 HTML_IMAGE_RATIO_08 5577 2.23 2.98 1.87 102 T_XMDrugObfuBody_14 5413 2.69 4.55 1.82 103 BOTNET 5302 3.88 8.36 1.78 104 RCVD_IN_IADB_OPTIN 5223 1.30 0.33 1.75 105 XM_DK_Undo_01 5210 1.81 1.94 1.75 106 TM2_M_URI_OPT_OUT 5170 1.98 2.49 1.74 107 XM_B_URI_Unicode 5111 1.92 2.35 1.72 108 XM_B_Unsub2 5017 1.82 2.12 1.68 109 XMGappySubj_01 4983 1.19 0.15 1.67 110 IN_HORDE_ADDRESS_BOOK 4888 1.15 0.10 1.64 111 TooManyTo_003 4850 1.36 0.77 1.63 112 XMDiploma_00 4742 1.82 2.31 1.59 113 XM_B_Investor 4731 2.57 4.65 1.59 114 TR_XM_PhishingBody 4423 2.28 3.97 1.49 115 XM_SPF_SoftFail 4270 1.94 3.01 1.43 116 XM_SendGrid 4206 1.43 1.46 1.41 117 TR_Symld_Words 4196 1.33 1.16 1.41 118 UNTRUSTED_Relay 4171 2.65 5.30 1.40 119 TR_XM_UnparsRelay 4140 3.80 8.92 1.39 120 TR_DCC_Bayes_99 4090 7.81 21.53 1.37 121 URI_NOVOWEL 3972 1.33 1.31 1.33 122 T_XMDrugObfuBody_08 3956 1.78 2.74 1.33 123 SUBJ_ALL_CAPS 3848 1.38 1.56 1.29 124 TVD_SPACE_RATIO 3785 0.90 0.10 1.27 125 XMStockSpam_06 3765 1.42 1.75 1.26 126 FROM_GOV_DKIM_AU 3685 0.90 0.17 1.24 127 TR_XM_SpammyWords5 3647 1.92 3.40 1.22 128 XM_GoogleGroups 3643 1.05 0.67 1.22 129 TooManyTo_004 3587 1.05 0.73 1.20 130 TR_MetaPhish_Combo_01 3513 1.04 0.75 1.18 131 XMCapTrack 3286 0.90 0.46 1.10 132 URI_HEX 3260 1.16 1.31 1.09 133 HTTPS_HTTP_MISMATCH 3257 1.11 1.16 1.09 134 HELO_NODOT 3214 0.83 0.29 1.08 135 HELO_NO_DOMAIN 3212 0.83 0.29 1.08 136 T_TooManySym_03 3211 0.79 0.17 1.08 137 XM_OfRef6 3148 1.94 3.81 1.06 138 XMBody_95 3076 0.75 0.16 1.03 139 RELAYCOUNTRY_CA 2993 2.33 5.16 1.00 140 TooManyTo_005 2972 0.90 0.69 1.00 141 XM_B_COPY_HTML 2937 1.18 1.59 0.99 142 XMBrknScrpt_02 2897 1.23 1.78 0.97 143 T_FILL_THIS_FORM_SHORT 2881 1.09 1.35 0.97 144 XM_H_Long_From02 2841 1.06 1.29 0.95 145 XM_ProductURIs 2809 0.95 0.98 0.94 146 SpammyFromTLD_01 2778 1.15 1.61 0.93 147 T_XMDrugObfuBody_00 2731 1.50 2.76 0.92 148 TR_XM_DK_SendGrid 2590 0.83 0.74 0.87 149 RCVD_IN_BL_SPAMCOP_NET 2517 3.91 10.43 0.85 150 XM_UB50 2438 1.36 2.52 0.82 151 DKIM_ADSP_CUSTOM_MED 2435 0.98 1.34 0.82 152 RDNS_DYNAMIC 2385 0.85 0.96 0.80 153 XMGappySubj_02 2364 0.56 0.05 0.79 154 T_TVD_MIME_NO_HEADERS 2355 0.55 0.04 0.79 155 TR_XM_Base64_M1 2305 0.89 1.14 0.77 156 XMGenDplmaNmb 2263 0.92 1.26 0.76 157 RELAYCOUNTRY_AU 2263 1.36 2.63 0.76 158 XMNoVowels 2253 0.69 0.53 0.76 159 XM_H_PHPMailer 2214 0.72 0.67 0.74 160 RCVD_IN_PBL 2183 0.73 0.72 0.73 161 XM_B_FormFill 2015 0.47 0.04 0.68 162 SpammyFromTLD_02 1997 1.06 1.90 0.67 163 XM_RXBody 1981 0.62 0.52 0.67 164 XM_B_SpammyWords4 1977 1.23 2.43 0.66 165 XMBdyGiftCard01 1973 0.82 1.14 0.66 166 XM_ShortIntro_01 1972 0.64 0.59 0.66 167 TM2_M_OBFU_COMMENT 1860 0.79 1.14 0.62 168 PDS_RDNS_DYNAMIC_FP 1836 0.72 0.95 0.62 169 XMSubMetaSxObfu_03 1822 0.72 0.94 0.61 170 XM_B_DNDMA 1804 0.66 0.79 0.61 171 URI_TRY_3LD 1766 0.79 1.21 0.59 172 MPART_ALT_DIFF_COUNT 1715 0.73 1.05 0.58 173 XMSlimDrugH 1714 0.60 0.66 0.58 174 TVD_RCVD_IP 1709 0.65 0.82 0.57 175 XMSubMetaI_00 1666 0.85 1.47 0.56 176 XMMoneyMeta_00 1650 0.74 1.14 0.55 177 HTML_TAG_BALANCE_BODY 1648 0.77 1.23 0.55 178 T_XMHurry_00 1601 1.16 2.48 0.54 179 NML_ADSP_CUSTOM_MED 1585 0.70 1.04 0.53 180 MISSING_HEADERS 1575 0.53 0.52 0.53 181 DIET_1 1565 0.81 1.40 0.53 182 TR_XM_SPAMCOP 1557 3.37 9.43 0.52 183 XMPhish30 1557 0.88 1.64 0.52 184 THIS_AD 1533 0.70 1.09 0.51 185 XMLngstWrd_00 1525 0.50 0.46 0.51 186 RELAYCOUNTRY_GB 1506 0.62 0.87 0.51 187 T_OBFU_PDF_ATTACH 1501 0.38 0.12 0.50 188 FORGED_GMAIL_RCVD 1477 0.63 0.92 0.50 189 HTML_FONT_FACE_BAD 1399 0.56 0.75 0.47 190 MSGID_FROM_MTA_HEADER 1375 0.35 0.11 0.46 191 FILL_THIS_FORM 1357 0.53 0.68 0.46 192 PLING_QUERY 1353 0.53 0.70 0.45 193 TO_NO_BRKTS_HTML_ONLY 1319 0.38 0.25 0.44 194 TR_XM_SpammyWords2 1279 4.05 11.77 0.43 195 XMBody_17 1274 1.11 2.56 0.43 196 HTML_IMAGE_ONLY_20 1261 0.47 0.58 0.42 197 TM2_M_BODY_EMPTY 1248 0.30 0.05 0.42 198 HTML_IMAGE_ONLY_28 1244 0.36 0.23 0.42 199 XMLngstWrd_01 1236 0.41 0.40 0.41 200 XMClaimOffer 1226 0.39 0.35 0.41 ----------------------------------------------------------------------