Email: 460745 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.31 sec Spam: 139774 Autolearn: 0 AvgScore: 15.06 AvgScanTime: 1.41 sec Ham: 320971 Autolearn: 0 AvgScore: 0.13 AvgScanTime: 1.27 sec Time Spent Running SA: 167.92 hours Time Spent Processing Spam: 54.65 hours Time Spent Processing Ham: 113.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132119 89.27 94.52 86.98 2 DKIM_SIGNED 121827 75.97 87.16 71.10 3 XM_DK_Pass 115740 73.56 82.81 69.54 4 RELAYCOUNTRY_US 114766 80.97 82.11 80.47 5 DKIM_VALID 113433 72.22 81.15 68.34 6 XM_B_Unicode 113011 71.89 80.85 67.98 7 DCC_CHECK 106107 47.87 75.91 35.65 8 XMListUnsubscribeExists 94963 50.92 67.94 43.51 9 XM_B_SpammyWords 93521 49.61 66.91 42.07 10 DKIM_VALID_AU 90095 57.57 64.46 54.57 11 XM_B_Unicode3 68119 42.03 48.74 39.11 12 LOC_TINY_FONT_1 65298 30.49 46.72 23.43 13 BAYES_50 55643 53.47 39.81 59.42 14 XM_B_SpammyWords2 54163 23.37 38.75 16.68 15 XM_DK_Undo_02 54054 14.66 38.67 4.21 16 RCVD_IN_MSPIKE_H2 52264 34.23 37.39 32.86 17 HTML_FONT_LOW_CONTRAST 50109 29.62 35.85 26.91 18 FVGT_m_MULTI_ODD 45471 25.94 32.53 23.07 19 T_KAM_HTML_FONT_INVALID 44316 22.54 31.71 18.55 20 BAYES_99 42448 11.39 30.37 3.13 21 MIME_HTML_ONLY 40337 22.48 28.86 19.71 22 DKIM_VALID_EF 40024 28.79 28.63 28.86 23 TR_XM_DKIM_Undo 37106 9.20 26.55 1.65 24 BAYES_999 32847 8.73 23.50 2.30 25 XMSubLong 32528 23.44 23.27 23.51 26 TR_DCC_Bayes_99 31361 7.53 22.44 1.03 27 DCC_CHECK_NEGATIVE 30737 51.47 21.99 64.30 28 XM_Multi_Part_URI 29476 14.85 21.09 12.14 29 T_TM2_M_HEADER_IN_MSG 29127 29.58 20.84 33.39 30 TR_XM_DK_Unsub 27673 14.11 19.80 11.63 31 UNPARSEABLE_RELAY 24571 13.10 17.58 11.14 32 XM_B_Unsub 22747 11.63 16.27 9.61 33 RELAYCOUNTRY_META 22179 7.44 15.87 3.76 34 TR_XM_BayesUnsub 21927 9.41 15.69 6.67 35 TR_MAX_INTL_RELAY 21579 8.20 15.44 5.05 36 XM_B_SpammyWords3 16954 6.23 12.13 3.67 37 TR_XM_SpammyWords2 15842 3.68 11.33 0.34 38 LOTS_OF_MONEY 15826 7.64 11.32 6.04 39 FSL_BULK_SIG 15218 8.22 10.89 7.05 40 XM_Evil_Numbers_Gen 14129 9.74 10.11 9.58 41 TR_XM_SpammyWords4 14081 5.97 10.07 4.18 42 TR_XM_SpammyRelay 13723 4.30 9.82 1.90 43 BOTNET_IPINHOSTNAME 13632 4.88 9.75 2.76 44 RCVD_IN_BL_SPAMCOP_NET 12987 3.17 9.29 0.51 45 BAYES_80 12947 4.95 9.26 3.07 46 BOTNET 12511 3.58 8.95 1.24 47 BAYES_60 12095 8.22 8.65 8.03 48 TR_XM_UnparsRelay 12054 3.65 8.62 1.49 49 LotsOfNums_01 11708 9.21 8.38 9.58 50 UNTRUSTED_Relay 11235 3.52 8.04 1.56 51 XM_Body_Dirty_Words 10841 3.88 7.76 2.20 52 XM_UncommonTLD01 10426 5.22 7.46 4.25 53 XM_B_Phish_Phrases 10182 5.82 7.28 5.19 54 TR_XM_SPAMCOP 9964 2.38 7.13 0.31 55 HTML_IMAGE_RATIO_02 9861 5.26 7.05 4.48 56 XMSubMetaSx_00 9642 4.79 6.90 3.88 57 MPART_ALT_DIFF 8868 4.74 6.34 4.04 58 XM_H_Long_From01 8543 5.50 6.11 5.24 59 DKIM_INVALID 8394 3.74 6.01 2.76 60 RCVD_IN_VALIDITY_RPBL 8222 1.95 5.88 0.24 61 XM_B_PhoneNumber 7900 8.87 5.65 10.27 62 BAYES_95 7811 3.08 5.59 1.98 63 XM_H_GMP 7516 5.76 5.38 5.92 64 RELAYCOUNTRY_CA 6734 2.21 4.82 1.08 65 XMStrtUSub 6714 4.95 4.80 5.01 66 XMSexyCombo_05 6429 2.60 4.60 1.74 67 XMNumbers 6293 3.56 4.50 3.15 68 TR_XM_PhishingBody 5938 2.38 4.25 1.57 69 T_REMOTE_IMAGE 5863 3.83 4.19 3.67 70 XM_B_Investor 5843 2.19 4.18 1.32 71 HTML_IMAGE_RATIO_04 5825 3.64 4.17 3.41 72 XM_B_SpammyTLD 5790 2.67 4.14 2.04 73 T_XMDrugObfuBody_14 5789 3.01 4.14 2.52 74 TR_XM_SpammyWords5 5689 2.20 4.07 1.38 75 TooManyTo_001 5547 7.98 3.97 9.73 76 RCVD_IN_MSPIKE_WL 5375 4.98 3.85 5.47 77 RCVD_IN_MSPIKE_H3 5375 4.98 3.85 5.47 78 TM2_M_VERY_LONG_WORD 5140 4.01 3.68 4.15 79 XM_CamelCaseFrm001 4859 2.39 3.48 1.92 80 XM_SPF_SoftFail 4780 2.36 3.42 1.91 81 HTML_IMAGE_RATIO_06 4728 2.68 3.38 2.38 82 XM_UB50 4720 1.68 3.38 0.93 83 MIME_HTML_MOSTLY 4718 2.55 3.38 2.20 84 MIME_HTML_ONLY_MULTI 4630 2.60 3.31 2.29 85 XM_OfRef6 4326 1.72 3.09 1.13 86 XMDiploma_00 3987 2.07 2.85 1.73 87 TM2_M_URI_OPT_OUT 3980 2.03 2.85 1.68 88 MIME_QP_LONG_LINE 3805 4.32 2.72 5.01 89 XM_B_Unsub2 3765 1.66 2.69 1.20 90 T_XMDrugObfuBody_08 3757 1.89 2.69 1.54 91 RELAYCOUNTRY_AU 3701 1.20 2.65 0.57 92 XM_URI_RBL 3575 0.98 2.56 0.30 93 HTML_IMAGE_ONLY_08 3526 0.91 2.52 0.20 94 HTML_IMAGE_RATIO_08 3470 1.92 2.48 1.68 95 HTML_SHORT_LINK_IMG_1 3420 0.80 2.45 0.09 96 T_TooManySym_01 3417 4.75 2.44 5.75 97 HDRS_LCASE_IMGONLY 3393 0.79 2.43 0.07 98 XM_B_URI_Unicode 3376 2.15 2.42 2.03 99 TR_XM_NoHeaderRelay 3364 0.93 2.41 0.29 100 SpammyFromTLD_02 3282 0.86 2.35 0.22 101 LongTLD 3143 1.05 2.25 0.53 102 DKIM_ADSP_NXDOMAIN 3125 0.90 2.24 0.31 103 MAILING_LIST_MULTI 3091 2.90 2.21 3.20 104 FROM_EXCESS_BASE64 3062 1.91 2.19 1.79 105 RCVD_IN_VALIDITY_SAFE 3035 3.47 2.17 4.04 106 SHORTCIRCUIT 2888 0.63 2.07 0.00 107 RCVD_IN_ZEN_LASTEXTERNAL 2888 0.63 2.07 0.00 108 T_XMHurry_00 2861 0.94 2.05 0.45 109 T_XMDrugObfuBody_00 2827 1.23 2.02 0.88 110 XM_DK_Undo_01 2819 1.74 2.02 1.62 111 NO_DNS_FOR_FROM 2790 0.80 2.00 0.28 112 XM_B_SpammyWords4 2784 0.96 1.99 0.51 113 TR_XM_INV_DKIM 2771 0.67 1.98 0.10 114 TR_XM_MaxWHORU 2737 0.75 1.96 0.22 115 XMStockSpam_06 2689 1.37 1.92 1.13 116 T_FILL_THIS_FORM_SHORT 2659 1.27 1.90 0.99 117 SUBJ_ALL_CAPS 2548 1.42 1.82 1.24 118 TR_Symld_Words 2465 1.63 1.76 1.58 119 XMGenDplmaNmb 2441 1.10 1.75 0.82 120 RCVD_IN_VALIDITY_CERTIFIED 2439 2.45 1.74 2.75 121 XMBody_17 2345 0.72 1.68 0.31 122 SpammyFromTLD_01 2330 1.19 1.67 0.99 123 XM_SendGrid 2309 1.50 1.65 1.43 124 SUSP_UTF8_WORD_SUBJ 2286 0.59 1.64 0.13 125 RELAYCOUNTRY_TH 2240 0.49 1.60 0.00 126 XMBrknScrpt_02 2214 1.04 1.58 0.81 127 HTML_MIME_NO_HTML_TAG 2212 2.18 1.58 2.44 128 BAYES_40 2202 4.18 1.58 5.32 129 HTTPS_HTTP_MISMATCH 2173 1.07 1.55 0.85 130 XMHTML_After_End 2095 0.70 1.50 0.35 131 XM_B_COPY_HTML 2074 0.93 1.48 0.68 132 TR_XM_PHPForged 2068 0.65 1.48 0.29 133 ALL_TRUSTED 2063 11.93 1.48 16.49 134 TR_XM_PHPDW 2039 0.64 1.46 0.28 135 XMPhish30 2027 0.80 1.45 0.52 136 URI_HEX 2019 1.21 1.44 1.11 137 TR_XM_FormFill2 2001 0.63 1.43 0.29 138 XM_UB60 1991 0.49 1.42 0.09 139 USER_IN_DEF_DKIM_WL 1987 8.64 1.42 11.79 140 XM_H_PHPOS 1964 0.62 1.41 0.27 141 URI_NOVOWEL 1916 1.43 1.37 1.45 142 XM_UB99 1912 0.42 1.37 0.00 143 RCVD_IN_PBL 1904 1.02 1.36 0.87 144 KHOP_HELO_FCRDNS 1899 2.41 1.36 2.86 145 BAYES_20 1873 3.10 1.34 3.87 146 XM_H_Undi_Recip 1812 0.55 1.30 0.23 147 SUSP_UTF8_WORD_COMBO 1794 0.49 1.28 0.15 148 XMMoneyMeta_00 1737 0.72 1.24 0.49 149 XM_B_SEO 1706 0.58 1.22 0.30 150 DKIM_ADSP_CUSTOM_MED 1701 1.01 1.22 0.92 151 T_PDS_OTHER_BAD_TLD 1649 0.50 1.18 0.20 152 BOTNET_NORDNS 1646 0.37 1.18 0.01 153 THIS_AD 1629 0.71 1.17 0.51 154 XM_H_Long_From02 1626 0.98 1.16 0.90 155 RCVD_IN_IADB_LISTED 1575 2.64 1.13 3.30 156 DIET_1 1566 0.64 1.12 0.43 157 MIME_CHARSET_FARAWAY 1557 1.66 1.11 1.90 158 FROM_SUSPICIOUS_NTLD 1518 0.35 1.09 0.03 159 T_MONEY_PERCENT 1511 0.53 1.08 0.29 160 TR_LOTS_OF_MONEY2 1511 0.53 1.08 0.29 161 RCVD_IN_XBL 1510 0.35 1.08 0.03 162 HK_RANDOM_ENVFROM 1501 0.42 1.07 0.14 163 XM_B_DNDMA 1492 0.52 1.07 0.28 164 URI_TRY_3LD 1476 0.78 1.06 0.66 165 TR_XM_SEO4 1475 0.45 1.06 0.18 166 XMSexyCombo_01 1462 0.46 1.05 0.20 167 XM_B_Phish66 1459 0.55 1.04 0.34 168 MPART_ALT_DIFF_COUNT 1433 0.73 1.03 0.61 169 HOSTED_IMG_MULTI_PUB_01 1428 0.33 1.02 0.02 170 RCVD_IN_SORBS_DUL 1427 0.35 1.02 0.05 171 NML_ADSP_CUSTOM_MED 1419 0.74 1.02 0.62 172 TR_XM_Undi_Recip19 1411 0.37 1.01 0.09 173 RCVD_IN_IADB_SPF 1397 2.33 1.00 2.91 174 SHOPIFY_IMG_NOT_RCVD_SFY 1396 0.45 1.00 0.21 175 XM_ProductURIs 1382 0.62 0.99 0.46 176 HTML_FONT_SIZE_LARGE 1380 0.35 0.99 0.07 177 XM_UB80 1361 0.31 0.97 0.02 178 T_STY_INVIS_DIRECT 1346 0.54 0.96 0.35 179 RDNS_DYNAMIC 1325 0.53 0.95 0.35 180 RCVD_IN_IADB_SENDERID 1324 2.10 0.95 2.60 181 XMReplyNow 1318 0.45 0.94 0.23 182 XMBody_78 1314 0.45 0.94 0.24 183 TR_XM_DK_SendGrid 1306 0.97 0.93 0.99 184 HTML_TAG_BALANCE_BODY 1299 0.61 0.93 0.47 185 PDS_RDNS_DYNAMIC_FP 1293 0.42 0.93 0.20 186 XM_B_REG_HTML 1288 0.42 0.92 0.20 187 RCVD_IN_IADB_DK 1287 2.05 0.92 2.54 188 TR_XM_Base64_M1 1283 0.78 0.92 0.72 189 XM_UB999 1268 0.28 0.91 0.00 190 TR_XM_InvalidRelay 1262 0.28 0.90 0.01 191 RCVD_IN_PSBL 1252 0.48 0.90 0.30 192 TooManyTo_002 1247 3.14 0.89 4.12 193 XM_B_COVIDMETA 1245 0.42 0.89 0.21 194 TR_XM_RelayPhish 1237 0.32 0.89 0.07 195 RELAYCOUNTRY_FR 1233 0.42 0.88 0.21 196 XMPhish14 1226 0.59 0.88 0.46 197 TR_Mismatch_TLD_02 1219 0.32 0.87 0.07 198 T_Symld_Words_02 1190 0.73 0.85 0.67 199 XM_H_PHPMailer 1185 0.75 0.85 0.71 200 FROM_SUSPICIOUS_NTLD_FP 1181 0.27 0.84 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279196 89.27 94.52 86.98 2 RELAYCOUNTRY_US 258295 80.97 82.11 80.47 3 DKIM_SIGNED 228198 75.97 87.16 71.10 4 XM_DK_Pass 223201 73.56 82.81 69.54 5 DKIM_VALID 219340 72.22 81.15 68.34 6 XM_B_Unicode 218196 71.89 80.85 67.98 7 DCC_CHECK_NEGATIVE 206396 51.47 21.99 64.30 8 BAYES_50 190707 53.47 39.81 59.42 9 DKIM_VALID_AU 175141 57.57 64.46 54.57 10 XMListUnsubscribeExists 139642 50.92 67.94 43.51 11 XM_B_SpammyWords 135037 49.61 66.91 42.07 12 XM_B_Unicode3 125521 42.03 48.74 39.11 13 DCC_CHECK 114433 47.87 75.91 35.65 14 T_TM2_M_HEADER_IN_MSG 107172 29.58 20.84 33.39 15 RCVD_IN_MSPIKE_H2 105456 34.23 37.39 32.86 16 DKIM_VALID_EF 92644 28.79 28.63 28.86 17 HTML_FONT_LOW_CONTRAST 86359 29.62 35.85 26.91 18 XMSubLong 75456 23.44 23.27 23.51 19 LOC_TINY_FONT_1 75200 30.49 46.72 23.43 20 FVGT_m_MULTI_ODD 74063 25.94 32.53 23.07 21 MIME_HTML_ONLY 63254 22.48 28.86 19.71 22 T_KAM_HTML_FONT_INVALID 59527 22.54 31.71 18.55 23 XM_B_SpammyWords2 53525 23.37 38.75 16.68 24 ALL_TRUSTED 52916 11.93 1.48 16.49 25 BAYES_00 41457 9.21 0.69 12.92 26 XM_Multi_Part_URI 38958 14.85 21.09 12.14 27 USER_IN_DEF_DKIM_WL 37828 8.64 1.42 11.79 28 TR_XM_DK_Unsub 37326 14.11 19.80 11.63 29 UNPARSEABLE_RELAY 35770 13.10 17.58 11.14 30 XM_B_PhoneNumber 32962 8.87 5.65 10.27 31 TooManyTo_001 31223 7.98 3.97 9.73 32 XM_B_Unsub 30844 11.63 16.27 9.61 33 XM_Evil_Numbers_Gen 30757 9.74 10.11 9.58 34 LotsOfNums_01 30739 9.21 8.38 9.58 35 BAYES_60 25775 8.22 8.65 8.03 36 FSL_BULK_SIG 22642 8.22 10.89 7.05 37 TR_XM_DK_Bayes 22313 5.02 0.57 6.95 38 TR_XM_DK_Bayes1 21896 4.92 0.56 6.82 39 TR_XM_BayesUnsub 21409 9.41 15.69 6.67 40 IN_ZIMBRA_NJ_WHITELIST 21289 4.64 0.08 6.63 41 XM_DKIMWhitelistDomains 20028 4.36 0.05 6.24 42 LOTS_OF_MONEY 19377 7.64 11.32 6.04 43 BOUNCE_MESSAGE 19042 4.32 0.62 5.93 44 ANY_BOUNCE_MESSAGE 19042 4.32 0.62 5.93 45 XM_H_GMP 19007 5.76 5.38 5.92 46 TR_XM_DK_Bayes2 18598 4.19 0.49 5.79 47 T_TooManySym_01 18467 4.75 2.44 5.75 48 RCVD_IN_MSPIKE_WL 17558 4.98 3.85 5.47 49 RCVD_IN_MSPIKE_H3 17557 4.98 3.85 5.47 50 BAYES_40 17080 4.18 1.58 5.32 51 XM_H_Long_From01 16810 5.50 6.11 5.24 52 XM_B_Phish_Phrases 16647 5.82 7.28 5.19 53 XM_PDF 16353 3.78 0.78 5.09 54 TR_MAX_INTL_RELAY 16222 8.20 15.44 5.05 55 XMStrtUSub 16093 4.95 4.80 5.01 56 MIME_QP_LONG_LINE 16082 4.32 2.72 5.01 57 HTML_IMAGE_RATIO_02 14390 5.26 7.05 4.48 58 XM_UncommonTLD01 13642 5.22 7.46 4.25 59 XM_DK_Undo_02 13505 14.66 38.67 4.21 60 TR_XM_SpammyWords4 13408 5.97 10.07 4.18 61 TM2_M_VERY_LONG_WORD 13330 4.01 3.68 4.15 62 TooManyTo_002 13226 3.14 0.89 4.12 63 RCVD_IN_VALIDITY_SAFE 12972 3.47 2.17 4.04 64 MPART_ALT_DIFF 12971 4.74 6.34 4.04 65 XMSubMetaSx_00 12439 4.79 6.90 3.88 66 BAYES_20 12411 3.10 1.34 3.87 67 RELAYCOUNTRY_META 12079 7.44 15.87 3.76 68 T_REMOTE_IMAGE 11793 3.83 4.19 3.67 69 XM_B_SpammyWords3 11768 6.23 12.13 3.67 70 HTML_IMAGE_ONLY_32 11147 2.48 0.20 3.47 71 HTML_IMAGE_RATIO_04 10941 3.64 4.17 3.41 72 RCVD_IN_IADB_LISTED 10591 2.64 1.13 3.30 73 MAILING_LIST_MULTI 10275 2.90 2.21 3.20 74 T_TooManySym_02 10159 2.44 0.78 3.17 75 XMNumbers 10123 3.56 4.50 3.15 76 BAYES_99 10039 11.39 30.37 3.13 77 BAYES_80 9855 4.95 9.26 3.07 78 RCVD_IN_IADB_SPF 9350 2.33 1.00 2.91 79 KHOP_HELO_FCRDNS 9185 2.41 1.36 2.86 80 BOTNET_IPINHOSTNAME 8861 4.88 9.75 2.76 81 DKIM_INVALID 8858 3.74 6.01 2.76 82 RCVD_IN_VALIDITY_CERTIFIED 8833 2.45 1.74 2.75 83 RCVD_IN_IADB_SENDERID 8353 2.10 0.95 2.60 84 RCVD_IN_IADB_DK 8163 2.05 0.92 2.54 85 T_XMDrugObfuBody_14 8086 3.01 4.14 2.52 86 HTML_MIME_NO_HTML_TAG 7837 2.18 1.58 2.44 87 HTML_IMAGE_RATIO_06 7630 2.68 3.38 2.38 88 BAYES_999 7395 8.73 23.50 2.30 89 MIME_HTML_ONLY_MULTI 7349 2.60 3.31 2.29 90 INVALID_MSGID 7317 1.63 0.14 2.28 91 BAYES_05 7280 1.77 0.64 2.27 92 XM_Body_Dirty_Words 7058 3.88 7.76 2.20 93 MIME_HTML_MOSTLY 7049 2.55 3.38 2.20 94 RCVD_IN_IADB_VOUCHED 6993 1.69 0.57 2.18 95 XM_ShortIntro_01 6937 1.68 0.59 2.16 96 XM_B_SpammyTLD 6534 2.67 4.14 2.04 97 XM_B_URI_Unicode 6509 2.15 2.42 2.03 98 BAYES_95 6357 3.08 5.59 1.98 99 TooManyTo_003 6288 1.61 0.80 1.96 100 TO_MALFORMED 6204 1.35 0.01 1.93 101 XM_CamelCaseFrm001 6174 2.39 3.48 1.92 102 XM_SPF_SoftFail 6115 2.36 3.42 1.91 103 MIME_CHARSET_FARAWAY 6110 1.66 1.11 1.90 104 TR_XM_SpammyRelay 6105 4.30 9.82 1.90 105 FROM_EXCESS_BASE64 5733 1.91 2.19 1.79 106 XMSexyCombo_05 5573 2.60 4.60 1.74 107 XMDiploma_00 5552 2.07 2.85 1.73 108 TM2_M_URI_OPT_OUT 5389 2.03 2.85 1.68 109 HTML_IMAGE_RATIO_08 5377 1.92 2.48 1.68 110 TR_XM_DKIM_Undo 5287 9.20 26.55 1.65 111 CHARSET_FARAWAY_HEADER 5235 1.17 0.11 1.63 112 XM_DK_Undo_01 5210 1.74 2.02 1.62 113 TR_Symld_Words 5058 1.63 1.76 1.58 114 TR_XM_PhishingBody 5040 2.38 4.25 1.57 115 UNTRUSTED_Relay 4996 3.52 8.04 1.56 116 T_XMDrugObfuBody_08 4949 1.89 2.69 1.54 117 RCVD_IN_IADB_OPTIN 4860 1.17 0.39 1.51 118 IN_HORDE_ADDRESS_BOOK 4819 1.07 0.08 1.50 119 TR_XM_UnparsRelay 4768 3.65 8.62 1.49 120 TooManyTo_004 4666 1.23 0.73 1.45 121 URI_NOVOWEL 4650 1.43 1.37 1.45 122 XM_SendGrid 4601 1.50 1.65 1.43 123 HELO_NODOT 4443 1.06 0.32 1.38 124 XM_B_FormFill 4435 0.97 0.03 1.38 125 HELO_NO_DOMAIN 4434 1.06 0.32 1.38 126 TR_XM_SpammyWords5 4432 2.20 4.07 1.38 127 XMCapTrack 4334 1.18 0.80 1.35 128 XMLngstWrd_00 4240 1.06 0.46 1.32 129 XM_B_Investor 4226 2.19 4.18 1.32 130 XM_GoogleGroups 4139 1.12 0.74 1.29 131 T_TooManySym_03 4069 0.93 0.17 1.27 132 BOTNET 3983 3.58 8.95 1.24 133 SUBJ_ALL_CAPS 3978 1.42 1.82 1.24 134 TooManyTo_005 3881 1.05 0.68 1.21 135 XM_B_Unsub2 3867 1.66 2.69 1.20 136 XMGappySubj_01 3679 0.85 0.15 1.15 137 XMStockSpam_06 3628 1.37 1.92 1.13 138 XM_OfRef6 3619 1.72 3.09 1.13 139 URI_HEX 3563 1.21 1.44 1.11 140 RELAYCOUNTRY_CA 3464 2.21 4.82 1.08 141 TVD_SPACE_RATIO 3325 0.78 0.19 1.04 142 TR_DCC_Bayes_99 3320 7.53 22.44 1.03 143 T_FILL_THIS_FORM_SHORT 3189 1.27 1.90 0.99 144 SpammyFromTLD_01 3172 1.19 1.67 0.99 145 TR_XM_DK_SendGrid 3165 0.97 0.93 0.99 146 XM_UB50 3001 1.68 3.38 0.93 147 DKIM_ADSP_CUSTOM_MED 2967 1.01 1.22 0.92 148 XM_H_Long_From02 2885 0.98 1.16 0.90 149 T_XMDrugObfuBody_00 2838 1.23 2.02 0.88 150 RCVD_IN_PBL 2791 1.02 1.36 0.87 151 HTTPS_HTTP_MISMATCH 2740 1.07 1.55 0.85 152 XMGenDplmaNmb 2639 1.10 1.75 0.82 153 XMBrknScrpt_02 2585 1.04 1.58 0.81 154 XMGappySubj_02 2567 0.58 0.08 0.80 155 XMNoVowels 2561 0.71 0.51 0.80 156 TR_XM_Base64_M1 2315 0.78 0.92 0.72 157 XM_H_PHPMailer 2269 0.75 0.85 0.71 158 TR_MetaPhish_Combo_01 2248 0.71 0.74 0.70 159 XM_B_COPY_HTML 2192 0.93 1.48 0.68 160 T_Symld_Words_02 2160 0.73 0.85 0.67 161 URI_TRY_3LD 2122 0.78 1.06 0.66 162 TVD_RCVD_IP 2063 0.70 0.82 0.64 163 T_OBFU_PDF_ATTACH 2059 0.50 0.19 0.64 164 NML_ADSP_CUSTOM_MED 2005 0.74 1.02 0.62 165 XMBody_95 1992 0.49 0.20 0.62 166 FROM_GOV_DKIM_AU 1968 0.47 0.16 0.61 167 MPART_ALT_DIFF_COUNT 1943 0.73 1.03 0.61 168 FILL_THIS_FORM 1930 0.51 0.30 0.60 169 XMBdyGiftCard01 1882 0.66 0.84 0.59 170 MISSING_HEADERS 1874 0.66 0.84 0.58 171 XMSlimDrugH 1873 0.59 0.61 0.58 172 RELAYCOUNTRY_AU 1829 1.20 2.65 0.57 173 TO_NO_BRKTS_HTML_ONLY 1751 0.47 0.31 0.55 174 XMSubMetaI_00 1747 0.57 0.62 0.54 175 LongTLD 1691 1.05 2.25 0.53 176 XMPhish30 1674 0.80 1.45 0.52 177 FROM_GOV_SPOOF 1668 0.39 0.09 0.52 178 TM2_M_BODY_EMPTY 1657 0.38 0.08 0.52 179 MSGID_FROM_MTA_HEADER 1638 0.40 0.15 0.51 180 RCVD_IN_BL_SPAMCOP_NET 1634 3.17 9.29 0.51 181 XM_B_SpammyWords4 1628 0.96 1.99 0.51 182 THIS_AD 1622 0.71 1.17 0.51 183 RELAYCOUNTRY_GB 1613 0.59 0.80 0.50 184 FORGED_GMAIL_RCVD 1591 0.56 0.72 0.50 185 XMMoneyMeta_00 1559 0.72 1.24 0.49 186 HTML_TAG_BALANCE_BODY 1521 0.61 0.93 0.47 187 T_TVD_MIME_NO_HEADERS 1493 0.34 0.05 0.47 188 XMPhish14 1483 0.59 0.88 0.46 189 XM_ProductURIs 1475 0.62 0.99 0.46 190 XM_H_OutlookMailer 1467 0.35 0.10 0.46 191 T_XMHurry_00 1458 0.94 2.05 0.45 192 XMSubMetaSxObfu_03 1428 0.53 0.73 0.44 193 DIET_1 1375 0.64 1.12 0.43 194 HTML_IMAGE_ONLY_20 1369 0.48 0.59 0.43 195 PLING_QUERY 1360 0.49 0.65 0.42 196 SHORT_HELO_AND_INLINE_IMAGE 1354 0.30 0.03 0.42 197 HTML_IMAGE_ONLY_28 1339 0.38 0.29 0.42 198 XMLngstWrd_01 1328 0.40 0.36 0.41 199 XMDateMe_00 1306 0.39 0.34 0.41 200 TM2_M_OBFU_COMMENT 1293 0.54 0.84 0.40 ----------------------------------------------------------------------