Email: 479245 Autolearn: 0 AvgScore: 4.76 AvgScanTime: 1.40 sec Spam: 156006 Autolearn: 0 AvgScore: 14.62 AvgScanTime: 1.53 sec Ham: 323239 Autolearn: 0 AvgScore: -0.00 AvgScanTime: 1.34 sec Time Spent Running SA: 186.40 hours Time Spent Processing Spam: 66.39 hours Time Spent Processing Ham: 120.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148388 90.09 95.12 87.66 2 DKIM_SIGNED 138607 80.96 88.85 77.15 3 XM_DK_Pass 132760 78.72 85.10 75.64 4 DKIM_VALID 131105 77.57 84.04 74.44 5 RELAYCOUNTRY_US 130801 82.90 83.84 82.45 6 XM_B_Unicode 130502 75.02 83.65 70.85 7 DCC_CHECK 118852 51.60 76.18 39.74 8 XMListUnsubscribeExists 108139 56.28 69.32 49.99 9 DKIM_VALID_AU 102980 61.00 66.01 58.58 10 XM_B_SpammyWords 102651 51.43 65.80 44.49 11 XM_B_Unicode3 77423 43.81 49.63 40.99 12 LOC_TINY_FONT_1 75620 33.91 48.47 26.88 13 XM_DK_Undo_02 63319 16.38 40.59 4.69 14 BAYES_50 61070 53.28 39.15 60.10 15 RCVD_IN_MSPIKE_H2 60369 36.21 38.70 35.01 16 HTML_FONT_LOW_CONTRAST 59039 30.50 37.84 26.96 17 XM_B_SpammyWords2 58344 24.40 37.40 18.13 18 FVGT_m_MULTI_ODD 52849 28.34 33.88 25.67 19 T_KAM_HTML_FONT_INVALID 48459 24.61 31.06 21.49 20 BAYES_99 47962 12.26 30.74 3.34 21 DKIM_VALID_EF 45849 29.96 29.39 30.23 22 MIME_HTML_ONLY 45443 22.54 29.13 19.37 23 TR_XM_DKIM_Undo 42685 10.12 27.36 1.80 24 XMSubLong 39490 23.86 25.31 23.16 25 BAYES_999 36477 9.28 23.38 2.48 26 TR_DCC_Bayes_99 36145 8.44 23.17 1.34 27 DCC_CHECK_NEGATIVE 34710 47.85 22.25 60.20 28 XM_Multi_Part_URI 34060 16.25 21.83 13.56 29 T_TM2_M_HEADER_IN_MSG 33070 27.16 21.20 30.03 30 TR_XM_DK_Unsub 31909 15.89 20.45 13.68 31 UNPARSEABLE_RELAY 28146 14.27 18.04 12.44 32 XM_B_Unsub 26921 11.88 17.26 9.29 33 TR_XM_BayesUnsub 26168 10.24 16.77 7.09 34 TR_MAX_INTL_RELAY 26052 9.35 16.70 5.80 35 RELAYCOUNTRY_META 24793 7.97 15.89 4.15 36 XM_B_SpammyWords3 21220 7.29 13.60 4.25 37 LOTS_OF_MONEY 18596 7.57 11.92 5.47 38 XMSubMetaSx_00 17304 8.03 11.09 6.55 39 TR_XM_SpammyWords2 16766 3.84 10.75 0.50 40 FSL_BULK_SIG 16535 8.14 10.60 6.95 41 BOTNET_IPINHOSTNAME 16500 5.56 10.58 3.14 42 TR_XM_SpammyWords4 16022 5.65 10.27 3.42 43 XM_Evil_Numbers_Gen 15944 9.08 10.22 8.53 44 BOTNET 15919 4.24 10.20 1.37 45 BAYES_80 15670 5.65 10.04 3.53 46 RCVD_IN_BL_SPAMCOP_NET 15185 3.58 9.73 0.61 47 TR_XM_SpammyRelay 14906 4.55 9.55 2.13 48 TR_XM_UnparsRelay 14404 4.12 9.23 1.65 49 BAYES_60 13693 8.92 8.78 8.99 50 XM_Body_Dirty_Words 12685 4.38 8.13 2.57 51 TR_XM_SPAMCOP 12581 2.88 8.06 0.38 52 LotsOfNums_01 12456 8.52 7.98 8.78 53 XM_UncommonTLD01 12076 5.45 7.74 4.35 54 UNTRUSTED_Relay 11618 3.52 7.45 1.63 55 XM_B_PhoneNumber 10584 9.13 6.78 10.27 56 XM_B_Phish_Phrases 10561 5.36 6.77 4.68 57 HTML_IMAGE_RATIO_02 10255 5.45 6.57 4.91 58 XMSexyCombo_05 10065 3.21 6.45 1.64 59 MPART_ALT_DIFF 9977 5.27 6.40 4.72 60 RCVD_IN_VALIDITY_RPBL 9802 2.13 6.28 0.12 61 BAYES_95 9278 3.47 5.95 2.27 62 XM_H_Long_From01 9229 5.85 5.92 5.81 63 HTML_IMAGE_RATIO_04 8131 4.17 5.21 3.67 64 XM_H_GMP 8119 5.48 5.20 5.61 65 DKIM_INVALID 7502 3.39 4.81 2.71 66 RELAYCOUNTRY_CA 6938 2.25 4.45 1.19 67 XM_B_Investor 6845 2.45 4.39 1.52 68 TR_XM_PhishingBody 6669 2.62 4.27 1.82 69 T_XMDrugObfuBody_14 6338 2.70 4.06 2.05 70 TM2_M_VERY_LONG_WORD 6133 2.30 3.93 1.51 71 DKIM_ADSP_NXDOMAIN 6109 1.49 3.92 0.31 72 RCVD_IN_MSPIKE_WL 6085 5.16 3.90 5.77 73 RCVD_IN_MSPIKE_H3 6085 5.16 3.90 5.77 74 NO_DNS_FOR_FROM 5964 1.44 3.82 0.29 75 TM2_M_URI_OPT_OUT 5919 2.42 3.79 1.75 76 XM_B_SpammyTLD 5914 3.12 3.79 2.80 77 TR_XM_MaxWHORU 5902 1.38 3.78 0.23 78 HTML_IMAGE_RATIO_06 5666 3.69 3.63 3.71 79 XM_OfRef6 5658 1.95 3.63 1.14 80 XMStrtUSub 5505 4.23 3.53 4.57 81 XMNumbers 5454 2.98 3.50 2.74 82 TR_XM_SpammyWords5 5413 2.14 3.47 1.50 83 MIME_HTML_ONLY_MULTI 5299 2.98 3.40 2.77 84 XM_SPF_SoftFail 5248 2.03 3.36 1.38 85 XM_UB50 5219 1.83 3.35 1.11 86 TooManyTo_001 5211 6.99 3.34 8.75 87 HTML_IMAGE_RATIO_08 5142 2.82 3.30 2.58 88 T_REMOTE_IMAGE 4988 3.56 3.20 3.73 89 MIME_HTML_MOSTLY 4978 2.64 3.19 2.37 90 LongTLD 4935 1.37 3.16 0.51 91 MIME_QP_LONG_LINE 4880 4.65 3.13 5.39 92 XM_CamelCaseFrm001 4632 2.44 2.97 2.18 93 T_XMDrugObfuBody_08 4402 2.04 2.82 1.66 94 RELAYCOUNTRY_AU 4363 1.40 2.80 0.73 95 XMDiploma_00 3980 1.95 2.55 1.66 96 XM_URI_RBL 3920 1.04 2.51 0.33 97 T_TooManySym_01 3636 4.65 2.33 5.76 98 XM_B_Unsub2 3602 1.92 2.31 1.73 99 XM_B_SpammyWords4 3573 1.30 2.29 0.83 100 TR_XM_NoHeaderRelay 3460 0.95 2.22 0.34 101 RCVD_IN_VALIDITY_SAFE 3459 3.20 2.22 3.67 102 MAILING_LIST_MULTI 3387 2.88 2.17 3.22 103 HTML_MIME_NO_HTML_TAG 3375 2.26 2.16 2.31 104 SpammyFromTLD_02 3352 1.05 2.15 0.52 105 XM_B_URI_Unicode 3277 2.01 2.10 1.97 106 FROM_EXCESS_BASE64 3242 1.94 2.08 1.88 107 HTML_SHORT_LINK_IMG_1 3194 0.68 2.05 0.02 108 USER_IN_DEF_DKIM_WL 3137 8.90 2.01 12.23 109 XM_DK_Undo_01 3066 1.82 1.97 1.75 110 T_XMHurry_00 3034 0.99 1.94 0.53 111 RELAYCOUNTRY_TH 2904 0.61 1.86 0.00 112 HTML_IMAGE_ONLY_08 2877 0.69 1.84 0.13 113 HDRS_LCASE_IMGONLY 2789 0.60 1.79 0.02 114 BODY_URI_ONLY 2778 0.59 1.78 0.01 115 XMStockSpam_06 2757 1.08 1.77 0.75 116 SUBJ_ALL_CAPS 2713 1.63 1.74 1.57 117 XM_SendGrid 2692 1.86 1.73 1.92 118 XMSubMetaI_00 2660 0.96 1.71 0.59 119 XM_H_Long_From02 2658 1.23 1.70 1.01 120 URI_HEX 2593 1.39 1.66 1.26 121 T_XMDrugObfuBody_00 2411 1.08 1.55 0.85 122 RCVD_IN_ZEN_LASTEXTERNAL 2392 0.50 1.53 0.00 123 SHORTCIRCUIT 2392 0.50 1.53 0.00 124 XMBody_17 2374 0.72 1.52 0.33 125 SpammyFromTLD_01 2319 1.08 1.49 0.89 126 BAYES_40 2291 3.78 1.47 4.89 127 TR_XM_INV_DKIM 2277 0.62 1.46 0.22 128 T_FILL_THIS_FORM_SHORT 2203 1.13 1.41 1.00 129 XM_H_Undi_Recip 2196 0.58 1.41 0.17 130 XMBdyGiftCard01 2170 0.81 1.39 0.52 131 RCVD_IN_IADB_LISTED 2136 3.20 1.37 4.08 132 RCVD_IN_VALIDITY_CERTIFIED 2134 2.21 1.37 2.62 133 XM_UB99 2093 0.44 1.34 0.01 134 XM_B_SEO 2046 0.60 1.31 0.25 135 XMGenDplmaNmb 2038 1.09 1.31 0.99 136 XMPhish30 2026 0.74 1.30 0.47 137 KHOP_HELO_FCRDNS 1987 1.49 1.27 1.59 138 XMHTML_After_End 1950 0.66 1.25 0.37 139 TR_XM_Undi_Recip19 1946 0.45 1.25 0.07 140 XMReplyNow 1945 0.59 1.25 0.28 141 ALL_TRUSTED 1943 9.92 1.25 14.11 142 SUSP_UTF8_WORD_SUBJ 1915 0.42 1.23 0.03 143 XM_B_COPY_HTML 1887 0.88 1.21 0.73 144 XMSexyCombo_01 1885 0.61 1.21 0.32 145 XMBrknScrpt_02 1868 1.01 1.20 0.92 146 RCVD_IN_IADB_SPF 1856 2.81 1.19 3.60 147 TR_XM_SEO4 1838 0.48 1.18 0.14 148 XM_UB60 1804 0.42 1.16 0.06 149 TR_XM_DK_SendGrid 1796 1.08 1.15 1.04 150 TR_XM_Undi_RecipCombo2 1777 0.38 1.14 0.01 151 RCVD_IN_IADB_DK 1769 2.48 1.13 3.12 152 RCVD_IN_IADB_SENDERID 1736 2.53 1.11 3.21 153 URI_NOVOWEL 1731 1.44 1.11 1.60 154 XM_B_Phish66 1720 0.68 1.10 0.48 155 SHOPIFY_IMG_NOT_RCVD_SFY 1714 0.56 1.10 0.29 156 XMBody_78 1698 0.52 1.09 0.24 157 BAYES_20 1685 2.73 1.08 3.52 158 URI_TRY_3LD 1656 0.73 1.06 0.57 159 TR_XM_Base64_M1 1651 0.83 1.06 0.72 160 DIET_1 1635 0.55 1.05 0.31 161 TR_MetaPhish_Combo_01 1622 0.88 1.04 0.81 162 TR_XM_PHPDW 1621 0.55 1.04 0.32 163 TR_XM_PHPForged 1615 0.55 1.04 0.32 164 RELAYCOUNTRY_FR 1582 0.51 1.01 0.27 165 TR_XM_FormFill2 1570 0.54 1.01 0.32 166 RCVD_IN_PBL 1555 0.87 1.00 0.81 167 RCVD_IN_PSBL 1547 0.52 0.99 0.29 168 HTTPS_HTTP_MISMATCH 1540 0.89 0.99 0.85 169 T_Symld_Words_02 1536 0.65 0.98 0.50 170 XMPhish14 1531 0.65 0.98 0.49 171 XM_H_PHPOS 1526 0.52 0.98 0.30 172 DKIM_ADSP_CUSTOM_MED 1521 0.88 0.97 0.83 173 HTML_TAG_BALANCE_BODY 1521 0.74 0.97 0.63 174 XM_B_REG_HTML 1512 0.44 0.97 0.18 175 XM_UB999 1512 0.32 0.97 0.00 176 TR_LOTS_OF_MONEY3 1507 0.46 0.97 0.22 177 XM_B_DNDMA 1504 0.66 0.96 0.51 178 BOTNET_NORDNS 1503 0.33 0.96 0.02 179 UNDISC_MONEY 1491 0.31 0.96 0.01 180 HK_RANDOM_REPLYTO 1464 0.40 0.94 0.14 181 TR_XM_Undi_Recip5 1458 0.31 0.93 0.00 182 XMMoneyMeta_00 1424 0.70 0.91 0.60 183 TR_XM_InvalidRelay 1423 0.30 0.91 0.01 184 TR_Symld_Words 1415 1.29 0.91 1.47 185 MIME_CHARSET_FARAWAY 1383 0.59 0.89 0.45 186 T_STY_INVIS_DIRECT 1377 0.53 0.88 0.36 187 XM_ProductURIs 1377 0.62 0.88 0.50 188 URIBL_BLACK 1355 0.32 0.87 0.05 189 MPART_ALT_DIFF_COUNT 1349 0.72 0.86 0.65 190 FILL_THIS_FORM 1344 0.61 0.86 0.48 191 XMNoVowels 1340 0.95 0.86 1.00 192 HK_RANDOM_ENVFROM 1325 0.36 0.85 0.13 193 RDNS_DYNAMIC 1318 0.54 0.84 0.39 194 T_MONEY_PERCENT 1313 0.37 0.84 0.15 195 TR_LOTS_OF_MONEY2 1313 0.37 0.84 0.15 196 XM_UB80 1296 0.28 0.83 0.01 197 SUSP_UTF8_WORD_COMBO 1293 0.31 0.83 0.06 198 HK_SCAM 1285 0.29 0.82 0.03 199 PDS_RDNS_DYNAMIC_FP 1285 0.44 0.82 0.25 200 RCVD_IN_SORBS_DUL 1285 0.31 0.82 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 283346 90.09 95.12 87.66 2 RELAYCOUNTRY_US 266499 82.90 83.84 82.45 3 DKIM_SIGNED 249371 80.96 88.85 77.15 4 XM_DK_Pass 244482 78.72 85.10 75.64 5 DKIM_VALID 240624 77.57 84.04 74.44 6 XM_B_Unicode 229013 75.02 83.65 70.85 7 DCC_CHECK_NEGATIVE 194599 47.85 22.25 60.20 8 BAYES_50 194257 53.28 39.15 60.10 9 DKIM_VALID_AU 189347 61.00 66.01 58.58 10 XMListUnsubscribeExists 161597 56.28 69.32 49.99 11 XM_B_SpammyWords 143819 51.43 65.80 44.49 12 XM_B_Unicode3 132511 43.81 49.63 40.99 13 DCC_CHECK 128448 51.60 76.18 39.74 14 RCVD_IN_MSPIKE_H2 113170 36.21 38.70 35.01 15 DKIM_VALID_EF 97730 29.96 29.39 30.23 16 T_TM2_M_HEADER_IN_MSG 97084 27.16 21.20 30.03 17 HTML_FONT_LOW_CONTRAST 87130 30.50 37.84 26.96 18 LOC_TINY_FONT_1 86893 33.91 48.47 26.88 19 FVGT_m_MULTI_ODD 82989 28.34 33.88 25.67 20 XMSubLong 74865 23.86 25.31 23.16 21 T_KAM_HTML_FONT_INVALID 69460 24.61 31.06 21.49 22 MIME_HTML_ONLY 62601 22.54 29.13 19.37 23 XM_B_SpammyWords2 58613 24.40 37.40 18.13 24 ALL_TRUSTED 45621 9.92 1.25 14.11 25 TR_XM_DK_Unsub 44234 15.89 20.45 13.68 26 XM_Multi_Part_URI 43829 16.25 21.83 13.56 27 UNPARSEABLE_RELAY 40221 14.27 18.04 12.44 28 USER_IN_DEF_DKIM_WL 39536 8.90 2.01 12.23 29 BAYES_00 36071 7.74 0.65 11.16 30 XM_B_PhoneNumber 33181 9.13 6.78 10.27 31 XM_B_Unsub 30026 11.88 17.26 9.29 32 BAYES_60 29067 8.92 8.78 8.99 33 LotsOfNums_01 28385 8.52 7.98 8.78 34 TooManyTo_001 28271 6.99 3.34 8.75 35 XM_Evil_Numbers_Gen 27587 9.08 10.22 8.53 36 IN_ZIMBRA_NJ_WHITELIST 23045 4.83 0.08 7.13 37 TR_XM_DK_Bayes 22961 4.97 0.55 7.10 38 TR_XM_BayesUnsub 22906 10.24 16.77 7.09 39 TR_XM_DK_Bayes1 22644 4.90 0.54 7.01 40 FSL_BULK_SIG 22477 8.14 10.60 6.95 41 XMSubMetaSx_00 21165 8.03 11.09 6.55 42 XM_DKIMWhitelistDomains 20654 4.32 0.03 6.39 43 TR_XM_DK_Bayes2 19419 4.18 0.40 6.01 44 XM_H_Long_From01 18783 5.85 5.92 5.81 45 TR_MAX_INTL_RELAY 18758 9.35 16.70 5.80 46 RCVD_IN_MSPIKE_WL 18657 5.16 3.90 5.77 47 RCVD_IN_MSPIKE_H3 18657 5.16 3.90 5.77 48 T_TooManySym_01 18627 4.65 2.33 5.76 49 XM_H_GMP 18138 5.48 5.20 5.61 50 LOTS_OF_MONEY 17694 7.57 11.92 5.47 51 MIME_QP_LONG_LINE 17411 4.65 3.13 5.39 52 HTML_IMAGE_RATIO_02 15881 5.45 6.57 4.91 53 BAYES_40 15803 3.78 1.47 4.89 54 MPART_ALT_DIFF 15272 5.27 6.40 4.72 55 XM_DK_Undo_02 15164 16.38 40.59 4.69 56 XM_B_Phish_Phrases 15120 5.36 6.77 4.68 57 XMStrtUSub 14760 4.23 3.53 4.57 58 XM_PDF 14624 3.26 0.64 4.52 59 XM_UncommonTLD01 14062 5.45 7.74 4.35 60 XM_B_SpammyWords3 13739 7.29 13.60 4.25 61 RELAYCOUNTRY_META 13418 7.97 15.89 4.15 62 RCVD_IN_IADB_LISTED 13186 3.20 1.37 4.08 63 T_REMOTE_IMAGE 12055 3.56 3.20 3.73 64 HTML_IMAGE_RATIO_06 12003 3.69 3.63 3.71 65 HTML_IMAGE_RATIO_04 11868 4.17 5.21 3.67 66 RCVD_IN_VALIDITY_SAFE 11859 3.20 2.22 3.67 67 RCVD_IN_IADB_SPF 11632 2.81 1.19 3.60 68 BAYES_80 11405 5.65 10.04 3.53 69 BAYES_20 11387 2.73 1.08 3.52 70 TR_XM_SpammyWords4 11061 5.65 10.27 3.42 71 BAYES_99 10785 12.26 30.74 3.34 72 MAILING_LIST_MULTI 10396 2.88 2.17 3.22 73 RCVD_IN_IADB_SENDERID 10372 2.53 1.11 3.21 74 BOTNET_IPINHOSTNAME 10138 5.56 10.58 3.14 75 RCVD_IN_IADB_DK 10096 2.48 1.13 3.12 76 TooManyTo_002 10049 2.32 0.67 3.11 77 T_TooManySym_02 9866 2.26 0.61 3.05 78 ANY_BOUNCE_MESSAGE 9638 2.18 0.53 2.98 79 BOUNCE_MESSAGE 9638 2.18 0.53 2.98 80 XM_B_SpammyTLD 9036 3.12 3.79 2.80 81 MIME_HTML_ONLY_MULTI 8968 2.98 3.40 2.77 82 XMNumbers 8848 2.98 3.50 2.74 83 DKIM_INVALID 8747 3.39 4.81 2.71 84 RCVD_IN_IADB_VOUCHED 8626 2.00 0.61 2.67 85 RCVD_IN_VALIDITY_CERTIFIED 8460 2.21 1.37 2.62 86 HTML_IMAGE_RATIO_08 8353 2.82 3.30 2.58 87 XM_Body_Dirty_Words 8306 4.38 8.13 2.57 88 BAYES_999 8002 9.28 23.38 2.48 89 MIME_HTML_MOSTLY 7656 2.64 3.19 2.37 90 HTML_MIME_NO_HTML_TAG 7466 2.26 2.16 2.31 91 BAYES_95 7335 3.47 5.95 2.27 92 INVALID_MSGID 7182 1.57 0.21 2.22 93 BAYES_05 7122 1.68 0.60 2.20 94 XM_CamelCaseFrm001 7041 2.44 2.97 2.18 95 TR_XM_SpammyRelay 6877 4.55 9.55 2.13 96 T_XMDrugObfuBody_14 6611 2.70 4.06 2.05 97 XM_B_URI_Unicode 6370 2.01 2.10 1.97 98 XM_SendGrid 6218 1.86 1.73 1.92 99 TO_MALFORMED 6211 1.30 0.00 1.92 100 RCVD_IN_IADB_OPTIN 6080 1.39 0.36 1.88 101 FROM_EXCESS_BASE64 6074 1.94 2.08 1.88 102 TR_XM_PhishingBody 5875 2.62 4.27 1.82 103 TR_XM_DKIM_Undo 5824 10.12 27.36 1.80 104 TooManyTo_003 5678 1.38 0.60 1.76 105 XM_DK_Undo_01 5666 1.82 1.97 1.75 106 TM2_M_URI_OPT_OUT 5655 2.42 3.79 1.75 107 XM_B_Unsub2 5581 1.92 2.31 1.73 108 T_XMDrugObfuBody_08 5381 2.04 2.82 1.66 109 XMDiploma_00 5374 1.95 2.55 1.66 110 TR_XM_UnparsRelay 5343 4.12 9.23 1.65 111 XMSexyCombo_05 5312 3.21 6.45 1.64 112 UNTRUSTED_Relay 5272 3.52 7.45 1.63 113 URI_NOVOWEL 5173 1.44 1.11 1.60 114 KHOP_HELO_FCRDNS 5139 1.49 1.27 1.59 115 SUBJ_ALL_CAPS 5084 1.63 1.74 1.57 116 XM_B_Investor 4911 2.45 4.39 1.52 117 TM2_M_VERY_LONG_WORD 4888 2.30 3.93 1.51 118 TR_XM_SpammyWords5 4863 2.14 3.47 1.50 119 IN_HORDE_ADDRESS_BOOK 4821 1.05 0.12 1.49 120 TR_Symld_Words 4765 1.29 0.91 1.47 121 XMGappySubj_01 4513 1.00 0.19 1.40 122 XM_SPF_SoftFail 4469 2.03 3.36 1.38 123 BOTNET 4421 4.24 10.20 1.37 124 TR_DCC_Bayes_99 4320 8.44 23.17 1.34 125 HELO_NODOT 4297 0.99 0.27 1.33 126 HELO_NO_DOMAIN 4292 0.98 0.27 1.33 127 XM_GoogleGroups 4149 1.11 0.74 1.28 128 XMCapTrack 4139 1.03 0.50 1.28 129 TooManyTo_004 4112 1.04 0.55 1.27 130 T_TooManySym_03 4089 0.91 0.18 1.27 131 URI_HEX 4080 1.39 1.66 1.26 132 RELAYCOUNTRY_CA 3851 2.25 4.45 1.19 133 XM_OfRef6 3688 1.95 3.63 1.14 134 XM_UB50 3573 1.83 3.35 1.11 135 TooManyTo_005 3434 0.89 0.53 1.06 136 TR_XM_DK_SendGrid 3371 1.08 1.15 1.04 137 FROM_GOV_DKIM_AU 3268 0.75 0.22 1.01 138 XM_H_Long_From02 3249 1.23 1.70 1.01 139 T_FILL_THIS_FORM_SHORT 3231 1.13 1.41 1.00 140 XMNoVowels 3229 0.95 0.86 1.00 141 XMGenDplmaNmb 3193 1.09 1.31 0.99 142 TVD_SPACE_RATIO 3168 0.70 0.11 0.98 143 XMBrknScrpt_02 2966 1.01 1.20 0.92 144 SpammyFromTLD_01 2879 1.08 1.49 0.89 145 XM_H_Trusted_IP 2798 0.58 0.00 0.87 146 T_XMDrugObfuBody_00 2746 1.08 1.55 0.85 147 HTTPS_HTTP_MISMATCH 2739 0.89 0.99 0.85 148 XM_H_PHPMailer 2673 0.76 0.63 0.83 149 DKIM_ADSP_CUSTOM_MED 2673 0.88 0.97 0.83 150 XM_B_SpammyWords4 2669 1.30 2.29 0.83 151 TR_MetaPhish_Combo_01 2609 0.88 1.04 0.81 152 RCVD_IN_PBL 2605 0.87 1.00 0.81 153 XM_ShortIntro_01 2588 0.67 0.41 0.80 154 XMSubNoVowel 2564 0.67 0.40 0.79 155 TVD_RCVD_IP 2467 0.77 0.78 0.76 156 XMStockSpam_06 2422 1.08 1.77 0.75 157 RELAYCOUNTRY_AU 2360 1.40 2.80 0.73 158 XM_B_COPY_HTML 2352 0.88 1.21 0.73 159 TR_XM_Base64_M1 2337 0.83 1.06 0.72 160 XMGappySubj_02 2206 0.49 0.10 0.68 161 XM_B_FormFill 2116 0.45 0.02 0.65 162 MPART_ALT_DIFF_COUNT 2110 0.72 0.86 0.65 163 HTML_TAG_BALANCE_BODY 2021 0.74 0.97 0.63 164 RCVD_IN_BL_SPAMCOP_NET 1986 3.58 9.73 0.61 165 XMBody_95 1952 0.48 0.22 0.60 166 XMMoneyMeta_00 1928 0.70 0.91 0.60 167 T_OBFU_PDF_ATTACH 1922 0.47 0.20 0.59 168 XMSubMetaI_00 1919 0.96 1.71 0.59 169 SUBJ_DOLLARS 1850 0.61 0.68 0.57 170 MISSING_HEADERS 1846 0.54 0.46 0.57 171 URI_TRY_3LD 1843 0.73 1.06 0.57 172 FROM_GOV_SPOOF 1736 0.42 0.18 0.54 173 NML_ADSP_CUSTOM_MED 1716 0.61 0.79 0.53 174 T_XMHurry_00 1708 0.99 1.94 0.53 175 XMBdyGiftCard01 1696 0.81 1.39 0.52 176 HTML_IMAGE_ONLY_32 1689 0.41 0.16 0.52 177 SpammyFromTLD_02 1686 1.05 2.15 0.52 178 XM_B_DNDMA 1664 0.66 0.96 0.51 179 RELAYCOUNTRY_GB 1649 0.59 0.76 0.51 180 LongTLD 1640 1.37 3.16 0.51 181 TR_XM_SpammyWords2 1627 3.84 10.75 0.50 182 XM_ProductURIs 1613 0.62 0.88 0.50 183 T_Symld_Words_02 1602 0.65 0.98 0.50 184 FORGED_GMAIL_RCVD 1577 0.53 0.60 0.49 185 XMLngstWrd_00 1576 0.45 0.38 0.49 186 XMPhish14 1569 0.65 0.98 0.49 187 FILL_THIS_FORM 1567 0.61 0.86 0.48 188 XM_B_Phish66 1542 0.68 1.10 0.48 189 XMPhish30 1530 0.74 1.30 0.47 190 MIME_CHARSET_FARAWAY 1448 0.59 0.89 0.45 191 TO_NO_BRKTS_HTML_ONLY 1444 0.36 0.19 0.45 192 MSGID_FROM_MTA_HEADER 1377 0.31 0.07 0.43 193 XMDateMe_00 1367 0.42 0.41 0.42 194 SHORT_HELO_AND_INLINE_IMAGE 1332 0.29 0.03 0.41 195 USER_IN_WELCOMELIST 1325 0.28 0.00 0.41 196 USER_IN_WHITELIST 1325 0.28 0.00 0.41 197 XM_B_Crypto 1314 0.35 0.23 0.41 198 HTML_FONT_FACE_BAD 1311 0.51 0.72 0.41 199 TM2_M_BODY_EMPTY 1286 0.29 0.08 0.40 200 HTML_IMAGE_ONLY_28 1286 0.35 0.26 0.40 ----------------------------------------------------------------------