Email: 507471 Autolearn: 0 AvgScore: 2.88 AvgScanTime: 1.41 sec Spam: 151808 Autolearn: 0 AvgScore: 14.53 AvgScanTime: 1.58 sec Ham: 355663 Autolearn: 0 AvgScore: -2.10 AvgScanTime: 1.34 sec Time Spent Running SA: 199.27 hours Time Spent Processing Spam: 66.42 hours Time Spent Processing Ham: 132.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141765 90.22 93.38 88.86 2 DKIM_SIGNED 131385 72.95 86.55 67.15 3 XM_DK_Pass 125062 70.76 82.38 65.81 4 XM_B_Unicode 124510 75.69 82.02 72.99 5 RELAYCOUNTRY_US 124182 82.90 81.80 83.37 6 DKIM_VALID 123560 69.74 81.39 64.77 7 DCC_CHECK 110490 46.00 72.78 34.57 8 XM_B_SpammyWords 102932 50.18 67.80 42.66 9 XMListUnsubscribeExists 102214 49.97 67.33 42.56 10 DKIM_VALID_AU 98045 55.17 64.58 51.16 11 XM_B_Unicode3 75505 45.28 49.74 43.38 12 LOC_TINY_FONT_1 71760 29.67 47.27 22.16 13 XM_B_SpammyWords2 61395 24.03 40.44 17.03 14 XM_DK_Undo_02 59568 14.69 39.24 4.20 15 BAYES_50 59457 50.99 39.17 56.03 16 RCVD_IN_MSPIKE_H2 56130 32.52 36.97 30.62 17 HTML_FONT_LOW_CONTRAST 55059 27.34 36.27 23.52 18 BAYES_99 50982 12.13 33.58 2.97 19 T_KAM_HTML_FONT_INVALID 49554 22.88 32.64 18.72 20 FVGT_m_MULTI_ODD 47910 25.03 31.56 22.24 21 MIME_HTML_ONLY 43334 24.55 28.55 22.84 22 DKIM_VALID_EF 43050 27.31 28.36 26.86 23 TR_XM_DKIM_Undo 42815 9.43 28.20 1.41 24 BAYES_999 40370 9.50 26.59 2.21 25 DCC_CHECK_NEGATIVE 38830 53.48 25.58 65.39 26 XMSubLong 38697 24.19 25.49 23.63 27 TR_DCC_Bayes_99 33849 7.36 22.30 0.99 28 XM_Multi_Part_URI 31657 14.37 20.85 11.60 29 T_TM2_M_HEADER_IN_MSG 31265 24.76 20.60 26.54 30 TR_XM_DK_Unsub 29640 14.10 19.52 11.78 31 XM_B_Unsub 26737 11.05 17.61 8.25 32 TR_XM_BayesUnsub 25738 9.37 16.95 6.13 33 UNPARSEABLE_RELAY 24866 12.08 16.38 10.24 34 XM_B_SpammyWords3 22338 7.34 14.71 4.19 35 TR_MAX_INTL_RELAY 22277 7.96 14.67 5.10 36 RELAYCOUNTRY_META 21597 6.59 14.23 3.33 37 TR_XM_SpammyWords2 18449 3.86 12.15 0.33 38 LOTS_OF_MONEY 18183 7.49 11.98 5.57 39 TR_XM_SpammyWords4 16105 5.81 10.61 3.76 40 BOTNET_IPINHOSTNAME 14891 4.89 9.81 2.79 41 TR_XM_SpammyRelay 14540 3.95 9.58 1.55 42 BOTNET 14245 3.68 9.38 1.25 43 XM_Body_Dirty_Words 14223 4.51 9.37 2.44 44 FSL_BULK_SIG 13836 7.59 9.11 6.94 45 XM_Evil_Numbers_Gen 13682 9.13 9.01 9.17 46 BAYES_80 13396 4.83 8.82 3.12 47 RCVD_IN_BL_SPAMCOP_NET 12657 2.91 8.34 0.59 48 XM_B_Phish_Phrases 12134 5.57 7.99 4.53 49 TR_XM_UnparsRelay 12111 3.24 7.98 1.22 50 XMSubMetaSx_00 12030 4.74 7.92 3.38 51 BAYES_60 11429 7.48 7.53 7.46 52 TR_XM_SPAMCOP 10779 2.32 7.10 0.29 53 LotsOfNums_01 10601 7.04 6.98 7.07 54 MPART_ALT_DIFF 10181 8.32 6.71 9.01 55 XM_B_PhoneNumber 9520 8.48 6.27 9.42 56 XM_UncommonTLD01 9106 4.39 6.00 3.70 57 HTML_IMAGE_RATIO_02 9090 4.50 5.99 3.87 58 UNTRUSTED_Relay 8806 2.66 5.80 1.32 59 XM_H_Long_From01 8501 5.03 5.60 4.79 60 BAYES_95 8247 3.01 5.43 1.97 61 DKIM_INVALID 7825 3.21 5.15 2.38 62 XMSexyCombo_05 7818 2.38 5.15 1.19 63 RCVD_IN_VALIDITY_RPBL 7640 1.57 5.03 0.09 64 RELAYCOUNTRY_CA 7542 2.16 4.97 0.96 65 XM_H_GMP 7411 5.04 4.88 5.10 66 HTML_IMAGE_RATIO_04 7024 10.74 4.63 13.35 67 ALL_TRUSTED 6965 11.15 4.59 13.95 68 XMStrtUSub 6573 8.60 4.33 10.42 69 TR_XM_PhishingBody 6422 2.38 4.23 1.59 70 HTML_IMAGE_RATIO_06 6308 4.56 4.16 4.74 71 XM_B_Investor 6301 2.12 4.15 1.26 72 XM_B_SpammyTLD 6137 2.83 4.04 2.31 73 T_XMDrugObfuBody_14 6089 2.30 4.01 1.58 74 RCVD_IN_MSPIKE_WL 6084 4.79 4.01 5.12 75 RCVD_IN_MSPIKE_H3 6084 4.79 4.01 5.12 76 XM_OfRef6 5649 1.88 3.72 1.09 77 XMNumbers 5583 3.17 3.68 2.95 78 MIME_HTML_MOSTLY 5531 2.58 3.64 2.13 79 TM2_M_VERY_LONG_WORD 5484 1.95 3.61 1.25 80 TR_XM_SpammyWords5 5341 1.93 3.52 1.25 81 HTML_IMAGE_RATIO_08 5205 2.57 3.43 2.20 82 TooManyTo_001 5109 6.70 3.37 8.12 83 MIME_HTML_ONLY_MULTI 4804 6.08 3.16 7.33 84 DKIM_ADSP_NXDOMAIN 4767 1.14 3.14 0.28 85 XM_SPF_SoftFail 4712 1.86 3.10 1.33 86 T_XMDrugObfuBody_08 4625 2.03 3.05 1.60 87 XMDiploma_00 4493 2.12 2.96 1.76 88 XM_B_Unsub2 4480 1.84 2.95 1.36 89 NO_DNS_FOR_FROM 4281 1.01 2.82 0.24 90 TR_XM_MaxWHORU 4249 0.97 2.80 0.19 91 MIME_QP_LONG_LINE 4221 4.01 2.78 4.53 92 XM_CamelCaseFrm001 4183 2.44 2.76 2.31 93 RELAYCOUNTRY_AU 4117 1.15 2.71 0.49 94 XM_UB50 4024 1.39 2.65 0.85 95 T_TooManySym_01 3874 4.80 2.55 5.76 96 XM_B_URI_Unicode 3822 1.91 2.52 1.65 97 XM_B_SpammyWords4 3704 1.16 2.44 0.61 98 XM_URI_RBL 3636 0.91 2.40 0.28 99 T_XMHurry_00 3634 1.10 2.39 0.54 100 TM2_M_URI_OPT_OUT 3582 1.83 2.36 1.60 101 MAILING_LIST_MULTI 3453 2.53 2.27 2.64 102 RCVD_IN_VALIDITY_SAFE 3444 3.05 2.27 3.38 103 TM2_M_BODY_EMPTY 3425 0.99 2.26 0.46 104 XMEmptyBody_01 3365 0.76 2.22 0.13 105 TR_XM_NoHeaderRelay 3209 0.77 2.11 0.20 106 LongTLD 3208 0.89 2.11 0.37 107 T_REMOTE_IMAGE 3179 2.97 2.09 3.35 108 XMStockSpam_06 2934 1.35 1.93 1.10 109 XM_B_SEO 2858 0.73 1.88 0.24 110 HTML_MIME_NO_HTML_TAG 2855 2.07 1.88 2.15 111 XM_DK_Undo_01 2853 1.53 1.88 1.38 112 XMBody_17 2791 0.74 1.84 0.26 113 T_XMDrugObfuBody_00 2782 1.09 1.83 0.77 114 XM_B_COPY_HTML 2769 1.02 1.82 0.68 115 FROM_EXCESS_BASE64 2700 1.66 1.78 1.60 116 XMGenDplmaNmb 2691 1.19 1.77 0.94 117 RCVD_IN_VALIDITY_CERTIFIED 2675 2.33 1.76 2.57 118 USER_IN_DEF_DKIM_WL 2536 8.57 1.67 11.52 119 SUBJ_ALL_CAPS 2515 1.37 1.66 1.25 120 SUSP_UTF8_WORD_SUBJ 2490 0.50 1.64 0.01 121 TR_XM_SEO4 2462 0.56 1.62 0.11 122 SHORTCIRCUIT 2442 0.48 1.61 0.00 123 RCVD_IN_ZEN_LASTEXTERNAL 2442 0.48 1.61 0.00 124 XM_SendGrid 2442 1.80 1.61 1.87 125 SpammyFromTLD_01 2438 1.05 1.61 0.81 126 XMBrknScrpt_02 2411 1.03 1.59 0.79 127 BAYES_40 2389 4.33 1.57 5.51 128 XMSexyCombo_01 2379 0.64 1.57 0.25 129 TR_Symld_Words 2366 1.46 1.56 1.42 130 TR_XM_INV_DKIM 2311 0.57 1.52 0.17 131 SpammyFromTLD_02 2252 0.73 1.48 0.41 132 XMBody_78 2199 0.64 1.45 0.30 133 T_FILL_THIS_FORM_SHORT 2179 1.06 1.44 0.90 134 XMPhish30 2150 0.72 1.42 0.42 135 URI_HEX 2119 1.21 1.40 1.13 136 XMNoVowels 2081 1.04 1.37 0.89 137 DIET_1 2066 0.60 1.36 0.28 138 XMSubMetaI_00 2065 0.68 1.36 0.39 139 SUSP_UTF8_WORD_COMBO 2037 0.42 1.34 0.03 140 URI_NOVOWEL 1902 1.39 1.25 1.44 141 KHOP_HELO_FCRDNS 1889 1.34 1.24 1.37 142 XMPhish14 1873 0.71 1.23 0.48 143 DKIM_ADSP_CUSTOM_MED 1832 0.85 1.21 0.70 144 TR_XM_PHPForged 1809 0.55 1.19 0.27 145 XMHTML_After_End 1793 0.59 1.18 0.33 146 TR_XM_PHPDW 1792 0.55 1.18 0.28 147 RCVD_IN_IADB_LISTED 1781 2.62 1.17 3.23 148 XMReplyNow 1772 0.54 1.17 0.27 149 URI_TRY_3LD 1771 0.68 1.17 0.48 150 TR_XM_FormFill2 1759 0.54 1.16 0.28 151 BAYES_20 1730 3.29 1.14 4.20 152 XM_H_PHPOS 1714 0.52 1.13 0.27 153 HTTPS_HTTP_MISMATCH 1714 0.93 1.13 0.84 154 XMBdyGiftCard01 1701 0.74 1.12 0.58 155 MY_SERVERS_FOUND 1700 0.50 1.12 0.24 156 TR_LOTS_OF_MONEY3 1695 0.52 1.12 0.26 157 XM_UB99 1671 0.33 1.10 0.01 158 HK_RANDOM_REPLYTO 1649 0.40 1.09 0.11 159 XM_B_COVIDMETA 1644 0.41 1.08 0.13 160 XM_B_DNDMA 1643 0.71 1.08 0.55 161 HTML_TAG_BALANCE_BODY 1610 0.64 1.06 0.47 162 XM_DIRTYINTL 1599 0.38 1.05 0.10 163 HTML_IMAGE_ONLY_20 1577 0.56 1.04 0.36 164 XM_OfRef7 1561 0.43 1.03 0.18 165 HTML_SHORT_LINK_IMG_1 1532 0.31 1.01 0.02 166 RCVD_IN_IADB_SPF 1526 2.27 1.01 2.81 167 XM_H_Long_From02 1504 0.95 0.99 0.94 168 MPART_ALT_DIFF_COUNT 1491 0.64 0.98 0.50 169 XM_B_Phish66 1486 0.56 0.98 0.39 170 TM2_M_OBFU_COMMENT 1483 0.63 0.98 0.48 171 RCVD_IN_IADB_DK 1449 1.97 0.95 2.40 172 BOTNET_NORDNS 1448 0.29 0.95 0.01 173 RELAYCOUNTRY_FR 1448 0.44 0.95 0.22 174 RCVD_IN_IADB_SENDERID 1433 2.02 0.94 2.48 175 XM_B_REG_HTML 1427 0.38 0.94 0.15 176 HOSTED_IMG_MULTI_PUB_01 1400 0.29 0.92 0.02 177 TR_XM_DK_SendGrid 1397 0.99 0.92 1.02 178 SHOPIFY_IMG_NOT_RCVD_SFY 1378 0.41 0.91 0.20 179 TR_XM_RelayPhish 1364 0.32 0.90 0.07 180 NML_ADSP_CUSTOM_MED 1364 0.61 0.90 0.49 181 XM_ProductURIs 1345 0.55 0.89 0.40 182 TR_XM_InvalidRelay 1338 0.27 0.88 0.01 183 SUBJ_DOLLARS 1285 0.56 0.85 0.44 184 RCVD_IN_PBL 1285 0.71 0.85 0.66 185 RCVD_IN_PSBL 1279 0.44 0.84 0.27 186 XM_UB999 1265 0.25 0.83 0.00 187 FORGED_GMAIL_RCVD 1259 0.52 0.83 0.39 188 XMSlimDrugH 1251 0.51 0.82 0.38 189 T_MONEY_PERCENT 1248 0.37 0.82 0.17 190 TR_LOTS_OF_MONEY2 1248 0.37 0.82 0.17 191 XM_H_Undi_Recip 1244 0.38 0.82 0.19 192 T_Symld_Words_02 1241 0.71 0.82 0.67 193 TR_XM_Base64_M1 1238 0.63 0.82 0.55 194 RDNS_DYNAMIC 1216 0.46 0.80 0.32 195 XM_UB60 1215 0.27 0.80 0.04 196 FROM_SUSPICIOUS_NTLD 1204 0.27 0.79 0.05 197 XMMoneyMeta_00 1201 0.52 0.79 0.41 198 URIBL_BLACK 1199 0.26 0.79 0.03 199 HTML_IMAGE_ONLY_08 1197 0.32 0.79 0.12 200 PDS_RDNS_DYNAMIC_FP 1187 0.37 0.78 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316054 90.22 93.38 88.86 2 RELAYCOUNTRY_US 296515 82.90 81.80 83.37 3 XM_B_Unicode 259614 75.69 82.02 72.99 4 DKIM_SIGNED 238823 72.95 86.55 67.15 5 XM_DK_Pass 234047 70.76 82.38 65.81 6 DCC_CHECK_NEGATIVE 232560 53.48 25.58 65.39 7 DKIM_VALID 230357 69.74 81.39 64.77 8 BAYES_50 199282 50.99 39.17 56.03 9 DKIM_VALID_AU 181943 55.17 64.58 51.16 10 XM_B_Unicode3 154301 45.28 49.74 43.38 11 XM_B_SpammyWords 151742 50.18 67.80 42.66 12 XMListUnsubscribeExists 151354 49.97 67.33 42.56 13 DCC_CHECK 122954 46.00 72.78 34.57 14 RCVD_IN_MSPIKE_H2 108914 32.52 36.97 30.62 15 DKIM_VALID_EF 95520 27.31 28.36 26.86 16 T_TM2_M_HEADER_IN_MSG 94398 24.76 20.60 26.54 17 XMSubLong 84053 24.19 25.49 23.63 18 HTML_FONT_LOW_CONTRAST 83660 27.34 36.27 23.52 19 MIME_HTML_ONLY 81235 24.55 28.55 22.84 20 FVGT_m_MULTI_ODD 79099 25.03 31.56 22.24 21 LOC_TINY_FONT_1 78819 29.67 47.27 22.16 22 T_KAM_HTML_FONT_INVALID 66564 22.88 32.64 18.72 23 XM_B_SpammyWords2 60559 24.03 40.44 17.03 24 BAYES_00 54175 10.85 0.58 15.23 25 ALL_TRUSTED 49625 11.15 4.59 13.95 26 HTML_IMAGE_RATIO_04 47469 10.74 4.63 13.35 27 HTML_FONT_FACE_BAD 44280 8.94 0.70 12.45 28 TR_XM_DK_Unsub 41902 14.10 19.52 11.78 29 XM_H_Trusted_IP 41807 8.24 0.00 11.75 30 XM_Multi_Part_URI 41255 14.37 20.85 11.60 31 USER_IN_DEF_DKIM_WL 40958 8.57 1.67 11.52 32 XMStrtUSub 37063 8.60 4.33 10.42 33 UNPARSEABLE_RELAY 36431 12.08 16.38 10.24 34 XM_B_PhoneNumber 33492 8.48 6.27 9.42 35 XM_Evil_Numbers_Gen 32626 9.13 9.01 9.17 36 MPART_ALT_DIFF 32059 8.32 6.71 9.01 37 XM_B_Unsub 29333 11.05 17.61 8.25 38 TooManyTo_001 28889 6.70 3.37 8.12 39 BAYES_60 26526 7.48 7.53 7.46 40 MIME_HTML_ONLY_MULTI 26064 6.08 3.16 7.33 41 LotsOfNums_01 25134 7.04 6.98 7.07 42 FSL_BULK_SIG 24678 7.59 9.11 6.94 43 TR_XM_DK_Bayes 23361 4.74 0.47 6.57 44 TR_XM_DK_Bayes1 22950 4.66 0.47 6.45 45 IN_ZIMBRA_NJ_WHITELIST 22320 4.43 0.09 6.28 46 TR_XM_BayesUnsub 21807 9.37 16.95 6.13 47 T_TooManySym_01 20487 4.80 2.55 5.76 48 LOTS_OF_MONEY 19819 7.49 11.98 5.57 49 BAYES_40 19609 4.33 1.57 5.51 50 TR_XM_DK_Bayes2 19203 3.88 0.33 5.40 51 XM_DKIMWhitelistDomains 18841 3.73 0.05 5.30 52 RCVD_IN_MSPIKE_WL 18215 4.79 4.01 5.12 53 RCVD_IN_MSPIKE_H3 18215 4.79 4.01 5.12 54 XM_H_GMP 18154 5.04 4.88 5.10 55 TR_MAX_INTL_RELAY 18123 7.96 14.67 5.10 56 XM_H_Long_From01 17021 5.03 5.60 4.79 57 HTML_IMAGE_RATIO_06 16844 4.56 4.16 4.74 58 MIME_QP_LONG_LINE 16113 4.01 2.78 4.53 59 XM_B_Phish_Phrases 16107 5.57 7.99 4.53 60 XMSubNoVowel 15932 3.27 0.42 4.48 61 XM_PDF 15723 3.30 0.68 4.42 62 XM_DK_Undo_02 14955 14.69 39.24 4.20 63 BAYES_20 14943 3.29 1.14 4.20 64 XM_B_SpammyWords3 14901 7.34 14.71 4.19 65 HTML_IMAGE_RATIO_02 13755 4.50 5.99 3.87 66 TR_XM_SpammyWords4 13373 5.81 10.61 3.76 67 XM_UncommonTLD01 13166 4.39 6.00 3.70 68 BAYES_05 12457 2.62 0.55 3.50 69 XMSubMetaSx_00 12022 4.74 7.92 3.38 70 RCVD_IN_VALIDITY_SAFE 12014 3.05 2.27 3.38 71 T_REMOTE_IMAGE 11897 2.97 2.09 3.35 72 RELAYCOUNTRY_META 11840 6.59 14.23 3.33 73 RCVD_IN_IADB_LISTED 11492 2.62 1.17 3.23 74 ANY_BOUNCE_MESSAGE 11147 2.42 0.74 3.13 75 BOUNCE_MESSAGE 11145 2.42 0.74 3.13 76 BAYES_80 11094 4.83 8.82 3.12 77 BAYES_99 10552 12.13 33.58 2.97 78 XMNumbers 10501 3.17 3.68 2.95 79 RCVD_IN_IADB_SPF 9993 2.27 1.01 2.81 80 TooManyTo_002 9990 2.19 0.73 2.81 81 BOTNET_IPINHOSTNAME 9920 4.89 9.81 2.79 82 T_TooManySym_02 9707 2.13 0.71 2.73 83 MAILING_LIST_MULTI 9397 2.53 2.27 2.64 84 RCVD_IN_VALIDITY_CERTIFIED 9136 2.33 1.76 2.57 85 RCVD_IN_IADB_SENDERID 8827 2.02 0.94 2.48 86 XM_Body_Dirty_Words 8675 4.51 9.37 2.44 87 RCVD_IN_IADB_DK 8536 1.97 0.95 2.40 88 DKIM_INVALID 8466 3.21 5.15 2.38 89 XMSubLongNoVowel 8370 1.72 0.22 2.35 90 XM_B_SpammyTLD 8220 2.83 4.04 2.31 91 XM_CamelCaseFrm001 8211 2.44 2.76 2.31 92 XMSubGarbage 8185 1.62 0.03 2.30 93 RCVD_IN_IADB_VOUCHED 8069 1.77 0.59 2.27 94 INVALID_MSGID 7867 1.62 0.24 2.21 95 BAYES_999 7857 9.50 26.59 2.21 96 HTML_IMAGE_RATIO_08 7836 2.57 3.43 2.20 97 HTML_MIME_NO_HTML_TAG 7663 2.07 1.88 2.15 98 MIME_HTML_MOSTLY 7579 2.58 3.64 2.13 99 BAYES_95 7019 3.01 5.43 1.97 100 XM_SendGrid 6668 1.80 1.61 1.87 101 XMDiploma_00 6269 2.12 2.96 1.76 102 TO_MALFORMED 6230 1.23 0.00 1.75 103 XM_B_URI_Unicode 5885 1.91 2.52 1.65 104 TM2_M_URI_OPT_OUT 5704 1.83 2.36 1.60 105 FROM_EXCESS_BASE64 5700 1.66 1.78 1.60 106 T_XMDrugObfuBody_08 5700 2.03 3.05 1.60 107 TR_XM_PhishingBody 5641 2.38 4.23 1.59 108 RCVD_IN_IADB_OPTIN 5612 1.21 0.36 1.58 109 T_XMDrugObfuBody_14 5603 2.30 4.01 1.58 110 TR_XM_SpammyRelay 5530 3.95 9.58 1.55 111 TooManyTo_003 5392 1.26 0.66 1.52 112 URI_NOVOWEL 5127 1.39 1.25 1.44 113 TR_Symld_Words 5058 1.46 1.56 1.42 114 TR_XM_DKIM_Undo 5031 9.43 28.20 1.41 115 XM_DK_Undo_01 4899 1.53 1.88 1.38 116 KHOP_HELO_FCRDNS 4887 1.34 1.24 1.37 117 IN_HORDE_ADDRESS_BOOK 4874 1.00 0.12 1.37 118 XM_B_Unsub2 4842 1.84 2.95 1.36 119 XM_SPF_SoftFail 4714 1.86 3.10 1.33 120 UNTRUSTED_Relay 4680 2.66 5.80 1.32 121 HELO_NODOT 4497 0.98 0.30 1.26 122 HELO_NO_DOMAIN 4491 0.98 0.30 1.26 123 XM_B_Investor 4474 2.12 4.15 1.26 124 TR_XM_SpammyWords5 4450 1.93 3.52 1.25 125 SUBJ_ALL_CAPS 4447 1.37 1.66 1.25 126 TM2_M_VERY_LONG_WORD 4435 1.95 3.61 1.25 127 BOTNET 4429 3.68 9.38 1.25 128 TR_XM_UnparsRelay 4340 3.24 7.98 1.22 129 XMSexyCombo_05 4244 2.38 5.15 1.19 130 XMCapTrack 4158 0.96 0.48 1.17 131 URI_HEX 4025 1.21 1.40 1.13 132 TooManyTo_004 3981 0.97 0.61 1.12 133 T_TooManySym_03 3919 0.83 0.19 1.10 134 XMStockSpam_06 3917 1.35 1.93 1.10 135 XM_OfRef6 3876 1.88 3.72 1.09 136 XM_GoogleGroups 3793 0.96 0.71 1.07 137 TR_MetaPhish_Combo_01 3662 0.88 0.52 1.03 138 TR_XM_DK_SendGrid 3634 0.99 0.92 1.02 139 XM_ShortIntro_01 3547 0.84 0.47 1.00 140 XMGappySubj_01 3543 0.75 0.18 1.00 141 TR_DCC_Bayes_99 3514 7.36 22.30 0.99 142 RELAYCOUNTRY_CA 3432 2.16 4.97 0.96 143 XM_H_Long_From02 3333 0.95 0.99 0.94 144 XMGenDplmaNmb 3327 1.19 1.77 0.94 145 XM_E_Blogspot 3229 0.67 0.10 0.91 146 T_FILL_THIS_FORM_SHORT 3211 1.06 1.44 0.90 147 TooManyTo_005 3181 0.80 0.58 0.89 148 XMNoVowels 3179 1.04 1.37 0.89 149 TVD_SPACE_RATIO 3165 0.65 0.09 0.89 150 XM_UB50 3009 1.39 2.65 0.85 151 HTTPS_HTTP_MISMATCH 2992 0.93 1.13 0.84 152 SpammyFromTLD_01 2881 1.05 1.61 0.81 153 XMBrknScrpt_02 2810 1.03 1.59 0.79 154 T_XMDrugObfuBody_00 2734 1.09 1.83 0.77 155 FROM_GOV_DKIM_AU 2679 0.64 0.38 0.75 156 DKIM_ADSP_CUSTOM_MED 2487 0.85 1.21 0.70 157 XM_H_PHPMailer 2440 0.68 0.68 0.69 158 XM_B_COPY_HTML 2423 1.02 1.82 0.68 159 T_Symld_Words_02 2379 0.71 0.82 0.67 160 RCVD_IN_PBL 2342 0.71 0.85 0.66 161 XM_B_FormFill 2203 0.44 0.01 0.62 162 XM_B_SpammyWords4 2172 1.16 2.44 0.61 163 PLING_QUERY 2164 0.60 0.57 0.61 164 XMBody_95 2113 0.49 0.26 0.59 165 RCVD_IN_BL_SPAMCOP_NET 2090 2.91 8.34 0.59 166 XMBdyGiftCard01 2053 0.74 1.12 0.58 167 XMLngstWrd_00 2041 0.52 0.38 0.57 168 TVD_RCVD_IP 2008 0.61 0.70 0.56 169 XM_B_DNDMA 1962 0.71 1.08 0.55 170 TR_XM_Base64_M1 1961 0.63 0.82 0.55 171 T_XMHurry_00 1933 1.10 2.39 0.54 172 MPART_ALT_DIFF_COUNT 1782 0.64 0.98 0.50 173 RELAYCOUNTRY_AU 1730 1.15 2.71 0.49 174 NML_ADSP_CUSTOM_MED 1728 0.61 0.90 0.49 175 T_OBFU_PDF_ATTACH 1723 0.38 0.15 0.48 176 TM2_M_OBFU_COMMENT 1711 0.63 0.98 0.48 177 XMPhish14 1711 0.71 1.23 0.48 178 MISSING_HEADERS 1701 0.49 0.52 0.48 179 URI_TRY_3LD 1699 0.68 1.17 0.48 180 HTML_TAG_BALANCE_BODY 1661 0.64 1.06 0.47 181 FROM_GOV_SPOOF 1650 0.36 0.12 0.46 182 RELAYCOUNTRY_GB 1629 0.52 0.65 0.46 183 TM2_M_BODY_EMPTY 1620 0.99 2.26 0.46 184 FILL_THIS_FORM 1616 0.40 0.28 0.45 185 HTML_IMAGE_ONLY_32 1584 0.39 0.25 0.45 186 SUBJ_DOLLARS 1568 0.56 0.85 0.44 187 XMGappySubj_02 1559 0.32 0.05 0.44 188 TO_NO_BRKTS_HTML_ONLY 1549 0.37 0.23 0.44 189 XMPhish30 1510 0.72 1.42 0.42 190 SpammyFromTLD_02 1466 0.73 1.48 0.41 191 XMMoneyMeta_00 1453 0.52 0.79 0.41 192 XM_ProductURIs 1438 0.55 0.89 0.40 193 FORGED_GMAIL_RCVD 1392 0.52 0.83 0.39 194 XMSubMetaI_00 1386 0.68 1.36 0.39 195 XMBSHREFv2 1385 0.41 0.44 0.39 196 MIME_CHARSET_FARAWAY 1374 0.50 0.77 0.39 197 XM_B_Phish66 1372 0.56 0.98 0.39 198 SHORT_HELO_AND_INLINE_IMAGE 1364 0.28 0.03 0.38 199 XMDateMe_00 1358 0.43 0.53 0.38 200 XMSlimDrugH 1347 0.51 0.82 0.38 ----------------------------------------------------------------------