Email: 433357 Autolearn: 0 AvgScore: 4.75 AvgScanTime: 1.42 sec Spam: 138668 Autolearn: 0 AvgScore: 14.32 AvgScanTime: 1.56 sec Ham: 294689 Autolearn: 0 AvgScore: 0.24 AvgScanTime: 1.35 sec Time Spent Running SA: 170.46 hours Time Spent Processing Spam: 60.08 hours Time Spent Processing Ham: 110.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132318 89.61 95.42 86.88 2 DKIM_SIGNED 124973 80.22 90.12 75.56 3 XM_DK_Pass 119692 78.00 86.32 74.09 4 RELAYCOUNTRY_US 119586 83.40 86.24 82.07 5 DKIM_VALID 118685 77.05 85.59 73.04 6 XM_B_Unicode 116239 74.77 83.83 70.50 7 DCC_CHECK 106836 51.18 77.04 39.00 8 XMListUnsubscribeExists 100119 56.10 72.20 48.52 9 XM_B_SpammyWords 96998 53.33 69.95 45.52 10 DKIM_VALID_AU 93610 61.30 67.51 58.39 11 XM_B_Unicode3 72207 44.72 52.07 41.25 12 LOC_TINY_FONT_1 70745 34.47 51.02 26.69 13 XM_B_SpammyWords2 57724 27.07 41.63 20.23 14 BAYES_50 56461 53.23 40.72 59.12 15 HTML_FONT_LOW_CONTRAST 54644 31.18 39.41 27.31 16 XM_DK_Undo_02 53357 16.08 38.48 5.55 17 RCVD_IN_MSPIKE_H2 53346 35.95 38.47 34.76 18 FVGT_m_MULTI_ODD 47961 27.90 34.59 24.75 19 T_KAM_HTML_FONT_INVALID 45032 24.45 32.47 20.67 20 BAYES_99 41370 12.38 29.83 4.17 21 DKIM_VALID_EF 39545 29.46 28.52 29.91 22 MIME_HTML_ONLY 38022 23.34 27.42 21.42 23 TR_XM_DKIM_Undo 37736 10.47 27.21 2.60 24 XMSubLong 35910 24.43 25.90 23.74 25 BAYES_999 32066 9.63 23.12 3.28 26 TR_DCC_Bayes_99 31237 8.43 22.53 1.80 27 XM_Multi_Part_URI 30791 16.35 22.20 13.59 28 T_TM2_M_HEADER_IN_MSG 29873 27.36 21.54 30.09 29 DCC_CHECK_NEGATIVE 29673 48.29 21.40 60.95 30 TR_XM_DK_Unsub 27510 15.14 19.84 12.92 31 UNPARSEABLE_RELAY 24877 13.74 17.94 11.77 32 XM_B_Unsub 22269 11.45 16.06 9.28 33 TR_XM_BayesUnsub 21636 9.50 15.60 6.62 34 TR_MAX_INTL_RELAY 21260 8.63 15.33 5.48 35 XM_B_SpammyWords3 19310 7.44 13.93 4.38 36 RELAYCOUNTRY_META 18133 6.89 13.08 3.98 37 LOTS_OF_MONEY 17552 8.29 12.66 6.23 38 TR_XM_SpammyWords4 15923 6.57 11.48 4.26 39 TR_XM_SpammyWords2 14857 4.19 10.71 1.13 40 XM_Body_Dirty_Words 13666 5.09 9.86 2.85 41 XM_Evil_Numbers_Gen 13655 9.74 9.85 9.69 42 BOTNET_IPINHOSTNAME 13510 5.51 9.74 3.52 43 BAYES_80 13197 5.33 9.52 3.35 44 TR_XM_SpammyRelay 12922 4.41 9.32 2.10 45 LotsOfNums_01 12520 8.67 9.03 8.50 46 TR_XM_UnparsRelay 12413 3.91 8.95 1.54 47 BOTNET 12040 3.86 8.68 1.60 48 FSL_BULK_SIG 11851 7.70 8.55 7.29 49 XM_B_Phish_Phrases 11740 6.78 8.47 5.99 50 BAYES_60 11577 8.41 8.35 8.44 51 RCVD_IN_BL_SPAMCOP_NET 11567 3.02 8.34 0.52 52 XMSubMetaSx_00 10260 5.10 7.40 4.02 53 MPART_ALT_DIFF 10226 5.51 7.37 4.64 54 TR_XM_SPAMCOP 9970 2.55 7.19 0.36 55 HTML_IMAGE_RATIO_02 9445 5.50 6.81 4.89 56 XM_UncommonTLD01 8698 4.82 6.27 4.13 57 XM_H_Long_From01 8087 5.82 5.83 5.82 58 BAYES_95 7628 3.21 5.50 2.13 59 XMSexyCombo_05 7581 2.97 5.47 1.80 60 XM_B_PhoneNumber 7497 8.39 5.41 9.80 61 XM_H_GMP 7343 5.41 5.30 5.46 62 UNTRUSTED_Relay 6669 2.51 4.81 1.42 63 TM2_M_VERY_LONG_WORD 6554 3.45 4.73 2.85 64 TR_XM_PhishingBody 6461 2.53 4.66 1.52 65 RELAYCOUNTRY_CA 6413 2.38 4.62 1.32 66 DKIM_INVALID 6288 3.17 4.53 2.53 67 HTML_IMAGE_RATIO_04 6191 5.11 4.46 5.41 68 T_XMDrugObfuBody_14 6067 2.69 4.38 1.89 69 XM_B_Investor 5946 2.34 4.29 1.42 70 HTML_IMAGE_RATIO_06 5890 2.94 4.25 2.33 71 XMStrtUSub 5402 4.46 3.90 4.72 72 XM_CamelCaseFrm001 5333 2.97 3.85 2.55 73 MIME_HTML_MOSTLY 5313 2.85 3.83 2.39 74 XM_B_SpammyTLD 5258 3.14 3.79 2.83 75 MIME_HTML_ONLY_MULTI 5171 3.00 3.73 2.66 76 RCVD_IN_MSPIKE_WL 5119 4.68 3.69 5.15 77 RCVD_IN_MSPIKE_H3 5119 4.68 3.69 5.15 78 TR_XM_SpammyWords5 5004 2.14 3.61 1.45 79 RCVD_IN_VALIDITY_RPBL 5003 1.19 3.61 0.06 80 T_XMDrugObfuBody_08 4973 2.54 3.59 2.05 81 XMNumbers 4958 3.31 3.58 3.19 82 XM_OfRef6 4937 2.11 3.56 1.43 83 TooManyTo_001 4779 7.30 3.45 9.11 84 XMDiploma_00 4485 2.15 3.23 1.64 85 HTML_IMAGE_RATIO_08 4447 2.35 3.21 1.95 86 XM_SPF_SoftFail 4356 2.03 3.14 1.51 87 TM2_M_URI_OPT_OUT 4264 2.30 3.07 1.93 88 RCVD_IN_VALIDITY_SAFE 4072 3.79 2.94 4.20 89 RELAYCOUNTRY_AU 4020 1.43 2.90 0.74 90 MIME_QP_LONG_LINE 3950 4.32 2.85 5.01 91 XM_B_SpammyWords4 3836 1.44 2.77 0.81 92 T_XMHurry_00 3700 1.26 2.67 0.60 93 XM_URI_RBL 3656 1.11 2.64 0.39 94 FROM_EXCESS_BASE64 3593 2.11 2.59 1.88 95 DKIM_ADSP_NXDOMAIN 3520 1.04 2.54 0.33 96 XM_SendGrid 3396 1.79 2.45 1.48 97 XMBody_17 3380 1.08 2.44 0.43 98 T_TooManySym_01 3362 5.15 2.42 6.43 99 NO_DNS_FOR_FROM 3310 1.00 2.39 0.34 100 TR_XM_MaxWHORU 3302 0.96 2.38 0.29 101 XM_B_Unsub2 3260 1.78 2.35 1.52 102 XM_B_URI_Unicode 3210 2.09 2.31 1.99 103 XM_UB50 3195 1.36 2.30 0.92 104 MAILING_LIST_MULTI 3125 2.59 2.25 2.75 105 USER_IN_DEF_DKIM_WL 3059 9.76 2.21 13.31 106 RCVD_IN_VALIDITY_CERTIFIED 2923 2.84 2.11 3.18 107 XMPhish30 2804 0.96 2.02 0.46 108 SpammyFromTLD_02 2784 1.04 2.01 0.59 109 XMStockSpam_06 2659 1.48 1.92 1.27 110 TR_XM_NoHeaderRelay 2658 0.76 1.92 0.21 111 T_XMDrugObfuBody_00 2605 1.03 1.88 0.64 112 SUBJ_ALL_CAPS 2451 1.61 1.77 1.53 113 NORDNS_LOW_CONTRAST 2436 0.59 1.76 0.04 114 LongTLD 2407 0.83 1.74 0.40 115 BAYES_40 2326 3.91 1.68 4.96 116 XM_B_DNDMA 2324 0.91 1.68 0.55 117 XM_DK_Undo_01 2262 1.52 1.63 1.47 118 XMGenDplmaNmb 2228 1.04 1.61 0.77 119 XMSubMetaI_00 2206 1.03 1.59 0.77 120 XM_B_SEO 2194 0.70 1.58 0.28 121 SpammyFromTLD_01 2186 1.03 1.58 0.78 122 XMBrknScrpt_02 2148 1.18 1.55 1.01 123 HTML_MIME_NO_HTML_TAG 2129 2.44 1.54 2.87 124 RCVD_IN_ZEN_LASTEXTERNAL 2115 0.49 1.53 0.00 125 SHORTCIRCUIT 2115 0.49 1.53 0.00 126 T_REMOTE_IMAGE 2083 2.98 1.50 3.67 127 T_FILL_THIS_FORM_SHORT 2028 1.22 1.46 1.10 128 XM_DIRTYINTL 2025 0.66 1.46 0.29 129 TR_XM_INV_DKIM 1999 0.57 1.44 0.16 130 SUSP_UTF8_WORD_SUBJ 1935 0.46 1.40 0.02 131 BAYES_20 1934 3.04 1.39 3.82 132 XMBody_78 1931 0.59 1.39 0.21 133 KHOP_HELO_FCRDNS 1919 1.89 1.38 2.13 134 XM_B_COPY_HTML 1900 0.99 1.37 0.81 135 TR_XM_Base64_M1 1879 0.92 1.36 0.71 136 THIS_AD 1859 0.84 1.34 0.60 137 MIME_CHARSET_FARAWAY 1845 0.85 1.33 0.63 138 TR_XM_SEO4 1839 0.50 1.33 0.12 139 XM_H_Long_From02 1837 1.11 1.32 1.00 140 URI_NOVOWEL 1829 1.39 1.32 1.42 141 SHOPIFY_IMG_NOT_RCVD_SFY 1817 0.62 1.31 0.30 142 DKIM_ADSP_CUSTOM_MED 1808 1.07 1.30 0.96 143 XM_ProductURIs 1753 0.79 1.26 0.57 144 ALL_TRUSTED 1741 10.41 1.26 14.71 145 XMBdyGiftCard01 1740 0.90 1.25 0.73 146 URI_HEX 1694 1.14 1.22 1.11 147 TM2_M_OBFU_COMMENT 1646 0.72 1.19 0.50 148 RCVD_IN_PSBL 1629 0.57 1.17 0.29 149 BOUNCE_MESSAGE 1581 3.21 1.14 4.19 150 ANY_BOUNCE_MESSAGE 1581 3.21 1.14 4.19 151 URI_TRY_3LD 1580 0.90 1.14 0.79 152 XM_B_Phish66 1578 0.65 1.14 0.42 153 XM_B_COVIDMETA 1563 0.53 1.13 0.25 154 RCVD_IN_IADB_LISTED 1559 2.91 1.12 3.75 155 UNICODE_OBFU_ASC 1557 0.36 1.12 0.01 156 STY_INVIS_DIRECT 1554 0.54 1.12 0.27 157 XMReplyNow 1531 0.49 1.10 0.21 158 DIET_1 1466 0.58 1.06 0.35 159 XM_B_REG_HTML 1462 0.46 1.05 0.18 160 TR_XM_PHPForged 1445 0.62 1.04 0.43 161 NML_ADSP_CUSTOM_MED 1443 0.74 1.04 0.60 162 XMNoVowels 1442 0.95 1.04 0.91 163 TR_Symld_Words 1441 1.40 1.04 1.57 164 TR_XM_PHPDW 1423 0.62 1.03 0.43 165 XMSexyCombo_01 1401 0.47 1.01 0.22 166 TR_XM_FormFill2 1396 0.61 1.01 0.43 167 RDNS_DYNAMIC 1393 0.58 1.00 0.37 168 XMHTML_After_End 1392 0.53 1.00 0.30 169 FORGED_GMAIL_RCVD 1386 0.76 1.00 0.65 170 MPART_ALT_DIFF_COUNT 1385 0.71 1.00 0.58 171 RCVD_IN_IADB_SPF 1383 2.54 1.00 3.27 172 PDS_RDNS_DYNAMIC_FP 1369 0.47 0.99 0.22 173 TR_LOTS_OF_MONEY3 1368 0.48 0.99 0.24 174 TR_XM_DK_SendGrid 1357 0.96 0.98 0.96 175 XM_H_PHPOS 1350 0.60 0.97 0.42 176 RELAYCOUNTRY_FR 1331 0.47 0.96 0.23 177 XM_OfRef7 1328 0.49 0.96 0.28 178 HTML_TAG_BALANCE_BODY 1312 0.81 0.95 0.74 179 RCVD_IN_IADB_DK 1308 2.24 0.94 2.85 180 RCVD_IN_IADB_SENDERID 1298 2.30 0.94 2.94 181 XMClaimOffer 1292 0.44 0.93 0.21 182 XM_UB99 1284 0.30 0.93 0.00 183 BAYES_05 1231 1.85 0.89 2.30 184 XMPhish14 1224 0.53 0.88 0.36 185 HTTPS_HTTP_MISMATCH 1221 0.79 0.88 0.75 186 BOTNET_NORDNS 1214 0.29 0.88 0.02 187 TR_MetaPhish_Combo_01 1210 0.69 0.87 0.61 188 TVD_RCVD_IP 1204 0.70 0.87 0.62 189 HTML_FONT_TINY_NORDNS 1181 0.32 0.85 0.06 190 XMSubMetaSSx_00 1166 0.53 0.84 0.38 191 RCVD_IN_PBL 1125 0.73 0.81 0.68 192 FUZZY_CREDIT 1121 0.27 0.81 0.01 193 FUZZY_BITCOIN 1119 0.26 0.81 0.01 194 XMHTMLBadTable_001 1112 0.41 0.80 0.23 195 XMSubMetaSxObfu_02 1104 0.44 0.80 0.27 196 XM_PDF 1081 3.53 0.78 4.83 197 XM_GoogleGroups 1080 1.02 0.78 1.14 198 XM_HighProb1 1053 0.25 0.76 0.01 199 XMSubMetaSxObfu_03 1031 0.56 0.74 0.48 200 XM_RXBody 1029 0.70 0.74 0.68 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 256033 89.61 95.42 86.88 2 RELAYCOUNTRY_US 241842 83.40 86.24 82.07 3 DKIM_SIGNED 222674 80.22 90.12 75.56 4 XM_DK_Pass 218331 78.00 86.32 74.09 5 DKIM_VALID 215229 77.05 85.59 73.04 6 XM_B_Unicode 207762 74.77 83.83 70.50 7 DCC_CHECK_NEGATIVE 179606 48.29 21.40 60.95 8 BAYES_50 174225 53.23 40.72 59.12 9 DKIM_VALID_AU 172056 61.30 67.51 58.39 10 XMListUnsubscribeExists 142974 56.10 72.20 48.52 11 XM_B_SpammyWords 134128 53.33 69.95 45.52 12 XM_B_Unicode3 121570 44.72 52.07 41.25 13 DCC_CHECK 114941 51.18 77.04 39.00 14 RCVD_IN_MSPIKE_H2 102428 35.95 38.47 34.76 15 T_TM2_M_HEADER_IN_MSG 88682 27.36 21.54 30.09 16 DKIM_VALID_EF 88137 29.46 28.52 29.91 17 HTML_FONT_LOW_CONTRAST 80472 31.18 39.41 27.31 18 LOC_TINY_FONT_1 78653 34.47 51.02 26.69 19 FVGT_m_MULTI_ODD 72943 27.90 34.59 24.75 20 XMSubLong 69946 24.43 25.90 23.74 21 MIME_HTML_ONLY 63117 23.34 27.42 21.42 22 T_KAM_HTML_FONT_INVALID 60903 24.45 32.47 20.67 23 XM_B_SpammyWords2 59605 27.07 41.63 20.23 24 ALL_TRUSTED 43350 10.41 1.26 14.71 25 XM_Multi_Part_URI 40045 16.35 22.20 13.59 26 USER_IN_DEF_DKIM_WL 39231 9.76 2.21 13.31 27 TR_XM_DK_Unsub 38080 15.14 19.84 12.92 28 UNPARSEABLE_RELAY 34672 13.74 17.94 11.77 29 BAYES_00 34513 8.15 0.60 11.71 30 XM_B_PhoneNumber 28866 8.39 5.41 9.80 31 XM_Evil_Numbers_Gen 28568 9.74 9.85 9.69 32 XM_B_Unsub 27336 11.45 16.06 9.28 33 TooManyTo_001 26846 7.30 3.45 9.11 34 LotsOfNums_01 25059 8.67 9.03 8.50 35 BAYES_60 24870 8.41 8.35 8.44 36 FSL_BULK_SIG 21496 7.70 8.55 7.29 37 IN_ZIMBRA_NJ_WHITELIST 21419 4.97 0.08 7.27 38 TR_XM_DK_Bayes 21285 5.06 0.47 7.22 39 TR_XM_DK_Bayes1 20937 4.98 0.47 7.10 40 TR_XM_BayesUnsub 19518 9.50 15.60 6.62 41 XM_DKIMWhitelistDomains 19474 4.54 0.13 6.61 42 T_TooManySym_01 18940 5.15 2.42 6.43 43 LOTS_OF_MONEY 18357 8.29 12.66 6.23 44 XM_B_Phish_Phrases 17642 6.78 8.47 5.99 45 TR_XM_DK_Bayes2 17413 4.13 0.36 5.91 46 XM_H_Long_From01 17154 5.82 5.83 5.82 47 XM_DK_Undo_02 16345 16.08 38.48 5.55 48 TR_MAX_INTL_RELAY 16153 8.63 15.33 5.48 49 XM_H_GMP 16082 5.41 5.30 5.46 50 HTML_IMAGE_RATIO_04 15941 5.11 4.46 5.41 51 RCVD_IN_MSPIKE_H3 15180 4.68 3.69 5.15 52 RCVD_IN_MSPIKE_WL 15180 4.68 3.69 5.15 53 MIME_QP_LONG_LINE 14758 4.32 2.85 5.01 54 BAYES_40 14612 3.91 1.68 4.96 55 HTML_IMAGE_RATIO_02 14411 5.50 6.81 4.89 56 XM_PDF 14227 3.53 0.78 4.83 57 XMStrtUSub 13921 4.46 3.90 4.72 58 MPART_ALT_DIFF 13670 5.51 7.37 4.64 59 XM_B_SpammyWords3 12917 7.44 13.93 4.38 60 TR_XM_SpammyWords4 12561 6.57 11.48 4.26 61 RCVD_IN_VALIDITY_SAFE 12369 3.79 2.94 4.20 62 ANY_BOUNCE_MESSAGE 12344 3.21 1.14 4.19 63 BOUNCE_MESSAGE 12344 3.21 1.14 4.19 64 BAYES_99 12280 12.38 29.83 4.17 65 XM_UncommonTLD01 12184 4.82 6.27 4.13 66 XMSubMetaSx_00 11833 5.10 7.40 4.02 67 RELAYCOUNTRY_META 11742 6.89 13.08 3.98 68 BAYES_20 11256 3.04 1.39 3.82 69 RCVD_IN_IADB_LISTED 11038 2.91 1.12 3.75 70 T_REMOTE_IMAGE 10823 2.98 1.50 3.67 71 BOTNET_IPINHOSTNAME 10384 5.51 9.74 3.52 72 BAYES_80 9881 5.33 9.52 3.35 73 T_TooManySym_02 9847 2.47 0.61 3.34 74 TooManyTo_002 9835 2.49 0.68 3.34 75 BAYES_999 9679 9.63 23.12 3.28 76 RCVD_IN_IADB_SPF 9645 2.54 1.00 3.27 77 XMNumbers 9397 3.31 3.58 3.19 78 RCVD_IN_VALIDITY_CERTIFIED 9372 2.84 2.11 3.18 79 RCVD_IN_IADB_SENDERID 8664 2.30 0.94 2.94 80 HTML_MIME_NO_HTML_TAG 8458 2.44 1.54 2.87 81 XM_Body_Dirty_Words 8391 5.09 9.86 2.85 82 RCVD_IN_IADB_DK 8389 2.24 0.94 2.85 83 TM2_M_VERY_LONG_WORD 8386 3.45 4.73 2.85 84 XM_B_SpammyTLD 8329 3.14 3.79 2.83 85 MAILING_LIST_MULTI 8105 2.59 2.25 2.75 86 MIME_HTML_ONLY_MULTI 7836 3.00 3.73 2.66 87 TR_XM_DKIM_Undo 7649 10.47 27.21 2.60 88 XM_CamelCaseFrm001 7524 2.97 3.85 2.55 89 DKIM_INVALID 7445 3.17 4.53 2.53 90 MIME_HTML_MOSTLY 7036 2.85 3.83 2.39 91 RCVD_IN_IADB_VOUCHED 7034 1.79 0.52 2.39 92 INVALID_MSGID 6994 1.67 0.17 2.37 93 HTML_IMAGE_RATIO_06 6852 2.94 4.25 2.33 94 BAYES_05 6785 1.85 0.89 2.30 95 KHOP_HELO_FCRDNS 6279 1.89 1.38 2.13 96 BAYES_95 6264 3.21 5.50 2.13 97 TO_MALFORMED 6214 1.44 0.02 2.11 98 TR_XM_SpammyRelay 6200 4.41 9.32 2.10 99 T_XMDrugObfuBody_08 6039 2.54 3.59 2.05 100 XM_B_URI_Unicode 5862 2.09 2.31 1.99 101 HTML_IMAGE_RATIO_08 5733 2.35 3.21 1.95 102 TM2_M_URI_OPT_OUT 5687 2.30 3.07 1.93 103 T_XMDrugObfuBody_14 5574 2.69 4.38 1.89 104 FROM_EXCESS_BASE64 5542 2.11 2.59 1.88 105 TR_DCC_Bayes_99 5316 8.43 22.53 1.80 106 XMSexyCombo_05 5311 2.97 5.47 1.80 107 TooManyTo_003 5187 1.39 0.59 1.76 108 RCVD_IN_IADB_OPTIN 4835 1.23 0.35 1.64 109 XMDiploma_00 4820 2.15 3.23 1.64 110 BOTNET 4703 3.86 8.68 1.60 111 XMGappySubj_01 4666 1.13 0.16 1.58 112 IN_HORDE_ADDRESS_BOOK 4662 1.11 0.10 1.58 113 TR_Symld_Words 4628 1.40 1.04 1.57 114 TR_XM_UnparsRelay 4525 3.91 8.95 1.54 115 SUBJ_ALL_CAPS 4517 1.61 1.77 1.53 116 TR_XM_PhishingBody 4492 2.53 4.66 1.52 117 XM_B_Unsub2 4472 1.78 2.35 1.52 118 XM_SPF_SoftFail 4459 2.03 3.14 1.51 119 XM_SendGrid 4373 1.79 2.45 1.48 120 XM_DK_Undo_01 4336 1.52 1.63 1.47 121 TR_XM_SpammyWords5 4277 2.14 3.61 1.45 122 XM_OfRef6 4217 2.11 3.56 1.43 123 XM_B_Investor 4194 2.34 4.29 1.42 124 UNTRUSTED_Relay 4194 2.51 4.81 1.42 125 URI_NOVOWEL 4187 1.39 1.32 1.42 126 T_TooManySym_03 4183 1.02 0.19 1.42 127 RELAYCOUNTRY_CA 3896 2.38 4.62 1.32 128 TooManyTo_004 3794 1.05 0.55 1.29 129 XMStockSpam_06 3755 1.48 1.92 1.27 130 HELO_NODOT 3420 0.84 0.16 1.16 131 HELO_NO_DOMAIN 3416 0.84 0.16 1.16 132 XM_GoogleGroups 3349 1.02 0.78 1.14 133 TR_XM_SpammyWords2 3318 4.19 10.71 1.13 134 XMCapTrack 3280 0.89 0.42 1.11 135 URI_HEX 3266 1.14 1.22 1.11 136 T_FILL_THIS_FORM_SHORT 3242 1.22 1.46 1.10 137 TVD_SPACE_RATIO 3056 0.74 0.12 1.04 138 XMBrknScrpt_02 2975 1.18 1.55 1.01 139 TooManyTo_005 2967 0.85 0.52 1.01 140 XM_B_FormFill 2966 0.69 0.02 1.01 141 XM_H_Long_From02 2955 1.11 1.32 1.00 142 DKIM_ADSP_CUSTOM_MED 2830 1.07 1.30 0.96 143 TR_XM_DK_SendGrid 2815 0.96 0.98 0.96 144 FROM_GOV_DKIM_AU 2768 0.70 0.18 0.94 145 XM_UB50 2708 1.36 2.30 0.92 146 XMNoVowels 2692 0.95 1.04 0.91 147 XMGappySubj_02 2659 0.63 0.05 0.90 148 XM_ShortIntro_01 2543 0.72 0.41 0.86 149 XM_B_SpammyWords4 2401 1.44 2.77 0.81 150 XM_B_COPY_HTML 2399 0.99 1.37 0.81 151 URI_TRY_3LD 2330 0.90 1.14 0.79 152 SpammyFromTLD_01 2295 1.03 1.58 0.78 153 XMGenDplmaNmb 2282 1.04 1.61 0.77 154 XMSubMetaI_00 2260 1.03 1.59 0.77 155 XMBody_95 2255 0.59 0.21 0.77 156 HTTPS_HTTP_MISMATCH 2215 0.79 0.88 0.75 157 HTML_TAG_BALANCE_BODY 2192 0.81 0.95 0.74 158 FILL_THIS_FORM 2186 0.59 0.26 0.74 159 XM_H_PHPMailer 2175 0.67 0.52 0.74 160 RELAYCOUNTRY_AU 2168 1.43 2.90 0.74 161 T_TVD_MIME_NO_HEADERS 2157 0.51 0.02 0.73 162 XMBdyGiftCard01 2147 0.90 1.25 0.73 163 TR_XM_Base64_M1 2100 0.92 1.36 0.71 164 RCVD_IN_PBL 2017 0.73 0.81 0.68 165 XM_RXBody 2012 0.70 0.74 0.68 166 HTML_IMAGE_ONLY_20 1998 0.64 0.56 0.68 167 TO_NO_BRKTS_HTML_ONLY 1922 0.51 0.22 0.65 168 T_OBFU_PDF_ATTACH 1914 0.50 0.17 0.65 169 FORGED_GMAIL_RCVD 1902 0.76 1.00 0.65 170 XMMoneyMeta_00 1897 0.65 0.65 0.64 171 T_XMDrugObfuBody_00 1873 1.03 1.88 0.64 172 MIME_CHARSET_FARAWAY 1855 0.85 1.33 0.63 173 TVD_RCVD_IP 1816 0.70 0.87 0.62 174 TR_MetaPhish_Combo_01 1791 0.69 0.87 0.61 175 THIS_AD 1780 0.84 1.34 0.60 176 T_XMHurry_00 1776 1.26 2.67 0.60 177 NML_ADSP_CUSTOM_MED 1773 0.74 1.04 0.60 178 MISSING_HEADERS 1770 0.58 0.54 0.60 179 SpammyFromTLD_02 1724 1.04 2.01 0.59 180 MPART_ALT_DIFF_COUNT 1708 0.71 1.00 0.58 181 XM_ProductURIs 1688 0.79 1.26 0.57 182 XMLngstWrd_00 1655 0.61 0.72 0.56 183 XM_B_DNDMA 1625 0.91 1.68 0.55 184 RCVD_IN_BL_SPAMCOP_NET 1536 3.02 8.34 0.52 185 XMSlimDrugH 1531 0.53 0.55 0.52 186 TM2_M_OBFU_COMMENT 1478 0.72 1.19 0.50 187 T_Symld_Words_02 1469 0.55 0.66 0.50 188 RELAYCOUNTRY_GB 1451 0.53 0.61 0.49 189 FROM_GOV_SPOOF 1445 0.38 0.16 0.49 190 XMSubMetaSxObfu_03 1410 0.56 0.74 0.48 191 HTML_IMAGE_ONLY_28 1384 0.41 0.27 0.47 192 HTML_FONT_FACE_BAD 1367 0.52 0.65 0.46 193 HTML_IMAGE_ONLY_32 1352 0.36 0.16 0.46 194 XMPhish30 1352 0.96 2.02 0.46 195 USER_IN_WHITELIST 1329 0.31 0.00 0.45 196 USER_IN_WELCOMELIST 1329 0.31 0.00 0.45 197 MSGID_FROM_MTA_HEADER 1322 0.34 0.12 0.45 198 PLING_QUERY 1291 0.51 0.65 0.44 199 XMBody_17 1279 1.08 2.44 0.43 200 TR_XM_FormFill2 1268 0.61 1.01 0.43 ----------------------------------------------------------------------