Email: 504955 Autolearn: 0 AvgScore: 2.76 AvgScanTime: 1.53 sec Spam: 145252 Autolearn: 0 AvgScore: 14.84 AvgScanTime: 1.73 sec Ham: 359703 Autolearn: 0 AvgScore: -2.12 AvgScanTime: 1.46 sec Time Spent Running SA: 215.27 hours Time Spent Processing Spam: 69.76 hours Time Spent Processing Ham: 145.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136999 90.59 94.32 89.08 2 DKIM_SIGNED 129938 72.64 89.46 65.85 3 XM_DK_Pass 124015 70.50 85.38 64.49 4 DKIM_VALID 122692 69.52 84.47 63.49 5 RELAYCOUNTRY_US 122020 83.88 84.01 83.83 6 XM_B_Unicode 119656 76.04 82.38 73.48 7 DCC_CHECK 108382 45.69 74.62 34.01 8 XM_B_SpammyWords 100951 51.63 69.50 44.41 9 XMListUnsubscribeExists 100355 49.78 69.09 41.98 10 DKIM_VALID_AU 97348 55.19 67.02 50.41 11 XM_B_Unicode3 72246 45.10 49.74 43.23 12 LOC_TINY_FONT_1 69205 30.32 47.64 23.32 13 XM_B_SpammyWords2 60008 24.31 41.31 17.44 14 BAYES_50 58569 51.46 40.32 55.96 15 XM_DK_Undo_02 56912 14.20 39.18 4.11 16 RCVD_IN_MSPIKE_H2 54577 32.35 37.57 30.25 17 HTML_FONT_LOW_CONTRAST 53333 27.88 36.72 24.32 18 FVGT_m_MULTI_ODD 49006 24.79 33.74 21.18 19 T_KAM_HTML_FONT_INVALID 47124 22.33 32.44 18.25 20 BAYES_99 44844 10.89 30.87 2.81 21 DKIM_VALID_EF 42547 27.20 29.29 26.36 22 TR_XM_DKIM_Undo 40486 9.14 27.87 1.58 23 MIME_HTML_ONLY 39933 24.67 27.49 23.53 24 XMSubLong 36187 23.35 24.91 22.73 25 BAYES_999 34772 8.40 23.94 2.12 26 DCC_CHECK_NEGATIVE 34178 53.75 23.53 65.95 27 T_TM2_M_HEADER_IN_MSG 32337 25.53 22.26 26.85 28 TR_DCC_Bayes_99 32249 6.93 22.20 0.76 29 XM_Multi_Part_URI 32137 14.42 22.12 11.31 30 TR_XM_DK_Unsub 28906 13.97 19.90 11.57 31 XM_B_Unsub 26472 11.28 18.22 8.47 32 TR_XM_BayesUnsub 25207 9.33 17.35 6.09 33 UNPARSEABLE_RELAY 24370 12.11 16.78 10.22 34 RELAYCOUNTRY_META 21762 6.66 14.98 3.31 35 TR_MAX_INTL_RELAY 21637 7.76 14.90 4.87 36 XM_B_SpammyWords3 20639 7.07 14.21 4.18 37 LOTS_OF_MONEY 18395 7.63 12.66 5.60 38 TR_XM_SpammyWords2 16946 3.56 11.67 0.29 39 TR_XM_SpammyWords4 16473 5.99 11.34 3.82 40 TR_XM_SpammyRelay 16272 4.42 11.20 1.69 41 BOTNET_IPINHOSTNAME 15168 5.09 10.44 2.92 42 XM_Evil_Numbers_Gen 13858 9.65 9.54 9.70 43 BAYES_80 13293 4.77 9.15 3.00 44 FSL_BULK_SIG 13239 7.55 9.11 6.92 45 BOTNET 13073 3.67 9.00 1.52 46 XM_B_Phish_Phrases 12466 6.29 8.58 5.37 47 RCVD_IN_BL_SPAMCOP_NET 12140 2.78 8.36 0.52 48 TR_XM_UnparsRelay 11552 3.33 7.95 1.46 49 XM_Body_Dirty_Words 11452 3.77 7.88 2.11 50 LotsOfNums_01 11389 7.79 7.84 7.77 51 BAYES_60 11388 7.50 7.84 7.36 52 XMSubMetaSx_00 10225 4.09 7.04 2.90 53 MPART_ALT_DIFF 10208 8.90 7.03 9.65 54 TR_XM_SPAMCOP 9978 2.25 6.87 0.38 55 XM_UncommonTLD01 9577 4.57 6.59 3.76 56 XM_B_PhoneNumber 9437 8.10 6.50 8.74 57 HTML_IMAGE_RATIO_02 8792 4.55 6.05 3.94 58 XM_H_Long_From01 8684 5.41 5.98 5.19 59 UNTRUSTED_Relay 8643 2.53 5.95 1.15 60 XM_H_GMP 8535 5.26 5.88 5.01 61 BAYES_95 7991 2.92 5.50 1.87 62 XM_B_Investor 7853 2.66 5.41 1.56 63 RELAYCOUNTRY_CA 7476 2.13 5.15 0.91 64 DKIM_INVALID 7246 3.12 4.99 2.37 65 HTML_IMAGE_RATIO_04 7086 12.10 4.88 15.01 66 TR_XM_PhishingBody 6680 2.36 4.60 1.46 67 XM_B_SpammyTLD 6614 2.90 4.55 2.23 68 T_XMDrugObfuBody_14 6537 2.40 4.50 1.55 69 HTML_IMAGE_RATIO_06 6021 4.65 4.15 4.85 70 RCVD_IN_MSPIKE_H3 5739 4.44 3.95 4.64 71 RCVD_IN_MSPIKE_WL 5739 4.44 3.95 4.64 72 TM2_M_VERY_LONG_WORD 5674 2.64 3.91 2.13 73 T_XMDrugObfuBody_08 5616 2.31 3.87 1.68 74 TR_XM_SpammyWords5 5596 1.99 3.85 1.23 75 XMStrtUSub 5492 9.16 3.78 11.33 76 MIME_HTML_ONLY_MULTI 5431 6.77 3.74 7.99 77 TooManyTo_001 5404 6.75 3.72 7.97 78 RCVD_IN_VALIDITY_RPBL 5349 1.12 3.68 0.09 79 HTML_IMAGE_RATIO_08 5337 2.46 3.67 1.96 80 XM_OfRef6 5318 1.76 3.66 0.99 81 MIME_HTML_MOSTLY 5192 2.75 3.57 2.42 82 XMNumbers 5156 3.02 3.55 2.81 83 MIME_QP_LONG_LINE 5022 4.39 3.46 4.76 84 XMSexyCombo_05 4992 1.63 3.44 0.91 85 XM_SPF_SoftFail 4945 1.95 3.40 1.36 86 XMDiploma_00 4490 1.81 3.09 1.29 87 RELAYCOUNTRY_AU 4461 1.25 3.07 0.52 88 TM2_M_URI_OPT_OUT 4287 1.86 2.95 1.42 89 XM_CamelCaseFrm001 4245 2.20 2.92 1.91 90 XM_B_Unsub2 4132 1.92 2.84 1.55 91 XM_B_URI_Unicode 4112 2.05 2.83 1.74 92 XM_B_SpammyWords4 3917 1.36 2.70 0.83 93 XM_URI_RBL 3792 0.95 2.61 0.28 94 XM_UB50 3653 1.26 2.51 0.75 95 T_TooManySym_01 3607 4.47 2.48 5.27 96 MAILING_LIST_MULTI 3604 2.49 2.48 2.50 97 TR_XM_NoHeaderRelay 3554 0.88 2.45 0.24 98 XMBody_17 3524 0.98 2.43 0.40 99 SpammyFromTLD_02 3451 0.99 2.38 0.43 100 RCVD_IN_VALIDITY_SAFE 3378 3.16 2.33 3.49 101 DKIM_ADSP_NXDOMAIN 3351 0.86 2.31 0.28 102 HTML_MIME_NO_HTML_TAG 2864 2.17 1.97 2.25 103 NO_DNS_FOR_FROM 2830 0.74 1.95 0.25 104 RCVD_IN_VALIDITY_CERTIFIED 2827 2.38 1.95 2.56 105 TR_XM_MaxWHORU 2806 0.70 1.93 0.20 106 T_XMHurry_00 2730 0.93 1.88 0.55 107 BAYES_40 2680 4.63 1.85 5.75 108 SHORTCIRCUIT 2643 0.52 1.82 0.00 109 RCVD_IN_ZEN_LASTEXTERNAL 2643 0.52 1.82 0.00 110 SUBJ_ALL_CAPS 2632 1.39 1.81 1.21 111 XMStockSpam_06 2576 1.31 1.77 1.13 112 XMBody_78 2566 0.70 1.77 0.28 113 SpammyFromTLD_01 2530 1.06 1.74 0.79 114 XM_DK_Undo_01 2517 1.52 1.73 1.44 115 SUSP_UTF8_WORD_SUBJ 2469 0.51 1.70 0.03 116 T_FILL_THIS_FORM_SHORT 2446 1.13 1.68 0.90 117 FROM_EXCESS_BASE64 2426 1.59 1.67 1.55 118 XM_SendGrid 2406 1.38 1.66 1.27 119 TR_XM_INV_DKIM 2394 0.60 1.65 0.18 120 XMPhish30 2301 0.76 1.58 0.43 121 ALL_TRUSTED 2298 10.21 1.58 13.69 122 XMGenDplmaNmb 2272 0.93 1.56 0.68 123 T_REMOTE_IMAGE 2269 2.68 1.56 3.13 124 RCVD_IN_PSBL 2240 0.65 1.54 0.29 125 LongTLD 2176 0.72 1.50 0.40 126 T_XMDrugObfuBody_00 2081 0.90 1.43 0.68 127 TR_Mismatch_TLD_02 2038 0.48 1.40 0.10 128 XM_B_SEO 2035 0.58 1.40 0.25 129 BAYES_20 2009 3.79 1.38 4.76 130 NORDNS_LOW_CONTRAST 1978 0.42 1.36 0.04 131 USER_IN_DEF_DKIM_WL 1975 8.35 1.36 11.18 132 URI_HEX 1960 1.16 1.35 1.08 133 KHOP_HELO_FCRDNS 1934 1.61 1.33 1.72 134 XM_H_Long_From02 1913 0.98 1.32 0.84 135 XM_B_COVIDMETA 1904 0.52 1.31 0.20 136 XM_OfRef7 1846 0.51 1.27 0.21 137 XMBrknScrpt_02 1839 0.90 1.27 0.76 138 BOTNET_NORDNS 1838 0.37 1.27 0.01 139 XM_UB99 1835 0.37 1.26 0.00 140 XM_B_COPY_HTML 1799 0.92 1.24 0.78 141 XM_B_Phish66 1768 0.56 1.22 0.30 142 RELAYCOUNTRY_FR 1758 0.49 1.21 0.21 143 DKIM_ADSP_CUSTOM_MED 1727 0.88 1.19 0.76 144 XMSlimDrugH 1688 0.60 1.16 0.37 145 HTTPS_HTTP_MISMATCH 1682 0.88 1.16 0.76 146 RCVD_IN_IADB_LISTED 1675 2.55 1.15 3.11 147 DIET_1 1659 0.50 1.14 0.24 148 URI_NOVOWEL 1655 1.41 1.14 1.52 149 XM_H_Undi_Recip 1643 0.48 1.13 0.22 150 XMHTML_After_End 1604 0.52 1.10 0.29 151 TR_XM_SEO4 1588 0.40 1.09 0.12 152 TM2_M_OBFU_COMMENT 1574 0.63 1.08 0.45 153 XMSexyCombo_01 1546 0.40 1.06 0.14 154 STY_INVIS_DIRECT 1533 0.46 1.06 0.22 155 RCVD_IN_IADB_SPF 1522 2.25 1.05 2.73 156 TR_LOTS_OF_MONEY2 1504 0.43 1.04 0.19 157 T_MONEY_PERCENT 1504 0.43 1.04 0.19 158 TR_LOTS_OF_MONEY3 1488 0.44 1.02 0.20 159 MPART_ALT_DIFF_COUNT 1488 0.58 1.02 0.41 160 SHOPIFY_IMG_NOT_RCVD_SFY 1470 0.46 1.01 0.23 161 RCVD_IN_IADB_DK 1450 1.99 1.00 2.39 162 TR_Symld_Words 1445 1.29 0.99 1.41 163 RCVD_IN_IADB_SENDERID 1443 2.03 0.99 2.45 164 XM_DIRTYINTL 1438 0.34 0.99 0.07 165 TR_XM_DK_SendGrid 1424 0.87 0.98 0.83 166 TR_XM_Undi_Recip19 1400 0.33 0.96 0.08 167 XM_UB999 1397 0.28 0.96 0.00 168 RCVD_IN_PBL 1378 0.78 0.95 0.71 169 HK_RANDOM_REPLYTO 1369 0.36 0.94 0.13 170 TR_XM_PHPForged 1360 0.51 0.94 0.34 171 NML_ADSP_CUSTOM_MED 1350 0.62 0.93 0.50 172 TR_XM_RelayPhish 1331 0.32 0.92 0.08 173 TR_XM_FormFill2 1329 0.50 0.91 0.34 174 HTML_FONT_FACE_BAD 1328 9.65 0.91 13.17 175 FORGED_GMAIL_RCVD 1327 0.58 0.91 0.44 176 TR_XM_InvalidRelay 1323 0.27 0.91 0.01 177 TR_XM_PHPDW 1322 0.50 0.91 0.34 178 HTML_TAG_BALANCE_BODY 1320 0.62 0.91 0.51 179 XMNoVowels 1318 0.89 0.91 0.89 180 XM_B_REG_HTML 1312 0.37 0.90 0.15 181 TR_XM_Base64_M1 1300 0.69 0.89 0.61 182 URI_TRY_3LD 1292 0.62 0.89 0.52 183 TR_XM_Undi_RecipCombo2 1276 0.26 0.88 0.01 184 XM_H_PHPOS 1276 0.48 0.88 0.33 185 RCVD_IN_SORBS_DUL 1265 0.28 0.87 0.04 186 TM2_M_A_HREF_HREF 1258 0.38 0.87 0.19 187 HTML_IMAGE_ONLY_20 1237 0.73 0.85 0.67 188 TR_XM_Undi_Recip11 1224 0.28 0.84 0.06 189 ANY_BOUNCE_MESSAGE 1213 3.32 0.84 4.32 190 BOUNCE_MESSAGE 1211 3.31 0.83 4.32 191 MIME_CHARSET_FARAWAY 1206 0.75 0.83 0.72 192 HTML_FONT_TINY_NORDNS 1194 0.29 0.82 0.07 193 XMSubMetaI_00 1185 0.46 0.82 0.32 194 XMBdyGiftCard01 1172 0.57 0.81 0.48 195 XMMoneyMeta_00 1170 0.54 0.81 0.43 196 XM_B_DNDMA 1146 0.60 0.79 0.53 197 DEAR_FRIEND 1132 0.33 0.78 0.15 198 RDNS_DYNAMIC 1131 0.43 0.78 0.29 199 XMSubMetaSxObfu_03 1113 0.47 0.77 0.35 200 XM_HighProb1 1108 0.22 0.76 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 320417 90.59 94.32 89.08 2 RELAYCOUNTRY_US 301530 83.88 84.01 83.83 3 XM_B_Unicode 264313 76.04 82.38 73.48 4 DCC_CHECK_NEGATIVE 237220 53.75 23.53 65.95 5 DKIM_SIGNED 236880 72.64 89.46 65.85 6 XM_DK_Pass 231956 70.50 85.38 64.49 7 DKIM_VALID 228366 69.52 84.47 63.49 8 BAYES_50 201275 51.46 40.32 55.96 9 DKIM_VALID_AU 181326 55.19 67.02 50.41 10 XM_B_SpammyWords 159761 51.63 69.50 44.41 11 XM_B_Unicode3 155492 45.10 49.74 43.23 12 XMListUnsubscribeExists 151002 49.78 69.09 41.98 13 DCC_CHECK 122335 45.69 74.62 34.01 14 RCVD_IN_MSPIKE_H2 108797 32.35 37.57 30.25 15 T_TM2_M_HEADER_IN_MSG 96590 25.53 22.26 26.85 16 DKIM_VALID_EF 94811 27.20 29.29 26.36 17 HTML_FONT_LOW_CONTRAST 87465 27.88 36.72 24.32 18 MIME_HTML_ONLY 84632 24.67 27.49 23.53 19 LOC_TINY_FONT_1 83877 30.32 47.64 23.32 20 XMSubLong 81743 23.35 24.91 22.73 21 FVGT_m_MULTI_ODD 76179 24.79 33.74 21.18 22 T_KAM_HTML_FONT_INVALID 65648 22.33 32.44 18.25 23 XM_B_SpammyWords2 62733 24.31 41.31 17.44 24 HTML_IMAGE_RATIO_04 54003 12.10 4.88 15.01 25 BAYES_00 52542 10.59 0.65 14.61 26 ALL_TRUSTED 49242 10.21 1.58 13.69 27 HTML_FONT_FACE_BAD 47383 9.65 0.91 13.17 28 XM_H_Trusted_IP 44965 8.90 0.00 12.50 29 TR_XM_DK_Unsub 41628 13.97 19.90 11.57 30 XMStrtUSub 40745 9.16 3.78 11.33 31 XM_Multi_Part_URI 40700 14.42 22.12 11.31 32 USER_IN_DEF_DKIM_WL 40201 8.35 1.36 11.18 33 UNPARSEABLE_RELAY 36773 12.11 16.78 10.22 34 XM_Evil_Numbers_Gen 34882 9.65 9.54 9.70 35 MPART_ALT_DIFF 34728 8.90 7.03 9.65 36 XM_B_PhoneNumber 31448 8.10 6.50 8.74 37 XM_B_Unsub 30463 11.28 18.22 8.47 38 MIME_HTML_ONLY_MULTI 28745 6.77 3.74 7.99 39 TooManyTo_001 28658 6.75 3.72 7.97 40 LotsOfNums_01 27961 7.79 7.84 7.77 41 BAYES_60 26463 7.50 7.84 7.36 42 FSL_BULK_SIG 24892 7.55 9.11 6.92 43 TR_XM_DK_Bayes 23670 4.83 0.51 6.58 44 TR_XM_DK_Bayes1 23290 4.76 0.50 6.47 45 IN_ZIMBRA_NJ_WHITELIST 21942 4.38 0.12 6.10 46 TR_XM_BayesUnsub 21914 9.33 17.35 6.09 47 XM_DKIMWhitelistDomains 20712 4.11 0.02 5.76 48 BAYES_40 20693 4.63 1.85 5.75 49 LOTS_OF_MONEY 20153 7.63 12.66 5.60 50 XM_B_Phish_Phrases 19299 6.29 8.58 5.37 51 TR_XM_DK_Bayes2 19166 3.91 0.39 5.33 52 T_TooManySym_01 18969 4.47 2.48 5.27 53 XM_H_Long_From01 18652 5.41 5.98 5.19 54 XM_H_GMP 18011 5.26 5.88 5.01 55 TR_MAX_INTL_RELAY 17525 7.76 14.90 4.87 56 HTML_IMAGE_RATIO_06 17451 4.65 4.15 4.85 57 MIME_QP_LONG_LINE 17130 4.39 3.46 4.76 58 BAYES_20 17122 3.79 1.38 4.76 59 RCVD_IN_MSPIKE_WL 16700 4.44 3.95 4.64 60 RCVD_IN_MSPIKE_H3 16700 4.44 3.95 4.64 61 ANY_BOUNCE_MESSAGE 15528 3.32 0.84 4.32 62 BOUNCE_MESSAGE 15528 3.31 0.83 4.32 63 XM_B_SpammyWords3 15037 7.07 14.21 4.18 64 XMSubNoVowel 15021 3.09 0.42 4.18 65 XM_DK_Undo_02 14770 14.20 39.18 4.11 66 HTML_IMAGE_RATIO_02 14180 4.55 6.05 3.94 67 BAYES_05 13965 2.94 0.62 3.88 68 TR_XM_SpammyWords4 13753 5.99 11.34 3.82 69 XM_UncommonTLD01 13514 4.57 6.59 3.76 70 XM_PDF 13079 2.76 0.61 3.64 71 RCVD_IN_VALIDITY_SAFE 12558 3.16 2.33 3.49 72 RELAYCOUNTRY_META 11890 6.66 14.98 3.31 73 T_REMOTE_IMAGE 11272 2.68 1.56 3.13 74 RCVD_IN_IADB_LISTED 11184 2.55 1.15 3.11 75 BAYES_80 10776 4.77 9.15 3.00 76 BOTNET_IPINHOSTNAME 10517 5.09 10.44 2.92 77 XMSubMetaSx_00 10429 4.09 7.04 2.90 78 BAYES_99 10124 10.89 30.87 2.81 79 XMNumbers 10112 3.02 3.55 2.81 80 TooManyTo_002 9992 2.16 0.63 2.78 81 RCVD_IN_IADB_SPF 9823 2.25 1.05 2.73 82 T_TooManySym_02 9386 2.07 0.74 2.61 83 RCVD_IN_VALIDITY_CERTIFIED 9204 2.38 1.95 2.56 84 MAILING_LIST_MULTI 8975 2.49 2.48 2.50 85 RCVD_IN_IADB_SENDERID 8812 2.03 0.99 2.45 86 MIME_HTML_MOSTLY 8687 2.75 3.57 2.42 87 RCVD_IN_IADB_DK 8582 1.99 1.00 2.39 88 DKIM_INVALID 8514 3.12 4.99 2.37 89 HTML_MIME_NO_HTML_TAG 8107 2.17 1.97 2.25 90 XM_B_SpammyTLD 8015 2.90 4.55 2.23 91 TM2_M_VERY_LONG_WORD 7654 2.64 3.91 2.13 92 BAYES_999 7637 8.40 23.94 2.12 93 XM_Body_Dirty_Words 7580 3.77 7.88 2.11 94 INVALID_MSGID 7383 1.53 0.24 2.05 95 RCVD_IN_IADB_VOUCHED 7173 1.58 0.56 1.99 96 HTML_IMAGE_RATIO_08 7068 2.46 3.67 1.96 97 XMSubLongNoVowel 6875 1.40 0.13 1.91 98 XM_CamelCaseFrm001 6858 2.20 2.92 1.91 99 BAYES_95 6737 2.92 5.50 1.87 100 XMSubGarbage 6695 1.33 0.02 1.86 101 XM_B_URI_Unicode 6248 2.05 2.83 1.74 102 TO_MALFORMED 6222 1.24 0.01 1.73 103 KHOP_HELO_FCRDNS 6190 1.61 1.33 1.72 104 TR_XM_SpammyRelay 6064 4.42 11.20 1.69 105 T_XMDrugObfuBody_08 6031 2.31 3.87 1.68 106 TR_XM_DKIM_Undo 5680 9.14 27.87 1.58 107 XM_B_Investor 5603 2.66 5.41 1.56 108 FROM_EXCESS_BASE64 5584 1.59 1.67 1.55 109 T_XMDrugObfuBody_14 5566 2.40 4.50 1.55 110 XM_B_Unsub2 5564 1.92 2.84 1.55 111 TooManyTo_003 5540 1.26 0.55 1.54 112 BOTNET 5478 3.67 9.00 1.52 113 URI_NOVOWEL 5465 1.41 1.14 1.52 114 TR_XM_UnparsRelay 5266 3.33 7.95 1.46 115 TR_XM_PhishingBody 5249 2.36 4.60 1.46 116 XM_DK_Undo_01 5174 1.52 1.73 1.44 117 TM2_M_URI_OPT_OUT 5107 1.86 2.95 1.42 118 TR_Symld_Words 5062 1.29 0.99 1.41 119 RCVD_IN_IADB_OPTIN 5034 1.10 0.35 1.40 120 XM_SPF_SoftFail 4909 1.95 3.40 1.36 121 IN_HORDE_ADDRESS_BOOK 4754 0.97 0.11 1.32 122 XMDiploma_00 4646 1.81 3.09 1.29 123 XM_SendGrid 4557 1.38 1.66 1.27 124 TR_XM_SpammyWords5 4438 1.99 3.85 1.23 125 SUBJ_ALL_CAPS 4369 1.39 1.81 1.21 126 UNTRUSTED_Relay 4141 2.53 5.95 1.15 127 XMStockSpam_06 4059 1.31 1.77 1.13 128 TooManyTo_004 4047 0.94 0.49 1.13 129 XMCapTrack 3959 0.93 0.51 1.10 130 URI_HEX 3880 1.16 1.35 1.08 131 T_TooManySym_03 3872 0.83 0.23 1.08 132 XM_GoogleGroups 3797 0.97 0.75 1.06 133 XMGappySubj_01 3769 0.79 0.14 1.05 134 XM_E_Blogspot 3738 0.77 0.11 1.04 135 HELO_NODOT 3708 0.78 0.17 1.03 136 HELO_NO_DOMAIN 3706 0.78 0.17 1.03 137 XM_OfRef6 3547 1.76 3.66 0.99 138 TooManyTo_005 3356 0.80 0.46 0.93 139 XMSexyCombo_05 3262 1.63 3.44 0.91 140 RELAYCOUNTRY_CA 3259 2.13 5.15 0.91 141 T_FILL_THIS_FORM_SHORT 3235 1.13 1.68 0.90 142 XMNoVowels 3201 0.89 0.91 0.89 143 TVD_SPACE_RATIO 3182 0.67 0.13 0.88 144 FROM_GOV_DKIM_AU 3162 0.74 0.41 0.88 145 XM_H_Long_From02 3025 0.98 1.32 0.84 146 XM_B_SpammyWords4 2973 1.36 2.70 0.83 147 TR_XM_DK_SendGrid 2972 0.87 0.98 0.83 148 SpammyFromTLD_01 2831 1.06 1.74 0.79 149 XM_B_COPY_HTML 2823 0.92 1.24 0.78 150 HTTPS_HTTP_MISMATCH 2747 0.88 1.16 0.76 151 XM_H_PHPMailer 2727 0.70 0.55 0.76 152 XMBrknScrpt_02 2723 0.90 1.27 0.76 153 TR_DCC_Bayes_99 2723 6.93 22.20 0.76 154 DKIM_ADSP_CUSTOM_MED 2717 0.88 1.19 0.76 155 XM_UB50 2693 1.26 2.51 0.75 156 XM_ShortIntro_01 2642 0.68 0.55 0.73 157 MIME_CHARSET_FARAWAY 2602 0.75 0.83 0.72 158 RCVD_IN_PBL 2558 0.78 0.95 0.71 159 XMGenDplmaNmb 2448 0.93 1.56 0.68 160 T_XMDrugObfuBody_00 2440 0.90 1.43 0.68 161 HTML_IMAGE_ONLY_20 2425 0.73 0.85 0.67 162 XMLngstWrd_00 2410 0.59 0.40 0.67 163 TR_MetaPhish_Combo_01 2399 0.65 0.62 0.67 164 TO_NO_BRKTS_HTML_ONLY 2277 0.51 0.22 0.63 165 TR_XM_Base64_M1 2181 0.69 0.89 0.61 166 RELAYCOUNTRY_GB 2133 0.64 0.74 0.59 167 XM_B_FormFill 2096 0.42 0.01 0.58 168 T_Symld_Words_02 2016 0.61 0.75 0.56 169 TVD_RCVD_IP 2009 0.60 0.71 0.56 170 T_XMHurry_00 1974 0.93 1.88 0.55 171 XM_B_DNDMA 1900 0.60 0.79 0.53 172 XMGappySubj_02 1881 0.38 0.04 0.52 173 RCVD_IN_BL_SPAMCOP_NET 1880 2.78 8.36 0.52 174 RELAYCOUNTRY_AU 1854 1.25 3.07 0.52 175 URI_TRY_3LD 1854 0.62 0.89 0.52 176 MISSING_HEADERS 1840 0.57 0.72 0.51 177 HTML_TAG_BALANCE_BODY 1831 0.62 0.91 0.51 178 T_OBFU_PDF_ATTACH 1823 0.40 0.15 0.51 179 NML_ADSP_CUSTOM_MED 1805 0.62 0.93 0.50 180 XMBody_95 1743 0.39 0.16 0.48 181 XMBdyGiftCard01 1730 0.57 0.81 0.48 182 TM2_M_OBFU_COMMENT 1607 0.63 1.08 0.45 183 FORGED_GMAIL_RCVD 1590 0.58 0.91 0.44 184 XM_ProductURIs 1580 0.52 0.71 0.44 185 XMPhish14 1578 0.51 0.67 0.44 186 XMMoneyMeta_00 1563 0.54 0.81 0.43 187 XMPhish30 1558 0.76 1.58 0.43 188 SpammyFromTLD_02 1557 0.99 2.38 0.43 189 MSGID_FROM_MTA_HEADER 1530 0.33 0.09 0.43 190 XMDateMe_00 1512 0.40 0.37 0.42 191 FILL_THIS_FORM 1480 0.46 0.57 0.41 192 MPART_ALT_DIFF_COUNT 1461 0.58 1.02 0.41 193 XMBody_17 1445 0.98 2.43 0.40 194 LongTLD 1443 0.72 1.50 0.40 195 HTML_IMAGE_ONLY_32 1437 0.36 0.26 0.40 196 FROM_GOV_SPOOF 1429 0.32 0.11 0.40 197 TR_XM_SPAMCOP 1371 2.25 6.87 0.38 198 XMSlimDrugH 1334 0.60 1.16 0.37 199 USER_IN_WHITELIST 1295 0.26 0.00 0.36 200 USER_IN_WELCOMELIST 1295 0.26 0.00 0.36 ----------------------------------------------------------------------