Email: 425969 Autolearn: 0 AvgScore: 4.49 AvgScanTime: 1.35 sec Spam: 130607 Autolearn: 0 AvgScore: 14.55 AvgScanTime: 1.49 sec Ham: 295362 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 1.29 sec Time Spent Running SA: 160.12 hours Time Spent Processing Spam: 53.94 hours Time Spent Processing Ham: 106.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124213 89.60 95.10 87.16 2 DKIM_SIGNED 118528 81.34 90.75 77.18 3 XM_DK_Pass 113708 79.15 87.06 75.66 4 DKIM_VALID 112171 78.07 85.88 74.61 5 RELAYCOUNTRY_US 110328 82.78 84.47 82.03 6 XM_B_Unicode 110006 74.97 84.23 70.88 7 DCC_CHECK 97337 49.99 74.53 39.14 8 XMListUnsubscribeExists 93912 56.63 71.90 49.88 9 XM_B_SpammyWords 93563 53.15 71.64 44.98 10 DKIM_VALID_AU 88054 61.95 67.42 59.53 11 XM_B_Unicode3 67789 44.61 51.90 41.39 12 LOC_TINY_FONT_1 63429 33.90 48.56 27.41 13 XM_B_SpammyWords2 57037 26.50 43.67 18.91 14 BAYES_50 53341 55.20 40.84 61.54 15 XM_DK_Undo_02 52083 16.01 39.88 5.45 16 RCVD_IN_MSPIKE_H2 51333 37.29 39.30 36.39 17 HTML_FONT_LOW_CONTRAST 49427 31.14 37.84 28.18 18 FVGT_m_MULTI_ODD 43175 27.63 33.06 25.23 19 T_KAM_HTML_FONT_INVALID 42253 24.51 32.35 21.04 20 BAYES_99 39400 11.94 30.17 3.88 21 DKIM_VALID_EF 38158 29.96 29.22 30.29 22 TR_XM_DKIM_Undo 37332 10.25 28.58 2.15 23 MIME_HTML_ONLY 36900 22.97 28.25 20.63 24 XMSubLong 32115 24.04 24.59 23.79 25 DCC_CHECK_NEGATIVE 31028 49.45 23.76 60.82 26 BAYES_999 30255 9.14 23.16 2.94 27 TR_DCC_Bayes_99 28182 7.41 21.58 1.14 28 XM_Multi_Part_URI 28172 16.22 21.57 13.85 29 T_TM2_M_HEADER_IN_MSG 27811 27.22 21.29 29.83 30 TR_XM_DK_Unsub 26526 15.34 20.31 13.15 31 UNPARSEABLE_RELAY 22346 13.47 17.11 11.86 32 XM_B_Unsub 21762 11.24 16.66 8.84 33 TR_XM_BayesUnsub 20919 9.62 16.02 6.79 34 XM_B_SpammyWords3 20118 8.22 15.40 5.05 35 RELAYCOUNTRY_META 19383 7.27 14.84 3.93 36 TR_MAX_INTL_RELAY 19207 8.53 14.71 5.79 37 LOTS_OF_MONEY 18034 9.15 13.81 7.09 38 TR_XM_SpammyWords2 16757 4.23 12.83 0.42 39 TR_XM_SpammyWords4 16335 7.08 12.51 4.68 40 TR_XM_SpammyRelay 14764 4.89 11.30 2.05 41 BOTNET_IPINHOSTNAME 13509 5.61 10.34 3.52 42 RCVD_IN_BL_SPAMCOP_NET 12323 3.48 9.44 0.85 43 BAYES_80 11973 5.26 9.17 3.54 44 XM_Evil_Numbers_Gen 11884 9.07 9.10 9.06 45 BAYES_60 10871 7.11 8.32 6.58 46 TR_XM_UnparsRelay 10837 3.69 8.30 1.65 47 XM_Body_Dirty_Words 10763 5.05 8.24 3.64 48 BOTNET 10746 3.62 8.23 1.58 49 XM_B_Phish_Phrases 10728 6.42 8.21 5.63 50 FSL_BULK_SIG 10486 7.60 8.03 7.41 51 TR_XM_SPAMCOP 10223 2.73 7.83 0.48 52 LotsOfNums_01 9905 8.38 7.58 8.73 53 XMSubMetaSx_00 9254 5.12 7.09 4.24 54 HTML_IMAGE_RATIO_02 8497 5.21 6.51 4.63 55 MPART_ALT_DIFF 8328 5.11 6.38 4.55 56 RELAYCOUNTRY_CA 8268 2.76 6.33 1.19 57 XM_H_Long_From01 7894 5.91 6.04 5.85 58 XM_H_GMP 7490 5.59 5.73 5.53 59 XM_B_PhoneNumber 7388 8.32 5.66 9.49 60 XM_UncommonTLD01 7083 4.69 5.42 4.37 61 BAYES_95 6863 3.17 5.25 2.25 62 XM_OfRef6 6643 2.41 5.09 1.22 63 HTML_IMAGE_RATIO_04 6624 5.11 5.07 5.13 64 TR_XM_PhishingBody 6530 2.59 5.00 1.52 65 DKIM_INVALID 6357 3.27 4.87 2.57 66 XM_B_Investor 6213 2.50 4.76 1.50 67 UNTRUSTED_Relay 6086 2.41 4.66 1.42 68 T_XMDrugObfuBody_14 6065 2.73 4.64 1.88 69 XMStrtUSub 5885 4.76 4.51 4.87 70 XM_B_SpammyTLD 5644 3.20 4.32 2.71 71 RCVD_IN_MSPIKE_H3 5524 5.11 4.23 5.50 72 RCVD_IN_MSPIKE_WL 5524 5.11 4.23 5.50 73 TM2_M_VERY_LONG_WORD 5406 2.53 4.14 1.82 74 XMSexyCombo_05 5403 2.87 4.14 2.31 75 TR_XM_SpammyWords5 5159 2.18 3.95 1.40 76 HTML_IMAGE_RATIO_06 5015 2.96 3.84 2.57 77 TooManyTo_001 4994 6.91 3.82 8.28 78 MIME_HTML_MOSTLY 4585 2.72 3.51 2.36 79 MIME_HTML_ONLY_MULTI 4522 2.92 3.46 2.68 80 RCVD_IN_VALIDITY_RPBL 4254 1.06 3.26 0.10 81 XMNumbers 4126 3.17 3.16 3.18 82 TM2_M_URI_OPT_OUT 4115 2.21 3.15 1.80 83 HTML_IMAGE_RATIO_08 3969 2.25 3.04 1.91 84 XM_CamelCaseFrm001 3929 2.37 3.01 2.09 85 RELAYCOUNTRY_AU 3926 1.44 3.01 0.75 86 MIME_QP_LONG_LINE 3915 4.80 3.00 5.60 87 RCVD_IN_VALIDITY_SAFE 3858 3.69 2.95 4.02 88 T_XMDrugObfuBody_08 3828 2.21 2.93 1.90 89 XM_SPF_SoftFail 3708 1.86 2.84 1.42 90 XMDiploma_00 3563 2.06 2.73 1.76 91 XMBody_17 3520 1.12 2.70 0.43 92 XM_URI_RBL 3417 1.09 2.62 0.41 93 T_TooManySym_01 3409 5.76 2.61 7.16 94 XM_B_SpammyWords4 3285 1.16 2.52 0.57 95 XM_B_URI_Unicode 3280 2.22 2.51 2.09 96 FROM_EXCESS_BASE64 3260 2.10 2.50 1.92 97 T_FILL_THIS_FORM_SHORT 3249 1.49 2.49 1.05 98 XM_UB50 3245 1.38 2.48 0.89 99 XM_B_Unsub2 3070 1.83 2.35 1.60 100 MAILING_LIST_MULTI 2988 2.76 2.29 2.96 101 RCVD_IN_VALIDITY_CERTIFIED 2923 2.67 2.24 2.86 102 DKIM_ADSP_NXDOMAIN 2823 0.88 2.16 0.32 103 USER_IN_DEF_DKIM_WL 2823 9.81 2.16 13.19 104 NO_DNS_FOR_FROM 2739 0.84 2.10 0.29 105 TR_XM_MaxWHORU 2734 0.80 2.09 0.24 106 SpammyFromTLD_02 2656 0.98 2.03 0.51 107 SUBJ_ALL_CAPS 2651 1.63 2.03 1.46 108 XMPhish30 2635 0.92 2.02 0.44 109 T_XMHurry_00 2631 1.03 2.01 0.59 110 HK_RANDOM_REPLYTO 2539 0.67 1.94 0.10 111 TR_XM_NoHeaderRelay 2379 0.70 1.82 0.20 112 HTML_MIME_NO_HTML_TAG 2315 2.35 1.77 2.61 113 XMStockSpam_06 2281 1.79 1.75 1.82 114 XM_SendGrid 2255 1.60 1.73 1.55 115 BAYES_40 2197 4.08 1.68 5.14 116 SHORTCIRCUIT 2192 0.51 1.68 0.00 117 RCVD_IN_ZEN_LASTEXTERNAL 2192 0.51 1.68 0.00 118 XM_H_Undi_Recip 2076 0.65 1.59 0.24 119 XMBrknScrpt_02 2069 1.13 1.58 0.92 120 T_XMDrugObfuBody_00 2051 0.95 1.57 0.67 121 XMBdyGiftCard01 2014 0.83 1.54 0.51 122 T_REMOTE_IMAGE 1998 2.94 1.53 3.56 123 RCVD_IN_PSBL 1910 0.73 1.46 0.41 124 XM_B_COPY_HTML 1878 1.00 1.44 0.80 125 TR_LOTS_OF_MONEY3 1875 0.68 1.44 0.34 126 BAYES_20 1853 3.06 1.42 3.78 127 TR_XM_INV_DKIM 1853 0.54 1.42 0.15 128 XMGenDplmaNmb 1850 1.02 1.42 0.84 129 LongTLD 1842 0.72 1.41 0.42 130 XMSexyCombo_01 1820 0.53 1.39 0.15 131 NORDNS_LOW_CONTRAST 1807 0.46 1.38 0.05 132 TR_XM_Undi_Recip19 1738 0.49 1.33 0.12 133 XM_B_SEO 1728 0.58 1.32 0.25 134 XM_OfRef7 1726 0.54 1.32 0.19 135 MPART_ALT_DIFF_COUNT 1702 0.80 1.30 0.58 136 XM_B_DNDMA 1697 0.75 1.30 0.51 137 TR_XM_Base64_M1 1697 0.81 1.30 0.59 138 SpammyFromTLD_01 1696 0.99 1.30 0.86 139 URI_HEX 1668 1.20 1.28 1.17 140 TR_XM_DK_SendGrid 1657 1.10 1.27 1.02 141 XM_H_Long_From02 1650 1.04 1.26 0.94 142 TR_XM_Undi_RecipCombo2 1641 0.39 1.26 0.00 143 URI_NOVOWEL 1630 1.39 1.25 1.45 144 ALL_TRUSTED 1628 10.65 1.25 14.81 145 XM_DK_Undo_01 1603 1.57 1.23 1.72 146 SHOPIFY_IMG_NOT_RCVD_SFY 1582 0.57 1.21 0.29 147 TR_XM_PHPDW 1557 0.60 1.19 0.34 148 TR_XM_PHPForged 1556 0.59 1.19 0.32 149 DIET_1 1546 0.65 1.18 0.41 150 RCVD_IN_IADB_LISTED 1541 3.08 1.18 3.92 151 KHOP_HELO_FCRDNS 1537 1.55 1.18 1.72 152 TR_XM_FormFill2 1522 0.58 1.17 0.33 153 STY_INVIS_DIRECT 1519 0.54 1.16 0.27 154 XM_B_Phish66 1509 0.57 1.16 0.31 155 HTML_TAG_BALANCE_BODY 1492 0.75 1.14 0.58 156 XM_H_PHPOS 1485 0.57 1.14 0.31 157 TR_Symld_Words 1461 1.41 1.12 1.53 158 TM2_M_OBFU_COMMENT 1454 0.72 1.11 0.54 159 XM_ProductURIs 1442 0.98 1.10 0.93 160 TR_XM_SEO4 1431 0.42 1.10 0.12 161 RCVD_IN_IADB_SPF 1402 2.73 1.07 3.46 162 XMNoVowels 1394 1.12 1.07 1.14 163 XMReplyNow 1367 0.47 1.05 0.22 164 XMPhish14 1349 0.68 1.03 0.52 165 XM_B_COVIDMETA 1343 0.45 1.03 0.19 166 RCVD_IN_IADB_SENDERID 1334 2.46 1.02 3.09 167 RCVD_IN_IADB_DK 1311 2.40 1.00 3.02 168 BOTNET_NORDNS 1309 0.31 1.00 0.01 169 DKIM_ADSP_CUSTOM_MED 1301 0.87 1.00 0.82 170 TR_XM_Undi_Recip11 1299 0.36 0.99 0.09 171 TR_XM_RelayPhish 1279 0.36 0.98 0.08 172 XM_B_REG_HTML 1275 0.45 0.98 0.22 173 HTTPS_HTTP_MISMATCH 1270 0.90 0.97 0.87 174 XMBody_78 1252 0.54 0.96 0.36 175 XMSubMetaI_00 1241 0.62 0.95 0.47 176 FONT_INVIS_LONG_LINE 1235 0.35 0.95 0.09 177 URI_TRY_3LD 1215 0.62 0.93 0.49 178 MIME_CHARSET_FARAWAY 1212 0.54 0.93 0.37 179 XM_UB99 1186 0.28 0.91 0.00 180 RDNS_DYNAMIC 1156 0.54 0.89 0.38 181 XM_RXBody 1141 0.38 0.87 0.15 182 XMSlimDrugH 1140 0.66 0.87 0.57 183 PDS_RDNS_DYNAMIC_FP 1133 0.42 0.87 0.22 184 XM_DIRTYINTL 1131 0.32 0.87 0.08 185 TR_XM_Spammywords 1114 0.41 0.85 0.22 186 XM_S_SpammyWords 1114 0.41 0.85 0.22 187 XMClaimOffer 1102 0.35 0.84 0.13 188 XM_GoogleGroups 1092 1.12 0.84 1.25 189 UNDISC_MONEY 1088 0.26 0.83 0.00 190 NML_ADSP_CUSTOM_MED 1081 0.62 0.83 0.53 191 XM_HighProb1 1080 0.26 0.83 0.01 192 HOSTED_IMG_MULTI_PUB_01 1068 0.26 0.82 0.02 193 RELAYCOUNTRY_FR 1067 0.42 0.82 0.25 194 TR_XM_Undi_Recip5 1054 0.25 0.81 0.00 195 J_POPCORN_WO_D 1053 0.40 0.81 0.22 196 TVD_RCVD_IP 1050 0.71 0.80 0.67 197 T_Symld_Words_02 1042 0.53 0.80 0.41 198 RCVD_IN_SORBS_DUL 1041 0.28 0.80 0.05 199 TR_XM_Undi_RecipCombo3 1033 0.24 0.79 0.00 200 TR_LOTS_OF_MONEY2 1027 0.35 0.79 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 257444 89.60 95.10 87.16 2 RELAYCOUNTRY_US 242289 82.78 84.47 82.03 3 DKIM_SIGNED 227967 81.34 90.75 77.18 4 XM_DK_Pass 223457 79.15 87.06 75.66 5 DKIM_VALID 220375 78.07 85.88 74.61 6 XM_B_Unicode 209342 74.97 84.23 70.88 7 BAYES_50 181777 55.20 40.84 61.54 8 DCC_CHECK_NEGATIVE 179628 49.45 23.76 60.82 9 DKIM_VALID_AU 175830 61.95 67.42 59.53 10 XMListUnsubscribeExists 147314 56.63 71.90 49.88 11 XM_B_SpammyWords 132845 53.15 71.64 44.98 12 XM_B_Unicode3 122252 44.61 51.90 41.39 13 DCC_CHECK 115594 49.99 74.53 39.14 14 RCVD_IN_MSPIKE_H2 107496 37.29 39.30 36.39 15 DKIM_VALID_EF 89476 29.96 29.22 30.29 16 T_TM2_M_HEADER_IN_MSG 88117 27.22 21.29 29.83 17 HTML_FONT_LOW_CONTRAST 83227 31.14 37.84 28.18 18 LOC_TINY_FONT_1 80957 33.90 48.56 27.41 19 FVGT_m_MULTI_ODD 74515 27.63 33.06 25.23 20 XMSubLong 70277 24.04 24.59 23.79 21 T_KAM_HTML_FONT_INVALID 62139 24.51 32.35 21.04 22 MIME_HTML_ONLY 60942 22.97 28.25 20.63 23 XM_B_SpammyWords2 55861 26.50 43.67 18.91 24 ALL_TRUSTED 43752 10.65 1.25 14.81 25 XM_Multi_Part_URI 40919 16.22 21.57 13.85 26 USER_IN_DEF_DKIM_WL 38971 9.81 2.16 13.19 27 TR_XM_DK_Unsub 38832 15.34 20.31 13.15 28 UNPARSEABLE_RELAY 35031 13.47 17.11 11.86 29 BAYES_00 32565 7.87 0.72 11.03 30 XM_B_PhoneNumber 28035 8.32 5.66 9.49 31 XM_Evil_Numbers_Gen 26764 9.07 9.10 9.06 32 XM_B_Unsub 26116 11.24 16.66 8.84 33 LotsOfNums_01 25787 8.38 7.58 8.73 34 TooManyTo_001 24460 6.91 3.82 8.28 35 XM_DKIMWhitelistDomains 22307 5.26 0.09 7.55 36 FSL_BULK_SIG 21889 7.60 8.03 7.41 37 TR_XM_DK_Bayes 21882 5.32 0.60 7.41 38 TR_XM_DK_Bayes1 21460 5.22 0.60 7.27 39 IN_ZIMBRA_NJ_WHITELIST 21158 5.00 0.09 7.16 40 T_TooManySym_01 21139 5.76 2.61 7.16 41 LOTS_OF_MONEY 20937 9.15 13.81 7.09 42 TR_XM_BayesUnsub 20065 9.62 16.02 6.79 43 BAYES_60 19432 7.11 8.32 6.58 44 TR_XM_DK_Bayes2 18093 4.40 0.49 6.13 45 XM_H_Long_From01 17293 5.91 6.04 5.85 46 TR_MAX_INTL_RELAY 17107 8.53 14.71 5.79 47 XM_B_Phish_Phrases 16639 6.42 8.21 5.63 48 MIME_QP_LONG_LINE 16534 4.80 3.00 5.60 49 XM_H_GMP 16338 5.59 5.73 5.53 50 RCVD_IN_MSPIKE_H3 16247 5.11 4.23 5.50 51 RCVD_IN_MSPIKE_WL 16247 5.11 4.23 5.50 52 XM_DK_Undo_02 16097 16.01 39.88 5.45 53 BAYES_40 15179 4.08 1.68 5.14 54 HTML_IMAGE_RATIO_04 15155 5.11 5.07 5.13 55 XM_B_SpammyWords3 14916 8.22 15.40 5.05 56 XMStrtUSub 14383 4.76 4.51 4.87 57 TR_XM_SpammyWords4 13827 7.08 12.51 4.68 58 XM_PDF 13726 3.43 0.67 4.65 59 HTML_IMAGE_RATIO_02 13678 5.21 6.51 4.63 60 MPART_ALT_DIFF 13444 5.11 6.38 4.55 61 XM_UncommonTLD01 12904 4.69 5.42 4.37 62 XMSubMetaSx_00 12535 5.12 7.09 4.24 63 RCVD_IN_VALIDITY_SAFE 11874 3.69 2.95 4.02 64 RELAYCOUNTRY_META 11602 7.27 14.84 3.93 65 RCVD_IN_IADB_LISTED 11568 3.08 1.18 3.92 66 BAYES_99 11470 11.94 30.17 3.88 67 BAYES_20 11168 3.06 1.42 3.78 68 T_TooManySym_02 10849 2.74 0.62 3.67 69 XM_Body_Dirty_Words 10765 5.05 8.24 3.64 70 T_REMOTE_IMAGE 10514 2.94 1.53 3.56 71 BAYES_80 10451 5.26 9.17 3.54 72 BOTNET_IPINHOSTNAME 10393 5.61 10.34 3.52 73 RCVD_IN_IADB_SPF 10220 2.73 1.07 3.46 74 BOUNCE_MESSAGE 9962 2.51 0.56 3.37 75 ANY_BOUNCE_MESSAGE 9962 2.51 0.56 3.37 76 XMNumbers 9378 3.17 3.16 3.18 77 RCVD_IN_IADB_SENDERID 9139 2.46 1.02 3.09 78 RCVD_IN_IADB_DK 8930 2.40 1.00 3.02 79 MAILING_LIST_MULTI 8754 2.76 2.29 2.96 80 BAYES_999 8674 9.14 23.16 2.94 81 RCVD_IN_VALIDITY_CERTIFIED 8447 2.67 2.24 2.86 82 TooManyTo_002 8199 2.13 0.67 2.78 83 XM_B_SpammyTLD 7993 3.20 4.32 2.71 84 MIME_HTML_ONLY_MULTI 7923 2.92 3.46 2.68 85 HTML_MIME_NO_HTML_TAG 7708 2.35 1.77 2.61 86 HTML_IMAGE_RATIO_06 7601 2.96 3.84 2.57 87 DKIM_INVALID 7592 3.27 4.87 2.57 88 RCVD_IN_IADB_VOUCHED 7451 1.91 0.52 2.52 89 INVALID_MSGID 7058 1.71 0.17 2.39 90 MIME_HTML_MOSTLY 6982 2.72 3.51 2.36 91 XMSexyCombo_05 6821 2.87 4.14 2.31 92 BAYES_05 6663 1.79 0.74 2.26 93 BAYES_95 6652 3.17 5.25 2.25 94 TR_XM_DKIM_Undo 6342 10.25 28.58 2.15 95 TO_MALFORMED 6206 1.47 0.03 2.10 96 XM_CamelCaseFrm001 6177 2.37 3.01 2.09 97 XM_B_URI_Unicode 6167 2.22 2.51 2.09 98 TR_XM_SpammyRelay 6068 4.89 11.30 2.05 99 FROM_EXCESS_BASE64 5676 2.10 2.50 1.92 100 HTML_IMAGE_RATIO_08 5634 2.25 3.04 1.91 101 T_XMDrugObfuBody_08 5605 2.21 2.93 1.90 102 T_XMDrugObfuBody_14 5560 2.73 4.64 1.88 103 TM2_M_VERY_LONG_WORD 5387 2.53 4.14 1.82 104 XMStockSpam_06 5363 1.79 1.75 1.82 105 TM2_M_URI_OPT_OUT 5312 2.21 3.15 1.80 106 RCVD_IN_IADB_OPTIN 5246 1.34 0.34 1.78 107 XMDiploma_00 5204 2.06 2.73 1.76 108 XM_DK_Undo_01 5069 1.57 1.23 1.72 109 KHOP_HELO_FCRDNS 5068 1.55 1.18 1.72 110 TooManyTo_003 4941 1.34 0.58 1.67 111 TR_XM_UnparsRelay 4886 3.69 8.30 1.65 112 XM_B_Unsub2 4722 1.83 2.35 1.60 113 BOTNET 4676 3.62 8.23 1.58 114 XM_SendGrid 4580 1.60 1.73 1.55 115 IN_HORDE_ADDRESS_BOOK 4546 1.10 0.11 1.54 116 TR_Symld_Words 4526 1.41 1.12 1.53 117 TR_XM_PhishingBody 4482 2.59 5.00 1.52 118 XM_B_Investor 4421 2.50 4.76 1.50 119 SUBJ_ALL_CAPS 4313 1.63 2.03 1.46 120 URI_NOVOWEL 4289 1.39 1.25 1.45 121 XM_SPF_SoftFail 4201 1.86 2.84 1.42 122 UNTRUSTED_Relay 4197 2.41 4.66 1.42 123 TR_XM_SpammyWords5 4137 2.18 3.95 1.40 124 XM_GoogleGroups 3693 1.12 0.84 1.25 125 T_TooManySym_03 3683 0.93 0.22 1.25 126 HELO_NODOT 3656 0.95 0.30 1.24 127 HELO_NO_DOMAIN 3652 0.95 0.29 1.24 128 XM_OfRef6 3609 2.41 5.09 1.22 129 TooManyTo_004 3534 0.99 0.52 1.20 130 XMGappySubj_01 3530 0.88 0.16 1.20 131 RELAYCOUNTRY_CA 3502 2.76 6.33 1.19 132 URI_HEX 3459 1.20 1.28 1.17 133 TR_DCC_Bayes_99 3372 7.41 21.58 1.14 134 XMNoVowels 3356 1.12 1.07 1.14 135 XMCapTrack 3296 0.93 0.52 1.12 136 TVD_SPACE_RATIO 3223 0.81 0.17 1.09 137 T_FILL_THIS_FORM_SHORT 3094 1.49 2.49 1.05 138 TR_XM_DK_SendGrid 3011 1.10 1.27 1.02 139 TooManyTo_005 2879 0.83 0.49 0.97 140 XM_H_Long_From02 2766 1.04 1.26 0.94 141 XM_ProductURIs 2735 0.98 1.10 0.93 142 XMBrknScrpt_02 2730 1.13 1.58 0.92 143 FROM_GOV_DKIM_AU 2649 0.68 0.19 0.90 144 XM_UB50 2635 1.38 2.48 0.89 145 XMSubMetaSxObfu_03 2616 0.81 0.65 0.89 146 HTTPS_HTTP_MISMATCH 2567 0.90 0.97 0.87 147 SpammyFromTLD_01 2530 0.99 1.30 0.86 148 RCVD_IN_BL_SPAMCOP_NET 2510 3.48 9.44 0.85 149 XMGenDplmaNmb 2492 1.02 1.42 0.84 150 DKIM_ADSP_CUSTOM_MED 2419 0.87 1.00 0.82 151 T_TVD_MIME_NO_HEADERS 2374 0.57 0.03 0.80 152 XM_B_COPY_HTML 2361 1.00 1.44 0.80 153 XM_H_PHPMailer 2290 0.77 0.76 0.78 154 RELAYCOUNTRY_AU 2220 1.44 3.01 0.75 155 TO_NO_BRKTS_HTML_ONLY 2135 0.56 0.20 0.72 156 XM_ShortIntro_01 2120 0.69 0.64 0.72 157 RCVD_IN_PBL 2111 0.72 0.74 0.71 158 TR_MetaPhish_Combo_01 2098 0.72 0.74 0.71 159 XMBody_95 2063 0.55 0.22 0.70 160 HTML_IMAGE_ONLY_20 2051 0.68 0.64 0.69 161 TVD_RCVD_IP 1978 0.71 0.80 0.67 162 T_XMDrugObfuBody_00 1975 0.95 1.57 0.67 163 T_OBFU_PDF_ATTACH 1973 0.51 0.15 0.67 164 XMLngstWrd_00 1915 0.56 0.37 0.65 165 XMGappySubj_02 1900 0.46 0.05 0.64 166 MISSING_HEADERS 1809 0.62 0.62 0.61 167 XMSubMetaSx_01 1771 0.55 0.43 0.60 168 TR_XM_Base64_M1 1753 0.81 1.30 0.59 169 T_XMHurry_00 1738 1.03 2.01 0.59 170 HTML_TAG_BALANCE_BODY 1718 0.75 1.14 0.58 171 MPART_ALT_DIFF_COUNT 1700 0.80 1.30 0.58 172 XMSlimDrugH 1681 0.66 0.87 0.57 173 XM_B_SpammyWords4 1672 1.16 2.52 0.57 174 RELAYCOUNTRY_GB 1618 0.61 0.75 0.55 175 TM2_M_OBFU_COMMENT 1603 0.72 1.11 0.54 176 NML_ADSP_CUSTOM_MED 1579 0.62 0.83 0.53 177 XMPhish14 1537 0.68 1.03 0.52 178 XMBdyGiftCard01 1516 0.83 1.54 0.51 179 SpammyFromTLD_02 1516 0.98 2.03 0.51 180 XM_B_DNDMA 1496 0.75 1.30 0.51 181 FORGED_GMAIL_RCVD 1487 0.53 0.57 0.50 182 MSGID_FROM_MTA_HEADER 1470 0.38 0.11 0.50 183 HTML_FONT_FACE_BAD 1469 0.52 0.56 0.50 184 URI_TRY_3LD 1445 0.62 0.93 0.49 185 TM2_M_A_HREF_HREF 1440 0.56 0.72 0.49 186 TR_XM_SPAMCOP 1426 2.73 7.83 0.48 187 FROM_GOV_SPOOF 1415 0.38 0.15 0.48 188 XMSubMetaI_00 1400 0.62 0.95 0.47 189 HTML_IMAGE_ONLY_32 1339 0.37 0.18 0.45 190 USER_IN_WELCOMELIST 1337 0.31 0.00 0.45 191 USER_IN_WHITELIST 1337 0.31 0.00 0.45 192 XMPhish30 1288 0.92 2.02 0.44 193 HTML_IMAGE_ONLY_28 1288 0.40 0.32 0.44 194 XMLngstWrd_01 1268 0.39 0.31 0.43 195 XMBody_17 1258 1.12 2.70 0.43 196 TR_XM_SpammyWords2 1253 4.23 12.83 0.42 197 LongTLD 1245 0.72 1.41 0.42 198 XMMoneyMeta_00 1232 0.53 0.78 0.42 199 DIET_1 1225 0.65 1.18 0.41 200 PLING_QUERY 1223 0.47 0.59 0.41 ----------------------------------------------------------------------