Email: 573373 Autolearn: 0 AvgScore: 4.67 AvgScanTime: 1.30 sec Spam: 165194 Autolearn: 0 AvgScore: 14.29 AvgScanTime: 1.50 sec Ham: 408179 Autolearn: 0 AvgScore: 0.77 AvgScanTime: 1.22 sec Time Spent Running SA: 207.28 hours Time Spent Processing Spam: 68.85 hours Time Spent Processing Ham: 138.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158516 91.29 95.96 89.40 2 DKIM_SIGNED 135433 66.89 81.98 60.78 3 XM_B_Unicode 132208 66.17 80.03 60.57 4 XM_DK_Pass 128818 64.84 77.98 59.53 5 DKIM_VALID 127625 63.99 77.26 58.61 6 RELAYCOUNTRY_US 126073 68.34 76.32 65.11 7 DCC_CHECK 121297 45.51 73.43 34.21 8 XMListUnsubscribeExists 106016 45.89 64.18 38.49 9 XM_B_SpammyWords 102563 45.42 62.09 38.68 10 DKIM_VALID_AU 97521 50.23 59.03 46.67 11 LOC_TINY_FONT_1 72439 27.68 43.85 21.13 12 XM_B_Unicode3 72287 35.12 43.76 31.63 13 BAYES_50 65750 57.41 39.80 64.53 14 RCVD_IN_MSPIKE_H2 64718 31.37 39.18 28.22 15 HTML_FONT_LOW_CONTRAST 63230 26.54 38.28 21.79 16 MIME_HTML_ONLY 60685 32.71 36.74 31.08 17 XM_DK_Undo_02 60037 13.35 36.34 4.05 18 XM_B_SpammyWords2 59523 23.21 36.03 18.03 19 T_KAM_HTML_FONT_INVALID 49818 21.24 30.16 17.63 20 FVGT_m_MULTI_ODD 48210 22.91 29.18 20.37 21 BAYES_99 44949 9.98 27.21 3.01 22 DKIM_VALID_EF 44827 24.35 27.14 23.23 23 XMSubLong 44000 30.71 26.64 32.36 24 TR_XM_DKIM_Undo 42111 8.62 25.49 1.79 25 DCC_CHECK_NEGATIVE 41362 54.02 25.04 65.74 26 T_TM2_M_HEADER_IN_MSG 36954 27.21 22.37 29.17 27 XM_Multi_Part_URI 35090 14.15 21.24 11.28 28 BAYES_999 35058 7.78 21.22 2.34 29 TR_DCC_Bayes_99 33677 6.77 20.39 1.26 30 TR_XM_DK_Unsub 32134 12.91 19.45 10.27 31 TR_MAX_INTL_RELAY 28999 8.19 17.55 4.40 32 RELAYCOUNTRY_META 28381 7.40 17.18 3.44 33 XM_B_Unsub 26319 9.55 15.93 6.97 34 UNPARSEABLE_RELAY 26316 10.68 15.93 8.55 35 TR_XM_BayesUnsub 25288 8.26 15.31 5.40 36 XM_B_SpammyWords3 20989 6.13 12.71 3.47 37 BAYES_80 20448 5.50 12.38 2.72 38 FSL_BULK_SIG 20006 7.43 12.11 5.54 39 TR_XM_SpammyRelay 17380 4.10 10.52 1.50 40 TR_XM_SpammyWords2 15981 3.26 9.67 0.66 41 BOTNET_IPINHOSTNAME 15969 4.43 9.67 2.31 42 LOTS_OF_MONEY 15915 7.69 9.63 6.91 43 XM_UncommonTLD01 15776 5.10 9.55 3.29 44 RCVD_IN_BL_SPAMCOP_NET 15335 3.04 9.28 0.51 45 BOTNET 14754 3.28 8.93 0.99 46 XMStrtUSub 14447 8.82 8.75 8.85 47 TR_XM_SpammyWords4 14264 6.34 8.63 5.41 48 XM_Evil_Numbers_Gen 13773 7.36 8.34 6.97 49 TR_XM_UnparsRelay 13671 3.16 8.28 1.08 50 XM_Body_Dirty_Words 13519 4.15 8.18 2.52 51 BAYES_60 12874 7.96 7.79 8.03 52 XM_B_Phish_Phrases 12735 6.40 7.71 5.86 53 TR_XM_SPAMCOP 11747 2.29 7.11 0.33 54 ALL_TRUSTED 11671 25.00 7.07 32.26 55 UNTRUSTED_Relay 11451 2.93 6.93 1.31 56 LotsOfNums_01 11350 6.70 6.87 6.64 57 XMSubMetaSx_00 10711 4.02 6.48 3.02 58 XM_B_SpammyTLD 10674 4.59 6.46 3.83 59 HTML_IMAGE_RATIO_02 10427 4.38 6.31 3.60 60 SpammyFromTLD_02 9987 1.97 6.05 0.33 61 XM_B_PhoneNumber 9919 7.79 6.00 8.51 62 RELAYCOUNTRY_CA 9710 2.29 5.88 0.84 63 MPART_ALT_DIFF 8639 4.35 5.23 3.99 64 T_HTML_ATTACH 8448 5.20 5.11 5.24 65 TO_IN_SUBJ 8346 5.17 5.05 5.22 66 T_OBFU_HTML_ATTACH 8328 5.15 5.04 5.20 67 TR_XM_HtmlAttach 8321 5.15 5.04 5.20 68 BAYES_95 8182 2.63 4.95 1.68 69 XM_H_Long_From01 7995 4.58 4.84 4.47 70 HTML_IMAGE_RATIO_04 7965 3.68 4.82 3.22 71 DKIM_INVALID 7808 2.91 4.73 2.17 72 XMSexyCombo_05 7607 2.24 4.60 1.29 73 XM_B_Investor 7090 2.22 4.29 1.38 74 TR_XM_PhishingBody 7042 2.30 4.26 1.51 75 HTML_IMAGE_RATIO_06 6984 3.21 4.23 2.80 76 XM_H_GMP 6698 4.55 4.05 4.75 77 T_XMDrugObfuBody_14 6653 2.21 4.03 1.47 78 TR_Symld_Words 6608 2.15 4.00 1.40 79 RELAYCOUNTRY_FR 6224 1.24 3.77 0.21 80 TR_XM_SpammyWords5 6200 1.89 3.75 1.13 81 MultiRelay_CC 6015 1.13 3.64 0.11 82 RCVD_IN_MSPIKE_WL 5993 4.26 3.63 4.52 83 RCVD_IN_MSPIKE_H3 5993 4.26 3.63 4.52 84 XMNumbers 5929 2.93 3.59 2.66 85 RCVD_IN_VALIDITY_RPBL 5896 1.09 3.57 0.09 86 TooManyTo_001 5377 6.01 3.25 7.12 87 XM_UB50 5352 1.53 3.24 0.84 88 XMNoVowels 5349 2.77 3.24 2.58 89 XM_OfRef6 5319 1.51 3.22 0.82 90 TM2_M_VERY_LONG_WORD 5276 1.59 3.19 0.95 91 MIME_HTML_MOSTLY 5267 2.20 3.19 1.80 92 TM2_M_URI_OPT_OUT 5111 1.95 3.09 1.49 93 T_TooManySym_01 4998 12.63 3.03 16.52 94 MIME_QP_LONG_LINE 4942 3.71 2.99 4.00 95 MIME_HTML_ONLY_MULTI 4858 2.56 2.94 2.40 96 T_XMDrugObfuBody_08 4836 1.81 2.93 1.36 97 RELAYCOUNTRY_ZA 4835 0.84 2.93 0.00 98 DATE_IN_FUTURE_06_12 4752 0.84 2.88 0.02 99 TR_Orig_Subnet 4742 0.83 2.87 0.00 100 HTML_IMAGE_RATIO_08 4413 2.20 2.67 2.01 101 XM_SPF_SoftFail 4405 1.64 2.67 1.22 102 XMStockSpam_06 4378 1.42 2.65 0.92 103 XM_B_Unsub2 4350 1.67 2.63 1.27 104 XM_CamelCaseFrm001 4184 1.92 2.53 1.68 105 XMDiploma_00 4019 1.71 2.43 1.42 106 XM_URI_RBL 3963 0.99 2.40 0.41 107 BAYES_20 3939 3.21 2.38 3.54 108 RCVD_IN_PSBL 3826 0.95 2.32 0.40 109 RELAYCOUNTRY_AU 3797 1.00 2.30 0.47 110 MAILING_LIST_MULTI 3741 2.90 2.26 3.15 111 XM_B_URI_Unicode 3694 1.71 2.24 1.50 112 T_XMHurry_00 3537 0.97 2.14 0.49 113 FROM_EXCESS_BASE64 3501 1.63 2.12 1.43 114 T_REMOTE_IMAGE 3414 10.14 2.07 13.41 115 XM_B_SpammyWords4 3292 1.04 1.99 0.66 116 HTML_TAG_BALANCE_BODY 3275 0.94 1.98 0.51 117 BAYES_40 3213 4.09 1.94 4.95 118 DKIM_ADSP_NXDOMAIN 3193 0.75 1.93 0.27 119 NO_DNS_FOR_FROM 3055 0.69 1.85 0.22 120 TR_XM_MaxWHORU 3014 0.65 1.82 0.17 121 TR_XM_NoHeaderRelay 2993 0.62 1.81 0.14 122 RCVD_IN_VALIDITY_SAFE 2978 2.57 1.80 2.88 123 USER_IN_DEF_DKIM_WL 2954 7.66 1.79 10.03 124 RELAYCOUNTRY_GB 2932 0.83 1.77 0.45 125 SUBJ_ALL_CAPS 2800 1.33 1.69 1.18 126 DIET_1 2719 0.71 1.65 0.33 127 T_FILL_THIS_FORM_SHORT 2713 1.01 1.64 0.76 128 XM_H_Long_From02 2698 1.04 1.63 0.80 129 T_TooManySym_02 2675 10.19 1.62 13.66 130 T_XMDrugObfuBody_00 2655 0.88 1.61 0.58 131 HTML_MIME_NO_HTML_TAG 2616 1.92 1.58 2.06 132 RCVD_IN_VALIDITY_CERTIFIED 2604 2.16 1.58 2.40 133 SpammyFromTLD_01 2583 0.94 1.56 0.69 134 HTML_IMAGE_ONLY_20 2569 8.40 1.56 11.17 135 XM_SendGrid 2540 1.23 1.54 1.10 136 RELAYCOUNTRY_DE 2538 0.66 1.54 0.31 137 SHORTCIRCUIT 2514 0.44 1.52 0.00 138 RCVD_IN_ZEN_LASTEXTERNAL 2514 0.44 1.52 0.00 139 TR_XM_INV_DKIM 2476 0.53 1.50 0.13 140 TR_MetaPhish_Combo_01 2401 1.04 1.45 0.87 141 XM_B_Phish66 2387 0.71 1.44 0.41 142 HK_RANDOM_REPLYTO 2386 0.48 1.44 0.09 143 XMGenDplmaNmb 2348 1.01 1.42 0.84 144 XMBody_17 2221 0.57 1.34 0.26 145 XMPhish30 2171 0.71 1.31 0.46 146 NORDNS_LOW_CONTRAST 2170 0.41 1.31 0.04 147 HOSTED_IMG_MULTI_PUB_01 2164 0.40 1.31 0.03 148 XMBrknScrpt_02 2123 0.87 1.29 0.71 149 BODY_URI_ONLY 2074 0.37 1.26 0.01 150 LongTLD 2052 0.63 1.24 0.38 151 RCVD_IN_IADB_LISTED 2030 2.57 1.23 3.11 152 XM_DK_Undo_01 1985 1.36 1.20 1.42 153 URI_HEX 1973 1.14 1.19 1.11 154 TO_NO_BRKTS_HTML_ONLY 1949 0.61 1.18 0.38 155 RELAYCOUNTRY_NL 1921 0.61 1.16 0.38 156 XM_B_SEO 1913 0.46 1.16 0.18 157 BOTNET_NORDNS 1840 0.33 1.11 0.01 158 TR_XM_Base64_M1 1823 0.68 1.10 0.51 159 ANY_BOUNCE_MESSAGE 1804 3.21 1.09 4.07 160 BOUNCE_MESSAGE 1804 3.21 1.09 4.07 161 KHOP_HELO_FCRDNS 1800 1.16 1.09 1.19 162 XM_DIRTYINTL 1765 0.35 1.07 0.07 163 DKIM_ADSP_CUSTOM_MED 1756 0.86 1.06 0.77 164 XM_B_COPY_HTML 1744 0.68 1.06 0.53 165 URI_NOVOWEL 1722 1.32 1.04 1.43 166 T_Symld_Words_02 1720 0.89 1.04 0.83 167 TR_XM_SEO4 1699 0.36 1.03 0.08 168 RCVD_IN_IADB_SPF 1692 2.21 1.02 2.70 169 BAYES_00 1663 7.14 1.01 9.62 170 BAYES_05 1662 1.64 1.01 1.90 171 HTTPS_HTTP_MISMATCH 1636 0.80 0.99 0.72 172 RCVD_IN_PBL 1632 0.74 0.99 0.64 173 RCVD_IN_IADB_DK 1607 1.93 0.97 2.31 174 XMBdyGiftCard01 1602 0.55 0.97 0.38 175 RCVD_IN_IADB_SENDERID 1596 1.98 0.97 2.39 176 URI_TRY_3LD 1594 0.55 0.96 0.39 177 XM_OfRef7 1591 0.37 0.96 0.14 178 XMPhish14 1555 0.53 0.94 0.36 179 TR_XM_RelayPhish 1543 0.31 0.93 0.06 180 T_TooManySym_03 1490 5.42 0.90 7.25 181 XMReplyNow 1474 0.41 0.89 0.22 182 TR_XM_DK_SendGrid 1471 0.72 0.89 0.65 183 SHOPIFY_IMG_NOT_RCVD_SFY 1454 0.39 0.88 0.19 184 T_MONEY_PERCENT 1454 0.34 0.88 0.12 185 TR_LOTS_OF_MONEY2 1454 0.34 0.88 0.12 186 XM_ProductURIs 1439 0.50 0.87 0.34 187 XMHTML_After_End 1438 0.41 0.87 0.22 188 TM2_M_OBFU_COMMENT 1411 0.38 0.85 0.19 189 XM_RXBody 1410 0.36 0.85 0.16 190 FORGED_GMAIL_RCVD 1401 0.60 0.85 0.51 191 XMSubMetaI_00 1396 0.49 0.85 0.35 192 XM_HighProb1 1381 0.24 0.84 0.01 193 XMSlimDrugH 1380 0.51 0.84 0.38 194 T_STY_INVIS_DIRECT 1377 0.47 0.83 0.33 195 MPART_ALT_DIFF_COUNT 1374 0.62 0.83 0.54 196 XM_B_DNDMA 1335 0.46 0.81 0.32 197 TR_XM_PHPDW 1331 0.44 0.81 0.29 198 MIME_CHARSET_FARAWAY 1327 0.47 0.80 0.34 199 TR_XM_PHPForged 1324 0.44 0.80 0.29 200 HTML_FONT_TINY_NORDNS 1300 0.27 0.79 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 364899 91.29 95.96 89.40 2 DCC_CHECK_NEGATIVE 268355 54.02 25.04 65.74 3 RELAYCOUNTRY_US 265763 68.34 76.32 65.11 4 BAYES_50 263418 57.41 39.80 64.53 5 DKIM_SIGNED 248100 66.89 81.98 60.78 6 XM_B_Unicode 247221 66.17 80.03 60.57 7 XM_DK_Pass 242979 64.84 77.98 59.53 8 DKIM_VALID 239248 63.99 77.26 58.61 9 DKIM_VALID_AU 190497 50.23 59.03 46.67 10 XM_B_SpammyWords 157878 45.42 62.09 38.68 11 XMListUnsubscribeExists 157116 45.89 64.18 38.49 12 DCC_CHECK 139644 45.51 73.43 34.21 13 XMSubLong 132078 30.71 26.64 32.36 14 ALL_TRUSTED 131680 25.00 7.07 32.26 15 XM_B_Unicode3 129101 35.12 43.76 31.63 16 MIME_HTML_ONLY 126854 32.71 36.74 31.08 17 T_TM2_M_HEADER_IN_MSG 119067 27.21 22.37 29.17 18 RCVD_IN_MSPIKE_H2 115174 31.37 39.18 28.22 19 DKIM_VALID_EF 94815 24.35 27.14 23.23 20 HTML_FONT_LOW_CONTRAST 88925 26.54 38.28 21.79 21 LOC_TINY_FONT_1 86264 27.68 43.85 21.13 22 FVGT_m_MULTI_ODD 83145 22.91 29.18 20.37 23 XM_B_SpammyWords2 73576 23.21 36.03 18.03 24 T_KAM_HTML_FONT_INVALID 71977 21.24 30.16 17.63 25 T_TooManySym_01 67428 12.63 3.03 16.52 26 T_TooManySym_02 55775 10.19 1.62 13.66 27 T_REMOTE_IMAGE 54730 10.14 2.07 13.41 28 XM_Multi_Part_URI 46039 14.15 21.24 11.28 29 HTML_IMAGE_ONLY_20 45612 8.40 1.56 11.17 30 MIME_HEADER_CTYPE_ONLY 43629 7.78 0.58 10.69 31 TR_XM_DK_Unsub 41904 12.91 19.45 10.27 32 USER_IN_DEF_DKIM_WL 40943 7.66 1.79 10.03 33 BAYES_00 39285 7.14 1.01 9.62 34 XMStrtUSub 36125 8.82 8.75 8.85 35 UNPARSEABLE_RELAY 34893 10.68 15.93 8.55 36 XM_B_PhoneNumber 34720 7.79 6.00 8.51 37 BAYES_60 32786 7.96 7.79 8.03 38 T_TooManySym_03 29594 5.42 0.90 7.25 39 TooManyTo_001 29068 6.01 3.25 7.12 40 XM_Evil_Numbers_Gen 28441 7.36 8.34 6.97 41 XM_B_Unsub 28437 9.55 15.93 6.97 42 LOTS_OF_MONEY 28192 7.69 9.63 6.91 43 LotsOfNums_01 27084 6.70 6.87 6.64 44 TR_XM_DK_Bayes 24190 4.40 0.64 5.93 45 XM_B_Phish_Phrases 23936 6.40 7.71 5.86 46 TR_XM_DK_Bayes1 23650 4.30 0.61 5.79 47 FSL_BULK_SIG 22611 7.43 12.11 5.54 48 XM_DKIMWhitelistDomains 22589 4.08 0.48 5.53 49 TR_XM_SpammyWords4 22075 6.34 8.63 5.41 50 TR_XM_BayesUnsub 22061 8.26 15.31 5.40 51 IN_ZIMBRA_NJ_WHITELIST 21946 3.85 0.09 5.38 52 T_HTML_ATTACH 21378 5.20 5.11 5.24 53 TO_IN_SUBJ 21301 5.17 5.05 5.22 54 T_OBFU_HTML_ATTACH 21210 5.15 5.04 5.20 55 TR_XM_HtmlAttach 21209 5.15 5.04 5.20 56 BAYES_40 20215 4.09 1.94 4.95 57 TR_XM_DK_Bayes2 19489 3.53 0.46 4.77 58 XM_H_GMP 19401 4.55 4.05 4.75 59 RCVD_IN_MSPIKE_WL 18455 4.26 3.63 4.52 60 RCVD_IN_MSPIKE_H3 18433 4.26 3.63 4.52 61 XM_H_Long_From01 18249 4.58 4.84 4.47 62 TR_MAX_INTL_RELAY 17973 8.19 17.55 4.40 63 ANY_BOUNCE_MESSAGE 16609 3.21 1.09 4.07 64 BOUNCE_MESSAGE 16595 3.21 1.09 4.07 65 XM_DK_Undo_02 16526 13.35 36.34 4.05 66 MIME_QP_LONG_LINE 16324 3.71 2.99 4.00 67 MPART_ALT_DIFF 16291 4.35 5.23 3.99 68 XM_PDF 16184 3.00 0.60 3.96 69 XM_B_SpammyTLD 15623 4.59 6.46 3.83 70 HTML_IMAGE_RATIO_02 14685 4.38 6.31 3.60 71 BAYES_20 14445 3.21 2.38 3.54 72 XM_B_SpammyWords3 14164 6.13 12.71 3.47 73 RELAYCOUNTRY_META 14058 7.40 17.18 3.44 74 XM_UncommonTLD01 13445 5.10 9.55 3.29 75 HTML_IMAGE_RATIO_04 13143 3.68 4.82 3.22 76 MAILING_LIST_MULTI 12861 2.90 2.26 3.15 77 RCVD_IN_IADB_LISTED 12690 2.57 1.23 3.11 78 XMSubMetaSx_00 12337 4.02 6.48 3.02 79 BAYES_99 12268 9.98 27.21 3.01 80 RCVD_IN_VALIDITY_SAFE 11752 2.57 1.80 2.88 81 HTML_IMAGE_RATIO_06 11440 3.21 4.23 2.80 82 BAYES_80 11095 5.50 12.38 2.72 83 RCVD_IN_IADB_SPF 11003 2.21 1.02 2.70 84 XMNumbers 10846 2.93 3.59 2.66 85 XMNoVowels 10514 2.77 3.24 2.58 86 XM_Body_Dirty_Words 10278 4.15 8.18 2.52 87 TooManyTo_002 10012 1.91 0.58 2.45 88 MIME_HTML_ONLY_MULTI 9803 2.56 2.94 2.40 89 RCVD_IN_VALIDITY_CERTIFIED 9798 2.16 1.58 2.40 90 RCVD_IN_IADB_SENDERID 9755 1.98 0.97 2.39 91 BAYES_999 9565 7.78 21.22 2.34 92 RCVD_IN_IADB_DK 9445 1.93 0.97 2.31 93 BOTNET_IPINHOSTNAME 9410 4.43 9.67 2.31 94 DKIM_INVALID 8852 2.91 4.73 2.17 95 RCVD_IN_IADB_VOUCHED 8681 1.68 0.57 2.13 96 HTML_MIME_NO_HTML_TAG 8403 1.92 1.58 2.06 97 HTML_IMAGE_RATIO_08 8207 2.20 2.67 2.01 98 INVALID_MSGID 7813 1.49 0.45 1.91 99 BAYES_05 7752 1.64 1.01 1.90 100 MIME_HTML_MOSTLY 7328 2.20 3.19 1.80 101 TR_XM_DKIM_Undo 7301 8.62 25.49 1.79 102 BAYES_95 6871 2.63 4.95 1.68 103 XM_CamelCaseFrm001 6837 1.92 2.53 1.68 104 TO_MALFORMED 6217 1.10 0.04 1.52 105 TR_XM_PhishingBody 6173 2.30 4.26 1.51 106 RCVD_IN_IADB_OPTIN 6160 1.16 0.29 1.51 107 XM_B_URI_Unicode 6123 1.71 2.24 1.50 108 TR_XM_SpammyRelay 6117 4.10 10.52 1.50 109 TM2_M_URI_OPT_OUT 6082 1.95 3.09 1.49 110 T_XMDrugObfuBody_14 6001 2.21 4.03 1.47 111 TooManyTo_003 5923 1.18 0.50 1.45 112 FROM_EXCESS_BASE64 5841 1.63 2.12 1.43 113 URI_NOVOWEL 5834 1.32 1.04 1.43 114 XM_DK_Undo_01 5816 1.36 1.20 1.42 115 XMDiploma_00 5811 1.71 2.43 1.42 116 TR_Symld_Words 5732 2.15 4.00 1.40 117 XM_B_Investor 5615 2.22 4.29 1.38 118 T_XMDrugObfuBody_08 5550 1.81 2.93 1.36 119 UNTRUSTED_Relay 5338 2.93 6.93 1.31 120 XMSexyCombo_05 5258 2.24 4.60 1.29 121 XM_B_Unsub2 5203 1.67 2.63 1.27 122 TR_DCC_Bayes_99 5157 6.77 20.39 1.26 123 XM_SPF_SoftFail 4990 1.64 2.67 1.22 124 KHOP_HELO_FCRDNS 4866 1.16 1.09 1.19 125 SUBJ_ALL_CAPS 4831 1.33 1.69 1.18 126 IN_HORDE_ADDRESS_BOOK 4703 0.84 0.08 1.15 127 TR_XM_SpammyWords5 4629 1.89 3.75 1.13 128 URI_HEX 4547 1.14 1.19 1.11 129 HELO_NODOT 4527 0.82 0.10 1.11 130 HELO_NO_DOMAIN 4523 0.82 0.10 1.11 131 XM_SendGrid 4498 1.23 1.54 1.10 132 TR_XM_UnparsRelay 4423 3.16 8.28 1.08 133 TooManyTo_004 4281 0.88 0.45 1.05 134 XM_GoogleGroups 4271 0.95 0.70 1.05 135 XMCapTrack 4138 0.85 0.44 1.01 136 BOTNET 4042 3.28 8.93 0.99 137 TM2_M_VERY_LONG_WORD 3859 1.59 3.19 0.95 138 XMGappySubj_01 3745 0.73 0.27 0.92 139 XMStockSpam_06 3740 1.42 2.65 0.92 140 T_TooManySym_04 3714 0.68 0.10 0.91 141 TooManyTo_005 3593 0.75 0.41 0.88 142 TR_MetaPhish_Combo_01 3564 1.04 1.45 0.87 143 XM_UB50 3443 1.53 3.24 0.84 144 XMGenDplmaNmb 3438 1.01 1.42 0.84 145 RELAYCOUNTRY_CA 3409 2.29 5.88 0.84 146 T_Symld_Words_02 3397 0.89 1.04 0.83 147 XM_OfRef6 3328 1.51 3.22 0.82 148 TVD_SPACE_RATIO 3314 0.65 0.27 0.81 149 XM_H_Long_From02 3261 1.04 1.63 0.80 150 DKIM_ADSP_CUSTOM_MED 3160 0.86 1.06 0.77 151 T_FILL_THIS_FORM_SHORT 3101 1.01 1.64 0.76 152 XM_H_Trusted_IP 3038 0.53 0.00 0.74 153 HTTPS_HTTP_MISMATCH 2956 0.80 0.99 0.72 154 XMBrknScrpt_02 2887 0.87 1.29 0.71 155 SpammyFromTLD_01 2818 0.94 1.56 0.69 156 XM_H_PHPMailer 2767 0.63 0.50 0.68 157 XM_ShortIntro_01 2759 0.60 0.43 0.68 158 TR_XM_SpammyWords2 2697 3.26 9.67 0.66 159 XM_B_SpammyWords4 2693 1.04 1.99 0.66 160 TR_XM_DK_SendGrid 2647 0.72 0.89 0.65 161 RCVD_IN_PBL 2605 0.74 0.99 0.64 162 FROM_GOV_DKIM_AU 2594 0.55 0.34 0.64 163 T_XMDrugObfuBody_00 2364 0.88 1.61 0.58 164 XMSubNoVowel 2314 0.51 0.38 0.57 165 MPART_ALT_DIFF_COUNT 2201 0.62 0.83 0.54 166 NML_ADSP_CUSTOM_MED 2189 0.58 0.70 0.54 167 T_OBFU_PDF_ATTACH 2188 0.41 0.11 0.54 168 XM_B_COPY_HTML 2146 0.68 1.06 0.53 169 HTML_TAG_BALANCE_BODY 2101 0.94 1.98 0.51 170 RCVD_IN_BL_SPAMCOP_NET 2090 3.04 9.28 0.51 171 TR_XM_Base64_M1 2088 0.68 1.10 0.51 172 XMLngstWrd_00 2078 0.53 0.58 0.51 173 FORGED_GMAIL_RCVD 2065 0.60 0.85 0.51 174 TVD_RCVD_IP 2049 0.53 0.61 0.50 175 T_XMHurry_00 2020 0.97 2.14 0.49 176 RELAYCOUNTRY_AU 1932 1.00 2.30 0.47 177 XMPhish30 1892 0.71 1.31 0.46 178 RELAYCOUNTRY_GB 1821 0.83 1.77 0.45 179 XMGappySubj_02 1732 0.35 0.15 0.42 180 XMBody_95 1688 0.33 0.12 0.41 181 XM_B_Phish66 1688 0.71 1.44 0.41 182 XM_URI_RBL 1686 0.99 2.40 0.41 183 XM_B_FormFill 1672 0.30 0.01 0.41 184 HTML_IMAGE_ONLY_32 1656 0.34 0.19 0.41 185 RCVD_IN_PSBL 1640 0.95 2.32 0.40 186 URI_TRY_3LD 1576 0.55 0.96 0.39 187 RELAYCOUNTRY_NL 1566 0.61 1.16 0.38 188 XMSlimDrugH 1556 0.51 0.84 0.38 189 MSGID_FROM_MTA_HEADER 1545 0.30 0.09 0.38 190 TO_NO_BRKTS_HTML_ONLY 1542 0.61 1.18 0.38 191 XMBdyGiftCard01 1540 0.55 0.97 0.38 192 LongTLD 1533 0.63 1.24 0.38 193 XMMoneyMeta_00 1533 0.48 0.75 0.38 194 HTML_IMAGE_ONLY_28 1520 0.35 0.30 0.37 195 XMPhish14 1463 0.53 0.94 0.36 196 XMSubMetaI_00 1435 0.49 0.85 0.35 197 XMLngstWrd_01 1420 0.39 0.48 0.35 198 TM2_M_BODY_EMPTY 1417 0.28 0.12 0.35 199 XM_ProductURIs 1408 0.50 0.87 0.34 200 XMDateMe_00 1404 0.35 0.36 0.34 ----------------------------------------------------------------------