Email: 461308 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.46 sec Spam: 150684 Autolearn: 0 AvgScore: 14.32 AvgScanTime: 1.57 sec Ham: 310624 Autolearn: 0 AvgScore: -0.02 AvgScanTime: 1.41 sec Time Spent Running SA: 187.18 hours Time Spent Processing Spam: 65.71 hours Time Spent Processing Ham: 121.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144420 90.35 95.84 87.69 2 DKIM_SIGNED 136099 81.55 90.32 77.30 3 XM_DK_Pass 127911 78.74 84.89 75.75 4 DKIM_VALID 126452 77.69 83.92 74.67 5 RELAYCOUNTRY_US 126425 82.63 83.90 82.01 6 XM_B_Unicode 126205 75.68 83.75 71.76 7 DCC_CHECK 115972 52.25 76.96 40.26 8 XMListUnsubscribeExists 107286 57.22 71.20 50.44 9 XM_B_SpammyWords 104725 53.04 69.50 45.05 10 DKIM_VALID_AU 98769 61.57 65.55 59.65 11 XM_B_Unicode3 75158 44.50 49.88 41.90 12 LOC_TINY_FONT_1 74925 34.60 49.72 27.27 13 BAYES_50 62753 55.26 41.65 61.86 14 XM_B_SpammyWords2 59843 25.85 39.71 19.12 15 XM_DK_Undo_02 59639 16.13 39.58 4.75 16 HTML_FONT_LOW_CONTRAST 59514 32.21 39.50 28.67 17 RCVD_IN_MSPIKE_H2 57236 35.68 37.98 34.57 18 T_KAM_HTML_FONT_INVALID 50277 25.71 33.37 22.00 19 FVGT_m_MULTI_ODD 50273 27.54 33.36 24.71 20 BAYES_99 44290 11.55 29.39 2.90 21 DKIM_VALID_EF 44163 28.76 29.31 28.50 22 MIME_HTML_ONLY 42568 23.09 28.25 20.59 23 TR_XM_DKIM_Undo 41690 10.37 27.67 1.98 24 XMSubLong 35841 23.21 23.79 22.93 25 BAYES_999 34116 8.87 22.64 2.18 26 XM_Multi_Part_URI 33951 16.03 22.53 12.88 27 TR_DCC_Bayes_99 32953 7.86 21.87 1.06 28 DCC_CHECK_NEGATIVE 32575 47.25 21.62 59.69 29 TR_XM_DK_Unsub 31985 15.44 21.23 12.63 30 T_TM2_M_HEADER_IN_MSG 31107 26.50 20.64 29.34 31 XM_B_Unsub 26988 11.82 17.91 8.86 32 UNPARSEABLE_RELAY 26101 13.75 17.32 12.02 33 TR_XM_BayesUnsub 25884 10.06 17.18 6.61 34 XM_B_SpammyWords3 23087 8.29 15.32 4.88 35 RELAYCOUNTRY_META 22596 7.65 15.00 4.08 36 TR_MAX_INTL_RELAY 22205 8.37 14.74 5.29 37 LOTS_OF_MONEY 18500 8.14 12.28 6.13 38 TR_XM_SpammyRelay 16911 5.06 11.22 2.06 39 TR_XM_SpammyWords4 16759 6.13 11.12 3.71 40 RCVD_IN_BL_SPAMCOP_NET 16540 4.26 10.98 1.00 41 BOTNET_IPINHOSTNAME 16182 5.64 10.74 3.17 42 XM_Evil_Numbers_Gen 15061 9.15 10.00 8.74 43 FSL_BULK_SIG 14957 8.11 9.93 7.23 44 TR_XM_SpammyWords2 14948 3.51 9.92 0.40 45 BOTNET 13977 4.06 9.28 1.54 46 BAYES_80 13846 5.20 9.19 3.26 47 XM_Body_Dirty_Words 13185 4.59 8.75 2.57 48 BAYES_60 12889 7.24 8.55 6.61 49 TR_XM_UnparsRelay 12629 3.80 8.38 1.58 50 TR_XM_SPAMCOP 12576 3.13 8.35 0.60 51 LotsOfNums_01 12064 8.40 8.01 8.59 52 XM_B_Phish_Phrases 11833 6.25 7.85 5.48 53 HTML_IMAGE_RATIO_02 9915 5.51 6.58 4.99 54 XMSubMetaSx_00 9892 4.62 6.56 3.68 55 MPART_ALT_DIFF 9838 5.30 6.53 4.71 56 DKIM_INVALID 9647 3.86 6.40 2.63 57 XM_UncommonTLD01 9399 5.11 6.24 4.56 58 XM_B_PhoneNumber 9295 9.07 6.17 10.48 59 UNTRUSTED_Relay 8905 2.96 5.91 1.53 60 RELAYCOUNTRY_CA 8412 2.66 5.58 1.24 61 BAYES_95 7915 3.08 5.25 2.03 62 HTML_IMAGE_RATIO_04 7685 4.18 5.10 3.74 63 XM_H_Long_From01 7620 5.85 5.06 6.23 64 TR_XM_PhishingBody 7250 2.65 4.81 1.60 65 XM_H_GMP 7212 5.63 4.79 6.04 66 XM_B_Investor 7128 2.59 4.73 1.56 67 HTML_IMAGE_RATIO_06 6540 3.49 4.34 3.07 68 XMStrtUSub 6332 4.61 4.20 4.81 69 T_XMDrugObfuBody_14 6140 2.48 4.07 1.71 70 RCVD_IN_MSPIKE_WL 5800 4.90 3.85 5.41 71 RCVD_IN_MSPIKE_H3 5800 4.90 3.85 5.41 72 XMSexyCombo_05 5790 2.07 3.84 1.21 73 TM2_M_VERY_LONG_WORD 5771 2.50 3.83 1.85 74 XM_B_SpammyTLD 5644 2.86 3.75 2.44 75 TooManyTo_001 5623 6.72 3.73 8.17 76 MIME_QP_LONG_LINE 5318 4.68 3.53 5.24 77 RCVD_IN_VALIDITY_RPBL 5223 1.15 3.47 0.03 78 MIME_HTML_MOSTLY 5219 2.51 3.46 2.05 79 MIME_HTML_ONLY_MULTI 5194 3.10 3.45 2.93 80 DKIM_ADSP_NXDOMAIN 5095 1.31 3.38 0.31 81 TR_XM_SpammyWords5 5030 2.06 3.34 1.44 82 XMNumbers 5017 3.17 3.33 3.09 83 T_XMDrugObfuBody_08 4851 2.08 3.22 1.53 84 TM2_M_URI_OPT_OUT 4812 2.27 3.19 1.82 85 XM_UB50 4635 1.62 3.08 0.92 86 XM_OfRef6 4259 1.69 2.83 1.13 87 XM_CamelCaseFrm001 4230 2.38 2.81 2.18 88 HTML_IMAGE_RATIO_08 4194 2.58 2.78 2.49 89 XM_SPF_SoftFail 4162 1.84 2.76 1.40 90 MAILING_LIST_MULTI 4126 3.15 2.74 3.36 91 XMDiploma_00 4125 2.08 2.74 1.76 92 NO_DNS_FOR_FROM 3995 1.07 2.65 0.30 93 TR_XM_MaxWHORU 3981 1.02 2.64 0.23 94 RCVD_IN_VALIDITY_SAFE 3967 3.67 2.63 4.18 95 XMNoVowels 3937 2.30 2.61 2.15 96 TR_XM_INV_DKIM 3836 0.96 2.55 0.19 97 XM_B_SpammyWords4 3832 1.18 2.54 0.53 98 XM_B_Unsub2 3831 1.85 2.54 1.51 99 XM_URI_RBL 3748 1.13 2.49 0.47 100 RELAYCOUNTRY_AU 3696 1.28 2.45 0.71 101 T_TooManySym_01 3676 4.85 2.44 6.03 102 XM_B_URI_Unicode 3584 2.20 2.38 2.12 103 T_XMHurry_00 3560 1.32 2.36 0.81 104 FROM_EXCESS_BASE64 3437 2.14 2.28 2.07 105 SpammyFromTLD_02 3396 1.02 2.25 0.42 106 TR_XM_NoHeaderRelay 3234 0.85 2.15 0.23 107 RCVD_IN_VALIDITY_CERTIFIED 3229 2.95 2.14 3.34 108 XMStockSpam_06 3075 1.25 2.04 0.87 109 T_XMDrugObfuBody_00 2977 1.15 1.98 0.75 110 USER_IN_DEF_DKIM_WL 2971 9.68 1.97 13.42 111 DIET_1 2939 0.87 1.95 0.35 112 NORDNS_LOW_CONTRAST 2882 0.66 1.91 0.05 113 BAYES_40 2873 4.41 1.91 5.62 114 SpammyFromTLD_01 2747 1.28 1.82 1.01 115 XM_H_Long_From02 2712 1.30 1.80 1.06 116 HK_RANDOM_REPLYTO 2665 0.70 1.77 0.18 117 ALL_TRUSTED 2662 10.48 1.77 14.71 118 XMBody_17 2574 0.84 1.71 0.42 119 T_REMOTE_IMAGE 2466 2.98 1.64 3.64 120 T_FILL_THIS_FORM_SHORT 2425 1.25 1.61 1.07 121 XMPhish30 2386 0.95 1.58 0.65 122 XM_DK_Undo_01 2324 1.67 1.54 1.74 123 XMBrknScrpt_02 2206 1.20 1.46 1.07 124 HTML_MIME_NO_HTML_TAG 2197 2.28 1.46 2.68 125 XMSexyCombo_01 2191 0.57 1.45 0.15 126 XM_SendGrid 2185 1.52 1.45 1.56 127 XMGenDplmaNmb 2175 1.07 1.44 0.89 128 LongTLD 2167 0.86 1.44 0.58 129 SHORTCIRCUIT 2123 0.46 1.41 0.00 130 RCVD_IN_ZEN_LASTEXTERNAL 2123 0.46 1.41 0.00 131 SUBJ_ALL_CAPS 2118 1.57 1.41 1.65 132 XMMoneyMeta_00 2098 0.83 1.39 0.55 133 URI_HEX 2087 1.42 1.39 1.44 134 RELAYCOUNTRY_FR 2079 0.61 1.38 0.24 135 XM_B_Phish66 2033 0.64 1.35 0.30 136 MPART_ALT_DIFF_COUNT 1958 0.88 1.30 0.67 137 BAYES_20 1936 2.97 1.28 3.79 138 KHOP_HELO_FCRDNS 1879 1.44 1.25 1.54 139 BOUNCE_MESSAGE 1784 2.80 1.18 3.59 140 ANY_BOUNCE_MESSAGE 1784 2.81 1.18 3.59 141 XM_S_SpammyWords 1748 0.58 1.16 0.29 142 TR_XM_Spammywords 1748 0.58 1.16 0.29 143 HTML_FONT_TINY_NORDNS 1723 0.43 1.14 0.08 144 TR_LOTS_OF_MONEY3 1705 0.56 1.13 0.29 145 SHOPIFY_IMG_NOT_RCVD_SFY 1697 0.53 1.13 0.24 146 TR_XM_RelayPhish 1634 0.41 1.08 0.08 147 HTML_IMAGE_ONLY_20 1629 0.64 1.08 0.42 148 RCVD_IN_IADB_LISTED 1623 3.29 1.08 4.37 149 URI_NOVOWEL 1603 1.69 1.06 1.99 150 URI_TRY_3LD 1602 0.66 1.06 0.47 151 XMHTML_After_End 1590 0.54 1.06 0.30 152 TR_Symld_Words 1566 1.42 1.04 1.61 153 RCVD_IN_IADB_SPF 1533 2.88 1.02 3.79 154 RCVD_IN_PBL 1529 0.86 1.01 0.78 155 TR_Mismatch_TLD_02 1527 0.38 1.01 0.08 156 XM_B_SEO 1522 0.51 1.01 0.27 157 T_MONEY_PERCENT 1521 0.43 1.01 0.15 158 TR_LOTS_OF_MONEY2 1521 0.43 1.01 0.15 159 XM_B_COPY_HTML 1516 0.87 1.01 0.80 160 RCVD_IN_IADB_DK 1505 2.51 1.00 3.25 161 RCVD_IN_PSBL 1498 0.54 0.99 0.31 162 HTTPS_HTTP_MISMATCH 1497 0.84 0.99 0.77 163 RCVD_IN_IADB_SENDERID 1491 2.59 0.99 3.36 164 XMReplyNow 1480 0.51 0.98 0.28 165 DKIM_ADSP_CUSTOM_MED 1464 0.96 0.97 0.95 166 XMBdyGiftCard01 1457 0.66 0.97 0.51 167 XMSubMetaI_00 1456 0.62 0.97 0.46 168 XM_UB99 1446 0.32 0.96 0.01 169 XM_B_COVIDMETA 1406 0.48 0.93 0.26 170 PLING_QUERY 1403 0.54 0.93 0.35 171 XM_ProductURIs 1401 0.73 0.93 0.63 172 TR_XM_Base64_M1 1395 0.79 0.93 0.73 173 XMPhish14 1387 0.58 0.92 0.41 174 T_TooManySym_02 1379 2.41 0.92 3.14 175 T_STY_INVIS_DIRECT 1364 0.54 0.91 0.37 176 XM_B_DNDMA 1360 0.78 0.90 0.73 177 BOTNET_NORDNS 1347 0.30 0.89 0.01 178 HTML_TAG_BALANCE_BODY 1334 0.70 0.89 0.61 179 T_Symld_Words_02 1331 0.67 0.88 0.57 180 XMBody_78 1315 0.59 0.87 0.45 181 XM_DIRTYINTL 1313 0.34 0.87 0.08 182 XM_RXBody 1307 0.42 0.87 0.20 183 TR_XM_InvalidRelay 1306 0.29 0.87 0.01 184 TR_XM_DK_SendGrid 1296 0.92 0.86 0.95 185 XMSlimDrugH 1288 0.66 0.85 0.57 186 MultiRelay_CC 1283 0.39 0.85 0.16 187 TR_XM_SEO4 1283 0.36 0.85 0.13 188 TR_XM_FormFill2 1279 0.48 0.85 0.30 189 TR_XM_PHPDW 1275 0.47 0.85 0.29 190 TR_XM_PHPForged 1274 0.47 0.85 0.29 191 XM_HighProb1 1270 0.28 0.84 0.01 192 RELAYCOUNTRY_GB 1235 0.66 0.82 0.58 193 XM_H_PHPOS 1224 0.46 0.81 0.28 194 URIBL_BLACK 1198 0.29 0.80 0.05 195 TM2_M_OBFU_COMMENT 1191 0.51 0.79 0.37 196 TM2_M_A_HREF_HREF 1184 0.56 0.79 0.44 197 MIME_CHARSET_FARAWAY 1174 0.64 0.78 0.58 198 XMSolicitRefs_0 1160 0.47 0.77 0.32 199 BAYES_00 1160 8.14 0.77 11.72 200 TR_MetaPhish_Combo_01 1147 0.75 0.76 0.75 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 272379 90.35 95.84 87.69 2 RELAYCOUNTRY_US 254743 82.63 83.90 82.01 3 DKIM_SIGNED 240108 81.55 90.32 77.30 4 XM_DK_Pass 235310 78.74 84.89 75.75 5 DKIM_VALID 231951 77.69 83.92 74.67 6 XM_B_Unicode 222891 75.68 83.75 71.76 7 BAYES_50 192159 55.26 41.65 61.86 8 DCC_CHECK_NEGATIVE 185413 47.25 21.62 59.69 9 DKIM_VALID_AU 185273 61.57 65.55 59.65 10 XMListUnsubscribeExists 156694 57.22 71.20 50.44 11 XM_B_SpammyWords 139946 53.04 69.50 45.05 12 XM_B_Unicode3 130142 44.50 49.88 41.90 13 DCC_CHECK 125043 52.25 76.96 40.26 14 RCVD_IN_MSPIKE_H2 107369 35.68 37.98 34.57 15 T_TM2_M_HEADER_IN_MSG 91127 26.50 20.64 29.34 16 HTML_FONT_LOW_CONTRAST 89067 32.21 39.50 28.67 17 DKIM_VALID_EF 88525 28.76 29.31 28.50 18 LOC_TINY_FONT_1 84703 34.60 49.72 27.27 19 FVGT_m_MULTI_ODD 76751 27.54 33.36 24.71 20 XMSubLong 71239 23.21 23.79 22.93 21 T_KAM_HTML_FONT_INVALID 68334 25.71 33.37 22.00 22 MIME_HTML_ONLY 63963 23.09 28.25 20.59 23 XM_B_SpammyWords2 59390 25.85 39.71 19.12 24 ALL_TRUSTED 45696 10.48 1.77 14.71 25 USER_IN_DEF_DKIM_WL 41687 9.68 1.97 13.42 26 XM_Multi_Part_URI 40003 16.03 22.53 12.88 27 TR_XM_DK_Unsub 39245 15.44 21.23 12.63 28 UNPARSEABLE_RELAY 37327 13.75 17.32 12.02 29 BAYES_00 36404 8.14 0.77 11.72 30 XM_B_PhoneNumber 32557 9.07 6.17 10.48 31 XM_B_Unsub 27521 11.82 17.91 8.86 32 XM_Evil_Numbers_Gen 27136 9.15 10.00 8.74 33 LotsOfNums_01 26687 8.40 8.01 8.59 34 TooManyTo_001 25369 6.72 3.73 8.17 35 TR_XM_DK_Bayes 24716 5.57 0.65 7.96 36 TR_XM_DK_Bayes1 24219 5.46 0.64 7.80 37 FSL_BULK_SIG 22455 8.11 9.93 7.23 38 XM_DKIMWhitelistDomains 22181 4.84 0.10 7.14 39 IN_ZIMBRA_NJ_WHITELIST 21539 4.70 0.10 6.93 40 TR_XM_DK_Bayes2 20600 4.63 0.49 6.63 41 TR_XM_BayesUnsub 20537 10.06 17.18 6.61 42 BAYES_60 20517 7.24 8.55 6.61 43 XM_H_Long_From01 19355 5.85 5.06 6.23 44 LOTS_OF_MONEY 19056 8.14 12.28 6.13 45 XM_H_GMP 18755 5.63 4.79 6.04 46 T_TooManySym_01 18719 4.85 2.44 6.03 47 BAYES_40 17468 4.41 1.91 5.62 48 XM_B_Phish_Phrases 17020 6.25 7.85 5.48 49 RCVD_IN_MSPIKE_WL 16793 4.90 3.85 5.41 50 RCVD_IN_MSPIKE_H3 16793 4.90 3.85 5.41 51 TR_MAX_INTL_RELAY 16421 8.37 14.74 5.29 52 MIME_QP_LONG_LINE 16264 4.68 3.53 5.24 53 HTML_IMAGE_RATIO_02 15498 5.51 6.58 4.99 54 XM_B_SpammyWords3 15161 8.29 15.32 4.88 55 XMStrtUSub 14955 4.61 4.20 4.81 56 XM_DK_Undo_02 14759 16.13 39.58 4.75 57 MPART_ALT_DIFF 14617 5.30 6.53 4.71 58 XM_UncommonTLD01 14168 5.11 6.24 4.56 59 XM_PDF 14094 3.26 0.63 4.54 60 RCVD_IN_IADB_LISTED 13563 3.29 1.08 4.37 61 RCVD_IN_VALIDITY_SAFE 12984 3.67 2.63 4.18 62 RELAYCOUNTRY_META 12678 7.65 15.00 4.08 63 BAYES_20 11785 2.97 1.28 3.79 64 RCVD_IN_IADB_SPF 11774 2.88 1.02 3.79 65 HTML_IMAGE_RATIO_04 11606 4.18 5.10 3.74 66 TR_XM_SpammyWords4 11536 6.13 11.12 3.71 67 XMSubMetaSx_00 11418 4.62 6.56 3.68 68 T_REMOTE_IMAGE 11298 2.98 1.64 3.64 69 ANY_BOUNCE_MESSAGE 11162 2.81 1.18 3.59 70 BOUNCE_MESSAGE 11153 2.80 1.18 3.59 71 RCVD_IN_IADB_SENDERID 10434 2.59 0.99 3.36 72 MAILING_LIST_MULTI 10422 3.15 2.74 3.36 73 RCVD_IN_VALIDITY_CERTIFIED 10390 2.95 2.14 3.34 74 BAYES_80 10124 5.20 9.19 3.26 75 RCVD_IN_IADB_DK 10085 2.51 1.00 3.25 76 BOTNET_IPINHOSTNAME 9856 5.64 10.74 3.17 77 T_TooManySym_02 9745 2.41 0.92 3.14 78 XMNumbers 9604 3.17 3.33 3.09 79 HTML_IMAGE_RATIO_06 9544 3.49 4.34 3.07 80 RCVD_IN_IADB_VOUCHED 9487 2.20 0.44 3.05 81 MIME_HTML_ONLY_MULTI 9095 3.10 3.45 2.93 82 BAYES_99 9013 11.55 29.39 2.90 83 TooManyTo_002 8608 2.04 0.53 2.77 84 HTML_MIME_NO_HTML_TAG 8338 2.28 1.46 2.68 85 DKIM_INVALID 8157 3.86 6.40 2.63 86 XM_Body_Dirty_Words 7995 4.59 8.75 2.57 87 HTML_IMAGE_RATIO_08 7721 2.58 2.78 2.49 88 XM_B_SpammyTLD 7564 2.86 3.75 2.44 89 INVALID_MSGID 7375 1.65 0.15 2.37 90 BAYES_05 6857 1.68 0.59 2.21 91 BAYES_999 6780 8.87 22.64 2.18 92 XM_CamelCaseFrm001 6766 2.38 2.81 2.18 93 XMNoVowels 6667 2.30 2.61 2.15 94 XM_B_URI_Unicode 6581 2.20 2.38 2.12 95 RCVD_IN_IADB_OPTIN 6432 1.48 0.27 2.07 96 FROM_EXCESS_BASE64 6429 2.14 2.28 2.07 97 TR_XM_SpammyRelay 6411 5.06 11.22 2.06 98 MIME_HTML_MOSTLY 6356 2.51 3.46 2.05 99 BAYES_95 6292 3.08 5.25 2.03 100 TO_MALFORMED 6275 1.38 0.05 2.02 101 URI_NOVOWEL 6191 1.69 1.06 1.99 102 TR_XM_DKIM_Undo 6152 10.37 27.67 1.98 103 TM2_M_VERY_LONG_WORD 5747 2.50 3.83 1.85 104 TM2_M_URI_OPT_OUT 5651 2.27 3.19 1.82 105 XMDiploma_00 5455 2.08 2.74 1.76 106 XM_DK_Undo_01 5397 1.67 1.54 1.74 107 T_XMDrugObfuBody_14 5316 2.48 4.07 1.71 108 TooManyTo_003 5139 1.26 0.44 1.65 109 SUBJ_ALL_CAPS 5122 1.57 1.41 1.65 110 TR_Symld_Words 4997 1.42 1.04 1.61 111 TR_XM_PhishingBody 4977 2.65 4.81 1.60 112 TR_XM_UnparsRelay 4900 3.80 8.38 1.58 113 XM_SendGrid 4835 1.52 1.45 1.56 114 XM_B_Investor 4833 2.59 4.73 1.56 115 KHOP_HELO_FCRDNS 4778 1.44 1.25 1.54 116 BOTNET 4769 4.06 9.28 1.54 117 T_XMDrugObfuBody_08 4761 2.08 3.22 1.53 118 UNTRUSTED_Relay 4739 2.96 5.91 1.53 119 XM_B_Unsub2 4685 1.85 2.54 1.51 120 TR_XM_SpammyWords5 4471 2.06 3.34 1.44 121 URI_HEX 4459 1.42 1.39 1.44 122 IN_HORDE_ADDRESS_BOOK 4438 0.99 0.08 1.43 123 HELO_NODOT 4377 1.01 0.20 1.41 124 HELO_NO_DOMAIN 4369 1.01 0.20 1.41 125 XM_SPF_SoftFail 4348 1.84 2.76 1.40 126 T_TooManySym_03 3878 0.91 0.20 1.25 127 RELAYCOUNTRY_CA 3862 2.66 5.58 1.24 128 XMSexyCombo_05 3760 2.07 3.84 1.21 129 TooManyTo_004 3677 0.92 0.39 1.18 130 XM_GoogleGroups 3574 1.00 0.69 1.15 131 XMCapTrack 3549 0.89 0.37 1.14 132 XMGappySubj_01 3526 0.80 0.11 1.14 133 XM_OfRef6 3524 1.69 2.83 1.13 134 T_FILL_THIS_FORM_SHORT 3334 1.25 1.61 1.07 135 XMBrknScrpt_02 3312 1.20 1.46 1.07 136 TR_DCC_Bayes_99 3305 7.86 21.87 1.06 137 XM_H_Long_From02 3288 1.30 1.80 1.06 138 TVD_SPACE_RATIO 3220 0.77 0.22 1.04 139 SpammyFromTLD_01 3135 1.28 1.82 1.01 140 RCVD_IN_BL_SPAMCOP_NET 3095 4.26 10.98 1.00 141 TooManyTo_005 2986 0.75 0.33 0.96 142 TR_XM_DK_SendGrid 2949 0.92 0.86 0.95 143 DKIM_ADSP_CUSTOM_MED 2946 0.96 0.97 0.95 144 XM_UB50 2847 1.62 3.08 0.92 145 XMGenDplmaNmb 2780 1.07 1.44 0.89 146 HTML_IMAGE_ONLY_32 2747 0.66 0.21 0.88 147 XMStockSpam_06 2702 1.25 2.04 0.87 148 XM_ShortIntro_01 2579 0.67 0.34 0.83 149 T_XMHurry_00 2508 1.32 2.36 0.81 150 FROM_GOV_DKIM_AU 2487 0.62 0.23 0.80 151 XM_B_COPY_HTML 2477 0.87 1.01 0.80 152 RCVD_IN_PBL 2418 0.86 1.01 0.78 153 HTTPS_HTTP_MISMATCH 2390 0.84 0.99 0.77 154 TR_MetaPhish_Combo_01 2319 0.75 0.76 0.75 155 T_XMDrugObfuBody_00 2318 1.15 1.98 0.75 156 TR_XM_Base64_M1 2258 0.79 0.93 0.73 157 XM_B_DNDMA 2258 0.78 0.90 0.73 158 RELAYCOUNTRY_AU 2204 1.28 2.45 0.71 159 NML_ADSP_CUSTOM_MED 2126 0.68 0.66 0.68 160 MPART_ALT_DIFF_COUNT 2094 0.88 1.30 0.67 161 XM_H_PHPMailer 2087 0.65 0.61 0.67 162 TVD_RCVD_IP 2043 0.63 0.57 0.66 163 XMPhish30 2004 0.95 1.58 0.65 164 XM_ProductURIs 1972 0.73 0.93 0.63 165 TO_NO_BRKTS_HTML_ONLY 1963 0.63 0.62 0.63 166 T_OBFU_PDF_ATTACH 1940 0.46 0.13 0.62 167 FORGED_GMAIL_RCVD 1895 0.65 0.74 0.61 168 HTML_TAG_BALANCE_BODY 1891 0.70 0.89 0.61 169 TR_XM_SPAMCOP 1870 3.13 8.35 0.60 170 XMLngstWrd_00 1837 0.63 0.72 0.59 171 MIME_CHARSET_FARAWAY 1797 0.64 0.78 0.58 172 RELAYCOUNTRY_GB 1796 0.66 0.82 0.58 173 LongTLD 1789 0.86 1.44 0.58 174 XMSlimDrugH 1770 0.66 0.85 0.57 175 XMBody_95 1761 0.46 0.24 0.57 176 T_Symld_Words_02 1756 0.67 0.88 0.57 177 MSGID_FROM_MTA_HEADER 1734 0.40 0.07 0.56 178 XMMoneyMeta_00 1708 0.83 1.39 0.55 179 XMGappySubj_02 1642 0.37 0.03 0.53 180 XM_B_SpammyWords4 1633 1.18 2.54 0.53 181 XMBdyGiftCard01 1575 0.66 0.97 0.51 182 THIS_AD 1513 0.52 0.60 0.49 183 MAY_BE_FORGED 1493 0.39 0.20 0.48 184 XM_URI_RBL 1470 1.13 2.49 0.47 185 URI_TRY_3LD 1457 0.66 1.06 0.47 186 XM_B_FormFill 1423 0.33 0.07 0.46 187 XMSubMetaI_00 1423 0.62 0.97 0.46 188 XMBody_78 1396 0.59 0.87 0.45 189 TM2_M_A_HREF_HREF 1377 0.56 0.79 0.44 190 HTML_FONT_FACE_BAD 1371 0.50 0.62 0.44 191 SHORT_HELO_AND_INLINE_IMAGE 1356 0.31 0.04 0.44 192 XMBody_17 1316 0.84 1.71 0.42 193 HTML_IMAGE_ONLY_20 1314 0.64 1.08 0.42 194 HELO_MISC_IP 1312 0.30 0.04 0.42 195 SpammyFromTLD_02 1303 1.02 2.25 0.42 196 XMBSHREFv2 1287 0.39 0.35 0.41 197 XMPhish14 1269 0.58 0.92 0.41 198 USER_IN_WHITELIST 1254 0.27 0.00 0.40 199 USER_IN_WELCOMELIST 1254 0.27 0.00 0.40 200 TR_XM_SpammyWords2 1253 3.51 9.92 0.40 ----------------------------------------------------------------------