Email: 512353 Autolearn: 0 AvgScore: 5.02 AvgScanTime: 1.46 sec Spam: 133794 Autolearn: 0 AvgScore: 14.11 AvgScanTime: 1.48 sec Ham: 378559 Autolearn: 0 AvgScore: 1.81 AvgScanTime: 1.45 sec Time Spent Running SA: 207.81 hours Time Spent Processing Spam: 55.03 hours Time Spent Processing Ham: 152.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127326 91.24 95.17 89.85 2 DKIM_SIGNED 118422 64.54 88.51 56.07 3 XM_B_Unicode 115693 80.10 86.47 77.85 4 RELAYCOUNTRY_US 114977 85.50 85.94 85.35 5 XM_DK_Pass 114408 63.04 85.51 55.09 6 DKIM_VALID 113569 62.33 84.88 54.35 7 DCC_CHECK 99083 41.33 74.06 29.76 8 XM_B_SpammyWords 94993 61.92 71.00 58.71 9 DKIM_VALID_AU 92926 50.62 69.45 43.96 10 XMListUnsubscribeExists 87353 44.08 65.29 36.59 11 XM_B_Unicode3 70095 36.68 52.39 31.13 12 LOC_TINY_FONT_1 66383 46.91 49.62 45.95 13 BAYES_50 57387 61.23 42.89 67.71 14 XM_B_SpammyWords2 56677 22.07 42.36 14.90 15 RCVD_IN_MSPIKE_H2 53222 30.71 39.78 27.50 16 XM_DK_Undo_02 51202 12.96 38.27 4.02 17 HTML_FONT_LOW_CONTRAST 50807 43.49 37.97 45.44 18 FVGT_m_MULTI_ODD 45613 22.65 34.09 18.60 19 DKIM_VALID_EF 41767 24.12 31.22 21.61 20 T_KAM_HTML_FONT_INVALID 39152 19.72 29.26 16.35 21 BAYES_99 38665 9.61 28.90 2.80 22 TR_XM_DKIM_Undo 36721 8.50 27.45 1.81 23 MIME_HTML_ONLY 34921 18.72 26.10 16.12 24 T_TM2_M_HEADER_IN_MSG 34627 41.12 25.88 46.50 25 DCC_CHECK_NEGATIVE 33034 58.32 24.69 70.21 26 XMSubLong 30431 18.31 22.74 16.74 27 BAYES_999 29492 7.33 22.04 2.13 28 XM_Multi_Part_URI 29247 13.54 21.86 10.59 29 TR_DCC_Bayes_99 27066 6.02 20.23 1.00 30 TR_XM_DK_Unsub 25292 11.95 18.90 9.49 31 XM_B_Unsub 23248 10.27 17.38 7.75 32 UNPARSEABLE_RELAY 22846 11.06 17.08 8.93 33 TR_XM_BayesUnsub 22493 8.24 16.81 5.22 34 RELAYCOUNTRY_META 22067 6.14 16.49 2.48 35 TR_MAX_INTL_RELAY 19087 7.20 14.27 4.70 36 XM_B_SpammyWords3 17982 5.87 13.44 3.20 37 TR_XM_SpammyRelay 16676 4.28 12.46 1.39 38 XM_Evil_Numbers_Gen 15742 26.10 11.77 31.16 39 LOTS_OF_MONEY 14440 6.53 10.79 5.03 40 BOTNET_IPINHOSTNAME 13756 4.64 10.28 2.64 41 TR_XM_SpammyWords2 13584 2.87 10.15 0.30 42 FSL_BULK_SIG 12879 6.69 9.63 5.66 43 XM_B_Phish_Phrases 12831 5.41 9.59 3.93 44 LotsOfNums_01 12760 21.06 9.54 25.13 45 TR_XM_SpammyWords4 12422 4.92 9.28 3.38 46 BOTNET 11970 3.18 8.95 1.14 47 BAYES_80 11698 4.19 8.74 2.59 48 RCVD_IN_BL_SPAMCOP_NET 11630 2.76 8.69 0.67 49 BAYES_60 10945 5.76 8.18 4.90 50 TR_XM_UnparsRelay 10767 2.96 8.05 1.16 51 TM2_M_VERY_LONG_WORD 9651 21.06 7.21 25.96 52 TR_XM_SPAMCOP 9649 2.20 7.21 0.43 53 HTML_IMAGE_RATIO_04 9488 4.30 7.09 3.31 54 XM_Body_Dirty_Words 9398 3.00 7.02 1.58 55 HTML_IMAGE_RATIO_02 8393 4.13 6.27 3.37 56 MPART_ALT_DIFF 7910 4.00 5.91 3.32 57 XMSubMetaSx_00 7667 3.55 5.73 2.77 58 BAYES_95 6959 2.92 5.20 2.12 59 UNTRUSTED_Relay 6875 2.17 5.14 1.12 60 XM_H_Long_From01 6811 4.45 5.09 4.22 61 XM_B_PhoneNumber 6807 6.87 5.09 7.51 62 XM_H_GMP 6787 4.41 5.07 4.17 63 XM_UncommonTLD01 6636 3.50 4.96 2.98 64 RELAYCOUNTRY_CA 6215 1.59 4.65 0.51 65 T_XMDrugObfuBody_14 6101 2.50 4.56 1.78 66 SpammyFromTLD_02 6038 1.42 4.51 0.33 67 TR_XM_PhishingBody 5534 2.13 4.14 1.42 68 TR_XM_SpammyWords5 5484 1.76 4.10 0.93 69 XMStrtUSub 5145 3.74 3.85 3.71 70 XM_B_Investor 5125 1.87 3.83 1.17 71 HTML_IMAGE_RATIO_06 5092 20.85 3.81 26.88 72 DKIM_INVALID 4853 2.21 3.63 1.71 73 MIME_HTML_MOSTLY 4816 2.19 3.60 1.69 74 XMSexyCombo_05 4809 1.82 3.59 1.19 75 TooManyTo_001 4774 5.92 3.57 6.75 76 XM_B_SpammyTLD 4651 2.29 3.48 1.87 77 XMNumbers 4607 2.53 3.44 2.21 78 BOUNCE_MESSAGE 4510 21.48 3.37 27.87 79 ANY_BOUNCE_MESSAGE 4510 21.48 3.37 27.87 80 MIME_HTML_ONLY_MULTI 4384 2.33 3.28 1.99 81 RELAYCOUNTRY_NL 4381 0.94 3.27 0.12 82 XM_OfRef6 4277 1.41 3.20 0.78 83 RCVD_IN_MSPIKE_H3 4135 3.68 3.09 3.88 84 RCVD_IN_MSPIKE_WL 4135 3.68 3.09 3.88 85 XMDiploma_00 4126 1.63 3.08 1.12 86 XM_CamelCaseFrm001 4056 2.04 3.03 1.68 87 XM_SPF_SoftFail 3998 1.52 2.99 1.00 88 HTML_IMAGE_RATIO_08 3957 2.05 2.96 1.73 89 XM_URI_RBL 3869 0.95 2.89 0.26 90 MAY_BE_FORGED 3853 19.17 2.88 24.93 91 KHOP_HELO_FCRDNS 3835 10.62 2.87 13.35 92 RCVD_IN_VALIDITY_RPBL 3628 0.73 2.71 0.03 93 T_XMDrugObfuBody_08 3604 1.92 2.69 1.64 94 XM_B_COPY_HTML 3573 1.09 2.67 0.54 95 RCVD_IN_VALIDITY_SAFE 3560 3.05 2.66 3.19 96 XM_UB50 3507 1.23 2.62 0.74 97 MIME_QP_LONG_LINE 3484 3.22 2.60 3.43 98 XM_B_Unsub2 3368 1.42 2.52 1.03 99 XM_B_SpammyWords4 3352 0.95 2.51 0.41 100 MAILING_LIST_MULTI 3325 2.19 2.49 2.08 101 RELAYCOUNTRY_AU 3279 1.02 2.45 0.51 102 TM2_M_URI_OPT_OUT 3273 1.58 2.45 1.27 103 SUBJ_ALL_CAPS 3184 1.40 2.38 1.06 104 TR_XM_NoHeaderRelay 3164 0.71 2.36 0.13 105 DIET_1 3144 0.87 2.35 0.34 106 SH_BODYURI_REVERSE_CSS 3130 0.89 2.34 0.38 107 T_TooManySym_01 3083 3.80 2.30 4.32 108 URIBL_CSS_A 3014 0.85 2.25 0.36 109 URIBL_CSS 3014 0.85 2.25 0.36 110 RCVD_IN_VALIDITY_CERTIFIED 3010 2.50 2.25 2.59 111 USER_IN_DEF_DKIM_WL 2924 7.85 2.19 9.86 112 XM_B_URI_Unicode 2867 1.57 2.14 1.36 113 XMGenDplmaNmb 2751 0.99 2.06 0.62 114 BAYES_40 2723 4.98 2.04 6.02 115 FROM_EXCESS_BASE64 2681 1.43 2.00 1.23 116 ALL_TRUSTED 2523 9.89 1.89 12.72 117 T_XMDrugObfuBody_00 2481 0.92 1.85 0.59 118 XMBody_17 2381 0.67 1.78 0.28 119 XMStockSpam_06 2363 1.16 1.77 0.94 120 T_XMHurry_00 2336 0.78 1.75 0.44 121 SpammyFromTLD_01 2323 0.90 1.74 0.61 122 LONG_JUNK_URI 2243 0.46 1.68 0.03 123 XMPhish30 2232 0.92 1.67 0.65 124 URI_HEX 2069 1.06 1.55 0.89 125 TR_XM_SpoofStaff 2058 0.51 1.54 0.14 126 T_FILL_THIS_FORM_SHORT 2049 0.87 1.53 0.64 127 XM_H_SpoofStaff4 2017 0.49 1.51 0.14 128 XMSpoofStaff2 2015 0.46 1.51 0.10 129 TR_XM_PSC1 2005 0.46 1.50 0.09 130 XM_DK_Undo_01 1986 1.26 1.48 1.19 131 T_REMOTE_IMAGE 1980 2.37 1.48 2.68 132 TR_XM_SpoofStaff2 1932 0.38 1.44 0.00 133 XMBrknScrpt_02 1930 0.85 1.44 0.64 134 BAYES_20 1926 2.69 1.44 3.14 135 HTML_MIME_NO_HTML_TAG 1895 1.79 1.42 1.92 136 TR_XM_SpoofStaff4 1888 0.44 1.41 0.09 137 RCVD_IN_PSBL 1884 0.47 1.41 0.14 138 SHOPIFY_IMG_NOT_RCVD_SFY 1831 0.51 1.37 0.20 139 XMBdyGiftCard01 1830 0.78 1.37 0.57 140 BOTNET_NORDNS 1823 0.36 1.36 0.01 141 XM_SendGrid 1773 1.06 1.33 0.97 142 SHORTCIRCUIT 1662 0.32 1.24 0.00 143 RCVD_IN_ZEN_LASTEXTERNAL 1662 0.32 1.24 0.00 144 TR_XM_INV_DKIM 1647 0.41 1.23 0.13 145 TM2_M_OBFU_COMMENT 1619 0.61 1.21 0.40 146 MPART_ALT_DIFF_COUNT 1577 0.68 1.18 0.51 147 URI_NOVOWEL 1562 1.25 1.17 1.27 148 URI_TRY_3LD 1530 0.62 1.14 0.43 149 TR_XM_FormFill2 1527 0.44 1.14 0.19 150 XMSlimDrugH 1527 0.62 1.14 0.44 151 TR_MetaPhish_Combo_01 1519 0.69 1.14 0.54 152 TR_XM_PHPForged 1519 0.43 1.14 0.18 153 XM_HighProb1 1505 0.30 1.12 0.01 154 TR_XM_PHPDW 1501 0.44 1.12 0.19 155 RCVD_IN_PBL 1478 0.69 1.10 0.54 156 XM_H_PHPOS 1466 0.42 1.10 0.18 157 TR_LOTS_OF_MONEY3 1463 0.43 1.09 0.20 158 HTML_FONT_TINY_NORDNS 1443 0.32 1.08 0.06 159 XM_B_Phish66 1441 0.45 1.08 0.22 160 T_STY_INVIS_DIRECT 1418 0.55 1.06 0.37 161 TR_XM_Base64_M1 1414 0.65 1.06 0.50 162 DKIM_ADSP_CUSTOM_MED 1407 0.73 1.05 0.61 163 XMReplyNow 1359 0.38 1.02 0.16 164 HTML_TAG_BALANCE_BODY 1354 0.69 1.01 0.58 165 THIS_AD 1343 0.46 1.00 0.27 166 MIME_CHARSET_FARAWAY 1337 0.40 1.00 0.19 167 XM_H_Long_From02 1292 0.73 0.97 0.65 168 XM_B_REG_HTML 1291 0.37 0.96 0.16 169 XM_B_DNDMA 1288 0.58 0.96 0.44 170 J_POPCORN_WO_D 1207 0.38 0.90 0.20 171 XMSubMetaI_00 1199 0.47 0.90 0.32 172 HTTPS_HTTP_MISMATCH 1194 0.53 0.89 0.40 173 RCVD_IN_IADB_LISTED 1187 2.34 0.89 2.85 174 XM_B_SEO 1167 0.37 0.87 0.20 175 NO_DNS_FOR_FROM 1165 0.40 0.87 0.24 176 FORGED_GMAIL_RCVD 1153 0.51 0.86 0.39 177 TR_XM_MaxWHORU 1145 0.35 0.86 0.17 178 RELAYCOUNTRY_FR 1138 0.35 0.85 0.17 179 XM_UB99 1129 0.22 0.84 0.00 180 XM_ProductURIs 1127 0.51 0.84 0.39 181 RDNS_DYNAMIC 1121 0.35 0.84 0.18 182 RCVD_IN_IADB_SPF 1120 2.04 0.84 2.47 183 NML_ADSP_CUSTOM_MED 1117 0.49 0.83 0.37 184 RCVD_IN_IADB_DK 1097 1.79 0.82 2.13 185 XM_B_COVIDMETA 1095 0.29 0.82 0.11 186 XM_S_SpammyWords 1089 0.33 0.81 0.15 187 TR_XM_Spammywords 1088 0.33 0.81 0.15 188 PDS_RDNS_DYNAMIC_FP 1086 0.27 0.81 0.08 189 RCVD_IN_IADB_SENDERID 1085 1.84 0.81 2.21 190 XM_H_PHPMailer 1078 0.77 0.81 0.76 191 CHARSET_FARAWAY_HEADER 1077 0.27 0.80 0.08 192 XMSubMetaSxObfu_03 1076 0.74 0.80 0.72 193 TR_XM_DK_SendGrid 1070 0.68 0.80 0.64 194 XMSolicitRefs_0 1049 0.47 0.78 0.36 195 XMClaimOffer 1044 0.53 0.78 0.44 196 XMSexyCombo_01 1041 0.26 0.78 0.08 197 TR_Mismatch_TLD_02 1038 0.24 0.78 0.05 198 XM_DIRTYINTL 1035 0.24 0.77 0.05 199 LongTLD 1029 0.38 0.77 0.24 200 XM_H_Undi_Recip 1003 0.30 0.75 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 340127 91.24 95.17 89.85 2 RELAYCOUNTRY_US 323102 85.50 85.94 85.35 3 XM_B_Unicode 294700 80.10 86.47 77.85 4 DCC_CHECK_NEGATIVE 265779 58.32 24.69 70.21 5 BAYES_50 256314 61.23 42.89 67.71 6 XM_B_SpammyWords 222244 61.92 71.00 58.71 7 DKIM_SIGNED 212244 64.54 88.51 56.07 8 XM_DK_Pass 208557 63.04 85.51 55.09 9 DKIM_VALID 205763 62.33 84.88 54.35 10 T_TM2_M_HEADER_IN_MSG 176040 41.12 25.88 46.50 11 LOC_TINY_FONT_1 173954 46.91 49.62 45.95 12 HTML_FONT_LOW_CONTRAST 172016 43.49 37.97 45.44 13 DKIM_VALID_AU 166403 50.62 69.45 43.96 14 XMListUnsubscribeExists 138514 44.08 65.29 36.59 15 XM_Evil_Numbers_Gen 117976 26.10 11.77 31.16 16 XM_B_Unicode3 117855 36.68 52.39 31.13 17 DCC_CHECK 112675 41.33 74.06 29.76 18 ANY_BOUNCE_MESSAGE 105518 21.48 3.37 27.87 19 BOUNCE_MESSAGE 105518 21.48 3.37 27.87 20 RCVD_IN_MSPIKE_H2 104108 30.71 39.78 27.50 21 HTML_IMAGE_RATIO_06 101747 20.85 3.81 26.88 22 TM2_M_VERY_LONG_WORD 98268 21.06 7.21 25.96 23 LotsOfNums_01 95127 21.06 9.54 25.13 24 MAY_BE_FORGED 94374 19.17 2.88 24.93 25 DKIM_VALID_EF 81804 24.12 31.22 21.61 26 FVGT_m_MULTI_ODD 70414 22.65 34.09 18.60 27 XMSubLong 63369 18.31 22.74 16.74 28 T_KAM_HTML_FONT_INVALID 61885 19.72 29.26 16.35 29 MIME_HTML_ONLY 61009 18.72 26.10 16.12 30 XM_B_SpammyWords2 56387 22.07 42.36 14.90 31 KHOP_HELO_FCRDNS 50555 10.62 2.87 13.35 32 ALL_TRUSTED 48157 9.89 1.89 12.72 33 XM_Multi_Part_URI 40104 13.54 21.86 10.59 34 USER_IN_DEF_DKIM_WL 37307 7.85 2.19 9.86 35 TR_XM_DK_Unsub 35944 11.95 18.90 9.49 36 BAYES_00 34111 6.85 0.74 9.01 37 UNPARSEABLE_RELAY 33804 11.06 17.08 8.93 38 XM_B_Unsub 29346 10.27 17.38 7.75 39 XM_B_PhoneNumber 28414 6.87 5.09 7.51 40 TooManyTo_001 25535 5.92 3.57 6.75 41 BAYES_40 22806 4.98 2.04 6.02 42 TR_XM_DK_Bayes 21630 4.36 0.54 5.71 43 FSL_BULK_SIG 21423 6.69 9.63 5.66 44 XM_DKIMWhitelistDomains 21356 4.27 0.38 5.64 45 TR_XM_DK_Bayes1 21220 4.28 0.54 5.61 46 TR_XM_BayesUnsub 19743 8.24 16.81 5.22 47 LOTS_OF_MONEY 19032 6.53 10.79 5.03 48 BAYES_60 18563 5.76 8.18 4.90 49 IN_ZIMBRA_NJ_WHITELIST 18144 3.57 0.11 4.79 50 TR_MAX_INTL_RELAY 17804 7.20 14.27 4.70 51 TR_XM_DK_Bayes2 17727 3.55 0.35 4.68 52 T_TooManySym_01 16365 3.80 2.30 4.32 53 XM_H_Long_From01 15971 4.45 5.09 4.22 54 XM_H_GMP 15802 4.41 5.07 4.17 55 XM_DK_Undo_02 15208 12.96 38.27 4.02 56 XM_B_Phish_Phrases 14892 5.41 9.59 3.93 57 RCVD_IN_MSPIKE_WL 14706 3.68 3.09 3.88 58 RCVD_IN_MSPIKE_H3 14705 3.68 3.09 3.88 59 XMStrtUSub 14039 3.74 3.85 3.71 60 MIME_QP_LONG_LINE 13002 3.22 2.60 3.43 61 TR_XM_SpammyWords4 12779 4.92 9.28 3.38 62 HTML_IMAGE_RATIO_02 12744 4.13 6.27 3.37 63 MPART_ALT_DIFF 12577 4.00 5.91 3.32 64 HTML_IMAGE_RATIO_04 12545 4.30 7.09 3.31 65 XM_PDF 12347 2.57 0.60 3.26 66 XM_B_SpammyWords3 12108 5.87 13.44 3.20 67 RCVD_IN_VALIDITY_SAFE 12072 3.05 2.66 3.19 68 BAYES_20 11868 2.69 1.44 3.14 69 XM_UncommonTLD01 11297 3.50 4.96 2.98 70 RCVD_IN_IADB_LISTED 10806 2.34 0.89 2.85 71 TooManyTo_002 10696 2.23 0.54 2.83 72 BAYES_99 10581 9.61 28.90 2.80 73 XMSubMetaSx_00 10502 3.55 5.73 2.77 74 T_REMOTE_IMAGE 10139 2.37 1.48 2.68 75 BOTNET_IPINHOSTNAME 10012 4.64 10.28 2.64 76 RCVD_IN_VALIDITY_CERTIFIED 9797 2.50 2.25 2.59 77 BAYES_80 9786 4.19 8.74 2.59 78 RELAYCOUNTRY_META 9387 6.14 16.49 2.48 79 RCVD_IN_IADB_SPF 9334 2.04 0.84 2.47 80 T_TooManySym_02 9128 1.92 0.54 2.41 81 XMNumbers 8355 2.53 3.44 2.21 82 RCVD_IN_IADB_SENDERID 8348 1.84 0.81 2.21 83 BAYES_999 8059 7.33 22.04 2.13 84 RCVD_IN_IADB_DK 8053 1.79 0.82 2.13 85 BAYES_95 8008 2.92 5.20 2.12 86 MAILING_LIST_MULTI 7876 2.19 2.49 2.08 87 MIME_HTML_ONLY_MULTI 7551 2.33 3.28 1.99 88 RCVD_IN_IADB_VOUCHED 7532 1.55 0.30 1.99 89 HTML_MIME_NO_HTML_TAG 7253 1.79 1.42 1.92 90 INVALID_MSGID 7163 1.46 0.22 1.89 91 XM_B_SpammyTLD 7070 2.29 3.48 1.87 92 TR_XM_DKIM_Undo 6840 8.50 27.45 1.81 93 T_XMDrugObfuBody_14 6726 2.50 4.56 1.78 94 HTML_IMAGE_RATIO_08 6560 2.05 2.96 1.73 95 BAYES_05 6520 1.44 0.63 1.72 96 DKIM_INVALID 6481 2.21 3.63 1.71 97 MIME_HTML_MOSTLY 6401 2.19 3.60 1.69 98 XM_CamelCaseFrm001 6371 2.04 3.03 1.68 99 TO_MALFORMED 6288 1.23 0.02 1.66 100 T_XMDrugObfuBody_08 6213 1.92 2.69 1.64 101 XM_Body_Dirty_Words 5991 3.00 7.02 1.58 102 TR_XM_PhishingBody 5379 2.13 4.14 1.42 103 RCVD_IN_IADB_OPTIN 5297 1.09 0.20 1.40 104 TR_XM_SpammyRelay 5268 4.28 12.46 1.39 105 XM_B_URI_Unicode 5158 1.57 2.14 1.36 106 URI_NOVOWEL 4819 1.25 1.17 1.27 107 TM2_M_URI_OPT_OUT 4804 1.58 2.45 1.27 108 FROM_EXCESS_BASE64 4650 1.43 2.00 1.23 109 XM_B_FormFill 4583 0.90 0.01 1.21 110 XMSexyCombo_05 4514 1.82 3.59 1.19 111 XM_DK_Undo_01 4494 1.26 1.48 1.19 112 TR_Symld_Words 4466 1.05 0.69 1.18 113 XM_B_Investor 4435 1.87 3.83 1.17 114 TooManyTo_003 4432 0.99 0.48 1.17 115 TR_XM_UnparsRelay 4400 2.96 8.05 1.16 116 IN_HORDE_ADDRESS_BOOK 4360 0.87 0.09 1.15 117 BOTNET 4313 3.18 8.95 1.14 118 XMDiploma_00 4245 1.63 3.08 1.12 119 UNTRUSTED_Relay 4242 2.17 5.14 1.12 120 SUBJ_ALL_CAPS 4002 1.40 2.38 1.06 121 XM_B_Unsub2 3898 1.42 2.52 1.03 122 XMGappySubj_01 3850 0.78 0.13 1.02 123 XM_SPF_SoftFail 3794 1.52 2.99 1.00 124 TR_DCC_Bayes_99 3789 6.02 20.23 1.00 125 XM_SendGrid 3661 1.06 1.33 0.97 126 XMStockSpam_06 3570 1.16 1.77 0.94 127 TR_XM_SpammyWords5 3514 1.76 4.10 0.93 128 XM_GoogleGroups 3506 0.87 0.72 0.93 129 T_TooManySym_03 3445 0.72 0.18 0.91 130 URI_HEX 3370 1.06 1.55 0.89 131 TooManyTo_004 3246 0.75 0.43 0.86 132 TVD_SPACE_RATIO 3169 0.67 0.22 0.84 133 TM2_M_BODY_EMPTY 3024 0.61 0.09 0.80 134 XM_OfRef6 2949 1.41 3.20 0.78 135 XM_H_PHPMailer 2883 0.77 0.81 0.76 136 XMCapTrack 2798 0.64 0.34 0.74 137 XM_UB50 2788 1.23 2.62 0.74 138 HELO_NODOT 2771 0.62 0.30 0.73 139 HELO_NO_DOMAIN 2765 0.62 0.30 0.73 140 FROM_GOV_DKIM_AU 2731 0.57 0.14 0.72 141 XMSubMetaSxObfu_03 2716 0.74 0.80 0.72 142 TooManyTo_005 2714 0.63 0.39 0.72 143 XMGappySubj_02 2576 0.51 0.04 0.68 144 RCVD_IN_BL_SPAMCOP_NET 2531 2.76 8.69 0.67 145 XMPhish30 2461 0.92 1.67 0.65 146 XM_H_Long_From02 2454 0.73 0.97 0.65 147 T_FILL_THIS_FORM_SHORT 2431 0.87 1.53 0.64 148 XMBrknScrpt_02 2413 0.85 1.44 0.64 149 TR_XM_DK_SendGrid 2407 0.68 0.80 0.64 150 XMGenDplmaNmb 2338 0.99 2.06 0.62 151 DKIM_ADSP_CUSTOM_MED 2327 0.73 1.05 0.61 152 SpammyFromTLD_01 2307 0.90 1.74 0.61 153 XM_RXBody 2240 0.60 0.63 0.59 154 T_XMDrugObfuBody_00 2223 0.92 1.85 0.59 155 HTML_TAG_BALANCE_BODY 2205 0.69 1.01 0.58 156 XMNoVowels 2161 0.56 0.54 0.57 157 XMBdyGiftCard01 2156 0.78 1.37 0.57 158 XMEmptyBody_01 2137 0.43 0.05 0.56 159 RCVD_IN_PBL 2044 0.69 1.10 0.54 160 TR_MetaPhish_Combo_01 2028 0.69 1.14 0.54 161 XM_B_COPY_HTML 2026 1.09 2.67 0.54 162 XM_ShortIntro_01 1997 0.50 0.41 0.53 163 MPART_ALT_DIFF_COUNT 1930 0.68 1.18 0.51 164 RELAYCOUNTRY_AU 1927 1.02 2.45 0.51 165 TVD_RCVD_IP 1926 0.54 0.64 0.51 166 RELAYCOUNTRY_CA 1919 1.59 4.65 0.51 167 TR_XM_Base64_M1 1908 0.65 1.06 0.50 168 T_OBFU_PDF_ATTACH 1786 0.37 0.09 0.47 169 XMBody_95 1688 0.37 0.14 0.45 170 T_Symld_Words_02 1682 0.44 0.44 0.44 171 XMSlimDrugH 1666 0.62 1.14 0.44 172 XM_B_DNDMA 1663 0.58 0.96 0.44 173 T_XMHurry_00 1654 0.78 1.75 0.44 174 XMClaimOffer 1648 0.53 0.78 0.44 175 URI_TRY_3LD 1628 0.62 1.14 0.43 176 TR_XM_SPAMCOP 1622 2.20 7.21 0.43 177 XM_B_SpammyWords4 1535 0.95 2.51 0.41 178 TM2_M_OBFU_COMMENT 1511 0.61 1.21 0.40 179 MSGID_FROM_MTA_HEADER 1507 0.33 0.12 0.40 180 HTTPS_HTTP_MISMATCH 1503 0.53 0.89 0.40 181 FILL_THIS_FORM 1503 0.35 0.23 0.40 182 XM_ProductURIs 1475 0.51 0.84 0.39 183 FORGED_GMAIL_RCVD 1472 0.51 0.86 0.39 184 T_TVD_MIME_NO_HEADERS 1471 0.30 0.04 0.39 185 SH_BODYURI_REVERSE_CSS 1449 0.89 2.34 0.38 186 HTML_IMAGE_ONLY_20 1408 0.36 0.31 0.37 187 XMBSHREFv2 1395 0.35 0.30 0.37 188 NML_ADSP_CUSTOM_MED 1387 0.49 0.83 0.37 189 T_STY_INVIS_DIRECT 1383 0.55 1.06 0.37 190 XMSolicitRefs_0 1376 0.47 0.78 0.36 191 XMLngstWrd_00 1366 0.44 0.68 0.36 192 URIBL_CSS_A 1362 0.85 2.25 0.36 193 URIBL_CSS 1362 0.85 2.25 0.36 194 HELO_MISC_IP 1335 0.28 0.06 0.35 195 DIET_1 1306 0.87 2.35 0.34 196 RELAYCOUNTRY_GB 1275 0.43 0.69 0.34 197 SpammyFromTLD_02 1246 1.42 4.51 0.33 198 USER_IN_WHITELIST 1242 0.24 0.00 0.33 199 USER_IN_WELCOMELIST 1242 0.24 0.00 0.33 200 XMSubMetaI_00 1230 0.47 0.90 0.32 ----------------------------------------------------------------------