Email: 504327 Autolearn: 0 AvgScore: 2.99 AvgScanTime: 1.40 sec Spam: 147843 Autolearn: 0 AvgScore: 14.48 AvgScanTime: 1.56 sec Ham: 356484 Autolearn: 0 AvgScore: -1.77 AvgScanTime: 1.33 sec Time Spent Running SA: 195.60 hours Time Spent Processing Spam: 63.86 hours Time Spent Processing Ham: 131.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141215 90.26 95.52 88.08 2 DKIM_SIGNED 130190 72.82 88.06 66.50 3 XM_B_Unicode 124477 76.41 84.20 73.19 4 RELAYCOUNTRY_US 124143 83.60 83.97 83.44 5 XM_DK_Pass 123820 70.63 83.75 65.18 6 DKIM_VALID 122595 69.65 82.92 64.15 7 DCC_CHECK 110483 46.08 74.73 34.19 8 XM_B_SpammyWords 102904 50.95 69.60 43.22 9 XMListUnsubscribeExists 99615 49.97 67.38 42.74 10 DKIM_VALID_AU 96643 55.60 65.37 51.55 11 XM_B_Unicode3 75379 45.84 50.99 43.71 12 LOC_TINY_FONT_1 72478 32.36 49.02 25.44 13 BAYES_50 62980 54.21 42.60 59.03 14 XM_B_SpammyWords2 59857 23.03 40.49 15.78 15 RCVD_IN_MSPIKE_H2 59101 33.61 39.98 30.97 16 XM_DK_Undo_02 56626 14.03 38.30 3.96 17 HTML_FONT_LOW_CONTRAST 54816 27.92 37.08 24.12 18 FVGT_m_MULTI_ODD 47548 25.59 32.16 22.86 19 T_KAM_HTML_FONT_INVALID 44877 22.77 30.35 19.63 20 DKIM_VALID_EF 42974 26.72 29.07 25.74 21 BAYES_99 42618 10.46 28.83 2.84 22 MIME_HTML_ONLY 42442 24.04 28.71 22.11 23 TR_XM_DKIM_Undo 40723 9.28 27.54 1.71 24 XMSubLong 39675 24.06 26.84 22.91 25 DCC_CHECK_NEGATIVE 35060 53.44 23.71 65.76 26 T_TM2_M_HEADER_IN_MSG 34423 26.72 23.28 28.14 27 BAYES_999 32283 7.90 21.84 2.12 28 TR_XM_DK_Unsub 30774 13.97 20.82 11.13 29 TR_DCC_Bayes_99 30656 6.74 20.74 0.93 30 XM_Multi_Part_URI 29337 14.08 19.84 11.69 31 UNPARSEABLE_RELAY 25039 12.04 16.94 10.01 32 XM_B_Unsub 24119 10.26 16.31 7.75 33 TR_XM_BayesUnsub 23362 8.76 15.80 5.84 34 RELAYCOUNTRY_META 22772 6.75 15.40 3.16 35 XM_B_SpammyWords3 22513 7.30 15.23 4.01 36 TR_MAX_INTL_RELAY 22185 7.79 15.01 4.80 37 XM_Evil_Numbers_Gen 17759 10.73 12.01 10.20 38 LOTS_OF_MONEY 16964 7.30 11.47 5.56 39 BOTNET_IPINHOSTNAME 15846 5.00 10.72 2.64 40 TR_XM_SpammyRelay 15832 4.22 10.71 1.52 41 BOTNET 15362 3.93 10.39 1.25 42 XM_B_Phish_Phrases 15052 6.52 10.18 5.01 43 TR_XM_SpammyWords4 14973 5.57 10.13 3.68 44 TR_XM_SpammyWords2 14789 3.10 10.00 0.24 45 FSL_BULK_SIG 14663 7.46 9.92 6.44 46 BAYES_80 13696 4.82 9.26 2.98 47 LotsOfNums_01 13429 8.24 9.08 7.88 48 RCVD_IN_BL_SPAMCOP_NET 12813 2.88 8.67 0.47 49 TR_XM_UnparsRelay 12728 3.37 8.61 1.19 50 BAYES_60 11965 6.54 8.09 5.89 51 TR_XM_SPAMCOP 10494 2.27 7.10 0.27 52 XM_Body_Dirty_Words 10075 3.81 6.81 2.56 53 XMSubMetaSx_00 9897 3.97 6.69 2.84 54 XM_UncommonTLD01 9409 4.65 6.36 3.94 55 XM_B_PhoneNumber 9310 8.39 6.30 9.26 56 HTML_IMAGE_RATIO_02 9119 4.90 6.17 4.38 57 MPART_ALT_DIFF 9038 8.00 6.11 8.78 58 TM2_M_VERY_LONG_WORD 8615 3.53 5.83 2.58 59 UNTRUSTED_Relay 8591 2.59 5.81 1.25 60 HTML_IMAGE_RATIO_04 8238 11.27 5.57 13.64 61 HTML_IMAGE_RATIO_06 8195 5.24 5.54 5.11 62 RELAYCOUNTRY_CA 8145 2.22 5.51 0.86 63 TR_XM_PhishingBody 7793 2.68 5.27 1.60 64 DKIM_INVALID 7595 3.16 5.14 2.34 65 BAYES_95 7568 2.79 5.12 1.82 66 XM_H_Long_From01 7243 5.10 4.90 5.19 67 XM_B_Investor 7033 2.38 4.76 1.39 68 T_XMDrugObfuBody_14 6734 2.69 4.55 1.91 69 XM_H_GMP 6434 5.16 4.35 5.50 70 XMSexyCombo_05 6142 2.30 4.15 1.52 71 XMStrtUSub 5752 8.28 3.89 10.10 72 TooManyTo_001 5266 6.71 3.56 8.02 73 XM_B_SpammyTLD 5215 2.69 3.53 2.34 74 XM_SPF_SoftFail 5157 1.92 3.49 1.27 75 XMNumbers 5115 3.11 3.46 2.97 76 MIME_HTML_ONLY_MULTI 5111 6.06 3.46 7.14 77 RCVD_IN_MSPIKE_WL 5100 4.27 3.45 4.60 78 RCVD_IN_MSPIKE_H3 5100 4.27 3.45 4.60 79 MIME_HTML_MOSTLY 5007 2.47 3.39 2.08 80 TR_XM_SpammyWords5 4998 1.74 3.38 1.06 81 T_XMDrugObfuBody_08 4966 2.31 3.36 1.87 82 XM_CamelCaseFrm001 4928 2.31 3.33 1.89 83 ANY_BOUNCE_MESSAGE 4752 4.07 3.21 4.42 84 BOUNCE_MESSAGE 4751 4.07 3.21 4.42 85 MIME_QP_LONG_LINE 4581 4.13 3.10 4.56 86 XM_UB50 4490 1.48 3.04 0.84 87 XM_B_URI_Unicode 4432 2.29 3.00 1.99 88 XM_B_Unsub2 4359 1.77 2.95 1.27 89 T_REMOTE_IMAGE 4265 3.08 2.88 3.16 90 XM_OfRef6 4171 1.41 2.82 0.83 91 KHOP_HELO_FCRDNS 4107 2.06 2.78 1.77 92 TM2_M_URI_OPT_OUT 4048 1.87 2.74 1.51 93 HTML_IMAGE_RATIO_08 4012 2.37 2.71 2.23 94 XMDiploma_00 3947 1.84 2.67 1.50 95 RELAYCOUNTRY_AU 3718 1.05 2.51 0.45 96 MAY_BE_FORGED 3710 1.78 2.51 1.48 97 RCVD_IN_VALIDITY_RPBL 3644 0.76 2.46 0.06 98 XM_B_SpammyWords4 3604 1.04 2.44 0.45 99 TR_XM_INV_DKIM 3601 0.83 2.44 0.17 100 T_TooManySym_01 3553 4.64 2.40 5.56 101 XM_URI_RBL 3552 0.92 2.40 0.31 102 TR_XM_NoHeaderRelay 3384 0.81 2.29 0.19 103 MAILING_LIST_MULTI 3375 2.93 2.28 3.19 104 XMPhish30 3105 1.03 2.10 0.59 105 T_XMDrugObfuBody_00 3023 1.10 2.04 0.70 106 SpammyFromTLD_02 3012 0.94 2.04 0.48 107 RCVD_IN_VALIDITY_SAFE 2926 2.84 1.98 3.20 108 XMStockSpam_06 2912 1.38 1.97 1.13 109 HTML_MIME_NO_HTML_TAG 2757 2.17 1.86 2.29 110 XMBody_17 2756 0.85 1.86 0.43 111 SpammyFromTLD_01 2739 1.08 1.85 0.76 112 BAYES_40 2724 4.37 1.84 5.42 113 MultiRelay_CC 2595 0.63 1.76 0.16 114 DIET_1 2578 0.72 1.74 0.30 115 ALL_TRUSTED 2515 10.47 1.70 14.11 116 T_FILL_THIS_FORM_SHORT 2509 1.01 1.70 0.73 117 T_XMHurry_00 2454 0.91 1.66 0.59 118 BOTNET_NORDNS 2379 0.48 1.61 0.02 119 RCVD_IN_VALIDITY_CERTIFIED 2378 2.32 1.61 2.62 120 XM_SendGrid 2335 1.31 1.58 1.20 121 FROM_EXCESS_BASE64 2274 1.67 1.54 1.72 122 RCVD_IN_ZEN_LASTEXTERNAL 2271 0.45 1.54 0.00 123 SHORTCIRCUIT 2271 0.45 1.54 0.00 124 USER_IN_DEF_DKIM_WL 2258 8.38 1.53 11.22 125 XM_DK_Undo_01 2203 1.57 1.49 1.60 126 HTTPS_HTTP_MISMATCH 2171 0.84 1.47 0.57 127 TR_Mismatch_TLD_02 2115 0.49 1.43 0.10 128 HTML_FONT_TINY_NORDNS 2112 0.47 1.43 0.08 129 XMGenDplmaNmb 2091 1.00 1.41 0.82 130 BAYES_20 2062 3.68 1.39 4.63 131 XM_B_Phish66 2041 0.62 1.38 0.31 132 SUBJ_ALL_CAPS 2029 1.24 1.37 1.19 133 TR_LOTS_OF_MONEY3 1924 0.52 1.30 0.19 134 XMBrknScrpt_02 1913 0.77 1.29 0.56 135 LongTLD 1910 0.65 1.29 0.39 136 XMBody_78 1900 0.68 1.29 0.42 137 URI_TRY_3LD 1863 0.76 1.26 0.56 138 HTML_IMAGE_ONLY_20 1839 0.69 1.24 0.46 139 RCVD_IN_PBL 1800 0.89 1.22 0.76 140 XM_B_DNDMA 1786 0.70 1.21 0.49 141 XM_B_COPY_HTML 1782 0.80 1.21 0.64 142 URI_NOVOWEL 1758 1.52 1.19 1.65 143 TM2_M_A_HREF_HREF 1731 0.52 1.17 0.25 144 XM_B_SEO 1730 0.48 1.17 0.19 145 XMSexyCombo_01 1722 0.44 1.16 0.14 146 URI_HEX 1711 1.13 1.16 1.13 147 SHOPIFY_IMG_NOT_RCVD_SFY 1639 0.47 1.11 0.20 148 XMEqualsVooDoo_00 1625 0.45 1.10 0.18 149 XMReplyNow 1621 0.49 1.10 0.24 150 XM_H_Long_From02 1618 0.84 1.09 0.74 151 HTML_TAG_BALANCE_BODY 1611 0.69 1.09 0.53 152 TR_XM_PHPDW 1610 0.58 1.09 0.37 153 TR_XM_PHPForged 1610 0.58 1.09 0.36 154 XMBdyGiftCard01 1606 0.73 1.09 0.58 155 TR_XM_FormFill2 1584 0.58 1.07 0.37 156 RCVD_IN_XBL 1574 0.34 1.06 0.04 157 XM_UB99 1564 0.31 1.06 0.01 158 DKIM_ADSP_CUSTOM_MED 1564 0.94 1.06 0.89 159 TR_XM_Spammywords 1554 0.49 1.05 0.26 160 XM_S_SpammyWords 1554 0.49 1.05 0.26 161 TM2_M_OBFU_COMMENT 1546 0.56 1.05 0.37 162 XM_H_PHPOS 1545 0.56 1.05 0.36 163 MPART_ALT_DIFF_COUNT 1543 0.73 1.04 0.60 164 RCVD_IN_IADB_LISTED 1530 2.45 1.03 3.03 165 TR_XM_SEO4 1516 0.38 1.03 0.11 166 RELAYCOUNTRY_GB 1511 0.61 1.02 0.45 167 TR_Symld_Words 1472 1.30 1.00 1.42 168 RCVD_IN_PSBL 1464 0.35 0.99 0.08 169 XM_B_COVIDMETA 1455 0.40 0.98 0.16 170 TR_XM_RelayPhish 1428 0.34 0.97 0.08 171 RCVD_IN_IADB_SPF 1407 2.16 0.95 2.66 172 XM_B_REG_HTML 1393 0.43 0.94 0.21 173 TR_XM_InvalidRelay 1390 0.28 0.94 0.01 174 XMSubMetaI_00 1383 0.61 0.94 0.48 175 RCVD_IN_IADB_DK 1363 1.91 0.92 2.33 176 RCVD_IN_IADB_SENDERID 1358 1.96 0.92 2.39 177 RCVD_IN_SBL_CSS 1303 0.29 0.88 0.04 178 XM_DIRTYINTL 1302 0.30 0.88 0.06 179 HK_RANDOM_REPLYTO 1293 0.32 0.87 0.09 180 XM_OfRef7 1285 0.40 0.87 0.21 181 XMSubMetaSxObfu_03 1281 0.50 0.87 0.35 182 XMHTML_After_End 1277 0.46 0.86 0.29 183 THIS_AD 1223 0.42 0.83 0.25 184 XM_HighProb1 1213 0.25 0.82 0.01 185 XMNoVowels 1207 0.77 0.82 0.76 186 XM_UB999 1207 0.24 0.82 0.00 187 RELAYCOUNTRY_FR 1200 0.40 0.81 0.23 188 NML_ADSP_CUSTOM_MED 1187 0.68 0.80 0.63 189 XM_PDF 1182 3.21 0.80 4.22 190 XMSlimDrugH 1182 0.48 0.80 0.35 191 XMPhish14 1180 0.56 0.80 0.46 192 RDNS_DYNAMIC 1169 0.37 0.79 0.20 193 FORGED_GMAIL_RCVD 1157 0.63 0.78 0.57 194 PDS_RDNS_DYNAMIC_FP 1148 0.30 0.78 0.10 195 TR_MetaPhish_Combo_01 1141 0.83 0.77 0.85 196 DKIM_ADSP_NXDOMAIN 1127 0.56 0.76 0.47 197 T_MONEY_PERCENT 1123 0.37 0.76 0.21 198 TR_LOTS_OF_MONEY2 1123 0.37 0.76 0.21 199 RCVD_IN_SORBS_DUL 1116 0.24 0.75 0.03 200 T_STY_INVIS_DIRECT 1114 0.53 0.75 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 314005 90.26 95.52 88.08 2 RELAYCOUNTRY_US 297463 83.60 83.97 83.44 3 XM_B_Unicode 260898 76.41 84.20 73.19 4 DKIM_SIGNED 237049 72.82 88.06 66.50 5 DCC_CHECK_NEGATIVE 234428 53.44 23.71 65.76 6 XM_DK_Pass 232363 70.63 83.75 65.18 7 DKIM_VALID 228692 69.65 82.92 64.15 8 BAYES_50 210424 54.21 42.60 59.03 9 DKIM_VALID_AU 183785 55.60 65.37 51.55 10 XM_B_Unicode3 155817 45.84 50.99 43.71 11 XM_B_SpammyWords 154068 50.95 69.60 43.22 12 XMListUnsubscribeExists 152378 49.97 67.38 42.74 13 DCC_CHECK 121889 46.08 74.73 34.19 14 RCVD_IN_MSPIKE_H2 110396 33.61 39.98 30.97 15 T_TM2_M_HEADER_IN_MSG 100324 26.72 23.28 28.14 16 DKIM_VALID_EF 91769 26.72 29.07 25.74 17 LOC_TINY_FONT_1 90700 32.36 49.02 25.44 18 HTML_FONT_LOW_CONTRAST 85990 27.92 37.08 24.12 19 XMSubLong 81657 24.06 26.84 22.91 20 FVGT_m_MULTI_ODD 81488 25.59 32.16 22.86 21 MIME_HTML_ONLY 78806 24.04 28.71 22.11 22 T_KAM_HTML_FONT_INVALID 69965 22.77 30.35 19.63 23 XM_B_SpammyWords2 56267 23.03 40.49 15.78 24 ALL_TRUSTED 50297 10.47 1.70 14.11 25 BAYES_00 49453 10.01 0.70 13.87 26 HTML_IMAGE_RATIO_04 48612 11.27 5.57 13.64 27 HTML_FONT_FACE_BAD 42962 8.72 0.68 12.05 28 XM_Multi_Part_URI 41686 14.08 19.84 11.69 29 XM_H_Trusted_IP 40442 8.02 0.00 11.34 30 USER_IN_DEF_DKIM_WL 39995 8.38 1.53 11.22 31 TR_XM_DK_Unsub 39663 13.97 20.82 11.13 32 XM_Evil_Numbers_Gen 36346 10.73 12.01 10.20 33 XMStrtUSub 36002 8.28 3.89 10.10 34 UNPARSEABLE_RELAY 35673 12.04 16.94 10.01 35 XM_B_PhoneNumber 33003 8.39 6.30 9.26 36 MPART_ALT_DIFF 31292 8.00 6.11 8.78 37 TooManyTo_001 28589 6.71 3.56 8.02 38 LotsOfNums_01 28104 8.24 9.08 7.88 39 XM_B_Unsub 27610 10.26 16.31 7.75 40 MIME_HTML_ONLY_MULTI 25441 6.06 3.46 7.14 41 TR_XM_DK_Bayes 23031 4.74 0.59 6.46 42 FSL_BULK_SIG 22968 7.46 9.92 6.44 43 TR_XM_DK_Bayes1 22555 4.64 0.58 6.33 44 BAYES_60 21005 6.54 8.09 5.89 45 IN_ZIMBRA_NJ_WHITELIST 20986 4.20 0.12 5.89 46 TR_XM_BayesUnsub 20824 8.76 15.80 5.84 47 XM_DKIMWhitelistDomains 19980 3.97 0.04 5.60 48 LOTS_OF_MONEY 19838 7.30 11.47 5.56 49 T_TooManySym_01 19830 4.64 2.40 5.56 50 XM_H_GMP 19610 5.16 4.35 5.50 51 BAYES_40 19329 4.37 1.84 5.42 52 TR_XM_DK_Bayes2 18986 3.88 0.39 5.33 53 XM_H_Long_From01 18487 5.10 4.90 5.19 54 HTML_IMAGE_RATIO_06 18217 5.24 5.54 5.11 55 XM_B_Phish_Phrases 17843 6.52 10.18 5.01 56 TR_MAX_INTL_RELAY 17112 7.79 15.01 4.80 57 BAYES_20 16491 3.68 1.39 4.63 58 RCVD_IN_MSPIKE_H3 16415 4.27 3.45 4.60 59 RCVD_IN_MSPIKE_WL 16415 4.27 3.45 4.60 60 MIME_QP_LONG_LINE 16263 4.13 3.10 4.56 61 BOUNCE_MESSAGE 15758 4.07 3.21 4.42 62 ANY_BOUNCE_MESSAGE 15758 4.07 3.21 4.42 63 HTML_IMAGE_RATIO_02 15598 4.90 6.17 4.38 64 XMSubNoVowel 15319 3.17 0.46 4.30 65 XM_PDF 15029 3.21 0.80 4.22 66 XM_B_SpammyWords3 14302 7.30 15.23 4.01 67 XM_DK_Undo_02 14119 14.03 38.30 3.96 68 XM_UncommonTLD01 14059 4.65 6.36 3.94 69 TR_XM_SpammyWords4 13135 5.57 10.13 3.68 70 BAYES_05 12561 2.67 0.62 3.52 71 RCVD_IN_VALIDITY_SAFE 11400 2.84 1.98 3.20 72 MAILING_LIST_MULTI 11380 2.93 2.28 3.19 73 RELAYCOUNTRY_META 11271 6.75 15.40 3.16 74 T_REMOTE_IMAGE 11249 3.08 2.88 3.16 75 RCVD_IN_IADB_LISTED 10813 2.45 1.03 3.03 76 BAYES_80 10615 4.82 9.26 2.98 77 XMNumbers 10592 3.11 3.46 2.97 78 T_TooManySym_02 10458 2.25 0.60 2.93 79 XMSubMetaSx_00 10130 3.97 6.69 2.84 80 BAYES_99 10112 10.46 28.83 2.84 81 TooManyTo_002 9898 2.14 0.60 2.78 82 RCVD_IN_IADB_SPF 9495 2.16 0.95 2.66 83 BOTNET_IPINHOSTNAME 9395 5.00 10.72 2.64 84 RCVD_IN_VALIDITY_CERTIFIED 9329 2.32 1.61 2.62 85 TM2_M_VERY_LONG_WORD 9202 3.53 5.83 2.58 86 XM_Body_Dirty_Words 9120 3.81 6.81 2.56 87 RCVD_IN_IADB_SENDERID 8515 1.96 0.92 2.39 88 DKIM_INVALID 8357 3.16 5.14 2.34 89 XM_B_SpammyTLD 8349 2.69 3.53 2.34 90 RCVD_IN_IADB_DK 8294 1.91 0.92 2.33 91 HTML_MIME_NO_HTML_TAG 8180 2.17 1.86 2.29 92 HTML_IMAGE_RATIO_08 7935 2.37 2.71 2.23 93 XMSubLongNoVowel 7692 1.57 0.14 2.16 94 BAYES_999 7565 7.90 21.84 2.12 95 XMSubGarbage 7494 1.50 0.04 2.10 96 MIME_HTML_MOSTLY 7432 2.47 3.39 2.08 97 INVALID_MSGID 7321 1.53 0.28 2.05 98 XM_B_URI_Unicode 7108 2.29 3.00 1.99 99 RCVD_IN_IADB_VOUCHED 7079 1.51 0.38 1.99 100 T_XMDrugObfuBody_14 6825 2.69 4.55 1.91 101 XM_CamelCaseFrm001 6731 2.31 3.33 1.89 102 T_XMDrugObfuBody_08 6680 2.31 3.36 1.87 103 BAYES_95 6484 2.79 5.12 1.82 104 KHOP_HELO_FCRDNS 6298 2.06 2.78 1.77 105 TO_MALFORMED 6281 1.25 0.03 1.76 106 FROM_EXCESS_BASE64 6141 1.67 1.54 1.72 107 TR_XM_DKIM_Undo 6098 9.28 27.54 1.71 108 URI_NOVOWEL 5894 1.52 1.19 1.65 109 TR_XM_PhishingBody 5710 2.68 5.27 1.60 110 XM_DK_Undo_01 5699 1.57 1.49 1.60 111 TooManyTo_003 5487 1.23 0.50 1.54 112 XMSexyCombo_05 5435 2.30 4.15 1.52 113 TR_XM_SpammyRelay 5430 4.22 10.71 1.52 114 TM2_M_URI_OPT_OUT 5370 1.87 2.74 1.51 115 XMDiploma_00 5335 1.84 2.67 1.50 116 MAY_BE_FORGED 5282 1.78 2.51 1.48 117 TR_Symld_Words 5066 1.30 1.00 1.42 118 XM_B_Investor 4969 2.38 4.76 1.39 119 RCVD_IN_IADB_OPTIN 4870 1.03 0.23 1.37 120 IN_HORDE_ADDRESS_BOOK 4682 0.95 0.09 1.31 121 XM_B_Unsub2 4544 1.77 2.95 1.27 122 XM_SPF_SoftFail 4536 1.92 3.49 1.27 123 UNTRUSTED_Relay 4469 2.59 5.81 1.25 124 BOTNET 4468 3.93 10.39 1.25 125 XMGappySubj_01 4397 0.91 0.12 1.23 126 XM_SendGrid 4284 1.31 1.58 1.20 127 XM_GoogleGroups 4271 1.05 0.70 1.20 128 TR_XM_UnparsRelay 4255 3.37 8.61 1.19 129 T_TooManySym_03 4245 0.90 0.21 1.19 130 SUBJ_ALL_CAPS 4241 1.24 1.37 1.19 131 HELO_NODOT 4237 0.93 0.32 1.19 132 HELO_NO_DOMAIN 4234 0.93 0.32 1.19 133 XMStockSpam_06 4043 1.38 1.97 1.13 134 TooManyTo_004 4032 0.92 0.42 1.13 135 XMCapTrack 4028 0.96 0.54 1.13 136 URI_HEX 4012 1.13 1.16 1.13 137 TR_XM_SpammyWords5 3794 1.74 3.38 1.06 138 XMLngstWrd_00 3641 0.91 0.63 1.02 139 TVD_SPACE_RATIO 3569 0.77 0.23 1.00 140 XM_E_Blogspot 3402 0.69 0.05 0.95 141 MIME_CHARSET_FARAWAY 3371 0.79 0.40 0.95 142 TooManyTo_005 3351 0.77 0.37 0.94 143 TR_DCC_Bayes_99 3324 6.74 20.74 0.93 144 DKIM_ADSP_CUSTOM_MED 3184 0.94 1.06 0.89 145 RELAYCOUNTRY_CA 3054 2.22 5.51 0.86 146 TR_MetaPhish_Combo_01 3029 0.83 0.77 0.85 147 XM_UB50 2992 1.48 3.04 0.84 148 FROM_GOV_DKIM_AU 2950 0.70 0.40 0.83 149 XM_OfRef6 2946 1.41 2.82 0.83 150 XMGenDplmaNmb 2931 1.00 1.41 0.82 151 CHARSET_FARAWAY_HEADER 2889 0.62 0.18 0.81 152 TR_XM_DK_SendGrid 2775 0.77 0.75 0.78 153 TR_XM_Base64_M1 2724 0.72 0.62 0.76 154 XMNoVowels 2700 0.77 0.82 0.76 155 SpammyFromTLD_01 2698 1.08 1.85 0.76 156 RCVD_IN_PBL 2695 0.89 1.22 0.76 157 XM_ShortIntro_01 2677 0.65 0.41 0.75 158 XM_H_Long_From02 2625 0.84 1.09 0.74 159 T_FILL_THIS_FORM_SHORT 2601 1.01 1.70 0.73 160 XM_RXBody 2535 0.72 0.74 0.71 161 T_XMDrugObfuBody_00 2502 1.10 2.04 0.70 162 XM_H_PHPMailer 2468 0.71 0.74 0.69 163 TVD_RCVD_IP 2424 0.67 0.64 0.68 164 XMGappySubj_02 2322 0.47 0.05 0.65 165 XM_B_COPY_HTML 2268 0.80 1.21 0.64 166 NML_ADSP_CUSTOM_MED 2260 0.68 0.80 0.63 167 MPART_ALT_DIFF_COUNT 2133 0.73 1.04 0.60 168 T_XMHurry_00 2114 0.91 1.66 0.59 169 XMPhish30 2096 1.03 2.10 0.59 170 XMBdyGiftCard01 2058 0.73 1.09 0.58 171 HTTPS_HTTP_MISMATCH 2044 0.84 1.47 0.57 172 FORGED_GMAIL_RCVD 2020 0.63 0.78 0.57 173 XMBrknScrpt_02 1988 0.77 1.29 0.56 174 URI_TRY_3LD 1981 0.76 1.26 0.56 175 XM_B_FormFill 1961 0.39 0.01 0.55 176 TO_NO_BRKTS_HTML_ONLY 1900 0.49 0.38 0.53 177 HTML_TAG_BALANCE_BODY 1894 0.69 1.09 0.53 178 T_OBFU_PDF_ATTACH 1886 0.40 0.10 0.53 179 T_Symld_Words_02 1845 0.55 0.65 0.52 180 XMBody_95 1760 0.41 0.20 0.49 181 MISSING_HEADERS 1756 0.53 0.62 0.49 182 XM_B_DNDMA 1739 0.70 1.21 0.49 183 T_MANY_PILL_PRICE 1736 0.35 0.01 0.49 184 XMSubMetaI_00 1706 0.61 0.94 0.48 185 SpammyFromTLD_02 1704 0.94 2.04 0.48 186 RCVD_IN_BL_SPAMCOP_NET 1687 2.88 8.67 0.47 187 DKIM_ADSP_NXDOMAIN 1673 0.56 0.76 0.47 188 HTML_IMAGE_ONLY_20 1656 0.69 1.24 0.46 189 XMPhish14 1651 0.56 0.80 0.46 190 PLING_QUERY 1630 0.51 0.64 0.46 191 XM_B_SpammyWords4 1622 1.04 2.44 0.45 192 XMDateMe_00 1609 0.40 0.28 0.45 193 RELAYCOUNTRY_AU 1594 1.05 2.51 0.45 194 RELAYCOUNTRY_GB 1590 0.61 1.02 0.45 195 T_STY_INVIS_DIRECT 1547 0.53 0.75 0.43 196 XMBody_17 1522 0.85 1.86 0.43 197 XMBody_78 1513 0.68 1.29 0.42 198 XMMoneyMeta_00 1465 0.49 0.69 0.41 199 XMLngstWrd_01 1433 0.45 0.55 0.40 200 LongTLD 1383 0.65 1.29 0.39 ----------------------------------------------------------------------