Email: 533756 Autolearn: 0 AvgScore: 2.32 AvgScanTime: 1.44 sec Spam: 155774 Autolearn: 0 AvgScore: 15.04 AvgScanTime: 1.63 sec Ham: 377982 Autolearn: 0 AvgScore: -2.93 AvgScanTime: 1.36 sec Time Spent Running SA: 213.55 hours Time Spent Processing Spam: 70.59 hours Time Spent Processing Ham: 142.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142605 90.00 91.55 89.36 2 DKIM_SIGNED 133439 69.91 85.66 63.42 3 RELAYCOUNTRY_US 128897 83.54 82.75 83.87 4 XM_B_Unicode 125110 76.53 80.32 74.97 5 XM_DK_Pass 123820 67.27 79.49 62.24 6 DKIM_VALID 122437 66.28 78.60 61.21 7 DCC_CHECK 112433 44.66 72.18 33.32 8 XM_B_SpammyWords 106072 51.64 68.09 44.86 9 XMListUnsubscribeExists 101669 47.68 65.27 40.43 10 DKIM_VALID_AU 96982 52.86 62.26 48.99 11 XM_B_Unicode3 73470 45.43 47.16 44.71 12 BAYES_50 68533 52.25 44.00 55.65 13 LOC_TINY_FONT_1 67739 28.60 43.49 22.46 14 XM_B_SpammyWords2 60124 22.50 38.60 15.86 15 RCVD_IN_MSPIKE_H2 59043 32.04 37.90 29.62 16 XM_DK_Undo_02 57158 13.53 36.69 3.98 17 HTML_FONT_LOW_CONTRAST 54435 27.14 34.94 23.92 18 FVGT_m_MULTI_ODD 49006 24.49 31.46 21.62 19 T_KAM_HTML_FONT_INVALID 47027 21.65 30.19 18.13 20 MIME_HTML_ONLY 43342 25.42 27.82 24.44 21 DKIM_VALID_EF 43234 25.48 27.75 24.54 22 BAYES_99 42935 9.87 27.56 2.58 23 XMSubLong 41555 23.05 26.68 21.56 24 TR_XM_DKIM_Undo 41062 8.85 26.36 1.64 25 DCC_CHECK_NEGATIVE 40727 54.82 26.14 66.63 26 T_TM2_M_HEADER_IN_MSG 35397 23.93 22.72 24.42 27 BAYES_999 32302 7.44 20.74 1.96 28 TR_XM_DK_Unsub 31282 13.14 20.08 10.28 29 XM_Multi_Part_URI 30667 13.75 19.69 11.30 30 TR_DCC_Bayes_99 29817 6.18 19.14 0.83 31 XM_B_Unsub 27045 10.48 17.36 7.65 32 TR_XM_BayesUnsub 26151 9.03 16.79 5.84 33 RELAYCOUNTRY_META 25820 6.98 16.58 3.03 34 UNPARSEABLE_RELAY 25694 11.70 16.49 9.73 35 LOTS_OF_MONEY 25090 8.61 16.11 5.53 36 BOTNET 23207 5.37 14.90 1.44 37 TR_MAX_INTL_RELAY 22883 7.60 14.69 4.67 38 BOTNET_IPINHOSTNAME 22523 6.34 14.46 3.00 39 XM_B_SpammyWords3 20588 6.51 13.22 3.75 40 TR_XM_SpammyWords4 20573 6.55 13.21 3.80 41 TR_XM_SpammyRelay 18908 4.59 12.14 1.47 42 TR_XM_SpammyWords2 16126 3.19 10.35 0.24 43 FSL_BULK_SIG 15999 7.73 10.27 6.69 44 RCVD_IN_BL_SPAMCOP_NET 14730 3.10 9.46 0.49 45 BAYES_80 13936 4.64 8.95 2.86 46 XM_Evil_Numbers_Gen 13747 8.74 8.82 8.70 47 TR_XM_UnparsRelay 13602 3.39 8.73 1.19 48 LotsOfNums_01 13181 7.20 8.46 6.68 49 BAYES_60 12961 6.46 8.32 5.69 50 XM_B_Phish_Phrases 12533 5.43 8.05 4.35 51 MPART_ALT_DIFF 11150 10.58 7.16 11.99 52 DKIM_INVALID 11002 3.62 7.06 2.21 53 UNTRUSTED_Relay 10328 2.86 6.63 1.30 54 XMSubMetaSx_00 10272 3.89 6.59 2.78 55 XM_Body_Dirty_Words 10129 3.60 6.50 2.40 56 TR_XM_SPAMCOP 10028 2.07 6.44 0.27 57 XM_B_PhoneNumber 9398 7.88 6.03 8.64 58 XM_UncommonTLD01 9396 4.21 6.03 3.45 59 XMBody_17 8570 1.90 5.50 0.41 60 RELAYCOUNTRY_CA 8437 2.15 5.42 0.81 61 BAYES_95 8325 2.84 5.34 1.81 62 HTML_IMAGE_RATIO_02 8247 4.06 5.29 3.55 63 KHOP_HELO_FCRDNS 7981 2.39 5.12 1.27 64 XM_H_Long_From01 7689 4.94 4.94 4.94 65 HTML_IMAGE_RATIO_04 7481 14.80 4.80 18.92 66 TR_XM_PhishingBody 7218 2.56 4.63 1.70 67 XM_H_GMP 6989 4.90 4.49 5.08 68 XM_B_Investor 6932 2.26 4.45 1.36 69 XMStrtUSub 6601 11.20 4.24 14.07 70 RDNS_DYNAMIC 6518 1.40 4.18 0.26 71 BOUNCE_MESSAGE 6496 3.78 4.17 3.62 72 ANY_BOUNCE_MESSAGE 6496 3.78 4.17 3.62 73 PDS_RDNS_DYNAMIC_FP 6485 1.33 4.16 0.16 74 XMSexyCombo_05 6382 2.10 4.10 1.28 75 XM_B_SpammyTLD 5956 2.83 3.82 2.42 76 XM_OfRef6 5882 1.78 3.78 0.96 77 HTML_IMAGE_RATIO_06 5697 4.47 3.66 4.80 78 LOADSA_MONEY_COMBO 5632 1.09 3.62 0.05 79 T_XMDrugObfuBody_14 5623 2.13 3.61 1.52 80 TooManyTo_001 5481 6.51 3.52 7.74 81 XM_UB50 5362 1.59 3.44 0.83 82 XFER_LOTSA_MONEY 5308 1.01 3.41 0.02 83 MIME_HTML_MOSTLY 5302 2.53 3.40 2.17 84 XM_UCStrings02 5281 1.01 3.39 0.03 85 XMNumbers 5270 2.74 3.38 2.48 86 RCVD_IN_MSPIKE_H3 5262 4.25 3.38 4.61 87 RCVD_IN_MSPIKE_WL 5262 4.25 3.38 4.61 88 ADVANCE_FEE_2_NEW_MONEY 5232 0.98 3.36 0.01 89 MILLION_HUNDRED 5222 0.98 3.35 0.00 90 NA_DOLLARS 5199 0.97 3.34 0.00 91 T_TVD_MIME_NO_HEADERS 5197 1.21 3.34 0.33 92 MIME_QP_LONG_LINE 5087 4.04 3.27 4.35 93 TR_XM_SpammyWords5 5063 1.76 3.25 1.14 94 XM_CamelCaseFrm001 4939 2.26 3.17 1.88 95 TM2_M_VERY_LONG_WORD 4906 1.77 3.15 1.20 96 MIME_HTML_ONLY_MULTI 4893 8.15 3.14 10.22 97 XM_B_URI_Unicode 4862 2.18 3.12 1.80 98 XMDiploma_00 4850 1.92 3.11 1.42 99 XM_B_Unsub2 4710 1.94 3.02 1.49 100 XM_SPF_SoftFail 4395 1.66 2.82 1.19 101 T_XMDrugObfuBody_08 4221 1.66 2.71 1.23 102 DIET_1 4213 0.97 2.70 0.26 103 TR_XM_NoHeaderRelay 4160 0.90 2.67 0.18 104 XM_URI_RBL 4146 0.99 2.66 0.31 105 DKIM_ADSP_NXDOMAIN 4136 0.97 2.66 0.28 106 XM_B_SpammyWords4 4075 1.40 2.62 0.90 107 TR_XM_INV_DKIM 4009 0.86 2.57 0.15 108 HTML_IMAGE_RATIO_08 3831 2.25 2.46 2.16 109 ALL_TRUSTED 3666 10.38 2.35 13.69 110 RCVD_IN_VALIDITY_RPBL 3632 0.73 2.33 0.06 111 MAILING_LIST_MULTI 3587 2.46 2.30 2.53 112 RELAYCOUNTRY_AU 3559 0.96 2.28 0.42 113 T_TooManySym_01 3429 4.16 2.20 4.97 114 SpammyFromTLD_02 3381 0.95 2.17 0.45 115 SpammyFromTLD_01 3348 1.11 2.15 0.69 116 TM2_M_URI_OPT_OUT 3220 1.63 2.07 1.45 117 RCVD_IN_VALIDITY_SAFE 3169 3.08 2.03 3.51 118 T_XMDrugObfuBody_00 3168 0.95 2.03 0.51 119 T_FILL_THIS_FORM_SHORT 3086 1.29 1.98 1.01 120 T_XMHurry_00 2912 1.16 1.87 0.87 121 T_REMOTE_IMAGE 2809 2.75 1.80 3.15 122 HTML_MIME_NO_HTML_TAG 2806 2.07 1.80 2.18 123 TR_LOTS_OF_MONEY3 2668 0.72 1.71 0.31 124 XMGenDplmaNmb 2599 1.03 1.67 0.77 125 SHORTCIRCUIT 2598 0.49 1.67 0.00 126 RCVD_IN_ZEN_LASTEXTERNAL 2598 0.49 1.67 0.00 127 BAYES_40 2590 4.68 1.66 5.93 128 USER_IN_DEF_DKIM_WL 2579 8.50 1.66 11.32 129 FROM_EXCESS_BASE64 2574 1.58 1.65 1.55 130 RCVD_IN_VALIDITY_CERTIFIED 2537 2.57 1.63 2.96 131 XMStockSpam_06 2511 1.20 1.61 1.03 132 HTML_FONT_TINY_NORDNS 2448 0.52 1.57 0.09 133 SUBJ_ALL_CAPS 2423 1.43 1.56 1.37 134 URI_TRY_3LD 2403 0.78 1.54 0.46 135 XM_DK_Undo_01 2369 1.63 1.52 1.67 136 URI_HEX 2230 1.26 1.43 1.18 137 XM_B_COVIDMETA 2230 0.51 1.43 0.13 138 URI_NOVOWEL 2229 1.40 1.43 1.39 139 XMPhish30 2171 0.77 1.39 0.52 140 XM_B_COPY_HTML 2152 0.90 1.38 0.70 141 TR_XM_PHPDW 2150 0.67 1.38 0.38 142 RCVD_IN_PSBL 2122 0.48 1.36 0.12 143 TR_XM_PHPForged 2121 0.67 1.36 0.38 144 TR_XM_FormFill2 2108 0.67 1.35 0.38 145 NO_DNS_FOR_FROM 2081 0.56 1.34 0.24 146 XM_H_PHPOS 2065 0.65 1.33 0.37 147 TR_XM_MaxWHORU 2030 0.51 1.30 0.18 148 XM_B_Phish66 2019 0.62 1.30 0.33 149 XM_OfRef7 2019 0.49 1.30 0.16 150 BAYES_20 1990 4.40 1.28 5.69 151 HTML_IMAGE_ONLY_20 1981 0.77 1.27 0.56 152 HTTPS_HTTP_MISMATCH 1889 0.76 1.21 0.58 153 XM_SendGrid 1826 1.09 1.17 1.06 154 MPART_ALT_DIFF_COUNT 1793 0.70 1.15 0.52 155 XM_H_Long_From02 1779 0.89 1.14 0.79 156 XMBrknScrpt_02 1777 0.84 1.14 0.72 157 RELAYCOUNTRY_TH 1766 0.33 1.13 0.00 158 SHOPIFY_IMG_NOT_RCVD_SFY 1719 0.46 1.10 0.20 159 BOTNET_NORDNS 1695 0.34 1.09 0.04 160 XM_UB99 1695 0.32 1.09 0.00 161 DKIM_ADSP_CUSTOM_MED 1659 0.86 1.07 0.77 162 XM_H_DKIM_GOOG 1636 0.32 1.05 0.01 163 LongTLD 1633 0.52 1.05 0.31 164 XM_B_Crypto 1630 0.37 1.05 0.10 165 NORDNS_LOW_CONTRAST 1603 0.34 1.03 0.06 166 XMBdyGiftCard01 1599 0.70 1.03 0.56 167 TR_MetaPhish_Combo_01 1599 0.76 1.03 0.64 168 XM_B_SEO 1582 0.45 1.02 0.22 169 RELAYCOUNTRY_FR 1565 0.46 1.00 0.24 170 XMHTML_After_End 1562 0.48 1.00 0.27 171 TR_Symld_Words 1559 1.25 1.00 1.35 172 TR_XM_RelayPhish 1544 0.35 0.99 0.08 173 RCVD_IN_PBL 1526 0.73 0.98 0.63 174 HTML_TAG_BALANCE_BODY 1483 0.66 0.95 0.54 175 XMPhish14 1457 0.69 0.94 0.60 176 XMMoneyMeta_00 1434 0.58 0.92 0.44 177 THIS_AD 1427 0.45 0.92 0.25 178 MultiRelay_CC 1419 0.35 0.91 0.12 179 XM_HighProb1 1401 0.27 0.90 0.01 180 XM_DIRTYINTL 1400 0.30 0.90 0.05 181 TM2_M_OBFU_COMMENT 1400 0.50 0.90 0.34 182 TR_XM_SEO4 1391 0.34 0.89 0.11 183 NML_ADSP_CUSTOM_MED 1389 0.66 0.89 0.57 184 XMSexyCombo_01 1373 0.35 0.88 0.13 185 RCVD_IN_SORBS_DUL 1363 0.28 0.87 0.04 186 RELAYCOUNTRY_GB 1336 0.55 0.86 0.43 187 XMBody_78 1325 0.49 0.85 0.34 188 XMSubMetaI_00 1288 0.43 0.83 0.27 189 RCVD_IN_IADB_LISTED 1278 2.30 0.82 2.91 190 HTML_FONT_FACE_BAD 1264 12.53 0.81 17.35 191 FORGED_GMAIL_RCVD 1260 0.58 0.81 0.48 192 XM_UB60 1254 0.30 0.81 0.08 193 TR_LOTS_OF_MONEY2 1248 0.34 0.80 0.15 194 T_MONEY_PERCENT 1248 0.34 0.80 0.15 195 XMLngstWrd_00 1243 0.75 0.80 0.73 196 XM_RXBody 1237 0.34 0.79 0.15 197 TR_XM_InvalidRelay 1237 0.24 0.79 0.01 198 URIBL_BLACK 1236 0.26 0.79 0.04 199 XM_H_PHPMailer 1233 0.68 0.79 0.63 200 XM_PDF 1223 3.01 0.79 3.93 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 337759 90.00 91.55 89.36 2 RELAYCOUNTRY_US 317006 83.54 82.75 83.87 3 XM_B_Unicode 283355 76.53 80.32 74.97 4 DCC_CHECK_NEGATIVE 251855 54.82 26.14 66.63 5 DKIM_SIGNED 239700 69.91 85.66 63.42 6 XM_DK_Pass 235248 67.27 79.49 62.24 7 DKIM_VALID 231359 66.28 78.60 61.21 8 BAYES_50 210343 52.25 44.00 55.65 9 DKIM_VALID_AU 185178 52.86 62.26 48.99 10 XM_B_SpammyWords 169562 51.64 68.09 44.86 11 XM_B_Unicode3 168996 45.43 47.16 44.71 12 XMListUnsubscribeExists 152828 47.68 65.27 40.43 13 DCC_CHECK 125937 44.66 72.18 33.32 14 RCVD_IN_MSPIKE_H2 111951 32.04 37.90 29.62 15 DKIM_VALID_EF 92773 25.48 27.75 24.54 16 MIME_HTML_ONLY 92362 25.42 27.82 24.44 17 T_TM2_M_HEADER_IN_MSG 92313 23.93 22.72 24.42 18 HTML_FONT_LOW_CONTRAST 90415 27.14 34.94 23.92 19 LOC_TINY_FONT_1 84896 28.60 43.49 22.46 20 FVGT_m_MULTI_ODD 81722 24.49 31.46 21.62 21 XMSubLong 81488 23.05 26.68 21.56 22 HTML_IMAGE_RATIO_04 71515 14.80 4.80 18.92 23 T_KAM_HTML_FONT_INVALID 68540 21.65 30.19 18.13 24 HTML_FONT_FACE_BAD 65589 12.53 0.81 17.35 25 XM_H_Trusted_IP 62563 11.72 0.00 16.55 26 XM_B_SpammyWords2 59945 22.50 38.60 15.86 27 BAYES_00 56941 10.86 0.64 15.06 28 XMStrtUSub 53171 11.20 4.24 14.07 29 ALL_TRUSTED 51749 10.38 2.35 13.69 30 MPART_ALT_DIFF 45319 10.58 7.16 11.99 31 USER_IN_DEF_DKIM_WL 42801 8.50 1.66 11.32 32 XM_Multi_Part_URI 42717 13.75 19.69 11.30 33 TR_XM_DK_Unsub 38854 13.14 20.08 10.28 34 MIME_HTML_ONLY_MULTI 38629 8.15 3.14 10.22 35 UNPARSEABLE_RELAY 36764 11.70 16.49 9.73 36 XM_Evil_Numbers_Gen 32895 8.74 8.82 8.70 37 XM_B_PhoneNumber 32666 7.88 6.03 8.64 38 TooManyTo_001 29244 6.51 3.52 7.74 39 XM_B_Unsub 28903 10.48 17.36 7.65 40 FSL_BULK_SIG 25281 7.73 10.27 6.69 41 LotsOfNums_01 25261 7.20 8.46 6.68 42 TR_XM_DK_Bayes 23681 4.57 0.47 6.27 43 TR_XM_DK_Bayes1 23215 4.48 0.46 6.14 44 BAYES_40 22399 4.68 1.66 5.93 45 TR_XM_BayesUnsub 22072 9.03 16.79 5.84 46 IN_ZIMBRA_NJ_WHITELIST 21901 4.14 0.12 5.79 47 BAYES_60 21526 6.46 8.32 5.69 48 BAYES_20 21496 4.40 1.28 5.69 49 XM_DKIMWhitelistDomains 21228 3.98 0.03 5.62 50 LOTS_OF_MONEY 20885 8.61 16.11 5.53 51 TR_XM_DK_Bayes2 20019 3.86 0.37 5.30 52 XM_H_GMP 19190 4.90 4.49 5.08 53 T_TooManySym_01 18772 4.16 2.20 4.97 54 XM_H_Long_From01 18690 4.94 4.94 4.94 55 XMSubNoVowel 18343 3.56 0.42 4.85 56 HTML_IMAGE_RATIO_06 18153 4.47 3.66 4.80 57 BAYES_05 17854 3.51 0.58 4.72 58 TR_MAX_INTL_RELAY 17667 7.60 14.69 4.67 59 RCVD_IN_MSPIKE_WL 17409 4.25 3.38 4.61 60 RCVD_IN_MSPIKE_H3 17409 4.25 3.38 4.61 61 MIME_QP_LONG_LINE 16451 4.04 3.27 4.35 62 XM_B_Phish_Phrases 16449 5.43 8.05 4.35 63 XM_DK_Undo_02 15056 13.53 36.69 3.98 64 XM_PDF 14843 3.01 0.79 3.93 65 TR_XM_SpammyWords4 14382 6.55 13.21 3.80 66 XM_B_SpammyWords3 14168 6.51 13.22 3.75 67 BOUNCE_MESSAGE 13667 3.78 4.17 3.62 68 ANY_BOUNCE_MESSAGE 13667 3.78 4.17 3.62 69 HTML_IMAGE_RATIO_02 13436 4.06 5.29 3.55 70 RCVD_IN_VALIDITY_SAFE 13277 3.08 2.03 3.51 71 XM_UncommonTLD01 13053 4.21 6.03 3.45 72 T_REMOTE_IMAGE 11895 2.75 1.80 3.15 73 RELAYCOUNTRY_META 11446 6.98 16.58 3.03 74 BOTNET_IPINHOSTNAME 11338 6.34 14.46 3.00 75 RCVD_IN_VALIDITY_CERTIFIED 11188 2.57 1.63 2.96 76 RCVD_IN_IADB_LISTED 10994 2.30 0.82 2.91 77 BAYES_80 10811 4.64 8.95 2.86 78 XMSubMetaSx_00 10504 3.89 6.59 2.78 79 BAYES_99 9758 9.87 27.56 2.58 80 RCVD_IN_IADB_SPF 9703 2.04 0.77 2.57 81 T_TooManySym_02 9703 1.99 0.58 2.57 82 MAILING_LIST_MULTI 9554 2.46 2.30 2.53 83 XMNumbers 9356 2.74 3.38 2.48 84 TooManyTo_002 9208 1.94 0.74 2.44 85 XM_B_SpammyTLD 9130 2.83 3.82 2.42 86 XM_Body_Dirty_Words 9083 3.60 6.50 2.40 87 RCVD_IN_IADB_SENDERID 8695 1.85 0.75 2.30 88 RCVD_IN_IADB_DK 8538 1.82 0.75 2.26 89 DKIM_INVALID 8341 3.62 7.06 2.21 90 HTML_MIME_NO_HTML_TAG 8250 2.07 1.80 2.18 91 MIME_HTML_MOSTLY 8198 2.53 3.40 2.17 92 HTML_IMAGE_RATIO_08 8183 2.25 2.46 2.16 93 BAYES_999 7419 7.44 20.74 1.96 94 XM_CamelCaseFrm001 7120 2.26 3.17 1.88 95 RCVD_IN_IADB_VOUCHED 7110 1.42 0.29 1.88 96 INVALID_MSGID 7062 1.42 0.32 1.87 97 XMSubLongNoVowel 7004 1.35 0.13 1.85 98 BAYES_95 6849 2.84 5.34 1.81 99 XMSubGarbage 6794 1.28 0.04 1.80 100 XM_B_URI_Unicode 6789 2.18 3.12 1.80 101 TR_XM_PhishingBody 6444 2.56 4.63 1.70 102 XM_DK_Undo_01 6311 1.63 1.52 1.67 103 TO_MALFORMED 6295 1.19 0.04 1.67 104 TR_XM_DKIM_Undo 6189 8.85 26.36 1.64 105 FROM_EXCESS_BASE64 5869 1.58 1.65 1.55 106 XM_E_Blogspot 5840 1.13 0.11 1.55 107 T_XMDrugObfuBody_14 5737 2.13 3.61 1.52 108 TooManyTo_003 5701 1.26 0.66 1.51 109 XM_B_Unsub2 5625 1.94 3.02 1.49 110 TR_XM_SpammyRelay 5565 4.59 12.14 1.47 111 TM2_M_URI_OPT_OUT 5490 1.63 2.07 1.45 112 BOTNET 5444 5.37 14.90 1.44 113 XMDiploma_00 5385 1.92 3.11 1.42 114 URI_NOVOWEL 5244 1.40 1.43 1.39 115 SUBJ_ALL_CAPS 5189 1.43 1.56 1.37 116 XM_B_Investor 5134 2.26 4.45 1.36 117 TR_Symld_Words 5110 1.25 1.00 1.35 118 UNTRUSTED_Relay 4914 2.86 6.63 1.30 119 RCVD_IN_IADB_OPTIN 4840 0.96 0.18 1.28 120 XMSexyCombo_05 4820 2.10 4.10 1.28 121 KHOP_HELO_FCRDNS 4789 2.39 5.12 1.27 122 T_XMDrugObfuBody_08 4644 1.66 2.71 1.23 123 TM2_M_VERY_LONG_WORD 4536 1.77 3.15 1.20 124 XM_SPF_SoftFail 4485 1.66 2.82 1.19 125 TR_XM_UnparsRelay 4482 3.39 8.73 1.19 126 URI_HEX 4475 1.26 1.43 1.18 127 IN_HORDE_ADDRESS_BOOK 4381 0.85 0.10 1.16 128 XM_GoogleGroups 4356 1.00 0.64 1.15 129 TR_XM_SpammyWords5 4327 1.76 3.25 1.14 130 HELO_NODOT 4264 0.89 0.32 1.13 131 HELO_NO_DOMAIN 4251 0.89 0.31 1.12 132 XMCapTrack 4193 0.91 0.43 1.11 133 TooManyTo_004 4093 0.93 0.56 1.08 134 T_TooManySym_03 4051 0.81 0.16 1.07 135 XM_SendGrid 3991 1.09 1.17 1.06 136 XMGappySubj_01 3920 0.76 0.09 1.04 137 XMStockSpam_06 3886 1.20 1.61 1.03 138 T_FILL_THIS_FORM_SHORT 3816 1.29 1.98 1.01 139 XM_OfRef6 3621 1.78 3.78 0.96 140 FROM_GOV_DKIM_AU 3553 0.78 0.39 0.94 141 TVD_SPACE_RATIO 3437 0.74 0.31 0.91 142 XM_B_SpammyWords4 3383 1.40 2.62 0.90 143 TooManyTo_005 3363 0.78 0.51 0.89 144 T_XMHurry_00 3282 1.16 1.87 0.87 145 TR_DCC_Bayes_99 3148 6.18 19.14 0.83 146 XM_UB50 3125 1.59 3.44 0.83 147 RELAYCOUNTRY_CA 3060 2.15 5.42 0.81 148 XM_H_Long_From02 2990 0.89 1.14 0.79 149 DKIM_ADSP_CUSTOM_MED 2914 0.86 1.07 0.77 150 XMGenDplmaNmb 2895 1.03 1.67 0.77 151 XMLngstWrd_00 2749 0.75 0.80 0.73 152 XMBrknScrpt_02 2716 0.84 1.14 0.72 153 XM_B_COPY_HTML 2663 0.90 1.38 0.70 154 TR_XM_DK_SendGrid 2617 0.70 0.74 0.69 155 SpammyFromTLD_01 2602 1.11 2.15 0.69 156 XM_ShortIntro_01 2583 0.58 0.33 0.68 157 XMNoVowels 2447 0.68 0.76 0.65 158 TR_XM_Base64_M1 2446 0.63 0.60 0.65 159 TR_MetaPhish_Combo_01 2436 0.76 1.03 0.64 160 XM_H_PHPMailer 2396 0.68 0.79 0.63 161 T_Symld_Words_02 2391 0.65 0.70 0.63 162 RCVD_IN_PBL 2376 0.73 0.98 0.63 163 XMPhish14 2249 0.69 0.94 0.60 164 TVD_RCVD_IP 2238 0.62 0.68 0.59 165 HTTPS_HTTP_MISMATCH 2194 0.76 1.21 0.58 166 NML_ADSP_CUSTOM_MED 2140 0.66 0.89 0.57 167 HTML_IMAGE_ONLY_20 2132 0.77 1.27 0.56 168 XMBdyGiftCard01 2116 0.70 1.03 0.56 169 HTML_TAG_BALANCE_BODY 2027 0.66 0.95 0.54 170 XMGappySubj_02 2003 0.39 0.05 0.53 171 T_OBFU_PDF_ATTACH 1966 0.41 0.15 0.52 172 MPART_ALT_DIFF_COUNT 1960 0.70 1.15 0.52 173 XMPhish30 1957 0.77 1.39 0.52 174 TO_NO_BRKTS_HTML_ONLY 1952 0.52 0.54 0.52 175 HTML_IMAGE_ONLY_32 1935 0.42 0.21 0.51 176 T_XMDrugObfuBody_00 1924 0.95 2.03 0.51 177 RCVD_IN_BL_SPAMCOP_NET 1837 3.10 9.46 0.49 178 FORGED_GMAIL_RCVD 1817 0.58 0.81 0.48 179 XMLngstWrd_01 1766 0.48 0.52 0.47 180 URI_TRY_3LD 1754 0.78 1.54 0.46 181 SpammyFromTLD_02 1694 0.95 2.17 0.45 182 XMMoneyMeta_00 1678 0.58 0.92 0.44 183 XMBSHREFv2 1676 0.39 0.27 0.44 184 RELAYCOUNTRY_GB 1616 0.55 0.86 0.43 185 XMBody_95 1610 0.36 0.20 0.43 186 HELO_MISC_IP 1608 0.34 0.12 0.43 187 RELAYCOUNTRY_AU 1574 0.96 2.28 0.42 188 XM_B_DNDMA 1560 0.47 0.63 0.41 189 XMBody_17 1554 1.90 5.50 0.41 190 T_MANY_PILL_PRICE 1542 0.29 0.01 0.41 191 XMDateMe_00 1477 0.39 0.39 0.39 192 TR_XM_PHPDW 1451 0.67 1.38 0.38 193 TR_XM_FormFill2 1443 0.67 1.35 0.38 194 TR_XM_PHPForged 1439 0.67 1.36 0.38 195 XMSubMetaSxObfu_03 1408 0.43 0.58 0.37 196 XM_H_PHPOS 1406 0.65 1.33 0.37 197 XM_B_FormFill 1392 0.27 0.02 0.37 198 T_STY_INVIS_DIRECT 1378 0.47 0.74 0.36 199 XMSlimDrugH 1376 0.48 0.75 0.36 200 HTML_IMAGE_ONLY_28 1342 0.36 0.37 0.36 ----------------------------------------------------------------------