Email: 470057 Autolearn: 0 AvgScore: 4.78 AvgScanTime: 1.38 sec Spam: 150699 Autolearn: 0 AvgScore: 14.42 AvgScanTime: 1.50 sec Ham: 319358 Autolearn: 0 AvgScore: 0.24 AvgScanTime: 1.33 sec Time Spent Running SA: 180.36 hours Time Spent Processing Spam: 62.77 hours Time Spent Processing Ham: 117.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142577 89.77 94.61 87.48 2 DKIM_SIGNED 136567 81.09 90.62 76.59 3 XM_DK_Pass 129893 78.68 86.19 75.13 4 DKIM_VALID 128694 77.63 85.40 73.96 5 XM_B_Unicode 126592 75.24 84.00 71.11 6 RELAYCOUNTRY_US 125985 82.65 83.60 82.20 7 DCC_CHECK 113737 51.10 75.47 39.60 8 XM_B_SpammyWords 106590 53.62 70.73 45.55 9 XMListUnsubscribeExists 104822 56.61 69.56 50.49 10 DKIM_VALID_AU 99689 61.36 66.15 59.10 11 XM_B_Unicode3 76384 44.44 50.69 41.49 12 LOC_TINY_FONT_1 72101 34.85 47.84 28.72 13 BAYES_50 63789 55.44 42.33 61.63 14 XM_B_SpammyWords2 62885 27.05 41.73 20.12 15 RCVD_IN_MSPIKE_H2 59791 36.97 39.68 35.70 16 XM_DK_Undo_02 58376 15.41 38.74 4.40 17 HTML_FONT_LOW_CONTRAST 55885 30.54 37.08 27.45 18 FVGT_m_MULTI_ODD 49524 28.07 32.86 25.81 19 T_KAM_HTML_FONT_INVALID 48186 25.39 31.97 22.28 20 DKIM_VALID_EF 44388 29.75 29.45 29.90 21 TR_XM_DKIM_Undo 42967 10.32 28.51 1.74 22 BAYES_99 42728 11.14 28.35 3.02 23 MIME_HTML_ONLY 42391 22.43 28.13 19.73 24 XMSubLong 38851 24.09 25.78 23.29 25 DCC_CHECK_NEGATIVE 34864 48.41 23.13 60.34 26 T_TM2_M_HEADER_IN_MSG 32804 26.60 21.77 28.89 27 BAYES_999 32185 8.38 21.36 2.26 28 TR_XM_DK_Unsub 31932 16.01 21.19 13.57 29 XM_Multi_Part_URI 30962 16.03 20.55 13.89 30 TR_DCC_Bayes_99 30517 7.28 20.25 1.16 31 UNPARSEABLE_RELAY 26406 14.05 17.52 12.41 32 XM_B_Unsub 26191 12.03 17.38 9.51 33 TR_XM_BayesUnsub 25265 10.23 16.77 7.15 34 RELAYCOUNTRY_META 23339 7.61 15.49 3.89 35 TR_MAX_INTL_RELAY 23016 8.84 15.27 5.80 36 XM_B_SpammyWords3 22357 8.07 14.84 4.88 37 LOTS_OF_MONEY 19751 8.52 13.11 6.36 38 TR_XM_SpammyRelay 18096 5.27 12.01 2.09 39 TR_XM_SpammyWords4 17083 6.49 11.34 4.20 40 BOTNET_IPINHOSTNAME 16725 5.84 11.10 3.36 41 BOTNET 16440 4.43 10.91 1.37 42 TR_XM_SpammyWords2 15871 3.67 10.53 0.44 43 XM_Evil_Numbers_Gen 15055 9.17 9.99 8.79 44 BAYES_80 14399 5.49 9.55 3.57 45 FSL_BULK_SIG 14314 7.60 9.50 6.70 46 TR_XM_UnparsRelay 13889 4.12 9.22 1.72 47 RCVD_IN_BL_SPAMCOP_NET 13553 3.28 8.99 0.59 48 XM_B_Phish_Phrases 13319 6.48 8.84 5.37 49 BAYES_60 12840 7.39 8.52 6.86 50 LotsOfNums_01 11910 7.97 7.90 8.00 51 XM_Body_Dirty_Words 11435 4.04 7.59 2.36 52 TR_XM_SPAMCOP 11343 2.61 7.53 0.29 53 XM_B_PhoneNumber 10820 9.19 7.18 10.14 54 HTML_IMAGE_RATIO_02 10428 5.60 6.92 4.97 55 XMSubMetaSx_00 9852 5.07 6.54 4.38 56 XM_UncommonTLD01 9606 4.92 6.37 4.23 57 RELAYCOUNTRY_CA 8949 2.62 5.94 1.06 58 MPART_ALT_DIFF 8743 4.83 5.80 4.37 59 BAYES_95 8181 3.25 5.43 2.23 60 DKIM_INVALID 7873 3.46 5.22 2.62 61 UNTRUSTED_Relay 7831 2.79 5.20 1.66 62 HTML_IMAGE_RATIO_04 7751 4.99 5.14 4.92 63 TR_XM_PhishingBody 7738 2.71 5.13 1.57 64 XMStrtUSub 7737 4.83 5.13 4.69 65 XM_H_Long_From01 7309 5.66 4.85 6.04 66 XM_H_GMP 7094 5.43 4.71 5.78 67 XMSexyCombo_05 6987 2.76 4.64 1.87 68 T_XMDrugObfuBody_14 6858 2.86 4.55 2.07 69 XM_B_Investor 6672 2.70 4.43 1.88 70 HTML_IMAGE_RATIO_06 6264 3.62 4.16 3.37 71 TM2_M_VERY_LONG_WORD 6007 2.33 3.99 1.55 72 XM_B_SpammyTLD 5991 3.17 3.98 2.78 73 RCVD_IN_MSPIKE_H3 5826 4.80 3.87 5.24 74 RCVD_IN_MSPIKE_WL 5826 4.80 3.87 5.24 75 TooManyTo_001 5634 7.32 3.74 9.01 76 XM_URI_RBL 5258 1.40 3.49 0.41 77 TR_XM_SpammyWords5 5090 2.09 3.38 1.48 78 MIME_HTML_MOSTLY 5028 2.78 3.34 2.52 79 XMNumbers 4982 3.03 3.31 2.90 80 MIME_HTML_ONLY_MULTI 4634 2.72 3.08 2.55 81 T_XMDrugObfuBody_08 4620 2.00 3.07 1.50 82 MIME_QP_LONG_LINE 4595 4.53 3.05 5.23 83 HTML_IMAGE_RATIO_08 4460 2.20 2.96 1.85 84 TM2_M_URI_OPT_OUT 4416 2.17 2.93 1.81 85 XM_OfRef6 4406 1.65 2.92 1.05 86 XM_B_URI_Unicode 4342 2.33 2.88 2.07 87 XMDiploma_00 4293 2.13 2.85 1.79 88 XM_SPF_SoftFail 4230 1.87 2.81 1.42 89 DIET_1 4100 1.12 2.72 0.36 90 XM_UB50 4055 1.59 2.69 1.08 91 RELAYCOUNTRY_AU 4040 1.22 2.68 0.53 92 XMBody_17 3924 1.18 2.60 0.51 93 XM_CamelCaseFrm001 3873 2.49 2.57 2.45 94 XM_B_Unsub2 3873 1.86 2.57 1.52 95 URI_HEX 3802 1.71 2.52 1.32 96 T_XMHurry_00 3753 1.22 2.49 0.62 97 MAILING_LIST_MULTI 3608 2.77 2.39 2.94 98 XM_B_SpammyWords4 3499 1.36 2.32 0.90 99 T_TooManySym_01 3408 4.51 2.26 5.57 100 ALL_TRUSTED 3301 10.60 2.19 14.58 101 FROM_EXCESS_BASE64 3260 1.93 2.16 1.83 102 USER_IN_DEF_DKIM_WL 3144 9.63 2.09 13.19 103 XMStockSpam_06 3138 1.55 2.08 1.29 104 TR_XM_INV_DKIM 3073 0.79 2.04 0.20 105 RCVD_IN_VALIDITY_SAFE 2966 3.58 1.97 4.34 106 RCVD_IN_VALIDITY_RPBL 2951 0.69 1.96 0.09 107 T_XMDrugObfuBody_00 2929 1.08 1.94 0.68 108 TR_XM_NoHeaderRelay 2866 0.74 1.90 0.20 109 SpammyFromTLD_02 2719 0.88 1.80 0.45 110 KHOP_HELO_FCRDNS 2680 1.68 1.78 1.63 111 RCVD_IN_VALIDITY_CERTIFIED 2651 3.08 1.76 3.71 112 TR_LOTS_OF_MONEY3 2627 0.90 1.74 0.51 113 BAYES_40 2573 4.24 1.71 5.43 114 SUBJ_ALL_CAPS 2507 1.69 1.66 1.71 115 T_FILL_THIS_FORM_SHORT 2502 1.34 1.66 1.19 116 XM_H_Long_From02 2470 1.06 1.64 0.79 117 T_REMOTE_IMAGE 2434 2.88 1.62 3.48 118 SpammyFromTLD_01 2410 1.11 1.60 0.87 119 XMGenDplmaNmb 2387 1.14 1.58 0.93 120 HTML_FONT_TINY_NORDNS 2332 0.56 1.55 0.09 121 XM_DK_Undo_01 2294 1.81 1.52 1.94 122 HTML_MIME_NO_HTML_TAG 2275 2.30 1.51 2.67 123 DKIM_ADSP_NXDOMAIN 2199 0.70 1.46 0.34 124 TR_XM_PHPDW 2157 0.74 1.43 0.41 125 NO_DNS_FOR_FROM 2121 0.64 1.41 0.28 126 LongTLD 2115 0.73 1.40 0.41 127 RCVD_IN_PSBL 2107 0.59 1.40 0.21 128 TR_XM_MaxWHORU 2101 0.59 1.39 0.21 129 XM_SendGrid 2101 1.39 1.39 1.38 130 TR_XM_FormFill2 2089 0.72 1.39 0.41 131 SHORTCIRCUIT 2083 0.44 1.38 0.00 132 RCVD_IN_ZEN_LASTEXTERNAL 2083 0.44 1.38 0.00 133 TR_XM_PHPForged 2081 0.72 1.38 0.41 134 RDNS_DYNAMIC 2059 0.75 1.37 0.46 135 XM_H_PHPOS 2050 0.71 1.36 0.40 136 BAYES_20 2048 3.08 1.36 3.90 137 BOUNCE_MESSAGE 2027 2.67 1.35 3.30 138 ANY_BOUNCE_MESSAGE 2027 2.67 1.35 3.30 139 PDS_RDNS_DYNAMIC_FP 2013 0.66 1.34 0.34 140 XM_B_COVIDMETA 1999 0.54 1.33 0.17 141 XMPhish30 1981 0.75 1.31 0.49 142 HTTPS_HTTP_MISMATCH 1900 0.93 1.26 0.78 143 XM_B_Phish66 1860 0.61 1.23 0.31 144 SHOPIFY_IMG_NOT_RCVD_SFY 1820 0.58 1.21 0.28 145 XMSexyCombo_01 1802 0.50 1.20 0.17 146 XM_B_DNDMA 1787 0.74 1.19 0.53 147 TR_MetaPhish_Combo_01 1773 0.90 1.18 0.77 148 URI_TRY_3LD 1755 0.79 1.16 0.61 149 XMBrknScrpt_02 1747 0.97 1.16 0.88 150 XMBody_78 1670 0.72 1.11 0.54 151 XM_B_COPY_HTML 1652 0.81 1.10 0.67 152 XMPhish11 1649 0.42 1.09 0.11 153 THIS_AD 1645 0.60 1.09 0.37 154 XM_HighProb1 1637 0.36 1.09 0.02 155 XMSubMetaI_00 1631 0.73 1.08 0.56 156 RELAYCOUNTRY_GB 1620 0.72 1.07 0.55 157 BOTNET_NORDNS 1583 0.38 1.05 0.06 158 XMHTML_After_End 1576 0.59 1.05 0.38 159 XM_B_SEO 1574 0.47 1.04 0.20 160 XM_RXBody 1572 0.49 1.04 0.23 161 TR_XM_Base64_M1 1534 0.78 1.02 0.67 162 MPART_ALT_DIFF_COUNT 1528 0.67 1.01 0.51 163 DKIM_ADSP_CUSTOM_MED 1521 0.97 1.01 0.95 164 XMSlimDrugH 1479 0.70 0.98 0.57 165 RCVD_IN_IADB_LISTED 1473 2.68 0.98 3.48 166 XM_S_SpammyWords 1466 0.47 0.97 0.23 167 TR_XM_Spammywords 1465 0.47 0.97 0.23 168 XM_ProductURIs 1439 0.56 0.95 0.37 169 XMMoneyMeta_00 1431 0.71 0.95 0.60 170 XMBdyGiftCard01 1429 0.74 0.95 0.64 171 NORDNS_LOW_CONTRAST 1415 0.33 0.94 0.04 172 TR_XM_SEO4 1410 0.37 0.94 0.10 173 XMPhish14 1404 0.55 0.93 0.37 174 TR_XM_RelayPhish 1401 0.35 0.93 0.07 175 XM_DIRTYINTL 1396 0.34 0.93 0.06 176 RCVD_IN_PBL 1388 0.78 0.92 0.72 177 FILL_THIS_FORM 1387 0.62 0.92 0.48 178 RCVD_IN_IADB_SPF 1383 2.40 0.92 3.10 179 URI_NOVOWEL 1381 1.56 0.92 1.87 180 TM2_M_A_HREF_HREF 1366 0.45 0.91 0.24 181 RCVD_IN_IADB_DK 1358 2.14 0.90 2.72 182 RELAYCOUNTRY_FR 1353 0.44 0.90 0.23 183 RCVD_IN_IADB_SENDERID 1353 2.18 0.90 2.78 184 XM_UB99 1336 0.29 0.89 0.00 185 HTML_FONT_FACE_BAD 1319 0.48 0.88 0.29 186 TM2_M_OBFU_COMMENT 1287 0.52 0.85 0.36 187 TR_XM_DK_SendGrid 1283 0.88 0.85 0.90 188 XMSubMetaSxObfu_03 1271 0.65 0.84 0.57 189 HTML_TAG_BALANCE_BODY 1266 0.70 0.84 0.64 190 T_STY_INVIS_DIRECT 1261 0.60 0.84 0.49 191 NML_ADSP_CUSTOM_MED 1256 0.72 0.83 0.67 192 XM_OfRef7 1230 0.41 0.82 0.22 193 XM_B_REG_HTML 1228 0.39 0.81 0.19 194 HTML_IMAGE_ONLY_20 1222 0.64 0.81 0.56 195 TR_Symld_Words 1221 1.29 0.81 1.52 196 XM_GoogleGroups 1219 1.17 0.81 1.34 197 FORGED_GMAIL_RCVD 1219 0.71 0.81 0.66 198 XM_H_Undi_Recip 1207 0.37 0.80 0.16 199 TR_Mismatch_TLD_02 1207 0.34 0.80 0.12 200 TR_XM_SpoofStaff 1201 0.37 0.80 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279384 89.77 94.61 87.48 2 RELAYCOUNTRY_US 262504 82.65 83.60 82.20 3 DKIM_SIGNED 244584 81.09 90.62 76.59 4 XM_DK_Pass 239926 78.68 86.19 75.13 5 DKIM_VALID 236204 77.63 85.40 73.96 6 XM_B_Unicode 227085 75.24 84.00 71.11 7 BAYES_50 196822 55.44 42.33 61.63 8 DCC_CHECK_NEGATIVE 192714 48.41 23.13 60.34 9 DKIM_VALID_AU 188750 61.36 66.15 59.10 10 XMListUnsubscribeExists 161254 56.61 69.56 50.49 11 XM_B_SpammyWords 145475 53.62 70.73 45.55 12 XM_B_Unicode3 132500 44.44 50.69 41.49 13 DCC_CHECK 126471 51.10 75.47 39.60 14 RCVD_IN_MSPIKE_H2 114005 36.97 39.68 35.70 15 DKIM_VALID_EF 95476 29.75 29.45 29.90 16 T_TM2_M_HEADER_IN_MSG 92253 26.60 21.77 28.89 17 LOC_TINY_FONT_1 91735 34.85 47.84 28.72 18 HTML_FONT_LOW_CONTRAST 87657 30.54 37.08 27.45 19 FVGT_m_MULTI_ODD 82413 28.07 32.86 25.81 20 XMSubLong 74374 24.09 25.78 23.29 21 T_KAM_HTML_FONT_INVALID 71167 25.39 31.97 22.28 22 XM_B_SpammyWords2 64260 27.05 41.73 20.12 23 MIME_HTML_ONLY 63025 22.43 28.13 19.73 24 ALL_TRUSTED 46548 10.60 2.19 14.58 25 XM_Multi_Part_URI 44369 16.03 20.55 13.89 26 TR_XM_DK_Unsub 43324 16.01 21.19 13.57 27 USER_IN_DEF_DKIM_WL 42134 9.63 2.09 13.19 28 UNPARSEABLE_RELAY 39619 14.05 17.52 12.41 29 BAYES_00 35217 7.73 0.73 11.03 30 XM_B_PhoneNumber 32393 9.19 7.18 10.14 31 XM_B_Unsub 30372 12.03 17.38 9.51 32 TooManyTo_001 28777 7.32 3.74 9.01 33 XM_Evil_Numbers_Gen 28063 9.17 9.99 8.79 34 LotsOfNums_01 25533 7.97 7.90 8.00 35 TR_XM_BayesUnsub 22839 10.23 16.77 7.15 36 TR_XM_DK_Bayes 22335 4.95 0.61 6.99 37 BAYES_60 21908 7.39 8.52 6.86 38 IN_ZIMBRA_NJ_WHITELIST 21846 4.69 0.13 6.84 39 TR_XM_DK_Bayes1 21830 4.83 0.60 6.84 40 FSL_BULK_SIG 21392 7.60 9.50 6.70 41 XM_DKIMWhitelistDomains 20910 4.47 0.06 6.55 42 LOTS_OF_MONEY 20300 8.52 13.11 6.36 43 XM_H_Long_From01 19297 5.66 4.85 6.04 44 TR_XM_DK_Bayes2 19003 4.20 0.50 5.95 45 TR_MAX_INTL_RELAY 18525 8.84 15.27 5.80 46 XM_H_GMP 18447 5.43 4.71 5.78 47 T_TooManySym_01 17797 4.51 2.26 5.57 48 BAYES_40 17338 4.24 1.71 5.43 49 XM_B_Phish_Phrases 17139 6.48 8.84 5.37 50 RCVD_IN_MSPIKE_H3 16750 4.80 3.87 5.24 51 RCVD_IN_MSPIKE_WL 16750 4.80 3.87 5.24 52 MIME_QP_LONG_LINE 16713 4.53 3.05 5.23 53 HTML_IMAGE_RATIO_02 15872 5.60 6.92 4.97 54 HTML_IMAGE_RATIO_04 15711 4.99 5.14 4.92 55 XM_B_SpammyWords3 15579 8.07 14.84 4.88 56 XMStrtUSub 14980 4.83 5.13 4.69 57 XM_PDF 14669 3.37 0.77 4.59 58 XM_DK_Undo_02 14050 15.41 38.74 4.40 59 XMSubMetaSx_00 13975 5.07 6.54 4.38 60 MPART_ALT_DIFF 13970 4.83 5.80 4.37 61 RCVD_IN_VALIDITY_SAFE 13848 3.58 1.97 4.34 62 XM_UncommonTLD01 13508 4.92 6.37 4.23 63 TR_XM_SpammyWords4 13412 6.49 11.34 4.20 64 BAYES_20 12440 3.08 1.36 3.90 65 RELAYCOUNTRY_META 12415 7.61 15.49 3.89 66 RCVD_IN_VALIDITY_CERTIFIED 11848 3.08 1.76 3.71 67 BAYES_80 11401 5.49 9.55 3.57 68 RCVD_IN_IADB_LISTED 11116 2.68 0.98 3.48 69 T_REMOTE_IMAGE 11110 2.88 1.62 3.48 70 HTML_IMAGE_RATIO_06 10758 3.62 4.16 3.37 71 BOTNET_IPINHOSTNAME 10738 5.84 11.10 3.36 72 ANY_BOUNCE_MESSAGE 10530 2.67 1.35 3.30 73 BOUNCE_MESSAGE 10529 2.67 1.35 3.30 74 TooManyTo_002 10253 2.36 0.57 3.21 75 RCVD_IN_IADB_SPF 9892 2.40 0.92 3.10 76 BAYES_99 9656 11.14 28.35 3.02 77 MAILING_LIST_MULTI 9398 2.77 2.39 2.94 78 XMNumbers 9263 3.03 3.31 2.90 79 T_TooManySym_02 9187 2.13 0.56 2.88 80 XM_B_SpammyTLD 8888 3.17 3.98 2.78 81 RCVD_IN_IADB_SENDERID 8882 2.18 0.90 2.78 82 RCVD_IN_IADB_DK 8692 2.14 0.90 2.72 83 HTML_MIME_NO_HTML_TAG 8533 2.30 1.51 2.67 84 DKIM_INVALID 8380 3.46 5.22 2.62 85 MIME_HTML_ONLY_MULTI 8145 2.72 3.08 2.55 86 MIME_HTML_MOSTLY 8047 2.78 3.34 2.52 87 XM_CamelCaseFrm001 7813 2.49 2.57 2.45 88 XM_Body_Dirty_Words 7535 4.04 7.59 2.36 89 BAYES_05 7456 1.79 0.64 2.33 90 BAYES_999 7224 8.38 21.36 2.26 91 BAYES_95 7111 3.25 5.43 2.23 92 INVALID_MSGID 7065 1.59 0.26 2.21 93 RCVD_IN_IADB_VOUCHED 7000 1.60 0.34 2.19 94 TR_XM_SpammyRelay 6663 5.27 12.01 2.09 95 T_XMDrugObfuBody_14 6609 2.86 4.55 2.07 96 XM_B_URI_Unicode 6607 2.33 2.88 2.07 97 TO_MALFORMED 6262 1.34 0.02 1.96 98 XM_DK_Undo_01 6209 1.81 1.52 1.94 99 XM_B_Investor 6009 2.70 4.43 1.88 100 XMSexyCombo_05 5980 2.76 4.64 1.87 101 URI_NOVOWEL 5966 1.56 0.92 1.87 102 HTML_IMAGE_RATIO_08 5904 2.20 2.96 1.85 103 FROM_EXCESS_BASE64 5831 1.93 2.16 1.83 104 TM2_M_URI_OPT_OUT 5766 2.17 2.93 1.81 105 XMDiploma_00 5708 2.13 2.85 1.79 106 TR_XM_DKIM_Undo 5550 10.32 28.51 1.74 107 TR_XM_UnparsRelay 5477 4.12 9.22 1.72 108 SUBJ_ALL_CAPS 5450 1.69 1.66 1.71 109 TooManyTo_003 5299 1.28 0.48 1.66 110 UNTRUSTED_Relay 5297 2.79 5.20 1.66 111 KHOP_HELO_FCRDNS 5198 1.68 1.78 1.63 112 TR_XM_PhishingBody 5009 2.71 5.13 1.57 113 TM2_M_VERY_LONG_WORD 4955 2.33 3.99 1.55 114 XM_B_Unsub2 4862 1.86 2.57 1.52 115 TR_Symld_Words 4845 1.29 0.81 1.52 116 RCVD_IN_IADB_OPTIN 4838 1.10 0.23 1.51 117 T_XMDrugObfuBody_08 4789 2.00 3.07 1.50 118 TR_XM_SpammyWords5 4731 2.09 3.38 1.48 119 IN_HORDE_ADDRESS_BOOK 4565 1.01 0.11 1.43 120 XM_SPF_SoftFail 4538 1.87 2.81 1.42 121 XMGappySubj_01 4486 1.02 0.19 1.40 122 XM_SendGrid 4423 1.39 1.39 1.38 123 BOTNET 4386 4.43 10.91 1.37 124 XM_GoogleGroups 4269 1.17 0.81 1.34 125 URI_HEX 4226 1.71 2.52 1.32 126 HELO_NODOT 4145 0.97 0.26 1.30 127 HELO_NO_DOMAIN 4138 0.96 0.26 1.30 128 XMStockSpam_06 4125 1.55 2.08 1.29 129 TooManyTo_004 3842 0.95 0.41 1.20 130 T_TooManySym_03 3842 0.87 0.17 1.20 131 T_FILL_THIS_FORM_SHORT 3792 1.34 1.66 1.19 132 TR_DCC_Bayes_99 3712 7.28 20.25 1.16 133 XMCapTrack 3568 0.91 0.47 1.12 134 XM_UB50 3438 1.59 2.69 1.08 135 RELAYCOUNTRY_CA 3382 2.62 5.94 1.06 136 XM_OfRef6 3368 1.65 2.92 1.05 137 TVD_SPACE_RATIO 3302 0.77 0.22 1.03 138 TooManyTo_005 3099 0.78 0.36 0.97 139 DKIM_ADSP_CUSTOM_MED 3031 0.97 1.01 0.95 140 XMGenDplmaNmb 2971 1.14 1.58 0.93 141 XMGappySubj_02 2878 0.63 0.05 0.90 142 XM_B_SpammyWords4 2875 1.36 2.32 0.90 143 TR_XM_DK_SendGrid 2862 0.88 0.85 0.90 144 XMBrknScrpt_02 2801 0.97 1.16 0.88 145 SpammyFromTLD_01 2789 1.11 1.60 0.87 146 XM_B_FormFill 2617 0.56 0.02 0.82 147 XM_H_Long_From02 2516 1.06 1.64 0.79 148 HTTPS_HTTP_MISMATCH 2493 0.93 1.26 0.78 149 TR_MetaPhish_Combo_01 2468 0.90 1.18 0.77 150 FROM_GOV_DKIM_AU 2455 0.56 0.13 0.77 151 XM_ShortIntro_01 2419 0.66 0.46 0.76 152 LOW_PRICE 2374 0.64 0.41 0.74 153 RCVD_IN_PBL 2299 0.78 0.92 0.72 154 XM_H_PHPMailer 2268 0.73 0.78 0.71 155 TVD_RCVD_IP 2217 0.71 0.73 0.69 156 T_OBFU_PDF_ATTACH 2213 0.51 0.13 0.69 157 T_XMDrugObfuBody_00 2168 1.08 1.94 0.68 158 HTML_IMAGE_ONLY_32 2147 0.52 0.18 0.67 159 XMNoVowels 2144 0.69 0.73 0.67 160 XM_B_COPY_HTML 2134 0.81 1.10 0.67 161 TR_XM_Base64_M1 2133 0.78 1.02 0.67 162 NML_ADSP_CUSTOM_MED 2130 0.72 0.83 0.67 163 FORGED_GMAIL_RCVD 2102 0.71 0.81 0.66 164 TO_NO_BRKTS_HTML_ONLY 2073 0.57 0.40 0.65 165 XMBdyGiftCard01 2052 0.74 0.95 0.64 166 HTML_TAG_BALANCE_BODY 2032 0.70 0.84 0.64 167 T_XMHurry_00 1989 1.22 2.49 0.62 168 URI_TRY_3LD 1945 0.79 1.16 0.61 169 XMMoneyMeta_00 1921 0.71 0.95 0.60 170 RCVD_IN_BL_SPAMCOP_NET 1870 3.28 8.99 0.59 171 XMSlimDrugH 1812 0.70 0.98 0.57 172 XMSubMetaSxObfu_03 1807 0.65 0.84 0.57 173 HTML_IMAGE_ONLY_20 1777 0.64 0.81 0.56 174 XMSubMetaI_00 1777 0.73 1.08 0.56 175 RELAYCOUNTRY_GB 1766 0.72 1.07 0.55 176 XMBody_78 1736 0.72 1.11 0.54 177 XM_B_DNDMA 1701 0.74 1.19 0.53 178 RELAYCOUNTRY_AU 1692 1.22 2.68 0.53 179 MSGID_FROM_MTA_HEADER 1648 0.38 0.09 0.52 180 MPART_ALT_DIFF_COUNT 1642 0.67 1.01 0.51 181 TR_LOTS_OF_MONEY3 1613 0.90 1.74 0.51 182 XMBody_17 1613 1.18 2.60 0.51 183 T_Symld_Words_02 1606 0.54 0.62 0.50 184 T_STY_INVIS_DIRECT 1579 0.60 0.84 0.49 185 XMBody_95 1563 0.40 0.20 0.49 186 XMPhish30 1556 0.75 1.31 0.49 187 XMDateMe_00 1556 0.48 0.48 0.49 188 FILL_THIS_FORM 1521 0.62 0.92 0.48 189 RDNS_DYNAMIC 1485 0.75 1.37 0.46 190 XMLngstWrd_00 1480 0.43 0.35 0.46 191 HELO_MISC_IP 1457 0.32 0.05 0.46 192 FROM_GOV_SPOOF 1437 0.33 0.08 0.45 193 XMBSHREFv2 1434 0.39 0.27 0.45 194 SpammyFromTLD_02 1428 0.88 1.80 0.45 195 SUBJ_DOLLARS 1421 0.43 0.40 0.44 196 TR_XM_SpammyWords2 1395 3.67 10.53 0.44 197 LongTLD 1317 0.73 1.40 0.41 198 SHORT_HELO_AND_INLINE_IMAGE 1315 0.29 0.02 0.41 199 TR_XM_PHPDW 1311 0.74 1.43 0.41 200 XM_URI_RBL 1310 1.40 3.49 0.41 ----------------------------------------------------------------------