Email: 466908 Autolearn: 0 AvgScore: 4.65 AvgScanTime: 1.30 sec Spam: 146454 Autolearn: 0 AvgScore: 14.34 AvgScanTime: 1.38 sec Ham: 320454 Autolearn: 0 AvgScore: 0.23 AvgScanTime: 1.26 sec Time Spent Running SA: 168.40 hours Time Spent Processing Spam: 56.05 hours Time Spent Processing Ham: 112.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139087 88.98 94.97 86.24 2 XM_B_Unicode 123934 74.01 84.62 69.17 3 DKIM_SIGNED 123720 75.58 84.48 71.51 4 XM_DK_Pass 115665 72.96 78.98 70.21 5 RELAYCOUNTRY_US 114863 79.80 78.43 80.43 6 DKIM_VALID 114360 71.84 78.09 68.99 7 DCC_CHECK 112749 48.96 76.99 36.15 8 XM_B_SpammyWords 94763 49.88 64.70 43.11 9 XMListUnsubscribeExists 94169 51.08 64.30 45.03 10 DKIM_VALID_AU 90187 57.28 61.58 55.31 11 XM_B_Unicode3 77017 44.38 52.59 40.63 12 LOC_TINY_FONT_1 74421 33.72 50.82 25.91 13 BAYES_50 62861 54.98 42.92 60.49 14 RCVD_IN_MSPIKE_H2 55058 35.50 37.59 34.54 15 XM_B_SpammyWords2 54835 23.55 37.44 17.20 16 HTML_FONT_LOW_CONTRAST 51818 30.32 35.38 28.01 17 XM_DK_Undo_02 51773 13.97 35.35 4.20 18 T_KAM_HTML_FONT_INVALID 51182 25.19 34.95 20.73 19 MIME_HTML_ONLY 45452 22.55 31.04 18.67 20 XMSubLong 45282 25.85 30.92 23.54 21 FVGT_m_MULTI_ODD 43911 26.37 29.98 24.72 22 DKIM_VALID_EF 39666 28.27 27.08 28.81 23 BAYES_99 39107 10.51 26.70 3.11 24 TR_XM_DKIM_Undo 38017 9.28 25.96 1.66 25 T_TM2_M_HEADER_IN_MSG 31767 29.35 21.69 32.85 26 DCC_CHECK_NEGATIVE 31265 50.49 21.35 63.80 27 BAYES_999 30276 8.09 20.67 2.33 28 XM_Multi_Part_URI 28784 14.81 19.65 12.60 29 TR_DCC_Bayes_99 27664 6.73 18.89 1.17 30 TR_XM_DK_Unsub 27048 14.17 18.47 12.20 31 XM_B_Unsub 24796 11.10 16.93 8.44 32 TR_XM_BayesUnsub 23906 9.55 16.32 6.45 33 UNPARSEABLE_RELAY 22491 13.06 15.36 12.00 34 FSL_BULK_SIG 21572 9.27 14.73 6.78 35 RELAYCOUNTRY_META 21370 6.92 14.59 3.41 36 XM_B_SpammyWords3 20957 7.24 14.31 4.01 37 TR_MAX_INTL_RELAY 19624 8.62 13.40 6.44 38 LOTS_OF_MONEY 16876 7.38 11.52 5.49 39 BOTNET_IPINHOSTNAME 15398 5.17 10.51 2.73 40 BOTNET 15173 4.07 10.36 1.19 41 TR_XM_SpammyWords4 15133 5.61 10.33 3.46 42 TR_XM_SpammyRelay 15048 4.41 10.27 1.73 43 TR_XM_SpammyWords2 13789 3.20 9.42 0.35 44 XM_Evil_Numbers_Gen 12815 9.24 8.75 9.47 45 BAYES_80 12159 4.98 8.30 3.46 46 BAYES_60 11659 6.94 7.96 6.48 47 ALL_TRUSTED 11196 14.00 7.64 16.90 48 RCVD_IN_BL_SPAMCOP_NET 10922 2.67 7.46 0.49 49 TR_XM_UnparsRelay 10605 3.23 7.24 1.39 50 XM_B_Phish_Phrases 10520 5.59 7.18 4.87 51 XMSubMetaSx_00 10380 4.18 7.09 2.85 52 HTML_IMAGE_RATIO_02 10316 5.14 7.04 4.27 53 LotsOfNums_01 10237 8.82 6.99 9.65 54 TR_Symld_Words 9474 3.27 6.47 1.81 55 DKIM_INVALID 9360 3.74 6.39 2.52 56 TR_XM_SPAMCOP 8487 1.98 5.79 0.24 57 BASE64_LENGTH_79_INF 8482 2.03 5.79 0.31 58 MPART_ALT_DIFF 8441 4.74 5.76 4.28 59 TR_MetaPhish_Combo_01b 8395 1.96 5.73 0.23 60 XM_B_PhoneNumber 8253 8.27 5.64 9.48 61 RELAYCOUNTRY_CA 8135 2.34 5.55 0.87 62 XM_Body_Dirty_Words 8117 3.68 5.54 2.84 63 UNTRUSTED_Relay 8001 2.69 5.46 1.42 64 XM_UncommonTLD01 7396 4.45 5.05 4.17 65 XM_B_Investor 7222 2.56 4.93 1.48 66 XM_H_Long_From01 7193 5.21 4.91 5.35 67 TR_XM_PhishingBody 7145 2.50 4.88 1.41 68 BAYES_40 7121 5.63 4.86 5.99 69 BAYES_95 6972 3.53 4.76 2.97 70 XMStrtUSub 6933 4.98 4.73 5.10 71 XM_H_GMP 6848 5.63 4.68 6.06 72 HTML_IMAGE_RATIO_04 6844 4.17 4.67 3.95 73 TM2_M_VERY_LONG_WORD 6382 4.70 4.36 4.86 74 TooManyTo_001 6341 7.17 4.33 8.46 75 T_XMDrugObfuBody_14 5931 2.47 4.05 1.74 76 XMSexyCombo_05 5771 2.27 3.94 1.50 77 HTML_IMAGE_RATIO_06 5668 3.06 3.87 2.69 78 XM_B_SpammyTLD 5041 2.74 3.44 2.42 79 MIME_HTML_MOSTLY 5021 2.62 3.43 2.24 80 RCVD_IN_MSPIKE_H3 4945 4.37 3.38 4.83 81 RCVD_IN_MSPIKE_WL 4945 4.37 3.38 4.83 82 XMNumbers 4819 3.14 3.29 3.08 83 TR_XM_SpammyWords5 4799 1.95 3.28 1.35 84 MIME_HTML_ONLY_MULTI 4671 2.70 3.19 2.48 85 T_XMDrugObfuBody_08 4665 1.85 3.19 1.25 86 XM_UB50 4510 1.56 3.08 0.87 87 XM_CamelCaseFrm001 4380 2.20 2.99 1.84 88 RCVD_IN_VALIDITY_RPBL 4280 1.00 2.92 0.12 89 XM_OfRef6 4161 1.60 2.84 1.03 90 XM_SPF_SoftFail 4114 1.79 2.81 1.32 91 MIME_QP_LONG_LINE 3998 3.74 2.73 4.20 92 XMDiploma_00 3994 1.95 2.73 1.59 93 TR_XM_INV_DKIM 3735 0.91 2.55 0.17 94 XM_B_Unsub2 3730 1.70 2.55 1.31 95 HTML_IMAGE_RATIO_08 3673 2.21 2.51 2.08 96 DIET_1 3597 1.02 2.46 0.37 97 T_TooManySym_01 3535 4.73 2.41 5.79 98 XM_URI_RBL 3500 1.04 2.39 0.42 99 MAILING_LIST_MULTI 3485 2.63 2.38 2.74 100 XM_B_URI_Unicode 3479 2.13 2.38 2.01 101 RELAYCOUNTRY_AU 3452 1.06 2.36 0.46 102 HTML_MIME_NO_HTML_TAG 3426 2.55 2.34 2.65 103 TM2_M_URI_OPT_OUT 3394 1.84 2.32 1.62 104 XM_B_SpammyWords4 3367 1.19 2.30 0.68 105 TR_XM_NoHeaderRelay 3327 0.84 2.27 0.19 106 KHOP_HELO_FCRDNS 3063 2.92 2.09 3.29 107 DKIM_ADSP_NXDOMAIN 3030 0.90 2.07 0.37 108 T_XMHurry_00 2983 1.05 2.04 0.60 109 NO_DNS_FOR_FROM 2869 0.82 1.96 0.30 110 TR_XM_MaxWHORU 2856 0.77 1.95 0.23 111 FROM_EXCESS_BASE64 2748 1.84 1.88 1.82 112 XMBody_17 2664 0.85 1.82 0.41 113 XMStockSpam_06 2612 1.38 1.78 1.20 114 XM_B_COPY_HTML 2586 1.18 1.77 0.92 115 RCVD_IN_VALIDITY_SAFE 2536 3.22 1.73 3.90 116 USER_IN_DEF_DKIM_WL 2464 8.79 1.68 12.04 117 SpammyFromTLD_02 2461 0.68 1.68 0.23 118 SHORTCIRCUIT 2421 0.52 1.65 0.00 119 RCVD_IN_ZEN_LASTEXTERNAL 2421 0.52 1.65 0.00 120 BOUNCE_MESSAGE 2418 5.18 1.65 6.79 121 ANY_BOUNCE_MESSAGE 2418 5.18 1.65 6.79 122 XMBrknScrpt_02 2385 1.05 1.63 0.78 123 T_REMOTE_IMAGE 2379 3.01 1.62 3.65 124 SUBJ_ALL_CAPS 2300 1.55 1.57 1.55 125 XMPhish30 2288 0.82 1.56 0.48 126 T_XMDrugObfuBody_00 2286 0.94 1.56 0.65 127 SpammyFromTLD_01 2237 1.09 1.53 0.89 128 RCVD_IN_VALIDITY_CERTIFIED 2237 2.70 1.53 3.23 129 BAYES_20 2222 3.23 1.52 4.01 130 T_FILL_THIS_FORM_SHORT 2126 1.17 1.45 1.04 131 RCVD_IN_PSBL 2102 0.59 1.44 0.21 132 URI_HEX 2076 1.33 1.42 1.29 133 TR_LOTS_OF_MONEY3 2051 0.66 1.40 0.32 134 TR_MetaPhish_Combo_01 2040 0.96 1.39 0.76 135 XMGenDplmaNmb 2025 1.02 1.38 0.85 136 HTML_TAG_BALANCE_BODY 2009 0.83 1.37 0.58 137 XM_B_Phish66 1995 0.63 1.36 0.30 138 XMSubMetaI_00 1973 0.73 1.35 0.45 139 RELAYCOUNTRY_FR 1789 0.56 1.22 0.26 140 XM_B_SEO 1779 0.55 1.21 0.25 141 TR_XM_PHPForged 1772 0.68 1.21 0.44 142 MIME_CHARSET_FARAWAY 1759 1.84 1.20 2.13 143 XMBdyGiftCard01 1756 1.01 1.20 0.93 144 HTTPS_HTTP_MISMATCH 1751 0.91 1.20 0.78 145 TR_XM_PHPDW 1748 0.68 1.19 0.44 146 TR_XM_FormFill2 1734 0.67 1.18 0.44 147 URI_TRY_3LD 1711 0.80 1.17 0.63 148 XM_H_PHPOS 1706 0.66 1.16 0.43 149 XM_DK_Undo_01 1688 1.67 1.15 1.90 150 HTML_FONT_TINY_NORDNS 1658 0.40 1.13 0.06 151 XMReplyNow 1619 0.50 1.11 0.23 152 XMBody_78 1609 0.54 1.10 0.28 153 XM_H_Long_From02 1577 0.90 1.08 0.83 154 TR_XM_SEO4 1568 0.44 1.07 0.16 155 NORDNS_LOW_CONTRAST 1556 0.37 1.06 0.05 156 XM_PDF 1542 3.48 1.05 4.59 157 XM_SendGrid 1521 1.39 1.04 1.54 158 SHOPIFY_IMG_NOT_RCVD_SFY 1508 0.49 1.03 0.25 159 LongTLD 1506 0.61 1.03 0.42 160 RCVD_IN_PBL 1479 0.77 1.01 0.66 161 MPART_ALT_DIFF_COUNT 1476 0.70 1.01 0.56 162 XMSexyCombo_01 1454 0.40 0.99 0.13 163 XM_ProductURIs 1435 0.63 0.98 0.48 164 T_Symld_Words_02 1435 0.68 0.98 0.55 165 THIS_AD 1419 0.55 0.97 0.35 166 HTML_FONT_FACE_BAD 1392 0.56 0.95 0.38 167 XMClaimOffer 1382 0.44 0.94 0.21 168 CHARSET_FARAWAY_HEADER 1378 1.67 0.94 2.00 169 URI_NOVOWEL 1371 1.38 0.94 1.58 170 XM_S_SpammyWords 1355 0.46 0.93 0.24 171 TR_XM_Spammywords 1355 0.46 0.93 0.24 172 TR_LOTS_OF_MONEY2 1327 0.45 0.91 0.24 173 T_MONEY_PERCENT 1327 0.45 0.91 0.24 174 XMHTML_After_End 1320 0.53 0.90 0.36 175 MAY_BE_FORGED 1319 2.81 0.90 3.68 176 XMSubMetaSxObfu_02 1292 0.46 0.88 0.26 177 TM2_M_OBFU_COMMENT 1289 0.58 0.88 0.44 178 RCVD_IN_SORBS_DUL 1260 0.29 0.86 0.03 179 TM2_M_A_HREF_HREF 1258 0.41 0.86 0.21 180 XM_HighProb1 1251 0.28 0.85 0.01 181 HTML_IMAGE_ONLY_20 1250 0.71 0.85 0.65 182 DKIM_ADSP_CUSTOM_MED 1236 0.97 0.84 1.03 183 URIBL_BLACK 1235 0.29 0.84 0.04 184 TR_XM_RelayPhish 1222 0.32 0.83 0.09 185 XM_B_REG_HTML 1209 0.39 0.83 0.20 186 RDNS_DYNAMIC 1204 0.48 0.82 0.32 187 XM_GoogleGroups 1201 1.08 0.82 1.19 188 XM_UB99 1194 0.26 0.82 0.00 189 PLING_QUERY 1187 0.58 0.81 0.48 190 XM_B_DNDMA 1185 0.60 0.81 0.50 191 BOTNET_NORDNS 1178 0.26 0.80 0.01 192 PDS_RDNS_DYNAMIC_FP 1176 0.39 0.80 0.20 193 XMSubMetaSSx_00 1162 0.39 0.79 0.20 194 XMPhish14 1138 0.47 0.78 0.33 195 XM_B_COVIDMETA 1123 0.34 0.77 0.15 196 RELAYCOUNTRY_GB 1123 0.58 0.77 0.49 197 MultiRelay_CC 1099 0.32 0.75 0.13 198 T_STY_INVIS_DIRECT 1091 0.52 0.74 0.41 199 XM_DIRTYINTL 1087 0.29 0.74 0.08 200 TVD_RCVD_IP 1086 0.66 0.74 0.62 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276369 88.98 94.97 86.24 2 RELAYCOUNTRY_US 257729 79.80 78.43 80.43 3 DKIM_SIGNED 229169 75.58 84.48 71.51 4 XM_DK_Pass 224987 72.96 78.98 70.21 5 XM_B_Unicode 221647 74.01 84.62 69.17 6 DKIM_VALID 221080 71.84 78.09 68.99 7 DCC_CHECK_NEGATIVE 204457 50.49 21.35 63.80 8 BAYES_50 193834 54.98 42.92 60.49 9 DKIM_VALID_AU 177251 57.28 61.58 55.31 10 XMListUnsubscribeExists 144310 51.08 64.30 45.03 11 XM_B_SpammyWords 138138 49.88 64.70 43.11 12 XM_B_Unicode3 130207 44.38 52.59 40.63 13 DCC_CHECK 115843 48.96 76.99 36.15 14 RCVD_IN_MSPIKE_H2 110688 35.50 37.59 34.54 15 T_TM2_M_HEADER_IN_MSG 105284 29.35 21.69 32.85 16 DKIM_VALID_EF 92319 28.27 27.08 28.81 17 HTML_FONT_LOW_CONTRAST 89749 30.32 35.38 28.01 18 LOC_TINY_FONT_1 83021 33.72 50.82 25.91 19 FVGT_m_MULTI_ODD 79217 26.37 29.98 24.72 20 XMSubLong 75421 25.85 30.92 23.54 21 T_KAM_HTML_FONT_INVALID 66436 25.19 34.95 20.73 22 MIME_HTML_ONLY 59825 22.55 31.04 18.67 23 XM_B_SpammyWords2 55134 23.55 37.44 17.20 24 ALL_TRUSTED 54149 14.00 7.64 16.90 25 XM_Multi_Part_URI 40373 14.81 19.65 12.60 26 TR_XM_DK_Unsub 39107 14.17 18.47 12.20 27 USER_IN_DEF_DKIM_WL 38591 8.79 1.68 12.04 28 UNPARSEABLE_RELAY 38464 13.06 15.36 12.00 29 BAYES_00 35694 7.86 0.70 11.14 30 LotsOfNums_01 30934 8.82 6.99 9.65 31 XM_B_PhoneNumber 30380 8.27 5.64 9.48 32 XM_Evil_Numbers_Gen 30331 9.24 8.75 9.47 33 TooManyTo_001 27119 7.17 4.33 8.46 34 XM_B_Unsub 27033 11.10 16.93 8.44 35 TR_XM_DK_Bayes 23651 5.25 0.59 7.38 36 TR_XM_DK_Bayes1 23079 5.13 0.59 7.20 37 ANY_BOUNCE_MESSAGE 21767 5.18 1.65 6.79 38 BOUNCE_MESSAGE 21766 5.18 1.65 6.79 39 FSL_BULK_SIG 21728 9.27 14.73 6.78 40 BAYES_60 20763 6.94 7.96 6.48 41 TR_XM_BayesUnsub 20684 9.55 16.32 6.45 42 TR_MAX_INTL_RELAY 20628 8.62 13.40 6.44 43 XM_DKIMWhitelistDomains 20556 4.42 0.06 6.41 44 IN_ZIMBRA_NJ_WHITELIST 20202 4.37 0.14 6.30 45 TR_XM_DK_Bayes2 19901 4.41 0.49 6.21 46 XM_H_GMP 19431 5.63 4.68 6.06 47 BAYES_40 19183 5.63 4.86 5.99 48 T_TooManySym_01 18570 4.73 2.41 5.79 49 LOTS_OF_MONEY 17577 7.38 11.52 5.49 50 XM_H_Long_From01 17132 5.21 4.91 5.35 51 XMStrtUSub 16336 4.98 4.73 5.10 52 XM_B_Phish_Phrases 15600 5.59 7.18 4.87 53 TM2_M_VERY_LONG_WORD 15566 4.70 4.36 4.86 54 RCVD_IN_MSPIKE_H3 15473 4.37 3.38 4.83 55 RCVD_IN_MSPIKE_WL 15473 4.37 3.38 4.83 56 XM_PDF 14714 3.48 1.05 4.59 57 MPART_ALT_DIFF 13708 4.74 5.76 4.28 58 HTML_IMAGE_RATIO_02 13679 5.14 7.04 4.27 59 HTML_IMAGE_ONLY_32 13601 2.98 0.21 4.24 60 XM_DK_Undo_02 13474 13.97 35.35 4.20 61 MIME_QP_LONG_LINE 13474 3.74 2.73 4.20 62 XM_UncommonTLD01 13369 4.45 5.05 4.17 63 BAYES_20 12860 3.23 1.52 4.01 64 XM_B_SpammyWords3 12850 7.24 14.31 4.01 65 HTML_IMAGE_RATIO_04 12643 4.17 4.67 3.95 66 RCVD_IN_VALIDITY_SAFE 12508 3.22 1.73 3.90 67 MAY_BE_FORGED 11783 2.81 0.90 3.68 68 T_REMOTE_IMAGE 11692 3.01 1.62 3.65 69 BAYES_80 11101 4.98 8.30 3.46 70 TR_XM_SpammyWords4 11076 5.61 10.33 3.46 71 RELAYCOUNTRY_META 10939 6.92 14.59 3.41 72 KHOP_HELO_FCRDNS 10557 2.92 2.09 3.29 73 RCVD_IN_VALIDITY_CERTIFIED 10358 2.70 1.53 3.23 74 BAYES_99 9964 10.51 26.70 3.11 75 T_TooManySym_02 9924 2.35 0.73 3.10 76 XMNumbers 9854 3.14 3.29 3.08 77 BAYES_95 9519 3.53 4.76 2.97 78 TooManyTo_002 9474 2.22 0.61 2.96 79 RCVD_IN_IADB_LISTED 9422 2.23 0.66 2.94 80 XMSubMetaSx_00 9145 4.18 7.09 2.85 81 XM_Body_Dirty_Words 9086 3.68 5.54 2.84 82 MAILING_LIST_MULTI 8778 2.63 2.38 2.74 83 BOTNET_IPINHOSTNAME 8760 5.17 10.51 2.73 84 HTML_IMAGE_RATIO_06 8621 3.06 3.87 2.69 85 HTML_MIME_NO_HTML_TAG 8482 2.55 2.34 2.65 86 RCVD_IN_IADB_SPF 8315 1.97 0.59 2.59 87 DKIM_INVALID 8089 3.74 6.39 2.52 88 MIME_HTML_ONLY_MULTI 7950 2.70 3.19 2.48 89 XM_B_SpammyTLD 7740 2.74 3.44 2.42 90 BAYES_05 7531 1.81 0.62 2.35 91 BAYES_999 7482 8.09 20.67 2.33 92 RCVD_IN_IADB_SENDERID 7397 1.76 0.57 2.31 93 INVALID_MSGID 7222 1.61 0.21 2.25 94 RCVD_IN_IADB_DK 7196 1.72 0.57 2.25 95 MIME_HTML_MOSTLY 7192 2.62 3.43 2.24 96 MIME_CHARSET_FARAWAY 6835 1.84 1.20 2.13 97 HTML_IMAGE_RATIO_08 6653 2.21 2.51 2.08 98 XM_B_URI_Unicode 6450 2.13 2.38 2.01 99 CHARSET_FARAWAY_HEADER 6407 1.67 0.94 2.00 100 RCVD_IN_IADB_VOUCHED 6321 1.44 0.26 1.97 101 TO_MALFORMED 6300 1.36 0.03 1.97 102 TM2_M_BODY_EMPTY 6215 1.35 0.07 1.94 103 XM_DK_Undo_01 6088 1.67 1.15 1.90 104 XM_CamelCaseFrm001 5893 2.20 2.99 1.84 105 FROM_EXCESS_BASE64 5846 1.84 1.88 1.82 106 TR_Symld_Words 5801 3.27 6.47 1.81 107 TooManyTo_003 5660 1.37 0.51 1.77 108 T_XMDrugObfuBody_14 5589 2.47 4.05 1.74 109 TR_XM_SpammyRelay 5549 4.41 10.27 1.73 110 TR_XM_DKIM_Undo 5306 9.28 25.96 1.66 111 TM2_M_URI_OPT_OUT 5205 1.84 2.32 1.62 112 XMEmptyBody_01 5183 1.12 0.04 1.62 113 XMDiploma_00 5098 1.95 2.73 1.59 114 URI_NOVOWEL 5076 1.38 0.94 1.58 115 SUBJ_ALL_CAPS 4955 1.55 1.57 1.55 116 XM_SendGrid 4946 1.39 1.04 1.54 117 XMLngstWrd_00 4897 1.25 0.65 1.53 118 XMSexyCombo_05 4820 2.27 3.94 1.50 119 XM_B_Investor 4748 2.56 4.93 1.48 120 UNTRUSTED_Relay 4546 2.69 5.46 1.42 121 TR_XM_PhishingBody 4533 2.50 4.88 1.41 122 RCVD_IN_IADB_OPTIN 4494 1.01 0.15 1.40 123 TR_XM_UnparsRelay 4467 3.23 7.24 1.39 124 IN_HORDE_ADDRESS_BOOK 4409 0.98 0.12 1.38 125 TR_XM_SpammyWords5 4314 1.95 3.28 1.35 126 XM_SPF_SoftFail 4231 1.79 2.81 1.32 127 HELO_NODOT 4203 1.02 0.37 1.31 128 XM_B_Unsub2 4203 1.70 2.55 1.31 129 XMCapTrack 4199 1.07 0.54 1.31 130 HELO_NO_DOMAIN 4195 1.01 0.37 1.31 131 URI_HEX 4129 1.33 1.42 1.29 132 TooManyTo_004 4116 1.03 0.47 1.28 133 T_TooManySym_03 4014 0.92 0.20 1.25 134 T_XMDrugObfuBody_08 3995 1.85 3.19 1.25 135 XMStockSpam_06 3831 1.38 1.78 1.20 136 XM_GoogleGroups 3820 1.08 0.82 1.19 137 BOTNET 3815 4.07 10.36 1.19 138 TR_DCC_Bayes_99 3750 6.73 18.89 1.17 139 XMGappySubj_01 3735 0.84 0.14 1.17 140 TVD_SPACE_RATIO 3464 0.82 0.25 1.08 141 TooManyTo_005 3384 0.86 0.43 1.06 142 T_FILL_THIS_FORM_SHORT 3318 1.17 1.45 1.04 143 DKIM_ADSP_CUSTOM_MED 3307 0.97 0.84 1.03 144 XM_OfRef6 3293 1.60 2.84 1.03 145 TR_XM_DK_SendGrid 3235 0.90 0.65 1.01 146 XM_ShortIntro_01 2968 0.78 0.46 0.93 147 XMBdyGiftCard01 2965 1.01 1.20 0.93 148 XM_B_COPY_HTML 2938 1.18 1.77 0.92 149 SpammyFromTLD_01 2867 1.09 1.53 0.89 150 RELAYCOUNTRY_CA 2780 2.34 5.55 0.87 151 XM_UB50 2773 1.56 3.08 0.87 152 XMGenDplmaNmb 2719 1.02 1.38 0.85 153 XM_H_Long_From02 2648 0.90 1.08 0.83 154 XM_H_PHPMailer 2637 0.78 0.70 0.82 155 HTTPS_HTTP_MISMATCH 2514 0.91 1.20 0.78 156 XMBrknScrpt_02 2498 1.05 1.63 0.78 157 XMGappySubj_02 2494 0.55 0.06 0.78 158 XMNoVowels 2487 0.71 0.56 0.78 159 TR_MetaPhish_Combo_01 2430 0.96 1.39 0.76 160 LOW_PRICE 2211 0.55 0.26 0.69 161 XM_B_SpammyWords4 2185 1.19 2.30 0.68 162 NML_ADSP_CUSTOM_MED 2142 0.65 0.60 0.67 163 RCVD_IN_PBL 2122 0.77 1.01 0.66 164 T_OBFU_PDF_ATTACH 2112 0.53 0.24 0.66 165 FORGED_GMAIL_RCVD 2105 0.63 0.56 0.66 166 FROM_GOV_DKIM_AU 2092 0.49 0.12 0.65 167 T_XMDrugObfuBody_00 2082 0.94 1.56 0.65 168 T_TVD_MIME_NO_HEADERS 2069 0.45 0.04 0.65 169 HTML_IMAGE_ONLY_20 2068 0.71 0.85 0.65 170 TO_NO_BRKTS_HTML_ONLY 2027 0.57 0.43 0.63 171 URI_TRY_3LD 2023 0.80 1.17 0.63 172 TVD_RCVD_IP 1996 0.66 0.74 0.62 173 T_XMHurry_00 1930 1.05 2.04 0.60 174 HTML_TAG_BALANCE_BODY 1868 0.83 1.37 0.58 175 MPART_ALT_DIFF_COUNT 1783 0.70 1.01 0.56 176 TR_XM_Base64_M1 1764 0.61 0.73 0.55 177 T_Symld_Words_02 1756 0.68 0.98 0.55 178 XMSlimDrugH 1748 0.58 0.64 0.55 179 XMBody_95 1743 0.43 0.18 0.54 180 MSGID_FROM_MTA_HEADER 1695 0.40 0.12 0.53 181 XMLngstWrd_01 1667 0.48 0.40 0.52 182 XM_B_DNDMA 1617 0.60 0.81 0.50 183 RELAYCOUNTRY_GB 1572 0.58 0.77 0.49 184 RCVD_IN_BL_SPAMCOP_NET 1562 2.67 7.46 0.49 185 T_MANY_PILL_PRICE 1561 0.34 0.01 0.49 186 FROM_GOV_SPOOF 1554 0.38 0.14 0.48 187 XMPhish30 1543 0.82 1.56 0.48 188 PLING_QUERY 1535 0.58 0.81 0.48 189 XM_ProductURIs 1524 0.63 0.98 0.48 190 RELAYCOUNTRY_AU 1480 1.06 2.36 0.46 191 XMSubMetaI_00 1449 0.73 1.35 0.45 192 MISSING_HEADERS 1437 0.50 0.63 0.45 193 TR_XM_PHPDW 1424 0.68 1.19 0.44 194 TR_XM_PHPForged 1418 0.68 1.21 0.44 195 TM2_M_OBFU_COMMENT 1415 0.58 0.88 0.44 196 TR_XM_FormFill2 1414 0.67 1.18 0.44 197 XM_B_FormFill 1412 0.31 0.04 0.44 198 XMBSHREFv2 1391 0.40 0.33 0.43 199 XM_H_PHPOS 1381 0.66 1.16 0.43 200 LongTLD 1355 0.61 1.03 0.42 ----------------------------------------------------------------------