Email: 444032 Autolearn: 0 AvgScore: 5.12 AvgScanTime: 1.33 sec Spam: 150549 Autolearn: 0 AvgScore: 14.44 AvgScanTime: 1.41 sec Ham: 293483 Autolearn: 0 AvgScore: 0.34 AvgScanTime: 1.29 sec Time Spent Running SA: 163.74 hours Time Spent Processing Spam: 58.93 hours Time Spent Processing Ham: 104.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143451 89.74 95.29 86.89 2 DKIM_SIGNED 136805 81.26 90.87 76.33 3 XM_DK_Pass 127630 78.26 84.78 74.92 4 XM_B_Unicode 127605 75.97 84.76 71.46 5 RELAYCOUNTRY_US 126287 82.74 83.88 82.15 6 DKIM_VALID 125698 77.16 83.49 73.91 7 DCC_CHECK 116638 53.51 77.48 41.22 8 XM_B_SpammyWords 108884 55.18 72.32 46.39 9 XMListUnsubscribeExists 105115 57.13 69.82 50.62 10 DKIM_VALID_AU 96165 60.90 63.88 59.37 11 XM_B_Unicode3 76552 45.33 50.85 42.51 12 LOC_TINY_FONT_1 75577 36.10 50.20 28.86 13 XM_B_SpammyWords2 63755 27.20 42.35 19.44 14 BAYES_50 61642 54.87 40.94 62.01 15 RCVD_IN_MSPIKE_H2 60218 37.99 40.00 36.96 16 XM_DK_Undo_02 58868 16.97 39.10 5.62 17 HTML_FONT_LOW_CONTRAST 57431 31.95 38.15 28.78 18 FVGT_m_MULTI_ODD 51567 28.97 34.25 26.26 19 T_KAM_HTML_FONT_INVALID 47422 26.09 31.50 23.32 20 TR_XM_DKIM_Undo 44682 11.97 29.68 2.89 21 DKIM_VALID_EF 43876 29.03 29.14 28.96 22 BAYES_99 43280 12.48 28.75 4.13 23 MIME_HTML_ONLY 41252 22.99 27.40 20.72 24 XMSubLong 37649 24.29 25.01 23.93 25 BAYES_999 33305 9.67 22.12 3.29 26 DCC_CHECK_NEGATIVE 32136 46.05 21.35 58.72 27 TR_DCC_Bayes_99 31928 8.38 21.21 1.80 28 XM_Multi_Part_URI 31623 16.04 21.01 13.49 29 TR_XM_DK_Unsub 31358 15.71 20.83 13.08 30 UNPARSEABLE_RELAY 30612 15.19 20.33 12.55 31 T_TM2_M_HEADER_IN_MSG 30500 26.16 20.26 29.19 32 XM_B_Unsub 26933 12.22 17.89 9.31 33 TR_XM_BayesUnsub 26068 10.55 17.32 7.09 34 TR_MAX_INTL_RELAY 23817 8.92 15.82 5.38 35 RELAYCOUNTRY_META 23189 7.59 15.40 3.57 36 XM_B_SpammyWords3 23048 8.44 15.31 4.92 37 LOTS_OF_MONEY 20418 9.03 13.56 6.70 38 TR_XM_SpammyWords4 18466 7.07 12.27 4.40 39 TR_XM_SpammyWords2 17583 4.30 11.68 0.52 40 TR_XM_SpammyRelay 17065 5.11 11.34 1.92 41 RCVD_IN_BL_SPAMCOP_NET 16286 4.09 10.82 0.64 42 TR_XM_UnparsRelay 16279 4.58 10.81 1.39 43 BOTNET 15504 4.50 10.30 1.52 44 BOTNET_IPINHOSTNAME 15450 5.73 10.26 3.40 45 FSL_BULK_SIG 15277 8.43 10.15 7.54 46 BAYES_80 15014 5.56 9.97 3.30 47 BAYES_60 14280 7.65 9.49 6.71 48 XM_Evil_Numbers_Gen 14107 9.78 9.37 10.00 49 T_SCC_BODY_TEXT_LINE 11843 8.23 7.87 8.41 50 TR_XM_SPAMCOP 11743 2.88 7.80 0.36 51 XM_B_Phish_Phrases 11667 6.29 7.75 5.54 52 LotsOfNums_01 11421 8.37 7.59 8.77 53 XM_Body_Dirty_Words 11193 4.21 7.43 2.55 54 DKIM_INVALID 11107 4.10 7.38 2.42 55 XMSubMetaSx_00 9960 5.01 6.62 4.18 56 RELAYCOUNTRY_CA 9264 2.76 6.15 1.02 57 MPART_ALT_DIFF 9222 5.06 6.13 4.52 58 HTML_IMAGE_RATIO_02 9055 5.01 6.01 4.49 59 UNTRUSTED_Relay 8849 2.91 5.88 1.39 60 HTML_IMAGE_RATIO_04 8762 4.98 5.82 4.55 61 XM_UncommonTLD01 8663 4.72 5.75 4.19 62 BAYES_95 8246 3.23 5.48 2.08 63 XM_B_PhoneNumber 7703 7.67 5.12 8.98 64 XM_H_GMP 7346 5.21 4.88 5.39 65 XMStrtUSub 7038 4.69 4.67 4.69 66 XM_B_Investor 7020 2.58 4.66 1.51 67 XM_H_Long_From01 6869 5.33 4.56 5.73 68 RCVD_IN_VALIDITY_RPBL 6611 1.56 4.39 0.10 69 TM2_M_VERY_LONG_WORD 6329 2.93 4.20 2.27 70 TR_XM_PhishingBody 6188 2.57 4.11 1.78 71 XMSexyCombo_05 6161 2.69 4.09 1.97 72 T_XMDrugObfuBody_14 6145 2.73 4.08 2.04 73 XM_OfRef6 5725 2.04 3.80 1.14 74 XM_B_SpammyTLD 5547 2.98 3.68 2.61 75 MIME_HTML_MOSTLY 5519 2.72 3.67 2.24 76 XMDiploma_00 5480 2.31 3.64 1.62 77 HTML_IMAGE_RATIO_06 5438 3.19 3.61 2.97 78 TR_XM_SpammyWords5 5158 2.19 3.43 1.55 79 RCVD_IN_MSPIKE_H3 5095 4.43 3.38 4.96 80 RCVD_IN_MSPIKE_WL 5095 4.43 3.38 4.96 81 KHOP_HELO_FCRDNS 4812 2.25 3.20 1.77 82 MIME_HTML_ONLY_MULTI 4751 2.80 3.16 2.62 83 HTML_IMAGE_RATIO_08 4740 2.58 3.15 2.29 84 XM_SPF_SoftFail 4725 1.94 3.14 1.33 85 TooManyTo_001 4666 6.40 3.10 8.10 86 T_XMDrugObfuBody_08 4614 2.45 3.06 2.13 87 XMNumbers 4482 3.08 2.98 3.13 88 MIME_QP_LONG_LINE 4457 4.49 2.96 5.28 89 XM_B_Unsub2 4390 1.95 2.92 1.45 90 XM_B_URI_Unicode 4273 2.21 2.84 1.89 91 XM_CamelCaseFrm001 4272 2.63 2.84 2.53 92 T_XMHurry_00 4155 1.68 2.76 1.12 93 T_TooManySym_01 4108 4.81 2.73 5.88 94 XM_UB50 3970 1.44 2.64 0.83 95 DIET_1 3911 1.18 2.60 0.45 96 T_XMDrugObfuBody_00 3791 1.43 2.52 0.87 97 TR_XM_NoHeaderRelay 3761 0.95 2.50 0.15 98 RCVD_IN_VALIDITY_SAFE 3720 3.86 2.47 4.57 99 RELAYCOUNTRY_AU 3653 1.27 2.43 0.67 100 XM_URI_RBL 3605 1.07 2.39 0.38 101 HTML_MIME_NO_HTML_TAG 3598 2.60 2.39 2.71 102 XMBody_17 3575 1.14 2.37 0.51 103 XM_B_SpammyWords4 3549 1.27 2.36 0.71 104 MAILING_LIST_MULTI 3526 2.58 2.34 2.70 105 TM2_M_URI_OPT_OUT 3488 2.08 2.32 1.95 106 XMStockSpam_06 3399 1.61 2.26 1.28 107 DKIM_ADSP_NXDOMAIN 3312 0.96 2.20 0.33 108 T_REMOTE_IMAGE 3152 3.19 2.09 3.75 109 TR_XM_INV_DKIM 3124 0.81 2.08 0.16 110 RCVD_IN_VALIDITY_CERTIFIED 3077 2.82 2.04 3.22 111 SpammyFromTLD_02 2995 0.98 1.99 0.46 112 USER_IN_DEF_DKIM_WL 2879 9.87 1.91 13.96 113 SUBJ_ALL_CAPS 2811 1.80 1.87 1.76 114 ALL_TRUSTED 2797 10.51 1.86 14.94 115 FROM_EXCESS_BASE64 2738 1.97 1.82 2.04 116 XMGenDplmaNmb 2606 1.16 1.73 0.87 117 TR_LOTS_OF_MONEY3 2568 0.90 1.71 0.49 118 XMBdyGiftCard01 2503 1.37 1.66 1.23 119 SpammyFromTLD_01 2499 1.04 1.66 0.73 120 NO_DNS_FOR_FROM 2483 0.83 1.65 0.40 121 TR_XM_MaxWHORU 2467 0.78 1.64 0.34 122 ANY_BOUNCE_MESSAGE 2371 3.38 1.57 4.31 123 BOUNCE_MESSAGE 2369 3.38 1.57 4.31 124 URI_HEX 2325 1.30 1.54 1.17 125 BAYES_40 2301 4.04 1.53 5.33 126 XMSubMetaI_00 2262 0.93 1.50 0.63 127 XMBrknScrpt_02 2243 1.13 1.49 0.94 128 T_FILL_THIS_FORM_SHORT 2242 1.11 1.49 0.91 129 XM_SendGrid 2211 1.43 1.47 1.41 130 RCVD_IN_PSBL 2200 0.62 1.46 0.19 131 XM_B_COPY_HTML 2142 1.05 1.42 0.87 132 XMPhish30 2121 1.01 1.41 0.80 133 XM_DIRTYINTL 1970 0.51 1.31 0.10 134 XM_DK_Undo_01 1958 1.48 1.30 1.57 135 XM_H_Long_From02 1913 0.95 1.27 0.79 136 RELAYCOUNTRY_FR 1880 0.58 1.25 0.23 137 BAYES_20 1872 2.85 1.24 3.67 138 HTML_FONT_TINY_NORDNS 1852 0.45 1.23 0.04 139 XM_H_DKIM_GOOG 1838 0.43 1.22 0.03 140 LongTLD 1835 0.72 1.22 0.47 141 SHOPIFY_IMG_NOT_RCVD_SFY 1831 0.62 1.22 0.31 142 MPART_ALT_DIFF_COUNT 1788 0.75 1.19 0.52 143 HTTPS_HTTP_MISMATCH 1773 0.82 1.18 0.63 144 SHORTCIRCUIT 1731 0.39 1.15 0.00 145 RCVD_IN_ZEN_LASTEXTERNAL 1731 0.39 1.15 0.00 146 XM_B_SEO 1717 0.54 1.14 0.23 147 THIS_AD 1714 0.70 1.14 0.47 148 TR_XM_PHPDW 1697 0.70 1.13 0.48 149 UNICODE_OBFU_ASC 1694 0.39 1.13 0.01 150 TR_XM_PHPForged 1683 0.70 1.12 0.48 151 URI_TRY_3LD 1679 0.82 1.12 0.67 152 URI_NOVOWEL 1674 1.56 1.11 1.78 153 TR_XM_FormFill2 1672 0.70 1.11 0.48 154 TR_MetaPhish_Combo_01 1665 0.74 1.11 0.56 155 XM_ProductURIs 1664 0.79 1.11 0.63 156 XM_H_PHPOS 1636 0.68 1.09 0.47 157 XM_B_DNDMA 1620 0.82 1.08 0.68 158 XMBody_78 1608 0.59 1.07 0.34 159 TR_XM_SEO4 1586 0.43 1.05 0.11 160 XM_OfRef7 1555 0.56 1.03 0.32 161 BOTNET_NORDNS 1545 0.35 1.03 0.01 162 XMReplyNow 1529 0.50 1.02 0.24 163 TM2_M_OBFU_COMMENT 1514 0.61 1.01 0.41 164 XM_B_REG_HTML 1484 0.49 0.99 0.24 165 XMSexyCombo_01 1484 0.46 0.99 0.19 166 FILL_THIS_FORM 1478 0.60 0.98 0.41 167 T_STY_INVIS_DIRECT 1474 0.66 0.98 0.50 168 MultiRelay_CC 1472 0.40 0.98 0.11 169 XM_B_Phish66 1470 0.55 0.98 0.33 170 DKIM_ADSP_CUSTOM_MED 1466 0.82 0.97 0.74 171 XM_UB60 1444 0.38 0.96 0.08 172 RCVD_IN_PBL 1400 0.70 0.93 0.58 173 SUSP_UTF8_WORD_SUBJ 1395 0.69 0.93 0.56 174 TR_Symld_Words 1386 1.41 0.92 1.66 175 HTML_TAG_BALANCE_BODY 1372 0.70 0.91 0.60 176 XM_S_SpammyWords 1344 0.44 0.89 0.21 177 TR_XM_Spammywords 1344 0.44 0.89 0.21 178 XM_UB99 1341 0.30 0.89 0.00 179 MAY_BE_FORGED 1319 0.96 0.88 1.00 180 XM_HighProb1 1318 0.30 0.88 0.01 181 XM_PDF 1312 3.59 0.87 4.98 182 URIBL_BLACK 1307 0.33 0.87 0.06 183 FUZZY_UNSUBSCRIBE 1269 0.29 0.84 0.00 184 FUZZY_PRIVACY 1267 0.29 0.84 0.00 185 XM_H_Undi_Recip 1266 0.40 0.84 0.18 186 XMHTML_After_End 1266 0.52 0.84 0.36 187 TR_XM_DK_SendGrid 1239 0.88 0.82 0.91 188 RDNS_DYNAMIC 1239 0.43 0.82 0.24 189 NORDNS_LOW_CONTRAST 1234 0.30 0.82 0.03 190 TR_XM_InvalidRelay 1217 0.28 0.81 0.01 191 NML_ADSP_CUSTOM_MED 1203 0.61 0.80 0.51 192 XM_RXBody 1200 0.75 0.80 0.72 193 RCVD_IN_IADB_LISTED 1195 2.71 0.79 3.69 194 TR_Mismatch_TLD_02 1194 0.31 0.79 0.06 195 TR_XM_Base64_M1 1185 0.80 0.79 0.80 196 FORGED_GMAIL_RCVD 1151 0.55 0.76 0.44 197 BAYES_00 1142 7.23 0.76 10.56 198 XM_UB80 1140 0.27 0.76 0.01 199 HTML_FONT_FACE_BAD 1129 0.55 0.75 0.44 200 PDS_RDNS_DYNAMIC_FP 1120 0.32 0.74 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 255018 89.74 95.29 86.89 2 RELAYCOUNTRY_US 241083 82.74 83.88 82.15 3 DKIM_SIGNED 224022 81.26 90.87 76.33 4 XM_DK_Pass 219871 78.26 84.78 74.92 5 DKIM_VALID 216907 77.16 83.49 73.91 6 XM_B_Unicode 209721 75.97 84.76 71.46 7 BAYES_50 181979 54.87 40.94 62.01 8 DKIM_VALID_AU 174247 60.90 63.88 59.37 9 DCC_CHECK_NEGATIVE 172346 46.05 21.35 58.72 10 XMListUnsubscribeExists 148555 57.13 69.82 50.62 11 XM_B_SpammyWords 136137 55.18 72.32 46.39 12 XM_B_Unicode3 124749 45.33 50.85 42.51 13 DCC_CHECK 120978 53.51 77.48 41.22 14 RCVD_IN_MSPIKE_H2 108480 37.99 40.00 36.96 15 T_TM2_M_HEADER_IN_MSG 85667 26.16 20.26 29.19 16 DKIM_VALID_EF 85005 29.03 29.14 28.96 17 LOC_TINY_FONT_1 84708 36.10 50.20 28.86 18 HTML_FONT_LOW_CONTRAST 84454 31.95 38.15 28.78 19 FVGT_m_MULTI_ODD 77065 28.97 34.25 26.26 20 XMSubLong 70227 24.29 25.01 23.93 21 T_KAM_HTML_FONT_INVALID 68443 26.09 31.50 23.32 22 MIME_HTML_ONLY 60821 22.99 27.40 20.72 23 XM_B_SpammyWords2 57040 27.20 42.35 19.44 24 ALL_TRUSTED 43860 10.51 1.86 14.94 25 USER_IN_DEF_DKIM_WL 40968 9.87 1.91 13.96 26 XM_Multi_Part_URI 39601 16.04 21.01 13.49 27 TR_XM_DK_Unsub 38386 15.71 20.83 13.08 28 UNPARSEABLE_RELAY 36837 15.19 20.33 12.55 29 BAYES_00 30978 7.23 0.76 10.56 30 XM_Evil_Numbers_Gen 29341 9.78 9.37 10.00 31 XM_B_Unsub 27331 12.22 17.89 9.31 32 XM_B_PhoneNumber 26368 7.67 5.12 8.98 33 LotsOfNums_01 25748 8.37 7.59 8.77 34 T_SCC_BODY_TEXT_LINE 24681 8.23 7.87 8.41 35 TooManyTo_001 23766 6.40 3.10 8.10 36 FSL_BULK_SIG 22139 8.43 10.15 7.54 37 XM_DKIMWhitelistDomains 20961 4.78 0.19 7.14 38 TR_XM_DK_Bayes 20902 4.93 0.65 7.12 39 TR_XM_BayesUnsub 20797 10.55 17.32 7.09 40 TR_XM_DK_Bayes1 20583 4.85 0.65 7.01 41 IN_ZIMBRA_NJ_WHITELIST 19711 4.48 0.13 6.72 42 BAYES_60 19692 7.65 9.49 6.71 43 LOTS_OF_MONEY 19673 9.03 13.56 6.70 44 TR_XM_DK_Bayes2 17551 4.13 0.51 5.98 45 T_TooManySym_01 17255 4.81 2.73 5.88 46 XM_H_Long_From01 16818 5.33 4.56 5.73 47 XM_DK_Undo_02 16504 16.97 39.10 5.62 48 XM_B_Phish_Phrases 16257 6.29 7.75 5.54 49 XM_H_GMP 15805 5.21 4.88 5.39 50 TR_MAX_INTL_RELAY 15789 8.92 15.82 5.38 51 BAYES_40 15634 4.04 1.53 5.33 52 MIME_QP_LONG_LINE 15488 4.49 2.96 5.28 53 XM_PDF 14620 3.59 0.87 4.98 54 RCVD_IN_MSPIKE_WL 14570 4.43 3.38 4.96 55 RCVD_IN_MSPIKE_H3 14570 4.43 3.38 4.96 56 XM_B_SpammyWords3 14445 8.44 15.31 4.92 57 XMStrtUSub 13774 4.69 4.67 4.69 58 RCVD_IN_VALIDITY_SAFE 13418 3.86 2.47 4.57 59 HTML_IMAGE_RATIO_04 13346 4.98 5.82 4.55 60 MPART_ALT_DIFF 13266 5.06 6.13 4.52 61 HTML_IMAGE_RATIO_02 13173 5.01 6.01 4.49 62 TR_XM_SpammyWords4 12913 7.07 12.27 4.40 63 BOUNCE_MESSAGE 12643 3.38 1.57 4.31 64 ANY_BOUNCE_MESSAGE 12643 3.38 1.57 4.31 65 XM_UncommonTLD01 12293 4.72 5.75 4.19 66 XMSubMetaSx_00 12269 5.01 6.62 4.18 67 BAYES_99 12113 12.48 28.75 4.13 68 T_REMOTE_IMAGE 11005 3.19 2.09 3.75 69 RCVD_IN_IADB_LISTED 10832 2.71 0.79 3.69 70 BAYES_20 10763 2.85 1.24 3.67 71 RELAYCOUNTRY_META 10491 7.59 15.40 3.57 72 BOTNET_IPINHOSTNAME 9990 5.73 10.26 3.40 73 BAYES_80 9673 5.56 9.97 3.30 74 BAYES_999 9650 9.67 22.12 3.29 75 RCVD_IN_IADB_SPF 9592 2.41 0.73 3.27 76 RCVD_IN_VALIDITY_CERTIFIED 9445 2.82 2.04 3.22 77 XMNumbers 9189 3.08 2.98 3.13 78 T_TooManySym_02 8948 2.21 0.56 3.05 79 TooManyTo_002 8750 2.13 0.46 2.98 80 HTML_IMAGE_RATIO_06 8721 3.19 3.61 2.97 81 RCVD_IN_IADB_SENDERID 8521 2.16 0.71 2.90 82 TR_XM_DKIM_Undo 8467 11.97 29.68 2.89 83 RCVD_IN_IADB_DK 8380 2.13 0.72 2.86 84 HTML_MIME_NO_HTML_TAG 7953 2.60 2.39 2.71 85 MAILING_LIST_MULTI 7911 2.58 2.34 2.70 86 MIME_HTML_ONLY_MULTI 7675 2.80 3.16 2.62 87 XM_B_SpammyTLD 7672 2.98 3.68 2.61 88 XM_Body_Dirty_Words 7482 4.21 7.43 2.55 89 XM_CamelCaseFrm001 7420 2.63 2.84 2.53 90 INVALID_MSGID 7167 1.71 0.28 2.44 91 RCVD_IN_IADB_VOUCHED 7129 1.70 0.28 2.43 92 DKIM_INVALID 7115 4.10 7.38 2.42 93 HTML_IMAGE_RATIO_08 6714 2.58 3.15 2.29 94 TM2_M_VERY_LONG_WORD 6660 2.93 4.20 2.27 95 MIME_HTML_MOSTLY 6566 2.72 3.67 2.24 96 BAYES_05 6539 1.71 0.69 2.23 97 TO_MALFORMED 6292 1.43 0.03 2.14 98 T_XMDrugObfuBody_08 6265 2.45 3.06 2.13 99 BAYES_95 6109 3.23 5.48 2.08 100 FROM_EXCESS_BASE64 5993 1.97 1.82 2.04 101 T_XMDrugObfuBody_14 5990 2.73 4.08 2.04 102 XMSexyCombo_05 5776 2.69 4.09 1.97 103 TM2_M_URI_OPT_OUT 5726 2.08 2.32 1.95 104 TR_XM_SpammyRelay 5634 5.11 11.34 1.92 105 XM_B_URI_Unicode 5551 2.21 2.84 1.89 106 TR_DCC_Bayes_99 5288 8.38 21.21 1.80 107 TR_XM_PhishingBody 5237 2.57 4.11 1.78 108 URI_NOVOWEL 5236 1.56 1.11 1.78 109 KHOP_HELO_FCRDNS 5189 2.25 3.20 1.77 110 SUBJ_ALL_CAPS 5176 1.80 1.87 1.76 111 RCVD_IN_IADB_OPTIN 5113 1.21 0.17 1.74 112 TR_Symld_Words 4886 1.41 0.92 1.66 113 TooManyTo_003 4799 1.22 0.41 1.64 114 XMDiploma_00 4758 2.31 3.64 1.62 115 XM_DK_Undo_01 4615 1.48 1.30 1.57 116 TR_XM_SpammyWords5 4555 2.19 3.43 1.55 117 BOTNET 4473 4.50 10.30 1.52 118 XM_B_Investor 4444 2.58 4.66 1.51 119 IN_HORDE_ADDRESS_BOOK 4393 1.02 0.08 1.50 120 XM_B_Unsub2 4265 1.95 2.92 1.45 121 XM_SendGrid 4135 1.43 1.47 1.41 122 TR_XM_UnparsRelay 4070 4.58 10.81 1.39 123 UNTRUSTED_Relay 4065 2.91 5.88 1.39 124 XM_SPF_SoftFail 3892 1.94 3.14 1.33 125 TVD_SPACE_RATIO 3843 0.93 0.18 1.31 126 XMStockSpam_06 3768 1.61 2.26 1.28 127 T_TooManySym_03 3748 0.93 0.24 1.28 128 XMBdyGiftCard01 3598 1.37 1.66 1.23 129 XM_GoogleGroups 3493 1.00 0.63 1.19 130 TooManyTo_004 3453 0.90 0.36 1.18 131 URI_HEX 3447 1.30 1.54 1.17 132 HTML_IMAGE_ONLY_32 3415 0.84 0.22 1.16 133 XMGappySubj_01 3408 0.95 0.53 1.16 134 XM_OfRef6 3347 2.04 3.80 1.14 135 T_XMHurry_00 3299 1.68 2.76 1.12 136 HELO_NODOT 3215 0.80 0.24 1.10 137 HELO_NO_DOMAIN 3208 0.80 0.23 1.09 138 RELAYCOUNTRY_CA 2985 2.76 6.15 1.02 139 MAY_BE_FORGED 2942 0.96 0.88 1.00 140 XMCapTrack 2901 0.77 0.35 0.99 141 T_OBFU_PDF_ATTACH 2881 0.69 0.13 0.98 142 TooManyTo_005 2820 0.75 0.34 0.96 143 XMBrknScrpt_02 2772 1.13 1.49 0.94 144 XMLngstWrd_00 2707 0.85 0.70 0.92 145 T_FILL_THIS_FORM_SHORT 2684 1.11 1.49 0.91 146 TR_XM_DK_SendGrid 2666 0.88 0.82 0.91 147 FROM_GOV_DKIM_AU 2606 0.63 0.13 0.89 148 XMSubMetaSSx_00 2562 0.82 0.71 0.87 149 T_XMDrugObfuBody_00 2557 1.43 2.52 0.87 150 XMGenDplmaNmb 2549 1.16 1.73 0.87 151 XM_B_COPY_HTML 2540 1.05 1.42 0.87 152 XM_UB50 2433 1.44 2.64 0.83 153 TR_XM_Base64_M1 2359 0.80 0.79 0.80 154 XMPhish30 2347 1.01 1.41 0.80 155 XM_H_Long_From02 2324 0.95 1.27 0.79 156 XM_ShortIntro_01 2302 0.62 0.31 0.78 157 XM_H_PHPMailer 2287 0.76 0.72 0.78 158 DKIM_ADSP_CUSTOM_MED 2171 0.82 0.97 0.74 159 SpammyFromTLD_01 2137 1.04 1.66 0.73 160 XM_RXBody 2120 0.75 0.80 0.72 161 XM_B_SpammyWords4 2071 1.27 2.36 0.71 162 TO_NO_BRKTS_HTML_ONLY 2020 0.56 0.30 0.69 163 XMGappySubj_02 2011 0.48 0.07 0.69 164 TVD_RCVD_IP 2000 0.67 0.64 0.68 165 XM_B_DNDMA 2000 0.82 1.08 0.68 166 RELAYCOUNTRY_AU 1968 1.27 2.43 0.67 167 XMSubMetaSxObfu_03 1968 0.68 0.69 0.67 168 URI_TRY_3LD 1962 0.82 1.12 0.67 169 T_TVD_MIME_NO_HEADERS 1918 0.44 0.03 0.65 170 XM_B_FormFill 1877 0.43 0.02 0.64 171 RCVD_IN_BL_SPAMCOP_NET 1869 4.09 10.82 0.64 172 XMSubNoVowel 1863 0.54 0.37 0.63 173 XMSubMetaI_00 1855 0.93 1.50 0.63 174 HTTPS_HTTP_MISMATCH 1852 0.82 1.18 0.63 175 XM_ProductURIs 1838 0.79 1.11 0.63 176 XMNoVowels 1823 0.58 0.51 0.62 177 XMBody_95 1771 0.47 0.20 0.60 178 HTML_TAG_BALANCE_BODY 1753 0.70 0.91 0.60 179 RCVD_IN_PBL 1711 0.70 0.93 0.58 180 TM2_M_BODY_EMPTY 1661 0.39 0.06 0.57 181 SUSP_UTF8_WORD_SUBJ 1656 0.69 0.93 0.56 182 TR_MetaPhish_Combo_01 1643 0.74 1.11 0.56 183 XMLngstWrd_01 1605 0.53 0.48 0.55 184 MPART_ALT_DIFF_COUNT 1530 0.75 1.19 0.52 185 TR_XM_SpammyWords2 1528 4.30 11.68 0.52 186 XMDateMe_00 1513 0.48 0.42 0.52 187 NML_ADSP_CUSTOM_MED 1507 0.61 0.80 0.51 188 XMBody_17 1498 1.14 2.37 0.51 189 HTML_IMAGE_ONLY_20 1496 0.52 0.53 0.51 190 T_STY_INVIS_DIRECT 1471 0.66 0.98 0.50 191 XMSolicitRefs_0 1451 0.46 0.39 0.49 192 TR_LOTS_OF_MONEY3 1449 0.90 1.71 0.49 193 MSGID_FROM_MTA_HEADER 1439 0.38 0.18 0.49 194 TR_XM_PHPForged 1422 0.70 1.12 0.48 195 TR_XM_PHPDW 1418 0.70 1.13 0.48 196 TR_XM_FormFill2 1417 0.70 1.11 0.48 197 XMBSHREFv2 1394 0.49 0.53 0.47 198 RELAYCOUNTRY_GB 1388 0.54 0.67 0.47 199 XM_H_PHPOS 1387 0.68 1.09 0.47 200 THIS_AD 1383 0.70 1.14 0.47 ----------------------------------------------------------------------