Email: 520983 Autolearn: 0 AvgScore: 4.72 AvgScanTime: 1.41 sec Spam: 169059 Autolearn: 0 AvgScore: 14.02 AvgScanTime: 1.56 sec Ham: 351924 Autolearn: 0 AvgScore: 0.25 AvgScanTime: 1.34 sec Time Spent Running SA: 203.65 hours Time Spent Processing Spam: 73.13 hours Time Spent Processing Ham: 130.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159260 90.28 94.20 88.40 2 XM_B_Unicode 143461 76.76 84.86 72.87 3 DKIM_SIGNED 135396 73.43 80.09 70.24 4 XM_DK_Pass 129029 71.38 76.32 69.00 5 RELAYCOUNTRY_US 126840 76.04 75.03 76.53 6 DKIM_VALID 125416 69.81 74.18 67.71 7 XM_B_SpammyWords 120536 54.49 71.30 46.42 8 DCC_CHECK 113106 46.76 66.90 37.08 9 XMListUnsubscribeExists 102610 50.69 60.69 45.89 10 DKIM_VALID_AU 99777 55.93 59.02 54.45 11 XM_B_Unicode3 91861 46.94 54.34 43.38 12 LOC_TINY_FONT_1 82567 36.62 48.84 30.75 13 BAYES_50 75873 56.19 44.88 61.62 14 XM_B_SpammyWords2 75560 27.79 44.69 19.67 15 HTML_FONT_LOW_CONTRAST 61185 30.76 36.19 28.15 16 RCVD_IN_MSPIKE_H2 61007 33.21 36.09 31.82 17 XM_DK_Undo_02 58996 14.09 34.90 4.09 18 FVGT_m_MULTI_ODD 55052 27.45 32.56 25.00 19 DCC_CHECK_NEGATIVE 53840 52.79 31.85 62.86 20 T_KAM_HTML_FONT_INVALID 53304 25.67 31.53 22.86 21 XM_Multi_Part_URI 48021 22.32 28.40 19.40 22 BAYES_99 46012 10.76 27.22 2.86 23 DKIM_VALID_EF 45091 27.03 26.67 27.20 24 MIME_HTML_ONLY 44279 21.33 26.19 18.99 25 TR_XM_DKIM_Undo 42489 9.45 25.13 1.92 26 XM_B_Unsub 40726 17.69 24.09 14.61 27 XMSubLong 39897 22.15 23.60 21.45 28 T_TM2_M_HEADER_IN_MSG 39285 27.01 23.24 28.82 29 TR_XM_BayesUnsub 39257 15.43 23.22 11.69 30 BAYES_999 35648 8.28 21.09 2.13 31 TR_DCC_Bayes_99 32317 7.06 19.12 1.27 32 TR_XM_DK_Unsub 31470 14.44 18.61 12.43 33 XM_B_SpammyWords3 28455 9.14 16.83 5.44 34 UNPARSEABLE_RELAY 27025 12.66 15.99 11.06 35 RELAYCOUNTRY_META 24105 6.92 14.26 3.40 36 TR_MAX_INTL_RELAY 24100 8.01 14.26 5.01 37 XM_B_Phish_Phrases 23754 8.84 14.05 6.34 38 LOTS_OF_MONEY 23481 8.64 13.89 6.11 39 XM_Evil_Numbers_Gen 21207 10.47 12.54 9.47 40 TR_XM_SpammyWords4 20629 6.68 12.20 4.03 41 ANY_BOUNCE_MESSAGE 19947 11.52 11.80 11.39 42 BOUNCE_MESSAGE 19947 11.52 11.80 11.39 43 ALL_TRUSTED 18891 17.63 11.17 20.73 44 TR_XM_SpammyWords2 18301 3.86 10.83 0.51 45 BOTNET_IPINHOSTNAME 17441 5.18 10.32 2.72 46 LotsOfNums_01 17083 9.25 10.10 8.84 47 TR_XM_SpammyRelay 16870 4.41 9.98 1.73 48 FSL_BULK_SIG 15838 7.65 9.37 6.83 49 BAYES_80 15141 4.98 8.96 3.06 50 TR_XM_UnparsRelay 14280 3.81 8.45 1.59 51 BOTNET 13552 3.41 8.02 1.20 52 RCVD_IN_BL_SPAMCOP_NET 13536 2.96 8.01 0.54 53 BAYES_60 13217 7.19 7.82 6.89 54 T_SCC_BODY_TEXT_LINE 13083 8.25 7.74 8.49 55 XM_Body_Dirty_Words 12202 4.26 7.22 2.84 56 XMSubMetaSx_00 11661 4.58 6.90 3.46 57 XM_B_PhoneNumber 11151 8.63 6.60 9.61 58 TR_XM_SPAMCOP 10983 2.30 6.50 0.28 59 HTML_IMAGE_RATIO_02 10354 4.76 6.12 4.11 60 TR_XM_PhishingBody 10242 3.20 6.06 1.83 61 MPART_ALT_DIFF 10164 5.23 6.01 4.85 62 DKIM_INVALID 9980 3.62 5.90 2.53 63 UNTRUSTED_Relay 9772 2.75 5.78 1.30 64 XM_B_Unsub2 9156 3.94 5.42 3.23 65 TM2_M_VERY_LONG_WORD 9142 3.74 5.41 2.95 66 XM_UncommonTLD01 9020 4.38 5.34 3.91 67 XM_B_Investor 9020 2.92 5.34 1.76 68 RELAYCOUNTRY_CA 9016 2.39 5.33 0.98 69 HTML_IMAGE_RATIO_04 8905 4.55 5.27 4.20 70 HTML_IMAGE_RATIO_06 8625 4.89 5.10 4.79 71 BAYES_95 8417 2.92 4.98 1.94 72 XM_B_SpammyTLD 8188 3.16 4.84 2.35 73 XM_H_Long_From01 8158 5.20 4.83 5.38 74 XM_H_GMP 7864 5.31 4.65 5.62 75 XMStrtUSub 7802 4.31 4.61 4.17 76 XMSexyCombo_05 7747 2.29 4.58 1.18 77 MIME_HTML_MOSTLY 6559 2.87 3.88 2.39 78 XM_OfRef6 6426 1.86 3.80 0.93 79 XMNumbers 6231 2.94 3.69 2.58 80 TR_XM_SpammyWords5 6135 2.02 3.63 1.25 81 XM_B_SpammyWords4 6000 1.73 3.55 0.86 82 TooManyTo_001 5953 6.58 3.52 8.04 83 HTML_IMAGE_RATIO_08 5908 3.30 3.49 3.21 84 T_XMDrugObfuBody_14 5658 2.41 3.35 1.96 85 T_XMDrugObfuBody_08 5246 2.28 3.10 1.88 86 MIME_HTML_ONLY_MULTI 5195 2.79 3.07 2.66 87 MIME_QP_LONG_LINE 5165 4.35 3.06 4.98 88 XM_UB50 5048 1.50 2.99 0.78 89 XM_B_URI_Unicode 4981 2.17 2.95 1.80 90 TM2_M_URI_OPT_OUT 4927 2.63 2.91 2.49 91 XMDiploma_00 4670 1.82 2.76 1.37 92 XM_CamelCaseFrm001 4615 2.13 2.73 1.84 93 XM_SPF_SoftFail 4460 1.82 2.64 1.42 94 RCVD_IN_MSPIKE_H3 4448 4.30 2.63 5.10 95 RCVD_IN_MSPIKE_WL 4448 4.30 2.63 5.11 96 KHOP_HELO_FCRDNS 4370 2.11 2.58 1.89 97 RELAYCOUNTRY_AU 4220 1.18 2.50 0.54 98 XMStockSpam_06 4189 1.32 2.48 0.77 99 XM_URI_RBL 4090 1.06 2.42 0.41 100 XMEqualsVooDoo_00 4034 0.89 2.39 0.18 101 XMBody_17 3976 1.05 2.35 0.43 102 SUBJ_ALL_CAPS 3880 1.77 2.30 1.51 103 TR_XM_NoHeaderRelay 3779 0.88 2.24 0.23 104 HTML_MIME_NO_HTML_TAG 3730 2.36 2.21 2.43 105 RCVD_IN_VALIDITY_SAFE 3667 3.12 2.17 3.57 106 T_XMDrugObfuBody_00 3655 1.37 2.16 0.99 107 TR_XM_INV_DKIM 3609 0.81 2.13 0.17 108 T_XMHurry_00 3596 1.05 2.13 0.53 109 SpammyFromTLD_02 3562 0.97 2.11 0.43 110 T_FILL_THIS_FORM_SHORT 3553 1.40 2.10 1.07 111 BAYES_40 3526 4.50 2.09 5.66 112 MAILING_LIST_MULTI 3485 2.65 2.06 2.94 113 FROM_EXCESS_BASE64 3348 1.83 1.98 1.75 114 XM_B_Phish66 3345 0.98 1.98 0.51 115 MAY_BE_FORGED 3262 1.69 1.93 1.58 116 T_REMOTE_IMAGE 3203 2.80 1.89 3.23 117 XMGppyBdWords 3180 0.68 1.88 0.11 118 T_TooManySym_01 3160 4.60 1.87 5.91 119 RCVD_IN_VALIDITY_RPBL 3071 0.65 1.82 0.09 120 USER_IN_DEF_DKIM_WL 3036 8.70 1.80 12.01 121 URI_OPTOUT_3LD 2997 0.79 1.77 0.32 122 RELAYCOUNTRY_FR 2989 0.71 1.77 0.20 123 XMLngstWrd_00 2957 1.32 1.75 1.11 124 XMGenDplmaNmb 2947 1.11 1.74 0.81 125 HTML_FONT_FACE_BAD 2929 0.97 1.73 0.60 126 URI_HEX 2919 1.32 1.73 1.12 127 XMPhish30 2895 0.95 1.71 0.59 128 RCVD_IN_PSBL 2723 0.74 1.61 0.32 129 XM_H_Long_From02 2702 1.02 1.60 0.75 130 XMBrknScrpt_02 2688 1.04 1.59 0.78 131 BAYES_20 2519 3.15 1.49 3.95 132 THIS_AD 2496 0.86 1.48 0.57 133 HTTPS_HTTP_MISMATCH 2494 1.02 1.48 0.80 134 TR_XM_PhishingBody2 2468 0.48 1.46 0.02 135 RCVD_IN_VALIDITY_CERTIFIED 2464 2.40 1.46 2.85 136 XM_SendGrid 2414 1.32 1.43 1.26 137 XM_DK_Undo_01 2412 1.67 1.43 1.78 138 MultiRelay_CC 2396 0.54 1.42 0.12 139 SpammyFromTLD_01 2367 1.03 1.40 0.86 140 XMLngstWrd_01 2272 0.77 1.34 0.49 141 URI_TRY_3LD 2256 0.80 1.33 0.54 142 TR_LOTS_OF_MONEY3 2247 0.59 1.33 0.23 143 XMHTML_After_End 2241 0.98 1.33 0.82 144 T_Symld_Words_02 2199 0.81 1.30 0.58 145 XMSexyCombo_01 2113 0.59 1.25 0.28 146 RCVD_IN_ZEN_LASTEXTERNAL 2087 0.40 1.23 0.00 147 SHORTCIRCUIT 2087 0.40 1.23 0.00 148 TR_MetaPhish_Combo_01 2040 0.88 1.21 0.73 149 XM_B_COPY_HTML 2037 0.84 1.20 0.66 150 URI_NOVOWEL 2018 1.42 1.19 1.52 151 TR_XM_PHPDW 1967 0.67 1.16 0.44 152 TR_XM_PHPForged 1945 0.67 1.15 0.44 153 TR_XM_SEO4 1928 0.53 1.14 0.24 154 TR_XM_FormFill2 1922 0.66 1.14 0.43 155 HTML_NONELEMENT_30_40 1918 0.37 1.13 0.01 156 HTML_TAG_BALANCE_BODY 1904 0.75 1.13 0.56 157 XM_H_PHPOS 1902 0.65 1.13 0.43 158 DKIM_ADSP_CUSTOM_MED 1882 0.86 1.11 0.74 159 TR_LOTS_OF_MONEY2 1875 0.53 1.11 0.25 160 T_MONEY_PERCENT 1875 0.53 1.11 0.25 161 MISSING_HEADERS 1866 0.57 1.10 0.31 162 DIET_1 1859 0.50 1.10 0.22 163 XM_B_SEO 1840 0.60 1.09 0.36 164 TR_Caps_n_Bayes_99 1832 0.38 1.08 0.05 165 HTML_FONT_TINY_NORDNS 1814 0.40 1.07 0.07 166 SUBJ_DOLLARS 1788 0.61 1.06 0.39 167 TM2_M_OBFU_COMMENT 1750 0.61 1.04 0.40 168 LongTLD 1713 0.67 1.01 0.50 169 RCVD_IN_PBL 1703 0.76 1.01 0.65 170 XMPhish14 1631 0.60 0.96 0.42 171 RCVD_IN_IADB_LISTED 1627 2.64 0.96 3.44 172 XMPhish08 1623 0.48 0.96 0.24 173 XMLngstWrd_02 1591 0.57 0.94 0.40 174 XM_H_Undi_Recip 1556 0.42 0.92 0.19 175 XMBdyGiftCard01 1554 0.61 0.92 0.46 176 TR_XM_Base64_M1 1546 0.74 0.91 0.66 177 MPART_ALT_DIFF_COUNT 1543 0.67 0.91 0.55 178 BOTNET_NORDNS 1533 0.30 0.91 0.01 179 RCVD_IN_IADB_SPF 1526 2.34 0.90 3.03 180 XM_B_REG_HTML 1521 0.44 0.90 0.22 181 SHOPIFY_IMG_NOT_RCVD_SFY 1513 0.46 0.89 0.25 182 NML_ADSP_CUSTOM_MED 1511 0.62 0.89 0.49 183 FORGED_GMAIL_RCVD 1511 0.56 0.89 0.40 184 TR_XM_DK_SendGrid 1499 0.83 0.89 0.81 185 RCVD_IN_IADB_DK 1497 2.08 0.89 2.65 186 RCVD_IN_IADB_SENDERID 1496 2.13 0.88 2.73 187 HK_SCAM 1468 0.29 0.87 0.02 188 TR_XM_InvalidRelay 1438 0.28 0.85 0.01 189 XM_B_COVIDMETA 1426 0.40 0.84 0.19 190 XM_DIRTYINTL 1415 0.35 0.84 0.12 191 XM_Nigeria_01 1413 0.29 0.84 0.03 192 XM_PDF 1410 3.12 0.83 4.21 193 TR_XM_FormFill 1405 0.27 0.83 0.01 194 CK_HELO_GENERIC 1366 0.29 0.81 0.04 195 TR_XM_Base64_L1 1359 0.31 0.80 0.07 196 XM_UB99 1358 0.27 0.80 0.01 197 TR_XM_Undi_Recip19 1357 0.32 0.80 0.08 198 XM_B_DNDMA 1352 0.51 0.80 0.37 199 XM_OfRef7 1352 0.39 0.80 0.19 200 XM_UB60 1335 0.29 0.79 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 311109 90.28 94.20 88.40 2 RELAYCOUNTRY_US 269331 76.04 75.03 76.53 3 XM_B_Unicode 256449 76.76 84.86 72.87 4 DKIM_SIGNED 247179 73.43 80.09 70.24 5 XM_DK_Pass 242843 71.38 76.32 69.00 6 DKIM_VALID 238276 69.81 74.18 67.71 7 DCC_CHECK_NEGATIVE 221207 52.79 31.85 62.86 8 BAYES_50 216843 56.19 44.88 61.62 9 DKIM_VALID_AU 191618 55.93 59.02 54.45 10 XM_B_SpammyWords 163359 54.49 71.30 46.42 11 XMListUnsubscribeExists 161483 50.69 60.69 45.89 12 XM_B_Unicode3 152671 46.94 54.34 43.38 13 DCC_CHECK 130506 46.76 66.90 37.08 14 RCVD_IN_MSPIKE_H2 111999 33.21 36.09 31.82 15 LOC_TINY_FONT_1 108211 36.62 48.84 30.75 16 T_TM2_M_HEADER_IN_MSG 101429 27.01 23.24 28.82 17 HTML_FONT_LOW_CONTRAST 99055 30.76 36.19 28.15 18 DKIM_VALID_EF 95738 27.03 26.67 27.20 19 FVGT_m_MULTI_ODD 87981 27.45 32.56 25.00 20 T_KAM_HTML_FONT_INVALID 80453 25.67 31.53 22.86 21 XMSubLong 75486 22.15 23.60 21.45 22 ALL_TRUSTED 72940 17.63 11.17 20.73 23 XM_B_SpammyWords2 69216 27.79 44.69 19.67 24 XM_Multi_Part_URI 68276 22.32 28.40 19.40 25 MIME_HTML_ONLY 66835 21.33 26.19 18.99 26 XM_B_Unsub 51410 17.69 24.09 14.61 27 TR_XM_DK_Unsub 43749 14.44 18.61 12.43 28 USER_IN_DEF_DKIM_WL 42267 8.70 1.80 12.01 29 TR_XM_BayesUnsub 41146 15.43 23.22 11.69 30 BAYES_00 40150 7.93 0.70 11.41 31 ANY_BOUNCE_MESSAGE 40086 11.52 11.80 11.39 32 BOUNCE_MESSAGE 40084 11.52 11.80 11.39 33 UNPARSEABLE_RELAY 38916 12.66 15.99 11.06 34 XM_B_PhoneNumber 33824 8.63 6.60 9.61 35 XM_Evil_Numbers_Gen 33344 10.47 12.54 9.47 36 LotsOfNums_01 31093 9.25 10.10 8.84 37 T_SCC_BODY_TEXT_LINE 29877 8.25 7.74 8.49 38 TooManyTo_001 28303 6.58 3.52 8.04 39 TR_XM_DK_Bayes 24475 4.88 0.55 6.95 40 BAYES_60 24264 7.19 7.82 6.89 41 FSL_BULK_SIG 24024 7.65 9.37 6.83 42 TR_XM_DK_Bayes1 23867 4.75 0.53 6.78 43 XM_DKIMWhitelistDomains 23478 4.56 0.15 6.67 44 XM_B_Phish_Phrases 22295 8.84 14.05 6.34 45 IN_ZIMBRA_NJ_WHITELIST 21742 4.23 0.16 6.18 46 LOTS_OF_MONEY 21507 8.64 13.89 6.11 47 T_TooManySym_01 20784 4.60 1.87 5.91 48 TR_XM_DK_Bayes2 20582 4.10 0.45 5.85 49 BAYES_40 19926 4.50 2.09 5.66 50 XM_H_GMP 19788 5.31 4.65 5.62 51 XM_B_SpammyWords3 19138 9.14 16.83 5.44 52 XM_H_Long_From01 18938 5.20 4.83 5.38 53 RCVD_IN_MSPIKE_WL 17970 4.30 2.63 5.11 54 RCVD_IN_MSPIKE_H3 17944 4.30 2.63 5.10 55 TR_MAX_INTL_RELAY 17614 8.01 14.26 5.01 56 MIME_QP_LONG_LINE 17510 4.35 3.06 4.98 57 MPART_ALT_DIFF 17074 5.23 6.01 4.85 58 HTML_IMAGE_RATIO_06 16841 4.89 5.10 4.79 59 XM_PDF 14829 3.12 0.83 4.21 60 HTML_IMAGE_RATIO_04 14797 4.55 5.27 4.20 61 XMStrtUSub 14672 4.31 4.61 4.17 62 HTML_IMAGE_RATIO_02 14464 4.76 6.12 4.11 63 XM_DK_Undo_02 14397 14.09 34.90 4.09 64 TR_XM_SpammyWords4 14185 6.68 12.20 4.03 65 BAYES_20 13895 3.15 1.49 3.95 66 XM_UncommonTLD01 13777 4.38 5.34 3.91 67 RCVD_IN_VALIDITY_SAFE 12565 3.12 2.17 3.57 68 XMSubMetaSx_00 12187 4.58 6.90 3.46 69 RCVD_IN_IADB_LISTED 12112 2.64 0.96 3.44 70 RELAYCOUNTRY_META 11955 6.92 14.26 3.40 71 XM_B_Unsub2 11380 3.94 5.42 3.23 72 T_REMOTE_IMAGE 11362 2.80 1.89 3.23 73 HTML_IMAGE_RATIO_08 11295 3.30 3.49 3.21 74 BAYES_80 10785 4.98 8.96 3.06 75 RCVD_IN_IADB_SPF 10665 2.34 0.90 3.03 76 TM2_M_VERY_LONG_WORD 10365 3.74 5.41 2.95 77 MAILING_LIST_MULTI 10337 2.65 2.06 2.94 78 BAYES_99 10070 10.76 27.22 2.86 79 RCVD_IN_VALIDITY_CERTIFIED 10041 2.40 1.46 2.85 80 XM_Body_Dirty_Words 10004 4.26 7.22 2.84 81 T_TooManySym_02 9770 2.08 0.64 2.78 82 RCVD_IN_IADB_SENDERID 9605 2.13 0.88 2.73 83 TooManyTo_002 9578 2.01 0.54 2.72 84 BOTNET_IPINHOSTNAME 9559 5.18 10.32 2.72 85 MIME_HTML_ONLY_MULTI 9347 2.79 3.07 2.66 86 RCVD_IN_IADB_DK 9320 2.08 0.89 2.65 87 XMNumbers 9083 2.94 3.69 2.58 88 DKIM_INVALID 8903 3.62 5.90 2.53 89 TM2_M_URI_OPT_OUT 8751 2.63 2.91 2.49 90 BAYES_05 8687 1.86 0.60 2.47 91 HTML_MIME_NO_HTML_TAG 8556 2.36 2.21 2.43 92 MIME_HTML_MOSTLY 8404 2.87 3.88 2.39 93 XM_B_SpammyTLD 8269 3.16 4.84 2.35 94 RCVD_IN_IADB_VOUCHED 7843 1.61 0.31 2.23 95 BAYES_999 7511 8.28 21.09 2.13 96 INVALID_MSGID 7473 1.50 0.20 2.12 97 T_XMDrugObfuBody_14 6905 2.41 3.35 1.96 98 BAYES_95 6812 2.92 4.98 1.94 99 TR_XM_DKIM_Undo 6748 9.45 25.13 1.92 100 KHOP_HELO_FCRDNS 6639 2.11 2.58 1.89 101 T_XMDrugObfuBody_08 6619 2.28 3.10 1.88 102 XM_CamelCaseFrm001 6464 2.13 2.73 1.84 103 TR_XM_PhishingBody 6430 3.20 6.06 1.83 104 XM_B_URI_Unicode 6318 2.17 2.95 1.80 105 TO_MALFORMED 6304 1.23 0.06 1.79 106 XM_DK_Undo_01 6266 1.67 1.43 1.78 107 XM_B_Investor 6193 2.92 5.34 1.76 108 FROM_EXCESS_BASE64 6167 1.83 1.98 1.75 109 TR_XM_SpammyRelay 6093 4.41 9.98 1.73 110 TR_Symld_Words 5685 1.34 0.76 1.62 111 TR_XM_UnparsRelay 5591 3.81 8.45 1.59 112 MAY_BE_FORGED 5548 1.69 1.93 1.58 113 RCVD_IN_IADB_OPTIN 5484 1.11 0.17 1.56 114 TooManyTo_003 5400 1.19 0.48 1.53 115 URI_NOVOWEL 5357 1.42 1.19 1.52 116 SUBJ_ALL_CAPS 5320 1.77 2.30 1.51 117 XM_SPF_SoftFail 5006 1.82 2.64 1.42 118 XMDiploma_00 4820 1.82 2.76 1.37 119 XM_GoogleGroups 4631 1.08 0.60 1.32 120 HELO_NODOT 4585 0.97 0.29 1.30 121 HELO_NO_DOMAIN 4578 0.97 0.27 1.30 122 UNTRUSTED_Relay 4558 2.75 5.78 1.30 123 IN_HORDE_ADDRESS_BOOK 4505 0.90 0.12 1.28 124 TR_DCC_Bayes_99 4482 7.06 19.12 1.27 125 XM_SendGrid 4440 1.32 1.43 1.26 126 TR_XM_SpammyWords5 4407 2.02 3.63 1.25 127 BOTNET 4208 3.41 8.02 1.20 128 XMSexyCombo_05 4166 2.29 4.58 1.18 129 XMCapTrack 4049 0.92 0.45 1.15 130 T_TooManySym_03 3999 0.82 0.16 1.14 131 URI_HEX 3935 1.32 1.73 1.12 132 TooManyTo_004 3926 0.89 0.43 1.12 133 XMLngstWrd_00 3905 1.32 1.75 1.11 134 T_FILL_THIS_FORM_SHORT 3758 1.40 2.10 1.07 135 XMGappySubj_01 3539 0.74 0.20 1.01 136 T_XMDrugObfuBody_00 3490 1.37 2.16 0.99 137 TVD_SPACE_RATIO 3490 0.71 0.14 0.99 138 RELAYCOUNTRY_CA 3452 2.39 5.33 0.98 139 MIME_CHARSET_FARAWAY 3317 0.76 0.37 0.94 140 XM_OfRef6 3267 1.86 3.80 0.93 141 XM_ShortIntro_01 3249 0.74 0.37 0.92 142 TooManyTo_005 3145 0.73 0.40 0.89 143 XM_B_SpammyWords4 3036 1.73 3.55 0.86 144 SpammyFromTLD_01 3012 1.03 1.40 0.86 145 XM_H_Trusted_IP 2973 0.57 0.00 0.84 146 XMHTML_After_End 2879 0.98 1.33 0.82 147 XMGenDplmaNmb 2858 1.11 1.74 0.81 148 TR_XM_DK_SendGrid 2842 0.83 0.89 0.81 149 HTTPS_HTTP_MISMATCH 2827 1.02 1.48 0.80 150 TO_NO_BRKTS_HTML_ONLY 2773 0.69 0.49 0.79 151 XM_UB50 2761 1.50 2.99 0.78 152 XMBrknScrpt_02 2742 1.04 1.59 0.78 153 CHARSET_FARAWAY_HEADER 2703 0.58 0.19 0.77 154 XMStockSpam_06 2698 1.32 2.48 0.77 155 XM_ProductURIs 2694 0.76 0.76 0.77 156 XM_H_Long_From02 2625 1.02 1.60 0.75 157 DKIM_ADSP_CUSTOM_MED 2594 0.86 1.11 0.74 158 TR_MetaPhish_Combo_01 2556 0.88 1.21 0.73 159 XMSubNoVowel 2552 0.63 0.43 0.73 160 TVD_RCVD_IP 2492 0.66 0.55 0.71 161 FROM_GOV_DKIM_AU 2480 0.52 0.13 0.70 162 XM_H_PHPMailer 2425 0.65 0.55 0.69 163 XM_B_COPY_HTML 2331 0.84 1.20 0.66 164 TR_XM_Base64_M1 2310 0.74 0.91 0.66 165 RCVD_IN_PBL 2273 0.76 1.01 0.65 166 HTML_IMAGE_ONLY_20 2229 0.63 0.62 0.63 167 XMNoVowels 2152 0.54 0.38 0.61 168 XMSubMetaI_00 2125 0.65 0.76 0.60 169 HTML_FONT_FACE_BAD 2116 0.97 1.73 0.60 170 XMMoneyMeta_00 2090 0.61 0.65 0.59 171 XMSlimDrugH 2089 0.63 0.70 0.59 172 XMPhish30 2062 0.95 1.71 0.59 173 MSGID_FROM_MTA_HEADER 2040 0.43 0.13 0.58 174 T_Symld_Words_02 2031 0.81 1.30 0.58 175 THIS_AD 1990 0.86 1.48 0.57 176 T_OBFU_PDF_ATTACH 1986 0.45 0.20 0.56 177 HTML_TAG_BALANCE_BODY 1981 0.75 1.13 0.56 178 MPART_ALT_DIFF_COUNT 1936 0.67 0.91 0.55 179 XM_B_FormFill 1924 0.37 0.01 0.55 180 RELAYCOUNTRY_AU 1912 1.18 2.50 0.54 181 URI_TRY_3LD 1909 0.80 1.33 0.54 182 RCVD_IN_BL_SPAMCOP_NET 1902 2.96 8.01 0.54 183 T_XMHurry_00 1871 1.05 2.13 0.53 184 TR_XM_SpammyWords2 1800 3.86 10.83 0.51 185 XM_B_Phish66 1785 0.98 1.98 0.51 186 LongTLD 1767 0.67 1.01 0.50 187 XMBSHREFv2 1748 0.47 0.40 0.50 188 NML_ADSP_CUSTOM_MED 1732 0.62 0.89 0.49 189 XMLngstWrd_01 1725 0.77 1.34 0.49 190 HTML_IMAGE_ONLY_32 1723 0.40 0.22 0.49 191 RELAYCOUNTRY_GB 1631 0.56 0.77 0.46 192 XMBdyGiftCard01 1609 0.61 0.92 0.46 193 XMGappySubj_02 1570 0.32 0.05 0.45 194 PLING_QUERY 1550 0.54 0.76 0.44 195 TR_XM_PHPDW 1538 0.67 1.16 0.44 196 TR_XM_PHPForged 1534 0.67 1.15 0.44 197 TR_XM_FormFill2 1522 0.66 1.14 0.43 198 XMSolicitRefs_0 1516 0.43 0.43 0.43 199 SpammyFromTLD_02 1511 0.97 2.11 0.43 200 XMBody_17 1508 1.05 2.35 0.43 ----------------------------------------------------------------------