Email: 467167 Autolearn: 0 AvgScore: 4.69 AvgScanTime: 1.29 sec Spam: 149029 Autolearn: 0 AvgScore: 14.50 AvgScanTime: 1.41 sec Ham: 318138 Autolearn: 0 AvgScore: 0.10 AvgScanTime: 1.23 sec Time Spent Running SA: 166.76 hours Time Spent Processing Spam: 58.32 hours Time Spent Processing Ham: 108.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141025 89.73 94.63 87.43 2 DKIM_SIGNED 135537 81.56 90.95 77.16 3 XM_DK_Pass 128391 79.10 86.15 75.79 4 DKIM_VALID 127391 78.11 85.48 74.66 5 XM_B_Unicode 127089 76.17 85.28 71.91 6 RELAYCOUNTRY_US 125087 82.25 83.93 81.47 7 DCC_CHECK 112902 51.91 75.76 40.75 8 XM_B_SpammyWords 104686 52.98 70.25 44.90 9 DKIM_VALID_AU 101118 62.20 67.85 59.55 10 XMListUnsubscribeExists 100885 56.06 67.69 50.61 11 XM_B_Unicode3 77365 44.96 51.91 41.70 12 LOC_TINY_FONT_1 74393 35.55 49.92 28.82 13 BAYES_50 61783 54.35 41.46 60.38 14 XM_B_SpammyWords2 60793 25.74 40.79 18.68 15 RCVD_IN_MSPIKE_H2 59414 36.90 39.87 35.51 16 XM_DK_Undo_02 58581 15.83 39.31 4.83 17 HTML_FONT_LOW_CONTRAST 58188 31.67 39.04 28.22 18 FVGT_m_MULTI_ODD 49286 28.03 33.07 25.67 19 DKIM_VALID_EF 46491 30.15 31.20 29.66 20 T_KAM_HTML_FONT_INVALID 45571 25.30 30.58 22.83 21 BAYES_99 44184 11.72 29.65 3.33 22 MIME_HTML_ONLY 43346 23.06 29.09 20.24 23 TR_XM_DKIM_Undo 42346 10.55 28.41 2.18 24 XMSubLong 36921 23.28 24.77 22.57 25 DCC_CHECK_NEGATIVE 34053 47.61 22.85 59.21 26 T_TM2_M_HEADER_IN_MSG 34018 27.66 22.83 29.93 27 BAYES_999 33571 8.94 22.53 2.58 28 XM_Multi_Part_URI 32214 15.96 21.62 13.31 29 TR_XM_DK_Unsub 31591 15.84 21.20 13.34 30 TR_DCC_Bayes_99 31300 7.57 21.00 1.28 31 UNPARSEABLE_RELAY 28665 14.47 19.23 12.23 32 XM_B_Unsub 28038 12.32 18.81 9.28 33 TR_XM_BayesUnsub 26927 10.43 18.07 6.85 34 XM_B_SpammyWords3 22871 8.35 15.35 5.07 35 TR_MAX_INTL_RELAY 22106 8.57 14.83 5.63 36 RELAYCOUNTRY_META 22027 7.46 14.78 4.04 37 LOTS_OF_MONEY 19002 8.32 12.75 6.24 38 FSL_BULK_SIG 17349 8.57 11.64 7.13 39 BOTNET_IPINHOSTNAME 17309 5.93 11.61 3.26 40 TR_XM_SpammyWords4 17117 6.56 11.49 4.26 41 TR_XM_SpammyWords2 15545 3.70 10.43 0.54 42 TR_XM_UnparsRelay 15542 4.38 10.43 1.55 43 TR_XM_SpammyRelay 15413 4.79 10.34 2.19 44 XM_Evil_Numbers_Gen 15085 9.10 10.12 8.62 45 BOTNET 14414 4.10 9.67 1.49 46 BAYES_80 13577 5.33 9.11 3.56 47 RCVD_IN_BL_SPAMCOP_NET 12863 3.24 8.63 0.71 48 XM_B_Phish_Phrases 12579 6.28 8.44 5.27 49 BAYES_60 12546 7.59 8.42 7.20 50 T_SCC_BODY_TEXT_LINE 11913 8.25 7.99 8.38 51 XM_Body_Dirty_Words 11348 4.37 7.61 2.85 52 LotsOfNums_01 10570 7.65 7.09 7.91 53 HTML_IMAGE_RATIO_02 10374 5.84 6.96 5.31 54 TR_XM_SPAMCOP 10350 2.40 6.94 0.27 55 XMSubMetaSx_00 9865 5.16 6.62 4.48 56 XM_B_PhoneNumber 9854 9.19 6.61 10.39 57 MPART_ALT_DIFF 9803 5.13 6.58 4.45 58 UNTRUSTED_Relay 8985 3.01 6.03 1.59 59 XM_UncommonTLD01 8735 4.84 5.86 4.36 60 TR_XM_PhishingBody 8609 2.97 5.78 1.65 61 DKIM_INVALID 8146 3.45 5.47 2.50 62 BAYES_95 7928 3.10 5.32 2.06 63 XM_H_Long_From01 7857 5.88 5.27 6.16 64 RELAYCOUNTRY_CA 7807 2.50 5.24 1.22 65 HTML_IMAGE_RATIO_04 7673 4.29 5.15 3.88 66 XMSexyCombo_05 7439 2.78 4.99 1.74 67 XM_H_GMP 7213 5.51 4.84 5.82 68 HTML_IMAGE_RATIO_06 6903 4.11 4.63 3.86 69 XM_B_Investor 6328 2.50 4.25 1.68 70 T_XMDrugObfuBody_14 6287 2.91 4.22 2.30 71 XMStrtUSub 6214 5.28 4.17 5.80 72 T_XMDrugObfuBody_08 6184 2.49 4.15 1.71 73 MIME_HTML_MOSTLY 5979 2.99 4.01 2.51 74 XM_B_SpammyTLD 5755 3.27 3.86 2.99 75 XMNumbers 5753 3.31 3.86 3.05 76 TR_XM_SpammyWords5 5699 2.14 3.82 1.35 77 TooManyTo_001 5556 7.04 3.73 8.60 78 TM2_M_VERY_LONG_WORD 5462 2.14 3.67 1.43 79 XM_CamelCaseFrm001 5440 2.65 3.65 2.18 80 XM_B_URI_Unicode 5232 2.48 3.51 2.00 81 MIME_HTML_ONLY_MULTI 5164 2.83 3.47 2.54 82 TM2_M_URI_OPT_OUT 4745 2.29 3.18 1.87 83 XM_B_Unsub2 4725 2.08 3.17 1.56 84 XM_OfRef6 4639 1.66 3.11 0.98 85 XM_SPF_SoftFail 4595 1.92 3.08 1.38 86 HTML_IMAGE_RATIO_08 4519 2.27 3.03 1.92 87 RCVD_IN_MSPIKE_WL 4501 4.80 3.02 5.63 88 RCVD_IN_MSPIKE_H3 4501 4.79 3.02 5.63 89 XM_UB50 4310 1.60 2.89 0.99 90 MIME_QP_LONG_LINE 4228 4.46 2.84 5.22 91 XM_URI_RBL 4133 1.16 2.77 0.40 92 XMDiploma_00 4025 1.98 2.70 1.64 93 XM_B_SpammyWords4 4009 1.43 2.69 0.84 94 T_TooManySym_01 3818 4.76 2.56 5.79 95 XM_SendGrid 3802 1.88 2.55 1.57 96 SpammyFromTLD_02 3784 1.14 2.54 0.48 97 RELAYCOUNTRY_AU 3778 1.14 2.54 0.48 98 TR_XM_NoHeaderRelay 3683 0.89 2.47 0.15 99 RCVD_IN_VALIDITY_SAFE 3423 3.69 2.30 4.34 100 TR_XM_INV_DKIM 3383 0.88 2.27 0.23 101 MAILING_LIST_MULTI 3316 2.66 2.23 2.86 102 FROM_EXCESS_BASE64 3196 1.78 2.14 1.61 103 XMStockSpam_06 3139 1.50 2.11 1.21 104 T_FILL_THIS_FORM_SHORT 3138 1.34 2.11 0.98 105 T_REMOTE_IMAGE 3133 3.15 2.10 3.64 106 XM_H_Long_From02 3127 1.26 2.10 0.86 107 XM_B_Phish66 3100 0.92 2.08 0.38 108 USER_IN_DEF_DKIM_WL 3071 10.17 2.06 13.97 109 HTML_MIME_NO_HTML_TAG 2998 2.35 2.01 2.51 110 T_XMDrugObfuBody_00 2973 1.13 1.99 0.73 111 XM_DK_Undo_01 2800 1.75 1.88 1.70 112 RCVD_IN_VALIDITY_RPBL 2761 0.65 1.85 0.08 113 ALL_TRUSTED 2748 10.91 1.84 15.15 114 XMBrknScrpt_02 2690 1.14 1.81 0.83 115 URI_HEX 2652 1.41 1.78 1.24 116 BAYES_40 2613 4.32 1.75 5.52 117 XMBody_17 2560 0.81 1.72 0.38 118 RCVD_IN_VALIDITY_CERTIFIED 2559 2.93 1.72 3.50 119 URI_TRY_3LD 2489 0.90 1.67 0.54 120 T_XMHurry_00 2486 0.95 1.67 0.61 121 HTML_FONT_TINY_NORDNS 2409 0.56 1.62 0.07 122 SUBJ_ALL_CAPS 2366 1.64 1.59 1.66 123 TR_LOTS_OF_MONEY3 2348 0.71 1.58 0.30 124 TR_Mismatch_TLD_02 2303 0.59 1.55 0.15 125 XMGenDplmaNmb 2295 1.09 1.54 0.87 126 SpammyFromTLD_01 2287 1.10 1.53 0.90 127 BAYES_20 2234 3.20 1.50 3.99 128 SHORTCIRCUIT 2052 0.44 1.38 0.00 129 RCVD_IN_ZEN_LASTEXTERNAL 2052 0.44 1.38 0.00 130 T_MONEY_PERCENT 2033 0.60 1.36 0.24 131 TR_LOTS_OF_MONEY2 2033 0.60 1.36 0.24 132 TR_MetaPhish_Combo_01 2011 0.97 1.35 0.80 133 XMPhish30 2002 0.75 1.34 0.48 134 HTTPS_HTTP_MISMATCH 1981 0.88 1.33 0.66 135 MPART_ALT_DIFF_COUNT 1951 0.77 1.31 0.51 136 XM_B_COVIDMETA 1949 0.55 1.31 0.20 137 XMSubMetaSxObfu_03 1912 1.11 1.28 1.03 138 XM_B_COPY_HTML 1874 0.92 1.26 0.76 139 XM_ProductURIs 1805 0.65 1.21 0.38 140 TR_XM_SEO4 1797 0.47 1.21 0.13 141 DKIM_ADSP_CUSTOM_MED 1790 0.93 1.20 0.80 142 XMBdyGiftCard01 1790 1.10 1.20 1.05 143 XMLngstWrd_00 1788 0.69 1.20 0.46 144 XMPhish14 1771 0.71 1.19 0.48 145 DKIM_ADSP_NXDOMAIN 1757 0.60 1.18 0.33 146 THIS_AD 1756 0.64 1.18 0.39 147 KHOP_HELO_FCRDNS 1749 1.26 1.17 1.30 148 BOTNET_NORDNS 1748 0.38 1.17 0.01 149 TR_XM_PHPDW 1678 0.61 1.13 0.36 150 XM_B_SEO 1677 0.52 1.13 0.23 151 XMSubMetaI_00 1667 0.68 1.12 0.48 152 HTML_IMAGE_ONLY_20 1643 0.75 1.10 0.58 153 TR_XM_PHPForged 1634 0.59 1.10 0.35 154 TR_XM_FormFill2 1616 0.59 1.08 0.36 155 XMLngstWrd_01 1615 0.59 1.08 0.35 156 RCVD_IN_PBL 1607 0.82 1.08 0.69 157 TR_XM_DK_SendGrid 1602 1.02 1.07 1.00 158 XM_H_PHPOS 1591 0.58 1.07 0.35 159 URI_NOVOWEL 1564 1.50 1.05 1.71 160 SHOPIFY_IMG_NOT_RCVD_SFY 1519 0.49 1.02 0.25 161 XMMoneyMeta_00 1519 0.65 1.02 0.47 162 TR_Mismatch_TLD_01 1517 0.44 1.02 0.17 163 NML_ADSP_CUSTOM_MED 1513 0.70 1.02 0.55 164 XMLngstWrd_02 1497 0.51 1.00 0.27 165 XM_UB99 1492 0.33 1.00 0.01 166 XMHTML_After_End 1476 0.61 0.99 0.43 167 XM_H_Undi_Recip 1466 0.45 0.98 0.19 168 RELAYCOUNTRY_FR 1463 0.48 0.98 0.25 169 DEAR_FRIEND 1458 0.36 0.98 0.07 170 TR_Symld_Words 1453 1.39 0.97 1.59 171 LongTLD 1442 0.69 0.97 0.56 172 XM_DIRTYINTL 1422 0.35 0.95 0.07 173 XMLngstWrd_03 1409 0.44 0.95 0.20 174 RCVD_IN_PSBL 1397 0.48 0.94 0.27 175 FORGED_GMAIL_RCVD 1386 0.64 0.93 0.50 176 XM_B_DNDMA 1378 0.67 0.92 0.55 177 XM_B_REG_HTML 1365 0.42 0.92 0.18 178 TR_XM_InvalidRelay 1350 0.30 0.91 0.01 179 ANY_BOUNCE_MESSAGE 1349 2.40 0.91 3.10 180 BOUNCE_MESSAGE 1348 2.40 0.90 3.09 181 RCVD_IN_IADB_LISTED 1338 2.94 0.90 3.90 182 RELAYCOUNTRY_GB 1336 0.69 0.90 0.60 183 XMLngstWrd_04 1327 0.40 0.89 0.17 184 URIBL_BLACK 1312 0.32 0.88 0.06 185 XMReplyNow 1303 0.45 0.87 0.26 186 TM2_M_A_HREF_HREF 1293 0.45 0.87 0.25 187 XMSexyCombo_01 1289 0.52 0.86 0.36 188 HTML_TAG_BALANCE_BODY 1286 0.68 0.86 0.59 189 XM_PDF 1282 3.38 0.86 4.55 190 T_STY_INVIS_DIRECT 1278 0.61 0.86 0.49 191 XM_GoogleGroups 1275 1.22 0.86 1.39 192 XM_HighProb1 1270 0.28 0.85 0.01 193 XMBody_78 1242 0.62 0.83 0.52 194 RCVD_IN_IADB_SPF 1234 2.59 0.83 3.41 195 XM_UB60 1218 0.30 0.82 0.06 196 TR_XM_Base64_M1 1210 0.65 0.81 0.58 197 MISSING_HEADERS 1207 0.51 0.81 0.36 198 TR_XM_Undi_Recip19 1202 0.32 0.81 0.09 199 MultiRelay_CC 1198 0.38 0.80 0.17 200 RCVD_IN_IADB_DK 1194 2.27 0.80 2.95 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 278148 89.73 94.63 87.43 2 RELAYCOUNTRY_US 259177 82.25 83.93 81.47 3 DKIM_SIGNED 245491 81.56 90.95 77.16 4 XM_DK_Pass 241126 79.10 86.15 75.79 5 DKIM_VALID 237522 78.11 85.48 74.66 6 XM_B_Unicode 228775 76.17 85.28 71.91 7 BAYES_50 192102 54.35 41.46 60.38 8 DKIM_VALID_AU 189456 62.20 67.85 59.55 9 DCC_CHECK_NEGATIVE 188362 47.61 22.85 59.21 10 XMListUnsubscribeExists 161006 56.06 67.69 50.61 11 XM_B_SpammyWords 142833 52.98 70.25 44.90 12 XM_B_Unicode3 132665 44.96 51.91 41.70 13 DCC_CHECK 129626 51.91 75.76 40.75 14 RCVD_IN_MSPIKE_H2 112976 36.90 39.87 35.51 15 T_TM2_M_HEADER_IN_MSG 95220 27.66 22.83 29.93 16 DKIM_VALID_EF 94351 30.15 31.20 29.66 17 LOC_TINY_FONT_1 91680 35.55 49.92 28.82 18 HTML_FONT_LOW_CONTRAST 89780 31.67 39.04 28.22 19 FVGT_m_MULTI_ODD 81665 28.03 33.07 25.67 20 T_KAM_HTML_FONT_INVALID 72621 25.30 30.58 22.83 21 XMSubLong 71816 23.28 24.77 22.57 22 MIME_HTML_ONLY 64380 23.06 29.09 20.24 23 XM_B_SpammyWords2 59441 25.74 40.79 18.68 24 ALL_TRUSTED 48209 10.91 1.84 15.15 25 USER_IN_DEF_DKIM_WL 44432 10.17 2.06 13.97 26 TR_XM_DK_Unsub 42430 15.84 21.20 13.34 27 XM_Multi_Part_URI 42347 15.96 21.62 13.31 28 UNPARSEABLE_RELAY 38913 14.47 19.23 12.23 29 BAYES_00 36526 8.06 0.76 11.48 30 XM_B_PhoneNumber 33064 9.19 6.61 10.39 31 XM_B_Unsub 29513 12.32 18.81 9.28 32 XM_Evil_Numbers_Gen 27419 9.10 10.12 8.62 33 TooManyTo_001 27350 7.04 3.73 8.60 34 T_SCC_BODY_TEXT_LINE 26649 8.25 7.99 8.38 35 LotsOfNums_01 25174 7.65 7.09 7.91 36 TR_XM_DK_Bayes 24765 5.49 0.59 7.78 37 TR_XM_DK_Bayes1 24258 5.38 0.58 7.62 38 BAYES_60 22901 7.59 8.42 7.20 39 FSL_BULK_SIG 22668 8.57 11.64 7.13 40 XM_DKIMWhitelistDomains 21906 4.70 0.02 6.89 41 TR_XM_BayesUnsub 21783 10.43 18.07 6.85 42 IN_ZIMBRA_NJ_WHITELIST 21640 4.68 0.14 6.80 43 TR_XM_DK_Bayes2 20684 4.58 0.49 6.50 44 LOTS_OF_MONEY 19858 8.32 12.75 6.24 45 XM_H_Long_From01 19599 5.88 5.27 6.16 46 XM_H_GMP 18526 5.51 4.84 5.82 47 XMStrtUSub 18449 5.28 4.17 5.80 48 T_TooManySym_01 18422 4.76 2.56 5.79 49 RCVD_IN_MSPIKE_WL 17917 4.80 3.02 5.63 50 TR_MAX_INTL_RELAY 17911 8.57 14.83 5.63 51 RCVD_IN_MSPIKE_H3 17898 4.79 3.02 5.63 52 BAYES_40 17576 4.32 1.75 5.52 53 HTML_IMAGE_RATIO_02 16889 5.84 6.96 5.31 54 XM_B_Phish_Phrases 16780 6.28 8.44 5.27 55 MIME_QP_LONG_LINE 16594 4.46 2.84 5.22 56 XM_B_SpammyWords3 16121 8.35 15.35 5.07 57 XM_DK_Undo_02 15358 15.83 39.31 4.83 58 XM_PDF 14489 3.38 0.86 4.55 59 XMSubMetaSx_00 14250 5.16 6.62 4.48 60 MPART_ALT_DIFF 14144 5.13 6.58 4.45 61 XM_UncommonTLD01 13860 4.84 5.86 4.36 62 RCVD_IN_VALIDITY_SAFE 13810 3.69 2.30 4.34 63 TR_XM_SpammyWords4 13544 6.56 11.49 4.26 64 RELAYCOUNTRY_META 12838 7.46 14.78 4.04 65 BAYES_20 12699 3.20 1.50 3.99 66 RCVD_IN_IADB_LISTED 12392 2.94 0.90 3.90 67 HTML_IMAGE_RATIO_04 12355 4.29 5.15 3.88 68 HTML_IMAGE_RATIO_06 12291 4.11 4.63 3.86 69 T_REMOTE_IMAGE 11576 3.15 2.10 3.64 70 BAYES_80 11339 5.33 9.11 3.56 71 RCVD_IN_VALIDITY_CERTIFIED 11121 2.93 1.72 3.50 72 RCVD_IN_IADB_SPF 10853 2.59 0.83 3.41 73 BAYES_99 10579 11.72 29.65 3.33 74 BOTNET_IPINHOSTNAME 10378 5.93 11.61 3.26 75 ANY_BOUNCE_MESSAGE 9847 2.40 0.91 3.10 76 BOUNCE_MESSAGE 9846 2.40 0.90 3.09 77 XMNumbers 9714 3.31 3.86 3.05 78 RCVD_IN_IADB_SENDERID 9704 2.33 0.80 3.05 79 T_TooManySym_02 9635 2.25 0.60 3.03 80 XM_B_SpammyTLD 9501 3.27 3.86 2.99 81 RCVD_IN_IADB_DK 9393 2.27 0.80 2.95 82 TooManyTo_002 9353 2.22 0.69 2.94 83 MAILING_LIST_MULTI 9110 2.66 2.23 2.86 84 XM_Body_Dirty_Words 9059 4.37 7.61 2.85 85 RCVD_IN_IADB_VOUCHED 8429 1.92 0.36 2.65 86 BAYES_999 8196 8.94 22.53 2.58 87 MIME_HTML_ONLY_MULTI 8078 2.83 3.47 2.54 88 MIME_HTML_MOSTLY 7994 2.99 4.01 2.51 89 HTML_MIME_NO_HTML_TAG 7991 2.35 2.01 2.51 90 DKIM_INVALID 7969 3.45 5.47 2.50 91 BAYES_05 7842 1.89 0.65 2.46 92 T_XMDrugObfuBody_14 7308 2.91 4.22 2.30 93 INVALID_MSGID 7271 1.62 0.21 2.29 94 TR_XM_SpammyRelay 6967 4.79 10.34 2.19 95 XM_CamelCaseFrm001 6937 2.65 3.65 2.18 96 TR_XM_DKIM_Undo 6926 10.55 28.41 2.18 97 BAYES_95 6547 3.10 5.32 2.06 98 XM_B_URI_Unicode 6369 2.48 3.51 2.00 99 TO_MALFORMED 6274 1.35 0.02 1.97 100 HTML_IMAGE_RATIO_08 6101 2.27 3.03 1.92 101 TM2_M_URI_OPT_OUT 5965 2.29 3.18 1.87 102 RCVD_IN_IADB_OPTIN 5790 1.31 0.24 1.82 103 XMSexyCombo_05 5539 2.78 4.99 1.74 104 URI_NOVOWEL 5434 1.50 1.05 1.71 105 T_XMDrugObfuBody_08 5432 2.49 4.15 1.71 106 XM_DK_Undo_01 5396 1.75 1.88 1.70 107 XM_B_Investor 5335 2.50 4.25 1.68 108 SUBJ_ALL_CAPS 5286 1.64 1.59 1.66 109 TR_XM_PhishingBody 5247 2.97 5.78 1.65 110 XMDiploma_00 5209 1.98 2.70 1.64 111 TooManyTo_003 5133 1.29 0.61 1.61 112 FROM_EXCESS_BASE64 5120 1.78 2.14 1.61 113 UNTRUSTED_Relay 5071 3.01 6.03 1.59 114 TR_Symld_Words 5055 1.39 0.97 1.59 115 XM_SendGrid 5004 1.88 2.55 1.57 116 XM_B_Unsub2 4975 2.08 3.17 1.56 117 TR_XM_UnparsRelay 4937 4.38 10.43 1.55 118 BOTNET 4742 4.10 9.67 1.49 119 TM2_M_VERY_LONG_WORD 4556 2.14 3.67 1.43 120 XM_GoogleGroups 4419 1.22 0.86 1.39 121 XM_SPF_SoftFail 4396 1.92 3.08 1.38 122 IN_HORDE_ADDRESS_BOOK 4358 0.97 0.10 1.37 123 TR_XM_SpammyWords5 4285 2.14 3.82 1.35 124 KHOP_HELO_FCRDNS 4148 1.26 1.17 1.30 125 TR_DCC_Bayes_99 4062 7.57 21.00 1.28 126 T_TooManySym_03 3976 0.91 0.19 1.25 127 URI_HEX 3945 1.41 1.78 1.24 128 RELAYCOUNTRY_CA 3883 2.50 5.24 1.22 129 HELO_NODOT 3876 0.92 0.27 1.22 130 HELO_NO_DOMAIN 3864 0.91 0.26 1.21 131 XMStockSpam_06 3851 1.50 2.11 1.21 132 TooManyTo_004 3720 0.97 0.55 1.17 133 XMCapTrack 3711 0.94 0.47 1.17 134 XMBdyGiftCard01 3337 1.10 1.20 1.05 135 XMSubMetaSxObfu_03 3277 1.11 1.28 1.03 136 TVD_SPACE_RATIO 3240 0.76 0.22 1.02 137 XMGappySubj_01 3218 0.76 0.22 1.01 138 TR_XM_DK_SendGrid 3173 1.02 1.07 1.00 139 XM_UB50 3143 1.60 2.89 0.99 140 T_FILL_THIS_FORM_SHORT 3125 1.34 2.11 0.98 141 XM_OfRef6 3107 1.66 3.11 0.98 142 TM2_M_BODY_EMPTY 3100 0.69 0.08 0.97 143 TooManyTo_005 2951 0.79 0.49 0.93 144 SpammyFromTLD_01 2875 1.10 1.53 0.90 145 XM_ShortIntro_01 2871 0.74 0.39 0.90 146 XMGenDplmaNmb 2778 1.09 1.54 0.87 147 XM_H_Long_From02 2736 1.26 2.10 0.86 148 XM_B_SpammyWords4 2679 1.43 2.69 0.84 149 XMBrknScrpt_02 2645 1.14 1.81 0.83 150 DKIM_ADSP_CUSTOM_MED 2541 0.93 1.20 0.80 151 TR_MetaPhish_Combo_01 2539 0.97 1.35 0.80 152 FROM_GOV_DKIM_AU 2502 0.59 0.17 0.79 153 XM_H_PHPMailer 2470 0.74 0.66 0.78 154 XM_B_COPY_HTML 2423 0.92 1.26 0.76 155 TVD_RCVD_IP 2392 0.72 0.67 0.75 156 XMNoVowels 2323 0.64 0.46 0.73 157 T_XMDrugObfuBody_00 2313 1.13 1.99 0.73 158 RCVD_IN_BL_SPAMCOP_NET 2266 3.24 8.63 0.71 159 XM_B_FormFill 2234 0.48 0.01 0.70 160 XMEmptyBody_01 2211 0.48 0.03 0.69 161 RCVD_IN_PBL 2206 0.82 1.08 0.69 162 HTTPS_HTTP_MISMATCH 2109 0.88 1.33 0.66 163 T_OBFU_PDF_ATTACH 2049 0.49 0.17 0.64 164 TO_NO_BRKTS_HTML_ONLY 2007 0.56 0.40 0.63 165 T_XMHurry_00 1939 0.95 1.67 0.61 166 XMSlimDrugH 1932 0.60 0.59 0.61 167 RELAYCOUNTRY_GB 1901 0.69 0.90 0.60 168 HTML_TAG_BALANCE_BODY 1888 0.68 0.86 0.59 169 MSGID_FROM_MTA_HEADER 1846 0.43 0.12 0.58 170 HTML_IMAGE_ONLY_20 1844 0.75 1.10 0.58 171 TR_XM_Base64_M1 1843 0.65 0.81 0.58 172 HTML_IMAGE_ONLY_32 1794 0.43 0.15 0.56 173 LongTLD 1784 0.69 0.97 0.56 174 NML_ADSP_CUSTOM_MED 1749 0.70 1.02 0.55 175 XM_B_DNDMA 1744 0.67 0.92 0.55 176 XMBody_95 1728 0.41 0.12 0.54 177 URI_TRY_3LD 1725 0.90 1.67 0.54 178 TR_XM_SpammyWords2 1722 3.70 10.43 0.54 179 XMBody_78 1658 0.62 0.83 0.52 180 MPART_ALT_DIFF_COUNT 1626 0.77 1.31 0.51 181 XMBSHREFv2 1603 0.47 0.38 0.50 182 FORGED_GMAIL_RCVD 1592 0.64 0.93 0.50 183 T_Symld_Words_02 1569 0.54 0.65 0.49 184 T_STY_INVIS_DIRECT 1555 0.61 0.86 0.49 185 SUBJ_DOLLARS 1550 0.51 0.57 0.49 186 RELAYCOUNTRY_AU 1541 1.14 2.54 0.48 187 HELO_MISC_IP 1527 0.34 0.04 0.48 188 XMPhish14 1523 0.71 1.19 0.48 189 XMPhish30 1523 0.75 1.34 0.48 190 XMSubMetaI_00 1522 0.68 1.12 0.48 191 SpammyFromTLD_02 1520 1.14 2.54 0.48 192 XMMoneyMeta_00 1496 0.65 1.02 0.47 193 XMGappySubj_02 1491 0.33 0.05 0.47 194 XMDateMe_00 1484 0.47 0.48 0.47 195 XMLngstWrd_00 1452 0.69 1.20 0.46 196 XMHTML_After_End 1360 0.61 0.99 0.43 197 XM_Ancestry_Forge 1312 0.28 0.00 0.41 198 HTML_EXTRA_CLOSE 1307 0.29 0.04 0.41 199 RELAYCOUNTRY_DE 1288 0.39 0.36 0.40 200 HTML_FONT_FACE_BAD 1281 0.49 0.69 0.40 ----------------------------------------------------------------------