Email: 439448 Autolearn: 0 AvgScore: 4.70 AvgScanTime: 1.28 sec Spam: 135693 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 1.41 sec Ham: 303755 Autolearn: 0 AvgScore: 0.36 AvgScanTime: 1.22 sec Time Spent Running SA: 155.77 hours Time Spent Processing Spam: 52.98 hours Time Spent Processing Ham: 102.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129022 89.71 95.08 87.31 2 DKIM_SIGNED 121675 77.92 89.67 72.68 3 XM_DK_Pass 116530 75.82 85.88 71.33 4 XM_B_Unicode 116508 73.48 85.86 67.95 5 DKIM_VALID 115322 74.86 84.99 70.33 6 RELAYCOUNTRY_US 113645 79.39 83.75 77.44 7 DCC_CHECK 102243 49.29 75.35 37.65 8 XM_B_SpammyWords 95578 51.35 70.44 42.82 9 XMListUnsubscribeExists 93178 53.69 68.67 47.01 10 DKIM_VALID_AU 92451 60.15 68.13 56.59 11 XM_B_Unicode3 69300 43.06 51.07 39.48 12 LOC_TINY_FONT_1 68702 37.93 50.63 32.26 13 XM_B_SpammyWords2 55699 24.84 41.05 17.59 14 BAYES_50 54908 55.27 40.46 61.88 15 XM_DK_Undo_02 54381 15.88 40.08 5.08 16 RCVD_IN_MSPIKE_H2 53198 35.76 39.20 34.22 17 HTML_FONT_LOW_CONTRAST 51002 30.44 37.59 27.25 18 FVGT_m_MULTI_ODD 43205 26.80 31.84 24.54 19 T_KAM_HTML_FONT_INVALID 41804 24.36 30.81 21.48 20 BAYES_99 41674 11.96 30.71 3.58 21 DKIM_VALID_EF 41242 28.90 30.39 28.23 22 TR_XM_DKIM_Undo 39644 10.61 29.22 2.30 23 MIME_HTML_ONLY 38947 26.04 28.70 24.85 24 XMSubLong 32617 22.55 24.04 21.89 25 BAYES_999 32296 9.25 23.80 2.75 26 DCC_CHECK_NEGATIVE 31413 50.22 23.15 62.31 27 TR_DCC_Bayes_99 30584 7.89 22.54 1.34 28 T_TM2_M_HEADER_IN_MSG 29111 26.41 21.45 28.63 29 TR_XM_DK_Unsub 28970 15.39 21.35 12.73 30 XM_Multi_Part_URI 28316 15.56 20.87 13.19 31 UNPARSEABLE_RELAY 25664 13.73 18.91 11.42 32 XM_B_Unsub 23091 11.55 17.02 9.10 33 TR_XM_BayesUnsub 22218 9.52 16.37 6.46 34 XM_B_SpammyWords3 20410 7.61 15.04 4.29 35 RELAYCOUNTRY_META 20108 7.19 14.82 3.79 36 TR_MAX_INTL_RELAY 19284 8.14 14.21 5.43 37 LOTS_OF_MONEY 18034 8.13 13.29 5.82 38 TR_XM_SpammyWords4 16412 6.43 12.09 3.89 39 TR_XM_SpammyWords2 16004 4.07 11.79 0.62 40 TR_XM_SpammyRelay 15193 4.95 11.20 2.16 41 BOTNET_IPINHOSTNAME 14311 5.57 10.55 3.35 42 FSL_BULK_SIG 14024 8.38 10.34 7.51 43 XM_Evil_Numbers_Gen 13900 8.93 10.24 8.35 44 TR_XM_UnparsRelay 12974 3.94 9.56 1.43 45 XM_B_Phish_Phrases 12759 6.27 9.40 4.87 46 BOTNET 12541 3.84 9.24 1.43 47 LotsOfNums_01 12354 8.25 9.10 7.86 48 BAYES_80 12168 5.04 8.97 3.28 49 BAYES_60 11131 7.20 8.20 6.75 50 RCVD_IN_BL_SPAMCOP_NET 10755 2.81 7.93 0.52 51 T_SCC_BODY_TEXT_LINE 10582 8.21 7.80 8.40 52 XMSubMetaSx_00 9833 4.75 7.25 3.64 53 XM_Body_Dirty_Words 9473 4.05 6.98 2.73 54 HTML_IMAGE_RATIO_02 8544 4.89 6.30 4.26 55 XM_B_PhoneNumber 8399 8.11 6.19 8.96 56 MPART_ALT_DIFF 8325 4.75 6.14 4.13 57 TR_XM_SPAMCOP 8056 2.02 5.94 0.26 58 XM_H_Long_From01 7989 5.76 5.89 5.70 59 HTML_IMAGE_RATIO_04 7834 8.53 5.77 9.76 60 UNTRUSTED_Relay 7618 2.75 5.61 1.48 61 RELAYCOUNTRY_CA 7388 2.49 5.44 1.17 62 XM_UncommonTLD01 7381 4.44 5.44 3.99 63 TR_XM_PhishingBody 6736 2.76 4.96 1.78 64 TM2_M_VERY_LONG_WORD 6697 2.88 4.94 1.96 65 BAYES_95 6642 2.99 4.89 2.14 66 DKIM_INVALID 6353 3.06 4.68 2.34 67 XMSexyCombo_05 6153 2.51 4.53 1.60 68 XM_H_GMP 6135 5.21 4.52 5.52 69 T_XMDrugObfuBody_14 5895 2.89 4.34 2.25 70 HTML_IMAGE_RATIO_06 5763 2.99 4.25 2.43 71 XMStrtUSub 5730 4.58 4.22 4.74 72 XM_B_Investor 5724 2.41 4.22 1.60 73 XM_B_SpammyTLD 5541 3.31 4.08 2.96 74 MIME_HTML_MOSTLY 5505 2.71 4.06 2.11 75 XM_CamelCaseFrm001 5265 2.73 3.88 2.21 76 MIME_HTML_ONLY_MULTI 5077 2.86 3.74 2.47 77 TooManyTo_001 5003 6.83 3.69 8.23 78 TR_XM_SpammyWords5 4789 1.85 3.53 1.11 79 T_XMDrugObfuBody_08 4599 2.23 3.39 1.71 80 MIME_QP_LONG_LINE 4355 4.16 3.21 4.58 81 XM_SPF_SoftFail 4320 1.88 3.18 1.30 82 XMNumbers 4302 2.90 3.17 2.77 83 RCVD_IN_MSPIKE_WL 4218 4.37 3.11 4.93 84 RCVD_IN_MSPIKE_H3 4217 4.36 3.11 4.92 85 XM_OfRef6 4202 1.76 3.10 1.16 86 XM_B_Unsub2 4087 1.94 3.01 1.47 87 HTML_IMAGE_RATIO_08 4050 2.19 2.98 1.84 88 FROM_EXCESS_BASE64 3972 2.15 2.93 1.80 89 XMDiploma_00 3875 1.79 2.86 1.32 90 XM_URI_RBL 3838 1.10 2.83 0.33 91 XM_B_URI_Unicode 3702 2.24 2.73 2.03 92 XM_B_SpammyWords4 3687 1.36 2.72 0.75 93 RCVD_IN_VALIDITY_SAFE 3669 3.36 2.70 3.65 94 RELAYCOUNTRY_AU 3662 1.23 2.70 0.58 95 XM_UB50 3499 1.44 2.58 0.94 96 MAILING_LIST_MULTI 3430 2.63 2.53 2.68 97 TR_XM_NoHeaderRelay 3395 0.89 2.50 0.18 98 TM2_M_URI_OPT_OUT 3349 2.05 2.47 1.86 99 XMBody_17 3284 1.06 2.42 0.45 100 XM_SendGrid 3279 1.70 2.42 1.38 101 T_XMHurry_00 3181 1.07 2.34 0.51 102 T_XMDrugObfuBody_00 3169 1.33 2.34 0.89 103 ANY_BOUNCE_MESSAGE 3100 3.24 2.28 3.67 104 BOUNCE_MESSAGE 3093 3.24 2.28 3.67 105 XMStockSpam_06 3019 1.55 2.22 1.25 106 ALL_TRUSTED 3012 14.11 2.22 19.43 107 BAYES_40 2880 4.36 2.12 5.36 108 XMBrknScrpt_02 2869 1.24 2.11 0.84 109 USER_IN_DEF_DKIM_WL 2863 9.36 2.11 12.60 110 RCVD_IN_VALIDITY_CERTIFIED 2781 2.65 2.05 2.91 111 SpammyFromTLD_02 2717 1.02 2.00 0.58 112 KHOP_HELO_FCRDNS 2716 1.68 2.00 1.54 113 TR_XM_INV_DKIM 2604 0.69 1.92 0.13 114 RCVD_IN_VALIDITY_RPBL 2562 0.66 1.89 0.11 115 T_TooManySym_01 2537 4.57 1.87 5.78 116 T_FILL_THIS_FORM_SHORT 2524 1.14 1.86 0.81 117 SUBJ_ALL_CAPS 2447 1.55 1.80 1.43 118 URI_HEX 2380 1.25 1.75 1.03 119 SpammyFromTLD_01 2321 0.98 1.71 0.65 120 T_REMOTE_IMAGE 2320 2.98 1.71 3.54 121 HTML_MIME_NO_HTML_TAG 2249 2.22 1.66 2.47 122 BAYES_20 2198 3.10 1.62 3.76 123 XMPhish30 2177 0.77 1.60 0.39 124 TR_MetaPhish_Combo_01 2118 1.01 1.56 0.77 125 TR_LOTS_OF_MONEY3 2113 0.74 1.56 0.38 126 XM_PDF 2050 3.43 1.51 4.29 127 SHORTCIRCUIT 2015 0.46 1.48 0.00 128 RCVD_IN_ZEN_LASTEXTERNAL 2015 0.46 1.48 0.00 129 HTTPS_HTTP_MISMATCH 1983 0.88 1.46 0.63 130 XM_B_COPY_HTML 1920 1.15 1.41 1.03 131 XM_DK_Undo_01 1906 1.56 1.40 1.62 132 URI_TRY_3LD 1904 0.88 1.40 0.65 133 XMGenDplmaNmb 1881 0.91 1.39 0.70 134 XMBdyGiftCard01 1830 0.87 1.35 0.65 135 HTML_FONT_TINY_NORDNS 1802 0.44 1.33 0.05 136 MAY_BE_FORGED 1772 0.80 1.31 0.58 137 TR_XM_Base64_M1 1763 0.90 1.30 0.72 138 THIS_AD 1755 0.66 1.29 0.38 139 URI_NOVOWEL 1728 1.69 1.27 1.88 140 DKIM_ADSP_CUSTOM_MED 1727 0.91 1.27 0.75 141 SHOPIFY_IMG_NOT_RCVD_SFY 1704 0.61 1.26 0.32 142 TM2_M_OBFU_COMMENT 1682 0.74 1.24 0.51 143 XMSexyCombo_01 1582 0.51 1.17 0.22 144 TR_XM_PHPDW 1578 0.65 1.16 0.42 145 XM_B_Phish66 1576 0.63 1.16 0.39 146 TR_XM_PHPForged 1561 0.64 1.15 0.42 147 DIET_1 1556 0.54 1.15 0.27 148 XM_H_Long_From02 1555 0.96 1.15 0.88 149 TR_XM_FormFill2 1548 0.64 1.14 0.41 150 XM_ProductURIs 1533 0.68 1.13 0.48 151 XM_H_PHPOS 1522 0.63 1.12 0.41 152 TR_LOTS_OF_MONEY2 1520 0.48 1.12 0.19 153 T_MONEY_PERCENT 1520 0.48 1.12 0.19 154 XM_B_SEO 1472 0.54 1.08 0.30 155 MPART_ALT_DIFF_COUNT 1470 0.67 1.08 0.48 156 RELAYCOUNTRY_FR 1461 0.52 1.08 0.27 157 XMSubMetaI_00 1442 0.59 1.06 0.38 158 HTML_TAG_BALANCE_BODY 1433 0.77 1.06 0.65 159 TR_XM_DK_SendGrid 1424 0.94 1.05 0.89 160 XMSubMetaSxObfu_03 1421 0.55 1.05 0.33 161 NML_ADSP_CUSTOM_MED 1415 0.66 1.04 0.49 162 TR_Mismatch_TLD_02 1396 0.36 1.03 0.06 163 RCVD_IN_IADB_LISTED 1372 2.82 1.01 3.63 164 RCVD_IN_PBL 1354 0.72 1.00 0.60 165 FORGED_GMAIL_RCVD 1350 0.64 0.99 0.48 166 XM_B_DNDMA 1342 0.78 0.99 0.69 167 XM_DIRTYINTL 1323 0.35 0.97 0.07 168 XM_B_COVIDMETA 1318 0.46 0.97 0.23 169 XM_UB99 1312 0.30 0.97 0.01 170 TR_Symld_Words 1307 1.39 0.96 1.59 171 TR_XM_SEO4 1305 0.42 0.96 0.17 172 XM_B_REG_HTML 1294 0.43 0.95 0.19 173 RCVD_IN_IADB_SPF 1292 2.48 0.95 3.17 174 RCVD_IN_IADB_DK 1263 2.20 0.93 2.77 175 RCVD_IN_IADB_SENDERID 1257 2.24 0.93 2.83 176 URIBL_BLACK 1252 0.33 0.92 0.06 177 XM_HighProb1 1233 0.29 0.91 0.01 178 DEAR_FRIEND 1212 0.33 0.89 0.08 179 HTML_IMAGE_ONLY_20 1209 0.60 0.89 0.47 180 RDNS_DYNAMIC 1208 0.45 0.89 0.26 181 J_POPCORN_WO_D 1196 0.44 0.88 0.24 182 XMBody_78 1180 0.52 0.87 0.37 183 XMPhish14 1164 0.80 0.86 0.77 184 BOTNET_NORDNS 1148 0.27 0.85 0.02 185 TR_XM_Base64_M2 1123 0.42 0.83 0.24 186 RCVD_IN_PSBL 1106 0.46 0.82 0.30 187 XM_H_Undi_Recip 1103 0.42 0.81 0.24 188 RELAYCOUNTRY_CN 1097 0.30 0.81 0.08 189 PDS_RDNS_DYNAMIC_FP 1096 0.34 0.81 0.13 190 XMReplyNow 1085 0.42 0.80 0.24 191 BAYES_05 1070 1.86 0.79 2.33 192 TR_Mismatch_TLD_01 1067 0.37 0.79 0.19 193 TR_XM_InvalidRelay 1052 0.25 0.78 0.01 194 TR_XM_RelayPhish 1050 0.29 0.77 0.08 195 TO_NO_BRKTS_FROM_MSSP 1048 0.25 0.77 0.01 196 RCVD_IN_SORBS_DUL 1037 0.26 0.76 0.03 197 HTML_FONT_FACE_BAD 1030 0.55 0.76 0.46 198 TM2_M_A_HREF_HREF 1028 0.42 0.76 0.26 199 XM_UB60 1014 0.27 0.75 0.06 200 RCVD_IN_XBL 1010 0.25 0.74 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 265197 89.71 95.08 87.31 2 RELAYCOUNTRY_US 235214 79.39 83.75 77.44 3 DKIM_SIGNED 220754 77.92 89.67 72.68 4 XM_DK_Pass 216659 75.82 85.88 71.33 5 DKIM_VALID 213642 74.86 84.99 70.33 6 XM_B_Unicode 206391 73.48 85.86 67.95 7 DCC_CHECK_NEGATIVE 189270 50.22 23.15 62.31 8 BAYES_50 187976 55.27 40.46 61.88 9 DKIM_VALID_AU 171891 60.15 68.13 56.59 10 XMListUnsubscribeExists 142782 53.69 68.67 47.01 11 XM_B_SpammyWords 130067 51.35 70.44 42.82 12 XM_B_Unicode3 119929 43.06 51.07 39.48 13 DCC_CHECK 114352 49.29 75.35 37.65 14 RCVD_IN_MSPIKE_H2 103950 35.76 39.20 34.22 15 LOC_TINY_FONT_1 97998 37.93 50.63 32.26 16 T_TM2_M_HEADER_IN_MSG 86969 26.41 21.45 28.63 17 DKIM_VALID_EF 85746 28.90 30.39 28.23 18 HTML_FONT_LOW_CONTRAST 82761 30.44 37.59 27.25 19 MIME_HTML_ONLY 75474 26.04 28.70 24.85 20 FVGT_m_MULTI_ODD 74548 26.80 31.84 24.54 21 XMSubLong 66498 22.55 24.04 21.89 22 T_KAM_HTML_FONT_INVALID 65248 24.36 30.81 21.48 23 ALL_TRUSTED 59014 14.11 2.22 19.43 24 XM_B_SpammyWords2 53444 24.84 41.05 17.59 25 XM_Multi_Part_URI 40066 15.56 20.87 13.19 26 TR_XM_DK_Unsub 38658 15.39 21.35 12.73 27 USER_IN_DEF_DKIM_WL 38262 9.36 2.11 12.60 28 UNPARSEABLE_RELAY 34675 13.73 18.91 11.42 29 BAYES_00 33162 7.77 0.74 10.92 30 HTML_IMAGE_RATIO_04 29645 8.53 5.77 9.76 31 XM_B_Unsub 27653 11.55 17.02 9.10 32 XM_B_PhoneNumber 27219 8.11 6.19 8.96 33 T_SCC_BODY_TEXT_LINE 25509 8.21 7.80 8.40 34 XM_Evil_Numbers_Gen 25349 8.93 10.24 8.35 35 TooManyTo_001 24996 6.83 3.69 8.23 36 LotsOfNums_01 23879 8.25 9.10 7.86 37 FSL_BULK_SIG 22821 8.38 10.34 7.51 38 TR_XM_DK_Bayes 22447 5.30 0.62 7.39 39 TR_XM_DK_Bayes1 21995 5.19 0.61 7.24 40 BAYES_60 20505 7.20 8.20 6.75 41 XM_DKIMWhitelistDomains 20316 4.66 0.12 6.69 42 TR_XM_BayesUnsub 19613 9.52 16.37 6.46 43 IN_ZIMBRA_NJ_WHITELIST 19558 4.48 0.08 6.44 44 TR_XM_DK_Bayes2 18710 4.41 0.48 6.16 45 LOTS_OF_MONEY 17687 8.13 13.29 5.82 46 T_TooManySym_01 17543 4.57 1.87 5.78 47 XM_H_Long_From01 17321 5.76 5.89 5.70 48 XM_H_GMP 16773 5.21 4.52 5.52 49 TR_MAX_INTL_RELAY 16481 8.14 14.21 5.43 50 BAYES_40 16275 4.36 2.12 5.36 51 BASE64_LENGTH_79_INF 15882 3.69 0.25 5.23 52 HTML_OBFUSCATE_05_10 15518 3.58 0.14 5.11 53 XM_DK_Undo_02 15422 15.88 40.08 5.08 54 FORGED_OUTLOOK_HTML 15203 3.48 0.05 5.01 55 RCVD_IN_MSPIKE_WL 14964 4.37 3.11 4.93 56 RCVD_IN_MSPIKE_H3 14947 4.36 3.11 4.92 57 XM_B_Phish_Phrases 14808 6.27 9.40 4.87 58 XMStrtUSub 14387 4.58 4.22 4.74 59 MIME_QP_LONG_LINE 13924 4.16 3.21 4.58 60 XM_PDF 13030 3.43 1.51 4.29 61 XM_B_SpammyWords3 13017 7.61 15.04 4.29 62 HTML_IMAGE_RATIO_02 12942 4.89 6.30 4.26 63 MPART_ALT_DIFF 12545 4.75 6.14 4.13 64 XM_UncommonTLD01 12128 4.44 5.44 3.99 65 TR_XM_SpammyWords4 11830 6.43 12.09 3.89 66 RELAYCOUNTRY_META 11500 7.19 14.82 3.79 67 BAYES_20 11418 3.10 1.62 3.76 68 ANY_BOUNCE_MESSAGE 11150 3.24 2.28 3.67 69 BOUNCE_MESSAGE 11145 3.24 2.28 3.67 70 RCVD_IN_VALIDITY_SAFE 11088 3.36 2.70 3.65 71 XMSubMetaSx_00 11059 4.75 7.25 3.64 72 RCVD_IN_IADB_LISTED 11014 2.82 1.01 3.63 73 BAYES_99 10863 11.96 30.71 3.58 74 T_REMOTE_IMAGE 10768 2.98 1.71 3.54 75 BOTNET_IPINHOSTNAME 10185 5.57 10.55 3.35 76 BAYES_80 9965 5.04 8.97 3.28 77 RCVD_IN_IADB_SPF 9621 2.48 0.95 3.17 78 T_TooManySym_02 9280 2.27 0.50 3.06 79 TooManyTo_002 9142 2.26 0.59 3.01 80 XM_B_SpammyTLD 8995 3.31 4.08 2.96 81 RCVD_IN_VALIDITY_CERTIFIED 8853 2.65 2.05 2.91 82 RCVD_IN_IADB_SENDERID 8603 2.24 0.93 2.83 83 XMNumbers 8423 2.90 3.17 2.77 84 RCVD_IN_IADB_DK 8400 2.20 0.93 2.77 85 BAYES_999 8367 9.25 23.80 2.75 86 XM_Body_Dirty_Words 8305 4.05 6.98 2.73 87 MAILING_LIST_MULTI 8127 2.63 2.53 2.68 88 HTML_MIME_NO_HTML_TAG 7493 2.22 1.66 2.47 89 MIME_HTML_ONLY_MULTI 7489 2.86 3.74 2.47 90 HTML_IMAGE_RATIO_06 7380 2.99 4.25 2.43 91 RCVD_IN_IADB_VOUCHED 7336 1.76 0.31 2.42 92 INVALID_MSGID 7249 1.73 0.26 2.39 93 DKIM_INVALID 7112 3.06 4.68 2.34 94 BAYES_05 7083 1.86 0.79 2.33 95 TR_XM_DKIM_Undo 6993 10.61 29.22 2.30 96 T_XMDrugObfuBody_14 6822 2.89 4.34 2.25 97 XM_CamelCaseFrm001 6711 2.73 3.88 2.21 98 TR_XM_SpammyRelay 6575 4.95 11.20 2.16 99 BAYES_95 6495 2.99 4.89 2.14 100 MIME_HTML_MOSTLY 6421 2.71 4.06 2.11 101 TO_MALFORMED 6292 1.45 0.05 2.07 102 XM_B_URI_Unicode 6154 2.24 2.73 2.03 103 TM2_M_VERY_LONG_WORD 5943 2.88 4.94 1.96 104 URI_NOVOWEL 5711 1.69 1.27 1.88 105 TM2_M_URI_OPT_OUT 5639 2.05 2.47 1.86 106 HTML_IMAGE_RATIO_08 5577 2.19 2.98 1.84 107 FROM_EXCESS_BASE64 5479 2.15 2.93 1.80 108 TR_XM_PhishingBody 5398 2.76 4.96 1.78 109 RCVD_IN_IADB_OPTIN 5237 1.24 0.17 1.72 110 T_XMDrugObfuBody_08 5180 2.23 3.39 1.71 111 DEAR_SOMETHING 5177 1.29 0.35 1.70 112 XM_DK_Undo_01 4935 1.56 1.40 1.62 113 XMSexyCombo_05 4865 2.51 4.53 1.60 114 XM_B_Investor 4861 2.41 4.22 1.60 115 TR_Symld_Words 4820 1.39 0.96 1.59 116 TooManyTo_003 4804 1.25 0.51 1.58 117 KHOP_HELO_FCRDNS 4666 1.68 2.00 1.54 118 UNTRUSTED_Relay 4482 2.75 5.61 1.48 119 XM_B_Unsub2 4458 1.94 3.01 1.47 120 BOTNET 4355 3.84 9.24 1.43 121 SUBJ_ALL_CAPS 4352 1.55 1.80 1.43 122 TR_XM_UnparsRelay 4335 3.94 9.56 1.43 123 XM_SendGrid 4182 1.70 2.42 1.38 124 IN_HORDE_ADDRESS_BOOK 4160 0.97 0.08 1.37 125 TR_DCC_Bayes_99 4077 7.89 22.54 1.34 126 XMDiploma_00 4009 1.79 2.86 1.32 127 XM_SPF_SoftFail 3958 1.88 3.18 1.30 128 T_TooManySym_03 3903 0.94 0.18 1.28 129 XMStockSpam_06 3802 1.55 2.22 1.25 130 XM_GoogleGroups 3797 1.08 0.70 1.25 131 XMGappySubj_01 3761 0.95 0.30 1.24 132 TooManyTo_004 3571 0.95 0.44 1.18 133 RELAYCOUNTRY_CA 3546 2.49 5.44 1.17 134 XM_OfRef6 3528 1.76 3.10 1.16 135 TR_XM_SpammyWords5 3358 1.85 3.53 1.11 136 URI_HEX 3133 1.25 1.75 1.03 137 XMCapTrack 3132 0.85 0.45 1.03 138 TVD_SPACE_RATIO 3132 0.77 0.19 1.03 139 HELO_NODOT 3130 0.75 0.12 1.03 140 XM_B_COPY_HTML 3127 1.15 1.41 1.03 141 HELO_NO_DOMAIN 3121 0.75 0.11 1.03 142 FROM_GOV_DKIM_AU 3101 0.76 0.17 1.02 143 TooManyTo_005 2949 0.80 0.41 0.97 144 XM_UB50 2842 1.44 2.58 0.94 145 XM_H_PHPMailer 2752 0.79 0.54 0.91 146 TR_XM_DK_SendGrid 2707 0.94 1.05 0.89 147 T_XMDrugObfuBody_00 2694 1.33 2.34 0.89 148 XM_H_Long_From02 2680 0.96 1.15 0.88 149 HTML_IMAGE_ONLY_32 2594 0.65 0.21 0.85 150 XMBrknScrpt_02 2560 1.24 2.11 0.84 151 XM_ShortIntro_01 2489 0.67 0.34 0.82 152 T_FILL_THIS_FORM_SHORT 2469 1.14 1.86 0.81 153 XMPhish14 2348 0.80 0.86 0.77 154 TR_MetaPhish_Combo_01 2338 1.01 1.56 0.77 155 XM_B_FormFill 2287 0.53 0.02 0.75 156 TVD_RCVD_IP 2285 0.73 0.67 0.75 157 DKIM_ADSP_CUSTOM_MED 2284 0.91 1.27 0.75 158 XM_B_SpammyWords4 2270 1.36 2.72 0.75 159 TR_XM_Base64_M1 2175 0.90 1.30 0.72 160 XMGenDplmaNmb 2137 0.91 1.39 0.70 161 XM_B_DNDMA 2106 0.78 0.99 0.69 162 XMBdyGiftCard01 1984 0.87 1.35 0.65 163 HTML_TAG_BALANCE_BODY 1971 0.77 1.06 0.65 164 URI_TRY_3LD 1969 0.88 1.40 0.65 165 SpammyFromTLD_01 1967 0.98 1.71 0.65 166 XMSlimDrugH 1940 0.65 0.66 0.64 167 T_OBFU_PDF_ATTACH 1925 0.50 0.20 0.63 168 XMNoVowels 1914 0.62 0.59 0.63 169 XMLngstWrd_00 1912 0.63 0.64 0.63 170 HTTPS_HTTP_MISMATCH 1904 0.88 1.46 0.63 171 TR_XM_SpammyWords2 1891 4.07 11.79 0.62 172 RCVD_IN_PBL 1831 0.72 1.00 0.60 173 XMGappySubj_02 1799 0.43 0.06 0.59 174 XMBody_95 1779 0.46 0.18 0.59 175 SpammyFromTLD_02 1767 1.02 2.00 0.58 176 MAY_BE_FORGED 1761 0.80 1.31 0.58 177 RELAYCOUNTRY_AU 1748 1.23 2.70 0.58 178 T_TVD_MIME_NO_HEADERS 1698 0.39 0.03 0.56 179 RELAYCOUNTRY_GB 1634 0.60 0.73 0.54 180 MSGID_FROM_MTA_HEADER 1609 0.42 0.18 0.53 181 TO_NO_BRKTS_HTML_ONLY 1607 0.55 0.60 0.53 182 RCVD_IN_BL_SPAMCOP_NET 1581 2.81 7.93 0.52 183 TM2_M_OBFU_COMMENT 1550 0.74 1.24 0.51 184 LongTLD 1543 0.57 0.71 0.51 185 T_XMHurry_00 1536 1.07 2.34 0.51 186 XMBSHREFv2 1496 0.47 0.43 0.49 187 HELO_MISC_IP 1493 0.35 0.03 0.49 188 NML_ADSP_CUSTOM_MED 1477 0.66 1.04 0.49 189 MPART_ALT_DIFF_COUNT 1461 0.67 1.08 0.48 190 FORGED_GMAIL_RCVD 1457 0.64 0.99 0.48 191 XM_ProductURIs 1447 0.68 1.13 0.48 192 T_Symld_Words_02 1415 0.55 0.73 0.47 193 HTML_IMAGE_ONLY_20 1413 0.60 0.89 0.47 194 HTML_FONT_FACE_BAD 1391 0.55 0.76 0.46 195 FILL_THIS_FORM 1376 0.45 0.43 0.45 196 XMBody_17 1363 1.06 2.42 0.45 197 USER_IN_WELCOMELIST 1306 0.30 0.00 0.43 198 USER_IN_WHITELIST 1306 0.30 0.00 0.43 199 MISSING_HEADERS 1298 0.49 0.63 0.43 200 TR_XM_PHPDW 1277 0.65 1.16 0.42 ----------------------------------------------------------------------