Email: 469857 Autolearn: 0 AvgScore: 4.63 AvgScanTime: 1.33 sec Spam: 145982 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.48 sec Ham: 323875 Autolearn: 0 AvgScore: 0.27 AvgScanTime: 1.26 sec Time Spent Running SA: 173.45 hours Time Spent Processing Spam: 60.03 hours Time Spent Processing Ham: 113.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139415 90.15 95.50 87.74 2 DKIM_SIGNED 129045 78.47 88.40 74.00 3 XM_B_Unicode 124456 76.20 85.25 72.11 4 XM_DK_Pass 123194 76.30 84.39 72.66 5 DKIM_VALID 122291 75.35 83.77 71.55 6 RELAYCOUNTRY_US 121273 81.53 83.07 80.84 7 DCC_CHECK 107468 49.55 73.62 38.71 8 XM_B_SpammyWords 100093 52.22 68.57 44.85 9 XMListUnsubscribeExists 97097 53.49 66.51 47.62 10 DKIM_VALID_AU 96340 60.38 65.99 57.85 11 XM_B_Unicode3 73529 44.33 50.37 41.61 12 LOC_TINY_FONT_1 72692 37.05 49.80 31.31 13 BAYES_50 61952 55.95 42.44 62.03 14 XM_B_SpammyWords2 59038 25.59 40.44 18.90 15 T_SCC_BODY_TEXT_LINE 57604 41.46 39.46 42.36 16 RCVD_IN_MSPIKE_H2 57516 35.67 39.40 33.99 17 XM_DK_Undo_02 54214 14.79 37.14 4.72 18 HTML_FONT_LOW_CONTRAST 54027 31.52 37.01 29.05 19 FVGT_m_MULTI_ODD 47662 26.62 32.65 23.91 20 T_KAM_HTML_FONT_INVALID 46386 24.18 31.78 20.76 21 MIME_HTML_ONLY 42524 24.60 29.13 22.56 22 DKIM_VALID_EF 41834 28.59 28.66 28.57 23 BAYES_99 41580 11.20 28.48 3.42 24 TR_XM_DKIM_Undo 38504 9.86 26.38 2.41 25 XMSubLong 36939 24.84 25.30 24.63 26 DCC_CHECK_NEGATIVE 36343 49.95 24.90 61.25 27 T_TM2_M_HEADER_IN_MSG 35073 29.31 24.03 31.69 28 BAYES_999 31486 8.51 21.57 2.63 29 TR_DCC_Bayes_99 29994 7.38 20.55 1.44 30 TR_XM_DK_Unsub 29911 15.17 20.49 12.77 31 XM_Multi_Part_URI 29783 15.53 20.40 13.34 32 XM_B_Unsub 27406 12.13 18.77 9.13 33 TR_XM_BayesUnsub 26458 10.21 18.12 6.65 34 UNPARSEABLE_RELAY 26338 13.96 18.04 12.12 35 RELAYCOUNTRY_META 23722 7.64 16.25 3.75 36 XM_B_SpammyWords3 21913 8.07 15.01 4.94 37 TR_MAX_INTL_RELAY 21041 8.19 14.41 5.39 38 LOTS_OF_MONEY 20216 8.91 13.85 6.68 39 BOTNET_IPINHOSTNAME 18694 6.07 12.81 3.04 40 TR_XM_SpammyWords4 18119 7.03 12.41 4.60 41 XM_Evil_Numbers_Gen 16166 10.91 11.07 10.84 42 TR_XM_SpammyRelay 15863 4.74 10.87 1.98 43 FSL_BULK_SIG 15361 8.48 10.52 7.56 44 XM_B_Phish_Phrases 15017 7.11 10.29 5.67 45 TR_XM_SpammyWords2 14357 3.48 9.83 0.61 46 TR_XM_UnparsRelay 13752 4.10 9.42 1.70 47 BOTNET 13453 3.86 9.22 1.44 48 BAYES_80 13003 5.07 8.91 3.34 49 LotsOfNums_01 12535 9.07 8.59 9.29 50 BAYES_60 12059 7.38 8.26 6.99 51 RCVD_IN_BL_SPAMCOP_NET 11612 2.76 7.95 0.42 52 XMSubMetaSx_00 11393 4.89 7.80 3.58 53 XM_Body_Dirty_Words 11007 3.98 7.54 2.37 54 HTML_IMAGE_RATIO_02 10542 5.69 7.22 5.00 55 XM_UncommonTLD01 9866 4.87 6.76 4.03 56 MPART_ALT_DIFF 9215 5.19 6.31 4.68 57 XM_B_PhoneNumber 9115 8.93 6.24 10.14 58 UNTRUSTED_Relay 8894 2.81 6.09 1.34 59 RELAYCOUNTRY_CA 8521 2.50 5.84 1.00 60 XM_H_Long_From01 8254 5.78 5.65 5.83 61 TR_XM_SPAMCOP 7974 1.82 5.46 0.18 62 TM2_M_VERY_LONG_WORD 7914 4.14 5.42 3.56 63 BAYES_95 7625 3.03 5.22 2.05 64 XMSexyCombo_05 7473 2.55 5.12 1.39 65 XM_H_GMP 7454 5.54 5.11 5.73 66 HTML_IMAGE_RATIO_04 7441 4.70 5.10 4.52 67 HTML_IMAGE_RATIO_06 7426 4.96 5.09 4.90 68 XM_B_SpammyTLD 7294 3.60 5.00 2.98 69 DKIM_INVALID 6754 3.13 4.63 2.45 70 TR_XM_PhishingBody 6715 2.50 4.60 1.55 71 T_XMDrugObfuBody_14 6131 2.88 4.20 2.28 72 TooManyTo_001 5908 6.90 4.05 8.19 73 XMStrtUSub 5768 4.31 3.95 4.47 74 XM_B_Investor 5582 2.23 3.82 1.52 75 TR_XM_SpammyWords5 5448 2.36 3.73 1.75 76 T_XMDrugObfuBody_08 5359 2.27 3.67 1.65 77 MIME_HTML_MOSTLY 5334 2.78 3.65 2.38 78 XM_OfRef6 5331 1.76 3.65 0.91 79 XM_CamelCaseFrm001 5208 2.53 3.57 2.07 80 MIME_QP_LONG_LINE 5190 4.57 3.56 5.03 81 XMNumbers 5129 4.53 3.51 4.99 82 MIME_HTML_ONLY_MULTI 4989 2.86 3.42 2.60 83 XM_UB50 4928 1.61 3.38 0.82 84 XM_B_URI_Unicode 4567 2.46 3.13 2.16 85 ANY_BOUNCE_MESSAGE 4464 4.88 3.06 5.70 86 BOUNCE_MESSAGE 4459 4.88 3.05 5.70 87 XMDiploma_00 4382 2.09 3.00 1.68 88 HTML_IMAGE_RATIO_08 4305 2.34 2.95 2.06 89 TM2_M_URI_OPT_OUT 4288 2.07 2.94 1.68 90 XM_SPF_SoftFail 4205 1.83 2.88 1.36 91 TR_XM_NoHeaderRelay 4120 1.01 2.82 0.19 92 XM_B_Unsub2 4044 1.78 2.77 1.34 93 XM_B_SpammyWords4 3903 1.32 2.67 0.71 94 RELAYCOUNTRY_AU 3828 1.30 2.62 0.71 95 RCVD_IN_MSPIKE_WL 3807 4.69 2.61 5.63 96 RCVD_IN_MSPIKE_H3 3807 4.69 2.61 5.63 97 XM_URI_RBL 3497 0.93 2.40 0.27 98 URI_NOVOWEL 3405 1.89 2.33 1.69 99 T_TooManySym_01 3357 5.67 2.30 7.19 100 KHOP_HELO_FCRDNS 3354 2.42 2.30 2.47 101 RCVD_IN_VALIDITY_SAFE 3315 3.29 2.27 3.74 102 USER_IN_DEF_DKIM_WL 3285 9.64 2.25 12.98 103 TR_Symld_Words 3243 1.78 2.22 1.58 104 SUBJ_ALL_CAPS 3167 1.97 2.17 1.88 105 FROM_EXCESS_BASE64 3132 1.64 2.15 1.41 106 XMStockSpam_06 3080 1.75 2.11 1.59 107 XMBody_17 3032 0.97 2.08 0.47 108 BAYES_40 3016 4.29 2.07 5.29 109 MAILING_LIST_MULTI 3007 2.56 2.06 2.79 110 TR_XM_INV_DKIM 2944 0.75 2.02 0.18 111 XM_H_Long_From02 2902 1.17 1.99 0.80 112 T_XMDrugObfuBody_00 2814 1.24 1.93 0.94 113 HTML_MIME_NO_HTML_TAG 2757 2.24 1.89 2.40 114 T_XMHurry_00 2751 1.00 1.88 0.61 115 SpammyFromTLD_02 2749 0.88 1.88 0.42 116 ALL_TRUSTED 2738 11.86 1.88 16.36 117 URI_TRY_3LD 2579 0.94 1.77 0.57 118 XMGenDplmaNmb 2579 1.15 1.77 0.88 119 URI_HEX 2507 1.45 1.72 1.33 120 XMBrknScrpt_02 2467 1.09 1.69 0.81 121 T_REMOTE_IMAGE 2458 3.08 1.68 3.71 122 BAYES_20 2442 3.21 1.67 3.90 123 RCVD_IN_VALIDITY_RPBL 2439 0.56 1.67 0.06 124 RCVD_IN_VALIDITY_CERTIFIED 2368 2.64 1.62 3.10 125 SpammyFromTLD_01 2337 1.02 1.60 0.76 126 XM_DK_Undo_01 2302 1.71 1.58 1.77 127 MAY_BE_FORGED 2297 1.40 1.57 1.32 128 XM_SendGrid 2221 1.49 1.52 1.48 129 RCVD_IN_ZEN_LASTEXTERNAL 2146 0.46 1.47 0.00 130 SHORTCIRCUIT 2146 0.46 1.47 0.00 131 TR_LOTS_OF_MONEY2 2135 0.62 1.46 0.24 132 T_MONEY_PERCENT 2135 0.62 1.46 0.24 133 XM_B_Phish66 1989 0.64 1.36 0.32 134 TR_LOTS_OF_MONEY3 1969 0.65 1.35 0.33 135 T_FILL_THIS_FORM_SHORT 1943 0.93 1.33 0.75 136 XMBdyGiftCard01 1942 0.78 1.33 0.53 137 DIET_1 1929 0.73 1.32 0.47 138 XMPhish30 1923 0.80 1.32 0.57 139 RCVD_IN_PBL 1913 0.90 1.31 0.72 140 TR_XM_PHPForged 1912 0.83 1.31 0.62 141 HTTPS_HTTP_MISMATCH 1900 0.87 1.30 0.68 142 DKIM_ADSP_NXDOMAIN 1899 0.61 1.30 0.30 143 TR_XM_PHPDW 1892 0.81 1.30 0.60 144 TR_MetaPhish_Combo_01 1881 1.00 1.29 0.87 145 TR_XM_FormFill2 1863 0.81 1.28 0.60 146 DKIM_ADSP_CUSTOM_MED 1853 0.95 1.27 0.81 147 XM_B_DNDMA 1842 0.86 1.26 0.68 148 XM_H_PHPOS 1835 0.80 1.26 0.59 149 TR_XM_SpoofStaff 1829 0.53 1.25 0.20 150 XMSpoofStaff2 1791 0.46 1.23 0.11 151 XM_H_SpoofStaff4 1769 0.51 1.21 0.20 152 TR_XM_PSC1 1767 0.45 1.21 0.11 153 XMReplyNow 1744 0.56 1.19 0.27 154 XM_B_SEO 1735 0.65 1.19 0.41 155 XM_ProductURIs 1707 0.67 1.17 0.45 156 XMSexyCombo_01 1706 0.46 1.17 0.14 157 SHOPIFY_IMG_NOT_RCVD_SFY 1695 0.53 1.16 0.25 158 XMSubMetaSxObfu_03 1640 0.64 1.12 0.42 159 NML_ADSP_CUSTOM_MED 1595 0.71 1.09 0.53 160 XM_B_COPY_HTML 1595 0.77 1.09 0.63 161 XM_DIRTYINTL 1567 0.39 1.07 0.08 162 RCVD_IN_PSBL 1509 0.56 1.03 0.34 163 TR_XM_SEO4 1507 0.51 1.03 0.28 164 XMBody_78 1494 0.57 1.02 0.37 165 FORGED_GMAIL_RCVD 1491 0.66 1.02 0.50 166 TR_XM_RelayPhish 1486 0.38 1.02 0.09 167 MPART_ALT_DIFF_COUNT 1478 0.69 1.01 0.54 168 XMHTML_After_End 1451 0.59 0.99 0.40 169 XM_B_COVIDMETA 1440 0.47 0.99 0.24 170 TR_Mismatch_TLD_02 1431 0.36 0.98 0.08 171 XMPhish14 1430 0.57 0.98 0.39 172 LongTLD 1416 0.62 0.97 0.46 173 XMGppyBdWords 1378 0.37 0.94 0.11 174 BOTNET_NORDNS 1368 0.30 0.94 0.01 175 HTML_TAG_BALANCE_BODY 1360 0.73 0.93 0.64 176 TR_XM_Base64_M1 1328 0.68 0.91 0.58 177 XM_UB99 1303 0.28 0.89 0.00 178 RCVD_IN_IADB_LISTED 1297 2.84 0.89 3.72 179 RELAYCOUNTRY_GB 1286 0.60 0.88 0.47 180 TM2_M_OBFU_COMMENT 1269 0.50 0.87 0.33 181 XMSlimDrugH 1259 0.74 0.86 0.69 182 RELAYCOUNTRY_FR 1238 0.44 0.85 0.26 183 RDNS_DYNAMIC 1232 0.42 0.84 0.23 184 RCVD_IN_IADB_SPF 1229 2.49 0.84 3.23 185 RCVD_IN_IADB_SENDERID 1207 2.24 0.83 2.87 186 RCVD_IN_IADB_DK 1204 2.19 0.82 2.81 187 XMSubMetaI_00 1201 0.72 0.82 0.67 188 HTML_IMAGE_ONLY_20 1200 0.63 0.82 0.55 189 TR_XM_DK_SendGrid 1194 0.90 0.82 0.94 190 BAYES_05 1166 1.84 0.80 2.31 191 TM2_M_A_HREF_HREF 1143 0.41 0.78 0.24 192 RCVD_IN_XBL 1134 0.25 0.78 0.02 193 MISSING_HEADERS 1128 0.49 0.77 0.37 194 XM_UB60 1126 0.28 0.77 0.06 195 XMBounce_01 1101 0.25 0.75 0.02 196 RCVD_IN_SORBS_DUL 1091 0.27 0.75 0.05 197 TVD_RCVD_IP 1087 0.74 0.74 0.74 198 URIBL_BLACK 1080 0.27 0.74 0.05 199 DEAR_FRIEND 1077 0.26 0.74 0.05 200 XMClaimOffer 1070 0.33 0.73 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 284165 90.15 95.50 87.74 2 RELAYCOUNTRY_US 261814 81.53 83.07 80.84 3 DKIM_SIGNED 239675 78.47 88.40 74.00 4 XM_DK_Pass 235325 76.30 84.39 72.66 5 XM_B_Unicode 233555 76.20 85.25 72.11 6 DKIM_VALID 231737 75.35 83.77 71.55 7 BAYES_50 200910 55.95 42.44 62.03 8 DCC_CHECK_NEGATIVE 198359 49.95 24.90 61.25 9 DKIM_VALID_AU 187356 60.38 65.99 57.85 10 XMListUnsubscribeExists 154225 53.49 66.51 47.62 11 XM_B_SpammyWords 145266 52.22 68.57 44.85 12 T_SCC_BODY_TEXT_LINE 137181 41.46 39.46 42.36 13 XM_B_Unicode3 134754 44.33 50.37 41.61 14 DCC_CHECK 125368 49.55 73.62 38.71 15 RCVD_IN_MSPIKE_H2 110081 35.67 39.40 33.99 16 T_TM2_M_HEADER_IN_MSG 102634 29.31 24.03 31.69 17 LOC_TINY_FONT_1 101397 37.05 49.80 31.31 18 HTML_FONT_LOW_CONTRAST 94088 31.52 37.01 29.05 19 DKIM_VALID_EF 92517 28.59 28.66 28.57 20 XMSubLong 79780 24.84 25.30 24.63 21 FVGT_m_MULTI_ODD 77433 26.62 32.65 23.91 22 MIME_HTML_ONLY 73078 24.60 29.13 22.56 23 T_KAM_HTML_FONT_INVALID 67224 24.18 31.78 20.76 24 XM_B_SpammyWords2 61209 25.59 40.44 18.90 25 ALL_TRUSTED 52981 11.86 1.88 16.36 26 XM_Multi_Part_URI 43208 15.53 20.40 13.34 27 USER_IN_DEF_DKIM_WL 42027 9.64 2.25 12.98 28 TR_XM_DK_Unsub 41353 15.17 20.49 12.77 29 UNPARSEABLE_RELAY 39265 13.96 18.04 12.12 30 XM_Evil_Numbers_Gen 35097 10.91 11.07 10.84 31 BAYES_00 34543 7.56 0.67 10.67 32 XM_B_PhoneNumber 32828 8.93 6.24 10.14 33 LotsOfNums_01 30083 9.07 8.59 9.29 34 XM_B_Unsub 29583 12.13 18.77 9.13 35 TooManyTo_001 26517 6.90 4.05 8.19 36 FSL_BULK_SIG 24475 8.48 10.52 7.56 37 TR_XM_DK_Bayes 23378 5.15 0.55 7.22 38 T_TooManySym_01 23288 5.67 2.30 7.19 39 IN_ZIMBRA_NJ_WHITELIST 23018 4.93 0.10 7.11 40 XM_DKIMWhitelistDomains 22925 4.88 0.01 7.08 41 TR_XM_DK_Bayes1 22880 5.04 0.54 7.06 42 BAYES_60 22626 7.38 8.26 6.99 43 LOTS_OF_MONEY 21626 8.91 13.85 6.68 44 TR_XM_BayesUnsub 21525 10.21 18.12 6.65 45 TR_XM_DK_Bayes2 19713 4.34 0.45 6.09 46 XM_H_Long_From01 18896 5.78 5.65 5.83 47 XM_H_GMP 18572 5.54 5.11 5.73 48 ANY_BOUNCE_MESSAGE 18456 4.88 3.06 5.70 49 BOUNCE_MESSAGE 18451 4.88 3.05 5.70 50 XM_B_Phish_Phrases 18368 7.11 10.29 5.67 51 RCVD_IN_MSPIKE_WL 18238 4.69 2.61 5.63 52 RCVD_IN_MSPIKE_H3 18230 4.69 2.61 5.63 53 TR_MAX_INTL_RELAY 17454 8.19 14.41 5.39 54 BAYES_40 17148 4.29 2.07 5.29 55 MIME_QP_LONG_LINE 16302 4.57 3.56 5.03 56 HTML_IMAGE_RATIO_02 16190 5.69 7.22 5.00 57 XMNumbers 16162 4.53 3.51 4.99 58 XM_B_SpammyWords3 16002 8.07 15.01 4.94 59 HTML_IMAGE_RATIO_06 15885 4.96 5.09 4.90 60 XM_DK_Undo_02 15294 14.79 37.14 4.72 61 MPART_ALT_DIFF 15153 5.19 6.31 4.68 62 TR_XM_SpammyWords4 14905 7.03 12.41 4.60 63 HTML_IMAGE_RATIO_04 14652 4.70 5.10 4.52 64 XMStrtUSub 14483 4.31 3.95 4.47 65 XM_PDF 14168 3.23 0.68 4.37 66 XM_UncommonTLD01 13038 4.87 6.76 4.03 67 BAYES_20 12619 3.21 1.67 3.90 68 RELAYCOUNTRY_META 12158 7.64 16.25 3.75 69 RCVD_IN_VALIDITY_SAFE 12124 3.29 2.27 3.74 70 RCVD_IN_IADB_LISTED 12032 2.84 0.89 3.72 71 T_REMOTE_IMAGE 12006 3.08 1.68 3.71 72 XMSubMetaSx_00 11603 4.89 7.80 3.58 73 TM2_M_VERY_LONG_WORD 11531 4.14 5.42 3.56 74 BAYES_99 11067 11.20 28.48 3.42 75 BAYES_80 10820 5.07 8.91 3.34 76 RCVD_IN_IADB_SPF 10477 2.49 0.84 3.23 77 T_TooManySym_02 10214 2.39 0.68 3.15 78 RCVD_IN_VALIDITY_CERTIFIED 10052 2.64 1.62 3.10 79 BOTNET_IPINHOSTNAME 9834 6.07 12.81 3.04 80 XM_B_SpammyTLD 9637 3.60 5.00 2.98 81 RCVD_IN_IADB_SENDERID 9301 2.24 0.83 2.87 82 TooManyTo_002 9225 2.11 0.48 2.85 83 RCVD_IN_IADB_DK 9098 2.19 0.82 2.81 84 MAILING_LIST_MULTI 9034 2.56 2.06 2.79 85 BAYES_999 8518 8.51 21.57 2.63 86 MIME_HTML_ONLY_MULTI 8436 2.86 3.42 2.60 87 RCVD_IN_IADB_VOUCHED 8241 1.85 0.31 2.54 88 KHOP_HELO_FCRDNS 8010 2.42 2.30 2.47 89 DKIM_INVALID 7938 3.13 4.63 2.45 90 TR_XM_DKIM_Undo 7819 9.86 26.38 2.41 91 HTML_MIME_NO_HTML_TAG 7788 2.24 1.89 2.40 92 MIME_HTML_MOSTLY 7713 2.78 3.65 2.38 93 XM_Body_Dirty_Words 7692 3.98 7.54 2.37 94 BAYES_05 7494 1.84 0.80 2.31 95 T_XMDrugObfuBody_14 7386 2.88 4.20 2.28 96 INVALID_MSGID 7292 1.61 0.18 2.25 97 XM_B_URI_Unicode 6990 2.46 3.13 2.16 98 XM_CamelCaseFrm001 6701 2.53 3.57 2.07 99 HTML_IMAGE_RATIO_08 6668 2.34 2.95 2.06 100 BAYES_95 6628 3.03 5.22 2.05 101 TR_XM_SpammyRelay 6405 4.74 10.87 1.98 102 TO_MALFORMED 6289 1.39 0.17 1.94 103 SUBJ_ALL_CAPS 6101 1.97 2.17 1.88 104 XM_DK_Undo_01 5736 1.71 1.58 1.77 105 TR_XM_SpammyWords5 5662 2.36 3.73 1.75 106 RCVD_IN_IADB_OPTIN 5592 1.25 0.20 1.73 107 DC_PNG_UNO_LARGO 5588 1.27 0.27 1.73 108 TR_XM_UnparsRelay 5521 4.10 9.42 1.70 109 URI_NOVOWEL 5465 1.89 2.33 1.69 110 TM2_M_URI_OPT_OUT 5446 2.07 2.94 1.68 111 XMDiploma_00 5428 2.09 3.00 1.68 112 T_XMDrugObfuBody_08 5329 2.27 3.67 1.65 113 TooManyTo_003 5223 1.23 0.39 1.61 114 XMStockSpam_06 5151 1.75 2.11 1.59 115 TR_Symld_Words 5113 1.78 2.22 1.58 116 XMHTML_ManyTags1 5063 1.15 0.22 1.56 117 AC_BR_BONANZA 5039 1.16 0.28 1.56 118 XMHTML_ManyTags2 5035 1.13 0.18 1.55 119 TR_XM_PhishingBody 5034 2.50 4.60 1.55 120 XMHTML_ManyTags3 5029 1.13 0.18 1.55 121 XM_B_Investor 4913 2.23 3.82 1.52 122 XM_SendGrid 4778 1.49 1.52 1.48 123 BOTNET 4675 3.86 9.22 1.44 124 TR_DCC_Bayes_99 4662 7.38 20.55 1.44 125 FROM_EXCESS_BASE64 4559 1.64 2.15 1.41 126 XMSexyCombo_05 4494 2.55 5.12 1.39 127 XM_SPF_SoftFail 4396 1.83 2.88 1.36 128 XM_B_Unsub2 4342 1.78 2.77 1.34 129 UNTRUSTED_Relay 4331 2.81 6.09 1.34 130 URI_HEX 4305 1.45 1.72 1.33 131 MAY_BE_FORGED 4272 1.40 1.57 1.32 132 IN_HORDE_ADDRESS_BOOK 4231 0.93 0.09 1.31 133 T_TooManySym_03 4178 0.96 0.23 1.29 134 XM_GoogleGroups 4120 1.10 0.72 1.27 135 HELO_NODOT 3984 0.93 0.27 1.23 136 HELO_NO_DOMAIN 3972 0.93 0.26 1.23 137 TooManyTo_004 3758 0.90 0.33 1.16 138 XMCapTrack 3695 0.91 0.41 1.14 139 XMGappySubj_01 3615 0.83 0.19 1.12 140 MIME_CHARSET_FARAWAY 3529 0.88 0.42 1.09 141 XMLngstWrd_00 3408 0.87 0.46 1.05 142 RELAYCOUNTRY_CA 3245 2.50 5.84 1.00 143 XM_ShortIntro_01 3181 0.78 0.32 0.98 144 CHARSET_FARAWAY_HEADER 3136 0.72 0.16 0.97 145 TVD_SPACE_RATIO 3068 0.70 0.15 0.95 146 TR_XM_DK_SendGrid 3042 0.90 0.82 0.94 147 T_XMDrugObfuBody_00 3034 1.24 1.93 0.94 148 XM_OfRef6 2952 1.76 3.65 0.91 149 TooManyTo_005 2947 0.72 0.29 0.91 150 URI_WPADMIN 2899 0.65 0.09 0.90 151 FROM_GOV_DKIM_AU 2867 0.66 0.15 0.89 152 XMGenDplmaNmb 2844 1.15 1.77 0.88 153 TR_MetaPhish_Combo_01 2828 1.00 1.29 0.87 154 XM_H_PHPMailer 2747 0.80 0.70 0.85 155 XM_UB50 2645 1.61 3.38 0.82 156 XMBrknScrpt_02 2637 1.09 1.69 0.81 157 DKIM_ADSP_CUSTOM_MED 2620 0.95 1.27 0.81 158 XM_H_Long_From02 2585 1.17 1.99 0.80 159 SpammyFromTLD_01 2474 1.02 1.60 0.76 160 T_FILL_THIS_FORM_SHORT 2424 0.93 1.33 0.75 161 TVD_RCVD_IP 2391 0.74 0.74 0.74 162 RCVD_IN_PBL 2325 0.90 1.31 0.72 163 XM_B_SpammyWords4 2310 1.32 2.67 0.71 164 RELAYCOUNTRY_AU 2290 1.30 2.62 0.71 165 XMSlimDrugH 2239 0.74 0.86 0.69 166 XMNoVowels 2222 0.63 0.50 0.69 167 XM_B_DNDMA 2213 0.86 1.26 0.68 168 HTTPS_HTTP_MISMATCH 2209 0.87 1.30 0.68 169 XMSubMetaI_00 2181 0.72 0.82 0.67 170 TO_NO_BRKTS_HTML_ONLY 2167 0.64 0.59 0.67 171 MSGID_FROM_MTA_HEADER 2160 0.51 0.15 0.67 172 HTML_TAG_BALANCE_BODY 2059 0.73 0.93 0.64 173 XM_B_COPY_HTML 2032 0.77 1.09 0.63 174 XMGappySubj_02 1997 0.45 0.09 0.62 175 TR_XM_PHPForged 1992 0.83 1.31 0.62 176 TR_XM_SpammyWords2 1982 3.48 9.83 0.61 177 T_XMHurry_00 1961 1.00 1.88 0.61 178 T_OBFU_PDF_ATTACH 1954 0.46 0.15 0.60 179 TR_XM_FormFill2 1952 0.81 1.28 0.60 180 XM_B_FormFill 1943 0.42 0.03 0.60 181 TR_XM_PHPDW 1936 0.81 1.30 0.60 182 T_Symld_Words_02 1917 0.59 0.60 0.59 183 XM_H_PHPOS 1905 0.80 1.26 0.59 184 HTML_IMAGE_ONLY_32 1897 0.45 0.16 0.59 185 XMBSHREFv2 1884 0.51 0.36 0.58 186 TR_XM_Base64_M1 1866 0.68 0.91 0.58 187 XMPhish30 1856 0.80 1.32 0.57 188 URI_TRY_3LD 1833 0.94 1.77 0.57 189 XMLngstWrd_01 1812 0.52 0.43 0.56 190 HTML_IMAGE_ONLY_20 1774 0.63 0.82 0.55 191 MPART_ALT_DIFF_COUNT 1758 0.69 1.01 0.54 192 NML_ADSP_CUSTOM_MED 1719 0.71 1.09 0.53 193 XMBody_95 1717 0.41 0.16 0.53 194 XMBdyGiftCard01 1709 0.78 1.33 0.53 195 FORGED_GMAIL_RCVD 1633 0.66 1.02 0.50 196 XMMoneyMeta_00 1545 0.53 0.66 0.48 197 XMBody_17 1537 0.97 2.08 0.47 198 T_MANY_PILL_PRICE 1536 0.33 0.02 0.47 199 RELAYCOUNTRY_GB 1519 0.60 0.88 0.47 200 DIET_1 1517 0.73 1.32 0.47 ----------------------------------------------------------------------