Email: 535628 Autolearn: 0 AvgScore: 2.83 AvgScanTime: 1.35 sec Spam: 147212 Autolearn: 0 AvgScore: 14.38 AvgScanTime: 1.55 sec Ham: 388416 Autolearn: 0 AvgScore: -1.54 AvgScanTime: 1.27 sec Time Spent Running SA: 200.38 hours Time Spent Processing Spam: 63.38 hours Time Spent Processing Ham: 137.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140453 91.22 95.41 89.64 2 DKIM_SIGNED 127912 69.59 86.89 63.03 3 XM_DK_Pass 121579 67.52 82.59 61.81 4 DKIM_VALID 120451 66.64 81.82 60.89 5 XM_B_Unicode 119249 72.24 81.00 68.92 6 RELAYCOUNTRY_US 118135 78.41 80.25 77.71 7 DCC_CHECK 107136 45.55 72.78 35.23 8 XM_B_SpammyWords 100151 48.81 68.03 41.52 9 XMListUnsubscribeExists 98526 47.78 66.93 40.53 10 DKIM_VALID_AU 96494 53.55 65.55 49.00 11 XM_B_Unicode3 69209 41.72 47.01 39.72 12 LOC_TINY_FONT_1 68657 29.99 46.64 23.67 13 RCVD_IN_MSPIKE_H2 60179 31.40 40.88 27.81 14 BAYES_50 60076 51.56 40.81 55.63 15 XM_B_SpammyWords2 58834 21.94 39.97 15.11 16 T_SCC_BODY_TEXT_LINE 58026 41.41 39.42 42.17 17 HTML_FONT_LOW_CONTRAST 55549 31.50 37.73 29.14 18 XM_DK_Undo_02 51142 12.56 34.74 4.16 19 FVGT_m_MULTI_ODD 49845 25.35 33.86 22.12 20 T_KAM_HTML_FONT_INVALID 46464 22.50 31.56 19.06 21 MIME_HTML_ONLY 45431 28.11 30.86 27.06 22 DKIM_VALID_EF 42320 25.89 28.75 24.81 23 BAYES_99 41589 10.12 28.25 3.25 24 TR_XM_DKIM_Undo 38490 8.69 26.15 2.08 25 DCC_CHECK_NEGATIVE 37747 53.98 25.64 64.73 26 XMSubLong 36965 22.74 25.11 21.84 27 T_TM2_M_HEADER_IN_MSG 36411 29.75 24.73 31.65 28 XM_Multi_Part_URI 31301 14.10 21.26 11.39 29 TR_XM_DK_Unsub 30567 13.87 20.76 11.25 30 BAYES_999 30284 7.35 20.57 2.33 31 TR_DCC_Bayes_99 26417 5.69 17.94 1.05 32 UNPARSEABLE_RELAY 25579 12.19 17.38 10.23 33 XM_B_Unsub 25531 10.38 17.34 7.75 34 TR_XM_BayesUnsub 24629 8.90 16.73 5.94 35 RELAYCOUNTRY_META 23495 6.71 15.96 3.20 36 TR_MAX_INTL_RELAY 22920 9.97 15.57 7.85 37 XM_B_SpammyWords3 22495 6.98 15.28 3.83 38 LOTS_OF_MONEY 20328 7.70 13.81 5.38 39 TR_XM_SpammyWords4 18499 6.18 12.57 3.75 40 BOTNET_IPINHOSTNAME 18334 5.43 12.45 2.76 41 TR_XM_SpammyRelay 16279 4.24 11.06 1.65 42 BOTNET 15899 3.93 10.80 1.33 43 FSL_BULK_SIG 15085 9.31 10.25 8.96 44 BAYES_80 14378 5.55 9.77 3.95 45 XM_B_Phish_Phrases 14173 5.62 9.63 4.10 46 XM_Evil_Numbers_Gen 13829 9.12 9.39 9.02 47 BAYES_60 13802 7.92 9.38 7.37 48 TR_XM_SpammyWords2 13494 2.80 9.17 0.38 49 TR_XM_UnparsRelay 13210 3.40 8.97 1.29 50 LotsOfNums_01 11540 7.00 7.84 6.68 51 XM_Body_Dirty_Words 10985 3.97 7.46 2.64 52 RCVD_IN_BL_SPAMCOP_NET 9869 2.14 6.70 0.41 53 UNTRUSTED_Relay 9663 2.74 6.56 1.29 54 XMSubMetaSx_00 9387 3.84 6.38 2.88 55 HTML_IMAGE_RATIO_02 9296 4.28 6.31 3.52 56 XM_B_PhoneNumber 9247 7.61 6.28 8.11 57 MPART_ALT_DIFF 8732 8.02 5.93 8.81 58 RELAYCOUNTRY_CA 8510 2.21 5.78 0.85 59 XM_UncommonTLD01 8457 4.09 5.74 3.47 60 XM_H_Long_From01 7954 4.81 5.40 4.59 61 BAYES_95 7766 4.27 5.28 3.90 62 XM_B_Investor 7662 2.50 5.20 1.48 63 DKIM_INVALID 7461 2.95 5.07 2.15 64 TR_XM_PhishingBody 7460 2.58 5.07 1.63 65 XM_H_GMP 7355 5.18 5.00 5.24 66 TR_XM_SpammyWords5 6986 2.38 4.75 1.48 67 HTML_IMAGE_RATIO_04 6802 11.24 4.62 13.75 68 XMSexyCombo_05 6644 2.21 4.51 1.33 69 TooManyTo_001 6584 6.50 4.47 7.27 70 XM_OfRef6 6552 1.92 4.45 0.96 71 ALL_TRUSTED 6328 15.57 4.30 19.85 72 XM_B_SpammyTLD 6161 2.96 4.19 2.49 73 XMStrtUSub 5966 8.48 4.05 10.16 74 XMNumbers 5769 3.99 3.92 4.02 75 T_XMDrugObfuBody_14 5527 2.35 3.75 1.81 76 MIME_QP_LONG_LINE 5481 4.01 3.72 4.12 77 TR_XM_SPAMCOP 5480 1.14 3.72 0.15 78 MIME_HTML_MOSTLY 5389 2.46 3.66 2.00 79 TM2_M_VERY_LONG_WORD 5295 1.80 3.60 1.12 80 HTML_IMAGE_RATIO_06 5035 4.53 3.42 4.95 81 MIME_HTML_ONLY_MULTI 4883 6.14 3.32 7.22 82 HTML_IMAGE_RATIO_08 4750 2.23 3.23 1.86 83 T_TooManySym_01 4722 5.81 3.21 6.80 84 XM_UB50 4648 1.41 3.16 0.74 85 TR_XM_NoHeaderRelay 4605 1.01 3.13 0.20 86 XM_B_URI_Unicode 4551 2.02 3.09 1.61 87 XM_B_Unsub2 4513 1.82 3.07 1.35 88 XM_CamelCaseFrm001 4375 1.96 2.97 1.57 89 XM_SPF_SoftFail 4336 1.60 2.95 1.09 90 T_XMDrugObfuBody_08 4223 2.00 2.87 1.67 91 XMDiploma_00 3984 1.61 2.71 1.19 92 SUBJ_ALL_CAPS 3977 1.77 2.70 1.41 93 XM_B_SpammyWords4 3975 1.27 2.70 0.73 94 XM_URI_RBL 3850 0.95 2.62 0.32 95 T_FILL_THIS_FORM_SHORT 3841 1.30 2.61 0.80 96 T_XMHurry_00 3817 1.27 2.59 0.77 97 MAILING_LIST_MULTI 3783 2.72 2.57 2.77 98 URI_WPADMIN 3726 5.05 2.53 6.00 99 XMBody_17 3701 0.96 2.51 0.37 100 RELAYCOUNTRY_AU 3670 1.04 2.49 0.49 101 RCVD_IN_MSPIKE_WL 3378 3.87 2.29 4.47 102 BOUNCE_MESSAGE 3358 2.78 2.28 2.97 103 ANY_BOUNCE_MESSAGE 3358 2.78 2.28 2.97 104 RCVD_IN_MSPIKE_H3 3332 3.79 2.26 4.36 105 TR_XM_INV_DKIM 3315 0.74 2.25 0.17 106 XMStockSpam_06 3194 1.41 2.17 1.12 107 XMPhish30 3180 0.94 2.16 0.48 108 SpammyFromTLD_02 3157 0.88 2.14 0.41 109 TM2_M_URI_OPT_OUT 3147 1.63 2.14 1.44 110 BAYES_40 3103 4.64 2.11 5.60 111 KHOP_HELO_FCRDNS 3050 1.29 2.07 1.00 112 XMBrknScrpt_02 2861 1.84 1.94 1.80 113 USER_IN_DEF_DKIM_WL 2844 8.52 1.93 11.02 114 RCVD_IN_VALIDITY_RPBL 2771 0.55 1.88 0.05 115 FROM_EXCESS_BASE64 2757 1.54 1.87 1.41 116 HTTPS_HTTP_MISMATCH 2694 0.95 1.83 0.62 117 RCVD_IN_VALIDITY_SAFE 2652 3.14 1.80 3.64 118 XM_DK_Undo_01 2642 1.62 1.79 1.56 119 SpammyFromTLD_01 2566 0.96 1.74 0.67 120 T_REMOTE_IMAGE 2518 2.59 1.71 2.92 121 URI_HEX 2427 1.16 1.65 0.97 122 XMGenDplmaNmb 2397 0.93 1.63 0.67 123 HTML_MIME_NO_HTML_TAG 2365 2.12 1.61 2.31 124 TR_LOTS_OF_MONEY3 2317 0.68 1.57 0.35 125 DKIM_ADSP_NXDOMAIN 2314 0.63 1.57 0.28 126 SHORTCIRCUIT 2302 0.43 1.56 0.00 127 RCVD_IN_ZEN_LASTEXTERNAL 2302 0.43 1.56 0.00 128 RCVD_IN_PSBL 2211 0.59 1.50 0.25 129 URI_TRY_3LD 2206 0.79 1.50 0.52 130 BAYES_20 2156 3.68 1.46 4.52 131 HTML_IMAGE_ONLY_20 2151 0.71 1.46 0.42 132 RCVD_IN_VALIDITY_CERTIFIED 2087 2.54 1.42 2.97 133 T_XMDrugObfuBody_00 2052 0.87 1.39 0.67 134 XM_OfRef7 1967 0.46 1.34 0.13 135 DKIM_ADSP_CUSTOM_MED 1933 1.08 1.31 0.99 136 XM_SendGrid 1918 1.21 1.30 1.17 137 BOTNET_NORDNS 1887 0.36 1.28 0.01 138 XM_H_Long_From02 1859 0.83 1.26 0.67 139 XM_B_COPY_HTML 1841 0.92 1.25 0.80 140 DIET_1 1785 0.56 1.21 0.31 141 XM_ProductURIs 1771 0.66 1.20 0.45 142 XM_B_SEO 1747 0.48 1.19 0.21 143 XM_S_SpammyWords 1745 0.51 1.19 0.26 144 TR_XM_Spammywords 1745 0.51 1.19 0.26 145 URI_NOVOWEL 1733 1.32 1.18 1.38 146 TVD_RCVD_IP 1725 1.09 1.17 1.06 147 RCVD_IN_PBL 1711 0.80 1.16 0.66 148 T_Symld_Words_02 1675 0.64 1.14 0.45 149 RDNS_DYNAMIC 1666 0.43 1.13 0.17 150 TM2_M_OBFU_COMMENT 1660 0.65 1.13 0.47 151 TR_MetaPhish_Combo_01 1641 0.79 1.11 0.67 152 TR_XM_PHPForged 1639 0.53 1.11 0.30 153 URI_OPTOUT_3LD 1628 0.41 1.11 0.15 154 TR_XM_PHPDW 1627 0.52 1.11 0.31 155 LongTLD 1621 0.58 1.10 0.38 156 MISSING_HEADERS 1606 0.51 1.09 0.30 157 XM_UB99 1600 0.30 1.09 0.00 158 TR_XM_FormFill2 1600 0.52 1.09 0.31 159 TR_XM_SEO4 1594 0.37 1.08 0.10 160 XM_H_PHPOS 1562 0.51 1.06 0.30 161 XM_B_Phish66 1549 0.49 1.05 0.28 162 XM_B_DNDMA 1531 0.65 1.04 0.50 163 XM_UB60 1517 0.32 1.03 0.05 164 TR_Symld_Words 1497 1.22 1.02 1.30 165 SHOPIFY_IMG_NOT_RCVD_SFY 1495 0.46 1.02 0.25 166 XM_GoogleGroups 1457 1.10 0.99 1.15 167 TR_LOTS_OF_MONEY2 1452 0.44 0.99 0.23 168 T_MONEY_PERCENT 1452 0.44 0.99 0.23 169 TR_Mismatch_TLD_02 1443 0.31 0.98 0.06 170 RCVD_IN_IADB_LISTED 1421 2.40 0.97 2.94 171 MPART_ALT_DIFF_COUNT 1417 0.60 0.96 0.47 172 RELAYCOUNTRY_FR 1415 0.44 0.96 0.25 173 TR_XM_InvalidRelay 1407 0.27 0.96 0.01 174 XMBody_78 1399 0.51 0.95 0.34 175 NML_ADSP_CUSTOM_MED 1390 0.76 0.94 0.69 176 RELAYCOUNTRY_GB 1383 0.55 0.94 0.41 177 XM_PDF 1370 2.87 0.93 3.61 178 FORGED_GMAIL_RCVD 1353 0.75 0.92 0.68 179 HTML_FONT_TINY_NORDNS 1338 0.27 0.91 0.03 180 XMHTML_After_End 1337 0.47 0.91 0.30 181 XM_B_COVIDMETA 1334 0.34 0.91 0.13 182 URIBL_BLACK 1329 0.28 0.90 0.04 183 TR_XM_RelayPhish 1327 0.30 0.90 0.07 184 RCVD_IN_IADB_SPF 1325 2.13 0.90 2.60 185 RCVD_IN_IADB_DK 1307 1.90 0.89 2.29 186 XMPhish14 1302 0.63 0.88 0.53 187 MultiRelay_CC 1288 0.36 0.87 0.16 188 RCVD_IN_IADB_SENDERID 1287 1.93 0.87 2.33 189 XM_B_REG_HTML 1277 0.36 0.87 0.17 190 XM_HighProb1 1253 0.24 0.85 0.01 191 XMSubMetaI_00 1229 0.57 0.83 0.47 192 TM2_M_A_HREF_HREF 1227 0.37 0.83 0.20 193 HTML_TAG_BALANCE_BODY 1221 0.57 0.83 0.47 194 DEAR_SOMETHING 1211 0.43 0.82 0.29 195 XMBounce_01 1200 0.24 0.82 0.02 196 RCVD_IN_MSPIKE_BL 1184 0.22 0.80 0.00 197 TR_XM_Base64_M1 1183 0.54 0.80 0.45 198 XM_DIRTYINTL 1181 0.27 0.80 0.06 199 XM_UB999 1165 0.22 0.79 0.00 200 XMSexyCombo_01 1164 0.33 0.79 0.15 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 348158 91.22 95.41 89.64 2 RELAYCOUNTRY_US 301837 78.41 80.25 77.71 3 XM_B_Unicode 267692 72.24 81.00 68.92 4 DCC_CHECK_NEGATIVE 251411 53.98 25.64 64.73 5 DKIM_SIGNED 244835 69.59 86.89 63.03 6 XM_DK_Pass 240082 67.52 82.59 61.81 7 DKIM_VALID 236503 66.64 81.82 60.89 8 BAYES_50 216079 51.56 40.81 55.63 9 DKIM_VALID_AU 190310 53.55 65.55 49.00 10 T_SCC_BODY_TEXT_LINE 163788 41.41 39.42 42.17 11 XM_B_SpammyWords 161278 48.81 68.03 41.52 12 XMListUnsubscribeExists 157409 47.78 66.93 40.53 13 XM_B_Unicode3 154266 41.72 47.01 39.72 14 DCC_CHECK 136843 45.55 72.78 35.23 15 T_TM2_M_HEADER_IN_MSG 122930 29.75 24.73 31.65 16 HTML_FONT_LOW_CONTRAST 113182 31.50 37.73 29.14 17 RCVD_IN_MSPIKE_H2 108019 31.40 40.88 27.81 18 MIME_HTML_ONLY 105116 28.11 30.86 27.06 19 DKIM_VALID_EF 96362 25.89 28.75 24.81 20 LOC_TINY_FONT_1 91956 29.99 46.64 23.67 21 FVGT_m_MULTI_ODD 85928 25.35 33.86 22.12 22 XMSubLong 84815 22.74 25.11 21.84 23 ALL_TRUSTED 77091 15.57 4.30 19.85 24 T_KAM_HTML_FONT_INVALID 74050 22.50 31.56 19.06 25 XM_B_SpammyWords2 58673 21.94 39.97 15.11 26 HTML_IMAGE_RATIO_04 53413 11.24 4.62 13.75 27 BAYES_00 48968 9.32 0.64 12.61 28 HTML_FONT_FACE_BAD 46759 8.94 0.75 12.04 29 XM_Multi_Part_URI 44237 14.10 21.26 11.39 30 XM_H_Trusted_IP 43870 8.19 0.00 11.29 31 TR_XM_DK_Unsub 43709 13.87 20.76 11.25 32 USER_IN_DEF_DKIM_WL 42785 8.52 1.93 11.02 33 UNPARSEABLE_RELAY 39719 12.19 17.38 10.23 34 XMStrtUSub 39480 8.48 4.05 10.16 35 XM_Evil_Numbers_Gen 35018 9.12 9.39 9.02 36 FSL_BULK_SIG 34784 9.31 10.25 8.96 37 MPART_ALT_DIFF 34230 8.02 5.93 8.81 38 XM_B_PhoneNumber 31510 7.61 6.28 8.11 39 TR_MAX_INTL_RELAY 30488 9.97 15.57 7.85 40 XM_B_Unsub 30091 10.38 17.34 7.75 41 BAYES_60 28636 7.92 9.38 7.37 42 TooManyTo_001 28222 6.50 4.47 7.27 43 MIME_HTML_ONLY_MULTI 28029 6.14 3.32 7.22 44 T_TooManySym_01 26409 5.81 3.21 6.80 45 LotsOfNums_01 25939 7.00 7.84 6.68 46 TR_XM_DK_Bayes 24106 4.65 0.53 6.21 47 TR_XM_DK_Bayes1 23647 4.56 0.52 6.09 48 IN_ZIMBRA_NJ_WHITELIST 23476 4.41 0.11 6.04 49 URI_WPADMIN 23323 5.05 2.53 6.00 50 TR_XM_BayesUnsub 23065 8.90 16.73 5.94 51 XM_DKIMWhitelistDomains 22257 4.16 0.02 5.73 52 BAYES_40 21761 4.64 2.11 5.60 53 LOTS_OF_MONEY 20901 7.70 13.81 5.38 54 XM_H_GMP 20369 5.18 5.00 5.24 55 TR_XM_DK_Bayes2 20117 3.88 0.44 5.18 56 HTML_IMAGE_RATIO_06 19212 4.53 3.42 4.95 57 XM_H_Long_From01 17834 4.81 5.40 4.59 58 BAYES_20 17544 3.68 1.46 4.52 59 RCVD_IN_MSPIKE_WL 17352 3.87 2.29 4.47 60 RCVD_IN_MSPIKE_H3 16944 3.79 2.26 4.36 61 XM_DK_Undo_02 16148 12.56 34.74 4.16 62 MIME_QP_LONG_LINE 15990 4.01 3.72 4.12 63 XM_B_Phish_Phrases 15921 5.62 9.63 4.10 64 XMSubNoVowel 15691 3.06 0.49 4.04 65 XMNumbers 15605 3.99 3.92 4.02 66 BAYES_80 15345 5.55 9.77 3.95 67 BAYES_95 15129 4.27 5.28 3.90 68 XM_B_SpammyWords3 14871 6.98 15.28 3.83 69 TR_XM_SpammyWords4 14577 6.18 12.57 3.75 70 RCVD_IN_VALIDITY_SAFE 14153 3.14 1.80 3.64 71 XM_PDF 14024 2.87 0.93 3.61 72 HTML_IMAGE_RATIO_02 13653 4.28 6.31 3.52 73 XM_UncommonTLD01 13465 4.09 5.74 3.47 74 BAYES_99 12613 10.12 28.25 3.25 75 RELAYCOUNTRY_META 12427 6.71 15.96 3.20 76 BAYES_05 12329 2.51 0.74 3.17 77 ANY_BOUNCE_MESSAGE 11529 2.78 2.28 2.97 78 RCVD_IN_VALIDITY_CERTIFIED 11526 2.54 1.42 2.97 79 BOUNCE_MESSAGE 11522 2.78 2.28 2.97 80 RCVD_IN_IADB_LISTED 11435 2.40 0.97 2.94 81 T_REMOTE_IMAGE 11336 2.59 1.71 2.92 82 XMSubMetaSx_00 11181 3.84 6.38 2.88 83 MAILING_LIST_MULTI 10776 2.72 2.57 2.77 84 BOTNET_IPINHOSTNAME 10733 5.43 12.45 2.76 85 XM_Body_Dirty_Words 10263 3.97 7.46 2.64 86 RCVD_IN_IADB_SPF 10097 2.13 0.90 2.60 87 XM_B_SpammyTLD 9687 2.96 4.19 2.49 88 T_TooManySym_02 9565 1.98 0.70 2.46 89 TooManyTo_002 9513 1.96 0.68 2.45 90 BAYES_999 9062 7.35 20.57 2.33 91 RCVD_IN_IADB_SENDERID 9060 1.93 0.87 2.33 92 HTML_MIME_NO_HTML_TAG 8974 2.12 1.61 2.31 93 RCVD_IN_IADB_DK 8892 1.90 0.89 2.29 94 DKIM_INVALID 8332 2.95 5.07 2.15 95 TR_XM_DKIM_Undo 8068 8.69 26.15 2.08 96 MIME_HTML_MOSTLY 7771 2.46 3.66 2.00 97 XMSubLongNoVowel 7765 1.50 0.19 2.00 98 XMSubGarbage 7548 1.42 0.03 1.94 99 RCVD_IN_IADB_VOUCHED 7295 1.45 0.31 1.88 100 HTML_IMAGE_RATIO_08 7219 2.23 3.23 1.86 101 INVALID_MSGID 7198 1.43 0.31 1.85 102 T_XMDrugObfuBody_14 7034 2.35 3.75 1.81 103 XMBrknScrpt_02 7009 1.84 1.94 1.80 104 T_XMDrugObfuBody_08 6500 2.00 2.87 1.67 105 TR_XM_SpammyRelay 6411 4.24 11.06 1.65 106 TR_XM_PhishingBody 6343 2.58 5.07 1.63 107 TO_MALFORMED 6271 1.18 0.02 1.61 108 XM_B_URI_Unicode 6270 2.02 3.09 1.61 109 XM_CamelCaseFrm001 6114 1.96 2.97 1.57 110 XM_DK_Undo_01 6056 1.62 1.79 1.56 111 TR_XM_SpammyWords5 5757 2.38 4.75 1.48 112 XM_B_Investor 5750 2.50 5.20 1.48 113 TM2_M_URI_OPT_OUT 5605 1.63 2.14 1.44 114 TooManyTo_003 5572 1.20 0.58 1.43 115 SUBJ_ALL_CAPS 5492 1.77 2.70 1.41 116 FROM_EXCESS_BASE64 5489 1.54 1.87 1.41 117 URI_NOVOWEL 5341 1.32 1.18 1.38 118 XM_B_Unsub2 5236 1.82 3.07 1.35 119 XMSexyCombo_05 5184 2.21 4.51 1.33 120 BOTNET 5166 3.93 10.80 1.33 121 TR_Symld_Words 5043 1.22 1.02 1.30 122 TR_XM_UnparsRelay 5022 3.40 8.97 1.29 123 UNTRUSTED_Relay 4995 2.74 6.56 1.29 124 RCVD_IN_IADB_OPTIN 4952 0.97 0.17 1.27 125 XMDiploma_00 4629 1.61 2.71 1.19 126 XM_SendGrid 4560 1.21 1.30 1.17 127 XM_GoogleGroups 4455 1.10 0.99 1.15 128 XMStockSpam_06 4342 1.41 2.17 1.12 129 TM2_M_VERY_LONG_WORD 4339 1.80 3.60 1.12 130 IN_HORDE_ADDRESS_BOOK 4292 0.82 0.07 1.11 131 XM_SPF_SoftFail 4220 1.60 2.95 1.09 132 HELO_NODOT 4193 0.87 0.31 1.08 133 HELO_NO_DOMAIN 4186 0.86 0.29 1.08 134 XMGappySubj_01 4138 0.92 0.54 1.07 135 TVD_RCVD_IP 4132 1.09 1.17 1.06 136 TR_DCC_Bayes_99 4074 5.69 17.94 1.05 137 XMCapTrack 4053 0.91 0.55 1.04 138 TooManyTo_004 4051 0.90 0.51 1.04 139 T_TooManySym_03 4039 0.83 0.27 1.04 140 KHOP_HELO_FCRDNS 3876 1.29 2.07 1.00 141 DKIM_ADSP_CUSTOM_MED 3832 1.08 1.31 0.99 142 URI_HEX 3762 1.16 1.65 0.97 143 XM_OfRef6 3742 1.92 4.45 0.96 144 XM_E_Blogspot 3729 0.74 0.14 0.96 145 TooManyTo_005 3341 0.75 0.46 0.86 146 RELAYCOUNTRY_CA 3310 2.21 5.78 0.85 147 TVD_SPACE_RATIO 3244 0.65 0.17 0.84 148 FROM_GOV_DKIM_AU 3119 0.69 0.40 0.80 149 T_FILL_THIS_FORM_SHORT 3113 1.30 2.61 0.80 150 XM_B_COPY_HTML 3092 0.92 1.25 0.80 151 XMBdyGiftCard01 3005 0.76 0.71 0.77 152 T_XMHurry_00 3003 1.27 2.59 0.77 153 FORGED_OUTLOOK_HTML 2936 0.67 0.46 0.76 154 TR_XM_DK_SendGrid 2901 0.74 0.70 0.75 155 XM_UB50 2886 1.41 3.16 0.74 156 XM_B_SpammyWords4 2854 1.27 2.70 0.73 157 XM_ShortIntro_01 2802 0.65 0.46 0.72 158 NML_ADSP_CUSTOM_MED 2688 0.76 0.94 0.69 159 FORGED_GMAIL_RCVD 2655 0.75 0.92 0.68 160 TR_MetaPhish_Combo_01 2611 0.79 1.11 0.67 161 XM_H_Long_From02 2608 0.83 1.26 0.67 162 XMGenDplmaNmb 2592 0.93 1.63 0.67 163 SpammyFromTLD_01 2587 0.96 1.74 0.67 164 T_XMDrugObfuBody_00 2586 0.87 1.39 0.67 165 RCVD_IN_PBL 2574 0.80 1.16 0.66 166 XM_H_PHPMailer 2561 0.66 0.67 0.66 167 XMGappySubj_02 2436 0.54 0.29 0.63 168 HTML_OBFUSCATE_05_10 2409 0.54 0.34 0.62 169 HTTPS_HTTP_MISMATCH 2406 0.95 1.83 0.62 170 XMNoVowels 2088 0.56 0.60 0.54 171 XMPhish14 2056 0.63 0.88 0.53 172 URI_TRY_3LD 2028 0.79 1.50 0.52 173 T_OBFU_PDF_ATTACH 2024 0.42 0.15 0.52 174 XM_B_DNDMA 1925 0.65 1.04 0.50 175 RELAYCOUNTRY_AU 1904 1.04 2.49 0.49 176 TO_NO_BRKTS_HTML_ONLY 1883 0.53 0.65 0.48 177 MSGID_FROM_MTA_HEADER 1876 0.38 0.12 0.48 178 XMPhish30 1847 0.94 2.16 0.48 179 XMBSHREFv2 1836 0.43 0.32 0.47 180 XMSubMetaI_00 1826 0.57 0.83 0.47 181 MPART_ALT_DIFF_COUNT 1822 0.60 0.96 0.47 182 HTML_TAG_BALANCE_BODY 1818 0.57 0.83 0.47 183 TM2_M_OBFU_COMMENT 1818 0.65 1.13 0.47 184 XMLngstWrd_00 1786 0.49 0.55 0.46 185 XM_ProductURIs 1754 0.66 1.20 0.45 186 T_Symld_Words_02 1745 0.64 1.14 0.45 187 TR_XM_Base64_M1 1736 0.54 0.80 0.45 188 XM_B_FormFill 1673 0.32 0.03 0.43 189 XMBody_95 1668 0.37 0.22 0.43 190 XMSlimDrugH 1648 0.51 0.73 0.42 191 HTML_IMAGE_ONLY_20 1645 0.71 1.46 0.42 192 RCVD_IN_BL_SPAMCOP_NET 1607 2.14 6.70 0.41 193 SpammyFromTLD_02 1583 0.88 2.14 0.41 194 RELAYCOUNTRY_GB 1578 0.55 0.94 0.41 195 XMLngstWrd_01 1555 0.43 0.49 0.40 196 T_STY_INVIS_DIRECT 1514 0.50 0.78 0.39 197 XMMoneyMeta_00 1483 0.47 0.69 0.38 198 TR_XM_SpammyWords2 1482 2.80 9.17 0.38 199 LongTLD 1462 0.58 1.10 0.38 200 XMBody_17 1423 0.96 2.51 0.37 ----------------------------------------------------------------------