Email: 467214 Autolearn: 0 AvgScore: 4.55 AvgScanTime: 1.60 sec Spam: 146121 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.78 sec Ham: 321093 Autolearn: 0 AvgScore: 0.10 AvgScanTime: 1.51 sec Time Spent Running SA: 207.04 hours Time Spent Processing Spam: 72.13 hours Time Spent Processing Ham: 134.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139458 90.09 95.44 87.66 2 DKIM_SIGNED 130707 81.66 89.45 78.12 3 XM_B_Unicode 123478 76.09 84.50 72.26 4 XM_DK_Pass 123370 79.06 84.43 76.61 5 DKIM_VALID 122336 78.09 83.72 75.53 6 RELAYCOUNTRY_US 119062 82.02 81.48 82.27 7 DCC_CHECK 111813 52.13 76.52 41.02 8 XM_B_SpammyWords 101827 53.65 69.69 46.35 9 XMListUnsubscribeExists 99764 56.93 68.27 51.77 10 DKIM_VALID_AU 97955 62.53 67.04 60.48 11 XM_B_Unicode3 73921 44.77 50.59 42.12 12 LOC_TINY_FONT_1 70921 35.74 48.54 29.91 13 BAYES_50 62525 55.90 42.79 61.86 14 XM_B_SpammyWords2 58778 25.93 40.23 19.42 15 T_SCC_BODY_TEXT_LINE 58461 41.28 40.01 41.86 16 HTML_FONT_LOW_CONTRAST 55801 31.80 38.19 28.89 17 XM_DK_Undo_02 54719 15.28 37.45 5.19 18 FVGT_m_MULTI_ODD 48147 29.31 32.95 27.65 19 T_KAM_HTML_FONT_INVALID 47259 26.16 32.34 23.35 20 MIME_HTML_ONLY 46514 23.87 31.83 20.25 21 DKIM_VALID_EF 42716 29.74 29.23 29.97 22 BAYES_99 42106 11.42 28.82 3.51 23 TR_XM_DKIM_Undo 40179 10.30 27.50 2.47 24 XMSubLong 35353 23.17 24.19 22.70 25 XM_Multi_Part_URI 33976 17.15 23.25 14.37 26 RCVD_IN_MSPIKE_H2 32947 21.36 22.55 20.82 27 DCC_CHECK_NEGATIVE 32216 47.39 22.05 58.92 28 BAYES_999 31980 8.66 21.89 2.64 29 TR_XM_DK_Unsub 30958 16.32 21.19 14.11 30 TR_DCC_Bayes_99 30285 7.38 20.73 1.31 31 XM_B_Unsub 29037 12.69 19.87 9.43 32 T_TM2_M_HEADER_IN_MSG 28807 26.24 19.71 29.20 33 TR_XM_BayesUnsub 28233 10.89 19.32 7.06 34 UNPARSEABLE_RELAY 27017 14.24 18.49 12.30 35 RELAYCOUNTRY_META 25013 8.16 17.12 4.08 36 TR_MAX_INTL_RELAY 21945 8.60 15.02 5.68 37 XM_B_SpammyWords3 21573 8.17 14.76 5.17 38 BOTNET_IPINHOSTNAME 18742 6.22 12.83 3.21 39 FSL_BULK_SIG 17532 8.77 12.00 7.30 40 LOTS_OF_MONEY 17152 8.18 11.74 6.55 41 TR_XM_SpammyRelay 16716 5.01 11.44 2.09 42 BOTNET 15857 4.49 10.85 1.59 43 TR_XM_SpammyWords4 15636 6.55 10.70 4.66 44 TR_XM_SpammyWords2 15121 3.61 10.35 0.54 45 XM_Evil_Numbers_Gen 14427 9.07 9.87 8.70 46 TR_XM_UnparsRelay 14024 4.13 9.60 1.64 47 BAYES_80 13668 5.30 9.35 3.46 48 XM_B_Phish_Phrases 13145 6.53 9.00 5.41 49 BAYES_60 11985 7.25 8.20 6.81 50 RCVD_IN_BL_SPAMCOP_NET 11083 2.90 7.58 0.77 51 LotsOfNums_01 10903 7.90 7.46 8.10 52 XM_Body_Dirty_Words 10896 4.20 7.46 2.72 53 UNTRUSTED_Relay 10772 3.41 7.37 1.60 54 MPART_ALT_DIFF 10287 5.44 7.04 4.71 55 HTML_IMAGE_RATIO_02 10031 5.43 6.86 4.78 56 XM_B_PhoneNumber 9831 9.20 6.73 10.32 57 XMSubMetaSx_00 9824 4.91 6.72 4.08 58 RELAYCOUNTRY_CA 8599 2.55 5.88 1.04 59 DKIM_INVALID 8371 3.57 5.73 2.59 60 HTML_IMAGE_RATIO_04 8321 4.88 5.69 4.51 61 XM_UncommonTLD01 8245 4.60 5.64 4.13 62 TooManyTo_001 7987 7.95 5.47 9.08 63 XM_H_Long_From01 7818 5.69 5.35 5.84 64 BAYES_95 7752 3.19 5.31 2.22 65 XM_B_SpammyTLD 7297 3.62 4.99 3.00 66 TR_XM_PhishingBody 6806 2.79 4.66 1.93 67 HTML_IMAGE_RATIO_06 6572 3.77 4.50 3.45 68 XMSexyCombo_05 6520 2.18 4.46 1.14 69 MIME_QP_LONG_LINE 6456 5.05 4.42 5.34 70 XMStrtUSub 6309 4.69 4.32 4.87 71 XM_H_GMP 6128 5.37 4.19 5.90 72 XM_B_Investor 6119 2.55 4.19 1.80 73 XM_UB50 6015 1.98 4.12 1.00 74 MIME_HTML_ONLY_MULTI 5713 3.07 3.91 2.69 75 XM_OfRef6 5616 1.98 3.84 1.13 76 TR_XM_NoHeaderRelay 5607 1.33 3.84 0.19 77 RCVD_IN_MSPIKE_WL 5542 7.13 3.79 8.65 78 MIME_HTML_MOSTLY 5508 2.88 3.77 2.47 79 TM2_M_VERY_LONG_WORD 5105 1.95 3.49 1.24 80 T_XMDrugObfuBody_14 5079 2.67 3.48 2.30 81 XM_CamelCaseFrm001 4893 2.48 3.35 2.09 82 RCVD_IN_VALIDITY_RPBL 4698 1.05 3.22 0.07 83 TM2_M_URI_OPT_OUT 4681 2.17 3.20 1.70 84 XMNumbers 4666 3.47 3.19 3.59 85 TR_XM_SpammyWords5 4529 1.99 3.10 1.48 86 XM_B_URI_Unicode 4468 2.31 3.06 1.97 87 XM_URI_RBL 4266 1.21 2.92 0.43 88 XM_SPF_SoftFail 4262 1.85 2.92 1.36 89 XMDiploma_00 4183 2.14 2.86 1.82 90 HTML_IMAGE_RATIO_08 4149 2.54 2.84 2.40 91 XM_B_SpammyWords4 4030 1.57 2.76 1.02 92 XM_B_Unsub2 4018 1.81 2.75 1.38 93 TR_XM_SPAMCOP 3999 0.96 2.74 0.15 94 T_XMDrugObfuBody_08 3997 1.91 2.74 1.53 95 RCVD_IN_MSPIKE_H3 3866 4.69 2.65 5.62 96 USER_IN_DEF_DKIM_WL 3788 9.96 2.59 13.32 97 RELAYCOUNTRY_AU 3545 1.28 2.43 0.76 98 TR_XM_INV_DKIM 3403 0.89 2.33 0.23 99 URI_TRY_3LD 3379 1.14 2.31 0.61 100 XMStockSpam_06 3374 1.59 2.31 1.26 101 FROM_EXCESS_BASE64 3339 2.01 2.29 1.88 102 KHOP_HELO_FCRDNS 3183 1.51 2.18 1.21 103 MAILING_LIST_MULTI 3138 2.82 2.15 3.12 104 ANY_BOUNCE_MESSAGE 3050 2.64 2.09 2.89 105 BOUNCE_MESSAGE 3046 2.64 2.08 2.89 106 XMBody_17 3021 1.12 2.07 0.68 107 T_FILL_THIS_FORM_SHORT 3011 1.29 2.06 0.94 108 T_XMHurry_00 2991 1.08 2.05 0.64 109 ALL_TRUSTED 2987 10.61 2.04 14.50 110 XMBrknScrpt_02 2948 1.25 2.02 0.90 111 HTML_MIME_NO_HTML_TAG 2922 2.32 2.00 2.47 112 DKIM_ADSP_NXDOMAIN 2879 0.84 1.97 0.33 113 SUBJ_ALL_CAPS 2878 1.74 1.97 1.64 114 T_TooManySym_01 2874 4.72 1.97 5.98 115 XM_DK_Undo_01 2818 1.88 1.93 1.86 116 BAYES_40 2817 4.40 1.93 5.52 117 RCVD_IN_VALIDITY_SAFE 2804 3.34 1.92 3.98 118 XM_H_Long_From02 2762 1.24 1.89 0.94 119 T_REMOTE_IMAGE 2743 3.12 1.88 3.68 120 SpammyFromTLD_02 2681 0.84 1.83 0.39 121 SpammyFromTLD_01 2409 1.06 1.65 0.79 122 HTTPS_HTTP_MISMATCH 2340 1.04 1.60 0.78 123 XMBounce_01 2247 0.49 1.54 0.02 124 TR_LOTS_OF_MONEY3 2215 0.75 1.52 0.40 125 XMGenDplmaNmb 2203 1.16 1.51 1.00 126 XMMoneyMeta_00 2133 0.80 1.46 0.50 127 DIET_1 2082 0.74 1.42 0.44 128 T_XMDrugObfuBody_00 2075 0.99 1.42 0.79 129 RCVD_IN_ZEN_LASTEXTERNAL 2057 0.44 1.41 0.00 130 SHORTCIRCUIT 2057 0.44 1.41 0.00 131 RCVD_IN_PBL 2012 0.89 1.38 0.67 132 XM_SendGrid 1994 1.44 1.36 1.48 133 MPART_ALT_DIFF_COUNT 1963 0.82 1.34 0.58 134 RCVD_IN_VALIDITY_CERTIFIED 1962 2.79 1.34 3.45 135 URI_HEX 1959 1.26 1.34 1.22 136 TR_Symld_Words 1952 1.45 1.34 1.51 137 URI_NOVOWEL 1949 1.68 1.33 1.83 138 RCVD_IN_PSBL 1944 0.62 1.33 0.30 139 XMPhish30 1931 0.81 1.32 0.58 140 XMSubMetaI_00 1883 0.85 1.29 0.65 141 HTML_TAG_BALANCE_BODY 1868 1.01 1.28 0.89 142 XMBdyGiftCard01 1818 0.83 1.24 0.64 143 SHOPIFY_IMG_NOT_RCVD_SFY 1780 0.63 1.22 0.37 144 BOTNET_NORDNS 1719 0.38 1.18 0.01 145 TR_XM_PHPForged 1693 0.60 1.16 0.35 146 XM_B_Phish66 1691 0.63 1.16 0.39 147 TR_XM_FormFill2 1685 0.60 1.15 0.35 148 TR_XM_PHPDW 1685 0.60 1.15 0.35 149 XPRIO 1669 0.36 1.14 0.01 150 RCVD_IN_MSPIKE_BL 1655 0.42 1.13 0.09 151 XM_H_PHPOS 1645 0.58 1.13 0.34 152 BAYES_20 1616 2.98 1.11 3.83 153 RELAYCOUNTRY_FR 1603 0.54 1.10 0.28 154 HTML_IMAGE_ONLY_20 1602 0.66 1.10 0.46 155 XM_B_COPY_HTML 1585 0.98 1.08 0.94 156 RCVD_IN_IADB_LISTED 1574 3.11 1.08 4.03 157 DKIM_ADSP_CUSTOM_MED 1573 1.00 1.08 0.96 158 TR_LOTS_OF_MONEY2 1542 0.55 1.06 0.31 159 T_MONEY_PERCENT 1542 0.55 1.06 0.31 160 HTML_FONT_TINY_NORDNS 1517 0.36 1.04 0.05 161 XM_HighProb1 1486 0.33 1.02 0.01 162 XM_B_SEO 1482 0.52 1.01 0.30 163 RCVD_IN_IADB_SPF 1476 2.75 1.01 3.54 164 XM_ProductURIs 1469 0.60 1.01 0.41 165 RELAYCOUNTRY_CN 1467 0.37 1.00 0.08 166 RCVD_IN_MSPIKE_H5 1466 2.21 1.00 2.76 167 TR_XM_InvalidRelay 1465 0.32 1.00 0.02 168 RCVD_IN_IADB_DK 1444 2.43 0.99 3.08 169 XMPhish14 1442 0.63 0.99 0.47 170 XM_UB99 1442 0.31 0.99 0.00 171 RCVD_IN_IADB_SENDERID 1433 2.48 0.98 3.16 172 RELAYCOUNTRY_GB 1426 0.69 0.98 0.56 173 XM_B_DNDMA 1422 0.76 0.97 0.67 174 XMSubMetaSxObfu_03 1414 0.61 0.97 0.45 175 TR_XM_RelayPhish 1402 0.37 0.96 0.10 176 RELAYCOUNTRY_TH 1392 0.30 0.95 0.00 177 TR_Mismatch_TLD_02 1386 0.38 0.95 0.11 178 XMBody_78 1378 0.51 0.94 0.32 179 LongTLD 1376 0.65 0.94 0.51 180 RDNS_DYNAMIC 1335 0.43 0.91 0.21 181 XM_DIRTYINTL 1333 0.36 0.91 0.11 182 XMReplyNow 1310 0.43 0.90 0.22 183 TR_XM_DK_SendGrid 1285 0.91 0.88 0.92 184 MultiRelay_CC 1285 0.38 0.88 0.16 185 TR_XM_Base64_M1 1268 0.75 0.87 0.69 186 XMSexyCombo_01 1268 0.44 0.87 0.25 187 TR_XM_SEO4 1243 0.38 0.85 0.16 188 XMHTML_After_End 1241 0.55 0.85 0.41 189 TR_Mismatch_TLD_01 1226 0.42 0.84 0.23 190 TVD_RCVD_IP 1203 0.73 0.82 0.69 191 FORGED_GMAIL_RCVD 1197 0.70 0.82 0.65 192 TR_MetaPhish_Combo_01 1175 0.75 0.80 0.73 193 XM_OfRef7 1170 0.37 0.80 0.17 194 TM2_M_OBFU_COMMENT 1168 0.54 0.80 0.42 195 HTML_FONT_FACE_BAD 1147 0.52 0.78 0.39 196 THIS_AD 1146 0.46 0.78 0.31 197 MISSING_HEADERS 1133 0.48 0.78 0.34 198 XM_UB60 1121 0.28 0.77 0.07 199 XMDateMe_00 1117 0.52 0.76 0.40 200 NML_ADSP_CUSTOM_MED 1111 0.67 0.76 0.62 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 281469 90.09 95.44 87.66 2 RELAYCOUNTRY_US 264168 82.02 81.48 82.27 3 DKIM_SIGNED 250841 81.66 89.45 78.12 4 XM_DK_Pass 246002 79.06 84.43 76.61 5 DKIM_VALID 242517 78.09 83.72 75.53 6 XM_B_Unicode 232028 76.09 84.50 72.26 7 BAYES_50 198643 55.90 42.79 61.86 8 DKIM_VALID_AU 194205 62.53 67.04 60.48 9 DCC_CHECK_NEGATIVE 189201 47.39 22.05 58.92 10 XMListUnsubscribeExists 166218 56.93 68.27 51.77 11 XM_B_SpammyWords 148828 53.65 69.69 46.35 12 XM_B_Unicode3 135235 44.77 50.59 42.12 13 T_SCC_BODY_TEXT_LINE 134400 41.28 40.01 41.86 14 DCC_CHECK 131724 52.13 76.52 41.02 15 DKIM_VALID_EF 96216 29.74 29.23 29.97 16 LOC_TINY_FONT_1 96051 35.74 48.54 29.91 17 T_TM2_M_HEADER_IN_MSG 93767 26.24 19.71 29.20 18 HTML_FONT_LOW_CONTRAST 92769 31.80 38.19 28.89 19 FVGT_m_MULTI_ODD 88783 29.31 32.95 27.65 20 T_KAM_HTML_FONT_INVALID 74975 26.16 32.34 23.35 21 XMSubLong 72894 23.17 24.19 22.70 22 RCVD_IN_MSPIKE_H2 66846 21.36 22.55 20.82 23 MIME_HTML_ONLY 65022 23.87 31.83 20.25 24 XM_B_SpammyWords2 62358 25.93 40.23 19.42 25 ALL_TRUSTED 46565 10.61 2.04 14.50 26 XM_Multi_Part_URI 46157 17.15 23.25 14.37 27 TR_XM_DK_Unsub 45305 16.32 21.19 14.11 28 USER_IN_DEF_DKIM_WL 42768 9.96 2.59 13.32 29 UNPARSEABLE_RELAY 39505 14.24 18.49 12.30 30 BAYES_00 33984 7.43 0.48 10.58 31 XM_B_PhoneNumber 33150 9.20 6.73 10.32 32 XM_B_Unsub 30269 12.69 19.87 9.43 33 TooManyTo_001 29163 7.95 5.47 9.08 34 XM_Evil_Numbers_Gen 27951 9.07 9.87 8.70 35 RCVD_IN_MSPIKE_WL 27765 7.13 3.79 8.65 36 LotsOfNums_01 26016 7.90 7.46 8.10 37 FSL_BULK_SIG 23450 8.77 12.00 7.30 38 IN_ZIMBRA_NJ_WHITELIST 23139 4.99 0.12 7.21 39 TR_XM_DK_Bayes 23120 5.07 0.39 7.20 40 TR_XM_BayesUnsub 22660 10.89 19.32 7.06 41 TR_XM_DK_Bayes1 22654 4.97 0.38 7.06 42 XM_DKIMWhitelistDomains 22316 4.78 0.01 6.95 43 BAYES_60 21872 7.25 8.20 6.81 44 LOTS_OF_MONEY 21046 8.18 11.74 6.55 45 TR_XM_DK_Bayes2 19492 4.26 0.29 6.07 46 T_TooManySym_01 19194 4.72 1.97 5.98 47 XM_H_GMP 18947 5.37 4.19 5.90 48 XM_H_Long_From01 18746 5.69 5.35 5.84 49 TR_MAX_INTL_RELAY 18254 8.60 15.02 5.68 50 RCVD_IN_MSPIKE_H3 18058 4.69 2.65 5.62 51 BAYES_40 17731 4.40 1.93 5.52 52 XM_B_Phish_Phrases 17376 6.53 9.00 5.41 53 MIME_QP_LONG_LINE 17152 5.05 4.42 5.34 54 XM_DK_Undo_02 16678 15.28 37.45 5.19 55 XM_B_SpammyWords3 16587 8.17 14.76 5.17 56 XMStrtUSub 15624 4.69 4.32 4.87 57 HTML_IMAGE_RATIO_02 15359 5.43 6.86 4.78 58 MPART_ALT_DIFF 15135 5.44 7.04 4.71 59 TR_XM_SpammyWords4 14967 6.55 10.70 4.66 60 HTML_IMAGE_RATIO_04 14486 4.88 5.69 4.51 61 XM_PDF 14444 3.33 0.76 4.50 62 XM_UncommonTLD01 13258 4.60 5.64 4.13 63 XMSubMetaSx_00 13104 4.91 6.72 4.08 64 RELAYCOUNTRY_META 13102 8.16 17.12 4.08 65 RCVD_IN_IADB_LISTED 12950 3.11 1.08 4.03 66 RCVD_IN_VALIDITY_SAFE 12784 3.34 1.92 3.98 67 BAYES_20 12309 2.98 1.11 3.83 68 T_REMOTE_IMAGE 11816 3.12 1.88 3.68 69 XMNumbers 11526 3.47 3.19 3.59 70 RCVD_IN_IADB_SPF 11352 2.75 1.01 3.54 71 BAYES_99 11272 11.42 28.82 3.51 72 BAYES_80 11113 5.30 9.35 3.46 73 RCVD_IN_VALIDITY_CERTIFIED 11076 2.79 1.34 3.45 74 HTML_IMAGE_RATIO_06 11065 3.77 4.50 3.45 75 BOTNET_IPINHOSTNAME 10321 6.22 12.83 3.21 76 RCVD_IN_IADB_SENDERID 10153 2.48 0.98 3.16 77 MAILING_LIST_MULTI 10017 2.82 2.15 3.12 78 T_TooManySym_02 9990 2.30 0.53 3.11 79 RCVD_IN_IADB_DK 9898 2.43 0.99 3.08 80 XM_B_SpammyTLD 9624 3.62 4.99 3.00 81 TooManyTo_002 9288 2.20 0.66 2.89 82 ANY_BOUNCE_MESSAGE 9280 2.64 2.09 2.89 83 BOUNCE_MESSAGE 9271 2.64 2.08 2.89 84 RCVD_IN_MSPIKE_H5 8867 2.21 1.00 2.76 85 XM_Body_Dirty_Words 8746 4.20 7.46 2.72 86 MIME_HTML_ONLY_MULTI 8635 3.07 3.91 2.69 87 RCVD_IN_IADB_VOUCHED 8609 1.95 0.33 2.68 88 BAYES_999 8476 8.66 21.89 2.64 89 DKIM_INVALID 8324 3.57 5.73 2.59 90 TR_XM_DKIM_Undo 7943 10.30 27.50 2.47 91 MIME_HTML_MOSTLY 7932 2.88 3.77 2.47 92 HTML_MIME_NO_HTML_TAG 7929 2.32 2.00 2.47 93 HTML_IMAGE_RATIO_08 7711 2.54 2.84 2.40 94 T_XMDrugObfuBody_14 7397 2.67 3.48 2.30 95 INVALID_MSGID 7291 1.62 0.20 2.27 96 BAYES_95 7130 3.19 5.31 2.22 97 BAYES_05 7030 1.69 0.61 2.19 98 XM_CamelCaseFrm001 6715 2.48 3.35 2.09 99 TR_XM_SpammyRelay 6698 5.01 11.44 2.09 100 XM_B_URI_Unicode 6313 2.31 3.06 1.97 101 TO_MALFORMED 6262 1.35 0.02 1.95 102 TR_XM_PhishingBody 6211 2.79 4.66 1.93 103 FROM_EXCESS_BASE64 6041 2.01 2.29 1.88 104 RCVD_IN_IADB_OPTIN 6000 1.35 0.22 1.87 105 XM_DK_Undo_01 5968 1.88 1.93 1.86 106 URI_NOVOWEL 5880 1.68 1.33 1.83 107 XMDiploma_00 5829 2.14 2.86 1.82 108 XM_B_Investor 5779 2.55 4.19 1.80 109 TM2_M_URI_OPT_OUT 5444 2.17 3.20 1.70 110 TR_XM_UnparsRelay 5268 4.13 9.60 1.64 111 SUBJ_ALL_CAPS 5268 1.74 1.97 1.64 112 TooManyTo_003 5198 1.29 0.58 1.62 113 UNTRUSTED_Relay 5141 3.41 7.37 1.60 114 BOTNET 5101 4.49 10.85 1.59 115 T_XMDrugObfuBody_08 4908 1.91 2.74 1.53 116 TR_Symld_Words 4845 1.45 1.34 1.51 117 TR_XM_SpammyWords5 4760 1.99 3.10 1.48 118 XM_SendGrid 4742 1.44 1.36 1.48 119 IN_HORDE_ADDRESS_BOOK 4436 0.98 0.10 1.38 120 XM_B_Unsub2 4419 1.81 2.75 1.38 121 XM_SPF_SoftFail 4365 1.85 2.92 1.36 122 XM_GoogleGroups 4296 1.14 0.71 1.34 123 T_TooManySym_03 4281 0.99 0.23 1.33 124 HELO_NODOT 4216 1.00 0.30 1.31 125 HELO_NO_DOMAIN 4211 0.99 0.28 1.31 126 TR_DCC_Bayes_99 4200 7.38 20.73 1.31 127 XM_H_PHPMailer 4049 1.09 0.72 1.26 128 XMStockSpam_06 4032 1.59 2.31 1.26 129 TM2_M_VERY_LONG_WORD 3991 1.95 3.49 1.24 130 URI_HEX 3926 1.26 1.34 1.22 131 KHOP_HELO_FCRDNS 3891 1.51 2.18 1.21 132 XMGappySubj_01 3834 0.88 0.18 1.19 133 XMCapTrack 3834 0.96 0.46 1.19 134 TooManyTo_004 3782 0.97 0.52 1.18 135 XMSexyCombo_05 3645 2.18 4.46 1.14 136 XM_OfRef6 3639 1.98 3.84 1.13 137 RELAYCOUNTRY_CA 3337 2.55 5.88 1.04 138 XM_B_SpammyWords4 3284 1.57 2.76 1.02 139 TVD_SPACE_RATIO 3233 0.76 0.22 1.01 140 XM_UB50 3218 1.98 4.12 1.00 141 XMGenDplmaNmb 3214 1.16 1.51 1.00 142 XM_ShortIntro_01 3136 0.81 0.44 0.98 143 DKIM_ADSP_CUSTOM_MED 3079 1.00 1.08 0.96 144 TooManyTo_005 3036 0.80 0.49 0.95 145 T_FILL_THIS_FORM_SHORT 3027 1.29 2.06 0.94 146 XM_H_Long_From02 3015 1.24 1.89 0.94 147 XM_B_COPY_HTML 3011 0.98 1.08 0.94 148 TR_XM_DK_SendGrid 2953 0.91 0.88 0.92 149 XMBrknScrpt_02 2874 1.25 2.02 0.90 150 HTML_TAG_BALANCE_BODY 2868 1.01 1.28 0.89 151 FROM_GOV_DKIM_AU 2670 0.63 0.17 0.83 152 T_XMDrugObfuBody_00 2551 0.99 1.42 0.79 153 SpammyFromTLD_01 2541 1.06 1.65 0.79 154 HTTPS_HTTP_MISMATCH 2514 1.04 1.60 0.78 155 RCVD_IN_BL_SPAMCOP_NET 2486 2.90 7.58 0.77 156 RELAYCOUNTRY_AU 2435 1.28 2.43 0.76 157 TR_MetaPhish_Combo_01 2334 0.75 0.80 0.73 158 XMNoVowels 2253 0.62 0.44 0.70 159 XMGappySubj_02 2245 0.49 0.04 0.70 160 TR_XM_Base64_M1 2218 0.75 0.87 0.69 161 T_OBFU_PDF_ATTACH 2207 0.52 0.16 0.69 162 TVD_RCVD_IP 2204 0.73 0.82 0.69 163 XMBody_17 2192 1.12 2.07 0.68 164 RCVD_IN_PBL 2159 0.89 1.38 0.67 165 XM_B_DNDMA 2136 0.76 0.97 0.67 166 XMSubMetaI_00 2098 0.85 1.29 0.65 167 XM_B_FormFill 2095 0.46 0.03 0.65 168 FORGED_GMAIL_RCVD 2083 0.70 0.82 0.65 169 XMBdyGiftCard01 2062 0.83 1.24 0.64 170 XMBody_95 2045 0.55 0.37 0.64 171 T_XMHurry_00 2043 1.08 2.05 0.64 172 NML_ADSP_CUSTOM_MED 1996 0.67 0.76 0.62 173 T_Symld_Words_02 1956 0.64 0.70 0.61 174 URI_TRY_3LD 1954 1.14 2.31 0.61 175 XMPhish30 1861 0.81 1.32 0.58 176 MPART_ALT_DIFF_COUNT 1850 0.82 1.34 0.58 177 RELAYCOUNTRY_GB 1811 0.69 0.98 0.56 178 TR_XM_SpammyWords2 1740 3.61 10.35 0.54 179 XMSlimDrugH 1663 0.57 0.69 0.52 180 LongTLD 1640 0.65 0.94 0.51 181 XMBSHREFv2 1638 0.49 0.46 0.51 182 MSGID_FROM_MTA_HEADER 1615 0.40 0.18 0.50 183 XMMoneyMeta_00 1612 0.80 1.46 0.50 184 XMPhish14 1508 0.63 0.99 0.47 185 HTML_IMAGE_ONLY_20 1486 0.66 1.10 0.46 186 T_STY_INVIS_DIRECT 1448 0.50 0.59 0.45 187 XMSubMetaSxObfu_03 1437 0.61 0.97 0.45 188 XMLngstWrd_00 1428 0.41 0.34 0.44 189 TO_NO_BRKTS_HTML_ONLY 1411 0.48 0.57 0.44 190 DIET_1 1398 0.74 1.42 0.44 191 XM_Body_Obfu01 1384 0.49 0.63 0.43 192 XM_URI_RBL 1383 1.21 2.92 0.43 193 TM2_M_OBFU_COMMENT 1345 0.54 0.80 0.42 194 XMHTML_After_End 1329 0.55 0.85 0.41 195 XM_ProductURIs 1319 0.60 1.01 0.41 196 SHORT_HELO_AND_INLINE_IMAGE 1316 0.29 0.03 0.41 197 XMDateMe_00 1299 0.52 0.76 0.40 198 TR_LOTS_OF_MONEY3 1288 0.75 1.52 0.40 199 XMLngstWrd_01 1264 0.36 0.30 0.39 200 HTML_FONT_FACE_BAD 1260 0.52 0.78 0.39 ----------------------------------------------------------------------