Email: 628150 Autolearn: 0 AvgScore: 4.32 AvgScanTime: 1.33 sec Spam: 145324 Autolearn: 0 AvgScore: 14.63 AvgScanTime: 1.68 sec Ham: 482826 Autolearn: 0 AvgScore: 1.22 AvgScanTime: 1.22 sec Time Spent Running SA: 231.94 hours Time Spent Processing Spam: 67.71 hours Time Spent Processing Ham: 164.24 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137646 90.58 94.72 89.33 2 DKIM_SIGNED 124026 61.73 85.34 54.62 3 RELAYCOUNTRY_US 118956 84.74 81.86 85.60 4 XM_DK_Pass 117664 59.97 80.97 53.65 5 XM_B_Unicode 117186 66.63 80.64 62.42 6 DKIM_VALID 116795 59.24 80.37 52.87 7 DCC_CHECK 105372 38.50 72.51 28.26 8 XM_B_SpammyWords 94959 46.54 65.34 40.88 9 DKIM_VALID_AU 93112 47.06 64.07 41.94 10 XMListUnsubscribeExists 92889 41.05 63.92 34.16 11 XM_B_Unicode3 68047 39.29 46.82 37.02 12 LOC_TINY_FONT_1 67289 26.63 46.30 20.71 13 BAYES_50 63347 53.38 43.59 56.33 14 T_SCC_BODY_TEXT_LINE 58102 41.33 39.98 41.73 15 HTML_FONT_LOW_CONTRAST 55181 42.44 37.97 43.78 16 XM_DK_Undo_02 54699 11.54 37.64 3.69 17 XM_B_SpammyWords2 54450 20.35 37.47 15.20 18 FVGT_m_MULTI_ODD 47276 22.33 32.53 19.27 19 T_KAM_HTML_FONT_INVALID 44756 19.19 30.80 15.70 20 MIME_HTML_ONLY 41973 18.05 28.88 14.79 21 BAYES_99 41903 8.46 28.83 2.33 22 DKIM_VALID_EF 39753 22.95 27.35 21.63 23 TR_XM_DKIM_Undo 39262 7.74 27.02 1.93 24 DCC_CHECK_NEGATIVE 37462 61.07 25.78 71.69 25 T_TM2_M_HEADER_IN_MSG 34932 35.41 24.04 38.83 26 XMSubLong 34567 18.57 23.79 16.99 27 BAYES_999 31994 6.46 22.02 1.78 28 XM_Multi_Part_URI 30188 12.70 20.77 10.28 29 TR_DCC_Bayes_99 29344 5.36 20.19 0.89 30 XM_B_Unsub 27668 9.31 19.04 6.38 31 TR_XM_DK_Unsub 27604 11.45 18.99 9.18 32 TR_XM_BayesUnsub 26686 7.91 18.36 4.76 33 UNPARSEABLE_RELAY 26539 11.10 18.26 8.94 34 RELAYCOUNTRY_META 23101 6.03 15.90 3.06 35 LOTS_OF_MONEY 20597 6.48 14.17 4.17 36 TR_MAX_INTL_RELAY 20260 6.20 13.94 3.87 37 XM_B_SpammyWords3 20198 5.54 13.90 3.02 38 RCVD_IN_MSPIKE_H2 19843 11.48 13.65 10.83 39 BOTNET_IPINHOSTNAME 18999 4.86 13.07 2.39 40 XM_Evil_Numbers_Gen 18546 20.27 12.76 22.53 41 TR_XM_SpammyWords4 17837 4.95 12.27 2.75 42 FSL_BULK_SIG 17589 7.27 12.10 5.81 43 BOTNET 15716 3.43 10.81 1.21 44 TR_XM_SpammyRelay 15699 3.79 10.80 1.68 45 TR_XM_SpammyWords2 14054 2.55 9.67 0.41 46 TR_XM_UnparsRelay 13679 3.20 9.41 1.33 47 XM_B_Phish_Phrases 13376 8.77 9.20 8.64 48 BAYES_80 12394 3.84 8.53 2.43 49 XM_Body_Dirty_Words 12363 3.56 8.51 2.08 50 RCVD_IN_BL_SPAMCOP_NET 11290 2.24 7.77 0.57 51 BAYES_60 11156 5.67 7.68 5.07 52 LotsOfNums_01 10586 6.34 7.28 6.05 53 RCVD_IN_MSPIKE_WL 10025 8.49 6.90 8.97 54 HTML_IMAGE_RATIO_02 9608 4.08 6.61 3.32 55 XMSubMetaSx_00 9541 3.54 6.57 2.63 56 XMNumbers 9435 16.44 6.49 19.43 57 XM_UncommonTLD01 9125 4.04 6.28 3.37 58 UNTRUSTED_Relay 8920 2.22 6.14 1.05 59 XM_B_PhoneNumber 8900 7.11 6.12 7.41 60 RELAYCOUNTRY_CA 8419 1.99 5.79 0.85 61 MPART_ALT_DIFF 8324 3.72 5.73 3.12 62 XM_H_Long_From01 8159 4.53 5.61 4.20 63 XM_H_GMP 7517 4.46 5.17 4.25 64 HTML_IMAGE_RATIO_04 7503 4.52 5.16 4.33 65 BAYES_95 7478 2.29 5.15 1.43 66 XM_URI_RBL 7367 1.39 5.07 0.28 67 DKIM_INVALID 7231 2.50 4.98 1.75 68 XMStrtUSub 7061 4.33 4.86 4.17 69 XM_B_Investor 7029 2.00 4.84 1.14 70 ANY_BOUNCE_MESSAGE 6703 20.99 4.61 25.92 71 BOUNCE_MESSAGE 6701 20.99 4.61 25.92 72 TR_XM_PhishingBody 6487 2.06 4.46 1.34 73 TooManyTo_001 6208 5.74 4.27 6.18 74 HTML_IMAGE_RATIO_06 6093 2.91 4.19 2.53 75 XM_OfRef6 6090 1.53 4.19 0.73 76 T_XMDrugObfuBody_14 6080 2.42 4.18 1.89 77 MIME_QP_LONG_LINE 6056 5.46 4.17 5.85 78 XMSexyCombo_05 6018 1.65 4.14 0.90 79 MIME_HTML_MOSTLY 5890 2.16 4.05 1.60 80 XM_B_SpammyTLD 5860 2.50 4.03 2.04 81 TR_XM_SpammyWords5 5638 4.24 3.88 4.35 82 RCVD_IN_MSPIKE_H3 5485 4.35 3.77 4.53 83 TM2_M_VERY_LONG_WORD 5260 2.48 3.62 2.14 84 T_XMDrugObfuBody_08 4966 1.70 3.42 1.18 85 HTML_IMAGE_ONLY_32 4892 12.05 3.37 14.66 86 KHOP_HELO_FCRDNS 4849 12.37 3.34 15.09 87 TR_XM_SPAMCOP 4715 0.86 3.24 0.15 88 SHORT_URI_2 4687 15.65 3.23 19.39 89 T_TVD_MIME_NO_HEADERS 4664 18.02 3.21 22.48 90 SHORT_URI_3 4659 9.92 3.21 11.94 91 XM_CamelCaseFrm001 4609 1.73 3.17 1.30 92 XM_UB50 4542 1.23 3.13 0.66 93 MIME_HTML_ONLY_MULTI 4521 2.04 3.11 1.71 94 XMDiploma_00 4450 1.62 3.06 1.19 95 XM_B_Unsub2 4402 1.45 3.03 0.97 96 XM_B_URI_Unicode 4361 1.81 3.00 1.46 97 TM2_M_URI_OPT_OUT 4331 3.19 2.98 3.26 98 XM_SPF_SoftFail 4167 1.44 2.87 1.02 99 ALL_TRUSTED 4133 9.90 2.84 12.02 100 HTML_MIME_NO_HTML_TAG 4100 2.34 2.82 2.19 101 HTML_IMAGE_RATIO_08 4097 1.91 2.82 1.64 102 T_TooManySym_01 3969 3.74 2.73 4.04 103 T_FILL_THIS_FORM_SHORT 3945 1.13 2.71 0.66 104 TR_XM_NoHeaderRelay 3817 0.73 2.63 0.16 105 RCVD_IN_MSPIKE_H5 3697 3.41 2.54 3.67 106 RELAYCOUNTRY_AU 3686 1.04 2.54 0.59 107 SUBJ_ALL_CAPS 3681 1.36 2.53 1.00 108 XM_DK_Undo_01 3377 1.61 2.32 1.40 109 USER_IN_DEF_DKIM_WL 3326 7.33 2.29 8.85 110 TR_XM_INV_DKIM 3297 0.64 2.27 0.14 111 XMBody_17 3245 0.74 2.23 0.29 112 RCVD_IN_VALIDITY_RPBL 3191 0.56 2.20 0.06 113 XM_B_SpammyWords4 3175 0.74 2.18 0.30 114 MAILING_LIST_MULTI 3152 2.18 2.17 2.19 115 RCVD_IN_VALIDITY_SAFE 2984 2.68 2.05 2.87 116 XM_H_Long_From02 2940 0.99 2.02 0.68 117 XMStockSpam_06 2910 0.90 2.00 0.57 118 T_XMDrugObfuBody_00 2809 7.11 1.93 8.66 119 T_XMHurry_00 2789 0.76 1.92 0.41 120 URI_NOVOWEL 2768 1.38 1.90 1.22 121 SpammyFromTLD_02 2680 0.69 1.84 0.34 122 XMGenDplmaNmb 2623 0.99 1.80 0.74 123 XM_PDF 2573 4.00 1.77 4.68 124 BAYES_40 2483 9.71 1.71 12.11 125 FROM_EXCESS_BASE64 2483 1.31 1.71 1.19 126 RCVD_IN_ZEN_LASTEXTERNAL 2464 0.39 1.70 0.00 127 SHORTCIRCUIT 2464 0.39 1.70 0.00 128 SpammyFromTLD_01 2403 0.81 1.65 0.55 129 URI_HEX 2380 1.09 1.64 0.93 130 RCVD_IN_VALIDITY_CERTIFIED 2366 2.24 1.63 2.42 131 XMBrknScrpt_02 2362 0.80 1.63 0.55 132 DKIM_ADSP_NXDOMAIN 2275 0.53 1.57 0.21 133 T_REMOTE_IMAGE 2255 2.58 1.55 2.89 134 T_MONEY_PERCENT 2175 0.48 1.50 0.18 135 TR_LOTS_OF_MONEY2 2175 0.48 1.50 0.18 136 BAYES_20 2155 6.59 1.48 8.13 137 TR_LOTS_OF_MONEY3 2117 0.47 1.46 0.18 138 BOTNET_NORDNS 2091 0.34 1.44 0.01 139 HTTPS_HTTP_MISMATCH 2085 0.73 1.43 0.52 140 XMPhish30 2041 0.60 1.40 0.36 141 RCVD_IN_MSPIKE_BL 1987 0.59 1.37 0.35 142 TR_XM_MSPIKECOMBO 1986 0.59 1.37 0.35 143 XM_SendGrid 1971 1.24 1.36 1.20 144 XM_DIRTYINTL 1962 0.37 1.35 0.07 145 TR_Mismatch_TLD_02 1938 0.37 1.33 0.08 146 RCVD_IN_PSBL 1922 0.48 1.32 0.22 147 URI_TRY_3LD 1840 0.56 1.27 0.35 148 MPART_ALT_DIFF_COUNT 1751 0.68 1.20 0.52 149 XM_B_Phish66 1751 0.47 1.20 0.25 150 XMBdyGiftCard01 1731 0.55 1.19 0.36 151 XMBody_78 1730 0.99 1.19 0.93 152 XM_B_SEO 1704 0.40 1.17 0.17 153 LongTLD 1693 0.57 1.16 0.39 154 DIET_1 1691 0.42 1.16 0.19 155 XM_ProductURIs 1669 0.50 1.15 0.31 156 XM_UB99 1657 0.27 1.14 0.00 157 TR_XM_SEO4 1606 0.32 1.11 0.08 158 HTML_IMAGE_ONLY_20 1586 0.51 1.09 0.33 159 TR_XM_PHPForged 1577 0.56 1.09 0.41 160 TR_XM_PHPDW 1572 0.57 1.08 0.41 161 XPRIO 1565 0.26 1.08 0.01 162 TR_XM_FormFill2 1558 0.56 1.07 0.41 163 DKIM_ADSP_CUSTOM_MED 1548 0.79 1.07 0.71 164 TR_Symld_Words 1543 1.36 1.06 1.45 165 XM_H_PHPOS 1516 0.55 1.04 0.40 166 XMPhish14 1509 0.55 1.04 0.41 167 RCVD_IN_PBL 1507 0.69 1.04 0.58 168 HTML_TAG_BALANCE_BODY 1504 0.51 1.03 0.35 169 MultiRelay_CC 1499 0.33 1.03 0.12 170 XM_H_Undi_Recip 1480 0.33 1.02 0.12 171 RCVD_IN_IADB_LISTED 1465 2.54 1.01 3.00 172 BASE64_LENGTH_79_INF 1416 0.42 0.97 0.25 173 XM_OfRef7 1411 0.33 0.97 0.13 174 XMSubMetaI_00 1410 0.54 0.97 0.42 175 XM_B_COPY_HTML 1410 0.64 0.97 0.54 176 RDNS_DYNAMIC 1392 0.32 0.96 0.13 177 HTML_FONT_TINY_NORDNS 1382 0.25 0.95 0.03 178 TR_XM_SpammyWords3 1370 0.33 0.94 0.15 179 RCVD_IN_MSPIKE_L3 1370 0.49 0.94 0.35 180 RELAYCOUNTRY_FR 1370 0.39 0.94 0.23 181 XMHTML_After_End 1365 0.48 0.94 0.34 182 T_OBFU_PDF_ATTACH 1363 1.09 0.94 1.14 183 RELAYCOUNTRY_GB 1358 0.54 0.93 0.42 184 RCVD_IN_XBL 1356 0.24 0.93 0.03 185 RCVD_IN_IADB_SPF 1342 2.21 0.92 2.60 186 XMSexyCombo_01 1336 0.30 0.92 0.12 187 TR_MetaPhish_Combo_01 1335 0.64 0.92 0.55 188 FSL_NEW_HELO_USER 1328 0.21 0.91 0.00 189 FORGED_MUA_OUTLOOK 1327 0.22 0.91 0.01 190 FSL_CTYPE_WIN1251 1315 0.21 0.90 0.00 191 RCVD_IN_IADB_DK 1303 1.93 0.90 2.24 192 RCVD_IN_IADB_SENDERID 1296 1.97 0.89 2.30 193 RCVD_IN_SORBS_DUL 1288 0.23 0.89 0.03 194 SHOPIFY_IMG_NOT_RCVD_SFY 1278 0.34 0.88 0.17 195 TR_XM_DK_SendGrid 1249 0.81 0.86 0.80 196 XMBounce_01 1249 0.21 0.86 0.02 197 URIBL_BLACK 1243 0.23 0.86 0.04 198 XM_B_DNDMA 1242 0.48 0.85 0.36 199 TR_XM_RelayPhish 1239 0.24 0.85 0.06 200 TVD_RCVD_IP 1234 0.57 0.85 0.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 431311 90.58 94.72 89.33 2 RELAYCOUNTRY_US 413322 84.74 81.86 85.60 3 DCC_CHECK_NEGATIVE 346157 61.07 25.78 71.69 4 XM_B_Unicode 301362 66.63 80.64 62.42 5 BAYES_50 271954 53.38 43.59 56.33 6 DKIM_SIGNED 263736 61.73 85.34 54.62 7 XM_DK_Pass 259051 59.97 80.97 53.65 8 DKIM_VALID 255290 59.24 80.37 52.87 9 HTML_FONT_LOW_CONTRAST 211385 42.44 37.97 43.78 10 DKIM_VALID_AU 202501 47.06 64.07 41.94 11 T_SCC_BODY_TEXT_LINE 201503 41.33 39.98 41.73 12 XM_B_SpammyWords 197360 46.54 65.34 40.88 13 T_TM2_M_HEADER_IN_MSG 187498 35.41 24.04 38.83 14 XM_B_Unicode3 178728 39.29 46.82 37.02 15 XMListUnsubscribeExists 164956 41.05 63.92 34.16 16 DCC_CHECK 136464 38.50 72.51 28.26 17 ANY_BOUNCE_MESSAGE 125142 20.99 4.61 25.92 18 BOUNCE_MESSAGE 125139 20.99 4.61 25.92 19 XM_Evil_Numbers_Gen 108801 20.27 12.76 22.53 20 T_TVD_MIME_NO_HEADERS 108524 18.02 3.21 22.48 21 DKIM_VALID_EF 104427 22.95 27.35 21.63 22 LOC_TINY_FONT_1 99979 26.63 46.30 20.71 23 XMNumbers 93836 16.44 6.49 19.43 24 SHORT_URI_2 93621 15.65 3.23 19.39 25 FVGT_m_MULTI_ODD 93019 22.33 32.53 19.27 26 XMSubLong 82052 18.57 23.79 16.99 27 T_KAM_HTML_FONT_INVALID 75793 19.19 30.80 15.70 28 XM_B_SpammyWords2 73380 20.35 37.47 15.20 29 KHOP_HELO_FCRDNS 72876 12.37 3.34 15.09 30 MIME_HTML_ONLY 71397 18.05 28.88 14.79 31 HTML_IMAGE_ONLY_32 70782 12.05 3.37 14.66 32 BAYES_40 58486 9.71 1.71 12.11 33 ALL_TRUSTED 58040 9.90 2.84 12.02 34 SHORT_URI_3 57649 9.92 3.21 11.94 35 RCVD_IN_MSPIKE_H2 52283 11.48 13.65 10.83 36 XM_Multi_Part_URI 49612 12.70 20.77 10.28 37 TR_XM_DK_Unsub 44347 11.45 18.99 9.18 38 RCVD_IN_MSPIKE_WL 43333 8.49 6.90 8.97 39 UNPARSEABLE_RELAY 43188 11.10 18.26 8.94 40 USER_IN_DEF_DKIM_WL 42745 7.33 2.29 8.85 41 T_XMDrugObfuBody_00 41824 7.11 1.93 8.66 42 XM_B_Phish_Phrases 41732 8.77 9.20 8.64 43 BAYES_00 40678 6.64 0.70 8.42 44 BAYES_20 39253 6.59 1.48 8.13 45 XMLngstWrd_00 39070 6.41 0.81 8.09 46 XM_B_PhoneNumber 35782 7.11 6.12 7.41 47 XM_B_Unsub 30803 9.31 19.04 6.38 48 TooManyTo_001 29857 5.74 4.27 6.18 49 LotsOfNums_01 29217 6.34 7.28 6.05 50 MIME_QP_LONG_LINE 28233 5.46 4.17 5.85 51 FSL_BULK_SIG 28048 7.27 12.10 5.81 52 TR_XM_DK_Bayes 25855 4.25 0.57 5.35 53 IN_ZIMBRA_NJ_WHITELIST 25434 4.07 0.10 5.27 54 TR_XM_DK_Bayes1 25313 4.16 0.57 5.24 55 BAYES_60 24466 5.67 7.68 5.07 56 TR_XM_BayesUnsub 23004 7.91 18.36 4.76 57 XM_PDF 22579 4.00 1.77 4.68 58 XM_DKIMWhitelistDomains 22000 3.50 0.01 4.56 59 RCVD_IN_MSPIKE_H3 21852 4.35 3.77 4.53 60 TR_XM_DK_Bayes2 21619 3.54 0.44 4.48 61 TR_XM_SpammyWords5 20991 4.24 3.88 4.35 62 HTML_IMAGE_RATIO_04 20916 4.52 5.16 4.33 63 XM_H_GMP 20509 4.46 5.17 4.25 64 XM_H_Long_From01 20302 4.53 5.61 4.20 65 XMStrtUSub 20143 4.33 4.86 4.17 66 LOTS_OF_MONEY 20111 6.48 14.17 4.17 67 T_TooManySym_01 19495 3.74 2.73 4.04 68 TR_MAX_INTL_RELAY 18669 6.20 13.94 3.87 69 MAY_BE_FORGED 18413 2.93 0.00 3.81 70 BAYES_05 18054 3.02 0.64 3.74 71 XM_DK_Undo_02 17820 11.54 37.64 3.69 72 RCVD_IN_MSPIKE_H5 17708 3.41 2.54 3.67 73 XM_UncommonTLD01 16273 4.04 6.28 3.37 74 HTML_IMAGE_RATIO_02 16035 4.08 6.61 3.32 75 TM2_M_URI_OPT_OUT 15737 3.19 2.98 3.26 76 MPART_ALT_DIFF 15046 3.72 5.73 3.12 77 RELAYCOUNTRY_META 14790 6.03 15.90 3.06 78 XM_B_SpammyWords3 14585 5.54 13.90 3.02 79 RCVD_IN_IADB_LISTED 14490 2.54 1.01 3.00 80 T_REMOTE_IMAGE 13975 2.58 1.55 2.89 81 RCVD_IN_VALIDITY_SAFE 13851 2.68 2.05 2.87 82 TR_XM_SpammyWords4 13257 4.95 12.27 2.75 83 XMSubMetaSx_00 12691 3.54 6.57 2.63 84 RCVD_IN_IADB_SPF 12535 2.21 0.92 2.60 85 HTML_IMAGE_RATIO_06 12200 2.91 4.19 2.53 86 BAYES_80 11739 3.84 8.53 2.43 87 RCVD_IN_VALIDITY_CERTIFIED 11698 2.24 1.63 2.42 88 BOTNET_IPINHOSTNAME 11537 4.86 13.07 2.39 89 BAYES_99 11257 8.46 28.83 2.33 90 RCVD_IN_IADB_SENDERID 11091 1.97 0.89 2.30 91 RCVD_IN_IADB_DK 10838 1.93 0.90 2.24 92 HTML_MIME_NO_HTML_TAG 10594 2.34 2.82 2.19 93 MAILING_LIST_MULTI 10570 2.18 2.17 2.19 94 TooManyTo_002 10518 1.81 0.60 2.18 95 TM2_M_VERY_LONG_WORD 10349 2.48 3.62 2.14 96 XM_Body_Dirty_Words 10028 3.56 8.51 2.08 97 RCVD_IN_IADB_VOUCHED 9891 1.66 0.37 2.05 98 XM_B_SpammyTLD 9861 2.50 4.03 2.04 99 T_TooManySym_02 9795 1.71 0.65 2.03 100 TR_XM_DKIM_Undo 9338 7.74 27.02 1.93 101 T_XMDrugObfuBody_14 9117 2.42 4.18 1.89 102 HTML_EXTRA_CLOSE 8961 1.45 0.09 1.86 103 BAYES_999 8591 6.46 22.02 1.78 104 DKIM_INVALID 8446 2.50 4.98 1.75 105 MIME_HTML_ONLY_MULTI 8280 2.04 3.11 1.71 106 TR_XM_SpammyRelay 8132 3.79 10.80 1.68 107 HTML_IMAGE_RATIO_08 7897 1.91 2.82 1.64 108 MIME_HTML_MOSTLY 7707 2.16 4.05 1.60 109 INVALID_MSGID 7540 1.25 0.23 1.56 110 TO_EQ_FM_DOM_HTML_IMG 7331 1.17 0.00 1.52 111 XM_B_URI_Unicode 7028 1.81 3.00 1.46 112 TR_Symld_Words 7022 1.36 1.06 1.45 113 BAYES_95 6918 2.29 5.15 1.43 114 RCVD_IN_IADB_OPTIN 6824 1.14 0.25 1.41 115 XM_DK_Undo_01 6744 1.61 2.32 1.40 116 TR_XM_PhishingBody 6463 2.06 4.46 1.34 117 TR_XM_UnparsRelay 6422 3.20 9.41 1.33 118 TO_MALFORMED 6277 1.06 0.25 1.30 119 XM_CamelCaseFrm001 6256 1.73 3.17 1.30 120 URI_NOVOWEL 5903 1.38 1.90 1.22 121 TooManyTo_003 5893 1.05 0.49 1.22 122 BOTNET 5852 3.43 10.81 1.21 123 XM_SendGrid 5789 1.24 1.36 1.20 124 XMDiploma_00 5749 1.62 3.06 1.19 125 FROM_EXCESS_BASE64 5743 1.31 1.71 1.19 126 T_XMDrugObfuBody_08 5687 1.70 3.42 1.18 127 XM_B_Investor 5523 2.00 4.84 1.14 128 T_OBFU_PDF_ATTACH 5498 1.09 0.94 1.14 129 UNTRUSTED_Relay 5053 2.22 6.14 1.05 130 XM_SPF_SoftFail 4905 1.44 2.87 1.02 131 SUBJ_ALL_CAPS 4838 1.36 2.53 1.00 132 XM_B_Unsub2 4697 1.45 3.03 0.97 133 XMCapTrack 4628 0.85 0.49 0.96 134 IN_HORDE_ADDRESS_BOOK 4612 0.76 0.12 0.96 135 XM_GoogleGroups 4530 0.90 0.78 0.94 136 URI_HEX 4498 1.09 1.64 0.93 137 TooManyTo_004 4480 0.81 0.43 0.93 138 XMBody_78 4474 0.99 1.19 0.93 139 HELO_NODOT 4367 0.75 0.24 0.90 140 HELO_NO_DOMAIN 4357 0.75 0.22 0.90 141 XMSexyCombo_05 4350 1.65 4.14 0.90 142 XMGappySubj_01 4325 0.74 0.23 0.90 143 TR_DCC_Bayes_99 4311 5.36 20.19 0.89 144 FROM_GOV_DKIM_AU 4151 0.73 0.32 0.86 145 RELAYCOUNTRY_CA 4090 1.99 5.79 0.85 146 TM2_M_BODY_EMPTY 3976 0.66 0.11 0.82 147 T_TooManySym_03 3939 0.68 0.23 0.82 148 TR_XM_DK_SendGrid 3862 0.81 0.86 0.80 149 RCVD_IN_MSPIKE_H4 3773 0.73 0.58 0.78 150 TVD_SPACE_RATIO 3698 0.62 0.15 0.77 151 TooManyTo_005 3620 0.67 0.39 0.75 152 XMGenDplmaNmb 3566 0.99 1.80 0.74 153 XM_OfRef6 3524 1.53 4.19 0.73 154 MIME_CHARSET_FARAWAY 3518 0.66 0.42 0.73 155 XM_ShortIntro_01 3441 0.66 0.49 0.71 156 DKIM_ADSP_CUSTOM_MED 3431 0.79 1.07 0.71 157 XM_H_Long_From02 3295 0.99 2.02 0.68 158 T_FILL_THIS_FORM_SHORT 3179 1.13 2.71 0.66 159 XM_UB50 3172 1.23 3.13 0.66 160 CHARSET_FARAWAY_HEADER 3121 0.52 0.11 0.65 161 RELAYCOUNTRY_AU 2828 1.04 2.54 0.59 162 RCVD_IN_PBL 2822 0.69 1.04 0.58 163 XMStockSpam_06 2755 0.90 2.00 0.57 164 RCVD_IN_BL_SPAMCOP_NET 2754 2.24 7.77 0.57 165 XMLngstWrd_01 2723 0.52 0.36 0.56 166 TR_MetaPhish_Combo_01 2679 0.64 0.92 0.55 167 SpammyFromTLD_01 2668 0.81 1.65 0.55 168 XMBrknScrpt_02 2654 0.80 1.63 0.55 169 XM_B_COPY_HTML 2608 0.64 0.97 0.54 170 HTTPS_HTTP_MISMATCH 2529 0.73 1.43 0.52 171 MPART_ALT_DIFF_COUNT 2497 0.68 1.20 0.52 172 XM_H_PHPMailer 2484 0.51 0.48 0.51 173 XMNoVowels 2448 0.56 0.72 0.51 174 XM_B_FormFill 2338 0.41 0.16 0.48 175 TVD_RCVD_IP 2336 0.57 0.85 0.48 176 T_Symld_Words_02 2307 0.55 0.78 0.48 177 FORGED_GMAIL_RCVD 2282 0.55 0.82 0.47 178 XMLngstWrd_02 2276 0.43 0.31 0.47 179 XMGappySubj_02 2184 0.36 0.04 0.45 180 XMSlimDrugH 2110 0.49 0.69 0.44 181 T_STY_INVIS_DIRECT 2095 0.50 0.74 0.43 182 XMEmptyBody_01 2053 0.33 0.03 0.43 183 RELAYCOUNTRY_GB 2047 0.54 0.93 0.42 184 XMSubMetaI_00 2004 0.54 0.97 0.42 185 TR_XM_PHPDW 1984 0.57 1.08 0.41 186 T_XMHurry_00 1982 0.76 1.92 0.41 187 TR_XM_Base64_M1 1974 0.51 0.83 0.41 188 XMPhish14 1970 0.55 1.04 0.41 189 TR_XM_SpammyWords2 1969 2.55 9.67 0.41 190 TR_XM_PHPForged 1960 0.56 1.09 0.41 191 TR_XM_FormFill2 1957 0.56 1.07 0.41 192 XM_H_PHPOS 1925 0.55 1.04 0.40 193 NML_ADSP_CUSTOM_MED 1883 0.48 0.77 0.39 194 MSGID_FROM_MTA_HEADER 1872 0.35 0.24 0.39 195 LongTLD 1869 0.57 1.16 0.39 196 XMBody_95 1855 0.35 0.25 0.38 197 TO_NO_BRKTS_HTML_ONLY 1832 0.43 0.58 0.38 198 TM2_M_OBFU_COMMENT 1812 0.45 0.69 0.38 199 GMD_PDF_EMPTY_BODY 1766 0.30 0.10 0.37 200 XMPhish30 1754 0.60 1.40 0.36 ----------------------------------------------------------------------