Email: 467380 Autolearn: 0 AvgScore: 5.30 AvgScanTime: 1.60 sec Spam: 151479 Autolearn: 0 AvgScore: 14.59 AvgScanTime: 1.74 sec Ham: 315901 Autolearn: 0 AvgScore: 0.84 AvgScanTime: 1.54 sec Time Spent Running SA: 208.19 hours Time Spent Processing Spam: 73.24 hours Time Spent Processing Ham: 134.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144800 90.08 95.59 87.43 2 DKIM_SIGNED 138522 83.20 91.45 79.24 3 XM_DK_Pass 130429 80.44 86.10 77.72 4 XM_B_Unicode 129617 76.47 85.57 72.10 5 DKIM_VALID 129244 79.48 85.32 76.68 6 RELAYCOUNTRY_US 123544 82.38 81.56 82.77 7 DCC_CHECK 109406 47.81 72.23 36.10 8 XMListUnsubscribeExists 105428 57.44 69.60 51.60 9 XM_B_SpammyWords 105144 53.29 69.41 45.55 10 DKIM_VALID_AU 100777 64.33 66.53 63.28 11 LOC_TINY_FONT_1 74322 35.97 49.06 29.70 12 XM_B_Unicode3 73584 44.44 48.58 42.45 13 XM_DK_Undo_02 63662 17.55 42.03 5.82 14 XM_B_SpammyWords2 61624 25.94 40.68 18.87 15 BAYES_50 60963 54.31 40.25 61.06 16 HTML_FONT_LOW_CONTRAST 57706 31.25 38.10 27.97 17 FVGT_m_MULTI_ODD 51442 28.66 33.96 26.12 18 DKIM_VALID_EF 47214 31.52 31.17 31.69 19 BAYES_99 46303 12.68 30.57 4.10 20 T_KAM_HTML_FONT_INVALID 45239 25.66 29.86 23.64 21 TR_XM_DKIM_Undo 44769 11.23 29.55 2.45 22 MIME_HTML_ONLY 43884 22.45 28.97 19.33 23 DCC_CHECK_NEGATIVE 39737 51.67 26.23 63.87 24 XMSubLong 36557 24.33 24.13 24.42 25 BAYES_999 35725 9.81 23.58 3.20 26 TR_XM_DK_Unsub 35104 17.35 23.17 14.56 27 XM_Multi_Part_URI 34045 17.45 22.48 15.03 28 T_TM2_M_HEADER_IN_MSG 31820 26.78 21.01 29.55 29 RCVD_IN_MSPIKE_H2 31551 17.90 20.83 16.49 30 TR_DCC_Bayes_99 31250 7.77 20.63 1.61 31 XM_B_Unsub 28611 12.23 18.89 9.03 32 UNPARSEABLE_RELAY 28032 14.09 18.51 11.97 33 TR_XM_BayesUnsub 27248 10.61 17.99 7.08 34 RELAYCOUNTRY_META 25223 7.63 16.65 3.30 35 TR_MAX_INTL_RELAY 23431 9.41 15.47 6.50 36 XM_B_SpammyWords3 22844 8.42 15.08 5.22 37 LOTS_OF_MONEY 22208 9.12 14.66 6.47 38 RCVD_IN_BL_SPAMCOP_NET 20602 5.02 13.60 0.91 39 TR_XM_SpammyWords4 19142 6.66 12.64 3.79 40 TR_XM_SpammyRelay 18769 5.17 12.39 1.71 41 BOTNET_IPINHOSTNAME 17684 6.08 11.67 3.40 42 RCVD_IN_MSPIKE_WL 16153 16.71 10.66 19.60 43 TR_XM_UnparsRelay 15298 4.53 10.10 1.86 44 TR_XM_SpammyWords2 15185 3.68 10.02 0.63 45 BOTNET 14587 3.98 9.63 1.27 46 BAYES_80 14335 5.81 9.46 4.06 47 XM_Evil_Numbers_Gen 14281 8.35 9.43 7.83 48 XM_B_Phish_Phrases 13648 6.38 9.01 5.12 49 FSL_BULK_SIG 13227 5.57 8.73 4.05 50 BAYES_60 12728 7.82 8.40 7.55 51 TR_XM_SPAMCOP 10761 2.49 7.10 0.28 52 RCVD_IN_MSPIKE_BL 10350 2.97 6.83 1.12 53 TR_XM_MSPIKECOMBO 10346 2.97 6.83 1.12 54 RELAYCOUNTRY_CA 10233 2.59 6.76 0.59 55 MPART_ALT_DIFF 9740 5.80 6.43 5.50 56 UNTRUSTED_Relay 9538 3.12 6.30 1.60 57 DKIM_INVALID 9278 3.72 6.12 2.57 58 HTML_IMAGE_RATIO_02 9220 5.09 6.09 4.61 59 XM_B_PhoneNumber 9111 8.54 6.01 9.76 60 XMSubMetaSx_00 9071 3.97 5.99 3.00 61 LotsOfNums_01 8942 7.35 5.90 8.05 62 BAYES_95 8553 3.48 5.65 2.44 63 XM_UncommonTLD01 8490 4.73 5.60 4.30 64 XM_Body_Dirty_Words 8440 3.84 5.57 3.01 65 XM_H_GMP 8295 5.69 5.48 5.79 66 RCVD_IN_MSPIKE_H3 8257 7.90 5.45 9.07 67 XM_OfRef6 7889 2.26 5.21 0.85 68 XM_H_Long_From01 7729 5.64 5.10 5.90 69 TR_XM_SpammyWords3 7328 1.94 4.84 0.55 70 HTML_IMAGE_RATIO_04 7149 4.32 4.72 4.13 71 TR_XM_PhishingBody 7078 2.65 4.67 1.69 72 RCVD_IN_MSPIKE_L3 7050 2.21 4.65 1.03 73 XM_B_Investor 6917 2.76 4.57 1.90 74 T_XMDrugObfuBody_14 6779 2.82 4.48 2.03 75 TooManyTo_001 6260 6.60 4.13 7.78 76 XMDiploma_00 6020 2.49 3.97 1.77 77 XM_B_SpammyTLD 5944 3.26 3.92 2.95 78 XMSexyCombo_05 5825 1.79 3.85 0.81 79 XMStrtUSub 5763 5.18 3.80 5.85 80 TR_XM_SpammyWords5 5418 2.06 3.58 1.33 81 MIME_HTML_MOSTLY 5416 3.26 3.58 3.11 82 XMNumbers 5264 3.37 3.48 3.33 83 XM_URI_RBL 5205 1.29 3.44 0.26 84 TM2_M_VERY_LONG_WORD 5094 1.92 3.36 1.22 85 MIME_QP_LONG_LINE 5045 5.06 3.33 5.88 86 HTML_IMAGE_RATIO_08 4880 2.73 3.22 2.50 87 XM_B_URI_Unicode 4766 2.57 3.15 2.30 88 HTML_IMAGE_RATIO_06 4684 3.57 3.09 3.79 89 XM_B_Unsub2 4617 1.94 3.05 1.41 90 MIME_HTML_ONLY_MULTI 4351 2.76 2.87 2.71 91 TR_XM_INV_DKIM 4282 0.96 2.83 0.06 92 T_XMHurry_00 4245 1.34 2.80 0.65 93 TM2_M_URI_OPT_OUT 4217 2.21 2.78 1.93 94 RELAYCOUNTRY_AU 4168 1.24 2.75 0.52 95 XM_UB50 4154 1.63 2.74 1.10 96 RCVD_IN_MSPIKE_H4 4098 3.67 2.71 4.13 97 XM_SPF_SoftFail 4075 1.71 2.69 1.24 98 TR_LOTS_OF_MONEY3 4047 1.21 2.67 0.51 99 XM_CamelCaseFrm001 3995 2.30 2.64 2.14 100 T_XMDrugObfuBody_08 3988 1.96 2.63 1.64 101 XM_B_SpammyWords4 3920 1.21 2.59 0.54 102 TR_XM_NoHeaderRelay 3827 0.95 2.53 0.20 103 RCVD_IN_MSPIKE_H5 3798 5.14 2.51 6.41 104 MAILING_LIST_MULTI 3782 2.90 2.50 3.09 105 TR_XM_MSPIKECOMBO2 3746 0.84 2.47 0.06 106 XMGenDplmaNmb 3722 1.48 2.46 1.01 107 USER_IN_DEF_DKIM_WL 3715 9.97 2.45 13.58 108 T_TooManySym_01 3665 5.04 2.42 6.29 109 T_FILL_THIS_FORM_SHORT 3662 1.46 2.42 1.00 110 RCVD_IN_VALIDITY_SAFE 3516 3.38 2.32 3.89 111 XMBody_17 3428 1.03 2.26 0.44 112 SpammyFromTLD_02 3084 1.03 2.04 0.55 113 XMStockSpam_06 3069 1.26 2.03 0.89 114 SUBJ_ALL_CAPS 3063 1.65 2.02 1.47 115 RCVD_IN_VALIDITY_RPBL 3035 0.67 2.00 0.03 116 XM_H_Long_From02 3026 1.19 2.00 0.81 117 TR_XM_MaxSPIKE 2940 0.67 1.94 0.06 118 T_XMDrugObfuBody_00 2930 1.23 1.93 0.89 119 XMBrknScrpt_02 2922 1.19 1.93 0.83 120 FROM_EXCESS_BASE64 2912 1.63 1.92 1.48 121 RCVD_IN_VALIDITY_CERTIFIED 2789 2.96 1.84 3.50 122 BAYES_40 2726 4.07 1.80 5.16 123 XM_OfRef7 2695 0.70 1.78 0.19 124 HTML_FONT_TINY_NORDNS 2653 0.64 1.75 0.11 125 HTML_MIME_NO_HTML_TAG 2606 2.38 1.72 2.69 126 XMPhish30 2560 0.91 1.69 0.54 127 URI_HEX 2542 1.44 1.68 1.32 128 URI_TRY_3LD 2511 0.88 1.66 0.50 129 DKIM_ADSP_NXDOMAIN 2499 0.74 1.65 0.30 130 RCVD_IN_IADB_LISTED 2488 3.07 1.64 3.76 131 XM_DK_Undo_01 2405 1.66 1.59 1.69 132 XM_ProductURIs 2371 0.86 1.57 0.52 133 XM_SendGrid 2364 1.63 1.56 1.66 134 SpammyFromTLD_01 2336 1.05 1.54 0.82 135 T_REMOTE_IMAGE 2312 2.89 1.53 3.55 136 SHORTCIRCUIT 2306 0.49 1.52 0.00 137 RCVD_IN_ZEN_LASTEXTERNAL 2306 0.49 1.52 0.00 138 RCVD_IN_MSPIKE_L4 2301 0.54 1.52 0.08 139 TR_XM_INTL_Spamhaus 2261 0.60 1.49 0.17 140 XM_HighProb1 2176 0.47 1.44 0.00 141 KHOP_HELO_FCRDNS 2135 1.25 1.41 1.17 142 DIET_1 2104 0.63 1.39 0.26 143 RCVD_IN_IADB_SPF 2066 2.70 1.36 3.33 144 ALL_TRUSTED 2028 10.09 1.34 14.29 145 RCVD_IN_PSBL 2004 0.69 1.32 0.38 146 HTTPS_HTTP_MISMATCH 1999 0.88 1.32 0.67 147 MPART_ALT_DIFF_COUNT 1969 0.85 1.30 0.63 148 RCVD_IN_SBL_CSS 1962 0.45 1.30 0.05 149 XM_B_Phish66 1941 0.69 1.28 0.41 150 BAYES_20 1915 2.93 1.26 3.73 151 RCVD_IN_XBL 1913 0.43 1.26 0.03 152 RCVD_IN_IADB_DK 1890 2.36 1.25 2.89 153 URI_NOVOWEL 1888 1.36 1.25 1.41 154 RCVD_IN_IADB_SENDERID 1838 2.41 1.21 2.98 155 XMBdyGiftCard01 1827 0.63 1.21 0.36 156 XM_B_DNDMA 1781 0.80 1.18 0.62 157 STY_INVIS_DIRECT 1777 0.59 1.17 0.30 158 XMPhish14 1777 0.68 1.17 0.45 159 XM_B_SEO 1763 0.52 1.16 0.20 160 RDNS_DYNAMIC 1753 0.47 1.16 0.15 161 XM_GoogleGroups 1753 1.34 1.16 1.43 162 RCVD_IN_PBL 1686 0.83 1.11 0.69 163 HTML_IMAGE_ONLY_20 1667 0.73 1.10 0.55 164 RELAYCOUNTRY_FR 1658 0.55 1.09 0.29 165 TM2_M_OBFU_COMMENT 1647 0.54 1.09 0.28 166 BOTNET_NORDNS 1642 0.36 1.08 0.02 167 SHOPIFY_IMG_NOT_RCVD_SFY 1602 0.51 1.06 0.25 168 XM_B_COPY_HTML 1593 0.94 1.05 0.89 169 TR_Mismatch_TLD_01 1588 0.54 1.05 0.29 170 THIS_AD 1584 0.71 1.05 0.54 171 TR_XM_SEO4 1555 0.39 1.03 0.09 172 TR_XM_Base64_M1 1540 0.67 1.02 0.51 173 RCVD_IN_IADB_VOUCHED 1508 1.97 1.00 2.43 174 TR_XM_GMP_BULK_SIG 1490 0.41 0.98 0.14 175 TR_XM_DK_SendGrid 1481 1.02 0.98 1.04 176 TVD_RCVD_IP 1478 1.11 0.98 1.18 177 TR_LOTS_OF_MONEY2 1478 0.48 0.98 0.24 178 T_MONEY_PERCENT 1478 0.48 0.98 0.24 179 XM_UB99 1477 0.32 0.98 0.00 180 XMSubMetaI_00 1456 0.65 0.96 0.50 181 XM_UB60 1445 0.37 0.95 0.09 182 TM2_M_A_HREF_HREF 1416 0.51 0.93 0.31 183 DKIM_ADSP_CUSTOM_MED 1414 0.91 0.93 0.90 184 TR_XM_RelayPhish 1413 0.35 0.93 0.08 185 NO_DNS_FOR_FROM 1410 0.47 0.93 0.24 186 XM_B_COVIDMETA 1407 0.39 0.93 0.14 187 TR_XM_MaxWHORU 1387 0.43 0.92 0.20 188 RELAYCOUNTRY_GB 1376 0.75 0.91 0.67 189 MultiRelay_CC 1362 0.39 0.90 0.15 190 HTML_TAG_BALANCE_BODY 1350 0.73 0.89 0.65 191 XMSlimDrugH 1345 0.74 0.89 0.66 192 XMReplyNow 1338 0.45 0.88 0.25 193 LongTLD 1334 0.66 0.88 0.55 194 T_Symld_Words_02 1306 0.82 0.86 0.80 195 HELO_DYNAMIC_SPLIT_IP 1295 0.28 0.85 0.01 196 XMHTML_After_End 1277 0.56 0.84 0.43 197 TR_BOTNET_NEGATE 1267 0.38 0.84 0.16 198 XMBody_78 1254 0.56 0.83 0.43 199 FONT_INVIS_LONG_LINE 1248 0.30 0.82 0.04 200 XMCapTrack 1214 0.98 0.80 1.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276206 90.08 95.59 87.43 2 RELAYCOUNTRY_US 261487 82.38 81.56 82.77 3 DKIM_SIGNED 250326 83.20 91.45 79.24 4 XM_DK_Pass 245520 80.44 86.10 77.72 5 DKIM_VALID 242222 79.48 85.32 76.68 6 XM_B_Unicode 227779 76.47 85.57 72.10 7 DCC_CHECK_NEGATIVE 201757 51.67 26.23 63.87 8 DKIM_VALID_AU 199888 64.33 66.53 63.28 9 BAYES_50 192888 54.31 40.25 61.06 10 XMListUnsubscribeExists 163015 57.44 69.60 51.60 11 XM_B_SpammyWords 143903 53.29 69.41 45.55 12 XM_B_Unicode3 134113 44.44 48.58 42.45 13 DCC_CHECK 114044 47.81 72.23 36.10 14 DKIM_VALID_EF 100123 31.52 31.17 31.69 15 LOC_TINY_FONT_1 93809 35.97 49.06 29.70 16 T_TM2_M_HEADER_IN_MSG 93363 26.78 21.01 29.55 17 HTML_FONT_LOW_CONTRAST 88357 31.25 38.10 27.97 18 FVGT_m_MULTI_ODD 82529 28.66 33.96 26.12 19 XMSubLong 77145 24.33 24.13 24.42 20 T_KAM_HTML_FONT_INVALID 74690 25.66 29.86 23.64 21 RCVD_IN_MSPIKE_WL 61929 16.71 10.66 19.60 22 MIME_HTML_ONLY 61059 22.45 28.97 19.33 23 XM_B_SpammyWords2 59604 25.94 40.68 18.87 24 RCVD_IN_MSPIKE_H2 52087 17.90 20.83 16.49 25 XM_Multi_Part_URI 47490 17.45 22.48 15.03 26 TR_XM_DK_Unsub 45996 17.35 23.17 14.56 27 ALL_TRUSTED 45142 10.09 1.34 14.29 28 USER_IN_DEF_DKIM_WL 42898 9.97 2.45 13.58 29 UNPARSEABLE_RELAY 37814 14.09 18.51 11.97 30 XM_B_PhoneNumber 30820 8.54 6.01 9.76 31 BAYES_00 30427 6.67 0.50 9.63 32 RCVD_IN_MSPIKE_H3 28657 7.90 5.45 9.07 33 XM_B_Unsub 28539 12.23 18.89 9.03 34 LotsOfNums_01 25429 7.35 5.90 8.05 35 XM_Evil_Numbers_Gen 24745 8.35 9.43 7.83 36 TooManyTo_001 24569 6.60 4.13 7.78 37 BAYES_60 23844 7.82 8.40 7.55 38 TR_XM_BayesUnsub 22354 10.61 17.99 7.08 39 XM_DKIMWhitelistDomains 22223 4.79 0.09 7.03 40 TR_XM_DK_Bayes 21712 4.76 0.35 6.87 41 TR_XM_DK_Bayes1 21399 4.69 0.34 6.77 42 TR_MAX_INTL_RELAY 20538 9.41 15.47 6.50 43 LOTS_OF_MONEY 20437 9.12 14.66 6.47 44 RCVD_IN_MSPIKE_H5 20236 5.14 2.51 6.41 45 T_TooManySym_01 19875 5.04 2.42 6.29 46 TR_XM_DK_Bayes2 18855 4.13 0.30 5.97 47 XM_H_Long_From01 18627 5.64 5.10 5.90 48 MIME_QP_LONG_LINE 18586 5.06 3.33 5.88 49 XMStrtUSub 18466 5.18 3.80 5.85 50 XM_DK_Undo_02 18380 17.55 42.03 5.82 51 XM_H_GMP 18294 5.69 5.48 5.79 52 MPART_ALT_DIFF 17363 5.80 6.43 5.50 53 XM_B_SpammyWords3 16489 8.42 15.08 5.22 54 BAYES_40 16306 4.07 1.80 5.16 55 XM_B_Phish_Phrases 16178 6.38 9.01 5.12 56 HTML_IMAGE_RATIO_02 14571 5.09 6.09 4.61 57 XM_PDF 13980 3.21 0.69 4.43 58 XM_UncommonTLD01 13599 4.73 5.60 4.30 59 HTML_IMAGE_RATIO_04 13048 4.32 4.72 4.13 60 RCVD_IN_MSPIKE_H4 13036 3.67 2.71 4.13 61 BAYES_99 12941 12.68 30.57 4.10 62 BAYES_80 12810 5.81 9.46 4.06 63 FSL_BULK_SIG 12798 5.57 8.73 4.05 64 RCVD_IN_VALIDITY_SAFE 12295 3.38 2.32 3.89 65 HTML_IMAGE_RATIO_06 11982 3.57 3.09 3.79 66 TR_XM_SpammyWords4 11968 6.66 12.64 3.79 67 RCVD_IN_IADB_LISTED 11863 3.07 1.64 3.76 68 BAYES_20 11779 2.93 1.26 3.73 69 T_REMOTE_IMAGE 11203 2.89 1.53 3.55 70 RCVD_IN_VALIDITY_CERTIFIED 11066 2.96 1.84 3.50 71 BOTNET_IPINHOSTNAME 10739 6.08 11.67 3.40 72 RCVD_IN_IADB_SPF 10531 2.70 1.36 3.33 73 XMNumbers 10505 3.37 3.48 3.33 74 RELAYCOUNTRY_META 10439 7.63 16.65 3.30 75 BAYES_999 10112 9.81 23.58 3.20 76 MIME_HTML_MOSTLY 9836 3.26 3.58 3.11 77 ANY_BOUNCE_MESSAGE 9775 2.32 0.71 3.09 78 BOUNCE_MESSAGE 9772 2.32 0.71 3.09 79 MAILING_LIST_MULTI 9771 2.90 2.50 3.09 80 T_TooManySym_02 9577 2.29 0.74 3.03 81 XM_Body_Dirty_Words 9511 3.84 5.57 3.01 82 XMSubMetaSx_00 9477 3.97 5.99 3.00 83 RCVD_IN_IADB_SENDERID 9427 2.41 1.21 2.98 84 XM_B_SpammyTLD 9313 3.26 3.92 2.95 85 RCVD_IN_IADB_DK 9144 2.36 1.25 2.89 86 MIME_HTML_ONLY_MULTI 8546 2.76 2.87 2.71 87 HTML_MIME_NO_HTML_TAG 8506 2.38 1.72 2.69 88 DKIM_INVALID 8104 3.72 6.12 2.57 89 HTML_IMAGE_RATIO_08 7901 2.73 3.22 2.50 90 TooManyTo_002 7866 1.86 0.56 2.49 91 TR_XM_DKIM_Undo 7731 11.23 29.55 2.45 92 BAYES_95 7723 3.48 5.65 2.44 93 RCVD_IN_IADB_VOUCHED 7680 1.97 1.00 2.43 94 XM_B_URI_Unicode 7256 2.57 3.15 2.30 95 BAYES_05 7179 1.73 0.59 2.27 96 INVALID_MSGID 7129 1.65 0.38 2.26 97 XM_CamelCaseFrm001 6773 2.30 2.64 2.14 98 MSGID_NOFQDN1 6472 1.42 0.12 2.05 99 T_XMDrugObfuBody_14 6417 2.82 4.48 2.03 100 TO_MALFORMED 6334 1.36 0.00 2.01 101 TM2_M_URI_OPT_OUT 6102 2.21 2.78 1.93 102 XM_B_Investor 5999 2.76 4.57 1.90 103 TR_XM_UnparsRelay 5883 4.53 10.10 1.86 104 XMDiploma_00 5596 2.49 3.97 1.77 105 RCVD_IN_IADB_OPTIN 5427 1.37 0.66 1.72 106 TR_XM_SpammyRelay 5390 5.17 12.39 1.71 107 XM_DK_Undo_01 5331 1.66 1.59 1.69 108 TR_XM_PhishingBody 5323 2.65 4.67 1.69 109 XM_SendGrid 5251 1.63 1.56 1.66 110 T_XMDrugObfuBody_08 5192 1.96 2.63 1.64 111 TooManyTo_003 5127 1.25 0.48 1.62 112 TR_DCC_Bayes_99 5086 7.77 20.63 1.61 113 UNTRUSTED_Relay 5047 3.12 6.30 1.60 114 TR_Symld_Words 4941 1.32 0.80 1.56 115 FROM_EXCESS_BASE64 4683 1.63 1.92 1.48 116 SUBJ_ALL_CAPS 4656 1.65 2.02 1.47 117 XM_GoogleGroups 4514 1.34 1.16 1.43 118 URI_NOVOWEL 4458 1.36 1.25 1.41 119 XM_B_Unsub2 4455 1.94 3.05 1.41 120 TR_XM_SpammyWords5 4193 2.06 3.58 1.33 121 URI_HEX 4178 1.44 1.68 1.32 122 IN_HORDE_ADDRESS_BOOK 4123 0.91 0.08 1.31 123 HELO_NODOT 4034 0.90 0.10 1.28 124 HELO_NO_DOMAIN 4025 0.89 0.09 1.27 125 BOTNET 4001 3.98 9.63 1.27 126 T_TooManySym_03 3958 0.93 0.27 1.25 127 XMGappySubj_01 3935 0.89 0.15 1.25 128 XM_SPF_SoftFail 3929 1.71 2.69 1.24 129 TM2_M_VERY_LONG_WORD 3858 1.92 3.36 1.22 130 TooManyTo_004 3800 0.95 0.41 1.20 131 TVD_RCVD_IP 3723 1.11 0.98 1.18 132 KHOP_HELO_FCRDNS 3703 1.25 1.41 1.17 133 RCVD_IN_MSPIKE_BL 3540 2.97 6.83 1.12 134 TR_XM_MSPIKECOMBO 3535 2.97 6.83 1.12 135 XM_UB50 3476 1.63 2.74 1.10 136 XMCapTrack 3386 0.98 0.80 1.07 137 XM_ShortIntro_01 3314 0.89 0.55 1.05 138 TR_XM_DK_SendGrid 3276 1.02 0.98 1.04 139 RCVD_IN_MSPIKE_L3 3262 2.21 4.65 1.03 140 XMGenDplmaNmb 3190 1.48 2.46 1.01 141 T_FILL_THIS_FORM_SHORT 3159 1.46 2.42 1.00 142 FROM_GOV_DKIM_AU 3077 0.72 0.20 0.97 143 TooManyTo_005 2999 0.75 0.35 0.95 144 TVD_SPACE_RATIO 2885 0.68 0.19 0.91 145 RCVD_IN_BL_SPAMCOP_NET 2865 5.02 13.60 0.91 146 DKIM_ADSP_CUSTOM_MED 2846 0.91 0.93 0.90 147 XM_B_COPY_HTML 2813 0.94 1.05 0.89 148 T_XMDrugObfuBody_00 2804 1.23 1.93 0.89 149 XMStockSpam_06 2797 1.26 2.03 0.89 150 XM_OfRef6 2693 2.26 5.21 0.85 151 XMBrknScrpt_02 2621 1.19 1.93 0.83 152 SpammyFromTLD_01 2587 1.05 1.54 0.82 153 XMSexyCombo_05 2549 1.79 3.85 0.81 154 XM_H_Long_From02 2546 1.19 2.00 0.81 155 T_Symld_Words_02 2513 0.82 0.86 0.80 156 XMBSHREFv2 2434 0.62 0.30 0.77 157 XMNoVowels 2274 0.65 0.49 0.72 158 XM_H_PHPMailer 2272 0.72 0.73 0.72 159 RCVD_IN_PBL 2195 0.83 1.11 0.69 160 HTTPS_HTTP_MISMATCH 2128 0.88 1.32 0.67 161 RELAYCOUNTRY_GB 2125 0.75 0.91 0.67 162 TR_MetaPhish_Combo_01 2113 0.71 0.79 0.67 163 XMSlimDrugH 2091 0.74 0.89 0.66 164 HTML_TAG_BALANCE_BODY 2064 0.73 0.89 0.65 165 T_XMHurry_00 2039 1.34 2.80 0.65 166 TR_XM_SpammyWords2 2003 3.68 10.02 0.63 167 MPART_ALT_DIFF_COUNT 1993 0.85 1.30 0.63 168 XM_B_DNDMA 1973 0.80 1.18 0.62 169 MSGID_FROM_MTA_HEADER 1909 0.47 0.20 0.60 170 RELAYCOUNTRY_CA 1852 2.59 6.76 0.59 171 XMMoneyMeta_00 1842 0.64 0.76 0.58 172 NML_ADSP_CUSTOM_MED 1816 0.64 0.79 0.57 173 T_OBFU_PDF_ATTACH 1816 0.42 0.11 0.57 174 FORGED_GMAIL_RCVD 1807 0.60 0.66 0.57 175 XMGappySubj_02 1755 0.39 0.03 0.56 176 TR_XM_SpammyWords3 1747 1.94 4.84 0.55 177 LongTLD 1743 0.66 0.88 0.55 178 SpammyFromTLD_02 1741 1.03 2.04 0.55 179 TO_NO_BRKTS_HTML_ONLY 1740 0.53 0.49 0.55 180 HTML_IMAGE_ONLY_20 1736 0.73 1.10 0.55 181 THIS_AD 1716 0.71 1.05 0.54 182 XMPhish30 1713 0.91 1.69 0.54 183 XM_B_SpammyWords4 1713 1.21 2.59 0.54 184 XM_ProductURIs 1654 0.86 1.57 0.52 185 XMBody_95 1649 0.40 0.15 0.52 186 RELAYCOUNTRY_AU 1635 1.24 2.75 0.52 187 XMLngstWrd_00 1616 0.46 0.36 0.51 188 TR_LOTS_OF_MONEY3 1616 1.21 2.67 0.51 189 TR_XM_Base64_M1 1606 0.67 1.02 0.51 190 URI_TRY_3LD 1592 0.88 1.66 0.50 191 XMSubMetaI_00 1592 0.65 0.96 0.50 192 TR_XM_GMP_MSPIKE_UNDO2 1460 0.37 0.17 0.46 193 T_TVD_MIME_NO_HEADERS 1443 0.32 0.04 0.46 194 HTML_FONT_FACE_BAD 1425 0.48 0.54 0.45 195 XMPhish14 1420 0.68 1.17 0.45 196 XMBody_17 1395 1.03 2.26 0.44 197 HTML_IMAGE_ONLY_32 1394 0.34 0.12 0.44 198 XMBody_78 1362 0.56 0.83 0.43 199 XMHTML_After_End 1355 0.56 0.84 0.43 200 XM_B_Phish66 1296 0.69 1.28 0.41 ----------------------------------------------------------------------