Email: 722330 Autolearn: 0 AvgScore: 2.96 AvgScanTime: 1.45 sec Spam: 220520 Autolearn: 0 AvgScore: 13.86 AvgScanTime: 1.69 sec Ham: 501810 Autolearn: 0 AvgScore: -1.83 AvgScanTime: 1.34 sec Time Spent Running SA: 290.41 hours Time Spent Processing Spam: 103.82 hours Time Spent Processing Ham: 186.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 213211 84.31 96.69 78.87 2 DKIM_SIGNED 193610 81.45 87.80 78.65 3 XM_DK_Pass 190325 80.28 86.31 77.63 4 DKIM_VALID 186088 78.40 84.39 75.78 5 DCC_CHECK 172795 55.84 78.36 45.95 6 XM_B_Unicode 170512 67.43 77.32 63.08 7 RELAYCOUNTRY_US 169418 82.51 76.83 85.00 8 XMListUnsubscribeExists 158326 53.04 71.80 44.79 9 XM_B_SpammyWords 155958 57.42 70.72 51.57 10 DKIM_VALID_AU 139843 60.99 63.42 59.92 11 XM_DK_Undo_02 113552 21.83 51.49 8.79 12 XM_B_SpammyWords2 95528 25.13 43.32 17.13 13 TR_XM_DKIM_Undo 95491 17.42 43.30 6.05 14 XM_B_Unicode3 92140 38.49 41.78 37.04 15 BAYES_99 84348 16.42 38.25 6.83 16 LOC_TINY_FONT_1 82811 26.48 37.55 21.61 17 BAYES_50 81355 49.52 36.89 55.07 18 HTML_FONT_LOW_CONTRAST 75804 27.76 34.38 24.85 19 RCVD_IN_MSPIKE_H2 69879 27.58 31.69 25.78 20 BAYES_999 69108 13.25 31.34 5.29 21 DKIM_VALID_EF 68439 35.26 31.04 37.12 22 MIME_HTML_ONLY 66773 22.39 30.28 18.92 23 FVGT_m_MULTI_ODD 66093 23.37 29.97 20.47 24 TR_DCC_Bayes_99 65907 11.72 29.89 3.73 25 T_KAM_HTML_FONT_INVALID 57801 19.57 26.21 16.66 26 XMSubLong 55698 19.99 25.26 17.68 27 RCVD_IN_MSPIKE_WL 50406 33.02 22.86 37.48 28 RELAYCOUNTRY_META 47675 9.49 21.62 4.16 29 T_TM2_M_HEADER_IN_MSG 47287 24.11 21.44 25.29 30 DCC_CHECK_NEGATIVE 43619 42.16 19.78 51.99 31 XM_Body_Dirty_Words 42963 13.41 19.48 10.75 32 TR_XM_SpammyWords2 35727 5.54 16.20 0.85 33 LOTS_OF_MONEY 33476 8.66 15.18 5.79 34 XM_B_SpammyWords3 32230 7.30 14.62 4.08 35 XM_Multi_Part_URI 31619 11.75 14.34 10.61 36 BOTNET 30576 5.16 13.87 1.33 37 UNTRUSTED_Relay 30117 5.29 13.66 1.61 38 XM_UncommonTLD01 30087 6.26 13.64 3.01 39 TR_XM_SpammyWords4 29512 6.79 13.38 3.90 40 BOTNET_IPINHOSTNAME 27349 6.43 12.40 3.81 41 RCVD_IN_MSPIKE_H3 27069 14.24 12.28 15.10 42 XM_B_Unsub 26886 9.82 12.19 8.77 43 RCVD_IN_BL_SPAMCOP_NET 26213 4.38 11.89 1.07 44 FSL_BULK_SIG 24808 6.90 11.25 4.99 45 XM_Evil_Numbers_Gen 23797 8.64 10.79 7.70 46 XMSexyCombo_05 21551 5.64 9.77 3.82 47 RCVD_IN_MSPIKE_H4 21361 12.18 9.69 13.27 48 MPART_ALT_DIFF 21256 6.09 9.64 4.53 49 LotsOfNums_01 20834 8.52 9.45 8.11 50 HTML_IMAGE_RATIO_02 20060 7.52 9.10 6.83 51 XM_B_Phish_Phrases 19279 13.28 8.74 15.28 52 MIME_HTML_MOSTLY 19218 4.28 8.71 2.32 53 UNPARSEABLE_RELAY 18609 7.59 8.44 7.21 54 BAYES_60 18309 9.00 8.30 9.31 55 TR_XM_UnparsRelay 18226 6.63 8.27 5.91 56 BAYES_80 17017 7.46 7.72 7.35 57 XM_H_Long_From01 15731 5.56 7.13 4.87 58 RELAYCOUNTRY_CA 15531 2.93 7.04 1.13 59 XM_SendGrid 14834 6.68 6.73 6.66 60 XM_UB50 14074 2.65 6.38 1.01 61 TooManyTo_001 13557 7.10 6.15 7.52 62 XMSubMetaSx_00 13045 4.01 5.92 3.18 63 HTML_IMAGE_RATIO_04 12981 5.13 5.89 4.80 64 SpammyFromTLD_02 12862 1.89 5.83 0.15 65 T_REMOTE_IMAGE 12807 4.26 5.81 3.58 66 TR_XM_PhishingBody 12668 3.43 5.74 2.41 67 XMNumbers 12644 3.51 5.73 2.53 68 URIBL_SBL_A 12357 2.72 5.60 1.45 69 XM_B_SpammyTLD 11141 2.78 5.05 1.78 70 TR_XM_SpammyWords5 11138 2.53 5.05 1.43 71 KHOP_HELO_FCRDNS 10852 2.86 4.92 1.96 72 XM_DK_Undo_01 10835 2.38 4.91 1.27 73 SpammyFromTLD_01 10791 1.95 4.89 0.65 74 XM_OfRef6 10725 2.11 4.86 0.91 75 TM2_M_URI_OPT_OUT 10035 3.08 4.55 2.44 76 RCVD_IN_RP_SAFE 9891 6.48 4.49 7.36 77 HTML_IMAGE_RATIO_06 9798 3.51 4.44 3.10 78 BAYES_95 9645 4.36 4.37 4.36 79 RCVD_IN_MSPIKE_BL 9060 1.32 4.11 0.10 80 BODY_URI_ONLY 8745 1.21 3.97 0.01 81 HTML_SHORT_LINK_IMG_1 8741 1.22 3.96 0.01 82 TR_XM_MSPIKECOMBO 8609 1.26 3.90 0.09 83 HTML_FONT_SIZE_LARGE 8604 1.29 3.90 0.15 84 TR_XM_DK_SendGrid 8536 4.26 3.87 4.43 85 HTML_IMAGE_ONLY_12 8166 1.46 3.70 0.48 86 HTML_IMAGE_RATIO_08 7748 2.61 3.51 2.21 87 T_FILL_THIS_FORM_SHORT 7543 1.56 3.42 0.74 88 DKIM_INVALID 7522 3.04 3.41 2.88 89 URIBL_DBL_SPAM 7426 1.03 3.37 0.01 90 URI_HEX 7353 2.01 3.33 1.42 91 TR_LOTS_OF_MONEY3 7248 1.32 3.29 0.46 92 RCVD_IN_RP_CERTIFIED 7188 5.68 3.26 6.75 93 RCVD_IN_MSPIKE_L5 7157 1.03 3.25 0.05 94 MIME_HTML_ONLY_MULTI 7117 2.83 3.23 2.65 95 XM_SPF_SoftFail 7113 2.17 3.23 1.71 96 TR_XM_MaxBayes 7028 0.99 3.19 0.02 97 XMStrtUSub 6907 11.90 3.13 15.75 98 XMBody_17 6832 1.34 3.10 0.57 99 XMBdyGiftCard01 6750 1.32 3.06 0.55 100 XM_B_Unsub2 6630 1.86 3.01 1.35 101 RELAYCOUNTRY_IN 6614 0.99 3.00 0.11 102 RELAYCOUNTRY_FR 6477 1.05 2.94 0.23 103 RCVD_IN_RP_RNBL 6434 0.91 2.92 0.03 104 XMDiploma_00 6362 1.95 2.88 1.53 105 XM_B_Phish66 6292 1.96 2.85 1.56 106 MIME_QP_LONG_LINE 6265 4.62 2.84 5.40 107 XM_B_COVIDMETA 6084 1.66 2.76 1.18 108 XM_DIRTYINTL 6012 1.09 2.73 0.38 109 T_XMDrugObfuBody_14 5792 2.10 2.63 1.86 110 FORGED_GMAIL_RCVD 5766 1.17 2.61 0.53 111 RCVD_IN_PSBL 5514 0.81 2.50 0.07 112 TR_XM_SpammyWords3 5283 0.76 2.40 0.04 113 BOTNET_NORDNS 5150 0.72 2.34 0.01 114 XM_UB99 5131 0.72 2.33 0.01 115 XMBrknScrpt_02 5020 1.10 2.28 0.58 116 T_XMDrugObfuBody_08 5001 1.59 2.27 1.29 117 XM_UB60 4970 0.76 2.25 0.10 118 XMStockSpam_06 4947 1.47 2.24 1.13 119 XM_B_SpammyWords4 4892 1.09 2.22 0.59 120 TM2_M_VERY_LONG_WORD 4722 1.42 2.14 1.10 121 XM_CamelCaseFrm001 4711 1.91 2.14 1.81 122 URI_NOVOWEL 4609 2.75 2.09 3.04 123 T_TooManySym_01 4594 3.43 2.08 4.02 124 RCVD_IN_IADB_LISTED 4521 4.37 2.05 5.39 125 TR_XM_FormFill 4518 0.65 2.05 0.03 126 FROM_EXCESS_BASE64 4490 2.54 2.04 2.77 127 PDS_OTHER_BAD_TLD 4463 0.93 2.02 0.45 128 URI_PHP_REDIR 4448 0.62 2.02 0.00 129 SUBJ_ALL_CAPS 4311 1.78 1.95 1.70 130 GOOGLE_DOC_SUSP 4291 0.60 1.95 0.01 131 HK_RANDOM_REPLYTO 4215 0.68 1.91 0.13 132 XMSubMetaI_00 4133 0.86 1.87 0.41 133 TR_XM_BayesRelay 4044 0.57 1.83 0.02 134 BAYES_40 3923 3.28 1.78 3.94 135 RCVD_IN_IADB_SPF 3889 3.79 1.76 4.68 136 XM_UB999 3765 0.52 1.71 0.00 137 XMGenDplmaNmb 3687 0.96 1.67 0.65 138 RCVD_IN_IADB_DK 3629 3.28 1.65 4.00 139 XM_OfRef7 3597 0.59 1.63 0.13 140 RCVD_IN_IADB_SENDERID 3596 3.40 1.63 4.17 141 XM_URI_RBL 3281 0.57 1.49 0.16 142 URI_TRY_3LD 3260 1.12 1.48 0.96 143 XMPhish08 3231 0.58 1.47 0.19 144 TR_XM_SB_Phish 3186 1.64 1.44 1.73 145 TR_XM_COVIDMETA4 3146 0.68 1.43 0.36 146 T_XMHurry_00 3055 0.93 1.39 0.73 147 RELAYCOUNTRY_GB 3055 0.99 1.39 0.81 148 XMSubPhish11 3052 1.60 1.38 1.70 149 XM_UB80 3019 0.45 1.37 0.04 150 ANY_BOUNCE_MESSAGE 2974 1.96 1.35 2.23 151 BOUNCE_MESSAGE 2967 1.96 1.35 2.23 152 MAILING_LIST_MULTI 2915 1.90 1.32 2.16 153 ALL_TRUSTED 2882 8.73 1.31 11.99 154 URIBL_BLACK 2875 0.42 1.30 0.03 155 TR_XM_PHPDW 2852 0.60 1.29 0.30 156 T_XMDrugObfuBody_00 2840 0.83 1.29 0.62 157 BAYES_20 2801 2.47 1.27 2.99 158 LOADSA_MONEY_COMBO 2704 0.42 1.23 0.06 159 TR_XM_COVIDMETA1 2685 0.58 1.22 0.29 160 HTML_MIME_NO_HTML_TAG 2675 1.89 1.21 2.19 161 XMSexyCombo_01 2656 0.55 1.20 0.26 162 TR_XM_PHPForged 2642 0.54 1.20 0.25 163 TR_XM_FormFill2 2585 0.53 1.17 0.25 164 TR_Symld_Words 2583 1.51 1.17 1.66 165 XM_H_Long_From02 2582 1.04 1.17 0.99 166 XM_H_PHPOS 2574 0.52 1.17 0.24 167 HTTPS_HTTP_MISMATCH 2506 0.90 1.14 0.79 168 XFER_LOTSA_MONEY 2452 0.37 1.11 0.05 169 NUMERIC_HTTP_ADDR 2438 0.48 1.11 0.21 170 TR_XM_INV_DKIM 2428 0.38 1.10 0.06 171 XM_BadFromFormat 2375 0.42 1.08 0.13 172 RELAYCOUNTRY_DE 2365 0.56 1.07 0.33 173 TO_IN_SUBJ 2355 0.34 1.07 0.02 174 XM_Body_Obfu01 2335 0.49 1.06 0.24 175 PLING_QUERY 2305 0.61 1.05 0.42 176 ADVANCE_FEE_5_NEW_MONEY 2265 0.31 1.03 0.00 177 URI_OPTOUT_3LD 2260 0.34 1.02 0.05 178 XMLngstWrd_00 2239 0.64 1.02 0.48 179 MONEY_FRAUD_8 2232 0.31 1.01 0.00 180 TR_XM_RelayPhish 2210 0.35 1.00 0.06 181 DEAR_BENEFICIARY 2197 0.30 1.00 0.00 182 TR_Caps_n_Bayes_99 2151 0.35 0.98 0.07 183 XMHTML_After_End 2108 0.85 0.96 0.80 184 RCVD_IN_IADB_VOUCHED 2086 2.67 0.95 3.43 185 RELAYCOUNTRY_NL 2063 0.37 0.94 0.13 186 TR_Sbj_FN_Bdy 2061 0.37 0.93 0.12 187 XMBody_78 2052 0.48 0.93 0.29 188 XM_Body_Dirty_Words_01 2049 0.67 0.93 0.55 189 MONEY_FORM_SHORT 2035 0.29 0.92 0.01 190 RDNS_DYNAMIC 2026 0.59 0.92 0.45 191 SUBJ_DOLLARS 1980 0.43 0.90 0.23 192 RCVD_IN_MSPIKE_H5 1976 6.61 0.90 9.12 193 THIS_AD 1967 0.59 0.89 0.45 194 URI_NO_WWW_INFO_CGI 1934 0.28 0.88 0.01 195 XMPhish30 1930 0.45 0.88 0.26 196 XM_UB95 1902 0.28 0.86 0.02 197 XMSubMetaSSx_00 1881 0.36 0.85 0.14 198 XM_PDF 1854 3.23 0.84 4.28 199 XMSubNoVowel 1840 1.10 0.83 1.21 200 DKIM_ADSP_CUSTOM_MED 1808 0.90 0.82 0.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 426541 82.51 76.83 85.00 2 HTML_MESSAGE 395774 84.31 96.69 78.87 3 DKIM_SIGNED 394693 81.45 87.80 78.65 4 XM_DK_Pass 389538 80.28 86.31 77.63 5 DKIM_VALID 380247 78.40 84.39 75.78 6 XM_B_Unicode 316553 67.43 77.32 63.08 7 DKIM_VALID_AU 300677 60.99 63.42 59.92 8 BAYES_50 276332 49.52 36.89 55.07 9 DCC_CHECK_NEGATIVE 260893 42.16 19.78 51.99 10 XM_B_SpammyWords 258783 57.42 70.72 51.57 11 DCC_CHECK 230586 55.84 78.36 45.95 12 XMListUnsubscribeExists 224779 53.04 71.80 44.79 13 RCVD_IN_MSPIKE_WL 188102 33.02 22.86 37.48 14 DKIM_VALID_EF 186287 35.26 31.04 37.12 15 XM_B_Unicode3 185893 38.49 41.78 37.04 16 RCVD_IN_MSPIKE_H2 129355 27.58 31.69 25.78 17 T_TM2_M_HEADER_IN_MSG 126890 24.11 21.44 25.29 18 HTML_FONT_LOW_CONTRAST 124696 27.76 34.38 24.85 19 LOC_TINY_FONT_1 108463 26.48 37.55 21.61 20 FVGT_m_MULTI_ODD 102739 23.37 29.97 20.47 21 XM_DKIMWhitelistDomains 98598 13.67 0.05 19.65 22 MIME_HTML_ONLY 94936 22.39 30.28 18.92 23 XMSubLong 88723 19.99 25.26 17.68 24 XM_B_SpammyWords2 85985 25.13 43.32 17.13 25 T_KAM_HTML_FONT_INVALID 83590 19.57 26.21 16.66 26 XMStrtUSub 79051 11.90 3.13 15.75 27 XM_B_Phish_Phrases 76656 13.28 8.74 15.28 28 RCVD_IN_MSPIKE_H3 75757 14.24 12.28 15.10 29 RCVD_IN_MSPIKE_H4 66592 12.18 9.69 13.27 30 ALL_TRUSTED 60167 8.73 1.31 11.99 31 XM_Body_Dirty_Words 53921 13.41 19.48 10.75 32 XM_Multi_Part_URI 53224 11.75 14.34 10.61 33 BAYES_60 46729 9.00 8.30 9.31 34 RCVD_IN_MSPIKE_H5 45753 6.61 0.90 9.12 35 XM_DK_Undo_02 44128 21.83 51.49 8.79 36 XM_B_Unsub 44017 9.82 12.19 8.77 37 BAYES_00 42100 6.04 0.70 8.39 38 LotsOfNums_01 40707 8.52 9.45 8.11 39 XM_Evil_Numbers_Gen 38628 8.64 10.79 7.70 40 TooManyTo_001 37738 7.10 6.15 7.52 41 RCVD_IN_RP_SAFE 36919 6.48 4.49 7.36 42 BAYES_80 36861 7.46 7.72 7.35 43 UNPARSEABLE_RELAY 36187 7.59 8.44 7.21 44 BAYES_99 34276 16.42 38.25 6.83 45 HTML_IMAGE_RATIO_02 34268 7.52 9.10 6.83 46 RCVD_IN_RP_CERTIFIED 33852 5.68 3.26 6.75 47 XM_SendGrid 33442 6.68 6.73 6.66 48 TR_XM_DK_Bayes 30365 4.37 0.53 6.05 49 TR_XM_DKIM_Undo 30354 17.42 43.30 6.05 50 TR_XM_UnparsRelay 29681 6.63 8.27 5.91 51 TR_XM_DK_Bayes1 29514 4.24 0.52 5.88 52 LOTS_OF_MONEY 29066 8.66 15.18 5.79 53 MIME_QP_LONG_LINE 27116 4.62 2.84 5.40 54 RCVD_IN_IADB_LISTED 27054 4.37 2.05 5.39 55 BAYES_999 26569 13.25 31.34 5.29 56 TR_XM_DK_Bayes2 25752 3.69 0.40 5.13 57 IN_ZIMBRA_NJ_WHITELIST 25178 3.50 0.06 5.02 58 FSL_BULK_SIG 25041 6.90 11.25 4.99 59 XM_H_Long_From01 24449 5.56 7.13 4.87 60 HTML_IMAGE_RATIO_04 24069 5.13 5.89 4.80 61 RCVD_IN_IADB_SPF 23486 3.79 1.76 4.68 62 MPART_ALT_DIFF 22711 6.09 9.64 4.53 63 TR_XM_DK_SendGrid 22229 4.26 3.87 4.43 64 BAYES_95 21874 4.36 4.37 4.36 65 XM_PDF 21473 3.23 0.84 4.28 66 RCVD_IN_IADB_SENDERID 20932 3.40 1.63 4.17 67 RELAYCOUNTRY_META 20878 9.49 21.62 4.16 68 XM_B_SpammyWords3 20467 7.30 14.62 4.08 69 T_TooManySym_01 20169 3.43 2.08 4.02 70 RCVD_IN_IADB_DK 20074 3.28 1.65 4.00 71 BAYES_40 19761 3.28 1.78 3.94 72 TR_XM_SpammyWords4 19568 6.79 13.38 3.90 73 XMSexyCombo_05 19171 5.64 9.77 3.82 74 BOTNET_IPINHOSTNAME 19119 6.43 12.40 3.81 75 TR_DCC_Bayes_99 18717 11.72 29.89 3.73 76 T_REMOTE_IMAGE 17958 4.26 5.81 3.58 77 RCVD_IN_IADB_VOUCHED 17227 2.67 0.95 3.43 78 XMSubMetaSx_00 15954 4.01 5.92 3.18 79 HTML_IMAGE_RATIO_06 15540 3.51 4.44 3.10 80 URI_NOVOWEL 15262 2.75 2.09 3.04 81 XM_UncommonTLD01 15098 6.26 13.64 3.01 82 BAYES_20 15021 2.47 1.27 2.99 83 DKIM_INVALID 14446 3.04 3.41 2.88 84 FROM_EXCESS_BASE64 13877 2.54 2.04 2.77 85 MIME_HTML_ONLY_MULTI 13306 2.83 3.23 2.65 86 XM_H_Trusted_IP 13188 1.83 0.00 2.63 87 XMNumbers 12698 3.51 5.73 2.53 88 TM2_M_URI_OPT_OUT 12235 3.08 4.55 2.44 89 TR_XM_PhishingBody 12091 3.43 5.74 2.41 90 MIME_HTML_MOSTLY 11666 4.28 8.71 2.32 91 RCVD_IN_IADB_OPTIN 11410 1.76 0.61 2.27 92 ANY_BOUNCE_MESSAGE 11200 1.96 1.35 2.23 93 BOUNCE_MESSAGE 11194 1.96 1.35 2.23 94 HTML_IMAGE_RATIO_08 11075 2.61 3.51 2.21 95 HTML_MIME_NO_HTML_TAG 10979 1.89 1.21 2.19 96 MAILING_LIST_MULTI 10836 1.90 1.32 2.16 97 T_TooManySym_02 10540 1.68 0.72 2.10 98 TooManyTo_002 9903 1.56 0.61 1.97 99 KHOP_HELO_FCRDNS 9842 2.86 4.92 1.96 100 T_XMDrugObfuBody_14 9350 2.10 2.63 1.86 101 TVD_RCVD_IP 9119 1.31 0.16 1.82 102 XM_CamelCaseFrm001 9058 1.91 2.14 1.81 103 XM_B_SpammyTLD 8945 2.78 5.05 1.78 104 BAYES_05 8856 1.44 0.71 1.76 105 TR_XM_SB_Phish 8680 1.64 1.44 1.73 106 XM_SPF_SoftFail 8592 2.17 3.23 1.71 107 XMSubPhish11 8527 1.60 1.38 1.70 108 SUBJ_ALL_CAPS 8523 1.78 1.95 1.70 109 TR_Symld_Words 8306 1.51 1.17 1.66 110 UNTRUSTED_Relay 8080 5.29 13.66 1.61 111 XM_B_Phish66 7852 1.96 2.85 1.56 112 HELO_NODOT 7710 1.22 0.50 1.54 113 HELO_NO_DOMAIN 7710 1.21 0.47 1.54 114 XMDiploma_00 7688 1.95 2.88 1.53 115 URIBL_SBL_A 7295 2.72 5.60 1.45 116 IN_HORDE_ADDRESS_BOOK 7246 1.02 0.06 1.44 117 TR_XM_SpammyWords5 7155 2.53 5.05 1.43 118 URI_HEX 7137 2.01 3.33 1.42 119 INVALID_MSGID 7022 1.07 0.32 1.40 120 XM_B_Unsub2 6790 1.86 3.01 1.35 121 TooManyTo_003 6675 1.08 0.50 1.33 122 BOTNET 6667 5.16 13.87 1.33 123 T_XMDrugObfuBody_08 6480 1.59 2.27 1.29 124 MSGID_NOFQDN1 6408 0.90 0.03 1.28 125 XM_DK_Undo_01 6391 2.38 4.91 1.27 126 TO_MALFORMED 6277 0.87 0.02 1.25 127 XMSubNoVowel 6089 1.10 0.83 1.21 128 XM_B_COVIDMETA 5930 1.66 2.76 1.18 129 USER_IN_DEF_DKIM_WL 5874 0.83 0.06 1.17 130 RELAYCOUNTRY_CA 5665 2.93 7.04 1.13 131 XMStockSpam_06 5652 1.47 2.24 1.13 132 TM2_M_VERY_LONG_WORD 5522 1.42 2.14 1.10 133 HELO_MISC_IP 5480 0.78 0.06 1.09 134 RCVD_IN_BL_SPAMCOP_NET 5392 4.38 11.89 1.07 135 XMCapTrack 5246 0.81 0.29 1.05 136 HTML_FONT_FACE_BAD 5157 0.94 0.75 1.03 137 XM_UB50 5090 2.65 6.38 1.01 138 XM_H_Long_From02 4963 1.04 1.17 0.99 139 TooManyTo_004 4962 0.82 0.43 0.99 140 URI_TRY_3LD 4818 1.12 1.48 0.96 141 XM_GoogleGroups 4756 0.78 0.41 0.95 142 DKIM_ADSP_CUSTOM_MED 4706 0.90 0.82 0.94 143 XMBSHREFv2 4644 0.72 0.24 0.93 144 XM_OfRef6 4546 2.11 4.86 0.91 145 TR_XM_SpammyWords2 4261 5.54 16.20 0.85 146 RELAYCOUNTRY_GB 4072 0.99 1.39 0.81 147 XMBody_95 4071 0.60 0.12 0.81 148 TooManyTo_005 4070 0.68 0.38 0.81 149 XMHTML_After_End 4027 0.85 0.96 0.80 150 HTTPS_HTTP_MISMATCH 3973 0.90 1.14 0.79 151 XMGappySubj_01 3839 0.63 0.33 0.77 152 T_FILL_THIS_FORM_SHORT 3696 1.56 3.42 0.74 153 T_XMHurry_00 3662 0.93 1.39 0.73 154 TVD_SPACE_RATIO 3432 0.50 0.08 0.68 155 TR_MSPIKEBAYES00 3416 0.48 0.01 0.68 156 XM_E_Blogspot 3311 0.47 0.05 0.66 157 SpammyFromTLD_01 3286 1.95 4.89 0.65 158 XMGenDplmaNmb 3242 0.96 1.67 0.65 159 T_XMDrugObfuBody_00 3127 0.83 1.29 0.62 160 XM_SPF_Unknown 3095 0.62 0.62 0.62 161 XM_ProductURIs 3048 0.66 0.79 0.61 162 NML_ADSP_CUSTOM_MED 3005 0.62 0.68 0.60 163 MISSING_HEADERS 3003 0.51 0.30 0.60 164 XMHTMLBadTable_001 3001 0.60 0.61 0.60 165 XM_B_SpammyWords4 2957 1.09 2.22 0.59 166 XMBrknScrpt_02 2922 1.10 2.28 0.58 167 XMBody_17 2870 1.34 3.10 0.57 168 XM_H_PHPMailer 2835 0.57 0.58 0.56 169 XM_ShortIntro_01 2809 0.49 0.34 0.56 170 XM_Body_Dirty_Words_01 2783 0.67 0.93 0.55 171 TR_MetaPhish_Combo_01 2782 0.60 0.70 0.55 172 XMBdyGiftCard01 2759 1.32 3.06 0.55 173 T_TooManySym_03 2686 0.48 0.35 0.54 174 FORGED_GMAIL_RCVD 2660 1.17 2.61 0.53 175 HTML_IMAGE_ONLY_20 2610 0.48 0.38 0.52 176 T_Symld_Words_02 2588 0.59 0.75 0.52 177 XMLngstWrd_00 2419 0.64 1.02 0.48 178 XMSubMetaSxObfu_03 2395 0.57 0.77 0.48 179 HTML_IMAGE_ONLY_12 2388 1.46 3.70 0.48 180 T_OBFU_PDF_ATTACH 2382 0.38 0.17 0.47 181 RCVD_IN_SORBS_DUL 2380 0.37 0.14 0.47 182 TR_LOTS_OF_MONEY3 2319 1.32 3.29 0.46 183 XM_H_SpoofStaff4 2319 0.35 0.08 0.46 184 XM_B_REG_HTML 2313 0.42 0.33 0.46 185 THIS_AD 2283 0.59 0.89 0.45 186 SHORT_HELO_AND_INLINE_IMAGE 2282 0.33 0.06 0.45 187 PDS_OTHER_BAD_TLD 2282 0.93 2.02 0.45 188 RDNS_DYNAMIC 2268 0.59 0.92 0.45 189 XMMoneyMeta_00 2239 0.53 0.71 0.45 190 TR_XM_SpoofStaff 2178 0.34 0.12 0.43 191 XMSpoofStaff2 2176 0.33 0.10 0.43 192 TR_XM_PSC1 2173 0.33 0.08 0.43 193 XMLngstWrd_01 2166 0.54 0.78 0.43 194 PLING_QUERY 2124 0.61 1.05 0.42 195 XM_DKIMRevIO 2115 0.29 0.00 0.42 196 TM2_M_BODY_EMPTY 2110 0.44 0.47 0.42 197 XMSubMetaI_00 2060 0.86 1.87 0.41 198 XMNoVowels 2054 0.39 0.36 0.41 199 FROM_GOV_SPOOF 2040 0.31 0.10 0.41 200 MPART_ALT_DIFF_COUNT 2010 0.47 0.63 0.40 ----------------------------------------------------------------------