Email: 500362 Autolearn: 0 AvgScore: 2.70 AvgScanTime: 1.22 sec Spam: 137666 Autolearn: 0 AvgScore: 14.99 AvgScanTime: 1.37 sec Ham: 362696 Autolearn: 0 AvgScore: -1.97 AvgScanTime: 1.16 sec Time Spent Running SA: 169.14 hours Time Spent Processing Spam: 52.20 hours Time Spent Processing Ham: 116.94 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 128521 89.22 93.36 87.65 2 DKIM_SIGNED 116144 73.46 84.37 69.32 3 XM_DK_Pass 113294 71.99 82.30 68.08 4 DKIM_VALID 112769 71.23 81.91 67.17 5 RELAYCOUNTRY_US 108351 81.20 78.71 82.14 6 XM_B_Unicode 108269 73.24 78.65 71.19 7 DCC_CHECK 97068 41.42 70.51 30.38 8 XM_B_SpammyWords 90342 50.16 65.62 44.29 9 XMListUnsubscribeExists 89633 49.68 65.11 43.82 10 DKIM_VALID_AU 84879 54.89 61.66 52.33 11 XM_B_Unicode3 62005 44.44 45.04 44.22 12 XM_DK_Undo_02 61182 17.56 44.44 7.36 13 BAYES_50 55396 49.56 40.24 53.10 14 XM_B_SpammyWords2 51194 22.82 37.19 17.37 15 LOC_TINY_FONT_1 49951 26.20 36.28 22.38 16 TR_XM_DKIM_Undo 47835 13.42 34.75 5.33 17 MIME_HTML_ONLY 46238 23.83 33.59 20.13 18 HTML_FONT_LOW_CONTRAST 46211 28.54 33.57 26.63 19 FVGT_m_MULTI_ODD 45955 26.17 33.38 23.43 20 BAYES_99 45872 13.62 33.32 6.14 21 DKIM_VALID_EF 40601 28.05 29.49 27.51 22 DCC_CHECK_NEGATIVE 40553 58.53 29.46 69.57 23 BAYES_999 36101 10.89 26.22 5.07 24 RCVD_IN_MSPIKE_H2 35668 21.60 25.91 19.97 25 XMSubLong 34815 21.90 25.29 20.61 26 T_KAM_HTML_FONT_INVALID 34386 19.20 24.98 17.01 27 TR_DCC_Bayes_99 33147 8.47 24.08 2.54 28 RELAYCOUNTRY_META 31430 8.90 22.83 3.62 29 T_TM2_M_HEADER_IN_MSG 30806 31.38 22.38 34.80 30 XM_Body_Dirty_Words 30527 14.14 22.17 11.09 31 RCVD_IN_MSPIKE_WL 28489 26.34 20.69 28.48 32 FSL_BULK_SIG 22877 6.50 16.62 2.66 33 XM_Multi_Part_URI 22559 13.20 16.39 11.99 34 BOTNET_IPINHOSTNAME 21669 7.48 15.74 4.35 35 LOTS_OF_MONEY 20807 11.54 15.11 10.18 36 XM_B_Unsub 20139 11.18 14.63 9.87 37 RCVD_IN_MSPIKE_H3 19237 15.09 13.97 15.52 38 BOTNET 19181 4.86 13.93 1.41 39 UNTRUSTED_Relay 19106 4.74 13.88 1.27 40 TR_XM_SpammyWords4 18154 7.59 13.19 5.46 41 UNPARSEABLE_RELAY 17695 9.02 12.85 7.57 42 TR_XM_UnparsRelay 17239 7.73 12.52 5.91 43 RCVD_IN_BL_SPAMCOP_NET 16854 3.85 12.24 0.67 44 XM_B_SpammyWords3 16360 5.84 11.88 3.55 45 TR_XM_SpammyWords2 15631 4.10 11.35 1.35 46 XMSexyCombo_05 15001 5.61 10.90 3.60 47 TR_XM_SpammyRelay 14755 4.00 10.72 1.46 48 XM_Evil_Numbers_Gen 14584 8.78 10.59 8.10 49 XM_UncommonTLD01 14288 5.25 10.38 3.30 50 BAYES_80 11756 5.37 8.54 4.16 51 XM_SendGrid 11473 6.44 8.33 5.72 52 RCVD_IN_MSPIKE_BL 10922 2.84 7.93 0.90 53 TR_XM_MSPIKECOMBO 10808 2.81 7.85 0.90 54 HTML_IMAGE_RATIO_02 10752 6.55 7.81 6.08 55 XMSubMetaSx_00 10443 4.85 7.59 3.81 56 MPART_ALT_DIFF 10407 5.91 7.56 5.29 57 BAYES_60 10176 8.64 7.39 9.11 58 XM_B_Phish_Phrases 10174 4.44 7.39 3.32 59 TR_XM_MaxUnsub 9849 3.36 7.15 1.92 60 LotsOfNums_01 9656 7.96 7.01 8.32 61 TR_XM_PhishingBody 8812 4.06 6.40 3.17 62 RCVD_IN_MSPIKE_H4 8808 9.68 6.40 10.93 63 HTML_IMAGE_RATIO_04 8032 5.48 5.83 5.35 64 RCVD_IN_VALIDITY_RPBL 7974 1.61 5.79 0.02 65 HTML_MIME_NO_HTML_TAG 7847 3.70 5.70 2.94 66 XM_H_Long_From01 7726 5.19 5.61 5.03 67 XM_UB50 7502 2.08 5.45 0.80 68 TM2_M_VERY_LONG_WORD 7341 2.64 5.33 1.62 69 XM_B_SpammyTLD 7020 2.97 5.10 2.17 70 RELAYCOUNTRY_CA 7018 2.02 5.10 0.86 71 TooManyTo_001 6915 7.28 5.02 8.13 72 MIME_HTML_ONLY_MULTI 6772 3.96 4.92 3.60 73 TR_XM_SPAMCOP 6766 1.53 4.91 0.24 74 TR_XM_DK_SendGrid 6617 4.07 4.81 3.79 75 XMNumbers 6613 3.98 4.80 3.67 76 XM_B_Investor 6550 2.41 4.76 1.52 77 T_REMOTE_IMAGE 6524 3.84 4.74 3.50 78 BAYES_95 6458 3.16 4.69 2.57 79 XM_SPF_SoftFail 6196 6.55 4.50 7.32 80 TR_XM_SpammyWords5 5992 2.54 4.35 1.85 81 TR_XM_SpammyWords3 5728 1.47 4.16 0.45 82 RCVD_IN_PSBL 5514 1.20 4.01 0.13 83 RCVD_IN_VALIDITY_SAFE 5471 4.36 3.97 4.51 84 SpammyFromTLD_01 5408 1.55 3.93 0.64 85 USER_IN_DEF_DKIM_WL 5247 9.64 3.81 11.85 86 KHOP_HELO_FCRDNS 5233 4.00 3.80 4.07 87 RCVD_IN_MSPIKE_L3 5222 1.49 3.79 0.61 88 PDS_OTHER_BAD_TLD 5097 1.24 3.70 0.30 89 T_XMDrugObfuBody_14 5087 2.48 3.70 2.02 90 RCVD_IN_MSPIKE_L5 4947 1.03 3.59 0.05 91 HTML_IMAGE_RATIO_06 4825 3.68 3.50 3.75 92 XMSexyCombo_01 4695 1.37 3.41 0.60 93 T_XMDrugObfuBody_08 4683 2.06 3.40 1.55 94 RCVD_IN_VALIDITY_CERTIFIED 4650 3.91 3.38 4.11 95 BODY_URI_ONLY 4600 0.93 3.34 0.01 96 URIBL_DBL_SPAM 4543 0.92 3.30 0.02 97 XM_B_Phish66 4508 2.46 3.27 2.16 98 MIME_QP_LONG_LINE 4482 4.57 3.26 5.07 99 XM_OfRef6 4396 1.54 3.19 0.91 100 MIME_HTML_MOSTLY 4308 2.42 3.13 2.15 101 TM2_M_URI_OPT_OUT 4232 2.70 3.07 2.55 102 XMStockSpam_06 4214 1.65 3.06 1.11 103 XMStrtUSub 4176 3.82 3.03 4.12 104 XM_DIRTYINTL 4040 1.03 2.93 0.31 105 XM_UB99 3921 0.79 2.85 0.00 106 SpammyFromTLD_02 3843 0.94 2.79 0.23 107 T_TooManySym_01 3812 5.29 2.77 6.25 108 XMLngstWrd_00 3787 1.43 2.75 0.93 109 TR_Symld_Words 3726 1.92 2.71 1.62 110 SUBJ_ALL_CAPS 3718 3.38 2.70 3.64 111 XMLngstWrd_01 3703 1.38 2.69 0.88 112 XMLngstWrd_02 3603 1.29 2.62 0.79 113 XMSubMetaSxObfu_03 3569 1.55 2.59 1.15 114 BOTNET_NORDNS 3456 0.71 2.51 0.02 115 XM_GoogleGroups 3429 1.89 2.49 1.66 116 DKIM_INVALID 3375 2.23 2.45 2.15 117 RCVD_IN_IADB_LISTED 3351 4.12 2.43 4.76 118 XMDiploma_00 3304 1.57 2.40 1.25 119 T_FILL_THIS_FORM_SHORT 3219 1.25 2.34 0.84 120 XM_B_SpammyWords4 3215 0.99 2.34 0.48 121 XM_DK_Undo_01 3206 1.76 2.33 1.55 122 XM_CamelCaseFrm001 3194 1.73 2.32 1.51 123 XMLngstWrd_03 3177 1.14 2.31 0.70 124 XMLngstWrd_04 3057 1.07 2.22 0.63 125 TR_XM_MSPIKECOMBO2 3039 0.67 2.21 0.08 126 URI_PHP_REDIR 3020 0.60 2.19 0.00 127 RCVD_IN_IADB_SPF 2938 3.65 2.13 4.23 128 XM_B_Unsub2 2929 1.62 2.13 1.42 129 XM_UB999 2929 0.59 2.13 0.00 130 XM_B_COVIDMETA 2844 0.86 2.07 0.40 131 HTML_IMAGE_ONLY_08 2832 0.64 2.06 0.10 132 HTML_IMAGE_RATIO_08 2805 5.31 2.04 6.55 133 HTML_TAG_BALANCE_CENTER 2781 0.60 2.02 0.06 134 RCVD_IN_IADB_DK 2755 3.24 2.00 3.71 135 TR_Mismatch_TLD_02 2752 0.60 2.00 0.07 136 TR_XM_NoHeaderRelay 2750 0.68 2.00 0.18 137 HTML_TITLE_SUBJ_DIFF 2740 0.86 1.99 0.43 138 GOOG_STO_IMG_HTML 2712 0.54 1.97 0.00 139 UPPERCASE_75_100 2708 0.86 1.97 0.44 140 XMBody_17 2690 0.87 1.95 0.46 141 RCVD_IN_IADB_SENDERID 2681 3.32 1.95 3.84 142 BAYES_40 2677 4.15 1.94 4.99 143 FROM_SUSPICIOUS_NTLD 2667 0.56 1.94 0.04 144 T_XMDrugObfuBody_00 2659 0.98 1.93 0.62 145 MAILING_LIST_MULTI 2631 2.56 1.91 2.81 146 XMBdyGiftCard01 2624 1.03 1.91 0.69 147 URI_NOVOWEL 2610 2.08 1.90 2.15 148 FROM_SUSPICIOUS_NTLD_FP 2587 0.54 1.88 0.04 149 XM_URI_RBL 2570 0.62 1.87 0.15 150 RELAYCOUNTRY_FR 2570 0.69 1.87 0.24 151 TR_XM_PHPDW 2559 0.77 1.86 0.35 152 TR_XM_SB_Phish 2506 2.05 1.82 2.14 153 TR_XM_PHPForged 2483 0.72 1.80 0.31 154 URI_HEX 2462 1.52 1.79 1.42 155 TR_XM_FormFill2 2430 0.71 1.77 0.31 156 XMSexyCombo_04 2429 0.61 1.76 0.17 157 XMSubPhish11 2426 1.90 1.76 1.95 158 XM_H_PHPOS 2421 0.71 1.76 0.31 159 FROM_EXCESS_BASE64 2421 2.55 1.76 2.86 160 BAYES_20 2328 3.13 1.69 3.68 161 FROM_2_EMAILS_SHORT 2314 0.46 1.68 0.00 162 MIXED_CENTER_CASE 2266 0.45 1.65 0.00 163 MIXED_HREF_CASE 2263 0.45 1.64 0.00 164 NAME_EMAIL_DIFF 2259 0.55 1.64 0.13 165 RELAYCOUNTRY_RU 2257 0.48 1.64 0.04 166 MIXED_IMG_CASE 2251 0.45 1.64 0.00 167 MIXED_AREA_CASE 2251 0.45 1.64 0.00 168 MIXED_FONT_CASE 2245 0.45 1.63 0.00 169 RELAYCOUNTRY_AU 2202 0.62 1.60 0.25 170 XMSubNoVowel 2193 1.41 1.59 1.34 171 PDS_TO_EQ_FROM_NAME 2191 0.44 1.59 0.00 172 TR_LOTS_OF_MONEY3 2181 0.63 1.58 0.27 173 NO_FM_NAME_IP_HOSTN 2179 0.44 1.58 0.00 174 ALL_TRUSTED 2134 11.70 1.55 15.55 175 TVD_SPACE_RATIO 2121 1.16 1.54 1.02 176 XMSubMetaI_00 2110 0.83 1.53 0.56 177 XM_UB80 2109 0.43 1.53 0.02 178 RELAYCOUNTRY_BR 2033 0.41 1.48 0.01 179 XM_Body_Dirty_Words_01 2021 0.53 1.47 0.18 180 XM_UB60 2019 0.46 1.47 0.07 181 XM_DKIMWhitelistDomains 2010 6.75 1.46 8.75 182 XMGenDplmaNmb 1979 0.87 1.44 0.66 183 HTML_FONT_SIZE_LARGE 1978 0.51 1.44 0.15 184 URIBL_BLACK 1967 0.42 1.43 0.04 185 TR_BOTNET_NEGATE 1966 0.61 1.43 0.31 186 XMPhish30 1965 0.75 1.43 0.49 187 TR_MetaPhish_Combo_01 1959 0.98 1.42 0.81 188 RELAYCOUNTRY_DE 1930 0.58 1.40 0.27 189 T_XMHurry_00 1905 1.04 1.38 0.91 190 XMGppyBdWords 1896 0.54 1.38 0.22 191 TR_XM_FormFill 1894 0.39 1.38 0.01 192 TR_XM_COVIDMETA1 1850 0.63 1.34 0.36 193 RCVD_IN_IADB_VOUCHED 1849 2.38 1.34 2.77 194 TM2_M_A_HREF_HREF 1841 0.63 1.34 0.36 195 DATE_IN_PAST_03_06 1811 0.41 1.32 0.07 196 PDS_FROM_2_EMAILS 1755 0.35 1.27 0.00 197 XM_B_DNDMA 1749 0.60 1.27 0.34 198 XM_B_SEO 1744 0.47 1.27 0.17 199 MONEY_NOHTML 1720 0.40 1.25 0.08 200 T_Symld_Words_02 1717 0.67 1.25 0.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 317892 89.22 93.36 87.65 2 RELAYCOUNTRY_US 297935 81.20 78.71 82.14 3 XM_B_Unicode 258199 73.24 78.65 71.19 4 DCC_CHECK_NEGATIVE 252331 58.53 29.46 69.57 5 DKIM_SIGNED 251422 73.46 84.37 69.32 6 XM_DK_Pass 246928 71.99 82.30 68.08 7 DKIM_VALID 243615 71.23 81.91 67.17 8 BAYES_50 192603 49.56 40.24 53.10 9 DKIM_VALID_AU 189786 54.89 61.66 52.33 10 XM_B_SpammyWords 160632 50.16 65.62 44.29 11 XM_B_Unicode3 160375 44.44 45.04 44.22 12 XMListUnsubscribeExists 158939 49.68 65.11 43.82 13 T_TM2_M_HEADER_IN_MSG 126213 31.38 22.38 34.80 14 DCC_CHECK 110188 41.42 70.51 30.38 15 RCVD_IN_MSPIKE_WL 103282 26.34 20.69 28.48 16 DKIM_VALID_EF 99761 28.05 29.49 27.51 17 HTML_FONT_LOW_CONTRAST 96598 28.54 33.57 26.63 18 FVGT_m_MULTI_ODD 84993 26.17 33.38 23.43 19 LOC_TINY_FONT_1 81159 26.20 36.28 22.38 20 XMSubLong 74745 21.90 25.29 20.61 21 MIME_HTML_ONLY 73003 23.83 33.59 20.13 22 RCVD_IN_MSPIKE_H2 72431 21.60 25.91 19.97 23 XM_B_SpammyWords2 63006 22.82 37.19 17.37 24 T_KAM_HTML_FONT_INVALID 61697 19.20 24.98 17.01 25 ALL_TRUSTED 56391 11.70 1.55 15.55 26 RCVD_IN_MSPIKE_H3 56286 15.09 13.97 15.52 27 BAYES_00 49942 10.31 1.18 13.77 28 XM_Multi_Part_URI 43494 13.20 16.39 11.99 29 USER_IN_DEF_DKIM_WL 42980 9.64 3.81 11.85 30 IN_ZIMBRA_NJ_WHITELIST 42905 8.61 0.14 11.83 31 XM_Body_Dirty_Words 40225 14.14 22.17 11.09 32 RCVD_IN_MSPIKE_H4 39635 9.68 6.40 10.93 33 LOTS_OF_MONEY 36927 11.54 15.11 10.18 34 XM_B_Unsub 35816 11.18 14.63 9.87 35 BAYES_60 33053 8.64 7.39 9.11 36 XM_DKIMWhitelistDomains 31743 6.75 1.46 8.75 37 LotsOfNums_01 30171 7.96 7.01 8.32 38 TooManyTo_001 29494 7.28 5.02 8.13 39 XM_Evil_Numbers_Gen 29369 8.78 10.59 8.10 40 UNPARSEABLE_RELAY 27461 9.02 12.85 7.57 41 XM_DK_Undo_02 26684 17.56 44.44 7.36 42 XM_SPF_SoftFail 26561 6.55 4.50 7.32 43 HTML_IMAGE_RATIO_08 23756 5.31 2.04 6.55 44 TR_XM_DK_Bayes 23655 4.90 0.62 6.52 45 TR_XM_DK_Bayes1 23072 4.78 0.62 6.36 46 HTML_FONT_FACE_BAD 22690 4.78 0.90 6.26 47 T_TooManySym_01 22677 5.29 2.77 6.25 48 BAYES_99 22257 13.62 33.32 6.14 49 HTML_IMAGE_RATIO_02 22042 6.55 7.81 6.08 50 TR_XM_UnparsRelay 21435 7.73 12.52 5.91 51 XM_SendGrid 20757 6.44 8.33 5.72 52 TR_XM_SpammyWords4 19809 7.59 13.19 5.46 53 TR_XM_DK_Bayes2 19607 4.06 0.50 5.41 54 HTML_IMAGE_RATIO_04 19396 5.48 5.83 5.35 55 TR_XM_DKIM_Undo 19329 13.42 34.75 5.33 56 MPART_ALT_DIFF 19177 5.91 7.56 5.29 57 XM_PDF 19098 4.04 0.81 5.27 58 BAYES_999 18395 10.89 26.22 5.07 59 MIME_QP_LONG_LINE 18393 4.57 3.26 5.07 60 XM_H_Long_From01 18255 5.19 5.61 5.03 61 BAYES_40 18109 4.15 1.94 4.99 62 RCVD_IN_IADB_LISTED 17269 4.12 2.43 4.76 63 RCVD_IN_VALIDITY_SAFE 16345 4.36 3.97 4.51 64 BOTNET_IPINHOSTNAME 15779 7.48 15.74 4.35 65 RCVD_IN_IADB_SPF 15334 3.65 2.13 4.23 66 BAYES_80 15102 5.37 8.54 4.16 67 XMStrtUSub 14945 3.82 3.03 4.12 68 RCVD_IN_VALIDITY_CERTIFIED 14911 3.91 3.38 4.11 69 KHOP_HELO_FCRDNS 14763 4.00 3.80 4.07 70 RCVD_IN_IADB_SENDERID 13936 3.32 1.95 3.84 71 XMSubMetaSx_00 13836 4.85 7.59 3.81 72 TR_XM_DK_SendGrid 13745 4.07 4.81 3.79 73 HTML_IMAGE_RATIO_06 13598 3.68 3.50 3.75 74 RCVD_IN_IADB_DK 13438 3.24 2.00 3.71 75 BAYES_20 13339 3.13 1.69 3.68 76 XMNumbers 13299 3.98 4.80 3.67 77 SUBJ_ALL_CAPS 13199 3.38 2.70 3.64 78 RELAYCOUNTRY_META 13120 8.90 22.83 3.62 79 MIME_HTML_ONLY_MULTI 13056 3.96 4.92 3.60 80 XMSexyCombo_05 13053 5.61 10.90 3.60 81 XM_B_SpammyWords3 12876 5.84 11.88 3.55 82 T_REMOTE_IMAGE 12679 3.84 4.74 3.50 83 T_TooManySym_02 12180 2.68 0.90 3.36 84 XM_H_Trusted_IP 12166 2.43 0.00 3.35 85 XM_B_Phish_Phrases 12035 4.44 7.39 3.32 86 XM_UncommonTLD01 11965 5.25 10.38 3.30 87 TR_XM_PhishingBody 11515 4.06 6.40 3.17 88 FILL_THIS_FORM 10966 2.26 0.23 3.02 89 HTML_MIME_NO_HTML_TAG 10660 3.70 5.70 2.94 90 FROM_EXCESS_BASE64 10360 2.55 1.76 2.86 91 MAILING_LIST_MULTI 10185 2.56 1.91 2.81 92 RCVD_IN_IADB_VOUCHED 10057 2.38 1.34 2.77 93 FSL_BULK_SIG 9642 6.50 16.62 2.66 94 ANY_BOUNCE_MESSAGE 9598 2.19 0.98 2.65 95 BOUNCE_MESSAGE 9595 2.19 0.98 2.65 96 BAYES_95 9336 3.16 4.69 2.57 97 TM2_M_URI_OPT_OUT 9260 2.70 3.07 2.55 98 TR_DCC_Bayes_99 9225 8.47 24.08 2.54 99 BAYES_05 8943 2.02 0.83 2.47 100 TooManyTo_002 8178 1.88 0.90 2.25 101 XM_B_SpammyTLD 7863 2.97 5.10 2.17 102 XM_B_Phish66 7818 2.46 3.27 2.16 103 DKIM_INVALID 7807 2.23 2.45 2.15 104 URI_NOVOWEL 7802 2.08 1.90 2.15 105 MIME_HTML_MOSTLY 7784 2.42 3.13 2.15 106 TR_XM_SB_Phish 7762 2.05 1.82 2.14 107 RCVD_IN_MSPIKE_H5 7361 1.56 0.32 2.03 108 T_XMDrugObfuBody_14 7333 2.48 3.70 2.02 109 XMSubPhish11 7062 1.90 1.76 1.95 110 TR_XM_MaxUnsub 6947 3.36 7.15 1.92 111 HELO_NODOT 6919 1.50 0.43 1.91 112 HELO_NO_DOMAIN 6916 1.50 0.42 1.91 113 INVALID_MSGID 6735 1.41 0.23 1.86 114 TR_XM_SpammyWords5 6719 2.54 4.35 1.85 115 RCVD_IN_IADB_OPTIN 6598 1.56 0.89 1.82 116 IN_HORDE_ADDRESS_BOOK 6465 1.40 0.41 1.78 117 MSGID_NOFQDN1 6169 1.27 0.14 1.70 118 TO_MALFORMED 6027 1.21 0.01 1.66 119 XM_GoogleGroups 6011 1.89 2.49 1.66 120 TM2_M_VERY_LONG_WORD 5892 2.64 5.33 1.62 121 TR_Symld_Words 5872 1.92 2.71 1.62 122 TVD_RCVD_IP 5862 1.30 0.47 1.62 123 TooManyTo_003 5635 1.34 0.78 1.55 124 T_XMDrugObfuBody_08 5626 2.06 3.40 1.55 125 XM_DK_Undo_01 5609 1.76 2.33 1.55 126 XM_B_Investor 5502 2.41 4.76 1.52 127 XM_CamelCaseFrm001 5474 1.73 2.32 1.51 128 TR_XM_SpammyRelay 5283 4.00 10.72 1.46 129 XM_B_Unsub2 5164 1.62 2.13 1.42 130 URI_HEX 5134 1.52 1.79 1.42 131 BOTNET 5114 4.86 13.93 1.41 132 XM_E_Blogspot 5102 1.08 0.22 1.41 133 TR_XM_SpammyWords2 4895 4.10 11.35 1.35 134 XMSubNoVowel 4854 1.41 1.59 1.34 135 UNTRUSTED_Relay 4614 4.74 13.88 1.27 136 XMDiploma_00 4547 1.57 2.40 1.25 137 XM_H_Long_From02 4464 1.21 1.15 1.23 138 XMCapTrack 4228 0.94 0.36 1.17 139 XMSubMetaSxObfu_03 4169 1.55 2.59 1.15 140 TooManyTo_004 4091 1.02 0.72 1.13 141 XMStockSpam_06 4021 1.65 3.06 1.11 142 XMGappySubj_01 3889 0.82 0.17 1.07 143 TVD_SPACE_RATIO 3682 1.16 1.54 1.02 144 XMBSHREFv2 3629 0.79 0.25 1.00 145 XMBrknScrpt_02 3535 0.99 1.01 0.97 146 DKIM_ADSP_CUSTOM_MED 3369 0.94 0.95 0.93 147 XMLngstWrd_00 3367 1.43 2.75 0.93 148 T_XMHurry_00 3317 1.04 1.38 0.91 149 XM_OfRef6 3300 1.54 3.19 0.91 150 TooManyTo_005 3283 0.84 0.66 0.91 151 RCVD_IN_MSPIKE_BL 3276 2.84 7.93 0.90 152 RCVD_IN_RP_SAFE 3268 0.90 0.90 0.90 153 TR_XM_MSPIKECOMBO 3264 2.81 7.85 0.90 154 T_TooManySym_03 3241 0.73 0.31 0.89 155 XMBody_95 3214 0.70 0.22 0.89 156 XMLngstWrd_01 3184 1.38 2.69 0.88 157 RELAYCOUNTRY_CA 3103 2.02 5.10 0.86 158 T_FILL_THIS_FORM_SHORT 3058 1.25 2.34 0.84 159 RCVD_IN_RP_CERTIFIED 3015 0.80 0.73 0.83 160 TR_MetaPhish_Combo_01 2940 0.98 1.42 0.81 161 XM_UB50 2908 2.08 5.45 0.80 162 XMLngstWrd_02 2876 1.29 2.62 0.79 163 XMNoVowels 2798 0.67 0.41 0.77 164 XMHTML_After_End 2682 0.87 1.22 0.74 165 RELAYCOUNTRY_GB 2631 0.81 1.04 0.73 166 HTML_IMAGE_ONLY_20 2544 0.63 0.46 0.70 167 XMLngstWrd_03 2531 1.14 2.31 0.70 168 XMBdyGiftCard01 2514 1.03 1.91 0.69 169 HTTPS_HTTP_MISMATCH 2485 0.77 1.01 0.69 170 RCVD_IN_BL_SPAMCOP_NET 2412 3.85 12.24 0.67 171 XM_ShortIntro_01 2409 0.65 0.59 0.66 172 XMGenDplmaNmb 2384 0.87 1.44 0.66 173 SpammyFromTLD_01 2326 1.55 3.93 0.64 174 TR_MSPIKEBAYES00 2323 0.48 0.05 0.64 175 XMLngstWrd_04 2290 1.07 2.22 0.63 176 T_XMDrugObfuBody_00 2259 0.98 1.93 0.62 177 RCVD_IN_MSPIKE_L3 2213 1.49 3.79 0.61 178 URI_TRY_3LD 2206 0.74 1.09 0.61 179 XMSexyCombo_01 2174 1.37 3.41 0.60 180 XM_ProductURIs 2164 0.70 0.97 0.60 181 HTML_TAG_BALANCE_BODY 2103 0.67 0.92 0.58 182 XMSubMetaI_00 2036 0.83 1.53 0.56 183 XM_B_COPY_HTML 2029 0.59 0.67 0.56 184 NML_ADSP_CUSTOM_MED 2006 0.62 0.78 0.55 185 XM_H_PHPMailer 1991 0.62 0.80 0.55 186 SHORT_HELO_AND_INLINE_IMAGE 1938 0.41 0.08 0.53 187 RCVD_IN_SORBS_DUL 1928 0.46 0.28 0.53 188 T_OBFU_PDF_ATTACH 1887 0.41 0.12 0.52 189 FORGED_GMAIL_RCVD 1807 0.59 0.83 0.50 190 XMPhish30 1773 0.75 1.43 0.49 191 XM_B_SpammyWords4 1746 0.99 2.34 0.48 192 XMMoneyMeta_00 1718 0.65 1.10 0.47 193 XMBody_17 1669 0.87 1.95 0.46 194 FROM_GOV_SPOOF 1658 0.39 0.20 0.46 195 XMHTMLBadTable_001 1652 0.61 1.01 0.46 196 TR_XM_SpammyWords3 1649 1.47 4.16 0.45 197 T_Symld_Words_02 1646 0.67 1.25 0.45 198 HTML_IMAGE_ONLY_32 1632 0.39 0.23 0.45 199 UPPERCASE_75_100 1596 0.86 1.97 0.44 200 HTML_TITLE_SUBJ_DIFF 1549 0.86 1.99 0.43 ----------------------------------------------------------------------