Email: 499350 Autolearn: 0 AvgScore: 3.69 AvgScanTime: 1.20 sec Spam: 142606 Autolearn: 0 AvgScore: 13.75 AvgScanTime: 1.23 sec Ham: 356744 Autolearn: 0 AvgScore: -0.33 AvgScanTime: 1.18 sec Time Spent Running SA: 165.81 hours Time Spent Processing Spam: 48.62 hours Time Spent Processing Ham: 117.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137121 89.98 96.15 87.51 2 DKIM_SIGNED 128816 81.01 90.33 77.28 3 XM_DK_Pass 123609 78.86 86.68 75.73 4 DKIM_VALID 121335 77.66 85.08 74.69 5 XM_B_Unicode 120094 74.26 84.21 70.28 6 RELAYCOUNTRY_US 110048 80.86 77.17 82.34 7 XM_B_SpammyWords 105392 53.80 73.90 45.77 8 XMListUnsubscribeExists 104068 57.64 72.98 51.51 9 DKIM_VALID_AU 88581 61.17 62.12 60.80 10 DCC_CHECK_NEGATIVE 76940 74.94 53.95 83.33 11 XM_DK_Undo_02 72778 19.31 51.03 6.63 12 DCC_CHECK 65643 25.03 46.03 16.64 13 XM_B_SpammyWords2 64467 27.20 45.21 20.00 14 XM_B_Unicode3 60608 40.65 42.50 39.91 15 BAYES_99 56520 14.83 39.63 4.92 16 TR_XM_DKIM_Undo 56198 13.33 39.41 2.90 17 LOC_TINY_FONT_1 52125 29.88 36.55 27.21 18 BAYES_50 50190 52.36 35.19 59.22 19 HTML_FONT_LOW_CONTRAST 49328 30.45 34.59 28.79 20 DKIM_VALID_EF 49242 31.46 34.53 30.23 21 RCVD_IN_MSPIKE_H2 48299 32.13 33.87 31.43 22 FVGT_m_MULTI_ODD 47038 28.66 32.98 26.94 23 MIME_HTML_ONLY 45261 22.87 31.74 19.32 24 BAYES_999 44256 11.52 31.03 3.72 25 T_KAM_HTML_FONT_INVALID 42287 23.38 29.65 20.87 26 TR_XM_DK_Unsub 36197 17.74 25.38 14.68 27 RELAYCOUNTRY_META 33237 10.01 23.31 4.70 28 T_TM2_M_HEADER_IN_MSG 31867 27.76 22.35 29.93 29 XMSubLong 30564 22.28 21.43 22.62 30 TR_DCC_Bayes_99 26190 5.73 18.37 0.68 31 LOTS_OF_MONEY 26099 10.24 18.30 7.02 32 TR_XM_SpammyRelay 25698 6.97 18.02 2.55 33 XM_Multi_Part_URI 25175 14.94 17.65 13.86 34 TR_XM_SpammyWords2 24032 5.46 16.85 0.90 35 TR_XM_SpammyWords4 22925 8.25 16.08 5.12 36 RCVD_IN_BL_SPAMCOP_NET 22405 5.16 15.71 0.94 37 XM_B_SpammyWords3 21421 7.57 15.02 4.59 38 TR_MAX_INTL_RELAY 21040 9.59 14.75 7.52 39 TR_XM_SPAMCOP 20204 4.46 14.17 0.57 40 XM_B_Unsub 20179 9.97 14.15 8.30 41 TR_XM_BayesUnsub 19419 8.74 13.62 6.79 42 RELAYCOUNTRY_CA 19363 5.01 13.58 1.59 43 BOTNET_IPINHOSTNAME 18888 6.82 13.24 4.25 44 UNPARSEABLE_RELAY 18283 11.61 12.82 11.12 45 RCVD_IN_MSPIKE_H3 15802 7.26 11.08 5.74 46 RCVD_IN_MSPIKE_WL 15802 7.26 11.08 5.74 47 BOTNET 14603 3.89 10.24 1.35 48 BAYES_80 12405 5.75 8.70 4.57 49 BAYES_60 10601 8.94 7.43 9.55 50 XM_Evil_Numbers_Gen 10348 8.06 7.26 8.38 51 XMBody_17 10232 2.59 7.18 0.76 52 TR_XM_UnparsRelay 9950 3.31 6.98 1.85 53 XM_UncommonTLD01 9444 4.59 6.62 3.78 54 UNTRUSTED_Relay 9344 3.05 6.55 1.65 55 XM_Body_Dirty_Words 8953 3.81 6.28 2.83 56 XM_B_SEO 7971 2.45 5.59 1.19 57 BAYES_95 7872 3.68 5.52 2.95 58 XM_H_GMP 7815 6.17 5.48 6.45 59 XMSubMetaSx_00 7795 4.46 5.47 4.05 60 RCVD_IN_VALIDITY_RPBL 7764 1.71 5.44 0.22 61 LotsOfNums_01 7625 7.39 5.35 8.20 62 XM_B_Phish_Phrases 7577 3.96 5.31 3.43 63 DKIM_INVALID 7481 3.34 5.25 2.58 64 XM_SPF_SoftFail 7397 3.97 5.19 3.48 65 TR_XM_SpammyWords5 7285 2.45 5.11 1.38 66 MPART_ALT_DIFF 7144 3.82 5.01 3.35 67 T_FILL_THIS_FORM_SHORT 7115 2.11 4.99 0.96 68 HTML_IMAGE_RATIO_02 7102 5.10 4.98 5.14 69 XM_B_PhoneNumber 7034 8.46 4.93 9.86 70 TR_XM_SEO4 7025 1.92 4.93 0.72 71 TR_LOTS_OF_MONEY3 7001 1.91 4.91 0.71 72 XM_OfRef6 6999 2.21 4.91 1.13 73 TR_XM_PhishingBody 6870 2.57 4.82 1.67 74 TooManyTo_001 6628 7.64 4.65 8.83 75 HK_RANDOM_REPLYTO 6356 1.38 4.46 0.14 76 XMNumbers 6315 3.42 4.43 3.02 77 XM_H_Long_From01 6224 4.71 4.36 4.85 78 HTML_IMAGE_RATIO_04 6206 4.06 4.35 3.94 79 XM_B_Investor 6195 2.40 4.34 1.62 80 XMSexyCombo_05 6114 2.41 4.29 1.66 81 FSL_BULK_SIG 6107 3.42 4.28 3.08 82 HTML_IMAGE_RATIO_06 6013 3.34 4.22 3.00 83 XMStrtUSub 5944 4.33 4.17 4.39 84 TR_XM_BayesRelay 5930 1.19 4.16 0.00 85 T_XMDrugObfuBody_08 5568 2.20 3.90 1.52 86 HTML_IMAGE_RATIO_08 5355 2.99 3.76 2.69 87 FONT_INVIS_LONG_LINE 5169 1.08 3.62 0.06 88 T_XMDrugObfuBody_14 5041 2.35 3.53 1.88 89 XMDiploma_00 4905 2.20 3.44 1.70 90 XM_B_SpammyTLD 4741 2.62 3.32 2.33 91 MIME_HTML_ONLY_MULTI 4683 2.27 3.28 1.87 92 SUBJ_ALL_CAPS 4582 2.14 3.21 1.72 93 XM_UB50 4446 1.61 3.12 1.01 94 MIME_HTML_MOSTLY 4347 2.43 3.05 2.18 95 TM2_M_URI_OPT_OUT 4259 2.03 2.99 1.65 96 TR_XM_FormFill 4240 0.87 2.97 0.02 97 HOSTED_IMG_MULTI_PUB_01 4213 0.87 2.95 0.04 98 XM_URI_RBL 4193 0.98 2.94 0.19 99 HTML_MIME_NO_HTML_TAG 4110 2.51 2.88 2.36 100 TM2_M_VERY_LONG_WORD 4106 1.88 2.88 1.48 101 SpammyFromTLD_01 4076 1.38 2.86 0.79 102 XMBrknScrpt_02 3726 1.41 2.61 0.93 103 MIME_QP_LONG_LINE 3618 4.06 2.54 4.68 104 XM_B_Unsub2 3428 1.71 2.40 1.44 105 TR_XM_NoHeaderRelay 3333 0.78 2.34 0.16 106 T_TooManySym_01 3305 4.81 2.32 5.81 107 T_XMHurry_00 3192 1.48 2.24 1.17 108 XM_CamelCaseFrm001 3174 2.28 2.23 2.30 109 URI_TRY_3LD 3135 1.14 2.20 0.72 110 XMReplyNow 3032 0.77 2.13 0.23 111 XM_B_SpammyWords4 2994 1.11 2.10 0.72 112 RELAYCOUNTRY_AU 2974 1.10 2.09 0.70 113 XM_H_Undi_Recip 2930 0.78 2.05 0.27 114 TR_Mismatch_TLD_02 2909 0.65 2.04 0.09 115 TR_XM_INV_DKIM 2818 0.62 1.98 0.07 116 MAILING_LIST_MULTI 2702 2.80 1.89 3.16 117 URIBL_DBL_SPAM 2649 0.53 1.86 0.01 118 BOUNCE_MESSAGE 2604 2.82 1.83 3.21 119 ANY_BOUNCE_MESSAGE 2604 2.82 1.83 3.21 120 RCVD_IN_VALIDITY_SAFE 2555 4.09 1.79 5.00 121 TR_Caps_n_Bayes_99 2544 0.52 1.78 0.02 122 TR_XM_Undi_Recip19 2531 0.58 1.77 0.10 123 XMGenDplmaNmb 2499 1.13 1.75 0.88 124 TR_XM_PHPForged 2448 0.80 1.72 0.43 125 TR_XM_PHPDW 2379 0.78 1.67 0.43 126 TR_XM_FormFill2 2340 0.78 1.64 0.44 127 XM_H_PHPOS 2327 0.76 1.63 0.42 128 TR_XM_Undi_RecipCombo2 2293 0.47 1.61 0.01 129 XM_HighProb1 2234 0.45 1.57 0.00 130 T_XMDrugObfuBody_00 2223 1.00 1.56 0.78 131 ALL_TRUSTED 2179 10.37 1.53 13.90 132 USER_IN_DEF_DKIM_WL 2098 9.77 1.47 13.09 133 TR_XM_InvalidRelay 2087 0.44 1.46 0.03 134 BAYES_40 2067 3.52 1.45 4.35 135 XM_DK_Undo_01 2040 1.84 1.43 2.00 136 SpammyFromTLD_02 2020 0.57 1.42 0.24 137 XMStockSpam_06 1997 1.29 1.40 1.25 138 RCVD_IN_VALIDITY_CERTIFIED 1994 3.38 1.40 4.18 139 HTML_TAG_BALANCE_BODY 1971 0.76 1.38 0.51 140 LOADSA_MONEY_COMBO 1868 0.41 1.31 0.05 141 KHOP_HELO_FCRDNS 1859 1.29 1.30 1.29 142 XMHTML_After_End 1856 0.71 1.30 0.48 143 XM_SendGrid 1791 1.43 1.26 1.51 144 T_REMOTE_IMAGE 1788 3.08 1.25 3.81 145 UNDISC_MONEY 1764 0.36 1.24 0.01 146 XM_B_Phish66 1748 0.64 1.23 0.41 147 XMLngstWrd_00 1743 0.94 1.22 0.82 148 XMPhish30 1724 0.76 1.21 0.58 149 RCVD_IN_IADB_LISTED 1712 2.74 1.20 3.35 150 AC_BR_BONANZA 1680 0.44 1.18 0.14 151 DKIM_ADSP_CUSTOM_MED 1673 1.02 1.17 0.97 152 TR_Symld_Words 1672 1.60 1.17 1.77 153 TR_LOTS_OF_MONEY2 1664 0.52 1.17 0.26 154 T_MONEY_PERCENT 1664 0.52 1.17 0.26 155 TR_XM_Undi_Recip5 1659 0.34 1.16 0.00 156 HTTPS_HTTP_MISMATCH 1652 1.04 1.16 0.99 157 URI_NOVOWEL 1599 1.13 1.12 1.13 158 TR_XM_Undi_RecipCombo3 1589 0.32 1.11 0.00 159 TR_XM_Undi_Recip6 1581 0.32 1.11 0.00 160 XM_UB99 1553 0.31 1.09 0.00 161 BAYES_20 1521 2.65 1.07 3.28 162 XMSexyCombo_01 1486 0.47 1.04 0.24 163 XM_OfRef7 1482 0.42 1.04 0.18 164 RCVD_IN_IADB_SPF 1466 2.42 1.03 2.97 165 LongTLD 1451 0.56 1.02 0.38 166 RDNS_DYNAMIC 1451 0.51 1.02 0.30 167 XM_DIRTYINTL 1448 0.42 1.02 0.18 168 NML_ADSP_CUSTOM_MED 1446 0.74 1.01 0.63 169 FROM_EXCESS_BASE64 1446 1.44 1.01 1.60 170 TR_Sbj_FN_Bdy 1437 0.40 1.01 0.16 171 URI_HEX 1430 1.08 1.00 1.11 172 BOTNET_NORDNS 1428 0.31 1.00 0.03 173 XFER_LOTSA_MONEY 1420 0.30 1.00 0.02 174 TooManyTo_002 1417 2.31 0.99 2.84 175 HTML_FONT_SIZE_LARGE 1410 0.34 0.99 0.08 176 DIET_1 1395 0.51 0.98 0.33 177 DKIM_ADSP_NXDOMAIN 1391 0.52 0.98 0.34 178 RCVD_IN_IADB_DK 1381 2.12 0.97 2.59 179 T_Symld_Words_02 1367 0.58 0.96 0.42 180 THIS_AD 1363 0.67 0.96 0.55 181 URG_BIZ 1363 0.31 0.96 0.05 182 MISSING_HEADERS 1357 0.59 0.95 0.44 183 XM_B_COPY_HTML 1355 0.64 0.95 0.52 184 TVD_RCVD_IP 1352 1.30 0.95 1.44 185 HTML_IMAGE_ONLY_08 1348 0.40 0.95 0.18 186 RCVD_IN_IADB_SENDERID 1340 2.17 0.94 2.66 187 T_STY_INVIS_DIRECT 1318 0.52 0.92 0.35 188 TR_Mismatch_TLD_01 1290 0.40 0.90 0.20 189 RELAYCOUNTRY_FR 1273 0.41 0.89 0.22 190 XM_Combo_Sbj 1257 0.45 0.88 0.27 191 AC_HTML_NONSENSE_TAGS 1257 0.27 0.88 0.02 192 MPART_ALT_DIFF_COUNT 1255 0.72 0.88 0.66 193 TooManyTo_003 1245 1.43 0.87 1.65 194 XMSubMetaI_00 1241 0.92 0.87 0.94 195 XMHTMLBadTable_001 1231 0.44 0.86 0.27 196 MIME_HEADER_CTYPE_ONLY 1196 0.34 0.84 0.14 197 RCVD_IN_PSBL 1189 0.61 0.83 0.52 198 XMPhish11 1189 0.30 0.83 0.08 199 XM_B_DNDMA 1186 0.78 0.83 0.76 200 FORGED_GMAIL_RCVD 1178 0.66 0.83 0.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312204 89.98 96.15 87.51 2 DCC_CHECK_NEGATIVE 297261 74.94 53.95 83.33 3 RELAYCOUNTRY_US 293750 80.86 77.17 82.34 4 DKIM_SIGNED 275688 81.01 90.33 77.28 5 XM_DK_Pass 270172 78.86 86.68 75.73 6 DKIM_VALID 266469 77.66 85.08 74.69 7 XM_B_Unicode 250723 74.26 84.21 70.28 8 DKIM_VALID_AU 216893 61.17 62.12 60.80 9 BAYES_50 211260 52.36 35.19 59.22 10 XMListUnsubscribeExists 183767 57.64 72.98 51.51 11 XM_B_SpammyWords 163269 53.80 73.90 45.77 12 XM_B_Unicode3 142362 40.65 42.50 39.91 13 RCVD_IN_MSPIKE_H2 112125 32.13 33.87 31.43 14 DKIM_VALID_EF 107836 31.46 34.53 30.23 15 T_TM2_M_HEADER_IN_MSG 106759 27.76 22.35 29.93 16 HTML_FONT_LOW_CONTRAST 102701 30.45 34.59 28.79 17 LOC_TINY_FONT_1 97064 29.88 36.55 27.21 18 FVGT_m_MULTI_ODD 96094 28.66 32.98 26.94 19 XMSubLong 80697 22.28 21.43 22.62 20 T_KAM_HTML_FONT_INVALID 74466 23.38 29.65 20.87 21 XM_B_SpammyWords2 71356 27.20 45.21 20.00 22 MIME_HTML_ONLY 68937 22.87 31.74 19.32 23 DCC_CHECK 59359 25.03 46.03 16.64 24 TR_XM_DK_Unsub 52377 17.74 25.38 14.68 25 ALL_TRUSTED 49589 10.37 1.53 13.90 26 XM_Multi_Part_URI 49445 14.94 17.65 13.86 27 USER_IN_DEF_DKIM_WL 46680 9.77 1.47 13.09 28 UNPARSEABLE_RELAY 39667 11.61 12.82 11.12 29 XM_B_PhoneNumber 35187 8.46 4.93 9.86 30 BAYES_60 34053 8.94 7.43 9.55 31 BAYES_00 32398 6.63 0.51 9.08 32 TooManyTo_001 31507 7.64 4.65 8.83 33 XM_Evil_Numbers_Gen 29896 8.06 7.26 8.38 34 XM_B_Unsub 29603 9.97 14.15 8.30 35 LotsOfNums_01 29253 7.39 5.35 8.20 36 XM_DKIMWhitelistDomains 27415 5.50 0.04 7.68 37 TR_MAX_INTL_RELAY 26844 9.59 14.75 7.52 38 LOTS_OF_MONEY 25056 10.24 18.30 7.02 39 TR_XM_BayesUnsub 24208 8.74 13.62 6.79 40 XM_DK_Undo_02 23657 19.31 51.03 6.63 41 XM_H_GMP 23008 6.17 5.48 6.45 42 IN_ZIMBRA_NJ_WHITELIST 22995 4.62 0.07 6.45 43 TR_XM_DK_Bayes 22250 4.57 0.40 6.24 44 TR_XM_DK_Bayes1 21884 4.49 0.39 6.13 45 T_TooManySym_01 20716 4.81 2.32 5.81 46 RCVD_IN_MSPIKE_H3 20469 7.26 11.08 5.74 47 RCVD_IN_MSPIKE_WL 20469 7.26 11.08 5.74 48 TR_XM_DK_Bayes2 18953 3.89 0.32 5.31 49 HTML_IMAGE_RATIO_02 18351 5.10 4.98 5.14 50 TR_XM_SpammyWords4 18263 8.25 16.08 5.12 51 RCVD_IN_VALIDITY_SAFE 17852 4.09 1.79 5.00 52 BAYES_99 17547 14.83 39.63 4.92 53 XM_H_Long_From01 17312 4.71 4.36 4.85 54 XM_PDF 17116 3.61 0.66 4.80 55 RELAYCOUNTRY_META 16770 10.01 23.31 4.70 56 MIME_QP_LONG_LINE 16678 4.06 2.54 4.68 57 XM_B_SpammyWords3 16372 7.57 15.02 4.59 58 BAYES_80 16311 5.75 8.70 4.57 59 XMStrtUSub 15672 4.33 4.17 4.39 60 BAYES_40 15535 3.52 1.45 4.35 61 BOTNET_IPINHOSTNAME 15167 6.82 13.24 4.25 62 RCVD_IN_VALIDITY_CERTIFIED 14897 3.38 1.40 4.18 63 XMSubMetaSx_00 14463 4.46 5.47 4.05 64 HTML_IMAGE_RATIO_04 14053 4.06 4.35 3.94 65 T_REMOTE_IMAGE 13590 3.08 1.25 3.81 66 XM_UncommonTLD01 13477 4.59 6.62 3.78 67 BAYES_999 13274 11.52 31.03 3.72 68 XM_SPF_SoftFail 12409 3.97 5.19 3.48 69 XM_B_Phish_Phrases 12221 3.96 5.31 3.43 70 RCVD_IN_IADB_LISTED 11956 2.74 1.20 3.35 71 MPART_ALT_DIFF 11935 3.82 5.01 3.35 72 BAYES_20 11693 2.65 1.07 3.28 73 ANY_BOUNCE_MESSAGE 11454 2.82 1.83 3.21 74 BOUNCE_MESSAGE 11454 2.82 1.83 3.21 75 MAILING_LIST_MULTI 11275 2.80 1.89 3.16 76 FSL_BULK_SIG 10970 3.42 4.28 3.08 77 XMNumbers 10773 3.42 4.43 3.02 78 HTML_IMAGE_RATIO_06 10690 3.34 4.22 3.00 79 RCVD_IN_IADB_SPF 10605 2.42 1.03 2.97 80 BAYES_95 10524 3.68 5.52 2.95 81 T_TooManySym_02 10401 2.29 0.72 2.92 82 TR_XM_DKIM_Undo 10356 13.33 39.41 2.90 83 TooManyTo_002 10139 2.31 0.99 2.84 84 XM_Body_Dirty_Words 10094 3.81 6.28 2.83 85 HTML_IMAGE_RATIO_08 9600 2.99 3.76 2.69 86 RCVD_IN_IADB_SENDERID 9502 2.17 0.94 2.66 87 RCVD_IN_IADB_DK 9229 2.12 0.97 2.59 88 DKIM_INVALID 9219 3.34 5.25 2.58 89 TR_XM_SpammyRelay 9091 6.97 18.02 2.55 90 HTML_MIME_NO_HTML_TAG 8414 2.51 2.88 2.36 91 XM_B_SpammyTLD 8325 2.62 3.32 2.33 92 XM_CamelCaseFrm001 8190 2.28 2.23 2.30 93 MIME_HTML_MOSTLY 7790 2.43 3.05 2.18 94 RCVD_IN_IADB_VOUCHED 7566 1.70 0.66 2.12 95 BAYES_05 7415 1.62 0.49 2.08 96 INVALID_MSGID 7287 1.50 0.14 2.04 97 TO_MALFORMED 7148 1.44 0.01 2.00 98 XM_DK_Undo_01 7141 1.84 1.43 2.00 99 HELO_NODOT 7019 1.50 0.32 1.97 100 HELO_NO_DOMAIN 7018 1.50 0.32 1.97 101 T_XMDrugObfuBody_14 6696 2.35 3.53 1.88 102 MIME_HTML_ONLY_MULTI 6674 2.27 3.28 1.87 103 TR_XM_UnparsRelay 6597 3.31 6.98 1.85 104 TR_Symld_Words 6298 1.60 1.17 1.77 105 SUBJ_ALL_CAPS 6124 2.14 3.21 1.72 106 XMDiploma_00 6063 2.20 3.44 1.70 107 TR_XM_PhishingBody 5948 2.57 4.82 1.67 108 XMSexyCombo_05 5917 2.41 4.29 1.66 109 TM2_M_URI_OPT_OUT 5880 2.03 2.99 1.65 110 UNTRUSTED_Relay 5879 3.05 6.55 1.65 111 TooManyTo_003 5875 1.43 0.87 1.65 112 XM_B_Investor 5766 2.40 4.34 1.62 113 FROM_EXCESS_BASE64 5725 1.44 1.01 1.60 114 RELAYCOUNTRY_CA 5670 5.01 13.58 1.59 115 T_XMDrugObfuBody_08 5415 2.20 3.90 1.52 116 XM_SendGrid 5370 1.43 1.26 1.51 117 TM2_M_VERY_LONG_WORD 5286 1.88 2.88 1.48 118 RCVD_IN_IADB_OPTIN 5232 1.16 0.39 1.47 119 TVD_RCVD_IP 5136 1.30 0.95 1.44 120 XM_B_Unsub2 5129 1.71 2.40 1.44 121 IN_HORDE_ADDRESS_BOOK 5075 1.04 0.07 1.42 122 TR_XM_SpammyWords5 4931 2.45 5.11 1.38 123 BOTNET 4803 3.89 10.24 1.35 124 KHOP_HELO_FCRDNS 4606 1.29 1.30 1.29 125 XMStockSpam_06 4456 1.29 1.40 1.25 126 TooManyTo_004 4415 1.12 0.81 1.24 127 XM_GoogleGroups 4321 1.02 0.55 1.21 128 XM_B_SEO 4259 2.45 5.59 1.19 129 XM_H_Long_From02 4249 1.08 0.82 1.19 130 XMGappySubj_01 4220 0.89 0.15 1.18 131 T_XMHurry_00 4178 1.48 2.24 1.17 132 XMCapTrack 4177 0.98 0.49 1.17 133 URI_NOVOWEL 4042 1.13 1.12 1.13 134 XM_OfRef6 4021 2.21 4.91 1.13 135 TVD_SPACE_RATIO 3990 0.83 0.12 1.12 136 URI_HEX 3948 1.08 1.00 1.11 137 T_TooManySym_03 3814 0.81 0.17 1.07 138 XMNoVowels 3807 0.86 0.35 1.07 139 TR_XM_DK_SendGrid 3750 0.98 0.80 1.05 140 TooManyTo_005 3704 0.96 0.77 1.04 141 XMBSHREFv2 3694 0.84 0.35 1.04 142 XM_UB50 3604 1.61 3.12 1.01 143 HTTPS_HTTP_MISMATCH 3531 1.04 1.16 0.99 144 DKIM_ADSP_CUSTOM_MED 3444 1.02 1.17 0.97 145 T_FILL_THIS_FORM_SHORT 3429 2.11 4.99 0.96 146 RCVD_IN_BL_SPAMCOP_NET 3349 5.16 15.71 0.94 147 XMSubMetaI_00 3336 0.92 0.87 0.94 148 XMBrknScrpt_02 3330 1.41 2.61 0.93 149 TR_XM_SpammyWords2 3216 5.46 16.85 0.90 150 XMGenDplmaNmb 3132 1.13 1.75 0.88 151 XMLngstWrd_00 2930 0.94 1.22 0.82 152 SpammyFromTLD_01 2802 1.38 2.86 0.79 153 XMBdyGiftCard01 2779 0.78 0.79 0.78 154 T_XMDrugObfuBody_00 2775 1.00 1.56 0.78 155 XM_B_DNDMA 2716 0.78 0.83 0.76 156 XMBody_17 2698 2.59 7.18 0.76 157 XMGappySubj_02 2673 0.55 0.05 0.75 158 TR_MetaPhish_Combo_01 2652 0.74 0.73 0.74 159 XM_ShortIntro_01 2597 0.69 0.60 0.73 160 XM_B_SpammyWords4 2570 1.11 2.10 0.72 161 TR_XM_SEO4 2561 1.92 4.93 0.72 162 URI_TRY_3LD 2557 1.14 2.20 0.72 163 TR_LOTS_OF_MONEY3 2521 1.91 4.91 0.71 164 RELAYCOUNTRY_AU 2505 1.10 2.09 0.70 165 XM_H_PHPMailer 2494 0.72 0.79 0.70 166 T_OBFU_PDF_ATTACH 2462 0.53 0.12 0.69 167 HTML_IMAGE_ONLY_32 2445 0.54 0.18 0.69 168 TR_DCC_Bayes_99 2424 5.73 18.37 0.68 169 TO_NO_BRKTS_HTML_ONLY 2422 0.57 0.31 0.68 170 XM_ProductURIs 2358 0.70 0.80 0.66 171 MPART_ALT_DIFF_COUNT 2347 0.72 0.88 0.66 172 SHORT_HELO_AND_INLINE_IMAGE 2312 0.48 0.05 0.65 173 NML_ADSP_CUSTOM_MED 2253 0.74 1.01 0.63 174 FORGED_GMAIL_RCVD 2093 0.66 0.83 0.59 175 XM_B_FormFill 2083 0.43 0.06 0.58 176 TR_XM_Base64_M1 2066 0.57 0.54 0.58 177 XMPhish30 2062 0.76 1.21 0.58 178 TR_XM_SPAMCOP 2044 4.46 14.17 0.57 179 THIS_AD 1972 0.67 0.96 0.55 180 FROM_GOV_DKIM_AU 1966 0.43 0.12 0.55 181 USER_IN_WHITELIST 1964 0.39 0.00 0.55 182 USER_IN_WELCOMELIST 1964 0.39 0.00 0.55 183 XM_B_COPY_HTML 1865 0.64 0.95 0.52 184 RCVD_IN_PSBL 1839 0.61 0.83 0.52 185 HTML_TAG_BALANCE_BODY 1834 0.76 1.38 0.51 186 FILL_THIS_FORM 1825 0.45 0.28 0.51 187 XMBody_95 1824 0.40 0.12 0.51 188 XMMoneyMeta_00 1770 0.57 0.77 0.50 189 HTML_FONT_FACE_BAD 1747 0.56 0.74 0.49 190 HTML_IMAGE_ONLY_28 1732 0.43 0.29 0.49 191 XMSubMetaSxObfu_02 1704 0.45 0.39 0.48 192 XMHTML_After_End 1699 0.71 1.30 0.48 193 PLING_QUERY 1690 0.47 0.46 0.47 194 RELAYCOUNTRY_GB 1662 0.50 0.59 0.47 195 XM_B_REG_HTML 1580 0.47 0.55 0.44 196 MISSING_HEADERS 1576 0.59 0.95 0.44 197 TM2_M_BODY_EMPTY 1570 0.34 0.09 0.44 198 TR_XM_FormFill2 1565 0.78 1.64 0.44 199 TR_XM_PHPForged 1529 0.80 1.72 0.43 200 T_TooManySym_04 1518 0.32 0.04 0.43 ----------------------------------------------------------------------