Email: 518434 Autolearn: 0 AvgScore: 2.88 AvgScanTime: 1.45 sec Spam: 165438 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 1.64 sec Ham: 352996 Autolearn: 0 AvgScore: -2.35 AvgScanTime: 1.36 sec Time Spent Running SA: 208.60 hours Time Spent Processing Spam: 75.48 hours Time Spent Processing Ham: 133.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159929 88.96 96.67 85.35 2 DKIM_SIGNED 147566 71.14 89.20 62.68 3 XM_DK_Pass 144581 69.38 87.39 60.94 4 DKIM_VALID 143184 68.55 86.55 60.12 5 RELAYCOUNTRY_US 137758 80.12 83.27 78.65 6 XM_B_Unicode 131497 70.44 79.48 66.20 7 DCC_CHECK 117170 40.65 70.82 26.51 8 XMListUnsubscribeExists 115934 49.95 70.08 40.52 9 XM_B_SpammyWords 107775 48.96 65.15 41.37 10 DKIM_VALID_AU 106366 52.13 64.29 46.43 11 RCVD_IN_MSPIKE_H2 79241 37.58 47.90 32.74 12 XM_B_Unicode3 72734 42.39 43.96 41.65 13 BAYES_50 72418 46.64 43.77 47.99 14 XM_DK_Undo_02 69295 17.55 41.89 6.15 15 XM_B_SpammyWords2 61841 22.52 37.38 15.55 16 MIME_HTML_ONLY 59417 23.89 35.91 18.26 17 FVGT_m_MULTI_ODD 58881 26.53 35.59 22.28 18 LOC_TINY_FONT_1 58521 24.35 35.37 19.19 19 HTML_FONT_LOW_CONTRAST 56111 26.20 33.92 22.59 20 TR_XM_DKIM_Undo 53804 13.00 32.52 3.86 21 BAYES_99 53175 17.32 32.14 10.37 22 DKIM_VALID_EF 51381 26.45 31.06 24.29 23 DCC_CHECK_NEGATIVE 48233 59.31 29.15 73.44 24 T_KAM_HTML_FONT_INVALID 46918 20.11 28.36 16.25 25 BAYES_999 42021 14.49 25.40 9.38 26 TR_DCC_Bayes_99 37508 8.25 22.67 1.50 27 XM_Body_Dirty_Words 36965 14.04 22.34 10.14 28 T_TM2_M_HEADER_IN_MSG 33551 28.70 20.28 32.64 29 RELAYCOUNTRY_META 33270 8.61 20.11 3.22 30 XMSubLong 33247 19.69 20.10 19.50 31 XM_B_Unsub 28420 10.83 17.18 7.85 32 XM_Multi_Part_URI 28032 12.83 16.94 10.90 33 TR_XM_BayesUnsub 27743 9.48 16.77 6.06 34 RCVD_IN_MSPIKE_WL 26030 15.03 15.73 14.71 35 TR_XM_Base64_M1 23226 12.61 14.04 11.94 36 LOTS_OF_MONEY 23163 12.60 14.00 11.94 37 TR_XM_Base64_L1 22295 6.66 13.48 3.46 38 RCVD_IN_MSPIKE_H3 21825 11.05 13.19 10.05 39 MPART_ALT_DIFF 21146 7.51 12.78 5.04 40 BOTNET_IPINHOSTNAME 20748 7.15 12.54 4.63 41 TR_XM_SpammyWords4 19715 9.89 11.92 8.93 42 UNPARSEABLE_RELAY 19059 8.00 11.52 6.34 43 XM_B_SpammyWords3 19018 5.69 11.50 2.96 44 RCVD_IN_BL_SPAMCOP_NET 18813 3.95 11.37 0.48 45 TR_XM_UnparsRelay 18673 6.91 11.29 4.86 46 TR_XM_SpammyRelay 18370 4.53 11.10 1.45 47 TR_XM_SpammyWords2 18314 4.06 11.07 0.77 48 XMSexyCombo_05 18260 5.56 11.04 2.99 49 FSL_BULK_SIG 16509 5.07 9.98 2.77 50 BOTNET 15712 4.03 9.50 1.47 51 MIME_HTML_ONLY_MULTI 15481 5.43 9.36 3.59 52 TM2_M_VERY_LONG_WORD 15111 3.83 9.13 1.34 53 XM_Evil_Numbers_Gen 14677 7.92 8.87 7.48 54 XM_UncommonTLD01 13953 4.95 8.43 3.32 55 HTML_MIME_NO_HTML_TAG 13762 4.03 8.32 2.03 56 BAYES_80 13241 5.81 8.00 4.79 57 UNTRUSTED_Relay 12904 3.28 7.80 1.16 58 TR_XM_SPAMCOP 12776 2.58 7.72 0.17 59 HTML_IMAGE_RATIO_02 12284 5.75 7.43 4.96 60 BAYES_60 12147 8.31 7.34 8.76 61 RELAYCOUNTRY_CA 11822 2.92 7.15 0.93 62 LotsOfNums_01 11735 7.62 7.09 7.86 63 XMSubMetaSx_00 11126 4.08 6.73 2.84 64 XMLngstWrd_00 10871 2.71 6.57 0.91 65 XMLngstWrd_01 10800 2.55 6.53 0.68 66 XM_GoogleGroups 10742 2.85 6.49 1.14 67 XMLngstWrd_02 10655 2.40 6.44 0.51 68 TR_XM_PhishingBody 10594 3.82 6.40 2.61 69 XM_H_Long_From01 10214 5.12 6.17 4.62 70 XMLngstWrd_03 10172 2.17 6.15 0.31 71 HTML_TITLE_SUBJ_DIFF 10119 1.97 6.12 0.03 72 XMLngstWrd_04 10010 2.03 6.05 0.14 73 UPPERCASE_75_100 9967 1.94 6.02 0.02 74 XM_SendGrid 9558 4.30 5.78 3.61 75 XM_B_Phish_Phrases 9309 3.45 5.63 2.43 76 RCVD_IN_MSPIKE_BL 8970 2.64 5.42 1.33 77 TR_XM_MSPIKECOMBO 8712 2.58 5.27 1.33 78 BAYES_95 8099 3.21 4.90 2.43 79 XM_B_Investor 7671 2.32 4.64 1.23 80 XM_B_SpammyTLD 7096 2.81 4.29 2.11 81 TooManyTo_001 7080 6.37 4.28 7.34 82 TR_XM_Base64_L2 7019 1.81 4.24 0.67 83 XM_SPF_SoftFail 6930 6.10 4.19 7.00 84 XM_B_Phish66 6597 2.28 3.99 1.48 85 XMStrtUSub 6595 3.89 3.99 3.85 86 HTML_IMAGE_RATIO_06 6562 6.39 3.97 7.53 87 TR_XM_Base64_C 6412 1.82 3.88 0.86 88 MIME_HTML_MOSTLY 6408 2.59 3.87 1.99 89 HTML_IMAGE_RATIO_04 6403 5.04 3.87 5.59 90 T_REMOTE_IMAGE 6167 3.51 3.73 3.41 91 XM_DIRTYINTL 6126 1.38 3.70 0.28 92 XM_OfRef6 6119 1.81 3.70 0.92 93 T_XMDrugObfuBody_14 6114 2.12 3.70 1.38 94 XMNumbers 5814 3.93 3.51 4.12 95 TR_XM_DK_SendGrid 5775 2.74 3.49 2.38 96 MIME_QP_LONG_LINE 5733 4.40 3.47 4.84 97 XM_CamelCaseFrm001 5729 2.17 3.46 1.56 98 T_XMDrugObfuBody_08 5512 1.93 3.33 1.28 99 TR_XM_SpammyWords5 5499 1.94 3.32 1.29 100 SpammyFromTLD_01 5485 1.48 3.32 0.61 101 SpammyFromTLD_02 5395 1.42 3.26 0.56 102 RCVD_IN_VALIDITY_SAFE 5299 3.89 3.20 4.22 103 TR_XM_Base64_M2 5253 2.48 3.18 2.15 104 TM2_M_URI_OPT_OUT 5176 2.86 3.13 2.73 105 TR_XM_SpammyWords3 5154 1.35 3.12 0.52 106 URI_NOVOWEL 5100 2.51 3.08 2.25 107 XM_UB50 5039 1.44 3.05 0.69 108 URIBL_DBL_SPAM 4976 0.97 3.01 0.02 109 USER_IN_DEF_DKIM_WL 4904 8.38 2.96 10.92 110 XMDiploma_00 4886 1.99 2.95 1.54 111 RCVD_IN_IADB_LISTED 4542 4.37 2.75 5.13 112 RCVD_IN_VALIDITY_CERTIFIED 4531 3.41 2.74 3.73 113 RCVD_IN_VALIDITY_RPBL 4502 0.88 2.72 0.02 114 XM_B_Unsub2 4492 1.48 2.72 0.89 115 PDS_OTHER_BAD_TLD 4399 0.94 2.66 0.13 116 DKIM_INVALID 4382 2.58 2.65 2.55 117 HTML_IMAGE_RATIO_08 4101 2.55 2.48 2.58 118 FROM_EXCESS_BASE64 4078 2.04 2.46 1.84 119 RCVD_IN_MSPIKE_L5 4019 0.80 2.43 0.03 120 RCVD_IN_MSPIKE_H4 3976 3.55 2.40 4.09 121 T_FILL_THIS_FORM_SHORT 3945 1.17 2.38 0.60 122 XM_B_SpammyWords4 3865 1.15 2.34 0.60 123 XM_DK_Undo_01 3838 1.60 2.32 1.27 124 RCVD_IN_IADB_SPF 3746 3.79 2.26 4.51 125 ALL_TRUSTED 3731 13.58 2.26 18.89 126 TR_XM_SB_Phish 3676 2.05 2.22 1.97 127 KHOP_HELO_FCRDNS 3633 3.53 2.20 4.15 128 TR_XM_MSPIKECOMBO2 3607 0.91 2.18 0.31 129 BOTNET_NORDNS 3602 0.71 2.18 0.02 130 T_TooManySym_01 3585 4.94 2.17 6.24 131 XMSubPhish11 3542 2.01 2.14 1.94 132 TR_LOTS_OF_MONEY3 3539 0.82 2.14 0.19 133 XMSexyCombo_01 3434 0.92 2.08 0.38 134 RCVD_IN_IADB_DK 3420 3.29 2.07 3.87 135 RCVD_IN_IADB_SENDERID 3416 3.39 2.06 4.02 136 XMBody_17 3264 0.97 1.97 0.50 137 URI_HEX 3259 1.37 1.97 1.09 138 RCVD_IN_MSPIKE_L3 3218 1.13 1.95 0.75 139 XM_B_COVIDMETA 3126 0.86 1.89 0.38 140 T_XMHurry_00 3106 0.85 1.88 0.38 141 XM_UB99 3098 0.60 1.87 0.00 142 URI_PHP_REDIR 3020 0.58 1.83 0.00 143 SUBJ_ALL_CAPS 2992 1.63 1.81 1.54 144 MAILING_LIST_MULTI 2970 2.19 1.80 2.38 145 T_XMDrugObfuBody_00 2961 1.03 1.79 0.67 146 XMStockSpam_06 2690 1.27 1.63 1.11 147 DATE_IN_PAST_03_06 2605 0.76 1.57 0.37 148 RCVD_IN_IADB_VOUCHED 2595 2.80 1.57 3.38 149 RELAYCOUNTRY_AU 2595 0.71 1.57 0.31 150 XMSubMetaSxObfu_02 2487 0.75 1.50 0.40 151 TR_XM_COVIDMETA1 2469 0.61 1.49 0.19 152 RCVD_IN_PSBL 2432 0.54 1.47 0.10 153 XM_UB999 2375 0.46 1.44 0.00 154 URI_TRY_3LD 2324 0.76 1.40 0.45 155 BAYES_40 2301 3.69 1.39 4.76 156 XMGenDplmaNmb 2300 0.93 1.39 0.71 157 TR_XM_PHPDW 2287 0.65 1.38 0.30 158 XM_B_DynamicLink 2286 0.46 1.38 0.02 159 HTTPS_HTTP_MISMATCH 2236 0.79 1.35 0.53 160 TR_XM_PHPForged 2214 1.65 1.34 1.80 161 TR_XM_FormFill2 2174 0.60 1.31 0.26 162 XM_H_PHPOS 2163 0.59 1.31 0.25 163 XMBrknScrpt_02 2131 0.95 1.29 0.78 164 HK_RANDOM_REPLYTO 2118 0.44 1.28 0.04 165 HTML_TAG_BALANCE_BODY 2047 0.79 1.24 0.58 166 TR_Symld_Words 2028 1.44 1.23 1.55 167 TR_XM_FormFill 2018 0.40 1.22 0.01 168 XM_OfRef7 2004 0.46 1.21 0.11 169 RELAYCOUNTRY_IN 1986 0.42 1.20 0.05 170 TR_XM_MaxSPIKE 1920 0.48 1.16 0.16 171 XM_B_DNDMA 1914 0.69 1.16 0.47 172 XM_URI_RBL 1900 0.44 1.15 0.11 173 TR_XM_BayesRelay 1900 0.37 1.15 0.00 174 TR_XM_COVIDMETA4 1891 0.49 1.14 0.18 175 TR_XM_Base64_L3 1873 0.44 1.13 0.11 176 RELAYCOUNTRY_RU 1870 0.38 1.13 0.02 177 RELAYCOUNTRY_FR 1868 0.51 1.13 0.21 178 XM_H_Long_From02 1841 0.97 1.11 0.91 179 XMSubNoVowel 1838 3.23 1.11 4.22 180 URIBL_BLACK 1832 0.38 1.11 0.05 181 HTML_TAG_BALANCE_CENTER 1822 0.42 1.10 0.11 182 FROM_SUSPICIOUS_NTLD 1819 0.36 1.10 0.02 183 XM_H_Undi_Recip 1810 0.53 1.09 0.27 184 XMBdyGiftCard01 1805 0.80 1.09 0.66 185 TR_XM_NoHeaderRelay 1793 0.41 1.08 0.09 186 XMHTML_After_End 1782 0.70 1.08 0.53 187 TR_MetaPhish_Combo_01 1760 0.81 1.06 0.69 188 HTML_IMAGE_ONLY_20 1751 1.11 1.06 1.13 189 LongTLD 1734 0.49 1.05 0.23 190 XMPhish30 1732 0.77 1.05 0.64 191 HTML_FONT_FACE_BAD 1671 4.87 1.01 6.69 192 XM_UB60 1656 0.36 1.00 0.06 193 BAYES_20 1628 2.81 0.98 3.67 194 RCVD_IN_IADB_OPTIN 1622 1.81 0.98 2.20 195 XMReplyNow 1619 0.46 0.98 0.22 196 T_MONEY_PERCENT 1604 0.42 0.97 0.16 197 TR_LOTS_OF_MONEY2 1604 0.42 0.97 0.16 198 FROM_SUSPICIOUS_NTLD_FP 1595 0.32 0.96 0.02 199 REMOVE_BEFORE_LINK 1582 0.43 0.96 0.19 200 DKIM_ADSP_CUSTOM_MED 1581 1.97 0.96 2.44 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301279 88.96 96.67 85.35 2 RELAYCOUNTRY_US 277617 80.12 83.27 78.65 3 DCC_CHECK_NEGATIVE 259253 59.31 29.15 73.44 4 XM_B_Unicode 233666 70.44 79.48 66.20 5 DKIM_SIGNED 221244 71.14 89.20 62.68 6 XM_DK_Pass 215107 69.38 87.39 60.94 7 DKIM_VALID 212227 68.55 86.55 60.12 8 BAYES_50 169388 46.64 43.77 47.99 9 DKIM_VALID_AU 163906 52.13 64.29 46.43 10 XM_B_Unicode3 147008 42.39 43.96 41.65 11 XM_B_SpammyWords 146051 48.96 65.15 41.37 12 XMListUnsubscribeExists 143039 49.95 70.08 40.52 13 RCVD_IN_MSPIKE_H2 115586 37.58 47.90 32.74 14 T_TM2_M_HEADER_IN_MSG 115220 28.70 20.28 32.64 15 DCC_CHECK 93588 40.65 70.82 26.51 16 DKIM_VALID_EF 85757 26.45 31.06 24.29 17 HTML_FONT_LOW_CONTRAST 79738 26.20 33.92 22.59 18 FVGT_m_MULTI_ODD 78642 26.53 35.59 22.28 19 XMSubLong 68845 19.69 20.10 19.50 20 LOC_TINY_FONT_1 67733 24.35 35.37 19.19 21 ALL_TRUSTED 66686 13.58 2.26 18.89 22 MIME_HTML_ONLY 64450 23.89 35.91 18.26 23 T_KAM_HTML_FONT_INVALID 57364 20.11 28.36 16.25 24 XM_B_SpammyWords2 54900 22.52 37.38 15.55 25 BAYES_00 52444 10.40 0.90 14.86 26 RCVD_IN_MSPIKE_WL 51912 15.03 15.73 14.71 27 TR_XM_Base64_M1 42144 12.61 14.04 11.94 28 LOTS_OF_MONEY 42139 12.60 14.00 11.94 29 IN_ZIMBRA_NJ_WHITELIST 40252 7.81 0.13 11.40 30 USER_IN_DEF_DKIM_WL 38534 8.38 2.96 10.92 31 XM_Multi_Part_URI 38494 12.83 16.94 10.90 32 BAYES_99 36616 17.32 32.14 10.37 33 XM_Body_Dirty_Words 35798 14.04 22.34 10.14 34 RCVD_IN_MSPIKE_H3 35486 11.05 13.19 10.05 35 BAYES_999 33124 14.49 25.40 9.38 36 TR_XM_SpammyWords4 31536 9.89 11.92 8.93 37 BAYES_60 30922 8.31 7.34 8.76 38 XM_DKIMWhitelistDomains 28550 5.57 0.18 8.09 39 LotsOfNums_01 27748 7.62 7.09 7.86 40 XM_B_Unsub 27722 10.83 17.18 7.85 41 HTML_IMAGE_RATIO_06 26578 6.39 3.97 7.53 42 XM_Evil_Numbers_Gen 26404 7.92 8.87 7.48 43 TooManyTo_001 25920 6.37 4.28 7.34 44 XM_H_Trusted_IP 25567 4.93 0.00 7.24 45 XM_SPF_SoftFail 24697 6.10 4.19 7.00 46 HTML_FONT_FACE_BAD 23602 4.87 1.01 6.69 47 UNPARSEABLE_RELAY 22394 8.00 11.52 6.34 48 T_TooManySym_01 22018 4.94 2.17 6.24 49 XM_DK_Undo_02 21699 17.55 41.89 6.15 50 TR_XM_BayesUnsub 21399 9.48 16.77 6.06 51 TR_XM_DK_Bayes 20104 4.10 0.70 5.70 52 HTML_IMAGE_RATIO_04 19742 5.04 3.87 5.59 53 TR_XM_DK_Bayes1 19693 4.02 0.70 5.58 54 BOUNCE_MESSAGE 18391 3.77 0.70 5.21 55 ANY_BOUNCE_MESSAGE 18391 3.77 0.70 5.21 56 RCVD_IN_IADB_LISTED 18107 4.37 2.75 5.13 57 MPART_ALT_DIFF 17801 7.51 12.78 5.04 58 HTML_IMAGE_RATIO_02 17511 5.75 7.43 4.96 59 TR_XM_DK_Bayes2 17425 3.53 0.54 4.94 60 TR_XM_UnparsRelay 17152 6.91 11.29 4.86 61 MIME_QP_LONG_LINE 17093 4.40 3.47 4.84 62 BAYES_80 16894 5.81 8.00 4.79 63 BAYES_40 16812 3.69 1.39 4.76 64 BOTNET_IPINHOSTNAME 16339 7.15 12.54 4.63 65 XM_H_Long_From01 16323 5.12 6.17 4.62 66 XM_PDF 16110 3.34 0.74 4.56 67 RCVD_IN_IADB_SPF 15923 3.79 2.26 4.51 68 RCVD_IN_VALIDITY_SAFE 14892 3.89 3.20 4.22 69 XMSubNoVowel 14890 3.23 1.11 4.22 70 KHOP_HELO_FCRDNS 14655 3.53 2.20 4.15 71 XMNumbers 14539 3.93 3.51 4.12 72 RCVD_IN_MSPIKE_H4 14446 3.55 2.40 4.09 73 RCVD_IN_IADB_SENDERID 14179 3.39 2.06 4.02 74 RCVD_IN_IADB_DK 13657 3.29 2.07 3.87 75 TR_XM_DKIM_Undo 13612 13.00 32.52 3.86 76 XMStrtUSub 13596 3.89 3.99 3.85 77 T_TooManySym_02 13157 2.75 0.66 3.73 78 RCVD_IN_VALIDITY_CERTIFIED 13156 3.41 2.74 3.73 79 BAYES_20 12958 2.81 0.98 3.67 80 XM_SendGrid 12751 4.30 5.78 3.61 81 MIME_HTML_ONLY_MULTI 12671 5.43 9.36 3.59 82 TR_XM_Base64_L1 12211 6.66 13.48 3.46 83 T_REMOTE_IMAGE 12042 3.51 3.73 3.41 84 RCVD_IN_IADB_VOUCHED 11927 2.80 1.57 3.38 85 XM_UncommonTLD01 11720 4.95 8.43 3.32 86 RELAYCOUNTRY_META 11351 8.61 20.11 3.22 87 XMSexyCombo_05 10544 5.56 11.04 2.99 88 XM_B_SpammyWords3 10455 5.69 11.50 2.96 89 XMSubMetaSx_00 10029 4.08 6.73 2.84 90 FSL_BULK_SIG 9769 5.07 9.98 2.77 91 TM2_M_URI_OPT_OUT 9648 2.86 3.13 2.73 92 TR_XM_PhishingBody 9210 3.82 6.40 2.61 93 HTML_IMAGE_RATIO_08 9108 2.55 2.48 2.58 94 DKIM_INVALID 9017 2.58 2.65 2.55 95 XM_H_PHPMailer 8912 1.93 0.67 2.52 96 DKIM_ADSP_CUSTOM_MED 8617 1.97 0.96 2.44 97 XM_B_Phish_Phrases 8572 3.45 5.63 2.43 98 BAYES_95 8564 3.21 4.90 2.43 99 TR_XM_DK_SendGrid 8415 2.74 3.49 2.38 100 MAILING_LIST_MULTI 8394 2.19 1.80 2.38 101 BAYES_05 8390 1.80 0.56 2.38 102 URI_NOVOWEL 7936 2.51 3.08 2.25 103 RCVD_IN_IADB_OPTIN 7758 1.81 0.98 2.20 104 TR_XM_Base64_M2 7591 2.48 3.18 2.15 105 XM_B_SpammyTLD 7452 2.81 4.29 2.11 106 NML_ADSP_CUSTOM_MED 7441 1.66 0.72 2.11 107 FORGED_GMAIL_RCVD 7279 1.67 0.83 2.06 108 HTML_MIME_NO_HTML_TAG 7151 4.03 8.32 2.03 109 MIME_HTML_MOSTLY 7016 2.59 3.87 1.99 110 TooManyTo_002 7003 1.50 0.48 1.98 111 TVD_SPACE_RATIO_MINFP 6984 1.39 0.13 1.98 112 TVD_RCVD_IP 6966 1.40 0.17 1.97 113 INVALID_MSGID 6951 1.39 0.16 1.97 114 TR_XM_SB_Phish 6949 2.05 2.22 1.97 115 XMSubPhish11 6857 2.01 2.14 1.94 116 FROM_EXCESS_BASE64 6492 2.04 2.46 1.84 117 TR_XM_PHPForged 6353 1.65 1.34 1.80 118 IN_HORDE_ADDRESS_BOOK 6043 1.20 0.09 1.71 119 TO_MALFORMED 5953 1.15 0.02 1.69 120 HELO_NODOT 5523 1.26 0.60 1.56 121 XM_CamelCaseFrm001 5516 2.17 3.46 1.56 122 TR_Symld_Words 5458 1.44 1.23 1.55 123 HELO_NO_DOMAIN 5453 1.22 0.51 1.54 124 XMDiploma_00 5449 1.99 2.95 1.54 125 SUBJ_ALL_CAPS 5448 1.63 1.81 1.54 126 TR_DCC_Bayes_99 5281 8.25 22.67 1.50 127 XM_B_Phish66 5228 2.28 3.99 1.48 128 BOTNET 5194 4.03 9.50 1.47 129 TR_XM_SpammyRelay 5118 4.53 11.10 1.45 130 XMGappySubj_01 5069 1.01 0.09 1.44 131 T_XMDrugObfuBody_14 4878 2.12 3.70 1.38 132 T_TooManySym_03 4871 1.02 0.26 1.38 133 TM2_M_VERY_LONG_WORD 4744 3.83 9.13 1.34 134 TooManyTo_003 4695 1.03 0.38 1.33 135 RCVD_IN_MSPIKE_BL 4692 2.64 5.42 1.33 136 TR_XM_MSPIKECOMBO 4681 2.58 5.27 1.33 137 XMBSHREFv2 4645 0.99 0.31 1.32 138 TR_XM_SpammyWords5 4570 1.94 3.32 1.29 139 T_XMDrugObfuBody_08 4512 1.93 3.33 1.28 140 XM_DK_Undo_01 4471 1.60 2.32 1.27 141 TVD_SPACE_RATIO 4466 0.92 0.20 1.27 142 XM_B_Investor 4332 2.32 4.64 1.23 143 UNTRUSTED_Relay 4085 3.28 7.80 1.16 144 XM_GoogleGroups 4014 2.85 6.49 1.14 145 HTML_IMAGE_ONLY_20 3994 1.11 1.06 1.13 146 XMStockSpam_06 3913 1.27 1.63 1.11 147 URI_HEX 3858 1.37 1.97 1.09 148 XMCapTrack 3359 0.75 0.32 0.95 149 TooManyTo_004 3312 0.74 0.32 0.94 150 RELAYCOUNTRY_CA 3299 2.92 7.15 0.93 151 XM_OfRef6 3243 1.81 3.70 0.92 152 XMLngstWrd_00 3204 2.71 6.57 0.91 153 XM_H_Long_From02 3196 0.97 1.11 0.91 154 XM_B_Unsub2 3157 1.48 2.72 0.89 155 BASE64_LENGTH_79_INF 3068 0.90 0.95 0.87 156 TR_XM_Base64_C 3022 1.82 3.88 0.86 157 RCVD_IN_RP_SAFE 3016 0.80 0.68 0.85 158 XMBrknScrpt_02 2770 0.95 1.29 0.78 159 TR_XM_SpammyWords2 2719 4.06 11.07 0.77 160 TooManyTo_005 2714 0.62 0.29 0.77 161 XM_B_SEO 2713 0.80 0.85 0.77 162 RCVD_IN_RP_CERTIFIED 2702 0.71 0.58 0.77 163 RCVD_IN_MSPIKE_L3 2656 1.13 1.95 0.75 164 XMGenDplmaNmb 2509 0.93 1.39 0.71 165 XM_UB50 2438 1.44 3.05 0.69 166 FROM_GOV_DKIM_AU 2437 0.51 0.12 0.69 167 XMBody_95 2431 0.54 0.24 0.69 168 TR_MetaPhish_Combo_01 2422 0.81 1.06 0.69 169 FVGT_m_MULTI_ODD_EMAIL 2410 0.50 0.11 0.68 170 XMLngstWrd_01 2408 2.55 6.53 0.68 171 TR_XM_Base64_L2 2379 1.81 4.24 0.67 172 T_XMDrugObfuBody_00 2370 1.03 1.79 0.67 173 XM_ProductURIs 2357 0.73 0.88 0.67 174 MSGID_NOFQDN1 2323 0.45 0.02 0.66 175 XMBdyGiftCard01 2321 0.80 1.09 0.66 176 XMPhish30 2267 0.77 1.05 0.64 177 XM_Body_Dirty_Words_01 2183 0.70 0.88 0.62 178 SpammyFromTLD_01 2163 1.48 3.32 0.61 179 XM_B_SpammyWords4 2121 1.15 2.34 0.60 180 T_FILL_THIS_FORM_SHORT 2104 1.17 2.38 0.60 181 HTML_TAG_BALANCE_BODY 2049 0.79 1.24 0.58 182 HTML_IMAGE_ONLY_08 2014 0.40 0.05 0.57 183 RCVD_IN_MSPIKE_H5 1980 0.43 0.14 0.56 184 SpammyFromTLD_02 1962 1.42 3.26 0.56 185 XM_ShortIntro_01 1952 0.49 0.35 0.55 186 XM_D_tchamptons_WL 1950 0.38 0.01 0.55 187 RCVD_IN_MSPIKE_L4 1906 0.65 0.89 0.54 188 RELAYCOUNTRY_GB 1904 0.56 0.61 0.54 189 XM_B_COPY_HTML 1883 0.60 0.75 0.53 190 HTTPS_HTTP_MISMATCH 1865 0.79 1.35 0.53 191 XMHTML_After_End 1854 0.70 1.08 0.53 192 T_OBFU_PDF_ATTACH 1850 0.39 0.09 0.52 193 TR_XM_SpammyWords3 1846 1.35 3.12 0.52 194 T_HTML_ATTACH 1832 0.39 0.11 0.52 195 XMLngstWrd_02 1784 2.40 6.44 0.51 196 XMBody_17 1760 0.97 1.97 0.50 197 T_MANY_PILL_PRICE 1735 0.34 0.01 0.49 198 HTML_OBFUSCATE_20_30 1691 0.33 0.02 0.48 199 RCVD_IN_BL_SPAMCOP_NET 1690 3.95 11.37 0.48 200 XM_B_DNDMA 1670 0.69 1.16 0.47 ----------------------------------------------------------------------