Email: 523845 Autolearn: 0 AvgScore: 3.79 AvgScanTime: 1.28 sec Spam: 159646 Autolearn: 0 AvgScore: 13.77 AvgScanTime: 1.42 sec Ham: 364199 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 1.22 sec Time Spent Running SA: 186.02 hours Time Spent Processing Spam: 62.81 hours Time Spent Processing Ham: 123.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146984 87.68 92.07 85.76 2 DKIM_SIGNED 140900 78.20 88.26 73.79 3 XM_DK_Pass 133970 75.88 83.92 72.35 4 DKIM_VALID 132724 74.84 83.14 71.21 5 XM_B_Unicode 131483 72.83 82.36 68.65 6 T_SCC_BODY_TEXT_LINE 129729 82.49 81.26 83.02 7 RELAYCOUNTRY_US 127863 80.52 80.09 80.71 8 DCC_CHECK 117695 43.70 73.72 30.54 9 XM_B_SpammyWords 111780 51.77 70.02 43.77 10 XMListUnsubscribeExists 107254 53.29 67.18 47.20 11 DKIM_VALID_AU 101053 58.35 63.30 56.18 12 XM_B_Unicode3 70926 40.58 44.43 38.90 13 XM_DK_Undo_02 69991 17.13 43.84 5.42 14 XM_B_SpammyWords2 63837 24.00 39.99 16.99 15 BAYES_50 61574 52.34 38.57 58.38 16 LOC_TINY_FONT_1 58981 26.87 36.94 22.45 17 HTML_FONT_LOW_CONTRAST 57640 28.95 36.10 25.81 18 BAYES_99 56709 13.91 35.52 4.44 19 TR_XM_DKIM_Undo 54174 11.96 33.93 2.33 20 MIME_HTML_ONLY 51377 22.90 32.18 18.83 21 DKIM_VALID_EF 49516 29.15 31.02 28.33 22 FVGT_m_MULTI_ODD 49182 26.71 30.81 24.91 23 BAYES_999 44626 10.91 27.95 3.44 24 T_KAM_HTML_FONT_INVALID 43660 22.22 27.35 19.97 25 DCC_CHECK_NEGATIVE 41920 56.26 26.26 69.41 26 TR_DCC_Bayes_99 40160 8.64 25.16 1.40 27 XMSubLong 37567 23.13 23.53 22.95 28 T_TM2_M_HEADER_IN_MSG 36201 27.78 22.68 30.02 29 TR_XM_DK_Unsub 33661 15.22 21.08 12.65 30 RELAYCOUNTRY_META 31595 8.83 19.79 4.03 31 RCVD_IN_MSPIKE_H2 29304 18.43 18.36 18.46 32 XM_Multi_Part_URI 28159 14.70 17.64 13.41 33 XM_B_Unsub 27683 11.00 17.34 8.22 34 TR_XM_BayesUnsub 26726 9.67 16.74 6.57 35 BOTNET_IPINHOSTNAME 24166 7.43 15.14 4.05 36 LOTS_OF_MONEY 23297 8.30 14.59 5.54 37 FSL_BULK_SIG 22625 6.55 14.17 3.21 38 XM_Body_Dirty_Words 22511 7.98 14.10 5.29 39 TR_XM_SpammyRelay 21991 5.69 13.77 2.15 40 XM_B_SpammyWords3 21493 7.09 13.46 4.29 41 UNPARSEABLE_RELAY 21449 11.18 13.44 10.19 42 TR_XM_SpammyWords2 21195 4.34 13.28 0.43 43 TR_XM_SpammyWords4 19888 6.21 12.46 3.48 44 RCVD_IN_BL_SPAMCOP_NET 18590 4.04 11.64 0.71 45 BOTNET 17891 4.17 11.21 1.09 46 XM_Evil_Numbers_Gen 15316 8.29 9.59 7.71 47 RELAYCOUNTRY_CA 14209 3.42 8.90 1.02 48 BAYES_80 13907 5.60 8.71 4.24 49 TR_XM_SPAMCOP 13314 2.74 8.34 0.28 50 XMSexyCombo_05 13234 3.81 8.29 1.84 51 UNTRUSTED_Relay 13099 3.54 8.21 1.49 52 HTML_IMAGE_RATIO_02 12933 5.64 8.10 4.56 53 RCVD_IN_MSPIKE_WL 12506 6.92 7.83 6.52 54 RCVD_IN_MSPIKE_H3 12505 6.90 7.83 6.49 55 XMSubMetaSx_00 12443 5.56 7.79 4.59 56 BAYES_60 11896 8.38 7.45 8.78 57 LotsOfNums_01 11238 8.07 7.04 8.53 58 TR_XM_UnparsRelay 11205 3.31 7.02 1.69 59 XM_UncommonTLD01 9825 4.45 6.15 3.71 60 HTML_IMAGE_RATIO_04 9734 4.74 6.10 4.14 61 XM_H_Long_From01 9143 5.59 5.73 5.54 62 TooManyTo_001 8635 7.92 5.41 9.02 63 BAYES_95 8513 3.45 5.33 2.62 64 MPART_ALT_DIFF 8320 4.55 5.21 4.27 65 DKIM_INVALID 8176 3.36 5.12 2.58 66 TR_XM_SpammyWords5 8029 2.46 5.03 1.33 67 HTML_IMAGE_RATIO_06 7623 3.78 4.77 3.34 68 XM_B_Phish_Phrases 7404 3.84 4.64 3.50 69 XM_B_Investor 7237 2.62 4.53 1.78 70 XMBody_17 6873 1.63 4.31 0.45 71 XMNumbers 6765 3.09 4.24 2.59 72 TR_XM_PhishingBody 6407 2.35 4.01 1.62 73 T_XMDrugObfuBody_08 6355 2.47 3.98 1.81 74 MIME_HTML_MOSTLY 6095 2.88 3.82 2.47 75 XM_SPF_SoftFail 5919 3.37 3.71 3.23 76 XM_UB50 5859 1.71 3.67 0.85 77 MIME_QP_LONG_LINE 5675 4.76 3.55 5.28 78 TM2_M_URI_OPT_OUT 5605 2.38 3.51 1.88 79 XM_OfRef6 5593 1.84 3.50 1.11 80 XM_B_SpammyTLD 5585 2.77 3.50 2.46 81 XMStrtUSub 5373 3.91 3.37 4.14 82 SUBJ_ALL_CAPS 5359 1.97 3.36 1.36 83 T_XMDrugObfuBody_14 5258 2.10 3.29 1.58 84 MIME_HTML_ONLY_MULTI 5254 2.73 3.29 2.49 85 T_FILL_THIS_FORM_SHORT 4973 1.58 3.12 0.90 86 RCVD_IN_VALIDITY_SAFE 4943 3.56 3.10 3.76 87 RCVD_IN_PSBL 4934 1.02 3.09 0.12 88 SpammyFromTLD_01 4769 1.50 2.99 0.85 89 HTML_MIME_NO_HTML_TAG 4739 2.56 2.97 2.38 90 HTML_IMAGE_RATIO_08 4553 2.56 2.85 2.44 91 TM2_M_VERY_LONG_WORD 4541 1.65 2.84 1.12 92 TR_XM_BayesRelay 4506 0.86 2.82 0.00 93 USER_IN_DEF_DKIM_WL 4133 8.54 2.59 11.15 94 XM_B_Unsub2 4102 1.81 2.57 1.48 95 RCVD_IN_VALIDITY_CERTIFIED 4017 3.03 2.52 3.26 96 XM_B_SpammyWords4 3973 1.21 2.49 0.65 97 TR_XM_NoHeaderRelay 3873 0.84 2.43 0.14 98 XM_URI_RBL 3872 0.85 2.43 0.15 99 XMDiploma_00 3744 1.81 2.35 1.58 100 XM_CamelCaseFrm001 3693 2.10 2.31 2.00 101 RELAYCOUNTRY_AU 3634 1.19 2.28 0.72 102 XM_DIRTYINTL 3616 0.85 2.27 0.24 103 XM_H_Undi_Recip 3588 0.87 2.25 0.26 104 FROM_EXCESS_BASE64 3484 1.99 2.18 1.91 105 HK_RANDOM_REPLYTO 3392 0.71 2.12 0.09 106 HTML_TAG_BALANCE_BODY 3349 0.93 2.10 0.42 107 KHOP_HELO_FCRDNS 3332 1.63 2.09 1.43 108 TR_XM_INV_DKIM 3239 0.66 2.03 0.07 109 RELAYCOUNTRY_RO 3207 0.62 2.01 0.01 110 MAILING_LIST_MULTI 3194 2.85 2.00 3.23 111 RCVD_IN_VALIDITY_RPBL 3187 0.64 2.00 0.05 112 T_TooManySym_01 3186 4.33 2.00 5.36 113 T_XMHurry_00 3100 0.96 1.94 0.53 114 BOTNET_NORDNS 3061 0.59 1.92 0.01 115 XMStockSpam_06 2932 1.19 1.84 0.91 116 XMSubMetaSxObfu_02 2897 0.82 1.81 0.39 117 XM_H_Long_From02 2845 1.21 1.78 0.96 118 TR_XM_PHPDW 2817 0.78 1.76 0.34 119 T_XMDrugObfuBody_00 2795 0.96 1.75 0.61 120 TR_XM_PHPForged 2784 0.77 1.74 0.35 121 TR_Caps_n_Bayes_99 2775 0.54 1.74 0.02 122 T_XMDrugObfuBody_12 2724 0.69 1.71 0.24 123 T_REMOTE_IMAGE 2720 3.02 1.70 3.60 124 TR_XM_FormFill2 2691 0.74 1.69 0.33 125 XM_DK_Undo_01 2676 1.90 1.68 1.99 126 XM_H_PHPOS 2667 0.73 1.67 0.32 127 TR_XM_FormFill 2648 0.51 1.66 0.01 128 SpammyFromTLD_02 2638 0.79 1.65 0.41 129 XMReplyNow 2636 0.68 1.65 0.25 130 TR_Mismatch_TLD_02 2634 0.57 1.65 0.09 131 TR_XM_Undi_Recip5 2612 0.51 1.64 0.01 132 LOADSA_MONEY_COMBO 2551 0.52 1.60 0.05 133 BAYES_40 2525 3.76 1.58 4.71 134 RCVD_IN_IADB_LISTED 2516 3.83 1.58 4.82 135 URI_HEX 2463 1.25 1.54 1.13 136 TR_LOTS_OF_MONEY3 2457 0.73 1.54 0.37 137 XM_SendGrid 2435 1.36 1.53 1.29 138 ANY_BOUNCE_MESSAGE 2409 3.42 1.51 4.26 139 BOUNCE_MESSAGE 2407 3.42 1.51 4.26 140 TR_XM_Undi_RecipCombo2 2338 0.45 1.46 0.00 141 URI_TRY_3LD 2299 0.86 1.44 0.61 142 PHOTO_EDITING_DIRECT 2288 0.44 1.43 0.00 143 XMBdyGiftCard01 2272 0.90 1.42 0.68 144 RCVD_IN_IADB_SPF 2266 3.38 1.42 4.24 145 UNDISC_MONEY 2236 0.43 1.40 0.01 146 TR_XM_Undi_Recip2 2196 0.44 1.38 0.04 147 BAYES_20 2182 2.87 1.37 3.52 148 FONT_INVIS_LONG_LINE 2158 0.45 1.35 0.05 149 TR_XM_Base64_M1 2152 0.90 1.35 0.70 150 XM_UB99 2152 0.41 1.35 0.00 151 XMGenDplmaNmb 2148 0.98 1.35 0.81 152 RCVD_IN_IADB_DK 2148 2.97 1.35 3.68 153 XMPhish30 2146 0.74 1.34 0.47 154 RCVD_IN_IADB_SENDERID 2141 3.03 1.34 3.78 155 SCC_BODY_URI_ONLY 2135 2.04 1.34 2.34 156 XFER_LOTSA_MONEY 2113 0.42 1.32 0.03 157 HTTPS_HTTP_MISMATCH 2075 1.06 1.30 0.96 158 XMSexyCombo_01 2062 0.56 1.29 0.25 159 XM_HighProb1 2038 0.39 1.28 0.00 160 XMSlimDrugH 1968 0.64 1.23 0.38 161 TR_LOTS_OF_MONEY2 1952 0.54 1.22 0.24 162 T_MONEY_PERCENT 1952 0.54 1.22 0.24 163 XMHTML_After_End 1918 0.84 1.20 0.68 164 XM_ProductURIs 1880 0.84 1.18 0.70 165 AC_BR_BONANZA 1856 0.40 1.16 0.06 166 XMSubMetaI_00 1836 0.77 1.15 0.60 167 ALL_TRUSTED 1828 11.75 1.15 16.40 168 TR_XM_Undi_Recip11 1817 0.38 1.14 0.04 169 HK_SCAM 1793 0.35 1.12 0.01 170 TR_Sbj_FN_Bdy 1768 0.44 1.11 0.14 171 DATE_IN_PAST_06_12 1743 0.38 1.09 0.07 172 DKIM_ADSP_NXDOMAIN 1721 0.49 1.08 0.23 173 XM_UB80 1682 0.33 1.05 0.01 174 URI_NOVOWEL 1660 1.70 1.04 1.99 175 TR_XM_DK_SendGrid 1638 0.90 1.03 0.84 176 XM_UB60 1635 0.37 1.02 0.08 177 RDNS_DYNAMIC 1635 0.56 1.02 0.35 178 TR_XM_InvalidRelay 1629 0.33 1.02 0.03 179 RELAYCOUNTRY_FR 1627 0.46 1.02 0.22 180 TR_XM_Undi_Recip6 1566 0.30 0.98 0.00 181 TR_Symld_Words 1552 1.42 0.97 1.61 182 XMPhish14 1536 0.62 0.96 0.47 183 TR_MetaPhish_Combo_01 1523 0.82 0.95 0.76 184 XM_B_DNDMA 1512 0.67 0.95 0.54 185 DATE_IN_PAST_03_06 1459 0.47 0.91 0.27 186 XMBody_78 1437 0.55 0.90 0.39 187 ADVANCE_FEE_5_NEW_MONEY 1431 0.27 0.90 0.00 188 XM_B_Phish66 1387 0.51 0.87 0.35 189 PDS_OTHER_BAD_TLD 1385 0.35 0.87 0.13 190 XMBrknScrpt_02 1363 0.90 0.85 0.92 191 SUBJ_DOLLARS 1361 0.52 0.85 0.37 192 TVD_RCVD_IP 1352 1.34 0.85 1.55 193 XM_B_COVIDMETA 1338 0.41 0.84 0.22 194 PLING_QUERY 1326 0.59 0.83 0.49 195 MILLION_USD 1304 0.25 0.82 0.00 196 XM_UB95 1298 0.25 0.81 0.01 197 MONEY_FRAUD_8 1297 0.25 0.81 0.00 198 URIBL_BLACK 1290 0.27 0.81 0.04 199 T_Symld_Words_02 1287 0.68 0.81 0.62 200 DIET_1 1285 0.39 0.80 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312347 87.68 92.07 85.76 2 T_SCC_BODY_TEXT_LINE 302367 82.49 81.26 83.02 3 RELAYCOUNTRY_US 293959 80.52 80.09 80.71 4 DKIM_SIGNED 268747 78.20 88.26 73.79 5 XM_DK_Pass 263508 75.88 83.92 72.35 6 DKIM_VALID 259335 74.84 83.14 71.21 7 DCC_CHECK_NEGATIVE 252782 56.26 26.26 69.41 8 XM_B_Unicode 250029 72.83 82.36 68.65 9 BAYES_50 212620 52.34 38.57 58.38 10 DKIM_VALID_AU 204591 58.35 63.30 56.18 11 XMListUnsubscribeExists 171892 53.29 67.18 47.20 12 XM_B_SpammyWords 159407 51.77 70.02 43.77 13 XM_B_Unicode3 141668 40.58 44.43 38.90 14 DCC_CHECK 111240 43.70 73.72 30.54 15 T_TM2_M_HEADER_IN_MSG 109334 27.78 22.68 30.02 16 DKIM_VALID_EF 103167 29.15 31.02 28.33 17 HTML_FONT_LOW_CONTRAST 93988 28.95 36.10 25.81 18 FVGT_m_MULTI_ODD 90733 26.71 30.81 24.91 19 XMSubLong 83585 23.13 23.53 22.95 20 LOC_TINY_FONT_1 81756 26.87 36.94 22.45 21 T_KAM_HTML_FONT_INVALID 72719 22.22 27.35 19.97 22 MIME_HTML_ONLY 68576 22.90 32.18 18.83 23 RCVD_IN_MSPIKE_H2 67247 18.43 18.36 18.46 24 XM_B_SpammyWords2 61867 24.00 39.99 16.99 25 ALL_TRUSTED 59727 11.75 1.15 16.40 26 XM_Multi_Part_URI 48846 14.70 17.64 13.41 27 TR_XM_DK_Unsub 46053 15.22 21.08 12.65 28 USER_IN_DEF_DKIM_WL 40606 8.54 2.59 11.15 29 BAYES_00 38333 7.54 0.75 10.53 30 UNPARSEABLE_RELAY 37117 11.18 13.44 10.19 31 TooManyTo_001 32861 7.92 5.41 9.02 32 BAYES_60 31984 8.38 7.45 8.78 33 LotsOfNums_01 31052 8.07 7.04 8.53 34 XM_B_Unsub 29950 11.00 17.34 8.22 35 XM_Evil_Numbers_Gen 28086 8.29 9.59 7.71 36 XM_DKIMWhitelistDomains 27969 5.36 0.08 7.68 37 IN_ZIMBRA_NJ_WHITELIST 25493 4.89 0.09 7.00 38 TR_XM_DK_Bayes 24754 4.87 0.48 6.80 39 TR_XM_DK_Bayes1 24251 4.78 0.48 6.66 40 TR_XM_BayesUnsub 23914 9.67 16.74 6.57 41 RCVD_IN_MSPIKE_WL 23736 6.92 7.83 6.52 42 RCVD_IN_MSPIKE_H3 23619 6.90 7.83 6.49 43 TR_XM_DK_Bayes2 20726 4.08 0.39 5.69 44 LOTS_OF_MONEY 20192 8.30 14.59 5.54 45 XM_H_Long_From01 20162 5.59 5.73 5.54 46 XM_DK_Undo_02 19724 17.13 43.84 5.42 47 T_TooManySym_01 19516 4.33 2.00 5.36 48 XM_Body_Dirty_Words 19270 7.98 14.10 5.29 49 MIME_QP_LONG_LINE 19242 4.76 3.55 5.28 50 XM_PDF 18047 3.62 0.57 4.96 51 RCVD_IN_IADB_LISTED 17541 3.83 1.58 4.82 52 BAYES_40 17157 3.76 1.58 4.71 53 XMSubMetaSx_00 16702 5.56 7.79 4.59 54 HTML_IMAGE_RATIO_02 16612 5.64 8.10 4.56 55 BAYES_99 16180 13.91 35.52 4.44 56 XM_B_SpammyWords3 15624 7.09 13.46 4.29 57 MPART_ALT_DIFF 15538 4.55 5.21 4.27 58 ANY_BOUNCE_MESSAGE 15525 3.42 1.51 4.26 59 BOUNCE_MESSAGE 15522 3.42 1.51 4.26 60 BAYES_80 15435 5.60 8.71 4.24 61 RCVD_IN_IADB_SPF 15434 3.38 1.42 4.24 62 XMStrtUSub 15088 3.91 3.37 4.14 63 HTML_IMAGE_RATIO_04 15075 4.74 6.10 4.14 64 BOTNET_IPINHOSTNAME 14768 7.43 15.14 4.05 65 RELAYCOUNTRY_META 14679 8.83 19.79 4.03 66 RCVD_IN_IADB_SENDERID 13757 3.03 1.34 3.78 67 RCVD_IN_VALIDITY_SAFE 13708 3.56 3.10 3.76 68 XM_UncommonTLD01 13512 4.45 6.15 3.71 69 RCVD_IN_IADB_DK 13398 2.97 1.35 3.68 70 T_REMOTE_IMAGE 13104 3.02 1.70 3.60 71 BAYES_20 12833 2.87 1.37 3.52 72 XM_B_Phish_Phrases 12737 3.84 4.64 3.50 73 TR_XM_SpammyWords4 12668 6.21 12.46 3.48 74 BAYES_999 12537 10.91 27.95 3.44 75 HTML_IMAGE_RATIO_06 12167 3.78 4.77 3.34 76 RCVD_IN_VALIDITY_CERTIFIED 11872 3.03 2.52 3.26 77 MAILING_LIST_MULTI 11753 2.85 2.00 3.23 78 XM_SPF_SoftFail 11749 3.37 3.71 3.23 79 FSL_BULK_SIG 11708 6.55 14.17 3.21 80 RCVD_IN_IADB_VOUCHED 11121 2.33 0.69 3.05 81 BAYES_05 10099 2.15 0.72 2.77 82 TooManyTo_002 10050 2.07 0.51 2.76 83 T_TooManySym_02 9931 2.05 0.50 2.73 84 BAYES_95 9558 3.45 5.33 2.62 85 XMNumbers 9419 3.09 4.24 2.59 86 DKIM_INVALID 9412 3.36 5.12 2.58 87 MIME_HTML_ONLY_MULTI 9072 2.73 3.29 2.49 88 MIME_HTML_MOSTLY 8995 2.88 3.82 2.47 89 XM_B_SpammyTLD 8942 2.77 3.50 2.46 90 HTML_IMAGE_RATIO_08 8881 2.56 2.85 2.44 91 HTML_MIME_NO_HTML_TAG 8651 2.56 2.97 2.38 92 SCC_BODY_URI_ONLY 8530 2.04 1.34 2.34 93 TR_XM_DKIM_Undo 8477 11.96 33.93 2.33 94 TR_XM_SpammyRelay 7828 5.69 13.77 2.15 95 RCVD_IN_IADB_OPTIN 7734 1.61 0.43 2.12 96 XM_CamelCaseFrm001 7295 2.10 2.31 2.00 97 XM_DK_Undo_01 7265 1.90 1.68 1.99 98 URI_NOVOWEL 7239 1.70 1.04 1.99 99 INVALID_MSGID 7179 1.42 0.17 1.97 100 FROM_EXCESS_BASE64 6949 1.99 2.18 1.91 101 HELO_NODOT 6893 1.37 0.18 1.89 102 HELO_NO_DOMAIN 6888 1.37 0.18 1.89 103 TM2_M_URI_OPT_OUT 6842 2.38 3.51 1.88 104 XMSexyCombo_05 6716 3.81 8.29 1.84 105 T_XMDrugObfuBody_08 6593 2.47 3.98 1.81 106 XM_B_Investor 6490 2.62 4.53 1.78 107 TR_XM_UnparsRelay 6152 3.31 7.02 1.69 108 TO_MALFORMED 6140 1.18 0.02 1.69 109 TR_XM_PhishingBody 5887 2.35 4.01 1.62 110 TR_Symld_Words 5862 1.42 0.97 1.61 111 TooManyTo_003 5759 1.23 0.43 1.58 112 XMDiploma_00 5754 1.81 2.35 1.58 113 T_XMDrugObfuBody_14 5739 2.10 3.29 1.58 114 TVD_RCVD_IP 5658 1.34 0.85 1.55 115 UNTRUSTED_Relay 5429 3.54 8.21 1.49 116 XM_B_Unsub2 5381 1.81 2.57 1.48 117 IN_HORDE_ADDRESS_BOOK 5343 1.05 0.09 1.47 118 KHOP_HELO_FCRDNS 5195 1.63 2.09 1.43 119 TR_DCC_Bayes_99 5108 8.64 25.16 1.40 120 XMGappySubj_01 5049 1.03 0.22 1.39 121 SUBJ_ALL_CAPS 4955 1.97 3.36 1.36 122 XM_H_Trusted_IP 4902 0.94 0.00 1.35 123 TR_XM_SpammyWords5 4856 2.46 5.03 1.33 124 XM_GoogleGroups 4812 1.09 0.56 1.32 125 XMCapTrack 4778 1.04 0.42 1.31 126 XM_SendGrid 4700 1.36 1.53 1.29 127 XMSubNoVowel 4654 1.02 0.43 1.28 128 TooManyTo_004 4175 0.92 0.39 1.15 129 URI_HEX 4107 1.25 1.54 1.13 130 TM2_M_VERY_LONG_WORD 4079 1.65 2.84 1.12 131 XM_OfRef6 4056 1.84 3.50 1.11 132 XMBody_95 3989 0.82 0.19 1.10 133 XMBSHREFv2 3980 0.85 0.29 1.09 134 BOTNET 3976 4.17 11.21 1.09 135 TVD_SPACE_RATIO 3845 0.76 0.09 1.06 136 XMNoVowels 3745 0.84 0.41 1.03 137 RELAYCOUNTRY_CA 3705 3.42 8.90 1.02 138 DKIM_ADSP_CUSTOM_MED 3637 0.93 0.76 1.00 139 T_TooManySym_03 3540 0.74 0.20 0.97 140 TooManyTo_005 3499 0.78 0.35 0.96 141 XM_H_Long_From02 3495 1.21 1.78 0.96 142 HTTPS_HTTP_MISMATCH 3479 1.06 1.30 0.96 143 XMBrknScrpt_02 3344 0.90 0.85 0.92 144 XMStockSpam_06 3323 1.19 1.84 0.91 145 T_FILL_THIS_FORM_SHORT 3281 1.58 3.12 0.90 146 SpammyFromTLD_01 3081 1.50 2.99 0.85 147 XM_UB50 3078 1.71 3.67 0.85 148 TR_XM_DK_SendGrid 3065 0.90 1.03 0.84 149 XM_ShortIntro_01 3059 0.71 0.43 0.84 150 XMGappySubj_02 2969 0.59 0.08 0.82 151 XMGenDplmaNmb 2961 0.98 1.35 0.81 152 TR_MetaPhish_Combo_01 2750 0.82 0.95 0.76 153 RCVD_IN_RP_SAFE 2722 0.72 0.64 0.75 154 RELAYCOUNTRY_AU 2625 1.19 2.28 0.72 155 RCVD_IN_BL_SPAMCOP_NET 2593 4.04 11.64 0.71 156 T_OBFU_PDF_ATTACH 2587 0.53 0.13 0.71 157 XM_B_COPY_HTML 2559 0.73 0.79 0.70 158 TR_XM_Base64_M1 2550 0.90 1.35 0.70 159 XM_ProductURIs 2537 0.84 1.18 0.70 160 XM_H_PHPMailer 2535 0.68 0.63 0.70 161 XMHTML_After_End 2494 0.84 1.20 0.68 162 XMBdyGiftCard01 2460 0.90 1.42 0.68 163 XMLngstWrd_00 2429 0.61 0.47 0.67 164 XMMoneyMeta_00 2425 0.68 0.72 0.67 165 XM_B_SpammyWords4 2382 1.21 2.49 0.65 166 RCVD_IN_RP_CERTIFIED 2348 0.61 0.52 0.64 167 MSGID_NOFQDN1 2347 0.45 0.01 0.64 168 FROM_GOV_DKIM_AU 2273 0.49 0.18 0.62 169 T_Symld_Words_02 2267 0.68 0.81 0.62 170 NML_ADSP_CUSTOM_MED 2260 0.61 0.59 0.62 171 URI_TRY_3LD 2222 0.86 1.44 0.61 172 T_XMDrugObfuBody_00 2214 0.96 1.75 0.61 173 XMSubMetaI_00 2202 0.77 1.15 0.60 174 TO_NO_BRKTS_HTML_ONLY 2175 0.49 0.26 0.60 175 FORGED_GMAIL_RCVD 2153 0.60 0.63 0.59 176 FILL_THIS_FORM 2113 0.58 0.59 0.58 177 SHORT_HELO_AND_INLINE_IMAGE 2074 0.41 0.04 0.57 178 XM_B_DNDMA 1980 0.67 0.95 0.54 179 XMSubEmpty 1953 0.41 0.11 0.54 180 T_XMHurry_00 1943 0.96 1.94 0.53 181 RELAYCOUNTRY_GB 1829 0.57 0.71 0.50 182 PLING_QUERY 1785 0.59 0.83 0.49 183 USER_IN_WELCOMELIST 1772 0.34 0.00 0.49 184 USER_IN_WHITELIST 1772 0.34 0.00 0.49 185 XM_B_FormFill 1741 0.34 0.02 0.48 186 MISSING_HEADERS 1740 0.47 0.45 0.48 187 MPART_ALT_DIFF_COUNT 1723 0.56 0.74 0.47 188 XMPhish30 1716 0.74 1.34 0.47 189 XMPhish14 1703 0.62 0.96 0.47 190 RCVD_IN_SORBS_DUL 1682 0.35 0.08 0.46 191 HTML_IMAGE_ONLY_20 1677 0.38 0.20 0.46 192 XMDateMe_00 1672 0.45 0.41 0.46 193 HTML_IMAGE_ONLY_32 1659 0.35 0.11 0.46 194 HTML_IMAGE_ONLY_28 1648 0.39 0.24 0.45 195 XMBody_17 1640 1.63 4.31 0.45 196 XMLngstWrd_01 1611 0.38 0.24 0.44 197 TM2_M_BODY_EMPTY 1605 0.49 0.62 0.44 198 TR_XM_SpammyWords2 1557 4.34 13.28 0.43 199 HTML_TAG_BALANCE_BODY 1526 0.93 2.10 0.42 200 HTML_FONT_FACE_BAD 1503 0.50 0.71 0.41 ----------------------------------------------------------------------