Email: 504648 Autolearn: 0 AvgScore: 4.21 AvgScanTime: 1.03 sec Spam: 164248 Autolearn: 0 AvgScore: 13.10 AvgScanTime: 1.07 sec Ham: 340400 Autolearn: 0 AvgScore: -0.07 AvgScanTime: 1.01 sec Time Spent Running SA: 144.11 hours Time Spent Processing Spam: 48.87 hours Time Spent Processing Ham: 95.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 150512 76.44 91.64 69.11 2 XM_DK_Pass 144766 74.33 88.14 67.67 3 DKIM_VALID 143244 73.43 87.21 66.79 4 HTML_MESSAGE 134867 83.04 82.11 83.49 5 RELAYCOUNTRY_US 132570 76.22 80.71 74.05 6 XMListUnsubscribeExists 125040 56.20 76.13 46.59 7 XM_B_Unicode 120498 70.65 73.36 69.34 8 DKIM_VALID_AU 112837 58.92 68.70 54.20 9 XM_B_SpammyWords 102529 47.04 62.42 39.62 10 DCC_CHECK 100242 40.94 61.03 31.24 11 XM_B_Unicode3 64877 38.58 39.50 38.14 12 DCC_CHECK_NEGATIVE 63984 59.03 38.96 68.72 13 BAYES_50 62345 51.09 37.96 57.43 14 XM_DK_Undo_02 60812 15.90 37.02 5.70 15 XM_B_SpammyWords2 59854 23.36 36.44 17.04 16 LOC_TINY_FONT_1 54170 26.81 32.98 23.83 17 HTML_FONT_LOW_CONTRAST 50690 27.77 30.86 26.28 18 BAYES_99 48280 12.67 29.39 4.60 19 TR_XM_DKIM_Undo 47203 10.76 28.74 2.09 20 FVGT_m_MULTI_ODD 46246 25.93 28.16 24.86 21 DKIM_VALID_EF 44449 27.13 27.06 27.17 22 MIME_HTML_ONLY 43465 24.72 26.46 23.88 23 XMSubLong 41278 22.64 25.13 21.44 24 RCVD_IN_MSPIKE_H2 41243 25.08 25.11 25.07 25 T_KAM_HTML_FONT_INVALID 39189 20.63 23.86 19.07 26 BAYES_999 37232 9.79 22.67 3.57 27 TR_DCC_Bayes_99 33651 7.64 20.49 1.44 28 TR_XM_DK_Unsub 32994 15.42 20.09 13.17 29 XM_UncommonTLD01 32932 12.32 20.05 8.59 30 T_TM2_M_HEADER_IN_MSG 31396 24.19 19.11 26.64 31 RELAYCOUNTRY_META 29883 8.85 18.19 4.34 32 XMNumbers 29712 7.64 18.09 2.60 33 XM_Multi_Part_URI 27591 14.76 16.80 13.77 34 SpammyFromTLD_01 27250 5.91 16.59 0.75 35 TR_XM_PHPDW 26728 5.65 16.27 0.52 36 TR_XM_PHPForged 26724 5.64 16.27 0.51 37 TR_XM_FormFill2 26655 5.64 16.23 0.52 38 XM_H_PHPOS 26642 5.62 16.22 0.50 39 TM2_M_BODY_EMPTY 24305 5.08 14.80 0.40 40 XMEmptyBody_01 24234 4.85 14.75 0.08 41 TR_XM_SpammyRelay 23082 6.09 14.05 2.25 42 XM_B_Unsub 22688 9.18 13.81 6.94 43 TR_XM_BayesUnsub 21789 7.91 13.27 5.33 44 TR_MAX_INTL_RELAY 21587 8.70 13.14 6.56 45 BOTNET_IPINHOSTNAME 21350 6.98 13.00 4.07 46 XM_B_SpammyWords3 19458 6.89 11.85 4.50 47 LOTS_OF_MONEY 19135 8.17 11.65 6.49 48 XM_SPF_SoftFail 18836 9.35 11.47 8.33 49 TR_XM_SpammyWords2 18586 3.95 11.32 0.39 50 UNPARSEABLE_RELAY 18547 10.32 11.29 9.85 51 TR_XM_SpammyWords4 17174 6.44 10.46 4.50 52 RCVD_IN_BL_SPAMCOP_NET 16268 3.66 9.90 0.64 53 BOTNET 15708 4.02 9.56 1.35 54 RELAYCOUNTRY_CA 15645 3.98 9.53 1.31 55 TR_XM_SPAMCOP 13405 2.84 8.16 0.28 56 BAYES_80 13257 5.35 8.07 4.04 57 XM_Evil_Numbers_Gen 12472 7.18 7.59 6.99 58 BAYES_40 12413 6.93 7.56 6.62 59 RCVD_IN_MSPIKE_WL 11891 6.03 7.24 5.44 60 RCVD_IN_MSPIKE_H3 11891 6.02 7.24 5.44 61 BAYES_60 11484 8.25 6.99 8.86 62 TooManyTo_001 11165 7.72 6.80 8.17 63 FSL_BULK_SIG 10987 4.14 6.69 2.91 64 MPART_ALT_DIFF 10880 4.64 6.62 3.68 65 UNTRUSTED_Relay 10673 3.10 6.50 1.47 66 XM_Body_Dirty_Words 10167 4.18 6.19 3.21 67 TR_XM_UnparsRelay 9755 2.88 5.94 1.40 68 XMBody_17 9447 2.32 5.75 0.67 69 LotsOfNums_01 9048 6.72 5.51 7.30 70 HTML_IMAGE_RATIO_02 8153 5.06 4.96 5.11 71 XMSubMetaSx_00 7698 3.72 4.69 3.25 72 BAYES_95 7670 3.22 4.67 2.52 73 HTML_IMAGE_RATIO_04 7446 4.03 4.53 3.79 74 XM_H_Long_From01 7380 4.73 4.49 4.85 75 DKIM_INVALID 7268 3.01 4.43 2.33 76 XM_H_GMP 6972 5.67 4.24 6.36 77 TR_XM_SpammyWords5 6559 2.12 3.99 1.21 78 XM_B_Phish_Phrases 6480 3.31 3.95 3.00 79 T_FILL_THIS_FORM_SHORT 6473 1.94 3.94 0.97 80 BAYES_20 6450 3.81 3.93 3.75 81 XM_B_Investor 6390 2.34 3.89 1.59 82 HTML_IMAGE_RATIO_06 5868 2.70 3.57 2.28 83 XMStrtUSub 5865 4.05 3.57 4.28 84 MIME_HTML_MOSTLY 5809 2.57 3.54 2.11 85 XMSexyCombo_05 5702 2.28 3.47 1.71 86 MIME_HTML_ONLY_MULTI 5564 2.64 3.39 2.28 87 T_XMDrugObfuBody_08 5459 2.47 3.32 2.06 88 XM_UB50 5353 1.63 3.26 0.85 89 MIME_QP_LONG_LINE 5336 3.92 3.25 4.25 90 T_XMDrugObfuBody_14 5308 2.13 3.23 1.60 91 XM_OfRef6 5051 1.85 3.08 1.26 92 TR_XM_PhishingBody 5017 1.86 3.05 1.28 93 XM_B_SpammyTLD 4948 2.47 3.01 2.20 94 TM2_M_VERY_LONG_WORD 4563 1.77 2.78 1.28 95 TR_XM_FormFill 4427 0.92 2.70 0.07 96 SUBJ_ALL_CAPS 4380 1.84 2.67 1.44 97 TM2_M_URI_OPT_OUT 4292 2.09 2.61 1.84 98 TR_LOTS_OF_MONEY3 4227 1.12 2.57 0.41 99 TR_XM_BayesRelay 4203 0.83 2.56 0.00 100 XM_CamelCaseFrm001 4063 2.36 2.47 2.30 101 ANY_BOUNCE_MESSAGE 4018 5.51 2.45 6.99 102 BOUNCE_MESSAGE 4016 5.51 2.45 6.99 103 XM_URI_RBL 3873 0.88 2.36 0.16 104 TR_XM_NoHeaderRelay 3833 0.84 2.33 0.11 105 RCVD_IN_VALIDITY_SAFE 3808 4.09 2.32 4.94 106 HTML_IMAGE_RATIO_08 3746 1.94 2.28 1.78 107 HK_RANDOM_REPLYTO 3535 0.76 2.15 0.09 108 USER_IN_DEF_DKIM_WL 3512 9.60 2.14 13.20 109 T_TooManySym_01 3385 4.35 2.06 5.46 110 FONT_INVIS_LONG_LINE 3371 0.68 2.05 0.02 111 RELAYCOUNTRY_AU 3139 1.28 1.91 0.98 112 XMDiploma_00 3117 1.55 1.90 1.38 113 RCVD_IN_VALIDITY_CERTIFIED 3015 3.53 1.84 4.34 114 T_REMOTE_IMAGE 2992 2.91 1.82 3.44 115 FROM_EXCESS_BASE64 2889 1.79 1.76 1.81 116 URI_TRY_3LD 2845 1.08 1.73 0.77 117 XM_B_SpammyWords4 2711 1.08 1.65 0.80 118 HTML_MIME_NO_HTML_TAG 2656 1.91 1.62 2.05 119 XMStockSpam_06 2652 1.30 1.61 1.15 120 MAILING_LIST_MULTI 2634 2.18 1.60 2.45 121 URI_HEX 2604 1.27 1.59 1.12 122 XM_B_Unsub2 2592 1.34 1.58 1.22 123 TR_XM_INV_DKIM 2498 0.54 1.52 0.06 124 XMReplyNow 2487 0.68 1.51 0.27 125 DKIM_ADSP_NXDOMAIN 2469 0.69 1.50 0.29 126 URI_NOVOWEL 2399 1.46 1.46 1.46 127 RCVD_IN_VALIDITY_RPBL 2394 0.49 1.46 0.02 128 SpammyFromTLD_02 2392 3.98 1.46 5.20 129 XMBrknScrpt_02 2380 0.90 1.45 0.63 130 T_XMHurry_00 2372 0.83 1.44 0.54 131 XM_SendGrid 2356 1.56 1.43 1.62 132 BOTNET_NORDNS 2328 0.47 1.42 0.01 133 XMHTML_After_End 2302 0.70 1.40 0.37 134 XM_DK_Undo_01 2291 1.62 1.39 1.72 135 AC_BR_BONANZA 2269 0.50 1.38 0.07 136 HTTPS_HTTP_MISMATCH 2170 0.96 1.32 0.79 137 T_XMDrugObfuBody_00 2126 0.75 1.29 0.48 138 RELAYCOUNTRY_CN 2074 0.46 1.26 0.07 139 HTML_TAG_BALANCE_BODY 2042 0.63 1.24 0.33 140 XM_HighProb1 2034 0.41 1.24 0.00 141 RCVD_IN_IADB_LISTED 1990 2.85 1.21 3.64 142 TR_XM_InvalidRelay 1919 0.40 1.17 0.02 143 ALL_TRUSTED 1902 15.60 1.16 22.57 144 TR_Mismatch_TLD_02 1850 0.40 1.13 0.05 145 XM_DIRTYINTL 1837 0.46 1.12 0.15 146 XMLngstWrd_00 1828 1.54 1.11 1.74 147 XM_H_Undi_Recip 1803 0.46 1.10 0.16 148 RCVD_IN_PSBL 1792 0.57 1.09 0.31 149 RCVD_IN_IADB_SPF 1772 2.55 1.08 3.26 150 XMPhish30 1755 0.66 1.07 0.46 151 PLING_QUERY 1746 0.72 1.06 0.56 152 XMBounce_01 1740 0.36 1.06 0.02 153 KHOP_HELO_FCRDNS 1723 0.98 1.05 0.95 154 XMGenDplmaNmb 1712 0.81 1.04 0.70 155 RCVD_IN_IADB_SENDERID 1677 2.34 1.02 2.98 156 XMSubMetaI_00 1668 0.78 1.02 0.67 157 RCVD_IN_IADB_DK 1664 2.30 1.01 2.92 158 DIET_1 1651 0.49 1.01 0.25 159 XM_UB60 1593 0.35 0.97 0.05 160 LongTLD 1580 0.45 0.96 0.20 161 THIS_AD 1563 0.56 0.95 0.37 162 XM_UB99 1529 0.31 0.93 0.00 163 XM_B_COPY_HTML 1520 0.67 0.93 0.55 164 BAYES_05 1518 2.78 0.92 3.67 165 RDNS_DYNAMIC 1517 0.51 0.92 0.32 166 TR_XM_Undi_Recip19 1516 0.36 0.92 0.09 167 TR_LOTS_OF_MONEY2 1513 0.56 0.92 0.38 168 T_MONEY_PERCENT 1513 0.56 0.92 0.38 169 MPART_ALT_DIFF_COUNT 1485 0.67 0.90 0.56 170 TR_XM_Base64_M1 1480 0.66 0.90 0.55 171 URIBL_DBL_SPAM 1447 0.30 0.88 0.01 172 XMClaimOffer 1444 0.40 0.88 0.16 173 XM_H_PHPMailer 1416 0.72 0.86 0.66 174 DKIM_ADSP_CUSTOM_MED 1407 0.94 0.86 0.98 175 TVD_RCVD_IP 1394 1.22 0.85 1.39 176 TooManyTo_002 1369 1.89 0.83 2.40 177 XMSexyCombo_01 1366 0.36 0.83 0.13 178 HOSTED_IMG_MULTI_PUB_01 1354 0.30 0.82 0.04 179 TR_Symld_Words 1349 1.08 0.82 1.21 180 T_Symld_Words_02 1342 0.56 0.82 0.43 181 XM_ShortIntro_01 1341 0.65 0.82 0.58 182 HTML_FONT_FACE_BAD 1291 1.14 0.79 1.31 183 TR_XM_Undi_RecipCombo2 1288 0.26 0.78 0.01 184 XM_H_Long_From02 1275 0.94 0.78 1.01 185 XMBdyGiftCard01 1259 0.64 0.77 0.58 186 PDS_OTHER_BAD_TLD 1242 0.32 0.76 0.11 187 TR_XM_Spammywords 1242 0.38 0.76 0.20 188 XM_S_SpammyWords 1242 0.38 0.76 0.21 189 TooManyTo_003 1227 1.17 0.75 1.38 190 T_STY_INVIS_DIRECT 1221 0.39 0.74 0.22 191 TR_XM_DK_SendGrid 1212 0.91 0.74 0.99 192 XM_B_DNDMA 1206 0.51 0.73 0.40 193 XM_UB80 1202 0.25 0.73 0.02 194 HELO_DYNAMIC_SPLIT_IP 1196 0.24 0.73 0.01 195 XMPhish14 1189 0.44 0.72 0.30 196 RELAYCOUNTRY_GB 1180 0.54 0.72 0.45 197 TR_MetaPhish_Combo_01 1157 0.62 0.70 0.58 198 TooManyTo_004 1152 0.95 0.70 1.07 199 FORGED_GMAIL_RCVD 1146 0.66 0.70 0.64 200 XM_B_Phish66 1145 0.40 0.70 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 284208 83.04 82.11 83.49 2 RELAYCOUNTRY_US 252065 76.22 80.71 74.05 3 XM_B_Unicode 236038 70.65 73.36 69.34 4 DKIM_SIGNED 235258 76.44 91.64 69.11 5 DCC_CHECK_NEGATIVE 233906 59.03 38.96 68.72 6 XM_DK_Pass 230348 74.33 88.14 67.67 7 DKIM_VALID 227340 73.43 87.21 66.79 8 BAYES_50 195475 51.09 37.96 57.43 9 DKIM_VALID_AU 184486 58.92 68.70 54.20 10 XMListUnsubscribeExists 158581 56.20 76.13 46.59 11 XM_B_SpammyWords 134874 47.04 62.42 39.62 12 XM_B_Unicode3 129818 38.58 39.50 38.14 13 DCC_CHECK 106351 40.94 61.03 31.24 14 DKIM_VALID_EF 92477 27.13 27.06 27.17 15 T_TM2_M_HEADER_IN_MSG 90676 24.19 19.11 26.64 16 HTML_FONT_LOW_CONTRAST 89458 27.77 30.86 26.28 17 RCVD_IN_MSPIKE_H2 85322 25.08 25.11 25.07 18 FVGT_m_MULTI_ODD 84633 25.93 28.16 24.86 19 MIME_HTML_ONLY 81302 24.72 26.46 23.88 20 LOC_TINY_FONT_1 81108 26.81 32.98 23.83 21 ALL_TRUSTED 76816 15.60 1.16 22.57 22 XMSubLong 72994 22.64 25.13 21.44 23 T_KAM_HTML_FONT_INVALID 64915 20.63 23.86 19.07 24 XM_B_SpammyWords2 58016 23.36 36.44 17.04 25 XM_Multi_Part_URI 46871 14.76 16.80 13.77 26 USER_IN_DEF_DKIM_WL 44944 9.60 2.14 13.20 27 TR_XM_DK_Unsub 44835 15.42 20.09 13.17 28 UNPARSEABLE_RELAY 33529 10.32 11.29 9.85 29 BAYES_60 30143 8.25 6.99 8.86 30 XM_UncommonTLD01 29226 12.32 20.05 8.59 31 BAYES_00 29005 5.91 0.50 8.52 32 XM_SPF_SoftFail 28350 9.35 11.47 8.33 33 TooManyTo_001 27812 7.72 6.80 8.17 34 XM_DKIMWhitelistDomains 26217 5.21 0.05 7.70 35 LotsOfNums_01 24840 6.72 5.51 7.30 36 ANY_BOUNCE_MESSAGE 23792 5.51 2.45 6.99 37 BOUNCE_MESSAGE 23788 5.51 2.45 6.99 38 XM_Evil_Numbers_Gen 23777 7.18 7.59 6.99 39 XM_B_Unsub 23615 9.18 13.81 6.94 40 BAYES_40 22548 6.93 7.56 6.62 41 TR_MAX_INTL_RELAY 22318 8.70 13.14 6.56 42 LOTS_OF_MONEY 22082 8.17 11.65 6.49 43 XM_H_GMP 21650 5.67 4.24 6.36 44 TR_XM_DK_Bayes 21416 4.37 0.39 6.29 45 TR_XM_DK_Bayes1 21098 4.30 0.37 6.20 46 IN_ZIMBRA_NJ_WHITELIST 21046 4.19 0.07 6.18 47 MIME_HEADER_CTYPE_ONLY 20186 4.07 0.21 5.93 48 XM_DK_Undo_02 19410 15.90 37.02 5.70 49 T_TooManySym_01 18575 4.35 2.06 5.46 50 RCVD_IN_MSPIKE_WL 18516 6.03 7.24 5.44 51 RCVD_IN_MSPIKE_H3 18513 6.02 7.24 5.44 52 TR_XM_BayesUnsub 18152 7.91 13.27 5.33 53 TR_XM_DK_Bayes2 17903 3.64 0.28 5.26 54 SpammyFromTLD_02 17708 3.98 1.46 5.20 55 HTML_IMAGE_RATIO_02 17407 5.06 4.96 5.11 56 RCVD_IN_VALIDITY_SAFE 16829 4.09 2.32 4.94 57 XM_H_Long_From01 16504 4.73 4.49 4.85 58 BAYES_99 15658 12.67 29.39 4.60 59 TR_XM_SpammyWords4 15333 6.44 10.46 4.50 60 XM_B_SpammyWords3 15331 6.89 11.85 4.50 61 RCVD_IN_VALIDITY_CERTIFIED 14779 3.53 1.84 4.34 62 RELAYCOUNTRY_META 14772 8.85 18.19 4.34 63 XMStrtUSub 14581 4.05 3.57 4.28 64 MIME_QP_LONG_LINE 14450 3.92 3.25 4.25 65 BOTNET_IPINHOSTNAME 13870 6.98 13.00 4.07 66 BAYES_80 13744 5.35 8.07 4.04 67 XM_PDF 13515 2.85 0.54 3.97 68 HTML_IMAGE_RATIO_04 12904 4.03 4.53 3.79 69 BAYES_20 12768 3.81 3.93 3.75 70 MPART_ALT_DIFF 12519 4.64 6.62 3.68 71 BAYES_05 12491 2.78 0.92 3.67 72 RCVD_IN_IADB_LISTED 12397 2.85 1.21 3.64 73 BAYES_999 12162 9.79 22.67 3.57 74 T_REMOTE_IMAGE 11693 2.91 1.82 3.44 75 RCVD_IN_IADB_SPF 11101 2.55 1.08 3.26 76 XMSubMetaSx_00 11066 3.72 4.69 3.25 77 XM_Body_Dirty_Words 10917 4.18 6.19 3.21 78 XM_B_Phish_Phrases 10200 3.31 3.95 3.00 79 RCVD_IN_IADB_SENDERID 10128 2.34 1.02 2.98 80 RCVD_IN_IADB_DK 9931 2.30 1.01 2.92 81 FSL_BULK_SIG 9896 4.14 6.69 2.91 82 XMNumbers 8849 7.64 18.09 2.60 83 BAYES_95 8568 3.22 4.67 2.52 84 T_TooManySym_02 8513 1.85 0.52 2.50 85 MAILING_LIST_MULTI 8346 2.18 1.60 2.45 86 TooManyTo_002 8186 1.89 0.83 2.40 87 DKIM_INVALID 7918 3.01 4.43 2.33 88 XM_CamelCaseFrm001 7828 2.36 2.47 2.30 89 HTML_IMAGE_RATIO_06 7776 2.70 3.57 2.28 90 MIME_HTML_ONLY_MULTI 7769 2.64 3.39 2.28 91 TR_XM_SpammyRelay 7649 6.09 14.05 2.25 92 XM_B_SpammyTLD 7494 2.47 3.01 2.20 93 MIME_HTML_MOSTLY 7171 2.57 3.54 2.11 94 TR_XM_DKIM_Undo 7121 10.76 28.74 2.09 95 RCVD_IN_IADB_VOUCHED 7109 1.58 0.51 2.09 96 T_XMDrugObfuBody_08 7015 2.47 3.32 2.06 97 HTML_MIME_NO_HTML_TAG 6990 1.91 1.62 2.05 98 INVALID_MSGID 6684 1.38 0.18 1.96 99 TO_MALFORMED 6442 1.29 0.03 1.89 100 TM2_M_URI_OPT_OUT 6252 2.09 2.61 1.84 101 MSGID_NOFQDN1 6186 1.25 0.07 1.82 102 FROM_EXCESS_BASE64 6166 1.79 1.76 1.81 103 HTML_IMAGE_RATIO_08 6047 1.94 2.28 1.78 104 XMLngstWrd_00 5924 1.54 1.11 1.74 105 XM_DK_Undo_01 5868 1.62 1.39 1.72 106 XMSexyCombo_05 5812 2.28 3.47 1.71 107 XM_SendGrid 5502 1.56 1.43 1.62 108 HELO_NODOT 5492 1.26 0.54 1.61 109 HELO_NO_DOMAIN 5489 1.26 0.54 1.61 110 T_XMDrugObfuBody_14 5448 2.13 3.23 1.60 111 XM_B_Investor 5423 2.34 3.89 1.59 112 UNTRUSTED_Relay 4993 3.10 6.50 1.47 113 URI_NOVOWEL 4969 1.46 1.46 1.46 114 RCVD_IN_IADB_OPTIN 4934 1.10 0.38 1.45 115 TR_DCC_Bayes_99 4912 7.64 20.49 1.44 116 SUBJ_ALL_CAPS 4905 1.84 2.67 1.44 117 TR_XM_UnparsRelay 4764 2.88 5.94 1.40 118 TVD_RCVD_IP 4738 1.22 0.85 1.39 119 TooManyTo_003 4694 1.17 0.75 1.38 120 XMDiploma_00 4688 1.55 1.90 1.38 121 XMGappySubj_01 4648 0.95 0.10 1.37 122 IN_HORDE_ADDRESS_BOOK 4648 0.94 0.07 1.37 123 BOTNET 4594 4.02 9.56 1.35 124 HTML_FONT_FACE_BAD 4475 1.14 0.79 1.31 125 RELAYCOUNTRY_CA 4463 3.98 9.53 1.31 126 TR_XM_PhishingBody 4359 1.86 3.05 1.28 127 TM2_M_VERY_LONG_WORD 4347 1.77 2.78 1.28 128 XM_OfRef6 4286 1.85 3.08 1.26 129 XM_B_Unsub2 4147 1.34 1.58 1.22 130 TR_XM_SpammyWords5 4129 2.12 3.99 1.21 131 TR_Symld_Words 4113 1.08 0.82 1.21 132 XMBSHREFv2 4001 0.89 0.29 1.18 133 XM_GoogleGroups 3999 0.95 0.47 1.17 134 XMStockSpam_06 3900 1.30 1.61 1.15 135 TVD_SPACE_RATIO 3877 0.81 0.12 1.14 136 URI_HEX 3798 1.27 1.59 1.12 137 TooManyTo_004 3644 0.95 0.70 1.07 138 XM_H_Long_From02 3450 0.94 0.78 1.01 139 XMGappySubj_02 3437 0.69 0.04 1.01 140 XMBody_95 3407 0.71 0.11 1.00 141 XMCapTrack 3379 0.77 0.32 0.99 142 TR_XM_DK_SendGrid 3357 0.91 0.74 0.99 143 RELAYCOUNTRY_AU 3334 1.28 1.91 0.98 144 DKIM_ADSP_CUSTOM_MED 3331 0.94 0.86 0.98 145 T_FILL_THIS_FORM_SHORT 3313 1.94 3.94 0.97 146 KHOP_HELO_FCRDNS 3239 0.98 1.05 0.95 147 T_TooManySym_03 3060 0.66 0.16 0.90 148 TooManyTo_005 3000 0.81 0.66 0.88 149 XM_UB50 2883 1.63 3.26 0.85 150 XM_B_SpammyWords4 2736 1.08 1.65 0.80 151 HTTPS_HTTP_MISMATCH 2681 0.96 1.32 0.79 152 URI_TRY_3LD 2614 1.08 1.73 0.77 153 SpammyFromTLD_01 2567 5.91 16.59 0.75 154 XMNoVowels 2457 0.59 0.33 0.72 155 XM_H_Trusted_IP 2427 0.48 0.00 0.71 156 XMGenDplmaNmb 2384 0.81 1.04 0.70 157 NML_ADSP_CUSTOM_MED 2349 0.69 0.68 0.69 158 XMSubMetaI_00 2282 0.78 1.02 0.67 159 XMBody_17 2271 2.32 5.75 0.67 160 XM_H_PHPMailer 2232 0.72 0.86 0.66 161 FILL_THIS_FORM 2222 0.52 0.25 0.65 162 RCVD_IN_BL_SPAMCOP_NET 2193 3.66 9.90 0.64 163 FORGED_GMAIL_RCVD 2193 0.66 0.70 0.64 164 XMBrknScrpt_02 2148 0.90 1.45 0.63 165 USER_IN_WHITELIST 1999 0.40 0.00 0.59 166 USER_IN_WELCOMELIST 1999 0.40 0.00 0.59 167 TR_MetaPhish_Combo_01 1973 0.62 0.70 0.58 168 XMBdyGiftCard01 1962 0.64 0.77 0.58 169 XM_ShortIntro_01 1960 0.65 0.82 0.58 170 PLING_QUERY 1905 0.72 1.06 0.56 171 MPART_ALT_DIFF_COUNT 1899 0.67 0.90 0.56 172 XM_B_COPY_HTML 1876 0.67 0.93 0.55 173 TR_XM_Base64_M1 1872 0.66 0.90 0.55 174 T_XMHurry_00 1832 0.83 1.44 0.54 175 T_OBFU_PDF_ATTACH 1825 0.41 0.15 0.54 176 XMSubNoVowel 1823 0.51 0.45 0.54 177 XM_B_FormFill 1804 0.40 0.13 0.53 178 TR_XM_FormFill2 1785 5.64 16.23 0.52 179 TR_XM_PHPDW 1764 5.65 16.27 0.52 180 TR_XM_PHPForged 1743 5.64 16.27 0.51 181 XMSubMetaSxObfu_02 1736 0.44 0.29 0.51 182 XM_H_PHPOS 1718 5.62 16.22 0.50 183 XM_ProductURIs 1684 0.51 0.55 0.49 184 T_XMDrugObfuBody_00 1650 0.75 1.29 0.48 185 HTML_IMAGE_ONLY_20 1643 0.38 0.16 0.48 186 SHORT_HELO_AND_INLINE_IMAGE 1617 0.33 0.02 0.48 187 XMPhish30 1563 0.66 1.07 0.46 188 TO_NO_BRKTS_HTML_ONLY 1528 0.37 0.20 0.45 189 RELAYCOUNTRY_GB 1523 0.54 0.72 0.45 190 T_Symld_Words_02 1480 0.56 0.82 0.43 191 HTML_IMAGE_ONLY_32 1431 0.34 0.18 0.42 192 XMOemUri 1427 0.35 0.19 0.42 193 TR_LOTS_OF_MONEY3 1402 1.12 2.57 0.41 194 MISSING_HEADERS 1381 0.39 0.35 0.41 195 TM2_M_BODY_EMPTY 1351 5.08 14.80 0.40 196 XM_B_DNDMA 1350 0.51 0.73 0.40 197 TR_XM_SpammyWords2 1325 3.95 11.32 0.39 198 FILL_THIS_FORM_LONG 1318 0.32 0.19 0.39 199 TR_LOTS_OF_MONEY2 1308 0.56 0.92 0.38 200 T_MONEY_PERCENT 1308 0.56 0.92 0.38 ----------------------------------------------------------------------