Email: 533203 Autolearn: 0 AvgScore: 3.76 AvgScanTime: 1.39 sec Spam: 158666 Autolearn: 0 AvgScore: 13.31 AvgScanTime: 1.49 sec Ham: 374537 Autolearn: 0 AvgScore: -0.29 AvgScanTime: 1.35 sec Time Spent Running SA: 205.79 hours Time Spent Processing Spam: 65.84 hours Time Spent Processing Ham: 139.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153874 89.70 96.98 86.61 2 DKIM_SIGNED 144988 77.39 91.38 71.46 3 XM_DK_Pass 136835 74.94 86.24 70.15 4 DKIM_VALID 135176 73.97 85.20 69.21 5 XM_B_Unicode 133659 73.75 84.24 69.31 6 RELAYCOUNTRY_US 127527 78.57 80.37 77.81 7 XM_B_SpammyWords 116130 51.71 73.19 42.61 8 XMListUnsubscribeExists 114052 54.98 71.88 47.82 9 DCC_CHECK 113611 42.73 71.60 30.50 10 DKIM_VALID_AU 101427 57.97 63.92 55.45 11 XM_DK_Undo_02 72779 17.63 45.87 5.67 12 XM_B_Unicode3 69537 39.96 43.83 38.33 13 LOC_TINY_FONT_1 66638 30.23 42.00 25.24 14 XM_B_SpammyWords2 63527 24.38 40.04 17.74 15 T_SCC_BODY_TEXT_LINE 63245 39.37 39.86 39.17 16 BAYES_50 60288 52.50 38.00 58.64 17 BAYES_99 56894 13.85 35.86 4.53 18 HTML_FONT_LOW_CONTRAST 55842 29.32 35.19 26.83 19 TR_XM_DKIM_Undo 54663 11.98 34.45 2.46 20 FVGT_m_MULTI_ODD 54140 27.20 34.12 24.27 21 MIME_HTML_ONLY 49842 23.11 31.41 19.60 22 RCVD_IN_MSPIKE_H2 46987 27.75 29.61 26.96 23 DKIM_VALID_EF 46431 27.69 29.26 27.02 24 DCC_CHECK_NEGATIVE 45034 57.24 28.38 69.46 25 BAYES_999 44865 10.84 28.28 3.46 26 T_KAM_HTML_FONT_INVALID 43870 22.31 27.65 20.05 27 T_TM2_M_HEADER_IN_MSG 42073 28.07 26.52 28.73 28 TR_DCC_Bayes_99 40203 8.54 25.34 1.43 29 XMSubLong 36378 21.97 22.93 21.56 30 TR_XM_DK_Unsub 34150 15.21 21.52 12.53 31 RELAYCOUNTRY_META 32143 9.00 20.26 4.24 32 XM_Multi_Part_URI 29724 14.89 18.73 13.26 33 TR_XM_SpammyRelay 26064 6.62 16.43 2.47 34 XM_B_Unsub 25614 10.21 16.14 7.69 35 TR_XM_BayesUnsub 24523 8.92 15.46 6.16 36 TR_MAX_INTL_RELAY 23203 8.90 14.62 6.48 37 UNPARSEABLE_RELAY 23074 11.47 14.54 10.17 38 BOTNET_IPINHOSTNAME 22434 7.06 14.14 4.07 39 LOTS_OF_MONEY 22271 8.63 14.04 6.33 40 XM_B_SpammyWords3 22073 7.54 13.91 4.85 41 TR_XM_SpammyWords2 20422 4.17 12.87 0.48 42 TR_XM_SpammyWords4 19867 6.74 12.52 4.29 43 RCVD_IN_BL_SPAMCOP_NET 19094 4.06 12.03 0.68 44 BOTNET 17890 4.19 11.28 1.19 45 TR_XM_SPAMCOP 16196 3.30 10.21 0.38 46 XM_Evil_Numbers_Gen 14773 7.87 9.31 7.27 47 RELAYCOUNTRY_CA 14690 3.83 9.26 1.53 48 BAYES_80 14571 5.51 9.18 3.95 49 FSL_BULK_SIG 12959 4.64 8.17 3.14 50 TR_XM_UnparsRelay 12770 3.52 8.05 1.61 51 RCVD_IN_MSPIKE_WL 12203 6.28 7.69 5.69 52 RCVD_IN_MSPIKE_H3 12203 6.28 7.69 5.69 53 BAYES_60 11785 8.22 7.43 8.56 54 UNTRUSTED_Relay 11622 3.12 7.32 1.34 55 HTML_IMAGE_RATIO_02 11419 5.60 7.20 4.92 56 LotsOfNums_01 10599 7.46 6.68 7.80 57 XM_Body_Dirty_Words 10263 4.00 6.47 2.96 58 XMBody_17 10001 2.37 6.30 0.71 59 TooManyTo_001 9888 8.37 6.23 9.27 60 DKIM_INVALID 9812 3.42 6.18 2.25 61 MPART_ALT_DIFF 9473 4.42 5.97 3.77 62 XMSubMetaSx_00 9330 4.85 5.88 4.42 63 BAYES_95 8005 3.28 5.05 2.53 64 XM_SPF_SoftFail 7875 5.95 4.96 6.36 65 XM_UncommonTLD01 7803 5.84 4.92 6.22 66 XM_H_Long_From01 7725 5.10 4.87 5.19 67 XM_B_Investor 7467 2.62 4.71 1.74 68 XM_B_Phish_Phrases 7252 3.57 4.57 3.15 69 XM_H_GMP 7100 5.58 4.47 6.04 70 TR_XM_SpammyWords5 7086 2.23 4.47 1.29 71 T_XMDrugObfuBody_14 6922 2.38 4.36 1.54 72 XMSexyCombo_05 6791 2.80 4.28 2.17 73 HTML_IMAGE_RATIO_06 6535 3.39 4.12 3.08 74 TM2_M_URI_OPT_OUT 6371 2.27 4.02 1.53 75 HTML_IMAGE_RATIO_04 6241 3.95 3.93 3.96 76 T_XMDrugObfuBody_08 6218 2.23 3.92 1.51 77 TR_XM_PhishingBody 6211 2.33 3.91 1.66 78 HTML_IMAGE_RATIO_08 5889 2.76 3.71 2.35 79 HTML_MIME_NO_HTML_TAG 5812 3.16 3.66 2.94 80 MIME_HTML_ONLY_MULTI 5612 2.62 3.54 2.24 81 XMStrtUSub 5565 3.65 3.51 3.70 82 MIME_QP_LONG_LINE 5356 4.33 3.38 4.74 83 XM_UB50 5335 1.61 3.36 0.87 84 SUBJ_ALL_CAPS 5199 1.97 3.28 1.41 85 XM_B_SpammyTLD 5016 2.57 3.16 2.32 86 XM_OfRef6 4943 1.72 3.12 1.13 87 XMNumbers 4839 2.76 3.05 2.64 88 RCVD_IN_VALIDITY_SAFE 4836 3.91 3.05 4.28 89 MIME_HTML_MOSTLY 4756 2.58 3.00 2.41 90 TM2_M_VERY_LONG_WORD 4707 1.81 2.97 1.31 91 T_FILL_THIS_FORM_SHORT 4645 1.87 2.93 1.42 92 TR_LOTS_OF_MONEY3 4604 1.21 2.90 0.49 93 XM_B_SpammyWords4 4376 1.44 2.76 0.88 94 RCVD_IN_VALIDITY_CERTIFIED 4150 3.40 2.62 3.73 95 TR_XM_InvalidRelay 4137 0.79 2.61 0.02 96 XM_CamelCaseFrm001 4056 2.26 2.56 2.14 97 XMDiploma_00 3914 1.99 2.47 1.78 98 T_TooManySym_01 3871 4.37 2.44 5.19 99 XM_URI_RBL 3856 0.81 2.43 0.13 100 RELAYCOUNTRY_AU 3814 1.24 2.40 0.75 101 TR_XM_NoHeaderRelay 3688 0.78 2.32 0.12 102 XM_B_Unsub2 3609 1.64 2.27 1.37 103 ANY_BOUNCE_MESSAGE 3590 3.56 2.26 4.11 104 BOUNCE_MESSAGE 3582 3.56 2.26 4.11 105 TR_XM_BayesRelay 3434 0.64 2.16 0.00 106 HOSTED_IMG_MULTI_PUB_01 3422 0.66 2.16 0.02 107 USER_IN_DEF_DKIM_WL 3356 10.19 2.12 13.62 108 AC_BR_BONANZA 3330 0.71 2.10 0.12 109 SpammyFromTLD_01 3315 1.21 2.09 0.83 110 FROM_EXCESS_BASE64 3202 1.96 2.02 1.94 111 URI_TRY_3LD 3201 1.05 2.02 0.64 112 SCC_BODY_URI_ONLY 3180 1.49 2.00 1.27 113 MAILING_LIST_MULTI 2993 2.35 1.89 2.55 114 FONT_INVIS_LONG_LINE 2983 0.58 1.88 0.03 115 TR_XM_INV_DKIM 2803 0.57 1.77 0.06 116 BAYES_40 2789 3.84 1.76 4.72 117 XM_H_Long_From02 2729 1.22 1.72 1.01 118 HTML_IMAGE_ONLY_08 2717 0.59 1.71 0.12 119 TR_XM_FormFill 2694 0.52 1.70 0.02 120 TR_Caps_n_Bayes_99 2655 0.52 1.67 0.03 121 T_HTML_TAG_BALANCE_CENTER 2636 0.52 1.66 0.04 122 HTML_SHORT_LINK_IMG_1 2595 0.49 1.64 0.01 123 T_REMOTE_IMAGE 2582 2.86 1.63 3.39 124 RELAYCOUNTRY_UA 2560 0.49 1.61 0.02 125 XMStockSpam_06 2531 1.38 1.60 1.29 126 TR_XM_PHPForged 2509 0.76 1.58 0.42 127 XM_DK_Undo_01 2459 1.66 1.55 1.70 128 SpammyFromTLD_02 2457 2.64 1.55 3.10 129 TR_MetaPhish_Combo_01 2428 0.98 1.53 0.74 130 TR_XM_PHPDW 2402 0.74 1.51 0.41 131 TR_XM_FormFill2 2384 0.75 1.50 0.43 132 XMReplyNow 2368 0.60 1.49 0.22 133 XM_H_PHPOS 2355 0.72 1.48 0.40 134 RCVD_IN_VALIDITY_RPBL 2337 0.49 1.47 0.07 135 T_XMDrugObfuBody_00 2317 1.17 1.46 1.05 136 XM_SendGrid 2293 1.35 1.45 1.31 137 HTTPS_HTTP_MISMATCH 2285 1.06 1.44 0.89 138 RCVD_IN_IADB_LISTED 2278 3.39 1.44 4.22 139 XMBdyGiftCard01 2256 0.99 1.42 0.81 140 XMBrknScrpt_02 2200 0.83 1.39 0.59 141 HTML_TAG_BALANCE_BODY 2129 0.75 1.34 0.50 142 XMGenDplmaNmb 2087 0.99 1.32 0.85 143 XM_HighProb1 2067 0.39 1.30 0.00 144 URI_HEX 2065 1.14 1.30 1.07 145 TR_Symld_Words 2023 1.34 1.28 1.36 146 KHOP_HELO_FCRDNS 2005 1.23 1.26 1.21 147 XMSubMetaI_00 2004 0.92 1.26 0.78 148 RCVD_IN_IADB_SPF 1999 3.03 1.26 3.78 149 XMPhish30 1985 0.69 1.25 0.45 150 ALL_TRUSTED 1947 13.57 1.23 18.80 151 T_XMHurry_00 1935 0.62 1.22 0.37 152 TR_Mismatch_TLD_02 1925 0.41 1.21 0.06 153 TR_XM_Base64_M1 1908 0.97 1.20 0.87 154 RCVD_IN_IADB_DK 1901 2.69 1.20 3.32 155 RCVD_IN_IADB_SENDERID 1889 2.74 1.19 3.40 156 HK_RANDOM_REPLYTO 1815 0.42 1.14 0.11 157 DKIM_ADSP_NXDOMAIN 1785 0.52 1.13 0.26 158 BOTNET_NORDNS 1770 0.34 1.12 0.01 159 BAYES_20 1749 2.81 1.10 3.53 160 TR_LOTS_OF_MONEY2 1716 0.48 1.08 0.22 161 T_MONEY_PERCENT 1716 0.48 1.08 0.22 162 THIS_AD 1714 0.60 1.08 0.39 163 XM_UB99 1688 0.32 1.06 0.00 164 XM_H_Undi_Recip 1636 0.41 1.03 0.15 165 XM_DIRTYINTL 1625 0.42 1.02 0.16 166 TR_XM_DK_SendGrid 1624 0.93 1.02 0.89 167 RDNS_DYNAMIC 1596 0.58 1.01 0.41 168 PDS_OTHER_BAD_TLD 1558 0.38 0.98 0.13 169 T_STY_INVIS_DIRECT 1558 0.42 0.98 0.19 170 XMHTML_After_End 1555 0.58 0.98 0.41 171 XMPhish14 1551 0.67 0.98 0.54 172 MPART_ALT_DIFF_COUNT 1546 0.69 0.97 0.57 173 BAYES_00 1503 7.86 0.95 10.79 174 XM_B_Phish66 1474 0.52 0.93 0.35 175 XM_UB80 1453 0.28 0.92 0.02 176 RELAYCOUNTRY_FR 1422 0.41 0.90 0.21 177 TR_XM_Base64_L1 1406 0.35 0.89 0.12 178 TooManyTo_002 1396 2.39 0.88 3.03 179 XM_UB60 1384 0.29 0.87 0.05 180 URI_NOVOWEL 1355 1.31 0.85 1.50 181 DKIM_ADSP_CUSTOM_MED 1354 0.87 0.85 0.88 182 TR_XM_Undi_Recip19 1351 0.30 0.85 0.07 183 XMSexyCombo_01 1338 0.64 0.84 0.55 184 RELAYCOUNTRY_CN 1330 0.30 0.84 0.08 185 RELAYCOUNTRY_GB 1330 0.54 0.84 0.41 186 XMLngstWrd_00 1330 0.63 0.84 0.54 187 TM2_M_A_HREF_HREF 1266 0.39 0.80 0.21 188 TVD_RCVD_IP 1264 1.27 0.80 1.46 189 T_Symld_Words_02 1245 0.71 0.78 0.68 190 XMBody_78 1228 0.49 0.77 0.36 191 XM_UB999 1208 0.23 0.76 0.00 192 AC_HTML_NONSENSE_TAGS 1201 0.25 0.76 0.03 193 TR_XM_Undi_RecipCombo2 1193 0.23 0.75 0.00 194 HTML_FONT_FACE_BAD 1190 0.53 0.75 0.43 195 T_TooManySym_02 1186 1.96 0.75 2.47 196 NML_ADSP_CUSTOM_MED 1183 0.64 0.75 0.60 197 TooManyTo_003 1182 1.22 0.74 1.42 198 TR_XM_RelayPhish 1182 0.26 0.74 0.05 199 XM_B_DNDMA 1172 0.47 0.74 0.36 200 TM2_M_OBFU_COMMENT 1154 0.40 0.73 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 324400 89.70 96.98 86.61 2 RELAYCOUNTRY_US 291424 78.57 80.37 77.81 3 DKIM_SIGNED 267660 77.39 91.38 71.46 4 XM_DK_Pass 262741 74.94 86.24 70.15 5 DCC_CHECK_NEGATIVE 260147 57.24 28.38 69.46 6 XM_B_Unicode 259600 73.75 84.24 69.31 7 DKIM_VALID 259216 73.97 85.20 69.21 8 BAYES_50 219645 52.50 38.00 58.64 9 DKIM_VALID_AU 207693 57.97 63.92 55.45 10 XMListUnsubscribeExists 179090 54.98 71.88 47.82 11 XM_B_SpammyWords 159599 51.71 73.19 42.61 12 T_SCC_BODY_TEXT_LINE 146703 39.37 39.86 39.17 13 XM_B_Unicode3 143551 39.96 43.83 38.33 14 DCC_CHECK 114241 42.73 71.60 30.50 15 T_TM2_M_HEADER_IN_MSG 107586 28.07 26.52 28.73 16 DKIM_VALID_EF 101214 27.69 29.26 27.02 17 RCVD_IN_MSPIKE_H2 100964 27.75 29.61 26.96 18 HTML_FONT_LOW_CONTRAST 100507 29.32 35.19 26.83 19 LOC_TINY_FONT_1 94547 30.23 42.00 25.24 20 FVGT_m_MULTI_ODD 90905 27.20 34.12 24.27 21 XMSubLong 80751 21.97 22.93 21.56 22 T_KAM_HTML_FONT_INVALID 75096 22.31 27.65 20.05 23 MIME_HTML_ONLY 73392 23.11 31.41 19.60 24 ALL_TRUSTED 70420 13.57 1.23 18.80 25 XM_B_SpammyWords2 66455 24.38 40.04 17.74 26 USER_IN_DEF_DKIM_WL 50998 10.19 2.12 13.62 27 XM_Multi_Part_URI 49656 14.89 18.73 13.26 28 TR_XM_DK_Unsub 46942 15.21 21.52 12.53 29 BAYES_00 40407 7.86 0.95 10.79 30 UNPARSEABLE_RELAY 38080 11.47 14.54 10.17 31 TooManyTo_001 34725 8.37 6.23 9.27 32 BAYES_60 32067 8.22 7.43 8.56 33 XM_DKIMWhitelistDomains 29648 5.63 0.25 7.92 34 LotsOfNums_01 29198 7.46 6.68 7.80 35 XM_B_Unsub 28817 10.21 16.14 7.69 36 XM_Evil_Numbers_Gen 27216 7.87 9.31 7.27 37 IN_ZIMBRA_NJ_WHITELIST 24822 4.68 0.08 6.63 38 TR_MAX_INTL_RELAY 24265 8.90 14.62 6.48 39 XM_SPF_SoftFail 23824 5.95 4.96 6.36 40 LOTS_OF_MONEY 23722 8.63 14.04 6.33 41 XM_UncommonTLD01 23310 5.84 4.92 6.22 42 TR_XM_BayesUnsub 23061 8.92 15.46 6.16 43 TR_XM_DK_Bayes 22647 4.43 0.61 6.05 44 XM_H_GMP 22629 5.58 4.47 6.04 45 TR_XM_DK_Bayes1 22294 4.36 0.61 5.95 46 RCVD_IN_MSPIKE_WL 21295 6.28 7.69 5.69 47 RCVD_IN_MSPIKE_H3 21293 6.28 7.69 5.69 48 XM_DK_Undo_02 21251 17.63 45.87 5.67 49 T_TooManySym_01 19450 4.37 2.44 5.19 50 XM_H_Long_From01 19444 5.10 4.87 5.19 51 TR_XM_DK_Bayes2 19068 3.72 0.49 5.09 52 HTML_IMAGE_RATIO_02 18438 5.60 7.20 4.92 53 XM_B_SpammyWords3 18152 7.54 13.91 4.85 54 MIME_QP_LONG_LINE 17740 4.33 3.38 4.74 55 BAYES_40 17693 3.84 1.76 4.72 56 BAYES_99 16973 13.85 35.86 4.53 57 XMSubMetaSx_00 16539 4.85 5.88 4.42 58 XM_PDF 16423 3.23 0.52 4.38 59 TR_XM_SpammyWords4 16051 6.74 12.52 4.29 60 RCVD_IN_VALIDITY_SAFE 16012 3.91 3.05 4.28 61 RELAYCOUNTRY_META 15870 9.00 20.26 4.24 62 RCVD_IN_IADB_LISTED 15821 3.39 1.44 4.22 63 ANY_BOUNCE_MESSAGE 15380 3.56 2.26 4.11 64 BOUNCE_MESSAGE 15379 3.56 2.26 4.11 65 BOTNET_IPINHOSTNAME 15228 7.06 14.14 4.07 66 HTML_IMAGE_RATIO_04 14827 3.95 3.93 3.96 67 BAYES_80 14782 5.51 9.18 3.95 68 RCVD_IN_IADB_SPF 14140 3.03 1.26 3.78 69 MPART_ALT_DIFF 14104 4.42 5.97 3.77 70 RCVD_IN_VALIDITY_CERTIFIED 13965 3.40 2.62 3.73 71 XMStrtUSub 13872 3.65 3.51 3.70 72 BAYES_20 13236 2.81 1.10 3.53 73 BAYES_999 12957 10.84 28.28 3.46 74 RCVD_IN_IADB_SENDERID 12734 2.74 1.19 3.40 75 T_REMOTE_IMAGE 12693 2.86 1.63 3.39 76 RCVD_IN_IADB_DK 12438 2.69 1.20 3.32 77 XM_B_Phish_Phrases 11808 3.57 4.57 3.15 78 FSL_BULK_SIG 11774 4.64 8.17 3.14 79 SpammyFromTLD_02 11599 2.64 1.55 3.10 80 HTML_IMAGE_RATIO_06 11552 3.39 4.12 3.08 81 TooManyTo_002 11343 2.39 0.88 3.03 82 XM_Body_Dirty_Words 11070 4.00 6.47 2.96 83 HTML_MIME_NO_HTML_TAG 11018 3.16 3.66 2.94 84 BAYES_05 10271 2.11 0.60 2.74 85 XMNumbers 9901 2.76 3.05 2.64 86 MAILING_LIST_MULTI 9562 2.35 1.89 2.55 87 RCVD_IN_IADB_VOUCHED 9542 1.97 0.60 2.55 88 BAYES_95 9463 3.28 5.05 2.53 89 T_TooManySym_02 9267 1.96 0.75 2.47 90 TR_XM_SpammyRelay 9241 6.62 16.43 2.47 91 TR_XM_DKIM_Undo 9195 11.98 34.45 2.46 92 MIME_HTML_MOSTLY 9012 2.58 3.00 2.41 93 HTML_IMAGE_RATIO_08 8818 2.76 3.71 2.35 94 XM_B_SpammyTLD 8686 2.57 3.16 2.32 95 DKIM_INVALID 8444 3.42 6.18 2.25 96 MIME_HTML_ONLY_MULTI 8376 2.62 3.54 2.24 97 XMSexyCombo_05 8139 2.80 4.28 2.17 98 XM_CamelCaseFrm001 8003 2.26 2.56 2.14 99 FROM_EXCESS_BASE64 7254 1.96 2.02 1.94 100 INVALID_MSGID 7033 1.38 0.22 1.88 101 HELO_NODOT 6928 1.40 0.32 1.85 102 HELO_NO_DOMAIN 6918 1.39 0.32 1.85 103 TO_MALFORMED 6884 1.30 0.03 1.84 104 XMDiploma_00 6681 1.99 2.47 1.78 105 RCVD_IN_IADB_OPTIN 6536 1.34 0.39 1.75 106 XM_B_Investor 6518 2.62 4.71 1.74 107 MSGID_NOFQDN1 6485 1.24 0.07 1.73 108 XM_DK_Undo_01 6381 1.66 1.55 1.70 109 TR_XM_PhishingBody 6232 2.33 3.91 1.66 110 TR_XM_UnparsRelay 6022 3.52 8.05 1.61 111 T_XMDrugObfuBody_14 5760 2.38 4.36 1.54 112 RELAYCOUNTRY_CA 5748 3.83 9.26 1.53 113 TM2_M_URI_OPT_OUT 5739 2.27 4.02 1.53 114 T_XMDrugObfuBody_08 5667 2.23 3.92 1.51 115 URI_NOVOWEL 5609 1.31 0.85 1.50 116 TVD_RCVD_IP 5482 1.27 0.80 1.46 117 IN_HORDE_ADDRESS_BOOK 5357 1.02 0.07 1.43 118 TR_DCC_Bayes_99 5352 8.54 25.34 1.43 119 T_FILL_THIS_FORM_SHORT 5335 1.87 2.93 1.42 120 TooManyTo_003 5320 1.22 0.74 1.42 121 SUBJ_ALL_CAPS 5282 1.97 3.28 1.41 122 XMGappySubj_01 5246 1.05 0.22 1.40 123 XM_B_Unsub2 5127 1.64 2.27 1.37 124 TR_Symld_Words 5109 1.34 1.28 1.36 125 UNTRUSTED_Relay 5011 3.12 7.32 1.34 126 XM_SendGrid 4923 1.35 1.45 1.31 127 TM2_M_VERY_LONG_WORD 4918 1.81 2.97 1.31 128 XMStockSpam_06 4846 1.38 1.60 1.29 129 TR_XM_SpammyWords5 4830 2.23 4.47 1.29 130 SCC_BODY_URI_ONLY 4754 1.49 2.00 1.27 131 KHOP_HELO_FCRDNS 4529 1.23 1.26 1.21 132 BOTNET 4464 4.19 11.28 1.19 133 XM_OfRef6 4242 1.72 3.12 1.13 134 XMCapTrack 4070 0.87 0.36 1.09 135 XM_GoogleGroups 4054 0.91 0.51 1.08 136 URI_HEX 4007 1.14 1.30 1.07 137 XMBSHREFv2 3950 0.81 0.25 1.05 138 XM_B_FormFill 3932 0.74 0.02 1.05 139 T_XMDrugObfuBody_00 3921 1.17 1.46 1.05 140 TVD_SPACE_RATIO 3919 0.75 0.06 1.05 141 TooManyTo_004 3898 0.94 0.70 1.04 142 XMBody_95 3893 0.78 0.18 1.04 143 XM_H_Long_From02 3766 1.22 1.72 1.01 144 T_TooManySym_03 3408 0.73 0.30 0.91 145 HTTPS_HTTP_MISMATCH 3342 1.06 1.44 0.89 146 TR_XM_DK_SendGrid 3339 0.93 1.02 0.89 147 XM_B_SpammyWords4 3313 1.44 2.76 0.88 148 DKIM_ADSP_CUSTOM_MED 3283 0.87 0.85 0.88 149 TR_XM_Base64_M1 3261 0.97 1.20 0.87 150 XM_UB50 3256 1.61 3.36 0.87 151 TooManyTo_005 3232 0.80 0.66 0.86 152 XMGenDplmaNmb 3181 0.99 1.32 0.85 153 SpammyFromTLD_01 3123 1.21 2.09 0.83 154 XMGappySubj_02 3110 0.60 0.06 0.83 155 XMBdyGiftCard01 3049 0.99 1.42 0.81 156 XMSubMetaI_00 2912 0.92 1.26 0.78 157 XM_H_Trusted_IP 2877 0.54 0.00 0.77 158 HTML_IMAGE_ONLY_16 2810 0.56 0.11 0.75 159 RELAYCOUNTRY_AU 2794 1.24 2.40 0.75 160 XM_H_PHPMailer 2790 0.73 0.70 0.74 161 TR_MetaPhish_Combo_01 2780 0.98 1.53 0.74 162 XMBody_17 2656 2.37 6.30 0.71 163 FROM_GOV_DKIM_AU 2640 0.54 0.15 0.70 164 T_Symld_Words_02 2557 0.71 0.78 0.68 165 RCVD_IN_BL_SPAMCOP_NET 2541 4.06 12.03 0.68 166 TO_NO_BRKTS_HTML_ONLY 2502 0.56 0.31 0.67 167 URI_TRY_3LD 2379 1.05 2.02 0.64 168 XM_ShortIntro_01 2344 0.57 0.44 0.63 169 PLING_QUERY 2318 0.64 0.70 0.62 170 SHORT_HELO_AND_INLINE_IMAGE 2250 0.43 0.04 0.60 171 XMNoVowels 2233 0.51 0.30 0.60 172 NML_ADSP_CUSTOM_MED 2229 0.64 0.75 0.60 173 XMBrknScrpt_02 2205 0.83 1.39 0.59 174 T_OBFU_PDF_ATTACH 2190 0.43 0.08 0.58 175 MPART_ALT_DIFF_COUNT 2129 0.69 0.97 0.57 176 XM_B_COPY_HTML 2097 0.61 0.72 0.56 177 XMSexyCombo_01 2068 0.64 0.84 0.55 178 XM_ProductURIs 2048 0.60 0.73 0.55 179 XMLngstWrd_00 2040 0.63 0.84 0.54 180 USER_IN_WELCOMELIST 2022 0.38 0.00 0.54 181 USER_IN_WHITELIST 2022 0.38 0.00 0.54 182 XMPhish14 2009 0.67 0.98 0.54 183 XMSubNoVowel 1982 0.45 0.27 0.53 184 FILL_THIS_FORM 1881 0.46 0.35 0.50 185 XMMoneyMeta_00 1875 0.56 0.70 0.50 186 HTML_TAG_BALANCE_BODY 1875 0.75 1.34 0.50 187 FORGED_GMAIL_RCVD 1846 0.54 0.66 0.49 188 TR_LOTS_OF_MONEY3 1845 1.21 2.90 0.49 189 TR_XM_SpammyWords2 1809 4.17 12.87 0.48 190 XMSubMetaSxObfu_04 1789 0.40 0.22 0.48 191 XMPhish30 1690 0.69 1.25 0.45 192 XMSexyCombo_04 1680 0.40 0.28 0.45 193 HTML_IMAGE_ONLY_28 1679 0.42 0.36 0.45 194 GMD_PDF_EMPTY_BODY 1642 0.32 0.03 0.44 195 HTML_FONT_FACE_BAD 1615 0.53 0.75 0.43 196 TR_XM_FormFill2 1608 0.75 1.50 0.43 197 TR_XM_PHPForged 1565 0.76 1.58 0.42 198 RELAYCOUNTRY_GB 1554 0.54 0.84 0.41 199 XMDateMe_00 1551 0.40 0.38 0.41 200 XMHTML_After_End 1548 0.58 0.98 0.41 ----------------------------------------------------------------------