Email: 602025 Autolearn: 0 AvgScore: 1.89 AvgScanTime: 1.24 sec Spam: 157340 Autolearn: 0 AvgScore: 13.12 AvgScanTime: 1.42 sec Ham: 444685 Autolearn: 0 AvgScore: -2.09 AvgScanTime: 1.18 sec Time Spent Running SA: 207.54 hours Time Spent Processing Spam: 62.19 hours Time Spent Processing Ham: 145.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 156953 99.48 99.75 99.39 2 HTML_MESSAGE 152488 87.10 96.92 83.62 3 DKIM_SIGNED 142443 67.35 90.53 59.15 4 XM_DK_Pass 137098 65.68 87.13 58.09 5 DKIM_VALID 134575 64.65 85.53 57.26 6 XM_B_Unicode 132301 73.35 84.09 69.56 7 RELAYCOUNTRY_US 124267 75.27 78.98 73.96 8 XMListUnsubscribeExists 113663 48.26 72.24 39.77 9 DCC_CHECK 111807 37.23 71.06 25.25 10 XM_B_SpammyWords 111734 47.34 71.01 38.97 11 DKIM_VALID_AU 99840 50.56 63.45 45.99 12 XM_DK_Undo_02 73574 15.55 46.76 4.50 13 XM_B_Unicode3 70018 40.18 44.50 38.65 14 XM_B_SpammyWords2 65333 21.59 41.52 14.54 15 LOC_TINY_FONT_1 62848 25.12 39.94 19.88 16 BAYES_50 60900 50.74 38.71 55.00 17 BAYES_99 56733 11.93 36.06 3.39 18 TR_XM_DKIM_Undo 54977 10.43 34.94 1.76 19 HTML_FONT_LOW_CONTRAST 53445 25.96 33.97 23.13 20 MIME_HTML_ONLY 51381 22.99 32.66 19.57 21 FVGT_m_MULTI_ODD 51198 23.74 32.54 20.63 22 DKIM_VALID_EF 51140 25.24 32.50 22.67 23 RCVD_IN_MSPIKE_H2 46970 24.37 29.85 22.43 24 DCC_CHECK_NEGATIVE 45511 62.75 28.93 74.71 25 BAYES_999 44252 9.26 28.13 2.58 26 T_KAM_HTML_FONT_INVALID 44070 19.15 28.01 16.01 27 TR_DCC_Bayes_99 39123 7.13 24.87 0.86 28 XMSubLong 38917 21.10 24.73 19.81 29 T_TM2_M_HEADER_IN_MSG 37893 23.56 24.08 23.38 30 TR_XM_DK_Unsub 37044 14.19 23.54 10.88 31 RELAYCOUNTRY_META 31997 7.75 20.34 3.29 32 XM_Multi_Part_URI 29360 13.32 18.66 11.43 33 TR_XM_SpammyRelay 25513 5.57 16.22 1.80 34 XM_B_Unsub 23882 8.39 15.18 5.99 35 TR_XM_BayesUnsub 23215 7.35 14.75 4.74 36 TR_MAX_INTL_RELAY 22557 7.80 14.34 5.48 37 LOTS_OF_MONEY 22389 7.63 14.23 5.30 38 XM_B_SpammyWords3 21944 6.56 13.95 3.94 39 RCVD_IN_BL_SPAMCOP_NET 21554 3.94 13.70 0.49 40 UNPARSEABLE_RELAY 20939 9.59 13.31 8.28 41 TR_XM_SpammyWords4 19970 5.99 12.69 3.62 42 TR_XM_SpammyWords2 19960 3.58 12.69 0.36 43 BOTNET_IPINHOSTNAME 19724 5.75 12.54 3.34 44 RELAYCOUNTRY_CA 18151 3.85 11.54 1.13 45 TR_XM_SPAMCOP 17961 3.19 11.42 0.29 46 BOTNET 14068 3.10 8.94 1.03 47 BAYES_80 13981 4.79 8.89 3.34 48 RCVD_IN_MSPIKE_H3 13927 5.78 8.85 4.70 49 RCVD_IN_MSPIKE_WL 13927 5.78 8.85 4.70 50 FSL_BULK_SIG 13033 4.40 8.28 3.03 51 XM_Evil_Numbers_Gen 12629 7.81 8.03 7.73 52 XM_UncommonTLD01 12084 6.95 7.68 6.70 53 TR_XM_UnparsRelay 11568 2.83 7.35 1.23 54 BAYES_60 11377 7.33 7.23 7.37 55 LotsOfNums_01 10713 6.70 6.81 6.66 56 XM_Body_Dirty_Words 10267 3.46 6.53 2.38 57 MPART_ALT_DIFF 10249 8.25 6.51 8.87 58 XM_SPF_SoftFail 9832 6.49 6.25 6.57 59 XMSubMetaSx_00 9366 3.64 5.95 2.82 60 XM_B_Investor 9212 2.53 5.85 1.35 61 HTML_IMAGE_RATIO_02 8981 4.37 5.71 3.89 62 XM_B_Phish_Phrases 8612 3.28 5.47 2.50 63 XMBody_17 8474 1.91 5.39 0.68 64 HTML_IMAGE_RATIO_04 8332 11.15 5.30 13.23 65 BAYES_95 7966 2.90 5.06 2.13 66 DKIM_INVALID 7868 2.70 5.00 1.88 67 UNTRUSTED_Relay 7787 2.14 4.95 1.14 68 TR_XM_SpammyWords5 7764 2.11 4.93 1.11 69 XM_H_GMP 7749 5.03 4.93 5.07 70 XM_H_Long_From01 7639 4.44 4.86 4.30 71 TooManyTo_001 7596 6.40 4.83 6.96 72 T_XMDrugObfuBody_14 7377 2.26 4.69 1.40 73 MIME_HTML_ONLY_MULTI 6948 5.91 4.42 6.44 74 XM_OfRef6 6721 1.92 4.27 1.09 75 XMSexyCombo_05 6486 2.05 4.12 1.32 76 TR_XM_PhishingBody 6188 2.10 3.93 1.45 77 SUBJ_ALL_CAPS 5901 2.04 3.75 1.43 78 T_XMDrugObfuBody_08 5681 2.08 3.61 1.54 79 XMStrtUSub 5603 8.15 3.56 9.77 80 XMNumbers 5544 2.53 3.52 2.18 81 MIME_QP_LONG_LINE 5520 3.90 3.51 4.04 82 MIME_HTML_MOSTLY 5437 3.18 3.46 3.09 83 HTML_IMAGE_RATIO_06 5425 4.02 3.45 4.23 84 XM_B_SpammyTLD 5219 2.32 3.32 1.96 85 RCVD_IN_VALIDITY_SAFE 5158 3.84 3.28 4.05 86 TM2_M_URI_OPT_OUT 5154 1.89 3.28 1.40 87 T_FILL_THIS_FORM_SHORT 5075 1.49 3.23 0.87 88 HTML_IMAGE_RATIO_08 5005 1.96 3.18 1.53 89 XM_CamelCaseFrm001 4837 1.92 3.07 1.51 90 SpammyFromTLD_02 4735 3.82 3.01 4.10 91 HK_RANDOM_REPLYTO 4583 0.82 2.91 0.08 92 TR_XM_BayesRelay 4568 0.76 2.90 0.00 93 TM2_M_VERY_LONG_WORD 4499 1.55 2.86 1.08 94 USER_IN_DEF_DKIM_WL 4440 8.87 2.82 11.01 95 ALL_TRUSTED 4340 18.05 2.76 23.46 96 RCVD_IN_VALIDITY_CERTIFIED 4209 3.27 2.68 3.47 97 SpammyFromTLD_01 4131 1.16 2.63 0.64 98 XM_B_SpammyWords4 4024 0.95 2.56 0.38 99 XM_URI_RBL 4014 0.77 2.55 0.14 100 XM_UB50 3901 1.17 2.48 0.70 101 TR_LOTS_OF_MONEY3 3829 0.89 2.43 0.35 102 T_TooManySym_01 3653 3.83 2.32 4.37 103 XM_B_Unsub2 3604 1.38 2.29 1.06 104 RELAYCOUNTRY_AU 3595 1.01 2.28 0.57 105 FONT_INVIS_LONG_LINE 3423 0.58 2.18 0.02 106 TR_XM_FormFill 3368 0.58 2.14 0.03 107 TR_XM_NoHeaderRelay 3344 0.61 2.13 0.08 108 FROM_EXCESS_BASE64 3014 1.78 1.92 1.73 109 XMDiploma_00 3005 1.53 1.91 1.40 110 URI_TRY_3LD 2872 0.88 1.83 0.54 111 ANY_BOUNCE_MESSAGE 2872 7.68 1.83 9.75 112 BOUNCE_MESSAGE 2865 7.68 1.82 9.75 113 TR_Mismatch_TLD_02 2848 0.52 1.81 0.06 114 TR_Caps_n_Bayes_99 2816 0.48 1.79 0.01 115 XMStockSpam_06 2789 1.13 1.77 0.90 116 XMBrknScrpt_02 2770 0.80 1.76 0.46 117 HTML_MIME_NO_HTML_TAG 2755 1.69 1.75 1.67 118 MAILING_LIST_MULTI 2687 2.07 1.71 2.19 119 XM_DK_Undo_01 2669 1.55 1.70 1.49 120 URI_HEX 2618 1.13 1.66 0.94 121 TR_XM_INV_DKIM 2609 0.46 1.66 0.04 122 T_REMOTE_IMAGE 2503 2.44 1.59 2.74 123 XM_B_DNDMA 2481 0.69 1.58 0.37 124 HTML_TAG_BALANCE_BODY 2363 0.80 1.50 0.55 125 BAYES_40 2357 4.66 1.50 5.78 126 AC_BR_BONANZA 2278 0.45 1.45 0.10 127 XM_B_COVIDMETA 2256 0.48 1.43 0.15 128 HTTPS_HTTP_MISMATCH 2235 0.84 1.42 0.64 129 T_XMHurry_00 2208 0.59 1.40 0.31 130 KHOP_HELO_FCRDNS 2202 1.06 1.40 0.93 131 RCVD_IN_IADB_LISTED 2186 2.73 1.39 3.20 132 TR_XM_PHPForged 2159 0.62 1.37 0.35 133 TR_MetaPhish_Combo_01 2140 0.79 1.36 0.59 134 T_XMDrugObfuBody_00 2115 0.69 1.34 0.46 135 TR_XM_PHPDW 2024 0.60 1.29 0.35 136 XMPhish30 2015 0.71 1.28 0.50 137 TR_XM_FormFill2 2009 0.60 1.28 0.36 138 XMPhish14 1993 0.64 1.27 0.42 139 XM_H_PHPOS 1992 0.59 1.27 0.35 140 RCVD_IN_IADB_SPF 1989 2.43 1.26 2.85 141 TR_Symld_Words 1979 1.60 1.26 1.73 142 URI_NOVOWEL 1979 1.29 1.26 1.29 143 XM_HighProb1 1974 0.33 1.25 0.00 144 DIET_1 1912 0.55 1.22 0.31 145 RCVD_IN_IADB_SENDERID 1897 2.22 1.21 2.57 146 RCVD_IN_IADB_DK 1886 2.18 1.20 2.52 147 XM_SendGrid 1881 1.08 1.20 1.03 148 XMHTML_After_End 1857 0.55 1.18 0.33 149 LongTLD 1848 0.51 1.17 0.28 150 XMGenDplmaNmb 1823 0.98 1.16 0.91 151 XMClaimOffer 1791 0.36 1.14 0.08 152 XM_H_Undi_Recip 1775 0.40 1.13 0.14 153 TR_LOTS_OF_MONEY2 1763 0.44 1.12 0.20 154 T_MONEY_PERCENT 1763 0.44 1.12 0.20 155 BAYES_20 1682 2.98 1.07 3.66 156 XMReplyNow 1667 0.43 1.06 0.20 157 XM_ProductURIs 1646 0.59 1.05 0.43 158 T_Symld_Words_02 1627 0.56 1.03 0.39 159 XM_DIRTYINTL 1625 0.32 1.03 0.07 160 TR_XM_InvalidRelay 1549 0.27 0.98 0.02 161 HTML_IMAGE_ONLY_20 1536 0.50 0.98 0.33 162 BOTNET_NORDNS 1503 0.26 0.96 0.01 163 MPART_ALT_DIFF_COUNT 1493 0.60 0.95 0.48 164 XM_B_SEO 1492 0.34 0.95 0.13 165 BAYES_00 1474 12.00 0.94 15.92 166 XMSexyCombo_01 1460 0.31 0.93 0.10 167 XM_B_REG_HTML 1458 0.46 0.93 0.30 168 TR_XM_RelayPhish 1441 0.29 0.92 0.07 169 XM_UB99 1415 0.24 0.90 0.00 170 XM_H_Long_From02 1412 0.88 0.90 0.87 171 XMLngstWrd_00 1402 1.50 0.89 1.71 172 T_STY_INVIS_DIRECT 1398 0.36 0.89 0.17 173 TR_XM_Base64_M1 1394 0.73 0.89 0.67 174 XM_B_COPY_HTML 1394 0.61 0.89 0.51 175 XMBody_78 1392 0.48 0.88 0.33 176 HTML_FONT_FACE_BAD 1379 9.11 0.88 12.02 177 TM2_M_OBFU_COMMENT 1378 0.44 0.88 0.29 178 PDS_OTHER_BAD_TLD 1376 0.30 0.87 0.09 179 TR_XM_Undi_Recip19 1371 0.26 0.87 0.04 180 XMSubMetaI_00 1369 0.53 0.87 0.41 181 RCVD_IN_VALIDITY_RPBL 1369 0.24 0.87 0.02 182 XMBdyGiftCard01 1353 0.82 0.86 0.80 183 RDNS_DYNAMIC 1341 0.45 0.85 0.31 184 TR_XM_Base64_L1 1337 0.30 0.85 0.10 185 PLING_QUERY 1304 0.49 0.83 0.37 186 RCVD_IN_PSBL 1271 0.47 0.81 0.35 187 XM_OfRef7 1267 0.31 0.81 0.14 188 RELAYCOUNTRY_GB 1260 0.46 0.80 0.34 189 XM_B_Phish66 1253 0.38 0.80 0.24 190 TooManyTo_002 1242 1.70 0.79 2.02 191 TR_XM_Undi_RecipCombo2 1237 0.21 0.79 0.00 192 TM2_M_A_HREF_HREF 1227 0.35 0.78 0.20 193 DKIM_ADSP_CUSTOM_MED 1212 0.70 0.77 0.68 194 TR_XM_SEO4 1206 0.25 0.77 0.07 195 TR_XM_Spammywords 1174 0.29 0.75 0.13 196 XM_S_SpammyWords 1174 0.29 0.75 0.13 197 TR_XM_DK_Bayes 1167 3.71 0.74 4.76 198 TR_XM_DK_SendGrid 1166 0.69 0.74 0.67 199 TR_XM_DK_Bayes1 1160 3.66 0.74 4.69 200 T_TooManySym_02 1146 1.64 0.73 1.96 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 441952 99.48 99.75 99.39 2 HTML_MESSAGE 371849 87.10 96.92 83.62 3 DCC_CHECK_NEGATIVE 332242 62.75 28.93 74.71 4 RELAYCOUNTRY_US 328888 75.27 78.98 73.96 5 XM_B_Unicode 309301 73.35 84.09 69.56 6 DKIM_SIGNED 263010 67.35 90.53 59.15 7 XM_DK_Pass 258298 65.68 87.13 58.09 8 DKIM_VALID 254629 64.65 85.53 57.26 9 BAYES_50 244576 50.74 38.71 55.00 10 DKIM_VALID_AU 204531 50.56 63.45 45.99 11 XMListUnsubscribeExists 176863 48.26 72.24 39.77 12 XM_B_SpammyWords 173276 47.34 71.01 38.97 13 XM_B_Unicode3 171861 40.18 44.50 38.65 14 DCC_CHECK 112300 37.23 71.06 25.25 15 ALL_TRUSTED 104329 18.05 2.76 23.46 16 T_TM2_M_HEADER_IN_MSG 103947 23.56 24.08 23.38 17 HTML_FONT_LOW_CONTRAST 102868 25.96 33.97 23.13 18 DKIM_VALID_EF 100812 25.24 32.50 22.67 19 RCVD_IN_MSPIKE_H2 99749 24.37 29.85 22.43 20 FVGT_m_MULTI_ODD 91751 23.74 32.54 20.63 21 LOC_TINY_FONT_1 88407 25.12 39.94 19.88 22 XMSubLong 88084 21.10 24.73 19.81 23 MIME_HTML_ONLY 87044 22.99 32.66 19.57 24 T_KAM_HTML_FONT_INVALID 71213 19.15 28.01 16.01 25 BAYES_00 70772 12.00 0.94 15.92 26 XM_B_SpammyWords2 64661 21.59 41.52 14.54 27 HTML_IMAGE_RATIO_04 58820 11.15 5.30 13.23 28 HTML_FONT_FACE_BAD 53459 9.11 0.88 12.02 29 XM_Multi_Part_URI 50813 13.32 18.66 11.43 30 USER_IN_DEF_DKIM_WL 48943 8.87 2.82 11.01 31 TR_XM_DK_Unsub 48365 14.19 23.54 10.88 32 XM_H_Trusted_IP 47672 7.92 0.00 10.72 33 XMStrtUSub 43433 8.15 3.56 9.77 34 ANY_BOUNCE_MESSAGE 43373 7.68 1.83 9.75 35 BOUNCE_MESSAGE 43372 7.68 1.82 9.75 36 MPART_ALT_DIFF 39430 8.25 6.51 8.87 37 UNPARSEABLE_RELAY 36812 9.59 13.31 8.28 38 XM_Evil_Numbers_Gen 34371 7.81 8.03 7.73 39 BAYES_60 32753 7.33 7.23 7.37 40 TooManyTo_001 30951 6.40 4.83 6.96 41 XM_UncommonTLD01 29775 6.95 7.68 6.70 42 LotsOfNums_01 29608 6.70 6.81 6.66 43 XM_SPF_SoftFail 29224 6.49 6.25 6.57 44 MIME_HTML_ONLY_MULTI 28630 5.91 4.42 6.44 45 XM_DKIMWhitelistDomains 26773 4.46 0.07 6.02 46 XM_B_Unsub 26657 8.39 15.18 5.99 47 BAYES_40 25722 4.66 1.50 5.78 48 IN_ZIMBRA_NJ_WHITELIST 24562 4.09 0.06 5.52 49 TR_MAX_INTL_RELAY 24371 7.80 14.34 5.48 50 LOTS_OF_MONEY 23575 7.63 14.23 5.30 51 SCC_BODY_URI_ONLY 23243 4.04 0.67 5.23 52 XM_H_GMP 22527 5.03 4.93 5.07 53 TR_XM_DK_Bayes 21168 3.71 0.74 4.76 54 TR_XM_BayesUnsub 21057 7.35 14.75 4.74 55 RCVD_IN_MSPIKE_WL 20886 5.78 8.85 4.70 56 RCVD_IN_MSPIKE_H3 20886 5.78 8.85 4.70 57 TR_XM_DK_Bayes1 20868 3.66 0.74 4.69 58 XM_DK_Undo_02 20020 15.55 46.76 4.50 59 T_TooManySym_01 19432 3.83 2.32 4.37 60 XM_H_Long_From01 19119 4.44 4.86 4.30 61 HTML_IMAGE_RATIO_06 18788 4.02 3.45 4.23 62 SpammyFromTLD_02 18236 3.82 3.01 4.10 63 RCVD_IN_VALIDITY_SAFE 17989 3.84 3.28 4.05 64 MIME_QP_LONG_LINE 17982 3.90 3.51 4.04 65 TR_XM_DK_Bayes2 17945 3.15 0.64 4.04 66 XM_B_SpammyWords3 17536 6.56 13.95 3.94 67 HTML_IMAGE_RATIO_02 17318 4.37 5.71 3.89 68 XM_PDF 16829 2.93 0.50 3.78 69 XMSubNoVowel 16673 2.86 0.35 3.75 70 BAYES_20 16272 2.98 1.07 3.66 71 TR_XM_SpammyWords4 16085 5.99 12.69 3.62 72 RCVD_IN_VALIDITY_CERTIFIED 15452 3.27 2.68 3.47 73 BAYES_05 15151 2.66 0.55 3.41 74 BAYES_99 15077 11.93 36.06 3.39 75 BAYES_80 14870 4.79 8.89 3.34 76 BOTNET_IPINHOSTNAME 14867 5.75 12.54 3.34 77 RELAYCOUNTRY_META 14634 7.75 20.34 3.29 78 RCVD_IN_IADB_LISTED 14242 2.73 1.39 3.20 79 MIME_HTML_MOSTLY 13722 3.18 3.46 3.09 80 FSL_BULK_SIG 13473 4.40 8.28 3.03 81 RCVD_IN_IADB_SPF 12670 2.43 1.26 2.85 82 XMSubMetaSx_00 12559 3.64 5.95 2.82 83 T_REMOTE_IMAGE 12189 2.44 1.59 2.74 84 BAYES_999 11493 9.26 28.13 2.58 85 RCVD_IN_IADB_SENDERID 11438 2.22 1.21 2.57 86 RCVD_IN_IADB_DK 11225 2.18 1.20 2.52 87 XM_B_Phish_Phrases 11132 3.28 5.47 2.50 88 XM_Body_Dirty_Words 10593 3.46 6.53 2.38 89 MAILING_LIST_MULTI 9749 2.07 1.71 2.19 90 XMNumbers 9707 2.53 3.52 2.18 91 BAYES_95 9491 2.90 5.06 2.13 92 TooManyTo_002 8963 1.70 0.79 2.02 93 T_TooManySym_02 8729 1.64 0.73 1.96 94 XM_B_SpammyTLD 8726 2.32 3.32 1.96 95 RCVD_IN_IADB_VOUCHED 8611 1.57 0.55 1.94 96 DKIM_INVALID 8381 2.70 5.00 1.88 97 XMSubLongNoVowel 8194 1.39 0.13 1.84 98 TR_XM_SpammyRelay 8001 5.57 16.22 1.80 99 XMSubGarbage 7932 1.33 0.03 1.78 100 TR_XM_DKIM_Undo 7811 10.43 34.94 1.76 101 FROM_EXCESS_BASE64 7694 1.78 1.92 1.73 102 TR_Symld_Words 7676 1.60 1.26 1.73 103 XMLngstWrd_00 7610 1.50 0.89 1.71 104 HTML_MIME_NO_HTML_TAG 7413 1.69 1.75 1.67 105 INVALID_MSGID 7238 1.25 0.19 1.63 106 TO_MALFORMED 6917 1.15 0.02 1.56 107 T_XMDrugObfuBody_08 6845 2.08 3.61 1.54 108 HTML_IMAGE_RATIO_08 6799 1.96 3.18 1.53 109 MSGID_NOFQDN1 6742 1.13 0.04 1.52 110 XM_CamelCaseFrm001 6717 1.92 3.07 1.51 111 XM_DK_Undo_01 6638 1.55 1.70 1.49 112 HELO_NODOT 6623 1.18 0.29 1.49 113 HELO_NO_DOMAIN 6619 1.18 0.29 1.49 114 TR_XM_PhishingBody 6466 2.10 3.93 1.45 115 SUBJ_ALL_CAPS 6354 2.04 3.75 1.43 116 TVD_RCVD_IP 6319 1.24 0.71 1.42 117 TM2_M_URI_OPT_OUT 6236 1.89 3.28 1.40 118 XMDiploma_00 6233 1.53 1.91 1.40 119 T_XMDrugObfuBody_14 6210 2.26 4.69 1.40 120 XM_B_Investor 5991 2.53 5.85 1.35 121 XMSexyCombo_05 5877 2.05 4.12 1.32 122 RCVD_IN_IADB_OPTIN 5855 1.06 0.35 1.32 123 URI_NOVOWEL 5758 1.29 1.26 1.29 124 TR_XM_UnparsRelay 5474 2.83 7.35 1.23 125 IN_HORDE_ADDRESS_BOOK 5083 0.86 0.06 1.14 126 UNTRUSTED_Relay 5080 2.14 4.95 1.14 127 TooManyTo_003 5070 1.01 0.66 1.14 128 RELAYCOUNTRY_CA 5037 3.85 11.54 1.13 129 TR_XM_SpammyWords5 4947 2.11 4.93 1.11 130 XMGappySubj_01 4884 0.87 0.21 1.10 131 XM_OfRef6 4866 1.92 4.27 1.09 132 TM2_M_VERY_LONG_WORD 4823 1.55 2.86 1.08 133 XM_B_Unsub2 4701 1.38 2.29 1.06 134 XMBSHREFv2 4695 0.86 0.30 1.06 135 XM_SendGrid 4596 1.08 1.20 1.03 136 BOTNET 4596 3.10 8.94 1.03 137 XM_GoogleGroups 4379 0.86 0.51 0.98 138 URI_HEX 4202 1.13 1.66 0.94 139 XMCapTrack 4186 0.79 0.37 0.94 140 KHOP_HELO_FCRDNS 4150 1.06 1.40 0.93 141 XMGenDplmaNmb 4057 0.98 1.16 0.91 142 XMStockSpam_06 4023 1.13 1.77 0.90 143 T_FILL_THIS_FORM_SHORT 3875 1.49 3.23 0.87 144 XM_H_Long_From02 3869 0.88 0.90 0.87 145 TR_DCC_Bayes_99 3824 7.13 24.87 0.86 146 TVD_SPACE_RATIO 3772 0.64 0.06 0.85 147 XM_E_Blogspot 3757 0.65 0.11 0.84 148 TooManyTo_004 3735 0.78 0.60 0.84 149 XMBody_95 3676 0.69 0.29 0.83 150 XMBdyGiftCard01 3554 0.82 0.86 0.80 151 XM_ShortIntro_01 3328 0.67 0.43 0.75 152 XM_UB50 3116 1.17 2.48 0.70 153 TooManyTo_005 3101 0.67 0.58 0.70 154 T_TooManySym_03 3099 0.58 0.27 0.70 155 XMBody_17 3025 1.91 5.39 0.68 156 DKIM_ADSP_CUSTOM_MED 3021 0.70 0.77 0.68 157 TR_XM_Base64_M1 2995 0.73 0.89 0.67 158 TR_XM_DK_SendGrid 2971 0.69 0.74 0.67 159 SpammyFromTLD_01 2862 1.16 2.63 0.64 160 XMGappySubj_02 2861 0.49 0.06 0.64 161 HTTPS_HTTP_MISMATCH 2840 0.84 1.42 0.64 162 FROM_GOV_DKIM_AU 2784 0.57 0.40 0.63 163 TR_MetaPhish_Combo_01 2607 0.79 1.36 0.59 164 RELAYCOUNTRY_AU 2513 1.01 2.28 0.57 165 HTML_EXTRA_CLOSE 2489 0.42 0.02 0.56 166 XM_H_PHPMailer 2467 0.59 0.68 0.55 167 URI_NO_WWW_INFO_CGI 2454 0.42 0.04 0.55 168 HTML_TAG_BALANCE_BODY 2442 0.80 1.50 0.55 169 URI_TRY_3LD 2421 0.88 1.83 0.54 170 XMNoVowels 2354 0.50 0.42 0.53 171 XM_B_COPY_HTML 2254 0.61 0.89 0.51 172 XMPhish30 2236 0.71 1.28 0.50 173 T_OBFU_PDF_ATTACH 2207 0.39 0.08 0.50 174 RCVD_IN_BL_SPAMCOP_NET 2186 3.94 13.70 0.49 175 MPART_ALT_DIFF_COUNT 2148 0.60 0.95 0.48 176 SHORT_HELO_AND_INLINE_IMAGE 2071 0.35 0.03 0.47 177 XMBrknScrpt_02 2054 0.80 1.76 0.46 178 T_XMDrugObfuBody_00 2050 0.69 1.34 0.46 179 HTML_IMAGE_ONLY_28 2047 0.42 0.31 0.46 180 USER_IN_WELCOMELIST 2007 0.33 0.00 0.45 181 FILL_THIS_FORM 2007 0.46 0.48 0.45 182 USER_IN_WHITELIST 2007 0.33 0.00 0.45 183 T_HTML_ATTACH 2004 0.36 0.11 0.45 184 NML_ADSP_CUSTOM_MED 1941 0.50 0.68 0.44 185 XM_ProductURIs 1909 0.59 1.05 0.43 186 XMPhish14 1853 0.64 1.27 0.42 187 XM_B_FormFill 1837 0.34 0.12 0.41 188 NUMERIC_HTTP_ADDR 1821 0.39 0.35 0.41 189 XMSubMetaI_00 1810 0.53 0.87 0.41 190 XMOemUri 1795 0.35 0.21 0.40 191 XMSolicitRefs_0 1741 0.43 0.52 0.39 192 T_Symld_Words_02 1727 0.56 1.03 0.39 193 FORGED_GMAIL_RCVD 1700 0.44 0.59 0.38 194 XM_B_SpammyWords4 1699 0.95 2.56 0.38 195 GMD_PDF_EMPTY_BODY 1687 0.29 0.04 0.38 196 XM_B_DNDMA 1652 0.69 1.58 0.37 197 PLING_QUERY 1635 0.49 0.83 0.37 198 TR_XM_FormFill2 1604 0.60 1.28 0.36 199 T_MANY_PILL_PRICE 1597 0.27 0.00 0.36 200 XMMoneyMeta_00 1591 0.42 0.58 0.36 ----------------------------------------------------------------------