Email: 787619 Autolearn: 0 AvgScore: 1.32 AvgScanTime: 1.27 sec Spam: 148737 Autolearn: 0 AvgScore: 13.18 AvgScanTime: 1.80 sec Ham: 638882 Autolearn: 0 AvgScore: -1.44 AvgScanTime: 1.15 sec Time Spent Running SA: 278.82 hours Time Spent Processing Spam: 74.17 hours Time Spent Processing Ham: 204.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 148382 99.64 99.76 99.61 2 HTML_MESSAGE 144230 63.84 96.97 56.12 3 DKIM_SIGNED 136178 50.47 91.56 40.90 4 XM_DK_Pass 129897 49.10 87.33 40.20 5 DKIM_VALID 128135 48.43 86.15 39.64 6 XM_B_Unicode 126259 53.97 84.89 46.77 7 RELAYCOUNTRY_US 119543 56.71 80.37 51.20 8 XM_B_SpammyWords 109632 36.49 73.71 27.82 9 DCC_CHECK 106955 42.69 71.91 35.89 10 XMListUnsubscribeExists 105168 35.44 70.71 27.23 11 DKIM_VALID_AU 96409 38.16 64.82 31.95 12 XM_B_Unicode3 66956 30.56 45.02 27.19 13 XM_DK_Undo_02 66194 11.01 44.50 3.21 14 XM_B_SpammyWords2 64762 17.42 43.54 11.34 15 LOC_TINY_FONT_1 62164 19.30 41.79 14.06 16 BAYES_50 58360 47.87 39.24 49.88 17 HTML_FONT_LOW_CONTRAST 52353 19.19 35.20 15.46 18 BAYES_99 51671 8.51 34.74 2.40 19 TR_XM_DKIM_Undo 51174 7.55 34.41 1.30 20 FVGT_m_MULTI_ODD 49221 17.85 33.09 14.30 21 DKIM_VALID_EF 48654 18.89 32.71 15.68 22 MIME_HTML_ONLY 47222 16.75 31.75 13.26 23 RCVD_IN_MSPIKE_H2 47113 18.68 31.68 15.65 24 DCC_CHECK_NEGATIVE 41765 57.27 28.08 64.07 25 T_KAM_HTML_FONT_INVALID 41717 14.43 28.05 11.25 26 BAYES_999 40241 6.60 27.06 1.84 27 TR_DCC_Bayes_99 35781 5.12 24.06 0.71 28 TR_XM_DK_Unsub 35086 10.47 23.59 7.42 29 XMSubLong 33752 15.21 22.69 13.47 30 T_TM2_M_HEADER_IN_MSG 32879 18.14 22.11 17.22 31 XM_Multi_Part_URI 29510 10.24 19.84 8.00 32 RELAYCOUNTRY_META 29145 5.58 19.59 2.32 33 XM_B_Unsub 26210 6.73 17.62 4.20 34 TR_XM_BayesUnsub 25204 5.98 16.95 3.42 35 TR_XM_SpammyRelay 23548 4.04 15.83 1.30 36 LOTS_OF_MONEY 23084 6.61 15.52 4.54 37 TR_MAX_INTL_RELAY 21934 5.81 14.75 3.73 38 UNPARSEABLE_RELAY 21425 7.18 14.40 5.49 39 TR_XM_SpammyWords4 20964 5.46 14.09 3.45 40 TR_XM_SpammyWords2 20606 2.86 13.85 0.30 41 BOTNET_IPINHOSTNAME 20598 4.48 13.85 2.30 42 XM_B_SpammyWords3 19937 4.74 13.40 2.72 43 RCVD_IN_BL_SPAMCOP_NET 17914 2.63 12.04 0.44 44 RELAYCOUNTRY_CA 15123 2.52 10.17 0.74 45 TR_XM_SPAMCOP 14575 2.06 9.80 0.26 46 BOTNET 14481 2.42 9.74 0.71 47 XM_Evil_Numbers_Gen 13552 6.02 9.11 5.30 48 BAYES_80 13363 3.54 8.98 2.27 49 FSL_BULK_SIG 12831 17.82 8.63 19.96 50 TR_XM_UnparsRelay 12132 2.24 8.16 0.87 51 RCVD_IN_MSPIKE_WL 12122 4.24 8.15 3.33 52 RCVD_IN_MSPIKE_H3 12121 4.24 8.15 3.33 53 XM_Body_Dirty_Words 12026 2.98 8.09 1.80 54 BAYES_60 11357 5.53 7.64 5.04 55 MPART_ALT_DIFF 10402 5.64 6.99 5.33 56 XMSubMetaSx_00 10174 2.84 6.84 1.91 57 LotsOfNums_01 9536 5.12 6.41 4.82 58 UNTRUSTED_Relay 9220 1.86 6.20 0.85 59 TooManyTo_001 8531 5.15 5.74 5.02 60 HTML_IMAGE_RATIO_02 8478 3.13 5.70 2.53 61 XMBody_17 8478 1.31 5.70 0.29 62 XMSexyCombo_05 8450 1.88 5.68 1.00 63 HTML_IMAGE_RATIO_04 8108 8.86 5.45 9.65 64 XM_UncommonTLD01 8072 3.07 5.43 2.52 65 DKIM_INVALID 8043 2.04 5.41 1.26 66 BAYES_95 8031 2.20 5.40 1.45 67 XM_H_Long_From01 7858 3.48 5.28 3.06 68 XM_B_Phish_Phrases 7642 2.44 5.14 1.81 69 XM_SPF_SoftFail 7597 2.90 5.11 2.38 70 XM_B_Investor 7556 1.80 5.08 1.03 71 XM_H_GMP 7268 3.93 4.89 3.71 72 XM_OfRef6 6134 1.33 4.12 0.68 73 TR_XM_PhishingBody 6061 1.54 4.07 0.94 74 T_XMDrugObfuBody_14 5876 1.54 3.95 0.98 75 HTML_IMAGE_RATIO_06 5855 2.97 3.94 2.74 76 TR_XM_SpammyWords5 5790 1.28 3.89 0.68 77 XM_B_SpammyTLD 5669 1.85 3.81 1.40 78 MIME_QP_LONG_LINE 5607 2.99 3.77 2.80 79 MIME_HTML_MOSTLY 5593 1.80 3.76 1.34 80 XMNumbers 5523 1.99 3.71 1.58 81 XMStrtUSub 5467 5.95 3.68 6.47 82 MIME_HTML_ONLY_MULTI 5322 4.19 3.58 4.33 83 TM2_M_URI_OPT_OUT 5274 1.38 3.55 0.88 84 HTML_IMAGE_RATIO_08 5023 1.55 3.38 1.12 85 XMDiploma_00 4989 1.37 3.35 0.91 86 TR_LOTS_OF_MONEY3 4920 0.86 3.31 0.30 87 TM2_M_VERY_LONG_WORD 4694 1.13 3.16 0.66 88 RCVD_IN_VALIDITY_SAFE 4558 2.89 3.06 2.85 89 T_FILL_THIS_FORM_SHORT 4525 0.96 3.04 0.48 90 USER_IN_DEF_DKIM_WL 4483 6.66 3.01 7.51 91 T_XMDrugObfuBody_08 4416 1.18 2.97 0.77 92 XM_UB50 4398 0.97 2.96 0.51 93 XM_URI_RBL 4012 0.57 2.70 0.08 94 T_TooManySym_01 3994 2.88 2.69 2.92 95 RCVD_IN_VALIDITY_CERTIFIED 3925 2.52 2.64 2.49 96 XM_CamelCaseFrm001 3899 1.44 2.62 1.17 97 TR_XM_BayesRelay 3790 0.48 2.55 0.00 98 XM_B_Unsub2 3779 1.12 2.54 0.79 99 TR_XM_NoHeaderRelay 3696 0.51 2.48 0.06 100 XM_B_SpammyWords4 3667 0.75 2.47 0.35 101 ANY_BOUNCE_MESSAGE 3615 32.09 2.43 38.99 102 BOUNCE_MESSAGE 3614 32.09 2.43 38.99 103 SUBJ_ALL_CAPS 3606 1.11 2.42 0.80 104 RELAYCOUNTRY_AU 3507 0.77 2.36 0.40 105 SpammyFromTLD_01 3010 0.70 2.02 0.39 106 MAILING_LIST_MULTI 2955 1.61 1.99 1.53 107 XMStockSpam_06 2903 0.88 1.95 0.63 108 XMBrknScrpt_02 2896 0.66 1.95 0.36 109 FROM_EXCESS_BASE64 2845 1.12 1.91 0.93 110 T_REMOTE_IMAGE 2826 1.89 1.90 1.89 111 HTML_MIME_NO_HTML_TAG 2822 1.28 1.90 1.14 112 URI_TRY_3LD 2691 0.69 1.81 0.42 113 TR_XM_FormFill 2587 0.34 1.74 0.01 114 TR_XM_INV_DKIM 2581 0.35 1.74 0.03 115 T_XMDrugObfuBody_00 2487 0.58 1.67 0.33 116 SpammyFromTLD_02 2483 0.92 1.67 0.75 117 XM_DIRTYINTL 2461 0.39 1.65 0.10 118 XM_DK_Undo_01 2402 1.14 1.61 1.02 119 TR_XM_PHPForged 2374 0.49 1.60 0.23 120 FONT_INVIS_LONG_LINE 2360 0.33 1.59 0.03 121 URI_HEX 2355 0.71 1.58 0.51 122 TR_XM_PHPDW 2343 0.48 1.58 0.23 123 KHOP_HELO_FCRDNS 2298 0.78 1.55 0.61 124 TR_XM_FormFill2 2276 0.48 1.53 0.23 125 XM_H_PHPOS 2268 0.47 1.52 0.22 126 BAYES_40 2194 7.26 1.48 8.61 127 HK_RANDOM_REPLYTO 2193 0.32 1.47 0.06 128 XM_HighProb1 2086 0.27 1.40 0.00 129 XMSexyCombo_01 2077 0.36 1.40 0.12 130 HTML_TAG_BALANCE_BODY 2057 0.50 1.38 0.29 131 XMGenDplmaNmb 2001 0.69 1.35 0.54 132 HTTPS_HTTP_MISMATCH 1996 0.67 1.34 0.52 133 ALL_TRUSTED 1989 38.35 1.34 46.97 134 XMPhish30 1953 0.46 1.31 0.26 135 XMReplyNow 1934 0.36 1.30 0.14 136 TR_Mismatch_TLD_02 1889 0.27 1.27 0.04 137 THIS_AD 1886 0.38 1.27 0.17 138 XMHTML_After_End 1879 0.39 1.26 0.19 139 DKIM_ADSP_NXDOMAIN 1850 0.35 1.24 0.14 140 BAYES_20 1822 2.11 1.22 2.32 141 URI_NOVOWEL 1775 0.83 1.19 0.74 142 XM_SendGrid 1733 0.82 1.17 0.74 143 RCVD_IN_IADB_LISTED 1733 1.86 1.17 2.02 144 HTML_IMAGE_ONLY_20 1731 0.41 1.16 0.23 145 TR_XM_InvalidRelay 1716 0.23 1.15 0.02 146 XM_H_Undi_Recip 1700 0.29 1.14 0.09 147 XM_B_COVIDMETA 1684 0.33 1.13 0.14 148 T_XMHurry_00 1679 0.41 1.13 0.24 149 AC_BR_BONANZA 1676 0.24 1.13 0.04 150 TR_Symld_Words 1640 0.86 1.10 0.80 151 BOTNET_NORDNS 1621 0.21 1.09 0.00 152 RCVD_IN_VALIDITY_RPBL 1601 0.23 1.08 0.03 153 XMBdyGiftCard01 1590 0.57 1.07 0.46 154 XMPhish14 1570 0.47 1.06 0.33 155 TR_XM_Base64_M1 1558 0.53 1.05 0.41 156 XMLngstWrd_00 1553 4.72 1.04 5.58 157 TR_LOTS_OF_MONEY2 1536 0.28 1.03 0.11 158 T_MONEY_PERCENT 1536 0.28 1.03 0.11 159 DKIM_ADSP_CUSTOM_MED 1521 0.62 1.02 0.53 160 RDNS_DYNAMIC 1518 0.33 1.02 0.17 161 XM_H_Long_From02 1515 0.73 1.02 0.66 162 RCVD_IN_IADB_SPF 1513 1.65 1.02 1.80 163 TooManyTo_002 1510 1.44 1.02 1.53 164 XM_B_DNDMA 1508 0.39 1.01 0.25 165 XM_B_Phish66 1492 0.35 1.00 0.19 166 TR_Caps_n_Bayes_99 1476 0.19 0.99 0.01 167 XM_B_SEO 1464 0.26 0.98 0.09 168 XM_B_COPY_HTML 1439 0.52 0.97 0.42 169 TM2_M_OBFU_COMMENT 1428 0.29 0.96 0.13 170 T_STY_INVIS_DIRECT 1424 0.29 0.96 0.13 171 RCVD_IN_IADB_SENDERID 1416 1.50 0.95 1.62 172 RCVD_IN_IADB_DK 1412 1.46 0.95 1.58 173 PDS_OTHER_BAD_TLD 1389 0.23 0.93 0.06 174 TR_XM_Undi_Recip19 1382 0.20 0.93 0.04 175 HTML_FONT_FACE_BAD 1377 7.04 0.93 8.47 176 MPART_ALT_DIFF_COUNT 1374 0.44 0.92 0.33 177 TR_XM_Base64_L1 1373 0.24 0.92 0.08 178 RELAYCOUNTRY_FR 1365 0.28 0.92 0.13 179 T_TooManySym_02 1341 1.33 0.90 1.43 180 XM_UB99 1330 0.17 0.89 0.00 181 TooManyTo_003 1328 0.85 0.89 0.84 182 XM_ProductURIs 1323 0.40 0.89 0.29 183 SCC_BODY_URI_ONLY 1317 16.15 0.89 19.70 184 RELAYCOUNTRY_IN 1305 0.19 0.88 0.03 185 TVD_RCVD_IP 1301 0.92 0.87 0.93 186 PLING_QUERY 1298 0.35 0.87 0.23 187 XM_UB60 1292 0.19 0.87 0.04 188 TR_XM_SEO4 1282 0.21 0.86 0.06 189 XMSubMetaI_00 1281 0.44 0.86 0.35 190 TR_Mismatch_TLD_01 1277 0.29 0.86 0.16 191 NML_ADSP_CUSTOM_MED 1262 0.44 0.85 0.35 192 TooManyTo_004 1213 0.65 0.82 0.61 193 T_Symld_Words_02 1209 0.43 0.81 0.34 194 RCVD_IN_PSBL 1202 0.40 0.81 0.31 195 RELAYCOUNTRY_CN 1197 0.19 0.80 0.05 196 RELAYCOUNTRY_GB 1183 0.34 0.80 0.24 197 XMSexyCombo_04 1180 0.16 0.79 0.02 198 AC_HTML_NONSENSE_TAGS 1161 0.16 0.78 0.02 199 XMSlimDrugH 1160 0.26 0.78 0.14 200 XMClaimOffer 1159 0.22 0.78 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 636418 99.64 99.76 99.61 2 DCC_CHECK_NEGATIVE 409316 57.27 28.08 64.07 3 HTML_MESSAGE 358560 63.84 96.97 56.12 4 RELAYCOUNTRY_US 327108 56.71 80.37 51.20 5 BAYES_50 318653 47.87 39.24 49.88 6 ALL_TRUSTED 300095 38.35 1.34 46.97 7 XM_B_Unicode 298814 53.97 84.89 46.77 8 DKIM_SIGNED 261331 50.47 91.56 40.90 9 XM_DK_Pass 256808 49.10 87.33 40.20 10 DKIM_VALID 253278 48.43 86.15 39.64 11 ANY_BOUNCE_MESSAGE 249117 32.09 2.43 38.99 12 BOUNCE_MESSAGE 249113 32.09 2.43 38.99 13 DCC_CHECK 229307 42.69 71.91 35.89 14 DKIM_VALID_AU 204152 38.16 64.82 31.95 15 XM_B_SpammyWords 177768 36.49 73.71 27.82 16 XMListUnsubscribeExists 173993 35.44 70.71 27.23 17 XM_B_Unicode3 173715 30.56 45.02 27.19 18 BAYES_00 164794 21.06 0.71 25.79 19 FSL_BULK_SIG 127497 17.82 8.63 19.96 20 SCC_BODY_URI_ONLY 125873 16.15 0.89 19.70 21 T_TM2_M_HEADER_IN_MSG 110013 18.14 22.11 17.22 22 DKIM_VALID_EF 100166 18.89 32.71 15.68 23 RCVD_IN_MSPIKE_H2 100014 18.68 31.68 15.65 24 HTML_FONT_LOW_CONTRAST 98790 19.19 35.20 15.46 25 FVGT_m_MULTI_ODD 91366 17.85 33.09 14.30 26 LOC_TINY_FONT_1 89843 19.30 41.79 14.06 27 XMSubLong 86026 15.21 22.69 13.47 28 MIME_HTML_ONLY 84730 16.75 31.75 13.26 29 XM_B_SpammyWords2 72430 17.42 43.54 11.34 30 T_KAM_HTML_FONT_INVALID 71899 14.43 28.05 11.25 31 HTML_IMAGE_RATIO_04 61669 8.86 5.45 9.65 32 BAYES_40 55000 7.26 1.48 8.61 33 HTML_FONT_FACE_BAD 54096 7.04 0.93 8.47 34 XM_Multi_Part_URI 51103 10.24 19.84 8.00 35 XM_H_Trusted_IP 47989 6.09 0.00 7.51 36 USER_IN_DEF_DKIM_WL 47981 6.66 3.01 7.51 37 TR_XM_DK_Unsub 47381 10.47 23.59 7.42 38 XMStrtUSub 41367 5.95 3.68 6.47 39 XMLngstWrd_00 35635 4.72 1.04 5.58 40 UNPARSEABLE_RELAY 35103 7.18 14.40 5.49 41 MPART_ALT_DIFF 34043 5.64 6.99 5.33 42 XM_Evil_Numbers_Gen 33852 6.02 9.11 5.30 43 BAYES_60 32185 5.53 7.64 5.04 44 TooManyTo_001 32064 5.15 5.74 5.02 45 LotsOfNums_01 30810 5.12 6.41 4.82 46 LOTS_OF_MONEY 29006 6.61 15.52 4.54 47 MIME_HTML_ONLY_MULTI 27673 4.19 3.58 4.33 48 XM_B_Unsub 26822 6.73 17.62 4.20 49 XM_DKIMWhitelistDomains 26280 3.36 0.14 4.11 50 IN_ZIMBRA_NJ_WHITELIST 24339 3.11 0.09 3.81 51 TR_MAX_INTL_RELAY 23799 5.81 14.75 3.73 52 XM_H_GMP 23719 3.93 4.89 3.71 53 TR_XM_SpammyWords4 22032 5.46 14.09 3.45 54 TR_XM_BayesUnsub 21877 5.98 16.95 3.42 55 TR_XM_DK_Bayes 21286 2.80 0.51 3.33 56 RCVD_IN_MSPIKE_WL 21254 4.24 8.15 3.33 57 RCVD_IN_MSPIKE_H3 21252 4.24 8.15 3.33 58 TR_XM_DK_Bayes1 21005 2.76 0.49 3.29 59 XM_DK_Undo_02 20538 11.01 44.50 3.21 60 XM_H_Long_From01 19540 3.48 5.28 3.06 61 T_TooManySym_01 18676 2.88 2.69 2.92 62 RCVD_IN_VALIDITY_SAFE 18223 2.89 3.06 2.85 63 TR_XM_DK_Bayes2 18058 2.36 0.38 2.83 64 MIME_QP_LONG_LINE 17917 2.99 3.77 2.80 65 HTML_IMAGE_RATIO_06 17532 2.97 3.94 2.74 66 XM_B_SpammyWords3 17379 4.74 13.40 2.72 67 XMSubNoVowel 17240 2.26 0.37 2.70 68 HTML_IMAGE_RATIO_02 16192 3.13 5.70 2.53 69 XM_UncommonTLD01 16091 3.07 5.43 2.52 70 XM_PDF 16065 2.14 0.55 2.51 71 RCVD_IN_VALIDITY_CERTIFIED 15918 2.52 2.64 2.49 72 BAYES_99 15356 8.51 34.74 2.40 73 XM_SPF_SoftFail 15207 2.90 5.11 2.38 74 RELAYCOUNTRY_META 14826 5.58 19.59 2.32 75 BAYES_20 14808 2.11 1.22 2.32 76 BOTNET_IPINHOSTNAME 14698 4.48 13.85 2.30 77 BAYES_80 14528 3.54 8.98 2.27 78 BAYES_05 14292 1.93 0.59 2.24 79 RCVD_IN_IADB_LISTED 12900 1.86 1.17 2.02 80 XMSubMetaSx_00 12193 2.84 6.84 1.91 81 T_REMOTE_IMAGE 12064 1.89 1.90 1.89 82 BAYES_999 11739 6.60 27.06 1.84 83 XM_B_Phish_Phrases 11578 2.44 5.14 1.81 84 RCVD_IN_IADB_SPF 11476 1.65 1.02 1.80 85 XM_Body_Dirty_Words 11468 2.98 8.09 1.80 86 RCVD_IN_IADB_SENDERID 10376 1.50 0.95 1.62 87 XMNumbers 10123 1.99 3.71 1.58 88 RCVD_IN_IADB_DK 10101 1.46 0.95 1.58 89 TooManyTo_002 9795 1.44 1.02 1.53 90 MAILING_LIST_MULTI 9761 1.61 1.99 1.53 91 BAYES_95 9264 2.20 5.40 1.45 92 T_TooManySym_02 9135 1.33 0.90 1.43 93 XM_B_SpammyTLD 8929 1.85 3.81 1.40 94 MIME_HTML_MOSTLY 8584 1.80 3.76 1.34 95 TR_XM_SpammyRelay 8303 4.04 15.83 1.30 96 TR_XM_DKIM_Undo 8301 7.55 34.41 1.30 97 RCVD_IN_IADB_VOUCHED 8287 1.16 0.58 1.30 98 XMSubLongNoVowel 8124 1.05 0.12 1.27 99 DKIM_INVALID 8053 2.04 5.41 1.26 100 XMSubGarbage 7908 1.01 0.03 1.24 101 XM_CamelCaseFrm001 7449 1.44 2.62 1.17 102 INVALID_MSGID 7298 0.96 0.17 1.14 103 HTML_MIME_NO_HTML_TAG 7274 1.28 1.90 1.14 104 HTML_IMAGE_RATIO_08 7156 1.55 3.38 1.12 105 TO_MALFORMED 7058 0.91 0.05 1.10 106 MSGID_NOFQDN1 6778 0.87 0.06 1.06 107 XM_B_Investor 6584 1.80 5.08 1.03 108 HELO_NODOT 6556 0.89 0.32 1.03 109 HELO_NO_DOMAIN 6553 0.89 0.32 1.03 110 XM_DK_Undo_01 6544 1.14 1.61 1.02 111 XMSexyCombo_05 6395 1.88 5.68 1.00 112 T_XMDrugObfuBody_14 6289 1.54 3.95 0.98 113 TR_XM_PhishingBody 6035 1.54 4.07 0.94 114 FROM_EXCESS_BASE64 5955 1.12 1.91 0.93 115 TVD_RCVD_IP 5932 0.92 0.87 0.93 116 XMDiploma_00 5821 1.37 3.35 0.91 117 RCVD_IN_IADB_OPTIN 5736 0.80 0.41 0.90 118 TM2_M_URI_OPT_OUT 5614 1.38 3.55 0.88 119 TR_XM_UnparsRelay 5531 2.24 8.16 0.87 120 XMGappySubj_01 5511 0.73 0.15 0.86 121 UNTRUSTED_Relay 5443 1.86 6.20 0.85 122 TooManyTo_003 5378 0.85 0.89 0.84 123 SUBJ_ALL_CAPS 5141 1.11 2.42 0.80 124 TR_Symld_Words 5099 0.86 1.10 0.80 125 XM_B_Unsub2 5061 1.12 2.54 0.79 126 T_XMDrugObfuBody_08 4908 1.18 2.97 0.77 127 SpammyFromTLD_02 4784 0.92 1.67 0.75 128 URI_NOVOWEL 4754 0.83 1.19 0.74 129 IN_HORDE_ADDRESS_BOOK 4749 0.62 0.07 0.74 130 RELAYCOUNTRY_CA 4736 2.52 10.17 0.74 131 XM_SendGrid 4717 0.82 1.17 0.74 132 BOTNET 4549 2.42 9.74 0.71 133 TR_DCC_Bayes_99 4535 5.12 24.06 0.71 134 XM_OfRef6 4337 1.33 4.12 0.68 135 TR_XM_SpammyWords5 4322 1.28 3.89 0.68 136 XM_H_Long_From02 4242 0.73 1.02 0.66 137 TM2_M_VERY_LONG_WORD 4241 1.13 3.16 0.66 138 XM_GoogleGroups 4143 0.63 0.53 0.65 139 XMStockSpam_06 4056 0.88 1.95 0.63 140 XMBSHREFv2 4032 0.58 0.36 0.63 141 XMCapTrack 4015 0.59 0.40 0.63 142 XM_E_Blogspot 3960 0.52 0.09 0.62 143 TooManyTo_004 3914 0.65 0.82 0.61 144 KHOP_HELO_FCRDNS 3872 0.78 1.55 0.61 145 XMBody_95 3671 0.54 0.39 0.57 146 TVD_SPACE_RATIO 3666 0.49 0.14 0.57 147 XMGenDplmaNmb 3420 0.69 1.35 0.54 148 DKIM_ADSP_CUSTOM_MED 3362 0.62 1.02 0.53 149 HTTPS_HTTP_MISMATCH 3303 0.67 1.34 0.52 150 T_TooManySym_03 3282 0.49 0.36 0.51 151 TR_XM_DK_SendGrid 3262 0.56 0.77 0.51 152 XM_UB50 3244 0.97 2.96 0.51 153 URI_HEX 3228 0.71 1.58 0.51 154 TooManyTo_005 3086 0.53 0.74 0.48 155 T_FILL_THIS_FORM_SHORT 3043 0.96 3.04 0.48 156 XMGappySubj_02 3035 0.40 0.09 0.48 157 XMBdyGiftCard01 2923 0.57 1.07 0.46 158 RCVD_IN_BL_SPAMCOP_NET 2807 2.63 12.04 0.44 159 URI_TRY_3LD 2705 0.69 1.81 0.42 160 XM_B_COPY_HTML 2681 0.52 0.97 0.42 161 TR_MetaPhish_Combo_01 2639 0.48 0.75 0.41 162 TR_XM_Base64_M1 2623 0.53 1.05 0.41 163 RELAYCOUNTRY_AU 2536 0.77 2.36 0.40 164 XM_ShortIntro_01 2527 0.45 0.69 0.40 165 XM_H_PHPMailer 2527 0.44 0.66 0.40 166 SpammyFromTLD_01 2506 0.70 2.02 0.39 167 T_OBFU_PDF_ATTACH 2504 0.34 0.10 0.39 168 FROM_GOV_DKIM_AU 2454 0.38 0.38 0.38 169 XMBrknScrpt_02 2315 0.66 1.95 0.36 170 XMMoneyMeta_00 2302 0.42 0.67 0.36 171 NML_ADSP_CUSTOM_MED 2237 0.44 0.85 0.35 172 XMSubMetaI_00 2212 0.44 0.86 0.35 173 XM_B_SpammyWords4 2211 0.75 2.47 0.35 174 XMNoVowels 2179 0.37 0.52 0.34 175 T_Symld_Words_02 2150 0.43 0.81 0.34 176 XMPhish14 2125 0.47 1.06 0.33 177 T_XMDrugObfuBody_00 2120 0.58 1.67 0.33 178 MPART_ALT_DIFF_COUNT 2097 0.44 0.92 0.33 179 SHORT_HELO_AND_INLINE_IMAGE 2062 0.27 0.06 0.32 180 XM_B_FormFill 2045 0.27 0.04 0.32 181 FILL_THIS_FORM 2005 0.31 0.30 0.31 182 FORGED_GMAIL_RCVD 1983 0.39 0.74 0.31 183 RCVD_IN_PSBL 1980 0.40 0.81 0.31 184 MISSING_HEADERS 1978 0.36 0.58 0.31 185 TO_NO_BRKTS_HTML_ONLY 1960 0.30 0.26 0.31 186 USER_IN_WELCOMELIST 1954 0.25 0.00 0.31 187 USER_IN_WHITELIST 1954 0.25 0.00 0.31 188 TR_XM_SpammyWords2 1906 2.86 13.85 0.30 189 TR_LOTS_OF_MONEY3 1890 0.86 3.31 0.30 190 HTML_TAG_BALANCE_BODY 1881 0.50 1.38 0.29 191 XMBody_17 1841 1.31 5.70 0.29 192 XM_ProductURIs 1824 0.40 0.89 0.29 193 MY_SERVERS_FOUND 1798 0.24 0.05 0.28 194 XMPhish30 1666 0.46 1.31 0.26 195 TR_XM_SPAMCOP 1639 2.06 9.80 0.26 196 XM_B_DNDMA 1593 0.39 1.01 0.25 197 T_MANY_PILL_PRICE 1586 0.20 0.00 0.25 198 XMSolicitRefs_0 1565 0.28 0.42 0.24 199 GMD_PDF_EMPTY_BODY 1565 0.21 0.05 0.24 200 HTML_IMAGE_ONLY_28 1540 0.25 0.30 0.24 ----------------------------------------------------------------------