Email: 482084 Autolearn: 0 AvgScore: 3.57 AvgScanTime: 1.17 sec Spam: 142454 Autolearn: 0 AvgScore: 13.31 AvgScanTime: 1.30 sec Ham: 339630 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.12 sec Time Spent Running SA: 157.24 hours Time Spent Processing Spam: 51.49 hours Time Spent Processing Ham: 105.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 142155 99.47 99.79 99.34 2 HTML_MESSAGE 137063 88.83 96.22 85.74 3 DKIM_SIGNED 128582 79.29 90.26 74.69 4 XM_DK_Pass 123042 77.07 86.37 73.16 5 DKIM_VALID 121170 75.88 85.06 72.03 6 XM_B_Unicode 118774 72.78 83.38 68.33 7 RELAYCOUNTRY_US 112875 80.20 79.24 80.61 8 XM_B_SpammyWords 102670 51.89 72.07 43.42 9 XMListUnsubscribeExists 102427 55.22 71.90 48.23 10 DCC_CHECK 100252 42.89 70.37 31.36 11 DKIM_VALID_AU 90847 59.64 63.77 57.91 12 XM_B_Unicode3 65057 41.05 45.67 39.12 13 XM_DK_Undo_02 63754 17.38 44.75 5.90 14 XM_B_SpammyWords2 60122 25.00 42.20 17.79 15 LOC_TINY_FONT_1 56822 29.49 39.89 25.13 16 BAYES_50 54094 52.26 37.97 58.25 17 BAYES_99 51322 13.85 36.03 4.54 18 HTML_FONT_LOW_CONTRAST 49788 29.76 34.95 27.58 19 TR_XM_DKIM_Undo 48267 11.63 33.88 2.30 20 MIME_HTML_ONLY 45441 22.77 31.90 18.95 21 FVGT_m_MULTI_ODD 45064 27.62 31.63 25.94 22 RCVD_IN_MSPIKE_H2 44221 29.94 31.04 29.48 23 DKIM_VALID_EF 44128 30.21 30.98 29.89 24 DCC_CHECK_NEGATIVE 42185 57.07 29.61 68.59 25 T_KAM_HTML_FONT_INVALID 41059 22.97 28.82 20.51 26 BAYES_999 39767 10.67 27.92 3.44 27 TR_DCC_Bayes_99 34972 8.21 24.55 1.36 28 T_TM2_M_HEADER_IN_MSG 33173 28.52 23.29 30.72 29 XMSubLong 32948 22.59 23.13 22.37 30 TR_XM_DK_Unsub 31963 16.30 22.44 13.73 31 RELAYCOUNTRY_META 28301 8.86 19.87 4.24 32 XM_Multi_Part_URI 27948 15.36 19.62 13.57 33 XM_B_Unsub 22560 10.03 15.84 7.60 34 TR_XM_SpammyRelay 22506 6.40 15.80 2.45 35 TR_XM_BayesUnsub 21830 8.84 15.32 6.13 36 LOTS_OF_MONEY 20776 8.71 14.58 6.25 37 TR_XM_SpammyWords2 20611 4.67 14.47 0.56 38 TR_MAX_INTL_RELAY 20555 9.09 14.43 6.85 39 BOTNET_IPINHOSTNAME 20281 7.12 14.24 4.14 40 UNPARSEABLE_RELAY 19133 11.60 13.43 10.83 41 TR_XM_SpammyWords4 18829 7.01 13.22 4.41 42 XM_B_SpammyWords3 17744 6.76 12.46 4.37 43 RCVD_IN_BL_SPAMCOP_NET 17412 4.11 12.22 0.70 44 RELAYCOUNTRY_CA 14968 4.10 10.51 1.41 45 BOTNET 14207 3.79 9.97 1.20 46 TR_XM_SPAMCOP 14180 3.27 9.95 0.47 47 XM_Evil_Numbers_Gen 12535 8.12 8.80 7.83 48 BAYES_80 12488 5.49 8.77 4.11 49 RCVD_IN_MSPIKE_WL 11910 6.86 8.36 6.23 50 RCVD_IN_MSPIKE_H3 11910 6.86 8.36 6.23 51 BAYES_60 11158 8.75 7.83 9.13 52 TR_XM_UnparsRelay 10827 3.55 7.60 1.86 53 FSL_BULK_SIG 10534 5.10 7.39 4.14 54 LotsOfNums_01 9606 7.41 6.74 7.69 55 XM_Body_Dirty_Words 9591 4.17 6.73 3.09 56 XMSubMetaSx_00 9467 4.48 6.65 3.57 57 UNTRUSTED_Relay 9328 2.99 6.55 1.50 58 XMBody_17 9293 2.33 6.52 0.57 59 HTML_IMAGE_RATIO_02 9052 5.07 6.35 4.54 60 XM_UncommonTLD01 8178 4.38 5.74 3.81 61 TooManyTo_001 8104 8.77 5.69 10.06 62 MPART_ALT_DIFF 7696 3.73 5.40 3.03 63 XM_B_Investor 7678 2.76 5.39 1.66 64 XM_H_GMP 7655 6.43 5.37 6.87 65 BAYES_95 7521 3.49 5.28 2.74 66 XM_SPF_SoftFail 7462 4.02 5.24 3.51 67 DKIM_INVALID 7412 3.41 5.20 2.66 68 XM_B_Phish_Phrases 7255 4.08 5.09 3.66 69 XM_H_Long_From01 6956 5.09 4.88 5.18 70 HTML_IMAGE_RATIO_04 6818 4.69 4.79 4.65 71 XMSexyCombo_05 6394 2.70 4.49 1.95 72 TR_XM_SpammyWords5 6176 2.24 4.34 1.36 73 T_XMDrugObfuBody_08 6003 2.36 4.21 1.58 74 XMStrtUSub 5693 4.39 4.00 4.55 75 XM_OfRef6 5678 2.13 3.99 1.35 76 TR_LOTS_OF_MONEY3 5669 1.57 3.98 0.56 77 T_XMDrugObfuBody_14 5526 2.72 3.88 2.24 78 XMNumbers 5248 3.14 3.68 2.91 79 T_FILL_THIS_FORM_SHORT 5094 1.67 3.58 0.88 80 HTML_IMAGE_RATIO_06 5092 2.63 3.57 2.23 81 TM2_M_URI_OPT_OUT 5019 2.38 3.52 1.90 82 TR_XM_PhishingBody 5008 2.04 3.52 1.42 83 MIME_HTML_MOSTLY 4961 2.58 3.48 2.20 84 MIME_HTML_ONLY_MULTI 4886 2.13 3.43 1.59 85 T_TooManySym_01 4858 5.27 3.41 6.05 86 RCVD_IN_VALIDITY_SAFE 4750 4.17 3.33 4.51 87 XM_B_SpammyTLD 4706 2.68 3.30 2.42 88 HTML_IMAGE_RATIO_08 4686 2.28 3.29 1.86 89 XM_UB50 4596 1.57 3.23 0.88 90 TM2_M_VERY_LONG_WORD 4362 1.86 3.06 1.35 91 USER_IN_DEF_DKIM_WL 4271 10.25 3.00 13.29 92 XM_URI_RBL 4256 1.00 2.99 0.17 93 MIME_QP_LONG_LINE 4128 4.35 2.90 4.97 94 RCVD_IN_VALIDITY_CERTIFIED 4016 3.60 2.82 3.93 95 SUBJ_ALL_CAPS 3992 1.97 2.80 1.62 96 SpammyFromTLD_01 3991 1.41 2.80 0.83 97 XM_CamelCaseFrm001 3953 2.50 2.77 2.39 98 TR_XM_BayesRelay 3874 0.80 2.72 0.00 99 XMDiploma_00 3560 2.03 2.50 1.83 100 FONT_INVIS_LONG_LINE 3516 0.76 2.47 0.04 101 TR_XM_FormFill 3339 0.71 2.34 0.02 102 TR_XM_NoHeaderRelay 3165 0.73 2.22 0.11 103 RELAYCOUNTRY_AU 3035 1.14 2.13 0.73 104 XM_B_Unsub2 2999 1.55 2.11 1.32 105 HTML_MIME_NO_HTML_TAG 2938 2.20 2.06 2.25 106 XM_B_SpammyWords4 2935 1.10 2.06 0.70 107 MAILING_LIST_MULTI 2898 2.49 2.03 2.68 108 URI_HEX 2887 1.35 2.03 1.06 109 ANY_BOUNCE_MESSAGE 2782 3.61 1.95 4.30 110 BOUNCE_MESSAGE 2780 3.60 1.95 4.30 111 T_REMOTE_IMAGE 2776 3.31 1.95 3.88 112 ALL_TRUSTED 2762 11.87 1.94 16.03 113 T_XMHurry_00 2736 0.89 1.92 0.45 114 TR_XM_INV_DKIM 2734 0.61 1.92 0.07 115 XMBrknScrpt_02 2695 1.11 1.89 0.79 116 XM_DK_Undo_01 2669 1.85 1.87 1.84 117 TR_XM_PHPForged 2621 0.92 1.84 0.54 118 URI_TRY_3LD 2534 1.01 1.78 0.68 119 TR_XM_PHPDW 2501 0.89 1.76 0.53 120 TR_XM_FormFill2 2486 0.89 1.75 0.54 121 FROM_EXCESS_BASE64 2474 1.72 1.74 1.71 122 XM_H_PHPOS 2453 0.88 1.72 0.53 123 BAYES_40 2413 3.89 1.69 4.81 124 XMStockSpam_06 2221 1.27 1.56 1.15 125 SpammyFromTLD_02 2131 0.61 1.50 0.24 126 XMBdyGiftCard01 2096 0.81 1.47 0.53 127 DKIM_ADSP_CUSTOM_MED 2075 1.08 1.46 0.92 128 URIBL_DBL_SPAM 2065 0.45 1.45 0.03 129 XM_DIRTYINTL 2040 0.50 1.43 0.11 130 XMGenDplmaNmb 2028 1.15 1.42 1.04 131 XM_HighProb1 2009 0.42 1.41 0.01 132 XMLngstWrd_00 1963 0.90 1.38 0.70 133 TR_LOTS_OF_MONEY2 1941 0.65 1.36 0.35 134 T_MONEY_PERCENT 1941 0.65 1.36 0.35 135 SCC_BODY_URI_ONLY 1920 2.53 1.35 3.02 136 XMSubMetaI_00 1878 0.94 1.32 0.78 137 TR_XM_InvalidRelay 1848 0.40 1.30 0.03 138 NML_ADSP_CUSTOM_MED 1847 0.81 1.30 0.61 139 T_XMDrugObfuBody_00 1845 0.84 1.30 0.66 140 HK_RANDOM_REPLYTO 1842 0.45 1.29 0.10 141 XMReplyNow 1809 0.58 1.27 0.29 142 XMPhish30 1800 0.71 1.26 0.47 143 KHOP_HELO_FCRDNS 1762 1.20 1.24 1.19 144 HTML_TAG_BALANCE_BODY 1741 0.67 1.22 0.43 145 RELAYCOUNTRY_RU 1714 0.38 1.20 0.03 146 XM_H_Undi_Recip 1691 0.53 1.19 0.25 147 THIS_AD 1648 0.64 1.16 0.43 148 BAYES_20 1641 2.80 1.15 3.49 149 TR_MetaPhish_Combo_01 1631 0.94 1.14 0.85 150 BOTNET_NORDNS 1587 0.33 1.11 0.01 151 XM_SendGrid 1584 1.33 1.11 1.42 152 RCVD_IN_IADB_LISTED 1576 2.75 1.11 3.44 153 XMSlimDrugH 1566 0.50 1.10 0.25 154 MPART_ALT_DIFF_COUNT 1546 0.84 1.09 0.74 155 TR_Symld_Words 1526 1.40 1.07 1.54 156 TooManyTo_002 1509 2.74 1.06 3.45 157 XMHTML_After_End 1507 0.67 1.06 0.51 158 HTTPS_HTTP_MISMATCH 1503 0.91 1.06 0.85 159 DKIM_ADSP_NXDOMAIN 1492 0.50 1.05 0.28 160 T_STY_INVIS_DIRECT 1475 0.46 1.04 0.21 161 XM_H_Long_From02 1474 1.06 1.03 1.08 162 RCVD_IN_VALIDITY_RPBL 1459 0.33 1.02 0.04 163 FORGED_GMAIL_RCVD 1456 0.67 1.02 0.52 164 XMHTMLBadTable_001 1436 0.49 1.01 0.27 165 TR_Mismatch_TLD_02 1431 0.36 1.00 0.08 166 TR_Caps_n_Bayes_99 1394 0.30 0.98 0.02 167 TR_XM_Undi_Recip19 1385 0.34 0.97 0.08 168 XM_UB99 1371 0.29 0.96 0.00 169 RCVD_IN_IADB_SPF 1369 2.38 0.96 2.98 170 TooManyTo_003 1319 1.61 0.93 1.90 171 XMSubMetaSxObfu_03 1313 0.52 0.92 0.36 172 T_TooManySym_02 1312 2.22 0.92 2.77 173 RDNS_DYNAMIC 1287 0.49 0.90 0.31 174 XM_UB60 1284 0.32 0.90 0.07 175 TM2_M_OBFU_COMMENT 1284 0.45 0.90 0.26 176 RCVD_IN_IADB_DK 1276 2.07 0.90 2.56 177 TR_XM_Base64_L1 1272 0.37 0.89 0.14 178 RCVD_IN_IADB_SENDERID 1271 2.13 0.89 2.65 179 XM_H_PHPMailer 1250 0.73 0.88 0.67 180 T_Symld_Words_02 1237 0.77 0.87 0.73 181 TooManyTo_004 1228 1.28 0.86 1.46 182 RCVD_IN_PSBL 1217 0.51 0.85 0.37 183 TR_XM_Undi_RecipCombo2 1207 0.26 0.85 0.01 184 XMSexyCombo_01 1201 0.35 0.84 0.14 185 DIET_1 1189 0.43 0.83 0.26 186 XM_B_DNDMA 1181 0.54 0.83 0.42 187 HTML_FONT_FACE_BAD 1169 0.54 0.82 0.43 188 XM_ProductURIs 1166 0.60 0.82 0.51 189 TM2_M_A_HREF_HREF 1165 0.42 0.82 0.26 190 URI_NOVOWEL 1161 1.14 0.81 1.28 191 XM_B_Phish66 1161 0.44 0.81 0.28 192 TooManyTo_005 1153 1.11 0.81 1.23 193 NO_DNS_FOR_FROM 1148 0.40 0.81 0.23 194 GOOG_STO_NOIMG_HTML 1146 0.24 0.80 0.00 195 RELAYCOUNTRY_GB 1125 0.55 0.79 0.45 196 XM_ShortIntro_01 1125 0.79 0.79 0.79 197 RELAYCOUNTRY_FR 1115 0.38 0.78 0.21 198 TR_Mismatch_TLD_01 1111 0.43 0.78 0.29 199 TR_XM_MaxWHORU 1091 0.36 0.77 0.19 200 TVD_RCVD_IP 1091 1.27 0.77 1.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 337395 99.47 99.79 99.34 2 HTML_MESSAGE 291194 88.83 96.22 85.74 3 RELAYCOUNTRY_US 273763 80.20 79.24 80.61 4 DKIM_SIGNED 253676 79.29 90.26 74.69 5 XM_DK_Pass 248489 77.07 86.37 73.16 6 DKIM_VALID 244634 75.88 85.06 72.03 7 DCC_CHECK_NEGATIVE 232952 57.07 29.61 68.59 8 XM_B_Unicode 232074 72.78 83.38 68.33 9 BAYES_50 197828 52.26 37.97 58.25 10 DKIM_VALID_AU 196668 59.64 63.77 57.91 11 XMListUnsubscribeExists 163799 55.22 71.90 48.23 12 XM_B_SpammyWords 147473 51.89 72.07 43.42 13 XM_B_Unicode3 132854 41.05 45.67 39.12 14 DCC_CHECK 106500 42.89 70.37 31.36 15 T_TM2_M_HEADER_IN_MSG 104330 28.52 23.29 30.72 16 DKIM_VALID_EF 101520 30.21 30.98 29.89 17 RCVD_IN_MSPIKE_H2 100139 29.94 31.04 29.48 18 HTML_FONT_LOW_CONTRAST 93665 29.76 34.95 27.58 19 FVGT_m_MULTI_ODD 88091 27.62 31.63 25.94 20 LOC_TINY_FONT_1 85355 29.49 39.89 25.13 21 XMSubLong 75965 22.59 23.13 22.37 22 T_KAM_HTML_FONT_INVALID 69655 22.97 28.82 20.51 23 MIME_HTML_ONLY 64347 22.77 31.90 18.95 24 XM_B_SpammyWords2 60406 25.00 42.20 17.79 25 ALL_TRUSTED 54445 11.87 1.94 16.03 26 TR_XM_DK_Unsub 46634 16.30 22.44 13.73 27 XM_Multi_Part_URI 46086 15.36 19.62 13.57 28 USER_IN_DEF_DKIM_WL 45137 10.25 3.00 13.29 29 UNPARSEABLE_RELAY 36782 11.60 13.43 10.83 30 TooManyTo_001 34157 8.77 5.69 10.06 31 BAYES_00 34059 7.26 0.64 10.03 32 BAYES_60 31021 8.75 7.83 9.13 33 XM_DKIMWhitelistDomains 27295 5.76 0.34 8.04 34 XM_Evil_Numbers_Gen 26597 8.12 8.80 7.83 35 LotsOfNums_01 26126 7.41 6.74 7.69 36 XM_B_Unsub 25796 10.03 15.84 7.60 37 IN_ZIMBRA_NJ_WHITELIST 23503 4.90 0.08 6.92 38 XM_H_GMP 23348 6.43 5.37 6.87 39 TR_MAX_INTL_RELAY 23268 9.09 14.43 6.85 40 TR_XM_DK_Bayes 23074 4.92 0.44 6.79 41 TR_XM_DK_Bayes1 22696 4.84 0.43 6.68 42 LOTS_OF_MONEY 21218 8.71 14.58 6.25 43 RCVD_IN_MSPIKE_WL 21146 6.86 8.36 6.23 44 RCVD_IN_MSPIKE_H3 21146 6.86 8.36 6.23 45 TR_XM_BayesUnsub 20804 8.84 15.32 6.13 46 T_TooManySym_01 20543 5.27 3.41 6.05 47 XM_DK_Undo_02 20034 17.38 44.75 5.90 48 TR_XM_DK_Bayes2 19536 4.17 0.38 5.75 49 XM_H_Long_From01 17578 5.09 4.88 5.18 50 MIME_QP_LONG_LINE 16865 4.35 2.90 4.97 51 XM_PDF 16772 3.66 0.62 4.94 52 BAYES_40 16333 3.89 1.69 4.81 53 HTML_IMAGE_RATIO_04 15781 4.69 4.79 4.65 54 XMStrtUSub 15462 4.39 4.00 4.55 55 BAYES_99 15428 13.85 36.03 4.54 56 HTML_IMAGE_RATIO_02 15413 5.07 6.35 4.54 57 RCVD_IN_VALIDITY_SAFE 15334 4.17 3.33 4.51 58 TR_XM_SpammyWords4 14974 7.01 13.22 4.41 59 XM_B_SpammyWords3 14844 6.76 12.46 4.37 60 ANY_BOUNCE_MESSAGE 14599 3.61 1.95 4.30 61 BOUNCE_MESSAGE 14597 3.60 1.95 4.30 62 RELAYCOUNTRY_META 14397 8.86 19.87 4.24 63 FSL_BULK_SIG 14072 5.10 7.39 4.14 64 BOTNET_IPINHOSTNAME 14055 7.12 14.24 4.14 65 BAYES_80 13969 5.49 8.77 4.11 66 RCVD_IN_VALIDITY_CERTIFIED 13353 3.60 2.82 3.93 67 T_REMOTE_IMAGE 13179 3.31 1.95 3.88 68 XM_UncommonTLD01 12932 4.38 5.74 3.81 69 XM_B_Phish_Phrases 12417 4.08 5.09 3.66 70 XMSubMetaSx_00 12133 4.48 6.65 3.57 71 XM_SPF_SoftFail 11916 4.02 5.24 3.51 72 BAYES_20 11869 2.80 1.15 3.49 73 TooManyTo_002 11721 2.74 1.06 3.45 74 RCVD_IN_IADB_LISTED 11682 2.75 1.11 3.44 75 BAYES_999 11674 10.67 27.92 3.44 76 XM_Body_Dirty_Words 10494 4.17 6.73 3.09 77 MPART_ALT_DIFF 10287 3.73 5.40 3.03 78 SCC_BODY_URI_ONLY 10272 2.53 1.35 3.02 79 RCVD_IN_IADB_SPF 10127 2.38 0.96 2.98 80 XMNumbers 9899 3.14 3.68 2.91 81 BAYES_05 9834 2.23 0.63 2.90 82 T_TooManySym_02 9398 2.22 0.92 2.77 83 BAYES_95 9289 3.49 5.28 2.74 84 MAILING_LIST_MULTI 9089 2.49 2.03 2.68 85 DKIM_INVALID 9042 3.41 5.20 2.66 86 RCVD_IN_IADB_SENDERID 8993 2.13 0.89 2.65 87 RCVD_IN_IADB_DK 8707 2.07 0.90 2.56 88 TR_XM_SpammyRelay 8324 6.40 15.80 2.45 89 XM_B_SpammyTLD 8210 2.68 3.30 2.42 90 XM_CamelCaseFrm001 8119 2.50 2.77 2.39 91 RCVD_IN_IADB_VOUCHED 8047 1.84 0.59 2.37 92 TR_XM_DKIM_Undo 7797 11.63 33.88 2.30 93 HTML_MIME_NO_HTML_TAG 7648 2.20 2.06 2.25 94 T_XMDrugObfuBody_14 7592 2.72 3.88 2.24 95 HTML_IMAGE_RATIO_06 7575 2.63 3.57 2.23 96 HELO_NODOT 7543 1.63 0.20 2.22 97 HELO_NO_DOMAIN 7540 1.62 0.19 2.22 98 MIME_HTML_MOSTLY 7463 2.58 3.48 2.20 99 INVALID_MSGID 7181 1.52 0.11 2.11 100 MSGID_NOFQDN1 6715 1.40 0.04 1.98 101 TO_MALFORMED 6667 1.40 0.06 1.96 102 XMSexyCombo_05 6620 2.70 4.49 1.95 103 TM2_M_URI_OPT_OUT 6455 2.38 3.52 1.90 104 TooManyTo_003 6451 1.61 0.93 1.90 105 TR_XM_UnparsRelay 6310 3.55 7.60 1.86 106 HTML_IMAGE_RATIO_08 6301 2.28 3.29 1.86 107 XM_DK_Undo_01 6260 1.85 1.87 1.84 108 XMDiploma_00 6203 2.03 2.50 1.83 109 FROM_EXCESS_BASE64 5811 1.72 1.74 1.71 110 XM_B_Investor 5641 2.76 5.39 1.66 111 RCVD_IN_IADB_OPTIN 5593 1.28 0.41 1.65 112 SUBJ_ALL_CAPS 5505 1.97 2.80 1.62 113 MIME_HTML_ONLY_MULTI 5394 2.13 3.43 1.59 114 T_XMDrugObfuBody_08 5373 2.36 4.21 1.58 115 TR_Symld_Words 5243 1.40 1.07 1.54 116 UNTRUSTED_Relay 5107 2.99 6.55 1.50 117 TVD_RCVD_IP 5033 1.27 0.77 1.48 118 TooManyTo_004 4959 1.28 0.86 1.46 119 XM_SendGrid 4837 1.33 1.11 1.42 120 TR_XM_PhishingBody 4827 2.04 3.52 1.42 121 RELAYCOUNTRY_CA 4800 4.10 10.51 1.41 122 IN_HORDE_ADDRESS_BOOK 4760 1.00 0.05 1.40 123 TR_DCC_Bayes_99 4626 8.21 24.55 1.36 124 TR_XM_SpammyWords5 4608 2.24 4.34 1.36 125 XM_OfRef6 4600 2.13 3.99 1.35 126 TM2_M_VERY_LONG_WORD 4589 1.86 3.06 1.35 127 XM_B_Unsub2 4470 1.55 2.11 1.32 128 URI_NOVOWEL 4353 1.14 0.81 1.28 129 TooManyTo_005 4193 1.11 0.81 1.23 130 XMGappySubj_01 4143 0.94 0.27 1.22 131 XMCapTrack 4123 0.98 0.41 1.21 132 BOTNET 4086 3.79 9.97 1.20 133 KHOP_HELO_FCRDNS 4037 1.20 1.24 1.19 134 XMBSHREFv2 4000 0.95 0.42 1.18 135 XMStockSpam_06 3920 1.27 1.56 1.15 136 TVD_SPACE_RATIO 3887 0.89 0.27 1.14 137 XM_GoogleGroups 3702 0.95 0.63 1.09 138 XM_H_Long_From02 3653 1.06 1.03 1.08 139 URI_HEX 3610 1.35 2.03 1.06 140 XMBody_95 3596 0.78 0.12 1.06 141 XMGenDplmaNmb 3537 1.15 1.42 1.04 142 T_TooManySym_03 3419 0.83 0.42 1.01 143 DKIM_ADSP_CUSTOM_MED 3118 1.08 1.46 0.92 144 TR_XM_DK_SendGrid 3080 0.85 0.71 0.91 145 XM_UB50 2987 1.57 3.23 0.88 146 T_FILL_THIS_FORM_SHORT 2972 1.67 3.58 0.88 147 TR_MetaPhish_Combo_01 2888 0.94 1.14 0.85 148 HTTPS_HTTP_MISMATCH 2878 0.91 1.06 0.85 149 XM_B_FormFill 2838 0.61 0.06 0.84 150 SpammyFromTLD_01 2823 1.41 2.80 0.83 151 XM_ShortIntro_01 2686 0.79 0.79 0.79 152 XMBrknScrpt_02 2673 1.11 1.89 0.79 153 XMSubMetaI_00 2641 0.94 1.32 0.78 154 XMGappySubj_02 2578 0.56 0.07 0.76 155 MPART_ALT_DIFF_COUNT 2511 0.84 1.09 0.74 156 FILL_THIS_FORM 2495 0.63 0.39 0.73 157 RELAYCOUNTRY_AU 2469 1.14 2.13 0.73 158 T_Symld_Words_02 2464 0.77 0.87 0.73 159 SHORT_HELO_AND_INLINE_IMAGE 2426 0.52 0.06 0.71 160 RCVD_IN_BL_SPAMCOP_NET 2389 4.11 12.22 0.70 161 XMLngstWrd_00 2378 0.90 1.38 0.70 162 XM_B_SpammyWords4 2377 1.10 2.06 0.70 163 URI_TRY_3LD 2316 1.01 1.78 0.68 164 XM_H_PHPMailer 2263 0.73 0.88 0.67 165 XMNoVowels 2262 0.64 0.58 0.67 166 T_XMDrugObfuBody_00 2225 0.84 1.30 0.66 167 T_OBFU_PDF_ATTACH 2192 0.48 0.09 0.65 168 TR_XM_Base64_M1 2157 0.64 0.66 0.64 169 XM_B_COPY_HTML 2089 0.66 0.77 0.62 170 NML_ADSP_CUSTOM_MED 2071 0.81 1.30 0.61 171 XMBody_17 1926 2.33 6.52 0.57 172 USER_IN_WHITELIST 1923 0.40 0.00 0.57 173 USER_IN_WELCOMELIST 1923 0.40 0.00 0.57 174 TO_NO_BRKTS_HTML_ONLY 1919 0.54 0.46 0.57 175 TR_XM_SpammyWords2 1908 4.67 14.47 0.56 176 FROM_GOV_DKIM_AU 1898 0.43 0.12 0.56 177 TR_LOTS_OF_MONEY3 1889 1.57 3.98 0.56 178 HTML_IMAGE_ONLY_32 1863 0.51 0.42 0.55 179 XMMoneyMeta_00 1831 0.57 0.65 0.54 180 TR_XM_PHPForged 1827 0.92 1.84 0.54 181 TR_XM_FormFill2 1827 0.89 1.75 0.54 182 XMBdyGiftCard01 1816 0.81 1.47 0.53 183 TR_XM_PHPDW 1808 0.89 1.76 0.53 184 XM_H_PHPOS 1785 0.88 1.72 0.53 185 FORGED_GMAIL_RCVD 1770 0.67 1.02 0.52 186 XM_ProductURIs 1749 0.60 0.82 0.51 187 XMHTML_After_End 1746 0.67 1.06 0.51 188 XMDateMe_00 1723 0.50 0.48 0.51 189 TM2_M_BODY_EMPTY 1656 0.37 0.09 0.49 190 XMSubMetaSxObfu_02 1623 0.51 0.58 0.48 191 XMPhish30 1612 0.71 1.26 0.47 192 TR_XM_SPAMCOP 1587 3.27 9.95 0.47 193 HTML_IMAGE_ONLY_28 1573 0.42 0.33 0.46 194 T_XMHurry_00 1545 0.89 1.92 0.45 195 RCVD_IN_SORBS_DUL 1520 0.33 0.07 0.45 196 RELAYCOUNTRY_GB 1513 0.55 0.79 0.45 197 HTML_IMAGE_ONLY_20 1476 0.46 0.53 0.43 198 HTML_TAG_BALANCE_BODY 1468 0.67 1.22 0.43 199 THIS_AD 1456 0.64 1.16 0.43 200 MISSING_HEADERS 1453 0.46 0.55 0.43 ----------------------------------------------------------------------