Email: 302452 Autolearn: 0 AvgScore: 4.79 AvgScanTime: 1.40 sec Spam: 114080 Autolearn: 0 AvgScore: 13.72 AvgScanTime: 1.45 sec Ham: 188372 Autolearn: 0 AvgScore: -0.61 AvgScanTime: 1.37 sec Time Spent Running SA: 117.51 hours Time Spent Processing Spam: 45.89 hours Time Spent Processing Ham: 71.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 113940 99.75 99.88 99.67 2 HTML_MESSAGE 110159 87.54 96.56 82.08 3 DKIM_SIGNED 105177 83.66 92.20 78.50 4 XM_DK_Pass 101895 81.90 89.32 77.41 5 DKIM_VALID 100755 81.23 88.32 76.94 6 XM_B_Unicode 97569 76.56 85.53 71.12 7 RELAYCOUNTRY_US 87525 78.31 76.72 79.27 8 XM_B_SpammyWords 86097 57.10 75.47 45.97 9 DCC_CHECK 84911 53.44 74.43 40.72 10 XMListUnsubscribeExists 83409 62.39 73.11 55.90 11 DKIM_VALID_AU 77605 66.86 68.03 66.15 12 XM_DK_Undo_02 57055 23.45 50.01 7.36 13 XM_B_SpammyWords2 52285 30.43 45.83 21.11 14 XM_B_Unicode3 49863 43.84 43.71 43.91 15 BAYES_99 46119 18.96 40.43 5.95 16 LOC_TINY_FONT_1 44996 33.34 39.44 29.64 17 TR_XM_DKIM_Undo 44914 16.74 39.37 3.03 18 HTML_FONT_LOW_CONTRAST 38515 33.95 33.76 34.06 19 BAYES_50 38319 48.72 33.59 57.88 20 RCVD_IN_MSPIKE_H2 37274 31.42 32.67 30.67 21 BAYES_999 37123 15.25 32.54 4.77 22 DKIM_VALID_EF 37057 31.72 32.48 31.25 23 FVGT_m_MULTI_ODD 35813 29.30 31.39 28.04 24 MIME_HTML_ONLY 35754 24.99 31.34 21.15 25 TR_DCC_Bayes_99 33914 12.91 29.73 2.72 26 T_KAM_HTML_FONT_INVALID 33168 23.68 29.07 20.42 27 DCC_CHECK_NEGATIVE 29159 46.55 25.56 59.26 28 RELAYCOUNTRY_META 26701 11.52 23.41 4.33 29 TR_XM_DK_Unsub 26082 19.19 22.86 16.96 30 XMSubLong 24287 21.68 21.29 21.91 31 TR_XM_SpammyRelay 21790 8.89 19.10 2.70 32 T_TM2_M_HEADER_IN_MSG 21410 20.35 18.77 21.31 33 TR_XM_SpammyWords2 20113 7.19 17.63 0.87 34 XM_B_Unsub 19591 11.85 17.17 8.63 35 XM_Multi_Part_URI 19205 16.67 16.83 16.56 36 TR_XM_BayesUnsub 19025 10.70 16.68 7.09 37 XM_B_SpammyWords3 18991 10.34 16.65 6.52 38 TR_MAX_INTL_RELAY 17425 10.56 15.27 7.71 39 RCVD_IN_BL_SPAMCOP_NET 17220 6.24 15.09 0.89 40 LOTS_OF_MONEY 16710 10.19 14.65 7.49 41 RELAYCOUNTRY_CA 15761 6.60 13.82 2.22 42 UNPARSEABLE_RELAY 15313 12.18 13.42 11.43 43 TR_XM_SpammyWords4 15266 8.61 13.38 5.73 44 TR_XM_SPAMCOP 13909 4.97 12.19 0.60 45 BOTNET_IPINHOSTNAME 12851 8.05 11.26 6.10 46 RCVD_IN_MSPIKE_WL 10984 7.78 9.63 6.66 47 RCVD_IN_MSPIKE_H3 10984 7.78 9.63 6.66 48 BAYES_80 10822 6.49 9.49 4.67 49 FSL_BULK_SIG 9633 6.45 8.44 5.24 50 BOTNET 9585 3.80 8.40 1.02 51 BAYES_60 9225 10.10 8.09 11.31 52 TR_XM_UnparsRelay 9112 4.29 7.99 2.05 53 XMBody_17 8975 3.61 7.87 1.02 54 HTML_IMAGE_RATIO_02 8303 6.26 7.28 5.64 55 UNTRUSTED_Relay 7776 3.54 6.82 1.56 56 XM_Evil_Numbers_Gen 7711 7.94 6.76 8.65 57 XM_Body_Dirty_Words 7535 4.86 6.61 3.80 58 TooManyTo_001 7013 6.44 6.15 6.62 59 XMSubMetaSx_00 6722 4.77 5.89 4.09 60 XM_UncommonTLD01 6382 4.93 5.59 4.53 61 BAYES_95 6154 3.92 5.39 3.03 62 MPART_ALT_DIFF 5961 4.39 5.23 3.88 63 LotsOfNums_01 5906 6.79 5.18 7.77 64 XMSexyCombo_05 5470 3.53 4.79 2.77 65 XM_H_GMP 5341 6.93 4.68 8.29 66 HTML_IMAGE_RATIO_06 5077 3.55 4.45 3.01 67 TR_LOTS_OF_MONEY3 5039 2.34 4.42 1.09 68 T_FILL_THIS_FORM_SHORT 4948 1.96 4.34 0.52 69 XM_B_Investor 4807 2.54 4.21 1.52 70 XM_SPF_SoftFail 4764 3.07 4.18 2.40 71 XM_B_Phish_Phrases 4681 3.42 4.10 3.00 72 HTML_IMAGE_RATIO_04 4644 4.74 4.07 5.14 73 XM_H_Long_From01 4632 4.95 4.06 5.48 74 XMStrtUSub 4622 5.29 4.05 6.04 75 TR_XM_SpammyWords5 4488 2.07 3.93 0.94 76 MIME_HTML_MOSTLY 4436 3.03 3.89 2.52 77 DKIM_INVALID 4422 2.43 3.88 1.56 78 XM_OfRef6 4416 2.12 3.87 1.07 79 RCVD_IN_VALIDITY_SAFE 4414 5.98 3.87 7.26 80 T_XMDrugObfuBody_14 4413 2.76 3.87 2.08 81 USER_IN_DEF_DKIM_WL 4090 13.48 3.59 19.47 82 TR_XM_BayesRelay 3915 1.30 3.43 0.00 83 HTML_IMAGE_RATIO_08 3904 2.40 3.42 1.78 84 TM2_M_URI_OPT_OUT 3901 2.41 3.42 1.80 85 RCVD_IN_VALIDITY_CERTIFIED 3701 4.94 3.24 5.96 86 TR_XM_NoHeaderRelay 3662 1.28 3.21 0.10 87 XM_B_SpammyTLD 3659 2.74 3.21 2.45 88 XM_UB50 3641 1.75 3.19 0.88 89 XMNumbers 3486 3.29 3.06 3.43 90 XMDiploma_00 3400 2.42 2.98 2.08 91 TR_XM_PhishingBody 3320 2.19 2.91 1.76 92 MIME_HTML_ONLY_MULTI 3300 2.40 2.89 2.11 93 FONT_INVIS_LONG_LINE 3242 1.09 2.84 0.03 94 XM_CamelCaseFrm001 3220 2.58 2.82 2.44 95 T_XMDrugObfuBody_08 3173 2.22 2.78 1.88 96 TM2_M_VERY_LONG_WORD 3082 2.04 2.70 1.64 97 TR_XM_FormFill 3001 1.00 2.63 0.02 98 SUBJ_ALL_CAPS 2954 1.52 2.59 0.88 99 TooManyTo_002 2878 1.98 2.52 1.66 100 XMBrknScrpt_02 2873 1.71 2.52 1.23 101 XM_B_SpammyWords4 2869 1.53 2.51 0.94 102 BOTNET_NORDNS 2847 0.95 2.50 0.01 103 T_TooManySym_01 2807 5.81 2.46 7.84 104 XM_URI_RBL 2776 1.03 2.43 0.18 105 TooManyTo_003 2760 1.46 2.42 0.88 106 TooManyTo_004 2718 1.30 2.38 0.65 107 TooManyTo_005 2656 1.22 2.33 0.55 108 RELAYCOUNTRY_AU 2596 1.13 2.28 0.44 109 XM_H_PHPMailer 2551 1.28 2.24 0.71 110 XM_B_Unsub2 2423 1.60 2.12 1.28 111 AC_BR_BONANZA 2343 0.89 2.05 0.18 112 SpammyFromTLD_01 2257 1.02 1.98 0.44 113 FROM_EXCESS_BASE64 2241 2.11 1.96 2.20 114 XMBdyGiftCard01 2115 1.26 1.85 0.90 115 URI_TRY_3LD 2080 1.30 1.82 0.98 116 TR_XM_PHPForged 2052 0.84 1.80 0.25 117 TR_XM_PHPDW 2032 0.83 1.78 0.25 118 T_REMOTE_IMAGE 2006 2.84 1.76 3.50 119 TR_XM_INV_DKIM 1993 0.70 1.75 0.06 120 XMReplyNow 1983 0.83 1.74 0.29 121 TR_XM_FormFill2 1974 0.81 1.73 0.25 122 XM_H_PHPOS 1971 0.79 1.73 0.23 123 HK_RANDOM_REPLYTO 1955 0.74 1.71 0.15 124 SpammyFromTLD_02 1935 0.80 1.70 0.26 125 HTML_MIME_NO_HTML_TAG 1921 1.55 1.68 1.46 126 XM_HighProb1 1816 0.60 1.59 0.00 127 MIME_QP_LONG_LINE 1796 2.78 1.57 3.51 128 HOSTED_IMG_MULTI_PUB_01 1739 0.59 1.52 0.02 129 RELAYCOUNTRY_RU 1721 0.58 1.51 0.02 130 DIET_1 1702 0.81 1.49 0.40 131 T_XMHurry_00 1684 1.38 1.48 1.32 132 XM_DK_Undo_01 1622 1.59 1.42 1.69 133 RCVD_IN_VALIDITY_RPBL 1606 0.59 1.41 0.09 134 XMStockSpam_06 1599 1.55 1.40 1.64 135 TM2_M_A_HREF_HREF 1597 0.78 1.40 0.40 136 XM_B_SEO 1562 0.63 1.37 0.18 137 MAILING_LIST_MULTI 1533 1.90 1.34 2.23 138 URI_HEX 1523 1.15 1.34 1.04 139 HTML_TAG_BALANCE_BODY 1471 0.93 1.29 0.71 140 XM_DIRTYINTL 1454 0.59 1.27 0.18 141 URI_NOVOWEL 1449 1.02 1.27 0.87 142 XMPhish30 1420 0.82 1.24 0.57 143 TR_Mismatch_TLD_02 1400 0.50 1.23 0.05 144 GOOG_STO_NOIMG_HTML 1391 0.46 1.22 0.00 145 TR_XM_SEO4 1385 0.51 1.21 0.08 146 THIS_AD 1371 0.69 1.20 0.38 147 KHOP_HELO_FCRDNS 1366 0.76 1.20 0.49 148 T_XMDrugObfuBody_00 1357 0.78 1.19 0.53 149 BAYES_40 1339 2.99 1.17 4.09 150 XMGenDplmaNmb 1328 1.10 1.16 1.05 151 LongTLD 1314 0.58 1.15 0.23 152 XMSexyCombo_01 1304 0.60 1.14 0.27 153 TR_Caps_n_Bayes_99 1296 0.44 1.14 0.01 154 RELAYCOUNTRY_IN 1295 0.45 1.14 0.04 155 RDNS_DYNAMIC 1277 0.74 1.12 0.51 156 ALL_TRUSTED 1252 10.73 1.10 16.57 157 T_STY_INVIS_DIRECT 1235 0.73 1.08 0.52 158 XM_UB60 1207 0.44 1.06 0.06 159 TR_LOTS_OF_MONEY2 1193 0.68 1.05 0.46 160 T_MONEY_PERCENT 1193 0.68 1.05 0.46 161 XMNoVowels 1185 0.73 1.04 0.54 162 XM_B_COPY_HTML 1185 1.02 1.04 1.01 163 TVD_RCVD_IP 1166 2.17 1.02 2.86 164 XM_H_Undi_Recip 1144 0.45 1.00 0.12 165 MPART_ALT_DIFF_COUNT 1120 0.81 0.98 0.71 166 SCC_BODY_URI_ONLY 1119 3.14 0.98 4.45 167 URIBL_DBL_SPAM 1117 0.37 0.98 0.01 168 PDS_OTHER_BAD_TLD 1113 0.45 0.98 0.13 169 XM_SendGrid 1110 1.15 0.97 1.26 170 BAYES_20 1087 2.09 0.95 2.78 171 TR_Symld_Words 1078 1.08 0.94 1.16 172 BOUNCE_MESSAGE 1076 3.75 0.94 5.46 173 ANY_BOUNCE_MESSAGE 1076 3.75 0.94 5.46 174 XM_UB99 1043 0.35 0.91 0.01 175 RCVD_IN_PSBL 1024 0.90 0.90 0.90 176 XM_UB80 1014 0.35 0.89 0.02 177 TR_XM_InvalidRelay 1011 0.34 0.89 0.01 178 XMSubMetaSxObfu_04 991 0.43 0.87 0.17 179 TR_Mismatch_TLD_01 977 0.49 0.86 0.27 180 XMSlimDrugH 973 0.56 0.85 0.38 181 XM_RXBody 964 1.14 0.85 1.31 182 FROM_SUSPICIOUS_NTLD 949 0.33 0.83 0.03 183 SUBJ_DOLLARS 947 0.52 0.83 0.34 184 HELO_DYNAMIC_SPLIT_IP 941 0.32 0.82 0.02 185 T_XMDrugObfuBody_10 917 0.33 0.80 0.04 186 AC_HTML_NONSENSE_TAGS 916 0.32 0.80 0.02 187 TR_XM_Base64_M1 914 1.02 0.80 1.16 188 TR_XM_Undi_RecipCombo2 914 0.31 0.80 0.01 189 DKIM_ADSP_NXDOMAIN 914 0.53 0.80 0.37 190 T_Symld_Words_02 912 0.55 0.80 0.39 191 HTTPS_HTTP_MISMATCH 911 0.62 0.80 0.52 192 HTML_FONT_FACE_BAD 911 0.68 0.80 0.60 193 FILL_THIS_FORM 910 0.53 0.80 0.36 194 FROM_SUSPICIOUS_NTLD_FP 901 0.31 0.79 0.03 195 XMSubMetaSxObfu_03 893 0.55 0.78 0.41 196 XM_ProductURIs 892 0.66 0.78 0.59 197 TM2_M_OBFU_COMMENT 868 0.52 0.76 0.37 198 HTML_TEXT_INVISIBLE_STYLE 866 0.44 0.76 0.25 199 PLING_QUERY 844 0.67 0.74 0.62 200 DKIM_ADSP_CUSTOM_MED 844 0.82 0.74 0.87 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 187759 99.75 99.88 99.67 2 HTML_MESSAGE 154617 87.54 96.56 82.08 3 RELAYCOUNTRY_US 149328 78.31 76.72 79.27 4 DKIM_SIGNED 147869 83.66 92.20 78.50 5 XM_DK_Pass 145811 81.90 89.32 77.41 6 DKIM_VALID 144929 81.23 88.32 76.94 7 XM_B_Unicode 133978 76.56 85.53 71.12 8 DKIM_VALID_AU 124616 66.86 68.03 66.15 9 DCC_CHECK_NEGATIVE 111627 46.55 25.56 59.26 10 BAYES_50 109033 48.72 33.59 57.88 11 XMListUnsubscribeExists 105298 62.39 73.11 55.90 12 XM_B_SpammyWords 86603 57.10 75.47 45.97 13 XM_B_Unicode3 82719 43.84 43.71 43.91 14 DCC_CHECK 76707 53.44 74.43 40.72 15 HTML_FONT_LOW_CONTRAST 64162 33.95 33.76 34.06 16 DKIM_VALID_EF 58868 31.72 32.48 31.25 17 RCVD_IN_MSPIKE_H2 57767 31.42 32.67 30.67 18 LOC_TINY_FONT_1 55831 33.34 39.44 29.64 19 FVGT_m_MULTI_ODD 52817 29.30 31.39 28.04 20 XMSubLong 41272 21.68 21.29 21.91 21 T_TM2_M_HEADER_IN_MSG 40147 20.35 18.77 21.31 22 MIME_HTML_ONLY 39836 24.99 31.34 21.15 23 XM_B_SpammyWords2 39764 30.43 45.83 21.11 24 T_KAM_HTML_FONT_INVALID 38463 23.68 29.07 20.42 25 USER_IN_DEF_DKIM_WL 36682 13.48 3.59 19.47 26 TR_XM_DK_Unsub 31953 19.19 22.86 16.96 27 ALL_TRUSTED 31215 10.73 1.10 16.57 28 XM_Multi_Part_URI 31200 16.67 16.83 16.56 29 XM_DKIMWhitelistDomains 22702 7.66 0.42 12.05 30 UNPARSEABLE_RELAY 21528 12.18 13.42 11.43 31 BAYES_60 21313 10.10 8.09 11.31 32 XM_Evil_Numbers_Gen 16296 7.94 6.76 8.65 33 XM_B_Unsub 16250 11.85 17.17 8.63 34 XM_H_GMP 15617 6.93 4.68 8.29 35 T_TooManySym_01 14768 5.81 2.46 7.84 36 LotsOfNums_01 14636 6.79 5.18 7.77 37 TR_MAX_INTL_RELAY 14520 10.56 15.27 7.71 38 LOTS_OF_MONEY 14112 10.19 14.65 7.49 39 XM_DK_Undo_02 13870 23.45 50.01 7.36 40 BAYES_00 13757 4.68 0.36 7.30 41 RCVD_IN_VALIDITY_SAFE 13677 5.98 3.87 7.26 42 TR_XM_BayesUnsub 13350 10.70 16.68 7.09 43 RCVD_IN_MSPIKE_H3 12540 7.78 9.63 6.66 44 RCVD_IN_MSPIKE_WL 12540 7.78 9.63 6.66 45 TooManyTo_001 12476 6.44 6.15 6.62 46 XM_B_SpammyWords3 12275 10.34 16.65 6.52 47 TR_XM_DK_Bayes 11631 3.94 0.24 6.17 48 TR_XM_DK_Bayes1 11533 3.90 0.24 6.12 49 BOTNET_IPINHOSTNAME 11482 8.05 11.26 6.10 50 XMStrtUSub 11383 5.29 4.05 6.04 51 RCVD_IN_VALIDITY_CERTIFIED 11227 4.94 3.24 5.96 52 BAYES_99 11217 18.96 40.43 5.95 53 TR_XM_SpammyWords4 10787 8.61 13.38 5.73 54 HTML_IMAGE_RATIO_02 10619 6.26 7.28 5.64 55 IN_ZIMBRA_NJ_WHITELIST 10524 3.50 0.05 5.59 56 XM_H_Long_From01 10327 4.95 4.06 5.48 57 ANY_BOUNCE_MESSAGE 10276 3.75 0.94 5.46 58 BOUNCE_MESSAGE 10276 3.75 0.94 5.46 59 TR_XM_DK_Bayes2 9999 3.36 0.15 5.31 60 FSL_BULK_SIG 9872 6.45 8.44 5.24 61 HTML_IMAGE_RATIO_04 9684 4.74 4.07 5.14 62 BAYES_999 8989 15.25 32.54 4.77 63 BAYES_80 8797 6.49 9.49 4.67 64 XM_UncommonTLD01 8529 4.93 5.59 4.53 65 SCC_BODY_URI_ONLY 8391 3.14 0.98 4.45 66 RELAYCOUNTRY_META 8154 11.52 23.41 4.33 67 XMSubMetaSx_00 7708 4.77 5.89 4.09 68 BAYES_40 7700 2.99 1.17 4.09 69 MPART_ALT_DIFF 7304 4.39 5.23 3.88 70 T_TooManySym_02 7190 2.63 0.67 3.82 71 XM_Body_Dirty_Words 7165 4.86 6.61 3.80 72 INVALID_MSGID 7140 2.42 0.16 3.79 73 TO_MALFORMED 6671 2.21 0.01 3.54 74 MIME_QP_LONG_LINE 6621 2.78 1.57 3.51 75 T_REMOTE_IMAGE 6586 2.84 1.76 3.50 76 XMNumbers 6459 3.29 3.06 3.43 77 TR_XM_DKIM_Undo 5715 16.74 39.37 3.03 78 BAYES_95 5709 3.92 5.39 3.03 79 HTML_IMAGE_RATIO_06 5672 3.55 4.45 3.01 80 XM_B_Phish_Phrases 5649 3.42 4.10 3.00 81 BAYES_05 5617 2.05 0.52 2.98 82 TVD_RCVD_IP 5394 2.17 1.02 2.86 83 BAYES_20 5228 2.09 0.95 2.78 84 XMSexyCombo_05 5209 3.53 4.79 2.77 85 TR_DCC_Bayes_99 5119 12.91 29.73 2.72 86 XM_PDF 5103 1.78 0.24 2.71 87 TR_XM_SpammyRelay 5094 8.89 19.10 2.70 88 XMBSHREFv2 4967 1.73 0.24 2.64 89 MIME_HTML_MOSTLY 4740 3.03 3.89 2.52 90 XM_B_SpammyTLD 4621 2.74 3.21 2.45 91 XM_CamelCaseFrm001 4587 2.58 2.82 2.44 92 RCVD_IN_IADB_LISTED 4574 1.73 0.58 2.43 93 XM_SPF_SoftFail 4514 3.07 4.18 2.40 94 MAILING_LIST_MULTI 4202 1.90 1.34 2.23 95 RELAYCOUNTRY_CA 4188 6.60 13.82 2.22 96 FROM_EXCESS_BASE64 4147 2.11 1.96 2.20 97 RCVD_IN_IADB_SPF 4108 1.55 0.52 2.18 98 MIME_HTML_ONLY_MULTI 3966 2.40 2.89 2.11 99 T_XMDrugObfuBody_14 3926 2.76 3.87 2.08 100 XMDiploma_00 3915 2.42 2.98 2.08 101 TR_XM_UnparsRelay 3867 4.29 7.99 2.05 102 RCVD_IN_IADB_SENDERID 3753 1.42 0.47 1.99 103 RCVD_IN_IADB_DK 3675 1.40 0.48 1.95 104 T_XMDrugObfuBody_08 3544 2.22 2.78 1.88 105 TM2_M_URI_OPT_OUT 3388 2.41 3.42 1.80 106 HTML_IMAGE_RATIO_08 3350 2.40 3.42 1.78 107 TR_XM_PhishingBody 3316 2.19 2.91 1.76 108 IN_HORDE_ADDRESS_BOOK 3228 1.08 0.04 1.71 109 TVD_SPACE_RATIO 3189 1.10 0.12 1.69 110 XM_DK_Undo_01 3180 1.59 1.42 1.69 111 TooManyTo_002 3123 1.98 2.52 1.66 112 TM2_M_VERY_LONG_WORD 3088 2.04 2.70 1.64 113 XMStockSpam_06 3082 1.55 1.40 1.64 114 UNTRUSTED_Relay 2943 3.54 6.82 1.56 115 DKIM_INVALID 2940 2.43 3.88 1.56 116 RCVD_IN_IADB_VOUCHED 2873 1.07 0.32 1.53 117 XM_B_Investor 2861 2.54 4.21 1.52 118 HTML_MIME_NO_HTML_TAG 2759 1.55 1.68 1.46 119 XMGappySubj_01 2676 0.96 0.20 1.42 120 T_XMHurry_00 2482 1.38 1.48 1.32 121 XM_RXBody 2469 1.14 0.85 1.31 122 XM_B_Unsub2 2411 1.60 2.12 1.28 123 XM_SendGrid 2382 1.15 0.97 1.26 124 XM_H_Long_From02 2328 1.01 0.65 1.24 125 XM_GoogleGroups 2327 0.92 0.41 1.24 126 XMBrknScrpt_02 2313 1.71 2.52 1.23 127 T_TooManySym_03 2256 0.85 0.27 1.20 128 TR_XM_Base64_M1 2182 1.02 0.80 1.16 129 TR_Symld_Words 2177 1.08 0.94 1.16 130 TR_LOTS_OF_MONEY3 2052 2.34 4.42 1.09 131 XM_OfRef6 2007 2.12 3.87 1.07 132 XMGenDplmaNmb 1985 1.10 1.16 1.05 133 RCVD_IN_IADB_OPTIN 1978 0.74 0.23 1.05 134 URI_HEX 1966 1.15 1.34 1.04 135 XMGappySubj_02 1955 0.68 0.08 1.04 136 XMBody_17 1929 3.61 7.87 1.02 137 BOTNET 1916 3.80 8.40 1.02 138 XM_B_COPY_HTML 1904 1.02 1.04 1.01 139 URI_TRY_3LD 1845 1.30 1.82 0.98 140 TR_XM_SpammyWords5 1767 2.07 3.93 0.94 141 XM_B_SpammyWords4 1766 1.53 2.51 0.94 142 TR_XM_DK_SendGrid 1741 0.84 0.70 0.92 143 RCVD_IN_PSBL 1698 0.90 0.90 0.90 144 XMBdyGiftCard01 1692 1.26 1.85 0.90 145 USER_IN_WELCOMELIST 1685 0.56 0.00 0.89 146 USER_IN_WHITELIST 1685 0.56 0.00 0.89 147 RCVD_IN_BL_SPAMCOP_NET 1668 6.24 15.09 0.89 148 XM_UB50 1666 1.75 3.19 0.88 149 TooManyTo_003 1660 1.46 2.42 0.88 150 SUBJ_ALL_CAPS 1655 1.52 2.59 0.88 151 TR_XM_SpammyWords2 1639 7.19 17.63 0.87 152 DKIM_ADSP_CUSTOM_MED 1637 0.82 0.74 0.87 153 URI_NOVOWEL 1634 1.02 1.27 0.87 154 XMSubMetaSxObfu_02 1554 0.60 0.23 0.82 155 XMBody_95 1529 0.56 0.14 0.81 156 TR_MetaPhish_Combo_01 1380 0.71 0.68 0.73 157 MPART_ALT_DIFF_COUNT 1341 0.81 0.98 0.71 158 HTML_TAG_BALANCE_BODY 1333 0.93 1.29 0.71 159 XM_H_PHPMailer 1330 1.28 2.24 0.71 160 XMSubMetaI_00 1242 0.66 0.66 0.66 161 TooManyTo_004 1218 1.30 2.38 0.65 162 PLING_QUERY 1175 0.67 0.74 0.62 163 SHOPIFY_IMG_NOT_RCVD_SFY 1143 0.65 0.71 0.61 164 HTML_FONT_FACE_BAD 1135 0.68 0.80 0.60 165 TR_XM_SPAMCOP 1127 4.97 12.19 0.60 166 XM_ProductURIs 1102 0.66 0.78 0.59 167 NML_ADSP_CUSTOM_MED 1080 0.60 0.64 0.57 168 XMPhish14 1074 0.51 0.42 0.57 169 XMPhish30 1071 0.82 1.24 0.57 170 TooManyTo_005 1029 1.22 2.33 0.55 171 XMNoVowels 1025 0.73 1.04 0.54 172 T_XMDrugObfuBody_00 1005 0.78 1.19 0.53 173 FORGED_GMAIL_RCVD 994 0.56 0.61 0.53 174 T_STY_INVIS_DIRECT 985 0.73 1.08 0.52 175 T_FILL_THIS_FORM_SHORT 978 1.96 4.34 0.52 176 HTTPS_HTTP_MISMATCH 971 0.62 0.80 0.52 177 XM_B_FormFill 969 0.34 0.05 0.51 178 RDNS_DYNAMIC 952 0.74 1.12 0.51 179 KHOP_HELO_FCRDNS 927 0.76 1.20 0.49 180 XMLngstWrd_00 907 0.38 0.20 0.48 181 TR_LOTS_OF_MONEY2 867 0.68 1.05 0.46 182 T_MONEY_PERCENT 867 0.68 1.05 0.46 183 T_TooManySym_04 854 0.34 0.16 0.45 184 SpammyFromTLD_01 826 1.02 1.98 0.44 185 RELAYCOUNTRY_AU 823 1.13 2.28 0.44 186 T_OBFU_PDF_ATTACH 822 0.28 0.03 0.44 187 XMLngstWrd_01 807 0.34 0.18 0.43 188 XM_S_SubURI 796 0.28 0.05 0.42 189 XMSubMetaSxObfu_03 776 0.55 0.78 0.41 190 DIET_1 756 0.81 1.49 0.40 191 TM2_M_A_HREF_HREF 752 0.78 1.40 0.40 192 XM_ShortIntro_01 750 0.41 0.42 0.40 193 HELO_NO_DOMAIN 744 0.36 0.31 0.39 194 HELO_NODOT 744 0.36 0.31 0.39 195 T_Symld_Words_02 743 0.55 0.80 0.39 196 CTE_8BIT_MISMATCH 729 0.27 0.08 0.39 197 XMSlimDrugH 725 0.56 0.85 0.38 198 XM_B_REG_HTML 721 0.48 0.65 0.38 199 THIS_AD 720 0.69 1.20 0.38 200 BASE64_LENGTH_79_INF 702 0.26 0.09 0.37 ----------------------------------------------------------------------