Email: 489443 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 1.23 sec Spam: 151581 Autolearn: 0 AvgScore: 13.71 AvgScanTime: 1.30 sec Ham: 337862 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 1.20 sec Time Spent Running SA: 166.98 hours Time Spent Processing Spam: 54.70 hours Time Spent Processing Ham: 112.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 151038 99.46 99.64 99.38 2 HTML_MESSAGE 144961 88.73 95.63 85.63 3 DKIM_SIGNED 138126 80.09 91.12 75.13 4 XM_DK_Pass 131866 77.75 86.99 73.60 5 DKIM_VALID 129828 76.55 85.65 72.46 6 XM_B_Unicode 126579 72.74 83.51 67.92 7 RELAYCOUNTRY_US 120709 80.03 79.63 80.20 8 DCC_CHECK 111609 45.52 73.63 32.91 9 XM_B_SpammyWords 109641 52.81 72.33 44.05 10 XMListUnsubscribeExists 106950 55.30 70.56 48.46 11 DKIM_VALID_AU 97736 60.24 64.48 58.34 12 XM_DK_Undo_02 68591 17.68 45.25 5.32 13 XM_B_SpammyWords2 67283 26.39 44.39 18.31 14 XM_B_Unicode3 64731 40.15 42.70 39.01 15 LOC_TINY_FONT_1 59837 29.33 39.48 24.78 16 BAYES_99 56158 14.45 37.05 4.31 17 BAYES_50 54872 52.03 36.20 59.13 18 TR_XM_DKIM_Undo 52163 12.28 34.41 2.36 19 HTML_FONT_LOW_CONTRAST 51541 29.54 34.00 27.54 20 RCVD_IN_MSPIKE_H2 50751 31.10 33.48 30.03 21 DKIM_VALID_EF 50537 31.28 33.34 30.36 22 FVGT_m_MULTI_ODD 47647 28.08 31.43 26.58 23 MIME_HTML_ONLY 46140 22.39 30.44 18.78 24 BAYES_999 44077 11.28 29.08 3.29 25 T_KAM_HTML_FONT_INVALID 41402 22.25 27.31 19.98 26 TR_DCC_Bayes_99 40858 9.35 26.95 1.46 27 DCC_CHECK_NEGATIVE 39943 54.44 26.35 67.04 28 TR_XM_DK_Unsub 35034 16.88 23.11 14.08 29 T_TM2_M_HEADER_IN_MSG 34571 28.09 22.81 30.46 30 XMSubLong 34443 22.41 22.72 22.27 31 RELAYCOUNTRY_META 31758 9.50 20.95 4.36 32 LOTS_OF_MONEY 28432 10.76 18.76 7.17 33 XM_Multi_Part_URI 27846 15.19 18.37 13.76 34 TR_XM_SpammyRelay 24957 6.81 16.46 2.48 35 TR_XM_SpammyWords4 24778 8.56 16.35 5.06 36 XM_B_Unsub 24487 10.60 16.15 8.11 37 TR_XM_BayesUnsub 23697 9.31 15.63 6.48 38 TR_XM_SpammyWords2 23541 5.17 15.53 0.51 39 TR_MAX_INTL_RELAY 23443 9.54 15.47 6.89 40 XM_B_SpammyWords3 21445 7.40 14.15 4.38 41 UNPARSEABLE_RELAY 19267 11.27 12.71 10.62 42 BOTNET_IPINHOSTNAME 18737 6.45 12.36 3.80 43 RCVD_IN_BL_SPAMCOP_NET 18322 4.12 12.09 0.54 44 RELAYCOUNTRY_CA 16184 4.26 10.68 1.38 45 TR_XM_SPAMCOP 15670 3.43 10.34 0.32 46 FSL_BULK_SIG 14715 5.81 9.71 4.06 47 BAYES_80 14496 5.89 9.56 4.24 48 RCVD_IN_MSPIKE_H3 13615 6.94 8.98 6.02 49 RCVD_IN_MSPIKE_WL 13615 6.94 8.98 6.02 50 XM_Evil_Numbers_Gen 13463 8.37 8.88 8.14 51 BOTNET 13411 3.54 8.85 1.16 52 BAYES_60 13017 9.09 8.59 9.31 53 XM_Body_Dirty_Words 11232 4.09 7.41 2.61 54 TR_XM_UnparsRelay 10950 3.42 7.22 1.72 55 UNTRUSTED_Relay 9660 3.08 6.37 1.61 56 XMBody_17 9587 2.46 6.32 0.72 57 LotsOfNums_01 9523 7.42 6.28 7.92 58 XM_B_Investor 9310 3.15 6.14 1.80 59 XMSubMetaSx_00 9153 4.60 6.04 3.96 60 HTML_IMAGE_RATIO_02 9070 5.05 5.98 4.63 61 XM_H_GMP 8971 6.50 5.92 6.76 62 XM_UncommonTLD01 8801 4.47 5.81 3.87 63 MPART_ALT_DIFF 8669 4.10 5.72 3.37 64 DKIM_INVALID 8298 3.54 5.47 2.67 65 BAYES_95 7959 3.45 5.25 2.64 66 XM_SPF_SoftFail 7667 3.87 5.06 3.34 67 XM_B_Phish_Phrases 7397 3.63 4.88 3.07 68 TR_XM_SpammyWords5 7379 2.68 4.87 1.70 69 TR_LOTS_OF_MONEY3 7317 2.05 4.83 0.80 70 TooManyTo_001 7295 7.80 4.81 9.15 71 XM_H_Long_From01 7207 4.97 4.75 5.07 72 HTML_IMAGE_RATIO_04 7036 4.33 4.64 4.19 73 XMSexyCombo_05 6962 2.83 4.59 2.03 74 XM_OfRef6 6782 2.23 4.47 1.22 75 XMNumbers 6074 3.28 4.01 2.96 76 T_FILL_THIS_FORM_SHORT 5980 1.87 3.95 0.94 77 HTML_IMAGE_RATIO_06 5774 3.15 3.81 2.86 78 T_XMDrugObfuBody_08 5511 2.25 3.64 1.62 79 XMStrtUSub 5465 4.05 3.61 4.24 80 XM_B_SpammyTLD 5375 2.69 3.55 2.30 81 MIME_HTML_MOSTLY 5341 2.61 3.52 2.20 82 TR_XM_PhishingBody 5329 2.09 3.52 1.45 83 SUBJ_ALL_CAPS 5055 2.35 3.33 1.91 84 TR_XM_NoHeaderRelay 4877 1.13 3.22 0.19 85 MIME_HTML_ONLY_MULTI 4871 2.28 3.21 1.86 86 HTML_IMAGE_RATIO_08 4863 2.59 3.21 2.31 87 T_XMDrugObfuBody_14 4854 2.25 3.20 1.82 88 T_TooManySym_01 4574 4.86 3.02 5.69 89 TM2_M_URI_OPT_OUT 4559 2.10 3.01 1.69 90 RCVD_IN_VALIDITY_SAFE 4546 4.30 3.00 4.89 91 MIME_QP_LONG_LINE 4486 4.28 2.96 4.87 92 TR_XM_BayesRelay 4417 0.90 2.91 0.00 93 TM2_M_VERY_LONG_WORD 4398 1.85 2.90 1.38 94 XM_B_SpammyWords4 4381 1.35 2.89 0.66 95 XMDiploma_00 4293 2.25 2.83 1.99 96 XM_H_Undi_Recip 4192 1.02 2.77 0.24 97 XM_UB50 4104 1.48 2.71 0.93 98 USER_IN_DEF_DKIM_WL 3868 9.94 2.55 13.26 99 RCVD_IN_VALIDITY_CERTIFIED 3728 3.49 2.46 3.96 100 FONT_INVIS_LONG_LINE 3700 0.78 2.44 0.04 101 SpammyFromTLD_01 3695 1.29 2.44 0.77 102 TR_XM_Undi_RecipCombo2 3627 0.75 2.39 0.01 103 XM_B_Unsub2 3539 1.71 2.33 1.43 104 TR_XM_FormFill 3509 0.74 2.31 0.04 105 TR_XM_Undi_Recip19 3435 0.76 2.27 0.08 106 RELAYCOUNTRY_AU 3333 1.18 2.20 0.73 107 XM_CamelCaseFrm001 3328 2.25 2.20 2.28 108 XMBrknScrpt_02 3212 1.20 2.12 0.79 109 XM_URI_RBL 3142 0.74 2.07 0.14 110 RCVD_IN_VALIDITY_RPBL 2967 0.64 1.96 0.04 111 UNDISC_MONEY 2957 0.61 1.95 0.01 112 HTML_MIME_NO_HTML_TAG 2949 2.26 1.95 2.40 113 ANY_BOUNCE_MESSAGE 2909 3.57 1.92 4.32 114 BOUNCE_MESSAGE 2905 3.57 1.92 4.32 115 TR_XM_Undi_Recip5 2839 0.58 1.87 0.00 116 T_XMHurry_00 2768 0.89 1.83 0.47 117 TR_XM_PHPForged 2644 0.89 1.74 0.51 118 DKIM_ADSP_NXDOMAIN 2589 0.74 1.71 0.31 119 URI_TRY_3LD 2574 1.07 1.70 0.79 120 TR_XM_INV_DKIM 2573 0.57 1.70 0.06 121 TR_Mismatch_TLD_02 2572 0.58 1.70 0.08 122 FROM_EXCESS_BASE64 2572 1.69 1.70 1.69 123 T_REMOTE_IMAGE 2552 3.17 1.68 3.84 124 ALL_TRUSTED 2509 11.80 1.66 16.36 125 TR_XM_Undi_RecipCombo3 2465 0.51 1.63 0.00 126 SpammyFromTLD_02 2450 0.65 1.62 0.22 127 TR_Caps_n_Bayes_99 2430 0.51 1.60 0.02 128 TR_XM_PHPDW 2426 0.84 1.60 0.50 129 TR_XM_Undi_Recip11 2357 0.52 1.55 0.05 130 TR_XM_FormFill2 2354 0.83 1.55 0.51 131 XM_H_PHPOS 2342 0.81 1.55 0.48 132 URI_HEX 2302 1.28 1.52 1.17 133 MAILING_LIST_MULTI 2290 2.49 1.51 2.93 134 AC_BR_BONANZA 2286 0.54 1.51 0.11 135 HK_RANDOM_REPLYTO 2166 0.52 1.43 0.11 136 FILL_THIS_FORM 2159 0.86 1.42 0.60 137 BAYES_40 2137 3.70 1.41 4.72 138 XMStockSpam_06 2077 1.22 1.37 1.15 139 XMGenDplmaNmb 2054 1.17 1.36 1.08 140 KHOP_HELO_FCRDNS 2054 1.28 1.36 1.25 141 XM_DK_Undo_01 2048 1.72 1.35 1.89 142 THIS_AD 2030 0.67 1.34 0.37 143 XM_DIRTYINTL 2026 0.52 1.34 0.15 144 RCVD_IN_PSBL 2023 0.63 1.33 0.31 145 XM_UB99 1957 0.40 1.29 0.00 146 T_XMDrugObfuBody_00 1952 0.85 1.29 0.65 147 HTML_TAG_BALANCE_BODY 1926 0.84 1.27 0.65 148 TR_Symld_Words 1923 1.45 1.27 1.54 149 BOTNET_NORDNS 1912 0.40 1.26 0.01 150 XMPhish30 1833 0.69 1.21 0.46 151 XMHTML_After_End 1830 0.59 1.21 0.31 152 TR_XM_InvalidRelay 1813 0.39 1.20 0.03 153 DKIM_ADSP_CUSTOM_MED 1805 1.09 1.19 1.04 154 TR_XM_Undi_Recip2 1786 0.37 1.18 0.01 155 HTTPS_HTTP_MISMATCH 1763 0.97 1.16 0.88 156 TR_LOTS_OF_MONEY2 1759 0.50 1.16 0.20 157 T_MONEY_PERCENT 1759 0.50 1.16 0.20 158 HOSTED_IMG_MULTI_PUB_01 1712 0.36 1.13 0.02 159 XMSubMetaI_00 1709 0.89 1.13 0.79 160 MONEY_FORM 1705 0.35 1.12 0.01 161 XM_HighProb1 1702 0.35 1.12 0.00 162 URI_NOVOWEL 1673 1.10 1.10 1.10 163 URIBL_DBL_SPAM 1660 0.35 1.10 0.01 164 HK_SCAM 1649 0.34 1.09 0.01 165 TR_XM_Undi_Recip9 1642 0.34 1.08 0.00 166 XMReplyNow 1639 0.51 1.08 0.25 167 XM_SendGrid 1590 1.32 1.05 1.44 168 TR_XM_Undi_RecipCombo4 1585 0.32 1.05 0.00 169 RCVD_IN_IADB_LISTED 1569 2.83 1.04 3.64 170 T_Symld_Words_02 1565 0.70 1.03 0.55 171 XM_UB60 1544 0.36 1.02 0.07 172 TR_XM_Undi_Recip6 1539 0.32 1.02 0.00 173 NML_ADSP_CUSTOM_MED 1538 0.82 1.01 0.73 174 DIET_1 1523 0.48 1.00 0.25 175 XMBdyGiftCard01 1519 0.75 1.00 0.63 176 XM_B_Phish66 1484 0.52 0.98 0.31 177 RELAYCOUNTRY_RU 1463 0.32 0.97 0.04 178 XM_UB999 1449 0.30 0.96 0.00 179 BAYES_20 1434 2.72 0.95 3.52 180 XM_B_COVIDMETA 1427 0.49 0.94 0.28 181 RDNS_DYNAMIC 1426 0.57 0.94 0.40 182 MISSING_HEADERS 1425 0.60 0.94 0.45 183 SCC_BODY_URI_ONLY 1407 2.42 0.93 3.09 184 RCVD_IN_IADB_SPF 1397 2.49 0.92 3.19 185 MPART_ALT_DIFF_COUNT 1361 0.66 0.90 0.55 186 XMSubMetaSxObfu_03 1349 0.61 0.89 0.49 187 FORGED_MUA_OUTLOOK 1346 0.29 0.89 0.02 188 XM_H_PHPMailer 1343 0.84 0.89 0.81 189 FORGED_GMAIL_RCVD 1320 0.69 0.87 0.62 190 TooManyTo_002 1320 2.37 0.87 3.04 191 RCVD_IN_IADB_SENDERID 1311 2.23 0.86 2.85 192 RCVD_IN_IADB_DK 1311 2.17 0.86 2.75 193 XMSlimDrugH 1304 0.51 0.86 0.35 194 AXB_XMAILER_MIMEOLE_OL_024C2 1300 0.27 0.86 0.00 195 FSL_CTYPE_WIN1251 1291 0.26 0.85 0.00 196 XM_H_Long_From02 1289 1.06 0.85 1.16 197 TR_Sbj_FN_Bdy 1277 0.35 0.84 0.13 198 RELAYCOUNTRY_IN 1274 0.30 0.84 0.06 199 TR_MetaPhish_Combo_01 1273 0.80 0.84 0.78 200 XM_B_COPY_HTML 1267 0.62 0.84 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 335783 99.46 99.64 99.38 2 HTML_MESSAGE 289323 88.73 95.63 85.63 3 RELAYCOUNTRY_US 270971 80.03 79.63 80.20 4 DKIM_SIGNED 253852 80.09 91.12 75.13 5 XM_DK_Pass 248675 77.75 86.99 73.60 6 DKIM_VALID 244830 76.55 85.65 72.46 7 XM_B_Unicode 229462 72.74 83.51 67.92 8 DCC_CHECK_NEGATIVE 226510 54.44 26.35 67.04 9 BAYES_50 199764 52.03 36.20 59.13 10 DKIM_VALID_AU 197098 60.24 64.48 58.34 11 XMListUnsubscribeExists 163734 55.30 70.56 48.46 12 XM_B_SpammyWords 148820 52.81 72.33 44.05 13 XM_B_Unicode3 131786 40.15 42.70 39.01 14 DCC_CHECK 111196 45.52 73.63 32.91 15 T_TM2_M_HEADER_IN_MSG 102921 28.09 22.81 30.46 16 DKIM_VALID_EF 102561 31.28 33.34 30.36 17 RCVD_IN_MSPIKE_H2 101467 31.10 33.48 30.03 18 HTML_FONT_LOW_CONTRAST 93040 29.54 34.00 27.54 19 FVGT_m_MULTI_ODD 89793 28.08 31.43 26.58 20 LOC_TINY_FONT_1 83707 29.33 39.48 24.78 21 XMSubLong 75251 22.41 22.72 22.27 22 T_KAM_HTML_FONT_INVALID 67492 22.25 27.31 19.98 23 MIME_HTML_ONLY 63453 22.39 30.44 18.78 24 XM_B_SpammyWords2 61875 26.39 44.39 18.31 25 ALL_TRUSTED 55268 11.80 1.66 16.36 26 TR_XM_DK_Unsub 47578 16.88 23.11 14.08 27 XM_Multi_Part_URI 46504 15.19 18.37 13.76 28 USER_IN_DEF_DKIM_WL 44796 9.94 2.55 13.26 29 UNPARSEABLE_RELAY 35871 11.27 12.71 10.62 30 BAYES_60 31460 9.09 8.59 9.31 31 BAYES_00 31220 6.53 0.49 9.24 32 TooManyTo_001 30904 7.80 4.81 9.15 33 XM_Evil_Numbers_Gen 27510 8.37 8.88 8.14 34 XM_B_Unsub 27395 10.60 16.15 8.11 35 LotsOfNums_01 26772 7.42 6.28 7.92 36 XM_DKIMWhitelistDomains 25339 5.29 0.36 7.50 37 LOTS_OF_MONEY 24210 10.76 18.76 7.17 38 TR_MAX_INTL_RELAY 23266 9.54 15.47 6.89 39 IN_ZIMBRA_NJ_WHITELIST 22843 4.69 0.08 6.76 40 XM_H_GMP 22839 6.50 5.92 6.76 41 TR_XM_BayesUnsub 21885 9.31 15.63 6.48 42 TR_XM_DK_Bayes 21158 4.41 0.29 6.26 43 TR_XM_DK_Bayes1 20794 4.34 0.29 6.15 44 RCVD_IN_MSPIKE_WL 20339 6.94 8.98 6.02 45 RCVD_IN_MSPIKE_H3 20337 6.94 8.98 6.02 46 T_TooManySym_01 19237 4.86 3.02 5.69 47 XM_DK_Undo_02 17958 17.68 45.25 5.32 48 TR_XM_DK_Bayes2 17877 3.73 0.25 5.29 49 XM_H_Long_From01 17127 4.97 4.75 5.07 50 TR_XM_SpammyWords4 17110 8.56 16.35 5.06 51 XM_PDF 16749 3.64 0.69 4.96 52 RCVD_IN_VALIDITY_SAFE 16513 4.30 3.00 4.89 53 MIME_QP_LONG_LINE 16440 4.28 2.96 4.87 54 BAYES_40 15953 3.70 1.41 4.72 55 HTML_IMAGE_RATIO_02 15651 5.05 5.98 4.63 56 XM_B_SpammyWords3 14785 7.40 14.15 4.38 57 RELAYCOUNTRY_META 14737 9.50 20.95 4.36 58 ANY_BOUNCE_MESSAGE 14587 3.57 1.92 4.32 59 BOUNCE_MESSAGE 14585 3.57 1.92 4.32 60 BAYES_99 14577 14.45 37.05 4.31 61 XMStrtUSub 14338 4.05 3.61 4.24 62 BAYES_80 14321 5.89 9.56 4.24 63 HTML_IMAGE_RATIO_04 14146 4.33 4.64 4.19 64 FSL_BULK_SIG 13702 5.81 9.71 4.06 65 XMSubMetaSx_00 13373 4.60 6.04 3.96 66 RCVD_IN_VALIDITY_CERTIFIED 13366 3.49 2.46 3.96 67 XM_UncommonTLD01 13074 4.47 5.81 3.87 68 T_REMOTE_IMAGE 12958 3.17 1.68 3.84 69 BOTNET_IPINHOSTNAME 12845 6.45 12.36 3.80 70 RCVD_IN_IADB_LISTED 12298 2.83 1.04 3.64 71 BAYES_20 11886 2.72 0.95 3.52 72 MPART_ALT_DIFF 11399 4.10 5.72 3.37 73 XM_SPF_SoftFail 11282 3.87 5.06 3.34 74 BAYES_999 11115 11.28 29.08 3.29 75 RCVD_IN_IADB_SPF 10776 2.49 0.92 3.19 76 SCC_BODY_URI_ONLY 10451 2.42 0.93 3.09 77 XM_B_Phish_Phrases 10388 3.63 4.88 3.07 78 TooManyTo_002 10285 2.37 0.87 3.04 79 XMNumbers 9994 3.28 4.01 2.96 80 MAILING_LIST_MULTI 9912 2.49 1.51 2.93 81 BAYES_05 9748 2.15 0.51 2.89 82 HTML_IMAGE_RATIO_06 9654 3.15 3.81 2.86 83 T_TooManySym_02 9642 2.22 0.81 2.85 84 RCVD_IN_IADB_SENDERID 9614 2.23 0.86 2.85 85 RCVD_IN_IADB_DK 9307 2.17 0.86 2.75 86 DKIM_INVALID 9022 3.54 5.47 2.67 87 BAYES_95 8932 3.45 5.25 2.64 88 XM_Body_Dirty_Words 8805 4.09 7.41 2.61 89 TR_XM_SpammyRelay 8380 6.81 16.46 2.48 90 RCVD_IN_IADB_VOUCHED 8142 1.84 0.56 2.41 91 HTML_MIME_NO_HTML_TAG 8092 2.26 1.95 2.40 92 TR_XM_DKIM_Undo 7959 12.28 34.41 2.36 93 HTML_IMAGE_RATIO_08 7791 2.59 3.21 2.31 94 XM_B_SpammyTLD 7774 2.69 3.55 2.30 95 XM_CamelCaseFrm001 7708 2.25 2.20 2.28 96 MIME_HTML_MOSTLY 7437 2.61 3.52 2.20 97 INVALID_MSGID 7247 1.52 0.12 2.14 98 HELO_NODOT 7100 1.57 0.39 2.10 99 HELO_NO_DOMAIN 7091 1.56 0.37 2.10 100 XMSexyCombo_05 6868 2.83 4.59 2.03 101 XMDiploma_00 6708 2.25 2.83 1.99 102 TO_MALFORMED 6676 1.37 0.02 1.98 103 SUBJ_ALL_CAPS 6445 2.35 3.33 1.91 104 XM_DK_Undo_01 6387 1.72 1.35 1.89 105 MIME_HTML_ONLY_MULTI 6291 2.28 3.21 1.86 106 T_XMDrugObfuBody_14 6134 2.25 3.20 1.82 107 XM_B_Investor 6084 3.15 6.14 1.80 108 TooManyTo_003 5812 1.42 0.75 1.72 109 TR_XM_UnparsRelay 5795 3.42 7.22 1.72 110 RCVD_IN_IADB_OPTIN 5742 1.29 0.38 1.70 111 TR_XM_SpammyWords5 5739 2.68 4.87 1.70 112 FROM_EXCESS_BASE64 5711 1.69 1.70 1.69 113 TM2_M_URI_OPT_OUT 5703 2.10 3.01 1.69 114 T_XMDrugObfuBody_08 5479 2.25 3.64 1.62 115 UNTRUSTED_Relay 5433 3.08 6.37 1.61 116 TR_Symld_Words 5194 1.45 1.27 1.54 117 IN_HORDE_ADDRESS_BOOK 4940 1.03 0.06 1.46 118 TR_DCC_Bayes_99 4926 9.35 26.95 1.46 119 TR_XM_PhishingBody 4907 2.09 3.52 1.45 120 XM_SendGrid 4878 1.32 1.05 1.44 121 XM_B_Unsub2 4846 1.71 2.33 1.43 122 TM2_M_VERY_LONG_WORD 4676 1.85 2.90 1.38 123 RELAYCOUNTRY_CA 4664 4.26 10.68 1.38 124 TooManyTo_004 4368 1.11 0.69 1.29 125 KHOP_HELO_FCRDNS 4215 1.28 1.36 1.25 126 XMCapTrack 4198 1.00 0.47 1.24 127 XM_OfRef6 4128 2.23 4.47 1.22 128 XM_RXBody 3977 0.96 0.47 1.18 129 TVD_RCVD_IP 3972 1.05 0.76 1.18 130 URI_HEX 3963 1.28 1.52 1.17 131 BOTNET 3915 3.54 8.85 1.16 132 XM_H_Long_From02 3906 1.06 0.85 1.16 133 TVD_SPACE_RATIO 3901 0.84 0.15 1.15 134 XMStockSpam_06 3888 1.22 1.37 1.15 135 XM_GoogleGroups 3834 0.95 0.52 1.13 136 URI_NOVOWEL 3733 1.10 1.10 1.10 137 XMGenDplmaNmb 3654 1.17 1.36 1.08 138 TooManyTo_005 3637 0.95 0.65 1.08 139 T_TooManySym_03 3540 0.80 0.26 1.05 140 DKIM_ADSP_CUSTOM_MED 3517 1.09 1.19 1.04 141 XMGappySubj_01 3325 0.74 0.18 0.98 142 TR_XM_DK_SendGrid 3207 0.86 0.66 0.95 143 T_FILL_THIS_FORM_SHORT 3186 1.87 3.95 0.94 144 XMNoVowels 3170 0.86 0.69 0.94 145 XM_UB50 3144 1.48 2.71 0.93 146 XMBSHREFv2 3091 0.71 0.26 0.91 147 HTTPS_HTTP_MISMATCH 2964 0.97 1.16 0.88 148 XM_H_PHPMailer 2744 0.84 0.89 0.81 149 TR_LOTS_OF_MONEY3 2715 2.05 4.83 0.80 150 XM_ShortIntro_01 2690 0.77 0.71 0.80 151 XMBrknScrpt_02 2682 1.20 2.12 0.79 152 TR_XM_Base64_M1 2677 0.75 0.67 0.79 153 URI_TRY_3LD 2670 1.07 1.70 0.79 154 XMSubMetaI_00 2667 0.89 1.13 0.79 155 TR_MetaPhish_Combo_01 2642 0.80 0.84 0.78 156 SpammyFromTLD_01 2614 1.29 2.44 0.77 157 NML_ADSP_CUSTOM_MED 2460 0.82 1.01 0.73 158 RELAYCOUNTRY_AU 2454 1.18 2.20 0.73 159 T_OBFU_PDF_ATTACH 2454 0.54 0.12 0.73 160 XMBody_17 2430 2.46 6.32 0.72 161 XM_ProductURIs 2367 0.70 0.71 0.70 162 XMBody_95 2334 0.54 0.19 0.69 163 XMSubMetaSSx_00 2290 0.70 0.74 0.68 164 TO_NO_BRKTS_HTML_ONLY 2263 0.58 0.38 0.67 165 XM_B_SpammyWords4 2245 1.35 2.89 0.66 166 SHORT_HELO_AND_INLINE_IMAGE 2212 0.47 0.06 0.65 167 T_XMDrugObfuBody_00 2210 0.85 1.29 0.65 168 HTML_TAG_BALANCE_BODY 2202 0.84 1.27 0.65 169 XMBdyGiftCard01 2143 0.75 1.00 0.63 170 XM_B_FormFill 2129 0.48 0.14 0.63 171 FORGED_GMAIL_RCVD 2080 0.69 0.87 0.62 172 FILL_THIS_FORM 2042 0.86 1.42 0.60 173 XMGappySubj_02 1901 0.41 0.08 0.56 174 T_Symld_Words_02 1865 0.70 1.03 0.55 175 MPART_ALT_DIFF_COUNT 1857 0.66 0.90 0.55 176 FROM_GOV_DKIM_AU 1821 0.41 0.11 0.54 177 RCVD_IN_BL_SPAMCOP_NET 1820 4.12 12.09 0.54 178 XMLngstWrd_00 1779 0.55 0.62 0.53 179 XM_B_COPY_HTML 1776 0.62 0.84 0.53 180 USER_IN_WELCOMELIST 1749 0.36 0.00 0.52 181 USER_IN_WHITELIST 1749 0.36 0.00 0.52 182 TR_XM_SpammyWords2 1739 5.17 15.53 0.51 183 TR_XM_PHPForged 1724 0.89 1.74 0.51 184 HTML_IMAGE_ONLY_32 1719 0.39 0.12 0.51 185 TR_XM_FormFill2 1711 0.83 1.55 0.51 186 TR_XM_PHPDW 1680 0.84 1.60 0.50 187 HTML_FONT_FACE_BAD 1664 0.58 0.78 0.49 188 XMDateMe_00 1660 0.44 0.32 0.49 189 XMSubMetaSxObfu_03 1654 0.61 0.89 0.49 190 XM_H_PHPOS 1637 0.81 1.55 0.48 191 HTML_IMAGE_ONLY_20 1622 0.47 0.46 0.48 192 T_XMHurry_00 1604 0.89 1.83 0.47 193 XMPhish30 1557 0.69 1.21 0.46 194 PLING_QUERY 1538 0.47 0.50 0.46 195 TM2_M_BODY_EMPTY 1535 0.38 0.22 0.45 196 HTML_IMAGE_ONLY_28 1511 0.46 0.48 0.45 197 MISSING_HEADERS 1508 0.60 0.94 0.45 198 RELAYCOUNTRY_GB 1493 0.51 0.66 0.44 199 XMMoneyMeta_00 1488 0.55 0.79 0.44 200 RCVD_IN_SORBS_DUL 1389 0.30 0.07 0.41 ----------------------------------------------------------------------