Email: 555244 Autolearn: 0 AvgScore: 4.39 AvgScanTime: 1.33 sec Spam: 177595 Autolearn: 0 AvgScore: 13.36 AvgScanTime: 1.45 sec Ham: 377649 Autolearn: 0 AvgScore: 0.17 AvgScanTime: 1.28 sec Time Spent Running SA: 205.88 hours Time Spent Processing Spam: 71.56 hours Time Spent Processing Ham: 134.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 177210 99.58 99.78 99.49 2 HTML_MESSAGE 172224 90.40 96.98 87.30 3 DKIM_SIGNED 163817 78.92 92.24 72.66 4 XM_DK_Pass 155667 76.52 87.65 71.29 5 DKIM_VALID 152998 75.41 86.15 70.36 6 XM_B_Unicode 151480 75.14 85.30 70.36 7 RELAYCOUNTRY_US 142545 79.92 80.26 79.76 8 XM_B_SpammyWords 130701 54.72 73.59 45.84 9 XMListUnsubscribeExists 130300 56.75 73.37 48.93 10 DCC_CHECK 130270 46.45 73.35 33.79 11 DKIM_VALID_AU 115455 58.98 65.01 56.14 12 XM_DK_Undo_02 79437 17.72 44.73 5.02 13 XM_B_Unicode3 79104 40.97 44.54 39.28 14 XM_B_SpammyWords2 78305 28.42 44.09 21.05 15 LOC_TINY_FONT_1 75052 30.10 42.26 24.39 16 BAYES_50 69838 53.10 39.32 59.57 17 HTML_FONT_LOW_CONTRAST 63894 29.86 35.98 26.98 18 BAYES_99 61139 13.65 34.43 3.88 19 TR_XM_DKIM_Undo 60596 12.33 34.12 2.09 20 FVGT_m_MULTI_ODD 60317 27.31 33.96 24.18 21 RCVD_IN_MSPIKE_H2 57034 29.16 32.11 27.76 22 DKIM_VALID_EF 54248 28.03 30.55 26.85 23 MIME_HTML_ONLY 51575 22.69 29.04 19.70 24 T_KAM_HTML_FONT_INVALID 51449 22.84 28.97 19.96 25 BAYES_999 47757 10.60 26.89 2.94 26 DCC_CHECK_NEGATIVE 47303 53.52 26.64 66.16 27 TR_DCC_Bayes_99 43490 8.76 24.49 1.37 28 T_TM2_M_HEADER_IN_MSG 40253 28.07 22.67 30.61 29 TR_XM_DK_Unsub 39616 15.53 22.31 12.34 30 XMSubLong 39033 21.99 21.98 22.00 31 RELAYCOUNTRY_META 36254 9.36 20.41 4.17 32 XM_Multi_Part_URI 32117 14.09 18.08 12.20 33 TR_XM_SpammyRelay 29173 6.83 16.43 2.32 34 XM_B_Unsub 29030 10.34 16.35 7.52 35 LOTS_OF_MONEY 28528 10.97 16.06 8.57 36 XM_B_SpammyWords3 28296 8.59 15.93 5.14 37 TR_XM_BayesUnsub 28097 9.11 15.82 5.95 38 TR_MAX_INTL_RELAY 27036 9.34 15.22 6.57 39 TR_XM_SpammyWords2 25210 4.85 14.20 0.46 40 TR_XM_SpammyWords4 25114 8.89 14.14 6.41 41 BOTNET_IPINHOSTNAME 24614 7.08 13.86 3.89 42 UNPARSEABLE_RELAY 24503 11.24 13.80 10.03 43 RCVD_IN_BL_SPAMCOP_NET 23456 4.72 13.21 0.73 44 TR_XM_SPAMCOP 19775 3.91 11.13 0.51 45 RELAYCOUNTRY_CA 18540 4.18 10.44 1.24 46 BAYES_80 16295 5.68 9.18 4.04 47 BOTNET 15848 3.69 8.92 1.22 48 RCVD_IN_MSPIKE_H3 14575 6.75 8.21 6.06 49 RCVD_IN_MSPIKE_WL 14575 6.75 8.21 6.06 50 FSL_BULK_SIG 14359 5.08 8.09 3.66 51 BAYES_60 14219 8.79 8.01 9.16 52 XM_Evil_Numbers_Gen 14019 7.57 7.89 7.42 53 TR_XM_UnparsRelay 12640 3.37 7.12 1.61 54 LotsOfNums_01 12359 7.75 6.96 8.13 55 XM_Body_Dirty_Words 12269 4.05 6.91 2.71 56 XMBody_17 11467 2.58 6.46 0.75 57 UNTRUSTED_Relay 10829 2.93 6.10 1.45 58 DKIM_INVALID 10819 3.51 6.09 2.29 59 MPART_ALT_DIFF 10630 4.32 5.99 3.54 60 HTML_IMAGE_RATIO_02 10616 4.69 5.98 4.09 61 XM_UncommonTLD01 10528 4.32 5.93 3.57 62 XMSubMetaSx_00 10370 4.33 5.84 3.62 63 BAYES_95 9844 3.49 5.54 2.53 64 XM_B_SEO 9124 2.55 5.14 1.33 65 TooManyTo_001 8948 7.25 5.04 8.30 66 XM_SPF_SoftFail 8817 4.21 4.96 3.86 67 XM_B_Phish_Phrases 8766 3.73 4.94 3.16 68 HTML_IMAGE_RATIO_06 8761 3.50 4.93 2.82 69 XM_B_Investor 8477 2.75 4.77 1.80 70 XM_H_GMP 8472 5.70 4.77 6.14 71 XM_H_Long_From01 8393 5.10 4.73 5.28 72 TR_XM_SEO4 8059 1.89 4.54 0.65 73 HTML_IMAGE_RATIO_04 8050 4.11 4.53 3.91 74 TR_LOTS_OF_MONEY3 7665 1.84 4.32 0.68 75 XM_OfRef6 7465 2.21 4.20 1.27 76 XMSexyCombo_05 7293 2.48 4.11 1.71 77 TR_XM_SpammyWords5 7087 2.15 3.99 1.29 78 T_XMDrugObfuBody_14 6875 2.60 3.87 2.01 79 TR_XM_PhishingBody 6852 2.36 3.86 1.65 80 XMStrtUSub 6739 4.09 3.79 4.23 81 T_XMDrugObfuBody_08 6676 2.21 3.76 1.48 82 MIME_QP_LONG_LINE 6634 5.22 3.74 5.92 83 HTML_IMAGE_RATIO_08 6394 2.58 3.60 2.10 84 TM2_M_URI_OPT_OUT 6265 2.56 3.53 2.10 85 MIME_HTML_MOSTLY 6064 2.56 3.41 2.16 86 XM_B_SpammyTLD 5949 2.51 3.35 2.11 87 XMNumbers 5904 2.77 3.32 2.50 88 T_FILL_THIS_FORM_SHORT 5899 1.75 3.32 1.01 89 XM_UB50 5770 1.62 3.25 0.86 90 RCVD_IN_VALIDITY_RPBL 5769 1.12 3.25 0.11 91 TM2_M_VERY_LONG_WORD 5578 1.88 3.14 1.29 92 MIME_HTML_ONLY_MULTI 5418 2.32 3.05 1.98 93 TR_XM_NoHeaderRelay 5317 1.06 2.99 0.15 94 XMDiploma_00 5141 2.09 2.89 1.72 95 USER_IN_DEF_DKIM_WL 4982 9.75 2.81 13.02 96 XM_CamelCaseFrm001 4695 2.28 2.64 2.11 97 FONT_INVIS_LONG_LINE 4528 0.85 2.55 0.06 98 T_TooManySym_01 4486 4.23 2.53 5.04 99 RCVD_IN_VALIDITY_SAFE 4363 3.93 2.46 4.63 100 SUBJ_ALL_CAPS 4335 1.83 2.44 1.54 101 XM_URI_RBL 4196 0.86 2.36 0.15 102 TR_XM_BayesRelay 4152 0.75 2.34 0.00 103 XM_B_Unsub2 4050 1.65 2.28 1.35 104 XM_B_SpammyWords4 4043 1.38 2.28 0.96 105 RELAYCOUNTRY_AU 4028 1.23 2.27 0.74 106 SpammyFromTLD_01 3929 1.20 2.21 0.72 107 MAILING_LIST_MULTI 3600 2.46 2.03 2.67 108 TR_XM_INV_DKIM 3534 0.68 1.99 0.06 109 TR_XM_FormFill 3527 0.65 1.99 0.02 110 T_XMHurry_00 3490 0.98 1.97 0.51 111 ANY_BOUNCE_MESSAGE 3481 3.02 1.96 3.52 112 BOUNCE_MESSAGE 3481 3.02 1.96 3.52 113 T_REMOTE_IMAGE 3480 2.94 1.96 3.40 114 RCVD_IN_VALIDITY_CERTIFIED 3437 3.25 1.94 3.87 115 SpammyFromTLD_02 3397 0.86 1.91 0.36 116 HTML_MIME_NO_HTML_TAG 3382 3.07 1.90 3.63 117 FROM_EXCESS_BASE64 3114 1.82 1.75 1.85 118 XMStockSpam_06 3084 1.15 1.74 0.87 119 XMBrknScrpt_02 3021 0.97 1.70 0.63 120 XM_DK_Undo_01 3000 1.76 1.69 1.79 121 HOSTED_IMG_MULTI_PUB_01 2917 0.54 1.64 0.02 122 URI_TRY_3LD 2879 1.05 1.62 0.78 123 XM_H_Long_From02 2790 1.20 1.57 1.02 124 XMGenDplmaNmb 2748 1.12 1.55 0.92 125 ALL_TRUSTED 2691 12.06 1.52 17.01 126 TR_Symld_Words 2647 1.40 1.49 1.36 127 DKIM_ADSP_NXDOMAIN 2638 0.66 1.49 0.27 128 BAYES_40 2630 3.83 1.48 4.93 129 HTTPS_HTTP_MISMATCH 2563 1.01 1.44 0.80 130 HK_RANDOM_REPLYTO 2517 0.51 1.42 0.08 131 URI_HEX 2367 1.25 1.33 1.21 132 TM2_M_A_HREF_HREF 2312 0.63 1.30 0.31 133 RCVD_IN_IADB_LISTED 2298 3.14 1.29 4.01 134 XM_SendGrid 2295 1.41 1.29 1.46 135 XMHTML_After_End 2288 0.71 1.29 0.43 136 XMSexyCombo_01 2286 0.53 1.29 0.18 137 T_XMDrugObfuBody_00 2272 0.86 1.28 0.66 138 PLING_QUERY 2269 0.73 1.28 0.47 139 XM_H_Undi_Recip 2257 0.52 1.27 0.17 140 XM_DIRTYINTL 2246 0.51 1.26 0.15 141 TR_Mismatch_TLD_02 2193 0.46 1.23 0.09 142 TR_XM_PHPForged 2171 0.64 1.22 0.37 143 XM_HighProb1 2162 0.39 1.22 0.00 144 URI_NOVOWEL 2160 1.24 1.22 1.26 145 TR_XM_PHPDW 2149 0.64 1.21 0.37 146 AC_BR_BONANZA 2141 0.43 1.21 0.06 147 KHOP_HELO_FCRDNS 2105 2.39 1.19 2.95 148 TR_XM_FormFill2 2085 0.63 1.17 0.38 149 RELAYCOUNTRY_RU 2079 0.40 1.17 0.04 150 XM_H_PHPOS 2058 0.61 1.16 0.36 151 XMPhish30 2039 0.84 1.15 0.70 152 HTML_TAG_BALANCE_BODY 2021 0.76 1.14 0.58 153 XM_B_Phish66 2012 0.57 1.13 0.31 154 RCVD_IN_IADB_SPF 2010 2.74 1.13 3.50 155 TR_XM_Undi_Recip19 1910 0.39 1.08 0.07 156 RCVD_IN_IADB_DK 1898 2.40 1.07 3.03 157 RCVD_IN_IADB_SENDERID 1892 2.47 1.07 3.13 158 TR_XM_InvalidRelay 1880 0.36 1.06 0.03 159 XMBdyGiftCard01 1872 0.94 1.05 0.89 160 XM_ProductURIs 1872 0.74 1.05 0.59 161 TR_Caps_n_Bayes_99 1858 0.35 1.05 0.02 162 BAYES_20 1839 2.57 1.04 3.30 163 TR_XM_Base64_M1 1816 0.80 1.02 0.70 164 DKIM_ADSP_CUSTOM_MED 1758 0.99 0.99 0.99 165 T_STY_INVIS_DIRECT 1700 0.50 0.96 0.28 166 THIS_AD 1686 0.46 0.95 0.23 167 XM_B_COVIDMETA 1652 0.44 0.93 0.20 168 XM_UB99 1649 0.30 0.93 0.00 169 LongTLD 1645 0.54 0.93 0.35 170 TR_XM_Undi_RecipCombo2 1638 0.30 0.92 0.01 171 XMSlimDrugH 1624 0.52 0.91 0.34 172 XMReplyNow 1584 0.44 0.89 0.23 173 RELAYCOUNTRY_FR 1575 0.42 0.89 0.20 174 T_Symld_Words_02 1569 0.80 0.88 0.76 175 MPART_ALT_DIFF_COUNT 1558 0.66 0.88 0.55 176 XM_BadFromFormat 1551 0.36 0.87 0.12 177 T_MONEY_PERCENT 1534 0.62 0.86 0.50 178 TR_LOTS_OF_MONEY2 1534 0.62 0.86 0.50 179 XM_B_COPY_HTML 1526 0.59 0.86 0.47 180 NML_ADSP_CUSTOM_MED 1509 0.77 0.85 0.73 181 TR_MetaPhish_Combo_01 1502 0.82 0.85 0.81 182 XMSubMetaI_00 1495 0.57 0.84 0.44 183 XM_B_DNDMA 1485 0.74 0.84 0.70 184 TR_XM_DK_SendGrid 1475 0.89 0.83 0.92 185 RELAYCOUNTRY_CN 1465 0.33 0.82 0.10 186 XMNoVowels 1448 0.67 0.82 0.60 187 XM_S_SpammyWords 1443 0.66 0.81 0.59 188 TR_XM_Spammywords 1443 0.66 0.81 0.59 189 TM2_M_OBFU_COMMENT 1441 0.46 0.81 0.29 190 XMLngstWrd_00 1433 0.60 0.81 0.50 191 PDS_OTHER_BAD_TLD 1431 0.33 0.81 0.11 192 XMPhish14 1424 0.51 0.80 0.37 193 TooManyTo_002 1414 2.08 0.80 2.69 194 XM_UB60 1411 0.30 0.79 0.07 195 RELAYCOUNTRY_IN 1392 0.29 0.78 0.06 196 URIBL_DBL_SPAM 1387 0.25 0.78 0.01 197 SCC_BODY_URI_ONLY 1379 1.97 0.78 2.54 198 RDNS_DYNAMIC 1373 0.49 0.77 0.36 199 TR_XM_COVIDMETA4 1373 0.32 0.77 0.10 200 UNDISC_MONEY 1342 0.25 0.76 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 375706 99.58 99.78 99.49 2 HTML_MESSAGE 329700 90.40 96.98 87.30 3 RELAYCOUNTRY_US 301216 79.92 80.26 79.76 4 DKIM_SIGNED 274391 78.92 92.24 72.66 5 XM_DK_Pass 269212 76.52 87.65 71.29 6 DKIM_VALID 265727 75.41 86.15 70.36 7 XM_B_Unicode 265721 75.14 85.30 70.36 8 DCC_CHECK_NEGATIVE 249842 53.52 26.64 66.16 9 BAYES_50 224977 53.10 39.32 59.57 10 DKIM_VALID_AU 212015 58.98 65.01 56.14 11 XMListUnsubscribeExists 184789 56.75 73.37 48.93 12 XM_B_SpammyWords 173103 54.72 73.59 45.84 13 XM_B_Unicode3 148359 40.97 44.54 39.28 14 DCC_CHECK 127615 46.45 73.35 33.79 15 T_TM2_M_HEADER_IN_MSG 115593 28.07 22.67 30.61 16 RCVD_IN_MSPIKE_H2 104852 29.16 32.11 27.76 17 HTML_FONT_LOW_CONTRAST 101902 29.86 35.98 26.98 18 DKIM_VALID_EF 101380 28.03 30.55 26.85 19 LOC_TINY_FONT_1 92098 30.10 42.26 24.39 20 FVGT_m_MULTI_ODD 91301 27.31 33.96 24.18 21 XMSubLong 83073 21.99 21.98 22.00 22 XM_B_SpammyWords2 79504 28.42 44.09 21.05 23 T_KAM_HTML_FONT_INVALID 75372 22.84 28.97 19.96 24 MIME_HTML_ONLY 74404 22.69 29.04 19.70 25 ALL_TRUSTED 64248 12.06 1.52 17.01 26 USER_IN_DEF_DKIM_WL 49177 9.75 2.81 13.02 27 TR_XM_DK_Unsub 46592 15.53 22.31 12.34 28 XM_Multi_Part_URI 46090 14.09 18.08 12.20 29 BAYES_00 39303 7.25 0.54 10.41 30 UNPARSEABLE_RELAY 37889 11.24 13.80 10.03 31 BAYES_60 34584 8.79 8.01 9.16 32 LOTS_OF_MONEY 32367 10.97 16.06 8.57 33 TooManyTo_001 31328 7.25 5.04 8.30 34 LotsOfNums_01 30691 7.75 6.96 8.13 35 XM_B_Unsub 28384 10.34 16.35 7.52 36 XM_Evil_Numbers_Gen 28030 7.57 7.89 7.42 37 XM_DKIMWhitelistDomains 26297 4.74 0.02 6.96 38 IN_ZIMBRA_NJ_WHITELIST 25727 4.66 0.09 6.81 39 TR_MAX_INTL_RELAY 24813 9.34 15.22 6.57 40 TR_XM_SpammyWords4 24224 8.89 14.14 6.41 41 TR_XM_DK_Bayes 23221 4.31 0.40 6.15 42 XM_H_GMP 23197 5.70 4.77 6.14 43 TR_XM_DK_Bayes1 22989 4.27 0.39 6.09 44 RCVD_IN_MSPIKE_H3 22888 6.75 8.21 6.06 45 RCVD_IN_MSPIKE_WL 22888 6.75 8.21 6.06 46 TR_XM_BayesUnsub 22475 9.11 15.82 5.95 47 MIME_QP_LONG_LINE 22354 5.22 3.74 5.92 48 TR_XM_DK_Bayes2 20128 3.73 0.33 5.33 49 XM_H_Long_From01 19932 5.10 4.73 5.28 50 XM_B_SpammyWords3 19398 8.59 15.93 5.14 51 T_TooManySym_01 19015 4.23 2.53 5.04 52 XM_DK_Undo_02 18947 17.72 44.73 5.02 53 BAYES_40 18630 3.83 1.48 4.93 54 RCVD_IN_VALIDITY_SAFE 17474 3.93 2.46 4.63 55 XM_PDF 16995 3.27 0.65 4.50 56 XMStrtUSub 15978 4.09 3.79 4.23 57 RELAYCOUNTRY_META 15734 9.36 20.41 4.17 58 HTML_IMAGE_RATIO_02 15449 4.69 5.98 4.09 59 BAYES_80 15253 5.68 9.18 4.04 60 RCVD_IN_IADB_LISTED 15130 3.14 1.29 4.01 61 HTML_IMAGE_RATIO_04 14766 4.11 4.53 3.91 62 BOTNET_IPINHOSTNAME 14696 7.08 13.86 3.89 63 BAYES_99 14659 13.65 34.43 3.88 64 RCVD_IN_VALIDITY_CERTIFIED 14614 3.25 1.94 3.87 65 XM_SPF_SoftFail 14563 4.21 4.96 3.86 66 FSL_BULK_SIG 13836 5.08 8.09 3.66 67 HTML_MIME_NO_HTML_TAG 13690 3.07 1.90 3.63 68 XMSubMetaSx_00 13684 4.33 5.84 3.62 69 XM_UncommonTLD01 13473 4.32 5.93 3.57 70 MPART_ALT_DIFF 13374 4.32 5.99 3.54 71 ANY_BOUNCE_MESSAGE 13304 3.02 1.96 3.52 72 BOUNCE_MESSAGE 13303 3.02 1.96 3.52 73 RCVD_IN_IADB_SPF 13199 2.74 1.13 3.50 74 T_REMOTE_IMAGE 12822 2.94 1.96 3.40 75 BAYES_20 12453 2.57 1.04 3.30 76 XM_B_Phish_Phrases 11919 3.73 4.94 3.16 77 RCVD_IN_IADB_SENDERID 11817 2.47 1.07 3.13 78 RCVD_IN_IADB_DK 11429 2.40 1.07 3.03 79 KHOP_HELO_FCRDNS 11150 2.39 1.19 2.95 80 BAYES_999 11087 10.60 26.89 2.94 81 HTML_IMAGE_RATIO_06 10647 3.50 4.93 2.82 82 RCVD_IN_IADB_VOUCHED 10421 2.09 0.66 2.76 83 XM_Body_Dirty_Words 10230 4.05 6.91 2.71 84 TooManyTo_002 10162 2.08 0.80 2.69 85 MAILING_LIST_MULTI 10074 2.46 2.03 2.67 86 SCC_BODY_URI_ONLY 9585 1.97 0.78 2.54 87 BAYES_95 9547 3.49 5.54 2.53 88 XMNumbers 9458 2.77 3.32 2.50 89 T_TooManySym_02 9127 1.88 0.74 2.42 90 TR_XM_SpammyRelay 8756 6.83 16.43 2.32 91 DKIM_INVALID 8664 3.51 6.09 2.29 92 BAYES_05 8239 1.63 0.47 2.18 93 MIME_HTML_MOSTLY 8155 2.56 3.41 2.16 94 XM_B_SpammyTLD 7970 2.51 3.35 2.11 95 XM_CamelCaseFrm001 7961 2.28 2.64 2.11 96 TM2_M_URI_OPT_OUT 7947 2.56 3.53 2.10 97 HTML_IMAGE_RATIO_08 7925 2.58 3.60 2.10 98 TR_XM_DKIM_Undo 7891 12.33 34.12 2.09 99 T_XMDrugObfuBody_14 7585 2.60 3.87 2.01 100 MIME_HTML_ONLY_MULTI 7463 2.32 3.05 1.98 101 INVALID_MSGID 7433 1.39 0.16 1.97 102 TO_MALFORMED 7001 1.27 0.04 1.85 103 FROM_EXCESS_BASE64 6980 1.82 1.75 1.85 104 RCVD_IN_IADB_OPTIN 6847 1.36 0.40 1.81 105 XM_B_Investor 6790 2.75 4.77 1.80 106 XM_DK_Undo_01 6766 1.76 1.69 1.79 107 HELO_NODOT 6766 1.31 0.29 1.79 108 HELO_NO_DOMAIN 6761 1.31 0.29 1.79 109 XMDiploma_00 6482 2.09 2.89 1.72 110 XMSexyCombo_05 6461 2.48 4.11 1.71 111 TR_XM_PhishingBody 6228 2.36 3.86 1.65 112 TR_XM_UnparsRelay 6083 3.37 7.12 1.61 113 SUBJ_ALL_CAPS 5825 1.83 2.44 1.54 114 IN_HORDE_ADDRESS_BOOK 5749 1.06 0.06 1.52 115 T_XMDrugObfuBody_08 5604 2.21 3.76 1.48 116 XM_SendGrid 5507 1.41 1.29 1.46 117 UNTRUSTED_Relay 5466 2.93 6.10 1.45 118 TooManyTo_003 5362 1.19 0.69 1.42 119 TR_DCC_Bayes_99 5167 8.76 24.49 1.37 120 TR_Symld_Words 5127 1.40 1.49 1.36 121 XM_B_Unsub2 5088 1.65 2.28 1.35 122 XM_B_SEO 5031 2.55 5.14 1.33 123 TVD_RCVD_IP 4883 1.10 0.70 1.29 124 TR_XM_SpammyWords5 4866 2.15 3.99 1.29 125 TM2_M_VERY_LONG_WORD 4862 1.88 3.14 1.29 126 XM_OfRef6 4791 2.21 4.20 1.27 127 URI_NOVOWEL 4746 1.24 1.22 1.26 128 RELAYCOUNTRY_CA 4684 4.18 10.44 1.24 129 BOTNET 4617 3.69 8.92 1.22 130 URI_HEX 4562 1.25 1.33 1.21 131 XMGappySubj_01 4338 0.86 0.24 1.15 132 XM_GoogleGroups 4301 0.99 0.67 1.14 133 XMCapTrack 3953 0.84 0.41 1.05 134 XMBSHREFv2 3913 0.81 0.33 1.04 135 TVD_SPACE_RATIO 3883 0.74 0.12 1.03 136 TooManyTo_004 3879 0.90 0.64 1.03 137 XM_H_Long_From02 3855 1.20 1.57 1.02 138 T_FILL_THIS_FORM_SHORT 3806 1.75 3.32 1.01 139 DKIM_ADSP_CUSTOM_MED 3730 0.99 0.99 0.99 140 XM_B_SpammyWords4 3614 1.38 2.28 0.96 141 TR_XM_DK_SendGrid 3465 0.89 0.83 0.92 142 XMGenDplmaNmb 3460 1.12 1.55 0.92 143 XMBdyGiftCard01 3357 0.94 1.05 0.89 144 T_TooManySym_03 3306 0.70 0.32 0.88 145 XMStockSpam_06 3275 1.15 1.74 0.87 146 TooManyTo_005 3242 0.77 0.60 0.86 147 XM_UB50 3231 1.62 3.25 0.86 148 T_OBFU_PDF_ATTACH 3050 0.57 0.08 0.81 149 TR_MetaPhish_Combo_01 3046 0.82 0.85 0.81 150 HTTPS_HTTP_MISMATCH 3020 1.01 1.44 0.80 151 XM_B_FormFill 2988 0.56 0.07 0.79 152 URI_TRY_3LD 2939 1.05 1.62 0.78 153 T_Symld_Words_02 2874 0.80 0.88 0.76 154 XMBody_17 2831 2.58 6.46 0.75 155 RELAYCOUNTRY_AU 2784 1.23 2.27 0.74 156 RCVD_IN_BL_SPAMCOP_NET 2773 4.72 13.21 0.73 157 NML_ADSP_CUSTOM_MED 2745 0.77 0.85 0.73 158 SpammyFromTLD_01 2719 1.20 2.21 0.72 159 XMBody_95 2709 0.53 0.14 0.72 160 TR_XM_Base64_M1 2653 0.80 1.02 0.70 161 XMPhish30 2637 0.84 1.15 0.70 162 XM_B_DNDMA 2633 0.74 0.84 0.70 163 TR_LOTS_OF_MONEY3 2578 1.84 4.32 0.68 164 T_XMDrugObfuBody_00 2486 0.86 1.28 0.66 165 TR_XM_SEO4 2452 1.89 4.54 0.65 166 FROM_GOV_DKIM_AU 2400 0.50 0.20 0.64 167 XMBrknScrpt_02 2384 0.97 1.70 0.63 168 XM_H_PHPMailer 2340 0.62 0.62 0.62 169 XM_ShortIntro_01 2309 0.61 0.61 0.61 170 XMMoneyMeta_00 2285 0.61 0.63 0.61 171 XMNoVowels 2266 0.67 0.82 0.60 172 TR_XM_Spammywords 2239 0.66 0.81 0.59 173 XM_S_SpammyWords 2239 0.66 0.81 0.59 174 XM_ProductURIs 2225 0.74 1.05 0.59 175 SHORT_HELO_AND_INLINE_IMAGE 2197 0.41 0.05 0.58 176 FORGED_GMAIL_RCVD 2189 0.61 0.68 0.58 177 HTML_TAG_BALANCE_BODY 2183 0.76 1.14 0.58 178 FILL_THIS_FORM 2146 0.45 0.21 0.57 179 XMGappySubj_02 2138 0.42 0.10 0.57 180 MPART_ALT_DIFF_COUNT 2083 0.66 0.88 0.55 181 T_XMHurry_00 1937 0.98 1.97 0.51 182 TR_XM_SPAMCOP 1926 3.91 11.13 0.51 183 T_MONEY_PERCENT 1887 0.62 0.86 0.50 184 TR_LOTS_OF_MONEY2 1887 0.62 0.86 0.50 185 XMLngstWrd_00 1885 0.60 0.81 0.50 186 XMDateMe_00 1860 0.52 0.56 0.49 187 RELAYCOUNTRY_GB 1800 0.56 0.72 0.48 188 PLING_QUERY 1787 0.73 1.28 0.47 189 XM_UCStrings02 1782 0.35 0.09 0.47 190 XM_B_COPY_HTML 1774 0.59 0.86 0.47 191 TR_XM_SpammyWords2 1730 4.85 14.20 0.46 192 XMSubMetaSxObfu_02 1700 0.41 0.34 0.45 193 XMSubMetaI_00 1675 0.57 0.84 0.44 194 XMHTML_After_End 1635 0.71 1.29 0.43 195 XMClaimOffer 1634 0.48 0.57 0.43 196 HTML_IMAGE_ONLY_28 1565 0.37 0.29 0.41 197 HTML_IMAGE_ONLY_32 1559 0.34 0.19 0.41 198 XMSubMetaSxObfu_03 1479 0.51 0.75 0.39 199 HTML_FONT_FACE_BAD 1436 0.47 0.65 0.38 200 TR_XM_FormFill2 1422 0.63 1.17 0.38 ----------------------------------------------------------------------