Email: 494535 Autolearn: 0 AvgScore: 4.04 AvgScanTime: 1.37 sec Spam: 147036 Autolearn: 0 AvgScore: 13.30 AvgScanTime: 1.45 sec Ham: 347499 Autolearn: 0 AvgScore: 0.13 AvgScanTime: 1.34 sec Time Spent Running SA: 188.28 hours Time Spent Processing Spam: 59.11 hours Time Spent Processing Ham: 129.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 146329 99.48 99.52 99.47 2 HTML_MESSAGE 142533 90.13 96.94 87.25 3 DKIM_SIGNED 135540 80.21 92.18 75.14 4 XM_DK_Pass 129888 78.15 88.34 73.83 5 DKIM_VALID 128095 77.14 87.12 72.92 6 XM_B_Unicode 126907 74.91 86.31 70.08 7 RELAYCOUNTRY_US 118469 81.65 80.57 82.10 8 XM_B_SpammyWords 109094 54.26 74.20 45.83 9 XMListUnsubscribeExists 107371 57.94 73.02 51.56 10 DKIM_VALID_AU 95460 60.61 64.92 58.78 11 DCC_CHECK 94141 39.05 64.03 28.49 12 XM_DK_Undo_02 72035 19.07 48.99 6.41 13 XM_B_Unicode3 66629 42.30 45.31 41.02 14 XM_B_SpammyWords2 65333 27.72 44.43 20.65 15 LOC_TINY_FONT_1 59856 30.71 40.71 26.47 16 TR_XM_DKIM_Undo 55614 13.24 37.82 2.84 17 BAYES_50 55232 52.08 37.56 58.22 18 BAYES_99 54123 14.61 36.81 5.22 19 DCC_CHECK_NEGATIVE 52877 60.91 35.96 71.47 20 HTML_FONT_LOW_CONTRAST 51686 30.27 35.15 28.20 21 FVGT_m_MULTI_ODD 48097 27.58 32.71 25.41 22 RCVD_IN_MSPIKE_H2 47341 29.85 32.20 28.85 23 DKIM_VALID_EF 46477 28.65 31.61 27.40 24 T_KAM_HTML_FONT_INVALID 46261 23.55 31.46 20.20 25 MIME_HTML_ONLY 43795 23.51 29.79 20.86 26 BAYES_999 42710 11.49 29.05 4.06 27 TR_DCC_Bayes_99 33929 8.00 23.08 1.62 28 T_TM2_M_HEADER_IN_MSG 33583 26.58 22.84 28.16 29 TR_XM_DK_Unsub 33543 16.11 22.81 13.27 30 XMSubLong 32999 22.09 22.44 21.95 31 XM_Multi_Part_URI 29915 15.49 20.35 13.44 32 RELAYCOUNTRY_META 28624 8.92 19.47 4.46 33 LOTS_OF_MONEY 24127 9.59 16.41 6.70 34 TR_XM_SpammyWords2 23775 5.37 16.17 0.81 35 XM_B_Unsub 23552 10.03 16.02 7.50 36 TR_XM_SpammyRelay 22594 6.35 15.37 2.53 37 TR_XM_BayesUnsub 22184 8.62 15.09 5.89 38 TR_XM_SpammyWords4 22122 7.87 15.05 4.83 39 RCVD_IN_BL_SPAMCOP_NET 21787 4.91 14.82 0.72 40 XM_B_SpammyWords3 21492 8.00 14.62 5.19 41 TR_MAX_INTL_RELAY 21479 9.67 14.61 7.58 42 UNPARSEABLE_RELAY 20883 11.23 14.20 9.97 43 BOTNET_IPINHOSTNAME 19823 7.22 13.48 4.57 44 TR_XM_SPAMCOP 19016 4.19 12.93 0.49 45 RELAYCOUNTRY_CA 16533 4.31 11.24 1.37 46 RCVD_IN_MSPIKE_H3 13623 7.00 9.27 6.04 47 RCVD_IN_MSPIKE_WL 13623 7.00 9.27 6.04 48 BOTNET 13390 3.75 9.11 1.49 49 BAYES_80 13118 5.74 8.92 4.40 50 XMBody_17 11645 2.85 7.92 0.71 51 XM_Evil_Numbers_Gen 11550 8.20 7.86 8.34 52 BAYES_60 11339 8.87 7.71 9.37 53 TR_XM_UnparsRelay 10966 3.29 7.46 1.53 54 FSL_BULK_SIG 10671 4.89 7.26 3.88 55 XM_Body_Dirty_Words 10079 4.42 6.85 3.39 56 LotsOfNums_01 9375 8.04 6.38 8.75 57 MPART_ALT_DIFF 9087 4.48 6.18 3.76 58 HTML_IMAGE_RATIO_02 8422 4.92 5.73 4.58 59 TooManyTo_001 7971 7.21 5.42 7.96 60 BAYES_95 7792 3.81 5.30 3.17 61 UNTRUSTED_Relay 7774 2.75 5.29 1.68 62 XM_B_Investor 7665 2.85 5.21 1.84 63 XM_UncommonTLD01 7576 4.10 5.15 3.65 64 XMSubMetaSx_00 7514 4.36 5.11 4.04 65 DKIM_INVALID 7445 3.06 5.06 2.22 66 XM_H_GMP 7377 5.77 5.02 6.08 67 XM_B_SEO 7303 2.31 4.97 1.19 68 XM_H_Long_From01 7276 5.24 4.95 5.36 69 HTML_IMAGE_RATIO_04 7000 5.10 4.76 5.24 70 XM_SPF_SoftFail 6938 4.37 4.72 4.23 71 XM_B_Phish_Phrases 6669 3.71 4.54 3.36 72 TR_XM_SpammyWords5 6606 2.25 4.49 1.31 73 TR_XM_SEO4 6460 1.80 4.39 0.70 74 T_XMDrugObfuBody_14 6328 2.95 4.30 2.37 75 HTML_IMAGE_RATIO_06 6283 3.02 4.27 2.49 76 XM_OfRef6 6045 2.46 4.11 1.77 77 MIME_HTML_MOSTLY 5884 2.86 4.00 2.38 78 XMSexyCombo_05 5737 2.27 3.90 1.58 79 T_FILL_THIS_FORM_SHORT 5632 1.93 3.83 1.13 80 XMNumbers 5540 3.11 3.77 2.83 81 TR_LOTS_OF_MONEY3 5487 1.55 3.73 0.63 82 TR_XM_PhishingBody 5486 2.13 3.73 1.45 83 XMStrtUSub 5306 4.10 3.61 4.31 84 TM2_M_URI_OPT_OUT 5146 2.33 3.50 1.84 85 MIME_QP_LONG_LINE 4972 4.64 3.38 5.17 86 FONT_INVIS_LONG_LINE 4779 1.00 3.25 0.05 87 MIME_HTML_ONLY_MULTI 4761 2.30 3.24 1.90 88 TM2_M_VERY_LONG_WORD 4692 2.06 3.19 1.58 89 RCVD_IN_VALIDITY_RPBL 4686 1.01 3.19 0.10 90 XM_B_SpammyTLD 4681 2.53 3.18 2.25 91 T_XMDrugObfuBody_08 4580 2.07 3.11 1.63 92 XM_CamelCaseFrm001 4377 3.01 2.98 3.03 93 T_TooManySym_01 4339 4.55 2.95 5.23 94 HTML_IMAGE_RATIO_08 4317 2.23 2.94 1.93 95 XMDiploma_00 4112 2.25 2.80 2.02 96 XM_UB50 4111 1.55 2.80 1.02 97 TR_XM_BayesRelay 4072 0.82 2.77 0.00 98 XM_URI_RBL 4029 0.94 2.74 0.18 99 RCVD_IN_VALIDITY_SAFE 3940 4.23 2.68 4.88 100 XM_B_SpammyWords4 3619 1.18 2.46 0.64 101 TR_XM_FormFill 3552 0.75 2.42 0.04 102 ANY_BOUNCE_MESSAGE 3525 3.23 2.40 3.59 103 BOUNCE_MESSAGE 3525 3.23 2.40 3.59 104 RELAYCOUNTRY_AU 3337 1.36 2.27 0.97 105 XM_B_Unsub2 3326 1.56 2.26 1.26 106 SUBJ_ALL_CAPS 3312 1.66 2.25 1.41 107 TR_XM_INV_DKIM 3272 0.72 2.23 0.08 108 SpammyFromTLD_01 3236 1.10 2.20 0.63 109 TR_XM_NoHeaderRelay 3191 0.72 2.17 0.10 110 RCVD_IN_VALIDITY_CERTIFIED 3173 3.43 2.16 3.97 111 USER_IN_DEF_DKIM_WL 3173 10.54 2.16 14.09 112 FROM_EXCESS_BASE64 2960 1.86 2.01 1.80 113 T_REMOTE_IMAGE 2771 2.99 1.88 3.46 114 HOSTED_IMG_MULTI_PUB_01 2710 0.57 1.84 0.03 115 MAILING_LIST_MULTI 2684 2.26 1.83 2.44 116 URI_TRY_3LD 2680 1.10 1.82 0.80 117 HTML_MIME_NO_HTML_TAG 2628 3.65 1.79 4.44 118 DKIM_ADSP_NXDOMAIN 2450 0.70 1.67 0.29 119 XM_SendGrid 2296 1.49 1.56 1.46 120 SpammyFromTLD_02 2263 0.74 1.54 0.41 121 TR_XM_PHPForged 2263 0.72 1.54 0.38 122 TR_XM_PHPDW 2247 0.72 1.53 0.38 123 BAYES_40 2195 3.30 1.49 4.06 124 HK_RANDOM_REPLYTO 2190 0.51 1.49 0.09 125 XMStockSpam_06 2167 1.23 1.47 1.13 126 TR_XM_FormFill2 2157 0.71 1.47 0.39 127 XM_H_PHPOS 2150 0.69 1.46 0.36 128 ALL_TRUSTED 2119 10.47 1.44 14.29 129 XM_DK_Undo_01 2119 1.66 1.44 1.75 130 XMBrknScrpt_02 2048 0.96 1.39 0.77 131 T_XMHurry_00 1992 0.79 1.35 0.55 132 TR_Mismatch_TLD_02 1982 0.47 1.35 0.10 133 XM_HighProb1 1922 0.39 1.31 0.00 134 URI_HEX 1921 1.02 1.31 0.89 135 HTTPS_HTTP_MISMATCH 1892 0.93 1.29 0.78 136 DKIM_ADSP_CUSTOM_MED 1892 1.05 1.29 0.94 137 T_XMDrugObfuBody_00 1859 1.24 1.26 1.22 138 KHOP_HELO_FCRDNS 1826 3.09 1.24 3.87 139 XMReplyNow 1802 0.61 1.23 0.35 140 RCVD_IN_IADB_LISTED 1800 3.21 1.22 4.06 141 XMGenDplmaNmb 1776 1.02 1.21 0.94 142 AC_BR_BONANZA 1729 0.42 1.18 0.10 143 HTML_TAG_BALANCE_BODY 1702 0.78 1.16 0.62 144 XMPhish30 1676 0.73 1.14 0.55 145 NML_ADSP_CUSTOM_MED 1674 0.80 1.14 0.66 146 XM_DIRTYINTL 1658 0.55 1.13 0.31 147 TR_XM_Base64_M1 1648 0.80 1.12 0.66 148 SCC_BODY_URI_ONLY 1635 1.93 1.11 2.28 149 XM_ProductURIs 1624 1.19 1.10 1.23 150 RCVD_IN_IADB_SPF 1598 2.80 1.09 3.52 151 XM_B_COPY_HTML 1559 0.80 1.06 0.70 152 XMHTML_After_End 1532 0.59 1.04 0.39 153 T_STY_INVIS_DIRECT 1530 0.53 1.04 0.32 154 RCVD_IN_IADB_DK 1516 2.43 1.03 3.02 155 XM_B_DNDMA 1509 0.62 1.03 0.45 156 TR_Caps_n_Bayes_99 1500 0.32 1.02 0.02 157 RCVD_IN_IADB_SENDERID 1493 2.49 1.02 3.12 158 XM_B_Phish66 1484 0.50 1.01 0.28 159 BAYES_20 1475 2.42 1.00 3.03 160 XM_PDF 1474 3.29 1.00 4.26 161 TooManyTo_002 1424 2.05 0.97 2.51 162 FORGED_GMAIL_RCVD 1424 0.68 0.97 0.55 163 RDNS_DYNAMIC 1406 0.55 0.96 0.37 164 XMNoVowels 1396 0.67 0.95 0.55 165 XM_H_Undi_Recip 1374 0.39 0.93 0.16 166 RELAYCOUNTRY_CN 1371 0.34 0.93 0.09 167 T_TooManySym_02 1344 2.20 0.91 2.75 168 TR_Symld_Words 1339 1.26 0.91 1.41 169 TR_XM_InvalidRelay 1334 0.29 0.91 0.03 170 XMSexyCombo_01 1317 0.36 0.90 0.13 171 XMBdyGiftCard01 1315 0.82 0.89 0.79 172 T_Symld_Words_02 1252 0.72 0.85 0.66 173 TooManyTo_003 1251 1.25 0.85 1.42 174 TM2_M_OBFU_COMMENT 1241 0.49 0.84 0.34 175 MPART_ALT_DIFF_COUNT 1239 0.67 0.84 0.60 176 URIBL_DBL_SPAM 1237 0.26 0.84 0.01 177 TR_XM_DK_SendGrid 1233 0.87 0.84 0.88 178 THIS_AD 1226 0.41 0.83 0.23 179 XM_UB99 1211 0.25 0.82 0.00 180 XMPhish14 1193 0.51 0.81 0.38 181 TooManyTo_004 1169 0.94 0.80 1.00 182 MIME_CHARSET_FARAWAY 1166 0.44 0.79 0.29 183 TR_MetaPhish_Combo_01 1151 0.70 0.78 0.67 184 TVD_RCVD_IP 1150 1.20 0.78 1.37 185 XM_H_Long_From02 1134 0.99 0.77 1.09 186 XMPhish08 1132 0.34 0.77 0.16 187 URI_NOVOWEL 1119 1.07 0.76 1.19 188 TooManyTo_005 1117 0.80 0.76 0.81 189 BOTNET_NORDNS 1116 0.23 0.76 0.01 190 XMSubMetaI_00 1104 0.73 0.75 0.72 191 TR_XM_Undi_Recip19 1088 0.27 0.74 0.07 192 XMHTMLBadTable_001 1082 0.41 0.74 0.27 193 XMBounce_01 1074 0.23 0.73 0.02 194 TM2_M_A_HREF_HREF 1043 0.35 0.71 0.20 195 DIET_1 1042 0.34 0.71 0.18 196 BAYES_00 1041 7.80 0.71 10.80 197 TR_XM_Base64_L1 1008 0.36 0.69 0.22 198 PDS_OTHER_BAD_TLD 1001 0.29 0.68 0.12 199 XM_H_PHPMailer 997 0.73 0.68 0.75 200 HELO_DYNAMIC_SPLIT_IP 993 0.21 0.68 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 345659 99.48 99.52 99.47 2 HTML_MESSAGE 303185 90.13 96.94 87.25 3 RELAYCOUNTRY_US 285295 81.65 80.57 82.10 4 DKIM_SIGNED 261124 80.21 92.18 75.14 5 XM_DK_Pass 256574 78.15 88.34 73.83 6 DKIM_VALID 253413 77.14 87.12 72.92 7 DCC_CHECK_NEGATIVE 248366 60.91 35.96 71.47 8 XM_B_Unicode 243544 74.91 86.31 70.08 9 DKIM_VALID_AU 204275 60.61 64.92 58.78 10 BAYES_50 202306 52.08 37.56 58.22 11 XMListUnsubscribeExists 179174 57.94 73.02 51.56 12 XM_B_SpammyWords 159252 54.26 74.20 45.83 13 XM_B_Unicode3 142545 42.30 45.31 41.02 14 RCVD_IN_MSPIKE_H2 100270 29.85 32.20 28.85 15 DCC_CHECK 98995 39.05 64.03 28.49 16 HTML_FONT_LOW_CONTRAST 98007 30.27 35.15 28.20 17 T_TM2_M_HEADER_IN_MSG 97860 26.58 22.84 28.16 18 DKIM_VALID_EF 95229 28.65 31.61 27.40 19 LOC_TINY_FONT_1 91993 30.71 40.71 26.47 20 FVGT_m_MULTI_ODD 88286 27.58 32.71 25.41 21 XMSubLong 76267 22.09 22.44 21.95 22 MIME_HTML_ONLY 72494 23.51 29.79 20.86 23 XM_B_SpammyWords2 71746 27.72 44.43 20.65 24 T_KAM_HTML_FONT_INVALID 70199 23.55 31.46 20.20 25 ALL_TRUSTED 49666 10.47 1.44 14.29 26 USER_IN_DEF_DKIM_WL 48962 10.54 2.16 14.09 27 XM_Multi_Part_URI 46693 15.49 20.35 13.44 28 TR_XM_DK_Unsub 46122 16.11 22.81 13.27 29 BAYES_00 37538 7.80 0.71 10.80 30 UNPARSEABLE_RELAY 34638 11.23 14.20 9.97 31 BAYES_60 32547 8.87 7.71 9.37 32 LotsOfNums_01 30409 8.04 6.38 8.75 33 XM_Evil_Numbers_Gen 28982 8.20 7.86 8.34 34 TooManyTo_001 27678 7.21 5.42 7.96 35 TR_MAX_INTL_RELAY 26324 9.67 14.61 7.58 36 XM_B_Unsub 26048 10.03 16.02 7.50 37 XM_DKIMWhitelistDomains 25799 5.22 0.02 7.42 38 LOTS_OF_MONEY 23285 9.59 16.41 6.70 39 IN_ZIMBRA_NJ_WHITELIST 23192 4.71 0.07 6.67 40 XM_DK_Undo_02 22263 19.07 48.99 6.41 41 TR_XM_DK_Bayes 21301 4.46 0.52 6.13 42 XM_H_GMP 21142 5.77 5.02 6.08 43 TR_XM_DK_Bayes1 21090 4.42 0.52 6.07 44 RCVD_IN_MSPIKE_WL 20975 7.00 9.27 6.04 45 RCVD_IN_MSPIKE_H3 20975 7.00 9.27 6.04 46 TR_XM_BayesUnsub 20464 8.62 15.09 5.89 47 XM_H_Long_From01 18621 5.24 4.95 5.36 48 HTML_IMAGE_RATIO_04 18210 5.10 4.76 5.24 49 T_TooManySym_01 18182 4.55 2.95 5.23 50 TR_XM_DK_Bayes2 18151 3.76 0.30 5.22 51 BAYES_99 18131 14.61 36.81 5.22 52 XM_B_SpammyWords3 18050 8.00 14.62 5.19 53 MIME_QP_LONG_LINE 17962 4.64 3.38 5.17 54 RCVD_IN_VALIDITY_SAFE 16973 4.23 2.68 4.88 55 TR_XM_SpammyWords4 16791 7.87 15.05 4.83 56 HTML_IMAGE_RATIO_02 15902 4.92 5.73 4.58 57 BOTNET_IPINHOSTNAME 15868 7.22 13.48 4.57 58 RELAYCOUNTRY_META 15512 8.92 19.47 4.46 59 HTML_MIME_NO_HTML_TAG 15433 3.65 1.79 4.44 60 BAYES_80 15288 5.74 8.92 4.40 61 XMStrtUSub 14980 4.10 3.61 4.31 62 XM_PDF 14811 3.29 1.00 4.26 63 XM_SPF_SoftFail 14683 4.37 4.72 4.23 64 BAYES_40 14124 3.30 1.49 4.06 65 BAYES_999 14115 11.49 29.05 4.06 66 RCVD_IN_IADB_LISTED 14099 3.21 1.22 4.06 67 XMSubMetaSx_00 14051 4.36 5.11 4.04 68 RCVD_IN_VALIDITY_CERTIFIED 13811 3.43 2.16 3.97 69 FSL_BULK_SIG 13498 4.89 7.26 3.88 70 KHOP_HELO_FCRDNS 13461 3.09 1.24 3.87 71 MPART_ALT_DIFF 13076 4.48 6.18 3.76 72 XM_UncommonTLD01 12694 4.10 5.15 3.65 73 ANY_BOUNCE_MESSAGE 12473 3.23 2.40 3.59 74 BOUNCE_MESSAGE 12473 3.23 2.40 3.59 75 RCVD_IN_IADB_SPF 12249 2.80 1.09 3.52 76 T_REMOTE_IMAGE 12009 2.99 1.88 3.46 77 XM_Body_Dirty_Words 11767 4.42 6.85 3.39 78 XM_B_Phish_Phrases 11665 3.71 4.54 3.36 79 BAYES_95 11032 3.81 5.30 3.17 80 RCVD_IN_IADB_SENDERID 10836 2.49 1.02 3.12 81 XM_CamelCaseFrm001 10533 3.01 2.98 3.03 82 BAYES_20 10516 2.42 1.00 3.03 83 RCVD_IN_IADB_DK 10485 2.43 1.03 3.02 84 TR_XM_DKIM_Undo 9861 13.24 37.82 2.84 85 XMNumbers 9837 3.11 3.77 2.83 86 RCVD_IN_IADB_VOUCHED 9662 2.15 0.66 2.78 87 T_TooManySym_02 9550 2.20 0.91 2.75 88 TR_XM_SpammyRelay 8801 6.35 15.37 2.53 89 TooManyTo_002 8720 2.05 0.97 2.51 90 HTML_IMAGE_RATIO_06 8637 3.02 4.27 2.49 91 MAILING_LIST_MULTI 8481 2.26 1.83 2.44 92 MIME_HTML_MOSTLY 8264 2.86 4.00 2.38 93 T_XMDrugObfuBody_14 8237 2.95 4.30 2.37 94 SCC_BODY_URI_ONLY 7917 1.93 1.11 2.28 95 XM_B_SpammyTLD 7807 2.53 3.18 2.25 96 DKIM_INVALID 7711 3.06 5.06 2.22 97 INVALID_MSGID 7328 1.56 0.26 2.11 98 XMDiploma_00 7032 2.25 2.80 2.02 99 TO_MALFORMED 6984 1.41 0.01 2.01 100 HTML_IMAGE_RATIO_08 6693 2.23 2.94 1.93 101 MIME_HTML_ONLY_MULTI 6601 2.30 3.24 1.90 102 XM_B_Investor 6405 2.85 5.21 1.84 103 TM2_M_URI_OPT_OUT 6392 2.33 3.50 1.84 104 RCVD_IN_IADB_OPTIN 6292 1.40 0.44 1.81 105 FROM_EXCESS_BASE64 6252 1.86 2.01 1.80 106 XM_OfRef6 6136 2.46 4.11 1.77 107 XM_DK_Undo_01 6074 1.66 1.44 1.75 108 BAYES_05 6015 1.36 0.49 1.73 109 UNTRUSTED_Relay 5838 2.75 5.29 1.68 110 HELO_NODOT 5694 1.25 0.33 1.64 111 HELO_NO_DOMAIN 5688 1.25 0.33 1.64 112 T_XMDrugObfuBody_08 5650 2.07 3.11 1.63 113 TR_DCC_Bayes_99 5630 8.00 23.08 1.62 114 TM2_M_VERY_LONG_WORD 5505 2.06 3.19 1.58 115 XMSexyCombo_05 5477 2.27 3.90 1.58 116 TR_XM_UnparsRelay 5313 3.29 7.46 1.53 117 BOTNET 5170 3.75 9.11 1.49 118 XM_SendGrid 5081 1.49 1.56 1.46 119 TR_XM_PhishingBody 5025 2.13 3.73 1.45 120 TooManyTo_003 4937 1.25 0.85 1.42 121 TR_Symld_Words 4895 1.26 0.91 1.41 122 SUBJ_ALL_CAPS 4888 1.66 2.25 1.41 123 IN_HORDE_ADDRESS_BOOK 4872 1.00 0.06 1.40 124 RELAYCOUNTRY_CA 4767 4.31 11.24 1.37 125 TVD_RCVD_IP 4761 1.20 0.78 1.37 126 TR_XM_SpammyWords5 4541 2.25 4.49 1.31 127 XM_B_Unsub2 4379 1.56 2.26 1.26 128 XM_ProductURIs 4263 1.19 1.10 1.23 129 XMGappySubj_01 4258 0.94 0.26 1.23 130 T_XMDrugObfuBody_00 4255 1.24 1.26 1.22 131 URI_NOVOWEL 4150 1.07 0.76 1.19 132 XM_B_SEO 4124 2.31 4.97 1.19 133 XMStockSpam_06 3930 1.23 1.47 1.13 134 T_FILL_THIS_FORM_SHORT 3917 1.93 3.83 1.13 135 XMBSHREFv2 3880 0.88 0.33 1.12 136 TVD_SPACE_RATIO 3843 0.82 0.15 1.11 137 XM_H_Long_From02 3784 0.99 0.77 1.09 138 XM_GoogleGroups 3746 0.94 0.61 1.08 139 XM_UB50 3534 1.55 2.80 1.02 140 TooManyTo_004 3486 0.94 0.80 1.00 141 RELAYCOUNTRY_AU 3364 1.36 2.27 0.97 142 DKIM_ADSP_CUSTOM_MED 3276 1.05 1.29 0.94 143 XMGenDplmaNmb 3268 1.02 1.21 0.94 144 XMCapTrack 3233 0.79 0.47 0.93 145 T_TooManySym_03 3210 0.74 0.29 0.92 146 URI_HEX 3102 1.02 1.31 0.89 147 TR_XM_DK_SendGrid 3067 0.87 0.84 0.88 148 TooManyTo_005 2820 0.80 0.76 0.81 149 TR_XM_SpammyWords2 2801 5.37 16.17 0.81 150 URI_TRY_3LD 2778 1.10 1.82 0.80 151 XMBdyGiftCard01 2750 0.82 0.89 0.79 152 HTTPS_HTTP_MISMATCH 2721 0.93 1.29 0.78 153 XMBrknScrpt_02 2678 0.96 1.39 0.77 154 FROM_GOV_DKIM_AU 2662 0.59 0.18 0.77 155 XM_H_PHPMailer 2598 0.73 0.68 0.75 156 XMSubMetaI_00 2502 0.73 0.75 0.72 157 RCVD_IN_BL_SPAMCOP_NET 2486 4.91 14.82 0.72 158 XMBody_17 2462 2.85 7.92 0.71 159 TR_XM_SEO4 2429 1.80 4.39 0.70 160 XM_B_COPY_HTML 2421 0.80 1.06 0.70 161 TR_MetaPhish_Combo_01 2315 0.70 0.78 0.67 162 NML_ADSP_CUSTOM_MED 2302 0.80 1.14 0.66 163 T_Symld_Words_02 2291 0.72 0.85 0.66 164 TR_XM_Base64_M1 2287 0.80 1.12 0.66 165 T_OBFU_PDF_ATTACH 2257 0.49 0.12 0.65 166 XM_ShortIntro_01 2255 0.61 0.50 0.65 167 XM_B_SpammyWords4 2221 1.18 2.46 0.64 168 SpammyFromTLD_01 2188 1.10 2.20 0.63 169 TR_LOTS_OF_MONEY3 2187 1.55 3.73 0.63 170 HTML_TAG_BALANCE_BODY 2154 0.78 1.16 0.62 171 XM_B_FormFill 2119 0.45 0.06 0.61 172 MPART_ALT_DIFF_COUNT 2085 0.67 0.84 0.60 173 FILL_THIS_FORM 2069 0.49 0.24 0.60 174 XMGappySubj_02 1946 0.41 0.06 0.56 175 FORGED_GMAIL_RCVD 1923 0.68 0.97 0.55 176 XMPhish30 1915 0.73 1.14 0.55 177 T_XMHurry_00 1913 0.79 1.35 0.55 178 XMNoVowels 1894 0.67 0.95 0.55 179 XMBody_95 1853 0.42 0.14 0.53 180 TR_XM_SPAMCOP 1710 4.19 12.93 0.49 181 T_TVD_MIME_NO_HEADERS 1637 0.36 0.10 0.47 182 SHORT_HELO_AND_INLINE_IMAGE 1611 0.34 0.05 0.46 183 RELAYCOUNTRY_GB 1580 0.48 0.53 0.45 184 XM_B_DNDMA 1567 0.62 1.03 0.45 185 XMMoneyMeta_00 1512 0.49 0.62 0.44 186 SpammyFromTLD_02 1417 0.74 1.54 0.41 187 HTML_IMAGE_ONLY_28 1395 0.36 0.25 0.40 188 PLING_QUERY 1387 0.47 0.62 0.40 189 HTML_FONT_FACE_BAD 1380 0.45 0.58 0.40 190 MISSING_HEADERS 1371 0.41 0.44 0.39 191 XMHTML_After_End 1370 0.59 1.04 0.39 192 TR_XM_FormFill2 1366 0.71 1.47 0.39 193 XMDateMe_00 1350 0.39 0.41 0.39 194 TM2_M_BODY_EMPTY 1341 0.31 0.13 0.39 195 XMLngstWrd_00 1341 0.41 0.47 0.39 196 SHOPIFY_IMG_NOT_RCVD_SFY 1331 0.44 0.57 0.38 197 TR_XM_PHPDW 1329 0.72 1.53 0.38 198 RELAYCOUNTRY_DE 1317 0.38 0.38 0.38 199 TR_XM_PHPForged 1313 0.72 1.54 0.38 200 XMPhish14 1311 0.51 0.81 0.38 ----------------------------------------------------------------------