Email: 551490 Autolearn: 0 AvgScore: 4.25 AvgScanTime: 1.48 sec Spam: 184383 Autolearn: 0 AvgScore: 13.50 AvgScanTime: 1.58 sec Ham: 367107 Autolearn: 0 AvgScore: -0.39 AvgScanTime: 1.44 sec Time Spent Running SA: 227.33 hours Time Spent Processing Spam: 80.80 hours Time Spent Processing Ham: 146.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 183984 99.57 99.78 99.46 2 HTML_MESSAGE 178594 90.74 96.86 87.67 3 DKIM_SIGNED 168057 80.73 91.15 75.50 4 XM_DK_Pass 160734 78.48 87.17 74.11 5 DKIM_VALID 157670 77.24 85.51 73.09 6 XM_B_Unicode 156822 76.62 85.05 72.38 7 RELAYCOUNTRY_US 145855 81.38 79.10 82.53 8 XMListUnsubscribeExists 138164 59.41 74.93 51.61 9 XM_B_SpammyWords 134656 55.16 73.03 46.19 10 DCC_CHECK 132492 47.12 71.86 34.69 11 DKIM_VALID_AU 118050 60.56 64.02 58.82 12 XM_B_Unicode3 84631 42.72 45.90 41.12 13 XM_DK_Undo_02 83389 18.92 45.23 5.71 14 XM_B_SpammyWords2 81963 28.44 44.45 20.39 15 LOC_TINY_FONT_1 74192 30.75 40.24 25.99 16 BAYES_50 71029 53.03 38.52 60.32 17 HTML_FONT_LOW_CONTRAST 66742 31.09 36.20 28.52 18 BAYES_99 65013 14.41 35.26 3.94 19 TR_XM_DKIM_Undo 63934 13.14 34.67 2.33 20 FVGT_m_MULTI_ODD 60439 28.16 32.78 25.84 21 DKIM_VALID_EF 56314 28.83 30.54 27.96 22 RCVD_IN_MSPIKE_H2 56051 29.83 30.40 29.54 23 MIME_HTML_ONLY 54619 22.98 29.62 19.65 24 T_KAM_HTML_FONT_INVALID 53891 24.46 29.23 22.07 25 DCC_CHECK_NEGATIVE 51869 52.85 28.13 65.26 26 BAYES_999 51011 11.22 27.67 2.96 27 TR_DCC_Bayes_99 46098 9.42 25.00 1.60 28 T_TM2_M_HEADER_IN_MSG 42518 26.61 23.06 28.39 29 TR_XM_DK_Unsub 42254 16.53 22.92 13.32 30 RELAYCOUNTRY_META 38066 9.81 20.65 4.37 31 XMSubLong 37919 22.31 20.57 23.18 32 XM_Multi_Part_URI 34120 15.00 18.50 13.24 33 TR_XM_SpammyRelay 28970 6.84 15.71 2.38 34 TR_XM_SpammyWords2 28891 5.60 15.67 0.54 35 LOTS_OF_MONEY 28558 9.39 15.49 6.33 36 TR_MAX_INTL_RELAY 26744 9.30 14.50 6.69 37 XM_B_Unsub 26469 11.08 14.36 9.43 38 XM_B_SpammyWords3 26266 8.55 14.25 5.69 39 TR_XM_SpammyWords4 26122 7.60 14.17 4.30 40 TR_XM_BayesUnsub 25530 8.96 13.85 6.50 41 UNPARSEABLE_RELAY 24681 11.62 13.39 10.73 42 RCVD_IN_BL_SPAMCOP_NET 24371 4.87 13.22 0.68 43 BOTNET_IPINHOSTNAME 24184 7.25 13.12 4.31 44 TR_XM_SPAMCOP 20338 4.02 11.03 0.50 45 RELAYCOUNTRY_CA 20172 4.60 10.94 1.41 46 BOTNET 18135 4.33 9.84 1.57 47 BAYES_80 16436 5.71 8.91 4.10 48 RCVD_IN_MSPIKE_H3 16332 7.05 8.86 6.13 49 RCVD_IN_MSPIKE_WL 16332 7.05 8.86 6.13 50 XM_Evil_Numbers_Gen 15115 7.48 8.20 7.12 51 BAYES_60 14669 8.72 7.96 9.11 52 XMBody_17 14063 3.05 7.63 0.76 53 LotsOfNums_01 13283 8.22 7.20 8.74 54 TR_XM_UnparsRelay 13159 3.61 7.14 1.83 55 FSL_BULK_SIG 12378 4.77 6.71 3.79 56 XM_Body_Dirty_Words 12284 4.25 6.66 3.04 57 UNTRUSTED_Relay 12168 3.33 6.60 1.69 58 HTML_IMAGE_RATIO_02 11712 5.39 6.35 4.90 59 XM_UncommonTLD01 11014 4.59 5.97 3.89 60 XMSubMetaSx_00 10932 4.95 5.93 4.45 61 DKIM_INVALID 10387 3.49 5.63 2.41 62 MPART_ALT_DIFF 9905 5.70 5.37 5.86 63 XM_H_Long_From01 9762 5.47 5.29 5.56 64 BAYES_95 9658 3.47 5.24 2.58 65 XM_B_SEO 9650 2.50 5.23 1.13 66 XM_SPF_SoftFail 8810 3.74 4.78 3.22 67 TR_LOTS_OF_MONEY3 8791 2.17 4.77 0.86 68 TooManyTo_001 8626 7.15 4.68 8.40 69 XM_B_Phish_Phrases 8422 3.61 4.57 3.13 70 XMSexyCombo_05 8416 2.65 4.56 1.68 71 XM_H_GMP 8407 5.42 4.56 5.85 72 TR_XM_SEO4 8310 1.97 4.51 0.70 73 TR_XM_SpammyWords5 7945 2.29 4.31 1.28 74 HTML_IMAGE_RATIO_04 7898 4.07 4.28 3.96 75 HTML_IMAGE_RATIO_06 7791 3.53 4.23 3.18 76 T_FILL_THIS_FORM_SHORT 7480 2.02 4.06 0.99 77 XM_OfRef6 7374 2.17 4.00 1.26 78 TR_XM_PhishingBody 7282 2.30 3.95 1.47 79 T_XMDrugObfuBody_14 7268 2.57 3.94 1.88 80 XM_B_Investor 7178 2.35 3.89 1.58 81 XM_B_SpammyTLD 6893 2.81 3.74 2.34 82 XM_UB50 6706 1.91 3.64 1.04 83 TM2_M_URI_OPT_OUT 6465 3.85 3.51 4.03 84 MIME_QP_LONG_LINE 6414 4.81 3.48 5.47 85 XMNumbers 6158 3.10 3.34 2.98 86 FONT_INVIS_LONG_LINE 6156 1.19 3.34 0.11 87 TM2_M_VERY_LONG_WORD 5959 2.06 3.23 1.47 88 MIME_HTML_ONLY_MULTI 5916 3.77 3.21 4.06 89 MIME_HTML_MOSTLY 5870 2.83 3.18 2.65 90 XM_CamelCaseFrm001 5869 2.51 3.18 2.17 91 TR_XM_BayesRelay 5659 1.03 3.07 0.00 92 HTML_IMAGE_RATIO_08 5563 2.40 3.02 2.09 93 HTML_MIME_NO_HTML_TAG 5331 2.24 2.89 1.91 94 HK_RANDOM_REPLYTO 5265 1.05 2.86 0.14 95 XMStrtUSub 5260 3.99 2.85 4.56 96 XMDiploma_00 5189 2.11 2.81 1.76 97 T_XMDrugObfuBody_08 5095 1.99 2.76 1.61 98 TR_XM_FormFill 5091 0.93 2.76 0.01 99 T_TooManySym_01 4890 4.25 2.65 5.05 100 URIBL_DBL_SPAM 4776 0.87 2.59 0.01 101 RCVD_IN_VALIDITY_RPBL 4774 0.97 2.59 0.15 102 SUBJ_ALL_CAPS 4729 1.92 2.56 1.59 103 SpammyFromTLD_01 4364 1.47 2.37 1.02 104 XM_B_Unsub2 4275 1.83 2.32 1.58 105 XM_URI_RBL 4239 0.87 2.30 0.15 106 SCC_BODY_URI_ONLY 4159 2.24 2.26 2.23 107 RCVD_IN_VALIDITY_SAFE 4140 4.08 2.25 5.00 108 T_XMHurry_00 4102 1.17 2.22 0.64 109 RELAYCOUNTRY_AU 3982 1.25 2.16 0.80 110 XM_B_SpammyWords4 3969 1.14 2.15 0.64 111 TR_XM_INV_DKIM 3952 0.76 2.14 0.06 112 USER_IN_DEF_DKIM_WL 3903 9.85 2.12 13.74 113 URI_TRY_3LD 3821 1.24 2.07 0.82 114 T_REMOTE_IMAGE 3637 2.86 1.97 3.31 115 TR_XM_NoHeaderRelay 3330 0.70 1.81 0.14 116 RCVD_IN_VALIDITY_CERTIFIED 3315 3.49 1.80 4.34 117 ALL_TRUSTED 3301 9.79 1.79 13.80 118 XMStockSpam_06 3177 1.07 1.72 0.74 119 XMBrknScrpt_02 3168 1.21 1.72 0.95 120 HOSTED_IMG_MULTI_PUB_01 3163 0.59 1.72 0.02 121 MAILING_LIST_MULTI 3138 2.35 1.70 2.68 122 HTTPS_HTTP_MISMATCH 3093 1.12 1.68 0.84 123 XMGenDplmaNmb 3070 1.20 1.67 0.96 124 BAYES_40 3040 3.62 1.65 4.61 125 XM_H_Long_From02 3035 1.25 1.65 1.05 126 SpammyFromTLD_02 2988 0.78 1.62 0.35 127 URI_NOVOWEL 2949 1.48 1.60 1.42 128 TR_XM_PHPForged 2934 0.77 1.59 0.35 129 FROM_EXCESS_BASE64 2922 1.71 1.58 1.77 130 HTML_IMAGE_ONLY_08 2916 0.61 1.58 0.12 131 XM_DK_Undo_01 2848 1.78 1.54 1.90 132 URI_HEX 2828 1.28 1.53 1.15 133 TR_XM_PHPDW 2818 0.74 1.53 0.34 134 TR_XM_FormFill2 2808 0.75 1.52 0.35 135 HTML_SHORT_LINK_IMG_1 2803 0.52 1.52 0.01 136 XM_H_PHPOS 2775 0.73 1.51 0.34 137 ANY_BOUNCE_MESSAGE 2735 2.70 1.48 3.31 138 BOUNCE_MESSAGE 2735 2.70 1.48 3.31 139 TR_Mismatch_TLD_02 2730 0.56 1.48 0.10 140 HTML_FONT_SIZE_LARGE 2699 0.55 1.46 0.09 141 T_XMDrugObfuBody_00 2556 0.85 1.39 0.58 142 MIME_HEADER_CTYPE_ONLY 2402 0.53 1.30 0.15 143 RCVD_IN_IADB_LISTED 2401 3.02 1.30 3.89 144 XM_SendGrid 2358 1.48 1.28 1.58 145 DKIM_ADSP_NXDOMAIN 2350 0.60 1.27 0.26 146 RELAYCOUNTRY_HU 2349 0.43 1.27 0.00 147 HTML_TAG_BALANCE_BODY 2269 0.81 1.23 0.60 148 XM_DIRTYINTL 2255 0.48 1.22 0.11 149 URIBL_CSS 2249 0.45 1.22 0.06 150 URIBL_CSS_A 2249 0.45 1.22 0.06 151 SHORTENER_SHORT_IMG 2237 0.41 1.21 0.00 152 XMPhish30 2225 0.72 1.21 0.47 153 TM2_M_A_HREF_HREF 2201 0.55 1.19 0.22 154 BOTNET_NORDNS 2163 0.40 1.17 0.01 155 DKIM_ADSP_CUSTOM_MED 2130 0.93 1.16 0.82 156 RCVD_IN_IADB_SPF 2096 2.64 1.14 3.40 157 XM_HighProb1 2073 0.38 1.12 0.00 158 TR_Symld_Words 2069 1.29 1.12 1.38 159 XMHTML_After_End 2049 0.65 1.11 0.42 160 BAYES_20 2033 2.55 1.10 3.28 161 RCVD_IN_IADB_DK 2005 2.31 1.09 2.93 162 XMPhish14 2002 0.63 1.09 0.40 163 RCVD_IN_IADB_SENDERID 1983 2.38 1.08 3.03 164 KHOP_HELO_FCRDNS 1979 1.14 1.07 1.17 165 TooManyTo_002 1952 2.01 1.06 2.49 166 XM_H_Undi_Recip 1930 0.50 1.05 0.22 167 XM_B_DNDMA 1921 0.66 1.04 0.48 168 NML_ADSP_CUSTOM_MED 1916 0.71 1.04 0.54 169 XMReplyNow 1903 0.48 1.03 0.21 170 XM_B_Phish66 1851 0.52 1.00 0.28 171 TR_XM_InvalidRelay 1832 0.35 0.99 0.03 172 AC_BR_BONANZA 1830 0.39 0.99 0.09 173 TooManyTo_003 1824 1.26 0.99 1.39 174 MPART_ALT_DIFF_COUNT 1791 0.81 0.97 0.73 175 XMBdyGiftCard01 1759 0.78 0.95 0.69 176 LongTLD 1749 0.55 0.95 0.35 177 TooManyTo_004 1734 0.97 0.94 0.99 178 XMBody_78 1680 0.49 0.91 0.28 179 XM_UB60 1664 0.34 0.90 0.06 180 TooManyTo_005 1663 0.84 0.90 0.81 181 TR_XM_Base64_M1 1604 0.68 0.87 0.58 182 XM_UB99 1575 0.29 0.85 0.01 183 HTML_FONT_FACE_BAD 1560 0.57 0.85 0.43 184 XMLngstWrd_00 1556 0.71 0.84 0.65 185 XM_Combo_Sbj 1548 0.47 0.84 0.29 186 THIS_AD 1521 0.56 0.82 0.43 187 TR_MetaPhish_Combo_01 1515 0.82 0.82 0.82 188 T_MONEY_PERCENT 1513 0.46 0.82 0.27 189 TR_LOTS_OF_MONEY2 1513 0.46 0.82 0.27 190 TR_XM_Undi_Recip19 1507 0.32 0.82 0.08 191 XMSexyCombo_01 1497 0.36 0.81 0.14 192 BAYES_00 1495 7.00 0.81 10.11 193 DIET_1 1494 0.40 0.81 0.20 194 RDNS_DYNAMIC 1477 0.50 0.80 0.35 195 TR_XM_DK_SendGrid 1433 0.93 0.78 1.01 196 RELAYCOUNTRY_GB 1405 0.57 0.76 0.47 197 T_STY_INVIS_DIRECT 1393 0.43 0.76 0.26 198 PLING_QUERY 1390 0.55 0.75 0.45 199 MIME_CHARSET_FARAWAY 1386 0.41 0.75 0.24 200 FORGED_GMAIL_RCVD 1372 0.58 0.74 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 365115 99.57 99.78 99.46 2 HTML_MESSAGE 321837 90.74 96.86 87.67 3 RELAYCOUNTRY_US 302968 81.38 79.10 82.53 4 DKIM_SIGNED 277166 80.73 91.15 75.50 5 XM_DK_Pass 272061 78.48 87.17 74.11 6 DKIM_VALID 268311 77.24 85.51 73.09 7 XM_B_Unicode 265724 76.62 85.05 72.38 8 DCC_CHECK_NEGATIVE 239567 52.85 28.13 65.26 9 BAYES_50 221421 53.03 38.52 60.32 10 DKIM_VALID_AU 215920 60.56 64.02 58.82 11 XMListUnsubscribeExists 189456 59.41 74.93 51.61 12 XM_B_SpammyWords 169549 55.16 73.03 46.19 13 XM_B_Unicode3 150962 42.72 45.90 41.12 14 DCC_CHECK 127360 47.12 71.86 34.69 15 RCVD_IN_MSPIKE_H2 108455 29.83 30.40 29.54 16 HTML_FONT_LOW_CONTRAST 104707 31.09 36.20 28.52 17 T_TM2_M_HEADER_IN_MSG 104229 26.61 23.06 28.39 18 DKIM_VALID_EF 102655 28.83 30.54 27.96 19 LOC_TINY_FONT_1 95410 30.75 40.24 25.99 20 FVGT_m_MULTI_ODD 94843 28.16 32.78 25.84 21 XMSubLong 85106 22.31 20.57 23.18 22 T_KAM_HTML_FONT_INVALID 81017 24.46 29.23 22.07 23 XM_B_SpammyWords2 74869 28.44 44.45 20.39 24 MIME_HTML_ONLY 72139 22.98 29.62 19.65 25 ALL_TRUSTED 50666 9.79 1.79 13.80 26 USER_IN_DEF_DKIM_WL 50442 9.85 2.12 13.74 27 TR_XM_DK_Unsub 48894 16.53 22.92 13.32 28 XM_Multi_Part_URI 48602 15.00 18.50 13.24 29 UNPARSEABLE_RELAY 39378 11.62 13.39 10.73 30 BAYES_00 37121 7.00 0.81 10.11 31 XM_B_Unsub 34621 11.08 14.36 9.43 32 BAYES_60 33434 8.72 7.96 9.11 33 LotsOfNums_01 32074 8.22 7.20 8.74 34 TooManyTo_001 30820 7.15 4.68 8.40 35 XM_Evil_Numbers_Gen 26145 7.48 8.20 7.12 36 IN_ZIMBRA_NJ_WHITELIST 25846 4.72 0.10 7.04 37 TR_MAX_INTL_RELAY 24560 9.30 14.50 6.69 38 XM_DKIMWhitelistDomains 24374 4.42 0.01 6.64 39 TR_XM_BayesUnsub 23857 8.96 13.85 6.50 40 LOTS_OF_MONEY 23254 9.39 15.49 6.33 41 TR_XM_DK_Bayes 22794 4.35 0.66 6.21 42 RCVD_IN_MSPIKE_H3 22522 7.05 8.86 6.13 43 RCVD_IN_MSPIKE_WL 22522 7.05 8.86 6.13 44 TR_XM_DK_Bayes1 22499 4.29 0.64 6.13 45 MPART_ALT_DIFF 21517 5.70 5.37 5.86 46 XM_H_GMP 21460 5.42 4.56 5.85 47 XM_DK_Undo_02 20970 18.92 45.23 5.71 48 XM_B_SpammyWords3 20871 8.55 14.25 5.69 49 XM_H_Long_From01 20417 5.47 5.29 5.56 50 MIME_QP_LONG_LINE 20095 4.81 3.48 5.47 51 TR_XM_DK_Bayes2 19584 3.74 0.57 5.33 52 T_TooManySym_01 18535 4.25 2.65 5.05 53 RCVD_IN_VALIDITY_SAFE 18362 4.08 2.25 5.00 54 HTML_IMAGE_RATIO_02 17996 5.39 6.35 4.90 55 BAYES_40 16919 3.62 1.65 4.61 56 XMStrtUSub 16730 3.99 2.85 4.56 57 XM_PDF 16682 3.27 0.72 4.54 58 XMSubMetaSx_00 16342 4.95 5.93 4.45 59 RELAYCOUNTRY_META 16051 9.81 20.65 4.37 60 RCVD_IN_VALIDITY_CERTIFIED 15919 3.49 1.80 4.34 61 BOTNET_IPINHOSTNAME 15815 7.25 13.12 4.31 62 TR_XM_SpammyWords4 15775 7.60 14.17 4.30 63 BAYES_80 15055 5.71 8.91 4.10 64 MIME_HTML_ONLY_MULTI 14898 3.77 3.21 4.06 65 TM2_M_URI_OPT_OUT 14792 3.85 3.51 4.03 66 HTML_IMAGE_RATIO_04 14524 4.07 4.28 3.96 67 BAYES_99 14457 14.41 35.26 3.94 68 XM_UncommonTLD01 14276 4.59 5.97 3.89 69 RCVD_IN_IADB_LISTED 14264 3.02 1.30 3.89 70 FSL_BULK_SIG 13910 4.77 6.71 3.79 71 RCVD_IN_IADB_SPF 12488 2.64 1.14 3.40 72 ANY_BOUNCE_MESSAGE 12142 2.70 1.48 3.31 73 BOUNCE_MESSAGE 12141 2.70 1.48 3.31 74 T_REMOTE_IMAGE 12141 2.86 1.97 3.31 75 BAYES_20 12027 2.55 1.10 3.28 76 XM_SPF_SoftFail 11803 3.74 4.78 3.22 77 HTML_IMAGE_RATIO_06 11674 3.53 4.23 3.18 78 XM_B_Phish_Phrases 11500 3.61 4.57 3.13 79 XM_Body_Dirty_Words 11176 4.25 6.66 3.04 80 RCVD_IN_IADB_SENDERID 11115 2.38 1.08 3.03 81 XMNumbers 10926 3.10 3.34 2.98 82 BAYES_999 10861 11.22 27.67 2.96 83 RCVD_IN_IADB_DK 10751 2.31 1.09 2.93 84 MAILING_LIST_MULTI 9827 2.35 1.70 2.68 85 MIME_HTML_MOSTLY 9724 2.83 3.18 2.65 86 RCVD_IN_IADB_VOUCHED 9597 1.94 0.59 2.61 87 BAYES_95 9485 3.47 5.24 2.58 88 TooManyTo_002 9141 2.01 1.06 2.49 89 T_TooManySym_02 8932 1.84 0.67 2.43 90 DKIM_INVALID 8855 3.49 5.63 2.41 91 TR_XM_SpammyRelay 8751 6.84 15.71 2.38 92 XM_B_SpammyTLD 8586 2.81 3.74 2.34 93 TR_XM_DKIM_Undo 8540 13.14 34.67 2.33 94 XM_H_Trusted_IP 8368 1.52 0.00 2.28 95 SCC_BODY_URI_ONLY 8193 2.24 2.26 2.23 96 XM_CamelCaseFrm001 7980 2.51 3.18 2.17 97 HTML_IMAGE_RATIO_08 7685 2.40 3.02 2.09 98 INVALID_MSGID 7187 1.35 0.15 1.96 99 BAYES_05 7184 1.49 0.55 1.96 100 HTML_MIME_NO_HTML_TAG 6996 2.24 2.89 1.91 101 XM_DK_Undo_01 6985 1.78 1.54 1.90 102 T_XMDrugObfuBody_14 6912 2.57 3.94 1.88 103 TR_XM_UnparsRelay 6734 3.61 7.14 1.83 104 HELO_NODOT 6676 1.32 0.33 1.82 105 HELO_NO_DOMAIN 6670 1.32 0.33 1.82 106 RCVD_IN_IADB_OPTIN 6617 1.30 0.31 1.80 107 TO_MALFORMED 6579 1.20 0.01 1.79 108 FROM_EXCESS_BASE64 6506 1.71 1.58 1.77 109 XMDiploma_00 6460 2.11 2.81 1.76 110 UNTRUSTED_Relay 6189 3.33 6.60 1.69 111 XMSexyCombo_05 6177 2.65 4.56 1.68 112 T_XMDrugObfuBody_08 5895 1.99 2.76 1.61 113 TR_DCC_Bayes_99 5873 9.42 25.00 1.60 114 SUBJ_ALL_CAPS 5845 1.92 2.56 1.59 115 XM_B_Unsub2 5817 1.83 2.32 1.58 116 XM_SendGrid 5795 1.48 1.28 1.58 117 XM_B_Investor 5791 2.35 3.89 1.58 118 BOTNET 5756 4.33 9.84 1.57 119 TM2_M_VERY_LONG_WORD 5406 2.06 3.23 1.47 120 TR_XM_PhishingBody 5385 2.30 3.95 1.47 121 IN_HORDE_ADDRESS_BOOK 5270 0.98 0.07 1.44 122 URI_NOVOWEL 5202 1.48 1.60 1.42 123 RELAYCOUNTRY_CA 5174 4.60 10.94 1.41 124 XMGappySubj_01 5172 0.99 0.15 1.41 125 TooManyTo_003 5100 1.26 0.99 1.39 126 TR_Symld_Words 5069 1.29 1.12 1.38 127 TVD_RCVD_IP 4757 1.11 0.73 1.30 128 TR_XM_SpammyWords5 4697 2.29 4.31 1.28 129 XM_OfRef6 4613 2.17 4.00 1.26 130 KHOP_HELO_FCRDNS 4288 1.14 1.07 1.17 131 XM_GoogleGroups 4214 0.98 0.63 1.15 132 URI_HEX 4210 1.28 1.53 1.15 133 XM_B_SEO 4132 2.50 5.23 1.13 134 XM_H_Long_From02 3862 1.25 1.65 1.05 135 XMCapTrack 3834 0.86 0.49 1.04 136 XM_UB50 3813 1.91 3.64 1.04 137 SpammyFromTLD_01 3745 1.47 2.37 1.02 138 TVD_SPACE_RATIO 3724 0.71 0.09 1.01 139 TR_XM_DK_SendGrid 3695 0.93 0.78 1.01 140 XMBSHREFv2 3688 0.77 0.32 1.00 141 T_FILL_THIS_FORM_SHORT 3646 2.02 4.06 0.99 142 TooManyTo_004 3642 0.97 0.94 0.99 143 XMGenDplmaNmb 3538 1.20 1.67 0.96 144 FROM_GOV_DKIM_AU 3526 0.71 0.22 0.96 145 XMBrknScrpt_02 3490 1.21 1.72 0.95 146 XMSubNoVowel 3345 0.73 0.36 0.91 147 T_TooManySym_03 3239 0.69 0.30 0.88 148 TR_LOTS_OF_MONEY3 3173 2.17 4.77 0.86 149 HTTPS_HTTP_MISMATCH 3085 1.12 1.68 0.84 150 XMGappySubj_02 3046 0.57 0.06 0.83 151 TR_MetaPhish_Combo_01 3008 0.82 0.82 0.82 152 DKIM_ADSP_CUSTOM_MED 3002 0.93 1.16 0.82 153 URI_TRY_3LD 3000 1.24 2.07 0.82 154 XMMoneyMeta_00 2978 0.77 0.69 0.81 155 TooManyTo_005 2977 0.84 0.90 0.81 156 T_OBFU_PDF_ATTACH 2949 0.61 0.21 0.80 157 RELAYCOUNTRY_AU 2938 1.25 2.16 0.80 158 XMBody_17 2772 3.05 7.63 0.76 159 XMStockSpam_06 2708 1.07 1.72 0.74 160 MPART_ALT_DIFF_COUNT 2694 0.81 0.97 0.73 161 TR_XM_SEO4 2564 1.97 4.51 0.70 162 XMBdyGiftCard01 2539 0.78 0.95 0.69 163 RCVD_IN_BL_SPAMCOP_NET 2498 4.87 13.22 0.68 164 XM_B_FormFill 2436 0.46 0.05 0.66 165 XMLngstWrd_00 2386 0.71 0.84 0.65 166 XM_B_COPY_HTML 2381 0.67 0.72 0.65 167 T_XMHurry_00 2357 1.17 2.22 0.64 168 XM_B_SpammyWords4 2340 1.14 2.15 0.64 169 XM_ShortIntro_01 2288 0.60 0.57 0.62 170 XM_H_PHPMailer 2258 0.66 0.74 0.62 171 XMNoVowels 2235 0.60 0.60 0.61 172 SHORT_HELO_AND_INLINE_IMAGE 2215 0.42 0.05 0.60 173 HTML_TAG_BALANCE_BODY 2202 0.81 1.23 0.60 174 XMBody_95 2164 0.43 0.12 0.59 175 T_XMDrugObfuBody_00 2143 0.85 1.39 0.58 176 TR_XM_Base64_M1 2120 0.68 0.87 0.58 177 NML_ADSP_CUSTOM_MED 1999 0.71 1.04 0.54 178 TR_XM_SpammyWords2 1997 5.60 15.67 0.54 179 T_Symld_Words_02 1962 0.57 0.65 0.53 180 TR_XM_SPAMCOP 1851 4.02 11.03 0.50 181 FORGED_GMAIL_RCVD 1808 0.58 0.74 0.49 182 TO_NO_BRKTS_HTML_ONLY 1758 0.42 0.29 0.48 183 XM_B_DNDMA 1746 0.66 1.04 0.48 184 XMPhish30 1729 0.72 1.21 0.47 185 RELAYCOUNTRY_GB 1724 0.57 0.76 0.47 186 XMSubMetaI_00 1714 0.55 0.71 0.47 187 USER_IN_WHITELIST 1656 0.30 0.00 0.45 188 USER_IN_WELCOMELIST 1656 0.30 0.00 0.45 189 PLING_QUERY 1653 0.55 0.75 0.45 190 HTML_IMAGE_ONLY_32 1649 0.36 0.18 0.45 191 HTML_IMAGE_ONLY_28 1639 0.42 0.37 0.45 192 HTML_FONT_FACE_BAD 1568 0.57 0.85 0.43 193 THIS_AD 1568 0.56 0.82 0.43 194 FILL_THIS_FORM 1557 0.35 0.21 0.42 195 XMHTML_After_End 1552 0.65 1.11 0.42 196 XMSubMetaSxObfu_02 1551 0.36 0.23 0.42 197 XMDateMe_00 1507 0.41 0.41 0.41 198 XMPhish14 1457 0.63 1.09 0.40 199 TM2_M_BODY_EMPTY 1437 0.30 0.10 0.39 200 XM_ProductURIs 1413 0.48 0.67 0.38 ----------------------------------------------------------------------