Email: 494984 Autolearn: 0 AvgScore: 3.50 AvgScanTime: 1.08 sec Spam: 151483 Autolearn: 0 AvgScore: 13.26 AvgScanTime: 1.22 sec Ham: 343501 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 1.01 sec Time Spent Running SA: 147.81 hours Time Spent Processing Spam: 51.39 hours Time Spent Processing Ham: 96.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145862 90.58 96.29 88.06 2 DKIM_SIGNED 137565 76.95 90.81 70.83 3 XM_DK_Pass 133024 75.27 87.81 69.74 4 DKIM_VALID 131325 74.25 86.69 68.77 5 RELAYCOUNTRY_US 130011 84.04 85.83 83.26 6 XM_B_Unicode 129806 73.85 85.69 68.63 7 DCC_CHECK 115290 48.17 76.11 35.86 8 XM_B_SpammyWords 112918 52.01 74.54 42.07 9 XMListUnsubscribeExists 110956 55.80 73.25 48.10 10 DKIM_VALID_AU 106216 60.52 70.12 56.29 11 XM_B_Unicode3 66919 39.64 44.18 37.64 12 XM_DK_Undo_02 66361 17.20 43.81 5.46 13 XM_B_SpammyWords2 64549 25.52 42.61 17.99 14 LOC_TINY_FONT_1 62737 29.29 41.42 23.95 15 RCVD_IN_MSPIKE_H2 61012 33.06 40.28 29.87 16 FVGT_m_MULTI_ODD 57786 30.94 38.15 27.77 17 HTML_FONT_LOW_CONTRAST 57784 30.47 38.15 27.08 18 BAYES_50 56449 53.13 37.26 60.12 19 BAYES_99 56106 14.27 37.04 4.23 20 TR_XM_DKIM_Undo 50607 11.87 33.41 2.37 21 BAYES_999 44055 11.16 29.08 3.25 22 T_KAM_HTML_FONT_INVALID 44013 22.74 29.05 19.96 23 TR_DCC_Bayes_99 42499 9.65 28.06 1.53 24 DKIM_VALID_EF 40613 27.60 26.81 27.95 25 T_TM2_M_HEADER_IN_MSG 37320 31.25 24.64 34.17 26 MIME_HTML_ONLY 36491 19.67 24.09 17.73 27 DCC_CHECK_NEGATIVE 36180 51.78 23.88 64.09 28 XMSubLong 31878 20.94 21.04 20.90 29 XM_Multi_Part_URI 30002 14.94 19.81 12.80 30 TR_XM_DK_Unsub 28583 15.32 18.87 13.75 31 LOTS_OF_MONEY 25571 9.36 16.88 6.05 32 TR_XM_SpammyWords4 23304 7.66 15.38 4.26 33 XM_B_Unsub 22844 9.49 15.08 7.02 34 TR_MAX_INTL_RELAY 22725 9.08 15.00 6.47 35 TR_XM_SpammyWords2 22353 4.89 14.76 0.55 36 TR_XM_BayesUnsub 22109 8.54 14.60 5.87 37 XM_B_SpammyWords3 21412 7.45 14.13 4.50 38 RELAYCOUNTRY_META 21062 6.94 13.90 3.87 39 UNPARSEABLE_RELAY 20550 10.89 13.57 9.71 40 BOTNET_IPINHOSTNAME 20237 6.62 13.36 3.65 41 TR_XM_SpammyRelay 15473 4.62 10.21 2.15 42 BAYES_80 14013 5.57 9.25 3.95 43 XM_Evil_Numbers_Gen 13695 8.07 9.04 7.64 44 BOTNET 13224 3.42 8.73 1.07 45 FSL_BULK_SIG 12549 6.07 8.28 5.09 46 BAYES_60 11469 8.71 7.57 9.21 47 XM_Body_Dirty_Words 11124 4.04 7.34 2.59 48 XMBody_17 11021 2.68 7.28 0.65 49 TR_XM_UnparsRelay 10834 3.14 7.15 1.38 50 RCVD_IN_BL_SPAMCOP_NET 10351 2.57 6.83 0.70 51 LotsOfNums_01 10343 7.53 6.83 7.85 52 XMSubMetaSx_00 9361 4.44 6.18 3.68 53 HTML_IMAGE_RATIO_02 9213 4.98 6.08 4.50 54 UNTRUSTED_Relay 8485 2.76 5.60 1.50 55 XM_B_PhoneNumber 8436 8.28 5.57 9.47 56 BAYES_95 8138 3.39 5.37 2.52 57 XM_UncommonTLD01 8111 4.08 5.35 3.51 58 RELAYCOUNTRY_CA 7972 2.47 5.26 1.25 59 MPART_ALT_DIFF 7894 3.84 5.21 3.24 60 TR_XM_SPAMCOP 7769 1.83 5.13 0.37 61 XM_SPF_SoftFail 7741 3.66 5.11 3.02 62 XM_H_Long_From01 7657 5.08 5.05 5.10 63 TR_LOTS_OF_MONEY3 7594 2.04 5.01 0.73 64 TooManyTo_001 7527 7.06 4.97 7.99 65 HTML_IMAGE_RATIO_04 7488 4.11 4.94 3.74 66 XM_B_SEO 7306 2.16 4.82 0.98 67 XM_H_GMP 7215 5.84 4.76 6.31 68 TR_XM_SEO4 6569 1.74 4.34 0.59 69 XM_B_Phish_Phrases 6524 3.79 4.31 3.56 70 XMSexyCombo_05 6384 2.56 4.21 1.83 71 XM_B_Investor 6310 2.22 4.17 1.36 72 RCVD_IN_VALIDITY_RPBL 6247 1.39 4.12 0.18 73 DKIM_INVALID 6240 2.70 4.12 2.07 74 TR_XM_PhishingBody 6026 2.12 3.98 1.31 75 MIME_HTML_MOSTLY 5962 2.72 3.94 2.18 76 HTML_IMAGE_RATIO_06 5799 2.68 3.83 2.17 77 TR_XM_SpammyWords5 5778 2.25 3.81 1.56 78 T_XMDrugObfuBody_14 5458 2.56 3.60 2.10 79 T_XMDrugObfuBody_08 5434 2.23 3.59 1.63 80 TM2_M_VERY_LONG_WORD 5338 2.02 3.52 1.36 81 XMNumbers 5334 3.10 3.52 2.91 82 HTML_IMAGE_RATIO_08 5293 2.52 3.49 2.09 83 XMStrtUSub 5222 3.91 3.45 4.11 84 XM_OfRef6 5160 1.64 3.41 0.86 85 RCVD_IN_VALIDITY_SAFE 4938 4.60 3.26 5.18 86 USER_IN_DEF_DKIM_WL 4897 9.81 3.23 12.71 87 MIME_HTML_ONLY_MULTI 4528 2.08 2.99 1.68 88 XM_CamelCaseFrm001 4488 2.31 2.96 2.03 89 XM_B_SpammyTLD 4471 2.40 2.95 2.16 90 XM_UB50 4345 1.49 2.87 0.88 91 XM_URI_RBL 4105 0.92 2.71 0.13 92 MIME_QP_LONG_LINE 3970 3.89 2.62 4.45 93 RCVD_IN_MSPIKE_WL 3954 4.67 2.61 5.58 94 RCVD_IN_MSPIKE_H3 3954 4.67 2.61 5.58 95 T_TooManySym_01 3911 4.32 2.58 5.08 96 TM2_M_URI_OPT_OUT 3901 1.89 2.58 1.59 97 T_XMHurry_00 3861 1.20 2.55 0.60 98 XMDiploma_00 3770 2.00 2.49 1.79 99 RCVD_IN_VALIDITY_CERTIFIED 3721 3.83 2.46 4.43 100 TR_XM_NoHeaderRelay 3550 0.78 2.34 0.09 101 RELAYCOUNTRY_AU 3463 1.15 2.29 0.65 102 SUBJ_ALL_CAPS 3447 1.75 2.28 1.51 103 XM_B_Unsub2 3412 1.41 2.25 1.04 104 URI_TRY_3LD 3400 1.39 2.24 1.01 105 XM_B_SpammyWords4 3200 1.38 2.11 1.05 106 AC_BR_BONANZA 3032 0.72 2.00 0.15 107 BOUNCE_MESSAGE 3031 3.50 2.00 4.16 108 ANY_BOUNCE_MESSAGE 3031 3.50 2.00 4.16 109 XMBrknScrpt_02 3030 1.36 2.00 1.08 110 FROM_EXCESS_BASE64 2712 1.76 1.79 1.74 111 HTML_MIME_NO_HTML_TAG 2659 1.91 1.76 1.97 112 HTML_TAG_BALANCE_BODY 2619 0.95 1.73 0.61 113 T_FILL_THIS_FORM_SHORT 2598 1.07 1.72 0.79 114 T_XMDrugObfuBody_00 2565 1.13 1.69 0.88 115 ALL_TRUSTED 2536 9.94 1.67 13.59 116 MAILING_LIST_MULTI 2509 2.18 1.66 2.41 117 KHOP_HELO_FCRDNS 2492 1.53 1.65 1.48 118 XM_HighProb1 2431 0.49 1.60 0.00 119 T_REMOTE_IMAGE 2428 2.82 1.60 3.35 120 XMStockSpam_06 2368 1.25 1.56 1.11 121 SpammyFromTLD_01 2364 0.87 1.56 0.56 122 BAYES_40 2320 5.34 1.53 7.01 123 XM_DIRTYINTL 2295 0.55 1.52 0.13 124 HTTPS_HTTP_MISMATCH 2276 0.98 1.50 0.76 125 SpammyFromTLD_02 2229 0.58 1.47 0.19 126 XM_DK_Undo_01 2207 1.55 1.46 1.59 127 THIS_AD 2179 0.78 1.44 0.49 128 URI_HEX 2169 1.12 1.43 0.98 129 TR_XM_INV_DKIM 2137 0.48 1.41 0.08 130 TR_XM_PHPForged 2129 5.76 1.41 7.68 131 LONGLN_LOW_CONTRAST 2109 0.60 1.39 0.25 132 HOSTED_IMG_MULTI_PUB_01 2091 0.43 1.38 0.02 133 TR_XM_PHPDW 2074 5.75 1.37 7.68 134 TR_XM_FormFill2 2048 5.75 1.35 7.68 135 XM_H_PHPOS 2037 5.73 1.34 7.67 136 XMSubMetaI_00 2031 1.12 1.34 1.02 137 XMBdyGiftCard01 2026 0.92 1.34 0.73 138 RCVD_IN_IADB_LISTED 1983 2.75 1.31 3.39 139 TR_Mismatch_TLD_02 1967 0.44 1.30 0.06 140 XMReplyNow 1870 0.55 1.23 0.25 141 XMPhish30 1868 0.71 1.23 0.48 142 RCVD_IN_PSBL 1839 0.63 1.21 0.38 143 XM_B_COPY_HTML 1813 0.72 1.20 0.50 144 TooManyTo_002 1766 2.20 1.17 2.65 145 XMHTML_After_End 1742 0.56 1.15 0.30 146 RDNS_DYNAMIC 1732 0.58 1.14 0.33 147 XM_ShortIntro_01 1727 0.91 1.14 0.82 148 BAYES_20 1712 2.48 1.13 3.07 149 RCVD_IN_IADB_SPF 1703 2.42 1.12 2.99 150 TR_XM_Base64_M1 1693 0.97 1.12 0.91 151 PDS_RDNS_DYNAMIC_FP 1688 0.46 1.11 0.18 152 XMLngstWrd_00 1679 1.11 1.11 1.11 153 XMGenDplmaNmb 1670 0.90 1.10 0.80 154 TR_XM_FormFill 1615 0.33 1.07 0.01 155 XM_B_Phish66 1609 0.49 1.06 0.23 156 TooManyTo_003 1605 1.31 1.06 1.42 157 MPART_ALT_DIFF_COUNT 1605 0.75 1.06 0.62 158 TR_Symld_Words 1604 1.37 1.06 1.51 159 TR_XM_InvalidRelay 1590 0.34 1.05 0.03 160 XM_H_Long_From02 1588 0.99 1.05 0.96 161 RCVD_IN_IADB_DK 1561 2.14 1.03 2.62 162 RCVD_IN_IADB_SENDERID 1561 2.19 1.03 2.70 163 DKIM_ADSP_CUSTOM_MED 1558 0.95 1.03 0.91 164 XMSexyCombo_01 1541 0.41 1.02 0.14 165 AC_HTML_NONSENSE_TAGS 1535 0.33 1.01 0.03 166 BOTNET_NORDNS 1529 0.31 1.01 0.01 167 XM_SendGrid 1527 1.15 1.01 1.21 168 MISSING_HEADERS 1525 0.57 1.01 0.38 169 XMSubMetaSxObfu_03 1506 0.87 0.99 0.81 170 TooManyTo_004 1502 1.04 0.99 1.06 171 MIME_CHARSET_FARAWAY 1464 0.45 0.97 0.23 172 XMHTMLBadTable_001 1459 0.48 0.96 0.27 173 TR_MetaPhish_Combo_01 1449 0.83 0.96 0.77 174 XM_H_Undi_Recip 1448 0.45 0.96 0.23 175 TooManyTo_005 1447 0.90 0.96 0.87 176 DKIM_ADSP_NXDOMAIN 1403 0.51 0.93 0.32 177 XMSlimDrugH 1386 0.53 0.91 0.36 178 T_STY_INVIS_DIRECT 1382 0.50 0.91 0.31 179 XM_UB99 1379 0.28 0.91 0.00 180 XM_B_DNDMA 1378 0.86 0.91 0.84 181 XM_ProductURIs 1373 0.63 0.91 0.51 182 T_MONEY_PERCENT 1365 0.41 0.90 0.19 183 TR_LOTS_OF_MONEY2 1365 0.41 0.90 0.19 184 LongTLD 1360 0.57 0.90 0.42 185 TVD_RCVD_IP 1360 1.17 0.90 1.30 186 FORGED_GMAIL_RCVD 1325 0.64 0.87 0.53 187 TR_Caps_n_Bayes_99 1312 0.27 0.87 0.01 188 URIBL_DBL_SPAM 1294 0.27 0.85 0.01 189 URI_NOVOWEL 1292 1.12 0.85 1.24 190 RELAYCOUNTRY_FR 1272 0.40 0.84 0.21 191 FROM_MISSP_EH_MATCH 1243 0.26 0.82 0.01 192 T_Symld_Words_02 1229 0.59 0.81 0.50 193 XMPhish14 1216 0.49 0.80 0.35 194 XM_Dr_From 1214 0.34 0.80 0.14 195 TO_NO_BRKTS_FROM_MSSP 1211 0.26 0.80 0.02 196 NML_ADSP_CUSTOM_MED 1204 0.64 0.79 0.57 197 HTML_FONT_TINY_NORDNS 1183 0.31 0.78 0.11 198 RCVD_IN_IADB_VOUCHED 1179 1.76 0.78 2.19 199 REMOVE_BEFORE_LINK 1175 0.36 0.78 0.18 200 RELAYCOUNTRY_GB 1159 0.51 0.77 0.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 302496 90.58 96.29 88.06 2 RELAYCOUNTRY_US 285987 84.04 85.83 83.26 3 DKIM_SIGNED 243313 76.95 90.81 70.83 4 XM_DK_Pass 239555 75.27 87.81 69.74 5 DKIM_VALID 236212 74.25 86.69 68.77 6 XM_B_Unicode 235752 73.85 85.69 68.63 7 DCC_CHECK_NEGATIVE 220146 51.78 23.88 64.09 8 BAYES_50 206522 53.13 37.26 60.12 9 DKIM_VALID_AU 193343 60.52 70.12 56.29 10 XMListUnsubscribeExists 165227 55.80 73.25 48.10 11 XM_B_SpammyWords 144520 52.01 74.54 42.07 12 XM_B_Unicode3 129306 39.64 44.18 37.64 13 DCC_CHECK 123165 48.17 76.11 35.86 14 T_TM2_M_HEADER_IN_MSG 117361 31.25 24.64 34.17 15 RCVD_IN_MSPIKE_H2 102608 33.06 40.28 29.87 16 DKIM_VALID_EF 95994 27.60 26.81 27.95 17 FVGT_m_MULTI_ODD 95384 30.94 38.15 27.77 18 HTML_FONT_LOW_CONTRAST 93018 30.47 38.15 27.08 19 LOC_TINY_FONT_1 82268 29.29 41.42 23.95 20 XMSubLong 71792 20.94 21.04 20.90 21 T_KAM_HTML_FONT_INVALID 68559 22.74 29.05 19.96 22 XM_B_SpammyWords2 61788 25.52 42.61 17.99 23 MIME_HTML_ONLY 60895 19.67 24.09 17.73 24 TR_XM_DK_Unsub 47239 15.32 18.87 13.75 25 ALL_TRUSTED 46668 9.94 1.67 13.59 26 IN_ZIMBRA_NJ_WHITELIST 46289 9.37 0.07 13.48 27 XM_Multi_Part_URI 43969 14.94 19.81 12.80 28 USER_IN_DEF_DKIM_WL 43673 9.81 3.23 12.71 29 UNPARSEABLE_RELAY 33368 10.89 13.57 9.71 30 XM_B_PhoneNumber 32534 8.28 5.57 9.47 31 BAYES_60 31643 8.71 7.57 9.21 32 BAYES_00 27604 5.69 0.37 8.04 33 TooManyTo_001 27429 7.06 4.97 7.99 34 XM_DKIMWhitelistDomains 27037 5.47 0.03 7.87 35 LotsOfNums_01 26949 7.53 6.83 7.85 36 XM_H_PHPMailer 26739 5.61 0.70 7.78 37 TR_XM_PHPForged 26397 5.76 1.41 7.68 38 TR_XM_FormFill2 26389 5.75 1.35 7.68 39 TR_XM_PHPDW 26369 5.75 1.37 7.68 40 XM_H_PHPOS 26343 5.73 1.34 7.67 41 XM_Evil_Numbers_Gen 26229 8.07 9.04 7.64 42 XM_H_PHPOS_M 24921 5.12 0.28 7.26 43 XM_B_Unsub 24110 9.49 15.08 7.02 44 BAYES_40 24096 5.34 1.53 7.01 45 TR_MAX_INTL_RELAY 22218 9.08 15.00 6.47 46 XM_H_GMP 21683 5.84 4.76 6.31 47 LOTS_OF_MONEY 20778 9.36 16.88 6.05 48 TR_XM_BayesUnsub 20168 8.54 14.60 5.87 49 RCVD_IN_MSPIKE_WL 19168 4.67 2.61 5.58 50 RCVD_IN_MSPIKE_H3 19168 4.67 2.61 5.58 51 TR_XM_DK_Bayes 18880 3.89 0.26 5.50 52 XM_DK_Undo_02 18771 17.20 43.81 5.46 53 TR_XM_DK_Bayes1 18634 3.84 0.24 5.42 54 RCVD_IN_VALIDITY_SAFE 17808 4.60 3.26 5.18 55 XM_H_Long_From01 17502 5.08 5.05 5.10 56 FSL_BULK_SIG 17497 6.07 8.28 5.09 57 T_TooManySym_01 17466 4.32 2.58 5.08 58 TR_XM_DK_Bayes2 16411 3.37 0.18 4.78 59 XM_B_SpammyWords3 15461 7.45 14.13 4.50 60 HTML_IMAGE_RATIO_02 15459 4.98 6.08 4.50 61 MIME_QP_LONG_LINE 15292 3.89 2.62 4.45 62 RCVD_IN_VALIDITY_CERTIFIED 15217 3.83 2.46 4.43 63 TR_XM_SpammyWords4 14625 7.66 15.38 4.26 64 BAYES_99 14535 14.27 37.04 4.23 65 XM_PDF 14385 3.12 0.70 4.19 66 ANY_BOUNCE_MESSAGE 14286 3.50 2.00 4.16 67 BOUNCE_MESSAGE 14285 3.50 2.00 4.16 68 XMStrtUSub 14123 3.91 3.45 4.11 69 BAYES_80 13561 5.57 9.25 3.95 70 RELAYCOUNTRY_META 13298 6.94 13.90 3.87 71 HTML_IMAGE_RATIO_04 12842 4.11 4.94 3.74 72 XMSubMetaSx_00 12637 4.44 6.18 3.68 73 BOTNET_IPINHOSTNAME 12525 6.62 13.36 3.65 74 XM_B_Phish_Phrases 12213 3.79 4.31 3.56 75 XM_UncommonTLD01 12066 4.08 5.35 3.51 76 RCVD_IN_IADB_LISTED 11639 2.75 1.31 3.39 77 T_REMOTE_IMAGE 11522 2.82 1.60 3.35 78 BAYES_999 11164 11.16 29.08 3.25 79 MPART_ALT_DIFF 11124 3.84 5.21 3.24 80 DATE_IN_PAST_03_06 10668 2.26 0.34 3.11 81 BAYES_20 10561 2.48 1.13 3.07 82 XM_SPF_SoftFail 10372 3.66 5.11 3.02 83 RCVD_IN_IADB_SPF 10277 2.42 1.12 2.99 84 XMNumbers 10000 3.10 3.52 2.91 85 RCVD_IN_IADB_SENDERID 9288 2.19 1.03 2.70 86 T_TooManySym_02 9158 2.07 0.73 2.67 87 TooManyTo_002 9117 2.20 1.17 2.65 88 RCVD_IN_IADB_DK 9008 2.14 1.03 2.62 89 XM_Body_Dirty_Words 8892 4.04 7.34 2.59 90 BAYES_95 8652 3.39 5.37 2.52 91 MAILING_LIST_MULTI 8295 2.18 1.66 2.41 92 TR_XM_DKIM_Undo 8129 11.87 33.41 2.37 93 RCVD_IN_IADB_VOUCHED 7515 1.76 0.78 2.19 94 MIME_HTML_MOSTLY 7479 2.72 3.94 2.18 95 HTML_IMAGE_RATIO_06 7455 2.68 3.83 2.17 96 XM_B_SpammyTLD 7422 2.40 2.95 2.16 97 TR_XM_SpammyRelay 7380 4.62 10.21 2.15 98 INVALID_MSGID 7322 1.52 0.13 2.13 99 T_XMDrugObfuBody_14 7207 2.56 3.60 2.10 100 HTML_IMAGE_RATIO_08 7176 2.52 3.49 2.09 101 DKIM_INVALID 7101 2.70 4.12 2.07 102 XM_CamelCaseFrm001 6958 2.31 2.96 2.03 103 HTML_MIME_NO_HTML_TAG 6777 1.91 1.76 1.97 104 TO_MALFORMED 6761 1.37 0.03 1.97 105 BAYES_05 6327 1.42 0.47 1.84 106 XMSexyCombo_05 6293 2.56 4.21 1.83 107 XMDiploma_00 6133 2.00 2.49 1.79 108 FROM_EXCESS_BASE64 5984 1.76 1.79 1.74 109 HELO_NODOT 5857 1.28 0.32 1.71 110 HELO_NO_DOMAIN 5853 1.28 0.32 1.70 111 MIME_HTML_ONLY_MULTI 5756 2.08 2.99 1.68 112 T_XMDrugObfuBody_08 5595 2.23 3.59 1.63 113 XM_DK_Undo_01 5462 1.55 1.46 1.59 114 TM2_M_URI_OPT_OUT 5451 1.89 2.58 1.59 115 TR_XM_SpammyWords5 5356 2.25 3.81 1.56 116 TR_DCC_Bayes_99 5265 9.65 28.06 1.53 117 RCVD_IN_IADB_OPTIN 5246 1.21 0.48 1.53 118 SUBJ_ALL_CAPS 5197 1.75 2.28 1.51 119 TR_Symld_Words 5195 1.37 1.06 1.51 120 UNTRUSTED_Relay 5154 2.76 5.60 1.50 121 KHOP_HELO_FCRDNS 5092 1.53 1.65 1.48 122 IN_HORDE_ADDRESS_BOOK 4887 1.01 0.07 1.42 123 TooManyTo_003 4862 1.31 1.06 1.42 124 TR_XM_UnparsRelay 4731 3.14 7.15 1.38 125 XM_B_Investor 4680 2.22 4.17 1.36 126 TM2_M_VERY_LONG_WORD 4660 2.02 3.52 1.36 127 TR_XM_PhishingBody 4487 2.12 3.98 1.31 128 TVD_RCVD_IP 4455 1.17 0.90 1.30 129 RELAYCOUNTRY_CA 4277 2.47 5.26 1.25 130 URI_NOVOWEL 4244 1.12 0.85 1.24 131 XM_SendGrid 4157 1.15 1.01 1.21 132 XMStockSpam_06 3820 1.25 1.56 1.11 133 XMLngstWrd_00 3804 1.11 1.11 1.11 134 XM_GoogleGroups 3777 0.94 0.58 1.10 135 TVD_SPACE_RATIO 3750 0.79 0.11 1.09 136 XMBrknScrpt_02 3714 1.36 2.00 1.08 137 BOTNET 3680 3.42 8.73 1.07 138 TooManyTo_004 3638 1.04 0.99 1.06 139 XMCapTrack 3628 0.89 0.50 1.06 140 XM_B_SpammyWords4 3613 1.38 2.11 1.05 141 XMGappySubj_01 3593 0.78 0.17 1.05 142 XMBSHREFv2 3589 0.87 0.46 1.04 143 XM_B_Unsub2 3584 1.41 2.25 1.04 144 XMSubMetaI_00 3514 1.12 1.34 1.02 145 URI_TRY_3LD 3461 1.39 2.24 1.01 146 XM_B_SEO 3370 2.16 4.82 0.98 147 URI_HEX 3351 1.12 1.43 0.98 148 XM_H_Long_From02 3300 0.99 1.05 0.96 149 T_TooManySym_03 3211 0.73 0.26 0.93 150 DKIM_ADSP_CUSTOM_MED 3136 0.95 1.03 0.91 151 TR_XM_Base64_M1 3112 0.97 1.12 0.91 152 XM_UB50 3023 1.49 2.87 0.88 153 T_XMDrugObfuBody_00 3012 1.13 1.69 0.88 154 TooManyTo_005 3005 0.90 0.96 0.87 155 XM_OfRef6 2952 1.64 3.41 0.86 156 TR_XM_DK_SendGrid 2897 0.79 0.67 0.84 157 XM_B_DNDMA 2888 0.86 0.91 0.84 158 XM_ShortIntro_01 2800 0.91 1.14 0.82 159 XMSubMetaSxObfu_03 2790 0.87 0.99 0.81 160 XMGenDplmaNmb 2762 0.90 1.10 0.80 161 T_FILL_THIS_FORM_SHORT 2713 1.07 1.72 0.79 162 TR_MetaPhish_Combo_01 2646 0.83 0.96 0.77 163 HTTPS_HTTP_MISMATCH 2599 0.98 1.50 0.76 164 HTML_IMAGE_ONLY_32 2574 0.57 0.15 0.75 165 TR_LOTS_OF_MONEY3 2507 2.04 5.01 0.73 166 XMBdyGiftCard01 2506 0.92 1.34 0.73 167 XMLngstWrd_01 2481 0.65 0.50 0.72 168 RCVD_IN_BL_SPAMCOP_NET 2390 2.57 6.83 0.70 169 XM_B_FormFill 2333 0.51 0.12 0.68 170 XMGappySubj_02 2329 0.50 0.09 0.68 171 TO_NO_BRKTS_HTML_ONLY 2319 0.60 0.41 0.68 172 XMBody_17 2248 2.68 7.28 0.65 173 XMNoVowels 2229 0.64 0.62 0.65 174 RELAYCOUNTRY_AU 2218 1.15 2.29 0.65 175 MPART_ALT_DIFF_COUNT 2128 0.75 1.06 0.62 176 HTML_TAG_BALANCE_BODY 2107 0.95 1.73 0.61 177 XMLngstWrd_02 2070 0.55 0.44 0.60 178 T_XMHurry_00 2060 1.20 2.55 0.60 179 XMBody_95 2039 0.46 0.17 0.59 180 TR_XM_SEO4 2033 1.74 4.34 0.59 181 T_OBFU_PDF_ATTACH 2027 0.45 0.14 0.59 182 USER_IN_WELCOMELIST 2013 0.41 0.00 0.59 183 USER_IN_WHITELIST 2013 0.41 0.00 0.59 184 FILL_THIS_FORM 1993 0.48 0.26 0.58 185 NML_ADSP_CUSTOM_MED 1954 0.64 0.79 0.57 186 XMSubMetaSxObfu_02 1948 0.50 0.36 0.57 187 SpammyFromTLD_01 1938 0.87 1.56 0.56 188 XMMoneyMeta_00 1928 0.60 0.69 0.56 189 SHORT_HELO_AND_INLINE_IMAGE 1887 0.40 0.05 0.55 190 TR_XM_SpammyWords2 1876 4.89 14.76 0.55 191 FORGED_GMAIL_RCVD 1837 0.64 0.87 0.53 192 XMOemUri 1775 0.49 0.42 0.52 193 XM_ProductURIs 1752 0.63 0.91 0.51 194 XM_B_COPY_HTML 1727 0.72 1.20 0.50 195 T_Symld_Words_02 1716 0.59 0.81 0.50 196 THIS_AD 1686 0.78 1.44 0.49 197 XMPhish30 1635 0.71 1.23 0.48 198 XMLngstWrd_03 1549 0.43 0.39 0.45 199 HTML_IMAGE_ONLY_20 1511 0.42 0.37 0.44 200 HTML_IMAGE_ONLY_28 1480 0.44 0.45 0.43 ----------------------------------------------------------------------