Email: 572470 Autolearn: 0 AvgScore: 2.55 AvgScanTime: 1.31 sec Spam: 176431 Autolearn: 0 AvgScore: 13.03 AvgScanTime: 1.48 sec Ham: 396039 Autolearn: 0 AvgScore: -2.12 AvgScanTime: 1.24 sec Time Spent Running SA: 208.48 hours Time Spent Processing Spam: 72.31 hours Time Spent Processing Ham: 136.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170154 91.66 96.44 89.53 2 DKIM_SIGNED 162631 75.72 92.18 68.39 3 XM_DK_Pass 156597 73.87 88.76 67.23 4 DKIM_VALID 154316 72.83 87.47 66.31 5 RELAYCOUNTRY_US 151035 84.91 85.61 84.60 6 XM_B_Unicode 150871 77.88 85.51 74.48 7 DCC_CHECK 134467 47.68 76.22 34.97 8 XM_B_SpammyWords 129288 53.88 73.28 45.24 9 XMListUnsubscribeExists 126885 54.75 71.92 47.10 10 DKIM_VALID_AU 124384 59.25 70.50 54.24 11 XM_B_Unicode3 79776 44.34 45.22 43.95 12 XM_DK_Undo_02 77430 16.96 43.89 4.96 13 XM_B_SpammyWords2 74841 25.50 42.42 17.96 14 LOC_TINY_FONT_1 74513 29.99 42.23 24.54 15 RCVD_IN_MSPIKE_H2 72914 32.04 41.33 27.90 16 BAYES_50 72438 53.25 41.06 58.69 17 HTML_FONT_LOW_CONTRAST 67063 30.35 38.01 26.94 18 FVGT_m_MULTI_ODD 64359 27.58 36.48 23.62 19 BAYES_99 58136 12.48 32.95 3.37 20 TR_XM_DKIM_Undo 57198 11.52 32.42 2.20 21 DKIM_VALID_EF 53469 27.20 30.31 25.82 22 T_KAM_HTML_FONT_INVALID 51374 22.42 29.12 19.43 23 MIME_HTML_ONLY 45799 23.50 25.96 22.41 24 BAYES_999 45449 9.70 25.76 2.54 25 TR_DCC_Bayes_99 43079 8.47 24.42 1.37 26 DCC_CHECK_NEGATIVE 41932 52.28 23.77 64.98 27 T_TM2_M_HEADER_IN_MSG 40485 24.61 22.95 25.35 28 XMSubLong 38476 22.28 21.81 22.50 29 XM_Multi_Part_URI 36757 14.99 20.83 12.39 30 TR_XM_DK_Unsub 36201 15.03 20.52 12.59 31 LOTS_OF_MONEY 30619 9.68 17.35 6.27 32 TR_XM_SpammyWords4 28123 7.97 15.94 4.41 33 XM_B_Unsub 28006 9.56 15.87 6.75 34 UNPARSEABLE_RELAY 27765 11.11 15.74 9.05 35 TR_XM_BayesUnsub 26995 8.57 15.30 5.57 36 RELAYCOUNTRY_META 25792 7.19 14.62 3.88 37 TR_MAX_INTL_RELAY 24728 8.49 14.02 6.03 38 BOTNET_IPINHOSTNAME 23782 6.64 13.48 3.60 39 XM_B_SpammyWords3 23767 7.56 13.47 4.93 40 TR_XM_SpammyWords2 22325 4.24 12.65 0.50 41 TR_XM_SpammyRelay 18475 4.77 10.47 2.23 42 FSL_BULK_SIG 18023 6.43 10.22 4.74 43 RCVD_IN_BL_SPAMCOP_NET 16382 3.49 9.29 0.91 44 BOTNET 16251 3.61 9.21 1.12 45 XM_Evil_Numbers_Gen 15530 8.64 8.80 8.57 46 BAYES_80 15288 5.25 8.67 3.73 47 BAYES_60 14375 8.31 8.15 8.38 48 TR_XM_UnparsRelay 14014 3.33 7.94 1.28 49 TR_XM_SPAMCOP 13511 2.73 7.66 0.53 50 XM_Body_Dirty_Words 12003 4.03 6.80 2.80 51 UNTRUSTED_Relay 11998 3.05 6.80 1.38 52 LotsOfNums_01 11393 7.22 6.46 7.56 53 HTML_IMAGE_RATIO_02 11042 5.22 6.26 4.75 54 MPART_ALT_DIFF 10673 7.91 6.05 8.74 55 XMSubMetaSx_00 10212 3.98 5.79 3.17 56 XM_B_PhoneNumber 10200 8.23 5.78 9.32 57 BAYES_95 8832 3.13 5.01 2.29 58 XM_B_Phish_Phrases 8808 3.57 4.99 2.93 59 XM_B_SEO 8695 2.29 4.93 1.11 60 XM_SPF_SoftFail 8687 3.69 4.92 3.14 61 XMBody_17 8673 1.93 4.92 0.59 62 TooManyTo_001 8595 6.73 4.87 7.56 63 XM_UncommonTLD01 8527 3.71 4.83 3.22 64 XM_H_Long_From01 8478 4.89 4.81 4.93 65 TR_LOTS_OF_MONEY3 8330 2.02 4.72 0.82 66 DKIM_INVALID 8315 2.89 4.71 2.07 67 HTML_IMAGE_RATIO_04 8054 10.94 4.56 13.78 68 RELAYCOUNTRY_CA 7991 2.29 4.53 1.29 69 TR_XM_PhishingBody 7916 2.57 4.49 1.72 70 XM_B_Investor 7822 2.32 4.43 1.37 71 TR_XM_SEO4 7390 1.76 4.19 0.68 72 XMStrtUSub 7165 8.86 4.06 11.00 73 XMSexyCombo_05 7027 2.14 3.98 1.32 74 XM_H_GMP 7003 5.03 3.97 5.50 75 RCVD_IN_VALIDITY_RPBL 6970 1.34 3.95 0.17 76 MIME_HTML_MOSTLY 6890 2.72 3.91 2.19 77 TR_XM_SpammyWords5 6878 2.03 3.90 1.20 78 XM_UB50 6656 1.73 3.77 0.83 79 HTML_IMAGE_RATIO_06 6625 4.33 3.76 4.58 80 T_XMDrugObfuBody_14 6522 2.15 3.70 1.46 81 XM_OfRef6 6300 1.69 3.57 0.85 82 HTML_IMAGE_RATIO_08 5968 2.47 3.38 2.06 83 T_XMDrugObfuBody_08 5940 2.27 3.37 1.78 84 XMNumbers 5850 2.71 3.32 2.44 85 XM_B_SpammyTLD 5793 2.48 3.28 2.12 86 MIME_HTML_ONLY_MULTI 5674 5.93 3.22 7.14 87 TM2_M_VERY_LONG_WORD 5672 1.78 3.21 1.14 88 T_XMHurry_00 5451 1.39 3.09 0.64 89 XMDiploma_00 5330 2.01 3.02 1.57 90 MIME_QP_LONG_LINE 5190 4.08 2.94 4.59 91 RCVD_IN_VALIDITY_SAFE 5163 4.24 2.93 4.82 92 XMStockSpam_06 5067 1.80 2.87 1.33 93 XM_URI_RBL 5017 0.98 2.84 0.15 94 USER_IN_DEF_DKIM_WL 4912 9.76 2.78 12.87 95 XM_CamelCaseFrm001 4789 2.28 2.71 2.08 96 RELAYCOUNTRY_AU 4508 1.28 2.56 0.71 97 T_TooManySym_01 4493 4.23 2.55 4.97 98 XM_B_Unsub2 4218 1.50 2.39 1.10 99 RCVD_IN_VALIDITY_CERTIFIED 4197 3.51 2.38 4.02 100 RCVD_IN_MSPIKE_H3 4106 4.37 2.33 5.28 101 RCVD_IN_MSPIKE_WL 4106 4.37 2.33 5.28 102 XM_B_SpammyWords4 4050 1.47 2.30 1.10 103 TM2_M_URI_OPT_OUT 4036 1.76 2.29 1.53 104 XM_SendGrid 3664 1.48 2.08 1.21 105 SUBJ_ALL_CAPS 3643 1.60 2.06 1.40 106 URI_TRY_3LD 3611 1.26 2.05 0.90 107 XMBrknScrpt_02 3509 1.25 1.99 0.93 108 MAILING_LIST_MULTI 3423 2.33 1.94 2.51 109 TR_XM_NoHeaderRelay 3278 0.65 1.86 0.11 110 FROM_EXCESS_BASE64 3119 1.87 1.77 1.92 111 XMLngstWrd_00 3085 1.07 1.75 0.76 112 T_REMOTE_IMAGE 3060 2.65 1.73 3.06 113 BAYES_40 2972 3.90 1.68 4.88 114 T_XMDrugObfuBody_00 2815 0.84 1.60 0.50 115 AC_BR_BONANZA 2809 0.57 1.59 0.12 116 SpammyFromTLD_01 2788 0.95 1.58 0.67 117 T_FILL_THIS_FORM_SHORT 2754 1.00 1.56 0.75 118 SpammyFromTLD_02 2729 0.74 1.55 0.38 119 LONGLN_LOW_CONTRAST 2642 0.63 1.50 0.25 120 URI_NOVOWEL 2636 1.18 1.49 1.04 121 BOUNCE_MESSAGE 2578 2.74 1.46 3.30 122 ANY_BOUNCE_MESSAGE 2578 2.74 1.46 3.30 123 XMReplyNow 2547 0.61 1.44 0.24 124 XM_HighProb1 2536 0.45 1.44 0.00 125 URI_TRUNCATED 2521 0.53 1.43 0.14 126 XM_DK_Undo_01 2521 1.48 1.43 1.51 127 HTML_MIME_NO_HTML_TAG 2493 1.73 1.41 1.87 128 XM_BadFromFormat 2466 0.51 1.40 0.11 129 HTTPS_HTTP_MISMATCH 2464 0.93 1.40 0.72 130 XM_B_Phish66 2451 0.71 1.39 0.41 131 XMPhish30 2432 0.84 1.38 0.60 132 TR_Mismatch_TLD_01 2432 0.55 1.38 0.19 133 RCVD_IN_IADB_LISTED 2423 2.75 1.37 3.36 134 TO_NO_BRKTS_FROM_MSSP 2393 0.44 1.36 0.03 135 HTML_TAG_BALANCE_BODY 2392 0.82 1.36 0.57 136 TR_XM_INV_DKIM 2382 0.46 1.35 0.06 137 URI_HEX 2318 1.01 1.31 0.87 138 XMGenDplmaNmb 2313 1.02 1.31 0.89 139 TR_XM_PHPForged 2310 0.63 1.31 0.32 140 XMSubMetaI_00 2301 0.68 1.30 0.41 141 TR_XM_PHPDW 2285 0.63 1.30 0.33 142 ALL_TRUSTED 2244 8.90 1.27 12.30 143 XM_H_Long_From02 2243 1.07 1.27 0.98 144 TR_XM_FormFill2 2229 0.62 1.26 0.33 145 XM_H_PHPOS 2223 0.61 1.26 0.32 146 XMLngstWrd_01 2163 0.63 1.23 0.36 147 BAYES_20 2146 2.78 1.22 3.48 148 XM_B_COPY_HTML 2074 0.73 1.18 0.54 149 RCVD_IN_IADB_SPF 2058 2.42 1.17 2.97 150 KHOP_HELO_FCRDNS 2019 1.14 1.14 1.14 151 XMHTML_After_End 2018 0.53 1.14 0.25 152 XM_B_DNDMA 1987 0.87 1.13 0.75 153 URIBL_DBL_SPAM 1958 0.34 1.11 0.00 154 TR_LOTS_OF_MONEY2 1951 0.46 1.11 0.18 155 TR_XM_InvalidRelay 1951 0.36 1.11 0.03 156 T_MONEY_PERCENT 1951 0.46 1.11 0.18 157 HOSTED_IMG_MULTI_PUB_01 1939 0.35 1.10 0.02 158 RCVD_IN_IADB_DK 1932 2.12 1.10 2.58 159 RCVD_IN_IADB_SENDERID 1896 2.17 1.07 2.65 160 TR_XM_Base64_M1 1823 0.80 1.03 0.69 161 T_TooManySym_02 1812 2.02 1.03 2.46 162 XM_DIRTYINTL 1809 0.38 1.03 0.10 163 TM2_M_A_HREF_HREF 1794 0.57 1.02 0.37 164 XMBdyGiftCard01 1756 1.01 1.00 1.02 165 T_HTML_ATTACH 1728 0.39 0.98 0.12 166 AC_HTML_NONSENSE_TAGS 1723 0.32 0.98 0.03 167 TR_XM_FormFill 1720 0.33 0.97 0.04 168 TR_Mismatch_TLD_02 1715 0.34 0.97 0.06 169 HTML_IMAGE_ONLY_20 1708 0.55 0.97 0.36 170 XMPhish14 1699 0.60 0.96 0.44 171 TR_Symld_Words 1698 1.23 0.96 1.35 172 BOTNET_NORDNS 1697 0.30 0.96 0.00 173 XMSexyCombo_01 1695 0.40 0.96 0.15 174 T_STY_INVIS_DIRECT 1639 0.47 0.93 0.26 175 XM_ProductURIs 1618 0.57 0.92 0.42 176 RELAYCOUNTRY_AR 1602 0.29 0.91 0.01 177 XM_UB99 1599 0.28 0.91 0.00 178 DATE_IN_PAST_06_12 1594 0.32 0.90 0.06 179 DKIM_ADSP_CUSTOM_MED 1584 0.79 0.90 0.74 180 RELAYCOUNTRY_FR 1580 0.43 0.90 0.22 181 RDNS_DYNAMIC 1571 0.44 0.89 0.24 182 FIN_FREE 1563 0.31 0.89 0.06 183 HTML_FONT_TINY_NORDNS 1560 0.34 0.88 0.10 184 TR_Caps_n_Bayes_99 1557 0.29 0.88 0.02 185 PDS_RDNS_DYNAMIC_FP 1546 0.35 0.88 0.11 186 TR_MetaPhish_Combo_01 1543 0.74 0.87 0.68 187 MPART_ALT_DIFF_COUNT 1536 0.63 0.87 0.52 188 T_Symld_Words_02 1515 0.57 0.86 0.45 189 HTML_FONT_FACE_BAD 1480 8.93 0.84 12.53 190 XM_UB60 1480 0.29 0.84 0.05 191 DIET_1 1443 0.82 0.82 0.82 192 TooManyTo_002 1442 1.87 0.82 2.34 193 REMOVE_BEFORE_LINK 1441 0.36 0.82 0.15 194 TM2_M_OBFU_COMMENT 1430 0.44 0.81 0.27 195 XMSlimDrugH 1398 0.43 0.79 0.27 196 RELAYCOUNTRY_IN 1395 0.27 0.79 0.04 197 RELAYCOUNTRY_GB 1390 0.52 0.79 0.40 198 XMLngstWrd_02 1384 0.43 0.78 0.28 199 XM_PDF 1378 3.08 0.78 4.10 200 XMHTMLBadTable_001 1368 0.39 0.78 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 354580 91.66 96.44 89.53 2 RELAYCOUNTRY_US 335043 84.91 85.61 84.60 3 XM_B_Unicode 294963 77.88 85.51 74.48 4 DKIM_SIGNED 270843 75.72 92.18 68.39 5 XM_DK_Pass 266274 73.87 88.76 67.23 6 DKIM_VALID 262633 72.83 87.47 66.31 7 DCC_CHECK_NEGATIVE 257333 52.28 23.77 64.98 8 BAYES_50 232427 53.25 41.06 58.69 9 DKIM_VALID_AU 214804 59.25 70.50 54.24 10 XMListUnsubscribeExists 186548 54.75 71.92 47.10 11 XM_B_SpammyWords 179177 53.88 73.28 45.24 12 XM_B_Unicode3 174054 44.34 45.22 43.95 13 DCC_CHECK 138494 47.68 76.22 34.97 14 RCVD_IN_MSPIKE_H2 110502 32.04 41.33 27.90 15 HTML_FONT_LOW_CONTRAST 106682 30.35 38.01 26.94 16 DKIM_VALID_EF 102264 27.20 30.31 25.82 17 T_TM2_M_HEADER_IN_MSG 100387 24.61 22.95 25.35 18 LOC_TINY_FONT_1 97193 29.99 42.23 24.54 19 FVGT_m_MULTI_ODD 93553 27.58 36.48 23.62 20 XMSubLong 89098 22.28 21.81 22.50 21 MIME_HTML_ONLY 88754 23.50 25.96 22.41 22 T_KAM_HTML_FONT_INVALID 76953 22.42 29.12 19.43 23 XM_B_SpammyWords2 71126 25.50 42.42 17.96 24 HTML_IMAGE_RATIO_04 54576 10.94 4.56 13.78 25 USER_IN_DEF_DKIM_WL 50967 9.76 2.78 12.87 26 TR_XM_DK_Unsub 49862 15.03 20.52 12.59 27 HTML_FONT_FACE_BAD 49621 8.93 0.84 12.53 28 XM_Multi_Part_URI 49060 14.99 20.83 12.39 29 BAYES_00 48939 8.76 0.67 12.36 30 ALL_TRUSTED 48724 8.90 1.27 12.30 31 XM_H_Trusted_IP 46710 8.16 0.00 11.79 32 XMStrtUSub 43575 8.86 4.06 11.00 33 XM_B_PhoneNumber 36901 8.23 5.78 9.32 34 UNPARSEABLE_RELAY 35861 11.11 15.74 9.05 35 MPART_ALT_DIFF 34624 7.91 6.05 8.74 36 XM_Evil_Numbers_Gen 33937 8.64 8.80 8.57 37 BAYES_60 33180 8.31 8.15 8.38 38 TooManyTo_001 29937 6.73 4.87 7.56 39 LotsOfNums_01 29936 7.22 6.46 7.56 40 MIME_HTML_ONLY_MULTI 28277 5.93 3.22 7.14 41 XM_B_Unsub 26731 9.56 15.87 6.75 42 XM_DKIMWhitelistDomains 26587 4.66 0.05 6.71 43 LOTS_OF_MONEY 24824 9.68 17.35 6.27 44 IN_ZIMBRA_NJ_WHITELIST 24700 4.34 0.08 6.24 45 TR_MAX_INTL_RELAY 23865 8.49 14.02 6.03 46 TR_XM_BayesUnsub 22063 8.57 15.30 5.57 47 XM_H_GMP 21801 5.03 3.97 5.50 48 TR_XM_DK_Bayes 21704 3.95 0.52 5.48 49 TR_XM_DK_Bayes1 21390 3.89 0.49 5.40 50 RCVD_IN_MSPIKE_WL 20927 4.37 2.33 5.28 51 RCVD_IN_MSPIKE_H3 20927 4.37 2.33 5.28 52 T_TooManySym_01 19701 4.23 2.55 4.97 53 XM_DK_Undo_02 19639 16.96 43.89 4.96 54 XM_H_Long_From01 19536 4.89 4.81 4.93 55 XM_B_SpammyWords3 19531 7.56 13.47 4.93 56 BAYES_40 19341 3.90 1.68 4.88 57 RCVD_IN_VALIDITY_SAFE 19095 4.24 2.93 4.82 58 HTML_IMAGE_RATIO_02 18814 5.22 6.26 4.75 59 FSL_BULK_SIG 18762 6.43 10.22 4.74 60 TR_XM_DK_Bayes2 18635 3.37 0.36 4.71 61 MIME_QP_LONG_LINE 18166 4.08 2.94 4.59 62 HTML_IMAGE_RATIO_06 18158 4.33 3.76 4.58 63 TR_XM_SpammyWords4 17477 7.97 15.94 4.41 64 XMSubNoVowel 16545 2.96 0.24 4.18 65 XM_PDF 16239 3.08 0.78 4.10 66 RCVD_IN_VALIDITY_CERTIFIED 15916 3.51 2.38 4.02 67 RELAYCOUNTRY_META 15352 7.19 14.62 3.88 68 BAYES_80 14792 5.25 8.67 3.73 69 BOTNET_IPINHOSTNAME 14239 6.64 13.48 3.60 70 BAYES_20 13767 2.78 1.22 3.48 71 BAYES_99 13334 12.48 32.95 3.37 72 RCVD_IN_IADB_LISTED 13295 2.75 1.37 3.36 73 ANY_BOUNCE_MESSAGE 13088 2.74 1.46 3.30 74 BOUNCE_MESSAGE 13086 2.74 1.46 3.30 75 XM_UncommonTLD01 12736 3.71 4.83 3.22 76 XMSubMetaSx_00 12571 3.98 5.79 3.17 77 XM_SPF_SoftFail 12436 3.69 4.92 3.14 78 T_REMOTE_IMAGE 12124 2.65 1.73 3.06 79 RCVD_IN_IADB_SPF 11773 2.42 1.17 2.97 80 XM_B_Phish_Phrases 11607 3.57 4.99 2.93 81 BAYES_05 11187 2.14 0.59 2.82 82 XM_Body_Dirty_Words 11081 4.03 6.80 2.80 83 RCVD_IN_IADB_SENDERID 10511 2.17 1.07 2.65 84 RCVD_IN_IADB_DK 10209 2.12 1.10 2.58 85 BAYES_999 10064 9.70 25.76 2.54 86 MAILING_LIST_MULTI 9925 2.33 1.94 2.51 87 T_TooManySym_02 9732 2.02 1.03 2.46 88 XMNumbers 9665 2.71 3.32 2.44 89 TooManyTo_002 9272 1.87 0.82 2.34 90 BAYES_95 9067 3.13 5.01 2.29 91 TR_XM_SpammyRelay 8834 4.77 10.47 2.23 92 RCVD_IN_IADB_VOUCHED 8771 1.76 0.74 2.21 93 TR_XM_DKIM_Undo 8728 11.52 32.42 2.20 94 MIME_HTML_MOSTLY 8693 2.72 3.91 2.19 95 XM_B_SpammyTLD 8406 2.48 3.28 2.12 96 XM_CamelCaseFrm001 8235 2.28 2.71 2.08 97 DKIM_INVALID 8210 2.89 4.71 2.07 98 HTML_IMAGE_RATIO_08 8146 2.47 3.38 2.06 99 XMSubLongNoVowel 8080 1.43 0.07 2.04 100 XMSubGarbage 7888 1.38 0.01 1.99 101 FROM_EXCESS_BASE64 7607 1.87 1.77 1.92 102 HTML_MIME_NO_HTML_TAG 7414 1.73 1.41 1.87 103 INVALID_MSGID 7266 1.31 0.14 1.83 104 T_XMDrugObfuBody_08 7049 2.27 3.37 1.78 105 TR_XM_PhishingBody 6822 2.57 4.49 1.72 106 HELO_NODOT 6622 1.25 0.29 1.67 107 HELO_NO_DOMAIN 6618 1.25 0.29 1.67 108 TO_MALFORMED 6232 1.10 0.03 1.57 109 XMDiploma_00 6205 2.01 3.02 1.57 110 RCVD_IN_IADB_OPTIN 6087 1.21 0.46 1.54 111 TM2_M_URI_OPT_OUT 6050 1.76 2.29 1.53 112 XM_DK_Undo_01 5977 1.48 1.43 1.51 113 TVD_RCVD_IP 5920 1.26 0.72 1.49 114 T_XMDrugObfuBody_14 5796 2.15 3.70 1.46 115 SUBJ_ALL_CAPS 5542 1.60 2.06 1.40 116 UNTRUSTED_Relay 5473 3.05 6.80 1.38 117 XM_B_Investor 5442 2.32 4.43 1.37 118 TR_DCC_Bayes_99 5414 8.47 24.42 1.37 119 TR_Symld_Words 5347 1.23 0.96 1.35 120 XMStockSpam_06 5249 1.80 2.87 1.33 121 XMSexyCombo_05 5235 2.14 3.98 1.32 122 RELAYCOUNTRY_CA 5099 2.29 4.53 1.29 123 TR_XM_UnparsRelay 5061 3.33 7.94 1.28 124 IN_HORDE_ADDRESS_BOOK 5003 0.90 0.07 1.26 125 XM_SendGrid 4803 1.48 2.08 1.21 126 TooManyTo_003 4772 1.05 0.71 1.20 127 TR_XM_SpammyWords5 4745 2.03 3.90 1.20 128 TM2_M_VERY_LONG_WORD 4528 1.78 3.21 1.14 129 KHOP_HELO_FCRDNS 4505 1.14 1.14 1.14 130 BOTNET 4435 3.61 9.21 1.12 131 XM_B_SEO 4387 2.29 4.93 1.11 132 XM_B_SpammyWords4 4350 1.47 2.30 1.10 133 XM_B_Unsub2 4345 1.50 2.39 1.10 134 URI_NOVOWEL 4117 1.18 1.49 1.04 135 XMGappySubj_01 4113 0.77 0.16 1.04 136 XMBdyGiftCard01 4046 1.01 1.00 1.02 137 TVD_SPACE_RATIO 3992 0.73 0.10 1.01 138 XM_GoogleGroups 3953 0.87 0.58 1.00 139 XM_H_Long_From02 3890 1.07 1.27 0.98 140 XMBSHREFv2 3703 0.72 0.24 0.94 141 XMCapTrack 3690 0.76 0.39 0.93 142 XMBrknScrpt_02 3664 1.25 1.99 0.93 143 RCVD_IN_BL_SPAMCOP_NET 3610 3.49 9.29 0.91 144 URI_TRY_3LD 3584 1.26 2.05 0.90 145 XM_E_Blogspot 3562 0.64 0.06 0.90 146 XMGenDplmaNmb 3512 1.02 1.31 0.89 147 T_TooManySym_03 3459 0.68 0.25 0.87 148 TooManyTo_004 3450 0.81 0.66 0.87 149 URI_HEX 3448 1.01 1.31 0.87 150 XM_OfRef6 3376 1.69 3.57 0.85 151 XM_UB50 3276 1.73 3.77 0.83 152 DIET_1 3257 0.82 0.82 0.82 153 TR_LOTS_OF_MONEY3 3243 2.02 4.72 0.82 154 TR_XM_DK_SendGrid 3115 0.78 0.76 0.79 155 XMLngstWrd_00 3024 1.07 1.75 0.76 156 T_FILL_THIS_FORM_SHORT 2982 1.00 1.56 0.75 157 XM_B_DNDMA 2970 0.87 1.13 0.75 158 DKIM_ADSP_CUSTOM_MED 2948 0.79 0.90 0.74 159 FROM_GOV_DKIM_AU 2868 0.61 0.36 0.72 160 TooManyTo_005 2865 0.70 0.63 0.72 161 HTTPS_HTTP_MISMATCH 2863 0.93 1.40 0.72 162 RELAYCOUNTRY_AU 2796 1.28 2.56 0.71 163 TR_XM_Base64_M1 2747 0.80 1.03 0.69 164 TR_XM_SEO4 2682 1.76 4.19 0.68 165 TR_MetaPhish_Combo_01 2679 0.74 0.87 0.68 166 XM_ShortIntro_01 2672 0.64 0.56 0.67 167 SpammyFromTLD_01 2662 0.95 1.58 0.67 168 T_XMHurry_00 2523 1.39 3.09 0.64 169 XMPhish30 2378 0.84 1.38 0.60 170 T_OBFU_PDF_ATTACH 2365 0.47 0.18 0.60 171 XMBody_17 2353 1.93 4.92 0.59 172 HTML_TAG_BALANCE_BODY 2276 0.82 1.36 0.57 173 XM_B_FormFill 2183 0.40 0.05 0.55 174 SHORT_HELO_AND_INLINE_IMAGE 2161 0.39 0.05 0.55 175 XMGappySubj_02 2160 0.40 0.07 0.55 176 XM_B_COPY_HTML 2132 0.73 1.18 0.54 177 TR_XM_SPAMCOP 2118 2.73 7.66 0.53 178 TM2_M_BODY_EMPTY 2075 0.39 0.10 0.52 179 MPART_ALT_DIFF_COUNT 2062 0.63 0.87 0.52 180 XMNoVowels 2004 0.52 0.54 0.51 181 TO_NO_BRKTS_HTML_ONLY 1993 0.43 0.25 0.50 182 T_XMDrugObfuBody_00 1975 0.84 1.60 0.50 183 TR_XM_SpammyWords2 1972 4.24 12.65 0.50 184 XMMoneyMeta_00 1969 0.56 0.69 0.50 185 XMSubMetaSxObfu_02 1961 0.55 0.66 0.50 186 PLING_QUERY 1913 0.55 0.69 0.48 187 USER_IN_WHITELIST 1889 0.33 0.00 0.48 188 USER_IN_WELCOMELIST 1889 0.33 0.00 0.48 189 XM_H_PHPMailer 1881 0.51 0.58 0.47 190 NML_ADSP_CUSTOM_MED 1830 0.55 0.73 0.46 191 T_Symld_Words_02 1775 0.57 0.86 0.45 192 XM_H_OutlookMailer 1775 0.34 0.09 0.45 193 XMPhish14 1730 0.60 0.96 0.44 194 FORGED_GMAIL_RCVD 1712 0.51 0.69 0.43 195 XM_ProductURIs 1649 0.57 0.92 0.42 196 HTML_IMAGE_ONLY_28 1636 0.38 0.30 0.41 197 XM_B_Phish66 1625 0.71 1.39 0.41 198 XMSubMetaI_00 1617 0.68 1.30 0.41 199 T_MANY_PILL_PRICE 1593 0.28 0.00 0.40 200 RELAYCOUNTRY_GB 1578 0.52 0.79 0.40 ----------------------------------------------------------------------