Email: 510838 Autolearn: 0 AvgScore: 4.42 AvgScanTime: 1.11 sec Spam: 169044 Autolearn: 0 AvgScore: 13.49 AvgScanTime: 1.26 sec Ham: 341794 Autolearn: 0 AvgScore: -0.06 AvgScanTime: 1.04 sec Time Spent Running SA: 158.17 hours Time Spent Processing Spam: 59.20 hours Time Spent Processing Ham: 98.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 163752 88.15 96.87 83.84 2 DKIM_SIGNED 154670 78.77 91.50 72.48 3 XM_DK_Pass 149352 76.87 88.35 71.19 4 DKIM_VALID 147396 75.82 87.19 70.19 5 RELAYCOUNTRY_US 145507 81.42 86.08 79.12 6 XM_B_Unicode 143559 72.38 84.92 66.18 7 DCC_CHECK 126948 48.06 75.10 34.68 8 XMListUnsubscribeExists 124657 55.90 73.74 47.08 9 XM_B_SpammyWords 122526 51.72 72.48 41.46 10 DKIM_VALID_AU 118665 61.07 70.20 56.56 11 XM_DK_Undo_02 78848 19.57 46.64 6.18 12 LOC_TINY_FONT_1 72788 30.22 43.06 23.88 13 XM_B_Unicode3 72127 39.57 42.67 38.04 14 XM_B_SpammyWords2 69319 24.38 41.01 16.16 15 BAYES_99 66528 16.41 39.36 5.07 16 HTML_FONT_LOW_CONTRAST 66414 31.25 39.29 27.27 17 RCVD_IN_MSPIKE_H2 66144 33.87 39.13 31.26 18 FVGT_m_MULTI_ODD 62892 29.11 37.20 25.11 19 BAYES_50 60899 52.78 36.03 61.06 20 TR_XM_DKIM_Undo 58621 13.12 34.68 2.45 21 BAYES_999 54728 13.36 32.38 3.96 22 TR_DCC_Bayes_99 49685 11.04 29.39 1.97 23 T_KAM_HTML_FONT_INVALID 49337 22.74 29.19 19.56 24 DKIM_VALID_EF 48625 29.66 28.76 30.10 25 DCC_CHECK_NEGATIVE 42080 51.90 24.89 65.26 26 MIME_HTML_ONLY 41960 21.01 24.82 19.12 27 T_TM2_M_HEADER_IN_MSG 41768 29.42 24.71 31.75 28 XMSubLong 37752 22.71 22.33 22.90 29 TR_XM_DK_Unsub 33653 15.93 19.91 13.97 30 XM_Multi_Part_URI 30627 16.64 18.12 15.92 31 LOTS_OF_MONEY 28254 10.01 16.71 6.70 32 TR_XM_SpammyWords4 25869 8.11 15.30 4.55 33 TR_XM_SpammyWords2 25052 5.46 14.82 0.84 34 RELAYCOUNTRY_META 24430 7.47 14.45 4.02 35 UNPARSEABLE_RELAY 24389 11.83 14.43 10.54 36 XM_B_Unsub 23468 9.79 13.88 7.77 37 TR_MAX_INTL_RELAY 23000 9.13 13.61 6.92 38 XM_B_SpammyWords3 22877 7.04 13.53 3.83 39 BOTNET_IPINHOSTNAME 22583 6.83 13.36 3.60 40 TR_XM_BayesUnsub 22582 8.63 13.36 6.29 41 TR_XM_SpammyRelay 17098 4.72 10.11 2.05 42 BOTNET 14736 3.63 8.72 1.11 43 BAYES_80 14205 5.58 8.40 4.18 44 TR_XM_UnparsRelay 13496 3.76 7.98 1.67 45 FSL_BULK_SIG 13332 5.93 7.89 4.96 46 XM_Evil_Numbers_Gen 13302 8.13 7.87 8.25 47 BAYES_60 13195 8.55 7.81 8.92 48 RCVD_IN_BL_SPAMCOP_NET 13061 2.92 7.73 0.54 49 LotsOfNums_01 11801 7.63 6.98 7.94 50 XM_Body_Dirty_Words 11270 4.09 6.67 2.82 51 TR_XM_SPAMCOP 10719 2.33 6.34 0.34 52 XMBody_17 10683 2.52 6.32 0.64 53 TR_LOTS_OF_MONEY3 10638 2.49 6.29 0.62 54 XM_B_PhoneNumber 9793 8.90 5.79 10.44 55 HTML_IMAGE_RATIO_02 9526 4.89 5.64 4.52 56 XMSubMetaSx_00 8943 4.70 5.29 4.40 57 UNTRUSTED_Relay 8916 2.95 5.27 1.80 58 HTML_IMAGE_RATIO_04 8900 4.32 5.26 3.85 59 RELAYCOUNTRY_CA 8883 2.53 5.25 1.18 60 XM_UncommonTLD01 8440 4.46 4.99 4.19 61 XM_SPF_SoftFail 8141 4.06 4.82 3.68 62 BAYES_95 8136 3.42 4.81 2.73 63 TooManyTo_001 7983 7.56 4.72 8.97 64 MPART_ALT_DIFF 7940 3.68 4.70 3.18 65 XM_B_SEO 7878 2.25 4.66 1.06 66 XM_H_Long_From01 7813 5.05 4.62 5.26 67 TR_XM_SpammyWords5 7512 2.36 4.44 1.32 68 XM_H_GMP 7408 5.75 4.38 6.42 69 XM_B_Investor 7374 2.42 4.36 1.46 70 DKIM_INVALID 7274 2.96 4.30 2.29 71 XMStrtUSub 7273 4.46 4.30 4.54 72 XM_OfRef6 7181 2.03 4.25 0.94 73 HTML_IMAGE_RATIO_06 7135 3.35 4.22 2.92 74 TR_XM_SEO4 7041 1.79 4.17 0.61 75 T_XMDrugObfuBody_14 6795 2.35 4.02 1.52 76 XM_B_Phish_Phrases 6752 3.72 3.99 3.58 77 XMNumbers 6652 3.23 3.94 2.88 78 TR_XM_PhishingBody 6330 2.12 3.74 1.32 79 XM_B_SpammyTLD 6155 4.74 3.64 5.28 80 XMSexyCombo_05 6145 2.50 3.64 1.93 81 T_XMDrugObfuBody_08 6123 2.16 3.62 1.44 82 T_XMHurry_00 5818 1.66 3.44 0.77 83 RCVD_IN_VALIDITY_SAFE 5792 3.98 3.43 4.25 84 MIME_HTML_MOSTLY 5412 2.45 3.20 2.08 85 TM2_M_VERY_LONG_WORD 5387 1.86 3.19 1.20 86 MIME_HTML_ONLY_MULTI 5058 2.21 2.99 1.83 87 HTML_IMAGE_RATIO_08 4862 2.27 2.88 1.96 88 MIME_QP_LONG_LINE 4686 4.17 2.77 4.86 89 T_TooManySym_01 4604 5.13 2.72 6.32 90 XM_CamelCaseFrm001 4600 2.13 2.72 1.84 91 RCVD_IN_MSPIKE_WL 4517 5.00 2.67 6.15 92 RCVD_IN_MSPIKE_H3 4517 5.00 2.67 6.15 93 XMDiploma_00 4504 2.06 2.66 1.77 94 XM_URI_RBL 4431 0.96 2.62 0.14 95 RCVD_IN_VALIDITY_CERTIFIED 4421 3.21 2.62 3.50 96 XM_UB50 4359 1.50 2.58 0.97 97 USER_IN_DEF_DKIM_WL 4341 9.57 2.57 13.03 98 URI_TRY_3LD 4201 1.39 2.49 0.84 99 TM2_M_URI_OPT_OUT 4174 1.90 2.47 1.63 100 SUBJ_ALL_CAPS 3982 1.70 2.36 1.38 101 XM_B_Unsub2 3806 1.66 2.25 1.37 102 XMBrknScrpt_02 3786 1.33 2.24 0.88 103 RELAYCOUNTRY_AU 3742 1.22 2.21 0.72 104 RCVD_IN_VALIDITY_RPBL 3739 0.77 2.21 0.06 105 XM_B_SpammyWords4 3546 1.10 2.10 0.61 106 XMStockSpam_06 3362 1.75 1.99 1.63 107 HTML_MIME_NO_HTML_TAG 3202 2.13 1.89 2.25 108 MAILING_LIST_MULTI 3141 2.57 1.86 2.92 109 T_REMOTE_IMAGE 3078 3.16 1.82 3.82 110 SpammyFromTLD_01 3059 1.18 1.81 0.87 111 AC_BR_BONANZA 3039 0.66 1.80 0.09 112 ALL_TRUSTED 2893 12.32 1.71 17.56 113 TR_XM_NoHeaderRelay 2714 0.60 1.61 0.10 114 TR_XM_PHPForged 2574 0.84 1.52 0.50 115 KHOP_HELO_FCRDNS 2532 1.48 1.50 1.47 116 TR_XM_PHPDW 2522 0.83 1.49 0.50 117 HTML_TAG_BALANCE_BODY 2514 0.90 1.49 0.60 118 FROM_EXCESS_BASE64 2510 1.59 1.48 1.64 119 T_XMDrugObfuBody_00 2509 0.89 1.48 0.59 120 TR_XM_INV_DKIM 2490 0.53 1.47 0.06 121 TR_XM_FormFill2 2473 0.82 1.46 0.51 122 XM_HighProb1 2470 0.49 1.46 0.00 123 BAYES_40 2455 4.11 1.45 5.43 124 XM_H_PHPOS 2449 0.81 1.45 0.49 125 XM_DK_Undo_01 2440 1.72 1.44 1.86 126 TR_MetaPhish_Combo_01 2370 0.94 1.40 0.71 127 SpammyFromTLD_02 2352 0.59 1.39 0.20 128 HTTPS_HTTP_MISMATCH 2350 1.12 1.39 0.99 129 URI_HEX 2308 1.21 1.37 1.13 130 ANY_BOUNCE_MESSAGE 2242 2.99 1.33 3.81 131 BOUNCE_MESSAGE 2241 2.99 1.33 3.81 132 XMGenDplmaNmb 2216 1.05 1.31 0.92 133 HOSTED_IMG_MULTI_PUB_01 2169 0.44 1.28 0.02 134 XMBdyGiftCard01 2164 0.93 1.28 0.76 135 XMSlimDrugH 2145 0.63 1.27 0.31 136 T_FILL_THIS_FORM_SHORT 2141 0.98 1.27 0.83 137 MPART_ALT_DIFF_COUNT 2061 0.84 1.22 0.65 138 URI_NOVOWEL 2047 3.25 1.21 4.25 139 XMReplyNow 2043 0.60 1.21 0.30 140 TM2_M_A_HREF_HREF 2032 0.59 1.20 0.29 141 RCVD_IN_IADB_LISTED 2030 2.87 1.20 3.70 142 XM_ProductURIs 2022 0.66 1.20 0.40 143 XM_PDF 1991 3.55 1.18 4.72 144 RELAYCOUNTRY_NL 1988 0.51 1.18 0.18 145 T_MONEY_PERCENT 1985 0.56 1.17 0.26 146 TR_LOTS_OF_MONEY2 1985 0.56 1.17 0.26 147 DIET_1 1956 0.55 1.16 0.24 148 RDNS_DYNAMIC 1931 0.54 1.14 0.25 149 TR_XM_InvalidRelay 1901 0.39 1.12 0.03 150 PDS_RDNS_DYNAMIC_FP 1883 0.42 1.11 0.08 151 XMPhish30 1869 0.63 1.11 0.39 152 DKIM_ADSP_NXDOMAIN 1868 0.58 1.11 0.33 153 XMSubMetaI_00 1851 0.68 1.09 0.48 154 BOTNET_NORDNS 1822 0.36 1.08 0.01 155 XM_SendGrid 1822 1.30 1.08 1.40 156 XMLngstWrd_00 1816 0.97 1.07 0.92 157 AC_HTML_NONSENSE_TAGS 1803 0.36 1.07 0.02 158 URIBL_DBL_SPAM 1789 0.35 1.06 0.01 159 RCVD_IN_IADB_SPF 1744 2.51 1.03 3.25 160 XM_B_COPY_HTML 1739 0.69 1.03 0.53 161 TR_Caps_n_Bayes_99 1722 0.36 1.02 0.03 162 TVD_RCVD_IP 1715 1.36 1.01 1.53 163 TR_Symld_Words 1690 1.41 1.00 1.62 164 DKIM_ADSP_CUSTOM_MED 1679 0.89 0.99 0.83 165 XM_H_Long_From02 1661 1.06 0.98 1.10 166 LONGLN_LOW_CONTRAST 1661 0.52 0.98 0.29 167 BAYES_20 1652 2.41 0.98 3.11 168 LongTLD 1648 0.59 0.97 0.40 169 T_STY_INVIS_DIRECT 1625 0.51 0.96 0.28 170 XMHTML_After_End 1607 0.53 0.95 0.32 171 RCVD_IN_IADB_DK 1599 2.20 0.95 2.81 172 RCVD_IN_IADB_SENDERID 1598 2.25 0.95 2.90 173 XM_B_Phish66 1579 0.51 0.93 0.31 174 T_TooManySym_02 1579 2.35 0.93 3.05 175 TR_Mismatch_TLD_02 1556 0.36 0.92 0.09 176 XM_Nigeria_01 1555 0.33 0.92 0.03 177 TooManyTo_002 1549 2.39 0.92 3.12 178 HTML_FONT_TINY_NORDNS 1522 0.37 0.90 0.10 179 XM_H_Undi_Recip 1471 0.46 0.87 0.25 180 XMPhish14 1463 0.54 0.87 0.38 181 XM_UB99 1450 0.29 0.86 0.00 182 XMSexyCombo_01 1446 0.41 0.86 0.19 183 THIS_AD 1444 0.54 0.85 0.39 184 XMMoneyMeta_00 1444 0.64 0.85 0.53 185 NML_ADSP_CUSTOM_MED 1422 0.66 0.84 0.57 186 XM_B_DNDMA 1417 0.69 0.84 0.62 187 TR_XM_FormFill 1412 0.28 0.84 0.01 188 HTML_FONT_FACE_BAD 1390 0.52 0.82 0.37 189 XM_DIRTYINTL 1387 0.33 0.82 0.09 190 RELAYCOUNTRY_GB 1355 0.54 0.80 0.41 191 PLING_QUERY 1347 0.54 0.80 0.42 192 TooManyTo_003 1318 1.35 0.78 1.64 193 TR_XM_SpoofStaff 1308 0.34 0.77 0.13 194 XM_H_PHPMailer 1306 0.81 0.77 0.83 195 RELAYCOUNTRY_FR 1297 0.40 0.77 0.22 196 XMSpoofStaff2 1292 0.30 0.76 0.07 197 XMPhish08 1272 0.38 0.75 0.19 198 XMHTMLBadTable_001 1268 0.42 0.75 0.25 199 XM_UB60 1260 0.29 0.75 0.06 200 XM_H_SpoofStaff4 1254 0.33 0.74 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 286545 88.15 96.87 83.84 2 RELAYCOUNTRY_US 270423 81.42 86.08 79.12 3 DKIM_SIGNED 247735 78.77 91.50 72.48 4 XM_DK_Pass 243312 76.87 88.35 71.19 5 DKIM_VALID 239909 75.82 87.19 70.19 6 XM_B_Unicode 226192 72.38 84.92 66.18 7 DCC_CHECK_NEGATIVE 223058 51.90 24.89 65.26 8 BAYES_50 208697 52.78 36.03 61.06 9 DKIM_VALID_AU 193309 61.07 70.20 56.56 10 XMListUnsubscribeExists 160902 55.90 73.74 47.08 11 XM_B_SpammyWords 141694 51.72 72.48 41.46 12 XM_B_Unicode3 130013 39.57 42.67 38.04 13 DCC_CHECK 118541 48.06 75.10 34.68 14 T_TM2_M_HEADER_IN_MSG 108510 29.42 24.71 31.75 15 RCVD_IN_MSPIKE_H2 106861 33.87 39.13 31.26 16 DKIM_VALID_EF 102888 29.66 28.76 30.10 17 HTML_FONT_LOW_CONTRAST 93222 31.25 39.29 27.27 18 FVGT_m_MULTI_ODD 85828 29.11 37.20 25.11 19 LOC_TINY_FONT_1 81608 30.22 43.06 23.88 20 XMSubLong 78264 22.71 22.33 22.90 21 T_KAM_HTML_FONT_INVALID 66851 22.74 29.19 19.56 22 MIME_HTML_ONLY 65366 21.01 24.82 19.12 23 ALL_TRUSTED 60024 12.32 1.71 17.56 24 XM_B_SpammyWords2 55227 24.38 41.01 16.16 25 XM_Multi_Part_URI 54397 16.64 18.12 15.92 26 TR_XM_DK_Unsub 47747 15.93 19.91 13.97 27 USER_IN_DEF_DKIM_WL 44529 9.57 2.57 13.03 28 UNPARSEABLE_RELAY 36029 11.83 14.43 10.54 29 XM_B_PhoneNumber 35672 8.90 5.79 10.44 30 TooManyTo_001 30660 7.56 4.72 8.97 31 BAYES_60 30482 8.55 7.81 8.92 32 XM_DKIMWhitelistDomains 28412 5.67 0.34 8.31 33 XM_Evil_Numbers_Gen 28210 8.13 7.87 8.25 34 LotsOfNums_01 27151 7.63 6.98 7.94 35 XM_B_Unsub 26541 9.79 13.88 7.77 36 BAYES_00 26123 5.33 0.64 7.64 37 TR_MAX_INTL_RELAY 23650 9.13 13.61 6.92 38 IN_ZIMBRA_NJ_WHITELIST 23263 4.58 0.09 6.81 39 LOTS_OF_MONEY 22905 10.01 16.71 6.70 40 XM_H_GMP 21940 5.75 4.38 6.42 41 T_TooManySym_01 21610 5.13 2.72 6.32 42 TR_XM_BayesUnsub 21495 8.63 13.36 6.29 43 XM_DK_Undo_02 21121 19.57 46.64 6.18 44 RCVD_IN_MSPIKE_WL 21032 5.00 2.67 6.15 45 RCVD_IN_MSPIKE_H3 21032 5.00 2.67 6.15 46 BAYES_40 18551 4.11 1.45 5.43 47 TR_XM_DK_Bayes 18116 3.69 0.44 5.30 48 XM_B_SpammyTLD 18037 4.74 3.64 5.28 49 XM_H_Long_From01 17965 5.05 4.62 5.26 50 TR_XM_DK_Bayes1 17821 3.63 0.43 5.21 51 BAYES_99 17317 16.41 39.36 5.07 52 FSL_BULK_SIG 16962 5.93 7.89 4.96 53 MIME_QP_LONG_LINE 16602 4.17 2.77 4.86 54 XM_PDF 16137 3.55 1.18 4.72 55 TR_XM_SpammyWords4 15555 8.11 15.30 4.55 56 XMStrtUSub 15513 4.46 4.30 4.54 57 HTML_IMAGE_RATIO_02 15439 4.89 5.64 4.52 58 TR_XM_DK_Bayes2 15131 3.07 0.33 4.43 59 XMSubMetaSx_00 15042 4.70 5.29 4.40 60 URI_NOVOWEL 14541 3.25 1.21 4.25 61 RCVD_IN_VALIDITY_SAFE 14531 3.98 3.43 4.25 62 XM_UncommonTLD01 14327 4.46 4.99 4.19 63 BAYES_80 14299 5.58 8.40 4.18 64 RELAYCOUNTRY_META 13742 7.47 14.45 4.02 65 BAYES_999 13539 13.36 32.38 3.96 66 HTML_IMAGE_RATIO_04 13176 4.32 5.26 3.85 67 XM_B_SpammyWords3 13100 7.04 13.53 3.83 68 T_REMOTE_IMAGE 13047 3.16 1.82 3.82 69 BOUNCE_MESSAGE 13030 2.99 1.33 3.81 70 ANY_BOUNCE_MESSAGE 13030 2.99 1.33 3.81 71 RCVD_IN_IADB_LISTED 12655 2.87 1.20 3.70 72 XM_SPF_SoftFail 12584 4.06 4.82 3.68 73 BOTNET_IPINHOSTNAME 12321 6.83 13.36 3.60 74 XM_B_Phish_Phrases 12249 3.72 3.99 3.58 75 RCVD_IN_VALIDITY_CERTIFIED 11966 3.21 2.62 3.50 76 RCVD_IN_IADB_SPF 11102 2.51 1.03 3.25 77 MPART_ALT_DIFF 10868 3.68 4.70 3.18 78 TooManyTo_002 10681 2.39 0.92 3.12 79 BAYES_20 10642 2.41 0.98 3.11 80 T_TooManySym_02 10437 2.35 0.93 3.05 81 MAILING_LIST_MULTI 9973 2.57 1.86 2.92 82 HTML_IMAGE_RATIO_06 9969 3.35 4.22 2.92 83 RCVD_IN_IADB_SENDERID 9918 2.25 0.95 2.90 84 XMNumbers 9840 3.23 3.94 2.88 85 XM_Body_Dirty_Words 9635 4.09 6.67 2.82 86 RCVD_IN_IADB_DK 9621 2.20 0.95 2.81 87 BAYES_95 9340 3.42 4.81 2.73 88 TR_XM_DKIM_Undo 8380 13.12 34.68 2.45 89 RCVD_IN_IADB_VOUCHED 8371 1.87 0.70 2.45 90 DKIM_INVALID 7826 2.96 4.30 2.29 91 HTML_MIME_NO_HTML_TAG 7686 2.13 1.89 2.25 92 INVALID_MSGID 7403 1.52 0.20 2.17 93 MIME_HTML_MOSTLY 7123 2.45 3.20 2.08 94 HELO_NODOT 7081 1.51 0.36 2.07 95 HELO_NO_DOMAIN 7079 1.50 0.35 2.07 96 TO_MALFORMED 7069 1.40 0.04 2.07 97 TR_XM_SpammyRelay 7023 4.72 10.11 2.05 98 TR_DCC_Bayes_99 6726 11.04 29.39 1.97 99 HTML_IMAGE_RATIO_08 6714 2.27 2.88 1.96 100 XMSexyCombo_05 6609 2.50 3.64 1.93 101 XM_DK_Undo_01 6369 1.72 1.44 1.86 102 BAYES_05 6343 1.41 0.52 1.86 103 XM_CamelCaseFrm001 6288 2.13 2.72 1.84 104 MIME_HTML_ONLY_MULTI 6245 2.21 2.99 1.83 105 UNTRUSTED_Relay 6142 2.95 5.27 1.80 106 XMDiploma_00 6034 2.06 2.66 1.77 107 RCVD_IN_IADB_OPTIN 5931 1.31 0.45 1.74 108 XM_TLDProd2 5868 1.23 0.24 1.72 109 TR_XM_UnparsRelay 5695 3.76 7.98 1.67 110 FROM_EXCESS_BASE64 5616 1.59 1.48 1.64 111 TooManyTo_003 5593 1.35 0.78 1.64 112 XMStockSpam_06 5564 1.75 1.99 1.63 113 TM2_M_URI_OPT_OUT 5555 1.90 2.47 1.63 114 TR_Symld_Words 5527 1.41 1.00 1.62 115 TVD_RCVD_IP 5234 1.36 1.01 1.53 116 T_XMDrugObfuBody_14 5204 2.35 4.02 1.52 117 KHOP_HELO_FCRDNS 5021 1.48 1.50 1.47 118 XM_B_Investor 4991 2.42 4.36 1.46 119 T_XMDrugObfuBody_08 4927 2.16 3.62 1.44 120 IN_HORDE_ADDRESS_BOOK 4888 0.98 0.08 1.43 121 XM_SendGrid 4802 1.30 1.08 1.40 122 SUBJ_ALL_CAPS 4716 1.70 2.36 1.38 123 XM_B_Unsub2 4691 1.66 2.25 1.37 124 TR_XM_SpammyWords5 4520 2.36 4.44 1.32 125 TR_XM_PhishingBody 4501 2.12 3.74 1.32 126 T_TooManySym_03 4255 0.93 0.31 1.24 127 XM_GoogleGroups 4248 1.06 0.68 1.24 128 TooManyTo_004 4201 1.06 0.72 1.23 129 XMGappySubj_01 4126 0.87 0.20 1.21 130 TM2_M_VERY_LONG_WORD 4108 1.86 3.19 1.20 131 RELAYCOUNTRY_CA 4019 2.53 5.25 1.18 132 TVD_SPACE_RATIO 3973 0.82 0.13 1.16 133 XMCapTrack 3933 0.94 0.51 1.15 134 URI_HEX 3861 1.21 1.37 1.13 135 BOTNET 3794 3.63 8.72 1.11 136 XMBSHREFv2 3766 0.83 0.27 1.10 137 XM_H_Long_From02 3764 1.06 0.98 1.10 138 XM_B_SEO 3611 2.25 4.66 1.06 139 TooManyTo_005 3465 0.90 0.68 1.01 140 HTML_IMAGE_ONLY_32 3463 0.73 0.15 1.01 141 HTTPS_HTTP_MISMATCH 3367 1.12 1.39 0.99 142 XM_UB50 3306 1.50 2.58 0.97 143 XM_OfRef6 3207 2.03 4.25 0.94 144 TR_XM_DK_SendGrid 3170 0.85 0.70 0.93 145 XMGenDplmaNmb 3155 1.05 1.31 0.92 146 XMLngstWrd_00 3129 0.97 1.07 0.92 147 XMBrknScrpt_02 3010 1.33 2.24 0.88 148 SpammyFromTLD_01 2985 1.18 1.81 0.87 149 XM_B_FormFill 2980 0.62 0.10 0.87 150 URI_TRY_3LD 2880 1.39 2.49 0.84 151 TO_NO_BRKTS_HTML_ONLY 2861 0.64 0.24 0.84 152 TR_XM_SpammyWords2 2860 5.46 14.82 0.84 153 T_FILL_THIS_FORM_SHORT 2853 0.98 1.27 0.83 154 DKIM_ADSP_CUSTOM_MED 2849 0.89 0.99 0.83 155 XM_H_PHPMailer 2828 0.81 0.77 0.83 156 XMGappySubj_02 2811 0.58 0.08 0.82 157 T_XMHurry_00 2647 1.66 3.44 0.77 158 XMNoVowels 2619 0.67 0.47 0.77 159 XM_ShortIntro_01 2618 0.68 0.50 0.77 160 XMBdyGiftCard01 2594 0.93 1.28 0.76 161 XMSubMetaSxObfu_03 2562 0.67 0.50 0.75 162 T_OBFU_PDF_ATTACH 2504 0.64 0.45 0.73 163 RELAYCOUNTRY_AU 2478 1.22 2.21 0.72 164 TR_MetaPhish_Combo_01 2439 0.94 1.40 0.71 165 XM_RXBody 2346 0.58 0.38 0.69 166 T_TVD_MIME_NO_HEADERS 2237 0.45 0.05 0.65 167 MPART_ALT_DIFF_COUNT 2233 0.84 1.22 0.65 168 XMBody_17 2187 2.52 6.32 0.64 169 XMBody_95 2145 0.49 0.22 0.63 170 XM_B_DNDMA 2110 0.69 0.84 0.62 171 TR_LOTS_OF_MONEY3 2107 2.49 6.29 0.62 172 TR_XM_SEO4 2100 1.79 4.17 0.61 173 XM_B_SpammyWords4 2079 1.10 2.10 0.61 174 HTML_TAG_BALANCE_BODY 2062 0.90 1.49 0.60 175 T_XMDrugObfuBody_00 2033 0.89 1.48 0.59 176 USER_IN_WELCOMELIST 1977 0.39 0.00 0.58 177 USER_IN_WHITELIST 1977 0.39 0.00 0.58 178 XM_H_OutlookMailer 1970 0.42 0.09 0.58 179 NML_ADSP_CUSTOM_MED 1938 0.66 0.84 0.57 180 SHORT_HELO_AND_INLINE_IMAGE 1903 0.40 0.07 0.56 181 FROM_GOV_DKIM_AU 1874 0.43 0.20 0.55 182 RCVD_IN_BL_SPAMCOP_NET 1847 2.92 7.73 0.54 183 XM_B_COPY_HTML 1809 0.69 1.03 0.53 184 XMMoneyMeta_00 1808 0.64 0.85 0.53 185 NO_DNS_FOR_FROM 1792 0.51 0.50 0.52 186 HTML_IMAGE_ONLY_28 1741 0.51 0.52 0.51 187 TR_XM_FormFill2 1727 0.82 1.46 0.51 188 TR_XM_Base64_M1 1718 0.53 0.59 0.50 189 TR_XM_PHPForged 1706 0.84 1.52 0.50 190 TR_XM_PHPDW 1705 0.83 1.49 0.50 191 XM_H_PHPOS 1666 0.81 1.45 0.49 192 T_Symld_Words_02 1643 0.56 0.71 0.48 193 XMSubMetaI_00 1628 0.68 1.09 0.48 194 HTML_IMAGE_ONLY_20 1614 0.51 0.60 0.47 195 XMLngstWrd_01 1603 0.43 0.35 0.47 196 MISSING_HEADERS 1588 0.46 0.46 0.46 197 FORGED_GMAIL_RCVD 1584 0.55 0.74 0.46 198 TM2_M_BODY_EMPTY 1512 0.34 0.12 0.44 199 RCVD_IN_SORBS_DUL 1468 0.31 0.06 0.43 200 PLING_QUERY 1437 0.54 0.80 0.42 ----------------------------------------------------------------------