Email: 610576 Autolearn: 0 AvgScore: 3.11 AvgScanTime: 1.21 sec Spam: 194299 Autolearn: 0 AvgScore: 13.37 AvgScanTime: 1.35 sec Ham: 416277 Autolearn: 0 AvgScore: -1.68 AvgScanTime: 1.15 sec Time Spent Running SA: 205.07 hours Time Spent Processing Spam: 72.59 hours Time Spent Processing Ham: 132.47 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 188149 91.05 96.83 88.35 2 DKIM_SIGNED 172336 71.44 88.70 63.39 3 XM_B_Unicode 169630 76.87 87.30 72.00 4 XM_DK_Pass 166686 69.82 85.79 62.37 5 DKIM_VALID 164710 68.95 84.77 61.56 6 RELAYCOUNTRY_US 161932 82.50 83.34 82.10 7 DCC_CHECK 142808 45.34 73.50 32.20 8 XMListUnsubscribeExists 139834 52.05 71.97 42.75 9 XM_B_SpammyWords 137291 51.56 70.66 42.64 10 DKIM_VALID_AU 134917 56.11 69.44 49.89 11 XM_B_Unicode3 91411 44.77 47.05 43.70 12 XM_DK_Undo_02 90384 18.37 46.52 5.22 13 BAYES_99 81636 17.08 42.02 5.44 14 XM_B_SpammyWords2 79350 24.40 40.84 16.73 15 RCVD_IN_MSPIKE_H2 78064 31.36 40.18 27.24 16 LOC_TINY_FONT_1 77621 26.83 39.95 20.71 17 HTML_FONT_LOW_CONTRAST 75807 32.39 39.02 29.29 18 FVGT_m_MULTI_ODD 74068 27.85 38.12 23.05 19 TR_XM_DKIM_Undo 68458 12.77 35.23 2.29 20 BAYES_999 67414 14.00 34.70 4.34 21 BAYES_50 66565 50.76 34.26 58.47 22 T_KAM_HTML_FONT_INVALID 57871 21.17 29.78 17.15 23 DKIM_VALID_EF 55305 25.29 28.46 23.81 24 TR_DCC_Bayes_99 54656 10.13 28.13 1.72 25 MIME_HTML_ONLY 52087 23.83 26.81 22.44 26 DCC_CHECK_NEGATIVE 51471 54.62 26.49 67.76 27 T_TM2_M_HEADER_IN_MSG 44369 27.01 22.84 28.95 28 XMSubLong 42172 21.61 21.70 21.57 29 TR_XM_DK_Unsub 40521 14.22 20.85 11.13 30 XM_Multi_Part_URI 36039 15.39 18.55 13.92 31 LOTS_OF_MONEY 33324 9.15 17.15 5.42 32 TR_XM_SpammyWords4 30286 7.58 15.59 3.84 33 TR_XM_SpammyWords2 29494 5.46 15.18 0.92 34 UNPARSEABLE_RELAY 27328 10.62 14.06 9.01 35 XM_B_Unsub 26629 8.81 13.71 6.53 36 TR_MAX_INTL_RELAY 26326 8.60 13.55 6.29 37 TR_XM_BayesUnsub 25778 7.82 13.27 5.28 38 BOTNET_IPINHOSTNAME 25348 6.42 13.05 3.32 39 XM_B_SpammyWords3 24506 6.79 12.61 4.07 40 RELAYCOUNTRY_META 23843 6.23 12.27 3.41 41 TR_XM_SpammyRelay 17191 4.12 8.85 1.91 42 BOTNET 16498 3.51 8.49 1.18 43 XM_Evil_Numbers_Gen 16186 9.07 8.33 9.42 44 BAYES_80 15780 5.21 8.12 3.86 45 RCVD_IN_BL_SPAMCOP_NET 15780 2.94 8.12 0.53 46 TR_XM_UnparsRelay 14805 3.38 7.62 1.40 47 XM_UncommonTLD01 14716 4.83 7.57 3.54 48 FSL_BULK_SIG 14295 5.52 7.36 4.67 49 BAYES_60 13708 7.72 7.06 8.03 50 XM_Body_Dirty_Words 13612 3.66 7.01 2.10 51 LotsOfNums_01 12946 7.39 6.66 7.72 52 TR_XM_SPAMCOP 12561 2.25 6.46 0.28 53 XM_SPF_SoftFail 11941 3.83 6.15 2.75 54 XMBody_17 11626 2.28 5.98 0.55 55 XMSubMetaSx_00 11624 3.93 5.98 2.97 56 ALL_TRUSTED 11328 12.02 5.83 14.90 57 HTML_IMAGE_RATIO_02 10839 4.70 5.58 4.29 58 MPART_ALT_DIFF 10820 7.15 5.57 7.89 59 XM_OfRef6 10772 2.48 5.54 1.06 60 TR_LOTS_OF_MONEY3 10711 2.15 5.51 0.58 61 XM_B_PhoneNumber 10676 7.46 5.49 8.38 62 HTML_IMAGE_RATIO_04 10590 9.99 5.45 12.11 63 UNTRUSTED_Relay 10313 2.79 5.31 1.62 64 BAYES_95 9779 3.25 5.03 2.42 65 XM_B_Investor 9208 2.35 4.74 1.24 66 TooManyTo_001 9088 6.63 4.68 7.54 67 XM_H_Long_From01 9018 5.24 4.64 5.52 68 XM_B_SEO 8992 2.35 4.63 1.29 69 XMNumbers 8834 3.23 4.55 2.62 70 TR_XM_SpammyWords5 8582 2.56 4.42 1.70 71 XM_B_Phish_Phrases 8575 3.67 4.41 3.33 72 TR_XM_SEO4 8008 1.90 4.12 0.86 73 TR_XM_PhishingBody 7973 2.40 4.10 1.61 74 RELAYCOUNTRY_CA 7845 1.97 4.04 1.00 75 XMSexyCombo_05 7829 2.09 4.03 1.18 76 RCVD_IN_VALIDITY_RPBL 7783 1.42 4.01 0.21 77 XMStrtUSub 7672 7.66 3.95 9.39 78 DKIM_INVALID 7626 2.50 3.92 1.83 79 MIME_HTML_MOSTLY 7611 2.56 3.92 1.93 80 HTML_IMAGE_RATIO_06 7594 4.54 3.91 4.84 81 XM_H_GMP 7471 4.61 3.85 4.97 82 RCVD_IN_VALIDITY_SAFE 7102 4.44 3.66 4.80 83 XM_B_SpammyTLD 6552 3.55 3.37 3.63 84 TM2_M_VERY_LONG_WORD 6533 4.29 3.36 4.72 85 T_XMDrugObfuBody_14 6480 2.06 3.34 1.47 86 HTML_IMAGE_RATIO_08 6419 2.38 3.30 1.95 87 FROM_MISSP_EH_MATCH 6269 1.04 3.23 0.01 88 TO_NO_BRKTS_FROM_MSSP 6212 1.03 3.20 0.02 89 MIME_HTML_ONLY_MULTI 6019 5.41 3.10 6.49 90 MIME_QP_LONG_LINE 5873 3.87 3.02 4.27 91 XM_BadFromFormat 5867 1.14 3.02 0.26 92 XMBody_95 5710 1.48 2.94 0.80 93 RCVD_IN_VALIDITY_CERTIFIED 5397 3.34 2.78 3.61 94 T_TooManySym_01 5343 3.81 2.75 4.30 95 XM_CamelCaseFrm001 5342 2.12 2.75 1.83 96 SUBJ_ALL_CAPS 5333 2.14 2.74 1.85 97 XMDiploma_00 5329 1.85 2.74 1.44 98 XM_UB50 5255 1.42 2.70 0.82 99 T_XMDrugObfuBody_08 5201 1.80 2.68 1.39 100 USER_IN_DEF_DKIM_WL 5145 8.99 2.65 11.96 101 RCVD_IN_MSPIKE_H3 5137 4.01 2.64 4.65 102 RCVD_IN_MSPIKE_WL 5137 4.01 2.64 4.65 103 XM_URI_RBL 5103 0.97 2.63 0.20 104 URI_TRY_3LD 5071 1.28 2.61 0.66 105 XMBrknScrpt_02 4843 1.31 2.49 0.76 106 T_XMHurry_00 4556 1.15 2.34 0.60 107 TM2_M_URI_OPT_OUT 4516 1.63 2.32 1.30 108 XM_B_Unsub2 4211 1.43 2.17 1.08 109 XMSubNoVowel 4145 3.32 2.13 3.87 110 XM_B_SpammyWords4 3991 1.03 2.05 0.55 111 RELAYCOUNTRY_AU 3977 1.09 2.05 0.65 112 T_REMOTE_IMAGE 3787 2.75 1.95 3.13 113 HTML_TAG_BALANCE_BODY 3756 0.97 1.93 0.52 114 MAILING_LIST_MULTI 3750 2.12 1.93 2.22 115 XMSubGarbage 3602 1.87 1.85 1.88 116 AC_BR_BONANZA 3522 0.66 1.81 0.12 117 XMStockSpam_06 3378 1.36 1.74 1.18 118 SpammyFromTLD_01 3274 1.01 1.69 0.70 119 XM_DK_Undo_01 3252 1.56 1.67 1.50 120 URI_HEX 3226 1.05 1.66 0.76 121 SpammyFromTLD_02 3052 0.73 1.57 0.34 122 HTML_MIME_NO_HTML_TAG 2945 1.84 1.52 1.99 123 TR_Caps_n_Bayes_99 2848 0.48 1.47 0.02 124 T_XMDrugObfuBody_00 2742 0.94 1.41 0.72 125 T_FILL_THIS_FORM_SHORT 2731 0.97 1.41 0.77 126 TR_Symld_Words 2694 1.34 1.39 1.32 127 TR_XM_NoHeaderRelay 2685 0.50 1.38 0.09 128 T_MONEY_PERCENT 2641 0.64 1.36 0.31 129 TR_LOTS_OF_MONEY2 2641 0.64 1.36 0.31 130 TR_XM_INV_DKIM 2614 0.47 1.35 0.07 131 FROM_EXCESS_BASE64 2598 1.52 1.34 1.60 132 URIBL_DBL_SPAM 2557 0.42 1.32 0.01 133 BAYES_40 2531 3.80 1.30 4.97 134 XM_OfRef7 2519 0.55 1.30 0.20 135 XMGenDplmaNmb 2516 0.92 1.29 0.74 136 XM_B_Phish66 2508 0.60 1.29 0.28 137 LONGLN_LOW_CONTRAST 2360 0.53 1.21 0.21 138 URI_NOVOWEL 2343 2.30 1.21 2.81 139 TR_XM_PHPForged 2343 0.56 1.21 0.25 140 TR_XM_PHPDW 2333 0.55 1.20 0.25 141 XM_SendGrid 2306 1.27 1.19 1.31 142 TR_XM_FormFill2 2288 0.56 1.18 0.27 143 KHOP_HELO_FCRDNS 2267 2.47 1.17 3.07 144 XM_H_PHPOS 2265 0.54 1.17 0.25 145 HOSTED_IMG_MULTI_PUB_01 2264 0.38 1.17 0.01 146 RCVD_IN_IADB_LISTED 2228 2.44 1.15 3.04 147 HTTPS_HTTP_MISMATCH 2215 0.88 1.14 0.76 148 XM_B_COPY_HTML 2195 0.80 1.13 0.64 149 XM_H_Undi_Recip 2172 0.44 1.12 0.12 150 XMPhish14 2154 0.71 1.11 0.53 151 XM_ProductURIs 2147 1.13 1.10 1.14 152 TR_XM_InvalidRelay 2113 0.36 1.09 0.02 153 XM_HighProb1 2078 0.35 1.07 0.01 154 FILL_THIS_FORM 1983 0.53 1.02 0.29 155 PLING_QUERY 1975 0.65 1.02 0.47 156 XMHTML_After_End 1960 0.50 1.01 0.26 157 RCVD_IN_IADB_SPF 1937 2.15 1.00 2.69 158 XMReplyNow 1935 0.44 1.00 0.18 159 XM_DIRTYINTL 1925 0.41 0.99 0.13 160 BAYES_20 1893 2.43 0.97 3.11 161 XMPhish30 1892 0.67 0.97 0.53 162 TR_Mismatch_TLD_02 1801 0.33 0.93 0.06 163 RCVD_IN_IADB_DK 1795 1.90 0.92 2.36 164 TR_XM_Undi_RecipCombo2 1782 0.29 0.92 0.00 165 RCVD_IN_IADB_SENDERID 1779 1.95 0.92 2.43 166 HTML_FONT_TINY_NORDNS 1761 0.35 0.91 0.09 167 XM_H_Long_From02 1749 0.86 0.90 0.84 168 XMSubMetaI_00 1744 0.67 0.90 0.57 169 DKIM_ADSP_CUSTOM_MED 1743 0.75 0.90 0.69 170 XMSexyCombo_01 1741 0.40 0.90 0.16 171 XMClaimOffer 1727 0.49 0.89 0.30 172 TooManyTo_002 1722 1.96 0.89 2.46 173 BOTNET_NORDNS 1709 0.28 0.88 0.00 174 RDNS_DYNAMIC 1678 0.51 0.86 0.35 175 TVD_RCVD_IP 1647 1.13 0.85 1.27 176 PDS_RDNS_DYNAMIC_FP 1645 0.42 0.85 0.22 177 RCVD_IN_PSBL 1635 0.39 0.84 0.18 178 MONEY_FORM 1616 0.27 0.83 0.01 179 TR_Mismatch_TLD_01 1605 0.37 0.83 0.16 180 DKIM_ADSP_NXDOMAIN 1588 0.44 0.82 0.26 181 ANY_BOUNCE_MESSAGE 1587 4.64 0.82 6.42 182 BOUNCE_MESSAGE 1587 4.64 0.82 6.42 183 XMBdyGiftCard01 1548 0.98 0.80 1.07 184 TR_XM_Undi_Recip19 1516 0.28 0.78 0.05 185 TR_XM_FormFill 1510 0.26 0.78 0.01 186 XM_B_DNDMA 1499 0.68 0.77 0.64 187 NML_ADSP_CUSTOM_MED 1498 0.57 0.77 0.48 188 XMSlimDrugH 1495 0.49 0.77 0.36 189 XM_PDF 1493 3.08 0.77 4.16 190 TR_XM_Undi_Recip11 1493 0.27 0.77 0.03 191 MPART_ALT_DIFF_COUNT 1462 0.50 0.75 0.38 192 LOADSA_MONEY_COMBO 1456 0.28 0.75 0.06 193 XM_UB99 1453 0.24 0.75 0.01 194 LongTLD 1453 0.46 0.75 0.32 195 TooManyTo_003 1450 1.14 0.75 1.32 196 TR_MetaPhish_Combo_01 1442 0.74 0.74 0.74 197 UNDISC_MONEY 1437 0.24 0.74 0.00 198 TM2_M_OBFU_COMMENT 1432 0.44 0.74 0.30 199 RELAYCOUNTRY_FR 1432 0.37 0.74 0.20 200 XMBody_78 1429 0.36 0.74 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 367795 91.05 96.83 88.35 2 RELAYCOUNTRY_US 341770 82.50 83.34 82.10 3 XM_B_Unicode 299706 76.87 87.30 72.00 4 DCC_CHECK_NEGATIVE 282051 54.62 26.49 67.76 5 DKIM_SIGNED 263876 71.44 88.70 63.39 6 XM_DK_Pass 259645 69.82 85.79 62.37 7 DKIM_VALID 256254 68.95 84.77 61.56 8 BAYES_50 243380 50.76 34.26 58.47 9 DKIM_VALID_AU 207676 56.11 69.44 49.89 10 XM_B_Unicode3 181915 44.77 47.05 43.70 11 XMListUnsubscribeExists 177946 52.05 71.97 42.75 12 XM_B_SpammyWords 177501 51.56 70.66 42.64 13 DCC_CHECK 134052 45.34 73.50 32.20 14 HTML_FONT_LOW_CONTRAST 121939 32.39 39.02 29.29 15 T_TM2_M_HEADER_IN_MSG 120518 27.01 22.84 28.95 16 RCVD_IN_MSPIKE_H2 113387 31.36 40.18 27.24 17 DKIM_VALID_EF 99123 25.29 28.46 23.81 18 FVGT_m_MULTI_ODD 95965 27.85 38.12 23.05 19 MIME_HTML_ONLY 93432 23.83 26.81 22.44 20 XMSubLong 89790 21.61 21.70 21.57 21 LOC_TINY_FONT_1 86219 26.83 39.95 20.71 22 T_KAM_HTML_FONT_INVALID 71387 21.17 29.78 17.15 23 XM_B_SpammyWords2 69661 24.40 40.84 16.73 24 ALL_TRUSTED 62039 12.02 5.83 14.90 25 XM_Multi_Part_URI 57952 15.39 18.55 13.92 26 HTML_IMAGE_RATIO_04 50391 9.99 5.45 12.11 27 USER_IN_DEF_DKIM_WL 49772 8.99 2.65 11.96 28 HTML_FONT_FACE_BAD 47584 8.00 0.65 11.43 29 BAYES_00 46393 7.82 0.69 11.14 30 TR_XM_DK_Unsub 46328 14.22 20.85 11.13 31 XM_H_Trusted_IP 44642 7.31 0.00 10.72 32 XM_Evil_Numbers_Gen 39216 9.07 8.33 9.42 33 XMStrtUSub 39074 7.66 3.95 9.39 34 UNPARSEABLE_RELAY 37501 10.62 14.06 9.01 35 XM_B_PhoneNumber 34873 7.46 5.49 8.38 36 BAYES_60 33424 7.72 7.06 8.03 37 MPART_ALT_DIFF 32843 7.15 5.57 7.89 38 LotsOfNums_01 32149 7.39 6.66 7.72 39 TooManyTo_001 31388 6.63 4.68 7.54 40 XM_DKIMWhitelistDomains 27219 4.47 0.03 6.54 41 XM_B_Unsub 27169 8.81 13.71 6.53 42 MIME_HTML_ONLY_MULTI 27012 5.41 3.10 6.49 43 ANY_BOUNCE_MESSAGE 26723 4.64 0.82 6.42 44 BOUNCE_MESSAGE 26722 4.64 0.82 6.42 45 TR_MAX_INTL_RELAY 26166 8.60 13.55 6.29 46 IN_ZIMBRA_NJ_WHITELIST 25343 4.18 0.09 6.09 47 XM_H_Long_From01 22967 5.24 4.64 5.52 48 BAYES_99 22630 17.08 42.02 5.44 49 LOTS_OF_MONEY 22572 9.15 17.15 5.42 50 TR_XM_BayesUnsub 21976 7.82 13.27 5.28 51 XM_DK_Undo_02 21749 18.37 46.52 5.22 52 BAYES_40 20674 3.80 1.30 4.97 53 XM_H_GMP 20672 4.61 3.85 4.97 54 TR_XM_DK_Bayes 20474 3.52 0.51 4.92 55 TR_XM_DK_Bayes1 20198 3.47 0.50 4.85 56 HTML_IMAGE_RATIO_06 20146 4.54 3.91 4.84 57 RCVD_IN_VALIDITY_SAFE 19978 4.44 3.66 4.80 58 TM2_M_VERY_LONG_WORD 19632 4.29 3.36 4.72 59 FSL_BULK_SIG 19424 5.52 7.36 4.67 60 RCVD_IN_MSPIKE_WL 19368 4.01 2.64 4.65 61 RCVD_IN_MSPIKE_H3 19366 4.01 2.64 4.65 62 BAYES_999 18068 14.00 34.70 4.34 63 T_TooManySym_01 17906 3.81 2.75 4.30 64 HTML_IMAGE_RATIO_02 17848 4.70 5.58 4.29 65 MIME_QP_LONG_LINE 17785 3.87 3.02 4.27 66 XM_PDF 17324 3.08 0.77 4.16 67 TR_XM_DK_Bayes2 16993 2.90 0.37 4.08 68 XM_B_SpammyWords3 16931 6.79 12.61 4.07 69 XMSubNoVowel 16112 3.32 2.13 3.87 70 BAYES_80 16052 5.21 8.12 3.86 71 TR_XM_SpammyWords4 15992 7.58 15.59 3.84 72 XM_B_SpammyTLD 15103 3.55 3.37 3.63 73 RCVD_IN_VALIDITY_CERTIFIED 15024 3.34 2.78 3.61 74 XM_UncommonTLD01 14757 4.83 7.57 3.54 75 RELAYCOUNTRY_META 14188 6.23 12.27 3.41 76 XM_B_Phish_Phrases 13849 3.67 4.41 3.33 77 BOTNET_IPINHOSTNAME 13833 6.42 13.05 3.32 78 T_REMOTE_IMAGE 13013 2.75 1.95 3.13 79 BAYES_20 12930 2.43 0.97 3.11 80 KHOP_HELO_FCRDNS 12791 2.47 1.17 3.07 81 RCVD_IN_IADB_LISTED 12644 2.44 1.15 3.04 82 XMSubMetaSx_00 12367 3.93 5.98 2.97 83 HTML_IMAGE_ONLY_32 11882 2.00 0.18 2.85 84 URI_NOVOWEL 11677 2.30 1.21 2.81 85 XM_SPF_SoftFail 11442 3.83 6.15 2.75 86 RCVD_IN_IADB_SPF 11190 2.15 1.00 2.69 87 XMNumbers 10903 3.23 4.55 2.62 88 BAYES_05 10703 1.93 0.55 2.57 89 TooManyTo_002 10226 1.96 0.89 2.46 90 RCVD_IN_IADB_SENDERID 10115 1.95 0.92 2.43 91 BAYES_95 10089 3.25 5.03 2.42 92 RCVD_IN_IADB_DK 9829 1.90 0.92 2.36 93 TR_XM_DKIM_Undo 9539 12.77 35.23 2.29 94 MAILING_LIST_MULTI 9223 2.12 1.93 2.22 95 T_TooManySym_02 9050 1.69 0.65 2.17 96 XM_Body_Dirty_Words 8744 3.66 7.01 2.10 97 HTML_MIME_NO_HTML_TAG 8270 1.84 1.52 1.99 98 RCVD_IN_IADB_VOUCHED 8196 1.54 0.62 1.97 99 HTML_IMAGE_RATIO_08 8124 2.38 3.30 1.95 100 MIME_CHARSET_FARAWAY 8102 1.54 0.65 1.95 101 MIME_HTML_MOSTLY 8043 2.56 3.92 1.93 102 XMSubLongNoVowel 8008 1.33 0.07 1.92 103 TR_XM_SpammyRelay 7967 4.12 8.85 1.91 104 XMSubGarbage 7821 1.87 1.85 1.88 105 SUBJ_ALL_CAPS 7718 2.14 2.74 1.85 106 DKIM_INVALID 7622 2.50 3.92 1.83 107 XM_CamelCaseFrm001 7611 2.12 2.75 1.83 108 INVALID_MSGID 7283 1.25 0.17 1.75 109 TR_DCC_Bayes_99 7177 10.13 28.13 1.72 110 TO_MALFORMED 7114 1.18 0.04 1.71 111 CHARSET_FARAWAY_HEADER 7068 1.18 0.06 1.70 112 TR_XM_SpammyWords5 7068 2.56 4.42 1.70 113 UNTRUSTED_Relay 6723 2.79 5.31 1.62 114 TR_XM_PhishingBody 6698 2.40 4.10 1.61 115 FROM_EXCESS_BASE64 6664 1.52 1.34 1.60 116 HELO_NODOT 6469 1.17 0.35 1.55 117 HELO_NO_DOMAIN 6460 1.16 0.33 1.55 118 XM_DK_Undo_01 6249 1.56 1.67 1.50 119 T_XMDrugObfuBody_14 6109 2.06 3.34 1.47 120 XMDiploma_00 5995 1.85 2.74 1.44 121 HTML_FONT_SIZE_HUGE 5985 1.06 0.25 1.44 122 TR_XM_UnparsRelay 5814 3.38 7.62 1.40 123 T_XMDrugObfuBody_08 5791 1.80 2.68 1.39 124 RCVD_IN_IADB_OPTIN 5612 1.05 0.40 1.35 125 TooManyTo_003 5502 1.14 0.75 1.32 126 TR_Symld_Words 5476 1.34 1.39 1.32 127 XM_SendGrid 5442 1.27 1.19 1.31 128 TM2_M_URI_OPT_OUT 5431 1.63 2.32 1.30 129 XM_B_SEO 5384 2.35 4.63 1.29 130 TVD_RCVD_IP 5283 1.13 0.85 1.27 131 XM_B_Investor 5161 2.35 4.74 1.24 132 IN_HORDE_ADDRESS_BOOK 5020 0.84 0.06 1.21 133 XMStockSpam_06 4927 1.36 1.74 1.18 134 XMSexyCombo_05 4912 2.09 4.03 1.18 135 BOTNET 4908 3.51 8.49 1.18 136 XMLngstWrd_00 4844 0.90 0.35 1.16 137 XM_ProductURIs 4755 1.13 1.10 1.14 138 XM_B_Unsub2 4494 1.43 2.17 1.08 139 XMBdyGiftCard01 4438 0.98 0.80 1.07 140 XMGappySubj_01 4403 0.75 0.10 1.06 141 XM_OfRef6 4394 2.48 5.54 1.06 142 XM_TLDProd2 4336 0.82 0.33 1.04 143 RELAYCOUNTRY_CA 4153 1.97 4.04 1.00 144 TooManyTo_004 3895 0.85 0.68 0.94 145 XM_GoogleGroups 3848 0.80 0.53 0.92 146 TR_XM_SpammyWords2 3831 5.46 15.18 0.92 147 XMCapTrack 3797 0.75 0.40 0.91 148 TVD_SPACE_RATIO 3606 0.64 0.15 0.87 149 TR_XM_SEO4 3594 1.90 4.12 0.86 150 XMBSHREFv2 3555 0.65 0.22 0.85 151 XM_H_Long_From02 3506 0.86 0.90 0.84 152 XM_E_Blogspot 3436 0.58 0.04 0.83 153 XM_UB50 3405 1.42 2.70 0.82 154 T_TooManySym_03 3334 0.60 0.18 0.80 155 XMBody_95 3312 1.48 2.94 0.80 156 TR_XM_DK_SendGrid 3286 0.75 0.67 0.79 157 XM_ShortIntro_01 3269 0.73 0.61 0.79 158 T_OBFU_PDF_ATTACH 3210 0.57 0.15 0.77 159 T_FILL_THIS_FORM_SHORT 3187 0.97 1.41 0.77 160 XMBrknScrpt_02 3184 1.31 2.49 0.76 161 URI_HEX 3175 1.05 1.66 0.76 162 HTTPS_HTTP_MISMATCH 3147 0.88 1.14 0.76 163 XMGenDplmaNmb 3076 0.92 1.29 0.74 164 TR_MetaPhish_Combo_01 3070 0.74 0.74 0.74 165 TooManyTo_005 3033 0.70 0.63 0.73 166 T_XMDrugObfuBody_00 2983 0.94 1.41 0.72 167 SpammyFromTLD_01 2923 1.01 1.69 0.70 168 DKIM_ADSP_CUSTOM_MED 2858 0.75 0.90 0.69 169 URI_TRY_3LD 2741 1.28 2.61 0.66 170 RELAYCOUNTRY_AU 2708 1.09 2.05 0.65 171 FROM_GOV_DKIM_AU 2696 0.60 0.49 0.65 172 XM_B_COPY_HTML 2673 0.80 1.13 0.64 173 XM_B_DNDMA 2657 0.68 0.77 0.64 174 XM_RXBody 2641 0.56 0.39 0.63 175 XMGappySubj_02 2534 0.43 0.04 0.61 176 T_XMHurry_00 2479 1.15 2.34 0.60 177 XMNoVowels 2435 0.54 0.44 0.58 178 TR_LOTS_OF_MONEY3 2414 2.15 5.51 0.58 179 XMSubMetaI_00 2368 0.67 0.90 0.57 180 XM_B_SpammyWords4 2291 1.03 2.05 0.55 181 XMBody_17 2290 2.28 5.98 0.55 182 TR_XM_Base64_M1 2216 0.54 0.56 0.53 183 XMPhish14 2207 0.71 1.11 0.53 184 XM_H_PHPMailer 2205 0.55 0.60 0.53 185 XMPhish30 2191 0.67 0.97 0.53 186 RCVD_IN_BL_SPAMCOP_NET 2188 2.94 8.12 0.53 187 HTML_TAG_BALANCE_BODY 2176 0.97 1.93 0.52 188 XM_B_FormFill 2136 0.38 0.10 0.51 189 SHORT_HELO_AND_INLINE_IMAGE 2010 0.35 0.05 0.48 190 NML_ADSP_CUSTOM_MED 2003 0.57 0.77 0.48 191 USER_IN_WHITELIST 1976 0.32 0.00 0.47 192 USER_IN_WELCOMELIST 1976 0.32 0.00 0.47 193 PLING_QUERY 1974 0.65 1.02 0.47 194 TO_NO_BRKTS_HTML_ONLY 1930 0.39 0.23 0.46 195 NO_DNS_FOR_FROM 1788 0.44 0.47 0.43 196 XMMoneyMeta_00 1738 0.52 0.73 0.42 197 FORGED_GMAIL_RCVD 1704 0.49 0.65 0.41 198 XM_H_OutlookMailer 1670 0.29 0.06 0.40 199 T_Symld_Words_02 1639 0.47 0.63 0.39 200 HTML_IMAGE_ONLY_20 1616 0.48 0.68 0.39 ----------------------------------------------------------------------