Email: 607717 Autolearn: 0 AvgScore: 2.84 AvgScanTime: 1.26 sec Spam: 183626 Autolearn: 0 AvgScore: 13.16 AvgScanTime: 1.46 sec Ham: 424091 Autolearn: 0 AvgScore: -1.63 AvgScanTime: 1.17 sec Time Spent Running SA: 212.01 hours Time Spent Processing Spam: 74.53 hours Time Spent Processing Ham: 137.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 178190 91.38 97.04 88.93 2 DKIM_SIGNED 171425 72.39 93.36 63.31 3 XM_DK_Pass 165195 70.47 89.96 62.02 4 DKIM_VALID 162320 69.35 88.40 61.11 5 RELAYCOUNTRY_US 160562 80.71 87.44 77.80 6 XM_B_Unicode 159460 77.56 86.84 73.54 7 DCC_CHECK 141916 46.18 77.29 32.71 8 XMListUnsubscribeExists 139357 51.98 75.89 41.63 9 XM_B_SpammyWords 138280 51.44 75.31 41.11 10 DKIM_VALID_AU 132711 56.32 72.27 49.41 11 XM_DK_Undo_02 87289 17.36 47.54 4.29 12 XM_B_Unicode3 82038 45.65 44.68 46.07 13 XM_B_SpammyWords2 80344 23.84 43.75 15.21 14 LOC_TINY_FONT_1 77817 27.89 42.38 21.62 15 HTML_FONT_LOW_CONTRAST 77051 29.28 41.96 23.79 16 RCVD_IN_MSPIKE_H2 72313 29.87 39.38 25.75 17 BAYES_99 71561 14.04 38.97 3.24 18 TR_XM_DKIM_Undo 67860 12.47 36.96 1.87 19 BAYES_50 67298 53.42 36.65 60.68 20 FVGT_m_MULTI_ODD 66950 25.85 36.46 21.25 21 BAYES_999 57999 11.29 31.59 2.50 22 T_KAM_HTML_FONT_INVALID 55766 21.48 30.37 17.63 23 TR_DCC_Bayes_99 54346 9.82 29.60 1.26 24 DKIM_VALID_EF 53132 25.50 28.93 24.02 25 MIME_HTML_ONLY 44731 27.24 24.36 28.49 26 T_TM2_M_HEADER_IN_MSG 42468 23.77 23.13 24.04 27 DCC_CHECK_NEGATIVE 41690 53.79 22.70 67.25 28 XMSubLong 41127 25.21 22.40 26.42 29 TR_XM_DK_Unsub 39166 14.05 21.33 10.90 30 XM_Multi_Part_URI 36522 14.28 19.89 11.85 31 LOTS_OF_MONEY 34325 9.73 18.69 5.85 32 TR_XM_SpammyWords4 31521 8.07 17.17 4.14 33 TR_XM_SpammyWords2 30178 5.37 16.43 0.58 34 UNPARSEABLE_RELAY 26337 10.42 14.34 8.73 35 XM_B_SpammyWords3 26298 6.90 14.32 3.69 36 XM_B_Unsub 26279 13.06 14.31 12.52 37 TR_MAX_INTL_RELAY 25805 8.04 14.05 5.44 38 TR_XM_BayesUnsub 25328 12.00 13.79 11.23 39 RELAYCOUNTRY_META 23953 6.36 13.04 3.46 40 BOTNET_IPINHOSTNAME 22584 5.37 12.30 2.37 41 TR_XM_SpammyRelay 17363 4.22 9.46 1.96 42 XM_Evil_Numbers_Gen 15981 8.46 8.70 8.36 43 TR_XM_UnparsRelay 15788 3.53 8.60 1.34 44 BAYES_80 15593 4.88 8.49 3.32 45 RCVD_IN_BL_SPAMCOP_NET 15325 2.93 8.35 0.59 46 LotsOfNums_01 14783 7.23 8.05 6.87 47 BOTNET 13870 2.94 7.55 0.94 48 FSL_BULK_SIG 13615 6.25 7.41 5.75 49 BAYES_60 12915 7.29 7.03 7.40 50 TR_LOTS_OF_MONEY3 12666 2.65 6.90 0.81 51 TR_XM_SPAMCOP 12156 2.19 6.62 0.27 52 HTML_IMAGE_RATIO_02 11856 4.93 6.46 4.27 53 XMBody_17 11561 2.31 6.30 0.58 54 XM_Body_Dirty_Words 11513 3.71 6.27 2.60 55 MPART_ALT_DIFF 10785 7.47 5.87 8.16 56 HTML_IMAGE_RATIO_04 10398 10.55 5.66 12.67 57 XMSubMetaSx_00 10254 3.44 5.58 2.52 58 XM_B_PhoneNumber 9640 7.02 5.25 7.78 59 BAYES_95 9611 3.06 5.23 2.12 60 XM_H_Long_From01 9358 4.56 5.10 4.33 61 XM_B_Investor 9248 2.43 5.04 1.30 62 UNTRUSTED_Relay 9111 2.40 4.96 1.29 63 DKIM_INVALID 9105 3.04 4.96 2.20 64 XM_SPF_SoftFail 9059 3.08 4.93 2.28 65 XM_B_SEO 9040 2.21 4.92 1.04 66 RELAYCOUNTRY_CA 8698 2.14 4.74 1.02 67 XM_B_Phish_Phrases 8682 3.36 4.73 2.77 68 XM_UncommonTLD01 8367 3.63 4.56 3.23 69 TR_XM_SEO4 8188 1.80 4.46 0.64 70 TR_XM_SpammyWords5 7975 2.19 4.34 1.25 71 TooManyTo_001 7921 10.56 4.31 13.26 72 T_XMDrugObfuBody_08 7803 2.16 4.25 1.26 73 XM_H_GMP 7424 4.39 4.04 4.53 74 T_XMDrugObfuBody_14 7408 2.50 4.03 1.83 75 XM_OfRef6 7380 1.87 4.02 0.94 76 RCVD_IN_VALIDITY_SAFE 7365 4.10 4.01 4.14 77 XMSexyCombo_05 7267 2.15 3.96 1.37 78 MIME_HTML_MOSTLY 7208 2.72 3.93 2.19 79 TR_XM_PhishingBody 7113 2.29 3.87 1.61 80 HTML_IMAGE_RATIO_06 6938 3.82 3.78 3.84 81 XMStrtUSub 6736 8.39 3.67 10.43 82 XMNumbers 6629 2.90 3.61 2.59 83 MIME_HTML_ONLY_MULTI 6533 5.72 3.56 6.66 84 HTML_IMAGE_RATIO_08 6381 2.49 3.47 2.07 85 USER_IN_DEF_DKIM_WL 6318 8.88 3.44 11.24 86 MIME_QP_LONG_LINE 6140 3.90 3.34 4.14 87 XMBrknScrpt_02 6084 1.59 3.31 0.84 88 TM2_M_VERY_LONG_WORD 5996 1.69 3.27 1.01 89 XM_B_SpammyTLD 5952 3.16 3.24 3.13 90 RCVD_IN_VALIDITY_CERTIFIED 5788 3.35 3.15 3.43 91 RCVD_IN_MSPIKE_H3 5690 4.02 3.10 4.42 92 RCVD_IN_MSPIKE_WL 5690 4.02 3.10 4.42 93 URI_TRY_3LD 5571 1.42 3.03 0.73 94 XM_CamelCaseFrm001 5487 2.37 2.99 2.11 95 TM2_M_URI_OPT_OUT 5297 1.86 2.88 1.41 96 XMDiploma_00 5263 6.39 2.87 7.92 97 XM_URI_RBL 5237 1.05 2.85 0.27 98 XM_UB50 4816 1.34 2.62 0.78 99 RCVD_IN_VALIDITY_RPBL 4762 0.87 2.59 0.12 100 T_TooManySym_01 4634 3.80 2.52 4.35 101 SUBJ_ALL_CAPS 4580 1.64 2.49 1.27 102 RELAYCOUNTRY_AU 4001 1.14 2.18 0.69 103 T_XMHurry_00 3924 0.94 2.14 0.42 104 T_REMOTE_IMAGE 3917 3.05 2.13 3.45 105 LONGLN_LOW_CONTRAST 3854 0.80 2.10 0.24 106 XM_B_SpammyWords4 3831 0.99 2.09 0.51 107 XM_B_Unsub2 3811 1.44 2.08 1.16 108 MAILING_LIST_MULTI 3444 2.26 1.88 2.42 109 HTML_TAG_BALANCE_BODY 3388 0.86 1.85 0.44 110 FROM_EXCESS_BASE64 3195 1.75 1.74 1.76 111 HTML_MIME_NO_HTML_TAG 2866 1.71 1.56 1.78 112 XM_DK_Undo_01 2863 1.59 1.56 1.60 113 XMStockSpam_06 2824 1.29 1.54 1.18 114 URI_HEX 2804 1.09 1.53 0.90 115 TR_XM_NoHeaderRelay 2780 0.54 1.51 0.12 116 AC_BR_BONANZA 2775 0.53 1.51 0.11 117 SpammyFromTLD_02 2755 0.64 1.50 0.27 118 RCVD_IN_IADB_LISTED 2725 2.50 1.48 2.94 119 T_XMDrugObfuBody_00 2713 0.81 1.48 0.52 120 T_MONEY_PERCENT 2698 0.61 1.47 0.23 121 TR_LOTS_OF_MONEY2 2698 0.61 1.47 0.23 122 BAYES_40 2612 3.97 1.42 5.07 123 XMGenDplmaNmb 2568 1.05 1.40 0.90 124 SpammyFromTLD_01 2551 0.95 1.39 0.75 125 RCVD_IN_IADB_SPF 2466 2.21 1.34 2.59 126 XM_H_Long_From02 2429 1.11 1.32 1.02 127 T_FILL_THIS_FORM_SHORT 2404 1.00 1.31 0.86 128 KHOP_HELO_FCRDNS 2398 1.16 1.31 1.10 129 ALL_TRUSTED 2330 13.97 1.27 19.47 130 RCVD_IN_IADB_DK 2324 1.96 1.27 2.25 131 RCVD_IN_IADB_SENDERID 2311 2.00 1.26 2.32 132 XM_HighProb1 2261 0.38 1.23 0.01 133 XM_B_COPY_HTML 2253 0.69 1.23 0.46 134 TR_Symld_Words 2247 1.27 1.22 1.29 135 TR_Caps_n_Bayes_99 2164 0.37 1.18 0.02 136 XM_B_Phish66 2102 0.52 1.14 0.25 137 HTTPS_HTTP_MISMATCH 2094 0.85 1.14 0.72 138 URI_NOVOWEL 2085 1.99 1.14 2.36 139 TR_XM_InvalidRelay 2084 0.36 1.13 0.02 140 XMPhish30 2054 0.79 1.12 0.65 141 DKIM_ADSP_CUSTOM_MED 2007 0.85 1.09 0.74 142 TR_XM_PHPForged 2006 0.54 1.09 0.30 143 TR_XM_INV_DKIM 1989 0.36 1.08 0.05 144 XMBdyGiftCard01 1971 0.82 1.07 0.72 145 HOSTED_IMG_MULTI_PUB_01 1971 0.34 1.07 0.02 146 TR_XM_PHPDW 1962 0.53 1.07 0.30 147 DIET_1 1938 0.46 1.06 0.21 148 TR_XM_FormFill2 1936 0.54 1.05 0.31 149 XM_H_PHPOS 1929 0.52 1.05 0.30 150 XMHTML_After_End 1929 0.50 1.05 0.26 151 BAYES_20 1928 2.67 1.05 3.37 152 XM_SendGrid 1926 1.07 1.05 1.08 153 XMSlimDrugH 1896 0.57 1.03 0.37 154 LongTLD 1887 0.52 1.03 0.31 155 XM_ProductURIs 1863 0.66 1.01 0.50 156 XM_B_DNDMA 1803 0.72 0.98 0.61 157 XM_DIRTYINTL 1713 0.33 0.93 0.07 158 TM2_M_A_HREF_HREF 1704 0.47 0.93 0.27 159 URIBL_DBL_SPAM 1703 0.29 0.93 0.02 160 HTML_IMAGE_ONLY_20 1692 0.52 0.92 0.35 161 NML_ADSP_CUSTOM_MED 1633 0.58 0.89 0.44 162 XMSexyCombo_01 1620 0.33 0.88 0.09 163 XMPhish14 1619 0.61 0.88 0.49 164 XMReplyNow 1619 0.41 0.88 0.20 165 RDNS_DYNAMIC 1588 0.45 0.86 0.28 166 PLING_QUERY 1578 0.49 0.86 0.33 167 XM_H_Undi_Recip 1562 0.37 0.85 0.16 168 PDS_RDNS_DYNAMIC_FP 1554 0.36 0.85 0.15 169 THIS_AD 1552 0.49 0.85 0.33 170 T_STY_INVIS_DIRECT 1548 0.46 0.84 0.29 171 XM_Combo_Sbj 1542 0.41 0.84 0.22 172 XMSubMetaSxObfu_03 1531 0.58 0.83 0.46 173 TR_Mismatch_TLD_02 1526 0.30 0.83 0.07 174 TR_MetaPhish_Combo_01 1515 0.73 0.83 0.69 175 TR_XM_Base64_M1 1507 0.65 0.82 0.57 176 MPART_ALT_DIFF_COUNT 1491 0.48 0.81 0.33 177 BOTNET_NORDNS 1483 0.25 0.81 0.01 178 HTML_FONT_FACE_BAD 1473 8.19 0.80 11.38 179 XMMoneyMeta_00 1436 0.52 0.78 0.40 180 XMHTMLBadTable_001 1426 0.42 0.78 0.26 181 T_Symld_Words_02 1422 0.55 0.77 0.46 182 TooManyTo_002 1411 1.74 0.77 2.16 183 XM_PDF 1406 3.07 0.77 4.06 184 RELAYCOUNTRY_FR 1404 0.39 0.76 0.23 185 TM2_M_OBFU_COMMENT 1404 0.40 0.76 0.24 186 XMSubMetaI_00 1387 0.56 0.76 0.47 187 TVD_RCVD_IP 1369 0.50 0.75 0.39 188 RELAYCOUNTRY_GB 1364 0.48 0.74 0.36 189 FORGED_GMAIL_RCVD 1351 0.53 0.74 0.44 190 XM_OfRef7 1339 0.33 0.73 0.16 191 BOUNCE_MESSAGE 1326 2.05 0.72 2.62 192 ANY_BOUNCE_MESSAGE 1326 2.05 0.72 2.62 193 XM_UB99 1313 0.22 0.72 0.00 194 XM_B_REG_HTML 1313 0.34 0.72 0.17 195 TooManyTo_003 1291 1.11 0.70 1.28 196 BAYES_00 1254 8.68 0.68 12.14 197 HTML_OBFUSCATE_05_10 1243 0.29 0.68 0.12 198 XMBody_78 1236 0.35 0.67 0.21 199 HTML_FONT_TINY_NORDNS 1226 0.26 0.67 0.09 200 RCVD_IN_IADB_VOUCHED 1219 1.56 0.66 1.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 377155 91.38 97.04 88.93 2 RELAYCOUNTRY_US 329926 80.71 87.44 77.80 3 XM_B_Unicode 311866 77.56 86.84 73.54 4 DCC_CHECK_NEGATIVE 285197 53.79 22.70 67.25 5 DKIM_SIGNED 268500 72.39 93.36 63.31 6 XM_DK_Pass 263041 70.47 89.96 62.02 7 DKIM_VALID 259149 69.35 88.40 61.11 8 BAYES_50 257320 53.42 36.65 60.68 9 DKIM_VALID_AU 209554 56.32 72.27 49.41 10 XM_B_Unicode3 195378 45.65 44.68 46.07 11 XMListUnsubscribeExists 176532 51.98 75.89 41.63 12 XM_B_SpammyWords 174327 51.44 75.31 41.11 13 DCC_CHECK 138717 46.18 77.29 32.71 14 MIME_HTML_ONLY 120831 27.24 24.36 28.49 15 XMSubLong 112063 25.21 22.40 26.42 16 RCVD_IN_MSPIKE_H2 109192 29.87 39.38 25.75 17 T_TM2_M_HEADER_IN_MSG 101971 23.77 23.13 24.04 18 DKIM_VALID_EF 101856 25.50 28.93 24.02 19 HTML_FONT_LOW_CONTRAST 100912 29.28 41.96 23.79 20 LOC_TINY_FONT_1 91668 27.89 42.38 21.62 21 FVGT_m_MULTI_ODD 90132 25.85 36.46 21.25 22 ALL_TRUSTED 82565 13.97 1.27 19.47 23 T_KAM_HTML_FONT_INVALID 74761 21.48 30.37 17.63 24 XM_B_SpammyWords2 64525 23.84 43.75 15.21 25 TooManyTo_001 56255 10.56 4.31 13.26 26 HTML_IMAGE_RATIO_04 53744 10.55 5.66 12.67 27 XM_B_Unsub 53099 13.06 14.31 12.52 28 BAYES_00 51497 8.68 0.68 12.14 29 XM_Multi_Part_URI 50267 14.28 19.89 11.85 30 HTML_FONT_FACE_BAD 48271 8.19 0.80 11.38 31 USER_IN_DEF_DKIM_WL 47674 8.88 3.44 11.24 32 TR_XM_BayesUnsub 47612 12.00 13.79 11.23 33 TR_XM_DK_Unsub 46227 14.05 21.33 10.90 34 XM_H_Trusted_IP 45493 7.49 0.00 10.73 35 XMStrtUSub 44227 8.39 3.67 10.43 36 UNPARSEABLE_RELAY 37007 10.42 14.34 8.73 37 XM_Evil_Numbers_Gen 35454 8.46 8.70 8.36 38 MPART_ALT_DIFF 34625 7.47 5.87 8.16 39 XMDiploma_00 33600 6.39 2.87 7.92 40 XM_B_PhoneNumber 33002 7.02 5.25 7.78 41 BAYES_60 31396 7.29 7.03 7.40 42 LotsOfNums_01 29136 7.23 8.05 6.87 43 MIME_HTML_ONLY_MULTI 28256 5.72 3.56 6.66 44 IN_ZIMBRA_NJ_WHITELIST 25864 4.28 0.08 6.10 45 LOTS_OF_MONEY 24805 9.73 18.69 5.85 46 TR_XM_DK_Bayes 24463 4.18 0.50 5.77 47 FSL_BULK_SIG 24388 6.25 7.41 5.75 48 TR_XM_DK_Bayes1 23999 4.09 0.48 5.66 49 TR_MAX_INTL_RELAY 23065 8.04 14.05 5.44 50 XM_DKIMWhitelistDomains 22401 3.70 0.05 5.28 51 BAYES_40 21497 3.97 1.42 5.07 52 TR_XM_DK_Bayes2 20107 3.40 0.30 4.74 53 XM_H_GMP 19229 4.39 4.04 4.53 54 RCVD_IN_MSPIKE_WL 18741 4.02 3.10 4.42 55 RCVD_IN_MSPIKE_H3 18741 4.02 3.10 4.42 56 T_TooManySym_01 18467 3.80 2.52 4.35 57 XM_H_Long_From01 18362 4.56 5.10 4.33 58 XM_DK_Undo_02 18189 17.36 47.54 4.29 59 HTML_IMAGE_RATIO_02 18104 4.93 6.46 4.27 60 MIME_QP_LONG_LINE 17564 3.90 3.34 4.14 61 TR_XM_SpammyWords4 17552 8.07 17.17 4.14 62 RCVD_IN_VALIDITY_SAFE 17540 4.10 4.01 4.14 63 XM_PDF 17222 3.07 0.77 4.06 64 HTML_IMAGE_RATIO_06 16281 3.82 3.78 3.84 65 XMSubNoVowel 16048 2.73 0.30 3.78 66 XM_B_SpammyWords3 15663 6.90 14.32 3.69 67 RELAYCOUNTRY_META 14675 6.36 13.04 3.46 68 T_REMOTE_IMAGE 14620 3.05 2.13 3.45 69 RCVD_IN_VALIDITY_CERTIFIED 14567 3.35 3.15 3.43 70 BAYES_20 14290 2.67 1.05 3.37 71 BAYES_80 14066 4.88 8.49 3.32 72 BAYES_99 13749 14.04 38.97 3.24 73 XM_UncommonTLD01 13678 3.63 4.56 3.23 74 XM_B_SpammyTLD 13277 3.16 3.24 3.13 75 RCVD_IN_IADB_LISTED 12484 2.50 1.48 2.94 76 XM_B_Phish_Phrases 11747 3.36 4.73 2.77 77 BAYES_05 11282 2.00 0.46 2.66 78 ANY_BOUNCE_MESSAGE 11129 2.05 0.72 2.62 79 BOUNCE_MESSAGE 11128 2.05 0.72 2.62 80 XM_Body_Dirty_Words 11026 3.71 6.27 2.60 81 RCVD_IN_IADB_SPF 10982 2.21 1.34 2.59 82 XMNumbers 10973 2.90 3.61 2.59 83 XMSubMetaSx_00 10676 3.44 5.58 2.52 84 BAYES_999 10608 11.29 31.59 2.50 85 MAILING_LIST_MULTI 10263 2.26 1.88 2.42 86 BOTNET_IPINHOSTNAME 10049 5.37 12.30 2.37 87 URI_NOVOWEL 10019 1.99 1.14 2.36 88 RCVD_IN_IADB_SENDERID 9826 2.00 1.26 2.32 89 XM_SPF_SoftFail 9679 3.08 4.93 2.28 90 RCVD_IN_IADB_DK 9559 1.96 1.27 2.25 91 DKIM_INVALID 9351 3.04 4.96 2.20 92 T_TooManySym_02 9349 1.72 0.60 2.20 93 MIME_HTML_MOSTLY 9295 2.72 3.93 2.19 94 TooManyTo_002 9145 1.74 0.77 2.16 95 BAYES_95 8993 3.06 5.23 2.12 96 XM_CamelCaseFrm001 8946 2.37 2.99 2.11 97 HTML_IMAGE_RATIO_08 8761 2.49 3.47 2.07 98 TR_XM_SpammyRelay 8300 4.22 9.46 1.96 99 RCVD_IN_IADB_VOUCHED 8238 1.56 0.66 1.94 100 XMSubLongNoVowel 7990 1.34 0.07 1.88 101 TR_XM_DKIM_Undo 7921 12.47 36.96 1.87 102 XMSubGarbage 7804 1.29 0.02 1.84 103 T_XMDrugObfuBody_14 7773 2.50 4.03 1.83 104 HTML_MIME_NO_HTML_TAG 7528 1.71 1.56 1.78 105 FROM_EXCESS_BASE64 7446 1.75 1.74 1.76 106 INVALID_MSGID 7184 1.23 0.15 1.69 107 TR_XM_PhishingBody 6831 2.29 3.87 1.61 108 XM_DK_Undo_01 6801 1.59 1.56 1.60 109 TO_MALFORMED 6752 1.12 0.03 1.59 110 HELO_NODOT 6564 1.17 0.30 1.55 111 HELO_NO_DOMAIN 6557 1.17 0.29 1.55 112 TM2_M_URI_OPT_OUT 5984 1.86 2.88 1.41 113 XMSexyCombo_05 5807 2.15 3.96 1.37 114 RCVD_IN_IADB_OPTIN 5749 1.06 0.39 1.36 115 TR_XM_UnparsRelay 5665 3.53 8.60 1.34 116 XM_B_Investor 5496 2.43 5.04 1.30 117 UNTRUSTED_Relay 5481 2.40 4.96 1.29 118 TR_Symld_Words 5472 1.27 1.22 1.29 119 TooManyTo_003 5438 1.11 0.70 1.28 120 SUBJ_ALL_CAPS 5405 1.64 2.49 1.27 121 TR_DCC_Bayes_99 5355 9.82 29.60 1.26 122 T_XMDrugObfuBody_08 5346 2.16 4.25 1.26 123 TR_XM_SpammyWords5 5310 2.19 4.34 1.25 124 IN_HORDE_ADDRESS_BOOK 5068 0.85 0.06 1.20 125 XMStockSpam_06 5003 1.29 1.54 1.18 126 XM_B_Unsub2 4913 1.44 2.08 1.16 127 KHOP_HELO_FCRDNS 4665 1.16 1.31 1.10 128 XM_SendGrid 4577 1.07 1.05 1.08 129 XM_B_SEO 4404 2.21 4.92 1.04 130 RELAYCOUNTRY_CA 4316 2.14 4.74 1.02 131 XM_H_Long_From02 4305 1.11 1.32 1.02 132 TM2_M_VERY_LONG_WORD 4301 1.69 3.27 1.01 133 XMCapTrack 4266 0.84 0.47 1.01 134 XM_GoogleGroups 4218 0.86 0.56 0.99 135 BOTNET 4005 2.94 7.55 0.94 136 TooManyTo_004 3998 0.85 0.64 0.94 137 XM_OfRef6 3994 1.87 4.02 0.94 138 XMGenDplmaNmb 3829 1.05 1.40 0.90 139 TVD_SPACE_RATIO 3808 0.67 0.15 0.90 140 URI_HEX 3800 1.09 1.53 0.90 141 T_FILL_THIS_FORM_SHORT 3652 1.00 1.31 0.86 142 XM_E_Blogspot 3638 0.63 0.09 0.86 143 XMGappySubj_01 3590 0.64 0.17 0.85 144 XMBrknScrpt_02 3561 1.59 3.31 0.84 145 XM_TLDProd2 3551 0.67 0.29 0.84 146 T_OBFU_PDF_ATTACH 3504 0.62 0.14 0.83 147 TR_LOTS_OF_MONEY3 3416 2.65 6.90 0.81 148 T_TooManySym_03 3346 0.61 0.20 0.79 149 XM_UB50 3324 1.34 2.62 0.78 150 TO_NO_BRKTS_HTML_ONLY 3286 0.58 0.14 0.77 151 TooManyTo_005 3249 0.72 0.61 0.77 152 SpammyFromTLD_01 3196 0.95 1.39 0.75 153 DKIM_ADSP_CUSTOM_MED 3135 0.85 1.09 0.74 154 URI_TRY_3LD 3083 1.42 3.03 0.73 155 HTTPS_HTTP_MISMATCH 3054 0.85 1.14 0.72 156 XMBdyGiftCard01 3034 0.82 1.07 0.72 157 TR_XM_DK_SendGrid 3011 0.69 0.63 0.71 158 TR_MetaPhish_Combo_01 2933 0.73 0.83 0.69 159 RELAYCOUNTRY_AU 2919 1.14 2.18 0.69 160 XM_ShortIntro_01 2821 0.59 0.42 0.67 161 XMPhish30 2763 0.79 1.12 0.65 162 TR_XM_SEO4 2724 1.80 4.46 0.64 163 XMNoVowels 2680 0.59 0.51 0.63 164 XM_H_PHPMailer 2625 0.61 0.58 0.62 165 XM_B_DNDMA 2584 0.72 0.98 0.61 166 RCVD_IN_BL_SPAMCOP_NET 2481 2.93 8.35 0.59 167 XMBody_17 2466 2.31 6.30 0.58 168 TR_XM_SpammyWords2 2464 5.37 16.43 0.58 169 TR_XM_Base64_M1 2432 0.65 0.82 0.57 170 FROM_GOV_DKIM_AU 2270 0.54 0.56 0.54 171 T_XMDrugObfuBody_00 2220 0.81 1.48 0.52 172 XM_B_SpammyWords4 2172 0.99 2.09 0.51 173 XMBody_95 2171 0.43 0.25 0.51 174 XM_ProductURIs 2125 0.66 1.01 0.50 175 XMPhish14 2089 0.61 0.88 0.49 176 USER_IN_WHITELIST 2063 0.34 0.00 0.49 177 USER_IN_WELCOMELIST 2063 0.34 0.00 0.49 178 XMSubMetaI_00 2012 0.56 0.76 0.47 179 SHORT_HELO_AND_INLINE_IMAGE 2007 0.35 0.06 0.47 180 XMGappySubj_02 1978 0.34 0.05 0.47 181 XMSubMetaSxObfu_03 1970 0.58 0.83 0.46 182 XMLngstWrd_00 1963 0.45 0.42 0.46 183 XM_B_COPY_HTML 1957 0.69 1.23 0.46 184 T_Symld_Words_02 1936 0.55 0.77 0.46 185 HTML_IMAGE_ONLY_28 1887 0.43 0.41 0.44 186 NML_ADSP_CUSTOM_MED 1875 0.58 0.89 0.44 187 FORGED_GMAIL_RCVD 1874 0.53 0.74 0.44 188 HTML_TAG_BALANCE_BODY 1867 0.86 1.85 0.44 189 T_XMHurry_00 1786 0.94 2.14 0.42 190 XMMoneyMeta_00 1712 0.52 0.78 0.40 191 TVD_RCVD_IP 1672 0.50 0.75 0.39 192 TM2_M_BODY_EMPTY 1653 0.31 0.13 0.39 193 XMhairloss01 1640 0.32 0.16 0.39 194 URI_TRUNCATED 1629 0.37 0.33 0.38 195 HTML_IMAGE_ONLY_32 1621 0.32 0.17 0.38 196 XM_B_FormFill 1619 0.29 0.07 0.38 197 T_MANY_PILL_PRICE 1591 0.26 0.00 0.38 198 XMSlimDrugH 1575 0.57 1.03 0.37 199 FILL_THIS_FORM 1560 0.36 0.33 0.37 200 RELAYCOUNTRY_GB 1543 0.48 0.74 0.36 ----------------------------------------------------------------------