Email: 592952 Autolearn: 0 AvgScore: 3.26 AvgScanTime: 1.49 sec Spam: 187617 Autolearn: 0 AvgScore: 14.17 AvgScanTime: 1.71 sec Ham: 405335 Autolearn: 0 AvgScore: -1.80 AvgScanTime: 1.38 sec Time Spent Running SA: 244.69 hours Time Spent Processing Spam: 88.87 hours Time Spent Processing Ham: 155.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 180153 90.08 96.02 87.34 2 DKIM_SIGNED 167419 73.27 89.23 65.89 3 XM_DK_Pass 161286 71.41 85.97 64.68 4 DKIM_VALID 159391 70.45 84.96 63.73 5 XM_B_Unicode 157932 76.36 84.18 72.75 6 RELAYCOUNTRY_US 157208 82.00 83.79 81.17 7 DCC_CHECK 143110 48.03 76.28 34.95 8 XM_B_SpammyWords 136244 53.84 72.62 45.15 9 XMListUnsubscribeExists 133951 52.54 71.40 43.81 10 DKIM_VALID_AU 129593 56.96 69.07 51.35 11 XM_B_Unicode3 89912 44.98 47.92 43.62 12 LOC_TINY_FONT_1 83212 29.90 44.35 23.21 13 XM_DK_Undo_02 83102 17.06 44.29 4.45 14 XM_B_SpammyWords2 76613 25.69 40.83 18.68 15 BAYES_50 73591 52.60 39.22 58.80 16 RCVD_IN_MSPIKE_H2 73034 31.03 38.93 27.37 17 HTML_FONT_LOW_CONTRAST 72225 29.38 38.50 25.16 18 BAYES_99 65638 13.36 34.99 3.34 19 FVGT_m_MULTI_ODD 62441 25.43 33.28 21.79 20 TR_XM_DKIM_Undo 61687 11.67 32.88 1.86 21 T_KAM_HTML_FONT_INVALID 55036 22.03 29.33 18.65 22 BAYES_999 52412 10.59 27.94 2.56 23 MIME_HTML_ONLY 51516 24.23 27.46 22.73 24 TR_DCC_Bayes_99 50175 9.19 26.74 1.07 25 DKIM_VALID_EF 48922 25.22 26.08 24.82 26 T_TM2_M_HEADER_IN_MSG 43936 26.60 23.42 28.07 27 DCC_CHECK_NEGATIVE 43266 51.73 23.06 65.00 28 XMSubLong 39154 21.39 20.87 21.63 29 XM_Multi_Part_URI 38435 15.80 20.49 13.64 30 TR_XM_DK_Unsub 34534 13.33 18.41 10.98 31 RELAYCOUNTRY_META 28787 7.41 15.34 3.74 32 XM_B_Unsub 28399 9.77 15.14 7.29 33 TR_XM_BayesUnsub 27605 8.61 14.71 5.78 34 UNPARSEABLE_RELAY 27124 10.66 14.46 8.90 35 XM_B_SpammyWords3 26933 7.65 14.36 4.54 36 TR_MAX_INTL_RELAY 26693 8.34 14.23 5.61 37 TR_XM_SpammyWords2 25368 4.62 13.52 0.51 38 LOTS_OF_MONEY 25243 9.02 13.45 6.97 39 BOTNET_IPINHOSTNAME 24591 6.14 13.11 2.91 40 TR_XM_SpammyWords4 23098 7.51 12.31 5.29 41 TR_XM_SpammyRelay 21494 5.10 11.46 2.16 42 BOTNET 19762 4.13 10.53 1.17 43 XM_Evil_Numbers_Gen 17142 8.91 9.14 8.81 44 FSL_BULK_SIG 16356 6.82 8.72 5.94 45 BAYES_80 16211 5.07 8.64 3.41 46 TR_XM_UnparsRelay 15798 3.67 8.42 1.47 47 RCVD_IN_BL_SPAMCOP_NET 14721 2.83 7.85 0.50 48 BAYES_60 13865 7.99 7.39 8.26 49 XM_UncommonTLD01 13551 4.60 7.22 3.39 50 UNTRUSTED_Relay 13125 3.21 7.00 1.46 51 LotsOfNums_01 12911 7.09 6.88 7.19 52 XM_Body_Dirty_Words 12751 3.82 6.80 2.45 53 XM_B_PhoneNumber 12320 7.99 6.57 8.65 54 XM_B_Phish_Phrases 11976 4.52 6.38 3.66 55 XM_SPF_SoftFail 11391 3.16 6.07 1.82 56 HTML_IMAGE_RATIO_02 11268 4.95 6.01 4.46 57 XMSubMetaSx_00 11039 3.97 5.88 3.09 58 TR_XM_SPAMCOP 10943 2.03 5.83 0.27 59 MPART_ALT_DIFF 10835 7.70 5.78 8.58 60 XM_H_Long_From01 10580 4.94 5.64 4.61 61 BAYES_95 9800 3.16 5.22 2.20 62 XM_H_GMP 9728 4.63 5.19 4.37 63 TooManyTo_001 9659 6.94 5.15 7.77 64 XM_B_Investor 9656 2.60 5.15 1.43 65 RCVD_IN_VALIDITY_RPBL 9640 1.77 5.14 0.21 66 RELAYCOUNTRY_CA 9514 2.30 5.07 1.02 67 TR_XM_PhishingBody 9097 2.64 4.85 1.62 68 XMBody_17 9055 1.88 4.83 0.51 69 HTML_IMAGE_RATIO_04 8569 10.90 4.57 13.83 70 XM_B_SEO 8523 2.20 4.54 1.12 71 HTML_IMAGE_RATIO_06 8264 4.37 4.40 4.36 72 XMSexyCombo_05 8185 2.30 4.36 1.34 73 DKIM_INVALID 8028 2.83 4.28 2.15 74 TR_XM_SpammyWords5 7717 2.13 4.11 1.22 75 XM_OfRef6 7685 2.01 4.10 1.04 76 USER_IN_DEF_DKIM_WL 7519 9.36 4.01 11.84 77 TR_XM_SEO4 7485 1.75 3.99 0.72 78 RCVD_IN_VALIDITY_SAFE 7484 4.51 3.99 4.75 79 XMBrknScrpt_02 7234 1.84 3.86 0.90 80 HTML_IMAGE_RATIO_08 7147 2.51 3.81 1.91 81 T_XMDrugObfuBody_14 7108 2.23 3.79 1.50 82 XM_UB50 6908 1.81 3.68 0.95 83 XM_B_SpammyTLD 6884 4.04 3.67 4.21 84 XMNumbers 6722 2.82 3.58 2.47 85 RCVD_IN_VALIDITY_CERTIFIED 6526 3.95 3.48 4.17 86 MIME_HTML_ONLY_MULTI 6440 5.91 3.43 7.05 87 XM_CamelCaseFrm001 6429 2.55 3.43 2.14 88 MIME_HTML_MOSTLY 6155 2.68 3.28 2.40 89 TR_LOTS_OF_MONEY3 5821 1.30 3.10 0.47 90 MIME_QP_LONG_LINE 5759 4.01 3.07 4.44 91 SpammyFromTLD_02 5487 1.22 2.92 0.43 92 XM_URI_RBL 5427 1.08 2.89 0.25 93 T_XMDrugObfuBody_08 5312 1.77 2.83 1.28 94 XMStrtUSub 5229 8.00 2.79 10.41 95 TM2_M_VERY_LONG_WORD 5211 1.76 2.78 1.28 96 RCVD_IN_MSPIKE_WL 5184 4.12 2.76 4.74 97 RCVD_IN_MSPIKE_H3 5184 4.12 2.76 4.74 98 XM_B_Unsub2 4934 1.82 2.63 1.44 99 XM_B_COPY_HTML 4777 1.19 2.55 0.57 100 XMPhish30 4759 1.13 2.54 0.48 101 SpammyFromTLD_01 4740 1.31 2.53 0.75 102 SUBJ_ALL_CAPS 4586 1.65 2.44 1.28 103 XMDiploma_00 4471 1.81 2.38 1.54 104 FROM_EXCESS_BASE64 4371 2.07 2.33 1.95 105 ALL_TRUSTED 4358 11.62 2.32 15.92 106 TM2_M_URI_OPT_OUT 4213 1.82 2.25 1.62 107 RELAYCOUNTRY_AU 4192 1.28 2.23 0.84 108 BOTNET_NORDNS 4148 0.71 2.21 0.01 109 T_XMDrugObfuBody_00 4065 1.10 2.17 0.60 110 T_TooManySym_01 4047 3.82 2.16 4.59 111 XM_B_SpammyWords4 3841 0.98 2.05 0.48 112 XMPhish14 3766 0.98 2.01 0.50 113 XM_DK_Undo_01 3631 1.75 1.94 1.66 114 XMStockSpam_06 3547 1.34 1.89 1.08 115 MAILING_LIST_MULTI 3488 2.48 1.86 2.76 116 XMPhish08 3401 0.79 1.81 0.31 117 BAYES_40 3358 4.45 1.79 5.68 118 T_XMHurry_00 3067 0.85 1.63 0.49 119 TR_XM_SpoofStaff 3052 0.59 1.63 0.11 120 HTML_MIME_NO_HTML_TAG 3029 1.99 1.61 2.16 121 XM_SendGrid 3021 1.53 1.61 1.49 122 XMSpoofStaff2 3016 0.56 1.61 0.07 123 XM_H_SpoofStaff4 2991 0.58 1.59 0.11 124 TR_XM_PSC1 2976 0.55 1.59 0.07 125 TR_XM_NoHeaderRelay 2933 0.56 1.56 0.10 126 TR_XM_SpoofStaff4 2903 0.53 1.55 0.06 127 RCVD_IN_SORBS_DUL 2840 0.61 1.51 0.19 128 HTML_TAG_BALANCE_BODY 2747 0.80 1.46 0.49 129 URI_PHISH 2744 0.47 1.46 0.01 130 XMGenDplmaNmb 2706 0.96 1.44 0.74 131 T_REMOTE_IMAGE 2693 2.77 1.44 3.39 132 RCVD_IN_PSBL 2693 0.50 1.44 0.07 133 RCVD_IN_IADB_LISTED 2616 2.61 1.39 3.17 134 URI_HEX 2602 1.10 1.39 0.97 135 RELAYCOUNTRY_KR 2577 0.44 1.37 0.01 136 XMBdyGiftCard01 2551 0.92 1.36 0.72 137 URIBL_DBL_SPAM 2521 0.43 1.34 0.00 138 AC_BR_BONANZA 2494 0.49 1.33 0.10 139 XMSubMetaI_00 2481 0.94 1.32 0.76 140 T_FILL_THIS_FORM_SHORT 2477 0.96 1.32 0.80 141 URI_TRY_3LD 2448 0.92 1.30 0.74 142 XM_ProductURIs 2396 1.00 1.28 0.87 143 RCVD_IN_IADB_SPF 2378 2.33 1.27 2.82 144 TR_XM_INV_DKIM 2328 0.43 1.24 0.05 145 TR_XM_SpoofStaff2 2315 0.39 1.23 0.00 146 RCVD_IN_IADB_DK 2284 2.07 1.22 2.46 147 RCVD_IN_IADB_SENDERID 2268 2.13 1.21 2.55 148 XMPhishMultiple 2261 0.38 1.21 0.00 149 TR_XM_Base64_M1 2240 0.76 1.19 0.56 150 TR_XM_PHPForged 2172 0.56 1.16 0.28 151 XMHTML_After_End 2158 0.57 1.15 0.30 152 TR_LOTS_OF_MONEY2 2157 0.54 1.15 0.25 153 T_MONEY_PERCENT 2157 0.54 1.15 0.25 154 TR_XM_PHPDW 2133 0.55 1.14 0.28 155 TR_XM_FormFill2 2109 0.56 1.12 0.29 156 URI_NOVOWEL 2102 2.26 1.12 2.78 157 XM_B_URI_Unicode 2101 0.78 1.12 0.63 158 HTTPS_HTTP_MISMATCH 2098 0.85 1.12 0.72 159 XM_H_PHPOS 2092 0.54 1.12 0.27 160 KHOP_HELO_FCRDNS 2060 1.06 1.10 1.04 161 THIS_AD 2049 0.68 1.09 0.49 162 XM_DIRTYINTL 2035 0.39 1.08 0.07 163 XM_B_DNDMA 2009 0.75 1.07 0.60 164 BAYES_20 1933 2.81 1.03 3.63 165 DKIM_ADSP_CUSTOM_MED 1892 0.76 1.01 0.65 166 XM_HighProb1 1876 0.32 1.00 0.01 167 T_STY_INVIS_DIRECT 1860 0.50 0.99 0.27 168 TR_Mismatch_TLD_01 1834 0.62 0.98 0.45 169 MPART_ALT_DIFF_COUNT 1828 0.67 0.97 0.54 170 RCVD_IN_PBL 1824 0.50 0.97 0.28 171 XMMoneyMeta_00 1801 0.64 0.96 0.50 172 T_Symld_Words_02 1792 0.76 0.96 0.67 173 XM_UB60 1791 0.34 0.95 0.06 174 TM2_M_OBFU_COMMENT 1776 0.55 0.95 0.36 175 TR_Caps_n_Bayes_99 1747 0.31 0.93 0.02 176 TR_XM_InvalidRelay 1740 0.31 0.93 0.02 177 DKIM_ADSP_NXDOMAIN 1729 0.51 0.92 0.31 178 TR_MetaPhish_Combo_01 1676 0.70 0.89 0.61 179 TR_Symld_Words 1664 1.38 0.89 1.61 180 XM_H_Long_From02 1627 0.97 0.87 1.02 181 TooManyTo_002 1605 2.10 0.86 2.68 182 HTML_IMAGE_ONLY_20 1561 0.58 0.83 0.47 183 XM_UB99 1538 0.26 0.82 0.00 184 ANY_BOUNCE_MESSAGE 1532 2.23 0.82 2.88 185 BOUNCE_MESSAGE 1531 2.23 0.82 2.88 186 XMReplyNow 1518 0.38 0.81 0.18 187 XMBody_78 1512 0.46 0.81 0.30 188 NML_ADSP_CUSTOM_MED 1472 0.54 0.78 0.43 189 XMClaimOffer 1464 0.49 0.78 0.36 190 RELAYCOUNTRY_GB 1458 0.52 0.78 0.40 191 DIET_1 1458 0.42 0.78 0.25 192 XM_B_Phish66 1457 0.44 0.78 0.28 193 RDNS_DYNAMIC 1454 0.42 0.77 0.25 194 HTML_FONT_FACE_BAD 1447 8.41 0.77 11.94 195 XMSubMetaSxObfu_03 1429 0.51 0.76 0.39 196 PDS_RDNS_DYNAMIC_FP 1419 0.32 0.76 0.12 197 XMSubMetaSSx_00 1402 0.35 0.75 0.17 198 FORGED_GMAIL_RCVD 1401 0.49 0.75 0.37 199 XMSexyCombo_01 1395 0.39 0.74 0.23 200 XMDateMe_00 1391 0.46 0.74 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 354007 90.08 96.02 87.34 2 RELAYCOUNTRY_US 329007 82.00 83.79 81.17 3 XM_B_Unicode 294869 76.36 84.18 72.75 4 DKIM_SIGNED 267061 73.27 89.23 65.89 5 DCC_CHECK_NEGATIVE 263488 51.73 23.06 65.00 6 XM_DK_Pass 262168 71.41 85.97 64.68 7 DKIM_VALID 258327 70.45 84.96 63.73 8 BAYES_50 238325 52.60 39.22 58.80 9 DKIM_VALID_AU 208150 56.96 69.07 51.35 10 XM_B_SpammyWords 183002 53.84 72.62 45.15 11 XMListUnsubscribeExists 177596 52.54 71.40 43.81 12 XM_B_Unicode3 176827 44.98 47.92 43.62 13 DCC_CHECK 141672 48.03 76.28 34.95 14 T_TM2_M_HEADER_IN_MSG 113772 26.60 23.42 28.07 15 RCVD_IN_MSPIKE_H2 110940 31.03 38.93 27.37 16 HTML_FONT_LOW_CONTRAST 101980 29.38 38.50 25.16 17 DKIM_VALID_EF 100616 25.22 26.08 24.82 18 LOC_TINY_FONT_1 94066 29.90 44.35 23.21 19 MIME_HTML_ONLY 92129 24.23 27.46 22.73 20 FVGT_m_MULTI_ODD 88341 25.43 33.28 21.79 21 XMSubLong 87666 21.39 20.87 21.63 22 XM_B_SpammyWords2 75707 25.69 40.83 18.68 23 T_KAM_HTML_FONT_INVALID 75583 22.03 29.33 18.65 24 ALL_TRUSTED 64539 11.62 2.32 15.92 25 HTML_IMAGE_RATIO_04 56038 10.90 4.57 13.83 26 XM_Multi_Part_URI 55269 15.80 20.49 13.64 27 HTML_FONT_FACE_BAD 48415 8.41 0.77 11.94 28 USER_IN_DEF_DKIM_WL 47997 9.36 4.01 11.84 29 BAYES_00 47980 8.26 0.53 11.84 30 XM_H_Trusted_IP 46203 7.79 0.00 11.40 31 TR_XM_DK_Unsub 44504 13.33 18.41 10.98 32 XMStrtUSub 42212 8.00 2.79 10.41 33 UNPARSEABLE_RELAY 36079 10.66 14.46 8.90 34 XM_Evil_Numbers_Gen 35692 8.91 9.14 8.81 35 XM_B_PhoneNumber 35066 7.99 6.57 8.65 36 MPART_ALT_DIFF 34796 7.70 5.78 8.58 37 BAYES_60 33499 7.99 7.39 8.26 38 TooManyTo_001 31477 6.94 5.15 7.77 39 XM_B_Unsub 29538 9.77 15.14 7.29 40 LotsOfNums_01 29145 7.09 6.88 7.19 41 MIME_HTML_ONLY_MULTI 28578 5.91 3.43 7.05 42 LOTS_OF_MONEY 28260 9.02 13.45 6.97 43 IN_ZIMBRA_NJ_WHITELIST 24406 4.14 0.08 6.02 44 FSL_BULK_SIG 24096 6.82 8.72 5.94 45 XM_DKIMWhitelistDomains 23899 4.04 0.04 5.90 46 TR_XM_BayesUnsub 23432 8.61 14.71 5.78 47 TR_XM_DK_Bayes 23293 4.06 0.43 5.75 48 BAYES_40 23017 4.45 1.79 5.68 49 TR_XM_DK_Bayes1 22800 3.98 0.42 5.62 50 TR_MAX_INTL_RELAY 22751 8.34 14.23 5.61 51 TR_XM_SpammyWords4 21456 7.51 12.31 5.29 52 TR_XM_DK_Bayes2 19337 3.36 0.32 4.77 53 RCVD_IN_VALIDITY_SAFE 19255 4.51 3.99 4.75 54 RCVD_IN_MSPIKE_H3 19222 4.12 2.76 4.74 55 RCVD_IN_MSPIKE_WL 19222 4.12 2.76 4.74 56 XM_H_Long_From01 18691 4.94 5.64 4.61 57 T_TooManySym_01 18594 3.82 2.16 4.59 58 XM_B_SpammyWords3 18418 7.65 14.36 4.54 59 HTML_IMAGE_RATIO_02 18071 4.95 6.01 4.46 60 XM_DK_Undo_02 18040 17.06 44.29 4.45 61 MIME_QP_LONG_LINE 17995 4.01 3.07 4.44 62 XM_H_GMP 17714 4.63 5.19 4.37 63 HTML_IMAGE_RATIO_06 17660 4.37 4.40 4.36 64 XM_B_SpammyTLD 17074 4.04 3.67 4.21 65 RCVD_IN_VALIDITY_CERTIFIED 16893 3.95 3.48 4.17 66 XMSubNoVowel 16240 2.84 0.32 4.01 67 XM_PDF 15490 2.84 0.73 3.82 68 RELAYCOUNTRY_META 15176 7.41 15.34 3.74 69 XM_B_Phish_Phrases 14832 4.52 6.38 3.66 70 BAYES_20 14731 2.81 1.03 3.63 71 BAYES_80 13832 5.07 8.64 3.41 72 T_REMOTE_IMAGE 13756 2.77 1.44 3.39 73 XM_UncommonTLD01 13739 4.60 7.22 3.39 74 BAYES_99 13554 13.36 34.99 3.34 75 RCVD_IN_IADB_LISTED 12843 2.61 1.39 3.17 76 XMSubMetaSx_00 12525 3.97 5.88 3.09 77 BOTNET_IPINHOSTNAME 11799 6.14 13.11 2.91 78 ANY_BOUNCE_MESSAGE 11686 2.23 0.82 2.88 79 BOUNCE_MESSAGE 11686 2.23 0.82 2.88 80 BAYES_05 11485 2.11 0.54 2.83 81 RCVD_IN_IADB_SPF 11422 2.33 1.27 2.82 82 URI_NOVOWEL 11276 2.26 1.12 2.78 83 MAILING_LIST_MULTI 11195 2.48 1.86 2.76 84 TooManyTo_002 10850 2.10 0.86 2.68 85 BAYES_999 10387 10.59 27.94 2.56 86 RCVD_IN_IADB_SENDERID 10347 2.13 1.21 2.55 87 XMNumbers 10020 2.82 3.58 2.47 88 RCVD_IN_IADB_DK 9982 2.07 1.22 2.46 89 XM_Body_Dirty_Words 9925 3.82 6.80 2.45 90 MIME_HTML_MOSTLY 9715 2.68 3.28 2.40 91 T_TooManySym_02 9633 1.82 0.62 2.38 92 BAYES_95 8909 3.16 5.22 2.20 93 TR_XM_SpammyRelay 8767 5.10 11.46 2.16 94 HTML_MIME_NO_HTML_TAG 8764 1.99 1.61 2.16 95 DKIM_INVALID 8734 2.83 4.28 2.15 96 XM_CamelCaseFrm001 8677 2.55 3.43 2.14 97 RCVD_IN_IADB_VOUCHED 8278 1.58 0.58 2.04 98 XMSubLongNoVowel 7935 1.37 0.11 1.96 99 FROM_EXCESS_BASE64 7919 2.07 2.33 1.95 100 HTML_IMAGE_RATIO_08 7747 2.51 3.81 1.91 101 XMSubGarbage 7724 1.31 0.04 1.91 102 TR_XM_DKIM_Undo 7522 11.67 32.88 1.86 103 XM_SPF_SoftFail 7363 3.16 6.07 1.82 104 INVALID_MSGID 7177 1.27 0.19 1.77 105 XM_DK_Undo_01 6726 1.75 1.94 1.66 106 TO_MALFORMED 6659 1.16 0.13 1.64 107 TR_XM_PhishingBody 6567 2.64 4.85 1.62 108 TM2_M_URI_OPT_OUT 6562 1.82 2.25 1.62 109 TR_Symld_Words 6545 1.38 0.89 1.61 110 XMDiploma_00 6253 1.81 2.38 1.54 111 T_XMDrugObfuBody_14 6090 2.23 3.79 1.50 112 XM_SendGrid 6046 1.53 1.61 1.49 113 TR_XM_UnparsRelay 5966 3.67 8.42 1.47 114 UNTRUSTED_Relay 5913 3.21 7.00 1.46 115 RCVD_IN_IADB_OPTIN 5897 1.11 0.37 1.45 116 XM_B_Unsub2 5851 1.82 2.63 1.44 117 XM_B_Investor 5778 2.60 5.15 1.43 118 TooManyTo_003 5479 1.11 0.59 1.35 119 XMSexyCombo_05 5429 2.30 4.36 1.34 120 TM2_M_VERY_LONG_WORD 5206 1.76 2.78 1.28 121 T_XMDrugObfuBody_08 5193 1.77 2.83 1.28 122 SUBJ_ALL_CAPS 5191 1.65 2.44 1.28 123 HELO_NODOT 5168 0.95 0.26 1.27 124 HELO_NO_DOMAIN 5161 0.95 0.26 1.27 125 IN_HORDE_ADDRESS_BOOK 4980 0.86 0.07 1.23 126 TR_XM_SpammyWords5 4930 2.13 4.11 1.22 127 XM_GoogleGroups 4774 0.99 0.59 1.18 128 BOTNET 4744 4.13 10.53 1.17 129 XM_B_SEO 4537 2.20 4.54 1.12 130 XM_TLDProd2 4395 0.84 0.33 1.08 131 XMStockSpam_06 4384 1.34 1.89 1.08 132 TR_DCC_Bayes_99 4327 9.19 26.74 1.07 133 XM_OfRef6 4233 2.01 4.10 1.04 134 KHOP_HELO_FCRDNS 4230 1.06 1.10 1.04 135 XM_H_Long_From02 4136 0.97 0.87 1.02 136 RELAYCOUNTRY_CA 4132 2.30 5.07 1.02 137 XMCapTrack 4123 0.88 0.58 1.02 138 XMGappySubj_01 4057 0.75 0.21 1.00 139 TooManyTo_004 4055 0.86 0.54 1.00 140 URI_HEX 3917 1.10 1.39 0.97 141 XM_UB50 3854 1.81 3.68 0.95 142 TVD_SPACE_RATIO 3759 0.67 0.13 0.93 143 XMBrknScrpt_02 3647 1.84 3.86 0.90 144 XM_E_Blogspot 3591 0.67 0.19 0.89 145 XM_ProductURIs 3538 1.00 1.28 0.87 146 T_TooManySym_03 3447 0.65 0.23 0.85 147 RELAYCOUNTRY_AU 3411 1.28 2.23 0.84 148 TooManyTo_005 3283 0.72 0.52 0.81 149 T_FILL_THIS_FORM_SHORT 3232 0.96 1.32 0.80 150 XMSubMetaI_00 3098 0.94 1.32 0.76 151 SpammyFromTLD_01 3049 1.31 2.53 0.75 152 XM_B_FormFill 3020 0.58 0.23 0.75 153 FROM_GOV_DKIM_AU 3014 0.66 0.47 0.74 154 XMGenDplmaNmb 2984 0.96 1.44 0.74 155 URI_TRY_3LD 2983 0.92 1.30 0.74 156 TR_XM_DK_SendGrid 2950 0.72 0.71 0.73 157 TR_XM_SEO4 2917 1.75 3.99 0.72 158 XMBdyGiftCard01 2914 0.92 1.36 0.72 159 HTTPS_HTTP_MISMATCH 2913 0.85 1.12 0.72 160 T_OBFU_PDF_ATTACH 2773 0.55 0.26 0.68 161 T_Symld_Words_02 2706 0.76 0.96 0.67 162 DKIM_ADSP_CUSTOM_MED 2638 0.76 1.01 0.65 163 XMNoVowels 2612 0.58 0.45 0.64 164 XM_B_URI_Unicode 2541 0.78 1.12 0.63 165 XM_ShortIntro_01 2526 0.58 0.47 0.62 166 XMLngstWrd_00 2482 0.58 0.52 0.61 167 TR_MetaPhish_Combo_01 2478 0.70 0.89 0.61 168 T_XMDrugObfuBody_00 2439 1.10 2.17 0.60 169 XM_H_PHPMailer 2436 0.61 0.61 0.60 170 XM_B_DNDMA 2428 0.75 1.07 0.60 171 XMBody_95 2312 0.49 0.33 0.57 172 XM_B_COPY_HTML 2303 1.19 2.55 0.57 173 TR_XM_Base64_M1 2281 0.76 1.19 0.56 174 XMGappySubj_02 2194 0.42 0.15 0.54 175 MPART_ALT_DIFF_COUNT 2170 0.67 0.97 0.54 176 XMBody_17 2081 1.88 4.83 0.51 177 TR_XM_SpammyWords2 2047 4.62 13.52 0.51 178 RCVD_IN_BL_SPAMCOP_NET 2035 2.83 7.85 0.50 179 XMPhish14 2027 0.98 2.01 0.50 180 XMMoneyMeta_00 2023 0.64 0.96 0.50 181 THIS_AD 2000 0.68 1.09 0.49 182 BASE64_LENGTH_79_INF 1992 0.44 0.32 0.49 183 HTML_TAG_BALANCE_BODY 1986 0.80 1.46 0.49 184 T_XMHurry_00 1979 0.85 1.63 0.49 185 XM_B_SpammyWords4 1962 0.98 2.05 0.48 186 XMPhish30 1935 1.13 2.54 0.48 187 TR_LOTS_OF_MONEY3 1905 1.30 3.10 0.47 188 HTML_IMAGE_ONLY_20 1898 0.58 0.83 0.47 189 TR_Mismatch_TLD_01 1844 0.62 0.98 0.45 190 HTML_IMAGE_ONLY_28 1767 0.43 0.43 0.44 191 NML_ADSP_CUSTOM_MED 1730 0.54 0.78 0.43 192 SpammyFromTLD_02 1728 1.22 2.92 0.43 193 XMLngstWrd_01 1660 0.43 0.47 0.41 194 RELAYCOUNTRY_GB 1620 0.52 0.78 0.40 195 TO_NO_BRKTS_HTML_ONLY 1595 0.33 0.19 0.39 196 XMSubMetaSxObfu_03 1579 0.51 0.76 0.39 197 USER_IN_WHITELIST 1576 0.27 0.00 0.39 198 USER_IN_WELCOMELIST 1576 0.27 0.00 0.39 199 SHORT_HELO_AND_INLINE_IMAGE 1572 0.28 0.04 0.39 200 HTML_IMAGE_ONLY_32 1528 0.30 0.14 0.38 ----------------------------------------------------------------------