Email: 568665 Autolearn: 0 AvgScore: 2.94 AvgScanTime: 1.60 sec Spam: 169029 Autolearn: 0 AvgScore: 14.78 AvgScanTime: 1.77 sec Ham: 399636 Autolearn: 0 AvgScore: -2.08 AvgScanTime: 1.52 sec Time Spent Running SA: 252.46 hours Time Spent Processing Spam: 83.33 hours Time Spent Processing Ham: 169.12 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160750 90.44 95.10 88.47 2 DKIM_SIGNED 150961 74.23 89.31 67.85 3 XM_DK_Pass 142427 71.96 84.26 66.76 4 RELAYCOUNTRY_US 141428 82.70 83.67 82.29 5 DKIM_VALID 140170 70.93 82.93 65.85 6 XM_B_Unicode 138951 76.01 82.21 73.39 7 DCC_CHECK 125867 47.53 74.46 36.14 8 XM_B_SpammyWords 116633 51.28 69.00 43.79 9 XMListUnsubscribeExists 114276 51.39 67.61 44.53 10 DKIM_VALID_AU 112225 56.95 66.39 52.95 11 XM_B_Unicode3 82214 45.52 48.64 44.20 12 LOC_TINY_FONT_1 76975 30.51 45.54 24.15 13 BAYES_50 70361 53.60 41.63 58.66 14 XM_B_SpammyWords2 66031 23.26 39.06 16.57 15 XM_DK_Undo_02 64278 14.44 38.03 4.46 16 RCVD_IN_MSPIKE_H2 62673 32.20 37.08 30.13 17 HTML_FONT_LOW_CONTRAST 62463 29.15 36.95 25.84 18 MIME_HTML_ONLY 54322 26.93 32.14 24.72 19 FVGT_m_MULTI_ODD 54162 24.58 32.04 21.42 20 T_KAM_HTML_FONT_INVALID 51075 22.38 30.22 19.06 21 BAYES_99 50514 11.05 29.88 3.08 22 DKIM_VALID_EF 47627 26.32 28.18 25.53 23 TR_XM_DKIM_Undo 44861 9.25 26.54 1.94 24 XMSubLong 42019 23.24 24.86 22.55 25 DCC_CHECK_NEGATIVE 40406 51.95 23.90 63.82 26 BAYES_999 39247 8.54 23.22 2.33 27 XM_Multi_Part_URI 35958 16.09 21.27 13.89 28 T_TM2_M_HEADER_IN_MSG 35896 24.51 21.24 25.90 29 TR_DCC_Bayes_99 35220 6.94 20.84 1.07 30 XM_B_Unsub 31917 11.04 18.88 7.72 31 UNPARSEABLE_RELAY 31093 12.44 18.40 9.92 32 TR_XM_DK_Unsub 31057 13.13 18.37 10.91 33 TR_XM_BayesUnsub 30861 9.72 18.26 6.10 34 RELAYCOUNTRY_META 26040 7.25 15.41 3.80 35 XM_B_SpammyWords3 25749 7.43 15.23 4.14 36 TR_MAX_INTL_RELAY 24915 8.20 14.74 5.44 37 BOTNET_IPINHOSTNAME 21045 5.75 12.45 2.91 38 LOTS_OF_MONEY 20223 7.42 11.96 5.50 39 BOTNET 18143 4.10 10.73 1.29 40 FSL_BULK_SIG 18128 7.55 10.72 6.20 41 TR_XM_SpammyWords4 17727 5.86 10.49 3.91 42 TR_XM_SpammyWords2 16964 3.25 10.04 0.38 43 TR_XM_UnparsRelay 16604 3.88 9.82 1.37 44 TR_XM_SpammyRelay 16451 4.37 9.73 2.10 45 XM_Evil_Numbers_Gen 16036 9.75 9.49 9.86 46 BAYES_80 15424 5.11 9.13 3.42 47 XM_B_Phish_Phrases 14871 6.49 8.80 5.51 48 BAYES_60 14154 7.97 8.37 7.79 49 LotsOfNums_01 13285 7.53 7.86 7.39 50 HTML_IMAGE_RATIO_02 12871 5.17 7.61 4.14 51 UNTRUSTED_Relay 12430 3.23 7.35 1.49 52 XM_UncommonTLD01 12413 4.97 7.34 3.97 53 RCVD_IN_BL_SPAMCOP_NET 12008 2.52 7.10 0.59 54 XM_B_PhoneNumber 11876 7.84 7.03 8.19 55 XM_Body_Dirty_Words 11772 3.97 6.96 2.71 56 XM_H_Long_From01 11502 5.51 6.80 4.97 57 XMSubMetaSx_00 11192 4.04 6.62 2.95 58 DKIM_INVALID 10791 3.30 6.38 2.00 59 XM_B_SEO 10427 2.63 6.17 1.13 60 MPART_ALT_DIFF 10142 7.93 6.00 8.75 61 TooManyTo_001 9391 6.48 5.56 6.88 62 TR_XM_SEO4 9081 2.10 5.37 0.71 63 TR_XM_SPAMCOP 8846 1.79 5.23 0.33 64 BAYES_95 8690 2.95 5.14 2.02 65 RELAYCOUNTRY_CA 8193 2.11 4.85 0.95 66 HTML_IMAGE_RATIO_04 8111 11.41 4.80 14.20 67 XM_H_GMP 7995 4.75 4.73 4.76 68 XM_SPF_SoftFail 7847 2.56 4.64 1.68 69 XMSexyCombo_05 7808 2.48 4.62 1.57 70 XM_B_Investor 7507 2.27 4.44 1.36 71 TR_XM_PhishingBody 7484 2.64 4.43 1.88 72 T_XMDrugObfuBody_14 7087 2.39 4.19 1.62 73 HTML_IMAGE_RATIO_06 7001 4.56 4.14 4.74 74 MIME_HTML_MOSTLY 6591 2.67 3.90 2.15 75 XM_B_SpammyTLD 6445 3.76 3.81 3.74 76 XMStrtUSub 6211 8.56 3.67 10.63 77 XMNumbers 6080 2.95 3.60 2.67 78 XM_UB50 6014 1.69 3.56 0.91 79 TR_XM_SpammyWords5 5997 1.97 3.55 1.30 80 MIME_HTML_ONLY_MULTI 5989 6.17 3.54 7.28 81 MIME_QP_LONG_LINE 5726 4.31 3.39 4.70 82 XM_OfRef6 5722 1.64 3.39 0.90 83 XM_CamelCaseFrm001 5657 2.53 3.35 2.18 84 HTML_IMAGE_RATIO_08 5261 2.23 3.11 1.86 85 XM_B_Unsub2 5178 1.95 3.06 1.48 86 RCVD_IN_MSPIKE_H3 5013 4.22 2.97 4.75 87 RCVD_IN_MSPIKE_WL 5013 4.22 2.97 4.75 88 XM_URI_RBL 4951 1.10 2.93 0.33 89 TM2_M_VERY_LONG_WORD 4925 1.63 2.91 1.08 90 RCVD_IN_VALIDITY_RPBL 4861 0.91 2.88 0.08 91 TM2_M_URI_OPT_OUT 4855 1.93 2.87 1.53 92 XMStockSpam_06 4595 1.98 2.72 1.66 93 XM_B_URI_Unicode 4592 2.03 2.72 1.74 94 FROM_EXCESS_BASE64 4449 2.21 2.63 2.03 95 XMDiploma_00 4296 1.87 2.54 1.59 96 T_XMDrugObfuBody_08 4195 1.62 2.48 1.25 97 RELAYCOUNTRY_AU 4190 1.33 2.48 0.85 98 XM_B_SpammyWords4 4133 1.14 2.45 0.58 99 SpammyFromTLD_02 4024 0.98 2.38 0.39 100 XM_DK_Undo_01 3967 1.83 2.35 1.61 101 XMBody_17 3941 1.01 2.33 0.45 102 T_TooManySym_01 3782 3.91 2.24 4.62 103 RCVD_IN_VALIDITY_SAFE 3745 3.84 2.22 4.52 104 USER_IN_DEF_DKIM_WL 3601 10.28 2.13 13.72 105 TR_XM_NoHeaderRelay 3581 0.73 2.12 0.15 106 SpammyFromTLD_01 3576 1.12 2.12 0.70 107 MAILING_LIST_MULTI 3564 2.44 2.11 2.59 108 T_FILL_THIS_FORM_SHORT 3524 1.13 2.08 0.72 109 T_REMOTE_IMAGE 3464 2.71 2.05 3.00 110 HTML_MIME_NO_HTML_TAG 3381 1.95 2.00 1.93 111 XM_H_DKIM_GOOG 3354 0.60 1.98 0.01 112 T_XMHurry_00 3110 0.99 1.84 0.63 113 XMBrknScrpt_02 3041 0.98 1.80 0.64 114 XMSubMetaI_00 2794 1.02 1.65 0.75 115 SUBJ_ALL_CAPS 2789 1.54 1.65 1.50 116 BAYES_40 2784 4.24 1.65 5.34 117 T_XMDrugObfuBody_00 2730 0.92 1.62 0.63 118 TR_XM_INV_DKIM 2721 0.54 1.61 0.09 119 XM_BadFromFormat 2717 0.56 1.61 0.12 120 SHORTCIRCUIT 2704 0.48 1.60 0.00 121 RCVD_IN_ZEN_LASTEXTERNAL 2704 0.48 1.60 0.00 122 RCVD_IN_VALIDITY_CERTIFIED 2640 3.05 1.56 3.68 123 TooManyTo_002 2625 1.86 1.55 1.99 124 RCVD_IN_IADB_LISTED 2490 2.85 1.47 3.43 125 URI_HEX 2406 1.06 1.42 0.91 126 XM_B_REG_HTML 2316 0.54 1.37 0.19 127 XM_SendGrid 2314 1.25 1.37 1.20 128 XM_UB99 2305 0.41 1.36 0.01 129 TR_XM_PHPForged 2292 0.68 1.36 0.39 130 RELAYCOUNTRY_FR 2286 0.57 1.35 0.24 131 TR_Mismatch_TLD_02 2285 0.46 1.35 0.08 132 TR_XM_FormFill 2257 0.40 1.34 0.01 133 URI_NOVOWEL 2252 2.22 1.33 2.60 134 TR_XM_Base64_M1 2227 0.79 1.32 0.56 135 TR_XM_PHPDW 2220 0.66 1.31 0.39 136 TR_XM_FormFill2 2201 0.66 1.30 0.39 137 RCVD_IN_IADB_SPF 2196 2.51 1.30 3.03 138 XMGenDplmaNmb 2172 0.89 1.28 0.73 139 XM_ProductURIs 2168 1.23 1.28 1.21 140 XM_H_PHPOS 2162 0.65 1.28 0.38 141 DKIM_ADSP_CUSTOM_MED 2157 0.93 1.28 0.78 142 XMBdyGiftCard01 2151 0.95 1.27 0.81 143 XMPhish30 2138 0.81 1.26 0.62 144 XMHTML_After_End 2124 0.55 1.26 0.25 145 RCVD_IN_IADB_DK 2078 2.22 1.23 2.64 146 RCVD_IN_IADB_SENDERID 2061 2.27 1.22 2.72 147 THIS_AD 2054 0.54 1.22 0.26 148 BAYES_20 2033 2.97 1.20 3.72 149 TR_Symld_Words 2028 1.40 1.20 1.48 150 SHOPIFY_IMG_NOT_RCVD_SFY 2027 0.49 1.20 0.19 151 TR_XM_InvalidRelay 1979 0.36 1.17 0.02 152 ALL_TRUSTED 1953 10.76 1.16 14.83 153 LongTLD 1918 0.55 1.13 0.30 154 DIET_1 1861 0.50 1.10 0.25 155 TR_LOTS_OF_MONEY3 1856 0.48 1.10 0.22 156 XMBody_78 1833 0.53 1.08 0.29 157 XM_B_Phish66 1832 0.59 1.08 0.38 158 XM_H_Long_From02 1824 0.94 1.08 0.89 159 NML_ADSP_CUSTOM_MED 1812 0.71 1.07 0.56 160 MPART_ALT_DIFF_COUNT 1748 0.58 1.03 0.39 161 XM_B_COPY_HTML 1742 0.71 1.03 0.57 162 XM_B_COVIDMETA 1707 0.43 1.01 0.18 163 T_MONEY_PERCENT 1701 0.42 1.01 0.17 164 TR_LOTS_OF_MONEY2 1701 0.42 1.01 0.17 165 XM_H_Undi_Recip 1691 0.40 1.00 0.15 166 HTTPS_HTTP_MISMATCH 1676 0.78 0.99 0.70 167 HTML_TAG_BALANCE_BODY 1662 0.71 0.98 0.60 168 XMSexyCombo_01 1640 0.42 0.97 0.19 169 T_HTML_ATTACH 1639 0.33 0.97 0.06 170 XM_B_FormFill 1631 0.37 0.96 0.12 171 TM2_M_OBFU_COMMENT 1630 0.65 0.96 0.51 172 XMPhish14 1629 0.67 0.96 0.55 173 XM_UB999 1626 0.29 0.96 0.00 174 XMHTMLBadTable_001 1613 0.49 0.95 0.29 175 XM_DIRTYINTL 1613 0.42 0.95 0.19 176 TR_XM_RelayPhish 1610 0.37 0.95 0.12 177 XMSubMetaSxObfu_03 1604 0.54 0.95 0.37 178 XM_UB60 1590 0.35 0.94 0.10 179 XM_Appointment_Request 1579 0.28 0.93 0.00 180 NO_DNS_FOR_FROM 1564 0.49 0.93 0.31 181 URI_TRY_3LD 1535 0.69 0.91 0.59 182 RDNS_DYNAMIC 1521 0.47 0.90 0.29 183 TR_XM_MaxWHORU 1521 0.45 0.90 0.26 184 XMSlimDrugH 1506 0.50 0.89 0.33 185 KHOP_HELO_FCRDNS 1503 1.01 0.89 1.07 186 FROM_SUSPICIOUS_NTLD 1499 0.28 0.89 0.02 187 BOTNET_NORDNS 1497 0.27 0.89 0.01 188 PDS_RDNS_DYNAMIC_FP 1488 0.37 0.88 0.16 189 NORDNS_LOW_CONTRAST 1482 0.29 0.88 0.05 190 TR_XM_Undi_Recip19 1454 0.30 0.86 0.06 191 XM_HighProb1 1451 0.26 0.86 0.00 192 XM_OfRef7 1448 0.31 0.86 0.09 193 FROM_SUSPICIOUS_NTLD_FP 1419 0.26 0.84 0.02 194 URIBL_BLACK 1408 0.28 0.83 0.04 195 HTML_IMAGE_ONLY_20 1405 0.57 0.83 0.46 196 HTML_FONT_TINY_NORDNS 1385 0.29 0.82 0.06 197 T_STY_INVIS_DIRECT 1375 0.46 0.81 0.31 198 RELAYCOUNTRY_RU 1364 0.26 0.81 0.03 199 FORGED_GMAIL_RCVD 1361 0.60 0.81 0.52 200 XM_H_PHPMailer 1360 0.63 0.80 0.56 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 353553 90.44 95.10 88.47 2 RELAYCOUNTRY_US 328841 82.70 83.67 82.29 3 XM_B_Unicode 293304 76.01 82.21 73.39 4 DKIM_SIGNED 271160 74.23 89.31 67.85 5 XM_DK_Pass 266784 71.96 84.26 66.76 6 DKIM_VALID 263157 70.93 82.93 65.85 7 DCC_CHECK_NEGATIVE 255038 51.95 23.90 63.82 8 BAYES_50 234423 53.60 41.63 58.66 9 DKIM_VALID_AU 211611 56.95 66.39 52.95 10 XMListUnsubscribeExists 177955 51.39 67.61 44.53 11 XM_B_Unicode3 176621 45.52 48.64 44.20 12 XM_B_SpammyWords 175003 51.28 69.00 43.79 13 DCC_CHECK 144417 47.53 74.46 36.14 14 RCVD_IN_MSPIKE_H2 120419 32.20 37.08 30.13 15 T_TM2_M_HEADER_IN_MSG 103486 24.51 21.24 25.90 16 HTML_FONT_LOW_CONTRAST 103280 29.15 36.95 25.84 17 DKIM_VALID_EF 102039 26.32 28.18 25.53 18 MIME_HTML_ONLY 98805 26.93 32.14 24.72 19 LOC_TINY_FONT_1 96513 30.51 45.54 24.15 20 XMSubLong 90128 23.24 24.86 22.55 21 FVGT_m_MULTI_ODD 85618 24.58 32.04 21.42 22 T_KAM_HTML_FONT_INVALID 76180 22.38 30.22 19.06 23 XM_B_SpammyWords2 66219 23.26 39.06 16.57 24 ALL_TRUSTED 59247 10.76 1.16 14.83 25 HTML_IMAGE_RATIO_04 56766 11.41 4.80 14.20 26 XM_Multi_Part_URI 55528 16.09 21.27 13.89 27 USER_IN_DEF_DKIM_WL 54833 10.28 2.13 13.72 28 BAYES_00 52066 9.39 0.79 13.03 29 HTML_FONT_FACE_BAD 48444 8.74 0.76 12.12 30 XM_H_Trusted_IP 46132 8.11 0.00 11.54 31 TR_XM_DK_Unsub 43603 13.13 18.37 10.91 32 XMStrtUSub 42481 8.56 3.67 10.63 33 UNPARSEABLE_RELAY 39637 12.44 18.40 9.92 34 XM_Evil_Numbers_Gen 39403 9.75 9.49 9.86 35 MPART_ALT_DIFF 34981 7.93 6.00 8.75 36 XM_B_PhoneNumber 32730 7.84 7.03 8.19 37 BAYES_60 31145 7.97 8.37 7.79 38 XM_B_Unsub 30845 11.04 18.88 7.72 39 LotsOfNums_01 29548 7.53 7.86 7.39 40 MIME_HTML_ONLY_MULTI 29097 6.17 3.54 7.28 41 XM_DKIMWhitelistDomains 28273 5.00 0.08 7.07 42 TooManyTo_001 27478 6.48 5.56 6.88 43 TR_XM_DK_Bayes 26583 4.85 0.58 6.65 44 TR_XM_DK_Bayes1 26231 4.78 0.57 6.56 45 FSL_BULK_SIG 24785 7.55 10.72 6.20 46 TR_XM_BayesUnsub 24397 9.72 18.26 6.10 47 IN_ZIMBRA_NJ_WHITELIST 24139 4.31 0.20 6.04 48 TR_XM_DK_Bayes2 22772 4.13 0.41 5.70 49 XM_B_Phish_Phrases 22010 6.49 8.80 5.51 50 LOTS_OF_MONEY 21999 7.42 11.96 5.50 51 TR_MAX_INTL_RELAY 21726 8.20 14.74 5.44 52 BAYES_40 21353 4.24 1.65 5.34 53 XM_H_Long_From01 19858 5.51 6.80 4.97 54 XM_H_GMP 19025 4.75 4.73 4.76 55 RCVD_IN_MSPIKE_H3 18988 4.22 2.97 4.75 56 RCVD_IN_MSPIKE_WL 18988 4.22 2.97 4.75 57 HTML_IMAGE_RATIO_06 18944 4.56 4.14 4.74 58 MIME_QP_LONG_LINE 18773 4.31 3.39 4.70 59 T_TooManySym_01 18450 3.91 2.24 4.62 60 XM_PDF 18104 3.38 0.65 4.53 61 RCVD_IN_VALIDITY_SAFE 18079 3.84 2.22 4.52 62 XM_DK_Undo_02 17830 14.44 38.03 4.46 63 XMSubNoVowel 16644 3.07 0.50 4.16 64 HTML_IMAGE_RATIO_02 16550 5.17 7.61 4.14 65 XM_B_SpammyWords3 16528 7.43 15.23 4.14 66 XM_UncommonTLD01 15852 4.97 7.34 3.97 67 TR_XM_SpammyWords4 15623 5.86 10.49 3.91 68 RELAYCOUNTRY_META 15175 7.25 15.41 3.80 69 XM_B_SpammyTLD 14944 3.76 3.81 3.74 70 BAYES_20 14853 2.97 1.20 3.72 71 RCVD_IN_VALIDITY_CERTIFIED 14697 3.05 1.56 3.68 72 RCVD_IN_IADB_LISTED 13698 2.85 1.47 3.43 73 BAYES_80 13650 5.11 9.13 3.42 74 BAYES_99 12302 11.05 29.88 3.08 75 RCVD_IN_IADB_SPF 12089 2.51 1.30 3.03 76 T_REMOTE_IMAGE 11973 2.71 2.05 3.00 77 XMSubMetaSx_00 11787 4.04 6.62 2.95 78 BAYES_05 11775 2.25 0.61 2.95 79 BOTNET_IPINHOSTNAME 11626 5.75 12.45 2.91 80 ANY_BOUNCE_MESSAGE 10913 2.13 0.71 2.73 81 BOUNCE_MESSAGE 10912 2.13 0.71 2.73 82 RCVD_IN_IADB_SENDERID 10858 2.27 1.22 2.72 83 XM_Body_Dirty_Words 10831 3.97 6.96 2.71 84 XMNumbers 10678 2.95 3.60 2.67 85 RCVD_IN_IADB_DK 10552 2.22 1.23 2.64 86 URI_NOVOWEL 10396 2.22 1.33 2.60 87 MAILING_LIST_MULTI 10333 2.44 2.11 2.59 88 T_TooManySym_02 9306 1.82 0.62 2.33 89 BAYES_999 9301 8.54 23.22 2.33 90 RCVD_IN_IADB_VOUCHED 9031 1.80 0.72 2.26 91 XM_CamelCaseFrm001 8711 2.53 3.35 2.18 92 MIME_HTML_MOSTLY 8598 2.67 3.90 2.15 93 TR_XM_SpammyRelay 8400 4.37 9.73 2.10 94 XMSubLongNoVowel 8164 1.50 0.21 2.04 95 FROM_EXCESS_BASE64 8118 2.21 2.63 2.03 96 BAYES_95 8064 2.95 5.14 2.02 97 DKIM_INVALID 8003 3.30 6.38 2.00 98 TooManyTo_002 7971 1.86 1.55 1.99 99 XMSubGarbage 7965 1.42 0.05 1.99 100 TR_XM_DKIM_Undo 7766 9.25 26.54 1.94 101 HTML_MIME_NO_HTML_TAG 7698 1.95 2.00 1.93 102 TR_XM_PhishingBody 7512 2.64 4.43 1.88 103 INVALID_MSGID 7483 1.38 0.22 1.87 104 HTML_IMAGE_RATIO_08 7441 2.23 3.11 1.86 105 XM_B_URI_Unicode 6939 2.03 2.72 1.74 106 XM_SPF_SoftFail 6724 2.56 4.64 1.68 107 XMStockSpam_06 6637 1.98 2.72 1.66 108 T_XMDrugObfuBody_14 6477 2.39 4.19 1.62 109 XM_DK_Undo_01 6436 1.83 2.35 1.61 110 XMDiploma_00 6354 1.87 2.54 1.59 111 XMSexyCombo_05 6287 2.48 4.62 1.57 112 TO_MALFORMED 6221 1.10 0.04 1.56 113 RCVD_IN_IADB_OPTIN 6206 1.22 0.43 1.55 114 TM2_M_URI_OPT_OUT 6113 1.93 2.87 1.53 115 SUBJ_ALL_CAPS 5995 1.54 1.65 1.50 116 UNTRUSTED_Relay 5935 3.23 7.35 1.49 117 XM_B_Unsub2 5918 1.95 3.06 1.48 118 TR_Symld_Words 5907 1.40 1.20 1.48 119 T_OBFU_PDF_ATTACH 5739 1.07 0.22 1.44 120 TR_XM_UnparsRelay 5464 3.88 9.82 1.37 121 XM_B_Investor 5428 2.27 4.44 1.36 122 TooManyTo_003 5287 1.09 0.54 1.32 123 TR_XM_SpammyWords5 5178 1.97 3.55 1.30 124 BOTNET 5168 4.10 10.73 1.29 125 IN_HORDE_ADDRESS_BOOK 5147 0.95 0.14 1.29 126 T_XMDrugObfuBody_08 4993 1.62 2.48 1.25 127 XM_ProductURIs 4854 1.23 1.28 1.21 128 XM_SendGrid 4812 1.25 1.37 1.20 129 XMGappySubj_01 4577 0.85 0.17 1.15 130 XM_B_SEO 4530 2.63 6.17 1.13 131 TM2_M_VERY_LONG_WORD 4329 1.63 2.91 1.08 132 XM_GoogleGroups 4271 0.93 0.59 1.07 133 TR_DCC_Bayes_99 4263 6.94 20.84 1.07 134 KHOP_HELO_FCRDNS 4261 1.01 0.89 1.07 135 URI_TRUNCATED 4075 0.90 0.63 1.02 136 TooManyTo_004 3916 0.84 0.50 0.98 137 RELAYCOUNTRY_CA 3812 2.11 4.85 0.95 138 XMCapTrack 3810 0.83 0.55 0.95 139 HELO_NODOT 3755 0.71 0.16 0.94 140 HELO_NO_DOMAIN 3753 0.71 0.16 0.94 141 TVD_SPACE_RATIO 3712 0.68 0.10 0.93 142 XM_TLDProd2 3653 0.75 0.35 0.91 143 URI_HEX 3644 1.06 1.42 0.91 144 XM_UB50 3618 1.69 3.56 0.91 145 XM_OfRef6 3601 1.64 3.39 0.90 146 XM_H_Long_From02 3543 0.94 1.08 0.89 147 XM_E_Blogspot 3492 0.71 0.33 0.87 148 RELAYCOUNTRY_AU 3382 1.33 2.48 0.85 149 FROM_GOV_DKIM_AU 3282 0.68 0.35 0.82 150 T_TooManySym_03 3281 0.66 0.27 0.82 151 XMBdyGiftCard01 3232 0.95 1.27 0.81 152 TR_XM_DK_SendGrid 3142 0.74 0.62 0.79 153 TooManyTo_005 3119 0.69 0.47 0.78 154 DKIM_ADSP_CUSTOM_MED 3116 0.93 1.28 0.78 155 T_Symld_Words_02 3078 0.74 0.67 0.77 156 XM_B_DNDMA 3018 0.74 0.70 0.76 157 XMSubMetaI_00 2978 1.02 1.65 0.75 158 XMGenDplmaNmb 2903 0.89 1.28 0.73 159 T_FILL_THIS_FORM_SHORT 2894 1.13 2.08 0.72 160 TR_XM_SEO4 2843 2.10 5.37 0.71 161 XMGappySubj_02 2824 0.53 0.10 0.71 162 SpammyFromTLD_01 2792 1.12 2.12 0.70 163 HTTPS_HTTP_MISMATCH 2786 0.78 0.99 0.70 164 HTML_FONT_SIZE_LARGE 2738 0.56 0.28 0.69 165 XM_ShortIntro_01 2655 0.65 0.61 0.66 166 XMBrknScrpt_02 2552 0.98 1.80 0.64 167 T_XMHurry_00 2535 0.99 1.84 0.63 168 T_XMDrugObfuBody_00 2528 0.92 1.62 0.63 169 XMPhish30 2492 0.81 1.26 0.62 170 TR_MetaPhish_Combo_01 2484 0.64 0.68 0.62 171 XMNoVowels 2401 0.60 0.59 0.60 172 HTML_TAG_BALANCE_BODY 2398 0.71 0.98 0.60 173 TVD_RCVD_IP 2366 0.64 0.77 0.59 174 URI_TRY_3LD 2361 0.69 0.91 0.59 175 XMBody_95 2344 0.48 0.21 0.59 176 RCVD_IN_BL_SPAMCOP_NET 2340 2.52 7.10 0.59 177 XM_B_SpammyWords4 2336 1.14 2.45 0.58 178 XM_B_COPY_HTML 2287 0.71 1.03 0.57 179 RCVD_IN_PBL 2284 0.63 0.77 0.57 180 TR_XM_Base64_M1 2242 0.79 1.32 0.56 181 XM_H_PHPMailer 2231 0.63 0.80 0.56 182 NML_ADSP_CUSTOM_MED 2225 0.71 1.07 0.56 183 XMPhish14 2194 0.67 0.96 0.55 184 FORGED_GMAIL_RCVD 2075 0.60 0.81 0.52 185 TM2_M_OBFU_COMMENT 2056 0.65 0.96 0.51 186 XMLngstWrd_00 1910 0.47 0.45 0.48 187 TO_NO_BRKTS_HTML_ONLY 1838 0.50 0.60 0.46 188 HTML_IMAGE_ONLY_20 1820 0.57 0.83 0.46 189 HTML_IMAGE_ONLY_28 1815 0.42 0.34 0.45 190 XMBody_17 1810 1.01 2.33 0.45 191 SUBJ_DOLLARS 1724 0.44 0.46 0.43 192 XMMoneyMeta_00 1713 0.51 0.70 0.43 193 RELAYCOUNTRY_GB 1606 0.50 0.74 0.40 194 HTML_IMAGE_ONLY_32 1575 0.33 0.18 0.39 195 SpammyFromTLD_02 1568 0.98 2.38 0.39 196 TR_XM_PHPForged 1552 0.68 1.36 0.39 197 TR_XM_FormFill2 1544 0.66 1.30 0.39 198 MPART_ALT_DIFF_COUNT 1540 0.58 1.03 0.39 199 TR_XM_PHPDW 1539 0.66 1.31 0.39 200 TR_XM_SpammyWords2 1519 3.25 10.04 0.38 ----------------------------------------------------------------------