Email: 309014 Autolearn: 0 AvgScore: 4.67 AvgScanTime: 1.24 sec Spam: 100756 Autolearn: 0 AvgScore: 14.77 AvgScanTime: 1.31 sec Ham: 208258 Autolearn: 0 AvgScore: -0.22 AvgScanTime: 1.21 sec Time Spent Running SA: 106.71 hours Time Spent Processing Spam: 36.58 hours Time Spent Processing Ham: 70.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96591 86.76 95.87 82.36 2 DKIM_SIGNED 87381 77.79 86.73 73.47 3 XM_DK_Pass 82334 75.24 81.72 72.10 4 RELAYCOUNTRY_US 82114 79.11 81.50 77.96 5 DKIM_VALID 81513 74.49 80.90 71.39 6 XM_B_Unicode 80340 71.70 79.74 67.80 7 DCC_CHECK 79465 53.74 78.87 41.59 8 XMListUnsubscribeExists 70141 54.75 69.61 47.56 9 XM_B_SpammyWords 69842 51.67 69.32 43.13 10 DKIM_VALID_AU 65192 61.69 64.70 60.23 11 LOC_TINY_FONT_1 49732 34.08 49.36 26.69 12 XM_B_Unicode3 47185 44.03 46.83 42.68 13 XM_B_SpammyWords2 40788 24.66 40.48 17.01 14 RCVD_IN_MSPIKE_H2 40456 36.07 40.15 34.09 15 BAYES_50 39822 52.42 39.52 58.66 16 XM_DK_Undo_02 38906 16.45 38.61 5.72 17 HTML_FONT_LOW_CONTRAST 38686 33.30 38.40 30.84 18 FVGT_m_MULTI_ODD 31648 26.50 31.41 24.13 19 T_KAM_HTML_FONT_INVALID 30964 23.10 30.73 19.40 20 BAYES_99 30925 12.98 30.69 4.41 21 MIME_HTML_ONLY 29806 24.09 29.58 21.43 22 TR_XM_DKIM_Undo 26724 10.21 26.52 2.32 23 BAYES_999 24275 10.16 24.09 3.43 24 DKIM_VALID_EF 24104 27.34 23.92 28.99 25 TR_DCC_Bayes_99 23703 8.83 23.53 1.72 26 XM_Multi_Part_URI 23675 19.40 23.50 17.42 27 XMSubLong 21952 21.93 21.79 22.00 28 DCC_CHECK_NEGATIVE 20462 45.97 20.31 58.38 29 T_TM2_M_HEADER_IN_MSG 20396 23.91 20.24 25.69 30 RELAYCOUNTRY_META 17810 8.32 17.68 3.79 31 UNPARSEABLE_RELAY 17485 13.63 17.35 11.83 32 XM_B_Unsub 17397 12.94 17.27 10.85 33 TR_XM_BayesUnsub 16917 10.39 16.79 7.30 34 TR_XM_DK_Unsub 16423 13.98 16.30 12.85 35 TR_MAX_INTL_RELAY 15903 9.16 15.78 5.96 36 XM_B_SpammyWords3 14461 7.32 14.35 3.92 37 TR_XM_SpammyRelay 13721 5.74 13.62 1.92 38 FSL_BULK_SIG 12319 10.73 12.23 10.01 39 BOTNET 11600 4.55 11.51 1.19 40 BOTNET_IPINHOSTNAME 11124 5.62 11.04 3.00 41 TR_XM_SpammyWords2 10892 3.88 10.81 0.53 42 LOTS_OF_MONEY 10632 6.77 10.55 4.94 43 BAYES_80 10087 5.72 10.01 3.65 44 TR_XM_UnparsRelay 9836 4.39 9.76 1.79 45 XM_Body_Dirty_Words 9796 4.62 9.72 2.16 46 TR_XM_SpammyWords4 9723 5.49 9.65 3.48 47 XM_Evil_Numbers_Gen 8974 8.96 8.91 8.98 48 BAYES_60 8967 9.07 8.90 9.15 49 XM_UncommonTLD01 8816 5.97 8.75 4.63 50 RCVD_IN_BL_SPAMCOP_NET 8644 3.20 8.58 0.60 51 UNTRUSTED_Relay 8114 3.84 8.05 1.81 52 LotsOfNums_01 7533 7.35 7.48 7.29 53 TR_XM_SPAMCOP 7386 2.66 7.33 0.40 54 XM_H_GMP 6582 6.32 6.53 6.22 55 XMSubMetaSx_00 6398 5.52 6.35 5.12 56 RELAYCOUNTRY_CA 6398 2.96 6.35 1.33 57 MPART_ALT_DIFF 6135 4.42 6.09 3.61 58 RCVD_IN_VALIDITY_RPBL 6064 2.03 6.02 0.11 59 HTML_IMAGE_RATIO_02 5937 5.16 5.89 4.80 60 DKIM_INVALID 5868 3.30 5.82 2.08 61 TooManyTo_001 5791 8.25 5.75 9.46 62 TR_XM_SpammyWords5 5714 2.68 5.67 1.24 63 XM_H_Long_From01 5618 5.48 5.58 5.44 64 BAYES_95 5517 3.34 5.48 2.31 65 XM_B_Phish_Phrases 5459 5.46 5.42 5.48 66 T_XMDrugObfuBody_14 5391 2.83 5.35 1.61 67 HTML_IMAGE_RATIO_04 5268 4.54 5.23 4.21 68 XMSexyCombo_05 5135 3.52 5.10 2.76 69 TR_XM_PhishingBody 4906 2.66 4.87 1.59 70 XM_B_PhoneNumber 4730 7.08 4.69 8.23 71 XM_SPF_SoftFail 4581 2.26 4.55 1.16 72 XMStrtUSub 4571 5.21 4.54 5.53 73 DKIM_ADSP_NXDOMAIN 4464 1.70 4.43 0.38 74 TR_XM_NoHeaderRelay 4303 1.60 4.27 0.30 75 XM_B_SpammyTLD 4255 4.85 4.22 5.16 76 XM_B_Investor 4218 2.17 4.19 1.20 77 XMNumbers 3935 3.26 3.91 2.95 78 MIME_HTML_ONLY_MULTI 3788 2.66 3.76 2.12 79 XM_CamelCaseFrm001 3780 2.91 3.75 2.50 80 BOTNET_NORDNS 3704 1.21 3.68 0.01 81 SUBJ_ALL_CAPS 3670 1.97 3.64 1.16 82 XMBody_17 3579 1.56 3.55 0.59 83 XM_UB50 3501 1.88 3.47 1.11 84 XM_OfRef6 3415 1.58 3.39 0.70 85 TM2_M_VERY_LONG_WORD 3385 2.53 3.36 2.13 86 MIME_HTML_MOSTLY 3288 2.53 3.26 2.18 87 MIME_QP_LONG_LINE 3270 5.01 3.25 5.87 88 HTML_IMAGE_RATIO_06 3256 2.60 3.23 2.30 89 NO_DNS_FOR_FROM 3141 1.27 3.12 0.38 90 TR_XM_MaxWHORU 3100 1.22 3.08 0.31 91 T_XMHurry_00 2742 1.30 2.72 0.61 92 RELAYCOUNTRY_AU 2688 1.22 2.67 0.52 93 TM2_M_URI_OPT_OUT 2592 3.09 2.57 3.34 94 DIET_1 2571 1.15 2.55 0.47 95 XM_B_URI_Unicode 2490 1.88 2.47 1.60 96 RCVD_IN_XBL 2478 0.82 2.46 0.02 97 SpammyFromTLD_01 2462 1.23 2.44 0.65 98 HTML_IMAGE_RATIO_08 2459 2.20 2.44 2.08 99 RCVD_IN_PBL 2448 1.26 2.43 0.69 100 XMDiploma_00 2412 1.67 2.39 1.33 101 SpammyFromTLD_02 2405 0.89 2.39 0.17 102 MISSING_HEADERS 2371 1.01 2.35 0.36 103 FROM_EXCESS_BASE64 2351 2.35 2.33 2.35 104 TR_XM_InvalidRelay 2340 0.77 2.32 0.01 105 MAILING_LIST_MULTI 2276 2.62 2.26 2.79 106 ALL_TRUSTED 2271 13.23 2.25 18.54 107 NORDNS_LOW_CONTRAST 2266 0.76 2.25 0.04 108 RCVD_IN_VALIDITY_SAFE 2263 4.64 2.25 5.80 109 RCVD_IN_PSBL 2261 0.80 2.24 0.09 110 XMSubMetaI_00 2256 1.40 2.24 1.00 111 XM_URI_RBL 2254 0.97 2.24 0.35 112 KHOP_HELO_FCRDNS 2242 1.61 2.23 1.31 113 T_XMDrugObfuBody_08 2241 1.55 2.22 1.22 114 RCVD_IN_MSPIKE_H3 2195 3.87 2.18 4.68 115 RCVD_IN_MSPIKE_WL 2195 3.87 2.18 4.68 116 T_TooManySym_01 2179 5.04 2.16 6.44 117 HTML_MIME_NO_HTML_TAG 2153 2.09 2.14 2.07 118 ANY_BOUNCE_MESSAGE 2145 3.36 2.13 3.95 119 BOUNCE_MESSAGE 2145 3.36 2.13 3.95 120 RELAYCOUNTRY_FR 2093 0.84 2.08 0.24 121 REPLYTO_WITHOUT_TO_CC 2086 0.70 2.07 0.03 122 RELAYCOUNTRY_CN 2078 0.71 2.06 0.06 123 TO_NO_BRKTS_FROM_MSSP 2074 0.68 2.06 0.01 124 FROM_MISSP_REPLYTO 2060 0.67 2.04 0.00 125 XM_B_SpammyWords4 2056 0.97 2.04 0.45 126 XPRIO 2025 0.66 2.01 0.01 127 LOADSA_MONEY_COMBO 2009 0.71 1.99 0.09 128 FSL_NEW_HELO_USER 1973 0.64 1.96 0.00 129 FSL_CTYPE_WIN1251 1972 0.64 1.96 0.00 130 FORGED_MUA_OUTLOOK 1971 0.66 1.96 0.04 131 AXB_XMAILER_MIMEOLE_OL_024C2 1968 0.64 1.95 0.00 132 FROM_MISSP_MSFT 1962 0.63 1.95 0.00 133 XMBrknScrpt_02 1960 1.45 1.95 1.21 134 XFER_LOTSA_MONEY 1959 0.64 1.94 0.01 135 FROM_MISSPACED 1957 0.63 1.94 0.00 136 XM_OfRef7 1954 0.74 1.94 0.17 137 TO_NO_BRKTS_MSFT 1953 0.63 1.94 0.00 138 TR_XM_PHPForged 1909 0.75 1.89 0.20 139 FILL_THIS_FORM 1909 0.94 1.89 0.48 140 NSL_RCVD_FROM_USER 1905 0.62 1.89 0.00 141 HK_SCAM 1905 0.62 1.89 0.01 142 TR_XM_PHPDW 1893 0.74 1.88 0.19 143 FROM_MISSP_USER 1882 0.61 1.87 0.00 144 TR_XM_FormFill2 1878 0.74 1.86 0.20 145 XM_Lotto 1873 0.63 1.86 0.03 146 BAYES_40 1868 4.32 1.85 5.51 147 XM_Dr_From 1866 0.72 1.85 0.17 148 RCVD_IN_VALIDITY_CERTIFIED 1863 3.89 1.85 4.88 149 FORGED_OUTLOOK_TAGS 1842 0.60 1.83 0.00 150 XMPhish30 1839 1.03 1.83 0.64 151 FORGED_OUTLOOK_HTML 1838 0.59 1.82 0.00 152 XM_H_PHPOS 1837 0.72 1.82 0.18 153 T_FILL_THIS_FORM_SHORT 1837 1.05 1.82 0.68 154 MONEY_FORM 1831 0.60 1.82 0.01 155 XM_Attn_01 1828 0.64 1.81 0.07 156 XM_OfRef8 1823 0.60 1.81 0.01 157 MILLION_USD 1816 0.59 1.80 0.00 158 TR_XM_INV_DKIM 1812 0.65 1.80 0.09 159 SUSP_UTF8_WORD_SUBJ 1802 0.60 1.79 0.02 160 MONEY_FRAUD_8 1801 0.58 1.79 0.00 161 T_FILL_THIS_FORM_FRAUD_PHISH 1792 0.63 1.78 0.08 162 TR_LOTS_OF_MONEY1 1777 0.59 1.76 0.02 163 T_FILL_THIS_FORM_LOAN 1768 0.60 1.75 0.04 164 MONEY_FROM_MISSP 1768 0.57 1.75 0.00 165 MILLION_HUNDRED 1767 0.57 1.75 0.00 166 ADVANCE_FEE_5_NEW_FRM_MNY 1758 0.57 1.74 0.00 167 LOTTO_DEPT 1745 0.57 1.73 0.00 168 URIBL_CSS_A 1730 0.60 1.72 0.06 169 URIBL_CSS 1730 0.60 1.72 0.06 170 SH_BODYURI_REVERSE_CSS 1724 0.60 1.71 0.06 171 XMHTMLBadTable_001 1723 0.75 1.71 0.28 172 LongTLD 1688 0.68 1.68 0.19 173 XM_UB80 1681 0.55 1.67 0.01 174 FBI_MONEY 1666 0.54 1.65 0.00 175 FBI_SPOOF 1666 0.54 1.65 0.00 176 USER_IN_DEF_DKIM_WL 1664 10.63 1.65 14.98 177 URI_HEX 1648 1.15 1.64 0.92 178 XM_B_Unsub2 1612 1.23 1.60 1.05 179 XMStockSpam_06 1606 1.49 1.59 1.44 180 XM_DK_Undo_01 1571 1.55 1.56 1.54 181 XM_SendGrid 1545 1.36 1.53 1.28 182 XM_B_COPY_HTML 1539 1.09 1.53 0.88 183 TR_Caps_n_Bayes_80 1524 0.53 1.51 0.06 184 XMBounce_01 1520 0.51 1.51 0.02 185 THIS_AD 1479 0.73 1.47 0.38 186 T_XMDrugObfuBody_00 1443 0.92 1.43 0.67 187 BAYES_20 1427 2.68 1.42 3.30 188 T_STY_INVIS_DIRECT 1382 0.69 1.37 0.37 189 XM_B_REG_HTML 1378 0.59 1.37 0.21 190 XMReplyNow 1372 0.62 1.36 0.27 191 DKIM_ADSP_CUSTOM_MED 1317 1.13 1.31 1.04 192 XMSlimDrugH 1259 0.62 1.25 0.32 193 HOSTED_IMG_MULTI_PUB_01 1254 0.47 1.24 0.09 194 RDNS_DYNAMIC 1233 0.59 1.22 0.29 195 PDS_RDNS_DYNAMIC_FP 1212 0.44 1.20 0.07 196 T_REMOTE_IMAGE 1210 2.53 1.20 3.17 197 XM_B_SEO 1199 0.55 1.19 0.24 198 XM_PDF 1197 2.49 1.19 3.12 199 SHOPIFY_IMG_NOT_RCVD_SFY 1189 0.57 1.18 0.28 200 HTML_TAG_BALANCE_BODY 1186 0.71 1.18 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171513 86.76 95.87 82.36 2 RELAYCOUNTRY_US 162357 79.11 81.50 77.96 3 DKIM_SIGNED 153011 77.79 86.73 73.47 4 XM_DK_Pass 150164 75.24 81.72 72.10 5 DKIM_VALID 148679 74.49 80.90 71.39 6 XM_B_Unicode 141209 71.70 79.74 67.80 7 DKIM_VALID_AU 125444 61.69 64.70 60.23 8 BAYES_50 122161 52.42 39.52 58.66 9 DCC_CHECK_NEGATIVE 121578 45.97 20.31 58.38 10 XMListUnsubscribeExists 99054 54.75 69.61 47.56 11 XM_B_SpammyWords 89812 51.67 69.32 43.13 12 XM_B_Unicode3 88886 44.03 46.83 42.68 13 DCC_CHECK 86610 53.74 78.87 41.59 14 RCVD_IN_MSPIKE_H2 70996 36.07 40.15 34.09 15 HTML_FONT_LOW_CONTRAST 64231 33.30 38.40 30.84 16 DKIM_VALID_EF 60378 27.34 23.92 28.99 17 LOC_TINY_FONT_1 55578 34.08 49.36 26.69 18 T_TM2_M_HEADER_IN_MSG 53503 23.91 20.24 25.69 19 FVGT_m_MULTI_ODD 50256 26.50 31.41 24.13 20 XMSubLong 45811 21.93 21.79 22.00 21 MIME_HTML_ONLY 44626 24.09 29.58 21.43 22 T_KAM_HTML_FONT_INVALID 40407 23.10 30.73 19.40 23 ALL_TRUSTED 38606 13.23 2.25 18.54 24 XM_Multi_Part_URI 36278 19.40 23.50 17.42 25 XM_B_SpammyWords2 35420 24.66 40.48 17.01 26 USER_IN_DEF_DKIM_WL 31187 10.63 1.65 14.98 27 TR_XM_DK_Unsub 26769 13.98 16.30 12.85 28 UNPARSEABLE_RELAY 24643 13.63 17.35 11.83 29 BAYES_00 23020 7.70 0.78 11.05 30 XM_B_Unsub 22593 12.94 17.27 10.85 31 FSL_BULK_SIG 20852 10.73 12.23 10.01 32 TooManyTo_001 19704 8.25 5.75 9.46 33 BAYES_60 19046 9.07 8.90 9.15 34 XM_Evil_Numbers_Gen 18710 8.96 8.91 8.98 35 XM_DKIMWhitelistDomains 17626 5.84 0.43 8.46 36 XM_B_PhoneNumber 17148 7.08 4.69 8.23 37 TR_XM_DK_Bayes 15598 5.27 0.67 7.49 38 TR_XM_DK_Bayes1 15474 5.23 0.67 7.43 39 TR_XM_BayesUnsub 15194 10.39 16.79 7.30 40 LotsOfNums_01 15176 7.35 7.48 7.29 41 TR_XM_DK_Bayes2 13742 4.51 0.20 6.60 42 T_TooManySym_01 13406 5.04 2.16 6.44 43 XM_H_GMP 12954 6.32 6.53 6.22 44 TR_MAX_INTL_RELAY 12403 9.16 15.78 5.96 45 MIME_QP_LONG_LINE 12218 5.01 3.25 5.87 46 IN_ZIMBRA_NJ_WHITELIST 12098 3.94 0.08 5.81 47 RCVD_IN_VALIDITY_SAFE 12069 4.64 2.25 5.80 48 XM_DK_Undo_02 11921 16.45 38.61 5.72 49 XMStrtUSub 11525 5.21 4.54 5.53 50 BAYES_40 11482 4.32 1.85 5.51 51 XM_B_Phish_Phrases 11422 5.46 5.42 5.48 52 XM_H_Long_From01 11325 5.48 5.58 5.44 53 XM_B_SpammyTLD 10736 4.85 4.22 5.16 54 XMSubMetaSx_00 10663 5.52 6.35 5.12 55 LOTS_OF_MONEY 10293 6.77 10.55 4.94 56 RCVD_IN_VALIDITY_CERTIFIED 10171 3.89 1.85 4.88 57 HTML_IMAGE_RATIO_02 9993 5.16 5.89 4.80 58 RCVD_IN_MSPIKE_H3 9749 3.87 2.18 4.68 59 RCVD_IN_MSPIKE_WL 9749 3.87 2.18 4.68 60 XM_UncommonTLD01 9636 5.97 8.75 4.63 61 BAYES_99 9177 12.98 30.69 4.41 62 HTML_IMAGE_RATIO_04 8761 4.54 5.23 4.21 63 BOUNCE_MESSAGE 8235 3.36 2.13 3.95 64 ANY_BOUNCE_MESSAGE 8235 3.36 2.13 3.95 65 XM_B_SpammyWords3 8156 7.32 14.35 3.92 66 RELAYCOUNTRY_META 7889 8.32 17.68 3.79 67 URI_NOVOWEL 7812 2.84 0.94 3.75 68 BAYES_80 7599 5.72 10.01 3.65 69 MPART_ALT_DIFF 7512 4.42 6.09 3.61 70 TooManyTo_002 7328 2.71 1.05 3.52 71 T_TooManySym_02 7281 2.51 0.48 3.50 72 TR_XM_SpammyWords4 7254 5.49 9.65 3.48 73 BAYES_999 7135 10.16 24.09 3.43 74 TM2_M_URI_OPT_OUT 6952 3.09 2.57 3.34 75 BAYES_20 6863 2.68 1.42 3.30 76 INVALID_MSGID 6719 2.23 0.16 3.23 77 T_REMOTE_IMAGE 6609 2.53 1.20 3.17 78 XM_PDF 6502 2.49 1.19 3.12 79 TO_MALFORMED 6317 2.05 0.01 3.03 80 BOTNET_IPINHOSTNAME 6240 5.62 11.04 3.00 81 XMNumbers 6137 3.26 3.91 2.95 82 RCVD_IN_IADB_LISTED 5878 2.13 0.71 2.82 83 MAILING_LIST_MULTI 5805 2.62 2.26 2.79 84 XMSexyCombo_05 5752 3.52 5.10 2.76 85 RCVD_IN_IADB_SPF 5310 1.92 0.63 2.55 86 XM_CamelCaseFrm001 5215 2.91 3.75 2.50 87 FROM_EXCESS_BASE64 4902 2.35 2.33 2.35 88 RCVD_IN_IADB_SENDERID 4865 1.77 0.60 2.34 89 TR_XM_DKIM_Undo 4822 10.21 26.52 2.32 90 BAYES_95 4802 3.34 5.48 2.31 91 HTML_IMAGE_RATIO_06 4786 2.60 3.23 2.30 92 RCVD_IN_IADB_DK 4777 1.74 0.60 2.29 93 MIME_HTML_MOSTLY 4540 2.53 3.26 2.18 94 XM_Body_Dirty_Words 4488 4.62 9.72 2.16 95 TM2_M_VERY_LONG_WORD 4442 2.53 3.36 2.13 96 MIME_HTML_ONLY_MULTI 4422 2.66 3.76 2.12 97 HTML_IMAGE_RATIO_08 4339 2.20 2.44 2.08 98 DKIM_INVALID 4332 3.30 5.82 2.08 99 HTML_MIME_NO_HTML_TAG 4304 2.09 2.14 2.07 100 BAYES_05 4107 1.52 0.59 1.97 101 TR_XM_SpammyRelay 4007 5.74 13.62 1.92 102 XM_B_FormFill 3820 1.24 0.01 1.83 103 UNTRUSTED_Relay 3762 3.84 8.05 1.81 104 TR_XM_UnparsRelay 3727 4.39 9.76 1.79 105 IN_HORDE_ADDRESS_BOOK 3628 1.24 0.20 1.74 106 TR_DCC_Bayes_99 3592 8.83 23.53 1.72 107 RCVD_IN_IADB_VOUCHED 3448 1.22 0.31 1.66 108 T_XMDrugObfuBody_14 3352 2.83 5.35 1.61 109 XM_B_URI_Unicode 3331 1.88 2.47 1.60 110 TR_XM_PhishingBody 3313 2.66 4.87 1.59 111 TVD_SPACE_RATIO 3303 1.11 0.13 1.59 112 XM_DK_Undo_01 3217 1.55 1.56 1.54 113 XM_TLDProd2 3004 1.04 0.20 1.44 114 XMStockSpam_06 2995 1.49 1.59 1.44 115 TR_Symld_Words 2855 1.25 1.00 1.37 116 TooManyTo_003 2850 1.24 0.98 1.37 117 RELAYCOUNTRY_CA 2762 2.96 6.35 1.33 118 XMDiploma_00 2762 1.67 2.39 1.33 119 KHOP_HELO_FCRDNS 2731 1.61 2.23 1.31 120 XM_SendGrid 2673 1.36 1.53 1.28 121 T_TooManySym_03 2622 0.93 0.25 1.26 122 TR_XM_SpammyWords5 2576 2.68 5.67 1.24 123 T_XMDrugObfuBody_08 2543 1.55 2.22 1.22 124 XMGappySubj_01 2532 0.90 0.25 1.22 125 RCVD_IN_IADB_OPTIN 2527 0.88 0.19 1.21 126 XMBrknScrpt_02 2527 1.45 1.95 1.21 127 XMSubMetaSxObfu_03 2512 1.16 1.08 1.21 128 XM_B_Investor 2492 2.17 4.19 1.20 129 BOTNET 2472 4.55 11.51 1.19 130 SUBJ_ALL_CAPS 2413 1.97 3.64 1.16 131 XM_SPF_SoftFail 2412 2.26 4.55 1.16 132 XM_GoogleGroups 2372 0.99 0.67 1.14 133 XM_UB50 2303 1.88 3.47 1.11 134 TooManyTo_004 2285 1.05 0.95 1.10 135 XMBody_95 2194 0.74 0.08 1.05 136 XM_B_Unsub2 2178 1.23 1.60 1.05 137 DKIM_ADSP_CUSTOM_MED 2167 1.13 1.31 1.04 138 XMSubMetaI_00 2076 1.40 2.24 1.00 139 XM_H_Long_From02 2042 0.87 0.64 0.98 140 TooManyTo_005 1964 0.94 0.92 0.94 141 URI_HEX 1909 1.15 1.64 0.92 142 XMSubMetaSx_01 1863 0.68 0.22 0.89 143 XM_B_COPY_HTML 1834 1.09 1.53 0.88 144 HTML_IMAGE_ONLY_32 1813 0.64 0.17 0.87 145 TR_MetaPhish_Combo_01 1747 0.92 1.08 0.84 146 XM_B_DNDMA 1741 0.79 0.70 0.84 147 XMGappySubj_02 1740 0.62 0.17 0.84 148 T_TVD_MIME_NO_HEADERS 1730 0.58 0.06 0.83 149 TR_XM_DK_SendGrid 1680 0.79 0.74 0.81 150 TVD_RCVD_IP 1592 0.88 1.13 0.76 151 XMLngstWrd_00 1590 0.67 0.47 0.76 152 NML_ADSP_CUSTOM_MED 1558 0.87 1.11 0.75 153 XMBdyGiftCard01 1508 0.77 0.85 0.72 154 XMNoVowels 1467 0.61 0.41 0.70 155 XM_OfRef6 1459 1.58 3.39 0.70 156 T_OBFU_PDF_ATTACH 1454 0.75 0.86 0.70 157 BASE64_LENGTH_79_INF 1445 0.75 0.87 0.69 158 URI_TRY_3LD 1438 0.78 0.98 0.69 159 FORGED_GMAIL_RCVD 1431 0.78 0.96 0.69 160 RCVD_IN_PBL 1431 1.26 2.43 0.69 161 T_FILL_THIS_FORM_SHORT 1422 1.05 1.82 0.68 162 T_XMDrugObfuBody_00 1395 0.92 1.43 0.67 163 XMCapTrack 1360 0.67 0.69 0.65 164 XM_H_PHPMailer 1354 0.68 0.74 0.65 165 USER_IN_WHITELIST 1347 0.44 0.00 0.65 166 USER_IN_WELCOMELIST 1347 0.44 0.00 0.65 167 SpammyFromTLD_01 1346 1.23 2.44 0.65 168 XMPhish30 1338 1.03 1.83 0.64 169 XMGenDplmaNmb 1311 0.68 0.79 0.63 170 T_XMHurry_00 1269 1.30 2.72 0.61 171 RCVD_IN_BL_SPAMCOP_NET 1249 3.20 8.58 0.60 172 TR_XM_Base64_M1 1246 0.73 1.00 0.60 173 XMBody_17 1236 1.56 3.55 0.59 174 TM2_M_OBFU_COMMENT 1235 0.73 1.02 0.59 175 HTTPS_HTTP_MISMATCH 1166 0.72 1.06 0.56 176 XM_ShortIntro_01 1111 0.54 0.55 0.53 177 TR_XM_SpammyWords2 1098 3.88 10.81 0.53 178 HTML_IMAGE_ONLY_20 1093 0.47 0.36 0.52 179 PLING_QUERY 1091 0.60 0.77 0.52 180 RELAYCOUNTRY_AU 1083 1.22 2.67 0.52 181 HELO_NO_DOMAIN 1036 0.39 0.16 0.50 182 HELO_NODOT 1036 0.39 0.16 0.50 183 HTML_TAG_BALANCE_BODY 1022 0.71 1.18 0.49 184 T_TooManySym_04 1021 0.34 0.03 0.49 185 XMBSHREFv2 1002 0.43 0.32 0.48 186 XMClaimOffer 1001 0.51 0.56 0.48 187 FILL_THIS_FORM 994 0.94 1.89 0.48 188 MSGID_FROM_MTA_HEADER 977 0.37 0.17 0.47 189 DIET_1 975 1.15 2.55 0.47 190 XM_B_SpammyWords4 945 0.97 2.04 0.45 191 XMSubNoVowel 913 0.51 0.66 0.44 192 XMLngstWrd_01 881 0.40 0.37 0.42 193 MIME_CHARSET_FARAWAY 881 0.47 0.57 0.42 194 XM_B_Phish66 876 0.61 1.00 0.42 195 XM_ProductURIs 855 0.60 1.01 0.41 196 MPART_ALT_DIFF_COUNT 850 0.60 0.99 0.41 197 T_Symld_Words_02 841 0.55 0.86 0.40 198 TR_XM_SPAMCOP 831 2.66 7.33 0.40 199 HTML_FONT_FACE_BAD 809 0.51 0.76 0.39 200 HTML_IMAGE_ONLY_28 798 0.31 0.15 0.38 ----------------------------------------------------------------------