Email: 449863 Autolearn: 0 AvgScore: 4.18 AvgScanTime: 1.26 sec Spam: 127953 Autolearn: 0 AvgScore: 14.89 AvgScanTime: 1.43 sec Ham: 321910 Autolearn: 0 AvgScore: -0.08 AvgScanTime: 1.19 sec Time Spent Running SA: 156.97 hours Time Spent Processing Spam: 50.72 hours Time Spent Processing Ham: 106.25 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 119844 88.76 93.66 86.81 2 DKIM_SIGNED 112106 76.83 87.61 72.54 3 XM_DK_Pass 107426 74.76 83.96 71.11 4 RELAYCOUNTRY_US 106358 79.45 83.12 77.99 5 XM_B_Unicode 105155 72.14 82.18 68.15 6 DKIM_VALID 104623 73.31 81.77 69.95 7 DCC_CHECK 96468 46.95 75.39 35.65 8 XM_B_SpammyWords 90287 52.08 70.56 44.73 9 XMListUnsubscribeExists 87799 50.18 68.62 42.85 10 DKIM_VALID_AU 83033 58.64 64.89 56.16 11 XM_B_Unicode3 62682 40.60 48.99 37.26 12 LOC_TINY_FONT_1 62564 30.06 48.90 22.57 13 BAYES_50 53059 55.67 41.47 61.31 14 XM_B_SpammyWords2 52772 26.00 41.24 19.94 15 XM_DK_Undo_02 48439 14.21 37.86 4.80 16 HTML_FONT_LOW_CONTRAST 47788 29.08 37.35 25.80 17 RCVD_IN_MSPIKE_H2 45583 34.07 35.62 33.45 18 FVGT_m_MULTI_ODD 42867 25.89 33.50 22.86 19 BAYES_99 39930 11.28 31.21 3.36 20 T_KAM_HTML_FONT_INVALID 39833 22.14 31.13 18.57 21 TR_XM_DKIM_Undo 34894 9.05 27.27 1.81 22 MIME_HTML_ONLY 34667 20.71 27.09 18.17 23 DKIM_VALID_EF 32654 29.58 25.52 31.19 24 XMSubLong 30853 22.72 24.11 22.17 25 BAYES_999 30672 8.68 23.97 2.60 26 TR_DCC_Bayes_99 29615 7.45 23.15 1.21 27 T_TM2_M_HEADER_IN_MSG 29504 30.14 23.06 32.96 28 DCC_CHECK_NEGATIVE 29030 52.46 22.69 64.29 29 XM_Multi_Part_URI 27516 15.11 21.50 12.57 30 XM_B_Unsub 21714 11.22 16.97 8.94 31 TR_XM_DK_Unsub 21593 13.36 16.88 11.97 32 TR_XM_BayesUnsub 20992 9.65 16.41 6.97 33 UNPARSEABLE_RELAY 20559 13.46 16.07 12.43 34 RELAYCOUNTRY_META 19538 7.12 15.27 3.87 35 XM_B_SpammyWords3 18694 6.91 14.61 3.85 36 TR_MAX_INTL_RELAY 17974 7.81 14.05 5.34 37 BOTNET_IPINHOSTNAME 16181 5.72 12.65 2.96 38 LOTS_OF_MONEY 15568 8.61 12.17 7.19 39 TR_XM_SpammyWords2 14749 3.48 11.53 0.28 40 TR_XM_SpammyRelay 14450 4.62 11.29 1.96 41 TR_XM_SpammyWords4 14115 6.97 11.03 5.36 42 XM_Evil_Numbers_Gen 12203 8.61 9.54 8.25 43 BOTNET 11765 3.63 9.19 1.42 44 FSL_BULK_SIG 11617 7.52 9.08 6.89 45 LotsOfNums_01 11599 7.81 9.07 7.31 46 BAYES_80 11017 4.81 8.61 3.30 47 TR_XM_UnparsRelay 10862 3.45 8.49 1.44 48 XM_B_Phish_Phrases 10577 6.03 8.27 5.14 49 BAYES_60 10413 7.99 8.14 7.93 50 XM_Body_Dirty_Words 10092 3.64 7.89 1.96 51 XM_UncommonTLD01 9398 5.09 7.34 4.19 52 HTML_IMAGE_RATIO_02 8377 5.02 6.55 4.41 53 XMSubMetaSx_00 8291 5.54 6.48 5.17 54 XM_B_PhoneNumber 7749 8.63 6.06 9.65 55 UNTRUSTED_Relay 7626 2.74 5.96 1.46 56 RCVD_IN_BL_SPAMCOP_NET 7573 2.11 5.92 0.59 57 DKIM_INVALID 7483 3.51 5.85 2.59 58 MPART_ALT_DIFF 7349 4.46 5.74 3.95 59 RELAYCOUNTRY_CA 7065 2.50 5.52 1.31 60 XM_H_Long_From01 6816 5.05 5.33 4.94 61 XM_H_GMP 6778 5.73 5.30 5.90 62 XM_B_Investor 6422 2.43 5.02 1.40 63 BAYES_95 6403 2.88 5.00 2.04 64 TR_XM_PhishingBody 6045 2.20 4.72 1.20 65 TR_XM_SPAMCOP 6001 1.53 4.69 0.28 66 TooManyTo_001 5955 9.24 4.65 11.07 67 TM2_M_VERY_LONG_WORD 5575 2.37 4.36 1.58 68 XM_B_SpammyTLD 5531 2.82 4.32 2.23 69 TR_XM_SpammyWords5 5519 2.15 4.31 1.29 70 T_XMDrugObfuBody_14 5478 2.60 4.28 1.94 71 XMStrtUSub 5152 4.10 4.03 4.13 72 XMSexyCombo_05 5058 1.84 3.95 1.00 73 XMNumbers 4739 3.03 3.70 2.76 74 MIME_HTML_MOSTLY 4721 2.82 3.69 2.47 75 HTML_IMAGE_RATIO_04 4698 3.59 3.67 3.56 76 MIME_HTML_ONLY_MULTI 4585 2.64 3.58 2.26 77 TM2_M_URI_OPT_OUT 4495 2.66 3.51 2.31 78 HTML_IMAGE_RATIO_06 4290 2.63 3.35 2.35 79 XM_SPF_SoftFail 4132 1.97 3.23 1.46 80 XM_CamelCaseFrm001 4099 2.42 3.20 2.11 81 T_XMDrugObfuBody_08 4027 1.81 3.15 1.28 82 RCVD_IN_MSPIKE_WL 4003 4.68 3.13 5.29 83 RCVD_IN_MSPIKE_H3 4003 4.68 3.13 5.29 84 XM_UB50 3964 1.52 3.10 0.90 85 XM_B_SpammyWords4 3956 1.43 3.09 0.78 86 XMDiploma_00 3921 2.14 3.06 1.77 87 RCVD_IN_VALIDITY_RPBL 3901 0.94 3.05 0.10 88 XM_URI_RBL 3766 1.08 2.94 0.34 89 XM_OfRef6 3641 2.54 2.85 2.42 90 RELAYCOUNTRY_AU 3631 1.22 2.84 0.58 91 MIME_QP_LONG_LINE 3585 4.69 2.80 5.44 92 XM_B_URI_Unicode 3568 2.31 2.79 2.12 93 FROM_EXCESS_BASE64 3474 1.96 2.72 1.66 94 XMBody_17 3384 1.04 2.64 0.41 95 T_TooManySym_01 3134 5.44 2.45 6.63 96 XM_B_Unsub2 3107 1.82 2.43 1.57 97 SpammyFromTLD_02 3099 0.87 2.42 0.26 98 HTML_IMAGE_RATIO_08 2976 2.25 2.33 2.21 99 MAILING_LIST_MULTI 2932 2.81 2.29 3.02 100 T_XMDrugObfuBody_00 2869 1.13 2.24 0.68 101 SUBJ_ALL_CAPS 2842 1.69 2.22 1.48 102 RCVD_IN_VALIDITY_SAFE 2689 3.38 2.10 3.89 103 TR_XM_NoHeaderRelay 2645 0.75 2.07 0.23 104 HTML_MIME_NO_HTML_TAG 2615 2.35 2.04 2.47 105 T_REMOTE_IMAGE 2458 3.17 1.92 3.66 106 SpammyFromTLD_01 2447 1.17 1.91 0.88 107 LongTLD 2428 0.85 1.90 0.44 108 RCVD_IN_ZEN_LASTEXTERNAL 2403 0.53 1.88 0.00 109 SHORTCIRCUIT 2403 0.53 1.88 0.00 110 TR_Mismatch_TLD_02 2314 0.57 1.81 0.07 111 BAYES_40 2308 4.72 1.80 5.89 112 RCVD_IN_VALIDITY_CERTIFIED 2292 2.86 1.79 3.28 113 XMStockSpam_06 2292 1.41 1.79 1.26 114 ALL_TRUSTED 2268 13.98 1.77 18.83 115 TR_XM_PHPForged 2191 0.86 1.71 0.52 116 DIET_1 2186 0.70 1.71 0.30 117 HTTPS_HTTP_MISMATCH 2171 1.08 1.70 0.84 118 NO_DNS_FOR_FROM 2168 0.72 1.69 0.34 119 USER_IN_DEF_DKIM_WL 2165 8.77 1.69 11.58 120 TR_XM_MaxWHORU 2159 0.69 1.69 0.29 121 TR_XM_PHPDW 2151 0.85 1.68 0.52 122 TR_XM_FormFill2 2121 0.85 1.66 0.52 123 XM_DK_Undo_01 2103 1.75 1.64 1.79 124 XM_H_PHPOS 2092 0.83 1.63 0.51 125 T_XMHurry_00 2076 1.30 1.62 1.17 126 XM_B_REG_HTML 2011 0.60 1.57 0.21 127 XM_B_SEO 2006 0.65 1.57 0.29 128 DKIM_ADSP_CUSTOM_MED 1968 1.09 1.54 0.92 129 XM_SendGrid 1954 1.47 1.53 1.45 130 XMPhish30 1932 0.72 1.51 0.41 131 XMBrknScrpt_02 1913 1.09 1.50 0.93 132 XM_B_COPY_HTML 1912 0.88 1.49 0.64 133 URI_HEX 1897 1.16 1.48 1.03 134 KHOP_HELO_FCRDNS 1871 1.60 1.46 1.65 135 DKIM_ADSP_NXDOMAIN 1841 0.64 1.44 0.32 136 XMGenDplmaNmb 1823 1.13 1.42 1.01 137 TR_XM_INV_DKIM 1815 0.46 1.42 0.08 138 RCVD_IN_PBL 1782 0.98 1.39 0.82 139 XMBody_78 1756 0.57 1.37 0.25 140 RCVD_IN_PSBL 1746 0.47 1.36 0.12 141 TR_XM_Base64_M1 1736 0.89 1.36 0.70 142 T_FILL_THIS_FORM_SHORT 1719 1.08 1.34 0.97 143 XM_H_Long_From02 1682 1.05 1.31 0.94 144 SUSP_UTF8_WORD_SUBJ 1616 0.37 1.26 0.01 145 TR_Symld_Words 1589 1.64 1.24 1.80 146 TR_XM_COVIDMETA4 1585 0.42 1.24 0.09 147 THIS_AD 1563 0.64 1.22 0.41 148 TR_LOTS_OF_MONEY3 1544 0.45 1.21 0.16 149 NML_ADSP_CUSTOM_MED 1525 0.78 1.19 0.62 150 FORGED_GMAIL_RCVD 1520 0.73 1.19 0.55 151 XM_B_Phish66 1514 0.54 1.18 0.28 152 XM_ProductURIs 1476 0.59 1.15 0.37 153 RDNS_DYNAMIC 1473 0.57 1.15 0.34 154 XMReplyNow 1464 0.50 1.14 0.25 155 PDS_RDNS_DYNAMIC_FP 1450 0.46 1.13 0.20 156 TR_XM_SEO4 1440 0.43 1.13 0.15 157 XMBdyGiftCard01 1432 0.75 1.12 0.60 158 RCVD_IN_IADB_LISTED 1424 2.73 1.11 3.37 159 TR_MetaPhish_Combo_01 1421 0.72 1.11 0.57 160 FROM_SUSPICIOUS_NTLD 1416 0.35 1.11 0.05 161 TR_LOTS_OF_MONEY2 1393 0.46 1.09 0.21 162 T_MONEY_PERCENT 1393 0.46 1.09 0.21 163 XMPhish08 1377 0.38 1.08 0.11 164 TM2_M_OBFU_COMMENT 1363 0.60 1.07 0.41 165 TooManyTo_002 1361 3.76 1.06 4.83 166 NORDNS_LOW_CONTRAST 1353 0.34 1.06 0.05 167 XM_ShortIntro_01 1336 0.93 1.04 0.88 168 T_Symld_Words_02 1329 0.67 1.04 0.52 169 RELAYCOUNTRY_FR 1320 0.45 1.03 0.22 170 TVD_RCVD_IP 1305 0.69 1.02 0.56 171 MPART_ALT_DIFF_COUNT 1302 0.69 1.02 0.56 172 XM_B_COVIDMETA 1296 0.45 1.01 0.22 173 XM_HighProb1 1290 0.29 1.01 0.00 174 FROM_SUSPICIOUS_NTLD_FP 1279 0.30 1.00 0.02 175 HTML_TAG_BALANCE_BODY 1270 0.60 0.99 0.44 176 TR_XM_RelayPhish 1268 0.34 0.99 0.08 177 XMHTML_After_End 1249 0.51 0.98 0.33 178 XMSubMetaI_00 1240 0.58 0.97 0.42 179 TooManyTo_003 1238 2.83 0.97 3.57 180 URI_NOVOWEL 1224 1.05 0.96 1.08 181 XM_UB99 1222 0.27 0.96 0.00 182 BOTNET_NORDNS 1215 0.28 0.95 0.01 183 XMSlimDrugH 1173 0.58 0.92 0.45 184 RCVD_IN_IADB_SPF 1168 2.39 0.91 2.98 185 BAYES_20 1151 3.02 0.90 3.86 186 TooManyTo_004 1141 2.47 0.89 3.10 187 XMSexyCombo_01 1141 0.36 0.89 0.15 188 RCVD_IN_SORBS_DUL 1130 0.29 0.88 0.05 189 SHOPIFY_IMG_NOT_RCVD_SFY 1126 0.38 0.88 0.18 190 XM_B_DNDMA 1100 0.73 0.86 0.68 191 AC_BR_BONANZA 1097 0.31 0.86 0.10 192 XMMoneyMeta_00 1090 0.60 0.85 0.50 193 RCVD_IN_XBL 1089 0.27 0.85 0.04 194 T_STY_INVIS_DIRECT 1088 0.45 0.85 0.30 195 RCVD_IN_IADB_SENDERID 1086 2.18 0.85 2.70 196 HELO_DYNAMIC_SPLIT_IP 1084 0.25 0.85 0.02 197 XMSubMetaSxObfu_03 1082 1.56 0.85 1.84 198 RCVD_IN_IADB_DK 1080 2.12 0.84 2.63 199 TooManyTo_005 1061 2.29 0.83 2.87 200 TR_XM_Base64_L1 1052 0.29 0.82 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279435 88.76 93.66 86.81 2 RELAYCOUNTRY_US 251063 79.45 83.12 77.99 3 DKIM_SIGNED 233510 76.83 87.61 72.54 4 XM_DK_Pass 228907 74.76 83.96 71.11 5 DKIM_VALID 225182 73.31 81.77 69.95 6 XM_B_Unicode 219366 72.14 82.18 68.15 7 DCC_CHECK_NEGATIVE 206960 52.46 22.69 64.29 8 BAYES_50 197363 55.67 41.47 61.31 9 DKIM_VALID_AU 180776 58.64 64.89 56.16 10 XM_B_SpammyWords 144004 52.08 70.56 44.73 11 XMListUnsubscribeExists 137954 50.18 68.62 42.85 12 XM_B_Unicode3 119958 40.60 48.99 37.26 13 DCC_CHECK 114748 46.95 75.39 35.65 14 RCVD_IN_MSPIKE_H2 107679 34.07 35.62 33.45 15 T_TM2_M_HEADER_IN_MSG 106107 30.14 23.06 32.96 16 DKIM_VALID_EF 100397 29.58 25.52 31.19 17 HTML_FONT_LOW_CONTRAST 83048 29.08 37.35 25.80 18 FVGT_m_MULTI_ODD 73586 25.89 33.50 22.86 19 LOC_TINY_FONT_1 72647 30.06 48.90 22.57 20 XMSubLong 71366 22.72 24.11 22.17 21 XM_B_SpammyWords2 64179 26.00 41.24 19.94 22 ALL_TRUSTED 60620 13.98 1.77 18.83 23 T_KAM_HTML_FONT_INVALID 59779 22.14 31.13 18.57 24 MIME_HTML_ONLY 58483 20.71 27.09 18.17 25 XM_Multi_Part_URI 40460 15.11 21.50 12.57 26 UNPARSEABLE_RELAY 40014 13.46 16.07 12.43 27 TR_XM_DK_Unsub 38528 13.36 16.88 11.97 28 USER_IN_DEF_DKIM_WL 37293 8.77 1.69 11.58 29 TooManyTo_001 35622 9.24 4.65 11.07 30 BAYES_00 32925 7.47 0.55 10.23 31 XM_B_PhoneNumber 31072 8.63 6.06 9.65 32 XM_B_Unsub 28774 11.22 16.97 8.94 33 XM_Evil_Numbers_Gen 26546 8.61 9.54 8.25 34 BAYES_60 25518 7.99 8.14 7.93 35 LotsOfNums_01 23540 7.81 9.07 7.31 36 XM_DKIMWhitelistDomains 23440 5.22 0.05 7.28 37 LOTS_OF_MONEY 23157 8.61 12.17 7.19 38 IN_ZIMBRA_NJ_WHITELIST 23150 5.17 0.09 7.19 39 TR_XM_BayesUnsub 22442 9.65 16.41 6.97 40 FSL_BULK_SIG 22194 7.52 9.08 6.89 41 T_TooManySym_01 21336 5.44 2.45 6.63 42 TR_XM_DK_Bayes 20216 4.61 0.42 6.28 43 TR_XM_DK_Bayes1 19902 4.54 0.42 6.18 44 XM_H_GMP 18995 5.73 5.30 5.90 45 BAYES_40 18946 4.72 1.80 5.89 46 MIME_QP_LONG_LINE 17508 4.69 2.80 5.44 47 TR_XM_SpammyWords4 17243 6.97 11.03 5.36 48 TR_MAX_INTL_RELAY 17177 7.81 14.05 5.34 49 TR_XM_DK_Bayes2 17152 3.89 0.27 5.33 50 RCVD_IN_MSPIKE_H3 17033 4.68 3.13 5.29 51 RCVD_IN_MSPIKE_WL 17033 4.68 3.13 5.29 52 XMSubMetaSx_00 16650 5.54 6.48 5.17 53 XM_B_Phish_Phrases 16555 6.03 8.27 5.14 54 XM_H_Long_From01 15899 5.05 5.33 4.94 55 TooManyTo_002 15552 3.76 1.06 4.83 56 XM_PDF 15513 3.66 0.73 4.82 57 XM_DK_Undo_02 15467 14.21 37.86 4.80 58 HTML_IMAGE_RATIO_02 14203 5.02 6.55 4.41 59 XM_UncommonTLD01 13482 5.09 7.34 4.19 60 XMStrtUSub 13295 4.10 4.03 4.13 61 MPART_ALT_DIFF 12726 4.46 5.74 3.95 62 RCVD_IN_VALIDITY_SAFE 12528 3.38 2.10 3.89 63 RELAYCOUNTRY_META 12470 7.12 15.27 3.87 64 BAYES_20 12431 3.02 0.90 3.86 65 XM_B_SpammyWords3 12400 6.91 14.61 3.85 66 T_REMOTE_IMAGE 11791 3.17 1.92 3.66 67 BOUNCE_MESSAGE 11604 2.79 0.74 3.60 68 ANY_BOUNCE_MESSAGE 11604 2.79 0.74 3.60 69 TooManyTo_003 11490 2.83 0.97 3.57 70 HTML_IMAGE_RATIO_04 11455 3.59 3.67 3.56 71 RCVD_IN_IADB_LISTED 10853 2.73 1.11 3.37 72 BAYES_99 10817 11.28 31.21 3.36 73 BAYES_80 10618 4.81 8.61 3.30 74 RCVD_IN_VALIDITY_CERTIFIED 10573 2.86 1.79 3.28 75 TooManyTo_004 9972 2.47 0.89 3.10 76 MAILING_LIST_MULTI 9706 2.81 2.29 3.02 77 RCVD_IN_IADB_SPF 9606 2.39 0.91 2.98 78 BOTNET_IPINHOSTNAME 9538 5.72 12.65 2.96 79 T_TooManySym_02 9472 2.31 0.72 2.94 80 TooManyTo_005 9239 2.29 0.83 2.87 81 XMNumbers 8876 3.03 3.70 2.76 82 RCVD_IN_IADB_SENDERID 8702 2.18 0.85 2.70 83 RCVD_IN_IADB_DK 8478 2.12 0.84 2.63 84 BAYES_999 8370 8.68 23.97 2.60 85 DKIM_INVALID 8328 3.51 5.85 2.59 86 HTML_MIME_NO_HTML_TAG 7964 2.35 2.04 2.47 87 MIME_HTML_MOSTLY 7948 2.82 3.69 2.47 88 XM_OfRef6 7790 2.54 2.85 2.42 89 HTML_IMAGE_RATIO_06 7555 2.63 3.35 2.35 90 TM2_M_URI_OPT_OUT 7450 2.66 3.51 2.31 91 INVALID_MSGID 7284 1.69 0.25 2.26 92 MIME_HTML_ONLY_MULTI 7274 2.64 3.58 2.26 93 XM_B_SpammyTLD 7172 2.82 4.32 2.23 94 HTML_IMAGE_RATIO_08 7130 2.25 2.33 2.21 95 RCVD_IN_IADB_VOUCHED 6853 1.71 0.65 2.13 96 XM_B_URI_Unicode 6838 2.31 2.79 2.12 97 XM_CamelCaseFrm001 6799 2.42 3.20 2.11 98 BAYES_05 6738 1.62 0.44 2.09 99 BAYES_95 6551 2.88 5.00 2.04 100 HTML_IMAGE_ONLY_32 6523 1.51 0.21 2.03 101 TO_MALFORMED 6500 1.45 0.01 2.02 102 TR_XM_SpammyRelay 6323 4.62 11.29 1.96 103 XM_Body_Dirty_Words 6296 3.64 7.89 1.96 104 T_XMDrugObfuBody_14 6240 2.60 4.28 1.94 105 FILL_THIS_FORM 6223 1.43 0.18 1.93 106 XMSubMetaSxObfu_03 5926 1.56 0.85 1.84 107 TR_XM_DKIM_Undo 5835 9.05 27.27 1.81 108 TR_Symld_Words 5784 1.64 1.24 1.80 109 XM_DK_Undo_01 5771 1.75 1.64 1.79 110 XMDiploma_00 5686 2.14 3.06 1.77 111 FROM_EXCESS_BASE64 5359 1.96 2.72 1.66 112 KHOP_HELO_FCRDNS 5326 1.60 1.46 1.65 113 TM2_M_VERY_LONG_WORD 5080 2.37 4.36 1.58 114 XM_B_Unsub2 5062 1.82 2.43 1.57 115 T_FILL_THIS_FORM_LOAN 4908 1.10 0.04 1.52 116 SUBJ_ALL_CAPS 4779 1.69 2.22 1.48 117 IN_HORDE_ADDRESS_BOOK 4729 1.09 0.14 1.47 118 XM_SPF_SoftFail 4714 1.97 3.23 1.46 119 UNTRUSTED_Relay 4686 2.74 5.96 1.46 120 XM_SendGrid 4673 1.47 1.53 1.45 121 TR_XM_UnparsRelay 4642 3.45 8.49 1.44 122 RCVD_IN_IADB_OPTIN 4603 1.12 0.35 1.43 123 BOTNET 4559 3.63 9.19 1.42 124 XM_B_Investor 4502 2.43 5.02 1.40 125 HELO_NODOT 4419 1.11 0.45 1.37 126 HELO_NO_DOMAIN 4417 1.11 0.45 1.37 127 XM_GoogleGroups 4317 1.16 0.72 1.34 128 RELAYCOUNTRY_CA 4202 2.50 5.52 1.31 129 XMCapTrack 4191 1.10 0.60 1.30 130 TR_XM_SpammyWords5 4166 2.15 4.31 1.29 131 T_XMDrugObfuBody_08 4112 1.81 3.15 1.28 132 XMStockSpam_06 4040 1.41 1.79 1.26 133 TVD_SPACE_RATIO 4037 0.95 0.20 1.25 134 XMGappySubj_01 4030 0.96 0.22 1.25 135 TR_DCC_Bayes_99 3900 7.45 23.15 1.21 136 TR_XM_PhishingBody 3863 2.20 4.72 1.20 137 T_XMHurry_00 3776 1.30 1.62 1.17 138 T_TooManySym_03 3501 0.86 0.28 1.09 139 URI_NOVOWEL 3490 1.05 0.96 1.08 140 URI_HEX 3303 1.16 1.48 1.03 141 TR_XM_DK_SendGrid 3291 0.95 0.77 1.02 142 XMGenDplmaNmb 3245 1.13 1.42 1.01 143 XMSexyCombo_05 3209 1.84 3.95 1.00 144 T_FILL_THIS_FORM_SHORT 3131 1.08 1.34 0.97 145 XM_H_Long_From02 3042 1.05 1.31 0.94 146 XMBrknScrpt_02 2995 1.09 1.50 0.93 147 DKIM_ADSP_CUSTOM_MED 2946 1.09 1.54 0.92 148 FROM_GOV_DKIM_AU 2926 0.69 0.14 0.91 149 XM_UB50 2882 1.52 3.10 0.90 150 XM_ShortIntro_01 2828 0.93 1.04 0.88 151 SpammyFromTLD_01 2817 1.17 1.91 0.88 152 XMGappySubj_02 2765 0.63 0.05 0.86 153 XMNoVowels 2757 0.80 0.64 0.86 154 HTTPS_HTTP_MISMATCH 2696 1.08 1.70 0.84 155 RCVD_IN_PBL 2633 0.98 1.39 0.82 156 XM_B_SpammyWords4 2499 1.43 3.09 0.78 157 URI_TRY_3LD 2464 0.76 0.75 0.77 158 T_XMDrugObfuBody_12 2409 0.68 0.52 0.75 159 TR_XM_Base64_M1 2251 0.89 1.36 0.70 160 XMBody_95 2217 0.54 0.18 0.69 161 T_XMDrugObfuBody_00 2205 1.13 2.24 0.68 162 XM_B_DNDMA 2181 0.73 0.86 0.68 163 XMLngstWrd_00 2159 0.63 0.54 0.67 164 T_TVD_MIME_NO_HEADERS 2148 0.49 0.04 0.67 165 XM_B_FormFill 2138 0.49 0.05 0.66 166 XM_B_COPY_HTML 2047 0.88 1.49 0.64 167 NML_ADSP_CUSTOM_MED 2005 0.78 1.19 0.62 168 XMBdyGiftCard01 1924 0.75 1.12 0.60 169 XM_H_PHPMailer 1915 0.65 0.80 0.59 170 RCVD_IN_BL_SPAMCOP_NET 1901 2.11 5.92 0.59 171 RELAYCOUNTRY_AU 1865 1.22 2.84 0.58 172 TR_MetaPhish_Combo_01 1831 0.72 1.11 0.57 173 TVD_RCVD_IP 1816 0.69 1.02 0.56 174 T_OBFU_PDF_ATTACH 1800 0.44 0.15 0.56 175 MISSING_HEADERS 1798 0.62 0.77 0.56 176 MPART_ALT_DIFF_COUNT 1795 0.69 1.02 0.56 177 FORGED_GMAIL_RCVD 1768 0.73 1.19 0.55 178 TR_XM_FormFill2 1684 0.85 1.66 0.52 179 T_Symld_Words_02 1681 0.67 1.04 0.52 180 TR_XM_PHPForged 1673 0.86 1.71 0.52 181 TR_XM_PHPDW 1669 0.85 1.68 0.52 182 XM_H_PHPOS 1644 0.83 1.63 0.51 183 XMLngstWrd_01 1643 0.50 0.46 0.51 184 MSGID_FROM_MTA_HEADER 1625 0.39 0.11 0.50 185 TO_NO_BRKTS_HTML_ONLY 1618 0.56 0.72 0.50 186 XMMoneyMeta_00 1606 0.60 0.85 0.50 187 T_MANY_PILL_PRICE 1571 0.35 0.01 0.49 188 HTML_IMAGE_ONLY_28 1525 0.42 0.28 0.47 189 XMDateMe_00 1480 0.43 0.35 0.46 190 XMSlimDrugH 1449 0.58 0.92 0.45 191 HTML_IMAGE_ONLY_20 1448 0.50 0.62 0.45 192 HTML_TAG_BALANCE_BODY 1430 0.60 0.99 0.44 193 LongTLD 1402 0.85 1.90 0.44 194 TM2_M_BODY_EMPTY 1385 0.33 0.06 0.43 195 RELAYCOUNTRY_GB 1372 0.51 0.72 0.43 196 XMSubMetaI_00 1353 0.58 0.97 0.42 197 XMLngstWrd_02 1338 0.41 0.40 0.42 198 TM2_M_OBFU_COMMENT 1323 0.60 1.07 0.41 199 FROM_GOV_SPOOF 1323 0.34 0.18 0.41 200 XMPhish30 1317 0.72 1.51 0.41 ----------------------------------------------------------------------