Email: 479945 Autolearn: 0 AvgScore: 4.93 AvgScanTime: 1.42 sec Spam: 152506 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 1.57 sec Ham: 327439 Autolearn: 0 AvgScore: 0.51 AvgScanTime: 1.35 sec Time Spent Running SA: 189.72 hours Time Spent Processing Spam: 66.49 hours Time Spent Processing Ham: 123.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143870 89.45 94.34 87.18 2 DKIM_SIGNED 134449 78.33 88.16 73.75 3 RELAYCOUNTRY_US 129094 81.37 84.65 79.84 4 XM_DK_Pass 128238 76.10 84.09 72.38 5 XM_B_Unicode 127545 74.82 83.63 70.71 6 DKIM_VALID 125460 74.72 82.27 71.20 7 DCC_CHECK 114044 49.67 74.78 37.98 8 XM_B_SpammyWords 107452 52.11 70.46 43.57 9 XMListUnsubscribeExists 106143 54.61 69.60 47.63 10 DKIM_VALID_AU 99641 59.63 65.34 56.98 11 LOC_TINY_FONT_1 79683 34.15 52.25 25.72 12 XM_B_Unicode3 76395 44.86 50.09 42.43 13 BAYES_50 65603 56.26 43.02 62.43 14 XM_B_SpammyWords2 65318 26.35 42.83 18.68 15 HTML_FONT_LOW_CONTRAST 58709 30.80 38.50 27.22 16 XM_DK_Undo_02 57891 15.55 37.96 5.11 17 RCVD_IN_MSPIKE_H2 55007 35.32 36.07 34.97 18 FVGT_m_MULTI_ODD 52951 27.62 34.72 24.31 19 T_KAM_HTML_FONT_INVALID 49271 24.49 32.31 20.84 20 BAYES_99 43135 11.20 28.28 3.25 21 DKIM_VALID_EF 41881 28.35 27.46 28.77 22 TR_XM_DKIM_Undo 39893 9.70 26.16 2.03 23 MIME_HTML_ONLY 39623 21.37 25.98 19.22 24 XMSubLong 37915 23.32 24.86 22.61 25 T_TM2_M_HEADER_IN_MSG 36652 28.20 24.03 30.14 26 XM_Multi_Part_URI 35845 16.53 23.50 13.28 27 DCC_CHECK_NEGATIVE 35796 49.73 23.47 61.96 28 BAYES_999 33221 8.55 21.78 2.38 29 TR_DCC_Bayes_99 31410 7.37 20.60 1.21 30 TR_XM_DK_Unsub 29086 14.72 19.07 12.69 31 UNPARSEABLE_RELAY 27535 13.40 18.06 11.23 32 XM_B_Unsub 25436 11.48 16.68 9.06 33 TR_XM_BayesUnsub 24420 9.76 16.01 6.84 34 XM_B_SpammyWords3 23027 7.68 15.10 4.23 35 TR_MAX_INTL_RELAY 22222 8.43 14.57 5.57 36 RELAYCOUNTRY_META 21878 9.19 14.35 6.79 37 LOTS_OF_MONEY 19004 8.04 12.46 5.98 38 TR_XM_SpammyWords4 16993 6.18 11.14 3.87 39 BOTNET_IPINHOSTNAME 16963 5.85 11.12 3.40 40 TR_XM_SpammyWords2 16110 3.68 10.56 0.47 41 XM_Evil_Numbers_Gen 15854 9.26 10.40 8.74 42 RCVD_IN_BL_SPAMCOP_NET 15492 3.86 10.16 0.93 43 TR_XM_SpammyRelay 15304 4.66 10.04 2.16 44 XM_B_Phish_Phrases 14077 6.82 9.23 5.70 45 LotsOfNums_01 13883 8.86 9.10 8.74 46 BAYES_80 13813 5.24 9.06 3.46 47 XM_Body_Dirty_Words 13555 4.47 8.89 2.41 48 TR_XM_UnparsRelay 13265 3.88 8.70 1.64 49 FSL_BULK_SIG 13089 7.32 8.58 6.73 50 BAYES_60 13044 8.32 8.55 8.21 51 TR_XM_SPAMCOP 12888 3.08 8.45 0.58 52 BOTNET 12682 3.76 8.32 1.64 53 HTML_IMAGE_RATIO_02 10437 5.34 6.84 4.64 54 XM_B_PhoneNumber 9511 8.65 6.24 9.78 55 XM_UncommonTLD01 9382 4.71 6.15 4.04 56 XMSubMetaSx_00 9242 4.54 6.06 3.83 57 DKIM_INVALID 8989 3.61 5.89 2.55 58 UNTRUSTED_Relay 8900 4.67 5.84 4.13 59 XM_H_Long_From01 8730 5.50 5.72 5.39 60 MPART_ALT_DIFF 8390 4.66 5.50 4.26 61 HTML_IMAGE_RATIO_04 8185 4.96 5.37 4.76 62 XM_H_GMP 7974 7.16 5.23 8.06 63 BAYES_95 7788 3.06 5.11 2.10 64 TM2_M_VERY_LONG_WORD 7616 3.19 4.99 2.35 65 XM_B_SpammyTLD 7367 3.09 4.83 2.27 66 RELAYCOUNTRY_CA 7279 2.36 4.77 1.23 67 XM_B_Investor 7273 2.61 4.77 1.60 68 TR_XM_SpammyWords5 6669 2.44 4.37 1.54 69 HTML_IMAGE_RATIO_06 6478 3.61 4.25 3.32 70 TR_XM_PhishingBody 6318 2.35 4.14 1.51 71 T_XMDrugObfuBody_14 6153 2.48 4.03 1.76 72 XMNumbers 5925 3.33 3.89 3.08 73 XMStrtUSub 5812 4.07 3.81 4.19 74 XM_CamelCaseFrm001 5500 2.75 3.61 2.35 75 TooManyTo_001 5424 6.92 3.56 8.48 76 RCVD_IN_MSPIKE_WL 5331 4.98 3.50 5.67 77 RCVD_IN_MSPIKE_H3 5330 4.97 3.49 5.66 78 XMSexyCombo_05 5063 1.83 3.32 1.14 79 MIME_HTML_ONLY_MULTI 4978 2.78 3.26 2.56 80 MIME_HTML_MOSTLY 4703 4.30 3.08 4.87 81 XM_UB50 4554 3.35 2.99 3.52 82 XM_SPF_SoftFail 4500 1.95 2.95 1.48 83 RCVD_IN_VALIDITY_RPBL 4448 1.01 2.92 0.12 84 TM2_M_URI_OPT_OUT 4355 2.09 2.86 1.73 85 T_TooManySym_01 4340 4.77 2.85 5.67 86 RELAYCOUNTRY_AU 4197 1.48 2.75 0.89 87 ANY_BOUNCE_MESSAGE 4059 3.56 2.66 3.99 88 XM_OfRef6 4058 1.60 2.66 1.11 89 BOUNCE_MESSAGE 4047 3.56 2.65 3.98 90 T_XMDrugObfuBody_08 3979 1.71 2.61 1.29 91 HTML_IMAGE_RATIO_08 3853 2.13 2.53 1.95 92 XM_URI_RBL 3781 0.99 2.48 0.29 93 MIME_QP_LONG_LINE 3768 4.53 2.47 5.49 94 XMDiploma_00 3690 1.68 2.42 1.34 95 RCVD_IN_VALIDITY_SAFE 3576 3.47 2.34 4.00 96 T_XMHurry_00 3503 1.40 2.30 0.98 97 T_XMDrugObfuBody_00 3501 1.30 2.30 0.83 98 XM_B_URI_Unicode 3410 1.99 2.24 1.87 99 XM_B_SpammyWords4 3398 1.01 2.23 0.45 100 XM_B_Unsub2 3312 1.65 2.17 1.41 101 SUSP_UTF8_WORD_SUBJ 3303 0.70 2.17 0.02 102 SUSP_UTF8_WORD_COMBO 3271 0.71 2.14 0.04 103 XMSubMetaI_00 3206 1.08 2.10 0.61 104 XMBody_17 3160 0.92 2.07 0.38 105 SUBJ_ALL_CAPS 3104 1.58 2.04 1.37 106 MAILING_LIST_MULTI 3070 2.71 2.01 3.03 107 XM_DK_Undo_01 3067 1.73 2.01 1.59 108 FROM_EXCESS_BASE64 3054 1.95 2.00 1.92 109 USER_IN_DEF_DKIM_WL 3028 9.04 1.99 12.33 110 SpammyFromTLD_01 2999 1.20 1.97 0.85 111 TR_XM_NoHeaderRelay 2974 0.78 1.95 0.24 112 XMStockSpam_06 2938 1.43 1.93 1.20 113 DKIM_ADSP_NXDOMAIN 2898 0.78 1.90 0.27 114 KHOP_HELO_FCRDNS 2890 1.76 1.90 1.69 115 XMBody_78 2864 0.87 1.88 0.40 116 T_REMOTE_IMAGE 2848 3.12 1.87 3.70 117 XM_H_Long_From02 2771 1.33 1.82 1.10 118 RCVD_IN_ZEN_LASTEXTERNAL 2619 0.55 1.72 0.00 119 SHORTCIRCUIT 2619 0.55 1.72 0.00 120 SpammyFromTLD_02 2579 0.84 1.69 0.45 121 BAYES_40 2552 3.67 1.67 4.59 122 RCVD_IN_VALIDITY_CERTIFIED 2437 2.58 1.60 3.04 123 XMLngstWrd_00 2425 1.17 1.59 0.98 124 TR_XM_PHPForged 2366 0.70 1.55 0.31 125 TR_XM_PHPDW 2362 0.70 1.55 0.30 126 HTML_MIME_NO_HTML_TAG 2352 2.12 1.54 2.40 127 NO_DNS_FOR_FROM 2342 0.70 1.54 0.30 128 TR_XM_FormFill2 2335 0.70 1.53 0.31 129 TR_XM_MaxWHORU 2316 0.66 1.52 0.26 130 TR_XM_INV_DKIM 2312 0.53 1.52 0.07 131 XM_H_PHPOS 2283 0.68 1.50 0.30 132 XM_B_SEO 2282 0.65 1.50 0.25 133 URI_HEX 2280 1.38 1.50 1.32 134 XMGenDplmaNmb 2239 1.00 1.47 0.79 135 MIME_CHARSET_FARAWAY 2222 2.71 1.46 3.30 136 XM_SendGrid 2217 1.40 1.45 1.37 137 XM_B_COVIDMETA 2213 0.64 1.45 0.26 138 XMBrknScrpt_02 2180 0.99 1.43 0.79 139 DKIM_ADSP_CUSTOM_MED 2164 1.14 1.42 1.01 140 ALL_TRUSTED 2160 10.12 1.42 14.18 141 XMPhish30 2157 0.82 1.41 0.54 142 XMLngstWrd_01 2153 0.93 1.41 0.71 143 TR_XM_SEO4 2064 0.52 1.35 0.13 144 XM_B_COPY_HTML 2015 0.93 1.32 0.75 145 DIET_1 1999 0.59 1.31 0.26 146 XMReplyNow 1988 0.58 1.30 0.25 147 RCVD_IN_IADB_LISTED 1982 2.93 1.30 3.69 148 NML_ADSP_CUSTOM_MED 1903 0.88 1.25 0.70 149 T_MONEY_PERCENT 1866 0.48 1.22 0.14 150 TR_LOTS_OF_MONEY2 1866 0.48 1.22 0.14 151 XMBdyGiftCard01 1813 0.72 1.19 0.50 152 BAYES_20 1810 2.70 1.19 3.40 153 T_FILL_THIS_FORM_SHORT 1808 1.01 1.19 0.92 154 XM_B_Phish66 1789 0.55 1.17 0.26 155 TR_Symld_Words 1736 1.44 1.14 1.58 156 XMSexyCombo_01 1725 0.47 1.13 0.17 157 XMLngstWrd_02 1719 0.68 1.13 0.47 158 XMHTML_After_End 1709 0.55 1.12 0.28 159 URI_NOVOWEL 1701 1.32 1.12 1.42 160 HTTPS_HTTP_MISMATCH 1659 0.90 1.09 0.82 161 HTML_TAG_BALANCE_BODY 1650 0.77 1.08 0.63 162 RCVD_IN_IADB_SPF 1649 2.57 1.08 3.27 163 XMLngstWrd_03 1647 0.57 1.08 0.33 164 SHOPIFY_IMG_NOT_RCVD_SFY 1624 0.52 1.06 0.26 165 XM_B_DNDMA 1613 0.84 1.06 0.74 166 RDNS_DYNAMIC 1610 0.59 1.06 0.37 167 LongTLD 1595 0.62 1.05 0.42 168 XM_ProductURIs 1591 1.12 1.04 1.16 169 XM_H_Undi_Recip 1589 0.46 1.04 0.19 170 XMLngstWrd_04 1584 0.54 1.04 0.30 171 PDS_RDNS_DYNAMIC_FP 1582 0.48 1.04 0.22 172 URI_TRY_3LD 1567 0.72 1.03 0.58 173 TR_XM_Base64_M1 1553 0.73 1.02 0.59 174 XM_UB99 1547 0.33 1.01 0.01 175 T_STY_INVIS_DIRECT 1529 0.52 1.00 0.30 176 THIS_AD 1521 0.50 1.00 0.27 177 T_TooManySym_02 1484 2.32 0.97 2.95 178 RCVD_IN_IADB_SENDERID 1462 2.32 0.96 2.95 179 XM_PDF 1440 5.15 0.94 7.12 180 RCVD_IN_IADB_DK 1432 2.27 0.94 2.88 181 FORGED_GMAIL_RCVD 1424 0.75 0.93 0.66 182 XMNoVowels 1418 0.88 0.93 0.86 183 RELAYCOUNTRY_FR 1418 0.52 0.93 0.33 184 T_Symld_Words_02 1394 0.73 0.91 0.64 185 XMPhish14 1394 0.62 0.91 0.49 186 PLING_QUERY 1348 0.58 0.88 0.43 187 XMBounce_01 1346 0.30 0.88 0.02 188 TR_XM_Undi_Recip19 1330 0.33 0.87 0.08 189 URIBL_BLACK 1313 0.31 0.86 0.06 190 XMMoneyMeta_00 1304 0.62 0.86 0.50 191 TM2_M_OBFU_COMMENT 1283 0.51 0.84 0.36 192 XMBounce_02 1277 0.28 0.84 0.01 193 BAYES_00 1266 7.44 0.83 10.52 194 MPART_ALT_DIFF_COUNT 1260 0.72 0.83 0.67 195 XMSlimDrugH 1252 0.61 0.82 0.51 196 TR_MetaPhish_Combo_01 1252 0.68 0.82 0.62 197 XM_UB60 1232 0.32 0.81 0.09 198 TR_XM_RelayPhish 1228 0.30 0.81 0.07 199 XM_Combo_Sbj 1226 0.40 0.80 0.21 200 TVD_RCVD_IP 1225 0.61 0.80 0.52 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 285457 89.45 94.34 87.18 2 RELAYCOUNTRY_US 261420 81.37 84.65 79.84 3 DKIM_SIGNED 241477 78.33 88.16 73.75 4 XM_DK_Pass 236992 76.10 84.09 72.38 5 DKIM_VALID 233131 74.72 82.27 71.20 6 XM_B_Unicode 231535 74.82 83.63 70.71 7 BAYES_50 204411 56.26 43.02 62.43 8 DCC_CHECK_NEGATIVE 202866 49.73 23.47 61.96 9 DKIM_VALID_AU 186566 59.63 65.34 56.98 10 XMListUnsubscribeExists 155957 54.61 69.60 47.63 11 XM_B_SpammyWords 142662 52.11 70.46 43.57 12 XM_B_Unicode3 138918 44.86 50.09 42.43 13 DCC_CHECK 124357 49.67 74.78 37.98 14 RCVD_IN_MSPIKE_H2 114492 35.32 36.07 34.97 15 T_TM2_M_HEADER_IN_MSG 98696 28.20 24.03 30.14 16 DKIM_VALID_EF 94204 28.35 27.46 28.77 17 HTML_FONT_LOW_CONTRAST 89121 30.80 38.50 27.22 18 LOC_TINY_FONT_1 84231 34.15 52.25 25.72 19 FVGT_m_MULTI_ODD 79600 27.62 34.72 24.31 20 XMSubLong 74026 23.32 24.86 22.61 21 T_KAM_HTML_FONT_INVALID 68251 24.49 32.31 20.84 22 MIME_HTML_ONLY 62944 21.37 25.98 19.22 23 XM_B_SpammyWords2 61164 26.35 42.83 18.68 24 ALL_TRUSTED 46433 10.12 1.42 14.18 25 XM_Multi_Part_URI 43488 16.53 23.50 13.28 26 TR_XM_DK_Unsub 41561 14.72 19.07 12.69 27 USER_IN_DEF_DKIM_WL 40361 9.04 1.99 12.33 28 UNPARSEABLE_RELAY 36757 13.40 18.06 11.23 29 BAYES_00 34431 7.44 0.83 10.52 30 XM_B_PhoneNumber 32014 8.65 6.24 9.78 31 XM_B_Unsub 29669 11.48 16.68 9.06 32 LotsOfNums_01 28619 8.86 9.10 8.74 33 XM_Evil_Numbers_Gen 28603 9.26 10.40 8.74 34 TooManyTo_001 27765 6.92 3.56 8.48 35 BAYES_60 26897 8.32 8.55 8.21 36 XM_H_GMP 26384 7.16 5.23 8.06 37 XM_PDF 23301 5.15 0.94 7.12 38 TR_XM_DK_Bayes 22884 4.99 0.70 6.99 39 TR_XM_DK_Bayes1 22647 4.94 0.69 6.92 40 IN_ZIMBRA_NJ_WHITELIST 22463 4.70 0.08 6.86 41 TR_XM_BayesUnsub 22406 9.76 16.01 6.84 42 RELAYCOUNTRY_META 22222 9.19 14.35 6.79 43 FSL_BULK_SIG 22033 7.32 8.58 6.73 44 XM_DKIMWhitelistDomains 20772 4.43 0.33 6.34 45 TR_XM_DK_Bayes2 19643 4.25 0.51 6.00 46 LOTS_OF_MONEY 19566 8.04 12.46 5.98 47 XM_B_Phish_Phrases 18675 6.82 9.23 5.70 48 T_TooManySym_01 18566 4.77 2.85 5.67 49 RCVD_IN_MSPIKE_WL 18551 4.98 3.50 5.67 50 RCVD_IN_MSPIKE_H3 18546 4.97 3.49 5.66 51 TR_MAX_INTL_RELAY 18225 8.43 14.57 5.57 52 MIME_QP_LONG_LINE 17992 4.53 2.47 5.49 53 XM_H_Long_From01 17657 5.50 5.72 5.39 54 XM_DK_Undo_02 16745 15.55 37.96 5.11 55 MIME_HTML_MOSTLY 15935 4.30 3.08 4.87 56 HTML_IMAGE_RATIO_04 15602 4.96 5.37 4.76 57 HTML_IMAGE_RATIO_02 15182 5.34 6.84 4.64 58 BAYES_40 15040 3.67 1.67 4.59 59 MPART_ALT_DIFF 13965 4.66 5.50 4.26 60 XM_B_SpammyWords3 13852 7.68 15.10 4.23 61 XMStrtUSub 13727 4.07 3.81 4.19 62 UNTRUSTED_Relay 13518 4.67 5.84 4.13 63 XM_UncommonTLD01 13224 4.71 6.15 4.04 64 RCVD_IN_VALIDITY_SAFE 13091 3.47 2.34 4.00 65 ANY_BOUNCE_MESSAGE 13049 3.56 2.66 3.99 66 BOUNCE_MESSAGE 13041 3.56 2.65 3.98 67 TR_XM_SpammyWords4 12686 6.18 11.14 3.87 68 XMSubMetaSx_00 12551 4.54 6.06 3.83 69 T_REMOTE_IMAGE 12125 3.12 1.87 3.70 70 RCVD_IN_IADB_LISTED 12071 2.93 1.30 3.69 71 XM_UB50 11529 3.35 2.99 3.52 72 BAYES_80 11322 5.24 9.06 3.46 73 BAYES_20 11135 2.70 1.19 3.40 74 BOTNET_IPINHOSTNAME 11131 5.85 11.12 3.40 75 HTML_IMAGE_RATIO_06 10856 3.61 4.25 3.32 76 MIME_CHARSET_FARAWAY 10800 2.71 1.46 3.30 77 RCVD_IN_IADB_SPF 10697 2.57 1.08 3.27 78 BAYES_99 10636 11.20 28.28 3.25 79 XMSubNoVowel 10110 2.30 0.59 3.09 80 XMNumbers 10077 3.33 3.89 3.08 81 RCVD_IN_VALIDITY_CERTIFIED 9965 2.58 1.60 3.04 82 MAILING_LIST_MULTI 9931 2.71 2.01 3.03 83 T_TooManySym_02 9673 2.32 0.97 2.95 84 RCVD_IN_IADB_SENDERID 9654 2.32 0.96 2.95 85 TooManyTo_002 9593 2.24 0.75 2.93 86 CHARSET_FARAWAY_HEADER 9470 2.20 0.71 2.89 87 RCVD_IN_IADB_DK 9444 2.27 0.94 2.88 88 RELAYCOUNTRY_CN 8860 1.91 0.19 2.71 89 HTML_COMMENT_SAVED_URL 8840 1.87 0.09 2.70 90 MIME_HTML_ONLY_MULTI 8382 2.78 3.26 2.56 91 DKIM_INVALID 8346 3.61 5.89 2.55 92 XM_Body_Dirty_Words 7881 4.47 8.89 2.41 93 HTML_MIME_NO_HTML_TAG 7844 2.12 1.54 2.40 94 BAYES_999 7795 8.55 21.78 2.38 95 TM2_M_VERY_LONG_WORD 7700 3.19 4.99 2.35 96 XM_CamelCaseFrm001 7697 2.75 3.61 2.35 97 RCVD_IN_IADB_VOUCHED 7524 1.82 0.79 2.30 98 XM_B_SpammyTLD 7448 3.09 4.83 2.27 99 INVALID_MSGID 7320 1.60 0.25 2.24 100 TR_XM_SpammyRelay 7075 4.66 10.04 2.16 101 BAYES_95 6890 3.06 5.11 2.10 102 BAYES_05 6675 1.57 0.57 2.04 103 TR_XM_DKIM_Undo 6660 9.70 26.16 2.03 104 HTML_IMAGE_RATIO_08 6378 2.13 2.53 1.95 105 FROM_EXCESS_BASE64 6301 1.95 2.00 1.92 106 TO_MALFORMED 6219 1.30 0.01 1.90 107 XM_B_URI_Unicode 6137 1.99 2.24 1.87 108 T_XMDrugObfuBody_14 5772 2.48 4.03 1.76 109 TM2_M_URI_OPT_OUT 5654 2.09 2.86 1.73 110 TooManyTo_003 5638 1.38 0.65 1.72 111 KHOP_HELO_FCRDNS 5549 1.76 1.90 1.69 112 TR_XM_UnparsRelay 5374 3.88 8.70 1.64 113 BOTNET 5356 3.76 8.32 1.64 114 IN_HORDE_ADDRESS_BOOK 5283 1.12 0.07 1.61 115 XM_B_Investor 5244 2.61 4.77 1.60 116 RCVD_IN_IADB_OPTIN 5225 1.25 0.51 1.60 117 XM_DK_Undo_01 5222 1.73 2.01 1.59 118 TR_Symld_Words 5162 1.44 1.14 1.58 119 XMGappySubj_01 5056 1.12 0.20 1.54 120 TR_XM_SpammyWords5 5041 2.44 4.37 1.54 121 TR_XM_PhishingBody 4941 2.35 4.14 1.51 122 XM_SPF_SoftFail 4836 1.95 2.95 1.48 123 URI_NOVOWEL 4643 1.32 1.12 1.42 124 XM_B_Unsub2 4603 1.65 2.17 1.41 125 XM_SendGrid 4497 1.40 1.45 1.37 126 SUBJ_ALL_CAPS 4492 1.58 2.04 1.37 127 XMDiploma_00 4376 1.68 2.42 1.34 128 HELO_NODOT 4368 1.00 0.29 1.33 129 HELO_NO_DOMAIN 4356 1.00 0.29 1.33 130 URI_HEX 4330 1.38 1.50 1.32 131 T_XMDrugObfuBody_08 4225 1.71 2.61 1.29 132 TooManyTo_004 4088 1.04 0.60 1.25 133 RELAYCOUNTRY_CA 4030 2.36 4.77 1.23 134 XMCapTrack 3983 0.98 0.46 1.22 135 TR_DCC_Bayes_99 3948 7.37 20.60 1.21 136 XMStockSpam_06 3940 1.43 1.93 1.20 137 XM_GoogleGroups 3895 1.03 0.67 1.19 138 TVD_SPACE_RATIO 3881 0.86 0.18 1.19 139 XM_ProductURIs 3790 1.12 1.04 1.16 140 XMSexyCombo_05 3725 1.83 3.32 1.14 141 XM_OfRef6 3634 1.60 2.66 1.11 142 XM_H_Long_From02 3591 1.33 1.82 1.10 143 TooManyTo_005 3364 0.88 0.57 1.03 144 T_TooManySym_03 3334 0.77 0.24 1.02 145 DKIM_ADSP_CUSTOM_MED 3297 1.14 1.42 1.01 146 T_XMHurry_00 3217 1.40 2.30 0.98 147 XMLngstWrd_00 3206 1.17 1.59 0.98 148 XMGappySubj_02 3098 0.66 0.05 0.95 149 RCVD_IN_BL_SPAMCOP_NET 3057 3.86 10.16 0.93 150 T_FILL_THIS_FORM_SHORT 3017 1.01 1.19 0.92 151 TR_XM_DK_SendGrid 2953 0.87 0.79 0.90 152 RELAYCOUNTRY_AU 2918 1.48 2.75 0.89 153 FROM_GOV_DKIM_AU 2872 0.64 0.14 0.88 154 XMBody_95 2834 0.66 0.23 0.87 155 XMNoVowels 2801 0.88 0.93 0.86 156 SpammyFromTLD_01 2776 1.20 1.97 0.85 157 T_XMDrugObfuBody_00 2729 1.30 2.30 0.83 158 HTTPS_HTTP_MISMATCH 2677 0.90 1.09 0.82 159 XMGenDplmaNmb 2577 1.00 1.47 0.79 160 XMBrknScrpt_02 2574 0.99 1.43 0.79 161 XM_ShortIntro_01 2501 0.64 0.36 0.76 162 XM_B_COPY_HTML 2454 0.93 1.32 0.75 163 XM_B_DNDMA 2427 0.84 1.06 0.74 164 XMLngstWrd_01 2315 0.93 1.41 0.71 165 NML_ADSP_CUSTOM_MED 2304 0.88 1.25 0.70 166 RCVD_IN_PBL 2285 0.71 0.75 0.70 167 MPART_ALT_DIFF_COUNT 2178 0.72 0.83 0.67 168 FORGED_GMAIL_RCVD 2168 0.75 0.93 0.66 169 XM_H_PHPMailer 2149 0.67 0.70 0.66 170 T_Symld_Words_02 2091 0.73 0.91 0.64 171 HTML_TAG_BALANCE_BODY 2049 0.77 1.08 0.63 172 TR_MetaPhish_Combo_01 2015 0.68 0.82 0.62 173 XMSubMetaI_00 1987 1.08 2.10 0.61 174 TR_XM_Base64_M1 1928 0.73 1.02 0.59 175 TR_XM_SPAMCOP 1915 3.08 8.45 0.58 176 URI_TRY_3LD 1903 0.72 1.03 0.58 177 XM_B_FormFill 1897 0.40 0.03 0.58 178 HTML_IMAGE_ONLY_32 1775 0.44 0.22 0.54 179 XMPhish30 1763 0.82 1.41 0.54 180 TVD_RCVD_IP 1717 0.61 0.80 0.52 181 XMSlimDrugH 1677 0.61 0.82 0.51 182 T_OBFU_PDF_ATTACH 1666 0.39 0.12 0.51 183 XMMoneyMeta_00 1651 0.62 0.86 0.50 184 XMBdyGiftCard01 1637 0.72 1.19 0.50 185 MSGID_FROM_MTA_HEADER 1607 0.37 0.12 0.49 186 RELAYCOUNTRY_GB 1605 0.58 0.77 0.49 187 XMPhish14 1601 0.62 0.91 0.49 188 T_TVD_MIME_NO_HEADERS 1571 0.36 0.11 0.48 189 XMDateMe_00 1555 0.53 0.66 0.47 190 TR_XM_SpammyWords2 1529 3.68 10.56 0.47 191 XMLngstWrd_02 1526 0.68 1.13 0.47 192 SpammyFromTLD_02 1475 0.84 1.69 0.45 193 XM_B_SpammyWords4 1458 1.01 2.23 0.45 194 TO_NO_BRKTS_HTML_ONLY 1424 0.37 0.23 0.43 195 TM2_M_BODY_EMPTY 1415 0.32 0.09 0.43 196 PLING_QUERY 1413 0.58 0.88 0.43 197 LongTLD 1380 0.62 1.05 0.42 198 HTML_FONT_FACE_BAD 1357 0.44 0.51 0.41 199 MISSING_HEADERS 1353 0.43 0.47 0.41 200 XMBody_78 1326 0.87 1.88 0.40 ----------------------------------------------------------------------