Email: 434262 Autolearn: 0 AvgScore: 4.72 AvgScanTime: 1.26 sec Spam: 132507 Autolearn: 0 AvgScore: 15.14 AvgScanTime: 1.37 sec Ham: 301755 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 1.21 sec Time Spent Running SA: 152.30 hours Time Spent Processing Spam: 50.52 hours Time Spent Processing Ham: 101.78 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123896 88.47 93.50 86.26 2 DKIM_SIGNED 117857 78.10 88.94 73.34 3 XM_DK_Pass 112474 75.81 84.88 71.82 4 RELAYCOUNTRY_US 112442 81.01 84.86 79.32 5 DKIM_VALID 110940 74.58 83.72 70.57 6 XM_B_Unicode 108983 72.35 82.25 68.01 7 DCC_CHECK 99242 47.85 74.90 35.97 8 XM_B_SpammyWords 95239 52.59 71.87 44.12 9 XMListUnsubscribeExists 93900 52.33 70.86 44.19 10 DKIM_VALID_AU 89996 60.13 67.92 56.71 11 LOC_TINY_FONT_1 65628 31.72 49.53 23.89 12 XM_B_Unicode3 65261 41.73 49.25 38.43 13 XM_B_SpammyWords2 55720 24.57 42.05 16.89 14 BAYES_50 54250 54.73 40.94 60.78 15 XM_DK_Undo_02 52244 15.19 39.43 4.55 16 HTML_FONT_LOW_CONTRAST 50171 29.44 37.86 25.74 17 RCVD_IN_MSPIKE_H2 49056 34.53 37.02 33.44 18 FVGT_m_MULTI_ODD 43054 26.73 32.49 24.20 19 T_KAM_HTML_FONT_INVALID 41773 22.76 31.53 18.91 20 BAYES_99 38798 11.13 29.28 3.17 21 DKIM_VALID_EF 38321 29.50 28.92 29.75 22 TR_XM_DKIM_Undo 38284 9.99 28.89 1.69 23 MIME_HTML_ONLY 33903 20.92 25.59 18.87 24 XMSubLong 32582 25.62 24.59 26.07 25 T_TM2_M_HEADER_IN_MSG 31016 29.61 23.41 32.33 26 XM_Multi_Part_URI 30645 16.14 23.13 13.07 27 DCC_CHECK_NEGATIVE 30533 51.49 23.04 63.98 28 BAYES_999 29487 8.46 22.25 2.41 29 TR_DCC_Bayes_99 28004 7.10 21.13 0.93 30 TR_XM_DK_Unsub 26240 14.41 19.80 12.04 31 UNPARSEABLE_RELAY 22056 12.98 16.65 11.37 32 XM_B_Unsub 19952 10.86 15.06 9.02 33 TR_MAX_INTL_RELAY 19832 8.23 14.97 5.27 34 XM_B_SpammyWords3 19774 7.47 14.92 4.20 35 TR_XM_BayesUnsub 19028 9.01 14.36 6.66 36 RELAYCOUNTRY_META 18619 7.05 14.05 3.97 37 LOTS_OF_MONEY 17682 8.54 13.34 6.43 38 TR_XM_SpammyWords4 15729 6.61 11.87 4.30 39 BOTNET_IPINHOSTNAME 15406 5.75 11.63 3.16 40 TR_XM_SpammyWords2 15310 3.75 11.55 0.33 41 TR_XM_SpammyRelay 13669 4.51 10.32 1.96 42 XM_Body_Dirty_Words 12590 4.55 9.50 2.37 43 RCVD_IN_BL_SPAMCOP_NET 12231 3.29 9.23 0.68 44 BAYES_80 12179 5.10 9.19 3.30 45 BOTNET 11850 3.68 8.94 1.37 46 BAYES_60 11397 8.41 8.60 8.33 47 XM_Evil_Numbers_Gen 11392 8.67 8.60 8.70 48 TR_XM_SPAMCOP 10776 2.76 8.13 0.40 49 FSL_BULK_SIG 10573 7.61 7.98 7.45 50 TR_XM_UnparsRelay 10530 3.39 7.95 1.39 51 LotsOfNums_01 10335 7.47 7.80 7.32 52 HTML_IMAGE_RATIO_02 9887 5.69 7.46 4.92 53 XM_B_Phish_Phrases 9495 5.76 7.17 5.14 54 XMSubMetaSx_00 8805 4.88 6.64 4.10 55 XM_H_GMP 8681 6.38 6.55 6.31 56 XM_UncommonTLD01 8080 4.92 6.10 4.41 57 XM_H_Long_From01 7532 5.33 5.68 5.18 58 XM_B_PhoneNumber 7442 8.72 5.62 10.08 59 MPART_ALT_DIFF 7345 4.34 5.54 3.82 60 BAYES_95 7299 3.05 5.51 1.97 61 UNTRUSTED_Relay 7284 2.74 5.50 1.52 62 XM_B_Investor 7188 2.73 5.42 1.55 63 DKIM_INVALID 6917 3.52 5.22 2.77 64 XM_B_SpammyTLD 6652 3.08 5.02 2.23 65 RELAYCOUNTRY_CA 6407 2.32 4.84 1.22 66 TR_XM_SpammyWords5 6104 2.53 4.61 1.62 67 XMSexyCombo_05 6053 2.63 4.57 1.78 68 T_XMDrugObfuBody_14 5770 2.64 4.35 1.89 69 TooManyTo_001 5680 7.91 4.29 9.51 70 RCVD_IN_MSPIKE_H3 5366 4.92 4.05 5.31 71 RCVD_IN_MSPIKE_WL 5366 4.92 4.05 5.31 72 XMNumbers 5270 3.39 3.98 3.14 73 XM_OfRef6 5215 1.90 3.94 1.01 74 TR_XM_PhishingBody 5105 2.22 3.85 1.50 75 XMStrtUSub 4999 4.29 3.77 4.51 76 HTML_IMAGE_RATIO_04 4965 3.47 3.75 3.35 77 RCVD_IN_VALIDITY_RPBL 4841 1.15 3.65 0.05 78 TM2_M_VERY_LONG_WORD 4798 2.45 3.62 1.94 79 XM_SPF_SoftFail 4619 2.26 3.49 1.72 80 HTML_IMAGE_RATIO_06 4577 2.94 3.45 2.71 81 T_XMDrugObfuBody_08 4527 2.20 3.42 1.66 82 MIME_HTML_ONLY_MULTI 4356 2.59 3.29 2.28 83 XMDiploma_00 4113 2.16 3.10 1.75 84 MIME_QP_LONG_LINE 3879 4.02 2.93 4.50 85 XM_CamelCaseFrm001 3862 2.59 2.91 2.45 86 MIME_HTML_MOSTLY 3842 2.34 2.90 2.10 87 XM_UB50 3803 1.54 2.87 0.95 88 T_XMHurry_00 3756 1.21 2.83 0.50 89 RELAYCOUNTRY_AU 3730 1.34 2.81 0.69 90 SUSP_UTF8_WORD_SUBJ 3690 0.87 2.78 0.02 91 HTML_IMAGE_RATIO_08 3609 2.12 2.72 1.85 92 SUSP_UTF8_WORD_COMBO 3539 0.84 2.67 0.04 93 XM_B_URI_Unicode 3502 2.50 2.64 2.44 94 TM2_M_URI_OPT_OUT 3423 1.85 2.58 1.52 95 T_TooManySym_01 3382 5.64 2.55 6.99 96 SUBJ_ALL_CAPS 3307 1.81 2.50 1.51 97 T_XMDrugObfuBody_00 3273 1.25 2.47 0.71 98 XM_URI_RBL 3072 0.93 2.32 0.32 99 XM_B_Unsub2 3058 1.75 2.31 1.50 100 FROM_EXCESS_BASE64 3048 1.73 2.30 1.48 101 MAILING_LIST_MULTI 3001 2.92 2.26 3.21 102 XM_B_SpammyWords4 2949 1.15 2.23 0.68 103 T_FILL_THIS_FORM_SHORT 2814 2.53 2.12 2.70 104 SpammyFromTLD_01 2812 1.24 2.12 0.86 105 XM_H_Undi_Recip 2806 0.89 2.12 0.34 106 XMBody_17 2795 0.90 2.11 0.37 107 DKIM_ADSP_NXDOMAIN 2773 0.87 2.09 0.33 108 TR_XM_NoHeaderRelay 2748 0.85 2.07 0.31 109 SHORTCIRCUIT 2687 0.62 2.03 0.00 110 RCVD_IN_ZEN_LASTEXTERNAL 2687 0.62 2.03 0.00 111 XMReplyNow 2672 0.88 2.02 0.38 112 NO_DNS_FOR_FROM 2643 0.84 1.99 0.33 113 TR_XM_MaxWHORU 2610 0.80 1.97 0.29 114 XMStockSpam_06 2554 1.57 1.93 1.41 115 XMBody_78 2467 0.72 1.86 0.23 116 TR_XM_Undi_Recip19 2456 0.63 1.85 0.10 117 BAYES_40 2406 4.02 1.82 4.99 118 XM_B_COPY_HTML 2368 1.06 1.79 0.74 119 XM_DK_Undo_01 2349 1.72 1.77 1.69 120 USER_IN_DEF_DKIM_WL 2293 8.94 1.73 12.11 121 XMSubMetaI_00 2287 0.95 1.73 0.60 122 TR_XM_Undi_RecipCombo2 2247 0.53 1.70 0.01 123 DIET_1 2233 0.79 1.69 0.40 124 RCVD_IN_VALIDITY_SAFE 2228 3.77 1.68 4.69 125 TR_XM_INV_DKIM 2187 0.56 1.65 0.08 126 T_REMOTE_IMAGE 2183 3.02 1.65 3.63 127 TR_Symld_Words 2118 1.65 1.60 1.67 128 T_MONEY_PERCENT 2060 0.66 1.55 0.27 129 TR_LOTS_OF_MONEY2 2060 0.66 1.55 0.27 130 SpammyFromTLD_02 2005 0.61 1.51 0.22 131 MONEY_FRAUD_8 1986 0.46 1.50 0.01 132 XMGenDplmaNmb 1984 1.03 1.50 0.83 133 ALL_TRUSTED 1972 12.60 1.49 17.49 134 URI_HEX 1968 1.24 1.49 1.14 135 UNDISC_MONEY 1927 0.45 1.45 0.01 136 XMPhish30 1904 0.85 1.44 0.59 137 HTML_MIME_NO_HTML_TAG 1877 2.28 1.42 2.65 138 XM_H_Long_From02 1868 1.10 1.41 0.96 139 XMBrknScrpt_02 1851 1.04 1.40 0.88 140 DEAR_BENEFICIARY 1850 0.43 1.40 0.01 141 XM_B_SEO 1831 0.67 1.38 0.35 142 RCVD_IN_VALIDITY_CERTIFIED 1778 2.75 1.34 3.36 143 TR_XM_Undi_Recip5 1778 0.42 1.34 0.01 144 TR_XM_PHPForged 1769 0.74 1.34 0.48 145 TR_XM_PHPDW 1754 0.73 1.32 0.47 146 XM_SendGrid 1736 1.41 1.31 1.45 147 TR_XM_FormFill2 1715 0.73 1.29 0.49 148 TR_XM_Undi_Recip11 1708 0.43 1.29 0.05 149 TR_XM_Undi_Recip2 1696 0.39 1.28 0.00 150 XM_H_PHPOS 1693 0.71 1.28 0.46 151 TR_XM_SEO4 1692 0.53 1.28 0.20 152 XM_ProductURIs 1690 0.75 1.28 0.52 153 TR_XM_Undi_RecipCombo3 1674 0.39 1.26 0.00 154 KHOP_HELO_FCRDNS 1651 1.61 1.25 1.77 155 BAYES_20 1632 2.92 1.23 3.66 156 DKIM_ADSP_CUSTOM_MED 1631 1.14 1.23 1.10 157 URI_TRY_3LD 1594 0.86 1.20 0.71 158 XMSlimDrugH 1590 0.67 1.20 0.44 159 RCVD_IN_IADB_LISTED 1589 2.70 1.20 3.35 160 XM_B_COVIDMETA 1571 0.50 1.19 0.20 161 HTTPS_HTTP_MISMATCH 1495 1.00 1.13 0.95 162 TR_XM_Base64_M1 1478 0.75 1.12 0.59 163 ADVANCE_FEE_5_NEW_MONEY 1463 0.34 1.10 0.00 164 RDNS_DYNAMIC 1458 0.62 1.10 0.40 165 RCVD_IN_IADB_SPF 1441 2.35 1.09 2.91 166 PDS_RDNS_DYNAMIC_FP 1440 0.50 1.09 0.25 167 RELAYCOUNTRY_FR 1416 0.51 1.07 0.27 168 THIS_AD 1412 0.56 1.07 0.34 169 XM_DIRTYINTL 1378 0.38 1.04 0.08 170 XMBdyGiftCard01 1373 0.76 1.04 0.64 171 XMHTML_After_End 1371 0.56 1.03 0.36 172 RCVD_IN_IADB_DK 1365 2.07 1.03 2.53 173 RCVD_IN_IADB_SENDERID 1357 2.12 1.02 2.59 174 XM_OfRef7 1330 0.42 1.00 0.16 175 TM2_M_OBFU_COMMENT 1328 0.57 1.00 0.38 176 HTML_TAG_BALANCE_BODY 1327 0.73 1.00 0.61 177 URG_BIZ 1307 0.35 0.99 0.07 178 TR_LOTS_OF_MONEY3 1296 0.50 0.98 0.29 179 TVD_RCVD_IP 1271 0.76 0.96 0.67 180 BOTNET_NORDNS 1268 0.30 0.96 0.01 181 SHOPIFY_IMG_NOT_RCVD_SFY 1248 0.43 0.94 0.20 182 HOSTED_IMG_MULTI_PUB_01 1233 0.29 0.93 0.01 183 LongTLD 1217 0.63 0.92 0.51 184 NML_ADSP_CUSTOM_MED 1213 0.81 0.92 0.76 185 TR_Mismatch_TLD_02 1211 0.35 0.91 0.10 186 MPART_ALT_DIFF_COUNT 1199 0.71 0.90 0.63 187 RCVD_IN_PBL 1166 0.84 0.88 0.83 188 RCVD_IN_SORBS_DUL 1164 0.29 0.88 0.04 189 TooManyTo_002 1156 2.52 0.87 3.24 190 URI_NOVOWEL 1150 1.12 0.87 1.23 191 XM_B_Phish66 1137 0.49 0.86 0.33 192 TR_XM_DK_SendGrid 1123 0.87 0.85 0.89 193 URIBL_BLACK 1104 0.29 0.83 0.05 194 HK_SCAM 1102 0.26 0.83 0.01 195 T_STY_INVIS_DIRECT 1101 0.48 0.83 0.33 196 BOUNCE_MESSAGE 1099 2.58 0.83 3.34 197 ANY_BOUNCE_MESSAGE 1099 2.58 0.83 3.34 198 TR_MetaPhish_Combo_01 1085 0.70 0.82 0.64 199 LOADSA_MONEY_COMBO 1075 0.29 0.81 0.05 200 XMPhish14 1070 0.48 0.81 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 260284 88.47 93.50 86.26 2 RELAYCOUNTRY_US 239364 81.01 84.86 79.32 3 DKIM_SIGNED 221318 78.10 88.94 73.34 4 XM_DK_Pass 216724 75.81 84.88 71.82 5 DKIM_VALID 212949 74.58 83.72 70.57 6 XM_B_Unicode 205219 72.35 82.25 68.01 7 DCC_CHECK_NEGATIVE 193058 51.49 23.04 63.98 8 BAYES_50 183403 54.73 40.94 60.78 9 DKIM_VALID_AU 171120 60.13 67.92 56.71 10 XMListUnsubscribeExists 133340 52.33 70.86 44.19 11 XM_B_SpammyWords 133131 52.59 71.87 44.12 12 XM_B_Unicode3 115973 41.73 49.25 38.43 13 DCC_CHECK 108542 47.85 74.90 35.97 14 RCVD_IN_MSPIKE_H2 100914 34.53 37.02 33.44 15 T_TM2_M_HEADER_IN_MSG 97570 29.61 23.41 32.33 16 DKIM_VALID_EF 89778 29.50 28.92 29.75 17 XMSubLong 78679 25.62 24.59 26.07 18 HTML_FONT_LOW_CONTRAST 77665 29.44 37.86 25.74 19 FVGT_m_MULTI_ODD 73033 26.73 32.49 24.20 20 LOC_TINY_FONT_1 72104 31.72 49.53 23.89 21 T_KAM_HTML_FONT_INVALID 57066 22.76 31.53 18.91 22 MIME_HTML_ONLY 56932 20.92 25.59 18.87 23 ALL_TRUSTED 52764 12.60 1.49 17.49 24 XM_B_SpammyWords2 50958 24.57 42.05 16.89 25 XM_Multi_Part_URI 39436 16.14 23.13 13.07 26 USER_IN_DEF_DKIM_WL 36538 8.94 1.73 12.11 27 TR_XM_DK_Unsub 36337 14.41 19.80 12.04 28 BAYES_00 34652 8.22 0.78 11.48 29 UNPARSEABLE_RELAY 34317 12.98 16.65 11.37 30 XM_B_PhoneNumber 30427 8.72 5.62 10.08 31 TooManyTo_001 28689 7.91 4.29 9.51 32 XM_B_Unsub 27205 10.86 15.06 9.02 33 XM_Evil_Numbers_Gen 26241 8.67 8.60 8.70 34 BAYES_60 25139 8.41 8.60 8.33 35 FSL_BULK_SIG 22483 7.61 7.98 7.45 36 TR_XM_DK_Bayes 22401 5.37 0.69 7.42 37 TR_XM_DK_Bayes1 22089 5.29 0.68 7.32 38 LotsOfNums_01 22086 7.47 7.80 7.32 39 IN_ZIMBRA_NJ_WHITELIST 21195 4.91 0.09 7.02 40 T_TooManySym_01 21096 5.64 2.55 6.99 41 TR_XM_BayesUnsub 20088 9.01 14.36 6.66 42 XM_DKIMWhitelistDomains 19558 4.53 0.07 6.48 43 LOTS_OF_MONEY 19415 8.54 13.34 6.43 44 TR_XM_DK_Bayes2 19030 4.54 0.51 6.31 45 XM_H_GMP 19028 6.38 6.55 6.31 46 RCVD_IN_MSPIKE_H3 16011 4.92 4.05 5.31 47 RCVD_IN_MSPIKE_WL 16011 4.92 4.05 5.31 48 TR_MAX_INTL_RELAY 15900 8.23 14.97 5.27 49 XM_H_Long_From01 15635 5.33 5.68 5.18 50 XM_PDF 15536 3.82 0.81 5.15 51 XM_B_Phish_Phrases 15510 5.76 7.17 5.14 52 BAYES_40 15070 4.02 1.82 4.99 53 HTML_IMAGE_RATIO_02 14841 5.69 7.46 4.92 54 RCVD_IN_VALIDITY_SAFE 14165 3.77 1.68 4.69 55 XM_DK_Undo_02 13740 15.19 39.43 4.55 56 XMStrtUSub 13619 4.29 3.77 4.51 57 MIME_QP_LONG_LINE 13574 4.02 2.93 4.50 58 XM_UncommonTLD01 13296 4.92 6.10 4.41 59 TR_XM_SpammyWords4 12978 6.61 11.87 4.30 60 XM_B_SpammyWords3 12660 7.47 14.92 4.20 61 XMSubMetaSx_00 12372 4.88 6.64 4.10 62 RELAYCOUNTRY_META 11988 7.05 14.05 3.97 63 MPART_ALT_DIFF 11513 4.34 5.54 3.82 64 BAYES_20 11057 2.92 1.23 3.66 65 T_REMOTE_IMAGE 10941 3.02 1.65 3.63 66 RCVD_IN_VALIDITY_CERTIFIED 10150 2.75 1.34 3.36 67 RCVD_IN_IADB_LISTED 10115 2.70 1.20 3.35 68 HTML_IMAGE_RATIO_04 10114 3.47 3.75 3.35 69 BOUNCE_MESSAGE 10092 2.58 0.83 3.34 70 ANY_BOUNCE_MESSAGE 10092 2.58 0.83 3.34 71 BAYES_80 9951 5.10 9.19 3.30 72 TooManyTo_002 9782 2.52 0.87 3.24 73 MAILING_LIST_MULTI 9679 2.92 2.26 3.21 74 BAYES_99 9557 11.13 29.28 3.17 75 T_TooManySym_02 9551 2.42 0.71 3.17 76 BOTNET_IPINHOSTNAME 9544 5.75 11.63 3.16 77 XMNumbers 9472 3.39 3.98 3.14 78 RCVD_IN_IADB_SPF 8784 2.35 1.09 2.91 79 DKIM_INVALID 8369 3.52 5.22 2.77 80 HTML_IMAGE_RATIO_06 8182 2.94 3.45 2.71 81 T_FILL_THIS_FORM_SHORT 8155 2.53 2.12 2.70 82 HTML_MIME_NO_HTML_TAG 8010 2.28 1.42 2.65 83 RCVD_IN_IADB_SENDERID 7828 2.12 1.02 2.59 84 RCVD_IN_IADB_DK 7641 2.07 1.03 2.53 85 INVALID_MSGID 7431 1.75 0.13 2.46 86 XM_CamelCaseFrm001 7386 2.59 2.91 2.45 87 XM_B_URI_Unicode 7354 2.50 2.64 2.44 88 BAYES_999 7272 8.46 22.25 2.41 89 XM_Body_Dirty_Words 7152 4.55 9.50 2.37 90 BAYES_05 6989 1.80 0.62 2.32 91 MIME_HTML_ONLY_MULTI 6873 2.59 3.29 2.28 92 RCVD_IN_IADB_VOUCHED 6787 1.73 0.54 2.25 93 XMMoneyMeta_00 6742 1.80 0.80 2.23 94 XM_B_SpammyTLD 6739 3.08 5.02 2.23 95 MIME_HTML_MOSTLY 6329 2.34 2.90 2.10 96 TO_MALFORMED 6189 1.45 0.07 2.05 97 BAYES_95 5935 3.05 5.51 1.97 98 TR_XM_SpammyRelay 5925 4.51 10.32 1.96 99 TM2_M_VERY_LONG_WORD 5848 2.45 3.62 1.94 100 T_XMDrugObfuBody_14 5714 2.64 4.35 1.89 101 TooManyTo_003 5711 1.56 0.80 1.89 102 HTML_IMAGE_RATIO_08 5579 2.12 2.72 1.85 103 XMSexyCombo_05 5363 2.63 4.57 1.78 104 KHOP_HELO_FCRDNS 5328 1.61 1.25 1.77 105 XMDiploma_00 5268 2.16 3.10 1.75 106 XM_SPF_SoftFail 5205 2.26 3.49 1.72 107 XM_DK_Undo_01 5101 1.72 1.77 1.69 108 TR_XM_DKIM_Undo 5087 9.99 28.89 1.69 109 TR_Symld_Words 5034 1.65 1.60 1.67 110 T_XMDrugObfuBody_08 5023 2.20 3.42 1.66 111 TR_XM_SpammyWords5 4894 2.53 4.61 1.62 112 RCVD_IN_IADB_OPTIN 4787 1.21 0.36 1.59 113 XM_B_Investor 4667 2.73 5.42 1.55 114 UNTRUSTED_Relay 4600 2.74 5.50 1.52 115 TM2_M_URI_OPT_OUT 4591 1.85 2.58 1.52 116 SUBJ_ALL_CAPS 4545 1.81 2.50 1.51 117 XM_B_Unsub2 4521 1.75 2.31 1.50 118 TR_XM_PhishingBody 4517 2.22 3.85 1.50 119 FROM_EXCESS_BASE64 4470 1.73 2.30 1.48 120 TooManyTo_004 4417 1.24 0.74 1.46 121 XM_SendGrid 4366 1.41 1.31 1.45 122 IN_HORDE_ADDRESS_BOOK 4342 1.03 0.11 1.44 123 XMGappySubj_01 4342 1.05 0.16 1.44 124 XMCapTrack 4321 1.17 0.58 1.43 125 XMStockSpam_06 4258 1.57 1.93 1.41 126 HELO_NODOT 4197 1.06 0.32 1.39 127 TR_XM_UnparsRelay 4196 3.39 7.95 1.39 128 HELO_NO_DOMAIN 4195 1.06 0.32 1.39 129 BOTNET 4129 3.68 8.94 1.37 130 XM_GoogleGroups 3934 1.13 0.73 1.30 131 TVD_SPACE_RATIO 3851 0.94 0.18 1.28 132 URI_NOVOWEL 3708 1.12 0.87 1.23 133 RELAYCOUNTRY_CA 3685 2.32 4.84 1.22 134 TooManyTo_005 3665 1.06 0.70 1.21 135 T_TooManySym_03 3448 0.87 0.26 1.14 136 URI_HEX 3435 1.24 1.49 1.14 137 DKIM_ADSP_CUSTOM_MED 3312 1.14 1.23 1.10 138 HTML_IMAGE_ONLY_32 3197 0.78 0.14 1.06 139 XM_OfRef6 3036 1.90 3.94 1.01 140 XM_H_Long_From02 2895 1.10 1.41 0.96 141 HTTPS_HTTP_MISMATCH 2864 1.00 1.13 0.95 142 XM_UB50 2864 1.54 2.87 0.95 143 XMNoVowels 2859 0.85 0.64 0.95 144 XMGappySubj_02 2828 0.66 0.02 0.94 145 TR_DCC_Bayes_99 2820 7.10 21.13 0.93 146 TR_XM_DK_SendGrid 2673 0.87 0.85 0.89 147 XMBrknScrpt_02 2668 1.04 1.40 0.88 148 XM_ShortIntro_01 2662 0.78 0.54 0.88 149 XMSubMetaSxObfu_03 2611 0.77 0.56 0.87 150 SpammyFromTLD_01 2586 1.24 2.12 0.86 151 XMGenDplmaNmb 2502 1.03 1.50 0.83 152 RCVD_IN_PBL 2497 0.84 0.88 0.83 153 XMLngstWrd_00 2469 0.69 0.40 0.82 154 NML_ADSP_CUSTOM_MED 2289 0.81 0.92 0.76 155 XM_H_PHPMailer 2264 0.76 0.79 0.75 156 XM_B_COPY_HTML 2235 1.06 1.79 0.74 157 FROM_GOV_DKIM_AU 2200 0.55 0.13 0.73 158 XMBody_95 2195 0.54 0.11 0.73 159 XM_B_DNDMA 2188 0.72 0.71 0.73 160 URI_TRY_3LD 2151 0.86 1.20 0.71 161 T_XMDrugObfuBody_00 2142 1.25 2.47 0.71 162 RELAYCOUNTRY_AU 2093 1.34 2.81 0.69 163 XM_B_SpammyWords4 2061 1.15 2.23 0.68 164 RCVD_IN_BL_SPAMCOP_NET 2043 3.29 9.23 0.68 165 FORGED_GMAIL_RCVD 2042 0.69 0.74 0.68 166 TVD_RCVD_IP 2012 0.76 0.96 0.67 167 T_TVD_MIME_NO_HEADERS 1956 0.47 0.05 0.65 168 TR_MetaPhish_Combo_01 1944 0.70 0.82 0.64 169 XMBdyGiftCard01 1930 0.76 1.04 0.64 170 MPART_ALT_DIFF_COUNT 1901 0.71 0.90 0.63 171 PLING_QUERY 1886 0.63 0.63 0.63 172 HTML_TAG_BALANCE_BODY 1833 0.73 1.00 0.61 173 XMSubMetaI_00 1819 0.95 1.73 0.60 174 XMPhish30 1768 0.85 1.44 0.59 175 TR_XM_Base64_M1 1768 0.75 1.12 0.59 176 XMLngstWrd_01 1752 0.50 0.32 0.58 177 T_OBFU_PDF_ATTACH 1716 0.44 0.14 0.57 178 MISSING_HEADERS 1683 0.61 0.74 0.56 179 FROM_GOV_SPOOF 1625 0.40 0.10 0.54 180 XM_B_FormFill 1601 0.38 0.03 0.53 181 MSGID_FROM_MTA_HEADER 1572 0.39 0.08 0.52 182 XM_ProductURIs 1563 0.75 1.28 0.52 183 LongTLD 1531 0.63 0.92 0.51 184 T_XMHurry_00 1508 1.21 2.83 0.50 185 TR_XM_FormFill2 1476 0.73 1.29 0.49 186 T_Symld_Words_02 1447 0.56 0.74 0.48 187 TR_XM_PHPForged 1444 0.74 1.34 0.48 188 TR_XM_PHPDW 1430 0.73 1.32 0.47 189 XMLngstWrd_02 1404 0.41 0.28 0.47 190 RELAYCOUNTRY_GB 1404 0.55 0.76 0.47 191 XM_H_PHPOS 1401 0.71 1.28 0.46 192 SHORT_HELO_AND_INLINE_IMAGE 1360 0.32 0.02 0.45 193 TM2_M_BODY_EMPTY 1332 0.32 0.05 0.44 194 XMSlimDrugH 1319 0.67 1.20 0.44 195 HTML_IMAGE_ONLY_24 1314 0.36 0.18 0.44 196 XMDateMe_00 1305 0.41 0.37 0.43 197 FILL_THIS_FORM 1299 0.48 0.58 0.43 198 T_TooManySym_04 1240 0.30 0.06 0.41 199 TO_NO_BRKTS_HTML_ONLY 1236 0.36 0.26 0.41 200 RDNS_DYNAMIC 1219 0.62 1.10 0.40 ----------------------------------------------------------------------