Email: 441440 Autolearn: 0 AvgScore: 4.76 AvgScanTime: 1.30 sec Spam: 137937 Autolearn: 0 AvgScore: 14.95 AvgScanTime: 1.43 sec Ham: 303503 Autolearn: 0 AvgScore: 0.13 AvgScanTime: 1.25 sec Time Spent Running SA: 159.97 hours Time Spent Processing Spam: 54.80 hours Time Spent Processing Ham: 105.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130106 87.90 94.32 84.99 2 DKIM_SIGNED 122244 78.45 88.62 73.83 3 RELAYCOUNTRY_US 116399 81.20 84.39 79.75 4 XM_DK_Pass 115623 75.88 83.82 72.27 5 DKIM_VALID 114401 74.78 82.94 71.08 6 XM_B_Unicode 113539 71.50 82.31 66.58 7 DCC_CHECK 104266 48.71 75.59 36.49 8 XM_B_SpammyWords 97614 51.91 70.77 43.33 9 XMListUnsubscribeExists 96938 52.55 70.28 44.49 10 DKIM_VALID_AU 91269 59.99 66.17 57.18 11 XM_B_Unicode3 67393 41.30 48.86 37.86 12 LOC_TINY_FONT_1 67238 31.76 48.75 24.05 13 XM_B_SpammyWords2 57406 24.80 41.62 17.15 14 BAYES_50 56642 53.74 41.06 59.50 15 RCVD_IN_MSPIKE_H2 52835 34.71 38.30 33.08 16 XM_DK_Undo_02 52760 15.02 38.25 4.47 17 HTML_FONT_LOW_CONTRAST 51933 29.34 37.65 25.57 18 T_KAM_HTML_FONT_INVALID 43981 23.46 31.88 19.63 19 FVGT_m_MULTI_ODD 43795 26.35 31.75 23.90 20 DKIM_VALID_EF 40973 30.50 29.70 30.86 21 BAYES_99 39885 12.01 28.92 4.32 22 TR_XM_DKIM_Undo 38715 9.98 28.07 1.75 23 MIME_HTML_ONLY 37048 21.49 26.86 19.05 24 XMSubLong 34742 24.28 25.19 23.86 25 T_TM2_M_HEADER_IN_MSG 31871 30.44 23.11 33.78 26 XM_Multi_Part_URI 31576 15.89 22.89 12.70 27 DCC_CHECK_NEGATIVE 30824 50.62 22.35 63.46 28 BAYES_999 30169 9.08 21.87 3.26 29 TR_DCC_Bayes_99 29244 7.32 21.20 1.01 30 TR_XM_DK_Unsub 28712 15.10 20.82 12.50 31 UNPARSEABLE_RELAY 23717 12.90 17.19 10.95 32 TR_MAX_INTL_RELAY 21331 8.69 15.46 5.62 33 XM_B_Unsub 21233 10.83 15.39 8.75 34 TR_XM_BayesUnsub 20541 9.28 14.89 6.73 35 XM_B_SpammyWords3 20427 7.43 14.81 4.08 36 RELAYCOUNTRY_META 20287 7.28 14.71 3.90 37 LOTS_OF_MONEY 19260 8.85 13.96 6.53 38 TR_XM_SpammyWords4 17294 6.98 12.54 4.46 39 BOTNET_IPINHOSTNAME 16376 5.69 11.87 2.88 40 TR_XM_SpammyRelay 14663 4.60 10.63 1.86 41 TR_XM_SpammyWords2 14582 3.51 10.57 0.30 42 BAYES_80 13273 5.36 9.62 3.42 43 FSL_BULK_SIG 12806 8.04 9.28 7.47 44 RCVD_IN_BL_SPAMCOP_NET 12666 3.35 9.18 0.70 45 BOTNET 12433 3.72 9.01 1.31 46 XM_Evil_Numbers_Gen 12087 8.73 8.76 8.71 47 XM_Body_Dirty_Words 11973 4.21 8.68 2.18 48 TR_XM_UnparsRelay 11816 3.65 8.57 1.41 49 BAYES_60 11734 8.52 8.51 8.52 50 LotsOfNums_01 11662 7.79 8.45 7.50 51 TR_XM_SPAMCOP 11069 2.82 8.02 0.45 52 XM_B_Phish_Phrases 10644 5.69 7.72 4.76 53 XMSubMetaSx_00 9544 4.74 6.92 3.75 54 MPART_ALT_DIFF 8897 4.59 6.45 3.75 55 XM_UncommonTLD01 8850 5.16 6.42 4.59 56 HTML_IMAGE_RATIO_02 8135 4.87 5.90 4.41 57 XM_H_Long_From01 7996 5.44 5.80 5.28 58 DKIM_INVALID 7843 3.67 5.69 2.75 59 XM_H_GMP 7827 5.98 5.67 6.12 60 BAYES_95 7671 3.24 5.56 2.19 61 XM_B_PhoneNumber 7670 8.90 5.56 10.42 62 UNTRUSTED_Relay 7592 2.68 5.50 1.40 63 RELAYCOUNTRY_CA 7070 2.43 5.13 1.20 64 HTML_IMAGE_RATIO_04 6866 3.97 4.98 3.51 65 XMSexyCombo_05 6642 2.43 4.82 1.35 66 TR_XM_PhishingBody 6423 2.46 4.66 1.46 67 XM_B_Investor 6202 2.40 4.50 1.45 68 TooManyTo_001 6002 7.77 4.35 9.32 69 TM2_M_VERY_LONG_WORD 5995 2.72 4.35 1.99 70 RCVD_IN_MSPIKE_WL 5681 5.20 4.12 5.69 71 RCVD_IN_MSPIKE_H3 5681 5.20 4.12 5.69 72 T_XMDrugObfuBody_14 5524 2.46 4.00 1.76 73 XMStrtUSub 5420 4.22 3.93 4.35 74 MIME_HTML_ONLY_MULTI 5320 2.68 3.86 2.15 75 XM_OfRef6 5315 1.97 3.85 1.11 76 RCVD_IN_VALIDITY_RPBL 4913 1.18 3.56 0.10 77 TR_XM_SpammyWords5 4808 1.91 3.49 1.19 78 XMNumbers 4759 3.08 3.45 2.91 79 T_XMDrugObfuBody_08 4740 2.27 3.44 1.74 80 XM_B_SpammyTLD 4731 2.67 3.43 2.32 81 XM_CamelCaseFrm001 4646 3.14 3.37 3.04 82 XM_SPF_SoftFail 4553 2.14 3.30 1.62 83 T_XMHurry_00 4313 1.42 3.13 0.65 84 HTML_IMAGE_RATIO_06 4243 2.60 3.08 2.38 85 MIME_HTML_MOSTLY 4153 2.41 3.01 2.14 86 XM_B_SpammyWords4 4021 1.40 2.92 0.71 87 MIME_QP_LONG_LINE 3958 4.17 2.87 4.76 88 XMBody_17 3905 1.19 2.83 0.44 89 XMDiploma_00 3706 1.96 2.69 1.63 90 RELAYCOUNTRY_AU 3701 1.22 2.68 0.55 91 XM_UB50 3571 1.39 2.59 0.85 92 DKIM_ADSP_NXDOMAIN 3564 1.04 2.58 0.34 93 HTML_IMAGE_RATIO_08 3499 2.02 2.54 1.79 94 NO_DNS_FOR_FROM 3332 0.95 2.42 0.28 95 XM_URI_RBL 3310 0.95 2.40 0.29 96 TR_XM_MaxWHORU 3303 0.90 2.39 0.23 97 MAILING_LIST_MULTI 3259 2.92 2.36 3.18 98 T_TooManySym_01 3237 5.18 2.35 6.47 99 XM_B_Unsub2 3208 1.59 2.33 1.25 100 XM_B_URI_Unicode 3183 2.09 2.31 2.00 101 T_XMDrugObfuBody_00 3132 1.27 2.27 0.81 102 TM2_M_URI_OPT_OUT 3113 1.83 2.26 1.63 103 SUSP_UTF8_WORD_SUBJ 2944 0.67 2.13 0.01 104 T_REMOTE_IMAGE 2944 3.19 2.13 3.66 105 SpammyFromTLD_02 2923 0.82 2.12 0.23 106 XMStockSpam_06 2919 1.58 2.12 1.33 107 RCVD_IN_VALIDITY_SAFE 2915 3.37 2.11 3.94 108 RCVD_IN_ZEN_LASTEXTERNAL 2803 0.63 2.03 0.00 109 SHORTCIRCUIT 2803 0.63 2.03 0.00 110 FROM_EXCESS_BASE64 2794 1.68 2.03 1.52 111 TR_XM_INV_DKIM 2781 0.69 2.02 0.09 112 SpammyFromTLD_01 2751 1.32 1.99 1.01 113 SUSP_UTF8_WORD_COMBO 2474 0.58 1.79 0.03 114 TR_XM_NoHeaderRelay 2464 0.72 1.79 0.23 115 T_FILL_THIS_FORM_SHORT 2456 1.22 1.78 0.97 116 MIME_CHARSET_FARAWAY 2385 0.82 1.73 0.41 117 XM_H_Undi_Recip 2297 0.69 1.67 0.25 118 KHOP_HELO_FCRDNS 2296 1.71 1.66 1.73 119 RCVD_IN_VALIDITY_CERTIFIED 2279 2.54 1.65 2.94 120 XM_DK_Undo_01 2260 1.75 1.64 1.80 121 XMBrknScrpt_02 2247 1.13 1.63 0.90 122 ALL_TRUSTED 2241 12.37 1.62 17.26 123 XMGenDplmaNmb 2217 1.20 1.61 1.02 124 USER_IN_DEF_DKIM_WL 2217 8.37 1.61 11.44 125 TR_LOTS_OF_MONEY3 2210 0.70 1.60 0.30 126 DIET_1 2177 0.72 1.58 0.33 127 HTML_MIME_NO_HTML_TAG 2164 2.36 1.57 2.72 128 TR_XM_PHPForged 2117 0.87 1.53 0.57 129 TR_XM_PHPDW 2112 0.87 1.53 0.57 130 BAYES_40 2089 3.96 1.51 5.08 131 TR_XM_FormFill2 2078 0.87 1.51 0.58 132 XM_B_COPY_HTML 2050 0.86 1.49 0.58 133 XM_H_PHPOS 2048 0.85 1.48 0.56 134 BOUNCE_MESSAGE 2046 2.88 1.48 3.52 135 ANY_BOUNCE_MESSAGE 2046 2.88 1.48 3.52 136 SUBJ_ALL_CAPS 2016 1.42 1.46 1.40 137 XMPhish30 1973 0.78 1.43 0.49 138 TR_XM_Undi_Recip19 1961 0.51 1.42 0.09 139 URI_HEX 1788 1.20 1.30 1.16 140 HTTPS_HTTP_MISMATCH 1782 1.00 1.29 0.87 141 URI_NOVOWEL 1736 1.28 1.26 1.29 142 URI_TRY_3LD 1723 0.87 1.25 0.70 143 BAYES_20 1711 3.00 1.24 3.80 144 TR_MetaPhish_Combo_01 1705 1.20 1.24 1.18 145 RCVD_IN_IADB_LISTED 1687 2.72 1.22 3.40 146 XM_OfRef7 1685 0.52 1.22 0.20 147 XM_B_Phish66 1678 0.60 1.22 0.32 148 DKIM_ADSP_CUSTOM_MED 1662 1.07 1.20 1.01 149 XM_H_Long_From02 1622 0.99 1.18 0.91 150 DEAR_FRIEND 1615 0.39 1.17 0.03 151 RELAYCOUNTRY_GB 1591 0.74 1.15 0.55 152 TooManyTo_002 1588 2.62 1.15 3.29 153 XM_SendGrid 1586 1.39 1.15 1.49 154 RELAYCOUNTRY_FR 1548 0.51 1.12 0.24 155 XMHTML_After_End 1545 0.61 1.12 0.37 156 TR_XM_Undi_RecipCombo2 1539 0.36 1.12 0.01 157 THIS_AD 1525 0.65 1.11 0.44 158 T_Symld_Words_02 1509 0.66 1.09 0.47 159 XM_B_SEO 1506 0.52 1.09 0.26 160 TR_XM_RelayPhish 1491 0.40 1.08 0.08 161 RCVD_IN_IADB_SPF 1488 2.42 1.08 3.02 162 LongTLD 1471 0.66 1.07 0.48 163 TooManyTo_003 1468 1.68 1.06 1.95 164 XMSubMetaI_00 1458 0.78 1.06 0.65 165 T_MONEY_PERCENT 1451 0.50 1.05 0.25 166 TR_LOTS_OF_MONEY2 1451 0.50 1.05 0.25 167 HTML_TAG_BALANCE_BODY 1421 0.67 1.03 0.51 168 XM_B_COVIDMETA 1418 0.45 1.03 0.19 169 RCVD_IN_PBL 1412 0.82 1.02 0.73 170 RCVD_IN_IADB_DK 1410 2.14 1.02 2.64 171 RCVD_IN_IADB_SENDERID 1407 2.19 1.02 2.72 172 XM_ProductURIs 1406 1.03 1.02 1.04 173 XMSexyCombo_01 1401 0.40 1.02 0.12 174 UNDISC_MONEY 1394 0.32 1.01 0.00 175 HOSTED_IMG_MULTI_PUB_01 1393 0.32 1.01 0.01 176 TooManyTo_004 1390 1.32 1.01 1.47 177 TR_Symld_Words 1376 1.49 1.00 1.72 178 TVD_RCVD_IP 1335 0.79 0.97 0.72 179 XMPhish14 1322 0.57 0.96 0.40 180 PLING_QUERY 1321 0.50 0.96 0.29 181 TooManyTo_005 1320 1.14 0.96 1.22 182 XMBody_78 1316 0.49 0.95 0.28 183 RCVD_IN_SORBS_DUL 1313 0.34 0.95 0.06 184 XMMoneyMeta_00 1305 0.66 0.95 0.53 185 TM2_M_OBFU_COMMENT 1298 0.53 0.94 0.34 186 TR_XM_Base64_M1 1281 0.75 0.93 0.67 187 TR_XM_SEO4 1279 0.38 0.93 0.13 188 HTML_FONT_FACE_BAD 1277 0.55 0.93 0.39 189 TR_XM_InvalidRelay 1262 0.29 0.91 0.01 190 MPART_ALT_DIFF_COUNT 1234 0.70 0.89 0.61 191 NML_ADSP_CUSTOM_MED 1224 0.78 0.89 0.74 192 RDNS_DYNAMIC 1217 0.49 0.88 0.31 193 T_STY_INVIS_DIRECT 1217 0.52 0.88 0.36 194 SHOPIFY_IMG_NOT_RCVD_SFY 1206 0.42 0.87 0.22 195 PDS_RDNS_DYNAMIC_FP 1194 0.37 0.87 0.15 196 XMHTMLBadTable_001 1192 0.44 0.86 0.25 197 XM_UB99 1178 0.27 0.85 0.00 198 XMSlimDrugH 1174 0.61 0.85 0.50 199 FORGED_GMAIL_RCVD 1173 0.69 0.85 0.61 200 XMReplyNow 1168 0.44 0.85 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 257934 87.90 94.32 84.99 2 RELAYCOUNTRY_US 242055 81.20 84.39 79.75 3 DKIM_SIGNED 224078 78.45 88.62 73.83 4 XM_DK_Pass 219349 75.88 83.82 72.27 5 DKIM_VALID 215718 74.78 82.94 71.08 6 XM_B_Unicode 202073 71.50 82.31 66.58 7 DCC_CHECK_NEGATIVE 192611 50.62 22.35 63.46 8 BAYES_50 180576 53.74 41.06 59.50 9 DKIM_VALID_AU 173545 59.99 66.17 57.18 10 XMListUnsubscribeExists 135026 52.55 70.28 44.49 11 XM_B_SpammyWords 131516 51.91 70.77 43.33 12 XM_B_Unicode3 114910 41.30 48.86 37.86 13 DCC_CHECK 110754 48.71 75.59 36.49 14 T_TM2_M_HEADER_IN_MSG 102522 30.44 23.11 33.78 15 RCVD_IN_MSPIKE_H2 100386 34.71 38.30 33.08 16 DKIM_VALID_EF 93660 30.50 29.70 30.86 17 HTML_FONT_LOW_CONTRAST 77597 29.34 37.65 25.57 18 LOC_TINY_FONT_1 72981 31.76 48.75 24.05 19 FVGT_m_MULTI_ODD 72536 26.35 31.75 23.90 20 XMSubLong 72426 24.28 25.19 23.86 21 T_KAM_HTML_FONT_INVALID 59586 23.46 31.88 19.63 22 MIME_HTML_ONLY 57803 21.49 26.86 19.05 23 ALL_TRUSTED 52377 12.37 1.62 17.26 24 XM_B_SpammyWords2 52053 24.80 41.62 17.15 25 XM_Multi_Part_URI 38559 15.89 22.89 12.70 26 TR_XM_DK_Unsub 37929 15.10 20.82 12.50 27 USER_IN_DEF_DKIM_WL 34712 8.37 1.61 11.44 28 UNPARSEABLE_RELAY 33233 12.90 17.19 10.95 29 BAYES_00 33220 7.78 0.82 10.95 30 XM_B_PhoneNumber 31639 8.90 5.56 10.42 31 TooManyTo_001 28289 7.77 4.35 9.32 32 XM_B_Unsub 26562 10.83 15.39 8.75 33 XM_Evil_Numbers_Gen 26434 8.73 8.76 8.71 34 BAYES_60 25871 8.52 8.51 8.52 35 LotsOfNums_01 22748 7.79 8.45 7.50 36 FSL_BULK_SIG 22680 8.04 9.28 7.47 37 IN_ZIMBRA_NJ_WHITELIST 21577 4.91 0.08 7.11 38 TR_XM_DK_Bayes 21268 5.04 0.71 7.01 39 TR_XM_DK_Bayes1 20915 4.96 0.71 6.89 40 TR_XM_BayesUnsub 20416 9.28 14.89 6.73 41 LOTS_OF_MONEY 19811 8.85 13.96 6.53 42 XM_DKIMWhitelistDomains 19682 4.61 0.49 6.48 43 T_TooManySym_01 19628 5.18 2.35 6.47 44 XM_H_GMP 18588 5.98 5.67 6.12 45 TR_XM_DK_Bayes2 17980 4.24 0.54 5.92 46 RCVD_IN_MSPIKE_H3 17278 5.20 4.12 5.69 47 RCVD_IN_MSPIKE_WL 17278 5.20 4.12 5.69 48 TR_MAX_INTL_RELAY 17045 8.69 15.46 5.62 49 XM_H_Long_From01 16037 5.44 5.80 5.28 50 BAYES_40 15403 3.96 1.51 5.08 51 XM_PDF 15362 3.74 0.82 5.06 52 XM_B_Phish_Phrases 14460 5.69 7.72 4.76 53 MIME_QP_LONG_LINE 14457 4.17 2.87 4.76 54 XM_UncommonTLD01 13940 5.16 6.42 4.59 55 XM_DK_Undo_02 13552 15.02 38.25 4.47 56 TR_XM_SpammyWords4 13531 6.98 12.54 4.46 57 HTML_IMAGE_RATIO_02 13381 4.87 5.90 4.41 58 XMStrtUSub 13207 4.22 3.93 4.35 59 BAYES_99 13126 12.01 28.92 4.32 60 XM_B_SpammyWords3 12390 7.43 14.81 4.08 61 RCVD_IN_VALIDITY_SAFE 11964 3.37 2.11 3.94 62 RELAYCOUNTRY_META 11837 7.28 14.71 3.90 63 BAYES_20 11539 3.00 1.24 3.80 64 XMSubMetaSx_00 11387 4.74 6.92 3.75 65 MPART_ALT_DIFF 11371 4.59 6.45 3.75 66 T_REMOTE_IMAGE 11120 3.19 2.13 3.66 67 BOUNCE_MESSAGE 10669 2.88 1.48 3.52 68 ANY_BOUNCE_MESSAGE 10669 2.88 1.48 3.52 69 HTML_IMAGE_RATIO_04 10667 3.97 4.98 3.51 70 BAYES_80 10384 5.36 9.62 3.42 71 RCVD_IN_IADB_LISTED 10328 2.72 1.22 3.40 72 TooManyTo_002 9997 2.62 1.15 3.29 73 BAYES_999 9906 9.08 21.87 3.26 74 T_TooManySym_02 9724 2.44 0.76 3.20 75 MAILING_LIST_MULTI 9653 2.92 2.36 3.18 76 XM_CamelCaseFrm001 9231 3.14 3.37 3.04 77 RCVD_IN_IADB_SPF 9175 2.42 1.08 3.02 78 RCVD_IN_VALIDITY_CERTIFIED 8933 2.54 1.65 2.94 79 XMNumbers 8846 3.08 3.45 2.91 80 BOTNET_IPINHOSTNAME 8738 5.69 11.87 2.88 81 DKIM_INVALID 8360 3.67 5.69 2.75 82 RCVD_IN_IADB_SENDERID 8268 2.19 1.02 2.72 83 HTML_MIME_NO_HTML_TAG 8241 2.36 1.57 2.72 84 RCVD_IN_IADB_DK 8024 2.14 1.02 2.64 85 INVALID_MSGID 7357 1.71 0.12 2.42 86 HTML_IMAGE_RATIO_06 7218 2.60 3.08 2.38 87 XM_B_SpammyTLD 7043 2.67 3.43 2.32 88 BAYES_05 6718 1.75 0.72 2.21 89 BAYES_95 6651 3.24 5.56 2.19 90 XM_Body_Dirty_Words 6628 4.21 8.68 2.18 91 RCVD_IN_IADB_VOUCHED 6528 1.66 0.57 2.15 92 MIME_HTML_ONLY_MULTI 6526 2.68 3.86 2.15 93 MIME_HTML_MOSTLY 6498 2.41 3.01 2.14 94 TO_MALFORMED 6194 1.41 0.02 2.04 95 XM_B_URI_Unicode 6058 2.09 2.31 2.00 96 TM2_M_VERY_LONG_WORD 6025 2.72 4.35 1.99 97 TooManyTo_003 5931 1.68 1.06 1.95 98 TR_XM_SpammyRelay 5653 4.60 10.63 1.86 99 XM_DK_Undo_01 5449 1.75 1.64 1.80 100 HTML_IMAGE_RATIO_08 5433 2.02 2.54 1.79 101 T_XMDrugObfuBody_14 5329 2.46 4.00 1.76 102 TR_XM_DKIM_Undo 5319 9.98 28.07 1.75 103 T_XMDrugObfuBody_08 5296 2.27 3.44 1.74 104 KHOP_HELO_FCRDNS 5253 1.71 1.66 1.73 105 TR_Symld_Words 5215 1.49 1.00 1.72 106 TM2_M_URI_OPT_OUT 4948 1.83 2.26 1.63 107 XMDiploma_00 4941 1.96 2.69 1.63 108 XM_SPF_SoftFail 4912 2.14 3.30 1.62 109 RCVD_IN_IADB_OPTIN 4663 1.16 0.33 1.54 110 IN_HORDE_ADDRESS_BOOK 4619 1.07 0.07 1.52 111 FROM_EXCESS_BASE64 4611 1.68 2.03 1.52 112 XM_SendGrid 4529 1.39 1.15 1.49 113 HELO_NODOT 4492 1.08 0.19 1.48 114 HELO_NO_DOMAIN 4488 1.08 0.19 1.48 115 TooManyTo_004 4457 1.32 1.01 1.47 116 TR_XM_PhishingBody 4441 2.46 4.66 1.46 117 XM_B_Investor 4414 2.40 4.50 1.45 118 XMCapTrack 4333 1.16 0.58 1.43 119 TR_XM_UnparsRelay 4286 3.65 8.57 1.41 120 UNTRUSTED_Relay 4246 2.68 5.50 1.40 121 SUBJ_ALL_CAPS 4235 1.42 1.46 1.40 122 XM_GoogleGroups 4124 1.16 0.71 1.36 123 XMSexyCombo_05 4086 2.43 4.82 1.35 124 XMStockSpam_06 4044 1.58 2.12 1.33 125 BOTNET 3971 3.72 9.01 1.31 126 URI_NOVOWEL 3925 1.28 1.26 1.29 127 XMGappySubj_01 3913 0.94 0.16 1.29 128 TVD_SPACE_RATIO 3819 0.92 0.17 1.26 129 XM_B_Unsub2 3808 1.59 2.33 1.25 130 TooManyTo_005 3693 1.14 0.96 1.22 131 RELAYCOUNTRY_CA 3645 2.43 5.13 1.20 132 TR_XM_SpammyWords5 3607 1.91 3.49 1.19 133 TR_MetaPhish_Combo_01 3579 1.20 1.24 1.18 134 URI_HEX 3512 1.20 1.30 1.16 135 T_TooManySym_03 3411 0.87 0.30 1.12 136 XM_OfRef6 3380 1.97 3.85 1.11 137 XMNoVowels 3361 0.98 0.70 1.11 138 XM_ProductURIs 3148 1.03 1.02 1.04 139 XMGenDplmaNmb 3093 1.20 1.61 1.02 140 TR_DCC_Bayes_99 3067 7.32 21.20 1.01 141 SpammyFromTLD_01 3058 1.32 1.99 1.01 142 DKIM_ADSP_CUSTOM_MED 3058 1.07 1.20 1.01 143 T_FILL_THIS_FORM_SHORT 2942 1.22 1.78 0.97 144 TR_XM_DK_SendGrid 2939 0.88 0.69 0.97 145 XM_H_Long_From02 2765 0.99 1.18 0.91 146 XMGappySubj_02 2765 0.64 0.05 0.91 147 XMBrknScrpt_02 2733 1.13 1.63 0.90 148 XM_ShortIntro_01 2718 0.82 0.65 0.90 149 HTTPS_HTTP_MISMATCH 2637 1.00 1.29 0.87 150 XM_H_PHPMailer 2581 0.78 0.63 0.85 151 XM_UB50 2572 1.39 2.59 0.85 152 HTML_IMAGE_ONLY_32 2541 0.63 0.17 0.84 153 T_XMDrugObfuBody_00 2465 1.27 2.27 0.81 154 NML_ADSP_CUSTOM_MED 2237 0.78 0.89 0.74 155 RCVD_IN_PBL 2213 0.82 1.02 0.73 156 XMLngstWrd_00 2189 0.68 0.58 0.72 157 TVD_RCVD_IP 2172 0.79 0.97 0.72 158 XM_B_SpammyWords4 2142 1.40 2.92 0.71 159 XMBody_95 2139 0.53 0.16 0.70 160 URI_TRY_3LD 2112 0.87 1.25 0.70 161 RCVD_IN_BL_SPAMCOP_NET 2110 3.35 9.18 0.70 162 FROM_GOV_DKIM_AU 2059 0.50 0.11 0.68 163 TR_XM_Base64_M1 2027 0.75 0.93 0.67 164 XMSubMetaI_00 1969 0.78 1.06 0.65 165 T_XMHurry_00 1966 1.42 3.13 0.65 166 T_OBFU_PDF_ATTACH 1926 0.51 0.25 0.63 167 MPART_ALT_DIFF_COUNT 1861 0.70 0.89 0.61 168 FORGED_GMAIL_RCVD 1855 0.69 0.85 0.61 169 MSGID_FROM_MTA_HEADER 1820 0.50 0.28 0.60 170 TO_NO_BRKTS_HTML_ONLY 1819 0.50 0.28 0.60 171 MISSING_HEADERS 1800 0.58 0.56 0.59 172 TR_XM_FormFill2 1753 0.87 1.51 0.58 173 XM_B_COPY_HTML 1752 0.86 1.49 0.58 174 XMBdyGiftCard01 1751 0.65 0.82 0.58 175 TR_XM_PHPForged 1740 0.87 1.53 0.57 176 TR_XM_PHPDW 1739 0.87 1.53 0.57 177 XM_H_PHPOS 1706 0.85 1.48 0.56 178 XM_B_DNDMA 1689 0.62 0.77 0.56 179 RELAYCOUNTRY_AU 1678 1.22 2.68 0.55 180 RELAYCOUNTRY_GB 1669 0.74 1.15 0.55 181 XMLngstWrd_01 1634 0.53 0.51 0.54 182 XMMoneyMeta_00 1602 0.66 0.95 0.53 183 T_MANY_PILL_PRICE 1601 0.37 0.01 0.53 184 HTML_TAG_BALANCE_BODY 1543 0.67 1.03 0.51 185 XM_B_FormFill 1537 0.36 0.03 0.51 186 XMSlimDrugH 1527 0.61 0.85 0.50 187 XMPhish30 1474 0.78 1.43 0.49 188 LongTLD 1457 0.66 1.07 0.48 189 T_TVD_MIME_NO_HEADERS 1429 0.33 0.03 0.47 190 T_Symld_Words_02 1412 0.66 1.09 0.47 191 SHORT_HELO_AND_INLINE_IMAGE 1384 0.32 0.03 0.46 192 FROM_GOV_SPOOF 1376 0.35 0.11 0.45 193 TR_XM_SPAMCOP 1376 2.82 8.02 0.45 194 XMDateMe_00 1357 0.46 0.48 0.45 195 HTML_IMAGE_ONLY_28 1354 0.41 0.32 0.45 196 XMLngstWrd_02 1352 0.45 0.45 0.45 197 TM2_M_BODY_EMPTY 1346 0.32 0.04 0.44 198 XMBody_17 1346 1.19 2.83 0.44 199 HTML_IMAGE_ONLY_24 1344 0.38 0.23 0.44 200 HTML_IMAGE_ONLY_20 1335 0.44 0.45 0.44 ----------------------------------------------------------------------