Email: 499914 Autolearn: 0 AvgScore: 4.30 AvgScanTime: 1.40 sec Spam: 145980 Autolearn: 0 AvgScore: 14.66 AvgScanTime: 1.55 sec Ham: 353934 Autolearn: 0 AvgScore: 0.03 AvgScanTime: 1.34 sec Time Spent Running SA: 194.33 hours Time Spent Processing Spam: 62.67 hours Time Spent Processing Ham: 131.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137946 90.14 94.50 88.35 2 DKIM_SIGNED 127811 75.23 87.55 70.15 3 XM_B_Unicode 123532 75.23 84.62 71.36 4 RELAYCOUNTRY_US 123462 81.10 84.57 79.66 5 XM_DK_Pass 122251 73.09 83.75 68.70 6 DKIM_VALID 120757 72.05 82.72 67.64 7 DCC_CHECK 107852 46.39 73.88 35.06 8 XM_B_SpammyWords 102741 53.61 70.38 46.69 9 XMListUnsubscribeExists 100036 51.45 68.53 44.41 10 DKIM_VALID_AU 95708 56.97 65.56 53.42 11 XM_B_Unicode3 74302 42.70 50.90 39.32 12 LOC_TINY_FONT_1 70246 33.42 48.12 27.35 13 XM_B_SpammyWords2 61503 28.04 42.13 22.23 14 BAYES_50 61060 54.66 41.83 59.95 15 XM_DK_Undo_02 55702 14.25 38.16 4.39 16 HTML_FONT_LOW_CONTRAST 54202 29.21 37.13 25.95 17 RCVD_IN_MSPIKE_H2 53093 33.58 36.37 32.43 18 FVGT_m_MULTI_ODD 46597 25.43 31.92 22.76 19 T_KAM_HTML_FONT_INVALID 45260 23.17 31.00 19.94 20 BAYES_99 43917 11.10 30.08 3.27 21 TR_XM_DKIM_Undo 39895 9.16 27.33 1.66 22 MIME_HTML_ONLY 39719 21.25 27.21 18.80 23 XMSubLong 39704 23.92 27.20 22.57 24 DKIM_VALID_EF 39358 27.39 26.96 27.56 25 T_TM2_M_HEADER_IN_MSG 36403 32.29 24.94 35.32 26 DCC_CHECK_NEGATIVE 35397 53.02 24.25 64.89 27 BAYES_999 34020 8.53 23.30 2.43 28 TR_DCC_Bayes_99 32413 7.25 22.20 1.08 29 XM_Multi_Part_URI 32051 15.00 21.96 12.13 30 TR_XM_DK_Unsub 26968 13.72 18.47 11.76 31 XM_B_Unsub 26015 11.26 17.82 8.55 32 TR_XM_BayesUnsub 25087 9.60 17.19 6.47 33 UNPARSEABLE_RELAY 24771 12.55 16.97 10.73 34 TR_MAX_INTL_RELAY 21939 8.10 15.03 5.24 35 RELAYCOUNTRY_META 21215 6.78 14.53 3.58 36 XM_B_SpammyWords3 20295 6.90 13.90 4.00 37 LOTS_OF_MONEY 17186 9.11 11.77 8.01 38 TR_XM_SpammyWords2 16404 3.51 11.24 0.32 39 BOTNET_IPINHOSTNAME 16046 5.27 10.99 2.91 40 TR_XM_SpammyRelay 15567 4.28 10.66 1.64 41 TR_XM_SpammyWords4 15375 7.49 10.53 6.24 42 XM_Evil_Numbers_Gen 14628 10.96 10.02 11.35 43 FSL_BULK_SIG 13798 7.37 9.45 6.51 44 BAYES_80 13625 5.03 9.33 3.26 45 LotsOfNums_01 13272 10.03 9.09 10.42 46 TR_XM_UnparsRelay 12096 3.47 8.29 1.49 47 BOTNET 11808 3.32 8.09 1.35 48 RCVD_IN_BL_SPAMCOP_NET 11711 2.75 8.02 0.57 49 XM_B_Phish_Phrases 11664 6.34 7.99 5.67 50 XM_Body_Dirty_Words 11596 3.81 7.94 2.11 51 BAYES_60 11137 7.87 7.63 7.98 52 MPART_ALT_DIFF 9892 5.15 6.78 4.48 53 XMSubMetaSx_00 9774 4.28 6.70 3.28 54 TR_XM_SPAMCOP 9718 2.20 6.66 0.37 55 HTML_IMAGE_RATIO_02 9548 4.64 6.54 3.86 56 XM_B_PhoneNumber 9473 8.73 6.49 9.65 57 XM_UncommonTLD01 8977 4.64 6.15 4.02 58 BAYES_95 7970 3.00 5.46 1.99 59 RELAYCOUNTRY_CA 7660 2.28 5.25 1.05 60 TM2_M_VERY_LONG_WORD 7644 5.11 5.24 5.06 61 UNTRUSTED_Relay 7635 2.40 5.23 1.23 62 XM_H_Long_From01 7578 5.26 5.19 5.28 63 XMStrtUSub 7368 4.65 5.05 4.49 64 XM_H_GMP 7090 5.27 4.86 5.44 65 DKIM_INVALID 7054 3.18 4.83 2.51 66 XMSexyCombo_05 6902 2.13 4.73 1.06 67 XM_B_Investor 6901 2.58 4.73 1.70 68 HTML_IMAGE_RATIO_04 6822 4.66 4.67 4.65 69 TR_XM_PhishingBody 6430 2.43 4.40 1.61 70 HTML_IMAGE_RATIO_06 6384 4.85 4.37 5.05 71 T_XMDrugObfuBody_14 6311 2.44 4.32 1.66 72 XM_B_SpammyTLD 5956 2.76 4.08 2.22 73 TR_XM_SpammyWords5 5635 2.05 3.86 1.30 74 HTML_IMAGE_RATIO_08 5553 2.81 3.80 2.40 75 XMNumbers 5504 3.13 3.77 2.86 76 RCVD_IN_MSPIKE_WL 5496 4.68 3.76 5.05 77 RCVD_IN_MSPIKE_H3 5496 4.68 3.76 5.05 78 XM_OfRef6 5485 1.82 3.76 1.02 79 TooManyTo_001 5452 6.98 3.73 8.32 80 XM_SPF_SoftFail 5419 2.11 3.71 1.45 81 TM2_M_URI_OPT_OUT 5223 2.12 3.58 1.52 82 MIME_HTML_ONLY_MULTI 5216 2.89 3.57 2.60 83 MIME_HTML_MOSTLY 4757 2.40 3.26 2.04 84 RCVD_IN_VALIDITY_RPBL 4711 1.01 3.23 0.10 85 RELAYCOUNTRY_AU 4365 1.30 2.99 0.60 86 T_XMDrugObfuBody_08 4270 2.12 2.93 1.79 87 XM_URI_RBL 4218 1.07 2.89 0.32 88 MIME_QP_LONG_LINE 4198 4.13 2.88 4.65 89 XMDiploma_00 4055 1.93 2.78 1.58 90 XM_UB50 3879 1.35 2.66 0.80 91 XM_B_Unsub2 3877 1.86 2.66 1.53 92 XM_CamelCaseFrm001 3863 2.31 2.65 2.18 93 T_TooManySym_01 3813 4.59 2.61 5.41 94 XMBody_17 3464 0.95 2.37 0.36 95 TR_XM_NoHeaderRelay 3444 0.84 2.36 0.22 96 XM_B_SpammyWords4 3424 1.29 2.35 0.86 97 BOUNCE_MESSAGE 3374 5.59 2.31 6.95 98 ANY_BOUNCE_MESSAGE 3374 5.59 2.31 6.95 99 MIME_CHARSET_FARAWAY 3312 1.69 2.27 1.45 100 RCVD_IN_VALIDITY_SAFE 3252 3.10 2.23 3.46 101 XM_B_URI_Unicode 3198 1.96 2.19 1.86 102 DKIM_ADSP_NXDOMAIN 3161 0.84 2.17 0.29 103 FROM_EXCESS_BASE64 3122 1.74 2.14 1.57 104 MAILING_LIST_MULTI 3103 2.42 2.13 2.54 105 T_XMHurry_00 2987 0.94 2.05 0.48 106 SpammyFromTLD_02 2974 0.82 2.04 0.31 107 NO_DNS_FOR_FROM 2869 0.75 1.97 0.25 108 KHOP_HELO_FCRDNS 2865 2.88 1.96 3.26 109 TR_XM_MaxWHORU 2855 0.72 1.96 0.21 110 T_XMDrugObfuBody_00 2722 1.06 1.86 0.73 111 RCVD_IN_ZEN_LASTEXTERNAL 2688 0.54 1.84 0.00 112 SHORTCIRCUIT 2688 0.54 1.84 0.00 113 SpammyFromTLD_01 2662 1.20 1.82 0.95 114 TR_XM_INV_DKIM 2604 0.64 1.78 0.16 115 XM_H_Long_From02 2565 1.15 1.76 0.89 116 USER_IN_DEF_DKIM_WL 2547 8.77 1.74 11.67 117 XM_SendGrid 2445 1.40 1.67 1.28 118 SUBJ_ALL_CAPS 2421 1.46 1.66 1.38 119 HTML_MIME_NO_HTML_TAG 2355 2.22 1.61 2.47 120 XMStockSpam_06 2339 0.96 1.60 0.70 121 XMEqualsVooDoo_00 2290 0.95 1.57 0.69 122 CHARSET_FARAWAY_HEADER 2287 1.28 1.57 1.16 123 XMGenDplmaNmb 2263 1.00 1.55 0.78 124 XMSubMetaI_00 2251 0.92 1.54 0.67 125 BAYES_40 2214 4.60 1.52 5.87 126 SUSP_UTF8_WORD_SUBJ 2208 0.46 1.51 0.02 127 XMEqualsVooDoo_01 2207 0.45 1.51 0.02 128 XMEqualsVooDoo_02 2206 0.44 1.51 0.00 129 XM_DK_Undo_01 2202 1.60 1.51 1.63 130 RCVD_IN_VALIDITY_CERTIFIED 2192 2.16 1.50 2.44 131 XM_B_SEO 2169 0.62 1.49 0.26 132 T_FILL_THIS_FORM_SHORT 2167 1.03 1.48 0.84 133 ALL_TRUSTED 2154 12.85 1.48 17.54 134 LongTLD 2153 0.76 1.47 0.47 135 XMEqualsVooDoo_03 2087 0.42 1.43 0.00 136 DIET_1 2067 0.72 1.42 0.43 137 TR_MetaPhish_Combo_01 2040 0.96 1.40 0.78 138 XMBody_78 2039 0.56 1.40 0.21 139 XMPhish30 2007 0.80 1.37 0.57 140 NORDNS_LOW_CONTRAST 1972 0.42 1.35 0.04 141 XMBrknScrpt_02 1971 1.03 1.35 0.90 142 T_REMOTE_IMAGE 1961 2.89 1.34 3.52 143 XM_B_COPY_HTML 1913 0.93 1.31 0.77 144 RCVD_IN_IADB_LISTED 1905 2.95 1.30 3.62 145 URI_HEX 1854 1.27 1.27 1.27 146 URI_TRY_3LD 1851 0.68 1.27 0.44 147 HTTPS_HTTP_MISMATCH 1843 1.01 1.26 0.90 148 URI_NOVOWEL 1823 1.46 1.25 1.55 149 RCVD_IN_PSBL 1821 0.60 1.25 0.34 150 TR_Mismatch_TLD_02 1812 0.41 1.24 0.06 151 TR_XM_SEO4 1764 0.45 1.21 0.14 152 XMSubMetaSxObfu_03 1742 0.75 1.19 0.56 153 TR_LOTS_OF_MONEY2 1724 0.49 1.18 0.20 154 T_MONEY_PERCENT 1724 0.49 1.18 0.20 155 TR_XM_PHPForged 1706 0.61 1.17 0.38 156 XM_B_COVIDMETA 1695 0.48 1.16 0.20 157 XMPhish14 1686 0.58 1.15 0.34 158 TR_XM_PHPDW 1682 0.60 1.15 0.38 159 TR_XM_FormFill2 1682 0.60 1.15 0.38 160 XMNoVowels 1680 1.02 1.15 0.97 161 XMBdyGiftCard01 1676 0.65 1.15 0.44 162 TR_XM_DK_SendGrid 1660 0.87 1.14 0.76 163 XM_H_PHPOS 1634 0.59 1.12 0.37 164 RCVD_IN_PBL 1610 0.86 1.10 0.76 165 SHOPIFY_IMG_NOT_RCVD_SFY 1609 0.49 1.10 0.24 166 XMHTML_After_End 1596 0.52 1.09 0.29 167 RCVD_IN_IADB_SPF 1593 2.53 1.09 3.12 168 MPART_ALT_DIFF_COUNT 1571 0.83 1.08 0.73 169 TR_Symld_Words 1567 1.29 1.07 1.38 170 BAYES_20 1552 3.13 1.06 3.98 171 XM_B_Phish66 1526 0.50 1.05 0.28 172 XM_DIRTYINTL 1503 0.36 1.03 0.08 173 RCVD_IN_IADB_DK 1496 2.19 1.02 2.67 174 T_Symld_Words_02 1480 0.76 1.01 0.66 175 RCVD_IN_IADB_SENDERID 1473 2.24 1.01 2.75 176 THIS_AD 1472 0.52 1.01 0.32 177 XM_OfRef7 1456 0.42 1.00 0.18 178 HTML_TAG_BALANCE_BODY 1443 0.70 0.99 0.58 179 XM_ShortIntro_01 1433 0.85 0.98 0.80 180 TR_XM_RelayPhish 1424 0.33 0.98 0.07 181 DKIM_ADSP_CUSTOM_MED 1415 0.83 0.97 0.77 182 XMReplyNow 1388 0.43 0.95 0.22 183 XM_UB99 1358 0.27 0.93 0.00 184 RCVD_IN_SORBS_DUL 1333 0.30 0.91 0.05 185 STY_INVIS_DIRECT 1323 0.42 0.91 0.22 186 TM2_M_A_HREF_HREF 1314 0.43 0.90 0.24 187 PLING_QUERY 1305 0.57 0.89 0.44 188 TR_XM_Base64_M1 1301 0.70 0.89 0.63 189 TM2_M_OBFU_COMMENT 1295 0.50 0.89 0.34 190 XMSubMetaSSx_00 1275 0.41 0.87 0.21 191 HK_RANDOM_REPLYTO 1267 0.35 0.87 0.13 192 TR_LOTS_OF_MONEY3 1262 0.37 0.86 0.16 193 RELAYCOUNTRY_FR 1262 0.41 0.86 0.23 194 XM_HighProb1 1246 0.25 0.85 0.01 195 RDNS_DYNAMIC 1241 0.46 0.85 0.30 196 URIBL_BLACK 1231 0.28 0.84 0.05 197 RELAYCOUNTRY_GB 1230 0.66 0.84 0.59 198 TooManyTo_002 1214 2.27 0.83 2.86 199 PDS_RDNS_DYNAMIC_FP 1209 0.36 0.83 0.16 200 RCVD_IN_XBL 1169 0.25 0.80 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 312683 90.14 94.50 88.35 2 RELAYCOUNTRY_US 281951 81.10 84.57 79.66 3 XM_B_Unicode 252554 75.23 84.62 71.36 4 DKIM_SIGNED 248282 75.23 87.55 70.15 5 XM_DK_Pass 243161 73.09 83.75 68.70 6 DKIM_VALID 239414 72.05 82.72 67.64 7 DCC_CHECK_NEGATIVE 229673 53.02 24.25 64.89 8 BAYES_50 212169 54.66 41.83 59.95 9 DKIM_VALID_AU 189079 56.97 65.56 53.42 10 XM_B_SpammyWords 165269 53.61 70.38 46.69 11 XMListUnsubscribeExists 157189 51.45 68.53 44.41 12 XM_B_Unicode3 139174 42.70 50.90 39.32 13 T_TM2_M_HEADER_IN_MSG 125011 32.29 24.94 35.32 14 DCC_CHECK 124072 46.39 73.88 35.06 15 RCVD_IN_MSPIKE_H2 114765 33.58 36.37 32.43 16 DKIM_VALID_EF 97554 27.39 26.96 27.56 17 LOC_TINY_FONT_1 96806 33.42 48.12 27.35 18 HTML_FONT_LOW_CONTRAST 91844 29.21 37.13 25.95 19 FVGT_m_MULTI_ODD 80538 25.43 31.92 22.76 20 XMSubLong 79899 23.92 27.20 22.57 21 XM_B_SpammyWords2 78684 28.04 42.13 22.23 22 T_KAM_HTML_FONT_INVALID 70561 23.17 31.00 19.94 23 MIME_HTML_ONLY 66529 21.25 27.21 18.80 24 ALL_TRUSTED 62067 12.85 1.48 17.54 25 XM_Multi_Part_URI 42918 15.00 21.96 12.13 26 TR_XM_DK_Unsub 41624 13.72 18.47 11.76 27 USER_IN_DEF_DKIM_WL 41301 8.77 1.74 11.67 28 XM_Evil_Numbers_Gen 40162 10.96 10.02 11.35 29 BAYES_00 40033 8.20 0.65 11.31 30 UNPARSEABLE_RELAY 37973 12.55 16.97 10.73 31 LotsOfNums_01 36866 10.03 9.09 10.42 32 XM_B_PhoneNumber 34162 8.73 6.49 9.65 33 XM_B_Unsub 30262 11.26 17.82 8.55 34 TooManyTo_001 29446 6.98 3.73 8.32 35 LOTS_OF_MONEY 28365 9.11 11.77 8.01 36 BAYES_60 28228 7.87 7.63 7.98 37 TR_XM_DK_Bayes 25788 5.32 0.54 7.29 38 TR_XM_DK_Bayes1 25294 5.21 0.53 7.15 39 ANY_BOUNCE_MESSAGE 24583 5.59 2.31 6.95 40 BOUNCE_MESSAGE 24581 5.59 2.31 6.95 41 IN_ZIMBRA_NJ_WHITELIST 23456 4.72 0.09 6.63 42 FSL_BULK_SIG 23025 7.37 9.45 6.51 43 TR_XM_BayesUnsub 22899 9.60 17.19 6.47 44 XM_DKIMWhitelistDomains 22728 4.67 0.44 6.42 45 TR_XM_SpammyWords4 22077 7.49 10.53 6.24 46 TR_XM_DK_Bayes2 21332 4.38 0.39 6.03 47 BAYES_40 20768 4.60 1.52 5.87 48 XM_B_Phish_Phrases 20055 6.34 7.99 5.67 49 XM_H_GMP 19259 5.27 4.86 5.44 50 T_TooManySym_01 19133 4.59 2.61 5.41 51 XM_H_Long_From01 18702 5.26 5.19 5.28 52 TR_MAX_INTL_RELAY 18558 8.10 15.03 5.24 53 TM2_M_VERY_LONG_WORD 17901 5.11 5.24 5.06 54 RCVD_IN_MSPIKE_WL 17885 4.68 3.76 5.05 55 RCVD_IN_MSPIKE_H3 17885 4.68 3.76 5.05 56 HTML_IMAGE_RATIO_06 17881 4.85 4.37 5.05 57 HTML_IMAGE_RATIO_04 16466 4.66 4.67 4.65 58 MIME_QP_LONG_LINE 16455 4.13 2.88 4.65 59 XMStrtUSub 15874 4.65 5.05 4.49 60 MPART_ALT_DIFF 15855 5.15 6.78 4.48 61 XM_DK_Undo_02 15539 14.25 38.16 4.39 62 XM_PDF 15224 3.24 0.67 4.30 63 XM_UncommonTLD01 14222 4.64 6.15 4.02 64 XM_B_SpammyWords3 14175 6.90 13.90 4.00 65 BAYES_20 14080 3.13 1.06 3.98 66 HTML_IMAGE_RATIO_02 13661 4.64 6.54 3.86 67 RCVD_IN_IADB_LISTED 12823 2.95 1.30 3.62 68 RELAYCOUNTRY_META 12688 6.78 14.53 3.58 69 T_REMOTE_IMAGE 12471 2.89 1.34 3.52 70 RCVD_IN_VALIDITY_SAFE 12232 3.10 2.23 3.46 71 XMSubMetaSx_00 11610 4.28 6.70 3.28 72 BAYES_99 11571 11.10 30.08 3.27 73 KHOP_HELO_FCRDNS 11547 2.88 1.96 3.26 74 BAYES_80 11523 5.03 9.33 3.26 75 RCVD_IN_IADB_SPF 11060 2.53 1.09 3.12 76 BOTNET_IPINHOSTNAME 10285 5.27 10.99 2.91 77 TooManyTo_002 10131 2.27 0.83 2.86 78 XMNumbers 10124 3.13 3.77 2.86 79 T_TooManySym_02 9857 2.15 0.60 2.78 80 RCVD_IN_IADB_SENDERID 9733 2.24 1.01 2.75 81 RCVD_IN_IADB_DK 9444 2.19 1.02 2.67 82 MIME_HTML_ONLY_MULTI 9217 2.89 3.57 2.60 83 RCVD_IN_IADB_VOUCHED 9069 2.02 0.69 2.56 84 MAILING_LIST_MULTI 9001 2.42 2.13 2.54 85 DKIM_INVALID 8868 3.18 4.83 2.51 86 HTML_MIME_NO_HTML_TAG 8756 2.22 1.61 2.47 87 RCVD_IN_VALIDITY_CERTIFIED 8623 2.16 1.50 2.44 88 BAYES_999 8604 8.53 23.30 2.43 89 BAYES_05 8534 1.88 0.59 2.41 90 HTML_IMAGE_RATIO_08 8511 2.81 3.80 2.40 91 XM_B_SpammyTLD 7847 2.76 4.08 2.22 92 XM_CamelCaseFrm001 7700 2.31 2.65 2.18 93 XM_Body_Dirty_Words 7466 3.81 7.94 2.11 94 INVALID_MSGID 7320 1.55 0.29 2.07 95 MIME_HTML_MOSTLY 7226 2.40 3.26 2.04 96 BAYES_95 7026 3.00 5.46 1.99 97 XM_B_URI_Unicode 6591 1.96 2.19 1.86 98 T_XMDrugObfuBody_08 6353 2.12 2.93 1.79 99 RCVD_IN_IADB_OPTIN 6291 1.37 0.39 1.78 100 TO_MALFORMED 6202 1.25 0.03 1.75 101 XM_B_Investor 6010 2.58 4.73 1.70 102 T_XMDrugObfuBody_14 5891 2.44 4.32 1.66 103 TR_XM_DKIM_Undo 5884 9.16 27.33 1.66 104 TR_XM_SpammyRelay 5812 4.28 10.66 1.64 105 XM_DK_Undo_01 5772 1.60 1.51 1.63 106 TooManyTo_003 5759 1.37 0.73 1.63 107 TR_XM_PhishingBody 5707 2.43 4.40 1.61 108 XMDiploma_00 5596 1.93 2.78 1.58 109 FROM_EXCESS_BASE64 5565 1.74 2.14 1.57 110 URI_NOVOWEL 5472 1.46 1.25 1.55 111 XM_B_Unsub2 5399 1.86 2.66 1.53 112 TM2_M_URI_OPT_OUT 5372 2.12 3.58 1.52 113 TR_XM_UnparsRelay 5269 3.47 8.29 1.49 114 MIME_CHARSET_FARAWAY 5145 1.69 2.27 1.45 115 XM_SPF_SoftFail 5123 2.11 3.71 1.45 116 SUBJ_ALL_CAPS 4885 1.46 1.66 1.38 117 TR_Symld_Words 4877 1.29 1.07 1.38 118 BOTNET 4779 3.32 8.09 1.35 119 IN_HORDE_ADDRESS_BOOK 4651 0.96 0.10 1.31 120 TR_XM_SpammyWords5 4594 2.05 3.86 1.30 121 XM_SendGrid 4548 1.40 1.67 1.28 122 URI_HEX 4484 1.27 1.27 1.27 123 UNTRUSTED_Relay 4352 2.40 5.23 1.23 124 TooManyTo_004 4308 1.06 0.68 1.22 125 HELO_NODOT 4286 0.92 0.20 1.21 126 HELO_NO_DOMAIN 4279 0.91 0.19 1.21 127 XMGappySubj_01 4234 0.90 0.17 1.20 128 XMCapTrack 4175 0.97 0.48 1.18 129 CHARSET_FARAWAY_HEADER 4122 1.28 1.57 1.16 130 T_TooManySym_03 3967 0.86 0.21 1.12 131 XM_GoogleGroups 3851 1.00 0.79 1.09 132 TR_DCC_Bayes_99 3822 7.25 22.20 1.08 133 XMSexyCombo_05 3742 2.13 4.73 1.06 134 RELAYCOUNTRY_CA 3726 2.28 5.25 1.05 135 TooManyTo_005 3677 0.92 0.65 1.04 136 XM_OfRef6 3622 1.82 3.76 1.02 137 XMLngstWrd_00 3460 0.81 0.42 0.98 138 XMNoVowels 3424 1.02 1.15 0.97 139 SpammyFromTLD_01 3347 1.20 1.82 0.95 140 HTTPS_HTTP_MISMATCH 3189 1.01 1.26 0.90 141 XMBrknScrpt_02 3171 1.03 1.35 0.90 142 TVD_SPACE_RATIO 3165 0.69 0.18 0.89 143 XM_H_Long_From02 3163 1.15 1.76 0.89 144 XM_B_SpammyWords4 3045 1.29 2.35 0.86 145 T_FILL_THIS_FORM_SHORT 2985 1.03 1.48 0.84 146 XM_H_Trusted_IP 2882 0.58 0.00 0.81 147 XM_UB50 2847 1.35 2.66 0.80 148 XM_ShortIntro_01 2820 0.85 0.98 0.80 149 TR_MetaPhish_Combo_01 2770 0.96 1.40 0.78 150 XMGenDplmaNmb 2743 1.00 1.55 0.78 151 XM_H_PHPMailer 2735 0.70 0.53 0.77 152 XM_B_COPY_HTML 2730 0.93 1.31 0.77 153 DKIM_ADSP_CUSTOM_MED 2721 0.83 0.97 0.77 154 FROM_GOV_DKIM_AU 2704 0.58 0.12 0.76 155 RCVD_IN_PBL 2687 0.86 1.10 0.76 156 TR_XM_DK_SendGrid 2682 0.87 1.14 0.76 157 MPART_ALT_DIFF_COUNT 2600 0.83 1.08 0.73 158 T_XMDrugObfuBody_00 2572 1.06 1.86 0.73 159 XMGappySubj_02 2542 0.53 0.07 0.72 160 HTML_IMAGE_ONLY_20 2540 0.63 0.43 0.72 161 TO_NO_BRKTS_HTML_ONLY 2500 0.57 0.24 0.71 162 XMStockSpam_06 2465 0.96 1.60 0.70 163 XMEqualsVooDoo_00 2448 0.95 1.57 0.69 164 XMSubNoVowel 2386 0.64 0.57 0.67 165 XMSubMetaI_00 2357 0.92 1.54 0.67 166 T_Symld_Words_02 2343 0.76 1.01 0.66 167 TR_XM_Base64_M1 2218 0.70 0.89 0.63 168 RELAYCOUNTRY_AU 2133 1.30 2.99 0.60 169 XMBody_95 2111 0.47 0.18 0.60 170 RELAYCOUNTRY_GB 2089 0.66 0.84 0.59 171 XMSlimDrugH 2084 0.65 0.79 0.59 172 MISSING_HEADERS 2072 0.60 0.62 0.59 173 HTML_TAG_BALANCE_BODY 2062 0.70 0.99 0.58 174 TVD_RCVD_IP 2034 0.64 0.78 0.57 175 RCVD_IN_BL_SPAMCOP_NET 2016 2.75 8.02 0.57 176 T_OBFU_PDF_ATTACH 2016 0.46 0.19 0.57 177 XMPhish30 2016 0.80 1.37 0.57 178 XMSubMetaSxObfu_03 1994 0.75 1.19 0.56 179 FROM_GOV_SPOOF 1878 0.43 0.18 0.53 180 HTML_IMAGE_ONLY_32 1819 0.44 0.25 0.51 181 NML_ADSP_CUSTOM_MED 1818 0.58 0.73 0.51 182 XMMoneyMeta_00 1800 0.57 0.71 0.51 183 XM_B_FormFill 1800 0.36 0.02 0.51 184 T_XMHurry_00 1711 0.94 2.05 0.48 185 FILL_THIS_FORM 1670 0.46 0.43 0.47 186 LongTLD 1649 0.76 1.47 0.47 187 XM_ProductURIs 1578 0.54 0.78 0.45 188 FORGED_GMAIL_RCVD 1574 0.52 0.71 0.44 189 MSGID_FROM_MTA_HEADER 1574 0.37 0.19 0.44 190 URI_TRY_3LD 1563 0.68 1.27 0.44 191 PLING_QUERY 1553 0.57 0.89 0.44 192 XMBdyGiftCard01 1550 0.65 1.15 0.44 193 DIET_1 1510 0.72 1.42 0.43 194 XMBSHREFv2 1495 0.42 0.40 0.42 195 HTML_IMAGE_ONLY_28 1453 0.37 0.26 0.41 196 TM2_M_BODY_EMPTY 1448 0.32 0.09 0.41 197 XMDateMe_00 1397 0.37 0.31 0.39 198 TR_XM_FormFill2 1341 0.60 1.15 0.38 199 TR_XM_PHPForged 1336 0.61 1.17 0.38 200 TR_XM_PHPDW 1332 0.60 1.15 0.38 ----------------------------------------------------------------------