Email: 446176 Autolearn: 0 AvgScore: 4.97 AvgScanTime: 1.37 sec Spam: 136692 Autolearn: 0 AvgScore: 15.79 AvgScanTime: 1.49 sec Ham: 309484 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 1.33 sec Time Spent Running SA: 170.37 hours Time Spent Processing Spam: 56.39 hours Time Spent Processing Ham: 113.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131071 89.83 95.89 87.16 2 DKIM_SIGNED 117600 77.09 86.03 73.14 3 XM_B_Unicode 112254 73.29 82.12 69.39 4 XM_DK_Pass 112150 74.86 82.05 71.69 5 DKIM_VALID 110786 73.81 81.05 70.61 6 RELAYCOUNTRY_US 109562 81.83 80.15 82.57 7 DCC_CHECK 103558 49.03 75.76 37.22 8 XM_B_SpammyWords 99153 54.29 72.54 46.23 9 XMListUnsubscribeExists 93140 52.45 68.14 45.53 10 DKIM_VALID_AU 85984 58.45 62.90 56.48 11 XM_B_Unicode3 65742 42.65 48.09 40.25 12 LOC_TINY_FONT_1 64471 33.28 47.17 27.15 13 XM_B_SpammyWords2 56617 27.31 41.42 21.07 14 BAYES_50 55858 54.87 40.86 61.05 15 RCVD_IN_MSPIKE_H2 52256 35.74 38.23 34.65 16 HTML_FONT_LOW_CONTRAST 50389 30.19 36.86 27.24 17 XM_DK_Undo_02 50161 14.58 36.70 4.81 18 MIME_HTML_ONLY 44674 24.80 32.68 21.32 19 T_KAM_HTML_FONT_INVALID 43792 23.90 32.04 20.30 20 FVGT_m_MULTI_ODD 43507 26.74 31.83 24.50 21 BAYES_99 40828 11.48 29.87 3.36 22 DKIM_VALID_EF 39159 29.00 28.65 29.15 23 TR_XM_DKIM_Undo 37018 9.73 27.08 2.07 24 BAYES_999 31686 8.86 23.18 2.53 25 XMSubLong 31417 22.91 22.98 22.87 26 DCC_CHECK_NEGATIVE 30930 50.44 22.63 62.73 27 TR_DCC_Bayes_99 30621 7.65 22.40 1.14 28 T_TM2_M_HEADER_IN_MSG 30429 29.45 22.26 32.62 29 TR_XM_DK_Unsub 28263 14.65 20.68 11.99 30 XM_Multi_Part_URI 28229 15.38 20.65 13.05 31 RELAYCOUNTRY_META 25661 8.40 18.77 3.81 32 XM_B_Unsub 22910 11.75 16.76 9.54 33 TR_MAX_INTL_RELAY 22507 8.65 16.47 5.20 34 UNPARSEABLE_RELAY 22043 13.29 16.13 12.03 35 TR_XM_BayesUnsub 21843 9.34 15.98 6.41 36 TR_XM_SpammyRelay 21134 6.07 15.46 1.93 37 XM_B_SpammyWords3 20499 9.31 15.00 6.80 38 LOTS_OF_MONEY 17566 7.90 12.85 5.71 39 TR_XM_SpammyWords2 16553 3.93 12.11 0.32 40 TR_XM_SpammyWords4 16204 6.27 11.85 3.80 41 BOTNET_IPINHOSTNAME 13061 5.09 9.56 3.12 42 RCVD_IN_BL_SPAMCOP_NET 12913 3.40 9.45 0.72 43 BAYES_80 12631 5.05 9.24 3.20 44 FSL_BULK_SIG 12571 8.39 9.20 8.04 45 XM_Body_Dirty_Words 12342 4.61 9.03 2.66 46 BOTNET 12278 3.71 8.98 1.38 47 UNTRUSTED_Relay 12174 3.66 8.91 1.34 48 XM_Evil_Numbers_Gen 12164 9.77 8.90 10.16 49 BAYES_60 11562 6.79 8.46 6.05 50 XM_B_Phish_Phrases 11369 8.26 8.32 8.24 51 LotsOfNums_01 11110 8.81 8.13 9.11 52 XM_UncommonTLD01 10907 5.32 7.98 4.14 53 TR_XM_SPAMCOP 10727 2.74 7.85 0.49 54 TR_XM_UnparsRelay 10226 3.37 7.48 1.56 55 XMSubMetaSx_00 9052 5.01 6.62 4.30 56 XM_SPF_SoftFail 8665 2.98 6.34 1.49 57 RELAYCOUNTRY_CA 8460 2.68 6.19 1.13 58 HTML_IMAGE_RATIO_02 8333 5.07 6.10 4.62 59 XM_B_PhoneNumber 7533 8.28 5.51 9.51 60 BAYES_95 7326 3.03 5.36 2.00 61 XM_OfRef6 7253 2.42 5.31 1.14 62 XM_H_Long_From01 7107 5.50 5.20 5.64 63 XMSexyCombo_05 7106 2.99 5.20 2.02 64 RCVD_IN_PSBL 7034 1.86 5.15 0.42 65 MPART_ALT_DIFF 6988 4.63 5.11 4.42 66 RCVD_IN_VALIDITY_RPBL 6904 1.61 5.05 0.08 67 DKIM_INVALID 6814 3.28 4.98 2.52 68 TR_XM_SpammyWords5 6648 2.41 4.86 1.33 69 T_XMDrugObfuBody_14 6576 2.81 4.81 1.93 70 XM_H_GMP 6518 5.06 4.77 5.18 71 HTML_IMAGE_RATIO_04 6477 4.96 4.74 5.06 72 TR_XM_PhishingBody 6272 2.46 4.59 1.52 73 SpammyFromTLD_02 6185 1.88 4.52 0.71 74 TM2_M_VERY_LONG_WORD 5791 5.16 4.24 5.57 75 TR_XM_InvalidRelay 5736 1.29 4.20 0.01 76 XM_B_SpammyTLD 5709 3.25 4.18 2.85 77 HTML_IMAGE_RATIO_08 5556 2.48 4.06 1.77 78 XM_B_Investor 5506 2.26 4.03 1.48 79 TR_XM_NoHeaderRelay 5478 1.40 4.01 0.25 80 T_REMOTE_IMAGE 5435 3.75 3.98 3.65 81 HTML_MIME_NO_HTML_TAG 5335 3.33 3.90 3.08 82 RCVD_IN_MSPIKE_WL 5051 4.71 3.70 5.16 83 RCVD_IN_MSPIKE_H3 5051 4.71 3.70 5.16 84 XMNoVowels 4924 2.62 3.60 2.18 85 HTML_IMAGE_RATIO_06 4750 2.91 3.47 2.67 86 XM_CamelCaseFrm001 4614 2.63 3.38 2.31 87 XM_UB50 4600 1.63 3.37 0.86 88 MIME_HTML_MOSTLY 4523 2.65 3.31 2.35 89 XMStrtUSub 4420 4.29 3.23 4.76 90 MIME_QP_LONG_LINE 4415 4.09 3.23 4.47 91 TooManyTo_001 4372 7.23 3.20 9.02 92 XMNumbers 4248 3.09 3.11 3.09 93 SUBJ_ALL_CAPS 4154 2.06 3.04 1.63 94 MIME_HTML_ONLY_MULTI 4139 2.64 3.03 2.47 95 XM_URI_RBL 3865 1.08 2.83 0.31 96 TM2_M_URI_OPT_OUT 3798 2.05 2.78 1.73 97 XMDiploma_00 3775 1.90 2.76 1.52 98 TO_NO_BRKTS_HTML_ONLY 3744 1.27 2.74 0.63 99 T_XMDrugObfuBody_08 3572 1.98 2.61 1.70 100 RELAYCOUNTRY_AU 3548 1.31 2.60 0.74 101 T_FILL_THIS_FORM_SHORT 3538 1.39 2.59 0.87 102 XM_B_Unsub2 3520 1.72 2.58 1.34 103 RELAYCOUNTRY_UA 3503 0.79 2.56 0.00 104 XM_UB99 3441 0.77 2.52 0.00 105 XM_B_URI_Unicode 3436 2.11 2.51 1.93 106 RCVD_IN_VALIDITY_SAFE 3296 3.30 2.41 3.69 107 XM_B_SpammyWords4 3288 1.26 2.41 0.75 108 T_XMHurry_00 3230 1.10 2.36 0.54 109 T_TooManySym_01 3211 4.79 2.35 5.88 110 BOTNET_NORDNS 3050 0.69 2.23 0.01 111 MAILING_LIST_MULTI 3037 2.64 2.22 2.82 112 FROM_EXCESS_BASE64 3020 1.77 2.21 1.58 113 XMBody_17 2907 0.93 2.13 0.39 114 XM_OfRef7 2872 0.78 2.10 0.19 115 XM_UB999 2736 0.62 2.00 0.00 116 DKIM_ADSP_NXDOMAIN 2715 0.83 1.99 0.32 117 MultiRelay_CC 2701 0.68 1.98 0.11 118 USER_IN_DEF_DKIM_WL 2690 9.03 1.97 12.15 119 ALL_TRUSTED 2641 10.60 1.93 14.42 120 TR_Caps_n_Bayes_99 2609 0.60 1.91 0.02 121 T_XMDrugObfuBody_00 2583 1.05 1.89 0.68 122 NO_DNS_FOR_FROM 2546 0.79 1.86 0.32 123 TR_XM_MaxWHORU 2531 0.75 1.85 0.26 124 XMStockSpam_06 2471 1.43 1.81 1.27 125 RCVD_IN_VALIDITY_CERTIFIED 2391 2.34 1.75 2.60 126 BAYES_40 2363 4.50 1.73 5.73 127 RCVD_IN_XBL 2355 0.55 1.72 0.02 128 MISSING_HEADERS 2201 0.86 1.61 0.52 129 XM_ProductURIs 2199 0.94 1.61 0.64 130 XMGenDplmaNmb 2188 1.01 1.60 0.74 131 XMPhish30 2173 0.86 1.59 0.54 132 SHORTCIRCUIT 2154 0.48 1.58 0.00 133 RCVD_IN_ZEN_LASTEXTERNAL 2154 0.48 1.58 0.00 134 HOSTED_IMG_MULTI_PUB_01 2133 0.50 1.56 0.03 135 XM_B_Phish66 2111 0.68 1.54 0.30 136 SpammyFromTLD_01 2086 1.06 1.53 0.85 137 XM_B_COPY_HTML 2061 1.02 1.51 0.80 138 XM_SendGrid 2051 1.45 1.50 1.42 139 TR_XM_INV_DKIM 2045 0.54 1.50 0.12 140 XM_OfRef8 2030 0.47 1.49 0.02 141 RELAYCOUNTRY_CN 2029 0.49 1.48 0.06 142 URI_HEX 2006 1.21 1.47 1.09 143 LOADSA_MONEY_COMBO 1930 0.45 1.41 0.03 144 HK_RANDOM_REPLYTO 1900 0.52 1.39 0.14 145 XM_Lotto 1897 0.51 1.39 0.12 146 REPLYTO_WITHOUT_TO_CC 1886 0.44 1.38 0.02 147 XM_B_SEO 1885 0.60 1.38 0.25 148 TR_Symld_Words 1876 1.50 1.37 1.56 149 TR_LOTS_OF_MONEY3 1871 0.57 1.37 0.22 150 HTML_IMAGE_ONLY_24 1865 0.64 1.36 0.32 151 FILL_THIS_FORM 1860 0.76 1.36 0.50 152 TO_NO_BRKTS_FROM_MSSP 1835 0.44 1.34 0.05 153 XFER_LOTSA_MONEY 1832 0.42 1.34 0.02 154 XM_DK_Undo_01 1830 1.49 1.34 1.55 155 MPART_ALT_DIFF_COUNT 1823 0.83 1.33 0.60 156 HTML_TITLE_SUBJ_DIFF 1817 0.44 1.33 0.04 157 MILLION_USD 1811 0.41 1.32 0.00 158 XMSexyCombo_01 1811 0.54 1.32 0.20 159 HK_SCAM 1810 0.41 1.32 0.01 160 KHOP_HELO_FCRDNS 1802 2.93 1.32 3.64 161 FROM_MISSP_EH_MATCH 1801 0.43 1.32 0.03 162 BAYES_20 1801 3.17 1.32 3.98 163 TM2_M_OBFU_COMMENT 1793 0.66 1.31 0.38 164 XMSubGiftCard1 1792 0.47 1.31 0.10 165 FORGED_MUA_OUTLOOK 1784 0.42 1.31 0.02 166 MONEY_FRAUD_8 1783 0.40 1.30 0.00 167 LongTLD 1783 0.71 1.30 0.45 168 FROM_MISSP_REPLYTO 1781 0.40 1.30 0.00 169 AXB_XMAILER_MIMEOLE_OL_024C2 1780 0.40 1.30 0.00 170 XMBrknScrpt_02 1779 0.99 1.30 0.85 171 FSL_CTYPE_WIN1251 1778 0.40 1.30 0.00 172 FSL_NEW_HELO_USER 1776 0.40 1.30 0.00 173 FROM_MISSP_MSFT 1764 0.40 1.29 0.00 174 FILL_THIS_FORM_LONG 1764 0.56 1.29 0.24 175 FROM_MISSPACED 1763 0.40 1.29 0.00 176 TO_NO_BRKTS_MSFT 1762 0.40 1.29 0.00 177 TR_LOTS_OF_MONEY1 1760 0.41 1.29 0.03 178 MILLION_HUNDRED 1758 0.39 1.29 0.00 179 XPRIO 1740 0.39 1.27 0.00 180 MONEY_FORM 1737 0.39 1.27 0.01 181 RELAYCOUNTRY_IT 1737 0.40 1.27 0.02 182 RCVD_IN_SBL 1735 0.39 1.27 0.00 183 NSL_RCVD_FROM_USER 1734 0.39 1.27 0.00 184 FONT_INVIS_LONG_LINE 1734 0.43 1.27 0.06 185 RCVD_IN_SBL_DROP 1715 0.38 1.25 0.00 186 FROM_MISSP_USER 1715 0.38 1.25 0.00 187 FORGED_OUTLOOK_TAGS 1708 0.39 1.25 0.01 188 RCVD_IN_IADB_LISTED 1708 3.00 1.25 3.77 189 FORGED_OUTLOOK_HTML 1707 0.38 1.25 0.00 190 NORDNS_LOW_CONTRAST 1703 0.42 1.25 0.06 191 XMBdyGiftCard01 1702 0.71 1.25 0.48 192 XM_DIRTYINTL 1701 0.45 1.24 0.11 193 ADVANCE_FEE_5_NEW_FRM_MNY 1696 0.38 1.24 0.00 194 MONEY_FROM_MISSP 1689 0.38 1.24 0.00 195 DIET_1 1660 0.56 1.21 0.27 196 PLING_QUERY 1617 0.91 1.18 0.79 197 FBI_MONEY 1615 0.36 1.18 0.00 198 FBI_SPOOF 1615 0.36 1.18 0.00 199 XM_B_COVIDMETA 1615 0.49 1.18 0.19 200 HTML_IMAGE_ONLY_12 1614 0.53 1.18 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 269744 89.83 95.89 87.16 2 RELAYCOUNTRY_US 255535 81.83 80.15 82.57 3 DKIM_SIGNED 226343 77.09 86.03 73.14 4 XM_DK_Pass 221872 74.86 82.05 71.69 5 DKIM_VALID 218540 73.81 81.05 70.61 6 XM_B_Unicode 214742 73.29 82.12 69.39 7 DCC_CHECK_NEGATIVE 194125 50.44 22.63 62.73 8 BAYES_50 188944 54.87 40.86 61.05 9 DKIM_VALID_AU 174812 58.45 62.90 56.48 10 XM_B_SpammyWords 143077 54.29 72.54 46.23 11 XMListUnsubscribeExists 140900 52.45 68.14 45.53 12 XM_B_Unicode3 124571 42.65 48.09 40.25 13 DCC_CHECK 115205 49.03 75.76 37.22 14 RCVD_IN_MSPIKE_H2 107225 35.74 38.23 34.65 15 T_TM2_M_HEADER_IN_MSG 100966 29.45 22.26 32.62 16 DKIM_VALID_EF 90220 29.00 28.65 29.15 17 HTML_FONT_LOW_CONTRAST 84315 30.19 36.86 27.24 18 LOC_TINY_FONT_1 84016 33.28 47.17 27.15 19 FVGT_m_MULTI_ODD 75818 26.74 31.83 24.50 20 XMSubLong 70793 22.91 22.98 22.87 21 MIME_HTML_ONLY 65985 24.80 32.68 21.32 22 XM_B_SpammyWords2 65222 27.31 41.42 21.07 23 T_KAM_HTML_FONT_INVALID 62834 23.90 32.04 20.30 24 ALL_TRUSTED 44643 10.60 1.93 14.42 25 XM_Multi_Part_URI 40393 15.38 20.65 13.05 26 BAYES_00 37705 8.69 0.79 12.18 27 USER_IN_DEF_DKIM_WL 37591 9.03 1.97 12.15 28 UNPARSEABLE_RELAY 37239 13.29 16.13 12.03 29 TR_XM_DK_Unsub 37099 14.65 20.68 11.99 30 XM_Evil_Numbers_Gen 31429 9.77 8.90 10.16 31 XM_B_Unsub 29517 11.75 16.76 9.54 32 XM_B_PhoneNumber 29424 8.28 5.51 9.51 33 LotsOfNums_01 28205 8.81 8.13 9.11 34 TooManyTo_001 27901 7.23 3.20 9.02 35 XM_B_Phish_Phrases 25495 8.26 8.32 8.24 36 FSL_BULK_SIG 24877 8.39 9.20 8.04 37 TR_XM_DK_Bayes 24837 5.75 0.61 8.03 38 TR_XM_DK_Bayes1 24263 5.62 0.59 7.84 39 ANY_BOUNCE_MESSAGE 21896 5.17 0.86 7.08 40 BOUNCE_MESSAGE 21856 5.16 0.86 7.06 41 IN_ZIMBRA_NJ_WHITELIST 21547 4.87 0.13 6.96 42 XM_B_SpammyWords3 21052 9.31 15.00 6.80 43 TR_XM_DK_Bayes2 20958 4.83 0.43 6.77 44 XM_DKIMWhitelistDomains 20902 4.80 0.39 6.75 45 TR_XM_BayesUnsub 19830 9.34 15.98 6.41 46 BAYES_60 18716 6.79 8.46 6.05 47 T_TooManySym_01 18183 4.79 2.35 5.88 48 BAYES_40 17719 4.50 1.73 5.73 49 LOTS_OF_MONEY 17673 7.90 12.85 5.71 50 XM_H_Long_From01 17449 5.50 5.20 5.64 51 TM2_M_VERY_LONG_WORD 17244 5.16 4.24 5.57 52 XM_PDF 16260 3.98 1.08 5.25 53 TR_MAX_INTL_RELAY 16082 8.65 16.47 5.20 54 XM_H_GMP 16037 5.06 4.77 5.18 55 RCVD_IN_MSPIKE_WL 15974 4.71 3.70 5.16 56 RCVD_IN_MSPIKE_H3 15973 4.71 3.70 5.16 57 HTML_IMAGE_RATIO_04 15658 4.96 4.74 5.06 58 XM_DK_Undo_02 14872 14.58 36.70 4.81 59 XMStrtUSub 14730 4.29 3.23 4.76 60 HTML_IMAGE_RATIO_02 14285 5.07 6.10 4.62 61 MIME_QP_LONG_LINE 13843 4.09 3.23 4.47 62 MPART_ALT_DIFF 13665 4.63 5.11 4.42 63 XMSubMetaSx_00 13322 5.01 6.62 4.30 64 XM_UncommonTLD01 12811 5.32 7.98 4.14 65 BAYES_20 12330 3.17 1.32 3.98 66 RELAYCOUNTRY_META 11805 8.40 18.77 3.81 67 TR_XM_SpammyWords4 11774 6.27 11.85 3.80 68 RCVD_IN_IADB_LISTED 11669 3.00 1.25 3.77 69 RCVD_IN_VALIDITY_SAFE 11409 3.30 2.41 3.69 70 T_REMOTE_IMAGE 11282 3.75 3.98 3.65 71 KHOP_HELO_FCRDNS 11253 2.93 1.32 3.64 72 MAY_BE_FORGED 11026 2.54 0.24 3.56 73 TooManyTo_002 10532 2.55 0.62 3.40 74 BAYES_99 10401 11.48 29.87 3.36 75 RCVD_IN_IADB_SPF 10089 2.60 1.11 3.26 76 BAYES_80 9889 5.05 9.24 3.20 77 BOTNET_IPINHOSTNAME 9653 5.09 9.56 3.12 78 XMNumbers 9551 3.09 3.11 3.09 79 HTML_MIME_NO_HTML_TAG 9530 3.33 3.90 3.08 80 T_TooManySym_02 9474 2.31 0.60 3.06 81 RCVD_IN_IADB_SENDERID 8860 2.31 1.05 2.86 82 XM_B_SpammyTLD 8810 3.25 4.18 2.85 83 MAILING_LIST_MULTI 8731 2.64 2.22 2.82 84 RCVD_IN_IADB_DK 8589 2.25 1.05 2.78 85 HTML_IMAGE_RATIO_06 8254 2.91 3.47 2.67 86 XM_Body_Dirty_Words 8246 4.61 9.03 2.66 87 RCVD_IN_IADB_VOUCHED 8130 1.99 0.54 2.63 88 RCVD_IN_VALIDITY_CERTIFIED 8045 2.34 1.75 2.60 89 BAYES_999 7841 8.86 23.18 2.53 90 DKIM_INVALID 7803 3.28 4.98 2.52 91 MIME_HTML_ONLY_MULTI 7643 2.64 3.03 2.47 92 BAYES_05 7587 1.94 0.80 2.45 93 MIME_HTML_MOSTLY 7286 2.65 3.31 2.35 94 INVALID_MSGID 7191 1.68 0.22 2.32 95 XM_CamelCaseFrm001 7141 2.63 3.38 2.31 96 XMNoVowels 6759 2.62 3.60 2.18 97 TR_XM_DKIM_Undo 6399 9.73 27.08 2.07 98 HTML_EXTRA_CLOSE 6345 1.44 0.06 2.05 99 XMSexyCombo_05 6243 2.99 5.20 2.02 100 TO_MALFORMED 6215 1.41 0.06 2.01 101 BAYES_95 6179 3.03 5.36 2.00 102 T_XMDrugObfuBody_14 5972 2.81 4.81 1.93 103 TR_XM_SpammyRelay 5968 6.07 15.46 1.93 104 XM_B_URI_Unicode 5965 2.11 2.51 1.93 105 RCVD_IN_IADB_OPTIN 5884 1.42 0.34 1.90 106 HTML_IMAGE_RATIO_08 5490 2.48 4.06 1.77 107 TM2_M_URI_OPT_OUT 5349 2.05 2.78 1.73 108 T_XMDrugObfuBody_08 5258 1.98 2.61 1.70 109 SUBJ_ALL_CAPS 5045 2.06 3.04 1.63 110 TooManyTo_003 5039 1.29 0.53 1.63 111 XMGappySubj_01 4953 1.15 0.14 1.60 112 FROM_EXCESS_BASE64 4890 1.77 2.21 1.58 113 TR_XM_UnparsRelay 4826 3.37 7.48 1.56 114 TR_Symld_Words 4824 1.50 1.37 1.56 115 XM_DK_Undo_01 4812 1.49 1.34 1.55 116 XMDiploma_00 4715 1.90 2.76 1.52 117 TR_XM_PhishingBody 4711 2.46 4.59 1.52 118 XM_SPF_SoftFail 4615 2.98 6.34 1.49 119 XM_B_Investor 4580 2.26 4.03 1.48 120 IN_HORDE_ADDRESS_BOOK 4545 1.06 0.13 1.47 121 XM_SendGrid 4407 1.45 1.50 1.42 122 BOTNET 4273 3.71 8.98 1.38 123 URI_NOVOWEL 4245 1.29 1.09 1.37 124 FROM_GOV_DKIM_AU 4157 1.01 0.24 1.34 125 UNTRUSTED_Relay 4146 3.66 8.91 1.34 126 XM_B_Unsub2 4134 1.72 2.58 1.34 127 TR_XM_SpammyWords5 4111 2.41 4.86 1.33 128 XMStockSpam_06 3930 1.43 1.81 1.27 129 T_TooManySym_03 3915 0.93 0.18 1.27 130 HELO_NODOT 3618 0.96 0.48 1.17 131 HELO_NO_DOMAIN 3616 0.96 0.48 1.17 132 TooManyTo_004 3604 0.95 0.47 1.16 133 XM_OfRef6 3528 2.42 5.31 1.14 134 TR_DCC_Bayes_99 3522 7.65 22.40 1.14 135 RELAYCOUNTRY_CA 3494 2.68 6.19 1.13 136 URI_HEX 3372 1.21 1.47 1.09 137 XM_GoogleGroups 3343 0.98 0.77 1.08 138 TVD_SPACE_RATIO 3311 0.82 0.26 1.07 139 XM_B_FormFill 3275 0.75 0.05 1.06 140 XMCapTrack 3251 0.88 0.48 1.05 141 T_OBFU_PDF_ATTACH 3197 0.90 0.61 1.03 142 XM_H_Long_From02 3127 0.98 0.90 1.01 143 MIME_CHARSET_FARAWAY 3004 1.03 1.18 0.97 144 TooManyTo_005 2960 0.80 0.44 0.96 145 TR_XM_DK_SendGrid 2847 0.93 0.97 0.92 146 T_FILL_THIS_FORM_SHORT 2679 1.39 2.59 0.87 147 XM_UB50 2659 1.63 3.37 0.86 148 SpammyFromTLD_01 2632 1.06 1.53 0.85 149 XMBrknScrpt_02 2617 0.99 1.30 0.85 150 T_TVD_MIME_NO_HEADERS 2499 0.57 0.02 0.81 151 XM_B_COPY_HTML 2470 1.02 1.51 0.80 152 PLING_QUERY 2441 0.91 1.18 0.79 153 XM_B_DNDMA 2417 0.90 1.17 0.78 154 XM_H_PHPMailer 2331 0.73 0.67 0.75 155 XM_B_SpammyWords4 2320 1.26 2.41 0.75 156 XMGenDplmaNmb 2303 1.01 1.60 0.74 157 XMBody_95 2300 0.57 0.19 0.74 158 RELAYCOUNTRY_AU 2299 1.31 2.60 0.74 159 DKIM_ADSP_CUSTOM_MED 2259 0.80 0.95 0.73 160 XM_ShortIntro_01 2256 0.63 0.40 0.73 161 RCVD_IN_BL_SPAMCOP_NET 2238 3.40 9.45 0.72 162 HTTPS_HTTP_MISMATCH 2224 0.77 0.90 0.72 163 XMLngstWrd_00 2201 0.68 0.60 0.71 164 SpammyFromTLD_02 2190 1.88 4.52 0.71 165 T_XMDrugObfuBody_00 2101 1.05 1.89 0.68 166 TR_XM_Base64_M1 2019 0.77 1.05 0.65 167 RCVD_IN_PBL 2011 0.78 1.07 0.65 168 XMGappySubj_02 2005 0.47 0.06 0.65 169 XM_ProductURIs 1983 0.94 1.61 0.64 170 TO_NO_BRKTS_HTML_ONLY 1940 1.27 2.74 0.63 171 CHARSET_FARAWAY_HEADER 1930 0.52 0.30 0.62 172 TVD_RCVD_IP 1924 0.65 0.70 0.62 173 TR_MetaPhish_Combo_01 1909 0.72 0.95 0.62 174 MPART_ALT_DIFF_COUNT 1865 0.83 1.33 0.60 175 HTML_IMAGE_ONLY_20 1801 0.55 0.48 0.58 176 XMPhish30 1681 0.86 1.59 0.54 177 URI_TRY_3LD 1679 0.67 0.94 0.54 178 BASE64_LENGTH_79_INF 1666 0.59 0.70 0.54 179 T_XMHurry_00 1660 1.10 2.36 0.54 180 HTML_TAG_BALANCE_BODY 1657 0.69 1.04 0.54 181 MISSING_HEADERS 1623 0.86 1.61 0.52 182 FILL_THIS_FORM 1533 0.76 1.36 0.50 183 TM2_M_BODY_EMPTY 1516 0.36 0.06 0.49 184 TR_XM_SPAMCOP 1511 2.74 7.85 0.49 185 NML_ADSP_CUSTOM_MED 1502 0.56 0.73 0.49 186 RELAYCOUNTRY_GB 1490 0.53 0.63 0.48 187 XMBdyGiftCard01 1485 0.71 1.25 0.48 188 HTML_IMAGE_ONLY_32 1392 0.38 0.22 0.45 189 LongTLD 1382 0.71 1.30 0.45 190 HTML_FONT_FACE_BAD 1357 0.49 0.61 0.44 191 FROM_GOV_SPOOF 1350 0.32 0.07 0.44 192 FORGED_GMAIL_RCVD 1333 0.50 0.66 0.43 193 MSGID_FROM_MTA_HEADER 1322 0.33 0.12 0.43 194 USER_IN_WELCOMELIST 1316 0.29 0.00 0.43 195 USER_IN_WHITELIST 1316 0.29 0.00 0.43 196 XMLngstWrd_01 1305 0.45 0.51 0.42 197 XMMoneyMeta_00 1299 0.52 0.73 0.42 198 RCVD_IN_PSBL 1287 1.86 5.15 0.42 199 T_TooManySym_04 1261 0.29 0.02 0.41 200 HTML_IMAGE_ONLY_28 1260 0.34 0.18 0.41 ----------------------------------------------------------------------