Email: 455080 Autolearn: 0 AvgScore: 4.83 AvgScanTime: 1.29 sec Spam: 142543 Autolearn: 0 AvgScore: 15.03 AvgScanTime: 1.39 sec Ham: 312537 Autolearn: 0 AvgScore: 0.18 AvgScanTime: 1.25 sec Time Spent Running SA: 163.68 hours Time Spent Processing Spam: 54.87 hours Time Spent Processing Ham: 108.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135970 89.81 95.39 87.26 2 DKIM_SIGNED 125474 76.93 88.03 71.87 3 XM_DK_Pass 118334 74.33 83.02 70.36 4 XM_B_Unicode 118232 73.86 82.94 69.71 5 RELAYCOUNTRY_US 118005 81.80 82.79 81.36 6 DKIM_VALID 116527 73.05 81.75 69.08 7 DCC_CHECK 107997 48.34 75.76 35.83 8 XM_B_SpammyWords 99223 51.84 69.61 43.73 9 XMListUnsubscribeExists 97312 52.15 68.27 44.79 10 DKIM_VALID_AU 90736 57.77 63.66 55.08 11 LOC_TINY_FONT_1 68994 32.46 48.40 25.19 12 XM_B_Unicode3 68384 42.89 47.97 40.58 13 BAYES_50 58078 54.54 40.74 60.84 14 XM_B_SpammyWords2 56359 24.73 39.54 17.98 15 RCVD_IN_MSPIKE_H2 55439 35.23 38.89 33.56 16 XM_DK_Undo_02 53055 14.55 37.22 4.21 17 HTML_FONT_LOW_CONTRAST 51731 31.59 36.29 29.44 18 T_KAM_HTML_FONT_INVALID 47609 24.14 33.40 19.91 19 FVGT_m_MULTI_ODD 44498 26.49 31.22 24.33 20 BAYES_99 41953 11.44 29.43 3.23 21 MIME_HTML_ONLY 40840 22.38 28.65 19.52 22 DKIM_VALID_EF 40593 28.76 28.48 28.88 23 TR_XM_DKIM_Undo 37986 9.42 26.65 1.57 24 XMSubLong 37390 24.48 26.23 23.68 25 BAYES_999 32246 8.75 22.62 2.43 26 T_TM2_M_HEADER_IN_MSG 31909 30.67 22.39 34.44 27 DCC_CHECK_NEGATIVE 31823 51.03 22.33 64.12 28 TR_DCC_Bayes_99 31454 7.67 22.07 1.10 29 XM_Multi_Part_URI 30663 14.95 21.51 11.96 30 TR_XM_DK_Unsub 27903 14.45 19.58 12.11 31 XM_B_Unsub 24641 11.33 17.29 8.61 32 TR_XM_BayesUnsub 23613 9.55 16.57 6.36 33 UNPARSEABLE_RELAY 23427 12.43 16.44 10.61 34 RELAYCOUNTRY_META 22262 7.62 15.62 3.97 35 TR_MAX_INTL_RELAY 21722 8.39 15.24 5.26 36 XM_B_SpammyWords3 21307 7.70 14.95 4.39 37 LOTS_OF_MONEY 16957 7.76 11.90 5.87 38 TR_XM_SpammyRelay 15633 4.86 10.97 2.08 39 TR_XM_SpammyWords4 15024 5.92 10.54 3.81 40 TR_XM_SpammyWords2 14916 3.48 10.46 0.29 41 BOTNET_IPINHOSTNAME 14771 5.09 10.36 2.69 42 FSL_BULK_SIG 14157 7.70 9.93 6.69 43 XM_Evil_Numbers_Gen 13822 9.81 9.70 9.87 44 BAYES_80 13643 5.23 9.57 3.25 45 BOTNET 13510 3.81 9.48 1.23 46 LotsOfNums_01 12691 9.90 8.90 10.35 47 RCVD_IN_BL_SPAMCOP_NET 12108 2.93 8.49 0.40 48 BAYES_60 11927 7.13 8.37 6.57 49 TR_XM_UnparsRelay 11402 3.47 8.00 1.40 50 XM_B_Phish_Phrases 11029 6.20 7.74 5.50 51 XM_Body_Dirty_Words 10982 3.96 7.70 2.25 52 HTML_IMAGE_RATIO_02 10328 5.05 7.25 4.05 53 UNTRUSTED_Relay 9313 3.03 6.53 1.44 54 TR_XM_SPAMCOP 9100 2.17 6.38 0.26 55 XMSubMetaSx_00 8994 4.08 6.31 3.07 56 MPART_ALT_DIFF 8969 4.86 6.29 4.21 57 DKIM_INVALID 8947 3.88 6.28 2.78 58 XM_B_PhoneNumber 8477 8.87 5.95 10.20 59 XM_UncommonTLD01 7843 4.67 5.50 4.30 60 RELAYCOUNTRY_CA 7831 2.62 5.49 1.31 61 BAYES_95 7637 3.06 5.36 2.01 62 XM_H_GMP 7436 5.86 5.22 6.16 63 HTML_IMAGE_RATIO_04 7178 4.21 5.04 3.83 64 XM_H_Long_From01 6902 5.17 4.84 5.32 65 TooManyTo_001 6595 7.75 4.63 9.17 66 TR_XM_PhishingBody 6469 2.45 4.54 1.49 67 XM_B_Investor 6263 2.35 4.39 1.42 68 T_XMDrugObfuBody_14 6141 2.55 4.31 1.75 69 MIME_HTML_MOSTLY 5832 2.69 4.09 2.05 70 XMStrtUSub 5801 4.57 4.07 4.80 71 HTML_IMAGE_RATIO_06 5787 3.47 4.06 3.20 72 TR_XM_SpammyWords5 5725 2.17 4.02 1.33 73 XM_B_SpammyTLD 5660 2.86 3.97 2.35 74 TM2_M_VERY_LONG_WORD 5559 5.12 3.90 5.67 75 XMNumbers 5448 3.29 3.82 3.05 76 RCVD_IN_VALIDITY_RPBL 5448 1.23 3.82 0.05 77 XMSexyCombo_05 5430 1.91 3.81 1.05 78 RCVD_IN_MSPIKE_H3 5290 4.74 3.71 5.21 79 RCVD_IN_MSPIKE_WL 5290 4.74 3.71 5.21 80 XM_SPF_SoftFail 5053 2.09 3.54 1.43 81 MIME_HTML_ONLY_MULTI 5012 2.85 3.52 2.54 82 T_TooManySym_01 4929 5.62 3.46 6.60 83 XMNoVowels 4881 2.80 3.42 2.52 84 MIME_QP_LONG_LINE 4767 4.26 3.34 4.67 85 DKIM_ADSP_NXDOMAIN 4632 1.26 3.25 0.35 86 T_XMDrugObfuBody_08 4498 1.99 3.16 1.46 87 XM_UB50 4467 1.60 3.13 0.90 88 TM2_M_URI_OPT_OUT 4436 2.05 3.11 1.57 89 XM_CamelCaseFrm001 4217 2.28 2.96 1.98 90 XM_OfRef6 4144 1.62 2.91 1.04 91 XMDiploma_00 3970 2.07 2.79 1.75 92 HTML_IMAGE_RATIO_08 3903 2.37 2.74 2.20 93 XM_B_Unsub2 3843 1.80 2.70 1.39 94 XM_B_URI_Unicode 3831 2.27 2.69 2.08 95 XM_B_SpammyWords4 3716 1.25 2.61 0.64 96 XM_URI_RBL 3685 1.17 2.59 0.53 97 NO_DNS_FOR_FROM 3643 1.00 2.56 0.29 98 TR_XM_MaxWHORU 3618 0.96 2.54 0.24 99 RELAYCOUNTRY_AU 3559 1.14 2.50 0.52 100 MAILING_LIST_MULTI 3502 3.00 2.46 3.25 101 KHOP_HELO_FCRDNS 3486 3.21 2.45 3.56 102 TR_XM_NoHeaderRelay 3297 0.87 2.31 0.21 103 XMBody_17 3246 1.03 2.28 0.46 104 FROM_EXCESS_BASE64 3184 1.76 2.23 1.54 105 T_REMOTE_IMAGE 2934 3.02 2.06 3.46 106 T_XMHurry_00 2929 1.04 2.05 0.57 107 HTML_MIME_NO_HTML_TAG 2891 2.49 2.03 2.71 108 DIET_1 2841 0.99 1.99 0.53 109 RCVD_IN_VALIDITY_SAFE 2791 3.31 1.96 3.93 110 ALL_TRUSTED 2751 11.21 1.93 15.44 111 USER_IN_DEF_DKIM_WL 2742 8.58 1.92 11.62 112 RCVD_IN_ZEN_LASTEXTERNAL 2695 0.59 1.89 0.00 113 SHORTCIRCUIT 2695 0.59 1.89 0.00 114 T_XMDrugObfuBody_00 2603 0.98 1.83 0.59 115 TR_XM_INV_DKIM 2548 0.66 1.79 0.14 116 BAYES_40 2514 4.70 1.76 6.03 117 RCVD_IN_VALIDITY_CERTIFIED 2474 2.81 1.74 3.30 118 T_FILL_THIS_FORM_SHORT 2444 1.17 1.71 0.92 119 XM_SendGrid 2420 1.39 1.70 1.26 120 SpammyFromTLD_01 2415 1.09 1.69 0.81 121 XMGenDplmaNmb 2407 1.21 1.69 0.99 122 XM_B_COPY_HTML 2383 0.92 1.67 0.57 123 TR_Symld_Words 2313 1.62 1.62 1.62 124 SpammyFromTLD_02 2307 0.66 1.62 0.23 125 ANY_BOUNCE_MESSAGE 2249 5.83 1.58 7.77 126 BOUNCE_MESSAGE 2247 5.83 1.58 7.77 127 DKIM_ADSP_CUSTOM_MED 2246 1.15 1.58 0.96 128 XMStockSpam_06 2226 1.37 1.56 1.29 129 NORDNS_LOW_CONTRAST 2223 0.52 1.56 0.05 130 SUBJ_ALL_CAPS 2214 1.50 1.55 1.47 131 MIME_CHARSET_FARAWAY 2207 2.40 1.55 2.79 132 URI_HEX 2207 1.18 1.55 1.01 133 XMBrknScrpt_02 2184 1.02 1.53 0.79 134 TR_XM_InvalidRelay 2179 0.48 1.53 0.01 135 RCVD_IN_PSBL 2044 0.81 1.43 0.53 136 XM_UB99 1971 0.44 1.38 0.00 137 BAYES_20 1950 3.22 1.37 4.07 138 XM_DK_Undo_01 1911 1.62 1.34 1.74 139 XMPhish30 1901 0.77 1.33 0.51 140 MPART_ALT_DIFF_COUNT 1882 0.82 1.32 0.60 141 RCVD_IN_XBL 1874 0.43 1.31 0.03 142 XMSubMetaI_00 1851 0.88 1.30 0.69 143 XMPhish14 1788 0.63 1.25 0.35 144 NML_ADSP_CUSTOM_MED 1757 0.79 1.23 0.59 145 RCVD_IN_IADB_LISTED 1752 2.58 1.23 3.20 146 FORGED_GMAIL_RCVD 1736 0.77 1.22 0.57 147 XMBdyGiftCard01 1698 0.78 1.19 0.60 148 RCVD_IN_PBL 1659 0.92 1.16 0.81 149 TR_LOTS_OF_MONEY2 1640 0.53 1.15 0.25 150 T_MONEY_PERCENT 1640 0.53 1.15 0.25 151 XM_H_Long_From02 1638 0.97 1.15 0.89 152 XMReplyNow 1628 0.53 1.14 0.26 153 RELAYCOUNTRY_DE 1593 0.55 1.12 0.29 154 HTML_TAG_BALANCE_BODY 1577 0.74 1.11 0.57 155 HTTPS_HTTP_MISMATCH 1572 1.05 1.10 1.03 156 RCVD_IN_IADB_SPF 1555 2.27 1.09 2.81 157 TR_XM_PHPDW 1551 0.66 1.09 0.46 158 URI_NOVOWEL 1549 1.32 1.09 1.42 159 TR_XM_PHPForged 1548 0.66 1.09 0.46 160 RCVD_IN_SBL_CSS 1524 0.35 1.07 0.02 161 TR_XM_FormFill2 1516 0.65 1.06 0.46 162 XM_B_REG_HTML 1506 0.47 1.06 0.20 163 XM_H_PHPOS 1481 0.63 1.04 0.45 164 RCVD_IN_SORBS_DUL 1481 0.36 1.04 0.05 165 XMHTML_After_End 1475 0.54 1.03 0.31 166 RCVD_IN_IADB_SENDERID 1457 2.05 1.02 2.51 167 RCVD_IN_IADB_DK 1457 1.99 1.02 2.44 168 XM_B_SEO 1426 0.48 1.00 0.24 169 XM_UB999 1422 0.31 1.00 0.00 170 TR_LOTS_OF_MONEY3 1406 0.48 0.99 0.25 171 TR_XM_Base64_M1 1404 0.77 0.98 0.67 172 T_Symld_Words_02 1398 0.81 0.98 0.73 173 TR_XM_RelayPhish 1389 0.36 0.97 0.08 174 XM_B_Phish66 1373 0.52 0.96 0.32 175 RELAYCOUNTRY_FR 1365 0.45 0.96 0.22 176 PLING_QUERY 1357 0.62 0.95 0.47 177 HTML_FONT_TINY_NORDNS 1334 0.34 0.94 0.07 178 BOTNET_NORDNS 1333 0.30 0.94 0.01 179 XM_B_COVIDMETA 1321 0.42 0.93 0.18 180 FONT_INVIS_LONG_LINE 1309 0.37 0.92 0.12 181 RCVD_IN_SBL 1306 0.29 0.92 0.00 182 MAY_BE_FORGED 1304 3.49 0.91 4.66 183 XM_ProductURIs 1301 0.65 0.91 0.54 184 LongTLD 1296 0.68 0.91 0.57 185 TR_XM_DK_SendGrid 1291 0.83 0.91 0.80 186 XM_PDF 1270 3.69 0.89 4.96 187 T_STY_INVIS_DIRECT 1269 0.51 0.89 0.34 188 RDNS_DYNAMIC 1266 0.40 0.89 0.18 189 TR_XM_SEO4 1259 0.36 0.88 0.12 190 RCVD_IN_SBL_DROP 1257 0.28 0.88 0.00 191 HK_RANDOM_REPLYTO 1249 0.38 0.88 0.15 192 PDS_RDNS_DYNAMIC_FP 1240 0.34 0.87 0.09 193 BAYES_00 1238 8.20 0.87 11.54 194 URI_TRY_3LD 1228 0.65 0.86 0.55 195 SHOPIFY_IMG_NOT_RCVD_SFY 1225 0.42 0.86 0.22 196 TM2_M_A_HREF_HREF 1200 0.39 0.84 0.19 197 TM2_M_OBFU_COMMENT 1196 0.52 0.84 0.37 198 TR_MetaPhish_Combo_01 1191 0.76 0.84 0.73 199 CHARSET_FARAWAY_HEADER 1185 1.94 0.83 2.45 200 XMSexyCombo_01 1182 0.37 0.83 0.17 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 272733 89.81 95.39 87.26 2 RELAYCOUNTRY_US 254268 81.80 82.79 81.36 3 DKIM_SIGNED 224617 76.93 88.03 71.87 4 XM_DK_Pass 219911 74.33 83.02 70.36 5 XM_B_Unicode 217868 73.86 82.94 69.71 6 DKIM_VALID 215916 73.05 81.75 69.08 7 DCC_CHECK_NEGATIVE 200388 51.03 22.33 64.12 8 BAYES_50 190145 54.54 40.74 60.84 9 DKIM_VALID_AU 172145 57.77 63.66 55.08 10 XMListUnsubscribeExists 139993 52.15 68.27 44.79 11 XM_B_SpammyWords 136673 51.84 69.61 43.73 12 XM_B_Unicode3 126815 42.89 47.97 40.58 13 DCC_CHECK 111978 48.34 75.76 35.83 14 T_TM2_M_HEADER_IN_MSG 107652 30.67 22.39 34.44 15 RCVD_IN_MSPIKE_H2 104892 35.23 38.89 33.56 16 HTML_FONT_LOW_CONTRAST 92022 31.59 36.29 29.44 17 DKIM_VALID_EF 90276 28.76 28.48 28.88 18 LOC_TINY_FONT_1 78738 32.46 48.40 25.19 19 FVGT_m_MULTI_ODD 76055 26.49 31.22 24.33 20 XMSubLong 74014 24.48 26.23 23.68 21 T_KAM_HTML_FONT_INVALID 62231 24.14 33.40 19.91 22 MIME_HTML_ONLY 60996 22.38 28.65 19.52 23 XM_B_SpammyWords2 56189 24.73 39.54 17.98 24 ALL_TRUSTED 48253 11.21 1.93 15.44 25 TR_XM_DK_Unsub 37847 14.45 19.58 12.11 26 XM_Multi_Part_URI 37365 14.95 21.51 11.96 27 USER_IN_DEF_DKIM_WL 36326 8.58 1.92 11.62 28 BAYES_00 36081 8.20 0.87 11.54 29 UNPARSEABLE_RELAY 33156 12.43 16.44 10.61 30 LotsOfNums_01 32361 9.90 8.90 10.35 31 XM_B_PhoneNumber 31873 8.87 5.95 10.20 32 XM_Evil_Numbers_Gen 30833 9.81 9.70 9.87 33 TooManyTo_001 28675 7.75 4.63 9.17 34 XM_B_Unsub 26898 11.33 17.29 8.61 35 ANY_BOUNCE_MESSAGE 24285 5.83 1.58 7.77 36 BOUNCE_MESSAGE 24278 5.83 1.58 7.77 37 TR_XM_DK_Bayes 23953 5.50 0.75 7.66 38 TR_XM_DK_Bayes1 23453 5.39 0.74 7.50 39 FSL_BULK_SIG 20897 7.70 9.93 6.69 40 T_TooManySym_01 20638 5.62 3.46 6.60 41 IN_ZIMBRA_NJ_WHITELIST 20620 4.57 0.11 6.60 42 BAYES_60 20536 7.13 8.37 6.57 43 XM_DKIMWhitelistDomains 20536 4.53 0.06 6.57 44 TR_XM_BayesUnsub 19866 9.55 16.57 6.36 45 TR_XM_DK_Bayes2 19829 4.53 0.57 6.34 46 XM_H_GMP 19237 5.86 5.22 6.16 47 BAYES_40 18859 4.70 1.76 6.03 48 LOTS_OF_MONEY 18338 7.76 11.90 5.87 49 TM2_M_VERY_LONG_WORD 17720 5.12 3.90 5.67 50 XM_B_Phish_Phrases 17177 6.20 7.74 5.50 51 XM_H_Long_From01 16623 5.17 4.84 5.32 52 TR_MAX_INTL_RELAY 16445 8.39 15.24 5.26 53 RCVD_IN_MSPIKE_H3 16292 4.74 3.71 5.21 54 RCVD_IN_MSPIKE_WL 16292 4.74 3.71 5.21 55 XM_PDF 15517 3.69 0.89 4.96 56 XMStrtUSub 15005 4.57 4.07 4.80 57 MIME_QP_LONG_LINE 14597 4.26 3.34 4.67 58 MAY_BE_FORGED 14578 3.49 0.91 4.66 59 HTML_IMAGE_ONLY_32 13737 3.08 0.18 4.40 60 XM_B_SpammyWords3 13730 7.70 14.95 4.39 61 XM_UncommonTLD01 13431 4.67 5.50 4.30 62 XM_DK_Undo_02 13170 14.55 37.22 4.21 63 MPART_ALT_DIFF 13161 4.86 6.29 4.21 64 BAYES_20 12721 3.22 1.37 4.07 65 HTML_IMAGE_RATIO_02 12651 5.05 7.25 4.05 66 RELAYCOUNTRY_META 12419 7.62 15.62 3.97 67 RCVD_IN_VALIDITY_SAFE 12280 3.31 1.96 3.93 68 HTML_IMAGE_RATIO_04 11968 4.21 5.04 3.83 69 TR_XM_SpammyWords4 11912 5.92 10.54 3.81 70 KHOP_HELO_FCRDNS 11137 3.21 2.45 3.56 71 T_REMOTE_IMAGE 10816 3.02 2.06 3.46 72 TooManyTo_002 10351 2.53 0.82 3.31 73 RCVD_IN_VALIDITY_CERTIFIED 10320 2.81 1.74 3.30 74 BAYES_80 10168 5.23 9.57 3.25 75 MAILING_LIST_MULTI 10161 3.00 2.46 3.25 76 BAYES_99 10101 11.44 29.43 3.23 77 HTML_IMAGE_RATIO_06 10005 3.47 4.06 3.20 78 T_TooManySym_02 10002 2.41 0.69 3.20 79 RCVD_IN_IADB_LISTED 9994 2.58 1.23 3.20 80 XMSubMetaSx_00 9590 4.08 6.31 3.07 81 XMNumbers 9518 3.29 3.82 3.05 82 RCVD_IN_IADB_SPF 8773 2.27 1.09 2.81 83 MIME_CHARSET_FARAWAY 8729 2.40 1.55 2.79 84 DKIM_INVALID 8701 3.88 6.28 2.78 85 HTML_MIME_NO_HTML_TAG 8463 2.49 2.03 2.71 86 BOTNET_IPINHOSTNAME 8414 5.09 10.36 2.69 87 MIME_HTML_ONLY_MULTI 7936 2.85 3.52 2.54 88 XMNoVowels 7864 2.80 3.42 2.52 89 RCVD_IN_IADB_SENDERID 7851 2.05 1.02 2.51 90 CHARSET_FARAWAY_HEADER 7653 1.94 0.83 2.45 91 BAYES_05 7652 1.88 0.64 2.45 92 RCVD_IN_IADB_DK 7620 1.99 1.02 2.44 93 BAYES_999 7595 8.75 22.62 2.43 94 XM_B_SpammyTLD 7342 2.86 3.97 2.35 95 INVALID_MSGID 7233 1.69 0.32 2.31 96 XM_Body_Dirty_Words 7022 3.96 7.70 2.25 97 HTML_IMAGE_RATIO_08 6885 2.37 2.74 2.20 98 RCVD_IN_IADB_VOUCHED 6750 1.66 0.56 2.16 99 TR_XM_SpammyRelay 6501 4.86 10.97 2.08 100 XM_B_URI_Unicode 6497 2.27 2.69 2.08 101 MIME_HTML_MOSTLY 6410 2.69 4.09 2.05 102 BAYES_95 6270 3.06 5.36 2.01 103 TO_MALFORMED 6266 1.41 0.10 2.00 104 XM_CamelCaseFrm001 6173 2.28 2.96 1.98 105 TooManyTo_003 6105 1.57 0.73 1.95 106 T_XMDrugObfuBody_14 5479 2.55 4.31 1.75 107 XMDiploma_00 5466 2.07 2.79 1.75 108 XM_DK_Undo_01 5450 1.62 1.34 1.74 109 XMLngstWrd_00 5278 1.34 0.57 1.69 110 TR_Symld_Words 5078 1.62 1.62 1.62 111 TM2_M_URI_OPT_OUT 4905 2.05 3.11 1.57 112 TR_XM_DKIM_Undo 4904 9.42 26.65 1.57 113 FROM_EXCESS_BASE64 4812 1.76 2.23 1.54 114 RCVD_IN_IADB_OPTIN 4731 1.15 0.35 1.51 115 TR_XM_PhishingBody 4660 2.45 4.54 1.49 116 SUBJ_ALL_CAPS 4592 1.50 1.55 1.47 117 TooManyTo_004 4587 1.22 0.67 1.47 118 T_XMDrugObfuBody_08 4566 1.99 3.16 1.46 119 XMCapTrack 4517 1.15 0.51 1.45 120 IN_HORDE_ADDRESS_BOOK 4517 1.03 0.11 1.45 121 UNTRUSTED_Relay 4497 3.03 6.53 1.44 122 XM_SPF_SoftFail 4477 2.09 3.54 1.43 123 URI_NOVOWEL 4444 1.32 1.09 1.42 124 XM_B_Investor 4435 2.35 4.39 1.42 125 TR_XM_UnparsRelay 4386 3.47 8.00 1.40 126 HELO_NODOT 4371 1.06 0.31 1.40 127 HELO_NO_DOMAIN 4367 1.06 0.31 1.40 128 XM_B_Unsub2 4344 1.80 2.70 1.39 129 TR_XM_SpammyWords5 4166 2.17 4.02 1.33 130 RELAYCOUNTRY_CA 4094 2.62 5.49 1.31 131 XMStockSpam_06 4031 1.37 1.56 1.29 132 XM_GoogleGroups 4007 1.12 0.77 1.28 133 XMGappySubj_01 3968 0.92 0.15 1.27 134 XM_SendGrid 3928 1.39 1.70 1.26 135 T_TooManySym_03 3912 0.92 0.19 1.25 136 TooManyTo_005 3889 1.05 0.62 1.24 137 BOTNET 3842 3.81 9.48 1.23 138 TR_DCC_Bayes_99 3445 7.67 22.07 1.10 139 TVD_SPACE_RATIO 3341 0.82 0.29 1.07 140 XMSexyCombo_05 3284 1.91 3.81 1.05 141 XM_OfRef6 3238 1.62 2.91 1.04 142 HTTPS_HTTP_MISMATCH 3215 1.05 1.10 1.03 143 URI_HEX 3150 1.18 1.55 1.01 144 XMGenDplmaNmb 3088 1.21 1.69 0.99 145 DKIM_ADSP_CUSTOM_MED 3006 1.15 1.58 0.96 146 T_FILL_THIS_FORM_SHORT 2871 1.17 1.71 0.92 147 XM_UB50 2815 1.60 3.13 0.90 148 XM_H_PHPMailer 2791 0.84 0.72 0.89 149 XM_H_Long_From02 2778 0.97 1.15 0.89 150 XM_ShortIntro_01 2728 0.76 0.51 0.87 151 XMGappySubj_02 2635 0.59 0.03 0.84 152 RCVD_IN_PBL 2538 0.92 1.16 0.81 153 SpammyFromTLD_01 2529 1.09 1.69 0.81 154 TR_XM_DK_SendGrid 2508 0.83 0.91 0.80 155 XMBrknScrpt_02 2472 1.02 1.53 0.79 156 TR_MetaPhish_Combo_01 2287 0.76 0.84 0.73 157 T_Symld_Words_02 2266 0.81 0.98 0.73 158 TVD_RCVD_IP 2168 0.72 0.76 0.69 159 XMSubMetaI_00 2160 0.88 1.30 0.69 160 XMWhlSbjSex 2103 0.55 0.27 0.67 161 TR_XM_Base64_M1 2084 0.77 0.98 0.67 162 T_OBFU_PDF_ATTACH 2008 0.50 0.18 0.64 163 XM_B_SpammyWords4 1991 1.25 2.61 0.64 164 TO_NO_BRKTS_HTML_ONLY 1984 0.61 0.54 0.63 165 FROM_GOV_DKIM_AU 1976 0.49 0.17 0.63 166 MPART_ALT_DIFF_COUNT 1870 0.82 1.32 0.60 167 XMBdyGiftCard01 1866 0.78 1.19 0.60 168 NML_ADSP_CUSTOM_MED 1857 0.79 1.23 0.59 169 T_XMDrugObfuBody_00 1851 0.98 1.83 0.59 170 HTML_IMAGE_ONLY_20 1798 0.62 0.71 0.58 171 T_XMHurry_00 1790 1.04 2.05 0.57 172 XM_B_COPY_HTML 1784 0.92 1.67 0.57 173 FORGED_GMAIL_RCVD 1781 0.77 1.22 0.57 174 LongTLD 1779 0.68 0.91 0.57 175 HTML_TAG_BALANCE_BODY 1774 0.74 1.11 0.57 176 XMSlimDrugH 1741 0.61 0.74 0.56 177 URI_TRY_3LD 1714 0.65 0.86 0.55 178 XM_B_FormFill 1679 0.38 0.04 0.54 179 XM_ProductURIs 1673 0.65 0.91 0.54 180 DIET_1 1661 0.99 1.99 0.53 181 RCVD_IN_PSBL 1655 0.81 1.43 0.53 182 XM_URI_RBL 1651 1.17 2.59 0.53 183 RELAYCOUNTRY_GB 1648 0.60 0.76 0.53 184 T_TVD_MIME_NO_HEADERS 1628 0.37 0.03 0.52 185 RELAYCOUNTRY_AU 1621 1.14 2.50 0.52 186 MSGID_FROM_MTA_HEADER 1593 0.38 0.11 0.51 187 XMPhish30 1581 0.77 1.33 0.51 188 MISSING_HEADERS 1570 0.50 0.50 0.50 189 T_MANY_PILL_PRICE 1570 0.35 0.01 0.50 190 XMBody_95 1489 0.41 0.27 0.48 191 XMMoneyMeta_00 1472 0.55 0.72 0.47 192 PLING_QUERY 1470 0.62 0.95 0.47 193 TR_XM_PHPForged 1447 0.66 1.09 0.46 194 TR_XM_FormFill2 1443 0.65 1.06 0.46 195 XMBody_17 1436 1.03 2.28 0.46 196 TR_XM_PHPDW 1434 0.66 1.09 0.46 197 XM_H_PHPOS 1401 0.63 1.04 0.45 198 XMDateMe_00 1374 0.42 0.36 0.44 199 XMEqualsVooDoo_00 1356 0.52 0.72 0.43 200 XMBSHREFv2 1341 0.40 0.35 0.43 ----------------------------------------------------------------------