Email: 441146 Autolearn: 0 AvgScore: 4.90 AvgScanTime: 1.37 sec Spam: 146757 Autolearn: 0 AvgScore: 14.08 AvgScanTime: 1.47 sec Ham: 294389 Autolearn: 0 AvgScore: 0.33 AvgScanTime: 1.32 sec Time Spent Running SA: 167.70 hours Time Spent Processing Spam: 60.07 hours Time Spent Processing Ham: 107.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140795 89.90 95.94 86.89 2 DKIM_SIGNED 125020 78.23 85.19 74.76 3 RELAYCOUNTRY_US 124895 83.09 85.10 82.08 4 XM_B_Unicode 122372 75.41 83.38 71.44 5 XM_DK_Pass 118857 75.89 80.99 73.34 6 DKIM_VALID 117442 74.87 80.02 72.29 7 DCC_CHECK 105745 50.16 72.05 39.25 8 XM_B_SpammyWords 103378 52.78 70.44 43.98 9 XMListUnsubscribeExists 99253 55.18 67.63 48.97 10 DKIM_VALID_AU 91878 59.54 62.61 58.01 11 LOC_TINY_FONT_1 75333 36.58 51.33 29.23 12 XM_B_Unicode3 74726 45.08 50.92 42.17 13 BAYES_50 64915 55.77 44.23 61.52 14 XM_B_SpammyWords2 61864 26.32 42.15 18.43 15 RCVD_IN_MSPIKE_H2 56603 36.52 38.57 35.50 16 HTML_FONT_LOW_CONTRAST 55404 30.99 37.75 27.62 17 XM_DK_Undo_02 54524 15.82 37.15 5.18 18 FVGT_m_MULTI_ODD 47516 27.21 32.38 24.63 19 T_KAM_HTML_FONT_INVALID 47210 25.35 32.17 21.95 20 DKIM_VALID_EF 41500 28.08 28.28 27.99 21 BAYES_99 40998 11.77 27.94 3.71 22 TR_XM_DKIM_Undo 39582 10.48 26.97 2.26 23 MIME_HTML_ONLY 39114 22.73 26.65 20.77 24 DCC_CHECK_NEGATIVE 38926 49.32 26.52 60.68 25 T_TM2_M_HEADER_IN_MSG 36132 28.87 24.62 30.99 26 XMSubLong 36068 23.74 24.58 23.33 27 XM_Multi_Part_URI 32972 16.35 22.47 13.31 28 BAYES_999 32061 9.10 21.85 2.75 29 TR_DCC_Bayes_99 29028 7.46 19.78 1.32 30 TR_XM_DK_Unsub 28848 14.93 19.66 12.57 31 UNPARSEABLE_RELAY 23836 12.69 16.24 10.92 32 XM_B_Unsub 23602 11.56 16.08 9.30 33 TR_XM_BayesUnsub 22828 9.58 15.55 6.60 34 XM_Evil_Numbers_Gen 20495 11.51 13.97 10.29 35 TR_MAX_INTL_RELAY 20463 8.45 13.94 5.71 36 XM_B_SpammyWords3 19939 7.54 13.59 4.53 37 RELAYCOUNTRY_META 19066 6.87 12.99 3.82 38 LotsOfNums_01 18604 10.29 12.68 9.10 39 LOTS_OF_MONEY 17813 8.01 12.14 5.96 40 XM_B_Phish_Phrases 16495 7.65 11.24 5.86 41 TR_XM_SpammyWords4 16410 6.30 11.18 3.86 42 TR_XM_SpammyWords2 15021 3.75 10.24 0.51 43 BOTNET_IPINHOSTNAME 14298 5.53 9.74 3.43 44 BOTNET 14019 4.14 9.55 1.45 45 TR_XM_SpammyRelay 13888 4.45 9.46 1.95 46 TM2_M_VERY_LONG_WORD 13727 5.62 9.35 3.76 47 RCVD_IN_BL_SPAMCOP_NET 13485 3.48 9.19 0.64 48 FSL_BULK_SIG 12754 7.80 8.69 7.35 49 BAYES_80 12631 5.20 8.61 3.50 50 HTML_IMAGE_RATIO_04 12191 6.30 8.31 5.30 51 BAYES_60 11655 6.80 7.94 6.23 52 XM_Body_Dirty_Words 11180 4.44 7.62 2.86 53 TR_XM_UnparsRelay 10631 3.31 7.24 1.35 54 BOUNCE_MESSAGE 10132 6.11 6.90 5.72 55 ANY_BOUNCE_MESSAGE 10132 6.12 6.90 5.72 56 TR_XM_SPAMCOP 10076 2.54 6.87 0.39 57 HTML_IMAGE_RATIO_02 8983 4.88 6.12 4.26 58 XMSubMetaSx_00 8789 4.82 5.99 4.23 59 MPART_ALT_DIFF 8492 4.92 5.79 4.49 60 XM_UncommonTLD01 8425 4.84 5.74 4.39 61 UNTRUSTED_Relay 8289 2.84 5.65 1.44 62 MAY_BE_FORGED 7708 3.30 5.25 2.33 63 DKIM_INVALID 7578 3.36 5.16 2.47 64 RELAYCOUNTRY_CA 7571 2.46 5.16 1.11 65 BAYES_95 7476 3.17 5.09 2.21 66 XM_B_PhoneNumber 7400 8.04 5.04 9.53 67 HTML_IMAGE_RATIO_06 7399 4.06 5.04 3.58 68 XM_H_Long_From01 7215 5.47 4.92 5.74 69 TR_XM_PhishingBody 6607 2.53 4.50 1.55 70 TooManyTo_001 6600 7.01 4.50 8.27 71 XM_B_Investor 6367 2.47 4.34 1.53 72 XM_H_GMP 6173 5.20 4.21 5.70 73 MIME_QP_LONG_LINE 6036 4.60 4.11 4.84 74 XMStrtUSub 5984 4.68 4.08 4.99 75 XMSexyCombo_05 5835 2.49 3.98 1.75 76 T_XMDrugObfuBody_14 5700 2.64 3.88 2.01 77 KHOP_HELO_FCRDNS 5536 2.85 3.77 2.39 78 RCVD_IN_MSPIKE_H3 5148 4.39 3.51 4.83 79 RCVD_IN_MSPIKE_WL 5148 4.39 3.51 4.83 80 XM_UB50 5116 1.79 3.49 0.94 81 XM_B_SpammyTLD 5103 3.06 3.48 2.86 82 DKIM_ADSP_NXDOMAIN 4969 1.34 3.39 0.32 83 MIME_HTML_MOSTLY 4931 2.51 3.36 2.09 84 TR_XM_SpammyWords5 4924 2.03 3.36 1.37 85 MIME_HTML_ONLY_MULTI 4763 2.93 3.25 2.77 86 T_XMDrugObfuBody_08 4580 2.10 3.12 1.58 87 XM_OfRef6 4524 1.81 3.08 1.18 88 TM2_M_URI_OPT_OUT 4363 2.31 2.97 1.97 89 XMDiploma_00 4252 2.03 2.90 1.60 90 XMNumbers 4206 3.07 2.87 3.18 91 XM_B_URI_Unicode 4204 2.31 2.86 2.04 92 RCVD_IN_VALIDITY_RPBL 4171 0.96 2.84 0.02 93 XM_SPF_SoftFail 4158 1.84 2.83 1.34 94 XM_CamelCaseFrm001 4048 2.69 2.76 2.66 95 HTML_IMAGE_RATIO_08 3957 2.39 2.70 2.24 96 XM_B_Unsub2 3566 1.74 2.43 1.40 97 T_XMHurry_00 3559 1.20 2.43 0.59 98 XMNoVowels 3556 2.24 2.42 2.15 99 XMBody_17 3477 1.08 2.37 0.43 100 XM_URI_RBL 3263 0.99 2.22 0.37 101 MIME_CHARSET_FARAWAY 3194 1.56 2.18 1.25 102 MAILING_LIST_MULTI 3180 2.58 2.17 2.78 103 RELAYCOUNTRY_AU 3166 1.17 2.16 0.68 104 BAYES_40 3143 4.29 2.14 5.37 105 USER_IN_DEF_DKIM_WL 3128 9.54 2.13 13.23 106 SpammyFromTLD_02 3076 1.07 2.10 0.56 107 RCVD_IN_VALIDITY_SAFE 3019 3.40 2.06 4.07 108 TR_XM_INV_DKIM 2974 0.78 2.03 0.16 109 BOTNET_NORDNS 2952 0.68 2.01 0.01 110 T_XMDrugObfuBody_00 2911 1.15 1.98 0.73 111 T_TooManySym_01 2897 4.63 1.97 5.95 112 TR_XM_NoHeaderRelay 2826 0.80 1.93 0.24 113 FROM_EXCESS_BASE64 2821 1.90 1.92 1.88 114 XM_B_SpammyWords4 2722 1.06 1.85 0.67 115 XM_DK_Undo_01 2681 1.67 1.83 1.59 116 TR_Symld_Words 2636 1.79 1.80 1.78 117 XMStockSpam_06 2595 1.59 1.77 1.51 118 SUBJ_ALL_CAPS 2566 1.58 1.75 1.50 119 RCVD_IN_VALIDITY_CERTIFIED 2457 2.81 1.67 3.38 120 XMPhish30 2442 0.95 1.66 0.59 121 SpammyFromTLD_01 2413 1.14 1.64 0.88 122 XMGenDplmaNmb 2393 1.15 1.63 0.91 123 T_REMOTE_IMAGE 2384 3.09 1.62 3.82 124 T_FILL_THIS_FORM_SHORT 2334 1.17 1.59 0.96 125 DIET_1 2263 1.13 1.54 0.92 126 XM_SendGrid 2243 1.40 1.53 1.34 127 XMBrknScrpt_02 2243 1.14 1.53 0.95 128 XM_B_COPY_HTML 2229 1.19 1.52 1.03 129 HTML_MIME_NO_HTML_TAG 2152 2.14 1.47 2.48 130 CHARSET_FARAWAY_HEADER 2122 1.06 1.45 0.87 131 RCVD_IN_PSBL 2087 0.68 1.42 0.31 132 LongTLD 2076 0.75 1.41 0.42 133 SHORTCIRCUIT 2071 0.47 1.41 0.00 134 RCVD_IN_ZEN_LASTEXTERNAL 2071 0.47 1.41 0.00 135 XMBdyGiftCard01 2038 0.82 1.39 0.54 136 ALL_TRUSTED 2028 10.41 1.38 14.91 137 URI_NOVOWEL 2004 1.31 1.37 1.28 138 BAYES_20 2001 3.04 1.36 3.87 139 NO_DNS_FOR_FROM 1954 0.63 1.33 0.28 140 TR_XM_MaxWHORU 1937 0.58 1.32 0.22 141 URI_HEX 1837 1.40 1.25 1.48 142 RCVD_IN_IADB_LISTED 1833 2.92 1.25 3.75 143 XMLngstWrd_00 1831 1.23 1.25 1.22 144 TM2_M_A_HREF_HREF 1812 0.62 1.23 0.32 145 XM_H_Long_From02 1771 1.04 1.21 0.96 146 XMEqualsVooDoo_00 1752 0.53 1.19 0.20 147 TM2_M_OBFU_COMMENT 1745 0.66 1.19 0.40 148 XM_B_Phish66 1732 0.59 1.18 0.30 149 SHOPIFY_IMG_NOT_RCVD_SFY 1726 0.56 1.18 0.25 150 RCVD_IN_IADB_SPF 1711 2.58 1.17 3.28 151 HK_RANDOM_REPLYTO 1682 0.48 1.15 0.15 152 RCVD_IN_IADB_DK 1668 2.28 1.14 2.86 153 RCVD_IN_IADB_SENDERID 1652 2.34 1.13 2.94 154 XMBounce_01 1645 0.38 1.12 0.01 155 XM_Body_Dirty_Words_01 1644 0.42 1.12 0.07 156 TR_LOTS_OF_MONEY3 1606 0.50 1.09 0.20 157 MPART_ALT_DIFF_COUNT 1597 0.75 1.09 0.58 158 URI_TRY_3LD 1551 0.78 1.06 0.64 159 TR_MetaPhish_Combo_01 1517 0.95 1.03 0.91 160 TR_XM_PHPDW 1510 0.56 1.03 0.32 161 RCVD_IN_PBL 1508 0.79 1.03 0.67 162 TR_XM_PHPForged 1507 0.55 1.03 0.32 163 XM_B_COVIDMETA 1495 0.49 1.02 0.23 164 PLING_QUERY 1491 0.62 1.02 0.42 165 DKIM_ADSP_CUSTOM_MED 1490 0.92 1.02 0.87 166 TR_XM_FormFill2 1473 0.55 1.00 0.33 167 HTML_TAG_BALANCE_BODY 1454 0.68 0.99 0.53 168 XM_H_PHPOS 1450 0.54 0.99 0.31 169 XM_B_SEO 1441 0.48 0.98 0.23 170 NORDNS_LOW_CONTRAST 1398 0.33 0.95 0.02 171 XM_ProductURIs 1389 0.72 0.95 0.60 172 XM_B_DNDMA 1363 0.69 0.93 0.58 173 XMSubMetaI_00 1339 0.60 0.91 0.44 174 TR_XM_Base64_M1 1331 0.74 0.91 0.65 175 XMPhish14 1324 0.57 0.90 0.40 176 J_POPCORN_WO_D 1322 0.43 0.90 0.20 177 XMHTML_After_End 1273 0.49 0.87 0.30 178 TR_XM_DK_SendGrid 1271 0.85 0.87 0.84 179 HTML_FONT_TINY_NORDNS 1237 0.32 0.84 0.06 180 TR_XM_SEO4 1216 0.34 0.83 0.09 181 T_Symld_Words_02 1187 0.65 0.81 0.56 182 MultiRelay_CC 1180 0.36 0.80 0.14 183 XMLngstWrd_01 1178 0.55 0.80 0.43 184 HTML_IMAGE_ONLY_20 1170 0.63 0.80 0.55 185 XMReplyNow 1166 0.41 0.79 0.21 186 RELAYCOUNTRY_FR 1159 0.40 0.79 0.21 187 T_STY_INVIS_DIRECT 1158 0.57 0.79 0.46 188 TR_LOTS_OF_MONEY2 1148 0.37 0.78 0.16 189 T_MONEY_PERCENT 1148 0.37 0.78 0.16 190 TR_XM_RelayPhish 1128 0.31 0.77 0.07 191 HTTPS_HTTP_MISMATCH 1121 0.75 0.76 0.74 192 XMDateMe_00 1120 0.60 0.76 0.52 193 XMSubMetaSxObfu_03 1119 0.63 0.76 0.57 194 XM_B_REG_HTML 1113 0.38 0.76 0.19 195 TR_XM_InvalidRelay 1107 0.26 0.75 0.02 196 XM_RXBody 1106 0.79 0.75 0.81 197 XM_DIRTYINTL 1090 0.31 0.74 0.09 198 FORGED_GMAIL_RCVD 1087 0.60 0.74 0.53 199 FONT_INVIS_LONG_LINE 1082 0.30 0.74 0.08 200 XMSlimDrugH 1080 0.52 0.74 0.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 255803 89.90 95.94 86.89 2 RELAYCOUNTRY_US 241632 83.09 85.10 82.08 3 DKIM_SIGNED 220087 78.23 85.19 74.76 4 XM_DK_Pass 215912 75.89 80.99 73.34 5 DKIM_VALID 212823 74.87 80.02 72.29 6 XM_B_Unicode 210311 75.41 83.38 71.44 7 BAYES_50 181108 55.77 44.23 61.52 8 DCC_CHECK_NEGATIVE 178642 49.32 26.52 60.68 9 DKIM_VALID_AU 170783 59.54 62.61 58.01 10 XMListUnsubscribeExists 144160 55.18 67.63 48.97 11 XM_B_SpammyWords 129479 52.78 70.44 43.98 12 XM_B_Unicode3 124136 45.08 50.92 42.17 13 DCC_CHECK 115534 50.16 72.05 39.25 14 RCVD_IN_MSPIKE_H2 104501 36.52 38.57 35.50 15 T_TM2_M_HEADER_IN_MSG 91234 28.87 24.62 30.99 16 LOC_TINY_FONT_1 86047 36.58 51.33 29.23 17 DKIM_VALID_EF 82394 28.08 28.28 27.99 18 HTML_FONT_LOW_CONTRAST 81300 30.99 37.75 27.62 19 FVGT_m_MULTI_ODD 72500 27.21 32.38 24.63 20 XMSubLong 68671 23.74 24.58 23.33 21 T_KAM_HTML_FONT_INVALID 64630 25.35 32.17 21.95 22 MIME_HTML_ONLY 61157 22.73 26.65 20.77 23 XM_B_SpammyWords2 54264 26.32 42.15 18.43 24 ALL_TRUSTED 43891 10.41 1.38 14.91 25 XM_Multi_Part_URI 39175 16.35 22.47 13.31 26 USER_IN_DEF_DKIM_WL 38956 9.54 2.13 13.23 27 TR_XM_DK_Unsub 37016 14.93 19.66 12.57 28 BAYES_00 33428 7.81 0.68 11.36 29 UNPARSEABLE_RELAY 32133 12.69 16.24 10.92 30 XM_Evil_Numbers_Gen 30297 11.51 13.97 10.29 31 XM_B_PhoneNumber 28062 8.04 5.04 9.53 32 XM_B_Unsub 27387 11.56 16.08 9.30 33 LotsOfNums_01 26804 10.29 12.68 9.10 34 TooManyTo_001 24345 7.01 4.50 8.27 35 TR_XM_DK_Bayes 21662 5.09 0.55 7.36 36 FSL_BULK_SIG 21635 7.80 8.69 7.35 37 TR_XM_DK_Bayes1 21267 5.00 0.54 7.22 38 XM_DKIMWhitelistDomains 20792 4.75 0.10 7.06 39 IN_ZIMBRA_NJ_WHITELIST 19923 4.55 0.11 6.77 40 TR_XM_BayesUnsub 19417 9.58 15.55 6.60 41 BAYES_60 18328 6.80 7.94 6.23 42 TR_XM_DK_Bayes2 17681 4.13 0.36 6.01 43 LOTS_OF_MONEY 17538 8.01 12.14 5.96 44 T_TooManySym_01 17517 4.63 1.97 5.95 45 XM_B_Phish_Phrases 17260 7.65 11.24 5.86 46 XM_H_Long_From01 16911 5.47 4.92 5.74 47 ANY_BOUNCE_MESSAGE 16848 6.12 6.90 5.72 48 BOUNCE_MESSAGE 16836 6.11 6.90 5.72 49 TR_MAX_INTL_RELAY 16802 8.45 13.94 5.71 50 XM_H_GMP 16777 5.20 4.21 5.70 51 BAYES_40 15800 4.29 2.14 5.37 52 HTML_IMAGE_RATIO_04 15615 6.30 8.31 5.30 53 XM_DK_Undo_02 15259 15.82 37.15 5.18 54 XMStrtUSub 14681 4.68 4.08 4.99 55 MIME_QP_LONG_LINE 14248 4.60 4.11 4.84 56 RCVD_IN_MSPIKE_WL 14228 4.39 3.51 4.83 57 RCVD_IN_MSPIKE_H3 14227 4.39 3.51 4.83 58 XM_B_SpammyWords3 13338 7.54 13.59 4.53 59 MPART_ALT_DIFF 13209 4.92 5.79 4.49 60 XM_PDF 13016 3.16 0.62 4.42 61 XM_UncommonTLD01 12936 4.84 5.74 4.39 62 HTML_IMAGE_RATIO_02 12530 4.88 6.12 4.26 63 XMSubMetaSx_00 12461 4.82 5.99 4.23 64 RCVD_IN_VALIDITY_SAFE 11981 3.40 2.06 4.07 65 BAYES_20 11391 3.04 1.36 3.87 66 TR_XM_SpammyWords4 11370 6.30 11.18 3.86 67 T_REMOTE_IMAGE 11246 3.09 1.62 3.82 68 RELAYCOUNTRY_META 11242 6.87 12.99 3.82 69 TM2_M_VERY_LONG_WORD 11055 5.62 9.35 3.76 70 RCVD_IN_IADB_LISTED 11028 2.92 1.25 3.75 71 BAYES_99 10912 11.77 27.94 3.71 72 HTML_IMAGE_RATIO_06 10532 4.06 5.04 3.58 73 BAYES_80 10289 5.20 8.61 3.50 74 BOTNET_IPINHOSTNAME 10112 5.53 9.74 3.43 75 RCVD_IN_VALIDITY_CERTIFIED 9939 2.81 1.67 3.38 76 RCVD_IN_IADB_SPF 9669 2.58 1.17 3.28 77 XMNumbers 9347 3.07 2.87 3.18 78 TooManyTo_002 9309 2.27 0.48 3.16 79 T_TooManySym_02 9190 2.29 0.62 3.12 80 RCVD_IN_IADB_SENDERID 8653 2.34 1.13 2.94 81 XM_Body_Dirty_Words 8427 4.44 7.62 2.86 82 XM_B_SpammyTLD 8418 3.06 3.48 2.86 83 RCVD_IN_IADB_DK 8407 2.28 1.14 2.86 84 MAILING_LIST_MULTI 8187 2.58 2.17 2.78 85 MIME_HTML_ONLY_MULTI 8164 2.93 3.25 2.77 86 BAYES_999 8089 9.10 21.85 2.75 87 XM_CamelCaseFrm001 7822 2.69 2.76 2.66 88 INVALID_MSGID 7370 1.76 0.26 2.50 89 RCVD_IN_IADB_VOUCHED 7345 1.80 0.40 2.49 90 HTML_MIME_NO_HTML_TAG 7307 2.14 1.47 2.48 91 DKIM_INVALID 7264 3.36 5.16 2.47 92 KHOP_HELO_FCRDNS 7034 2.85 3.77 2.39 93 MAY_BE_FORGED 6868 3.30 5.25 2.33 94 TR_XM_DKIM_Undo 6665 10.48 26.97 2.26 95 BAYES_05 6621 1.70 0.59 2.25 96 HTML_IMAGE_RATIO_08 6580 2.39 2.70 2.24 97 BAYES_95 6508 3.17 5.09 2.21 98 XMNoVowels 6333 2.24 2.42 2.15 99 TO_MALFORMED 6294 1.43 0.02 2.14 100 MIME_HTML_MOSTLY 6154 2.51 3.36 2.09 101 XM_B_URI_Unicode 6008 2.31 2.86 2.04 102 T_XMDrugObfuBody_14 5926 2.64 3.88 2.01 103 TM2_M_URI_OPT_OUT 5808 2.31 2.97 1.97 104 TR_XM_SpammyRelay 5735 4.45 9.46 1.95 105 FROM_EXCESS_BASE64 5543 1.90 1.92 1.88 106 TR_Symld_Words 5248 1.79 1.80 1.78 107 XMSexyCombo_05 5151 2.49 3.98 1.75 108 RCVD_IN_IADB_OPTIN 5086 1.24 0.26 1.73 109 XMDiploma_00 4698 2.03 2.90 1.60 110 TooManyTo_003 4696 1.21 0.43 1.60 111 XM_DK_Undo_01 4695 1.67 1.83 1.59 112 T_XMDrugObfuBody_08 4666 2.10 3.12 1.58 113 IN_HORDE_ADDRESS_BOOK 4583 1.07 0.10 1.56 114 TR_XM_PhishingBody 4564 2.53 4.50 1.55 115 XM_B_Investor 4517 2.47 4.34 1.53 116 XMStockSpam_06 4435 1.59 1.77 1.51 117 SUBJ_ALL_CAPS 4415 1.58 1.75 1.50 118 URI_HEX 4352 1.40 1.25 1.48 119 BOTNET 4258 4.14 9.55 1.45 120 UNTRUSTED_Relay 4251 2.84 5.65 1.44 121 XM_B_Unsub2 4114 1.74 2.43 1.40 122 TR_XM_SpammyWords5 4027 2.03 3.36 1.37 123 TR_XM_UnparsRelay 3968 3.31 7.24 1.35 124 XM_SendGrid 3954 1.40 1.53 1.34 125 XM_SPF_SoftFail 3943 1.84 2.83 1.34 126 TR_DCC_Bayes_99 3879 7.46 19.78 1.32 127 XMGappySubj_01 3830 0.91 0.13 1.30 128 URI_NOVOWEL 3768 1.31 1.37 1.28 129 MIME_CHARSET_FARAWAY 3691 1.56 2.18 1.25 130 T_TooManySym_03 3657 0.89 0.19 1.24 131 XMLngstWrd_00 3596 1.23 1.25 1.22 132 XM_OfRef6 3469 1.81 3.08 1.18 133 HELO_NODOT 3395 0.84 0.23 1.15 134 HELO_NO_DOMAIN 3392 0.84 0.23 1.15 135 TooManyTo_004 3363 0.89 0.38 1.14 136 RELAYCOUNTRY_CA 3282 2.46 5.16 1.11 137 XM_GoogleGroups 3266 0.95 0.62 1.11 138 FROM_GOV_DKIM_AU 3245 0.79 0.16 1.10 139 TVD_SPACE_RATIO 3083 0.78 0.25 1.05 140 XMCapTrack 3058 0.82 0.38 1.04 141 XM_B_COPY_HTML 3028 1.19 1.52 1.03 142 XM_B_FormFill 2896 0.67 0.05 0.98 143 T_FILL_THIS_FORM_SHORT 2832 1.17 1.59 0.96 144 XM_H_Long_From02 2822 1.04 1.21 0.96 145 XMBrknScrpt_02 2796 1.14 1.53 0.95 146 XM_UB50 2764 1.79 3.49 0.94 147 DIET_1 2708 1.13 1.54 0.92 148 XMGenDplmaNmb 2684 1.15 1.63 0.91 149 TooManyTo_005 2666 0.71 0.33 0.91 150 TR_MetaPhish_Combo_01 2666 0.95 1.03 0.91 151 SpammyFromTLD_01 2602 1.14 1.64 0.88 152 DKIM_ADSP_CUSTOM_MED 2565 0.92 1.02 0.87 153 CHARSET_FARAWAY_HEADER 2556 1.06 1.45 0.87 154 XM_ShortIntro_01 2522 0.73 0.47 0.86 155 XMSolicitRefs_0 2506 0.77 0.60 0.85 156 TR_XM_DK_SendGrid 2460 0.85 0.87 0.84 157 XM_RXBody 2391 0.79 0.75 0.81 158 XM_H_PHPMailer 2252 0.71 0.60 0.76 159 HTTPS_HTTP_MISMATCH 2168 0.75 0.76 0.74 160 T_OBFU_PDF_ATTACH 2167 0.54 0.14 0.74 161 T_XMDrugObfuBody_00 2153 1.15 1.98 0.73 162 RELAYCOUNTRY_AU 1992 1.17 2.16 0.68 163 RCVD_IN_PBL 1985 0.79 1.03 0.67 164 XM_B_SpammyWords4 1969 1.06 1.85 0.67 165 XMSexyCombo_01 1953 0.68 0.72 0.66 166 T_TVD_MIME_NO_HEADERS 1918 0.44 0.02 0.65 167 TR_XM_Base64_M1 1915 0.74 0.91 0.65 168 TO_NO_BRKTS_HTML_ONLY 1913 0.54 0.31 0.65 169 TVD_RCVD_IP 1910 0.61 0.54 0.65 170 URI_TRY_3LD 1898 0.78 1.06 0.64 171 RCVD_IN_BL_SPAMCOP_NET 1876 3.48 9.19 0.64 172 HTML_EXTRA_CLOSE 1850 0.44 0.06 0.63 173 XMBody_95 1798 0.49 0.24 0.61 174 XM_ProductURIs 1771 0.72 0.95 0.60 175 XMPhish30 1733 0.95 1.66 0.59 176 T_XMHurry_00 1724 1.20 2.43 0.59 177 MPART_ALT_DIFF_COUNT 1718 0.75 1.09 0.58 178 XM_B_DNDMA 1701 0.69 0.93 0.58 179 NML_ADSP_CUSTOM_MED 1691 0.61 0.67 0.57 180 XMSexyCombo_04 1685 0.46 0.25 0.57 181 XMSubMetaSxObfu_03 1672 0.63 0.76 0.57 182 T_Symld_Words_02 1663 0.65 0.81 0.56 183 SpammyFromTLD_02 1663 1.07 2.10 0.56 184 HTML_IMAGE_ONLY_20 1628 0.63 0.80 0.55 185 XMGappySubj_02 1620 0.38 0.03 0.55 186 XMBdyGiftCard01 1581 0.82 1.39 0.54 187 HTML_TAG_BALANCE_BODY 1566 0.68 0.99 0.53 188 FORGED_GMAIL_RCVD 1555 0.60 0.74 0.53 189 RELAYCOUNTRY_GB 1544 0.58 0.69 0.52 190 XMDateMe_00 1541 0.60 0.76 0.52 191 TR_XM_SpammyWords2 1503 3.75 10.24 0.51 192 FILL_THIS_FORM 1398 0.40 0.24 0.47 193 T_STY_INVIS_DIRECT 1353 0.57 0.79 0.46 194 MSGID_FROM_MTA_HEADER 1327 0.34 0.11 0.45 195 XMSubMetaI_00 1310 0.60 0.91 0.44 196 HTML_IMAGE_ONLY_32 1281 0.35 0.18 0.44 197 XMBody_17 1278 1.08 2.37 0.43 198 XMLngstWrd_01 1267 0.55 0.80 0.43 199 XMBSHREFv2 1260 0.38 0.29 0.43 200 PLING_QUERY 1245 0.62 1.02 0.42 ----------------------------------------------------------------------