Email: 449284 Autolearn: 0 AvgScore: 4.49 AvgScanTime: 1.26 sec Spam: 131199 Autolearn: 0 AvgScore: 14.85 AvgScanTime: 1.38 sec Ham: 318085 Autolearn: 0 AvgScore: 0.22 AvgScanTime: 1.21 sec Time Spent Running SA: 157.05 hours Time Spent Processing Spam: 50.45 hours Time Spent Processing Ham: 106.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123682 89.41 94.27 87.41 2 DKIM_SIGNED 115412 76.52 87.97 71.79 3 XM_B_Unicode 110550 73.08 84.26 68.47 4 XM_DK_Pass 109577 74.14 83.52 70.27 5 DKIM_VALID 108456 72.99 82.67 69.00 6 RELAYCOUNTRY_US 106410 82.33 81.11 82.83 7 DCC_CHECK 97238 46.34 74.11 34.89 8 XM_B_SpammyWords 91375 50.53 69.65 42.65 9 XMListUnsubscribeExists 88411 50.81 67.39 43.97 10 DKIM_VALID_AU 86130 58.72 65.65 55.86 11 XM_B_Unicode3 65178 42.42 49.68 39.43 12 LOC_TINY_FONT_1 62803 31.46 47.87 24.69 13 BAYES_50 54998 54.88 41.92 60.23 14 XM_B_SpammyWords2 53051 24.01 40.44 17.23 15 RCVD_IN_MSPIKE_H2 50058 34.69 38.15 33.26 16 XM_DK_Undo_02 49070 13.86 37.40 4.15 17 HTML_FONT_LOW_CONTRAST 47566 30.21 36.25 27.72 18 FVGT_m_MULTI_ODD 39823 26.03 30.35 24.25 19 MIME_HTML_ONLY 39361 23.94 30.00 21.44 20 DKIM_VALID_EF 38378 29.54 29.25 29.67 21 T_KAM_HTML_FONT_INVALID 38295 22.82 29.19 20.20 22 BAYES_99 38150 10.72 29.08 3.14 23 TR_XM_DKIM_Undo 35821 9.36 27.30 1.96 24 XMSubLong 33672 23.93 25.66 23.22 25 DCC_CHECK_NEGATIVE 31468 53.06 23.98 65.06 26 T_TM2_M_HEADER_IN_MSG 30247 30.95 23.05 34.21 27 BAYES_999 29709 8.31 22.64 2.40 28 TR_XM_DK_Unsub 27052 14.90 20.62 12.54 29 XM_Multi_Part_URI 26718 14.62 20.36 12.25 30 TR_DCC_Bayes_99 26494 6.79 20.19 1.26 31 XM_B_Unsub 22907 12.76 17.46 10.82 32 UNPARSEABLE_RELAY 22271 13.39 16.97 11.90 33 RELAYCOUNTRY_META 21932 7.53 16.72 3.74 34 TR_XM_BayesUnsub 21882 9.45 16.68 6.47 35 XM_B_SpammyWords3 21202 7.79 16.16 4.34 36 LOTS_OF_MONEY 18409 8.18 14.03 5.77 37 TR_MAX_INTL_RELAY 17857 7.51 13.61 4.99 38 TR_XM_SpammyWords4 16558 6.40 12.62 3.84 39 TR_XM_SpammyRelay 15816 4.68 12.05 1.64 40 BOTNET_IPINHOSTNAME 15232 5.36 11.61 2.78 41 FSL_BULK_SIG 13403 7.82 10.22 6.83 42 BOTNET 13340 3.81 10.17 1.19 43 XM_Evil_Numbers_Gen 13196 9.65 10.06 9.49 44 TR_XM_SpammyWords2 13104 3.26 9.99 0.49 45 XM_B_Phish_Phrases 12872 6.21 9.81 4.72 46 TR_XM_UnparsRelay 11509 3.67 8.77 1.56 47 BAYES_80 11248 4.64 8.57 3.02 48 BAYES_60 11000 6.81 8.38 6.16 49 T_SCC_BODY_TEXT_LINE 10347 8.32 7.89 8.49 50 LotsOfNums_01 9500 8.93 7.24 9.63 51 XM_Body_Dirty_Words 9094 3.53 6.93 2.13 52 UNTRUSTED_Relay 8879 2.97 6.77 1.40 53 MPART_ALT_DIFF 8812 4.79 6.72 4.00 54 RCVD_IN_BL_SPAMCOP_NET 8335 2.13 6.35 0.39 55 XMSubMetaSx_00 8266 4.56 6.30 3.84 56 HTML_IMAGE_RATIO_02 8215 4.79 6.26 4.18 57 RELAYCOUNTRY_CA 8129 2.47 6.20 0.94 58 XM_B_PhoneNumber 8106 10.22 6.18 11.88 59 XM_UncommonTLD01 7674 4.57 5.85 4.04 60 XM_H_Long_From01 7370 5.42 5.62 5.34 61 DKIM_INVALID 6956 3.52 5.30 2.79 62 HTML_IMAGE_RATIO_04 6780 3.69 5.17 3.08 63 XM_B_Investor 6415 2.56 4.89 1.60 64 TR_XM_SPAMCOP 6368 1.57 4.85 0.22 65 TR_XM_PhishingBody 6368 2.43 4.85 1.44 66 BAYES_95 6265 2.79 4.78 1.97 67 TR_XM_SpammyWords5 6207 2.28 4.73 1.28 68 XMStrtUSub 5974 4.32 4.55 4.23 69 XM_H_GMP 5944 5.68 4.53 6.15 70 XM_B_SpammyTLD 5776 3.16 4.40 2.64 71 XMNumbers 5621 5.25 4.28 5.65 72 XMSexyCombo_05 5589 2.31 4.26 1.51 73 TooManyTo_001 5337 8.89 4.07 10.87 74 T_XMDrugObfuBody_08 5225 2.32 3.98 1.63 75 T_XMDrugObfuBody_14 5212 2.56 3.97 1.97 76 TM2_M_VERY_LONG_WORD 5184 4.68 3.95 4.98 77 MIME_HTML_ONLY_MULTI 4976 2.76 3.79 2.34 78 MIME_QP_LONG_LINE 4826 4.29 3.68 4.54 79 HTML_IMAGE_RATIO_06 4651 3.16 3.54 3.01 80 XM_UB50 4643 1.63 3.54 0.85 81 XM_B_SpammyWords4 4600 1.52 3.51 0.70 82 XM_CamelCaseFrm001 4498 2.82 3.43 2.57 83 MIME_HTML_MOSTLY 4493 2.40 3.42 1.97 84 XM_SPF_SoftFail 4437 1.99 3.38 1.41 85 XMDiploma_00 4335 2.12 3.30 1.64 86 XM_OfRef6 4112 1.71 3.13 1.12 87 HTML_IMAGE_RATIO_08 3995 2.05 3.04 1.64 88 XM_B_Unsub2 3956 1.79 3.02 1.28 89 RCVD_IN_MSPIKE_WL 3887 4.55 2.96 5.21 90 RCVD_IN_MSPIKE_H3 3887 4.55 2.96 5.20 91 TM2_M_URI_OPT_OUT 3688 1.94 2.81 1.59 92 TR_XM_NoHeaderRelay 3650 0.95 2.78 0.20 93 RELAYCOUNTRY_AU 3621 1.13 2.76 0.46 94 ALL_TRUSTED 3536 11.00 2.70 14.42 95 XM_URI_RBL 3374 0.95 2.57 0.27 96 T_TooManySym_01 3294 5.12 2.51 6.19 97 XMBody_17 3278 1.02 2.50 0.41 98 XM_B_URI_Unicode 3183 1.96 2.43 1.76 99 RCVD_IN_VALIDITY_SAFE 3179 3.04 2.42 3.30 100 MAILING_LIST_MULTI 3039 2.98 2.32 3.25 101 XMBrknScrpt_02 2900 1.18 2.21 0.76 102 FROM_EXCESS_BASE64 2879 2.05 2.19 1.99 103 SUBJ_ALL_CAPS 2871 1.77 2.19 1.60 104 T_XMHurry_00 2867 1.18 2.19 0.76 105 TR_XM_INV_DKIM 2841 0.76 2.17 0.17 106 HTML_MIME_NO_HTML_TAG 2837 2.67 2.16 2.89 107 BAYES_40 2801 4.95 2.13 6.12 108 SpammyFromTLD_02 2718 0.75 2.07 0.20 109 KHOP_HELO_FCRDNS 2718 2.96 2.07 3.33 110 RCVD_IN_VALIDITY_RPBL 2610 0.63 1.99 0.07 111 USER_IN_DEF_DKIM_WL 2602 8.74 1.98 11.52 112 TR_MetaPhish_Combo_01 2587 1.57 1.97 1.41 113 T_FILL_THIS_FORM_SHORT 2579 1.28 1.97 0.99 114 SHORTCIRCUIT 2473 0.55 1.88 0.00 115 RCVD_IN_ZEN_LASTEXTERNAL 2473 0.55 1.88 0.00 116 BAYES_20 2361 3.50 1.80 4.21 117 T_XMDrugObfuBody_00 2352 1.08 1.79 0.79 118 XMStockSpam_06 2350 1.34 1.79 1.15 119 T_REMOTE_IMAGE 2334 3.07 1.78 3.60 120 DIET_1 2289 0.68 1.74 0.24 121 XMGenDplmaNmb 2249 1.23 1.71 1.03 122 XM_DK_Undo_01 2190 1.88 1.67 1.96 123 RCVD_IN_VALIDITY_CERTIFIED 2184 2.40 1.66 2.70 124 TR_LOTS_OF_MONEY3 2159 0.68 1.65 0.28 125 TR_LOTS_OF_MONEY2 2139 0.68 1.63 0.28 126 T_MONEY_PERCENT 2139 0.68 1.63 0.28 127 SpammyFromTLD_01 2107 1.07 1.61 0.85 128 TR_XM_PHPDW 1975 0.58 1.51 0.20 129 TR_XM_PHPForged 1944 0.58 1.48 0.20 130 TR_XM_FormFill2 1919 0.57 1.46 0.20 131 ANY_BOUNCE_MESSAGE 1918 5.36 1.46 6.97 132 BOUNCE_MESSAGE 1918 5.36 1.46 6.97 133 HTTPS_HTTP_MISMATCH 1918 0.96 1.46 0.76 134 XM_B_DNDMA 1913 0.73 1.46 0.43 135 URI_HEX 1889 1.22 1.44 1.13 136 XM_H_PHPOS 1887 0.56 1.44 0.19 137 XM_B_COPY_HTML 1887 0.79 1.44 0.53 138 HTML_FONT_TINY_NORDNS 1813 0.44 1.38 0.05 139 HTML_TAG_BALANCE_BODY 1782 0.81 1.36 0.58 140 XMPhish30 1750 0.72 1.33 0.46 141 XM_SendGrid 1737 1.64 1.32 1.77 142 DKIM_ADSP_CUSTOM_MED 1735 0.99 1.32 0.85 143 THIS_AD 1712 0.70 1.30 0.45 144 TR_XM_RelayPhish 1704 0.44 1.30 0.09 145 XMSubMetaI_00 1684 0.62 1.28 0.35 146 XM_ProductURIs 1667 0.66 1.27 0.41 147 LongTLD 1665 0.68 1.27 0.43 148 RELAYCOUNTRY_FR 1659 0.53 1.26 0.22 149 RCVD_IN_PBL 1651 0.88 1.26 0.73 150 TR_XM_SEO4 1591 0.45 1.21 0.14 151 XM_H_Long_From02 1590 0.87 1.21 0.73 152 XM_B_SEO 1569 0.52 1.20 0.25 153 URI_TRY_3LD 1559 0.80 1.19 0.64 154 RCVD_IN_PSBL 1530 0.54 1.17 0.28 155 URI_NOVOWEL 1520 1.42 1.16 1.52 156 XM_B_Phish66 1516 0.59 1.16 0.36 157 BOTNET_NORDNS 1515 0.35 1.15 0.02 158 TR_XM_InvalidRelay 1499 0.34 1.14 0.01 159 MPART_ALT_DIFF_COUNT 1483 0.68 1.13 0.49 160 XMSubMetaSxObfu_03 1463 0.99 1.12 0.93 161 XM_B_COVIDMETA 1454 0.52 1.11 0.28 162 RCVD_IN_IADB_LISTED 1436 2.55 1.09 3.15 163 NML_ADSP_CUSTOM_MED 1420 0.74 1.08 0.60 164 XM_DIRTYINTL 1416 0.36 1.08 0.07 165 XMHTML_After_End 1370 0.57 1.04 0.38 166 T_Symld_Words_02 1363 0.78 1.04 0.67 167 TR_Symld_Words 1351 1.51 1.03 1.70 168 HTML_IMAGE_ONLY_20 1334 0.66 1.02 0.51 169 RCVD_IN_SORBS_DUL 1331 0.31 1.01 0.02 170 MIME_CHARSET_FARAWAY 1322 1.85 1.01 2.19 171 XM_PDF 1289 3.52 0.98 4.57 172 DKIM_ADSP_NXDOMAIN 1277 0.53 0.97 0.35 173 XMPhish08 1275 0.39 0.97 0.15 174 TM2_M_OBFU_COMMENT 1269 0.50 0.97 0.31 175 XM_UB60 1256 0.32 0.96 0.06 176 XMNoVowels 1254 1.13 0.96 1.21 177 TR_XM_Base64_M1 1242 0.78 0.95 0.72 178 SHOPIFY_IMG_NOT_RCVD_SFY 1237 0.44 0.94 0.24 179 FORGED_GMAIL_RCVD 1229 0.62 0.94 0.49 180 RCVD_IN_IADB_SPF 1228 2.22 0.94 2.74 181 HTML_FONT_FACE_BAD 1219 0.51 0.93 0.33 182 MISSING_HEADERS 1214 0.59 0.93 0.46 183 RDNS_DYNAMIC 1211 0.43 0.92 0.23 184 TR_Mismatch_TLD_02 1206 0.32 0.92 0.07 185 XMReplyNow 1201 0.42 0.92 0.21 186 RCVD_IN_IADB_DK 1193 1.95 0.91 2.38 187 XM_H_Undi_Recip 1189 0.45 0.91 0.27 188 RCVD_IN_IADB_SENDERID 1182 1.99 0.90 2.44 189 MultiRelay_CC 1181 0.39 0.90 0.17 190 XM_UB99 1169 0.26 0.89 0.00 191 XMBdyGiftCard01 1168 0.68 0.89 0.60 192 TVD_RCVD_IP 1152 0.79 0.88 0.76 193 XM_H_PHPMailer 1148 0.82 0.88 0.80 194 DEAR_FRIEND 1143 0.29 0.87 0.05 195 XMClaimOffer 1090 0.29 0.83 0.07 196 XMSexyCombo_01 1087 0.33 0.83 0.12 197 XM_B_REG_HTML 1087 0.36 0.83 0.17 198 T_STY_INVIS_DIRECT 1075 0.56 0.82 0.46 199 URIBL_BLACK 1073 0.27 0.82 0.04 200 TR_XM_Spammywords 1069 0.42 0.81 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 278044 89.41 94.27 87.41 2 RELAYCOUNTRY_US 263472 82.33 81.11 82.83 3 DKIM_SIGNED 228361 76.52 87.97 71.79 4 XM_DK_Pass 223506 74.14 83.52 70.27 5 DKIM_VALID 219481 72.99 82.67 69.00 6 XM_B_Unicode 217781 73.08 84.26 68.47 7 DCC_CHECK_NEGATIVE 206937 53.06 23.98 65.06 8 BAYES_50 191583 54.88 41.92 60.23 9 DKIM_VALID_AU 177680 58.72 65.65 55.86 10 XMListUnsubscribeExists 139859 50.81 67.39 43.97 11 XM_B_SpammyWords 135667 50.53 69.65 42.65 12 XM_B_Unicode3 125418 42.42 49.68 39.43 13 DCC_CHECK 110978 46.34 74.11 34.89 14 T_TM2_M_HEADER_IN_MSG 108828 30.95 23.05 34.21 15 RCVD_IN_MSPIKE_H2 105789 34.69 38.15 33.26 16 DKIM_VALID_EF 94360 29.54 29.25 29.67 17 HTML_FONT_LOW_CONTRAST 88169 30.21 36.25 27.72 18 LOC_TINY_FONT_1 78540 31.46 47.87 24.69 19 FVGT_m_MULTI_ODD 77146 26.03 30.35 24.25 20 XMSubLong 73863 23.93 25.66 23.22 21 MIME_HTML_ONLY 68204 23.94 30.00 21.44 22 T_KAM_HTML_FONT_INVALID 64244 22.82 29.19 20.20 23 XM_B_SpammyWords2 54808 24.01 40.44 17.23 24 ALL_TRUSTED 45881 11.00 2.70 14.42 25 BAYES_00 40368 9.21 0.79 12.69 26 TR_XM_DK_Unsub 39880 14.90 20.62 12.54 27 XM_Multi_Part_URI 38950 14.62 20.36 12.25 28 UNPARSEABLE_RELAY 37866 13.39 16.97 11.90 29 XM_B_PhoneNumber 37801 10.22 6.18 11.88 30 USER_IN_DEF_DKIM_WL 36649 8.74 1.98 11.52 31 TooManyTo_001 34585 8.89 4.07 10.87 32 XM_B_Unsub 34411 12.76 17.46 10.82 33 LotsOfNums_01 30616 8.93 7.24 9.63 34 XM_Evil_Numbers_Gen 30176 9.65 10.06 9.49 35 T_SCC_BODY_TEXT_LINE 27019 8.32 7.89 8.49 36 ANY_BOUNCE_MESSAGE 22177 5.36 1.46 6.97 37 BOUNCE_MESSAGE 22173 5.36 1.46 6.97 38 FSL_BULK_SIG 21724 7.82 10.22 6.83 39 TR_XM_DK_Bayes 21689 4.99 0.54 6.82 40 TR_XM_DK_Bayes1 21121 4.86 0.53 6.64 41 TR_XM_BayesUnsub 20594 9.45 16.68 6.47 42 IN_ZIMBRA_NJ_WHITELIST 20329 4.56 0.14 6.39 43 XM_DKIMWhitelistDomains 20176 4.52 0.12 6.34 44 T_TooManySym_01 19695 5.12 2.51 6.19 45 BAYES_60 19592 6.81 8.38 6.16 46 XM_H_GMP 19557 5.68 4.53 6.15 47 BAYES_40 19459 4.95 2.13 6.12 48 LOTS_OF_MONEY 18344 8.18 14.03 5.77 49 XMNumbers 17985 5.25 4.28 5.65 50 TR_XM_DK_Bayes2 17869 4.11 0.47 5.62 51 XM_H_Long_From01 16978 5.42 5.62 5.34 52 TooManyTo_002 16728 3.94 0.74 5.26 53 RCVD_IN_MSPIKE_WL 16563 4.55 2.96 5.21 54 RCVD_IN_MSPIKE_H3 16547 4.55 2.96 5.20 55 TR_MAX_INTL_RELAY 15882 7.51 13.61 4.99 56 TM2_M_VERY_LONG_WORD 15844 4.68 3.95 4.98 57 XM_B_Phish_Phrases 15012 6.21 9.81 4.72 58 XM_PDF 14523 3.52 0.98 4.57 59 MIME_QP_LONG_LINE 14434 4.29 3.68 4.54 60 HTML_IMAGE_ONLY_32 14147 3.29 0.50 4.45 61 XM_B_SpammyWords3 13790 7.79 16.16 4.34 62 XMStrtUSub 13442 4.32 4.55 4.23 63 BAYES_20 13382 3.50 1.80 4.21 64 HTML_IMAGE_RATIO_02 13285 4.79 6.26 4.18 65 XM_DK_Undo_02 13214 13.86 37.40 4.15 66 XM_UncommonTLD01 12856 4.57 5.85 4.04 67 MPART_ALT_DIFF 12717 4.79 6.72 4.00 68 XMSubMetaSx_00 12223 4.56 6.30 3.84 69 TR_XM_SpammyWords4 12217 6.40 12.62 3.84 70 RELAYCOUNTRY_META 11889 7.53 16.72 3.74 71 MAY_BE_FORGED 11810 2.82 0.66 3.71 72 T_REMOTE_IMAGE 11437 3.07 1.78 3.60 73 T_TooManySym_02 10976 2.64 0.69 3.45 74 KHOP_HELO_FCRDNS 10595 2.96 2.07 3.33 75 RCVD_IN_VALIDITY_SAFE 10481 3.04 2.42 3.30 76 MAILING_LIST_MULTI 10342 2.98 2.32 3.25 77 RCVD_IN_IADB_LISTED 10010 2.55 1.09 3.15 78 BAYES_99 9995 10.72 29.08 3.14 79 HTML_IMAGE_RATIO_04 9794 3.69 5.17 3.08 80 BAYES_80 9597 4.64 8.57 3.02 81 HTML_IMAGE_RATIO_06 9563 3.16 3.54 3.01 82 HTML_MIME_NO_HTML_TAG 9180 2.67 2.16 2.89 83 DKIM_INVALID 8880 3.52 5.30 2.79 84 BOTNET_IPINHOSTNAME 8846 5.36 11.61 2.78 85 RCVD_IN_IADB_SPF 8724 2.22 0.94 2.74 86 RCVD_IN_VALIDITY_CERTIFIED 8595 2.40 1.66 2.70 87 XM_B_FormFill 8493 1.90 0.02 2.67 88 XM_B_SpammyTLD 8405 3.16 4.40 2.64 89 XM_CamelCaseFrm001 8172 2.82 3.43 2.57 90 BAYES_05 7820 1.93 0.66 2.46 91 RCVD_IN_IADB_SENDERID 7771 1.99 0.90 2.44 92 BAYES_999 7621 8.31 22.64 2.40 93 RCVD_IN_IADB_DK 7570 1.95 0.91 2.38 94 MIME_HTML_ONLY_MULTI 7433 2.76 3.79 2.34 95 INVALID_MSGID 7349 1.72 0.29 2.31 96 MIME_CHARSET_FARAWAY 6971 1.85 1.01 2.19 97 XM_Body_Dirty_Words 6781 3.53 6.93 2.13 98 RCVD_IN_IADB_VOUCHED 6641 1.60 0.42 2.09 99 CHARSET_FARAWAY_HEADER 6548 1.67 0.74 2.06 100 FROM_EXCESS_BASE64 6328 2.05 2.19 1.99 101 BAYES_95 6278 2.79 4.78 1.97 102 T_XMDrugObfuBody_14 6278 2.56 3.97 1.97 103 MIME_HTML_MOSTLY 6269 2.40 3.42 1.97 104 TR_XM_DKIM_Undo 6250 9.36 27.30 1.96 105 XM_DK_Undo_01 6245 1.88 1.67 1.96 106 TO_MALFORMED 6243 1.40 0.05 1.96 107 TooManyTo_003 6192 1.57 0.65 1.95 108 XM_SendGrid 5621 1.64 1.32 1.77 109 XM_B_URI_Unicode 5604 1.96 2.43 1.76 110 TR_Symld_Words 5419 1.51 1.03 1.70 111 TR_XM_SpammyRelay 5230 4.68 12.05 1.64 112 HTML_IMAGE_RATIO_08 5227 2.05 3.04 1.64 113 XMDiploma_00 5211 2.12 3.30 1.64 114 T_XMDrugObfuBody_08 5178 2.32 3.98 1.63 115 SUBJ_ALL_CAPS 5087 1.77 2.19 1.60 116 XM_B_Investor 5081 2.56 4.89 1.60 117 TM2_M_URI_OPT_OUT 5043 1.94 2.81 1.59 118 TR_XM_UnparsRelay 4958 3.67 8.77 1.56 119 URI_NOVOWEL 4838 1.42 1.16 1.52 120 XMSexyCombo_05 4800 2.31 4.26 1.51 121 TooManyTo_004 4767 1.23 0.58 1.50 122 RCVD_IN_IADB_OPTIN 4655 1.10 0.21 1.46 123 XMLngstWrd_00 4631 1.18 0.53 1.46 124 T_TooManySym_03 4573 1.07 0.16 1.44 125 TR_XM_PhishingBody 4565 2.43 4.85 1.44 126 XM_SPF_SoftFail 4498 1.99 3.38 1.41 127 TR_MetaPhish_Combo_01 4481 1.57 1.97 1.41 128 UNTRUSTED_Relay 4445 2.97 6.77 1.40 129 XMCapTrack 4256 1.10 0.53 1.34 130 IN_HORDE_ADDRESS_BOOK 4102 0.94 0.10 1.29 131 XM_B_Unsub2 4087 1.79 3.02 1.28 132 HELO_NODOT 4066 1.03 0.44 1.28 133 TR_XM_SpammyWords5 4059 2.28 4.73 1.28 134 HELO_NO_DOMAIN 4059 1.03 0.44 1.28 135 TR_DCC_Bayes_99 3997 6.79 20.19 1.26 136 XM_GoogleGroups 3878 1.09 0.76 1.22 137 XMNoVowels 3845 1.13 0.96 1.21 138 BOTNET 3780 3.81 10.17 1.19 139 XMStockSpam_06 3670 1.34 1.79 1.15 140 TooManyTo_005 3664 0.96 0.49 1.15 141 XMGappySubj_01 3628 0.87 0.21 1.14 142 URI_HEX 3584 1.22 1.44 1.13 143 XM_OfRef6 3570 1.71 3.13 1.12 144 TR_XM_DK_SendGrid 3399 0.99 0.81 1.07 145 XMGenDplmaNmb 3283 1.23 1.71 1.03 146 TVD_SPACE_RATIO 3274 0.80 0.24 1.03 147 XM_ShortIntro_01 3245 0.85 0.45 1.02 148 T_FILL_THIS_FORM_SHORT 3152 1.28 1.97 0.99 149 RELAYCOUNTRY_CA 2988 2.47 6.20 0.94 150 XMSubMetaSxObfu_03 2968 0.99 1.12 0.93 151 SpammyFromTLD_01 2716 1.07 1.61 0.85 152 DKIM_ADSP_CUSTOM_MED 2703 0.99 1.32 0.85 153 XM_UB50 2701 1.63 3.54 0.85 154 XM_H_PHPMailer 2539 0.82 0.88 0.80 155 T_XMDrugObfuBody_00 2520 1.08 1.79 0.79 156 XMBrknScrpt_02 2419 1.18 2.21 0.76 157 T_XMHurry_00 2415 1.18 2.19 0.76 158 HTTPS_HTTP_MISMATCH 2415 0.96 1.46 0.76 159 TVD_RCVD_IP 2412 0.79 0.88 0.76 160 XM_H_Long_From02 2325 0.87 1.21 0.73 161 RCVD_IN_PBL 2313 0.88 1.26 0.73 162 TR_XM_Base64_M1 2282 0.78 0.95 0.72 163 XM_B_SpammyWords4 2237 1.52 3.51 0.70 164 MSGID_FROM_MTA_HEADER 2196 0.54 0.16 0.69 165 XMGappySubj_02 2138 0.48 0.03 0.67 166 T_Symld_Words_02 2133 0.78 1.04 0.67 167 XMSlimDrugH 2081 0.63 0.57 0.65 168 T_TVD_MIME_NO_HEADERS 2067 0.47 0.03 0.65 169 URI_TRY_3LD 2047 0.80 1.19 0.64 170 T_OBFU_PDF_ATTACH 2002 0.52 0.25 0.63 171 NML_ADSP_CUSTOM_MED 1924 0.74 1.08 0.60 172 XMBdyGiftCard01 1903 0.68 0.89 0.60 173 HTML_TAG_BALANCE_BODY 1852 0.81 1.36 0.58 174 RELAYCOUNTRY_GB 1754 0.63 0.81 0.55 175 FROM_GOV_DKIM_AU 1741 0.42 0.11 0.55 176 TO_NO_BRKTS_HTML_ONLY 1710 0.61 0.79 0.54 177 FILL_THIS_FORM 1704 0.46 0.28 0.54 178 XM_B_COPY_HTML 1674 0.79 1.44 0.53 179 XMBSHREFv2 1624 0.46 0.34 0.51 180 HTML_IMAGE_ONLY_20 1618 0.66 1.02 0.51 181 T_TooManySym_04 1603 0.36 0.02 0.50 182 FORGED_GMAIL_RCVD 1573 0.62 0.94 0.49 183 MPART_ALT_DIFF_COUNT 1565 0.68 1.13 0.49 184 TR_XM_SpammyWords2 1562 3.26 9.99 0.49 185 XMPhish30 1463 0.72 1.33 0.46 186 T_STY_INVIS_DIRECT 1462 0.56 0.82 0.46 187 RELAYCOUNTRY_AU 1459 1.13 2.76 0.46 188 MISSING_HEADERS 1449 0.59 0.93 0.46 189 HELO_MISC_IP 1434 0.33 0.04 0.45 190 THIS_AD 1432 0.70 1.30 0.45 191 XMLngstWrd_01 1382 0.42 0.40 0.43 192 LongTLD 1371 0.68 1.27 0.43 193 XMBody_95 1368 0.35 0.15 0.43 194 XM_B_DNDMA 1367 0.73 1.46 0.43 195 XMDateMe_00 1345 0.42 0.42 0.42 196 XMMoneyMeta_00 1336 0.48 0.63 0.42 197 HTML_EXTRA_CLOSE 1334 0.30 0.02 0.42 198 TM2_M_BODY_EMPTY 1329 0.32 0.08 0.42 199 RELAYCOUNTRY_NL 1314 0.38 0.29 0.41 200 XMBody_17 1306 1.02 2.50 0.41 ----------------------------------------------------------------------