Email: 448291 Autolearn: 0 AvgScore: 4.95 AvgScanTime: 1.34 sec Spam: 133804 Autolearn: 0 AvgScore: 14.40 AvgScanTime: 1.51 sec Ham: 314487 Autolearn: 0 AvgScore: 0.92 AvgScanTime: 1.27 sec Time Spent Running SA: 166.90 hours Time Spent Processing Spam: 56.28 hours Time Spent Processing Ham: 110.61 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 131510 99.01 98.29 99.32 2 HTML_MESSAGE 127491 89.34 95.28 86.81 3 DKIM_SIGNED 120102 80.53 89.76 76.61 4 XM_DK_Pass 114690 78.63 85.71 75.61 5 DKIM_VALID 113580 77.63 84.89 74.54 6 XM_B_Unicode 113561 74.97 84.87 70.75 7 RELAYCOUNTRY_US 109633 81.61 81.94 81.48 8 DCC_CHECK 99657 50.96 74.48 40.95 9 XM_B_SpammyWords 93867 52.65 70.15 45.20 10 XMListUnsubscribeExists 89856 54.61 67.15 49.27 11 DKIM_VALID_AU 89542 62.37 66.92 60.44 12 XM_B_Unicode3 66518 43.38 49.71 40.68 13 LOC_TINY_FONT_1 64371 34.79 48.11 29.12 14 BAYES_50 54955 54.81 41.07 60.65 15 XM_DK_Undo_02 54564 15.52 40.78 4.77 16 XM_B_SpammyWords2 54504 25.86 40.73 19.53 17 HTML_FONT_LOW_CONTRAST 49784 30.98 37.21 28.33 18 FVGT_m_MULTI_ODD 46078 28.49 34.44 25.95 19 DKIM_VALID_EF 41850 31.16 31.28 31.12 20 BAYES_99 40906 11.48 30.57 3.36 21 MIME_HTML_ONLY 40324 22.87 30.14 19.78 22 TR_XM_DKIM_Undo 40185 10.42 30.03 2.07 23 T_KAM_HTML_FONT_INVALID 38956 24.55 29.11 22.61 24 T_TM2_M_HEADER_IN_MSG 33000 29.15 24.66 31.06 25 XMSubLong 32789 24.40 24.51 24.36 26 DCC_CHECK_NEGATIVE 32091 48.54 23.98 58.99 27 BAYES_999 31484 8.76 23.53 2.48 28 TR_XM_DK_Unsub 30134 16.78 22.52 14.34 29 XM_Multi_Part_URI 28945 16.96 21.63 14.97 30 TR_DCC_Bayes_99 28263 7.18 21.12 1.25 31 RCVD_IN_MSPIKE_H2 27145 18.58 20.29 17.85 32 XM_B_Unsub 26842 13.17 20.06 10.24 33 TR_XM_BayesUnsub 25725 11.26 19.23 7.87 34 RELAYCOUNTRY_META 22988 7.73 17.18 3.71 35 UNPARSEABLE_RELAY 22822 13.48 17.06 11.96 36 XM_B_SpammyWords3 19314 8.03 14.43 5.31 37 TR_MAX_INTL_RELAY 19151 8.65 14.31 6.24 38 LOTS_OF_MONEY 18002 8.13 13.45 5.86 39 BOTNET_IPINHOSTNAME 17244 5.93 12.89 2.97 40 TR_XM_SpammyRelay 16811 5.06 12.56 1.87 41 TR_XM_SpammyWords4 16415 6.45 12.27 3.97 42 TR_XM_SpammyWords2 14972 3.76 11.19 0.60 43 XM_Evil_Numbers_Gen 14845 9.63 11.09 9.00 44 FSL_BULK_SIG 14570 9.29 10.89 8.61 45 BOTNET 13430 3.87 10.04 1.24 46 XM_B_Phish_Phrases 12558 6.90 9.39 5.84 47 TR_XM_UnparsRelay 12455 4.04 9.31 1.80 48 RCVD_IN_MSPIKE_WL 12215 15.39 9.13 18.06 49 RCVD_IN_BL_SPAMCOP_NET 11905 3.09 8.90 0.62 50 BAYES_80 11894 5.37 8.89 3.87 51 BAYES_60 10276 7.28 7.68 7.10 52 LotsOfNums_01 9443 7.77 7.06 8.08 53 RELAYCOUNTRY_CA 9229 2.59 6.90 0.76 54 HTML_IMAGE_RATIO_02 9015 5.00 6.74 4.26 55 XMSubMetaSx_00 8846 4.55 6.61 3.68 56 XM_Body_Dirty_Words 8722 3.91 6.52 2.81 57 XM_B_PhoneNumber 8590 9.65 6.42 11.02 58 MPART_ALT_DIFF 8317 5.34 6.22 4.97 59 UNTRUSTED_Relay 7740 2.90 5.78 1.67 60 XM_UncommonTLD01 7584 4.62 5.67 4.17 61 XM_H_Long_From01 7583 5.71 5.67 5.73 62 HTML_IMAGE_RATIO_04 7421 4.61 5.55 4.21 63 XMStrtUSub 7165 4.94 5.35 4.77 64 BAYES_95 6834 3.18 5.11 2.36 65 TR_XM_PhishingBody 6782 2.76 5.07 1.78 66 XM_B_Investor 6770 2.78 5.06 1.80 67 DKIM_INVALID 6522 2.91 4.87 2.07 68 RCVD_IN_MSPIKE_H3 6456 7.04 4.82 7.98 69 RCVD_IN_MSPIKE_BL 6112 2.00 4.57 0.91 70 TR_XM_MSPIKECOMBO 6111 2.00 4.57 0.91 71 XM_H_GMP 6063 5.48 4.53 5.88 72 TooManyTo_001 5754 7.46 4.30 8.81 73 TM2_M_VERY_LONG_WORD 5468 2.14 4.09 1.31 74 TR_XM_SpammyWords5 5307 2.24 3.97 1.51 75 XMSexyCombo_05 5212 2.08 3.90 1.31 76 TR_XM_SPAMCOP 5134 1.26 3.84 0.17 77 T_XMDrugObfuBody_14 5118 2.51 3.82 1.94 78 XM_B_SpammyTLD 5103 3.10 3.81 2.79 79 XMNumbers 5073 3.84 3.79 3.85 80 T_XMDrugObfuBody_08 5017 2.22 3.75 1.56 81 MIME_HTML_MOSTLY 4936 2.94 3.69 2.62 82 XM_CamelCaseFrm001 4809 2.76 3.59 2.40 83 HTML_IMAGE_RATIO_06 4607 3.09 3.44 2.94 84 XM_SPF_SoftFail 4533 2.05 3.39 1.48 85 TR_XM_SpammyWords3 4443 1.29 3.32 0.42 86 XM_B_Unsub2 4283 2.16 3.20 1.72 87 MIME_QP_LONG_LINE 4246 4.72 3.17 5.37 88 MIME_HTML_ONLY_MULTI 4243 2.84 3.17 2.70 89 XM_OfRef6 4232 1.62 3.16 0.97 90 HTML_IMAGE_RATIO_08 4086 2.65 3.05 2.48 91 TR_XM_NoHeaderRelay 4049 1.06 3.03 0.23 92 TM2_M_URI_OPT_OUT 4002 2.21 2.99 1.87 93 XM_B_SpammyWords4 3997 1.69 2.99 1.13 94 RELAYCOUNTRY_AU 3880 1.27 2.90 0.58 95 XM_URI_RBL 3861 1.12 2.89 0.37 96 XMBody_17 3812 1.16 2.85 0.45 97 XM_UB50 3793 1.60 2.83 1.08 98 XM_B_URI_Unicode 3761 2.21 2.81 1.95 99 XM_SendGrid 3690 2.98 2.76 3.07 100 RCVD_IN_VALIDITY_RPBL 3560 0.86 2.66 0.09 101 FROM_EXCESS_BASE64 3460 2.07 2.59 1.85 102 USER_IN_DEF_DKIM_WL 3381 9.99 2.53 13.17 103 XMDiploma_00 3376 1.85 2.52 1.56 104 RCVD_IN_MSPIKE_L3 3338 1.21 2.49 0.67 105 T_TooManySym_01 3310 5.05 2.47 6.14 106 ALL_TRUSTED 3288 11.56 2.46 15.44 107 RCVD_IN_MSPIKE_H4 3159 3.45 2.36 3.91 108 MAILING_LIST_MULTI 2880 2.89 2.15 3.21 109 RCVD_IN_VALIDITY_SAFE 2855 3.62 2.13 4.25 110 T_FILL_THIS_FORM_SHORT 2809 1.24 2.10 0.87 111 SUBJ_ALL_CAPS 2734 1.60 2.04 1.41 112 T_XMHurry_00 2701 0.96 2.02 0.50 113 XM_H_Long_From02 2676 1.22 2.00 0.88 114 HTML_MIME_NO_HTML_TAG 2659 2.30 1.99 2.43 115 BAYES_40 2647 4.46 1.98 5.52 116 TR_XM_INV_DKIM 2642 0.62 1.97 0.04 117 RCVD_IN_MSPIKE_H5 2600 4.90 1.94 6.16 118 XMStockSpam_06 2468 1.07 1.84 0.74 119 XMBrknScrpt_02 2452 1.23 1.83 0.98 120 SpammyFromTLD_01 2405 1.15 1.80 0.87 121 SpammyFromTLD_02 2370 0.85 1.77 0.46 122 RCVD_IN_VALIDITY_CERTIFIED 2281 2.91 1.70 3.43 123 TR_XM_DK_SendGrid 2247 1.93 1.68 2.04 124 SCC_BODY_URI_ONLY 2221 2.16 1.66 2.37 125 BAYES_20 2193 3.17 1.64 3.83 126 TR_LOTS_OF_MONEY3 2177 0.72 1.63 0.33 127 XM_DK_Undo_01 2167 1.87 1.62 1.98 128 XMGenDplmaNmb 2126 1.13 1.59 0.94 129 RCVD_IN_MSPIKE_L4 2112 0.63 1.58 0.23 130 XM_B_COPY_HTML 2111 0.91 1.58 0.62 131 T_XMDrugObfuBody_00 2084 1.13 1.56 0.95 132 XMPhish30 2060 0.84 1.54 0.54 133 XMPhish14 2047 0.78 1.53 0.46 134 SHORTCIRCUIT 2033 0.45 1.52 0.00 135 RCVD_IN_ZEN_LASTEXTERNAL 2033 0.45 1.52 0.00 136 RDNS_DYNAMIC 1992 0.56 1.49 0.16 137 HK_RANDOM_REPLYTO 1978 0.50 1.48 0.09 138 T_REMOTE_IMAGE 1977 2.93 1.48 3.55 139 TR_LOTS_OF_MONEY2 1975 0.57 1.48 0.18 140 T_MONEY_PERCENT 1975 0.57 1.48 0.18 141 TR_XM_MSPIKECOMBO2 1969 0.46 1.47 0.03 142 URI_TRY_3LD 1946 0.81 1.45 0.54 143 URI_NOVOWEL 1946 1.45 1.45 1.45 144 PDS_RDNS_DYNAMIC_FP 1946 0.47 1.45 0.04 145 BOTNET_NORDNS 1884 0.43 1.41 0.01 146 XMBdyGiftCard01 1878 1.04 1.40 0.88 147 RCVD_IN_PSBL 1870 0.74 1.40 0.45 148 KHOP_HELO_FCRDNS 1814 1.46 1.36 1.50 149 HTTPS_HTTP_MISMATCH 1813 0.91 1.35 0.72 150 DIET_1 1793 0.61 1.34 0.30 151 RCVD_IN_PBL 1789 0.92 1.34 0.75 152 URI_HEX 1761 1.37 1.32 1.40 153 RCVD_IN_IADB_LISTED 1761 3.20 1.32 4.00 154 XM_B_Phish66 1682 0.64 1.26 0.38 155 TR_XM_PHPForged 1665 0.84 1.24 0.67 156 TR_XM_PHPDW 1646 0.84 1.23 0.68 157 TVD_RCVD_IP 1643 1.01 1.23 0.92 158 TR_XM_FormFill2 1628 0.84 1.22 0.68 159 TR_XM_Base64_M1 1616 0.84 1.21 0.68 160 XM_B_DNDMA 1599 0.69 1.20 0.47 161 XM_H_PHPOS 1592 0.82 1.19 0.66 162 XM_B_SEO 1588 0.52 1.19 0.24 163 RCVD_IN_IADB_SPF 1575 2.81 1.18 3.51 164 TR_MetaPhish_Combo_01 1531 1.38 1.14 1.49 165 HTML_IMAGE_ONLY_20 1521 0.57 1.14 0.34 166 XMBody_78 1514 0.54 1.13 0.30 167 RELAYCOUNTRY_FR 1508 0.51 1.13 0.25 168 RCVD_IN_IADB_DK 1507 2.46 1.13 3.03 169 RCVD_IN_IADB_SENDERID 1487 2.53 1.11 3.13 170 XMSubMetaI_00 1484 0.79 1.11 0.65 171 TR_XM_RelayPhish 1451 0.37 1.08 0.07 172 TM2_M_OBFU_COMMENT 1435 0.53 1.07 0.30 173 DKIM_ADSP_CUSTOM_MED 1427 0.90 1.07 0.83 174 TR_XM_InvalidRelay 1425 0.33 1.06 0.02 175 TR_XM_SEO4 1405 0.37 1.05 0.08 176 TM2_M_A_HREF_HREF 1400 0.53 1.05 0.32 177 XM_HighProb1 1388 0.31 1.04 0.00 178 HELO_DYNAMIC_SPLIT_IP 1382 0.31 1.03 0.00 179 XMSexyCombo_01 1382 0.43 1.03 0.17 180 XMSlimDrugH 1345 0.72 1.01 0.60 181 TR_Symld_Words 1331 1.33 0.99 1.47 182 XMSubMetaSxObfu_03 1330 0.64 0.99 0.49 183 XM_ProductURIs 1319 0.65 0.99 0.51 184 MPART_ALT_DIFF_COUNT 1311 0.63 0.98 0.48 185 THIS_AD 1306 0.56 0.98 0.38 186 URIBL_BLACK 1278 0.30 0.96 0.02 187 XMHTML_After_End 1261 0.55 0.94 0.39 188 XMMoneyMeta_00 1251 0.72 0.93 0.63 189 MultiRelay_CC 1222 0.38 0.91 0.15 190 RELAYCOUNTRY_GB 1209 0.70 0.90 0.62 191 XM_GoogleGroups 1201 1.23 0.90 1.37 192 HTML_FONT_TINY_NORDNS 1191 0.33 0.89 0.10 193 BAYES_05 1189 1.87 0.89 2.28 194 MISSING_HEADERS 1174 0.50 0.88 0.35 195 XM_PDF 1154 3.46 0.86 4.57 196 XM_UB99 1149 0.26 0.86 0.00 197 NO_DNS_FOR_FROM 1141 0.41 0.85 0.22 198 T_TooManySym_02 1136 2.32 0.85 2.95 199 TR_Mismatch_TLD_02 1135 0.31 0.85 0.08 200 RCVD_IN_XBL 1134 0.27 0.85 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 312363 99.01 98.29 99.32 2 HTML_MESSAGE 272991 89.34 95.28 86.81 3 RELAYCOUNTRY_US 256238 81.61 81.94 81.48 4 DKIM_SIGNED 240926 80.53 89.76 76.61 5 XM_DK_Pass 237782 78.63 85.71 75.61 6 DKIM_VALID 234416 77.63 84.89 74.54 7 XM_B_Unicode 222511 74.97 84.87 70.75 8 BAYES_50 190748 54.81 41.07 60.65 9 DKIM_VALID_AU 190066 62.37 66.92 60.44 10 DCC_CHECK_NEGATIVE 185513 48.54 23.98 58.99 11 XMListUnsubscribeExists 154947 54.61 67.15 49.27 12 XM_B_SpammyWords 142155 52.65 70.15 45.20 13 DCC_CHECK 128798 50.96 74.48 40.95 14 XM_B_Unicode3 127939 43.38 49.71 40.68 15 DKIM_VALID_EF 97859 31.16 31.28 31.12 16 T_TM2_M_HEADER_IN_MSG 97687 29.15 24.66 31.06 17 LOC_TINY_FONT_1 91572 34.79 48.11 29.12 18 HTML_FONT_LOW_CONTRAST 89107 30.98 37.21 28.33 19 FVGT_m_MULTI_ODD 81621 28.49 34.44 25.95 20 XMSubLong 76602 24.40 24.51 24.36 21 T_KAM_HTML_FONT_INVALID 71103 24.55 29.11 22.61 22 MIME_HTML_ONLY 62201 22.87 30.14 19.78 23 XM_B_SpammyWords2 61432 25.86 40.73 19.53 24 RCVD_IN_MSPIKE_WL 56784 15.39 9.13 18.06 25 RCVD_IN_MSPIKE_H2 56145 18.58 20.29 17.85 26 ALL_TRUSTED 48542 11.56 2.46 15.44 27 XM_Multi_Part_URI 47072 16.96 21.63 14.97 28 TR_XM_DK_Unsub 45101 16.78 22.52 14.34 29 USER_IN_DEF_DKIM_WL 41423 9.99 2.53 13.17 30 UNPARSEABLE_RELAY 37628 13.48 17.06 11.96 31 BAYES_00 34665 7.93 0.65 11.02 32 XM_B_PhoneNumber 34664 9.65 6.42 11.02 33 XM_B_Unsub 32198 13.17 20.06 10.24 34 XM_Evil_Numbers_Gen 28304 9.63 11.09 9.00 35 TooManyTo_001 27700 7.46 4.30 8.81 36 FSL_BULK_SIG 27085 9.29 10.89 8.61 37 LotsOfNums_01 25400 7.77 7.06 8.08 38 RCVD_IN_MSPIKE_H3 25109 7.04 4.82 7.98 39 TR_XM_BayesUnsub 24737 11.26 19.23 7.87 40 TR_XM_DK_Bayes 22811 5.23 0.48 7.25 41 XM_DKIMWhitelistDomains 22619 5.05 0.02 7.19 42 TR_XM_DK_Bayes1 22375 5.13 0.47 7.11 43 BAYES_60 22344 7.28 7.68 7.10 44 TR_MAX_INTL_RELAY 19622 8.65 14.31 6.24 45 RCVD_IN_MSPIKE_H5 19363 4.90 1.94 6.16 46 T_TooManySym_01 19325 5.05 2.47 6.14 47 TR_XM_DK_Bayes2 18792 4.28 0.30 5.98 48 XM_H_GMP 18486 5.48 4.53 5.88 49 LOTS_OF_MONEY 18428 8.13 13.45 5.86 50 XM_B_Phish_Phrases 18381 6.90 9.39 5.84 51 XM_H_Long_From01 18034 5.71 5.67 5.73 52 BAYES_40 17344 4.46 1.98 5.52 53 MIME_QP_LONG_LINE 16903 4.72 3.17 5.37 54 XM_B_SpammyWords3 16702 8.03 14.43 5.31 55 MPART_ALT_DIFF 15632 5.34 6.22 4.97 56 XM_DK_Undo_02 15005 15.52 40.78 4.77 57 XMStrtUSub 14993 4.94 5.35 4.77 58 XM_PDF 14378 3.46 0.86 4.57 59 HTML_IMAGE_RATIO_02 13412 5.00 6.74 4.26 60 RCVD_IN_VALIDITY_SAFE 13379 3.62 2.13 4.25 61 HTML_IMAGE_RATIO_04 13253 4.61 5.55 4.21 62 XM_UncommonTLD01 13114 4.62 5.67 4.17 63 RCVD_IN_IADB_LISTED 12579 3.20 1.32 4.00 64 TR_XM_SpammyWords4 12486 6.45 12.27 3.97 65 RCVD_IN_MSPIKE_H4 12312 3.45 2.36 3.91 66 BAYES_80 12177 5.37 8.89 3.87 67 XMNumbers 12119 3.84 3.79 3.85 68 BAYES_20 12039 3.17 1.64 3.83 69 RELAYCOUNTRY_META 11672 7.73 17.18 3.71 70 ANY_BOUNCE_MESSAGE 11650 2.78 0.60 3.70 71 BOUNCE_MESSAGE 11646 2.78 0.60 3.70 72 XMSubMetaSx_00 11572 4.55 6.61 3.68 73 T_REMOTE_IMAGE 11177 2.93 1.48 3.55 74 RCVD_IN_IADB_SPF 11038 2.81 1.18 3.51 75 RCVD_IN_VALIDITY_CERTIFIED 10782 2.91 1.70 3.43 76 BAYES_99 10554 11.48 30.57 3.36 77 TooManyTo_002 10183 2.46 0.65 3.24 78 MAILING_LIST_MULTI 10086 2.89 2.15 3.21 79 RCVD_IN_IADB_SENDERID 9834 2.53 1.11 3.13 80 XM_SendGrid 9658 2.98 2.76 3.07 81 RCVD_IN_IADB_DK 9538 2.46 1.13 3.03 82 BOTNET_IPINHOSTNAME 9353 5.93 12.89 2.97 83 T_TooManySym_02 9265 2.32 0.85 2.95 84 HTML_IMAGE_RATIO_06 9234 3.09 3.44 2.94 85 XM_Body_Dirty_Words 8826 3.91 6.52 2.81 86 XM_B_SpammyTLD 8783 3.10 3.81 2.79 87 MIME_HTML_ONLY_MULTI 8493 2.84 3.17 2.70 88 MIME_HTML_MOSTLY 8226 2.94 3.69 2.62 89 RCVD_IN_IADB_VOUCHED 8014 1.98 0.63 2.55 90 HTML_IMAGE_RATIO_08 7797 2.65 3.05 2.48 91 BAYES_999 7790 8.76 23.53 2.48 92 HTML_MIME_NO_HTML_TAG 7632 2.30 1.99 2.43 93 XM_CamelCaseFrm001 7562 2.76 3.59 2.40 94 SCC_BODY_URI_ONLY 7463 2.16 1.66 2.37 95 BAYES_95 7436 3.18 5.11 2.36 96 INVALID_MSGID 7239 1.68 0.22 2.30 97 BAYES_05 7174 1.87 0.89 2.28 98 TR_XM_DKIM_Undo 6521 10.42 30.03 2.07 99 DKIM_INVALID 6510 2.91 4.87 2.07 100 TR_XM_DK_SendGrid 6404 1.93 1.68 2.04 101 TO_MALFORMED 6391 1.44 0.04 2.03 102 XM_DK_Undo_01 6234 1.87 1.62 1.98 103 XM_B_URI_Unicode 6140 2.21 2.81 1.95 104 T_XMDrugObfuBody_14 6113 2.51 3.82 1.94 105 TM2_M_URI_OPT_OUT 5893 2.21 2.99 1.87 106 TR_XM_SpammyRelay 5883 5.06 12.56 1.87 107 FROM_EXCESS_BASE64 5828 2.07 2.59 1.85 108 TR_XM_UnparsRelay 5676 4.04 9.31 1.80 109 XM_B_Investor 5672 2.78 5.06 1.80 110 TR_XM_PhishingBody 5604 2.76 5.07 1.78 111 RCVD_IN_IADB_OPTIN 5544 1.36 0.43 1.76 112 XM_B_Unsub2 5415 2.16 3.20 1.72 113 TooManyTo_003 5318 1.34 0.52 1.69 114 UNTRUSTED_Relay 5240 2.90 5.78 1.67 115 T_XMDrugObfuBody_08 4920 2.22 3.75 1.56 116 XMDiploma_00 4917 1.85 2.52 1.56 117 TR_XM_SpammyWords5 4740 2.24 3.97 1.51 118 KHOP_HELO_FCRDNS 4715 1.46 1.36 1.50 119 TR_MetaPhish_Combo_01 4675 1.38 1.14 1.49 120 XM_SPF_SoftFail 4650 2.05 3.39 1.48 121 TR_Symld_Words 4617 1.33 0.99 1.47 122 URI_NOVOWEL 4572 1.45 1.45 1.45 123 SUBJ_ALL_CAPS 4449 1.60 2.04 1.41 124 URI_HEX 4397 1.37 1.32 1.40 125 XM_GoogleGroups 4293 1.23 0.90 1.37 126 HELO_NODOT 4290 0.99 0.11 1.36 127 HELO_NO_DOMAIN 4286 0.99 0.10 1.36 128 TM2_M_VERY_LONG_WORD 4116 2.14 4.09 1.31 129 XMSexyCombo_05 4115 2.08 3.90 1.31 130 IN_HORDE_ADDRESS_BOOK 4034 0.93 0.09 1.28 131 TooManyTo_004 3945 1.01 0.44 1.25 132 TR_DCC_Bayes_99 3941 7.18 21.12 1.25 133 BOTNET 3909 3.87 10.04 1.24 134 XMGappySubj_01 3736 0.90 0.22 1.19 135 T_TooManySym_03 3663 0.92 0.34 1.16 136 XM_B_SpammyWords4 3558 1.69 2.99 1.13 137 XMCapTrack 3545 0.98 0.64 1.13 138 XM_UB50 3400 1.60 2.83 1.08 139 TooManyTo_005 3339 0.86 0.40 1.06 140 XMBrknScrpt_02 3076 1.23 1.83 0.98 141 XM_ShortIntro_01 3061 0.82 0.44 0.97 142 XM_OfRef6 3036 1.62 3.16 0.97 143 TVD_SPACE_RATIO 3029 0.74 0.21 0.96 144 T_XMDrugObfuBody_00 2993 1.13 1.56 0.95 145 XM_B_FormFill 2962 0.67 0.04 0.94 146 XMGenDplmaNmb 2956 1.13 1.59 0.94 147 TVD_RCVD_IP 2890 1.01 1.23 0.92 148 RCVD_IN_MSPIKE_BL 2873 2.00 4.57 0.91 149 TR_XM_MSPIKECOMBO 2873 2.00 4.57 0.91 150 XMBdyGiftCard01 2772 1.04 1.40 0.88 151 XM_H_Long_From02 2771 1.22 2.00 0.88 152 T_FILL_THIS_FORM_SHORT 2742 1.24 2.10 0.87 153 SpammyFromTLD_01 2739 1.15 1.80 0.87 154 DKIM_ADSP_CUSTOM_MED 2620 0.90 1.07 0.83 155 T_OBFU_PDF_ATTACH 2395 0.59 0.20 0.76 156 RELAYCOUNTRY_CA 2389 2.59 6.90 0.76 157 FROM_GOV_DKIM_AU 2382 0.57 0.14 0.76 158 XM_H_PHPMailer 2380 0.69 0.53 0.76 159 URI_OPTOUT_3LD 2372 0.71 0.61 0.75 160 RCVD_IN_PBL 2352 0.92 1.34 0.75 161 XMStockSpam_06 2339 1.07 1.84 0.74 162 HTTPS_HTTP_MISMATCH 2254 0.91 1.35 0.72 163 XMNoVowels 2250 0.67 0.56 0.72 164 T_TVD_MIME_NO_HEADERS 2222 0.51 0.04 0.71 165 TR_XM_Base64_M1 2144 0.84 1.21 0.68 166 TR_XM_PHPDW 2138 0.84 1.23 0.68 167 TR_XM_FormFill2 2134 0.84 1.22 0.68 168 PLING_QUERY 2116 0.65 0.59 0.67 169 TR_XM_PHPForged 2110 0.84 1.24 0.67 170 RCVD_IN_MSPIKE_L3 2096 1.21 2.49 0.67 171 XM_H_PHPOS 2091 0.82 1.19 0.66 172 XMSubMetaI_00 2037 0.79 1.11 0.65 173 XMMoneyMeta_00 1990 0.72 0.93 0.63 174 RCVD_IN_BL_SPAMCOP_NET 1959 3.09 8.90 0.62 175 XM_B_COPY_HTML 1956 0.91 1.58 0.62 176 XMGappySubj_02 1955 0.45 0.05 0.62 177 RELAYCOUNTRY_GB 1940 0.70 0.90 0.62 178 T_Symld_Words_02 1920 0.67 0.80 0.61 179 TR_XM_SpammyWords2 1890 3.76 11.19 0.60 180 XMSlimDrugH 1873 0.72 1.01 0.60 181 RELAYCOUNTRY_AU 1813 1.27 2.90 0.58 182 XMBSHREFv2 1806 0.51 0.35 0.57 183 XMLngstWrd_00 1760 0.50 0.35 0.56 184 HTML_TAG_BALANCE_BODY 1746 0.62 0.77 0.56 185 URI_TRY_3LD 1707 0.81 1.45 0.54 186 MSGID_FROM_MTA_HEADER 1694 0.45 0.25 0.54 187 XMPhish30 1689 0.84 1.54 0.54 188 FORGED_GMAIL_RCVD 1625 0.58 0.73 0.52 189 NML_ADSP_CUSTOM_MED 1614 0.61 0.85 0.51 190 TM2_M_BODY_EMPTY 1606 0.38 0.08 0.51 191 XM_ProductURIs 1603 0.65 0.99 0.51 192 T_XMHurry_00 1586 0.96 2.02 0.50 193 XMSubMetaSxObfu_03 1548 0.64 0.99 0.49 194 MPART_ALT_DIFF_COUNT 1523 0.63 0.98 0.48 195 TO_NO_BRKTS_HTML_ONLY 1506 0.58 0.82 0.48 196 XMDateMe_00 1505 0.50 0.54 0.48 197 XM_B_DNDMA 1484 0.69 1.20 0.47 198 LongTLD 1478 0.56 0.78 0.47 199 XMLngstWrd_01 1471 0.42 0.30 0.47 200 XMPhish14 1450 0.78 1.53 0.46 ----------------------------------------------------------------------