Email: 442592 Autolearn: 0 AvgScore: 5.26 AvgScanTime: 1.33 sec Spam: 134221 Autolearn: 0 AvgScore: 15.14 AvgScanTime: 1.46 sec Ham: 308371 Autolearn: 0 AvgScore: 0.96 AvgScanTime: 1.28 sec Time Spent Running SA: 163.69 hours Time Spent Processing Spam: 54.43 hours Time Spent Processing Ham: 109.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 131757 98.96 98.16 99.31 2 HTML_MESSAGE 126773 89.08 94.45 86.74 3 DKIM_SIGNED 120393 77.96 89.70 72.85 4 XM_DK_Pass 112697 75.49 83.96 71.80 5 XM_B_Unicode 111982 73.60 83.43 69.32 6 DKIM_VALID 111817 74.49 83.31 70.65 7 RELAYCOUNTRY_US 108850 81.38 81.10 81.50 8 DCC_CHECK 101287 49.17 75.46 37.73 9 XM_B_SpammyWords 92284 50.96 68.76 43.22 10 XMListUnsubscribeExists 89126 51.80 66.40 45.45 11 DKIM_VALID_AU 86734 59.71 64.62 57.58 12 XM_B_Unicode3 64417 42.29 47.99 39.81 13 LOC_TINY_FONT_1 59781 32.77 44.54 27.65 14 XM_DK_Undo_02 55222 15.76 41.14 4.71 15 XM_B_SpammyWords2 50889 23.71 37.91 17.52 16 BAYES_50 50152 53.34 37.37 60.29 17 HTML_FONT_LOW_CONTRAST 49555 31.76 36.92 29.51 18 FVGT_m_MULTI_ODD 45784 27.93 34.11 25.24 19 BAYES_99 43794 12.33 32.63 3.49 20 DKIM_VALID_EF 41464 31.05 30.89 31.12 21 TR_XM_DKIM_Undo 40298 10.47 30.02 1.96 22 MIME_HTML_ONLY 38956 22.24 29.02 19.29 23 T_KAM_HTML_FONT_INVALID 38534 22.97 28.71 20.47 24 BAYES_999 33937 9.52 25.28 2.66 25 XMSubLong 31987 22.74 23.83 22.26 26 TR_DCC_Bayes_99 31252 8.00 23.28 1.35 27 DCC_CHECK_NEGATIVE 30695 50.28 22.87 62.22 28 TR_XM_DK_Unsub 29784 16.46 22.19 13.96 29 T_TM2_M_HEADER_IN_MSG 29326 29.76 21.85 33.20 30 XM_B_Unsub 27144 11.83 20.22 8.18 31 XM_Multi_Part_URI 26588 14.79 19.81 12.60 32 RCVD_IN_MSPIKE_H2 26499 17.86 19.74 17.04 33 TR_XM_BayesUnsub 26059 10.33 19.41 6.37 34 RELAYCOUNTRY_META 24596 8.14 18.33 3.71 35 UNPARSEABLE_RELAY 23412 13.98 17.44 12.48 36 TR_MAX_INTL_RELAY 20740 8.83 15.45 5.94 37 LOTS_OF_MONEY 20150 9.30 15.01 6.82 38 XM_B_SpammyWords3 18863 7.17 14.05 4.17 39 TR_XM_SpammyWords4 17757 7.35 13.23 4.80 40 TR_XM_SpammyRelay 17540 5.20 13.07 1.77 41 BOTNET_IPINHOSTNAME 17369 5.99 12.94 2.96 42 FSL_BULK_SIG 15818 9.51 11.79 8.51 43 BOTNET 14679 4.15 10.94 1.20 44 RCVD_IN_BL_SPAMCOP_NET 14279 3.58 10.64 0.51 45 TR_XM_SpammyWords2 14244 3.57 10.61 0.50 46 TR_XM_UnparsRelay 13540 4.26 10.09 1.72 47 BAYES_80 12969 5.42 9.66 3.58 48 RCVD_IN_MSPIKE_WL 12682 15.52 9.45 18.17 49 XM_Evil_Numbers_Gen 12430 10.04 9.26 10.38 50 BAYES_60 11119 7.41 8.28 7.03 51 XM_B_Phish_Phrases 10484 5.67 7.81 4.73 52 XM_UncommonTLD01 9439 5.24 7.03 4.45 53 MPART_ALT_DIFF 9348 4.97 6.96 4.11 54 HTML_IMAGE_RATIO_02 9163 4.92 6.83 4.08 55 RELAYCOUNTRY_CA 8634 2.48 6.43 0.76 56 DKIM_INVALID 8576 3.47 6.39 2.19 57 XM_B_PhoneNumber 8519 8.84 6.35 9.92 58 XM_Body_Dirty_Words 8498 3.77 6.33 2.66 59 LotsOfNums_01 8373 8.36 6.24 9.29 60 UNTRUSTED_Relay 8162 2.98 6.08 1.62 61 XMSubMetaSx_00 7882 3.84 5.87 2.96 62 XM_B_Investor 7818 2.84 5.82 1.54 63 XM_H_Long_From01 7648 5.37 5.70 5.23 64 XM_H_GMP 7515 6.05 5.60 6.25 65 BAYES_95 7266 3.29 5.41 2.36 66 XMStrtUSub 6776 4.85 5.05 4.77 67 TR_XM_SpammyWords5 6736 2.56 5.02 1.49 68 RCVD_IN_MSPIKE_BL 6644 2.18 4.95 0.97 69 TR_XM_MSPIKECOMBO 6642 2.18 4.95 0.97 70 TR_XM_NoHeaderRelay 6455 1.59 4.81 0.19 71 HTML_IMAGE_RATIO_04 6388 4.20 4.76 3.96 72 RCVD_IN_MSPIKE_H3 6088 6.97 4.54 8.02 73 XM_OfRef6 5896 2.06 4.39 1.04 74 TooManyTo_001 5861 7.36 4.37 8.66 75 TR_XM_PhishingBody 5688 2.24 4.24 1.37 76 XMSexyCombo_05 5418 2.01 4.04 1.13 77 XM_B_SpammyTLD 5405 3.10 4.03 2.70 78 T_XMDrugObfuBody_14 5303 2.56 3.95 1.95 79 XMNumbers 5193 3.54 3.87 3.40 80 XM_CamelCaseFrm001 5026 2.35 3.74 1.74 81 XM_SPF_SoftFail 4947 2.17 3.69 1.51 82 MIME_QP_LONG_LINE 4826 4.41 3.60 4.77 83 RCVD_IN_VALIDITY_RPBL 4663 1.24 3.47 0.26 84 TR_XM_SpammyWords3 4663 1.35 3.47 0.42 85 TM2_M_VERY_LONG_WORD 4639 3.89 3.46 4.08 86 TR_XM_SPAMCOP 4511 1.13 3.36 0.16 87 XM_B_Unsub2 4491 1.82 3.35 1.15 88 T_XMDrugObfuBody_08 4482 1.98 3.34 1.40 89 XMBody_17 4459 1.26 3.32 0.36 90 SpammyFromTLD_02 4458 1.20 3.32 0.28 91 MIME_HTML_ONLY_MULTI 4399 2.66 3.28 2.40 92 SUBJ_ALL_CAPS 4398 2.33 3.28 1.92 93 XMDiploma_00 4352 2.14 3.24 1.66 94 MIME_HTML_MOSTLY 4314 2.43 3.21 2.09 95 XM_UB50 4054 1.61 3.02 1.00 96 XM_URI_RBL 4010 1.08 2.99 0.25 97 T_TooManySym_01 3873 4.95 2.89 5.84 98 HTML_IMAGE_RATIO_06 3854 2.93 2.87 2.95 99 RCVD_IN_MSPIKE_H4 3837 3.56 2.86 3.86 100 TM2_M_URI_OPT_OUT 3796 2.05 2.83 1.71 101 HTML_IMAGE_RATIO_08 3759 2.24 2.80 1.99 102 RELAYCOUNTRY_AU 3627 1.17 2.70 0.50 103 RCVD_IN_MSPIKE_L3 3618 1.33 2.70 0.73 104 T_FILL_THIS_FORM_SHORT 3488 1.46 2.60 0.96 105 TR_XM_INV_DKIM 3463 0.82 2.58 0.05 106 XM_SendGrid 3462 3.02 2.58 3.21 107 XM_B_URI_Unicode 3421 2.25 2.55 2.12 108 XMStockSpam_06 3250 1.66 2.42 1.32 109 XM_B_SpammyWords4 3247 1.06 2.42 0.47 110 FROM_EXCESS_BASE64 3095 1.90 2.31 1.72 111 T_XMHurry_00 3046 1.20 2.27 0.73 112 MAILING_LIST_MULTI 2974 2.83 2.22 3.10 113 XMBrknScrpt_02 2888 1.37 2.15 1.03 114 XMGenDplmaNmb 2856 1.26 2.13 0.88 115 RCVD_IN_MSPIKE_H5 2757 5.00 2.05 6.28 116 TR_LOTS_OF_MONEY3 2755 0.93 2.05 0.45 117 RCVD_IN_VALIDITY_SAFE 2736 3.09 2.04 3.55 118 DKIM_ADSP_NXDOMAIN 2716 0.83 2.02 0.30 119 ALL_TRUSTED 2694 11.43 2.01 15.53 120 USER_IN_DEF_DKIM_WL 2668 8.84 1.99 11.82 121 T_XMDrugObfuBody_00 2590 1.09 1.93 0.73 122 SCC_BODY_URI_ONLY 2500 2.25 1.86 2.41 123 BAYES_40 2480 5.03 1.85 6.41 124 LongTLD 2399 1.01 1.79 0.67 125 XMPhish30 2383 0.90 1.78 0.51 126 HTML_MIME_NO_HTML_TAG 2377 2.58 1.77 2.93 127 DKIM_ADSP_CUSTOM_MED 2340 1.15 1.74 0.89 128 RCVD_IN_ZEN_LASTEXTERNAL 2220 0.50 1.65 0.00 129 SHORTCIRCUIT 2220 0.50 1.65 0.00 130 RELAYCOUNTRY_IN 2217 0.53 1.65 0.04 131 XM_DIRTYINTL 2152 0.54 1.60 0.08 132 XMSubMetaI_00 2150 0.90 1.60 0.60 133 HTML_IMAGE_ONLY_20 2140 0.76 1.59 0.40 134 BAYES_20 2098 3.43 1.56 4.24 135 SpammyFromTLD_01 2086 1.05 1.55 0.83 136 XM_DK_Undo_01 2074 1.81 1.55 1.93 137 RCVD_IN_MSPIKE_L4 2037 0.62 1.52 0.23 138 XM_H_Long_From02 2030 0.97 1.51 0.73 139 TR_XM_MSPIKECOMBO2 2008 0.48 1.50 0.03 140 RCVD_IN_VALIDITY_CERTIFIED 1968 2.48 1.47 2.92 141 URI_TRY_3LD 1960 0.81 1.46 0.52 142 URI_NOVOWEL 1958 1.37 1.46 1.33 143 HTTPS_HTTP_MISMATCH 1957 0.98 1.46 0.78 144 SH_BODYURI_REVERSE_CSS 1952 0.45 1.45 0.01 145 URIBL_CSS_A 1950 0.45 1.45 0.01 146 URIBL_CSS 1950 0.45 1.45 0.01 147 TR_XM_DK_SendGrid 1907 1.94 1.42 2.17 148 KHOP_HELO_FCRDNS 1880 2.81 1.40 3.42 149 XM_H_DKIM_GOOG 1854 0.43 1.38 0.01 150 XM_B_SEO 1828 0.60 1.36 0.27 151 TR_Caps_n_Bayes_99 1826 0.42 1.36 0.01 152 BOTNET_NORDNS 1824 0.42 1.36 0.01 153 RELAYCOUNTRY_GB 1823 0.83 1.36 0.60 154 FROM_SUSPICIOUS_NTLD 1818 0.46 1.35 0.08 155 XM_B_COPY_HTML 1809 0.87 1.35 0.66 156 TR_XM_PHPForged 1800 0.62 1.34 0.31 157 TR_XM_FormFill2 1790 0.61 1.33 0.30 158 URI_HEX 1756 1.31 1.31 1.30 159 RDNS_DYNAMIC 1745 0.52 1.30 0.17 160 TR_XM_PHPDW 1738 0.60 1.29 0.30 161 RCVD_IN_PBL 1737 1.01 1.29 0.88 162 MISSING_HEADERS 1724 0.65 1.28 0.38 163 XM_H_PHPOS 1722 0.59 1.28 0.29 164 T_REMOTE_IMAGE 1713 3.00 1.28 3.75 165 PDS_RDNS_DYNAMIC_FP 1708 0.42 1.27 0.05 166 SCC_CANSPAM_2 1688 0.38 1.26 0.00 167 THIS_AD 1680 0.65 1.25 0.39 168 XM_B_Phish66 1675 0.63 1.25 0.37 169 XM_B_DNDMA 1671 0.65 1.24 0.39 170 TR_XM_SEO4 1665 0.48 1.24 0.14 171 TR_Mismatch_TLD_02 1662 0.47 1.24 0.14 172 NML_ADSP_CUSTOM_MED 1625 0.73 1.21 0.53 173 FORGED_GMAIL_RCVD 1620 0.77 1.21 0.57 174 XM_S_SpammyWords 1606 0.69 1.20 0.47 175 TR_XM_Spammywords 1606 0.69 1.20 0.47 176 RCVD_IN_PSBL 1594 0.56 1.19 0.29 177 RCVD_IN_IADB_LISTED 1592 2.62 1.19 3.24 178 RCVD_IN_XBL 1586 0.38 1.18 0.03 179 TR_XM_InvalidRelay 1585 0.37 1.18 0.02 180 MultiRelay_CC 1559 0.49 1.16 0.20 181 TR_LOTS_OF_MONEY2 1541 0.55 1.15 0.28 182 T_MONEY_PERCENT 1541 0.55 1.15 0.28 183 RELAYCOUNTRY_FR 1535 0.58 1.14 0.34 184 XM_HighProb1 1512 0.34 1.13 0.00 185 T_Symld_Words_02 1511 0.97 1.13 0.91 186 XM_ProductURIs 1490 0.70 1.11 0.53 187 TVD_RCVD_IP 1478 0.96 1.10 0.89 188 TM2_M_A_HREF_HREF 1474 0.48 1.10 0.21 189 XM_GoogleGroups 1471 1.29 1.10 1.38 190 XMBdyGiftCard01 1426 0.74 1.06 0.60 191 RCVD_IN_IADB_SPF 1382 2.29 1.03 2.83 192 ANY_BOUNCE_MESSAGE 1380 5.46 1.03 7.38 193 BOUNCE_MESSAGE 1376 5.46 1.03 7.38 194 TR_XM_MaxSPIKE 1371 0.33 1.02 0.03 195 TM2_M_OBFU_COMMENT 1368 0.45 1.02 0.21 196 XMBody_78 1366 0.57 1.02 0.37 197 TR_Symld_Words 1366 1.33 1.02 1.47 198 REPLYTO_WITHOUT_TO_CC 1344 0.32 1.00 0.02 199 DIET_1 1285 0.50 0.96 0.30 200 RCVD_IN_IADB_DK 1282 2.02 0.96 2.48 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 306246 98.96 98.16 99.31 2 HTML_MESSAGE 267466 89.08 94.45 86.74 3 RELAYCOUNTRY_US 251319 81.38 81.10 81.50 4 DKIM_SIGNED 224636 77.96 89.70 72.85 5 XM_DK_Pass 221404 75.49 83.96 71.80 6 DKIM_VALID 217871 74.49 83.31 70.65 7 XM_B_Unicode 213778 73.60 83.43 69.32 8 DCC_CHECK_NEGATIVE 191860 50.28 22.87 62.22 9 BAYES_50 185918 53.34 37.37 60.29 10 DKIM_VALID_AU 177547 59.71 64.62 57.58 11 XMListUnsubscribeExists 140157 51.80 66.40 45.45 12 XM_B_SpammyWords 133270 50.96 68.76 43.22 13 XM_B_Unicode3 122767 42.29 47.99 39.81 14 DCC_CHECK 116333 49.17 75.46 37.73 15 T_TM2_M_HEADER_IN_MSG 102370 29.76 21.85 33.20 16 DKIM_VALID_EF 95951 31.05 30.89 31.12 17 HTML_FONT_LOW_CONTRAST 90998 31.76 36.92 29.51 18 LOC_TINY_FONT_1 85257 32.77 44.54 27.65 19 FVGT_m_MULTI_ODD 77832 27.93 34.11 25.24 20 XMSubLong 68648 22.74 23.83 22.26 21 T_KAM_HTML_FONT_INVALID 63128 22.97 28.71 20.47 22 MIME_HTML_ONLY 59487 22.24 29.02 19.29 23 RCVD_IN_MSPIKE_WL 56016 15.52 9.45 18.17 24 XM_B_SpammyWords2 54034 23.71 37.91 17.52 25 RCVD_IN_MSPIKE_H2 52537 17.86 19.74 17.04 26 ALL_TRUSTED 47880 11.43 2.01 15.53 27 TR_XM_DK_Unsub 43064 16.46 22.19 13.96 28 XM_Multi_Part_URI 38870 14.79 19.81 12.60 29 UNPARSEABLE_RELAY 38481 13.98 17.44 12.48 30 USER_IN_DEF_DKIM_WL 36447 8.84 1.99 11.82 31 XM_Evil_Numbers_Gen 32017 10.04 9.26 10.38 32 BAYES_00 31457 7.34 0.78 10.20 33 XM_B_PhoneNumber 30604 8.84 6.35 9.92 34 LotsOfNums_01 28643 8.36 6.24 9.29 35 TooManyTo_001 26716 7.36 4.37 8.66 36 FSL_BULK_SIG 26253 9.51 11.79 8.51 37 XM_B_Unsub 25236 11.83 20.22 8.18 38 RCVD_IN_MSPIKE_H3 24741 6.97 4.54 8.02 39 ANY_BOUNCE_MESSAGE 22771 5.46 1.03 7.38 40 BOUNCE_MESSAGE 22771 5.46 1.03 7.38 41 BAYES_60 21670 7.41 8.28 7.03 42 LOTS_OF_MONEY 21025 9.30 15.01 6.82 43 TR_XM_DK_Bayes 20697 4.88 0.68 6.71 44 TR_XM_DK_Bayes1 20283 4.79 0.67 6.58 45 BAYES_40 19778 5.03 1.85 6.41 46 TR_XM_BayesUnsub 19644 10.33 19.41 6.37 47 RCVD_IN_MSPIKE_H5 19365 5.00 2.05 6.28 48 XM_H_GMP 19275 6.05 5.60 6.25 49 TR_MAX_INTL_RELAY 18323 8.83 15.45 5.94 50 XM_DKIMWhitelistDomains 18295 4.15 0.04 5.93 51 T_TooManySym_01 18016 4.95 2.89 5.84 52 TR_XM_DK_Bayes2 17010 4.01 0.55 5.52 53 XM_PDF 16647 4.04 0.93 5.40 54 XM_H_Long_From01 16128 5.37 5.70 5.23 55 TR_XM_SpammyWords4 14788 7.35 13.23 4.80 56 MIME_QP_LONG_LINE 14703 4.41 3.60 4.77 57 XMStrtUSub 14700 4.85 5.05 4.77 58 XM_B_Phish_Phrases 14596 5.67 7.81 4.73 59 XM_DK_Undo_02 14512 15.76 41.14 4.71 60 XM_UncommonTLD01 13731 5.24 7.03 4.45 61 BAYES_20 13062 3.43 1.56 4.24 62 XM_B_SpammyWords3 12860 7.17 14.05 4.17 63 MPART_ALT_DIFF 12670 4.97 6.96 4.11 64 TM2_M_VERY_LONG_WORD 12594 3.89 3.46 4.08 65 HTML_IMAGE_RATIO_02 12592 4.92 6.83 4.08 66 HTML_IMAGE_RATIO_04 12205 4.20 4.76 3.96 67 RCVD_IN_MSPIKE_H4 11910 3.56 2.86 3.86 68 T_REMOTE_IMAGE 11570 3.00 1.28 3.75 69 HTML_IMAGE_ONLY_32 11534 2.74 0.46 3.74 70 RELAYCOUNTRY_META 11444 8.14 18.33 3.71 71 BAYES_80 11029 5.42 9.66 3.58 72 RCVD_IN_VALIDITY_SAFE 10950 3.09 2.04 3.55 73 BAYES_99 10761 12.33 32.63 3.49 74 KHOP_HELO_FCRDNS 10550 2.81 1.40 3.42 75 XMNumbers 10496 3.54 3.87 3.40 76 RCVD_IN_IADB_LISTED 9983 2.62 1.19 3.24 77 XM_SendGrid 9913 3.02 2.58 3.21 78 MAILING_LIST_MULTI 9556 2.83 2.22 3.10 79 T_TooManySym_02 9319 2.36 0.85 3.02 80 BOTNET_IPINHOSTNAME 9122 5.99 12.94 2.96 81 XMSubMetaSx_00 9121 3.84 5.87 2.96 82 HTML_IMAGE_RATIO_06 9099 2.93 2.87 2.95 83 HTML_MIME_NO_HTML_TAG 9035 2.58 1.77 2.93 84 RCVD_IN_VALIDITY_CERTIFIED 9001 2.48 1.47 2.92 85 TooManyTo_002 8999 2.31 0.91 2.92 86 RCVD_IN_IADB_SPF 8742 2.29 1.03 2.83 87 XM_B_SpammyTLD 8327 3.10 4.03 2.70 88 MAY_BE_FORGED 8308 1.92 0.13 2.69 89 BAYES_999 8205 9.52 25.28 2.66 90 XM_Body_Dirty_Words 8198 3.77 6.33 2.66 91 RCVD_IN_IADB_SENDERID 7882 2.07 0.94 2.56 92 RCVD_IN_IADB_DK 7658 2.02 0.96 2.48 93 SCC_BODY_URI_ONLY 7440 2.25 1.86 2.41 94 BAYES_05 7404 1.92 0.80 2.40 95 MIME_HTML_ONLY_MULTI 7391 2.66 3.28 2.40 96 INVALID_MSGID 7324 1.76 0.35 2.38 97 BAYES_95 7284 3.29 5.41 2.36 98 DKIM_INVALID 6765 3.47 6.39 2.19 99 TR_XM_DK_SendGrid 6678 1.94 1.42 2.17 100 XM_B_URI_Unicode 6545 2.25 2.55 2.12 101 MIME_HTML_MOSTLY 6453 2.43 3.21 2.09 102 RCVD_IN_IADB_VOUCHED 6431 1.64 0.61 2.09 103 TO_MALFORMED 6416 1.47 0.05 2.08 104 HTML_IMAGE_RATIO_08 6151 2.24 2.80 1.99 105 TR_XM_DKIM_Undo 6035 10.47 30.02 1.96 106 T_XMDrugObfuBody_14 6018 2.56 3.95 1.95 107 T_TVD_MIME_NO_HEADERS 5942 1.37 0.08 1.93 108 XM_DK_Undo_01 5940 1.81 1.55 1.93 109 SUBJ_ALL_CAPS 5919 2.33 3.28 1.92 110 TooManyTo_003 5871 1.57 0.82 1.90 111 TR_XM_SpammyRelay 5463 5.20 13.07 1.77 112 XM_CamelCaseFrm001 5365 2.35 3.74 1.74 113 FROM_EXCESS_BASE64 5301 1.90 2.31 1.72 114 TR_XM_UnparsRelay 5300 4.26 10.09 1.72 115 TM2_M_URI_OPT_OUT 5259 2.05 2.83 1.71 116 XMDiploma_00 5112 2.14 3.24 1.66 117 UNTRUSTED_Relay 5009 2.98 6.08 1.62 118 XM_B_Investor 4753 2.84 5.82 1.54 119 MIME_CHARSET_FARAWAY 4690 1.20 0.47 1.52 120 XM_SPF_SoftFail 4670 2.17 3.69 1.51 121 TR_XM_SpammyWords5 4594 2.56 5.02 1.49 122 TR_Symld_Words 4532 1.33 1.02 1.47 123 RCVD_IN_IADB_OPTIN 4422 1.12 0.41 1.43 124 TooManyTo_004 4357 1.21 0.73 1.41 125 HELO_NODOT 4342 1.07 0.29 1.41 126 HELO_NO_DOMAIN 4334 1.04 0.20 1.41 127 T_XMDrugObfuBody_08 4302 1.98 3.34 1.40 128 CHARSET_FARAWAY_HEADER 4293 1.05 0.28 1.39 129 XMCapTrack 4283 1.20 0.76 1.39 130 XM_GoogleGroups 4246 1.29 1.10 1.38 131 TR_XM_PhishingBody 4237 2.24 4.24 1.37 132 TR_DCC_Bayes_99 4150 8.00 23.28 1.35 133 URI_NOVOWEL 4087 1.37 1.46 1.33 134 XMStockSpam_06 4084 1.66 2.42 1.32 135 IN_HORDE_ADDRESS_BOOK 4034 0.93 0.08 1.31 136 URI_HEX 4023 1.31 1.31 1.30 137 XM_H_PHPMailer 3939 1.09 0.66 1.28 138 XMLngstWrd_00 3877 1.02 0.48 1.26 139 BOTNET 3703 4.15 10.94 1.20 140 T_TooManySym_03 3675 0.93 0.34 1.19 141 XMGappySubj_01 3669 0.94 0.36 1.19 142 TooManyTo_005 3594 1.02 0.68 1.17 143 XM_B_Unsub2 3561 1.82 3.35 1.15 144 XMSexyCombo_05 3497 2.01 4.04 1.13 145 TVD_SPACE_RATIO 3484 0.84 0.17 1.13 146 XM_ShortIntro_01 3463 0.93 0.48 1.12 147 XM_OfRef6 3203 2.06 4.39 1.04 148 XMBrknScrpt_02 3171 1.37 2.15 1.03 149 XM_UB50 3087 1.61 3.02 1.00 150 TR_XM_MSPIKECOMBO 3000 2.18 4.95 0.97 151 RCVD_IN_MSPIKE_BL 3000 2.18 4.95 0.97 152 T_FILL_THIS_FORM_SHORT 2975 1.46 2.60 0.96 153 T_Symld_Words_02 2804 0.97 1.13 0.91 154 TVD_RCVD_IP 2749 0.96 1.10 0.89 155 DKIM_ADSP_CUSTOM_MED 2748 1.15 1.74 0.89 156 RCVD_IN_PBL 2726 1.01 1.29 0.88 157 XMNoVowels 2702 0.81 0.67 0.88 158 XMGenDplmaNmb 2699 1.26 2.13 0.88 159 SHORT_URI_3 2625 0.62 0.11 0.85 160 SpammyFromTLD_01 2561 1.05 1.55 0.83 161 T_OBFU_PDF_ATTACH 2467 0.65 0.29 0.80 162 HTTPS_HTTP_MISMATCH 2395 0.98 1.46 0.78 163 TR_XM_Base64_M1 2378 0.81 0.89 0.77 164 RELAYCOUNTRY_CA 2333 2.48 6.43 0.76 165 XMGappySubj_02 2301 0.54 0.06 0.75 166 RCVD_IN_MSPIKE_L3 2259 1.33 2.70 0.73 167 T_XMHurry_00 2253 1.20 2.27 0.73 168 XM_H_Long_From02 2244 0.97 1.51 0.73 169 T_XMDrugObfuBody_00 2237 1.09 1.93 0.73 170 SHORT_URI_2 2149 0.52 0.11 0.70 171 TR_MetaPhish_Combo_01 2070 0.62 0.51 0.67 172 XMLngstWrd_01 2062 0.58 0.38 0.67 173 LongTLD 2060 1.01 1.79 0.67 174 XM_B_COPY_HTML 2042 0.87 1.35 0.66 175 MSGID_FROM_MTA_HEADER 1900 0.49 0.21 0.62 176 RELAYCOUNTRY_GB 1864 0.83 1.36 0.60 177 XMBdyGiftCard01 1857 0.74 1.06 0.60 178 XMSubMetaI_00 1854 0.90 1.60 0.60 179 XMSlimDrugH 1850 0.60 0.61 0.60 180 XMSolicitRefs_0 1782 0.58 0.60 0.58 181 FORGED_GMAIL_RCVD 1773 0.77 1.21 0.57 182 HTML_TAG_BALANCE_BODY 1660 0.64 0.87 0.54 183 XM_ProductURIs 1624 0.70 1.11 0.53 184 NML_ADSP_CUSTOM_MED 1619 0.73 1.21 0.53 185 XMBSHREFv2 1608 0.54 0.58 0.52 186 URI_TRY_3LD 1605 0.81 1.46 0.52 187 TM2_M_BODY_EMPTY 1604 0.39 0.08 0.52 188 FROM_GOV_DKIM_AU 1594 0.42 0.19 0.52 189 XMPhish30 1580 0.90 1.78 0.51 190 XMMoneyMeta_00 1577 0.56 0.68 0.51 191 T_STY_INVIS_DIRECT 1566 0.63 0.92 0.51 192 RCVD_IN_BL_SPAMCOP_NET 1565 3.58 10.64 0.51 193 T_MANY_PILL_PRICE 1559 0.36 0.01 0.51 194 TR_XM_SpammyWords2 1544 3.57 10.61 0.50 195 RELAYCOUNTRY_AU 1537 1.17 2.70 0.50 196 XMLngstWrd_02 1492 0.44 0.33 0.48 197 TR_XM_Spammywords 1456 0.69 1.20 0.47 198 XM_S_SpammyWords 1456 0.69 1.20 0.47 199 XM_B_SpammyWords4 1448 1.06 2.42 0.47 200 XMDateMe_00 1408 0.46 0.48 0.46 ----------------------------------------------------------------------