Email: 492536 Autolearn: 0 AvgScore: 3.59 AvgScanTime: 1.47 sec Spam: 140790 Autolearn: 0 AvgScore: 14.89 AvgScanTime: 1.65 sec Ham: 351746 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 1.40 sec Time Spent Running SA: 201.24 hours Time Spent Processing Spam: 64.69 hours Time Spent Processing Ham: 136.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134109 90.42 95.25 88.48 2 DKIM_SIGNED 125139 73.18 88.88 66.90 3 XM_DK_Pass 118062 71.06 83.86 65.94 4 DKIM_VALID 117021 70.15 83.12 64.96 5 XM_B_Unicode 116169 75.56 82.51 72.77 6 RELAYCOUNTRY_US 111346 81.81 79.09 82.89 7 DCC_CHECK 103524 51.79 73.53 43.09 8 XM_B_SpammyWords 96235 50.57 68.35 43.46 9 XMListUnsubscribeExists 93109 49.23 66.13 42.46 10 DKIM_VALID_AU 92166 56.76 65.46 53.28 11 XM_B_Unicode3 68930 44.61 48.96 42.86 12 LOC_TINY_FONT_1 67068 31.46 47.64 24.99 13 T_SCC_BODY_TEXT_LINE 65939 50.30 46.84 51.69 14 BAYES_50 57498 53.53 40.84 58.61 15 XM_B_SpammyWords2 56622 23.32 40.22 16.56 16 XM_DK_Undo_02 54487 14.09 38.70 4.24 17 HTML_FONT_LOW_CONTRAST 49051 28.03 34.84 25.31 18 DKIM_VALID_EF 46735 28.75 33.19 26.98 19 FVGT_m_MULTI_ODD 46474 25.40 33.01 22.35 20 BAYES_99 42888 10.91 30.46 3.09 21 MIME_HTML_ONLY 42707 24.30 30.33 21.88 22 T_KAM_HTML_FONT_INVALID 41303 22.59 29.34 19.89 23 TR_XM_DKIM_Undo 40183 9.41 28.54 1.75 24 XMSubLong 36774 23.51 26.12 22.47 25 DCC_CHECK_NEGATIVE 35150 47.74 24.97 56.85 26 TR_XM_DK_Unsub 32938 15.25 23.40 12.00 27 BAYES_999 32803 8.24 23.30 2.22 28 T_TM2_M_HEADER_IN_MSG 31038 25.65 22.05 27.09 29 XM_Multi_Part_URI 29271 14.67 20.79 12.22 30 TR_DCC_Bayes_99 28012 6.52 19.90 1.16 31 RCVD_IN_MSPIKE_H2 28005 16.07 19.89 14.54 32 RELAYCOUNTRY_META 27835 8.17 19.77 3.53 33 XM_B_Unsub 26127 10.76 18.56 7.64 34 TR_XM_BayesUnsub 25318 9.36 17.98 5.91 35 UNPARSEABLE_RELAY 24284 12.57 17.25 10.70 36 XM_B_SpammyWords3 23168 8.19 16.46 4.89 37 TR_MAX_INTL_RELAY 21470 8.11 15.25 5.25 38 TR_XM_SpammyRelay 18386 4.88 13.06 1.60 39 BOTNET_IPINHOSTNAME 17748 5.58 12.61 2.77 40 LOTS_OF_MONEY 17359 7.60 12.33 5.70 41 TR_XM_SpammyWords4 15396 5.84 10.94 3.80 42 BOTNET 14722 3.85 10.46 1.21 43 XM_Evil_Numbers_Gen 14456 9.74 10.27 9.53 44 FSL_BULK_SIG 13649 14.06 9.69 15.80 45 RCVD_IN_BL_SPAMCOP_NET 13510 3.09 9.60 0.49 46 TR_XM_SpammyWords2 13337 2.97 9.47 0.37 47 RCVD_IN_MSPIKE_WL 13060 13.81 9.28 15.62 48 TR_XM_UnparsRelay 13058 3.79 9.27 1.59 49 BAYES_80 12999 4.93 9.23 3.21 50 XM_B_Phish_Phrases 12864 6.02 9.14 4.77 51 UNTRUSTED_Relay 12837 3.94 9.12 1.86 52 XM_UncommonTLD01 11987 5.32 8.51 4.04 53 BAYES_60 11573 6.77 8.22 6.20 54 MPART_ALT_DIFF 11122 9.68 7.90 10.39 55 LotsOfNums_01 10128 7.06 7.19 7.01 56 RELAYCOUNTRY_CA 9278 2.31 6.59 0.60 57 HTML_IMAGE_RATIO_02 8725 4.67 6.20 4.06 58 XM_Body_Dirty_Words 8547 3.45 6.07 2.41 59 XMSubMetaSx_00 8380 3.84 5.95 2.99 60 XM_B_PhoneNumber 8359 8.29 5.94 9.23 61 XM_H_Long_From01 8267 5.33 5.87 5.11 62 XM_B_Investor 8130 2.71 5.77 1.48 63 DKIM_INVALID 8118 3.03 5.77 1.94 64 BAYES_95 7659 3.02 5.44 2.04 65 HTML_IMAGE_RATIO_04 7431 11.52 5.28 14.02 66 XMStrtUSub 6981 8.89 4.96 10.46 67 XM_H_GMP 6874 5.25 4.88 5.40 68 RCVD_IN_MSPIKE_BL 6735 1.97 4.78 0.85 69 TR_XM_MSPIKECOMBO 6734 1.97 4.78 0.85 70 TR_XM_PhishingBody 6559 2.40 4.66 1.50 71 TR_XM_SPAMCOP 6504 1.45 4.62 0.18 72 TooManyTo_001 6336 6.59 4.50 7.42 73 RCVD_IN_MSPIKE_H3 6206 6.49 4.41 7.32 74 TR_XM_SpammyWords5 5673 2.05 4.03 1.26 75 XM_B_SpammyTLD 5669 2.86 4.03 2.39 76 XM_OfRef6 5626 1.81 4.00 0.93 77 XMSexyCombo_05 5622 1.80 3.99 0.93 78 T_XMDrugObfuBody_14 5481 2.28 3.89 1.63 79 T_XMDrugObfuBody_08 5413 2.05 3.84 1.34 80 TR_XM_SpammyWords3 5315 1.36 3.78 0.40 81 HTML_IMAGE_RATIO_06 5240 4.43 3.72 4.71 82 XMNumbers 5115 3.23 3.63 3.07 83 TM2_M_VERY_LONG_WORD 5057 2.17 3.59 1.60 84 XM_B_URI_Unicode 5011 2.26 3.56 1.74 85 XM_UB50 4901 1.90 3.48 1.27 86 XM_B_Unsub2 4888 2.01 3.47 1.42 87 MIME_HTML_MOSTLY 4847 2.68 3.44 2.37 88 XM_URI_RBL 4811 1.18 3.42 0.29 89 MIME_HTML_ONLY_MULTI 4805 6.34 3.41 7.51 90 MIME_QP_LONG_LINE 4648 4.35 3.30 4.77 91 TR_XM_NoHeaderRelay 4508 1.01 3.20 0.14 92 SpammyFromTLD_02 4483 1.31 3.18 0.55 93 XM_SPF_SoftFail 4361 1.77 3.10 1.25 94 KHOP_HELO_FCRDNS 4315 2.29 3.06 1.98 95 XM_CamelCaseFrm001 4281 1.96 3.04 1.52 96 HTML_IMAGE_RATIO_08 4134 2.44 2.94 2.24 97 XMDiploma_00 4025 1.75 2.86 1.30 98 USER_IN_DEF_DKIM_WL 4013 8.98 2.85 11.43 99 RCVD_IN_MSPIKE_H4 3996 3.08 2.84 3.18 100 T_TooManySym_01 3833 4.63 2.72 5.40 101 TR_XM_INV_DKIM 3829 0.79 2.72 0.01 102 TM2_M_URI_OPT_OUT 3821 1.92 2.71 1.60 103 RELAYCOUNTRY_AU 3696 1.05 2.63 0.42 104 XM_UB99 3687 0.75 2.62 0.00 105 RCVD_IN_MSPIKE_L3 3637 1.20 2.58 0.65 106 T_FILL_THIS_FORM_SHORT 3283 1.18 2.33 0.73 107 FROM_EXCESS_BASE64 3255 1.68 2.31 1.43 108 RCVD_IN_VALIDITY_SAFE 3129 3.05 2.22 3.38 109 XM_B_SpammyWords4 3111 1.11 2.21 0.67 110 XM_UB999 3018 0.61 2.14 0.00 111 SUBJ_ALL_CAPS 3009 1.51 2.14 1.26 112 T_XMDrugObfuBody_00 2999 1.15 2.13 0.76 113 T_XMHurry_00 2888 0.92 2.05 0.47 114 RCVD_IN_MSPIKE_H5 2858 4.23 2.03 5.12 115 XMGenDplmaNmb 2852 1.12 2.03 0.76 116 TR_XM_MSPIKECOMBO2 2802 0.60 1.99 0.05 117 MAILING_LIST_MULTI 2777 2.51 1.97 2.73 118 XMBody_17 2775 0.83 1.97 0.37 119 XMStockSpam_06 2693 1.35 1.91 1.12 120 RCVD_IN_VALIDITY_CERTIFIED 2685 2.64 1.91 2.93 121 URI_NOVOWEL 2647 1.37 1.88 1.17 122 RELAYCOUNTRY_JP 2638 0.78 1.87 0.35 123 SpammyFromTLD_01 2622 1.04 1.86 0.71 124 BAYES_40 2587 4.74 1.84 5.91 125 RELAYCOUNTRY_FR 2533 0.68 1.80 0.23 126 RCVD_IN_PSBL 2471 0.78 1.76 0.39 127 RCVD_IN_VALIDITY_RPBL 2440 0.54 1.73 0.06 128 XMBdyGiftCard01 2437 0.75 1.73 0.36 129 HTML_SHORT_LINK_IMG_1 2433 1.12 1.73 0.88 130 ALL_TRUSTED 2413 10.50 1.71 14.01 131 HTML_MIME_NO_HTML_TAG 2375 2.01 1.69 2.14 132 T_REMOTE_IMAGE 2360 2.87 1.68 3.35 133 RCVD_IN_MSPIKE_L4 2340 0.61 1.66 0.19 134 DC_PNG_UNO_LARGO 2320 1.24 1.65 1.08 135 XM_B_COPY_HTML 2319 0.92 1.65 0.63 136 BODY_URI_ONLY 2307 0.71 1.64 0.34 137 HTML_IMAGE_ONLY_04 2235 1.06 1.59 0.85 138 XM_ProductURIs 2232 0.79 1.59 0.47 139 CONTENT_AFTER_HTML 2196 0.69 1.56 0.34 140 HTML_IMAGE_ONLY_20 2181 0.72 1.55 0.39 141 XMBrknScrpt_02 2147 0.89 1.52 0.64 142 XM_H_Long_From02 2143 0.96 1.52 0.73 143 RCVD_IN_ZEN_LASTEXTERNAL 2088 0.42 1.48 0.00 144 SHORTCIRCUIT 2088 0.42 1.48 0.00 145 XMPhish30 2083 0.76 1.48 0.47 146 URI_HEX 2072 1.19 1.47 1.08 147 TR_LOTS_OF_MONEY3 2065 0.57 1.47 0.20 148 TM2_M_OBFU_COMMENT 2042 0.63 1.45 0.31 149 RCVD_IN_PBL 2029 0.89 1.44 0.67 150 XM_DK_Undo_01 2021 1.69 1.44 1.79 151 RCVD_IN_XBL 1935 0.41 1.37 0.02 152 MultiRelay_CC 1920 0.49 1.36 0.14 153 RCVD_IN_SBL_CSS 1915 0.41 1.36 0.03 154 XM_B_DNDMA 1911 0.64 1.36 0.35 155 DKIM_ADSP_NXDOMAIN 1895 0.58 1.35 0.27 156 URI_TRY_3LD 1892 0.76 1.34 0.53 157 XM_SendGrid 1858 1.32 1.32 1.32 158 T_Symld_Words_02 1850 0.97 1.31 0.83 159 XM_UB60 1842 0.43 1.31 0.08 160 XM_HighProb1 1813 0.37 1.29 0.00 161 XM_B_Phish66 1811 0.60 1.29 0.32 162 RDNS_DYNAMIC 1759 0.46 1.25 0.14 163 PDS_RDNS_DYNAMIC_FP 1711 0.36 1.22 0.02 164 RCVD_IN_IADB_LISTED 1703 2.43 1.21 2.92 165 TM2_M_A_HREF_HREF 1698 0.57 1.21 0.32 166 XM_DIRTYINTL 1661 0.38 1.18 0.06 167 BOUNCE_MESSAGE 1645 3.80 1.17 4.86 168 ANY_BOUNCE_MESSAGE 1645 3.80 1.17 4.86 169 T_MONEY_PERCENT 1639 0.49 1.16 0.22 170 TR_LOTS_OF_MONEY2 1639 0.49 1.16 0.22 171 DIET_1 1633 0.47 1.16 0.20 172 TR_XM_InvalidRelay 1629 0.34 1.16 0.01 173 URIBL_SBL_A 1610 0.33 1.14 0.00 174 SH_BODYURI_REVERSE_SBL 1610 0.33 1.14 0.00 175 TR_XM_PHPForged 1610 0.74 1.14 0.57 176 URIBL_SBL 1610 0.33 1.14 0.00 177 TR_XM_IMAGE_URI 1598 0.32 1.14 0.00 178 XM_JunkDunk 1597 0.32 1.13 0.00 179 TR_XM_PHPDW 1596 0.73 1.13 0.57 180 TR_XM_FormFill2 1587 0.73 1.13 0.57 181 BAYES_20 1587 3.71 1.13 4.75 182 XM_B_SEO 1580 0.46 1.12 0.20 183 MPART_ALT_DIFF_COUNT 1550 0.67 1.10 0.50 184 XM_H_PHPOS 1547 0.72 1.10 0.57 185 BOTNET_NORDNS 1541 0.32 1.09 0.01 186 HK_RANDOM_REPLYTO 1538 0.36 1.09 0.07 187 HTML_TAG_BALANCE_BODY 1508 0.63 1.07 0.45 188 RCVD_IN_IADB_SPF 1507 2.12 1.07 2.54 189 TR_Symld_Words 1485 1.25 1.05 1.33 190 TR_Mismatch_TLD_02 1477 0.35 1.05 0.07 191 TVD_RCVD_IP 1460 1.01 1.04 0.99 192 XMHTML_After_End 1451 0.55 1.03 0.36 193 HTTPS_HTTP_MISMATCH 1448 0.73 1.03 0.62 194 XMSubMetaI_00 1448 0.60 1.03 0.42 195 TR_XM_RelayPhish 1432 0.34 1.02 0.07 196 XM_OfRef7 1429 0.40 1.01 0.15 197 XMPhish14 1423 0.61 1.01 0.45 198 XMBody_78 1420 0.48 1.01 0.27 199 LongTLD 1419 0.60 1.01 0.44 200 URIBL_BLACK 1404 0.29 1.00 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 311242 90.42 95.25 88.48 2 RELAYCOUNTRY_US 291578 81.81 79.09 82.89 3 XM_B_Unicode 255980 75.56 82.51 72.77 4 DKIM_SIGNED 235308 73.18 88.88 66.90 5 XM_DK_Pass 231930 71.06 83.86 65.94 6 DKIM_VALID 228483 70.15 83.12 64.96 7 BAYES_50 206164 53.53 40.84 58.61 8 DCC_CHECK_NEGATIVE 199982 47.74 24.97 56.85 9 DKIM_VALID_AU 187395 56.76 65.46 53.28 10 T_SCC_BODY_TEXT_LINE 181813 50.30 46.84 51.69 11 XM_B_SpammyWords 152864 50.57 68.35 43.46 12 DCC_CHECK 151573 51.79 73.53 43.09 13 XM_B_Unicode3 150767 44.61 48.96 42.86 14 XMListUnsubscribeExists 149355 49.23 66.13 42.46 15 T_TM2_M_HEADER_IN_MSG 95282 25.65 22.05 27.09 16 DKIM_VALID_EF 94888 28.75 33.19 26.98 17 HTML_FONT_LOW_CONTRAST 89014 28.03 34.84 25.31 18 LOC_TINY_FONT_1 87884 31.46 47.64 24.99 19 XMSubLong 79024 23.51 26.12 22.47 20 FVGT_m_MULTI_ODD 78613 25.40 33.01 22.35 21 MIME_HTML_ONLY 76956 24.30 30.33 21.88 22 T_KAM_HTML_FONT_INVALID 69950 22.59 29.34 19.89 23 XM_B_SpammyWords2 58252 23.32 40.22 16.56 24 FSL_BULK_SIG 55585 14.06 9.69 15.80 25 RCVD_IN_MSPIKE_WL 54943 13.81 9.28 15.62 26 RCVD_IN_MSPIKE_H2 51156 16.07 19.89 14.54 27 HTML_IMAGE_RATIO_04 49319 11.52 5.28 14.02 28 ALL_TRUSTED 49285 10.50 1.71 14.01 29 BAYES_00 45928 9.55 0.78 13.06 30 HTML_FONT_FACE_BAD 43692 9.09 0.76 12.42 31 XM_Multi_Part_URI 42968 14.67 20.79 12.22 32 TR_XM_DK_Unsub 42192 15.25 23.40 12.00 33 XM_H_Trusted_IP 41280 8.38 0.00 11.74 34 USER_IN_DEF_DKIM_WL 40212 8.98 2.85 11.43 35 UNPARSEABLE_RELAY 37630 12.57 17.25 10.70 36 XMStrtUSub 36788 8.89 4.96 10.46 37 MPART_ALT_DIFF 36559 9.68 7.90 10.39 38 XM_Evil_Numbers_Gen 33529 9.74 10.27 9.53 39 XM_B_PhoneNumber 32458 8.29 5.94 9.23 40 XM_B_Unsub 26880 10.76 18.56 7.64 41 MIME_HTML_ONLY_MULTI 26420 6.34 3.41 7.51 42 TooManyTo_001 26098 6.59 4.50 7.42 43 RCVD_IN_MSPIKE_H3 25748 6.49 4.41 7.32 44 LotsOfNums_01 24653 7.06 7.19 7.01 45 TR_XM_DK_Bayes 21855 4.62 0.65 6.21 46 BAYES_60 21794 6.77 8.22 6.20 47 TR_XM_DK_Bayes1 21534 4.55 0.64 6.12 48 TR_XM_BayesUnsub 20779 9.36 17.98 5.91 49 BAYES_40 20775 4.74 1.84 5.91 50 LOTS_OF_MONEY 20050 7.60 12.33 5.70 51 XM_DKIMWhitelistDomains 19053 3.88 0.03 5.42 52 XM_H_GMP 19002 5.25 4.88 5.40 53 T_TooManySym_01 18994 4.63 2.72 5.40 54 TR_MAX_INTL_RELAY 18475 8.11 15.25 5.25 55 TR_XM_DK_Bayes2 18447 3.84 0.34 5.24 56 RCVD_IN_MSPIKE_H5 17998 4.23 2.03 5.12 57 XM_H_Long_From01 17968 5.33 5.87 5.11 58 XM_B_SpammyWords3 17186 8.19 16.46 4.89 59 ANY_BOUNCE_MESSAGE 17090 3.80 1.17 4.86 60 BOUNCE_MESSAGE 17085 3.80 1.17 4.86 61 MIME_QP_LONG_LINE 16785 4.35 3.30 4.77 62 XM_B_Phish_Phrases 16778 6.02 9.14 4.77 63 BAYES_20 16698 3.71 1.13 4.75 64 HTML_IMAGE_RATIO_06 16569 4.43 3.72 4.71 65 XMSubNoVowel 15005 3.15 0.36 4.27 66 XM_DK_Undo_02 14903 14.09 38.70 4.24 67 HTML_IMAGE_RATIO_02 14276 4.67 6.20 4.06 68 XM_UncommonTLD01 14216 5.32 8.51 4.04 69 XM_PDF 13920 3.08 0.88 3.96 70 TR_XM_SpammyWords4 13363 5.84 10.94 3.80 71 RELAYCOUNTRY_META 12416 8.17 19.77 3.53 72 RCVD_IN_VALIDITY_SAFE 11902 3.05 2.22 3.38 73 T_REMOTE_IMAGE 11799 2.87 1.68 3.35 74 BAYES_80 11275 4.93 9.23 3.21 75 RCVD_IN_MSPIKE_H4 11197 3.08 2.84 3.18 76 BAYES_05 11050 2.41 0.58 3.14 77 BAYES_99 10868 10.91 30.46 3.09 78 XMNumbers 10797 3.23 3.63 3.07 79 XMSubMetaSx_00 10515 3.84 5.95 2.99 80 RCVD_IN_VALIDITY_CERTIFIED 10304 2.64 1.91 2.93 81 RCVD_IN_IADB_LISTED 10263 2.43 1.21 2.92 82 BOTNET_IPINHOSTNAME 9739 5.58 12.61 2.77 83 MAILING_LIST_MULTI 9600 2.51 1.97 2.73 84 T_TooManySym_02 9220 2.08 0.74 2.62 85 RCVD_IN_IADB_SPF 8917 2.12 1.07 2.54 86 XM_Body_Dirty_Words 8465 3.45 6.07 2.41 87 XM_B_SpammyTLD 8405 2.86 4.03 2.39 88 MIME_HTML_MOSTLY 8330 2.68 3.44 2.37 89 TooManyTo_002 8163 1.86 0.71 2.32 90 RCVD_IN_IADB_SENDERID 7920 1.88 0.97 2.25 91 HTML_IMAGE_RATIO_08 7870 2.44 2.94 2.24 92 BAYES_999 7800 8.24 23.30 2.22 93 RCVD_IN_IADB_DK 7662 1.84 0.99 2.18 94 HTML_MIME_NO_HTML_TAG 7539 2.01 1.69 2.14 95 XMSubLongNoVowel 7499 1.55 0.11 2.13 96 XMSubGarbage 7336 1.50 0.04 2.09 97 BAYES_95 7192 3.02 5.44 2.04 98 INVALID_MSGID 7159 1.54 0.32 2.04 99 KHOP_HELO_FCRDNS 6958 2.29 3.06 1.98 100 DKIM_INVALID 6825 3.03 5.77 1.94 101 RCVD_IN_IADB_VOUCHED 6699 1.55 0.66 1.90 102 UNTRUSTED_Relay 6553 3.94 9.12 1.86 103 TO_MALFORMED 6423 1.31 0.01 1.83 104 XM_DK_Undo_01 6291 1.69 1.44 1.79 105 TR_XM_DKIM_Undo 6164 9.41 28.54 1.75 106 XM_B_URI_Unicode 6104 2.26 3.56 1.74 107 T_XMDrugObfuBody_14 5739 2.28 3.89 1.63 108 TR_XM_SpammyRelay 5645 4.88 13.06 1.60 109 TM2_M_VERY_LONG_WORD 5636 2.17 3.59 1.60 110 TM2_M_URI_OPT_OUT 5626 1.92 2.71 1.60 111 TR_XM_UnparsRelay 5595 3.79 9.27 1.59 112 XM_CamelCaseFrm001 5357 1.96 3.04 1.52 113 TR_XM_PhishingBody 5269 2.40 4.66 1.50 114 XM_B_Investor 5212 2.71 5.77 1.48 115 TooManyTo_003 5102 1.20 0.56 1.45 116 FROM_EXCESS_BASE64 5028 1.68 2.31 1.43 117 XM_B_Unsub2 5006 2.01 3.47 1.42 118 RCVD_IN_IADB_OPTIN 4840 1.12 0.47 1.38 119 T_XMDrugObfuBody_08 4696 2.05 3.84 1.34 120 TR_Symld_Words 4694 1.25 1.05 1.33 121 XM_SendGrid 4641 1.32 1.32 1.32 122 XMDiploma_00 4581 1.75 2.86 1.30 123 XMGappySubj_01 4487 0.98 0.24 1.28 124 XM_UB50 4458 1.90 3.48 1.27 125 SUBJ_ALL_CAPS 4439 1.51 2.14 1.26 126 TR_XM_SpammyWords5 4435 2.05 4.03 1.26 127 HELO_NODOT 4394 0.93 0.14 1.25 128 XM_SPF_SoftFail 4380 1.77 3.10 1.25 129 HELO_NO_DOMAIN 4379 0.93 0.14 1.24 130 XM_GoogleGroups 4363 1.13 0.84 1.24 131 BOTNET 4244 3.85 10.46 1.21 132 SCC_BODY_URI_ONLY 4221 1.13 0.96 1.20 133 URI_NOVOWEL 4113 1.37 1.88 1.17 134 TR_DCC_Bayes_99 4078 6.52 19.90 1.16 135 XMStockSpam_06 3937 1.35 1.91 1.12 136 IN_HORDE_ADDRESS_BOOK 3838 0.80 0.06 1.09 137 DC_PNG_UNO_LARGO 3812 1.24 1.65 1.08 138 URI_HEX 3806 1.19 1.47 1.08 139 TooManyTo_004 3768 0.90 0.47 1.07 140 MSGID_NOFQDN1 3760 0.80 0.12 1.07 141 XM_ShortIntro_01 3754 0.87 0.39 1.07 142 T_TooManySym_03 3643 0.82 0.28 1.04 143 XMCapTrack 3620 0.86 0.44 1.03 144 TVD_RCVD_IP 3494 1.01 1.04 0.99 145 HTML_IMAGE_ONLY_32 3392 0.80 0.38 0.96 146 XM_E_Blogspot 3352 0.72 0.15 0.95 147 XM_OfRef6 3284 1.81 4.00 0.93 148 XMSexyCombo_05 3260 1.80 3.99 0.93 149 HTML_SHORT_LINK_IMG_1 3108 1.12 1.73 0.88 150 TR_XM_DK_SendGrid 3015 0.83 0.77 0.86 151 TooManyTo_005 3014 0.73 0.42 0.86 152 HTML_IMAGE_ONLY_04 3004 1.06 1.59 0.85 153 RCVD_IN_MSPIKE_BL 2982 1.97 4.78 0.85 154 TR_XM_MSPIKECOMBO 2982 1.97 4.78 0.85 155 TVD_SPACE_RATIO 2933 0.64 0.16 0.83 156 T_Symld_Words_02 2907 0.97 1.31 0.83 157 FROM_GOV_DKIM_AU 2831 0.73 0.53 0.80 158 TR_MetaPhish_Combo_01 2702 0.80 0.86 0.77 159 DKIM_ADSP_CUSTOM_MED 2699 0.82 0.96 0.77 160 T_XMDrugObfuBody_00 2673 1.15 2.13 0.76 161 XMGenDplmaNmb 2666 1.12 2.03 0.76 162 XM_H_Long_From02 2583 0.96 1.52 0.73 163 T_FILL_THIS_FORM_SHORT 2552 1.18 2.33 0.73 164 SpammyFromTLD_01 2509 1.04 1.86 0.71 165 XMLngstWrd_00 2395 0.61 0.42 0.68 166 XM_B_SpammyWords4 2348 1.11 2.21 0.67 167 T_TVD_MIME_NO_HEADERS 2341 0.49 0.04 0.67 168 RCVD_IN_PBL 2340 0.89 1.44 0.67 169 XMGappySubj_02 2331 0.49 0.04 0.66 170 RCVD_IN_MSPIKE_L3 2295 1.20 2.58 0.65 171 XMBrknScrpt_02 2248 0.89 1.52 0.64 172 RELAYCOUNTRY_GB 2223 0.73 0.98 0.63 173 XM_B_COPY_HTML 2204 0.92 1.65 0.63 174 HTTPS_HTTP_MISMATCH 2166 0.73 1.03 0.62 175 XM_H_PHPMailer 2123 0.60 0.57 0.60 176 RELAYCOUNTRY_CA 2116 2.31 6.59 0.60 177 MAY_BE_FORGED 2105 0.43 0.01 0.60 178 TR_XM_PHPDW 2019 0.73 1.13 0.57 179 TR_XM_PHPForged 2017 0.74 1.14 0.57 180 TR_XM_FormFill2 2011 0.73 1.13 0.57 181 XMNoVowels 2006 0.57 0.58 0.57 182 XM_H_PHPOS 1995 0.72 1.10 0.57 183 TR_XM_Base64_M1 1962 0.64 0.83 0.56 184 SpammyFromTLD_02 1950 1.31 3.18 0.55 185 T_OBFU_PDF_ATTACH 1889 0.43 0.18 0.54 186 URI_TRY_3LD 1869 0.76 1.34 0.53 187 NML_ADSP_CUSTOM_MED 1759 0.60 0.85 0.50 188 MPART_ALT_DIFF_COUNT 1749 0.67 1.10 0.50 189 RCVD_IN_BL_SPAMCOP_NET 1719 3.09 9.60 0.49 190 CONTENT_AFTER_HTML_WEAK 1716 0.35 0.02 0.49 191 XMPhish30 1670 0.76 1.48 0.47 192 XM_ProductURIs 1652 0.79 1.59 0.47 193 FORGED_GMAIL_RCVD 1650 0.52 0.66 0.47 194 T_XMHurry_00 1639 0.92 2.05 0.47 195 XMBSHREFv2 1626 0.41 0.29 0.46 196 HTML_TAG_BALANCE_BODY 1597 0.63 1.07 0.45 197 XMPhish14 1585 0.61 1.01 0.45 198 XMLngstWrd_01 1565 0.43 0.38 0.44 199 TO_NO_BRKTS_HTML_ONLY 1564 0.46 0.49 0.44 200 LongTLD 1559 0.60 1.01 0.44 ----------------------------------------------------------------------