Email: 582202 Autolearn: 0 AvgScore: 5.12 AvgScanTime: 1.55 sec Spam: 205338 Autolearn: 0 AvgScore: 12.64 AvgScanTime: 1.68 sec Ham: 376864 Autolearn: 0 AvgScore: 1.03 AvgScanTime: 1.48 sec Time Spent Running SA: 250.46 hours Time Spent Processing Spam: 95.91 hours Time Spent Processing Ham: 154.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 205061 99.65 99.87 99.54 2 HTML_MESSAGE 200829 91.59 97.80 88.21 3 XM_B_Unicode 183055 78.91 89.15 73.33 4 DKIM_SIGNED 167901 80.47 81.77 79.77 5 XM_DK_Pass 160366 78.35 78.10 78.48 6 DKIM_VALID 159032 77.50 77.45 77.53 7 RELAYCOUNTRY_US 156250 80.36 76.09 82.68 8 XM_B_SpammyWords 149980 56.68 73.04 47.76 9 DCC_CHECK 134797 46.61 65.65 36.23 10 XMListUnsubscribeExists 129838 57.65 63.23 54.61 11 DKIM_VALID_AU 126311 63.08 61.51 63.93 12 XM_B_Unicode3 92767 43.80 45.18 43.04 13 LOC_TINY_FONT_1 90848 36.14 44.24 31.72 14 BAYES_99 83179 17.09 40.51 4.34 15 XM_DK_Undo_02 82242 17.76 40.05 5.62 16 HTML_FONT_LOW_CONTRAST 77217 31.57 37.60 28.28 17 XM_B_SpammyWords2 74642 25.82 36.35 20.08 18 BAYES_50 72941 51.89 35.52 60.80 19 FVGT_m_MULTI_ODD 70628 30.15 34.40 27.84 20 DCC_CHECK_NEGATIVE 70426 53.33 34.30 63.70 21 BAYES_999 68935 14.01 33.57 3.36 22 XMSubLong 67302 26.80 32.78 23.55 23 MIME_HTML_ONLY 65541 23.86 31.92 19.46 24 DKIM_VALID_EF 58321 29.65 28.40 30.34 25 TR_XM_DKIM_Undo 55181 10.90 26.87 2.20 26 T_KAM_HTML_FONT_INVALID 52896 24.50 25.76 23.81 27 XM_Multi_Part_URI 48110 18.00 23.43 15.05 28 RCVD_IN_MSPIKE_H2 44848 17.96 21.84 15.85 29 TR_XM_DK_Unsub 44507 17.15 21.67 14.69 30 TR_DCC_Bayes_99 41719 7.92 20.32 1.16 31 XM_B_Phish_Phrases 40520 10.79 19.73 5.92 32 UNPARSEABLE_RELAY 39346 14.32 19.16 11.68 33 T_TM2_M_HEADER_IN_MSG 37979 24.91 18.50 28.41 34 LOTS_OF_MONEY 35979 11.69 17.52 8.52 35 XM_B_Unsub 34160 12.03 16.64 9.52 36 TR_XM_BayesUnsub 33110 10.65 16.12 7.67 37 XM_H_Long_From01 31466 9.38 15.32 6.14 38 TR_XM_SpammyWords4 31216 8.94 15.20 5.52 39 TM2_M_URI_OPT_OUT 28071 6.47 13.67 2.55 40 TR_MAX_INTL_RELAY 27773 9.67 13.53 7.57 41 RELAYCOUNTRY_META 27527 7.14 13.41 3.73 42 XM_B_SpammyWords3 25770 7.89 12.55 5.36 43 ALL_TRUSTED 25393 13.45 12.37 14.04 44 RCVD_IN_BL_SPAMCOP_NET 24772 4.82 12.06 0.87 45 RCVD_IN_MSPIKE_WL 23709 20.32 11.55 25.11 46 XM_B_SpammyTLD 22752 5.89 11.08 3.06 47 TR_XM_SpammyWords2 22727 4.09 11.07 0.29 48 TR_XM_UnparsRelay 20723 4.68 10.09 1.73 49 XM_Evil_Numbers_Gen 20683 9.20 10.07 8.73 50 TR_XM_SpammyRelay 19512 4.61 9.50 1.95 51 BOTNET_IPINHOSTNAME 19430 5.50 9.46 3.34 52 MIME_HEADER_CTYPE_ONLY 19195 3.51 9.35 0.33 53 TO_IN_SUBJ 19069 3.30 9.29 0.03 54 BAYES_80 16770 5.96 8.17 4.75 55 FSL_BULK_SIG 16242 5.36 7.91 3.97 56 TR_XM_SPAMCOP 16104 2.98 7.84 0.32 57 BOTNET 16072 3.59 7.83 1.27 58 BAYES_60 15921 8.25 7.75 8.51 59 TR_LOTS_OF_MONEY3 14978 4.49 7.29 2.96 60 RCVD_IN_MSPIKE_BL 13881 3.33 6.76 1.47 61 TR_XM_MSPIKECOMBO 13836 3.32 6.74 1.46 62 XM_B_PhoneNumber 13102 8.66 6.38 9.90 63 LotsOfNums_01 12444 8.49 6.06 9.81 64 RCVD_IN_MSPIKE_H3 11618 8.90 5.66 10.67 65 XM_H_GMP 11249 5.15 5.48 4.96 66 XMStrtUSub 11037 5.64 5.38 5.79 67 UNTRUSTED_Relay 11031 3.04 5.37 1.77 68 HTML_IMAGE_RATIO_02 10278 5.07 5.01 5.11 69 MPART_ALT_DIFF 10227 4.50 4.98 4.24 70 BAYES_95 10065 3.55 4.90 2.82 71 HTML_IMAGE_RATIO_04 9763 4.37 4.75 4.16 72 XMSubMetaSx_00 9743 3.64 4.74 3.03 73 RCVD_IN_MSPIKE_L3 9741 2.51 4.74 1.29 74 XM_UncommonTLD01 9201 3.89 4.48 3.56 75 DKIM_INVALID 8869 2.97 4.32 2.24 76 TR_XM_SpammyWords3 8746 1.94 4.26 0.68 77 RELAYCOUNTRY_CA 8437 1.84 4.11 0.61 78 TR_XM_PhishingBody 8181 2.58 3.98 1.82 79 XM_B_Investor 8062 2.43 3.93 1.62 80 XM_Body_Dirty_Words 7998 3.10 3.90 2.67 81 XMNumbers 7416 3.53 3.61 3.49 82 XM_B_Unsub2 7183 2.23 3.50 1.54 83 XM_URI_RBL 7158 1.47 3.49 0.38 84 TR_XM_SpammyWords5 7115 2.42 3.47 1.86 85 T_XMDrugObfuBody_14 7063 2.12 3.44 1.40 86 MIME_HTML_MOSTLY 6862 2.52 3.34 2.07 87 XM_OfRef6 6824 1.71 3.32 0.83 88 RCVD_IN_MSPIKE_H4 6714 4.64 3.27 5.38 89 TR_XM_MSPIKECOMBO2 6661 1.22 3.24 0.12 90 BOUNCE_MESSAGE 6559 3.34 3.19 3.42 91 ANY_BOUNCE_MESSAGE 6559 3.34 3.19 3.42 92 TM2_M_VERY_LONG_WORD 6453 2.08 3.14 1.50 93 T_XMHurry_00 6277 1.97 3.06 1.37 94 XMBody_17 6190 1.39 3.01 0.50 95 XMDiploma_00 6143 2.30 2.99 1.92 96 T_XMDrugObfuBody_08 6132 2.02 2.99 1.49 97 TooManyTo_001 6131 5.75 2.99 7.26 98 HTML_IMAGE_RATIO_06 5906 3.28 2.88 3.51 99 USER_IN_DEF_DKIM_WL 5804 10.00 2.83 13.91 100 XMSexyCombo_05 5787 1.63 2.82 0.99 101 MIME_QP_LONG_LINE 5541 5.16 2.70 6.50 102 URI_HEX 5429 1.85 2.64 1.41 103 RCVD_IN_MSPIKE_H5 5377 6.79 2.62 9.06 104 XM_CamelCaseFrm001 5348 2.12 2.60 1.86 105 XM_SPF_SoftFail 5258 1.66 2.56 1.17 106 T_REMOTE_IMAGE 5203 3.09 2.53 3.39 107 TR_XM_MaxSPIKE 5171 0.96 2.52 0.11 108 HTML_IMAGE_RATIO_08 5155 2.90 2.51 3.11 109 XM_B_URI_Unicode 5088 2.03 2.48 1.78 110 RELAYCOUNTRY_AU 5028 1.25 2.45 0.60 111 TR_XM_NoHeaderRelay 4857 0.95 2.37 0.19 112 T_TooManySym_01 4766 4.85 2.32 6.23 113 XMStockSpam_06 4620 1.39 2.25 0.92 114 XM_UB50 4539 1.57 2.21 1.22 115 KHOP_HELO_FCRDNS 4488 1.40 2.19 0.98 116 T_XMDrugObfuBody_00 4456 1.45 2.17 1.06 117 MIME_HTML_ONLY_MULTI 4283 2.36 2.09 2.51 118 T_FILL_THIS_FORM_SHORT 4264 1.30 2.08 0.88 119 XM_B_SpammyWords4 4237 1.41 2.06 1.06 120 RCVD_IN_IADB_LISTED 4193 3.55 2.04 4.37 121 TR_XM_INV_DKIM 4035 0.70 1.97 0.01 122 T_Symld_Words_02 3943 1.24 1.92 0.86 123 SUBJ_ALL_CAPS 3919 1.74 1.91 1.64 124 XM_HighProb1 3879 0.67 1.89 0.00 125 MAILING_LIST_MULTI 3797 2.87 1.85 3.43 126 TR_XM_GMP_BULK_SIG 3766 0.71 1.83 0.09 127 RCVD_IN_MSPIKE_L4 3645 0.72 1.78 0.15 128 RELAYCOUNTRY_FR 3513 0.82 1.71 0.34 129 XMGenDplmaNmb 3443 1.19 1.68 0.93 130 THIS_AD 3423 0.86 1.67 0.43 131 RCVD_IN_IADB_SPF 3338 3.10 1.63 3.90 132 SpammyFromTLD_02 3259 0.89 1.59 0.51 133 TR_LOTS_OF_MONEY2 3208 0.74 1.56 0.29 134 T_MONEY_PERCENT 3208 0.74 1.56 0.29 135 XM_B_Phish66 3180 0.93 1.55 0.59 136 RCVD_IN_VALIDITY_RPBL 3127 0.64 1.52 0.16 137 RCVD_IN_IADB_VOUCHED 3032 2.30 1.48 2.74 138 URI_NOVOWEL 2984 1.33 1.45 1.26 139 RCVD_IN_IADB_DK 2962 2.68 1.44 3.35 140 RCVD_IN_IADB_SENDERID 2917 2.78 1.42 3.52 141 XMSubMetaI_00 2874 0.96 1.40 0.72 142 XMPhish30 2848 0.81 1.39 0.49 143 BAYES_40 2823 3.43 1.37 4.54 144 XMBrknScrpt_02 2807 1.22 1.37 1.14 145 XM_UB99 2755 0.47 1.34 0.00 146 XM_DK_Undo_01 2738 1.70 1.33 1.90 147 RCVD_IN_VALIDITY_SAFE 2606 3.43 1.27 4.61 148 HTML_IMAGE_ONLY_24 2594 0.62 1.26 0.26 149 XM_ProductURIs 2529 0.77 1.23 0.52 150 HK_RANDOM_REPLYTO 2529 0.51 1.23 0.11 151 MPART_ALT_DIFF_COUNT 2477 0.72 1.21 0.46 152 XM_SendGrid 2398 1.47 1.17 1.64 153 XM_H_Long_From02 2381 1.08 1.16 1.04 154 RDNS_DYNAMIC 2340 0.48 1.14 0.13 155 SHOPIFY_IMG_NOT_RCVD_SFY 2314 0.50 1.13 0.16 156 HTML_MIME_NO_HTML_TAG 2283 1.90 1.11 2.32 157 TM2_M_A_HREF_HREF 2207 0.59 1.07 0.32 158 HTTPS_HTTP_MISMATCH 2196 0.83 1.07 0.70 159 XMBody_78 2154 0.63 1.05 0.39 160 FROM_EXCESS_BASE64 2152 1.44 1.05 1.65 161 LOW_PRICE 2144 0.52 1.04 0.23 162 XM_B_SEO 2131 0.52 1.04 0.24 163 RCVD_IN_IADB_OPTIN 2098 1.57 1.02 1.87 164 BOTNET_NORDNS 2005 0.35 0.98 0.01 165 TR_XM_FormFill 1992 0.35 0.97 0.01 166 RCVD_IN_PSBL 1945 0.35 0.95 0.02 167 TVD_RCVD_IP 1929 0.87 0.94 0.84 168 XM_B_COPY_HTML 1926 0.70 0.94 0.57 169 TR_XM_SEO4 1910 0.41 0.93 0.12 170 URI_TRY_3LD 1910 0.69 0.93 0.56 171 BAYES_20 1892 2.41 0.92 3.22 172 MIXED_HREF_CASE 1892 0.39 0.92 0.10 173 SpammyFromTLD_01 1880 0.77 0.92 0.68 174 XM_GoogleGroups 1868 1.15 0.91 1.28 175 DEAR_FRIEND 1838 0.49 0.90 0.28 176 XM_B_DNDMA 1808 0.67 0.88 0.56 177 HELO_DYNAMIC_SPLIT_IP 1799 0.32 0.88 0.02 178 TR_XM_RelayPhish 1797 0.38 0.88 0.11 179 TR_XM_DK_SendGrid 1701 1.06 0.83 1.18 180 XM_B_REG_HTML 1586 0.42 0.77 0.23 181 XMHTML_After_End 1584 0.48 0.77 0.32 182 MultiRelay_CC 1575 0.38 0.77 0.17 183 T_TooManySym_02 1572 2.09 0.77 2.81 184 RELAYCOUNTRY_GB 1570 0.73 0.76 0.71 185 XMBdyGiftCard01 1561 0.79 0.76 0.81 186 DKIM_ADSP_CUSTOM_MED 1557 0.73 0.76 0.71 187 RCVD_IN_VALIDITY_CERTIFIED 1555 2.84 0.76 3.97 188 HK_RANDOM_FROM 1535 0.34 0.75 0.12 189 DIET_1 1516 0.53 0.74 0.42 190 TR_MetaPhish_Combo_01 1477 0.70 0.72 0.69 191 TR_XM_InvalidRelay 1477 0.26 0.72 0.01 192 XM_UB999 1456 0.25 0.71 0.00 193 XMClaimOffer 1422 0.35 0.69 0.16 194 DKIM_ADSP_NXDOMAIN 1415 0.45 0.69 0.32 195 NO_DNS_FOR_FROM 1394 0.39 0.68 0.23 196 TR_BOTNET_NEGATE 1385 0.34 0.67 0.15 197 XM_UB60 1380 0.38 0.67 0.22 198 TR_Symld_Words 1374 1.07 0.67 1.28 199 URIBL_BLACK 1368 0.24 0.67 0.02 200 TR_Mismatch_TLD_02 1348 0.29 0.66 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 375131 99.65 99.87 99.54 2 HTML_MESSAGE 332419 91.59 97.80 88.21 3 RELAYCOUNTRY_US 311594 80.36 76.09 82.68 4 DKIM_SIGNED 300614 80.47 81.77 79.77 5 XM_DK_Pass 295777 78.35 78.10 78.48 6 DKIM_VALID 292172 77.50 77.45 77.53 7 XM_B_Unicode 276344 78.91 89.15 73.33 8 DKIM_VALID_AU 240918 63.08 61.51 63.93 9 DCC_CHECK_NEGATIVE 240050 53.33 34.30 63.70 10 BAYES_50 229139 51.89 35.52 60.80 11 XMListUnsubscribeExists 205808 57.65 63.23 54.61 12 XM_B_SpammyWords 180002 56.68 73.04 47.76 13 XM_B_Unicode3 162215 43.80 45.18 43.04 14 DCC_CHECK 136540 46.61 65.65 36.23 15 LOC_TINY_FONT_1 119552 36.14 44.24 31.72 16 DKIM_VALID_EF 114327 29.65 28.40 30.34 17 T_TM2_M_HEADER_IN_MSG 107055 24.91 18.50 28.41 18 HTML_FONT_LOW_CONTRAST 106576 31.57 37.60 28.28 19 FVGT_m_MULTI_ODD 104911 30.15 34.40 27.84 20 RCVD_IN_MSPIKE_WL 94614 20.32 11.55 25.11 21 T_KAM_HTML_FONT_INVALID 89725 24.50 25.76 23.81 22 XMSubLong 88748 26.80 32.78 23.55 23 XM_B_SpammyWords2 75691 25.82 36.35 20.08 24 MIME_HTML_ONLY 73346 23.86 31.92 19.46 25 RCVD_IN_MSPIKE_H2 59718 17.96 21.84 15.85 26 XM_Multi_Part_URI 56703 18.00 23.43 15.05 27 TR_XM_DK_Unsub 55368 17.15 21.67 14.69 28 ALL_TRUSTED 52901 13.45 12.37 14.04 29 USER_IN_DEF_DKIM_WL 52427 10.00 2.83 13.91 30 UNPARSEABLE_RELAY 44035 14.32 19.16 11.68 31 RCVD_IN_MSPIKE_H3 40207 8.90 5.66 10.67 32 XM_B_PhoneNumber 37301 8.66 6.38 9.90 33 LotsOfNums_01 36974 8.49 6.06 9.81 34 XM_B_Unsub 35883 12.03 16.64 9.52 35 BAYES_00 34273 6.04 0.42 9.09 36 RCVD_IN_MSPIKE_H5 34126 6.79 2.62 9.06 37 XM_Evil_Numbers_Gen 32895 9.20 10.07 8.73 38 LOTS_OF_MONEY 32096 11.69 17.52 8.52 39 BAYES_60 32087 8.25 7.75 8.51 40 TR_XM_BayesUnsub 28922 10.65 16.12 7.67 41 TR_MAX_INTL_RELAY 28541 9.67 13.53 7.57 42 TooManyTo_001 27355 5.75 2.99 7.26 43 XM_DKIMWhitelistDomains 25749 4.45 0.08 6.83 44 TR_XM_DK_Bayes 24839 4.37 0.29 6.59 45 MIME_QP_LONG_LINE 24505 5.16 2.70 6.50 46 TR_XM_DK_Bayes1 24434 4.30 0.28 6.48 47 T_TooManySym_01 23471 4.85 2.32 6.23 48 XM_H_Long_From01 23126 9.38 15.32 6.14 49 XM_B_Phish_Phrases 22315 10.79 19.73 5.92 50 XMStrtUSub 21803 5.64 5.38 5.79 51 XM_DK_Undo_02 21170 17.76 40.05 5.62 52 TR_XM_SpammyWords4 20816 8.94 15.20 5.52 53 TR_XM_DK_Bayes2 20382 3.58 0.22 5.41 54 RCVD_IN_MSPIKE_H4 20281 4.64 3.27 5.38 55 XM_B_SpammyWords3 20187 7.89 12.55 5.36 56 HTML_IMAGE_RATIO_02 19254 5.07 5.01 5.11 57 XM_H_GMP 18709 5.15 5.48 4.96 58 BAYES_80 17910 5.96 8.17 4.75 59 RCVD_IN_VALIDITY_SAFE 17387 3.43 1.27 4.61 60 BAYES_40 17120 3.43 1.37 4.54 61 RCVD_IN_IADB_LISTED 16476 3.55 2.04 4.37 62 BAYES_99 16348 17.09 40.51 4.34 63 MPART_ALT_DIFF 15979 4.50 4.98 4.24 64 HTML_IMAGE_RATIO_04 15680 4.37 4.75 4.16 65 FSL_BULK_SIG 14971 5.36 7.91 3.97 66 RCVD_IN_VALIDITY_CERTIFIED 14968 2.84 0.76 3.97 67 XM_PDF 14891 2.74 0.51 3.95 68 RCVD_IN_IADB_SPF 14685 3.10 1.63 3.90 69 RELAYCOUNTRY_META 14061 7.14 13.41 3.73 70 XM_UncommonTLD01 13419 3.89 4.48 3.56 71 RCVD_IN_IADB_SENDERID 13253 2.78 1.42 3.52 72 HTML_IMAGE_RATIO_06 13213 3.28 2.88 3.51 73 XMNumbers 13153 3.53 3.61 3.49 74 MAILING_LIST_MULTI 12936 2.87 1.85 3.43 75 ANY_BOUNCE_MESSAGE 12885 3.34 3.19 3.42 76 BOUNCE_MESSAGE 12883 3.34 3.19 3.42 77 T_REMOTE_IMAGE 12773 3.09 2.53 3.39 78 BAYES_999 12649 14.01 33.57 3.36 79 RCVD_IN_IADB_DK 12626 2.68 1.44 3.35 80 BOTNET_IPINHOSTNAME 12577 5.50 9.46 3.34 81 BAYES_20 12131 2.41 0.92 3.22 82 HTML_IMAGE_RATIO_08 11733 2.90 2.51 3.11 83 XM_B_SpammyTLD 11534 5.89 11.08 3.06 84 XMSubMetaSx_00 11426 3.64 4.74 3.03 85 TR_LOTS_OF_MONEY3 11142 4.49 7.29 2.96 86 BAYES_95 10623 3.55 4.90 2.82 87 T_TooManySym_02 10599 2.09 0.77 2.81 88 RCVD_IN_IADB_VOUCHED 10333 2.30 1.48 2.74 89 XM_Body_Dirty_Words 10068 3.10 3.90 2.67 90 TM2_M_URI_OPT_OUT 9620 6.47 13.67 2.55 91 MIME_HTML_ONLY_MULTI 9444 2.36 2.09 2.51 92 HTML_MIME_NO_HTML_TAG 8760 1.90 1.11 2.32 93 DKIM_INVALID 8442 2.97 4.32 2.24 94 TR_XM_DKIM_Undo 8308 10.90 26.87 2.20 95 TO_MALFORMED 7937 1.37 0.03 2.11 96 TooManyTo_002 7911 1.50 0.40 2.10 97 MIME_HTML_MOSTLY 7818 2.52 3.34 2.07 98 TR_XM_SpammyRelay 7350 4.61 9.50 1.95 99 BAYES_05 7230 1.39 0.43 1.92 100 XMDiploma_00 7227 2.30 2.99 1.92 101 XM_DK_Undo_01 7178 1.70 1.33 1.90 102 INVALID_MSGID 7166 1.30 0.18 1.90 103 RCVD_IN_IADB_OPTIN 7065 1.57 1.02 1.87 104 XM_CamelCaseFrm001 7015 2.12 2.60 1.86 105 TR_XM_SpammyWords5 6992 2.42 3.47 1.86 106 TR_XM_PhishingBody 6846 2.58 3.98 1.82 107 XM_B_URI_Unicode 6711 2.03 2.48 1.78 108 UNTRUSTED_Relay 6686 3.04 5.37 1.77 109 TR_XM_UnparsRelay 6532 4.68 10.09 1.73 110 FROM_EXCESS_BASE64 6222 1.44 1.05 1.65 111 SUBJ_ALL_CAPS 6185 1.74 1.91 1.64 112 XM_SendGrid 6172 1.47 1.17 1.64 113 XM_B_Investor 6094 2.43 3.93 1.62 114 XM_B_Unsub2 5822 2.23 3.50 1.54 115 TM2_M_VERY_LONG_WORD 5661 2.08 3.14 1.50 116 T_XMDrugObfuBody_08 5614 2.02 2.99 1.49 117 RCVD_IN_MSPIKE_BL 5534 3.33 6.76 1.47 118 HELO_NODOT 5502 1.10 0.44 1.46 119 TR_XM_MSPIKECOMBO 5501 3.32 6.74 1.46 120 HELO_NO_DOMAIN 5496 1.10 0.44 1.46 121 URI_HEX 5314 1.85 2.64 1.41 122 T_XMDrugObfuBody_14 5276 2.12 3.44 1.40 123 T_XMHurry_00 5171 1.97 3.06 1.37 124 TooManyTo_003 5024 0.97 0.32 1.33 125 IN_HORDE_ADDRESS_BOOK 4962 0.87 0.06 1.32 126 RCVD_IN_MSPIKE_L3 4859 2.51 4.74 1.29 127 TR_Symld_Words 4833 1.07 0.67 1.28 128 XM_GoogleGroups 4818 1.15 0.91 1.28 129 BOTNET 4804 3.59 7.83 1.27 130 URI_NOVOWEL 4758 1.33 1.45 1.26 131 XM_UB50 4583 1.57 2.21 1.22 132 XMGappySubj_01 4549 0.83 0.14 1.21 133 TR_XM_DK_SendGrid 4459 1.06 0.83 1.18 134 XM_SPF_SoftFail 4393 1.66 2.56 1.17 135 TR_DCC_Bayes_99 4388 7.92 20.32 1.16 136 T_TooManySym_03 4376 0.83 0.23 1.16 137 XMBrknScrpt_02 4289 1.22 1.37 1.14 138 T_XMDrugObfuBody_00 4005 1.45 2.17 1.06 139 XM_B_SpammyWords4 3992 1.41 2.06 1.06 140 FROM_GOV_DKIM_AU 3937 0.72 0.12 1.04 141 XM_H_Long_From02 3927 1.08 1.16 1.04 142 XMSexyCombo_05 3726 1.63 2.82 0.99 143 KHOP_HELO_FCRDNS 3687 1.40 2.19 0.98 144 TooManyTo_004 3662 0.72 0.25 0.97 145 XMGenDplmaNmb 3508 1.19 1.68 0.93 146 XMCapTrack 3505 0.79 0.53 0.93 147 XMStockSpam_06 3474 1.39 2.25 0.92 148 XM_ShortIntro_01 3384 0.71 0.37 0.90 149 T_FILL_THIS_FORM_SHORT 3322 1.30 2.08 0.88 150 RCVD_IN_BL_SPAMCOP_NET 3290 4.82 12.06 0.87 151 T_Symld_Words_02 3254 1.24 1.92 0.86 152 TVD_RCVD_IP 3156 0.87 0.94 0.84 153 XM_OfRef6 3142 1.71 3.32 0.83 154 XMBdyGiftCard01 3043 0.79 0.76 0.81 155 TooManyTo_005 3001 0.60 0.23 0.80 156 TR_XM_Base64_M1 2807 0.64 0.44 0.74 157 XM_Body_Obfu01 2755 0.68 0.60 0.73 158 XMSubMetaI_00 2698 0.96 1.40 0.72 159 TVD_SPACE_RATIO 2698 0.52 0.15 0.72 160 XM_H_PHPMailer 2688 0.56 0.28 0.71 161 DKIM_ADSP_CUSTOM_MED 2671 0.73 0.76 0.71 162 RELAYCOUNTRY_GB 2663 0.73 0.76 0.71 163 HTTPS_HTTP_MISMATCH 2648 0.83 1.07 0.70 164 TR_MetaPhish_Combo_01 2616 0.70 0.72 0.69 165 SpammyFromTLD_01 2581 0.77 0.92 0.68 166 TR_XM_SpammyWords3 2574 1.94 4.26 0.68 167 TO_NO_BRKTS_HTML_ONLY 2500 0.48 0.15 0.66 168 XMBSHREFv2 2462 0.64 0.61 0.65 169 XMNoVowels 2412 0.58 0.47 0.64 170 PLING_QUERY 2374 0.63 0.63 0.63 171 RELAYCOUNTRY_CA 2301 1.84 4.11 0.61 172 HTML_TAG_BALANCE_BODY 2278 0.62 0.65 0.60 173 RELAYCOUNTRY_AU 2277 1.25 2.45 0.60 174 HTML_IMAGE_ONLY_20 2270 0.59 0.57 0.60 175 XM_B_Phish66 2235 0.93 1.55 0.59 176 XM_B_COPY_HTML 2143 0.70 0.94 0.57 177 XM_B_DNDMA 2118 0.67 0.88 0.56 178 URI_TRY_3LD 2115 0.69 0.93 0.56 179 T_OBFU_PDF_ATTACH 2045 0.38 0.07 0.54 180 TR_XM_PHPDW 2002 0.50 0.43 0.53 181 TR_XM_FormFill2 1967 0.49 0.43 0.52 182 TR_XM_PHPForged 1963 0.49 0.44 0.52 183 XM_ProductURIs 1950 0.77 1.23 0.52 184 XM_H_PHPOS 1939 0.48 0.41 0.51 185 SpammyFromTLD_02 1930 0.89 1.59 0.51 186 XMGappySubj_02 1918 0.35 0.05 0.51 187 MSGID_FROM_MTA_HEADER 1900 0.44 0.32 0.50 188 XMBody_17 1891 1.39 3.01 0.50 189 XMPhish30 1847 0.81 1.39 0.49 190 MISSING_HEADERS 1788 0.48 0.49 0.47 191 SHORT_HELO_AND_INLINE_IMAGE 1753 0.34 0.12 0.47 192 MPART_ALT_DIFF_COUNT 1737 0.72 1.21 0.46 193 XMSlimDrugH 1717 0.46 0.48 0.46 194 LongTLD 1705 0.46 0.46 0.45 195 FORGED_GMAIL_RCVD 1694 0.51 0.63 0.45 196 BASE64_LENGTH_79_INF 1682 0.33 0.12 0.45 197 XMSolicitRefs_0 1675 0.50 0.61 0.44 198 XMMoneyMeta_00 1659 0.45 0.48 0.44 199 XMBody_95 1623 0.33 0.14 0.43 200 XMLngstWrd_00 1610 0.47 0.56 0.43 ----------------------------------------------------------------------