Email: 514063 Autolearn: 0 AvgScore: 3.15 AvgScanTime: 1.44 sec Spam: 145725 Autolearn: 0 AvgScore: 13.07 AvgScanTime: 1.57 sec Ham: 368338 Autolearn: 0 AvgScore: -0.77 AvgScanTime: 1.39 sec Time Spent Running SA: 205.72 hours Time Spent Processing Spam: 63.42 hours Time Spent Processing Ham: 142.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136905 88.17 93.95 85.89 2 DKIM_SIGNED 131314 76.85 90.11 71.61 3 XM_DK_Pass 126393 74.95 86.73 70.29 4 DKIM_VALID 125150 74.11 85.88 69.45 5 XM_B_Unicode 121116 74.01 83.11 70.41 6 RELAYCOUNTRY_US 119474 79.89 81.99 79.07 7 T_SCC_BODY_TEXT_LINE 115945 82.13 79.56 83.14 8 XM_B_SpammyWords 103232 50.99 70.84 43.13 9 XMListUnsubscribeExists 102066 54.31 70.04 48.09 10 DCC_CHECK 100786 42.41 69.16 31.83 11 DKIM_VALID_AU 96360 58.13 66.12 54.96 12 XM_B_Unicode3 67678 42.14 46.44 40.44 13 XM_DK_Undo_02 63025 16.68 43.25 6.17 14 LOC_TINY_FONT_1 58065 28.70 39.85 24.30 15 XM_B_SpammyWords2 57771 24.30 39.64 18.23 16 BAYES_50 56704 51.67 38.91 56.72 17 HTML_FONT_LOW_CONTRAST 53443 29.99 36.67 27.35 18 BAYES_99 48296 13.28 33.14 5.42 19 TR_XM_DKIM_Undo 48128 11.00 33.03 2.28 20 FVGT_m_MULTI_ODD 46925 25.55 32.20 22.93 21 DCC_CHECK_NEGATIVE 44917 57.55 30.82 68.13 22 MIME_HTML_ONLY 44106 24.58 30.27 22.33 23 DKIM_VALID_EF 43032 27.96 29.53 27.34 24 RCVD_IN_MSPIKE_H2 40286 25.44 27.65 24.57 25 T_KAM_HTML_FONT_INVALID 38604 22.01 26.49 20.23 26 BAYES_999 38187 10.58 26.20 4.39 27 TR_DCC_Bayes_99 33117 7.82 22.73 1.93 28 T_TM2_M_HEADER_IN_MSG 32650 23.59 22.41 24.06 29 XMSubLong 31206 21.12 21.41 21.00 30 TR_XM_DK_Unsub 29949 15.13 20.55 12.98 31 XM_Multi_Part_URI 29228 15.46 20.06 13.65 32 RELAYCOUNTRY_META 26057 7.96 17.88 4.04 33 XM_B_Unsub 24348 11.60 16.71 9.57 34 TR_XM_BayesUnsub 23397 9.10 16.06 6.34 35 UNPARSEABLE_RELAY 22338 11.87 15.33 10.50 36 TR_MAX_INTL_RELAY 21103 8.69 14.48 6.40 37 TR_XM_SpammyRelay 20255 5.44 13.90 2.09 38 XM_B_SpammyWords3 19649 7.18 13.48 4.69 39 BOTNET_IPINHOSTNAME 19614 7.03 13.46 4.49 40 TR_XM_SpammyWords2 18425 3.87 12.64 0.40 41 LOTS_OF_MONEY 18266 7.77 12.53 5.88 42 TR_XM_SpammyWords4 16331 5.96 11.21 3.88 43 RCVD_IN_BL_SPAMCOP_NET 16225 3.71 11.13 0.78 44 BOTNET 14307 3.69 9.82 1.26 45 XM_Evil_Numbers_Gen 14293 8.43 9.81 7.88 46 XM_Body_Dirty_Words 13694 5.25 9.40 3.61 47 BAYES_80 12979 5.33 8.91 3.92 48 TR_XM_SPAMCOP 12152 2.66 8.34 0.41 49 RELAYCOUNTRY_CA 11640 3.02 7.99 1.06 50 BAYES_60 11400 8.43 7.82 8.67 51 TR_XM_UnparsRelay 11181 3.38 7.67 1.68 52 FSL_BULK_SIG 11156 4.73 7.66 3.57 53 LotsOfNums_01 10917 8.23 7.49 8.53 54 XM_UncommonTLD01 9998 4.86 6.86 4.07 55 HTML_IMAGE_RATIO_02 9876 5.62 6.78 5.16 56 RCVD_IN_MSPIKE_WL 9417 6.00 6.46 5.82 57 RCVD_IN_MSPIKE_H3 9417 6.00 6.46 5.82 58 XM_SPF_SoftFail 9344 3.65 6.41 2.56 59 MPART_ALT_DIFF 9185 7.92 6.30 8.56 60 XMNumbers 8994 4.10 6.17 3.27 61 XMSubMetaSx_00 8864 4.59 6.08 4.00 62 TooManyTo_001 8717 7.13 5.98 7.58 63 UNTRUSTED_Relay 8519 2.68 5.85 1.43 64 XM_H_Long_From01 8484 5.46 5.82 5.32 65 HTML_IMAGE_RATIO_04 8121 4.68 5.57 4.33 66 XMSexyCombo_05 7504 2.66 5.15 1.67 67 TR_XM_SpammyWords5 7475 2.45 5.13 1.39 68 XM_B_Phish_Phrases 7190 3.66 4.93 3.15 69 BAYES_95 7184 3.17 4.93 2.48 70 XMBody_17 6837 1.65 4.69 0.45 71 XM_B_Investor 6772 2.43 4.65 1.56 72 XM_H_GMP 6512 5.25 4.47 5.56 73 TR_XM_PhishingBody 6279 2.35 4.31 1.58 74 DKIM_INVALID 6164 2.74 4.23 2.15 75 MIME_HTML_MOSTLY 6145 4.16 4.22 4.14 76 TR_XM_PHPDW 6108 1.49 4.19 0.42 77 TR_XM_PHPForged 6092 1.49 4.18 0.42 78 TR_XM_FormFill2 6008 1.46 4.12 0.41 79 XM_H_PHPOS 5984 1.45 4.11 0.40 80 T_XMDrugObfuBody_14 5643 2.52 3.87 1.98 81 XM_B_SpammyTLD 5591 3.07 3.84 2.77 82 XMStrtUSub 5548 4.82 3.81 5.22 83 SpammyFromTLD_01 5516 1.55 3.79 0.67 84 HTML_IMAGE_RATIO_06 5450 2.77 3.74 2.39 85 T_XMDrugObfuBody_08 5123 2.14 3.52 1.60 86 TM2_M_URI_OPT_OUT 5090 4.31 3.49 4.63 87 MIME_HTML_ONLY_MULTI 4899 4.52 3.36 4.98 88 TM2_M_VERY_LONG_WORD 4655 1.78 3.19 1.23 89 XM_OfRef6 4570 1.71 3.14 1.15 90 MIME_QP_LONG_LINE 4500 4.59 3.09 5.18 91 T_FILL_THIS_FORM_SHORT 4499 1.57 3.09 0.97 92 XM_B_SpammyWords4 4426 1.22 3.04 0.49 93 XM_URI_RBL 4362 0.97 2.99 0.17 94 RCVD_IN_VALIDITY_SAFE 4361 3.83 2.99 4.16 95 XM_CamelCaseFrm001 4053 2.31 2.78 2.12 96 FROM_EXCESS_BASE64 4022 2.18 2.76 1.96 97 XM_UB50 3905 1.38 2.68 0.86 98 SUBJ_ALL_CAPS 3845 1.74 2.64 1.39 99 RELAYCOUNTRY_AU 3817 1.47 2.62 1.01 100 SCC_BODY_URI_ONLY 3783 2.51 2.60 2.47 101 XMDiploma_00 3688 1.60 2.53 1.23 102 USER_IN_DEF_DKIM_WL 3675 9.29 2.52 11.97 103 HTML_IMAGE_RATIO_08 3591 1.95 2.46 1.74 104 BAYES_20 3545 3.27 2.43 3.60 105 XM_B_Unsub2 3460 1.54 2.37 1.21 106 RCVD_IN_VALIDITY_CERTIFIED 3399 3.23 2.33 3.59 107 TR_XM_NoHeaderRelay 3201 0.70 2.20 0.11 108 BAYES_40 3198 4.64 2.19 5.60 109 T_TooManySym_01 3133 3.96 2.15 4.68 110 BOTNET_NORDNS 3110 0.61 2.13 0.01 111 TM2_M_BODY_EMPTY 3040 0.99 2.09 0.55 112 XMBrknScrpt_02 2951 1.04 2.03 0.65 113 ANY_BOUNCE_MESSAGE 2947 3.93 2.02 4.69 114 BOUNCE_MESSAGE 2945 3.93 2.02 4.69 115 TR_LOTS_OF_MONEY3 2941 0.81 2.02 0.34 116 XMEmptyBody_01 2919 0.62 2.00 0.07 117 T_REMOTE_IMAGE 2758 3.27 1.89 3.81 118 XMMoneyMeta_00 2690 0.83 1.85 0.43 119 HTML_MIME_NO_HTML_TAG 2679 2.35 1.84 2.56 120 TR_XM_FormFill 2664 0.55 1.83 0.04 121 MAILING_LIST_MULTI 2583 2.32 1.77 2.54 122 XMStockSpam_06 2570 1.36 1.76 1.20 123 XM_DK_Undo_01 2550 1.71 1.75 1.70 124 RCVD_IN_PSBL 2505 0.68 1.72 0.27 125 SpammyFromTLD_02 2435 0.85 1.67 0.53 126 XM_SendGrid 2388 1.51 1.64 1.46 127 XMSubMetaI_00 2375 0.99 1.63 0.73 128 RCVD_IN_IADB_LISTED 2332 3.98 1.60 4.93 129 HTTPS_HTTP_MISMATCH 2283 0.92 1.57 0.66 130 XM_HighProb1 2238 0.44 1.54 0.00 131 TR_XM_INV_DKIM 2210 0.46 1.52 0.05 132 RELAYCOUNTRY_GB 2196 0.76 1.51 0.46 133 T_XMDrugObfuBody_00 2179 0.85 1.50 0.59 134 TR_XM_Base64_M1 2135 0.79 1.47 0.52 135 URI_HEX 2134 1.14 1.46 1.02 136 TR_XM_BayesRelay 2112 0.41 1.45 0.00 137 FONT_INVIS_LONG_LINE 2110 0.43 1.45 0.03 138 RCVD_IN_IADB_SPF 2085 3.53 1.43 4.35 139 XMPhish30 2051 0.88 1.41 0.67 140 KHOP_HELO_FCRDNS 2033 1.19 1.40 1.10 141 THIS_AD 2024 0.67 1.39 0.38 142 RCVD_IN_IADB_DK 1981 3.09 1.36 3.78 143 RCVD_IN_IADB_SENDERID 1964 3.17 1.35 3.90 144 XM_DIRTYINTL 1936 0.49 1.33 0.16 145 SHOPIFY_IMG_NOT_RCVD_SFY 1841 0.59 1.26 0.33 146 RDNS_DYNAMIC 1819 0.61 1.25 0.36 147 AC_BR_BONANZA 1819 0.43 1.25 0.10 148 HTML_TAG_BALANCE_BODY 1777 0.63 1.22 0.40 149 PLING_QUERY 1740 0.65 1.19 0.44 150 XMBdyGiftCard01 1731 0.77 1.19 0.61 151 TR_XM_InvalidRelay 1682 0.34 1.15 0.01 152 ALL_TRUSTED 1679 13.08 1.15 17.80 153 URI_NOVOWEL 1659 1.80 1.14 2.06 154 XM_UB99 1657 0.32 1.14 0.00 155 XMPhish14 1644 0.58 1.13 0.37 156 T_XMHurry_00 1636 0.68 1.12 0.50 157 RCVD_IN_VALIDITY_RPBL 1623 0.34 1.11 0.03 158 URI_TRY_3LD 1612 0.73 1.11 0.58 159 XM_B_Phish66 1612 0.50 1.11 0.25 160 XMGenDplmaNmb 1594 0.68 1.09 0.52 161 XM_H_PHPMailer 1536 0.72 1.05 0.59 162 XM_H_Undi_Recip 1526 0.41 1.05 0.16 163 XM_H_Long_From02 1522 1.02 1.04 1.02 164 XMReplyNow 1520 0.49 1.04 0.28 165 XMLngstWrd_00 1512 0.79 1.04 0.69 166 XM_B_DNDMA 1495 0.54 1.03 0.35 167 TR_Mismatch_TLD_02 1487 0.34 1.02 0.07 168 HK_RANDOM_REPLYTO 1465 0.35 1.01 0.09 169 DKIM_ADSP_CUSTOM_MED 1454 0.88 1.00 0.83 170 TR_XM_DK_SendGrid 1452 1.00 1.00 1.00 171 XM_ProductURIs 1437 0.70 0.99 0.59 172 XMSexyCombo_01 1408 0.39 0.97 0.16 173 MISSING_HEADERS 1403 0.56 0.96 0.40 174 TooManyTo_002 1381 1.75 0.95 2.07 175 MPART_ALT_DIFF_COUNT 1343 0.63 0.92 0.52 176 HELO_NODOT 1339 1.16 0.92 1.26 177 HTML_IMAGE_ONLY_08 1337 0.34 0.92 0.11 178 HELO_NO_DOMAIN 1335 1.16 0.92 1.26 179 TM2_M_OBFU_COMMENT 1330 0.42 0.91 0.22 180 TVD_RCVD_IP 1322 1.25 0.91 1.38 181 TR_Symld_Words 1291 1.15 0.89 1.25 182 XM_B_COPY_HTML 1285 0.79 0.88 0.75 183 HELO_DYNAMIC_SPLIT_IP 1275 0.25 0.87 0.01 184 BAYES_05 1270 2.26 0.87 2.81 185 XM_UB999 1254 0.25 0.86 0.00 186 TR_XM_Base64_L1 1252 0.32 0.86 0.11 187 FORGED_GMAIL_RCVD 1237 0.61 0.85 0.52 188 XM_PDF 1233 4.70 0.85 6.22 189 TR_Mismatch_TLD_01 1219 0.43 0.84 0.26 190 NML_ADSP_CUSTOM_MED 1217 0.61 0.84 0.52 191 URIBL_BLACK 1217 0.26 0.84 0.03 192 URG_BIZ 1200 0.28 0.82 0.06 193 TR_MetaPhish_Combo_01 1195 0.72 0.82 0.68 194 RELAYCOUNTRY_FR 1194 0.40 0.82 0.23 195 TooManyTo_003 1180 1.13 0.81 1.26 196 TM2_M_A_HREF_HREF 1162 0.38 0.80 0.21 197 BAYES_00 1149 7.95 0.79 10.78 198 REPLYTO_WITHOUT_TO_CC 1112 0.24 0.76 0.03 199 TooManyTo_004 1111 0.86 0.76 0.90 200 XMSubMetaSxObfu_03 1106 0.45 0.76 0.33 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316351 88.17 93.95 85.89 2 T_SCC_BODY_TEXT_LINE 306235 82.13 79.56 83.14 3 RELAYCOUNTRY_US 291232 79.89 81.99 79.07 4 DKIM_SIGNED 263753 76.85 90.11 71.61 5 XM_B_Unicode 259361 74.01 83.11 70.41 6 XM_DK_Pass 258890 74.95 86.73 70.29 7 DKIM_VALID 255819 74.11 85.88 69.45 8 DCC_CHECK_NEGATIVE 250936 57.55 30.82 68.13 9 BAYES_50 208923 51.67 38.91 56.72 10 DKIM_VALID_AU 202454 58.13 66.12 54.96 11 XMListUnsubscribeExists 177137 54.31 70.04 48.09 12 XM_B_SpammyWords 158873 50.99 70.84 43.13 13 XM_B_Unicode3 148969 42.14 46.44 40.44 14 DCC_CHECK 117252 42.41 69.16 31.83 15 HTML_FONT_LOW_CONTRAST 100726 29.99 36.67 27.35 16 DKIM_VALID_EF 100705 27.96 29.53 27.34 17 RCVD_IN_MSPIKE_H2 90508 25.44 27.65 24.57 18 LOC_TINY_FONT_1 89491 28.70 39.85 24.30 19 T_TM2_M_HEADER_IN_MSG 88619 23.59 22.41 24.06 20 FVGT_m_MULTI_ODD 84442 25.55 32.20 22.93 21 MIME_HTML_ONLY 82241 24.58 30.27 22.33 22 XMSubLong 77342 21.12 21.41 21.00 23 T_KAM_HTML_FONT_INVALID 74530 22.01 26.49 20.23 24 XM_B_SpammyWords2 67138 24.30 39.64 18.23 25 ALL_TRUSTED 65546 13.08 1.15 17.80 26 XM_Multi_Part_URI 50265 15.46 20.06 13.65 27 TR_XM_DK_Unsub 47818 15.13 20.55 12.98 28 USER_IN_DEF_DKIM_WL 44091 9.29 2.52 11.97 29 BAYES_00 39702 7.95 0.79 10.78 30 UNPARSEABLE_RELAY 38659 11.87 15.33 10.50 31 XM_B_Unsub 35260 11.60 16.71 9.57 32 BAYES_60 31918 8.43 7.82 8.67 33 MPART_ALT_DIFF 31527 7.92 6.30 8.56 34 LotsOfNums_01 31401 8.23 7.49 8.53 35 XM_DKIMWhitelistDomains 30284 5.92 0.09 8.22 36 XM_Evil_Numbers_Gen 29042 8.43 9.81 7.88 37 TooManyTo_001 27926 7.13 5.98 7.58 38 TR_XM_DK_Bayes 23916 4.82 0.59 6.49 39 TR_XM_DK_Bayes1 23609 4.76 0.58 6.41 40 TR_MAX_INTL_RELAY 23573 8.69 14.48 6.40 41 TR_XM_BayesUnsub 23358 9.10 16.06 6.34 42 IN_ZIMBRA_NJ_WHITELIST 23118 4.52 0.07 6.28 43 XM_PDF 22917 4.70 0.85 6.22 44 XM_DK_Undo_02 22721 16.68 43.25 6.17 45 LOTS_OF_MONEY 21673 7.77 12.53 5.88 46 RCVD_IN_MSPIKE_WL 21428 6.00 6.46 5.82 47 RCVD_IN_MSPIKE_H3 21427 6.00 6.46 5.82 48 BAYES_40 20632 4.64 2.19 5.60 49 TR_XM_DK_Bayes2 20487 4.12 0.49 5.56 50 XM_H_GMP 20486 5.25 4.47 5.56 51 BAYES_99 19981 13.28 33.14 5.42 52 XM_H_Long_From01 19588 5.46 5.82 5.32 53 XMStrtUSub 19223 4.82 3.81 5.22 54 MIME_QP_LONG_LINE 19085 4.59 3.09 5.18 55 HTML_IMAGE_RATIO_02 19016 5.62 6.78 5.16 56 MIME_HTML_ONLY_MULTI 18339 4.52 3.36 4.98 57 RCVD_IN_IADB_LISTED 18141 3.98 1.60 4.93 58 XM_B_SpammyWords3 17286 7.18 13.48 4.69 59 ANY_BOUNCE_MESSAGE 17273 3.93 2.02 4.69 60 BOUNCE_MESSAGE 17271 3.93 2.02 4.69 61 T_TooManySym_01 17235 3.96 2.15 4.68 62 TM2_M_URI_OPT_OUT 17053 4.31 3.49 4.63 63 BOTNET_IPINHOSTNAME 16528 7.03 13.46 4.49 64 BAYES_999 16187 10.58 26.20 4.39 65 RCVD_IN_IADB_SPF 16038 3.53 1.43 4.35 66 HTML_IMAGE_RATIO_04 15958 4.68 5.57 4.33 67 RCVD_IN_VALIDITY_SAFE 15317 3.83 2.99 4.16 68 MIME_HTML_MOSTLY 15255 4.16 4.22 4.14 69 XM_UncommonTLD01 15006 4.86 6.86 4.07 70 RELAYCOUNTRY_META 14863 7.96 17.88 4.04 71 XMSubMetaSx_00 14744 4.59 6.08 4.00 72 BAYES_80 14445 5.33 8.91 3.92 73 RCVD_IN_IADB_SENDERID 14349 3.17 1.35 3.90 74 TR_XM_SpammyWords4 14303 5.96 11.21 3.88 75 T_REMOTE_IMAGE 14038 3.27 1.89 3.81 76 RCVD_IN_IADB_DK 13905 3.09 1.36 3.78 77 XM_H_Trusted_IP 13759 2.68 0.00 3.74 78 XM_Body_Dirty_Words 13286 5.25 9.40 3.61 79 BAYES_20 13255 3.27 2.43 3.60 80 RCVD_IN_VALIDITY_CERTIFIED 13209 3.23 2.33 3.59 81 FSL_BULK_SIG 13136 4.73 7.66 3.57 82 XMNumbers 12058 4.10 6.17 3.27 83 XM_B_Phish_Phrases 11621 3.66 4.93 3.15 84 RCVD_IN_IADB_VOUCHED 11089 2.33 0.62 3.01 85 BAYES_05 10362 2.26 0.87 2.81 86 XM_B_SpammyTLD 10206 3.07 3.84 2.77 87 HTML_MIME_NO_HTML_TAG 9417 2.35 1.84 2.56 88 XM_SPF_SoftFail 9414 3.65 6.41 2.56 89 MAILING_LIST_MULTI 9363 2.32 1.77 2.54 90 BAYES_95 9119 3.17 4.93 2.48 91 T_TooManySym_02 9115 1.98 0.72 2.47 92 SCC_BODY_URI_ONLY 9097 2.51 2.60 2.47 93 HTML_IMAGE_RATIO_06 8796 2.77 3.74 2.39 94 TR_XM_DKIM_Undo 8415 11.00 33.03 2.28 95 DKIM_INVALID 7934 2.74 4.23 2.15 96 XM_CamelCaseFrm001 7807 2.31 2.78 2.12 97 TR_XM_SpammyRelay 7701 5.44 13.90 2.09 98 RCVD_IN_IADB_OPTIN 7662 1.62 0.47 2.08 99 TooManyTo_002 7633 1.75 0.95 2.07 100 URI_NOVOWEL 7574 1.80 1.14 2.06 101 T_XMDrugObfuBody_14 7299 2.52 3.87 1.98 102 INVALID_MSGID 7243 1.46 0.19 1.97 103 FROM_EXCESS_BASE64 7209 2.18 2.76 1.96 104 TR_DCC_Bayes_99 7096 7.82 22.73 1.93 105 HTML_IMAGE_RATIO_08 6408 1.95 2.46 1.74 106 XM_DK_Undo_01 6262 1.71 1.75 1.70 107 TO_MALFORMED 6257 1.23 0.03 1.70 108 T_OBFU_PDF_ATTACH 6194 1.26 0.21 1.68 109 TR_XM_UnparsRelay 6173 3.38 7.67 1.68 110 XMSexyCombo_05 6159 2.66 5.15 1.67 111 XMSubNoVowel 5932 1.36 0.73 1.61 112 T_XMDrugObfuBody_08 5892 2.14 3.52 1.60 113 TR_XM_PhishingBody 5810 2.35 4.31 1.58 114 XM_B_Investor 5730 2.43 4.65 1.56 115 T_HTML_ATTACH 5717 1.13 0.06 1.55 116 XM_SendGrid 5369 1.51 1.64 1.46 117 UNTRUSTED_Relay 5249 2.68 5.85 1.43 118 IN_HORDE_ADDRESS_BOOK 5194 1.03 0.06 1.41 119 TR_XM_SpammyWords5 5119 2.45 5.13 1.39 120 SUBJ_ALL_CAPS 5119 1.74 2.64 1.39 121 TVD_RCVD_IP 5088 1.25 0.91 1.38 122 XMGappySubj_01 4746 0.99 0.22 1.29 123 BOTNET 4641 3.69 9.82 1.26 124 HELO_NODOT 4627 1.16 0.92 1.26 125 HELO_NO_DOMAIN 4623 1.16 0.92 1.26 126 TooManyTo_003 4623 1.13 0.81 1.26 127 TR_Symld_Words 4614 1.15 0.89 1.25 128 XMDiploma_00 4525 1.60 2.53 1.23 129 TM2_M_VERY_LONG_WORD 4521 1.78 3.19 1.23 130 XM_B_Unsub2 4474 1.54 2.37 1.21 131 XMStockSpam_06 4407 1.36 1.76 1.20 132 XM_OfRef6 4222 1.71 3.14 1.15 133 XM_GoogleGroups 4209 0.97 0.52 1.14 134 KHOP_HELO_FCRDNS 4063 1.19 1.40 1.10 135 XMBSHREFv2 4057 0.97 0.62 1.10 136 TVD_SPACE_RATIO 3942 0.80 0.11 1.07 137 RELAYCOUNTRY_CA 3909 3.02 7.99 1.06 138 XMBody_95 3810 0.79 0.18 1.03 139 URI_HEX 3751 1.14 1.46 1.02 140 XM_H_Long_From02 3741 1.02 1.04 1.02 141 RELAYCOUNTRY_AU 3720 1.47 2.62 1.01 142 TR_XM_DK_SendGrid 3672 1.00 1.00 1.00 143 T_FILL_THIS_FORM_SHORT 3563 1.57 3.09 0.97 144 T_TooManySym_03 3530 0.79 0.35 0.96 145 TooManyTo_004 3298 0.86 0.76 0.90 146 XM_UB50 3183 1.38 2.68 0.86 147 XMCapTrack 3126 0.71 0.37 0.85 148 FROM_GOV_DKIM_AU 3070 0.63 0.12 0.83 149 DKIM_ADSP_CUSTOM_MED 3050 0.88 1.00 0.83 150 RCVD_IN_RP_SAFE 2887 0.74 0.61 0.78 151 RCVD_IN_BL_SPAMCOP_NET 2872 3.71 11.13 0.78 152 XM_B_COPY_HTML 2776 0.79 0.88 0.75 153 XMSubMetaI_00 2697 0.99 1.63 0.73 154 TooManyTo_005 2681 0.73 0.73 0.73 155 XMLngstWrd_00 2558 0.79 1.04 0.69 156 TR_MetaPhish_Combo_01 2513 0.72 0.82 0.68 157 XMPhish30 2477 0.88 1.41 0.67 158 SpammyFromTLD_01 2471 1.55 3.79 0.67 159 RCVD_IN_RP_CERTIFIED 2466 0.62 0.48 0.67 160 HTTPS_HTTP_MISMATCH 2433 0.92 1.57 0.66 161 XMBrknScrpt_02 2401 1.04 2.03 0.65 162 MSGID_NOFQDN1 2383 0.47 0.03 0.65 163 XMGappySubj_02 2290 0.48 0.13 0.62 164 XMBdyGiftCard01 2247 0.77 1.19 0.61 165 XMHTML_After_End 2195 0.62 0.69 0.60 166 T_XMDrugObfuBody_00 2175 0.85 1.50 0.59 167 XM_ProductURIs 2165 0.70 0.99 0.59 168 XM_H_PHPMailer 2164 0.72 1.05 0.59 169 URI_TRY_3LD 2152 0.73 1.11 0.58 170 XM_ShortIntro_01 2150 0.54 0.43 0.58 171 TM2_M_BODY_EMPTY 2039 0.99 2.09 0.55 172 USER_IN_WELCOMELIST 1975 0.38 0.00 0.54 173 USER_IN_WHITELIST 1975 0.38 0.00 0.54 174 SpammyFromTLD_02 1956 0.85 1.67 0.53 175 XMNoVowels 1952 0.57 0.68 0.53 176 NML_ADSP_CUSTOM_MED 1925 0.61 0.84 0.52 177 XMGenDplmaNmb 1914 0.68 1.09 0.52 178 MPART_ALT_DIFF_COUNT 1912 0.63 0.92 0.52 179 TR_XM_Base64_M1 1906 0.79 1.47 0.52 180 FORGED_GMAIL_RCVD 1897 0.61 0.85 0.52 181 T_XMHurry_00 1848 0.68 1.12 0.50 182 XM_B_SpammyWords4 1820 1.22 3.04 0.49 183 RELAYCOUNTRY_GB 1704 0.76 1.51 0.46 184 BASE64_LENGTH_79_INF 1688 0.39 0.20 0.46 185 FILL_THIS_FORM 1651 0.43 0.39 0.45 186 XMBody_17 1642 1.65 4.69 0.45 187 PLING_QUERY 1624 0.65 1.19 0.44 188 HTML_IMAGE_ONLY_20 1581 0.47 0.58 0.43 189 XMMoneyMeta_00 1577 0.83 1.85 0.43 190 DIET_1 1559 0.52 0.76 0.42 191 TR_XM_PHPForged 1543 1.49 4.18 0.42 192 TR_XM_PHPDW 1535 1.49 4.19 0.42 193 TR_XM_SPAMCOP 1521 2.66 8.34 0.41 194 HTML_IMAGE_ONLY_32 1515 0.33 0.11 0.41 195 GMD_PDF_EMPTY_BODY 1497 0.32 0.11 0.41 196 TR_XM_FormFill2 1497 1.46 4.12 0.41 197 SUBJ_DOLLARS 1486 0.47 0.65 0.40 198 TR_XM_SpammyWords2 1474 3.87 12.64 0.40 199 MISSING_HEADERS 1473 0.56 0.96 0.40 200 XM_H_PHPOS 1473 1.45 4.11 0.40 ----------------------------------------------------------------------