Email: 537447 Autolearn: 0 AvgScore: 1.52 AvgScanTime: 1.38 sec Spam: 139386 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 1.56 sec Ham: 398061 Autolearn: 0 AvgScore: -2.34 AvgScanTime: 1.32 sec Time Spent Running SA: 206.54 hours Time Spent Processing Spam: 60.26 hours Time Spent Processing Ham: 146.29 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 131622 89.38 94.43 87.62 2 DKIM_SIGNED 126870 70.64 91.02 63.50 3 XM_DK_Pass 121688 68.82 87.30 62.35 4 DKIM_VALID 120592 67.98 86.52 61.49 5 RELAYCOUNTRY_US 118842 81.45 85.26 80.11 6 XM_B_Unicode 114101 74.59 81.86 72.04 7 T_SCC_BODY_TEXT_LINE 110802 82.30 79.49 83.29 8 XMListUnsubscribeExists 99552 49.09 71.42 41.27 9 DKIM_VALID_AU 97753 54.77 70.13 49.39 10 XM_B_SpammyWords 97592 49.58 70.02 42.42 11 DCC_CHECK 95953 38.47 68.84 27.83 12 XM_B_Unicode3 64008 42.99 45.92 41.96 13 LOC_TINY_FONT_1 58510 26.72 41.98 21.38 14 XM_DK_Undo_02 57131 14.52 40.99 5.26 15 BAYES_50 56306 53.11 40.40 57.56 16 XM_B_SpammyWords2 54853 22.61 39.35 16.74 17 HTML_FONT_LOW_CONTRAST 51315 26.79 36.82 23.28 18 BAYES_99 46774 12.10 33.56 4.59 19 FVGT_m_MULTI_ODD 46673 24.57 33.48 21.45 20 DCC_CHECK_NEGATIVE 43415 61.50 31.15 72.13 21 TR_XM_DKIM_Undo 41995 9.29 30.13 1.99 22 RCVD_IN_MSPIKE_H2 38865 23.40 27.88 21.83 23 DKIM_VALID_EF 38075 25.56 27.32 24.95 24 MIME_HTML_ONLY 36922 22.63 26.49 21.28 25 T_KAM_HTML_FONT_INVALID 36776 19.72 26.38 17.39 26 BAYES_999 36623 9.57 26.27 3.72 27 XMSubLong 35523 22.88 25.49 21.97 28 T_TM2_M_HEADER_IN_MSG 31618 25.98 22.68 27.13 29 TR_DCC_Bayes_99 31506 7.02 22.60 1.56 30 XM_Multi_Part_URI 27683 13.95 19.86 11.88 31 TR_XM_DK_Unsub 25168 13.08 18.06 11.33 32 XM_B_Unsub 22346 9.40 16.03 7.08 33 TR_XM_BayesUnsub 21617 8.22 15.51 5.67 34 BOTNET_IPINHOSTNAME 20099 6.44 14.42 3.64 35 UNPARSEABLE_RELAY 19897 9.83 14.27 8.27 36 LOTS_OF_MONEY 19888 8.83 14.27 6.93 37 TR_MAX_INTL_RELAY 19586 7.86 14.05 5.70 38 RELAYCOUNTRY_META 19541 6.31 14.02 3.61 39 XM_B_SpammyWords3 19030 6.11 13.65 3.47 40 TR_XM_SpammyWords4 17428 6.99 12.50 5.07 41 TR_XM_SpammyWords2 17044 3.58 12.23 0.56 42 TR_XM_SpammyRelay 14492 4.07 10.40 1.86 43 XM_Body_Dirty_Words 13946 4.75 10.01 2.91 44 XM_Evil_Numbers_Gen 13925 8.84 9.99 8.43 45 BOTNET 13707 3.32 9.83 1.04 46 BAYES_80 11965 4.81 8.58 3.49 47 TR_XM_UnparsRelay 10385 2.83 7.45 1.21 48 BAYES_60 10271 7.65 7.37 7.75 49 XM_UncommonTLD01 10198 4.31 7.32 3.26 50 LotsOfNums_01 10181 7.30 7.30 7.30 51 HTML_IMAGE_RATIO_02 9889 5.21 7.09 4.55 52 TooManyTo_001 9399 7.37 6.74 7.59 53 XMSubMetaSx_00 9397 4.13 6.74 3.22 54 HTML_IMAGE_RATIO_04 9389 12.37 6.74 14.34 55 FSL_BULK_SIG 9100 3.79 6.53 2.83 56 RCVD_IN_BL_SPAMCOP_NET 8676 2.02 6.22 0.55 57 MPART_ALT_DIFF 8184 7.94 5.87 8.66 58 UNTRUSTED_Relay 7805 2.42 5.60 1.31 59 XM_H_Long_From01 7726 4.88 5.54 4.65 60 XM_B_Phish_Phrases 7652 3.67 5.49 3.03 61 XMSexyCombo_05 7557 2.27 5.42 1.17 62 RELAYCOUNTRY_CA 7526 2.18 5.40 1.06 63 XM_SPF_SoftFail 7357 3.46 5.28 2.82 64 XMNumbers 7080 3.05 5.08 2.34 65 BAYES_95 6977 2.93 5.01 2.20 66 XM_H_GMP 6861 5.46 4.92 5.65 67 XM_B_Investor 6733 2.26 4.83 1.36 68 DKIM_INVALID 6278 2.66 4.50 2.01 69 TR_XM_PhishingBody 6196 2.48 4.45 1.79 70 T_XMDrugObfuBody_14 6017 2.18 4.32 1.43 71 HTML_IMAGE_RATIO_06 5322 4.25 3.82 4.40 72 XMBody_17 5256 1.27 3.77 0.39 73 TR_XM_PHPForged 5214 1.28 3.74 0.42 74 TR_XM_PHPDW 5137 1.26 3.69 0.41 75 TR_XM_SpammyWords5 5108 1.77 3.66 1.11 76 TR_XM_FormFill2 5069 1.25 3.64 0.41 77 MIME_HTML_ONLY_MULTI 5055 6.15 3.63 7.03 78 XM_H_PHPOS 5043 1.23 3.62 0.39 79 XMStrtUSub 5025 8.36 3.61 10.02 80 MIME_HTML_MOSTLY 4946 2.52 3.55 2.15 81 MIME_QP_LONG_LINE 4931 4.22 3.54 4.46 82 T_XMDrugObfuBody_08 4928 2.09 3.54 1.58 83 TR_XM_SPAMCOP 4903 1.13 3.52 0.29 84 SpammyFromTLD_01 4861 1.47 3.49 0.77 85 TM2_M_VERY_LONG_WORD 4807 1.61 3.45 0.97 86 XM_B_SpammyTLD 4783 2.58 3.43 2.28 87 XM_OfRef6 4620 1.60 3.31 1.00 88 TM2_M_URI_OPT_OUT 4141 2.09 2.97 1.78 89 RCVD_IN_VALIDITY_SAFE 4007 3.54 2.87 3.78 90 XM_CamelCaseFrm001 4004 1.96 2.87 1.64 91 XM_UB50 3968 1.33 2.85 0.79 92 T_TooManySym_01 3865 4.06 2.77 4.51 93 XMDiploma_00 3836 1.71 2.75 1.35 94 XM_URI_RBL 3769 0.82 2.70 0.16 95 TR_LOTS_OF_MONEY3 3767 1.01 2.70 0.42 96 RCVD_IN_MSPIKE_H3 3741 4.73 2.68 5.45 97 RCVD_IN_MSPIKE_WL 3741 4.73 2.68 5.45 98 XM_B_Unsub2 3583 1.69 2.57 1.38 99 HTML_IMAGE_RATIO_08 3432 1.90 2.46 1.70 100 RELAYCOUNTRY_AU 3418 1.11 2.45 0.64 101 XM_B_SpammyWords4 3395 0.97 2.44 0.46 102 SCC_BODY_URI_ONLY 3322 2.25 2.38 2.20 103 MAILING_LIST_MULTI 3302 2.55 2.37 2.61 104 USER_IN_DEF_DKIM_WL 3147 8.22 2.26 10.31 105 FROM_EXCESS_BASE64 3134 1.95 2.25 1.85 106 XMBrknScrpt_02 3032 0.90 2.18 0.45 107 T_XMDrugObfuBody_00 3024 0.99 2.17 0.58 108 RCVD_IN_VALIDITY_CERTIFIED 2938 3.09 2.11 3.44 109 ANY_BOUNCE_MESSAGE 2850 4.19 2.04 4.94 110 BOUNCE_MESSAGE 2848 4.19 2.04 4.94 111 BAYES_40 2765 4.34 1.98 5.17 112 XM_DK_Undo_01 2713 1.84 1.95 1.81 113 T_XMHurry_00 2600 0.83 1.87 0.47 114 T_FILL_THIS_FORM_SHORT 2552 1.14 1.83 0.90 115 T_REMOTE_IMAGE 2523 2.73 1.81 3.05 116 SUBJ_ALL_CAPS 2497 1.41 1.79 1.27 117 SpammyFromTLD_02 2483 0.74 1.78 0.37 118 TM2_M_BODY_EMPTY 2483 0.73 1.78 0.37 119 TR_XM_NoHeaderRelay 2481 0.53 1.78 0.10 120 RCVD_IN_IADB_LISTED 2422 3.27 1.74 3.81 121 TR_XM_INV_DKIM 2421 0.49 1.74 0.05 122 XMEmptyBody_01 2371 0.48 1.70 0.06 123 BAYES_20 2335 3.08 1.68 3.57 124 HTTPS_HTTP_MISMATCH 2335 0.96 1.68 0.71 125 HTML_MIME_NO_HTML_TAG 2299 1.89 1.65 1.97 126 TM2_M_A_HREF_HREF 2209 0.61 1.58 0.28 127 RCVD_IN_IADB_SPF 2205 2.93 1.58 3.40 128 XMStockSpam_06 2159 1.18 1.55 1.05 129 ALL_TRUSTED 2152 13.03 1.54 17.06 130 DIET_1 2117 0.57 1.52 0.24 131 RCVD_IN_IADB_DK 2088 2.63 1.50 3.02 132 KHOP_HELO_FCRDNS 2087 1.19 1.50 1.08 133 RCVD_IN_IADB_SENDERID 2074 2.66 1.49 3.07 134 XM_SendGrid 2069 1.24 1.48 1.16 135 XMPhish30 2008 0.77 1.44 0.53 136 HTML_TAG_BALANCE_BODY 1994 0.71 1.43 0.45 137 URI_HEX 1991 1.03 1.43 0.89 138 URI_TRY_3LD 1987 0.79 1.43 0.56 139 XM_DIRTYINTL 1983 0.48 1.42 0.16 140 XMSexyCombo_01 1979 0.49 1.42 0.17 141 XMLngstWrd_00 1970 1.04 1.41 0.92 142 AC_BR_BONANZA 1945 0.41 1.40 0.07 143 XM_H_Long_From02 1937 1.07 1.39 0.96 144 XM_H_Undi_Recip 1926 0.48 1.38 0.16 145 XM_HighProb1 1900 0.36 1.36 0.00 146 XMHTML_After_End 1899 0.82 1.36 0.63 147 BOTNET_NORDNS 1887 0.36 1.35 0.01 148 XM_B_COVIDMETA 1839 0.48 1.32 0.18 149 XM_B_Phish66 1811 0.56 1.30 0.30 150 XMGenDplmaNmb 1792 0.81 1.29 0.64 151 XM_H_PHPMailer 1753 0.84 1.26 0.70 152 XM_B_COPY_HTML 1730 0.81 1.24 0.66 153 TR_XM_Base64_M1 1698 0.84 1.22 0.71 154 TR_Symld_Words 1623 1.22 1.16 1.23 155 TR_XM_FormFill 1608 0.31 1.15 0.02 156 XM_UB99 1546 0.29 1.11 0.00 157 XM_B_DNDMA 1516 0.48 1.09 0.27 158 TR_Mismatch_TLD_02 1511 0.32 1.08 0.05 159 XMReplyNow 1476 0.44 1.06 0.23 160 DKIM_ADSP_CUSTOM_MED 1437 0.88 1.03 0.83 161 RELAYCOUNTRY_FR 1403 0.41 1.01 0.20 162 XMBody_78 1391 0.50 1.00 0.33 163 TooManyTo_002 1364 1.87 0.98 2.19 164 LongTLD 1356 0.45 0.97 0.27 165 URI_NOVOWEL 1355 1.35 0.97 1.49 166 FROM_SUSPICIOUS_NTLD 1345 0.27 0.96 0.02 167 XMBdyGiftCard01 1315 0.68 0.94 0.59 168 XMMoneyMeta_00 1310 0.58 0.94 0.46 169 XMPhish14 1308 0.67 0.94 0.58 170 TR_XM_InvalidRelay 1307 0.26 0.94 0.02 171 XMSubMetaI_00 1304 0.55 0.94 0.41 172 T_TooManySym_02 1298 2.00 0.93 2.37 173 TR_MetaPhish_Combo_01 1270 0.79 0.91 0.75 174 RCVD_IN_VALIDITY_RPBL 1265 0.26 0.91 0.04 175 RDNS_DYNAMIC 1256 0.49 0.90 0.34 176 FROM_SUSPICIOUS_NTLD_FP 1246 0.25 0.89 0.02 177 TM2_M_OBFU_COMMENT 1237 0.44 0.89 0.28 178 SHOPIFY_IMG_NOT_RCVD_SFY 1236 0.39 0.89 0.22 179 XM_UB999 1234 0.23 0.89 0.00 180 XM_ProductURIs 1225 0.99 0.88 1.03 181 T_PDS_OTHER_BAD_TLD 1221 0.33 0.88 0.14 182 TR_XM_DK_SendGrid 1208 0.80 0.87 0.78 183 MPART_ALT_DIFF_COUNT 1202 0.74 0.86 0.70 184 T_MONEY_PERCENT 1195 0.41 0.86 0.26 185 TR_LOTS_OF_MONEY2 1195 0.41 0.86 0.26 186 XM_OfRef7 1192 0.34 0.86 0.16 187 NML_ADSP_CUSTOM_MED 1163 0.63 0.83 0.56 188 XM_S_SpammyWords 1132 0.33 0.81 0.16 189 TR_XM_Spammywords 1132 0.33 0.81 0.16 190 TooManyTo_003 1123 1.23 0.81 1.37 191 TR_XM_Undi_Recip2 1110 0.21 0.80 0.01 192 T_Symld_Words_02 1109 0.54 0.80 0.46 193 XM_B_REG_HTML 1103 0.42 0.79 0.29 194 BAYES_05 1089 2.68 0.78 3.35 195 TR_XM_Undi_Recip5 1079 0.20 0.77 0.01 196 FORGED_GMAIL_RCVD 1070 0.55 0.77 0.47 197 XM_B_SEO 1068 0.26 0.77 0.09 198 XMClaimOffer 1065 0.33 0.76 0.18 199 TR_XM_Undi_RecipCombo2 1041 0.19 0.75 0.00 200 RCVD_IN_IADB_VOUCHED 1038 1.84 0.74 2.23 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 348772 89.38 94.43 87.62 2 T_SCC_BODY_TEXT_LINE 331539 82.30 79.49 83.29 3 RELAYCOUNTRY_US 318900 81.45 85.26 80.11 4 DCC_CHECK_NEGATIVE 287108 61.50 31.15 72.13 5 XM_B_Unicode 286773 74.59 81.86 72.04 6 DKIM_SIGNED 252779 70.64 91.02 63.50 7 XM_DK_Pass 248176 68.82 87.30 62.35 8 DKIM_VALID 244771 67.98 86.52 61.49 9 BAYES_50 229116 53.11 40.40 57.56 10 DKIM_VALID_AU 196620 54.77 70.13 49.39 11 XM_B_SpammyWords 168871 49.58 70.02 42.42 12 XM_B_Unicode3 167015 42.99 45.92 41.96 13 XMListUnsubscribeExists 164263 49.09 71.42 41.27 14 DCC_CHECK 110791 38.47 68.84 27.83 15 T_TM2_M_HEADER_IN_MSG 108010 25.98 22.68 27.13 16 DKIM_VALID_EF 99323 25.56 27.32 24.95 17 HTML_FONT_LOW_CONTRAST 92687 26.79 36.82 23.28 18 XMSubLong 87440 22.88 25.49 21.97 19 RCVD_IN_MSPIKE_H2 86886 23.40 27.88 21.83 20 FVGT_m_MULTI_ODD 85381 24.57 33.48 21.45 21 LOC_TINY_FONT_1 85111 26.72 41.98 21.38 22 MIME_HTML_ONLY 84714 22.63 26.49 21.28 23 T_KAM_HTML_FONT_INVALID 69224 19.72 26.38 17.39 24 ALL_TRUSTED 67898 13.03 1.54 17.06 25 XM_B_SpammyWords2 66649 22.61 39.35 16.74 26 HTML_IMAGE_RATIO_04 57082 12.37 6.74 14.34 27 HTML_FONT_FACE_BAD 51814 9.83 0.71 13.02 28 BAYES_00 49038 9.29 0.65 12.32 29 XM_H_Trusted_IP 47898 8.91 0.00 12.03 30 XM_Multi_Part_URI 47304 13.95 19.86 11.88 31 TR_XM_DK_Unsub 45107 13.08 18.06 11.33 32 USER_IN_DEF_DKIM_WL 41028 8.22 2.26 10.31 33 XMStrtUSub 39903 8.36 3.61 10.02 34 MPART_ALT_DIFF 34477 7.94 5.87 8.66 35 XM_Evil_Numbers_Gen 33571 8.84 9.99 8.43 36 UNPARSEABLE_RELAY 32920 9.83 14.27 8.27 37 BAYES_60 30858 7.65 7.37 7.75 38 TooManyTo_001 30213 7.37 6.74 7.59 39 LotsOfNums_01 29045 7.30 7.30 7.30 40 XM_DKIMWhitelistDomains 29006 5.41 0.04 7.29 41 XM_B_Unsub 28167 9.40 16.03 7.08 42 MIME_HTML_ONLY_MULTI 27996 6.15 3.63 7.03 43 LOTS_OF_MONEY 27584 8.83 14.27 6.93 44 IN_ZIMBRA_NJ_WHITELIST 22825 4.26 0.06 5.73 45 TR_MAX_INTL_RELAY 22671 7.86 14.05 5.70 46 TR_XM_BayesUnsub 22580 8.22 15.51 5.67 47 XM_H_GMP 22482 5.46 4.92 5.65 48 RCVD_IN_MSPIKE_WL 21679 4.73 2.68 5.45 49 RCVD_IN_MSPIKE_H3 21679 4.73 2.68 5.45 50 TR_XM_DK_Bayes 21195 4.07 0.49 5.32 51 TR_XM_DK_Bayes1 20926 4.02 0.49 5.26 52 XM_DK_Undo_02 20924 14.52 40.99 5.26 53 BAYES_40 20569 4.34 1.98 5.17 54 TR_XM_SpammyWords4 20163 6.99 12.50 5.07 55 ANY_BOUNCE_MESSAGE 19651 4.19 2.04 4.94 56 BOUNCE_MESSAGE 19649 4.19 2.04 4.94 57 XM_H_Long_From01 18520 4.88 5.54 4.65 58 BAYES_99 18280 12.10 33.56 4.59 59 HTML_IMAGE_RATIO_02 18098 5.21 7.09 4.55 60 TR_XM_DK_Bayes2 18086 3.46 0.38 4.54 61 T_TooManySym_01 17945 4.06 2.77 4.51 62 MIME_QP_LONG_LINE 17734 4.22 3.54 4.46 63 HTML_IMAGE_RATIO_06 17517 4.25 3.82 4.40 64 XMSubNoVowel 17471 3.37 0.46 4.39 65 XM_PDF 16928 3.34 0.73 4.25 66 RCVD_IN_IADB_LISTED 15170 3.27 1.74 3.81 67 RCVD_IN_VALIDITY_SAFE 15041 3.54 2.87 3.78 68 BAYES_999 14816 9.57 26.27 3.72 69 BOTNET_IPINHOSTNAME 14494 6.44 14.42 3.64 70 RELAYCOUNTRY_META 14355 6.31 14.02 3.61 71 BAYES_20 14203 3.08 1.68 3.57 72 BAYES_80 13899 4.81 8.58 3.49 73 XM_B_SpammyWords3 13812 6.11 13.65 3.47 74 RCVD_IN_VALIDITY_CERTIFIED 13678 3.09 2.11 3.44 75 RCVD_IN_IADB_SPF 13550 2.93 1.58 3.40 76 BAYES_05 13328 2.68 0.78 3.35 77 XM_UncommonTLD01 12988 4.31 7.32 3.26 78 XMSubMetaSx_00 12819 4.13 6.74 3.22 79 RCVD_IN_IADB_SENDERID 12239 2.66 1.49 3.07 80 T_REMOTE_IMAGE 12141 2.73 1.81 3.05 81 XM_B_Phish_Phrases 12054 3.67 5.49 3.03 82 RCVD_IN_IADB_DK 12023 2.63 1.50 3.02 83 XM_Body_Dirty_Words 11583 4.75 10.01 2.91 84 FSL_BULK_SIG 11282 3.79 6.53 2.83 85 XM_SPF_SoftFail 11219 3.46 5.28 2.82 86 MAILING_LIST_MULTI 10385 2.55 2.37 2.61 87 T_TooManySym_02 9439 2.00 0.93 2.37 88 XMNumbers 9323 3.05 5.08 2.34 89 XM_B_SpammyTLD 9059 2.58 3.43 2.28 90 RCVD_IN_IADB_VOUCHED 8867 1.84 0.74 2.23 91 BAYES_95 8769 2.93 5.01 2.20 92 SCC_BODY_URI_ONLY 8752 2.25 2.38 2.20 93 TooManyTo_002 8711 1.87 0.98 2.19 94 MIME_HTML_MOSTLY 8573 2.52 3.55 2.15 95 DKIM_INVALID 8008 2.66 4.50 2.01 96 TR_XM_DKIM_Undo 7929 9.29 30.13 1.99 97 HTML_MIME_NO_HTML_TAG 7855 1.89 1.65 1.97 98 XMSubGarbage 7818 1.46 0.02 1.96 99 XMSubLongNoVowel 7816 1.49 0.12 1.96 100 TR_XM_SpammyRelay 7404 4.07 10.40 1.86 101 FROM_EXCESS_BASE64 7351 1.95 2.25 1.85 102 INVALID_MSGID 7244 1.41 0.23 1.82 103 XM_DK_Undo_01 7191 1.84 1.95 1.81 104 TR_XM_PhishingBody 7139 2.48 4.45 1.79 105 TM2_M_URI_OPT_OUT 7092 2.09 2.97 1.78 106 HTML_IMAGE_RATIO_08 6769 1.90 2.46 1.70 107 HELO_NODOT 6714 1.42 0.68 1.69 108 HELO_NO_DOMAIN 6706 1.42 0.68 1.68 109 XM_CamelCaseFrm001 6517 1.96 2.87 1.64 110 TO_MALFORMED 6335 1.19 0.04 1.59 111 T_XMDrugObfuBody_08 6288 2.09 3.54 1.58 112 TR_DCC_Bayes_99 6213 7.02 22.60 1.56 113 RCVD_IN_IADB_OPTIN 5930 1.22 0.44 1.49 114 URI_NOVOWEL 5919 1.35 0.97 1.49 115 T_XMDrugObfuBody_14 5692 2.18 4.32 1.43 116 TVD_RCVD_IP 5492 1.21 0.73 1.38 117 XM_B_Unsub2 5485 1.69 2.57 1.38 118 TooManyTo_003 5463 1.23 0.81 1.37 119 XM_B_Investor 5433 2.26 4.83 1.36 120 XMDiploma_00 5368 1.71 2.75 1.35 121 UNTRUSTED_Relay 5201 2.42 5.60 1.31 122 SUBJ_ALL_CAPS 5058 1.41 1.79 1.27 123 IN_HORDE_ADDRESS_BOOK 4924 0.93 0.07 1.24 124 XMGappySubj_01 4920 0.96 0.16 1.24 125 TR_Symld_Words 4916 1.22 1.16 1.23 126 XMBody_95 4874 0.96 0.19 1.22 127 TR_XM_UnparsRelay 4829 2.83 7.45 1.21 128 XMSexyCombo_05 4651 2.27 5.42 1.17 129 XM_SendGrid 4599 1.24 1.48 1.16 130 TR_XM_SpammyWords5 4412 1.77 3.66 1.11 131 XM_GoogleGroups 4328 0.96 0.61 1.09 132 KHOP_HELO_FCRDNS 4296 1.19 1.50 1.08 133 XMBSHREFv2 4258 0.89 0.36 1.07 134 RELAYCOUNTRY_CA 4203 2.18 5.40 1.06 135 XMStockSpam_06 4175 1.18 1.55 1.05 136 BOTNET 4145 3.32 9.83 1.04 137 XMCapTrack 4103 0.87 0.43 1.03 138 XM_ProductURIs 4081 0.99 0.88 1.03 139 XM_OfRef6 3983 1.60 3.31 1.00 140 TooManyTo_004 3970 0.93 0.74 1.00 141 TVD_SPACE_RATIO 3943 0.77 0.16 0.99 142 TM2_M_VERY_LONG_WORD 3868 1.61 3.45 0.97 143 XM_E_Blogspot 3835 0.76 0.17 0.96 144 XM_H_Long_From02 3804 1.07 1.39 0.96 145 XMLngstWrd_00 3646 1.04 1.41 0.92 146 T_FILL_THIS_FORM_SHORT 3601 1.14 1.83 0.90 147 URI_HEX 3527 1.03 1.43 0.89 148 T_TooManySym_03 3354 0.70 0.28 0.84 149 DKIM_ADSP_CUSTOM_MED 3308 0.88 1.03 0.83 150 TooManyTo_005 3231 0.78 0.69 0.81 151 XM_UB50 3163 1.33 2.85 0.79 152 TR_XM_DK_SendGrid 3085 0.80 0.87 0.78 153 SpammyFromTLD_01 3048 1.47 3.49 0.77 154 RCVD_IN_RP_SAFE 3025 0.72 0.60 0.76 155 TR_MetaPhish_Combo_01 2992 0.79 0.91 0.75 156 XMGappySubj_02 2956 0.57 0.07 0.74 157 HTTPS_HTTP_MISMATCH 2846 0.96 1.68 0.71 158 TR_XM_Base64_M1 2815 0.84 1.22 0.71 159 MPART_ALT_DIFF_COUNT 2778 0.74 0.86 0.70 160 XM_H_PHPMailer 2767 0.84 1.26 0.70 161 RCVD_IN_RP_CERTIFIED 2683 0.62 0.47 0.67 162 XM_B_COPY_HTML 2612 0.81 1.24 0.66 163 XM_ShortIntro_01 2611 0.61 0.49 0.66 164 XMGenDplmaNmb 2545 0.81 1.29 0.64 165 RELAYCOUNTRY_AU 2541 1.11 2.45 0.64 166 XMHTML_After_End 2502 0.82 1.36 0.63 167 MSGID_NOFQDN1 2395 0.45 0.03 0.60 168 T_OBFU_PDF_ATTACH 2385 0.48 0.12 0.60 169 XMBdyGiftCard01 2353 0.68 0.94 0.59 170 XMPhish14 2317 0.67 0.94 0.58 171 T_XMDrugObfuBody_00 2300 0.99 2.17 0.58 172 FROM_GOV_DKIM_AU 2299 0.53 0.41 0.58 173 URI_TRY_3LD 2244 0.79 1.43 0.56 174 NML_ADSP_CUSTOM_MED 2231 0.63 0.83 0.56 175 TR_XM_SpammyWords2 2216 3.58 12.23 0.56 176 XM_RXBody 2199 0.57 0.64 0.55 177 XMNoVowels 2193 0.52 0.43 0.55 178 RCVD_IN_BL_SPAMCOP_NET 2189 2.02 6.22 0.55 179 FILL_THIS_FORM 2150 0.55 0.59 0.54 180 XMPhish30 2111 0.77 1.44 0.53 181 SHORT_HELO_AND_INLINE_IMAGE 2008 0.39 0.06 0.50 182 USER_IN_WELCOMELIST 1994 0.37 0.00 0.50 183 USER_IN_WHITELIST 1994 0.37 0.00 0.50 184 RELAYCOUNTRY_GB 1922 0.50 0.56 0.48 185 FORGED_GMAIL_RCVD 1883 0.55 0.77 0.47 186 T_XMHurry_00 1878 0.83 1.87 0.47 187 XMMoneyMeta_00 1824 0.58 0.94 0.46 188 XM_B_SpammyWords4 1821 0.97 2.44 0.46 189 T_Symld_Words_02 1817 0.54 0.80 0.46 190 HTML_TAG_BALANCE_BODY 1796 0.71 1.43 0.45 191 XMBrknScrpt_02 1792 0.90 2.18 0.45 192 HTML_IMAGE_ONLY_28 1697 0.44 0.46 0.43 193 TR_LOTS_OF_MONEY3 1676 1.01 2.70 0.42 194 TR_XM_PHPForged 1662 1.28 3.74 0.42 195 TR_XM_FormFill2 1650 1.25 3.64 0.41 196 XMSubMetaI_00 1641 0.55 0.94 0.41 197 HTML_IMAGE_ONLY_32 1625 0.34 0.16 0.41 198 TR_XM_PHPDW 1622 1.26 3.69 0.41 199 XM_H_PHPOS 1566 1.23 3.62 0.39 200 XMOemUri 1557 0.36 0.28 0.39 ----------------------------------------------------------------------