Email: 576018 Autolearn: 0 AvgScore: 1.92 AvgScanTime: 1.53 sec Spam: 161645 Autolearn: 0 AvgScore: 13.17 AvgScanTime: 1.75 sec Ham: 414373 Autolearn: 0 AvgScore: -2.47 AvgScanTime: 1.44 sec Time Spent Running SA: 244.22 hours Time Spent Processing Spam: 78.80 hours Time Spent Processing Ham: 165.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157259 90.30 97.29 87.57 2 DKIM_SIGNED 149168 72.28 92.28 64.47 3 XM_DK_Pass 143645 70.46 88.86 63.28 4 DKIM_VALID 141776 69.51 87.71 62.41 5 XM_B_Unicode 139701 76.98 86.42 73.29 6 T_SCC_BODY_TEXT_LINE 131038 82.71 81.07 83.35 7 RELAYCOUNTRY_US 127874 81.25 79.11 82.08 8 XM_B_SpammyWords 119307 50.83 73.81 41.86 9 XMListUnsubscribeExists 118476 51.17 73.29 42.55 10 DCC_CHECK 117678 40.52 72.80 27.93 11 DKIM_VALID_AU 105653 54.59 65.36 50.39 12 XM_B_Unicode3 77440 45.32 47.91 44.31 13 XM_DK_Undo_02 73431 16.48 45.43 5.19 14 XM_B_SpammyWords2 68991 23.24 42.68 15.66 15 LOC_TINY_FONT_1 65589 27.31 40.58 22.13 16 BAYES_50 63726 51.25 39.42 55.87 17 HTML_FONT_LOW_CONTRAST 60840 28.14 37.64 24.44 18 TR_XM_DKIM_Undo 56522 11.40 34.97 2.21 19 BAYES_99 54738 12.74 33.86 4.50 20 FVGT_m_MULTI_ODD 54653 26.25 33.81 23.30 21 MIME_HTML_ONLY 53553 25.04 33.13 21.88 22 DKIM_VALID_EF 50579 26.73 31.29 24.96 23 T_KAM_HTML_FONT_INVALID 46381 20.78 28.69 17.69 24 DCC_CHECK_NEGATIVE 43946 59.45 27.19 72.04 25 RCVD_IN_MSPIKE_H2 43574 23.57 26.96 22.24 26 BAYES_999 42793 10.00 26.47 3.58 27 TR_DCC_Bayes_99 38669 7.77 23.92 1.47 28 TR_XM_DK_Unsub 37439 14.74 23.16 11.46 29 XMSubLong 36522 22.73 22.59 22.78 30 T_TM2_M_HEADER_IN_MSG 35533 24.29 21.98 25.19 31 RELAYCOUNTRY_META 32894 8.23 20.35 3.50 32 XM_Multi_Part_URI 32050 15.22 19.83 13.42 33 TR_XM_SpammyRelay 26626 6.01 16.47 1.92 34 XM_B_Unsub 25626 9.53 15.85 7.06 35 TR_XM_BayesUnsub 24670 8.32 15.26 5.61 36 TR_MAX_INTL_RELAY 24027 8.37 14.86 5.84 37 XM_B_SpammyWords3 23930 6.98 14.80 3.93 38 UNPARSEABLE_RELAY 23392 10.31 14.47 8.69 39 LOTS_OF_MONEY 22610 8.47 13.99 6.32 40 BOTNET_IPINHOSTNAME 22089 6.35 13.67 3.49 41 RCVD_IN_BL_SPAMCOP_NET 21824 4.17 13.50 0.53 42 TR_XM_SpammyWords2 20459 3.80 12.66 0.34 43 TR_XM_SpammyWords4 20129 6.31 12.45 3.91 44 RELAYCOUNTRY_CA 19292 4.07 11.93 1.01 45 TR_XM_SPAMCOP 17861 3.28 11.05 0.25 46 XM_Evil_Numbers_Gen 16898 8.97 10.45 8.39 47 BOTNET 15363 3.39 9.50 1.01 48 RCVD_IN_MSPIKE_H3 15214 6.45 9.41 5.30 49 RCVD_IN_MSPIKE_WL 15214 6.45 9.41 5.30 50 BAYES_80 15027 5.21 9.30 3.62 51 XM_Body_Dirty_Words 13504 4.50 8.35 3.00 52 FSL_BULK_SIG 13075 4.19 8.09 2.66 53 BAYES_60 12825 7.95 7.93 7.96 54 TR_XM_UnparsRelay 12148 3.01 7.52 1.25 55 HTML_IMAGE_RATIO_02 11060 5.30 6.84 4.70 56 XMBody_17 11049 2.37 6.84 0.63 57 XMSubMetaSx_00 10577 4.01 6.54 3.02 58 LotsOfNums_01 10365 6.91 6.41 7.10 59 HTML_IMAGE_RATIO_04 9751 12.39 6.03 14.87 60 XM_UncommonTLD01 9516 3.95 5.89 3.20 61 XM_H_Long_From01 9450 4.86 5.85 4.48 62 TooManyTo_001 9437 7.15 5.84 7.66 63 MPART_ALT_DIFF 9130 8.23 5.65 9.24 64 XM_B_Phish_Phrases 8931 3.95 5.53 3.34 65 UNTRUSTED_Relay 8628 2.40 5.34 1.25 66 XMSexyCombo_05 8446 2.35 5.23 1.22 67 BAYES_95 8343 3.04 5.16 2.22 68 T_FILL_THIS_FORM_SHORT 8333 2.01 5.16 0.79 69 XMStrtUSub 7560 9.03 4.68 10.73 70 TR_XM_SpammyWords5 7476 2.07 4.62 1.08 71 TR_XM_PhishingBody 7452 2.28 4.61 1.37 72 DKIM_INVALID 7392 2.77 4.57 2.07 73 XM_SPF_SoftFail 6990 3.22 4.32 2.80 74 HTML_IMAGE_RATIO_06 6438 4.95 3.98 5.33 75 XM_B_Investor 6332 2.07 3.92 1.35 76 XM_H_GMP 6281 5.12 3.89 5.60 77 T_XMDrugObfuBody_14 6106 2.05 3.78 1.37 78 XMNumbers 6060 2.68 3.75 2.26 79 HTML_IMAGE_RATIO_08 5831 2.47 3.61 2.03 80 TM2_M_URI_OPT_OUT 5690 2.28 3.52 1.79 81 MIME_HTML_MOSTLY 5584 2.63 3.45 2.31 82 XM_OfRef6 5579 1.74 3.45 1.07 83 MIME_HTML_ONLY_MULTI 5542 6.43 3.43 7.61 84 XM_B_SpammyTLD 5491 2.54 3.40 2.20 85 TR_XM_FormFill 5351 0.94 3.31 0.01 86 TR_XM_BayesRelay 5318 0.92 3.29 0.00 87 TM2_M_VERY_LONG_WORD 5252 1.84 3.25 1.29 88 MIME_QP_LONG_LINE 5054 3.96 3.13 4.28 89 T_XMDrugObfuBody_08 5011 2.46 3.10 2.22 90 XM_CamelCaseFrm001 4863 2.42 3.01 2.19 91 FONT_INVIS_LONG_LINE 4841 0.86 2.99 0.03 92 RCVD_IN_VALIDITY_SAFE 4522 3.56 2.80 3.85 93 XMDiploma_00 4457 2.06 2.76 1.79 94 SpammyFromTLD_01 4266 1.25 2.64 0.70 95 XM_UB50 4242 1.26 2.62 0.72 96 XM_B_Unsub2 4181 1.69 2.59 1.34 97 SUBJ_ALL_CAPS 4056 1.56 2.51 1.19 98 TR_LOTS_OF_MONEY3 4021 0.92 2.49 0.31 99 USER_IN_DEF_DKIM_WL 4018 8.44 2.49 10.76 100 XM_URI_RBL 3872 0.77 2.40 0.14 101 FROM_EXCESS_BASE64 3850 1.97 2.38 1.81 102 XM_B_SpammyWords4 3785 1.16 2.34 0.70 103 T_TooManySym_01 3660 4.01 2.26 4.69 104 RELAYCOUNTRY_AU 3653 1.07 2.26 0.60 105 XMStockSpam_06 3523 1.25 2.18 0.89 106 RCVD_IN_VALIDITY_CERTIFIED 3467 3.00 2.14 3.33 107 URI_TRY_3LD 3057 1.06 1.89 0.73 108 URI_HEX 3031 1.44 1.88 1.28 109 ANY_BOUNCE_MESSAGE 2977 4.44 1.84 5.45 110 TR_XM_NoHeaderRelay 2976 0.58 1.84 0.09 111 BOUNCE_MESSAGE 2976 4.44 1.84 5.45 112 MAILING_LIST_MULTI 2933 2.20 1.81 2.35 113 XMBrknScrpt_02 2931 0.95 1.81 0.61 114 T_XMHurry_00 2852 0.80 1.76 0.42 115 XM_DK_Undo_01 2843 1.61 1.76 1.55 116 BAYES_40 2829 4.29 1.75 5.27 117 TR_XM_PHPForged 2820 0.78 1.74 0.41 118 T_XMDrugObfuBody_00 2799 1.18 1.73 0.97 119 XM_H_Long_From02 2760 1.15 1.71 0.93 120 XMBdyGiftCard01 2742 1.04 1.70 0.79 121 HTML_MIME_NO_HTML_TAG 2739 1.84 1.69 1.89 122 TR_XM_PHPDW 2724 0.75 1.69 0.39 123 T_REMOTE_IMAGE 2702 2.74 1.67 3.15 124 TR_XM_INV_DKIM 2684 0.49 1.66 0.04 125 XMReplyNow 2665 0.63 1.65 0.24 126 RCVD_IN_IADB_LISTED 2654 3.09 1.64 3.66 127 TR_XM_FormFill2 2650 0.75 1.64 0.40 128 XM_H_PHPOS 2640 0.73 1.63 0.38 129 XMPhish14 2639 0.76 1.63 0.42 130 HK_RANDOM_REPLYTO 2602 0.55 1.61 0.13 131 XMSubMetaI_00 2518 0.86 1.56 0.59 132 RCVD_IN_IADB_SPF 2452 2.78 1.52 3.27 133 TM2_M_A_HREF_HREF 2426 0.67 1.50 0.34 134 XM_SendGrid 2384 1.26 1.47 1.17 135 RCVD_IN_IADB_DK 2364 2.51 1.46 2.92 136 RCVD_IN_IADB_SENDERID 2343 2.56 1.45 2.99 137 XMGenDplmaNmb 2331 1.11 1.44 0.98 138 HTML_TAG_BALANCE_BODY 2292 0.67 1.42 0.38 139 SpammyFromTLD_02 2236 0.64 1.38 0.35 140 TR_Mismatch_TLD_02 2234 0.43 1.38 0.06 141 BOTNET_NORDNS 2228 0.39 1.38 0.01 142 XMHTML_After_End 2174 0.78 1.34 0.56 143 THIS_AD 2141 0.62 1.32 0.35 144 LOW_PRICE 2110 0.57 1.31 0.29 145 XMClaimOffer 2107 0.56 1.30 0.27 146 XM_DIRTYINTL 2069 0.48 1.28 0.16 147 XMPhish30 2068 0.64 1.28 0.39 148 XM_HighProb1 2063 0.36 1.28 0.00 149 T_Symld_Words_02 2057 0.76 1.27 0.56 150 BAYES_20 2052 3.01 1.27 3.69 151 ALL_TRUSTED 2044 11.35 1.26 15.29 152 HTTPS_HTTP_MISMATCH 1966 0.83 1.22 0.67 153 AC_BR_BONANZA 1923 0.39 1.19 0.08 154 TR_XM_Base64_M1 1875 0.69 1.16 0.51 155 XM_B_COVIDMETA 1791 0.49 1.11 0.25 156 XM_B_COPY_HTML 1745 0.82 1.08 0.72 157 TR_MetaPhish_Combo_01 1717 0.84 1.06 0.76 158 KHOP_HELO_FCRDNS 1714 0.94 1.06 0.90 159 TR_Symld_Words 1688 1.25 1.04 1.33 160 TR_Caps_n_Bayes_99 1666 0.30 1.03 0.02 161 TR_LOTS_OF_MONEY2 1658 0.45 1.03 0.22 162 T_MONEY_PERCENT 1658 0.45 1.03 0.22 163 URI_NOVOWEL 1636 1.27 1.01 1.36 164 XM_B_Phish66 1628 0.50 1.01 0.30 165 XMLngstWrd_00 1606 0.88 0.99 0.84 166 RDNS_DYNAMIC 1571 0.47 0.97 0.27 167 URIBL_DBL_SPAM 1565 0.27 0.97 0.00 168 XMSubMetaSxObfu_03 1559 0.43 0.96 0.22 169 DIET_1 1526 0.51 0.94 0.35 170 XMSexyCombo_01 1498 0.37 0.93 0.15 171 TR_XM_DK_SendGrid 1484 0.83 0.92 0.79 172 TooManyTo_002 1478 1.90 0.91 2.28 173 T_XMDrugObfuBody_10 1465 0.28 0.91 0.03 174 DKIM_ADSP_CUSTOM_MED 1456 0.85 0.90 0.83 175 XM_H_Undi_Recip 1456 0.36 0.90 0.15 176 XM_UB99 1447 0.25 0.90 0.00 177 SHOPIFY_IMG_NOT_RCVD_SFY 1417 0.45 0.88 0.28 178 MPART_ALT_DIFF_COUNT 1413 0.60 0.87 0.49 179 TR_XM_Base64_L1 1396 0.36 0.86 0.16 180 TR_XM_InvalidRelay 1374 0.26 0.85 0.02 181 XM_H_PHPMailer 1373 0.78 0.85 0.76 182 RCVD_IN_VALIDITY_RPBL 1359 0.26 0.84 0.03 183 TR_XM_SEO4 1343 0.28 0.83 0.06 184 TVD_RCVD_IP 1327 1.18 0.82 1.32 185 TooManyTo_003 1317 1.14 0.81 1.27 186 HTML_IMAGE_ONLY_20 1292 0.46 0.80 0.33 187 XM_B_DNDMA 1292 0.55 0.80 0.45 188 REMOVE_BEFORE_LINK 1285 0.39 0.79 0.23 189 RCVD_IN_PSBL 1251 0.43 0.77 0.30 190 TooManyTo_004 1246 0.87 0.77 0.91 191 XM_B_SEO 1243 0.29 0.77 0.10 192 RELAYCOUNTRY_IN 1229 0.25 0.76 0.06 193 FROM_SUSPICIOUS_NTLD 1221 0.23 0.76 0.03 194 HELO_DYNAMIC_SPLIT_IP 1218 0.21 0.75 0.00 195 XM_ProductURIs 1218 0.67 0.75 0.64 196 RELAYCOUNTRY_FR 1207 0.34 0.75 0.18 197 SCC_BODY_URI_ONLY 1202 1.97 0.74 2.45 198 TooManyTo_005 1199 0.73 0.74 0.73 199 NML_ADSP_CUSTOM_MED 1197 0.63 0.74 0.59 200 HTML_FONT_FACE_BAD 1176 10.54 0.73 14.37 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 362887 90.30 97.29 87.57 2 T_SCC_BODY_TEXT_LINE 345361 82.71 81.07 83.35 3 RELAYCOUNTRY_US 340118 81.25 79.11 82.08 4 XM_B_Unicode 303714 76.98 86.42 73.29 5 DCC_CHECK_NEGATIVE 298499 59.45 27.19 72.04 6 DKIM_SIGNED 267157 72.28 92.28 64.47 7 XM_DK_Pass 262204 70.46 88.86 63.28 8 DKIM_VALID 258597 69.51 87.71 62.41 9 BAYES_50 231494 51.25 39.42 55.87 10 DKIM_VALID_AU 208814 54.59 65.36 50.39 11 XM_B_Unicode3 183601 45.32 47.91 44.31 12 XMListUnsubscribeExists 176298 51.17 73.29 42.55 13 XM_B_SpammyWords 173471 50.83 73.81 41.86 14 DCC_CHECK 115723 40.52 72.80 27.93 15 T_TM2_M_HEADER_IN_MSG 104361 24.29 21.98 25.19 16 DKIM_VALID_EF 103419 26.73 31.29 24.96 17 HTML_FONT_LOW_CONTRAST 101260 28.14 37.64 24.44 18 FVGT_m_MULTI_ODD 96534 26.25 33.81 23.30 19 XMSubLong 94397 22.73 22.59 22.78 20 RCVD_IN_MSPIKE_H2 92170 23.57 26.96 22.24 21 LOC_TINY_FONT_1 91709 27.31 40.58 22.13 22 MIME_HTML_ONLY 90660 25.04 33.13 21.88 23 T_KAM_HTML_FONT_INVALID 73297 20.78 28.69 17.69 24 XM_B_SpammyWords2 64874 23.24 42.68 15.66 25 ALL_TRUSTED 63352 11.35 1.26 15.29 26 HTML_IMAGE_RATIO_04 61605 12.39 6.03 14.87 27 HTML_FONT_FACE_BAD 59563 10.54 0.73 14.37 28 XM_Multi_Part_URI 55605 15.22 19.83 13.42 29 BAYES_00 55309 9.78 0.62 13.35 30 XM_H_Trusted_IP 54769 9.51 0.00 13.22 31 TR_XM_DK_Unsub 47479 14.74 23.16 11.46 32 USER_IN_DEF_DKIM_WL 44586 8.44 2.49 10.76 33 XMStrtUSub 44454 9.03 4.68 10.73 34 MPART_ALT_DIFF 38301 8.23 5.65 9.24 35 UNPARSEABLE_RELAY 35992 10.31 14.47 8.69 36 XM_Evil_Numbers_Gen 34772 8.97 10.45 8.39 37 BAYES_60 32992 7.95 7.93 7.96 38 TooManyTo_001 31726 7.15 5.84 7.66 39 MIME_HTML_ONLY_MULTI 31518 6.43 3.43 7.61 40 XM_DKIMWhitelistDomains 30580 5.36 0.18 7.38 41 LotsOfNums_01 29423 6.91 6.41 7.10 42 XM_B_Unsub 29269 9.53 15.85 7.06 43 LOTS_OF_MONEY 26177 8.47 13.99 6.32 44 TR_MAX_INTL_RELAY 24196 8.37 14.86 5.84 45 TR_XM_DK_Bayes 23657 4.23 0.44 5.71 46 TR_XM_DK_Bayes1 23359 4.18 0.44 5.64 47 TR_XM_BayesUnsub 23263 8.32 15.26 5.61 48 IN_ZIMBRA_NJ_WHITELIST 23232 4.05 0.07 5.61 49 XM_H_GMP 23205 5.12 3.89 5.60 50 ANY_BOUNCE_MESSAGE 22591 4.44 1.84 5.45 51 BOUNCE_MESSAGE 22591 4.44 1.84 5.45 52 HTML_IMAGE_RATIO_06 22072 4.95 3.98 5.33 53 RCVD_IN_MSPIKE_WL 21966 6.45 9.41 5.30 54 RCVD_IN_MSPIKE_H3 21966 6.45 9.41 5.30 55 BAYES_40 21857 4.29 1.75 5.27 56 XM_DK_Undo_02 21505 16.48 45.43 5.19 57 XMSubNoVowel 21338 3.88 0.61 5.15 58 TR_XM_DK_Bayes2 20074 3.58 0.33 4.84 59 HTML_IMAGE_RATIO_02 19467 5.30 6.84 4.70 60 T_TooManySym_01 19434 4.01 2.26 4.69 61 BAYES_99 18654 12.74 33.86 4.50 62 XM_H_Long_From01 18550 4.86 5.85 4.48 63 MIME_QP_LONG_LINE 17729 3.96 3.13 4.28 64 XM_B_SpammyWords3 16265 6.98 14.80 3.93 65 TR_XM_SpammyWords4 16200 6.31 12.45 3.91 66 RCVD_IN_VALIDITY_SAFE 15970 3.56 2.80 3.85 67 XM_PDF 15799 2.90 0.54 3.81 68 BAYES_20 15275 3.01 1.27 3.69 69 RCVD_IN_IADB_LISTED 15155 3.09 1.64 3.66 70 BAYES_80 14991 5.21 9.30 3.62 71 BAYES_999 14821 10.00 26.47 3.58 72 BAYES_05 14598 2.72 0.68 3.52 73 RELAYCOUNTRY_META 14493 8.23 20.35 3.50 74 BOTNET_IPINHOSTNAME 14472 6.35 13.67 3.49 75 XM_B_Phish_Phrases 13841 3.95 5.53 3.34 76 RCVD_IN_VALIDITY_CERTIFIED 13799 3.00 2.14 3.33 77 RCVD_IN_IADB_SPF 13556 2.78 1.52 3.27 78 XM_UncommonTLD01 13257 3.95 5.89 3.20 79 T_REMOTE_IMAGE 13069 2.74 1.67 3.15 80 XMSubMetaSx_00 12527 4.01 6.54 3.02 81 XM_Body_Dirty_Words 12427 4.50 8.35 3.00 82 RCVD_IN_IADB_SENDERID 12377 2.56 1.45 2.99 83 RCVD_IN_IADB_DK 12099 2.51 1.46 2.92 84 XM_SPF_SoftFail 11582 3.22 4.32 2.80 85 FSL_BULK_SIG 11042 4.19 8.09 2.66 86 XMSubLongNoVowel 10565 1.89 0.20 2.55 87 XMSubGarbage 10528 1.84 0.04 2.54 88 SCC_BODY_URI_ONLY 10156 1.97 0.74 2.45 89 MAILING_LIST_MULTI 9747 2.20 1.81 2.35 90 MIME_HTML_MOSTLY 9570 2.63 3.45 2.31 91 T_TooManySym_02 9446 1.83 0.69 2.28 92 TooManyTo_002 9441 1.90 0.91 2.28 93 XMNumbers 9353 2.68 3.75 2.26 94 BAYES_95 9195 3.04 5.16 2.22 95 T_XMDrugObfuBody_08 9183 2.46 3.10 2.22 96 TR_XM_DKIM_Undo 9148 11.40 34.97 2.21 97 XM_B_SpammyTLD 9122 2.54 3.40 2.20 98 XM_CamelCaseFrm001 9063 2.42 3.01 2.19 99 RCVD_IN_IADB_VOUCHED 8701 1.68 0.62 2.10 100 DKIM_INVALID 8560 2.77 4.57 2.07 101 HTML_IMAGE_RATIO_08 8401 2.47 3.61 2.03 102 TR_XM_SpammyRelay 7974 6.01 16.47 1.92 103 HTML_MIME_NO_HTML_TAG 7831 1.84 1.69 1.89 104 FROM_EXCESS_BASE64 7490 1.97 2.38 1.81 105 INVALID_MSGID 7456 1.35 0.19 1.80 106 TM2_M_URI_OPT_OUT 7426 2.28 3.52 1.79 107 XMDiploma_00 7414 2.06 2.76 1.79 108 HELO_NODOT 6510 1.26 0.45 1.57 109 HELO_NO_DOMAIN 6503 1.26 0.45 1.57 110 XM_DK_Undo_01 6438 1.61 1.76 1.55 111 TO_MALFORMED 6333 1.10 0.00 1.53 112 TR_DCC_Bayes_99 6105 7.77 23.92 1.47 113 RCVD_IN_IADB_OPTIN 5768 1.11 0.40 1.39 114 T_XMDrugObfuBody_14 5686 2.05 3.78 1.37 115 TR_XM_PhishingBody 5664 2.28 4.61 1.37 116 URI_NOVOWEL 5653 1.27 1.01 1.36 117 XM_B_Investor 5586 2.07 3.92 1.35 118 XM_B_Unsub2 5559 1.69 2.59 1.34 119 TR_Symld_Words 5529 1.25 1.04 1.33 120 TVD_RCVD_IP 5467 1.18 0.82 1.32 121 TM2_M_VERY_LONG_WORD 5342 1.84 3.25 1.29 122 URI_HEX 5284 1.44 1.88 1.28 123 TooManyTo_003 5258 1.14 0.81 1.27 124 UNTRUSTED_Relay 5195 2.40 5.34 1.25 125 TR_XM_UnparsRelay 5175 3.01 7.52 1.25 126 XMGappySubj_01 5160 0.94 0.16 1.25 127 IN_HORDE_ADDRESS_BOOK 5072 0.90 0.06 1.22 128 XMSexyCombo_05 5062 2.35 5.23 1.22 129 SUBJ_ALL_CAPS 4949 1.56 2.51 1.19 130 XM_SendGrid 4853 1.26 1.47 1.17 131 XMBody_95 4850 0.88 0.12 1.17 132 TR_XM_SpammyWords5 4456 2.07 4.62 1.08 133 XM_OfRef6 4436 1.74 3.45 1.07 134 XM_GoogleGroups 4352 0.89 0.50 1.05 135 XMCapTrack 4194 0.83 0.35 1.01 136 BOTNET 4171 3.39 9.50 1.01 137 RELAYCOUNTRY_CA 4165 4.07 11.93 1.01 138 XMGenDplmaNmb 4046 1.11 1.44 0.98 139 T_XMDrugObfuBody_00 4025 1.18 1.73 0.97 140 XMBSHREFv2 4001 0.77 0.28 0.97 141 XM_E_Blogspot 3921 0.72 0.14 0.95 142 XM_H_Long_From02 3869 1.15 1.71 0.93 143 TVD_SPACE_RATIO 3804 0.69 0.11 0.92 144 TooManyTo_004 3774 0.87 0.77 0.91 145 KHOP_HELO_FCRDNS 3709 0.94 1.06 0.90 146 XMStockSpam_06 3701 1.25 2.18 0.89 147 XMLngstWrd_00 3467 0.88 0.99 0.84 148 DKIM_ADSP_CUSTOM_MED 3447 0.85 0.90 0.83 149 XM_ShortIntro_01 3420 0.78 0.65 0.83 150 TR_XM_DK_SendGrid 3277 0.83 0.92 0.79 151 T_FILL_THIS_FORM_SHORT 3264 2.01 5.16 0.79 152 XMBdyGiftCard01 3254 1.04 1.70 0.79 153 T_TooManySym_03 3241 0.65 0.32 0.78 154 TR_MetaPhish_Combo_01 3136 0.84 1.06 0.76 155 XM_H_PHPMailer 3132 0.78 0.85 0.76 156 XMGappySubj_02 3114 0.56 0.05 0.75 157 URI_TRY_3LD 3045 1.06 1.89 0.73 158 RCVD_IN_RP_SAFE 3011 0.70 0.63 0.73 159 TooManyTo_005 3006 0.73 0.74 0.73 160 XM_UB50 3001 1.26 2.62 0.72 161 XM_B_COPY_HTML 3001 0.82 1.08 0.72 162 SpammyFromTLD_01 2909 1.25 2.64 0.70 163 XM_B_SpammyWords4 2897 1.16 2.34 0.70 164 HTTPS_HTTP_MISMATCH 2797 0.83 1.22 0.67 165 XMNoVowels 2741 0.65 0.62 0.66 166 XM_ProductURIs 2640 0.67 0.75 0.64 167 XMBody_17 2628 2.37 6.84 0.63 168 RCVD_IN_RP_CERTIFIED 2545 0.59 0.53 0.61 169 XMBrknScrpt_02 2533 0.95 1.81 0.61 170 RELAYCOUNTRY_AU 2494 1.07 2.26 0.60 171 NML_ADSP_CUSTOM_MED 2459 0.63 0.74 0.59 172 XMSubMetaI_00 2453 0.86 1.56 0.59 173 MSGID_NOFQDN1 2429 0.43 0.02 0.59 174 FROM_GOV_DKIM_AU 2366 0.51 0.36 0.57 175 T_Symld_Words_02 2336 0.76 1.27 0.56 176 XMHTML_After_End 2300 0.78 1.34 0.56 177 RCVD_IN_BL_SPAMCOP_NET 2206 4.17 13.50 0.53 178 T_OBFU_PDF_ATTACH 2161 0.40 0.09 0.52 179 XMMoneyMeta_00 2130 0.57 0.71 0.51 180 SHORT_HELO_AND_INLINE_IMAGE 2125 0.38 0.04 0.51 181 TR_XM_Base64_M1 2124 0.69 1.16 0.51 182 TO_NO_BRKTS_HTML_ONLY 2076 0.44 0.30 0.50 183 MPART_ALT_DIFF_COUNT 2027 0.60 0.87 0.49 184 FILL_THIS_FORM 2021 0.42 0.26 0.49 185 FORGED_GMAIL_RCVD 2014 0.55 0.71 0.49 186 XM_B_FormFill 1951 0.37 0.12 0.47 187 USER_IN_WELCOMELIST 1887 0.33 0.00 0.46 188 USER_IN_WHITELIST 1887 0.33 0.00 0.46 189 XM_B_DNDMA 1851 0.55 0.80 0.45 190 RELAYCOUNTRY_GB 1805 0.52 0.72 0.44 191 XM_RXBody 1735 0.48 0.63 0.42 192 T_XMHurry_00 1733 0.80 1.76 0.42 193 XMPhish14 1731 0.76 1.63 0.42 194 TR_XM_PHPForged 1692 0.78 1.74 0.41 195 TR_XM_FormFill2 1655 0.75 1.64 0.40 196 XMSolicitRefs_0 1637 0.41 0.44 0.40 197 TR_XM_PHPDW 1622 0.75 1.69 0.39 198 PLING_QUERY 1621 0.48 0.70 0.39 199 XMPhish30 1610 0.64 1.28 0.39 200 HTML_TAG_BALANCE_BODY 1584 0.67 1.42 0.38 ----------------------------------------------------------------------