Email: 485430 Autolearn: 0 AvgScore: 3.52 AvgScanTime: 1.45 sec Spam: 145076 Autolearn: 0 AvgScore: 13.30 AvgScanTime: 1.61 sec Ham: 340354 Autolearn: 0 AvgScore: -0.65 AvgScanTime: 1.39 sec Time Spent Running SA: 195.85 hours Time Spent Processing Spam: 64.87 hours Time Spent Processing Ham: 130.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141012 89.20 97.20 85.79 2 DKIM_SIGNED 133841 78.40 92.26 72.50 3 XM_DK_Pass 128842 76.54 88.81 71.30 4 DKIM_VALID 127094 75.51 87.61 70.36 5 XM_B_Unicode 126054 75.91 86.89 71.23 6 T_SCC_BODY_TEXT_LINE 117551 82.56 81.03 83.22 7 RELAYCOUNTRY_US 112813 79.84 77.76 80.73 8 XMListUnsubscribeExists 107940 56.62 74.40 49.04 9 XM_B_SpammyWords 107869 52.89 74.35 43.74 10 DCC_CHECK 107263 45.25 73.94 33.03 11 DKIM_VALID_AU 95499 59.19 65.83 56.36 12 XM_B_Unicode3 68205 43.09 47.01 41.41 13 XM_DK_Undo_02 66532 18.29 45.86 6.54 14 XM_B_SpammyWords2 64491 26.90 44.45 19.41 15 LOC_TINY_FONT_1 59443 29.58 40.97 24.72 16 BAYES_50 55296 52.08 38.12 58.04 17 TR_XM_DKIM_Undo 52426 12.77 36.14 2.82 18 BAYES_99 51810 14.67 35.71 5.70 19 HTML_FONT_LOW_CONTRAST 50659 30.12 34.92 28.07 20 FVGT_m_MULTI_ODD 48112 27.79 33.16 25.50 21 MIME_HTML_ONLY 47688 25.05 32.87 21.71 22 DKIM_VALID_EF 46858 29.28 32.30 27.99 23 T_KAM_HTML_FONT_INVALID 42046 22.22 28.98 19.34 24 BAYES_999 40915 11.75 28.20 4.74 25 RCVD_IN_MSPIKE_H2 39855 25.79 27.47 25.07 26 TR_DCC_Bayes_99 37811 9.10 26.06 1.87 27 DCC_CHECK_NEGATIVE 37799 54.71 26.05 66.92 28 TR_XM_DK_Unsub 34960 16.60 24.10 13.40 29 T_TM2_M_HEADER_IN_MSG 32629 25.84 22.49 27.27 30 RELAYCOUNTRY_META 31599 9.47 21.78 4.22 31 XMSubLong 31161 21.58 21.48 21.62 32 XM_Multi_Part_URI 28184 14.97 19.43 13.07 33 TR_XM_SpammyRelay 26653 7.25 18.37 2.51 34 LOTS_OF_MONEY 22854 9.17 15.75 6.36 35 XM_B_Unsub 22552 11.41 15.54 9.65 36 XM_B_SpammyWords3 22496 8.21 15.51 5.09 37 TR_XM_SpammyWords2 22144 5.03 15.26 0.67 38 TR_MAX_INTL_RELAY 21995 9.01 15.16 6.39 39 TR_XM_BayesUnsub 21730 9.04 14.98 6.52 40 UNPARSEABLE_RELAY 21039 11.38 14.50 10.05 41 TR_XM_SpammyWords4 20567 7.27 14.18 4.33 42 RELAYCOUNTRY_CA 19394 4.86 13.37 1.23 43 RCVD_IN_BL_SPAMCOP_NET 19365 4.48 13.35 0.70 44 BOTNET_IPINHOSTNAME 19263 7.40 13.28 4.89 45 TR_XM_SPAMCOP 16086 3.54 11.09 0.32 46 XM_Body_Dirty_Words 15078 6.17 10.39 4.37 47 RCVD_IN_MSPIKE_H3 14181 7.08 9.77 5.93 48 RCVD_IN_MSPIKE_WL 14181 7.08 9.77 5.93 49 XM_Evil_Numbers_Gen 13989 7.53 9.64 6.63 50 BAYES_80 13497 5.56 9.30 3.96 51 BOTNET 12566 3.71 8.66 1.61 52 TR_XM_UnparsRelay 11380 3.43 7.84 1.54 53 BAYES_60 10896 8.54 7.51 8.97 54 FSL_BULK_SIG 10808 4.57 7.45 3.34 55 LotsOfNums_01 10643 7.80 7.34 8.00 56 XMSubMetaSx_00 10252 4.69 7.07 3.68 57 XMSexyCombo_05 9679 3.45 6.67 2.07 58 XMBody_17 9636 2.36 6.64 0.53 59 HTML_IMAGE_RATIO_02 9559 5.76 6.59 5.40 60 HTML_IMAGE_RATIO_04 9318 4.86 6.42 4.19 61 XM_UncommonTLD01 8964 4.36 6.18 3.58 62 XM_B_Phish_Phrases 8740 3.93 6.02 3.04 63 TooManyTo_001 8603 7.51 5.93 8.18 64 MPART_ALT_DIFF 8584 6.81 5.92 7.19 65 XM_H_Long_From01 7905 5.23 5.45 5.13 66 BAYES_95 7887 3.32 5.44 2.42 67 UNTRUSTED_Relay 7713 2.65 5.32 1.52 68 DKIM_INVALID 6747 2.89 4.65 2.14 69 T_FILL_THIS_FORM_SHORT 6585 2.06 4.54 1.00 70 XM_SPF_SoftFail 6462 3.34 4.45 2.86 71 XM_B_Investor 6048 2.27 4.17 1.46 72 XM_H_GMP 6028 5.48 4.16 6.05 73 HK_RANDOM_REPLYTO 5795 1.25 3.99 0.08 74 MIME_HTML_ONLY_MULTI 5741 4.71 3.96 5.03 75 XMNumbers 5604 3.03 3.86 2.67 76 T_XMDrugObfuBody_14 5510 2.54 3.80 2.01 77 TR_XM_SpammyWords5 5445 1.98 3.75 1.22 78 XMStrtUSub 5405 4.14 3.73 4.32 79 TR_XM_PhishingBody 5246 2.37 3.62 1.84 80 HTML_IMAGE_RATIO_06 5081 2.71 3.50 2.37 81 XM_B_SpammyTLD 5072 2.75 3.50 2.43 82 XM_OfRef6 5049 1.83 3.48 1.13 83 TR_XM_BayesRelay 5042 1.04 3.48 0.00 84 MIME_HTML_MOSTLY 4979 3.04 3.43 2.88 85 MIME_QP_LONG_LINE 4847 4.32 3.34 4.73 86 HTML_IMAGE_RATIO_08 4824 2.15 3.33 1.66 87 TR_LOTS_OF_MONEY3 4767 1.27 3.29 0.41 88 T_XMDrugObfuBody_08 4704 2.08 3.24 1.59 89 XM_B_SpammyWords4 4616 1.32 3.18 0.52 90 TM2_M_URI_OPT_OUT 4527 4.40 3.12 4.94 91 USER_IN_DEF_DKIM_WL 4508 8.85 3.11 11.30 92 FONT_INVIS_LONG_LINE 4508 0.96 3.11 0.04 93 TR_XM_FormFill 4289 0.89 2.96 0.01 94 XMStockSpam_06 4152 1.45 2.86 0.85 95 XM_CamelCaseFrm001 4115 2.26 2.84 2.02 96 TM2_M_VERY_LONG_WORD 4058 1.77 2.80 1.33 97 T_TooManySym_01 3906 4.38 2.69 5.10 98 XM_UB50 3851 1.43 2.65 0.91 99 XM_URI_RBL 3642 0.86 2.51 0.16 100 SpammyFromTLD_01 3604 1.26 2.48 0.74 101 XMDiploma_00 3548 2.02 2.45 1.83 102 XM_B_Unsub2 3498 1.81 2.41 1.55 103 RCVD_IN_VALIDITY_SAFE 3487 3.88 2.40 4.50 104 T_XMHurry_00 3456 1.11 2.38 0.57 105 FROM_EXCESS_BASE64 3425 2.10 2.36 1.99 106 RELAYCOUNTRY_AU 3262 1.30 2.25 0.89 107 HTML_MIME_NO_HTML_TAG 3068 2.06 2.11 2.03 108 T_XMDrugObfuBody_00 2984 1.16 2.06 0.77 109 TR_XM_NoHeaderRelay 2847 0.66 1.96 0.11 110 RCVD_IN_VALIDITY_CERTIFIED 2803 3.32 1.93 3.90 111 TR_XM_PHPForged 2766 0.92 1.91 0.50 112 T_REMOTE_IMAGE 2724 3.13 1.88 3.67 113 ANY_BOUNCE_MESSAGE 2723 3.92 1.88 4.80 114 BOUNCE_MESSAGE 2721 3.92 1.88 4.80 115 TR_XM_PHPDW 2625 0.89 1.81 0.50 116 XMBrknScrpt_02 2608 0.91 1.80 0.53 117 TR_XM_FormFill2 2584 0.89 1.78 0.50 118 MAILING_LIST_MULTI 2575 2.31 1.77 2.54 119 TM2_M_A_HREF_HREF 2575 0.90 1.77 0.52 120 XM_H_PHPOS 2575 0.87 1.77 0.49 121 XM_ProductURIs 2489 1.16 1.72 0.92 122 TR_XM_INV_DKIM 2434 0.55 1.68 0.07 123 SpammyFromTLD_02 2401 0.81 1.65 0.45 124 BAYES_40 2298 3.89 1.58 4.87 125 XM_SendGrid 2264 1.51 1.56 1.50 126 URI_TRY_3LD 2228 0.98 1.54 0.75 127 SUBJ_ALL_CAPS 2218 1.40 1.53 1.34 128 URI_HEX 2180 1.17 1.50 1.03 129 XM_RXBody 2175 0.68 1.50 0.33 130 RCVD_IN_IADB_LISTED 2162 3.44 1.49 4.28 131 HTTPS_HTTP_MISMATCH 2160 0.92 1.49 0.68 132 XM_DK_Undo_01 2121 1.57 1.46 1.61 133 XM_DIRTYINTL 2083 0.62 1.44 0.28 134 XMSexyCombo_01 2031 0.63 1.40 0.30 135 BOTNET_NORDNS 2024 0.42 1.40 0.01 136 XMPhish30 2020 1.02 1.39 0.86 137 XMReplyNow 2013 0.57 1.39 0.23 138 RCVD_IN_IADB_SPF 1972 3.07 1.36 3.80 139 HTML_TAG_BALANCE_BODY 1927 0.66 1.33 0.37 140 ALL_TRUSTED 1925 11.54 1.33 15.90 141 RCVD_IN_IADB_DK 1901 2.74 1.31 3.34 142 XM_HighProb1 1895 0.39 1.31 0.00 143 RCVD_IN_IADB_SENDERID 1878 2.79 1.29 3.42 144 XMBdyGiftCard01 1868 0.79 1.29 0.58 145 TR_XM_Base64_M1 1850 0.94 1.28 0.80 146 HOSTED_IMG_MULTI_PUB_01 1822 0.39 1.26 0.02 147 TR_Mismatch_TLD_02 1805 0.44 1.24 0.10 148 XM_Body_Dirty_Words_01 1739 0.52 1.20 0.23 149 XMGenDplmaNmb 1710 1.09 1.18 1.05 150 XM_DKIMWhitelistDomains 1701 6.63 1.17 8.95 151 KHOP_HELO_FCRDNS 1684 1.08 1.16 1.04 152 AC_BR_BONANZA 1635 0.37 1.13 0.05 153 BAYES_20 1623 2.62 1.12 3.25 154 THIS_AD 1592 0.57 1.10 0.34 155 LongTLD 1590 0.52 1.10 0.27 156 XM_UB99 1480 0.31 1.02 0.00 157 SCC_BODY_URI_ONLY 1478 2.06 1.02 2.51 158 TR_XM_Base64_L1 1469 0.38 1.01 0.11 159 DKIM_ADSP_CUSTOM_MED 1465 0.90 1.01 0.86 160 XM_B_COPY_HTML 1461 0.88 1.01 0.83 161 TR_XM_InvalidRelay 1449 0.32 1.00 0.03 162 XM_H_Undi_Recip 1428 0.40 0.98 0.16 163 URI_NOVOWEL 1415 1.38 0.98 1.55 164 DIET_1 1412 0.50 0.97 0.30 165 XM_B_COVIDMETA 1406 0.53 0.97 0.34 166 RDNS_DYNAMIC 1402 0.57 0.97 0.41 167 XM_H_PHPMailer 1400 0.80 0.97 0.73 168 TR_XM_DK_SendGrid 1371 1.01 0.95 1.04 169 MPART_ALT_DIFF_COUNT 1359 0.64 0.94 0.52 170 XMHTML_After_End 1355 0.68 0.93 0.58 171 XM_B_Phish66 1352 0.47 0.93 0.27 172 TR_Symld_Words 1348 1.25 0.93 1.38 173 FORGED_RELAY_MUA_TO_MX 1330 0.28 0.92 0.01 174 XMSubMetaI_00 1322 0.82 0.91 0.78 175 T_MONEY_PERCENT 1314 0.42 0.91 0.21 176 TR_LOTS_OF_MONEY2 1314 0.42 0.91 0.21 177 RCVD_IN_PSBL 1294 0.47 0.89 0.29 178 TM2_M_OBFU_COMMENT 1288 0.46 0.89 0.28 179 NML_ADSP_CUSTOM_MED 1286 0.68 0.89 0.60 180 RELAYCOUNTRY_FR 1266 0.42 0.87 0.23 181 XM_B_DNDMA 1231 0.49 0.85 0.34 182 TR_XM_Undi_Recip19 1204 0.29 0.83 0.06 183 XMSubMetaSxObfu_03 1192 0.48 0.82 0.34 184 XM_UB999 1186 0.25 0.82 0.00 185 XM_B_SEO 1178 0.41 0.81 0.24 186 SHOPIFY_IMG_NOT_RCVD_SFY 1176 0.47 0.81 0.32 187 TVD_RCVD_IP 1168 1.29 0.81 1.50 188 TooManyTo_002 1102 1.87 0.76 2.35 189 XMBody_78 1097 0.50 0.76 0.40 190 HTML_FONT_FACE_BAD 1086 0.53 0.75 0.43 191 HELO_DYNAMIC_SPLIT_IP 1080 0.23 0.74 0.01 192 RCVD_IN_VALIDITY_RPBL 1078 0.23 0.74 0.02 193 FORGED_GMAIL_RCVD 1078 0.55 0.74 0.47 194 TR_MetaPhish_Combo_01 1074 0.79 0.74 0.81 195 TR_XM_Undi_RecipCombo2 1060 0.22 0.73 0.01 196 XM_OfRef7 1055 0.34 0.73 0.17 197 TR_XM_SEO4 1055 0.28 0.73 0.09 198 XM_H_Long_From02 1035 0.96 0.71 1.07 199 URIBL_DBL_SPAM 1032 0.21 0.71 0.00 200 T_TooManySym_02 1017 1.93 0.70 2.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 291978 89.20 97.20 85.79 2 T_SCC_BODY_TEXT_LINE 283241 82.56 81.03 83.22 3 RELAYCOUNTRY_US 274759 79.84 77.76 80.73 4 DKIM_SIGNED 246757 78.40 92.26 72.50 5 XM_DK_Pass 242684 76.54 88.81 71.30 6 XM_B_Unicode 242442 75.91 86.89 71.23 7 DKIM_VALID 239462 75.51 87.61 70.36 8 DCC_CHECK_NEGATIVE 227780 54.71 26.05 66.92 9 BAYES_50 197531 52.08 38.12 58.04 10 DKIM_VALID_AU 191811 59.19 65.83 56.36 11 XMListUnsubscribeExists 166924 56.62 74.40 49.04 12 XM_B_SpammyWords 148869 52.89 74.35 43.74 13 XM_B_Unicode3 140951 43.09 47.01 41.41 14 DCC_CHECK 112409 45.25 73.94 33.03 15 HTML_FONT_LOW_CONTRAST 95551 30.12 34.92 28.07 16 DKIM_VALID_EF 95270 29.28 32.30 27.99 17 T_TM2_M_HEADER_IN_MSG 92808 25.84 22.49 27.27 18 FVGT_m_MULTI_ODD 86783 27.79 33.16 25.50 19 RCVD_IN_MSPIKE_H2 85327 25.79 27.47 25.07 20 LOC_TINY_FONT_1 84134 29.58 40.97 24.72 21 MIME_HTML_ONLY 73891 25.05 32.87 21.71 22 XMSubLong 73596 21.58 21.48 21.62 23 XM_B_SpammyWords2 66077 26.90 44.45 19.41 24 T_KAM_HTML_FONT_INVALID 65815 22.22 28.98 19.34 25 ALL_TRUSTED 54104 11.54 1.33 15.90 26 TR_XM_DK_Unsub 45624 16.60 24.10 13.40 27 XM_Multi_Part_URI 44494 14.97 19.43 13.07 28 USER_IN_DEF_DKIM_WL 38460 8.85 3.11 11.30 29 BAYES_00 34837 7.39 0.70 10.24 30 UNPARSEABLE_RELAY 34217 11.38 14.50 10.05 31 XM_B_Unsub 32839 11.41 15.54 9.65 32 BAYES_60 30542 8.54 7.51 8.97 33 XM_DKIMWhitelistDomains 30471 6.63 1.17 8.95 34 TooManyTo_001 27837 7.51 5.93 8.18 35 LotsOfNums_01 27212 7.80 7.34 8.00 36 MPART_ALT_DIFF 24463 6.81 5.92 7.19 37 XM_Evil_Numbers_Gen 22578 7.53 9.64 6.63 38 XM_DK_Undo_02 22274 18.29 45.86 6.54 39 TR_XM_BayesUnsub 22176 9.04 14.98 6.52 40 TR_MAX_INTL_RELAY 21738 9.01 15.16 6.39 41 LOTS_OF_MONEY 21647 9.17 15.75 6.36 42 TR_XM_DK_Bayes 21508 4.56 0.42 6.32 43 TR_XM_DK_Bayes1 21190 4.49 0.42 6.23 44 IN_ZIMBRA_NJ_WHITELIST 21064 4.36 0.09 6.19 45 XM_H_GMP 20579 5.48 4.16 6.05 46 RCVD_IN_MSPIKE_H3 20198 7.08 9.77 5.93 47 RCVD_IN_MSPIKE_WL 20198 7.08 9.77 5.93 48 BAYES_99 19397 14.67 35.71 5.70 49 HTML_IMAGE_RATIO_02 18391 5.76 6.59 5.40 50 TR_XM_DK_Bayes2 18380 3.89 0.36 5.40 51 XM_H_Long_From01 17471 5.23 5.45 5.13 52 T_TooManySym_01 17353 4.38 2.69 5.10 53 XM_B_SpammyWords3 17337 8.21 15.51 5.09 54 MIME_HTML_ONLY_MULTI 17124 4.71 3.96 5.03 55 TM2_M_URI_OPT_OUT 16830 4.40 3.12 4.94 56 BOTNET_IPINHOSTNAME 16644 7.40 13.28 4.89 57 BAYES_40 16590 3.89 1.58 4.87 58 ANY_BOUNCE_MESSAGE 16322 3.92 1.88 4.80 59 BOUNCE_MESSAGE 16322 3.92 1.88 4.80 60 BAYES_999 16139 11.75 28.20 4.74 61 MIME_QP_LONG_LINE 16115 4.32 3.34 4.73 62 RCVD_IN_VALIDITY_SAFE 15324 3.88 2.40 4.50 63 XM_Body_Dirty_Words 14869 6.17 10.39 4.37 64 TR_XM_SpammyWords4 14747 7.27 14.18 4.33 65 XMStrtUSub 14697 4.14 3.73 4.32 66 RCVD_IN_IADB_LISTED 14561 3.44 1.49 4.28 67 XM_PDF 14506 3.13 0.49 4.26 68 RELAYCOUNTRY_META 14371 9.47 21.78 4.22 69 HTML_IMAGE_RATIO_04 14269 4.86 6.42 4.19 70 BAYES_80 13472 5.56 9.30 3.96 71 RCVD_IN_VALIDITY_CERTIFIED 13290 3.32 1.93 3.90 72 RCVD_IN_IADB_SPF 12949 3.07 1.36 3.80 73 XM_H_Trusted_IP 12822 2.64 0.00 3.77 74 XMSubMetaSx_00 12536 4.69 7.07 3.68 75 T_REMOTE_IMAGE 12487 3.13 1.88 3.67 76 XM_UncommonTLD01 12189 4.36 6.18 3.58 77 RCVD_IN_IADB_SENDERID 11651 2.79 1.29 3.42 78 RCVD_IN_IADB_DK 11383 2.74 1.31 3.34 79 FSL_BULK_SIG 11381 4.57 7.45 3.34 80 BAYES_20 11076 2.62 1.12 3.25 81 XM_B_Phish_Phrases 10351 3.93 6.02 3.04 82 MIME_HTML_MOSTLY 9794 3.04 3.43 2.88 83 XM_SPF_SoftFail 9744 3.34 4.45 2.86 84 TR_XM_DKIM_Undo 9582 12.77 36.14 2.82 85 XMNumbers 9090 3.03 3.86 2.67 86 RCVD_IN_IADB_VOUCHED 8895 1.99 0.54 2.61 87 BAYES_05 8655 1.94 0.52 2.54 88 MAILING_LIST_MULTI 8636 2.31 1.77 2.54 89 TR_XM_SpammyRelay 8544 7.25 18.37 2.51 90 SCC_BODY_URI_ONLY 8530 2.06 1.02 2.51 91 T_TooManySym_02 8334 1.93 0.70 2.45 92 XM_B_SpammyTLD 8281 2.75 3.50 2.43 93 BAYES_95 8253 3.32 5.44 2.42 94 HTML_IMAGE_RATIO_06 8060 2.71 3.50 2.37 95 TooManyTo_002 7983 1.87 0.76 2.35 96 DKIM_INVALID 7295 2.89 4.65 2.14 97 INVALID_MSGID 7098 1.51 0.15 2.09 98 XMSexyCombo_05 7052 3.45 6.67 2.07 99 HTML_MIME_NO_HTML_TAG 6914 2.06 2.11 2.03 100 XM_CamelCaseFrm001 6869 2.26 2.84 2.02 101 T_XMDrugObfuBody_14 6842 2.54 3.80 2.01 102 FROM_EXCESS_BASE64 6760 2.10 2.36 1.99 103 TR_DCC_Bayes_99 6355 9.10 26.06 1.87 104 TO_MALFORMED 6327 1.31 0.01 1.86 105 TR_XM_PhishingBody 6271 2.37 3.62 1.84 106 XMDiploma_00 6245 2.02 2.45 1.83 107 RCVD_IN_IADB_OPTIN 6108 1.36 0.35 1.79 108 XMSubNoVowel 5794 1.35 0.52 1.70 109 HTML_IMAGE_RATIO_08 5636 2.15 3.33 1.66 110 XM_DK_Undo_01 5492 1.57 1.46 1.61 111 BOTNET 5464 3.71 8.66 1.61 112 HELO_NODOT 5457 1.27 0.50 1.60 113 HELO_NO_DOMAIN 5452 1.27 0.50 1.60 114 T_XMDrugObfuBody_08 5413 2.08 3.24 1.59 115 XM_B_Unsub2 5279 1.81 2.41 1.55 116 URI_NOVOWEL 5271 1.38 0.98 1.55 117 TR_XM_UnparsRelay 5250 3.43 7.84 1.54 118 UNTRUSTED_Relay 5158 2.65 5.32 1.52 119 TVD_RCVD_IP 5103 1.29 0.81 1.50 120 XM_SendGrid 5090 1.51 1.56 1.50 121 IN_HORDE_ADDRESS_BOOK 5033 1.07 0.10 1.48 122 XM_B_Investor 4979 2.27 4.17 1.46 123 XMGappySubj_01 4939 1.07 0.19 1.45 124 TR_Symld_Words 4697 1.25 0.93 1.38 125 SUBJ_ALL_CAPS 4574 1.40 1.53 1.34 126 TM2_M_VERY_LONG_WORD 4532 1.77 2.80 1.33 127 TooManyTo_003 4394 1.10 0.66 1.29 128 RELAYCOUNTRY_CA 4196 4.86 13.37 1.23 129 TR_XM_SpammyWords5 4150 1.98 3.75 1.22 130 XMBSHREFv2 3978 0.97 0.49 1.17 131 XM_OfRef6 3835 1.83 3.48 1.13 132 XM_GoogleGroups 3789 0.94 0.53 1.11 133 TVD_SPACE_RATIO 3666 0.79 0.12 1.08 134 XM_H_Long_From02 3634 0.96 0.71 1.07 135 XMGenDplmaNmb 3557 1.09 1.18 1.05 136 XMBody_95 3551 0.77 0.14 1.04 137 TR_XM_DK_SendGrid 3547 1.01 0.95 1.04 138 KHOP_HELO_FCRDNS 3545 1.08 1.16 1.04 139 URI_HEX 3497 1.17 1.50 1.03 140 FROM_GOV_DKIM_AU 3410 0.77 0.22 1.00 141 T_FILL_THIS_FORM_SHORT 3392 2.06 4.54 1.00 142 XMCapTrack 3356 0.81 0.39 0.99 143 XM_ProductURIs 3134 1.16 1.72 0.92 144 XM_UB50 3111 1.43 2.65 0.91 145 TooManyTo_004 3091 0.82 0.60 0.91 146 RELAYCOUNTRY_AU 3032 1.30 2.25 0.89 147 XMGappySubj_02 3014 0.64 0.06 0.89 148 RCVD_IN_RP_SAFE 2970 0.77 0.54 0.87 149 XMPhish30 2930 1.02 1.39 0.86 150 DKIM_ADSP_CUSTOM_MED 2921 0.90 1.01 0.86 151 XMStockSpam_06 2902 1.45 2.86 0.85 152 T_TooManySym_03 2855 0.67 0.26 0.84 153 XM_B_COPY_HTML 2829 0.88 1.01 0.83 154 TR_MetaPhish_Combo_01 2745 0.79 0.74 0.81 155 TR_XM_Base64_M1 2727 0.94 1.28 0.80 156 XMSubMetaI_00 2654 0.82 0.91 0.78 157 T_XMDrugObfuBody_00 2632 1.16 2.06 0.77 158 RCVD_IN_RP_CERTIFIED 2588 0.66 0.43 0.76 159 URI_TRY_3LD 2542 0.98 1.54 0.75 160 TooManyTo_005 2533 0.69 0.56 0.74 161 XM_ShortIntro_01 2530 0.65 0.43 0.74 162 SpammyFromTLD_01 2528 1.26 2.48 0.74 163 XM_H_PHPMailer 2479 0.80 0.97 0.73 164 RCVD_IN_BL_SPAMCOP_NET 2397 4.48 13.35 0.70 165 MSGID_NOFQDN1 2362 0.49 0.02 0.69 166 HTTPS_HTTP_MISMATCH 2316 0.92 1.49 0.68 167 TR_XM_SpammyWords2 2269 5.03 15.26 0.67 168 TVD_SPACE_RATIO_MINFP 2163 0.52 0.24 0.64 169 T_OBFU_PDF_ATTACH 2160 0.47 0.07 0.63 170 HTML_IMAGE_ONLY_12 2075 0.47 0.13 0.61 171 NML_ADSP_CUSTOM_MED 2030 0.68 0.89 0.60 172 XMBdyGiftCard01 1990 0.79 1.29 0.58 173 XMHTML_After_End 1970 0.68 0.93 0.58 174 T_XMHurry_00 1933 1.11 2.38 0.57 175 XM_B_FormFill 1911 0.41 0.05 0.56 176 XMBody_17 1807 2.36 6.64 0.53 177 XMBrknScrpt_02 1800 0.91 1.80 0.53 178 XM_B_SpammyWords4 1778 1.32 3.18 0.52 179 TM2_M_A_HREF_HREF 1775 0.90 1.77 0.52 180 MPART_ALT_DIFF_COUNT 1765 0.64 0.94 0.52 181 FILL_THIS_FORM 1746 0.43 0.25 0.51 182 TR_XM_FormFill2 1714 0.89 1.78 0.50 183 TR_XM_PHPForged 1711 0.92 1.91 0.50 184 XMNoVowels 1707 0.50 0.50 0.50 185 USER_IN_WHITELIST 1700 0.35 0.00 0.50 186 USER_IN_WELCOMELIST 1700 0.35 0.00 0.50 187 TR_XM_PHPDW 1695 0.89 1.81 0.50 188 XMMoneyMeta_00 1667 0.52 0.59 0.49 189 XM_H_PHPOS 1662 0.87 1.77 0.49 190 SHORT_HELO_AND_INLINE_IMAGE 1652 0.35 0.04 0.49 191 FORGED_GMAIL_RCVD 1614 0.55 0.74 0.47 192 XMLngstWrd_00 1580 0.45 0.43 0.46 193 SpammyFromTLD_02 1525 0.81 1.65 0.45 194 PLING_QUERY 1475 0.50 0.66 0.43 195 TO_NO_BRKTS_HTML_ONLY 1470 0.39 0.29 0.43 196 T_Symld_Words_02 1468 0.51 0.68 0.43 197 HTML_FONT_FACE_BAD 1465 0.53 0.75 0.43 198 HTML_IMAGE_ONLY_20 1431 0.44 0.49 0.42 199 RELAYCOUNTRY_GB 1430 0.44 0.50 0.42 200 MISSING_HEADERS 1389 0.42 0.45 0.41 ----------------------------------------------------------------------