Email: 564593 Autolearn: 0 AvgScore: 4.11 AvgScanTime: 1.27 sec Spam: 180391 Autolearn: 0 AvgScore: 12.93 AvgScanTime: 1.32 sec Ham: 384202 Autolearn: 0 AvgScore: -0.03 AvgScanTime: 1.25 sec Time Spent Running SA: 199.35 hours Time Spent Processing Spam: 65.96 hours Time Spent Processing Ham: 133.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 166253 76.39 92.16 68.99 2 XM_DK_Pass 160059 74.49 88.73 67.80 3 DKIM_VALID 158076 73.49 87.63 66.85 4 HTML_MESSAGE 150687 85.75 83.53 86.79 5 RELAYCOUNTRY_US 147394 77.31 81.71 75.24 6 XMListUnsubscribeExists 137538 55.69 76.24 46.03 7 XM_B_Unicode 134628 72.86 74.63 72.02 8 DKIM_VALID_AU 123860 58.33 68.66 53.48 9 DCC_CHECK 113496 41.27 62.92 31.11 10 XM_B_SpammyWords 112065 47.06 62.12 39.98 11 XM_B_Unicode3 70505 42.01 39.08 43.39 12 XM_DK_Undo_02 70251 16.11 38.94 5.38 13 DCC_CHECK_NEGATIVE 66876 58.70 37.07 68.85 14 XM_B_SpammyWords2 65108 22.91 36.09 16.73 15 LOC_TINY_FONT_1 63050 26.93 34.95 23.16 16 BAYES_50 61593 52.46 34.14 61.06 17 HTML_FONT_LOW_CONTRAST 56723 27.33 31.44 25.40 18 BAYES_99 56621 13.14 31.39 4.57 19 TR_XM_DKIM_Undo 53630 10.94 29.73 2.11 20 FVGT_m_MULTI_ODD 52519 25.09 29.11 23.20 21 DKIM_VALID_EF 48008 26.36 26.61 26.24 22 MIME_HTML_ONLY 47567 25.72 26.37 25.42 23 RCVD_IN_MSPIKE_H2 47252 25.59 26.19 25.30 24 XMSubLong 45480 25.88 25.21 26.19 25 T_KAM_HTML_FONT_INVALID 45163 21.28 25.04 19.52 26 BAYES_999 44646 10.36 24.75 3.60 27 TR_DCC_Bayes_99 40603 8.38 22.51 1.74 28 T_TM2_M_HEADER_IN_MSG 36600 24.75 20.29 26.84 29 TR_XM_DK_Unsub 36090 14.68 20.01 12.18 30 XM_UncommonTLD01 34579 9.49 19.17 4.95 31 RELAYCOUNTRY_META 31417 8.21 17.42 3.89 32 XMNumbers 31272 7.31 17.34 2.60 33 XM_Multi_Part_URI 31004 14.25 17.19 12.88 34 SpammyFromTLD_01 27822 5.50 15.42 0.84 35 TR_XM_PHPForged 27693 5.23 15.35 0.47 36 TR_XM_PHPDW 27643 5.22 15.32 0.48 37 TR_XM_FormFill2 27588 5.22 15.29 0.49 38 XM_H_PHPOS 27575 5.20 15.29 0.46 39 XM_B_Unsub 24902 13.52 13.80 13.39 40 TM2_M_BODY_EMPTY 24884 4.74 13.79 0.49 41 XMEmptyBody_01 24815 4.51 13.76 0.17 42 TR_XM_SpammyRelay 24623 5.78 13.65 2.09 43 TR_XM_BayesUnsub 24186 12.37 13.41 11.88 44 TR_MAX_INTL_RELAY 23607 8.43 13.09 6.25 45 XM_B_SpammyWords3 22814 6.74 12.65 3.96 46 TR_XM_SpammyWords2 22318 4.30 12.37 0.50 47 UNPARSEABLE_RELAY 21933 10.36 12.16 9.51 48 BOTNET_IPINHOSTNAME 21475 6.47 11.90 3.92 49 LOTS_OF_MONEY 21435 8.37 11.88 6.73 50 XM_SPF_SoftFail 19490 6.52 10.80 4.51 51 TR_XM_SpammyWords4 19046 6.59 10.56 4.72 52 RCVD_IN_BL_SPAMCOP_NET 17393 3.42 9.64 0.51 53 RELAYCOUNTRY_CA 16570 3.74 9.19 1.19 54 BOTNET 15066 3.38 8.35 1.05 55 TR_XM_SPAMCOP 14572 2.78 8.08 0.29 56 BAYES_80 14510 5.13 8.04 3.77 57 XM_Evil_Numbers_Gen 14450 7.33 8.01 7.01 58 FSL_BULK_SIG 12685 4.31 7.03 3.03 59 RCVD_IN_MSPIKE_H3 12637 6.08 7.01 5.65 60 RCVD_IN_MSPIKE_WL 12637 6.08 7.01 5.65 61 TR_XM_UnparsRelay 12394 3.33 6.87 1.67 62 BAYES_60 12171 7.71 6.75 8.17 63 LotsOfNums_01 12049 7.48 6.68 7.85 64 XM_Body_Dirty_Words 11502 3.96 6.38 2.82 65 BAYES_20 11267 4.29 6.25 3.37 66 HTML_IMAGE_RATIO_02 10628 5.09 5.89 4.71 67 BAYES_40 10282 5.21 5.70 4.97 68 MPART_ALT_DIFF 10113 4.36 5.61 3.78 69 UNTRUSTED_Relay 9982 2.76 5.53 1.46 70 XMSubMetaSx_00 9795 4.45 5.43 4.00 71 TooManyTo_001 9331 11.71 5.17 14.78 72 BAYES_95 8495 3.19 4.71 2.48 73 HTML_IMAGE_RATIO_04 8376 4.05 4.64 3.77 74 XM_H_Long_From01 8275 4.80 4.59 4.90 75 DKIM_INVALID 8177 2.90 4.53 2.14 76 XM_B_Phish_Phrases 8092 3.76 4.49 3.41 77 XMBody_17 7833 1.74 4.34 0.52 78 XMSexyCombo_05 7175 2.18 3.98 1.34 79 XM_B_Investor 7056 2.39 3.91 1.67 80 HTML_IMAGE_RATIO_06 6805 3.36 3.77 3.17 81 XM_H_GMP 6532 5.27 3.62 6.04 82 TR_XM_SpammyWords5 6402 1.85 3.55 1.05 83 MIME_HTML_MOSTLY 6318 2.58 3.50 2.14 84 T_XMDrugObfuBody_14 5907 2.03 3.27 1.45 85 TM2_M_URI_OPT_OUT 5841 2.18 3.24 1.68 86 HTML_IMAGE_RATIO_08 5820 2.66 3.23 2.39 87 MIME_QP_LONG_LINE 5703 4.43 3.16 5.02 88 MIME_HTML_ONLY_MULTI 5531 2.53 3.07 2.28 89 TR_XM_PhishingBody 5406 2.00 3.00 1.53 90 T_FILL_THIS_FORM_SHORT 5380 1.50 2.98 0.80 91 TM2_M_VERY_LONG_WORD 5057 1.69 2.80 1.16 92 XM_B_SpammyTLD 5009 2.41 2.78 2.24 93 XM_UB50 4861 1.49 2.69 0.93 94 T_XMDrugObfuBody_08 4838 1.87 2.68 1.50 95 XMStrtUSub 4822 3.56 2.67 3.97 96 XM_OfRef6 4647 1.58 2.58 1.12 97 BAYES_05 4590 2.53 2.54 2.53 98 USER_IN_DEF_DKIM_WL 4545 9.44 2.52 12.69 99 XM_CamelCaseFrm001 4344 2.18 2.41 2.07 100 HK_RANDOM_REPLYTO 4336 0.83 2.40 0.10 101 XMDiploma_00 4315 5.96 2.39 7.63 102 XM_URI_RBL 4311 0.88 2.39 0.17 103 RCVD_IN_VALIDITY_SAFE 4104 3.90 2.28 4.67 104 TR_LOTS_OF_MONEY3 3805 1.04 2.11 0.54 105 T_TooManySym_01 3790 4.00 2.10 4.89 106 XM_B_Unsub2 3724 1.41 2.06 1.11 107 TR_XM_BayesRelay 3696 0.66 2.05 0.00 108 XM_B_SpammyWords4 3585 1.02 1.99 0.57 109 SpammyFromTLD_02 3457 1.81 1.92 1.76 110 RCVD_IN_VALIDITY_CERTIFIED 3425 3.43 1.90 4.15 111 TR_XM_FormFill 3420 0.63 1.90 0.03 112 RELAYCOUNTRY_AU 3406 1.01 1.89 0.60 113 TR_XM_INV_DKIM 3265 0.62 1.81 0.07 114 FONT_INVIS_LONG_LINE 3259 0.60 1.81 0.03 115 ANY_BOUNCE_MESSAGE 3226 3.32 1.79 4.05 116 BOUNCE_MESSAGE 3214 3.32 1.78 4.04 117 TR_XM_NoHeaderRelay 3175 0.64 1.76 0.11 118 SUBJ_ALL_CAPS 3084 1.42 1.71 1.29 119 RCVD_IN_IADB_LISTED 3017 3.38 1.67 4.18 120 T_XMHurry_00 2966 0.88 1.64 0.52 121 HTML_MIME_NO_HTML_TAG 2951 1.78 1.64 1.84 122 MAILING_LIST_MULTI 2949 2.26 1.63 2.55 123 T_XMDrugObfuBody_00 2935 0.91 1.63 0.58 124 T_REMOTE_IMAGE 2879 2.70 1.60 3.22 125 FROM_EXCESS_BASE64 2878 1.73 1.60 1.80 126 URI_NOVOWEL 2751 1.60 1.53 1.63 127 XMBrknScrpt_02 2663 0.97 1.48 0.73 128 RCVD_IN_IADB_SPF 2642 2.99 1.46 3.71 129 URI_HEX 2619 1.22 1.45 1.11 130 XM_DK_Undo_01 2557 1.63 1.42 1.73 131 XM_H_Long_From02 2546 1.13 1.41 0.99 132 AC_BR_BONANZA 2544 0.50 1.41 0.07 133 XM_SendGrid 2521 1.38 1.40 1.37 134 RCVD_IN_IADB_SENDERID 2490 2.73 1.38 3.36 135 RCVD_IN_IADB_DK 2473 2.67 1.37 3.28 136 LongTLD 2465 0.64 1.37 0.30 137 XMLngstWrd_00 2417 0.89 1.34 0.69 138 XMStockSpam_06 2351 0.96 1.30 0.80 139 XM_HighProb1 2334 0.42 1.29 0.00 140 MPART_ALT_DIFF_COUNT 2298 0.80 1.27 0.57 141 XMReplyNow 2267 0.61 1.26 0.31 142 BOTNET_NORDNS 2264 0.41 1.26 0.01 143 XMGenDplmaNmb 2198 5.12 1.22 6.95 144 ALL_TRUSTED 2167 15.16 1.20 21.72 145 TR_MetaPhish_Combo_01 2152 0.85 1.19 0.69 146 HOSTED_IMG_MULTI_PUB_01 2138 0.41 1.19 0.04 147 HTML_TAG_BALANCE_BODY 2135 0.68 1.18 0.44 148 XM_DIRTYINTL 2114 0.53 1.17 0.23 149 HTTPS_HTTP_MISMATCH 2104 0.95 1.17 0.85 150 RCVD_IN_PSBL 2067 0.56 1.15 0.28 151 THIS_AD 2064 0.59 1.14 0.33 152 TR_XM_Base64_M1 2052 0.84 1.14 0.71 153 XMPhish30 2051 0.74 1.14 0.55 154 URI_TRY_3LD 2000 0.80 1.11 0.66 155 TR_Mismatch_TLD_02 1945 0.39 1.08 0.06 156 RELAYCOUNTRY_GB 1883 0.63 1.04 0.43 157 TR_Symld_Words 1831 1.22 1.02 1.32 158 XMHTML_After_End 1808 0.58 1.00 0.38 159 KHOP_HELO_FCRDNS 1783 1.03 0.99 1.05 160 XMBody_78 1754 0.53 0.97 0.32 161 FROM_SUSPICIOUS_NTLD 1752 0.33 0.97 0.02 162 DIET_1 1712 0.47 0.95 0.25 163 TR_XM_InvalidRelay 1706 0.31 0.95 0.02 164 TR_XM_DK_SendGrid 1668 0.92 0.92 0.91 165 XMBdyGiftCard01 1666 0.68 0.92 0.57 166 XM_H_PHPMailer 1663 0.76 0.92 0.69 167 XMSexyCombo_01 1625 0.51 0.90 0.32 168 RDNS_DYNAMIC 1615 0.56 0.90 0.41 169 FROM_SUSPICIOUS_NTLD_FP 1608 0.30 0.89 0.02 170 T_Symld_Words_02 1606 0.63 0.89 0.51 171 XMSubMetaI_00 1577 0.51 0.87 0.34 172 XM_UB99 1552 0.28 0.86 0.00 173 RELAYCOUNTRY_FR 1537 0.44 0.85 0.24 174 RCVD_IN_VALIDITY_RPBL 1485 0.28 0.82 0.02 175 TR_LOTS_OF_MONEY2 1481 0.57 0.82 0.45 176 T_MONEY_PERCENT 1481 0.57 0.82 0.45 177 XM_B_COVIDMETA 1439 0.38 0.80 0.19 178 XM_H_Undi_Recip 1421 0.35 0.79 0.14 179 XM_S_SpammyWords 1394 0.37 0.77 0.19 180 TR_XM_Spammywords 1394 0.37 0.77 0.19 181 XM_UB60 1392 0.29 0.77 0.07 182 XMClaimOffer 1391 0.35 0.77 0.15 183 DKIM_ADSP_CUSTOM_MED 1341 0.81 0.74 0.84 184 XM_BadFromFormat 1334 0.29 0.74 0.07 185 XM_B_Phish66 1318 0.42 0.73 0.27 186 TooManyTo_002 1314 1.98 0.73 2.57 187 RCVD_IN_IADB_VOUCHED 1313 1.92 0.73 2.48 188 HTML_FONT_FACE_BAD 1305 0.85 0.72 0.91 189 SHOPIFY_IMG_NOT_RCVD_SFY 1304 0.42 0.72 0.28 190 XM_B_SEO 1277 0.35 0.71 0.18 191 TR_XM_Base64_L1 1275 0.31 0.71 0.12 192 TR_Caps_n_Bayes_99 1230 0.24 0.68 0.03 193 XMSubMetaSxObfu_03 1229 0.59 0.68 0.55 194 RELAYCOUNTRY_IN 1228 0.25 0.68 0.05 195 TVD_RCVD_IP 1226 1.10 0.68 1.29 196 XMHTMLBadTable_001 1220 0.46 0.68 0.36 197 XM_B_DNDMA 1208 0.39 0.67 0.26 198 TM2_M_A_HREF_HREF 1198 0.36 0.66 0.21 199 XM_UB80 1188 0.22 0.66 0.02 200 PDS_OTHER_BAD_TLD 1168 0.28 0.65 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 333460 85.75 83.53 86.79 2 RELAYCOUNTRY_US 289085 77.31 81.71 75.24 3 XM_B_Unicode 276712 72.86 74.63 72.02 4 DKIM_SIGNED 265053 76.39 92.16 68.99 5 DCC_CHECK_NEGATIVE 264520 58.70 37.07 68.85 6 XM_DK_Pass 260495 74.49 88.73 67.80 7 DKIM_VALID 256841 73.49 87.63 66.85 8 BAYES_50 234598 52.46 34.14 61.06 9 DKIM_VALID_AU 205460 58.33 68.66 53.48 10 XMListUnsubscribeExists 176867 55.69 76.24 46.03 11 XM_B_Unicode3 166705 42.01 39.08 43.39 12 XM_B_SpammyWords 153606 47.06 62.12 39.98 13 DCC_CHECK 119514 41.27 62.92 31.11 14 T_TM2_M_HEADER_IN_MSG 103129 24.75 20.29 26.84 15 DKIM_VALID_EF 100822 26.36 26.61 26.24 16 XMSubLong 100614 25.88 25.21 26.19 17 MIME_HTML_ONLY 97672 25.72 26.37 25.42 18 HTML_FONT_LOW_CONTRAST 97603 27.33 31.44 25.40 19 RCVD_IN_MSPIKE_H2 97214 25.59 26.19 25.30 20 FVGT_m_MULTI_ODD 89116 25.09 29.11 23.20 21 LOC_TINY_FONT_1 88999 26.93 34.95 23.16 22 ALL_TRUSTED 83445 15.16 1.20 21.72 23 T_KAM_HTML_FONT_INVALID 74990 21.28 25.04 19.52 24 XM_B_SpammyWords2 64263 22.91 36.09 16.73 25 TooManyTo_001 56798 11.71 5.17 14.78 26 XM_B_Unsub 51446 13.52 13.80 13.39 27 XM_Multi_Part_URI 49470 14.25 17.19 12.88 28 USER_IN_DEF_DKIM_WL 48768 9.44 2.52 12.69 29 TR_XM_DK_Unsub 46814 14.68 20.01 12.18 30 TR_XM_BayesUnsub 45640 12.37 13.41 11.88 31 UNPARSEABLE_RELAY 36553 10.36 12.16 9.51 32 BAYES_00 34877 6.33 0.48 9.08 33 BAYES_60 31381 7.71 6.75 8.17 34 LotsOfNums_01 30168 7.48 6.68 7.85 35 XMDiploma_00 29331 5.96 2.39 7.63 36 XM_DKIMWhitelistDomains 28087 4.98 0.02 7.31 37 XM_Evil_Numbers_Gen 26920 7.33 8.01 7.01 38 XMGenDplmaNmb 26706 5.12 1.22 6.95 39 LOTS_OF_MONEY 25847 8.37 11.88 6.73 40 IN_ZIMBRA_NJ_WHITELIST 24401 4.35 0.08 6.35 41 TR_MAX_INTL_RELAY 24016 8.43 13.09 6.25 42 TR_XM_DK_Bayes 23582 4.29 0.36 6.14 43 TR_XM_DK_Bayes1 23253 4.23 0.34 6.05 44 XM_H_GMP 23209 5.27 3.62 6.04 45 RCVD_IN_MSPIKE_H3 21702 6.08 7.01 5.65 46 RCVD_IN_MSPIKE_WL 21702 6.08 7.01 5.65 47 XM_DK_Undo_02 20684 16.11 38.94 5.38 48 TR_XM_DK_Bayes2 19909 3.62 0.28 5.18 49 MIME_QP_LONG_LINE 19285 4.43 3.16 5.02 50 BAYES_40 19110 5.21 5.70 4.97 51 XM_UncommonTLD01 19005 9.49 19.17 4.95 52 XM_H_Long_From01 18815 4.80 4.59 4.90 53 T_TooManySym_01 18793 4.00 2.10 4.89 54 TR_XM_SpammyWords4 18150 6.59 10.56 4.72 55 HTML_IMAGE_RATIO_02 18113 5.09 5.89 4.71 56 RCVD_IN_VALIDITY_SAFE 17928 3.90 2.28 4.67 57 BAYES_99 17571 13.14 31.39 4.57 58 XM_SPF_SoftFail 17324 6.52 10.80 4.51 59 XM_PDF 16183 3.03 0.52 4.21 60 RCVD_IN_IADB_LISTED 16056 3.38 1.67 4.18 61 RCVD_IN_VALIDITY_CERTIFIED 15939 3.43 1.90 4.15 62 ANY_BOUNCE_MESSAGE 15543 3.32 1.79 4.05 63 BOUNCE_MESSAGE 15526 3.32 1.78 4.04 64 XMSubMetaSx_00 15351 4.45 5.43 4.00 65 XMStrtUSub 15258 3.56 2.67 3.97 66 XM_B_SpammyWords3 15221 6.74 12.65 3.96 67 BOTNET_IPINHOSTNAME 15050 6.47 11.90 3.92 68 RELAYCOUNTRY_META 14930 8.21 17.42 3.89 69 MPART_ALT_DIFF 14515 4.36 5.61 3.78 70 HTML_IMAGE_RATIO_04 14501 4.05 4.64 3.77 71 BAYES_80 14466 5.13 8.04 3.77 72 RCVD_IN_IADB_SPF 14253 2.99 1.46 3.71 73 BAYES_999 13846 10.36 24.75 3.60 74 XM_B_Phish_Phrases 13113 3.76 4.49 3.41 75 BAYES_20 12942 4.29 6.25 3.37 76 RCVD_IN_IADB_SENDERID 12922 2.73 1.38 3.36 77 RCVD_IN_IADB_DK 12593 2.67 1.37 3.28 78 T_REMOTE_IMAGE 12367 2.70 1.60 3.22 79 HTML_IMAGE_RATIO_06 12177 3.36 3.77 3.17 80 FSL_BULK_SIG 11624 4.31 7.03 3.03 81 XM_Body_Dirty_Words 10844 3.96 6.38 2.82 82 XMNumbers 9980 7.31 17.34 2.60 83 TooManyTo_002 9888 1.98 0.73 2.57 84 MAILING_LIST_MULTI 9794 2.26 1.63 2.55 85 BAYES_05 9713 2.53 2.54 2.53 86 BAYES_95 9540 3.19 4.71 2.48 87 RCVD_IN_IADB_VOUCHED 9522 1.92 0.73 2.48 88 HTML_IMAGE_RATIO_08 9191 2.66 3.23 2.39 89 T_TooManySym_02 9168 1.78 0.50 2.39 90 MIME_HTML_ONLY_MULTI 8748 2.53 3.07 2.28 91 XM_B_SpammyTLD 8587 2.41 2.78 2.24 92 MIME_HTML_MOSTLY 8237 2.58 3.50 2.14 93 DKIM_INVALID 8212 2.90 4.53 2.14 94 TR_XM_DKIM_Undo 8112 10.94 29.73 2.11 95 TR_XM_SpammyRelay 8038 5.78 13.65 2.09 96 XM_CamelCaseFrm001 7952 2.18 2.41 2.07 97 HELO_NODOT 7182 1.45 0.56 1.87 98 HELO_NO_DOMAIN 7179 1.45 0.56 1.87 99 INVALID_MSGID 7100 1.32 0.21 1.85 100 HTML_MIME_NO_HTML_TAG 7086 1.78 1.64 1.84 101 FROM_EXCESS_BASE64 6911 1.73 1.60 1.80 102 SpammyFromTLD_02 6769 1.81 1.92 1.76 103 TR_DCC_Bayes_99 6700 8.38 22.51 1.74 104 XM_DK_Undo_01 6628 1.63 1.42 1.73 105 RCVD_IN_IADB_OPTIN 6539 1.30 0.45 1.70 106 MSGID_NOFQDN1 6505 1.19 0.11 1.69 107 TO_MALFORMED 6493 1.16 0.03 1.69 108 TM2_M_URI_OPT_OUT 6451 2.18 3.24 1.68 109 XM_B_Investor 6435 2.39 3.91 1.67 110 TR_XM_UnparsRelay 6409 3.33 6.87 1.67 111 URI_NOVOWEL 6268 1.60 1.53 1.63 112 MIME_HEADER_CTYPE_ONLY 6075 1.21 0.42 1.58 113 TR_XM_PhishingBody 5865 2.00 3.00 1.53 114 T_XMDrugObfuBody_08 5746 1.87 2.68 1.50 115 UNTRUSTED_Relay 5594 2.76 5.53 1.46 116 T_XMDrugObfuBody_14 5582 2.03 3.27 1.45 117 TooManyTo_003 5369 1.16 0.65 1.40 118 XM_SendGrid 5270 1.38 1.40 1.37 119 XMSexyCombo_05 5138 2.18 3.98 1.34 120 IN_HORDE_ADDRESS_BOOK 5083 0.92 0.06 1.32 121 TR_Symld_Words 5071 1.22 1.02 1.32 122 XMGappySubj_01 5048 0.93 0.11 1.31 123 XM_H_Trusted_IP 5040 0.89 0.00 1.31 124 TVD_RCVD_IP 4970 1.10 0.68 1.29 125 SUBJ_ALL_CAPS 4952 1.42 1.71 1.29 126 RELAYCOUNTRY_CA 4570 3.74 9.19 1.19 127 XM_GoogleGroups 4560 0.95 0.44 1.19 128 TM2_M_VERY_LONG_WORD 4457 1.69 2.80 1.16 129 XM_OfRef6 4289 1.58 2.58 1.12 130 XM_B_Unsub2 4253 1.41 2.06 1.11 131 URI_HEX 4252 1.22 1.45 1.11 132 XMCapTrack 4192 0.85 0.33 1.09 133 XMBody_95 4147 0.79 0.18 1.08 134 XMBSHREFv2 4035 0.81 0.30 1.05 135 BOTNET 4033 3.38 8.35 1.05 136 TVD_SPACE_RATIO 4030 0.75 0.10 1.05 137 KHOP_HELO_FCRDNS 4027 1.03 0.99 1.05 138 TR_XM_SpammyWords5 4026 1.85 3.55 1.05 139 TooManyTo_004 3937 0.89 0.61 1.02 140 XM_H_Long_From02 3818 1.13 1.41 0.99 141 XM_UB50 3570 1.49 2.69 0.93 142 TR_XM_DK_SendGrid 3510 0.92 0.92 0.91 143 HTML_FONT_FACE_BAD 3487 0.85 0.72 0.91 144 XMSubNoVowel 3375 0.73 0.41 0.88 145 T_TooManySym_03 3298 0.64 0.17 0.86 146 HTTPS_HTTP_MISMATCH 3282 0.95 1.17 0.85 147 SpammyFromTLD_01 3230 5.50 15.42 0.84 148 DKIM_ADSP_CUSTOM_MED 3211 0.81 0.74 0.84 149 TooManyTo_005 3207 0.75 0.56 0.83 150 XMStockSpam_06 3077 0.96 1.30 0.80 151 T_FILL_THIS_FORM_SHORT 3061 1.50 2.98 0.80 152 XMGappySubj_02 2838 0.51 0.04 0.74 153 XMBrknScrpt_02 2800 0.97 1.48 0.73 154 TR_XM_Base64_M1 2713 0.84 1.14 0.71 155 TR_MetaPhish_Combo_01 2644 0.85 1.19 0.69 156 XM_H_PHPMailer 2634 0.76 0.92 0.69 157 XMLngstWrd_00 2632 0.89 1.34 0.69 158 URI_TRY_3LD 2542 0.80 1.11 0.66 159 XMNoVowels 2440 0.55 0.35 0.64 160 XM_ShortIntro_01 2413 0.56 0.40 0.63 161 FROM_GOV_DKIM_AU 2413 0.47 0.12 0.63 162 SHORT_HELO_AND_INLINE_IMAGE 2359 0.43 0.03 0.61 163 RELAYCOUNTRY_AU 2309 1.01 1.89 0.60 164 T_XMDrugObfuBody_00 2226 0.91 1.63 0.58 165 XM_B_FormFill 2219 0.41 0.04 0.58 166 MPART_ALT_DIFF_COUNT 2194 0.80 1.27 0.57 167 T_OBFU_PDF_ATTACH 2193 0.43 0.13 0.57 168 XMBdyGiftCard01 2186 0.68 0.92 0.57 169 XM_B_SpammyWords4 2174 1.02 1.99 0.57 170 FILL_THIS_FORM 2155 0.45 0.20 0.56 171 XMPhish30 2129 0.74 1.14 0.55 172 NML_ADSP_CUSTOM_MED 2111 0.55 0.54 0.55 173 XMSubMetaSxObfu_03 2109 0.59 0.68 0.55 174 XM_B_COPY_HTML 2084 0.57 0.64 0.54 175 TR_LOTS_OF_MONEY3 2072 1.04 2.11 0.54 176 XMMoneyMeta_00 2068 0.55 0.57 0.54 177 USER_IN_WELCOMELIST 2012 0.36 0.00 0.52 178 USER_IN_WHITELIST 2012 0.36 0.00 0.52 179 XMBody_17 2008 1.74 4.34 0.52 180 T_XMHurry_00 1995 0.88 1.64 0.52 181 T_Symld_Words_02 1942 0.63 0.89 0.51 182 RCVD_IN_BL_SPAMCOP_NET 1941 3.42 9.64 0.51 183 TR_XM_SpammyWords2 1932 4.30 12.37 0.50 184 TM2_M_BODY_EMPTY 1897 4.74 13.79 0.49 185 XM_ProductURIs 1874 0.53 0.61 0.49 186 TR_XM_FormFill2 1870 5.22 15.29 0.49 187 FORGED_GMAIL_RCVD 1854 0.53 0.62 0.48 188 TR_XM_PHPDW 1839 5.22 15.32 0.48 189 TR_XM_PHPForged 1822 5.23 15.35 0.47 190 XM_H_PHPOS 1785 5.20 15.29 0.46 191 XMDateMe_00 1782 0.46 0.45 0.46 192 TR_LOTS_OF_MONEY2 1733 0.57 0.82 0.45 193 T_MONEY_PERCENT 1733 0.57 0.82 0.45 194 HTML_TAG_BALANCE_BODY 1702 0.68 1.18 0.44 195 TO_NO_BRKTS_HTML_ONLY 1701 0.38 0.25 0.44 196 XMSubMetaSxObfu_02 1654 0.36 0.22 0.43 197 RELAYCOUNTRY_GB 1647 0.63 1.04 0.43 198 RCVD_IN_SORBS_DUL 1576 0.33 0.16 0.41 199 RDNS_DYNAMIC 1564 0.56 0.90 0.41 200 HTML_IMAGE_ONLY_20 1542 0.32 0.14 0.40 ----------------------------------------------------------------------