Email: 557911 Autolearn: 0 AvgScore: 3.39 AvgScanTime: 1.19 sec Spam: 165817 Autolearn: 0 AvgScore: 12.94 AvgScanTime: 1.31 sec Ham: 392094 Autolearn: 0 AvgScore: -0.65 AvgScanTime: 1.14 sec Time Spent Running SA: 184.08 hours Time Spent Processing Spam: 60.31 hours Time Spent Processing Ham: 123.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160436 88.45 96.75 84.93 2 XM_B_Unicode 142385 72.90 85.87 67.42 3 DKIM_SIGNED 131653 70.25 79.40 66.38 4 XM_DK_Pass 126349 68.40 76.20 65.11 5 XM_B_SpammyWords 124644 50.20 75.17 39.64 6 DKIM_VALID 123730 67.24 74.62 64.11 7 RELAYCOUNTRY_US 116318 73.38 70.15 74.75 8 DCC_CHECK 107749 39.12 64.98 28.18 9 XMListUnsubscribeExists 102772 47.54 61.98 41.43 10 DKIM_VALID_AU 94820 52.84 57.18 51.00 11 XM_B_Unicode3 83631 39.83 50.44 35.35 12 XM_B_SpammyWords2 80515 26.20 48.56 16.75 13 BAYES_50 74901 52.16 45.17 55.12 14 LOC_TINY_FONT_1 62916 26.11 37.94 21.11 15 XM_DK_Undo_02 62855 15.01 37.91 5.33 16 MIME_HTML_ONLY 62059 25.21 37.43 20.05 17 DCC_CHECK_NEGATIVE 58048 60.85 35.01 71.78 18 HTML_FONT_LOW_CONTRAST 56814 30.85 34.26 29.40 19 BAYES_99 50247 12.08 30.30 4.38 20 TR_XM_DKIM_Undo 49360 10.41 29.77 2.22 21 XMSubLong 48920 22.72 29.50 19.85 22 FVGT_m_MULTI_ODD 47424 24.25 28.60 22.41 23 DKIM_VALID_EF 46444 27.09 28.01 26.70 24 RCVD_IN_MSPIKE_H2 44999 25.73 27.14 25.14 25 XM_B_Unsub 42867 13.84 25.85 8.76 26 TR_XM_BayesUnsub 41897 11.61 25.27 5.83 27 T_KAM_HTML_FONT_INVALID 40361 20.09 24.34 18.29 28 BAYES_999 38915 9.44 23.47 3.50 29 TR_DCC_Bayes_99 34648 7.11 20.90 1.28 30 T_TM2_M_HEADER_IN_MSG 34183 25.05 20.61 26.93 31 TR_XM_DK_Unsub 32522 13.96 19.61 11.56 32 XM_Multi_Part_URI 29502 13.77 17.79 12.07 33 RELAYCOUNTRY_META 27627 7.53 16.66 3.66 34 XM_Body_Dirty_Words 27492 6.79 16.58 2.64 35 XMSubMetaSx_00 27151 7.31 16.37 3.48 36 TooManyTo_001 24554 10.21 14.81 8.27 37 XMSexyCombo_05 24242 5.43 14.62 1.54 38 LOTS_OF_MONEY 22102 7.94 13.33 5.66 39 ALL_TRUSTED 21978 19.79 13.25 22.55 40 TR_MAX_INTL_RELAY 21671 8.04 13.07 5.92 41 XM_B_SpammyWords3 20721 6.94 12.50 4.59 42 TR_XM_SpammyWords2 20594 3.97 12.42 0.40 43 TR_XM_SpammyRelay 20395 5.00 12.30 1.92 44 TR_XM_SpammyWords4 19629 6.19 11.84 3.80 45 BOTNET_IPINHOSTNAME 19442 6.04 11.72 3.63 46 UNPARSEABLE_RELAY 19273 10.44 11.62 9.95 47 XMSexyCombo_01 17913 3.39 10.80 0.26 48 RCVD_IN_BL_SPAMCOP_NET 16683 3.54 10.06 0.78 49 XMSexyCombo_04 16652 3.02 10.04 0.05 50 XM_Evil_Numbers_Gen 15108 7.75 9.11 7.17 51 FSL_BULK_SIG 14454 5.51 8.72 4.16 52 BOTNET 14062 3.29 8.48 1.09 53 TR_XM_SPAMCOP 13775 2.73 8.31 0.37 54 RELAYCOUNTRY_CA 13579 3.28 8.19 1.21 55 BAYES_80 13258 4.92 8.00 3.62 56 BAYES_60 11858 7.83 7.15 8.12 57 RCVD_IN_MSPIKE_H3 11420 5.88 6.89 5.46 58 RCVD_IN_MSPIKE_WL 11420 5.88 6.89 5.46 59 MPART_ALT_DIFF 11384 5.86 6.87 5.43 60 LotsOfNums_01 11027 7.18 6.65 7.40 61 XM_UncommonTLD01 10848 8.61 6.54 9.49 62 TR_XM_UnparsRelay 10504 3.00 6.33 1.60 63 UNTRUSTED_Relay 10413 2.74 6.28 1.24 64 XM_SPF_SoftFail 9354 7.61 5.64 8.44 65 HTML_IMAGE_RATIO_02 9225 4.84 5.56 4.53 66 XM_B_Phish_Phrases 8561 3.42 5.16 2.68 67 XMStrtUSub 8543 6.56 5.15 7.15 68 MIME_HTML_MOSTLY 8263 2.97 4.98 2.12 69 DKIM_INVALID 7923 3.01 4.78 2.26 70 BAYES_95 7898 3.03 4.76 2.30 71 HTML_IMAGE_RATIO_04 7895 3.90 4.76 3.53 72 XM_H_Long_From01 7626 4.69 4.60 4.73 73 XM_H_GMP 7565 5.68 4.56 6.15 74 XM_B_Investor 7380 2.25 4.45 1.32 75 XMBody_17 6970 1.62 4.20 0.53 76 TR_XM_PhishingBody 6517 2.19 3.93 1.46 77 TR_XM_SpammyWords5 6445 1.97 3.89 1.15 78 XMNumbers 6323 3.04 3.81 2.71 79 RCVD_IN_VALIDITY_SAFE 6213 4.11 3.75 4.27 80 XM_OfRef6 5842 2.05 3.52 1.43 81 T_XMDrugObfuBody_14 5808 2.54 3.50 2.13 82 HTML_IMAGE_RATIO_06 5790 2.62 3.49 2.25 83 T_FILL_THIS_FORM_SHORT 5580 1.73 3.37 1.04 84 T_XMDrugObfuBody_08 5523 2.04 3.33 1.49 85 MIME_HTML_ONLY_MULTI 5488 3.72 3.31 3.89 86 XM_B_SpammyTLD 5312 2.44 3.20 2.12 87 XM_UB50 5236 1.45 3.16 0.73 88 RCVD_IN_VALIDITY_CERTIFIED 5219 3.43 3.15 3.55 89 USER_IN_DEF_DKIM_WL 5160 9.24 3.11 11.84 90 TM2_M_URI_OPT_OUT 4888 3.63 2.95 3.92 91 MIME_QP_LONG_LINE 4583 4.16 2.76 4.75 92 TM2_M_VERY_LONG_WORD 4547 1.70 2.74 1.26 93 TR_LOTS_OF_MONEY3 4395 1.03 2.65 0.35 94 SpammyFromTLD_01 4296 1.28 2.59 0.72 95 HTML_IMAGE_RATIO_08 4282 2.06 2.58 1.84 96 XM_B_Unsub2 4269 1.76 2.57 1.42 97 XM_URI_RBL 4021 0.83 2.42 0.15 98 URI_NOVOWEL 3984 1.80 2.40 1.54 99 XM_B_SpammyWords4 3882 1.14 2.34 0.64 100 TR_XM_NoHeaderRelay 3872 0.77 2.34 0.10 101 SUBJ_ALL_CAPS 3839 1.66 2.32 1.38 102 XM_CamelCaseFrm001 3825 2.17 2.31 2.11 103 HK_RANDOM_REPLYTO 3807 0.74 2.30 0.09 104 SpammyFromTLD_02 3749 4.64 2.26 5.64 105 FONT_INVIS_LONG_LINE 3651 0.67 2.20 0.03 106 T_TooManySym_01 3513 4.04 2.12 4.85 107 TR_XM_BayesRelay 3441 0.62 2.08 0.00 108 RELAYCOUNTRY_AU 3326 1.00 2.01 0.57 109 XMDiploma_00 3316 1.65 2.00 1.50 110 BAYES_40 3261 4.47 1.97 5.53 111 TR_XM_FormFill 3181 0.61 1.92 0.06 112 HTML_MIME_NO_HTML_TAG 3170 2.38 1.91 2.58 113 FROM_EXCESS_BASE64 3116 1.71 1.88 1.63 114 XMBrknScrpt_02 3010 0.95 1.82 0.58 115 URI_HEX 2836 1.18 1.71 0.95 116 TR_XM_PHPForged 2770 0.82 1.67 0.46 117 BOUNCE_MESSAGE 2741 3.82 1.65 4.74 118 ANY_BOUNCE_MESSAGE 2741 3.82 1.65 4.74 119 T_XMDrugObfuBody_00 2655 0.89 1.60 0.58 120 T_XMHurry_00 2595 0.75 1.56 0.40 121 T_REMOTE_IMAGE 2588 3.23 1.56 3.93 122 TR_XM_PHPDW 2573 0.78 1.55 0.45 123 XMBdyGiftCard01 2518 0.88 1.52 0.60 124 KHOP_HELO_FCRDNS 2500 1.28 1.51 1.18 125 TR_XM_FormFill2 2497 0.77 1.51 0.45 126 XM_H_PHPOS 2481 0.75 1.50 0.44 127 TR_Mismatch_TLD_02 2457 0.49 1.48 0.08 128 TR_XM_INV_DKIM 2456 0.48 1.48 0.06 129 URI_TRY_3LD 2411 0.81 1.45 0.54 130 XM_DK_Undo_01 2372 1.84 1.43 2.01 131 MAILING_LIST_MULTI 2353 2.21 1.42 2.55 132 PLING_QUERY 2334 0.71 1.41 0.42 133 XMPhish30 2312 0.64 1.39 0.32 134 XMStockSpam_06 2306 1.21 1.39 1.13 135 XM_SendGrid 2279 1.47 1.37 1.51 136 HTML_TAG_BALANCE_BODY 2271 0.70 1.37 0.42 137 RCVD_IN_IADB_LISTED 2185 3.24 1.32 4.06 138 BAYES_20 2183 3.40 1.32 4.28 139 XMSubMetaI_00 2180 0.85 1.31 0.65 140 RCVD_IN_VALIDITY_RPBL 2180 0.44 1.31 0.07 141 XM_B_COVIDMETA 2124 0.56 1.28 0.26 142 MY_SERVERS_FOUND 2106 0.65 1.27 0.39 143 XM_HighProb1 2082 0.38 1.26 0.00 144 RDNS_DYNAMIC 2081 0.57 1.25 0.29 145 THIS_AD 2075 0.68 1.25 0.44 146 XMReplyNow 2032 0.52 1.23 0.23 147 RCVD_IN_IADB_SPF 1971 2.89 1.19 3.61 148 XMPhish14 1962 0.69 1.18 0.48 149 MPART_ALT_DIFF_COUNT 1956 0.71 1.18 0.52 150 TVD_RCVD_IP 1950 1.25 1.18 1.28 151 TR_MetaPhish_Combo_01 1903 0.78 1.15 0.63 152 XM_H_Undi_Recip 1894 0.49 1.14 0.21 153 BOTNET_NORDNS 1886 0.34 1.14 0.01 154 RCVD_IN_IADB_DK 1852 2.56 1.12 3.17 155 RCVD_IN_IADB_SENDERID 1845 2.62 1.11 3.26 156 TR_Symld_Words 1842 1.33 1.11 1.42 157 XMGenDplmaNmb 1794 0.91 1.08 0.84 158 HTTPS_HTTP_MISMATCH 1766 0.85 1.07 0.76 159 DKIM_ADSP_CUSTOM_MED 1762 1.05 1.06 1.04 160 JH_SPAMMY_HEADERS 1756 0.31 1.06 0.00 161 XM_B_REG_HTML 1688 0.54 1.02 0.34 162 T_MONEY_PERCENT 1663 0.50 1.00 0.28 163 TR_LOTS_OF_MONEY2 1663 0.50 1.00 0.28 164 XMHTML_After_End 1645 0.58 0.99 0.41 165 TR_XM_Undi_Recip19 1634 0.36 0.99 0.09 166 XMLngstWrd_00 1631 0.73 0.98 0.62 167 AC_BR_BONANZA 1621 0.31 0.98 0.03 168 XM_B_DNDMA 1601 0.58 0.97 0.41 169 XM_UB60 1555 0.31 0.94 0.05 170 LongTLD 1537 0.55 0.93 0.39 171 T_Symld_Words_02 1527 0.54 0.92 0.38 172 URIBL_DBL_SPAM 1485 0.27 0.90 0.01 173 RCVD_IN_PSBL 1460 0.42 0.88 0.22 174 XM_B_Phish66 1454 0.44 0.88 0.26 175 TooManyTo_002 1447 2.03 0.87 2.51 176 XM_DIRTYINTL 1437 0.35 0.87 0.13 177 TR_XM_Base64_L1 1430 0.33 0.86 0.10 178 XM_H_PHPMailer 1428 0.68 0.86 0.61 179 XM_B_COPY_HTML 1424 0.57 0.86 0.45 180 RELAYCOUNTRY_RU 1424 0.26 0.86 0.01 181 XM_PDF 1416 4.64 0.85 6.25 182 TR_XM_Undi_RecipCombo2 1414 0.26 0.85 0.01 183 FORGED_GMAIL_RCVD 1398 0.68 0.84 0.61 184 RELAYCOUNTRY_IN 1380 0.30 0.83 0.07 185 XM_S_SpammyWords 1376 0.42 0.83 0.25 186 TR_XM_Spammywords 1375 0.42 0.83 0.25 187 NML_ADSP_CUSTOM_MED 1365 0.68 0.82 0.62 188 TR_XM_COVIDMETA4 1358 0.33 0.82 0.12 189 TR_XM_InvalidRelay 1352 0.25 0.82 0.02 190 TR_XM_Base64_M1 1344 0.59 0.81 0.50 191 XM_H_Long_From02 1332 0.96 0.80 1.02 192 TooManyTo_003 1315 1.26 0.79 1.46 193 XM_UB99 1312 0.24 0.79 0.01 194 TM2_M_OBFU_COMMENT 1289 0.38 0.78 0.21 195 XM_OfRef7 1266 0.48 0.76 0.35 196 TR_Mismatch_TLD_01 1263 0.47 0.76 0.35 197 TR_XM_RelayPhish 1248 0.27 0.75 0.06 198 TooManyTo_004 1239 0.97 0.75 1.06 199 XM_ProductURIs 1238 0.59 0.75 0.52 200 TR_XM_DK_SendGrid 1225 0.98 0.74 1.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 333022 88.45 96.75 84.93 2 RELAYCOUNTRY_US 293079 73.38 70.15 74.75 3 DCC_CHECK_NEGATIVE 281426 60.85 35.01 71.78 4 XM_B_Unicode 264355 72.90 85.87 67.42 5 DKIM_SIGNED 260261 70.25 79.40 66.38 6 XM_DK_Pass 255279 68.40 76.20 65.11 7 DKIM_VALID 251391 67.24 74.62 64.11 8 BAYES_50 216117 52.16 45.17 55.12 9 DKIM_VALID_AU 199956 52.84 57.18 51.00 10 XMListUnsubscribeExists 162446 47.54 61.98 41.43 11 XM_B_SpammyWords 155435 50.20 75.17 39.64 12 XM_B_Unicode3 138612 39.83 50.44 35.35 13 HTML_FONT_LOW_CONTRAST 115289 30.85 34.26 29.40 14 DCC_CHECK 110498 39.12 64.98 28.18 15 T_TM2_M_HEADER_IN_MSG 105596 25.05 20.61 26.93 16 DKIM_VALID_EF 104707 27.09 28.01 26.70 17 RCVD_IN_MSPIKE_H2 98553 25.73 27.14 25.14 18 ALL_TRUSTED 88428 19.79 13.25 22.55 19 FVGT_m_MULTI_ODD 87855 24.25 28.60 22.41 20 LOC_TINY_FONT_1 82764 26.11 37.94 21.11 21 MIME_HTML_ONLY 78605 25.21 37.43 20.05 22 XMSubLong 77846 22.72 29.50 19.85 23 T_KAM_HTML_FONT_INVALID 71726 20.09 24.34 18.29 24 XM_B_SpammyWords2 65668 26.20 48.56 16.75 25 BAYES_00 52545 9.59 0.59 13.40 26 XM_Multi_Part_URI 47314 13.77 17.79 12.07 27 USER_IN_DEF_DKIM_WL 46409 9.24 3.11 11.84 28 TR_XM_DK_Unsub 45336 13.96 19.61 11.56 29 UNPARSEABLE_RELAY 38995 10.44 11.62 9.95 30 XM_UncommonTLD01 37204 8.61 6.54 9.49 31 XM_B_Unsub 34331 13.84 25.85 8.76 32 XM_SPF_SoftFail 33088 7.61 5.64 8.44 33 TooManyTo_001 32427 10.21 14.81 8.27 34 BAYES_60 31820 7.83 7.15 8.12 35 LotsOfNums_01 29016 7.18 6.65 7.40 36 XM_Evil_Numbers_Gen 28110 7.75 9.11 7.17 37 XMStrtUSub 28051 6.56 5.15 7.15 38 XM_DKIMWhitelistDomains 27252 4.95 0.23 6.95 39 IN_ZIMBRA_NJ_WHITELIST 25033 4.51 0.07 6.38 40 TR_XM_DK_Bayes 24689 4.55 0.42 6.30 41 XM_PDF 24494 4.64 0.85 6.25 42 TR_XM_DK_Bayes1 24326 4.48 0.41 6.20 43 XM_H_GMP 24123 5.68 4.56 6.15 44 TR_MAX_INTL_RELAY 23203 8.04 13.07 5.92 45 TR_XM_BayesUnsub 22876 11.61 25.27 5.83 46 LOTS_OF_MONEY 22197 7.94 13.33 5.66 47 SpammyFromTLD_02 22114 4.64 2.26 5.64 48 BAYES_40 21702 4.47 1.97 5.53 49 RCVD_IN_MSPIKE_H3 21398 5.88 6.89 5.46 50 RCVD_IN_MSPIKE_WL 21398 5.88 6.89 5.46 51 MPART_ALT_DIFF 21286 5.86 6.87 5.43 52 TR_XM_DK_Bayes2 21035 3.86 0.32 5.36 53 XM_DK_Undo_02 20897 15.01 37.91 5.33 54 T_TooManySym_01 19028 4.04 2.12 4.85 55 MIME_QP_LONG_LINE 18605 4.16 2.76 4.75 56 ANY_BOUNCE_MESSAGE 18579 3.82 1.65 4.74 57 BOUNCE_MESSAGE 18578 3.82 1.65 4.74 58 XM_H_Long_From01 18531 4.69 4.60 4.73 59 XM_B_SpammyWords3 17986 6.94 12.50 4.59 60 HTML_IMAGE_RATIO_02 17756 4.84 5.56 4.53 61 BAYES_99 17165 12.08 30.30 4.38 62 BAYES_20 16777 3.40 1.32 4.28 63 RCVD_IN_VALIDITY_SAFE 16742 4.11 3.75 4.27 64 FSL_BULK_SIG 16297 5.51 8.72 4.16 65 RCVD_IN_IADB_LISTED 15901 3.24 1.32 4.06 66 T_REMOTE_IMAGE 15415 3.23 1.56 3.93 67 TM2_M_URI_OPT_OUT 15369 3.63 2.95 3.92 68 MIME_HTML_ONLY_MULTI 15268 3.72 3.31 3.89 69 TR_XM_SpammyWords4 14899 6.19 11.84 3.80 70 RELAYCOUNTRY_META 14365 7.53 16.66 3.66 71 BOTNET_IPINHOSTNAME 14245 6.04 11.72 3.63 72 BAYES_80 14178 4.92 8.00 3.62 73 RCVD_IN_IADB_SPF 14138 2.89 1.19 3.61 74 RCVD_IN_VALIDITY_CERTIFIED 13930 3.43 3.15 3.55 75 HTML_IMAGE_RATIO_04 13856 3.90 4.76 3.53 76 BAYES_999 13732 9.44 23.47 3.50 77 XMSubMetaSx_00 13639 7.31 16.37 3.48 78 RCVD_IN_IADB_SENDERID 12792 2.62 1.11 3.26 79 BAYES_05 12781 2.51 0.74 3.26 80 RCVD_IN_IADB_DK 12446 2.56 1.12 3.17 81 XM_H_Trusted_IP 11660 2.09 0.00 2.97 82 XMNumbers 10624 3.04 3.81 2.71 83 XM_B_Phish_Phrases 10508 3.42 5.16 2.68 84 XM_Body_Dirty_Words 10370 6.79 16.58 2.64 85 HTML_MIME_NO_HTML_TAG 10105 2.38 1.91 2.58 86 MAILING_LIST_MULTI 9995 2.21 1.42 2.55 87 TooManyTo_002 9853 2.03 0.87 2.51 88 T_TooManySym_02 9542 1.91 0.66 2.43 89 RCVD_IN_IADB_VOUCHED 9392 1.85 0.57 2.40 90 BAYES_95 9008 3.03 4.76 2.30 91 DKIM_INVALID 8870 3.01 4.78 2.26 92 HTML_IMAGE_RATIO_06 8821 2.62 3.49 2.25 93 TR_XM_DKIM_Undo 8695 10.41 29.77 2.22 94 T_XMDrugObfuBody_14 8354 2.54 3.50 2.13 95 MIME_HTML_MOSTLY 8310 2.97 4.98 2.12 96 XM_B_SpammyTLD 8294 2.44 3.20 2.12 97 XM_CamelCaseFrm001 8271 2.17 2.31 2.11 98 XM_DK_Undo_01 7885 1.84 1.43 2.01 99 TR_XM_SpammyRelay 7516 5.00 12.30 1.92 100 INVALID_MSGID 7403 1.41 0.28 1.89 101 HTML_IMAGE_RATIO_08 7217 2.06 2.58 1.84 102 MSGID_NOFQDN1 6929 1.29 0.17 1.77 103 HELO_NODOT 6892 1.36 0.43 1.76 104 HELO_NO_DOMAIN 6885 1.35 0.40 1.76 105 TO_MALFORMED 6696 1.21 0.02 1.71 106 RCVD_IN_IADB_OPTIN 6514 1.28 0.38 1.66 107 FROM_EXCESS_BASE64 6407 1.71 1.88 1.63 108 TR_XM_UnparsRelay 6258 3.00 6.33 1.60 109 URI_NOVOWEL 6031 1.80 2.40 1.54 110 XMSexyCombo_05 6028 5.43 14.62 1.54 111 T_OBFU_PDF_ATTACH 5961 1.13 0.22 1.52 112 XM_SendGrid 5917 1.47 1.37 1.51 113 XMDiploma_00 5877 1.65 2.00 1.50 114 T_XMDrugObfuBody_08 5858 2.04 3.33 1.49 115 TR_XM_PhishingBody 5720 2.19 3.93 1.46 116 TooManyTo_003 5713 1.26 0.79 1.46 117 XM_OfRef6 5601 2.05 3.52 1.43 118 XM_B_Unsub2 5571 1.76 2.57 1.42 119 TR_Symld_Words 5561 1.33 1.11 1.42 120 XMSubNoVowel 5528 1.13 0.47 1.41 121 SUBJ_ALL_CAPS 5418 1.66 2.32 1.38 122 IN_HORDE_ADDRESS_BOOK 5193 0.95 0.06 1.32 123 XM_B_Investor 5168 2.25 4.45 1.32 124 TVD_RCVD_IP 5023 1.25 1.18 1.28 125 TR_DCC_Bayes_99 5008 7.11 20.90 1.28 126 TM2_M_VERY_LONG_WORD 4925 1.70 2.74 1.26 127 UNTRUSTED_Relay 4862 2.74 6.28 1.24 128 RELAYCOUNTRY_CA 4725 3.28 8.19 1.21 129 KHOP_HELO_FCRDNS 4628 1.28 1.51 1.18 130 TR_XM_SpammyWords5 4521 1.97 3.89 1.15 131 XMGappySubj_01 4490 0.84 0.11 1.15 132 XMStockSpam_06 4431 1.21 1.39 1.13 133 XMCapTrack 4418 0.90 0.37 1.13 134 TVD_SPACE_RATIO 4411 0.87 0.25 1.12 135 BOTNET 4272 3.29 8.48 1.09 136 TR_XM_DK_SendGrid 4218 0.98 0.74 1.08 137 TooManyTo_004 4148 0.97 0.75 1.06 138 DKIM_ADSP_CUSTOM_MED 4089 1.05 1.06 1.04 139 T_FILL_THIS_FORM_SHORT 4084 1.73 3.37 1.04 140 XM_GoogleGroups 4030 0.87 0.51 1.03 141 XM_H_Long_From02 4000 0.96 0.80 1.02 142 XMBSHREFv2 3947 0.81 0.36 1.01 143 XMBody_95 3785 0.73 0.18 0.97 144 URI_HEX 3720 1.18 1.71 0.95 145 T_TooManySym_03 3511 0.69 0.19 0.90 146 TooManyTo_005 3454 0.80 0.59 0.88 147 URI_OPTOUT_3LD 3274 0.66 0.24 0.84 148 XMGenDplmaNmb 3274 0.91 1.08 0.84 149 XM_ShortIntro_01 3142 0.72 0.52 0.80 150 RCVD_IN_BL_SPAMCOP_NET 3047 3.54 10.06 0.78 151 XMGappySubj_02 3047 0.56 0.05 0.78 152 HTTPS_HTTP_MISMATCH 2979 0.85 1.07 0.76 153 XM_UB50 2848 1.45 3.16 0.73 154 SpammyFromTLD_01 2828 1.28 2.59 0.72 155 XMSubMetaI_00 2546 0.85 1.31 0.65 156 XMNoVowels 2528 0.59 0.46 0.64 157 FILL_THIS_FORM 2520 0.60 0.50 0.64 158 XM_B_SpammyWords4 2500 1.14 2.34 0.64 159 TM2_M_BODY_EMPTY 2478 0.49 0.16 0.63 160 TR_MetaPhish_Combo_01 2460 0.78 1.15 0.63 161 NML_ADSP_CUSTOM_MED 2442 0.68 0.82 0.62 162 XMLngstWrd_00 2414 0.73 0.98 0.62 163 XM_H_PHPMailer 2380 0.68 0.86 0.61 164 FORGED_GMAIL_RCVD 2378 0.68 0.84 0.61 165 XMBdyGiftCard01 2368 0.88 1.52 0.60 166 MISSING_HEADERS 2326 0.57 0.52 0.59 167 T_XMDrugObfuBody_00 2292 0.89 1.60 0.58 168 XMBrknScrpt_02 2265 0.95 1.82 0.58 169 RELAYCOUNTRY_AU 2246 1.00 2.01 0.57 170 USER_IN_WELCOMELIST 2195 0.39 0.00 0.56 171 USER_IN_WHITELIST 2195 0.39 0.00 0.56 172 XM_B_FormFill 2185 0.40 0.02 0.56 173 TO_NO_BRKTS_HTML_ONLY 2174 0.50 0.35 0.55 174 XMSubMetaSxObfu_02 2150 0.53 0.50 0.55 175 SHORT_HELO_AND_INLINE_IMAGE 2103 0.39 0.05 0.54 176 URI_TRY_3LD 2102 0.81 1.45 0.54 177 XMBody_17 2075 1.62 4.20 0.53 178 FROM_GOV_DKIM_AU 2037 0.40 0.13 0.52 179 XM_ProductURIs 2026 0.59 0.75 0.52 180 MPART_ALT_DIFF_COUNT 2023 0.71 1.18 0.52 181 HTML_IMAGE_ONLY_32 2006 0.44 0.27 0.51 182 TR_XM_Base64_M1 1961 0.59 0.81 0.50 183 XMPhish14 1899 0.69 1.18 0.48 184 TR_XM_PHPForged 1800 0.82 1.67 0.46 185 TR_XM_FormFill2 1776 0.77 1.51 0.45 186 GMD_PDF_EMPTY_BODY 1772 0.35 0.10 0.45 187 XM_B_COPY_HTML 1765 0.57 0.86 0.45 188 TR_XM_PHPDW 1759 0.78 1.55 0.45 189 XMClaimOffer 1722 0.52 0.70 0.44 190 XM_H_PHPOS 1721 0.75 1.50 0.44 191 THIS_AD 1718 0.68 1.25 0.44 192 HTML_IMAGE_ONLY_28 1706 0.40 0.33 0.44 193 HTML_TAG_BALANCE_BODY 1658 0.70 1.37 0.42 194 PLING_QUERY 1653 0.71 1.41 0.42 195 BASE64_LENGTH_79_INF 1639 0.35 0.19 0.42 196 XMMoneyMeta_00 1620 0.48 0.64 0.41 197 XM_B_DNDMA 1609 0.58 0.97 0.41 198 T_MANY_PILL_PRICE 1607 0.29 0.00 0.41 199 XMHTML_After_End 1591 0.58 0.99 0.41 200 TR_XM_SpammyWords2 1578 3.97 12.42 0.40 ----------------------------------------------------------------------