Email: 573910 Autolearn: 0 AvgScore: 1.91 AvgScanTime: 1.27 sec Spam: 152061 Autolearn: 0 AvgScore: 13.48 AvgScanTime: 1.47 sec Ham: 421849 Autolearn: 0 AvgScore: -2.26 AvgScanTime: 1.19 sec Time Spent Running SA: 202.11 hours Time Spent Processing Spam: 62.20 hours Time Spent Processing Ham: 139.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145422 87.05 95.63 83.96 2 DKIM_SIGNED 138556 68.87 91.12 60.85 3 XM_DK_Pass 132445 67.00 87.10 59.75 4 DKIM_VALID 130465 65.97 85.80 58.82 5 XM_B_Unicode 125717 71.66 82.68 67.68 6 RELAYCOUNTRY_US 118064 77.08 77.64 76.88 7 XMListUnsubscribeExists 111174 48.61 73.11 39.78 8 XM_B_SpammyWords 110739 48.96 72.83 40.36 9 DCC_CHECK 108036 38.47 71.05 26.73 10 DKIM_VALID_AU 98379 51.86 64.70 47.23 11 XM_B_Unicode3 69135 41.14 45.47 39.58 12 XM_DK_Undo_02 67758 15.49 44.56 5.01 13 XM_B_SpammyWords2 62229 22.73 40.92 16.17 14 LOC_TINY_FONT_1 61400 25.71 40.38 20.42 15 BAYES_50 58746 51.26 38.63 55.81 16 HTML_FONT_LOW_CONTRAST 55216 27.71 36.31 24.60 17 TR_XM_DKIM_Undo 52916 10.63 34.80 1.92 18 BAYES_99 51006 11.77 33.54 3.93 19 DKIM_VALID_EF 49919 26.30 32.83 23.94 20 MIME_HTML_ONLY 49334 24.42 32.44 21.53 21 FVGT_m_MULTI_ODD 45847 23.22 30.15 20.72 22 T_KAM_HTML_FONT_INVALID 44853 19.92 29.50 16.46 23 RCVD_IN_MSPIKE_H2 44037 24.49 28.96 22.88 24 DCC_CHECK_NEGATIVE 44004 61.49 28.94 73.23 25 BAYES_999 39672 9.18 26.09 3.09 26 XMSubLong 37949 21.72 24.96 20.55 27 TR_XM_DK_Unsub 37158 14.55 24.44 10.98 28 TR_DCC_Bayes_99 35670 7.10 23.46 1.21 29 T_TM2_M_HEADER_IN_MSG 34379 24.37 22.61 25.00 30 RELAYCOUNTRY_META 33661 8.35 22.14 3.39 31 XM_Multi_Part_URI 28829 13.59 18.96 11.65 32 TR_XM_SpammyRelay 26712 6.06 17.57 1.91 33 XM_B_Unsub 24569 9.07 16.16 6.51 34 TR_XM_BayesUnsub 23646 7.81 15.55 5.02 35 TR_MAX_INTL_RELAY 23183 8.34 15.25 5.85 36 LOTS_OF_MONEY 22645 8.47 14.89 6.16 37 XM_B_SpammyWords3 22253 6.46 14.63 3.52 38 BOTNET_IPINHOSTNAME 22227 6.60 14.62 3.70 39 RCVD_IN_BL_SPAMCOP_NET 20868 4.10 13.72 0.63 40 TR_XM_SpammyWords4 20342 6.91 13.38 4.58 41 TR_XM_SpammyWords2 18835 3.55 12.39 0.36 42 UNPARSEABLE_RELAY 18600 9.33 12.23 8.29 43 RELAYCOUNTRY_CA 17979 3.87 11.82 1.00 44 TR_XM_SPAMCOP 16938 3.25 11.14 0.41 45 BOTNET 15400 3.65 10.13 1.31 46 RCVD_IN_MSPIKE_H3 14737 6.41 9.69 5.23 47 RCVD_IN_MSPIKE_WL 14737 6.41 9.69 5.23 48 BAYES_80 13907 5.16 9.15 3.73 49 XM_Evil_Numbers_Gen 13672 8.29 8.99 8.03 50 XM_UncommonTLD01 13081 4.69 8.60 3.27 51 FSL_BULK_SIG 11897 4.29 7.82 3.02 52 BAYES_60 11612 7.77 7.64 7.82 53 UNTRUSTED_Relay 11223 2.80 7.38 1.14 54 MPART_ALT_DIFF 10934 8.81 7.19 9.40 55 XM_Body_Dirty_Words 10188 3.33 6.70 2.11 56 LotsOfNums_01 9938 6.78 6.54 6.87 57 XMBody_17 9910 2.13 6.52 0.55 58 TR_XM_UnparsRelay 9741 2.67 6.41 1.33 59 XMSubMetaSx_00 9615 3.70 6.32 2.75 60 TooManyTo_001 9603 7.07 6.32 7.34 61 HTML_IMAGE_RATIO_02 9249 4.44 6.08 3.84 62 HTML_IMAGE_RATIO_04 8830 11.40 5.81 13.42 63 T_FILL_THIS_FORM_SHORT 8828 2.22 5.81 0.93 64 XMNumbers 8516 3.18 5.60 2.31 65 XM_SPF_SoftFail 8491 3.60 5.58 2.89 66 BAYES_95 8355 3.01 5.49 2.12 67 DKIM_INVALID 8091 2.90 5.32 2.02 68 XM_B_Phish_Phrases 7697 3.63 5.06 3.11 69 XM_OfRef6 7578 2.12 4.98 1.09 70 XM_H_Long_From01 7566 4.54 4.98 4.38 71 XMSexyCombo_05 7333 2.11 4.82 1.13 72 XM_B_Investor 7329 2.28 4.82 1.36 73 T_XMDrugObfuBody_14 7274 2.29 4.78 1.39 74 XM_H_GMP 7188 5.30 4.73 5.51 75 SpammyFromTLD_01 7171 1.82 4.72 0.78 76 MIME_HTML_MOSTLY 7111 3.57 4.68 3.17 77 TR_XM_SpammyWords5 7015 1.96 4.61 1.00 78 HTML_IMAGE_RATIO_06 6424 4.44 4.22 4.52 79 TR_XM_PhishingBody 6337 2.19 4.17 1.47 80 XMStrtUSub 6119 8.40 4.02 9.98 81 XM_UB50 5769 1.49 3.79 0.66 82 MIME_HTML_ONLY_MULTI 5620 5.92 3.70 6.73 83 FONT_INVIS_LONG_LINE 5507 0.98 3.62 0.03 84 TR_XM_FormFill 5401 0.96 3.55 0.02 85 TR_XM_BayesRelay 5291 0.92 3.48 0.00 86 TM2_M_URI_OPT_OUT 5151 2.07 3.39 1.60 87 T_XMDrugObfuBody_08 4958 1.76 3.26 1.21 88 HTML_IMAGE_RATIO_08 4957 2.33 3.26 1.99 89 XM_B_SpammyTLD 4951 2.42 3.26 2.12 90 TR_LOTS_OF_MONEY3 4828 1.07 3.18 0.31 91 MIME_QP_LONG_LINE 4784 3.98 3.15 4.28 92 RCVD_IN_VALIDITY_SAFE 4591 3.89 3.02 4.20 93 XMDiploma_00 4579 1.86 3.01 1.45 94 TR_XM_PHPForged 4535 1.16 2.98 0.50 95 USER_IN_DEF_DKIM_WL 4365 8.91 2.87 11.09 96 TR_XM_PHPDW 4364 1.12 2.87 0.49 97 TR_XM_FormFill2 4330 1.12 2.85 0.50 98 XM_H_PHPOS 4322 1.11 2.84 0.48 99 TR_XM_NoHeaderRelay 4273 0.83 2.81 0.12 100 XM_CamelCaseFrm001 4116 1.94 2.71 1.67 101 XM_B_Unsub2 4034 1.57 2.65 1.18 102 HK_RANDOM_REPLYTO 4005 0.76 2.63 0.09 103 TM2_M_VERY_LONG_WORD 3997 1.55 2.63 1.16 104 SUBJ_ALL_CAPS 3877 1.58 2.55 1.22 105 RCVD_IN_VALIDITY_CERTIFIED 3856 3.36 2.54 3.65 106 XMBrknScrpt_02 3723 1.04 2.45 0.53 107 T_TooManySym_01 3708 3.77 2.44 4.25 108 RELAYCOUNTRY_AU 3609 1.08 2.37 0.62 109 XM_B_SpammyWords4 3571 1.09 2.35 0.63 110 XM_URI_RBL 3520 0.72 2.31 0.14 111 BAYES_40 3035 4.75 2.00 5.74 112 T_REMOTE_IMAGE 3027 2.76 1.99 3.04 113 URI_NOVOWEL 3004 1.46 1.98 1.28 114 FROM_EXCESS_BASE64 2938 1.69 1.93 1.60 115 BAYES_20 2872 3.03 1.89 3.44 116 ANY_BOUNCE_MESSAGE 2820 6.87 1.85 8.68 117 BOUNCE_MESSAGE 2820 6.87 1.85 8.68 118 MAILING_LIST_MULTI 2784 2.10 1.83 2.20 119 HTML_MIME_NO_HTML_TAG 2728 2.01 1.79 2.09 120 URI_TRY_3LD 2702 0.93 1.78 0.63 121 TR_XM_INV_DKIM 2645 0.50 1.74 0.05 122 XMStockSpam_06 2618 1.22 1.72 1.04 123 T_XMDrugObfuBody_00 2606 0.86 1.71 0.56 124 TM2_M_BODY_EMPTY 2413 0.75 1.59 0.44 125 XM_DK_Undo_01 2381 1.55 1.57 1.55 126 XMGenDplmaNmb 2376 0.97 1.56 0.76 127 BOTNET_NORDNS 2376 0.42 1.56 0.01 128 HTML_TAG_BALANCE_BODY 2353 0.67 1.55 0.36 129 XMEmptyBody_01 2299 0.46 1.51 0.08 130 KHOP_HELO_FCRDNS 2270 1.14 1.49 1.01 131 XMPhish30 2267 0.75 1.49 0.48 132 DIET_1 2262 0.55 1.49 0.21 133 LongTLD 2223 0.62 1.46 0.31 134 URI_HEX 2218 1.01 1.46 0.85 135 SpammyFromTLD_02 2176 0.64 1.43 0.35 136 XM_SendGrid 2144 1.24 1.41 1.18 137 XM_OfRef7 2063 0.50 1.36 0.20 138 RELAYCOUNTRY_RU 2043 0.37 1.34 0.02 139 RCVD_IN_IADB_LISTED 2038 2.96 1.34 3.54 140 TR_Mismatch_TLD_02 2001 0.40 1.32 0.07 141 XMHTML_After_End 2000 0.58 1.32 0.32 142 AC_BR_BONANZA 1959 0.40 1.29 0.08 143 ALL_TRUSTED 1949 15.47 1.28 20.58 144 XMSubMetaI_00 1937 0.54 1.27 0.27 145 URIBL_DBL_SPAM 1912 0.34 1.26 0.00 146 XMBdyGiftCard01 1878 0.86 1.24 0.72 147 T_XMHurry_00 1854 0.54 1.22 0.30 148 T_Symld_Words_02 1850 0.73 1.22 0.56 149 T_MONEY_PERCENT 1824 0.46 1.20 0.20 150 TR_LOTS_OF_MONEY2 1824 0.46 1.20 0.20 151 RELAYCOUNTRY_IN 1823 0.36 1.20 0.06 152 XM_B_COVIDMETA 1809 0.64 1.19 0.44 153 RCVD_IN_IADB_SPF 1807 2.63 1.19 3.16 154 XMReplyNow 1787 0.50 1.18 0.25 155 TR_Symld_Words 1768 1.31 1.16 1.36 156 RDNS_DYNAMIC 1761 0.58 1.16 0.37 157 XM_H_Undi_Recip 1712 0.40 1.13 0.14 158 RCVD_IN_IADB_DK 1709 2.36 1.12 2.80 159 RCVD_IN_IADB_SENDERID 1707 2.40 1.12 2.86 160 XM_HighProb1 1671 0.29 1.10 0.00 161 XM_UB99 1664 0.29 1.09 0.00 162 XM_H_Long_From02 1641 0.99 1.08 0.96 163 XM_DIRTYINTL 1633 0.35 1.07 0.09 164 TR_XM_InvalidRelay 1608 0.29 1.06 0.01 165 GOOG_STO_NOIMG_HTML 1555 0.27 1.02 0.00 166 TR_XM_Undi_Recip19 1509 0.30 0.99 0.05 167 XM_UB60 1506 0.31 0.99 0.06 168 TR_XM_Base64_M1 1492 0.62 0.98 0.50 169 XM_B_Phish66 1488 0.48 0.98 0.29 170 TVD_RCVD_IP 1458 1.20 0.96 1.28 171 BAYES_05 1455 2.69 0.96 3.31 172 XMSexyCombo_01 1446 0.33 0.95 0.10 173 XM_B_COPY_HTML 1445 0.64 0.95 0.53 174 TR_MetaPhish_Combo_01 1443 0.82 0.95 0.78 175 RCVD_IN_VALIDITY_RPBL 1440 0.32 0.95 0.09 176 MPART_ALT_DIFF_COUNT 1436 0.61 0.94 0.49 177 HTTPS_HTTP_MISMATCH 1434 0.78 0.94 0.72 178 TR_Caps_n_Bayes_99 1423 0.26 0.94 0.01 179 DKIM_ADSP_CUSTOM_MED 1417 0.81 0.93 0.77 180 T_STY_INVIS_DIRECT 1413 0.38 0.93 0.18 181 XMPhish14 1411 0.55 0.93 0.42 182 XM_B_DNDMA 1405 0.58 0.92 0.46 183 TR_XM_DK_SendGrid 1365 0.81 0.90 0.78 184 TR_XM_Undi_RecipCombo2 1311 0.23 0.86 0.01 185 XMSlimDrugH 1269 0.45 0.83 0.31 186 RELAYCOUNTRY_FR 1258 0.42 0.83 0.27 187 NML_ADSP_CUSTOM_MED 1239 0.61 0.81 0.53 188 XMBody_78 1238 0.44 0.81 0.30 189 XMLngstWrd_00 1236 1.26 0.81 1.42 190 XM_B_SEO 1236 0.29 0.81 0.10 191 XMGppyBdWords 1227 0.39 0.81 0.24 192 XMSubMetaSxObfu_03 1220 0.45 0.80 0.33 193 TR_XM_Base64_L1 1216 0.30 0.80 0.12 194 THIS_AD 1208 0.45 0.79 0.32 195 XM_UB999 1205 0.21 0.79 0.00 196 XM_UB80 1202 0.22 0.79 0.02 197 JH_SPAMMY_HEADERS 1179 0.21 0.78 0.00 198 TR_XM_RelayPhish 1176 0.25 0.77 0.06 199 HTML_FONT_FACE_BAD 1163 9.22 0.76 12.27 200 RELAYCOUNTRY_GB 1162 0.46 0.76 0.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 354164 87.05 95.63 83.96 2 RELAYCOUNTRY_US 324304 77.08 77.64 76.88 3 DCC_CHECK_NEGATIVE 308909 61.49 28.94 73.23 4 XM_B_Unicode 285521 71.66 82.68 67.68 5 DKIM_SIGNED 256683 68.87 91.12 60.85 6 XM_DK_Pass 252060 67.00 87.10 59.75 7 DKIM_VALID 248141 65.97 85.80 58.82 8 BAYES_50 235452 51.26 38.63 55.81 9 DKIM_VALID_AU 199258 51.86 64.70 47.23 10 XM_B_SpammyWords 170276 48.96 72.83 40.36 11 XMListUnsubscribeExists 167812 48.61 73.11 39.78 12 XM_B_Unicode3 166981 41.14 45.47 39.58 13 DCC_CHECK 112775 38.47 71.05 26.73 14 T_TM2_M_HEADER_IN_MSG 105467 24.37 22.61 25.00 15 HTML_FONT_LOW_CONTRAST 103793 27.71 36.31 24.60 16 DKIM_VALID_EF 101001 26.30 32.83 23.94 17 RCVD_IN_MSPIKE_H2 96525 24.49 28.96 22.88 18 MIME_HTML_ONLY 90820 24.42 32.44 21.53 19 FVGT_m_MULTI_ODD 87405 23.22 30.15 20.72 20 ALL_TRUSTED 86820 15.47 1.28 20.58 21 XMSubLong 86711 21.72 24.96 20.55 22 LOC_TINY_FONT_1 86149 25.71 40.38 20.42 23 T_KAM_HTML_FONT_INVALID 69447 19.92 29.50 16.46 24 XM_B_SpammyWords2 68198 22.73 40.92 16.17 25 BAYES_00 59439 10.54 0.71 14.09 26 HTML_IMAGE_RATIO_04 56594 11.40 5.81 13.42 27 HTML_FONT_FACE_BAD 51752 9.22 0.76 12.27 28 XM_Multi_Part_URI 49151 13.59 18.96 11.65 29 XM_H_Trusted_IP 48036 8.37 0.00 11.39 30 USER_IN_DEF_DKIM_WL 46793 8.91 2.87 11.09 31 TR_XM_DK_Unsub 46319 14.55 24.44 10.98 32 XMStrtUSub 42114 8.40 4.02 9.98 33 MPART_ALT_DIFF 39647 8.81 7.19 9.40 34 ANY_BOUNCE_MESSAGE 36635 6.87 1.85 8.68 35 BOUNCE_MESSAGE 36633 6.87 1.85 8.68 36 UNPARSEABLE_RELAY 34958 9.33 12.23 8.29 37 XM_Evil_Numbers_Gen 33886 8.29 8.99 8.03 38 BAYES_60 32990 7.77 7.64 7.82 39 TooManyTo_001 30975 7.07 6.32 7.34 40 LotsOfNums_01 28976 6.78 6.54 6.87 41 MIME_HTML_ONLY_MULTI 28374 5.92 3.70 6.73 42 XM_B_Unsub 27459 9.07 16.16 6.51 43 XM_DKIMWhitelistDomains 27283 4.78 0.10 6.47 44 LOTS_OF_MONEY 25985 8.47 14.89 6.16 45 IN_ZIMBRA_NJ_WHITELIST 24752 4.33 0.08 5.87 46 TR_MAX_INTL_RELAY 24672 8.34 15.25 5.85 47 BAYES_40 24233 4.75 2.00 5.74 48 TR_XM_DK_Bayes 23558 4.25 0.54 5.58 49 XM_H_GMP 23253 5.30 4.73 5.51 50 TR_XM_DK_Bayes1 23079 4.16 0.53 5.47 51 RCVD_IN_MSPIKE_WL 22071 6.41 9.69 5.23 52 RCVD_IN_MSPIKE_H3 22070 6.41 9.69 5.23 53 TR_XM_BayesUnsub 21192 7.81 15.55 5.02 54 XM_DK_Undo_02 21123 15.49 44.56 5.01 55 TR_XM_DK_Bayes2 19979 3.61 0.48 4.74 56 TR_XM_SpammyWords4 19326 6.91 13.38 4.58 57 HTML_IMAGE_RATIO_06 19057 4.44 4.22 4.52 58 XM_H_Long_From01 18496 4.54 4.98 4.38 59 MIME_QP_LONG_LINE 18053 3.98 3.15 4.28 60 T_TooManySym_01 17921 3.77 2.44 4.25 61 RCVD_IN_VALIDITY_SAFE 17719 3.89 3.02 4.20 62 XMSubNoVowel 17482 3.15 0.40 4.14 63 XM_PDF 16896 3.12 0.65 4.01 64 BAYES_99 16571 11.77 33.54 3.93 65 HTML_IMAGE_RATIO_02 16205 4.44 6.08 3.84 66 BAYES_80 15732 5.16 9.15 3.73 67 BOTNET_IPINHOSTNAME 15625 6.60 14.62 3.70 68 RCVD_IN_VALIDITY_CERTIFIED 15418 3.36 2.54 3.65 69 RCVD_IN_IADB_LISTED 14935 2.96 1.34 3.54 70 XM_B_SpammyWords3 14836 6.46 14.63 3.52 71 BAYES_20 14525 3.03 1.89 3.44 72 RELAYCOUNTRY_META 14289 8.35 22.14 3.39 73 BAYES_05 13983 2.69 0.96 3.31 74 XM_UncommonTLD01 13809 4.69 8.60 3.27 75 MIME_HTML_MOSTLY 13368 3.57 4.68 3.17 76 RCVD_IN_IADB_SPF 13312 2.63 1.19 3.16 77 XM_B_Phish_Phrases 13129 3.63 5.06 3.11 78 BAYES_999 13035 9.18 26.09 3.09 79 T_REMOTE_IMAGE 12836 2.76 1.99 3.04 80 FSL_BULK_SIG 12735 4.29 7.82 3.02 81 XM_SPF_SoftFail 12174 3.60 5.58 2.89 82 RCVD_IN_IADB_SENDERID 12072 2.40 1.12 2.86 83 RCVD_IN_IADB_DK 11822 2.36 1.12 2.80 84 XMSubMetaSx_00 11592 3.70 6.32 2.75 85 XMNumbers 9763 3.18 5.60 2.31 86 TooManyTo_002 9523 1.85 0.72 2.26 87 MAILING_LIST_MULTI 9267 2.10 1.83 2.20 88 T_TooManySym_02 9232 1.80 0.73 2.19 89 XM_B_SpammyTLD 8937 2.42 3.26 2.12 90 BAYES_95 8924 3.01 5.49 2.12 91 XM_Body_Dirty_Words 8896 3.33 6.70 2.11 92 HTML_MIME_NO_HTML_TAG 8834 2.01 1.79 2.09 93 RCVD_IN_IADB_VOUCHED 8752 1.69 0.61 2.07 94 DKIM_INVALID 8542 2.90 5.32 2.02 95 HTML_IMAGE_RATIO_08 8394 2.33 3.26 1.99 96 TR_XM_DKIM_Undo 8094 10.63 34.80 1.92 97 TR_XM_SpammyRelay 8076 6.06 17.57 1.91 98 XMSubLongNoVowel 7988 1.43 0.15 1.89 99 XMSubGarbage 7872 1.38 0.02 1.87 100 INVALID_MSGID 7175 1.34 0.32 1.70 101 XM_CamelCaseFrm001 7045 1.94 2.71 1.67 102 FROM_EXCESS_BASE64 6750 1.69 1.93 1.60 103 TM2_M_URI_OPT_OUT 6746 2.07 3.39 1.60 104 MSGID_NOFQDN1 6647 1.21 0.20 1.58 105 HELO_NODOT 6567 1.23 0.31 1.56 106 HELO_NO_DOMAIN 6561 1.23 0.31 1.56 107 TO_MALFORMED 6535 1.16 0.08 1.55 108 XM_DK_Undo_01 6530 1.55 1.57 1.55 109 TR_XM_PhishingBody 6207 2.19 4.17 1.47 110 XMDiploma_00 6123 1.86 3.01 1.45 111 XMLngstWrd_00 6007 1.26 0.81 1.42 112 T_XMDrugObfuBody_14 5876 2.29 4.78 1.39 113 RCVD_IN_IADB_OPTIN 5770 1.11 0.38 1.37 114 TR_Symld_Words 5752 1.31 1.16 1.36 115 XM_B_Investor 5744 2.28 4.82 1.36 116 TR_XM_UnparsRelay 5611 2.67 6.41 1.33 117 BOTNET 5537 3.65 10.13 1.31 118 TVD_RCVD_IP 5409 1.20 0.96 1.28 119 URI_NOVOWEL 5397 1.46 1.98 1.28 120 IN_HORDE_ADDRESS_BOOK 5223 0.93 0.07 1.24 121 SUBJ_ALL_CAPS 5167 1.58 2.55 1.22 122 T_XMDrugObfuBody_08 5122 1.76 3.26 1.21 123 TR_DCC_Bayes_99 5087 7.10 23.46 1.21 124 XM_SendGrid 4968 1.24 1.41 1.18 125 XM_B_Unsub2 4964 1.57 2.65 1.18 126 TM2_M_VERY_LONG_WORD 4894 1.55 2.63 1.16 127 HTML_OBFUSCATE_20_30 4831 0.85 0.05 1.15 128 UNTRUSTED_Relay 4827 2.80 7.38 1.14 129 TooManyTo_003 4763 0.99 0.62 1.13 130 XMGappySubj_01 4762 0.87 0.15 1.13 131 XMSexyCombo_05 4754 2.11 4.82 1.13 132 XM_OfRef6 4578 2.12 4.98 1.09 133 XMStockSpam_06 4387 1.22 1.72 1.04 134 XMBSHREFv2 4305 0.84 0.34 1.02 135 KHOP_HELO_FCRDNS 4270 1.14 1.49 1.01 136 TR_XM_SpammyWords5 4229 1.96 4.61 1.00 137 XMCapTrack 4219 0.84 0.39 1.00 138 RELAYCOUNTRY_CA 4218 3.87 11.82 1.00 139 TVD_SPACE_RATIO 4197 0.76 0.10 0.99 140 XM_H_Long_From02 4041 0.99 1.08 0.96 141 T_FILL_THIS_FORM_SHORT 3932 2.22 5.81 0.93 142 XM_GoogleGroups 3800 0.79 0.49 0.90 143 XM_E_Blogspot 3781 0.68 0.09 0.90 144 XMBody_95 3775 0.79 0.48 0.89 145 FROM_GOV_DKIM_AU 3613 0.76 0.48 0.86 146 URI_HEX 3569 1.01 1.46 0.85 147 TooManyTo_004 3465 0.75 0.56 0.82 148 SpammyFromTLD_01 3302 1.82 4.72 0.78 149 TR_XM_DK_SendGrid 3292 0.81 0.90 0.78 150 TR_MetaPhish_Combo_01 3281 0.82 0.95 0.78 151 DKIM_ADSP_CUSTOM_MED 3233 0.81 0.93 0.77 152 XMGenDplmaNmb 3199 0.97 1.56 0.76 153 T_TooManySym_03 3170 0.62 0.27 0.75 154 HTTPS_HTTP_MISMATCH 3057 0.78 0.94 0.72 155 XMBdyGiftCard01 3056 0.86 1.24 0.72 156 TooManyTo_005 2804 0.63 0.54 0.66 157 XM_UB50 2770 1.49 3.79 0.66 158 RCVD_IN_BL_SPAMCOP_NET 2662 4.10 13.72 0.63 159 XM_B_SpammyWords4 2659 1.09 2.35 0.63 160 URI_TRY_3LD 2646 0.93 1.78 0.63 161 XMGappySubj_02 2626 0.47 0.04 0.62 162 RELAYCOUNTRY_AU 2614 1.08 2.37 0.62 163 TO_NO_BRKTS_HTML_ONLY 2591 0.55 0.37 0.61 164 T_OBFU_PDF_ATTACH 2588 0.49 0.16 0.61 165 XM_ShortIntro_01 2574 0.57 0.45 0.61 166 XM_H_PHPMailer 2490 0.62 0.71 0.59 167 XM_B_FormFill 2434 0.44 0.05 0.58 168 T_Symld_Words_02 2355 0.73 1.22 0.56 169 T_XMDrugObfuBody_00 2345 0.86 1.71 0.56 170 XMBody_17 2331 2.13 6.52 0.55 171 NML_ADSP_CUSTOM_MED 2247 0.61 0.81 0.53 172 XMBrknScrpt_02 2242 1.04 2.45 0.53 173 XM_B_COPY_HTML 2240 0.64 0.95 0.53 174 XM_Combo_Sbj 2194 0.56 0.66 0.52 175 SHORT_HELO_AND_INLINE_IMAGE 2119 0.38 0.04 0.50 176 XM_ProductURIs 2107 0.56 0.74 0.50 177 TR_XM_FormFill2 2105 1.12 2.85 0.50 178 TR_XM_PHPForged 2104 1.16 2.98 0.50 179 TR_XM_Base64_M1 2092 0.62 0.98 0.50 180 XMNoVowels 2089 0.56 0.75 0.50 181 MPART_ALT_DIFF_COUNT 2079 0.61 0.94 0.49 182 TR_XM_PHPDW 2052 1.12 2.87 0.49 183 XMPhish30 2045 0.75 1.49 0.48 184 XM_H_PHPOS 2029 1.11 2.84 0.48 185 USER_IN_WHITELIST 1966 0.34 0.00 0.47 186 USER_IN_WELCOMELIST 1966 0.34 0.00 0.47 187 FILL_THIS_FORM 1952 0.41 0.27 0.46 188 XM_B_DNDMA 1930 0.58 0.92 0.46 189 TM2_M_BODY_EMPTY 1876 0.75 1.59 0.44 190 XM_B_COVIDMETA 1863 0.64 1.19 0.44 191 FORGED_GMAIL_RCVD 1854 0.51 0.71 0.44 192 XMMoneyMeta_00 1793 0.45 0.50 0.43 193 XMPhish14 1772 0.55 0.93 0.42 194 TR_XM_SPAMCOP 1714 3.25 11.14 0.41 195 PLING_QUERY 1596 0.47 0.73 0.38 196 RDNS_DYNAMIC 1577 0.58 1.16 0.37 197 TR_XM_SpammyWords2 1520 3.55 12.39 0.36 198 HTML_TAG_BALANCE_BODY 1510 0.67 1.55 0.36 199 HTML_IMAGE_ONLY_28 1498 0.34 0.29 0.36 200 RELAYCOUNTRY_GB 1493 0.46 0.76 0.35 ----------------------------------------------------------------------