Email: 559824 Autolearn: 0 AvgScore: 3.40 AvgScanTime: 1.14 sec Spam: 157349 Autolearn: 0 AvgScore: 13.32 AvgScanTime: 1.33 sec Ham: 402475 Autolearn: 0 AvgScore: -0.48 AvgScanTime: 1.06 sec Time Spent Running SA: 176.63 hours Time Spent Processing Spam: 57.99 hours Time Spent Processing Ham: 118.64 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152063 80.12 96.64 73.67 2 DKIM_SIGNED 143447 72.28 91.16 64.90 3 XM_DK_Pass 137864 70.48 87.62 63.78 4 DKIM_VALID 135964 69.44 86.41 62.81 5 XM_B_Unicode 134254 66.36 85.32 58.95 6 RELAYCOUNTRY_US 123677 72.33 78.60 69.88 7 DCC_CHECK 116184 42.46 73.84 30.20 8 XMListUnsubscribeExists 114697 51.53 72.89 43.17 9 XM_B_SpammyWords 113297 46.83 72.00 36.99 10 DKIM_VALID_AU 100631 54.18 63.95 50.36 11 XM_B_Unicode3 73155 37.48 46.49 33.96 12 XM_DK_Undo_02 70313 16.04 44.69 4.84 13 XM_B_SpammyWords2 66254 22.72 42.11 15.14 14 LOC_TINY_FONT_1 64457 27.11 40.96 21.70 15 BAYES_50 61800 51.25 39.28 55.93 16 HTML_FONT_LOW_CONTRAST 59054 28.16 37.53 24.49 17 BAYES_99 53318 12.24 33.89 3.78 18 TR_XM_DKIM_Undo 53258 10.97 33.85 2.03 19 FVGT_m_MULTI_ODD 51798 25.02 32.92 21.93 20 DKIM_VALID_EF 50261 26.94 31.94 24.99 21 MIME_HTML_ONLY 48768 20.73 30.99 16.72 22 RCVD_IN_MSPIKE_H2 46810 25.50 29.75 23.83 23 T_KAM_HTML_FONT_INVALID 44954 20.98 28.57 18.02 24 DCC_CHECK_NEGATIVE 41147 57.51 26.15 69.77 25 BAYES_999 40954 9.42 26.03 2.92 26 TR_DCC_Bayes_99 38744 7.91 24.62 1.37 27 TR_XM_DK_Unsub 37818 15.26 24.03 11.83 28 XMSubLong 36510 20.36 23.20 19.26 29 T_TM2_M_HEADER_IN_MSG 35354 23.49 22.47 23.90 30 RELAYCOUNTRY_META 33827 8.69 21.50 3.69 31 XM_Multi_Part_URI 28986 13.48 18.42 11.55 32 TR_XM_SpammyRelay 26902 6.39 17.10 2.21 33 XM_B_Unsub 25282 9.67 16.07 7.17 34 TR_XM_BayesUnsub 24164 8.33 15.36 5.59 35 TR_MAX_INTL_RELAY 24123 8.79 15.33 6.23 36 LOTS_OF_MONEY 23061 8.38 14.66 5.93 37 XM_B_SpammyWords3 22489 6.54 14.29 3.51 38 BOTNET_IPINHOSTNAME 21797 6.54 13.85 3.68 39 RCVD_IN_BL_SPAMCOP_NET 21348 4.31 13.57 0.69 40 UNPARSEABLE_RELAY 21248 10.60 13.50 9.46 41 TR_XM_SpammyWords4 20721 6.50 13.17 3.90 42 TR_XM_SpammyWords2 20222 3.95 12.85 0.47 43 TR_XM_SPAMCOP 18569 3.69 11.80 0.52 44 RELAYCOUNTRY_CA 18206 4.05 11.57 1.11 45 RCVD_IN_MSPIKE_H3 15048 6.86 9.56 5.80 46 RCVD_IN_MSPIKE_WL 15048 6.86 9.56 5.80 47 BAYES_80 14968 5.54 9.51 3.98 48 XM_Evil_Numbers_Gen 14586 6.91 9.27 5.99 49 BOTNET 13950 3.28 8.87 1.10 50 FSL_BULK_SIG 13055 4.96 8.30 3.66 51 BAYES_60 12516 7.95 7.95 7.96 52 LotsOfNums_01 11768 7.32 7.48 7.26 53 TR_XM_UnparsRelay 11598 3.19 7.37 1.56 54 XM_Body_Dirty_Words 11457 3.74 7.28 2.36 55 XM_UncommonTLD01 11118 4.76 7.07 3.85 56 UNTRUSTED_Relay 10414 2.77 6.62 1.27 57 MPART_ALT_DIFF 10337 4.70 6.57 3.97 58 HTML_IMAGE_RATIO_02 10308 4.77 6.55 4.08 59 XMBody_17 9770 2.13 6.21 0.53 60 XMSubMetaSx_00 9266 3.91 5.89 3.14 61 TooManyTo_001 9194 7.02 5.84 7.49 62 BAYES_95 8590 3.15 5.46 2.24 63 XM_B_Phish_Phrases 8545 3.29 5.43 2.46 64 XM_SPF_SoftFail 8523 3.82 5.42 3.20 65 XM_H_GMP 8054 5.60 5.12 5.79 66 HTML_IMAGE_RATIO_04 7883 4.38 5.01 4.13 67 HTML_IMAGE_RATIO_06 7877 2.93 5.01 2.12 68 XM_H_Long_From01 7789 4.76 4.95 4.68 69 T_XMDrugObfuBody_14 7490 2.32 4.76 1.37 70 DKIM_INVALID 7483 2.84 4.76 2.09 71 XM_B_Investor 7063 2.25 4.49 1.38 72 XMSexyCombo_05 7000 2.14 4.45 1.23 73 T_FILL_THIS_FORM_SHORT 7000 1.92 4.45 0.94 74 TR_XM_PhishingBody 6911 2.32 4.39 1.51 75 TM2_M_URI_OPT_OUT 6674 2.35 4.24 1.60 76 TR_XM_SpammyWords5 6644 2.05 4.22 1.20 77 MIME_HTML_MOSTLY 6427 3.09 4.08 2.70 78 XMNumbers 5991 2.91 3.81 2.57 79 XMStrtUSub 5859 3.98 3.72 4.08 80 MIME_HTML_ONLY_MULTI 5546 2.18 3.52 1.65 81 HTML_IMAGE_RATIO_08 5510 2.19 3.50 1.67 82 MIME_QP_LONG_LINE 5449 4.27 3.46 4.58 83 XM_OfRef6 5367 1.75 3.41 1.10 84 TR_LOTS_OF_MONEY3 5229 1.19 3.32 0.36 85 XM_B_SpammyTLD 5150 2.57 3.27 2.29 86 SpammyFromTLD_01 5149 1.80 3.27 1.22 87 T_XMDrugObfuBody_08 5064 1.80 3.22 1.24 88 TM2_M_VERY_LONG_WORD 4974 1.91 3.16 1.43 89 USER_IN_DEF_DKIM_WL 4904 9.10 3.12 11.44 90 XM_UB50 4819 1.40 3.06 0.75 91 RCVD_IN_VALIDITY_SAFE 4798 4.01 3.05 4.39 92 TR_XM_BayesRelay 4782 0.85 3.04 0.00 93 XM_URI_RBL 4309 0.86 2.74 0.12 94 FONT_INVIS_LONG_LINE 4274 0.79 2.72 0.04 95 XM_CamelCaseFrm001 4253 2.16 2.70 1.94 96 TR_XM_FormFill 4235 0.77 2.69 0.01 97 SUBJ_ALL_CAPS 4219 1.65 2.68 1.25 98 RCVD_IN_VALIDITY_CERTIFIED 4097 3.47 2.60 3.80 99 TR_XM_NoHeaderRelay 4000 0.80 2.54 0.12 100 XM_B_SpammyWords4 3871 1.14 2.46 0.63 101 RELAYCOUNTRY_AU 3691 1.10 2.35 0.62 102 XM_B_Unsub2 3681 1.69 2.34 1.44 103 T_TooManySym_01 3565 3.85 2.27 4.47 104 T_REMOTE_IMAGE 3460 2.83 2.20 3.07 105 XMDiploma_00 3426 1.49 2.18 1.22 106 ANY_BOUNCE_MESSAGE 3194 12.75 2.03 16.94 107 BOUNCE_MESSAGE 3190 12.75 2.03 16.94 108 HK_RANDOM_REPLYTO 3190 0.64 2.03 0.10 109 TR_Mismatch_TLD_02 3172 0.61 2.02 0.06 110 MAILING_LIST_MULTI 3066 2.11 1.95 2.18 111 SpammyFromTLD_02 3034 0.90 1.93 0.49 112 HTML_MIME_NO_HTML_TAG 2995 2.23 1.90 2.36 113 FROM_EXCESS_BASE64 2915 1.68 1.85 1.62 114 TR_XM_PHPForged 2728 1.17 1.73 0.95 115 XM_H_Long_From02 2724 1.20 1.73 0.99 116 XM_SendGrid 2715 1.46 1.73 1.36 117 URI_HEX 2714 1.18 1.72 0.97 118 TR_XM_PHPDW 2708 1.16 1.72 0.94 119 XM_DK_Undo_01 2674 1.69 1.70 1.69 120 XMBrknScrpt_02 2611 0.87 1.66 0.56 121 TR_XM_FormFill2 2606 1.15 1.66 0.95 122 XM_H_PHPOS 2594 1.13 1.65 0.93 123 TR_XM_INV_DKIM 2580 0.50 1.64 0.05 124 RCVD_IN_IADB_LISTED 2574 3.32 1.64 3.98 125 XMStockSpam_06 2564 1.03 1.63 0.79 126 URI_TRY_3LD 2512 0.85 1.60 0.55 127 BAYES_40 2351 4.77 1.49 6.05 128 RCVD_IN_IADB_SPF 2301 2.97 1.46 3.55 129 KHOP_HELO_FCRDNS 2294 1.25 1.46 1.17 130 T_XMHurry_00 2292 0.73 1.46 0.45 131 XM_HighProb1 2291 0.41 1.46 0.00 132 ALL_TRUSTED 2215 20.06 1.41 27.35 133 RCVD_IN_IADB_DK 2186 2.65 1.39 3.15 134 RCVD_IN_IADB_SENDERID 2177 2.70 1.38 3.22 135 XMBdyGiftCard01 2173 0.78 1.38 0.54 136 XMPhish30 2144 0.72 1.36 0.47 137 HTML_TAG_BALANCE_BODY 2132 0.65 1.35 0.38 138 XMHTML_After_End 2131 0.67 1.35 0.41 139 TR_Symld_Words 2104 1.32 1.34 1.31 140 URI_NOVOWEL 2068 1.48 1.31 1.55 141 TR_XM_InvalidRelay 2057 0.38 1.31 0.02 142 DKIM_ADSP_CUSTOM_MED 2010 0.95 1.28 0.82 143 XMPhish14 1981 0.60 1.26 0.34 144 T_XMDrugObfuBody_00 1963 0.68 1.25 0.46 145 DIET_1 1958 0.53 1.24 0.26 146 AC_BR_BONANZA 1869 0.38 1.19 0.07 147 RCVD_IN_VALIDITY_RPBL 1869 0.36 1.19 0.03 148 XMReplyNow 1845 0.47 1.17 0.19 149 XMGenDplmaNmb 1827 0.75 1.16 0.59 150 BAYES_20 1822 2.43 1.16 2.93 151 XMSlimDrugH 1783 0.55 1.13 0.32 152 NML_ADSP_CUSTOM_MED 1766 0.72 1.12 0.57 153 LongTLD 1718 0.50 1.09 0.27 154 RELAYCOUNTRY_FR 1715 0.61 1.09 0.42 155 HTTPS_HTTP_MISMATCH 1658 0.82 1.05 0.73 156 XM_UB99 1640 0.30 1.04 0.00 157 BOTNET_NORDNS 1639 0.30 1.04 0.00 158 FORGED_GMAIL_RCVD 1603 0.62 1.02 0.47 159 XM_B_Phish66 1591 0.47 1.01 0.25 160 URIBL_DBL_SPAM 1585 0.29 1.01 0.00 161 T_Symld_Words_02 1557 0.65 0.99 0.52 162 XM_B_COVIDMETA 1535 0.42 0.98 0.20 163 THIS_AD 1530 0.52 0.97 0.34 164 XM_UB80 1510 0.28 0.96 0.02 165 TR_MetaPhish_Combo_01 1505 0.66 0.96 0.55 166 DKIM_ADSP_NXDOMAIN 1494 0.55 0.95 0.39 167 TR_XM_DK_SendGrid 1484 0.89 0.94 0.87 168 RDNS_DYNAMIC 1477 0.54 0.94 0.38 169 XM_H_Undi_Recip 1437 0.37 0.91 0.16 170 TR_Mismatch_TLD_01 1437 0.49 0.91 0.33 171 XM_UB60 1434 0.30 0.91 0.06 172 T_MONEY_PERCENT 1418 0.48 0.90 0.31 173 TR_LOTS_OF_MONEY2 1418 0.48 0.90 0.31 174 MISSING_HEADERS 1415 0.55 0.90 0.41 175 XMSubMetaI_00 1400 0.59 0.89 0.48 176 XM_DIRTYINTL 1389 0.33 0.88 0.12 177 TVD_RCVD_IP 1388 1.20 0.88 1.32 178 XMBody_78 1343 0.47 0.85 0.33 179 MPART_ALT_DIFF_COUNT 1342 0.63 0.85 0.55 180 TR_XM_Base64_M1 1338 0.67 0.85 0.59 181 PLING_QUERY 1336 0.52 0.85 0.39 182 XMMoneyMeta_00 1310 0.57 0.83 0.46 183 RELAYCOUNTRY_GB 1309 0.49 0.83 0.36 184 T_STY_INVIS_DIRECT 1307 0.34 0.83 0.15 185 TR_XM_Spammywords 1285 0.36 0.82 0.18 186 XM_S_SpammyWords 1285 0.36 0.82 0.18 187 XM_B_DNDMA 1271 0.40 0.81 0.24 188 T_XMDrugObfuBody_10 1256 0.24 0.80 0.03 189 XM_B_COPY_HTML 1238 0.62 0.79 0.55 190 XMSexyCombo_01 1234 0.33 0.78 0.15 191 TM2_M_OBFU_COMMENT 1219 0.47 0.77 0.35 192 XM_ProductURIs 1216 0.57 0.77 0.48 193 HOSTED_IMG_MULTI_PUB_01 1216 0.23 0.77 0.01 194 XM_UB999 1211 0.22 0.77 0.00 195 URIBL_BLACK 1190 0.24 0.76 0.04 196 TooManyTo_002 1188 1.83 0.76 2.26 197 T_TooManySym_02 1185 1.83 0.75 2.25 198 HTML_FONT_FACE_BAD 1184 0.42 0.75 0.29 199 TR_Caps_n_Bayes_99 1178 0.22 0.75 0.01 200 XM_Combo_Sbj 1160 0.38 0.74 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 296489 80.12 96.64 73.67 2 RELAYCOUNTRY_US 281267 72.33 78.60 69.88 3 DCC_CHECK_NEGATIVE 280815 57.51 26.15 69.77 4 DKIM_SIGNED 261216 72.28 91.16 64.90 5 XM_DK_Pass 256693 70.48 87.62 63.78 6 DKIM_VALID 252797 69.44 86.41 62.81 7 XM_B_Unicode 237261 66.36 85.32 58.95 8 BAYES_50 225095 51.25 39.28 55.93 9 DKIM_VALID_AU 202693 54.18 63.95 50.36 10 XMListUnsubscribeExists 173759 51.53 72.89 43.17 11 XM_B_SpammyWords 148891 46.83 72.00 36.99 12 XM_B_Unicode3 136667 37.48 46.49 33.96 13 DCC_CHECK 121542 42.46 73.84 30.20 14 ALL_TRUSTED 110080 20.06 1.41 27.35 15 DKIM_VALID_EF 100569 26.94 31.94 24.99 16 HTML_FONT_LOW_CONTRAST 98571 28.16 37.53 24.49 17 T_TM2_M_HEADER_IN_MSG 96172 23.49 22.47 23.90 18 RCVD_IN_MSPIKE_H2 95922 25.50 29.75 23.83 19 FVGT_m_MULTI_ODD 88278 25.02 32.92 21.93 20 LOC_TINY_FONT_1 87319 27.11 40.96 21.70 21 XMSubLong 77497 20.36 23.20 19.26 22 T_KAM_HTML_FONT_INVALID 72517 20.98 28.57 18.02 23 ANY_BOUNCE_MESSAGE 68183 12.75 2.03 16.94 24 BOUNCE_MESSAGE 68173 12.75 2.03 16.94 25 MIME_HTML_ONLY 67279 20.73 30.99 16.72 26 XM_B_SpammyWords2 60920 22.72 42.11 15.14 27 BAYES_00 59708 10.86 0.68 14.84 28 TR_XM_DK_Unsub 47611 15.26 24.03 11.83 29 XM_Multi_Part_URI 46484 13.48 18.42 11.55 30 USER_IN_DEF_DKIM_WL 46043 9.10 3.12 11.44 31 UNPARSEABLE_RELAY 38071 10.60 13.50 9.46 32 BAYES_60 32017 7.95 7.95 7.96 33 TooManyTo_001 30133 7.02 5.84 7.49 34 LotsOfNums_01 29232 7.32 7.48 7.26 35 XM_B_Unsub 28873 9.67 16.07 7.17 36 XM_DKIMWhitelistDomains 25986 4.66 0.05 6.46 37 IN_ZIMBRA_NJ_WHITELIST 25578 4.59 0.06 6.36 38 TR_MAX_INTL_RELAY 25064 8.79 15.33 6.23 39 BAYES_40 24330 4.77 1.49 6.05 40 XM_Evil_Numbers_Gen 24125 6.91 9.27 5.99 41 LOTS_OF_MONEY 23857 8.38 14.66 5.93 42 TR_XM_DK_Bayes 23739 4.40 0.56 5.90 43 RCVD_IN_MSPIKE_WL 23333 6.86 9.56 5.80 44 RCVD_IN_MSPIKE_H3 23333 6.86 9.56 5.80 45 XM_H_GMP 23290 5.60 5.12 5.79 46 TR_XM_DK_Bayes1 23005 4.26 0.55 5.72 47 TR_XM_BayesUnsub 22489 8.33 15.36 5.59 48 TR_XM_DK_Bayes2 20090 3.73 0.50 4.99 49 XM_DK_Undo_02 19486 16.04 44.69 4.84 50 XM_H_Long_From01 18839 4.76 4.95 4.68 51 MIME_QP_LONG_LINE 18451 4.27 3.46 4.58 52 T_TooManySym_01 17980 3.85 2.27 4.47 53 RCVD_IN_VALIDITY_SAFE 17662 4.01 3.05 4.39 54 XM_PDF 17099 3.23 0.63 4.25 55 HTML_IMAGE_RATIO_04 16624 4.38 5.01 4.13 56 XMStrtUSub 16437 3.98 3.72 4.08 57 HTML_IMAGE_RATIO_02 16419 4.77 6.55 4.08 58 BAYES_80 16029 5.54 9.51 3.98 59 RCVD_IN_IADB_LISTED 16012 3.32 1.64 3.98 60 MPART_ALT_DIFF 15993 4.70 6.57 3.97 61 TR_XM_SpammyWords4 15692 6.50 13.17 3.90 62 XM_UncommonTLD01 15510 4.76 7.07 3.85 63 RCVD_IN_VALIDITY_CERTIFIED 15304 3.47 2.60 3.80 64 BAYES_99 15198 12.24 33.89 3.78 65 RELAYCOUNTRY_META 14844 8.69 21.50 3.69 66 BOTNET_IPINHOSTNAME 14831 6.54 13.85 3.68 67 FSL_BULK_SIG 14727 4.96 8.30 3.66 68 RCVD_IN_IADB_SPF 14298 2.97 1.46 3.55 69 XM_B_SpammyWords3 14112 6.54 14.29 3.51 70 RCVD_IN_IADB_SENDERID 12944 2.70 1.38 3.22 71 XM_SPF_SoftFail 12866 3.82 5.42 3.20 72 RCVD_IN_IADB_DK 12670 2.65 1.39 3.15 73 XMSubMetaSx_00 12635 3.91 5.89 3.14 74 T_REMOTE_IMAGE 12375 2.83 2.20 3.07 75 BAYES_20 11805 2.43 1.16 2.93 76 BAYES_999 11754 9.42 26.03 2.92 77 MIME_HTML_MOSTLY 10881 3.09 4.08 2.70 78 XMNumbers 10324 2.91 3.81 2.57 79 XM_B_Phish_Phrases 9893 3.29 5.43 2.46 80 RCVD_IN_IADB_VOUCHED 9650 1.91 0.66 2.40 81 XM_Body_Dirty_Words 9498 3.74 7.28 2.36 82 HTML_MIME_NO_HTML_TAG 9497 2.23 1.90 2.36 83 BAYES_05 9270 1.82 0.58 2.30 84 XM_B_SpammyTLD 9217 2.57 3.27 2.29 85 TooManyTo_002 9080 1.83 0.76 2.26 86 T_TooManySym_02 9071 1.83 0.75 2.25 87 BAYES_95 9023 3.15 5.46 2.24 88 TR_XM_SpammyRelay 8878 6.39 17.10 2.21 89 MAILING_LIST_MULTI 8767 2.11 1.95 2.18 90 HTML_IMAGE_RATIO_06 8519 2.93 5.01 2.12 91 DKIM_INVALID 8419 2.84 4.76 2.09 92 TR_XM_DKIM_Undo 8155 10.97 33.85 2.03 93 XM_CamelCaseFrm001 7825 2.16 2.70 1.94 94 INVALID_MSGID 7066 1.33 0.24 1.76 95 XM_DK_Undo_01 6808 1.69 1.70 1.69 96 HTML_IMAGE_RATIO_08 6733 2.19 3.50 1.67 97 MIME_HTML_ONLY_MULTI 6654 2.18 3.52 1.65 98 RCVD_IN_IADB_OPTIN 6538 1.29 0.43 1.62 99 FROM_EXCESS_BASE64 6500 1.68 1.85 1.62 100 TO_MALFORMED 6498 1.19 0.11 1.61 101 MSGID_NOFQDN1 6480 1.19 0.12 1.61 102 TM2_M_URI_OPT_OUT 6458 2.35 4.24 1.60 103 HELO_NODOT 6290 1.21 0.31 1.56 104 HELO_NO_DOMAIN 6285 1.21 0.30 1.56 105 TR_XM_UnparsRelay 6260 3.19 7.37 1.56 106 URI_NOVOWEL 6227 1.48 1.31 1.55 107 TR_XM_PhishingBody 6066 2.32 4.39 1.51 108 XM_B_Unsub2 5787 1.69 2.34 1.44 109 TM2_M_VERY_LONG_WORD 5738 1.91 3.16 1.43 110 XM_B_Investor 5535 2.25 4.49 1.38 111 TR_DCC_Bayes_99 5531 7.91 24.62 1.37 112 T_XMDrugObfuBody_14 5522 2.32 4.76 1.37 113 XM_SendGrid 5476 1.46 1.73 1.36 114 TVD_RCVD_IP 5311 1.20 0.88 1.32 115 TR_Symld_Words 5284 1.32 1.34 1.31 116 UNTRUSTED_Relay 5110 2.77 6.62 1.27 117 SUBJ_ALL_CAPS 5033 1.65 2.68 1.25 118 T_XMDrugObfuBody_08 4989 1.80 3.22 1.24 119 IN_HORDE_ADDRESS_BOOK 4953 0.90 0.05 1.23 120 XMSexyCombo_05 4953 2.14 4.45 1.23 121 XMDiploma_00 4925 1.49 2.18 1.22 122 SpammyFromTLD_01 4901 1.80 3.27 1.22 123 XMGappySubj_01 4878 0.92 0.18 1.21 124 TR_XM_SpammyWords5 4828 2.05 4.22 1.20 125 KHOP_HELO_FCRDNS 4709 1.25 1.46 1.17 126 TooManyTo_003 4591 1.00 0.65 1.14 127 RELAYCOUNTRY_CA 4484 4.05 11.57 1.11 128 XM_OfRef6 4434 1.75 3.41 1.10 129 BOTNET 4429 3.28 8.87 1.10 130 TVD_SPACE_RATIO 4259 0.81 0.17 1.06 131 XM_GoogleGroups 4132 0.88 0.51 1.03 132 XMBSHREFv2 4049 0.84 0.43 1.01 133 XM_H_Long_From02 4004 1.20 1.73 0.99 134 URI_HEX 3896 1.18 1.72 0.97 135 TR_XM_FormFill2 3839 1.15 1.66 0.95 136 TR_XM_PHPForged 3825 1.17 1.73 0.95 137 TR_XM_PHPDW 3801 1.16 1.72 0.94 138 XMCapTrack 3777 0.76 0.30 0.94 139 T_FILL_THIS_FORM_SHORT 3765 1.92 4.45 0.94 140 XM_H_PHPOS 3759 1.13 1.65 0.93 141 T_TooManySym_03 3592 0.71 0.23 0.89 142 XMBody_95 3529 0.71 0.28 0.88 143 TR_XM_DK_SendGrid 3508 0.89 0.94 0.87 144 DKIM_ADSP_CUSTOM_MED 3318 0.95 1.28 0.82 145 TooManyTo_004 3222 0.74 0.59 0.80 146 XMStockSpam_06 3177 1.03 1.63 0.79 147 XMLngstWrd_00 3112 0.72 0.57 0.77 148 XM_UB50 2999 1.40 3.06 0.75 149 XMGappySubj_02 2954 0.55 0.08 0.73 150 HTTPS_HTTP_MISMATCH 2920 0.82 1.05 0.73 151 XMLngstWrd_01 2815 0.65 0.53 0.70 152 RCVD_IN_BL_SPAMCOP_NET 2764 4.31 13.57 0.69 153 FROM_GOV_DKIM_AU 2716 0.56 0.26 0.67 154 TooManyTo_005 2661 0.63 0.57 0.66 155 T_OBFU_PDF_ATTACH 2628 0.51 0.16 0.65 156 XM_B_SpammyWords4 2523 1.14 2.46 0.63 157 XM_ShortIntro_01 2520 0.61 0.58 0.63 158 XM_H_PHPMailer 2489 0.65 0.71 0.62 159 RELAYCOUNTRY_AU 2484 1.10 2.35 0.62 160 HTML_OBFUSCATE_20_30 2401 0.44 0.03 0.60 161 TR_XM_Base64_M1 2393 0.67 0.85 0.59 162 XMGenDplmaNmb 2371 0.75 1.16 0.59 163 HTML_IMAGE_ONLY_28 2370 0.61 0.65 0.59 164 NML_ADSP_CUSTOM_MED 2280 0.72 1.12 0.57 165 XMBrknScrpt_02 2264 0.87 1.66 0.56 166 URI_TRY_3LD 2225 0.85 1.60 0.55 167 XM_B_COPY_HTML 2221 0.62 0.79 0.55 168 TR_MetaPhish_Combo_01 2215 0.66 0.96 0.55 169 MPART_ALT_DIFF_COUNT 2196 0.63 0.85 0.55 170 XMBdyGiftCard01 2167 0.78 1.38 0.54 171 FILL_THIS_FORM 2141 0.45 0.25 0.53 172 XMBody_17 2140 2.13 6.21 0.53 173 TR_XM_SPAMCOP 2109 3.69 11.80 0.52 174 T_Symld_Words_02 2075 0.65 0.99 0.52 175 XMNoVowels 2043 0.50 0.49 0.51 176 USER_IN_WELCOMELIST 2040 0.36 0.00 0.51 177 USER_IN_WHITELIST 2040 0.36 0.00 0.51 178 SHORT_HELO_AND_INLINE_IMAGE 1994 0.37 0.05 0.50 179 SpammyFromTLD_02 1978 0.90 1.93 0.49 180 XM_ProductURIs 1950 0.57 0.77 0.48 181 XMSubNoVowel 1936 0.44 0.35 0.48 182 XMSubMetaI_00 1922 0.59 0.89 0.48 183 FORGED_GMAIL_RCVD 1890 0.62 1.02 0.47 184 TR_XM_SpammyWords2 1882 3.95 12.85 0.47 185 XMPhish30 1875 0.72 1.36 0.47 186 XMMoneyMeta_00 1863 0.57 0.83 0.46 187 T_XMDrugObfuBody_00 1844 0.68 1.25 0.46 188 T_XMHurry_00 1805 0.73 1.46 0.45 189 XM_B_FormFill 1794 0.33 0.03 0.45 190 T_TooManySym_04 1783 0.34 0.07 0.44 191 RELAYCOUNTRY_FR 1688 0.61 1.09 0.42 192 MISSING_HEADERS 1648 0.55 0.90 0.41 193 XMHTML_After_End 1642 0.67 1.35 0.41 194 TM2_M_BODY_EMPTY 1586 0.35 0.25 0.39 195 XMPhish08 1584 0.47 0.65 0.39 196 DKIM_ADSP_NXDOMAIN 1579 0.55 0.95 0.39 197 PLING_QUERY 1576 0.52 0.85 0.39 198 HTML_IMAGE_ONLY_32 1573 0.33 0.16 0.39 199 TO_NO_BRKTS_HTML_ONLY 1572 0.37 0.30 0.39 200 XMSolicitRefs_0 1561 0.41 0.45 0.39 ----------------------------------------------------------------------