Email: 528516 Autolearn: 0 AvgScore: 3.79 AvgScanTime: 1.42 sec Spam: 162393 Autolearn: 0 AvgScore: 13.28 AvgScanTime: 1.52 sec Ham: 366123 Autolearn: 0 AvgScore: -0.41 AvgScanTime: 1.37 sec Time Spent Running SA: 207.90 hours Time Spent Processing Spam: 68.63 hours Time Spent Processing Ham: 139.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 161187 99.26 99.26 99.26 2 HTML_MESSAGE 156735 89.21 96.52 85.98 3 DKIM_SIGNED 147688 80.59 90.94 76.00 4 XM_DK_Pass 141514 78.45 87.14 74.60 5 DKIM_VALID 139458 77.39 85.88 73.63 6 XM_B_Unicode 137352 74.67 84.58 70.27 7 RELAYCOUNTRY_US 128580 81.03 79.18 81.84 8 XMListUnsubscribeExists 118130 57.02 72.74 50.05 9 XM_B_SpammyWords 117375 53.38 72.28 45.00 10 DCC_CHECK 116574 45.97 71.79 34.53 11 DKIM_VALID_AU 103476 60.54 63.72 59.13 12 XM_B_Unicode3 74275 41.86 45.74 40.14 13 XM_DK_Undo_02 73212 17.85 45.08 5.77 14 XM_B_SpammyWords2 70298 26.42 43.29 18.94 15 LOC_TINY_FONT_1 64307 29.86 39.60 25.55 16 BAYES_50 60680 52.96 37.37 59.87 17 BAYES_99 59143 14.20 36.42 4.35 18 HTML_FONT_LOW_CONTRAST 57583 30.60 35.46 28.45 19 TR_XM_DKIM_Undo 56366 12.35 34.71 2.43 20 FVGT_m_MULTI_ODD 52263 27.97 32.18 26.10 21 DKIM_VALID_EF 50986 29.48 31.40 28.63 22 MIME_HTML_ONLY 50721 22.24 31.23 18.25 23 RCVD_IN_MSPIKE_H2 49902 29.52 30.73 28.98 24 BAYES_999 46461 11.04 28.61 3.25 25 T_KAM_HTML_FONT_INVALID 45971 23.16 28.31 20.88 26 DCC_CHECK_NEGATIVE 45803 53.98 28.21 65.42 27 TR_DCC_Bayes_99 41008 8.98 25.25 1.76 28 XMSubLong 38965 22.99 23.99 22.54 29 TR_XM_DK_Unsub 37517 16.49 23.10 13.55 30 T_TM2_M_HEADER_IN_MSG 37280 27.07 22.96 28.90 31 RELAYCOUNTRY_META 32473 9.23 20.00 4.46 32 XM_Multi_Part_URI 31512 15.92 19.40 14.38 33 LOTS_OF_MONEY 26375 9.43 16.24 6.40 34 TR_XM_SpammyRelay 25974 6.48 15.99 2.27 35 XM_B_Unsub 24621 10.42 15.16 8.32 36 TR_MAX_INTL_RELAY 23889 9.59 14.71 7.31 37 TR_XM_SpammyWords2 23854 4.93 14.69 0.60 38 TR_XM_SpammyWords4 23846 7.61 14.68 4.47 39 TR_XM_BayesUnsub 23724 9.22 14.61 6.83 40 XM_B_SpammyWords3 22785 7.51 14.03 4.62 41 BOTNET_IPINHOSTNAME 22671 7.07 13.96 4.01 42 UNPARSEABLE_RELAY 21939 11.83 13.51 11.08 43 RCVD_IN_BL_SPAMCOP_NET 19353 4.10 11.92 0.64 44 RELAYCOUNTRY_CA 17607 4.25 10.84 1.33 45 TR_XM_SPAMCOP 16288 3.37 10.03 0.41 46 BOTNET 15015 3.70 9.25 1.24 47 RCVD_IN_MSPIKE_WL 14585 6.99 8.98 6.11 48 RCVD_IN_MSPIKE_H3 14585 6.99 8.98 6.11 49 XM_Evil_Numbers_Gen 14501 7.98 8.93 7.56 50 BAYES_80 14446 5.91 8.90 4.59 51 TR_XM_UnparsRelay 12515 3.63 7.71 1.83 52 BAYES_60 12260 8.74 7.55 9.26 53 FSL_BULK_SIG 12024 5.06 7.40 4.02 54 XMBody_17 11152 2.62 6.87 0.74 55 XM_Body_Dirty_Words 11147 3.88 6.86 2.56 56 LotsOfNums_01 10966 7.90 6.75 8.41 57 HTML_IMAGE_RATIO_02 10720 5.36 6.60 4.80 58 MPART_ALT_DIFF 9589 4.26 5.90 3.53 59 XMSubMetaSx_00 9473 4.20 5.83 3.48 60 UNTRUSTED_Relay 9397 2.74 5.79 1.40 61 BAYES_95 8834 3.55 5.44 2.72 62 XM_H_GMP 8806 6.10 5.42 6.40 63 XM_UncommonTLD01 8791 4.29 5.41 3.80 64 TooManyTo_001 8760 7.53 5.39 8.47 65 XM_H_Long_From01 8582 5.35 5.28 5.37 66 XM_SPF_SoftFail 8478 3.88 5.22 3.29 67 XM_B_Investor 8260 2.86 5.09 1.87 68 DKIM_INVALID 8230 3.20 5.07 2.37 69 HTML_IMAGE_RATIO_04 7916 4.37 4.87 4.14 70 TM2_M_URI_OPT_OUT 7654 2.50 4.71 1.52 71 TR_LOTS_OF_MONEY3 7430 1.74 4.58 0.48 72 XM_B_Phish_Phrases 7186 3.80 4.43 3.52 73 TR_XM_SpammyWords5 7148 2.14 4.40 1.14 74 TR_XM_PhishingBody 7047 2.64 4.34 1.89 75 HTML_IMAGE_RATIO_06 6810 3.44 4.19 3.11 76 MIME_HTML_MOSTLY 6479 2.65 3.99 2.06 77 XMSexyCombo_05 6407 2.16 3.95 1.36 78 T_XMDrugObfuBody_14 6364 2.34 3.92 1.65 79 HTML_IMAGE_RATIO_08 6271 2.92 3.86 2.51 80 XMStrtUSub 6084 4.20 3.75 4.40 81 T_FILL_THIS_FORM_SHORT 5876 1.75 3.62 0.93 82 MIME_HTML_ONLY_MULTI 5644 2.55 3.48 2.14 83 XM_OfRef6 5361 1.83 3.30 1.18 84 XMNumbers 5314 2.78 3.27 2.56 85 XM_B_SpammyTLD 5098 2.68 3.14 2.47 86 T_XMDrugObfuBody_08 5047 1.95 3.11 1.43 87 MIME_QP_LONG_LINE 4963 4.47 3.06 5.10 88 TR_XM_BayesRelay 4768 0.90 2.94 0.00 89 TM2_M_VERY_LONG_WORD 4646 1.71 2.86 1.20 90 RCVD_IN_VALIDITY_SAFE 4590 4.34 2.83 5.01 91 XM_UB50 4416 1.40 2.72 0.82 92 T_TooManySym_01 4413 5.16 2.72 6.24 93 XM_CamelCaseFrm001 4242 2.22 2.61 2.04 94 XMDiploma_00 4236 2.00 2.61 1.73 95 XM_URI_RBL 4161 0.89 2.56 0.14 96 SUBJ_ALL_CAPS 4093 1.73 2.52 1.37 97 USER_IN_DEF_DKIM_WL 3993 10.10 2.46 13.48 98 XM_B_Unsub2 3967 1.91 2.44 1.68 99 RCVD_IN_VALIDITY_CERTIFIED 3920 3.76 2.41 4.35 100 RELAYCOUNTRY_AU 3913 1.21 2.41 0.68 101 XM_B_SpammyWords4 3879 1.26 2.39 0.75 102 ALL_TRUSTED 3656 11.02 2.25 14.91 103 HTML_MIME_NO_HTML_TAG 3410 1.95 2.10 1.88 104 TR_XM_FormFill 3385 0.66 2.08 0.02 105 SpammyFromTLD_01 3369 1.25 2.07 0.88 106 TR_XM_INV_DKIM 3060 0.62 1.88 0.06 107 FONT_INVIS_LONG_LINE 2960 0.59 1.82 0.04 108 URI_TRY_3LD 2935 0.95 1.81 0.57 109 FROM_EXCESS_BASE64 2925 1.69 1.80 1.64 110 BAYES_40 2856 3.69 1.76 4.54 111 URIBL_DBL_SPAM 2811 0.55 1.73 0.03 112 MAILING_LIST_MULTI 2777 3.02 1.71 3.61 113 ANY_BOUNCE_MESSAGE 2740 3.40 1.69 4.16 114 BOUNCE_MESSAGE 2740 3.40 1.69 4.16 115 XMBrknScrpt_02 2700 0.92 1.66 0.59 116 URI_HEX 2651 1.42 1.63 1.33 117 T_REMOTE_IMAGE 2649 2.94 1.63 3.52 118 TR_XM_PHPForged 2626 0.74 1.62 0.35 119 DKIM_ADSP_CUSTOM_MED 2595 1.08 1.60 0.85 120 XM_DK_Undo_01 2576 1.83 1.59 1.94 121 TR_XM_PHPDW 2558 0.73 1.58 0.35 122 TR_XM_NoHeaderRelay 2549 0.58 1.57 0.14 123 TR_XM_FormFill2 2524 0.73 1.55 0.37 124 T_XMHurry_00 2501 0.84 1.54 0.53 125 XM_H_Long_From02 2494 1.22 1.54 1.08 126 XM_H_PHPOS 2484 0.71 1.53 0.34 127 SpammyFromTLD_02 2454 0.85 1.51 0.55 128 XMPhish30 2413 0.84 1.49 0.55 129 XMGenDplmaNmb 2369 1.16 1.46 1.03 130 NML_ADSP_CUSTOM_MED 2368 0.82 1.46 0.54 131 HOSTED_IMG_MULTI_PUB_01 2330 0.45 1.43 0.02 132 XM_SendGrid 2322 1.39 1.43 1.37 133 XMStockSpam_06 2303 1.09 1.42 0.95 134 SCC_BODY_URI_ONLY 2229 2.51 1.37 3.02 135 XM_HighProb1 2189 0.42 1.35 0.00 136 KHOP_HELO_FCRDNS 2181 1.19 1.34 1.12 137 XMReplyNow 2158 0.61 1.33 0.29 138 HTTPS_HTTP_MISMATCH 2149 0.99 1.32 0.84 139 HK_RANDOM_REPLYTO 2096 0.46 1.29 0.10 140 XMPhish14 2082 0.83 1.28 0.62 141 T_XMDrugObfuBody_00 1980 0.82 1.22 0.64 142 XMBdyGiftCard01 1937 0.84 1.19 0.68 143 TR_XM_InvalidRelay 1893 0.37 1.17 0.02 144 FORGED_GMAIL_RCVD 1892 0.70 1.17 0.50 145 TooManyTo_002 1886 2.15 1.16 2.58 146 XMSexyCombo_01 1883 0.49 1.16 0.20 147 T_MONEY_PERCENT 1832 0.60 1.13 0.37 148 TR_LOTS_OF_MONEY2 1832 0.60 1.13 0.37 149 BAYES_20 1831 2.59 1.13 3.25 150 XMSubMetaI_00 1821 0.75 1.12 0.59 151 DIET_1 1812 0.56 1.12 0.31 152 XM_DIRTYINTL 1801 0.40 1.11 0.09 153 RCVD_IN_IADB_LISTED 1792 3.03 1.10 3.88 154 THIS_AD 1766 0.62 1.09 0.41 155 XMLngstWrd_00 1762 0.81 1.09 0.69 156 TR_Caps_n_Bayes_99 1760 0.35 1.08 0.03 157 TR_Mismatch_TLD_02 1755 0.40 1.08 0.10 158 TooManyTo_003 1750 1.33 1.08 1.44 159 RCVD_IN_VALIDITY_RPBL 1748 0.37 1.08 0.06 160 HTML_TAG_BALANCE_BODY 1742 0.70 1.07 0.54 161 XM_H_Undi_Recip 1721 0.44 1.06 0.17 162 TR_XM_Base64_M1 1684 0.77 1.04 0.66 163 XMHTML_After_End 1677 0.63 1.03 0.45 164 RELAYCOUNTRY_FR 1669 0.48 1.03 0.24 165 XMClaimOffer 1669 0.47 1.03 0.23 166 BOTNET_NORDNS 1663 0.32 1.02 0.01 167 XM_UB99 1661 0.32 1.02 0.00 168 TooManyTo_004 1651 1.04 1.02 1.05 169 XMBody_78 1651 0.54 1.02 0.32 170 TR_Symld_Words 1638 1.27 1.01 1.38 171 XM_B_COPY_HTML 1585 0.81 0.98 0.73 172 MPART_ALT_DIFF_COUNT 1579 0.77 0.97 0.69 173 TooManyTo_005 1562 0.88 0.96 0.84 174 RCVD_IN_IADB_SPF 1534 2.65 0.94 3.41 175 T_STY_INVIS_DIRECT 1529 0.47 0.94 0.26 176 PDS_OTHER_BAD_TLD 1500 0.37 0.92 0.12 177 XMMoneyMeta_00 1473 0.75 0.91 0.68 178 XM_H_PHPMailer 1461 0.73 0.90 0.66 179 TR_XM_DK_SendGrid 1453 0.89 0.89 0.88 180 LongTLD 1441 0.47 0.89 0.29 181 RCVD_IN_IADB_DK 1421 2.31 0.88 2.94 182 XM_Combo_Sbj 1417 0.44 0.87 0.25 183 XM_B_DNDMA 1416 0.46 0.87 0.28 184 RCVD_IN_IADB_SENDERID 1414 2.36 0.87 3.03 185 XM_B_Phish66 1379 0.44 0.85 0.26 186 BAYES_00 1377 6.41 0.85 8.87 187 AC_BR_BONANZA 1354 0.30 0.83 0.07 188 URI_TRUNCATED 1346 0.42 0.83 0.24 189 T_TooManySym_02 1342 2.39 0.83 3.08 190 HTML_TAG_BALANCE_HEAD 1336 0.39 0.82 0.20 191 TR_XM_Undi_Recip19 1330 0.30 0.82 0.07 192 XM_ShortIntro_01 1280 0.75 0.79 0.73 193 RDNS_DYNAMIC 1272 0.47 0.78 0.33 194 XMNoVowels 1256 1.36 0.77 1.61 195 XM_S_SpammyWords 1235 0.36 0.76 0.18 196 TR_XM_Spammywords 1235 0.36 0.76 0.18 197 TR_MetaPhish_Combo_01 1234 0.82 0.76 0.85 198 XM_B_SEO 1229 0.38 0.76 0.22 199 TR_Mismatch_TLD_01 1219 0.39 0.75 0.23 200 XM_UB60 1204 0.28 0.74 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 363422 99.26 99.26 99.26 2 HTML_MESSAGE 314775 89.21 96.52 85.98 3 RELAYCOUNTRY_US 299652 81.03 79.18 81.84 4 DKIM_SIGNED 278237 80.59 90.94 76.00 5 XM_DK_Pass 273125 78.45 87.14 74.60 6 DKIM_VALID 269561 77.39 85.88 73.63 7 XM_B_Unicode 257280 74.67 84.58 70.27 8 DCC_CHECK_NEGATIVE 239507 53.98 28.21 65.42 9 BAYES_50 219213 52.96 37.37 59.87 10 DKIM_VALID_AU 216480 60.54 63.72 59.13 11 XMListUnsubscribeExists 183234 57.02 72.74 50.05 12 XM_B_SpammyWords 164766 53.38 72.28 45.00 13 XM_B_Unicode3 146958 41.86 45.74 40.14 14 DCC_CHECK 126408 45.97 71.79 34.53 15 RCVD_IN_MSPIKE_H2 106120 29.52 30.73 28.98 16 T_TM2_M_HEADER_IN_MSG 105794 27.07 22.96 28.90 17 DKIM_VALID_EF 104829 29.48 31.40 28.63 18 HTML_FONT_LOW_CONTRAST 104146 30.60 35.46 28.45 19 FVGT_m_MULTI_ODD 95545 27.97 32.18 26.10 20 LOC_TINY_FONT_1 93532 29.86 39.60 25.55 21 XMSubLong 82520 22.99 23.99 22.54 22 T_KAM_HTML_FONT_INVALID 76445 23.16 28.31 20.88 23 XM_B_SpammyWords2 69330 26.42 43.29 18.94 24 MIME_HTML_ONLY 66807 22.24 31.23 18.25 25 ALL_TRUSTED 54607 11.02 2.25 14.91 26 XM_Multi_Part_URI 52648 15.92 19.40 14.38 27 TR_XM_DK_Unsub 49623 16.49 23.10 13.55 28 USER_IN_DEF_DKIM_WL 49368 10.10 2.46 13.48 29 UNPARSEABLE_RELAY 40570 11.83 13.51 11.08 30 BAYES_60 33916 8.74 7.55 9.26 31 BAYES_00 32483 6.41 0.85 8.87 32 TooManyTo_001 31016 7.53 5.39 8.47 33 LotsOfNums_01 30785 7.90 6.75 8.41 34 XM_B_Unsub 30473 10.42 15.16 8.32 35 XM_DKIMWhitelistDomains 29555 5.65 0.18 8.07 36 XM_Evil_Numbers_Gen 27683 7.98 8.93 7.56 37 TR_MAX_INTL_RELAY 26771 9.59 14.71 7.31 38 TR_XM_BayesUnsub 24998 9.22 14.61 6.83 39 IN_ZIMBRA_NJ_WHITELIST 24839 4.72 0.08 6.78 40 XM_H_GMP 23446 6.10 5.42 6.40 41 LOTS_OF_MONEY 23439 9.43 16.24 6.40 42 T_TooManySym_01 22842 5.16 2.72 6.24 43 RCVD_IN_MSPIKE_WL 22371 6.99 8.98 6.11 44 RCVD_IN_MSPIKE_H3 22370 6.99 8.98 6.11 45 TR_XM_DK_Bayes 21367 4.26 0.69 5.84 46 XM_DK_Undo_02 21138 17.85 45.08 5.77 47 TR_XM_DK_Bayes1 21048 4.19 0.69 5.75 48 XM_H_Long_From01 19679 5.35 5.28 5.37 49 MIME_QP_LONG_LINE 18676 4.47 3.06 5.10 50 RCVD_IN_VALIDITY_SAFE 18344 4.34 2.83 5.01 51 TR_XM_DK_Bayes2 18272 3.60 0.47 4.99 52 HTML_IMAGE_RATIO_02 17589 5.36 6.60 4.80 53 XM_B_SpammyWords3 16902 7.51 14.03 4.62 54 BAYES_80 16814 5.91 8.90 4.59 55 BAYES_40 16629 3.69 1.76 4.54 56 TR_XM_SpammyWords4 16377 7.61 14.68 4.47 57 RELAYCOUNTRY_META 16327 9.23 20.00 4.46 58 XMStrtUSub 16119 4.20 3.75 4.40 59 RCVD_IN_VALIDITY_CERTIFIED 15942 3.76 2.41 4.35 60 BAYES_99 15913 14.20 36.42 4.35 61 XM_PDF 15820 3.17 0.56 4.32 62 ANY_BOUNCE_MESSAGE 15230 3.40 1.69 4.16 63 BOUNCE_MESSAGE 15229 3.40 1.69 4.16 64 HTML_IMAGE_RATIO_04 15173 4.37 4.87 4.14 65 FSL_BULK_SIG 14713 5.06 7.40 4.02 66 BOTNET_IPINHOSTNAME 14689 7.07 13.96 4.01 67 RCVD_IN_IADB_LISTED 14212 3.03 1.10 3.88 68 XM_UncommonTLD01 13903 4.29 5.41 3.80 69 MAILING_LIST_MULTI 13209 3.02 1.71 3.61 70 MPART_ALT_DIFF 12928 4.26 5.90 3.53 71 T_REMOTE_IMAGE 12904 2.94 1.63 3.52 72 XM_B_Phish_Phrases 12890 3.80 4.43 3.52 73 XMSubMetaSx_00 12731 4.20 5.83 3.48 74 RCVD_IN_IADB_SPF 12476 2.65 0.94 3.41 75 XM_SPF_SoftFail 12031 3.88 5.22 3.29 76 BAYES_999 11889 11.04 28.61 3.25 77 BAYES_20 11883 2.59 1.13 3.25 78 HTML_IMAGE_RATIO_06 11390 3.44 4.19 3.11 79 T_TooManySym_02 11269 2.39 0.83 3.08 80 RCVD_IN_IADB_SENDERID 11082 2.36 0.87 3.03 81 SCC_BODY_URI_ONLY 11053 2.51 1.37 3.02 82 RCVD_IN_IADB_DK 10767 2.31 0.88 2.94 83 BAYES_95 9944 3.55 5.44 2.72 84 RCVD_IN_IADB_VOUCHED 9545 1.99 0.61 2.61 85 TooManyTo_002 9459 2.15 1.16 2.58 86 XMNumbers 9376 2.78 3.27 2.56 87 XM_Body_Dirty_Words 9366 3.88 6.86 2.56 88 BAYES_05 9328 1.95 0.59 2.55 89 HTML_IMAGE_RATIO_08 9176 2.92 3.86 2.51 90 XM_B_SpammyTLD 9043 2.68 3.14 2.47 91 TR_XM_DKIM_Undo 8894 12.35 34.71 2.43 92 DKIM_INVALID 8676 3.20 5.07 2.37 93 TR_XM_SpammyRelay 8294 6.48 15.99 2.27 94 MIME_HTML_ONLY_MULTI 7819 2.55 3.48 2.14 95 MIME_HTML_MOSTLY 7551 2.65 3.99 2.06 96 XM_CamelCaseFrm001 7475 2.22 2.61 2.04 97 INVALID_MSGID 7149 1.40 0.15 1.95 98 XM_DK_Undo_01 7089 1.83 1.59 1.94 99 HELO_NODOT 6949 1.40 0.29 1.90 100 HELO_NO_DOMAIN 6939 1.40 0.29 1.90 101 TR_XM_PhishingBody 6910 2.64 4.34 1.89 102 HTML_MIME_NO_HTML_TAG 6897 1.95 2.10 1.88 103 XM_B_Investor 6851 2.86 5.09 1.87 104 MSGID_NOFQDN1 6695 1.28 0.05 1.83 105 TR_XM_UnparsRelay 6684 3.63 7.71 1.83 106 TO_MALFORMED 6555 1.32 0.25 1.79 107 RCVD_IN_IADB_OPTIN 6472 1.35 0.42 1.77 108 TR_DCC_Bayes_99 6456 8.98 25.25 1.76 109 XMDiploma_00 6349 2.00 2.61 1.73 110 XM_B_Unsub2 6135 1.91 2.44 1.68 111 T_XMDrugObfuBody_14 6024 2.34 3.92 1.65 112 FROM_EXCESS_BASE64 5998 1.69 1.80 1.64 113 XMNoVowels 5908 1.36 0.77 1.61 114 TM2_M_URI_OPT_OUT 5575 2.50 4.71 1.52 115 IN_HORDE_ADDRESS_BOOK 5332 1.03 0.07 1.46 116 XMGappySubj_01 5292 1.04 0.14 1.45 117 TooManyTo_003 5267 1.33 1.08 1.44 118 T_XMDrugObfuBody_08 5235 1.95 3.11 1.43 119 TVD_RCVD_IP 5196 1.18 0.65 1.42 120 UNTRUSTED_Relay 5109 2.74 5.79 1.40 121 TR_Symld_Words 5048 1.27 1.01 1.38 122 SUBJ_ALL_CAPS 5024 1.73 2.52 1.37 123 XM_SendGrid 5015 1.39 1.43 1.37 124 XMSexyCombo_05 4997 2.16 3.95 1.36 125 URI_HEX 4874 1.42 1.63 1.33 126 RELAYCOUNTRY_CA 4863 4.25 10.84 1.33 127 BOTNET 4525 3.70 9.25 1.24 128 XMBSHREFv2 4508 0.98 0.42 1.23 129 TM2_M_VERY_LONG_WORD 4410 1.71 2.86 1.20 130 XM_GoogleGroups 4330 1.00 0.57 1.18 131 T_TooManySym_03 4327 0.91 0.29 1.18 132 XM_OfRef6 4315 1.83 3.30 1.18 133 TR_XM_SpammyWords5 4161 2.14 4.40 1.14 134 URI_NOVOWEL 4140 1.01 0.72 1.13 135 KHOP_HELO_FCRDNS 4086 1.19 1.34 1.12 136 XMCapTrack 4027 0.90 0.45 1.10 137 XM_H_Long_From02 3938 1.22 1.54 1.08 138 TooManyTo_004 3860 1.04 1.02 1.05 139 TVD_SPACE_RATIO 3790 0.75 0.11 1.04 140 XMGenDplmaNmb 3768 1.16 1.46 1.03 141 XMBody_95 3540 0.72 0.15 0.97 142 XMStockSpam_06 3478 1.09 1.42 0.95 143 T_FILL_THIS_FORM_SHORT 3394 1.75 3.62 0.93 144 TR_XM_DK_SendGrid 3231 0.89 0.89 0.88 145 SpammyFromTLD_01 3221 1.25 2.07 0.88 146 XM_H_Trusted_IP 3160 0.60 0.00 0.86 147 TR_MetaPhish_Combo_01 3101 0.82 0.76 0.85 148 DKIM_ADSP_CUSTOM_MED 3099 1.08 1.60 0.85 149 TooManyTo_005 3088 0.88 0.96 0.84 150 HTTPS_HTTP_MISMATCH 3072 0.99 1.32 0.84 151 XM_UB50 3003 1.40 2.72 0.82 152 XMGappySubj_02 2832 0.55 0.05 0.77 153 XM_B_SpammyWords4 2763 1.26 2.39 0.75 154 XMBody_17 2695 2.62 6.87 0.74 155 XM_B_COPY_HTML 2674 0.81 0.98 0.73 156 XM_ShortIntro_01 2669 0.75 0.79 0.73 157 XMLngstWrd_00 2535 0.81 1.09 0.69 158 MPART_ALT_DIFF_COUNT 2509 0.77 0.97 0.69 159 XMMoneyMeta_00 2503 0.75 0.91 0.68 160 FROM_GOV_DKIM_AU 2499 0.49 0.07 0.68 161 XMBdyGiftCard01 2492 0.84 1.19 0.68 162 RELAYCOUNTRY_AU 2476 1.21 2.41 0.68 163 XM_H_PHPMailer 2408 0.73 0.90 0.66 164 TR_XM_Base64_M1 2402 0.77 1.04 0.66 165 XM_ProductURIs 2400 0.65 0.63 0.66 166 SHORT_HELO_AND_INLINE_IMAGE 2354 0.46 0.06 0.64 167 T_XMDrugObfuBody_00 2337 0.82 1.22 0.64 168 RCVD_IN_BL_SPAMCOP_NET 2333 4.10 11.92 0.64 169 XMPhish14 2288 0.83 1.28 0.62 170 XMSubNoVowel 2274 0.57 0.44 0.62 171 TR_XM_SpammyWords2 2184 4.93 14.69 0.60 172 XMBrknScrpt_02 2158 0.92 1.66 0.59 173 XMSubMetaI_00 2157 0.75 1.12 0.59 174 T_Symld_Words_02 2101 0.60 0.66 0.57 175 URI_TRY_3LD 2084 0.95 1.81 0.57 176 FILL_THIS_FORM 2057 0.51 0.39 0.56 177 RELAYCOUNTRY_NL 2037 0.48 0.29 0.56 178 XMPhish30 2031 0.84 1.49 0.55 179 SpammyFromTLD_02 2014 0.85 1.51 0.55 180 XM_B_FormFill 2002 0.39 0.03 0.55 181 NML_ADSP_CUSTOM_MED 1977 0.82 1.46 0.54 182 USER_IN_WHITELIST 1976 0.37 0.00 0.54 183 USER_IN_WELCOMELIST 1976 0.37 0.00 0.54 184 HTML_TAG_BALANCE_BODY 1975 0.70 1.07 0.54 185 T_XMHurry_00 1931 0.84 1.54 0.53 186 T_OBFU_PDF_ATTACH 1845 0.38 0.11 0.50 187 FORGED_GMAIL_RCVD 1814 0.70 1.17 0.50 188 T_TooManySym_04 1809 0.39 0.15 0.49 189 HTML_FONT_FACE_BAD 1782 0.56 0.71 0.49 190 TR_LOTS_OF_MONEY3 1747 1.74 4.58 0.48 191 XMSlimDrugH 1744 0.55 0.73 0.48 192 XMGppyBdWords 1683 0.43 0.36 0.46 193 RELAYCOUNTRY_GB 1678 0.54 0.74 0.46 194 SHOPIFY_IMG_NOT_RCVD_SFY 1664 0.47 0.51 0.45 195 HTML_IMAGE_ONLY_28 1651 0.42 0.36 0.45 196 XMHTML_After_End 1637 0.63 1.03 0.45 197 XMDateMe_00 1626 0.39 0.26 0.44 198 XMHTMLBadTable_001 1625 0.53 0.72 0.44 199 XMSolicitRefs_0 1612 0.46 0.52 0.44 200 TM2_M_BODY_EMPTY 1546 0.32 0.07 0.42 ----------------------------------------------------------------------