Email: 513659 Autolearn: 0 AvgScore: 4.06 AvgScanTime: 1.26 sec Spam: 158976 Autolearn: 0 AvgScore: 13.32 AvgScanTime: 1.39 sec Ham: 354683 Autolearn: 0 AvgScore: -0.10 AvgScanTime: 1.20 sec Time Spent Running SA: 179.20 hours Time Spent Processing Spam: 61.19 hours Time Spent Processing Ham: 118.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 158604 99.50 99.77 99.38 2 HTML_MESSAGE 153384 88.78 96.48 85.33 3 DKIM_SIGNED 145730 80.65 91.67 75.71 4 XM_DK_Pass 140464 78.65 88.36 74.30 5 DKIM_VALID 138230 77.51 86.95 73.28 6 XM_B_Unicode 134826 74.38 84.81 69.70 7 RELAYCOUNTRY_US 127082 80.13 79.94 80.21 8 DCC_CHECK 117289 47.20 73.78 35.28 9 XM_B_SpammyWords 115284 53.38 72.52 44.80 10 XMListUnsubscribeExists 114927 57.80 72.29 51.31 11 DKIM_VALID_AU 103748 60.61 65.26 58.52 12 XM_B_Unicode3 73722 42.20 46.37 40.33 13 XM_DK_Undo_02 71057 18.28 44.70 6.44 14 XM_B_SpammyWords2 67136 26.30 42.23 19.16 15 LOC_TINY_FONT_1 67133 31.80 42.23 27.12 16 BAYES_50 61998 52.94 39.00 59.18 17 HTML_FONT_LOW_CONTRAST 57524 30.90 36.18 28.52 18 BAYES_99 54410 14.04 34.23 4.99 19 TR_XM_DKIM_Undo 53693 12.66 33.77 3.20 20 FVGT_m_MULTI_ODD 51836 27.90 32.61 25.80 21 DKIM_VALID_EF 51592 29.26 32.45 27.83 22 RCVD_IN_MSPIKE_H2 49621 29.80 31.21 29.17 23 MIME_HTML_ONLY 48407 22.44 30.45 18.86 24 T_KAM_HTML_FONT_INVALID 45153 23.59 28.40 21.43 25 BAYES_999 41991 10.84 26.41 3.86 26 DCC_CHECK_NEGATIVE 41671 52.76 26.21 64.67 27 TR_DCC_Bayes_99 38891 9.15 24.46 2.29 28 TR_XM_DK_Unsub 36277 16.25 22.82 13.30 29 XMSubLong 35669 22.16 22.44 22.04 30 T_TM2_M_HEADER_IN_MSG 34331 26.85 21.60 29.21 31 RELAYCOUNTRY_META 31854 9.18 20.04 4.32 32 XM_Multi_Part_URI 31044 15.42 19.53 13.58 33 LOTS_OF_MONEY 27234 10.01 17.13 6.81 34 XM_B_Unsub 25932 10.48 16.31 7.87 35 TR_XM_SpammyRelay 25062 6.56 15.76 2.44 36 TR_XM_BayesUnsub 24991 9.24 15.72 6.33 37 TR_MAX_INTL_RELAY 24087 9.35 15.15 6.75 38 TR_XM_SpammyWords4 23336 7.84 14.68 4.77 39 XM_B_SpammyWords3 22711 7.86 14.29 4.98 40 BOTNET_IPINHOSTNAME 22399 7.14 14.09 4.02 41 UNPARSEABLE_RELAY 21967 11.65 13.82 10.67 42 TR_XM_SpammyWords2 20703 4.53 13.02 0.73 43 RCVD_IN_BL_SPAMCOP_NET 18972 4.17 11.93 0.70 44 RELAYCOUNTRY_CA 16133 4.07 10.15 1.35 45 BOTNET 15652 3.88 9.85 1.21 46 TR_XM_SPAMCOP 15324 3.25 9.64 0.39 47 BAYES_80 14868 5.70 9.35 4.07 48 RCVD_IN_MSPIKE_WL 14402 7.31 9.06 6.53 49 RCVD_IN_MSPIKE_H3 14402 7.31 9.06 6.53 50 FSL_BULK_SIG 13752 5.74 8.65 4.44 51 XM_Evil_Numbers_Gen 13598 8.16 8.55 7.98 52 BAYES_60 12812 9.05 8.06 9.49 53 TR_XM_UnparsRelay 11124 3.43 7.00 1.84 54 HTML_IMAGE_RATIO_02 11104 5.92 6.98 5.44 55 LotsOfNums_01 11099 8.08 6.98 8.57 56 XM_Body_Dirty_Words 10800 3.90 6.79 2.61 57 UNTRUSTED_Relay 10585 3.16 6.66 1.60 58 XMSubMetaSx_00 10087 4.51 6.34 3.69 59 MPART_ALT_DIFF 9595 4.34 6.04 3.58 60 XM_UncommonTLD01 9224 4.40 5.80 3.77 61 XMBody_17 9065 2.16 5.70 0.58 62 BAYES_95 8568 3.51 5.39 2.66 63 TooManyTo_001 8441 7.38 5.31 8.31 64 XM_H_GMP 8377 5.91 5.27 6.19 65 XM_H_Long_From01 8010 5.47 5.04 5.67 66 XM_SPF_SoftFail 7915 3.77 4.98 3.23 67 XM_OfRef6 7770 2.45 4.89 1.36 68 XMSexyCombo_05 7750 2.69 4.87 1.71 69 XM_B_Phish_Phrases 7642 4.11 4.81 3.79 70 HTML_IMAGE_RATIO_04 7543 4.01 4.74 3.68 71 DKIM_INVALID 7500 3.14 4.72 2.44 72 XM_B_Investor 7290 2.59 4.59 1.70 73 TM2_M_URI_OPT_OUT 7160 2.39 4.50 1.45 74 HTML_IMAGE_RATIO_06 7112 3.28 4.47 2.74 75 TR_LOTS_OF_MONEY3 6519 1.62 4.10 0.51 76 MIME_HTML_MOSTLY 6395 2.74 4.02 2.17 77 T_FILL_THIS_FORM_SHORT 6055 1.83 3.81 0.94 78 XMStrtUSub 6029 4.28 3.79 4.50 79 XM_B_SpammyTLD 6017 3.09 3.78 2.77 80 TR_XM_PhishingBody 6010 2.41 3.78 1.79 81 XMDiploma_00 5754 2.49 3.62 1.98 82 T_XMDrugObfuBody_14 5700 2.60 3.59 2.16 83 MIME_HTML_ONLY_MULTI 5473 2.40 3.44 1.93 84 TR_XM_SpammyWords5 5436 1.97 3.42 1.32 85 XMNumbers 5411 2.93 3.40 2.71 86 XM_UB50 5040 1.64 3.17 0.96 87 TM2_M_VERY_LONG_WORD 4969 1.79 3.13 1.19 88 MIME_QP_LONG_LINE 4954 4.58 3.12 5.24 89 XM_CamelCaseFrm001 4801 3.41 3.02 3.59 90 T_XMDrugObfuBody_08 4786 1.95 3.01 1.48 91 RCVD_IN_VALIDITY_SAFE 4666 4.46 2.94 5.14 92 XM_B_SpammyWords4 4665 1.47 2.93 0.82 93 TR_XM_NoHeaderRelay 4528 0.96 2.85 0.12 94 HTML_IMAGE_RATIO_08 4501 2.68 2.83 2.61 95 T_TooManySym_01 4369 4.47 2.75 5.24 96 XM_URI_RBL 3965 0.88 2.49 0.15 97 RELAYCOUNTRY_AU 3896 1.22 2.45 0.68 98 TR_XM_BayesRelay 3874 0.75 2.44 0.00 99 RCVD_IN_VALIDITY_CERTIFIED 3842 3.87 2.42 4.53 100 SUBJ_ALL_CAPS 3753 1.79 2.36 1.53 101 XM_B_Unsub2 3715 1.62 2.34 1.30 102 TR_XM_FormFill 3566 0.71 2.24 0.02 103 SpammyFromTLD_01 3498 1.27 2.20 0.86 104 USER_IN_DEF_DKIM_WL 3390 10.34 2.13 14.02 105 HTML_MIME_NO_HTML_TAG 3151 2.08 1.98 2.12 106 XMGenDplmaNmb 2995 1.34 1.88 1.10 107 BOTNET_NORDNS 2895 0.57 1.82 0.01 108 XMStockSpam_06 2881 1.71 1.81 1.66 109 FROM_EXCESS_BASE64 2843 1.73 1.79 1.70 110 T_REMOTE_IMAGE 2826 3.03 1.78 3.59 111 T_XMHurry_00 2804 0.93 1.76 0.56 112 XM_H_Long_From02 2782 1.28 1.75 1.06 113 XMBrknScrpt_02 2762 1.13 1.74 0.86 114 URI_TRY_3LD 2719 0.98 1.71 0.65 115 XM_H_Undi_Recip 2697 0.67 1.70 0.21 116 TR_XM_INV_DKIM 2696 0.58 1.70 0.07 117 BOUNCE_MESSAGE 2664 3.33 1.68 4.08 118 ANY_BOUNCE_MESSAGE 2664 3.33 1.68 4.08 119 SpammyFromTLD_02 2565 0.76 1.61 0.38 120 XMPhish30 2502 1.01 1.57 0.76 121 BAYES_40 2453 3.58 1.54 4.50 122 URI_HEX 2443 1.32 1.54 1.23 123 XM_DK_Undo_01 2424 1.83 1.52 1.96 124 MAILING_LIST_MULTI 2393 2.44 1.51 2.85 125 TR_XM_PHPForged 2313 0.69 1.45 0.35 126 URI_NOVOWEL 2296 1.29 1.44 1.22 127 FONT_INVIS_LONG_LINE 2293 0.49 1.44 0.07 128 HK_RANDOM_REPLYTO 2283 0.52 1.44 0.11 129 TR_XM_Undi_Recip19 2282 0.49 1.44 0.07 130 TR_XM_PHPDW 2227 0.67 1.40 0.34 131 TR_XM_FormFill2 2204 0.67 1.39 0.35 132 XM_H_PHPOS 2190 0.66 1.38 0.34 133 XMReplyNow 2186 0.56 1.38 0.20 134 XM_SendGrid 2174 1.38 1.37 1.39 135 TR_XM_Undi_RecipCombo2 2135 0.42 1.34 0.01 136 KHOP_HELO_FCRDNS 2064 1.26 1.30 1.25 137 XM_DIRTYINTL 2059 0.47 1.30 0.11 138 RCVD_IN_IADB_LISTED 2044 3.39 1.29 4.33 139 XM_HighProb1 2025 0.40 1.27 0.00 140 TR_Mismatch_TLD_02 1982 0.43 1.25 0.07 141 T_XMDrugObfuBody_00 1975 1.19 1.24 1.16 142 ALL_TRUSTED 1938 11.68 1.22 16.37 143 UNDISC_MONEY 1895 0.37 1.19 0.00 144 AC_BR_BONANZA 1893 0.45 1.19 0.12 145 BAYES_20 1880 2.69 1.18 3.36 146 XMMoneyMeta_00 1857 0.78 1.17 0.61 147 THIS_AD 1813 0.62 1.14 0.39 148 RCVD_IN_IADB_SPF 1800 2.96 1.13 3.77 149 XMNoVowels 1779 0.76 1.12 0.60 150 MPART_ALT_DIFF_COUNT 1778 0.82 1.12 0.69 151 HTML_TAG_BALANCE_BODY 1776 0.75 1.12 0.59 152 LongTLD 1754 0.55 1.10 0.31 153 TR_XM_Undi_Recip5 1727 0.34 1.09 0.00 154 TR_LOTS_OF_MONEY2 1724 0.48 1.08 0.21 155 T_MONEY_PERCENT 1724 0.48 1.08 0.21 156 XM_OfRef7 1722 0.49 1.08 0.22 157 RCVD_IN_IADB_DK 1694 2.58 1.07 3.26 158 TR_XM_Undi_Recip2 1686 0.34 1.06 0.01 159 RCVD_IN_IADB_SENDERID 1676 2.64 1.05 3.35 160 HTTPS_HTTP_MISMATCH 1670 0.93 1.05 0.88 161 TR_XM_Undi_RecipCombo3 1662 0.32 1.05 0.00 162 DKIM_ADSP_CUSTOM_MED 1651 0.89 1.04 0.83 163 XMHTML_After_End 1646 0.81 1.04 0.71 164 XM_UB99 1629 0.33 1.02 0.02 165 XM_UB60 1626 0.36 1.02 0.06 166 TR_MetaPhish_Combo_01 1606 0.90 1.01 0.85 167 TR_XM_InvalidRelay 1606 0.33 1.01 0.03 168 URG_BIZ 1604 0.34 1.01 0.04 169 XMBdyGiftCard01 1603 0.74 1.01 0.61 170 T_Symld_Words_02 1582 0.68 1.00 0.54 171 SCC_BODY_URI_ONLY 1569 2.48 0.99 3.15 172 RELAYCOUNTRY_RU 1551 0.32 0.98 0.02 173 RCVD_IN_PSBL 1541 0.55 0.97 0.37 174 TooManyTo_002 1518 2.01 0.95 2.49 175 TR_XM_DK_SendGrid 1494 0.96 0.94 0.96 176 RDNS_DYNAMIC 1489 0.51 0.94 0.32 177 URIBL_DBL_SPAM 1475 0.29 0.93 0.01 178 PLING_QUERY 1472 0.58 0.93 0.43 179 NML_ADSP_CUSTOM_MED 1469 0.67 0.92 0.55 180 GOOG_STO_NOIMG_HTML 1458 0.28 0.92 0.00 181 MILLION_USD 1448 0.28 0.91 0.00 182 RELAYCOUNTRY_IN 1446 0.33 0.91 0.07 183 XM_ProductURIs 1433 0.64 0.90 0.52 184 TR_Caps_n_Bayes_99 1423 0.29 0.90 0.01 185 RCVD_IN_VALIDITY_RPBL 1421 0.30 0.89 0.03 186 XM_B_Phish66 1421 0.47 0.89 0.29 187 XMSexyCombo_01 1409 0.37 0.89 0.13 188 HOSTED_IMG_MULTI_PUB_01 1394 0.28 0.88 0.01 189 TR_XM_Spammywords 1375 0.44 0.86 0.25 190 XM_S_SpammyWords 1375 0.44 0.86 0.25 191 TR_Symld_Words 1374 1.25 0.86 1.42 192 TR_XM_Base64_M1 1342 0.75 0.84 0.70 193 DIET_1 1341 0.42 0.84 0.23 194 TVD_RCVD_IP 1325 1.18 0.83 1.34 195 TooManyTo_003 1324 1.20 0.83 1.37 196 TR_XM_Undi_Recip4 1317 0.26 0.83 0.00 197 TR_Sbj_FN_Bdy 1316 0.34 0.83 0.12 198 XM_B_COVIDMETA 1312 0.39 0.83 0.19 199 LOADSA_MONEY_COMBO 1298 0.28 0.82 0.03 200 XMSubMetaI_00 1296 0.55 0.82 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 352484 99.50 99.77 99.38 2 HTML_MESSAGE 302645 88.78 96.48 85.33 3 RELAYCOUNTRY_US 284497 80.13 79.94 80.21 4 DKIM_SIGNED 268539 80.65 91.67 75.71 5 XM_DK_Pass 263532 78.65 88.36 74.30 6 DKIM_VALID 259898 77.51 86.95 73.28 7 XM_B_Unicode 247222 74.38 84.81 69.70 8 DCC_CHECK_NEGATIVE 229356 52.76 26.21 64.67 9 BAYES_50 209917 52.94 39.00 59.18 10 DKIM_VALID_AU 207562 60.61 65.26 58.52 11 XMListUnsubscribeExists 181989 57.80 72.29 51.31 12 XM_B_SpammyWords 158889 53.38 72.52 44.80 13 XM_B_Unicode3 143029 42.20 46.37 40.33 14 DCC_CHECK 125146 47.20 73.78 35.28 15 T_TM2_M_HEADER_IN_MSG 103598 26.85 21.60 29.21 16 RCVD_IN_MSPIKE_H2 103446 29.80 31.21 29.17 17 HTML_FONT_LOW_CONTRAST 101171 30.90 36.18 28.52 18 DKIM_VALID_EF 98702 29.26 32.45 27.83 19 LOC_TINY_FONT_1 96206 31.80 42.23 27.12 20 FVGT_m_MULTI_ODD 91497 27.90 32.61 25.80 21 XMSubLong 78182 22.16 22.44 22.04 22 T_KAM_HTML_FONT_INVALID 76014 23.59 28.40 21.43 23 XM_B_SpammyWords2 67955 26.30 42.23 19.16 24 MIME_HTML_ONLY 66878 22.44 30.45 18.86 25 ALL_TRUSTED 58049 11.68 1.22 16.37 26 USER_IN_DEF_DKIM_WL 49743 10.34 2.13 14.02 27 XM_Multi_Part_URI 48160 15.42 19.53 13.58 28 TR_XM_DK_Unsub 47174 16.25 22.82 13.30 29 UNPARSEABLE_RELAY 37850 11.65 13.82 10.67 30 BAYES_60 33673 9.05 8.06 9.49 31 BAYES_00 32174 6.48 0.70 9.07 32 LotsOfNums_01 30403 8.08 6.98 8.57 33 TooManyTo_001 29468 7.38 5.31 8.31 34 XM_Evil_Numbers_Gen 28306 8.16 8.55 7.98 35 XM_B_Unsub 27924 10.48 16.31 7.87 36 XM_DKIMWhitelistDomains 27292 5.37 0.17 7.69 37 LOTS_OF_MONEY 24158 10.01 17.13 6.81 38 IN_ZIMBRA_NJ_WHITELIST 24070 4.72 0.11 6.79 39 TR_MAX_INTL_RELAY 23940 9.35 15.15 6.75 40 RCVD_IN_MSPIKE_WL 23157 7.31 9.06 6.53 41 RCVD_IN_MSPIKE_H3 23157 7.31 9.06 6.53 42 XM_DK_Undo_02 22851 18.28 44.70 6.44 43 TR_XM_DK_Bayes 22813 4.61 0.53 6.43 44 TR_XM_BayesUnsub 22460 9.24 15.72 6.33 45 TR_XM_DK_Bayes1 22333 4.51 0.53 6.30 46 XM_H_GMP 21970 5.91 5.27 6.19 47 XM_H_Long_From01 20111 5.47 5.04 5.67 48 TR_XM_DK_Bayes2 19423 3.92 0.44 5.48 49 HTML_IMAGE_RATIO_02 19288 5.92 6.98 5.44 50 T_TooManySym_01 18590 4.47 2.75 5.24 51 MIME_QP_LONG_LINE 18588 4.58 3.12 5.24 52 RCVD_IN_VALIDITY_SAFE 18229 4.46 2.94 5.14 53 BAYES_99 17686 14.04 34.23 4.99 54 XM_B_SpammyWords3 17651 7.86 14.29 4.98 55 TR_XM_SpammyWords4 16916 7.84 14.68 4.77 56 RCVD_IN_VALIDITY_CERTIFIED 16051 3.87 2.42 4.53 57 XMStrtUSub 15957 4.28 3.79 4.50 58 BAYES_40 15955 3.58 1.54 4.50 59 FSL_BULK_SIG 15742 5.74 8.65 4.44 60 XM_PDF 15736 3.25 0.62 4.44 61 RCVD_IN_IADB_LISTED 15357 3.39 1.29 4.33 62 RELAYCOUNTRY_META 15307 9.18 20.04 4.32 63 BOUNCE_MESSAGE 14455 3.33 1.68 4.08 64 ANY_BOUNCE_MESSAGE 14455 3.33 1.68 4.08 65 BAYES_80 14427 5.70 9.35 4.07 66 BOTNET_IPINHOSTNAME 14271 7.14 14.09 4.02 67 BAYES_999 13680 10.84 26.41 3.86 68 XM_B_Phish_Phrases 13456 4.11 4.81 3.79 69 RCVD_IN_IADB_SPF 13388 2.96 1.13 3.77 70 XM_UncommonTLD01 13369 4.40 5.80 3.77 71 XMSubMetaSx_00 13084 4.51 6.34 3.69 72 HTML_IMAGE_RATIO_04 13044 4.01 4.74 3.68 73 XM_CamelCaseFrm001 12732 3.41 3.02 3.59 74 T_REMOTE_IMAGE 12718 3.03 1.78 3.59 75 MPART_ALT_DIFF 12696 4.34 6.04 3.58 76 BAYES_20 11921 2.69 1.18 3.36 77 RCVD_IN_IADB_SENDERID 11885 2.64 1.05 3.35 78 RCVD_IN_IADB_DK 11557 2.58 1.07 3.26 79 XM_SPF_SoftFail 11442 3.77 4.98 3.23 80 TR_XM_DKIM_Undo 11346 12.66 33.77 3.20 81 SCC_BODY_URI_ONLY 11168 2.48 0.99 3.15 82 RCVD_IN_IADB_VOUCHED 10607 2.25 0.59 2.99 83 MAILING_LIST_MULTI 10120 2.44 1.51 2.85 84 XM_B_SpammyTLD 9838 3.09 3.78 2.77 85 HTML_IMAGE_RATIO_06 9715 3.28 4.47 2.74 86 XMNumbers 9623 2.93 3.40 2.71 87 BAYES_05 9493 2.02 0.55 2.68 88 BAYES_95 9436 3.51 5.39 2.66 89 HTML_IMAGE_RATIO_08 9248 2.68 2.83 2.61 90 XM_Body_Dirty_Words 9246 3.90 6.79 2.61 91 T_TooManySym_02 8825 1.94 0.71 2.49 92 TooManyTo_002 8819 2.01 0.95 2.49 93 DKIM_INVALID 8641 3.14 4.72 2.44 94 TR_XM_SpammyRelay 8637 6.56 15.76 2.44 95 TR_DCC_Bayes_99 8123 9.15 24.46 2.29 96 MIME_HTML_MOSTLY 7702 2.74 4.02 2.17 97 T_XMDrugObfuBody_14 7650 2.60 3.59 2.16 98 HTML_MIME_NO_HTML_TAG 7510 2.08 1.98 2.12 99 INVALID_MSGID 7356 1.47 0.13 2.07 100 RCVD_IN_IADB_OPTIN 7228 1.52 0.35 2.04 101 XMDiploma_00 7014 2.49 3.62 1.98 102 XM_DK_Undo_01 6958 1.83 1.52 1.96 103 MIME_HTML_ONLY_MULTI 6847 2.40 3.44 1.93 104 TO_MALFORMED 6574 1.29 0.02 1.85 105 TR_XM_UnparsRelay 6514 3.43 7.00 1.84 106 TR_XM_PhishingBody 6353 2.41 3.78 1.79 107 HELO_NODOT 6203 1.32 0.35 1.75 108 HELO_NO_DOMAIN 6197 1.31 0.34 1.75 109 XMSexyCombo_05 6081 2.69 4.87 1.71 110 FROM_EXCESS_BASE64 6033 1.73 1.79 1.70 111 XM_B_Investor 6028 2.59 4.59 1.70 112 XMStockSpam_06 5882 1.71 1.81 1.66 113 UNTRUSTED_Relay 5661 3.16 6.66 1.60 114 SUBJ_ALL_CAPS 5416 1.79 2.36 1.53 115 T_XMDrugObfuBody_08 5251 1.95 3.01 1.48 116 IN_HORDE_ADDRESS_BOOK 5133 1.02 0.07 1.45 117 TM2_M_URI_OPT_OUT 5126 2.39 4.50 1.45 118 TR_Symld_Words 5044 1.25 0.86 1.42 119 XM_SendGrid 4920 1.38 1.37 1.39 120 TooManyTo_003 4863 1.20 0.83 1.37 121 XM_OfRef6 4817 2.45 4.89 1.36 122 RELAYCOUNTRY_CA 4779 4.07 10.15 1.35 123 TVD_RCVD_IP 4750 1.18 0.83 1.34 124 TR_XM_SpammyWords5 4690 1.97 3.42 1.32 125 XM_B_Unsub2 4623 1.62 2.34 1.30 126 KHOP_HELO_FCRDNS 4420 1.26 1.30 1.25 127 URI_HEX 4354 1.32 1.54 1.23 128 URI_NOVOWEL 4329 1.29 1.44 1.22 129 BOTNET 4289 3.88 9.85 1.21 130 TM2_M_VERY_LONG_WORD 4221 1.79 3.13 1.19 131 XM_GoogleGroups 4217 0.98 0.53 1.19 132 T_XMDrugObfuBody_00 4114 1.19 1.24 1.16 133 XMBSHREFv2 4019 0.88 0.32 1.13 134 XMCapTrack 3944 0.90 0.42 1.11 135 XMGappySubj_01 3911 0.82 0.17 1.10 136 XMGenDplmaNmb 3889 1.34 1.88 1.10 137 XM_H_Long_From02 3770 1.28 1.75 1.06 138 TVD_SPACE_RATIO 3758 0.78 0.14 1.06 139 TooManyTo_004 3517 0.92 0.77 0.99 140 TR_XM_DK_SendGrid 3414 0.96 0.94 0.96 141 XM_UB50 3408 1.64 3.17 0.96 142 T_FILL_THIS_FORM_SHORT 3350 1.83 3.81 0.94 143 T_TooManySym_03 3298 0.73 0.28 0.93 144 HTTPS_HTTP_MISMATCH 3111 0.93 1.05 0.88 145 SpammyFromTLD_01 3039 1.27 2.20 0.86 146 XMBrknScrpt_02 3039 1.13 1.74 0.86 147 XMBody_95 3029 0.63 0.12 0.85 148 TR_MetaPhish_Combo_01 3015 0.90 1.01 0.85 149 DKIM_ADSP_CUSTOM_MED 2943 0.89 1.04 0.83 150 XM_B_SpammyWords4 2908 1.47 2.93 0.82 151 MSGID_NOFQDN1 2833 0.56 0.01 0.80 152 XMSubMetaSxObfu_03 2824 0.80 0.81 0.80 153 TooManyTo_005 2810 0.77 0.73 0.79 154 XMPhish30 2699 1.01 1.57 0.76 155 TR_XM_SpammyWords2 2589 4.53 13.02 0.73 156 XMHTML_After_End 2511 0.81 1.04 0.71 157 TR_XM_Base64_M1 2494 0.75 0.84 0.70 158 RCVD_IN_BL_SPAMCOP_NET 2472 4.17 11.93 0.70 159 MPART_ALT_DIFF_COUNT 2443 0.82 1.12 0.69 160 XM_ShortIntro_01 2403 0.61 0.47 0.68 161 RELAYCOUNTRY_AU 2395 1.22 2.45 0.68 162 XM_B_COPY_HTML 2333 0.70 0.80 0.66 163 T_OBFU_PDF_ATTACH 2323 0.49 0.11 0.65 164 URI_TRY_3LD 2308 0.98 1.71 0.65 165 FROM_GOV_DKIM_AU 2181 0.49 0.21 0.61 166 XMBdyGiftCard01 2178 0.74 1.01 0.61 167 XMMoneyMeta_00 2163 0.78 1.17 0.61 168 XMNoVowels 2119 0.76 1.12 0.60 169 HTML_TAG_BALANCE_BODY 2100 0.75 1.12 0.59 170 XMGappySubj_02 2061 0.42 0.05 0.58 171 XMBody_17 2053 2.16 5.70 0.58 172 XM_H_PHPMailer 2030 0.60 0.68 0.57 173 T_XMHurry_00 1982 0.93 1.76 0.56 174 NML_ADSP_CUSTOM_MED 1968 0.67 0.92 0.55 175 SHORT_HELO_AND_INLINE_IMAGE 1967 0.40 0.05 0.55 176 T_Symld_Words_02 1909 0.68 1.00 0.54 177 SUBJ_DOLLARS 1902 0.60 0.75 0.54 178 FILL_THIS_FORM 1865 0.58 0.70 0.53 179 XM_ProductURIs 1838 0.64 0.90 0.52 180 TR_LOTS_OF_MONEY3 1817 1.62 4.10 0.51 181 FORGED_GMAIL_RCVD 1794 0.59 0.79 0.51 182 USER_IN_WHITELIST 1772 0.34 0.00 0.50 183 USER_IN_WELCOMELIST 1772 0.34 0.00 0.50 184 XM_B_FormFill 1756 0.35 0.04 0.50 185 XMLngstWrd_00 1751 0.55 0.67 0.49 186 TM2_M_BODY_EMPTY 1679 0.35 0.09 0.47 187 HTML_IMAGE_ONLY_28 1651 0.45 0.42 0.47 188 SHOPIFY_IMG_NOT_RCVD_SFY 1610 0.49 0.56 0.45 189 RELAYCOUNTRY_GB 1552 0.55 0.81 0.44 190 XM_B_DNDMA 1531 0.52 0.73 0.43 191 PLING_QUERY 1520 0.58 0.93 0.43 192 XMSubMetaI_00 1510 0.55 0.82 0.43 193 HTML_IMAGE_ONLY_20 1506 0.43 0.45 0.42 194 TO_NO_BRKTS_HTML_ONLY 1481 0.38 0.28 0.42 195 XMSlimDrugH 1427 0.49 0.70 0.40 196 HTML_IMAGE_ONLY_32 1425 0.45 0.55 0.40 197 THIS_AD 1391 0.62 1.14 0.39 198 TR_XM_SPAMCOP 1389 3.25 9.64 0.39 199 XMOemUri 1368 0.31 0.13 0.39 200 SpammyFromTLD_02 1361 0.76 1.61 0.38 ----------------------------------------------------------------------