Email: 291328 Autolearn: 0 AvgScore: 4.70 AvgScanTime: 1.14 sec Spam: 103158 Autolearn: 0 AvgScore: 13.94 AvgScanTime: 1.18 sec Ham: 188170 Autolearn: 0 AvgScore: -0.37 AvgScanTime: 1.12 sec Time Spent Running SA: 92.08 hours Time Spent Processing Spam: 33.78 hours Time Spent Processing Ham: 58.30 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 102835 99.71 99.69 99.72 2 HTML_MESSAGE 99005 84.98 95.97 78.95 3 DKIM_SIGNED 93958 80.69 91.08 75.00 4 XM_DK_Pass 90555 78.88 87.78 74.00 5 DKIM_VALID 89159 78.09 86.43 73.52 6 XM_B_Unicode 88810 75.33 86.09 69.43 7 XMListUnsubscribeExists 78346 62.63 75.95 55.32 8 RELAYCOUNTRY_US 77112 75.68 74.75 76.20 9 XM_B_SpammyWords 76805 54.99 74.45 44.32 10 DCC_CHECK 74800 51.07 72.51 39.32 11 DKIM_VALID_AU 66069 63.53 64.05 63.25 12 XM_DK_Undo_02 51329 21.63 49.76 6.22 13 XM_B_Unicode3 47624 44.77 46.17 44.00 14 XM_B_SpammyWords2 44201 28.34 42.85 20.38 15 BAYES_99 41804 19.71 40.52 8.31 16 TR_XM_DKIM_Undo 40556 15.65 39.31 2.68 17 LOC_TINY_FONT_1 40109 33.63 38.88 30.75 18 HTML_FONT_LOW_CONTRAST 35339 34.06 34.26 33.96 19 RCVD_IN_MSPIKE_H2 34283 31.13 33.23 29.98 20 FVGT_m_MULTI_ODD 33840 29.51 32.80 27.70 21 BAYES_50 33540 48.52 32.51 57.29 22 BAYES_999 33147 15.79 32.13 6.84 23 DKIM_VALID_EF 32375 29.36 31.38 28.25 24 MIME_HTML_ONLY 32309 23.41 31.32 19.08 25 TR_DCC_Bayes_99 29672 11.52 28.76 2.07 26 T_KAM_HTML_FONT_INVALID 28500 22.51 27.63 19.70 27 DCC_CHECK_NEGATIVE 28347 48.91 27.48 60.66 28 TR_XM_DK_Unsub 25446 18.81 24.67 15.59 29 RELAYCOUNTRY_META 25109 11.37 24.34 4.26 30 T_TM2_M_HEADER_IN_MSG 22404 22.83 21.72 23.45 31 XMSubLong 21153 21.57 20.51 22.16 32 TR_XM_SpammyRelay 20303 8.63 19.68 2.57 33 XM_Multi_Part_URI 18265 16.05 17.71 15.14 34 TR_XM_SpammyWords2 17137 6.29 16.61 0.63 35 RCVD_IN_BL_SPAMCOP_NET 16793 6.16 16.28 0.62 36 TR_MAX_INTL_RELAY 16655 10.75 16.15 7.80 37 RELAYCOUNTRY_CA 16009 6.82 15.52 2.04 38 TR_XM_SPAMCOP 15479 5.60 15.01 0.44 39 UNPARSEABLE_RELAY 14700 12.44 14.25 11.45 40 XM_B_SpammyWords3 14198 8.15 13.76 5.08 41 XM_B_Unsub 13819 9.93 13.40 8.03 42 BOTNET_IPINHOSTNAME 13582 8.05 13.17 5.24 43 TR_XM_BayesUnsub 13147 9.00 12.74 6.95 44 LOTS_OF_MONEY 12592 7.93 12.21 5.59 45 RCVD_IN_MSPIKE_H3 12432 8.07 12.05 5.89 46 RCVD_IN_MSPIKE_WL 12432 8.07 12.05 5.89 47 TR_XM_SpammyWords4 11640 6.70 11.28 4.19 48 BAYES_80 10094 6.49 9.78 4.68 49 XMBody_17 9795 3.97 9.50 0.94 50 BAYES_60 8617 10.14 8.35 11.11 51 TR_XM_UnparsRelay 8536 4.17 8.27 1.91 52 BOTNET 8320 3.46 8.07 0.94 53 XM_UncommonTLD01 7333 5.49 7.11 4.60 54 HTML_IMAGE_RATIO_02 6902 5.86 6.69 5.40 55 FSL_BULK_SIG 6755 5.01 6.55 4.17 56 XM_Evil_Numbers_Gen 6620 7.84 6.42 8.62 57 XM_OfRef6 6355 2.81 6.16 0.97 58 T_FILL_THIS_FORM_SHORT 6342 2.60 6.15 0.65 59 XM_Body_Dirty_Words 6333 4.05 6.14 2.90 60 UNTRUSTED_Relay 6271 3.34 6.08 1.84 61 MPART_ALT_DIFF 6131 4.39 5.94 3.53 62 BAYES_95 6113 4.11 5.93 3.11 63 TR_XM_SpammyWords5 5890 2.99 5.71 1.50 64 TooManyTo_001 5463 5.93 5.30 6.29 65 XMSubMetaSx_00 5445 4.33 5.28 3.81 66 XM_H_GMP 5252 6.76 5.09 7.67 67 LotsOfNums_01 5007 6.36 4.85 7.18 68 TM2_M_URI_OPT_OUT 4957 3.47 4.81 2.73 69 HTML_IMAGE_RATIO_06 4856 3.98 4.71 3.58 70 TR_XM_BayesRelay 4804 1.65 4.66 0.00 71 DKIM_INVALID 4799 2.61 4.65 1.48 72 XM_SPF_SoftFail 4660 3.16 4.52 2.42 73 SUBJ_ALL_CAPS 4625 2.42 4.48 1.30 74 FONT_INVIS_LONG_LINE 4605 1.61 4.46 0.04 75 RCVD_IN_VALIDITY_SAFE 4320 7.17 4.19 8.80 76 HTML_IMAGE_RATIO_04 4102 4.65 3.98 5.01 77 XMSexyCombo_05 4025 2.39 3.90 1.56 78 TR_XM_FormFill 3909 1.37 3.79 0.05 79 XMNumbers 3812 3.66 3.70 3.65 80 XM_B_Investor 3728 2.10 3.61 1.27 81 T_XMDrugObfuBody_14 3706 2.44 3.59 1.81 82 XM_B_SEO 3656 1.90 3.54 1.00 83 XM_H_Long_From01 3638 4.40 3.53 4.87 84 RCVD_IN_VALIDITY_CERTIFIED 3628 6.22 3.52 7.70 85 XM_B_Phish_Phrases 3610 3.19 3.50 3.03 86 XMStrtUSub 3538 4.70 3.43 5.39 87 MIME_HTML_MOSTLY 3533 2.84 3.42 2.51 88 HTML_IMAGE_RATIO_08 3470 2.53 3.36 2.08 89 TR_LOTS_OF_MONEY3 3441 1.56 3.34 0.59 90 T_XMDrugObfuBody_08 3417 2.03 3.31 1.33 91 SpammyFromTLD_01 3344 1.41 3.24 0.41 92 T_TooManySym_01 3267 5.33 3.17 6.52 93 TR_XM_SEO4 3234 1.46 3.13 0.54 94 TR_XM_PhishingBody 3201 2.62 3.10 2.35 95 XM_CamelCaseFrm001 3155 3.95 3.06 4.45 96 MIME_HTML_ONLY_MULTI 3060 2.24 2.97 1.84 97 HOSTED_IMG_MULTI_PUB_01 3010 1.04 2.92 0.02 98 USER_IN_DEF_DKIM_WL 2996 12.87 2.90 18.33 99 XM_B_SpammyTLD 2893 2.61 2.80 2.50 100 TM2_M_VERY_LONG_WORD 2878 1.84 2.79 1.33 101 XM_URI_RBL 2842 1.08 2.75 0.16 102 XM_UB50 2837 1.60 2.75 0.97 103 RCVD_IN_VALIDITY_RPBL 2641 1.02 2.56 0.18 104 TR_XM_NoHeaderRelay 2431 0.89 2.36 0.09 105 XMStockSpam_06 2388 1.83 2.31 1.57 106 T_XMHurry_00 2305 1.26 2.23 0.72 107 TR_Caps_n_Bayes_99 2287 0.80 2.22 0.02 108 MIME_QP_LONG_LINE 2243 3.17 2.17 3.72 109 ALL_TRUSTED 2201 13.42 2.13 19.61 110 RELAYCOUNTRY_AU 2192 1.03 2.12 0.43 111 TR_XM_INV_DKIM 2125 0.78 2.06 0.08 112 HK_RANDOM_REPLYTO 2113 0.80 2.05 0.11 113 TR_XM_PHPForged 2057 0.88 1.99 0.27 114 XMBrknScrpt_02 2048 1.44 1.99 1.14 115 XM_B_Unsub2 2021 1.38 1.96 1.06 116 TR_XM_PHPDW 2017 0.87 1.96 0.28 117 SpammyFromTLD_02 1985 0.80 1.92 0.18 118 TR_Mismatch_TLD_02 1982 0.71 1.92 0.05 119 TR_XM_FormFill2 1974 0.86 1.91 0.28 120 XM_H_PHPOS 1953 0.83 1.89 0.25 121 XM_B_SpammyWords4 1951 1.05 1.89 0.59 122 AC_BR_BONANZA 1895 0.74 1.84 0.13 123 XM_HighProb1 1809 0.62 1.75 0.00 124 URI_TRY_3LD 1802 1.12 1.75 0.77 125 THIS_AD 1738 0.91 1.68 0.49 126 XMDiploma_00 1726 1.58 1.67 1.52 127 FROM_EXCESS_BASE64 1677 2.04 1.63 2.27 128 XMReplyNow 1641 0.71 1.59 0.23 129 HTML_TAG_BALANCE_BODY 1611 1.16 1.56 0.95 130 HTML_MIME_NO_HTML_TAG 1607 1.46 1.56 1.40 131 DKIM_ADSP_NXDOMAIN 1513 0.79 1.47 0.42 132 BOUNCE_MESSAGE 1466 4.18 1.42 5.69 133 ANY_BOUNCE_MESSAGE 1466 4.18 1.42 5.69 134 KHOP_HELO_FCRDNS 1452 0.92 1.41 0.65 135 T_REMOTE_IMAGE 1451 2.41 1.41 2.96 136 TR_Symld_Words 1433 1.27 1.39 1.21 137 URI_HEX 1425 1.11 1.38 0.97 138 LongTLD 1387 0.62 1.34 0.23 139 BAYES_40 1305 2.95 1.27 3.87 140 XM_SendGrid 1286 1.21 1.25 1.19 141 XMPhish30 1266 1.18 1.23 1.16 142 XM_DIRTYINTL 1265 0.50 1.23 0.10 143 T_STY_INVIS_DIRECT 1228 0.73 1.19 0.47 144 XMBdyGiftCard01 1226 1.29 1.19 1.35 145 XM_H_Long_From02 1198 1.02 1.16 0.94 146 AC_HTML_NONSENSE_TAGS 1197 0.42 1.16 0.01 147 DKIM_ADSP_CUSTOM_MED 1187 1.03 1.15 0.96 148 TR_XM_InvalidRelay 1169 0.42 1.13 0.02 149 MAILING_LIST_MULTI 1164 1.63 1.13 1.91 150 XM_UB99 1150 0.40 1.11 0.00 151 XMSubMetaI_00 1143 1.04 1.11 1.01 152 XM_B_COPY_HTML 1117 1.27 1.08 1.37 153 NML_ADSP_CUSTOM_MED 1110 0.82 1.08 0.67 154 TR_MetaPhish_Combo_01 1110 0.97 1.08 0.91 155 FROM_SUSPICIOUS_NTLD 1057 0.39 1.02 0.04 156 PLING_QUERY 1051 0.81 1.02 0.69 157 MPART_ALT_DIFF_COUNT 1049 0.89 1.02 0.82 158 T_MONEY_PERCENT 1038 0.60 1.01 0.38 159 TR_LOTS_OF_MONEY2 1038 0.60 1.01 0.38 160 RDNS_DYNAMIC 1036 0.59 1.00 0.36 161 SHOPIFY_IMG_NOT_RCVD_SFY 1035 0.86 1.00 0.78 162 TooManyTo_002 1032 1.35 1.00 1.54 163 TR_Mismatch_TLD_01 1019 0.53 0.99 0.28 164 XMSlimDrugH 995 0.52 0.96 0.27 165 FROM_SUSPICIOUS_NTLD_FP 995 0.37 0.96 0.04 166 HTTPS_HTTP_MISMATCH 987 0.62 0.96 0.43 167 XM_DK_Undo_01 982 1.28 0.95 1.46 168 XM_H_PHPMailer 982 0.87 0.95 0.82 169 SCC_BODY_URI_ONLY 967 3.15 0.94 4.37 170 TooManyTo_003 964 0.87 0.93 0.83 171 TR_XM_DK_SendGrid 961 0.90 0.93 0.89 172 FORGED_GMAIL_RCVD 948 0.73 0.92 0.63 173 T_XMDrugObfuBody_00 939 0.62 0.91 0.46 174 TVD_RCVD_IP 939 1.92 0.91 2.47 175 XM_UB60 938 0.38 0.91 0.09 176 TooManyTo_004 933 0.74 0.90 0.65 177 BAYES_20 926 2.02 0.90 2.64 178 XM_Combo_Sbj 922 0.40 0.89 0.13 179 TooManyTo_005 912 0.68 0.88 0.57 180 XM_OfRef7 908 0.37 0.88 0.09 181 DIET_1 908 0.54 0.88 0.35 182 URI_TRUNCATED 885 0.33 0.86 0.04 183 XM_B_DNDMA 859 0.73 0.83 0.68 184 HELO_DYNAMIC_SPLIT_IP 857 0.30 0.83 0.01 185 HTML_FONT_FACE_BAD 847 0.57 0.82 0.44 186 XMSexyCombo_01 833 0.37 0.81 0.13 187 TM2_M_OBFU_COMMENT 829 0.46 0.80 0.28 188 XM_UB999 825 0.28 0.80 0.00 189 HTML_OBFUSCATE_05_10 806 0.36 0.78 0.13 190 BOTNET_NORDNS 804 0.28 0.78 0.01 191 XM_ProductURIs 803 0.69 0.78 0.65 192 XM_UB80 801 0.29 0.78 0.03 193 RCVD_IN_PSBL 801 0.58 0.78 0.47 194 XMBody_29 791 0.35 0.77 0.13 195 URIBL_DBL_SPAM 788 0.28 0.76 0.01 196 T_TooManySym_02 781 2.65 0.76 3.68 197 XMNoVowels 768 0.57 0.74 0.48 198 XMHTMLBadTable_001 765 0.39 0.74 0.20 199 XM_B_Phish66 763 0.41 0.74 0.23 200 XM_H_Undi_Recip 763 0.34 0.74 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 187652 99.71 99.69 99.72 2 HTML_MESSAGE 148552 84.98 95.97 78.95 3 RELAYCOUNTRY_US 143379 75.68 74.75 76.20 4 DKIM_SIGNED 141129 80.69 91.08 75.00 5 XM_DK_Pass 139250 78.88 87.78 74.00 6 DKIM_VALID 138338 78.09 86.43 73.52 7 XM_B_Unicode 130652 75.33 86.09 69.43 8 DKIM_VALID_AU 119010 63.53 64.05 63.25 9 DCC_CHECK_NEGATIVE 114137 48.91 27.48 60.66 10 BAYES_50 107808 48.52 32.51 57.29 11 XMListUnsubscribeExists 104105 62.63 75.95 55.32 12 XM_B_SpammyWords 83393 54.99 74.45 44.32 13 XM_B_Unicode3 82803 44.77 46.17 44.00 14 DCC_CHECK 73988 51.07 72.51 39.32 15 HTML_FONT_LOW_CONTRAST 63898 34.06 34.26 33.96 16 LOC_TINY_FONT_1 57860 33.63 38.88 30.75 17 RCVD_IN_MSPIKE_H2 56406 31.13 33.23 29.98 18 DKIM_VALID_EF 53156 29.36 31.38 28.25 19 FVGT_m_MULTI_ODD 52118 29.51 32.80 27.70 20 T_TM2_M_HEADER_IN_MSG 44117 22.83 21.72 23.45 21 XMSubLong 41698 21.57 20.51 22.16 22 XM_B_SpammyWords2 38357 28.34 42.85 20.38 23 T_KAM_HTML_FONT_INVALID 37070 22.51 27.63 19.70 24 ALL_TRUSTED 36909 13.42 2.13 19.61 25 MIME_HTML_ONLY 35895 23.41 31.32 19.08 26 USER_IN_DEF_DKIM_WL 34494 12.87 2.90 18.33 27 TR_XM_DK_Unsub 29339 18.81 24.67 15.59 28 XM_Multi_Part_URI 28487 16.05 17.71 15.14 29 UNPARSEABLE_RELAY 21551 12.44 14.25 11.45 30 BAYES_60 20910 10.14 8.35 11.11 31 XM_DKIMWhitelistDomains 20261 6.97 0.05 10.77 32 RCVD_IN_VALIDITY_SAFE 16557 7.17 4.19 8.80 33 XM_Evil_Numbers_Gen 16228 7.84 6.42 8.62 34 BAYES_99 15628 19.71 40.52 8.31 35 XM_B_Unsub 15119 9.93 13.40 8.03 36 TR_MAX_INTL_RELAY 14669 10.75 16.15 7.80 37 RCVD_IN_VALIDITY_CERTIFIED 14492 6.22 3.52 7.70 38 XM_H_GMP 14439 6.76 5.09 7.67 39 LotsOfNums_01 13518 6.36 4.85 7.18 40 TR_XM_BayesUnsub 13085 9.00 12.74 6.95 41 BAYES_999 12867 15.79 32.13 6.84 42 T_TooManySym_01 12266 5.33 3.17 6.52 43 BAYES_00 12078 4.26 0.34 6.42 44 TooManyTo_001 11827 5.93 5.30 6.29 45 XM_DK_Undo_02 11695 21.63 49.76 6.22 46 RCVD_IN_MSPIKE_WL 11079 8.07 12.05 5.89 47 RCVD_IN_MSPIKE_H3 11079 8.07 12.05 5.89 48 ANY_BOUNCE_MESSAGE 10709 4.18 1.42 5.69 49 BOUNCE_MESSAGE 10708 4.18 1.42 5.69 50 LOTS_OF_MONEY 10521 7.93 12.21 5.59 51 HTML_IMAGE_RATIO_02 10166 5.86 6.69 5.40 52 XMStrtUSub 10148 4.70 3.43 5.39 53 TR_XM_DK_Bayes 10146 3.57 0.24 5.39 54 TR_XM_DK_Bayes1 10056 3.53 0.21 5.34 55 BOTNET_IPINHOSTNAME 9865 8.05 13.17 5.24 56 XM_B_SpammyWords3 9553 8.15 13.76 5.08 57 IN_ZIMBRA_NJ_WHITELIST 9438 3.25 0.04 5.02 58 HTML_IMAGE_RATIO_04 9436 4.65 3.98 5.01 59 XM_H_Long_From01 9171 4.40 3.53 4.87 60 TR_XM_DK_Bayes2 8817 3.08 0.16 4.69 61 BAYES_80 8811 6.49 9.78 4.68 62 XM_UncommonTLD01 8655 5.49 7.11 4.60 63 XM_CamelCaseFrm001 8365 3.95 3.06 4.45 64 SCC_BODY_URI_ONLY 8220 3.15 0.94 4.37 65 RELAYCOUNTRY_META 8012 11.37 24.34 4.26 66 TR_XM_SpammyWords4 7891 6.70 11.28 4.19 67 FSL_BULK_SIG 7854 5.01 6.55 4.17 68 BAYES_40 7280 2.95 1.27 3.87 69 XMSubMetaSx_00 7177 4.33 5.28 3.81 70 MIME_QP_LONG_LINE 7001 3.17 2.17 3.72 71 TO_MALFORMED 7000 2.41 0.01 3.72 72 INVALID_MSGID 6936 2.46 0.23 3.69 73 T_TooManySym_02 6927 2.65 0.76 3.68 74 XMNumbers 6862 3.66 3.70 3.65 75 HTML_IMAGE_RATIO_06 6733 3.98 4.71 3.58 76 MPART_ALT_DIFF 6649 4.39 5.94 3.53 77 BAYES_95 5858 4.11 5.93 3.11 78 XM_B_Phish_Phrases 5695 3.19 3.50 3.03 79 T_REMOTE_IMAGE 5569 2.41 1.41 2.96 80 XM_Body_Dirty_Words 5457 4.05 6.14 2.90 81 TM2_M_URI_OPT_OUT 5138 3.47 4.81 2.73 82 TR_XM_DKIM_Undo 5049 15.65 39.31 2.68 83 BAYES_20 4961 2.02 0.90 2.64 84 TR_XM_SpammyRelay 4838 8.63 19.68 2.57 85 BAYES_05 4834 1.80 0.40 2.57 86 MIME_HTML_MOSTLY 4728 2.84 3.42 2.51 87 XM_B_SpammyTLD 4706 2.61 2.80 2.50 88 TVD_RCVD_IP 4640 1.92 0.91 2.47 89 XM_SPF_SoftFail 4547 3.16 4.52 2.42 90 TR_XM_PhishingBody 4422 2.62 3.10 2.35 91 FROM_EXCESS_BASE64 4278 2.04 1.63 2.27 92 RCVD_IN_IADB_LISTED 4231 1.63 0.50 2.25 93 XMBSHREFv2 4036 1.47 0.24 2.14 94 HTML_IMAGE_RATIO_08 3906 2.53 3.36 2.08 95 TR_DCC_Bayes_99 3888 11.52 28.76 2.07 96 RELAYCOUNTRY_CA 3848 6.82 15.52 2.04 97 RCVD_IN_IADB_SPF 3779 1.45 0.44 2.01 98 TR_XM_UnparsRelay 3602 4.17 8.27 1.91 99 MAILING_LIST_MULTI 3597 1.63 1.13 1.91 100 XM_PDF 3482 1.30 0.31 1.85 101 UNTRUSTED_Relay 3470 3.34 6.08 1.84 102 MIME_HTML_ONLY_MULTI 3459 2.24 2.97 1.84 103 T_XMDrugObfuBody_14 3410 2.44 3.59 1.81 104 RCVD_IN_IADB_SENDERID 3364 1.30 0.41 1.79 105 RCVD_IN_IADB_DK 3325 1.29 0.42 1.77 106 TVD_SPACE_RATIO 3254 1.15 0.09 1.73 107 IN_HORDE_ADDRESS_BOOK 2975 1.03 0.03 1.58 108 XMStockSpam_06 2956 1.83 2.31 1.57 109 XMSexyCombo_05 2934 2.39 3.90 1.56 110 TooManyTo_002 2894 1.35 1.00 1.54 111 XMDiploma_00 2869 1.58 1.67 1.52 112 TR_XM_SpammyWords5 2830 2.99 5.71 1.50 113 RCVD_IN_IADB_VOUCHED 2813 1.05 0.25 1.49 114 DKIM_INVALID 2791 2.61 4.65 1.48 115 XM_DK_Undo_01 2740 1.28 0.95 1.46 116 HTML_MIME_NO_HTML_TAG 2637 1.46 1.56 1.40 117 XMGappySubj_01 2582 0.96 0.20 1.37 118 XM_B_COPY_HTML 2579 1.27 1.08 1.37 119 XMBdyGiftCard01 2541 1.29 1.19 1.35 120 T_XMDrugObfuBody_08 2503 2.03 3.31 1.33 121 TM2_M_VERY_LONG_WORD 2497 1.84 2.79 1.33 122 SUBJ_ALL_CAPS 2439 2.42 4.48 1.30 123 XM_B_Investor 2384 2.10 3.61 1.27 124 T_TooManySym_03 2363 0.91 0.29 1.26 125 TR_Symld_Words 2279 1.27 1.39 1.21 126 XM_SendGrid 2238 1.21 1.25 1.19 127 XMGappySubj_02 2227 0.80 0.10 1.18 128 XMPhish30 2181 1.18 1.23 1.16 129 XMBrknScrpt_02 2151 1.44 1.99 1.14 130 RCVD_IN_IADB_OPTIN 2098 0.78 0.16 1.11 131 XM_B_Unsub2 1990 1.38 1.96 1.06 132 XM_GoogleGroups 1927 0.85 0.52 1.02 133 XMSubMetaI_00 1893 1.04 1.11 1.01 134 XM_B_SEO 1883 1.90 3.54 1.00 135 XM_OfRef6 1826 2.81 6.16 0.97 136 URI_HEX 1818 1.11 1.38 0.97 137 XM_UB50 1818 1.60 2.75 0.97 138 DKIM_ADSP_CUSTOM_MED 1811 1.03 1.15 0.96 139 HTML_TAG_BALANCE_BODY 1780 1.16 1.56 0.95 140 XMBody_17 1772 3.97 9.50 0.94 141 BOTNET 1764 3.46 8.07 0.94 142 XM_H_Long_From02 1763 1.02 1.16 0.94 143 TR_MetaPhish_Combo_01 1710 0.97 1.08 0.91 144 TR_XM_DK_SendGrid 1671 0.90 0.93 0.89 145 URI_NOVOWEL 1635 0.76 0.55 0.87 146 TooManyTo_003 1558 0.87 0.93 0.83 147 MPART_ALT_DIFF_COUNT 1551 0.89 1.02 0.82 148 XM_H_PHPMailer 1548 0.87 0.95 0.82 149 USER_IN_WHITELIST 1544 0.53 0.00 0.82 150 USER_IN_WELCOMELIST 1544 0.53 0.00 0.82 151 TR_XM_Base64_M1 1507 0.77 0.73 0.80 152 SHOPIFY_IMG_NOT_RCVD_SFY 1460 0.86 1.00 0.78 153 URI_TRY_3LD 1454 1.12 1.75 0.77 154 T_XMHurry_00 1359 1.26 2.23 0.72 155 XMSubMetaSxObfu_02 1347 0.58 0.32 0.72 156 PLING_QUERY 1302 0.81 1.02 0.69 157 XMBody_95 1285 0.48 0.12 0.68 158 XM_B_DNDMA 1272 0.73 0.83 0.68 159 NML_ADSP_CUSTOM_MED 1267 0.82 1.08 0.67 160 T_FILL_THIS_FORM_SHORT 1232 2.60 6.15 0.65 161 TooManyTo_004 1225 0.74 0.90 0.65 162 KHOP_HELO_FCRDNS 1222 0.92 1.41 0.65 163 XM_ProductURIs 1215 0.69 0.78 0.65 164 FORGED_GMAIL_RCVD 1185 0.73 0.92 0.63 165 TR_XM_SpammyWords2 1180 6.29 16.61 0.63 166 RCVD_IN_BL_SPAMCOP_NET 1161 6.16 16.28 0.62 167 XMPhish14 1146 0.62 0.65 0.61 168 XMGenDplmaNmb 1145 0.64 0.71 0.61 169 TR_LOTS_OF_MONEY3 1117 1.56 3.34 0.59 170 XM_B_SpammyWords4 1101 1.05 1.89 0.59 171 XM_B_FormFill 1088 0.41 0.11 0.58 172 XM_B_REG_HTML 1070 0.63 0.73 0.57 173 TooManyTo_005 1066 0.68 0.88 0.57 174 TR_XM_SEO4 1024 1.46 3.13 0.54 175 FILL_THIS_FORM 989 0.47 0.38 0.53 176 THIS_AD 916 0.91 1.68 0.49 177 XMNoVowels 898 0.57 0.74 0.48 178 T_TooManySym_04 896 0.37 0.16 0.48 179 RCVD_IN_PSBL 893 0.58 0.78 0.47 180 T_STY_INVIS_DIRECT 892 0.73 1.19 0.47 181 T_XMDrugObfuBody_00 866 0.62 0.91 0.46 182 TR_XM_SPAMCOP 827 5.60 15.01 0.44 183 HTML_FONT_FACE_BAD 821 0.57 0.82 0.44 184 HTTPS_HTTP_MISMATCH 816 0.62 0.96 0.43 185 RELAYCOUNTRY_AU 807 1.03 2.12 0.43 186 XMClaimOffer 806 0.53 0.73 0.43 187 DKIM_ADSP_NXDOMAIN 782 0.79 1.47 0.42 188 XM_S_SubURI 773 0.29 0.06 0.41 189 SpammyFromTLD_01 765 1.41 3.24 0.41 190 CTE_8BIT_MISMATCH 742 0.26 0.02 0.39 191 TR_LOTS_OF_MONEY2 717 0.60 1.01 0.38 192 T_MONEY_PERCENT 717 0.60 1.01 0.38 193 NUMERIC_HTTP_ADDR 708 0.35 0.30 0.38 194 RDNS_DYNAMIC 671 0.59 1.00 0.36 195 DIET_1 661 0.54 0.88 0.35 196 HELO_NO_DOMAIN 658 0.26 0.10 0.35 197 HELO_NODOT 658 0.26 0.11 0.35 198 XMLngstWrd_00 655 0.33 0.29 0.35 199 XM_Walgreens_Forge 653 0.23 0.02 0.35 200 HTML_TEXT_INVISIBLE_STYLE 650 0.36 0.39 0.35 ----------------------------------------------------------------------