Email: 488903 Autolearn: 0 AvgScore: 4.48 AvgScanTime: 1.45 sec Spam: 161825 Autolearn: 0 AvgScore: 13.66 AvgScanTime: 1.53 sec Ham: 327078 Autolearn: 0 AvgScore: -0.07 AvgScanTime: 1.41 sec Time Spent Running SA: 196.98 hours Time Spent Processing Spam: 68.78 hours Time Spent Processing Ham: 128.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 161472 99.56 99.78 99.45 2 HTML_MESSAGE 155182 89.94 95.89 86.99 3 DKIM_SIGNED 145197 81.51 89.72 77.44 4 XM_DK_Pass 139196 79.45 86.02 76.19 5 XM_B_Unicode 137589 76.09 85.02 71.68 6 DKIM_VALID 137153 78.37 84.75 75.21 7 RELAYCOUNTRY_US 128350 81.74 79.31 82.94 8 XM_B_SpammyWords 119162 55.38 73.64 46.35 9 XMListUnsubscribeExists 118381 59.55 73.15 52.82 10 DCC_CHECK 113937 47.05 70.41 35.49 11 DKIM_VALID_AU 102964 61.88 63.63 61.01 12 XM_DK_Undo_02 74424 19.70 45.99 6.70 13 XM_B_SpammyWords2 71385 28.58 44.11 20.90 14 XM_B_Unicode3 70569 42.54 43.61 42.01 15 LOC_TINY_FONT_1 63567 31.49 39.28 27.64 16 BAYES_50 61384 53.16 37.93 60.70 17 TR_XM_DKIM_Undo 58102 14.10 35.90 3.31 18 BAYES_99 58083 15.19 35.89 4.95 19 HTML_FONT_LOW_CONTRAST 55475 31.06 34.28 29.46 20 FVGT_m_MULTI_ODD 50548 27.43 31.24 25.55 21 RCVD_IN_MSPIKE_H2 50289 30.67 31.08 30.47 22 DKIM_VALID_EF 50107 29.35 30.96 28.55 23 MIME_HTML_ONLY 50103 23.26 30.96 19.45 24 T_KAM_HTML_FONT_INVALID 48320 24.08 29.86 21.23 25 DCC_CHECK_NEGATIVE 47867 52.91 29.58 64.45 26 BAYES_999 45886 11.94 28.36 3.81 27 TR_DCC_Bayes_99 39900 9.60 24.66 2.15 28 TR_XM_DK_Unsub 36710 16.63 22.68 13.64 29 T_TM2_M_HEADER_IN_MSG 35031 25.88 21.65 27.97 30 RELAYCOUNTRY_META 33870 9.73 20.93 4.18 31 XMSubLong 32895 22.60 20.33 23.72 32 XM_Multi_Part_URI 29962 15.26 18.52 13.66 33 TR_XM_SpammyRelay 25553 6.74 15.79 2.26 34 LOTS_OF_MONEY 25542 9.75 15.78 6.77 35 TR_XM_SpammyWords2 25099 5.73 15.51 0.89 36 TR_MAX_INTL_RELAY 23869 9.33 14.75 6.64 37 XM_B_Unsub 23760 10.28 14.68 8.11 38 XM_B_SpammyWords3 23492 8.50 14.52 5.53 39 TR_XM_SpammyWords4 23385 7.84 14.45 4.57 40 RCVD_IN_BL_SPAMCOP_NET 22963 5.30 14.19 0.90 41 TR_XM_BayesUnsub 22675 8.97 14.01 6.47 42 UNPARSEABLE_RELAY 21598 11.55 13.35 10.67 43 BOTNET_IPINHOSTNAME 20572 7.18 12.71 4.44 44 TR_XM_SPAMCOP 19872 4.44 12.28 0.56 45 RELAYCOUNTRY_CA 17675 4.39 10.92 1.15 46 BOTNET 16063 4.26 9.93 1.46 47 RCVD_IN_MSPIKE_H3 14719 6.96 9.10 5.91 48 RCVD_IN_MSPIKE_WL 14719 6.96 9.10 5.91 49 BAYES_80 14528 5.65 8.98 4.00 50 BAYES_60 12795 8.99 7.91 9.53 51 FSL_BULK_SIG 12633 5.07 7.81 3.72 52 XMBody_17 12427 3.08 7.68 0.80 53 XM_Evil_Numbers_Gen 12249 8.12 7.57 8.40 54 TR_XM_UnparsRelay 11401 3.45 7.05 1.68 55 XM_Body_Dirty_Words 10707 4.39 6.62 3.29 56 UNTRUSTED_Relay 10417 3.20 6.44 1.59 57 XM_UncommonTLD01 10187 4.66 6.30 3.85 58 LotsOfNums_01 10177 7.97 6.29 8.80 59 XMSubMetaSx_00 10101 5.38 6.24 4.95 60 MPART_ALT_DIFF 9139 4.58 5.65 4.06 61 HTML_IMAGE_RATIO_02 9129 5.21 5.64 4.99 62 BAYES_95 8663 3.54 5.35 2.64 63 XM_B_SEO 8224 2.61 5.08 1.39 64 TooManyTo_001 8138 6.99 5.03 7.96 65 XM_H_GMP 8047 5.66 4.97 6.00 66 DKIM_INVALID 8044 3.14 4.97 2.24 67 XMSexyCombo_05 8030 2.87 4.96 1.84 68 TR_XM_SpammyWords5 7924 2.59 4.90 1.46 69 XM_SPF_SoftFail 7907 3.59 4.89 2.95 70 XM_B_Phish_Phrases 7831 4.03 4.84 3.63 71 HTML_IMAGE_RATIO_04 7532 4.56 4.65 4.51 72 XM_H_Long_From01 7517 5.29 4.65 5.62 73 TR_XM_SEO4 7465 2.15 4.61 0.93 74 RCVD_IN_VALIDITY_RPBL 6950 1.55 4.29 0.19 75 XM_B_Investor 6839 2.54 4.23 1.71 76 TR_XM_PhishingBody 6813 2.39 4.21 1.49 77 TR_LOTS_OF_MONEY3 6757 1.74 4.18 0.53 78 XMStrtUSub 6713 4.73 4.15 5.01 79 XM_OfRef6 6631 2.15 4.10 1.19 80 T_XMDrugObfuBody_14 6582 2.93 4.07 2.37 81 HTML_IMAGE_RATIO_08 6297 3.03 3.89 2.60 82 HTML_IMAGE_RATIO_06 6135 2.86 3.79 2.39 83 XMNumbers 6084 3.20 3.76 2.93 84 MIME_HTML_MOSTLY 5936 2.87 3.67 2.47 85 T_FILL_THIS_FORM_SHORT 5858 1.86 3.62 0.99 86 MIME_QP_LONG_LINE 5800 4.74 3.58 5.32 87 XM_UB50 5791 1.82 3.58 0.94 88 XM_B_SpammyTLD 5678 2.91 3.51 2.61 89 FONT_INVIS_LONG_LINE 5226 1.10 3.23 0.05 90 MIME_HTML_ONLY_MULTI 4894 2.51 3.02 2.25 91 T_XMDrugObfuBody_08 4841 2.18 2.99 1.78 92 XMDiploma_00 4780 2.17 2.95 1.78 93 TM2_M_URI_OPT_OUT 4742 2.17 2.93 1.79 94 USER_IN_DEF_DKIM_WL 4701 11.26 2.90 15.39 95 TM2_M_VERY_LONG_WORD 4664 2.33 2.88 2.05 96 XM_CamelCaseFrm001 4556 2.48 2.82 2.32 97 SUBJ_ALL_CAPS 4471 1.88 2.76 1.44 98 HTML_MIME_NO_HTML_TAG 4441 2.28 2.74 2.05 99 RCVD_IN_VALIDITY_SAFE 4419 4.43 2.73 5.26 100 HOSTED_IMG_MULTI_PUB_01 4261 0.89 2.63 0.02 101 XM_URI_RBL 4200 0.97 2.60 0.16 102 TR_XM_BayesRelay 4132 0.85 2.55 0.00 103 SCC_BODY_URI_ONLY 4001 2.37 2.47 2.32 104 TR_Mismatch_TLD_02 3988 0.85 2.46 0.06 105 SpammyFromTLD_01 3967 1.31 2.45 0.74 106 URIBL_DBL_SPAM 3761 0.78 2.32 0.01 107 TR_XM_FormFill 3749 0.78 2.32 0.03 108 RCVD_IN_VALIDITY_CERTIFIED 3552 3.64 2.19 4.36 109 T_TooManySym_01 3501 4.67 2.16 5.92 110 XM_B_SpammyWords4 3372 1.22 2.08 0.79 111 RELAYCOUNTRY_AU 3366 1.28 2.08 0.89 112 XM_B_Unsub2 3339 1.68 2.06 1.49 113 T_XMHurry_00 3296 1.06 2.04 0.58 114 URI_TRY_3LD 3221 1.16 1.99 0.76 115 ALL_TRUSTED 3115 9.89 1.92 13.82 116 ANY_BOUNCE_MESSAGE 3114 3.62 1.92 4.47 117 BOUNCE_MESSAGE 3114 3.62 1.92 4.46 118 TR_XM_INV_DKIM 3105 0.67 1.92 0.05 119 TR_XM_NoHeaderRelay 3074 0.70 1.90 0.11 120 FROM_EXCESS_BASE64 2977 2.17 1.84 2.33 121 T_REMOTE_IMAGE 2914 2.91 1.80 3.46 122 XMStockSpam_06 2913 1.41 1.80 1.21 123 TR_XM_PHPForged 2887 0.77 1.78 0.27 124 TR_XM_PHPDW 2804 0.76 1.73 0.27 125 TR_XM_FormFill2 2777 0.75 1.72 0.27 126 XMBrknScrpt_02 2764 1.18 1.71 0.91 127 BAYES_40 2750 3.50 1.70 4.39 128 XM_H_PHPOS 2738 0.73 1.69 0.26 129 XM_DK_Undo_01 2662 1.81 1.64 1.89 130 MAILING_LIST_MULTI 2545 2.34 1.57 2.72 131 RCVD_IN_PSBL 2503 0.80 1.55 0.43 132 HK_RANDOM_REPLYTO 2502 0.57 1.55 0.08 133 SpammyFromTLD_02 2489 0.90 1.54 0.58 134 HTTPS_HTTP_MISMATCH 2416 1.01 1.49 0.77 135 THIS_AD 2328 0.81 1.44 0.51 136 XMGenDplmaNmb 2294 1.12 1.42 0.97 137 XMPhish30 2279 0.80 1.41 0.51 138 XM_B_Phish66 2253 0.71 1.39 0.38 139 DKIM_ADSP_NXDOMAIN 2235 0.65 1.38 0.29 140 BOTNET_NORDNS 2196 0.46 1.36 0.01 141 T_XMDrugObfuBody_00 2179 0.93 1.35 0.72 142 XM_DIRTYINTL 2151 0.58 1.33 0.21 143 XM_SendGrid 2137 1.39 1.32 1.42 144 DKIM_ADSP_CUSTOM_MED 2082 0.92 1.29 0.74 145 TR_Symld_Words 2079 1.42 1.28 1.49 146 URI_HEX 1980 0.98 1.22 0.86 147 TR_Caps_n_Bayes_99 1944 0.42 1.20 0.03 148 RCVD_IN_IADB_LISTED 1915 2.93 1.18 3.80 149 HTML_FONT_SIZE_LARGE 1910 0.44 1.18 0.07 150 NML_ADSP_CUSTOM_MED 1908 0.73 1.18 0.50 151 HTML_IMAGE_ONLY_08 1869 0.45 1.15 0.11 152 XM_HighProb1 1815 0.37 1.12 0.00 153 TooManyTo_002 1808 1.96 1.12 2.37 154 HTML_TAG_BALANCE_BODY 1792 0.76 1.11 0.58 155 MIME_HEADER_CTYPE_ONLY 1770 0.45 1.09 0.14 156 TR_XM_InvalidRelay 1768 0.38 1.09 0.03 157 KHOP_HELO_FCRDNS 1763 1.48 1.09 1.68 158 HTML_SHORT_LINK_IMG_1 1742 0.36 1.08 0.01 159 RELAYCOUNTRY_HU 1739 0.36 1.07 0.00 160 XMSexyCombo_01 1731 0.49 1.07 0.20 161 XM_ShortIntro_01 1722 0.75 1.06 0.60 162 URIBL_CSS_A 1701 0.37 1.05 0.03 163 URIBL_CSS 1701 0.37 1.05 0.03 164 SHORTENER_SHORT_IMG 1700 0.35 1.05 0.00 165 XMReplyNow 1697 0.52 1.05 0.26 166 TR_MetaPhish_Combo_01 1679 0.89 1.04 0.82 167 BAYES_20 1675 2.47 1.04 3.18 168 RCVD_IN_IADB_SPF 1658 2.59 1.02 3.36 169 XM_H_Undi_Recip 1651 0.44 1.02 0.16 170 TooManyTo_003 1650 1.28 1.02 1.41 171 TR_XM_RelayPhish 1645 0.37 1.02 0.06 172 RCVD_IN_IADB_SENDERID 1581 2.33 0.98 3.01 173 AC_BR_BONANZA 1562 0.37 0.97 0.08 174 RCVD_IN_IADB_DK 1562 2.28 0.97 2.94 175 T_STY_INVIS_DIRECT 1556 0.55 0.96 0.34 176 TooManyTo_004 1551 0.98 0.96 0.99 177 XMHTML_After_End 1541 0.62 0.95 0.45 178 TooManyTo_005 1514 0.85 0.94 0.81 179 URI_NOVOWEL 1507 1.11 0.93 1.20 180 XM_UB99 1496 0.31 0.92 0.00 181 PLING_QUERY 1495 0.67 0.92 0.54 182 MPART_ALT_DIFF_COUNT 1494 0.73 0.92 0.63 183 TR_XM_Base64_M1 1473 0.91 0.91 0.91 184 XMLngstWrd_00 1473 0.73 0.91 0.63 185 XM_H_Long_From02 1428 1.03 0.88 1.11 186 XMHTMLBadTable_001 1423 0.49 0.88 0.29 187 TM2_M_OBFU_COMMENT 1411 0.51 0.87 0.34 188 XM_ProductURIs 1409 1.24 0.87 1.42 189 XMBdyGiftCard01 1407 0.90 0.87 0.92 190 RDNS_DYNAMIC 1391 0.51 0.86 0.34 191 TR_XM_DK_SendGrid 1387 0.89 0.86 0.90 192 TR_XM_Undi_Recip19 1379 0.33 0.85 0.07 193 TR_LOTS_OF_MONEY2 1371 0.49 0.85 0.31 194 T_MONEY_PERCENT 1371 0.49 0.85 0.31 195 FORGED_GMAIL_RCVD 1359 0.57 0.84 0.44 196 XM_H_PHPMailer 1332 0.75 0.82 0.71 197 XM_B_COPY_HTML 1312 0.73 0.81 0.69 198 XM_B_DNDMA 1291 0.58 0.80 0.47 199 XMMoneyMeta_00 1237 0.58 0.76 0.49 200 XM_UB60 1222 0.29 0.76 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 325292 99.56 99.78 99.45 2 HTML_MESSAGE 284527 89.94 95.89 86.99 3 RELAYCOUNTRY_US 271283 81.74 79.31 82.94 4 DKIM_SIGNED 253301 81.51 89.72 77.44 5 XM_DK_Pass 249215 79.45 86.02 76.19 6 DKIM_VALID 245986 78.37 84.75 75.21 7 XM_B_Unicode 234435 76.09 85.02 71.68 8 DCC_CHECK_NEGATIVE 210810 52.91 29.58 64.45 9 DKIM_VALID_AU 199550 61.88 63.63 61.01 10 BAYES_50 198521 53.16 37.93 60.70 11 XMListUnsubscribeExists 172751 59.55 73.15 52.82 12 XM_B_SpammyWords 151589 55.38 73.64 46.35 13 XM_B_Unicode3 137401 42.54 43.61 42.01 14 DCC_CHECK 116094 47.05 70.41 35.49 15 RCVD_IN_MSPIKE_H2 99650 30.67 31.08 30.47 16 HTML_FONT_LOW_CONTRAST 96361 31.06 34.28 29.46 17 DKIM_VALID_EF 93385 29.35 30.96 28.55 18 T_TM2_M_HEADER_IN_MSG 91475 25.88 21.65 27.97 19 LOC_TINY_FONT_1 90401 31.49 39.28 27.64 20 FVGT_m_MULTI_ODD 83554 27.43 31.24 25.55 21 XMSubLong 77581 22.60 20.33 23.72 22 T_KAM_HTML_FONT_INVALID 69426 24.08 29.86 21.23 23 XM_B_SpammyWords2 68364 28.58 44.11 20.90 24 MIME_HTML_ONLY 63618 23.26 30.96 19.45 25 USER_IN_DEF_DKIM_WL 50336 11.26 2.90 15.39 26 ALL_TRUSTED 45218 9.89 1.92 13.82 27 XM_Multi_Part_URI 44667 15.26 18.52 13.66 28 TR_XM_DK_Unsub 44606 16.63 22.68 13.64 29 UNPARSEABLE_RELAY 34894 11.55 13.35 10.67 30 BAYES_60 31159 8.99 7.91 9.53 31 LotsOfNums_01 28778 7.97 6.29 8.80 32 BAYES_00 28696 6.09 0.65 8.77 33 XM_Evil_Numbers_Gen 27470 8.12 7.57 8.40 34 XM_B_Unsub 26519 10.28 14.68 8.11 35 XM_DKIMWhitelistDomains 26441 5.48 0.21 8.08 36 TooManyTo_001 26045 6.99 5.03 7.96 37 IN_ZIMBRA_NJ_WHITELIST 23203 4.77 0.09 7.09 38 LOTS_OF_MONEY 22149 9.75 15.78 6.77 39 XM_DK_Undo_02 21911 19.70 45.99 6.70 40 TR_MAX_INTL_RELAY 21727 9.33 14.75 6.64 41 TR_XM_BayesUnsub 21171 8.97 14.01 6.47 42 TR_XM_DK_Bayes 20396 4.32 0.44 6.24 43 TR_XM_DK_Bayes1 20066 4.25 0.44 6.13 44 XM_H_GMP 19619 5.66 4.97 6.00 45 T_TooManySym_01 19354 4.67 2.16 5.92 46 RCVD_IN_MSPIKE_WL 19331 6.96 9.10 5.91 47 RCVD_IN_MSPIKE_H3 19330 6.96 9.10 5.91 48 XM_H_Long_From01 18367 5.29 4.65 5.62 49 XM_B_SpammyWords3 18088 8.50 14.52 5.53 50 TR_XM_DK_Bayes2 17492 3.69 0.34 5.35 51 MIME_QP_LONG_LINE 17394 4.74 3.58 5.32 52 RCVD_IN_VALIDITY_SAFE 17216 4.43 2.73 5.26 53 XMStrtUSub 16396 4.73 4.15 5.01 54 HTML_IMAGE_RATIO_02 16322 5.21 5.64 4.99 55 XMSubMetaSx_00 16188 5.38 6.24 4.95 56 BAYES_99 16177 15.19 35.89 4.95 57 TR_XM_SpammyWords4 14945 7.84 14.45 4.57 58 HTML_IMAGE_RATIO_04 14755 4.56 4.65 4.51 59 ANY_BOUNCE_MESSAGE 14605 3.62 1.92 4.47 60 BOUNCE_MESSAGE 14603 3.62 1.92 4.46 61 BOTNET_IPINHOSTNAME 14525 7.18 12.71 4.44 62 XM_PDF 14402 3.16 0.66 4.40 63 BAYES_40 14358 3.50 1.70 4.39 64 RCVD_IN_VALIDITY_CERTIFIED 14265 3.64 2.19 4.36 65 RELAYCOUNTRY_META 13680 9.73 20.93 4.18 66 MPART_ALT_DIFF 13274 4.58 5.65 4.06 67 BAYES_80 13087 5.65 8.98 4.00 68 XM_UncommonTLD01 12606 4.66 6.30 3.85 69 BAYES_999 12466 11.94 28.36 3.81 70 RCVD_IN_IADB_LISTED 12422 2.93 1.18 3.80 71 FSL_BULK_SIG 12155 5.07 7.81 3.72 72 XM_B_Phish_Phrases 11882 4.03 4.84 3.63 73 T_REMOTE_IMAGE 11310 2.91 1.80 3.46 74 RCVD_IN_IADB_SPF 11006 2.59 1.02 3.36 75 TR_XM_DKIM_Undo 10820 14.10 35.90 3.31 76 XM_Body_Dirty_Words 10760 4.39 6.62 3.29 77 BAYES_20 10402 2.47 1.04 3.18 78 RCVD_IN_IADB_SENDERID 9831 2.33 0.98 3.01 79 XM_SPF_SoftFail 9636 3.59 4.89 2.95 80 RCVD_IN_IADB_DK 9603 2.28 0.97 2.94 81 XMNumbers 9583 3.20 3.76 2.93 82 T_TooManySym_02 9069 2.08 0.69 2.77 83 MAILING_LIST_MULTI 8893 2.34 1.57 2.72 84 BAYES_95 8628 3.54 5.35 2.64 85 XM_B_SpammyTLD 8550 2.91 3.51 2.61 86 HTML_IMAGE_RATIO_08 8499 3.03 3.89 2.60 87 RCVD_IN_IADB_VOUCHED 8188 1.85 0.54 2.50 88 MIME_HTML_MOSTLY 8086 2.87 3.67 2.47 89 HTML_IMAGE_RATIO_06 7830 2.86 3.79 2.39 90 TooManyTo_002 7763 1.96 1.12 2.37 91 T_XMDrugObfuBody_14 7760 2.93 4.07 2.37 92 FROM_EXCESS_BASE64 7618 2.17 1.84 2.33 93 XM_CamelCaseFrm001 7592 2.48 2.82 2.32 94 SCC_BODY_URI_ONLY 7578 2.37 2.47 2.32 95 TR_XM_SpammyRelay 7391 6.74 15.79 2.26 96 MIME_HTML_ONLY_MULTI 7368 2.51 3.02 2.25 97 DKIM_INVALID 7315 3.14 4.97 2.24 98 INVALID_MSGID 7055 1.49 0.14 2.16 99 TR_DCC_Bayes_99 7045 9.60 24.66 2.15 100 TO_MALFORMED 6760 1.56 0.53 2.07 101 TM2_M_VERY_LONG_WORD 6716 2.33 2.88 2.05 102 HTML_MIME_NO_HTML_TAG 6714 2.28 2.74 2.05 103 XM_DK_Undo_01 6198 1.81 1.64 1.89 104 BAYES_05 6046 1.42 0.55 1.85 105 XMSexyCombo_05 6025 2.87 4.96 1.84 106 TM2_M_URI_OPT_OUT 5856 2.17 2.93 1.79 107 T_XMDrugObfuBody_08 5815 2.18 2.99 1.78 108 XMDiploma_00 5809 2.17 2.95 1.78 109 XM_B_Investor 5596 2.54 4.23 1.71 110 KHOP_HELO_FCRDNS 5497 1.48 1.09 1.68 111 TR_XM_UnparsRelay 5486 3.45 7.05 1.68 112 RCVD_IN_IADB_OPTIN 5483 1.22 0.30 1.68 113 HELO_NODOT 5368 1.22 0.38 1.64 114 HELO_NO_DOMAIN 5362 1.22 0.38 1.64 115 UNTRUSTED_Relay 5213 3.20 6.44 1.59 116 XMGappySubj_01 5104 1.10 0.18 1.56 117 TR_XM_PhishingBody 4884 2.39 4.21 1.49 118 XM_B_Unsub2 4869 1.68 2.06 1.49 119 TR_Symld_Words 4862 1.42 1.28 1.49 120 IN_HORDE_ADDRESS_BOOK 4792 1.01 0.08 1.47 121 BOTNET 4772 4.26 9.93 1.46 122 TR_XM_SpammyWords5 4763 2.59 4.90 1.46 123 SUBJ_ALL_CAPS 4725 1.88 2.76 1.44 124 TVD_RCVD_IP 4672 1.19 0.71 1.43 125 XM_ProductURIs 4660 1.24 0.87 1.42 126 XM_SendGrid 4653 1.39 1.32 1.42 127 TooManyTo_003 4612 1.28 1.02 1.41 128 XM_B_SEO 4557 2.61 5.08 1.39 129 XMStockSpam_06 3967 1.41 1.80 1.21 130 URI_NOVOWEL 3915 1.11 0.93 1.20 131 XM_OfRef6 3895 2.15 4.10 1.19 132 RELAYCOUNTRY_CA 3771 4.39 10.92 1.15 133 XMBSHREFv2 3725 0.86 0.31 1.14 134 XM_GoogleGroups 3704 0.94 0.56 1.13 135 TVD_SPACE_RATIO 3694 0.80 0.14 1.13 136 XM_H_Long_From02 3631 1.03 0.88 1.11 137 T_FILL_THIS_FORM_SHORT 3248 1.86 3.62 0.99 138 TooManyTo_004 3244 0.98 0.96 0.99 139 XMGenDplmaNmb 3187 1.12 1.42 0.97 140 XMCapTrack 3175 0.79 0.43 0.97 141 T_TooManySym_03 3097 0.72 0.27 0.95 142 XM_UB50 3086 1.82 3.58 0.94 143 TR_XM_SEO4 3039 2.15 4.61 0.93 144 XMBdyGiftCard01 3012 0.90 0.87 0.92 145 XMBrknScrpt_02 2987 1.18 1.71 0.91 146 FROM_GOV_DKIM_AU 2975 0.65 0.14 0.91 147 TR_XM_Base64_M1 2966 0.91 0.91 0.91 148 TR_XM_DK_SendGrid 2955 0.89 0.86 0.90 149 RCVD_IN_BL_SPAMCOP_NET 2935 5.30 14.19 0.90 150 TR_XM_SpammyWords2 2918 5.73 15.51 0.89 151 RELAYCOUNTRY_AU 2909 1.28 2.08 0.89 152 URI_HEX 2816 0.98 1.22 0.86 153 TR_MetaPhish_Combo_01 2678 0.89 1.04 0.82 154 XMGappySubj_02 2658 0.57 0.07 0.81 155 TooManyTo_005 2635 0.85 0.94 0.81 156 XMSubMetaI_00 2627 0.74 0.61 0.80 157 XMBody_17 2614 3.08 7.68 0.80 158 XM_B_SpammyWords4 2599 1.22 2.08 0.79 159 HTTPS_HTTP_MISMATCH 2507 1.01 1.49 0.77 160 URI_TRY_3LD 2474 1.16 1.99 0.76 161 SpammyFromTLD_01 2436 1.31 2.45 0.74 162 DKIM_ADSP_CUSTOM_MED 2431 0.92 1.29 0.74 163 XMNoVowels 2405 0.70 0.61 0.74 164 T_XMDrugObfuBody_00 2347 0.93 1.35 0.72 165 XM_H_PHPMailer 2318 0.75 0.82 0.71 166 XMBody_95 2303 0.52 0.15 0.70 167 T_OBFU_PDF_ATTACH 2283 0.50 0.11 0.70 168 XM_B_COPY_HTML 2241 0.73 0.81 0.69 169 HTML_EXTRA_CLOSE 2097 0.43 0.01 0.64 170 XMLngstWrd_00 2075 0.73 0.91 0.63 171 MPART_ALT_DIFF_COUNT 2056 0.73 0.92 0.63 172 T_Symld_Words_02 2009 0.56 0.46 0.61 173 XM_ShortIntro_01 1967 0.75 1.06 0.60 174 HTML_TAG_BALANCE_BODY 1900 0.76 1.11 0.58 175 SpammyFromTLD_02 1898 0.90 1.54 0.58 176 T_XMHurry_00 1890 1.06 2.04 0.58 177 XMSolicitRefs_0 1840 0.50 0.37 0.56 178 HTML_FONT_FACE_BAD 1839 0.58 0.60 0.56 179 TR_XM_SPAMCOP 1833 4.44 12.28 0.56 180 PLING_QUERY 1780 0.67 0.92 0.54 181 SHORT_HELO_AND_INLINE_IMAGE 1751 0.38 0.07 0.54 182 TR_LOTS_OF_MONEY3 1746 1.74 4.18 0.53 183 THIS_AD 1656 0.81 1.44 0.51 184 XMPhish30 1653 0.80 1.41 0.51 185 NML_ADSP_CUSTOM_MED 1645 0.73 1.18 0.50 186 XMSubMetaSxObfu_03 1630 0.54 0.61 0.50 187 USER_IN_WHITELIST 1628 0.33 0.00 0.50 188 USER_IN_WELCOMELIST 1628 0.33 0.00 0.50 189 XM_B_FormFill 1613 0.35 0.06 0.49 190 XMMoneyMeta_00 1603 0.58 0.76 0.49 191 XM_B_DNDMA 1525 0.58 0.80 0.47 192 RELAYCOUNTRY_GB 1495 0.50 0.58 0.46 193 XMHTML_After_End 1485 0.62 0.95 0.45 194 T_TVD_MIME_NO_HEADERS 1462 0.32 0.06 0.45 195 FORGED_GMAIL_RCVD 1452 0.57 0.84 0.44 196 TO_NO_BRKTS_HTML_ONLY 1452 0.43 0.40 0.44 197 MISSING_HEADERS 1421 0.44 0.44 0.43 198 FILL_THIS_FORM 1416 0.38 0.27 0.43 199 RCVD_IN_PSBL 1402 0.80 1.55 0.43 200 URI_OPTOUT_3LD 1366 0.34 0.20 0.42 ----------------------------------------------------------------------