Email: 502012 Autolearn: 0 AvgScore: 4.25 AvgScanTime: 1.27 sec Spam: 161029 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 1.37 sec Ham: 340983 Autolearn: 0 AvgScore: -0.15 AvgScanTime: 1.23 sec Time Spent Running SA: 177.41 hours Time Spent Processing Spam: 61.15 hours Time Spent Processing Ham: 116.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 160709 99.51 99.80 99.37 2 HTML_MESSAGE 154611 89.30 96.01 86.12 3 DKIM_SIGNED 147203 80.55 91.41 75.42 4 XM_DK_Pass 141644 78.48 87.96 74.01 5 DKIM_VALID 139610 77.35 86.70 72.94 6 XM_B_Unicode 135671 73.58 84.25 68.54 7 RELAYCOUNTRY_US 124733 79.84 77.46 80.97 8 XMListUnsubscribeExists 119724 57.74 74.35 49.89 9 XM_B_SpammyWords 118269 53.49 73.45 44.07 10 DCC_CHECK 116652 45.61 72.44 32.93 11 DKIM_VALID_AU 104587 60.89 64.95 58.97 12 XM_DK_Undo_02 73304 18.57 45.52 5.83 13 XM_B_SpammyWords2 71967 27.27 44.69 19.05 14 XM_B_Unicode3 70290 40.94 43.65 39.66 15 LOC_TINY_FONT_1 61963 29.78 38.48 25.67 16 BAYES_50 58866 51.80 36.56 59.00 17 BAYES_99 57277 14.75 35.57 4.91 18 TR_XM_DKIM_Undo 56411 12.99 35.03 2.58 19 HTML_FONT_LOW_CONTRAST 54896 29.43 34.09 27.23 20 FVGT_m_MULTI_ODD 53610 28.48 33.29 26.21 21 RCVD_IN_MSPIKE_H2 51109 30.56 31.74 30.01 22 DKIM_VALID_EF 50319 30.43 31.25 30.04 23 T_KAM_HTML_FONT_INVALID 46632 22.94 28.96 20.09 24 MIME_HTML_ONLY 46340 21.62 28.78 18.23 25 DCC_CHECK_NEGATIVE 44356 54.35 27.55 67.00 26 BAYES_999 44257 11.30 27.48 3.65 27 TR_DCC_Bayes_99 40254 9.12 25.00 1.62 28 T_TM2_M_HEADER_IN_MSG 38117 28.97 23.67 31.47 29 TR_XM_DK_Unsub 37677 17.16 23.40 14.22 30 RELAYCOUNTRY_META 36639 10.53 22.75 4.75 31 XMSubLong 32986 22.15 20.48 22.93 32 TR_XM_SpammyRelay 29394 7.64 18.25 2.63 33 XM_Multi_Part_URI 28513 14.34 17.71 12.75 34 TR_MAX_INTL_RELAY 25543 9.77 15.86 6.89 35 XM_B_SpammyWords3 24697 8.29 15.34 4.96 36 TR_XM_SpammyWords2 24351 5.22 15.12 0.55 37 LOTS_OF_MONEY 23703 9.18 14.72 6.56 38 XM_B_Unsub 22305 9.78 13.85 7.86 39 TR_XM_SpammyWords4 21479 7.35 13.34 4.52 40 TR_XM_BayesUnsub 21469 8.59 13.33 6.35 41 RELAYCOUNTRY_CA 21212 5.42 13.17 1.76 42 RCVD_IN_BL_SPAMCOP_NET 21186 4.72 13.16 0.74 43 BOTNET_IPINHOSTNAME 20841 6.77 12.94 3.85 44 UNPARSEABLE_RELAY 20021 11.19 12.43 10.60 45 TR_XM_SPAMCOP 19137 4.08 11.88 0.39 46 BAYES_80 15749 5.95 9.78 4.15 47 RCVD_IN_MSPIKE_H3 15421 7.15 9.58 6.00 48 RCVD_IN_MSPIKE_WL 15421 7.15 9.58 6.00 49 BAYES_60 14275 9.49 8.86 9.78 50 BOTNET 14171 3.59 8.80 1.14 51 XMBody_17 13348 3.10 8.29 0.65 52 XM_Evil_Numbers_Gen 13078 8.12 8.12 8.11 53 XM_UncommonTLD01 11411 4.85 7.09 3.80 54 TR_XM_UnparsRelay 10981 3.30 6.82 1.64 55 FSL_BULK_SIG 10674 4.17 6.63 3.01 56 XM_Body_Dirty_Words 10649 4.11 6.61 2.92 57 LotsOfNums_01 10156 7.73 6.31 8.40 58 UNTRUSTED_Relay 9721 3.09 6.04 1.70 59 XMSubMetaSx_00 9258 4.37 5.75 3.72 60 BAYES_95 9131 3.68 5.67 2.74 61 MPART_ALT_DIFF 8816 3.88 5.47 3.13 62 HTML_IMAGE_RATIO_02 8579 4.69 5.33 4.39 63 XM_H_GMP 8011 5.99 4.97 6.47 64 XM_OfRef6 8004 2.35 4.97 1.11 65 XM_B_SEO 7982 2.40 4.96 1.19 66 XM_SPF_SoftFail 7974 3.87 4.95 3.36 67 HTML_IMAGE_RATIO_04 7963 4.52 4.95 4.32 68 TooManyTo_001 7937 7.54 4.93 8.77 69 XM_B_Phish_Phrases 7635 3.52 4.74 2.94 70 DKIM_INVALID 7593 3.19 4.72 2.48 71 XM_B_Investor 7528 2.52 4.67 1.51 72 HK_RANDOM_REPLYTO 7278 1.51 4.52 0.10 73 TR_XM_SEO4 6912 1.87 4.29 0.73 74 XM_H_Long_From01 6901 4.97 4.29 5.29 75 HTML_IMAGE_RATIO_06 6682 3.42 4.15 3.08 76 TR_XM_PhishingBody 6443 2.17 4.00 1.31 77 XM_B_SpammyTLD 6406 2.74 3.98 2.16 78 TR_XM_SpammyWords5 6331 2.19 3.93 1.36 79 T_FILL_THIS_FORM_SHORT 6294 1.96 3.91 1.04 80 XMSexyCombo_05 6193 2.21 3.85 1.44 81 T_XMDrugObfuBody_14 6029 2.36 3.74 1.71 82 TR_LOTS_OF_MONEY3 5879 1.51 3.65 0.50 83 XMStrtUSub 5751 4.12 3.57 4.38 84 MIME_HTML_MOSTLY 5708 2.60 3.54 2.16 85 HTML_IMAGE_RATIO_08 5477 2.65 3.40 2.29 86 T_XMDrugObfuBody_08 5468 2.04 3.40 1.41 87 XMNumbers 5354 3.02 3.32 2.88 88 RCVD_IN_VALIDITY_RPBL 5075 1.09 3.15 0.12 89 FONT_INVIS_LONG_LINE 5032 1.03 3.12 0.04 90 TM2_M_VERY_LONG_WORD 5025 2.05 3.12 1.54 91 XMDiploma_00 4808 2.19 2.99 1.82 92 HOSTED_IMG_MULTI_PUB_01 4764 0.97 2.96 0.04 93 XM_UB50 4739 1.64 2.94 1.03 94 MIME_HTML_ONLY_MULTI 4726 2.07 2.93 1.67 95 TR_XM_BayesRelay 4658 0.93 2.89 0.00 96 MIME_QP_LONG_LINE 4575 4.44 2.84 5.19 97 SpammyFromTLD_01 4530 1.39 2.81 0.72 98 XM_CamelCaseFrm001 4405 3.14 2.74 3.34 99 T_TooManySym_01 4398 4.70 2.73 5.63 100 XM_URI_RBL 4130 0.92 2.56 0.14 101 SUBJ_ALL_CAPS 4028 1.91 2.50 1.63 102 TM2_M_URI_OPT_OUT 3945 1.94 2.45 1.70 103 USER_IN_DEF_DKIM_WL 3821 9.92 2.37 13.48 104 RCVD_IN_VALIDITY_SAFE 3784 4.21 2.35 5.09 105 TR_XM_FormFill 3687 0.86 2.29 0.18 106 TM2_M_A_HREF_HREF 3471 1.01 2.16 0.46 107 XM_B_Unsub2 3404 1.67 2.11 1.46 108 RELAYCOUNTRY_AU 3377 1.15 2.10 0.71 109 URI_TRY_3LD 3288 1.16 2.04 0.74 110 XM_B_SpammyWords4 3259 1.17 2.02 0.77 111 TR_XM_NoHeaderRelay 3087 0.71 1.92 0.15 112 XMStockSpam_06 3074 1.39 1.91 1.15 113 ANY_BOUNCE_MESSAGE 3024 2.99 1.88 3.51 114 BOUNCE_MESSAGE 3019 2.99 1.87 3.51 115 LongTLD 3018 0.94 1.87 0.49 116 T_XMHurry_00 2982 1.32 1.85 1.07 117 RCVD_IN_VALIDITY_CERTIFIED 2933 3.59 1.82 4.42 118 URIBL_DBL_SPAM 2926 0.60 1.82 0.02 119 SpammyFromTLD_02 2925 0.74 1.82 0.24 120 TR_Mismatch_TLD_02 2896 0.62 1.80 0.06 121 ALL_TRUSTED 2867 10.82 1.78 15.08 122 TR_XM_INV_DKIM 2861 0.63 1.78 0.08 123 XMBrknScrpt_02 2783 1.25 1.73 1.02 124 HTTPS_HTTP_MISMATCH 2727 1.11 1.69 0.84 125 MAILING_LIST_MULTI 2671 2.40 1.66 2.74 126 HTML_MIME_NO_HTML_TAG 2637 2.05 1.64 2.25 127 XM_DK_Undo_01 2462 1.91 1.53 2.09 128 T_REMOTE_IMAGE 2445 2.95 1.52 3.62 129 FROM_EXCESS_BASE64 2416 1.48 1.50 1.47 130 TR_XM_PHPForged 2400 0.81 1.49 0.49 131 KHOP_HELO_FCRDNS 2332 1.40 1.45 1.37 132 URI_HEX 2326 1.12 1.44 0.96 133 TR_XM_PHPDW 2323 0.80 1.44 0.50 134 XMGenDplmaNmb 2323 1.06 1.44 0.88 135 AC_BR_BONANZA 2297 0.55 1.43 0.13 136 TR_XM_FormFill2 2280 0.79 1.42 0.50 137 XM_H_PHPOS 2246 0.78 1.39 0.48 138 BAYES_40 2235 3.58 1.39 4.61 139 XM_HighProb1 2205 0.44 1.37 0.00 140 DKIM_ADSP_NXDOMAIN 2132 0.63 1.32 0.30 141 XMSubMetaI_00 2131 0.83 1.32 0.59 142 T_XMDrugObfuBody_00 2099 0.84 1.30 0.63 143 TR_XM_InvalidRelay 2080 0.43 1.29 0.03 144 DKIM_ADSP_CUSTOM_MED 1971 0.98 1.22 0.87 145 XMHTML_After_End 1971 0.64 1.22 0.36 146 URI_NOVOWEL 1931 1.23 1.20 1.24 147 XMPhish30 1915 0.67 1.19 0.43 148 XM_H_Undi_Recip 1869 0.55 1.16 0.26 149 HTML_TAG_BALANCE_BODY 1865 0.75 1.16 0.56 150 THIS_AD 1804 0.63 1.12 0.40 151 XMReplyNow 1791 0.53 1.11 0.26 152 XM_DIRTYINTL 1786 0.41 1.11 0.08 153 RCVD_IN_IADB_LISTED 1775 2.72 1.10 3.48 154 XM_SendGrid 1757 1.33 1.09 1.44 155 XM_B_COPY_HTML 1748 0.72 1.09 0.54 156 NML_ADSP_CUSTOM_MED 1734 0.76 1.08 0.61 157 XMPhish14 1704 0.61 1.06 0.40 158 XM_B_Phish66 1704 0.53 1.06 0.28 159 TR_Caps_n_Bayes_99 1680 0.35 1.04 0.03 160 BAYES_20 1672 2.60 1.04 3.33 161 TR_Symld_Words 1671 1.47 1.04 1.67 162 TooManyTo_002 1639 2.17 1.02 2.71 163 BOTNET_NORDNS 1628 0.33 1.01 0.00 164 XM_UB99 1589 0.32 0.99 0.01 165 XMSexyCombo_01 1580 0.42 0.98 0.16 166 T_STY_INVIS_DIRECT 1542 0.53 0.96 0.32 167 DIET_1 1540 0.51 0.96 0.30 168 XMBdyGiftCard01 1536 0.83 0.95 0.78 169 RCVD_IN_IADB_SPF 1528 2.41 0.95 3.09 170 TR_XM_Undi_Recip19 1526 0.36 0.95 0.08 171 XMNoVowels 1501 0.76 0.93 0.67 172 XM_Combo_Sbj 1498 0.45 0.93 0.22 173 TooManyTo_003 1475 1.40 0.92 1.64 174 RELAYCOUNTRY_FR 1471 0.47 0.91 0.26 175 MPART_ALT_DIFF_COUNT 1463 0.68 0.91 0.57 176 T_MONEY_PERCENT 1462 0.45 0.91 0.23 177 TR_LOTS_OF_MONEY2 1462 0.45 0.91 0.23 178 T_TooManySym_02 1456 2.14 0.90 2.73 179 RCVD_IN_IADB_SENDERID 1416 2.16 0.88 2.76 180 RCVD_IN_IADB_DK 1394 2.11 0.87 2.69 181 XMSubMetaSxObfu_03 1381 0.59 0.86 0.46 182 XM_UB60 1370 0.32 0.85 0.07 183 XM_H_Long_From02 1369 1.01 0.85 1.08 184 TooManyTo_004 1365 1.08 0.85 1.19 185 XM_B_DNDMA 1363 0.78 0.85 0.74 186 TR_XM_RelayPhish 1356 0.30 0.84 0.04 187 RELAYCOUNTRY_DE 1348 0.51 0.84 0.36 188 RDNS_DYNAMIC 1348 0.47 0.84 0.30 189 SCC_BODY_URI_ONLY 1347 1.92 0.84 2.43 190 RELAYCOUNTRY_IN 1343 0.33 0.83 0.09 191 XMLngstWrd_00 1319 0.84 0.82 0.85 192 TooManyTo_005 1308 0.92 0.81 0.97 193 HTML_FONT_FACE_BAD 1267 0.56 0.79 0.46 194 TM2_M_OBFU_COMMENT 1260 0.48 0.78 0.34 195 TR_XM_Undi_RecipCombo2 1255 0.26 0.78 0.01 196 PDS_OTHER_BAD_TLD 1248 0.34 0.78 0.13 197 XM_UB999 1235 0.25 0.77 0.00 198 XM_ShortIntro_01 1209 0.76 0.75 0.77 199 TVD_RCVD_IP 1201 1.14 0.75 1.33 200 TR_MetaPhish_Combo_01 1200 0.68 0.75 0.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 338834 99.51 99.80 99.37 2 HTML_MESSAGE 293663 89.30 96.01 86.12 3 RELAYCOUNTRY_US 276092 79.84 77.46 80.97 4 DKIM_SIGNED 257161 80.55 91.41 75.42 5 XM_DK_Pass 252350 78.48 87.96 74.01 6 DKIM_VALID 248716 77.35 86.70 72.94 7 XM_B_Unicode 233714 73.58 84.25 68.54 8 DCC_CHECK_NEGATIVE 228474 54.35 27.55 67.00 9 BAYES_50 201166 51.80 36.56 59.00 10 DKIM_VALID_AU 201091 60.89 64.95 58.97 11 XMListUnsubscribeExists 170113 57.74 74.35 49.89 12 XM_B_SpammyWords 150268 53.49 73.45 44.07 13 XM_B_Unicode3 135247 40.94 43.65 39.66 14 DCC_CHECK 112292 45.61 72.44 32.93 15 T_TM2_M_HEADER_IN_MSG 107291 28.97 23.67 31.47 16 DKIM_VALID_EF 102422 30.43 31.25 30.04 17 RCVD_IN_MSPIKE_H2 102329 30.56 31.74 30.01 18 HTML_FONT_LOW_CONTRAST 92864 29.43 34.09 27.23 19 FVGT_m_MULTI_ODD 89384 28.48 33.29 26.21 20 LOC_TINY_FONT_1 87527 29.78 38.48 25.67 21 XMSubLong 78189 22.15 20.48 22.93 22 T_KAM_HTML_FONT_INVALID 68520 22.94 28.96 20.09 23 XM_B_SpammyWords2 64946 27.27 44.69 19.05 24 MIME_HTML_ONLY 62173 21.62 28.78 18.23 25 ALL_TRUSTED 51427 10.82 1.78 15.08 26 TR_XM_DK_Unsub 48493 17.16 23.40 14.22 27 USER_IN_DEF_DKIM_WL 45966 9.92 2.37 13.48 28 XM_Multi_Part_URI 43472 14.34 17.71 12.75 29 UNPARSEABLE_RELAY 36148 11.19 12.43 10.60 30 BAYES_60 33348 9.49 8.86 9.78 31 BAYES_00 32111 6.58 0.56 9.42 32 TooManyTo_001 29894 7.54 4.93 8.77 33 LotsOfNums_01 28638 7.73 6.31 8.40 34 XM_Evil_Numbers_Gen 27663 8.12 8.12 8.11 35 XM_B_Unsub 26801 9.78 13.85 7.86 36 XM_DKIMWhitelistDomains 25628 5.11 0.02 7.52 37 IN_ZIMBRA_NJ_WHITELIST 23487 4.70 0.08 6.89 38 TR_MAX_INTL_RELAY 23482 9.77 15.86 6.89 39 LOTS_OF_MONEY 22377 9.18 14.72 6.56 40 TR_XM_DK_Bayes 22094 4.53 0.41 6.48 41 XM_H_GMP 22068 5.99 4.97 6.47 42 TR_XM_DK_Bayes1 21744 4.46 0.40 6.38 43 TR_XM_BayesUnsub 21639 8.59 13.33 6.35 44 RCVD_IN_MSPIKE_H3 20460 7.15 9.58 6.00 45 RCVD_IN_MSPIKE_WL 20460 7.15 9.58 6.00 46 XM_DK_Undo_02 19895 18.57 45.52 5.83 47 T_TooManySym_01 19204 4.70 2.73 5.63 48 TR_XM_DK_Bayes2 18802 3.85 0.33 5.51 49 XM_H_Long_From01 18047 4.97 4.29 5.29 50 MIME_QP_LONG_LINE 17692 4.44 2.84 5.19 51 RCVD_IN_VALIDITY_SAFE 17372 4.21 2.35 5.09 52 XM_B_SpammyWords3 16928 8.29 15.34 4.96 53 BAYES_99 16751 14.75 35.57 4.91 54 XM_PDF 16254 3.45 0.67 4.77 55 RELAYCOUNTRY_META 16213 10.53 22.75 4.75 56 BAYES_40 15720 3.58 1.39 4.61 57 TR_XM_SpammyWords4 15407 7.35 13.34 4.52 58 RCVD_IN_VALIDITY_CERTIFIED 15082 3.59 1.82 4.42 59 HTML_IMAGE_RATIO_02 14960 4.69 5.33 4.39 60 XMStrtUSub 14931 4.12 3.57 4.38 61 HTML_IMAGE_RATIO_04 14744 4.52 4.95 4.32 62 BAYES_80 14141 5.95 9.78 4.15 63 BOTNET_IPINHOSTNAME 13126 6.77 12.94 3.85 64 XM_UncommonTLD01 12948 4.85 7.09 3.80 65 XMSubMetaSx_00 12692 4.37 5.75 3.72 66 BAYES_999 12450 11.30 27.48 3.65 67 T_REMOTE_IMAGE 12349 2.95 1.52 3.62 68 ANY_BOUNCE_MESSAGE 11983 2.99 1.88 3.51 69 BOUNCE_MESSAGE 11982 2.99 1.87 3.51 70 RCVD_IN_IADB_LISTED 11873 2.72 1.10 3.48 71 XM_SPF_SoftFail 11457 3.87 4.95 3.36 72 XM_CamelCaseFrm001 11380 3.14 2.74 3.34 73 BAYES_20 11371 2.60 1.04 3.33 74 MPART_ALT_DIFF 10658 3.88 5.47 3.13 75 RCVD_IN_IADB_SPF 10553 2.41 0.95 3.09 76 HTML_IMAGE_RATIO_06 10504 3.42 4.15 3.08 77 FSL_BULK_SIG 10278 4.17 6.63 3.01 78 XM_B_Phish_Phrases 10028 3.52 4.74 2.94 79 XM_Body_Dirty_Words 9959 4.11 6.61 2.92 80 XMNumbers 9817 3.02 3.32 2.88 81 RCVD_IN_IADB_SENDERID 9419 2.16 0.88 2.76 82 MAILING_LIST_MULTI 9359 2.40 1.66 2.74 83 BAYES_95 9329 3.68 5.67 2.74 84 T_TooManySym_02 9312 2.14 0.90 2.73 85 TooManyTo_002 9242 2.17 1.02 2.71 86 RCVD_IN_IADB_DK 9179 2.11 0.87 2.69 87 TR_XM_SpammyRelay 8976 7.64 18.25 2.63 88 TR_XM_DKIM_Undo 8814 12.99 35.03 2.58 89 DKIM_INVALID 8445 3.19 4.72 2.48 90 SCC_BODY_URI_ONLY 8281 1.92 0.84 2.43 91 HTML_IMAGE_RATIO_08 7810 2.65 3.40 2.29 92 HTML_MIME_NO_HTML_TAG 7664 2.05 1.64 2.25 93 RCVD_IN_IADB_VOUCHED 7578 1.70 0.61 2.22 94 XM_B_SpammyTLD 7373 2.74 3.98 2.16 95 MIME_HTML_MOSTLY 7369 2.60 3.54 2.16 96 HELO_NODOT 7193 1.55 0.35 2.11 97 HELO_NO_DOMAIN 7186 1.54 0.35 2.11 98 XM_DK_Undo_01 7128 1.91 1.53 2.09 99 BAYES_05 7039 1.59 0.57 2.06 100 INVALID_MSGID 7013 1.44 0.15 2.06 101 TO_MALFORMED 6763 1.35 0.01 1.98 102 XMDiploma_00 6194 2.19 2.99 1.82 103 RELAYCOUNTRY_CA 5996 5.42 13.17 1.76 104 T_XMDrugObfuBody_14 5821 2.36 3.74 1.71 105 TM2_M_URI_OPT_OUT 5802 1.94 2.45 1.70 106 UNTRUSTED_Relay 5791 3.09 6.04 1.70 107 TR_Symld_Words 5688 1.47 1.04 1.67 108 MIME_HTML_ONLY_MULTI 5680 2.07 2.93 1.67 109 TR_XM_UnparsRelay 5584 3.30 6.82 1.64 110 TooManyTo_003 5577 1.40 0.92 1.64 111 SUBJ_ALL_CAPS 5573 1.91 2.50 1.63 112 TR_DCC_Bayes_99 5515 9.12 25.00 1.62 113 RCVD_IN_IADB_OPTIN 5361 1.20 0.41 1.57 114 TM2_M_VERY_LONG_WORD 5259 2.05 3.12 1.54 115 XM_B_Investor 5136 2.52 4.67 1.51 116 IN_HORDE_ADDRESS_BOOK 5131 1.04 0.05 1.50 117 FROM_EXCESS_BASE64 5008 1.48 1.50 1.47 118 XM_B_Unsub2 4963 1.67 2.11 1.46 119 XM_SendGrid 4924 1.33 1.09 1.44 120 XMSexyCombo_05 4904 2.21 3.85 1.44 121 T_XMDrugObfuBody_08 4794 2.04 3.40 1.41 122 KHOP_HELO_FCRDNS 4681 1.40 1.45 1.37 123 TR_XM_SpammyWords5 4638 2.19 3.93 1.36 124 TVD_RCVD_IP 4538 1.14 0.75 1.33 125 TR_XM_PhishingBody 4457 2.17 4.00 1.31 126 URI_NOVOWEL 4226 1.23 1.20 1.24 127 XM_B_SEO 4062 2.40 4.96 1.19 128 TooManyTo_004 4051 1.08 0.85 1.19 129 XM_GoogleGroups 3954 0.96 0.55 1.16 130 XMStockSpam_06 3912 1.39 1.91 1.15 131 BOTNET 3872 3.59 8.80 1.14 132 XMCapTrack 3866 0.93 0.49 1.13 133 XM_OfRef6 3777 2.35 4.97 1.11 134 XMGappySubj_01 3756 0.80 0.15 1.10 135 XMBSHREFv2 3742 0.85 0.31 1.10 136 TVD_SPACE_RATIO 3736 0.78 0.11 1.10 137 XM_H_Long_From02 3680 1.01 0.85 1.08 138 T_XMHurry_00 3659 1.32 1.85 1.07 139 XM_ProductURIs 3574 0.91 0.63 1.05 140 T_FILL_THIS_FORM_SHORT 3553 1.96 3.91 1.04 141 XM_UB50 3500 1.64 2.94 1.03 142 XMBrknScrpt_02 3495 1.25 1.73 1.02 143 T_TooManySym_03 3405 0.78 0.31 1.00 144 TooManyTo_005 3305 0.92 0.81 0.97 145 URI_HEX 3281 1.12 1.44 0.96 146 TR_XM_DK_SendGrid 3248 0.86 0.66 0.95 147 XMGenDplmaNmb 2989 1.06 1.44 0.88 148 DKIM_ADSP_CUSTOM_MED 2965 0.98 1.22 0.87 149 XMLngstWrd_00 2909 0.84 0.82 0.85 150 HTTPS_HTTP_MISMATCH 2870 1.11 1.69 0.84 151 XMBdyGiftCard01 2647 0.83 0.95 0.78 152 XM_ShortIntro_01 2629 0.76 0.75 0.77 153 XM_B_SpammyWords4 2618 1.17 2.02 0.77 154 HTML_IMAGE_ONLY_32 2584 0.56 0.15 0.76 155 XM_B_DNDMA 2540 0.78 0.85 0.74 156 URI_TRY_3LD 2535 1.16 2.04 0.74 157 RCVD_IN_BL_SPAMCOP_NET 2518 4.72 13.16 0.74 158 XMGappySubj_02 2518 0.52 0.05 0.74 159 TR_XM_SEO4 2478 1.87 4.29 0.73 160 SpammyFromTLD_01 2455 1.39 2.81 0.72 161 RELAYCOUNTRY_AU 2416 1.15 2.10 0.71 162 XM_H_PHPMailer 2325 0.67 0.65 0.68 163 XMNoVowels 2295 0.76 0.93 0.67 164 TR_MetaPhish_Combo_01 2222 0.68 0.75 0.65 165 XMBody_17 2219 3.10 8.29 0.65 166 SHORT_HELO_AND_INLINE_IMAGE 2201 0.46 0.07 0.65 167 XMBody_95 2155 0.47 0.13 0.63 168 T_OBFU_PDF_ATTACH 2141 0.46 0.09 0.63 169 T_XMDrugObfuBody_00 2138 0.84 1.30 0.63 170 TR_XM_Base64_M1 2113 0.63 0.65 0.62 171 NML_ADSP_CUSTOM_MED 2078 0.76 1.08 0.61 172 XMSubMetaI_00 2027 0.83 1.32 0.59 173 XM_RXBody 2002 0.51 0.34 0.59 174 MPART_ALT_DIFF_COUNT 1929 0.68 0.91 0.57 175 HTML_TAG_BALANCE_BODY 1921 0.75 1.16 0.56 176 TR_XM_SpammyWords2 1879 5.22 15.12 0.55 177 XM_B_COPY_HTML 1853 0.72 1.09 0.54 178 FROM_GOV_DKIM_AU 1829 0.41 0.14 0.54 179 XMDateMe_00 1826 0.48 0.38 0.54 180 USER_IN_WHITELIST 1787 0.36 0.00 0.52 181 USER_IN_WELCOMELIST 1787 0.36 0.00 0.52 182 XMMoneyMeta_00 1717 0.57 0.71 0.50 183 TR_XM_PHPDW 1697 0.80 1.44 0.50 184 TR_XM_FormFill2 1697 0.79 1.42 0.50 185 FROM_GOV_SPOOF 1696 0.36 0.06 0.50 186 TR_LOTS_OF_MONEY3 1691 1.51 3.65 0.50 187 TR_XM_PHPForged 1683 0.81 1.49 0.49 188 FORGED_GMAIL_RCVD 1682 0.57 0.74 0.49 189 LongTLD 1677 0.94 1.87 0.49 190 XM_B_FormFill 1661 0.36 0.10 0.49 191 XM_H_PHPOS 1652 0.78 1.39 0.48 192 HTML_IMAGE_ONLY_20 1629 0.46 0.41 0.48 193 RELAYCOUNTRY_GB 1618 0.53 0.65 0.47 194 XMSubMetaSxObfu_02 1596 0.40 0.25 0.47 195 TM2_M_A_HREF_HREF 1580 1.01 2.16 0.46 196 XMSubMetaSxObfu_03 1571 0.59 0.86 0.46 197 TM2_M_BODY_EMPTY 1565 0.35 0.10 0.46 198 HTML_FONT_FACE_BAD 1559 0.56 0.79 0.46 199 FILL_THIS_FORM 1535 0.40 0.28 0.45 200 MISSING_HEADERS 1532 0.45 0.45 0.45 ----------------------------------------------------------------------