Email: 575147 Autolearn: 0 AvgScore: 4.39 AvgScanTime: 1.30 sec Spam: 177287 Autolearn: 0 AvgScore: 13.68 AvgScanTime: 1.48 sec Ham: 397860 Autolearn: 0 AvgScore: 0.26 AvgScanTime: 1.22 sec Time Spent Running SA: 207.97 hours Time Spent Processing Spam: 72.77 hours Time Spent Processing Ham: 135.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 172370 89.81 97.23 86.51 2 DKIM_SIGNED 160180 74.31 90.35 67.16 3 XM_DK_Pass 153484 72.28 86.57 65.91 4 DKIM_VALID 151392 71.26 85.39 64.97 5 XM_B_Unicode 150013 75.63 84.62 71.62 6 RELAYCOUNTRY_US 138854 73.99 78.32 72.06 7 XMListUnsubscribeExists 131391 54.25 74.11 45.40 8 XM_B_SpammyWords 129256 51.88 72.91 42.51 9 DCC_CHECK 128137 43.24 72.28 30.31 10 DKIM_VALID_AU 112073 55.83 63.22 52.53 11 XM_DK_Undo_02 81226 17.54 45.82 4.93 12 XM_B_SpammyWords2 76841 27.39 43.34 20.29 13 XM_B_Unicode3 76072 42.77 42.91 42.71 14 BAYES_50 68680 56.25 38.74 64.05 15 LOC_TINY_FONT_1 68480 27.61 38.63 22.69 16 HTML_FONT_LOW_CONTRAST 64080 28.63 36.14 25.28 17 TR_XM_DKIM_Undo 62939 12.32 35.50 1.99 18 BAYES_99 62216 13.33 35.09 3.64 19 RCVD_IN_MSPIKE_H2 58756 28.59 33.14 26.56 20 FVGT_m_MULTI_ODD 57906 26.02 32.66 23.06 21 DKIM_VALID_EF 56290 27.69 31.75 25.88 22 MIME_HTML_ONLY 55842 26.22 31.50 23.87 23 T_KAM_HTML_FONT_INVALID 52362 22.58 29.54 19.49 24 DCC_CHECK_NEGATIVE 49127 56.73 27.71 69.66 25 BAYES_999 48114 10.27 27.14 2.76 26 TR_DCC_Bayes_99 44512 8.50 25.11 1.11 27 T_TM2_M_HEADER_IN_MSG 42030 27.65 23.71 29.40 28 TR_XM_DK_Unsub 41897 15.92 23.63 12.48 29 XMSubLong 40183 27.70 22.67 29.95 30 RELAYCOUNTRY_META 38495 9.30 21.71 3.78 31 XM_Multi_Part_URI 36315 14.74 20.48 12.18 32 LOTS_OF_MONEY 29692 10.46 16.75 7.66 33 TR_XM_SpammyRelay 28908 6.41 16.31 2.00 34 RCVD_IN_BL_SPAMCOP_NET 26677 5.22 15.05 0.84 35 XM_B_Unsub 26675 14.26 15.05 13.90 36 TR_XM_SpammyWords2 26624 4.93 15.02 0.44 37 TR_XM_SpammyWords4 26600 8.75 15.00 5.96 38 TR_MAX_INTL_RELAY 26575 8.76 14.99 5.98 39 TR_XM_BayesUnsub 25727 13.22 14.51 12.65 40 XM_B_SpammyWords3 25592 7.56 14.44 4.49 41 UNPARSEABLE_RELAY 23425 10.38 13.21 9.12 42 TR_XM_SPAMCOP 23383 4.40 13.19 0.48 43 BOTNET_IPINHOSTNAME 22168 6.25 12.50 3.47 44 RELAYCOUNTRY_CA 19644 4.28 11.08 1.25 45 BOTNET 18497 4.00 10.43 1.13 46 BAYES_80 16210 5.35 9.14 3.66 47 RCVD_IN_MSPIKE_WL 16094 6.53 9.08 5.39 48 RCVD_IN_MSPIKE_H3 16094 6.53 9.08 5.39 49 XM_Evil_Numbers_Gen 15134 7.10 8.54 6.46 50 XMBody_17 13699 2.90 7.73 0.75 51 BAYES_60 13610 8.06 7.68 8.22 52 UNTRUSTED_Relay 13059 3.24 7.37 1.41 53 FSL_BULK_SIG 12730 4.21 7.18 2.88 54 TR_XM_UnparsRelay 12639 3.21 7.13 1.46 55 LotsOfNums_01 12197 7.32 6.88 7.51 56 XMSubMetaSx_00 11374 4.07 6.42 3.02 57 MPART_ALT_DIFF 10568 4.23 5.96 3.45 58 XM_Body_Dirty_Words 10313 3.44 5.82 2.38 59 XM_B_PhoneNumber 10051 7.96 5.67 8.98 60 TooManyTo_001 9996 11.89 5.64 14.67 61 BAYES_95 9750 3.30 5.50 2.32 62 XM_UncommonTLD01 9409 3.97 5.31 3.38 63 XM_B_SEO 9087 2.48 5.13 1.30 64 DKIM_INVALID 8788 3.04 4.96 2.19 65 XM_OfRef6 8751 2.29 4.94 1.11 66 XM_B_Phish_Phrases 8627 3.69 4.87 3.16 67 XM_H_Long_From01 8620 4.81 4.86 4.79 68 HTML_IMAGE_RATIO_04 8376 3.75 4.72 3.31 69 XM_SPF_SoftFail 8314 3.53 4.69 3.02 70 XM_H_GMP 8229 5.27 4.64 5.55 71 HTML_IMAGE_RATIO_02 8142 4.26 4.59 4.12 72 XM_B_Investor 8112 2.55 4.58 1.65 73 TR_XM_SEO4 8043 1.96 4.54 0.81 74 RCVD_IN_VALIDITY_RPBL 7858 1.56 4.43 0.28 75 XMSexyCombo_05 7789 2.33 4.39 1.41 76 XM_UB50 7699 1.92 4.34 0.84 77 HTML_IMAGE_RATIO_06 7695 3.20 4.34 2.69 78 MIME_QP_LONG_LINE 7547 4.51 4.26 4.63 79 TR_LOTS_OF_MONEY3 7511 1.79 4.24 0.70 80 TR_XM_SpammyWords5 7236 2.03 4.08 1.12 81 XMStrtUSub 7159 4.16 4.04 4.21 82 TR_XM_PhishingBody 7134 2.29 4.02 1.52 83 T_XMDrugObfuBody_14 6655 2.31 3.75 1.67 84 T_FILL_THIS_FORM_SHORT 6445 1.65 3.64 0.77 85 HTML_IMAGE_RATIO_08 6142 2.60 3.46 2.22 86 XMNumbers 6060 2.83 3.42 2.57 87 TM2_M_VERY_LONG_WORD 6012 1.87 3.39 1.19 88 XMDiploma_00 5818 7.03 3.28 8.69 89 XM_B_SpammyTLD 5704 2.40 3.22 2.04 90 T_XMDrugObfuBody_08 5545 1.81 3.13 1.22 91 SUBJ_ALL_CAPS 5362 1.92 3.02 1.42 92 MIME_HTML_MOSTLY 5338 2.31 3.01 2.00 93 TR_XM_BayesRelay 5318 0.93 3.00 0.00 94 HTML_MIME_NO_HTML_TAG 5242 2.29 2.96 1.99 95 MIME_HTML_ONLY_MULTI 5108 2.07 2.88 1.70 96 TM2_M_URI_OPT_OUT 4920 1.95 2.78 1.58 97 FONT_INVIS_LONG_LINE 4894 0.88 2.76 0.04 98 XM_CamelCaseFrm001 4561 2.05 2.57 1.81 99 BOUNCE_MESSAGE 4453 2.76 2.51 2.87 100 ANY_BOUNCE_MESSAGE 4453 2.76 2.51 2.87 101 TR_XM_NoHeaderRelay 4419 0.83 2.49 0.09 102 XM_URI_RBL 4385 0.85 2.47 0.13 103 TR_XM_FormFill 4228 0.75 2.38 0.02 104 RCVD_IN_VALIDITY_SAFE 4177 3.78 2.36 4.41 105 XMBrknScrpt_02 4128 1.28 2.33 0.82 106 XM_B_SpammyWords4 4108 1.35 2.32 0.92 107 RELAYCOUNTRY_AU 4028 1.12 2.27 0.60 108 USER_IN_DEF_DKIM_WL 3985 8.86 2.25 11.81 109 XM_B_Unsub2 3897 1.66 2.20 1.42 110 DKIM_ADSP_NXDOMAIN 3823 0.88 2.16 0.31 111 HOSTED_IMG_MULTI_PUB_01 3768 0.67 2.13 0.02 112 T_TooManySym_01 3750 5.69 2.12 7.29 113 T_XMDrugObfuBody_00 3677 1.15 2.07 0.73 114 T_XMHurry_00 3651 1.00 2.06 0.53 115 MAILING_LIST_MULTI 3527 2.37 1.99 2.53 116 SpammyFromTLD_01 3517 1.14 1.98 0.76 117 T_REMOTE_IMAGE 3374 2.87 1.90 3.30 118 RCVD_IN_VALIDITY_CERTIFIED 3329 3.24 1.88 3.85 119 URI_TRY_3LD 3326 1.04 1.88 0.66 120 TR_XM_INV_DKIM 3302 0.62 1.86 0.06 121 URIBL_DBL_SPAM 3159 0.55 1.78 0.00 122 HTTPS_HTTP_MISMATCH 3075 1.10 1.73 0.81 123 XM_DK_Undo_01 2985 1.65 1.68 1.64 124 XMStockSpam_06 2944 1.01 1.66 0.73 125 FROM_EXCESS_BASE64 2902 1.67 1.64 1.69 126 BAYES_40 2815 4.05 1.59 5.15 127 HK_RANDOM_REPLYTO 2751 0.54 1.55 0.09 128 RCVD_IN_IADB_LISTED 2620 2.73 1.48 3.28 129 XMGenDplmaNmb 2603 1.03 1.47 0.83 130 URI_HEX 2509 1.08 1.42 0.93 131 THIS_AD 2483 0.68 1.40 0.36 132 ALL_TRUSTED 2465 17.66 1.39 24.91 133 XM_SendGrid 2461 1.25 1.39 1.19 134 RCVD_IN_IADB_SPF 2423 2.42 1.37 2.89 135 SpammyFromTLD_02 2402 0.70 1.35 0.41 136 HTML_FONT_SIZE_LARGE 2345 0.45 1.32 0.07 137 AC_BR_BONANZA 2339 0.47 1.32 0.09 138 TR_XM_PHPForged 2330 0.62 1.31 0.31 139 RCVD_IN_IADB_DK 2314 2.15 1.31 2.52 140 XMBdyGiftCard01 2307 0.82 1.30 0.60 141 RCVD_IN_IADB_SENDERID 2305 2.20 1.30 2.60 142 TR_XM_PHPDW 2278 0.61 1.28 0.31 143 BOTNET_NORDNS 2265 0.40 1.28 0.01 144 XMPhish30 2250 0.74 1.27 0.51 145 HTML_IMAGE_ONLY_08 2247 0.47 1.27 0.11 146 TR_XM_FormFill2 2225 0.60 1.26 0.31 147 XM_H_PHPOS 2203 0.59 1.24 0.30 148 XM_H_Undi_Recip 2166 0.53 1.22 0.22 149 MIME_HEADER_CTYPE_ONLY 2158 0.46 1.22 0.12 150 XM_HighProb1 2153 0.38 1.21 0.00 151 HTML_SHORT_LINK_IMG_1 2139 0.38 1.21 0.01 152 XMReplyNow 2114 0.54 1.19 0.25 153 DKIM_ADSP_CUSTOM_MED 2097 0.91 1.18 0.79 154 T_MONEY_PERCENT 2093 0.58 1.18 0.31 155 TR_LOTS_OF_MONEY2 2093 0.58 1.18 0.31 156 XMHTML_After_End 2080 0.74 1.17 0.55 157 SHORTENER_SHORT_IMG 2076 0.36 1.17 0.00 158 RELAYCOUNTRY_HU 2072 0.36 1.17 0.00 159 URI_NOVOWEL 2038 1.12 1.15 1.11 160 XMBounce_01 1983 0.36 1.12 0.02 161 TR_Symld_Words 1971 1.37 1.11 1.48 162 HTML_TAG_BALANCE_BODY 1971 0.71 1.11 0.53 163 TR_Caps_n_Bayes_99 1943 0.35 1.10 0.02 164 TR_Mismatch_TLD_02 1928 0.38 1.09 0.07 165 BAYES_20 1880 2.57 1.06 3.24 166 RELAYCOUNTRY_FR 1858 0.47 1.05 0.21 167 XMPhish14 1811 0.63 1.02 0.46 168 T_STY_INVIS_DIRECT 1805 0.50 1.02 0.27 169 NML_ADSP_CUSTOM_MED 1797 0.71 1.01 0.57 170 TR_XM_Undi_Recip19 1784 0.37 1.01 0.09 171 RELAYCOUNTRY_CN 1728 0.36 0.97 0.08 172 LongTLD 1711 0.49 0.97 0.28 173 PLING_QUERY 1709 0.68 0.96 0.56 174 KHOP_HELO_FCRDNS 1694 1.05 0.96 1.09 175 XM_B_Phish66 1687 0.52 0.95 0.32 176 XM_UB99 1681 0.30 0.95 0.01 177 TooManyTo_002 1674 1.98 0.94 2.44 178 XM_H_Long_From02 1664 1.00 0.94 1.03 179 XMSubMetaI_00 1664 0.53 0.94 0.34 180 TM2_M_OBFU_COMMENT 1630 0.48 0.92 0.29 181 XM_B_COPY_HTML 1619 0.78 0.91 0.73 182 TR_XM_InvalidRelay 1616 0.30 0.91 0.03 183 MPART_ALT_DIFF_COUNT 1582 0.61 0.89 0.48 184 RELAYCOUNTRY_GB 1575 0.55 0.89 0.39 185 TR_XM_Undi_RecipCombo2 1574 0.28 0.89 0.01 186 T_XMDrugObfuBody_10 1572 0.28 0.89 0.02 187 TR_MetaPhish_Combo_01 1570 0.76 0.89 0.70 188 HTML_IMAGE_ONLY_20 1559 0.52 0.88 0.37 189 TR_Mismatch_TLD_01 1542 0.40 0.87 0.19 190 XM_OfRef7 1519 0.37 0.86 0.15 191 FORGED_GMAIL_RCVD 1504 0.57 0.85 0.45 192 TR_XM_Base64_M1 1486 0.78 0.84 0.75 193 TooManyTo_003 1477 1.16 0.83 1.30 194 XMBody_78 1471 0.42 0.83 0.23 195 RDNS_DYNAMIC 1448 0.45 0.82 0.29 196 XMSexyCombo_01 1444 0.34 0.81 0.12 197 TR_XM_Spammywords 1417 0.40 0.80 0.23 198 XM_S_SpammyWords 1417 0.40 0.80 0.23 199 XMMoneyMeta_00 1415 0.57 0.80 0.47 200 XM_ProductURIs 1407 0.57 0.79 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 344175 89.81 97.23 86.51 2 RELAYCOUNTRY_US 286696 73.99 78.32 72.06 3 XM_B_Unicode 284944 75.63 84.62 71.62 4 DCC_CHECK_NEGATIVE 277140 56.73 27.71 69.66 5 DKIM_SIGNED 267191 74.31 90.35 67.16 6 XM_DK_Pass 262229 72.28 86.57 65.91 7 DKIM_VALID 258478 71.26 85.39 64.97 8 BAYES_50 254818 56.25 38.74 64.05 9 DKIM_VALID_AU 209012 55.83 63.22 52.53 10 XMListUnsubscribeExists 180634 54.25 74.11 45.40 11 XM_B_Unicode3 169931 42.77 42.91 42.71 12 XM_B_SpammyWords 169137 51.88 72.91 42.51 13 DCC_CHECK 120572 43.24 72.28 30.31 14 XMSubLong 119152 27.70 22.67 29.95 15 T_TM2_M_HEADER_IN_MSG 116980 27.65 23.71 29.40 16 RCVD_IN_MSPIKE_H2 105664 28.59 33.14 26.56 17 DKIM_VALID_EF 102983 27.69 31.75 25.88 18 HTML_FONT_LOW_CONTRAST 100583 28.63 36.14 25.28 19 ALL_TRUSTED 99121 17.66 1.39 24.91 20 MIME_HTML_ONLY 94951 26.22 31.50 23.87 21 FVGT_m_MULTI_ODD 91743 26.02 32.66 23.06 22 LOC_TINY_FONT_1 90293 27.61 38.63 22.69 23 XM_B_SpammyWords2 80715 27.39 43.34 20.29 24 T_KAM_HTML_FONT_INVALID 77532 22.58 29.54 19.49 25 TooManyTo_001 58379 11.89 5.64 14.67 26 XM_B_Unsub 55318 14.26 15.05 13.90 27 TR_XM_BayesUnsub 50335 13.22 14.51 12.65 28 TR_XM_DK_Unsub 49655 15.92 23.63 12.48 29 XM_Multi_Part_URI 48450 14.74 20.48 12.18 30 USER_IN_DEF_DKIM_WL 46995 8.86 2.25 11.81 31 UNPARSEABLE_RELAY 36295 10.38 13.21 9.12 32 XM_B_PhoneNumber 35711 7.96 5.67 8.98 33 XMDiploma_00 34589 7.03 3.28 8.69 34 BAYES_60 32720 8.06 7.68 8.22 35 BAYES_00 31692 5.71 0.65 7.97 36 LOTS_OF_MONEY 30476 10.46 16.75 7.66 37 LotsOfNums_01 29882 7.32 6.88 7.51 38 T_TooManySym_01 28997 5.69 2.12 7.29 39 XM_DKIMWhitelistDomains 26093 4.68 0.46 6.56 40 XM_Evil_Numbers_Gen 25688 7.10 8.54 6.46 41 IN_ZIMBRA_NJ_WHITELIST 24553 4.29 0.08 6.17 42 TR_MAX_INTL_RELAY 23782 8.76 14.99 5.98 43 TR_XM_SpammyWords4 23702 8.75 15.00 5.96 44 TR_XM_DK_Bayes 22183 4.01 0.49 5.58 45 XM_H_GMP 22093 5.27 4.64 5.55 46 TR_XM_DK_Bayes1 21861 3.95 0.49 5.49 47 RCVD_IN_MSPIKE_H3 21462 6.53 9.08 5.39 48 RCVD_IN_MSPIKE_WL 21462 6.53 9.08 5.39 49 BAYES_40 20502 4.05 1.59 5.15 50 XM_DK_Undo_02 19627 17.54 45.82 4.93 51 XM_H_Long_From01 19065 4.81 4.86 4.79 52 TR_XM_DK_Bayes2 18943 3.43 0.43 4.76 53 MIME_QP_LONG_LINE 18420 4.51 4.26 4.63 54 XM_B_SpammyWords3 17871 7.56 14.44 4.49 55 RCVD_IN_VALIDITY_SAFE 17536 3.78 2.36 4.41 56 XMStrtUSub 16768 4.16 4.04 4.21 57 HTML_IMAGE_RATIO_02 16376 4.26 4.59 4.12 58 XM_PDF 15623 2.91 0.63 3.93 59 RCVD_IN_VALIDITY_CERTIFIED 15333 3.24 1.88 3.85 60 RELAYCOUNTRY_META 15021 9.30 21.71 3.78 61 BAYES_80 14545 5.35 9.14 3.66 62 BAYES_99 14477 13.33 35.09 3.64 63 BOTNET_IPINHOSTNAME 13790 6.25 12.50 3.47 64 MPART_ALT_DIFF 13746 4.23 5.96 3.45 65 XM_UncommonTLD01 13443 3.97 5.31 3.38 66 HTML_IMAGE_RATIO_04 13169 3.75 4.72 3.31 67 T_REMOTE_IMAGE 13131 2.87 1.90 3.30 68 RCVD_IN_IADB_LISTED 13062 2.73 1.48 3.28 69 BAYES_20 12881 2.57 1.06 3.24 70 XM_B_Phish_Phrases 12569 3.69 4.87 3.16 71 XM_SPF_SoftFail 12016 3.53 4.69 3.02 72 XMSubMetaSx_00 12006 4.07 6.42 3.02 73 RCVD_IN_IADB_SPF 11497 2.42 1.37 2.89 74 FSL_BULK_SIG 11464 4.21 7.18 2.88 75 ANY_BOUNCE_MESSAGE 11411 2.76 2.51 2.87 76 BOUNCE_MESSAGE 11410 2.76 2.51 2.87 77 BAYES_999 10965 10.27 27.14 2.76 78 HTML_IMAGE_RATIO_06 10703 3.20 4.34 2.69 79 RCVD_IN_IADB_SENDERID 10351 2.20 1.30 2.60 80 XMNumbers 10227 2.83 3.42 2.57 81 MAILING_LIST_MULTI 10076 2.37 1.99 2.53 82 RCVD_IN_IADB_DK 10037 2.15 1.31 2.52 83 TooManyTo_002 9699 1.98 0.94 2.44 84 T_TooManySym_02 9485 1.83 0.59 2.38 85 XM_Body_Dirty_Words 9478 3.44 5.82 2.38 86 BAYES_95 9213 3.30 5.50 2.32 87 HTML_IMAGE_RATIO_08 8813 2.60 3.46 2.22 88 DKIM_INVALID 8713 3.04 4.96 2.19 89 RCVD_IN_IADB_VOUCHED 8368 1.63 0.58 2.10 90 XM_B_SpammyTLD 8111 2.40 3.22 2.04 91 MIME_HTML_MOSTLY 7964 2.31 3.01 2.00 92 TR_XM_SpammyRelay 7960 6.41 16.31 2.00 93 HTML_MIME_NO_HTML_TAG 7931 2.29 2.96 1.99 94 TR_XM_DKIM_Undo 7906 12.32 35.50 1.99 95 INVALID_MSGID 7254 1.30 0.14 1.82 96 XM_CamelCaseFrm001 7202 2.05 2.57 1.81 97 BAYES_05 6993 1.38 0.54 1.76 98 TO_MALFORMED 6803 1.18 0.00 1.71 99 MIME_HTML_ONLY_MULTI 6771 2.07 2.88 1.70 100 FROM_EXCESS_BASE64 6717 1.67 1.64 1.69 101 HELO_NODOT 6641 1.20 0.16 1.67 102 T_XMDrugObfuBody_14 6635 2.31 3.75 1.67 103 HELO_NO_DOMAIN 6633 1.20 0.16 1.67 104 XM_B_Investor 6550 2.55 4.58 1.65 105 XM_DK_Undo_01 6522 1.65 1.68 1.64 106 TM2_M_URI_OPT_OUT 6284 1.95 2.78 1.58 107 TR_XM_PhishingBody 6060 2.29 4.02 1.52 108 TR_Symld_Words 5897 1.37 1.11 1.48 109 RCVD_IN_IADB_OPTIN 5881 1.13 0.36 1.48 110 TR_XM_UnparsRelay 5821 3.21 7.13 1.46 111 SUBJ_ALL_CAPS 5653 1.92 3.02 1.42 112 XM_B_Unsub2 5642 1.66 2.20 1.42 113 XMSexyCombo_05 5625 2.33 4.39 1.41 114 UNTRUSTED_Relay 5592 3.24 7.37 1.41 115 TooManyTo_003 5183 1.16 0.83 1.30 116 TVD_RCVD_IP 5169 1.12 0.71 1.30 117 XM_B_SEO 5168 2.48 5.13 1.30 118 IN_HORDE_ADDRESS_BOOK 5024 0.89 0.06 1.26 119 RELAYCOUNTRY_CA 4958 4.28 11.08 1.25 120 XMGappySubj_01 4886 0.91 0.20 1.23 121 T_XMDrugObfuBody_08 4858 1.81 3.13 1.22 122 TM2_M_VERY_LONG_WORD 4739 1.87 3.39 1.19 123 XM_SendGrid 4730 1.25 1.39 1.19 124 BOTNET 4486 4.00 10.43 1.13 125 TR_XM_SpammyWords5 4437 2.03 4.08 1.12 126 URI_NOVOWEL 4417 1.12 1.15 1.11 127 XM_OfRef6 4414 2.29 4.94 1.11 128 TR_DCC_Bayes_99 4398 8.50 25.11 1.11 129 KHOP_HELO_FCRDNS 4349 1.05 0.96 1.09 130 XM_GoogleGroups 4177 0.93 0.67 1.05 131 XM_H_Long_From02 4102 1.00 0.94 1.03 132 XMCapTrack 3995 0.83 0.45 1.00 133 TVD_SPACE_RATIO 3917 0.72 0.12 0.98 134 XMBSHREFv2 3879 0.78 0.33 0.97 135 TooManyTo_004 3723 0.89 0.78 0.94 136 URI_HEX 3706 1.08 1.42 0.93 137 XM_B_SpammyWords4 3654 1.35 2.32 0.92 138 T_TooManySym_03 3545 0.68 0.20 0.89 139 XM_UB50 3335 1.92 4.34 0.84 140 RCVD_IN_BL_SPAMCOP_NET 3325 5.22 15.05 0.84 141 XMGenDplmaNmb 3295 1.03 1.47 0.83 142 XMBrknScrpt_02 3260 1.28 2.33 0.82 143 HTTPS_HTTP_MISMATCH 3230 1.10 1.73 0.81 144 TR_XM_SEO4 3203 1.96 4.54 0.81 145 DKIM_ADSP_CUSTOM_MED 3148 0.91 1.18 0.79 146 TR_XM_DK_SendGrid 3108 0.76 0.71 0.78 147 TooManyTo_005 3089 0.77 0.75 0.78 148 T_FILL_THIS_FORM_SHORT 3065 1.65 3.64 0.77 149 SpammyFromTLD_01 3042 1.14 1.98 0.76 150 TR_XM_Base64_M1 2975 0.78 0.84 0.75 151 XMBody_17 2966 2.90 7.73 0.75 152 T_XMDrugObfuBody_00 2921 1.15 2.07 0.73 153 XM_B_COPY_HTML 2887 0.78 0.91 0.73 154 XMStockSpam_06 2887 1.01 1.66 0.73 155 XMGappySubj_02 2845 0.52 0.10 0.72 156 TR_LOTS_OF_MONEY3 2789 1.79 4.24 0.70 157 TR_MetaPhish_Combo_01 2777 0.76 0.89 0.70 158 URI_TRY_3LD 2628 1.04 1.88 0.66 159 FROM_GOV_DKIM_AU 2625 0.57 0.36 0.66 160 XMNoVowels 2553 0.61 0.54 0.64 161 XM_ShortIntro_01 2493 0.63 0.62 0.63 162 T_Symld_Words_02 2493 0.67 0.78 0.63 163 XM_H_PHPMailer 2457 0.57 0.47 0.62 164 TO_NO_BRKTS_HTML_ONLY 2426 0.50 0.24 0.61 165 XM_B_FormFill 2419 0.45 0.09 0.61 166 XMBdyGiftCard01 2399 0.82 1.30 0.60 167 RELAYCOUNTRY_AU 2385 1.12 2.27 0.60 168 T_OBFU_PDF_ATTACH 2352 0.44 0.09 0.59 169 NML_ADSP_CUSTOM_MED 2261 0.71 1.01 0.57 170 PLING_QUERY 2211 0.68 0.96 0.56 171 XMBody_95 2186 0.46 0.27 0.55 172 XMHTML_After_End 2173 0.74 1.17 0.55 173 SHORT_HELO_AND_INLINE_IMAGE 2166 0.39 0.04 0.54 174 T_XMHurry_00 2105 1.00 2.06 0.53 175 HTML_TAG_BALANCE_BODY 2103 0.71 1.11 0.53 176 XMPhish30 2025 0.74 1.27 0.51 177 MPART_ALT_DIFF_COUNT 1923 0.61 0.89 0.48 178 TR_XM_SPAMCOP 1921 4.40 13.19 0.48 179 XM_ProductURIs 1884 0.57 0.79 0.47 180 USER_IN_WELCOMELIST 1867 0.32 0.00 0.47 181 USER_IN_WHITELIST 1867 0.32 0.00 0.47 182 XMMoneyMeta_00 1851 0.57 0.80 0.47 183 XMPhish14 1825 0.63 1.02 0.46 184 XMSolicitRefs_0 1803 0.42 0.36 0.45 185 XM_B_DNDMA 1799 0.54 0.75 0.45 186 FORGED_GMAIL_RCVD 1785 0.57 0.85 0.45 187 TR_XM_SpammyWords2 1756 4.93 15.02 0.44 188 HTML_IMAGE_ONLY_28 1719 0.38 0.25 0.43 189 SpammyFromTLD_02 1624 0.70 1.35 0.41 190 FILL_THIS_FORM 1580 0.39 0.38 0.40 191 RELAYCOUNTRY_GB 1562 0.55 0.89 0.39 192 XMLngstWrd_00 1547 0.39 0.38 0.39 193 HTML_IMAGE_ONLY_32 1541 0.34 0.25 0.39 194 XMDateMe_00 1499 0.35 0.28 0.38 195 TM2_M_BODY_EMPTY 1487 0.29 0.10 0.37 196 FROM_GOV_SPOOF 1458 0.30 0.16 0.37 197 HTML_IMAGE_ONLY_20 1454 0.52 0.88 0.37 198 XMOemUri 1443 0.30 0.16 0.36 199 THIS_AD 1429 0.68 1.40 0.36 200 MISSING_HEADERS 1405 0.39 0.46 0.35 ----------------------------------------------------------------------