Email: 488336 Autolearn: 0 AvgScore: 2.95 AvgScanTime: 1.44 sec Spam: 122936 Autolearn: 0 AvgScore: 12.73 AvgScanTime: 1.50 sec Ham: 365400 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 1.42 sec Time Spent Running SA: 195.14 hours Time Spent Processing Spam: 51.18 hours Time Spent Processing Ham: 143.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 122886 99.94 99.96 99.93 2 HTML_MESSAGE 118108 90.41 96.07 88.50 3 DKIM_SIGNED 110411 82.55 89.81 80.10 4 XM_DK_Pass 105944 80.56 86.18 78.68 5 DKIM_VALID 104385 79.58 84.91 77.79 6 XM_B_Unicode 103839 76.92 84.47 74.39 7 XM_B_SpammyWords 93465 56.24 76.03 49.58 8 RELAYCOUNTRY_US 91994 81.60 74.83 83.88 9 XMListUnsubscribeExists 86435 60.59 70.31 57.32 10 DKIM_VALID_AU 74512 62.15 60.61 62.66 11 XM_DK_Undo_02 72232 21.01 58.76 8.31 12 XM_B_SpammyWords2 57200 28.66 46.53 22.65 13 TR_XM_DKIM_Undo 56935 15.01 46.31 4.48 14 BAYES_99 52540 15.75 42.74 6.66 15 XM_B_Unicode3 47891 41.85 38.96 42.82 16 LOC_TINY_FONT_1 44613 32.42 36.29 31.11 17 HTML_FONT_LOW_CONTRAST 42379 32.62 34.47 31.99 18 DKIM_VALID_EF 42237 30.18 34.36 28.78 19 BAYES_50 41777 52.57 33.98 58.83 20 BAYES_999 41013 12.30 33.36 5.21 21 RCVD_IN_MSPIKE_H2 41007 32.14 33.36 31.73 22 FVGT_m_MULTI_ODD 40026 29.39 32.56 28.33 23 MIME_HTML_ONLY 37308 22.73 30.35 20.16 24 T_KAM_HTML_FONT_INVALID 34904 24.28 28.39 22.90 25 TR_XM_DK_Unsub 31328 17.56 25.48 14.89 26 RELAYCOUNTRY_META 29814 9.56 24.25 4.62 27 T_TM2_M_HEADER_IN_MSG 29640 26.38 24.11 27.14 28 TR_XM_SpammyRelay 24669 7.18 20.07 2.84 29 XMSubLong 24488 22.39 19.92 23.22 30 RCVD_IN_BL_SPAMCOP_NET 24025 5.72 19.54 1.07 31 LOTS_OF_MONEY 22377 10.30 18.20 7.64 32 TR_XM_SpammyWords2 22373 5.86 18.20 1.71 33 TR_XM_SPAMCOP 22082 4.96 17.96 0.58 34 XM_Multi_Part_URI 20862 15.33 16.97 14.77 35 TR_XM_SpammyWords4 19962 8.33 16.24 5.67 36 XM_B_Unsub 19798 10.21 16.10 8.23 37 TR_XM_BayesUnsub 19142 8.97 15.57 6.75 38 RELAYCOUNTRY_CA 18004 4.85 14.65 1.55 39 XM_B_SpammyWords3 17986 7.94 14.63 5.70 40 UNPARSEABLE_RELAY 17170 12.41 13.97 11.88 41 TR_MAX_INTL_RELAY 16796 9.64 13.66 8.29 42 BOTNET_IPINHOSTNAME 16744 7.28 13.62 5.14 43 RCVD_IN_MSPIKE_H3 14969 7.40 12.18 5.80 44 RCVD_IN_MSPIKE_WL 14969 7.40 12.18 5.80 45 BOTNET 13440 3.80 10.93 1.40 46 XMBody_17 10963 3.24 8.92 1.33 47 BAYES_80 10329 5.84 8.40 4.98 48 TR_XM_UnparsRelay 10107 3.89 8.22 2.43 49 XM_Evil_Numbers_Gen 8833 8.06 7.19 8.36 50 XM_Body_Dirty_Words 8466 4.15 6.89 3.23 51 BAYES_60 8127 8.88 6.61 9.64 52 XM_H_GMP 8106 5.98 6.59 5.77 53 XMSubMetaSx_00 8065 4.74 6.56 4.12 54 XM_UncommonTLD01 7767 4.22 6.32 3.52 55 HK_RANDOM_REPLYTO 7537 1.67 6.13 0.17 56 UNTRUSTED_Relay 7176 2.74 5.84 1.69 57 XM_B_SEO 6741 2.62 5.48 1.65 58 LotsOfNums_01 6690 8.10 5.44 8.99 59 HTML_IMAGE_RATIO_02 6289 5.09 5.12 5.08 60 MPART_ALT_DIFF 6243 4.50 5.08 4.31 61 XM_OfRef6 6229 2.20 5.07 1.23 62 TR_XM_SEO4 6176 2.11 5.02 1.13 63 BAYES_95 6039 3.71 4.91 3.30 64 DKIM_INVALID 6026 2.97 4.90 2.31 65 TR_XM_SpammyWords5 5898 2.16 4.80 1.28 66 T_XMDrugObfuBody_14 5896 2.62 4.80 1.89 67 XM_B_Investor 5882 2.65 4.78 1.93 68 TR_LOTS_OF_MONEY3 5853 1.96 4.76 1.02 69 XM_B_PhoneNumber 5824 8.26 4.74 9.45 70 T_FILL_THIS_FORM_SHORT 5677 1.85 4.62 0.92 71 XM_B_Phish_Phrases 5648 3.33 4.59 2.90 72 TooManyTo_001 5510 7.27 4.48 8.20 73 XM_SPF_SoftFail 5476 3.51 4.45 3.19 74 XM_H_Long_From01 5360 5.43 4.36 5.79 75 XMSexyCombo_05 5300 2.47 4.31 1.85 76 XMStrtUSub 5016 4.21 4.08 4.26 77 TR_XM_BayesRelay 4925 1.01 4.01 0.00 78 RCVD_IN_VALIDITY_RPBL 4908 1.19 3.99 0.25 79 XMNumbers 4888 3.05 3.98 2.74 80 FONT_INVIS_LONG_LINE 4817 1.03 3.92 0.06 81 HTML_IMAGE_RATIO_04 4800 5.20 3.90 5.64 82 HTML_IMAGE_RATIO_08 4790 2.84 3.90 2.49 83 HTML_IMAGE_RATIO_06 4731 2.94 3.85 2.64 84 TR_XM_PhishingBody 4494 2.59 3.66 2.23 85 XM_B_SpammyTLD 4401 2.76 3.58 2.48 86 T_XMDrugObfuBody_08 4322 2.25 3.52 1.82 87 MIME_HTML_MOSTLY 4121 2.96 3.35 2.82 88 SUBJ_ALL_CAPS 4005 2.05 3.26 1.64 89 XM_UB50 3967 1.60 3.23 1.05 90 SpammyFromTLD_01 3963 1.34 3.22 0.71 91 ALL_TRUSTED 3736 9.94 3.04 12.26 92 T_TooManySym_01 3688 4.68 3.00 5.25 93 TR_XM_FormFill 3673 0.78 2.99 0.03 94 XM_URI_RBL 3660 0.89 2.98 0.19 95 TM2_M_VERY_LONG_WORD 3631 1.88 2.95 1.52 96 XMStockSpam_06 3532 1.70 2.87 1.31 97 XMDiploma_00 3475 1.90 2.83 1.59 98 MIME_HTML_ONLY_MULTI 3417 2.44 2.78 2.32 99 TM2_M_URI_OPT_OUT 3345 2.45 2.72 2.36 100 HOSTED_IMG_MULTI_PUB_01 3236 0.74 2.63 0.10 101 XMBrknScrpt_02 3106 1.47 2.53 1.11 102 T_XMHurry_00 3103 1.38 2.52 0.99 103 MISSING_HEADERS 3066 0.96 2.49 0.44 104 HTML_MIME_NO_HTML_TAG 3034 2.13 2.47 2.02 105 RELAYCOUNTRY_AU 3013 1.32 2.45 0.93 106 MILLION_HUNDRED 2980 0.66 2.42 0.07 107 BASE64_LENGTH_79_INF 2975 0.82 2.42 0.29 108 XM_CamelCaseFrm001 2871 2.28 2.34 2.27 109 XM_B_Unsub2 2850 1.74 2.32 1.54 110 MIME_QP_LONG_LINE 2805 4.55 2.28 5.31 111 TR_XM_INV_DKIM 2798 0.61 2.28 0.05 112 BOUNCE_MESSAGE 2794 2.99 2.27 3.23 113 ANY_BOUNCE_MESSAGE 2794 2.99 2.27 3.23 114 REPLYTO_WITHOUT_TO_CC 2595 0.61 2.11 0.10 115 TR_XM_NoHeaderRelay 2491 0.60 2.03 0.12 116 XM_H_Undi_Recip 2436 0.60 1.98 0.13 117 TR_Mismatch_TLD_02 2359 0.56 1.92 0.10 118 TR_XM_Undi_Recip15 2273 0.47 1.85 0.01 119 RCVD_IN_VALIDITY_SAFE 2255 4.77 1.83 5.75 120 SHORT_URI_4 2221 0.46 1.81 0.01 121 TR_XM_PHPForged 2181 0.70 1.77 0.34 122 TR_XM_PHPDW 2165 0.69 1.76 0.33 123 TR_XM_Undi_Recip19 2153 0.49 1.75 0.07 124 TR_Caps_n_Bayes_99 2120 0.45 1.72 0.03 125 XM_B_SpammyWords4 2116 0.98 1.72 0.73 126 TR_XM_FormFill2 2114 0.69 1.72 0.34 127 XM_H_PHPOS 2107 0.68 1.71 0.33 128 MAILING_LIST_MULTI 2084 2.28 1.70 2.47 129 FROM_EXCESS_BASE64 2057 1.94 1.67 2.03 130 XM_HighProb1 2026 0.42 1.65 0.01 131 AC_BR_BONANZA 2014 0.58 1.64 0.22 132 TR_XM_Base64_M1 2006 0.97 1.63 0.74 133 URIBL_DBL_SPAM 1993 0.41 1.62 0.01 134 TR_MetaPhish_Combo_01 1991 0.92 1.62 0.68 135 TR_Mismatch_TLD_01 1985 0.56 1.61 0.20 136 TR_XM_Undi_RecipCombo2 1962 0.41 1.60 0.00 137 BAYES_40 1953 3.48 1.59 4.12 138 URI_TRY_3LD 1941 1.11 1.58 0.96 139 T_XMDrugObfuBody_00 1924 0.89 1.57 0.67 140 XM_DIRTYINTL 1905 0.50 1.55 0.15 141 KHOP_HELO_FCRDNS 1872 1.18 1.52 1.07 142 RCVD_IN_VALIDITY_CERTIFIED 1829 4.12 1.49 5.01 143 USER_IN_DEF_DKIM_WL 1803 10.37 1.47 13.37 144 HTML_TAG_BALANCE_BODY 1772 0.80 1.44 0.58 145 T_REMOTE_IMAGE 1764 2.93 1.43 3.44 146 XM_H_WindowsLiveMail 1752 0.40 1.43 0.05 147 XMSexyCombo_01 1742 0.59 1.42 0.31 148 XM_DK_Undo_01 1739 1.77 1.41 1.89 149 UNDISC_MONEY 1738 0.36 1.41 0.00 150 XMGenDplmaNmb 1710 0.94 1.39 0.79 151 T_TooManySym_02 1707 2.23 1.39 2.51 152 XM_SendGrid 1663 1.47 1.35 1.50 153 TR_XM_Undi_Recip5 1647 0.34 1.34 0.00 154 XMSlimDrugH 1644 0.55 1.34 0.29 155 HTTPS_HTTP_MISMATCH 1614 0.97 1.31 0.85 156 SpammyFromTLD_02 1584 0.73 1.29 0.54 157 T_STY_INVIS_DIRECT 1577 0.53 1.28 0.28 158 URI_HEX 1540 1.11 1.25 1.06 159 LOADSA_MONEY_COMBO 1537 0.35 1.25 0.04 160 TR_XM_Undi_Recip2 1520 0.32 1.24 0.01 161 XMPhish14 1515 0.59 1.23 0.37 162 RDNS_DYNAMIC 1454 0.52 1.18 0.29 163 MIME_HEADER_CTYPE_ONLY 1446 0.38 1.18 0.12 164 TooManyTo_002 1431 2.16 1.16 2.50 165 TR_Symld_Words 1415 1.28 1.15 1.32 166 URIBL_CSS_A 1374 0.34 1.12 0.08 167 URIBL_CSS 1374 0.34 1.12 0.08 168 XM_H_Long_From02 1359 1.05 1.11 1.04 169 DIET_1 1358 0.48 1.10 0.27 170 XMReplyNow 1344 0.58 1.09 0.41 171 XFER_LOTSA_MONEY 1336 0.29 1.09 0.02 172 HTML_FONT_SIZE_LARGE 1308 0.32 1.06 0.07 173 TooManyTo_003 1296 1.29 1.05 1.37 174 DKIM_ADSP_CUSTOM_MED 1282 0.88 1.04 0.82 175 TVD_RCVD_IP 1256 1.29 1.02 1.38 176 HTML_IMAGE_ONLY_08 1252 0.33 1.02 0.10 177 HK_SCAM 1248 0.26 1.02 0.01 178 TooManyTo_004 1221 1.01 0.99 1.02 179 AC_HTML_NONSENSE_TAGS 1217 0.26 0.99 0.02 180 XMSubMetaI_00 1213 0.96 0.99 0.95 181 URIBL_BLACK 1210 0.29 0.98 0.05 182 THIS_AD 1194 0.71 0.97 0.62 183 DKIM_ADSP_NXDOMAIN 1191 0.55 0.97 0.41 184 HTML_SHORT_LINK_IMG_1 1167 0.25 0.95 0.01 185 XM_B_DNDMA 1165 0.73 0.95 0.65 186 TooManyTo_005 1156 0.84 0.94 0.81 187 URI_NOVOWEL 1153 1.23 0.94 1.33 188 BAYES_20 1150 2.46 0.94 2.97 189 TR_XM_InvalidRelay 1147 0.25 0.93 0.03 190 MONEY_FRAUD_3 1144 0.24 0.93 0.01 191 ADVANCE_FEE_2_NEW_MONEY 1139 0.24 0.93 0.01 192 BOTNET_NORDNS 1130 0.24 0.92 0.01 193 XMHTML_After_End 1127 0.57 0.92 0.46 194 XM_B_Phish66 1109 0.50 0.90 0.36 195 RELAYCOUNTRY_GB 1072 0.59 0.87 0.50 196 TR_XM_DK_SendGrid 1069 0.99 0.87 1.03 197 HELO_DYNAMIC_SPLIT_IP 1067 0.22 0.87 0.01 198 RELAYCOUNTRY_HU 1061 0.23 0.86 0.02 199 NML_ADSP_CUSTOM_MED 1061 0.61 0.86 0.53 200 XM_UB99 1053 0.22 0.86 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 365152 99.94 99.96 99.93 2 HTML_MESSAGE 323383 90.41 96.07 88.50 3 RELAYCOUNTRY_US 306495 81.60 74.83 83.88 4 DKIM_SIGNED 292702 82.55 89.81 80.10 5 XM_DK_Pass 287481 80.56 86.18 78.68 6 DKIM_VALID 284245 79.58 84.91 77.79 7 XM_B_Unicode 271810 76.92 84.47 74.39 8 DKIM_VALID_AU 228977 62.15 60.61 62.66 9 BAYES_50 214959 52.57 33.98 58.83 10 XMListUnsubscribeExists 209436 60.59 70.31 57.32 11 XM_B_SpammyWords 181180 56.24 76.03 49.58 12 XM_B_Unicode3 156454 41.85 38.96 42.82 13 HTML_FONT_LOW_CONTRAST 116894 32.62 34.47 31.99 14 RCVD_IN_MSPIKE_H2 115951 32.14 33.36 31.73 15 LOC_TINY_FONT_1 113687 32.42 36.29 31.11 16 DKIM_VALID_EF 105166 30.18 34.36 28.78 17 FVGT_m_MULTI_ODD 103504 29.39 32.56 28.33 18 T_TM2_M_HEADER_IN_MSG 99165 26.38 24.11 27.14 19 XMSubLong 84846 22.39 19.92 23.22 20 T_KAM_HTML_FONT_INVALID 83672 24.28 28.39 22.90 21 XM_B_SpammyWords2 82768 28.66 46.53 22.65 22 MIME_HTML_ONLY 73669 22.73 30.35 20.16 23 TR_XM_DK_Unsub 54421 17.56 25.48 14.89 24 XM_Multi_Part_URI 53986 15.33 16.97 14.77 25 USER_IN_DEF_DKIM_WL 48861 10.37 1.47 13.37 26 ALL_TRUSTED 44790 9.94 3.04 12.26 27 UNPARSEABLE_RELAY 43420 12.41 13.97 11.88 28 BAYES_60 35222 8.88 6.61 9.64 29 XM_B_PhoneNumber 34535 8.26 4.74 9.45 30 LotsOfNums_01 32858 8.10 5.44 8.99 31 XM_Evil_Numbers_Gen 30537 8.06 7.19 8.36 32 XM_DK_Undo_02 30367 21.01 58.76 8.31 33 TR_MAX_INTL_RELAY 30292 9.64 13.66 8.29 34 XM_B_Unsub 30081 10.21 16.10 8.23 35 TooManyTo_001 29969 7.27 4.48 8.20 36 BAYES_00 28170 5.88 0.44 7.71 37 LOTS_OF_MONEY 27924 10.30 18.20 7.64 38 XM_DKIMWhitelistDomains 27439 5.62 0.02 7.51 39 TR_XM_BayesUnsub 24659 8.97 15.57 6.75 40 BAYES_99 24351 15.75 42.74 6.66 41 IN_ZIMBRA_NJ_WHITELIST 22585 4.64 0.04 6.18 42 RCVD_IN_MSPIKE_WL 21177 7.40 12.18 5.80 43 RCVD_IN_MSPIKE_H3 21177 7.40 12.18 5.80 44 XM_H_Long_From01 21139 5.43 4.36 5.79 45 XM_H_GMP 21101 5.98 6.59 5.77 46 RCVD_IN_VALIDITY_SAFE 21027 4.77 1.83 5.75 47 XM_B_SpammyWords3 20811 7.94 14.63 5.70 48 TR_XM_SpammyWords4 20723 8.33 16.24 5.67 49 HTML_IMAGE_RATIO_04 20600 5.20 3.90 5.64 50 TR_XM_DK_Bayes 20109 4.19 0.30 5.50 51 TR_XM_DK_Bayes1 19872 4.15 0.30 5.44 52 MIME_QP_LONG_LINE 19411 4.55 2.28 5.31 53 T_TooManySym_01 19186 4.68 3.00 5.25 54 BAYES_999 19045 12.30 33.36 5.21 55 BOTNET_IPINHOSTNAME 18791 7.28 13.62 5.14 56 HTML_IMAGE_RATIO_02 18550 5.09 5.12 5.08 57 RCVD_IN_VALIDITY_CERTIFIED 18306 4.12 1.49 5.01 58 BAYES_80 18212 5.84 8.40 4.98 59 TR_XM_DK_Bayes2 17296 3.60 0.21 4.73 60 RELAYCOUNTRY_META 16888 9.56 24.25 4.62 61 TR_XM_DKIM_Undo 16372 15.01 46.31 4.48 62 MPART_ALT_DIFF 15737 4.50 5.08 4.31 63 XMStrtUSub 15558 4.21 4.08 4.26 64 XMSubMetaSx_00 15064 4.74 6.56 4.12 65 BAYES_40 15047 3.48 1.59 4.12 66 XM_PDF 14526 3.16 0.75 3.98 67 RCVD_IN_IADB_LISTED 14388 3.16 0.84 3.94 68 XM_UncommonTLD01 12861 4.22 6.32 3.52 69 RCVD_IN_IADB_SPF 12613 2.77 0.76 3.45 70 T_REMOTE_IMAGE 12560 2.93 1.43 3.44 71 BAYES_95 12069 3.71 4.91 3.30 72 ANY_BOUNCE_MESSAGE 11802 2.99 2.27 3.23 73 BOUNCE_MESSAGE 11802 2.99 2.27 3.23 74 XM_Body_Dirty_Words 11796 4.15 6.89 3.23 75 XM_SPF_SoftFail 11647 3.51 4.45 3.19 76 RCVD_IN_IADB_SENDERID 11357 2.50 0.71 3.11 77 RCVD_IN_IADB_DK 11101 2.45 0.72 3.04 78 BAYES_20 10865 2.46 0.94 2.97 79 XM_B_Phish_Phrases 10592 3.33 4.59 2.90 80 TR_XM_SpammyRelay 10379 7.18 20.07 2.84 81 MIME_HTML_MOSTLY 10314 2.96 3.35 2.82 82 XMNumbers 10006 3.05 3.98 2.74 83 HTML_IMAGE_RATIO_06 9629 2.94 3.85 2.64 84 T_TooManySym_02 9180 2.23 1.39 2.51 85 RCVD_IN_IADB_VOUCHED 9174 1.97 0.37 2.51 86 TooManyTo_002 9140 2.16 1.16 2.50 87 HTML_IMAGE_RATIO_08 9085 2.84 3.90 2.49 88 XM_B_SpammyTLD 9076 2.76 3.58 2.48 89 MAILING_LIST_MULTI 9041 2.28 1.70 2.47 90 TR_XM_UnparsRelay 8870 3.89 8.22 2.43 91 TM2_M_URI_OPT_OUT 8639 2.45 2.72 2.36 92 MIME_HTML_ONLY_MULTI 8477 2.44 2.78 2.32 93 DKIM_INVALID 8457 2.97 4.90 2.31 94 XM_CamelCaseFrm001 8280 2.28 2.34 2.27 95 TR_XM_PhishingBody 8140 2.59 3.66 2.23 96 FROM_EXCESS_BASE64 7427 1.94 1.67 2.03 97 HTML_MIME_NO_HTML_TAG 7373 2.13 2.47 2.02 98 TO_MALFORMED 7371 1.51 0.02 2.02 99 INVALID_MSGID 7234 1.52 0.15 1.98 100 XM_B_Investor 7062 2.65 4.78 1.93 101 T_XMDrugObfuBody_14 6907 2.62 4.80 1.89 102 XM_DK_Undo_01 6897 1.77 1.41 1.89 103 XMSexyCombo_05 6769 2.47 4.31 1.85 104 T_XMDrugObfuBody_08 6654 2.25 3.52 1.82 105 BAYES_05 6504 1.43 0.39 1.78 106 RCVD_IN_IADB_OPTIN 6460 1.39 0.25 1.77 107 TR_XM_SpammyWords2 6261 5.86 18.20 1.71 108 UNTRUSTED_Relay 6192 2.74 5.84 1.69 109 XM_B_SEO 6043 2.62 5.48 1.65 110 SUBJ_ALL_CAPS 6003 2.05 3.26 1.64 111 XMDiploma_00 5814 1.90 2.83 1.59 112 RELAYCOUNTRY_CA 5675 4.85 14.65 1.55 113 XM_B_Unsub2 5627 1.74 2.32 1.54 114 TM2_M_VERY_LONG_WORD 5553 1.88 2.95 1.52 115 XM_SendGrid 5492 1.47 1.35 1.50 116 HELO_NODOT 5394 1.20 0.37 1.48 117 HELO_NO_DOMAIN 5390 1.20 0.37 1.48 118 BOTNET 5128 3.80 10.93 1.40 119 TVD_RCVD_IP 5041 1.29 1.02 1.38 120 TooManyTo_003 5013 1.29 1.05 1.37 121 IN_HORDE_ADDRESS_BOOK 4931 1.02 0.04 1.35 122 URI_NOVOWEL 4875 1.23 0.94 1.33 123 XMBody_17 4867 3.24 8.92 1.33 124 TR_Symld_Words 4827 1.28 1.15 1.32 125 XMStockSpam_06 4773 1.70 2.87 1.31 126 TR_XM_SpammyWords5 4664 2.16 4.80 1.28 127 XMGappySubj_01 4654 0.99 0.16 1.27 128 XM_OfRef6 4501 2.20 5.07 1.23 129 XMPhish30 4277 1.07 0.76 1.17 130 XM_GoogleGroups 4175 0.97 0.46 1.14 131 TR_XM_SEO4 4138 2.11 5.02 1.13 132 XMBrknScrpt_02 4060 1.47 2.53 1.11 133 RCVD_IN_BL_SPAMCOP_NET 3915 5.72 19.54 1.07 134 KHOP_HELO_FCRDNS 3909 1.18 1.52 1.07 135 XMBSHREFv2 3903 0.89 0.35 1.07 136 URI_HEX 3887 1.11 1.25 1.06 137 XM_UB50 3843 1.60 3.23 1.05 138 XM_H_Long_From02 3785 1.05 1.11 1.04 139 TR_XM_DK_SendGrid 3757 0.99 0.87 1.03 140 TVD_SPACE_RATIO 3746 0.79 0.11 1.03 141 TR_LOTS_OF_MONEY3 3735 1.96 4.76 1.02 142 TooManyTo_004 3712 1.01 0.99 1.02 143 T_XMHurry_00 3626 1.38 2.52 0.99 144 URI_TRY_3LD 3503 1.11 1.58 0.96 145 XMSubMetaI_00 3475 0.96 0.99 0.95 146 RELAYCOUNTRY_AU 3409 1.32 2.45 0.93 147 T_FILL_THIS_FORM_SHORT 3346 1.85 4.62 0.92 148 XM_B_COPY_HTML 3300 0.85 0.67 0.90 149 T_TooManySym_03 3276 0.74 0.26 0.90 150 HTTPS_HTTP_MISMATCH 3117 0.97 1.31 0.85 151 DKIM_ADSP_CUSTOM_MED 3004 0.88 1.04 0.82 152 XMCapTrack 3002 0.72 0.41 0.82 153 TooManyTo_005 2949 0.84 0.94 0.81 154 XMBdyGiftCard01 2927 0.75 0.62 0.80 155 XMGenDplmaNmb 2886 0.94 1.39 0.79 156 XM_ProductURIs 2740 0.75 0.76 0.75 157 TR_XM_Base64_M1 2708 0.97 1.63 0.74 158 XM_B_SpammyWords4 2682 0.98 1.72 0.73 159 FROM_GOV_DKIM_AU 2608 0.58 0.17 0.71 160 XM_B_FormFill 2590 0.54 0.04 0.71 161 SpammyFromTLD_01 2590 1.34 3.22 0.71 162 TR_MetaPhish_Combo_01 2497 0.92 1.62 0.68 163 T_Symld_Words_02 2470 0.66 0.61 0.68 164 T_XMDrugObfuBody_00 2438 0.89 1.57 0.67 165 XMGappySubj_02 2418 0.52 0.09 0.66 166 XM_B_DNDMA 2379 0.73 0.95 0.65 167 THIS_AD 2276 0.71 0.97 0.62 168 HTML_FONT_FACE_BAD 2233 0.62 0.64 0.61 169 MPART_ALT_DIFF_COUNT 2157 0.64 0.80 0.59 170 TR_XM_SPAMCOP 2129 4.96 17.96 0.58 171 HTML_TAG_BALANCE_BODY 2124 0.80 1.44 0.58 172 XM_H_PHPMailer 2069 0.61 0.73 0.57 173 XMNoVowels 2065 0.58 0.61 0.57 174 T_OBFU_PDF_ATTACH 2060 0.44 0.07 0.56 175 XM_ShortIntro_01 2046 0.56 0.58 0.56 176 RCVD_IN_PSBL 1999 0.62 0.83 0.55 177 XMBody_95 1959 0.45 0.20 0.54 178 SpammyFromTLD_02 1958 0.73 1.29 0.54 179 NML_ADSP_CUSTOM_MED 1941 0.61 0.86 0.53 180 USER_IN_WHITELIST 1934 0.40 0.00 0.53 181 USER_IN_WELCOMELIST 1934 0.40 0.00 0.53 182 FILL_THIS_FORM 1899 0.46 0.28 0.52 183 FORGED_GMAIL_RCVD 1867 0.58 0.79 0.51 184 RELAYCOUNTRY_GB 1820 0.59 0.87 0.50 185 XMHTML_After_End 1677 0.57 0.92 0.46 186 TO_NO_BRKTS_HTML_ONLY 1673 0.41 0.26 0.46 187 SHORT_HELO_AND_INLINE_IMAGE 1637 0.35 0.07 0.45 188 MISSING_HEADERS 1618 0.96 2.49 0.44 189 XMMoneyMeta_00 1603 0.46 0.53 0.44 190 SHOPIFY_IMG_NOT_RCVD_SFY 1581 0.48 0.64 0.43 191 XMLngstWrd_00 1562 0.51 0.74 0.43 192 DKIM_ADSP_NXDOMAIN 1509 0.55 0.97 0.41 193 XMReplyNow 1500 0.58 1.09 0.41 194 XMSubMetaSxObfu_02 1495 0.37 0.25 0.41 195 PLING_QUERY 1486 0.39 0.34 0.41 196 LOW_PRICE 1478 0.35 0.18 0.40 197 XMSubMetaSxObfu_03 1472 0.50 0.79 0.40 198 TM2_M_OBFU_COMMENT 1467 0.49 0.77 0.40 199 HTML_IMAGE_ONLY_28 1440 0.35 0.23 0.39 200 XM_B_REG_HTML 1414 0.36 0.27 0.39 ----------------------------------------------------------------------