Email: 515432 Autolearn: 0 AvgScore: 3.32 AvgScanTime: 1.17 sec Spam: 150602 Autolearn: 0 AvgScore: 12.88 AvgScanTime: 1.32 sec Ham: 364830 Autolearn: 0 AvgScore: -0.63 AvgScanTime: 1.10 sec Time Spent Running SA: 167.14 hours Time Spent Processing Spam: 55.18 hours Time Spent Processing Ham: 111.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146068 90.18 96.99 87.37 2 DKIM_SIGNED 135591 80.05 90.03 75.93 3 XM_DK_Pass 129408 77.92 85.93 74.62 4 DKIM_VALID 127740 76.81 84.82 73.51 5 XM_B_Unicode 127581 72.42 84.71 67.35 6 RELAYCOUNTRY_US 126034 81.70 83.69 80.89 7 DCC_CHECK 110094 48.05 73.10 37.70 8 XMListUnsubscribeExists 107859 55.24 71.62 48.48 9 XM_B_SpammyWords 107848 51.61 71.61 43.36 10 DKIM_VALID_AU 103057 62.42 68.43 59.94 11 XM_B_Unicode3 69414 40.52 46.09 38.22 12 LOC_TINY_FONT_1 63939 30.09 42.46 24.99 13 XM_B_SpammyWords2 62951 24.45 41.80 17.29 14 BAYES_50 62150 54.90 41.27 60.52 15 XM_DK_Undo_02 59622 15.78 39.59 5.95 16 HTML_FONT_LOW_CONTRAST 56582 30.50 37.57 27.58 17 RCVD_IN_MSPIKE_H2 53416 31.90 35.47 30.42 18 FVGT_m_MULTI_ODD 51357 27.15 34.10 24.29 19 BAYES_99 48905 12.44 32.47 4.17 20 T_KAM_HTML_FONT_INVALID 43823 22.54 29.10 19.83 21 TR_XM_DKIM_Undo 43720 10.35 29.03 2.63 22 DKIM_VALID_EF 40867 29.74 27.14 30.81 23 DCC_CHECK_NEGATIVE 40488 51.91 26.88 62.25 24 BAYES_999 38191 9.65 25.36 3.17 25 MIME_HTML_ONLY 37689 21.24 25.03 19.68 26 T_TM2_M_HEADER_IN_MSG 36272 29.17 24.08 31.27 27 TR_DCC_Bayes_99 34850 7.86 23.14 1.55 28 XMSubLong 34654 22.06 23.01 21.66 29 XM_Multi_Part_URI 29466 15.19 19.57 13.39 30 TR_XM_DK_Unsub 27895 14.80 18.52 13.26 31 RELAYCOUNTRY_META 25131 8.61 16.69 5.28 32 LOTS_OF_MONEY 24606 9.03 16.34 6.01 33 XM_B_Unsub 24090 10.10 16.00 7.67 34 TR_XM_BayesUnsub 23058 8.84 15.31 6.17 35 TR_XM_SpammyWords4 22132 7.17 14.70 4.07 36 UNPARSEABLE_RELAY 21847 12.26 14.51 11.33 37 BOTNET_IPINHOSTNAME 21786 7.16 14.47 4.14 38 TR_MAX_INTL_RELAY 21714 8.70 14.42 6.34 39 XM_B_SpammyWords3 21331 6.92 14.16 3.93 40 TR_XM_SpammyWords2 17561 3.70 11.66 0.41 41 TR_XM_SpammyRelay 17029 4.99 11.31 2.38 42 BOTNET 15816 4.21 10.50 1.61 43 XM_Evil_Numbers_Gen 13678 8.10 9.08 7.69 44 BAYES_80 13483 5.40 8.95 3.94 45 BAYES_60 11332 8.73 7.52 9.23 46 LotsOfNums_01 11125 7.70 7.39 7.82 47 FSL_BULK_SIG 11019 6.32 7.32 5.91 48 XM_Body_Dirty_Words 10796 4.42 7.17 3.28 49 XMSubMetaSx_00 10491 4.66 6.97 3.70 50 TR_XM_UnparsRelay 10446 3.09 6.94 1.51 51 UNTRUSTED_Relay 10144 2.85 6.74 1.25 52 RCVD_IN_BL_SPAMCOP_NET 9370 2.34 6.22 0.74 53 MPART_ALT_DIFF 9365 5.75 6.22 5.56 54 XM_B_PhoneNumber 9363 8.84 6.22 9.92 55 HTML_IMAGE_RATIO_02 9238 5.15 6.13 4.74 56 TooManyTo_001 8736 7.88 5.80 8.74 57 XM_UncommonTLD01 8485 4.23 5.63 3.65 58 RELAYCOUNTRY_CA 8189 2.57 5.44 1.39 59 XM_B_SEO 8084 2.35 5.37 1.10 60 XM_SPF_SoftFail 7859 4.24 5.22 3.84 61 DKIM_INVALID 7851 3.24 5.21 2.43 62 BAYES_95 7561 3.17 5.02 2.41 63 HTML_IMAGE_RATIO_04 7504 4.05 4.98 3.67 64 TR_LOTS_OF_MONEY3 7408 1.86 4.92 0.60 65 XMBody_17 7250 1.92 4.81 0.73 66 XM_B_Phish_Phrases 7211 3.72 4.79 3.27 67 TR_XM_SEO4 7175 1.86 4.76 0.66 68 TR_XM_SPAMCOP 7151 1.69 4.75 0.42 69 XM_H_Long_From01 6866 4.75 4.56 4.82 70 XM_B_Investor 6801 2.30 4.52 1.38 71 XM_H_GMP 6710 5.99 4.46 6.62 72 MIME_HTML_MOSTLY 6532 4.32 4.34 4.32 73 TR_XM_PhishingBody 6527 2.38 4.33 1.57 74 TR_XM_SpammyWords5 6492 2.23 4.31 1.37 75 XMSexyCombo_05 6293 2.54 4.18 1.87 76 XMNumbers 5799 3.03 3.85 2.69 77 HTML_IMAGE_RATIO_08 5772 2.67 3.83 2.19 78 XMStrtUSub 5669 4.31 3.76 4.53 79 T_XMDrugObfuBody_08 5588 2.27 3.71 1.68 80 T_XMDrugObfuBody_14 5572 2.36 3.70 1.80 81 HTML_IMAGE_RATIO_06 5354 2.73 3.56 2.39 82 XM_B_SpammyTLD 5186 2.65 3.44 2.32 83 XM_UB50 5183 1.51 3.44 0.71 84 XM_OfRef6 5182 1.60 3.44 0.83 85 MIME_HTML_ONLY_MULTI 5159 2.32 3.43 1.87 86 RELAYCOUNTRY_AU 4849 1.59 3.22 0.91 87 MIME_QP_LONG_LINE 4772 4.44 3.17 4.96 88 TM2_M_VERY_LONG_WORD 4611 1.72 3.06 1.17 89 XM_CamelCaseFrm001 4406 2.26 2.93 1.99 90 TM2_M_URI_OPT_OUT 4399 1.96 2.92 1.57 91 RCVD_IN_VALIDITY_RPBL 4247 0.90 2.82 0.11 92 XM_B_Unsub2 4238 1.88 2.81 1.49 93 XMDiploma_00 4043 2.02 2.68 1.75 94 SUBJ_ALL_CAPS 4028 1.80 2.67 1.45 95 T_TooManySym_01 3919 4.52 2.60 5.31 96 HTML_MIME_NO_HTML_TAG 3880 2.50 2.58 2.46 97 USER_IN_DEF_DKIM_WL 3869 10.49 2.57 13.76 98 XM_URI_RBL 3748 0.83 2.49 0.14 99 RCVD_IN_MSPIKE_H3 3704 4.99 2.46 6.03 100 RCVD_IN_MSPIKE_WL 3704 4.99 2.46 6.03 101 XM_B_SpammyWords4 3647 1.21 2.42 0.71 102 RCVD_IN_VALIDITY_SAFE 3458 4.36 2.30 5.21 103 T_REMOTE_IMAGE 3330 3.33 2.21 3.79 104 TR_XM_NoHeaderRelay 3158 0.70 2.10 0.12 105 URI_TRY_3LD 3109 1.17 2.06 0.80 106 BAYES_40 2966 3.89 1.97 4.68 107 FROM_EXCESS_BASE64 2889 2.04 1.92 2.09 108 T_XMDrugObfuBody_00 2858 1.16 1.90 0.85 109 XMBrknScrpt_02 2834 1.21 1.88 0.94 110 T_XMHurry_00 2822 0.81 1.87 0.38 111 MAILING_LIST_MULTI 2809 2.45 1.87 2.70 112 TR_XM_PHPForged 2770 0.84 1.84 0.43 113 TR_XM_PHPDW 2734 0.84 1.82 0.44 114 RCVD_IN_VALIDITY_CERTIFIED 2718 3.66 1.80 4.42 115 XMStockSpam_06 2700 1.36 1.79 1.19 116 TR_Symld_Words 2694 1.79 1.79 1.80 117 TR_XM_FormFill2 2677 0.83 1.78 0.43 118 XM_H_PHPOS 2667 0.81 1.77 0.42 119 ALL_TRUSTED 2607 11.04 1.73 14.89 120 XM_DK_Undo_01 2591 1.83 1.72 1.88 121 URIBL_DBL_SPAM 2540 0.50 1.69 0.00 122 ANY_BOUNCE_MESSAGE 2539 3.54 1.69 4.30 123 BOUNCE_MESSAGE 2536 3.54 1.68 4.30 124 SpammyFromTLD_01 2510 1.10 1.67 0.87 125 TR_XM_INV_DKIM 2443 0.53 1.62 0.08 126 XMReplyNow 2435 0.68 1.62 0.29 127 URI_HEX 2419 1.18 1.61 1.01 128 KHOP_HELO_FCRDNS 2355 1.83 1.56 1.95 129 HTML_TAG_BALANCE_BODY 2328 0.82 1.55 0.52 130 TR_LOTS_OF_MONEY2 2313 0.60 1.54 0.21 131 T_MONEY_PERCENT 2313 0.60 1.54 0.21 132 TooManyTo_002 2300 2.38 1.53 2.73 133 T_FILL_THIS_FORM_SHORT 2298 0.99 1.53 0.77 134 XMSexyCombo_01 2270 0.68 1.51 0.34 135 XMGenDplmaNmb 2234 1.03 1.48 0.85 136 SpammyFromTLD_02 2229 0.56 1.48 0.19 137 TooManyTo_003 2183 1.52 1.45 1.55 138 RCVD_IN_IADB_LISTED 2155 3.02 1.43 3.68 139 AC_BR_BONANZA 2111 0.48 1.40 0.10 140 TooManyTo_004 2095 1.24 1.39 1.17 141 BAYES_20 2093 2.80 1.39 3.38 142 XMSubMetaI_00 2059 0.72 1.37 0.45 143 TooManyTo_005 2035 1.08 1.35 0.97 144 HOSTED_IMG_MULTI_PUB_01 2029 0.41 1.35 0.03 145 HTTPS_HTTP_MISMATCH 1999 1.02 1.33 0.89 146 LongTLD 1975 0.63 1.31 0.35 147 XM_HighProb1 1958 0.38 1.30 0.00 148 DIET_1 1951 0.51 1.30 0.18 149 XM_B_Phish66 1929 0.59 1.28 0.31 150 XMBdyGiftCard01 1897 0.87 1.26 0.71 151 XMPhish30 1893 0.70 1.26 0.47 152 URI_NOVOWEL 1884 1.32 1.25 1.35 153 TR_XM_InvalidRelay 1874 0.38 1.24 0.02 154 XM_DIRTYINTL 1838 0.52 1.22 0.23 155 RCVD_IN_IADB_SPF 1823 2.65 1.21 3.24 156 TM2_M_A_HREF_HREF 1822 0.62 1.21 0.38 157 XM_SendGrid 1718 1.30 1.14 1.37 158 DKIM_ADSP_CUSTOM_MED 1712 0.96 1.14 0.88 159 RDNS_DYNAMIC 1711 0.55 1.14 0.31 160 XMHTML_After_End 1709 0.57 1.13 0.34 161 RCVD_IN_IADB_SENDERID 1692 2.38 1.12 2.90 162 RCVD_IN_IADB_DK 1685 2.31 1.12 2.80 163 MPART_ALT_DIFF_COUNT 1660 0.77 1.10 0.63 164 XM_UB99 1645 0.32 1.09 0.00 165 XMSlimDrugH 1581 0.60 1.05 0.41 166 TVD_RCVD_IP 1556 1.62 1.03 1.86 167 XM_B_COPY_HTML 1523 0.64 1.01 0.49 168 BOTNET_NORDNS 1480 0.29 0.98 0.01 169 TR_MetaPhish_Combo_01 1448 0.79 0.96 0.73 170 RELAYCOUNTRY_FR 1443 0.43 0.96 0.21 171 TR_Caps_n_Bayes_99 1407 0.29 0.93 0.02 172 HTML_FONT_SIZE_LARGE 1391 0.32 0.92 0.07 173 HTML_IMAGE_ONLY_08 1389 0.39 0.92 0.17 174 HELO_DYNAMIC_SPLIT_IP 1387 0.28 0.92 0.01 175 THIS_AD 1382 0.51 0.92 0.34 176 XM_B_DNDMA 1380 0.81 0.92 0.76 177 TM2_M_OBFU_COMMENT 1379 0.44 0.92 0.25 178 XM_PDF 1365 4.19 0.91 5.54 179 XMPhish14 1346 0.63 0.89 0.53 180 NML_ADSP_CUSTOM_MED 1335 0.70 0.89 0.62 181 T_STY_INVIS_DIRECT 1335 0.54 0.89 0.40 182 XMLngstWrd_00 1325 0.72 0.88 0.66 183 XM_H_PHPMailer 1298 0.73 0.86 0.67 184 XM_B_COVIDMETA 1296 0.35 0.86 0.13 185 XM_H_Long_From02 1291 1.04 0.86 1.12 186 XM_H_Undi_Recip 1288 0.44 0.86 0.26 187 FORGED_GMAIL_RCVD 1281 0.59 0.85 0.49 188 DKIM_ADSP_NXDOMAIN 1280 0.47 0.85 0.31 189 XM_Combo_Sbj 1264 0.45 0.84 0.29 190 TR_Mismatch_TLD_02 1254 0.29 0.83 0.07 191 T_Symld_Words_02 1244 0.51 0.83 0.38 192 RELAYCOUNTRY_GB 1241 1.35 0.82 1.56 193 TR_XM_FormFill 1225 0.25 0.81 0.01 194 T_TooManySym_02 1215 2.12 0.81 2.67 195 TR_XM_Base64_M1 1201 0.68 0.80 0.63 196 TR_XM_DK_SendGrid 1196 0.90 0.79 0.94 197 XM_UB999 1193 0.23 0.79 0.00 198 MIME_HEADER_CTYPE_ONLY 1172 0.36 0.78 0.19 199 XM_UB60 1167 0.26 0.77 0.05 200 RELAYCOUNTRY_IN 1164 0.26 0.77 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 318760 90.18 96.99 87.37 2 RELAYCOUNTRY_US 295096 81.70 83.69 80.89 3 DKIM_SIGNED 277019 80.05 90.03 75.93 4 XM_DK_Pass 272237 77.92 85.93 74.62 5 DKIM_VALID 268171 76.81 84.82 73.51 6 XM_B_Unicode 245717 72.42 84.71 67.35 7 DCC_CHECK_NEGATIVE 227092 51.91 26.88 62.25 8 BAYES_50 220797 54.90 41.27 60.52 9 DKIM_VALID_AU 218693 62.42 68.43 59.94 10 XMListUnsubscribeExists 176867 55.24 71.62 48.48 11 XM_B_SpammyWords 158187 51.61 71.61 43.36 12 XM_B_Unicode3 139455 40.52 46.09 38.22 13 DCC_CHECK 137556 48.05 73.10 37.70 14 T_TM2_M_HEADER_IN_MSG 114065 29.17 24.08 31.27 15 DKIM_VALID_EF 112398 29.74 27.14 30.81 16 RCVD_IN_MSPIKE_H2 110999 31.90 35.47 30.42 17 HTML_FONT_LOW_CONTRAST 100631 30.50 37.57 27.58 18 LOC_TINY_FONT_1 91157 30.09 42.46 24.99 19 FVGT_m_MULTI_ODD 88599 27.15 34.10 24.29 20 XMSubLong 79035 22.06 23.01 21.66 21 T_KAM_HTML_FONT_INVALID 72344 22.54 29.10 19.83 22 MIME_HTML_ONLY 71799 21.24 25.03 19.68 23 XM_B_SpammyWords2 63068 24.45 41.80 17.29 24 ALL_TRUSTED 54305 11.04 1.73 14.89 25 USER_IN_DEF_DKIM_WL 50206 10.49 2.57 13.76 26 XM_Multi_Part_URI 48839 15.19 19.57 13.39 27 TR_XM_DK_Unsub 48385 14.80 18.52 13.26 28 UNPARSEABLE_RELAY 41332 12.26 14.51 11.33 29 XM_B_PhoneNumber 36206 8.84 6.22 9.92 30 BAYES_00 35144 7.02 0.69 9.63 31 BAYES_60 33684 8.73 7.52 9.23 32 TooManyTo_001 31888 7.88 5.80 8.74 33 XM_DKIMWhitelistDomains 28607 5.57 0.06 7.84 34 LotsOfNums_01 28541 7.70 7.39 7.82 35 XM_Evil_Numbers_Gen 28050 8.10 9.08 7.69 36 XM_B_Unsub 27974 10.10 16.00 7.67 37 IN_ZIMBRA_NJ_WHITELIST 25910 5.05 0.09 7.10 38 XM_H_GMP 24147 5.99 4.46 6.62 39 TR_XM_DK_Bayes 24144 4.83 0.50 6.62 40 TR_XM_DK_Bayes1 23757 4.75 0.48 6.51 41 TR_MAX_INTL_RELAY 23147 8.70 14.42 6.34 42 TR_XM_BayesUnsub 22507 8.84 15.31 6.17 43 RCVD_IN_MSPIKE_H3 22014 4.99 2.46 6.03 44 RCVD_IN_MSPIKE_WL 22014 4.99 2.46 6.03 45 LOTS_OF_MONEY 21917 9.03 16.34 6.01 46 XM_DK_Undo_02 21710 15.78 39.59 5.95 47 FSL_BULK_SIG 21571 6.32 7.32 5.91 48 TR_XM_DK_Bayes2 20556 4.10 0.37 5.63 49 MPART_ALT_DIFF 20275 5.75 6.22 5.56 50 XM_PDF 20215 4.19 0.91 5.54 51 T_TooManySym_01 19369 4.52 2.60 5.31 52 RELAYCOUNTRY_META 19257 8.61 16.69 5.28 53 RCVD_IN_VALIDITY_SAFE 19013 4.36 2.30 5.21 54 MIME_QP_LONG_LINE 18101 4.44 3.17 4.96 55 XM_H_Long_From01 17595 4.75 4.56 4.82 56 HTML_IMAGE_RATIO_02 17305 5.15 6.13 4.74 57 BAYES_40 17086 3.89 1.97 4.68 58 XMStrtUSub 16542 4.31 3.76 4.53 59 RCVD_IN_VALIDITY_CERTIFIED 16129 3.66 1.80 4.42 60 MIME_HTML_MOSTLY 15746 4.32 4.34 4.32 61 ANY_BOUNCE_MESSAGE 15701 3.54 1.69 4.30 62 BOUNCE_MESSAGE 15700 3.54 1.68 4.30 63 BAYES_99 15221 12.44 32.47 4.17 64 BOTNET_IPINHOSTNAME 15110 7.16 14.47 4.14 65 TR_XM_SpammyWords4 14846 7.17 14.70 4.07 66 BAYES_80 14359 5.40 8.95 3.94 67 XM_B_SpammyWords3 14322 6.92 14.16 3.93 68 XM_SPF_SoftFail 14000 4.24 5.22 3.84 69 T_REMOTE_IMAGE 13843 3.33 2.21 3.79 70 XMSubMetaSx_00 13512 4.66 6.97 3.70 71 RCVD_IN_IADB_LISTED 13422 3.02 1.43 3.68 72 HTML_IMAGE_RATIO_04 13374 4.05 4.98 3.67 73 XM_UncommonTLD01 13299 4.23 5.63 3.65 74 BAYES_20 12338 2.80 1.39 3.38 75 XM_Body_Dirty_Words 11969 4.42 7.17 3.28 76 XM_B_Phish_Phrases 11938 3.72 4.79 3.27 77 RCVD_IN_IADB_SPF 11819 2.65 1.21 3.24 78 BAYES_999 11568 9.65 25.36 3.17 79 HTML_IMAGE_ONLY_32 10755 2.16 0.26 2.95 80 RCVD_IN_IADB_SENDERID 10584 2.38 1.12 2.90 81 RCVD_IN_IADB_DK 10199 2.31 1.12 2.80 82 TooManyTo_002 9954 2.38 1.53 2.73 83 MAILING_LIST_MULTI 9837 2.45 1.87 2.70 84 XMNumbers 9813 3.03 3.85 2.69 85 T_TooManySym_02 9731 2.12 0.81 2.67 86 TR_XM_DKIM_Undo 9607 10.35 29.03 2.63 87 HTML_MIME_NO_HTML_TAG 8989 2.50 2.58 2.46 88 DKIM_INVALID 8848 3.24 5.21 2.43 89 RCVD_IN_IADB_VOUCHED 8846 1.94 0.76 2.42 90 BAYES_95 8778 3.17 5.02 2.41 91 HTML_IMAGE_RATIO_06 8716 2.73 3.56 2.39 92 TR_XM_SpammyRelay 8682 4.99 11.31 2.38 93 XM_B_SpammyTLD 8482 2.65 3.44 2.32 94 HTML_IMAGE_RATIO_08 7978 2.67 3.83 2.19 95 FROM_EXCESS_BASE64 7615 2.04 1.92 2.09 96 BAYES_05 7422 1.65 0.71 2.03 97 INVALID_MSGID 7292 1.48 0.21 2.00 98 XM_CamelCaseFrm001 7242 2.26 2.93 1.99 99 KHOP_HELO_FCRDNS 7099 1.83 1.56 1.95 100 XM_DK_Undo_01 6865 1.83 1.72 1.88 101 HELO_NODOT 6839 1.43 0.34 1.87 102 HELO_NO_DOMAIN 6834 1.42 0.33 1.87 103 MIME_HTML_ONLY_MULTI 6808 2.32 3.43 1.87 104 XMSexyCombo_05 6808 2.54 4.18 1.87 105 TVD_RCVD_IP 6787 1.62 1.03 1.86 106 T_XMDrugObfuBody_14 6567 2.36 3.70 1.80 107 TR_Symld_Words 6556 1.79 1.79 1.80 108 XMDiploma_00 6390 2.02 2.68 1.75 109 RCVD_IN_IADB_OPTIN 6332 1.38 0.52 1.74 110 TO_MALFORMED 6325 1.24 0.03 1.73 111 T_XMDrugObfuBody_08 6130 2.27 3.71 1.68 112 BOTNET 5887 4.21 10.50 1.61 113 TR_XM_PhishingBody 5731 2.38 4.33 1.57 114 TM2_M_URI_OPT_OUT 5710 1.96 2.92 1.57 115 RELAYCOUNTRY_GB 5699 1.35 0.82 1.56 116 TR_DCC_Bayes_99 5671 7.86 23.14 1.55 117 TooManyTo_003 5640 1.52 1.45 1.55 118 TR_XM_UnparsRelay 5505 3.09 6.94 1.51 119 IN_HORDE_ADDRESS_BOOK 5432 1.08 0.08 1.49 120 XM_B_Unsub2 5432 1.88 2.81 1.49 121 SUBJ_ALL_CAPS 5274 1.80 2.67 1.45 122 RELAYCOUNTRY_CA 5076 2.57 5.44 1.39 123 XM_B_Investor 5049 2.30 4.52 1.38 124 TR_XM_SpammyWords5 5006 2.23 4.31 1.37 125 XM_SendGrid 4986 1.30 1.14 1.37 126 URI_NOVOWEL 4935 1.32 1.25 1.35 127 XMGappySubj_01 4741 0.96 0.13 1.30 128 UNTRUSTED_Relay 4564 2.85 6.74 1.25 129 XMStockSpam_06 4327 1.36 1.79 1.19 130 TooManyTo_004 4285 1.24 1.39 1.17 131 TM2_M_VERY_LONG_WORD 4258 1.72 3.06 1.17 132 XM_H_Long_From02 4077 1.04 0.86 1.12 133 XMCapTrack 4069 0.95 0.55 1.12 134 TVD_SPACE_RATIO 4033 0.81 0.11 1.11 135 XM_B_SEO 4021 2.35 5.37 1.10 136 XM_GoogleGroups 4009 0.97 0.67 1.10 137 XMBSHREFv2 3777 0.83 0.35 1.04 138 T_OBFU_PDF_ATTACH 3689 0.77 0.20 1.01 139 URI_HEX 3681 1.18 1.61 1.01 140 T_TooManySym_03 3600 0.77 0.24 0.99 141 TooManyTo_005 3548 1.08 1.35 0.97 142 TR_XM_DK_SendGrid 3418 0.90 0.79 0.94 143 XMBrknScrpt_02 3414 1.21 1.88 0.94 144 RELAYCOUNTRY_AU 3324 1.59 3.22 0.91 145 HTTPS_HTTP_MISMATCH 3255 1.02 1.33 0.89 146 DKIM_ADSP_CUSTOM_MED 3228 0.96 1.14 0.88 147 FROM_GOV_DKIM_AU 3218 0.67 0.16 0.88 148 SpammyFromTLD_01 3175 1.10 1.67 0.87 149 XMBody_95 3160 0.68 0.24 0.87 150 T_XMDrugObfuBody_00 3099 1.16 1.90 0.85 151 XMGenDplmaNmb 3097 1.03 1.48 0.85 152 XM_OfRef6 3045 1.60 3.44 0.83 153 XMGappySubj_02 2952 0.59 0.06 0.81 154 URI_TRY_3LD 2934 1.17 2.06 0.80 155 T_FILL_THIS_FORM_SHORT 2826 0.99 1.53 0.77 156 XM_B_DNDMA 2777 0.81 0.92 0.76 157 XM_ShortIntro_01 2715 0.73 0.69 0.74 158 RCVD_IN_BL_SPAMCOP_NET 2704 2.34 6.22 0.74 159 XMBody_17 2648 1.92 4.81 0.73 160 TR_MetaPhish_Combo_01 2647 0.79 0.96 0.73 161 XM_B_SpammyWords4 2582 1.21 2.42 0.71 162 XM_UB50 2582 1.51 3.44 0.71 163 XMBdyGiftCard01 2574 0.87 1.26 0.71 164 XMNoVowels 2521 0.60 0.36 0.69 165 XM_H_PHPMailer 2441 0.73 0.86 0.67 166 TR_XM_SEO4 2412 1.86 4.76 0.66 167 XMLngstWrd_00 2404 0.72 0.88 0.66 168 TR_XM_Base64_M1 2306 0.68 0.80 0.63 169 MPART_ALT_DIFF_COUNT 2288 0.77 1.10 0.63 170 TO_NO_BRKTS_HTML_ONLY 2263 0.58 0.48 0.62 171 NML_ADSP_CUSTOM_MED 2250 0.70 0.89 0.62 172 TR_LOTS_OF_MONEY3 2179 1.86 4.92 0.60 173 USER_IN_WELCOMELIST 2065 0.40 0.00 0.57 174 USER_IN_WHITELIST 2065 0.40 0.00 0.57 175 SHORT_HELO_AND_INLINE_IMAGE 1988 0.40 0.04 0.54 176 XMPhish14 1918 0.63 0.89 0.53 177 HTML_TAG_BALANCE_BODY 1889 0.82 1.55 0.52 178 HTML_IMAGE_ONLY_28 1885 0.46 0.32 0.52 179 TM2_M_BODY_EMPTY 1801 0.39 0.13 0.49 180 XM_B_COPY_HTML 1793 0.64 1.01 0.49 181 XMSubMetaSxObfu_02 1787 0.45 0.34 0.49 182 FORGED_GMAIL_RCVD 1781 0.59 0.85 0.49 183 XM_B_FormFill 1749 0.36 0.05 0.48 184 XMMoneyMeta_00 1728 0.54 0.71 0.47 185 XMPhish30 1719 0.70 1.26 0.47 186 BASE64_LENGTH_79_INF 1708 0.38 0.16 0.47 187 PLING_QUERY 1698 0.51 0.61 0.47 188 XMhairloss01 1682 0.34 0.05 0.46 189 XMSubMetaI_00 1655 0.72 1.37 0.45 190 TR_XM_PHPDW 1589 0.84 1.82 0.44 191 TR_XM_FormFill2 1578 0.83 1.78 0.43 192 TR_XM_PHPForged 1576 0.84 1.84 0.43 193 MISSING_HEADERS 1573 0.51 0.69 0.43 194 XM_ProductURIs 1571 0.52 0.75 0.43 195 TR_XM_SPAMCOP 1541 1.69 4.75 0.42 196 XMLngstWrd_01 1541 0.43 0.45 0.42 197 XM_shorewaves_Whitelist 1535 0.30 0.00 0.42 198 XM_H_PHPOS 1531 0.81 1.77 0.42 199 TR_XM_SpammyWords2 1513 3.70 11.66 0.41 200 FROM_GOV_SPOOF 1504 0.32 0.10 0.41 ----------------------------------------------------------------------