Email: 597419 Autolearn: 0 AvgScore: 3.66 AvgScanTime: 1.14 sec Spam: 181520 Autolearn: 0 AvgScore: 13.26 AvgScanTime: 1.36 sec Ham: 415899 Autolearn: 0 AvgScore: -0.53 AvgScanTime: 1.04 sec Time Spent Running SA: 188.59 hours Time Spent Processing Spam: 68.73 hours Time Spent Processing Ham: 119.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 176408 90.85 97.18 88.09 2 DKIM_SIGNED 167207 72.59 92.11 64.07 3 XM_DK_Pass 161139 70.83 88.77 63.00 4 DKIM_VALID 159194 69.87 87.70 62.09 5 RELAYCOUNTRY_US 157531 80.02 86.78 77.06 6 XM_B_Unicode 155625 77.04 85.73 73.24 7 DCC_CHECK 136632 45.20 75.27 32.08 8 XMListUnsubscribeExists 136006 52.61 74.93 42.88 9 XM_B_SpammyWords 131750 48.21 72.58 37.57 10 DKIM_VALID_AU 130088 56.43 71.67 49.78 11 XM_DK_Undo_02 83134 17.46 45.80 5.09 12 XM_B_Unicode3 80646 42.09 44.43 41.07 13 LOC_TINY_FONT_1 80553 28.57 44.38 21.67 14 XM_B_SpammyWords2 76842 23.53 42.33 15.32 15 HTML_FONT_LOW_CONTRAST 74112 29.55 40.83 24.63 16 RCVD_IN_MSPIKE_H2 69358 29.75 38.21 26.06 17 BAYES_50 68444 55.00 37.71 62.55 18 BAYES_99 68168 14.18 37.55 3.99 19 FVGT_m_MULTI_ODD 65814 27.04 36.26 23.02 20 TR_XM_DKIM_Undo 62010 11.90 34.16 2.18 21 BAYES_999 55799 11.46 30.74 3.05 22 DKIM_VALID_EF 52740 25.98 29.05 24.64 23 T_KAM_HTML_FONT_INVALID 51972 21.23 28.63 18.01 24 TR_DCC_Bayes_99 50325 9.58 27.72 1.66 25 MIME_HTML_ONLY 46915 23.97 25.85 23.15 26 DCC_CHECK_NEGATIVE 44869 54.76 24.72 67.87 27 T_TM2_M_HEADER_IN_MSG 44207 34.91 24.35 39.52 28 XMSubLong 41368 24.52 22.79 25.28 29 TR_XM_DK_Unsub 38130 14.28 21.01 11.35 30 XM_Multi_Part_URI 37372 15.36 20.59 13.07 31 LOTS_OF_MONEY 33649 9.71 18.54 5.85 32 TR_XM_SpammyWords4 31189 7.94 17.18 3.90 33 TR_XM_SpammyWords2 27908 5.19 15.37 0.75 34 UNPARSEABLE_RELAY 26600 10.70 14.65 8.97 35 RELAYCOUNTRY_META 25952 6.89 14.30 3.65 36 XM_B_Unsub 25807 13.74 14.22 13.53 37 XM_B_SpammyWords3 25569 6.92 14.09 3.80 38 TR_MAX_INTL_RELAY 24824 8.23 13.68 5.86 39 TR_XM_BayesUnsub 24722 12.71 13.62 12.32 40 BOTNET_IPINHOSTNAME 24585 6.40 13.54 3.29 41 TR_XM_SpammyRelay 17936 4.47 9.88 2.10 42 XM_Evil_Numbers_Gen 16205 7.50 8.93 6.87 43 BAYES_80 15452 5.06 8.51 3.55 44 BOTNET 15425 3.28 8.50 1.00 45 RCVD_IN_BL_SPAMCOP_NET 15079 2.94 8.31 0.60 46 TR_XM_UnparsRelay 14447 3.37 7.96 1.36 47 LotsOfNums_01 13603 7.57 7.49 7.61 48 BAYES_60 13361 7.87 7.36 8.09 49 FSL_BULK_SIG 13247 5.26 7.30 4.37 50 HTML_IMAGE_RATIO_02 12721 5.15 7.01 4.33 51 XM_Body_Dirty_Words 12398 3.54 6.83 2.11 52 TR_XM_SPAMCOP 12286 2.28 6.77 0.31 53 TR_LOTS_OF_MONEY3 11825 2.36 6.51 0.55 54 MPART_ALT_DIFF 11173 4.22 6.16 3.38 55 XM_B_PhoneNumber 10617 8.12 5.85 9.12 56 XMSubMetaSx_00 10562 4.36 5.82 3.73 57 UNTRUSTED_Relay 10295 2.78 5.67 1.51 58 XM_B_Phish_Phrases 9879 3.76 5.44 3.03 59 XM_H_Long_From01 9251 4.81 5.10 4.69 60 XM_UncommonTLD01 9239 4.02 5.09 3.55 61 XM_SPF_SoftFail 9114 3.66 5.02 3.06 62 HTML_IMAGE_RATIO_04 8937 3.79 4.92 3.30 63 XMBody_17 8813 1.89 4.86 0.60 64 BAYES_95 8563 3.04 4.72 2.31 65 TooManyTo_001 8554 11.52 4.71 14.49 66 XM_B_SEO 8480 2.23 4.67 1.17 67 HTML_IMAGE_RATIO_06 8163 3.47 4.50 3.03 68 DKIM_INVALID 8013 2.73 4.41 1.99 69 RELAYCOUNTRY_CA 7928 2.12 4.37 1.14 70 XM_B_Investor 7740 2.29 4.26 1.42 71 TR_XM_PhishingBody 7688 2.17 4.24 1.26 72 XMStrtUSub 7639 4.02 4.21 3.93 73 XM_OfRef6 7588 1.87 4.18 0.86 74 TR_XM_SEO4 7509 1.83 4.14 0.82 75 XM_H_GMP 7421 5.05 4.09 5.47 76 XMSexyCombo_05 7349 2.34 4.05 1.59 77 T_XMDrugObfuBody_14 7226 2.23 3.98 1.47 78 TR_XM_SpammyWords5 7086 1.98 3.90 1.14 79 MIME_HTML_ONLY_MULTI 6971 2.50 3.84 1.92 80 MIME_HTML_MOSTLY 6796 2.53 3.74 2.00 81 XMNumbers 6443 2.62 3.55 2.21 82 XM_B_SpammyTLD 6288 3.44 3.46 3.43 83 RCVD_IN_VALIDITY_SAFE 6231 3.45 3.43 3.45 84 MIME_QP_LONG_LINE 6205 4.17 3.42 4.49 85 TM2_M_URI_OPT_OUT 6138 1.88 3.38 1.22 86 HTML_IMAGE_RATIO_08 6084 2.50 3.35 2.13 87 XM_URI_RBL 5868 1.09 3.23 0.16 88 XMDiploma_00 5776 6.76 3.18 8.33 89 TM2_M_VERY_LONG_WORD 5542 1.66 3.05 1.05 90 USER_IN_DEF_DKIM_WL 5315 9.25 2.93 12.01 91 T_XMDrugObfuBody_08 5143 1.83 2.83 1.39 92 XM_CamelCaseFrm001 5117 2.27 2.82 2.04 93 XM_UB50 4984 1.40 2.75 0.81 94 RCVD_IN_MSPIKE_WL 4943 4.54 2.72 5.33 95 RCVD_IN_MSPIKE_H3 4943 4.54 2.72 5.33 96 RCVD_IN_VALIDITY_CERTIFIED 4880 2.80 2.69 2.84 97 URI_TRY_3LD 4879 1.23 2.69 0.60 98 T_TooManySym_01 4654 3.70 2.56 4.20 99 RELAYCOUNTRY_AU 4541 1.25 2.50 0.71 100 XM_B_Unsub2 4533 1.65 2.50 1.28 101 RCVD_IN_VALIDITY_RPBL 4422 0.79 2.44 0.07 102 XM_B_SpammyWords4 4288 1.14 2.36 0.60 103 XMBrknScrpt_02 4186 1.32 2.31 0.90 104 SUBJ_ALL_CAPS 4154 1.58 2.29 1.27 105 T_XMHurry_00 3904 1.00 2.15 0.50 106 MAILING_LIST_MULTI 3853 2.29 2.12 2.37 107 FROM_EXCESS_BASE64 3763 1.81 2.07 1.70 108 T_REMOTE_IMAGE 3429 2.71 1.89 3.07 109 XMStockSpam_06 3363 1.25 1.85 0.99 110 TR_XM_NoHeaderRelay 3250 0.64 1.79 0.14 111 XM_DK_Undo_01 3241 1.82 1.79 1.84 112 URI_HEX 3100 1.24 1.71 1.04 113 HTML_TAG_BALANCE_BODY 3098 0.86 1.71 0.48 114 XMGenDplmaNmb 3080 1.10 1.70 0.83 115 SpammyFromTLD_02 3051 0.77 1.68 0.38 116 BAYES_40 3018 5.74 1.66 7.53 117 TR_XM_INV_DKIM 2988 0.55 1.65 0.07 118 XM_HighProb1 2939 0.50 1.62 0.01 119 HTML_MIME_NO_HTML_TAG 2913 1.73 1.60 1.78 120 XMPhish14 2800 0.72 1.54 0.37 121 SpammyFromTLD_01 2786 0.96 1.53 0.70 122 AC_BR_BONANZA 2768 0.52 1.52 0.09 123 ANY_BOUNCE_MESSAGE 2601 2.62 1.43 3.14 124 BOUNCE_MESSAGE 2598 2.62 1.43 3.14 125 XM_H_Long_From02 2556 1.10 1.41 0.97 126 TR_XM_PHPForged 2485 5.59 1.37 7.44 127 TR_MetaPhish_Combo_01 2440 0.86 1.34 0.65 128 RCVD_IN_IADB_LISTED 2439 2.78 1.34 3.40 129 TR_XM_PHPDW 2395 5.58 1.32 7.43 130 TR_XM_FormFill2 2390 5.58 1.32 7.44 131 XM_H_PHPOS 2367 5.57 1.30 7.43 132 LONGLN_LOW_CONTRAST 2350 0.53 1.29 0.20 133 URIBL_DBL_SPAM 2348 0.40 1.29 0.01 134 ALL_TRUSTED 2346 14.18 1.29 19.80 135 XM_ProductURIs 2346 1.02 1.29 0.90 136 HTTPS_HTTP_MISMATCH 2298 1.00 1.27 0.88 137 KHOP_HELO_FCRDNS 2295 1.21 1.26 1.18 138 T_XMDrugObfuBody_00 2289 0.78 1.26 0.56 139 T_FILL_THIS_FORM_SHORT 2181 0.88 1.20 0.74 140 MPART_ALT_DIFF_COUNT 2174 0.78 1.20 0.60 141 RCVD_IN_IADB_SPF 2141 2.42 1.18 2.96 142 TR_XM_InvalidRelay 2140 0.37 1.18 0.02 143 BAYES_20 2121 2.72 1.17 3.40 144 XM_SendGrid 2068 1.11 1.14 1.09 145 XMHTML_After_End 2031 0.56 1.12 0.32 146 BOTNET_NORDNS 2010 0.34 1.11 0.01 147 RCVD_IN_IADB_DK 2006 2.12 1.11 2.57 148 RCVD_IN_IADB_SENDERID 1996 2.17 1.10 2.63 149 XMPhish30 1985 0.53 1.09 0.29 150 TR_Symld_Words 1885 1.37 1.04 1.51 151 URI_NOVOWEL 1882 2.07 1.04 2.52 152 T_Symld_Words_02 1882 0.63 1.04 0.45 153 TR_Caps_n_Bayes_99 1878 0.34 1.03 0.03 154 XMMoneyMeta_00 1837 0.75 1.01 0.63 155 RDNS_DYNAMIC 1832 0.53 1.01 0.32 156 THIS_AD 1815 0.53 1.00 0.32 157 RELAYCOUNTRY_FR 1808 0.45 1.00 0.21 158 XMLngstWrd_00 1805 0.73 0.99 0.62 159 PDS_RDNS_DYNAMIC_FP 1794 0.43 0.99 0.19 160 TR_XM_Base64_M1 1790 0.66 0.99 0.52 161 DKIM_ADSP_CUSTOM_MED 1770 0.80 0.98 0.73 162 XM_B_Phish66 1768 0.53 0.97 0.34 163 LongTLD 1746 0.59 0.96 0.43 164 XM_B_COPY_HTML 1744 0.65 0.96 0.51 165 XM_S_SpammyWords 1679 0.39 0.92 0.16 166 TR_XM_Spammywords 1679 0.39 0.92 0.16 167 RELAYCOUNTRY_GB 1662 0.55 0.92 0.40 168 XMReplyNow 1627 0.42 0.90 0.22 169 XMSexyCombo_01 1614 0.38 0.89 0.16 170 TR_Mismatch_TLD_02 1600 0.31 0.88 0.05 171 XM_UB99 1557 0.26 0.86 0.00 172 XMBdyGiftCard01 1551 0.66 0.85 0.57 173 TVD_RCVD_IP 1546 1.19 0.85 1.34 174 RELAYCOUNTRY_NL 1539 0.34 0.85 0.11 175 XM_B_DNDMA 1529 0.52 0.84 0.38 176 XMSubMetaI_00 1523 0.63 0.84 0.54 177 DKIM_ADSP_NXDOMAIN 1521 0.43 0.84 0.26 178 TooManyTo_002 1503 2.34 0.83 3.00 179 XM_DIRTYINTL 1473 0.30 0.81 0.08 180 XMHTMLBadTable_001 1468 0.41 0.81 0.24 181 XM_OfRef7 1445 0.33 0.80 0.13 182 HTML_FONT_FACE_BAD 1441 0.46 0.79 0.32 183 XM_PDF 1409 2.87 0.78 3.79 184 NML_ADSP_CUSTOM_MED 1404 0.55 0.77 0.45 185 HELO_DYNAMIC_SPLIT_IP 1403 0.24 0.77 0.01 186 BAYES_00 1402 5.04 0.77 6.90 187 HOSTED_IMG_MULTI_PUB_01 1399 0.24 0.77 0.01 188 AC_HTML_NONSENSE_TAGS 1396 0.29 0.77 0.08 189 XM_UB60 1391 0.28 0.77 0.07 190 XMNoVowels 1385 0.57 0.76 0.48 191 GOOG_STO_IMG_NOHTML 1362 0.26 0.75 0.05 192 T_TooManySym_02 1330 1.70 0.73 2.13 193 FORGED_GMAIL_RCVD 1328 0.52 0.73 0.43 194 T_STY_INVIS_DIRECT 1319 0.38 0.73 0.24 195 SHOPIFY_IMG_NOT_RCVD_SFY 1310 0.42 0.72 0.29 196 T_MONEY_PERCENT 1289 0.49 0.71 0.39 197 TR_LOTS_OF_MONEY2 1289 0.49 0.71 0.39 198 TooManyTo_003 1281 1.12 0.71 1.30 199 XMPhish08 1273 0.37 0.70 0.22 200 XMSubMetaSxObfu_03 1246 0.41 0.69 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 366353 90.85 97.18 88.09 2 RELAYCOUNTRY_US 320501 80.02 86.78 77.06 3 XM_B_Unicode 304624 77.04 85.73 73.24 4 DCC_CHECK_NEGATIVE 282285 54.76 24.72 67.87 5 DKIM_SIGNED 266484 72.59 92.11 64.07 6 XM_DK_Pass 262022 70.83 88.77 63.00 7 BAYES_50 260153 55.00 37.71 62.55 8 DKIM_VALID 258212 69.87 87.70 62.09 9 DKIM_VALID_AU 207038 56.43 71.67 49.78 10 XMListUnsubscribeExists 178322 52.61 74.93 42.88 11 XM_B_Unicode3 170822 42.09 44.43 41.07 12 T_TM2_M_HEADER_IN_MSG 164349 34.91 24.35 39.52 13 XM_B_SpammyWords 156261 48.21 72.58 37.57 14 DCC_CHECK 133422 45.20 75.27 32.08 15 RCVD_IN_MSPIKE_H2 108404 29.75 38.21 26.06 16 XMSubLong 105147 24.52 22.79 25.28 17 DKIM_VALID_EF 102472 25.98 29.05 24.64 18 HTML_FONT_LOW_CONTRAST 102435 29.55 40.83 24.63 19 MIME_HTML_ONLY 96280 23.97 25.85 23.15 20 FVGT_m_MULTI_ODD 95736 27.04 36.26 23.02 21 LOC_TINY_FONT_1 90109 28.57 44.38 21.67 22 ALL_TRUSTED 82363 14.18 1.29 19.80 23 T_KAM_HTML_FONT_INVALID 74889 21.23 28.63 18.01 24 XM_B_SpammyWords2 63728 23.53 42.33 15.32 25 TooManyTo_001 60277 11.52 4.71 14.49 26 XM_B_Unsub 56276 13.74 14.22 13.53 27 IN_ZIMBRA_NJ_WHITELIST 54884 9.21 0.09 13.20 28 XM_Multi_Part_URI 54370 15.36 20.59 13.07 29 TR_XM_BayesUnsub 51239 12.71 13.62 12.32 30 USER_IN_DEF_DKIM_WL 49969 9.25 2.93 12.01 31 TR_XM_DK_Unsub 47189 14.28 21.01 11.35 32 XM_B_PhoneNumber 37921 8.12 5.85 9.12 33 UNPARSEABLE_RELAY 37295 10.70 14.65 8.97 34 XMDiploma_00 34632 6.76 3.18 8.33 35 BAYES_60 33638 7.87 7.36 8.09 36 XM_H_PHPMailer 31964 5.53 0.60 7.69 37 LotsOfNums_01 31651 7.57 7.49 7.61 38 BAYES_40 31302 5.74 1.66 7.53 39 TR_XM_FormFill2 30950 5.58 1.32 7.44 40 TR_XM_PHPForged 30931 5.59 1.37 7.44 41 TR_XM_PHPDW 30914 5.58 1.32 7.43 42 XM_H_PHPOS 30887 5.57 1.30 7.43 43 XM_H_PHPOS_M 29907 5.09 0.27 7.19 44 XM_DKIMWhitelistDomains 28994 4.87 0.06 6.97 45 BAYES_00 28706 5.04 0.77 6.90 46 XM_Evil_Numbers_Gen 28582 7.50 8.93 6.87 47 TR_MAX_INTL_RELAY 24361 8.23 13.68 5.86 48 LOTS_OF_MONEY 24342 9.71 18.54 5.85 49 XM_H_GMP 22760 5.05 4.09 5.47 50 RCVD_IN_MSPIKE_WL 22152 4.54 2.72 5.33 51 RCVD_IN_MSPIKE_H3 22150 4.54 2.72 5.33 52 XM_DK_Undo_02 21159 17.46 45.80 5.09 53 TR_XM_DK_Bayes 19692 3.46 0.54 4.73 54 XM_H_Long_From01 19501 4.81 5.10 4.69 55 TR_XM_DK_Bayes1 19404 3.41 0.53 4.67 56 MIME_QP_LONG_LINE 18685 4.17 3.42 4.49 57 FSL_BULK_SIG 18158 5.26 7.30 4.37 58 HTML_IMAGE_RATIO_02 18020 5.15 7.01 4.33 59 T_TooManySym_01 17456 3.70 2.56 4.20 60 TR_XM_DK_Bayes2 16755 2.95 0.48 4.03 61 BAYES_99 16575 14.18 37.55 3.99 62 XMStrtUSub 16348 4.02 4.21 3.93 63 TR_XM_SpammyWords4 16228 7.94 17.18 3.90 64 XM_B_SpammyWords3 15791 6.92 14.09 3.80 65 XM_PDF 15763 2.87 0.78 3.79 66 XMSubMetaSx_00 15507 4.36 5.82 3.73 67 RELAYCOUNTRY_META 15185 6.89 14.30 3.65 68 XM_UncommonTLD01 14761 4.02 5.09 3.55 69 BAYES_80 14758 5.06 8.51 3.55 70 RCVD_IN_VALIDITY_SAFE 14355 3.45 3.43 3.45 71 XM_B_SpammyTLD 14267 3.44 3.46 3.43 72 BAYES_20 14151 2.72 1.17 3.40 73 RCVD_IN_IADB_LISTED 14142 2.78 1.34 3.40 74 MPART_ALT_DIFF 14046 4.22 6.16 3.38 75 HTML_IMAGE_RATIO_04 13713 3.79 4.92 3.30 76 BOTNET_IPINHOSTNAME 13669 6.40 13.54 3.29 77 ANY_BOUNCE_MESSAGE 13068 2.62 1.43 3.14 78 BOUNCE_MESSAGE 13067 2.62 1.43 3.14 79 T_REMOTE_IMAGE 12755 2.71 1.89 3.07 80 XM_SPF_SoftFail 12734 3.66 5.02 3.06 81 BAYES_999 12670 11.46 30.74 3.05 82 XM_B_Phish_Phrases 12607 3.76 5.44 3.03 83 HTML_IMAGE_RATIO_06 12596 3.47 4.50 3.03 84 TooManyTo_002 12471 2.34 0.83 3.00 85 RCVD_IN_IADB_SPF 12306 2.42 1.18 2.96 86 RCVD_IN_VALIDITY_CERTIFIED 11831 2.80 2.69 2.84 87 DATE_IN_PAST_06_12 11723 2.12 0.51 2.82 88 RCVD_IN_IADB_SENDERID 10955 2.17 1.10 2.63 89 RCVD_IN_IADB_DK 10682 2.12 1.11 2.57 90 URI_NOVOWEL 10470 2.07 1.04 2.52 91 MAILING_LIST_MULTI 9844 2.29 2.12 2.37 92 BAYES_95 9593 3.04 4.72 2.31 93 RCVD_IN_IADB_VOUCHED 9517 1.80 0.68 2.29 94 XMNumbers 9195 2.62 3.55 2.21 95 TR_XM_DKIM_Undo 9061 11.90 34.16 2.18 96 DATE_IN_PAST_03_06 8996 1.60 0.32 2.16 97 HTML_IMAGE_RATIO_08 8877 2.50 3.35 2.13 98 T_TooManySym_02 8844 1.70 0.73 2.13 99 XM_Body_Dirty_Words 8757 3.54 6.83 2.11 100 TR_XM_SpammyRelay 8750 4.47 9.88 2.10 101 XM_CamelCaseFrm001 8464 2.27 2.82 2.04 102 MIME_HTML_MOSTLY 8298 2.53 3.74 2.00 103 DKIM_INVALID 8272 2.73 4.41 1.99 104 MIME_HTML_ONLY_MULTI 7977 2.50 3.84 1.92 105 XM_DK_Undo_01 7656 1.82 1.79 1.84 106 HTML_MIME_NO_HTML_TAG 7405 1.73 1.60 1.78 107 INVALID_MSGID 7306 1.26 0.13 1.76 108 TO_MALFORMED 7088 1.20 0.04 1.70 109 FROM_EXCESS_BASE64 7069 1.81 2.07 1.70 110 BAYES_05 7022 1.34 0.54 1.69 111 TR_DCC_Bayes_99 6915 9.58 27.72 1.66 112 XMSexyCombo_05 6625 2.34 4.05 1.59 113 HELO_NODOT 6613 1.22 0.38 1.59 114 HELO_NO_DOMAIN 6613 1.22 0.38 1.59 115 RCVD_IN_IADB_OPTIN 6481 1.21 0.42 1.56 116 UNTRUSTED_Relay 6294 2.78 5.67 1.51 117 TR_Symld_Words 6293 1.37 1.04 1.51 118 T_XMDrugObfuBody_14 6103 2.23 3.98 1.47 119 XM_B_Investor 5915 2.29 4.26 1.42 120 T_XMDrugObfuBody_08 5764 1.83 2.83 1.39 121 TR_XM_UnparsRelay 5676 3.37 7.96 1.36 122 TVD_RCVD_IP 5560 1.19 0.85 1.34 123 TooManyTo_003 5397 1.12 0.71 1.30 124 XM_B_Unsub2 5337 1.65 2.50 1.28 125 SUBJ_ALL_CAPS 5276 1.58 2.29 1.27 126 TR_XM_PhishingBody 5253 2.17 4.24 1.26 127 TM2_M_URI_OPT_OUT 5087 1.88 3.38 1.22 128 IN_HORDE_ADDRESS_BOOK 4966 0.86 0.08 1.19 129 KHOP_HELO_FCRDNS 4915 1.21 1.26 1.18 130 XM_B_SEO 4870 2.23 4.67 1.17 131 XM_B_FormFill 4809 0.83 0.09 1.16 132 RELAYCOUNTRY_CA 4731 2.12 4.37 1.14 133 TR_XM_SpammyWords5 4722 1.98 3.90 1.14 134 XM_SendGrid 4535 1.11 1.14 1.09 135 TM2_M_VERY_LONG_WORD 4360 1.66 3.05 1.05 136 URI_HEX 4317 1.24 1.71 1.04 137 XMGappySubj_01 4272 0.77 0.19 1.03 138 BOTNET 4176 3.28 8.50 1.00 139 XMCapTrack 4167 0.84 0.47 1.00 140 XM_GoogleGroups 4147 0.89 0.65 1.00 141 XMStockSpam_06 4118 1.25 1.85 0.99 142 TVD_SPACE_RATIO 4045 0.74 0.19 0.97 143 XM_H_Long_From02 4032 1.10 1.41 0.97 144 XMBSHREFv2 3916 0.75 0.31 0.94 145 TooManyTo_004 3868 0.84 0.64 0.93 146 XMBrknScrpt_02 3728 1.32 2.31 0.90 147 XM_ProductURIs 3725 1.02 1.29 0.90 148 HTTPS_HTTP_MISMATCH 3657 1.00 1.27 0.88 149 XM_OfRef6 3590 1.87 4.18 0.86 150 XMGenDplmaNmb 3465 1.10 1.70 0.83 151 TR_XM_SEO4 3399 1.83 4.14 0.82 152 XM_UB50 3378 1.40 2.75 0.81 153 XM_TLDProd2 3215 0.62 0.28 0.77 154 T_TooManySym_03 3184 0.59 0.19 0.77 155 TR_XM_SpammyWords2 3113 5.19 15.37 0.75 156 TooManyTo_005 3107 0.70 0.60 0.75 157 T_FILL_THIS_FORM_SHORT 3085 0.88 1.20 0.74 158 DKIM_ADSP_CUSTOM_MED 3036 0.80 0.98 0.73 159 RELAYCOUNTRY_AU 2947 1.25 2.50 0.71 160 XM_H_Trusted_IP 2938 0.49 0.00 0.71 161 SpammyFromTLD_01 2932 0.96 1.53 0.70 162 TR_XM_DK_SendGrid 2718 0.66 0.67 0.65 163 PLING_QUERY 2698 0.61 0.54 0.65 164 TR_MetaPhish_Combo_01 2683 0.86 1.34 0.65 165 XMMoneyMeta_00 2617 0.75 1.01 0.63 166 XMLngstWrd_00 2585 0.73 0.99 0.62 167 XM_ShortIntro_01 2543 0.57 0.47 0.61 168 XM_B_SpammyWords4 2515 1.14 2.36 0.60 169 RCVD_IN_BL_SPAMCOP_NET 2506 2.94 8.31 0.60 170 XMSubNoVowel 2506 0.50 0.28 0.60 171 MPART_ALT_DIFF_COUNT 2499 0.78 1.20 0.60 172 URI_TRY_3LD 2487 1.23 2.69 0.60 173 XMBody_17 2486 1.89 4.86 0.60 174 FROM_GOV_DKIM_AU 2446 0.45 0.13 0.59 175 T_OBFU_PDF_ATTACH 2376 0.46 0.20 0.57 176 XMBdyGiftCard01 2368 0.66 0.85 0.57 177 T_XMDrugObfuBody_00 2347 0.78 1.26 0.56 178 XMBody_95 2292 0.45 0.22 0.55 179 TR_LOTS_OF_MONEY3 2287 2.36 6.51 0.55 180 XMSubMetaI_00 2238 0.63 0.84 0.54 181 TR_XM_Base64_M1 2152 0.66 0.99 0.52 182 XMGappySubj_02 2114 0.37 0.06 0.51 183 XM_B_COPY_HTML 2113 0.65 0.96 0.51 184 SHORT_HELO_AND_INLINE_IMAGE 2109 0.38 0.08 0.51 185 T_XMHurry_00 2099 1.00 2.15 0.50 186 HTML_TAG_BALANCE_BODY 2011 0.86 1.71 0.48 187 XMNoVowels 2002 0.57 0.76 0.48 188 USER_IN_WHITELIST 1957 0.33 0.00 0.47 189 USER_IN_WELCOMELIST 1957 0.33 0.00 0.47 190 XM_H_OutlookMailer 1942 0.35 0.07 0.47 191 T_Symld_Words_02 1875 0.63 1.04 0.45 192 NML_ADSP_CUSTOM_MED 1859 0.55 0.77 0.45 193 TO_NO_BRKTS_HTML_ONLY 1822 0.38 0.25 0.44 194 NO_DNS_FOR_FROM 1795 0.45 0.49 0.43 195 FORGED_GMAIL_RCVD 1787 0.52 0.73 0.43 196 LongTLD 1777 0.59 0.96 0.43 197 HTML_IMAGE_ONLY_32 1734 0.33 0.15 0.42 198 HTML_IMAGE_ONLY_28 1709 0.41 0.40 0.41 199 RELAYCOUNTRY_GB 1650 0.55 0.92 0.40 200 TR_LOTS_OF_MONEY2 1624 0.49 0.71 0.39 ----------------------------------------------------------------------