Email: 548554 Autolearn: 0 AvgScore: 4.47 AvgScanTime: 1.25 sec Spam: 189659 Autolearn: 0 AvgScore: 13.35 AvgScanTime: 1.39 sec Ham: 358895 Autolearn: 0 AvgScore: -0.22 AvgScanTime: 1.17 sec Time Spent Running SA: 190.26 hours Time Spent Processing Spam: 73.22 hours Time Spent Processing Ham: 117.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 182789 89.94 96.38 86.54 2 DKIM_SIGNED 172986 81.08 91.21 75.73 3 XM_DK_Pass 166178 78.95 87.62 74.38 4 DKIM_VALID 164465 77.97 86.72 73.35 5 XM_B_Unicode 163620 75.88 86.27 70.38 6 RELAYCOUNTRY_US 161241 82.88 85.02 81.75 7 DCC_CHECK 143072 50.72 75.44 37.66 8 XMListUnsubscribeExists 142938 59.33 75.37 50.86 9 XM_B_SpammyWords 137572 54.57 72.54 45.07 10 DKIM_VALID_AU 135374 62.83 71.38 58.31 11 XM_DK_Undo_02 88745 19.99 46.79 5.82 12 XM_B_Unicode3 84138 41.70 44.36 40.29 13 XM_B_SpammyWords2 81206 26.68 42.82 18.15 14 LOC_TINY_FONT_1 80998 31.44 42.71 25.49 15 HTML_FONT_LOW_CONTRAST 80081 32.87 42.22 27.93 16 RCVD_IN_MSPIKE_H2 75924 34.70 40.03 31.88 17 BAYES_99 74187 16.54 39.12 4.60 18 BAYES_50 71568 52.67 37.74 60.56 19 FVGT_m_MULTI_ODD 70155 29.72 36.99 25.88 20 TR_XM_DKIM_Undo 66642 13.82 35.14 2.55 21 BAYES_999 61106 13.43 32.22 3.50 22 T_KAM_HTML_FONT_INVALID 57010 24.63 30.06 21.76 23 TR_DCC_Bayes_99 54380 11.12 28.67 1.85 24 DKIM_VALID_EF 52184 28.78 27.51 29.45 25 MIME_HTML_ONLY 47681 21.06 25.14 18.91 26 DCC_CHECK_NEGATIVE 46564 49.24 24.55 62.29 27 T_TM2_M_HEADER_IN_MSG 44372 27.80 23.40 30.12 28 XMSubLong 42273 22.06 22.29 21.94 29 TR_XM_DK_Unsub 39688 16.18 20.93 13.67 30 XM_Multi_Part_URI 36616 16.02 19.31 14.29 31 LOTS_OF_MONEY 32976 10.55 17.39 6.94 32 TR_XM_SpammyWords2 31269 6.17 16.49 0.72 33 TR_XM_SpammyWords4 30206 8.52 15.93 4.61 34 UNPARSEABLE_RELAY 28202 12.50 14.87 11.24 35 XM_B_Unsub 26950 9.98 14.21 7.75 36 XM_B_SpammyWords3 26594 7.90 14.02 4.66 37 RELAYCOUNTRY_META 26337 7.50 13.89 4.13 38 TR_XM_BayesUnsub 25730 8.90 13.57 6.44 39 TR_MAX_INTL_RELAY 23956 8.85 12.63 6.85 40 BOTNET_IPINHOSTNAME 23743 6.78 12.52 3.75 41 TR_XM_SpammyRelay 18353 4.82 9.68 2.25 42 XM_Evil_Numbers_Gen 17434 8.58 9.19 8.25 43 BOTNET 16644 3.77 8.78 1.13 44 RCVD_IN_BL_SPAMCOP_NET 16186 3.42 8.53 0.72 45 BAYES_80 14683 5.37 7.74 4.12 46 TR_XM_UnparsRelay 14631 3.81 7.71 1.75 47 FSL_BULK_SIG 14493 6.25 7.64 5.51 48 LotsOfNums_01 13981 8.27 7.37 8.75 49 BAYES_60 13368 8.54 7.05 9.32 50 UNTRUSTED_Relay 13001 3.57 6.85 1.84 51 TR_XM_SPAMCOP 12813 2.57 6.76 0.36 52 XM_Body_Dirty_Words 12067 3.88 6.36 2.56 53 HTML_IMAGE_RATIO_02 11628 5.11 6.13 4.56 54 XM_B_PhoneNumber 11430 8.79 6.03 10.24 55 MPART_ALT_DIFF 11286 4.58 5.95 3.86 56 TR_LOTS_OF_MONEY3 10701 2.42 5.64 0.72 57 HTML_IMAGE_RATIO_04 10592 4.49 5.58 3.91 58 XMSubMetaSx_00 10566 4.57 5.57 4.04 59 XM_H_Long_From01 10485 5.27 5.53 5.13 60 XMBody_17 10390 2.30 5.48 0.62 61 XM_UncommonTLD01 9590 4.41 5.06 4.08 62 XM_B_SEO 8993 2.63 4.74 1.52 63 XM_B_Investor 8940 2.77 4.71 1.75 64 XM_SPF_SoftFail 8914 3.64 4.70 3.08 65 HTML_IMAGE_RATIO_06 8768 4.19 4.62 3.96 66 BAYES_95 8676 3.36 4.57 2.72 67 DKIM_INVALID 8521 3.11 4.49 2.38 68 XM_B_Phish_Phrases 8459 3.77 4.46 3.40 69 XM_OfRef6 8313 2.24 4.38 1.11 70 TR_XM_SpammyWords5 8276 2.35 4.36 1.28 71 TR_XM_SEO4 8128 2.09 4.29 0.93 72 RELAYCOUNTRY_CA 8088 2.27 4.26 1.21 73 MIME_HTML_MOSTLY 7853 2.90 4.14 2.24 74 TooManyTo_001 7737 6.88 4.08 8.36 75 TR_XM_PhishingBody 7703 2.34 4.06 1.43 76 XM_UB50 7587 2.01 4.00 0.95 77 XM_URI_RBL 7239 1.49 3.82 0.26 78 RCVD_IN_VALIDITY_SAFE 7203 3.91 3.80 3.97 79 XMSexyCombo_05 7198 2.35 3.80 1.59 80 XMStrtUSub 7061 4.09 3.72 4.28 81 TM2_M_VERY_LONG_WORD 6927 2.48 3.65 1.86 82 XMNumbers 6778 2.97 3.57 2.66 83 XM_H_GMP 6731 5.27 3.55 6.18 84 USER_IN_DEF_DKIM_WL 6668 10.35 3.52 13.97 85 MIME_QP_LONG_LINE 6539 4.77 3.45 5.46 86 T_XMDrugObfuBody_14 6471 2.26 3.41 1.66 87 MIME_HTML_ONLY_MULTI 6387 2.60 3.37 2.20 88 HTML_IMAGE_RATIO_08 6268 2.76 3.30 2.46 89 XM_B_SpammyTLD 6057 3.70 3.19 3.96 90 TM2_M_URI_OPT_OUT 6041 2.00 3.19 1.38 91 XMDiploma_00 5981 2.31 3.15 1.87 92 RCVD_IN_VALIDITY_CERTIFIED 5735 3.17 3.02 3.24 93 RCVD_IN_VALIDITY_RPBL 5454 1.11 2.88 0.17 94 XM_CamelCaseFrm001 5415 2.50 2.86 2.32 95 T_XMDrugObfuBody_08 5291 2.00 2.79 1.58 96 T_TooManySym_01 5260 4.72 2.77 5.74 97 RCVD_IN_MSPIKE_H3 5084 4.76 2.68 5.85 98 RCVD_IN_MSPIKE_WL 5084 4.76 2.68 5.85 99 SUBJ_ALL_CAPS 4988 1.88 2.63 1.48 100 URI_TRY_3LD 4498 1.34 2.37 0.80 101 T_REMOTE_IMAGE 4478 3.18 2.36 3.61 102 XMBrknScrpt_02 4436 1.43 2.34 0.94 103 T_XMHurry_00 4417 1.30 2.33 0.76 104 XM_B_Unsub2 4290 1.74 2.26 1.46 105 ALL_TRUSTED 4140 10.35 2.18 14.67 106 RELAYCOUNTRY_AU 4021 1.26 2.12 0.81 107 URIBL_DBL_SPAM 3986 0.73 2.10 0.01 108 XM_B_SpammyWords4 3773 1.23 1.99 0.83 109 HTML_TAG_BALANCE_BODY 3589 1.03 1.89 0.57 110 XM_HighProb1 3449 0.64 1.82 0.02 111 MAILING_LIST_MULTI 3378 2.40 1.78 2.72 112 XMGenDplmaNmb 3339 1.21 1.76 0.92 113 HTML_MIME_NO_HTML_TAG 3304 2.12 1.74 2.32 114 AC_BR_BONANZA 3222 0.66 1.70 0.10 115 FROM_EXCESS_BASE64 3222 1.91 1.70 2.03 116 XM_DK_Undo_01 3200 1.76 1.69 1.80 117 SpammyFromTLD_01 3197 1.17 1.69 0.90 118 URI_NOVOWEL 3179 2.48 1.68 2.91 119 SpammyFromTLD_02 3049 0.83 1.61 0.42 120 LONGLN_LOW_CONTRAST 3012 0.79 1.59 0.36 121 TR_XM_NoHeaderRelay 2948 0.62 1.55 0.13 122 TR_XM_INV_DKIM 2896 0.57 1.53 0.06 123 T_XMDrugObfuBody_00 2870 0.95 1.51 0.65 124 XMStockSpam_06 2636 1.20 1.39 1.10 125 BAYES_40 2621 3.57 1.38 4.73 126 XM_H_Long_From02 2578 1.08 1.36 0.93 127 HOSTED_IMG_MULTI_PUB_01 2549 0.48 1.34 0.02 128 TR_Caps_n_Bayes_99 2511 0.48 1.32 0.04 129 HTML_FONT_TINY_NORDNS 2508 0.52 1.32 0.09 130 RCVD_IN_IADB_LISTED 2503 3.14 1.32 4.10 131 XM_ProductURIs 2466 0.82 1.30 0.57 132 URI_HEX 2450 1.22 1.29 1.18 133 XM_SendGrid 2378 1.41 1.25 1.49 134 BOTNET_NORDNS 2194 0.40 1.16 0.01 135 TR_XM_PHPForged 2184 0.61 1.15 0.33 136 TM2_M_BODY_EMPTY 2168 0.67 1.14 0.43 137 XMSubMetaI_00 2159 0.68 1.14 0.43 138 TR_XM_PHPDW 2139 0.61 1.13 0.33 139 RCVD_IN_IADB_SPF 2128 2.74 1.12 3.59 140 TR_XM_InvalidRelay 2106 0.41 1.11 0.03 141 XM_B_Phish66 2101 0.55 1.11 0.25 142 TR_XM_FormFill2 2095 0.60 1.10 0.33 143 XM_H_PHPOS 2074 0.58 1.09 0.32 144 XMPhish14 2069 0.72 1.09 0.52 145 HTTPS_HTTP_MISMATCH 2067 0.93 1.09 0.85 146 T_FILL_THIS_FORM_SHORT 2057 0.90 1.08 0.81 147 XMPhish30 2055 0.62 1.08 0.37 148 XMEmptyBody_01 2052 0.45 1.08 0.11 149 THIS_AD 2010 0.66 1.06 0.44 150 RELAYCOUNTRY_IN 2005 0.40 1.06 0.05 151 TR_MetaPhish_Combo_01 1993 0.88 1.05 0.79 152 RCVD_IN_IADB_DK 1963 2.38 1.04 3.09 153 RCVD_IN_IADB_SENDERID 1947 2.45 1.03 3.20 154 BAYES_20 1923 2.50 1.01 3.28 155 XMBdyGiftCard01 1919 0.89 1.01 0.83 156 MPART_ALT_DIFF_COUNT 1919 0.69 1.01 0.52 157 XMHTML_After_End 1880 0.55 0.99 0.32 158 LongTLD 1846 0.60 0.97 0.40 159 KHOP_HELO_FCRDNS 1828 1.33 0.96 1.53 160 T_MONEY_PERCENT 1818 0.48 0.96 0.22 161 TR_LOTS_OF_MONEY2 1818 0.48 0.96 0.22 162 XM_DIRTYINTL 1816 0.40 0.96 0.10 163 TR_Symld_Words 1800 1.35 0.95 1.57 164 XM_B_COPY_HTML 1752 0.66 0.92 0.52 165 RELAYCOUNTRY_GB 1718 0.60 0.91 0.43 166 DIET_1 1646 0.63 0.87 0.50 167 XMHTMLBadTable_001 1578 0.47 0.83 0.28 168 DKIM_ADSP_CUSTOM_MED 1551 0.89 0.82 0.93 169 XMClaimOffer 1537 0.50 0.81 0.33 170 XM_PDF 1536 3.16 0.81 4.40 171 XMSlimDrugH 1534 0.52 0.81 0.36 172 TR_Mismatch_TLD_02 1521 0.32 0.80 0.07 173 XMReplyNow 1518 0.42 0.80 0.22 174 RELAYCOUNTRY_FR 1513 0.42 0.80 0.22 175 HTML_FONT_SIZE_LARGE 1495 0.32 0.79 0.07 176 NORDNS_LOW_CONTRAST 1494 0.32 0.79 0.07 177 T_STY_INVIS_DIRECT 1491 0.48 0.79 0.31 178 HTML_FONT_FACE_BAD 1487 0.55 0.78 0.42 179 XMMoneyMeta_00 1466 0.66 0.77 0.60 180 TR_XM_Base64_M1 1452 0.72 0.77 0.69 181 TM2_M_A_HREF_HREF 1452 0.49 0.77 0.35 182 RCVD_IN_PSBL 1452 0.45 0.77 0.29 183 RDNS_DYNAMIC 1442 0.48 0.76 0.33 184 RCVD_IN_IADB_VOUCHED 1442 2.09 0.76 2.79 185 XM_UB99 1427 0.26 0.75 0.00 186 T_TooManySym_02 1419 2.25 0.75 3.05 187 PDS_RDNS_DYNAMIC_FP 1409 0.38 0.74 0.19 188 XM_S_SpammyWords 1379 0.39 0.73 0.21 189 TR_XM_Spammywords 1379 0.39 0.73 0.21 190 T_Symld_Words_02 1374 0.60 0.72 0.54 191 BAYES_00 1357 5.84 0.72 8.55 192 HTML_IMAGE_ONLY_08 1344 0.34 0.71 0.14 193 XM_Dr_From 1337 0.34 0.70 0.14 194 TR_XM_RelayPhish 1337 0.27 0.70 0.05 195 XM_Combo_Sbj 1323 0.40 0.70 0.24 196 PLING_QUERY 1323 0.54 0.70 0.45 197 XMPhish08 1309 0.39 0.69 0.23 198 FROM_SUSPICIOUS_NTLD 1309 0.26 0.69 0.03 199 DKIM_ADSP_NXDOMAIN 1304 0.42 0.69 0.27 200 XM_B_COVIDMETA 1304 0.37 0.69 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 310572 89.94 96.38 86.54 2 RELAYCOUNTRY_US 293399 82.88 85.02 81.75 3 DKIM_SIGNED 271787 81.08 91.21 75.73 4 XM_DK_Pass 266929 78.95 87.62 74.38 5 DKIM_VALID 263237 77.97 86.72 73.35 6 XM_B_Unicode 252601 75.88 86.27 70.38 7 DCC_CHECK_NEGATIVE 223544 49.24 24.55 62.29 8 BAYES_50 217341 52.67 37.74 60.56 9 DKIM_VALID_AU 209280 62.83 71.38 58.31 10 XMListUnsubscribeExists 182534 59.33 75.37 50.86 11 XM_B_SpammyWords 161771 54.57 72.54 45.07 12 XM_B_Unicode3 144596 41.70 44.36 40.29 13 DCC_CHECK 135161 50.72 75.44 37.66 14 RCVD_IN_MSPIKE_H2 114420 34.70 40.03 31.88 15 T_TM2_M_HEADER_IN_MSG 108112 27.80 23.40 30.12 16 DKIM_VALID_EF 105704 28.78 27.51 29.45 17 HTML_FONT_LOW_CONTRAST 100248 32.87 42.22 27.93 18 FVGT_m_MULTI_ODD 92882 29.72 36.99 25.88 19 LOC_TINY_FONT_1 91488 31.44 42.71 25.49 20 XMSubLong 78731 22.06 22.29 21.94 21 T_KAM_HTML_FONT_INVALID 78098 24.63 30.06 21.76 22 MIME_HTML_ONLY 67856 21.06 25.14 18.91 23 XM_B_SpammyWords2 65151 26.68 42.82 18.15 24 ALL_TRUSTED 52640 10.35 2.18 14.67 25 XM_Multi_Part_URI 51273 16.02 19.31 14.29 26 USER_IN_DEF_DKIM_WL 50123 10.35 3.52 13.97 27 TR_XM_DK_Unsub 49072 16.18 20.93 13.67 28 UNPARSEABLE_RELAY 40354 12.50 14.87 11.24 29 XM_B_PhoneNumber 36766 8.79 6.03 10.24 30 BAYES_60 33455 8.54 7.05 9.32 31 LotsOfNums_01 31387 8.27 7.37 8.75 32 BAYES_00 30675 5.84 0.72 8.55 33 TooManyTo_001 30017 6.88 4.08 8.36 34 XM_Evil_Numbers_Gen 29613 8.58 9.19 8.25 35 XM_DKIMWhitelistDomains 29217 5.37 0.14 8.14 36 XM_B_Unsub 27800 9.98 14.21 7.75 37 IN_ZIMBRA_NJ_WHITELIST 25126 4.61 0.08 7.00 38 LOTS_OF_MONEY 24902 10.55 17.39 6.94 39 TR_MAX_INTL_RELAY 24573 8.85 12.63 6.85 40 TR_XM_BayesUnsub 23106 8.90 13.57 6.44 41 XM_H_GMP 22176 5.27 3.55 6.18 42 RCVD_IN_MSPIKE_WL 21004 4.76 2.68 5.85 43 RCVD_IN_MSPIKE_H3 21004 4.76 2.68 5.85 44 XM_DK_Undo_02 20892 19.99 46.79 5.82 45 T_TooManySym_01 20609 4.72 2.77 5.74 46 TR_XM_DK_Bayes 20566 3.91 0.46 5.73 47 TR_XM_DK_Bayes1 20257 3.85 0.45 5.64 48 FSL_BULK_SIG 19770 6.25 7.64 5.51 49 MIME_QP_LONG_LINE 19606 4.77 3.45 5.46 50 XM_H_Long_From01 18415 5.27 5.53 5.13 51 TR_XM_DK_Bayes2 17527 3.32 0.37 4.88 52 BAYES_40 16982 3.57 1.38 4.73 53 XM_B_SpammyWords3 16730 7.90 14.02 4.66 54 TR_XM_SpammyWords4 16556 8.52 15.93 4.61 55 BAYES_99 16524 16.54 39.12 4.60 56 HTML_IMAGE_RATIO_02 16379 5.11 6.13 4.56 57 XM_PDF 15794 3.16 0.81 4.40 58 XMStrtUSub 15374 4.09 3.72 4.28 59 RELAYCOUNTRY_META 14830 7.50 13.89 4.13 60 BAYES_80 14800 5.37 7.74 4.12 61 RCVD_IN_IADB_LISTED 14720 3.14 1.32 4.10 62 XM_UncommonTLD01 14625 4.41 5.06 4.08 63 XMSubMetaSx_00 14496 4.57 5.57 4.04 64 RCVD_IN_VALIDITY_SAFE 14238 3.91 3.80 3.97 65 XM_B_SpammyTLD 14220 3.70 3.19 3.96 66 HTML_IMAGE_RATIO_06 14204 4.19 4.62 3.96 67 HTML_IMAGE_RATIO_04 14033 4.49 5.58 3.91 68 MPART_ALT_DIFF 13860 4.58 5.95 3.86 69 BOTNET_IPINHOSTNAME 13463 6.78 12.52 3.75 70 T_REMOTE_IMAGE 12969 3.18 2.36 3.61 71 ANY_BOUNCE_MESSAGE 12910 2.59 0.67 3.60 72 BOUNCE_MESSAGE 12909 2.59 0.67 3.60 73 RCVD_IN_IADB_SPF 12884 2.74 1.12 3.59 74 BAYES_999 12571 13.43 32.22 3.50 75 XM_B_Phish_Phrases 12196 3.77 4.46 3.40 76 BAYES_20 11778 2.50 1.01 3.28 77 RCVD_IN_VALIDITY_CERTIFIED 11643 3.17 3.02 3.24 78 RCVD_IN_IADB_SENDERID 11473 2.45 1.03 3.20 79 RCVD_IN_IADB_DK 11097 2.38 1.04 3.09 80 XM_SPF_SoftFail 11070 3.64 4.70 3.08 81 T_TooManySym_02 10935 2.25 0.75 3.05 82 URI_NOVOWEL 10429 2.48 1.68 2.91 83 RCVD_IN_IADB_VOUCHED 10023 2.09 0.76 2.79 84 TooManyTo_002 9798 2.00 0.61 2.73 85 MAILING_LIST_MULTI 9769 2.40 1.78 2.72 86 BAYES_95 9759 3.36 4.57 2.72 87 XMNumbers 9540 2.97 3.57 2.66 88 XM_Body_Dirty_Words 9203 3.88 6.36 2.56 89 TR_XM_DKIM_Undo 9158 13.82 35.14 2.55 90 HTML_IMAGE_RATIO_08 8846 2.76 3.30 2.46 91 DKIM_INVALID 8550 3.11 4.49 2.38 92 HTML_MIME_NO_HTML_TAG 8325 2.12 1.74 2.32 93 XM_CamelCaseFrm001 8324 2.50 2.86 2.32 94 TR_XM_SpammyRelay 8075 4.82 9.68 2.25 95 MIME_HTML_MOSTLY 8040 2.90 4.14 2.24 96 MIME_HTML_ONLY_MULTI 7893 2.60 3.37 2.20 97 FROM_EXCESS_BASE64 7279 1.91 1.70 2.03 98 INVALID_MSGID 7246 1.36 0.11 2.02 99 TO_MALFORMED 7139 1.31 0.01 1.99 100 BAYES_05 6969 1.47 0.58 1.94 101 RCVD_IN_IADB_OPTIN 6809 1.40 0.45 1.90 102 XMDiploma_00 6710 2.31 3.15 1.87 103 TM2_M_VERY_LONG_WORD 6662 2.48 3.65 1.86 104 TR_DCC_Bayes_99 6642 11.12 28.67 1.85 105 UNTRUSTED_Relay 6609 3.57 6.85 1.84 106 XM_DK_Undo_01 6462 1.76 1.69 1.80 107 HELO_NODOT 6302 1.29 0.40 1.76 108 HELO_NO_DOMAIN 6292 1.28 0.38 1.75 109 TR_XM_UnparsRelay 6290 3.81 7.71 1.75 110 XM_B_Investor 6281 2.77 4.71 1.75 111 T_XMDrugObfuBody_14 5947 2.26 3.41 1.66 112 XMSexyCombo_05 5720 2.35 3.80 1.59 113 T_XMDrugObfuBody_08 5660 2.00 2.79 1.58 114 TR_Symld_Words 5631 1.35 0.95 1.57 115 KHOP_HELO_FCRDNS 5494 1.33 0.96 1.53 116 XM_B_SEO 5443 2.63 4.74 1.52 117 TooManyTo_003 5367 1.15 0.51 1.50 118 XM_SendGrid 5356 1.41 1.25 1.49 119 SUBJ_ALL_CAPS 5301 1.88 2.63 1.48 120 XM_B_Unsub2 5229 1.74 2.26 1.46 121 TR_XM_PhishingBody 5138 2.34 4.06 1.43 122 IN_HORDE_ADDRESS_BOOK 5062 0.95 0.07 1.41 123 TVD_RCVD_IP 5047 1.15 0.65 1.41 124 TM2_M_URI_OPT_OUT 4951 2.00 3.19 1.38 125 XMGappySubj_01 4719 0.91 0.13 1.31 126 TR_XM_SpammyWords5 4595 2.35 4.36 1.28 127 RELAYCOUNTRY_CA 4360 2.27 4.26 1.21 128 URI_HEX 4233 1.22 1.29 1.18 129 XMCapTrack 4042 0.92 0.53 1.13 130 BOTNET 4042 3.77 8.78 1.13 131 XM_TLDProd2 4000 0.87 0.40 1.11 132 XM_OfRef6 3993 2.24 4.38 1.11 133 XMStockSpam_06 3962 1.20 1.39 1.10 134 TVD_SPACE_RATIO 3906 0.77 0.15 1.09 135 XM_GoogleGroups 3894 0.91 0.58 1.08 136 TooManyTo_004 3827 0.86 0.46 1.07 137 XMBSHREFv2 3690 0.77 0.28 1.03 138 T_TooManySym_03 3458 0.71 0.23 0.96 139 XM_UB50 3421 2.01 4.00 0.95 140 XMBrknScrpt_02 3390 1.43 2.34 0.94 141 TR_XM_DK_SendGrid 3384 0.83 0.62 0.94 142 TR_XM_SEO4 3342 2.09 4.29 0.93 143 XM_H_Trusted_IP 3334 0.61 0.00 0.93 144 DKIM_ADSP_CUSTOM_MED 3333 0.89 0.82 0.93 145 XM_H_Long_From02 3329 1.08 1.36 0.93 146 XMGenDplmaNmb 3318 1.21 1.76 0.92 147 FROM_GOV_DKIM_AU 3301 0.75 0.43 0.92 148 SpammyFromTLD_01 3246 1.17 1.69 0.90 149 TooManyTo_005 3167 0.72 0.42 0.88 150 HTTPS_HTTP_MISMATCH 3050 0.93 1.09 0.85 151 XM_B_SpammyWords4 2980 1.23 1.99 0.83 152 XMBdyGiftCard01 2966 0.89 1.01 0.83 153 T_FILL_THIS_FORM_SHORT 2901 0.90 1.08 0.81 154 RELAYCOUNTRY_AU 2891 1.26 2.12 0.81 155 URI_TRY_3LD 2856 1.34 2.37 0.80 156 TR_MetaPhish_Combo_01 2845 0.88 1.05 0.79 157 T_XMHurry_00 2723 1.30 2.33 0.76 158 XMSubMetaSxObfu_03 2650 0.69 0.60 0.74 159 XMGappySubj_02 2636 0.50 0.05 0.73 160 TR_LOTS_OF_MONEY3 2590 2.42 5.64 0.72 161 RCVD_IN_BL_SPAMCOP_NET 2583 3.42 8.53 0.72 162 TR_XM_SpammyWords2 2568 6.17 16.49 0.72 163 TR_XM_Base64_M1 2482 0.72 0.77 0.69 164 XM_ShortIntro_01 2471 0.61 0.47 0.69 165 T_OBFU_PDF_ATTACH 2443 0.51 0.20 0.68 166 XMBody_95 2346 0.51 0.24 0.65 167 T_XMDrugObfuBody_00 2328 0.95 1.51 0.65 168 XMNoVowels 2307 0.61 0.55 0.64 169 XMSubNoVowel 2259 0.51 0.29 0.63 170 XMBody_17 2229 2.30 5.48 0.62 171 XM_H_PHPMailer 2172 0.62 0.65 0.61 172 XMMoneyMeta_00 2151 0.66 0.77 0.60 173 FORGED_GMAIL_RCVD 2124 0.61 0.64 0.59 174 XM_B_DNDMA 2124 0.62 0.66 0.59 175 HTML_TAG_BALANCE_BODY 2047 1.03 1.89 0.57 176 XM_ProductURIs 2042 0.82 1.30 0.57 177 NML_ADSP_CUSTOM_MED 1984 0.60 0.68 0.55 178 SHORT_HELO_AND_INLINE_IMAGE 1956 0.38 0.07 0.55 179 USER_IN_WHITELIST 1945 0.35 0.00 0.54 180 USER_IN_WELCOMELIST 1945 0.35 0.00 0.54 181 T_Symld_Words_02 1942 0.60 0.72 0.54 182 XM_B_FormFill 1901 0.37 0.08 0.53 183 XMPhish14 1874 0.72 1.09 0.52 184 XM_B_COPY_HTML 1864 0.66 0.92 0.52 185 MPART_ALT_DIFF_COUNT 1856 0.69 1.01 0.52 186 DIET_1 1808 0.63 0.87 0.50 187 NO_DNS_FOR_FROM 1778 0.54 0.61 0.50 188 HTML_IMAGE_ONLY_32 1717 0.37 0.16 0.48 189 XMSubMetaSxObfu_02 1678 0.44 0.39 0.47 190 PLING_QUERY 1617 0.54 0.70 0.45 191 TO_NO_BRKTS_HTML_ONLY 1597 0.35 0.18 0.44 192 THIS_AD 1585 0.66 1.06 0.44 193 HTML_IMAGE_ONLY_28 1580 0.42 0.37 0.44 194 HTML_IMAGE_ONLY_20 1553 0.40 0.35 0.43 195 RELAYCOUNTRY_GB 1553 0.60 0.91 0.43 196 XMSubMetaI_00 1548 0.68 1.14 0.43 197 TM2_M_BODY_EMPTY 1534 0.67 1.14 0.43 198 HTML_FONT_FACE_BAD 1522 0.55 0.78 0.42 199 SpammyFromTLD_02 1498 0.83 1.61 0.42 200 LongTLD 1419 0.60 0.97 0.40 ----------------------------------------------------------------------