Email: 496856 Autolearn: 0 AvgScore: 4.78 AvgScanTime: 1.16 sec Spam: 177285 Autolearn: 0 AvgScore: 13.13 AvgScanTime: 1.29 sec Ham: 319571 Autolearn: 0 AvgScore: 0.16 AvgScanTime: 1.09 sec Time Spent Running SA: 160.65 hours Time Spent Processing Spam: 63.49 hours Time Spent Processing Ham: 97.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 171587 89.80 96.79 85.92 2 DKIM_SIGNED 165197 82.11 93.18 75.97 3 XM_DK_Pass 160594 80.31 90.59 74.61 4 DKIM_VALID 158259 79.19 89.27 73.60 5 XM_B_Unicode 157486 77.06 88.83 70.53 6 RELAYCOUNTRY_US 155462 83.45 87.69 81.10 7 DCC_CHECK 137511 52.87 77.56 39.17 8 XMListUnsubscribeExists 134923 60.65 76.11 52.07 9 DKIM_VALID_AU 130162 64.33 73.42 59.29 10 XM_B_SpammyWords 130123 55.42 73.40 45.45 11 XM_DK_Undo_02 85241 21.31 48.08 6.46 12 XM_B_Unicode3 82824 43.02 46.72 40.97 13 LOC_TINY_FONT_1 77517 32.28 43.72 25.94 14 XM_B_SpammyWords2 75686 27.79 42.69 19.52 15 RCVD_IN_MSPIKE_H2 75671 35.51 42.68 31.53 16 HTML_FONT_LOW_CONTRAST 73563 34.37 41.49 30.41 17 BAYES_99 69130 17.06 38.99 4.90 18 FVGT_m_MULTI_ODD 68483 30.24 38.63 25.58 19 BAYES_50 64934 52.20 36.63 60.85 20 TR_XM_DKIM_Undo 64304 14.75 36.27 2.81 21 BAYES_999 57591 14.08 32.48 3.86 22 T_KAM_HTML_FONT_INVALID 53842 24.24 30.37 20.84 23 DKIM_VALID_EF 52691 28.99 29.72 28.59 24 TR_DCC_Bayes_99 52363 11.86 29.54 2.05 25 T_TM2_M_HEADER_IN_MSG 42453 27.77 23.95 29.89 26 TR_XM_DK_Unsub 40111 16.99 22.63 13.86 27 DCC_CHECK_NEGATIVE 39754 47.10 22.42 60.79 28 MIME_HTML_ONLY 39508 20.36 22.29 19.29 29 XMSubLong 35877 21.18 20.24 21.70 30 XM_Multi_Part_URI 35601 17.06 20.08 15.38 31 LOTS_OF_MONEY 35028 11.60 19.76 7.07 32 TR_XM_SpammyWords4 31954 9.42 18.02 4.65 33 TR_XM_SpammyWords2 28727 6.24 16.20 0.72 34 UNPARSEABLE_RELAY 26660 12.41 15.04 10.95 35 XM_B_Unsub 25147 10.38 14.18 8.28 36 TR_XM_BayesUnsub 24395 9.06 13.76 6.45 37 XM_B_SpammyWords3 23528 8.30 13.27 5.55 38 TR_MAX_INTL_RELAY 23417 8.95 13.21 6.58 39 RELAYCOUNTRY_META 22548 7.43 12.72 4.49 40 BOTNET_IPINHOSTNAME 20971 6.76 11.83 3.95 41 RCVD_IN_BL_SPAMCOP_NET 17027 3.93 9.60 0.79 42 TR_XM_SpammyRelay 16306 4.83 9.20 2.41 43 XM_Evil_Numbers_Gen 15973 8.62 9.01 8.41 44 XMBody_17 15010 3.55 8.47 0.82 45 LotsOfNums_01 14671 8.99 8.28 9.38 46 BAYES_80 14458 5.49 8.16 4.02 47 FSL_BULK_SIG 14432 6.40 8.14 5.43 48 TR_XM_SPAMCOP 14263 3.15 8.05 0.43 49 BAYES_60 13609 8.75 7.68 9.34 50 TR_XM_UnparsRelay 12967 3.66 7.31 1.63 51 TR_LOTS_OF_MONEY3 12525 3.09 7.06 0.88 52 BOTNET 11770 3.34 6.64 1.51 53 XM_Body_Dirty_Words 11665 4.14 6.58 2.78 54 HTML_IMAGE_RATIO_02 11571 5.62 6.53 5.12 55 XM_B_Investor 10270 3.14 5.79 1.67 56 MPART_ALT_DIFF 9757 4.48 5.50 3.91 57 HTML_IMAGE_RATIO_04 9648 4.58 5.44 4.10 58 XMSubMetaSx_00 9508 4.52 5.36 4.05 59 XM_SPF_SoftFail 9257 3.76 5.22 2.95 60 XM_B_PhoneNumber 9187 7.91 5.18 9.42 61 UNTRUSTED_Relay 8952 2.81 5.05 1.57 62 XM_H_Long_From01 8581 5.18 4.84 5.36 63 BAYES_95 8494 3.36 4.79 2.56 64 TooManyTo_001 8088 6.54 4.56 7.64 65 XM_UncommonTLD01 7811 4.00 4.41 3.77 66 TR_XM_SpammyWords5 7796 2.33 4.40 1.18 67 XM_B_SEO 7730 2.42 4.36 1.34 68 XM_H_GMP 7349 5.04 4.15 5.53 69 RELAYCOUNTRY_CA 7348 2.26 4.14 1.22 70 XMStrtUSub 7310 4.74 4.12 5.08 71 TR_XM_PhishingBody 7182 2.54 4.05 1.71 72 XM_B_Phish_Phrases 7168 3.92 4.04 3.86 73 RCVD_IN_VALIDITY_RPBL 7140 1.56 4.03 0.18 74 T_XMDrugObfuBody_14 7064 2.59 3.98 1.81 75 RCVD_IN_VALIDITY_SAFE 6963 4.49 3.93 4.80 76 DKIM_INVALID 6938 2.92 3.91 2.37 77 TR_XM_SEO4 6937 1.89 3.91 0.76 78 XM_OfRef6 6787 2.10 3.83 1.14 79 TM2_M_VERY_LONG_WORD 6672 2.99 3.76 2.56 80 T_XMDrugObfuBody_08 6670 2.32 3.76 1.52 81 XMNumbers 6659 2.85 3.76 2.35 82 MIME_HTML_MOSTLY 6629 2.84 3.74 2.34 83 XMSexyCombo_05 6570 2.44 3.71 1.74 84 HTML_IMAGE_RATIO_06 6159 3.11 3.47 2.91 85 MIME_HTML_ONLY_MULTI 5799 2.59 3.27 2.21 86 USER_IN_DEF_DKIM_WL 5658 10.16 3.19 14.03 87 XM_B_SpammyTLD 5544 4.13 3.13 4.69 88 HTML_IMAGE_RATIO_08 5365 2.39 3.03 2.03 89 MIME_QP_LONG_LINE 5312 4.37 3.00 5.13 90 RCVD_IN_VALIDITY_CERTIFIED 5264 3.58 2.97 3.92 91 T_XMHurry_00 5103 1.50 2.88 0.74 92 XMDiploma_00 5027 2.08 2.84 1.66 93 RCVD_IN_MSPIKE_WL 4995 4.61 2.82 5.60 94 RCVD_IN_MSPIKE_H3 4995 4.61 2.82 5.60 95 XM_CamelCaseFrm001 4969 2.50 2.80 2.33 96 XM_UB50 4914 1.59 2.77 0.94 97 XMBrknScrpt_02 4910 1.83 2.77 1.31 98 SUBJ_ALL_CAPS 4884 1.97 2.75 1.54 99 URI_TRY_3LD 4869 1.58 2.75 0.93 100 XM_URI_RBL 4844 1.15 2.73 0.27 101 TM2_M_URI_OPT_OUT 4258 1.88 2.40 1.59 102 XM_B_SpammyWords4 4001 1.23 2.26 0.65 103 T_REMOTE_IMAGE 3880 3.18 2.19 3.73 104 FROM_EXCESS_BASE64 3829 1.91 2.16 1.77 105 TR_MetaPhish_Combo_01 3634 1.28 2.05 0.85 106 RELAYCOUNTRY_AU 3566 1.41 2.01 1.08 107 XMStockSpam_06 3463 1.57 1.95 1.36 108 HTML_TAG_BALANCE_BODY 3404 1.03 1.92 0.53 109 T_TooManySym_01 3391 4.00 1.91 5.16 110 AC_BR_BONANZA 3199 0.73 1.80 0.14 111 MAILING_LIST_MULTI 3144 2.43 1.77 2.80 112 XM_DK_Undo_01 2902 1.78 1.64 1.86 113 XMReplyNow 2884 0.74 1.63 0.24 114 URI_HEX 2866 1.14 1.62 0.87 115 XM_B_Unsub2 2854 1.85 1.61 1.99 116 XMGenDplmaNmb 2851 1.08 1.61 0.78 117 T_XMDrugObfuBody_00 2723 1.39 1.54 1.31 118 BAYES_40 2605 3.86 1.47 5.18 119 XM_ProductURIs 2599 0.83 1.47 0.48 120 TR_XM_NoHeaderRelay 2488 0.59 1.40 0.13 121 HOSTED_IMG_MULTI_PUB_01 2483 0.51 1.40 0.02 122 XMSubMetaI_00 2448 1.05 1.38 0.86 123 SpammyFromTLD_02 2428 0.81 1.37 0.50 124 URI_NOVOWEL 2413 2.82 1.36 3.64 125 TR_Symld_Words 2381 1.43 1.34 1.47 126 HTML_MIME_NO_HTML_TAG 2354 1.96 1.33 2.32 127 KHOP_HELO_FCRDNS 2295 1.64 1.29 1.83 128 SpammyFromTLD_01 2279 0.88 1.29 0.66 129 T_FILL_THIS_FORM_SHORT 2278 1.01 1.28 0.86 130 LONGLN_LOW_CONTRAST 2236 0.63 1.26 0.28 131 TR_Caps_n_Bayes_99 2233 0.46 1.26 0.02 132 XM_B_COPY_HTML 2229 0.84 1.26 0.61 133 TR_XM_Base64_M1 2160 0.81 1.22 0.58 134 XM_B_Phish66 2140 0.60 1.21 0.27 135 RELAYCOUNTRY_GB 2126 0.75 1.20 0.50 136 BAYES_20 2111 2.43 1.19 3.11 137 THIS_AD 2105 0.73 1.19 0.47 138 XMSexyCombo_01 2096 0.55 1.18 0.20 139 RCVD_IN_IADB_LISTED 2091 2.98 1.18 3.98 140 TR_XM_PHPForged 2073 0.61 1.17 0.30 141 TR_XM_PHPDW 2073 0.61 1.17 0.30 142 URIBL_DBL_SPAM 2022 0.42 1.14 0.02 143 TR_XM_FormFill2 2021 0.60 1.14 0.31 144 HTTPS_HTTP_MISMATCH 2009 0.89 1.13 0.75 145 XM_H_PHPOS 2008 0.59 1.13 0.29 146 XM_SendGrid 1990 1.24 1.12 1.31 147 XMPhish30 1977 0.81 1.12 0.65 148 TR_XM_InvalidRelay 1940 0.40 1.09 0.02 149 XMHTML_After_End 1929 0.57 1.09 0.28 150 XM_HighProb1 1926 0.40 1.09 0.02 151 MIME_CHARSET_FARAWAY 1922 0.62 1.08 0.36 152 ALL_TRUSTED 1920 10.34 1.08 15.47 153 T_STY_INVIS_DIRECT 1839 0.62 1.04 0.39 154 MILLION_HUNDRED 1807 0.37 1.02 0.00 155 XMPhish14 1793 0.69 1.01 0.51 156 TR_XM_INV_DKIM 1787 0.39 1.01 0.05 157 RCVD_IN_IADB_SPF 1782 2.60 1.01 3.49 158 MONEY_FRAUD_5 1766 0.36 1.00 0.00 159 TR_LOTS_OF_MONEY2 1742 0.49 0.98 0.21 160 T_MONEY_PERCENT 1742 0.49 0.98 0.21 161 MONEY_FROM_MISSP 1739 0.36 0.98 0.01 162 ADVANCE_FEE_3_NEW_MONEY 1737 0.35 0.98 0.00 163 PLING_QUERY 1699 0.58 0.96 0.38 164 XM_DIRTYINTL 1697 0.39 0.96 0.08 165 RCVD_IN_IADB_DK 1676 2.28 0.95 3.03 166 RCVD_IN_IADB_SENDERID 1674 2.34 0.94 3.11 167 XM_H_Long_From02 1667 0.93 0.94 0.93 168 MONEY_ATM_CARD 1644 0.33 0.93 0.00 169 ANY_BOUNCE_MESSAGE 1603 3.03 0.90 4.22 170 BOUNCE_MESSAGE 1601 3.03 0.90 4.21 171 TM2_M_OBFU_COMMENT 1593 0.54 0.90 0.34 172 SHOPIFY_IMG_NOT_RCVD_SFY 1567 0.56 0.88 0.38 173 XM_B_DNDMA 1552 0.75 0.88 0.68 174 DKIM_ADSP_CUSTOM_MED 1538 0.83 0.87 0.82 175 RDNS_DYNAMIC 1401 0.50 0.79 0.35 176 TooManyTo_002 1386 1.76 0.78 2.30 177 PDS_RDNS_DYNAMIC_FP 1375 0.39 0.78 0.18 178 XM_UB99 1365 0.28 0.77 0.00 179 HTML_FONT_FACE_BAD 1363 0.63 0.77 0.56 180 LongTLD 1311 0.50 0.74 0.36 181 XM_B_COVIDMETA 1300 0.41 0.73 0.23 182 XMBdyGiftCard01 1297 0.72 0.73 0.71 183 RELAYCOUNTRY_FR 1276 0.42 0.72 0.26 184 XMHTMLBadTable_001 1264 0.43 0.71 0.27 185 TooManyTo_003 1241 1.17 0.70 1.44 186 NML_ADSP_CUSTOM_MED 1235 0.57 0.70 0.50 187 XM_OfRef7 1228 0.39 0.69 0.22 188 XM_B_REG_HTML 1215 0.40 0.69 0.25 189 TR_XM_FormFill 1212 0.25 0.68 0.01 190 XMMoneyMeta_00 1207 0.54 0.68 0.46 191 TVD_RCVD_IP 1191 0.78 0.67 0.84 192 TR_XM_DK_SendGrid 1174 0.76 0.66 0.81 193 RELAYCOUNTRY_IN 1165 0.27 0.66 0.05 194 XMPhish08 1157 0.38 0.65 0.23 195 TooManyTo_004 1146 0.92 0.65 1.07 196 T_TooManySym_02 1107 1.96 0.62 2.71 197 TM2_M_A_HREF_HREF 1107 0.34 0.62 0.19 198 HTML_OBFUSCATE_05_10 1085 0.30 0.61 0.13 199 XM_GoogleGroups 1084 1.00 0.61 1.21 200 XM_H_Undi_Recip 1077 0.32 0.61 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 274590 89.80 96.79 85.92 2 RELAYCOUNTRY_US 259175 83.45 87.69 81.10 3 DKIM_SIGNED 242767 82.11 93.18 75.97 4 XM_DK_Pass 238441 80.31 90.59 74.61 5 DKIM_VALID 235192 79.19 89.27 73.60 6 XM_B_Unicode 225393 77.06 88.83 70.53 7 BAYES_50 194449 52.20 36.63 60.85 8 DCC_CHECK_NEGATIVE 194276 47.10 22.42 60.79 9 DKIM_VALID_AU 189483 64.33 73.42 59.29 10 XMListUnsubscribeExists 166405 60.65 76.11 52.07 11 XM_B_SpammyWords 145259 55.42 73.40 45.45 12 XM_B_Unicode3 130938 43.02 46.72 40.97 13 DCC_CHECK 125162 52.87 77.56 39.17 14 RCVD_IN_MSPIKE_H2 100747 35.51 42.68 31.53 15 HTML_FONT_LOW_CONTRAST 97196 34.37 41.49 30.41 16 T_TM2_M_HEADER_IN_MSG 95507 27.77 23.95 29.89 17 DKIM_VALID_EF 91353 28.99 29.72 28.59 18 LOC_TINY_FONT_1 82882 32.28 43.72 25.94 19 FVGT_m_MULTI_ODD 81759 30.24 38.63 25.58 20 XMSubLong 69341 21.18 20.24 21.70 21 T_KAM_HTML_FONT_INVALID 66599 24.24 30.37 20.84 22 XM_B_SpammyWords2 62380 27.79 42.69 19.52 23 MIME_HTML_ONLY 61647 20.36 22.29 19.29 24 ALL_TRUSTED 49432 10.34 1.08 15.47 25 XM_Multi_Part_URI 49163 17.06 20.08 15.38 26 USER_IN_DEF_DKIM_WL 44827 10.16 3.19 14.03 27 TR_XM_DK_Unsub 44298 16.99 22.63 13.86 28 UNPARSEABLE_RELAY 34981 12.41 15.04 10.95 29 XM_B_PhoneNumber 30111 7.91 5.18 9.42 30 LotsOfNums_01 29977 8.99 8.28 9.38 31 BAYES_60 29845 8.75 7.68 9.34 32 XM_Evil_Numbers_Gen 26873 8.62 9.01 8.41 33 XM_B_Unsub 26450 10.38 14.18 8.28 34 BAYES_00 26336 5.50 0.57 8.24 35 TooManyTo_001 24430 6.54 4.56 7.64 36 XM_DKIMWhitelistDomains 23583 4.77 0.06 7.38 37 IN_ZIMBRA_NJ_WHITELIST 23232 4.71 0.09 7.27 38 LOTS_OF_MONEY 22592 11.60 19.76 7.07 39 TR_MAX_INTL_RELAY 21038 8.95 13.21 6.58 40 XM_DK_Undo_02 20660 21.31 48.08 6.46 41 TR_XM_BayesUnsub 20611 9.06 13.76 6.45 42 TR_XM_DK_Bayes 19237 4.03 0.45 6.02 43 TR_XM_DK_Bayes1 18800 3.94 0.44 5.88 44 RCVD_IN_MSPIKE_H3 17888 4.61 2.82 5.60 45 RCVD_IN_MSPIKE_WL 17888 4.61 2.82 5.60 46 XM_B_SpammyWords3 17732 8.30 13.27 5.55 47 XM_H_GMP 17676 5.04 4.15 5.53 48 FSL_BULK_SIG 17359 6.40 8.14 5.43 49 XM_H_Long_From01 17143 5.18 4.84 5.36 50 BAYES_40 16558 3.86 1.47 5.18 51 T_TooManySym_01 16500 4.00 1.91 5.16 52 MIME_QP_LONG_LINE 16385 4.37 3.00 5.13 53 HTML_IMAGE_RATIO_02 16353 5.62 6.53 5.12 54 XMStrtUSub 16226 4.74 4.12 5.08 55 TR_XM_DK_Bayes2 15718 3.26 0.28 4.92 56 BAYES_99 15651 17.06 38.99 4.90 57 RCVD_IN_VALIDITY_SAFE 15355 4.49 3.93 4.80 58 XM_B_SpammyTLD 14994 4.13 3.13 4.69 59 TR_XM_SpammyWords4 14859 9.42 18.02 4.65 60 RELAYCOUNTRY_META 14346 7.43 12.72 4.49 61 XM_PDF 13761 2.97 0.55 4.31 62 ANY_BOUNCE_MESSAGE 13470 3.03 0.90 4.22 63 BOUNCE_MESSAGE 13467 3.03 0.90 4.21 64 HTML_IMAGE_RATIO_04 13106 4.58 5.44 4.10 65 XMSubMetaSx_00 12939 4.52 5.36 4.05 66 BAYES_80 12843 5.49 8.16 4.02 67 RCVD_IN_IADB_LISTED 12718 2.98 1.18 3.98 68 BOTNET_IPINHOSTNAME 12610 6.76 11.83 3.95 69 RCVD_IN_VALIDITY_CERTIFIED 12524 3.58 2.97 3.92 70 MPART_ALT_DIFF 12492 4.48 5.50 3.91 71 BAYES_999 12350 14.08 32.48 3.86 72 XM_B_Phish_Phrases 12323 3.92 4.04 3.86 73 XM_UncommonTLD01 12052 4.00 4.41 3.77 74 T_REMOTE_IMAGE 11930 3.18 2.19 3.73 75 URI_NOVOWEL 11617 2.82 1.36 3.64 76 RCVD_IN_IADB_SPF 11161 2.60 1.01 3.49 77 BAYES_20 9952 2.43 1.19 3.11 78 RCVD_IN_IADB_SENDERID 9937 2.34 0.94 3.11 79 RCVD_IN_IADB_DK 9668 2.28 0.95 3.03 80 XM_SPF_SoftFail 9425 3.76 5.22 2.95 81 HTML_IMAGE_RATIO_06 9307 3.11 3.47 2.91 82 TR_XM_DKIM_Undo 8995 14.75 36.27 2.81 83 MAILING_LIST_MULTI 8952 2.43 1.77 2.80 84 XM_Body_Dirty_Words 8890 4.14 6.58 2.78 85 T_TooManySym_02 8656 1.96 0.62 2.71 86 RCVD_IN_IADB_VOUCHED 8567 1.94 0.60 2.68 87 BAYES_95 8188 3.36 4.79 2.56 88 TM2_M_VERY_LONG_WORD 8166 2.99 3.76 2.56 89 TR_XM_SpammyRelay 7698 4.83 9.20 2.41 90 DKIM_INVALID 7575 2.92 3.91 2.37 91 XMNumbers 7523 2.85 3.76 2.35 92 MIME_HTML_MOSTLY 7470 2.84 3.74 2.34 93 XM_CamelCaseFrm001 7444 2.50 2.80 2.33 94 HTML_MIME_NO_HTML_TAG 7400 1.96 1.33 2.32 95 TooManyTo_002 7355 1.76 0.78 2.30 96 INVALID_MSGID 7162 1.50 0.16 2.24 97 MIME_HTML_ONLY_MULTI 7073 2.59 3.27 2.21 98 TR_DCC_Bayes_99 6555 11.86 29.54 2.05 99 HTML_IMAGE_RATIO_08 6500 2.39 3.03 2.03 100 XM_B_Unsub2 6361 1.85 1.61 1.99 101 TO_MALFORMED 6349 1.28 0.01 1.99 102 RCVD_IN_IADB_OPTIN 6086 1.34 0.33 1.90 103 XM_DK_Undo_01 5938 1.78 1.64 1.86 104 KHOP_HELO_FCRDNS 5834 1.64 1.29 1.83 105 T_XMDrugObfuBody_14 5797 2.59 3.98 1.81 106 BAYES_05 5749 1.34 0.53 1.80 107 FROM_EXCESS_BASE64 5643 1.91 2.16 1.77 108 XMSexyCombo_05 5557 2.44 3.71 1.74 109 TR_XM_PhishingBody 5456 2.54 4.05 1.71 110 XM_B_Investor 5349 3.14 5.79 1.67 111 XMDiploma_00 5309 2.08 2.84 1.66 112 TR_XM_UnparsRelay 5194 3.66 7.31 1.63 113 TM2_M_URI_OPT_OUT 5077 1.88 2.40 1.59 114 UNTRUSTED_Relay 5029 2.81 5.05 1.57 115 IN_HORDE_ADDRESS_BOOK 5023 1.05 0.10 1.57 116 HELO_NODOT 5006 1.08 0.19 1.57 117 HELO_NO_DOMAIN 5002 1.07 0.19 1.57 118 SUBJ_ALL_CAPS 4906 1.97 2.75 1.54 119 T_XMDrugObfuBody_08 4864 2.32 3.76 1.52 120 BOTNET 4817 3.34 6.64 1.51 121 TR_Symld_Words 4702 1.43 1.34 1.47 122 TooManyTo_003 4588 1.17 0.70 1.44 123 XMStockSpam_06 4331 1.57 1.95 1.36 124 XM_B_SEO 4289 2.42 4.36 1.34 125 XM_SendGrid 4190 1.24 1.12 1.31 126 XMBrknScrpt_02 4184 1.83 2.77 1.31 127 T_XMDrugObfuBody_00 4175 1.39 1.54 1.31 128 XM_TLDProd2 3952 0.90 0.30 1.24 129 RELAYCOUNTRY_CA 3900 2.26 4.14 1.22 130 XM_GoogleGroups 3878 1.00 0.61 1.21 131 XMGappySubj_01 3853 0.81 0.11 1.21 132 TR_XM_SpammyWords5 3765 2.33 4.40 1.18 133 TVD_SPACE_RATIO 3720 0.79 0.11 1.16 134 XM_OfRef6 3640 2.10 3.83 1.14 135 RELAYCOUNTRY_AU 3464 1.41 2.01 1.08 136 TooManyTo_004 3404 0.92 0.65 1.07 137 T_TooManySym_03 3275 0.72 0.17 1.02 138 XMCapTrack 3134 0.79 0.45 0.98 139 XMSubMetaSxObfu_03 3088 0.83 0.57 0.97 140 XM_UB50 2998 1.59 2.77 0.94 141 XM_H_Long_From02 2977 0.93 0.94 0.93 142 URI_TRY_3LD 2967 1.58 2.75 0.93 143 FROM_GOV_DKIM_AU 2845 0.67 0.26 0.89 144 TR_LOTS_OF_MONEY3 2817 3.09 7.06 0.88 145 TooManyTo_005 2804 0.78 0.61 0.88 146 URI_HEX 2793 1.14 1.62 0.87 147 XMSubMetaI_00 2751 1.05 1.38 0.86 148 T_FILL_THIS_FORM_SHORT 2743 1.01 1.28 0.86 149 TR_MetaPhish_Combo_01 2715 1.28 2.05 0.85 150 TVD_RCVD_IP 2699 0.78 0.67 0.84 151 TR_XM_SpoofStaff 2664 0.57 0.08 0.83 152 XM_H_SpoofStaff4 2651 0.56 0.08 0.83 153 XMBody_17 2614 3.55 8.47 0.82 154 DKIM_ADSP_CUSTOM_MED 2606 0.83 0.87 0.82 155 TR_XM_DK_SendGrid 2589 0.76 0.66 0.81 156 HTML_EXTRA_CLOSE 2526 0.51 0.01 0.79 157 RCVD_IN_BL_SPAMCOP_NET 2511 3.93 9.60 0.79 158 XMGenDplmaNmb 2508 1.08 1.61 0.78 159 TR_XM_SEO4 2436 1.89 3.91 0.76 160 HTTPS_HTTP_MISMATCH 2391 0.89 1.13 0.75 161 T_XMHurry_00 2367 1.50 2.88 0.74 162 TR_XM_SpammyWords2 2292 6.24 16.20 0.72 163 XMBdyGiftCard01 2273 0.72 0.73 0.71 164 XMBSHREFv2 2252 0.56 0.30 0.70 165 XM_B_DNDMA 2165 0.75 0.88 0.68 166 T_OBFU_PDF_ATTACH 2106 0.47 0.13 0.66 167 SpammyFromTLD_01 2105 0.88 1.29 0.66 168 XM_B_SpammyWords4 2088 1.23 2.26 0.65 169 XM_H_PHPMailer 2082 0.57 0.42 0.65 170 XMNoVowels 2076 0.53 0.32 0.65 171 XMPhish30 2064 0.81 1.12 0.65 172 XMBody_95 2055 0.49 0.20 0.64 173 XM_RXBody 2040 0.52 0.32 0.64 174 USER_IN_WELCOMELIST 2004 0.40 0.00 0.63 175 USER_IN_WHITELIST 2004 0.40 0.00 0.63 176 XM_B_COPY_HTML 1957 0.84 1.26 0.61 177 XMGappySubj_02 1905 0.40 0.05 0.60 178 XM_ShortIntro_01 1898 0.55 0.48 0.59 179 XMSubMetaSx_01 1885 0.46 0.24 0.59 180 TR_XM_Base64_M1 1854 0.81 1.22 0.58 181 HTML_FONT_FACE_BAD 1791 0.63 0.77 0.56 182 TO_NO_BRKTS_HTML_ONLY 1731 0.40 0.14 0.54 183 HTML_TAG_BALANCE_BODY 1707 1.03 1.92 0.53 184 XMPhish14 1632 0.69 1.01 0.51 185 SpammyFromTLD_02 1602 0.81 1.37 0.50 186 RELAYCOUNTRY_GB 1593 0.75 1.20 0.50 187 NML_ADSP_CUSTOM_MED 1586 0.57 0.70 0.50 188 HTML_IMAGE_ONLY_20 1585 0.47 0.43 0.50 189 HTML_IMAGE_ONLY_32 1581 0.36 0.12 0.49 190 SHORT_HELO_AND_INLINE_IMAGE 1554 0.33 0.04 0.49 191 XM_ProductURIs 1535 0.83 1.47 0.48 192 FORGED_GMAIL_RCVD 1520 0.52 0.60 0.48 193 THIS_AD 1505 0.73 1.19 0.47 194 XMMoneyMeta_00 1463 0.54 0.68 0.46 195 T_TooManySym_04 1391 0.29 0.03 0.44 196 TR_XM_SPAMCOP 1371 3.15 8.05 0.43 197 T_Symld_Words_02 1358 0.46 0.53 0.42 198 HTML_IMAGE_ONLY_28 1325 0.39 0.34 0.41 199 TM2_M_BODY_EMPTY 1288 0.30 0.10 0.40 200 MISSING_HEADERS 1274 0.43 0.47 0.40 ----------------------------------------------------------------------