Email: 535940 Autolearn: 0 AvgScore: 4.04 AvgScanTime: 1.33 sec Spam: 169469 Autolearn: 0 AvgScore: 13.57 AvgScanTime: 1.43 sec Ham: 366471 Autolearn: 0 AvgScore: -0.36 AvgScanTime: 1.28 sec Time Spent Running SA: 197.94 hours Time Spent Processing Spam: 67.18 hours Time Spent Processing Ham: 130.77 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 162129 89.12 95.67 86.09 2 DKIM_SIGNED 152398 77.95 89.93 72.41 3 XM_DK_Pass 147094 76.00 86.80 71.00 4 XM_B_Unicode 145800 73.81 86.03 68.16 5 DKIM_VALID 145369 74.96 85.78 69.96 6 T_SCC_BODY_TEXT_LINE 136594 82.29 80.60 83.08 7 RELAYCOUNTRY_US 131224 78.64 77.43 79.20 8 XM_B_SpammyWords 124766 52.48 73.62 42.70 9 XMListUnsubscribeExists 124215 55.41 73.30 47.13 10 DCC_CHECK 123799 44.97 73.05 31.98 11 DKIM_VALID_AU 107508 57.87 63.44 55.30 12 XM_DK_Undo_02 77795 18.25 45.91 5.46 13 XM_B_Unicode3 76276 40.87 45.01 38.95 14 XM_B_SpammyWords2 72273 25.09 42.65 16.96 15 LOC_TINY_FONT_1 69031 28.29 40.73 22.54 16 BAYES_50 65843 51.86 38.85 57.87 17 TR_XM_DKIM_Undo 62038 13.03 36.61 2.13 18 HTML_FONT_LOW_CONTRAST 61671 29.67 36.39 26.57 19 BAYES_99 60428 14.28 35.66 4.39 20 MIME_HTML_ONLY 57090 23.25 33.69 18.42 21 FVGT_m_MULTI_ODD 55323 27.50 32.64 25.12 22 DKIM_VALID_EF 54640 29.05 32.24 27.57 23 T_KAM_HTML_FONT_INVALID 50277 23.69 29.67 20.92 24 BAYES_999 48200 11.29 28.44 3.36 25 DCC_CHECK_NEGATIVE 45642 55.00 26.93 67.98 26 TR_DCC_Bayes_99 44414 9.41 26.21 1.64 27 TR_XM_DK_Unsub 41873 16.27 24.71 12.36 28 XMSubLong 39251 22.23 23.16 21.80 29 T_TM2_M_HEADER_IN_MSG 38505 27.42 22.72 29.59 30 RCVD_IN_MSPIKE_H2 37586 22.44 22.18 22.57 31 RELAYCOUNTRY_META 36789 9.63 21.71 4.04 32 TR_XM_SpammyRelay 30817 7.31 18.18 2.28 33 XM_Multi_Part_URI 30709 14.21 18.12 12.40 34 LOTS_OF_MONEY 26069 8.93 15.38 5.95 35 XM_B_Unsub 24999 10.09 14.75 7.94 36 BOTNET_IPINHOSTNAME 24783 7.51 14.62 4.23 37 UNPARSEABLE_RELAY 24418 11.47 14.41 10.11 38 TR_XM_BayesUnsub 24081 8.83 14.21 6.34 39 TR_XM_SpammyWords4 23506 6.98 13.87 3.79 40 TR_XM_SpammyWords2 23371 4.68 13.79 0.47 41 XM_B_SpammyWords3 23126 6.91 13.65 3.79 42 RCVD_IN_BL_SPAMCOP_NET 23120 4.76 13.64 0.66 43 RELAYCOUNTRY_CA 22454 5.06 13.25 1.27 44 TR_XM_SPAMCOP 19389 3.79 11.44 0.25 45 RCVD_IN_MSPIKE_WL 18377 7.66 10.84 6.19 46 RCVD_IN_MSPIKE_H3 18377 7.66 10.84 6.19 47 BOTNET 17636 4.08 10.41 1.16 48 XM_Body_Dirty_Words 17615 6.62 10.39 4.87 49 XM_Evil_Numbers_Gen 14931 7.77 8.81 7.30 50 BAYES_80 14621 5.60 8.63 4.20 51 FSL_BULK_SIG 14064 5.43 8.30 4.10 52 TR_XM_UnparsRelay 13166 3.55 7.77 1.60 53 XMBody_17 12808 2.75 7.56 0.53 54 XM_UncommonTLD01 12721 4.88 7.51 3.66 55 LotsOfNums_01 12198 8.01 7.20 8.39 56 BAYES_60 12131 8.59 7.16 9.25 57 HTML_IMAGE_RATIO_02 10539 5.15 6.22 4.66 58 HTML_IMAGE_RATIO_04 10304 4.81 6.08 4.23 59 UNTRUSTED_Relay 9844 2.84 5.81 1.47 60 MPART_ALT_DIFF 9642 4.92 5.69 4.56 61 XMSexyCombo_05 9421 2.74 5.56 1.44 62 XMSubMetaSx_00 9416 4.22 5.56 3.61 63 XMNumbers 9038 3.86 5.33 3.18 64 BAYES_95 8806 3.45 5.20 2.64 65 T_FILL_THIS_FORM_SHORT 8582 2.31 5.06 1.04 66 TR_XM_BayesRelay 8529 1.59 5.03 0.00 67 XMStrtUSub 8377 4.64 4.94 4.51 68 HTML_IMAGE_RATIO_06 8271 3.84 4.88 3.35 69 XM_B_Phish_Phrases 7938 3.63 4.68 3.14 70 XM_H_Long_From01 7936 4.95 4.68 5.07 71 TR_XM_SpammyWords5 7587 2.31 4.48 1.30 72 TooManyTo_001 7517 7.30 4.44 8.63 73 TR_LOTS_OF_MONEY3 7348 1.90 4.34 0.77 74 XM_B_Investor 7299 2.50 4.31 1.67 75 XM_SPF_SoftFail 7126 3.56 4.20 3.25 76 XM_OfRef6 7079 2.24 4.18 1.34 77 DKIM_INVALID 7029 2.99 4.15 2.45 78 HK_RANDOM_REPLYTO 6719 1.32 3.96 0.09 79 SpammyFromTLD_01 6704 1.77 3.96 0.76 80 TR_XM_PhishingBody 6595 2.43 3.89 1.76 81 XM_H_GMP 6098 5.83 3.60 6.86 82 HTML_IMAGE_RATIO_08 5880 2.79 3.47 2.47 83 TR_XM_FormFill 5736 1.08 3.38 0.02 84 T_XMDrugObfuBody_08 5670 2.07 3.35 1.47 85 MIME_HTML_MOSTLY 5608 2.63 3.31 2.31 86 XM_B_SpammyTLD 5492 2.58 3.24 2.27 87 T_XMDrugObfuBody_14 5447 2.18 3.21 1.70 88 MIME_QP_LONG_LINE 5346 4.71 3.15 5.42 89 MIME_HTML_ONLY_MULTI 5257 2.57 3.10 2.33 90 XM_UB50 5072 1.51 2.99 0.82 91 FONT_INVIS_LONG_LINE 5069 0.98 2.99 0.05 92 TM2_M_VERY_LONG_WORD 4874 1.84 2.88 1.36 93 XM_URI_RBL 4654 0.98 2.75 0.16 94 RCVD_IN_VALIDITY_SAFE 4616 3.40 2.72 3.71 95 XMBrknScrpt_02 4612 1.33 2.72 0.68 96 T_TooManySym_01 4586 4.60 2.71 5.47 97 XM_CamelCaseFrm001 4372 2.32 2.58 2.20 98 TM2_M_URI_OPT_OUT 4321 2.02 2.55 1.77 99 FROM_EXCESS_BASE64 4262 2.17 2.51 2.01 100 TR_XM_PHPForged 4249 1.14 2.51 0.51 101 TR_XM_PHPDW 4244 1.13 2.50 0.50 102 XM_B_Unsub2 4238 1.72 2.50 1.35 103 XMDiploma_00 4210 1.71 2.48 1.35 104 TR_XM_FormFill2 4148 1.11 2.45 0.50 105 XM_H_PHPOS 4132 1.10 2.44 0.48 106 USER_IN_DEF_DKIM_WL 4068 7.76 2.40 10.23 107 T_XMHurry_00 4066 1.09 2.40 0.48 108 RCVD_IN_VALIDITY_CERTIFIED 3693 2.88 2.18 3.20 109 SUBJ_ALL_CAPS 3690 1.77 2.18 1.59 110 XM_B_SpammyWords4 3564 1.01 2.10 0.50 111 ALL_TRUSTED 3561 12.73 2.10 17.64 112 TR_Mismatch_TLD_02 3486 0.72 2.06 0.09 113 ANY_BOUNCE_MESSAGE 3481 3.92 2.05 4.78 114 BOUNCE_MESSAGE 3475 3.91 2.05 4.78 115 AC_BR_BONANZA 3448 0.74 2.03 0.13 116 RELAYCOUNTRY_AU 3325 1.11 1.96 0.72 117 XMStockSpam_06 3178 1.11 1.88 0.75 118 MAILING_LIST_MULTI 3147 2.44 1.86 2.71 119 URI_HEX 3088 1.36 1.82 1.14 120 TR_XM_NoHeaderRelay 3052 0.65 1.80 0.12 121 T_REMOTE_IMAGE 2940 3.05 1.73 3.66 122 BAYES_40 2918 3.87 1.72 4.86 123 XM_DK_Undo_01 2903 1.90 1.71 1.99 124 HTML_TAG_BALANCE_BODY 2866 0.86 1.69 0.48 125 TR_Symld_Words 2810 1.91 1.66 2.03 126 HTML_MIME_NO_HTML_TAG 2781 1.97 1.64 2.13 127 HTTPS_HTTP_MISMATCH 2619 1.61 1.55 1.63 128 URI_TRY_3LD 2607 1.02 1.54 0.78 129 TR_XM_INV_DKIM 2606 0.53 1.54 0.06 130 RCVD_IN_IADB_LISTED 2596 3.75 1.53 4.78 131 XM_HighProb1 2580 0.49 1.52 0.01 132 XMSubMetaI_00 2571 1.02 1.52 0.79 133 BOTNET_NORDNS 2554 0.48 1.51 0.01 134 T_XMDrugObfuBody_00 2553 0.92 1.51 0.64 135 XM_DIRTYINTL 2505 0.62 1.48 0.22 136 XM_SendGrid 2465 1.31 1.45 1.25 137 SCC_BODY_URI_ONLY 2402 2.22 1.42 2.59 138 BAYES_20 2378 2.86 1.40 3.53 139 SpammyFromTLD_02 2349 0.60 1.39 0.23 140 RCVD_IN_IADB_SPF 2243 3.33 1.32 4.26 141 BASE64_LENGTH_79_INF 2189 1.38 1.29 1.43 142 RCVD_IN_IADB_DK 2146 2.97 1.27 3.76 143 KHOP_HELO_FCRDNS 2143 1.24 1.26 1.22 144 T_MONEY_PERCENT 2143 0.54 1.26 0.20 145 TR_LOTS_OF_MONEY2 2143 0.54 1.26 0.20 146 TM2_M_A_HREF_HREF 2132 0.67 1.26 0.40 147 XM_ProductURIs 2123 0.76 1.25 0.53 148 RCVD_IN_IADB_SENDERID 2123 3.04 1.25 3.86 149 RCVD_IN_PSBL 2110 0.56 1.25 0.25 150 T_TooManySym_02 2082 2.43 1.23 2.98 151 XMPhish30 2042 0.69 1.20 0.45 152 MPART_ALT_DIFF_COUNT 2032 0.76 1.20 0.55 153 XMBdyGiftCard01 1983 0.99 1.17 0.91 154 XMSexyCombo_01 1935 0.53 1.14 0.25 155 TR_XM_Base64_M1 1902 0.77 1.12 0.60 156 XMPhish14 1868 0.83 1.10 0.71 157 XMGenDplmaNmb 1832 0.82 1.08 0.69 158 THIS_AD 1822 0.64 1.08 0.43 159 XMBody_78 1805 0.56 1.07 0.33 160 RCVD_IN_VALIDITY_RPBL 1750 0.36 1.03 0.04 161 XMHTML_After_End 1740 0.78 1.03 0.66 162 XMClaimOffer 1679 0.38 0.99 0.10 163 XMReplyNow 1668 0.47 0.98 0.23 164 RELAYCOUNTRY_FR 1658 0.46 0.98 0.22 165 TR_XM_InvalidRelay 1657 0.33 0.98 0.03 166 LongTLD 1654 0.59 0.98 0.41 167 XM_UB99 1635 0.31 0.96 0.00 168 RDNS_DYNAMIC 1633 0.58 0.96 0.40 169 TM2_M_BODY_EMPTY 1625 0.75 0.96 0.65 170 XMLngstWrd_00 1598 0.78 0.94 0.71 171 TR_MetaPhish_Combo_01 1584 0.77 0.93 0.70 172 XM_H_PHPMailer 1583 0.83 0.93 0.79 173 URI_NOVOWEL 1537 1.50 0.91 1.78 174 XMEmptyBody_01 1535 0.38 0.91 0.14 175 T_XMDrugObfuBody_10 1532 0.30 0.90 0.02 176 MISSING_HEADERS 1525 0.66 0.90 0.55 177 TR_XM_DK_SendGrid 1505 0.86 0.89 0.84 178 SHOPIFY_IMG_NOT_RCVD_SFY 1491 0.42 0.88 0.21 179 XM_B_COPY_HTML 1481 0.62 0.87 0.51 180 T_TooManySym_03 1457 1.22 0.86 1.39 181 T_Symld_Words_02 1444 0.56 0.85 0.43 182 XM_B_Phish66 1437 0.46 0.85 0.29 183 XM_B_COVIDMETA 1423 0.43 0.84 0.24 184 TR_Caps_n_Bayes_99 1422 0.28 0.84 0.03 185 XM_H_Long_From02 1413 0.97 0.83 1.03 186 XM_B_DNDMA 1391 0.43 0.82 0.26 187 LONGLN_LOW_CONTRAST 1390 0.42 0.82 0.23 188 HTML_FONT_FACE_BAD 1384 0.52 0.82 0.39 189 DKIM_ADSP_CUSTOM_MED 1365 0.98 0.81 1.06 190 BAYES_05 1319 2.15 0.78 2.78 191 XMBody_29 1317 0.32 0.78 0.11 192 TR_Mismatch_TLD_01 1312 0.47 0.77 0.33 193 XMSubMetaSSx_00 1267 0.35 0.75 0.16 194 XM_B_SEO 1237 0.35 0.73 0.17 195 HOSTED_IMG_MULTI_PUB_01 1234 0.24 0.73 0.01 196 PDS_OTHER_BAD_TLD 1224 0.32 0.72 0.14 197 AC_HTML_NONSENSE_TAGS 1220 0.25 0.72 0.03 198 FORGED_RELAY_MUA_TO_MX 1202 0.23 0.71 0.01 199 TM2_M_OBFU_COMMENT 1198 0.36 0.71 0.21 200 REMOVE_BEFORE_LINK 1185 0.37 0.70 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 315503 89.12 95.67 86.09 2 T_SCC_BODY_TEXT_LINE 304447 82.29 80.60 83.08 3 RELAYCOUNTRY_US 290256 78.64 77.43 79.20 4 DKIM_SIGNED 265371 77.95 89.93 72.41 5 XM_DK_Pass 260196 76.00 86.80 71.00 6 DKIM_VALID 256380 74.96 85.78 69.96 7 XM_B_Unicode 249787 73.81 86.03 68.16 8 DCC_CHECK_NEGATIVE 249122 55.00 26.93 67.98 9 BAYES_50 212081 51.86 38.85 57.87 10 DKIM_VALID_AU 202660 57.87 63.44 55.30 11 XMListUnsubscribeExists 172734 55.41 73.30 47.13 12 XM_B_SpammyWords 156498 52.48 73.62 42.70 13 XM_B_Unicode3 142757 40.87 45.01 38.95 14 DCC_CHECK 117193 44.97 73.05 31.98 15 T_TM2_M_HEADER_IN_MSG 108455 27.42 22.72 29.59 16 DKIM_VALID_EF 101042 29.05 32.24 27.57 17 HTML_FONT_LOW_CONTRAST 97355 29.67 36.39 26.57 18 FVGT_m_MULTI_ODD 92073 27.50 32.64 25.12 19 RCVD_IN_MSPIKE_H2 82704 22.44 22.18 22.57 20 LOC_TINY_FONT_1 82601 28.29 40.73 22.54 21 XMSubLong 79896 22.23 23.16 21.80 22 T_KAM_HTML_FONT_INVALID 76682 23.69 29.67 20.92 23 MIME_HTML_ONLY 67492 23.25 33.69 18.42 24 ALL_TRUSTED 64646 12.73 2.10 17.64 25 XM_B_SpammyWords2 62171 25.09 42.65 16.96 26 XM_Multi_Part_URI 45442 14.21 18.12 12.40 27 TR_XM_DK_Unsub 45298 16.27 24.71 12.36 28 BAYES_00 38396 7.35 0.60 10.48 29 USER_IN_DEF_DKIM_WL 37508 7.76 2.40 10.23 30 UNPARSEABLE_RELAY 37057 11.47 14.41 10.11 31 BAYES_60 33888 8.59 7.16 9.25 32 TooManyTo_001 31632 7.30 4.44 8.63 33 LotsOfNums_01 30744 8.01 7.20 8.39 34 XM_B_Unsub 29104 10.09 14.75 7.94 35 XM_DKIMWhitelistDomains 27523 5.14 0.03 7.51 36 XM_Evil_Numbers_Gen 26736 7.77 8.81 7.30 37 XM_H_GMP 25124 5.83 3.60 6.86 38 IN_ZIMBRA_NJ_WHITELIST 24550 4.61 0.09 6.70 39 TR_XM_DK_Bayes 24546 4.71 0.42 6.70 40 TR_XM_DK_Bayes1 24123 4.63 0.42 6.58 41 TR_XM_BayesUnsub 23223 8.83 14.21 6.34 42 RCVD_IN_MSPIKE_H3 22681 7.66 10.84 6.19 43 RCVD_IN_MSPIKE_WL 22681 7.66 10.84 6.19 44 LOTS_OF_MONEY 21808 8.93 15.38 5.95 45 TR_XM_DK_Bayes2 20528 3.94 0.35 5.60 46 T_TooManySym_01 20047 4.60 2.71 5.47 47 XM_DK_Undo_02 19991 18.25 45.91 5.46 48 MIME_QP_LONG_LINE 19875 4.71 3.15 5.42 49 XM_PDF 18970 3.69 0.48 5.18 50 XM_H_Long_From01 18567 4.95 4.68 5.07 51 XM_Body_Dirty_Words 17854 6.62 10.39 4.87 52 BAYES_40 17828 3.87 1.72 4.86 53 RCVD_IN_IADB_LISTED 17509 3.75 1.53 4.78 54 ANY_BOUNCE_MESSAGE 17505 3.92 2.05 4.78 55 BOUNCE_MESSAGE 17503 3.91 2.05 4.78 56 HTML_IMAGE_RATIO_02 17069 5.15 6.22 4.66 57 MPART_ALT_DIFF 16719 4.92 5.69 4.56 58 XMStrtUSub 16515 4.64 4.94 4.51 59 BAYES_99 16084 14.28 35.66 4.39 60 RCVD_IN_IADB_SPF 15614 3.33 1.32 4.26 61 HTML_IMAGE_RATIO_04 15496 4.81 6.08 4.23 62 BOTNET_IPINHOSTNAME 15487 7.51 14.62 4.23 63 BAYES_80 15381 5.60 8.63 4.20 64 FSL_BULK_SIG 15032 5.43 8.30 4.10 65 RELAYCOUNTRY_META 14823 9.63 21.71 4.04 66 RCVD_IN_IADB_SENDERID 14143 3.04 1.25 3.86 67 TR_XM_SpammyWords4 13894 6.98 13.87 3.79 68 XM_B_SpammyWords3 13886 6.91 13.65 3.79 69 RCVD_IN_IADB_DK 13784 2.97 1.27 3.76 70 RCVD_IN_VALIDITY_SAFE 13585 3.40 2.72 3.71 71 T_REMOTE_IMAGE 13422 3.05 1.73 3.66 72 XM_UncommonTLD01 13410 4.88 7.51 3.66 73 XMSubMetaSx_00 13220 4.22 5.56 3.61 74 BAYES_20 12940 2.86 1.40 3.53 75 BAYES_999 12324 11.29 28.44 3.36 76 HTML_IMAGE_RATIO_06 12293 3.84 4.88 3.35 77 XM_SPF_SoftFail 11928 3.56 4.20 3.25 78 RCVD_IN_VALIDITY_CERTIFIED 11733 2.88 2.18 3.20 79 XMNumbers 11651 3.86 5.33 3.18 80 XM_B_Phish_Phrases 11509 3.63 4.68 3.14 81 T_TooManySym_02 10924 2.43 1.23 2.98 82 RCVD_IN_IADB_VOUCHED 10697 2.21 0.69 2.92 83 BAYES_05 10190 2.15 0.78 2.78 84 MAILING_LIST_MULTI 9923 2.44 1.86 2.71 85 BAYES_95 9680 3.45 5.20 2.64 86 SCC_BODY_URI_ONLY 9486 2.22 1.42 2.59 87 TooManyTo_002 9229 1.93 0.67 2.52 88 HTML_IMAGE_RATIO_08 9046 2.79 3.47 2.47 89 DKIM_INVALID 8991 2.99 4.15 2.45 90 MIME_HTML_ONLY_MULTI 8525 2.57 3.10 2.33 91 MIME_HTML_MOSTLY 8469 2.63 3.31 2.31 92 TR_XM_SpammyRelay 8346 7.31 18.18 2.28 93 XM_B_SpammyTLD 8318 2.58 3.24 2.27 94 XM_CamelCaseFrm001 8070 2.32 2.58 2.20 95 TR_XM_DKIM_Undo 7792 13.03 36.61 2.13 96 HTML_MIME_NO_HTML_TAG 7788 1.97 1.64 2.13 97 HELO_NODOT 7711 1.61 0.53 2.10 98 HELO_NO_DOMAIN 7704 1.61 0.53 2.10 99 TR_Symld_Words 7441 1.91 1.66 2.03 100 FROM_EXCESS_BASE64 7355 2.17 2.51 2.01 101 INVALID_MSGID 7323 1.43 0.20 2.00 102 XM_DK_Undo_01 7281 1.90 1.71 1.99 103 RCVD_IN_IADB_OPTIN 7169 1.46 0.39 1.96 104 URI_NOVOWEL 6506 1.50 0.91 1.78 105 TM2_M_URI_OPT_OUT 6498 2.02 2.55 1.77 106 TR_XM_PhishingBody 6442 2.43 3.89 1.76 107 TO_MALFORMED 6434 1.20 0.01 1.76 108 T_XMDrugObfuBody_14 6217 2.18 3.21 1.70 109 XM_B_Investor 6122 2.50 4.31 1.67 110 TR_DCC_Bayes_99 5999 9.41 26.21 1.64 111 HTTPS_HTTP_MISMATCH 5987 1.61 1.55 1.63 112 TR_XM_UnparsRelay 5846 3.55 7.77 1.60 113 SUBJ_ALL_CAPS 5816 1.77 2.18 1.59 114 TooManyTo_003 5657 1.24 0.58 1.54 115 TVD_SPACE_RATIO 5440 1.10 0.28 1.48 116 T_XMDrugObfuBody_08 5402 2.07 3.35 1.47 117 UNTRUSTED_Relay 5401 2.84 5.81 1.47 118 IN_HORDE_ADDRESS_BOOK 5319 1.01 0.05 1.45 119 XMSexyCombo_05 5277 2.74 5.56 1.44 120 BASE64_LENGTH_79_INF 5227 1.38 1.29 1.43 121 XM_H_Trusted_IP 5164 0.96 0.00 1.41 122 T_TooManySym_03 5100 1.22 0.86 1.39 123 TVD_RCVD_IP 5052 1.15 0.67 1.38 124 TM2_M_VERY_LONG_WORD 4973 1.84 2.88 1.36 125 XM_B_Unsub2 4963 1.72 2.50 1.35 126 XMDiploma_00 4944 1.71 2.48 1.35 127 XM_OfRef6 4928 2.24 4.18 1.34 128 XMCapTrack 4833 1.01 0.35 1.32 129 TR_XM_SpammyWords5 4774 2.31 4.48 1.30 130 RELAYCOUNTRY_CA 4643 5.06 13.25 1.27 131 XM_SendGrid 4564 1.31 1.45 1.25 132 KHOP_HELO_FCRDNS 4482 1.24 1.26 1.22 133 BOTNET 4252 4.08 10.41 1.16 134 TooManyTo_004 4239 0.96 0.54 1.16 135 XM_GoogleGroups 4211 0.92 0.42 1.15 136 URI_HEX 4176 1.36 1.82 1.14 137 XMBody_95 4163 0.84 0.19 1.14 138 XMGappySubj_01 4099 0.84 0.24 1.12 139 XMBSHREFv2 3995 0.85 0.32 1.09 140 DKIM_ADSP_CUSTOM_MED 3882 0.98 0.81 1.06 141 T_FILL_THIS_FORM_SHORT 3815 2.31 5.06 1.04 142 XM_H_Long_From02 3788 0.97 0.83 1.03 143 XMSubNoVowel 3591 0.79 0.36 0.98 144 TooManyTo_005 3589 0.83 0.51 0.98 145 XMBdyGiftCard01 3338 0.99 1.17 0.91 146 TR_XM_DK_SendGrid 3089 0.86 0.89 0.84 147 XM_ShortIntro_01 3020 0.71 0.47 0.82 148 XM_UB50 3007 1.51 2.99 0.82 149 XMGappySubj_02 2929 0.60 0.17 0.80 150 XM_H_PHPMailer 2891 0.83 0.93 0.79 151 XMSubMetaI_00 2883 1.02 1.52 0.79 152 URI_TRY_3LD 2876 1.02 1.54 0.78 153 TR_LOTS_OF_MONEY3 2827 1.90 4.34 0.77 154 T_OBFU_PDF_ATTACH 2818 0.55 0.07 0.77 155 SpammyFromTLD_01 2776 1.77 3.96 0.76 156 XMStockSpam_06 2761 1.11 1.88 0.75 157 NML_ADSP_CUSTOM_MED 2733 0.68 0.55 0.75 158 RCVD_IN_RP_SAFE 2728 0.67 0.49 0.74 159 RELAYCOUNTRY_AU 2638 1.11 1.96 0.72 160 XMPhish14 2607 0.83 1.10 0.71 161 XMLngstWrd_00 2604 0.78 0.94 0.71 162 TR_MetaPhish_Combo_01 2559 0.77 0.93 0.70 163 XMGenDplmaNmb 2545 0.82 1.08 0.69 164 XMBrknScrpt_02 2504 1.33 2.72 0.68 165 FORGED_GMAIL_RCVD 2493 0.69 0.70 0.68 166 XMHTML_After_End 2424 0.78 1.03 0.66 167 RCVD_IN_BL_SPAMCOP_NET 2417 4.76 13.64 0.66 168 MSGID_NOFQDN1 2403 0.45 0.01 0.66 169 TM2_M_BODY_EMPTY 2398 0.75 0.96 0.65 170 RCVD_IN_RP_CERTIFIED 2367 0.57 0.39 0.65 171 T_XMDrugObfuBody_00 2361 0.92 1.51 0.64 172 XMNoVowels 2331 0.54 0.35 0.64 173 SHORT_HELO_AND_INLINE_IMAGE 2262 0.44 0.06 0.62 174 TR_XM_Base64_M1 2208 0.77 1.12 0.60 175 FILL_THIS_FORM 2180 0.51 0.31 0.59 176 MPART_ALT_DIFF_COUNT 2030 0.76 1.20 0.55 177 HTML_IMAGE_ONLY_28 2017 0.47 0.29 0.55 178 MISSING_HEADERS 1999 0.66 0.90 0.55 179 USER_IN_WELCOMELIST 1994 0.37 0.00 0.54 180 USER_IN_WHITELIST 1994 0.37 0.00 0.54 181 XMBody_17 1955 2.75 7.56 0.53 182 XM_ProductURIs 1944 0.76 1.25 0.53 183 TO_NO_BRKTS_HTML_ONLY 1895 0.43 0.23 0.52 184 FROM_GOV_DKIM_AU 1893 0.40 0.15 0.52 185 XM_B_COPY_HTML 1866 0.62 0.87 0.51 186 RCVD_IN_SORBS_DUL 1865 0.36 0.05 0.51 187 XMMoneyMeta_00 1852 0.53 0.58 0.51 188 TR_XM_PHPForged 1852 1.14 2.51 0.51 189 XM_B_SpammyWords4 1848 1.01 2.10 0.50 190 TR_XM_FormFill2 1819 1.11 2.45 0.50 191 TR_XM_PHPDW 1818 1.13 2.50 0.50 192 SUBJ_DOLLARS 1808 0.51 0.55 0.49 193 RELAYCOUNTRY_GB 1789 0.55 0.67 0.49 194 T_XMHurry_00 1757 1.09 2.40 0.48 195 HTML_TAG_BALANCE_BODY 1750 0.86 1.69 0.48 196 XM_H_PHPOS 1750 1.10 2.44 0.48 197 T_TooManySym_04 1745 0.43 0.34 0.48 198 GMD_PDF_EMPTY_BODY 1733 0.34 0.06 0.47 199 TR_XM_SpammyWords2 1712 4.68 13.79 0.47 200 XMPhish30 1637 0.69 1.20 0.45 ----------------------------------------------------------------------