Email: 514016 Autolearn: 0 AvgScore: 3.63 AvgScanTime: 1.39 sec Spam: 155010 Autolearn: 0 AvgScore: 13.11 AvgScanTime: 1.57 sec Ham: 359006 Autolearn: 0 AvgScore: -0.47 AvgScanTime: 1.31 sec Time Spent Running SA: 198.81 hours Time Spent Processing Spam: 67.71 hours Time Spent Processing Ham: 131.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146274 88.41 94.36 85.84 2 DKIM_SIGNED 141944 78.83 91.57 73.33 3 XM_DK_Pass 136549 76.84 88.09 71.98 4 DKIM_VALID 134700 75.70 86.90 70.86 5 XM_B_Unicode 130868 73.25 84.43 68.43 6 RELAYCOUNTRY_US 126038 80.38 81.31 79.98 7 T_SCC_BODY_TEXT_LINE 123634 82.22 79.76 83.28 8 XMListUnsubscribeExists 111777 54.99 72.11 47.60 9 DCC_CHECK 111534 45.06 71.95 33.44 10 XM_B_SpammyWords 110152 52.30 71.06 44.20 11 DKIM_VALID_AU 100827 59.30 65.05 56.82 12 XM_B_Unicode3 70370 41.04 45.40 39.15 13 XM_DK_Undo_02 68607 17.37 44.26 5.76 14 XM_B_SpammyWords2 65426 26.67 42.21 19.96 15 LOC_TINY_FONT_1 63318 29.26 40.85 24.26 16 BAYES_50 61828 52.96 39.89 58.61 17 HTML_FONT_LOW_CONTRAST 56881 29.34 36.70 26.16 18 TR_XM_DKIM_Undo 52349 11.82 33.77 2.34 19 BAYES_99 52339 13.12 33.76 4.20 20 MIME_HTML_ONLY 49255 23.41 31.78 19.80 21 FVGT_m_MULTI_ODD 49012 27.18 31.62 25.26 22 DKIM_VALID_EF 48953 29.35 31.58 28.38 23 T_KAM_HTML_FONT_INVALID 43548 22.58 28.09 20.20 24 DCC_CHECK_NEGATIVE 43455 54.91 28.03 66.51 25 BAYES_999 41194 10.32 26.58 3.31 26 XMSubLong 39631 22.90 25.57 21.75 27 TR_DCC_Bayes_99 37636 8.33 24.28 1.44 28 T_TM2_M_HEADER_IN_MSG 37501 28.14 24.19 29.84 29 RCVD_IN_MSPIKE_H2 36090 22.62 23.28 22.34 30 TR_XM_DK_Unsub 35705 16.11 23.03 13.12 31 XM_Multi_Part_URI 31046 14.96 20.03 12.77 32 RELAYCOUNTRY_META 29244 8.33 18.87 3.78 33 XM_B_Unsub 25027 10.48 16.15 8.03 34 TR_XM_BayesUnsub 24102 8.95 15.55 6.09 35 TR_XM_SpammyRelay 23797 6.08 15.35 2.07 36 UNPARSEABLE_RELAY 22500 11.34 14.52 9.97 37 BOTNET_IPINHOSTNAME 21936 7.34 14.15 4.40 38 LOTS_OF_MONEY 21802 9.29 14.06 7.23 39 TR_XM_SpammyWords2 21250 4.44 13.71 0.44 40 XM_B_SpammyWords3 20864 7.02 13.46 4.24 41 RCVD_IN_BL_SPAMCOP_NET 19085 4.38 12.31 0.95 42 TR_XM_SpammyWords4 18927 7.16 12.21 4.98 43 XM_Body_Dirty_Words 16772 6.26 10.82 4.30 44 RELAYCOUNTRY_CA 16150 3.90 10.42 1.09 45 TR_XM_SPAMCOP 15712 3.36 10.14 0.43 46 XM_Evil_Numbers_Gen 15465 8.71 9.98 8.16 47 BOTNET 15070 3.87 9.72 1.35 48 FSL_BULK_SIG 14303 5.97 9.23 4.57 49 RCVD_IN_MSPIKE_H3 13657 7.24 8.81 6.56 50 RCVD_IN_MSPIKE_WL 13657 7.24 8.81 6.56 51 BAYES_80 13132 5.29 8.47 3.92 52 LotsOfNums_01 12413 8.24 8.01 8.34 53 XM_UncommonTLD01 12098 4.97 7.80 3.75 54 BAYES_60 11408 8.32 7.36 8.74 55 TR_XM_UnparsRelay 11249 3.20 7.26 1.45 56 HTML_IMAGE_RATIO_02 10882 5.66 7.02 5.08 57 XMSubMetaSx_00 9831 4.23 6.34 3.32 58 HTML_IMAGE_RATIO_04 9174 4.40 5.92 3.75 59 XMSexyCombo_05 8990 2.84 5.80 1.56 60 MPART_ALT_DIFF 8469 4.41 5.46 3.96 61 XM_H_Long_From01 8468 5.48 5.46 5.48 62 UNTRUSTED_Relay 8257 2.53 5.33 1.32 63 XM_SPF_SoftFail 8204 3.94 5.29 3.36 64 TooManyTo_001 8034 7.41 5.18 8.37 65 XMNumbers 7791 3.43 5.03 2.74 66 XM_B_Phish_Phrases 7782 3.77 5.02 3.23 67 XMBody_17 7657 1.78 4.94 0.41 68 BAYES_95 7470 3.16 4.82 2.44 69 DKIM_INVALID 7244 3.13 4.67 2.47 70 XM_B_Investor 7099 2.60 4.58 1.74 71 SpammyFromTLD_01 6838 1.93 4.41 0.86 72 XM_H_GMP 6484 5.58 4.18 6.18 73 T_FILL_THIS_FORM_SHORT 6068 1.78 3.91 0.86 74 XMStrtUSub 5969 4.70 3.85 5.06 75 TR_XM_PhishingBody 5909 2.24 3.81 1.57 76 MIME_QP_LONG_LINE 5876 4.74 3.79 5.15 77 MIME_HTML_MOSTLY 5808 2.63 3.75 2.14 78 TM2_M_URI_OPT_OUT 5765 2.48 3.72 1.94 79 HTML_IMAGE_RATIO_06 5705 2.85 3.68 2.49 80 HTML_IMAGE_RATIO_08 5505 2.91 3.55 2.64 81 T_XMDrugObfuBody_08 5424 2.20 3.50 1.63 82 XMDiploma_00 5398 2.12 3.48 1.54 83 TR_XM_BayesRelay 5270 1.03 3.40 0.00 84 T_XMDrugObfuBody_14 5229 2.15 3.37 1.63 85 XM_B_SpammyTLD 5204 2.85 3.36 2.64 86 TR_XM_SpammyWords5 5129 1.97 3.31 1.40 87 XM_OfRef6 5047 2.07 3.26 1.55 88 TR_XM_PHPForged 5022 1.30 3.24 0.47 89 TR_XM_PHPDW 4997 1.30 3.22 0.47 90 MIME_HTML_ONLY_MULTI 4985 2.51 3.22 2.20 91 TR_XM_FormFill2 4939 1.28 3.19 0.46 92 XM_H_PHPOS 4919 1.27 3.17 0.45 93 XM_CamelCaseFrm001 4655 2.44 3.00 2.20 94 RCVD_IN_VALIDITY_SAFE 4273 3.90 2.76 4.40 95 TM2_M_VERY_LONG_WORD 4209 1.67 2.72 1.23 96 T_TooManySym_01 4116 4.32 2.66 5.04 97 XM_UB50 4003 1.31 2.58 0.76 98 XM_B_Unsub2 3899 1.81 2.52 1.51 99 XM_URI_RBL 3629 0.81 2.34 0.14 100 USER_IN_DEF_DKIM_WL 3618 9.18 2.33 12.13 101 RELAYCOUNTRY_AU 3588 1.21 2.31 0.74 102 TR_XM_FormFill 3524 0.69 2.27 0.01 103 TR_LOTS_OF_MONEY3 3498 0.84 2.26 0.22 104 SCC_BODY_URI_ONLY 3471 2.67 2.24 2.86 105 HK_RANDOM_REPLYTO 3386 0.72 2.18 0.09 106 XM_B_SpammyWords4 3305 1.20 2.13 0.80 107 RCVD_IN_VALIDITY_CERTIFIED 3292 3.30 2.12 3.81 108 FONT_INVIS_LONG_LINE 3236 0.69 2.09 0.09 109 HTML_MIME_NO_HTML_TAG 3219 2.21 2.08 2.26 110 TR_XM_NoHeaderRelay 3006 0.68 1.94 0.13 111 RCVD_IN_IADB_LISTED 2995 3.70 1.93 4.46 112 BAYES_40 2964 4.03 1.91 4.95 113 MAILING_LIST_MULTI 2926 2.29 1.89 2.47 114 FROM_EXCESS_BASE64 2922 2.19 1.89 2.32 115 XMStockSpam_06 2887 1.13 1.86 0.81 116 XM_H_Long_From02 2885 1.22 1.86 0.94 117 HTML_TAG_BALANCE_BODY 2863 1.05 1.85 0.71 118 T_REMOTE_IMAGE 2860 3.35 1.85 3.99 119 TM2_M_BODY_EMPTY 2767 0.91 1.79 0.53 120 ANY_BOUNCE_MESSAGE 2748 3.58 1.77 4.36 121 XM_DIRTYINTL 2745 0.68 1.77 0.21 122 BOUNCE_MESSAGE 2745 3.58 1.77 4.36 123 RCVD_IN_IADB_SPF 2708 3.28 1.75 3.95 124 SUBJ_ALL_CAPS 2706 1.56 1.75 1.47 125 XMEmptyBody_01 2701 0.62 1.74 0.13 126 BAYES_20 2699 2.93 1.74 3.44 127 XMGenDplmaNmb 2619 1.10 1.69 0.84 128 XM_DK_Undo_01 2603 1.82 1.68 1.87 129 T_XMHurry_00 2596 0.76 1.67 0.36 130 URI_HEX 2574 1.24 1.66 1.06 131 RCVD_IN_IADB_DK 2568 2.92 1.66 3.46 132 T_XMDrugObfuBody_00 2559 0.97 1.65 0.68 133 RCVD_IN_IADB_SENDERID 2555 2.98 1.65 3.56 134 TR_Mismatch_TLD_02 2474 0.57 1.60 0.12 135 TR_XM_INV_DKIM 2425 0.53 1.56 0.08 136 XM_SendGrid 2423 1.47 1.56 1.43 137 XMPhish30 2347 0.93 1.51 0.67 138 AC_BR_BONANZA 2296 0.53 1.48 0.12 139 URI_TRY_3LD 2190 0.88 1.41 0.65 140 SpammyFromTLD_02 2173 0.72 1.40 0.43 141 KHOP_HELO_FCRDNS 2093 1.34 1.35 1.34 142 HTTPS_HTTP_MISMATCH 2032 0.94 1.31 0.78 143 BOTNET_NORDNS 2021 0.40 1.30 0.01 144 XMHTML_After_End 2004 0.76 1.29 0.53 145 XM_HighProb1 1995 0.39 1.29 0.00 146 ALL_TRUSTED 1975 12.36 1.27 17.15 147 XMSexyCombo_01 1974 0.57 1.27 0.27 148 XMBrknScrpt_02 1961 0.82 1.27 0.63 149 XM_H_Undi_Recip 1903 0.58 1.23 0.30 150 XMBdyGiftCard01 1894 0.73 1.22 0.52 151 URI_NOVOWEL 1885 1.81 1.22 2.07 152 T_XMDrugObfuBody_10 1830 0.38 1.18 0.03 153 TR_XM_InvalidRelay 1767 0.36 1.14 0.02 154 TR_XM_Base64_M1 1709 0.85 1.10 0.74 155 XM_B_COVIDMETA 1700 0.49 1.10 0.23 156 TR_XM_DK_SendGrid 1662 1.00 1.07 0.97 157 T_MONEY_PERCENT 1654 0.48 1.07 0.23 158 TR_LOTS_OF_MONEY2 1654 0.48 1.07 0.23 159 DKIM_ADSP_CUSTOM_MED 1648 0.94 1.06 0.89 160 XMSubMetaI_00 1619 0.64 1.04 0.47 161 BAYES_05 1598 2.22 1.03 2.74 162 XMReplyNow 1570 0.45 1.01 0.21 163 BAYES_00 1570 7.96 1.01 10.97 164 RDNS_DYNAMIC 1523 0.56 0.98 0.37 165 T_Symld_Words_02 1517 0.64 0.98 0.50 166 RELAYCOUNTRY_FR 1488 0.45 0.96 0.22 167 XMSlimDrugH 1448 0.47 0.93 0.27 168 XM_UB99 1442 0.28 0.93 0.00 169 XM_B_COPY_HTML 1426 0.59 0.92 0.45 170 TR_MetaPhish_Combo_01 1424 0.75 0.92 0.67 171 XMPhish14 1395 0.54 0.90 0.39 172 XM_H_PHPMailer 1367 0.74 0.88 0.67 173 XM_B_DNDMA 1359 0.52 0.88 0.37 174 RCVD_IN_VALIDITY_RPBL 1351 0.29 0.87 0.04 175 TR_Symld_Words 1331 1.24 0.86 1.40 176 MPART_ALT_DIFF_COUNT 1302 0.65 0.84 0.57 177 XM_S_SpammyWords 1283 0.45 0.83 0.28 178 URIBL_BLACK 1283 0.29 0.83 0.06 179 TR_XM_Spammywords 1283 0.45 0.83 0.28 180 NML_ADSP_CUSTOM_MED 1275 0.66 0.82 0.59 181 TVD_RCVD_IP 1270 1.31 0.82 1.52 182 XM_B_Phish66 1260 0.41 0.81 0.24 183 TR_XM_DK_Bayes 1259 5.66 0.81 7.75 184 XMBody_78 1257 0.51 0.81 0.38 185 THIS_AD 1207 0.41 0.78 0.25 186 SHOPIFY_IMG_NOT_RCVD_SFY 1191 0.40 0.77 0.24 187 HTML_FONT_FACE_BAD 1190 0.46 0.77 0.33 188 FORGED_GMAIL_RCVD 1186 0.59 0.77 0.51 189 XM_B_SEO 1183 0.32 0.76 0.13 190 RCVD_IN_IADB_VOUCHED 1177 2.17 0.76 2.77 191 XM_ProductURIs 1169 0.62 0.75 0.57 192 XMSubMetaSxObfu_03 1169 0.59 0.75 0.52 193 REMOVE_BEFORE_LINK 1157 0.35 0.75 0.17 194 DIET_1 1143 0.38 0.74 0.23 195 RCVD_IN_PSBL 1131 0.37 0.73 0.22 196 TM2_M_A_HREF_HREF 1129 0.37 0.73 0.21 197 ACT_NOW_CAPS 1125 0.30 0.73 0.12 198 TooManyTo_002 1104 1.83 0.71 2.31 199 TR_XM_SEO4 1103 0.26 0.71 0.06 200 PLING_QUERY 1087 0.40 0.70 0.27 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 308171 88.41 94.36 85.84 2 T_SCC_BODY_TEXT_LINE 298973 82.22 79.76 83.28 3 RELAYCOUNTRY_US 287146 80.38 81.31 79.98 4 DKIM_SIGNED 263259 78.83 91.57 73.33 5 XM_DK_Pass 258403 76.84 88.09 71.98 6 DKIM_VALID 254408 75.70 86.90 70.86 7 XM_B_Unicode 245650 73.25 84.43 68.43 8 DCC_CHECK_NEGATIVE 238772 54.91 28.03 66.51 9 BAYES_50 210401 52.96 39.89 58.61 10 DKIM_VALID_AU 203994 59.30 65.05 56.82 11 XMListUnsubscribeExists 170883 54.99 72.11 47.60 12 XM_B_SpammyWords 158665 52.30 71.06 44.20 13 XM_B_Unicode3 140560 41.04 45.40 39.15 14 DCC_CHECK 120056 45.06 71.95 33.44 15 T_TM2_M_HEADER_IN_MSG 107120 28.14 24.19 29.84 16 DKIM_VALID_EF 101897 29.35 31.58 28.38 17 HTML_FONT_LOW_CONTRAST 93920 29.34 36.70 26.16 18 FVGT_m_MULTI_ODD 90695 27.18 31.62 25.26 19 LOC_TINY_FONT_1 87094 29.26 40.85 24.26 20 RCVD_IN_MSPIKE_H2 80188 22.62 23.28 22.34 21 XMSubLong 78067 22.90 25.57 21.75 22 T_KAM_HTML_FONT_INVALID 72511 22.58 28.09 20.20 23 XM_B_SpammyWords2 71647 26.67 42.21 19.96 24 MIME_HTML_ONLY 71066 23.41 31.78 19.80 25 ALL_TRUSTED 61563 12.36 1.27 17.15 26 TR_XM_DK_Unsub 47116 16.11 23.03 13.12 27 XM_Multi_Part_URI 45850 14.96 20.03 12.77 28 USER_IN_DEF_DKIM_WL 43548 9.18 2.33 12.13 29 BAYES_00 39370 7.96 1.01 10.97 30 UNPARSEABLE_RELAY 35808 11.34 14.52 9.97 31 BAYES_60 31360 8.32 7.36 8.74 32 TooManyTo_001 30045 7.41 5.18 8.37 33 LotsOfNums_01 29950 8.24 8.01 8.34 34 XM_Evil_Numbers_Gen 29312 8.71 9.98 8.16 35 XM_B_Unsub 28817 10.48 16.15 8.03 36 TR_XM_DK_Bayes 27809 5.66 0.81 7.75 37 TR_XM_DK_Bayes1 27059 5.45 0.63 7.54 38 XM_DKIMWhitelistDomains 26277 5.12 0.02 7.32 39 LOTS_OF_MONEY 25951 9.29 14.06 7.23 40 IN_ZIMBRA_NJ_WHITELIST 25218 4.93 0.09 7.02 41 RCVD_IN_MSPIKE_WL 23564 7.24 8.81 6.56 42 RCVD_IN_MSPIKE_H3 23564 7.24 8.81 6.56 43 TR_XM_DK_Bayes2 23142 4.65 0.50 6.45 44 XM_H_GMP 22202 5.58 4.18 6.18 45 TR_XM_BayesUnsub 21881 8.95 15.55 6.09 46 XM_DK_Undo_02 20691 17.37 44.26 5.76 47 XM_H_Long_From01 19684 5.48 5.46 5.48 48 MIME_QP_LONG_LINE 18471 4.74 3.79 5.15 49 HTML_IMAGE_RATIO_02 18226 5.66 7.02 5.08 50 XMStrtUSub 18169 4.70 3.85 5.06 51 T_TooManySym_01 18095 4.32 2.66 5.04 52 TR_XM_SpammyWords4 17889 7.16 12.21 4.98 53 BAYES_40 17756 4.03 1.91 4.95 54 XM_PDF 17147 3.49 0.52 4.78 55 FSL_BULK_SIG 16391 5.97 9.23 4.57 56 RCVD_IN_IADB_LISTED 16001 3.70 1.93 4.46 57 BOTNET_IPINHOSTNAME 15792 7.34 14.15 4.40 58 RCVD_IN_VALIDITY_SAFE 15782 3.90 2.76 4.40 59 ANY_BOUNCE_MESSAGE 15646 3.58 1.77 4.36 60 BOUNCE_MESSAGE 15644 3.58 1.77 4.36 61 XM_Body_Dirty_Words 15425 6.26 10.82 4.30 62 XM_B_SpammyWords3 15207 7.02 13.46 4.24 63 BAYES_99 15096 13.12 33.76 4.20 64 T_REMOTE_IMAGE 14342 3.35 1.85 3.99 65 MPART_ALT_DIFF 14202 4.41 5.46 3.96 66 RCVD_IN_IADB_SPF 14165 3.28 1.75 3.95 67 BAYES_80 14072 5.29 8.47 3.92 68 RCVD_IN_VALIDITY_CERTIFIED 13677 3.30 2.12 3.81 69 RELAYCOUNTRY_META 13559 8.33 18.87 3.78 70 HTML_IMAGE_RATIO_04 13464 4.40 5.92 3.75 71 XM_UncommonTLD01 13446 4.97 7.80 3.75 72 RCVD_IN_IADB_SENDERID 12764 2.98 1.65 3.56 73 RCVD_IN_IADB_DK 12420 2.92 1.66 3.46 74 BAYES_20 12353 2.93 1.74 3.44 75 XM_SPF_SoftFail 12055 3.94 5.29 3.36 76 XMSubMetaSx_00 11922 4.23 6.34 3.32 77 BAYES_999 11872 10.32 26.58 3.31 78 XM_B_Phish_Phrases 11597 3.77 5.02 3.23 79 SCC_BODY_URI_ONLY 10274 2.67 2.24 2.86 80 RCVD_IN_IADB_VOUCHED 9958 2.17 0.76 2.77 81 XMNumbers 9838 3.43 5.03 2.74 82 BAYES_05 9831 2.22 1.03 2.74 83 HTML_IMAGE_RATIO_08 9467 2.91 3.55 2.64 84 XM_B_SpammyTLD 9464 2.85 3.36 2.64 85 HTML_IMAGE_RATIO_06 8942 2.85 3.68 2.49 86 MAILING_LIST_MULTI 8867 2.29 1.89 2.47 87 DKIM_INVALID 8851 3.13 4.67 2.47 88 T_TooManySym_02 8825 1.91 0.64 2.46 89 BAYES_95 8759 3.16 4.82 2.44 90 TR_XM_DKIM_Undo 8394 11.82 33.77 2.34 91 FROM_EXCESS_BASE64 8325 2.19 1.89 2.32 92 TooManyTo_002 8293 1.83 0.71 2.31 93 HTML_MIME_NO_HTML_TAG 8117 2.21 2.08 2.26 94 MIME_HTML_ONLY_MULTI 7893 2.51 3.22 2.20 95 XM_CamelCaseFrm001 7890 2.44 3.00 2.20 96 MIME_HTML_MOSTLY 7686 2.63 3.75 2.14 97 TR_XM_SpammyRelay 7432 6.08 15.35 2.07 98 URI_NOVOWEL 7419 1.81 1.22 2.07 99 INVALID_MSGID 7355 1.49 0.19 2.05 100 TM2_M_URI_OPT_OUT 6977 2.48 3.72 1.94 101 HELO_NODOT 6924 1.48 0.44 1.93 102 HELO_NO_DOMAIN 6915 1.48 0.44 1.93 103 XM_DK_Undo_01 6729 1.82 1.68 1.87 104 RCVD_IN_IADB_OPTIN 6673 1.44 0.49 1.86 105 TO_MALFORMED 6430 1.25 0.00 1.79 106 XM_B_Investor 6251 2.60 4.58 1.74 107 T_XMDrugObfuBody_08 5867 2.20 3.50 1.63 108 T_XMDrugObfuBody_14 5842 2.15 3.37 1.63 109 TR_XM_PhishingBody 5626 2.24 3.81 1.57 110 XMSexyCombo_05 5603 2.84 5.80 1.56 111 XMGappySubj_01 5589 1.15 0.20 1.56 112 XM_OfRef6 5569 2.07 3.26 1.55 113 XMDiploma_00 5524 2.12 3.48 1.54 114 IN_HORDE_ADDRESS_BOOK 5482 1.09 0.08 1.53 115 TVD_RCVD_IP 5441 1.31 0.82 1.52 116 XM_B_Unsub2 5407 1.81 2.52 1.51 117 SUBJ_ALL_CAPS 5287 1.56 1.75 1.47 118 TooManyTo_003 5275 1.22 0.66 1.47 119 TR_XM_UnparsRelay 5203 3.20 7.26 1.45 120 TR_DCC_Bayes_99 5168 8.33 24.28 1.44 121 XM_SendGrid 5149 1.47 1.56 1.43 122 TR_Symld_Words 5027 1.24 0.86 1.40 123 TR_XM_SpammyWords5 5017 1.97 3.31 1.40 124 BOTNET 4843 3.87 9.72 1.35 125 KHOP_HELO_FCRDNS 4817 1.34 1.35 1.34 126 UNTRUSTED_Relay 4756 2.53 5.33 1.32 127 TM2_M_VERY_LONG_WORD 4400 1.67 2.72 1.23 128 XMBody_95 4330 0.89 0.17 1.21 129 XMBSHREFv2 4287 0.95 0.38 1.19 130 XM_GoogleGroups 4281 0.99 0.52 1.19 131 XMCapTrack 4166 0.93 0.40 1.16 132 TVD_SPACE_RATIO 3930 0.81 0.16 1.09 133 RELAYCOUNTRY_CA 3918 3.90 10.42 1.09 134 URI_HEX 3819 1.24 1.66 1.06 135 TooManyTo_004 3775 0.92 0.61 1.05 136 XMGappySubj_02 3491 0.71 0.11 0.97 137 TR_XM_DK_SendGrid 3479 1.00 1.07 0.97 138 RCVD_IN_BL_SPAMCOP_NET 3420 4.38 12.31 0.95 139 XM_H_Long_From02 3390 1.22 1.86 0.94 140 DKIM_ADSP_CUSTOM_MED 3182 0.94 1.06 0.89 141 T_TooManySym_03 3161 0.71 0.32 0.88 142 FROM_GOV_DKIM_AU 3145 0.73 0.39 0.88 143 TooManyTo_005 3142 0.79 0.58 0.88 144 SpammyFromTLD_01 3105 1.93 4.41 0.86 145 T_FILL_THIS_FORM_SHORT 3092 1.78 3.91 0.86 146 RCVD_IN_RP_SAFE 3063 0.78 0.61 0.85 147 XMGenDplmaNmb 3027 1.10 1.69 0.84 148 XM_H_Trusted_IP 2952 0.57 0.00 0.82 149 XMStockSpam_06 2917 1.13 1.86 0.81 150 XM_B_SpammyWords4 2875 1.20 2.13 0.80 151 HTTPS_HTTP_MISMATCH 2805 0.94 1.31 0.78 152 XM_UB50 2735 1.31 2.58 0.76 153 XMSubNoVowel 2655 0.63 0.39 0.74 154 RCVD_IN_RP_CERTIFIED 2647 0.66 0.49 0.74 155 RELAYCOUNTRY_AU 2644 1.21 2.31 0.74 156 TR_XM_Base64_M1 2640 0.85 1.10 0.74 157 HTML_TAG_BALANCE_BODY 2533 1.05 1.85 0.71 158 XM_ShortIntro_01 2473 0.64 0.52 0.69 159 T_XMDrugObfuBody_00 2432 0.97 1.65 0.68 160 XM_H_PHPMailer 2419 0.74 0.88 0.67 161 TR_MetaPhish_Combo_01 2410 0.75 0.92 0.67 162 XMPhish30 2408 0.93 1.51 0.67 163 XMNoVowels 2377 0.61 0.48 0.66 164 MSGID_NOFQDN1 2363 0.46 0.01 0.66 165 URI_TRY_3LD 2323 0.88 1.41 0.65 166 T_OBFU_PDF_ATTACH 2291 0.47 0.08 0.64 167 XMBrknScrpt_02 2273 0.82 1.27 0.63 168 NML_ADSP_CUSTOM_MED 2128 0.66 0.82 0.59 169 XMMoneyMeta_00 2116 0.59 0.59 0.59 170 FILL_THIS_FORM 2090 0.56 0.50 0.58 171 BASE64_LENGTH_79_INF 2060 0.44 0.14 0.57 172 SHORT_HELO_AND_INLINE_IMAGE 2038 0.41 0.05 0.57 173 XM_ProductURIs 2034 0.62 0.75 0.57 174 MPART_ALT_DIFF_COUNT 2029 0.65 0.84 0.57 175 USER_IN_WELCOMELIST 1934 0.38 0.00 0.54 176 USER_IN_WHITELIST 1934 0.38 0.00 0.54 177 TM2_M_BODY_EMPTY 1904 0.91 1.79 0.53 178 XMHTML_After_End 1885 0.76 1.29 0.53 179 XMBdyGiftCard01 1872 0.73 1.22 0.52 180 XMSubMetaSxObfu_03 1851 0.59 0.75 0.52 181 HTML_IMAGE_ONLY_28 1845 0.45 0.31 0.51 182 FORGED_GMAIL_RCVD 1829 0.59 0.77 0.51 183 T_Symld_Words_02 1778 0.64 0.98 0.50 184 XMSubMetaI_00 1691 0.64 1.04 0.47 185 TR_XM_PHPForged 1675 1.30 3.24 0.47 186 TR_XM_PHPDW 1670 1.30 3.22 0.47 187 TR_XM_FormFill2 1660 1.28 3.19 0.46 188 XMDateMe_00 1653 0.47 0.49 0.46 189 RELAYCOUNTRY_GB 1645 0.50 0.61 0.46 190 HTML_IMAGE_ONLY_32 1638 0.37 0.19 0.46 191 XM_B_COPY_HTML 1624 0.59 0.92 0.45 192 XM_H_PHPOS 1608 1.27 3.17 0.45 193 RCVD_IN_SORBS_DUL 1566 0.32 0.05 0.44 194 TR_XM_SpammyWords2 1562 4.44 13.71 0.44 195 XMLngstWrd_00 1554 0.43 0.41 0.43 196 SpammyFromTLD_02 1550 0.72 1.40 0.43 197 TR_XM_SPAMCOP 1542 3.36 10.14 0.43 198 HTML_IMAGE_ONLY_20 1541 0.40 0.32 0.43 199 XMOemUri 1517 0.36 0.22 0.42 200 XMBody_17 1489 1.78 4.94 0.41 ----------------------------------------------------------------------