Email: 476895 Autolearn: 0 AvgScore: 4.23 AvgScanTime: 1.19 sec Spam: 156619 Autolearn: 0 AvgScore: 13.72 AvgScanTime: 1.33 sec Ham: 320276 Autolearn: 0 AvgScore: -0.42 AvgScanTime: 1.13 sec Time Spent Running SA: 158.04 hours Time Spent Processing Spam: 57.90 hours Time Spent Processing Ham: 100.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150446 88.80 96.06 85.25 2 DKIM_SIGNED 143553 80.29 91.66 74.73 3 XM_DK_Pass 138249 78.25 88.27 73.35 4 DKIM_VALID 135800 77.12 86.71 72.44 5 XM_B_Unicode 134539 74.87 85.90 69.48 6 T_SCC_BODY_TEXT_LINE 127124 82.58 81.17 83.26 7 RELAYCOUNTRY_US 126115 81.00 80.52 81.23 8 DCC_CHECK 114048 46.21 72.82 33.20 9 XMListUnsubscribeExists 113930 57.63 72.74 50.24 10 XM_B_SpammyWords 112972 53.22 72.13 43.97 11 DKIM_VALID_AU 100074 59.75 63.90 57.72 12 XM_DK_Undo_02 73955 19.49 47.22 5.93 13 XM_B_Unicode3 73156 42.50 46.71 40.44 14 TR_MAX_INTL_RELAY 67836 18.99 43.31 7.09 15 XM_B_SpammyWords2 64553 25.86 41.22 18.36 16 LOC_TINY_FONT_1 63004 30.12 40.23 25.17 17 BAYES_99 57844 15.46 36.93 4.96 18 BAYES_50 57748 52.08 36.87 59.51 19 TR_XM_DKIM_Undo 55905 13.33 35.69 2.39 20 HTML_FONT_LOW_CONTRAST 55565 30.45 35.48 27.99 21 MIME_HTML_ONLY 51775 24.06 33.06 19.66 22 DKIM_VALID_EF 50855 30.04 32.47 28.86 23 FVGT_m_MULTI_ODD 48889 27.29 31.22 25.37 24 T_KAM_HTML_FONT_INVALID 47796 24.21 30.52 21.13 25 BAYES_999 45828 12.29 29.26 3.99 26 DCC_CHECK_NEGATIVE 42547 53.76 27.17 66.76 27 TR_DCC_Bayes_99 41546 9.75 26.53 1.54 28 RCVD_IN_MSPIKE_H2 40103 24.60 25.61 24.11 29 TR_XM_DK_Unsub 38273 17.36 24.44 13.91 30 T_TM2_M_HEADER_IN_MSG 34966 26.36 22.33 28.34 31 XMSubLong 34899 22.70 22.28 22.91 32 RELAYCOUNTRY_META 32011 9.23 20.44 3.75 33 XM_Multi_Part_URI 30700 15.86 19.60 14.03 34 TR_XM_SpammyRelay 26250 6.92 16.76 2.11 35 XM_B_Unsub 25226 10.83 16.11 8.25 36 TR_XM_BayesUnsub 24352 9.50 15.55 6.54 37 UNPARSEABLE_RELAY 23560 11.82 15.04 10.24 38 RCVD_IN_BL_SPAMCOP_NET 23013 5.30 14.69 0.71 39 TR_XM_SpammyWords2 22445 5.01 14.33 0.45 40 BOTNET_IPINHOSTNAME 20995 7.60 13.41 4.76 41 XM_B_SpammyWords3 20508 7.04 13.09 4.08 42 LOTS_OF_MONEY 19275 8.54 12.31 6.70 43 TR_XM_SPAMCOP 18620 4.13 11.89 0.34 44 RELAYCOUNTRY_CA 18031 4.47 11.51 1.03 45 TR_XM_SpammyWords4 17533 6.91 11.19 4.82 46 RCVD_IN_MSPIKE_WL 15372 7.55 9.81 6.44 47 RCVD_IN_MSPIKE_H3 15372 7.55 9.81 6.44 48 XM_Body_Dirty_Words 15099 5.82 9.64 3.96 49 XM_Evil_Numbers_Gen 15061 8.38 9.62 7.77 50 BOTNET 14289 3.91 9.12 1.36 51 BAYES_80 13206 5.54 8.43 4.12 52 FSL_BULK_SIG 12080 4.82 7.71 3.40 53 BAYES_60 11951 8.73 7.63 9.27 54 TR_XM_UnparsRelay 11945 3.69 7.63 1.77 55 HTML_IMAGE_RATIO_02 11770 6.23 7.52 5.60 56 LotsOfNums_01 11083 8.30 7.08 8.90 57 XM_UncommonTLD01 10724 4.87 6.85 3.90 58 XMBody_17 10625 2.59 6.78 0.54 59 MPART_ALT_DIFF 9958 4.79 6.36 4.03 60 BAYES_95 9677 3.46 6.18 2.13 61 XMSubMetaSx_00 9044 4.80 5.77 4.33 62 HTML_IMAGE_RATIO_04 9010 4.99 5.75 4.61 63 T_FILL_THIS_FORM_SHORT 8697 2.37 5.55 0.82 64 XM_H_Long_From01 8434 5.49 5.39 5.53 65 UNTRUSTED_Relay 8404 2.73 5.37 1.44 66 TooManyTo_001 8373 7.53 5.35 8.60 67 XMSexyCombo_05 7828 2.67 5.00 1.53 68 DKIM_INVALID 7753 3.17 4.95 2.30 69 XM_B_Phish_Phrases 7087 3.54 4.52 3.06 70 TR_XM_SpammyWords5 6917 2.28 4.42 1.24 71 XM_SPF_SoftFail 6883 3.36 4.39 2.85 72 XMNumbers 6859 3.17 4.38 2.59 73 XM_B_Investor 6767 2.59 4.32 1.74 74 XMStrtUSub 6659 4.21 4.25 4.19 75 MIME_HTML_MOSTLY 6642 2.97 4.24 2.34 76 T_XMDrugObfuBody_14 6636 2.79 4.24 2.08 77 XM_B_SpammyTLD 6553 3.21 4.18 2.74 78 XM_H_GMP 6513 5.65 4.16 6.38 79 TR_XM_BayesRelay 6110 1.28 3.90 0.00 80 TM2_M_URI_OPT_OUT 6089 2.75 3.89 2.19 81 XM_OfRef6 6057 2.13 3.87 1.28 82 TR_XM_PhishingBody 6042 2.37 3.86 1.65 83 MIME_HTML_ONLY_MULTI 6031 2.89 3.85 2.42 84 HTML_IMAGE_RATIO_06 5958 2.88 3.80 2.43 85 USER_IN_DEF_DKIM_WL 5830 9.44 3.72 12.24 86 SpammyFromTLD_01 5815 1.73 3.71 0.76 87 TR_XM_FormFill 5813 1.22 3.71 0.01 88 FONT_INVIS_LONG_LINE 5316 1.16 3.39 0.07 89 RCVD_IN_VALIDITY_SAFE 5157 4.20 3.29 4.64 90 HTML_IMAGE_RATIO_08 4720 2.49 3.01 2.23 91 MIME_QP_LONG_LINE 4585 4.57 2.93 5.38 92 XMDiploma_00 4569 1.85 2.92 1.32 93 TR_XM_PHPDW 4525 1.23 2.89 0.42 94 TR_XM_PHPForged 4508 1.23 2.88 0.42 95 T_XMDrugObfuBody_08 4438 1.90 2.83 1.45 96 TR_XM_FormFill2 4435 1.21 2.83 0.41 97 XM_H_PHPOS 4418 1.19 2.82 0.40 98 FROM_EXCESS_BASE64 4390 2.21 2.80 1.92 99 TM2_M_VERY_LONG_WORD 4363 1.80 2.79 1.32 100 SUBJ_ALL_CAPS 4299 1.87 2.74 1.44 101 RCVD_IN_VALIDITY_CERTIFIED 4273 3.52 2.73 3.91 102 RELAYCOUNTRY_AU 4180 1.36 2.67 0.73 103 XM_CamelCaseFrm001 4097 2.24 2.62 2.06 104 XM_URI_RBL 3902 0.93 2.49 0.16 105 XM_UB50 3855 1.37 2.46 0.84 106 TR_XM_NoHeaderRelay 3693 0.84 2.36 0.10 107 XM_B_SpammyWords4 3425 1.01 2.19 0.44 108 T_TooManySym_01 3406 4.34 2.17 5.39 109 XM_B_Unsub2 3189 1.49 2.04 1.22 110 TR_XM_INV_DKIM 2872 0.64 1.83 0.06 111 XMStockSpam_06 2869 1.42 1.83 1.23 112 TR_LOTS_OF_MONEY3 2840 0.78 1.81 0.28 113 HK_RANDOM_REPLYTO 2833 0.65 1.81 0.08 114 XM_DK_Undo_01 2794 1.83 1.78 1.85 115 T_XMHurry_00 2777 1.05 1.77 0.70 116 TR_Mismatch_TLD_02 2763 0.64 1.76 0.09 117 XM_SendGrid 2754 1.56 1.76 1.46 118 URI_HEX 2660 1.21 1.70 0.97 119 XM_DIRTYINTL 2636 0.68 1.68 0.19 120 KHOP_HELO_FCRDNS 2632 1.24 1.68 1.02 121 XMBdyGiftCard01 2602 0.92 1.66 0.56 122 RCVD_IN_IADB_LISTED 2580 3.84 1.65 4.91 123 T_REMOTE_IMAGE 2556 2.93 1.63 3.56 124 T_XMDrugObfuBody_00 2517 0.96 1.61 0.65 125 SpammyFromTLD_02 2491 0.90 1.59 0.57 126 XM_B_COPY_HTML 2469 0.94 1.58 0.63 127 HTML_TAG_BALANCE_BODY 2395 0.76 1.53 0.39 128 XMGenDplmaNmb 2394 0.96 1.53 0.69 129 MAILING_LIST_MULTI 2351 2.28 1.50 2.66 130 BAYES_40 2303 3.56 1.47 4.58 131 XMPhish30 2298 0.89 1.47 0.61 132 XMReplyNow 2278 0.65 1.45 0.26 133 HTML_MIME_NO_HTML_TAG 2238 1.82 1.43 2.02 134 RCVD_IN_IADB_SPF 2234 3.38 1.43 4.33 135 TR_XM_Base64_M1 2215 0.84 1.41 0.56 136 TR_MetaPhish_Combo_01 2207 0.94 1.41 0.71 137 SCC_BODY_URI_ONLY 2203 2.25 1.41 2.66 138 RCVD_IN_PSBL 2161 0.71 1.38 0.39 139 ANY_BOUNCE_MESSAGE 2146 3.48 1.37 4.51 140 BOUNCE_MESSAGE 2146 3.48 1.37 4.51 141 RCVD_IN_IADB_DK 2121 2.98 1.35 3.78 142 XM_HighProb1 2108 0.44 1.35 0.00 143 TR_Caps_n_Bayes_99 2061 0.44 1.32 0.01 144 RCVD_IN_IADB_SENDERID 2021 3.04 1.29 3.90 145 URI_TRY_3LD 1948 0.88 1.24 0.70 146 BAYES_20 1935 2.60 1.24 3.27 147 BOTNET_NORDNS 1916 0.41 1.22 0.01 148 AC_BR_BONANZA 1912 0.46 1.22 0.09 149 TR_XM_DK_SendGrid 1900 1.04 1.21 0.95 150 XMSexyCombo_01 1833 0.55 1.17 0.25 151 XM_ProductURIs 1758 0.83 1.12 0.68 152 XM_UB60 1756 0.40 1.12 0.05 153 XM_H_PHPMailer 1745 0.85 1.11 0.73 154 ALL_TRUSTED 1690 10.95 1.08 15.78 155 HTTPS_HTTP_MISMATCH 1681 0.86 1.07 0.75 156 TR_Symld_Words 1676 1.38 1.07 1.53 157 XMBrknScrpt_02 1668 0.71 1.07 0.53 158 MISSING_HEADERS 1626 0.61 1.04 0.41 159 URIBL_DBL_SPAM 1600 0.34 1.02 0.01 160 URI_NOVOWEL 1590 1.49 1.02 1.72 161 RDNS_DYNAMIC 1555 0.59 0.99 0.39 162 SHOPIFY_IMG_NOT_RCVD_SFY 1520 0.51 0.97 0.29 163 XM_H_Undi_Recip 1502 0.46 0.96 0.22 164 TR_XM_InvalidRelay 1495 0.33 0.95 0.02 165 TM2_M_A_HREF_HREF 1477 0.46 0.94 0.22 166 XM_B_Phish66 1472 0.55 0.94 0.36 167 THIS_AD 1471 0.48 0.94 0.25 168 TooManyTo_002 1463 2.01 0.93 2.53 169 XM_B_DNDMA 1445 0.56 0.92 0.39 170 TR_XM_Base64_L1 1428 0.37 0.91 0.11 171 XMSubMetaI_00 1414 0.53 0.90 0.36 172 T_Symld_Words_02 1390 0.64 0.89 0.53 173 XM_UB99 1388 0.29 0.89 0.00 174 TM2_M_OBFU_COMMENT 1378 0.48 0.88 0.28 175 TooManyTo_003 1363 1.29 0.87 1.50 176 REMOVE_BEFORE_LINK 1340 0.40 0.86 0.17 177 XMPhish14 1317 0.52 0.84 0.36 178 REPLYTO_WITHOUT_TO_CC 1314 0.29 0.84 0.02 179 XMHTML_After_End 1307 0.79 0.83 0.77 180 PDS_OTHER_BAD_TLD 1300 0.34 0.83 0.10 181 TooManyTo_004 1280 0.97 0.82 1.04 182 XMBody_78 1262 0.48 0.81 0.32 183 DKIM_ADSP_CUSTOM_MED 1260 0.85 0.80 0.87 184 MPART_ALT_DIFF_COUNT 1243 0.68 0.79 0.62 185 RCVD_IN_VALIDITY_RPBL 1237 0.29 0.79 0.05 186 TooManyTo_005 1231 0.84 0.79 0.86 187 T_MONEY_PERCENT 1230 0.50 0.79 0.36 188 TR_LOTS_OF_MONEY2 1230 0.50 0.79 0.36 189 XM_H_Long_From02 1210 1.00 0.77 1.12 190 RCVD_IN_IADB_VOUCHED 1205 2.27 0.77 3.00 191 T_TooManySym_02 1196 2.04 0.76 2.66 192 XMClaimOffer 1191 0.30 0.76 0.07 193 TM2_M_BODY_EMPTY 1180 0.53 0.75 0.41 194 HOSTED_IMG_MULTI_PUB_01 1174 0.25 0.75 0.01 195 DIET_1 1166 0.52 0.74 0.40 196 TVD_RCVD_IP 1162 1.32 0.74 1.61 197 HELO_NODOT 1147 1.37 0.73 1.68 198 XM_B_COVIDMETA 1146 0.44 0.73 0.30 199 HELO_NO_DOMAIN 1145 1.36 0.73 1.67 200 HTML_FONT_FACE_BAD 1145 0.52 0.73 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 273047 88.80 96.06 85.25 2 T_SCC_BODY_TEXT_LINE 266675 82.58 81.17 83.26 3 RELAYCOUNTRY_US 260162 81.00 80.52 81.23 4 DKIM_SIGNED 239357 80.29 91.66 74.73 5 XM_DK_Pass 234930 78.25 88.27 73.35 6 DKIM_VALID 231995 77.12 86.71 72.44 7 XM_B_Unicode 222522 74.87 85.90 69.48 8 DCC_CHECK_NEGATIVE 213828 53.76 27.17 66.76 9 BAYES_50 190607 52.08 36.87 59.51 10 DKIM_VALID_AU 184875 59.75 63.90 57.72 11 XMListUnsubscribeExists 160891 57.63 72.74 50.24 12 XM_B_SpammyWords 140834 53.22 72.13 43.97 13 XM_B_Unicode3 129511 42.50 46.71 40.44 14 DCC_CHECK 106320 46.21 72.82 33.20 15 DKIM_VALID_EF 92421 30.04 32.47 28.86 16 T_TM2_M_HEADER_IN_MSG 90755 26.36 22.33 28.34 17 HTML_FONT_LOW_CONTRAST 89636 30.45 35.48 27.99 18 FVGT_m_MULTI_ODD 81253 27.29 31.22 25.37 19 LOC_TINY_FONT_1 80621 30.12 40.23 25.17 20 RCVD_IN_MSPIKE_H2 77219 24.60 25.61 24.11 21 XMSubLong 73368 22.70 22.28 22.91 22 T_KAM_HTML_FONT_INVALID 67680 24.21 30.52 21.13 23 MIME_HTML_ONLY 62961 24.06 33.06 19.66 24 XM_B_SpammyWords2 58787 25.86 41.22 18.36 25 ALL_TRUSTED 50539 10.95 1.08 15.78 26 XM_Multi_Part_URI 44946 15.86 19.60 14.03 27 TR_XM_DK_Unsub 44535 17.36 24.44 13.91 28 USER_IN_DEF_DKIM_WL 39205 9.44 3.72 12.24 29 UNPARSEABLE_RELAY 32798 11.82 15.04 10.24 30 BAYES_00 30938 6.67 0.56 9.66 31 BAYES_60 29678 8.73 7.63 9.27 32 LotsOfNums_01 28490 8.30 7.08 8.90 33 TooManyTo_001 27559 7.53 5.35 8.60 34 XM_DKIMWhitelistDomains 27143 5.74 0.15 8.47 35 XM_B_Unsub 26421 10.83 16.11 8.25 36 XM_Evil_Numbers_Gen 24892 8.38 9.62 7.77 37 TR_MAX_INTL_RELAY 22710 18.99 43.31 7.09 38 TR_XM_DK_Bayes 22171 4.79 0.42 6.92 39 TR_XM_DK_Bayes1 21933 4.74 0.42 6.85 40 IN_ZIMBRA_NJ_WHITELIST 21845 4.61 0.09 6.82 41 LOTS_OF_MONEY 21449 8.54 12.31 6.70 42 TR_XM_BayesUnsub 20938 9.50 15.55 6.54 43 RCVD_IN_MSPIKE_WL 20620 7.55 9.81 6.44 44 RCVD_IN_MSPIKE_H3 20620 7.55 9.81 6.44 45 XM_H_GMP 20422 5.65 4.16 6.38 46 TR_XM_DK_Bayes2 19099 4.10 0.28 5.96 47 XM_DK_Undo_02 18990 19.49 47.22 5.93 48 HTML_IMAGE_RATIO_02 17943 6.23 7.52 5.60 49 XM_H_Long_From01 17727 5.49 5.39 5.53 50 T_TooManySym_01 17275 4.34 2.17 5.39 51 MIME_QP_LONG_LINE 17220 4.57 2.93 5.38 52 BAYES_99 15872 15.46 36.93 4.96 53 RCVD_IN_IADB_LISTED 15736 3.84 1.65 4.91 54 TR_XM_SpammyWords4 15436 6.91 11.19 4.82 55 BOTNET_IPINHOSTNAME 15237 7.60 13.41 4.76 56 RCVD_IN_VALIDITY_SAFE 14876 4.20 3.29 4.64 57 HTML_IMAGE_RATIO_04 14771 4.99 5.75 4.61 58 BAYES_40 14661 3.56 1.47 4.58 59 ANY_BOUNCE_MESSAGE 14455 3.48 1.37 4.51 60 BOUNCE_MESSAGE 14454 3.48 1.37 4.51 61 RCVD_IN_IADB_SPF 13864 3.38 1.43 4.33 62 XMSubMetaSx_00 13857 4.80 5.77 4.33 63 XMStrtUSub 13406 4.21 4.25 4.19 64 BAYES_80 13200 5.54 8.43 4.12 65 XM_PDF 13098 2.91 0.49 4.09 66 XM_B_SpammyWords3 13052 7.04 13.09 4.08 67 MPART_ALT_DIFF 12905 4.79 6.36 4.03 68 BAYES_999 12781 12.29 29.26 3.99 69 XM_Body_Dirty_Words 12669 5.82 9.64 3.96 70 RCVD_IN_VALIDITY_CERTIFIED 12514 3.52 2.73 3.91 71 XM_UncommonTLD01 12479 4.87 6.85 3.90 72 RCVD_IN_IADB_SENDERID 12477 3.04 1.29 3.90 73 RCVD_IN_IADB_DK 12091 2.98 1.35 3.78 74 RELAYCOUNTRY_META 12026 9.23 20.44 3.75 75 T_REMOTE_IMAGE 11405 2.93 1.63 3.56 76 FSL_BULK_SIG 10885 4.82 7.71 3.40 77 BAYES_20 10467 2.60 1.24 3.27 78 XM_B_Phish_Phrases 9815 3.54 4.52 3.06 79 RCVD_IN_IADB_VOUCHED 9612 2.27 0.77 3.00 80 XM_SPF_SoftFail 9141 3.36 4.39 2.85 81 XM_B_SpammyTLD 8764 3.21 4.18 2.74 82 T_TooManySym_02 8517 2.04 0.76 2.66 83 MAILING_LIST_MULTI 8510 2.28 1.50 2.66 84 SCC_BODY_URI_ONLY 8508 2.25 1.41 2.66 85 XMNumbers 8282 3.17 4.38 2.59 86 TooManyTo_002 8118 2.01 0.93 2.53 87 BAYES_05 8039 1.91 0.69 2.51 88 HTML_IMAGE_RATIO_06 7785 2.88 3.80 2.43 89 MIME_HTML_ONLY_MULTI 7743 2.89 3.85 2.42 90 TR_XM_DKIM_Undo 7651 13.33 35.69 2.39 91 MIME_HTML_MOSTLY 7508 2.97 4.24 2.34 92 DKIM_INVALID 7362 3.17 4.95 2.30 93 HTML_IMAGE_RATIO_08 7148 2.49 3.01 2.23 94 INVALID_MSGID 7080 1.55 0.19 2.21 95 TM2_M_URI_OPT_OUT 7018 2.75 3.89 2.19 96 BAYES_95 6812 3.46 6.18 2.13 97 TR_XM_SpammyRelay 6763 6.92 16.76 2.11 98 T_XMDrugObfuBody_14 6646 2.79 4.24 2.08 99 XM_CamelCaseFrm001 6592 2.24 2.62 2.06 100 RCVD_IN_IADB_OPTIN 6508 1.54 0.53 2.03 101 HTML_MIME_NO_HTML_TAG 6460 1.82 1.43 2.02 102 TO_MALFORMED 6304 1.33 0.03 1.97 103 FROM_EXCESS_BASE64 6141 2.21 2.80 1.92 104 XM_DK_Undo_01 5918 1.83 1.78 1.85 105 TR_XM_UnparsRelay 5667 3.69 7.63 1.77 106 XM_B_Investor 5583 2.59 4.32 1.74 107 XMGappySubj_01 5522 1.22 0.19 1.72 108 URI_NOVOWEL 5493 1.49 1.02 1.72 109 HELO_NODOT 5365 1.37 0.73 1.68 110 HELO_NO_DOMAIN 5357 1.36 0.73 1.67 111 TR_XM_PhishingBody 5278 2.37 3.86 1.65 112 TVD_RCVD_IP 5142 1.32 0.74 1.61 113 TR_DCC_Bayes_99 4943 9.75 26.53 1.54 114 XMSexyCombo_05 4900 2.67 5.00 1.53 115 TR_Symld_Words 4899 1.38 1.07 1.53 116 IN_HORDE_ADDRESS_BOOK 4892 1.05 0.07 1.53 117 TooManyTo_003 4798 1.29 0.87 1.50 118 XM_SendGrid 4687 1.56 1.76 1.46 119 T_XMDrugObfuBody_08 4636 1.90 2.83 1.45 120 UNTRUSTED_Relay 4603 2.73 5.37 1.44 121 SUBJ_ALL_CAPS 4601 1.87 2.74 1.44 122 BOTNET 4347 3.91 9.12 1.36 123 TM2_M_VERY_LONG_WORD 4239 1.80 2.79 1.32 124 XMDiploma_00 4236 1.85 2.92 1.32 125 XMBSHREFv2 4195 0.98 0.31 1.31 126 XM_OfRef6 4101 2.13 3.87 1.28 127 TR_XM_SpammyWords5 3975 2.28 4.42 1.24 128 XMStockSpam_06 3926 1.42 1.83 1.23 129 XM_B_Unsub2 3920 1.49 2.04 1.22 130 XM_H_Trusted_IP 3853 0.81 0.00 1.20 131 XM_GoogleGroups 3851 0.98 0.52 1.20 132 TVD_SPACE_RATIO 3833 0.86 0.17 1.20 133 XMBody_95 3720 0.83 0.15 1.16 134 XM_H_Long_From02 3572 1.00 0.77 1.12 135 XMGappySubj_02 3447 0.74 0.06 1.08 136 XMCapTrack 3350 0.82 0.35 1.05 137 TooManyTo_004 3346 0.97 0.82 1.04 138 RELAYCOUNTRY_CA 3305 4.47 11.51 1.03 139 KHOP_HELO_FCRDNS 3271 1.24 1.68 1.02 140 URI_HEX 3096 1.21 1.70 0.97 141 TR_XM_DK_SendGrid 3045 1.04 1.21 0.95 142 T_TooManySym_03 3019 0.74 0.32 0.94 143 RCVD_IN_RP_SAFE 2950 0.83 0.65 0.92 144 XMSubNoVowel 2837 0.71 0.36 0.89 145 FROM_GOV_DKIM_AU 2799 0.63 0.13 0.87 146 DKIM_ADSP_CUSTOM_MED 2795 0.85 0.80 0.87 147 TooManyTo_005 2752 0.84 0.79 0.86 148 XM_UB50 2693 1.37 2.46 0.84 149 T_FILL_THIS_FORM_SHORT 2613 2.37 5.55 0.82 150 XMHTML_After_End 2481 0.79 0.83 0.77 151 RCVD_IN_RP_CERTIFIED 2464 0.70 0.55 0.77 152 SpammyFromTLD_01 2423 1.73 3.71 0.76 153 HTTPS_HTTP_MISMATCH 2416 0.86 1.07 0.75 154 MSGID_NOFQDN1 2350 0.50 0.02 0.73 155 XM_H_PHPMailer 2327 0.85 1.11 0.73 156 RELAYCOUNTRY_AU 2324 1.36 2.67 0.73 157 XM_ShortIntro_01 2274 0.61 0.41 0.71 158 TR_MetaPhish_Combo_01 2269 0.94 1.41 0.71 159 RCVD_IN_BL_SPAMCOP_NET 2266 5.30 14.69 0.71 160 T_XMHurry_00 2249 1.05 1.77 0.70 161 URI_TRY_3LD 2248 0.88 1.24 0.70 162 XMGenDplmaNmb 2203 0.96 1.53 0.69 163 XM_ProductURIs 2192 0.83 1.12 0.68 164 USER_IN_WHITELIST 2110 0.44 0.00 0.66 165 USER_IN_WELCOMELIST 2110 0.44 0.00 0.66 166 TO_NO_BRKTS_HTML_ONLY 2082 0.48 0.13 0.65 167 T_XMDrugObfuBody_00 2070 0.96 1.61 0.65 168 XM_B_COPY_HTML 2002 0.94 1.58 0.63 169 LOW_PRICE 1995 0.56 0.44 0.62 170 MPART_ALT_DIFF_COUNT 1984 0.68 0.79 0.62 171 XMPhish30 1958 0.89 1.47 0.61 172 TVD_SPACE_RATIO_MINFP 1928 0.44 0.12 0.60 173 T_OBFU_PDF_ATTACH 1867 0.42 0.10 0.58 174 SpammyFromTLD_02 1813 0.90 1.59 0.57 175 TR_XM_Base64_M1 1809 0.84 1.41 0.56 176 XMBdyGiftCard01 1807 0.92 1.66 0.56 177 PLING_QUERY 1775 0.56 0.59 0.55 178 FILL_THIS_FORM 1741 0.47 0.31 0.54 179 XMBody_17 1736 2.59 6.78 0.54 180 SHORT_HELO_AND_INLINE_IMAGE 1722 0.38 0.05 0.54 181 XMBrknScrpt_02 1701 0.71 1.07 0.53 182 T_Symld_Words_02 1683 0.64 0.89 0.53 183 NML_ADSP_CUSTOM_MED 1658 0.54 0.58 0.52 184 FORGED_GMAIL_RCVD 1638 0.54 0.61 0.51 185 XMNoVowels 1614 0.51 0.54 0.50 186 RELAYCOUNTRY_GB 1600 0.52 0.56 0.50 187 XM_B_FormFill 1571 0.34 0.04 0.49 188 XMSubMetaSxObfu_02 1569 0.47 0.43 0.49 189 TR_XM_SpammyWords2 1453 5.01 14.33 0.45 190 XM_B_SpammyWords4 1415 1.01 2.19 0.44 191 HTML_IMAGE_ONLY_20 1406 0.42 0.39 0.44 192 XMDateMe_00 1395 0.39 0.30 0.44 193 XMSubMetaSxObfu_03 1374 0.49 0.61 0.43 194 HTML_IMAGE_ONLY_28 1363 0.38 0.27 0.43 195 TR_XM_PHPForged 1349 1.23 2.88 0.42 196 TR_XM_PHPDW 1345 1.23 2.89 0.42 197 MSGID_FROM_MTA_HEADER 1334 0.31 0.09 0.42 198 HTML_IMAGE_ONLY_24 1326 0.35 0.21 0.41 199 TR_XM_FormFill2 1326 1.21 2.83 0.41 200 TM2_M_BODY_EMPTY 1324 0.53 0.75 0.41 ----------------------------------------------------------------------