Email: 482820 Autolearn: 0 AvgScore: 4.00 AvgScanTime: 1.43 sec Spam: 154083 Autolearn: 0 AvgScore: 13.33 AvgScanTime: 1.54 sec Ham: 328737 Autolearn: 0 AvgScore: -0.38 AvgScanTime: 1.38 sec Time Spent Running SA: 191.78 hours Time Spent Processing Spam: 65.80 hours Time Spent Processing Ham: 125.98 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146216 88.73 94.89 85.85 2 DKIM_SIGNED 141919 80.53 92.11 75.11 3 XM_DK_Pass 137260 78.61 89.08 73.70 4 DKIM_VALID 135836 77.72 88.16 72.83 5 XM_B_Unicode 130633 75.39 84.78 70.99 6 RELAYCOUNTRY_US 123593 80.75 80.21 81.00 7 T_SCC_BODY_TEXT_LINE 122899 82.25 79.76 83.41 8 XMListUnsubscribeExists 112772 58.57 73.19 51.71 9 XM_B_SpammyWords 111893 54.07 72.62 45.37 10 DCC_CHECK 110409 47.04 71.66 35.51 11 DKIM_VALID_AU 101143 60.98 65.64 58.80 12 XM_DK_Undo_02 68808 18.50 44.66 6.23 13 XM_B_Unicode3 68691 42.65 44.58 41.75 14 XM_B_SpammyWords2 66926 27.26 43.44 19.68 15 LOC_TINY_FONT_1 60440 29.54 39.23 24.99 16 BAYES_50 59624 52.33 38.70 58.72 17 HTML_FONT_LOW_CONTRAST 55644 31.16 36.11 28.85 18 TR_XM_DKIM_Undo 53520 12.82 34.73 2.55 19 BAYES_99 51935 14.51 33.71 5.52 20 DKIM_VALID_EF 50732 29.79 32.93 28.33 21 MIME_HTML_ONLY 49592 23.30 32.19 19.14 22 FVGT_m_MULTI_ODD 48463 28.34 31.45 26.88 23 T_KAM_HTML_FONT_INVALID 45473 23.45 29.51 20.61 24 DCC_CHECK_NEGATIVE 43654 52.93 28.33 64.45 25 BAYES_999 40342 11.40 26.18 4.47 26 RCVD_IN_MSPIKE_H2 39709 24.72 25.77 24.22 27 TR_XM_DK_Unsub 37554 17.25 24.37 13.91 28 TR_DCC_Bayes_99 37009 8.79 24.02 1.66 29 XMSubLong 36477 23.45 23.67 23.34 30 T_TM2_M_HEADER_IN_MSG 35727 26.33 23.19 27.80 31 XM_Multi_Part_URI 30742 15.56 19.95 13.50 32 RELAYCOUNTRY_META 29864 9.04 19.38 4.19 33 XM_B_Unsub 24898 10.56 16.16 7.93 34 TR_XM_SpammyRelay 24451 6.60 15.87 2.26 35 TR_XM_BayesUnsub 23999 9.28 15.58 6.33 36 TR_MAX_INTL_RELAY 22882 9.21 14.85 6.56 37 UNPARSEABLE_RELAY 21823 11.29 14.16 9.95 38 LOTS_OF_MONEY 21490 8.62 13.95 6.12 39 TR_XM_SpammyWords2 21474 4.98 13.94 0.78 40 BOTNET_IPINHOSTNAME 21320 7.89 13.84 5.10 41 RCVD_IN_BL_SPAMCOP_NET 21286 4.97 13.81 0.82 42 XM_B_SpammyWords3 20174 7.00 13.09 4.15 43 TR_XM_SpammyWords4 19542 6.95 12.68 4.27 44 XM_Body_Dirty_Words 17397 7.05 11.29 5.07 45 TR_XM_SPAMCOP 17241 3.84 11.19 0.39 46 RELAYCOUNTRY_CA 16998 4.28 11.03 1.11 47 RCVD_IN_MSPIKE_WL 14343 7.14 9.31 6.12 48 RCVD_IN_MSPIKE_H3 14343 7.14 9.31 6.12 49 BAYES_80 14156 5.65 9.19 3.99 50 XM_Evil_Numbers_Gen 13839 8.62 8.98 8.45 51 BOTNET 13778 3.80 8.94 1.38 52 FSL_BULK_SIG 11818 5.50 7.67 4.49 53 BAYES_60 11606 8.80 7.53 9.39 54 XMBody_17 11470 2.90 7.44 0.76 55 TR_XM_UnparsRelay 11124 3.25 7.22 1.39 56 LotsOfNums_01 11036 8.20 7.16 8.69 57 XM_UncommonTLD01 10847 4.77 7.04 3.71 58 HTML_IMAGE_RATIO_02 10642 5.52 6.91 4.86 59 XMSubMetaSx_00 9861 5.52 6.40 5.10 60 MPART_ALT_DIFF 9685 4.92 6.29 4.28 61 TooManyTo_001 8988 7.48 5.83 8.26 62 HTML_IMAGE_RATIO_04 8539 4.94 5.54 4.66 63 UNTRUSTED_Relay 8443 2.87 5.48 1.65 64 XMSexyCombo_05 8325 3.07 5.40 1.97 65 BAYES_95 8251 3.46 5.35 2.57 66 XMNumbers 7571 3.28 4.91 2.52 67 XM_OfRef6 7349 2.38 4.77 1.26 68 XM_SPF_SoftFail 7341 3.55 4.76 2.98 69 XM_H_Long_From01 7281 5.24 4.73 5.48 70 XM_B_Investor 7118 2.59 4.62 1.64 71 XM_B_Phish_Phrases 6997 3.55 4.54 3.08 72 T_FILL_THIS_FORM_SHORT 6672 2.04 4.33 0.97 73 T_XMDrugObfuBody_08 6589 2.61 4.28 1.83 74 SpammyFromTLD_01 6381 1.85 4.14 0.78 75 TR_XM_PhishingBody 6275 2.59 4.07 1.89 76 TR_XM_PHPForged 6092 1.54 3.95 0.40 77 DKIM_INVALID 6083 2.81 3.95 2.28 78 TR_XM_PHPDW 6064 1.53 3.94 0.41 79 TR_XM_SpammyWords5 6022 2.08 3.91 1.22 80 XM_H_GMP 6006 5.59 3.90 6.38 81 XM_B_SpammyTLD 5996 3.08 3.89 2.70 82 TR_XM_FormFill2 5982 1.51 3.88 0.40 83 XM_H_PHPOS 5967 1.50 3.87 0.39 84 MIME_HTML_MOSTLY 5884 2.80 3.82 2.32 85 T_XMDrugObfuBody_14 5852 2.33 3.80 1.64 86 HTML_IMAGE_RATIO_06 5744 2.97 3.73 2.61 87 XMStrtUSub 5351 4.08 3.47 4.37 88 MIME_HTML_ONLY_MULTI 5322 2.90 3.45 2.65 89 TR_LOTS_OF_MONEY3 5059 1.24 3.28 0.28 90 FONT_INVIS_LONG_LINE 5011 1.06 3.25 0.04 91 TR_XM_BayesRelay 4854 1.01 3.15 0.00 92 HTML_IMAGE_RATIO_08 4838 2.83 3.14 2.68 93 MIME_QP_LONG_LINE 4787 4.60 3.11 5.30 94 XM_UB50 4604 1.63 2.99 0.99 95 TM2_M_URI_OPT_OUT 4476 2.35 2.90 2.09 96 TR_XM_FormFill 4370 0.91 2.84 0.01 97 SCC_BODY_URI_ONLY 4225 2.62 2.74 2.56 98 XMDiploma_00 4149 2.32 2.69 2.14 99 XM_URI_RBL 4088 0.97 2.65 0.18 100 TM2_M_VERY_LONG_WORD 4059 1.74 2.63 1.31 101 XM_CamelCaseFrm001 4044 2.21 2.62 2.01 102 RCVD_IN_VALIDITY_SAFE 4014 4.04 2.61 4.71 103 USER_IN_DEF_DKIM_WL 3886 9.34 2.52 12.54 104 T_TooManySym_01 3825 4.35 2.48 5.23 105 RELAYCOUNTRY_AU 3810 1.44 2.47 0.96 106 FROM_EXCESS_BASE64 3706 2.09 2.41 1.94 107 SUBJ_ALL_CAPS 3619 1.86 2.35 1.64 108 XM_B_Unsub2 3578 1.82 2.32 1.59 109 RCVD_IN_VALIDITY_CERTIFIED 3290 3.33 2.14 3.88 110 T_XMHurry_00 3210 1.05 2.08 0.57 111 T_REMOTE_IMAGE 3202 3.06 2.08 3.52 112 XM_B_SpammyWords4 3059 0.98 1.99 0.51 113 TM2_M_BODY_EMPTY 3031 0.89 1.97 0.38 114 BAYES_40 2966 3.59 1.92 4.37 115 XMStockSpam_06 2956 1.49 1.92 1.29 116 XMEmptyBody_01 2938 0.65 1.91 0.06 117 TR_XM_NoHeaderRelay 2930 0.70 1.90 0.13 118 URI_TRY_3LD 2900 1.23 1.88 0.92 119 BAYES_20 2894 2.79 1.88 3.22 120 HK_RANDOM_REPLYTO 2713 0.62 1.76 0.08 121 XM_DK_Undo_01 2645 1.77 1.72 1.80 122 XM_DIRTYINTL 2586 0.68 1.68 0.21 123 RCVD_IN_IADB_LISTED 2468 3.59 1.60 4.52 124 ANY_BOUNCE_MESSAGE 2451 3.70 1.59 4.68 125 BOUNCE_MESSAGE 2447 3.70 1.59 4.68 126 AC_BR_BONANZA 2439 0.59 1.58 0.12 127 RCVD_IN_PSBL 2336 0.71 1.52 0.33 128 XM_HighProb1 2322 0.48 1.51 0.00 129 HTML_MIME_NO_HTML_TAG 2280 1.78 1.48 1.92 130 URI_HEX 2242 1.26 1.46 1.17 131 HTTPS_HTTP_MISMATCH 2241 0.97 1.45 0.75 132 XM_SendGrid 2224 1.29 1.44 1.21 133 SpammyFromTLD_02 2211 0.81 1.43 0.52 134 HTML_TAG_BALANCE_BODY 2206 0.77 1.43 0.45 135 T_XMDrugObfuBody_00 2184 0.82 1.42 0.53 136 RCVD_IN_IADB_SPF 2168 3.19 1.41 4.03 137 XMBrknScrpt_02 2155 0.94 1.40 0.73 138 MAILING_LIST_MULTI 2149 2.27 1.39 2.69 139 TR_Mismatch_TLD_02 2147 0.49 1.39 0.07 140 XM_B_COPY_HTML 2136 0.98 1.39 0.79 141 URIBL_DBL_SPAM 2114 0.44 1.37 0.01 142 RCVD_IN_IADB_DK 2062 2.84 1.34 3.54 143 RCVD_IN_IADB_SENDERID 2043 2.91 1.33 3.65 144 XMGenDplmaNmb 2022 1.27 1.31 1.25 145 BOTNET_NORDNS 2012 0.43 1.31 0.01 146 XM_B_Phish66 2011 0.74 1.31 0.48 147 XMPhish30 1963 0.91 1.27 0.74 148 TR_MetaPhish_Combo_01 1865 0.82 1.21 0.63 149 TR_XM_INV_DKIM 1858 0.42 1.21 0.06 150 XMReplyNow 1830 0.53 1.19 0.22 151 ALL_TRUSTED 1797 11.09 1.17 15.74 152 XM_H_PHPMailer 1790 0.85 1.16 0.70 153 THIS_AD 1783 0.63 1.16 0.38 154 XMBdyGiftCard01 1735 0.76 1.13 0.59 155 RCVD_IN_VALIDITY_RPBL 1721 0.46 1.12 0.15 156 KHOP_HELO_FCRDNS 1665 1.05 1.08 1.04 157 XMBody_78 1620 0.58 1.05 0.35 158 TR_XM_Base64_M1 1610 0.85 1.04 0.76 159 XMSexyCombo_01 1556 0.94 1.01 0.91 160 TR_XM_DK_SendGrid 1517 0.85 0.98 0.78 161 DKIM_ADSP_CUSTOM_MED 1511 0.99 0.98 1.00 162 SHOPIFY_IMG_NOT_RCVD_SFY 1495 0.51 0.97 0.29 163 TR_Symld_Words 1474 1.31 0.96 1.47 164 URG_BIZ 1457 0.34 0.95 0.06 165 T_MONEY_PERCENT 1446 0.45 0.94 0.22 166 TR_LOTS_OF_MONEY2 1446 0.45 0.94 0.22 167 XMSubMetaI_00 1442 0.62 0.94 0.48 168 PDS_OTHER_BAD_TLD 1435 0.37 0.93 0.11 169 TR_Caps_n_Bayes_99 1431 0.30 0.93 0.01 170 RDNS_DYNAMIC 1430 0.60 0.93 0.45 171 TooManyTo_002 1413 1.93 0.92 2.40 172 BAYES_05 1397 2.05 0.91 2.59 173 TM2_M_OBFU_COMMENT 1385 0.48 0.90 0.28 174 MPART_ALT_DIFF_COUNT 1349 0.62 0.88 0.49 175 URI_NOVOWEL 1347 1.33 0.87 1.54 176 XM_H_Undi_Recip 1346 0.40 0.87 0.18 177 XMPhish14 1343 0.55 0.87 0.40 178 XM_UB99 1341 0.28 0.87 0.00 179 HTML_FONT_FACE_BAD 1310 0.61 0.85 0.50 180 XMSubMetaSxObfu_03 1287 0.75 0.84 0.71 181 XMHTML_After_End 1284 0.85 0.83 0.85 182 XM_B_DNDMA 1278 0.47 0.83 0.30 183 TR_XM_InvalidRelay 1271 0.28 0.82 0.03 184 FORGED_GMAIL_RCVD 1268 0.71 0.82 0.66 185 BAYES_00 1252 6.82 0.81 9.64 186 TooManyTo_003 1250 1.17 0.81 1.34 187 XM_H_Long_From02 1238 0.94 0.80 1.01 188 XM_ProductURIs 1226 0.65 0.80 0.58 189 XM_B_COVIDMETA 1214 0.37 0.79 0.17 190 TM2_M_A_HREF_HREF 1187 0.36 0.77 0.16 191 TooManyTo_004 1175 0.92 0.76 0.99 192 TVD_RCVD_IP 1163 1.38 0.75 1.67 193 PLING_QUERY 1130 0.52 0.73 0.41 194 TooManyTo_005 1125 0.79 0.73 0.81 195 T_Symld_Words_02 1114 0.63 0.72 0.58 196 T_XMDrugObfuBody_10 1077 0.24 0.70 0.03 197 TR_XM_Base64_L1 1075 0.32 0.70 0.14 198 T_TooManySym_02 1070 2.01 0.69 2.63 199 HELO_DYNAMIC_SPLIT_IP 1040 0.22 0.67 0.01 200 NML_ADSP_CUSTOM_MED 1028 0.64 0.67 0.63 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 282206 88.73 94.89 85.85 2 T_SCC_BODY_TEXT_LINE 274203 82.25 79.76 83.41 3 RELAYCOUNTRY_US 266265 80.75 80.21 81.00 4 DKIM_SIGNED 246920 80.53 92.11 75.11 5 XM_DK_Pass 242282 78.61 89.08 73.70 6 DKIM_VALID 239422 77.72 88.16 72.83 7 XM_B_Unicode 233359 75.39 84.78 70.99 8 DCC_CHECK_NEGATIVE 211881 52.93 28.33 64.45 9 DKIM_VALID_AU 193285 60.98 65.64 58.80 10 BAYES_50 193023 52.33 38.70 58.72 11 XMListUnsubscribeExists 170001 58.57 73.19 51.71 12 XM_B_SpammyWords 149148 54.07 72.62 45.37 13 XM_B_Unicode3 137234 42.65 44.58 41.75 14 DCC_CHECK 116728 47.04 71.66 35.51 15 HTML_FONT_LOW_CONTRAST 94826 31.16 36.11 28.85 16 DKIM_VALID_EF 93115 29.79 32.93 28.33 17 T_TM2_M_HEADER_IN_MSG 91387 26.33 23.19 27.80 18 FVGT_m_MULTI_ODD 88361 28.34 31.45 26.88 19 LOC_TINY_FONT_1 82165 29.54 39.23 24.99 20 RCVD_IN_MSPIKE_H2 79625 24.72 25.77 24.22 21 XMSubLong 76740 23.45 23.67 23.34 22 T_KAM_HTML_FONT_INVALID 67745 23.45 29.51 20.61 23 XM_B_SpammyWords2 64696 27.26 43.44 19.68 24 MIME_HTML_ONLY 62911 23.30 32.19 19.14 25 ALL_TRUSTED 51741 11.09 1.17 15.74 26 TR_XM_DK_Unsub 45711 17.25 24.37 13.91 27 XM_Multi_Part_URI 44381 15.56 19.95 13.50 28 USER_IN_DEF_DKIM_WL 41217 9.34 2.52 12.54 29 UNPARSEABLE_RELAY 32701 11.29 14.16 9.95 30 BAYES_00 31694 6.82 0.81 9.64 31 BAYES_60 30867 8.80 7.53 9.39 32 XM_DKIMWhitelistDomains 29610 6.16 0.09 9.01 33 LotsOfNums_01 28579 8.20 7.16 8.69 34 XM_Evil_Numbers_Gen 27789 8.62 8.98 8.45 35 TooManyTo_001 27149 7.48 5.83 8.26 36 XM_B_Unsub 26084 10.56 16.16 7.93 37 TR_XM_DK_Bayes 23108 4.99 0.65 7.03 38 TR_XM_DK_Bayes1 22873 4.94 0.65 6.96 39 IN_ZIMBRA_NJ_WHITELIST 22746 4.73 0.07 6.92 40 TR_MAX_INTL_RELAY 21566 9.21 14.85 6.56 41 XM_H_GMP 20983 5.59 3.90 6.38 42 TR_XM_BayesUnsub 20816 9.28 15.58 6.33 43 XM_DK_Undo_02 20496 18.50 44.66 6.23 44 LOTS_OF_MONEY 20124 8.62 13.95 6.12 45 RCVD_IN_MSPIKE_WL 20122 7.14 9.31 6.12 46 RCVD_IN_MSPIKE_H3 20120 7.14 9.31 6.12 47 TR_XM_DK_Bayes2 19960 4.27 0.44 6.07 48 BAYES_99 18134 14.51 33.71 5.52 49 XM_H_Long_From01 18004 5.24 4.73 5.48 50 MIME_QP_LONG_LINE 17421 4.60 3.11 5.30 51 T_TooManySym_01 17195 4.35 2.48 5.23 52 XMSubMetaSx_00 16778 5.52 6.40 5.10 53 BOTNET_IPINHOSTNAME 16771 7.89 13.84 5.10 54 XM_Body_Dirty_Words 16665 7.05 11.29 5.07 55 HTML_IMAGE_RATIO_02 15993 5.52 6.91 4.86 56 RCVD_IN_VALIDITY_SAFE 15472 4.04 2.61 4.71 57 ANY_BOUNCE_MESSAGE 15401 3.70 1.59 4.68 58 BOUNCE_MESSAGE 15395 3.70 1.59 4.68 59 HTML_IMAGE_RATIO_04 15333 4.94 5.54 4.66 60 RCVD_IN_IADB_LISTED 14866 3.59 1.60 4.52 61 FSL_BULK_SIG 14759 5.50 7.67 4.49 62 BAYES_999 14686 11.40 26.18 4.47 63 BAYES_40 14378 3.59 1.92 4.37 64 XMStrtUSub 14361 4.08 3.47 4.37 65 MPART_ALT_DIFF 14065 4.92 6.29 4.28 66 TR_XM_SpammyWords4 14028 6.95 12.68 4.27 67 RELAYCOUNTRY_META 13788 9.04 19.38 4.19 68 XM_B_SpammyWords3 13644 7.00 13.09 4.15 69 XM_PDF 13268 2.89 0.45 4.04 70 RCVD_IN_IADB_SPF 13255 3.19 1.41 4.03 71 BAYES_80 13103 5.65 9.19 3.99 72 RCVD_IN_VALIDITY_CERTIFIED 12768 3.33 2.14 3.88 73 XM_UncommonTLD01 12205 4.77 7.04 3.71 74 RCVD_IN_IADB_SENDERID 12012 2.91 1.33 3.65 75 RCVD_IN_IADB_DK 11651 2.84 1.34 3.54 76 T_REMOTE_IMAGE 11582 3.06 2.08 3.52 77 BAYES_20 10571 2.79 1.88 3.22 78 XM_B_Phish_Phrases 10128 3.55 4.54 3.08 79 XM_SPF_SoftFail 9787 3.55 4.76 2.98 80 RCVD_IN_IADB_VOUCHED 8987 2.07 0.65 2.73 81 XM_B_SpammyTLD 8861 3.08 3.89 2.70 82 MAILING_LIST_MULTI 8828 2.27 1.39 2.69 83 HTML_IMAGE_RATIO_08 8819 2.83 3.14 2.68 84 MIME_HTML_ONLY_MULTI 8700 2.90 3.45 2.65 85 T_TooManySym_02 8634 2.01 0.69 2.63 86 HTML_IMAGE_RATIO_06 8589 2.97 3.73 2.61 87 BAYES_05 8517 2.05 0.91 2.59 88 BAYES_95 8450 3.46 5.35 2.57 89 SCC_BODY_URI_ONLY 8423 2.62 2.74 2.56 90 TR_XM_DKIM_Undo 8370 12.82 34.73 2.55 91 XMNumbers 8274 3.28 4.91 2.52 92 TooManyTo_002 7895 1.93 0.92 2.40 93 MIME_HTML_MOSTLY 7611 2.80 3.82 2.32 94 DKIM_INVALID 7498 2.81 3.95 2.28 95 TR_XM_SpammyRelay 7439 6.60 15.87 2.26 96 INVALID_MSGID 7060 1.54 0.24 2.15 97 XMDiploma_00 7031 2.32 2.69 2.14 98 TM2_M_URI_OPT_OUT 6867 2.35 2.90 2.09 99 XM_CamelCaseFrm001 6607 2.21 2.62 2.01 100 XMSexyCombo_05 6481 3.07 5.40 1.97 101 TO_MALFORMED 6429 1.34 0.01 1.96 102 FROM_EXCESS_BASE64 6363 2.09 2.41 1.94 103 HTML_MIME_NO_HTML_TAG 6317 1.78 1.48 1.92 104 TR_XM_PhishingBody 6215 2.59 4.07 1.89 105 T_XMDrugObfuBody_08 6019 2.61 4.28 1.83 106 RCVD_IN_IADB_OPTIN 5954 1.36 0.40 1.81 107 XM_DK_Undo_01 5907 1.77 1.72 1.80 108 TVD_RCVD_IP 5495 1.38 0.75 1.67 109 TR_DCC_Bayes_99 5445 8.79 24.02 1.66 110 UNTRUSTED_Relay 5414 2.87 5.48 1.65 111 T_XMDrugObfuBody_14 5407 2.33 3.80 1.64 112 XM_B_Investor 5382 2.59 4.62 1.64 113 SUBJ_ALL_CAPS 5379 1.86 2.35 1.64 114 IN_HORDE_ADDRESS_BOOK 5236 1.11 0.08 1.59 115 XM_B_Unsub2 5214 1.82 2.32 1.59 116 HELO_NODOT 5150 1.27 0.64 1.57 117 HELO_NO_DOMAIN 5145 1.27 0.64 1.57 118 URI_NOVOWEL 5063 1.33 0.87 1.54 119 XMGappySubj_01 5061 1.09 0.12 1.54 120 TR_Symld_Words 4840 1.31 0.96 1.47 121 TR_XM_UnparsRelay 4585 3.25 7.22 1.39 122 BOTNET 4547 3.80 8.94 1.38 123 TooManyTo_003 4406 1.17 0.81 1.34 124 TM2_M_VERY_LONG_WORD 4321 1.74 2.63 1.31 125 XM_GoogleGroups 4302 1.06 0.52 1.31 126 XMStockSpam_06 4232 1.49 1.92 1.29 127 XMBSHREFv2 4208 0.95 0.24 1.28 128 XM_OfRef6 4137 2.38 4.77 1.26 129 XMGenDplmaNmb 4120 1.27 1.31 1.25 130 TR_XM_SpammyWords5 4010 2.08 3.91 1.22 131 XM_SendGrid 3994 1.29 1.44 1.21 132 XM_H_Trusted_IP 3886 0.80 0.00 1.18 133 URI_HEX 3837 1.26 1.46 1.17 134 TVD_SPACE_RATIO 3701 0.80 0.10 1.13 135 RELAYCOUNTRY_CA 3644 4.28 11.03 1.11 136 XMBody_95 3429 0.75 0.13 1.04 137 KHOP_HELO_FCRDNS 3414 1.05 1.08 1.04 138 XM_H_Long_From02 3311 0.94 0.80 1.01 139 DKIM_ADSP_CUSTOM_MED 3278 0.99 0.98 1.00 140 TooManyTo_004 3254 0.92 0.76 0.99 141 XM_UB50 3249 1.63 2.99 0.99 142 T_FILL_THIS_FORM_SHORT 3192 2.04 4.33 0.97 143 XMCapTrack 3167 0.78 0.38 0.96 144 RELAYCOUNTRY_AU 3161 1.44 2.47 0.96 145 RCVD_IN_RP_SAFE 3088 0.81 0.55 0.94 146 URI_TRY_3LD 3037 1.23 1.88 0.92 147 XMGappySubj_02 3032 0.65 0.06 0.92 148 T_TooManySym_03 3017 0.71 0.28 0.92 149 XMSexyCombo_01 2983 0.94 1.01 0.91 150 XMSubNoVowel 2801 0.69 0.36 0.85 151 XMHTML_After_End 2800 0.85 0.83 0.85 152 RCVD_IN_BL_SPAMCOP_NET 2708 4.97 13.81 0.82 153 TooManyTo_005 2679 0.79 0.73 0.81 154 FROM_GOV_DKIM_AU 2634 0.58 0.12 0.80 155 XM_B_COPY_HTML 2609 0.98 1.39 0.79 156 TR_XM_DK_SendGrid 2565 0.85 0.98 0.78 157 SpammyFromTLD_01 2563 1.85 4.14 0.78 158 TR_XM_SpammyWords2 2557 4.98 13.94 0.78 159 RCVD_IN_RP_CERTIFIED 2545 0.67 0.44 0.77 160 XMBody_17 2514 2.90 7.44 0.76 161 TR_XM_Base64_M1 2508 0.85 1.04 0.76 162 HTTPS_HTTP_MISMATCH 2451 0.97 1.45 0.75 163 XMPhish30 2445 0.91 1.27 0.74 164 XM_RXBody 2437 0.67 0.52 0.74 165 XMBrknScrpt_02 2401 0.94 1.40 0.73 166 XMSubMetaSxObfu_03 2335 0.75 0.84 0.71 167 XM_H_PHPMailer 2300 0.85 1.16 0.70 168 MSGID_NOFQDN1 2292 0.48 0.01 0.70 169 XMNoVowels 2214 0.59 0.40 0.67 170 FORGED_GMAIL_RCVD 2155 0.71 0.82 0.66 171 T_OBFU_PDF_ATTACH 2089 0.46 0.08 0.64 172 NML_ADSP_CUSTOM_MED 2083 0.64 0.67 0.63 173 TR_MetaPhish_Combo_01 2071 0.82 1.21 0.63 174 USER_IN_WELCOMELIST 2051 0.42 0.00 0.62 175 USER_IN_WHITELIST 2051 0.42 0.00 0.62 176 XMSexyCombo_04 1980 0.52 0.34 0.60 177 XM_ShortIntro_01 1952 0.54 0.42 0.59 178 XMBdyGiftCard01 1936 0.76 1.13 0.59 179 T_Symld_Words_02 1919 0.63 0.72 0.58 180 XM_ProductURIs 1905 0.65 0.80 0.58 181 T_XMHurry_00 1881 1.05 2.08 0.57 182 HTML_IMAGE_ONLY_28 1794 0.46 0.28 0.55 183 T_XMDrugObfuBody_00 1752 0.82 1.42 0.53 184 XM_B_FormFill 1734 0.41 0.17 0.53 185 FILL_THIS_FORM 1715 0.50 0.46 0.52 186 SpammyFromTLD_02 1703 0.81 1.43 0.52 187 XM_B_SpammyWords4 1680 0.98 1.99 0.51 188 HTML_FONT_FACE_BAD 1654 0.61 0.85 0.50 189 MPART_ALT_DIFF_COUNT 1624 0.62 0.88 0.49 190 TO_NO_BRKTS_HTML_ONLY 1591 0.40 0.22 0.48 191 SHORT_HELO_AND_INLINE_IMAGE 1582 0.34 0.03 0.48 192 XM_B_Phish66 1577 0.74 1.31 0.48 193 XMSubMetaI_00 1569 0.62 0.94 0.48 194 RELAYCOUNTRY_GB 1510 0.52 0.66 0.46 195 DIET_1 1507 0.52 0.65 0.46 196 HTML_IMAGE_ONLY_20 1497 0.42 0.34 0.46 197 HTML_TAG_BALANCE_BODY 1490 0.77 1.43 0.45 198 RDNS_DYNAMIC 1474 0.60 0.93 0.45 199 TR_Mismatch_TLD_01 1418 0.48 0.59 0.43 200 XMLngstWrd_00 1405 0.42 0.41 0.43 ----------------------------------------------------------------------