Email: 494986 Autolearn: 0 AvgScore: 3.60 AvgScanTime: 1.18 sec Spam: 144454 Autolearn: 0 AvgScore: 12.68 AvgScanTime: 1.36 sec Ham: 350532 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 1.11 sec Time Spent Running SA: 162.88 hours Time Spent Processing Spam: 54.46 hours Time Spent Processing Ham: 108.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139371 88.98 96.48 85.88 2 DKIM_SIGNED 131751 78.11 91.21 72.71 3 XM_DK_Pass 125948 75.98 87.19 71.37 4 DKIM_VALID 124869 75.05 86.44 70.36 5 RELAYCOUNTRY_US 123096 80.38 85.21 78.39 6 XM_B_Unicode 122001 72.75 84.46 67.93 7 T_SCC_BODY_TEXT_LINE 117087 82.63 81.05 83.28 8 DCC_CHECK 103527 44.84 71.67 33.79 9 XM_B_SpammyWords 102243 52.42 70.78 44.85 10 XMListUnsubscribeExists 102057 54.39 70.65 47.69 11 DKIM_VALID_AU 99802 59.81 69.09 55.98 12 XM_B_Unicode3 70338 42.03 48.69 39.29 13 LOC_TINY_FONT_1 61002 29.21 42.23 23.84 14 XM_B_SpammyWords2 60022 24.17 41.55 17.01 15 XM_DK_Undo_02 59268 16.01 41.03 5.71 16 BAYES_50 58153 54.07 40.26 59.77 17 HTML_FONT_LOW_CONTRAST 56116 30.50 38.85 27.06 18 FVGT_m_MULTI_ODD 51334 28.22 35.54 25.21 19 BAYES_99 48820 13.27 33.80 4.81 20 TR_XM_DKIM_Undo 42612 10.28 29.50 2.36 21 RCVD_IN_MSPIKE_H2 42562 26.27 29.46 24.96 22 T_KAM_HTML_FONT_INVALID 41529 22.46 28.75 19.87 23 DCC_CHECK_NEGATIVE 40900 55.13 28.31 66.18 24 DKIM_VALID_EF 40120 28.06 27.77 28.18 25 BAYES_999 38075 10.33 26.36 3.73 26 MIME_HTML_ONLY 37196 21.87 25.75 20.28 27 XMSubLong 35298 23.45 24.44 23.05 28 T_TM2_M_HEADER_IN_MSG 34208 27.03 23.68 28.40 29 TR_DCC_Bayes_99 33288 7.80 23.04 1.52 30 XM_Multi_Part_URI 30133 14.83 20.86 12.34 31 TR_XM_DK_Unsub 26930 14.70 18.64 13.07 32 XM_B_Unsub 25065 10.86 17.35 8.19 33 TR_XM_BayesUnsub 24240 9.49 16.78 6.49 34 UNPARSEABLE_RELAY 22624 12.00 15.66 10.50 35 BOTNET_IPINHOSTNAME 21759 7.66 15.06 4.60 36 TR_MAX_INTL_RELAY 21373 9.18 14.80 6.87 37 RELAYCOUNTRY_META 20193 7.02 13.98 4.15 38 XM_B_SpammyWords3 19894 6.86 13.77 4.01 39 LOTS_OF_MONEY 19767 8.80 13.68 6.78 40 TR_XM_SpammyWords2 18719 4.13 12.96 0.49 41 TR_XM_SpammyWords4 17318 6.90 11.99 4.80 42 XM_Body_Dirty_Words 14748 5.93 10.21 4.16 43 XM_Evil_Numbers_Gen 14717 8.14 10.19 7.30 44 TR_XM_SpammyRelay 14439 4.58 10.00 2.34 45 BOTNET 14301 3.87 9.90 1.38 46 BAYES_80 13231 5.66 9.16 4.22 47 TR_XM_UnparsRelay 13061 3.90 9.04 1.78 48 FSL_BULK_SIG 12457 5.45 8.62 4.14 49 BAYES_60 11322 8.73 7.84 9.09 50 LotsOfNums_01 11246 8.22 7.79 8.40 51 XMSubMetaSx_00 10215 4.80 7.07 3.86 52 HTML_IMAGE_RATIO_02 10133 5.71 7.01 5.18 53 HTML_IMAGE_RATIO_04 9256 4.91 6.41 4.29 54 MPART_ALT_DIFF 9234 4.74 6.39 4.06 55 TooManyTo_001 9147 8.07 6.33 8.79 56 XM_UncommonTLD01 8345 4.39 5.78 3.82 57 UNTRUSTED_Relay 8307 2.77 5.75 1.54 58 XM_H_Long_From01 7908 5.28 5.47 5.20 59 XM_B_Phish_Phrases 7890 4.29 5.46 3.81 60 XMSexyCombo_05 7823 2.81 5.42 1.74 61 RCVD_IN_BL_SPAMCOP_NET 7655 2.01 5.30 0.66 62 BAYES_95 7404 3.38 5.13 2.65 63 TR_XM_PhishingBody 7386 2.86 5.11 1.94 64 XM_SPF_SoftFail 7329 3.66 5.07 3.07 65 RELAYCOUNTRY_CA 7055 2.19 4.88 1.08 66 XM_B_Investor 6906 2.51 4.78 1.57 67 DKIM_INVALID 6882 3.06 4.76 2.36 68 XMBody_17 6569 1.85 4.55 0.73 69 MIME_HTML_MOSTLY 6376 2.89 4.41 2.26 70 T_XMDrugObfuBody_08 6295 2.27 4.36 1.41 71 XM_H_GMP 6185 5.85 4.28 6.50 72 TR_XM_SpammyWords5 6152 2.30 4.26 1.50 73 HTML_IMAGE_RATIO_06 6083 2.96 4.21 2.45 74 XMNumbers 5776 3.06 4.00 2.68 75 XMStrtUSub 5398 4.13 3.74 4.29 76 HTML_IMAGE_RATIO_08 5226 2.69 3.62 2.31 77 MIME_HTML_ONLY_MULTI 5174 2.71 3.58 2.35 78 XM_OfRef6 5033 1.99 3.48 1.38 79 TM2_M_VERY_LONG_WORD 4940 1.91 3.42 1.28 80 XM_B_SpammyTLD 4908 2.86 3.40 2.63 81 TR_XM_SPAMCOP 4870 1.13 3.37 0.20 82 MIME_QP_LONG_LINE 4753 4.87 3.29 5.51 83 T_XMDrugObfuBody_14 4751 2.12 3.29 1.64 84 TM2_M_URI_OPT_OUT 4679 2.30 3.24 1.91 85 XM_CamelCaseFrm001 4491 2.25 3.11 1.89 86 T_TooManySym_01 4070 4.45 2.82 5.12 87 XM_B_SpammyWords4 4048 1.20 2.80 0.55 88 RCVD_IN_VALIDITY_SAFE 3867 3.62 2.68 4.01 89 XM_B_Unsub2 3848 1.73 2.66 1.34 90 XM_UB50 3843 1.42 2.66 0.91 91 XM_URI_RBL 3755 0.86 2.60 0.15 92 RELAYCOUNTRY_AU 3732 1.39 2.58 0.89 93 USER_IN_DEF_DKIM_WL 3722 8.68 2.58 11.20 94 RCVD_IN_MSPIKE_WL 3702 5.10 2.56 6.15 95 RCVD_IN_MSPIKE_H3 3702 5.10 2.56 6.15 96 XMDiploma_00 3652 1.69 2.53 1.34 97 T_XMHurry_00 3630 1.24 2.51 0.72 98 T_XMDrugObfuBody_00 3475 1.15 2.41 0.64 99 TR_LOTS_OF_MONEY3 3147 0.90 2.18 0.38 100 TR_XM_PHPForged 3073 0.88 2.13 0.37 101 MAILING_LIST_MULTI 3066 2.48 2.12 2.62 102 SUBJ_ALL_CAPS 3026 1.61 2.09 1.40 103 TR_XM_PHPDW 3012 0.87 2.09 0.36 104 T_FILL_THIS_FORM_SHORT 2979 1.39 2.06 1.11 105 TR_XM_FormFill2 2959 0.86 2.05 0.37 106 XM_H_PHPOS 2939 0.84 2.03 0.35 107 XMStockSpam_06 2916 1.43 2.02 1.19 108 TR_XM_INV_DKIM 2873 0.65 1.99 0.09 109 SpammyFromTLD_01 2862 1.23 1.98 0.93 110 SpammyFromTLD_02 2847 0.89 1.97 0.45 111 RCVD_IN_VALIDITY_CERTIFIED 2834 3.17 1.96 3.66 112 TR_XM_NoHeaderRelay 2783 0.64 1.93 0.10 113 ANY_BOUNCE_MESSAGE 2770 3.85 1.92 4.64 114 BOUNCE_MESSAGE 2768 3.85 1.92 4.64 115 XM_SendGrid 2748 1.57 1.90 1.43 116 XM_DK_Undo_01 2710 1.78 1.88 1.74 117 URI_HEX 2701 1.41 1.87 1.22 118 FROM_EXCESS_BASE64 2613 1.80 1.81 1.80 119 T_REMOTE_IMAGE 2603 3.04 1.80 3.55 120 XMBrknScrpt_02 2516 0.99 1.74 0.68 121 HTML_MIME_NO_HTML_TAG 2428 2.18 1.68 2.39 122 XM_B_Phish66 2327 0.75 1.61 0.39 123 RCVD_IN_IADB_LISTED 2314 3.68 1.60 4.53 124 ALL_TRUSTED 2264 13.35 1.57 18.20 125 BOTNET_NORDNS 2179 0.45 1.51 0.01 126 XM_DIRTYINTL 2113 0.57 1.46 0.20 127 HTML_TAG_BALANCE_BODY 2112 0.75 1.46 0.46 128 XMPhish30 2112 0.83 1.46 0.57 129 RCVD_IN_IADB_SPF 2065 3.26 1.43 4.02 130 BAYES_40 2042 3.61 1.41 4.51 131 XMSexyCombo_01 2032 0.58 1.41 0.24 132 TM2_M_A_HREF_HREF 2025 0.57 1.40 0.23 133 KHOP_HELO_FCRDNS 1980 1.25 1.37 1.20 134 RCVD_IN_IADB_DK 1950 2.90 1.35 3.54 135 RCVD_IN_IADB_SENDERID 1949 2.97 1.35 3.64 136 AC_BR_BONANZA 1938 0.44 1.34 0.07 137 XMGenDplmaNmb 1914 0.89 1.32 0.71 138 XMBdyGiftCard01 1895 0.95 1.31 0.80 139 TR_XM_FormFill 1886 0.39 1.31 0.01 140 XMPhish14 1870 0.83 1.29 0.63 141 XM_HighProb1 1857 0.38 1.29 0.00 142 HTTPS_HTTP_MISMATCH 1811 0.91 1.25 0.77 143 XM_UB99 1804 0.37 1.25 0.00 144 URI_NOVOWEL 1800 1.67 1.25 1.84 145 XMHTML_After_End 1758 0.91 1.22 0.78 146 SCC_BODY_URI_ONLY 1713 2.18 1.19 2.59 147 XM_H_PHPMailer 1711 0.86 1.18 0.72 148 URI_TRY_3LD 1673 0.94 1.16 0.85 149 TR_XM_DK_SendGrid 1629 1.04 1.13 1.00 150 XM_B_DNDMA 1596 0.71 1.10 0.54 151 XM_B_COVIDMETA 1590 0.53 1.10 0.29 152 RDNS_DYNAMIC 1559 0.62 1.08 0.43 153 XMReplyNow 1549 0.45 1.07 0.19 154 DKIM_ADSP_CUSTOM_MED 1547 1.00 1.07 0.97 155 RELAYCOUNTRY_FR 1514 0.47 1.05 0.23 156 TR_MetaPhish_Combo_01 1512 0.85 1.05 0.77 157 XMLngstWrd_00 1493 0.74 1.03 0.62 158 DIET_1 1463 0.50 1.01 0.29 159 XM_RXBody 1450 0.72 1.00 0.60 160 TR_Mismatch_TLD_02 1444 0.34 1.00 0.07 161 BAYES_20 1415 2.65 0.98 3.33 162 XMBody_78 1413 0.52 0.98 0.33 163 XM_H_Long_From02 1408 0.92 0.97 0.90 164 XM_UB999 1407 0.29 0.97 0.00 165 TR_XM_InvalidRelay 1404 0.30 0.97 0.03 166 T_Symld_Words_02 1387 0.65 0.96 0.53 167 TR_LOTS_OF_MONEY2 1378 0.50 0.95 0.32 168 T_MONEY_PERCENT 1378 0.50 0.95 0.32 169 MPART_ALT_DIFF_COUNT 1375 0.73 0.95 0.63 170 XM_B_COPY_HTML 1362 0.76 0.94 0.68 171 XMSubMetaI_00 1352 0.77 0.94 0.70 172 XM_ProductURIs 1287 0.66 0.89 0.57 173 FORGED_GMAIL_RCVD 1279 0.69 0.89 0.60 174 XM_S_SpammyWords 1269 0.40 0.88 0.20 175 TR_XM_Spammywords 1269 0.40 0.88 0.20 176 TR_Symld_Words 1265 1.34 0.88 1.53 177 NML_ADSP_CUSTOM_MED 1264 0.72 0.88 0.66 178 TooManyTo_002 1263 1.95 0.87 2.40 179 URIBL_BLACK 1262 0.29 0.87 0.05 180 XM_H_Undi_Recip 1261 0.36 0.87 0.15 181 T_PDS_OTHER_BAD_TLD 1253 0.34 0.87 0.12 182 XM_B_SEO 1247 0.34 0.86 0.13 183 BAYES_00 1246 6.62 0.86 8.99 184 TVD_RCVD_IP 1235 1.29 0.85 1.48 185 FROM_SUSPICIOUS_NTLD 1230 0.27 0.85 0.03 186 TR_XM_Base64_L1 1225 0.38 0.85 0.19 187 RCVD_IN_VALIDITY_RPBL 1215 0.28 0.84 0.05 188 TR_XM_Base64_M1 1207 0.77 0.84 0.74 189 XMClaimOffer 1198 0.34 0.83 0.13 190 FROM_SUSPICIOUS_NTLD_FP 1178 0.26 0.82 0.03 191 XM_H_PHPOS_M 1176 0.28 0.81 0.06 192 URIBL_DBL_SPAM 1167 0.24 0.81 0.00 193 SHOPIFY_IMG_NOT_RCVD_SFY 1159 0.46 0.80 0.31 194 T_TooManySym_02 1149 2.04 0.80 2.55 195 TR_XM_SEO4 1137 0.29 0.79 0.08 196 HELO_DYNAMIC_SPLIT_IP 1118 0.23 0.77 0.01 197 RCVD_IN_IADB_VOUCHED 1104 2.18 0.76 2.76 198 TooManyTo_003 1083 1.24 0.75 1.44 199 HTML_IMAGE_ONLY_20 1072 0.50 0.74 0.40 200 XM_PDF 1072 3.68 0.74 4.89 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301051 88.98 96.48 85.88 2 T_SCC_BODY_TEXT_LINE 291920 82.63 81.05 83.28 3 RELAYCOUNTRY_US 274789 80.38 85.21 78.39 4 DKIM_SIGNED 254877 78.11 91.21 72.71 5 XM_DK_Pass 250158 75.98 87.19 71.37 6 DKIM_VALID 246621 75.05 86.44 70.36 7 XM_B_Unicode 238103 72.75 84.46 67.93 8 DCC_CHECK_NEGATIVE 231969 55.13 28.31 66.18 9 BAYES_50 209507 54.07 40.26 59.77 10 DKIM_VALID_AU 196236 59.81 69.09 55.98 11 XMListUnsubscribeExists 167178 54.39 70.65 47.69 12 XM_B_SpammyWords 157209 52.42 70.78 44.85 13 XM_B_Unicode3 137712 42.03 48.69 39.29 14 DCC_CHECK 118440 44.84 71.67 33.79 15 T_TM2_M_HEADER_IN_MSG 99565 27.03 23.68 28.40 16 DKIM_VALID_EF 98783 28.06 27.77 28.18 17 HTML_FONT_LOW_CONTRAST 94848 30.50 38.85 27.06 18 FVGT_m_MULTI_ODD 88357 28.22 35.54 25.21 19 RCVD_IN_MSPIKE_H2 87481 26.27 29.46 24.96 20 LOC_TINY_FONT_1 83583 29.21 42.23 23.84 21 XMSubLong 80789 23.45 24.44 23.05 22 MIME_HTML_ONLY 71079 21.87 25.75 20.28 23 T_KAM_HTML_FONT_INVALID 69655 22.46 28.75 19.87 24 ALL_TRUSTED 63799 13.35 1.57 18.20 25 XM_B_SpammyWords2 59617 24.17 41.55 17.01 26 TR_XM_DK_Unsub 45817 14.70 18.64 13.07 27 XM_Multi_Part_URI 43267 14.83 20.86 12.34 28 USER_IN_DEF_DKIM_WL 39255 8.68 2.58 11.20 29 UNPARSEABLE_RELAY 36794 12.00 15.66 10.50 30 BAYES_60 31866 8.73 7.84 9.09 31 BAYES_00 31502 6.62 0.86 8.99 32 TooManyTo_001 30823 8.07 6.33 8.79 33 LotsOfNums_01 29458 8.22 7.79 8.40 34 XM_DKIMWhitelistDomains 29241 5.92 0.05 8.34 35 XM_B_Unsub 28711 10.86 17.35 8.19 36 XM_Evil_Numbers_Gen 25594 8.14 10.19 7.30 37 TR_MAX_INTL_RELAY 24086 9.18 14.80 6.87 38 LOTS_OF_MONEY 23776 8.80 13.68 6.78 39 IN_ZIMBRA_NJ_WHITELIST 23628 4.80 0.09 6.74 40 XM_H_GMP 22782 5.85 4.28 6.50 41 TR_XM_BayesUnsub 22740 9.49 16.78 6.49 42 RCVD_IN_MSPIKE_H3 21559 5.10 2.56 6.15 43 RCVD_IN_MSPIKE_WL 21559 5.10 2.56 6.15 44 TR_XM_DK_Bayes 20886 4.43 0.73 5.96 45 TR_XM_DK_Bayes1 20611 4.37 0.71 5.88 46 XM_DK_Undo_02 20000 16.01 41.03 5.71 47 MIME_QP_LONG_LINE 19330 4.87 3.29 5.51 48 XM_H_Long_From01 18244 5.28 5.47 5.20 49 HTML_IMAGE_RATIO_02 18148 5.71 7.01 5.18 50 T_TooManySym_01 17955 4.45 2.82 5.12 51 TR_XM_DK_Bayes2 17896 3.79 0.59 5.11 52 XM_PDF 17153 3.68 0.74 4.89 53 BAYES_99 16845 13.27 33.80 4.81 54 TR_XM_SpammyWords4 16831 6.90 11.99 4.80 55 ANY_BOUNCE_MESSAGE 16268 3.85 1.92 4.64 56 BOUNCE_MESSAGE 16265 3.85 1.92 4.64 57 BOTNET_IPINHOSTNAME 16134 7.66 15.06 4.60 58 RCVD_IN_IADB_LISTED 15892 3.68 1.60 4.53 59 BAYES_40 15803 3.61 1.41 4.51 60 XMStrtUSub 15053 4.13 3.74 4.29 61 HTML_IMAGE_RATIO_04 15028 4.91 6.41 4.29 62 BAYES_80 14781 5.66 9.16 4.22 63 XM_Body_Dirty_Words 14588 5.93 10.21 4.16 64 RELAYCOUNTRY_META 14548 7.02 13.98 4.15 65 FSL_BULK_SIG 14497 5.45 8.62 4.14 66 MPART_ALT_DIFF 14242 4.74 6.39 4.06 67 RCVD_IN_IADB_SPF 14084 3.26 1.43 4.02 68 XM_B_SpammyWords3 14057 6.86 13.77 4.01 69 RCVD_IN_VALIDITY_SAFE 14051 3.62 2.68 4.01 70 XMSubMetaSx_00 13541 4.80 7.07 3.86 71 XM_UncommonTLD01 13393 4.39 5.78 3.82 72 XM_B_Phish_Phrases 13354 4.29 5.46 3.81 73 BAYES_999 13077 10.33 26.36 3.73 74 RCVD_IN_VALIDITY_CERTIFIED 12837 3.17 1.96 3.66 75 RCVD_IN_IADB_SENDERID 12748 2.97 1.35 3.64 76 T_REMOTE_IMAGE 12441 3.04 1.80 3.55 77 RCVD_IN_IADB_DK 12397 2.90 1.35 3.54 78 BAYES_20 11679 2.65 0.98 3.33 79 XM_SPF_SoftFail 10769 3.66 5.07 3.07 80 RCVD_IN_IADB_VOUCHED 9691 2.18 0.76 2.76 81 XMNumbers 9390 3.06 4.00 2.68 82 BAYES_95 9302 3.38 5.13 2.65 83 BAYES_05 9245 2.03 0.57 2.64 84 XM_B_SpammyTLD 9234 2.86 3.40 2.63 85 MAILING_LIST_MULTI 9185 2.48 2.12 2.62 86 SCC_BODY_URI_ONLY 9081 2.18 1.19 2.59 87 T_TooManySym_02 8953 2.04 0.80 2.55 88 HTML_IMAGE_RATIO_06 8575 2.96 4.21 2.45 89 TooManyTo_002 8402 1.95 0.87 2.40 90 HTML_MIME_NO_HTML_TAG 8379 2.18 1.68 2.39 91 TR_XM_DKIM_Undo 8273 10.28 29.50 2.36 92 DKIM_INVALID 8256 3.06 4.76 2.36 93 MIME_HTML_ONLY_MULTI 8227 2.71 3.58 2.35 94 TR_XM_SpammyRelay 8217 4.58 10.00 2.34 95 HTML_IMAGE_RATIO_08 8113 2.69 3.62 2.31 96 MIME_HTML_MOSTLY 7918 2.89 4.41 2.26 97 INVALID_MSGID 7044 1.47 0.14 2.01 98 TR_XM_PhishingBody 6791 2.86 5.11 1.94 99 TM2_M_URI_OPT_OUT 6690 2.30 3.24 1.91 100 HELO_NODOT 6660 1.56 0.74 1.90 101 HELO_NO_DOMAIN 6657 1.56 0.74 1.90 102 XM_CamelCaseFrm001 6635 2.25 3.11 1.89 103 RCVD_IN_IADB_OPTIN 6581 1.47 0.49 1.88 104 URI_NOVOWEL 6458 1.67 1.25 1.84 105 TO_MALFORMED 6318 1.28 0.01 1.80 106 FROM_EXCESS_BASE64 6318 1.80 1.81 1.80 107 TR_XM_UnparsRelay 6224 3.90 9.04 1.78 108 XMSexyCombo_05 6100 2.81 5.42 1.74 109 XM_DK_Undo_01 6091 1.78 1.88 1.74 110 T_XMDrugObfuBody_14 5739 2.12 3.29 1.64 111 XM_B_Investor 5499 2.51 4.78 1.57 112 UNTRUSTED_Relay 5382 2.77 5.75 1.54 113 TR_Symld_Words 5372 1.34 0.88 1.53 114 TR_DCC_Bayes_99 5331 7.80 23.04 1.52 115 TR_XM_SpammyWords5 5247 2.30 4.26 1.50 116 TVD_RCVD_IP 5174 1.29 0.85 1.48 117 TooManyTo_003 5049 1.24 0.75 1.44 118 XM_SendGrid 5012 1.57 1.90 1.43 119 T_XMDrugObfuBody_08 4945 2.27 4.36 1.41 120 IN_HORDE_ADDRESS_BOOK 4935 1.02 0.07 1.41 121 SUBJ_ALL_CAPS 4924 1.61 2.09 1.40 122 BOTNET 4840 3.87 9.90 1.38 123 XM_OfRef6 4826 1.99 3.48 1.38 124 XMDiploma_00 4707 1.69 2.53 1.34 125 XM_B_Unsub2 4696 1.73 2.66 1.34 126 XMGappySubj_01 4595 1.02 0.33 1.31 127 TM2_M_VERY_LONG_WORD 4491 1.91 3.42 1.28 128 URI_HEX 4279 1.41 1.87 1.22 129 KHOP_HELO_FCRDNS 4191 1.25 1.37 1.20 130 XMStockSpam_06 4170 1.43 2.02 1.19 131 XMCapTrack 4143 0.97 0.47 1.18 132 XM_GoogleGroups 4022 0.98 0.57 1.15 133 XMBSHREFv2 3984 0.98 0.60 1.14 134 XMBody_95 3954 0.89 0.31 1.13 135 T_FILL_THIS_FORM_SHORT 3880 1.39 2.06 1.11 136 TVD_SPACE_RATIO 3841 0.82 0.16 1.10 137 RELAYCOUNTRY_CA 3783 2.19 4.88 1.08 138 TooManyTo_004 3614 0.93 0.68 1.03 139 TR_XM_DK_SendGrid 3495 1.04 1.13 1.00 140 DKIM_ADSP_CUSTOM_MED 3409 1.00 1.07 0.97 141 SpammyFromTLD_01 3245 1.23 1.98 0.93 142 XM_UB50 3200 1.42 2.66 0.91 143 XM_H_Long_From02 3164 0.92 0.97 0.90 144 RELAYCOUNTRY_AU 3136 1.39 2.58 0.89 145 T_TooManySym_03 2980 0.71 0.37 0.85 146 URI_TRY_3LD 2977 0.94 1.16 0.85 147 TooManyTo_005 2950 0.79 0.65 0.84 148 XM_H_Trusted_IP 2913 0.59 0.00 0.83 149 XMBdyGiftCard01 2813 0.95 1.31 0.80 150 RCVD_IN_RP_SAFE 2798 0.73 0.58 0.80 151 XMGappySubj_02 2779 0.59 0.09 0.79 152 HTML_IMAGE_ONLY_12 2762 0.59 0.10 0.79 153 XMHTML_After_End 2731 0.91 1.22 0.78 154 TR_MetaPhish_Combo_01 2708 0.85 1.05 0.77 155 HTTPS_HTTP_MISMATCH 2694 0.91 1.25 0.77 156 RCVD_IN_RP_CERTIFIED 2592 0.65 0.44 0.74 157 TR_XM_Base64_M1 2582 0.77 0.84 0.74 158 FROM_GOV_DKIM_AU 2577 0.57 0.18 0.74 159 XMBody_17 2571 1.85 4.55 0.73 160 XM_H_PHPMailer 2526 0.86 1.18 0.72 161 T_XMHurry_00 2524 1.24 2.51 0.72 162 XMSubNoVowel 2523 0.65 0.50 0.72 163 XMGenDplmaNmb 2472 0.89 1.32 0.71 164 XMSubMetaI_00 2462 0.77 0.94 0.70 165 MSGID_NOFQDN1 2401 0.49 0.01 0.68 166 XMBrknScrpt_02 2379 0.99 1.74 0.68 167 XM_B_COPY_HTML 2377 0.76 0.94 0.68 168 T_OBFU_PDF_ATTACH 2325 0.51 0.13 0.66 169 XM_ShortIntro_01 2318 0.64 0.60 0.66 170 RCVD_IN_BL_SPAMCOP_NET 2314 2.01 5.30 0.66 171 FILL_THIS_FORM 2299 0.56 0.33 0.66 172 NML_ADSP_CUSTOM_MED 2297 0.72 0.88 0.66 173 T_XMDrugObfuBody_00 2242 1.15 2.41 0.64 174 XMPhish14 2219 0.83 1.29 0.63 175 MPART_ALT_DIFF_COUNT 2218 0.73 0.95 0.63 176 SHORT_HELO_AND_INLINE_IMAGE 2210 0.46 0.04 0.63 177 XMLngstWrd_00 2178 0.74 1.03 0.62 178 XMNoVowels 2162 0.59 0.54 0.62 179 FORGED_GMAIL_RCVD 2115 0.69 0.89 0.60 180 XM_RXBody 2112 0.72 1.00 0.60 181 XMPhish30 2007 0.83 1.46 0.57 182 XM_ProductURIs 1999 0.66 0.89 0.57 183 XMSolicitRefs_0 1953 0.55 0.52 0.56 184 XM_B_SpammyWords4 1915 1.20 2.80 0.55 185 XM_B_DNDMA 1898 0.71 1.10 0.54 186 USER_IN_WHITELIST 1894 0.38 0.00 0.54 187 USER_IN_WELCOMELIST 1894 0.38 0.00 0.54 188 T_Symld_Words_02 1852 0.65 0.96 0.53 189 RELAYCOUNTRY_GB 1844 0.55 0.61 0.53 190 TR_XM_SpammyWords2 1715 4.13 12.96 0.49 191 XMMoneyMeta_00 1694 0.55 0.72 0.48 192 XMAntiAgingB 1658 0.36 0.09 0.47 193 HTML_TAG_BALANCE_BODY 1605 0.75 1.46 0.46 194 XMSubMetaSxObfu_02 1585 0.45 0.44 0.45 195 SpammyFromTLD_02 1569 0.89 1.97 0.45 196 RDNS_DYNAMIC 1491 0.62 1.08 0.43 197 HTML_IMAGE_ONLY_32 1486 0.36 0.22 0.42 198 XMDateMe_00 1470 0.38 0.29 0.42 199 PLING_QUERY 1464 0.51 0.74 0.42 200 HTML_IMAGE_ONLY_28 1412 0.40 0.39 0.40 ----------------------------------------------------------------------