Email: 545066 Autolearn: 0 AvgScore: 3.67 AvgScanTime: 1.22 sec Spam: 162224 Autolearn: 0 AvgScore: 13.15 AvgScanTime: 1.35 sec Ham: 382842 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 1.17 sec Time Spent Running SA: 185.35 hours Time Spent Processing Spam: 60.97 hours Time Spent Processing Ham: 124.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156972 88.73 96.76 85.33 2 DKIM_SIGNED 148593 78.74 91.60 73.29 3 XM_DK_Pass 142376 76.58 87.77 71.84 4 DKIM_VALID 140609 75.60 86.68 70.91 5 XM_B_Unicode 140367 74.84 86.53 69.89 6 T_SCC_BODY_TEXT_LINE 131332 82.70 80.96 83.43 7 RELAYCOUNTRY_US 128924 79.55 79.47 79.58 8 XM_B_SpammyWords 118277 53.26 72.91 44.93 9 XMListUnsubscribeExists 117505 56.05 72.43 49.10 10 DCC_CHECK 117459 44.25 72.41 32.32 11 DKIM_VALID_AU 105661 59.38 65.13 56.94 12 XM_B_Unicode3 78776 43.09 48.56 40.77 13 XM_DK_Undo_02 72845 17.37 44.90 5.70 14 LOC_TINY_FONT_1 67905 30.57 41.86 25.79 15 XM_B_SpammyWords2 66107 25.40 40.75 18.89 16 BAYES_50 62076 52.83 38.27 59.01 17 HTML_FONT_LOW_CONTRAST 60031 30.56 37.01 27.83 18 BAYES_99 57365 14.10 35.36 5.09 19 TR_XM_DKIM_Undo 55817 11.96 34.41 2.44 20 FVGT_m_MULTI_ODD 54817 28.24 33.79 25.89 21 MIME_HTML_ONLY 50744 22.69 31.28 19.05 22 DKIM_VALID_EF 50362 28.42 31.04 27.31 23 T_KAM_HTML_FONT_INVALID 47177 22.70 29.08 19.99 24 BAYES_999 44987 11.15 27.73 4.12 25 DCC_CHECK_NEGATIVE 44741 55.72 27.58 67.64 26 RCVD_IN_MSPIKE_H2 43720 25.75 26.95 25.24 27 TR_DCC_Bayes_99 40235 8.57 24.80 1.69 28 T_TM2_M_HEADER_IN_MSG 36756 28.14 22.66 30.46 29 TR_XM_DK_Unsub 36710 15.82 22.63 12.93 30 XMSubLong 35756 23.08 22.04 23.52 31 RELAYCOUNTRY_META 32651 8.74 20.13 3.92 32 XM_Multi_Part_URI 31930 15.77 19.68 14.11 33 XM_B_Unsub 26754 10.46 16.49 7.90 34 TR_XM_SpammyRelay 25959 6.16 16.00 1.98 35 TR_XM_BayesUnsub 25904 9.26 15.97 6.42 36 UNPARSEABLE_RELAY 24801 11.92 15.29 10.49 37 TR_MAX_INTL_RELAY 24325 8.98 14.99 6.44 38 XM_B_SpammyWords3 22454 7.26 13.84 4.48 39 LOTS_OF_MONEY 22012 9.45 13.57 7.70 40 BOTNET_IPINHOSTNAME 21448 6.75 13.22 4.00 41 TR_XM_SpammyWords2 21238 4.27 13.09 0.54 42 RCVD_IN_BL_SPAMCOP_NET 19615 3.99 12.09 0.56 43 TR_XM_SpammyWords4 19429 7.35 11.98 5.40 44 RELAYCOUNTRY_CA 17430 4.01 10.74 1.15 45 XM_Evil_Numbers_Gen 16452 8.82 10.14 8.26 46 TR_XM_SPAMCOP 15656 3.03 9.65 0.23 47 BAYES_80 14895 5.55 9.18 4.02 48 RCVD_IN_MSPIKE_H3 14656 7.05 9.03 6.21 49 RCVD_IN_MSPIKE_WL 14656 7.05 9.03 6.21 50 BOTNET 14569 3.47 8.98 1.13 51 TR_XM_UnparsRelay 13482 3.73 8.31 1.79 52 FSL_BULK_SIG 13304 4.48 8.20 2.90 53 XM_Body_Dirty_Words 13103 5.16 8.08 3.93 54 BAYES_60 12827 8.42 7.91 8.63 55 HTML_IMAGE_RATIO_02 11908 5.76 7.34 5.09 56 LotsOfNums_01 11807 8.03 7.28 8.35 57 XMSubMetaSx_00 10519 4.75 6.48 4.02 58 XMBody_17 10433 2.40 6.43 0.69 59 UNTRUSTED_Relay 10052 2.89 6.20 1.49 60 MPART_ALT_DIFF 9988 4.52 6.16 3.83 61 XM_H_Long_From01 9546 5.38 5.88 5.17 62 XM_UncommonTLD01 9505 4.14 5.86 3.41 63 TooManyTo_001 9422 7.69 5.81 8.49 64 XM_B_Phish_Phrases 8922 4.62 5.50 4.25 65 BAYES_95 8483 3.26 5.23 2.42 66 HTML_IMAGE_RATIO_04 8323 4.71 5.13 4.52 67 DKIM_INVALID 7984 3.14 4.92 2.38 68 XMSexyCombo_05 7945 2.78 4.90 1.89 69 XM_B_Investor 7806 2.73 4.81 1.85 70 TR_XM_SpammyWords5 7691 2.43 4.74 1.46 71 XM_SPF_SoftFail 7365 3.45 4.54 2.99 72 T_FILL_THIS_FORM_SHORT 7365 2.05 4.54 0.99 73 TR_XM_PhishingBody 7146 2.69 4.41 1.96 74 MIME_HTML_MOSTLY 6998 2.79 4.31 2.15 75 HTML_IMAGE_RATIO_06 6987 3.42 4.31 3.05 76 XMNumbers 6828 3.02 4.21 2.52 77 XM_H_GMP 6746 5.46 4.16 6.01 78 XMStrtUSub 6222 4.43 3.84 4.68 79 XM_B_SpammyTLD 6198 2.85 3.82 2.44 80 MIME_HTML_ONLY_MULTI 5765 2.70 3.55 2.34 81 T_XMDrugObfuBody_14 5693 2.15 3.51 1.57 82 HTML_IMAGE_RATIO_08 5656 2.67 3.49 2.32 83 XM_CamelCaseFrm001 5630 2.75 3.47 2.44 84 XM_OfRef6 5590 1.83 3.45 1.15 85 T_XMDrugObfuBody_08 5441 2.64 3.35 2.34 86 TM2_M_URI_OPT_OUT 5162 2.45 3.18 2.14 87 MIME_QP_LONG_LINE 5092 4.46 3.14 5.03 88 TM2_M_VERY_LONG_WORD 5057 1.93 3.12 1.43 89 TR_XM_BayesRelay 4863 0.89 3.00 0.00 90 XM_UB50 4693 1.47 2.89 0.86 91 RCVD_IN_VALIDITY_SAFE 4606 3.73 2.84 4.11 92 SpammyFromTLD_01 4421 1.35 2.73 0.77 93 TR_XM_FormFill 4278 0.80 2.64 0.02 94 FROM_EXCESS_BASE64 4229 2.07 2.61 1.84 95 XM_B_Unsub2 4224 1.70 2.60 1.32 96 T_TooManySym_01 4217 4.89 2.60 5.86 97 XM_URI_RBL 4169 0.87 2.57 0.15 98 XM_B_SpammyWords4 3979 1.14 2.45 0.59 99 RELAYCOUNTRY_AU 3924 1.14 2.42 0.60 100 USER_IN_DEF_DKIM_WL 3894 9.47 2.40 12.47 101 XMDiploma_00 3888 1.89 2.40 1.67 102 TR_LOTS_OF_MONEY3 3762 0.96 2.32 0.39 103 FONT_INVIS_LONG_LINE 3748 0.72 2.31 0.04 104 RCVD_IN_VALIDITY_CERTIFIED 3718 3.15 2.29 3.52 105 SUBJ_ALL_CAPS 3662 1.64 2.26 1.39 106 MAILING_LIST_MULTI 3630 2.60 2.24 2.75 107 SpammyFromTLD_02 3454 0.95 2.13 0.45 108 TR_XM_INV_DKIM 3227 0.71 1.99 0.17 109 HTML_MIME_NO_HTML_TAG 3216 2.01 1.98 2.03 110 XM_DK_Undo_01 3132 1.83 1.93 1.79 111 TR_XM_PHPForged 3103 0.91 1.91 0.48 112 TR_XM_NoHeaderRelay 3053 0.63 1.88 0.10 113 XMStockSpam_06 3042 1.74 1.88 1.69 114 TR_XM_PHPDW 3012 0.87 1.86 0.45 115 URI_HEX 2992 1.36 1.84 1.16 116 TR_XM_FormFill2 2960 0.87 1.82 0.47 117 XM_H_PHPOS 2931 0.85 1.81 0.44 118 T_REMOTE_IMAGE 2878 2.80 1.77 3.24 119 TR_MetaPhish_Combo_01 2847 1.22 1.75 0.99 120 XM_SendGrid 2799 1.59 1.73 1.53 121 ANY_BOUNCE_MESSAGE 2796 3.69 1.72 4.52 122 BOUNCE_MESSAGE 2795 3.69 1.72 4.52 123 XMBrknScrpt_02 2776 0.96 1.71 0.63 124 RCVD_IN_IADB_LISTED 2668 3.57 1.64 4.39 125 TR_XM_Base64_M1 2602 0.89 1.60 0.58 126 T_XMDrugObfuBody_00 2581 0.96 1.59 0.69 127 T_XMHurry_00 2566 0.96 1.58 0.70 128 BAYES_40 2518 4.11 1.55 5.20 129 TR_Mismatch_TLD_02 2472 0.49 1.52 0.06 130 RCVD_IN_IADB_SPF 2392 3.18 1.47 3.90 131 RCVD_IN_IADB_SENDERID 2268 2.88 1.40 3.51 132 RCVD_IN_IADB_DK 2267 2.82 1.40 3.42 133 XMBdyGiftCard01 2260 0.90 1.39 0.69 134 HK_RANDOM_REPLYTO 2199 0.50 1.36 0.13 135 RELAYCOUNTRY_FR 2189 0.56 1.35 0.23 136 URI_NOVOWEL 2162 1.58 1.33 1.68 137 KHOP_HELO_FCRDNS 2127 1.15 1.31 1.09 138 HTTPS_HTTP_MISMATCH 2121 0.91 1.31 0.74 139 ALL_TRUSTED 2109 12.56 1.30 17.33 140 XMPhish30 2079 0.79 1.28 0.58 141 TR_Symld_Words 2053 1.86 1.27 2.11 142 HTML_TAG_BALANCE_BODY 2035 0.71 1.25 0.48 143 XM_UB99 2022 0.37 1.25 0.00 144 THIS_AD 2019 0.60 1.24 0.32 145 XM_HighProb1 2018 0.37 1.24 0.00 146 XMGenDplmaNmb 1965 1.08 1.21 1.02 147 XM_DIRTYINTL 1956 0.47 1.21 0.16 148 XMReplyNow 1923 0.52 1.19 0.24 149 DKIM_ADSP_CUSTOM_MED 1920 0.99 1.18 0.90 150 BAYES_20 1887 2.65 1.16 3.29 151 BOTNET_NORDNS 1881 0.35 1.16 0.01 152 T_TooManySym_02 1880 2.62 1.16 3.24 153 XMPhish14 1877 0.74 1.16 0.57 154 TR_XM_DK_SendGrid 1873 1.02 1.15 0.97 155 XMLngstWrd_00 1833 0.85 1.13 0.73 156 XM_B_Phish66 1723 0.52 1.06 0.28 157 XMHTML_After_End 1718 0.70 1.06 0.55 158 XMSubMetaI_00 1694 0.63 1.04 0.45 159 XM_B_COPY_HTML 1683 0.64 1.04 0.47 160 TooManyTo_002 1673 2.13 1.03 2.60 161 URI_TRY_3LD 1657 0.85 1.02 0.78 162 RDNS_DYNAMIC 1657 0.55 1.02 0.34 163 AC_BR_BONANZA 1617 0.35 1.00 0.08 164 NML_ADSP_CUSTOM_MED 1613 0.74 0.99 0.63 165 XM_RXBody 1599 0.77 0.99 0.68 166 XM_H_PHPMailer 1582 0.96 0.98 0.95 167 XM_UB999 1574 0.29 0.97 0.00 168 SHOPIFY_IMG_NOT_RCVD_SFY 1547 0.49 0.95 0.29 169 TR_Caps_n_Bayes_99 1536 0.30 0.95 0.02 170 TR_LOTS_OF_MONEY2 1531 0.43 0.94 0.22 171 T_MONEY_PERCENT 1531 0.43 0.94 0.22 172 MPART_ALT_DIFF_COUNT 1520 0.69 0.94 0.59 173 TooManyTo_003 1518 1.36 0.94 1.54 174 XM_H_Undi_Recip 1500 0.38 0.92 0.15 175 HTML_FONT_FACE_BAD 1497 0.53 0.92 0.36 176 DIET_1 1470 0.45 0.91 0.26 177 XM_B_COVIDMETA 1465 0.55 0.90 0.40 178 TR_XM_InvalidRelay 1465 0.28 0.90 0.02 179 TR_XM_Base64_L1 1433 0.35 0.88 0.12 180 XMSubMetaSxObfu_03 1429 0.71 0.88 0.64 181 XMMoneyMeta_00 1417 0.70 0.87 0.62 182 XMClaimOffer 1410 0.44 0.87 0.25 183 TooManyTo_004 1408 1.07 0.87 1.15 184 XMSexyCombo_01 1393 0.40 0.86 0.20 185 XMPhish08 1382 0.56 0.85 0.43 186 XM_H_Long_From02 1381 0.97 0.85 1.01 187 FORGED_GMAIL_RCVD 1366 0.62 0.84 0.53 188 TooManyTo_005 1318 0.90 0.81 0.94 189 RCVD_IN_PSBL 1313 0.46 0.81 0.31 190 XM_UB60 1290 0.28 0.80 0.06 191 TR_XM_RelayPhish 1281 0.28 0.79 0.06 192 PDS_OTHER_BAD_TLD 1269 0.34 0.78 0.15 193 RELAYCOUNTRY_IN 1257 0.27 0.77 0.06 194 TM2_M_A_HREF_HREF 1256 0.38 0.77 0.22 195 RCVD_IN_RP_SAFE 1253 0.74 0.77 0.73 196 TVD_RCVD_IP 1243 1.16 0.77 1.33 197 URIBL_BLACK 1239 0.27 0.76 0.06 198 XM_B_DNDMA 1232 0.47 0.76 0.35 199 RCVD_IN_VALIDITY_RPBL 1229 0.25 0.76 0.03 200 BAYES_00 1227 7.08 0.76 9.76 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 326681 88.73 96.76 85.33 2 T_SCC_BODY_TEXT_LINE 319421 82.70 80.96 83.43 3 RELAYCOUNTRY_US 304664 79.55 79.47 79.58 4 DKIM_SIGNED 280589 78.74 91.60 73.29 5 XM_DK_Pass 275040 76.58 87.77 71.84 6 DKIM_VALID 271480 75.60 86.68 70.91 7 XM_B_Unicode 267578 74.84 86.53 69.89 8 DCC_CHECK_NEGATIVE 258948 55.72 27.58 67.64 9 BAYES_50 225907 52.83 38.27 59.01 10 DKIM_VALID_AU 217990 59.38 65.13 56.94 11 XMListUnsubscribeExists 187987 56.05 72.43 49.10 12 XM_B_SpammyWords 172006 53.26 72.91 44.93 13 XM_B_Unicode3 156076 43.09 48.56 40.77 14 DCC_CHECK 123721 44.25 72.41 32.32 15 T_TM2_M_HEADER_IN_MSG 116626 28.14 22.66 30.46 16 HTML_FONT_LOW_CONTRAST 106562 30.56 37.01 27.83 17 DKIM_VALID_EF 104556 28.42 31.04 27.31 18 FVGT_m_MULTI_ODD 99110 28.24 33.79 25.89 19 LOC_TINY_FONT_1 98724 30.57 41.86 25.79 20 RCVD_IN_MSPIKE_H2 96638 25.75 26.95 25.24 21 XMSubLong 90045 23.08 22.04 23.52 22 T_KAM_HTML_FONT_INVALID 76544 22.70 29.08 19.99 23 MIME_HTML_ONLY 72944 22.69 31.28 19.05 24 XM_B_SpammyWords2 72334 25.40 40.75 18.89 25 ALL_TRUSTED 66338 12.56 1.30 17.33 26 XM_Multi_Part_URI 54038 15.77 19.68 14.11 27 TR_XM_DK_Unsub 49503 15.82 22.63 12.93 28 USER_IN_DEF_DKIM_WL 47732 9.47 2.40 12.47 29 UNPARSEABLE_RELAY 40176 11.92 15.29 10.49 30 BAYES_00 37353 7.08 0.76 9.76 31 BAYES_60 33044 8.42 7.91 8.63 32 XM_DKIMWhitelistDomains 32737 6.06 0.19 8.55 33 TooManyTo_001 32499 7.69 5.81 8.49 34 LotsOfNums_01 31978 8.03 7.28 8.35 35 XM_Evil_Numbers_Gen 31616 8.82 10.14 8.26 36 XM_B_Unsub 30235 10.46 16.49 7.90 37 LOTS_OF_MONEY 29476 9.45 13.57 7.70 38 TR_MAX_INTL_RELAY 24649 8.98 14.99 6.44 39 TR_XM_BayesUnsub 24578 9.26 15.97 6.42 40 IN_ZIMBRA_NJ_WHITELIST 24501 4.51 0.06 6.40 41 TR_XM_DK_Bayes 24342 4.65 0.62 6.36 42 TR_XM_DK_Bayes1 23994 4.58 0.61 6.27 43 RCVD_IN_MSPIKE_WL 23789 7.05 9.03 6.21 44 RCVD_IN_MSPIKE_H3 23787 7.05 9.03 6.21 45 XM_H_GMP 23024 5.46 4.16 6.01 46 T_TooManySym_01 22427 4.89 2.60 5.86 47 XM_DK_Undo_02 21825 17.37 44.90 5.70 48 TR_XM_DK_Bayes2 20823 3.95 0.43 5.44 49 TR_XM_SpammyWords4 20659 7.35 11.98 5.40 50 BAYES_40 19897 4.11 1.55 5.20 51 XM_H_Long_From01 19782 5.38 5.88 5.17 52 HTML_IMAGE_RATIO_02 19503 5.76 7.34 5.09 53 BAYES_99 19503 14.10 35.36 5.09 54 MIME_QP_LONG_LINE 19240 4.46 3.14 5.03 55 XMStrtUSub 17908 4.43 3.84 4.68 56 HTML_IMAGE_RATIO_04 17323 4.71 5.13 4.52 57 ANY_BOUNCE_MESSAGE 17302 3.69 1.72 4.52 58 BOUNCE_MESSAGE 17300 3.69 1.72 4.52 59 XM_B_SpammyWords3 17141 7.26 13.84 4.48 60 RCVD_IN_IADB_LISTED 16806 3.57 1.64 4.39 61 XM_PDF 16450 3.17 0.52 4.30 62 XM_B_Phish_Phrases 16278 4.62 5.50 4.25 63 BAYES_999 15761 11.15 27.73 4.12 64 RCVD_IN_VALIDITY_SAFE 15723 3.73 2.84 4.11 65 XMSubMetaSx_00 15377 4.75 6.48 4.02 66 BAYES_80 15373 5.55 9.18 4.02 67 BOTNET_IPINHOSTNAME 15330 6.75 13.22 4.00 68 XM_Body_Dirty_Words 15027 5.16 8.08 3.93 69 RELAYCOUNTRY_META 15008 8.74 20.13 3.92 70 RCVD_IN_IADB_SPF 14917 3.18 1.47 3.90 71 MPART_ALT_DIFF 14671 4.52 6.16 3.83 72 RCVD_IN_VALIDITY_CERTIFIED 13462 3.15 2.29 3.52 73 RCVD_IN_IADB_SENDERID 13451 2.88 1.40 3.51 74 RCVD_IN_IADB_DK 13105 2.82 1.40 3.42 75 XM_UncommonTLD01 13049 4.14 5.86 3.41 76 BAYES_20 12584 2.65 1.16 3.29 77 T_TooManySym_02 12410 2.62 1.16 3.24 78 T_REMOTE_IMAGE 12394 2.80 1.77 3.24 79 HTML_IMAGE_RATIO_06 11676 3.42 4.31 3.05 80 XM_SPF_SoftFail 11442 3.45 4.54 2.99 81 FSL_BULK_SIG 11116 4.48 8.20 2.90 82 MAILING_LIST_MULTI 10541 2.60 2.24 2.75 83 RCVD_IN_IADB_VOUCHED 10250 2.08 0.68 2.68 84 TooManyTo_002 9957 2.13 1.03 2.60 85 BAYES_05 9908 1.99 0.58 2.59 86 SCC_BODY_URI_ONLY 9662 1.98 0.68 2.52 87 XMNumbers 9634 3.02 4.21 2.52 88 TR_XM_DKIM_Undo 9351 11.96 34.41 2.44 89 XM_B_SpammyTLD 9349 2.85 3.82 2.44 90 XM_CamelCaseFrm001 9341 2.75 3.47 2.44 91 BAYES_95 9272 3.26 5.23 2.42 92 DKIM_INVALID 9109 3.14 4.92 2.38 93 T_XMDrugObfuBody_08 8959 2.64 3.35 2.34 94 MIME_HTML_ONLY_MULTI 8955 2.70 3.55 2.34 95 HTML_IMAGE_RATIO_08 8879 2.67 3.49 2.32 96 MIME_HTML_MOSTLY 8219 2.79 4.31 2.15 97 TM2_M_URI_OPT_OUT 8206 2.45 3.18 2.14 98 TR_Symld_Words 8079 1.86 1.27 2.11 99 HTML_MIME_NO_HTML_TAG 7766 2.01 1.98 2.03 100 TR_XM_SpammyRelay 7599 6.16 16.00 1.98 101 TR_XM_PhishingBody 7522 2.69 4.41 1.96 102 INVALID_MSGID 7306 1.41 0.24 1.91 103 XMSexyCombo_05 7230 2.78 4.90 1.89 104 XM_B_Investor 7094 2.73 4.81 1.85 105 FROM_EXCESS_BASE64 7058 2.07 2.61 1.84 106 HELO_NODOT 6908 1.41 0.48 1.80 107 HELO_NO_DOMAIN 6898 1.41 0.48 1.80 108 TR_XM_UnparsRelay 6867 3.73 8.31 1.79 109 XM_DK_Undo_01 6859 1.83 1.93 1.79 110 RCVD_IN_IADB_OPTIN 6855 1.39 0.44 1.79 111 TR_DCC_Bayes_99 6461 8.57 24.80 1.69 112 XMStockSpam_06 6454 1.74 1.88 1.69 113 URI_NOVOWEL 6423 1.58 1.33 1.68 114 XMDiploma_00 6393 1.89 2.40 1.67 115 TO_MALFORMED 6362 1.17 0.02 1.66 116 T_XMDrugObfuBody_14 6010 2.15 3.51 1.57 117 TooManyTo_003 5897 1.36 0.94 1.54 118 XM_SendGrid 5841 1.59 1.73 1.53 119 UNTRUSTED_Relay 5706 2.89 6.20 1.49 120 TR_XM_SpammyWords5 5574 2.43 4.74 1.46 121 TM2_M_VERY_LONG_WORD 5478 1.93 3.12 1.43 122 XMGappySubj_01 5425 1.15 0.51 1.42 123 IN_HORDE_ADDRESS_BOOK 5327 0.99 0.05 1.39 124 SUBJ_ALL_CAPS 5303 1.64 2.26 1.39 125 TVD_RCVD_IP 5096 1.16 0.77 1.33 126 XM_B_Unsub2 5065 1.70 2.60 1.32 127 XM_GoogleGroups 4801 1.03 0.50 1.25 128 XM_H_Trusted_IP 4735 0.87 0.00 1.24 129 URI_HEX 4430 1.36 1.84 1.16 130 TooManyTo_004 4402 1.07 0.87 1.15 131 RELAYCOUNTRY_CA 4400 4.01 10.74 1.15 132 XM_OfRef6 4399 1.83 3.45 1.15 133 XMCapTrack 4374 0.92 0.38 1.14 134 BOTNET 4321 3.47 8.98 1.13 135 KHOP_HELO_FCRDNS 4157 1.15 1.31 1.09 136 XMBSHREFv2 4127 0.84 0.28 1.08 137 XMGenDplmaNmb 3924 1.08 1.21 1.02 138 XM_H_Long_From02 3882 0.97 0.85 1.01 139 XM_ProductURIs 3866 0.93 0.74 1.01 140 T_FILL_THIS_FORM_SHORT 3799 2.05 4.54 0.99 141 TR_MetaPhish_Combo_01 3798 1.22 1.75 0.99 142 TVD_SPACE_RATIO 3779 0.72 0.09 0.99 143 TR_XM_DK_SendGrid 3696 1.02 1.15 0.97 144 XMBody_95 3659 0.76 0.28 0.96 145 XM_H_PHPMailer 3637 0.96 0.98 0.95 146 TooManyTo_005 3598 0.90 0.81 0.94 147 DKIM_ADSP_CUSTOM_MED 3457 0.99 1.18 0.90 148 T_TooManySym_03 3338 0.69 0.24 0.87 149 XM_UB50 3295 1.47 2.89 0.86 150 XMGappySubj_02 3217 0.71 0.41 0.84 151 XMSubNoVowel 3110 0.73 0.55 0.81 152 XM_ShortIntro_01 3001 0.70 0.49 0.78 153 URI_TRY_3LD 2986 0.85 1.02 0.78 154 SpammyFromTLD_01 2935 1.35 2.73 0.77 155 HTTPS_HTTP_MISMATCH 2835 0.91 1.31 0.74 156 RCVD_IN_RP_SAFE 2794 0.74 0.77 0.73 157 XMLngstWrd_00 2784 0.85 1.13 0.73 158 T_XMHurry_00 2679 0.96 1.58 0.70 159 XMNoVowels 2641 0.62 0.44 0.69 160 XMBody_17 2641 2.40 6.43 0.69 161 XMBdyGiftCard01 2639 0.90 1.39 0.69 162 T_XMDrugObfuBody_00 2629 0.96 1.59 0.69 163 FROM_GOV_DKIM_AU 2606 0.56 0.28 0.68 164 XM_RXBody 2585 0.77 0.99 0.68 165 XMSubMetaSxObfu_03 2450 0.71 0.88 0.64 166 RCVD_IN_RP_CERTIFIED 2435 0.63 0.61 0.64 167 XMBrknScrpt_02 2431 0.96 1.71 0.63 168 NML_ADSP_CUSTOM_MED 2422 0.74 0.99 0.63 169 XMMoneyMeta_00 2389 0.70 0.87 0.62 170 FILL_THIS_FORM 2342 0.50 0.24 0.61 171 MSGID_NOFQDN1 2334 0.44 0.03 0.61 172 TO_NO_BRKTS_HTML_ONLY 2313 0.53 0.36 0.60 173 RELAYCOUNTRY_AU 2311 1.14 2.42 0.60 174 SHORT_HELO_AND_INLINE_IMAGE 2311 0.44 0.05 0.60 175 MPART_ALT_DIFF_COUNT 2267 0.69 0.94 0.59 176 T_Symld_Words_02 2254 0.62 0.69 0.59 177 XM_B_SpammyWords4 2245 1.14 2.45 0.59 178 XMPhish30 2238 0.79 1.28 0.58 179 TR_XM_Base64_M1 2229 0.89 1.60 0.58 180 T_OBFU_PDF_ATTACH 2174 0.42 0.07 0.57 181 XMPhish14 2173 0.74 1.16 0.57 182 RCVD_IN_BL_SPAMCOP_NET 2130 3.99 12.09 0.56 183 XMHTML_After_End 2121 0.70 1.06 0.55 184 TR_XM_SpammyWords2 2062 4.27 13.09 0.54 185 FORGED_GMAIL_RCVD 2034 0.62 0.84 0.53 186 PLING_QUERY 1922 0.54 0.63 0.50 187 XM_B_FormFill 1869 0.36 0.05 0.49 188 USER_IN_WELCOMELIST 1852 0.34 0.00 0.48 189 USER_IN_WHITELIST 1852 0.34 0.00 0.48 190 TR_XM_PHPForged 1850 0.91 1.91 0.48 191 HTML_TAG_BALANCE_BODY 1850 0.71 1.25 0.48 192 RELAYCOUNTRY_GB 1815 0.52 0.62 0.47 193 XM_B_COPY_HTML 1814 0.64 1.04 0.47 194 TR_XM_FormFill2 1795 0.87 1.82 0.47 195 TR_XM_PHPDW 1741 0.87 1.86 0.45 196 XMSubMetaI_00 1740 0.63 1.04 0.45 197 SpammyFromTLD_02 1736 0.95 2.13 0.45 198 HTML_IMAGE_ONLY_28 1696 0.43 0.39 0.44 199 XM_H_PHPOS 1690 0.85 1.81 0.44 200 XMPhish08 1655 0.56 0.85 0.43 ----------------------------------------------------------------------