Email: 309172 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.15 sec Spam: 115142 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 1.19 sec Ham: 194030 Autolearn: 0 AvgScore: -0.66 AvgScanTime: 1.12 sec Time Spent Running SA: 98.56 hours Time Spent Processing Spam: 38.06 hours Time Spent Processing Ham: 60.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 105354 82.22 91.50 76.72 2 HTML_MESSAGE 104877 84.98 91.08 81.35 3 XM_DK_Pass 101767 80.48 88.38 75.79 4 DKIM_VALID 100565 79.81 87.34 75.34 5 XM_B_Unicode 95847 74.76 83.24 69.72 6 RELAYCOUNTRY_US 88827 78.14 77.15 78.72 7 XMListUnsubscribeExists 85963 62.28 74.66 54.94 8 DCC_CHECK 80384 49.85 69.81 38.00 9 XM_B_SpammyWords 80249 53.90 69.70 44.53 10 DKIM_VALID_AU 77176 65.22 67.03 64.15 11 XM_DK_Undo_02 54636 22.56 47.45 7.78 12 XM_B_Unicode3 48703 42.33 42.30 42.35 13 XM_B_SpammyWords2 46056 27.30 40.00 19.76 14 LOC_TINY_FONT_1 45145 32.07 39.21 27.83 15 BAYES_99 44164 18.55 38.36 6.79 16 HTML_FONT_LOW_CONTRAST 41733 33.27 36.24 31.51 17 TR_XM_DKIM_Undo 41693 15.75 36.21 3.61 18 FVGT_m_MULTI_ODD 37563 29.27 32.62 27.28 19 BAYES_50 36309 47.41 31.53 56.84 20 DCC_CHECK_NEGATIVE 34747 50.14 30.18 61.98 21 BAYES_999 34607 14.55 30.06 5.35 22 DKIM_VALID_EF 34368 29.74 29.85 29.68 23 RCVD_IN_MSPIKE_H2 33926 29.15 29.46 28.96 24 MIME_HTML_ONLY 33642 24.03 29.22 20.95 25 T_KAM_HTML_FONT_INVALID 32065 23.07 27.85 20.23 26 TR_DCC_Bayes_99 31668 11.95 27.50 2.73 27 TR_XM_DK_Unsub 26602 18.40 23.10 15.60 28 RELAYCOUNTRY_META 25927 10.97 22.52 4.12 29 T_TM2_M_HEADER_IN_MSG 22296 20.83 19.36 21.70 30 XMSubLong 21689 20.05 18.84 20.77 31 XM_Multi_Part_URI 20217 16.52 17.56 15.91 32 TR_XM_SpammyRelay 20182 8.29 17.53 2.82 33 XM_B_Unsub 18037 10.94 15.67 8.13 34 LOTS_OF_MONEY 17849 9.87 15.50 6.53 35 TR_XM_BayesUnsub 17556 9.91 15.25 6.74 36 TR_MAX_INTL_RELAY 17402 10.83 15.11 8.29 37 RCVD_IN_BL_SPAMCOP_NET 17138 6.17 14.88 0.99 38 TR_XM_SpammyWords2 17011 6.16 14.77 1.05 39 UNPARSEABLE_RELAY 15793 12.31 13.72 11.48 40 TR_XM_SpammyWords4 15376 7.91 13.35 4.67 41 XM_B_SpammyWords3 14932 8.40 12.97 5.68 42 RELAYCOUNTRY_CA 14860 6.07 12.91 2.01 43 TR_XM_SPAMCOP 14276 4.99 12.40 0.59 44 BOTNET_IPINHOSTNAME 14102 8.03 12.25 5.53 45 XM_UncommonTLD01 12888 7.22 11.19 4.87 46 RCVD_IN_MSPIKE_WL 10464 7.04 9.09 5.82 47 RCVD_IN_MSPIKE_H3 10464 7.04 9.09 5.82 48 BAYES_80 10381 6.46 9.02 4.95 49 FSL_BULK_SIG 10175 5.97 8.84 4.27 50 TR_XM_UnparsRelay 9817 4.60 8.53 2.27 51 BOTNET 9681 3.85 8.41 1.14 52 XMBody_17 9666 3.88 8.39 1.21 53 XMNumbers 9177 4.99 7.97 3.22 54 BAYES_60 9059 9.74 7.87 10.85 55 SpammyFromTLD_01 8270 3.15 7.18 0.76 56 UNTRUSTED_Relay 8090 3.60 7.03 1.57 57 TR_XM_PHPForged 7897 2.78 6.86 0.35 58 TR_XM_PHPDW 7844 2.76 6.81 0.35 59 TR_XM_FormFill2 7782 2.74 6.76 0.36 60 XM_H_PHPOS 7774 2.72 6.75 0.32 61 XM_SPF_SoftFail 7719 4.13 6.70 2.61 62 XM_Body_Dirty_Words 7653 4.06 6.65 2.53 63 XM_Evil_Numbers_Gen 7545 7.33 6.55 7.78 64 HTML_IMAGE_RATIO_02 7227 6.33 6.28 6.36 65 TooManyTo_001 6582 6.30 5.72 6.65 66 MPART_ALT_DIFF 6540 4.45 5.68 3.72 67 BAYES_95 6431 4.18 5.59 3.35 68 XMSubMetaSx_00 6208 4.51 5.39 3.98 69 TR_LOTS_OF_MONEY3 5996 2.86 5.21 1.46 70 T_FILL_THIS_FORM_SHORT 5984 2.33 5.20 0.63 71 LotsOfNums_01 5910 6.94 5.13 8.02 72 TM2_M_BODY_EMPTY 5762 2.09 5.00 0.36 73 HTML_IMAGE_RATIO_04 5742 4.72 4.99 4.57 74 XMEmptyBody_01 5729 1.92 4.98 0.10 75 XM_H_GMP 5173 6.51 4.49 7.71 76 DKIM_INVALID 4789 2.41 4.16 1.37 77 HTML_IMAGE_RATIO_06 4656 2.92 4.04 2.25 78 XM_OfRef6 4571 2.38 3.97 1.44 79 TR_XM_SpammyWords5 4423 2.01 3.84 0.93 80 XMSexyCombo_05 4416 2.29 3.84 1.38 81 XMStrtUSub 4347 5.10 3.78 5.88 82 T_XMDrugObfuBody_14 4297 2.50 3.73 1.77 83 FONT_INVIS_LONG_LINE 4241 1.42 3.68 0.08 84 RCVD_IN_VALIDITY_SAFE 4183 6.60 3.63 8.36 85 XM_UB50 4101 1.90 3.56 0.91 86 MIME_HTML_MOSTLY 4053 2.89 3.52 2.51 87 XM_H_Long_From01 4045 4.64 3.51 5.31 88 HTML_IMAGE_RATIO_08 3987 2.58 3.46 2.05 89 USER_IN_DEF_DKIM_WL 3922 12.69 3.41 18.19 90 XM_B_Phish_Phrases 3774 2.86 3.28 2.60 91 TR_XM_FormFill 3723 1.22 3.23 0.03 92 TR_XM_PhishingBody 3616 2.14 3.14 1.54 93 T_XMDrugObfuBody_08 3615 2.02 3.14 1.35 94 BAYES_20 3519 2.78 3.06 2.62 95 RCVD_IN_VALIDITY_CERTIFIED 3509 5.47 3.05 6.91 96 XM_B_Investor 3412 1.91 2.96 1.29 97 XM_URI_RBL 3398 1.23 2.95 0.21 98 TR_XM_NoHeaderRelay 3394 1.15 2.95 0.08 99 TM2_M_VERY_LONG_WORD 3371 2.10 2.93 1.61 100 TR_XM_BayesRelay 3350 1.09 2.91 0.00 101 MIME_HTML_ONLY_MULTI 3349 2.38 2.91 2.07 102 XM_CamelCaseFrm001 3260 2.49 2.83 2.29 103 XM_B_SpammyTLD 3149 2.64 2.73 2.59 104 SUBJ_ALL_CAPS 3131 1.56 2.72 0.87 105 XMBrknScrpt_02 3119 1.48 2.71 0.76 106 BAYES_40 3092 3.50 2.69 3.99 107 TM2_M_URI_OPT_OUT 2771 2.24 2.41 2.15 108 FROM_EXCESS_BASE64 2756 2.23 2.39 2.14 109 HK_RANDOM_REPLYTO 2654 0.95 2.30 0.15 110 URI_TRY_3LD 2531 1.36 2.20 0.86 111 XMStockSpam_06 2480 1.28 2.15 0.76 112 XM_B_SpammyWords4 2462 1.32 2.14 0.83 113 MIME_QP_LONG_LINE 2453 3.16 2.13 3.77 114 AC_BR_BONANZA 2449 0.87 2.13 0.12 115 T_XMHurry_00 2435 1.35 2.11 0.89 116 XM_HighProb1 2396 0.78 2.08 0.00 117 RELAYCOUNTRY_AU 2209 1.01 1.92 0.46 118 T_TooManySym_01 2120 4.98 1.84 6.85 119 XMDiploma_00 2077 1.47 1.80 1.28 120 BOTNET_NORDNS 2037 0.66 1.77 0.01 121 ANY_BOUNCE_MESSAGE 2003 4.06 1.74 5.44 122 BOUNCE_MESSAGE 2003 4.06 1.74 5.44 123 T_REMOTE_IMAGE 1866 3.00 1.62 3.83 124 XM_SendGrid 1861 1.50 1.62 1.44 125 RCVD_IN_VALIDITY_RPBL 1810 0.72 1.57 0.22 126 XMBdyGiftCard01 1761 1.16 1.53 0.94 127 LongTLD 1758 0.71 1.53 0.22 128 TR_XM_INV_DKIM 1731 0.60 1.50 0.06 129 HTML_TAG_BALANCE_BODY 1731 0.86 1.50 0.48 130 XM_B_Unsub2 1719 1.29 1.49 1.18 131 SpammyFromTLD_02 1685 0.67 1.46 0.20 132 MAILING_LIST_MULTI 1673 1.87 1.45 2.12 133 KHOP_HELO_FCRDNS 1653 0.83 1.44 0.47 134 TR_Mismatch_TLD_02 1551 0.53 1.35 0.05 135 RELAYCOUNTRY_RU 1534 0.51 1.33 0.02 136 XMReplyNow 1497 0.63 1.30 0.23 137 BAYES_05 1494 2.25 1.30 2.81 138 THIS_AD 1483 0.85 1.29 0.59 139 TR_Caps_n_Bayes_99 1438 0.47 1.25 0.01 140 URI_NOVOWEL 1435 1.19 1.25 1.16 141 XMPhish30 1422 0.83 1.23 0.58 142 AC_HTML_NONSENSE_TAGS 1410 0.48 1.22 0.03 143 TR_Mismatch_TLD_01 1384 0.64 1.20 0.30 144 XM_H_PHPMailer 1364 0.96 1.18 0.83 145 URI_HEX 1359 1.15 1.18 1.13 146 HTTPS_HTTP_MISMATCH 1349 0.80 1.17 0.58 147 TR_XM_InvalidRelay 1348 0.45 1.17 0.02 148 XM_DK_Undo_01 1329 1.49 1.15 1.69 149 XM_B_COPY_HTML 1326 1.00 1.15 0.90 150 DIET_1 1321 0.64 1.15 0.33 151 DKIM_ADSP_CUSTOM_MED 1299 1.04 1.13 0.98 152 DKIM_ADSP_NXDOMAIN 1270 0.68 1.10 0.43 153 HTML_MIME_NO_HTML_TAG 1267 1.49 1.10 1.72 154 T_XMDrugObfuBody_00 1266 0.67 1.10 0.41 155 ALL_TRUSTED 1265 11.33 1.10 17.41 156 RCVD_IN_PSBL 1248 0.67 1.08 0.42 157 T_Symld_Words_02 1244 0.59 1.08 0.30 158 RDNS_DYNAMIC 1243 0.62 1.08 0.35 159 XMSlimDrugH 1234 0.59 1.07 0.30 160 XMSexyCombo_01 1222 0.52 1.06 0.20 161 NML_ADSP_CUSTOM_MED 1221 0.84 1.06 0.70 162 MPART_ALT_DIFF_COUNT 1210 0.97 1.05 0.92 163 TVD_RCVD_IP 1183 1.96 1.03 2.51 164 XM_DIRTYINTL 1181 0.46 1.03 0.12 165 TR_MetaPhish_Combo_01 1176 0.89 1.02 0.81 166 RELAYCOUNTRY_CN 1164 0.39 1.01 0.02 167 FORGED_GMAIL_RCVD 1164 0.76 1.01 0.61 168 XM_UB99 1117 0.36 0.97 0.01 169 PLING_QUERY 1111 0.71 0.96 0.55 170 XM_H_Undi_Recip 1086 0.44 0.94 0.13 171 XM_ProductURIs 1084 0.76 0.94 0.66 172 PDS_OTHER_BAD_TLD 1081 0.43 0.94 0.13 173 XMClaimOffer 1070 0.47 0.93 0.20 174 XMHTMLBadTable_001 1068 0.54 0.93 0.31 175 TR_XM_Base64_M1 1044 0.87 0.91 0.84 176 XM_UB60 1027 0.36 0.89 0.05 177 GOOG_STO_NOIMG_HTML 1017 0.33 0.88 0.00 178 XMSubMetaI_00 1011 0.76 0.88 0.70 179 SHOPIFY_IMG_NOT_RCVD_SFY 1003 0.58 0.87 0.41 180 XMBounce_01 996 0.33 0.87 0.01 181 TR_XM_DK_SendGrid 977 0.96 0.85 1.03 182 HELO_DYNAMIC_SPLIT_IP 960 0.32 0.83 0.01 183 TR_Symld_Words 942 1.04 0.82 1.16 184 XM_UB80 940 0.31 0.82 0.02 185 XM_H_Long_From02 933 1.04 0.81 1.18 186 XM_H_PHPOS_M 929 0.34 0.81 0.07 187 TR_XM_Base64_L1 902 0.40 0.78 0.18 188 URIBL_DBL_SPAM 899 0.29 0.78 0.00 189 RCVD_IN_IADB_LISTED 894 2.19 0.78 3.03 190 RELAYCOUNTRY_FR 881 0.40 0.77 0.19 191 FILL_THIS_FORM 879 0.68 0.76 0.62 192 TM2_M_OBFU_COMMENT 857 0.56 0.74 0.45 193 HTML_FONT_FACE_BAD 848 0.69 0.74 0.67 194 RELAYCOUNTRY_IN 848 0.30 0.74 0.04 195 XM_UB999 837 0.27 0.73 0.01 196 XMHTML_After_End 833 0.44 0.72 0.28 197 T_STY_INVIS_DIRECT 831 0.41 0.72 0.22 198 RCVD_IN_IADB_SPF 817 2.01 0.71 2.79 199 FILL_THIS_FORM_LONG 815 0.55 0.71 0.46 200 TR_LOTS_OF_MONEY2 813 0.46 0.71 0.31 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157851 84.98 91.08 81.35 2 RELAYCOUNTRY_US 152747 78.14 77.15 78.72 3 DKIM_SIGNED 148855 82.22 91.50 76.72 4 XM_DK_Pass 147063 80.48 88.38 75.79 5 DKIM_VALID 146189 79.81 87.34 75.34 6 XM_B_Unicode 135277 74.76 83.24 69.72 7 DKIM_VALID_AU 124478 65.22 67.03 64.15 8 DCC_CHECK_NEGATIVE 120264 50.14 30.18 61.98 9 BAYES_50 110278 47.41 31.53 56.84 10 XMListUnsubscribeExists 106597 62.28 74.66 54.94 11 XM_B_SpammyWords 86409 53.90 69.70 44.53 12 XM_B_Unicode3 82172 42.33 42.30 42.35 13 DCC_CHECK 73729 49.85 69.81 38.00 14 HTML_FONT_LOW_CONTRAST 61137 33.27 36.24 31.51 15 DKIM_VALID_EF 57587 29.74 29.85 29.68 16 RCVD_IN_MSPIKE_H2 56196 29.15 29.46 28.96 17 LOC_TINY_FONT_1 53997 32.07 39.21 27.83 18 FVGT_m_MULTI_ODD 52928 29.27 32.62 27.28 19 T_TM2_M_HEADER_IN_MSG 42111 20.83 19.36 21.70 20 MIME_HTML_ONLY 40654 24.03 29.22 20.95 21 XMSubLong 40305 20.05 18.84 20.77 22 T_KAM_HTML_FONT_INVALID 39260 23.07 27.85 20.23 23 XM_B_SpammyWords2 38339 27.30 40.00 19.76 24 USER_IN_DEF_DKIM_WL 35297 12.69 3.41 18.19 25 ALL_TRUSTED 33774 11.33 1.10 17.41 26 XM_Multi_Part_URI 30871 16.52 17.56 15.91 27 TR_XM_DK_Unsub 30275 18.40 23.10 15.60 28 UNPARSEABLE_RELAY 22271 12.31 13.72 11.48 29 BAYES_60 21057 9.74 7.87 10.85 30 XM_DKIMWhitelistDomains 19706 6.48 0.29 10.16 31 RCVD_IN_VALIDITY_SAFE 16227 6.60 3.63 8.36 32 TR_MAX_INTL_RELAY 16091 10.83 15.11 8.29 33 XM_B_Unsub 15784 10.94 15.67 8.13 34 LotsOfNums_01 15558 6.94 5.13 8.02 35 BAYES_00 15149 5.12 0.59 7.81 36 XM_Evil_Numbers_Gen 15104 7.33 6.55 7.78 37 XM_DK_Undo_02 15100 22.56 47.45 7.78 38 XM_H_GMP 14953 6.51 4.49 7.71 39 RCVD_IN_VALIDITY_CERTIFIED 13402 5.47 3.05 6.91 40 T_TooManySym_01 13287 4.98 1.84 6.85 41 BAYES_99 13181 18.55 38.36 6.79 42 TR_XM_BayesUnsub 13078 9.91 15.25 6.74 43 TooManyTo_001 12911 6.30 5.72 6.65 44 TR_XM_DK_Bayes 12803 4.32 0.48 6.60 45 TR_XM_DK_Bayes1 12706 4.29 0.48 6.55 46 LOTS_OF_MONEY 12678 9.87 15.50 6.53 47 HTML_IMAGE_RATIO_02 12342 6.33 6.28 6.36 48 XMStrtUSub 11413 5.10 3.78 5.88 49 RCVD_IN_MSPIKE_H3 11294 7.04 9.09 5.82 50 RCVD_IN_MSPIKE_WL 11294 7.04 9.09 5.82 51 IN_ZIMBRA_NJ_WHITELIST 11245 3.65 0.04 5.80 52 TR_XM_DK_Bayes2 11111 3.74 0.39 5.73 53 XM_B_SpammyWords3 11023 8.40 12.97 5.68 54 BOTNET_IPINHOSTNAME 10730 8.03 12.25 5.53 55 ANY_BOUNCE_MESSAGE 10559 4.06 1.74 5.44 56 BOUNCE_MESSAGE 10559 4.06 1.74 5.44 57 BAYES_999 10386 14.55 30.06 5.35 58 XM_H_Long_From01 10301 4.64 3.51 5.31 59 BAYES_80 9597 6.46 9.02 4.95 60 XM_UncommonTLD01 9443 7.22 11.19 4.87 61 TR_XM_SpammyWords4 9068 7.91 13.35 4.67 62 HTML_IMAGE_RATIO_04 8861 4.72 4.99 4.57 63 FSL_BULK_SIG 8276 5.97 8.84 4.27 64 RELAYCOUNTRY_META 8000 10.97 22.52 4.12 65 BAYES_40 7742 3.50 2.69 3.99 66 XMSubMetaSx_00 7721 4.51 5.39 3.98 67 T_REMOTE_IMAGE 7423 3.00 1.62 3.83 68 MIME_QP_LONG_LINE 7324 3.16 2.13 3.77 69 MPART_ALT_DIFF 7210 4.45 5.68 3.72 70 T_TooManySym_02 7120 2.48 0.47 3.67 71 TR_XM_DKIM_Undo 7002 15.75 36.21 3.61 72 INVALID_MSGID 6855 2.33 0.29 3.53 73 TO_MALFORMED 6651 2.16 0.02 3.43 74 BAYES_95 6491 4.18 5.59 3.35 75 MSGID_NOFQDN1 6417 2.14 0.19 3.31 76 XMNumbers 6251 4.99 7.97 3.22 77 RCVD_IN_IADB_LISTED 5874 2.19 0.78 3.03 78 XM_PDF 5730 1.98 0.34 2.95 79 TR_XM_SpammyRelay 5462 8.29 17.53 2.82 80 BAYES_05 5461 2.25 1.30 2.81 81 RCVD_IN_IADB_SPF 5411 2.01 0.71 2.79 82 TR_DCC_Bayes_99 5290 11.95 27.50 2.73 83 BAYES_20 5074 2.78 3.06 2.62 84 RCVD_IN_IADB_SENDERID 5065 1.89 0.68 2.61 85 XM_SPF_SoftFail 5061 4.13 6.70 2.61 86 XM_B_Phish_Phrases 5053 2.86 3.28 2.60 87 XM_B_SpammyTLD 5019 2.64 2.73 2.59 88 RCVD_IN_IADB_DK 4945 1.86 0.69 2.55 89 XM_Body_Dirty_Words 4905 4.06 6.65 2.53 90 MIME_HTML_MOSTLY 4871 2.89 3.52 2.51 91 TVD_RCVD_IP 4868 1.96 1.03 2.51 92 XM_CamelCaseFrm001 4446 2.49 2.83 2.29 93 TR_XM_UnparsRelay 4407 4.60 8.53 2.27 94 HTML_IMAGE_RATIO_06 4360 2.92 4.04 2.25 95 XMBSHREFv2 4241 1.47 0.26 2.19 96 TM2_M_URI_OPT_OUT 4165 2.24 2.41 2.15 97 FROM_EXCESS_BASE64 4149 2.23 2.39 2.14 98 MAILING_LIST_MULTI 4117 1.87 1.45 2.12 99 MIME_HTML_ONLY_MULTI 4012 2.38 2.91 2.07 100 HTML_IMAGE_RATIO_08 3982 2.58 3.46 2.05 101 RELAYCOUNTRY_CA 3899 6.07 12.91 2.01 102 IN_HORDE_ADDRESS_BOOK 3527 1.15 0.03 1.82 103 TVD_SPACE_RATIO 3481 1.15 0.07 1.79 104 T_XMDrugObfuBody_14 3439 2.50 3.73 1.77 105 TooManyTo_002 3367 1.31 0.59 1.74 106 HTML_MIME_NO_HTML_TAG 3332 1.49 1.10 1.72 107 XM_DK_Undo_01 3282 1.49 1.15 1.69 108 RCVD_IN_IADB_VOUCHED 3155 1.13 0.29 1.63 109 TM2_M_VERY_LONG_WORD 3127 2.10 2.93 1.61 110 XMBody_95 3103 1.07 0.18 1.60 111 UNTRUSTED_Relay 3052 3.60 7.03 1.57 112 TR_XM_PhishingBody 2989 2.14 3.14 1.54 113 TR_LOTS_OF_MONEY3 2840 2.86 5.21 1.46 114 XM_OfRef6 2796 2.38 3.97 1.44 115 XM_SendGrid 2790 1.50 1.62 1.44 116 XMSexyCombo_05 2676 2.29 3.84 1.38 117 DKIM_INVALID 2666 2.41 4.16 1.37 118 T_XMDrugObfuBody_08 2626 2.02 3.14 1.35 119 XMGappySubj_01 2620 0.90 0.13 1.35 120 XM_B_Investor 2501 1.91 2.96 1.29 121 XMDiploma_00 2479 1.47 1.80 1.28 122 T_TooManySym_03 2419 0.84 0.15 1.25 123 XMBody_17 2342 3.88 8.39 1.21 124 XM_H_Long_From02 2283 1.04 0.81 1.18 125 XM_B_Unsub2 2281 1.29 1.49 1.18 126 TR_Symld_Words 2260 1.04 0.82 1.16 127 URI_NOVOWEL 2245 1.19 1.25 1.16 128 RCVD_IN_IADB_OPTIN 2229 0.80 0.21 1.15 129 BOTNET 2210 3.85 8.41 1.14 130 URI_HEX 2183 1.15 1.18 1.13 131 XM_GoogleGroups 2161 0.85 0.42 1.11 132 XMGappySubj_02 2146 0.71 0.05 1.11 133 TR_XM_SpammyWords2 2031 6.16 14.77 1.05 134 TR_XM_DK_SendGrid 2001 0.96 0.85 1.03 135 RCVD_IN_BL_SPAMCOP_NET 1929 6.17 14.88 0.99 136 DKIM_ADSP_CUSTOM_MED 1906 1.04 1.13 0.98 137 XMBdyGiftCard01 1829 1.16 1.53 0.94 138 USER_IN_WHITELIST 1807 0.58 0.00 0.93 139 USER_IN_WELCOMELIST 1807 0.58 0.00 0.93 140 TR_XM_SpammyWords5 1804 2.01 3.84 0.93 141 MPART_ALT_DIFF_COUNT 1776 0.97 1.05 0.92 142 XM_UB50 1761 1.90 3.56 0.91 143 XM_B_COPY_HTML 1755 1.00 1.15 0.90 144 T_XMHurry_00 1725 1.35 2.11 0.89 145 SUBJ_ALL_CAPS 1679 1.56 2.72 0.87 146 URI_TRY_3LD 1662 1.36 2.20 0.86 147 TR_XM_Base64_M1 1638 0.87 0.91 0.84 148 T_OBFU_PDF_ATTACH 1631 0.55 0.05 0.84 149 TooManyTo_003 1622 0.72 0.52 0.84 150 XM_H_PHPMailer 1613 0.96 1.18 0.83 151 XM_B_SpammyWords4 1611 1.32 2.14 0.83 152 TR_MetaPhish_Combo_01 1572 0.89 1.02 0.81 153 SpammyFromTLD_01 1480 3.15 7.18 0.76 154 XMBrknScrpt_02 1469 1.48 2.71 0.76 155 XMStockSpam_06 1466 1.28 2.15 0.76 156 NML_ADSP_CUSTOM_MED 1365 0.84 1.06 0.70 157 XMSubMetaI_00 1352 0.76 0.88 0.70 158 XM_B_FormFill 1299 0.44 0.06 0.67 159 HTML_FONT_FACE_BAD 1293 0.69 0.74 0.67 160 XM_ProductURIs 1279 0.76 0.94 0.66 161 TooManyTo_004 1277 0.60 0.50 0.66 162 T_FILL_THIS_FORM_SHORT 1226 2.33 5.20 0.63 163 FILL_THIS_FORM 1209 0.68 0.76 0.62 164 FORGED_GMAIL_RCVD 1191 0.76 1.01 0.61 165 THIS_AD 1142 0.85 1.29 0.59 166 TR_XM_SPAMCOP 1140 4.99 12.40 0.59 167 XMPhish30 1131 0.83 1.23 0.58 168 HTTPS_HTTP_MISMATCH 1126 0.80 1.17 0.58 169 TooManyTo_005 1122 0.54 0.48 0.58 170 XMSubMetaSxObfu_02 1115 0.46 0.26 0.57 171 XMGenDplmaNmb 1111 0.61 0.68 0.57 172 XM_H_Trusted_IP 1078 0.35 0.00 0.56 173 PLING_QUERY 1074 0.71 0.96 0.55 174 XM_B_REG_HTML 1003 0.55 0.59 0.52 175 T_TooManySym_04 986 0.33 0.04 0.51 176 XMSubNoVowel 984 0.48 0.45 0.51 177 XMNoVowels 975 0.48 0.44 0.50 178 HTML_TAG_BALANCE_BODY 931 0.86 1.50 0.48 179 KHOP_HELO_FCRDNS 904 0.83 1.44 0.47 180 RELAYCOUNTRY_AU 900 1.01 1.92 0.46 181 FILL_THIS_FORM_LONG 884 0.55 0.71 0.46 182 TM2_M_OBFU_COMMENT 864 0.56 0.74 0.45 183 HELO_NODOT 854 0.53 0.69 0.44 184 HELO_NO_DOMAIN 853 0.53 0.69 0.44 185 SUBJ_DOLLARS 841 0.53 0.69 0.43 186 XM_ShortIntro_01 840 0.41 0.38 0.43 187 DKIM_ADSP_NXDOMAIN 828 0.68 1.10 0.43 188 NUMERIC_HTTP_ADDR 817 0.35 0.23 0.42 189 RCVD_IN_PSBL 813 0.67 1.08 0.42 190 T_XMDrugObfuBody_00 796 0.67 1.10 0.41 191 XMCapTrack 792 0.33 0.19 0.41 192 SHOPIFY_IMG_NOT_RCVD_SFY 791 0.58 0.87 0.41 193 XM_S_SubURI 775 0.27 0.06 0.40 194 NO_DNS_FOR_FROM 745 0.41 0.45 0.38 195 CTE_8BIT_MISMATCH 731 0.28 0.12 0.38 196 TO_NO_BRKTS_HTML_ONLY 715 0.35 0.32 0.37 197 XMSubMetaSxObfu_03 705 0.38 0.40 0.36 198 XMPhish08 703 0.41 0.49 0.36 199 TR_XM_FormFill2 693 2.74 6.76 0.36 200 TM2_M_BODY_EMPTY 692 2.09 5.00 0.36 ----------------------------------------------------------------------