Email: 470388 Autolearn: 0 AvgScore: 4.77 AvgScanTime: 1.25 sec Spam: 162011 Autolearn: 0 AvgScore: 13.17 AvgScanTime: 1.38 sec Ham: 308377 Autolearn: 0 AvgScore: 0.35 AvgScanTime: 1.19 sec Time Spent Running SA: 163.69 hours Time Spent Processing Spam: 62.12 hours Time Spent Processing Ham: 101.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155151 89.41 95.77 86.07 2 DKIM_SIGNED 150564 82.66 92.93 77.27 3 XM_DK_Pass 145532 80.75 89.83 75.98 4 DKIM_VALID 143334 79.65 88.47 75.01 5 XM_B_Unicode 140556 76.51 86.76 71.13 6 RELAYCOUNTRY_US 139446 83.12 86.07 81.57 7 DCC_CHECK 123727 53.44 76.37 41.39 8 XMListUnsubscribeExists 122231 61.38 75.45 53.98 9 XM_B_SpammyWords 118049 55.76 72.86 46.77 10 DKIM_VALID_AU 117520 64.53 72.54 60.33 11 LOC_TINY_FONT_1 79790 36.07 49.25 29.15 12 XM_DK_Undo_02 77161 20.21 47.63 5.81 13 XM_B_Unicode3 75910 44.80 46.85 43.73 14 HTML_FONT_LOW_CONTRAST 65467 33.95 40.41 30.55 15 XM_B_SpammyWords2 65064 27.40 40.16 20.69 16 RCVD_IN_MSPIKE_H2 64995 34.92 40.12 32.18 17 BAYES_50 61556 53.18 37.99 61.16 18 BAYES_99 61393 15.99 37.89 4.48 19 FVGT_m_MULTI_ODD 60357 29.53 37.25 25.46 20 TR_XM_DKIM_Undo 57162 13.87 35.28 2.62 21 BAYES_999 50572 12.99 31.22 3.42 22 T_KAM_HTML_FONT_INVALID 50087 24.55 30.92 21.20 23 TR_DCC_Bayes_99 46365 11.01 28.62 1.76 24 DKIM_VALID_EF 42912 27.36 26.49 27.82 25 MIME_HTML_ONLY 39361 22.04 24.30 20.86 26 DCC_CHECK_NEGATIVE 38260 46.54 23.62 58.58 27 T_TM2_M_HEADER_IN_MSG 37539 26.02 23.17 27.51 28 XM_Multi_Part_URI 34575 17.59 21.34 15.63 29 XMSubLong 33652 21.74 20.77 22.25 30 TR_XM_DK_Unsub 30994 15.26 19.13 13.23 31 LOTS_OF_MONEY 25832 9.98 15.94 6.85 32 XM_B_Unsub 24107 9.97 14.88 7.39 33 UNPARSEABLE_RELAY 24063 12.83 14.85 11.77 34 RELAYCOUNTRY_META 23600 7.83 14.57 4.29 35 TR_XM_BayesUnsub 23301 9.08 14.38 6.29 36 TR_XM_SpammyWords4 22537 8.00 13.91 4.90 37 TR_XM_SpammyWords2 22052 5.14 13.61 0.69 38 XM_B_SpammyWords3 21401 8.40 13.21 5.87 39 TR_MAX_INTL_RELAY 21224 8.90 13.10 6.69 40 BOTNET_IPINHOSTNAME 20677 6.58 12.76 3.34 41 TR_XM_SpammyRelay 16088 5.08 9.93 2.53 42 XM_Evil_Numbers_Gen 16078 9.73 9.92 9.63 43 RCVD_IN_BL_SPAMCOP_NET 15691 3.90 9.69 0.86 44 LotsOfNums_01 14289 8.55 8.82 8.40 45 BOTNET 13443 3.73 8.30 1.33 46 BAYES_80 13049 5.51 8.05 4.17 47 TR_XM_UnparsRelay 12869 3.99 7.94 1.92 48 TR_XM_SPAMCOP 12566 2.95 7.76 0.43 49 BAYES_60 12145 8.99 7.50 9.77 50 FSL_BULK_SIG 11922 6.57 7.36 6.15 51 HTML_IMAGE_RATIO_02 11779 5.74 7.27 4.94 52 XM_Body_Dirty_Words 11706 4.70 7.23 3.38 53 HTML_IMAGE_RATIO_04 11086 5.64 6.84 5.00 54 UNTRUSTED_Relay 10588 3.34 6.54 1.66 55 MPART_ALT_DIFF 10086 5.02 6.23 4.39 56 XMSubMetaSx_00 9402 4.90 5.80 4.42 57 XM_H_Long_From01 9206 5.68 5.68 5.68 58 XM_B_PhoneNumber 8420 7.76 5.20 9.11 59 XM_UncommonTLD01 8246 4.35 5.09 3.96 60 HTML_IMAGE_RATIO_06 8217 3.39 5.07 2.51 61 XMBody_17 8205 2.18 5.06 0.66 62 XM_H_GMP 7849 4.89 4.84 4.92 63 RELAYCOUNTRY_CA 7832 2.43 4.83 1.17 64 XM_SPF_SoftFail 7760 2.81 4.79 1.77 65 RCVD_IN_VALIDITY_SAFE 7730 5.04 4.77 5.17 66 BAYES_95 7704 3.29 4.76 2.53 67 XM_B_Phish_Phrases 7541 4.38 4.65 4.23 68 XM_B_Investor 7397 2.52 4.57 1.45 69 DKIM_INVALID 7230 3.02 4.46 2.26 70 XM_B_SEO 7164 2.52 4.42 1.52 71 T_XMDrugObfuBody_14 7085 2.56 4.37 1.61 72 TR_XM_SpammyWords5 6945 2.63 4.29 1.76 73 TooManyTo_001 6723 6.78 4.15 8.16 74 TM2_M_URI_OPT_OUT 6487 2.56 4.00 1.80 75 TR_XM_SEO4 6403 1.96 3.95 0.92 76 RCVD_IN_VALIDITY_CERTIFIED 6227 4.16 3.84 4.33 77 XM_UB50 6170 2.00 3.81 1.04 78 TM2_M_VERY_LONG_WORD 6096 2.25 3.76 1.46 79 USER_IN_DEF_DKIM_WL 6069 11.56 3.75 15.66 80 XMSexyCombo_05 5951 2.94 3.67 2.55 81 RCVD_IN_MSPIKE_H3 5894 4.74 3.64 5.33 82 RCVD_IN_MSPIKE_WL 5894 4.74 3.64 5.33 83 MIME_QP_LONG_LINE 5878 4.87 3.63 5.52 84 MIME_HTML_ONLY_MULTI 5851 2.74 3.61 2.28 85 TR_XM_PhishingBody 5820 2.32 3.59 1.66 86 HTML_IMAGE_RATIO_08 5810 3.03 3.59 2.73 87 XM_B_SpammyTLD 5728 4.01 3.54 4.26 88 XM_OfRef6 5720 1.85 3.53 0.96 89 XM_CamelCaseFrm001 5707 2.84 3.52 2.48 90 MIME_HTML_MOSTLY 5601 3.05 3.46 2.83 91 XM_URI_RBL 5540 1.42 3.42 0.37 92 XMBrknScrpt_02 5488 1.99 3.39 1.25 93 XMStrtUSub 5338 4.19 3.29 4.66 94 TR_LOTS_OF_MONEY3 5260 1.46 3.25 0.52 95 SUBJ_ALL_CAPS 4701 2.02 2.90 1.55 96 XMNumbers 4574 3.04 2.82 3.16 97 T_XMDrugObfuBody_08 4397 1.85 2.71 1.40 98 RELAYCOUNTRY_AU 4175 1.60 2.58 1.09 99 FROM_EXCESS_BASE64 4042 2.41 2.49 2.36 100 TR_LOTS_OF_MONEY2 3827 0.97 2.36 0.24 101 T_MONEY_PERCENT 3827 0.97 2.36 0.24 102 XM_B_SpammyWords4 3767 1.70 2.33 1.38 103 RCVD_IN_VALIDITY_RPBL 3664 0.86 2.26 0.12 104 T_TooManySym_01 3446 4.92 2.13 6.38 105 XMDiploma_00 3300 1.73 2.04 1.56 106 XM_B_Unsub2 3049 1.38 1.88 1.12 107 MAILING_LIST_MULTI 3019 2.39 1.86 2.67 108 SpammyFromTLD_01 2924 1.08 1.80 0.69 109 XMBdyGiftCard01 2857 1.27 1.76 1.01 110 ANY_BOUNCE_MESSAGE 2835 2.80 1.75 3.35 111 BOUNCE_MESSAGE 2833 2.80 1.75 3.35 112 T_XMHurry_00 2816 1.08 1.74 0.73 113 XMStockSpam_06 2810 1.89 1.73 1.98 114 T_XMDrugObfuBody_00 2751 1.17 1.70 0.89 115 BOTNET_NORDNS 2713 0.58 1.67 0.01 116 XM_DK_Undo_01 2625 1.74 1.62 1.80 117 TR_XM_NoHeaderRelay 2607 0.65 1.61 0.14 118 SpammyFromTLD_02 2535 0.84 1.56 0.46 119 XMSubMetaI_00 2470 1.05 1.52 0.80 120 HTML_TAG_BALANCE_BODY 2303 0.73 1.42 0.37 121 DKIM_ADSP_NXDOMAIN 2299 0.91 1.42 0.65 122 TR_Caps_n_Bayes_99 2297 0.52 1.42 0.04 123 URI_NOVOWEL 2285 2.53 1.41 3.12 124 XM_HighProb1 2227 0.48 1.37 0.01 125 T_REMOTE_IMAGE 2224 2.85 1.37 3.63 126 KHOP_HELO_FCRDNS 2221 1.41 1.37 1.43 127 XM_H_Long_From02 2214 1.11 1.37 0.98 128 URI_HEX 2210 1.17 1.36 1.06 129 RCVD_IN_IADB_LISTED 2193 3.17 1.35 4.12 130 XMPhish30 2080 0.76 1.28 0.49 131 XM_SendGrid 2034 1.37 1.26 1.43 132 TR_XM_PHPDW 2028 0.68 1.25 0.38 133 URI_TRY_3LD 2026 1.00 1.25 0.86 134 XM_OfRef7 2025 0.58 1.25 0.23 135 TR_XM_INV_DKIM 2022 0.46 1.25 0.05 136 BAYES_40 2010 3.48 1.24 4.66 137 TR_XM_PHPForged 1990 0.67 1.23 0.38 138 HTML_MIME_NO_HTML_TAG 1989 1.90 1.23 2.26 139 XM_ShortIntro_01 1967 1.02 1.21 0.92 140 RCVD_IN_IADB_SPF 1967 2.82 1.21 3.66 141 TR_XM_FormFill2 1940 0.67 1.20 0.39 142 XM_H_PHPOS 1925 0.65 1.19 0.37 143 URIBL_DBL_SPAM 1906 0.41 1.18 0.00 144 THIS_AD 1906 0.77 1.18 0.55 145 XM_B_COPY_HTML 1904 0.85 1.18 0.68 146 RDNS_DYNAMIC 1893 0.63 1.17 0.35 147 T_STY_INVIS_DIRECT 1874 0.59 1.16 0.29 148 PDS_RDNS_DYNAMIC_FP 1872 0.51 1.16 0.18 149 RCVD_IN_IADB_DK 1863 2.49 1.15 3.20 150 TR_XM_InvalidRelay 1858 0.41 1.15 0.02 151 RCVD_IN_IADB_SENDERID 1848 2.54 1.14 3.27 152 XM_ProductURIs 1821 0.84 1.12 0.69 153 XM_B_REG_HTML 1817 0.66 1.12 0.42 154 XMGenDplmaNmb 1806 0.81 1.11 0.65 155 BAYES_00 1782 5.78 1.10 8.24 156 T_FILL_THIS_FORM_SHORT 1770 0.91 1.09 0.82 157 AC_BR_BONANZA 1769 0.42 1.09 0.07 158 ALL_TRUSTED 1738 10.19 1.07 14.98 159 RELAYCOUNTRY_RU 1726 0.38 1.07 0.02 160 TVD_RCVD_IP 1685 0.62 1.04 0.41 161 XM_H_Undi_Recip 1673 0.47 1.03 0.18 162 XM_DIRTYINTL 1668 0.43 1.03 0.12 163 XM_B_DNDMA 1667 0.95 1.03 0.90 164 XMMoneyMeta_00 1658 0.68 1.02 0.50 165 TR_Symld_Words 1655 1.66 1.02 2.00 166 TR_XM_Base64_M1 1639 0.79 1.01 0.67 167 MPART_ALT_DIFF_COUNT 1623 0.79 1.00 0.68 168 TR_XM_DK_Bayes 1592 4.34 0.98 6.10 169 XMSubMetaSxObfu_03 1573 0.89 0.97 0.84 170 BAYES_20 1562 2.39 0.96 3.14 171 XMBounce_01 1532 0.33 0.95 0.01 172 HELO_DYNAMIC_SPLIT_IP 1499 0.32 0.93 0.01 173 SHOPIFY_IMG_NOT_RCVD_SFY 1499 0.60 0.93 0.44 174 DIET_1 1472 0.50 0.91 0.28 175 T_Symld_Words_02 1458 0.93 0.90 0.95 176 TM2_M_OBFU_COMMENT 1454 0.52 0.90 0.33 177 TR_Mismatch_TLD_01 1437 0.46 0.89 0.23 178 RELAYCOUNTRY_IN 1410 0.34 0.87 0.06 179 HTTPS_HTTP_MISMATCH 1408 0.81 0.87 0.78 180 TR_XM_Undi_Recip19 1384 0.33 0.85 0.06 181 RCVD_IN_PSBL 1380 0.34 0.85 0.08 182 XMSexyCombo_01 1375 0.77 0.85 0.73 183 XM_B_Phish66 1355 0.53 0.84 0.36 184 XM_UB99 1346 0.29 0.83 0.01 185 FILL_THIS_FORM 1344 0.66 0.83 0.57 186 XMHTMLBadTable_001 1306 0.50 0.81 0.34 187 DKIM_ADSP_CUSTOM_MED 1301 0.84 0.80 0.86 188 XMPhish14 1287 0.50 0.79 0.35 189 XMLngstWrd_00 1277 0.53 0.79 0.39 190 XMHTML_After_End 1264 0.45 0.78 0.28 191 PDS_OTHER_BAD_TLD 1259 0.36 0.78 0.13 192 TR_XM_Base64_L1 1257 0.36 0.78 0.15 193 URIBL_BLACK 1243 0.30 0.77 0.06 194 XMSlimDrugH 1223 0.57 0.75 0.48 195 TR_XM_COVIDMETA4 1213 0.34 0.75 0.12 196 TR_MetaPhish_Combo_01 1213 0.72 0.75 0.70 197 XMReplyNow 1212 0.37 0.75 0.16 198 RELAYCOUNTRY_FR 1207 0.42 0.75 0.25 199 FILL_THIS_FORM_LONG 1199 0.39 0.74 0.21 200 TR_XM_DK_SendGrid 1198 0.88 0.74 0.95 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 265407 89.41 95.77 86.07 2 RELAYCOUNTRY_US 251544 83.12 86.07 81.57 3 DKIM_SIGNED 238274 82.66 92.93 77.27 4 XM_DK_Pass 234314 80.75 89.83 75.98 5 DKIM_VALID 231319 79.65 88.47 75.01 6 XM_B_Unicode 219351 76.51 86.76 71.13 7 BAYES_50 188600 53.18 37.99 61.16 8 DKIM_VALID_AU 186032 64.53 72.54 60.33 9 DCC_CHECK_NEGATIVE 180651 46.54 23.62 58.58 10 XMListUnsubscribeExists 166477 61.38 75.45 53.98 11 XM_B_SpammyWords 144226 55.76 72.86 46.77 12 XM_B_Unicode3 134840 44.80 46.85 43.73 13 DCC_CHECK 127626 53.44 76.37 41.39 14 RCVD_IN_MSPIKE_H2 99250 34.92 40.12 32.18 15 HTML_FONT_LOW_CONTRAST 94208 33.95 40.41 30.55 16 LOC_TINY_FONT_1 89885 36.07 49.25 29.15 17 DKIM_VALID_EF 85776 27.36 26.49 27.82 18 T_TM2_M_HEADER_IN_MSG 84840 26.02 23.17 27.51 19 FVGT_m_MULTI_ODD 78526 29.53 37.25 25.46 20 XMSubLong 68613 21.74 20.77 22.25 21 T_KAM_HTML_FONT_INVALID 65381 24.55 30.92 21.20 22 MIME_HTML_ONLY 64328 22.04 24.30 20.86 23 XM_B_SpammyWords2 63808 27.40 40.16 20.69 24 USER_IN_DEF_DKIM_WL 48294 11.56 3.75 15.66 25 XM_Multi_Part_URI 48187 17.59 21.34 15.63 26 ALL_TRUSTED 46199 10.19 1.07 14.98 27 TR_XM_DK_Unsub 40786 15.26 19.13 13.23 28 UNPARSEABLE_RELAY 36282 12.83 14.85 11.77 29 BAYES_60 30132 8.99 7.50 9.77 30 XM_Evil_Numbers_Gen 29698 9.73 9.92 9.63 31 XM_B_PhoneNumber 28078 7.76 5.20 9.11 32 LotsOfNums_01 25913 8.55 8.82 8.40 33 BAYES_00 25425 5.78 1.10 8.24 34 TooManyTo_001 25161 6.78 4.15 8.16 35 XM_DKIMWhitelistDomains 23902 5.10 0.04 7.75 36 XM_B_Unsub 22792 9.97 14.88 7.39 37 LOTS_OF_MONEY 21120 9.98 15.94 6.85 38 IN_ZIMBRA_NJ_WHITELIST 20854 4.46 0.09 6.76 39 TR_MAX_INTL_RELAY 20643 8.90 13.10 6.69 40 T_TooManySym_01 19689 4.92 2.13 6.38 41 TR_XM_BayesUnsub 19402 9.08 14.38 6.29 42 FSL_BULK_SIG 18969 6.57 7.36 6.15 43 TR_XM_DK_Bayes 18818 4.34 0.98 6.10 44 TR_XM_DK_Bayes1 18410 4.09 0.50 5.97 45 XM_B_SpammyWords3 18111 8.40 13.21 5.87 46 XM_DK_Undo_02 17919 20.21 47.63 5.81 47 XM_H_Long_From01 17515 5.68 5.68 5.68 48 MIME_QP_LONG_LINE 17031 4.87 3.63 5.52 49 RCVD_IN_MSPIKE_WL 16423 4.74 3.64 5.33 50 RCVD_IN_MSPIKE_H3 16422 4.74 3.64 5.33 51 RCVD_IN_VALIDITY_SAFE 15958 5.04 4.77 5.17 52 TR_XM_DK_Bayes2 15451 3.40 0.32 5.01 53 HTML_IMAGE_RATIO_04 15431 5.64 6.84 5.00 54 HTML_IMAGE_RATIO_02 15233 5.74 7.27 4.94 55 XM_H_GMP 15174 4.89 4.84 4.92 56 TR_XM_SpammyWords4 15100 8.00 13.91 4.90 57 XMStrtUSub 14384 4.19 3.29 4.66 58 BAYES_40 14375 3.48 1.24 4.66 59 BAYES_99 13810 15.99 37.89 4.48 60 XMSubMetaSx_00 13641 4.90 5.80 4.42 61 MPART_ALT_DIFF 13534 5.02 6.23 4.39 62 RCVD_IN_VALIDITY_CERTIFIED 13340 4.16 3.84 4.33 63 RELAYCOUNTRY_META 13230 7.83 14.57 4.29 64 XM_B_SpammyTLD 13141 4.01 3.54 4.26 65 XM_B_Phish_Phrases 13052 4.38 4.65 4.23 66 BAYES_80 12846 5.51 8.05 4.17 67 RCVD_IN_IADB_LISTED 12704 3.17 1.35 4.12 68 XM_PDF 12199 2.76 0.47 3.96 69 XM_UncommonTLD01 12197 4.35 5.09 3.96 70 RCVD_IN_IADB_SPF 11278 2.82 1.21 3.66 71 T_REMOTE_IMAGE 11196 2.85 1.37 3.63 72 BAYES_999 10537 12.99 31.22 3.42 73 XM_Body_Dirty_Words 10408 4.70 7.23 3.38 74 ANY_BOUNCE_MESSAGE 10332 2.80 1.75 3.35 75 BOUNCE_MESSAGE 10332 2.80 1.75 3.35 76 BOTNET_IPINHOSTNAME 10296 6.58 12.76 3.34 77 RCVD_IN_IADB_SENDERID 10086 2.54 1.14 3.27 78 RCVD_IN_IADB_DK 9865 2.49 1.15 3.20 79 XMNumbers 9736 3.04 2.82 3.16 80 BAYES_20 9698 2.39 0.96 3.14 81 URI_NOVOWEL 9614 2.53 1.41 3.12 82 MIME_HTML_MOSTLY 8733 3.05 3.46 2.83 83 HTML_IMAGE_RATIO_08 8431 3.03 3.59 2.73 84 TooManyTo_002 8426 2.03 0.70 2.73 85 MAILING_LIST_MULTI 8220 2.39 1.86 2.67 86 T_TooManySym_02 8219 1.93 0.53 2.67 87 TR_XM_DKIM_Undo 8073 13.87 35.28 2.62 88 RCVD_IN_IADB_VOUCHED 7992 1.93 0.66 2.59 89 XMSexyCombo_05 7877 2.94 3.67 2.55 90 BAYES_95 7791 3.29 4.76 2.53 91 TR_XM_SpammyRelay 7789 5.08 9.93 2.53 92 HTML_IMAGE_RATIO_06 7735 3.39 5.07 2.51 93 XM_CamelCaseFrm001 7639 2.84 3.52 2.48 94 INVALID_MSGID 7288 1.59 0.13 2.36 95 FROM_EXCESS_BASE64 7278 2.41 2.49 2.36 96 MIME_HTML_ONLY_MULTI 7031 2.74 3.61 2.28 97 DKIM_INVALID 6955 3.02 4.46 2.26 98 HTML_MIME_NO_HTML_TAG 6954 1.90 1.23 2.26 99 TO_MALFORMED 6685 1.43 0.03 2.17 100 TR_Symld_Words 6171 1.66 1.02 2.00 101 XMStockSpam_06 6099 1.89 1.73 1.98 102 TR_XM_UnparsRelay 5911 3.99 7.94 1.92 103 RCVD_IN_IADB_OPTIN 5712 1.36 0.41 1.85 104 BAYES_05 5699 1.38 0.50 1.85 105 TM2_M_URI_OPT_OUT 5550 2.56 4.00 1.80 106 XM_DK_Undo_01 5548 1.74 1.62 1.80 107 XM_SPF_SoftFail 5457 2.81 4.79 1.77 108 TR_DCC_Bayes_99 5426 11.01 28.62 1.76 109 TR_XM_SpammyWords5 5425 2.63 4.29 1.76 110 UNTRUSTED_Relay 5132 3.34 6.54 1.66 111 TR_XM_PhishingBody 5109 2.32 3.59 1.66 112 T_XMDrugObfuBody_14 4965 2.56 4.37 1.61 113 XMDiploma_00 4823 1.73 2.04 1.56 114 SUBJ_ALL_CAPS 4778 2.02 2.90 1.55 115 IN_HORDE_ADDRESS_BOOK 4721 1.03 0.08 1.53 116 XM_B_SEO 4701 2.52 4.42 1.52 117 TM2_M_VERY_LONG_WORD 4491 2.25 3.76 1.46 118 XM_B_Investor 4471 2.52 4.57 1.45 119 KHOP_HELO_FCRDNS 4418 1.41 1.37 1.43 120 XM_SendGrid 4418 1.37 1.26 1.43 121 HELO_NODOT 4347 1.02 0.28 1.41 122 HELO_NO_DOMAIN 4346 1.02 0.28 1.41 123 T_XMDrugObfuBody_08 4305 1.85 2.71 1.40 124 XM_B_SpammyWords4 4253 1.70 2.33 1.38 125 BOTNET 4101 3.73 8.30 1.33 126 TooManyTo_003 4033 1.04 0.54 1.31 127 XMGappySubj_01 3973 0.90 0.15 1.29 128 XMBrknScrpt_02 3867 1.99 3.39 1.25 129 TVD_SPACE_RATIO 3655 0.82 0.11 1.19 130 RELAYCOUNTRY_CA 3606 2.43 4.83 1.17 131 XM_B_Unsub2 3455 1.38 1.88 1.12 132 RELAYCOUNTRY_AU 3354 1.60 2.58 1.09 133 URI_HEX 3275 1.17 1.36 1.06 134 XM_GoogleGroups 3271 0.89 0.56 1.06 135 XM_UB50 3219 2.00 3.81 1.04 136 XMBdyGiftCard01 3103 1.27 1.76 1.01 137 XM_TLDProd2 3074 0.79 0.40 1.00 138 XM_H_Long_From02 3007 1.11 1.37 0.98 139 XM_OfRef6 2961 1.85 3.53 0.96 140 TR_XM_DK_SendGrid 2927 0.88 0.74 0.95 141 T_Symld_Words_02 2923 0.93 0.90 0.95 142 T_TooManySym_03 2922 0.68 0.17 0.95 143 TooManyTo_004 2901 0.79 0.51 0.94 144 XMCapTrack 2858 0.78 0.49 0.93 145 XM_ShortIntro_01 2846 1.02 1.21 0.92 146 TR_XM_SEO4 2836 1.96 3.95 0.92 147 XM_B_DNDMA 2780 0.95 1.03 0.90 148 T_XMDrugObfuBody_00 2744 1.17 1.70 0.89 149 XM_B_FormFill 2700 0.60 0.09 0.88 150 RCVD_IN_BL_SPAMCOP_NET 2660 3.90 9.69 0.86 151 URI_TRY_3LD 2657 1.00 1.25 0.86 152 DKIM_ADSP_CUSTOM_MED 2639 0.84 0.80 0.86 153 XMSubMetaSxObfu_03 2595 0.89 0.97 0.84 154 T_FILL_THIS_FORM_SHORT 2522 0.91 1.09 0.82 155 XMSubMetaI_00 2471 1.05 1.52 0.80 156 TooManyTo_005 2425 0.68 0.49 0.79 157 HTTPS_HTTP_MISMATCH 2412 0.81 0.87 0.78 158 XMGappySubj_02 2250 0.49 0.04 0.73 159 XMSexyCombo_01 2248 0.77 0.85 0.73 160 T_XMHurry_00 2244 1.08 1.74 0.73 161 TR_MetaPhish_Combo_01 2169 0.72 0.75 0.70 162 SpammyFromTLD_01 2134 1.08 1.80 0.69 163 TR_XM_SpammyWords2 2130 5.14 13.61 0.69 164 XM_ProductURIs 2130 0.84 1.12 0.69 165 MPART_ALT_DIFF_COUNT 2110 0.79 1.00 0.68 166 XMBody_95 2108 0.51 0.18 0.68 167 XM_B_COPY_HTML 2100 0.85 1.18 0.68 168 TR_XM_Base64_M1 2077 0.79 1.01 0.67 169 XMNoVowels 2075 0.56 0.36 0.67 170 XMBody_17 2048 2.18 5.06 0.66 171 XMGenDplmaNmb 2014 0.81 1.11 0.65 172 DKIM_ADSP_NXDOMAIN 1995 0.91 1.42 0.65 173 T_OBFU_PDF_ATTACH 1957 0.45 0.10 0.63 174 XMSubMetaSx_01 1796 0.43 0.13 0.58 175 XMSexyCombo_04 1790 0.48 0.28 0.58 176 XM_H_PHPMailer 1780 0.60 0.65 0.58 177 FILL_THIS_FORM 1753 0.66 0.83 0.57 178 XMClaimOffer 1710 0.55 0.54 0.55 179 THIS_AD 1695 0.77 1.18 0.55 180 T_TVD_MIME_NO_HEADERS 1632 0.36 0.03 0.53 181 NML_ADSP_CUSTOM_MED 1604 0.56 0.65 0.52 182 FORGED_GMAIL_RCVD 1599 0.57 0.67 0.52 183 TR_LOTS_OF_MONEY3 1597 1.46 3.25 0.52 184 T_MANY_PILL_PRICE 1594 0.34 0.00 0.52 185 XMMoneyMeta_00 1544 0.68 1.02 0.50 186 PLING_QUERY 1525 0.52 0.58 0.49 187 USER_IN_WHITELIST 1504 0.32 0.00 0.49 188 USER_IN_WELCOMELIST 1504 0.32 0.00 0.49 189 XMPhish30 1502 0.76 1.28 0.49 190 XMSlimDrugH 1467 0.57 0.75 0.48 191 SpammyFromTLD_02 1431 0.84 1.56 0.46 192 HTML_IMAGE_ONLY_20 1396 0.49 0.56 0.45 193 HTML_FONT_FACE_BAD 1374 0.50 0.60 0.45 194 SHOPIFY_IMG_NOT_RCVD_SFY 1346 0.60 0.93 0.44 195 TO_NO_BRKTS_HTML_ONLY 1321 0.34 0.17 0.43 196 TR_XM_SPAMCOP 1318 2.95 7.76 0.43 197 SHORT_HELO_AND_INLINE_IMAGE 1307 0.29 0.04 0.42 198 XMSubMetaSxObfu_02 1304 0.37 0.27 0.42 199 FROM_GOV_DKIM_AU 1300 0.32 0.14 0.42 200 XM_B_REG_HTML 1285 0.66 1.12 0.42 ----------------------------------------------------------------------