Email: 322248 Autolearn: 0 AvgScore: 5.10 AvgScanTime: 1.34 sec Spam: 121508 Autolearn: 0 AvgScore: 14.11 AvgScanTime: 1.39 sec Ham: 200740 Autolearn: 0 AvgScore: -0.35 AvgScanTime: 1.32 sec Time Spent Running SA: 120.20 hours Time Spent Processing Spam: 46.80 hours Time Spent Processing Ham: 73.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 117972 88.46 97.09 83.24 2 DKIM_SIGNED 111358 83.57 91.65 78.68 3 RELAYCOUNTRY_US 105819 83.11 87.09 80.70 4 XM_DK_Pass 103624 80.58 85.28 77.73 5 XM_B_Unicode 103114 76.42 84.86 71.30 6 DKIM_VALID 102778 79.99 84.59 77.20 7 DCC_CHECK 95230 59.49 78.37 48.06 8 XM_B_SpammyWords 89482 57.31 73.64 47.43 9 XMListUnsubscribeExists 88577 61.72 72.90 54.95 10 DKIM_VALID_AU 84416 67.39 69.47 66.13 11 LOC_TINY_FONT_1 58301 38.39 47.98 32.58 12 XM_B_Unicode3 56675 46.56 46.64 46.51 13 XM_DK_Undo_02 53898 20.68 44.36 6.35 14 XM_B_SpammyWords2 51454 29.23 42.35 21.30 15 HTML_FONT_LOW_CONTRAST 51145 35.90 42.09 32.16 16 BAYES_99 46781 17.52 38.50 4.83 17 RCVD_IN_MSPIKE_H2 46645 34.95 38.39 32.86 18 BAYES_50 42655 50.29 35.10 59.48 19 TR_XM_DKIM_Undo 39773 13.96 32.73 2.59 20 FVGT_m_MULTI_ODD 38288 27.98 31.51 25.85 21 BAYES_999 38119 14.20 31.37 3.80 22 MIME_HTML_ONLY 36835 24.96 30.31 21.72 23 T_KAM_HTML_FONT_INVALID 35755 23.83 29.43 20.44 24 TR_DCC_Bayes_99 35727 12.26 29.40 1.89 25 DKIM_VALID_EF 29794 27.34 24.52 29.05 26 XMSubLong 27005 21.78 22.22 21.51 27 XM_Multi_Part_URI 26119 19.94 21.50 19.00 28 DCC_CHECK_NEGATIVE 25775 40.33 21.21 51.91 29 T_TM2_M_HEADER_IN_MSG 24207 21.59 19.92 22.60 30 XM_B_Unsub 22470 12.58 18.49 9.00 31 UNPARSEABLE_RELAY 22124 14.25 18.21 11.85 32 TR_XM_BayesUnsub 22032 11.52 18.13 7.52 33 TR_XM_DK_Unsub 21517 15.43 17.71 14.04 34 XM_B_SpammyWords3 18340 10.36 15.09 7.50 35 TR_MAX_INTL_RELAY 17809 9.71 14.66 6.71 36 TR_XM_SpammyWords2 17501 5.80 14.40 0.59 37 RELAYCOUNTRY_META 17000 7.78 13.99 4.02 38 LOTS_OF_MONEY 15864 9.33 13.06 7.07 39 BOTNET_IPINHOSTNAME 14501 6.61 11.93 3.39 40 TR_XM_SpammyWords4 14049 7.57 11.56 5.16 41 TR_XM_UnparsRelay 12760 5.07 10.50 1.79 42 TR_XM_SpammyRelay 12294 5.33 10.12 2.43 43 BOTNET 12206 4.48 10.05 1.11 44 FSL_BULK_SIG 11409 9.08 9.39 8.89 45 BAYES_80 10975 5.94 9.03 4.07 46 HTML_IMAGE_RATIO_02 10194 6.96 8.39 6.09 47 BAYES_60 9926 9.36 8.17 10.08 48 RCVD_IN_BL_SPAMCOP_NET 9775 3.71 8.04 1.09 49 XM_Evil_Numbers_Gen 9622 10.14 7.92 11.49 50 XM_Body_Dirty_Words 8768 4.75 7.22 3.25 51 DKIM_INVALID 8580 3.58 7.06 1.48 52 XM_B_Phish_Phrases 8481 5.96 6.98 5.34 53 LotsOfNums_01 7771 7.08 6.40 7.50 54 TR_XM_SPAMCOP 7643 2.71 6.29 0.54 55 XMSubMetaSx_00 7537 4.36 6.20 3.25 56 MPART_ALT_DIFF 7453 5.21 6.13 4.64 57 XMBody_17 7244 2.75 5.96 0.80 58 XM_H_Long_From01 7172 5.55 5.90 5.34 59 XM_UncommonTLD01 6888 4.96 5.67 4.52 60 XMSexyCombo_05 6743 3.35 5.55 2.02 61 XMStrtUSub 6602 6.09 5.43 6.48 62 RELAYCOUNTRY_CA 6546 3.08 5.39 1.68 63 TooManyTo_001 6515 5.43 5.36 5.47 64 UNTRUSTED_Relay 6369 2.93 5.24 1.53 65 BAYES_95 6354 3.62 5.23 2.64 66 HTML_IMAGE_RATIO_04 6350 5.07 5.23 4.98 67 XM_B_PhoneNumber 6162 5.67 5.07 6.03 68 MIME_HTML_MOSTLY 5470 3.74 4.50 3.28 69 XM_H_GMP 5384 5.01 4.43 5.36 70 XM_B_Investor 5152 2.30 4.24 1.12 71 XM_B_SEO 5049 2.29 4.16 1.16 72 T_XMDrugObfuBody_14 5048 2.76 4.15 1.92 73 XM_SPF_SoftFail 4905 2.43 4.04 1.45 74 RCVD_IN_VALIDITY_RPBL 4879 1.61 4.02 0.16 75 TR_XM_SpammyWords5 4868 2.70 4.01 1.90 76 XMNumbers 4602 3.63 3.79 3.54 77 TR_XM_SEO4 4410 1.83 3.63 0.75 78 MIME_HTML_ONLY_MULTI 4280 2.77 3.52 2.32 79 TR_LOTS_OF_MONEY3 4216 1.76 3.47 0.72 80 USER_IN_DEF_DKIM_WL 4161 14.25 3.42 20.80 81 TR_XM_PhishingBody 4134 2.33 3.40 1.68 82 HTML_IMAGE_RATIO_06 4013 3.45 3.30 3.54 83 XM_CamelCaseFrm001 3974 3.08 3.27 2.96 84 XMBrknScrpt_02 3847 2.18 3.17 1.59 85 HTML_IMAGE_RATIO_08 3845 2.46 3.16 2.04 86 RCVD_IN_MSPIKE_WL 3766 4.64 3.10 5.57 87 RCVD_IN_MSPIKE_H3 3766 4.64 3.10 5.57 88 XM_H_DKIM_GOOG 3745 1.17 3.08 0.02 89 XM_URI_RBL 3743 1.69 3.08 0.85 90 XM_B_SpammyTLD 3742 4.57 3.08 5.47 91 T_XMDrugObfuBody_08 3706 2.03 3.05 1.42 92 RCVD_IN_VALIDITY_SAFE 3686 5.90 3.03 7.63 93 XM_B_Unsub2 3613 2.01 2.97 1.43 94 T_FILL_THIS_FORM_SHORT 3570 1.54 2.94 0.69 95 XMDiploma_00 3526 1.95 2.90 1.37 96 TM2_M_VERY_LONG_WORD 3422 1.96 2.82 1.45 97 XM_OfRef6 3415 1.52 2.81 0.74 98 XM_UB50 3261 1.56 2.68 0.88 99 XM_B_URI_Unicode 3188 2.17 2.62 1.90 100 T_XMHurry_00 3124 1.55 2.57 0.93 101 TR_XM_NoHeaderRelay 2967 1.02 2.44 0.17 102 XM_B_SpammyWords4 2914 1.60 2.40 1.12 103 TR_XM_INV_DKIM 2837 0.93 2.33 0.07 104 LONGLN_LOW_CONTRAST 2727 1.24 2.24 0.63 105 TR_XM_FormFill 2717 0.86 2.24 0.02 106 XMStockSpam_06 2701 2.31 2.22 2.37 107 RCVD_IN_VALIDITY_CERTIFIED 2700 4.48 2.22 5.84 108 XM_DK_Undo_01 2696 1.90 2.22 1.71 109 FROM_EXCESS_BASE64 2635 2.59 2.17 2.84 110 TM2_M_URI_OPT_OUT 2610 1.97 2.15 1.87 111 RELAYCOUNTRY_AU 2552 1.23 2.10 0.70 112 DIET_1 2472 0.95 2.03 0.30 113 HTML_MIME_NO_HTML_TAG 2431 1.66 2.00 1.46 114 SpammyFromTLD_01 2374 1.11 1.95 0.59 115 SUBJ_ALL_CAPS 2287 1.52 1.88 1.30 116 T_REMOTE_IMAGE 2253 2.95 1.85 3.62 117 XM_B_REG_HTML 2250 0.82 1.85 0.20 118 T_TooManySym_01 2226 4.58 1.83 6.25 119 HTML_TAG_BALANCE_BODY 2153 1.37 1.77 1.13 120 XMGenDplmaNmb 2099 0.98 1.73 0.53 121 MIME_QP_LONG_LINE 2075 2.87 1.71 3.58 122 T_XMDrugObfuBody_00 2034 1.17 1.67 0.86 123 XMBdyGiftCard01 2004 1.70 1.65 1.73 124 HOSTED_IMG_MULTI_PUB_01 1952 0.69 1.61 0.14 125 MAILING_LIST_MULTI 1908 1.91 1.57 2.12 126 KHOP_HELO_FCRDNS 1866 1.33 1.54 1.20 127 URI_NOVOWEL 1850 2.93 1.52 3.78 128 HDRS_MISSP 1835 0.58 1.51 0.01 129 THIS_AD 1811 0.88 1.49 0.51 130 TooManyTo_002 1809 1.33 1.49 1.23 131 SHOPIFY_IMG_NOT_RCVD_SFY 1740 0.74 1.43 0.32 132 BAYES_40 1704 3.11 1.40 4.14 133 XMPhish30 1671 0.99 1.38 0.75 134 XMHTMLBadTable_001 1648 0.68 1.36 0.27 135 TR_XM_PHPDW 1564 0.66 1.29 0.27 136 XM_HighProb1 1552 0.48 1.28 0.00 137 TR_XM_PHPForged 1544 0.65 1.27 0.27 138 BOTNET_NORDNS 1526 0.48 1.26 0.01 139 RELAYCOUNTRY_FR 1523 0.61 1.25 0.22 140 NORDNS_LOW_CONTRAST 1518 0.50 1.25 0.05 141 URI_TRY_3LD 1497 1.09 1.23 1.01 142 TR_XM_FormFill2 1497 0.63 1.23 0.27 143 XM_H_PHPOS 1482 0.62 1.22 0.26 144 T_STY_INVIS_DIRECT 1476 0.72 1.21 0.42 145 URI_HEX 1466 1.12 1.21 1.08 146 ALL_TRUSTED 1457 10.15 1.20 15.57 147 XM_ProductURIs 1426 0.91 1.17 0.75 148 T_MONEY_PERCENT 1396 0.83 1.15 0.64 149 TR_LOTS_OF_MONEY2 1396 0.83 1.15 0.64 150 XM_B_COPY_HTML 1383 1.12 1.14 1.11 151 TR_Symld_Words 1371 1.28 1.13 1.37 152 TR_XM_RelayPhish 1339 0.47 1.10 0.09 153 SpammyFromTLD_02 1331 0.54 1.10 0.21 154 MPART_ALT_DIFF_COUNT 1329 0.69 1.09 0.45 155 BAYES_20 1309 2.18 1.08 2.85 156 HTML_IMAGE_ONLY_24 1294 0.55 1.06 0.24 157 XMSubMetaI_00 1271 0.78 1.05 0.61 158 XM_H_Long_From02 1242 0.95 1.02 0.90 159 AC_BR_BONANZA 1156 0.48 0.95 0.19 160 HTML_FONT_TINY_NORDNS 1145 0.40 0.94 0.07 161 XM_B_FormFill 1092 0.39 0.90 0.08 162 HTTPS_HTTP_MISMATCH 1088 0.65 0.90 0.49 163 XM_Appointment_Request 1082 0.34 0.89 0.00 164 LongTLD 1078 0.46 0.89 0.20 165 XMReplyNow 1053 0.46 0.87 0.22 166 TM2_M_OBFU_COMMENT 1041 0.77 0.86 0.71 167 XM_B_DNDMA 1036 0.93 0.85 0.98 168 XM_SendGrid 1018 1.03 0.84 1.15 169 XM_B_Phish66 1018 0.47 0.84 0.24 170 XM_UB99 1010 0.32 0.83 0.01 171 DKIM_ADSP_CUSTOM_MED 1002 0.74 0.82 0.69 172 RCVD_IN_IADB_LISTED 978 2.10 0.80 2.88 173 URIBL_SBL 973 0.30 0.80 0.00 174 URIBL_SBL_A 973 0.30 0.80 0.00 175 SH_BODYURI_REVERSE_SBL 972 0.30 0.80 0.00 176 PLING_QUERY 963 0.57 0.79 0.43 177 XMSubMetaSSx_00 951 0.44 0.78 0.23 178 EXCUSE_4 934 0.30 0.77 0.01 179 XM_UB60 922 0.32 0.76 0.05 180 RELAYCOUNTRY_IN 915 0.30 0.75 0.02 181 XM_DIRTYINTL 914 0.35 0.75 0.10 182 TO_NO_BRKTS_HTML_ONLY 913 0.42 0.75 0.21 183 XM_H_Undi_Recip 907 0.36 0.75 0.12 184 TR_Caps_n_Bayes_99 899 0.29 0.74 0.01 185 TR_Mismatch_TLD_02 894 0.31 0.74 0.05 186 XMSubMetaSxObfu_02 890 0.41 0.73 0.22 187 TR_Mismatch_TLD_01 886 0.42 0.73 0.24 188 RDNS_DYNAMIC 884 0.50 0.73 0.36 189 TR_MetaPhish_Combo_01 882 0.91 0.73 1.02 190 XM_B_COVIDMETA 878 0.36 0.72 0.14 191 AC_HTML_NONSENSE_TAGS 872 0.32 0.72 0.07 192 SUBJ_DOLLARS 867 0.45 0.71 0.30 193 PDS_RDNS_DYNAMIC_FP 864 0.33 0.71 0.10 194 URI_TRUNCATED 845 0.30 0.70 0.06 195 RCVD_IN_IADB_SPF 839 1.84 0.69 2.53 196 ANY_BOUNCE_MESSAGE 839 2.98 0.69 4.36 197 BOUNCE_MESSAGE 837 2.97 0.69 4.36 198 XMPhish08 831 0.44 0.68 0.30 199 NML_ADSP_CUSTOM_MED 823 0.52 0.68 0.42 200 XMSexyCombo_01 817 0.34 0.67 0.13 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167099 88.46 97.09 83.24 2 RELAYCOUNTRY_US 161995 83.11 87.09 80.70 3 DKIM_SIGNED 157937 83.57 91.65 78.68 4 XM_DK_Pass 156039 80.58 85.28 77.73 5 DKIM_VALID 154976 79.99 84.59 77.20 6 XM_B_Unicode 143134 76.42 84.86 71.30 7 DKIM_VALID_AU 132743 67.39 69.47 66.13 8 BAYES_50 119402 50.29 35.10 59.48 9 XMListUnsubscribeExists 110301 61.72 72.90 54.95 10 DCC_CHECK_NEGATIVE 104200 40.33 21.21 51.91 11 DCC_CHECK 96480 59.49 78.37 48.06 12 XM_B_SpammyWords 95203 57.31 73.64 47.43 13 XM_B_Unicode3 93360 46.56 46.64 46.51 14 RCVD_IN_MSPIKE_H2 65971 34.95 38.39 32.86 15 LOC_TINY_FONT_1 65401 38.39 47.98 32.58 16 HTML_FONT_LOW_CONTRAST 64553 35.90 42.09 32.16 17 DKIM_VALID_EF 58311 27.34 24.52 29.05 18 FVGT_m_MULTI_ODD 51888 27.98 31.51 25.85 19 T_TM2_M_HEADER_IN_MSG 45359 21.59 19.92 22.60 20 MIME_HTML_ONLY 43597 24.96 30.31 21.72 21 XMSubLong 43182 21.78 22.22 21.51 22 XM_B_SpammyWords2 42753 29.23 42.35 21.30 23 USER_IN_DEF_DKIM_WL 41753 14.25 3.42 20.80 24 T_KAM_HTML_FONT_INVALID 41029 23.83 29.43 20.44 25 XM_Multi_Part_URI 38148 19.94 21.50 19.00 26 ALL_TRUSTED 31257 10.15 1.20 15.57 27 TR_XM_DK_Unsub 28191 15.43 17.71 14.04 28 UNPARSEABLE_RELAY 23781 14.25 18.21 11.85 29 XM_Evil_Numbers_Gen 23064 10.14 7.92 11.49 30 XM_DKIMWhitelistDomains 20603 6.43 0.10 10.26 31 BAYES_00 20359 6.48 0.43 10.14 32 BAYES_60 20226 9.36 8.17 10.08 33 TR_XM_DK_Bayes 18373 5.84 0.37 9.15 34 TR_XM_DK_Bayes1 18232 5.79 0.36 9.08 35 XM_B_Unsub 18059 12.58 18.49 9.00 36 FSL_BULK_SIG 17843 9.08 9.39 8.89 37 TR_XM_DK_Bayes2 16583 5.23 0.23 8.26 38 RCVD_IN_VALIDITY_SAFE 15313 5.90 3.03 7.63 39 TR_XM_BayesUnsub 15093 11.52 18.13 7.52 40 LotsOfNums_01 15057 7.08 6.40 7.50 41 XM_B_SpammyWords3 15047 10.36 15.09 7.50 42 LOTS_OF_MONEY 14186 9.33 13.06 7.07 43 TR_MAX_INTL_RELAY 13477 9.71 14.66 6.71 44 XMStrtUSub 13013 6.09 5.43 6.48 45 XM_DK_Undo_02 12745 20.68 44.36 6.35 46 T_TooManySym_01 12545 4.58 1.83 6.25 47 HTML_IMAGE_RATIO_02 12234 6.96 8.39 6.09 48 XM_B_PhoneNumber 12104 5.67 5.07 6.03 49 RCVD_IN_VALIDITY_CERTIFIED 11723 4.48 2.22 5.84 50 RCVD_IN_MSPIKE_WL 11188 4.64 3.10 5.57 51 RCVD_IN_MSPIKE_H3 11188 4.64 3.10 5.57 52 IN_ZIMBRA_NJ_WHITELIST 11122 3.57 0.31 5.54 53 XM_B_SpammyTLD 10977 4.57 3.08 5.47 54 TooManyTo_001 10973 5.43 5.36 5.47 55 XM_H_GMP 10768 5.01 4.43 5.36 56 XM_B_Phish_Phrases 10727 5.96 6.98 5.34 57 XM_H_Long_From01 10714 5.55 5.90 5.34 58 TR_XM_SpammyWords4 10350 7.57 11.56 5.16 59 HTML_IMAGE_RATIO_04 9992 5.07 5.23 4.98 60 BAYES_99 9686 17.52 38.50 4.83 61 MPART_ALT_DIFF 9322 5.21 6.13 4.64 62 XM_UncommonTLD01 9080 4.96 5.67 4.52 63 ANY_BOUNCE_MESSAGE 8749 2.98 0.69 4.36 64 BOUNCE_MESSAGE 8746 2.97 0.69 4.36 65 BAYES_40 8302 3.11 1.40 4.14 66 BAYES_80 8179 5.94 9.03 4.07 67 RELAYCOUNTRY_META 8064 7.78 13.99 4.02 68 BAYES_999 7636 14.20 31.37 3.80 69 URI_NOVOWEL 7580 2.93 1.52 3.78 70 T_TooManySym_02 7416 2.47 0.44 3.69 71 T_REMOTE_IMAGE 7257 2.95 1.85 3.62 72 MIME_QP_LONG_LINE 7178 2.87 1.71 3.58 73 XMNumbers 7101 3.63 3.79 3.54 74 HTML_IMAGE_RATIO_06 7097 3.45 3.30 3.54 75 INVALID_MSGID 7003 2.24 0.17 3.49 76 BOTNET_IPINHOSTNAME 6800 6.61 11.93 3.39 77 MIME_HTML_MOSTLY 6577 3.74 4.50 3.28 78 XM_Body_Dirty_Words 6528 4.75 7.22 3.25 79 XMSubMetaSx_00 6522 4.36 6.20 3.25 80 TO_MALFORMED 6205 1.93 0.00 3.09 81 XM_CamelCaseFrm001 5936 3.08 3.27 2.96 82 RCVD_IN_IADB_LISTED 5781 2.10 0.80 2.88 83 BAYES_20 5725 2.18 1.08 2.85 84 FROM_EXCESS_BASE64 5696 2.59 2.17 2.84 85 BAYES_95 5296 3.62 5.23 2.64 86 TR_XM_DKIM_Undo 5208 13.96 32.73 2.59 87 RCVD_IN_IADB_SPF 5076 1.84 0.69 2.53 88 XM_PDF 4926 1.64 0.30 2.45 89 TR_XM_SpammyRelay 4873 5.33 10.12 2.43 90 XMStockSpam_06 4751 2.31 2.22 2.37 91 MIME_HTML_ONLY_MULTI 4662 2.77 3.52 2.32 92 RCVD_IN_IADB_SENDERID 4554 1.66 0.65 2.27 93 RCVD_IN_IADB_DK 4458 1.63 0.65 2.22 94 MAILING_LIST_MULTI 4256 1.91 1.57 2.12 95 HTML_IMAGE_RATIO_08 4093 2.46 3.16 2.04 96 XMSexyCombo_05 4046 3.35 5.55 2.02 97 T_XMDrugObfuBody_14 3847 2.76 4.15 1.92 98 TR_XM_SpammyWords5 3822 2.70 4.01 1.90 99 XM_B_URI_Unicode 3806 2.17 2.62 1.90 100 TR_DCC_Bayes_99 3788 12.26 29.40 1.89 101 TM2_M_URI_OPT_OUT 3753 1.97 2.15 1.87 102 RCVD_IN_IADB_VOUCHED 3715 1.31 0.42 1.85 103 TR_XM_UnparsRelay 3591 5.07 10.50 1.79 104 BAYES_05 3565 1.35 0.64 1.78 105 XMBdyGiftCard01 3482 1.70 1.65 1.73 106 IN_HORDE_ADDRESS_BOOK 3478 1.17 0.24 1.73 107 XM_DK_Undo_01 3433 1.90 2.22 1.71 108 RELAYCOUNTRY_CA 3372 3.08 5.39 1.68 109 TR_XM_PhishingBody 3367 2.33 3.40 1.68 110 TVD_SPACE_RATIO 3358 1.09 0.12 1.67 111 XMBrknScrpt_02 3187 2.18 3.17 1.59 112 UNTRUSTED_Relay 3062 2.93 5.24 1.53 113 DKIM_INVALID 2961 3.58 7.06 1.48 114 XMGappySubj_01 2951 0.97 0.14 1.47 115 HTML_MIME_NO_HTML_TAG 2923 1.66 2.00 1.46 116 XM_SPF_SoftFail 2914 2.43 4.04 1.45 117 TM2_M_VERY_LONG_WORD 2902 1.96 2.82 1.45 118 XM_TLDProd2 2892 1.01 0.30 1.44 119 XM_B_Unsub2 2870 2.01 2.97 1.43 120 T_XMDrugObfuBody_08 2851 2.03 3.05 1.42 121 XMDiploma_00 2748 1.95 2.90 1.37 122 TR_Symld_Words 2748 1.28 1.13 1.37 123 T_TVD_MIME_NO_HEADERS 2712 0.87 0.08 1.35 124 SUBJ_ALL_CAPS 2600 1.52 1.88 1.30 125 RCVD_IN_IADB_OPTIN 2585 0.90 0.26 1.29 126 T_TooManySym_03 2504 0.84 0.17 1.25 127 TooManyTo_002 2463 1.33 1.49 1.23 128 KHOP_HELO_FCRDNS 2417 1.33 1.54 1.20 129 XMGappySubj_02 2340 0.74 0.04 1.17 130 XM_B_SEO 2333 2.29 4.16 1.16 131 XM_SendGrid 2311 1.03 0.84 1.15 132 HTML_TAG_BALANCE_BODY 2275 1.37 1.77 1.13 133 XM_B_Investor 2256 2.30 4.24 1.12 134 XM_B_SpammyWords4 2254 1.60 2.40 1.12 135 XM_B_COPY_HTML 2235 1.12 1.14 1.11 136 BOTNET 2224 4.48 10.05 1.11 137 XM_GoogleGroups 2215 0.91 0.59 1.10 138 RCVD_IN_BL_SPAMCOP_NET 2185 3.71 8.04 1.09 139 XMBody_95 2159 0.84 0.46 1.08 140 URI_HEX 2159 1.12 1.21 1.08 141 TR_MetaPhish_Combo_01 2051 0.91 0.73 1.02 142 URI_TRY_3LD 2025 1.09 1.23 1.01 143 HTML_TEXT_INVISIBLE_STYLE 2013 0.76 0.37 1.00 144 HTML_EXTRA_CLOSE 2000 0.63 0.02 1.00 145 XM_B_DNDMA 1968 0.93 0.85 0.98 146 T_XMHurry_00 1858 1.55 2.57 0.93 147 XM_H_Long_From02 1812 0.95 1.02 0.90 148 XM_UB50 1757 1.56 2.68 0.88 149 TooManyTo_003 1746 0.76 0.57 0.87 150 T_XMDrugObfuBody_00 1734 1.17 1.67 0.86 151 XM_URI_RBL 1699 1.69 3.08 0.85 152 XMBody_17 1615 2.75 5.96 0.80 153 TR_XM_DK_SendGrid 1585 0.72 0.61 0.79 154 XM_ProductURIs 1508 0.91 1.17 0.75 155 XMPhish30 1507 0.99 1.38 0.75 156 TR_XM_SEO4 1503 1.83 3.63 0.75 157 HTML_TAG_BALANCE_CENTER 1499 0.67 0.54 0.75 158 XM_OfRef6 1495 1.52 2.81 0.74 159 USER_IN_WELCOMELIST 1467 0.46 0.00 0.73 160 USER_IN_WHITELIST 1467 0.46 0.00 0.73 161 TVD_RCVD_IP 1454 0.70 0.66 0.72 162 TR_LOTS_OF_MONEY3 1453 1.76 3.47 0.72 163 XMLngstWrd_00 1445 0.56 0.31 0.72 164 TM2_M_OBFU_COMMENT 1426 0.77 0.86 0.71 165 TR_XM_Base64_M1 1403 0.68 0.65 0.70 166 RELAYCOUNTRY_AU 1400 1.23 2.10 0.70 167 XMNoVowels 1386 0.55 0.33 0.69 168 T_FILL_THIS_FORM_SHORT 1381 1.54 2.94 0.69 169 DKIM_ADSP_CUSTOM_MED 1379 0.74 0.82 0.69 170 TooManyTo_004 1284 0.60 0.54 0.64 171 TR_LOTS_OF_MONEY2 1275 0.83 1.15 0.64 172 T_MONEY_PERCENT 1275 0.83 1.15 0.64 173 LONGLN_LOW_CONTRAST 1265 1.24 2.24 0.63 174 XMSubGiftCard1 1245 0.51 0.32 0.62 175 XMSubMetaI_00 1230 0.78 1.05 0.61 176 SpammyFromTLD_01 1193 1.11 1.95 0.59 177 TR_XM_SpammyWords2 1185 5.80 14.40 0.59 178 XM_H_PHPMailer 1168 0.56 0.51 0.58 179 XMOemUri 1115 0.42 0.20 0.56 180 TooManyTo_005 1115 0.54 0.51 0.56 181 TR_XM_SPAMCOP 1093 2.71 6.29 0.54 182 XMSubMetaSxObfu_03 1068 0.46 0.34 0.53 183 XMGenDplmaNmb 1064 0.98 1.73 0.53 184 XMWrdNumbWrd 1050 0.36 0.10 0.52 185 RCVD_IN_PBL 1035 0.53 0.56 0.52 186 THIS_AD 1014 0.88 1.49 0.51 187 XMLngstWrd_01 1001 0.41 0.27 0.50 188 HTTPS_HTTP_MISMATCH 993 0.65 0.90 0.49 189 HTML_FONT_FACE_BAD 963 0.53 0.60 0.48 190 T_TooManySym_04 958 0.32 0.05 0.48 191 XM_Sams_Club_Forge 932 0.33 0.10 0.46 192 MPART_ALT_DIFF_COUNT 910 0.69 1.09 0.45 193 DKIM_ADSP_NXDOMAIN 888 0.53 0.67 0.44 194 FORGED_GMAIL_RCVD 879 0.52 0.67 0.44 195 T_OBFU_PDF_ATTACH 860 0.31 0.13 0.43 196 PLING_QUERY 859 0.57 0.79 0.43 197 NML_ADSP_CUSTOM_MED 846 0.52 0.68 0.42 198 T_STY_INVIS_DIRECT 835 0.72 1.21 0.42 199 HTML_IMAGE_ONLY_20 831 0.47 0.55 0.41 200 NO_DNS_FOR_FROM 826 0.48 0.60 0.41 ----------------------------------------------------------------------