Email: 528961 Autolearn: 0 AvgScore: 4.40 AvgScanTime: 1.52 sec Spam: 166734 Autolearn: 0 AvgScore: 14.56 AvgScanTime: 1.67 sec Ham: 362227 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.45 sec Time Spent Running SA: 223.41 hours Time Spent Processing Spam: 77.37 hours Time Spent Processing Ham: 146.05 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157419 89.62 94.41 87.41 2 DKIM_SIGNED 148853 81.34 89.28 77.69 3 XM_DK_Pass 143008 79.38 85.77 76.44 4 XM_B_Unicode 141617 76.63 84.94 72.81 5 RELAYCOUNTRY_US 141248 83.43 84.71 82.84 6 DKIM_VALID 141127 78.33 84.64 75.42 7 DCC_CHECK 125320 52.26 75.16 41.72 8 XM_B_SpammyWords 117413 53.78 70.42 46.12 9 XMListUnsubscribeExists 116982 57.27 70.16 51.34 10 DKIM_VALID_AU 111490 62.50 66.87 60.50 11 XM_B_Unicode3 85839 46.26 51.48 43.86 12 LOC_TINY_FONT_1 79733 34.68 47.82 28.62 13 BAYES_50 70020 55.23 42.00 61.33 14 XM_B_SpammyWords2 67277 26.84 40.35 20.62 15 HTML_FONT_LOW_CONTRAST 65028 33.06 39.00 30.32 16 XM_DK_Undo_02 63671 15.65 38.19 5.27 17 RCVD_IN_MSPIKE_H2 61007 34.82 36.59 34.00 18 FVGT_m_MULTI_ODD 56184 27.62 33.70 24.82 19 T_KAM_HTML_FONT_INVALID 50418 24.25 30.24 21.50 20 BAYES_99 49539 11.80 29.71 3.56 21 MIME_HTML_ONLY 47316 22.75 28.38 20.16 22 DKIM_VALID_EF 45584 28.89 27.34 29.61 23 TR_XM_DKIM_Undo 45223 10.03 27.12 2.17 24 T_TM2_M_HEADER_IN_MSG 39144 27.80 23.48 29.79 25 XMSubLong 38972 22.82 23.37 22.56 26 DCC_CHECK_NEGATIVE 38691 47.20 23.21 58.24 27 BAYES_999 38342 9.07 23.00 2.65 28 TR_DCC_Bayes_99 35425 7.66 21.25 1.41 29 XM_Multi_Part_URI 35349 18.32 21.20 16.99 30 TR_XM_DK_Unsub 31478 14.78 18.88 12.89 31 UNPARSEABLE_RELAY 29565 13.40 17.73 11.40 32 XM_B_Unsub 29153 11.89 17.48 9.31 33 TR_XM_BayesUnsub 27993 10.49 16.79 7.60 34 RELAYCOUNTRY_META 25600 7.48 15.35 3.86 35 XM_B_SpammyWords3 24984 8.04 14.98 4.85 36 TR_MAX_INTL_RELAY 24311 8.70 14.58 5.99 37 LOTS_OF_MONEY 23297 8.92 13.97 6.60 38 BOTNET_IPINHOSTNAME 22568 6.56 13.54 3.36 39 TR_XM_SpammyWords4 21274 7.07 12.76 4.46 40 TR_XM_SpammyRelay 18550 4.99 11.13 2.17 41 TR_XM_SpammyWords2 17730 3.75 10.63 0.59 42 XM_Evil_Numbers_Gen 17360 9.89 10.41 9.64 43 LotsOfNums_01 15121 8.90 9.07 8.82 44 BOTNET 15024 3.85 9.01 1.48 45 BAYES_80 15011 5.38 9.00 3.71 46 FSL_BULK_SIG 14897 7.18 8.93 6.38 47 TR_XM_UnparsRelay 14896 4.00 8.93 1.73 48 BAYES_60 14121 8.69 8.47 8.79 49 HTML_IMAGE_RATIO_02 14086 5.86 8.45 4.66 50 XM_B_PhoneNumber 13462 8.95 8.07 9.36 51 XM_B_Phish_Phrases 13068 6.55 7.84 5.95 52 XMSubMetaSx_00 11909 5.03 7.14 4.06 53 XM_Body_Dirty_Words 11818 3.82 7.09 2.31 54 MPART_ALT_DIFF 11482 5.58 6.89 4.98 55 RCVD_IN_BL_SPAMCOP_NET 11470 2.68 6.88 0.74 56 XM_UncommonTLD01 11380 4.65 6.83 3.66 57 UNTRUSTED_Relay 10693 3.03 6.41 1.47 58 XM_H_Long_From01 9939 5.74 5.96 5.64 59 XM_B_SEO 9186 2.68 5.51 1.38 60 TooManyTo_001 9028 6.93 5.41 7.63 61 RELAYCOUNTRY_CA 8958 2.43 5.37 1.08 62 HTML_IMAGE_RATIO_04 8685 6.13 5.21 6.55 63 BAYES_95 8681 3.20 5.21 2.27 64 TR_XM_SEO4 7869 2.10 4.72 0.89 65 TR_XM_SPAMCOP 7803 1.70 4.68 0.32 66 XM_SPF_SoftFail 7782 2.74 4.67 1.85 67 DKIM_INVALID 7726 3.02 4.63 2.27 68 TM2_M_VERY_LONG_WORD 7643 2.93 4.58 2.17 69 XMSexyCombo_05 7621 2.64 4.57 1.75 70 TR_XM_PhishingBody 7455 2.45 4.47 1.52 71 MIME_HTML_MOSTLY 7153 3.27 4.29 2.80 72 XM_H_GMP 7121 4.81 4.27 5.06 73 T_XMDrugObfuBody_14 7117 2.55 4.27 1.76 74 XM_B_Investor 7022 2.45 4.21 1.64 75 HTML_IMAGE_RATIO_06 6786 3.51 4.07 3.26 76 XMStrtUSub 6650 4.41 3.99 4.61 77 TM2_M_URI_OPT_OUT 6598 2.27 3.96 1.49 78 MIME_HTML_ONLY_MULTI 6573 3.12 3.94 2.74 79 XM_CamelCaseFrm001 6220 2.88 3.73 2.48 80 TR_XM_SpammyWords5 6154 2.10 3.69 1.37 81 XM_B_SpammyTLD 6121 3.83 3.67 3.90 82 HTML_IMAGE_RATIO_08 5972 2.95 3.58 2.66 83 MIME_QP_LONG_LINE 5605 4.72 3.36 5.35 84 XM_UB50 5340 1.62 3.20 0.89 85 XMNumbers 5334 2.80 3.20 2.62 86 T_XMDrugObfuBody_08 5235 2.04 3.14 1.53 87 RCVD_IN_MSPIKE_WL 4999 4.89 3.00 5.75 88 RCVD_IN_MSPIKE_H3 4999 4.88 3.00 5.75 89 XM_URI_RBL 4985 1.24 2.99 0.43 90 XM_OfRef6 4936 1.44 2.96 0.75 91 XMDiploma_00 4782 1.92 2.87 1.49 92 XM_B_SpammyWords4 4739 1.44 2.84 0.79 93 XMBody_17 4513 1.16 2.71 0.45 94 RELAYCOUNTRY_AU 4511 1.38 2.71 0.77 95 SpammyFromTLD_01 4438 1.38 2.66 0.78 96 T_FILL_THIS_FORM_SHORT 4228 1.44 2.54 0.94 97 XM_B_Unsub2 4184 1.89 2.51 1.61 98 T_XMHurry_00 4168 1.70 2.50 1.33 99 TR_XM_NoHeaderRelay 4162 0.91 2.50 0.18 100 RCVD_IN_VALIDITY_SAFE 4155 4.10 2.49 4.84 101 FROM_EXCESS_BASE64 4009 2.31 2.40 2.27 102 XM_B_URI_Unicode 3935 2.00 2.36 1.84 103 T_TooManySym_01 3909 4.14 2.34 4.97 104 SUBJ_ALL_CAPS 3498 1.58 2.10 1.34 105 USER_IN_DEF_DKIM_WL 3433 11.00 2.06 15.11 106 SpammyFromTLD_02 3389 0.90 2.03 0.38 107 RCVD_IN_VALIDITY_RPBL 3348 0.73 2.01 0.14 108 MAILING_LIST_MULTI 3316 2.44 1.99 2.65 109 XM_DK_Undo_01 3308 1.97 1.98 1.97 110 XM_H_Long_From02 3254 1.26 1.95 0.94 111 DIET_1 3207 0.76 1.92 0.22 112 RCVD_IN_VALIDITY_CERTIFIED 3197 3.33 1.92 3.99 113 URI_NOVOWEL 3117 2.77 1.87 3.19 114 XMStockSpam_06 2987 1.73 1.79 1.70 115 MIME_CHARSET_FARAWAY 2923 0.93 1.75 0.56 116 XMBrknScrpt_02 2816 1.11 1.69 0.84 117 TR_LOTS_OF_MONEY3 2748 0.75 1.65 0.34 118 URI_HEX 2737 1.36 1.64 1.23 119 RCVD_IN_ZEN_LASTEXTERNAL 2700 0.51 1.62 0.00 120 SHORTCIRCUIT 2700 0.51 1.62 0.00 121 BAYES_40 2674 3.91 1.60 4.97 122 HTTPS_HTTP_MISMATCH 2666 1.10 1.60 0.88 123 KHOP_HELO_FCRDNS 2572 1.55 1.54 1.56 124 XM_SendGrid 2557 1.47 1.53 1.44 125 ANY_BOUNCE_MESSAGE 2535 3.03 1.52 3.72 126 BOUNCE_MESSAGE 2535 3.03 1.52 3.72 127 T_XMDrugObfuBody_00 2517 0.94 1.51 0.68 128 RCVD_IN_IADB_LISTED 2506 3.26 1.50 4.07 129 HTML_MIME_NO_HTML_TAG 2390 1.80 1.43 1.96 130 LongTLD 2368 0.68 1.42 0.34 131 TR_XM_INV_DKIM 2331 0.49 1.40 0.07 132 XMBdyGiftCard01 2271 1.10 1.36 0.98 133 T_REMOTE_IMAGE 2269 2.67 1.36 3.27 134 XMPhish30 2261 0.76 1.36 0.49 135 XM_B_Phish66 2245 0.60 1.35 0.26 136 SHOPIFY_IMG_NOT_RCVD_SFY 2234 0.59 1.34 0.24 137 TooManyTo_002 2214 1.93 1.33 2.20 138 TR_Symld_Words 2209 1.62 1.32 1.76 139 RCVD_IN_IADB_SPF 2177 2.83 1.31 3.53 140 XM_ProductURIs 2174 0.80 1.30 0.57 141 XMReplyNow 2120 0.60 1.27 0.29 142 TR_XM_FormFill 2092 0.41 1.25 0.02 143 XMGenDplmaNmb 2072 0.88 1.24 0.72 144 TR_XM_PHPDW 2057 0.68 1.23 0.43 145 XMSubMetaI_00 2045 1.26 1.23 1.28 146 RCVD_IN_IADB_SENDERID 2029 2.52 1.22 3.12 147 TR_XM_PHPForged 2027 0.68 1.22 0.43 148 RCVD_IN_IADB_DK 2010 2.46 1.21 3.04 149 TR_LOTS_OF_MONEY2 2006 0.62 1.20 0.36 150 T_MONEY_PERCENT 2006 0.62 1.20 0.36 151 TR_XM_FormFill2 1977 0.67 1.19 0.43 152 XM_H_PHPOS 1955 0.66 1.17 0.42 153 TR_XM_Base64_M1 1944 0.79 1.17 0.61 154 XM_B_REG_HTML 1939 0.49 1.16 0.18 155 TR_Mismatch_TLD_02 1914 0.40 1.15 0.05 156 BAYES_20 1850 2.61 1.11 3.30 157 ALL_TRUSTED 1842 9.93 1.10 14.00 158 CHARSET_FARAWAY_HEADER 1821 0.48 1.09 0.20 159 XMSexyCombo_01 1815 0.48 1.09 0.20 160 XMHTMLBadTable_001 1798 0.51 1.08 0.25 161 URI_TRY_3LD 1787 0.79 1.07 0.66 162 XM_B_COVIDMETA 1753 0.55 1.05 0.32 163 BOTNET_NORDNS 1739 0.33 1.04 0.00 164 MAY_BE_FORGED 1739 0.86 1.04 0.77 165 TR_XM_InvalidRelay 1728 0.34 1.04 0.01 166 NO_DNS_FOR_FROM 1691 0.55 1.01 0.34 167 DKIM_ADSP_CUSTOM_MED 1681 0.81 1.01 0.71 168 TR_XM_MaxWHORU 1672 0.51 1.00 0.29 169 XMHTML_After_End 1646 0.49 0.99 0.27 170 MPART_ALT_DIFF_COUNT 1645 0.61 0.99 0.43 171 XM_UB60 1642 0.36 0.98 0.07 172 FROM_SUSPICIOUS_NTLD 1629 0.33 0.98 0.03 173 THIS_AD 1619 0.47 0.97 0.24 174 RCVD_IN_XBL 1614 0.32 0.97 0.02 175 HTML_TAG_BALANCE_BODY 1601 0.71 0.96 0.60 176 XMMoneyMeta_00 1585 0.62 0.95 0.46 177 RDNS_DYNAMIC 1573 0.54 0.94 0.36 178 XMEqualsVooDoo_00 1562 0.34 0.94 0.06 179 XM_UB99 1553 0.30 0.93 0.00 180 TR_Mismatch_TLD_01 1548 0.46 0.93 0.24 181 URIBL_BLACK 1544 0.33 0.93 0.06 182 FROM_SUSPICIOUS_NTLD_FP 1537 0.30 0.92 0.02 183 PDS_RDNS_DYNAMIC_FP 1529 0.44 0.92 0.21 184 XM_DIRTYINTL 1524 0.34 0.91 0.08 185 RCVD_IN_PBL 1510 0.74 0.91 0.66 186 TR_XM_RelayPhish 1500 0.34 0.90 0.08 187 XM_B_DNDMA 1496 0.79 0.90 0.74 188 XMEqualsVooDoo_01 1492 0.30 0.89 0.03 189 XMEqualsVooDoo_02 1484 0.28 0.89 0.00 190 XMSubMetaSxObfu_03 1482 0.53 0.89 0.36 191 XM_S_SpammyWords 1479 0.49 0.89 0.31 192 TR_XM_DK_SendGrid 1478 0.88 0.89 0.88 193 TR_XM_Spammywords 1478 0.49 0.89 0.31 194 XMEqualsVooDoo_03 1476 0.28 0.89 0.00 195 XMBody_78 1450 0.47 0.87 0.29 196 RELAYCOUNTRY_FR 1428 0.46 0.86 0.28 197 XMPhish08 1410 0.48 0.85 0.31 198 HTML_IMAGE_ONLY_28 1395 0.59 0.84 0.48 199 TM2_M_A_HREF_HREF 1378 0.42 0.83 0.24 200 XM_B_COPY_HTML 1375 0.65 0.82 0.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316638 89.62 94.41 87.41 2 RELAYCOUNTRY_US 300054 83.43 84.71 82.84 3 DKIM_SIGNED 281416 81.34 89.28 77.69 4 XM_DK_Pass 276904 79.38 85.77 76.44 5 DKIM_VALID 273184 78.33 84.64 75.42 6 XM_B_Unicode 263748 76.63 84.94 72.81 7 BAYES_50 222144 55.23 42.00 61.33 8 DKIM_VALID_AU 219135 62.50 66.87 60.50 9 DCC_CHECK_NEGATIVE 210958 47.20 23.21 58.24 10 XMListUnsubscribeExists 185966 57.27 70.16 51.34 11 XM_B_SpammyWords 167071 53.78 70.42 46.12 12 XM_B_Unicode3 158877 46.26 51.48 43.86 13 DCC_CHECK 151115 52.26 75.16 41.72 14 RCVD_IN_MSPIKE_H2 123163 34.82 36.59 34.00 15 HTML_FONT_LOW_CONTRAST 109843 33.06 39.00 30.32 16 T_TM2_M_HEADER_IN_MSG 107895 27.80 23.48 29.79 17 DKIM_VALID_EF 107248 28.89 27.34 29.61 18 LOC_TINY_FONT_1 103686 34.68 47.82 28.62 19 FVGT_m_MULTI_ODD 89902 27.62 33.70 24.82 20 XMSubLong 81714 22.82 23.37 22.56 21 T_KAM_HTML_FONT_INVALID 77874 24.25 30.24 21.50 22 XM_B_SpammyWords2 74685 26.84 40.35 20.62 23 MIME_HTML_ONLY 73037 22.75 28.38 20.16 24 XM_Multi_Part_URI 61555 18.32 21.20 16.99 25 USER_IN_DEF_DKIM_WL 54745 11.00 2.06 15.11 26 ALL_TRUSTED 50710 9.93 1.10 14.00 27 TR_XM_DK_Unsub 46705 14.78 18.88 12.89 28 UNPARSEABLE_RELAY 41305 13.40 17.73 11.40 29 BAYES_00 36488 7.12 0.72 10.07 30 XM_Evil_Numbers_Gen 34935 9.89 10.41 9.64 31 XM_B_PhoneNumber 33906 8.95 8.07 9.36 32 XM_B_Unsub 33721 11.89 17.48 9.31 33 XM_DKIMWhitelistDomains 33341 6.35 0.15 9.20 34 LotsOfNums_01 31964 8.90 9.07 8.82 35 BAYES_60 31831 8.69 8.47 8.79 36 TooManyTo_001 27655 6.93 5.41 7.63 37 TR_XM_BayesUnsub 27519 10.49 16.79 7.60 38 TR_XM_DK_Bayes 26440 5.19 0.61 7.30 39 TR_XM_DK_Bayes1 26083 5.12 0.59 7.20 40 IN_ZIMBRA_NJ_WHITELIST 24288 4.62 0.10 6.71 41 LOTS_OF_MONEY 23890 8.92 13.97 6.60 42 HTML_IMAGE_RATIO_04 23728 6.13 5.21 6.55 43 FSL_BULK_SIG 23094 7.18 8.93 6.38 44 TR_XM_DK_Bayes2 23022 4.48 0.40 6.36 45 TR_MAX_INTL_RELAY 21683 8.70 14.58 5.99 46 XM_B_Phish_Phrases 21553 6.55 7.84 5.95 47 RCVD_IN_MSPIKE_WL 20842 4.89 3.00 5.75 48 RCVD_IN_MSPIKE_H3 20838 4.88 3.00 5.75 49 XM_H_Long_From01 20427 5.74 5.96 5.64 50 MIME_QP_LONG_LINE 19378 4.72 3.36 5.35 51 XM_DK_Undo_02 19099 15.65 38.19 5.27 52 XM_H_GMP 18325 4.81 4.27 5.06 53 MPART_ALT_DIFF 18046 5.58 6.89 4.98 54 T_TooManySym_01 18010 4.14 2.34 4.97 55 BAYES_40 18002 3.91 1.60 4.97 56 XM_B_SpammyWords3 17560 8.04 14.98 4.85 57 RCVD_IN_VALIDITY_SAFE 17517 4.10 2.49 4.84 58 HTML_IMAGE_RATIO_02 16896 5.86 8.45 4.66 59 XMStrtUSub 16701 4.41 3.99 4.61 60 TR_XM_SpammyWords4 16141 7.07 12.76 4.46 61 RCVD_IN_IADB_LISTED 14740 3.26 1.50 4.07 62 XMSubMetaSx_00 14691 5.03 7.14 4.06 63 RCVD_IN_VALIDITY_CERTIFIED 14443 3.33 1.92 3.99 64 XM_B_SpammyTLD 14132 3.83 3.67 3.90 65 RELAYCOUNTRY_META 13991 7.48 15.35 3.86 66 XM_PDF 13579 2.76 0.62 3.75 67 ANY_BOUNCE_MESSAGE 13487 3.03 1.52 3.72 68 BOUNCE_MESSAGE 13485 3.03 1.52 3.72 69 BAYES_80 13436 5.38 9.00 3.71 70 XM_UncommonTLD01 13242 4.65 6.83 3.66 71 BAYES_99 12878 11.80 29.71 3.56 72 RCVD_IN_IADB_SPF 12778 2.83 1.31 3.53 73 BOTNET_IPINHOSTNAME 12154 6.56 13.54 3.36 74 BAYES_20 11960 2.61 1.11 3.30 75 T_REMOTE_IMAGE 11855 2.67 1.36 3.27 76 HTML_IMAGE_RATIO_06 11804 3.51 4.07 3.26 77 URI_NOVOWEL 11549 2.77 1.87 3.19 78 RCVD_IN_IADB_SENDERID 11317 2.52 1.22 3.12 79 RCVD_IN_IADB_DK 11006 2.46 1.21 3.04 80 MIME_HTML_MOSTLY 10160 3.27 4.29 2.80 81 RCVD_IN_IADB_VOUCHED 10158 2.16 0.76 2.80 82 MIME_HTML_ONLY_MULTI 9933 3.12 3.94 2.74 83 HTML_IMAGE_RATIO_08 9651 2.95 3.58 2.66 84 BAYES_999 9615 9.07 23.00 2.65 85 MAILING_LIST_MULTI 9610 2.44 1.99 2.65 86 XMNumbers 9482 2.80 3.20 2.62 87 T_TooManySym_02 9020 1.94 0.74 2.49 88 XM_CamelCaseFrm001 8996 2.88 3.73 2.48 89 XM_Body_Dirty_Words 8383 3.82 7.09 2.31 90 BAYES_95 8237 3.20 5.21 2.27 91 DKIM_INVALID 8232 3.02 4.63 2.27 92 FROM_EXCESS_BASE64 8230 2.31 2.40 2.27 93 TooManyTo_002 7986 1.93 1.33 2.20 94 TM2_M_VERY_LONG_WORD 7871 2.93 4.58 2.17 95 TR_XM_SpammyRelay 7855 4.99 11.13 2.17 96 TR_XM_DKIM_Undo 7846 10.03 27.12 2.17 97 BAYES_05 7235 1.55 0.56 2.00 98 INVALID_MSGID 7214 1.42 0.16 1.99 99 XM_DK_Undo_01 7128 1.97 1.98 1.97 100 HTML_MIME_NO_HTML_TAG 7114 1.80 1.43 1.96 101 RCVD_IN_IADB_OPTIN 7061 1.48 0.45 1.95 102 XM_SPF_SoftFail 6690 2.74 4.67 1.85 103 XM_B_URI_Unicode 6659 2.00 2.36 1.84 104 T_XMDrugObfuBody_14 6382 2.55 4.27 1.76 105 TR_Symld_Words 6374 1.62 1.32 1.76 106 XMSexyCombo_05 6339 2.64 4.57 1.75 107 TR_XM_UnparsRelay 6268 4.00 8.93 1.73 108 TO_MALFORMED 6186 1.17 0.01 1.71 109 XMStockSpam_06 6167 1.73 1.79 1.70 110 XM_B_Investor 5948 2.45 4.21 1.64 111 XM_B_Unsub2 5821 1.89 2.51 1.61 112 KHOP_HELO_FCRDNS 5646 1.55 1.54 1.56 113 T_XMDrugObfuBody_08 5554 2.04 3.14 1.53 114 TR_XM_PhishingBody 5516 2.45 4.47 1.52 115 TM2_M_URI_OPT_OUT 5403 2.27 3.96 1.49 116 XMDiploma_00 5384 1.92 2.87 1.49 117 BOTNET 5345 3.85 9.01 1.48 118 UNTRUSTED_Relay 5330 3.03 6.41 1.47 119 IN_HORDE_ADDRESS_BOOK 5277 1.04 0.12 1.46 120 TooManyTo_003 5227 1.16 0.53 1.44 121 XM_SendGrid 5214 1.47 1.53 1.44 122 TR_DCC_Bayes_99 5116 7.66 21.25 1.41 123 XM_B_SEO 5014 2.68 5.51 1.38 124 TR_XM_SpammyWords5 4960 2.10 3.69 1.37 125 SUBJ_ALL_CAPS 4847 1.58 2.10 1.34 126 T_XMHurry_00 4831 1.70 2.50 1.33 127 XMSubMetaI_00 4623 1.26 1.23 1.28 128 URI_HEX 4455 1.36 1.64 1.23 129 XMGappySubj_01 4439 0.90 0.18 1.23 130 XMCapTrack 4040 0.90 0.44 1.12 131 XM_H_Trusted_IP 4004 0.76 0.00 1.11 132 RELAYCOUNTRY_CA 3906 2.43 5.37 1.08 133 XM_GoogleGroups 3891 0.93 0.62 1.07 134 TooManyTo_004 3876 0.89 0.48 1.07 135 HELO_NODOT 3685 0.75 0.17 1.02 136 TVD_SPACE_RATIO 3682 0.73 0.10 1.02 137 HELO_NO_DOMAIN 3679 0.75 0.17 1.02 138 XMBdyGiftCard01 3549 1.10 1.36 0.98 139 FROM_GOV_DKIM_AU 3465 0.73 0.24 0.96 140 XM_H_Long_From02 3413 1.26 1.95 0.94 141 T_FILL_THIS_FORM_SHORT 3410 1.44 2.54 0.94 142 XM_TLDProd2 3359 0.70 0.19 0.93 143 XM_UB50 3226 1.62 3.20 0.89 144 TR_XM_SEO4 3225 2.10 4.72 0.89 145 TooManyTo_005 3214 0.75 0.45 0.89 146 HTTPS_HTTP_MISMATCH 3175 1.10 1.60 0.88 147 T_TooManySym_03 3170 0.68 0.25 0.88 148 TR_XM_DK_SendGrid 3170 0.88 0.89 0.88 149 XMSubNoVowel 3124 0.71 0.39 0.86 150 XMBrknScrpt_02 3044 1.11 1.69 0.84 151 XM_B_SpammyWords4 2859 1.44 2.84 0.79 152 SpammyFromTLD_01 2837 1.38 2.66 0.78 153 RELAYCOUNTRY_AU 2806 1.38 2.71 0.77 154 MAY_BE_FORGED 2791 0.86 1.04 0.77 155 XMBody_95 2707 0.61 0.33 0.75 156 XM_OfRef6 2701 1.44 2.96 0.75 157 XM_B_DNDMA 2693 0.79 0.90 0.74 158 RCVD_IN_BL_SPAMCOP_NET 2682 2.68 6.88 0.74 159 XMGenDplmaNmb 2594 0.88 1.24 0.72 160 DKIM_ADSP_CUSTOM_MED 2587 0.81 1.01 0.71 161 TR_MetaPhish_Combo_01 2563 0.68 0.62 0.71 162 XM_ShortIntro_01 2460 0.62 0.48 0.68 163 T_XMDrugObfuBody_00 2454 0.94 1.51 0.68 164 URI_TRY_3LD 2407 0.79 1.07 0.66 165 RCVD_IN_PBL 2392 0.74 0.91 0.66 166 XMGappySubj_02 2388 0.47 0.06 0.66 167 HTML_IMAGE_ONLY_20 2317 0.51 0.23 0.64 168 T_Symld_Words_02 2230 0.64 0.68 0.62 169 TR_XM_Base64_M1 2221 0.79 1.17 0.61 170 HTML_TAG_BALANCE_BODY 2175 0.71 0.96 0.60 171 XM_H_PHPMailer 2132 0.59 0.58 0.59 172 TR_XM_SpammyWords2 2124 3.75 10.63 0.59 173 XMNoVowels 2112 0.54 0.43 0.58 174 XM_B_COPY_HTML 2058 0.65 0.82 0.57 175 XM_ProductURIs 2051 0.80 1.30 0.57 176 MIME_CHARSET_FARAWAY 2015 0.93 1.75 0.56 177 PLING_QUERY 2005 0.59 0.67 0.55 178 XMLngstWrd_00 1983 0.52 0.45 0.55 179 TM2_M_OBFU_COMMENT 1836 0.58 0.73 0.51 180 XMPhish30 1767 0.76 1.36 0.49 181 NML_ADSP_CUSTOM_MED 1757 0.58 0.79 0.49 182 HTML_IMAGE_ONLY_28 1746 0.59 0.84 0.48 183 T_MANY_PILL_PRICE 1721 0.33 0.01 0.48 184 XMMoneyMeta_00 1675 0.62 0.95 0.46 185 XMBody_17 1641 1.16 2.71 0.45 186 TVD_RCVD_IP 1631 0.56 0.80 0.45 187 HTML_IMAGE_ONLY_32 1630 0.35 0.13 0.45 188 T_OBFU_PDF_ATTACH 1587 0.34 0.14 0.44 189 XM_URI_RBL 1572 1.24 2.99 0.43 190 MPART_ALT_DIFF_COUNT 1558 0.61 0.99 0.43 191 TR_XM_PHPForged 1554 0.68 1.22 0.43 192 TR_XM_PHPDW 1553 0.68 1.23 0.43 193 TR_XM_FormFill2 1551 0.67 1.19 0.43 194 XMOemUri 1523 0.38 0.29 0.42 195 XM_H_PHPOS 1517 0.66 1.17 0.42 196 USER_IN_WELCOMELIST 1511 0.29 0.00 0.42 197 USER_IN_WHITELIST 1511 0.29 0.00 0.42 198 RELAYCOUNTRY_GB 1490 0.52 0.77 0.41 199 FORGED_GMAIL_RCVD 1487 0.50 0.69 0.41 200 XMPhish14 1474 0.53 0.80 0.41 ----------------------------------------------------------------------