Email: 520480 Autolearn: 0 AvgScore: 4.21 AvgScanTime: 1.53 sec Spam: 161574 Autolearn: 0 AvgScore: 14.07 AvgScanTime: 1.68 sec Ham: 358906 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 1.46 sec Time Spent Running SA: 221.39 hours Time Spent Processing Spam: 75.38 hours Time Spent Processing Ham: 146.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153554 89.31 95.04 86.73 2 DKIM_SIGNED 146833 81.45 90.88 77.20 3 XM_DK_Pass 141713 79.64 87.71 76.01 4 DKIM_VALID 139977 78.61 86.63 75.00 5 XM_B_Unicode 137447 76.41 85.07 72.52 6 RELAYCOUNTRY_US 135519 82.02 83.87 81.19 7 DCC_CHECK 121329 52.93 75.09 42.96 8 XMListUnsubscribeExists 115992 57.35 71.79 50.84 9 XM_B_SpammyWords 113986 53.66 70.55 46.06 10 DKIM_VALID_AU 108004 62.21 66.84 60.12 11 XM_B_Unicode3 79971 44.55 49.49 42.32 12 LOC_TINY_FONT_1 75875 34.19 46.96 28.45 13 BAYES_50 67507 54.98 41.78 60.92 14 XM_B_SpammyWords2 67309 25.48 41.66 18.20 15 XM_DK_Undo_02 63675 15.72 39.41 5.06 16 HTML_FONT_LOW_CONTRAST 62396 32.38 38.62 29.58 17 RCVD_IN_MSPIKE_H2 58729 34.84 36.35 34.17 18 FVGT_m_MULTI_ODD 56336 27.32 34.87 23.92 19 T_KAM_HTML_FONT_INVALID 49876 24.02 30.87 20.94 20 BAYES_99 49374 11.78 30.56 3.33 21 MIME_HTML_ONLY 46499 21.87 28.78 18.76 22 TR_XM_DKIM_Undo 45483 10.33 28.15 2.31 23 DKIM_VALID_EF 45121 28.73 27.93 29.09 24 DCC_CHECK_NEGATIVE 38188 46.63 23.63 56.98 25 BAYES_999 38007 9.00 23.52 2.46 26 XMSubLong 37285 22.10 23.08 21.66 27 XM_Multi_Part_URI 36210 19.23 22.41 17.80 28 TR_DCC_Bayes_99 35833 7.80 22.18 1.33 29 T_TM2_M_HEADER_IN_MSG 32712 24.80 20.25 26.86 30 TR_XM_DK_Unsub 31848 14.61 19.71 12.32 31 XM_B_Unsub 27966 12.07 17.31 9.71 32 UNPARSEABLE_RELAY 27881 12.98 17.26 11.05 33 TR_XM_BayesUnsub 27095 10.79 16.77 8.09 34 RELAYCOUNTRY_META 26317 7.64 16.29 3.75 35 XM_B_SpammyWords3 23529 7.98 14.56 5.02 36 TR_MAX_INTL_RELAY 23295 8.71 14.42 6.15 37 BOTNET_IPINHOSTNAME 20344 6.15 12.59 3.25 38 LOTS_OF_MONEY 18962 8.15 11.74 6.54 39 TR_XM_SpammyRelay 18791 5.00 11.63 2.01 40 XM_Evil_Numbers_Gen 18139 9.53 11.23 8.77 41 TR_XM_SpammyWords4 17577 6.44 10.88 4.45 42 TR_XM_SpammyWords2 17558 3.68 10.87 0.45 43 TR_XM_UnparsRelay 14926 3.95 9.24 1.56 44 HTML_IMAGE_RATIO_02 14577 6.22 9.02 4.96 45 BAYES_80 14385 5.37 8.90 3.78 46 XM_B_Phish_Phrases 14035 7.21 8.69 6.55 47 FSL_BULK_SIG 14014 7.61 8.67 7.13 48 LotsOfNums_01 13249 8.26 8.20 8.28 49 RCVD_IN_BL_SPAMCOP_NET 12899 2.91 7.98 0.63 50 BOTNET 12717 3.54 7.87 1.59 51 BAYES_60 12180 8.44 7.54 8.84 52 MPART_ALT_DIFF 11293 6.04 6.99 5.61 53 XM_B_PhoneNumber 11172 8.48 6.91 9.19 54 XM_Body_Dirty_Words 10923 3.70 6.76 2.32 55 XM_UncommonTLD01 10508 4.61 6.50 3.75 56 RELAYCOUNTRY_CA 10155 2.69 6.29 1.07 57 XM_H_Long_From01 9946 5.52 6.16 5.24 58 XMSubMetaSx_00 9889 4.37 6.12 3.58 59 UNTRUSTED_Relay 9542 2.92 5.91 1.58 60 TR_XM_SPAMCOP 9381 2.02 5.81 0.31 61 XM_B_Investor 9304 2.97 5.76 1.71 62 XM_B_SEO 9058 3.18 5.61 2.09 63 TooManyTo_001 8546 6.96 5.29 7.71 64 BAYES_95 8376 3.24 5.18 2.37 65 TR_XM_SEO4 8171 2.66 5.06 1.58 66 XMStrtUSub 7707 4.74 4.77 4.73 67 HTML_IMAGE_RATIO_04 7669 5.34 4.75 5.61 68 XM_H_GMP 7356 4.76 4.55 4.85 69 TR_XM_PhishingBody 7329 2.46 4.54 1.52 70 XM_SPF_SoftFail 7041 2.58 4.36 1.78 71 DKIM_INVALID 6856 2.84 4.24 2.20 72 MIME_HTML_MOSTLY 6847 3.63 4.24 3.35 73 MIME_HTML_ONLY_MULTI 6783 3.18 4.20 2.72 74 HTML_IMAGE_RATIO_06 6722 3.75 4.16 3.56 75 T_XMDrugObfuBody_14 6626 2.42 4.10 1.66 76 XMSexyCombo_05 6514 1.86 4.03 0.88 77 RCVD_IN_MSPIKE_WL 6439 5.04 3.99 5.52 78 RCVD_IN_MSPIKE_H3 6439 5.04 3.99 5.52 79 TM2_M_VERY_LONG_WORD 6406 2.05 3.96 1.19 80 MIME_QP_LONG_LINE 6395 5.54 3.96 6.25 81 XM_CamelCaseFrm001 6385 2.79 3.95 2.27 82 HTML_IMAGE_RATIO_08 6228 2.76 3.85 2.27 83 XMNumbers 5805 2.80 3.59 2.44 84 TM2_M_URI_OPT_OUT 5770 2.78 3.57 2.42 85 XM_B_SpammyWords4 5739 1.67 3.55 0.82 86 TR_XM_SpammyWords5 5674 1.93 3.51 1.21 87 XM_B_SpammyTLD 5367 4.15 3.32 4.52 88 RCVD_IN_VALIDITY_RPBL 5022 1.08 3.11 0.16 89 RELAYCOUNTRY_AU 4997 1.45 3.09 0.71 90 XM_UB50 4648 1.59 2.88 1.01 91 XM_URI_RBL 4641 1.10 2.87 0.31 92 T_XMDrugObfuBody_08 4411 1.83 2.73 1.43 93 RCVD_IN_VALIDITY_SAFE 4389 3.78 2.72 4.26 94 USER_IN_DEF_DKIM_WL 4302 11.06 2.66 14.83 95 T_XMHurry_00 4268 1.37 2.64 0.79 96 XMDiploma_00 4148 1.78 2.57 1.43 97 XMBody_17 3908 1.02 2.42 0.39 98 SUBJ_ALL_CAPS 3904 1.64 2.42 1.28 99 FROM_EXCESS_BASE64 3791 2.13 2.35 2.04 100 T_TooManySym_01 3760 4.14 2.33 4.96 101 MAILING_LIST_MULTI 3736 2.62 2.31 2.76 102 XM_B_URI_Unicode 3704 2.04 2.29 1.92 103 TR_XM_NoHeaderRelay 3647 0.82 2.26 0.18 104 XM_B_Unsub2 3636 1.74 2.25 1.51 105 XM_OfRef6 3544 1.19 2.19 0.74 106 TR_Symld_Words 3497 2.17 2.16 2.18 107 BAYES_40 3369 4.07 2.09 4.97 108 RCVD_IN_VALIDITY_CERTIFIED 3310 3.02 2.05 3.46 109 XMStockSpam_06 3220 1.52 1.99 1.31 110 XM_SendGrid 2967 1.50 1.84 1.35 111 URI_TRY_3LD 2891 1.02 1.79 0.68 112 URI_HEX 2864 1.40 1.77 1.24 113 XMBrknScrpt_02 2857 1.23 1.77 0.99 114 SpammyFromTLD_01 2829 1.08 1.75 0.78 115 XM_H_Long_From02 2788 1.15 1.73 0.90 116 T_REMOTE_IMAGE 2684 2.83 1.66 3.36 117 T_FILL_THIS_FORM_SHORT 2681 1.05 1.66 0.78 118 SpammyFromTLD_02 2610 0.84 1.62 0.50 119 XMBdyGiftCard01 2495 1.11 1.54 0.91 120 XMMoneyMeta_00 2494 0.82 1.54 0.49 121 RCVD_IN_IADB_LISTED 2482 3.55 1.54 4.46 122 HTTPS_HTTP_MISMATCH 2432 1.03 1.51 0.82 123 XM_DK_Undo_01 2408 1.62 1.49 1.68 124 XM_ProductURIs 2357 1.11 1.46 0.95 125 TR_Mismatch_TLD_02 2321 0.51 1.44 0.09 126 RCVD_IN_XBL 2279 0.45 1.41 0.02 127 HTML_MIME_NO_HTML_TAG 2249 1.71 1.39 1.86 128 TR_LOTS_OF_MONEY3 2188 0.82 1.35 0.57 129 T_XMDrugObfuBody_00 2145 0.85 1.33 0.64 130 RCVD_IN_IADB_SPF 2115 3.08 1.31 3.88 131 THIS_AD 2104 0.65 1.30 0.36 132 XMSubMetaI_00 2100 1.14 1.30 1.07 133 XMPhish14 2094 0.72 1.30 0.47 134 XMPhish30 2070 0.71 1.28 0.46 135 BAYES_20 2043 2.74 1.26 3.41 136 SHORTCIRCUIT 2038 0.39 1.26 0.00 137 RCVD_IN_ZEN_LASTEXTERNAL 2038 0.39 1.26 0.00 138 RCVD_IN_IADB_DK 2000 2.67 1.24 3.31 139 RCVD_IN_IADB_SENDERID 1969 2.75 1.22 3.44 140 XMReplyNow 1939 0.59 1.20 0.32 141 DKIM_ADSP_CUSTOM_MED 1935 0.89 1.20 0.75 142 RDNS_DYNAMIC 1924 0.57 1.19 0.29 143 RCVD_IN_SBL_CSS 1920 0.39 1.19 0.03 144 XMGenDplmaNmb 1917 0.87 1.19 0.73 145 SHOPIFY_IMG_NOT_RCVD_SFY 1916 0.53 1.19 0.24 146 TR_XM_Base64_M1 1914 0.78 1.18 0.60 147 ALL_TRUSTED 1907 11.10 1.18 15.57 148 PDS_RDNS_DYNAMIC_FP 1904 0.46 1.18 0.14 149 LongTLD 1898 0.65 1.17 0.41 150 TooManyTo_002 1884 1.67 1.17 1.90 151 HTML_TAG_BALANCE_BODY 1881 0.76 1.16 0.58 152 XM_B_DNDMA 1829 0.77 1.13 0.61 153 TR_XM_PHPForged 1786 0.56 1.11 0.31 154 TR_XM_FormFill 1778 0.35 1.10 0.01 155 TR_XM_PHPDW 1768 0.56 1.09 0.31 156 TR_XM_FormFill2 1731 0.55 1.07 0.31 157 URI_NOVOWEL 1724 2.68 1.07 3.41 158 TR_LOTS_OF_MONEY2 1720 0.43 1.06 0.15 159 T_MONEY_PERCENT 1720 0.43 1.06 0.15 160 XM_H_PHPOS 1710 0.54 1.06 0.30 161 TR_XM_INV_DKIM 1697 0.41 1.05 0.13 162 RCVD_IN_PBL 1690 0.78 1.05 0.66 163 XM_B_Phish66 1688 0.50 1.04 0.25 164 KHOP_HELO_FCRDNS 1680 1.15 1.04 1.20 165 XM_S_SpammyWords 1673 0.59 1.04 0.39 166 TR_XM_Spammywords 1673 0.59 1.04 0.39 167 XM_B_COPY_HTML 1662 0.75 1.03 0.63 168 XM_DIRTYINTL 1606 0.35 0.99 0.07 169 HTML_FONT_FACE_BAD 1591 0.54 0.98 0.34 170 XMHTML_After_End 1575 0.52 0.97 0.31 171 TR_XM_RelayPhish 1566 0.35 0.97 0.07 172 XM_B_COVIDMETA 1556 0.47 0.96 0.24 173 MPART_ALT_DIFF_COUNT 1545 0.67 0.96 0.54 174 XMSubMetaSxObfu_03 1495 0.63 0.93 0.50 175 TR_Mismatch_TLD_01 1480 0.41 0.92 0.19 176 TVD_RCVD_IP 1479 0.71 0.92 0.61 177 XMBody_78 1478 0.51 0.91 0.32 178 DIET_1 1475 0.50 0.91 0.32 179 RCVD_IN_SBL 1467 0.28 0.91 0.00 180 TM2_M_OBFU_COMMENT 1445 0.67 0.89 0.57 181 HELO_DYNAMIC_SPLIT_IP 1422 0.29 0.88 0.03 182 TR_XM_InvalidRelay 1416 0.29 0.88 0.02 183 XM_UB99 1408 0.27 0.87 0.00 184 TR_XM_DK_SendGrid 1385 0.82 0.86 0.80 185 HK_RANDOM_REPLYTO 1378 0.34 0.85 0.11 186 XMPhish08 1376 0.47 0.85 0.30 187 PLING_QUERY 1357 0.67 0.84 0.59 188 NML_ADSP_CUSTOM_MED 1352 0.58 0.84 0.47 189 LONGLN_LOW_CONTRAST 1332 0.41 0.82 0.23 190 FROM_ADDR_WS 1321 0.25 0.82 0.00 191 XMSubMetaSxObfu_02 1314 0.37 0.81 0.16 192 FORGED_GMAIL_RCVD 1290 0.58 0.80 0.48 193 XMHTMLBadTable_001 1285 0.39 0.80 0.20 194 T_STY_INVIS_DIRECT 1282 0.46 0.79 0.31 195 RELAYCOUNTRY_KZ 1281 0.25 0.79 0.00 196 XM_HighProb1 1269 0.25 0.79 0.01 197 FROM_WSP_TRAIL 1268 0.24 0.78 0.00 198 TR_MetaPhish_Combo_01 1266 0.73 0.78 0.71 199 URIBL_BLACK 1262 0.27 0.78 0.04 200 RCVD_IN_PSBL 1259 0.30 0.78 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 311264 89.31 95.04 86.73 2 RELAYCOUNTRY_US 291388 82.02 83.87 81.19 3 DKIM_SIGNED 277077 81.45 90.88 77.20 4 XM_DK_Pass 272802 79.64 87.71 76.01 5 DKIM_VALID 269171 78.61 86.63 75.00 6 XM_B_Unicode 260263 76.41 85.07 72.52 7 BAYES_50 218647 54.98 41.78 60.92 8 DKIM_VALID_AU 215772 62.21 66.84 60.12 9 DCC_CHECK_NEGATIVE 204517 46.63 23.63 56.98 10 XMListUnsubscribeExists 182483 57.35 71.79 50.84 11 XM_B_SpammyWords 165320 53.66 70.55 46.06 12 DCC_CHECK 154184 52.93 75.09 42.96 13 XM_B_Unicode3 151890 44.55 49.49 42.32 14 RCVD_IN_MSPIKE_H2 122632 34.84 36.35 34.17 15 HTML_FONT_LOW_CONTRAST 106152 32.38 38.62 29.58 16 DKIM_VALID_EF 104419 28.73 27.93 29.09 17 LOC_TINY_FONT_1 102095 34.19 46.96 28.45 18 T_TM2_M_HEADER_IN_MSG 96393 24.80 20.25 26.86 19 FVGT_m_MULTI_ODD 85852 27.32 34.87 23.92 20 XMSubLong 77731 22.10 23.08 21.66 21 T_KAM_HTML_FONT_INVALID 75151 24.02 30.87 20.94 22 MIME_HTML_ONLY 67329 21.87 28.78 18.76 23 XM_B_SpammyWords2 65307 25.48 41.66 18.20 24 XM_Multi_Part_URI 63885 19.23 22.41 17.80 25 ALL_TRUSTED 55879 11.10 1.18 15.57 26 USER_IN_DEF_DKIM_WL 53240 11.06 2.66 14.83 27 TR_XM_DK_Unsub 44201 14.61 19.71 12.32 28 UNPARSEABLE_RELAY 39655 12.98 17.26 11.05 29 BAYES_00 37254 7.39 0.76 10.38 30 XM_B_Unsub 34833 12.07 17.31 9.71 31 XM_DKIMWhitelistDomains 33303 6.42 0.06 9.28 32 XM_B_PhoneNumber 32981 8.48 6.91 9.19 33 BAYES_60 31730 8.44 7.54 8.84 34 XM_Evil_Numbers_Gen 31471 9.53 11.23 8.77 35 LotsOfNums_01 29735 8.26 8.20 8.28 36 TR_XM_BayesUnsub 29041 10.79 16.77 8.09 37 TooManyTo_001 27660 6.96 5.29 7.71 38 TR_XM_DK_Bayes 27233 5.43 0.63 7.59 39 TR_XM_DK_Bayes1 26844 5.35 0.63 7.48 40 FSL_BULK_SIG 25582 7.61 8.67 7.13 41 XM_B_Phish_Phrases 23513 7.21 8.69 6.55 42 TR_XM_DK_Bayes2 23493 4.66 0.46 6.55 43 LOTS_OF_MONEY 23480 8.15 11.74 6.54 44 IN_ZIMBRA_NJ_WHITELIST 23059 4.46 0.11 6.42 45 MIME_QP_LONG_LINE 22431 5.54 3.96 6.25 46 TR_MAX_INTL_RELAY 22060 8.71 14.42 6.15 47 HTML_IMAGE_RATIO_04 20145 5.34 4.75 5.61 48 MPART_ALT_DIFF 20118 6.04 6.99 5.61 49 RCVD_IN_MSPIKE_WL 19813 5.04 3.99 5.52 50 RCVD_IN_MSPIKE_H3 19812 5.04 3.99 5.52 51 XM_H_Long_From01 18790 5.52 6.16 5.24 52 XM_DK_Undo_02 18157 15.72 39.41 5.06 53 XM_B_SpammyWords3 18022 7.98 14.56 5.02 54 BAYES_40 17837 4.07 2.09 4.97 55 HTML_IMAGE_RATIO_02 17813 6.22 9.02 4.96 56 T_TooManySym_01 17809 4.14 2.33 4.96 57 XM_H_GMP 17409 4.76 4.55 4.85 58 XMStrtUSub 16964 4.74 4.77 4.73 59 XM_B_SpammyTLD 16211 4.15 3.32 4.52 60 RCVD_IN_IADB_LISTED 16021 3.55 1.54 4.46 61 TR_XM_SpammyWords4 15967 6.44 10.88 4.45 62 RCVD_IN_VALIDITY_SAFE 15287 3.78 2.72 4.26 63 XM_PDF 13971 2.86 0.56 3.89 64 RCVD_IN_IADB_SPF 13923 3.08 1.31 3.88 65 BAYES_80 13564 5.37 8.90 3.78 66 XM_UncommonTLD01 13470 4.61 6.50 3.75 67 RELAYCOUNTRY_META 13463 7.64 16.29 3.75 68 XMSubMetaSx_00 12856 4.37 6.12 3.58 69 HTML_IMAGE_RATIO_06 12789 3.75 4.16 3.56 70 RCVD_IN_VALIDITY_CERTIFIED 12416 3.02 2.05 3.46 71 RCVD_IN_IADB_SENDERID 12362 2.75 1.22 3.44 72 URI_NOVOWEL 12243 2.68 1.07 3.41 73 BAYES_20 12228 2.74 1.26 3.41 74 T_REMOTE_IMAGE 12056 2.83 1.66 3.36 75 MIME_HTML_MOSTLY 12027 3.63 4.24 3.35 76 BAYES_99 11938 11.78 30.56 3.33 77 RCVD_IN_IADB_DK 11875 2.67 1.24 3.31 78 BOTNET_IPINHOSTNAME 11673 6.15 12.59 3.25 79 ANY_BOUNCE_MESSAGE 10855 2.26 0.57 3.02 80 BOUNCE_MESSAGE 10854 2.26 0.57 3.02 81 RCVD_IN_IADB_VOUCHED 10806 2.31 0.76 3.01 82 MAILING_LIST_MULTI 9898 2.62 2.31 2.76 83 MIME_HTML_ONLY_MULTI 9773 3.18 4.20 2.72 84 BAYES_999 8815 9.00 23.52 2.46 85 XMNumbers 8743 2.80 3.59 2.44 86 TM2_M_URI_OPT_OUT 8675 2.78 3.57 2.42 87 BAYES_95 8490 3.24 5.18 2.37 88 T_TooManySym_02 8447 1.80 0.56 2.35 89 XM_Body_Dirty_Words 8311 3.70 6.76 2.32 90 TR_XM_DKIM_Undo 8288 10.33 28.15 2.31 91 HTML_IMAGE_RATIO_08 8150 2.76 3.85 2.27 92 XM_CamelCaseFrm001 8144 2.79 3.95 2.27 93 DKIM_INVALID 7906 2.84 4.24 2.20 94 TR_Symld_Words 7814 2.17 2.16 2.18 95 XM_B_SEO 7509 3.18 5.61 2.09 96 RCVD_IN_IADB_OPTIN 7436 1.56 0.43 2.07 97 FROM_EXCESS_BASE64 7306 2.13 2.35 2.04 98 BAYES_05 7217 1.59 0.66 2.01 99 INVALID_MSGID 7217 1.45 0.22 2.01 100 TR_XM_SpammyRelay 7208 5.00 11.63 2.01 101 XM_B_URI_Unicode 6908 2.04 2.29 1.92 102 TooManyTo_002 6811 1.67 1.17 1.90 103 HTML_MIME_NO_HTML_TAG 6671 1.71 1.39 1.86 104 XM_SPF_SoftFail 6377 2.58 4.36 1.78 105 TO_MALFORMED 6247 1.20 0.00 1.74 106 XM_B_Investor 6146 2.97 5.76 1.71 107 XM_DK_Undo_01 6044 1.62 1.49 1.68 108 T_XMDrugObfuBody_14 5975 2.42 4.10 1.66 109 BOTNET 5714 3.54 7.87 1.59 110 UNTRUSTED_Relay 5668 2.92 5.91 1.58 111 TR_XM_SEO4 5657 2.66 5.06 1.58 112 TR_XM_UnparsRelay 5615 3.95 9.24 1.56 113 TR_XM_PhishingBody 5466 2.46 4.54 1.52 114 XM_B_Unsub2 5405 1.74 2.25 1.51 115 XMDiploma_00 5136 1.78 2.57 1.43 116 T_XMDrugObfuBody_08 5115 1.83 2.73 1.43 117 IN_HORDE_ADDRESS_BOOK 4977 0.99 0.11 1.39 118 XMGappySubj_01 4975 1.02 0.20 1.39 119 XM_SendGrid 4838 1.50 1.84 1.35 120 TR_DCC_Bayes_99 4781 7.80 22.18 1.33 121 XMStockSpam_06 4713 1.52 1.99 1.31 122 XMBody_95 4692 0.96 0.19 1.31 123 TooManyTo_003 4671 1.06 0.54 1.30 124 SUBJ_ALL_CAPS 4609 1.64 2.42 1.28 125 URI_HEX 4446 1.40 1.77 1.24 126 TR_XM_SpammyWords5 4352 1.93 3.51 1.21 127 KHOP_HELO_FCRDNS 4307 1.15 1.04 1.20 128 FROM_GOV_DKIM_AU 4285 0.88 0.18 1.19 129 TM2_M_VERY_LONG_WORD 4263 2.05 3.96 1.19 130 RELAYCOUNTRY_CA 3858 2.69 6.29 1.07 131 XMSubMetaI_00 3837 1.14 1.30 1.07 132 TVD_SPACE_RATIO 3739 0.76 0.14 1.04 133 XM_GoogleGroups 3730 0.90 0.59 1.04 134 XM_UB50 3622 1.59 2.88 1.01 135 XM_TLDProd2 3595 0.75 0.20 1.00 136 XMBrknScrpt_02 3565 1.23 1.77 0.99 137 TooManyTo_004 3431 0.81 0.50 0.96 138 XM_ProductURIs 3426 1.11 1.46 0.95 139 HELO_NODOT 3387 0.68 0.10 0.94 140 HELO_NO_DOMAIN 3381 0.68 0.09 0.94 141 XMCapTrack 3332 0.78 0.44 0.93 142 XMBdyGiftCard01 3279 1.11 1.54 0.91 143 XM_H_Long_From02 3222 1.15 1.73 0.90 144 XMSexyCombo_05 3141 1.86 4.03 0.88 145 XM_H_Trusted_IP 3129 0.60 0.00 0.87 146 T_TooManySym_03 3071 0.64 0.17 0.86 147 XMSubNoVowel 3030 0.69 0.36 0.84 148 HTTPS_HTTP_MISMATCH 2943 1.03 1.51 0.82 149 XM_B_SpammyWords4 2935 1.67 3.55 0.82 150 TR_XM_DK_SendGrid 2868 0.82 0.86 0.80 151 T_XMHurry_00 2846 1.37 2.64 0.79 152 TooManyTo_005 2803 0.68 0.46 0.78 153 T_FILL_THIS_FORM_SHORT 2788 1.05 1.66 0.78 154 SpammyFromTLD_01 2782 1.08 1.75 0.78 155 DKIM_ADSP_CUSTOM_MED 2698 0.89 1.20 0.75 156 XMGappySubj_02 2669 0.54 0.09 0.74 157 XM_OfRef6 2648 1.19 2.19 0.74 158 XMGenDplmaNmb 2622 0.87 1.19 0.73 159 RELAYCOUNTRY_AU 2552 1.45 3.09 0.71 160 TR_MetaPhish_Combo_01 2545 0.73 0.78 0.71 161 XM_ShortIntro_01 2479 0.62 0.45 0.69 162 URI_TRY_3LD 2433 1.02 1.79 0.68 163 RCVD_IN_PBL 2355 0.78 1.05 0.66 164 LOW_PRICE 2342 0.58 0.40 0.65 165 T_XMDrugObfuBody_00 2291 0.85 1.33 0.64 166 XM_B_COPY_HTML 2265 0.75 1.03 0.63 167 RCVD_IN_BL_SPAMCOP_NET 2256 2.91 7.98 0.63 168 TVD_RCVD_IP 2207 0.71 0.92 0.61 169 XM_B_DNDMA 2177 0.77 1.13 0.61 170 TR_XM_Base64_M1 2164 0.78 1.18 0.60 171 XM_RXBody 2158 0.53 0.38 0.60 172 TVD_PH_SEC 2152 0.43 0.06 0.60 173 PLING_QUERY 2115 0.67 0.84 0.59 174 XM_H_PHPMailer 2075 0.54 0.45 0.58 175 HTML_TAG_BALANCE_BODY 2075 0.76 1.16 0.58 176 TR_LOTS_OF_MONEY3 2062 0.82 1.35 0.57 177 TM2_M_OBFU_COMMENT 2039 0.67 0.89 0.57 178 XMNoVowels 2017 0.51 0.41 0.56 179 MPART_ALT_DIFF_COUNT 1934 0.67 0.96 0.54 180 TRACKER_ID 1894 0.40 0.12 0.53 181 T_OBFU_PDF_ATTACH 1883 0.42 0.18 0.52 182 T_Symld_Words_02 1874 0.55 0.61 0.52 183 XMSubMetaSxObfu_03 1803 0.63 0.93 0.50 184 SpammyFromTLD_02 1784 0.84 1.62 0.50 185 XMMoneyMeta_00 1753 0.82 1.54 0.49 186 FORGED_GMAIL_RCVD 1732 0.58 0.80 0.48 187 XMLngstWrd_00 1698 0.56 0.74 0.47 188 XMPhish14 1677 0.72 1.30 0.47 189 NML_ADSP_CUSTOM_MED 1674 0.58 0.84 0.47 190 XMPhish30 1638 0.71 1.28 0.46 191 TR_XM_SpammyWords2 1600 3.68 10.87 0.45 192 USER_IN_WHITELIST 1528 0.29 0.00 0.43 193 USER_IN_WELCOMELIST 1528 0.29 0.00 0.43 194 RELAYCOUNTRY_GB 1520 0.52 0.75 0.42 195 HTML_IMAGE_ONLY_20 1485 0.40 0.36 0.41 196 LongTLD 1462 0.65 1.17 0.41 197 HTML_IMAGE_ONLY_32 1438 0.34 0.19 0.40 198 HTML_IMAGE_ONLY_28 1417 0.35 0.26 0.39 199 FROM_GOV_SPOOF 1411 0.30 0.09 0.39 200 TR_XM_Spammywords 1403 0.59 1.04 0.39 ----------------------------------------------------------------------