Email: 441336 Autolearn: 0 AvgScore: 3.83 AvgScanTime: 1.26 sec Spam: 127687 Autolearn: 0 AvgScore: 14.71 AvgScanTime: 1.42 sec Ham: 313649 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.20 sec Time Spent Running SA: 154.47 hours Time Spent Processing Spam: 50.34 hours Time Spent Processing Ham: 104.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 121970 87.44 95.52 84.15 2 DKIM_SIGNED 112764 76.98 88.31 72.37 3 XM_DK_Pass 108688 75.09 85.12 71.01 4 DKIM_VALID 107102 73.93 83.88 69.88 5 XM_B_Unicode 105927 71.44 82.96 66.75 6 RELAYCOUNTRY_US 105516 79.69 82.64 78.50 7 DCC_CHECK 97426 48.42 76.30 37.07 8 XM_B_SpammyWords 91476 51.13 71.64 42.78 9 XMListUnsubscribeExists 88407 51.70 69.24 44.57 10 DKIM_VALID_AU 84566 58.65 66.23 55.57 11 XM_B_Unicode3 61786 41.68 48.39 38.95 12 LOC_TINY_FONT_1 61311 30.34 48.02 23.14 13 BAYES_50 55755 54.70 43.67 59.19 14 XM_B_SpammyWords2 54782 24.93 42.90 17.62 15 HTML_FONT_LOW_CONTRAST 48265 28.67 37.80 24.95 16 XM_DK_Undo_02 47577 13.84 37.26 4.31 17 RCVD_IN_MSPIKE_H2 46898 33.41 36.73 32.06 18 FVGT_m_MULTI_ODD 41712 24.98 32.67 21.85 19 T_KAM_HTML_FONT_INVALID 41475 22.50 32.48 18.43 20 MIME_HTML_ONLY 37332 22.41 29.24 19.63 21 BAYES_99 36355 10.28 28.47 2.88 22 DKIM_VALID_EF 33346 27.93 26.12 28.67 23 TR_XM_DKIM_Undo 33194 8.76 26.00 1.74 24 XMSubLong 31096 23.14 24.35 22.65 25 XM_Multi_Part_URI 29429 16.90 23.05 14.40 26 T_TM2_M_HEADER_IN_MSG 28925 28.45 22.65 30.82 27 DCC_CHECK_NEGATIVE 28176 51.08 22.07 62.89 28 BAYES_999 27792 7.75 21.77 2.05 29 TR_DCC_Bayes_99 27097 6.85 21.22 1.00 30 TR_XM_DK_Unsub 23676 13.34 18.54 11.22 31 XM_B_Unsub 23368 11.94 18.30 9.35 32 UNPARSEABLE_RELAY 22381 12.76 17.53 10.81 33 TR_XM_BayesUnsub 22371 10.05 17.52 7.00 34 RELAYCOUNTRY_META 19450 7.08 15.23 3.76 35 XM_B_SpammyWords3 19308 7.33 15.12 4.16 36 TR_MAX_INTL_RELAY 17732 7.83 13.89 5.36 37 BOTNET_IPINHOSTNAME 16463 5.90 12.89 3.05 38 TR_XM_SpammyRelay 15309 4.86 11.99 1.95 39 LOTS_OF_MONEY 15296 7.52 11.98 5.71 40 TR_XM_SpammyWords4 14043 5.80 11.00 3.69 41 TR_XM_SpammyWords2 13714 3.32 10.74 0.30 42 BOTNET 13280 3.97 10.40 1.35 43 XM_Evil_Numbers_Gen 13263 9.66 10.39 9.37 44 FSL_BULK_SIG 12332 7.87 9.66 7.14 45 BAYES_80 11313 4.92 8.86 3.31 46 TR_XM_UnparsRelay 10747 3.54 8.42 1.56 47 XM_Body_Dirty_Words 10603 3.80 8.30 1.97 48 LotsOfNums_01 10522 8.13 8.24 8.08 49 BAYES_60 10192 8.16 7.98 8.24 50 XM_B_Phish_Phrases 9906 5.70 7.76 4.87 51 HTML_IMAGE_RATIO_02 9620 5.13 7.53 4.15 52 UNTRUSTED_Relay 8593 2.98 6.73 1.45 53 XM_UncommonTLD01 8445 4.95 6.61 4.28 54 RCVD_IN_BL_SPAMCOP_NET 8377 2.31 6.56 0.58 55 XM_B_PhoneNumber 7964 8.96 6.24 10.07 56 XMSubMetaSx_00 7918 4.27 6.20 3.49 57 MPART_ALT_DIFF 7568 4.73 5.93 4.24 58 TooManyTo_001 7240 8.41 5.67 9.52 59 RELAYCOUNTRY_CA 7190 2.49 5.63 1.21 60 XM_H_Long_From01 6894 5.08 5.40 4.96 61 XM_B_Investor 6669 2.61 5.22 1.54 62 TR_XM_SPAMCOP 6510 1.72 5.10 0.35 63 TR_XM_SpammyWords5 6403 2.55 5.01 1.54 64 XM_H_GMP 6349 5.51 4.97 5.73 65 XMStrtUSub 6282 5.06 4.92 5.12 66 BAYES_95 6082 2.84 4.76 2.05 67 XM_B_SpammyTLD 6019 4.50 4.71 4.41 68 TR_XM_PhishingBody 5937 2.44 4.65 1.54 69 DKIM_INVALID 5662 3.05 4.43 2.49 70 HTML_IMAGE_RATIO_04 5501 4.19 4.31 4.15 71 TM2_M_VERY_LONG_WORD 5402 2.42 4.23 1.68 72 T_XMDrugObfuBody_14 5244 2.27 4.11 1.52 73 XMNumbers 5074 3.19 3.97 2.87 74 XMSexyCombo_05 5036 1.83 3.94 0.97 75 MIME_HTML_ONLY_MULTI 4845 3.10 3.79 2.81 76 MIME_HTML_MOSTLY 4722 2.63 3.70 2.19 77 XM_SPF_SoftFail 4706 2.12 3.69 1.48 78 RCVD_IN_VALIDITY_RPBL 4676 1.12 3.66 0.09 79 TM2_M_URI_OPT_OUT 4632 2.60 3.63 2.18 80 XM_CamelCaseFrm001 4581 2.59 3.59 2.19 81 HTML_IMAGE_RATIO_06 4417 2.94 3.46 2.73 82 HTML_IMAGE_RATIO_08 4334 2.71 3.39 2.43 83 XM_UB50 4306 1.61 3.37 0.90 84 MIME_QP_LONG_LINE 4156 4.97 3.25 5.68 85 RELAYCOUNTRY_AU 4084 1.37 3.20 0.62 86 T_TooManySym_01 4033 5.08 3.16 5.87 87 DKIM_ADSP_NXDOMAIN 4026 1.11 3.15 0.27 88 T_XMDrugObfuBody_08 3980 1.91 3.12 1.42 89 SUBJ_ALL_CAPS 3662 2.01 2.87 1.66 90 TR_XM_NoHeaderRelay 3619 1.03 2.83 0.30 91 RCVD_IN_MSPIKE_WL 3561 4.70 2.79 5.48 92 RCVD_IN_MSPIKE_H3 3561 4.70 2.79 5.48 93 XM_OfRef6 3540 1.45 2.77 0.92 94 XMBody_17 3514 1.07 2.75 0.39 95 XMDiploma_00 3436 1.72 2.69 1.33 96 XM_B_SpammyWords4 3397 1.19 2.66 0.60 97 XM_B_Unsub2 3363 1.79 2.63 1.44 98 XM_B_URI_Unicode 3187 2.14 2.50 1.99 99 NO_DNS_FOR_FROM 3119 1.00 2.44 0.42 100 TR_XM_MaxWHORU 3090 0.96 2.42 0.37 101 XM_URI_RBL 2970 0.87 2.33 0.28 102 SpammyFromTLD_01 2861 1.35 2.24 0.98 103 MAILING_LIST_MULTI 2853 2.74 2.23 2.95 104 FROM_EXCESS_BASE64 2749 1.80 2.15 1.66 105 BOTNET_NORDNS 2729 0.63 2.14 0.01 106 XM_H_Long_From02 2559 1.31 2.00 1.03 107 XM_DK_Undo_01 2551 1.76 2.00 1.66 108 RCVD_IN_VALIDITY_SAFE 2543 3.73 1.99 4.44 109 TR_XM_PHPForged 2529 1.04 1.98 0.66 110 TR_XM_PHPDW 2511 1.04 1.97 0.66 111 TR_XM_FormFill2 2485 1.03 1.95 0.66 112 XM_H_PHPOS 2452 1.02 1.92 0.65 113 ALL_TRUSTED 2428 13.60 1.90 18.36 114 XMStockSpam_06 2400 1.58 1.88 1.46 115 BOUNCE_MESSAGE 2342 2.91 1.83 3.35 116 ANY_BOUNCE_MESSAGE 2342 2.91 1.83 3.35 117 BAYES_40 2322 4.54 1.82 5.65 118 HTML_MIME_NO_HTML_TAG 2287 2.09 1.79 2.22 119 XMBrknScrpt_02 2285 1.16 1.79 0.90 120 USER_IN_DEF_DKIM_WL 2280 9.32 1.79 12.39 121 SpammyFromTLD_02 2270 0.68 1.78 0.24 122 DIET_1 2268 0.93 1.78 0.59 123 TR_Symld_Words 2254 1.86 1.77 1.90 124 T_XMDrugObfuBody_00 2226 1.09 1.74 0.82 125 URI_HEX 2213 1.20 1.73 0.99 126 XM_B_SEO 2069 0.65 1.62 0.25 127 T_FILL_THIS_FORM_SHORT 2046 1.22 1.60 1.07 128 RCVD_IN_VALIDITY_CERTIFIED 2044 2.93 1.60 3.46 129 RCVD_IN_ZEN_LASTEXTERNAL 2041 0.46 1.60 0.00 130 SHORTCIRCUIT 2041 0.46 1.60 0.00 131 XMSubMetaI_00 2027 0.95 1.59 0.69 132 T_XMHurry_00 1952 0.70 1.53 0.36 133 RCVD_IN_PBL 1927 0.97 1.51 0.75 134 XMGenDplmaNmb 1909 0.93 1.50 0.70 135 XMPhish30 1896 0.83 1.48 0.56 136 SUSP_UTF8_WORD_SUBJ 1896 0.44 1.48 0.02 137 TR_XM_SEO4 1878 0.50 1.47 0.11 138 NORDNS_LOW_CONTRAST 1859 0.46 1.46 0.05 139 T_REMOTE_IMAGE 1853 3.12 1.45 3.80 140 TR_XM_InvalidRelay 1852 0.43 1.45 0.01 141 RCVD_IN_PSBL 1846 0.47 1.45 0.08 142 XM_SendGrid 1834 1.35 1.44 1.32 143 T_MONEY_PERCENT 1764 0.65 1.38 0.36 144 TR_LOTS_OF_MONEY2 1764 0.65 1.38 0.36 145 XM_Lotto 1738 0.48 1.36 0.12 146 KHOP_HELO_FCRDNS 1699 1.39 1.33 1.42 147 HTTPS_HTTP_MISMATCH 1694 0.99 1.33 0.86 148 XMBody_78 1678 0.60 1.31 0.31 149 BAYES_20 1677 3.12 1.31 3.85 150 THIS_AD 1675 0.63 1.31 0.36 151 RCVD_IN_IADB_LISTED 1625 3.06 1.27 3.79 152 SHOPIFY_IMG_NOT_RCVD_SFY 1611 0.51 1.26 0.21 153 XMSubMetaSxObfu_03 1574 0.78 1.23 0.60 154 XM_B_Phish66 1571 0.55 1.23 0.28 155 RCVD_IN_XBL 1571 0.37 1.23 0.02 156 SH_BODYURI_REVERSE_CSS 1556 0.39 1.22 0.06 157 URIBL_CSS_A 1556 0.39 1.22 0.06 158 URIBL_CSS 1556 0.39 1.22 0.06 159 XM_OfRef7 1536 0.46 1.20 0.16 160 XM_B_COPY_HTML 1523 0.78 1.19 0.62 161 TR_XM_INV_DKIM 1509 0.39 1.18 0.07 162 URI_TRY_3LD 1475 0.83 1.16 0.69 163 MISSING_HEADERS 1474 0.63 1.15 0.41 164 TooManyTo_002 1467 2.60 1.15 3.18 165 DKIM_ADSP_CUSTOM_MED 1445 0.92 1.13 0.83 166 XMBounce_01 1438 0.34 1.13 0.02 167 XM_DIRTYINTL 1419 0.37 1.11 0.07 168 XMSlimDrugH 1416 0.65 1.11 0.47 169 RCVD_IN_IADB_SPF 1413 2.67 1.11 3.30 170 LOADSA_MONEY_COMBO 1398 0.37 1.09 0.08 171 XMSexyCombo_01 1388 0.41 1.09 0.14 172 TooManyTo_003 1386 1.56 1.09 1.75 173 XMReplyNow 1350 0.50 1.06 0.27 174 TR_LOTS_OF_MONEY3 1332 0.43 1.04 0.18 175 RCVD_IN_IADB_SENDERID 1315 2.36 1.03 2.90 176 TooManyTo_004 1315 1.20 1.03 1.26 177 RCVD_IN_IADB_DK 1309 2.30 1.03 2.82 178 HTML_TAG_BALANCE_BODY 1299 0.65 1.02 0.50 179 URI_NOVOWEL 1290 2.79 1.01 3.52 180 HOSTED_IMG_MULTI_PUB_01 1289 0.35 1.01 0.08 181 LongTLD 1282 0.66 1.00 0.51 182 T_TooManySym_02 1278 2.36 1.00 2.92 183 TooManyTo_005 1276 1.01 1.00 1.02 184 TR_Mismatch_TLD_01 1266 0.44 0.99 0.22 185 XMHTML_After_End 1249 0.52 0.98 0.33 186 TR_XM_Base64_M1 1243 0.68 0.97 0.57 187 TM2_M_OBFU_COMMENT 1241 0.66 0.97 0.53 188 RDNS_DYNAMIC 1236 0.52 0.97 0.34 189 RELAYCOUNTRY_FR 1235 0.45 0.97 0.24 190 T_STY_INVIS_DIRECT 1224 0.52 0.96 0.34 191 TR_Caps_n_Bayes_99 1223 0.30 0.96 0.03 192 PDS_RDNS_DYNAMIC_FP 1215 0.41 0.95 0.19 193 XM_UB80 1209 0.28 0.95 0.01 194 XMPhish08 1208 0.43 0.95 0.22 195 XM_B_COVIDMETA 1160 0.40 0.91 0.19 196 TR_MetaPhish_Combo_01 1156 0.70 0.91 0.62 197 FILL_THIS_FORM 1148 0.64 0.90 0.53 198 XMBdyGiftCard01 1139 0.71 0.89 0.64 199 REPLYTO_WITHOUT_TO_CC 1137 0.28 0.89 0.03 200 XPRIO 1121 0.28 0.88 0.04 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 263925 87.44 95.52 84.15 2 RELAYCOUNTRY_US 246201 79.69 82.64 78.50 3 DKIM_SIGNED 226986 76.98 88.31 72.37 4 XM_DK_Pass 222725 75.09 85.12 71.01 5 DKIM_VALID 219171 73.93 83.88 69.88 6 XM_B_Unicode 209370 71.44 82.96 66.75 7 DCC_CHECK_NEGATIVE 197245 51.08 22.07 62.89 8 BAYES_50 185664 54.70 43.67 59.19 9 DKIM_VALID_AU 174293 58.65 66.23 55.57 10 XMListUnsubscribeExists 139784 51.70 69.24 44.57 11 XM_B_SpammyWords 134172 51.13 71.64 42.78 12 XM_B_Unicode3 122154 41.68 48.39 38.95 13 DCC_CHECK 116261 48.42 76.30 37.07 14 RCVD_IN_MSPIKE_H2 100551 33.41 36.73 32.06 15 T_TM2_M_HEADER_IN_MSG 96651 28.45 22.65 30.82 16 DKIM_VALID_EF 89911 27.93 26.12 28.67 17 HTML_FONT_LOW_CONTRAST 78263 28.67 37.80 24.95 18 LOC_TINY_FONT_1 72576 30.34 48.02 23.14 19 XMSubLong 71048 23.14 24.35 22.65 20 FVGT_m_MULTI_ODD 68536 24.98 32.67 21.85 21 MIME_HTML_ONLY 61566 22.41 29.24 19.63 22 T_KAM_HTML_FONT_INVALID 57804 22.50 32.48 18.43 23 ALL_TRUSTED 57579 13.60 1.90 18.36 24 XM_B_SpammyWords2 55252 24.93 42.90 17.62 25 XM_Multi_Part_URI 45167 16.90 23.05 14.40 26 BAYES_00 39190 9.13 0.87 12.49 27 USER_IN_DEF_DKIM_WL 38850 9.32 1.79 12.39 28 TR_XM_DK_Unsub 35190 13.34 18.54 11.22 29 UNPARSEABLE_RELAY 33918 12.76 17.53 10.81 30 XM_B_PhoneNumber 31591 8.96 6.24 10.07 31 TooManyTo_001 29874 8.41 5.67 9.52 32 XM_Evil_Numbers_Gen 29385 9.66 10.39 9.37 33 XM_B_Unsub 29341 11.94 18.30 9.35 34 BAYES_60 25834 8.16 7.98 8.24 35 LotsOfNums_01 25341 8.13 8.24 8.08 36 TR_XM_DK_Bayes 23890 5.63 0.76 7.62 37 XM_DKIMWhitelistDomains 23560 5.35 0.05 7.51 38 TR_XM_DK_Bayes1 23524 5.55 0.75 7.50 39 FSL_BULK_SIG 22393 7.87 9.66 7.14 40 TR_XM_BayesUnsub 21962 10.05 17.52 7.00 41 IN_ZIMBRA_NJ_WHITELIST 20652 4.70 0.07 6.58 42 TR_XM_DK_Bayes2 20504 4.80 0.54 6.54 43 T_TooManySym_01 18398 5.08 3.16 5.87 44 XM_H_GMP 17969 5.51 4.97 5.73 45 LOTS_OF_MONEY 17904 7.52 11.98 5.71 46 MIME_QP_LONG_LINE 17800 4.97 3.25 5.68 47 BAYES_40 17716 4.54 1.82 5.65 48 RCVD_IN_MSPIKE_H3 17191 4.70 2.79 5.48 49 RCVD_IN_MSPIKE_WL 17191 4.70 2.79 5.48 50 TR_MAX_INTL_RELAY 16825 7.83 13.89 5.36 51 XMStrtUSub 16067 5.06 4.92 5.12 52 XM_PDF 15807 3.78 0.69 5.04 53 XM_H_Long_From01 15545 5.08 5.40 4.96 54 XM_B_Phish_Phrases 15269 5.70 7.76 4.87 55 RCVD_IN_VALIDITY_SAFE 13935 3.73 1.99 4.44 56 XM_B_SpammyTLD 13830 4.50 4.71 4.41 57 XM_DK_Undo_02 13524 13.84 37.26 4.31 58 XM_UncommonTLD01 13421 4.95 6.61 4.28 59 MPART_ALT_DIFF 13303 4.73 5.93 4.24 60 XM_B_SpammyWords3 13043 7.33 15.12 4.16 61 HTML_IMAGE_RATIO_02 13015 5.13 7.53 4.15 62 HTML_IMAGE_RATIO_04 13011 4.19 4.31 4.15 63 BAYES_20 12071 3.12 1.31 3.85 64 T_REMOTE_IMAGE 11914 3.12 1.45 3.80 65 RCVD_IN_IADB_LISTED 11891 3.06 1.27 3.79 66 RELAYCOUNTRY_META 11792 7.08 15.23 3.76 67 TR_XM_SpammyWords4 11568 5.80 11.00 3.69 68 URI_NOVOWEL 11028 2.79 1.01 3.52 69 XMSubMetaSx_00 10933 4.27 6.20 3.49 70 RCVD_IN_VALIDITY_CERTIFIED 10867 2.93 1.60 3.46 71 ANY_BOUNCE_MESSAGE 10502 2.91 1.83 3.35 72 BOUNCE_MESSAGE 10502 2.91 1.83 3.35 73 BAYES_80 10390 4.92 8.86 3.31 74 RCVD_IN_IADB_SPF 10352 2.67 1.11 3.30 75 TooManyTo_002 9987 2.60 1.15 3.18 76 BOTNET_IPINHOSTNAME 9558 5.90 12.89 3.05 77 MAILING_LIST_MULTI 9250 2.74 2.23 2.95 78 T_TooManySym_02 9156 2.36 1.00 2.92 79 RCVD_IN_IADB_SENDERID 9105 2.36 1.03 2.90 80 BAYES_99 9034 10.28 28.47 2.88 81 XMNumbers 9007 3.19 3.97 2.87 82 RCVD_IN_IADB_DK 8855 2.30 1.03 2.82 83 MIME_HTML_ONLY_MULTI 8825 3.10 3.79 2.81 84 HTML_IMAGE_RATIO_06 8555 2.94 3.46 2.73 85 RCVD_IN_IADB_VOUCHED 8070 2.01 0.64 2.57 86 DKIM_INVALID 7815 3.05 4.43 2.49 87 HTML_IMAGE_RATIO_08 7637 2.71 3.39 2.43 88 INVALID_MSGID 7359 1.71 0.14 2.35 89 BAYES_05 7282 1.84 0.65 2.32 90 HTML_MIME_NO_HTML_TAG 6952 2.09 1.79 2.22 91 MIME_HTML_MOSTLY 6883 2.63 3.70 2.19 92 XM_CamelCaseFrm001 6855 2.59 3.59 2.19 93 TM2_M_URI_OPT_OUT 6840 2.60 3.63 2.18 94 TO_MALFORMED 6593 1.50 0.01 2.10 95 BAYES_95 6432 2.84 4.76 2.05 96 BAYES_999 6431 7.75 21.77 2.05 97 XM_B_URI_Unicode 6253 2.14 2.50 1.99 98 XM_Body_Dirty_Words 6187 3.80 8.30 1.97 99 TR_XM_SpammyRelay 6123 4.86 11.99 1.95 100 TR_Symld_Words 5963 1.86 1.77 1.90 101 RCVD_IN_IADB_OPTIN 5646 1.38 0.35 1.80 102 TooManyTo_003 5503 1.56 1.09 1.75 103 TR_XM_DKIM_Undo 5450 8.76 26.00 1.74 104 TM2_M_VERY_LONG_WORD 5275 2.42 4.23 1.68 105 SUBJ_ALL_CAPS 5219 2.01 2.87 1.66 106 XM_DK_Undo_01 5205 1.76 2.00 1.66 107 FROM_EXCESS_BASE64 5191 1.80 2.15 1.66 108 TR_XM_UnparsRelay 4885 3.54 8.42 1.56 109 XM_B_Investor 4845 2.61 5.22 1.54 110 TR_XM_SpammyWords5 4834 2.55 5.01 1.54 111 TR_XM_PhishingBody 4833 2.44 4.65 1.54 112 T_XMDrugObfuBody_14 4776 2.27 4.11 1.52 113 IN_HORDE_ADDRESS_BOOK 4661 1.08 0.08 1.49 114 XM_SPF_SoftFail 4635 2.12 3.69 1.48 115 XMStockSpam_06 4565 1.58 1.88 1.46 116 UNTRUSTED_Relay 4556 2.98 6.73 1.45 117 XM_B_Unsub2 4527 1.79 2.63 1.44 118 T_XMDrugObfuBody_08 4460 1.91 3.12 1.42 119 KHOP_HELO_FCRDNS 4449 1.39 1.33 1.42 120 HELO_NODOT 4275 1.05 0.27 1.36 121 HELO_NO_DOMAIN 4272 1.05 0.27 1.36 122 BOTNET 4238 3.97 10.40 1.35 123 XMDiploma_00 4165 1.72 2.69 1.33 124 TVD_SPACE_RATIO 4144 0.97 0.10 1.32 125 XM_SendGrid 4135 1.35 1.44 1.32 126 XM_GoogleGroups 4052 1.13 0.75 1.29 127 XMGappySubj_01 4015 0.96 0.17 1.28 128 TooManyTo_004 3966 1.20 1.03 1.26 129 XM_TLDProd2 3861 0.93 0.18 1.23 130 RELAYCOUNTRY_CA 3783 2.49 5.63 1.21 131 XMCapTrack 3622 1.01 0.65 1.15 132 T_TooManySym_03 3503 0.90 0.36 1.12 133 XM_H_Trusted_IP 3385 0.77 0.00 1.08 134 T_FILL_THIS_FORM_SHORT 3341 1.22 1.60 1.07 135 XM_H_Long_From02 3237 1.31 2.00 1.03 136 TooManyTo_005 3185 1.01 1.00 1.02 137 TR_DCC_Bayes_99 3143 6.85 21.22 1.00 138 URI_HEX 3100 1.20 1.73 0.99 139 SpammyFromTLD_01 3081 1.35 2.24 0.98 140 XMSexyCombo_05 3044 1.83 3.94 0.97 141 XM_ShortIntro_01 2916 0.81 0.50 0.93 142 XM_OfRef6 2875 1.45 2.77 0.92 143 XM_B_FormFill 2855 0.69 0.14 0.91 144 XMBrknScrpt_02 2821 1.16 1.79 0.90 145 XM_UB50 2816 1.61 3.37 0.90 146 FROM_GOV_DKIM_AU 2791 0.70 0.25 0.89 147 TR_XM_DK_SendGrid 2691 0.83 0.77 0.86 148 HTTPS_HTTP_MISMATCH 2683 0.99 1.33 0.86 149 XMGappySubj_02 2643 0.62 0.07 0.84 150 DKIM_ADSP_CUSTOM_MED 2614 0.92 1.13 0.83 151 T_XMDrugObfuBody_00 2571 1.09 1.74 0.82 152 XMSubNoVowel 2552 0.75 0.59 0.81 153 XMNoVowels 2357 0.68 0.49 0.75 154 RCVD_IN_PBL 2350 0.97 1.51 0.75 155 T_OBFU_PDF_ATTACH 2257 0.56 0.15 0.72 156 XMBody_95 2251 0.56 0.17 0.72 157 XMGenDplmaNmb 2195 0.93 1.50 0.70 158 URI_TRY_3LD 2167 0.83 1.16 0.69 159 XMSubMetaI_00 2167 0.95 1.59 0.69 160 TR_XM_PHPDW 2072 1.04 1.97 0.66 161 TR_XM_FormFill2 2069 1.03 1.95 0.66 162 TR_XM_PHPForged 2065 1.04 1.98 0.66 163 XM_H_PHPOS 2033 1.02 1.92 0.65 164 XM_ProductURIs 2029 0.71 0.86 0.65 165 XM_H_PHPMailer 2003 0.66 0.71 0.64 166 XMBdyGiftCard01 1996 0.71 0.89 0.64 167 RELAYCOUNTRY_AU 1955 1.37 3.20 0.62 168 TR_MetaPhish_Combo_01 1946 0.70 0.91 0.62 169 XM_B_COPY_HTML 1931 0.78 1.19 0.62 170 SHORT_URI_3 1922 0.50 0.23 0.61 171 TM2_M_BODY_EMPTY 1897 0.45 0.07 0.60 172 XMLngstWrd_00 1879 0.55 0.43 0.60 173 T_Symld_Words_02 1877 0.59 0.56 0.60 174 XMSubMetaSxObfu_03 1876 0.78 1.23 0.60 175 XM_B_SpammyWords4 1871 1.19 2.66 0.60 176 DIET_1 1844 0.93 1.78 0.59 177 RCVD_IN_BL_SPAMCOP_NET 1833 2.31 6.56 0.58 178 TVD_RCVD_IP 1809 0.66 0.87 0.58 179 TR_XM_Base64_M1 1779 0.68 0.97 0.57 180 XMPhish30 1751 0.83 1.48 0.56 181 NML_ADSP_CUSTOM_MED 1691 0.63 0.84 0.54 182 TM2_M_OBFU_COMMENT 1671 0.66 0.97 0.53 183 FILL_THIS_FORM 1670 0.64 0.90 0.53 184 HTML_IMAGE_ONLY_20 1663 0.52 0.49 0.53 185 LongTLD 1612 0.66 1.00 0.51 186 HTML_IMAGE_ONLY_32 1611 0.41 0.15 0.51 187 MPART_ALT_DIFF_COUNT 1587 0.60 0.82 0.51 188 HTML_TAG_BALANCE_BODY 1573 0.65 1.02 0.50 189 USER_IN_WHITELIST 1567 0.36 0.00 0.50 190 USER_IN_WELCOMELIST 1567 0.36 0.00 0.50 191 FORGED_GMAIL_RCVD 1560 0.60 0.84 0.50 192 XM_B_DNDMA 1556 0.58 0.78 0.50 193 MSGID_FROM_MTA_HEADER 1529 0.37 0.10 0.49 194 RELAYCOUNTRY_GB 1476 0.55 0.73 0.47 195 XMSlimDrugH 1466 0.65 1.11 0.47 196 HTML_IMAGE_ONLY_28 1438 0.40 0.25 0.46 197 XMDateMe_00 1430 0.46 0.46 0.46 198 HTML_IMAGE_ONLY_24 1345 0.36 0.19 0.43 199 XMMoneyMeta_00 1315 0.53 0.80 0.42 200 NO_DNS_FOR_FROM 1305 1.00 2.44 0.42 ----------------------------------------------------------------------