Email: 457599 Autolearn: 0 AvgScore: 4.35 AvgScanTime: 1.28 sec Spam: 136523 Autolearn: 0 AvgScore: 14.92 AvgScanTime: 1.45 sec Ham: 321076 Autolearn: 0 AvgScore: -0.15 AvgScanTime: 1.21 sec Time Spent Running SA: 162.76 hours Time Spent Processing Spam: 54.97 hours Time Spent Processing Ham: 107.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130578 88.81 95.65 85.90 2 DKIM_SIGNED 121148 78.31 88.74 73.88 3 XM_DK_Pass 116499 76.35 85.33 72.52 4 DKIM_VALID 114869 75.23 84.14 71.45 5 RELAYCOUNTRY_US 113472 80.81 83.12 79.82 6 XM_B_Unicode 111711 72.53 81.83 68.58 7 DCC_CHECK 103097 49.54 75.52 38.49 8 XM_B_SpammyWords 95434 52.49 69.90 45.09 9 XMListUnsubscribeExists 94515 53.16 69.23 46.33 10 DKIM_VALID_AU 91236 60.26 66.83 57.46 11 LOC_TINY_FONT_1 68122 32.18 49.90 24.65 12 XM_B_Unicode3 67464 42.54 49.42 39.61 13 BAYES_50 56843 55.43 41.64 61.30 14 XM_B_SpammyWords2 56296 25.53 41.24 18.86 15 HTML_FONT_LOW_CONTRAST 53809 30.16 39.41 26.22 16 XM_DK_Undo_02 52950 14.91 38.78 4.76 17 RCVD_IN_MSPIKE_H2 50466 34.05 36.97 32.81 18 FVGT_m_MULTI_ODD 45793 26.20 33.54 23.08 19 T_KAM_HTML_FONT_INVALID 45085 23.72 33.02 19.77 20 BAYES_99 41387 11.48 30.32 3.47 21 MIME_HTML_ONLY 38376 22.42 28.11 20.00 22 TR_XM_DKIM_Undo 36917 9.55 27.04 2.11 23 DKIM_VALID_EF 36161 28.15 26.49 28.85 24 XMSubLong 32152 22.79 23.55 22.46 25 BAYES_999 31786 8.65 23.28 2.43 26 T_TM2_M_HEADER_IN_MSG 31534 28.25 23.10 30.45 27 XM_Multi_Part_URI 31532 16.11 23.10 13.14 28 DCC_CHECK_NEGATIVE 30914 49.88 22.64 61.47 29 TR_DCC_Bayes_99 30579 7.57 22.40 1.26 30 TR_XM_DK_Unsub 24605 14.00 18.02 12.28 31 XM_B_Unsub 24218 11.99 17.74 9.54 32 UNPARSEABLE_RELAY 24086 12.68 17.64 10.57 33 TR_XM_BayesUnsub 23162 10.03 16.97 7.08 34 RELAYCOUNTRY_META 20292 7.16 14.86 3.89 35 XM_B_SpammyWords3 20161 7.13 14.77 3.89 36 TR_MAX_INTL_RELAY 19676 8.30 14.41 5.70 37 LOTS_OF_MONEY 18087 8.39 13.25 6.33 38 BOTNET_IPINHOSTNAME 17063 6.12 12.50 3.41 39 TR_XM_SpammyWords4 16695 6.71 12.23 4.36 40 TR_XM_SpammyRelay 16013 4.96 11.73 2.08 41 TR_XM_SpammyWords2 14899 3.58 10.91 0.47 42 BOTNET 13745 4.08 10.07 1.54 43 XM_Evil_Numbers_Gen 13109 9.07 9.60 8.84 44 TR_XM_UnparsRelay 12616 3.78 9.24 1.46 45 FSL_BULK_SIG 12606 8.19 9.23 7.74 46 BAYES_80 12334 5.14 9.03 3.48 47 XM_B_Phish_Phrases 12052 5.90 8.83 4.66 48 XM_Body_Dirty_Words 11926 4.50 8.74 2.70 49 LotsOfNums_01 11256 8.35 8.24 8.39 50 BAYES_60 10812 8.17 7.92 8.27 51 HTML_IMAGE_RATIO_02 10286 5.18 7.53 4.17 52 XMSubMetaSx_00 9534 4.92 6.98 4.04 53 RCVD_IN_BL_SPAMCOP_NET 9429 2.47 6.91 0.59 54 XM_UncommonTLD01 8707 4.83 6.38 4.17 55 UNTRUSTED_Relay 8515 2.87 6.24 1.44 56 XM_B_PhoneNumber 8080 8.95 5.92 10.24 57 TR_XM_SPAMCOP 8003 2.00 5.86 0.36 58 XM_H_Long_From01 7933 5.53 5.81 5.41 59 MPART_ALT_DIFF 7461 4.13 5.47 3.56 60 TooManyTo_001 7359 8.68 5.39 10.08 61 RELAYCOUNTRY_CA 7174 2.43 5.25 1.22 62 BAYES_95 6922 3.06 5.07 2.21 63 XMSexyCombo_05 6831 2.52 5.00 1.47 64 XM_H_GMP 6625 5.27 4.85 5.44 65 HTML_IMAGE_RATIO_04 6530 4.14 4.78 3.87 66 XM_B_Investor 6508 2.62 4.77 1.71 67 T_XMDrugObfuBody_14 6356 2.67 4.66 1.83 68 DKIM_INVALID 6279 3.07 4.60 2.43 69 TM2_M_VERY_LONG_WORD 5964 2.30 4.37 1.41 70 TR_XM_PhishingBody 5822 2.66 4.26 1.98 71 XM_B_SpammyTLD 5582 3.42 4.09 3.14 72 XM_CamelCaseFrm001 5370 2.81 3.93 2.33 73 XMStrtUSub 5241 4.82 3.84 5.24 74 HTML_IMAGE_RATIO_06 5147 2.78 3.77 2.36 75 TR_XM_SpammyWords5 4939 2.03 3.62 1.35 76 XM_SPF_SoftFail 4898 2.04 3.59 1.38 77 MIME_HTML_MOSTLY 4823 2.47 3.53 2.02 78 XMNumbers 4628 2.96 3.39 2.78 79 TM2_M_URI_OPT_OUT 4596 2.99 3.37 2.83 80 RCVD_IN_MSPIKE_WL 4534 5.09 3.32 5.84 81 RCVD_IN_MSPIKE_H3 4534 5.09 3.32 5.84 82 XM_OfRef6 4512 1.67 3.30 0.97 83 MIME_HTML_ONLY_MULTI 4487 2.55 3.29 2.24 84 RELAYCOUNTRY_AU 4324 1.44 3.17 0.71 85 XMDiploma_00 4231 2.04 3.10 1.58 86 RCVD_IN_VALIDITY_RPBL 4195 0.98 3.07 0.09 87 TR_XM_NoHeaderRelay 4030 1.08 2.95 0.28 88 MIME_QP_LONG_LINE 3972 5.11 2.91 6.04 89 XM_UB50 3838 1.41 2.81 0.81 90 HTML_IMAGE_RATIO_08 3800 2.69 2.78 2.65 91 T_XMDrugObfuBody_08 3711 1.81 2.72 1.43 92 XM_B_SpammyWords4 3652 1.18 2.68 0.54 93 T_TooManySym_01 3545 4.61 2.60 5.47 94 XM_B_URI_Unicode 3481 2.36 2.55 2.29 95 BOTNET_NORDNS 3477 0.77 2.55 0.01 96 XM_B_Unsub2 3431 1.77 2.51 1.46 97 XMBody_17 3396 0.99 2.49 0.36 98 RCVD_IN_VALIDITY_SAFE 3305 3.93 2.42 4.57 99 XM_URI_RBL 3161 0.97 2.32 0.39 100 FROM_EXCESS_BASE64 3058 1.93 2.24 1.80 101 XM_DK_Undo_01 2860 1.83 2.09 1.72 102 SUBJ_ALL_CAPS 2858 1.59 2.09 1.38 103 MAILING_LIST_MULTI 2835 2.90 2.08 3.25 104 RCVD_IN_VALIDITY_CERTIFIED 2826 3.40 2.07 3.96 105 DIET_1 2795 1.03 2.05 0.60 106 URI_HEX 2779 1.48 2.04 1.25 107 T_XMHurry_00 2720 0.90 1.99 0.43 108 XM_H_Long_From02 2686 1.30 1.97 1.01 109 USER_IN_DEF_DKIM_WL 2615 9.71 1.92 13.03 110 DKIM_ADSP_NXDOMAIN 2609 0.76 1.91 0.27 111 XMStockSpam_06 2609 1.44 1.91 1.24 112 HTML_MIME_NO_HTML_TAG 2498 2.18 1.83 2.33 113 SpammyFromTLD_01 2497 1.18 1.83 0.90 114 SHORTCIRCUIT 2459 0.54 1.80 0.00 115 RCVD_IN_ZEN_LASTEXTERNAL 2459 0.54 1.80 0.00 116 SpammyFromTLD_02 2401 0.89 1.76 0.53 117 BAYES_40 2369 3.93 1.74 4.87 118 XMSubMetaSxObfu_03 2342 0.90 1.72 0.56 119 XMBrknScrpt_02 2309 1.17 1.69 0.95 120 T_XMDrugObfuBody_00 2268 1.25 1.66 1.08 121 T_REMOTE_IMAGE 2247 3.38 1.65 4.12 122 XMBdyGiftCard01 2172 0.78 1.59 0.44 123 XMGenDplmaNmb 2131 1.09 1.56 0.89 124 ALL_TRUSTED 2104 12.33 1.54 16.92 125 XM_B_SEO 2064 0.61 1.51 0.23 126 TR_Symld_Words 2058 1.81 1.51 1.94 127 TR_XM_PHPDW 2058 0.77 1.51 0.45 128 TR_XM_PHPForged 2052 0.77 1.50 0.45 129 XMPhish30 2028 1.07 1.49 0.90 130 TR_XM_FormFill2 2022 0.76 1.48 0.46 131 XM_SendGrid 2005 1.29 1.47 1.22 132 XM_H_PHPOS 2000 0.75 1.46 0.45 133 ANY_BOUNCE_MESSAGE 1970 2.34 1.44 2.73 134 TR_XM_INV_DKIM 1967 0.47 1.44 0.06 135 BOUNCE_MESSAGE 1960 2.34 1.44 2.72 136 XM_B_COVIDMETA 1921 0.59 1.41 0.25 137 RCVD_IN_PBL 1904 0.93 1.39 0.74 138 NO_DNS_FOR_FROM 1886 0.62 1.38 0.30 139 TR_XM_MaxWHORU 1870 0.58 1.37 0.25 140 XM_B_COPY_HTML 1864 0.96 1.37 0.79 141 XMSubMetaI_00 1814 0.77 1.33 0.53 142 T_FILL_THIS_FORM_SHORT 1805 1.14 1.32 1.07 143 TR_LOTS_OF_MONEY2 1796 0.49 1.32 0.14 144 T_MONEY_PERCENT 1796 0.49 1.32 0.14 145 HTTPS_HTTP_MISMATCH 1786 0.97 1.31 0.83 146 MISSING_HEADERS 1742 0.68 1.28 0.43 147 TR_XM_SEO4 1735 0.44 1.27 0.09 148 TR_LOTS_OF_MONEY3 1729 0.58 1.27 0.29 149 TR_XM_InvalidRelay 1724 0.39 1.26 0.01 150 XMReplyNow 1714 0.56 1.26 0.26 151 KHOP_HELO_FCRDNS 1686 1.40 1.23 1.48 152 RCVD_IN_PSBL 1643 0.43 1.20 0.11 153 TR_XM_RelayPhish 1634 0.40 1.20 0.06 154 XM_OfRef7 1628 0.47 1.19 0.17 155 XMSlimDrugH 1609 0.67 1.18 0.46 156 SHOPIFY_IMG_NOT_RCVD_SFY 1598 0.50 1.17 0.22 157 LongTLD 1592 0.65 1.17 0.43 158 RCVD_IN_IADB_LISTED 1579 3.01 1.16 3.80 159 RCVD_IN_XBL 1579 0.37 1.16 0.03 160 TR_MetaPhish_Combo_01 1578 0.89 1.16 0.78 161 XMMoneyMeta_00 1576 0.74 1.15 0.56 162 XM_B_Phish66 1520 0.55 1.11 0.31 163 URI_NOVOWEL 1510 1.68 1.11 1.92 164 XM_Dr_From 1455 0.38 1.07 0.09 165 LOADSA_MONEY_COMBO 1453 0.35 1.06 0.05 166 XPRIO 1451 0.33 1.06 0.02 167 BAYES_20 1426 2.79 1.04 3.53 168 TM2_M_OBFU_COMMENT 1418 0.54 1.04 0.33 169 XMSexyCombo_01 1415 0.44 1.04 0.19 170 RCVD_IN_IADB_SPF 1390 2.64 1.02 3.33 171 TO_NO_BRKTS_FROM_MSSP 1375 0.32 1.01 0.03 172 FILL_THIS_FORM 1370 0.66 1.00 0.51 173 TooManyTo_002 1368 2.83 1.00 3.61 174 SH_BODYURI_REVERSE_CSS 1368 0.34 1.00 0.06 175 URIBL_CSS 1364 0.34 1.00 0.07 176 URIBL_CSS_A 1364 0.34 1.00 0.07 177 HK_SCAM 1353 0.30 0.99 0.01 178 HTML_TAG_BALANCE_BODY 1333 0.66 0.98 0.53 179 TR_XM_DK_SendGrid 1325 0.85 0.97 0.80 180 XMHTML_After_End 1325 0.51 0.97 0.32 181 XM_B_REG_HTML 1319 0.43 0.97 0.20 182 RELAYCOUNTRY_FR 1318 0.44 0.97 0.22 183 URI_TRY_3LD 1315 0.67 0.96 0.55 184 RCVD_IN_IADB_DK 1306 2.32 0.96 2.90 185 RCVD_IN_IADB_SENDERID 1288 2.38 0.94 2.99 186 REPLYTO_WITHOUT_TO_CC 1288 0.29 0.94 0.02 187 XM_UB80 1285 0.29 0.94 0.01 188 T_STY_INVIS_DIRECT 1282 0.53 0.94 0.35 189 XM_ProductURIs 1260 0.59 0.92 0.44 190 MPART_ALT_DIFF_COUNT 1260 0.73 0.92 0.64 191 XM_Lotto 1254 0.39 0.92 0.17 192 TooManyTo_003 1253 1.52 0.92 1.78 193 MONEY_FORM 1252 0.29 0.92 0.02 194 TR_XM_Base64_M1 1252 0.72 0.92 0.63 195 FORGED_MUA_OUTLOOK 1246 0.29 0.91 0.02 196 AXB_XMAILER_MIMEOLE_OL_024C2 1239 0.27 0.91 0.00 197 XM_H_Undi_Recip 1239 0.39 0.91 0.17 198 FSL_NEW_HELO_USER 1238 0.27 0.91 0.00 199 RCVD_IN_SORBS_DUL 1238 0.31 0.91 0.05 200 RDNS_DYNAMIC 1234 0.64 0.90 0.53 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 275816 88.81 95.65 85.90 2 RELAYCOUNTRY_US 256294 80.81 83.12 79.82 3 DKIM_SIGNED 237195 78.31 88.74 73.88 4 XM_DK_Pass 232857 76.35 85.33 72.52 5 DKIM_VALID 229404 75.23 84.14 71.45 6 XM_B_Unicode 220200 72.53 81.83 68.58 7 DCC_CHECK_NEGATIVE 197357 49.88 22.64 61.47 8 BAYES_50 196821 55.43 41.64 61.30 9 DKIM_VALID_AU 184494 60.26 66.83 57.46 10 XMListUnsubscribeExists 148762 53.16 69.23 46.33 11 XM_B_SpammyWords 144765 52.49 69.90 45.09 12 XM_B_Unicode3 127176 42.54 49.42 39.61 13 DCC_CHECK 123579 49.54 75.52 38.49 14 RCVD_IN_MSPIKE_H2 105338 34.05 36.97 32.81 15 T_TM2_M_HEADER_IN_MSG 97757 28.25 23.10 30.45 16 DKIM_VALID_EF 92634 28.15 26.49 28.85 17 HTML_FONT_LOW_CONTRAST 84190 30.16 39.41 26.22 18 LOC_TINY_FONT_1 79148 32.18 49.90 24.65 19 FVGT_m_MULTI_ODD 74108 26.20 33.54 23.08 20 XMSubLong 72121 22.79 23.55 22.46 21 MIME_HTML_ONLY 64208 22.42 28.11 20.00 22 T_KAM_HTML_FONT_INVALID 63473 23.72 33.02 19.77 23 XM_B_SpammyWords2 60551 25.53 41.24 18.86 24 ALL_TRUSTED 54316 12.33 1.54 16.92 25 XM_Multi_Part_URI 42202 16.11 23.10 13.14 26 USER_IN_DEF_DKIM_WL 41833 9.71 1.92 13.03 27 TR_XM_DK_Unsub 39438 14.00 18.02 12.28 28 BAYES_00 34734 7.84 0.83 10.82 29 UNPARSEABLE_RELAY 33941 12.68 17.64 10.57 30 XM_B_PhoneNumber 32892 8.95 5.92 10.24 31 TooManyTo_001 32362 8.68 5.39 10.08 32 XM_B_Unsub 30630 11.99 17.74 9.54 33 XM_Evil_Numbers_Gen 28374 9.07 9.60 8.84 34 LotsOfNums_01 26949 8.35 8.24 8.39 35 BAYES_60 26563 8.17 7.92 8.27 36 FSL_BULK_SIG 24856 8.19 9.23 7.74 37 XM_DKIMWhitelistDomains 23114 5.06 0.05 7.20 38 IN_ZIMBRA_NJ_WHITELIST 22774 5.00 0.07 7.09 39 TR_XM_BayesUnsub 22730 10.03 16.97 7.08 40 TR_XM_DK_Bayes 21716 4.96 0.71 6.76 41 TR_XM_DK_Bayes1 21439 4.90 0.71 6.68 42 LOTS_OF_MONEY 20325 8.39 13.25 6.33 43 MIME_QP_LONG_LINE 19395 5.11 2.91 6.04 44 RCVD_IN_MSPIKE_H3 18755 5.09 3.32 5.84 45 RCVD_IN_MSPIKE_WL 18755 5.09 3.32 5.84 46 TR_XM_DK_Bayes2 18729 4.21 0.40 5.83 47 TR_MAX_INTL_RELAY 18314 8.30 14.41 5.70 48 T_TooManySym_01 17567 4.61 2.60 5.47 49 XM_H_GMP 17476 5.27 4.85 5.44 50 XM_H_Long_From01 17368 5.53 5.81 5.41 51 XMStrtUSub 16818 4.82 3.84 5.24 52 XM_PDF 16086 3.78 0.87 5.01 53 BAYES_40 15634 3.93 1.74 4.87 54 XM_DK_Undo_02 15282 14.91 38.78 4.76 55 XM_B_Phish_Phrases 14959 5.90 8.83 4.66 56 RCVD_IN_VALIDITY_SAFE 14674 3.93 2.42 4.57 57 TR_XM_SpammyWords4 14001 6.71 12.23 4.36 58 HTML_IMAGE_RATIO_02 13402 5.18 7.53 4.17 59 XM_UncommonTLD01 13382 4.83 6.38 4.17 60 T_REMOTE_IMAGE 13238 3.38 1.65 4.12 61 XMSubMetaSx_00 12984 4.92 6.98 4.04 62 RCVD_IN_VALIDITY_CERTIFIED 12712 3.40 2.07 3.96 63 XM_B_SpammyWords3 12486 7.13 14.77 3.89 64 RELAYCOUNTRY_META 12474 7.16 14.86 3.89 65 HTML_IMAGE_RATIO_04 12410 4.14 4.78 3.87 66 RCVD_IN_IADB_LISTED 12192 3.01 1.16 3.80 67 TooManyTo_002 11596 2.83 1.00 3.61 68 MPART_ALT_DIFF 11433 4.13 5.47 3.56 69 BAYES_20 11333 2.79 1.04 3.53 70 BAYES_80 11189 5.14 9.03 3.48 71 BAYES_99 11151 11.48 30.32 3.47 72 BOTNET_IPINHOSTNAME 10953 6.12 12.50 3.41 73 RCVD_IN_IADB_SPF 10698 2.64 1.02 3.33 74 MAILING_LIST_MULTI 10435 2.90 2.08 3.25 75 XM_B_SpammyTLD 10087 3.42 4.09 3.14 76 RCVD_IN_IADB_SENDERID 9585 2.38 0.94 2.99 77 RCVD_IN_IADB_DK 9310 2.32 0.96 2.90 78 T_TooManySym_02 9163 2.25 0.85 2.85 79 TM2_M_URI_OPT_OUT 9071 2.99 3.37 2.83 80 XMNumbers 8927 2.96 3.39 2.78 81 ANY_BOUNCE_MESSAGE 8750 2.34 1.44 2.73 82 BOUNCE_MESSAGE 8749 2.34 1.44 2.72 83 XM_Body_Dirty_Words 8663 4.50 8.74 2.70 84 HTML_IMAGE_RATIO_08 8496 2.69 2.78 2.65 85 RCVD_IN_IADB_VOUCHED 7916 1.90 0.58 2.47 86 DKIM_INVALID 7791 3.07 4.60 2.43 87 BAYES_999 7789 8.65 23.28 2.43 88 HTML_IMAGE_RATIO_06 7577 2.78 3.77 2.36 89 HTML_MIME_NO_HTML_TAG 7482 2.18 1.83 2.33 90 XM_CamelCaseFrm001 7471 2.81 3.93 2.33 91 XM_B_URI_Unicode 7339 2.36 2.55 2.29 92 INVALID_MSGID 7211 1.63 0.17 2.25 93 MIME_HTML_ONLY_MULTI 7180 2.55 3.29 2.24 94 BAYES_95 7102 3.06 5.07 2.21 95 TR_XM_DKIM_Undo 6777 9.55 27.04 2.11 96 TR_XM_SpammyRelay 6689 4.96 11.73 2.08 97 BAYES_05 6547 1.61 0.61 2.04 98 MIME_HTML_MOSTLY 6494 2.47 3.53 2.02 99 TO_MALFORMED 6417 1.40 0.00 2.00 100 TR_XM_PhishingBody 6373 2.66 4.26 1.98 101 TR_Symld_Words 6235 1.81 1.51 1.94 102 URI_NOVOWEL 6176 1.68 1.11 1.92 103 XMGappySubj_01 6033 1.37 0.16 1.88 104 T_XMDrugObfuBody_14 5861 2.67 4.66 1.83 105 FROM_EXCESS_BASE64 5788 1.93 2.24 1.80 106 TooManyTo_003 5704 1.52 0.92 1.78 107 RCVD_IN_IADB_OPTIN 5562 1.32 0.36 1.73 108 XM_DK_Undo_01 5533 1.83 2.09 1.72 109 XM_B_Investor 5491 2.62 4.77 1.71 110 XMDiploma_00 5087 2.04 3.10 1.58 111 BOTNET 4932 4.08 10.07 1.54 112 IN_HORDE_ADDRESS_BOOK 4858 1.09 0.09 1.51 113 KHOP_HELO_FCRDNS 4740 1.40 1.23 1.48 114 XMSexyCombo_05 4716 2.52 5.00 1.47 115 XM_B_Unsub2 4691 1.77 2.51 1.46 116 TR_XM_UnparsRelay 4685 3.78 9.24 1.46 117 UNTRUSTED_Relay 4623 2.87 6.24 1.44 118 T_XMDrugObfuBody_08 4583 1.81 2.72 1.43 119 TM2_M_VERY_LONG_WORD 4539 2.30 4.37 1.41 120 SUBJ_ALL_CAPS 4439 1.59 2.09 1.38 121 XM_SPF_SoftFail 4418 2.04 3.59 1.38 122 HELO_NODOT 4403 1.18 0.71 1.37 123 HELO_NO_DOMAIN 4394 1.17 0.71 1.37 124 TR_XM_SpammyWords5 4332 2.03 3.62 1.35 125 TooManyTo_004 4254 1.19 0.86 1.32 126 TR_DCC_Bayes_99 4053 7.57 22.40 1.26 127 XM_GoogleGroups 4047 1.09 0.70 1.26 128 URI_HEX 3999 1.48 2.04 1.25 129 XMStockSpam_06 3985 1.44 1.91 1.24 130 XMCapTrack 3959 1.05 0.60 1.23 131 RELAYCOUNTRY_CA 3927 2.43 5.25 1.22 132 XM_SendGrid 3917 1.29 1.47 1.22 133 TVD_SPACE_RATIO 3917 0.90 0.14 1.22 134 XM_B_FormFill 3730 0.82 0.01 1.16 135 XMGappySubj_02 3723 0.84 0.09 1.16 136 T_TooManySym_03 3615 0.87 0.28 1.13 137 TooManyTo_005 3559 1.02 0.82 1.11 138 T_XMDrugObfuBody_00 3457 1.25 1.66 1.08 139 FROM_GOV_DKIM_AU 3451 0.81 0.18 1.07 140 T_FILL_THIS_FORM_SHORT 3432 1.14 1.32 1.07 141 XM_H_Long_From02 3256 1.30 1.97 1.01 142 XM_OfRef6 3115 1.67 3.30 0.97 143 XM_H_PHPMailer 3069 0.85 0.61 0.96 144 XMBrknScrpt_02 3053 1.17 1.69 0.95 145 SpammyFromTLD_01 2881 1.18 1.83 0.90 146 XMPhish30 2878 1.07 1.49 0.90 147 XMGenDplmaNmb 2854 1.09 1.56 0.89 148 HTTPS_HTTP_MISMATCH 2668 0.97 1.31 0.83 149 XM_UB50 2603 1.41 2.81 0.81 150 XM_ShortIntro_01 2595 0.75 0.61 0.81 151 TR_XM_DK_SendGrid 2553 0.85 0.97 0.80 152 XM_B_COPY_HTML 2544 0.96 1.37 0.79 153 XMBody_95 2542 0.60 0.15 0.79 154 XMNoVowels 2542 0.68 0.42 0.79 155 TR_MetaPhish_Combo_01 2504 0.89 1.16 0.78 156 TVD_RCVD_IP 2474 0.79 0.83 0.77 157 DKIM_ADSP_CUSTOM_MED 2409 0.79 0.88 0.75 158 RCVD_IN_PBL 2362 0.93 1.39 0.74 159 T_OBFU_PDF_ATTACH 2333 0.62 0.36 0.73 160 RELAYCOUNTRY_AU 2286 1.44 3.17 0.71 161 T_Symld_Words_02 2154 0.72 0.83 0.67 162 MPART_ALT_DIFF_COUNT 2060 0.73 0.92 0.64 163 TR_XM_Base64_M1 2030 0.72 0.92 0.63 164 HTML_IMAGE_ONLY_28 2008 0.54 0.34 0.63 165 TO_NO_BRKTS_HTML_ONLY 1985 0.49 0.19 0.62 166 XM_B_DNDMA 1943 0.68 0.85 0.61 167 DIET_1 1933 1.03 2.05 0.60 168 RCVD_IN_BL_SPAMCOP_NET 1885 2.47 6.91 0.59 169 XMMoneyMeta_00 1811 0.74 1.15 0.56 170 TRACKER_ID 1810 0.50 0.36 0.56 171 XMSubMetaSxObfu_03 1790 0.90 1.72 0.56 172 URI_TRY_3LD 1769 0.67 0.96 0.55 173 XMSubMetaSxObfu_02 1751 0.51 0.44 0.55 174 XM_B_SpammyWords4 1742 1.18 2.68 0.54 175 MSGID_FROM_MTA_HEADER 1731 0.43 0.17 0.54 176 XMSubMetaI_00 1713 0.77 1.33 0.53 177 RDNS_DYNAMIC 1710 0.64 0.90 0.53 178 HTML_IMAGE_ONLY_32 1694 0.44 0.23 0.53 179 HTML_TAG_BALANCE_BODY 1689 0.66 0.98 0.53 180 SpammyFromTLD_02 1687 0.89 1.76 0.53 181 XMOemUri 1682 0.46 0.30 0.52 182 FILL_THIS_FORM 1631 0.66 1.00 0.51 183 XMPhish14 1616 0.54 0.64 0.50 184 USER_IN_WELCOMELIST 1597 0.35 0.00 0.50 185 USER_IN_WHITELIST 1597 0.35 0.00 0.50 186 NML_ADSP_CUSTOM_MED 1565 0.55 0.69 0.49 187 HTML_IMAGE_ONLY_20 1564 0.54 0.68 0.49 188 XMLngstWrd_00 1521 0.49 0.51 0.47 189 TR_XM_SpammyWords2 1503 3.58 10.91 0.47 190 RELAYCOUNTRY_GB 1482 0.55 0.74 0.46 191 TR_XM_FormFill2 1476 0.76 1.48 0.46 192 XMSlimDrugH 1473 0.67 1.18 0.46 193 TR_XM_PHPForged 1457 0.77 1.50 0.45 194 TR_XM_PHPDW 1452 0.77 1.51 0.45 195 TM2_M_BODY_EMPTY 1431 0.33 0.06 0.45 196 XM_H_PHPOS 1430 0.75 1.46 0.45 197 XM_ProductURIs 1426 0.59 0.92 0.44 198 XMBdyGiftCard01 1414 0.78 1.59 0.44 199 T_XMHurry_00 1384 0.90 1.99 0.43 200 LongTLD 1380 0.65 1.17 0.43 ----------------------------------------------------------------------