Email: 422665 Autolearn: 0 AvgScore: 4.42 AvgScanTime: 1.30 sec Spam: 128104 Autolearn: 0 AvgScore: 14.52 AvgScanTime: 1.42 sec Ham: 294561 Autolearn: 0 AvgScore: 0.03 AvgScanTime: 1.25 sec Time Spent Running SA: 152.56 hours Time Spent Processing Spam: 50.52 hours Time Spent Processing Ham: 102.03 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 122683 89.15 95.77 86.27 2 DKIM_SIGNED 114699 78.45 89.54 73.63 3 XM_DK_Pass 110533 76.56 86.28 72.34 4 DKIM_VALID 109072 75.50 85.14 71.31 5 RELAYCOUNTRY_US 107328 82.46 83.78 81.89 6 XM_B_Unicode 106505 72.69 83.14 68.15 7 DCC_CHECK 98192 49.40 76.65 37.54 8 XM_B_SpammyWords 89987 53.72 70.25 46.53 9 XMListUnsubscribeExists 89174 52.79 69.61 45.48 10 DKIM_VALID_AU 86361 60.55 67.41 57.56 11 XM_B_Unicode3 64911 42.94 50.67 39.59 12 LOC_TINY_FONT_1 63672 32.31 49.70 24.75 13 BAYES_50 51851 54.59 40.48 60.73 14 XM_DK_Undo_02 51557 16.04 40.25 5.51 15 XM_B_SpammyWords2 51548 26.01 40.24 19.83 16 HTML_FONT_LOW_CONTRAST 50830 30.81 39.68 26.95 17 RCVD_IN_MSPIKE_H2 48768 35.66 38.07 34.61 18 FVGT_m_MULTI_ODD 43529 26.61 33.98 23.41 19 T_KAM_HTML_FONT_INVALID 41403 23.22 32.32 19.26 20 BAYES_99 40247 12.34 31.42 4.04 21 TR_XM_DKIM_Undo 35699 10.13 27.87 2.41 22 MIME_HTML_ONLY 35381 22.10 27.62 19.70 23 DKIM_VALID_EF 34796 28.81 27.16 29.52 24 XM_Multi_Part_URI 31883 17.64 24.89 14.49 25 BAYES_999 30943 9.42 24.15 3.02 26 T_TM2_M_HEADER_IN_MSG 30552 29.25 23.85 31.60 27 TR_DCC_Bayes_99 30432 8.27 23.76 1.54 28 XMSubLong 28694 22.49 22.40 22.54 29 DCC_CHECK_NEGATIVE 27845 50.09 21.74 62.42 30 XM_B_Unsub 24691 11.92 19.27 8.73 31 TR_XM_BayesUnsub 23635 10.03 18.45 6.37 32 TR_XM_DK_Unsub 23481 13.81 18.33 11.84 33 UNPARSEABLE_RELAY 22411 13.51 17.49 11.77 34 XM_B_SpammyWords3 20062 8.83 15.66 5.85 35 TR_MAX_INTL_RELAY 18914 8.22 14.76 5.37 36 RELAYCOUNTRY_META 18465 7.02 14.41 3.81 37 LOTS_OF_MONEY 15904 7.73 12.41 5.70 38 TR_XM_SpammyWords4 14613 6.05 11.41 3.72 39 TR_XM_SpammyRelay 14248 4.90 11.12 2.19 40 BOTNET_IPINHOSTNAME 14142 5.77 11.04 3.47 41 TR_XM_SpammyWords2 13916 3.54 10.86 0.36 42 XM_Evil_Numbers_Gen 13362 9.44 10.43 9.00 43 RCVD_IN_BL_SPAMCOP_NET 11701 3.28 9.13 0.73 44 XM_Body_Dirty_Words 11675 4.58 9.11 2.61 45 BAYES_80 11368 4.94 8.87 3.23 46 TR_XM_UnparsRelay 11308 3.73 8.83 1.51 47 BOTNET 11252 3.80 8.78 1.63 48 FSL_BULK_SIG 11213 8.65 8.75 8.61 49 LotsOfNums_01 11020 9.42 8.60 9.77 50 XM_B_Phish_Phrases 10868 7.57 8.48 7.17 51 BAYES_60 10487 8.10 8.19 8.06 52 TR_XM_SPAMCOP 9630 2.61 7.52 0.48 53 HTML_IMAGE_RATIO_02 9535 5.11 7.44 4.09 54 MPART_ALT_DIFF 8358 5.16 6.52 4.56 55 XMSubMetaSx_00 7884 5.16 6.15 4.72 56 RELAYCOUNTRY_CA 7583 2.63 5.92 1.19 57 XM_B_PhoneNumber 7563 8.07 5.90 9.01 58 UNTRUSTED_Relay 7552 2.76 5.90 1.40 59 XM_H_Long_From01 7189 5.52 5.61 5.48 60 XM_B_Investor 7173 2.83 5.60 1.63 61 XM_UncommonTLD01 7162 4.73 5.59 4.35 62 BAYES_95 7065 3.16 5.52 2.14 63 XM_H_GMP 6920 5.41 5.40 5.41 64 TooManyTo_001 6540 7.74 5.11 8.89 65 TR_XM_PhishingBody 6509 2.37 5.08 1.18 66 T_XMDrugObfuBody_14 6454 2.85 5.04 1.89 67 TM2_M_VERY_LONG_WORD 5993 4.47 4.68 4.38 68 HTML_IMAGE_RATIO_04 5803 4.39 4.53 4.33 69 DKIM_INVALID 5627 2.95 4.39 2.32 70 XMSexyCombo_05 5555 2.59 4.34 1.83 71 XMStrtUSub 5548 4.74 4.33 4.91 72 XM_B_SpammyTLD 5385 3.39 4.20 3.03 73 HTML_IMAGE_RATIO_06 5343 2.84 4.17 2.27 74 MIME_HTML_MOSTLY 5084 2.98 3.97 2.55 75 TR_XM_SpammyWords5 4991 2.05 3.90 1.25 76 XMBody_17 4825 1.38 3.77 0.34 77 MIME_HTML_ONLY_MULTI 4793 2.82 3.74 2.42 78 XM_CamelCaseFrm001 4636 2.79 3.62 2.43 79 FROM_EXCESS_BASE64 4103 2.32 3.20 1.94 80 T_XMDrugObfuBody_08 4074 2.02 3.18 1.51 81 RCVD_IN_MSPIKE_H3 4066 4.81 3.17 5.52 82 RCVD_IN_MSPIKE_WL 4066 4.81 3.17 5.52 83 XM_UB50 3970 1.54 3.10 0.87 84 XMNumbers 3959 3.01 3.09 2.97 85 XM_OfRef6 3854 1.81 3.01 1.28 86 T_TooManySym_01 3786 4.86 2.96 5.69 87 XM_SPF_SoftFail 3768 1.88 2.94 1.42 88 XMDiploma_00 3681 1.85 2.87 1.40 89 MIME_QP_LONG_LINE 3653 4.54 2.85 5.27 90 TM2_M_URI_OPT_OUT 3637 2.30 2.84 2.07 91 HTML_IMAGE_RATIO_08 3570 2.17 2.79 1.90 92 XM_B_URI_Unicode 3533 2.31 2.76 2.11 93 RCVD_IN_VALIDITY_SAFE 3471 3.82 2.71 4.30 94 RELAYCOUNTRY_AU 3465 1.36 2.70 0.77 95 RCVD_IN_VALIDITY_RPBL 3271 0.83 2.55 0.08 96 XM_URI_RBL 3215 0.98 2.51 0.32 97 XM_B_Unsub2 3104 1.65 2.42 1.32 98 RCVD_IN_VALIDITY_CERTIFIED 3094 3.20 2.42 3.54 99 MAILING_LIST_MULTI 3093 2.65 2.41 2.75 100 USER_IN_DEF_DKIM_WL 3042 10.03 2.37 13.35 101 DKIM_ADSP_NXDOMAIN 2882 0.87 2.25 0.27 102 SUBJ_ALL_CAPS 2827 1.59 2.21 1.33 103 XM_B_SpammyWords4 2780 0.92 2.17 0.38 104 TR_XM_NoHeaderRelay 2566 0.74 2.00 0.19 105 SpammyFromTLD_01 2465 1.29 1.92 1.01 106 XMPhish30 2439 0.85 1.90 0.40 107 XMBrknScrpt_02 2413 1.14 1.88 0.81 108 ANY_BOUNCE_MESSAGE 2395 4.38 1.87 5.48 109 XM_DK_Undo_01 2392 1.79 1.87 1.75 110 BOUNCE_MESSAGE 2389 4.38 1.86 5.48 111 XMStockSpam_06 2296 1.41 1.79 1.24 112 XM_B_COPY_HTML 2287 1.07 1.79 0.75 113 T_XMHurry_00 2262 0.78 1.77 0.35 114 SpammyFromTLD_02 2142 0.98 1.67 0.68 115 BAYES_40 2108 3.93 1.65 4.92 116 DIET_1 2105 1.15 1.64 0.93 117 TR_XM_Base64_M1 2082 0.93 1.63 0.62 118 KHOP_HELO_FCRDNS 2063 2.47 1.61 2.84 119 TR_XM_PHPDW 2059 0.87 1.61 0.55 120 XM_SendGrid 2057 1.33 1.61 1.21 121 TR_XM_PHPForged 2046 0.86 1.60 0.54 122 RCVD_IN_ZEN_LASTEXTERNAL 2016 0.48 1.57 0.00 123 SHORTCIRCUIT 2016 0.48 1.57 0.00 124 TR_XM_FormFill2 2001 0.86 1.56 0.55 125 XM_H_PHPOS 1982 0.84 1.55 0.54 126 BOTNET_NORDNS 1959 0.47 1.53 0.01 127 XMGenDplmaNmb 1933 0.95 1.51 0.71 128 T_XMDrugObfuBody_00 1861 0.96 1.45 0.75 129 HTML_MIME_NO_HTML_TAG 1831 2.06 1.43 2.34 130 URI_HEX 1815 1.25 1.42 1.17 131 HTTPS_HTTP_MISMATCH 1774 0.89 1.38 0.68 132 TR_MetaPhish_Combo_01 1730 0.89 1.35 0.68 133 ALL_TRUSTED 1709 10.84 1.33 14.97 134 T_REMOTE_IMAGE 1706 3.20 1.33 4.01 135 NO_DNS_FOR_FROM 1697 0.65 1.32 0.36 136 XM_B_SEO 1696 0.59 1.32 0.27 137 TR_XM_MaxWHORU 1690 0.61 1.32 0.31 138 TM2_M_OBFU_COMMENT 1676 1.08 1.31 0.97 139 SH_BODYURI_REVERSE_CSS 1651 0.42 1.29 0.05 140 URIBL_CSS_A 1647 0.42 1.29 0.05 141 URIBL_CSS 1647 0.42 1.29 0.05 142 TR_Symld_Words 1617 1.99 1.26 2.31 143 TR_XM_INV_DKIM 1611 0.43 1.26 0.07 144 XM_DIRTYINTL 1604 0.47 1.25 0.13 145 T_FILL_THIS_FORM_SHORT 1532 1.08 1.20 1.03 146 XM_ProductURIs 1525 0.68 1.19 0.46 147 TR_LOTS_OF_MONEY2 1515 0.48 1.18 0.18 148 T_MONEY_PERCENT 1515 0.48 1.18 0.18 149 HTML_TAG_BALANCE_BODY 1503 0.67 1.17 0.45 150 DKIM_ADSP_CUSTOM_MED 1484 0.89 1.16 0.78 151 XMBdyGiftCard01 1471 0.72 1.15 0.53 152 MPART_ALT_DIFF_COUNT 1470 1.12 1.15 1.11 153 XM_H_Long_From02 1447 0.95 1.13 0.87 154 XMReplyNow 1447 0.49 1.13 0.21 155 LongTLD 1421 0.57 1.11 0.34 156 BAYES_20 1417 2.94 1.11 3.74 157 T_TooManySym_02 1414 2.46 1.10 3.05 158 XMSubMetaI_00 1404 0.70 1.10 0.53 159 URI_TRY_3LD 1379 0.82 1.08 0.71 160 XMSubMetaSxObfu_03 1377 0.93 1.07 0.86 161 RDNS_DYNAMIC 1370 0.68 1.07 0.51 162 SHOPIFY_IMG_NOT_RCVD_SFY 1359 0.49 1.06 0.24 163 TR_Mismatch_TLD_02 1347 0.36 1.05 0.06 164 PDS_RDNS_DYNAMIC_FP 1347 0.57 1.05 0.35 165 T_STY_INVIS_DIRECT 1346 0.55 1.05 0.33 166 RELAYCOUNTRY_FR 1325 0.45 1.03 0.20 167 AC_BR_BONANZA 1323 0.40 1.03 0.12 168 J_POPCORN_W_RD 1289 0.53 1.01 0.32 169 XM_B_COVIDMETA 1282 0.41 1.00 0.15 170 RCVD_IN_IADB_LISTED 1277 2.72 1.00 3.47 171 XM_B_Phish66 1266 0.49 0.99 0.27 172 TR_XM_SEO4 1257 0.37 0.98 0.11 173 SUSP_UTF8_WORD_SUBJ 1240 0.30 0.97 0.02 174 RCVD_IN_PSBL 1234 0.38 0.96 0.12 175 TR_XM_RelayPhish 1228 0.33 0.96 0.05 176 XM_UB99 1228 0.29 0.96 0.01 177 XM_B_REG_HTML 1226 0.43 0.96 0.20 178 TooManyTo_002 1218 2.54 0.95 3.23 179 NML_ADSP_CUSTOM_MED 1216 0.62 0.95 0.48 180 XMPhish14 1200 0.49 0.94 0.29 181 XMBounce_01 1200 0.29 0.94 0.01 182 T_Symld_Words_02 1184 0.65 0.92 0.53 183 XM_RXBody 1169 0.37 0.91 0.13 184 XMBody_78 1164 0.47 0.91 0.27 185 XMHTML_After_End 1162 0.47 0.91 0.28 186 FORGED_GMAIL_RCVD 1159 0.61 0.90 0.48 187 MIME_CHARSET_FARAWAY 1158 0.61 0.90 0.49 188 RCVD_IN_IADB_SPF 1153 2.39 0.90 3.03 189 XMSexyCombo_01 1144 0.39 0.89 0.17 190 TooManyTo_003 1131 1.65 0.88 1.98 191 XMPhish08 1100 0.37 0.86 0.16 192 RCVD_IN_IADB_DK 1088 2.09 0.85 2.64 193 RCVD_IN_IADB_SENDERID 1083 2.16 0.85 2.73 194 NORDNS_LOW_CONTRAST 1081 0.28 0.84 0.03 195 TVD_RCVD_IP 1070 0.77 0.84 0.75 196 XM_B_DNDMA 1066 0.89 0.83 0.91 197 TooManyTo_004 1064 1.32 0.83 1.54 198 XM_GoogleGroups 1060 1.12 0.83 1.25 199 RCVD_IN_SORBS_DUL 1059 0.27 0.83 0.03 200 TR_XM_DK_SendGrid 1045 0.81 0.82 0.81 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 254130 89.15 95.77 86.27 2 RELAYCOUNTRY_US 241217 82.46 83.78 81.89 3 DKIM_SIGNED 216883 78.45 89.54 73.63 4 XM_DK_Pass 213071 76.56 86.28 72.34 5 DKIM_VALID 210055 75.50 85.14 71.31 6 XM_B_Unicode 200730 72.69 83.14 68.15 7 DCC_CHECK_NEGATIVE 183854 50.09 21.74 62.42 8 BAYES_50 178890 54.59 40.48 60.73 9 DKIM_VALID_AU 169544 60.55 67.41 57.56 10 XM_B_SpammyWords 137059 53.72 70.25 46.53 11 XMListUnsubscribeExists 133957 52.79 69.61 45.48 12 XM_B_Unicode3 116602 42.94 50.67 39.59 13 DCC_CHECK 110586 49.40 76.65 37.54 14 RCVD_IN_MSPIKE_H2 101958 35.66 38.07 34.61 15 T_TM2_M_HEADER_IN_MSG 93092 29.25 23.85 31.60 16 DKIM_VALID_EF 86965 28.81 27.16 29.52 17 HTML_FONT_LOW_CONTRAST 79395 30.81 39.68 26.95 18 LOC_TINY_FONT_1 72907 32.31 49.70 24.75 19 FVGT_m_MULTI_ODD 68956 26.61 33.98 23.41 20 XMSubLong 66383 22.49 22.40 22.54 21 XM_B_SpammyWords2 58406 26.01 40.24 19.83 22 MIME_HTML_ONLY 58034 22.10 27.62 19.70 23 T_KAM_HTML_FONT_INVALID 56723 23.22 32.32 19.26 24 ALL_TRUSTED 44099 10.84 1.33 14.97 25 XM_Multi_Part_URI 42679 17.64 24.89 14.49 26 USER_IN_DEF_DKIM_WL 39331 10.03 2.37 13.35 27 TR_XM_DK_Unsub 34890 13.81 18.33 11.84 28 UNPARSEABLE_RELAY 34679 13.51 17.49 11.77 29 BAYES_00 32400 7.85 0.62 11.00 30 LotsOfNums_01 28788 9.42 8.60 9.77 31 XM_B_PhoneNumber 26528 8.07 5.90 9.01 32 XM_Evil_Numbers_Gen 26519 9.44 10.43 9.00 33 TooManyTo_001 26173 7.74 5.11 8.89 34 XM_B_Unsub 25711 11.92 19.27 8.73 35 FSL_BULK_SIG 25356 8.65 8.75 8.61 36 BAYES_60 23750 8.10 8.19 8.06 37 TR_XM_DK_Bayes 22612 5.49 0.47 7.68 38 TR_XM_DK_Bayes1 22404 5.44 0.47 7.61 39 IN_ZIMBRA_NJ_WHITELIST 21935 5.22 0.09 7.45 40 XM_B_Phish_Phrases 21115 7.57 8.48 7.17 41 XM_DKIMWhitelistDomains 20327 4.91 0.35 6.90 42 TR_XM_DK_Bayes2 19668 4.75 0.31 6.68 43 TR_XM_BayesUnsub 18758 10.03 18.45 6.37 44 XM_B_SpammyWords3 17243 8.83 15.66 5.85 45 LOTS_OF_MONEY 16786 7.73 12.41 5.70 46 T_TooManySym_01 16769 4.86 2.96 5.69 47 RCVD_IN_MSPIKE_WL 16274 4.81 3.17 5.52 48 RCVD_IN_MSPIKE_H3 16274 4.81 3.17 5.52 49 XM_DK_Undo_02 16221 16.04 40.25 5.51 50 XM_H_Long_From01 16155 5.52 5.61 5.48 51 ANY_BOUNCE_MESSAGE 16128 4.38 1.87 5.48 52 BOUNCE_MESSAGE 16128 4.38 1.86 5.48 53 XM_H_GMP 15942 5.41 5.40 5.41 54 TR_MAX_INTL_RELAY 15826 8.22 14.76 5.37 55 MIME_QP_LONG_LINE 15530 4.54 2.85 5.27 56 XM_PDF 14554 3.63 0.62 4.94 57 BAYES_40 14502 3.93 1.65 4.92 58 XMStrtUSub 14475 4.74 4.33 4.91 59 XMSubMetaSx_00 13911 5.16 6.15 4.72 60 MPART_ALT_DIFF 13439 5.16 6.52 4.56 61 TM2_M_VERY_LONG_WORD 12911 4.47 4.68 4.38 62 XM_UncommonTLD01 12826 4.73 5.59 4.35 63 HTML_IMAGE_RATIO_04 12756 4.39 4.53 4.33 64 RCVD_IN_VALIDITY_SAFE 12675 3.82 2.71 4.30 65 HTML_IMAGE_RATIO_02 12049 5.11 7.44 4.09 66 BAYES_99 11908 12.34 31.42 4.04 67 T_REMOTE_IMAGE 11811 3.20 1.33 4.01 68 RELAYCOUNTRY_META 11223 7.02 14.41 3.81 69 BAYES_20 11014 2.94 1.11 3.74 70 TR_XM_SpammyWords4 10958 6.05 11.41 3.72 71 RCVD_IN_VALIDITY_CERTIFIED 10421 3.20 2.42 3.54 72 BOTNET_IPINHOSTNAME 10230 5.77 11.04 3.47 73 RCVD_IN_IADB_LISTED 10209 2.72 1.00 3.47 74 TooManyTo_002 9525 2.54 0.95 3.23 75 BAYES_80 9509 4.94 8.87 3.23 76 T_TooManySym_02 8987 2.46 1.10 3.05 77 XM_B_SpammyTLD 8939 3.39 4.20 3.03 78 RCVD_IN_IADB_SPF 8936 2.39 0.90 3.03 79 BAYES_999 8883 9.42 24.15 3.02 80 XMNumbers 8744 3.01 3.09 2.97 81 KHOP_HELO_FCRDNS 8364 2.47 1.61 2.84 82 MAILING_LIST_MULTI 8106 2.65 2.41 2.75 83 RCVD_IN_IADB_SENDERID 8036 2.16 0.85 2.73 84 RCVD_IN_IADB_DK 7762 2.09 0.85 2.64 85 XM_Body_Dirty_Words 7680 4.58 9.11 2.61 86 MIME_HTML_MOSTLY 7503 2.98 3.97 2.55 87 INVALID_MSGID 7195 1.76 0.18 2.44 88 XM_CamelCaseFrm001 7156 2.79 3.62 2.43 89 MIME_HTML_ONLY_MULTI 7130 2.82 3.74 2.42 90 TR_XM_DKIM_Undo 7111 10.13 27.87 2.41 91 HTML_MIME_NO_HTML_TAG 6896 2.06 1.43 2.34 92 DKIM_INVALID 6828 2.95 4.39 2.32 93 TR_Symld_Words 6794 1.99 1.26 2.31 94 RCVD_IN_IADB_VOUCHED 6717 1.73 0.45 2.28 95 HTML_IMAGE_RATIO_06 6681 2.84 4.17 2.27 96 TR_XM_SpammyRelay 6445 4.90 11.12 2.19 97 TO_MALFORMED 6434 1.54 0.05 2.18 98 BAYES_95 6306 3.16 5.52 2.14 99 BAYES_05 6282 1.66 0.58 2.13 100 XM_B_URI_Unicode 6224 2.31 2.76 2.11 101 TM2_M_URI_OPT_OUT 6092 2.30 2.84 2.07 102 HTML_EXTRA_CLOSE 6006 1.43 0.02 2.04 103 TooManyTo_003 5826 1.65 0.88 1.98 104 FROM_EXCESS_BASE64 5722 2.32 3.20 1.94 105 HTML_IMAGE_RATIO_08 5609 2.17 2.79 1.90 106 T_XMDrugObfuBody_14 5576 2.85 5.04 1.89 107 XMSexyCombo_05 5402 2.59 4.34 1.83 108 XMGappySubj_01 5347 1.31 0.14 1.82 109 XM_DK_Undo_01 5167 1.79 1.87 1.75 110 BOTNET 4814 3.80 8.78 1.63 111 XM_B_Investor 4802 2.83 5.60 1.63 112 RCVD_IN_IADB_OPTIN 4613 1.17 0.27 1.57 113 IN_HORDE_ADDRESS_BOOK 4547 1.11 0.12 1.54 114 TooManyTo_004 4528 1.32 0.83 1.54 115 TR_DCC_Bayes_99 4526 8.27 23.76 1.54 116 T_XMDrugObfuBody_08 4443 2.02 3.18 1.51 117 TR_XM_UnparsRelay 4441 3.73 8.83 1.51 118 XM_SPF_SoftFail 4195 1.88 2.94 1.42 119 XMDiploma_00 4122 1.85 2.87 1.40 120 UNTRUSTED_Relay 4110 2.76 5.90 1.40 121 TooManyTo_005 3923 1.17 0.81 1.33 122 SUBJ_ALL_CAPS 3908 1.59 2.21 1.33 123 XM_B_Unsub2 3883 1.65 2.42 1.32 124 TVD_SPACE_RATIO 3828 0.95 0.14 1.30 125 XM_OfRef6 3776 1.81 3.01 1.28 126 XM_GoogleGroups 3681 1.12 0.83 1.25 127 TR_XM_SpammyWords5 3681 2.05 3.90 1.25 128 XMStockSpam_06 3662 1.41 1.79 1.24 129 URI_NOVOWEL 3586 1.08 0.76 1.22 130 XM_SendGrid 3556 1.33 1.61 1.21 131 HELO_NODOT 3539 0.92 0.29 1.20 132 HELO_NO_DOMAIN 3535 0.92 0.29 1.20 133 RELAYCOUNTRY_CA 3517 2.63 5.92 1.19 134 TR_XM_PhishingBody 3488 2.37 5.08 1.18 135 URI_HEX 3461 1.25 1.42 1.17 136 XMCapTrack 3353 0.96 0.55 1.14 137 MPART_ALT_DIFF_COUNT 3283 1.12 1.15 1.11 138 T_TooManySym_03 3168 0.88 0.42 1.08 139 FROM_GOV_DKIM_AU 3097 0.77 0.13 1.05 140 T_FILL_THIS_FORM_SHORT 3035 1.08 1.20 1.03 141 XMGappySubj_02 3020 0.74 0.07 1.03 142 SpammyFromTLD_01 2974 1.29 1.92 1.01 143 TM2_M_OBFU_COMMENT 2869 1.08 1.31 0.97 144 DIET_1 2750 1.15 1.64 0.93 145 XM_B_DNDMA 2687 0.89 0.83 0.91 146 HTML_IMAGE_ONLY_32 2594 0.66 0.15 0.88 147 XM_H_Long_From02 2569 0.95 1.13 0.87 148 XM_UB50 2551 1.54 3.10 0.87 149 XMSubMetaSxObfu_03 2541 0.93 1.07 0.86 150 XM_H_PHPMailer 2525 0.82 0.72 0.86 151 TR_XM_DK_SendGrid 2394 0.81 0.82 0.81 152 XMBrknScrpt_02 2388 1.14 1.88 0.81 153 FILL_THIS_FORM 2384 0.67 0.35 0.81 154 HTML_IMAGE_ONLY_28 2304 0.66 0.39 0.78 155 DKIM_ADSP_CUSTOM_MED 2297 0.89 1.16 0.78 156 XMBody_95 2294 0.63 0.28 0.78 157 RELAYCOUNTRY_AU 2279 1.36 2.70 0.77 158 XMNoVowels 2269 0.70 0.53 0.77 159 RCVD_IN_PBL 2252 0.77 0.78 0.76 160 XM_ShortIntro_01 2223 0.68 0.51 0.75 161 XM_B_COPY_HTML 2217 1.07 1.79 0.75 162 TVD_RCVD_IP 2204 0.77 0.84 0.75 163 T_XMDrugObfuBody_00 2196 0.96 1.45 0.75 164 RCVD_IN_BL_SPAMCOP_NET 2151 3.28 9.13 0.73 165 XMGenDplmaNmb 2093 0.95 1.51 0.71 166 TR_XM_Spammywords 2086 0.67 0.58 0.71 167 URI_TRY_3LD 2086 0.82 1.08 0.71 168 XM_S_SpammyWords 2086 0.67 0.58 0.71 169 TR_MetaPhish_Combo_01 2015 0.89 1.35 0.68 170 SpammyFromTLD_02 1991 0.98 1.67 0.68 171 HTTPS_HTTP_MISMATCH 1990 0.89 1.38 0.68 172 T_OBFU_PDF_ATTACH 1981 0.50 0.11 0.67 173 TR_XM_Base64_M1 1833 0.93 1.63 0.62 174 T_TVD_MIME_NO_HEADERS 1718 0.41 0.02 0.58 175 XM_B_FormFill 1698 0.41 0.02 0.58 176 TR_XM_FormFill2 1622 0.86 1.56 0.55 177 TR_XM_PHPDW 1612 0.87 1.61 0.55 178 TR_XM_PHPForged 1604 0.86 1.60 0.54 179 XM_H_PHPOS 1587 0.84 1.55 0.54 180 T_MANY_PILL_PRICE 1583 0.38 0.01 0.54 181 T_Symld_Words_02 1571 0.65 0.92 0.53 182 XMBdyGiftCard01 1562 0.72 1.15 0.53 183 XMSubMetaI_00 1561 0.70 1.10 0.53 184 RDNS_DYNAMIC 1497 0.68 1.07 0.51 185 HTML_FONT_FACE_BAD 1445 0.55 0.70 0.49 186 MSGID_FROM_MTA_HEADER 1438 0.38 0.14 0.49 187 USER_IN_WELCOMELIST 1433 0.34 0.00 0.49 188 USER_IN_WHITELIST 1433 0.34 0.00 0.49 189 MIME_CHARSET_FARAWAY 1431 0.61 0.90 0.49 190 NML_ADSP_CUSTOM_MED 1423 0.62 0.95 0.48 191 TR_XM_SPAMCOP 1416 2.61 7.52 0.48 192 FORGED_GMAIL_RCVD 1402 0.61 0.90 0.48 193 HTML_IMAGE_ONLY_20 1393 0.43 0.34 0.47 194 XMLngstWrd_00 1363 0.50 0.58 0.46 195 TM2_M_BODY_EMPTY 1362 0.33 0.04 0.46 196 XM_ProductURIs 1356 0.68 1.19 0.46 197 HTML_TAG_BALANCE_BODY 1333 0.67 1.17 0.45 198 RELAYCOUNTRY_GB 1294 0.47 0.54 0.44 199 MISSING_HEADERS 1266 0.54 0.78 0.43 200 XMClaimOffer 1263 0.50 0.66 0.43 ----------------------------------------------------------------------