Email: 376364 Autolearn: 0 AvgScore: 5.05 AvgScanTime: 1.29 sec Spam: 122069 Autolearn: 0 AvgScore: 14.50 AvgScanTime: 1.38 sec Ham: 254295 Autolearn: 0 AvgScore: 0.51 AvgScanTime: 1.25 sec Time Spent Running SA: 134.99 hours Time Spent Processing Spam: 46.67 hours Time Spent Processing Ham: 88.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114833 88.16 94.07 85.33 2 DKIM_SIGNED 104009 76.71 85.21 72.64 3 RELAYCOUNTRY_US 100048 78.90 81.96 77.44 4 XM_DK_Pass 99984 74.78 81.91 71.36 5 DKIM_VALID 99125 73.87 81.20 70.34 6 XM_B_Unicode 98403 73.05 80.61 69.42 7 DCC_CHECK 95505 50.93 78.24 37.82 8 XM_B_SpammyWords 84755 52.08 69.43 43.75 9 XMListUnsubscribeExists 84172 53.38 68.95 45.91 10 DKIM_VALID_AU 79129 59.87 64.82 57.49 11 LOC_TINY_FONT_1 60422 33.06 49.50 25.17 12 XM_B_Unicode3 58575 42.42 47.99 39.75 13 XM_B_SpammyWords2 50117 26.31 41.06 19.23 14 BAYES_50 48354 53.97 39.61 60.86 15 XM_DK_Undo_02 45601 15.52 37.36 5.04 16 HTML_FONT_LOW_CONTRAST 45176 31.03 37.01 28.16 17 RCVD_IN_MSPIKE_H2 44442 34.45 36.41 33.51 18 T_KAM_HTML_FONT_INVALID 38416 22.92 31.47 18.81 19 BAYES_99 38145 13.21 31.25 4.55 20 FVGT_m_MULTI_ODD 38058 26.32 31.18 23.99 21 MIME_HTML_ONLY 33407 22.75 27.37 20.53 22 TR_XM_DKIM_Undo 32040 9.93 26.25 2.10 23 DKIM_VALID_EF 30425 27.23 24.92 28.34 24 BAYES_999 29715 10.21 24.34 3.43 25 TR_DCC_Bayes_99 29016 8.77 23.77 1.57 26 XM_Multi_Part_URI 26918 16.42 22.05 13.72 27 XMSubLong 26225 23.51 21.48 24.48 28 DCC_CHECK_NEGATIVE 25053 48.65 20.52 62.15 29 T_TM2_M_HEADER_IN_MSG 24923 27.36 20.42 30.69 30 TR_XM_DK_Unsub 20619 13.49 16.89 11.86 31 RELAYCOUNTRY_META 20544 8.60 16.83 4.64 32 XM_B_SpammyWords3 20093 8.69 16.46 4.95 33 UNPARSEABLE_RELAY 19793 13.19 16.21 11.74 34 XM_B_Unsub 19766 11.03 16.19 8.55 35 TR_MAX_INTL_RELAY 19146 9.11 15.68 5.95 36 TR_XM_BayesUnsub 19132 9.61 15.67 6.70 37 FSL_BULK_SIG 15023 8.70 12.31 6.97 38 BOTNET_IPINHOSTNAME 14230 5.98 11.66 3.26 39 TR_XM_SpammyWords2 14078 4.20 11.53 0.67 40 TR_XM_SpammyRelay 13958 5.19 11.43 2.19 41 LOTS_OF_MONEY 13639 8.12 11.17 6.65 42 XM_Body_Dirty_Words 12423 5.56 10.18 3.34 43 TR_XM_SpammyWords4 12103 5.43 9.91 3.27 44 BAYES_80 11675 5.53 9.56 3.60 45 XM_Evil_Numbers_Gen 11349 9.09 9.30 8.99 46 BOTNET 11080 3.88 9.08 1.39 47 BAYES_60 10895 8.84 8.93 8.80 48 TR_XM_UnparsRelay 10650 4.01 8.72 1.75 49 LotsOfNums_01 9201 7.54 7.54 7.54 50 XM_UncommonTLD01 8972 6.03 7.35 5.39 51 RCVD_IN_BL_SPAMCOP_NET 8911 2.71 7.30 0.50 52 UNTRUSTED_Relay 8568 3.39 7.02 1.65 53 HTML_IMAGE_RATIO_02 8503 5.71 6.97 5.10 54 XMSubMetaSx_00 7991 4.32 6.55 3.24 55 TooManyTo_001 7623 8.22 6.24 9.16 56 XM_B_Phish_Phrases 7370 5.38 6.04 5.07 57 RELAYCOUNTRY_CA 7044 2.82 5.77 1.40 58 TR_XM_SPAMCOP 7044 2.11 5.77 0.35 59 MPART_ALT_DIFF 7015 4.92 5.75 4.53 60 XM_H_GMP 6859 5.92 5.62 6.06 61 BAYES_95 6855 3.41 5.62 2.35 62 XM_H_Long_From01 6757 5.31 5.54 5.21 63 TR_XM_SpammyWords5 6113 2.91 5.01 1.90 64 XMStrtUSub 6056 5.07 4.96 5.11 65 XM_B_SpammyTLD 5739 3.02 4.70 2.21 66 XM_B_PhoneNumber 5689 7.31 4.66 8.58 67 T_XMDrugObfuBody_14 5528 2.68 4.53 1.79 68 XM_B_Investor 5254 2.19 4.30 1.17 69 XMNumbers 5125 3.86 4.20 3.69 70 HTML_IMAGE_RATIO_04 5030 4.01 4.12 3.95 71 TR_XM_PhishingBody 5025 2.40 4.12 1.58 72 XMSexyCombo_05 5004 2.07 4.10 1.09 73 DKIM_INVALID 4884 2.85 4.00 2.29 74 HTML_IMAGE_RATIO_06 4783 3.18 3.92 2.82 75 MIME_HTML_MOSTLY 4726 2.83 3.87 2.32 76 XM_UB50 4521 1.85 3.70 0.95 77 TM2_M_VERY_LONG_WORD 4448 2.18 3.64 1.48 78 XM_CamelCaseFrm001 4324 2.74 3.54 2.36 79 TR_XM_NoHeaderRelay 4183 1.28 3.43 0.24 80 DKIM_ADSP_NXDOMAIN 4148 1.35 3.40 0.36 81 MIME_QP_LONG_LINE 3997 4.74 3.27 5.44 82 RCVD_IN_MSPIKE_WL 3990 4.41 3.27 4.96 83 RCVD_IN_MSPIKE_H3 3990 4.41 3.27 4.96 84 RCVD_IN_VALIDITY_RPBL 3969 1.15 3.25 0.14 85 XMBody_17 3851 1.32 3.15 0.44 86 T_XMHurry_00 3688 1.30 3.02 0.48 87 XM_SPF_SoftFail 3642 1.91 2.98 1.39 88 ALL_TRUSTED 3515 13.89 2.88 19.18 89 XMDiploma_00 3406 2.82 2.79 2.84 90 SUSP_UTF8_WORD_SUBJ 3359 0.91 2.75 0.03 91 MIME_HTML_ONLY_MULTI 3342 2.79 2.74 2.81 92 T_XMDrugObfuBody_08 3238 1.81 2.65 1.41 93 SUBJ_ALL_CAPS 3180 1.78 2.61 1.38 94 XMStockSpam_06 3076 1.90 2.52 1.60 95 XM_URI_RBL 3070 1.07 2.51 0.38 96 HTML_MIME_NO_HTML_TAG 3038 2.55 2.49 2.57 97 XM_OfRef6 3038 1.55 2.49 1.10 98 TM2_M_URI_OPT_OUT 3023 2.72 2.48 2.83 99 XM_B_SpammyWords4 3022 1.17 2.48 0.55 100 SUSP_UTF8_WORD_COMBO 3020 0.84 2.47 0.05 101 T_TooManySym_01 2971 6.01 2.43 7.72 102 ANY_BOUNCE_MESSAGE 2932 3.49 2.40 4.01 103 BOUNCE_MESSAGE 2931 3.48 2.40 4.01 104 HTML_IMAGE_RATIO_08 2877 2.30 2.36 2.27 105 RCVD_IN_VALIDITY_SAFE 2865 4.34 2.35 5.29 106 SpammyFromTLD_02 2837 0.88 2.32 0.19 107 RELAYCOUNTRY_AU 2801 1.23 2.29 0.72 108 FROM_EXCESS_BASE64 2776 2.04 2.27 1.92 109 XM_B_URI_Unicode 2609 1.87 2.14 1.74 110 TR_Mismatch_TLD_02 2570 0.73 2.11 0.06 111 T_REMOTE_IMAGE 2555 3.17 2.09 3.69 112 XMBody_78 2552 0.83 2.09 0.22 113 TR_XM_PHPForged 2442 0.99 2.00 0.51 114 RCVD_IN_VALIDITY_CERTIFIED 2437 3.28 2.00 3.89 115 MAILING_LIST_MULTI 2422 3.17 1.98 3.73 116 SH_BODYURI_REVERSE_CSS 2387 0.67 1.96 0.05 117 TR_XM_PHPDW 2380 0.97 1.95 0.51 118 URIBL_CSS 2372 0.66 1.94 0.05 119 URIBL_CSS_A 2372 0.66 1.94 0.05 120 TR_XM_FormFill2 2346 0.97 1.92 0.51 121 XM_H_PHPOS 2315 0.95 1.90 0.49 122 XMSubMetaI_00 2306 1.34 1.89 1.07 123 XMReplyNow 2258 0.82 1.85 0.33 124 T_FILL_THIS_FORM_SHORT 2208 1.13 1.81 0.80 125 XM_B_Unsub2 2199 1.31 1.80 1.07 126 XM_SendGrid 2178 1.55 1.78 1.44 127 T_XMDrugObfuBody_00 2172 0.89 1.78 0.46 128 XMBounce_01 2146 0.59 1.76 0.02 129 TR_Symld_Words 2103 1.69 1.72 1.68 130 XM_DK_Undo_01 2089 1.73 1.71 1.75 131 URI_HEX 2058 1.26 1.69 1.06 132 LongTLD 2014 0.75 1.65 0.31 133 XMSexyCombo_01 2003 0.65 1.64 0.17 134 THIS_AD 1953 0.96 1.60 0.66 135 DIET_1 1909 0.72 1.56 0.31 136 SpammyFromTLD_01 1908 0.99 1.56 0.72 137 USER_IN_DEF_DKIM_WL 1894 9.68 1.55 13.58 138 DKIM_ADSP_CUSTOM_MED 1873 1.19 1.53 1.02 139 XMBrknScrpt_02 1835 1.20 1.50 1.05 140 XM_PDF 1829 3.44 1.50 4.38 141 XM_B_SEO 1800 0.70 1.47 0.33 142 XM_H_Undi_Recip 1797 0.64 1.47 0.24 143 NO_DNS_FOR_FROM 1786 0.73 1.46 0.38 144 KHOP_HELO_FCRDNS 1770 1.59 1.45 1.65 145 TR_XM_MaxWHORU 1767 0.69 1.45 0.32 146 RCVD_IN_XBL 1763 0.48 1.44 0.02 147 BAYES_40 1752 3.49 1.44 4.47 148 XM_B_COPY_HTML 1732 0.94 1.42 0.71 149 DEAR_FRIEND 1713 0.50 1.40 0.06 150 XMPhish30 1700 0.87 1.39 0.62 151 T_STY_INVIS_DIRECT 1651 0.86 1.35 0.62 152 XM_DIRTYINTL 1590 0.48 1.30 0.09 153 HTTPS_HTTP_MISMATCH 1571 0.89 1.29 0.71 154 XMBdyGiftCard01 1560 1.11 1.28 1.03 155 TR_XM_INV_DKIM 1552 0.47 1.27 0.08 156 FORGED_GMAIL_RCVD 1532 0.83 1.26 0.62 157 NML_ADSP_CUSTOM_MED 1526 0.87 1.25 0.68 158 TR_XM_SEO4 1464 0.48 1.20 0.13 159 RELAYCOUNTRY_CN 1458 0.45 1.19 0.09 160 RCVD_IN_ZEN_LASTEXTERNAL 1457 0.39 1.19 0.00 161 SHORTCIRCUIT 1457 0.39 1.19 0.00 162 MPART_ALT_DIFF_COUNT 1439 0.70 1.18 0.47 163 XMLngstWrd_00 1422 0.96 1.16 0.86 164 XM_ProductURIs 1417 0.66 1.16 0.42 165 HTML_TAG_BALANCE_BODY 1397 0.76 1.14 0.58 166 RCVD_IN_SBL_CSS 1351 0.38 1.11 0.03 167 XM_UB99 1343 0.36 1.10 0.01 168 XMLngstWrd_01 1339 0.73 1.10 0.55 169 RCVD_IN_PBL 1330 0.88 1.09 0.78 170 BASE64_LENGTH_79_INF 1320 0.64 1.08 0.42 171 FROM_SUSPICIOUS_NTLD 1295 0.36 1.06 0.03 172 RCVD_IN_IADB_LISTED 1270 2.35 1.04 2.97 173 TR_XM_Undi_Recip11 1258 0.36 1.03 0.04 174 TR_XM_Undi_RecipCombo2 1248 0.34 1.02 0.01 175 T_OBFU_PDF_ATTACH 1241 0.76 1.02 0.63 176 URI_NOVOWEL 1223 1.12 1.00 1.18 177 TR_XM_Base64_M1 1219 0.85 1.00 0.78 178 FROM_SUSPICIOUS_NTLD_FP 1218 0.34 1.00 0.03 179 XMGenDplmaNmb 1212 1.84 0.99 2.24 180 XMLngstWrd_02 1207 0.63 0.99 0.45 181 BOTNET_NORDNS 1205 0.33 0.99 0.01 182 RELAYCOUNTRY_RU 1200 0.34 0.98 0.02 183 BAYES_20 1171 2.47 0.96 3.20 184 XMMoneyMeta_00 1171 0.59 0.96 0.42 185 BAYES_00 1168 7.21 0.96 10.22 186 TooManyTo_002 1163 2.16 0.95 2.74 187 RDNS_DYNAMIC 1146 0.58 0.94 0.40 188 XMLngstWrd_03 1145 0.54 0.94 0.34 189 RELAYCOUNTRY_FR 1140 0.44 0.93 0.20 190 RCVD_IN_PSBL 1133 0.42 0.93 0.17 191 XM_UB60 1131 0.33 0.93 0.05 192 XM_HighProb1 1130 0.31 0.93 0.01 193 TR_Mismatch_TLD_01 1119 0.47 0.92 0.26 194 PDS_RDNS_DYNAMIC_FP 1111 0.44 0.91 0.22 195 RCVD_IN_IADB_SPF 1110 2.05 0.91 2.60 196 XMHTML_After_End 1104 1.52 0.90 1.82 197 UNDISC_MONEY 1103 0.30 0.90 0.00 198 XMLngstWrd_04 1092 0.49 0.89 0.29 199 RELAYCOUNTRY_TH 1092 0.29 0.89 0.00 200 FORGED_MUA_OUTLOOK 1081 0.31 0.89 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 216983 88.16 94.07 85.33 2 RELAYCOUNTRY_US 196921 78.90 81.96 77.44 3 DKIM_SIGNED 184713 76.71 85.21 72.64 4 XM_DK_Pass 181469 74.78 81.91 71.36 5 DKIM_VALID 178877 73.87 81.20 70.34 6 XM_B_Unicode 176523 73.05 80.61 69.42 7 DCC_CHECK_NEGATIVE 158042 48.65 20.52 62.15 8 BAYES_50 154764 53.97 39.61 60.86 9 DKIM_VALID_AU 146187 59.87 64.82 57.49 10 XMListUnsubscribeExists 116745 53.38 68.95 45.91 11 XM_B_SpammyWords 111243 52.08 69.43 43.75 12 XM_B_Unicode3 101093 42.42 47.99 39.75 13 DCC_CHECK 96176 50.93 78.24 37.82 14 RCVD_IN_MSPIKE_H2 85226 34.45 36.41 33.51 15 T_TM2_M_HEADER_IN_MSG 78050 27.36 20.42 30.69 16 DKIM_VALID_EF 72074 27.23 24.92 28.34 17 HTML_FONT_LOW_CONTRAST 71621 31.03 37.01 28.16 18 LOC_TINY_FONT_1 64015 33.06 49.50 25.17 19 XMSubLong 62261 23.51 21.48 24.48 20 FVGT_m_MULTI_ODD 61011 26.32 31.18 23.99 21 MIME_HTML_ONLY 52216 22.75 27.37 20.53 22 XM_B_SpammyWords2 48903 26.31 41.06 19.23 23 ALL_TRUSTED 48762 13.89 2.88 19.18 24 T_KAM_HTML_FONT_INVALID 47834 22.92 31.47 18.81 25 XM_Multi_Part_URI 34899 16.42 22.05 13.72 26 USER_IN_DEF_DKIM_WL 34538 9.68 1.55 13.58 27 TR_XM_DK_Unsub 30167 13.49 16.89 11.86 28 UNPARSEABLE_RELAY 29859 13.19 16.21 11.74 29 BAYES_00 25986 7.21 0.96 10.22 30 TooManyTo_001 23306 8.22 6.24 9.16 31 XM_Evil_Numbers_Gen 22868 9.09 9.30 8.99 32 BAYES_60 22366 8.84 8.93 8.80 33 XM_B_PhoneNumber 21829 7.31 4.66 8.58 34 XM_B_Unsub 21735 11.03 16.19 8.55 35 T_TooManySym_01 19643 6.01 2.43 7.72 36 XM_DKIMWhitelistDomains 19328 5.23 0.31 7.60 37 LotsOfNums_01 19185 7.54 7.54 7.54 38 FSL_BULK_SIG 17727 8.70 12.31 6.97 39 TR_XM_BayesUnsub 17036 9.61 15.67 6.70 40 LOTS_OF_MONEY 16914 8.12 11.17 6.65 41 TR_XM_DK_Bayes 16906 4.62 0.39 6.65 42 TR_XM_DK_Bayes1 16735 4.57 0.39 6.58 43 IN_ZIMBRA_NJ_WHITELIST 15711 4.19 0.06 6.18 44 XM_H_GMP 15421 5.92 5.62 6.06 45 TR_MAX_INTL_RELAY 15136 9.11 15.68 5.95 46 TR_XM_DK_Bayes2 14797 4.02 0.28 5.82 47 MIME_QP_LONG_LINE 13834 4.74 3.27 5.44 48 XM_UncommonTLD01 13719 6.03 7.35 5.39 49 RCVD_IN_VALIDITY_SAFE 13457 4.34 2.35 5.29 50 XM_H_Long_From01 13243 5.31 5.54 5.21 51 XMStrtUSub 13007 5.07 4.96 5.11 52 HTML_IMAGE_RATIO_02 12972 5.71 6.97 5.10 53 XM_B_Phish_Phrases 12893 5.38 6.04 5.07 54 XM_DK_Undo_02 12821 15.52 37.36 5.04 55 RCVD_IN_MSPIKE_WL 12615 4.41 3.27 4.96 56 RCVD_IN_MSPIKE_H3 12615 4.41 3.27 4.96 57 XM_B_SpammyWords3 12596 8.69 16.46 4.95 58 RELAYCOUNTRY_META 11812 8.60 16.83 4.64 59 BAYES_99 11566 13.21 31.25 4.55 60 MPART_ALT_DIFF 11511 4.92 5.75 4.53 61 BAYES_40 11369 3.49 1.44 4.47 62 XM_PDF 11131 3.44 1.50 4.38 63 T_TooManySym_02 10928 3.16 0.78 4.30 64 ANY_BOUNCE_MESSAGE 10187 3.49 2.40 4.01 65 BOUNCE_MESSAGE 10185 3.48 2.40 4.01 66 HTML_IMAGE_RATIO_04 10052 4.01 4.12 3.95 67 RCVD_IN_VALIDITY_CERTIFIED 9889 3.28 2.00 3.89 68 MAILING_LIST_MULTI 9495 3.17 1.98 3.73 69 XMNumbers 9393 3.86 4.20 3.69 70 T_REMOTE_IMAGE 9373 3.17 2.09 3.69 71 BAYES_80 9146 5.53 9.56 3.60 72 BAYES_999 8714 10.21 24.34 3.43 73 XM_Body_Dirty_Words 8495 5.56 10.18 3.34 74 TR_XM_SpammyWords4 8322 5.43 9.91 3.27 75 BOTNET_IPINHOSTNAME 8289 5.98 11.66 3.26 76 XMSubMetaSx_00 8250 4.32 6.55 3.24 77 BAYES_20 8143 2.47 0.96 3.20 78 RCVD_IN_IADB_LISTED 7563 2.35 1.04 2.97 79 XMDiploma_00 7213 2.82 2.79 2.84 80 TM2_M_URI_OPT_OUT 7208 2.72 2.48 2.83 81 HTML_IMAGE_RATIO_06 7178 3.18 3.92 2.82 82 MIME_HTML_ONLY_MULTI 7155 2.79 2.74 2.81 83 INVALID_MSGID 7140 1.97 0.23 2.81 84 TooManyTo_002 6974 2.16 0.95 2.74 85 RCVD_IN_IADB_SPF 6606 2.05 0.91 2.60 86 HTML_MIME_NO_HTML_TAG 6544 2.55 2.49 2.57 87 TO_MALFORMED 6205 1.65 0.00 2.44 88 XM_CamelCaseFrm001 6001 2.74 3.54 2.36 89 BAYES_95 5983 3.41 5.62 2.35 90 MIME_HTML_MOSTLY 5909 2.83 3.87 2.32 91 RCVD_IN_IADB_SENDERID 5889 1.84 0.84 2.32 92 DKIM_INVALID 5836 2.85 4.00 2.29 93 HTML_IMAGE_RATIO_08 5762 2.30 2.36 2.27 94 RCVD_IN_IADB_DK 5742 1.80 0.85 2.26 95 XMGenDplmaNmb 5706 1.84 0.99 2.24 96 XM_B_SpammyTLD 5611 3.02 4.70 2.21 97 TR_XM_SpammyRelay 5568 5.19 11.43 2.19 98 TR_XM_DKIM_Undo 5333 9.93 26.25 2.10 99 RCVD_IN_IADB_VOUCHED 5020 1.50 0.50 1.97 100 BAYES_05 4969 1.48 0.49 1.95 101 FROM_EXCESS_BASE64 4887 2.04 2.27 1.92 102 TR_XM_SpammyWords5 4831 2.91 5.01 1.90 103 T_TooManySym_03 4684 1.36 0.35 1.84 104 XMHTML_After_End 4628 1.52 0.90 1.82 105 T_XMDrugObfuBody_14 4545 2.68 4.53 1.79 106 TR_XM_UnparsRelay 4446 4.01 8.72 1.75 107 XM_DK_Undo_01 4439 1.73 1.71 1.75 108 XM_B_URI_Unicode 4432 1.87 2.14 1.74 109 TooManyTo_003 4343 1.43 0.86 1.71 110 TR_Symld_Words 4263 1.69 1.72 1.68 111 KHOP_HELO_FCRDNS 4207 1.59 1.45 1.65 112 UNTRUSTED_Relay 4189 3.39 7.02 1.65 113 XMStockSpam_06 4064 1.90 2.52 1.60 114 TR_XM_PhishingBody 4024 2.40 4.12 1.58 115 TR_DCC_Bayes_99 3980 8.77 23.77 1.57 116 IN_HORDE_ADDRESS_BOOK 3865 1.05 0.07 1.52 117 TM2_M_VERY_LONG_WORD 3769 2.18 3.64 1.48 118 XM_SendGrid 3650 1.55 1.78 1.44 119 TVD_SPACE_RATIO 3647 1.04 0.23 1.43 120 T_XMDrugObfuBody_08 3582 1.81 2.65 1.41 121 XMNoVowels 3574 1.14 0.59 1.41 122 RELAYCOUNTRY_CA 3555 2.82 5.77 1.40 123 BOTNET 3532 3.88 9.08 1.39 124 XM_SPF_SoftFail 3530 1.91 2.98 1.39 125 SUBJ_ALL_CAPS 3514 1.78 2.61 1.38 126 RCVD_IN_IADB_OPTIN 3496 1.03 0.32 1.37 127 TooManyTo_004 3307 1.14 0.80 1.30 128 XM_GoogleGroups 3157 1.07 0.71 1.24 129 URI_NOVOWEL 3007 1.12 1.00 1.18 130 XM_B_Investor 2982 2.19 4.30 1.17 131 XM_OfRef6 2795 1.55 2.49 1.10 132 HTML_IMAGE_ONLY_32 2789 0.87 0.40 1.10 133 XMSexyCombo_05 2782 2.07 4.10 1.09 134 TooManyTo_005 2774 0.99 0.77 1.09 135 XMGappySubj_01 2736 0.81 0.25 1.08 136 XMSubMetaI_00 2726 1.34 1.89 1.07 137 XM_B_Unsub2 2724 1.31 1.80 1.07 138 XMCapTrack 2723 0.91 0.57 1.07 139 URI_HEX 2698 1.26 1.69 1.06 140 HELO_NODOT 2677 0.82 0.32 1.05 141 HELO_NO_DOMAIN 2674 0.82 0.32 1.05 142 XMBrknScrpt_02 2665 1.20 1.50 1.05 143 XMBdyGiftCard01 2618 1.11 1.28 1.03 144 DKIM_ADSP_CUSTOM_MED 2602 1.19 1.53 1.02 145 TR_XM_DK_SendGrid 2473 0.92 0.81 0.97 146 XM_UB50 2425 1.85 3.70 0.95 147 XM_H_Long_From02 2375 0.86 0.72 0.93 148 T_TVD_MIME_NO_HEADERS 2343 0.64 0.05 0.92 149 XMBody_95 2308 0.66 0.15 0.91 150 XMLngstWrd_00 2190 0.96 1.16 0.86 151 T_FILL_THIS_FORM_SHORT 2045 1.13 1.81 0.80 152 URI_TRY_3LD 1990 0.79 0.82 0.78 153 TR_XM_Base64_M1 1989 0.85 1.00 0.78 154 XM_ShortIntro_01 1985 0.75 0.68 0.78 155 RCVD_IN_PBL 1985 0.88 1.09 0.78 156 XMGappySubj_02 1899 0.54 0.11 0.75 157 TVD_RCVD_IP 1898 0.78 0.84 0.75 158 SpammyFromTLD_01 1829 0.99 1.56 0.72 159 RELAYCOUNTRY_AU 1826 1.23 2.29 0.72 160 T_TooManySym_04 1806 0.50 0.06 0.71 161 XM_B_DNDMA 1805 0.74 0.79 0.71 162 HTTPS_HTTP_MISMATCH 1797 0.89 1.29 0.71 163 XM_B_COPY_HTML 1796 0.94 1.42 0.71 164 XM_H_PHPMailer 1779 0.75 0.86 0.70 165 NML_ADSP_CUSTOM_MED 1731 0.87 1.25 0.68 166 TR_MetaPhish_Combo_01 1720 0.71 0.77 0.68 167 TR_XM_SpammyWords2 1715 4.20 11.53 0.67 168 THIS_AD 1678 0.96 1.60 0.66 169 T_OBFU_PDF_ATTACH 1608 0.76 1.02 0.63 170 T_STY_INVIS_DIRECT 1585 0.86 1.35 0.62 171 FORGED_GMAIL_RCVD 1574 0.83 1.26 0.62 172 XMPhish30 1565 0.87 1.39 0.62 173 HTML_TAG_BALANCE_BODY 1474 0.76 1.14 0.58 174 XMSlimDrugH 1422 0.59 0.67 0.56 175 XMLngstWrd_01 1401 0.73 1.10 0.55 176 XM_B_SpammyWords4 1389 1.17 2.48 0.55 177 RELAYCOUNTRY_NL 1385 0.47 0.31 0.54 178 XM_B_FormFill 1314 0.36 0.04 0.52 179 TR_XM_FormFill2 1291 0.97 1.92 0.51 180 TR_XM_PHPDW 1287 0.97 1.95 0.51 181 TR_XM_PHPForged 1286 0.99 2.00 0.51 182 RCVD_IN_BL_SPAMCOP_NET 1278 2.71 7.30 0.50 183 MSGID_FROM_MTA_HEADER 1266 0.37 0.09 0.50 184 XM_H_PHPOS 1251 0.95 1.90 0.49 185 T_XMHurry_00 1208 1.30 3.02 0.48 186 MPART_ALT_DIFF_COUNT 1193 0.70 1.18 0.47 187 TM2_M_BODY_EMPTY 1182 0.34 0.09 0.46 188 T_XMDrugObfuBody_00 1180 0.89 1.78 0.46 189 XMLngstWrd_02 1147 0.63 0.99 0.45 190 XMPhish14 1135 0.55 0.77 0.45 191 XMBSHREFv2 1130 0.42 0.37 0.44 192 XMBody_17 1123 1.32 3.15 0.44 193 MISSING_HEADERS 1099 0.48 0.59 0.43 194 MIME_CHARSET_FARAWAY 1075 0.50 0.67 0.42 195 BASE64_LENGTH_79_INF 1074 0.64 1.08 0.42 196 XMMoneyMeta_00 1063 0.59 0.96 0.42 197 XM_ProductURIs 1060 0.66 1.16 0.42 198 RELAYCOUNTRY_GB 1050 0.53 0.77 0.41 199 HTML_IMAGE_ONLY_20 1034 0.40 0.40 0.41 200 XMDateMe_00 1033 0.37 0.29 0.41 ----------------------------------------------------------------------