Email: 414509 Autolearn: 0 AvgScore: 4.62 AvgScanTime: 1.37 sec Spam: 125429 Autolearn: 0 AvgScore: 14.22 AvgScanTime: 1.45 sec Ham: 289080 Autolearn: 0 AvgScore: 0.45 AvgScanTime: 1.33 sec Time Spent Running SA: 157.54 hours Time Spent Processing Spam: 50.54 hours Time Spent Processing Ham: 107.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 118861 89.31 94.76 86.95 2 DKIM_SIGNED 109405 74.19 87.22 68.53 3 RELAYCOUNTRY_US 105723 82.96 84.29 82.38 4 XM_B_Unicode 105213 74.05 83.88 69.78 5 XM_DK_Pass 104904 72.18 83.64 67.21 6 DKIM_VALID 103885 71.28 82.82 66.27 7 DCC_CHECK 95369 48.70 76.03 36.84 8 XMListUnsubscribeExists 88962 52.59 70.93 44.63 9 XM_B_SpammyWords 86403 50.97 68.89 43.19 10 DKIM_VALID_AU 81644 57.54 65.09 54.26 11 XM_B_Unicode3 64745 46.46 51.62 44.23 12 LOC_TINY_FONT_1 61695 33.16 49.19 26.20 13 BAYES_50 50560 56.01 40.31 62.82 14 XM_B_SpammyWords2 50302 23.68 40.10 16.55 15 XM_DK_Undo_02 47781 14.59 38.09 4.39 16 RCVD_IN_MSPIKE_H2 46709 33.47 37.24 31.84 17 HTML_FONT_LOW_CONTRAST 46594 34.29 37.15 33.05 18 FVGT_m_MULTI_ODD 40449 25.50 32.25 22.57 19 T_KAM_HTML_FONT_INVALID 39488 22.32 31.48 18.35 20 BAYES_99 38583 11.91 30.76 3.73 21 TR_XM_DKIM_Undo 33806 9.26 26.95 1.59 22 DKIM_VALID_EF 33011 26.95 26.32 27.23 23 MIME_HTML_ONLY 32820 21.50 26.17 19.48 24 XMSubLong 30505 24.01 24.32 23.87 25 BAYES_999 29605 9.16 23.60 2.90 26 TR_DCC_Bayes_99 28871 7.64 23.02 0.97 27 DCC_CHECK_NEGATIVE 28415 50.88 22.65 63.12 28 T_TM2_M_HEADER_IN_MSG 27479 31.28 21.91 35.35 29 XM_Multi_Part_URI 26240 14.75 20.92 12.07 30 TR_XM_DK_Unsub 24140 14.51 19.25 12.46 31 UNPARSEABLE_RELAY 20591 12.99 16.42 11.50 32 TR_MAX_INTL_RELAY 19412 8.40 15.48 5.34 33 RELAYCOUNTRY_META 19306 7.31 15.39 3.81 34 XM_B_SpammyWords3 18687 7.44 14.90 4.20 35 XM_B_Unsub 18567 10.05 14.80 7.98 36 TR_XM_BayesUnsub 18071 8.53 14.41 5.97 37 TR_XM_SpammyWords2 13953 3.59 11.12 0.33 38 LOTS_OF_MONEY 13938 7.32 11.11 5.68 39 BOTNET_IPINHOSTNAME 12782 5.03 10.19 2.80 40 TR_XM_SpammyRelay 12632 4.20 10.07 1.66 41 FSL_BULK_SIG 12239 7.66 9.76 6.75 42 BAYES_80 12054 5.16 9.61 3.23 43 XM_Evil_Numbers_Gen 11937 11.64 9.52 12.56 44 TR_XM_SpammyWords4 11881 5.66 9.47 4.00 45 BAYES_60 11277 8.26 8.99 7.95 46 BOTNET 10626 3.35 8.47 1.13 47 TR_XM_UnparsRelay 10259 3.63 8.18 1.66 48 RCVD_IN_BL_SPAMCOP_NET 10134 2.80 8.08 0.51 49 LotsOfNums_01 10023 10.24 7.99 11.21 50 XM_B_Phish_Phrases 9498 5.34 7.57 4.37 51 HTML_IMAGE_RATIO_02 8980 5.23 7.16 4.40 52 XM_Body_Dirty_Words 8808 3.59 7.02 2.10 53 XM_UncommonTLD01 8397 4.78 6.69 3.94 54 TR_XM_SPAMCOP 8243 2.18 6.57 0.28 55 MPART_ALT_DIFF 7567 4.49 6.03 3.82 56 UNTRUSTED_Relay 7476 2.82 5.96 1.46 57 BAYES_95 7039 3.16 5.61 2.10 58 XM_H_Long_From01 6930 5.36 5.53 5.29 59 TM2_M_VERY_LONG_WORD 6930 9.07 5.53 10.60 60 RELAYCOUNTRY_CA 6731 2.39 5.37 1.10 61 XM_H_GMP 6519 5.54 5.20 5.69 62 XMSubMetaSx_00 6500 3.77 5.18 3.15 63 XM_B_PhoneNumber 6072 6.93 4.84 7.84 64 HTML_IMAGE_RATIO_04 5634 4.75 4.49 4.86 65 DKIM_INVALID 5520 2.91 4.40 2.26 66 T_XMDrugObfuBody_14 5467 2.43 4.36 1.60 67 XM_B_Investor 5352 2.12 4.27 1.19 68 RCVD_IN_VALIDITY_RPBL 5309 1.33 4.23 0.07 69 TooManyTo_001 5276 6.59 4.21 7.63 70 XM_B_SpammyTLD 5187 3.00 4.14 2.51 71 XMStrtUSub 5031 4.91 4.01 5.30 72 TR_XM_PhishingBody 4837 2.24 3.86 1.54 73 XM_SPF_SoftFail 4718 2.07 3.76 1.34 74 RCVD_IN_MSPIKE_H3 4685 4.46 3.74 4.78 75 RCVD_IN_MSPIKE_WL 4685 4.46 3.74 4.78 76 TR_XM_SpammyWords5 4592 2.39 3.66 1.83 77 MIME_HTML_MOSTLY 4488 2.40 3.58 1.89 78 XM_OfRef6 4455 1.77 3.55 0.99 79 XMSexyCombo_05 4393 1.80 3.50 1.06 80 XM_CamelCaseFrm001 4290 2.54 3.42 2.16 81 HTML_IMAGE_RATIO_06 4237 2.89 3.38 2.68 82 HTML_IMAGE_RATIO_08 4215 2.69 3.36 2.40 83 XMNumbers 3918 3.10 3.12 3.09 84 MIME_HTML_ONLY_MULTI 3760 2.63 3.00 2.46 85 XM_UB50 3609 1.51 2.88 0.91 86 TM2_M_URI_OPT_OUT 3599 1.96 2.87 1.57 87 RELAYCOUNTRY_AU 3545 1.21 2.83 0.51 88 T_XMHurry_00 3360 1.18 2.68 0.53 89 T_XMDrugObfuBody_08 3280 1.84 2.62 1.50 90 XMSubMetaI_00 3277 1.42 2.61 0.90 91 XM_URI_RBL 3251 1.08 2.59 0.43 92 NO_DNS_FOR_FROM 3200 0.99 2.55 0.32 93 TR_XM_MaxWHORU 3191 0.95 2.54 0.26 94 DKIM_ADSP_NXDOMAIN 3148 1.04 2.51 0.40 95 RCVD_IN_VALIDITY_SAFE 3054 3.96 2.43 4.62 96 MIME_QP_LONG_LINE 3053 3.57 2.43 4.06 97 FROM_EXCESS_BASE64 3040 2.12 2.42 1.99 98 T_TooManySym_01 2976 5.18 2.37 6.40 99 SUBJ_ALL_CAPS 2974 2.00 2.37 1.84 100 TR_XM_NoHeaderRelay 2935 0.89 2.34 0.26 101 MIME_CHARSET_FARAWAY 2931 4.48 2.34 5.41 102 XMBody_17 2868 0.96 2.29 0.38 103 BOUNCE_MESSAGE 2849 9.77 2.27 13.02 104 ANY_BOUNCE_MESSAGE 2849 9.77 2.27 13.02 105 SpammyFromTLD_02 2775 0.81 2.21 0.20 106 XMDiploma_00 2716 1.55 2.17 1.28 107 KHOP_HELO_FCRDNS 2716 4.81 2.17 5.96 108 T_FILL_THIS_FORM_SHORT 2673 1.23 2.13 0.84 109 XM_B_URI_Unicode 2648 1.65 2.11 1.45 110 RCVD_IN_VALIDITY_CERTIFIED 2475 2.91 1.97 3.32 111 MAILING_LIST_MULTI 2448 2.48 1.95 2.71 112 XM_B_SpammyWords4 2426 1.02 1.93 0.63 113 SUSP_UTF8_WORD_SUBJ 2419 0.60 1.93 0.03 114 USER_IN_DEF_DKIM_WL 2262 9.43 1.80 12.74 115 XM_B_Unsub2 2115 1.24 1.69 1.05 116 RCVD_IN_PSBL 2100 0.75 1.67 0.35 117 XM_SendGrid 2096 1.49 1.67 1.41 118 XMStockSpam_06 2034 1.82 1.62 1.90 119 HTML_MIME_NO_HTML_TAG 2028 2.15 1.62 2.39 120 XMEqualsVooDoo_00 2024 0.87 1.61 0.55 121 XM_B_COPY_HTML 1996 0.94 1.59 0.66 122 CHARSET_FARAWAY_HEADER 1991 4.04 1.59 5.10 123 TR_XM_PHPForged 1958 0.79 1.56 0.45 124 LongTLD 1945 0.72 1.55 0.36 125 XMEqualsVooDoo_01 1944 0.47 1.55 0.01 126 XMEqualsVooDoo_02 1943 0.47 1.55 0.00 127 XMEqualsVooDoo_03 1940 0.47 1.55 0.00 128 TR_XM_PHPDW 1924 0.78 1.53 0.45 129 XMBody_78 1912 0.63 1.52 0.25 130 TR_XM_FormFill2 1912 0.78 1.52 0.45 131 THIS_AD 1909 0.89 1.52 0.62 132 XM_B_SEO 1903 0.62 1.52 0.24 133 ALL_TRUSTED 1898 10.66 1.51 14.63 134 SHOPIFY_IMG_NOT_RCVD_SFY 1881 0.64 1.50 0.27 135 XM_H_PHPOS 1877 0.76 1.50 0.44 136 XMBrknScrpt_02 1855 1.12 1.48 0.96 137 BAYES_40 1844 3.72 1.47 4.70 138 XMPhish30 1809 0.83 1.44 0.56 139 T_XMDrugObfuBody_00 1804 0.97 1.44 0.76 140 PLING_QUERY 1797 0.66 1.43 0.32 141 DIET_1 1780 0.63 1.42 0.29 142 NORDNS_LOW_CONTRAST 1768 0.46 1.41 0.05 143 TR_XM_Base64_M1 1700 0.85 1.36 0.62 144 TR_XM_INV_DKIM 1684 0.51 1.34 0.15 145 SpammyFromTLD_01 1666 0.80 1.33 0.57 146 T_REMOTE_IMAGE 1634 2.61 1.30 3.17 147 SHORTCIRCUIT 1630 0.39 1.30 0.00 148 RCVD_IN_ZEN_LASTEXTERNAL 1630 0.39 1.30 0.00 149 XMMoneyMeta_00 1600 0.66 1.28 0.39 150 XM_B_DNDMA 1589 0.68 1.27 0.43 151 RCVD_IN_PBL 1583 0.91 1.26 0.76 152 XM_DK_Undo_01 1571 1.41 1.25 1.48 153 URI_HEX 1558 1.20 1.24 1.18 154 RELAYCOUNTRY_FR 1506 0.50 1.20 0.19 155 MPART_ALT_DIFF_COUNT 1491 0.72 1.19 0.52 156 TR_XM_SEO4 1471 0.42 1.17 0.09 157 STY_INVIS_DIRECT 1455 0.57 1.16 0.31 158 DKIM_ADSP_CUSTOM_MED 1406 0.96 1.12 0.90 159 RDNS_DYNAMIC 1401 0.59 1.12 0.36 160 TM2_M_A_HREF_HREF 1399 0.48 1.12 0.20 161 XMClaimOffer 1392 0.55 1.11 0.31 162 RCVD_IN_IADB_LISTED 1383 2.29 1.10 2.80 163 PDS_RDNS_DYNAMIC_FP 1383 0.47 1.10 0.20 164 XMSlimDrugH 1373 0.67 1.09 0.48 165 XM_ProductURIs 1318 0.66 1.05 0.50 166 XMBdyGiftCard01 1305 0.78 1.04 0.66 167 BOTNET_NORDNS 1303 0.32 1.04 0.01 168 HTML_TAG_BALANCE_BODY 1298 0.70 1.03 0.55 169 TooManyTo_002 1288 2.21 1.03 2.73 170 URI_NOVOWEL 1262 1.22 1.01 1.32 171 XM_S_SpammyWords 1260 0.50 1.00 0.28 172 TR_XM_Spammywords 1260 0.50 1.00 0.28 173 TR_Mismatch_TLD_02 1247 0.34 0.99 0.06 174 TR_XM_DK_SendGrid 1243 0.94 0.99 0.92 175 XMGenDplmaNmb 1238 0.75 0.99 0.65 176 RCVD_IN_IADB_SPF 1228 2.03 0.98 2.48 177 BAYES_20 1221 2.71 0.97 3.47 178 TR_XM_InvalidRelay 1218 0.30 0.97 0.01 179 XM_UB99 1217 0.30 0.97 0.01 180 XM_OfRef7 1217 0.45 0.97 0.23 181 TooManyTo_003 1193 1.35 0.95 1.52 182 T_Symld_Words_02 1179 0.60 0.94 0.45 183 RCVD_IN_IADB_DK 1162 1.80 0.93 2.18 184 TVD_RCVD_IP 1161 0.73 0.93 0.64 185 RCVD_IN_IADB_SENDERID 1158 1.84 0.92 2.24 186 RELAYCOUNTRY_GB 1153 0.73 0.92 0.64 187 TooManyTo_004 1132 1.08 0.90 1.15 188 TM2_M_OBFU_COMMENT 1116 0.62 0.89 0.50 189 TR_LOTS_OF_MONEY2 1108 0.45 0.88 0.26 190 T_MONEY_PERCENT 1108 0.45 0.88 0.26 191 URI_TRY_3LD 1103 0.68 0.88 0.59 192 TooManyTo_005 1101 0.96 0.88 0.99 193 XM_H_Undi_Recip 1098 0.40 0.88 0.19 194 XM_B_Phish66 1084 0.42 0.86 0.23 195 NML_ADSP_CUSTOM_MED 1083 0.67 0.86 0.59 196 XM_B_COVIDMETA 1072 0.35 0.85 0.13 197 XM_UB60 1068 0.29 0.85 0.05 198 TR_Symld_Words 1066 1.13 0.85 1.25 199 RCVD_IN_XBL 1066 0.27 0.85 0.02 200 XMPhish14 1056 0.61 0.84 0.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 251357 89.31 94.76 86.95 2 RELAYCOUNTRY_US 238149 82.96 84.29 82.38 3 XM_B_Unicode 201725 74.05 83.88 69.78 4 DKIM_SIGNED 198104 74.19 87.22 68.53 5 XM_DK_Pass 194294 72.18 83.64 67.21 6 DKIM_VALID 191573 71.28 82.82 66.27 7 DCC_CHECK_NEGATIVE 182470 50.88 22.65 63.12 8 BAYES_50 181602 56.01 40.31 62.82 9 DKIM_VALID_AU 156846 57.54 65.09 54.26 10 XMListUnsubscribeExists 129025 52.59 70.93 44.63 11 XM_B_Unicode3 127847 46.46 51.62 44.23 12 XM_B_SpammyWords 124861 50.97 68.89 43.19 13 DCC_CHECK 106508 48.70 76.03 36.84 14 T_TM2_M_HEADER_IN_MSG 102200 31.28 21.91 35.35 15 HTML_FONT_LOW_CONTRAST 95548 34.29 37.15 33.05 16 RCVD_IN_MSPIKE_H2 92029 33.47 37.24 31.84 17 DKIM_VALID_EF 78705 26.95 26.32 27.23 18 LOC_TINY_FONT_1 75745 33.16 49.19 26.20 19 XMSubLong 68998 24.01 24.32 23.87 20 FVGT_m_MULTI_ODD 65231 25.50 32.25 22.57 21 MIME_HTML_ONLY 56312 21.50 26.17 19.48 22 T_KAM_HTML_FONT_INVALID 53044 22.32 31.48 18.35 23 XM_B_SpammyWords2 47852 23.68 40.10 16.55 24 ALL_TRUSTED 42298 10.66 1.51 14.63 25 BOUNCE_MESSAGE 37648 9.77 2.27 13.02 26 ANY_BOUNCE_MESSAGE 37648 9.77 2.27 13.02 27 USER_IN_DEF_DKIM_WL 36827 9.43 1.80 12.74 28 XM_Evil_Numbers_Gen 36306 11.64 9.52 12.56 29 TR_XM_DK_Unsub 36006 14.51 19.25 12.46 30 XM_Multi_Part_URI 34882 14.75 20.92 12.07 31 UNPARSEABLE_RELAY 33245 12.99 16.42 11.50 32 LotsOfNums_01 32407 10.24 7.99 11.21 33 TM2_M_VERY_LONG_WORD 30646 9.07 5.53 10.60 34 BAYES_00 28460 6.99 0.43 9.85 35 HTML_IMAGE_ONLY_32 24268 5.94 0.28 8.39 36 XM_B_Unsub 23083 10.05 14.80 7.98 37 BAYES_60 22975 8.26 8.99 7.95 38 XM_B_PhoneNumber 22673 6.93 4.84 7.84 39 TooManyTo_001 22060 6.59 4.21 7.63 40 XM_DKIMWhitelistDomains 19749 4.79 0.07 6.83 41 FSL_BULK_SIG 19501 7.66 9.76 6.75 42 TR_XM_DK_Bayes 18896 4.66 0.33 6.54 43 TR_XM_DK_Bayes1 18605 4.59 0.33 6.44 44 T_TooManySym_01 18505 5.18 2.37 6.40 45 TR_XM_BayesUnsub 17271 8.53 14.41 5.97 46 KHOP_HELO_FCRDNS 17235 4.81 2.17 5.96 47 XM_H_GMP 16436 5.54 5.20 5.69 48 LOTS_OF_MONEY 16409 7.32 11.11 5.68 49 IN_ZIMBRA_NJ_WHITELIST 16212 3.93 0.05 5.61 50 TR_XM_DK_Bayes2 15949 3.91 0.22 5.52 51 MIME_CHARSET_FARAWAY 15648 4.48 2.34 5.41 52 TR_MAX_INTL_RELAY 15425 8.40 15.48 5.34 53 XMStrtUSub 15311 4.91 4.01 5.30 54 XM_H_Long_From01 15292 5.36 5.53 5.29 55 CHARSET_FARAWAY_HEADER 14740 4.04 1.59 5.10 56 HTML_IMAGE_RATIO_04 14048 4.75 4.49 4.86 57 RCVD_IN_MSPIKE_H3 13807 4.46 3.74 4.78 58 RCVD_IN_MSPIKE_WL 13807 4.46 3.74 4.78 59 BAYES_40 13575 3.72 1.47 4.70 60 RCVD_IN_VALIDITY_SAFE 13343 3.96 2.43 4.62 61 HTML_IMAGE_RATIO_02 12715 5.23 7.16 4.40 62 XM_DK_Undo_02 12701 14.59 38.09 4.39 63 XM_B_Phish_Phrases 12626 5.34 7.57 4.37 64 XM_B_SpammyWords3 12135 7.44 14.90 4.20 65 MIME_QP_LONG_LINE 11730 3.57 2.43 4.06 66 TR_XM_SpammyWords4 11563 5.66 9.47 4.00 67 XM_UncommonTLD01 11397 4.78 6.69 3.94 68 XM_PDF 11239 2.89 0.57 3.89 69 MPART_ALT_DIFF 11044 4.49 6.03 3.82 70 RELAYCOUNTRY_META 11008 7.31 15.39 3.81 71 BAYES_99 10791 11.91 30.76 3.73 72 BAYES_20 10026 2.71 0.97 3.47 73 RCVD_IN_VALIDITY_CERTIFIED 9598 2.91 1.97 3.32 74 T_TooManySym_02 9591 2.52 0.68 3.32 75 BAYES_80 9341 5.16 9.61 3.23 76 T_REMOTE_IMAGE 9168 2.61 1.30 3.17 77 XMSubMetaSx_00 9113 3.77 5.18 3.15 78 XMNumbers 8938 3.10 3.12 3.09 79 XMLngstWrd_00 8842 2.27 0.44 3.06 80 BAYES_999 8383 9.16 23.60 2.90 81 RCVD_IN_IADB_LISTED 8091 2.29 1.10 2.80 82 BOTNET_IPINHOSTNAME 8087 5.03 10.19 2.80 83 TooManyTo_002 7892 2.21 1.03 2.73 84 MAILING_LIST_MULTI 7823 2.48 1.95 2.71 85 HTML_IMAGE_RATIO_06 7753 2.89 3.38 2.68 86 XM_B_SpammyTLD 7258 3.00 4.14 2.51 87 RCVD_IN_IADB_SPF 7180 2.03 0.98 2.48 88 MIME_HTML_ONLY_MULTI 7125 2.63 3.00 2.46 89 INVALID_MSGID 7089 1.77 0.20 2.45 90 HTML_IMAGE_RATIO_08 6927 2.69 3.36 2.40 91 HTML_MIME_NO_HTML_TAG 6903 2.15 1.62 2.39 92 DKIM_INVALID 6531 2.91 4.40 2.26 93 RCVD_IN_IADB_SENDERID 6472 1.84 0.92 2.24 94 RCVD_IN_IADB_DK 6309 1.80 0.93 2.18 95 TO_MALFORMED 6250 1.52 0.03 2.16 96 XM_CamelCaseFrm001 6245 2.54 3.42 2.16 97 BAYES_05 6237 1.67 0.55 2.16 98 BAYES_95 6066 3.16 5.61 2.10 99 XM_Body_Dirty_Words 6064 3.59 7.02 2.10 100 FROM_EXCESS_BASE64 5745 2.12 2.42 1.99 101 XMStockSpam_06 5499 1.82 1.62 1.90 102 MIME_HTML_MOSTLY 5462 2.40 3.58 1.89 103 SUBJ_ALL_CAPS 5326 2.00 2.37 1.84 104 TR_XM_SpammyWords5 5297 2.39 3.66 1.83 105 RCVD_IN_IADB_VOUCHED 5238 1.43 0.56 1.81 106 TR_XM_UnparsRelay 4787 3.63 8.18 1.66 107 TR_XM_SpammyRelay 4786 4.20 10.07 1.66 108 T_XMDrugObfuBody_14 4620 2.43 4.36 1.60 109 TR_XM_DKIM_Undo 4586 9.26 26.95 1.59 110 TM2_M_URI_OPT_OUT 4530 1.96 2.87 1.57 111 TR_XM_PhishingBody 4448 2.24 3.86 1.54 112 TooManyTo_003 4405 1.35 0.95 1.52 113 T_XMDrugObfuBody_08 4329 1.84 2.62 1.50 114 XM_DK_Undo_01 4269 1.41 1.25 1.48 115 UNTRUSTED_Relay 4215 2.82 5.96 1.46 116 XM_B_URI_Unicode 4202 1.65 2.11 1.45 117 XM_SendGrid 4069 1.49 1.67 1.41 118 T_TooManySym_03 4013 1.05 0.27 1.39 119 IN_HORDE_ADDRESS_BOOK 3978 0.98 0.08 1.38 120 XM_SPF_SoftFail 3866 2.07 3.76 1.34 121 URI_NOVOWEL 3803 1.22 1.01 1.32 122 XMDiploma_00 3698 1.55 2.17 1.28 123 TR_Symld_Words 3615 1.13 0.85 1.25 124 RCVD_IN_IADB_OPTIN 3614 0.99 0.39 1.25 125 XM_B_Investor 3447 2.12 4.27 1.19 126 URI_HEX 3405 1.20 1.24 1.18 127 TooManyTo_004 3327 1.08 0.90 1.15 128 XMGappySubj_01 3295 0.84 0.14 1.14 129 BOTNET 3269 3.35 8.47 1.13 130 RELAYCOUNTRY_CA 3184 2.39 5.37 1.10 131 XM_GoogleGroups 3072 0.96 0.73 1.06 132 XMSexyCombo_05 3058 1.80 3.50 1.06 133 XM_B_Unsub2 3045 1.24 1.69 1.05 134 TVD_SPACE_RATIO 3031 0.77 0.14 1.05 135 HELO_NODOT 2875 0.77 0.25 0.99 136 HELO_NO_DOMAIN 2873 0.77 0.25 0.99 137 TooManyTo_005 2868 0.96 0.88 0.99 138 XM_OfRef6 2867 1.77 3.55 0.99 139 TR_DCC_Bayes_99 2807 7.64 23.02 0.97 140 XMBrknScrpt_02 2781 1.12 1.48 0.96 141 XMNoVowels 2741 0.90 0.80 0.95 142 XMCapTrack 2700 0.81 0.54 0.93 143 TR_XM_DK_SendGrid 2672 0.94 0.99 0.92 144 XM_UB50 2641 1.51 2.88 0.91 145 XMSubMetaI_00 2601 1.42 2.61 0.90 146 DKIM_ADSP_CUSTOM_MED 2589 0.96 1.12 0.90 147 T_TVD_MIME_NO_HEADERS 2555 0.63 0.04 0.88 148 T_FILL_THIS_FORM_SHORT 2434 1.23 2.13 0.84 149 XMGappySubj_02 2424 0.61 0.10 0.84 150 XM_H_Long_From02 2359 0.78 0.69 0.82 151 RCVD_IN_PBL 2206 0.91 1.26 0.76 152 T_XMDrugObfuBody_00 2203 0.97 1.44 0.76 153 HTML_IMAGE_ONLY_20 2125 0.62 0.35 0.74 154 XM_H_PHPMailer 2062 0.72 0.75 0.71 155 XMBdyGiftCard01 1919 0.78 1.04 0.66 156 XM_ShortIntro_01 1906 0.64 0.58 0.66 157 XM_B_COPY_HTML 1900 0.94 1.59 0.66 158 XMBody_95 1899 0.55 0.29 0.66 159 XMGenDplmaNmb 1874 0.75 0.99 0.65 160 RELAYCOUNTRY_GB 1853 0.73 0.92 0.64 161 TVD_RCVD_IP 1848 0.73 0.93 0.64 162 XM_B_SpammyWords4 1808 1.02 1.93 0.63 163 TR_XM_Base64_M1 1805 0.85 1.36 0.62 164 TR_MetaPhish_Combo_01 1791 0.63 0.66 0.62 165 THIS_AD 1780 0.89 1.52 0.62 166 HTTPS_HTTP_MISMATCH 1777 0.67 0.81 0.61 167 TO_NO_BRKTS_HTML_ONLY 1764 0.49 0.21 0.61 168 XMLngstWrd_01 1763 0.54 0.38 0.61 169 URI_TRY_3LD 1717 0.68 0.88 0.59 170 NML_ADSP_CUSTOM_MED 1708 0.67 0.86 0.59 171 XM_B_FormFill 1706 0.42 0.03 0.59 172 SpammyFromTLD_01 1650 0.80 1.33 0.57 173 XMPhish30 1629 0.83 1.44 0.56 174 HTML_TAG_BALANCE_BODY 1594 0.70 1.03 0.55 175 FORGED_GMAIL_RCVD 1594 0.63 0.80 0.55 176 XMEqualsVooDoo_00 1593 0.87 1.61 0.55 177 T_OBFU_PDF_ATTACH 1574 0.43 0.15 0.54 178 T_XMHurry_00 1539 1.18 2.68 0.53 179 MPART_ALT_DIFF_COUNT 1502 0.72 1.19 0.52 180 MSGID_FROM_MTA_HEADER 1499 0.44 0.24 0.52 181 RELAYCOUNTRY_AU 1482 1.21 2.83 0.51 182 RCVD_IN_BL_SPAMCOP_NET 1477 2.80 8.08 0.51 183 XMPhish14 1455 0.61 0.84 0.50 184 TM2_M_OBFU_COMMENT 1451 0.62 0.89 0.50 185 XM_ProductURIs 1433 0.66 1.05 0.50 186 XMSlimDrugH 1391 0.67 1.09 0.48 187 FILL_THIS_FORM 1326 0.43 0.37 0.46 188 T_Symld_Words_02 1313 0.60 0.94 0.45 189 TR_XM_FormFill2 1305 0.78 1.52 0.45 190 TR_XM_PHPForged 1304 0.79 1.56 0.45 191 TR_XM_PHPDW 1295 0.78 1.53 0.45 192 USER_IN_WELCOMELIST 1265 0.31 0.00 0.44 193 USER_IN_WHITELIST 1265 0.31 0.00 0.44 194 XM_H_PHPOS 1263 0.76 1.50 0.44 195 XM_URI_RBL 1232 1.08 2.59 0.43 196 XMBSHREFv2 1229 0.41 0.38 0.43 197 XM_B_DNDMA 1229 0.68 1.27 0.43 198 T_TooManySym_04 1199 0.31 0.06 0.41 199 XMLngstWrd_02 1169 0.38 0.33 0.40 200 DKIM_ADSP_NXDOMAIN 1156 1.04 2.51 0.40 ----------------------------------------------------------------------