Email: 442239 Autolearn: 0 AvgScore: 4.80 AvgScanTime: 1.36 sec Spam: 145316 Autolearn: 0 AvgScore: 14.22 AvgScanTime: 1.49 sec Ham: 296923 Autolearn: 0 AvgScore: 0.19 AvgScanTime: 1.30 sec Time Spent Running SA: 167.52 hours Time Spent Processing Spam: 60.04 hours Time Spent Processing Ham: 107.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 139221 89.91 95.81 87.03 2 DKIM_SIGNED 131260 81.11 90.33 76.61 3 XM_B_Unicode 125508 76.31 86.37 71.39 4 XM_DK_Pass 124342 78.59 85.57 75.17 5 RELAYCOUNTRY_US 123613 82.80 85.06 81.69 6 DKIM_VALID 123070 77.64 84.69 74.18 7 DCC_CHECK 110763 52.47 76.22 40.85 8 XMListUnsubscribeExists 105494 57.75 72.60 50.49 9 XM_B_SpammyWords 102264 53.63 70.37 45.44 10 DKIM_VALID_AU 96206 61.92 66.20 59.82 11 LOC_TINY_FONT_1 75225 36.20 51.77 28.57 12 XM_B_Unicode3 74030 44.65 50.94 41.56 13 XM_DK_Undo_02 61160 17.18 42.09 4.98 14 XM_B_SpammyWords2 59974 26.12 41.27 18.71 15 BAYES_50 59793 54.84 41.15 61.55 16 RCVD_IN_MSPIKE_H2 59476 37.61 40.93 35.98 17 HTML_FONT_LOW_CONTRAST 58602 32.22 40.33 28.26 18 FVGT_m_MULTI_ODD 49113 27.79 33.80 24.84 19 T_KAM_HTML_FONT_INVALID 47773 25.60 32.88 22.03 20 BAYES_99 43732 12.07 30.09 3.25 21 DKIM_VALID_EF 43641 29.38 30.03 29.06 22 TR_XM_DKIM_Undo 43585 11.43 29.99 2.34 23 MIME_HTML_ONLY 40294 23.67 27.73 21.69 24 XMSubLong 36729 24.63 25.28 24.31 25 XM_Multi_Part_URI 36262 17.13 24.95 13.30 26 BAYES_999 34243 9.43 23.56 2.51 27 TR_DCC_Bayes_99 32730 8.26 22.52 1.29 28 DCC_CHECK_NEGATIVE 32657 47.07 22.47 59.11 29 T_TM2_M_HEADER_IN_MSG 30896 26.12 21.26 28.49 30 TR_XM_DK_Unsub 30764 15.67 21.17 12.98 31 UNPARSEABLE_RELAY 25543 13.81 17.58 11.97 32 XM_B_SpammyWords3 22880 8.13 15.74 4.41 33 XM_B_Unsub 22762 11.46 15.66 9.40 34 TR_XM_BayesUnsub 21806 9.52 15.01 6.84 35 TR_MAX_INTL_RELAY 20863 8.30 14.36 5.34 36 RELAYCOUNTRY_META 20677 7.21 14.23 3.78 37 RCVD_IN_BL_SPAMCOP_NET 19384 4.96 13.34 0.86 38 TR_XM_SpammyWords2 17091 4.16 11.76 0.43 39 LOTS_OF_MONEY 16895 7.78 11.63 5.89 40 XM_Evil_Numbers_Gen 16020 9.97 11.02 9.45 41 TR_XM_SpammyRelay 15999 5.04 11.01 2.12 42 TR_XM_SpammyWords4 15444 6.01 10.63 3.75 43 TR_XM_SPAMCOP 15302 3.82 10.53 0.53 44 BOTNET_IPINHOSTNAME 13449 5.30 9.26 3.36 45 XM_B_Phish_Phrases 13170 6.54 9.06 5.30 46 BAYES_80 13057 5.20 8.99 3.35 47 XM_Body_Dirty_Words 12878 4.64 8.86 2.58 48 BOTNET 12275 3.72 8.45 1.41 49 TR_XM_UnparsRelay 12206 3.81 8.40 1.56 50 BAYES_60 12182 7.35 8.38 6.85 51 LotsOfNums_01 12062 8.42 8.30 8.47 52 FSL_BULK_SIG 11869 7.54 8.17 7.23 53 HTML_IMAGE_RATIO_02 9240 5.18 6.36 4.61 54 RELAYCOUNTRY_CA 9090 2.71 6.26 0.98 55 MPART_ALT_DIFF 8799 5.07 6.06 4.59 56 XM_UncommonTLD01 8530 4.75 5.87 4.21 57 HTML_IMAGE_RATIO_04 8368 5.51 5.76 5.39 58 DKIM_INVALID 8190 3.48 5.64 2.42 59 TM2_M_VERY_LONG_WORD 7752 2.96 5.33 1.80 60 XM_B_PhoneNumber 7714 8.16 5.31 9.56 61 BAYES_95 7435 3.01 5.12 1.99 62 XMSubMetaSx_00 7268 3.98 5.00 3.49 63 XM_H_Long_From01 7220 5.41 4.97 5.63 64 XM_H_GMP 7195 5.23 4.95 5.36 65 TR_XM_PhishingBody 6817 2.65 4.69 1.65 66 T_XMDrugObfuBody_14 6755 2.62 4.65 1.63 67 UNTRUSTED_Relay 6655 2.54 4.58 1.55 68 XM_B_Investor 6431 2.54 4.43 1.62 69 XMStrtUSub 6326 4.78 4.35 4.99 70 XMSexyCombo_05 5585 2.25 3.84 1.47 71 TR_XM_SpammyWords5 5496 2.19 3.78 1.41 72 RCVD_IN_MSPIKE_H3 5464 4.85 3.76 5.39 73 RCVD_IN_MSPIKE_WL 5464 4.85 3.76 5.39 74 XM_B_SpammyTLD 5462 3.00 3.76 2.62 75 XMNumbers 5273 3.28 3.63 3.11 76 HTML_IMAGE_RATIO_06 5186 3.10 3.57 2.87 77 XM_OfRef6 5158 1.88 3.55 1.06 78 XM_CamelCaseFrm001 5113 2.89 3.52 2.58 79 MIME_HTML_MOSTLY 4699 2.48 3.23 2.11 80 TooManyTo_001 4697 6.78 3.23 8.51 81 MIME_HTML_ONLY_MULTI 4643 2.99 3.20 2.89 82 XMNoVowels 4518 2.47 3.11 2.15 83 T_XMDrugObfuBody_08 4448 2.28 3.06 1.90 84 RCVD_IN_VALIDITY_RPBL 4325 1.03 2.98 0.08 85 TM2_M_URI_OPT_OUT 4205 2.23 2.89 1.91 86 T_TooManySym_01 4066 5.34 2.80 6.58 87 HTML_IMAGE_RATIO_08 4046 2.27 2.78 2.02 88 MIME_QP_LONG_LINE 4004 4.49 2.76 5.34 89 XMDiploma_00 4001 1.84 2.75 1.39 90 XM_B_URI_Unicode 3940 2.44 2.71 2.30 91 NO_DNS_FOR_FROM 3939 1.09 2.71 0.30 92 TR_XM_MaxWHORU 3924 1.05 2.70 0.24 93 DKIM_ADSP_NXDOMAIN 3761 1.07 2.59 0.33 94 XM_B_SpammyWords4 3700 1.40 2.55 0.84 95 XM_B_Unsub2 3692 1.73 2.54 1.33 96 XM_SPF_SoftFail 3590 1.73 2.47 1.37 97 RCVD_IN_VALIDITY_SAFE 3561 3.64 2.45 4.23 98 MAILING_LIST_MULTI 3523 2.88 2.42 3.10 99 RELAYCOUNTRY_AU 3415 1.27 2.35 0.74 100 XM_URI_RBL 3345 0.98 2.30 0.34 101 T_XMDrugObfuBody_00 3303 1.34 2.27 0.89 102 FROM_EXCESS_BASE64 3297 2.02 2.27 1.90 103 TR_XM_INV_DKIM 3283 0.85 2.26 0.15 104 USER_IN_DEF_DKIM_WL 3220 10.23 2.22 14.15 105 XMBody_17 3187 1.09 2.19 0.55 106 SpammyFromTLD_02 3158 1.04 2.17 0.49 107 XM_UB50 3135 1.37 2.16 0.98 108 RCVD_IN_VALIDITY_CERTIFIED 3127 3.07 2.15 3.52 109 DIET_1 3072 1.02 2.11 0.49 110 T_XMHurry_00 2851 1.05 1.96 0.60 111 NORDNS_LOW_CONTRAST 2660 0.62 1.83 0.03 112 XM_SendGrid 2644 1.54 1.82 1.41 113 BAYES_40 2621 4.13 1.80 5.26 114 XMStockSpam_06 2547 1.41 1.75 1.24 115 TR_XM_NoHeaderRelay 2531 0.74 1.74 0.25 116 XM_B_DNDMA 2493 0.92 1.72 0.53 117 T_FILL_THIS_FORM_SHORT 2479 1.16 1.71 0.90 118 XMPhish30 2389 0.99 1.64 0.67 119 T_REMOTE_IMAGE 2374 2.97 1.63 3.63 120 KHOP_HELO_FCRDNS 2318 1.50 1.60 1.46 121 SpammyFromTLD_01 2264 1.03 1.56 0.77 122 SUBJ_ALL_CAPS 2195 1.52 1.51 1.53 123 SHOPIFY_IMG_NOT_RCVD_SFY 2191 0.70 1.51 0.31 124 XMBrknScrpt_02 2177 1.36 1.50 1.29 125 LongTLD 2175 0.84 1.50 0.52 126 XMGenDplmaNmb 2162 0.99 1.49 0.74 127 ANY_BOUNCE_MESSAGE 2158 3.15 1.49 3.96 128 BOUNCE_MESSAGE 2155 3.15 1.48 3.96 129 URI_HEX 2113 1.33 1.45 1.27 130 ALL_TRUSTED 2113 10.72 1.45 15.26 131 HTML_MIME_NO_HTML_TAG 2096 2.18 1.44 2.54 132 HK_RANDOM_REPLYTO 2078 0.53 1.43 0.09 133 XM_B_SEO 2073 0.63 1.43 0.24 134 XMSlimDrugH 1948 0.91 1.34 0.70 135 DKIM_ADSP_CUSTOM_MED 1946 1.04 1.34 0.89 136 XM_B_Phish66 1931 0.67 1.33 0.35 137 XM_B_COPY_HTML 1911 0.99 1.32 0.83 138 XMSubMetaI_00 1893 1.13 1.30 1.04 139 BAYES_20 1892 2.96 1.30 3.78 140 SHORTCIRCUIT 1852 0.42 1.27 0.00 141 RCVD_IN_ZEN_LASTEXTERNAL 1852 0.42 1.27 0.00 142 XMBdyGiftCard01 1827 0.78 1.26 0.54 143 BAYES_00 1810 8.29 1.25 11.73 144 TR_LOTS_OF_MONEY3 1784 0.66 1.23 0.38 145 XM_ProductURIs 1767 1.08 1.22 1.01 146 XM_DK_Undo_01 1752 1.48 1.21 1.61 147 XMClaimOffer 1752 0.49 1.21 0.14 148 TM2_M_OBFU_COMMENT 1744 0.67 1.20 0.41 149 TR_XM_PHPDW 1738 0.59 1.20 0.29 150 TR_XM_SEO4 1724 0.46 1.19 0.10 151 XM_B_COVIDMETA 1707 0.52 1.17 0.20 152 FONT_INVIS_LONG_LINE 1700 0.42 1.17 0.06 153 TR_XM_PHPForged 1682 0.57 1.16 0.29 154 URI_TRY_3LD 1669 0.75 1.15 0.56 155 TR_XM_FormFill2 1663 0.57 1.14 0.29 156 NML_ADSP_CUSTOM_MED 1647 0.77 1.13 0.60 157 TR_MetaPhish_Combo_01 1632 0.82 1.12 0.67 158 XM_H_PHPOS 1624 0.55 1.12 0.28 159 TR_XM_RelayPhish 1618 0.40 1.11 0.05 160 XM_OfRef7 1599 0.52 1.10 0.24 161 HTML_FONT_TINY_NORDNS 1598 0.39 1.10 0.05 162 TR_XM_DK_Bayes 1586 5.52 1.09 7.69 163 MIME_CHARSET_FARAWAY 1573 0.73 1.08 0.56 164 TR_XM_DK_Bayes1 1573 5.43 1.08 7.55 165 XM_H_Long_From02 1545 1.01 1.06 0.98 166 HTML_TAG_BALANCE_BODY 1532 0.71 1.05 0.55 167 PLING_QUERY 1512 0.69 1.04 0.52 168 T_STY_INVIS_DIRECT 1510 0.53 1.04 0.27 169 XM_UB99 1494 0.34 1.03 0.01 170 RELAYCOUNTRY_FR 1482 0.49 1.02 0.23 171 XMBody_78 1467 0.49 1.01 0.23 172 RCVD_IN_IADB_LISTED 1449 3.01 1.00 3.99 173 FORGED_GMAIL_RCVD 1425 0.70 0.98 0.56 174 THIS_AD 1403 0.56 0.97 0.36 175 MPART_ALT_DIFF_COUNT 1385 0.70 0.95 0.57 176 URI_NOVOWEL 1361 1.42 0.94 1.65 177 RCVD_IN_IADB_SPF 1358 2.65 0.93 3.50 178 XMPhish14 1340 0.58 0.92 0.41 179 XM_B_REG_HTML 1337 0.48 0.92 0.27 180 RCVD_IN_IADB_DK 1330 2.34 0.92 3.04 181 RCVD_IN_IADB_SENDERID 1320 2.40 0.91 3.13 182 TR_Symld_Words 1317 1.31 0.91 1.50 183 MAY_BE_FORGED 1312 0.51 0.90 0.32 184 HTTPS_HTTP_MISMATCH 1307 0.86 0.90 0.83 185 TR_XM_DK_Bayes2 1298 4.57 0.89 6.36 186 TR_Mismatch_TLD_02 1295 0.35 0.89 0.09 187 J_POPCORN_WO_D 1294 0.46 0.89 0.25 188 TR_XM_DK_SendGrid 1262 0.87 0.87 0.87 189 RCVD_IN_PBL 1262 0.75 0.87 0.70 190 T_Symld_Words_02 1252 0.64 0.86 0.54 191 XMSubMetaSSxObfu_00 1233 0.42 0.85 0.21 192 URIBL_BLACK 1217 0.31 0.84 0.05 193 T_MONEY_PERCENT 1210 0.39 0.83 0.17 194 TR_LOTS_OF_MONEY2 1210 0.39 0.83 0.17 195 XMReplyNow 1208 0.42 0.83 0.22 196 XMSexyCombo_01 1196 0.34 0.82 0.11 197 TR_XM_Base64_M1 1180 0.82 0.81 0.82 198 XM_HighProb1 1179 0.27 0.81 0.01 199 TM2_M_A_HREF_HREF 1164 0.41 0.80 0.22 200 HOSTED_IMG_MULTI_PUB_01 1159 0.27 0.80 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 258417 89.91 95.81 87.03 2 RELAYCOUNTRY_US 242548 82.80 85.06 81.69 3 DKIM_SIGNED 227462 81.11 90.33 76.61 4 XM_DK_Pass 223194 78.59 85.57 75.17 5 DKIM_VALID 220263 77.64 84.69 74.18 6 XM_B_Unicode 211964 76.31 86.37 71.39 7 BAYES_50 182746 54.84 41.15 61.55 8 DKIM_VALID_AU 177614 61.92 66.20 59.82 9 DCC_CHECK_NEGATIVE 175497 47.07 22.47 59.11 10 XMListUnsubscribeExists 149904 57.75 72.60 50.49 11 XM_B_SpammyWords 134926 53.63 70.37 45.44 12 XM_B_Unicode3 123413 44.65 50.94 41.56 13 DCC_CHECK 121285 52.47 76.22 40.85 14 RCVD_IN_MSPIKE_H2 106831 37.61 40.93 35.98 15 DKIM_VALID_EF 86273 29.38 30.03 29.06 16 LOC_TINY_FONT_1 84844 36.20 51.77 28.57 17 T_TM2_M_HEADER_IN_MSG 84603 26.12 21.26 28.49 18 HTML_FONT_LOW_CONTRAST 83900 32.22 40.33 28.26 19 FVGT_m_MULTI_ODD 73765 27.79 33.80 24.84 20 XMSubLong 72173 24.63 25.28 24.31 21 T_KAM_HTML_FONT_INVALID 65420 25.60 32.88 22.03 22 MIME_HTML_ONLY 64403 23.67 27.73 21.69 23 XM_B_SpammyWords2 55557 26.12 41.27 18.71 24 ALL_TRUSTED 45300 10.72 1.45 15.26 25 USER_IN_DEF_DKIM_WL 42028 10.23 2.22 14.15 26 XM_Multi_Part_URI 39493 17.13 24.95 13.30 27 TR_XM_DK_Unsub 38539 15.67 21.17 12.98 28 UNPARSEABLE_RELAY 35528 13.81 17.58 11.97 29 BAYES_00 34840 8.29 1.25 11.73 30 XM_B_PhoneNumber 28381 8.16 5.31 9.56 31 XM_Evil_Numbers_Gen 28056 9.97 11.02 9.45 32 XM_B_Unsub 27901 11.46 15.66 9.40 33 TooManyTo_001 25279 6.78 3.23 8.51 34 LotsOfNums_01 25159 8.42 8.30 8.47 35 TR_XM_DK_Bayes 22820 5.52 1.09 7.69 36 TR_XM_DK_Bayes1 22429 5.43 1.08 7.55 37 FSL_BULK_SIG 21477 7.54 8.17 7.23 38 IN_ZIMBRA_NJ_WHITELIST 20762 4.72 0.09 6.99 39 XM_DKIMWhitelistDomains 20480 4.83 0.62 6.90 40 BAYES_60 20331 7.35 8.38 6.85 41 TR_XM_BayesUnsub 20300 9.52 15.01 6.84 42 T_TooManySym_01 19552 5.34 2.80 6.58 43 TR_XM_DK_Bayes2 18898 4.57 0.89 6.36 44 LOTS_OF_MONEY 17500 7.78 11.63 5.89 45 XM_H_Long_From01 16722 5.41 4.97 5.63 46 HTML_IMAGE_RATIO_04 15997 5.51 5.76 5.39 47 RCVD_IN_MSPIKE_H3 15996 4.85 3.76 5.39 48 RCVD_IN_MSPIKE_WL 15996 4.85 3.76 5.39 49 XM_H_GMP 15920 5.23 4.95 5.36 50 MIME_QP_LONG_LINE 15865 4.49 2.76 5.34 51 TR_MAX_INTL_RELAY 15850 8.30 14.36 5.34 52 XM_B_Phish_Phrases 15738 6.54 9.06 5.30 53 BAYES_40 15623 4.13 1.80 5.26 54 XMStrtUSub 14805 4.78 4.35 4.99 55 XM_DK_Undo_02 14796 17.18 42.09 4.98 56 HTML_IMAGE_RATIO_02 13679 5.18 6.36 4.61 57 MPART_ALT_DIFF 13629 5.07 6.06 4.59 58 XM_PDF 13347 3.19 0.53 4.50 59 XM_B_SpammyWords3 13080 8.13 15.74 4.41 60 RCVD_IN_VALIDITY_SAFE 12552 3.64 2.45 4.23 61 XM_UncommonTLD01 12498 4.75 5.87 4.21 62 RCVD_IN_IADB_LISTED 11846 3.01 1.00 3.99 63 ANY_BOUNCE_MESSAGE 11763 3.15 1.49 3.96 64 BOUNCE_MESSAGE 11758 3.15 1.48 3.96 65 BAYES_20 11211 2.96 1.30 3.78 66 RELAYCOUNTRY_META 11209 7.21 14.23 3.78 67 TR_XM_SpammyWords4 11148 6.01 10.63 3.75 68 T_TooManySym_02 10904 2.66 0.60 3.67 69 T_REMOTE_IMAGE 10780 2.97 1.63 3.63 70 RCVD_IN_VALIDITY_CERTIFIED 10458 3.07 2.15 3.52 71 RCVD_IN_IADB_SPF 10378 2.65 0.93 3.50 72 XMSubMetaSx_00 10349 3.98 5.00 3.49 73 BOTNET_IPINHOSTNAME 9972 5.30 9.26 3.36 74 BAYES_80 9943 5.20 8.99 3.35 75 BAYES_99 9636 12.07 30.09 3.25 76 TooManyTo_002 9481 2.32 0.52 3.19 77 RCVD_IN_IADB_SENDERID 9302 2.40 0.91 3.13 78 XMNumbers 9238 3.28 3.63 3.11 79 MAILING_LIST_MULTI 9209 2.88 2.42 3.10 80 RCVD_IN_IADB_DK 9033 2.34 0.92 3.04 81 MIME_HTML_ONLY_MULTI 8584 2.99 3.20 2.89 82 HTML_IMAGE_RATIO_06 8518 3.10 3.57 2.87 83 RCVD_IN_IADB_VOUCHED 7901 1.90 0.34 2.66 84 XM_B_SpammyTLD 7786 3.00 3.76 2.62 85 XM_CamelCaseFrm001 7671 2.89 3.52 2.58 86 XM_Body_Dirty_Words 7660 4.64 8.86 2.58 87 INVALID_MSGID 7616 1.78 0.16 2.56 88 HTML_MIME_NO_HTML_TAG 7539 2.18 1.44 2.54 89 BAYES_999 7467 9.43 23.56 2.51 90 DKIM_INVALID 7199 3.48 5.64 2.42 91 TR_XM_DKIM_Undo 6944 11.43 29.99 2.34 92 XM_B_URI_Unicode 6833 2.44 2.71 2.30 93 BAYES_05 6681 1.72 0.65 2.25 94 XMNoVowels 6396 2.47 3.11 2.15 95 TR_XM_SpammyRelay 6288 5.04 11.01 2.12 96 TO_MALFORMED 6277 1.43 0.02 2.11 97 MIME_HTML_MOSTLY 6268 2.48 3.23 2.11 98 HTML_IMAGE_RATIO_08 5996 2.27 2.78 2.02 99 BAYES_95 5897 3.01 5.12 1.99 100 TM2_M_URI_OPT_OUT 5657 2.23 2.89 1.91 101 FROM_EXCESS_BASE64 5642 2.02 2.27 1.90 102 T_XMDrugObfuBody_08 5629 2.28 3.06 1.90 103 RCVD_IN_IADB_OPTIN 5543 1.33 0.22 1.87 104 TM2_M_VERY_LONG_WORD 5354 2.96 5.33 1.80 105 TooManyTo_003 4901 1.26 0.45 1.65 106 URI_NOVOWEL 4897 1.42 0.94 1.65 107 TR_XM_PhishingBody 4892 2.65 4.69 1.65 108 T_XMDrugObfuBody_14 4831 2.62 4.65 1.63 109 XM_B_Investor 4799 2.54 4.43 1.62 110 XM_DK_Undo_01 4795 1.48 1.21 1.61 111 TR_XM_UnparsRelay 4633 3.81 8.40 1.56 112 UNTRUSTED_Relay 4592 2.54 4.58 1.55 113 IN_HORDE_ADDRESS_BOOK 4575 1.07 0.10 1.54 114 SUBJ_ALL_CAPS 4547 1.52 1.51 1.53 115 TR_Symld_Words 4461 1.31 0.91 1.50 116 XMGappySubj_01 4458 1.05 0.14 1.50 117 XMSexyCombo_05 4365 2.25 3.84 1.47 118 KHOP_HELO_FCRDNS 4335 1.50 1.60 1.46 119 BOTNET 4183 3.72 8.45 1.41 120 TR_XM_SpammyWords5 4182 2.19 3.78 1.41 121 XM_SendGrid 4179 1.54 1.82 1.41 122 XMDiploma_00 4126 1.84 2.75 1.39 123 XM_SPF_SoftFail 4054 1.73 2.47 1.37 124 XM_B_Unsub2 3952 1.73 2.54 1.33 125 XMBrknScrpt_02 3828 1.36 1.50 1.29 126 T_TooManySym_03 3827 0.94 0.21 1.29 127 TR_DCC_Bayes_99 3817 8.26 22.52 1.29 128 URI_HEX 3759 1.33 1.45 1.27 129 XMStockSpam_06 3673 1.41 1.75 1.24 130 XM_GoogleGroups 3541 1.01 0.63 1.19 131 TooManyTo_004 3437 0.91 0.40 1.16 132 HELO_NODOT 3395 0.87 0.31 1.14 133 HELO_NO_DOMAIN 3391 0.87 0.31 1.14 134 XMCapTrack 3267 0.87 0.40 1.10 135 XM_OfRef6 3142 1.88 3.55 1.06 136 TVD_SPACE_RATIO 3107 0.75 0.15 1.05 137 XMSubMetaI_00 3094 1.13 1.30 1.04 138 FROM_GOV_DKIM_AU 3009 0.75 0.22 1.01 139 XM_ProductURIs 2991 1.08 1.22 1.01 140 XM_H_Long_From02 2914 1.01 1.06 0.98 141 XM_UB50 2911 1.37 2.16 0.98 142 RELAYCOUNTRY_CA 2898 2.71 6.26 0.98 143 TooManyTo_005 2850 0.76 0.36 0.96 144 T_FILL_THIS_FORM_SHORT 2658 1.16 1.71 0.90 145 DKIM_ADSP_CUSTOM_MED 2633 1.04 1.34 0.89 146 T_XMDrugObfuBody_00 2629 1.34 2.27 0.89 147 XMGappySubj_02 2596 0.60 0.04 0.87 148 TR_XM_DK_SendGrid 2591 0.87 0.87 0.87 149 XM_B_FormFill 2552 0.59 0.03 0.86 150 RCVD_IN_BL_SPAMCOP_NET 2545 4.96 13.34 0.86 151 XM_B_SpammyWords4 2480 1.40 2.55 0.84 152 HTTPS_HTTP_MISMATCH 2475 0.86 0.90 0.83 153 XM_B_COPY_HTML 2458 0.99 1.32 0.83 154 XM_ShortIntro_01 2441 0.66 0.32 0.82 155 TR_XM_Base64_M1 2431 0.82 0.81 0.82 156 SpammyFromTLD_01 2283 1.03 1.56 0.77 157 RELAYCOUNTRY_AU 2206 1.27 2.35 0.74 158 XMGenDplmaNmb 2201 0.99 1.49 0.74 159 XMLngstWrd_00 2092 0.66 0.56 0.70 160 XMSlimDrugH 2091 0.91 1.34 0.70 161 RCVD_IN_PBL 2071 0.75 0.87 0.70 162 TVD_RCVD_IP 2064 0.67 0.63 0.70 163 XM_H_PHPMailer 2016 0.66 0.63 0.68 164 TR_MetaPhish_Combo_01 2000 0.82 1.12 0.67 165 T_OBFU_PDF_ATTACH 1999 0.48 0.09 0.67 166 XMPhish30 1978 0.99 1.64 0.67 167 T_TVD_MIME_NO_HEADERS 1976 0.45 0.02 0.67 168 XMBody_95 1833 0.48 0.19 0.62 169 T_XMHurry_00 1796 1.05 1.96 0.60 170 NML_ADSP_CUSTOM_MED 1775 0.77 1.13 0.60 171 XMLngstWrd_01 1764 0.56 0.49 0.59 172 TO_NO_BRKTS_HTML_ONLY 1707 0.48 0.28 0.57 173 MPART_ALT_DIFF_COUNT 1695 0.70 0.95 0.57 174 MIME_CHARSET_FARAWAY 1677 0.73 1.08 0.56 175 URI_TRY_3LD 1668 0.75 1.15 0.56 176 XMBSHREFv2 1667 0.53 0.47 0.56 177 FORGED_GMAIL_RCVD 1651 0.70 0.98 0.56 178 XMBody_17 1641 1.09 2.19 0.55 179 HTML_TAG_BALANCE_BODY 1627 0.71 1.05 0.55 180 XMBdyGiftCard01 1614 0.78 1.26 0.54 181 T_Symld_Words_02 1597 0.64 0.86 0.54 182 TR_XM_SPAMCOP 1584 3.82 10.53 0.53 183 XM_B_DNDMA 1561 0.92 1.72 0.53 184 PLING_QUERY 1554 0.69 1.04 0.52 185 FILL_THIS_FORM 1549 0.42 0.20 0.52 186 HTML_IMAGE_ONLY_20 1540 0.56 0.65 0.52 187 LongTLD 1539 0.84 1.50 0.52 188 XMSubMetaSxObfu_03 1510 0.51 0.50 0.51 189 RELAYCOUNTRY_GB 1488 0.54 0.63 0.50 190 SpammyFromTLD_02 1454 1.04 2.17 0.49 191 DIET_1 1448 1.02 2.11 0.49 192 XMLngstWrd_02 1435 0.43 0.33 0.48 193 TRACKER_ID 1432 0.38 0.17 0.48 194 XMMoneyMeta_00 1393 0.49 0.52 0.47 195 HTML_IMAGE_ONLY_32 1371 0.37 0.17 0.46 196 HELO_MISC_IP 1368 0.33 0.05 0.46 197 HTML_IMAGE_ONLY_28 1354 0.39 0.26 0.46 198 TR_XM_SpammyWords2 1285 4.16 11.76 0.43 199 MSGID_FROM_MTA_HEADER 1283 0.34 0.16 0.43 200 USER_IN_WHITELIST 1262 0.29 0.00 0.43 ----------------------------------------------------------------------