Email: 464028 Autolearn: 0 AvgScore: 4.58 AvgScanTime: 1.33 sec Spam: 144176 Autolearn: 0 AvgScore: 14.56 AvgScanTime: 1.46 sec Ham: 319852 Autolearn: 0 AvgScore: 0.08 AvgScanTime: 1.26 sec Time Spent Running SA: 170.89 hours Time Spent Processing Spam: 58.58 hours Time Spent Processing Ham: 112.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137372 89.73 95.28 87.22 2 DKIM_SIGNED 126821 80.27 87.96 76.80 3 XM_DK_Pass 120781 78.06 83.77 75.48 4 DKIM_VALID 119559 77.05 82.93 74.41 5 XM_B_Unicode 118682 75.00 82.32 71.69 6 RELAYCOUNTRY_US 115874 80.27 80.37 80.23 7 DCC_CHECK 109474 51.08 75.93 39.87 8 XM_B_SpammyWords 98320 52.36 68.19 45.23 9 XMListUnsubscribeExists 96633 54.36 67.02 48.65 10 DKIM_VALID_AU 95406 62.00 66.17 60.12 11 XM_B_Unicode3 71837 43.86 49.83 41.17 12 LOC_TINY_FONT_1 68630 34.31 47.60 28.31 13 RCVD_IN_MSPIKE_H2 60257 36.18 41.79 33.66 14 BAYES_50 59692 54.85 41.40 60.91 15 T_SCC_BODY_TEXT_LINE 57580 41.41 39.94 42.07 16 XM_B_SpammyWords2 56056 25.08 38.88 18.85 17 XM_DK_Undo_02 54383 15.31 37.72 5.21 18 HTML_FONT_LOW_CONTRAST 51717 29.17 35.87 26.14 19 FVGT_m_MULTI_ODD 48192 28.49 33.43 26.26 20 MIME_HTML_ONLY 44748 22.95 31.04 19.30 21 T_KAM_HTML_FONT_INVALID 44613 24.57 30.94 21.70 22 DKIM_VALID_EF 42800 29.61 29.69 29.57 23 BAYES_99 41042 11.50 28.47 3.85 24 TR_XM_DKIM_Undo 39113 10.31 27.13 2.72 25 XMSubLong 37611 24.15 26.09 23.28 26 DCC_CHECK_NEGATIVE 32518 48.41 22.55 60.07 27 BAYES_999 31380 8.86 21.77 3.04 28 T_TM2_M_HEADER_IN_MSG 30689 27.23 21.29 29.91 29 TR_XM_DK_Unsub 30333 15.40 21.04 12.86 30 XM_Multi_Part_URI 29933 16.03 20.76 13.90 31 TR_DCC_Bayes_99 29401 7.63 20.39 1.87 32 XM_B_Unsub 27212 12.34 18.87 9.39 33 TR_XM_BayesUnsub 26040 10.62 18.06 7.26 34 UNPARSEABLE_RELAY 25603 13.67 17.76 11.82 35 RELAYCOUNTRY_META 25394 8.80 17.61 4.82 36 TR_MAX_INTL_RELAY 22367 8.81 15.51 5.79 37 XM_B_SpammyWords3 21020 7.54 14.58 4.36 38 BOTNET_IPINHOSTNAME 18618 6.25 12.91 3.25 39 FSL_BULK_SIG 18412 9.34 12.77 7.79 40 LOTS_OF_MONEY 17299 7.87 12.00 6.00 41 BOTNET 16374 4.49 11.36 1.40 42 TR_XM_SpammyRelay 15968 4.92 11.08 2.15 43 TR_XM_SpammyWords4 15208 6.24 10.55 4.30 44 XM_Evil_Numbers_Gen 14584 9.13 10.12 8.69 45 TR_XM_SpammyWords2 14189 3.52 9.84 0.67 46 BAYES_80 14100 5.56 9.78 3.66 47 XM_B_Phish_Phrases 13512 6.39 9.37 5.04 48 TR_XM_UnparsRelay 13109 4.07 9.09 1.80 49 BAYES_60 12486 7.63 8.66 7.16 50 UNTRUSTED_Relay 11761 3.56 8.16 1.48 51 LotsOfNums_01 11022 7.73 7.64 7.78 52 RCVD_IN_BL_SPAMCOP_NET 10726 2.69 7.44 0.54 53 XM_Body_Dirty_Words 10433 4.58 7.24 3.39 54 HTML_IMAGE_RATIO_02 10046 5.47 6.97 4.80 55 XMSubMetaSx_00 9428 4.69 6.54 3.86 56 XM_B_PhoneNumber 9383 9.28 6.51 10.52 57 RELAYCOUNTRY_CA 8305 2.53 5.76 1.07 58 XM_UncommonTLD01 8230 4.67 5.71 4.21 59 XM_H_Long_From01 8138 5.78 5.64 5.85 60 MPART_ALT_DIFF 8081 4.82 5.60 4.46 61 TR_XM_PhishingBody 7772 2.89 5.39 1.76 62 HTML_IMAGE_RATIO_04 7648 4.41 5.30 4.01 63 TooManyTo_001 7620 7.47 5.29 8.45 64 BAYES_95 7574 3.09 5.25 2.12 65 DKIM_INVALID 7262 3.21 5.04 2.39 66 XM_H_GMP 7039 6.17 4.88 6.75 67 XMStrtUSub 6984 4.88 4.84 4.90 68 MIME_QP_LONG_LINE 6618 5.03 4.59 5.23 69 TR_XM_SPAMCOP 6560 1.58 4.55 0.23 70 XMSexyCombo_05 6299 2.54 4.37 1.71 71 XM_B_SpammyTLD 6257 3.12 4.34 2.57 72 XM_UB50 6130 1.97 4.25 0.95 73 TR_XM_SpammyWords5 6100 2.30 4.23 1.42 74 XM_B_Investor 5993 2.47 4.16 1.71 75 XMNumbers 5580 3.46 3.87 3.28 76 TM2_M_VERY_LONG_WORD 5308 2.13 3.68 1.43 77 T_XMDrugObfuBody_14 5278 2.39 3.66 1.81 78 RCVD_IN_VALIDITY_RPBL 5137 1.18 3.56 0.11 79 MIME_HTML_MOSTLY 5087 2.71 3.53 2.34 80 HTML_IMAGE_RATIO_06 5081 2.90 3.52 2.63 81 XM_B_Unsub2 4881 2.08 3.39 1.49 82 XM_CamelCaseFrm001 4787 2.58 3.32 2.25 83 XM_SPF_SoftFail 4638 1.96 3.22 1.39 84 TR_XM_NoHeaderRelay 4515 1.18 3.13 0.30 85 RCVD_IN_MSPIKE_WL 4452 4.97 3.09 5.81 86 XM_URI_RBL 4449 1.22 3.09 0.37 87 RCVD_IN_MSPIKE_H3 4400 4.85 3.05 5.67 88 MIME_HTML_ONLY_MULTI 4390 2.75 3.04 2.62 89 XM_OfRef6 4343 1.53 3.01 0.86 90 HTML_IMAGE_RATIO_08 4091 2.46 2.84 2.29 91 XMDiploma_00 4015 2.07 2.78 1.74 92 XMBody_17 4011 1.14 2.78 0.41 93 TM2_M_URI_OPT_OUT 3883 2.04 2.69 1.74 94 XM_B_SpammyWords4 3883 1.28 2.69 0.64 95 XM_B_URI_Unicode 3851 2.51 2.67 2.44 96 BOUNCE_MESSAGE 3840 3.94 2.66 4.51 97 ANY_BOUNCE_MESSAGE 3840 3.94 2.66 4.51 98 RELAYCOUNTRY_AU 3723 1.38 2.58 0.84 99 T_XMDrugObfuBody_08 3645 1.83 2.53 1.52 100 FROM_EXCESS_BASE64 3616 2.09 2.51 1.90 101 USER_IN_DEF_DKIM_WL 3325 10.15 2.31 13.68 102 MAILING_LIST_MULTI 3264 2.82 2.26 3.07 103 ALL_TRUSTED 3249 11.69 2.25 15.94 104 DKIM_ADSP_NXDOMAIN 3109 0.90 2.16 0.33 105 T_TooManySym_01 3084 4.77 2.14 5.95 106 HTML_MIME_NO_HTML_TAG 3074 2.32 2.13 2.40 107 SUBJ_ALL_CAPS 2997 1.84 2.08 1.73 108 BAYES_40 2983 4.41 2.07 5.47 109 XM_DK_Undo_01 2983 1.92 2.07 1.85 110 XMBrknScrpt_02 2980 1.35 2.07 1.03 111 RCVD_IN_VALIDITY_SAFE 2949 3.13 2.05 3.62 112 TR_XM_INV_DKIM 2920 0.74 2.03 0.16 113 SpammyFromTLD_02 2805 0.92 1.95 0.45 114 XMStockSpam_06 2778 1.53 1.93 1.36 115 XM_H_Long_From02 2692 1.19 1.87 0.88 116 KHOP_HELO_FCRDNS 2644 1.53 1.83 1.40 117 URI_HEX 2528 1.45 1.75 1.31 118 T_XMHurry_00 2511 0.94 1.74 0.57 119 SpammyFromTLD_01 2509 1.11 1.74 0.83 120 XMBounce_01 2483 0.54 1.72 0.01 121 RCVD_IN_PSBL 2390 0.73 1.66 0.31 122 T_FILL_THIS_FORM_SHORT 2385 1.15 1.65 0.92 123 RCVD_IN_VALIDITY_CERTIFIED 2287 2.55 1.59 2.98 124 XMGenDplmaNmb 2265 1.16 1.57 0.97 125 T_XMDrugObfuBody_00 2258 0.97 1.57 0.71 126 XMPhish30 2252 0.78 1.56 0.43 127 URI_TRY_3LD 2250 0.91 1.56 0.61 128 HTTPS_HTTP_MISMATCH 2229 1.02 1.55 0.79 129 BOTNET_NORDNS 2193 0.48 1.52 0.01 130 T_REMOTE_IMAGE 2178 3.09 1.51 3.80 131 RCVD_IN_ZEN_LASTEXTERNAL 2158 0.47 1.50 0.00 132 SHORTCIRCUIT 2158 0.47 1.50 0.00 133 XM_SendGrid 2140 1.45 1.48 1.43 134 URI_NOVOWEL 2135 1.51 1.48 1.53 135 BAYES_20 2090 3.13 1.45 3.89 136 TR_XM_PHPDW 1990 0.73 1.38 0.44 137 TR_XM_PHPForged 1969 0.73 1.37 0.44 138 TR_XM_FormFill2 1951 0.73 1.35 0.44 139 XM_B_Phish66 1938 0.65 1.34 0.34 140 RCVD_IN_PBL 1937 0.92 1.34 0.73 141 XM_H_PHPOS 1915 0.71 1.33 0.43 142 XMPhish14 1888 0.76 1.31 0.51 143 TR_LOTS_OF_MONEY3 1863 0.58 1.29 0.26 144 T_MONEY_PERCENT 1844 0.62 1.28 0.32 145 TR_LOTS_OF_MONEY2 1844 0.62 1.28 0.32 146 RELAYCOUNTRY_FR 1838 0.60 1.27 0.29 147 XPRIO 1835 0.40 1.27 0.01 148 RELAYCOUNTRY_GB 1801 1.25 1.25 1.25 149 DKIM_ADSP_CUSTOM_MED 1785 0.92 1.24 0.77 150 T_Symld_Words_02 1722 0.76 1.19 0.56 151 XM_B_COPY_HTML 1703 0.82 1.18 0.65 152 XM_HighProb1 1698 0.37 1.18 0.01 153 XMBdyGiftCard01 1693 0.74 1.17 0.54 154 TR_XM_InvalidRelay 1646 0.36 1.14 0.01 155 DIET_1 1611 0.50 1.12 0.22 156 XM_DIRTYINTL 1594 0.49 1.11 0.21 157 XM_B_SEO 1584 0.53 1.10 0.28 158 TR_MetaPhish_Combo_01 1561 0.97 1.08 0.91 159 TR_Symld_Words 1550 1.48 1.08 1.67 160 RDNS_DYNAMIC 1542 0.55 1.07 0.31 161 RCVD_IN_IADB_LISTED 1541 3.19 1.07 4.14 162 XM_UB60 1540 0.38 1.07 0.07 163 RELAYCOUNTRY_CN 1518 0.38 1.05 0.08 164 XMHTML_After_End 1495 0.61 1.04 0.41 165 NML_ADSP_CUSTOM_MED 1485 0.67 1.03 0.51 166 RCVD_IN_MSPIKE_BL 1485 0.32 1.03 0.00 167 TR_XM_Base64_M1 1474 0.85 1.02 0.77 168 SHOPIFY_IMG_NOT_RCVD_SFY 1470 0.50 1.02 0.27 169 MPART_ALT_DIFF_COUNT 1467 0.66 1.02 0.49 170 XMSubMetaI_00 1453 0.60 1.01 0.41 171 XM_UB99 1445 0.32 1.00 0.01 172 TR_XM_SEO4 1442 0.39 1.00 0.11 173 RCVD_IN_IADB_SPF 1438 2.79 1.00 3.60 174 XMSlimDrugH 1424 0.65 0.99 0.50 175 RCVD_IN_IADB_SENDERID 1407 2.50 0.98 3.19 176 RCVD_IN_IADB_DK 1405 2.43 0.97 3.08 177 XMSexyCombo_01 1396 0.47 0.97 0.25 178 XMSubMetaSxObfu_03 1386 0.55 0.96 0.37 179 HTML_TAG_BALANCE_BODY 1378 0.74 0.96 0.64 180 XM_UB80 1368 0.30 0.95 0.01 181 TR_XM_RelayPhish 1340 0.36 0.93 0.10 182 XM_B_DNDMA 1334 0.56 0.93 0.39 183 TR_Mismatch_TLD_02 1329 0.34 0.92 0.07 184 URIBL_BLACK 1309 0.32 0.91 0.06 185 XM_ProductURIs 1283 0.58 0.89 0.43 186 MultiRelay_CC 1271 0.37 0.88 0.14 187 LongTLD 1264 0.62 0.88 0.51 188 XMBody_78 1258 0.50 0.87 0.34 189 XM_H_PHPMailer 1252 0.76 0.87 0.71 190 FORGED_GMAIL_RCVD 1218 0.57 0.84 0.44 191 XMLngstWrd_00 1213 0.68 0.84 0.60 192 XMReplyNow 1208 0.43 0.84 0.25 193 TM2_M_A_HREF_HREF 1208 0.43 0.84 0.25 194 RELAYCOUNTRY_TH 1201 0.26 0.83 0.00 195 TVD_RCVD_IP 1190 0.74 0.83 0.71 196 HTML_IMAGE_ONLY_20 1163 0.68 0.81 0.62 197 TR_XM_DK_SendGrid 1155 0.92 0.80 0.98 198 DEAR_SOMETHING 1150 0.28 0.80 0.05 199 RELAYCOUNTRY_RU 1148 0.26 0.80 0.02 200 XM_GoogleGroups 1120 1.19 0.78 1.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 278984 89.73 95.28 87.22 2 RELAYCOUNTRY_US 256622 80.27 80.37 80.23 3 DKIM_SIGNED 245637 80.27 87.96 76.80 4 XM_DK_Pass 241419 78.06 83.77 75.48 5 DKIM_VALID 237993 77.05 82.93 74.41 6 XM_B_Unicode 229317 75.00 82.32 71.69 7 BAYES_50 194833 54.85 41.40 60.91 8 DKIM_VALID_AU 192288 62.00 66.17 60.12 9 DCC_CHECK_NEGATIVE 192137 48.41 22.55 60.07 10 XMListUnsubscribeExists 155599 54.36 67.02 48.65 11 XM_B_SpammyWords 144657 52.36 68.19 45.23 12 T_SCC_BODY_TEXT_LINE 134554 41.41 39.94 42.07 13 XM_B_Unicode3 131671 43.86 49.83 41.17 14 DCC_CHECK 127536 51.08 75.93 39.87 15 RCVD_IN_MSPIKE_H2 107649 36.18 41.79 33.66 16 T_TM2_M_HEADER_IN_MSG 95663 27.23 21.29 29.91 17 DKIM_VALID_EF 94577 29.61 29.69 29.57 18 LOC_TINY_FONT_1 90565 34.31 47.60 28.31 19 FVGT_m_MULTI_ODD 83997 28.49 33.43 26.26 20 HTML_FONT_LOW_CONTRAST 83625 29.17 35.87 26.14 21 XMSubLong 74451 24.15 26.09 23.28 22 T_KAM_HTML_FONT_INVALID 69409 24.57 30.94 21.70 23 MIME_HTML_ONLY 61724 22.95 31.04 19.30 24 XM_B_SpammyWords2 60301 25.08 38.88 18.85 25 ALL_TRUSTED 50976 11.69 2.25 15.94 26 XM_Multi_Part_URI 44451 16.03 20.76 13.90 27 USER_IN_DEF_DKIM_WL 43763 10.15 2.31 13.68 28 TR_XM_DK_Unsub 41126 15.40 21.04 12.86 29 UNPARSEABLE_RELAY 37814 13.67 17.76 11.82 30 BAYES_00 33958 7.53 0.69 10.62 31 XM_B_PhoneNumber 33659 9.28 6.51 10.52 32 XM_B_Unsub 30044 12.34 18.87 9.39 33 XM_Evil_Numbers_Gen 27784 9.13 10.12 8.69 34 TooManyTo_001 27040 7.47 5.29 8.45 35 FSL_BULK_SIG 24907 9.34 12.77 7.79 36 LotsOfNums_01 24869 7.73 7.64 7.78 37 TR_XM_DK_Bayes 23802 5.30 0.55 7.44 38 TR_XM_BayesUnsub 23228 10.62 18.06 7.26 39 TR_XM_DK_Bayes1 23222 5.17 0.54 7.26 40 IN_ZIMBRA_NJ_WHITELIST 23028 5.00 0.11 7.20 41 BAYES_60 22907 7.63 8.66 7.16 42 XM_DKIMWhitelistDomains 22725 4.95 0.17 7.10 43 XM_H_GMP 21583 6.17 4.88 6.75 44 TR_XM_DK_Bayes2 19394 4.31 0.41 6.06 45 LOTS_OF_MONEY 19200 7.87 12.00 6.00 46 T_TooManySym_01 19028 4.77 2.14 5.95 47 XM_H_Long_From01 18705 5.78 5.64 5.85 48 RCVD_IN_MSPIKE_WL 18594 4.97 3.09 5.81 49 TR_MAX_INTL_RELAY 18510 8.81 15.51 5.79 50 RCVD_IN_MSPIKE_H3 18124 4.85 3.05 5.67 51 BAYES_40 17483 4.41 2.07 5.47 52 MIME_QP_LONG_LINE 16742 5.03 4.59 5.23 53 XM_DK_Undo_02 16676 15.31 37.72 5.21 54 XM_B_Phish_Phrases 16132 6.39 9.37 5.04 55 XMStrtUSub 15675 4.88 4.84 4.90 56 RELAYCOUNTRY_META 15431 8.80 17.61 4.82 57 HTML_IMAGE_RATIO_02 15351 5.47 6.97 4.80 58 XM_PDF 14447 3.35 0.75 4.52 59 ANY_BOUNCE_MESSAGE 14439 3.94 2.66 4.51 60 BOUNCE_MESSAGE 14434 3.94 2.66 4.51 61 MPART_ALT_DIFF 14267 4.82 5.60 4.46 62 XM_B_SpammyWords3 13957 7.54 14.58 4.36 63 TR_XM_SpammyWords4 13764 6.24 10.55 4.30 64 XM_UncommonTLD01 13451 4.67 5.71 4.21 65 RCVD_IN_IADB_LISTED 13245 3.19 1.07 4.14 66 HTML_IMAGE_RATIO_04 12824 4.41 5.30 4.01 67 BAYES_20 12437 3.13 1.45 3.89 68 XMSubMetaSx_00 12340 4.69 6.54 3.86 69 BAYES_99 12313 11.50 28.47 3.85 70 T_REMOTE_IMAGE 12161 3.09 1.51 3.80 71 BAYES_80 11716 5.56 9.78 3.66 72 RCVD_IN_VALIDITY_SAFE 11583 3.13 2.05 3.62 73 RCVD_IN_IADB_SPF 11499 2.79 1.00 3.60 74 XM_Body_Dirty_Words 10841 4.58 7.24 3.39 75 XMNumbers 10494 3.46 3.87 3.28 76 BOTNET_IPINHOSTNAME 10405 6.25 12.91 3.25 77 RCVD_IN_IADB_SENDERID 10204 2.50 0.98 3.19 78 RCVD_IN_IADB_DK 9861 2.43 0.97 3.08 79 MAILING_LIST_MULTI 9831 2.82 2.26 3.07 80 T_TooManySym_02 9758 2.28 0.57 3.05 81 BAYES_999 9728 8.86 21.77 3.04 82 RCVD_IN_VALIDITY_CERTIFIED 9526 2.55 1.59 2.98 83 TooManyTo_002 9200 2.17 0.59 2.88 84 RCVD_IN_IADB_VOUCHED 9095 2.08 0.39 2.84 85 TR_XM_DKIM_Undo 8713 10.31 27.13 2.72 86 HTML_IMAGE_RATIO_06 8398 2.90 3.52 2.63 87 MIME_HTML_ONLY_MULTI 8381 2.75 3.04 2.62 88 XM_B_SpammyTLD 8216 3.12 4.34 2.57 89 XM_B_URI_Unicode 7793 2.51 2.67 2.44 90 HTML_MIME_NO_HTML_TAG 7691 2.32 2.13 2.40 91 DKIM_INVALID 7644 3.21 5.04 2.39 92 MIME_HTML_MOSTLY 7491 2.71 3.53 2.34 93 BAYES_05 7412 1.82 0.73 2.32 94 INVALID_MSGID 7385 1.66 0.23 2.31 95 HTML_IMAGE_RATIO_08 7332 2.46 2.84 2.29 96 XM_CamelCaseFrm001 7198 2.58 3.32 2.25 97 TR_XM_SpammyRelay 6872 4.92 11.08 2.15 98 BAYES_95 6777 3.09 5.25 2.12 99 RCVD_IN_IADB_OPTIN 6337 1.44 0.24 1.98 100 TO_MALFORMED 6272 1.35 0.01 1.96 101 FROM_EXCESS_BASE64 6075 2.09 2.51 1.90 102 TR_DCC_Bayes_99 5996 7.63 20.39 1.87 103 XM_DK_Undo_01 5909 1.92 2.07 1.85 104 T_XMDrugObfuBody_14 5799 2.39 3.66 1.81 105 TR_XM_UnparsRelay 5763 4.07 9.09 1.80 106 TR_XM_PhishingBody 5630 2.89 5.39 1.76 107 TooManyTo_003 5572 1.36 0.50 1.74 108 XMDiploma_00 5569 2.07 2.78 1.74 109 TM2_M_URI_OPT_OUT 5564 2.04 2.69 1.74 110 SUBJ_ALL_CAPS 5519 1.84 2.08 1.73 111 XMSexyCombo_05 5480 2.54 4.37 1.71 112 XM_B_Investor 5460 2.47 4.16 1.71 113 TR_Symld_Words 5333 1.48 1.08 1.67 114 URI_NOVOWEL 4878 1.51 1.48 1.53 115 T_XMDrugObfuBody_08 4864 1.83 2.53 1.52 116 XM_B_Unsub2 4755 2.08 3.39 1.49 117 UNTRUSTED_Relay 4740 3.56 8.16 1.48 118 XM_SendGrid 4579 1.45 1.48 1.43 119 TM2_M_VERY_LONG_WORD 4563 2.13 3.68 1.43 120 TR_XM_SpammyWords5 4554 2.30 4.23 1.42 121 BOTNET 4480 4.49 11.36 1.40 122 KHOP_HELO_FCRDNS 4471 1.53 1.83 1.40 123 XM_SPF_SoftFail 4448 1.96 3.22 1.39 124 XM_GoogleGroups 4404 1.19 0.78 1.38 125 XMStockSpam_06 4335 1.53 1.93 1.36 126 HELO_NODOT 4253 1.02 0.32 1.33 127 HELO_NO_DOMAIN 4248 1.01 0.31 1.33 128 IN_HORDE_ADDRESS_BOOK 4208 0.94 0.10 1.32 129 URI_HEX 4178 1.45 1.75 1.31 130 T_TooManySym_03 4117 0.95 0.19 1.29 131 TooManyTo_004 4024 1.01 0.45 1.26 132 XMCapTrack 4024 1.02 0.48 1.26 133 RELAYCOUNTRY_GB 3992 1.25 1.25 1.25 134 XMGappySubj_01 3570 0.85 0.25 1.12 135 RELAYCOUNTRY_CA 3412 2.53 5.76 1.07 136 XMBrknScrpt_02 3290 1.35 2.07 1.03 137 TooManyTo_005 3280 0.83 0.39 1.03 138 TVD_SPACE_RATIO 3259 0.76 0.19 1.02 139 TR_XM_DK_SendGrid 3125 0.92 0.80 0.98 140 XMGenDplmaNmb 3099 1.16 1.57 0.97 141 XM_UB50 3034 1.97 4.25 0.95 142 XM_ShortIntro_01 2969 0.79 0.50 0.93 143 T_FILL_THIS_FORM_SHORT 2943 1.15 1.65 0.92 144 TR_MetaPhish_Combo_01 2917 0.97 1.08 0.91 145 XM_H_Long_From02 2807 1.19 1.87 0.88 146 MIME_HEADER_CTYPE_ONLY 2777 0.63 0.11 0.87 147 XM_OfRef6 2755 1.53 3.01 0.86 148 RELAYCOUNTRY_AU 2679 1.38 2.58 0.84 149 SpammyFromTLD_01 2657 1.11 1.74 0.83 150 HTTPS_HTTP_MISMATCH 2511 1.02 1.55 0.79 151 DKIM_ADSP_CUSTOM_MED 2463 0.92 1.24 0.77 152 TR_XM_Base64_M1 2448 0.85 1.02 0.77 153 RCVD_IN_PBL 2335 0.92 1.34 0.73 154 FROM_GOV_DKIM_AU 2315 0.54 0.12 0.72 155 XM_H_PHPMailer 2262 0.76 0.87 0.71 156 TVD_RCVD_IP 2262 0.74 0.83 0.71 157 T_XMDrugObfuBody_00 2255 0.97 1.57 0.71 158 XMNoVowels 2218 0.72 0.78 0.69 159 TR_XM_SpammyWords2 2153 3.52 9.84 0.67 160 URI_OPTOUT_3LD 2135 0.68 0.70 0.67 161 TO_NO_BRKTS_HTML_ONLY 2088 0.64 0.61 0.65 162 XM_B_COPY_HTML 2084 0.82 1.18 0.65 163 PLING_QUERY 2058 0.63 0.60 0.64 164 HTML_TAG_BALANCE_BODY 2057 0.74 0.96 0.64 165 XM_B_SpammyWords4 2057 1.28 2.69 0.64 166 HTML_IMAGE_ONLY_20 1990 0.68 0.81 0.62 167 URI_TRY_3LD 1963 0.91 1.56 0.61 168 T_OBFU_PDF_ATTACH 1959 0.46 0.13 0.61 169 XMLngstWrd_00 1926 0.68 0.84 0.60 170 T_XMHurry_00 1831 0.94 1.74 0.57 171 T_Symld_Words_02 1783 0.76 1.19 0.56 172 XMLngstWrd_01 1766 0.60 0.72 0.55 173 RCVD_IN_BL_SPAMCOP_NET 1743 2.69 7.44 0.54 174 XMGappySubj_02 1742 0.40 0.09 0.54 175 XMBdyGiftCard01 1719 0.74 1.17 0.54 176 T_STY_INVIS_DIRECT 1713 0.61 0.76 0.54 177 MSGID_FROM_MTA_HEADER 1669 0.41 0.15 0.52 178 XMBSHREFv2 1644 0.45 0.32 0.51 179 LongTLD 1633 0.62 0.88 0.51 180 XMPhish14 1624 0.76 1.31 0.51 181 NML_ADSP_CUSTOM_MED 1616 0.67 1.03 0.51 182 XMSlimDrugH 1611 0.65 0.99 0.50 183 MPART_ALT_DIFF_COUNT 1574 0.66 1.02 0.49 184 XMBody_95 1572 0.37 0.11 0.49 185 HTML_IMAGE_ONLY_32 1503 0.42 0.32 0.47 186 XMDateMe_00 1477 0.48 0.53 0.46 187 XMMoneyMeta_00 1467 0.49 0.56 0.46 188 SpammyFromTLD_02 1453 0.92 1.95 0.45 189 TR_XM_FormFill2 1422 0.73 1.35 0.44 190 FORGED_GMAIL_RCVD 1416 0.57 0.84 0.44 191 TR_XM_PHPForged 1400 0.73 1.37 0.44 192 TR_XM_PHPDW 1394 0.73 1.38 0.44 193 XM_ProductURIs 1390 0.58 0.89 0.43 194 XMPhish30 1388 0.78 1.56 0.43 195 XM_H_PHPOS 1365 0.71 1.33 0.43 196 XM_B_FormFill 1333 0.30 0.04 0.42 197 XMSubMetaI_00 1326 0.60 1.01 0.41 198 FONT_INVIS_MSGID 1320 0.30 0.06 0.41 199 XMHTML_After_End 1319 0.61 1.04 0.41 200 XMBody_17 1302 1.14 2.78 0.41 ----------------------------------------------------------------------