Email: 570855 Autolearn: 0 AvgScore: 2.11 AvgScanTime: 1.37 sec Spam: 159393 Autolearn: 0 AvgScore: 13.55 AvgScanTime: 1.58 sec Ham: 411462 Autolearn: 0 AvgScore: -2.32 AvgScanTime: 1.29 sec Time Spent Running SA: 217.18 hours Time Spent Processing Spam: 69.79 hours Time Spent Processing Ham: 147.39 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147546 86.85 92.57 84.63 2 DKIM_SIGNED 143317 69.94 89.91 62.20 3 XM_DK_Pass 136782 67.85 85.81 60.89 4 DKIM_VALID 135388 66.93 84.94 59.96 5 XM_B_Unicode 132745 73.05 83.28 69.08 6 RELAYCOUNTRY_US 127694 79.46 80.11 79.20 7 T_SCC_BODY_TEXT_LINE 126923 82.14 79.63 83.11 8 DCC_CHECK 114119 38.29 71.60 25.39 9 XM_B_SpammyWords 112670 49.08 70.69 40.71 10 XMListUnsubscribeExists 112100 48.72 70.33 40.34 11 DKIM_VALID_AU 102160 52.43 64.09 47.91 12 XM_B_Unicode3 71104 42.08 44.61 41.10 13 XM_DK_Undo_02 70995 15.78 44.54 4.64 14 XM_B_SpammyWords2 65182 22.66 40.89 15.60 15 BAYES_50 61890 50.08 38.83 54.44 16 LOC_TINY_FONT_1 57090 23.42 35.82 18.62 17 TR_XM_DKIM_Undo 56424 11.22 35.40 1.86 18 HTML_FONT_LOW_CONTRAST 56194 26.15 35.25 22.62 19 BAYES_99 56006 12.55 35.14 3.80 20 MIME_HTML_ONLY 51066 24.15 32.04 21.10 21 DKIM_VALID_EF 51031 26.39 32.02 24.21 22 FVGT_m_MULTI_ODD 50479 24.33 31.67 21.49 23 DCC_CHECK_NEGATIVE 45252 61.66 28.39 74.55 24 BAYES_999 44811 10.02 28.11 3.01 25 T_KAM_HTML_FONT_INVALID 43825 19.47 27.49 16.36 26 XMSubLong 39641 22.91 24.87 22.14 27 TR_DCC_Bayes_99 38990 7.51 24.46 0.95 28 T_TM2_M_HEADER_IN_MSG 37280 25.24 23.39 25.95 29 TR_XM_DK_Unsub 36458 14.48 22.87 11.23 30 RELAYCOUNTRY_META 30420 7.85 19.08 3.49 31 RCVD_IN_MSPIKE_H2 30325 16.68 19.03 15.77 32 XM_Multi_Part_URI 29902 13.53 18.76 11.50 33 XM_B_Unsub 26479 9.39 16.61 6.59 34 TR_XM_BayesUnsub 25484 8.20 15.99 5.18 35 BOTNET_IPINHOSTNAME 24044 6.88 15.08 3.70 36 XM_Body_Dirty_Words 23316 7.75 14.63 5.08 37 TR_XM_SpammyRelay 22915 5.28 14.38 1.76 38 XM_B_SpammyWords3 22306 6.63 13.99 3.78 39 LOTS_OF_MONEY 22133 7.72 13.89 5.33 40 TR_XM_SpammyWords2 21539 4.16 13.51 0.54 41 UNPARSEABLE_RELAY 20978 9.40 13.16 7.94 42 RCVD_IN_BL_SPAMCOP_NET 18931 3.70 11.88 0.54 43 TR_XM_SpammyWords4 18638 5.75 11.69 3.45 44 FSL_BULK_SIG 17268 4.74 10.83 2.38 45 BOTNET 16532 3.72 10.37 1.14 46 RELAYCOUNTRY_CA 16186 3.49 10.15 0.91 47 XM_Evil_Numbers_Gen 14361 8.30 9.01 8.03 48 TR_XM_SPAMCOP 14345 2.66 9.00 0.20 49 XMSexyCombo_05 13708 3.79 8.60 1.92 50 RCVD_IN_MSPIKE_H3 13413 6.17 8.42 5.31 51 RCVD_IN_MSPIKE_WL 13413 6.19 8.42 5.33 52 BAYES_80 13175 4.95 8.27 3.66 53 XM_UncommonTLD01 12177 4.50 7.64 3.28 54 BAYES_60 11777 7.47 7.39 7.50 55 TR_XM_UnparsRelay 11735 2.93 7.36 1.21 56 UNTRUSTED_Relay 11210 2.87 7.03 1.25 57 XMSubMetaSx_00 10980 4.34 6.89 3.35 58 LotsOfNums_01 10929 7.10 6.86 7.20 59 HTML_IMAGE_RATIO_02 10445 4.63 6.55 3.88 60 MPART_ALT_DIFF 9459 8.20 5.93 9.07 61 HTML_IMAGE_RATIO_04 9298 11.97 5.83 14.35 62 XMNumbers 9257 3.43 5.81 2.50 63 TooManyTo_001 9116 7.34 5.72 7.96 64 XM_H_Long_From01 8503 4.67 5.33 4.42 65 XM_B_Phish_Phrases 8449 3.36 5.30 2.61 66 XMBody_17 8025 1.70 5.03 0.41 67 BAYES_95 7984 3.03 5.01 2.27 68 DKIM_INVALID 7929 3.00 4.97 2.24 69 XM_SPF_SoftFail 7533 3.52 4.73 3.05 70 XM_B_Investor 7480 2.33 4.69 1.42 71 SpammyFromTLD_01 7351 1.85 4.61 0.78 72 TR_XM_SpammyWords5 7240 2.26 4.54 1.37 73 HTML_IMAGE_RATIO_06 6970 4.37 4.37 4.37 74 MIME_HTML_MOSTLY 6463 2.82 4.05 2.34 75 T_XMDrugObfuBody_14 6450 2.13 4.05 1.38 76 XM_B_SpammyTLD 6336 2.63 3.98 2.11 77 T_XMDrugObfuBody_08 6209 2.12 3.90 1.44 78 XMStrtUSub 6144 8.19 3.85 9.87 79 XM_UB50 5860 1.55 3.68 0.73 80 XM_OfRef6 5850 1.79 3.67 1.06 81 TR_XM_PhishingBody 5798 2.02 3.64 1.39 82 T_FILL_THIS_FORM_SHORT 5597 1.55 3.51 0.78 83 MIME_HTML_ONLY_MULTI 5572 6.21 3.50 7.26 84 HTML_IMAGE_RATIO_08 5417 2.38 3.40 1.99 85 TR_XM_BayesRelay 5279 0.92 3.31 0.00 86 RCVD_IN_VALIDITY_SAFE 5073 3.33 3.18 3.39 87 MIME_QP_LONG_LINE 4925 4.15 3.09 4.56 88 XM_URI_RBL 4559 0.91 2.86 0.16 89 TR_XM_PHPDW 4432 1.09 2.78 0.43 90 USER_IN_DEF_DKIM_WL 4382 7.83 2.75 9.80 91 TR_XM_PHPForged 4368 1.07 2.74 0.43 92 TM2_M_URI_OPT_OUT 4332 1.90 2.72 1.58 93 HTML_MIME_NO_HTML_TAG 4318 2.24 2.71 2.06 94 SCC_BODY_URI_ONLY 4288 4.08 2.69 4.62 95 TR_XM_FormFill2 4282 1.06 2.69 0.43 96 XM_H_PHPOS 4259 1.04 2.67 0.41 97 XMDiploma_00 4257 1.66 2.67 1.27 98 TM2_M_BODY_EMPTY 4211 1.04 2.64 0.42 99 RCVD_IN_VALIDITY_CERTIFIED 4166 2.76 2.61 2.82 100 XM_B_Unsub2 4156 1.59 2.61 1.19 101 XMEmptyBody_01 4069 0.80 2.55 0.12 102 TM2_M_VERY_LONG_WORD 4012 1.41 2.52 0.98 103 T_TooManySym_01 3950 3.94 2.48 4.50 104 XM_DIRTYINTL 3946 0.88 2.48 0.27 105 MAILING_LIST_MULTI 3622 2.35 2.27 2.39 106 XM_DK_Undo_01 3534 1.86 2.22 1.72 107 XM_CamelCaseFrm001 3507 1.87 2.20 1.74 108 TR_XM_FormFill 3449 0.62 2.16 0.02 109 SUBJ_ALL_CAPS 3368 1.53 2.11 1.30 110 TR_Mismatch_TLD_02 3333 0.64 2.09 0.08 111 T_XMHurry_00 3278 0.81 2.06 0.33 112 T_XMDrugObfuBody_00 3211 0.89 2.01 0.45 113 RELAYCOUNTRY_AU 3198 1.02 2.01 0.64 114 TR_XM_NoHeaderRelay 3064 0.61 1.92 0.11 115 XM_H_Long_From02 3064 1.17 1.92 0.87 116 FROM_EXCESS_BASE64 3043 1.77 1.91 1.71 117 XM_B_SpammyWords4 3007 0.89 1.89 0.50 118 BAYES_40 2930 4.28 1.84 5.22 119 TR_XM_INV_DKIM 2921 0.54 1.83 0.05 120 ANY_BOUNCE_MESSAGE 2898 6.14 1.82 7.81 121 BOUNCE_MESSAGE 2893 6.14 1.82 7.81 122 URI_TRY_3LD 2855 0.88 1.79 0.52 123 XMStockSpam_06 2815 1.21 1.77 0.99 124 RCVD_IN_PSBL 2777 0.56 1.74 0.10 125 URI_HEX 2751 1.14 1.73 0.91 126 T_REMOTE_IMAGE 2742 2.80 1.72 3.22 127 XMSexyCombo_01 2708 0.70 1.70 0.32 128 BAYES_20 2666 5.18 1.67 6.54 129 HTML_TAG_BALANCE_BODY 2605 0.75 1.63 0.41 130 FONT_INVIS_LONG_LINE 2589 0.49 1.62 0.06 131 XM_H_Undi_Recip 2542 0.59 1.59 0.20 132 TR_LOTS_OF_MONEY3 2530 0.65 1.59 0.28 133 HTTPS_HTTP_MISMATCH 2495 0.99 1.57 0.77 134 TR_MetaPhish_Combo_01 2475 0.83 1.55 0.55 135 RCVD_IN_IADB_LISTED 2453 3.09 1.54 3.69 136 XM_HighProb1 2433 0.43 1.53 0.00 137 SpammyFromTLD_02 2369 0.68 1.49 0.37 138 XMGenDplmaNmb 2357 0.86 1.48 0.62 139 RCVD_IN_IADB_SPF 2249 2.79 1.41 3.33 140 HK_RANDOM_REPLYTO 2186 0.44 1.37 0.08 141 RCVD_IN_IADB_DK 2156 2.53 1.35 2.98 142 RCVD_IN_IADB_SENDERID 2156 2.58 1.35 3.05 143 AC_BR_BONANZA 2134 0.44 1.34 0.09 144 XM_SendGrid 2118 1.14 1.33 1.07 145 RCVD_IN_VALIDITY_RPBL 2068 0.38 1.30 0.03 146 TR_XM_InvalidRelay 2037 0.37 1.28 0.02 147 XMPhish30 2016 0.65 1.26 0.41 148 DKIM_ADSP_CUSTOM_MED 1939 0.94 1.22 0.83 149 XM_B_COVIDMETA 1894 0.48 1.19 0.20 150 XM_UB99 1879 0.33 1.18 0.00 151 KHOP_HELO_FCRDNS 1860 1.09 1.17 1.06 152 XM_B_COPY_HTML 1854 0.75 1.16 0.59 153 TR_XM_Undi_Recip2 1849 0.34 1.16 0.02 154 ALL_TRUSTED 1842 13.49 1.16 18.27 155 XMHTML_After_End 1826 0.72 1.15 0.56 156 T_MONEY_PERCENT 1803 0.47 1.13 0.22 157 TR_LOTS_OF_MONEY2 1803 0.47 1.13 0.22 158 XMSubMetaSSx_00 1768 0.46 1.11 0.21 159 XM_B_DNDMA 1766 0.55 1.11 0.33 160 XMBrknScrpt_02 1761 0.61 1.10 0.41 161 RELAYCOUNTRY_FR 1735 0.44 1.09 0.18 162 FORGED_GMAIL_RCVD 1734 0.64 1.09 0.46 163 PDS_OTHER_BAD_TLD 1710 0.39 1.07 0.13 164 URIBL_DBL_SPAM 1671 0.30 1.05 0.01 165 TR_XM_Base64_M1 1658 0.69 1.04 0.55 166 BAYES_05 1639 2.74 1.03 3.40 167 XMBody_78 1609 0.53 1.01 0.34 168 TR_Mismatch_TLD_01 1608 0.47 1.01 0.26 169 TR_Caps_n_Bayes_99 1604 0.29 1.01 0.02 170 XMReplyNow 1589 0.40 1.00 0.17 171 XM_UB60 1582 0.32 0.99 0.06 172 XMMoneyMeta_00 1580 0.82 0.99 0.75 173 URI_NOVOWEL 1527 1.24 0.96 1.35 174 XM_B_Phish66 1505 0.46 0.94 0.27 175 NML_ADSP_CUSTOM_MED 1499 0.65 0.94 0.54 176 T_Symld_Words_02 1471 0.52 0.92 0.37 177 RDNS_DYNAMIC 1467 0.47 0.92 0.30 178 XMBdyGiftCard01 1453 0.67 0.91 0.58 179 TR_XM_Spammywords 1447 0.48 0.91 0.32 180 XM_S_SpammyWords 1447 0.48 0.91 0.32 181 XM_B_SEO 1442 0.32 0.90 0.10 182 TR_Symld_Words 1419 1.23 0.89 1.36 183 XMSubMetaI_00 1389 0.56 0.87 0.44 184 XM_UB999 1387 0.25 0.87 0.00 185 BOTNET_NORDNS 1381 0.25 0.87 0.01 186 SUBJ_DOLLARS 1334 0.42 0.84 0.26 187 BAYES_00 1326 9.72 0.83 13.17 188 TR_XM_DK_SendGrid 1323 0.73 0.83 0.70 189 DIET_1 1319 0.37 0.83 0.19 190 XM_B_REG_HTML 1315 0.38 0.83 0.20 191 REMOVE_BEFORE_LINK 1306 0.38 0.82 0.21 192 MPART_ALT_DIFF_COUNT 1294 0.56 0.81 0.46 193 TM2_M_OBFU_COMMENT 1277 0.34 0.80 0.16 194 HTML_FONT_TINY_NORDNS 1255 0.30 0.79 0.11 195 XMClaimOffer 1253 0.28 0.79 0.09 196 TR_XM_RelayPhish 1241 0.25 0.78 0.05 197 XM_Nigeria_01 1222 0.24 0.77 0.03 198 TO_NO_BRKTS_PCNT 1213 0.21 0.76 0.00 199 XMSexyCombo_04 1205 0.25 0.76 0.06 200 DKIM_ADSP_NXDOMAIN 1185 0.38 0.74 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 348215 86.85 92.57 84.63 2 T_SCC_BODY_TEXT_LINE 341949 82.14 79.63 83.11 3 RELAYCOUNTRY_US 325895 79.46 80.11 79.20 4 DCC_CHECK_NEGATIVE 306754 61.66 28.39 74.55 5 XM_B_Unicode 284242 73.05 83.28 69.08 6 DKIM_SIGNED 255916 69.94 89.91 62.20 7 XM_DK_Pass 250549 67.85 85.81 60.89 8 DKIM_VALID 246702 66.93 84.94 59.96 9 BAYES_50 224000 50.08 38.83 54.44 10 DKIM_VALID_AU 197114 52.43 64.09 47.91 11 XM_B_Unicode3 169095 42.08 44.61 41.10 12 XM_B_SpammyWords 167505 49.08 70.69 40.71 13 XMListUnsubscribeExists 165997 48.72 70.33 40.34 14 T_TM2_M_HEADER_IN_MSG 106776 25.24 23.39 25.95 15 DCC_CHECK 104480 38.29 71.60 25.39 16 DKIM_VALID_EF 99627 26.39 32.02 24.21 17 HTML_FONT_LOW_CONTRAST 93067 26.15 35.25 22.62 18 XMSubLong 91115 22.91 24.87 22.14 19 FVGT_m_MULTI_ODD 88422 24.33 31.67 21.49 20 MIME_HTML_ONLY 86801 24.15 32.04 21.10 21 LOC_TINY_FONT_1 76615 23.42 35.82 18.62 22 ALL_TRUSTED 75191 13.49 1.16 18.27 23 T_KAM_HTML_FONT_INVALID 67334 19.47 27.49 16.36 24 RCVD_IN_MSPIKE_H2 64883 16.68 19.03 15.77 25 XM_B_SpammyWords2 64176 22.66 40.89 15.60 26 HTML_IMAGE_RATIO_04 59032 11.97 5.83 14.35 27 BAYES_00 54182 9.72 0.83 13.17 28 HTML_FONT_FACE_BAD 54040 9.66 0.69 13.13 29 XM_H_Trusted_IP 49742 8.71 0.00 12.09 30 XM_Multi_Part_URI 47308 13.53 18.76 11.50 31 TR_XM_DK_Unsub 46200 14.48 22.87 11.23 32 XMStrtUSub 40617 8.19 3.85 9.87 33 USER_IN_DEF_DKIM_WL 40312 7.83 2.75 9.80 34 MPART_ALT_DIFF 37336 8.20 5.93 9.07 35 XM_Evil_Numbers_Gen 33033 8.30 9.01 8.03 36 TooManyTo_001 32766 7.34 5.72 7.96 37 UNPARSEABLE_RELAY 32661 9.40 13.16 7.94 38 ANY_BOUNCE_MESSAGE 32134 6.14 1.82 7.81 39 BOUNCE_MESSAGE 32132 6.14 1.82 7.81 40 BAYES_60 30860 7.47 7.39 7.50 41 MIME_HTML_ONLY_MULTI 29868 6.21 3.50 7.26 42 LotsOfNums_01 29630 7.10 6.86 7.20 43 XM_DKIMWhitelistDomains 27124 4.76 0.04 6.59 44 XM_B_Unsub 27111 9.39 16.61 6.59 45 BAYES_20 26926 5.18 1.67 6.54 46 IN_ZIMBRA_NJ_WHITELIST 24667 4.34 0.08 5.99 47 TR_XM_DK_Bayes 24449 4.46 0.62 5.94 48 TR_XM_DK_Bayes1 23979 4.37 0.62 5.83 49 RCVD_IN_MSPIKE_WL 21940 6.19 8.42 5.33 50 LOTS_OF_MONEY 21913 7.72 13.89 5.33 51 RCVD_IN_MSPIKE_H3 21832 6.17 8.42 5.31 52 BAYES_40 21475 4.28 1.84 5.22 53 TR_XM_BayesUnsub 21325 8.20 15.99 5.18 54 XM_Body_Dirty_Words 20897 7.75 14.63 5.08 55 TR_XM_DK_Bayes2 20559 3.72 0.41 5.00 56 XM_DK_Undo_02 19088 15.78 44.54 4.64 57 SCC_BODY_URI_ONLY 19009 4.08 2.69 4.62 58 MIME_QP_LONG_LINE 18760 4.15 3.09 4.56 59 XMSubNoVowel 18652 3.38 0.40 4.53 60 T_TooManySym_01 18524 3.94 2.48 4.50 61 XM_H_Long_From01 18178 4.67 5.33 4.42 62 XM_PDF 18097 3.33 0.57 4.40 63 HTML_IMAGE_RATIO_06 18001 4.37 4.37 4.37 64 HTML_IMAGE_RATIO_02 15961 4.63 6.55 3.88 65 BAYES_99 15631 12.55 35.14 3.80 66 XM_B_SpammyWords3 15538 6.63 13.99 3.78 67 BOTNET_IPINHOSTNAME 15228 6.88 15.08 3.70 68 RCVD_IN_IADB_LISTED 15175 3.09 1.54 3.69 69 BAYES_80 15069 4.95 8.27 3.66 70 RELAYCOUNTRY_META 14377 7.85 19.08 3.49 71 TR_XM_SpammyWords4 14186 5.75 11.69 3.45 72 BAYES_05 13992 2.74 1.03 3.40 73 RCVD_IN_VALIDITY_SAFE 13951 3.33 3.18 3.39 74 XMSubMetaSx_00 13777 4.34 6.89 3.35 75 RCVD_IN_IADB_SPF 13689 2.79 1.41 3.33 76 XM_UncommonTLD01 13500 4.50 7.64 3.28 77 T_REMOTE_IMAGE 13239 2.80 1.72 3.22 78 XM_SPF_SoftFail 12558 3.52 4.73 3.05 79 RCVD_IN_IADB_SENDERID 12555 2.58 1.35 3.05 80 BAYES_999 12369 10.02 28.11 3.01 81 RCVD_IN_IADB_DK 12277 2.53 1.35 2.98 82 RCVD_IN_VALIDITY_CERTIFIED 11613 2.76 2.61 2.82 83 XM_B_Phish_Phrases 10757 3.36 5.30 2.61 84 XMNumbers 10301 3.43 5.81 2.50 85 MAILING_LIST_MULTI 9817 2.35 2.27 2.39 86 FSL_BULK_SIG 9774 4.74 10.83 2.38 87 TooManyTo_002 9737 1.85 0.51 2.37 88 MIME_HTML_MOSTLY 9626 2.82 4.05 2.34 89 BAYES_95 9327 3.03 5.01 2.27 90 DKIM_INVALID 9214 3.00 4.97 2.24 91 T_TooManySym_02 8950 1.77 0.73 2.18 92 XM_B_SpammyTLD 8668 2.63 3.98 2.11 93 RCVD_IN_IADB_VOUCHED 8585 1.67 0.60 2.09 94 HTML_MIME_NO_HTML_TAG 8494 2.24 2.71 2.06 95 HTML_IMAGE_RATIO_08 8173 2.38 3.40 1.99 96 XMSubLongNoVowel 8095 1.46 0.14 1.97 97 XMSubGarbage 8059 1.43 0.05 1.96 98 XMSexyCombo_05 7905 3.79 8.60 1.92 99 TR_XM_DKIM_Undo 7639 11.22 35.40 1.86 100 TR_XM_SpammyRelay 7240 5.28 14.38 1.76 101 INVALID_MSGID 7182 1.32 0.22 1.75 102 XM_CamelCaseFrm001 7157 1.87 2.20 1.74 103 XM_DK_Undo_01 7057 1.86 2.22 1.72 104 HELO_NODOT 7046 1.29 0.20 1.71 105 HELO_NO_DOMAIN 7041 1.29 0.20 1.71 106 FROM_EXCESS_BASE64 7034 1.77 1.91 1.71 107 TM2_M_URI_OPT_OUT 6501 1.90 2.72 1.58 108 TO_MALFORMED 6143 1.08 0.02 1.49 109 T_XMDrugObfuBody_08 5921 2.12 3.90 1.44 110 RCVD_IN_IADB_OPTIN 5883 1.14 0.40 1.43 111 XM_B_Investor 5823 2.33 4.69 1.42 112 TR_XM_PhishingBody 5706 2.02 3.64 1.39 113 T_XMDrugObfuBody_14 5683 2.13 4.05 1.38 114 TR_XM_SpammyWords5 5645 2.26 4.54 1.37 115 TVD_RCVD_IP 5639 1.19 0.72 1.37 116 TR_Symld_Words 5580 1.23 0.89 1.36 117 URI_NOVOWEL 5561 1.24 0.96 1.35 118 XMGappySubj_01 5476 1.03 0.25 1.33 119 TooManyTo_003 5437 1.07 0.41 1.32 120 SUBJ_ALL_CAPS 5353 1.53 2.11 1.30 121 IN_HORDE_ADDRESS_BOOK 5285 0.95 0.08 1.28 122 XMDiploma_00 5245 1.66 2.67 1.27 123 UNTRUSTED_Relay 5146 2.87 7.03 1.25 124 TR_XM_UnparsRelay 4987 2.93 7.36 1.21 125 XM_B_Unsub2 4893 1.59 2.61 1.19 126 XM_GoogleGroups 4749 0.99 0.57 1.15 127 XMCapTrack 4692 0.92 0.36 1.14 128 BOTNET 4689 3.72 10.37 1.14 129 XM_SendGrid 4392 1.14 1.33 1.07 130 XM_OfRef6 4382 1.79 3.67 1.06 131 KHOP_HELO_FCRDNS 4343 1.09 1.17 1.06 132 XMBody_95 4209 0.82 0.31 1.02 133 XMStockSpam_06 4085 1.21 1.77 0.99 134 TM2_M_VERY_LONG_WORD 4033 1.41 2.52 0.98 135 TooManyTo_004 3989 0.80 0.36 0.97 136 XM_E_Blogspot 3958 0.74 0.16 0.96 137 TR_DCC_Bayes_99 3904 7.51 24.46 0.95 138 XMBSHREFv2 3886 0.81 0.46 0.94 139 TVD_SPACE_RATIO 3871 0.70 0.08 0.94 140 RELAYCOUNTRY_CA 3750 3.49 10.15 0.91 141 URI_HEX 3732 1.14 1.73 0.91 142 XM_H_Long_From02 3593 1.17 1.92 0.87 143 XMGappySubj_02 3425 0.63 0.10 0.83 144 DKIM_ADSP_CUSTOM_MED 3408 0.94 1.22 0.83 145 TooManyTo_005 3277 0.66 0.30 0.80 146 T_FILL_THIS_FORM_SHORT 3226 1.55 3.51 0.78 147 SpammyFromTLD_01 3197 1.85 4.61 0.78 148 XM_ProductURIs 3166 0.76 0.72 0.77 149 HTTPS_HTTP_MISMATCH 3153 0.99 1.57 0.77 150 XMMoneyMeta_00 3099 0.82 0.99 0.75 151 T_TooManySym_03 3064 0.60 0.23 0.74 152 XM_UB50 3009 1.55 3.68 0.73 153 TR_XM_DK_SendGrid 2864 0.73 0.83 0.70 154 FROM_GOV_DKIM_AU 2835 0.62 0.43 0.69 155 XM_H_PHPMailer 2782 0.67 0.65 0.68 156 RCVD_IN_RP_SAFE 2686 0.68 0.74 0.65 157 RELAYCOUNTRY_AU 2646 1.02 2.01 0.64 158 XMGenDplmaNmb 2559 0.86 1.48 0.62 159 XM_ShortIntro_01 2461 0.55 0.42 0.60 160 XM_B_COPY_HTML 2432 0.75 1.16 0.59 161 XMBdyGiftCard01 2387 0.67 0.91 0.58 162 MSGID_NOFQDN1 2384 0.42 0.02 0.58 163 XMHTML_After_End 2288 0.72 1.15 0.56 164 TR_XM_Base64_M1 2280 0.69 1.04 0.55 165 TR_MetaPhish_Combo_01 2265 0.83 1.55 0.55 166 T_OBFU_PDF_ATTACH 2258 0.42 0.07 0.55 167 TR_XM_SpammyWords2 2224 4.16 13.51 0.54 168 NML_ADSP_CUSTOM_MED 2210 0.65 0.94 0.54 169 RCVD_IN_BL_SPAMCOP_NET 2203 3.70 11.88 0.54 170 RCVD_IN_RP_CERTIFIED 2187 0.55 0.61 0.53 171 URI_TRY_3LD 2160 0.88 1.79 0.52 172 SHORT_HELO_AND_INLINE_IMAGE 2116 0.38 0.05 0.51 173 FILL_THIS_FORM 2112 0.45 0.28 0.51 174 XM_B_SpammyWords4 2050 0.89 1.89 0.50 175 XMNoVowels 2049 0.49 0.45 0.50 176 RELAYCOUNTRY_GB 1938 0.52 0.63 0.47 177 XMLngstWrd_00 1935 0.46 0.43 0.47 178 PLING_QUERY 1929 0.53 0.68 0.47 179 FORGED_GMAIL_RCVD 1898 0.64 1.09 0.46 180 MPART_ALT_DIFF_COUNT 1896 0.56 0.81 0.46 181 XM_B_FormFill 1894 0.34 0.04 0.46 182 XMPhish14 1883 0.50 0.62 0.46 183 HTML_IMAGE_ONLY_20 1880 0.50 0.61 0.46 184 T_XMDrugObfuBody_00 1871 0.89 2.01 0.45 185 XMSubMetaI_00 1821 0.56 0.87 0.44 186 HTML_IMAGE_ONLY_28 1819 0.39 0.25 0.44 187 TR_XM_PHPDW 1781 1.09 2.78 0.43 188 TR_XM_PHPForged 1766 1.07 2.74 0.43 189 TR_XM_FormFill2 1764 1.06 2.69 0.43 190 TM2_M_BODY_EMPTY 1736 1.04 2.64 0.42 191 TO_NO_BRKTS_HTML_ONLY 1704 0.38 0.28 0.41 192 HTML_TAG_BALANCE_BODY 1703 0.75 1.63 0.41 193 XM_H_PHPOS 1700 1.04 2.67 0.41 194 XMBrknScrpt_02 1697 0.61 1.10 0.41 195 HTML_IMAGE_ONLY_32 1696 0.36 0.23 0.41 196 USER_IN_WELCOMELIST 1690 0.30 0.00 0.41 197 USER_IN_WHITELIST 1690 0.30 0.00 0.41 198 XMDateMe_00 1684 0.40 0.38 0.41 199 XMBody_17 1676 1.70 5.03 0.41 200 XMPhish30 1670 0.65 1.26 0.41 ----------------------------------------------------------------------