Email: 479895 Autolearn: 0 AvgScore: 3.72 AvgScanTime: 1.10 sec Spam: 145550 Autolearn: 0 AvgScore: 13.38 AvgScanTime: 1.23 sec Ham: 334345 Autolearn: 0 AvgScore: -0.49 AvgScanTime: 1.05 sec Time Spent Running SA: 147.19 hours Time Spent Processing Spam: 49.91 hours Time Spent Processing Ham: 97.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137097 87.28 94.19 84.28 2 DKIM_SIGNED 131202 77.98 90.14 72.68 3 XM_DK_Pass 125739 75.77 86.39 71.15 4 DKIM_VALID 124421 74.64 85.48 69.92 5 XM_B_Unicode 121376 71.15 83.39 65.82 6 T_SCC_BODY_TEXT_LINE 118859 82.57 81.66 82.96 7 RELAYCOUNTRY_US 118841 80.35 81.65 79.79 8 XM_B_SpammyWords 106768 50.88 73.35 41.09 9 DCC_CHECK 102569 41.54 70.47 28.95 10 XMListUnsubscribeExists 101684 52.91 69.86 45.53 11 DKIM_VALID_AU 94977 58.58 65.25 55.68 12 XM_B_Unicode3 66654 40.22 45.79 37.80 13 XM_DK_Undo_02 64897 17.24 44.59 5.34 14 XM_B_SpammyWords2 61825 24.33 42.48 16.44 15 BAYES_50 57891 52.79 39.77 58.46 16 LOC_TINY_FONT_1 56940 27.17 39.12 21.97 17 HTML_FONT_LOW_CONTRAST 53017 28.19 36.43 24.61 18 TR_XM_DKIM_Undo 51067 12.15 35.09 2.16 19 BAYES_99 50444 13.59 34.66 4.41 20 MIME_HTML_ONLY 45893 22.96 31.53 19.23 21 FVGT_m_MULTI_ODD 45725 26.66 31.42 24.58 22 DKIM_VALID_EF 45552 30.04 31.30 29.49 23 DCC_CHECK_NEGATIVE 42963 58.42 29.52 71.00 24 BAYES_999 39784 10.71 27.33 3.47 25 T_KAM_HTML_FONT_INVALID 39673 21.44 27.26 18.90 26 TR_DCC_Bayes_99 34462 8.08 23.68 1.28 27 XMSubLong 33763 23.19 23.20 23.19 28 T_TM2_M_HEADER_IN_MSG 33632 29.44 23.11 32.20 29 RCVD_IN_MSPIKE_H2 32857 21.62 22.57 21.20 30 TR_XM_DK_Unsub 30608 15.23 21.03 12.71 31 XM_Multi_Part_URI 26840 14.38 18.44 12.61 32 RELAYCOUNTRY_META 26830 8.45 18.43 4.10 33 BOTNET_IPINHOSTNAME 22912 7.39 15.74 3.75 34 XM_B_Unsub 22859 9.92 15.71 7.40 35 TR_XM_BayesUnsub 22143 8.65 15.21 5.80 36 TR_XM_SpammyRelay 21439 5.82 14.73 1.94 37 LOTS_OF_MONEY 20795 8.43 14.29 5.88 38 TR_XM_SpammyWords2 19969 4.56 13.72 0.58 39 XM_B_SpammyWords3 19560 6.69 13.44 3.75 40 UNPARSEABLE_RELAY 19345 10.89 13.29 9.84 41 XM_Body_Dirty_Words 18438 8.02 12.67 6.00 42 TR_XM_SpammyWords4 17547 6.38 12.06 3.91 43 RCVD_IN_BL_SPAMCOP_NET 16738 3.94 11.50 0.65 44 BOTNET 16638 4.26 11.43 1.13 45 XM_Evil_Numbers_Gen 14539 8.57 9.99 7.96 46 RELAYCOUNTRY_CA 13917 3.65 9.56 1.08 47 TR_XM_SPAMCOP 13184 2.94 9.06 0.28 48 BAYES_80 12930 5.48 8.88 3.99 49 FSL_BULK_SIG 12797 4.21 8.79 2.21 50 RCVD_IN_MSPIKE_WL 11427 6.64 7.85 6.12 51 RCVD_IN_MSPIKE_H3 11427 6.64 7.85 6.12 52 BAYES_60 11172 8.49 7.68 8.85 53 TR_XM_UnparsRelay 9517 3.00 6.54 1.45 54 HTML_IMAGE_RATIO_02 9274 5.05 6.37 4.47 55 XMSubMetaSx_00 9244 4.30 6.35 3.40 56 LotsOfNums_01 9088 7.58 6.24 8.16 57 XM_H_Long_From01 9042 5.40 6.21 5.05 58 XMSexyCombo_05 8984 3.39 6.17 2.18 59 MPART_ALT_DIFF 8783 4.42 6.03 3.71 60 TooManyTo_001 8501 8.53 5.84 9.70 61 UNTRUSTED_Relay 8379 2.82 5.76 1.53 62 XM_UncommonTLD01 8367 4.45 5.75 3.88 63 HTML_IMAGE_RATIO_04 7947 4.17 5.46 3.60 64 BAYES_95 7117 3.22 4.89 2.49 65 TR_XM_SpammyWords5 6924 2.34 4.76 1.29 66 DKIM_INVALID 6781 3.33 4.66 2.76 67 XM_B_Phish_Phrases 6775 3.47 4.65 2.95 68 TR_XM_PhishingBody 6775 2.51 4.65 1.58 69 XMBody_17 6770 1.79 4.65 0.55 70 T_XMDrugObfuBody_14 6741 3.18 4.63 2.54 71 XM_B_Investor 6669 2.42 4.58 1.49 72 T_XMDrugObfuBody_08 6230 2.39 4.28 1.56 73 XM_SPF_SoftFail 6124 3.65 4.21 3.41 74 XMNumbers 5978 3.11 4.11 2.68 75 MIME_HTML_MOSTLY 5920 2.86 4.07 2.33 76 HTML_IMAGE_RATIO_08 5541 2.64 3.81 2.14 77 HTML_IMAGE_RATIO_06 5388 3.03 3.70 2.74 78 MIME_HTML_ONLY_MULTI 5207 2.56 3.58 2.11 79 XM_OfRef6 5204 1.89 3.58 1.16 80 RCVD_IN_VALIDITY_SAFE 4946 3.70 3.40 3.84 81 XMStrtUSub 4907 4.09 3.37 4.41 82 T_FILL_THIS_FORM_SHORT 4841 1.65 3.33 0.92 83 XM_B_SpammyTLD 4690 2.50 3.22 2.18 84 XMDiploma_00 4629 2.21 3.18 1.79 85 XM_URI_RBL 4437 1.03 3.05 0.15 86 MIME_QP_LONG_LINE 4330 4.48 2.97 5.14 87 TM2_M_VERY_LONG_WORD 4279 1.81 2.94 1.31 88 TR_XM_BayesRelay 4174 0.87 2.87 0.00 89 XM_UB50 4090 1.48 2.81 0.90 90 TM2_M_URI_OPT_OUT 3983 2.06 2.74 1.77 91 TR_LOTS_OF_MONEY3 3961 0.99 2.72 0.24 92 RCVD_IN_VALIDITY_CERTIFIED 3949 3.08 2.71 3.24 93 HTML_MIME_NO_HTML_TAG 3883 2.66 2.67 2.66 94 SpammyFromTLD_01 3874 1.34 2.66 0.77 95 XM_CamelCaseFrm001 3809 2.42 2.62 2.34 96 XM_H_Undi_Recip 3770 1.11 2.59 0.46 97 XM_B_SpammyWords4 3604 1.12 2.48 0.52 98 T_TooManySym_01 3508 5.18 2.41 6.39 99 USER_IN_DEF_DKIM_WL 3496 8.31 2.40 10.88 100 SUBJ_ALL_CAPS 3338 1.85 2.29 1.65 101 RELAYCOUNTRY_AU 3290 1.14 2.26 0.66 102 XM_B_Unsub2 3116 1.62 2.14 1.39 103 FROM_EXCESS_BASE64 3098 1.94 2.13 1.86 104 MAILING_LIST_MULTI 3017 2.73 2.07 3.02 105 TR_XM_PHPDW 2853 1.00 1.96 0.58 106 TR_XM_PHPForged 2829 0.98 1.94 0.57 107 HTML_TAG_BALANCE_BODY 2810 0.91 1.93 0.47 108 TR_XM_NoHeaderRelay 2800 0.66 1.92 0.11 109 TR_XM_FormFill2 2752 0.97 1.89 0.57 110 XM_H_PHPOS 2727 0.94 1.87 0.54 111 AC_BR_BONANZA 2702 0.65 1.86 0.12 112 TR_XM_Undi_Recip5 2695 0.58 1.85 0.03 113 XM_DIRTYINTL 2686 0.76 1.85 0.29 114 HTTPS_HTTP_MISMATCH 2672 1.22 1.84 0.95 115 TR_XM_INV_DKIM 2669 0.59 1.83 0.05 116 XMStockSpam_06 2626 1.51 1.80 1.38 117 TR_XM_FormFill 2624 0.56 1.80 0.02 118 HK_RANDOM_REPLYTO 2609 0.60 1.79 0.08 119 T_REMOTE_IMAGE 2587 3.05 1.78 3.60 120 URI_TRY_3LD 2489 0.98 1.71 0.66 121 ANY_BOUNCE_MESSAGE 2456 3.43 1.69 4.19 122 BOUNCE_MESSAGE 2452 3.43 1.68 4.19 123 BOTNET_NORDNS 2436 0.52 1.67 0.01 124 T_XMHurry_00 2423 0.89 1.66 0.55 125 UNDISC_MONEY 2422 0.51 1.66 0.01 126 XMBdyGiftCard01 2333 1.06 1.60 0.82 127 XMPhish30 2311 0.79 1.59 0.44 128 TR_Mismatch_TLD_02 2299 0.53 1.58 0.07 129 T_XMDrugObfuBody_00 2296 0.92 1.58 0.64 130 XM_DK_Undo_01 2289 1.85 1.57 1.97 131 TR_XM_Undi_Recip2 2275 0.50 1.56 0.03 132 XMGenDplmaNmb 2249 1.13 1.55 0.95 133 XM_HighProb1 2241 0.47 1.54 0.00 134 SpammyFromTLD_02 2218 0.67 1.52 0.30 135 BAYES_40 2199 3.93 1.51 4.98 136 RCVD_IN_IADB_LISTED 2195 3.39 1.51 4.20 137 URI_HEX 2149 1.24 1.48 1.14 138 FONT_INVIS_LONG_LINE 2044 0.45 1.40 0.04 139 SCC_BODY_URI_ONLY 1982 2.14 1.36 2.48 140 XM_SendGrid 1970 1.40 1.35 1.43 141 TM2_M_A_HREF_HREF 1969 0.61 1.35 0.29 142 ALL_TRUSTED 1926 12.41 1.32 17.23 143 RCVD_IN_IADB_SPF 1905 3.01 1.31 3.75 144 RDNS_DYNAMIC 1865 0.63 1.28 0.34 145 TR_LOTS_OF_MONEY2 1827 0.52 1.26 0.20 146 T_MONEY_PERCENT 1827 0.52 1.26 0.20 147 RCVD_IN_IADB_DK 1781 2.66 1.22 3.29 148 TR_XM_Undi_RecipCombo2 1777 0.37 1.22 0.01 149 XM_H_Long_From02 1776 1.09 1.22 1.04 150 RCVD_IN_IADB_SENDERID 1775 2.73 1.22 3.39 151 KHOP_HELO_FCRDNS 1773 1.36 1.22 1.42 152 RCVD_IN_VALIDITY_RPBL 1766 0.39 1.21 0.03 153 XMSubMetaI_00 1755 0.67 1.21 0.44 154 URI_NOVOWEL 1753 1.53 1.20 1.67 155 XMPhish14 1716 0.72 1.18 0.52 156 TR_XM_InvalidRelay 1694 0.38 1.16 0.03 157 BAYES_20 1681 2.95 1.15 3.73 158 TR_XM_Undi_Recip11 1678 0.39 1.15 0.06 159 XM_B_Phish66 1677 0.56 1.15 0.30 160 DIET_1 1655 0.51 1.14 0.24 161 DKIM_ADSP_CUSTOM_MED 1641 1.07 1.13 1.05 162 XMReplyNow 1603 0.51 1.10 0.26 163 XM_B_COVIDMETA 1597 0.56 1.10 0.33 164 XMSexyCombo_01 1596 0.51 1.10 0.25 165 T_Symld_Words_02 1559 0.63 1.07 0.44 166 XM_UB99 1551 0.33 1.07 0.01 167 TR_Symld_Words 1535 1.48 1.05 1.66 168 XMLngstWrd_00 1521 0.89 1.05 0.82 169 XM_ProductURIs 1516 1.13 1.04 1.17 170 XM_H_PHPMailer 1502 1.01 1.03 1.00 171 TooManyTo_002 1483 2.52 1.02 3.17 172 XMHTML_After_End 1454 0.78 1.00 0.68 173 TVD_RCVD_IP 1443 1.04 0.99 1.06 174 RCVD_IN_PSBL 1419 0.40 0.97 0.14 175 FORGED_GMAIL_RCVD 1414 0.71 0.97 0.59 176 XM_B_COPY_HTML 1408 0.66 0.97 0.52 177 RELAYCOUNTRY_FR 1395 0.44 0.96 0.21 178 XMBrknScrpt_02 1378 0.60 0.95 0.45 179 XM_B_DNDMA 1365 0.55 0.94 0.38 180 HELO_DYNAMIC_SPLIT_IP 1322 0.28 0.91 0.01 181 TR_Sbj_FN_Bdy 1318 0.42 0.91 0.20 182 TooManyTo_003 1279 1.54 0.88 1.82 183 LongTLD 1267 0.52 0.87 0.36 184 TM2_M_OBFU_COMMENT 1267 0.39 0.87 0.18 185 THIS_AD 1232 0.49 0.85 0.34 186 TR_XM_Base64_M1 1224 0.58 0.84 0.47 187 MPART_ALT_DIFF_COUNT 1217 0.64 0.84 0.55 188 NML_ADSP_CUSTOM_MED 1201 0.74 0.83 0.70 189 MILLION_USD 1189 0.25 0.82 0.00 190 TR_XM_Spammywords 1186 0.35 0.81 0.15 191 XM_S_SpammyWords 1186 0.35 0.81 0.15 192 XM_UB999 1181 0.25 0.81 0.01 193 TooManyTo_004 1180 1.21 0.81 1.38 194 HTML_FONT_FACE_BAD 1166 0.52 0.80 0.40 195 TR_XM_Undi_Recip6 1164 0.26 0.80 0.02 196 BAYES_00 1143 7.41 0.79 10.30 197 TR_Mismatch_TLD_01 1141 0.45 0.78 0.30 198 PDS_OTHER_BAD_TLD 1134 0.32 0.78 0.12 199 T_TooManySym_02 1131 2.25 0.78 2.90 200 TR_XM_DK_SendGrid 1122 0.86 0.77 0.90 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 281771 87.28 94.19 84.28 2 T_SCC_BODY_TEXT_LINE 277369 82.57 81.66 82.96 3 RELAYCOUNTRY_US 266776 80.35 81.65 79.79 4 DKIM_SIGNED 243003 77.98 90.14 72.68 5 XM_DK_Pass 237871 75.77 86.39 71.15 6 DCC_CHECK_NEGATIVE 237396 58.42 29.52 71.00 7 DKIM_VALID 233788 74.64 85.48 69.92 8 XM_B_Unicode 220052 71.15 83.39 65.82 9 BAYES_50 195443 52.79 39.77 58.46 10 DKIM_VALID_AU 186161 58.58 65.25 55.68 11 XMListUnsubscribeExists 152218 52.91 69.86 45.53 12 XM_B_SpammyWords 137390 50.88 73.35 41.09 13 XM_B_Unicode3 126370 40.22 45.79 37.80 14 T_TM2_M_HEADER_IN_MSG 107672 29.44 23.11 32.20 15 DKIM_VALID_EF 98606 30.04 31.30 29.49 16 DCC_CHECK 96788 41.54 70.47 28.95 17 HTML_FONT_LOW_CONTRAST 82274 28.19 36.43 24.61 18 FVGT_m_MULTI_ODD 82196 26.66 31.42 24.58 19 XMSubLong 77531 23.19 23.20 23.19 20 LOC_TINY_FONT_1 73445 27.17 39.12 21.97 21 RCVD_IN_MSPIKE_H2 70890 21.62 22.57 21.20 22 MIME_HTML_ONLY 64289 22.96 31.53 19.23 23 T_KAM_HTML_FONT_INVALID 63204 21.44 27.26 18.90 24 ALL_TRUSTED 57609 12.41 1.32 17.23 25 XM_B_SpammyWords2 54950 24.33 42.48 16.44 26 TR_XM_DK_Unsub 42500 15.23 21.03 12.71 27 XM_Multi_Part_URI 42177 14.38 18.44 12.61 28 USER_IN_DEF_DKIM_WL 36393 8.31 2.40 10.88 29 BAYES_00 34436 7.41 0.79 10.30 30 UNPARSEABLE_RELAY 32908 10.89 13.29 9.84 31 TooManyTo_001 32434 8.53 5.84 9.70 32 BAYES_60 29573 8.49 7.68 8.85 33 LotsOfNums_01 27291 7.58 6.24 8.16 34 XM_Evil_Numbers_Gen 26599 8.57 9.99 7.96 35 XM_B_Unsub 24742 9.92 15.71 7.40 36 XM_DKIMWhitelistDomains 24419 5.12 0.10 7.30 37 IN_ZIMBRA_NJ_WHITELIST 23333 4.89 0.10 6.98 38 TR_XM_DK_Bayes 23222 5.00 0.52 6.95 39 TR_XM_DK_Bayes1 22833 4.91 0.52 6.83 40 T_TooManySym_01 21349 5.18 2.41 6.39 41 RCVD_IN_MSPIKE_H3 20462 6.64 7.85 6.12 42 RCVD_IN_MSPIKE_WL 20462 6.64 7.85 6.12 43 XM_Body_Dirty_Words 20051 8.02 12.67 6.00 44 LOTS_OF_MONEY 19664 8.43 14.29 5.88 45 XM_PDF 19490 4.24 0.60 5.83 46 TR_XM_BayesUnsub 19384 8.65 15.21 5.80 47 TR_XM_DK_Bayes2 19327 4.15 0.41 5.78 48 XM_DK_Undo_02 17839 17.24 44.59 5.34 49 MIME_QP_LONG_LINE 17180 4.48 2.97 5.14 50 XM_H_Long_From01 16889 5.40 6.21 5.05 51 BAYES_40 16653 3.93 1.51 4.98 52 HTML_IMAGE_RATIO_02 14956 5.05 6.37 4.47 53 BAYES_99 14756 13.59 34.66 4.41 54 XMStrtUSub 14737 4.09 3.37 4.41 55 RCVD_IN_IADB_LISTED 14056 3.39 1.51 4.20 56 ANY_BOUNCE_MESSAGE 14003 3.43 1.69 4.19 57 BOUNCE_MESSAGE 14002 3.43 1.68 4.19 58 RELAYCOUNTRY_META 13711 8.45 18.43 4.10 59 BAYES_80 13356 5.48 8.88 3.99 60 TR_XM_SpammyWords4 13060 6.38 12.06 3.91 61 XM_UncommonTLD01 12980 4.45 5.75 3.88 62 RCVD_IN_VALIDITY_SAFE 12828 3.70 3.40 3.84 63 XM_B_SpammyWords3 12549 6.69 13.44 3.75 64 BOTNET_IPINHOSTNAME 12539 7.39 15.74 3.75 65 RCVD_IN_IADB_SPF 12527 3.01 1.31 3.75 66 BAYES_20 12456 2.95 1.15 3.73 67 MPART_ALT_DIFF 12409 4.42 6.03 3.71 68 HTML_IMAGE_RATIO_04 12050 4.17 5.46 3.60 69 T_REMOTE_IMAGE 12031 3.05 1.78 3.60 70 BAYES_999 11603 10.71 27.33 3.47 71 XM_SPF_SoftFail 11397 3.65 4.21 3.41 72 XMSubMetaSx_00 11373 4.30 6.35 3.40 73 RCVD_IN_IADB_SENDERID 11343 2.73 1.22 3.39 74 RCVD_IN_IADB_DK 11004 2.66 1.22 3.29 75 RCVD_IN_VALIDITY_CERTIFIED 10838 3.08 2.71 3.24 76 TooManyTo_002 10614 2.52 1.02 3.17 77 MAILING_LIST_MULTI 10087 2.73 2.07 3.02 78 XM_B_Phish_Phrases 9862 3.47 4.65 2.95 79 T_TooManySym_02 9690 2.25 0.78 2.90 80 BAYES_05 9336 2.15 0.67 2.79 81 DKIM_INVALID 9215 3.33 4.66 2.76 82 HTML_IMAGE_RATIO_06 9176 3.03 3.70 2.74 83 XMNumbers 8963 3.11 4.11 2.68 84 HTML_MIME_NO_HTML_TAG 8888 2.66 2.67 2.66 85 RCVD_IN_IADB_VOUCHED 8742 2.04 0.73 2.61 86 T_XMDrugObfuBody_14 8501 3.18 4.63 2.54 87 BAYES_95 8336 3.22 4.89 2.49 88 SCC_BODY_URI_ONLY 8295 2.14 1.36 2.48 89 XM_CamelCaseFrm001 7816 2.42 2.62 2.34 90 MIME_HTML_MOSTLY 7784 2.86 4.07 2.33 91 HELO_NODOT 7513 1.76 0.63 2.25 92 HELO_NO_DOMAIN 7504 1.75 0.63 2.24 93 FSL_BULK_SIG 7392 4.21 8.79 2.21 94 XM_B_SpammyTLD 7285 2.50 3.22 2.18 95 XMSexyCombo_05 7275 3.39 6.17 2.18 96 TR_XM_DKIM_Undo 7236 12.15 35.09 2.16 97 HTML_IMAGE_RATIO_08 7140 2.64 3.81 2.14 98 INVALID_MSGID 7137 1.53 0.13 2.13 99 MIME_HTML_ONLY_MULTI 7062 2.56 3.58 2.11 100 XM_DK_Undo_01 6585 1.85 1.57 1.97 101 TR_XM_SpammyRelay 6486 5.82 14.73 1.94 102 FROM_EXCESS_BASE64 6225 1.94 2.13 1.86 103 RCVD_IN_IADB_OPTIN 6169 1.44 0.50 1.85 104 TO_MALFORMED 6167 1.29 0.00 1.84 105 TooManyTo_003 6096 1.54 0.88 1.82 106 XMDiploma_00 5989 2.21 3.18 1.79 107 TM2_M_URI_OPT_OUT 5916 2.06 2.74 1.77 108 URI_NOVOWEL 5576 1.53 1.20 1.67 109 TR_Symld_Words 5565 1.48 1.05 1.66 110 SUBJ_ALL_CAPS 5523 1.85 2.29 1.65 111 TR_XM_PhishingBody 5273 2.51 4.65 1.58 112 T_XMDrugObfuBody_08 5230 2.39 4.28 1.56 113 IN_HORDE_ADDRESS_BOOK 5206 1.11 0.08 1.56 114 UNTRUSTED_Relay 5132 2.82 5.76 1.53 115 XM_B_Investor 4966 2.42 4.58 1.49 116 XMGappySubj_01 4893 1.10 0.26 1.46 117 TR_XM_UnparsRelay 4856 3.00 6.54 1.45 118 XM_SendGrid 4765 1.40 1.35 1.43 119 KHOP_HELO_FCRDNS 4748 1.36 1.22 1.42 120 XMCapTrack 4712 1.11 0.43 1.41 121 XM_B_Unsub2 4654 1.62 2.14 1.39 122 XMStockSpam_06 4630 1.51 1.80 1.38 123 TooManyTo_004 4617 1.21 0.81 1.38 124 XM_GoogleGroups 4552 1.11 0.52 1.36 125 TM2_M_VERY_LONG_WORD 4384 1.81 2.94 1.31 126 TR_XM_SpammyWords5 4313 2.34 4.76 1.29 127 TR_DCC_Bayes_99 4294 8.08 23.68 1.28 128 XMBody_95 4232 0.93 0.17 1.27 129 TVD_SPACE_RATIO 3929 0.86 0.13 1.18 130 XM_ProductURIs 3911 1.13 1.04 1.17 131 XM_OfRef6 3868 1.89 3.58 1.16 132 T_OBFU_PDF_ATTACH 3839 0.83 0.11 1.15 133 TooManyTo_005 3834 1.03 0.75 1.15 134 URI_HEX 3797 1.24 1.48 1.14 135 BOTNET 3792 4.26 11.43 1.13 136 T_TooManySym_03 3631 0.86 0.34 1.09 137 RELAYCOUNTRY_CA 3616 3.65 9.56 1.08 138 TVD_RCVD_IP 3544 1.04 0.99 1.06 139 DKIM_ADSP_CUSTOM_MED 3496 1.07 1.13 1.05 140 XM_H_Long_From02 3462 1.09 1.22 1.04 141 XMGappySubj_02 3387 0.75 0.14 1.01 142 XM_H_PHPMailer 3360 1.01 1.03 1.00 143 XMGenDplmaNmb 3189 1.13 1.55 0.95 144 HTTPS_HTTP_MISMATCH 3176 1.22 1.84 0.95 145 XMNoVowels 3127 0.85 0.66 0.94 146 T_FILL_THIS_FORM_SHORT 3062 1.65 3.33 0.92 147 XM_UB50 3001 1.48 2.81 0.90 148 TR_XM_DK_SendGrid 2998 0.86 0.77 0.90 149 XM_ShortIntro_01 2963 0.78 0.54 0.89 150 XMBdyGiftCard01 2742 1.06 1.60 0.82 151 XMLngstWrd_00 2729 0.89 1.05 0.82 152 SpammyFromTLD_01 2573 1.34 2.66 0.77 153 RCVD_IN_RP_SAFE 2448 0.72 0.69 0.73 154 SHORT_HELO_AND_INLINE_IMAGE 2369 0.51 0.07 0.71 155 XM_H_Trusted_IP 2356 0.49 0.00 0.70 156 MSGID_NOFQDN1 2333 0.49 0.01 0.70 157 NML_ADSP_CUSTOM_MED 2332 0.74 0.83 0.70 158 XMSubNoVowel 2318 0.67 0.60 0.69 159 BASE64_LENGTH_79_INF 2300 0.52 0.14 0.69 160 XMHTML_After_End 2280 0.78 1.00 0.68 161 TR_MetaPhish_Combo_01 2232 0.68 0.70 0.67 162 XMBSHREFv2 2224 0.59 0.43 0.67 163 RELAYCOUNTRY_AU 2203 1.14 2.26 0.66 164 URI_TRY_3LD 2195 0.98 1.71 0.66 165 RCVD_IN_BL_SPAMCOP_NET 2163 3.94 11.50 0.65 166 T_XMDrugObfuBody_00 2139 0.92 1.58 0.64 167 XM_B_FormFill 2091 0.45 0.05 0.63 168 RCVD_IN_RP_CERTIFIED 2083 0.61 0.57 0.62 169 HTML_IMAGE_ONLY_32 2026 0.48 0.19 0.61 170 FILL_THIS_FORM 1975 0.53 0.39 0.59 171 FORGED_GMAIL_RCVD 1974 0.71 0.97 0.59 172 TR_XM_PHPDW 1937 1.00 1.96 0.58 173 TR_XM_SpammyWords2 1924 4.56 13.72 0.58 174 TR_XM_PHPForged 1890 0.98 1.94 0.57 175 TR_XM_FormFill2 1890 0.97 1.89 0.57 176 T_MANY_PILL_PRICE 1865 0.39 0.00 0.56 177 FROM_GOV_DKIM_AU 1854 0.42 0.11 0.55 178 TO_NO_BRKTS_HTML_ONLY 1853 0.46 0.24 0.55 179 MPART_ALT_DIFF_COUNT 1852 0.64 0.84 0.55 180 T_XMHurry_00 1830 0.89 1.66 0.55 181 XMBody_17 1829 1.79 4.65 0.55 182 XM_H_PHPOS 1804 0.94 1.87 0.54 183 MISSING_HEADERS 1790 0.48 0.35 0.54 184 USER_IN_WELCOMELIST 1768 0.37 0.00 0.53 185 USER_IN_WHITELIST 1768 0.37 0.00 0.53 186 XM_B_SpammyWords4 1755 1.12 2.48 0.52 187 RELAYCOUNTRY_GB 1753 0.54 0.57 0.52 188 XM_B_COPY_HTML 1746 0.66 0.97 0.52 189 XMPhish14 1736 0.72 1.18 0.52 190 HTML_IMAGE_ONLY_20 1719 0.45 0.32 0.51 191 RCVD_IN_SORBS_DUL 1714 0.38 0.06 0.51 192 XMDateMe_00 1671 0.49 0.47 0.50 193 HTML_TAG_BALANCE_BODY 1566 0.91 1.93 0.47 194 TR_XM_Base64_M1 1565 0.58 0.84 0.47 195 TM2_M_BODY_EMPTY 1561 0.38 0.17 0.47 196 XM_H_Undi_Recip 1537 1.11 2.59 0.46 197 XMBrknScrpt_02 1507 0.60 0.95 0.45 198 XMPhish30 1487 0.79 1.59 0.44 199 XMMoneyMeta_00 1475 0.52 0.69 0.44 200 T_Symld_Words_02 1473 0.63 1.07 0.44 ----------------------------------------------------------------------