Email: 588172 Autolearn: 0 AvgScore: 2.12 AvgScanTime: 1.50 sec Spam: 160168 Autolearn: 0 AvgScore: 13.60 AvgScanTime: 1.74 sec Ham: 428004 Autolearn: 0 AvgScore: -2.18 AvgScanTime: 1.41 sec Time Spent Running SA: 244.81 hours Time Spent Processing Spam: 77.32 hours Time Spent Processing Ham: 167.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154092 89.96 96.21 87.63 2 DKIM_SIGNED 143553 68.23 89.63 60.22 3 XM_DK_Pass 138459 66.57 86.45 59.13 4 XM_B_Unicode 137930 76.77 86.12 73.27 5 DKIM_VALID 136791 65.62 85.40 58.22 6 T_SCC_BODY_TEXT_LINE 130357 82.90 81.39 83.46 7 RELAYCOUNTRY_US 126380 77.68 78.90 77.22 8 XM_B_SpammyWords 119209 49.60 74.43 40.30 9 DCC_CHECK 117724 38.97 73.50 26.05 10 XMListUnsubscribeExists 115857 48.29 72.33 39.29 11 DKIM_VALID_AU 98402 50.69 61.44 46.67 12 XM_DK_Undo_02 75687 16.57 47.25 5.09 13 XM_B_Unicode3 72253 45.15 45.11 45.17 14 XM_B_SpammyWords2 67505 22.21 42.15 14.75 15 LOC_TINY_FONT_1 61917 24.82 38.66 19.64 16 TR_XM_DKIM_Undo 61185 12.09 38.20 2.32 17 BAYES_50 61110 52.98 38.15 58.53 18 BAYES_99 57761 12.82 36.06 4.12 19 HTML_FONT_LOW_CONTRAST 54629 25.57 34.11 22.38 20 MIME_HTML_ONLY 54473 28.04 34.01 25.81 21 DKIM_VALID_EF 53110 26.14 33.16 23.52 22 FVGT_m_MULTI_ODD 51368 23.81 32.07 20.72 23 T_KAM_HTML_FONT_INVALID 50212 20.79 31.35 16.84 24 BAYES_999 45964 10.18 28.70 3.25 25 DCC_CHECK_NEGATIVE 42426 60.99 26.49 73.91 26 TR_DCC_Bayes_99 41841 8.24 26.12 1.55 27 TR_XM_DK_Unsub 39449 14.65 24.63 10.92 28 XMSubLong 37964 25.97 23.70 26.82 29 RCVD_IN_MSPIKE_H2 36163 18.63 22.58 17.15 30 T_TM2_M_HEADER_IN_MSG 35413 23.74 22.11 24.36 31 RELAYCOUNTRY_META 33861 8.29 21.14 3.48 32 XM_Multi_Part_URI 30635 13.09 19.13 10.83 33 TR_XM_SpammyRelay 28445 6.17 17.76 1.84 34 RCVD_IN_BL_SPAMCOP_NET 25817 4.89 16.12 0.69 35 XM_B_Unsub 25659 12.82 16.02 11.63 36 TR_XM_BayesUnsub 24901 11.65 15.55 10.19 37 BOTNET_IPINHOSTNAME 24384 6.81 15.22 3.67 38 TR_XM_SpammyWords2 21933 4.33 13.69 0.83 39 TR_XM_SPAMCOP 21642 3.89 13.51 0.29 40 UNPARSEABLE_RELAY 21490 9.29 13.42 7.75 41 LOTS_OF_MONEY 21033 7.20 13.13 4.98 42 XM_B_SpammyWords3 20923 5.97 13.06 3.32 43 RELAYCOUNTRY_CA 20918 4.31 13.06 1.04 44 XM_Body_Dirty_Words 20259 6.84 12.65 4.67 45 TR_XM_SpammyWords4 18800 5.64 11.74 3.36 46 RCVD_IN_MSPIKE_WL 17134 6.70 10.70 5.21 47 RCVD_IN_MSPIKE_H3 17134 6.70 10.70 5.21 48 BOTNET 16992 3.68 10.61 1.08 49 XM_Evil_Numbers_Gen 15115 8.44 9.44 8.06 50 BAYES_80 14049 4.85 8.77 3.38 51 FSL_BULK_SIG 13705 4.26 8.56 2.65 52 BAYES_60 12058 7.32 7.53 7.24 53 TR_XM_UnparsRelay 11622 2.89 7.26 1.25 54 XMBody_17 10885 2.13 6.80 0.39 55 HTML_IMAGE_RATIO_02 10686 4.66 6.67 3.91 56 LotsOfNums_01 10545 6.84 6.58 6.94 57 XM_UncommonTLD01 10270 4.06 6.41 3.18 58 XMSexyCombo_05 9694 2.63 6.05 1.34 59 XMSubMetaSx_00 9162 3.82 5.72 3.11 60 MPART_ALT_DIFF 9071 7.94 5.66 8.79 61 HTML_IMAGE_RATIO_04 8773 11.58 5.48 13.86 62 T_FILL_THIS_FORM_SHORT 8560 2.04 5.34 0.80 63 BAYES_95 8480 2.96 5.29 2.08 64 XM_B_Phish_Phrases 8259 3.56 5.16 2.96 65 TR_XM_BayesRelay 8161 1.39 5.10 0.00 66 TooManyTo_001 8148 10.44 5.09 12.44 67 UNTRUSTED_Relay 8029 2.21 5.01 1.16 68 XM_H_Long_From01 7872 4.56 4.91 4.42 69 TR_XM_SpammyWords5 7779 2.13 4.86 1.11 70 XM_B_Investor 7455 2.16 4.65 1.23 71 HTML_IMAGE_RATIO_06 6988 4.39 4.36 4.40 72 XM_OfRef6 6915 1.97 4.32 1.09 73 DKIM_INVALID 6762 2.60 4.22 2.00 74 XMNumbers 6463 2.66 4.04 2.15 75 FONT_INVIS_LONG_LINE 6410 1.12 4.00 0.04 76 XM_SPF_SoftFail 6148 3.13 3.84 2.87 77 MIME_HTML_MOSTLY 6087 2.53 3.80 2.05 78 XM_B_SpammyTLD 6012 2.54 3.75 2.08 79 XM_H_GMP 5951 4.94 3.72 5.40 80 TR_XM_PhishingBody 5715 2.01 3.57 1.43 81 MIME_HTML_ONLY_MULTI 5613 6.20 3.50 7.21 82 T_XMDrugObfuBody_14 5551 1.97 3.47 1.42 83 XMStrtUSub 5526 8.28 3.45 10.09 84 TR_XM_FormFill 5504 0.95 3.44 0.03 85 HTML_IMAGE_RATIO_08 5450 2.25 3.40 1.81 86 HK_RANDOM_REPLYTO 5315 0.96 3.32 0.08 87 T_XMDrugObfuBody_08 5278 1.75 3.30 1.17 88 TM2_M_VERY_LONG_WORD 4762 1.52 2.97 0.97 89 MIME_QP_LONG_LINE 4685 3.91 2.93 4.28 90 XMDiploma_00 4655 5.44 2.91 6.38 91 RCVD_IN_VALIDITY_SAFE 4585 3.39 2.86 3.59 92 SpammyFromTLD_01 4432 1.28 2.77 0.72 93 XM_URI_RBL 4427 0.84 2.76 0.12 94 SUBJ_ALL_CAPS 4315 1.57 2.69 1.15 95 TR_LOTS_OF_MONEY3 4243 0.97 2.65 0.34 96 XM_B_Unsub2 4157 1.75 2.60 1.43 97 TM2_M_URI_OPT_OUT 3922 1.86 2.45 1.64 98 XM_CamelCaseFrm001 3881 2.06 2.42 1.93 99 XM_UB50 3821 1.15 2.39 0.69 100 HTML_MIME_NO_HTML_TAG 3726 1.84 2.33 1.66 101 XM_B_SpammyWords4 3655 0.94 2.28 0.44 102 RELAYCOUNTRY_AU 3520 1.08 2.20 0.66 103 RCVD_IN_VALIDITY_CERTIFIED 3320 2.76 2.07 3.01 104 T_TooManySym_01 3257 4.06 2.03 4.81 105 T_REMOTE_IMAGE 3204 2.72 2.00 2.99 106 MAILING_LIST_MULTI 3169 2.30 1.98 2.42 107 USER_IN_DEF_DKIM_WL 3050 7.59 1.90 9.71 108 FROM_EXCESS_BASE64 2992 1.69 1.87 1.62 109 TR_XM_NoHeaderRelay 2988 0.57 1.87 0.09 110 AC_BR_BONANZA 2983 0.56 1.86 0.07 111 XMStockSpam_06 2978 1.18 1.86 0.93 112 XM_DIRTYINTL 2943 0.68 1.84 0.24 113 ANY_BOUNCE_MESSAGE 2931 3.91 1.83 4.68 114 BOUNCE_MESSAGE 2927 3.90 1.83 4.68 115 HTML_TAG_BALANCE_BODY 2761 0.74 1.72 0.37 116 TR_Mismatch_TLD_02 2741 0.54 1.71 0.10 117 TR_XM_PHPForged 2730 0.70 1.70 0.33 118 DIET_1 2706 0.60 1.69 0.19 119 TR_XM_PHPDW 2690 0.69 1.68 0.32 120 URI_TRY_3LD 2651 0.89 1.66 0.60 121 TR_XM_FormFill2 2602 0.67 1.62 0.32 122 XM_H_PHPOS 2577 0.66 1.61 0.31 123 XM_DK_Undo_01 2571 1.65 1.61 1.67 124 RCVD_IN_IADB_LISTED 2530 3.01 1.58 3.55 125 XMBrknScrpt_02 2464 0.75 1.54 0.46 126 T_XMHurry_00 2432 0.67 1.52 0.35 127 XM_HighProb1 2417 0.41 1.51 0.00 128 ALL_TRUSTED 2392 15.12 1.49 20.22 129 T_XMDrugObfuBody_00 2377 0.85 1.48 0.61 130 SpammyFromTLD_02 2356 0.68 1.47 0.38 131 XMGenDplmaNmb 2354 0.91 1.47 0.70 132 BAYES_40 2349 3.96 1.47 4.90 133 TR_XM_INV_DKIM 2320 0.42 1.45 0.04 134 XMPhish30 2251 0.76 1.41 0.52 135 RCVD_IN_IADB_SPF 2206 2.68 1.38 3.17 136 XMSexyCombo_01 2206 0.53 1.38 0.21 137 XM_SendGrid 2195 1.19 1.37 1.12 138 XM_B_COVIDMETA 2152 0.56 1.34 0.27 139 URI_HEX 2123 0.89 1.33 0.73 140 TR_Caps_n_Bayes_99 2088 0.36 1.30 0.01 141 RCVD_IN_IADB_DK 2084 2.39 1.30 2.79 142 RCVD_IN_IADB_SENDERID 2069 2.44 1.29 2.86 143 HTTPS_HTTP_MISMATCH 2029 0.87 1.27 0.72 144 XMSlimDrugH 1994 0.54 1.24 0.28 145 BOTNET_NORDNS 1992 0.34 1.24 0.01 146 BAYES_20 1966 2.99 1.23 3.65 147 XMHTML_After_End 1957 0.76 1.22 0.59 148 KHOP_HELO_FCRDNS 1868 1.10 1.17 1.07 149 XM_B_DNDMA 1839 0.62 1.15 0.42 150 XM_H_Long_From02 1821 0.97 1.14 0.91 151 XM_B_COPY_HTML 1753 0.71 1.09 0.57 152 TR_XM_Base64_M1 1689 0.74 1.05 0.63 153 XM_H_PHPMailer 1663 0.73 1.04 0.61 154 XMSubMetaI_00 1641 0.62 1.02 0.46 155 RDNS_DYNAMIC 1636 0.48 1.02 0.28 156 TM2_M_A_HREF_HREF 1627 0.45 1.02 0.24 157 XM_ProductURIs 1581 0.90 0.99 0.87 158 XM_B_Phish66 1563 0.45 0.98 0.25 159 TR_XM_InvalidRelay 1563 0.28 0.98 0.02 160 URI_NOVOWEL 1555 1.25 0.97 1.36 161 TR_Symld_Words 1548 1.21 0.97 1.30 162 XM_UB99 1535 0.26 0.96 0.00 163 DKIM_ADSP_CUSTOM_MED 1530 0.80 0.96 0.74 164 TR_MetaPhish_Combo_01 1529 0.65 0.95 0.54 165 LongTLD 1505 0.53 0.94 0.37 166 T_MONEY_PERCENT 1496 0.35 0.93 0.13 167 TR_LOTS_OF_MONEY2 1496 0.35 0.93 0.13 168 XMBdyGiftCard01 1482 0.78 0.93 0.72 169 TVD_RCVD_IP 1481 1.34 0.92 1.49 170 XMBody_78 1481 0.51 0.92 0.36 171 HTML_IMAGE_ONLY_20 1440 0.55 0.90 0.42 172 XMReplyNow 1426 0.37 0.89 0.18 173 PLING_QUERY 1418 0.52 0.89 0.39 174 BAYES_00 1415 9.44 0.88 12.65 175 RELAYCOUNTRY_FR 1414 0.38 0.88 0.19 176 RCVD_IN_VALIDITY_RPBL 1391 0.25 0.87 0.02 177 MPART_ALT_DIFF_COUNT 1389 0.51 0.87 0.38 178 TR_XM_DK_SendGrid 1362 0.79 0.85 0.76 179 PDS_OTHER_BAD_TLD 1325 0.31 0.83 0.12 180 XMClaimOffer 1310 0.31 0.82 0.12 181 TR_Mismatch_TLD_01 1298 0.38 0.81 0.22 182 SUBJ_DOLLARS 1293 0.38 0.81 0.22 183 TM2_M_OBFU_COMMENT 1273 0.32 0.79 0.15 184 TooManyTo_002 1261 1.79 0.79 2.17 185 XM_H_Undi_Recip 1252 0.34 0.78 0.18 186 XMSubMetaSxObfu_03 1243 0.42 0.78 0.29 187 NML_ADSP_CUSTOM_MED 1243 0.57 0.78 0.50 188 FORGED_GMAIL_RCVD 1235 0.52 0.77 0.42 189 HELO_DYNAMIC_SPLIT_IP 1235 0.21 0.77 0.01 190 XM_Combo_Sbj 1217 0.34 0.76 0.19 191 T_XMDrugObfuBody_10 1214 0.22 0.76 0.02 192 XM_OfRef7 1200 0.29 0.75 0.12 193 RCVD_IN_IADB_VOUCHED 1191 1.75 0.74 2.13 194 HTML_FONT_FACE_BAD 1181 9.85 0.74 13.26 195 SCC_BODY_URI_ONLY 1175 1.67 0.73 2.02 196 THIS_AD 1174 0.37 0.73 0.23 197 TR_XM_DK_Bayes 1155 4.26 0.72 5.59 198 SHOPIFY_IMG_NOT_RCVD_SFY 1152 0.35 0.72 0.21 199 TR_XM_DK_Bayes1 1147 4.20 0.72 5.50 200 RCVD_IN_PSBL 1143 0.34 0.71 0.20 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 375046 89.96 96.21 87.63 2 T_SCC_BODY_TEXT_LINE 357222 82.90 81.39 83.46 3 RELAYCOUNTRY_US 330492 77.68 78.90 77.22 4 DCC_CHECK_NEGATIVE 316320 60.99 26.49 73.91 5 XM_B_Unicode 313614 76.77 86.12 73.27 6 DKIM_SIGNED 257746 68.23 89.63 60.22 7 XM_DK_Pass 253094 66.57 86.45 59.13 8 BAYES_50 250530 52.98 38.15 58.53 9 DKIM_VALID 249193 65.62 85.40 58.22 10 DKIM_VALID_AU 199731 50.69 61.44 46.67 11 XM_B_Unicode3 193324 45.15 45.11 45.17 12 XM_B_SpammyWords 172505 49.60 74.43 40.30 13 XMListUnsubscribeExists 168152 48.29 72.33 39.29 14 XMSubLong 114790 25.97 23.70 26.82 15 DCC_CHECK 111482 38.97 73.50 26.05 16 MIME_HTML_ONLY 110466 28.04 34.01 25.81 17 T_TM2_M_HEADER_IN_MSG 104245 23.74 22.11 24.36 18 DKIM_VALID_EF 100656 26.14 33.16 23.52 19 HTML_FONT_LOW_CONTRAST 95773 25.57 34.11 22.38 20 FVGT_m_MULTI_ODD 88694 23.81 32.07 20.72 21 ALL_TRUSTED 86546 15.12 1.49 20.22 22 LOC_TINY_FONT_1 84046 24.82 38.66 19.64 23 RCVD_IN_MSPIKE_H2 73400 18.63 22.58 17.15 24 T_KAM_HTML_FONT_INVALID 72093 20.79 31.35 16.84 25 XM_B_SpammyWords2 63128 22.21 42.15 14.75 26 HTML_IMAGE_RATIO_04 59321 11.58 5.48 13.86 27 HTML_FONT_FACE_BAD 56732 9.85 0.74 13.26 28 BAYES_00 54124 9.44 0.88 12.65 29 TooManyTo_001 53228 10.44 5.09 12.44 30 XM_H_Trusted_IP 52728 8.96 0.00 12.32 31 XM_B_Unsub 49764 12.82 16.02 11.63 32 TR_XM_DK_Unsub 46719 14.65 24.63 10.92 33 XM_Multi_Part_URI 46343 13.09 19.13 10.83 34 TR_XM_BayesUnsub 43599 11.65 15.55 10.19 35 XMStrtUSub 43170 8.28 3.45 10.09 36 USER_IN_DEF_DKIM_WL 41573 7.59 1.90 9.71 37 MPART_ALT_DIFF 37633 7.94 5.66 8.79 38 XM_Evil_Numbers_Gen 34499 8.44 9.44 8.06 39 UNPARSEABLE_RELAY 33164 9.29 13.42 7.75 40 BAYES_60 30992 7.32 7.53 7.24 41 MIME_HTML_ONLY_MULTI 30873 6.20 3.50 7.21 42 LotsOfNums_01 29708 6.84 6.58 6.94 43 XMDiploma_00 27322 5.44 2.91 6.38 44 XM_DKIMWhitelistDomains 25730 4.46 0.33 6.01 45 IN_ZIMBRA_NJ_WHITELIST 24460 4.19 0.10 5.71 46 TR_XM_DK_Bayes 23917 4.26 0.72 5.59 47 TR_XM_DK_Bayes1 23546 4.20 0.72 5.50 48 XM_H_GMP 23101 4.94 3.72 5.40 49 RCVD_IN_MSPIKE_H3 22292 6.70 10.70 5.21 50 RCVD_IN_MSPIKE_WL 22292 6.70 10.70 5.21 51 XM_DK_Undo_02 21795 16.57 47.25 5.09 52 LOTS_OF_MONEY 21319 7.20 13.13 4.98 53 BAYES_40 20969 3.96 1.47 4.90 54 T_TooManySym_01 20598 4.06 2.03 4.81 55 TR_XM_DK_Bayes2 20397 3.59 0.47 4.77 56 ANY_BOUNCE_MESSAGE 20051 3.91 1.83 4.68 57 BOUNCE_MESSAGE 20029 3.90 1.83 4.68 58 XM_Body_Dirty_Words 19974 6.84 12.65 4.67 59 XMSubNoVowel 18996 3.34 0.40 4.44 60 XM_H_Long_From01 18923 4.56 4.91 4.42 61 HTML_IMAGE_RATIO_06 18849 4.39 4.36 4.40 62 MIME_QP_LONG_LINE 18301 3.91 2.93 4.28 63 BAYES_99 17641 12.82 36.06 4.12 64 HTML_IMAGE_RATIO_02 16747 4.66 6.67 3.91 65 XM_PDF 16652 2.99 0.57 3.89 66 BOTNET_IPINHOSTNAME 15697 6.81 15.22 3.67 67 BAYES_20 15630 2.99 1.23 3.65 68 RCVD_IN_VALIDITY_SAFE 15350 3.39 2.86 3.59 69 RCVD_IN_IADB_LISTED 15178 3.01 1.58 3.55 70 RELAYCOUNTRY_META 14915 8.29 21.14 3.48 71 BAYES_05 14746 2.67 0.61 3.45 72 BAYES_80 14467 4.85 8.77 3.38 73 TR_XM_SpammyWords4 14377 5.64 11.74 3.36 74 XM_B_SpammyWords3 14218 5.97 13.06 3.32 75 BAYES_999 13915 10.18 28.70 3.25 76 XM_UncommonTLD01 13620 4.06 6.41 3.18 77 RCVD_IN_IADB_SPF 13563 2.68 1.38 3.17 78 XMSubMetaSx_00 13304 3.82 5.72 3.11 79 RCVD_IN_VALIDITY_CERTIFIED 12903 2.76 2.07 3.01 80 T_REMOTE_IMAGE 12783 2.72 2.00 2.99 81 XM_B_Phish_Phrases 12672 3.56 5.16 2.96 82 XM_SPF_SoftFail 12291 3.13 3.84 2.87 83 RCVD_IN_IADB_SENDERID 12256 2.44 1.29 2.86 84 RCVD_IN_IADB_DK 11950 2.39 1.30 2.79 85 FSL_BULK_SIG 11331 4.26 8.56 2.65 86 MAILING_LIST_MULTI 10349 2.30 1.98 2.42 87 TR_XM_DKIM_Undo 9931 12.09 38.20 2.32 88 TooManyTo_002 9295 1.79 0.79 2.17 89 T_TooManySym_02 9210 1.75 0.67 2.15 90 XMNumbers 9195 2.66 4.04 2.15 91 RCVD_IN_IADB_VOUCHED 9117 1.75 0.74 2.13 92 XM_B_SpammyTLD 8921 2.54 3.75 2.08 93 BAYES_95 8904 2.96 5.29 2.08 94 MIME_HTML_MOSTLY 8788 2.53 3.80 2.05 95 SCC_BODY_URI_ONLY 8635 1.67 0.73 2.02 96 DKIM_INVALID 8553 2.60 4.22 2.00 97 XMSubLongNoVowel 8348 1.45 0.13 1.95 98 XMSubGarbage 8285 1.41 0.01 1.94 99 XM_CamelCaseFrm001 8257 2.06 2.42 1.93 100 TR_XM_SpammyRelay 7868 6.17 17.76 1.84 101 HTML_IMAGE_RATIO_08 7756 2.25 3.40 1.81 102 XM_DK_Undo_01 7135 1.65 1.61 1.67 103 INVALID_MSGID 7129 1.26 0.19 1.67 104 HTML_MIME_NO_HTML_TAG 7101 1.84 2.33 1.66 105 TM2_M_URI_OPT_OUT 7034 1.86 2.45 1.64 106 FROM_EXCESS_BASE64 6923 1.69 1.87 1.62 107 HELO_NODOT 6905 1.34 0.60 1.61 108 HELO_NO_DOMAIN 6895 1.34 0.60 1.61 109 TR_DCC_Bayes_99 6642 8.24 26.12 1.55 110 TVD_RCVD_IP 6389 1.34 0.92 1.49 111 RCVD_IN_IADB_OPTIN 6223 1.18 0.46 1.45 112 TO_MALFORMED 6136 1.04 0.01 1.43 113 TR_XM_PhishingBody 6129 2.01 3.57 1.43 114 XM_B_Unsub2 6122 1.75 2.60 1.43 115 T_XMDrugObfuBody_14 6063 1.97 3.47 1.42 116 XMGappySubj_01 5868 1.05 0.21 1.37 117 URI_NOVOWEL 5817 1.25 0.97 1.36 118 XMSexyCombo_05 5746 2.63 6.05 1.34 119 TR_Symld_Words 5561 1.21 0.97 1.30 120 TooManyTo_003 5472 1.11 0.65 1.28 121 IN_HORDE_ADDRESS_BOOK 5387 0.94 0.07 1.26 122 TR_XM_UnparsRelay 5360 2.89 7.26 1.25 123 XM_B_Investor 5277 2.16 4.65 1.23 124 T_XMDrugObfuBody_08 5022 1.75 3.30 1.17 125 UNTRUSTED_Relay 4969 2.21 5.01 1.16 126 SUBJ_ALL_CAPS 4906 1.57 2.69 1.15 127 XM_SendGrid 4798 1.19 1.37 1.12 128 TR_XM_SpammyWords5 4732 2.13 4.86 1.11 129 XM_OfRef6 4681 1.97 4.32 1.09 130 BOTNET 4642 3.68 10.61 1.08 131 KHOP_HELO_FCRDNS 4599 1.10 1.17 1.07 132 XMCapTrack 4513 0.86 0.35 1.05 133 XM_GoogleGroups 4441 0.88 0.47 1.04 134 RELAYCOUNTRY_CA 4434 4.31 13.06 1.04 135 XMBSHREFv2 4409 0.85 0.37 1.03 136 XM_E_Blogspot 4208 0.75 0.11 0.98 137 TM2_M_VERY_LONG_WORD 4160 1.52 2.97 0.97 138 XMBody_95 4043 0.79 0.37 0.94 139 TVD_SPACE_RATIO 4009 0.72 0.13 0.94 140 XMStockSpam_06 3974 1.18 1.86 0.93 141 TooManyTo_004 3954 0.83 0.58 0.92 142 XM_H_Long_From02 3904 0.97 1.14 0.91 143 XM_ProductURIs 3705 0.90 0.99 0.87 144 XMGappySubj_02 3563 0.62 0.06 0.83 145 TR_XM_SpammyWords2 3552 4.33 13.69 0.83 146 T_FILL_THIS_FORM_SHORT 3418 2.04 5.34 0.80 147 T_TooManySym_03 3306 0.64 0.30 0.77 148 TR_XM_DK_SendGrid 3269 0.79 0.85 0.76 149 TooManyTo_005 3252 0.70 0.55 0.76 150 DKIM_ADSP_CUSTOM_MED 3184 0.80 0.96 0.74 151 URI_HEX 3137 0.89 1.33 0.73 152 XMBdyGiftCard01 3091 0.78 0.93 0.72 153 HTTPS_HTTP_MISMATCH 3087 0.87 1.27 0.72 154 SpammyFromTLD_01 3082 1.28 2.77 0.72 155 RCVD_IN_RP_SAFE 2997 0.67 0.58 0.70 156 XMGenDplmaNmb 2983 0.91 1.47 0.70 157 XM_UB50 2955 1.15 2.39 0.69 158 RCVD_IN_BL_SPAMCOP_NET 2949 4.89 16.12 0.69 159 RELAYCOUNTRY_AU 2823 1.08 2.20 0.66 160 TR_XM_Base64_M1 2687 0.74 1.05 0.63 161 FROM_GOV_DKIM_AU 2679 0.57 0.42 0.63 162 XMNoVowels 2663 0.63 0.65 0.62 163 XM_H_PHPMailer 2623 0.73 1.04 0.61 164 T_XMDrugObfuBody_00 2609 0.85 1.48 0.61 165 XM_ShortIntro_01 2577 0.57 0.48 0.60 166 URI_TRY_3LD 2557 0.89 1.66 0.60 167 RCVD_IN_RP_CERTIFIED 2528 0.55 0.44 0.59 168 XMHTML_After_End 2510 0.76 1.22 0.59 169 XM_B_COPY_HTML 2441 0.71 1.09 0.57 170 T_OBFU_PDF_ATTACH 2424 0.45 0.13 0.57 171 MSGID_NOFQDN1 2382 0.41 0.01 0.56 172 TR_MetaPhish_Combo_01 2296 0.65 0.95 0.54 173 XMPhish30 2215 0.76 1.41 0.52 174 SHORT_HELO_AND_INLINE_IMAGE 2190 0.39 0.07 0.51 175 XMMoneyMeta_00 2174 0.56 0.69 0.51 176 NML_ADSP_CUSTOM_MED 2124 0.57 0.78 0.50 177 FILL_THIS_FORM 2022 0.43 0.31 0.47 178 XMSubMetaI_00 1980 0.62 1.02 0.46 179 XMBrknScrpt_02 1974 0.75 1.54 0.46 180 XM_B_SpammyWords4 1895 0.94 2.28 0.44 181 HTML_IMAGE_ONLY_20 1804 0.55 0.90 0.42 182 FORGED_GMAIL_RCVD 1803 0.52 0.77 0.42 183 USER_IN_WELCOMELIST 1802 0.31 0.00 0.42 184 USER_IN_WHITELIST 1802 0.31 0.00 0.42 185 XM_B_DNDMA 1800 0.62 1.15 0.42 186 TO_NO_BRKTS_HTML_ONLY 1790 0.37 0.23 0.42 187 RELAYCOUNTRY_GB 1767 0.47 0.63 0.41 188 HTML_IMAGE_ONLY_28 1761 0.37 0.27 0.41 189 XMPhish14 1753 0.48 0.68 0.41 190 BASE64_LENGTH_79_INF 1752 0.34 0.16 0.41 191 HTML_IMAGE_ONLY_32 1737 0.33 0.15 0.41 192 PLING_QUERY 1668 0.52 0.89 0.39 193 XMLngstWrd_00 1661 0.40 0.42 0.39 194 XM_B_FormFill 1653 0.31 0.09 0.39 195 XMBody_17 1648 2.13 6.80 0.39 196 XMDateMe_00 1648 0.40 0.43 0.39 197 SpammyFromTLD_02 1626 0.68 1.47 0.38 198 MPART_ALT_DIFF_COUNT 1611 0.51 0.87 0.38 199 HTML_TAG_BALANCE_BODY 1604 0.74 1.72 0.37 200 LongTLD 1601 0.53 0.94 0.37 ----------------------------------------------------------------------