Email: 518713 Autolearn: 0 AvgScore: 4.24 AvgScanTime: 1.34 sec Spam: 165934 Autolearn: 0 AvgScore: 13.84 AvgScanTime: 1.45 sec Ham: 352779 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.29 sec Time Spent Running SA: 193.01 hours Time Spent Processing Spam: 66.79 hours Time Spent Processing Ham: 126.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158222 88.56 95.35 85.37 2 DKIM_SIGNED 148476 78.88 89.48 73.89 3 XM_B_Unicode 143789 74.26 86.65 68.44 4 XM_DK_Pass 142762 76.82 86.04 72.49 5 DKIM_VALID 141250 75.82 85.12 71.45 6 T_SCC_BODY_TEXT_LINE 135447 82.80 81.63 83.36 7 RELAYCOUNTRY_US 130769 79.40 78.81 79.68 8 XM_B_SpammyWords 124355 53.48 74.94 43.39 9 DCC_CHECK 123882 46.37 74.66 33.06 10 XMListUnsubscribeExists 122000 56.51 73.52 48.51 11 DKIM_VALID_AU 101688 58.52 61.28 57.22 12 XM_DK_Undo_02 77533 19.26 46.73 6.34 13 XM_B_Unicode3 77373 41.78 46.63 39.49 14 XM_B_SpammyWords2 71742 26.02 43.24 17.92 15 LOC_TINY_FONT_1 67543 29.61 40.70 24.39 16 BAYES_50 63982 51.77 38.56 57.98 17 TR_XM_DKIM_Undo 62919 13.82 37.92 2.48 18 BAYES_99 59237 14.99 35.70 5.25 19 HTML_FONT_LOW_CONTRAST 58657 28.98 35.35 25.99 20 MIME_HTML_ONLY 56262 22.90 33.91 17.72 21 DKIM_VALID_EF 55012 30.11 33.15 28.68 22 FVGT_m_MULTI_ODD 54405 27.81 32.79 25.47 23 T_KAM_HTML_FONT_INVALID 50848 24.22 30.64 21.21 24 BAYES_999 47220 11.95 28.46 4.19 25 TR_DCC_Bayes_99 44024 9.92 26.53 2.11 26 DCC_CHECK_NEGATIVE 42031 53.59 25.33 66.88 27 TR_XM_DK_Unsub 41804 17.16 25.19 13.38 28 RCVD_IN_MSPIKE_H2 37112 21.43 22.37 20.99 29 T_TM2_M_HEADER_IN_MSG 36862 26.97 22.21 29.20 30 XMSubLong 36301 22.50 21.88 22.79 31 RELAYCOUNTRY_META 35563 9.63 21.43 4.08 32 XM_Multi_Part_URI 32569 15.41 19.63 13.43 33 TR_XM_SpammyRelay 30231 7.26 18.22 2.10 34 RCVD_IN_BL_SPAMCOP_NET 27367 5.84 16.49 0.82 35 BOTNET_IPINHOSTNAME 25051 7.86 15.10 4.46 36 XM_B_Unsub 24911 10.14 15.01 7.84 37 LOTS_OF_MONEY 24247 9.16 14.61 6.60 38 TR_XM_BayesUnsub 23930 8.85 14.42 6.22 39 TR_XM_SpammyWords2 23276 4.86 14.03 0.54 40 TR_XM_SPAMCOP 23127 4.68 13.94 0.32 41 UNPARSEABLE_RELAY 22616 10.88 13.63 9.59 42 XM_B_SpammyWords3 21376 6.82 12.88 3.96 43 TR_XM_SpammyWords4 21207 7.21 12.78 4.59 44 RELAYCOUNTRY_CA 21119 4.83 12.73 1.11 45 XM_Body_Dirty_Words 21022 8.06 12.67 5.90 46 RCVD_IN_MSPIKE_WL 19899 8.35 11.99 6.64 47 RCVD_IN_MSPIKE_H3 19899 8.35 11.99 6.64 48 BOTNET 18304 4.39 11.03 1.26 49 BAYES_80 14816 5.70 8.93 4.17 50 FSL_BULK_SIG 14801 5.32 8.92 3.62 51 XM_Evil_Numbers_Gen 14666 8.02 8.84 7.63 52 BAYES_60 12710 8.67 7.66 9.14 53 TR_XM_UnparsRelay 11634 3.30 7.01 1.56 54 HTML_IMAGE_RATIO_02 11580 5.51 6.98 4.81 55 XMBody_17 11389 2.52 6.86 0.47 56 HTML_IMAGE_RATIO_04 11155 5.26 6.72 4.58 57 XM_UncommonTLD01 11042 4.66 6.65 3.72 58 LotsOfNums_01 10929 8.09 6.59 8.80 59 XMSubMetaSx_00 10488 4.74 6.32 3.99 60 UNTRUSTED_Relay 9368 2.82 5.65 1.50 61 XMSexyCombo_05 9314 2.87 5.61 1.58 62 TR_XM_BayesRelay 9165 1.77 5.52 0.00 63 MPART_ALT_DIFF 9063 4.85 5.46 4.56 64 XM_H_Long_From01 8690 5.38 5.24 5.45 65 BAYES_95 8660 3.40 5.22 2.54 66 TR_XM_SpammyWords5 8504 2.45 5.12 1.19 67 T_FILL_THIS_FORM_SHORT 8040 2.14 4.85 0.87 68 XM_B_Phish_Phrases 7780 3.69 4.69 3.22 69 TooManyTo_001 7493 7.21 4.52 8.47 70 DKIM_INVALID 7226 3.05 4.35 2.44 71 XM_H_GMP 6954 5.70 4.19 6.41 72 XM_OfRef6 6904 2.22 4.16 1.30 73 HTML_IMAGE_RATIO_06 6831 3.18 4.12 2.74 74 XM_SPF_SoftFail 6800 3.36 4.10 3.01 75 TR_XM_PhishingBody 6714 2.52 4.05 1.80 76 XM_B_Investor 6713 2.47 4.05 1.73 77 FONT_INVIS_LONG_LINE 6528 1.32 3.93 0.09 78 XMStrtUSub 6511 4.13 3.92 4.23 79 XM_B_SpammyTLD 6298 2.99 3.80 2.62 80 XMNumbers 6089 2.89 3.67 2.52 81 T_XMDrugObfuBody_08 5751 2.21 3.47 1.61 82 MIME_QP_LONG_LINE 5738 4.81 3.46 5.45 83 T_XMDrugObfuBody_14 5664 2.27 3.41 1.74 84 MIME_HTML_MOSTLY 5648 2.93 3.40 2.70 85 MIME_HTML_ONLY_MULTI 5567 2.64 3.35 2.31 86 TR_XM_FormFill 5527 1.07 3.33 0.01 87 HTML_IMAGE_RATIO_08 5397 2.51 3.25 2.16 88 SpammyFromTLD_01 5188 1.58 3.13 0.86 89 XMDiploma_00 5025 2.05 3.03 1.59 90 TM2_M_VERY_LONG_WORD 5017 1.85 3.02 1.29 91 RCVD_IN_VALIDITY_SAFE 5014 3.60 3.02 3.87 92 HK_RANDOM_REPLYTO 4800 0.98 2.89 0.07 93 TR_LOTS_OF_MONEY3 4791 1.11 2.89 0.28 94 XM_UB50 4775 1.56 2.88 0.94 95 SUBJ_ALL_CAPS 4751 1.86 2.86 1.39 96 TM2_M_URI_OPT_OUT 4469 2.21 2.69 1.98 97 XM_URI_RBL 4347 0.96 2.62 0.17 98 TR_Mismatch_TLD_02 4330 0.92 2.61 0.12 99 RCVD_IN_VALIDITY_CERTIFIED 3947 3.03 2.38 3.34 100 XM_B_Unsub2 3892 1.71 2.35 1.41 101 XM_B_SpammyWords4 3739 1.12 2.25 0.59 102 HTML_MIME_NO_HTML_TAG 3738 2.17 2.25 2.13 103 XM_CamelCaseFrm001 3706 2.20 2.23 2.18 104 T_TooManySym_01 3501 4.44 2.11 5.54 105 USER_IN_DEF_DKIM_WL 3406 8.63 2.05 11.72 106 TR_XM_NoHeaderRelay 3399 0.74 2.05 0.12 107 T_REMOTE_IMAGE 3367 3.08 2.03 3.57 108 RELAYCOUNTRY_AU 3283 1.15 1.98 0.75 109 FROM_EXCESS_BASE64 3099 1.84 1.87 1.82 110 URI_HEX 3032 1.39 1.83 1.18 111 T_XMDrugObfuBody_00 3004 1.11 1.81 0.79 112 XM_DK_Undo_01 2903 1.84 1.75 1.89 113 XM_DIRTYINTL 2858 0.73 1.72 0.26 114 XMStockSpam_06 2827 1.35 1.70 1.18 115 RCVD_IN_IADB_LISTED 2800 3.77 1.69 4.74 116 BOUNCE_MESSAGE 2765 3.85 1.67 4.87 117 ANY_BOUNCE_MESSAGE 2765 3.85 1.67 4.87 118 MAILING_LIST_MULTI 2760 2.44 1.66 2.80 119 XMGenDplmaNmb 2751 1.15 1.66 0.92 120 T_XMHurry_00 2707 0.82 1.63 0.43 121 SpammyFromTLD_02 2694 0.79 1.62 0.40 122 BAYES_40 2649 3.67 1.60 4.64 123 XMPhish30 2578 0.91 1.55 0.60 124 XM_H_Long_From02 2572 1.22 1.55 1.07 125 AC_BR_BONANZA 2533 0.53 1.53 0.07 126 HTML_TAG_BALANCE_BODY 2524 0.79 1.52 0.45 127 RCVD_IN_IADB_SPF 2522 3.36 1.52 4.23 128 DIET_1 2520 0.64 1.52 0.22 129 XM_HighProb1 2437 0.47 1.47 0.00 130 TR_XM_INV_DKIM 2422 0.50 1.46 0.05 131 URI_TRY_3LD 2415 0.89 1.46 0.63 132 XMBdyGiftCard01 2411 0.96 1.45 0.73 133 RCVD_IN_IADB_SENDERID 2398 3.09 1.45 3.86 134 RCVD_IN_IADB_DK 2384 3.01 1.44 3.75 135 TR_XM_PHPDW 2365 0.73 1.43 0.40 136 TR_Caps_n_Bayes_99 2339 0.48 1.41 0.04 137 XM_SendGrid 2334 1.35 1.41 1.32 138 TR_XM_PHPForged 2332 0.71 1.41 0.39 139 BOTNET_NORDNS 2314 0.45 1.39 0.01 140 TR_XM_FormFill2 2247 0.70 1.35 0.39 141 XM_H_PHPOS 2222 0.68 1.34 0.37 142 XMReplyNow 2218 0.58 1.34 0.22 143 ALL_TRUSTED 2193 12.12 1.32 17.19 144 TR_XM_InvalidRelay 2187 0.44 1.32 0.03 145 DKIM_ADSP_CUSTOM_MED 2144 1.00 1.29 0.86 146 URI_NOVOWEL 2143 1.87 1.29 2.14 147 XM_Combo_Sbj 2131 0.57 1.28 0.24 148 RCVD_IN_VALIDITY_RPBL 2105 0.44 1.27 0.04 149 XM_ProductURIs 2099 1.09 1.26 1.01 150 XMHTML_After_End 2060 0.91 1.24 0.75 151 KHOP_HELO_FCRDNS 2046 1.13 1.23 1.08 152 HTTPS_HTTP_MISMATCH 2021 0.90 1.22 0.76 153 FORGED_GMAIL_RCVD 1956 0.71 1.18 0.48 154 BAYES_20 1869 2.69 1.13 3.43 155 XMSexyCombo_01 1821 0.51 1.10 0.23 156 NML_ADSP_CUSTOM_MED 1753 0.74 1.06 0.59 157 XM_H_PHPMailer 1736 0.88 1.05 0.80 158 XM_B_Phish66 1639 0.54 0.99 0.33 159 XM_UB60 1631 0.35 0.98 0.06 160 XM_B_COVIDMETA 1619 0.51 0.98 0.29 161 XMSubMetaI_00 1614 0.70 0.97 0.58 162 RELAYCOUNTRY_RU 1583 0.32 0.95 0.02 163 NO_DNS_FOR_FROM 1562 0.46 0.94 0.24 164 XM_B_DNDMA 1542 0.50 0.93 0.29 165 TR_XM_MaxWHORU 1532 0.42 0.92 0.18 166 XMBody_78 1499 0.58 0.90 0.43 167 TR_Symld_Words 1480 1.39 0.89 1.62 168 PDS_OTHER_BAD_TLD 1478 0.37 0.89 0.12 169 XM_B_SEO 1468 0.37 0.88 0.13 170 XMSlimDrugH 1449 0.52 0.87 0.35 171 RCVD_IN_PSBL 1447 0.47 0.87 0.29 172 TR_LOTS_OF_MONEY2 1420 0.39 0.86 0.17 173 T_MONEY_PERCENT 1420 0.39 0.86 0.17 174 XMPhish14 1412 0.58 0.85 0.45 175 TR_MetaPhish_Combo_01 1402 0.72 0.84 0.66 176 TR_Mismatch_TLD_01 1393 0.46 0.84 0.29 177 T_XMDrugObfuBody_10 1376 0.29 0.83 0.03 178 XM_Nigeria_01 1364 0.32 0.82 0.08 179 XM_OfRef7 1350 0.35 0.81 0.13 180 TR_XM_DK_SendGrid 1342 0.84 0.81 0.85 181 THIS_AD 1340 0.49 0.81 0.34 182 XMMoneyMeta_00 1332 0.67 0.80 0.61 183 DKIM_ADSP_NXDOMAIN 1329 0.41 0.80 0.23 184 RDNS_DYNAMIC 1318 0.48 0.79 0.33 185 TM2_M_A_HREF_HREF 1317 0.39 0.79 0.20 186 TR_XM_COVIDMETA4 1307 0.34 0.79 0.13 187 TR_XM_SEO4 1302 0.30 0.78 0.07 188 HTML_FONT_FACE_BAD 1242 0.48 0.75 0.36 189 XMBSHREFv2 1242 1.17 0.75 1.37 190 XM_H_Undi_Recip 1231 0.38 0.74 0.21 191 XMHTMLBadTable_001 1219 0.45 0.73 0.32 192 SHOPIFY_IMG_NOT_RCVD_SFY 1206 0.45 0.73 0.31 193 XMBrknScrpt_02 1194 0.59 0.72 0.53 194 T_Symld_Words_02 1192 0.59 0.72 0.52 195 HOSTED_IMG_MULTI_PUB_01 1192 0.24 0.72 0.01 196 RELAYCOUNTRY_FR 1187 0.40 0.72 0.25 197 LOADSA_MONEY_COMBO 1174 0.26 0.71 0.05 198 TR_XM_Base64_M1 1171 0.60 0.71 0.56 199 RELAYCOUNTRY_GB 1166 0.62 0.70 0.58 200 TVD_RCVD_IP 1159 1.29 0.70 1.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301167 88.56 95.35 85.37 2 T_SCC_BODY_TEXT_LINE 294072 82.80 81.63 83.36 3 RELAYCOUNTRY_US 281091 79.40 78.81 79.68 4 DKIM_SIGNED 260660 78.88 89.48 73.89 5 XM_DK_Pass 255724 76.82 86.04 72.49 6 DKIM_VALID 252046 75.82 85.12 71.45 7 XM_B_Unicode 241426 74.26 86.65 68.44 8 DCC_CHECK_NEGATIVE 235947 53.59 25.33 66.88 9 BAYES_50 204548 51.77 38.56 57.98 10 DKIM_VALID_AU 201861 58.52 61.28 57.22 11 XMListUnsubscribeExists 171145 56.51 73.52 48.51 12 XM_B_SpammyWords 153069 53.48 74.94 43.39 13 XM_B_Unicode3 139327 41.78 46.63 39.49 14 DCC_CHECK 116636 46.37 74.66 33.06 15 T_TM2_M_HEADER_IN_MSG 103014 26.97 22.21 29.20 16 DKIM_VALID_EF 101170 30.11 33.15 28.68 17 HTML_FONT_LOW_CONTRAST 91679 28.98 35.35 25.99 18 FVGT_m_MULTI_ODD 89857 27.81 32.79 25.47 19 LOC_TINY_FONT_1 86035 29.61 40.70 24.39 20 XMSubLong 80402 22.50 21.88 22.79 21 T_KAM_HTML_FONT_INVALID 74807 24.22 30.64 21.21 22 RCVD_IN_MSPIKE_H2 74047 21.43 22.37 20.99 23 XM_B_SpammyWords2 63207 26.02 43.24 17.92 24 MIME_HTML_ONLY 62503 22.90 33.91 17.72 25 ALL_TRUSTED 60660 12.12 1.32 17.19 26 XM_Multi_Part_URI 47370 15.41 19.63 13.43 27 TR_XM_DK_Unsub 47202 17.16 25.19 13.38 28 USER_IN_DEF_DKIM_WL 41336 8.63 2.05 11.72 29 BAYES_00 35839 7.09 0.57 10.16 30 UNPARSEABLE_RELAY 33825 10.88 13.63 9.59 31 BAYES_60 32237 8.67 7.66 9.14 32 LotsOfNums_01 31047 8.09 6.59 8.80 33 TooManyTo_001 29886 7.21 4.52 8.47 34 XM_DKIMWhitelistDomains 28487 5.50 0.04 8.08 35 XM_B_Unsub 27664 10.14 15.01 7.84 36 XM_Evil_Numbers_Gen 26928 8.02 8.84 7.63 37 IN_ZIMBRA_NJ_WHITELIST 23916 4.65 0.11 6.78 38 TR_XM_DK_Bayes 23447 4.65 0.42 6.65 39 RCVD_IN_MSPIKE_H3 23407 8.35 11.99 6.64 40 RCVD_IN_MSPIKE_WL 23407 8.35 11.99 6.64 41 LOTS_OF_MONEY 23284 9.16 14.61 6.60 42 TR_XM_DK_Bayes1 23060 4.58 0.41 6.54 43 XM_H_GMP 22628 5.70 4.19 6.41 44 XM_DK_Undo_02 22370 19.26 46.73 6.34 45 TR_XM_BayesUnsub 21959 8.85 14.42 6.22 46 XM_Body_Dirty_Words 20812 8.06 12.67 5.90 47 TR_XM_DK_Bayes2 19983 3.96 0.32 5.66 48 T_TooManySym_01 19533 4.44 2.11 5.54 49 XM_H_Long_From01 19237 5.38 5.24 5.45 50 MIME_QP_LONG_LINE 19230 4.81 3.46 5.45 51 BAYES_99 18536 14.99 35.70 5.25 52 XM_PDF 17836 3.60 0.52 5.06 53 ANY_BOUNCE_MESSAGE 17183 3.85 1.67 4.87 54 BOUNCE_MESSAGE 17182 3.85 1.67 4.87 55 HTML_IMAGE_RATIO_02 16980 5.51 6.98 4.81 56 RCVD_IN_IADB_LISTED 16731 3.77 1.69 4.74 57 BAYES_40 16371 3.67 1.60 4.64 58 TR_XM_SpammyWords4 16206 7.21 12.78 4.59 59 HTML_IMAGE_RATIO_04 16150 5.26 6.72 4.58 60 MPART_ALT_DIFF 16090 4.85 5.46 4.56 61 BOTNET_IPINHOSTNAME 15732 7.86 15.10 4.46 62 RCVD_IN_IADB_SPF 14931 3.36 1.52 4.23 63 XMStrtUSub 14915 4.13 3.92 4.23 64 BAYES_999 14774 11.95 28.46 4.19 65 BAYES_80 14725 5.70 8.93 4.17 66 RELAYCOUNTRY_META 14399 9.63 21.43 4.08 67 XMSubMetaSx_00 14079 4.74 6.32 3.99 68 XM_B_SpammyWords3 13986 6.82 12.88 3.96 69 RCVD_IN_VALIDITY_SAFE 13643 3.60 3.02 3.87 70 RCVD_IN_IADB_SENDERID 13610 3.09 1.45 3.86 71 RCVD_IN_IADB_DK 13218 3.01 1.44 3.75 72 XM_UncommonTLD01 13110 4.66 6.65 3.72 73 FSL_BULK_SIG 12787 5.32 8.92 3.62 74 T_REMOTE_IMAGE 12611 3.08 2.03 3.57 75 BAYES_20 12086 2.69 1.13 3.43 76 RCVD_IN_VALIDITY_CERTIFIED 11788 3.03 2.38 3.34 77 XM_B_Phish_Phrases 11356 3.69 4.69 3.22 78 XM_SPF_SoftFail 10611 3.36 4.10 3.01 79 RCVD_IN_IADB_VOUCHED 10174 2.18 0.67 2.88 80 SCC_BODY_URI_ONLY 10169 2.16 0.63 2.88 81 MAILING_LIST_MULTI 9888 2.44 1.66 2.80 82 HTML_IMAGE_RATIO_06 9652 3.18 4.12 2.74 83 MIME_HTML_MOSTLY 9529 2.93 3.40 2.70 84 BAYES_05 9472 2.03 0.64 2.68 85 XM_B_SpammyTLD 9234 2.99 3.80 2.62 86 BAYES_95 8965 3.40 5.22 2.54 87 XMNumbers 8902 2.89 3.67 2.52 88 T_TooManySym_02 8842 1.88 0.56 2.51 89 TooManyTo_002 8772 1.87 0.57 2.49 90 TR_XM_DKIM_Undo 8762 13.82 37.92 2.48 91 DKIM_INVALID 8614 3.05 4.35 2.44 92 MIME_HTML_ONLY_MULTI 8143 2.64 3.35 2.31 93 XM_CamelCaseFrm001 7687 2.20 2.23 2.18 94 HTML_IMAGE_RATIO_08 7617 2.51 3.25 2.16 95 URI_NOVOWEL 7555 1.87 1.29 2.14 96 HTML_MIME_NO_HTML_TAG 7512 2.17 2.25 2.13 97 TR_DCC_Bayes_99 7444 9.92 26.53 2.11 98 TR_XM_SpammyRelay 7421 7.26 18.22 2.10 99 INVALID_MSGID 7315 1.45 0.11 2.07 100 TM2_M_URI_OPT_OUT 6983 2.21 2.69 1.98 101 HELO_NODOT 6900 1.51 0.58 1.96 102 HELO_NO_DOMAIN 6897 1.51 0.57 1.96 103 RCVD_IN_IADB_OPTIN 6680 1.42 0.42 1.89 104 XM_DK_Undo_01 6667 1.84 1.75 1.89 105 FROM_EXCESS_BASE64 6437 1.84 1.87 1.82 106 TR_XM_PhishingBody 6357 2.52 4.05 1.80 107 TO_MALFORMED 6146 1.19 0.00 1.74 108 T_XMDrugObfuBody_14 6128 2.27 3.41 1.74 109 XM_B_Investor 6111 2.47 4.05 1.73 110 TR_Symld_Words 5725 1.39 0.89 1.62 111 T_XMDrugObfuBody_08 5691 2.21 3.47 1.61 112 XMDiploma_00 5605 2.05 3.03 1.59 113 XMSexyCombo_05 5583 2.87 5.61 1.58 114 XMBody_95 5534 1.12 0.16 1.57 115 TVD_RCVD_IP 5534 1.29 0.70 1.57 116 TR_XM_UnparsRelay 5501 3.30 7.01 1.56 117 TooManyTo_003 5420 1.19 0.46 1.54 118 IN_HORDE_ADDRESS_BOOK 5373 1.05 0.06 1.52 119 UNTRUSTED_Relay 5282 2.82 5.65 1.50 120 XM_B_Unsub2 4990 1.71 2.35 1.41 121 SUBJ_ALL_CAPS 4914 1.86 2.86 1.39 122 XMBSHREFv2 4832 1.17 0.75 1.37 123 XM_SendGrid 4664 1.35 1.41 1.32 124 XM_OfRef6 4589 2.22 4.16 1.30 125 TM2_M_VERY_LONG_WORD 4557 1.85 3.02 1.29 126 BOTNET 4456 4.39 11.03 1.26 127 XM_GoogleGroups 4404 1.00 0.48 1.25 128 XMCapTrack 4239 0.92 0.34 1.20 129 TR_XM_SpammyWords5 4189 2.45 5.12 1.19 130 XMGappySubj_01 4176 0.88 0.24 1.18 131 URI_HEX 4174 1.39 1.83 1.18 132 XMStockSpam_06 4163 1.35 1.70 1.18 133 TVD_SPACE_RATIO 3974 0.80 0.11 1.13 134 TooManyTo_004 3937 0.89 0.42 1.12 135 RELAYCOUNTRY_CA 3926 4.83 12.73 1.11 136 KHOP_HELO_FCRDNS 3826 1.13 1.23 1.08 137 T_OBFU_PDF_ATTACH 3785 0.76 0.10 1.07 138 XM_H_Trusted_IP 3781 0.73 0.00 1.07 139 XM_H_Long_From02 3764 1.22 1.55 1.07 140 XM_ProductURIs 3560 1.09 1.26 1.01 141 XM_UB50 3317 1.56 2.88 0.94 142 XMSubNoVowel 3247 0.77 0.45 0.92 143 XMGenDplmaNmb 3233 1.15 1.66 0.92 144 TooManyTo_005 3229 0.75 0.38 0.92 145 T_TooManySym_03 3178 0.69 0.23 0.90 146 T_FILL_THIS_FORM_SHORT 3080 2.14 4.85 0.87 147 SpammyFromTLD_01 3025 1.58 3.13 0.86 148 DKIM_ADSP_CUSTOM_MED 3020 1.00 1.29 0.86 149 TR_XM_DK_SendGrid 2990 0.84 0.81 0.85 150 RCVD_IN_BL_SPAMCOP_NET 2904 5.84 16.49 0.82 151 XM_H_PHPMailer 2809 0.88 1.05 0.80 152 T_XMDrugObfuBody_00 2774 1.11 1.81 0.79 153 HTTPS_HTTP_MISMATCH 2668 0.90 1.22 0.76 154 RELAYCOUNTRY_AU 2660 1.15 1.98 0.75 155 XMHTML_After_End 2655 0.91 1.24 0.75 156 RCVD_IN_RP_SAFE 2649 0.73 0.68 0.75 157 XMBdyGiftCard01 2585 0.96 1.45 0.73 158 XMGappySubj_02 2407 0.50 0.11 0.68 159 MSGID_NOFQDN1 2382 0.46 0.01 0.68 160 FROM_GOV_DKIM_AU 2366 0.49 0.11 0.67 161 XM_ShortIntro_01 2359 0.62 0.51 0.67 162 TR_MetaPhish_Combo_01 2315 0.72 0.84 0.66 163 RCVD_IN_RP_CERTIFIED 2240 0.61 0.55 0.63 164 URI_TRY_3LD 2225 0.89 1.46 0.63 165 SHORT_HELO_AND_INLINE_IMAGE 2192 0.44 0.05 0.62 166 XMMoneyMeta_00 2141 0.67 0.80 0.61 167 XMPhish30 2127 0.91 1.55 0.60 168 NML_ADSP_CUSTOM_MED 2091 0.74 1.06 0.59 169 XM_B_SpammyWords4 2068 1.12 2.25 0.59 170 RELAYCOUNTRY_GB 2062 0.62 0.70 0.58 171 FILL_THIS_FORM 2056 0.61 0.66 0.58 172 XMNoVowels 2044 0.55 0.48 0.58 173 XMSubMetaI_00 2035 0.70 0.97 0.58 174 XMSubMetaSxObfu_03 1974 0.59 0.67 0.56 175 TR_XM_Base64_M1 1967 0.60 0.71 0.56 176 XM_B_COPY_HTML 1961 0.59 0.65 0.56 177 TR_XM_SpammyWords2 1919 4.86 14.03 0.54 178 XMBrknScrpt_02 1884 0.59 0.72 0.53 179 T_Symld_Words_02 1844 0.59 0.72 0.52 180 HTML_IMAGE_ONLY_28 1752 0.48 0.46 0.50 181 USER_IN_WHITELIST 1713 0.33 0.00 0.49 182 USER_IN_WELCOMELIST 1713 0.33 0.00 0.49 183 FORGED_GMAIL_RCVD 1708 0.71 1.18 0.48 184 XMSubMetaSxObfu_02 1687 0.43 0.33 0.48 185 XMLngstWrd_00 1681 0.43 0.33 0.48 186 XMBody_17 1664 2.52 6.86 0.47 187 HTML_IMAGE_ONLY_20 1649 0.42 0.33 0.47 188 MPART_ALT_DIFF_COUNT 1622 0.53 0.69 0.46 189 XMPhish14 1603 0.58 0.85 0.45 190 HTML_TAG_BALANCE_BODY 1579 0.79 1.52 0.45 191 T_XMHurry_00 1532 0.82 1.63 0.43 192 XMDateMe_00 1526 0.46 0.51 0.43 193 XMBody_78 1515 0.58 0.90 0.43 194 HTML_IMAGE_ONLY_32 1449 0.33 0.17 0.41 195 MISSING_HEADERS 1446 0.45 0.52 0.41 196 SpammyFromTLD_02 1423 0.79 1.62 0.40 197 XMLngstWrd_01 1423 0.36 0.28 0.40 198 RCVD_IN_SORBS_DUL 1409 0.29 0.04 0.40 199 TR_XM_PHPDW 1399 0.73 1.43 0.40 200 TO_NO_BRKTS_HTML_ONLY 1374 0.32 0.16 0.39 ----------------------------------------------------------------------