Email: 495191 Autolearn: 0 AvgScore: 4.23 AvgScanTime: 1.42 sec Spam: 163572 Autolearn: 0 AvgScore: 14.09 AvgScanTime: 1.53 sec Ham: 331619 Autolearn: 0 AvgScore: -0.63 AvgScanTime: 1.36 sec Time Spent Running SA: 194.95 hours Time Spent Processing Spam: 69.52 hours Time Spent Processing Ham: 125.43 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156476 88.50 95.66 84.97 2 DKIM_SIGNED 142991 77.66 87.42 72.84 3 XM_DK_Pass 138403 75.84 84.61 71.51 4 XM_B_Unicode 137085 73.62 83.81 68.60 5 DKIM_VALID 136350 74.75 83.36 70.50 6 T_SCC_BODY_TEXT_LINE 133419 82.68 81.57 83.22 7 RELAYCOUNTRY_US 125089 78.71 76.47 79.82 8 DCC_CHECK 122953 46.90 75.17 32.96 9 XM_B_SpammyWords 119920 52.45 73.31 42.15 10 XMListUnsubscribeExists 114809 55.75 70.19 48.62 11 DKIM_VALID_AU 96374 57.40 58.92 56.65 12 XM_DK_Undo_02 77347 19.67 47.29 6.04 13 XM_B_Unicode3 73921 42.29 45.19 40.85 14 XM_B_SpammyWords2 68675 25.61 41.98 17.54 15 BAYES_50 62530 51.69 38.23 58.33 16 LOC_TINY_FONT_1 62337 29.03 38.11 24.56 17 TR_XM_DKIM_Undo 61431 13.99 37.56 2.37 18 BAYES_99 61092 16.16 37.35 5.71 19 MIME_HTML_ONLY 58849 24.46 35.98 18.78 20 HTML_FONT_LOW_CONTRAST 55018 29.05 33.64 26.79 21 DKIM_VALID_EF 52548 28.98 32.13 27.43 22 FVGT_m_MULTI_ODD 51676 27.32 31.59 25.21 23 BAYES_999 48627 12.98 29.73 4.71 24 T_KAM_HTML_FONT_INVALID 46191 23.20 28.24 20.71 25 TR_DCC_Bayes_99 45647 10.36 27.91 1.71 26 DCC_CHECK_NEGATIVE 40598 53.07 24.82 67.00 27 TR_XM_DK_Unsub 39059 16.49 23.88 12.84 28 RELAYCOUNTRY_META 38645 10.50 23.63 4.03 29 T_TM2_M_HEADER_IN_MSG 38545 26.83 23.56 28.44 30 XMSubLong 37220 23.15 22.75 23.34 31 RCVD_IN_MSPIKE_H2 35633 21.36 21.78 21.16 32 TR_XM_SpammyRelay 31539 7.68 19.28 1.96 33 XM_Multi_Part_URI 30511 14.77 18.65 12.85 34 RCVD_IN_BL_SPAMCOP_NET 25813 5.75 15.78 0.80 35 XM_B_Unsub 25634 10.56 15.67 8.04 36 BOTNET_IPINHOSTNAME 25556 8.34 15.62 4.75 37 TR_XM_BayesUnsub 24652 9.27 15.07 6.40 38 TR_XM_SpammyWords2 23591 5.09 14.42 0.48 39 RELAYCOUNTRY_CA 22124 5.28 13.53 1.22 40 TR_XM_SPAMCOP 21483 4.56 13.13 0.33 41 XM_Body_Dirty_Words 21419 8.57 13.09 6.34 42 UNPARSEABLE_RELAY 20856 10.65 12.75 9.62 43 LOTS_OF_MONEY 20543 8.19 12.56 6.03 44 XM_B_SpammyWords3 20158 6.74 12.32 3.99 45 RCVD_IN_MSPIKE_H3 18941 8.07 11.58 6.34 46 RCVD_IN_MSPIKE_WL 18941 8.07 11.58 6.34 47 FSL_BULK_SIG 18903 6.14 11.56 3.46 48 TR_XM_SpammyWords4 17503 6.10 10.70 3.83 49 BOTNET 17370 4.34 10.62 1.25 50 XM_Evil_Numbers_Gen 14234 7.96 8.70 7.60 51 BAYES_80 13658 5.32 8.35 3.82 52 UNTRUSTED_Relay 11790 3.38 7.21 1.48 53 TR_XM_UnparsRelay 11542 3.31 7.06 1.46 54 BAYES_60 11297 8.08 6.91 8.66 55 HTML_IMAGE_RATIO_02 11058 5.49 6.76 4.86 56 TR_XM_PhishingBody 11029 3.65 6.74 2.13 57 XM_UncommonTLD01 10515 4.71 6.43 3.86 58 LotsOfNums_01 10344 7.68 6.32 8.35 59 XMSexyCombo_05 10193 3.54 6.23 2.21 60 XMBody_17 10005 2.33 6.12 0.46 61 MPART_ALT_DIFF 9448 4.61 5.78 4.04 62 XMSubMetaSx_00 9151 4.48 5.59 3.94 63 XM_B_Phish_Phrases 8826 4.10 5.40 3.46 64 TR_XM_SpammyWords5 8620 2.61 5.27 1.30 65 HTML_IMAGE_RATIO_04 8581 4.64 5.25 4.33 66 XM_H_Long_From01 8487 5.14 5.19 5.11 67 BAYES_95 8274 3.45 5.06 2.65 68 TR_XM_BayesRelay 8015 1.62 4.90 0.00 69 XMStrtUSub 7840 4.50 4.79 4.36 70 T_FILL_THIS_FORM_SHORT 7828 2.16 4.79 0.86 71 TooManyTo_001 7809 7.54 4.77 8.90 72 XM_B_Investor 7505 2.62 4.59 1.64 73 XM_UB50 7283 2.05 4.45 0.86 74 HTML_IMAGE_RATIO_06 7168 3.02 4.38 2.35 75 XMNumbers 7144 3.26 4.37 2.71 76 XM_H_GMP 7005 5.42 4.28 5.98 77 XM_OfRef6 6999 2.17 4.28 1.13 78 HK_RANDOM_REPLYTO 6815 1.43 4.17 0.08 79 DKIM_INVALID 6641 2.91 4.06 2.34 80 XM_B_SpammyTLD 6205 3.00 3.79 2.61 81 MIME_HTML_ONLY_MULTI 6158 2.79 3.76 2.31 82 T_XMDrugObfuBody_14 6080 2.28 3.72 1.57 83 TM2_M_URI_OPT_OUT 5767 2.74 3.53 2.36 84 MIME_HTML_MOSTLY 5721 2.81 3.50 2.47 85 HTML_IMAGE_RATIO_08 5653 2.50 3.46 2.02 86 RCVD_IN_VALIDITY_RPBL 5499 1.16 3.36 0.07 87 XM_SPF_SoftFail 5331 2.99 3.26 2.86 88 RCVD_IN_VALIDITY_SAFE 5306 4.18 3.24 4.65 89 TR_XM_FormFill 5200 1.05 3.18 0.01 90 T_XMDrugObfuBody_08 5005 2.08 3.06 1.59 91 SpammyFromTLD_01 4985 1.56 3.05 0.83 92 FONT_INVIS_LONG_LINE 4890 1.02 2.99 0.05 93 USER_IN_DEF_DKIM_WL 4792 9.16 2.93 12.24 94 TM2_M_VERY_LONG_WORD 4779 1.84 2.92 1.31 95 XMPhish11 4767 1.02 2.91 0.08 96 RELAYCOUNTRY_JP 4651 0.96 2.84 0.02 97 MIME_HEADER_CTYPE_ONLY 4617 1.00 2.82 0.10 98 RELAYCOUNTRY_RO 4553 0.92 2.78 0.01 99 RCVD_IN_VALIDITY_CERTIFIED 4486 3.67 2.74 4.13 100 MIME_QP_LONG_LINE 4438 4.46 2.71 5.33 101 URIBL_DBL_ABUSE_SPAM 4364 0.89 2.67 0.01 102 XM_URI_RBL 4243 0.96 2.59 0.16 103 SUBJ_ALL_CAPS 4236 1.74 2.59 1.32 104 RELAYCOUNTRY_AU 4051 1.25 2.48 0.64 105 XMDiploma_00 4021 1.68 2.46 1.30 106 HTML_MIME_NO_HTML_TAG 4010 2.15 2.45 2.00 107 XM_B_SpammyWords4 3988 1.13 2.44 0.48 108 T_TooManySym_01 3938 4.62 2.41 5.71 109 FROM_EXCESS_BASE64 3913 2.27 2.39 2.21 110 TR_MetaPhish_Combo_01b 3728 0.89 2.28 0.21 111 TR_Mismatch_TLD_02 3693 0.81 2.26 0.09 112 TR_MetaPhish_Combo_01 3600 1.26 2.20 0.80 113 XM_CamelCaseFrm001 3571 2.19 2.18 2.19 114 XM_B_Unsub2 3486 1.67 2.13 1.45 115 TR_LOTS_OF_MONEY3 3401 0.96 2.08 0.41 116 XM_DIRTYINTL 3294 0.82 2.01 0.23 117 T_XMHurry_00 3014 0.88 1.84 0.40 118 MAILING_LIST_MULTI 2894 2.41 1.77 2.73 119 BAYES_40 2864 3.68 1.75 4.63 120 XMBdyGiftCard01 2780 1.02 1.70 0.68 121 XMStockSpam_06 2761 1.37 1.69 1.21 122 AC_BR_BONANZA 2716 0.63 1.66 0.13 123 T_REMOTE_IMAGE 2690 2.93 1.64 3.57 124 TR_XM_INV_DKIM 2667 0.57 1.63 0.05 125 TR_XM_PHPForged 2638 0.78 1.61 0.36 126 TR_XM_PHPDW 2616 0.78 1.60 0.38 127 TR_XM_NoHeaderRelay 2612 0.60 1.60 0.11 128 URI_HEX 2595 1.17 1.59 0.97 129 TR_XM_SB_Phish 2566 0.65 1.57 0.20 130 ANY_BOUNCE_MESSAGE 2529 3.59 1.55 4.59 131 BOUNCE_MESSAGE 2525 3.59 1.54 4.59 132 XMSubPhish11 2510 0.61 1.53 0.15 133 TR_XM_FormFill2 2510 0.75 1.53 0.36 134 RCVD_IN_PSBL 2486 0.70 1.52 0.29 135 XM_H_PHPOS 2481 0.73 1.52 0.35 136 BOTNET_NORDNS 2470 0.51 1.51 0.01 137 SpammyFromTLD_02 2447 0.87 1.50 0.57 138 HTML_TAG_BALANCE_BODY 2446 0.77 1.50 0.42 139 TR_XM_SpoofStaff 2440 0.58 1.49 0.13 140 URG_BIZ 2417 0.55 1.48 0.10 141 XMSpoofStaff2 2414 0.58 1.48 0.13 142 XM_H_SpoofStaff4 2348 0.57 1.44 0.14 143 TR_XM_PSC1 2347 0.56 1.43 0.13 144 TR_XM_SpoofStaff2 2320 0.47 1.42 0.00 145 XM_HighProb1 2317 0.47 1.42 0.00 146 ALL_TRUSTED 2304 11.90 1.41 17.07 147 XM_H_Undi_Recip 2302 0.59 1.41 0.19 148 URI_PHISH 2282 0.48 1.40 0.02 149 URI_TRY_3LD 2271 0.93 1.39 0.70 150 RCVD_IN_IADB_LISTED 2264 3.52 1.38 4.57 151 TR_Email_Ref 2254 0.46 1.38 0.00 152 XMSexyCombo_01 2228 0.63 1.36 0.27 153 T_XMDrugObfuBody_00 2189 0.85 1.34 0.61 154 XMPhish30 2160 1.12 1.32 1.02 155 XM_DK_Undo_01 2145 1.75 1.31 1.96 156 XM_SendGrid 2121 1.27 1.30 1.26 157 RCVD_IN_IADB_SPF 2043 3.17 1.25 4.11 158 XM_OfRef7 2040 0.56 1.25 0.22 159 XMGenDplmaNmb 2024 0.87 1.24 0.69 160 XM_B_COVIDMETA 1985 0.60 1.21 0.29 161 XM_S_SpammyWords 1953 0.52 1.19 0.19 162 TR_XM_Spammywords 1953 0.52 1.19 0.19 163 RCVD_IN_IADB_SENDERID 1935 2.90 1.18 3.74 164 RCVD_IN_IADB_DK 1925 2.84 1.18 3.66 165 T_PDS_FROM_2_EMAILS 1912 0.39 1.17 0.00 166 DIET_1 1903 0.63 1.16 0.36 167 XMPhish08 1874 0.53 1.15 0.22 168 T_XMDrugObfuBody_10 1866 0.40 1.14 0.03 169 BAYES_20 1853 2.57 1.13 3.28 170 LongTLD 1821 0.60 1.11 0.35 171 HTTPS_HTTP_MISMATCH 1811 0.82 1.11 0.68 172 XMReplyNow 1804 0.58 1.10 0.32 173 TR_XM_Undi_Recip5 1753 0.36 1.07 0.01 174 TR_Caps_n_Bayes_99 1692 0.35 1.03 0.01 175 XMBrknScrpt_02 1692 0.60 1.03 0.39 176 XMSlimDrugH 1691 0.57 1.03 0.35 177 XM_H_PHPMailer 1673 0.84 1.02 0.76 178 URI_NOVOWEL 1647 1.56 1.01 1.83 179 UNDISC_MONEY 1632 0.34 1.00 0.01 180 TR_Mismatch_TLD_01 1607 0.51 0.98 0.28 181 XM_B_COPY_HTML 1601 0.70 0.98 0.56 182 XM_H_Long_From02 1596 1.01 0.98 1.02 183 TM2_M_A_HREF_HREF 1588 0.47 0.97 0.23 184 KHOP_HELO_FCRDNS 1570 1.14 0.96 1.22 185 TR_XM_Base64_M1 1537 0.67 0.94 0.54 186 XM_Body_Dirty_Words_01 1487 0.37 0.91 0.10 187 XM_ProductURIs 1486 0.76 0.91 0.68 188 TM2_M_OBFU_COMMENT 1447 0.46 0.88 0.25 189 T_XMDrugObfuBody_12 1428 0.37 0.87 0.12 190 RDNS_DYNAMIC 1428 0.54 0.87 0.38 191 THIS_AD 1417 0.51 0.87 0.34 192 PDS_OTHER_BAD_TLD 1394 0.40 0.85 0.18 193 DKIM_ADSP_CUSTOM_MED 1393 0.85 0.85 0.84 194 XM_B_Phish66 1376 0.48 0.84 0.30 195 TR_XM_DK_SendGrid 1366 0.83 0.84 0.83 196 MILLION_USD 1366 0.28 0.84 0.00 197 SHOPIFY_IMG_NOT_RCVD_SFY 1359 0.48 0.83 0.30 198 XMBody_78 1323 0.50 0.81 0.34 199 TR_Symld_Words 1317 1.24 0.81 1.45 200 XM_UB60 1302 0.31 0.80 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 281767 88.50 95.66 84.97 2 T_SCC_BODY_TEXT_LINE 275986 82.68 81.57 83.22 3 RELAYCOUNTRY_US 264693 78.71 76.47 79.82 4 DKIM_SIGNED 241567 77.66 87.42 72.84 5 XM_DK_Pass 237155 75.84 84.61 71.51 6 DKIM_VALID 233801 74.75 83.36 70.50 7 XM_B_Unicode 227497 73.62 83.81 68.60 8 DCC_CHECK_NEGATIVE 222182 53.07 24.82 67.00 9 BAYES_50 193431 51.69 38.23 58.33 10 DKIM_VALID_AU 187851 57.40 58.92 56.65 11 XMListUnsubscribeExists 161243 55.75 70.19 48.62 12 XM_B_SpammyWords 139784 52.45 73.31 42.15 13 XM_B_Unicode3 135481 42.29 45.19 40.85 14 DCC_CHECK 109289 46.90 75.17 32.96 15 T_TM2_M_HEADER_IN_MSG 94312 26.83 23.56 28.44 16 DKIM_VALID_EF 90966 28.98 32.13 27.43 17 HTML_FONT_LOW_CONTRAST 88843 29.05 33.64 26.79 18 FVGT_m_MULTI_ODD 83601 27.32 31.59 25.21 19 LOC_TINY_FONT_1 81433 29.03 38.11 24.56 20 XMSubLong 77394 23.15 22.75 23.34 21 RCVD_IN_MSPIKE_H2 70161 21.36 21.78 21.16 22 T_KAM_HTML_FONT_INVALID 68692 23.20 28.24 20.71 23 MIME_HTML_ONLY 62268 24.46 35.98 18.78 24 XM_B_SpammyWords2 58158 25.61 41.98 17.54 25 ALL_TRUSTED 56623 11.90 1.41 17.07 26 XM_Multi_Part_URI 42624 14.77 18.65 12.85 27 TR_XM_DK_Unsub 42589 16.49 23.88 12.84 28 USER_IN_DEF_DKIM_WL 40581 9.16 2.93 12.24 29 BAYES_00 33990 7.09 0.68 10.25 30 UNPARSEABLE_RELAY 31900 10.65 12.75 9.62 31 TooManyTo_001 29513 7.54 4.77 8.90 32 BAYES_60 28726 8.08 6.91 8.66 33 LotsOfNums_01 27675 7.68 6.32 8.35 34 XM_B_Unsub 26675 10.56 15.67 8.04 35 XM_DKIMWhitelistDomains 25654 5.18 0.01 7.74 36 XM_Evil_Numbers_Gen 25201 7.96 8.70 7.60 37 TR_XM_DK_Bayes 23599 4.93 0.49 7.12 38 TR_XM_DK_Bayes1 23076 4.82 0.48 6.96 39 IN_ZIMBRA_NJ_WHITELIST 22935 4.66 0.09 6.92 40 TR_XM_BayesUnsub 21236 9.27 15.07 6.40 41 XM_Body_Dirty_Words 21040 8.57 13.09 6.34 42 RCVD_IN_MSPIKE_WL 21038 8.07 11.58 6.34 43 RCVD_IN_MSPIKE_H3 21037 8.07 11.58 6.34 44 TR_XM_DK_Bayes2 20105 4.16 0.30 6.06 45 XM_DK_Undo_02 20045 19.67 47.29 6.04 46 LOTS_OF_MONEY 20007 8.19 12.56 6.03 47 XM_H_GMP 19830 5.42 4.28 5.98 48 BAYES_99 18949 16.16 37.35 5.71 49 T_TooManySym_01 18926 4.62 2.41 5.71 50 MIME_QP_LONG_LINE 17667 4.46 2.71 5.33 51 XM_PDF 17457 3.66 0.41 5.26 52 XM_H_Long_From01 16954 5.14 5.19 5.11 53 HTML_IMAGE_RATIO_02 16105 5.49 6.76 4.86 54 BOTNET_IPINHOSTNAME 15765 8.34 15.62 4.75 55 BAYES_999 15635 12.98 29.73 4.71 56 RCVD_IN_VALIDITY_SAFE 15406 4.18 3.24 4.65 57 BAYES_40 15361 3.68 1.75 4.63 58 BOUNCE_MESSAGE 15236 3.59 1.54 4.59 59 ANY_BOUNCE_MESSAGE 15236 3.59 1.55 4.59 60 RCVD_IN_IADB_LISTED 15165 3.52 1.38 4.57 61 XMStrtUSub 14445 4.50 4.79 4.36 62 HTML_IMAGE_RATIO_04 14375 4.64 5.25 4.33 63 RCVD_IN_VALIDITY_CERTIFIED 13705 3.67 2.74 4.13 64 RCVD_IN_IADB_SPF 13640 3.17 1.25 4.11 65 MPART_ALT_DIFF 13391 4.61 5.78 4.04 66 RELAYCOUNTRY_META 13358 10.50 23.63 4.03 67 XM_B_SpammyWords3 13231 6.74 12.32 3.99 68 XMSubMetaSx_00 13058 4.48 5.59 3.94 69 XM_UncommonTLD01 12785 4.71 6.43 3.86 70 TR_XM_SpammyWords4 12716 6.10 10.70 3.83 71 BAYES_80 12669 5.32 8.35 3.82 72 RCVD_IN_IADB_SENDERID 12415 2.90 1.18 3.74 73 RCVD_IN_IADB_DK 12129 2.84 1.18 3.66 74 T_REMOTE_IMAGE 11833 2.93 1.64 3.57 75 XM_B_Phish_Phrases 11486 4.10 5.40 3.46 76 FSL_BULK_SIG 11480 6.14 11.56 3.46 77 BAYES_20 10880 2.57 1.13 3.28 78 XM_SPF_SoftFail 9497 2.99 3.26 2.86 79 MAILING_LIST_MULTI 9056 2.41 1.77 2.73 80 XMNumbers 9002 3.26 4.37 2.71 81 RCVD_IN_IADB_VOUCHED 8948 1.98 0.53 2.70 82 BAYES_05 8811 1.96 0.55 2.66 83 BAYES_95 8801 3.45 5.06 2.65 84 SCC_BODY_URI_ONLY 8684 2.01 0.77 2.62 85 XM_B_SpammyTLD 8671 3.00 3.79 2.61 86 TooManyTo_002 8662 1.94 0.57 2.61 87 T_TooManySym_02 8447 1.90 0.59 2.55 88 MIME_HTML_MOSTLY 8178 2.81 3.50 2.47 89 TR_XM_DKIM_Undo 7853 13.99 37.56 2.37 90 TM2_M_URI_OPT_OUT 7820 2.74 3.53 2.36 91 HTML_IMAGE_RATIO_06 7794 3.02 4.38 2.35 92 DKIM_INVALID 7766 2.91 4.06 2.34 93 MIME_HTML_ONLY_MULTI 7659 2.79 3.76 2.31 94 XMSexyCombo_05 7340 3.54 6.23 2.21 95 FROM_EXCESS_BASE64 7323 2.27 2.39 2.21 96 XM_CamelCaseFrm001 7254 2.19 2.18 2.19 97 INVALID_MSGID 7159 1.48 0.11 2.16 98 TR_XM_PhishingBody 7047 3.65 6.74 2.13 99 HTML_IMAGE_RATIO_08 6715 2.50 3.46 2.02 100 HTML_MIME_NO_HTML_TAG 6639 2.15 2.45 2.00 101 XM_H_Trusted_IP 6634 1.34 0.00 2.00 102 XM_DK_Undo_01 6511 1.75 1.31 1.96 103 TR_XM_SpammyRelay 6491 7.68 19.28 1.96 104 RCVD_IN_IADB_OPTIN 6229 1.38 0.37 1.88 105 TO_MALFORMED 6162 1.25 0.01 1.86 106 URI_NOVOWEL 6077 1.56 1.01 1.83 107 TR_DCC_Bayes_99 5665 10.36 27.91 1.71 108 TVD_RCVD_IP 5574 1.36 0.71 1.68 109 HELO_NODOT 5479 1.29 0.55 1.65 110 HELO_NO_DOMAIN 5474 1.29 0.55 1.65 111 XM_B_Investor 5453 2.62 4.59 1.64 112 T_XMDrugObfuBody_08 5271 2.08 3.06 1.59 113 IN_HORDE_ADDRESS_BOOK 5236 1.23 0.52 1.58 114 T_XMDrugObfuBody_14 5206 2.28 3.72 1.57 115 XMSubNoVowel 5165 1.23 0.58 1.56 116 UNTRUSTED_Relay 4923 3.38 7.21 1.48 117 TooManyTo_003 4913 1.15 0.47 1.48 118 TR_XM_UnparsRelay 4856 3.31 7.06 1.46 119 TR_Symld_Words 4811 1.24 0.81 1.45 120 T_OBFU_PDF_ATTACH 4803 1.00 0.08 1.45 121 XM_B_Unsub2 4799 1.67 2.13 1.45 122 XMGappySubj_01 4762 1.02 0.17 1.44 123 SUBJ_ALL_CAPS 4386 1.74 2.59 1.32 124 TM2_M_VERY_LONG_WORD 4332 1.84 2.92 1.31 125 TR_XM_SpammyWords5 4323 2.61 5.27 1.30 126 XMDiploma_00 4308 1.68 2.46 1.30 127 XMBSHREFv2 4283 1.02 0.48 1.29 128 XM_GoogleGroups 4211 1.00 0.44 1.27 129 XM_SendGrid 4162 1.27 1.30 1.26 130 BOTNET 4131 4.34 10.62 1.25 131 KHOP_HELO_FCRDNS 4059 1.14 0.96 1.22 132 RELAYCOUNTRY_CA 4040 5.28 13.53 1.22 133 XMStockSpam_06 4025 1.37 1.69 1.21 134 XMBody_95 3983 0.85 0.13 1.20 135 TVD_SPACE_RATIO 3889 0.82 0.09 1.17 136 XM_OfRef6 3760 2.17 4.28 1.13 137 TooManyTo_004 3546 0.86 0.43 1.07 138 XMCapTrack 3512 0.82 0.35 1.06 139 XMPhish30 3383 1.12 1.32 1.02 140 XM_H_Long_From02 3382 1.01 0.98 1.02 141 URI_HEX 3208 1.17 1.59 0.97 142 RCVD_IN_RP_SAFE 3013 0.82 0.65 0.91 143 TooManyTo_005 2922 0.71 0.38 0.88 144 T_TooManySym_03 2914 0.66 0.23 0.88 145 XM_UB50 2862 2.05 4.45 0.86 146 T_FILL_THIS_FORM_SHORT 2849 2.16 4.79 0.86 147 DKIM_ADSP_CUSTOM_MED 2795 0.85 0.85 0.84 148 SpammyFromTLD_01 2759 1.56 3.05 0.83 149 TR_XM_DK_SendGrid 2744 0.83 0.84 0.83 150 RCVD_IN_RP_CERTIFIED 2722 0.73 0.55 0.82 151 XMGappySubj_02 2681 0.56 0.06 0.81 152 TR_MetaPhish_Combo_01 2648 1.26 2.20 0.80 153 RCVD_IN_BL_SPAMCOP_NET 2644 5.75 15.78 0.80 154 FROM_GOV_DKIM_AU 2551 0.56 0.14 0.77 155 XM_H_PHPMailer 2507 0.84 1.02 0.76 156 MSGID_NOFQDN1 2375 0.48 0.01 0.72 157 URI_TRY_3LD 2330 0.93 1.39 0.70 158 XMGenDplmaNmb 2286 0.87 1.24 0.69 159 XMBdyGiftCard01 2260 1.02 1.70 0.68 160 XM_ProductURIs 2258 0.76 0.91 0.68 161 HTTPS_HTTP_MISMATCH 2257 0.82 1.11 0.68 162 XMNoVowels 2207 0.60 0.47 0.67 163 RELAYCOUNTRY_AU 2136 1.25 2.48 0.64 164 XM_RXBody 2084 0.61 0.58 0.63 165 XMHTML_After_End 2058 0.67 0.76 0.62 166 T_XMDrugObfuBody_00 2030 0.85 1.34 0.61 167 XM_ShortIntro_01 2024 0.54 0.41 0.61 168 FILL_THIS_FORM 1919 0.59 0.63 0.58 169 SpammyFromTLD_02 1875 0.87 1.50 0.57 170 XM_B_COPY_HTML 1867 0.70 0.98 0.56 171 USER_IN_WELCOMELIST 1863 0.38 0.00 0.56 172 USER_IN_WHITELIST 1863 0.38 0.00 0.56 173 XM_B_FormFill 1809 0.38 0.06 0.55 174 TR_XM_Base64_M1 1791 0.67 0.94 0.54 175 NML_ADSP_CUSTOM_MED 1782 0.55 0.59 0.54 176 SHORT_HELO_AND_INLINE_IMAGE 1731 0.36 0.04 0.52 177 FORGED_GMAIL_RCVD 1722 0.60 0.76 0.52 178 RELAYCOUNTRY_GB 1702 0.51 0.50 0.51 179 XMPhish14 1684 0.53 0.59 0.51 180 XMSubMetaI_00 1640 0.59 0.77 0.49 181 T_Symld_Words_02 1637 0.57 0.73 0.49 182 XMSubMetaSxObfu_02 1608 0.44 0.35 0.48 183 TR_XM_SpammyWords2 1595 5.09 14.42 0.48 184 XM_B_SpammyWords4 1588 1.13 2.44 0.48 185 MPART_ALT_DIFF_COUNT 1554 0.56 0.74 0.47 186 XMLngstWrd_00 1530 0.44 0.40 0.46 187 HTML_IMAGE_ONLY_20 1529 0.44 0.39 0.46 188 XMBody_17 1510 2.33 6.12 0.46 189 TO_NO_BRKTS_HTML_ONLY 1504 0.35 0.14 0.45 190 HTML_IMAGE_ONLY_28 1497 0.48 0.54 0.45 191 HTML_TAG_BALANCE_BODY 1385 0.77 1.50 0.42 192 PLING_QUERY 1377 0.46 0.54 0.42 193 TR_LOTS_OF_MONEY3 1346 0.96 2.08 0.41 194 T_XMHurry_00 1329 0.88 1.84 0.40 195 MISSING_HEADERS 1312 0.44 0.53 0.40 196 TM2_M_BODY_EMPTY 1303 0.29 0.09 0.39 197 XMBrknScrpt_02 1295 0.60 1.03 0.39 198 XMMoneyMeta_00 1290 0.44 0.54 0.39 199 SUBJ_DOLLARS 1286 0.51 0.77 0.39 200 XMSubMetaSxObfu_03 1283 0.46 0.60 0.39 ----------------------------------------------------------------------