Email: 498325 Autolearn: 0 AvgScore: 4.02 AvgScanTime: 1.26 sec Spam: 155978 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 1.33 sec Ham: 342347 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 1.23 sec Time Spent Running SA: 174.67 hours Time Spent Processing Spam: 57.71 hours Time Spent Processing Ham: 116.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148393 87.75 95.14 84.39 2 DKIM_SIGNED 137009 77.38 87.84 72.62 3 XM_B_Unicode 135312 72.78 86.75 66.41 4 XM_DK_Pass 131635 75.24 84.39 71.07 5 DKIM_VALID 129900 74.17 83.28 70.02 6 T_SCC_BODY_TEXT_LINE 127225 82.56 81.57 83.02 7 RELAYCOUNTRY_US 118321 78.77 75.86 80.10 8 XM_B_SpammyWords 113903 51.73 73.03 42.03 9 DCC_CHECK 113660 43.58 72.87 30.24 10 XMListUnsubscribeExists 112721 54.10 72.27 45.82 11 DKIM_VALID_AU 92420 57.02 59.25 56.01 12 XM_B_Unicode3 73236 40.53 46.95 37.60 13 XM_DK_Undo_02 72923 18.61 46.75 5.79 14 XM_B_SpammyWords2 65490 24.87 41.99 17.06 15 TR_XM_DKIM_Undo 59363 13.41 38.06 2.18 16 LOC_TINY_FONT_1 59091 27.48 37.88 22.75 17 BAYES_99 58380 14.86 37.43 4.57 18 BAYES_50 56968 51.45 36.52 58.26 19 MIME_HTML_ONLY 55416 23.79 35.53 18.44 20 HTML_FONT_LOW_CONTRAST 52722 28.40 33.80 25.94 21 DKIM_VALID_EF 52468 30.47 33.64 29.02 22 FVGT_m_MULTI_ODD 47881 26.73 30.70 24.93 23 BAYES_999 46428 11.71 29.77 3.49 24 T_KAM_HTML_FONT_INVALID 43560 22.04 27.93 19.36 25 DCC_CHECK_NEGATIVE 42304 56.38 27.12 69.71 26 TR_DCC_Bayes_99 42143 9.50 27.02 1.51 27 TR_XM_DK_Unsub 39165 16.78 25.11 12.99 28 RELAYCOUNTRY_META 37445 10.17 24.01 3.87 29 XMSubLong 36459 23.32 23.37 23.29 30 T_TM2_M_HEADER_IN_MSG 36378 28.79 23.32 31.29 31 RCVD_IN_MSPIKE_H2 33211 21.88 21.29 22.15 32 TR_XM_SpammyRelay 30040 7.31 19.26 1.86 33 XM_Multi_Part_URI 28694 14.66 18.40 12.96 34 RCVD_IN_BL_SPAMCOP_NET 25353 5.52 16.25 0.63 35 BOTNET_IPINHOSTNAME 23396 7.74 15.00 4.43 36 TR_XM_SpammyWords2 22970 4.88 14.73 0.40 37 RELAYCOUNTRY_CA 22897 5.30 14.68 1.03 38 XM_B_Unsub 22349 10.28 14.33 8.43 39 RCVD_IN_MSPIKE_WL 21880 8.80 14.03 6.41 40 RCVD_IN_MSPIKE_H3 21880 8.80 14.03 6.41 41 TR_XM_BayesUnsub 21814 8.91 13.99 6.59 42 TR_XM_SPAMCOP 21122 4.42 13.54 0.26 43 LOTS_OF_MONEY 19341 7.92 12.40 5.88 44 UNPARSEABLE_RELAY 19293 10.98 12.37 10.34 45 XM_Body_Dirty_Words 18946 7.81 12.15 5.83 46 XM_B_SpammyWords3 18171 6.03 11.65 3.47 47 BOTNET 16776 4.30 10.76 1.36 48 TR_XM_SpammyWords4 16583 6.13 10.63 4.07 49 BAYES_80 13512 5.41 8.66 3.92 50 XM_Evil_Numbers_Gen 13294 7.96 8.52 7.70 51 FSL_BULK_SIG 13206 4.77 8.47 3.08 52 BAYES_60 11721 8.27 7.51 8.61 53 XMBody_17 11283 2.56 7.23 0.43 54 XM_UncommonTLD01 11044 4.99 7.08 4.04 55 LotsOfNums_01 10531 7.75 6.75 8.21 56 TR_XM_UnparsRelay 10516 3.30 6.74 1.73 57 TR_XM_BayesRelay 10216 2.05 6.55 0.00 58 UNTRUSTED_Relay 9800 3.01 6.28 1.52 59 XMSexyCombo_05 9474 3.19 6.07 1.88 60 XMSubMetaSx_00 9327 4.43 5.98 3.72 61 HTML_IMAGE_RATIO_02 9218 5.27 5.91 4.97 62 T_FILL_THIS_FORM_SHORT 9047 2.55 5.80 1.07 63 HTML_IMAGE_RATIO_04 8393 4.27 5.38 3.76 64 TR_XM_SpammyWords5 8389 2.60 5.38 1.33 65 TooManyTo_001 8297 8.34 5.32 9.72 66 MPART_ALT_DIFF 8259 4.03 5.29 3.45 67 BAYES_95 8217 3.42 5.27 2.57 68 XM_SPF_SoftFail 7831 3.93 5.02 3.44 69 XM_B_Phish_Phrases 7596 3.90 4.87 3.46 70 XM_H_Long_From01 7125 5.12 4.57 5.38 71 DKIM_INVALID 7109 3.21 4.56 2.60 72 XM_B_Investor 6978 2.46 4.47 1.55 73 TR_XM_PhishingBody 6644 2.52 4.26 1.72 74 XM_H_GMP 6516 5.83 4.18 6.58 75 HTML_IMAGE_RATIO_06 6429 2.85 4.12 2.27 76 XMNumbers 6427 3.22 4.12 2.81 77 TR_XM_FormFill 6351 1.31 4.07 0.05 78 FONT_INVIS_LONG_LINE 6228 1.29 3.99 0.06 79 SpammyFromTLD_01 6067 1.87 3.89 0.95 80 XMStrtUSub 6014 4.23 3.86 4.39 81 HK_RANDOM_REPLYTO 5836 1.22 3.74 0.08 82 XM_B_SpammyTLD 5719 2.81 3.67 2.42 83 T_XMDrugObfuBody_14 5614 2.59 3.60 2.13 84 XM_OfRef6 5327 1.79 3.42 1.06 85 HTML_IMAGE_RATIO_08 5252 2.67 3.37 2.35 86 MIME_HTML_MOSTLY 5210 2.56 3.34 2.21 87 RCVD_IN_VALIDITY_SAFE 5127 3.85 3.29 4.11 88 SUBJ_ALL_CAPS 5087 2.13 3.26 1.61 89 XMDiploma_00 4983 2.07 3.19 1.55 90 MIME_HTML_ONLY_MULTI 4936 2.41 3.16 2.07 91 T_XMDrugObfuBody_08 4820 2.03 3.09 1.54 92 TR_Mismatch_TLD_02 4718 1.04 3.02 0.13 93 TM2_M_URI_OPT_OUT 4533 2.29 2.91 2.00 94 XM_URI_RBL 4499 1.00 2.88 0.14 95 XM_UB50 4419 1.51 2.83 0.91 96 TM2_M_VERY_LONG_WORD 4399 1.72 2.82 1.22 97 MIME_QP_LONG_LINE 4294 4.19 2.75 4.84 98 RCVD_IN_VALIDITY_CERTIFIED 4257 3.25 2.73 3.49 99 USER_IN_DEF_DKIM_WL 4080 8.52 2.62 11.21 100 XM_B_SpammyWords4 3900 1.22 2.50 0.63 101 TR_LOTS_OF_MONEY3 3873 1.11 2.48 0.48 102 XM_CamelCaseFrm001 3705 1.99 2.38 1.81 103 DIET_1 3347 0.90 2.15 0.33 104 T_TooManySym_01 3346 4.77 2.15 5.96 105 HTML_MIME_NO_HTML_TAG 3340 2.08 2.14 2.05 106 XM_B_Unsub2 3329 1.68 2.13 1.47 107 XM_DIRTYINTL 3265 0.85 2.09 0.28 108 XM_B_COPY_HTML 3242 1.06 2.08 0.59 109 RELAYCOUNTRY_AU 3242 1.07 2.08 0.61 110 ANY_BOUNCE_MESSAGE 3103 3.70 1.99 4.48 111 RCVD_IN_VALIDITY_RPBL 3077 0.66 1.97 0.05 112 BOUNCE_MESSAGE 3060 3.69 1.96 4.47 113 TR_XM_InvalidRelay 3057 0.63 1.96 0.02 114 URI_HEX 3048 1.25 1.95 0.92 115 TR_XM_PHPForged 2987 1.03 1.92 0.63 116 TR_XM_PHPDW 2945 1.03 1.89 0.63 117 T_XMHurry_00 2884 1.05 1.85 0.69 118 TR_XM_FormFill2 2870 1.00 1.84 0.62 119 XM_H_PHPOS 2848 0.98 1.83 0.60 120 RELAYCOUNTRY_JP 2720 0.57 1.74 0.03 121 BAYES_40 2687 3.92 1.72 4.92 122 TR_XM_NoHeaderRelay 2641 0.59 1.69 0.09 123 TR_XM_INV_DKIM 2613 0.56 1.68 0.05 124 TR_Caps_n_Bayes_99 2599 0.54 1.67 0.03 125 FROM_EXCESS_BASE64 2543 1.75 1.63 1.80 126 MAILING_LIST_MULTI 2497 2.47 1.60 2.87 127 BOTNET_NORDNS 2466 0.50 1.58 0.01 128 T_REMOTE_IMAGE 2453 3.17 1.57 3.90 129 KHOP_HELO_FCRDNS 2448 1.54 1.57 1.53 130 SpammyFromTLD_02 2383 0.67 1.53 0.27 131 URI_TRY_3LD 2343 0.83 1.50 0.53 132 XMReplyNow 2339 0.66 1.50 0.28 133 XM_H_Undi_Recip 2332 0.71 1.50 0.36 134 HTML_TAG_BALANCE_BODY 2317 0.76 1.49 0.43 135 XMBdyGiftCard01 2242 0.81 1.44 0.52 136 XM_HighProb1 2233 0.45 1.43 0.00 137 XM_DK_Undo_01 2233 1.84 1.43 2.03 138 RCVD_IN_IADB_LISTED 2230 3.33 1.43 4.19 139 XMBrknScrpt_02 2191 0.77 1.40 0.48 140 XMSexyCombo_01 2184 0.67 1.40 0.33 141 T_XMDrugObfuBody_00 2180 0.94 1.40 0.73 142 ALL_TRUSTED 2173 12.10 1.39 16.98 143 AC_BR_BONANZA 2156 0.48 1.38 0.08 144 HTTPS_HTTP_MISMATCH 2106 1.08 1.35 0.96 145 XM_B_DNDMA 2094 0.65 1.34 0.33 146 BAYES_20 2087 2.88 1.34 3.59 147 RDNS_DYNAMIC 2072 0.72 1.33 0.45 148 XMPhish30 2056 0.80 1.32 0.57 149 TR_XM_SpoofStaff 2054 0.51 1.32 0.14 150 XMSpoofStaff2 2041 0.50 1.31 0.14 151 RCVD_IN_IADB_SPF 2000 2.97 1.28 3.73 152 MIME_HEADER_CTYPE_ONLY 1980 0.48 1.27 0.12 153 XM_B_COVIDMETA 1960 0.64 1.26 0.36 154 TR_XM_SpoofStaff2 1903 0.38 1.22 0.00 155 RCVD_IN_IADB_DK 1900 2.67 1.22 3.33 156 XMStockSpam_06 1897 1.20 1.22 1.19 157 RCVD_IN_IADB_SENDERID 1873 2.71 1.20 3.40 158 RELAYCOUNTRY_RO 1835 0.38 1.18 0.02 159 XMGenDplmaNmb 1832 0.97 1.17 0.87 160 URIBL_DBL_ABUSE_SPAM 1821 0.37 1.17 0.01 161 URI_NOVOWEL 1821 1.61 1.17 1.81 162 XM_SendGrid 1819 1.31 1.17 1.38 163 XMHTML_After_End 1819 0.95 1.17 0.86 164 XM_H_PHPMailer 1777 0.93 1.14 0.84 165 T_MONEY_PERCENT 1753 0.50 1.12 0.21 166 TR_LOTS_OF_MONEY2 1753 0.50 1.12 0.21 167 MPART_ALT_DIFF_COUNT 1735 0.70 1.11 0.51 168 TR_MetaPhish_Combo_01 1733 0.75 1.11 0.59 169 XMSubMetaI_00 1704 0.96 1.09 0.89 170 XM_Combo_Sbj 1619 0.46 1.04 0.20 171 T_XMDrugObfuBody_10 1603 0.33 1.03 0.02 172 XM_B_Phish66 1591 0.54 1.02 0.33 173 PDS_OTHER_BAD_TLD 1585 0.44 1.02 0.18 174 TR_XM_Undi_Recip5 1572 0.33 1.01 0.02 175 PLING_QUERY 1571 0.62 1.01 0.44 176 XMPhish14 1559 0.69 1.00 0.54 177 XMSubMetaSxObfu_03 1539 0.64 0.99 0.48 178 XM_UB60 1537 0.36 0.99 0.07 179 XMSlimDrugH 1484 0.55 0.95 0.36 180 LOADSA_MONEY_COMBO 1453 0.33 0.93 0.05 181 UNDISC_MONEY 1428 0.30 0.92 0.02 182 TR_Symld_Words 1387 1.38 0.89 1.60 183 XM_ProductURIs 1358 0.92 0.87 0.94 184 TM2_M_A_HREF_HREF 1342 0.42 0.86 0.22 185 BAYES_00 1322 7.64 0.85 10.74 186 XM_H_Long_From02 1318 0.95 0.84 0.99 187 XMLngstWrd_00 1317 0.77 0.84 0.73 188 HTML_FONT_FACE_BAD 1306 0.52 0.84 0.37 189 DKIM_ADSP_CUSTOM_MED 1295 0.84 0.83 0.85 190 XM_UB99 1289 0.26 0.83 0.00 191 XFER_LOTSA_MONEY 1270 0.28 0.81 0.04 192 TR_XM_Undi_Recip2 1264 0.28 0.81 0.03 193 HTML_FONT_TINY_NORDNS 1263 0.34 0.81 0.12 194 TM2_M_OBFU_COMMENT 1239 0.38 0.79 0.20 195 TVD_RCVD_IP 1229 1.40 0.79 1.68 196 RELAYCOUNTRY_GB 1192 0.58 0.76 0.50 197 SCC_BODY_URI_ONLY 1170 1.99 0.75 2.55 198 RCVD_IN_RP_SAFE 1166 0.80 0.75 0.82 199 T_TooManySym_02 1164 2.12 0.75 2.75 200 TR_XM_Base64_M1 1159 0.63 0.74 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 288895 87.75 95.14 84.39 2 T_SCC_BODY_TEXT_LINE 284200 82.56 81.57 83.02 3 RELAYCOUNTRY_US 274224 78.77 75.86 80.10 4 DKIM_SIGNED 248616 77.38 87.84 72.62 5 XM_DK_Pass 243316 75.24 84.39 71.07 6 DKIM_VALID 239708 74.17 83.28 70.02 7 DCC_CHECK_NEGATIVE 238667 56.38 27.12 69.71 8 XM_B_Unicode 227366 72.78 86.75 66.41 9 BAYES_50 199440 51.45 36.52 58.26 10 DKIM_VALID_AU 191745 57.02 59.25 56.01 11 XMListUnsubscribeExists 156854 54.10 72.27 45.82 12 XM_B_SpammyWords 143891 51.73 73.03 42.03 13 XM_B_Unicode3 128716 40.53 46.95 37.60 14 T_TM2_M_HEADER_IN_MSG 107109 28.79 23.32 31.29 15 DCC_CHECK 103520 43.58 72.87 30.24 16 DKIM_VALID_EF 99348 30.47 33.64 29.02 17 HTML_FONT_LOW_CONTRAST 88817 28.40 33.80 25.94 18 FVGT_m_MULTI_ODD 85346 26.73 30.70 24.93 19 XMSubLong 79737 23.32 23.37 23.29 20 LOC_TINY_FONT_1 77873 27.48 37.88 22.75 21 RCVD_IN_MSPIKE_H2 75814 21.88 21.29 22.15 22 T_KAM_HTML_FONT_INVALID 66267 22.04 27.93 19.36 23 MIME_HTML_ONLY 63132 23.79 35.53 18.44 24 XM_B_SpammyWords2 58421 24.87 41.99 17.06 25 ALL_TRUSTED 58123 12.10 1.39 16.98 26 TR_XM_DK_Unsub 44454 16.78 25.11 12.99 27 XM_Multi_Part_URI 44374 14.66 18.40 12.96 28 USER_IN_DEF_DKIM_WL 38390 8.52 2.62 11.21 29 BAYES_00 36752 7.64 0.85 10.74 30 UNPARSEABLE_RELAY 35415 10.98 12.37 10.34 31 TooManyTo_001 33274 8.34 5.32 9.72 32 BAYES_60 29484 8.27 7.51 8.61 33 XM_B_Unsub 28862 10.28 14.33 8.43 34 LotsOfNums_01 28096 7.75 6.75 8.21 35 XM_DKIMWhitelistDomains 27026 5.45 0.07 7.89 36 XM_Evil_Numbers_Gen 26365 7.96 8.52 7.70 37 TR_XM_DK_Bayes 24069 4.97 0.45 7.03 38 TR_XM_DK_Bayes1 23620 4.88 0.44 6.90 39 IN_ZIMBRA_NJ_WHITELIST 23078 4.67 0.12 6.74 40 TR_XM_BayesUnsub 22567 8.91 13.99 6.59 41 XM_H_GMP 22533 5.83 4.18 6.58 42 RCVD_IN_MSPIKE_H3 21960 8.80 14.03 6.41 43 RCVD_IN_MSPIKE_WL 21960 8.80 14.03 6.41 44 T_TooManySym_01 20407 4.77 2.15 5.96 45 TR_XM_DK_Bayes2 20203 4.15 0.29 5.90 46 LOTS_OF_MONEY 20132 7.92 12.40 5.88 47 XM_Body_Dirty_Words 19974 7.81 12.15 5.83 48 XM_DK_Undo_02 19824 18.61 46.75 5.79 49 XM_H_Long_From01 18404 5.12 4.57 5.38 50 HTML_IMAGE_RATIO_02 17019 5.27 5.91 4.97 51 XM_PDF 16861 3.57 0.58 4.93 52 BAYES_40 16827 3.92 1.72 4.92 53 MIME_QP_LONG_LINE 16566 4.19 2.75 4.84 54 BAYES_99 15647 14.86 37.43 4.57 55 ANY_BOUNCE_MESSAGE 15345 3.70 1.99 4.48 56 BOUNCE_MESSAGE 15310 3.69 1.96 4.47 57 BOTNET_IPINHOSTNAME 15178 7.74 15.00 4.43 58 XMStrtUSub 15046 4.23 3.86 4.39 59 RCVD_IN_IADB_LISTED 14352 3.33 1.43 4.19 60 RCVD_IN_VALIDITY_SAFE 14080 3.85 3.29 4.11 61 TR_XM_SpammyWords4 13946 6.13 10.63 4.07 62 XM_UncommonTLD01 13819 4.99 7.08 4.04 63 BAYES_80 13423 5.41 8.66 3.92 64 T_REMOTE_IMAGE 13354 3.17 1.57 3.90 65 RELAYCOUNTRY_META 13252 10.17 24.01 3.87 66 HTML_IMAGE_RATIO_04 12862 4.27 5.38 3.76 67 RCVD_IN_IADB_SPF 12786 2.97 1.28 3.73 68 XMSubMetaSx_00 12749 4.43 5.98 3.72 69 BAYES_20 12279 2.88 1.34 3.59 70 BAYES_999 11945 11.71 29.77 3.49 71 RCVD_IN_VALIDITY_CERTIFIED 11931 3.25 2.73 3.49 72 XM_B_SpammyWords3 11866 6.03 11.65 3.47 73 XM_B_Phish_Phrases 11854 3.90 4.87 3.46 74 MPART_ALT_DIFF 11805 4.03 5.29 3.45 75 XM_SPF_SoftFail 11769 3.93 5.02 3.44 76 RCVD_IN_IADB_SENDERID 11636 2.71 1.20 3.40 77 RCVD_IN_IADB_DK 11395 2.67 1.22 3.33 78 TooManyTo_002 10852 2.40 0.69 3.17 79 FSL_BULK_SIG 10544 4.77 8.47 3.08 80 MAILING_LIST_MULTI 9834 2.47 1.60 2.87 81 BAYES_05 9686 2.16 0.69 2.83 82 XMNumbers 9613 3.22 4.12 2.81 83 T_TooManySym_02 9401 2.12 0.75 2.75 84 DKIM_INVALID 8908 3.21 4.56 2.60 85 BAYES_95 8808 3.42 5.27 2.57 86 SCC_BODY_URI_ONLY 8741 1.99 0.75 2.55 87 RCVD_IN_IADB_VOUCHED 8671 1.93 0.60 2.53 88 XM_B_SpammyTLD 8291 2.81 3.67 2.42 89 HTML_IMAGE_RATIO_08 8034 2.67 3.37 2.35 90 HTML_IMAGE_RATIO_06 7766 2.85 4.12 2.27 91 MIME_HTML_MOSTLY 7564 2.56 3.34 2.21 92 TR_XM_DKIM_Undo 7463 13.41 38.06 2.18 93 T_XMDrugObfuBody_14 7280 2.59 3.60 2.13 94 HELO_NODOT 7266 1.67 0.69 2.12 95 HELO_NO_DOMAIN 7263 1.67 0.68 2.12 96 MIME_HTML_ONLY_MULTI 7091 2.41 3.16 2.07 97 INVALID_MSGID 7067 1.45 0.10 2.06 98 HTML_MIME_NO_HTML_TAG 7005 2.08 2.14 2.05 99 XM_DK_Undo_01 6960 1.84 1.43 2.03 100 TM2_M_URI_OPT_OUT 6855 2.29 2.91 2.00 101 XMSexyCombo_05 6425 3.19 6.07 1.88 102 TR_XM_SpammyRelay 6375 7.31 19.26 1.86 103 XM_CamelCaseFrm001 6209 1.99 2.38 1.81 104 URI_NOVOWEL 6197 1.61 1.17 1.81 105 FROM_EXCESS_BASE64 6155 1.75 1.63 1.80 106 TO_MALFORMED 6137 1.23 0.01 1.79 107 TooManyTo_003 5983 1.37 0.55 1.75 108 RCVD_IN_IADB_OPTIN 5924 1.31 0.39 1.73 109 TR_XM_UnparsRelay 5914 3.30 6.74 1.73 110 TR_XM_PhishingBody 5893 2.52 4.26 1.72 111 TVD_RCVD_IP 5756 1.40 0.79 1.68 112 SUBJ_ALL_CAPS 5514 2.13 3.26 1.61 113 TR_Symld_Words 5489 1.38 0.89 1.60 114 XMDiploma_00 5323 2.07 3.19 1.55 115 XM_B_Investor 5305 2.46 4.47 1.55 116 T_XMDrugObfuBody_08 5272 2.03 3.09 1.54 117 KHOP_HELO_FCRDNS 5247 1.54 1.57 1.53 118 UNTRUSTED_Relay 5219 3.01 6.28 1.52 119 TR_DCC_Bayes_99 5174 9.50 27.02 1.51 120 XMGappySubj_01 5157 1.08 0.15 1.51 121 IN_HORDE_ADDRESS_BOOK 5134 1.06 0.08 1.50 122 XM_B_Unsub2 5031 1.68 2.13 1.47 123 XM_SendGrid 4729 1.31 1.17 1.38 124 XMCapTrack 4667 1.07 0.41 1.36 125 BOTNET 4643 4.30 10.76 1.36 126 TR_XM_SpammyWords5 4547 2.60 5.38 1.33 127 TooManyTo_004 4508 1.06 0.50 1.32 128 XM_GoogleGroups 4424 1.04 0.50 1.29 129 TM2_M_VERY_LONG_WORD 4187 1.72 2.82 1.22 130 XMBSHREFv2 4170 0.95 0.37 1.22 131 TVD_SPACE_RATIO 4163 0.88 0.15 1.22 132 XMStockSpam_06 4088 1.20 1.22 1.19 133 XMBody_95 3805 0.82 0.17 1.11 134 TooManyTo_005 3751 0.90 0.46 1.10 135 XMGappySubj_02 3741 0.77 0.07 1.09 136 T_FILL_THIS_FORM_SHORT 3673 2.55 5.80 1.07 137 XM_OfRef6 3612 1.79 3.42 1.06 138 RELAYCOUNTRY_CA 3524 5.30 14.68 1.03 139 XM_H_Long_From02 3406 0.95 0.84 0.99 140 HTTPS_HTTP_MISMATCH 3285 1.08 1.35 0.96 141 TR_XM_DK_SendGrid 3279 0.88 0.72 0.96 142 T_TooManySym_03 3278 0.75 0.30 0.96 143 SpammyFromTLD_01 3239 1.87 3.89 0.95 144 XM_ProductURIs 3220 0.92 0.87 0.94 145 URI_HEX 3161 1.25 1.95 0.92 146 XM_UB50 3126 1.51 2.83 0.91 147 XMSubMetaI_00 3057 0.96 1.09 0.89 148 XMNoVowels 3024 0.74 0.44 0.88 149 XMGenDplmaNmb 2979 0.97 1.17 0.87 150 XMHTML_After_End 2940 0.95 1.17 0.86 151 DKIM_ADSP_CUSTOM_MED 2908 0.84 0.83 0.85 152 XM_ShortIntro_01 2899 0.74 0.50 0.85 153 XM_H_PHPMailer 2859 0.93 1.14 0.84 154 RCVD_IN_RP_SAFE 2796 0.80 0.75 0.82 155 XM_B_FormFill 2655 0.57 0.11 0.78 156 T_XMDrugObfuBody_00 2507 0.94 1.40 0.73 157 XMLngstWrd_00 2499 0.77 0.84 0.73 158 XM_H_Trusted_IP 2448 0.49 0.00 0.72 159 RCVD_IN_RP_CERTIFIED 2444 0.67 0.57 0.71 160 T_XMHurry_00 2353 1.05 1.85 0.69 161 SHORT_HELO_AND_INLINE_IMAGE 2348 0.49 0.06 0.69 162 FILL_THIS_FORM 2331 0.59 0.40 0.68 163 MSGID_NOFQDN1 2315 0.47 0.01 0.68 164 T_OBFU_PDF_ATTACH 2243 0.47 0.08 0.66 165 XM_B_SpammyWords4 2164 1.22 2.50 0.63 166 TR_XM_PHPDW 2163 1.03 1.89 0.63 167 RCVD_IN_BL_SPAMCOP_NET 2161 5.52 16.25 0.63 168 TR_XM_PHPForged 2146 1.03 1.92 0.63 169 TR_XM_FormFill2 2117 1.00 1.84 0.62 170 RELAYCOUNTRY_AU 2078 1.07 2.08 0.61 171 XM_H_PHPOS 2051 0.98 1.83 0.60 172 FROM_GOV_DKIM_AU 2035 0.44 0.09 0.59 173 TR_MetaPhish_Combo_01 2024 0.75 1.11 0.59 174 XM_B_COPY_HTML 2020 1.06 2.08 0.59 175 XM_RXBody 2016 0.53 0.41 0.59 176 TR_XM_Base64_M1 1991 0.63 0.74 0.58 177 XMSubNoVowel 1984 0.51 0.35 0.58 178 NML_ADSP_CUSTOM_MED 1983 0.61 0.67 0.58 179 XMPhish30 1939 0.80 1.32 0.57 180 HTML_IMAGE_ONLY_32 1872 0.42 0.15 0.55 181 XMPhish14 1861 0.69 1.00 0.54 182 URI_TRY_3LD 1803 0.83 1.50 0.53 183 XMMoneyMeta_00 1794 0.52 0.51 0.52 184 XMBdyGiftCard01 1793 0.81 1.44 0.52 185 USER_IN_WHITELIST 1792 0.36 0.00 0.52 186 USER_IN_WELCOMELIST 1792 0.36 0.00 0.52 187 XMSubMetaSxObfu_02 1750 0.48 0.42 0.51 188 MPART_ALT_DIFF_COUNT 1733 0.70 1.11 0.51 189 RCVD_IN_SORBS_DUL 1730 0.36 0.05 0.51 190 TM2_M_BODY_EMPTY 1719 0.40 0.17 0.50 191 HTML_IMAGE_ONLY_20 1717 0.46 0.38 0.50 192 RELAYCOUNTRY_GB 1705 0.58 0.76 0.50 193 XMBrknScrpt_02 1651 0.77 1.40 0.48 194 TO_NO_BRKTS_HTML_ONLY 1644 0.42 0.28 0.48 195 TR_LOTS_OF_MONEY3 1638 1.11 2.48 0.48 196 XMSubMetaSxObfu_03 1633 0.64 0.99 0.48 197 MISSING_HEADERS 1622 0.54 0.68 0.47 198 HTML_IMAGE_ONLY_28 1572 0.39 0.25 0.46 199 RDNS_DYNAMIC 1526 0.72 1.33 0.45 200 PLING_QUERY 1496 0.62 1.01 0.44 ----------------------------------------------------------------------