Email: 523151 Autolearn: 0 AvgScore: 4.29 AvgScanTime: 1.38 sec Spam: 170262 Autolearn: 0 AvgScore: 13.65 AvgScanTime: 1.50 sec Ham: 352889 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 1.32 sec Time Spent Running SA: 200.82 hours Time Spent Processing Spam: 70.98 hours Time Spent Processing Ham: 129.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164323 89.27 96.51 85.78 2 DKIM_SIGNED 153548 79.62 90.18 74.52 3 XM_DK_Pass 147520 77.55 86.64 73.17 4 XM_B_Unicode 146972 75.24 86.32 69.89 5 DKIM_VALID 144755 76.32 85.02 72.12 6 T_SCC_BODY_TEXT_LINE 138781 82.66 81.51 83.22 7 RELAYCOUNTRY_US 136091 80.23 79.93 80.37 8 DCC_CHECK 127527 48.03 74.90 35.07 9 XMListUnsubscribeExists 123972 57.69 72.81 50.39 10 XM_B_SpammyWords 123192 53.69 72.35 44.68 11 DKIM_VALID_AU 104672 58.57 61.48 57.16 12 XM_B_Unicode3 80053 42.75 47.02 40.70 13 XM_DK_Undo_02 77785 19.23 45.69 6.46 14 XM_B_SpammyWords2 72824 26.58 42.77 18.77 15 LOC_TINY_FONT_1 71899 30.48 42.23 24.81 16 BAYES_50 67279 52.47 39.51 58.73 17 HTML_FONT_LOW_CONTRAST 63092 30.74 37.06 27.69 18 TR_XM_DKIM_Undo 60944 13.50 35.79 2.74 19 BAYES_99 57801 14.31 33.95 4.83 20 FVGT_m_MULTI_ODD 56779 28.29 33.35 25.85 21 DKIM_VALID_EF 56545 29.54 33.21 27.76 22 MIME_HTML_ONLY 55653 23.06 32.69 18.41 23 T_KAM_HTML_FONT_INVALID 50148 23.91 29.45 21.24 24 BAYES_999 45256 11.12 26.58 3.66 25 TR_DCC_Bayes_99 42779 9.50 25.13 1.96 26 DCC_CHECK_NEGATIVE 42715 51.93 25.09 64.88 27 XMSubLong 42528 24.15 24.98 23.75 28 TR_XM_DK_Unsub 41846 16.90 24.58 13.19 29 RCVD_IN_MSPIKE_H2 40566 22.88 23.83 22.43 30 T_TM2_M_HEADER_IN_MSG 37906 25.92 22.26 27.68 31 XM_Multi_Part_URI 34256 15.21 20.12 12.84 32 RELAYCOUNTRY_META 33378 9.08 19.60 4.01 33 TR_XM_SpammyRelay 27211 6.70 15.98 2.22 34 BOTNET_IPINHOSTNAME 26836 8.14 15.76 4.46 35 XM_B_Unsub 26716 10.83 15.69 8.48 36 UNPARSEABLE_RELAY 25969 11.88 15.25 10.26 37 TR_XM_BayesUnsub 25956 9.37 15.24 6.54 38 RCVD_IN_BL_SPAMCOP_NET 25400 5.58 14.92 1.08 39 XM_B_SpammyWords3 23826 7.53 13.99 4.41 40 TR_XM_SpammyWords2 23241 4.85 13.65 0.60 41 XM_Body_Dirty_Words 21952 8.40 12.89 6.24 42 LOTS_OF_MONEY 21151 8.12 12.42 6.05 43 TR_XM_SPAMCOP 20630 4.17 12.12 0.34 44 RELAYCOUNTRY_CA 19350 4.41 11.36 1.05 45 BOTNET 19169 4.62 11.26 1.42 46 TR_XM_SpammyWords4 18439 6.33 10.83 4.15 47 RCVD_IN_MSPIKE_H3 17760 7.99 10.43 6.81 48 RCVD_IN_MSPIKE_WL 17760 7.99 10.43 6.81 49 XM_Evil_Numbers_Gen 16192 8.29 9.51 7.70 50 BAYES_80 15188 5.65 8.92 4.07 51 FSL_BULK_SIG 15123 5.23 8.88 3.47 52 TR_XM_UnparsRelay 13413 3.69 7.88 1.67 53 BAYES_60 12979 8.61 7.62 9.09 54 LotsOfNums_01 12025 8.21 7.06 8.76 55 HTML_IMAGE_RATIO_02 11951 5.67 7.02 5.01 56 XMBody_17 11044 2.45 6.49 0.50 57 XMSubMetaSx_00 10847 5.05 6.37 4.42 58 XM_UncommonTLD01 10402 4.38 6.11 3.55 59 XMSexyCombo_05 10256 3.48 6.02 2.25 60 HTML_IMAGE_RATIO_04 10048 4.90 5.90 4.42 61 UNTRUSTED_Relay 9829 2.92 5.77 1.54 62 BAYES_95 9567 3.59 5.62 2.61 63 XM_H_Long_From01 9400 5.38 5.52 5.31 64 DKIM_INVALID 8793 3.30 5.16 2.41 65 MPART_ALT_DIFF 8791 4.48 5.16 4.15 66 TooManyTo_001 8615 7.24 5.06 8.29 67 XM_SPF_SoftFail 8150 3.60 4.79 3.02 68 XM_H_GMP 7814 5.79 4.59 6.36 69 HTML_IMAGE_RATIO_06 7770 3.46 4.56 2.92 70 T_FILL_THIS_FORM_SHORT 7513 2.15 4.41 1.06 71 XM_B_Phish_Phrases 7495 3.85 4.40 3.58 72 TR_XM_SpammyWords5 7465 2.23 4.38 1.19 73 TR_XM_BayesRelay 7137 1.37 4.19 0.00 74 XMNumbers 6842 2.97 4.02 2.47 75 XM_B_Investor 6751 2.28 3.97 1.47 76 TR_XM_PhishingBody 6494 2.40 3.81 1.71 77 XM_OfRef6 6444 1.93 3.78 1.04 78 HK_RANDOM_REPLYTO 6376 1.28 3.74 0.09 79 MIME_HTML_MOSTLY 6183 2.74 3.63 2.31 80 XMStrtUSub 6141 3.96 3.61 4.13 81 XM_B_SpammyTLD 6044 2.71 3.55 2.31 82 T_XMDrugObfuBody_14 5931 2.23 3.48 1.63 83 T_XMDrugObfuBody_08 5889 2.38 3.46 1.86 84 HTML_IMAGE_RATIO_08 5690 2.63 3.34 2.29 85 MIME_HTML_ONLY_MULTI 5516 2.75 3.24 2.52 86 TM2_M_URI_OPT_OUT 5508 2.62 3.24 2.32 87 MIME_QP_LONG_LINE 5398 4.81 3.17 5.60 88 SpammyFromTLD_01 5365 1.55 3.15 0.77 89 XM_UB50 5261 1.56 3.09 0.82 90 TM2_M_VERY_LONG_WORD 5058 1.75 2.97 1.15 91 TR_XM_FormFill 4931 0.97 2.90 0.04 92 XMDiploma_00 4733 2.00 2.78 1.63 93 RCVD_IN_VALIDITY_SAFE 4633 3.66 2.72 4.11 94 TR_LOTS_OF_MONEY3 4619 1.17 2.71 0.43 95 XM_CamelCaseFrm001 4520 2.33 2.65 2.18 96 XM_URI_RBL 4407 0.95 2.59 0.16 97 SUBJ_ALL_CAPS 4221 1.71 2.48 1.34 98 FONT_INVIS_LONG_LINE 4167 0.86 2.45 0.09 99 T_TooManySym_01 3960 4.56 2.33 5.64 100 XM_B_SpammyWords4 3856 1.34 2.26 0.89 101 XM_B_Unsub2 3850 1.78 2.26 1.54 102 RCVD_IN_VALIDITY_CERTIFIED 3654 3.14 2.15 3.62 103 RELAYCOUNTRY_AU 3625 1.19 2.13 0.74 104 USER_IN_DEF_DKIM_WL 3604 8.98 2.12 12.30 105 T_REMOTE_IMAGE 3312 3.06 1.95 3.60 106 ANY_BOUNCE_MESSAGE 3303 3.65 1.94 4.48 107 BOUNCE_MESSAGE 3302 3.65 1.94 4.48 108 TR_XM_NoHeaderRelay 3259 0.70 1.91 0.11 109 URI_HEX 3168 1.34 1.86 1.08 110 XM_DIRTYINTL 3140 0.86 1.84 0.39 111 TR_Mismatch_TLD_02 3110 0.65 1.83 0.09 112 FROM_EXCESS_BASE64 3095 2.14 1.82 2.29 113 XM_H_Long_From02 3041 1.29 1.79 1.05 114 MAILING_LIST_MULTI 2985 2.33 1.75 2.60 115 TR_XM_InvalidRelay 2920 0.58 1.72 0.03 116 XMStockSpam_06 2911 1.32 1.71 1.13 117 RCVD_IN_IADB_LISTED 2851 4.11 1.67 5.29 118 XM_DK_Undo_01 2842 1.88 1.67 1.98 119 TR_XM_INV_DKIM 2831 0.57 1.66 0.05 120 BAYES_40 2786 3.74 1.64 4.76 121 TR_XM_PHPDW 2727 0.78 1.60 0.38 122 XMSexyCombo_01 2727 0.80 1.60 0.41 123 TR_XM_PHPForged 2715 0.78 1.59 0.38 124 HTML_MIME_NO_HTML_TAG 2679 1.95 1.57 2.13 125 HTML_TAG_BALANCE_BODY 2647 0.79 1.55 0.42 126 T_XMDrugObfuBody_00 2617 1.25 1.54 1.11 127 BOTNET_NORDNS 2598 0.50 1.53 0.01 128 TR_XM_FormFill2 2596 0.75 1.52 0.38 129 URI_TRY_3LD 2587 0.82 1.52 0.48 130 XM_SendGrid 2574 1.41 1.51 1.37 131 XM_H_PHPOS 2571 0.73 1.51 0.35 132 T_XMHurry_00 2523 1.11 1.48 0.93 133 RCVD_IN_IADB_SPF 2502 3.64 1.47 4.69 134 AC_BR_BONANZA 2480 0.54 1.46 0.10 135 KHOP_HELO_FCRDNS 2429 1.29 1.43 1.23 136 DIET_1 2426 0.63 1.42 0.25 137 HTTPS_HTTP_MISMATCH 2425 1.01 1.42 0.80 138 XMPhish30 2400 0.81 1.41 0.52 139 ALL_TRUSTED 2395 11.57 1.41 16.47 140 SpammyFromTLD_02 2387 0.73 1.40 0.41 141 RCVD_IN_IADB_SENDERID 2350 3.30 1.38 4.23 142 RCVD_IN_IADB_DK 2343 3.24 1.38 4.13 143 DKIM_ADSP_CUSTOM_MED 2325 1.16 1.37 1.05 144 TR_Symld_Words 2284 1.50 1.34 1.58 145 XMReplyNow 2271 0.62 1.33 0.28 146 URI_NOVOWEL 2248 1.86 1.32 2.12 147 XMBdyGiftCard01 2084 0.74 1.22 0.50 148 XMGenDplmaNmb 2050 0.96 1.20 0.85 149 XMBody_78 2033 0.65 1.19 0.38 150 BAYES_20 2026 2.69 1.19 3.41 151 TR_Caps_n_Bayes_99 1984 0.39 1.17 0.01 152 XM_H_Undi_Recip 1957 0.54 1.15 0.24 153 XM_HighProb1 1955 0.38 1.15 0.00 154 XMHTML_After_End 1954 0.83 1.15 0.67 155 RCVD_IN_PSBL 1932 0.55 1.13 0.27 156 NML_ADSP_CUSTOM_MED 1899 0.86 1.12 0.73 157 T_MONEY_PERCENT 1852 0.48 1.09 0.19 158 TR_LOTS_OF_MONEY2 1852 0.48 1.09 0.19 159 SHOPIFY_IMG_NOT_RCVD_SFY 1849 0.51 1.09 0.24 160 XMSubMetaI_00 1817 0.82 1.07 0.70 161 RDNS_DYNAMIC 1774 0.58 1.04 0.36 162 FORGED_GMAIL_RCVD 1731 0.76 1.02 0.64 163 XM_H_PHPMailer 1676 0.85 0.98 0.78 164 SCC_BODY_URI_ONLY 1666 1.99 0.98 2.48 165 XMPhish14 1664 0.67 0.98 0.53 166 MPART_ALT_DIFF_COUNT 1664 0.71 0.98 0.57 167 BAYES_00 1652 6.98 0.97 9.87 168 RCVD_IN_VALIDITY_RPBL 1649 0.34 0.97 0.04 169 XMBrknScrpt_02 1631 0.76 0.96 0.67 170 TVD_RCVD_IP 1544 1.27 0.91 1.44 171 REMOVE_BEFORE_LINK 1509 0.46 0.89 0.25 172 XM_ProductURIs 1494 0.89 0.88 0.89 173 TR_XM_DK_SendGrid 1463 0.91 0.86 0.94 174 TR_XM_Base64_M1 1443 0.70 0.85 0.63 175 T_XMDrugObfuBody_10 1419 0.29 0.83 0.03 176 TR_XM_DK_Bayes 1417 4.77 0.83 6.67 177 TR_XM_Spammywords 1404 0.46 0.82 0.28 178 XM_S_SpammyWords 1404 0.46 0.82 0.28 179 XM_B_COVIDMETA 1401 0.39 0.82 0.19 180 XM_B_DNDMA 1389 0.45 0.82 0.27 181 RELAYCOUNTRY_FR 1372 0.41 0.81 0.22 182 XMSubMetaSxObfu_03 1369 0.68 0.80 0.62 183 XM_B_COPY_HTML 1368 0.63 0.80 0.55 184 XM_Body_Dirty_Words_01 1367 0.38 0.80 0.18 185 XMMoneyMeta_00 1365 0.61 0.80 0.52 186 XMBody_29 1356 0.30 0.80 0.05 187 RCVD_IN_IADB_VOUCHED 1348 2.47 0.79 3.28 188 XM_UB99 1345 0.26 0.79 0.00 189 TR_Mismatch_TLD_01 1338 0.47 0.79 0.32 190 TR_MetaPhish_Combo_01 1334 0.71 0.78 0.67 191 PDS_OTHER_BAD_TLD 1318 0.36 0.77 0.16 192 XMSlimDrugH 1314 0.48 0.77 0.35 193 XM_UB60 1282 0.29 0.75 0.06 194 XM_B_Phish66 1280 0.43 0.75 0.27 195 HOSTED_IMG_MULTI_PUB_01 1275 0.25 0.75 0.00 196 TR_XM_COVIDMETA4 1253 0.31 0.74 0.11 197 TooManyTo_002 1223 1.82 0.72 2.35 198 HTML_FONT_FACE_BAD 1220 0.52 0.72 0.42 199 HTML_FONT_TINY_NORDNS 1210 0.32 0.71 0.13 200 XM_B_REG_HTML 1191 0.44 0.70 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 302709 89.27 96.51 85.78 2 T_SCC_BODY_TEXT_LINE 293677 82.66 81.51 83.22 3 RELAYCOUNTRY_US 283616 80.23 79.93 80.37 4 DKIM_SIGNED 262983 79.62 90.18 74.52 5 XM_DK_Pass 258206 77.55 86.64 73.17 6 DKIM_VALID 254490 76.32 85.02 72.12 7 XM_B_Unicode 246625 75.24 86.32 69.89 8 DCC_CHECK_NEGATIVE 228946 51.93 25.09 64.88 9 BAYES_50 207238 52.47 39.51 58.73 10 DKIM_VALID_AU 201723 58.57 61.48 57.16 11 XMListUnsubscribeExists 177829 57.69 72.81 50.39 12 XM_B_SpammyWords 157680 53.69 72.35 44.68 13 XM_B_Unicode3 143619 42.75 47.02 40.70 14 DCC_CHECK 123755 48.03 74.90 35.07 15 DKIM_VALID_EF 97974 29.54 33.21 27.76 16 HTML_FONT_LOW_CONTRAST 97727 30.74 37.06 27.69 17 T_TM2_M_HEADER_IN_MSG 97688 25.92 22.26 27.68 18 FVGT_m_MULTI_ODD 91233 28.29 33.35 25.85 19 LOC_TINY_FONT_1 87536 30.48 42.23 24.81 20 XMSubLong 83818 24.15 24.98 23.75 21 RCVD_IN_MSPIKE_H2 79151 22.88 23.83 22.43 22 T_KAM_HTML_FONT_INVALID 74945 23.91 29.45 21.24 23 XM_B_SpammyWords2 66245 26.58 42.77 18.77 24 MIME_HTML_ONLY 64980 23.06 32.69 18.41 25 ALL_TRUSTED 58121 11.57 1.41 16.47 26 TR_XM_DK_Unsub 46555 16.90 24.58 13.19 27 XM_Multi_Part_URI 45300 15.21 20.12 12.84 28 USER_IN_DEF_DKIM_WL 43396 8.98 2.12 12.30 29 UNPARSEABLE_RELAY 36192 11.88 15.25 10.26 30 BAYES_00 34839 6.98 0.97 9.87 31 BAYES_60 32068 8.61 7.62 9.09 32 LotsOfNums_01 30927 8.21 7.06 8.76 33 XM_B_Unsub 29938 10.83 15.69 8.48 34 TooManyTo_001 29249 7.24 5.06 8.29 35 XM_Evil_Numbers_Gen 27166 8.29 9.51 7.70 36 XM_DKIMWhitelistDomains 26873 5.15 0.03 7.62 37 IN_ZIMBRA_NJ_WHITELIST 24121 4.63 0.07 6.84 38 RCVD_IN_MSPIKE_H3 24048 7.99 10.43 6.81 39 RCVD_IN_MSPIKE_WL 24048 7.99 10.43 6.81 40 TR_XM_DK_Bayes 23555 4.77 0.83 6.67 41 TR_XM_DK_Bayes1 23182 4.60 0.51 6.57 42 TR_XM_BayesUnsub 23066 9.37 15.24 6.54 43 XM_DK_Undo_02 22802 19.23 45.69 6.46 44 XM_H_GMP 22458 5.79 4.59 6.36 45 XM_Body_Dirty_Words 22014 8.40 12.89 6.24 46 LOTS_OF_MONEY 21342 8.12 12.42 6.05 47 TR_XM_DK_Bayes2 20060 3.96 0.39 5.68 48 T_TooManySym_01 19908 4.56 2.33 5.64 49 MIME_QP_LONG_LINE 19756 4.81 3.17 5.60 50 XM_H_Long_From01 18748 5.38 5.52 5.31 51 RCVD_IN_IADB_LISTED 18655 4.11 1.67 5.29 52 HTML_IMAGE_RATIO_02 17689 5.67 7.02 5.01 53 BAYES_99 17036 14.31 33.95 4.83 54 BAYES_40 16786 3.74 1.64 4.76 55 RCVD_IN_IADB_SPF 16566 3.64 1.47 4.69 56 XM_PDF 16200 3.31 0.66 4.59 57 ANY_BOUNCE_MESSAGE 15795 3.65 1.94 4.48 58 BOUNCE_MESSAGE 15792 3.65 1.94 4.48 59 BOTNET_IPINHOSTNAME 15729 8.14 15.76 4.46 60 HTML_IMAGE_RATIO_04 15612 4.90 5.90 4.42 61 XMSubMetaSx_00 15597 5.05 6.37 4.42 62 XM_B_SpammyWords3 15577 7.53 13.99 4.41 63 RCVD_IN_IADB_SENDERID 14934 3.30 1.38 4.23 64 TR_XM_SpammyWords4 14659 6.33 10.83 4.15 65 MPART_ALT_DIFF 14639 4.48 5.16 4.15 66 RCVD_IN_IADB_DK 14583 3.24 1.38 4.13 67 XMStrtUSub 14567 3.96 3.61 4.13 68 RCVD_IN_VALIDITY_SAFE 14498 3.66 2.72 4.11 69 BAYES_80 14353 5.65 8.92 4.07 70 RELAYCOUNTRY_META 14143 9.08 19.60 4.01 71 BAYES_999 12915 11.12 26.58 3.66 72 RCVD_IN_VALIDITY_CERTIFIED 12782 3.14 2.15 3.62 73 T_REMOTE_IMAGE 12698 3.06 1.95 3.60 74 XM_B_Phish_Phrases 12633 3.85 4.40 3.58 75 XM_UncommonTLD01 12535 4.38 6.11 3.55 76 FSL_BULK_SIG 12231 5.23 8.88 3.47 77 BAYES_20 12043 2.69 1.19 3.41 78 RCVD_IN_IADB_VOUCHED 11567 2.47 0.79 3.28 79 XM_SPF_SoftFail 10658 3.60 4.79 3.02 80 HTML_IMAGE_RATIO_06 10306 3.46 4.56 2.92 81 TR_XM_DKIM_Undo 9674 13.50 35.79 2.74 82 BAYES_05 9313 1.97 0.58 2.64 83 BAYES_95 9212 3.59 5.62 2.61 84 MAILING_LIST_MULTI 9191 2.33 1.75 2.60 85 MIME_HTML_ONLY_MULTI 8894 2.75 3.24 2.52 86 SCC_BODY_URI_ONLY 8755 1.99 0.98 2.48 87 XMNumbers 8715 2.97 4.02 2.47 88 T_TooManySym_02 8596 1.86 0.68 2.44 89 DKIM_INVALID 8493 3.30 5.16 2.41 90 TooManyTo_002 8286 1.82 0.72 2.35 91 TM2_M_URI_OPT_OUT 8199 2.62 3.24 2.32 92 XM_B_SpammyTLD 8153 2.71 3.55 2.31 93 MIME_HTML_MOSTLY 8135 2.74 3.63 2.31 94 FROM_EXCESS_BASE64 8092 2.14 1.82 2.29 95 HTML_IMAGE_RATIO_08 8069 2.63 3.34 2.29 96 XMSexyCombo_05 7947 3.48 6.02 2.25 97 TR_XM_SpammyRelay 7833 6.70 15.98 2.22 98 RCVD_IN_IADB_OPTIN 7744 1.64 0.48 2.19 99 XM_CamelCaseFrm001 7689 2.33 2.65 2.18 100 HTML_MIME_NO_HTML_TAG 7524 1.95 1.57 2.13 101 URI_NOVOWEL 7472 1.86 1.32 2.12 102 INVALID_MSGID 7061 1.39 0.13 2.00 103 XM_DK_Undo_01 7001 1.88 1.67 1.98 104 TR_DCC_Bayes_99 6921 9.50 25.13 1.96 105 T_XMDrugObfuBody_08 6562 2.38 3.46 1.86 106 TO_MALFORMED 6420 1.29 0.18 1.82 107 HELO_NODOT 6290 1.37 0.50 1.78 108 HELO_NO_DOMAIN 6281 1.36 0.50 1.78 109 TR_XM_PhishingBody 6042 2.40 3.81 1.71 110 TR_XM_UnparsRelay 5909 3.69 7.88 1.67 111 XMDiploma_00 5753 2.00 2.78 1.63 112 T_XMDrugObfuBody_14 5753 2.23 3.48 1.63 113 TR_Symld_Words 5564 1.50 1.34 1.58 114 XM_B_Unsub2 5446 1.78 2.26 1.54 115 UNTRUSTED_Relay 5425 2.92 5.77 1.54 116 IN_HORDE_ADDRESS_BOOK 5210 1.02 0.08 1.48 117 XM_B_Investor 5190 2.28 3.97 1.47 118 TooManyTo_003 5081 1.16 0.59 1.44 119 TVD_RCVD_IP 5079 1.27 0.91 1.44 120 BOTNET 5000 4.62 11.26 1.42 121 XM_SendGrid 4819 1.41 1.51 1.37 122 XMGappySubj_01 4801 0.97 0.15 1.36 123 SUBJ_ALL_CAPS 4736 1.71 2.48 1.34 124 XMBody_95 4664 0.95 0.19 1.32 125 XM_GoogleGroups 4593 1.04 0.49 1.30 126 KHOP_HELO_FCRDNS 4341 1.29 1.43 1.23 127 XMBSHREFv2 4200 0.93 0.40 1.19 128 XMCapTrack 4191 0.93 0.39 1.19 129 TR_XM_SpammyWords5 4185 2.23 4.38 1.19 130 XM_H_Trusted_IP 4091 0.78 0.00 1.16 131 TVD_SPACE_RATIO 4083 0.86 0.25 1.16 132 TM2_M_VERY_LONG_WORD 4073 1.75 2.97 1.15 133 XMStockSpam_06 3976 1.32 1.71 1.13 134 T_XMDrugObfuBody_00 3903 1.25 1.54 1.11 135 URI_HEX 3825 1.34 1.86 1.08 136 RCVD_IN_BL_SPAMCOP_NET 3815 5.58 14.92 1.08 137 T_FILL_THIS_FORM_SHORT 3755 2.15 4.41 1.06 138 DKIM_ADSP_CUSTOM_MED 3720 1.16 1.37 1.05 139 RELAYCOUNTRY_CA 3708 4.41 11.36 1.05 140 TooManyTo_004 3698 0.88 0.54 1.05 141 XM_H_Long_From02 3695 1.29 1.79 1.05 142 XM_OfRef6 3666 1.93 3.78 1.04 143 TR_XM_DK_SendGrid 3302 0.91 0.86 0.94 144 T_XMHurry_00 3290 1.11 1.48 0.93 145 XM_ProductURIs 3156 0.89 0.88 0.89 146 XM_B_SpammyWords4 3151 1.34 2.26 0.89 147 XMGappySubj_02 3123 0.62 0.06 0.88 148 TooManyTo_005 3057 0.75 0.51 0.87 149 XMGenDplmaNmb 2987 0.96 1.20 0.85 150 FROM_GOV_DKIM_AU 2918 0.60 0.13 0.83 151 T_TooManySym_03 2901 0.64 0.25 0.82 152 XM_UB50 2901 1.56 3.09 0.82 153 RCVD_IN_RP_SAFE 2878 0.71 0.50 0.82 154 HTTPS_HTTP_MISMATCH 2838 1.01 1.42 0.80 155 XM_H_PHPMailer 2756 0.85 0.98 0.78 156 SpammyFromTLD_01 2732 1.55 3.15 0.77 157 RELAYCOUNTRY_AU 2615 1.19 2.13 0.74 158 NML_ADSP_CUSTOM_MED 2574 0.86 1.12 0.73 159 XM_ShortIntro_01 2549 0.64 0.48 0.72 160 RCVD_IN_RP_CERTIFIED 2534 0.61 0.39 0.72 161 XMSubMetaI_00 2454 0.82 1.07 0.70 162 XMSubNoVowel 2430 0.61 0.45 0.69 163 TR_MetaPhish_Combo_01 2376 0.71 0.78 0.67 164 XMHTML_After_End 2368 0.83 1.15 0.67 165 XMNoVowels 2359 0.63 0.54 0.67 166 XMBrknScrpt_02 2356 0.76 0.96 0.67 167 MSGID_NOFQDN1 2355 0.45 0.01 0.67 168 FORGED_GMAIL_RCVD 2256 0.76 1.02 0.64 169 TR_XM_Base64_M1 2212 0.70 0.85 0.63 170 XMSubMetaSxObfu_03 2202 0.68 0.80 0.62 171 T_OBFU_PDF_ATTACH 2190 0.44 0.07 0.62 172 TR_XM_SpammyWords2 2132 4.85 13.65 0.60 173 MPART_ALT_DIFF_COUNT 2025 0.71 0.98 0.57 174 RELAYCOUNTRY_GB 2022 0.58 0.59 0.57 175 SHORT_HELO_AND_INLINE_IMAGE 1974 0.40 0.06 0.56 176 XM_B_COPY_HTML 1935 0.63 0.80 0.55 177 USER_IN_WELCOMELIST 1895 0.36 0.00 0.54 178 USER_IN_WHITELIST 1895 0.36 0.00 0.54 179 XMPhish14 1861 0.67 0.98 0.53 180 XMMoneyMeta_00 1848 0.61 0.80 0.52 181 XMPhish30 1843 0.81 1.41 0.52 182 XMBdyGiftCard01 1778 0.74 1.22 0.50 183 XMBody_17 1771 2.45 6.49 0.50 184 HTML_IMAGE_ONLY_28 1744 0.44 0.33 0.49 185 T_Symld_Words_02 1735 0.51 0.54 0.49 186 PLING_QUERY 1710 0.55 0.68 0.48 187 URI_TRY_3LD 1698 0.82 1.52 0.48 188 XMSubMetaSxObfu_02 1665 0.44 0.36 0.47 189 MISSING_HEADERS 1605 0.47 0.51 0.45 190 TO_NO_BRKTS_HTML_ONLY 1535 0.38 0.28 0.43 191 FILL_THIS_FORM 1535 0.45 0.49 0.43 192 TR_LOTS_OF_MONEY3 1514 1.17 2.71 0.43 193 TM2_M_BODY_EMPTY 1505 0.34 0.15 0.43 194 HTML_IMAGE_ONLY_20 1498 0.44 0.48 0.42 195 HTML_TAG_BALANCE_BODY 1493 0.79 1.55 0.42 196 HTML_FONT_FACE_BAD 1480 0.52 0.72 0.42 197 HTML_IMAGE_ONLY_32 1465 0.35 0.20 0.42 198 XMLngstWrd_00 1461 0.38 0.32 0.41 199 SpammyFromTLD_02 1440 0.73 1.40 0.41 200 XMSexyCombo_01 1438 0.80 1.60 0.41 ----------------------------------------------------------------------