Email: 496892 Autolearn: 0 AvgScore: 4.05 AvgScanTime: 1.12 sec Spam: 152852 Autolearn: 0 AvgScore: 14.45 AvgScanTime: 1.21 sec Ham: 344040 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 1.07 sec Time Spent Running SA: 154.29 hours Time Spent Processing Spam: 51.57 hours Time Spent Processing Ham: 102.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 146190 88.50 95.64 85.32 2 DKIM_SIGNED 134845 78.29 88.22 73.88 3 XM_B_Unicode 127980 72.06 83.73 66.88 4 T_SCC_BODY_TEXT_LINE 124631 82.66 81.54 83.15 5 XM_DK_Pass 123201 74.74 80.60 72.13 6 DKIM_VALID 120942 73.51 79.12 71.01 7 RELAYCOUNTRY_US 119026 79.73 77.87 80.55 8 XM_B_SpammyWords 112414 51.94 73.54 42.34 9 DCC_CHECK 111813 43.91 73.15 30.93 10 XMListUnsubscribeExists 100916 52.91 66.02 47.09 11 DKIM_VALID_AU 87656 56.72 57.35 56.44 12 XM_B_Unicode3 67053 40.67 43.87 39.26 13 XM_DK_Undo_02 65617 17.13 42.93 5.67 14 XM_B_SpammyWords2 63699 24.39 41.67 16.72 15 BAYES_50 56871 50.77 37.21 56.80 16 MIME_HTML_ONLY 56721 24.69 37.11 19.17 17 LOC_TINY_FONT_1 55788 27.29 36.50 23.20 18 BAYES_99 55239 14.36 36.14 4.68 19 HTML_FONT_LOW_CONTRAST 53127 29.64 34.76 27.36 20 TR_XM_DKIM_Undo 51931 11.85 33.97 2.02 21 DKIM_VALID_EF 46415 30.05 30.37 29.91 22 FVGT_m_MULTI_ODD 46276 26.97 30.28 25.51 23 BAYES_999 44162 11.38 28.89 3.60 24 RCVD_IN_MSPIKE_H2 41513 24.60 27.16 23.47 25 DCC_CHECK_NEGATIVE 41022 56.05 26.84 69.03 26 T_KAM_HTML_FONT_INVALID 40248 21.73 26.33 19.69 27 RELAYCOUNTRY_META 39990 10.82 26.16 4.00 28 TR_DCC_Bayes_99 39737 8.93 26.00 1.35 29 XMSubLong 36918 23.11 24.15 22.65 30 T_TM2_M_HEADER_IN_MSG 36664 28.56 23.99 30.59 31 TR_XM_DK_Unsub 34637 16.45 22.66 13.69 32 TR_XM_SpammyRelay 32861 7.97 21.50 1.96 33 XM_B_Unsub 26990 10.86 17.66 7.83 34 XM_Multi_Part_URI 26869 14.29 17.58 12.83 35 TR_XM_BayesUnsub 26267 9.51 17.18 6.10 36 RCVD_IN_BL_SPAMCOP_NET 25800 5.57 16.88 0.55 37 TR_XM_SpammyWords2 22538 4.80 14.74 0.38 38 TR_XM_SPAMCOP 21944 4.58 14.36 0.23 39 BOTNET 21813 5.25 14.27 1.24 40 BOTNET_IPINHOSTNAME 21699 7.36 14.20 4.32 41 UNPARSEABLE_RELAY 20958 11.17 13.71 10.03 42 LOTS_OF_MONEY 19279 8.12 12.61 6.12 43 XM_B_SpammyWords3 18235 6.29 11.93 3.78 44 FSL_BULK_SIG 17830 5.85 11.66 3.26 45 RELAYCOUNTRY_CA 17827 4.28 11.66 1.00 46 TR_XM_SpammyWords4 17433 6.36 11.41 4.12 47 RCVD_IN_MSPIKE_WL 15369 7.58 10.05 6.48 48 RCVD_IN_MSPIKE_H3 15369 7.58 10.05 6.48 49 XM_Body_Dirty_Words 14001 5.78 9.16 4.28 50 BAYES_80 13951 5.81 9.13 4.33 51 DKIM_INVALID 13903 4.78 9.10 2.87 52 XM_Evil_Numbers_Gen 13890 7.94 9.09 7.43 53 BAYES_60 12653 8.89 8.28 9.16 54 HTML_IMAGE_RATIO_02 11872 6.03 7.77 5.26 55 TR_XM_UnparsRelay 11525 3.34 7.54 1.48 56 XMSubMetaSx_00 11498 4.83 7.52 3.63 57 UNTRUSTED_Relay 11014 3.38 7.21 1.69 58 XM_UncommonTLD01 10741 4.98 7.03 4.07 59 XMBody_17 10265 2.43 6.72 0.52 60 XMSexyCombo_05 10109 3.50 6.61 2.12 61 MPART_ALT_DIFF 9414 4.40 6.16 3.62 62 LotsOfNums_01 9333 7.40 6.11 7.98 63 TooManyTo_001 8836 8.36 5.78 9.51 64 TR_XM_NoHeaderRelay 8613 1.82 5.63 0.13 65 HTML_IMAGE_RATIO_04 8252 4.46 5.40 4.04 66 BAYES_95 8052 3.37 5.27 2.53 67 TR_XM_SpammyWords5 7907 2.51 5.17 1.32 68 HTML_MIME_NO_HTML_TAG 7567 3.21 4.95 2.44 69 XM_H_Long_From01 7468 5.06 4.89 5.14 70 XM_OfRef6 7244 2.38 4.74 1.33 71 XM_B_Phish_Phrases 7227 3.44 4.73 2.87 72 XM_SPF_SoftFail 7120 3.68 4.66 3.24 73 TR_XM_BayesRelay 7064 1.42 4.62 0.00 74 XMStrtUSub 6707 4.47 4.39 4.51 75 BOTNET_NORDNS 6606 1.34 4.32 0.02 76 XMNumbers 6361 3.07 4.16 2.58 77 XM_H_GMP 6345 5.99 4.15 6.81 78 XM_B_Investor 6241 2.37 4.08 1.61 79 T_FILL_THIS_FORM_SHORT 6222 1.97 4.07 1.04 80 TR_XM_PhishingBody 6189 2.29 4.05 1.51 81 MIME_HTML_MOSTLY 6174 2.88 4.04 2.37 82 HK_RANDOM_REPLYTO 6015 1.26 3.94 0.08 83 RELAYCOUNTRY_RO 5980 1.22 3.91 0.02 84 TR_XM_INV_DKIM 5911 1.23 3.87 0.06 85 XM_UB50 5827 1.84 3.81 0.96 86 HTML_IMAGE_RATIO_06 5804 2.81 3.80 2.37 87 SpammyFromTLD_01 5606 1.64 3.67 0.74 88 T_XMDrugObfuBody_08 5554 2.32 3.63 1.73 89 MIME_HTML_ONLY_MULTI 5480 2.54 3.59 2.08 90 RCVD_IN_VALIDITY_RPBL 5429 1.12 3.55 0.04 91 T_XMDrugObfuBody_14 5229 2.26 3.42 1.74 92 FONT_INVIS_LONG_LINE 5134 1.07 3.36 0.06 93 TM2_M_VERY_LONG_WORD 4905 1.89 3.21 1.31 94 XM_B_SpammyTLD 4871 2.57 3.19 2.30 95 TM2_M_URI_OPT_OUT 4780 2.44 3.13 2.13 96 T_REMOTE_IMAGE 4712 3.58 3.08 3.80 97 HTML_IMAGE_RATIO_08 4341 2.24 2.84 1.97 98 MIME_QP_LONG_LINE 4218 4.49 2.76 5.26 99 T_TooManySym_01 4184 4.71 2.74 5.59 100 SUBJ_ALL_CAPS 4158 1.88 2.72 1.51 101 XMDiploma_00 4143 1.85 2.71 1.47 102 KHOP_HELO_FCRDNS 4063 1.85 2.66 1.50 103 XM_CamelCaseFrm001 3962 2.27 2.59 2.13 104 RCVD_IN_VALIDITY_SAFE 3954 3.60 2.59 4.05 105 XM_URI_RBL 3921 0.88 2.57 0.13 106 TR_LOTS_OF_MONEY3 3887 1.00 2.54 0.31 107 TR_Mismatch_TLD_02 3861 0.85 2.53 0.11 108 TR_XM_FormFill 3828 0.80 2.50 0.04 109 RELAYCOUNTRY_AU 3625 1.20 2.37 0.68 110 XM_B_Unsub2 3200 1.60 2.09 1.38 111 TR_XM_PHPForged 3191 1.06 2.09 0.61 112 ANY_BOUNCE_MESSAGE 3190 3.91 2.09 4.73 113 BOUNCE_MESSAGE 3187 3.91 2.09 4.72 114 USER_IN_DEF_DKIM_WL 3176 8.64 2.08 11.56 115 RCVD_IN_VALIDITY_CERTIFIED 3150 3.10 2.06 3.56 116 TR_XM_PHPDW 3139 1.05 2.05 0.60 117 TR_XM_FormFill2 3072 1.04 2.01 0.61 118 XM_B_SpammyWords4 3058 1.10 2.00 0.70 119 XM_H_PHPOS 3047 1.02 1.99 0.58 120 XMSexyCombo_01 2904 0.78 1.90 0.29 121 RCVD_IN_PSBL 2687 0.70 1.76 0.23 122 MAILING_LIST_MULTI 2671 2.51 1.75 2.85 123 XM_SendGrid 2616 1.53 1.71 1.45 124 URI_HEX 2608 1.20 1.71 0.98 125 FROM_MISSP_REPLYTO 2602 0.52 1.70 0.00 126 XMStockSpam_06 2592 1.42 1.70 1.29 127 BAYES_40 2488 4.11 1.63 5.22 128 HTML_TAG_BALANCE_BODY 2471 0.85 1.62 0.51 129 XM_DIRTYINTL 2451 0.63 1.60 0.19 130 HTML_FONT_SIZE_LARGE 2386 0.57 1.56 0.13 131 SpammyFromTLD_02 2370 0.76 1.55 0.41 132 FROM_EXCESS_BASE64 2350 1.81 1.54 1.94 133 T_XMHurry_00 2314 0.74 1.51 0.40 134 AC_BR_BONANZA 2307 0.54 1.51 0.12 135 XMLngstWrd_00 2282 1.02 1.49 0.81 136 URI_TRY_3LD 2272 1.08 1.49 0.91 137 XM_OfRef7 2235 0.60 1.46 0.22 138 RELAYCOUNTRY_IE 2231 0.62 1.46 0.24 139 XM_DK_Undo_01 2228 1.83 1.46 2.00 140 XM_HighProb1 2209 0.45 1.45 0.00 141 TR_XM_InvalidRelay 2066 0.43 1.35 0.02 142 XMPhish14 2050 0.69 1.34 0.40 143 XMReplyNow 2048 0.60 1.34 0.27 144 XM_B_DNDMA 2020 0.73 1.32 0.47 145 RCVD_IN_IADB_LISTED 2010 3.55 1.31 4.54 146 XMGenDplmaNmb 1998 0.98 1.31 0.83 147 XMSubMetaI_00 1988 0.71 1.30 0.45 148 HTTPS_HTTP_MISMATCH 1952 1.08 1.28 1.00 149 MISSING_HEADERS 1933 0.71 1.26 0.47 150 XMSubMetaSxObfu_03 1896 0.69 1.24 0.45 151 RELAYCOUNTRY_FR 1890 0.55 1.24 0.25 152 TR_Symld_Words 1881 1.52 1.23 1.65 153 HOSTED_IMG_DIRECT_MX 1877 0.41 1.23 0.04 154 ALL_TRUSTED 1873 11.75 1.23 16.43 155 XMBdyGiftCard01 1849 0.82 1.21 0.64 156 XMBrknScrpt_02 1834 0.72 1.20 0.51 157 URI_NOVOWEL 1833 1.59 1.20 1.77 158 XMSexyCombo_04 1812 0.43 1.19 0.09 159 XMPhish30 1811 0.72 1.18 0.52 160 RCVD_IN_IADB_SPF 1805 3.16 1.18 4.04 161 XM_H_PHPMailer 1795 1.02 1.17 0.95 162 T_XMDrugObfuBody_10 1791 0.39 1.17 0.05 163 BAYES_20 1778 2.96 1.16 3.76 164 XM_UB99 1728 0.35 1.13 0.00 165 RCVD_IN_IADB_DK 1711 2.82 1.12 3.58 166 RCVD_IN_IADB_SENDERID 1705 2.90 1.12 3.69 167 HTML_IMAGE_ONLY_20 1701 0.67 1.11 0.47 168 XM_B_SEO 1648 0.43 1.08 0.15 169 XM_H_Undi_Recip 1625 0.58 1.06 0.36 170 RDNS_DYNAMIC 1614 0.58 1.06 0.37 171 XMLongAddy 1587 0.38 1.04 0.08 172 XMHTML_After_End 1585 0.86 1.04 0.79 173 XM_BadFromFormat 1580 0.39 1.03 0.10 174 HDRS_MISSP 1539 0.34 1.01 0.04 175 TR_XM_SEO4 1537 0.37 1.01 0.08 176 TO_NO_BRKTS_FROM_MSSP 1518 0.32 0.99 0.02 177 REPLYTO_WITHOUT_TO_CC 1517 0.32 0.99 0.02 178 RELAYCOUNTRY_GB 1510 0.64 0.99 0.48 179 URIBL_DBL_SPAM 1507 0.31 0.99 0.01 180 T_XMDrugObfuBody_00 1502 0.65 0.98 0.50 181 FORGED_MUA_OUTLOOK 1495 0.32 0.98 0.02 182 SCC_BODY_URI_ONLY 1487 2.36 0.97 2.98 183 AXB_XMAILER_MIMEOLE_OL_024C2 1487 0.30 0.97 0.00 184 TR_XM_DK_SendGrid 1483 0.98 0.97 0.98 185 FSL_CTYPE_WIN1251 1483 0.30 0.97 0.00 186 BODY_ENHANCEMENT 1479 0.37 0.97 0.10 187 FROM_MISSP_EH_MATCH 1474 0.31 0.96 0.02 188 FSL_NEW_HELO_USER 1465 0.30 0.96 0.00 189 FILL_THIS_FORM 1463 0.75 0.96 0.66 190 TR_MetaPhish_Combo_01 1430 0.78 0.94 0.72 191 NSL_RCVD_FROM_USER 1424 0.29 0.93 0.00 192 XM_B_Phish66 1413 0.49 0.92 0.30 193 FROM_MISSPACED 1408 0.28 0.92 0.00 194 TR_LOTS_OF_MONEY2 1397 0.42 0.91 0.21 195 T_MONEY_PERCENT 1397 0.42 0.91 0.21 196 TooManyTo_002 1392 2.34 0.91 2.97 197 FROM_MISSP_MSFT 1389 0.28 0.91 0.00 198 XM_ProductURIs 1388 1.41 0.91 1.63 199 DKIM_ADSP_CUSTOM_MED 1388 0.92 0.91 0.93 200 FONT_INVIS_MSGID 1371 0.35 0.90 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 293536 88.50 95.64 85.32 2 T_SCC_BODY_TEXT_LINE 286081 82.66 81.54 83.15 3 RELAYCOUNTRY_US 277134 79.73 77.87 80.55 4 DKIM_SIGNED 254175 78.29 88.22 73.88 5 XM_DK_Pass 248165 74.74 80.60 72.13 6 DKIM_VALID 244317 73.51 79.12 71.01 7 DCC_CHECK_NEGATIVE 237493 56.05 26.84 69.03 8 XM_B_Unicode 230090 72.06 83.73 66.88 9 BAYES_50 195409 50.77 37.21 56.80 10 DKIM_VALID_AU 194168 56.72 57.35 56.44 11 XMListUnsubscribeExists 162013 52.91 66.02 47.09 12 XM_B_SpammyWords 145680 51.94 73.54 42.34 13 XM_B_Unicode3 135055 40.67 43.87 39.26 14 DCC_CHECK 106397 43.91 73.15 30.93 15 T_TM2_M_HEADER_IN_MSG 105238 28.56 23.99 30.59 16 DKIM_VALID_EF 102889 30.05 30.37 29.91 17 HTML_FONT_LOW_CONTRAST 94131 29.64 34.76 27.36 18 FVGT_m_MULTI_ODD 87755 26.97 30.28 25.51 19 RCVD_IN_MSPIKE_H2 80746 24.60 27.16 23.47 20 LOC_TINY_FONT_1 79831 27.29 36.50 23.20 21 XMSubLong 77923 23.11 24.15 22.65 22 T_KAM_HTML_FONT_INVALID 67749 21.73 26.33 19.69 23 MIME_HTML_ONLY 65943 24.69 37.11 19.17 24 XM_B_SpammyWords2 57509 24.39 41.67 16.72 25 ALL_TRUSTED 56527 11.75 1.23 16.43 26 TR_XM_DK_Unsub 47104 16.45 22.66 13.69 27 XM_Multi_Part_URI 44124 14.29 17.58 12.83 28 USER_IN_DEF_DKIM_WL 39768 8.64 2.08 11.56 29 BAYES_00 36984 7.63 0.61 10.75 30 UNPARSEABLE_RELAY 34522 11.17 13.71 10.03 31 TooManyTo_001 32709 8.36 5.78 9.51 32 BAYES_60 31525 8.89 8.28 9.16 33 XM_DKIMWhitelistDomains 29515 5.94 0.01 8.58 34 LotsOfNums_01 27441 7.40 6.11 7.98 35 XM_B_Unsub 26949 10.86 17.66 7.83 36 XM_Evil_Numbers_Gen 25551 7.94 9.09 7.43 37 TR_XM_DK_Bayes 24229 5.01 0.44 7.04 38 TR_XM_DK_Bayes1 23826 4.93 0.43 6.93 39 XM_H_GMP 23438 5.99 4.15 6.81 40 IN_ZIMBRA_NJ_WHITELIST 23421 4.78 0.22 6.81 41 RCVD_IN_MSPIKE_WL 22279 7.58 10.05 6.48 42 RCVD_IN_MSPIKE_H3 22278 7.58 10.05 6.48 43 LOTS_OF_MONEY 21064 8.12 12.61 6.12 44 TR_XM_BayesUnsub 20976 9.51 17.18 6.10 45 TR_XM_DK_Bayes2 20457 4.21 0.30 5.95 46 XM_DK_Undo_02 19491 17.13 42.93 5.67 47 T_TooManySym_01 19236 4.71 2.74 5.59 48 XM_PDF 18191 3.83 0.54 5.29 49 MIME_QP_LONG_LINE 18090 4.49 2.76 5.26 50 HTML_IMAGE_RATIO_02 18087 6.03 7.77 5.26 51 BAYES_40 17950 4.11 1.63 5.22 52 XM_H_Long_From01 17695 5.06 4.89 5.14 53 ANY_BOUNCE_MESSAGE 16257 3.91 2.09 4.73 54 BOUNCE_MESSAGE 16255 3.91 2.09 4.72 55 BAYES_99 16111 14.36 36.14 4.68 56 RCVD_IN_IADB_LISTED 15616 3.55 1.31 4.54 57 XMStrtUSub 15523 4.47 4.39 4.51 58 BAYES_80 14905 5.81 9.13 4.33 59 BOTNET_IPINHOSTNAME 14849 7.36 14.20 4.32 60 XM_Body_Dirty_Words 14722 5.78 9.16 4.28 61 TR_XM_SpammyWords4 14187 6.36 11.41 4.12 62 XM_UncommonTLD01 13997 4.98 7.03 4.07 63 RCVD_IN_VALIDITY_SAFE 13927 3.60 2.59 4.05 64 HTML_IMAGE_RATIO_04 13906 4.46 5.40 4.04 65 RCVD_IN_IADB_SPF 13883 3.16 1.18 4.04 66 RELAYCOUNTRY_META 13765 10.82 26.16 4.00 67 T_REMOTE_IMAGE 13077 3.58 3.08 3.80 68 XM_B_SpammyWords3 13012 6.29 11.93 3.78 69 BAYES_20 12947 2.96 1.16 3.76 70 RCVD_IN_IADB_SENDERID 12686 2.90 1.12 3.69 71 XMSubMetaSx_00 12478 4.83 7.52 3.63 72 MPART_ALT_DIFF 12466 4.40 6.16 3.62 73 BAYES_999 12376 11.38 28.89 3.60 74 RCVD_IN_IADB_DK 12314 2.82 1.12 3.58 75 RCVD_IN_VALIDITY_CERTIFIED 12257 3.10 2.06 3.56 76 FSL_BULK_SIG 11224 5.85 11.66 3.26 77 XM_SPF_SoftFail 11149 3.68 4.66 3.24 78 SCC_BODY_URI_ONLY 10259 2.36 0.97 2.98 79 TooManyTo_002 10215 2.34 0.91 2.97 80 XM_B_Phish_Phrases 9874 3.44 4.73 2.87 81 DKIM_INVALID 9858 4.78 9.10 2.87 82 MAILING_LIST_MULTI 9789 2.51 1.75 2.85 83 T_TooManySym_02 9625 2.20 0.86 2.80 84 BAYES_05 9492 2.09 0.58 2.76 85 RCVD_IN_IADB_VOUCHED 9224 2.03 0.56 2.68 86 XMNumbers 8892 3.07 4.16 2.58 87 BAYES_95 8715 3.37 5.27 2.53 88 HTML_MIME_NO_HTML_TAG 8383 3.21 4.95 2.44 89 HTML_IMAGE_RATIO_06 8144 2.81 3.80 2.37 90 MIME_HTML_MOSTLY 8138 2.88 4.04 2.37 91 XM_B_SpammyTLD 7903 2.57 3.19 2.30 92 HELO_NODOT 7483 1.67 0.54 2.18 93 HELO_NO_DOMAIN 7480 1.67 0.54 2.17 94 INVALID_MSGID 7356 1.53 0.17 2.14 95 XM_CamelCaseFrm001 7334 2.27 2.59 2.13 96 TM2_M_URI_OPT_OUT 7320 2.44 3.13 2.13 97 XMSexyCombo_05 7286 3.50 6.61 2.12 98 MIME_HTML_ONLY_MULTI 7150 2.54 3.59 2.08 99 TR_XM_DKIM_Undo 6948 11.85 33.97 2.02 100 XM_DK_Undo_01 6868 1.83 1.46 2.00 101 HTML_IMAGE_RATIO_08 6779 2.24 2.84 1.97 102 TR_XM_SpammyRelay 6745 7.97 21.50 1.96 103 FROM_EXCESS_BASE64 6667 1.81 1.54 1.94 104 TO_MALFORMED 6382 1.29 0.02 1.86 105 RCVD_IN_IADB_OPTIN 6214 1.36 0.35 1.81 106 URI_NOVOWEL 6076 1.59 1.20 1.77 107 T_XMDrugObfuBody_14 5993 2.26 3.42 1.74 108 TooManyTo_003 5987 1.46 0.83 1.74 109 T_XMDrugObfuBody_08 5960 2.32 3.63 1.73 110 UNTRUSTED_Relay 5801 3.38 7.21 1.69 111 TR_Symld_Words 5666 1.52 1.23 1.65 112 XM_ProductURIs 5612 1.41 0.91 1.63 113 XM_B_Investor 5539 2.37 4.08 1.61 114 TR_XM_PhishingBody 5206 2.29 4.05 1.51 115 SUBJ_ALL_CAPS 5187 1.88 2.72 1.51 116 KHOP_HELO_FCRDNS 5153 1.85 2.66 1.50 117 TR_XM_UnparsRelay 5086 3.34 7.54 1.48 118 XMDiploma_00 5057 1.85 2.71 1.47 119 IN_HORDE_ADDRESS_BOOK 5043 1.15 0.45 1.47 120 XM_SendGrid 5000 1.53 1.71 1.45 121 TVD_RCVD_IP 4976 1.26 0.82 1.45 122 XM_GoogleGroups 4786 1.11 0.47 1.39 123 XM_B_Unsub2 4745 1.60 2.09 1.38 124 TR_DCC_Bayes_99 4630 8.93 26.00 1.35 125 XM_OfRef6 4581 2.38 4.74 1.33 126 TR_XM_SpammyWords5 4552 2.51 5.17 1.32 127 TM2_M_VERY_LONG_WORD 4504 1.89 3.21 1.31 128 XMStockSpam_06 4450 1.42 1.70 1.29 129 XMCapTrack 4437 1.00 0.34 1.29 130 TooManyTo_004 4374 1.12 0.78 1.27 131 BOTNET 4276 5.25 14.27 1.24 132 TVD_SPACE_RATIO 4217 0.88 0.10 1.23 133 XMGappySubj_01 4156 0.91 0.24 1.21 134 XMBody_95 4098 0.87 0.16 1.19 135 XMBSHREFv2 4045 0.92 0.33 1.18 136 TooManyTo_005 3651 0.96 0.72 1.06 137 T_FILL_THIS_FORM_SHORT 3578 1.97 4.07 1.04 138 T_TooManySym_03 3567 0.85 0.42 1.04 139 XM_H_Long_From02 3473 0.97 0.88 1.01 140 HTTPS_HTTP_MISMATCH 3437 1.08 1.28 1.00 141 RELAYCOUNTRY_CA 3432 4.28 11.66 1.00 142 URI_HEX 3376 1.20 1.71 0.98 143 TR_XM_DK_SendGrid 3376 0.98 0.97 0.98 144 XM_UB50 3303 1.84 3.81 0.96 145 XM_H_PHPMailer 3284 1.02 1.17 0.95 146 DKIM_ADSP_CUSTOM_MED 3193 0.92 0.91 0.93 147 URI_TRY_3LD 3119 1.08 1.49 0.91 148 XMGappySubj_02 3068 0.66 0.15 0.89 149 XMGenDplmaNmb 2861 0.98 1.31 0.83 150 XM_ShortIntro_01 2848 0.71 0.44 0.83 151 XMLngstWrd_00 2797 1.02 1.49 0.81 152 RCVD_IN_RP_SAFE 2732 0.72 0.54 0.79 153 XMHTML_After_End 2707 0.86 1.04 0.79 154 T_OBFU_PDF_ATTACH 2677 0.56 0.08 0.78 155 SpammyFromTLD_01 2559 1.64 3.67 0.74 156 TR_MetaPhish_Combo_01 2465 0.78 0.94 0.72 157 XMNoVowels 2435 0.64 0.48 0.71 158 RCVD_IN_RP_CERTIFIED 2412 0.62 0.44 0.70 159 XM_B_SpammyWords4 2399 1.10 2.00 0.70 160 DIET_1 2365 0.73 0.82 0.69 161 RELAYCOUNTRY_AU 2355 1.20 2.37 0.68 162 MSGID_NOFQDN1 2354 0.48 0.02 0.68 163 FILL_THIS_FORM 2260 0.75 0.96 0.66 164 XMSubNoVowel 2213 0.63 0.59 0.64 165 SHORT_HELO_AND_INLINE_IMAGE 2208 0.46 0.04 0.64 166 XMBdyGiftCard01 2201 0.82 1.21 0.64 167 HTML_IMAGE_ONLY_32 2172 0.55 0.36 0.63 168 TR_XM_Base64_M1 2128 0.65 0.72 0.62 169 XM_H_Trusted_IP 2115 0.43 0.00 0.61 170 TR_XM_FormFill2 2102 1.04 2.01 0.61 171 TR_XM_PHPForged 2099 1.06 2.09 0.61 172 USER_IN_WELCOMELIST 2090 0.42 0.00 0.61 173 USER_IN_WHITELIST 2090 0.42 0.00 0.61 174 NML_ADSP_CUSTOM_MED 2084 0.66 0.78 0.61 175 TR_XM_PHPDW 2064 1.05 2.05 0.60 176 XM_H_PHPOS 2006 1.02 1.99 0.58 177 XM_B_FormFill 1984 0.41 0.03 0.58 178 FROM_GOV_DKIM_AU 1979 0.47 0.23 0.58 179 TO_NO_BRKTS_HTML_ONLY 1909 0.50 0.36 0.55 180 RCVD_IN_BL_SPAMCOP_NET 1888 5.57 16.88 0.55 181 XMBody_17 1797 2.43 6.72 0.52 182 XMPhish30 1787 0.72 1.18 0.52 183 XMBrknScrpt_02 1765 0.72 1.20 0.51 184 FORGED_GMAIL_RCVD 1756 0.59 0.76 0.51 185 HTML_TAG_BALANCE_BODY 1744 0.85 1.62 0.51 186 T_XMDrugObfuBody_00 1735 0.65 0.98 0.50 187 MPART_ALT_DIFF_COUNT 1729 0.60 0.82 0.50 188 RCVD_IN_SORBS_DUL 1727 0.36 0.03 0.50 189 XM_B_COPY_HTML 1721 0.62 0.89 0.50 190 TM2_M_BODY_EMPTY 1699 0.38 0.11 0.49 191 XMSubMetaSxObfu_02 1684 0.57 0.75 0.49 192 RELAYCOUNTRY_GB 1661 0.64 0.99 0.48 193 HTML_IMAGE_ONLY_28 1650 0.41 0.26 0.48 194 T_Symld_Words_02 1643 0.53 0.66 0.48 195 HTML_IMAGE_ONLY_20 1627 0.67 1.11 0.47 196 MISSING_HEADERS 1616 0.71 1.26 0.47 197 XM_B_DNDMA 1606 0.73 1.32 0.47 198 XMSubMetaI_00 1559 0.71 1.30 0.45 199 XMSubMetaSxObfu_03 1552 0.69 1.24 0.45 200 XMMoneyMeta_00 1526 0.46 0.50 0.44 ----------------------------------------------------------------------