Email: 532089 Autolearn: 0 AvgScore: 3.86 AvgScanTime: 1.35 sec Spam: 163841 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 1.43 sec Ham: 368248 Autolearn: 0 AvgScore: -0.49 AvgScanTime: 1.32 sec Time Spent Running SA: 200.02 hours Time Spent Processing Spam: 65.10 hours Time Spent Processing Ham: 134.92 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157296 87.72 96.01 84.03 2 DKIM_SIGNED 144815 78.98 88.39 74.79 3 XM_DK_Pass 139748 77.05 85.29 73.38 4 XM_B_Unicode 138960 72.99 84.81 67.72 5 DKIM_VALID 137069 75.78 83.66 72.27 6 T_SCC_BODY_TEXT_LINE 133691 82.75 81.60 83.26 7 RELAYCOUNTRY_US 127642 80.48 77.91 81.62 8 DCC_CHECK 120466 44.82 73.53 32.04 9 XM_B_SpammyWords 119371 52.44 72.86 43.35 10 XMListUnsubscribeExists 115295 54.61 70.37 47.60 11 DKIM_VALID_AU 100262 58.59 61.19 57.44 12 XM_B_Unicode3 75428 41.17 46.04 39.00 13 XM_DK_Undo_02 72898 17.59 44.49 5.62 14 XM_B_SpammyWords2 69769 25.16 42.58 17.41 15 BAYES_50 65032 52.91 39.69 58.78 16 LOC_TINY_FONT_1 61756 27.81 37.69 23.42 17 MIME_HTML_ONLY 58804 24.00 35.89 18.70 18 TR_XM_DKIM_Undo 57781 12.39 35.27 2.21 19 HTML_FONT_LOW_CONTRAST 57539 29.14 35.12 26.47 20 BAYES_99 57126 13.87 34.87 4.52 21 DKIM_VALID_EF 53007 29.69 32.35 28.50 22 FVGT_m_MULTI_ODD 48937 26.61 29.87 25.16 23 T_KAM_HTML_FONT_INVALID 46374 23.03 28.30 20.69 24 BAYES_999 45207 10.93 27.59 3.52 25 DCC_CHECK_NEGATIVE 43358 55.15 26.46 67.91 26 TR_DCC_Bayes_99 41068 8.91 25.07 1.73 27 TR_XM_DK_Unsub 39898 16.41 24.35 12.87 28 T_TM2_M_HEADER_IN_MSG 39767 28.46 24.27 30.32 29 RCVD_IN_MSPIKE_H2 38354 23.36 23.41 23.33 30 XMSubLong 37355 23.07 22.80 23.19 31 RELAYCOUNTRY_META 36473 10.13 22.26 4.74 32 XM_Multi_Part_URI 30577 15.19 18.66 13.64 33 TR_XM_SpammyRelay 29768 7.04 18.17 2.09 34 XM_B_Unsub 25569 10.57 15.61 8.33 35 BOTNET_IPINHOSTNAME 24877 7.73 15.18 4.41 36 TR_XM_BayesUnsub 24637 9.25 15.04 6.68 37 XM_B_SpammyWords3 23493 7.35 14.34 4.24 38 TR_XM_SpammyWords2 23487 4.70 14.34 0.42 39 RCVD_IN_BL_SPAMCOP_NET 23162 4.81 14.14 0.66 40 UNPARSEABLE_RELAY 23115 11.46 14.11 10.28 41 RELAYCOUNTRY_CA 20383 4.52 12.44 1.00 42 LOTS_OF_MONEY 19773 7.61 12.07 5.62 43 BOTNET 19121 4.43 11.67 1.20 44 TR_XM_SPAMCOP 18684 3.68 11.40 0.25 45 RCVD_IN_MSPIKE_WL 17846 7.62 10.89 6.17 46 RCVD_IN_MSPIKE_H3 17846 7.62 10.89 6.17 47 TR_XM_SpammyWords4 17599 5.84 10.74 3.67 48 FSL_BULK_SIG 17118 5.66 10.45 3.53 49 XM_Body_Dirty_Words 16033 5.87 9.79 4.13 50 XM_Evil_Numbers_Gen 15969 8.31 9.75 7.68 51 BAYES_80 14145 5.42 8.63 3.99 52 BAYES_60 12275 8.42 7.49 8.84 53 XMSubMetaSx_00 12194 4.98 7.44 3.89 54 TR_XM_UnparsRelay 11699 3.38 7.14 1.71 55 XM_UncommonTLD01 11634 4.86 7.10 3.86 56 LotsOfNums_01 11588 8.04 7.07 8.48 57 UNTRUSTED_Relay 11552 3.25 7.05 1.56 58 HTML_IMAGE_RATIO_02 10740 5.37 6.56 4.84 59 MPART_ALT_DIFF 10527 4.90 6.43 4.23 60 XMSexyCombo_05 10037 2.91 6.13 1.47 61 XMBody_17 9871 2.20 6.02 0.49 62 HTML_IMAGE_RATIO_06 9217 3.97 5.63 3.23 63 T_FILL_THIS_FORM_SHORT 9014 2.35 5.50 0.94 64 XM_H_Long_From01 8562 5.41 5.23 5.49 65 BAYES_95 8469 3.25 5.17 2.40 66 XM_B_Investor 8328 2.79 5.08 1.78 67 HTML_IMAGE_RATIO_04 8232 4.38 5.02 4.09 68 XM_B_Phish_Phrases 8096 3.75 4.94 3.22 69 TooManyTo_001 8054 7.67 4.92 8.90 70 TR_XM_SpammyWords5 8017 2.37 4.89 1.25 71 DKIM_INVALID 7746 3.20 4.73 2.52 72 TR_XM_BayesRelay 7005 1.32 4.28 0.00 73 XMNumbers 6927 3.03 4.23 2.50 74 TR_XM_PhishingBody 6819 2.43 4.16 1.66 75 XM_SPF_SoftFail 6689 3.31 4.08 2.96 76 MIME_HTML_MOSTLY 6615 2.78 4.04 2.23 77 T_XMDrugObfuBody_08 6553 2.38 4.00 1.67 78 T_XMDrugObfuBody_14 6492 2.50 3.96 1.85 79 XM_OfRef6 6478 2.27 3.95 1.52 80 MIME_HTML_ONLY_MULTI 6353 2.95 3.88 2.54 81 SpammyFromTLD_01 6262 1.79 3.82 0.89 82 XM_H_GMP 6251 5.68 3.82 6.51 83 XMStrtUSub 6229 4.43 3.80 4.71 84 HTML_IMAGE_RATIO_08 6189 2.83 3.78 2.41 85 TM2_M_URI_OPT_OUT 5881 2.33 3.59 1.77 86 XM_UB50 5864 1.75 3.58 0.93 87 TR_XM_FormFill 5782 1.10 3.53 0.01 88 MIME_QP_LONG_LINE 5146 4.64 3.14 5.30 89 FONT_INVIS_LONG_LINE 5139 1.00 3.14 0.05 90 RCVD_IN_VALIDITY_SAFE 5116 3.70 3.12 3.96 91 T_TooManySym_01 4785 5.65 2.92 6.86 92 XM_B_SpammyTLD 4771 2.80 2.91 2.74 93 TR_Mismatch_TLD_02 4669 0.94 2.85 0.09 94 XM_CamelCaseFrm001 4545 2.47 2.77 2.34 95 TM2_M_VERY_LONG_WORD 4489 1.69 2.74 1.23 96 T_REMOTE_IMAGE 4435 3.27 2.71 3.52 97 USER_IN_DEF_DKIM_WL 4305 8.70 2.63 11.41 98 XMDiploma_00 4202 1.96 2.56 1.69 99 XM_URI_RBL 4161 0.87 2.54 0.13 100 HK_RANDOM_REPLYTO 4135 0.85 2.52 0.10 101 HTML_MIME_NO_HTML_TAG 4100 2.28 2.50 2.19 102 XM_B_Unsub2 4043 1.93 2.47 1.70 103 RCVD_IN_VALIDITY_CERTIFIED 4023 3.19 2.46 3.52 104 RELAYCOUNTRY_AU 3806 1.21 2.32 0.71 105 KHOP_HELO_FCRDNS 3712 1.68 2.27 1.41 106 TR_XM_NoHeaderRelay 3661 0.77 2.23 0.11 107 XM_B_SpammyWords4 3621 1.20 2.21 0.76 108 TR_LOTS_OF_MONEY3 3605 0.93 2.20 0.37 109 TR_XM_PHPForged 3453 0.97 2.11 0.46 110 SUBJ_ALL_CAPS 3356 1.56 2.05 1.35 111 TR_XM_PHPDW 3327 0.93 2.03 0.44 112 TR_XM_FormFill2 3265 0.93 1.99 0.45 113 XM_DK_Undo_01 3258 1.97 1.99 1.95 114 XM_H_PHPOS 3237 0.91 1.98 0.43 115 BOTNET_NORDNS 3230 0.62 1.97 0.01 116 MAILING_LIST_MULTI 3095 3.65 1.89 4.44 117 FROM_EXCESS_BASE64 3043 2.17 1.86 2.31 118 ANY_BOUNCE_MESSAGE 2950 3.73 1.80 4.59 119 BOUNCE_MESSAGE 2949 3.73 1.80 4.58 120 HTTPS_HTTP_MISMATCH 2944 1.15 1.80 0.87 121 XMStockSpam_06 2938 1.06 1.79 0.73 122 URI_HEX 2931 1.28 1.79 1.06 123 RCVD_IN_IADB_LISTED 2894 3.56 1.77 4.36 124 T_XMHurry_00 2860 0.88 1.75 0.50 125 XM_DIRTYINTL 2857 0.72 1.74 0.27 126 RCVD_IN_PSBL 2753 0.68 1.68 0.23 127 TR_XM_INV_DKIM 2740 0.56 1.67 0.06 128 BAYES_40 2599 3.76 1.59 4.72 129 SpammyFromTLD_02 2572 0.78 1.57 0.43 130 RCVD_IN_VALIDITY_RPBL 2550 0.52 1.56 0.06 131 XMBdyGiftCard01 2526 0.84 1.54 0.52 132 RCVD_IN_IADB_SPF 2481 3.14 1.51 3.86 133 XMSexyCombo_01 2427 0.71 1.48 0.36 134 DATE_IN_PAST_03_06 2413 0.56 1.47 0.15 135 RCVD_IN_IADB_DK 2337 2.80 1.43 3.41 136 RCVD_IN_IADB_SENDERID 2318 2.86 1.41 3.50 137 XMReplyNow 2317 0.62 1.41 0.26 138 HTML_TAG_BALANCE_BODY 2274 0.72 1.39 0.43 139 XM_SendGrid 2238 1.37 1.37 1.38 140 ALL_TRUSTED 2228 11.06 1.36 15.37 141 XMGenDplmaNmb 2203 1.12 1.34 1.02 142 XM_HighProb1 2183 0.41 1.33 0.00 143 XMPhish30 2165 0.76 1.32 0.51 144 XM_H_PHPMailer 2130 0.96 1.30 0.81 145 XMHTML_After_End 2099 0.90 1.28 0.73 146 AC_BR_BONANZA 2075 0.44 1.27 0.07 147 XM_UB99 2057 0.39 1.26 0.01 148 XMSubMetaI_00 2052 0.81 1.25 0.61 149 URI_TRY_3LD 2031 0.92 1.24 0.78 150 BAYES_20 1997 2.79 1.22 3.49 151 DIET_1 1987 0.53 1.21 0.23 152 T_XMDrugObfuBody_00 1942 0.72 1.19 0.52 153 XMPhish14 1941 0.69 1.18 0.47 154 XMLngstWrd_00 1940 0.92 1.18 0.80 155 TR_XM_InvalidRelay 1919 0.38 1.17 0.03 156 HTML_IMAGE_ONLY_32 1882 0.66 1.15 0.44 157 XMBrknScrpt_02 1863 0.72 1.14 0.53 158 PLING_QUERY 1862 0.72 1.14 0.54 159 TM2_M_A_HREF_HREF 1837 0.51 1.12 0.24 160 URI_NOVOWEL 1758 1.50 1.07 1.68 161 TR_Symld_Words 1748 1.41 1.07 1.56 162 DKIM_ADSP_NXDOMAIN 1735 0.52 1.06 0.28 163 XMSlimDrugH 1699 0.53 1.04 0.31 164 XM_B_DNDMA 1665 0.51 1.02 0.28 165 TR_XM_RelayPhish 1654 0.35 1.01 0.06 166 TR_XM_Base64_M1 1641 0.88 1.00 0.83 167 T_XMDrugObfuBody_10 1635 0.32 1.00 0.02 168 NO_DNS_FOR_FROM 1634 0.47 1.00 0.23 169 XM_B_COPY_HTML 1622 0.71 0.99 0.59 170 RDNS_DYNAMIC 1612 0.69 0.98 0.56 171 XM_H_Long_From02 1580 0.99 0.96 1.01 172 XM_DrugUnitList 1573 0.30 0.96 0.00 173 RELAYCOUNTRY_IN 1556 0.33 0.95 0.06 174 XM_UB999 1535 0.29 0.94 0.01 175 THIS_AD 1527 0.51 0.93 0.32 176 XM_B_Phish66 1526 0.52 0.93 0.33 177 RELAYCOUNTRY_FR 1515 0.45 0.92 0.24 178 XMBody_78 1497 0.55 0.91 0.39 179 TR_Caps_n_Bayes_99 1490 0.29 0.91 0.02 180 TR_XM_DK_SendGrid 1469 0.91 0.90 0.92 181 XM_ProductURIs 1450 0.76 0.89 0.70 182 DKIM_ADSP_CUSTOM_MED 1436 0.84 0.88 0.83 183 XMSubMetaSxObfu_03 1405 0.65 0.86 0.56 184 RCVD_IN_IADB_VOUCHED 1345 2.09 0.82 2.65 185 T_MONEY_PERCENT 1341 0.38 0.82 0.18 186 TR_LOTS_OF_MONEY2 1341 0.38 0.82 0.18 187 HOSTED_IMG_MULTI_PUB_01 1327 0.25 0.81 0.01 188 XM_H_PHPOS_M 1308 0.30 0.80 0.08 189 SHOPIFY_IMG_NOT_RCVD_SFY 1304 0.41 0.80 0.23 190 URIBL_DBL_SPAM 1291 0.25 0.79 0.01 191 XM_UB60 1285 0.29 0.78 0.07 192 XM_B_COVIDMETA 1281 0.34 0.78 0.15 193 XM_H_Undi_Recip 1279 0.40 0.78 0.23 194 TVD_RCVD_IP 1272 1.21 0.78 1.40 195 TR_MetaPhish_Combo_01 1263 0.79 0.77 0.80 196 NML_ADSP_CUSTOM_MED 1253 0.61 0.76 0.54 197 FORGED_GMAIL_RCVD 1250 0.56 0.76 0.46 198 T_TooManySym_02 1249 2.71 0.76 3.58 199 TooManyTo_002 1224 2.01 0.75 2.57 200 RELAYCOUNTRY_CN 1213 0.29 0.74 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 309445 87.72 96.01 84.03 2 T_SCC_BODY_TEXT_LINE 306607 82.75 81.60 83.26 3 RELAYCOUNTRY_US 300567 80.48 77.91 81.62 4 DKIM_SIGNED 275404 78.98 88.39 74.79 5 XM_DK_Pass 270211 77.05 85.29 73.38 6 DKIM_VALID 266140 75.78 83.66 72.27 7 DCC_CHECK_NEGATIVE 250092 55.15 26.46 67.91 8 XM_B_Unicode 249392 72.99 84.81 67.72 9 BAYES_50 216474 52.91 39.69 58.78 10 DKIM_VALID_AU 211508 58.59 61.19 57.44 11 XMListUnsubscribeExists 175294 54.61 70.37 47.60 12 XM_B_SpammyWords 159630 52.44 72.86 43.35 13 XM_B_Unicode3 143615 41.17 46.04 39.00 14 DCC_CHECK 117999 44.82 73.53 32.04 15 T_TM2_M_HEADER_IN_MSG 111666 28.46 24.27 30.32 16 DKIM_VALID_EF 104964 29.69 32.35 28.50 17 HTML_FONT_LOW_CONTRAST 97486 29.14 35.12 26.47 18 FVGT_m_MULTI_ODD 92668 26.61 29.87 25.16 19 LOC_TINY_FONT_1 86238 27.81 37.69 23.42 20 RCVD_IN_MSPIKE_H2 85917 23.36 23.41 23.33 21 XMSubLong 85415 23.07 22.80 23.19 22 T_KAM_HTML_FONT_INVALID 76183 23.03 28.30 20.69 23 MIME_HTML_ONLY 68873 24.00 35.89 18.70 24 XM_B_SpammyWords2 64121 25.16 42.58 17.41 25 ALL_TRUSTED 56611 11.06 1.36 15.37 26 XM_Multi_Part_URI 50228 15.19 18.66 13.64 27 TR_XM_DK_Unsub 47405 16.41 24.35 12.87 28 USER_IN_DEF_DKIM_WL 42008 8.70 2.63 11.41 29 BAYES_00 38927 7.50 0.61 10.57 30 UNPARSEABLE_RELAY 37853 11.46 14.11 10.28 31 TooManyTo_001 32764 7.67 4.92 8.90 32 BAYES_60 32545 8.42 7.49 8.84 33 LotsOfNums_01 31215 8.04 7.07 8.48 34 XM_B_Unsub 30693 10.57 15.61 8.33 35 XM_DKIMWhitelistDomains 29446 5.55 0.07 8.00 36 XM_Evil_Numbers_Gen 28268 8.31 9.75 7.68 37 T_TooManySym_01 25253 5.65 2.92 6.86 38 TR_XM_DK_Bayes 25150 4.86 0.43 6.83 39 IN_ZIMBRA_NJ_WHITELIST 24924 4.71 0.07 6.77 40 TR_XM_BayesUnsub 24581 9.25 15.04 6.68 41 TR_XM_DK_Bayes1 24361 4.71 0.43 6.62 42 XM_H_GMP 23957 5.68 3.82 6.51 43 RCVD_IN_MSPIKE_WL 22724 7.62 10.89 6.17 44 RCVD_IN_MSPIKE_H3 22723 7.62 10.89 6.17 45 TR_XM_DK_Bayes2 21022 4.05 0.32 5.71 46 LOTS_OF_MONEY 20710 7.61 12.07 5.62 47 XM_DK_Undo_02 20708 17.59 44.49 5.62 48 XM_H_Long_From01 20227 5.41 5.23 5.49 49 MIME_QP_LONG_LINE 19527 4.64 3.14 5.30 50 HTML_IMAGE_RATIO_02 17813 5.37 6.56 4.84 51 RELAYCOUNTRY_META 17442 10.13 22.26 4.74 52 BAYES_40 17399 3.76 1.59 4.72 53 XMStrtUSub 17343 4.43 3.80 4.71 54 XM_PDF 16987 3.33 0.44 4.61 55 ANY_BOUNCE_MESSAGE 16885 3.73 1.80 4.59 56 BOUNCE_MESSAGE 16881 3.73 1.80 4.58 57 BAYES_99 16659 13.87 34.87 4.52 58 MAILING_LIST_MULTI 16337 3.65 1.89 4.44 59 BOTNET_IPINHOSTNAME 16227 7.73 15.18 4.41 60 RCVD_IN_IADB_LISTED 16071 3.56 1.77 4.36 61 XM_B_SpammyWords3 15604 7.35 14.34 4.24 62 MPART_ALT_DIFF 15564 4.90 6.43 4.23 63 XM_Body_Dirty_Words 15216 5.87 9.79 4.13 64 HTML_IMAGE_RATIO_04 15049 4.38 5.02 4.09 65 BAYES_80 14701 5.42 8.63 3.99 66 RCVD_IN_VALIDITY_SAFE 14569 3.70 3.12 3.96 67 XMSubMetaSx_00 14319 4.98 7.44 3.89 68 RCVD_IN_IADB_SPF 14227 3.14 1.51 3.86 69 XM_UncommonTLD01 14199 4.86 7.10 3.86 70 TR_XM_SpammyWords4 13501 5.84 10.74 3.67 71 T_TooManySym_02 13187 2.71 0.76 3.58 72 FSL_BULK_SIG 13009 5.66 10.45 3.53 73 T_REMOTE_IMAGE 12980 3.27 2.71 3.52 74 BAYES_999 12975 10.93 27.59 3.52 75 RCVD_IN_VALIDITY_CERTIFIED 12959 3.19 2.46 3.52 76 RCVD_IN_IADB_SENDERID 12875 2.86 1.41 3.50 77 BAYES_20 12846 2.79 1.22 3.49 78 RCVD_IN_IADB_DK 12548 2.80 1.43 3.41 79 HTML_IMAGE_RATIO_06 11904 3.97 5.63 3.23 80 XM_B_Phish_Phrases 11872 3.75 4.94 3.22 81 XM_SPF_SoftFail 10900 3.31 4.08 2.96 82 SCC_BODY_URI_ONLY 10452 2.17 0.68 2.84 83 XM_B_SpammyTLD 10101 2.80 2.91 2.74 84 BAYES_05 9857 2.08 0.73 2.68 85 RCVD_IN_IADB_VOUCHED 9764 2.09 0.82 2.65 86 TooManyTo_002 9461 2.01 0.75 2.57 87 MIME_HTML_ONLY_MULTI 9342 2.95 3.88 2.54 88 DKIM_INVALID 9264 3.20 4.73 2.52 89 XMNumbers 9188 3.03 4.23 2.50 90 HTML_IMAGE_RATIO_08 8880 2.83 3.78 2.41 91 BAYES_95 8838 3.25 5.17 2.40 92 XM_CamelCaseFrm001 8609 2.47 2.77 2.34 93 FROM_EXCESS_BASE64 8494 2.17 1.86 2.31 94 MIME_HTML_MOSTLY 8200 2.78 4.04 2.23 95 XMNoVowels 8152 1.67 0.43 2.21 96 TR_XM_DKIM_Undo 8126 12.39 35.27 2.21 97 HTML_MIME_NO_HTML_TAG 8048 2.28 2.50 2.19 98 TR_XM_SpammyRelay 7694 7.04 18.17 2.09 99 HELO_NODOT 7297 1.59 0.71 1.98 100 HELO_NO_DOMAIN 7289 1.59 0.71 1.98 101 INVALID_MSGID 7286 1.43 0.20 1.98 102 XM_DK_Undo_01 7199 1.97 1.99 1.95 103 T_XMDrugObfuBody_14 6827 2.50 3.96 1.85 104 RCVD_IN_IADB_OPTIN 6570 1.39 0.49 1.78 105 XM_B_Investor 6538 2.79 5.08 1.78 106 TM2_M_URI_OPT_OUT 6528 2.33 3.59 1.77 107 TR_DCC_Bayes_99 6354 8.91 25.07 1.73 108 TO_MALFORMED 6319 1.19 0.01 1.72 109 TR_XM_UnparsRelay 6294 3.38 7.14 1.71 110 XM_B_Unsub2 6245 1.93 2.47 1.70 111 XMDiploma_00 6214 1.96 2.56 1.69 112 URI_NOVOWEL 6199 1.50 1.07 1.68 113 T_XMDrugObfuBody_08 6137 2.38 4.00 1.67 114 TR_XM_PhishingBody 6126 2.43 4.16 1.66 115 XMGappySubj_01 6085 1.20 0.20 1.65 116 UNTRUSTED_Relay 5746 3.25 7.05 1.56 117 TR_Symld_Words 5729 1.41 1.07 1.56 118 XM_OfRef6 5590 2.27 3.95 1.52 119 TooManyTo_003 5439 1.23 0.67 1.48 120 XMSexyCombo_05 5430 2.91 6.13 1.47 121 KHOP_HELO_FCRDNS 5208 1.68 2.27 1.41 122 XM_H_Trusted_IP 5173 0.97 0.00 1.40 123 T_TooManySym_03 5163 1.06 0.30 1.40 124 TVD_RCVD_IP 5159 1.21 0.78 1.40 125 IN_HORDE_ADDRESS_BOOK 5131 0.99 0.09 1.39 126 XM_GoogleGroups 5084 1.09 0.44 1.38 127 XM_SendGrid 5072 1.37 1.37 1.38 128 SUBJ_ALL_CAPS 4971 1.56 2.05 1.35 129 TR_XM_SpammyWords5 4589 2.37 4.89 1.25 130 TM2_M_VERY_LONG_WORD 4515 1.69 2.74 1.23 131 BOTNET 4428 4.43 11.67 1.20 132 XMCapTrack 4386 0.93 0.36 1.19 133 XMBody_95 4303 0.87 0.19 1.17 134 XMBSHREFv2 4288 0.90 0.30 1.16 135 TooManyTo_004 4031 0.94 0.61 1.09 136 TVD_SPACE_RATIO 3973 0.77 0.08 1.08 137 URI_HEX 3897 1.28 1.79 1.06 138 XMGenDplmaNmb 3746 1.12 1.34 1.02 139 XM_H_Long_From02 3706 0.99 0.96 1.01 140 RELAYCOUNTRY_CA 3679 4.52 12.44 1.00 141 RELAYCOUNTRY_NL 3486 0.85 0.63 0.95 142 T_FILL_THIS_FORM_SHORT 3475 2.35 5.50 0.94 143 XM_UB50 3426 1.75 3.58 0.93 144 TR_XM_DK_SendGrid 3383 0.91 0.90 0.92 145 TooManyTo_005 3372 0.81 0.57 0.92 146 XMSubNoVowel 3335 0.75 0.42 0.91 147 SpammyFromTLD_01 3277 1.79 3.82 0.89 148 XMGappySubj_02 3224 0.64 0.11 0.88 149 HTTPS_HTTP_MISMATCH 3191 1.15 1.80 0.87 150 DKIM_ADSP_CUSTOM_MED 3056 0.84 0.88 0.83 151 TR_XM_Base64_M1 3043 0.88 1.00 0.83 152 XM_H_PHPMailer 2995 0.96 1.30 0.81 153 TR_MetaPhish_Combo_01 2956 0.79 0.77 0.80 154 XMLngstWrd_00 2938 0.92 1.18 0.80 155 URI_TRY_3LD 2870 0.92 1.24 0.78 156 RCVD_IN_RP_SAFE 2827 0.72 0.60 0.77 157 XM_B_SpammyWords4 2786 1.20 2.21 0.76 158 XMStockSpam_06 2695 1.06 1.79 0.73 159 XMHTML_After_End 2670 0.90 1.28 0.73 160 FILL_THIS_FORM 2645 0.58 0.27 0.72 161 RELAYCOUNTRY_AU 2623 1.21 2.32 0.71 162 XM_ShortIntro_01 2600 0.67 0.57 0.71 163 XM_ProductURIs 2581 0.76 0.89 0.70 164 FROM_GOV_DKIM_AU 2534 0.53 0.18 0.69 165 T_TooManySym_04 2526 0.51 0.13 0.69 166 RCVD_IN_RP_CERTIFIED 2432 0.61 0.50 0.66 167 RCVD_IN_BL_SPAMCOP_NET 2415 4.81 14.14 0.66 168 MSGID_NOFQDN1 2376 0.45 0.01 0.65 169 T_OBFU_PDF_ATTACH 2318 0.46 0.08 0.63 170 SHORT_HELO_AND_INLINE_IMAGE 2270 0.44 0.04 0.62 171 XMSubMetaI_00 2251 0.81 1.25 0.61 172 XM_B_COPY_HTML 2168 0.71 0.99 0.59 173 USER_IN_WHITELIST 2149 0.40 0.00 0.58 174 USER_IN_WELCOMELIST 2149 0.40 0.00 0.58 175 XMMoneyMeta_00 2082 0.61 0.71 0.57 176 RDNS_DYNAMIC 2058 0.69 0.98 0.56 177 XMSubMetaSxObfu_03 2053 0.65 0.86 0.56 178 T_Symld_Words_02 2037 0.60 0.70 0.55 179 NML_ADSP_CUSTOM_MED 1987 0.61 0.76 0.54 180 PLING_QUERY 1985 0.72 1.14 0.54 181 XMBrknScrpt_02 1968 0.72 1.14 0.53 182 XMBdyGiftCard01 1929 0.84 1.54 0.52 183 T_XMDrugObfuBody_00 1902 0.72 1.19 0.52 184 MPART_ALT_DIFF_COUNT 1880 0.56 0.67 0.51 185 XMPhish30 1877 0.76 1.32 0.51 186 RELAYCOUNTRY_GB 1850 0.54 0.63 0.50 187 T_XMHurry_00 1827 0.88 1.75 0.50 188 XMBody_17 1811 2.20 6.02 0.49 189 TO_NO_BRKTS_HTML_ONLY 1747 0.39 0.20 0.47 190 XMPhish14 1744 0.69 1.18 0.47 191 FORGED_GMAIL_RCVD 1710 0.56 0.76 0.46 192 HTML_IMAGE_ONLY_28 1709 0.43 0.36 0.46 193 FILL_THIS_FORM_LONG 1684 0.38 0.19 0.46 194 TR_XM_PHPForged 1682 0.97 2.11 0.46 195 HTML_IMAGE_ONLY_20 1680 0.54 0.72 0.46 196 XM_B_FormFill 1662 0.32 0.04 0.45 197 TR_XM_FormFill2 1659 0.93 1.99 0.45 198 HTML_IMAGE_ONLY_32 1635 0.66 1.15 0.44 199 TR_XM_PHPDW 1628 0.93 2.03 0.44 200 XM_H_PHPOS 1595 0.91 1.98 0.43 ----------------------------------------------------------------------