Email: 518351 Autolearn: 0 AvgScore: 4.29 AvgScanTime: 1.36 sec Spam: 169821 Autolearn: 0 AvgScore: 13.80 AvgScanTime: 1.49 sec Ham: 348530 Autolearn: 0 AvgScore: -0.34 AvgScanTime: 1.29 sec Time Spent Running SA: 195.11 hours Time Spent Processing Spam: 70.10 hours Time Spent Processing Ham: 125.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164861 88.79 97.08 84.76 2 DKIM_SIGNED 155658 79.96 91.66 74.27 3 XM_DK_Pass 150317 77.90 88.51 72.73 4 DKIM_VALID 147742 76.73 87.00 71.73 5 XM_B_Unicode 145468 74.00 85.66 68.32 6 T_SCC_BODY_TEXT_LINE 138499 82.75 81.56 83.33 7 RELAYCOUNTRY_US 133459 80.24 78.59 81.05 8 DCC_CHECK 127092 47.84 74.84 34.69 9 XM_B_SpammyWords 125284 53.57 73.77 43.72 10 XMListUnsubscribeExists 123638 57.45 72.80 49.97 11 DKIM_VALID_AU 107007 59.06 63.01 57.14 12 XM_DK_Undo_02 81623 19.09 48.06 4.98 13 XM_B_Unicode3 78053 42.06 45.96 40.16 14 TR_MAX_INTL_RELAY 73217 18.17 43.11 6.01 15 XM_B_SpammyWords2 71249 25.95 41.96 18.15 16 LOC_TINY_FONT_1 67343 28.88 39.66 23.63 17 BAYES_50 63839 51.51 37.59 58.30 18 TR_XM_DKIM_Undo 63825 13.75 37.58 2.14 19 BAYES_99 63146 14.77 37.18 3.85 20 HTML_FONT_LOW_CONTRAST 61070 30.11 35.96 27.26 21 MIME_HTML_ONLY 59494 24.43 35.03 19.27 22 DKIM_VALID_EF 56766 29.73 33.43 27.93 23 FVGT_m_MULTI_ODD 56105 28.14 33.04 25.75 24 BAYES_999 49851 11.61 29.36 2.97 25 T_KAM_HTML_FONT_INVALID 49743 23.23 29.29 20.28 26 TR_DCC_Bayes_99 46274 9.81 27.25 1.31 27 TR_XM_DK_Unsub 42915 17.30 25.27 13.41 28 DCC_CHECK_NEGATIVE 42702 52.12 25.15 65.27 29 RCVD_IN_MSPIKE_H2 39656 23.49 23.35 23.56 30 T_TM2_M_HEADER_IN_MSG 38781 26.65 22.84 28.50 31 XMSubLong 38157 22.46 22.47 22.46 32 RELAYCOUNTRY_META 36467 9.77 21.47 4.07 33 XM_Multi_Part_URI 33215 15.47 19.56 13.48 34 TR_XM_SpammyRelay 31019 7.42 18.27 2.14 35 XM_B_Unsub 27717 10.64 16.32 7.88 36 TR_XM_BayesUnsub 26809 9.31 15.79 6.15 37 RCVD_IN_BL_SPAMCOP_NET 25604 5.46 15.08 0.78 38 UNPARSEABLE_RELAY 24784 11.57 14.59 10.10 39 BOTNET_IPINHOSTNAME 24751 8.22 14.57 5.12 40 TR_XM_SpammyWords2 24180 4.91 14.24 0.36 41 RELAYCOUNTRY_CA 21884 4.96 12.89 1.09 42 TR_XM_SPAMCOP 21624 4.38 12.73 0.31 43 XM_B_SpammyWords3 21395 6.93 12.60 4.17 44 LOTS_OF_MONEY 20276 7.90 11.94 5.93 45 RCVD_IN_MSPIKE_WL 19825 8.26 11.67 6.60 46 RCVD_IN_MSPIKE_H3 19825 8.26 11.67 6.60 47 TR_XM_SpammyWords4 17761 6.05 10.46 3.90 48 BOTNET 16008 3.88 9.43 1.18 49 XM_Evil_Numbers_Gen 15856 7.86 9.34 7.14 50 FSL_BULK_SIG 15682 5.67 9.23 3.94 51 XM_Body_Dirty_Words 14954 5.74 8.81 4.25 52 TR_XM_UnparsRelay 13904 3.69 8.19 1.50 53 BAYES_80 13870 5.52 8.17 4.23 54 XMBody_17 13234 2.89 7.79 0.51 55 BAYES_60 12715 8.58 7.49 9.11 56 HTML_IMAGE_RATIO_02 12054 5.82 7.10 5.19 57 XMSubMetaSx_00 11900 4.93 7.01 3.92 58 LotsOfNums_01 11527 7.73 6.79 8.19 59 MPART_ALT_DIFF 10212 4.45 6.01 3.68 60 XM_UncommonTLD01 9860 4.54 5.81 3.93 61 HTML_IMAGE_RATIO_04 9726 4.51 5.73 3.92 62 BAYES_95 9721 3.33 5.72 2.16 63 T_FILL_THIS_FORM_SHORT 9599 2.42 5.65 0.85 64 UNTRUSTED_Relay 9346 2.84 5.50 1.54 65 XM_B_Investor 9159 2.84 5.39 1.60 66 XM_B_Phish_Phrases 8908 3.65 5.25 2.88 67 TR_XM_BayesRelay 8836 1.70 5.20 0.00 68 XMSexyCombo_05 8757 2.62 5.16 1.38 69 TooManyTo_001 8704 7.48 5.13 8.62 70 DKIM_INVALID 7916 3.23 4.66 2.53 71 TR_XM_SpammyWords5 7667 2.33 4.51 1.26 72 XM_H_Long_From01 7610 5.12 4.48 5.43 73 HTML_IMAGE_RATIO_06 7529 3.03 4.43 2.34 74 FONT_INVIS_LONG_LINE 7451 1.49 4.39 0.08 75 TM2_M_URI_OPT_OUT 7403 2.63 4.36 1.79 76 XM_OfRef6 7056 2.27 4.15 1.35 77 HTML_IMAGE_RATIO_08 6884 3.00 4.05 2.48 78 XMNumbers 6812 3.05 4.01 2.59 79 XM_SPF_SoftFail 6763 3.62 3.98 3.44 80 TR_XM_PhishingBody 6482 2.27 3.82 1.52 81 MIME_HTML_ONLY_MULTI 6462 2.71 3.81 2.18 82 TR_XM_FormFill 6456 1.25 3.80 0.01 83 XM_H_GMP 6352 5.39 3.74 6.19 84 MIME_HTML_MOSTLY 6351 2.70 3.74 2.19 85 RCVD_IN_VALIDITY_SAFE 6151 3.95 3.62 4.12 86 T_XMDrugObfuBody_08 6087 2.36 3.58 1.76 87 XMStrtUSub 5859 4.25 3.45 4.64 88 TM2_M_VERY_LONG_WORD 5738 1.98 3.38 1.30 89 T_XMDrugObfuBody_14 5702 2.36 3.36 1.87 90 XM_B_SpammyTLD 5493 2.82 3.23 2.61 91 USER_IN_DEF_DKIM_WL 5426 9.03 3.20 11.88 92 MIME_QP_LONG_LINE 5197 4.57 3.06 5.31 93 SpammyFromTLD_01 5082 1.60 2.99 0.92 94 RCVD_IN_VALIDITY_CERTIFIED 4947 3.38 2.91 3.61 95 XM_UB50 4575 1.51 2.69 0.93 96 RELAYCOUNTRY_AU 4441 1.34 2.62 0.71 97 XM_CamelCaseFrm001 4357 2.36 2.57 2.27 98 HK_RANDOM_REPLYTO 4227 0.88 2.49 0.10 99 XMDiploma_00 4198 1.78 2.47 1.44 100 XM_B_Unsub2 4197 1.78 2.47 1.45 101 XM_URI_RBL 4180 0.92 2.46 0.17 102 T_TooManySym_01 3986 4.42 2.35 5.43 103 T_REMOTE_IMAGE 3663 3.09 2.16 3.55 104 HTML_MIME_NO_HTML_TAG 3606 2.22 2.12 2.27 105 SUBJ_ALL_CAPS 3592 1.59 2.12 1.33 106 TR_LOTS_OF_MONEY3 3493 0.83 2.06 0.24 107 XMReplyNow 3395 0.86 2.00 0.31 108 XM_B_SpammyWords4 3321 0.99 1.96 0.51 109 URI_HEX 3258 1.36 1.92 1.09 110 TR_XM_NoHeaderRelay 3160 0.69 1.86 0.11 111 TR_Mismatch_TLD_02 3116 0.65 1.83 0.07 112 MAILING_LIST_MULTI 2996 2.47 1.76 2.82 113 TR_XM_INV_DKIM 2974 0.63 1.75 0.08 114 XM_DK_Undo_01 2923 1.87 1.72 1.94 115 RCVD_IN_IADB_LISTED 2822 3.82 1.66 4.87 116 XMStockSpam_06 2779 1.05 1.64 0.76 117 FROM_EXCESS_BASE64 2770 2.54 1.63 2.98 118 T_XMHurry_00 2744 0.80 1.62 0.40 119 TR_XM_PHPForged 2722 0.80 1.60 0.41 120 TR_XM_PHPDW 2707 0.78 1.59 0.39 121 XM_H_Long_From02 2695 1.23 1.59 1.05 122 BAYES_40 2644 3.78 1.56 4.87 123 TR_XM_FormFill2 2635 0.77 1.55 0.39 124 XM_H_PHPOS 2605 0.76 1.53 0.38 125 URI_TRY_3LD 2568 1.03 1.51 0.79 126 RCVD_IN_IADB_SPF 2534 3.41 1.49 4.34 127 BOUNCE_MESSAGE 2530 3.42 1.49 4.37 128 ANY_BOUNCE_MESSAGE 2530 3.42 1.49 4.37 129 XMBdyGiftCard01 2505 0.87 1.48 0.58 130 HTTPS_HTTP_MISMATCH 2490 1.02 1.47 0.81 131 SpammyFromTLD_02 2439 0.79 1.44 0.47 132 RCVD_IN_IADB_DK 2395 3.04 1.41 3.84 133 HTML_TAG_BALANCE_BODY 2393 0.78 1.41 0.47 134 RCVD_IN_IADB_SENDERID 2387 3.11 1.41 3.94 135 T_XMDrugObfuBody_00 2381 0.96 1.40 0.75 136 AC_BR_BONANZA 2376 0.50 1.40 0.06 137 XMLngstWrd_00 2368 0.95 1.39 0.74 138 ALL_TRUSTED 2314 11.03 1.36 15.75 139 XM_SendGrid 2288 1.38 1.35 1.39 140 XMPhish30 2285 0.81 1.35 0.56 141 XM_HighProb1 2257 0.44 1.33 0.01 142 XMGenDplmaNmb 2233 0.93 1.31 0.74 143 XM_DIRTYINTL 2155 0.59 1.27 0.26 144 BAYES_20 2042 2.82 1.20 3.61 145 XMHTML_After_End 1987 0.87 1.17 0.73 146 XMSubMetaI_00 1926 0.79 1.13 0.62 147 RCVD_IN_PSBL 1886 0.58 1.11 0.32 148 PLING_QUERY 1877 0.73 1.11 0.55 149 URI_NOVOWEL 1813 1.63 1.07 1.91 150 BOTNET_NORDNS 1802 0.36 1.06 0.01 151 XMBrknScrpt_02 1784 0.71 1.05 0.54 152 XMSexyCombo_01 1746 0.48 1.03 0.21 153 KHOP_HELO_FCRDNS 1745 1.66 1.03 1.97 154 XM_H_PHPMailer 1702 0.83 1.00 0.74 155 XM_B_DNDMA 1690 0.49 1.00 0.25 156 XMPhish14 1676 0.56 0.99 0.36 157 TR_MetaPhish_Combo_01 1664 0.84 0.98 0.77 158 TR_Symld_Words 1653 1.50 0.97 1.75 159 RCVD_IN_VALIDITY_RPBL 1628 0.34 0.96 0.03 160 RDNS_DYNAMIC 1607 1.11 0.95 1.19 161 TR_Caps_n_Bayes_99 1597 0.32 0.94 0.01 162 TR_XM_RelayPhish 1583 0.35 0.93 0.06 163 XM_UB99 1582 0.31 0.93 0.00 164 XM_Combo_Sbj 1574 0.47 0.93 0.25 165 RELAYCOUNTRY_FR 1569 0.44 0.92 0.21 166 XM_B_COVIDMETA 1558 0.43 0.92 0.20 167 T_XMDrugObfuBody_10 1522 0.32 0.90 0.04 168 T_MONEY_PERCENT 1513 0.46 0.89 0.24 169 TR_LOTS_OF_MONEY2 1513 0.46 0.89 0.24 170 NO_DNS_FOR_FROM 1512 0.46 0.89 0.25 171 SHOPIFY_IMG_NOT_RCVD_SFY 1504 0.46 0.89 0.25 172 TVD_RCVD_IP 1496 1.27 0.88 1.45 173 DKIM_ADSP_NXDOMAIN 1487 0.47 0.88 0.28 174 XM_ProductURIs 1468 0.87 0.86 0.87 175 TR_XM_DK_SendGrid 1463 0.87 0.86 0.88 176 XM_OfRef7 1458 0.42 0.86 0.20 177 SCC_BODY_URI_ONLY 1456 2.11 0.86 2.71 178 XMSubMetaSxObfu_03 1455 0.54 0.86 0.38 179 MPART_ALT_DIFF_COUNT 1436 0.65 0.85 0.55 180 TR_XM_InvalidRelay 1431 0.29 0.84 0.02 181 TooManyTo_002 1406 2.10 0.83 2.73 182 TR_XM_Base64_M1 1400 0.94 0.82 0.99 183 PDS_OTHER_BAD_TLD 1358 0.33 0.80 0.11 184 XM_B_Phish66 1357 0.46 0.80 0.29 185 HELO_DYNAMIC_SPLIT_IP 1350 0.27 0.79 0.01 186 TR_Mismatch_TLD_01 1323 0.52 0.78 0.39 187 XMLngstWrd_01 1323 0.49 0.78 0.35 188 XM_UB60 1322 0.29 0.78 0.05 189 LONGLN_LOW_CONTRAST 1315 0.35 0.77 0.15 190 DKIM_ADSP_CUSTOM_MED 1314 0.85 0.77 0.89 191 TM2_M_A_HREF_HREF 1281 0.40 0.75 0.22 192 RCVD_IN_IADB_VOUCHED 1269 2.21 0.75 2.92 193 TooManyTo_003 1265 1.26 0.74 1.52 194 XM_UB999 1258 0.24 0.74 0.00 195 RCVD_IN_RP_SAFE 1249 0.79 0.74 0.82 196 REMOVE_BEFORE_LINK 1249 0.36 0.74 0.18 197 XM_B_COPY_HTML 1232 0.62 0.73 0.57 198 THIS_AD 1231 0.41 0.72 0.26 199 XMLngstWrd_02 1223 0.42 0.72 0.27 200 T_TooManySym_02 1204 1.97 0.71 2.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 295403 88.79 97.08 84.76 2 T_SCC_BODY_TEXT_LINE 290421 82.75 81.56 83.33 3 RELAYCOUNTRY_US 282490 80.24 78.59 81.05 4 DKIM_SIGNED 258838 79.96 91.66 74.27 5 XM_DK_Pass 253472 77.90 88.51 72.73 6 DKIM_VALID 250010 76.73 87.00 71.73 7 XM_B_Unicode 238110 74.00 85.66 68.32 8 DCC_CHECK_NEGATIVE 227470 52.12 25.15 65.27 9 BAYES_50 203189 51.51 37.59 58.30 10 DKIM_VALID_AU 199140 59.06 63.01 57.14 11 XMListUnsubscribeExists 174169 57.45 72.80 49.97 12 XM_B_SpammyWords 152376 53.57 73.77 43.72 13 XM_B_Unicode3 139983 42.06 45.96 40.16 14 DCC_CHECK 120894 47.84 74.84 34.69 15 T_TM2_M_HEADER_IN_MSG 99344 26.65 22.84 28.50 16 DKIM_VALID_EF 97350 29.73 33.43 27.93 17 HTML_FONT_LOW_CONTRAST 95012 30.11 35.96 27.26 18 FVGT_m_MULTI_ODD 89749 28.14 33.04 25.75 19 LOC_TINY_FONT_1 82369 28.88 39.66 23.63 20 RCVD_IN_MSPIKE_H2 82118 23.49 23.35 23.56 21 XMSubLong 78269 22.46 22.47 22.46 22 T_KAM_HTML_FONT_INVALID 70666 23.23 29.29 20.28 23 MIME_HTML_ONLY 67145 24.43 35.03 19.27 24 XM_B_SpammyWords2 63254 25.95 41.96 18.15 25 ALL_TRUSTED 54884 11.03 1.36 15.75 26 XM_Multi_Part_URI 46992 15.47 19.56 13.48 27 TR_XM_DK_Unsub 46746 17.30 25.27 13.41 28 USER_IN_DEF_DKIM_WL 41404 9.03 3.20 11.88 29 BAYES_00 38646 7.64 0.56 11.09 30 UNPARSEABLE_RELAY 35202 11.57 14.59 10.10 31 BAYES_60 31746 8.58 7.49 9.11 32 TooManyTo_001 30058 7.48 5.13 8.62 33 LotsOfNums_01 28545 7.73 6.79 8.19 34 XM_DKIMWhitelistDomains 27799 5.37 0.03 7.98 35 XM_B_Unsub 27450 10.64 16.32 7.88 36 XM_Evil_Numbers_Gen 24883 7.86 9.34 7.14 37 TR_XM_DK_Bayes 24704 4.89 0.37 7.09 38 IN_ZIMBRA_NJ_WHITELIST 24342 4.72 0.08 6.98 39 TR_XM_DK_Bayes1 24303 4.81 0.37 6.97 40 RCVD_IN_MSPIKE_H3 23015 8.26 11.67 6.60 41 RCVD_IN_MSPIKE_WL 23015 8.26 11.67 6.60 42 XM_H_GMP 21570 5.39 3.74 6.19 43 TR_XM_BayesUnsub 21452 9.31 15.79 6.15 44 TR_XM_DK_Bayes2 21201 4.18 0.28 6.08 45 TR_MAX_INTL_RELAY 20950 18.17 43.11 6.01 46 LOTS_OF_MONEY 20653 7.90 11.94 5.93 47 T_TooManySym_01 18930 4.42 2.35 5.43 48 XM_H_Long_From01 18924 5.12 4.48 5.43 49 MIME_QP_LONG_LINE 18503 4.57 3.06 5.31 50 HTML_IMAGE_RATIO_02 18099 5.82 7.10 5.19 51 BOTNET_IPINHOSTNAME 17848 8.22 14.57 5.12 52 XM_DK_Undo_02 17342 19.09 48.06 4.98 53 RCVD_IN_IADB_LISTED 16976 3.82 1.66 4.87 54 BAYES_40 16974 3.78 1.56 4.87 55 XM_PDF 16757 3.41 0.54 4.81 56 XMStrtUSub 16182 4.25 3.45 4.64 57 ANY_BOUNCE_MESSAGE 15221 3.42 1.49 4.37 58 BOUNCE_MESSAGE 15220 3.42 1.49 4.37 59 RCVD_IN_IADB_SPF 15123 3.41 1.49 4.34 60 XM_Body_Dirty_Words 14813 5.74 8.81 4.25 61 BAYES_80 14746 5.52 8.17 4.23 62 XM_B_SpammyWords3 14538 6.93 12.60 4.17 63 RCVD_IN_VALIDITY_SAFE 14345 3.95 3.62 4.12 64 RELAYCOUNTRY_META 14185 9.77 21.47 4.07 65 FSL_BULK_SIG 13732 5.67 9.23 3.94 66 RCVD_IN_IADB_SENDERID 13720 3.11 1.41 3.94 67 XM_UncommonTLD01 13696 4.54 5.81 3.93 68 HTML_IMAGE_RATIO_04 13668 4.51 5.73 3.92 69 XMSubMetaSx_00 13649 4.93 7.01 3.92 70 TR_XM_SpammyWords4 13600 6.05 10.46 3.90 71 BAYES_99 13407 14.77 37.18 3.85 72 RCVD_IN_IADB_DK 13369 3.04 1.41 3.84 73 MPART_ALT_DIFF 12831 4.45 6.01 3.68 74 BAYES_20 12587 2.82 1.20 3.61 75 RCVD_IN_VALIDITY_CERTIFIED 12571 3.38 2.91 3.61 76 T_REMOTE_IMAGE 12371 3.09 2.16 3.55 77 XM_SPF_SoftFail 12004 3.62 3.98 3.44 78 FROM_EXCESS_BASE64 10388 2.54 1.63 2.98 79 BAYES_999 10352 11.61 29.36 2.97 80 RCVD_IN_IADB_VOUCHED 10191 2.21 0.75 2.92 81 XM_B_Phish_Phrases 10026 3.65 5.25 2.88 82 MAILING_LIST_MULTI 9817 2.47 1.76 2.82 83 BAYES_05 9713 2.05 0.52 2.79 84 TooManyTo_002 9505 2.10 0.83 2.73 85 SCC_BODY_URI_ONLY 9456 2.11 0.86 2.71 86 XM_B_SpammyTLD 9106 2.82 3.23 2.61 87 XMNumbers 9017 3.05 4.01 2.59 88 T_TooManySym_02 8988 1.97 0.71 2.58 89 DKIM_INVALID 8828 3.23 4.66 2.53 90 HTML_IMAGE_RATIO_08 8656 3.00 4.05 2.48 91 HTML_IMAGE_RATIO_06 8156 3.03 4.43 2.34 92 HTML_MIME_NO_HTML_TAG 7917 2.22 2.12 2.27 93 XM_CamelCaseFrm001 7897 2.36 2.57 2.27 94 MIME_HTML_MOSTLY 7646 2.70 3.74 2.19 95 MIME_HTML_ONLY_MULTI 7595 2.71 3.81 2.18 96 BAYES_95 7519 3.33 5.72 2.16 97 TR_XM_SpammyRelay 7461 7.42 18.27 2.14 98 TR_XM_DKIM_Undo 7457 13.75 37.58 2.14 99 INVALID_MSGID 7166 1.45 0.21 2.06 100 KHOP_HELO_FCRDNS 6874 1.66 1.03 1.97 101 RCVD_IN_IADB_OPTIN 6832 1.48 0.49 1.96 102 XM_DK_Undo_01 6777 1.87 1.72 1.94 103 URI_NOVOWEL 6655 1.63 1.07 1.91 104 HELO_NODOT 6561 1.41 0.46 1.88 105 HELO_NO_DOMAIN 6556 1.41 0.45 1.88 106 T_XMDrugObfuBody_14 6510 2.36 3.36 1.87 107 TO_MALFORMED 6302 1.22 0.01 1.81 108 TM2_M_URI_OPT_OUT 6223 2.63 4.36 1.79 109 T_XMDrugObfuBody_08 6142 2.36 3.58 1.76 110 TR_Symld_Words 6100 1.50 0.97 1.75 111 XM_B_Investor 5567 2.84 5.39 1.60 112 UNTRUSTED_Relay 5364 2.84 5.50 1.54 113 TR_XM_PhishingBody 5298 2.27 3.82 1.52 114 TooManyTo_003 5283 1.26 0.74 1.52 115 IN_HORDE_ADDRESS_BOOK 5265 1.04 0.08 1.51 116 TR_XM_UnparsRelay 5239 3.69 8.19 1.50 117 TVD_RCVD_IP 5065 1.27 0.88 1.45 118 XM_B_Unsub2 5050 1.78 2.47 1.45 119 XMDiploma_00 5029 1.78 2.47 1.44 120 XMGappySubj_01 4935 1.02 0.20 1.42 121 XM_SendGrid 4858 1.38 1.35 1.39 122 XMSexyCombo_05 4813 2.62 5.16 1.38 123 XM_GoogleGroups 4753 1.06 0.43 1.36 124 XM_OfRef6 4706 2.27 4.15 1.35 125 SUBJ_ALL_CAPS 4639 1.59 2.12 1.33 126 TR_DCC_Bayes_99 4555 9.81 27.25 1.31 127 TM2_M_VERY_LONG_WORD 4533 1.98 3.38 1.30 128 TR_XM_SpammyWords5 4401 2.33 4.51 1.26 129 XMBody_95 4229 0.90 0.25 1.21 130 XMBSHREFv2 4179 0.90 0.29 1.20 131 RDNS_DYNAMIC 4136 1.11 0.95 1.19 132 BOTNET 4106 3.88 9.43 1.18 133 TVD_SPACE_RATIO 4000 0.82 0.15 1.15 134 XMCapTrack 3967 0.88 0.36 1.14 135 TooManyTo_004 3872 0.98 0.70 1.11 136 RELAYCOUNTRY_CA 3805 4.96 12.89 1.09 137 URI_HEX 3798 1.36 1.92 1.09 138 XM_H_Long_From02 3663 1.23 1.59 1.05 139 TR_XM_Base64_M1 3450 0.94 0.82 0.99 140 XM_UB50 3254 1.51 2.69 0.93 141 SpammyFromTLD_01 3213 1.60 2.99 0.92 142 TooManyTo_005 3172 0.83 0.65 0.91 143 DKIM_ADSP_CUSTOM_MED 3106 0.85 0.77 0.89 144 T_TooManySym_03 3071 0.69 0.31 0.88 145 TR_XM_DK_SendGrid 3059 0.87 0.86 0.88 146 XM_ProductURIs 3035 0.87 0.86 0.87 147 T_FILL_THIS_FORM_SHORT 2967 2.42 5.65 0.85 148 RCVD_IN_RP_SAFE 2853 0.79 0.74 0.82 149 HTTPS_HTTP_MISMATCH 2809 1.02 1.47 0.81 150 URI_TRY_3LD 2751 1.03 1.51 0.79 151 RCVD_IN_BL_SPAMCOP_NET 2722 5.46 15.08 0.78 152 TR_MetaPhish_Combo_01 2670 0.84 0.98 0.77 153 XMStockSpam_06 2660 1.05 1.64 0.76 154 XMGappySubj_02 2659 0.53 0.06 0.76 155 XM_H_Trusted_IP 2605 0.50 0.00 0.75 156 T_XMDrugObfuBody_00 2601 0.96 1.40 0.75 157 XM_H_PHPMailer 2589 0.83 1.00 0.74 158 XMGenDplmaNmb 2578 0.93 1.31 0.74 159 XMLngstWrd_00 2570 0.95 1.39 0.74 160 XMHTML_After_End 2544 0.87 1.17 0.73 161 RCVD_IN_RP_CERTIFIED 2515 0.68 0.60 0.72 162 RELAYCOUNTRY_AU 2488 1.34 2.62 0.71 163 FROM_GOV_DKIM_AU 2385 0.51 0.15 0.68 164 MSGID_NOFQDN1 2359 0.46 0.01 0.68 165 XMNoVowels 2319 0.57 0.37 0.67 166 XM_ShortIntro_01 2297 0.56 0.37 0.66 167 XMSubNoVowel 2234 0.51 0.24 0.64 168 XM_B_FormFill 2171 0.43 0.05 0.62 169 XMSubMetaI_00 2166 0.79 1.13 0.62 170 FILL_THIS_FORM 2122 0.53 0.37 0.61 171 T_OBFU_PDF_ATTACH 2076 0.42 0.07 0.60 172 RELAYCOUNTRY_GB 2060 0.61 0.65 0.59 173 SHORT_HELO_AND_INLINE_IMAGE 2058 0.40 0.02 0.59 174 USER_IN_WHITELIST 2024 0.39 0.00 0.58 175 USER_IN_WELCOMELIST 2024 0.39 0.00 0.58 176 XMBdyGiftCard01 2007 0.87 1.48 0.58 177 XM_B_COPY_HTML 1985 0.62 0.73 0.57 178 FORGED_GMAIL_RCVD 1976 0.59 0.65 0.57 179 XMPhish30 1935 0.81 1.35 0.56 180 PLING_QUERY 1928 0.73 1.11 0.55 181 MPART_ALT_DIFF_COUNT 1921 0.65 0.85 0.55 182 HTML_IMAGE_ONLY_28 1913 0.50 0.39 0.55 183 NML_ADSP_CUSTOM_MED 1903 0.57 0.61 0.55 184 XMBrknScrpt_02 1893 0.71 1.05 0.54 185 T_Symld_Words_02 1865 0.55 0.59 0.54 186 XMMoneyMeta_00 1843 0.57 0.64 0.53 187 XM_B_SpammyWords4 1786 0.99 1.96 0.51 188 XMBody_17 1768 2.89 7.79 0.51 189 SpammyFromTLD_02 1652 0.79 1.44 0.47 190 HTML_TAG_BALANCE_BODY 1625 0.78 1.41 0.47 191 HTML_IMAGE_ONLY_32 1608 0.37 0.18 0.46 192 XMSubMetaSxObfu_02 1493 0.45 0.48 0.43 193 TO_NO_BRKTS_HTML_ONLY 1448 0.35 0.22 0.42 194 HTML_IMAGE_ONLY_20 1441 0.43 0.48 0.41 195 XMSolicitRefs_0 1435 0.40 0.37 0.41 196 TR_XM_PHPForged 1428 0.80 1.60 0.41 197 HTML_FONT_FACE_BAD 1393 0.50 0.70 0.40 198 T_XMHurry_00 1380 0.80 1.62 0.40 199 TR_Mismatch_TLD_01 1370 0.52 0.78 0.39 200 MISSING_HEADERS 1370 0.43 0.49 0.39 ----------------------------------------------------------------------