Email: 477641 Autolearn: 0 AvgScore: 4.36 AvgScanTime: 1.44 sec Spam: 157356 Autolearn: 0 AvgScore: 13.99 AvgScanTime: 1.59 sec Ham: 320285 Autolearn: 0 AvgScore: -0.37 AvgScanTime: 1.37 sec Time Spent Running SA: 191.36 hours Time Spent Processing Spam: 69.43 hours Time Spent Processing Ham: 121.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151917 88.56 96.54 84.64 2 DKIM_SIGNED 144016 79.62 91.52 73.78 3 XM_DK_Pass 138320 77.46 87.90 72.33 4 DKIM_VALID 132707 75.46 84.34 71.11 5 XM_B_Unicode 132203 73.25 84.02 67.95 6 T_SCC_BODY_TEXT_LINE 128252 82.64 81.50 83.20 7 RELAYCOUNTRY_US 121941 79.71 77.49 80.81 8 XMListUnsubscribeExists 116128 57.72 73.80 49.82 9 DCC_CHECK 115304 46.60 73.28 33.50 10 XM_B_SpammyWords 114453 52.93 72.74 43.19 11 DKIM_VALID_AU 95227 58.18 60.52 57.03 12 XM_B_Unicode3 73954 42.79 47.00 40.72 13 XM_DK_Undo_02 73701 19.36 46.84 5.87 14 TR_MAX_INTL_RELAY 66769 18.52 42.43 6.77 15 XM_B_SpammyWords2 65835 25.33 41.84 17.22 16 LOC_TINY_FONT_1 59923 29.74 38.08 25.65 17 BAYES_50 59195 51.43 37.62 58.21 18 TR_XM_DKIM_Undo 57452 13.66 36.51 2.43 19 BAYES_99 56900 15.06 36.16 4.70 20 HTML_FONT_LOW_CONTRAST 55327 30.78 35.16 28.62 21 MIME_HTML_ONLY 52704 25.14 33.49 21.03 22 FVGT_m_MULTI_ODD 52515 27.62 33.37 24.79 23 DKIM_VALID_EF 50823 29.76 32.30 28.51 24 T_KAM_HTML_FONT_INVALID 46955 23.25 29.84 20.02 25 BAYES_999 44968 11.96 28.58 3.79 26 DCC_CHECK_NEGATIVE 42030 53.36 26.71 66.46 27 TR_DCC_Bayes_99 40773 9.62 25.91 1.62 28 TR_XM_DK_Unsub 39013 17.42 24.79 13.80 29 RELAYCOUNTRY_META 38331 10.83 24.36 4.18 30 RCVD_IN_MSPIKE_H2 38290 23.43 24.33 22.99 31 T_TM2_M_HEADER_IN_MSG 35855 25.99 22.79 27.56 32 XMSubLong 34252 22.47 21.77 22.81 33 XM_Multi_Part_URI 30282 15.59 19.24 13.80 34 TR_XM_SpammyRelay 30152 7.76 19.16 2.15 35 XM_B_Unsub 24845 10.72 15.79 8.22 36 RCVD_IN_BL_SPAMCOP_NET 24649 5.67 15.66 0.77 37 TR_XM_BayesUnsub 23959 9.26 15.23 6.32 38 UNPARSEABLE_RELAY 23765 11.94 15.10 10.39 39 TR_XM_SpammyWords2 23066 5.04 14.66 0.31 40 BOTNET_IPINHOSTNAME 21427 8.06 13.62 5.32 41 XM_B_SpammyWords3 21116 7.11 13.42 4.02 42 RELAYCOUNTRY_CA 20874 5.15 13.27 1.16 43 TR_XM_SPAMCOP 20616 4.52 13.10 0.30 44 RCVD_IN_MSPIKE_WL 18218 8.13 11.58 6.44 45 RCVD_IN_MSPIKE_H3 18218 8.13 11.58 6.44 46 LOTS_OF_MONEY 17951 8.42 11.41 6.95 47 TR_XM_SpammyWords4 15966 6.66 10.15 4.95 48 XM_Body_Dirty_Words 15350 6.15 9.75 4.38 49 BOTNET 15026 4.05 9.55 1.35 50 XM_Evil_Numbers_Gen 13895 8.21 8.83 7.91 51 MPART_ALT_DIFF 13717 5.72 8.72 4.25 52 BAYES_80 13466 5.44 8.56 3.91 53 TR_XM_UnparsRelay 12882 3.66 8.19 1.44 54 BAYES_60 12571 8.73 7.99 9.10 55 FSL_BULK_SIG 12488 4.77 7.94 3.21 56 HTML_IMAGE_RATIO_02 12056 6.04 7.66 5.24 57 XMBody_17 12020 2.83 7.64 0.47 58 DKIM_INVALID 11309 4.16 7.19 2.67 59 LotsOfNums_01 10856 7.74 6.90 8.16 60 HTML_IMAGE_RATIO_04 10749 5.31 6.83 4.56 61 UNTRUSTED_Relay 10427 3.23 6.63 1.56 62 XM_UncommonTLD01 10130 4.74 6.44 3.90 63 XMSubMetaSx_00 9813 5.22 6.24 4.72 64 BAYES_95 9547 3.39 6.07 2.07 65 T_FILL_THIS_FORM_SHORT 9123 2.53 5.80 0.92 66 XM_H_GMP 9010 6.25 5.73 6.51 67 XMSexyCombo_05 8269 3.46 5.25 2.58 68 TR_XM_SpammyWords5 7985 2.59 5.07 1.37 69 TooManyTo_001 7862 7.55 5.00 8.80 70 XM_B_Investor 7844 2.64 4.98 1.49 71 XM_H_Long_From01 7799 5.28 4.96 5.44 72 TR_XM_BayesRelay 7439 1.56 4.73 0.00 73 MIME_HTML_MOSTLY 7126 3.07 4.53 2.36 74 XMStrtUSub 7102 4.55 4.51 4.57 75 XM_B_Phish_Phrases 7095 3.76 4.51 3.39 76 FONT_INVIS_LONG_LINE 6729 1.45 4.28 0.06 77 XMNumbers 6697 3.29 4.26 2.82 78 HTML_IMAGE_RATIO_06 6491 2.83 4.13 2.20 79 XM_OfRef6 6313 2.14 4.01 1.23 80 T_XMDrugObfuBody_14 6140 2.70 3.90 2.11 81 MIME_HTML_ONLY_MULTI 6001 2.89 3.81 2.44 82 XM_SPF_SoftFail 5984 3.27 3.80 3.00 83 XM_UB50 5897 1.87 3.75 0.94 84 TR_XM_PhishingBody 5880 2.41 3.74 1.75 85 TR_XM_FormFill 5753 1.21 3.66 0.01 86 TM2_M_VERY_LONG_WORD 5569 2.20 3.54 1.54 87 XM_B_SpammyTLD 5569 2.85 3.54 2.51 88 TM2_M_URI_OPT_OUT 5520 2.82 3.51 2.49 89 T_XMDrugObfuBody_08 5472 2.22 3.48 1.60 90 USER_IN_DEF_DKIM_WL 5335 9.12 3.39 11.94 91 SpammyFromTLD_01 5120 1.54 3.25 0.69 92 RCVD_IN_VALIDITY_SAFE 4993 4.01 3.17 4.42 93 MIME_QP_LONG_LINE 4900 4.57 3.11 5.29 94 KHOP_HELO_FCRDNS 4788 2.16 3.04 1.72 95 HTML_IMAGE_RATIO_08 4519 2.57 2.87 2.42 96 SUBJ_ALL_CAPS 4480 1.91 2.85 1.45 97 XMDiploma_00 4399 1.90 2.80 1.46 98 T_TooManySym_01 4346 4.75 2.76 5.73 99 XM_URI_RBL 4298 1.01 2.73 0.17 100 XM_CamelCaseFrm001 4199 2.49 2.67 2.40 101 RCVD_IN_VALIDITY_CERTIFIED 4077 3.47 2.59 3.90 102 RELAYCOUNTRY_AU 4019 1.32 2.55 0.71 103 SCC_BODY_URI_ONLY 3995 2.73 2.54 2.83 104 HK_RANDOM_REPLYTO 3917 0.88 2.49 0.09 105 XM_B_Unsub2 3734 1.71 2.37 1.38 106 HTML_FONT_SIZE_LARGE 3614 0.86 2.30 0.16 107 ANY_BOUNCE_MESSAGE 3525 3.84 2.24 4.63 108 BOUNCE_MESSAGE 3525 3.84 2.24 4.62 109 XM_DIRTYINTL 3465 0.89 2.20 0.25 110 FROM_EXCESS_BASE64 3350 2.66 2.13 2.91 111 LONG_JUNK_URI2 3348 0.78 2.13 0.12 112 XM_B_SpammyWords4 3250 1.08 2.07 0.60 113 HTML_TAG_BALANCE_BODY 3221 0.95 2.05 0.41 114 RELAYCOUNTRY_HU 3148 0.72 2.00 0.09 115 TR_Mismatch_TLD_02 3128 0.72 1.99 0.09 116 TR_LOTS_OF_MONEY3 3033 0.82 1.93 0.28 117 TR_XM_NoHeaderRelay 3021 0.72 1.92 0.13 118 XMStockSpam_06 3004 1.72 1.91 1.63 119 T_REMOTE_IMAGE 2949 3.05 1.87 3.63 120 HTML_IMAGE_ONLY_24 2916 0.93 1.85 0.47 121 TR_XM_INV_DKIM 2900 0.64 1.84 0.05 122 MAILING_LIST_MULTI 2857 2.41 1.82 2.71 123 TR_XM_PHPDW 2754 0.85 1.75 0.40 124 TR_XM_PHPForged 2745 0.85 1.74 0.41 125 HTML_MIME_NO_HTML_TAG 2731 1.96 1.74 2.07 126 TR_XM_FormFill2 2674 0.83 1.70 0.40 127 XM_H_PHPOS 2654 0.81 1.69 0.38 128 URI_HEX 2631 1.25 1.67 1.04 129 URI_TRY_3LD 2623 1.02 1.67 0.71 130 AC_BR_BONANZA 2604 0.60 1.65 0.08 131 RCVD_IN_PSBL 2604 0.82 1.65 0.41 132 BOTNET_NORDNS 2553 0.54 1.62 0.01 133 RCVD_IN_IADB_LISTED 2539 3.50 1.61 4.42 134 T_XMHurry_00 2440 0.82 1.55 0.45 135 XMReplyNow 2436 0.68 1.55 0.26 136 XMBdyGiftCard01 2422 0.80 1.54 0.44 137 XM_HighProb1 2411 0.51 1.53 0.00 138 TR_Symld_Words 2406 1.48 1.53 1.46 139 SpammyFromTLD_02 2260 0.74 1.44 0.39 140 XMPhish30 2246 0.96 1.43 0.73 141 BAYES_40 2222 3.57 1.41 4.63 142 TR_Caps_n_Bayes_99 2195 0.46 1.39 0.01 143 T_XMDrugObfuBody_00 2190 0.80 1.39 0.51 144 XMLngstWrd_00 2186 0.82 1.39 0.54 145 RCVD_IN_IADB_SPF 2183 3.09 1.39 3.93 146 XM_SendGrid 2136 1.38 1.36 1.39 147 RCVD_IN_IADB_DK 2062 2.75 1.31 3.46 148 TR_XM_InvalidRelay 2054 0.45 1.31 0.03 149 RCVD_IN_IADB_SENDERID 2053 2.80 1.30 3.54 150 XM_DK_Undo_01 2004 1.66 1.27 1.85 151 XM_B_COPY_HTML 1999 0.82 1.27 0.60 152 XMBrknScrpt_02 1985 0.79 1.26 0.56 153 HTTPS_HTTP_MISMATCH 1978 0.94 1.26 0.78 154 T_Symld_Words_02 1967 0.70 1.25 0.42 155 ALL_TRUSTED 1820 11.11 1.16 16.00 156 XMSexyCombo_01 1816 0.95 1.15 0.85 157 HTML_IMAGE_ONLY_20 1767 0.67 1.12 0.45 158 XM_H_PHPMailer 1735 0.88 1.10 0.77 159 XMGenDplmaNmb 1716 0.89 1.09 0.79 160 BAYES_20 1714 2.68 1.09 3.47 161 XM_Combo_Sbj 1690 0.47 1.07 0.17 162 XM_B_DNDMA 1653 0.53 1.05 0.28 163 NO_DNS_FOR_FROM 1651 0.51 1.05 0.24 164 TR_XM_MaxWHORU 1638 0.47 1.04 0.19 165 XMLngstWrd_01 1625 0.53 1.03 0.28 166 T_XMDrugObfuBody_10 1621 0.35 1.03 0.02 167 XMSubMetaSx_01 1607 0.71 1.02 0.56 168 RCVD_IN_VALIDITY_RPBL 1606 0.38 1.02 0.06 169 PDS_OTHER_BAD_TLD 1601 0.43 1.02 0.14 170 TR_Mismatch_TLD_01 1599 0.51 1.02 0.26 171 XMSubMetaI_00 1578 0.76 1.00 0.64 172 SHOPIFY_IMG_NOT_RCVD_SFY 1575 0.53 1.00 0.29 173 TR_XM_Base64_M1 1539 0.91 0.98 0.87 174 LONGLN_LOW_CONTRAST 1533 0.58 0.97 0.39 175 DKIM_ADSP_NXDOMAIN 1531 0.50 0.97 0.26 176 XM_B_COVIDMETA 1527 0.52 0.97 0.30 177 URI_NOVOWEL 1498 1.44 0.95 1.69 178 XMHTML_After_End 1493 0.76 0.95 0.67 179 XM_UB60 1491 0.35 0.95 0.05 180 XMSubMetaSxObfu_03 1485 0.96 0.94 0.97 181 XMBody_78 1448 0.49 0.92 0.28 182 XMLngstWrd_02 1438 0.44 0.91 0.20 183 XMBounce_01 1436 0.31 0.91 0.02 184 RDNS_DYNAMIC 1430 0.93 0.91 0.95 185 TM2_M_OBFU_COMMENT 1414 0.47 0.90 0.27 186 XM_B_Phish66 1412 0.53 0.90 0.36 187 TR_XM_DK_SendGrid 1409 0.90 0.90 0.89 188 T_TooManySym_02 1366 2.02 0.87 2.58 189 DKIM_ADSP_CUSTOM_MED 1348 0.87 0.86 0.88 190 XMLngstWrd_03 1333 0.38 0.85 0.16 191 XM_UB99 1321 0.28 0.84 0.00 192 TR_MetaPhish_Combo_01 1316 0.86 0.84 0.87 193 FVGT_m_MULTI_ODD_EMAIL 1294 0.34 0.82 0.11 194 LongTLD 1288 0.55 0.82 0.42 195 XM_S_GiftBonus 1259 0.28 0.80 0.02 196 DIET_1 1242 0.50 0.79 0.35 197 THIS_AD 1231 0.46 0.78 0.31 198 HTML_TAG_BALANCE_HEAD 1223 0.29 0.78 0.05 199 XMGetyour 1222 0.28 0.78 0.03 200 HTML_SHORT_LINK_IMG_3 1205 0.31 0.77 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 271093 88.56 96.54 84.64 2 T_SCC_BODY_TEXT_LINE 266479 82.64 81.50 83.20 3 RELAYCOUNTRY_US 258810 79.71 77.49 80.81 4 DKIM_SIGNED 236294 79.62 91.52 73.78 5 XM_DK_Pass 231659 77.46 87.90 72.33 6 DKIM_VALID 227743 75.46 84.34 71.11 7 XM_B_Unicode 217648 73.25 84.02 67.95 8 DCC_CHECK_NEGATIVE 212858 53.36 26.71 66.46 9 BAYES_50 186448 51.43 37.62 58.21 10 DKIM_VALID_AU 182647 58.18 60.52 57.03 11 XMListUnsubscribeExists 159571 57.72 73.80 49.82 12 XM_B_SpammyWords 138345 52.93 72.74 43.19 13 XM_B_Unicode3 130429 42.79 47.00 40.72 14 DCC_CHECK 107294 46.60 73.28 33.50 15 HTML_FONT_LOW_CONTRAST 91681 30.78 35.16 28.62 16 DKIM_VALID_EF 91300 29.76 32.30 28.51 17 T_TM2_M_HEADER_IN_MSG 88272 25.99 22.79 27.56 18 LOC_TINY_FONT_1 82145 29.74 38.08 25.65 19 FVGT_m_MULTI_ODD 79393 27.62 33.37 24.79 20 RCVD_IN_MSPIKE_H2 73636 23.43 24.33 22.99 21 XMSubLong 73062 22.47 21.77 22.81 22 MIME_HTML_ONLY 67365 25.14 33.49 21.03 23 T_KAM_HTML_FONT_INVALID 64119 23.25 29.84 20.02 24 XM_B_SpammyWords2 55165 25.33 41.84 17.22 25 ALL_TRUSTED 51230 11.11 1.16 16.00 26 TR_XM_DK_Unsub 44206 17.42 24.79 13.80 27 XM_Multi_Part_URI 44184 15.59 19.24 13.80 28 USER_IN_DEF_DKIM_WL 38247 9.12 3.39 11.94 29 BAYES_00 35693 7.66 0.57 11.14 30 UNPARSEABLE_RELAY 33279 11.94 15.10 10.39 31 BAYES_60 29137 8.73 7.99 9.10 32 TooManyTo_001 28200 7.55 5.00 8.80 33 XM_DKIMWhitelistDomains 27560 5.84 0.21 8.60 34 XM_B_Unsub 26335 10.72 15.79 8.22 35 LotsOfNums_01 26136 7.74 6.90 8.16 36 XM_Evil_Numbers_Gen 25337 8.21 8.83 7.91 37 TR_XM_DK_Bayes 24094 5.17 0.40 7.52 38 TR_XM_DK_Bayes1 23106 4.97 0.39 7.21 39 LOTS_OF_MONEY 22259 8.42 11.41 6.95 40 TR_MAX_INTL_RELAY 21695 18.52 42.43 6.77 41 IN_ZIMBRA_NJ_WHITELIST 21631 4.56 0.09 6.75 42 XM_H_GMP 20852 6.25 5.73 6.51 43 RCVD_IN_MSPIKE_H3 20618 8.13 11.58 6.44 44 RCVD_IN_MSPIKE_WL 20618 8.13 11.58 6.44 45 TR_XM_BayesUnsub 20254 9.26 15.23 6.32 46 TR_XM_DK_Bayes2 20052 4.29 0.28 6.26 47 XM_DK_Undo_02 18791 19.36 46.84 5.87 48 T_TooManySym_01 18359 4.75 2.76 5.73 49 XM_H_Long_From01 17435 5.28 4.96 5.44 50 BOTNET_IPINHOSTNAME 17055 8.06 13.62 5.32 51 MIME_QP_LONG_LINE 16938 4.57 3.11 5.29 52 HTML_IMAGE_RATIO_02 16771 6.04 7.66 5.24 53 TR_XM_SpammyWords4 15868 6.66 10.15 4.95 54 XMSubMetaSx_00 15118 5.22 6.24 4.72 55 BAYES_99 15047 15.06 36.16 4.70 56 BAYES_40 14818 3.57 1.41 4.63 57 ANY_BOUNCE_MESSAGE 14814 3.84 2.24 4.63 58 BOUNCE_MESSAGE 14813 3.84 2.24 4.62 59 XMStrtUSub 14653 4.55 4.51 4.57 60 HTML_IMAGE_RATIO_04 14593 5.31 6.83 4.56 61 XM_PDF 14559 3.19 0.44 4.55 62 RCVD_IN_VALIDITY_SAFE 14172 4.01 3.17 4.42 63 RCVD_IN_IADB_LISTED 14164 3.50 1.61 4.42 64 XM_Body_Dirty_Words 14028 6.15 9.75 4.38 65 MPART_ALT_DIFF 13616 5.72 8.72 4.25 66 RELAYCOUNTRY_META 13387 10.83 24.36 4.18 67 XM_B_SpammyWords3 12867 7.11 13.42 4.02 68 RCVD_IN_IADB_SPF 12580 3.09 1.39 3.93 69 BAYES_80 12532 5.44 8.56 3.91 70 XM_UncommonTLD01 12499 4.74 6.44 3.90 71 RCVD_IN_VALIDITY_CERTIFIED 12484 3.47 2.59 3.90 72 BAYES_999 12145 11.96 28.58 3.79 73 T_REMOTE_IMAGE 11620 3.05 1.87 3.63 74 RCVD_IN_IADB_SENDERID 11332 2.80 1.30 3.54 75 BAYES_20 11104 2.68 1.09 3.47 76 RCVD_IN_IADB_DK 11066 2.75 1.31 3.46 77 XM_B_Phish_Phrases 10843 3.76 4.51 3.39 78 FSL_BULK_SIG 10286 4.77 7.94 3.21 79 XM_SPF_SoftFail 9611 3.27 3.80 3.00 80 FROM_EXCESS_BASE64 9333 2.66 2.13 2.91 81 SCC_BODY_URI_ONLY 9066 2.73 2.54 2.83 82 XMNumbers 9024 3.29 4.26 2.82 83 BAYES_05 8884 2.04 0.54 2.77 84 TooManyTo_002 8747 2.07 0.72 2.73 85 MAILING_LIST_MULTI 8678 2.41 1.82 2.71 86 DKIM_INVALID 8551 4.16 7.19 2.67 87 RCVD_IN_IADB_VOUCHED 8465 2.00 0.69 2.64 88 XMSexyCombo_05 8279 3.46 5.25 2.58 89 T_TooManySym_02 8265 2.02 0.87 2.58 90 XM_B_SpammyTLD 8027 2.85 3.54 2.51 91 TM2_M_URI_OPT_OUT 7965 2.82 3.51 2.49 92 MIME_HTML_ONLY_MULTI 7825 2.89 3.81 2.44 93 TR_XM_DKIM_Undo 7771 13.66 36.51 2.43 94 HTML_IMAGE_RATIO_08 7738 2.57 2.87 2.42 95 XM_CamelCaseFrm001 7689 2.49 2.67 2.40 96 MIME_HTML_MOSTLY 7552 3.07 4.53 2.36 97 INVALID_MSGID 7312 1.59 0.17 2.28 98 HTML_IMAGE_RATIO_06 7042 2.83 4.13 2.20 99 TR_XM_SpammyRelay 6901 7.76 19.16 2.15 100 T_XMDrugObfuBody_14 6766 2.70 3.90 2.11 101 HTML_MIME_NO_HTML_TAG 6631 1.96 1.74 2.07 102 BAYES_95 6622 3.39 6.07 2.07 103 TO_MALFORMED 6308 1.33 0.02 1.97 104 XM_DK_Undo_01 5920 1.66 1.27 1.85 105 RCVD_IN_IADB_OPTIN 5651 1.32 0.42 1.76 106 TR_XM_PhishingBody 5611 2.41 3.74 1.75 107 HELO_NODOT 5549 1.38 0.65 1.73 108 HELO_NO_DOMAIN 5546 1.37 0.65 1.73 109 KHOP_HELO_FCRDNS 5514 2.16 3.04 1.72 110 URI_NOVOWEL 5401 1.44 0.95 1.69 111 XMStockSpam_06 5217 1.72 1.91 1.63 112 TR_DCC_Bayes_99 5173 9.62 25.91 1.62 113 T_XMDrugObfuBody_08 5130 2.22 3.48 1.60 114 IN_HORDE_ADDRESS_BOOK 5094 1.09 0.07 1.59 115 TVD_RCVD_IP 5087 1.32 0.76 1.59 116 UNTRUSTED_Relay 5000 3.23 6.63 1.56 117 TM2_M_VERY_LONG_WORD 4948 2.20 3.54 1.54 118 XMGappySubj_01 4808 1.05 0.13 1.50 119 XM_B_Investor 4779 2.64 4.98 1.49 120 TooManyTo_003 4738 1.21 0.65 1.48 121 XMDiploma_00 4683 1.90 2.80 1.46 122 TR_Symld_Words 4662 1.48 1.53 1.46 123 SUBJ_ALL_CAPS 4646 1.91 2.85 1.45 124 TR_XM_UnparsRelay 4619 3.66 8.19 1.44 125 XM_SendGrid 4451 1.38 1.36 1.39 126 XM_B_Unsub2 4419 1.71 2.37 1.38 127 TR_XM_SpammyWords5 4376 2.59 5.07 1.37 128 XM_H_Trusted_IP 4373 0.92 0.00 1.37 129 BOTNET 4321 4.05 9.55 1.35 130 XMBSHREFv2 4113 1.00 0.42 1.28 131 XM_OfRef6 3930 2.14 4.01 1.23 132 XM_GoogleGroups 3929 0.98 0.48 1.23 133 RELAYCOUNTRY_CA 3711 5.15 13.27 1.16 134 TVD_SPACE_RATIO 3655 0.81 0.14 1.14 135 XMBody_95 3630 0.80 0.11 1.13 136 TooManyTo_004 3547 0.94 0.60 1.11 137 XM_H_Long_From02 3510 0.97 0.70 1.10 138 URI_HEX 3316 1.25 1.67 1.04 139 XMCapTrack 3290 0.80 0.34 1.03 140 XMSubMetaSxObfu_03 3101 0.96 0.94 0.97 141 RDNS_DYNAMIC 3028 0.93 0.91 0.95 142 XM_UB50 3016 1.87 3.75 0.94 143 T_TooManySym_03 3010 0.71 0.26 0.94 144 XMSubNoVowel 2970 0.72 0.29 0.93 145 T_FILL_THIS_FORM_SHORT 2951 2.53 5.80 0.92 146 RCVD_IN_RP_SAFE 2884 0.81 0.63 0.90 147 TR_XM_DK_SendGrid 2866 0.90 0.90 0.89 148 TooManyTo_005 2842 0.78 0.57 0.89 149 DKIM_ADSP_CUSTOM_MED 2814 0.87 0.86 0.88 150 TR_XM_Base64_M1 2792 0.91 0.98 0.87 151 TR_MetaPhish_Combo_01 2788 0.86 0.84 0.87 152 XMGappySubj_02 2750 0.59 0.03 0.86 153 TO_NO_BRKTS_HTML_ONLY 2740 0.71 0.42 0.86 154 XMSexyCombo_01 2709 0.95 1.15 0.85 155 XM_ProductURIs 2681 0.81 0.76 0.84 156 RCVD_IN_RP_CERTIFIED 2544 0.70 0.49 0.79 157 XMGenDplmaNmb 2531 0.89 1.09 0.79 158 HTTPS_HTTP_MISMATCH 2492 0.94 1.26 0.78 159 XM_H_PHPMailer 2468 0.88 1.10 0.77 160 RCVD_IN_BL_SPAMCOP_NET 2457 5.67 15.66 0.77 161 MSGID_NOFQDN1 2386 0.50 0.01 0.74 162 XMPhish30 2326 0.96 1.43 0.73 163 XM_ShortIntro_01 2304 0.60 0.36 0.72 164 URI_TRY_3LD 2271 1.02 1.67 0.71 165 RELAYCOUNTRY_AU 2265 1.32 2.55 0.71 166 SpammyFromTLD_01 2222 1.54 3.25 0.69 167 FROM_GOV_DKIM_AU 2148 0.51 0.19 0.67 168 XM_RXBody 2148 0.67 0.66 0.67 169 XMHTML_After_End 2147 0.76 0.95 0.67 170 XMSubMetaI_00 2055 0.76 1.00 0.64 171 FILL_THIS_FORM 2053 0.51 0.25 0.64 172 T_OBFU_PDF_ATTACH 2052 0.45 0.06 0.64 173 XM_B_FormFill 2035 0.44 0.04 0.64 174 USER_IN_WELCOMELIST 2010 0.42 0.00 0.63 175 USER_IN_WHITELIST 2010 0.42 0.00 0.63 176 XM_B_COPY_HTML 1932 0.82 1.27 0.60 177 XM_B_SpammyWords4 1930 1.08 2.07 0.60 178 TVD_SPACE_RATIO_MINFP 1915 0.44 0.13 0.60 179 XMSexyCombo_04 1852 0.53 0.44 0.58 180 NML_ADSP_CUSTOM_MED 1849 0.60 0.65 0.58 181 XMSubMetaSx_01 1806 0.71 1.02 0.56 182 XMBrknScrpt_02 1805 0.79 1.26 0.56 183 SHORT_HELO_AND_INLINE_IMAGE 1750 0.38 0.04 0.55 184 XMLngstWrd_00 1745 0.82 1.39 0.54 185 FORGED_GMAIL_RCVD 1731 0.61 0.77 0.54 186 XMNoVowels 1728 0.46 0.30 0.54 187 RELAYCOUNTRY_GB 1675 0.51 0.47 0.52 188 MPART_ALT_DIFF_COUNT 1644 0.59 0.75 0.51 189 T_MANY_PILL_PRICE 1639 0.34 0.00 0.51 190 T_XMDrugObfuBody_00 1638 0.80 1.39 0.51 191 PLING_QUERY 1630 0.55 0.63 0.51 192 XM_B_REG_HTML 1574 0.44 0.34 0.49 193 HTML_IMAGE_ONLY_24 1517 0.93 1.85 0.47 194 XMBody_17 1493 2.83 7.64 0.47 195 T_XMHurry_00 1456 0.82 1.55 0.45 196 HTML_IMAGE_ONLY_20 1426 0.67 1.12 0.45 197 XMBdyGiftCard01 1420 0.80 1.54 0.44 198 XMMoneyMeta_00 1361 0.43 0.43 0.42 199 HTML_FONT_FACE_BAD 1359 0.51 0.68 0.42 200 T_Symld_Words_02 1355 0.70 1.25 0.42 ----------------------------------------------------------------------