Email: 530441 Autolearn: 0 AvgScore: 4.01 AvgScanTime: 1.43 sec Spam: 165249 Autolearn: 0 AvgScore: 13.50 AvgScanTime: 1.56 sec Ham: 365192 Autolearn: 0 AvgScore: -0.28 AvgScanTime: 1.38 sec Time Spent Running SA: 211.24 hours Time Spent Processing Spam: 71.74 hours Time Spent Processing Ham: 139.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156319 88.93 94.60 86.37 2 DKIM_SIGNED 151430 78.88 91.64 73.11 3 XM_DK_Pass 145740 76.83 88.19 71.69 4 DKIM_VALID 144110 75.86 87.21 70.73 5 XM_B_Unicode 138741 73.95 83.96 69.42 6 RELAYCOUNTRY_US 134915 80.74 81.64 80.33 7 T_SCC_BODY_TEXT_LINE 132001 82.24 79.88 83.31 8 XMListUnsubscribeExists 120670 56.19 73.02 48.57 9 DCC_CHECK 119214 45.32 72.14 33.19 10 XM_B_SpammyWords 116598 51.76 70.56 43.26 11 DKIM_VALID_AU 109915 59.13 66.51 55.78 12 XM_B_Unicode3 71504 40.88 43.27 39.80 13 XM_DK_Undo_02 71361 17.11 43.18 5.30 14 XM_B_SpammyWords2 68217 25.45 41.28 18.29 15 TR_MAX_INTL_RELAY 66619 17.12 40.31 6.62 16 LOC_TINY_FONT_1 65071 29.68 39.38 25.30 17 BAYES_50 63675 52.90 38.53 59.39 18 HTML_FONT_LOW_CONTRAST 59362 30.31 35.92 27.77 19 BAYES_99 56331 13.57 34.09 4.28 20 TR_XM_DKIM_Undo 54048 11.78 32.71 2.31 21 FVGT_m_MULTI_ODD 53634 28.00 32.46 25.98 22 DKIM_VALID_EF 52694 29.56 31.89 28.51 23 MIME_HTML_ONLY 49787 22.72 30.13 19.36 24 T_KAM_HTML_FONT_INVALID 47637 22.52 28.83 19.67 25 DCC_CHECK_NEGATIVE 46013 54.64 27.84 66.76 26 BAYES_999 43785 10.49 26.50 3.25 27 RCVD_IN_MSPIKE_H2 40663 23.80 24.61 23.44 28 TR_DCC_Bayes_99 39758 8.73 24.06 1.80 29 XMSubLong 38606 22.96 23.36 22.77 30 TR_XM_DK_Unsub 38497 16.49 23.30 13.41 31 T_TM2_M_HEADER_IN_MSG 37546 27.41 22.72 29.53 32 XM_Multi_Part_URI 31488 15.64 19.05 14.09 33 RELAYCOUNTRY_META 30378 8.48 18.38 4.00 34 XM_B_Unsub 25569 10.35 15.47 8.03 35 TR_XM_BayesUnsub 24687 9.07 14.94 6.42 36 UNPARSEABLE_RELAY 24318 11.34 14.72 9.81 37 XM_B_SpammyWords3 23693 7.76 14.34 4.78 38 TR_XM_SpammyRelay 23538 5.81 14.24 2.00 39 LOTS_OF_MONEY 23347 8.76 14.13 6.33 40 BOTNET_IPINHOSTNAME 22255 6.97 13.47 4.03 41 TR_XM_SpammyWords2 21904 4.61 13.26 0.69 42 TR_XM_SpammyWords4 20847 6.94 12.62 4.37 43 RCVD_IN_BL_SPAMCOP_NET 18695 3.90 11.31 0.55 44 XM_Evil_Numbers_Gen 16406 8.20 9.93 7.42 45 RELAYCOUNTRY_CA 15793 3.72 9.56 1.08 46 XM_Body_Dirty_Words 15267 5.41 9.24 3.68 47 BOTNET 14940 3.64 9.04 1.20 48 BAYES_80 14432 5.66 8.73 4.27 49 TR_XM_SPAMCOP 14185 2.80 8.58 0.19 50 FSL_BULK_SIG 13733 4.68 8.31 3.04 51 RCVD_IN_MSPIKE_WL 13731 6.70 8.31 5.97 52 RCVD_IN_MSPIKE_H3 13731 6.70 8.31 5.97 53 TR_XM_UnparsRelay 13609 3.56 8.24 1.45 54 XM_UncommonTLD01 12674 5.07 7.67 3.90 55 BAYES_60 12623 8.55 7.64 8.97 56 LotsOfNums_01 12112 8.05 7.33 8.37 57 HTML_IMAGE_RATIO_02 10848 5.41 6.56 4.88 58 XMBody_17 10377 2.32 6.28 0.52 59 XMSubMetaSx_00 9960 4.90 6.03 4.39 60 BAYES_95 9958 3.48 6.03 2.33 61 UNTRUSTED_Relay 9571 2.86 5.79 1.53 62 HTML_IMAGE_RATIO_04 9528 4.92 5.77 4.54 63 XMNumbers 9371 3.58 5.67 2.64 64 XM_H_Long_From01 9323 5.42 5.64 5.32 65 MPART_ALT_DIFF 9153 4.37 5.54 3.84 66 TooManyTo_001 9133 8.03 5.53 9.16 67 XM_SPF_SoftFail 8625 3.70 5.22 3.02 68 XM_B_Phish_Phrases 8423 4.11 5.10 3.66 69 XM_OfRef6 7782 2.39 4.71 1.35 70 XMSexyCombo_05 7771 2.84 4.70 1.99 71 TR_XM_SpammyWords5 7600 2.36 4.60 1.35 72 SpammyFromTLD_01 7527 2.09 4.55 0.97 73 DKIM_INVALID 7320 3.02 4.43 2.38 74 TR_XM_PhishingBody 7136 2.69 4.32 1.95 75 XM_H_GMP 6886 5.63 4.17 6.29 76 XM_B_Investor 6876 2.49 4.16 1.73 77 T_FILL_THIS_FORM_SHORT 6819 2.04 4.13 1.10 78 HTML_IMAGE_RATIO_06 6739 3.85 4.08 3.75 79 MIME_HTML_MOSTLY 6530 2.66 3.95 2.07 80 TR_XM_PHPForged 6278 1.57 3.80 0.55 81 TR_XM_PHPDW 6259 1.55 3.79 0.54 82 TR_XM_FormFill2 6192 1.54 3.75 0.55 83 XM_H_PHPOS 6169 1.53 3.73 0.53 84 MIME_QP_LONG_LINE 5987 4.64 3.62 5.10 85 T_XMDrugObfuBody_14 5832 2.30 3.53 1.74 86 XM_B_SpammyTLD 5738 2.70 3.47 2.35 87 T_XMDrugObfuBody_08 5685 2.17 3.44 1.59 88 TR_LOTS_OF_MONEY3 5651 1.35 3.42 0.42 89 MIME_HTML_ONLY_MULTI 5573 2.59 3.37 2.24 90 XMStrtUSub 5154 3.90 3.12 4.25 91 XMDiploma_00 5029 2.01 3.04 1.54 92 XM_CamelCaseFrm001 4851 2.49 2.94 2.29 93 FONT_INVIS_LONG_LINE 4790 0.94 2.90 0.05 94 RCVD_IN_VALIDITY_SAFE 4741 3.87 2.87 4.33 95 TM2_M_URI_OPT_OUT 4671 2.37 2.83 2.16 96 TR_XM_BayesRelay 4593 0.87 2.78 0.00 97 XM_B_SpammyWords4 4583 1.49 2.77 0.91 98 XM_URI_RBL 4529 0.97 2.74 0.17 99 XM_UB50 4479 1.54 2.71 1.01 100 TM2_M_VERY_LONG_WORD 4443 1.69 2.69 1.23 101 XM_B_Unsub2 4293 1.87 2.60 1.55 102 HTML_IMAGE_RATIO_08 4263 2.28 2.58 2.14 103 USER_IN_DEF_DKIM_WL 4232 8.61 2.56 11.34 104 SUBJ_ALL_CAPS 4201 1.85 2.54 1.54 105 TR_XM_FormFill 4139 0.79 2.50 0.01 106 SCC_BODY_URI_ONLY 4036 2.43 2.44 2.42 107 RCVD_IN_VALIDITY_CERTIFIED 3975 3.37 2.41 3.81 108 T_TooManySym_01 3953 4.52 2.39 5.48 109 RCVD_IN_IADB_LISTED 3727 3.79 2.26 4.49 110 FROM_EXCESS_BASE64 3540 1.93 2.14 1.83 111 RELAYCOUNTRY_AU 3494 1.12 2.11 0.68 112 BAYES_40 3429 3.99 2.08 4.86 113 RCVD_IN_IADB_SPF 3340 3.37 2.02 3.98 114 T_REMOTE_IMAGE 3157 2.94 1.91 3.41 115 RCVD_IN_IADB_SENDERID 3123 3.05 1.89 3.58 116 XMStockSpam_06 3119 1.38 1.89 1.15 117 RCVD_IN_IADB_DK 3116 2.99 1.89 3.48 118 TM2_M_BODY_EMPTY 3090 0.87 1.87 0.42 119 MAILING_LIST_MULTI 3062 2.51 1.85 2.81 120 URI_HEX 3054 1.42 1.85 1.22 121 TR_XM_NoHeaderRelay 2984 0.65 1.81 0.13 122 XMEmptyBody_01 2955 0.61 1.79 0.08 123 TR_Mismatch_TLD_02 2895 0.63 1.75 0.12 124 XM_SendGrid 2806 1.43 1.70 1.31 125 T_XMHurry_00 2715 0.90 1.64 0.56 126 SpammyFromTLD_02 2711 0.68 1.64 0.24 127 BOUNCE_MESSAGE 2642 3.51 1.60 4.38 128 ANY_BOUNCE_MESSAGE 2642 3.51 1.60 4.38 129 BAYES_20 2592 2.91 1.57 3.51 130 HTML_TAG_BALANCE_BODY 2548 0.75 1.54 0.39 131 XM_HighProb1 2478 0.47 1.50 0.00 132 XM_DIRTYINTL 2459 0.58 1.49 0.18 133 T_XMDrugObfuBody_00 2448 0.86 1.48 0.58 134 TR_XM_INV_DKIM 2432 0.50 1.47 0.06 135 XM_DK_Undo_01 2416 1.90 1.46 2.11 136 HK_RANDOM_REPLYTO 2383 0.51 1.44 0.09 137 HTML_MIME_NO_HTML_TAG 2345 1.75 1.42 1.91 138 URI_NOVOWEL 2297 1.63 1.39 1.74 139 BOTNET_NORDNS 2210 0.42 1.34 0.01 140 XM_B_Phish66 2148 0.60 1.30 0.29 141 URI_TRY_3LD 2115 0.80 1.28 0.58 142 XMSexyCombo_01 2106 0.64 1.27 0.35 143 XMLngstWrd_00 2077 0.85 1.26 0.67 144 XMBdyGiftCard01 2074 0.81 1.26 0.61 145 AC_BR_BONANZA 2070 0.45 1.25 0.08 146 XMGenDplmaNmb 2067 1.02 1.25 0.92 147 HTTPS_HTTP_MISMATCH 2067 1.02 1.25 0.91 148 XMPhish30 2009 0.92 1.22 0.78 149 XMHTML_After_End 1998 1.34 1.21 1.40 150 ALL_TRUSTED 1997 11.80 1.21 16.59 151 TR_XM_Base64_M1 1979 0.72 1.20 0.51 152 XMBody_78 1970 0.62 1.19 0.36 153 TR_Symld_Words 1941 1.54 1.17 1.71 154 XM_OfRef7 1924 0.53 1.16 0.24 155 TR_XM_InvalidRelay 1897 0.37 1.15 0.02 156 THIS_AD 1865 0.65 1.13 0.43 157 XM_H_PHPMailer 1828 0.84 1.11 0.72 158 XMBrknScrpt_02 1824 0.64 1.10 0.42 159 XMReplyNow 1823 0.53 1.10 0.27 160 KHOP_HELO_FCRDNS 1804 1.13 1.09 1.14 161 T_Symld_Words_02 1787 0.77 1.08 0.62 162 TR_Caps_n_Bayes_99 1780 0.35 1.08 0.02 163 T_MONEY_PERCENT 1747 0.49 1.06 0.24 164 TR_LOTS_OF_MONEY2 1747 0.49 1.06 0.24 165 DKIM_ADSP_CUSTOM_MED 1743 0.99 1.05 0.96 166 TooManyTo_002 1733 2.45 1.05 3.08 167 XM_B_COPY_HTML 1712 0.74 1.04 0.60 168 URIBL_DBL_SPAM 1704 0.32 1.03 0.01 169 RCVD_IN_IADB_VOUCHED 1695 2.20 1.03 2.73 170 PLING_QUERY 1677 0.69 1.01 0.54 171 XMPhish14 1658 0.64 1.00 0.47 172 RDNS_DYNAMIC 1648 0.53 1.00 0.31 173 XM_UB99 1645 0.31 1.00 0.00 174 TR_XM_DK_SendGrid 1617 0.88 0.98 0.84 175 XMSubMetaSxObfu_03 1601 0.60 0.97 0.44 176 FORGED_GMAIL_RCVD 1558 0.72 0.94 0.62 177 PDS_OTHER_BAD_TLD 1543 0.37 0.93 0.11 178 SHOPIFY_IMG_NOT_RCVD_SFY 1532 0.55 0.93 0.37 179 XM_H_Long_From02 1513 1.07 0.92 1.14 180 TooManyTo_003 1502 1.38 0.91 1.59 181 XM_H_Undi_Recip 1498 0.41 0.91 0.18 182 HTML_FONT_FACE_BAD 1489 0.57 0.90 0.42 183 XM_Combo_Sbj 1487 0.63 0.90 0.50 184 XM_B_COVIDMETA 1473 0.46 0.89 0.27 185 XM_S_SpammyWords 1467 0.65 0.89 0.54 186 TR_XM_Spammywords 1464 0.65 0.89 0.54 187 TR_MetaPhish_Combo_01 1448 0.79 0.88 0.75 188 RCVD_IN_VALIDITY_RPBL 1447 0.31 0.88 0.05 189 NML_ADSP_CUSTOM_MED 1447 0.67 0.88 0.58 190 MPART_ALT_DIFF_COUNT 1438 0.65 0.87 0.55 191 XM_B_DNDMA 1427 0.45 0.86 0.27 192 TooManyTo_004 1419 1.09 0.86 1.19 193 RELAYCOUNTRY_FR 1402 0.44 0.85 0.26 194 REMOVE_BEFORE_LINK 1384 0.40 0.84 0.20 195 SUBJ_DOLLARS 1371 0.45 0.83 0.28 196 XM_UB60 1362 0.29 0.82 0.05 197 TooManyTo_005 1354 0.95 0.82 1.00 198 XM_B_SEO 1343 0.34 0.81 0.12 199 TR_Mismatch_TLD_01 1303 0.43 0.79 0.27 200 TVD_RCVD_IP 1294 1.16 0.78 1.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 315415 88.93 94.60 86.37 2 T_SCC_BODY_TEXT_LINE 304244 82.24 79.88 83.31 3 RELAYCOUNTRY_US 293362 80.74 81.64 80.33 4 DKIM_SIGNED 267005 78.88 91.64 73.11 5 XM_DK_Pass 261791 76.83 88.19 71.69 6 DKIM_VALID 258304 75.86 87.21 70.73 7 XM_B_Unicode 253523 73.95 83.96 69.42 8 DCC_CHECK_NEGATIVE 243818 54.64 27.84 66.76 9 BAYES_50 216904 52.90 38.53 59.39 10 DKIM_VALID_AU 203712 59.13 66.51 55.78 11 XMListUnsubscribeExists 177363 56.19 73.02 48.57 12 XM_B_SpammyWords 157980 51.76 70.56 43.26 13 XM_B_Unicode3 145329 40.88 43.27 39.80 14 DCC_CHECK 121197 45.32 72.14 33.19 15 T_TM2_M_HEADER_IN_MSG 107859 27.41 22.72 29.53 16 DKIM_VALID_EF 104120 29.56 31.89 28.51 17 HTML_FONT_LOW_CONTRAST 101431 30.31 35.92 27.77 18 FVGT_m_MULTI_ODD 94888 28.00 32.46 25.98 19 LOC_TINY_FONT_1 92379 29.68 39.38 25.30 20 RCVD_IN_MSPIKE_H2 85601 23.80 24.61 23.44 21 XMSubLong 83172 22.96 23.36 22.77 22 T_KAM_HTML_FONT_INVALID 71827 22.52 28.83 19.67 23 MIME_HTML_ONLY 70708 22.72 30.13 19.36 24 XM_B_SpammyWords2 66790 25.45 41.28 18.29 25 ALL_TRUSTED 60600 11.80 1.21 16.59 26 XM_Multi_Part_URI 51473 15.64 19.05 14.09 27 TR_XM_DK_Unsub 48958 16.49 23.30 13.41 28 USER_IN_DEF_DKIM_WL 41414 8.61 2.56 11.34 29 UNPARSEABLE_RELAY 35819 11.34 14.72 9.81 30 BAYES_00 35227 6.82 0.59 9.65 31 TooManyTo_001 33442 8.03 5.53 9.16 32 BAYES_60 32752 8.55 7.64 8.97 33 XM_DKIMWhitelistDomains 31169 5.90 0.07 8.53 34 LotsOfNums_01 30576 8.05 7.33 8.37 35 XM_B_Unsub 29311 10.35 15.47 8.03 36 XM_Evil_Numbers_Gen 27107 8.20 9.93 7.42 37 TR_MAX_INTL_RELAY 24169 17.12 40.31 6.62 38 IN_ZIMBRA_NJ_WHITELIST 23824 4.52 0.08 6.52 39 TR_XM_DK_Bayes 23501 4.56 0.43 6.44 40 TR_XM_BayesUnsub 23428 9.07 14.94 6.42 41 TR_XM_DK_Bayes1 23193 4.50 0.42 6.35 42 LOTS_OF_MONEY 23118 8.76 14.13 6.33 43 XM_H_GMP 22965 5.63 4.17 6.29 44 RCVD_IN_MSPIKE_H3 21812 6.70 8.31 5.97 45 RCVD_IN_MSPIKE_WL 21812 6.70 8.31 5.97 46 T_TooManySym_01 20003 4.52 2.39 5.48 47 TR_XM_DK_Bayes2 19897 3.86 0.36 5.45 48 XM_H_Long_From01 19439 5.42 5.64 5.32 49 XM_DK_Undo_02 19373 17.11 43.18 5.30 50 MIME_QP_LONG_LINE 18621 4.64 3.62 5.10 51 HTML_IMAGE_RATIO_02 17825 5.41 6.56 4.88 52 BAYES_40 17751 3.99 2.08 4.86 53 XM_B_SpammyWords3 17449 7.76 14.34 4.78 54 HTML_IMAGE_RATIO_04 16583 4.92 5.77 4.54 55 RCVD_IN_IADB_LISTED 16382 3.79 2.26 4.49 56 XMSubMetaSx_00 16027 4.90 6.03 4.39 57 ANY_BOUNCE_MESSAGE 16003 3.51 1.60 4.38 58 BOUNCE_MESSAGE 16003 3.51 1.60 4.38 59 TR_XM_SpammyWords4 15951 6.94 12.62 4.37 60 RCVD_IN_VALIDITY_SAFE 15809 3.87 2.87 4.33 61 BAYES_99 15631 13.57 34.09 4.28 62 BAYES_80 15610 5.66 8.73 4.27 63 XMStrtUSub 15510 3.90 3.12 4.25 64 XM_PDF 14862 2.96 0.52 4.07 65 BOTNET_IPINHOSTNAME 14722 6.97 13.47 4.03 66 RELAYCOUNTRY_META 14617 8.48 18.38 4.00 67 RCVD_IN_IADB_SPF 14528 3.37 2.02 3.98 68 XM_UncommonTLD01 14234 5.07 7.67 3.90 69 MPART_ALT_DIFF 14019 4.37 5.54 3.84 70 RCVD_IN_VALIDITY_CERTIFIED 13910 3.37 2.41 3.81 71 HTML_IMAGE_RATIO_06 13687 3.85 4.08 3.75 72 XM_Body_Dirty_Words 13449 5.41 9.24 3.68 73 XM_B_Phish_Phrases 13380 4.11 5.10 3.66 74 RCVD_IN_IADB_SENDERID 13074 3.05 1.89 3.58 75 BAYES_20 12821 2.91 1.57 3.51 76 RCVD_IN_IADB_DK 12724 2.99 1.89 3.48 77 T_REMOTE_IMAGE 12458 2.94 1.91 3.41 78 BAYES_999 11875 10.49 26.50 3.25 79 TooManyTo_002 11254 2.45 1.05 3.08 80 FSL_BULK_SIG 11098 4.68 8.31 3.04 81 XM_SPF_SoftFail 11024 3.70 5.22 3.02 82 MAILING_LIST_MULTI 10256 2.51 1.85 2.81 83 RCVD_IN_IADB_VOUCHED 9988 2.20 1.03 2.73 84 BAYES_05 9978 2.12 0.75 2.73 85 XMNumbers 9624 3.58 5.67 2.64 86 T_TooManySym_02 9342 2.00 0.76 2.56 87 SCC_BODY_URI_ONLY 8853 2.43 2.44 2.42 88 DKIM_INVALID 8701 3.02 4.43 2.38 89 XM_B_SpammyTLD 8575 2.70 3.47 2.35 90 BAYES_95 8518 3.48 6.03 2.33 91 TR_XM_DKIM_Undo 8426 11.78 32.71 2.31 92 XM_CamelCaseFrm001 8380 2.49 2.94 2.29 93 MIME_HTML_ONLY_MULTI 8169 2.59 3.37 2.24 94 TM2_M_URI_OPT_OUT 7883 2.37 2.83 2.16 95 HTML_IMAGE_RATIO_08 7815 2.28 2.58 2.14 96 XM_DK_Undo_01 7688 1.90 1.46 2.11 97 MIME_HTML_MOSTLY 7573 2.66 3.95 2.07 98 INVALID_MSGID 7484 1.46 0.16 2.05 99 TR_XM_SpammyRelay 7291 5.81 14.24 2.00 100 XMSexyCombo_05 7284 2.84 4.70 1.99 101 TR_XM_PhishingBody 7109 2.69 4.32 1.95 102 HELO_NODOT 6982 1.53 0.68 1.91 103 HELO_NO_DOMAIN 6977 1.53 0.68 1.91 104 HTML_MIME_NO_HTML_TAG 6959 1.75 1.42 1.91 105 RCVD_IN_IADB_OPTIN 6707 1.46 0.63 1.84 106 FROM_EXCESS_BASE64 6684 1.93 2.14 1.83 107 TR_DCC_Bayes_99 6560 8.73 24.06 1.80 108 TO_MALFORMED 6450 1.23 0.04 1.77 109 URI_NOVOWEL 6359 1.63 1.39 1.74 110 T_XMDrugObfuBody_14 6358 2.30 3.53 1.74 111 XM_B_Investor 6335 2.49 4.16 1.73 112 TR_Symld_Words 6229 1.54 1.17 1.71 113 XMGappySubj_01 6007 1.26 0.42 1.64 114 XMBody_95 5852 1.18 0.24 1.60 115 T_XMDrugObfuBody_08 5824 2.17 3.44 1.59 116 TooManyTo_003 5793 1.38 0.91 1.59 117 XM_B_Unsub2 5649 1.87 2.60 1.55 118 SUBJ_ALL_CAPS 5631 1.85 2.54 1.54 119 XMDiploma_00 5612 2.01 3.04 1.54 120 UNTRUSTED_Relay 5582 2.86 5.79 1.53 121 IN_HORDE_ADDRESS_BOOK 5305 1.02 0.08 1.45 122 TR_XM_UnparsRelay 5287 3.56 8.24 1.45 123 XMHTML_After_End 5126 1.34 1.21 1.40 124 TR_XM_SpammyWords5 4942 2.36 4.60 1.35 125 XM_OfRef6 4917 2.39 4.71 1.35 126 TVD_RCVD_IP 4883 1.16 0.78 1.34 127 XM_SendGrid 4782 1.43 1.70 1.31 128 XM_H_Trusted_IP 4658 0.88 0.00 1.28 129 XM_GoogleGroups 4598 1.01 0.47 1.26 130 TO_NO_BRKTS_HTML_ONLY 4554 0.92 0.19 1.25 131 TM2_M_VERY_LONG_WORD 4499 1.69 2.69 1.23 132 URI_HEX 4460 1.42 1.85 1.22 133 BOTNET 4372 3.64 9.04 1.20 134 TooManyTo_004 4351 1.09 0.86 1.19 135 XMGappySubj_02 4216 0.86 0.22 1.15 136 XMStockSpam_06 4190 1.38 1.89 1.15 137 KHOP_HELO_FCRDNS 4171 1.13 1.09 1.14 138 XM_H_Long_From02 4171 1.07 0.92 1.14 139 XMCapTrack 4134 0.89 0.35 1.13 140 TVD_SPACE_RATIO 4061 0.81 0.15 1.11 141 T_FILL_THIS_FORM_SHORT 4002 2.04 4.13 1.10 142 RELAYCOUNTRY_CA 3948 3.72 9.56 1.08 143 XMBSHREFv2 3932 0.84 0.32 1.08 144 XMNoVowels 3834 0.87 0.48 1.05 145 XM_UB50 3675 1.54 2.71 1.01 146 TooManyTo_005 3667 0.95 0.82 1.00 147 SpammyFromTLD_01 3551 2.09 4.55 0.97 148 XM_B_FormFill 3531 0.68 0.04 0.97 149 DKIM_ADSP_CUSTOM_MED 3509 0.99 1.05 0.96 150 T_TooManySym_03 3363 0.73 0.32 0.92 151 XMGenDplmaNmb 3342 1.02 1.25 0.92 152 XM_B_SpammyWords4 3324 1.49 2.77 0.91 153 HTTPS_HTTP_MISMATCH 3322 1.02 1.25 0.91 154 XM_ProductURIs 3284 0.84 0.72 0.90 155 RCVD_IN_RP_SAFE 3080 0.77 0.62 0.84 156 TR_XM_DK_SendGrid 3068 0.88 0.98 0.84 157 XMSubNoVowel 2998 0.69 0.41 0.82 158 XMPhish30 2852 0.92 1.22 0.78 159 XM_ShortIntro_01 2753 0.67 0.49 0.75 160 TR_MetaPhish_Combo_01 2723 0.79 0.88 0.75 161 RCVD_IN_RP_CERTIFIED 2700 0.67 0.51 0.74 162 XM_H_PHPMailer 2630 0.84 1.11 0.72 163 TR_XM_SpammyWords2 2529 4.61 13.26 0.69 164 RELAYCOUNTRY_AU 2468 1.12 2.11 0.68 165 XMLngstWrd_00 2442 0.85 1.26 0.67 166 HTML_OBFUSCATE_05_10 2436 0.62 0.51 0.67 167 FILL_THIS_FORM 2421 0.56 0.35 0.66 168 MSGID_NOFQDN1 2399 0.46 0.02 0.66 169 T_OBFU_PDF_ATTACH 2296 0.46 0.08 0.63 170 T_Symld_Words_02 2280 0.77 1.08 0.62 171 FORGED_GMAIL_RCVD 2255 0.72 0.94 0.62 172 XMMoneyMeta_00 2231 0.66 0.77 0.61 173 XMBdyGiftCard01 2221 0.81 1.26 0.61 174 XM_B_COPY_HTML 2201 0.74 1.04 0.60 175 SHORT_HELO_AND_INLINE_IMAGE 2200 0.43 0.04 0.60 176 T_XMDrugObfuBody_00 2136 0.86 1.48 0.58 177 FROM_GOV_DKIM_AU 2136 0.45 0.15 0.58 178 URI_TRY_3LD 2119 0.80 1.28 0.58 179 NML_ADSP_CUSTOM_MED 2116 0.67 0.88 0.58 180 USER_IN_WHITELIST 2072 0.39 0.00 0.57 181 USER_IN_WELCOMELIST 2072 0.39 0.00 0.57 182 T_XMHurry_00 2042 0.90 1.64 0.56 183 TR_XM_PHPForged 2025 1.57 3.80 0.55 184 RCVD_IN_BL_SPAMCOP_NET 2008 3.90 11.31 0.55 185 TR_XM_FormFill2 1994 1.54 3.75 0.55 186 MPART_ALT_DIFF_COUNT 1991 0.65 0.87 0.55 187 PLING_QUERY 1974 0.69 1.01 0.54 188 TR_XM_PHPDW 1961 1.55 3.79 0.54 189 TR_XM_Spammywords 1958 0.65 0.89 0.54 190 XM_S_SpammyWords 1958 0.65 0.89 0.54 191 RELAYCOUNTRY_GB 1958 0.59 0.72 0.54 192 XM_H_PHPOS 1921 1.53 3.73 0.53 193 XMBody_17 1908 2.32 6.28 0.52 194 HTML_IMAGE_ONLY_28 1876 0.47 0.36 0.51 195 TR_XM_Base64_M1 1846 0.72 1.20 0.51 196 XM_Combo_Sbj 1840 0.63 0.90 0.50 197 XMPhish14 1715 0.64 1.00 0.47 198 XMSlimDrugH 1679 0.52 0.67 0.46 199 XMSubMetaSxObfu_03 1600 0.60 0.97 0.44 200 T_MANY_PILL_PRICE 1573 0.31 0.04 0.43 ----------------------------------------------------------------------