Email: 553840 Autolearn: 0 AvgScore: 2.04 AvgScanTime: 1.70 sec Spam: 157541 Autolearn: 0 AvgScore: 13.49 AvgScanTime: 1.84 sec Ham: 396299 Autolearn: 0 AvgScore: -2.51 AvgScanTime: 1.65 sec Time Spent Running SA: 261.83 hours Time Spent Processing Spam: 80.74 hours Time Spent Processing Ham: 181.09 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148341 89.16 94.16 87.17 2 DKIM_SIGNED 143151 71.53 90.87 63.85 3 XM_DK_Pass 137530 69.61 87.30 62.58 4 DKIM_VALID 135817 68.71 86.21 61.75 5 XM_B_Unicode 128731 75.17 81.71 72.56 6 RELAYCOUNTRY_US 126480 81.58 80.28 82.10 7 T_SCC_BODY_TEXT_LINE 125755 82.35 79.82 83.36 8 XMListUnsubscribeExists 112897 50.85 71.66 42.58 9 XM_B_SpammyWords 112460 50.49 71.38 42.19 10 DCC_CHECK 108000 38.84 68.55 27.03 11 DKIM_VALID_AU 101851 53.89 64.65 49.61 12 XM_B_Unicode3 69770 43.53 44.29 43.23 13 XM_DK_Undo_02 68648 16.06 43.57 5.12 14 XM_B_SpammyWords2 66608 23.68 42.28 16.28 15 LOC_TINY_FONT_1 61583 26.13 39.09 20.97 16 BAYES_50 61547 51.91 39.07 57.02 17 HTML_FONT_LOW_CONTRAST 55478 28.02 35.21 25.17 18 DKIM_VALID_EF 52331 26.84 33.22 24.31 19 BAYES_99 52239 12.32 33.16 4.04 20 TR_XM_DKIM_Undo 51447 10.85 32.66 2.17 21 MIME_HTML_ONLY 50895 24.94 32.31 22.01 22 DCC_CHECK_NEGATIVE 49515 61.13 31.43 72.94 23 FVGT_m_MULTI_ODD 48167 24.75 30.57 22.43 24 T_KAM_HTML_FONT_INVALID 44141 20.63 28.02 17.69 25 BAYES_999 40821 9.59 25.91 3.11 26 RCVD_IN_MSPIKE_H2 39805 21.91 25.27 20.58 27 XMSubLong 37901 22.73 24.06 22.21 28 TR_XM_DK_Unsub 37836 15.07 24.02 11.52 29 TR_MAX_INTL_RELAY 37082 10.81 23.54 5.75 30 T_TM2_M_HEADER_IN_MSG 37052 24.97 23.52 25.55 31 TR_DCC_Bayes_99 35083 7.31 22.27 1.37 32 XM_Multi_Part_URI 30902 14.30 19.62 12.19 33 RELAYCOUNTRY_META 30282 8.04 19.22 3.59 34 TR_XM_SpammyRelay 24370 5.77 15.47 1.92 35 LOTS_OF_MONEY 24183 8.62 15.35 5.95 36 XM_B_Unsub 23971 9.24 15.22 6.86 37 TR_XM_BayesUnsub 23181 8.08 14.71 5.44 38 UNPARSEABLE_RELAY 22433 10.05 14.24 8.39 39 XM_B_SpammyWords3 21802 7.01 13.84 4.29 40 RCVD_IN_BL_SPAMCOP_NET 21604 4.39 13.71 0.68 41 TR_XM_SpammyWords4 21571 6.89 13.69 4.19 42 BOTNET_IPINHOSTNAME 21102 6.53 13.39 3.80 43 TR_XM_SpammyWords2 20147 4.13 12.79 0.69 44 TR_XM_SPAMCOP 16223 3.12 10.30 0.27 45 RELAYCOUNTRY_CA 16211 3.59 10.29 0.93 46 BOTNET 15340 3.63 9.74 1.20 47 XM_Body_Dirty_Words 15331 5.28 9.73 3.51 48 XM_Evil_Numbers_Gen 14602 8.87 9.27 8.71 49 RCVD_IN_MSPIKE_H3 14441 6.23 9.17 5.06 50 RCVD_IN_MSPIKE_WL 14441 6.23 9.17 5.06 51 BAYES_80 14002 5.17 8.89 3.69 52 BAYES_60 12446 7.86 7.90 7.84 53 XM_UncommonTLD01 12380 4.63 7.86 3.34 54 TR_XM_UnparsRelay 12284 3.28 7.80 1.49 55 FSL_BULK_SIG 11596 4.14 7.36 2.86 56 HTML_IMAGE_RATIO_02 10868 5.01 6.90 4.26 57 LotsOfNums_01 10651 7.26 6.76 7.46 58 XMSubMetaSx_00 10527 4.23 6.68 3.26 59 MPART_ALT_DIFF 9984 8.48 6.34 9.33 60 XMBody_17 9610 2.05 6.10 0.44 61 UNTRUSTED_Relay 9507 2.66 6.03 1.32 62 XM_H_Long_From01 9302 4.97 5.90 4.59 63 BAYES_95 8994 3.16 5.71 2.15 64 XMSexyCombo_05 8495 2.55 5.39 1.42 65 HTML_IMAGE_RATIO_04 8438 12.49 5.36 15.33 66 TooManyTo_001 8428 7.65 5.35 8.57 67 XMNumbers 8418 3.37 5.34 2.58 68 XM_B_Phish_Phrases 8268 3.95 5.25 3.43 69 XM_OfRef6 8005 2.26 5.08 1.14 70 XM_SPF_SoftFail 7854 3.44 4.99 2.83 71 XM_H_GMP 7388 5.45 4.69 5.75 72 DKIM_INVALID 7334 2.82 4.66 2.10 73 SpammyFromTLD_01 7146 1.85 4.54 0.78 74 TR_XM_PhishingBody 6920 2.50 4.39 1.75 75 XM_B_Investor 6887 2.27 4.37 1.44 76 TR_XM_SpammyWords5 6635 2.07 4.21 1.22 77 T_FILL_THIS_FORM_SHORT 6594 1.81 4.19 0.87 78 MIME_HTML_MOSTLY 6493 2.81 4.12 2.29 79 TR_XM_PHPDW 6129 1.36 3.89 0.35 80 TR_XM_PHPForged 6128 1.38 3.89 0.39 81 TR_XM_FormFill2 6053 1.34 3.84 0.35 82 T_XMDrugObfuBody_08 6041 2.05 3.83 1.34 83 XM_H_PHPOS 6031 1.33 3.83 0.34 84 HTML_IMAGE_RATIO_06 6007 4.92 3.81 5.36 85 MIME_HTML_ONLY_MULTI 5894 6.60 3.74 7.74 86 XM_B_SpammyTLD 5543 2.58 3.52 2.21 87 TM2_M_URI_OPT_OUT 5352 2.12 3.40 1.61 88 T_XMDrugObfuBody_14 5298 1.97 3.36 1.42 89 MIME_QP_LONG_LINE 5297 4.24 3.36 4.59 90 XMStrtUSub 5162 8.50 3.28 10.57 91 TR_LOTS_OF_MONEY3 5092 1.21 3.23 0.41 92 TR_XM_BayesRelay 4879 0.88 3.10 0.00 93 XM_UB50 4685 1.41 2.97 0.78 94 FONT_INVIS_LONG_LINE 4587 0.85 2.91 0.04 95 XM_URI_RBL 4345 0.89 2.76 0.14 96 HTML_IMAGE_RATIO_08 4233 2.09 2.69 1.86 97 XM_CamelCaseFrm001 4193 2.09 2.66 1.86 98 TM2_M_VERY_LONG_WORD 4171 1.54 2.65 1.11 99 T_TooManySym_01 4111 4.19 2.61 4.82 100 TR_XM_FormFill 4100 0.77 2.60 0.04 101 XM_B_Unsub2 4083 1.64 2.59 1.26 102 SUBJ_ALL_CAPS 3892 1.55 2.47 1.19 103 SCC_BODY_URI_ONLY 3813 2.19 2.42 2.10 104 RELAYCOUNTRY_AU 3669 1.16 2.33 0.70 105 RCVD_IN_VALIDITY_SAFE 3616 3.32 2.30 3.72 106 XMDiploma_00 3402 1.55 2.16 1.31 107 XM_B_SpammyWords4 3391 1.06 2.15 0.63 108 URI_TRY_3LD 3361 1.03 2.13 0.59 109 TM2_M_BODY_EMPTY 3167 0.82 2.01 0.34 110 T_REMOTE_IMAGE 3115 2.82 1.98 3.16 111 FROM_EXCESS_BASE64 3114 1.77 1.98 1.69 112 BAYES_40 3061 4.24 1.94 5.16 113 USER_IN_DEF_DKIM_WL 3045 8.17 1.93 10.65 114 XMEmptyBody_01 3045 0.58 1.93 0.05 115 T_XMDrugObfuBody_00 3025 1.01 1.92 0.65 116 XMStockSpam_06 3012 1.27 1.91 1.01 117 BAYES_20 2946 3.28 1.87 3.83 118 XM_DIRTYINTL 2926 0.67 1.86 0.20 119 HTML_MIME_NO_HTML_TAG 2885 1.73 1.83 1.70 120 ANY_BOUNCE_MESSAGE 2877 4.13 1.83 5.05 121 BOUNCE_MESSAGE 2875 4.13 1.82 5.05 122 MAILING_LIST_MULTI 2835 2.33 1.80 2.54 123 TR_XM_NoHeaderRelay 2833 0.58 1.80 0.09 124 RCVD_IN_VALIDITY_CERTIFIED 2824 2.80 1.79 3.19 125 T_XMHurry_00 2798 0.78 1.78 0.39 126 RCVD_IN_IADB_LISTED 2784 3.22 1.77 3.79 127 TR_Mismatch_TLD_02 2687 0.54 1.71 0.07 128 XM_DK_Undo_01 2686 1.63 1.70 1.60 129 SpammyFromTLD_02 2645 0.74 1.68 0.36 130 HK_RANDOM_REPLYTO 2639 0.52 1.68 0.06 131 XM_OfRef7 2624 0.56 1.67 0.12 132 TR_XM_INV_DKIM 2592 0.51 1.65 0.05 133 XM_H_Long_From02 2542 1.19 1.61 1.02 134 RCVD_IN_IADB_SPF 2426 2.86 1.54 3.39 135 XM_H_Undi_Recip 2344 0.54 1.49 0.16 136 RCVD_IN_IADB_DK 2292 2.54 1.45 2.97 137 RCVD_IN_IADB_SENDERID 2283 2.59 1.45 3.05 138 URI_HEX 2283 1.14 1.45 1.01 139 XMReplyNow 2228 0.55 1.41 0.21 140 XMSexyCombo_01 2227 0.55 1.41 0.20 141 XM_HighProb1 2193 0.40 1.39 0.00 142 RCVD_IN_PSBL 2192 0.65 1.39 0.35 143 HTML_TAG_BALANCE_BODY 2185 0.67 1.39 0.38 144 RCVD_IN_VALIDITY_RPBL 2156 0.42 1.37 0.05 145 XM_B_Phish66 2114 0.59 1.34 0.30 146 URI_NOVOWEL 2103 1.44 1.33 1.49 147 BOTNET_NORDNS 2095 0.38 1.33 0.01 148 XM_SendGrid 2035 1.17 1.29 1.12 149 XMPhish30 2016 0.81 1.28 0.62 150 FILL_THIS_FORM 2003 0.77 1.27 0.57 151 KHOP_HELO_FCRDNS 1984 1.09 1.26 1.03 152 XM_B_COVIDMETA 1978 0.48 1.26 0.18 153 FILL_THIS_FORM_LONG 1887 0.55 1.20 0.29 154 ALL_TRUSTED 1881 11.20 1.19 15.18 155 XMHTML_After_End 1867 0.83 1.19 0.69 156 T_MONEY_PERCENT 1864 0.47 1.18 0.19 157 TR_LOTS_OF_MONEY2 1864 0.47 1.18 0.19 158 TR_XM_Base64_M1 1857 0.82 1.18 0.67 159 AC_BR_BONANZA 1828 0.38 1.16 0.06 160 XMBrknScrpt_02 1809 0.73 1.15 0.57 161 XM_B_COPY_HTML 1770 0.73 1.12 0.58 162 PDS_OTHER_BAD_TLD 1767 0.40 1.12 0.11 163 XMGenDplmaNmb 1762 0.81 1.12 0.69 164 RDNS_DYNAMIC 1750 0.56 1.11 0.34 165 XMMoneyMeta_00 1734 0.73 1.10 0.59 166 TooManyTo_002 1726 2.04 1.10 2.41 167 XMPhish14 1710 0.66 1.09 0.48 168 TR_Symld_Words 1694 1.28 1.08 1.37 169 MONEY_ATM_CARD 1663 0.30 1.06 0.00 170 HTTPS_HTTP_MISMATCH 1662 0.92 1.05 0.87 171 MONEY_FORM 1603 0.29 1.02 0.01 172 XMLngstWrd_00 1602 0.81 1.02 0.73 173 XMSubMetaSxObfu_03 1550 0.50 0.98 0.30 174 XM_H_PHPMailer 1539 0.78 0.98 0.70 175 TooManyTo_003 1538 1.29 0.98 1.41 176 XM_B_Crypto 1535 0.36 0.97 0.12 177 XM_S_SpammyWords 1508 0.40 0.96 0.18 178 TR_XM_Spammywords 1508 0.40 0.96 0.18 179 TR_Sbj_FN_Bdy 1503 0.35 0.95 0.10 180 TR_XM_Undi_Recip5 1499 0.27 0.95 0.01 181 TR_XM_Undi_RecipCombo2 1490 0.27 0.95 0.00 182 T_XMDrugObfuBody_10 1489 0.28 0.95 0.02 183 BAYES_05 1454 2.85 0.92 3.62 184 XMBdyGiftCard01 1445 0.76 0.92 0.69 185 TooManyTo_004 1441 0.98 0.91 1.01 186 XM_UB60 1428 0.30 0.91 0.06 187 XMSubMetaI_00 1425 0.59 0.90 0.47 188 T_TooManySym_02 1422 1.87 0.90 2.26 189 REMOVE_BEFORE_LINK 1421 0.46 0.90 0.28 190 XM_UB99 1420 0.26 0.90 0.00 191 TR_MetaPhish_Combo_01 1411 0.74 0.90 0.67 192 TR_Caps_n_Bayes_99 1410 0.26 0.90 0.01 193 T_Symld_Words_02 1409 0.68 0.89 0.60 194 MPART_ALT_DIFF_COUNT 1403 0.59 0.89 0.48 195 MILLION_USD 1393 0.26 0.88 0.01 196 XMSlimDrugH 1385 0.44 0.88 0.26 197 UNDISC_MONEY 1372 0.25 0.87 0.01 198 XM_B_DNDMA 1370 0.51 0.87 0.37 199 TooManyTo_005 1369 0.83 0.87 0.82 200 TR_XM_InvalidRelay 1363 0.26 0.87 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 345465 89.16 94.16 87.17 2 T_SCC_BODY_TEXT_LINE 330358 82.35 79.82 83.36 3 RELAYCOUNTRY_US 325362 81.58 80.28 82.10 4 DCC_CHECK_NEGATIVE 289069 61.13 31.43 72.94 5 XM_B_Unicode 287564 75.17 81.71 72.56 6 DKIM_SIGNED 253025 71.53 90.87 63.85 7 XM_DK_Pass 247988 69.61 87.30 62.58 8 DKIM_VALID 244717 68.71 86.21 61.75 9 BAYES_50 225967 51.91 39.07 57.02 10 DKIM_VALID_AU 196622 53.89 64.65 49.61 11 XM_B_Unicode3 171336 43.53 44.29 43.23 12 XMListUnsubscribeExists 168755 50.85 71.66 42.58 13 XM_B_SpammyWords 167199 50.49 71.38 42.19 14 DCC_CHECK 107101 38.84 68.55 27.03 15 T_TM2_M_HEADER_IN_MSG 101261 24.97 23.52 25.55 16 HTML_FONT_LOW_CONTRAST 99729 28.02 35.21 25.17 17 DKIM_VALID_EF 96346 26.84 33.22 24.31 18 FVGT_m_MULTI_ODD 88893 24.75 30.57 22.43 19 XMSubLong 88003 22.73 24.06 22.21 20 MIME_HTML_ONLY 87209 24.94 32.31 22.01 21 LOC_TINY_FONT_1 83123 26.13 39.09 20.97 22 RCVD_IN_MSPIKE_H2 81559 21.91 25.27 20.58 23 T_KAM_HTML_FONT_INVALID 70094 20.63 28.02 17.69 24 XM_B_SpammyWords2 64514 23.68 42.28 16.28 25 HTML_IMAGE_RATIO_04 60763 12.49 5.36 15.33 26 ALL_TRUSTED 60146 11.20 1.19 15.18 27 HTML_FONT_FACE_BAD 56915 10.49 0.75 14.36 28 XM_H_Trusted_IP 52285 9.44 0.00 13.19 29 BAYES_00 50163 9.21 0.54 12.66 30 XM_Multi_Part_URI 48315 14.30 19.62 12.19 31 TR_XM_DK_Unsub 45643 15.07 24.02 11.52 32 USER_IN_DEF_DKIM_WL 42207 8.17 1.93 10.65 33 XMStrtUSub 41903 8.50 3.28 10.57 34 MPART_ALT_DIFF 36962 8.48 6.34 9.33 35 XM_Evil_Numbers_Gen 34537 8.87 9.27 8.71 36 TooManyTo_001 33945 7.65 5.35 8.57 37 UNPARSEABLE_RELAY 33250 10.05 14.24 8.39 38 BAYES_60 31065 7.86 7.90 7.84 39 MIME_HTML_ONLY_MULTI 30665 6.60 3.74 7.74 40 LotsOfNums_01 29550 7.26 6.76 7.46 41 XM_DKIMWhitelistDomains 27215 4.98 0.23 6.87 42 XM_B_Unsub 27182 9.24 15.22 6.86 43 LOTS_OF_MONEY 23570 8.62 15.35 5.95 44 IN_ZIMBRA_NJ_WHITELIST 23556 4.28 0.08 5.94 45 TR_MAX_INTL_RELAY 22783 10.81 23.54 5.75 46 XM_H_GMP 22773 5.45 4.69 5.75 47 TR_XM_BayesUnsub 21569 8.08 14.71 5.44 48 TR_XM_DK_Bayes 21555 4.01 0.40 5.44 49 TR_XM_DK_Bayes1 21328 3.96 0.39 5.38 50 HTML_IMAGE_RATIO_06 21242 4.92 3.81 5.36 51 BAYES_40 20447 4.24 1.94 5.16 52 XM_DK_Undo_02 20308 16.06 43.57 5.12 53 RCVD_IN_MSPIKE_H3 20045 6.23 9.17 5.06 54 RCVD_IN_MSPIKE_WL 20045 6.23 9.17 5.06 55 ANY_BOUNCE_MESSAGE 20019 4.13 1.83 5.05 56 BOUNCE_MESSAGE 20018 4.13 1.82 5.05 57 XMSubNoVowel 19121 3.59 0.48 4.82 58 T_TooManySym_01 19088 4.19 2.61 4.82 59 TR_XM_DK_Bayes2 18328 3.40 0.31 4.62 60 XM_H_Long_From01 18209 4.97 5.90 4.59 61 MIME_QP_LONG_LINE 18179 4.24 3.36 4.59 62 XM_B_SpammyWords3 17005 7.01 13.84 4.29 63 HTML_IMAGE_RATIO_02 16873 5.01 6.90 4.26 64 TR_XM_SpammyWords4 16597 6.89 13.69 4.19 65 XM_PDF 16016 3.07 0.64 4.04 66 BAYES_99 16002 12.32 33.16 4.04 67 BAYES_20 15196 3.28 1.87 3.83 68 BOTNET_IPINHOSTNAME 15071 6.53 13.39 3.80 69 RCVD_IN_IADB_LISTED 15036 3.22 1.77 3.79 70 RCVD_IN_VALIDITY_SAFE 14752 3.32 2.30 3.72 71 BAYES_80 14609 5.17 8.89 3.69 72 BAYES_05 14336 2.85 0.92 3.62 73 RELAYCOUNTRY_META 14241 8.04 19.22 3.59 74 XM_Body_Dirty_Words 13918 5.28 9.73 3.51 75 XM_B_Phish_Phrases 13587 3.95 5.25 3.43 76 RCVD_IN_IADB_SPF 13428 2.86 1.54 3.39 77 XM_UncommonTLD01 13255 4.63 7.86 3.34 78 XMSubMetaSx_00 12917 4.23 6.68 3.26 79 RCVD_IN_VALIDITY_CERTIFIED 12659 2.80 1.79 3.19 80 T_REMOTE_IMAGE 12508 2.82 1.98 3.16 81 BAYES_999 12318 9.59 25.91 3.11 82 RCVD_IN_IADB_SENDERID 12078 2.59 1.45 3.05 83 RCVD_IN_IADB_DK 11774 2.54 1.45 2.97 84 FSL_BULK_SIG 11347 4.14 7.36 2.86 85 XM_SPF_SoftFail 11202 3.44 4.99 2.83 86 XMNumbers 10243 3.37 5.34 2.58 87 MAILING_LIST_MULTI 10063 2.33 1.80 2.54 88 TooManyTo_002 9553 2.04 1.10 2.41 89 MIME_HTML_MOSTLY 9085 2.81 4.12 2.29 90 RCVD_IN_IADB_VOUCHED 9032 1.86 0.79 2.28 91 T_TooManySym_02 8962 1.87 0.90 2.26 92 XM_B_SpammyTLD 8750 2.58 3.52 2.21 93 XMSubLongNoVowel 8683 1.61 0.14 2.19 94 TR_XM_DKIM_Undo 8619 10.85 32.66 2.17 95 XMSubGarbage 8610 1.56 0.02 2.17 96 BAYES_95 8514 3.16 5.71 2.15 97 SCC_BODY_URI_ONLY 8309 2.19 2.42 2.10 98 DKIM_INVALID 8308 2.82 4.66 2.10 99 TR_XM_SpammyRelay 7602 5.77 15.47 1.92 100 HTML_IMAGE_RATIO_08 7361 2.09 2.69 1.86 101 XM_CamelCaseFrm001 7355 2.09 2.66 1.86 102 INVALID_MSGID 7262 1.39 0.28 1.83 103 TR_XM_PhishingBody 6948 2.50 4.39 1.75 104 HTML_MIME_NO_HTML_TAG 6720 1.73 1.83 1.70 105 FROM_EXCESS_BASE64 6708 1.77 1.98 1.69 106 HELO_NODOT 6552 1.34 0.56 1.65 107 HELO_NO_DOMAIN 6542 1.34 0.54 1.65 108 TM2_M_URI_OPT_OUT 6383 2.12 3.40 1.61 109 TO_MALFORMED 6382 1.16 0.03 1.61 110 XM_DK_Undo_01 6344 1.63 1.70 1.60 111 RCVD_IN_IADB_OPTIN 6017 1.22 0.47 1.52 112 URI_NOVOWEL 5895 1.44 1.33 1.49 113 TR_XM_UnparsRelay 5887 3.28 7.80 1.49 114 XMGappySubj_01 5756 1.10 0.20 1.45 115 XM_B_Investor 5709 2.27 4.37 1.44 116 XMSexyCombo_05 5641 2.55 5.39 1.42 117 T_XMDrugObfuBody_14 5631 1.97 3.36 1.42 118 TooManyTo_003 5598 1.29 0.98 1.41 119 TR_DCC_Bayes_99 5426 7.31 22.27 1.37 120 TR_Symld_Words 5410 1.28 1.08 1.37 121 T_XMDrugObfuBody_08 5299 2.05 3.83 1.34 122 TVD_RCVD_IP 5292 1.17 0.76 1.34 123 UNTRUSTED_Relay 5228 2.66 6.03 1.32 124 XMDiploma_00 5191 1.55 2.16 1.31 125 IN_HORDE_ADDRESS_BOOK 5051 0.93 0.07 1.27 126 XM_B_Unsub2 4981 1.64 2.59 1.26 127 TR_XM_SpammyWords5 4823 2.07 4.21 1.22 128 BOTNET 4752 3.63 9.74 1.20 129 SUBJ_ALL_CAPS 4719 1.55 2.47 1.19 130 XM_GoogleGroups 4570 0.99 0.60 1.15 131 XM_OfRef6 4535 2.26 5.08 1.14 132 XM_SendGrid 4433 1.17 1.29 1.12 133 TM2_M_VERY_LONG_WORD 4380 1.54 2.65 1.11 134 XM_E_Blogspot 4121 0.78 0.12 1.04 135 KHOP_HELO_FCRDNS 4073 1.09 1.26 1.03 136 XM_H_Long_From02 4028 1.19 1.61 1.02 137 URI_HEX 4010 1.14 1.45 1.01 138 XMStockSpam_06 3996 1.27 1.91 1.01 139 TooManyTo_004 3987 0.98 0.91 1.01 140 XM_ProductURIs 3959 0.96 0.86 1.00 141 XMCapTrack 3936 0.84 0.44 0.99 142 TVD_SPACE_RATIO 3822 0.72 0.10 0.96 143 RELAYCOUNTRY_CA 3686 3.59 10.29 0.93 144 XMBSHREFv2 3632 0.76 0.35 0.92 145 XMGappySubj_02 3558 0.67 0.09 0.90 146 DKIM_ADSP_CUSTOM_MED 3458 0.86 0.82 0.87 147 T_FILL_THIS_FORM_SHORT 3429 1.81 4.19 0.87 148 HTTPS_HTTP_MISMATCH 3429 0.92 1.05 0.87 149 TooManyTo_005 3254 0.83 0.87 0.82 150 XMBody_95 3144 0.66 0.31 0.79 151 T_TooManySym_03 3122 0.67 0.36 0.79 152 XM_UB50 3100 1.41 2.97 0.78 153 SpammyFromTLD_01 3083 1.85 4.54 0.78 154 TR_XM_DK_SendGrid 3059 0.79 0.84 0.77 155 XMLngstWrd_00 2902 0.81 1.02 0.73 156 RCVD_IN_RP_SAFE 2845 0.67 0.54 0.72 157 XM_H_PHPMailer 2776 0.78 0.98 0.70 158 RELAYCOUNTRY_AU 2755 1.16 2.33 0.70 159 XMGenDplmaNmb 2749 0.81 1.12 0.69 160 TR_XM_SpammyWords2 2744 4.13 12.79 0.69 161 XMBdyGiftCard01 2739 0.76 0.92 0.69 162 XMHTML_After_End 2736 0.83 1.19 0.69 163 RCVD_IN_BL_SPAMCOP_NET 2714 4.39 13.71 0.68 164 TR_MetaPhish_Combo_01 2675 0.74 0.90 0.67 165 TR_XM_Base64_M1 2664 0.82 1.18 0.67 166 XM_ShortIntro_01 2595 0.60 0.47 0.65 167 T_XMDrugObfuBody_00 2586 1.01 1.92 0.65 168 XM_B_SpammyWords4 2503 1.06 2.15 0.63 169 RCVD_IN_RP_CERTIFIED 2458 0.57 0.44 0.62 170 XMPhish30 2444 0.81 1.28 0.62 171 MSGID_NOFQDN1 2383 0.44 0.03 0.60 172 T_Symld_Words_02 2365 0.68 0.89 0.60 173 XMMoneyMeta_00 2331 0.73 1.10 0.59 174 URI_TRY_3LD 2324 1.03 2.13 0.59 175 XM_B_COPY_HTML 2282 0.73 1.12 0.58 176 NML_ADSP_CUSTOM_MED 2263 0.58 0.61 0.57 177 FILL_THIS_FORM 2255 0.77 1.27 0.57 178 FORGED_GMAIL_RCVD 2254 0.59 0.64 0.57 179 XMBrknScrpt_02 2251 0.73 1.15 0.57 180 FROM_GOV_DKIM_AU 2234 0.51 0.36 0.56 181 XMNoVowels 2089 0.51 0.46 0.53 182 SHORT_HELO_AND_INLINE_IMAGE 2082 0.39 0.04 0.53 183 USER_IN_WELCOMELIST 2081 0.38 0.00 0.53 184 USER_IN_WHITELIST 2081 0.38 0.00 0.53 185 T_OBFU_PDF_ATTACH 2029 0.39 0.10 0.51 186 XMPhish14 1922 0.66 1.09 0.48 187 MPART_ALT_DIFF_COUNT 1884 0.59 0.89 0.48 188 XM_B_FormFill 1852 0.35 0.05 0.47 189 XMSubMetaI_00 1851 0.59 0.90 0.47 190 RELAYCOUNTRY_GB 1777 0.50 0.63 0.45 191 XMBody_17 1750 2.05 6.10 0.44 192 T_MANY_PILL_PRICE 1677 0.32 0.08 0.42 193 XMDateMe_00 1625 0.38 0.31 0.41 194 TR_LOTS_OF_MONEY3 1618 1.21 3.23 0.41 195 T_XMHurry_00 1546 0.78 1.78 0.39 196 TR_XM_PHPForged 1538 1.38 3.89 0.39 197 HTML_TAG_BALANCE_BODY 1501 0.67 1.39 0.38 198 MISSING_HEADERS 1492 0.40 0.47 0.38 199 RCVD_IN_SORBS_DUL 1484 0.28 0.05 0.37 200 TO_NO_BRKTS_HTML_ONLY 1479 0.31 0.16 0.37 ----------------------------------------------------------------------