Email: 495913 Autolearn: 0 AvgScore: 4.02 AvgScanTime: 1.07 sec Spam: 152485 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 1.18 sec Ham: 343428 Autolearn: 0 AvgScore: -0.24 AvgScanTime: 1.02 sec Time Spent Running SA: 147.35 hours Time Spent Processing Spam: 49.94 hours Time Spent Processing Ham: 97.41 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142815 86.97 93.66 84.01 2 DKIM_SIGNED 139639 77.98 91.58 71.94 3 XM_DK_Pass 133730 75.69 87.70 70.35 4 DKIM_VALID 131911 74.59 86.51 69.31 5 XM_B_Unicode 126946 71.97 83.25 66.95 6 T_SCC_BODY_TEXT_LINE 121782 82.22 79.86 83.26 7 RELAYCOUNTRY_US 120453 78.45 78.99 78.21 8 XM_B_SpammyWords 111908 52.51 73.39 43.24 9 XMListUnsubscribeExists 110145 54.23 72.23 46.23 10 DCC_CHECK 107171 42.99 70.28 30.87 11 DKIM_VALID_AU 98485 58.38 64.59 55.62 12 XM_DK_Undo_02 67338 17.64 44.16 5.86 13 XM_B_SpammyWords2 66632 25.36 43.70 17.21 14 XM_B_Unicode3 66610 39.06 43.68 37.01 15 LOC_TINY_FONT_1 59046 27.88 38.72 23.06 16 BAYES_50 59019 52.92 38.70 59.23 17 HTML_FONT_LOW_CONTRAST 53433 29.02 35.04 26.35 18 TR_XM_DKIM_Undo 53096 12.18 34.82 2.13 19 BAYES_99 52085 14.02 34.16 5.08 20 DKIM_VALID_EF 51217 30.55 33.59 29.20 21 MIME_HTML_ONLY 49770 22.66 32.64 18.23 22 FVGT_m_MULTI_ODD 47246 26.88 30.98 25.06 23 DCC_CHECK_NEGATIVE 45293 56.98 29.70 69.09 24 T_KAM_HTML_FONT_INVALID 44183 22.02 28.98 18.94 25 BAYES_999 40732 10.98 26.71 3.99 26 RCVD_IN_MSPIKE_H2 38996 24.81 25.57 24.47 27 TR_XM_DK_Unsub 36942 16.77 24.23 13.46 28 TR_DCC_Bayes_99 36074 8.36 23.66 1.56 29 T_TM2_M_HEADER_IN_MSG 34720 28.29 22.77 30.74 30 XMSubLong 34530 23.33 22.64 23.63 31 RELAYCOUNTRY_META 31974 9.33 20.97 4.16 32 XM_Multi_Part_URI 27195 14.32 17.83 12.75 33 TR_XM_SpammyRelay 26288 6.78 17.24 2.13 34 LOTS_OF_MONEY 23816 9.38 15.62 6.61 35 XM_B_Unsub 23619 10.03 15.49 7.61 36 TR_XM_BayesUnsub 22817 8.74 14.96 5.97 37 TR_XM_SpammyWords2 22473 4.90 14.74 0.53 38 TR_MAX_INTL_RELAY 21691 8.75 14.23 6.32 39 TR_XM_SpammyWords4 21158 7.44 13.88 4.59 40 BOTNET_IPINHOSTNAME 20867 7.04 13.68 4.09 41 XM_B_SpammyWords3 20289 6.70 13.31 3.77 42 UNPARSEABLE_RELAY 19908 11.15 13.06 10.31 43 RCVD_IN_BL_SPAMCOP_NET 19860 4.40 13.02 0.57 44 RELAYCOUNTRY_CA 18205 4.52 11.94 1.23 45 RCVD_IN_MSPIKE_WL 16103 7.36 10.56 5.94 46 RCVD_IN_MSPIKE_H3 16103 7.36 10.56 5.94 47 TR_XM_SPAMCOP 16002 3.41 10.49 0.26 48 XM_Body_Dirty_Words 15971 5.94 10.47 3.93 49 BOTNET 15046 3.88 9.87 1.23 50 XM_Evil_Numbers_Gen 13957 7.95 9.15 7.41 51 BAYES_80 13401 5.34 8.79 3.80 52 XM_UncommonTLD01 12504 5.11 8.20 3.74 53 BAYES_60 12117 8.50 7.95 8.75 54 FSL_BULK_SIG 11984 5.27 7.86 4.12 55 XMBody_17 10540 2.65 6.91 0.76 56 TR_XM_UnparsRelay 10304 3.27 6.76 1.72 57 HTML_IMAGE_RATIO_02 10029 5.62 6.58 5.20 58 LotsOfNums_01 9742 7.08 6.39 7.38 59 XMSubMetaSx_00 9382 5.94 6.15 5.84 60 HTML_IMAGE_RATIO_04 9200 4.67 6.03 4.06 61 UNTRUSTED_Relay 8881 2.83 5.82 1.50 62 MPART_ALT_DIFF 8753 4.03 5.74 3.27 63 TooManyTo_001 8746 8.72 5.74 10.05 64 XM_H_Long_From01 8630 5.18 5.66 4.97 65 XMSexyCombo_05 8424 3.14 5.52 2.08 66 XMNumbers 8345 3.46 5.47 2.56 67 XM_SPF_SoftFail 8016 3.70 5.26 3.01 68 XM_B_Phish_Phrases 7887 3.72 5.17 3.08 69 BAYES_95 7782 3.31 5.10 2.51 70 DKIM_INVALID 7728 3.38 5.07 2.63 71 XM_H_GMP 7602 6.11 4.99 6.61 72 SpammyFromTLD_01 7453 2.03 4.89 0.76 73 T_FILL_THIS_FORM_SHORT 7213 2.18 4.73 1.05 74 XM_OfRef6 6744 2.42 4.42 1.53 75 XM_B_Investor 6671 2.43 4.37 1.57 76 TR_XM_SpammyWords5 6398 2.25 4.20 1.38 77 TR_LOTS_OF_MONEY3 6396 1.67 4.19 0.55 78 XMStrtUSub 6342 4.40 4.16 4.50 79 T_XMDrugObfuBody_08 6311 2.42 4.14 1.66 80 TR_XM_PhishingBody 6196 2.44 4.06 1.72 81 TR_XM_PHPForged 5672 1.57 3.72 0.61 82 TR_XM_BayesRelay 5649 1.14 3.70 0.00 83 TR_XM_PHPDW 5620 1.55 3.69 0.60 84 TR_XM_FormFill2 5555 1.54 3.64 0.61 85 MIME_HTML_MOSTLY 5542 2.45 3.63 1.92 86 XM_H_PHPOS 5510 1.52 3.61 0.58 87 T_XMDrugObfuBody_14 5337 2.17 3.50 1.57 88 MIME_HTML_ONLY_MULTI 5285 2.44 3.47 1.98 89 FONT_INVIS_LONG_LINE 5164 1.07 3.39 0.05 90 XM_B_SpammyTLD 5023 2.63 3.29 2.33 91 HTML_IMAGE_RATIO_06 5017 2.73 3.29 2.48 92 TM2_M_URI_OPT_OUT 4782 2.17 3.14 1.74 93 TR_XM_FormFill 4652 0.96 3.05 0.03 94 XM_UB50 4633 1.54 3.04 0.88 95 XM_URI_RBL 4608 1.03 3.02 0.14 96 TM2_M_VERY_LONG_WORD 4533 1.76 2.97 1.23 97 XMDiploma_00 4358 2.06 2.86 1.71 98 MIME_QP_LONG_LINE 4344 3.99 2.85 4.50 99 XM_CamelCaseFrm001 4117 2.35 2.70 2.20 100 HTML_IMAGE_RATIO_08 4058 2.02 2.66 1.74 101 RCVD_IN_VALIDITY_SAFE 4029 3.56 2.64 3.97 102 SUBJ_ALL_CAPS 4016 1.90 2.63 1.57 103 T_TooManySym_01 3849 4.86 2.52 5.90 104 SCC_BODY_URI_ONLY 3844 2.65 2.52 2.70 105 XM_B_Unsub2 3836 1.71 2.52 1.35 106 TR_Mismatch_TLD_02 3809 0.83 2.50 0.09 107 XMBrknScrpt_02 3652 1.11 2.39 0.55 108 RELAYCOUNTRY_AU 3608 1.17 2.37 0.63 109 TR_XM_NoHeaderRelay 3591 0.81 2.35 0.13 110 RCVD_IN_VALIDITY_CERTIFIED 3155 3.03 2.07 3.46 111 TM2_M_BODY_EMPTY 3103 0.93 2.03 0.44 112 HTML_MIME_NO_HTML_TAG 3082 2.08 2.02 2.11 113 T_REMOTE_IMAGE 3068 3.18 2.01 3.70 114 URI_HEX 3065 1.36 2.01 1.07 115 XMEmptyBody_01 2990 0.64 1.96 0.06 116 HK_RANDOM_REPLYTO 2969 0.65 1.95 0.08 117 XM_B_SpammyWords4 2930 0.98 1.92 0.56 118 BAYES_40 2897 3.89 1.90 4.77 119 USER_IN_DEF_DKIM_WL 2885 8.41 1.89 11.31 120 BAYES_20 2866 3.06 1.88 3.59 121 URI_TRY_3LD 2826 1.07 1.85 0.73 122 XM_H_Undi_Recip 2707 0.70 1.78 0.22 123 XM_DK_Undo_01 2672 1.83 1.75 1.86 124 XM_DIRTYINTL 2644 0.66 1.73 0.18 125 BOUNCE_MESSAGE 2620 3.64 1.72 4.50 126 ANY_BOUNCE_MESSAGE 2620 3.64 1.72 4.50 127 SpammyFromTLD_02 2570 0.68 1.69 0.24 128 MAILING_LIST_MULTI 2556 2.64 1.68 3.07 129 FROM_EXCESS_BASE64 2480 1.50 1.63 1.44 130 AC_BR_BONANZA 2475 0.59 1.62 0.13 131 XM_HighProb1 2462 0.50 1.61 0.01 132 T_XMDrugObfuBody_00 2419 0.83 1.59 0.49 133 XMReplyNow 2418 0.67 1.59 0.27 134 HTTPS_HTTP_MISMATCH 2416 1.06 1.58 0.83 135 XMStockSpam_06 2408 1.40 1.58 1.32 136 T_XMHurry_00 2357 0.96 1.55 0.71 137 HTML_TAG_BALANCE_BODY 2300 0.73 1.51 0.39 138 RCVD_IN_IADB_LISTED 2226 3.23 1.46 4.02 139 BOTNET_NORDNS 2219 0.46 1.46 0.02 140 TR_XM_INV_DKIM 2189 0.49 1.44 0.06 141 XM_B_Phish66 2173 0.73 1.43 0.42 142 XMGenDplmaNmb 2068 1.08 1.36 0.95 143 KHOP_HELO_FCRDNS 2057 1.21 1.35 1.15 144 XMBdyGiftCard01 2031 0.82 1.33 0.60 145 TR_XM_Undi_Recip5 2027 0.41 1.33 0.01 146 TR_XM_Undi_Recip11 2019 0.45 1.32 0.06 147 TR_XM_Undi_RecipCombo2 1937 0.39 1.27 0.01 148 ALL_TRUSTED 1936 13.32 1.27 18.67 149 XM_H_PHPMailer 1925 1.01 1.26 0.90 150 RDNS_DYNAMIC 1910 0.65 1.25 0.38 151 XMLngstWrd_00 1894 0.95 1.24 0.82 152 TM2_M_A_HREF_HREF 1885 0.62 1.24 0.34 153 RCVD_IN_IADB_SPF 1883 2.84 1.23 3.56 154 XM_S_SpammyWords 1867 0.49 1.22 0.16 155 TR_XM_Spammywords 1867 0.49 1.22 0.16 156 XMPhish30 1857 0.74 1.22 0.53 157 XM_SendGrid 1848 1.38 1.21 1.46 158 RCVD_IN_PSBL 1827 0.55 1.20 0.27 159 XMSexyCombo_01 1827 0.57 1.20 0.29 160 TR_XM_Undi_Recip2 1826 0.38 1.20 0.02 161 URI_NOVOWEL 1814 1.55 1.19 1.71 162 RCVD_IN_VALIDITY_RPBL 1796 0.40 1.18 0.06 163 XM_OfRef7 1796 0.51 1.18 0.22 164 RCVD_IN_IADB_DK 1795 2.52 1.18 3.12 165 RCVD_IN_IADB_SENDERID 1794 2.57 1.18 3.19 166 UNDISC_MONEY 1749 0.36 1.15 0.01 167 TR_MetaPhish_Combo_01 1724 0.82 1.13 0.68 168 XMSubMetaI_00 1693 0.89 1.11 0.79 169 TR_Caps_n_Bayes_99 1617 0.33 1.06 0.01 170 TR_XM_InvalidRelay 1602 0.34 1.05 0.03 171 XMHTML_After_End 1596 0.88 1.05 0.81 172 XMSubMetaSxObfu_03 1593 0.95 1.04 0.91 173 TR_XM_Undi_RecipCombo3 1581 0.32 1.04 0.00 174 TR_XM_Undi_Recip6 1558 0.32 1.02 0.00 175 T_MONEY_PERCENT 1479 0.47 0.97 0.25 176 TR_LOTS_OF_MONEY2 1479 0.47 0.97 0.25 177 TR_XM_Base64_M1 1478 0.63 0.97 0.48 178 DIET_1 1458 0.46 0.96 0.24 179 TVD_RCVD_IP 1448 1.20 0.95 1.31 180 XM_B_COPY_HTML 1414 0.65 0.93 0.53 181 DKIM_ADSP_CUSTOM_MED 1403 0.99 0.92 1.02 182 MPART_ALT_DIFF_COUNT 1402 0.64 0.92 0.52 183 XM_UB99 1389 0.28 0.91 0.00 184 RELAYCOUNTRY_RU 1350 0.30 0.89 0.05 185 XM_B_SEO 1349 0.36 0.88 0.13 186 BAYES_05 1302 2.24 0.85 2.85 187 HELO_DYNAMIC_SPLIT_IP 1295 0.27 0.85 0.01 188 TR_Symld_Words 1290 1.31 0.85 1.51 189 XMBody_78 1288 0.46 0.84 0.29 190 TM2_M_OBFU_COMMENT 1275 0.40 0.84 0.20 191 HTML_FONT_FACE_BAD 1267 0.55 0.83 0.42 192 MONEY_FRAUD_8 1267 0.26 0.83 0.00 193 DEAR_BENEFICIARY 1237 0.25 0.81 0.00 194 FROM_SUSPICIOUS_NTLD 1233 0.26 0.81 0.02 195 ADVANCE_FEE_5_NEW_MONEY 1232 0.25 0.81 0.00 196 XMGppyBdWords 1228 0.38 0.81 0.19 197 XM_ProductURIs 1216 0.99 0.80 1.08 198 RELAYCOUNTRY_FR 1190 0.37 0.78 0.18 199 XM_B_COVIDMETA 1188 0.39 0.78 0.22 200 XM_B_DNDMA 1174 0.65 0.77 0.59 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 288503 86.97 93.66 84.01 2 T_SCC_BODY_TEXT_LINE 285942 82.22 79.86 83.26 3 RELAYCOUNTRY_US 268607 78.45 78.99 78.21 4 DKIM_SIGNED 247058 77.98 91.58 71.94 5 XM_DK_Pass 241606 75.69 87.70 70.35 6 DKIM_VALID 238014 74.59 86.51 69.31 7 DCC_CHECK_NEGATIVE 237259 56.98 29.70 69.09 8 XM_B_Unicode 229942 71.97 83.25 66.95 9 BAYES_50 203407 52.92 38.70 59.23 10 DKIM_VALID_AU 191026 58.38 64.59 55.62 11 XMListUnsubscribeExists 158774 54.23 72.23 46.23 12 XM_B_SpammyWords 148482 52.51 73.39 43.24 13 XM_B_Unicode3 127095 39.06 43.68 37.01 14 DCC_CHECK 106030 42.99 70.28 30.87 15 T_TM2_M_HEADER_IN_MSG 105564 28.29 22.77 30.74 16 DKIM_VALID_EF 100282 30.55 33.59 29.20 17 HTML_FONT_LOW_CONTRAST 90488 29.02 35.04 26.35 18 FVGT_m_MULTI_ODD 86053 26.88 30.98 25.06 19 RCVD_IN_MSPIKE_H2 84044 24.81 25.57 24.47 20 XMSubLong 81143 23.33 22.64 23.63 21 LOC_TINY_FONT_1 79193 27.88 38.72 23.06 22 T_KAM_HTML_FONT_INVALID 65037 22.02 28.98 18.94 23 ALL_TRUSTED 64105 13.32 1.27 18.67 24 MIME_HTML_ONLY 62605 22.66 32.64 18.23 25 XM_B_SpammyWords2 59119 25.36 43.70 17.21 26 TR_XM_DK_Unsub 46217 16.77 24.23 13.46 27 XM_Multi_Part_URI 43798 14.32 17.83 12.75 28 USER_IN_DEF_DKIM_WL 38836 8.41 1.89 11.31 29 UNPARSEABLE_RELAY 35402 11.15 13.06 10.31 30 TooManyTo_001 34501 8.72 5.74 10.05 31 BAYES_00 32313 6.72 0.67 9.41 32 BAYES_60 30048 8.50 7.95 8.75 33 XM_DKIMWhitelistDomains 28569 5.79 0.08 8.32 34 XM_B_Unsub 26121 10.03 15.49 7.61 35 XM_Evil_Numbers_Gen 25461 7.95 9.15 7.41 36 LotsOfNums_01 25361 7.08 6.39 7.38 37 XM_H_GMP 22707 6.11 4.99 6.61 38 LOTS_OF_MONEY 22691 9.38 15.62 6.61 39 TR_XM_DK_Bayes 22268 4.64 0.49 6.48 40 IN_ZIMBRA_NJ_WHITELIST 22196 4.50 0.08 6.46 41 TR_XM_DK_Bayes1 21981 4.58 0.48 6.40 42 TR_MAX_INTL_RELAY 21695 8.75 14.23 6.32 43 TR_XM_BayesUnsub 20519 8.74 14.96 5.97 44 RCVD_IN_MSPIKE_WL 20406 7.36 10.56 5.94 45 RCVD_IN_MSPIKE_H3 20406 7.36 10.56 5.94 46 T_TooManySym_01 20261 4.86 2.52 5.90 47 XM_DK_Undo_02 20134 17.64 44.16 5.86 48 XMSubMetaSx_00 20060 5.94 6.15 5.84 49 TR_XM_DK_Bayes2 19084 3.97 0.40 5.56 50 HTML_IMAGE_RATIO_02 17856 5.62 6.58 5.20 51 BAYES_99 17462 14.02 34.16 5.08 52 XM_H_Long_From01 17081 5.18 5.66 4.97 53 XM_PDF 16670 3.53 0.56 4.85 54 BAYES_40 16398 3.89 1.90 4.77 55 TR_XM_SpammyWords4 15754 7.44 13.88 4.59 56 XMStrtUSub 15455 4.40 4.16 4.50 57 ANY_BOUNCE_MESSAGE 15452 3.64 1.72 4.50 58 BOUNCE_MESSAGE 15450 3.64 1.72 4.50 59 MIME_QP_LONG_LINE 15438 3.99 2.85 4.50 60 RELAYCOUNTRY_META 14271 9.33 20.97 4.16 61 FSL_BULK_SIG 14160 5.27 7.86 4.12 62 BOTNET_IPINHOSTNAME 14035 7.04 13.68 4.09 63 HTML_IMAGE_RATIO_04 13945 4.67 6.03 4.06 64 RCVD_IN_IADB_LISTED 13814 3.23 1.46 4.02 65 BAYES_999 13718 10.98 26.71 3.99 66 RCVD_IN_VALIDITY_SAFE 13628 3.56 2.64 3.97 67 XM_Body_Dirty_Words 13507 5.94 10.47 3.93 68 BAYES_80 13062 5.34 8.79 3.80 69 XM_B_SpammyWords3 12952 6.70 13.31 3.77 70 XM_UncommonTLD01 12840 5.11 8.20 3.74 71 T_REMOTE_IMAGE 12702 3.18 2.01 3.70 72 BAYES_20 12325 3.06 1.88 3.59 73 RCVD_IN_IADB_SPF 12216 2.84 1.23 3.56 74 RCVD_IN_VALIDITY_CERTIFIED 11874 3.03 2.07 3.46 75 MPART_ALT_DIFF 11222 4.03 5.74 3.27 76 RCVD_IN_IADB_SENDERID 10962 2.57 1.18 3.19 77 RCVD_IN_IADB_DK 10705 2.52 1.18 3.12 78 XM_B_Phish_Phrases 10575 3.72 5.17 3.08 79 MAILING_LIST_MULTI 10537 2.64 1.68 3.07 80 TooManyTo_002 10396 2.28 0.58 3.03 81 XM_SPF_SoftFail 10334 3.70 5.26 3.01 82 T_TooManySym_02 9901 2.19 0.64 2.88 83 BAYES_05 9788 2.24 0.85 2.85 84 SCC_BODY_URI_ONLY 9281 2.65 2.52 2.70 85 DKIM_INVALID 9044 3.38 5.07 2.63 86 XMNumbers 8798 3.46 5.47 2.56 87 RCVD_IN_IADB_VOUCHED 8624 1.95 0.67 2.51 88 BAYES_95 8624 3.31 5.10 2.51 89 HTML_IMAGE_RATIO_06 8515 2.73 3.29 2.48 90 XM_B_SpammyTLD 8017 2.63 3.29 2.33 91 XM_CamelCaseFrm001 7551 2.35 2.70 2.20 92 TR_XM_SpammyRelay 7331 6.78 17.24 2.13 93 TR_XM_DKIM_Undo 7328 12.18 34.82 2.13 94 HTML_MIME_NO_HTML_TAG 7249 2.08 2.02 2.11 95 XMSexyCombo_05 7137 3.14 5.52 2.08 96 INVALID_MSGID 7015 1.51 0.32 2.04 97 HELO_NODOT 6928 1.61 0.69 2.02 98 HELO_NO_DOMAIN 6921 1.61 0.69 2.02 99 MIME_HTML_ONLY_MULTI 6806 2.44 3.47 1.98 100 MIME_HTML_MOSTLY 6584 2.45 3.63 1.92 101 XM_DK_Undo_01 6399 1.83 1.75 1.86 102 TO_MALFORMED 6326 1.28 0.01 1.84 103 RCVD_IN_IADB_OPTIN 5993 1.33 0.39 1.75 104 HTML_IMAGE_RATIO_08 5970 2.02 2.66 1.74 105 TM2_M_URI_OPT_OUT 5963 2.17 3.14 1.74 106 TR_XM_PhishingBody 5913 2.44 4.06 1.72 107 TR_XM_UnparsRelay 5891 3.27 6.76 1.72 108 XMDiploma_00 5875 2.06 2.86 1.71 109 URI_NOVOWEL 5858 1.55 1.19 1.71 110 T_XMDrugObfuBody_08 5696 2.42 4.14 1.66 111 TooManyTo_003 5509 1.26 0.48 1.60 112 T_XMDrugObfuBody_14 5404 2.17 3.50 1.57 113 SUBJ_ALL_CAPS 5394 1.90 2.63 1.57 114 XM_B_Investor 5377 2.43 4.37 1.57 115 TR_DCC_Bayes_99 5365 8.36 23.66 1.56 116 XM_OfRef6 5254 2.42 4.42 1.53 117 TR_Symld_Words 5183 1.31 0.85 1.51 118 UNTRUSTED_Relay 5143 2.83 5.82 1.50 119 XM_SendGrid 5004 1.38 1.21 1.46 120 FROM_EXCESS_BASE64 4950 1.50 1.63 1.44 121 IN_HORDE_ADDRESS_BOOK 4875 1.01 0.09 1.42 122 XMGappySubj_01 4812 1.01 0.13 1.40 123 TR_XM_SpammyWords5 4738 2.25 4.20 1.38 124 XM_B_Unsub2 4638 1.71 2.52 1.35 125 XMStockSpam_06 4530 1.40 1.58 1.32 126 TVD_RCVD_IP 4507 1.20 0.95 1.31 127 XM_GoogleGroups 4488 1.06 0.51 1.31 128 XMCapTrack 4262 0.99 0.41 1.24 129 RELAYCOUNTRY_CA 4221 4.52 11.94 1.23 130 TM2_M_VERY_LONG_WORD 4219 1.76 2.97 1.23 131 BOTNET 4213 3.88 9.87 1.23 132 TooManyTo_004 4004 0.94 0.43 1.17 133 KHOP_HELO_FCRDNS 3945 1.21 1.35 1.15 134 TVD_SPACE_RATIO 3884 0.82 0.11 1.13 135 XMBSHREFv2 3871 0.87 0.29 1.13 136 XM_ProductURIs 3712 0.99 0.80 1.08 137 URI_HEX 3662 1.36 2.01 1.07 138 XM_H_Long_From02 3656 0.97 0.75 1.06 139 XMNoVowels 3654 0.93 0.61 1.06 140 XMBody_95 3599 0.77 0.15 1.05 141 T_TooManySym_03 3596 0.81 0.27 1.05 142 T_FILL_THIS_FORM_SHORT 3592 2.18 4.73 1.05 143 DKIM_ADSP_CUSTOM_MED 3496 0.99 0.92 1.02 144 XMGappySubj_02 3450 0.71 0.06 1.00 145 TR_XM_DK_SendGrid 3329 0.91 0.76 0.97 146 TooManyTo_005 3320 0.78 0.37 0.97 147 XMGenDplmaNmb 3272 1.08 1.36 0.95 148 XMSubMetaSxObfu_03 3142 0.95 1.04 0.91 149 XM_H_PHPMailer 3080 1.01 1.26 0.90 150 XM_UB50 3025 1.54 3.04 0.88 151 HTTPS_HTTP_MISMATCH 2861 1.06 1.58 0.83 152 XMLngstWrd_00 2824 0.95 1.24 0.82 153 XMHTML_After_End 2786 0.88 1.05 0.81 154 XMSubMetaI_00 2721 0.89 1.11 0.79 155 RCVD_IN_RP_SAFE 2652 0.71 0.56 0.77 156 XM_B_FormFill 2645 0.57 0.12 0.77 157 SpammyFromTLD_01 2626 2.03 4.89 0.76 158 XMBody_17 2595 2.65 6.91 0.76 159 XM_ShortIntro_01 2558 0.65 0.44 0.74 160 XM_RXBody 2511 0.70 0.63 0.73 161 URI_TRY_3LD 2494 1.07 1.85 0.73 162 T_XMHurry_00 2425 0.96 1.55 0.71 163 FILL_THIS_FORM 2418 0.71 0.71 0.70 164 MSGID_NOFQDN1 2353 0.48 0.03 0.69 165 TR_MetaPhish_Combo_01 2338 0.82 1.13 0.68 166 RCVD_IN_RP_CERTIFIED 2330 0.60 0.43 0.68 167 T_OBFU_PDF_ATTACH 2252 0.48 0.08 0.66 168 NML_ADSP_CUSTOM_MED 2181 0.64 0.66 0.64 169 RELAYCOUNTRY_AU 2180 1.17 2.37 0.63 170 SHORT_HELO_AND_INLINE_IMAGE 2150 0.45 0.05 0.63 171 TR_XM_PHPForged 2104 1.57 3.72 0.61 172 TR_XM_FormFill2 2082 1.54 3.64 0.61 173 TR_XM_PHPDW 2058 1.55 3.69 0.60 174 XMBdyGiftCard01 2057 0.82 1.33 0.60 175 FORGED_GMAIL_RCVD 2049 0.64 0.75 0.60 176 XM_B_DNDMA 2039 0.65 0.77 0.59 177 USER_IN_WHITELIST 2026 0.41 0.00 0.59 178 USER_IN_WELCOMELIST 2026 0.41 0.00 0.59 179 XM_H_PHPOS 2008 1.52 3.61 0.58 180 RCVD_IN_BL_SPAMCOP_NET 1961 4.40 13.02 0.57 181 PLING_QUERY 1950 0.61 0.71 0.57 182 XM_B_SpammyWords4 1935 0.98 1.92 0.56 183 TR_LOTS_OF_MONEY3 1900 1.67 4.19 0.55 184 XMSubNoVowel 1881 0.53 0.50 0.55 185 XMBrknScrpt_02 1876 1.11 2.39 0.55 186 XMPhish30 1830 0.74 1.22 0.53 187 TR_XM_SpammyWords2 1827 4.90 14.74 0.53 188 XM_H_Trusted_IP 1825 0.37 0.00 0.53 189 XM_B_COPY_HTML 1812 0.65 0.93 0.53 190 T_Symld_Words_02 1799 0.56 0.63 0.52 191 FROM_GOV_DKIM_AU 1793 0.40 0.14 0.52 192 MPART_ALT_DIFF_COUNT 1777 0.64 0.92 0.52 193 RCVD_IN_SORBS_DUL 1773 0.37 0.05 0.52 194 HTML_IMAGE_ONLY_32 1744 0.41 0.19 0.51 195 T_XMDrugObfuBody_00 1694 0.83 1.59 0.49 196 XMPhish14 1691 0.57 0.74 0.49 197 HTML_IMAGE_ONLY_28 1678 0.44 0.34 0.49 198 TR_XM_Base64_M1 1653 0.63 0.97 0.48 199 RELAYCOUNTRY_GB 1613 0.50 0.56 0.47 200 TM2_M_BODY_EMPTY 1524 0.93 2.03 0.44 ----------------------------------------------------------------------