Email: 529585 Autolearn: 0 AvgScore: 4.05 AvgScanTime: 1.27 sec Spam: 165889 Autolearn: 0 AvgScore: 13.45 AvgScanTime: 1.39 sec Ham: 363696 Autolearn: 0 AvgScore: -0.23 AvgScanTime: 1.22 sec Time Spent Running SA: 186.95 hours Time Spent Processing Spam: 64.07 hours Time Spent Processing Ham: 122.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158268 87.97 95.41 84.57 2 DKIM_SIGNED 152149 78.11 91.72 71.91 3 XM_DK_Pass 145923 75.92 87.96 70.43 4 DKIM_VALID 144097 74.91 86.86 69.45 5 XM_B_Unicode 141560 72.84 85.33 67.13 6 T_SCC_BODY_TEXT_LINE 133591 82.45 80.53 83.33 7 RELAYCOUNTRY_US 132789 79.28 80.05 78.92 8 XMListUnsubscribeExists 119858 55.05 72.25 47.21 9 DCC_CHECK 119626 45.25 72.11 32.99 10 XM_B_SpammyWords 119320 51.67 71.93 42.44 11 DKIM_VALID_AU 107269 58.24 64.66 55.30 12 XM_DK_Undo_02 75133 18.08 45.29 5.67 13 XM_B_Unicode3 73515 40.08 44.32 38.15 14 XM_B_SpammyWords2 71926 25.74 43.36 17.70 15 LOC_TINY_FONT_1 67782 28.75 40.86 23.22 16 BAYES_50 65096 52.61 39.24 58.71 17 HTML_FONT_LOW_CONTRAST 60209 30.44 36.29 27.77 18 BAYES_99 57374 14.06 34.59 4.70 19 TR_XM_DKIM_Undo 57073 12.39 34.40 2.35 20 FVGT_m_MULTI_ODD 53621 27.12 32.32 24.75 21 DKIM_VALID_EF 52369 28.93 31.57 27.73 22 MIME_HTML_ONLY 52197 22.53 31.47 18.45 23 T_KAM_HTML_FONT_INVALID 47350 22.33 28.54 19.50 24 DCC_CHECK_NEGATIVE 46243 54.72 27.88 66.96 25 BAYES_999 45166 10.96 27.23 3.55 26 RCVD_IN_MSPIKE_H2 42254 24.49 25.47 24.04 27 TR_DCC_Bayes_99 40691 8.78 24.53 1.60 28 T_TM2_M_HEADER_IN_MSG 38918 27.64 23.46 29.55 29 XMSubLong 38885 22.38 23.44 21.89 30 TR_XM_DK_Unsub 38563 16.11 23.25 12.86 31 RELAYCOUNTRY_META 32158 8.79 19.39 3.96 32 XM_Multi_Part_URI 30806 14.95 18.57 13.30 33 XM_B_Unsub 27316 10.63 16.47 7.96 34 TR_XM_BayesUnsub 26523 9.31 15.99 6.27 35 TR_XM_SpammyRelay 25856 6.39 15.59 2.20 36 LOTS_OF_MONEY 25837 9.65 15.57 6.95 37 UNPARSEABLE_RELAY 24220 11.46 14.60 10.03 38 TR_MAX_INTL_RELAY 23535 9.04 14.19 6.70 39 TR_XM_SpammyWords2 23485 4.95 14.16 0.74 40 XM_B_SpammyWords3 23346 7.29 14.07 4.20 41 BOTNET_IPINHOSTNAME 23141 7.28 13.95 4.24 42 TR_XM_SpammyWords4 22954 7.59 13.84 4.74 43 RCVD_IN_BL_SPAMCOP_NET 21482 4.52 12.95 0.68 44 RELAYCOUNTRY_CA 17414 4.01 10.50 1.04 45 TR_XM_SPAMCOP 16815 3.38 10.14 0.29 46 XM_Body_Dirty_Words 16046 5.46 9.67 3.53 47 XM_Evil_Numbers_Gen 15692 7.91 9.46 7.20 48 BOTNET 14750 3.60 8.89 1.19 49 BAYES_80 14506 5.54 8.74 4.08 50 RCVD_IN_MSPIKE_WL 14492 6.74 8.74 5.83 51 RCVD_IN_MSPIKE_H3 14492 6.74 8.74 5.83 52 FSL_BULK_SIG 14357 5.93 8.65 4.68 53 BAYES_60 13035 8.96 7.86 9.46 54 TR_XM_UnparsRelay 12467 3.32 7.52 1.41 55 LotsOfNums_01 12303 7.92 7.42 8.15 56 XM_UncommonTLD01 11832 4.70 7.13 3.59 57 HTML_IMAGE_RATIO_02 11539 5.75 6.96 5.19 58 UNTRUSTED_Relay 10288 2.95 6.20 1.47 59 XMBody_17 9784 2.28 5.90 0.63 60 XMSubMetaSx_00 9658 4.80 5.82 4.33 61 MPART_ALT_DIFF 9562 5.20 5.76 4.95 62 TooManyTo_001 8742 8.18 5.27 9.50 63 HTML_IMAGE_RATIO_04 8673 4.48 5.23 4.14 64 XM_B_Phish_Phrases 8551 3.92 5.15 3.35 65 XM_B_Investor 8457 2.85 5.10 1.82 66 BAYES_95 8371 3.38 5.05 2.62 67 XM_H_Long_From01 8226 5.19 4.96 5.29 68 XMSexyCombo_05 8122 2.68 4.90 1.67 69 DKIM_INVALID 8052 3.21 4.85 2.46 70 XMNumbers 7742 3.19 4.67 2.52 71 XM_SPF_SoftFail 7663 3.55 4.62 3.06 72 HTML_IMAGE_RATIO_06 7621 3.48 4.59 2.97 73 TR_XM_SpammyWords5 7354 2.34 4.43 1.38 74 SpammyFromTLD_01 7314 1.85 4.41 0.69 75 T_XMDrugObfuBody_08 7194 2.84 4.34 2.15 76 XM_OfRef6 7087 2.28 4.27 1.37 77 TR_XM_PhishingBody 7040 2.62 4.24 1.87 78 TM2_M_URI_OPT_OUT 6824 2.48 4.11 1.73 79 XM_H_GMP 6509 5.53 3.92 6.26 80 MIME_HTML_MOSTLY 6500 3.32 3.92 3.05 81 T_FILL_THIS_FORM_SHORT 6474 1.90 3.90 0.99 82 MIME_QP_LONG_LINE 5986 4.67 3.61 5.15 83 TR_LOTS_OF_MONEY3 5968 1.63 3.60 0.73 84 XM_B_SpammyTLD 5857 3.08 3.53 2.88 85 XM_UB50 5546 1.68 3.34 0.92 86 MIME_HTML_ONLY_MULTI 5482 2.72 3.30 2.45 87 TR_XM_BayesRelay 5375 1.02 3.24 0.00 88 XMStrtUSub 5323 3.91 3.21 4.23 89 T_XMDrugObfuBody_14 5161 2.06 3.11 1.58 90 TR_XM_PHPForged 4976 1.22 3.00 0.41 91 TR_XM_PHPDW 4927 1.21 2.97 0.41 92 TR_XM_FormFill2 4864 1.20 2.93 0.41 93 RCVD_IN_VALIDITY_SAFE 4847 3.48 2.92 3.74 94 XM_H_PHPOS 4839 1.18 2.92 0.39 95 XM_B_Unsub2 4740 1.89 2.86 1.45 96 HTML_IMAGE_RATIO_08 4671 2.31 2.82 2.08 97 XM_URI_RBL 4579 0.99 2.76 0.18 98 TM2_M_VERY_LONG_WORD 4319 1.55 2.60 1.07 99 SUBJ_ALL_CAPS 4286 1.80 2.58 1.44 100 XM_CamelCaseFrm001 4240 2.30 2.56 2.18 101 USER_IN_DEF_DKIM_WL 4141 8.01 2.50 10.53 102 TR_XM_FormFill 4105 0.80 2.47 0.03 103 RELAYCOUNTRY_AU 4017 1.25 2.42 0.71 104 T_XMDrugObfuBody_00 4008 1.25 2.42 0.72 105 XMDiploma_00 3973 1.62 2.39 1.26 106 FONT_INVIS_LONG_LINE 3969 0.77 2.39 0.04 107 RCVD_IN_VALIDITY_CERTIFIED 3942 3.00 2.38 3.28 108 XM_B_SpammyWords4 3779 1.27 2.28 0.81 109 XMBrknScrpt_02 3710 1.10 2.24 0.58 110 T_TooManySym_01 3628 4.24 2.19 5.18 111 TR_XM_NoHeaderRelay 3417 0.72 2.06 0.11 112 URI_HEX 3363 1.27 2.03 0.93 113 FROM_EXCESS_BASE64 3331 1.96 2.01 1.94 114 TR_Mismatch_TLD_02 3305 0.68 1.99 0.08 115 BAYES_40 3240 3.77 1.95 4.59 116 ANY_BOUNCE_MESSAGE 3221 3.72 1.94 4.53 117 XM_DK_Undo_01 3221 1.92 1.94 1.92 118 BOUNCE_MESSAGE 3218 3.72 1.94 4.53 119 SCC_BODY_URI_ONLY 2951 2.41 1.78 2.69 120 T_REMOTE_IMAGE 2920 3.09 1.76 3.69 121 RCVD_IN_IADB_LISTED 2919 3.71 1.76 4.60 122 XMStockSpam_06 2904 1.11 1.75 0.81 123 HK_RANDOM_REPLYTO 2842 0.59 1.71 0.08 124 HTML_MIME_NO_HTML_TAG 2773 1.85 1.67 1.93 125 MAILING_LIST_MULTI 2726 2.46 1.64 2.84 126 SpammyFromTLD_02 2600 0.81 1.57 0.46 127 AC_BR_BONANZA 2580 0.57 1.56 0.12 128 URI_TRY_3LD 2579 1.08 1.55 0.87 129 XM_H_Long_From02 2548 1.16 1.54 1.00 130 RCVD_IN_IADB_SPF 2483 3.28 1.50 4.09 131 XM_HighProb1 2483 0.47 1.50 0.00 132 TR_XM_INV_DKIM 2475 0.50 1.49 0.05 133 RCVD_IN_IADB_DK 2374 2.92 1.43 3.60 134 HTML_TAG_BALANCE_BODY 2369 0.79 1.43 0.49 135 XM_SendGrid 2367 1.37 1.43 1.34 136 RCVD_IN_IADB_SENDERID 2362 2.98 1.42 3.70 137 XMBdyGiftCard01 2348 0.85 1.42 0.60 138 T_XMHurry_00 2340 0.76 1.41 0.46 139 BAYES_20 2305 2.77 1.39 3.39 140 URI_NOVOWEL 2303 1.67 1.39 1.80 141 HTTPS_HTTP_MISMATCH 2299 1.01 1.39 0.84 142 KHOP_HELO_FCRDNS 2291 1.21 1.38 1.13 143 XM_DIRTYINTL 2272 0.58 1.37 0.22 144 TR_MetaPhish_Combo_01 2177 0.89 1.31 0.70 145 XMSexyCombo_01 2117 0.52 1.28 0.18 146 TM2_M_BODY_EMPTY 2115 0.71 1.27 0.45 147 XMGenDplmaNmb 2107 0.86 1.27 0.68 148 XMBody_78 2101 0.68 1.27 0.41 149 XMReplyNow 2099 0.58 1.27 0.27 150 ALL_TRUSTED 2081 12.79 1.25 18.04 151 BOTNET_NORDNS 2026 0.39 1.22 0.01 152 XMPhish14 2019 0.91 1.22 0.76 153 XMEmptyBody_01 2014 0.43 1.21 0.07 154 RDNS_DYNAMIC 1999 0.65 1.21 0.39 155 TR_XM_Base64_M1 1989 0.82 1.20 0.65 156 XM_S_SpammyWords 1963 0.57 1.18 0.29 157 TR_XM_Spammywords 1963 0.57 1.18 0.28 158 MPART_ALT_DIFF_COUNT 1943 0.72 1.17 0.51 159 RCVD_IN_PSBL 1935 0.53 1.17 0.24 160 XMHTML_After_End 1882 0.81 1.13 0.66 161 TR_Caps_n_Bayes_99 1847 0.36 1.11 0.02 162 XM_B_Phish66 1840 0.53 1.11 0.27 163 XMPhish30 1835 0.71 1.11 0.52 164 XMLngstWrd_00 1763 0.82 1.06 0.71 165 XM_H_PHPMailer 1754 1.00 1.06 0.97 166 XMSubMetaI_00 1726 0.73 1.04 0.59 167 TVD_RCVD_IP 1711 1.26 1.03 1.36 168 TR_Symld_Words 1677 1.32 1.01 1.46 169 TR_XM_InvalidRelay 1650 0.33 0.99 0.03 170 LOW_PRICE 1554 0.40 0.94 0.15 171 DKIM_ADSP_CUSTOM_MED 1547 0.90 0.93 0.88 172 TR_LOTS_OF_MONEY2 1527 0.50 0.92 0.31 173 T_MONEY_PERCENT 1527 0.50 0.92 0.31 174 XM_H_Undi_Recip 1525 0.43 0.92 0.21 175 XM_UB99 1500 0.29 0.90 0.00 176 TR_XM_DK_SendGrid 1497 0.88 0.90 0.87 177 HELO_DYNAMIC_SPLIT_IP 1463 0.28 0.88 0.01 178 XM_B_DNDMA 1440 0.52 0.87 0.36 179 SHOPIFY_IMG_NOT_RCVD_SFY 1403 0.47 0.85 0.30 180 RCVD_IN_VALIDITY_RPBL 1389 0.32 0.84 0.08 181 RCVD_IN_IADB_VOUCHED 1322 2.18 0.80 2.81 182 PLING_QUERY 1319 0.61 0.80 0.53 183 XMClaimOffer 1290 0.34 0.78 0.14 184 XM_ProductURIs 1271 0.68 0.77 0.63 185 XM_B_SEO 1261 0.35 0.76 0.16 186 FORGED_GMAIL_RCVD 1255 0.57 0.76 0.49 187 T_TooManySym_02 1250 2.01 0.75 2.59 188 XMMoneyMeta_00 1214 0.55 0.73 0.46 189 THIS_AD 1211 0.40 0.73 0.24 190 XM_B_COPY_HTML 1210 0.57 0.73 0.49 191 DIET_1 1201 0.38 0.72 0.22 192 RELAYCOUNTRY_FR 1173 0.38 0.71 0.22 193 URIBL_BLACK 1172 0.25 0.71 0.04 194 XM_UB999 1167 0.22 0.70 0.00 195 T_Symld_Words_02 1167 0.59 0.70 0.54 196 XM_UB60 1160 0.26 0.70 0.06 197 AC_HTML_NONSENSE_TAGS 1159 0.23 0.70 0.02 198 TooManyTo_002 1154 2.07 0.70 2.70 199 HTML_FONT_FACE_BAD 1152 0.48 0.69 0.38 200 TR_XM_Base64_L1 1146 0.31 0.69 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 307594 87.97 95.41 84.57 2 T_SCC_BODY_TEXT_LINE 303051 82.45 80.53 83.33 3 RELAYCOUNTRY_US 287040 79.28 80.05 78.92 4 DKIM_SIGNED 261528 78.11 91.72 71.91 5 XM_DK_Pass 256153 75.92 87.96 70.43 6 DKIM_VALID 252595 74.91 86.86 69.45 7 XM_B_Unicode 244167 72.84 85.33 67.13 8 DCC_CHECK_NEGATIVE 243522 54.72 27.88 66.96 9 BAYES_50 213511 52.61 39.24 58.71 10 DKIM_VALID_AU 201138 58.24 64.66 55.30 11 XMListUnsubscribeExists 171690 55.05 72.25 47.21 12 XM_B_SpammyWords 154337 51.67 71.93 42.44 13 XM_B_Unicode3 138741 40.08 44.32 38.15 14 DCC_CHECK 119985 45.25 72.11 32.99 15 T_TM2_M_HEADER_IN_MSG 107467 27.64 23.46 29.55 16 HTML_FONT_LOW_CONTRAST 101008 30.44 36.29 27.77 17 DKIM_VALID_EF 100839 28.93 31.57 27.73 18 FVGT_m_MULTI_ODD 90011 27.12 32.32 24.75 19 RCVD_IN_MSPIKE_H2 87428 24.49 25.47 24.04 20 LOC_TINY_FONT_1 84457 28.75 40.86 23.22 21 XMSubLong 79616 22.38 23.44 21.89 22 T_KAM_HTML_FONT_INVALID 70924 22.33 28.54 19.50 23 MIME_HTML_ONLY 67116 22.53 31.47 18.45 24 ALL_TRUSTED 65628 12.79 1.25 18.04 25 XM_B_SpammyWords2 64387 25.74 43.36 17.70 26 XM_Multi_Part_URI 48379 14.95 18.57 13.30 27 TR_XM_DK_Unsub 46770 16.11 23.25 12.86 28 USER_IN_DEF_DKIM_WL 38292 8.01 2.50 10.53 29 UNPARSEABLE_RELAY 36462 11.46 14.60 10.03 30 BAYES_00 35363 6.87 0.62 9.72 31 TooManyTo_001 34566 8.18 5.27 9.50 32 BAYES_60 34396 8.96 7.86 9.46 33 LotsOfNums_01 29642 7.92 7.42 8.15 34 XM_B_Unsub 28968 10.63 16.47 7.96 35 XM_DKIMWhitelistDomains 28564 5.40 0.02 7.85 36 XM_Evil_Numbers_Gen 26187 7.91 9.46 7.20 37 LOTS_OF_MONEY 25265 9.65 15.57 6.95 38 TR_MAX_INTL_RELAY 24354 9.04 14.19 6.70 39 IN_ZIMBRA_NJ_WHITELIST 24228 4.60 0.07 6.66 40 TR_XM_DK_Bayes 23054 4.49 0.45 6.34 41 TR_XM_BayesUnsub 22805 9.31 15.99 6.27 42 XM_H_GMP 22752 5.53 3.92 6.26 43 TR_XM_DK_Bayes1 22736 4.43 0.44 6.25 44 RCVD_IN_MSPIKE_WL 21203 6.74 8.74 5.83 45 RCVD_IN_MSPIKE_H3 21202 6.74 8.74 5.83 46 XM_DK_Undo_02 20606 18.08 45.29 5.67 47 TR_XM_DK_Bayes2 19741 3.83 0.34 5.43 48 XM_H_Long_From01 19241 5.19 4.96 5.29 49 HTML_IMAGE_RATIO_02 18888 5.75 6.96 5.19 50 T_TooManySym_01 18836 4.24 2.19 5.18 51 MIME_QP_LONG_LINE 18736 4.67 3.61 5.15 52 MPART_ALT_DIFF 17986 5.20 5.76 4.95 53 TR_XM_SpammyWords4 17235 7.59 13.84 4.74 54 BAYES_99 17079 14.06 34.59 4.70 55 FSL_BULK_SIG 17032 5.93 8.65 4.68 56 RCVD_IN_IADB_LISTED 16741 3.71 1.76 4.60 57 BAYES_40 16700 3.77 1.95 4.59 58 XM_PDF 16512 3.29 0.55 4.54 59 ANY_BOUNCE_MESSAGE 16484 3.72 1.94 4.53 60 BOUNCE_MESSAGE 16477 3.72 1.94 4.53 61 XMSubMetaSx_00 15736 4.80 5.82 4.33 62 BOTNET_IPINHOSTNAME 15409 7.28 13.95 4.24 63 XMStrtUSub 15375 3.91 3.21 4.23 64 XM_B_SpammyWords3 15264 7.29 14.07 4.20 65 HTML_IMAGE_RATIO_04 15059 4.48 5.23 4.14 66 RCVD_IN_IADB_SPF 14862 3.28 1.50 4.09 67 BAYES_80 14822 5.54 8.74 4.08 68 RELAYCOUNTRY_META 14386 8.79 19.39 3.96 69 RCVD_IN_VALIDITY_SAFE 13603 3.48 2.92 3.74 70 RCVD_IN_IADB_SENDERID 13442 2.98 1.42 3.70 71 T_REMOTE_IMAGE 13435 3.09 1.76 3.69 72 RCVD_IN_IADB_DK 13110 2.92 1.43 3.60 73 XM_UncommonTLD01 13057 4.70 7.13 3.59 74 BAYES_999 12901 10.96 27.23 3.55 75 XM_Body_Dirty_Words 12849 5.46 9.67 3.53 76 BAYES_20 12342 2.77 1.39 3.39 77 XM_B_Phish_Phrases 12184 3.92 5.15 3.35 78 RCVD_IN_VALIDITY_CERTIFIED 11932 3.00 2.38 3.28 79 XM_SPF_SoftFail 11126 3.55 4.62 3.06 80 MIME_HTML_MOSTLY 11079 3.32 3.92 3.05 81 HTML_IMAGE_RATIO_06 10791 3.48 4.59 2.97 82 XM_B_SpammyTLD 10474 3.08 3.53 2.88 83 MAILING_LIST_MULTI 10319 2.46 1.64 2.84 84 RCVD_IN_IADB_VOUCHED 10238 2.18 0.80 2.81 85 BAYES_05 9967 2.06 0.56 2.74 86 TooManyTo_002 9818 2.07 0.70 2.70 87 SCC_BODY_URI_ONLY 9799 2.41 1.78 2.69 88 BAYES_95 9516 3.38 5.05 2.62 89 T_TooManySym_02 9409 2.01 0.75 2.59 90 XMNumbers 9171 3.19 4.67 2.52 91 DKIM_INVALID 8933 3.21 4.85 2.46 92 MIME_HTML_ONLY_MULTI 8898 2.72 3.30 2.45 93 TR_XM_DKIM_Undo 8565 12.39 34.40 2.35 94 TR_XM_SpammyRelay 7986 6.39 15.59 2.20 95 XM_CamelCaseFrm001 7940 2.30 2.56 2.18 96 T_XMDrugObfuBody_08 7832 2.84 4.34 2.15 97 HTML_IMAGE_RATIO_08 7550 2.31 2.82 2.08 98 FROM_EXCESS_BASE64 7065 1.96 2.01 1.94 99 INVALID_MSGID 7046 1.41 0.26 1.94 100 HTML_MIME_NO_HTML_TAG 7008 1.85 1.67 1.93 101 HELO_NODOT 7007 1.52 0.63 1.93 102 HELO_NO_DOMAIN 6999 1.52 0.62 1.92 103 XM_DK_Undo_01 6966 1.92 1.94 1.92 104 TR_XM_PhishingBody 6816 2.62 4.24 1.87 105 RCVD_IN_IADB_OPTIN 6770 1.41 0.42 1.86 106 XM_B_Investor 6618 2.85 5.10 1.82 107 URI_NOVOWEL 6555 1.67 1.39 1.80 108 TM2_M_URI_OPT_OUT 6284 2.48 4.11 1.73 109 TO_MALFORMED 6279 1.19 0.02 1.73 110 XMSexyCombo_05 6081 2.68 4.90 1.67 111 TR_DCC_Bayes_99 5805 8.78 24.53 1.60 112 T_XMDrugObfuBody_14 5758 2.06 3.11 1.58 113 UNTRUSTED_Relay 5353 2.95 6.20 1.47 114 TR_Symld_Words 5314 1.32 1.01 1.46 115 XM_B_Unsub2 5280 1.89 2.86 1.45 116 SUBJ_ALL_CAPS 5223 1.80 2.58 1.44 117 TooManyTo_003 5203 1.17 0.60 1.43 118 TR_XM_UnparsRelay 5131 3.32 7.52 1.41 119 IN_HORDE_ADDRESS_BOOK 5070 0.98 0.07 1.39 120 TR_XM_SpammyWords5 5032 2.34 4.43 1.38 121 XMBody_95 5027 0.99 0.14 1.38 122 XM_OfRef6 4983 2.28 4.27 1.37 123 XM_H_Trusted_IP 4972 0.94 0.00 1.37 124 TVD_RCVD_IP 4946 1.26 1.03 1.36 125 XMGappySubj_01 4915 1.00 0.24 1.35 126 XM_SendGrid 4890 1.37 1.43 1.34 127 XM_GoogleGroups 4700 1.04 0.48 1.29 128 XMDiploma_00 4594 1.62 2.39 1.26 129 BOTNET 4341 3.60 8.89 1.19 130 XMBSHREFv2 4124 0.86 0.25 1.13 131 KHOP_HELO_FCRDNS 4110 1.21 1.38 1.13 132 XMCapTrack 4104 0.89 0.37 1.13 133 TVD_SPACE_RATIO 4008 0.79 0.09 1.10 134 TM2_M_VERY_LONG_WORD 3881 1.55 2.60 1.07 135 RELAYCOUNTRY_CA 3800 4.01 10.50 1.04 136 TooManyTo_004 3766 0.87 0.52 1.04 137 XM_H_Long_From02 3619 1.16 1.54 1.00 138 T_FILL_THIS_FORM_SHORT 3593 1.90 3.90 0.99 139 XM_H_PHPMailer 3543 1.00 1.06 0.97 140 HTML_OBFUSCATE_20_30 3529 0.69 0.06 0.97 141 T_PDS_OTHER_BAD_TLD 3455 0.86 0.65 0.95 142 T_TooManySym_03 3381 0.72 0.25 0.93 143 URI_HEX 3366 1.27 2.03 0.93 144 XM_UB50 3335 1.68 3.34 0.92 145 XMSubNoVowel 3303 0.75 0.41 0.91 146 DKIM_ADSP_CUSTOM_MED 3200 0.90 0.93 0.88 147 TR_XM_DK_SendGrid 3166 0.88 0.90 0.87 148 URI_TRY_3LD 3149 1.08 1.55 0.87 149 HTTPS_HTTP_MISMATCH 3052 1.01 1.39 0.84 150 FROM_GOV_DKIM_AU 3030 0.60 0.09 0.83 151 TooManyTo_005 3017 0.72 0.49 0.83 152 XMStockSpam_06 2953 1.11 1.75 0.81 153 XM_B_SpammyWords4 2952 1.27 2.28 0.81 154 XMPhish14 2779 0.91 1.22 0.76 155 TR_XM_SpammyWords2 2708 4.95 14.16 0.74 156 TR_LOTS_OF_MONEY3 2650 1.63 3.60 0.73 157 RCVD_IN_RP_SAFE 2647 0.70 0.64 0.73 158 T_XMDrugObfuBody_00 2607 1.25 2.42 0.72 159 XM_ShortIntro_01 2600 0.64 0.49 0.71 160 XMLngstWrd_00 2583 0.82 1.06 0.71 161 RELAYCOUNTRY_AU 2577 1.25 2.42 0.71 162 XMNoVowels 2558 0.66 0.56 0.70 163 TR_MetaPhish_Combo_01 2540 0.89 1.31 0.70 164 SpammyFromTLD_01 2499 1.85 4.41 0.69 165 XMGenDplmaNmb 2459 0.86 1.27 0.68 166 RCVD_IN_BL_SPAMCOP_NET 2459 4.52 12.95 0.68 167 XMHTML_After_End 2405 0.81 1.13 0.66 168 XMGappySubj_02 2395 0.48 0.09 0.66 169 T_OBFU_PDF_ATTACH 2353 0.47 0.08 0.65 170 TR_XM_Base64_M1 2349 0.82 1.20 0.65 171 MSGID_NOFQDN1 2343 0.45 0.02 0.64 172 XM_B_FormFill 2336 0.46 0.08 0.64 173 RCVD_IN_RP_CERTIFIED 2332 0.60 0.52 0.64 174 XM_ProductURIs 2307 0.68 0.77 0.63 175 XMBody_17 2302 2.28 5.90 0.63 176 SHORT_HELO_AND_INLINE_IMAGE 2299 0.45 0.05 0.63 177 TO_NO_BRKTS_HTML_ONLY 2240 0.51 0.28 0.62 178 NML_ADSP_CUSTOM_MED 2220 0.63 0.68 0.61 179 XMBdyGiftCard01 2171 0.85 1.42 0.60 180 XMSubMetaI_00 2130 0.73 1.04 0.59 181 XMBrknScrpt_02 2109 1.10 2.24 0.58 182 USER_IN_WELCOMELIST 2027 0.38 0.00 0.56 183 USER_IN_WHITELIST 2027 0.38 0.00 0.56 184 T_Symld_Words_02 1946 0.59 0.70 0.54 185 PLING_QUERY 1918 0.61 0.80 0.53 186 XMPhish30 1904 0.71 1.11 0.52 187 RELAYCOUNTRY_GB 1886 0.56 0.66 0.52 188 MPART_ALT_DIFF_COUNT 1853 0.72 1.17 0.51 189 FILL_THIS_FORM 1840 0.49 0.46 0.51 190 XM_B_COPY_HTML 1797 0.57 0.73 0.49 191 HTML_TAG_BALANCE_BODY 1797 0.79 1.43 0.49 192 FORGED_GMAIL_RCVD 1784 0.57 0.76 0.49 193 SUBJ_DOLLARS 1761 0.48 0.48 0.48 194 XMMoneyMeta_00 1690 0.55 0.73 0.46 195 T_XMHurry_00 1684 0.76 1.41 0.46 196 SpammyFromTLD_02 1667 0.81 1.57 0.46 197 TM2_M_BODY_EMPTY 1652 0.71 1.27 0.45 198 HTML_IMAGE_ONLY_28 1635 0.41 0.34 0.45 199 XMSubMetaSxObfu_02 1584 0.38 0.25 0.44 200 XMBody_78 1506 0.68 1.27 0.41 ----------------------------------------------------------------------