Email: 563592 Autolearn: 0 AvgScore: 2.10 AvgScanTime: 1.47 sec Spam: 159357 Autolearn: 0 AvgScore: 13.28 AvgScanTime: 1.68 sec Ham: 404235 Autolearn: 0 AvgScore: -2.31 AvgScanTime: 1.38 sec Time Spent Running SA: 229.92 hours Time Spent Processing Spam: 74.41 hours Time Spent Processing Ham: 155.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153800 90.28 96.51 87.82 2 DKIM_SIGNED 145081 71.43 91.04 63.69 3 XM_DK_Pass 138597 69.40 86.97 62.48 4 DKIM_VALID 136962 68.50 85.95 61.62 5 XM_B_Unicode 134148 75.46 84.18 72.02 6 RELAYCOUNTRY_US 129106 81.10 81.02 81.13 7 T_SCC_BODY_TEXT_LINE 129077 82.66 81.00 83.31 8 XM_B_SpammyWords 115014 50.42 72.17 41.84 9 DCC_CHECK 114915 41.12 72.11 28.90 10 XMListUnsubscribeExists 114803 51.03 72.04 42.74 11 DKIM_VALID_AU 102051 53.38 64.04 49.18 12 XM_DK_Undo_02 70579 15.88 44.29 4.68 13 XM_B_Unicode3 69448 42.60 43.58 42.22 14 XM_B_SpammyWords2 67074 23.50 42.09 16.17 15 LOC_TINY_FONT_1 65457 26.95 41.08 21.38 16 BAYES_50 62858 51.95 39.44 56.88 17 HTML_FONT_LOW_CONTRAST 59617 29.39 37.41 26.22 18 BAYES_99 55716 12.62 34.96 3.81 19 TR_XM_DKIM_Undo 53437 10.75 33.53 1.77 20 DKIM_VALID_EF 51609 26.81 32.39 24.61 21 MIME_HTML_ONLY 51457 24.53 32.29 21.47 22 FVGT_m_MULTI_ODD 50994 25.03 32.00 22.29 23 T_KAM_HTML_FONT_INVALID 46027 20.84 28.88 17.67 24 DCC_CHECK_NEGATIVE 44421 58.85 27.88 71.06 25 BAYES_999 44117 9.93 27.68 2.93 26 RCVD_IN_MSPIKE_H2 41610 22.63 26.11 21.25 27 TR_DCC_Bayes_99 37942 7.57 23.81 1.17 28 TR_XM_DK_Unsub 36795 15.09 23.09 11.94 29 XMSubLong 36396 21.75 22.84 21.32 30 T_TM2_M_HEADER_IN_MSG 35988 24.04 22.58 24.61 31 RELAYCOUNTRY_META 30819 8.05 19.34 3.60 32 XM_Multi_Part_URI 30195 13.78 18.95 11.74 33 LOTS_OF_MONEY 27455 9.08 17.23 5.87 34 XM_B_Unsub 24398 9.05 15.31 6.59 35 TR_XM_SpammyWords4 24144 7.17 15.15 4.03 36 TR_XM_SpammyRelay 23982 5.60 15.05 1.87 37 TR_XM_BayesUnsub 23500 7.83 14.75 5.11 38 TR_MAX_INTL_RELAY 23057 8.41 14.47 6.02 39 XM_B_SpammyWords3 22902 6.85 14.37 3.88 40 BOTNET_IPINHOSTNAME 22484 6.80 14.11 3.92 41 UNPARSEABLE_RELAY 21589 10.20 13.55 8.88 42 TR_XM_SpammyWords2 21186 4.01 13.29 0.35 43 RCVD_IN_BL_SPAMCOP_NET 18808 3.70 11.80 0.50 44 XM_Body_Dirty_Words 16174 5.65 10.15 3.87 45 RELAYCOUNTRY_CA 16136 3.58 10.13 1.00 46 XM_Evil_Numbers_Gen 14848 8.95 9.32 8.81 47 BOTNET 14766 3.42 9.27 1.12 48 TR_XM_SPAMCOP 14490 2.73 9.09 0.23 49 BAYES_80 14086 5.20 8.84 3.77 50 FSL_BULK_SIG 13381 4.89 8.40 3.50 51 RCVD_IN_MSPIKE_H3 13204 6.06 8.29 5.18 52 RCVD_IN_MSPIKE_WL 13204 6.06 8.29 5.18 53 BAYES_60 12252 8.12 7.69 8.29 54 TR_XM_UnparsRelay 11528 2.92 7.23 1.21 55 LotsOfNums_01 10677 7.33 6.70 7.58 56 XMSubMetaSx_00 10627 4.44 6.67 3.56 57 MPART_ALT_DIFF 9728 8.44 6.10 9.36 58 HTML_IMAGE_RATIO_02 9616 4.71 6.03 4.19 59 XMBody_17 9609 2.14 6.03 0.60 60 XM_H_Long_From01 9534 4.98 5.98 4.59 61 HTML_IMAGE_RATIO_04 9316 12.28 5.85 14.82 62 TooManyTo_001 9303 7.15 5.84 7.66 63 UNTRUSTED_Relay 9227 2.58 5.79 1.32 64 XMSexyCombo_05 9146 2.89 5.74 1.76 65 TR_LOTS_OF_MONEY3 8928 2.04 5.60 0.64 66 XM_UncommonTLD01 8712 3.95 5.47 3.36 67 XM_B_Phish_Phrases 8213 3.51 5.15 2.87 68 DKIM_INVALID 8119 2.93 5.09 2.07 69 BAYES_95 8093 3.04 5.08 2.24 70 TR_XM_SpammyWords5 7625 2.21 4.78 1.19 71 T_XMDrugObfuBody_08 7270 2.42 4.56 1.58 72 XM_B_Investor 7131 2.30 4.47 1.44 73 XM_SPF_SoftFail 6917 3.28 4.34 2.86 74 MIME_HTML_MOSTLY 6448 3.13 4.05 2.76 75 XM_H_GMP 6384 5.24 4.01 5.72 76 XMNumbers 6320 2.82 3.97 2.37 77 TR_XM_PhishingBody 6140 2.28 3.85 1.66 78 XMStrtUSub 6037 8.44 3.79 10.27 79 HTML_IMAGE_RATIO_06 5965 4.32 3.74 4.55 80 XM_OfRef6 5959 1.82 3.74 1.06 81 XM_B_SpammyTLD 5743 2.91 3.60 2.64 82 T_XMDrugObfuBody_14 5726 2.09 3.59 1.49 83 T_FILL_THIS_FORM_SHORT 5579 1.59 3.50 0.84 84 TM2_M_URI_OPT_OUT 5451 2.17 3.42 1.67 85 MIME_HTML_ONLY_MULTI 5431 6.13 3.41 7.21 86 MIME_QP_LONG_LINE 5402 4.18 3.39 4.49 87 HTML_IMAGE_RATIO_08 5314 2.16 3.33 1.70 88 TR_XM_BayesRelay 5234 0.93 3.28 0.00 89 RCVD_IN_VALIDITY_SAFE 4753 3.57 2.98 3.81 90 XM_UB50 4683 1.44 2.94 0.84 91 XMBrknScrpt_02 4596 1.27 2.88 0.63 92 TM2_M_VERY_LONG_WORD 4591 1.54 2.88 1.01 93 XM_CamelCaseFrm001 4472 2.12 2.81 1.86 94 XM_URI_RBL 4398 0.89 2.76 0.16 95 FONT_INVIS_LONG_LINE 4266 0.78 2.68 0.03 96 T_TooManySym_01 4175 4.25 2.62 4.89 97 T_XMHurry_00 4127 1.13 2.59 0.56 98 XM_B_Unsub2 4059 1.58 2.55 1.20 99 SUBJ_ALL_CAPS 4058 1.66 2.55 1.31 100 XMDiploma_00 4046 1.60 2.54 1.23 101 XM_B_SpammyWords4 4015 1.28 2.52 0.80 102 RELAYCOUNTRY_AU 3739 1.10 2.35 0.61 103 RCVD_IN_VALIDITY_CERTIFIED 3658 2.94 2.30 3.20 104 TR_XM_FormFill 3624 0.65 2.27 0.01 105 SpammyFromTLD_01 3561 1.20 2.23 0.79 106 TR_XM_NoHeaderRelay 3441 0.67 2.16 0.08 107 TR_XM_INV_DKIM 3244 0.61 2.04 0.05 108 USER_IN_DEF_DKIM_WL 3220 7.91 2.02 10.24 109 ANY_BOUNCE_MESSAGE 3191 4.15 2.00 4.99 110 BOUNCE_MESSAGE 3187 4.14 2.00 4.99 111 FROM_EXCESS_BASE64 3176 1.72 1.99 1.61 112 URI_TRY_3LD 3001 1.08 1.88 0.76 113 T_REMOTE_IMAGE 2964 2.81 1.86 3.19 114 TR_XM_PHPForged 2851 0.76 1.79 0.36 115 TR_XM_PHPDW 2843 0.75 1.78 0.35 116 URI_HEX 2791 1.19 1.75 0.97 117 MAILING_LIST_MULTI 2775 2.26 1.74 2.46 118 TR_XM_FormFill2 2759 0.74 1.73 0.35 119 XM_DK_Undo_01 2728 1.62 1.71 1.59 120 XM_H_PHPOS 2725 0.72 1.71 0.33 121 SpammyFromTLD_02 2688 0.77 1.69 0.41 122 RCVD_IN_IADB_LISTED 2658 3.27 1.67 3.90 123 RCVD_IN_PSBL 2609 0.65 1.64 0.26 124 TR_Mismatch_TLD_02 2609 0.52 1.64 0.07 125 HK_RANDOM_REPLYTO 2593 0.52 1.63 0.08 126 XMStockSpam_06 2522 1.20 1.58 1.05 127 HTML_MIME_NO_HTML_TAG 2511 1.79 1.58 1.87 128 AC_BR_BONANZA 2485 0.52 1.56 0.10 129 KHOP_HELO_FCRDNS 2436 1.26 1.53 1.16 130 HTML_TAG_BALANCE_BODY 2423 0.66 1.52 0.32 131 XMPhish30 2370 0.82 1.49 0.56 132 RCVD_IN_IADB_SPF 2341 2.93 1.47 3.50 133 XM_HighProb1 2328 0.42 1.46 0.00 134 HTTPS_HTTP_MISMATCH 2323 0.94 1.46 0.74 135 BAYES_40 2320 4.01 1.46 5.01 136 XM_DIRTYINTL 2258 0.56 1.42 0.22 137 RCVD_IN_IADB_DK 2242 2.63 1.41 3.11 138 RCVD_IN_IADB_SENDERID 2231 2.67 1.40 3.18 139 XM_SendGrid 2217 1.24 1.39 1.17 140 T_XMDrugObfuBody_00 2190 0.75 1.37 0.50 141 XMSexyCombo_01 2073 0.52 1.30 0.21 142 XMClaimOffer 2070 0.42 1.30 0.08 143 XMHTML_After_End 2003 0.81 1.26 0.64 144 BOTNET_NORDNS 1973 0.36 1.24 0.01 145 XMBdyGiftCard01 1968 0.86 1.23 0.72 146 XMGenDplmaNmb 1885 0.75 1.18 0.57 147 T_MONEY_PERCENT 1834 0.46 1.15 0.18 148 TR_LOTS_OF_MONEY2 1834 0.46 1.15 0.18 149 RCVD_IN_VALIDITY_RPBL 1831 0.35 1.15 0.04 150 ALL_TRUSTED 1829 11.91 1.15 16.16 151 DKIM_ADSP_CUSTOM_MED 1808 0.90 1.13 0.81 152 XM_UB99 1776 0.32 1.11 0.00 153 TR_Caps_n_Bayes_99 1768 0.34 1.11 0.04 154 XM_B_COPY_HTML 1751 0.70 1.10 0.55 155 BAYES_20 1749 2.92 1.10 3.63 156 XMReplyNow 1730 0.44 1.09 0.19 157 SCC_BODY_URI_ONLY 1719 1.94 1.08 2.28 158 HTML_IMAGE_ONLY_20 1670 0.55 1.05 0.35 159 XM_B_COVIDMETA 1670 0.45 1.05 0.21 160 XMSlimDrugH 1660 0.46 1.04 0.24 161 XMSubMetaI_00 1658 0.62 1.04 0.46 162 XM_H_Long_From02 1636 1.02 1.03 1.01 163 URI_NOVOWEL 1627 1.43 1.02 1.58 164 XM_B_DNDMA 1614 0.55 1.01 0.37 165 FORGED_GMAIL_RCVD 1599 0.63 1.00 0.49 166 XMPhish14 1586 0.64 1.00 0.50 167 TR_XM_InvalidRelay 1585 0.29 0.99 0.01 168 RDNS_DYNAMIC 1536 0.51 0.96 0.34 169 XM_H_PHPMailer 1519 0.74 0.95 0.66 170 XMMoneyMeta_00 1482 0.62 0.93 0.49 171 TR_Mismatch_TLD_01 1480 0.47 0.93 0.29 172 T_Symld_Words_02 1458 0.66 0.91 0.57 173 XMLngstWrd_00 1443 0.73 0.91 0.66 174 XMBody_78 1420 0.44 0.89 0.27 175 TooManyTo_002 1417 1.81 0.89 2.18 176 NML_ADSP_CUSTOM_MED 1410 0.63 0.88 0.53 177 XM_B_Phish66 1404 0.45 0.88 0.27 178 TR_Symld_Words 1398 1.15 0.88 1.26 179 XM_UB999 1336 0.24 0.84 0.00 180 MISSING_HEADERS 1295 0.48 0.81 0.35 181 RELAYCOUNTRY_FR 1294 0.35 0.81 0.17 182 XM_H_Undi_Recip 1293 0.33 0.81 0.14 183 XM_B_REG_HTML 1287 0.41 0.81 0.26 184 URIBL_BLACK 1286 0.26 0.81 0.04 185 TVD_RCVD_IP 1278 1.32 0.80 1.53 186 T_XMDrugObfuBody_10 1277 0.25 0.80 0.03 187 TM2_M_OBFU_COMMENT 1264 0.35 0.79 0.18 188 TR_MetaPhish_Combo_01 1237 0.62 0.78 0.55 189 BAYES_00 1237 9.51 0.78 12.95 190 DIET_1 1229 0.35 0.77 0.18 191 XM_ProductURIs 1222 0.52 0.77 0.42 192 XM_OfRef7 1217 0.31 0.76 0.13 193 DATE_IN_PAST_03_06 1214 0.27 0.76 0.08 194 TooManyTo_003 1209 1.15 0.76 1.31 195 T_TooManySym_02 1206 1.86 0.76 2.30 196 HELO_DYNAMIC_SPLIT_IP 1203 0.22 0.75 0.00 197 SHOPIFY_IMG_NOT_RCVD_SFY 1196 0.38 0.75 0.23 198 DKIM_ADSP_NXDOMAIN 1190 0.37 0.75 0.22 199 RELAYCOUNTRY_GB 1189 0.58 0.75 0.51 200 T_PDS_OTHER_BAD_TLD 1171 0.90 0.73 0.96 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 355008 90.28 96.51 87.82 2 T_SCC_BODY_TEXT_LINE 336765 82.66 81.00 83.31 3 RELAYCOUNTRY_US 327955 81.10 81.02 81.13 4 XM_B_Unicode 291114 75.46 84.18 72.02 5 DCC_CHECK_NEGATIVE 287244 58.85 27.88 71.06 6 DKIM_SIGNED 257476 71.43 91.04 63.69 7 XM_DK_Pass 252562 69.40 86.97 62.48 8 DKIM_VALID 249107 68.50 85.95 61.62 9 BAYES_50 229936 51.95 39.44 56.88 10 DKIM_VALID_AU 198802 53.38 64.04 49.18 11 XMListUnsubscribeExists 172787 51.03 72.04 42.74 12 XM_B_Unicode3 170668 42.60 43.58 42.22 13 XM_B_SpammyWords 169132 50.42 72.17 41.84 14 DCC_CHECK 116809 41.12 72.11 28.90 15 HTML_FONT_LOW_CONTRAST 106002 29.39 37.41 26.22 16 DKIM_VALID_EF 99492 26.81 32.39 24.61 17 T_TM2_M_HEADER_IN_MSG 99477 24.04 22.58 24.61 18 FVGT_m_MULTI_ODD 90092 25.03 32.00 22.29 19 MIME_HTML_ONLY 86796 24.53 32.29 21.47 20 LOC_TINY_FONT_1 86411 26.95 41.08 21.38 21 XMSubLong 86195 21.75 22.84 21.32 22 RCVD_IN_MSPIKE_H2 85911 22.63 26.11 21.25 23 T_KAM_HTML_FONT_INVALID 71424 20.84 28.88 17.67 24 XM_B_SpammyWords2 65347 23.50 42.09 16.17 25 ALL_TRUSTED 65307 11.91 1.15 16.16 26 HTML_IMAGE_RATIO_04 59901 12.28 5.85 14.82 27 HTML_FONT_FACE_BAD 55594 10.07 0.72 13.75 28 BAYES_00 52339 9.51 0.78 12.95 29 XM_H_Trusted_IP 50885 9.03 0.00 12.59 30 TR_XM_DK_Unsub 48271 15.09 23.09 11.94 31 XM_Multi_Part_URI 47472 13.78 18.95 11.74 32 XMStrtUSub 41529 8.44 3.79 10.27 33 USER_IN_DEF_DKIM_WL 41380 7.91 2.02 10.24 34 MPART_ALT_DIFF 37825 8.44 6.10 9.36 35 UNPARSEABLE_RELAY 35902 10.20 13.55 8.88 36 XM_Evil_Numbers_Gen 35613 8.95 9.32 8.81 37 BAYES_60 33513 8.12 7.69 8.29 38 TooManyTo_001 30972 7.15 5.84 7.66 39 LotsOfNums_01 30624 7.33 6.70 7.58 40 MIME_HTML_ONLY_MULTI 29141 6.13 3.41 7.21 41 XM_B_Unsub 26625 9.05 15.31 6.59 42 XM_DKIMWhitelistDomains 26432 4.70 0.02 6.54 43 TR_MAX_INTL_RELAY 24321 8.41 14.47 6.02 44 IN_ZIMBRA_NJ_WHITELIST 23949 4.27 0.06 5.92 45 LOTS_OF_MONEY 23731 9.08 17.23 5.87 46 XM_H_GMP 23137 5.24 4.01 5.72 47 TR_XM_DK_Bayes 22085 4.09 0.60 5.46 48 TR_XM_DK_Bayes1 21776 4.03 0.59 5.39 49 RCVD_IN_MSPIKE_H3 20933 6.06 8.29 5.18 50 RCVD_IN_MSPIKE_WL 20933 6.06 8.29 5.18 51 TR_XM_BayesUnsub 20647 7.83 14.75 5.11 52 BAYES_40 20255 4.01 1.46 5.01 53 ANY_BOUNCE_MESSAGE 20171 4.15 2.00 4.99 54 BOUNCE_MESSAGE 20166 4.14 2.00 4.99 55 T_TooManySym_01 19761 4.25 2.62 4.89 56 XM_DK_Undo_02 18903 15.88 44.29 4.68 57 XM_H_Long_From01 18549 4.98 5.98 4.59 58 TR_XM_DK_Bayes2 18518 3.43 0.49 4.58 59 XMSubNoVowel 18438 3.37 0.35 4.56 60 HTML_IMAGE_RATIO_06 18402 4.32 3.74 4.55 61 MIME_QP_LONG_LINE 18131 4.18 3.39 4.49 62 HTML_IMAGE_RATIO_02 16926 4.71 6.03 4.19 63 TR_XM_SpammyWords4 16286 7.17 15.15 4.03 64 XM_PDF 15840 3.00 0.66 3.92 65 BOTNET_IPINHOSTNAME 15827 6.80 14.11 3.92 66 RCVD_IN_IADB_LISTED 15746 3.27 1.67 3.90 67 XM_B_SpammyWords3 15697 6.85 14.37 3.88 68 XM_Body_Dirty_Words 15662 5.65 10.15 3.87 69 BAYES_99 15413 12.62 34.96 3.81 70 RCVD_IN_VALIDITY_SAFE 15388 3.57 2.98 3.81 71 BAYES_80 15248 5.20 8.84 3.77 72 BAYES_20 14687 2.92 1.10 3.63 73 RELAYCOUNTRY_META 14533 8.05 19.34 3.60 74 XMSubMetaSx_00 14403 4.44 6.67 3.56 75 FSL_BULK_SIG 14166 4.89 8.40 3.50 76 RCVD_IN_IADB_SPF 14166 2.93 1.47 3.50 77 BAYES_05 13782 2.63 0.66 3.41 78 XM_UncommonTLD01 13570 3.95 5.47 3.36 79 RCVD_IN_VALIDITY_CERTIFIED 12923 2.94 2.30 3.20 80 T_REMOTE_IMAGE 12888 2.81 1.86 3.19 81 RCVD_IN_IADB_SENDERID 12839 2.67 1.40 3.18 82 RCVD_IN_IADB_DK 12555 2.63 1.41 3.11 83 BAYES_999 11846 9.93 27.68 2.93 84 XM_B_Phish_Phrases 11586 3.51 5.15 2.87 85 XM_SPF_SoftFail 11546 3.28 4.34 2.86 86 MIME_HTML_MOSTLY 11169 3.13 4.05 2.76 87 XM_B_SpammyTLD 10653 2.91 3.60 2.64 88 MAILING_LIST_MULTI 9934 2.26 1.74 2.46 89 XMNumbers 9598 2.82 3.97 2.37 90 T_TooManySym_02 9281 1.86 0.76 2.30 91 SCC_BODY_URI_ONLY 9206 1.94 1.08 2.28 92 BAYES_95 9059 3.04 5.08 2.24 93 RCVD_IN_IADB_VOUCHED 9007 1.79 0.70 2.23 94 TooManyTo_002 8794 1.81 0.89 2.18 95 XMSubLongNoVowel 8576 1.54 0.08 2.12 96 XMSubGarbage 8466 1.51 0.04 2.09 97 DKIM_INVALID 8369 2.93 5.09 2.07 98 TR_XM_SpammyRelay 7574 5.60 15.05 1.87 99 HTML_MIME_NO_HTML_TAG 7557 1.79 1.58 1.87 100 XM_CamelCaseFrm001 7499 2.12 2.81 1.86 101 TR_XM_DKIM_Undo 7139 10.75 33.53 1.77 102 XMSexyCombo_05 7123 2.89 5.74 1.76 103 INVALID_MSGID 7004 1.31 0.24 1.73 104 HTML_IMAGE_RATIO_08 6883 2.16 3.33 1.70 105 TM2_M_URI_OPT_OUT 6762 2.17 3.42 1.67 106 TR_XM_PhishingBody 6698 2.28 3.85 1.66 107 HELO_NODOT 6664 1.33 0.51 1.65 108 HELO_NO_DOMAIN 6653 1.33 0.51 1.65 109 FROM_EXCESS_BASE64 6509 1.72 1.99 1.61 110 XM_DK_Undo_01 6411 1.62 1.71 1.59 111 URI_NOVOWEL 6407 1.43 1.02 1.58 112 T_XMDrugObfuBody_08 6375 2.42 4.56 1.58 113 TO_MALFORMED 6272 1.11 0.01 1.55 114 RCVD_IN_IADB_OPTIN 6222 1.22 0.41 1.54 115 TVD_RCVD_IP 6183 1.32 0.80 1.53 116 T_XMDrugObfuBody_14 6027 2.09 3.59 1.49 117 XM_B_Investor 5828 2.30 4.47 1.44 118 UNTRUSTED_Relay 5339 2.58 5.79 1.32 119 SUBJ_ALL_CAPS 5309 1.66 2.55 1.31 120 TooManyTo_003 5277 1.15 0.76 1.31 121 TR_Symld_Words 5107 1.15 0.88 1.26 122 XMDiploma_00 4989 1.60 2.54 1.23 123 IN_HORDE_ADDRESS_BOOK 4927 0.89 0.07 1.22 124 TR_XM_UnparsRelay 4909 2.92 7.23 1.21 125 XM_B_Unsub2 4856 1.58 2.55 1.20 126 TR_XM_SpammyWords5 4812 2.21 4.78 1.19 127 XM_SendGrid 4747 1.24 1.39 1.17 128 TR_DCC_Bayes_99 4714 7.57 23.81 1.17 129 XMGappySubj_01 4711 0.91 0.27 1.17 130 KHOP_HELO_FCRDNS 4683 1.26 1.53 1.16 131 XM_GoogleGroups 4639 0.97 0.52 1.15 132 HTML_OBFUSCATE_20_30 4549 0.82 0.05 1.13 133 BOTNET 4511 3.42 9.27 1.12 134 XMBSHREFv2 4469 0.87 0.27 1.11 135 XM_OfRef6 4286 1.82 3.74 1.06 136 XMStockSpam_06 4233 1.20 1.58 1.05 137 XMCapTrack 4097 0.82 0.34 1.01 138 XM_H_Long_From02 4096 1.02 1.03 1.01 139 TM2_M_VERY_LONG_WORD 4063 1.54 2.88 1.01 140 RELAYCOUNTRY_CA 4030 3.58 10.13 1.00 141 XM_E_Blogspot 3933 0.71 0.05 0.97 142 URI_HEX 3913 1.19 1.75 0.97 143 T_PDS_OTHER_BAD_TLD 3897 0.90 0.73 0.96 144 TVD_SPACE_RATIO 3868 0.71 0.10 0.96 145 TooManyTo_004 3769 0.87 0.70 0.93 146 XMBody_95 3533 0.69 0.21 0.87 147 XM_UB50 3413 1.44 2.94 0.84 148 T_FILL_THIS_FORM_SHORT 3403 1.59 3.50 0.84 149 T_TooManySym_03 3362 0.69 0.34 0.83 150 DKIM_ADSP_CUSTOM_MED 3259 0.90 1.13 0.81 151 XM_B_SpammyWords4 3218 1.28 2.52 0.80 152 SpammyFromTLD_01 3209 1.20 2.23 0.79 153 TR_XM_DK_SendGrid 3121 0.76 0.73 0.77 154 URI_TRY_3LD 3078 1.08 1.88 0.76 155 HTTPS_HTTP_MISMATCH 2984 0.94 1.46 0.74 156 RCVD_IN_RP_SAFE 2975 0.72 0.68 0.74 157 TooManyTo_005 2945 0.71 0.67 0.73 158 XMBdyGiftCard01 2905 0.86 1.23 0.72 159 XM_ShortIntro_01 2757 0.61 0.44 0.68 160 XMGappySubj_02 2740 0.53 0.14 0.68 161 XMLngstWrd_00 2673 0.73 0.91 0.66 162 XM_H_PHPMailer 2651 0.74 0.95 0.66 163 XMHTML_After_End 2577 0.81 1.26 0.64 164 TR_LOTS_OF_MONEY3 2576 2.04 5.60 0.64 165 XMBrknScrpt_02 2555 1.27 2.88 0.63 166 RELAYCOUNTRY_AU 2477 1.10 2.35 0.61 167 T_OBFU_PDF_ATTACH 2467 0.46 0.07 0.61 168 RCVD_IN_RP_CERTIFIED 2447 0.59 0.57 0.61 169 XMBody_17 2438 2.14 6.03 0.60 170 MSGID_NOFQDN1 2338 0.42 0.03 0.58 171 FROM_GOV_DKIM_AU 2332 0.54 0.46 0.58 172 XMGenDplmaNmb 2315 0.75 1.18 0.57 173 T_Symld_Words_02 2289 0.66 0.91 0.57 174 XMPhish30 2268 0.82 1.49 0.56 175 T_XMHurry_00 2252 1.13 2.59 0.56 176 TR_MetaPhish_Combo_01 2240 0.62 0.78 0.55 177 XM_B_COPY_HTML 2212 0.70 1.10 0.55 178 NML_ADSP_CUSTOM_MED 2151 0.63 0.88 0.53 179 SHORT_HELO_AND_INLINE_IMAGE 2091 0.38 0.04 0.52 180 RELAYCOUNTRY_GB 2080 0.58 0.75 0.51 181 XMPhish14 2035 0.64 1.00 0.50 182 RCVD_IN_BL_SPAMCOP_NET 2028 3.70 11.80 0.50 183 T_XMDrugObfuBody_00 2028 0.75 1.37 0.50 184 XMMoneyMeta_00 1992 0.62 0.93 0.49 185 TR_XM_Base64_M1 1970 0.54 0.69 0.49 186 FORGED_GMAIL_RCVD 1962 0.63 1.00 0.49 187 XMNoVowels 1931 0.48 0.50 0.48 188 USER_IN_WELCOMELIST 1928 0.34 0.00 0.48 189 USER_IN_WHITELIST 1928 0.34 0.00 0.48 190 XMSubMetaI_00 1861 0.62 1.04 0.46 191 TO_NO_BRKTS_HTML_ONLY 1796 0.37 0.19 0.44 192 MPART_ALT_DIFF_COUNT 1792 0.52 0.72 0.44 193 HTML_IMAGE_ONLY_28 1714 0.44 0.46 0.42 194 XM_ProductURIs 1703 0.52 0.77 0.42 195 SpammyFromTLD_02 1669 0.77 1.69 0.41 196 XMSubMetaSxObfu_03 1531 0.46 0.66 0.38 197 FILL_THIS_FORM 1522 0.45 0.64 0.38 198 XM_B_DNDMA 1505 0.55 1.01 0.37 199 XMSubMetaSxObfu_02 1503 0.39 0.43 0.37 200 HTML_IMAGE_ONLY_32 1502 0.32 0.17 0.37 ----------------------------------------------------------------------