Email: 481668 Autolearn: 0 AvgScore: 3.96 AvgScanTime: 1.12 sec Spam: 147393 Autolearn: 0 AvgScore: 13.44 AvgScanTime: 1.22 sec Ham: 334275 Autolearn: 0 AvgScore: -0.22 AvgScanTime: 1.07 sec Time Spent Running SA: 149.82 hours Time Spent Processing Spam: 50.06 hours Time Spent Processing Ham: 99.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141997 87.92 96.34 84.20 2 DKIM_SIGNED 134414 78.31 91.19 72.64 3 XM_DK_Pass 129265 76.26 87.70 71.22 4 DKIM_VALID 127080 75.03 86.22 70.09 5 XM_B_Unicode 127058 72.95 86.20 67.11 6 T_SCC_BODY_TEXT_LINE 119472 82.55 81.06 83.20 7 RELAYCOUNTRY_US 113884 78.54 77.27 79.10 8 XM_B_SpammyWords 110598 52.19 75.04 42.12 9 DCC_CHECK 108450 44.84 73.58 32.16 10 XMListUnsubscribeExists 107361 54.48 72.84 46.38 11 DKIM_VALID_AU 93465 58.52 63.41 56.36 12 XM_B_Unicode3 69373 40.83 47.07 38.09 13 XM_DK_Undo_02 67194 17.88 45.59 5.66 14 XM_B_SpammyWords2 63488 24.85 43.07 16.81 15 LOC_TINY_FONT_1 57733 28.16 39.17 23.30 16 BAYES_50 55646 51.35 37.75 57.35 17 TR_XM_DKIM_Undo 54231 12.71 36.79 2.10 18 BAYES_99 52510 14.23 35.63 4.79 19 HTML_FONT_LOW_CONTRAST 49554 28.43 33.62 26.14 20 DKIM_VALID_EF 48660 30.27 33.01 29.06 21 MIME_HTML_ONLY 48478 23.12 32.89 18.80 22 FVGT_m_MULTI_ODD 46841 27.27 31.78 25.28 23 T_KAM_HTML_FONT_INVALID 42482 22.29 28.82 19.42 24 BAYES_999 40524 11.05 27.49 3.80 25 RCVD_IN_MSPIKE_H2 38977 25.90 26.44 25.67 26 DCC_CHECK_NEGATIVE 38925 55.13 26.41 67.80 27 TR_DCC_Bayes_99 38037 8.98 25.81 1.56 28 TR_XM_DK_Unsub 35844 16.53 24.32 13.09 29 T_TM2_M_HEADER_IN_MSG 33847 28.63 22.96 31.12 30 XMSubLong 32871 22.70 22.30 22.87 31 RELAYCOUNTRY_META 32223 9.54 21.86 4.11 32 TR_XM_SpammyRelay 26751 6.95 18.15 2.02 33 XM_Multi_Part_URI 26491 14.52 17.97 13.00 34 XM_B_Unsub 22949 10.07 15.57 7.65 35 TR_XM_BayesUnsub 21990 8.67 14.92 5.91 36 TR_MAX_INTL_RELAY 21939 9.26 14.88 6.78 37 LOTS_OF_MONEY 21448 8.91 14.55 6.42 38 XM_B_SpammyWords3 21439 7.05 14.55 3.74 39 TR_XM_SpammyWords2 20647 4.53 14.01 0.36 40 UNPARSEABLE_RELAY 20593 11.32 13.97 10.14 41 RELAYCOUNTRY_CA 20292 5.02 13.77 1.16 42 BOTNET_IPINHOSTNAME 19599 6.99 13.30 4.21 43 TR_XM_SpammyWords4 19115 7.02 12.97 4.40 44 RCVD_IN_BL_SPAMCOP_NET 19005 4.24 12.89 0.42 45 RCVD_IN_MSPIKE_WL 16258 7.40 11.03 5.79 46 RCVD_IN_MSPIKE_H3 16258 7.40 11.03 5.79 47 TR_XM_SPAMCOP 16202 3.50 10.99 0.20 48 XM_Evil_Numbers_Gen 14176 8.13 9.62 7.48 49 XM_Body_Dirty_Words 13869 5.32 9.41 3.52 50 BOTNET 13585 3.74 9.22 1.32 51 BAYES_80 13382 5.63 9.08 4.11 52 BAYES_60 11754 8.62 7.97 8.90 53 XMBody_17 11399 2.82 7.73 0.65 54 FSL_BULK_SIG 11154 4.98 7.57 3.84 55 TR_XM_UnparsRelay 11007 3.35 7.47 1.54 56 LotsOfNums_01 9558 7.20 6.48 7.52 57 XMSubMetaSx_00 9435 4.80 6.40 4.10 58 XM_UncommonTLD01 9308 4.65 6.32 3.92 59 HTML_IMAGE_RATIO_02 9237 5.52 6.27 5.19 60 XM_H_Long_From01 8749 5.51 5.94 5.32 61 MPART_ALT_DIFF 8740 4.34 5.93 3.64 62 TooManyTo_001 8471 8.36 5.75 9.52 63 T_FILL_THIS_FORM_SHORT 8137 2.48 5.52 1.14 64 BAYES_95 8052 3.52 5.46 2.67 65 UNTRUSTED_Relay 8013 2.72 5.44 1.52 66 XMSexyCombo_05 7994 2.98 5.42 1.91 67 XM_B_Investor 7496 2.74 5.09 1.71 68 XM_B_Phish_Phrases 7386 4.01 5.01 3.57 69 DKIM_INVALID 7334 3.29 4.98 2.54 70 XM_OfRef6 7278 2.54 4.94 1.49 71 HTML_IMAGE_RATIO_04 7175 4.05 4.87 3.69 72 XM_H_GMP 6568 6.12 4.46 6.86 73 XM_SPF_SoftFail 6529 3.56 4.43 3.17 74 MIME_HTML_MOSTLY 6235 2.75 4.23 2.10 75 TR_XM_SpammyWords5 6183 2.20 4.19 1.32 76 HTML_IMAGE_RATIO_06 5975 2.97 4.05 2.50 77 TR_XM_PhishingBody 5680 2.28 3.85 1.59 78 T_XMDrugObfuBody_14 5584 2.64 3.79 2.14 79 TM2_M_URI_OPT_OUT 5497 2.47 3.73 1.91 80 XMNumbers 5492 2.93 3.73 2.57 81 TR_XM_BayesRelay 5246 1.09 3.56 0.00 82 T_XMDrugObfuBody_08 5231 2.31 3.55 1.77 83 MIME_HTML_ONLY_MULTI 5181 2.57 3.52 2.15 84 FONT_INVIS_LONG_LINE 4948 1.07 3.36 0.06 85 TR_XM_FormFill 4905 1.03 3.33 0.01 86 HTML_IMAGE_RATIO_08 4823 2.52 3.27 2.18 87 XMStrtUSub 4728 3.94 3.21 4.27 88 XM_B_SpammyWords4 4483 1.57 3.04 0.92 89 TM2_M_VERY_LONG_WORD 4444 1.79 3.02 1.25 90 XM_B_SpammyTLD 4393 2.65 2.98 2.51 91 XM_URI_RBL 4331 1.00 2.94 0.15 92 T_TooManySym_01 4058 5.02 2.75 6.02 93 XMDiploma_00 4049 1.89 2.75 1.51 94 MIME_QP_LONG_LINE 4044 4.23 2.74 4.89 95 TR_LOTS_OF_MONEY3 3987 1.15 2.71 0.47 96 SpammyFromTLD_01 3964 1.38 2.69 0.80 97 USER_IN_DEF_DKIM_WL 3946 8.76 2.68 11.44 98 XM_CamelCaseFrm001 3911 2.39 2.65 2.27 99 XM_UB50 3764 1.38 2.55 0.87 100 RCVD_IN_VALIDITY_SAFE 3752 3.45 2.55 3.85 101 SUBJ_ALL_CAPS 3277 1.84 2.22 1.68 102 XMBrknScrpt_02 3179 1.09 2.16 0.62 103 XM_B_Unsub2 3164 1.53 2.15 1.26 104 TR_XM_NoHeaderRelay 3161 0.73 2.14 0.11 105 RELAYCOUNTRY_AU 3133 1.10 2.13 0.65 106 RCVD_IN_VALIDITY_CERTIFIED 3066 3.01 2.08 3.42 107 FROM_EXCESS_BASE64 3011 1.77 2.04 1.64 108 TR_XM_PHPForged 2846 1.07 1.93 0.69 109 XMStockSpam_06 2788 1.46 1.89 1.27 110 HK_RANDOM_REPLYTO 2767 0.63 1.88 0.07 111 TR_XM_PHPDW 2760 1.02 1.87 0.65 112 TR_XM_FormFill2 2710 1.02 1.84 0.66 113 XM_H_PHPOS 2699 1.01 1.83 0.64 114 T_XMHurry_00 2691 0.83 1.83 0.39 115 HTML_MIME_NO_HTML_TAG 2602 2.10 1.77 2.24 116 URI_HEX 2595 1.24 1.76 1.02 117 TR_XM_INV_DKIM 2590 0.58 1.76 0.05 118 TR_Mismatch_TLD_02 2564 0.59 1.74 0.08 119 MAILING_LIST_MULTI 2498 2.69 1.69 3.12 120 HTML_TAG_BALANCE_BODY 2470 0.85 1.68 0.49 121 SpammyFromTLD_02 2452 0.69 1.66 0.26 122 ANY_BOUNCE_MESSAGE 2434 3.90 1.65 4.89 123 BOUNCE_MESSAGE 2434 3.90 1.65 4.89 124 XM_SendGrid 2427 1.48 1.65 1.41 125 XM_DK_Undo_01 2376 1.84 1.61 1.94 126 TM2_M_A_HREF_HREF 2354 0.69 1.60 0.29 127 BAYES_40 2330 3.99 1.58 5.05 128 XMBdyGiftCard01 2318 0.97 1.57 0.70 129 XM_HighProb1 2296 0.48 1.56 0.01 130 T_XMDrugObfuBody_00 2255 0.88 1.53 0.59 131 XM_B_DNDMA 2200 0.72 1.49 0.38 132 XMReplyNow 2178 0.59 1.48 0.20 133 XMGenDplmaNmb 2122 1.04 1.44 0.87 134 T_REMOTE_IMAGE 2107 2.85 1.43 3.47 135 XM_H_Undi_Recip 2102 0.60 1.43 0.23 136 RCVD_IN_IADB_LISTED 2071 3.32 1.41 4.17 137 HTTPS_HTTP_MISMATCH 2067 1.05 1.40 0.89 138 THIS_AD 2010 0.70 1.36 0.41 139 ALL_TRUSTED 1996 12.79 1.35 17.83 140 XM_DIRTYINTL 1979 0.53 1.34 0.17 141 URI_TRY_3LD 1953 0.93 1.33 0.76 142 KHOP_HELO_FCRDNS 1930 1.28 1.31 1.26 143 XMLngstWrd_00 1883 0.88 1.28 0.70 144 RCVD_IN_IADB_SPF 1872 2.94 1.27 3.68 145 XMPhish30 1849 0.72 1.25 0.49 146 BAYES_20 1817 2.95 1.23 3.71 147 TR_XM_Undi_Recip19 1807 0.43 1.23 0.08 148 BOTNET_NORDNS 1795 0.38 1.22 0.01 149 RCVD_IN_IADB_DK 1773 2.62 1.20 3.25 150 RCVD_IN_IADB_SENDERID 1760 2.68 1.19 3.33 151 HOSTED_IMG_MULTI_PUB_01 1751 0.37 1.19 0.01 152 XMSexyCombo_01 1727 0.55 1.17 0.28 153 AC_BR_BONANZA 1706 0.39 1.16 0.04 154 XMHTML_After_End 1682 0.86 1.14 0.73 155 LongTLD 1636 0.59 1.11 0.36 156 DKIM_ADSP_CUSTOM_MED 1627 1.03 1.10 1.00 157 T_MONEY_PERCENT 1620 0.55 1.10 0.31 158 TR_LOTS_OF_MONEY2 1620 0.55 1.10 0.31 159 XMMoneyMeta_00 1611 0.67 1.09 0.48 160 TR_XM_DK_SendGrid 1583 1.00 1.07 0.97 161 XM_H_PHPMailer 1576 0.88 1.07 0.79 162 RCVD_IN_VALIDITY_RPBL 1575 0.35 1.07 0.04 163 TR_Symld_Words 1556 1.51 1.06 1.71 164 SCC_BODY_URI_ONLY 1545 2.30 1.05 2.85 165 XMSubMetaI_00 1533 0.63 1.04 0.45 166 XM_RXBody 1517 0.77 1.03 0.66 167 RDNS_DYNAMIC 1516 0.57 1.03 0.37 168 TR_MetaPhish_Combo_01 1473 0.86 1.00 0.80 169 NML_ADSP_CUSTOM_MED 1472 0.77 1.00 0.68 170 TR_XM_InvalidRelay 1462 0.32 0.99 0.02 171 URI_NOVOWEL 1457 1.39 0.99 1.57 172 T_TooManySym_02 1456 2.42 0.99 3.05 173 XMClaimOffer 1444 0.43 0.98 0.19 174 XMPhish14 1415 0.66 0.96 0.53 175 XMSubMetaSxObfu_03 1406 1.00 0.95 1.03 176 XM_ProductURIs 1402 0.68 0.95 0.56 177 XM_B_COVIDMETA 1400 0.49 0.95 0.29 178 XM_B_Phish66 1394 0.49 0.95 0.28 179 MPART_ALT_DIFF_COUNT 1362 0.74 0.92 0.66 180 XM_UB99 1356 0.29 0.92 0.01 181 TR_XM_Base64_L1 1306 0.34 0.89 0.10 182 XM_B_COPY_HTML 1297 0.64 0.88 0.54 183 XM_H_Long_From02 1285 1.01 0.87 1.08 184 TR_XM_Undi_RecipCombo2 1251 0.27 0.85 0.01 185 TR_XM_Base64_M1 1238 0.75 0.84 0.71 186 TooManyTo_002 1222 2.34 0.83 3.00 187 RELAYCOUNTRY_FR 1220 0.44 0.83 0.27 188 TR_Caps_n_Bayes_99 1212 0.26 0.82 0.01 189 RCVD_IN_PSBL 1198 0.44 0.81 0.27 190 T_Symld_Words_02 1178 0.57 0.80 0.47 191 TM2_M_OBFU_COMMENT 1176 0.36 0.80 0.16 192 TVD_RCVD_IP 1157 1.19 0.78 1.38 193 T_XMDrugObfuBody_10 1152 0.27 0.78 0.04 194 RELAYCOUNTRY_RU 1129 0.26 0.77 0.04 195 HELO_DYNAMIC_SPLIT_IP 1104 0.23 0.75 0.01 196 TR_Mismatch_TLD_01 1104 0.51 0.75 0.41 197 HTML_FONT_FACE_BAD 1102 0.52 0.75 0.42 198 RELAYCOUNTRY_GB 1095 0.57 0.74 0.49 199 TR_XM_Spammywords 1093 0.46 0.74 0.33 200 XM_S_SpammyWords 1093 0.46 0.74 0.34 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 281467 87.92 96.34 84.20 2 T_SCC_BODY_TEXT_LINE 278123 82.55 81.06 83.20 3 RELAYCOUNTRY_US 264416 78.54 77.27 79.10 4 DKIM_SIGNED 242802 78.31 91.19 72.64 5 XM_DK_Pass 238068 76.26 87.70 71.22 6 DKIM_VALID 234301 75.03 86.22 70.09 7 DCC_CHECK_NEGATIVE 226623 55.13 26.41 67.80 8 XM_B_Unicode 224325 72.95 86.20 67.11 9 BAYES_50 191692 51.35 37.75 57.35 10 DKIM_VALID_AU 188390 58.52 63.41 56.36 11 XMListUnsubscribeExists 155041 54.48 72.84 46.38 12 XM_B_SpammyWords 140786 52.19 75.04 42.12 13 XM_B_Unicode3 127313 40.83 47.07 38.09 14 DCC_CHECK 107513 44.84 73.58 32.16 15 T_TM2_M_HEADER_IN_MSG 104031 28.63 22.96 31.12 16 DKIM_VALID_EF 97130 30.27 33.01 29.06 17 HTML_FONT_LOW_CONTRAST 87388 28.43 33.62 26.14 18 RCVD_IN_MSPIKE_H2 85794 25.90 26.44 25.67 19 FVGT_m_MULTI_ODD 84508 27.27 31.78 25.28 20 LOC_TINY_FONT_1 77887 28.16 39.17 23.30 21 XMSubLong 76450 22.70 22.30 22.87 22 T_KAM_HTML_FONT_INVALID 64903 22.29 28.82 19.42 23 MIME_HTML_ONLY 62860 23.12 32.89 18.80 24 ALL_TRUSTED 59611 12.79 1.35 17.83 25 XM_B_SpammyWords2 56195 24.85 43.07 16.81 26 TR_XM_DK_Unsub 43769 16.53 24.32 13.09 27 XM_Multi_Part_URI 43470 14.52 17.97 13.00 28 USER_IN_DEF_DKIM_WL 38257 8.76 2.68 11.44 29 BAYES_00 34967 7.45 0.64 10.46 30 UNPARSEABLE_RELAY 33912 11.32 13.97 10.14 31 TooManyTo_001 31820 8.36 5.75 9.52 32 BAYES_60 29759 8.62 7.97 8.90 33 XM_B_Unsub 25576 10.07 15.57 7.65 34 XM_DKIMWhitelistDomains 25266 5.25 0.03 7.56 35 LotsOfNums_01 25131 7.20 6.48 7.52 36 XM_Evil_Numbers_Gen 25001 8.13 9.62 7.48 37 TR_XM_DK_Bayes 23235 4.96 0.46 6.95 38 XM_H_GMP 22927 6.12 4.46 6.86 39 TR_XM_DK_Bayes1 22853 4.88 0.45 6.84 40 TR_MAX_INTL_RELAY 22662 9.26 14.88 6.78 41 IN_ZIMBRA_NJ_WHITELIST 21905 4.57 0.08 6.55 42 LOTS_OF_MONEY 21445 8.91 14.55 6.42 43 T_TooManySym_01 20127 5.02 2.75 6.02 44 TR_XM_DK_Bayes2 19777 4.20 0.30 5.92 45 TR_XM_BayesUnsub 19749 8.67 14.92 5.91 46 RCVD_IN_MSPIKE_WL 19370 7.40 11.03 5.79 47 RCVD_IN_MSPIKE_H3 19370 7.40 11.03 5.79 48 XM_DK_Undo_02 18911 17.88 45.59 5.66 49 XM_H_Long_From01 17771 5.51 5.94 5.32 50 XM_PDF 17637 3.86 0.65 5.28 51 HTML_IMAGE_RATIO_02 17341 5.52 6.27 5.19 52 BAYES_40 16879 3.99 1.58 5.05 53 MIME_QP_LONG_LINE 16351 4.23 2.74 4.89 54 ANY_BOUNCE_MESSAGE 16341 3.90 1.65 4.89 55 BOUNCE_MESSAGE 16341 3.90 1.65 4.89 56 BAYES_99 16026 14.23 35.63 4.79 57 TR_XM_SpammyWords4 14715 7.02 12.97 4.40 58 XMStrtUSub 14262 3.94 3.21 4.27 59 BOTNET_IPINHOSTNAME 14059 6.99 13.30 4.21 60 RCVD_IN_IADB_LISTED 13940 3.32 1.41 4.17 61 RELAYCOUNTRY_META 13752 9.54 21.86 4.11 62 BAYES_80 13742 5.63 9.08 4.11 63 XMSubMetaSx_00 13699 4.80 6.40 4.10 64 XM_UncommonTLD01 13111 4.65 6.32 3.92 65 RCVD_IN_VALIDITY_SAFE 12855 3.45 2.55 3.85 66 FSL_BULK_SIG 12840 4.98 7.57 3.84 67 BAYES_999 12698 11.05 27.49 3.80 68 XM_B_SpammyWords3 12508 7.05 14.55 3.74 69 BAYES_20 12406 2.95 1.23 3.71 70 HTML_IMAGE_RATIO_04 12349 4.05 4.87 3.69 71 RCVD_IN_IADB_SPF 12298 2.94 1.27 3.68 72 MPART_ALT_DIFF 12172 4.34 5.93 3.64 73 XM_B_Phish_Phrases 11940 4.01 5.01 3.57 74 XM_Body_Dirty_Words 11750 5.32 9.41 3.52 75 T_REMOTE_IMAGE 11604 2.85 1.43 3.47 76 RCVD_IN_VALIDITY_CERTIFIED 11446 3.01 2.08 3.42 77 RCVD_IN_IADB_SENDERID 11133 2.68 1.19 3.33 78 RCVD_IN_IADB_DK 10852 2.62 1.20 3.25 79 XM_SPF_SoftFail 10598 3.56 4.43 3.17 80 MAILING_LIST_MULTI 10441 2.69 1.69 3.12 81 T_TooManySym_02 10183 2.42 0.99 3.05 82 TooManyTo_002 10026 2.34 0.83 3.00 83 BAYES_05 9893 2.25 0.65 2.96 84 SCC_BODY_URI_ONLY 9526 2.30 1.05 2.85 85 BAYES_95 8909 3.52 5.46 2.67 86 XMNumbers 8604 2.93 3.73 2.57 87 DKIM_INVALID 8501 3.29 4.98 2.54 88 XM_B_SpammyTLD 8376 2.65 2.98 2.51 89 RCVD_IN_IADB_VOUCHED 8356 1.92 0.61 2.50 90 HTML_IMAGE_RATIO_06 8352 2.97 4.05 2.50 91 XM_CamelCaseFrm001 7590 2.39 2.65 2.27 92 HELO_NODOT 7528 1.74 0.60 2.25 93 HELO_NO_DOMAIN 7510 1.74 0.59 2.25 94 HTML_MIME_NO_HTML_TAG 7501 2.10 1.77 2.24 95 HTML_IMAGE_RATIO_08 7295 2.52 3.27 2.18 96 MIME_HTML_ONLY_MULTI 7194 2.57 3.52 2.15 97 T_XMDrugObfuBody_14 7141 2.64 3.79 2.14 98 INVALID_MSGID 7053 1.51 0.15 2.11 99 MIME_HTML_MOSTLY 7022 2.75 4.23 2.10 100 TR_XM_DKIM_Undo 7004 12.71 36.79 2.10 101 TR_XM_SpammyRelay 6743 6.95 18.15 2.02 102 XM_DK_Undo_01 6480 1.84 1.61 1.94 103 TM2_M_URI_OPT_OUT 6382 2.47 3.73 1.91 104 XMSexyCombo_05 6372 2.98 5.42 1.91 105 TO_MALFORMED 6311 1.31 0.00 1.89 106 T_XMDrugObfuBody_08 5909 2.31 3.55 1.77 107 RCVD_IN_IADB_OPTIN 5846 1.36 0.48 1.75 108 TooManyTo_003 5798 1.42 0.72 1.73 109 XM_B_Investor 5723 2.74 5.09 1.71 110 TR_Symld_Words 5711 1.51 1.06 1.71 111 SUBJ_ALL_CAPS 5600 1.84 2.22 1.68 112 FROM_EXCESS_BASE64 5493 1.77 2.04 1.64 113 TR_XM_PhishingBody 5299 2.28 3.85 1.59 114 URI_NOVOWEL 5242 1.39 0.99 1.57 115 TR_DCC_Bayes_99 5229 8.98 25.81 1.56 116 TR_XM_UnparsRelay 5145 3.35 7.47 1.54 117 UNTRUSTED_Relay 5078 2.72 5.44 1.52 118 XMDiploma_00 5048 1.89 2.75 1.51 119 XMGappySubj_01 5003 1.08 0.13 1.50 120 XM_OfRef6 4969 2.54 4.94 1.49 121 IN_HORDE_ADDRESS_BOOK 4752 1.01 0.07 1.42 122 XM_SendGrid 4698 1.48 1.65 1.41 123 TVD_RCVD_IP 4598 1.19 0.78 1.38 124 XM_GoogleGroups 4530 1.09 0.47 1.36 125 XMCapTrack 4460 1.04 0.37 1.33 126 BOTNET 4417 3.74 9.22 1.32 127 TR_XM_SpammyWords5 4408 2.20 4.19 1.32 128 TooManyTo_004 4253 1.08 0.66 1.27 129 XMStockSpam_06 4231 1.46 1.89 1.27 130 XM_B_Unsub2 4228 1.53 2.15 1.26 131 KHOP_HELO_FCRDNS 4219 1.28 1.31 1.26 132 TM2_M_VERY_LONG_WORD 4195 1.79 3.02 1.25 133 TVD_SPACE_RATIO 3942 0.86 0.13 1.18 134 RELAYCOUNTRY_CA 3894 5.02 13.77 1.16 135 XMBody_95 3862 0.86 0.19 1.16 136 T_FILL_THIS_FORM_SHORT 3817 2.48 5.52 1.14 137 XMBSHREFv2 3668 0.85 0.30 1.10 138 XM_H_Long_From02 3596 1.01 0.87 1.08 139 XMGappySubj_02 3546 0.75 0.05 1.06 140 TooManyTo_005 3458 0.91 0.63 1.03 141 T_TooManySym_03 3439 0.82 0.34 1.03 142 XMSubMetaSxObfu_03 3427 1.00 0.95 1.03 143 URI_HEX 3393 1.24 1.76 1.02 144 DKIM_ADSP_CUSTOM_MED 3340 1.03 1.10 1.00 145 TR_XM_DK_SendGrid 3231 1.00 1.07 0.97 146 XMNoVowels 3102 0.79 0.47 0.93 147 XM_B_SpammyWords4 3077 1.57 3.04 0.92 148 HTTPS_HTTP_MISMATCH 2990 1.05 1.40 0.89 149 XMGenDplmaNmb 2907 1.04 1.44 0.87 150 XM_UB50 2901 1.38 2.55 0.87 151 SpammyFromTLD_01 2686 1.38 2.69 0.80 152 RCVD_IN_RP_SAFE 2679 0.72 0.54 0.80 153 TR_MetaPhish_Combo_01 2664 0.86 1.00 0.80 154 XM_H_PHPMailer 2651 0.88 1.07 0.79 155 XM_ShortIntro_01 2603 0.66 0.39 0.78 156 URI_TRY_3LD 2531 0.93 1.33 0.76 157 T_OBFU_PDF_ATTACH 2485 0.55 0.11 0.74 158 XMHTML_After_End 2442 0.86 1.14 0.73 159 RCVD_IN_RP_CERTIFIED 2422 0.64 0.44 0.72 160 SHORT_HELO_AND_INLINE_IMAGE 2393 0.51 0.04 0.72 161 TR_XM_Base64_M1 2372 0.75 0.84 0.71 162 XMLngstWrd_00 2349 0.88 1.28 0.70 163 XMBdyGiftCard01 2341 0.97 1.57 0.70 164 MSGID_NOFQDN1 2338 0.49 0.01 0.70 165 TR_XM_PHPForged 2311 1.07 1.93 0.69 166 NML_ADSP_CUSTOM_MED 2257 0.77 1.00 0.68 167 XM_RXBody 2213 0.77 1.03 0.66 168 TR_XM_FormFill2 2207 1.02 1.84 0.66 169 MPART_ALT_DIFF_COUNT 2205 0.74 0.92 0.66 170 RELAYCOUNTRY_AU 2180 1.10 2.13 0.65 171 TR_XM_PHPDW 2176 1.02 1.87 0.65 172 XMBody_17 2164 2.82 7.73 0.65 173 FILL_THIS_FORM 2163 0.57 0.39 0.65 174 XM_H_PHPOS 2144 1.01 1.83 0.64 175 XM_H_Trusted_IP 2074 0.43 0.00 0.62 176 XMBrknScrpt_02 2061 1.09 2.16 0.62 177 T_XMDrugObfuBody_00 1977 0.88 1.53 0.59 178 PLING_QUERY 1956 0.62 0.69 0.59 179 USER_IN_WELCOMELIST 1892 0.39 0.00 0.57 180 USER_IN_WHITELIST 1892 0.39 0.00 0.57 181 XM_ProductURIs 1886 0.68 0.95 0.56 182 XMSubNoVowel 1875 0.56 0.56 0.56 183 FROM_GOV_DKIM_AU 1857 0.42 0.10 0.56 184 FORGED_GMAIL_RCVD 1839 0.60 0.71 0.55 185 TO_NO_BRKTS_HTML_ONLY 1813 0.47 0.30 0.54 186 XM_B_COPY_HTML 1793 0.64 0.88 0.54 187 XMPhish14 1765 0.66 0.96 0.53 188 XM_B_FormFill 1759 0.38 0.05 0.53 189 HTML_IMAGE_ONLY_32 1701 0.41 0.18 0.51 190 TM2_M_BODY_EMPTY 1694 0.40 0.15 0.51 191 HTML_TAG_BALANCE_BODY 1639 0.85 1.68 0.49 192 RELAYCOUNTRY_GB 1637 0.57 0.74 0.49 193 XMPhish30 1624 0.72 1.25 0.49 194 XMMoneyMeta_00 1598 0.67 1.09 0.48 195 RCVD_IN_SORBS_DUL 1594 0.34 0.04 0.48 196 T_Symld_Words_02 1568 0.57 0.80 0.47 197 TR_LOTS_OF_MONEY3 1557 1.15 2.71 0.47 198 XMSubMetaI_00 1515 0.63 1.04 0.45 199 HTML_IMAGE_ONLY_28 1469 0.44 0.43 0.44 200 MISSING_HEADERS 1453 0.53 0.73 0.43 ----------------------------------------------------------------------