Email: 558920 Autolearn: 0 AvgScore: 3.98 AvgScanTime: 1.08 sec Spam: 160780 Autolearn: 0 AvgScore: 13.34 AvgScanTime: 1.28 sec Ham: 398140 Autolearn: 0 AvgScore: 0.20 AvgScanTime: 0.99 sec Time Spent Running SA: 167.17 hours Time Spent Processing Spam: 57.27 hours Time Spent Processing Ham: 109.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155541 89.46 96.74 86.52 2 DKIM_SIGNED 144687 71.87 89.99 64.55 3 XM_DK_Pass 139823 70.22 86.97 63.46 4 XM_B_Unicode 137949 67.04 85.80 59.46 5 DKIM_VALID 137926 69.27 85.79 62.61 6 T_SCC_BODY_TEXT_LINE 130487 82.74 81.16 83.38 7 RELAYCOUNTRY_US 123696 71.99 76.93 69.99 8 XM_B_SpammyWords 118408 47.55 73.65 37.01 9 XMListUnsubscribeExists 116387 51.22 72.39 42.67 10 DCC_CHECK 116374 41.18 72.38 28.58 11 DKIM_VALID_AU 101870 53.98 63.36 50.19 12 XM_B_Unicode3 76659 38.04 47.68 34.14 13 XM_DK_Undo_02 72109 16.36 44.85 4.85 14 XM_B_SpammyWords2 69217 23.23 43.05 15.22 15 LOC_TINY_FONT_1 63174 26.19 39.29 20.89 16 BAYES_50 63165 51.95 39.29 57.06 17 HTML_FONT_LOW_CONTRAST 57615 27.28 35.83 23.82 18 TR_XM_DKIM_Undo 56066 11.35 34.87 1.85 19 BAYES_99 54931 13.14 34.17 4.65 20 DKIM_VALID_EF 54164 28.20 33.69 25.99 21 FVGT_m_MULTI_ODD 53126 24.92 33.04 21.64 22 MIME_HTML_ONLY 52423 29.58 32.61 28.35 23 T_KAM_HTML_FONT_INVALID 47528 21.32 29.56 17.99 24 DCC_CHECK_NEGATIVE 44385 58.79 27.61 71.39 25 BAYES_999 42475 10.08 26.42 3.49 26 RCVD_IN_MSPIKE_H2 42245 24.05 26.28 23.15 27 TR_XM_DK_Unsub 39850 15.89 24.79 12.30 28 TR_DCC_Bayes_99 38980 7.78 24.24 1.13 29 XMSubLong 36577 20.56 22.75 19.68 30 T_TM2_M_HEADER_IN_MSG 36359 24.52 22.61 25.29 31 RELAYCOUNTRY_META 35481 8.99 22.07 3.71 32 XM_Multi_Part_URI 31201 23.48 19.41 25.13 33 TR_XM_SpammyRelay 28329 6.49 17.62 2.00 34 XM_B_Unsub 25561 10.01 15.90 7.64 35 TR_XM_BayesUnsub 24749 8.68 15.39 5.98 36 TR_MAX_INTL_RELAY 23884 9.38 14.86 7.17 37 LOTS_OF_MONEY 22918 8.22 14.25 5.79 38 XM_B_SpammyWords3 22479 6.61 13.98 3.63 39 UNPARSEABLE_RELAY 22280 10.41 13.86 9.01 40 RCVD_IN_BL_SPAMCOP_NET 22031 4.30 13.70 0.50 41 BOTNET_IPINHOSTNAME 21397 6.56 13.31 3.84 42 TR_XM_SpammyWords2 21353 4.08 13.28 0.36 43 TR_XM_SpammyWords4 20661 6.56 12.85 4.02 44 RELAYCOUNTRY_CA 20404 4.41 12.69 1.06 45 TR_XM_SPAMCOP 18510 3.49 11.51 0.25 46 RCVD_IN_MSPIKE_WL 16859 6.90 10.49 5.45 47 RCVD_IN_MSPIKE_H3 16859 6.90 10.49 5.45 48 XM_Body_Dirty_Words 15248 5.23 9.48 3.52 49 XM_Evil_Numbers_Gen 15028 7.38 9.35 6.59 50 BOTNET 14936 3.49 9.29 1.15 51 BAYES_80 14594 5.73 9.08 4.38 52 BAYES_60 13023 11.61 8.10 13.03 53 FSL_BULK_SIG 12148 4.29 7.56 2.97 54 TR_XM_UnparsRelay 12078 3.18 7.51 1.43 55 XMBody_17 11496 2.47 7.15 0.59 56 HTML_IMAGE_RATIO_02 11180 5.11 6.95 4.37 57 LotsOfNums_01 11102 7.37 6.91 7.56 58 UNTRUSTED_Relay 10637 2.89 6.62 1.38 59 XMSubMetaSx_00 10628 4.58 6.61 3.76 60 MPART_ALT_DIFF 10540 4.29 6.56 3.37 61 XM_B_Phish_Phrases 9788 3.74 6.09 2.79 62 TooManyTo_001 9480 7.21 5.90 7.74 63 T_FILL_THIS_FORM_SHORT 9179 2.27 5.71 0.88 64 XMSexyCombo_05 9095 2.73 5.66 1.54 65 XM_UncommonTLD01 8919 4.04 5.55 3.43 66 HTML_IMAGE_RATIO_04 8807 4.01 5.48 3.41 67 BAYES_95 8664 3.53 5.39 2.79 68 XM_H_Long_From01 8467 4.64 5.27 4.39 69 TR_XM_SpammyWords5 7606 2.16 4.73 1.13 70 HTML_IMAGE_RATIO_06 7438 2.82 4.63 2.09 71 XMNumbers 7283 2.90 4.53 2.24 72 XM_SPF_SoftFail 7154 3.33 4.45 2.88 73 MIME_HTML_MOSTLY 6921 2.77 4.30 2.14 74 XM_OfRef6 6847 2.01 4.26 1.11 75 TR_XM_PhishingBody 6831 2.27 4.25 1.48 76 DKIM_INVALID 6761 2.60 4.21 1.95 77 XM_H_GMP 6678 5.30 4.15 5.77 78 HK_RANDOM_REPLYTO 6497 1.23 4.04 0.09 79 XM_B_SpammyTLD 6453 3.33 4.01 3.05 80 XM_B_Investor 6312 2.16 3.93 1.45 81 TM2_M_URI_OPT_OUT 6037 2.39 3.75 1.83 82 MIME_HTML_ONLY_MULTI 5954 2.44 3.70 1.93 83 XMStrtUSub 5862 4.04 3.65 4.20 84 HTML_IMAGE_RATIO_08 5703 2.28 3.55 1.77 85 T_XMDrugObfuBody_08 5603 1.97 3.48 1.36 86 TR_XM_BayesRelay 5579 1.00 3.47 0.00 87 TR_XM_FormFill 5494 0.99 3.42 0.02 88 FONT_INVIS_LONG_LINE 5456 1.03 3.39 0.08 89 TM2_M_VERY_LONG_WORD 5349 1.80 3.33 1.19 90 T_XMDrugObfuBody_14 5284 2.01 3.29 1.49 91 XM_UB50 4976 1.46 3.09 0.80 92 TR_LOTS_OF_MONEY3 4759 1.13 2.96 0.39 93 MIME_QP_LONG_LINE 4531 4.04 2.82 4.53 94 XM_URI_RBL 4281 0.85 2.66 0.12 95 XM_CamelCaseFrm001 4227 1.96 2.63 1.69 96 USER_IN_DEF_DKIM_WL 4120 7.53 2.56 9.54 97 XM_B_Unsub2 4066 1.89 2.53 1.64 98 RCVD_IN_VALIDITY_SAFE 4025 3.19 2.50 3.47 99 ANY_BOUNCE_MESSAGE 3964 4.38 2.47 5.15 100 BOUNCE_MESSAGE 3958 4.38 2.46 5.15 101 T_TooManySym_01 3954 3.86 2.46 4.42 102 XMDiploma_00 3915 1.77 2.44 1.50 103 SpammyFromTLD_01 3458 1.17 2.15 0.78 104 FROM_EXCESS_BASE64 3438 1.55 2.14 1.31 105 T_XMHurry_00 3389 0.92 2.11 0.44 106 RELAYCOUNTRY_AU 3371 1.05 2.10 0.63 107 RCVD_IN_VALIDITY_CERTIFIED 3287 2.76 2.04 3.05 108 TR_XM_PHPForged 3251 0.89 2.02 0.44 109 URI_HEX 3141 1.30 1.95 1.03 110 XM_B_SpammyWords4 3130 0.97 1.95 0.57 111 TR_XM_PHPDW 3117 0.86 1.94 0.42 112 SUBJ_ALL_CAPS 3087 1.53 1.92 1.37 113 TR_XM_FormFill2 3075 0.86 1.91 0.43 114 XMStockSpam_06 3055 1.05 1.90 0.70 115 XM_H_PHPOS 3054 0.84 1.90 0.41 116 TR_XM_NoHeaderRelay 3047 0.61 1.90 0.10 117 HTML_MIME_NO_HTML_TAG 3005 1.79 1.87 1.76 118 MAILING_LIST_MULTI 2992 2.23 1.86 2.38 119 XM_DIRTYINTL 2954 0.63 1.84 0.15 120 XMBrknScrpt_02 2952 0.95 1.84 0.59 121 XM_DK_Undo_01 2899 1.66 1.80 1.60 122 BOTNET_NORDNS 2775 0.50 1.73 0.01 123 SpammyFromTLD_02 2763 0.72 1.72 0.32 124 XM_H_Long_From02 2669 1.12 1.66 0.90 125 BAYES_40 2624 3.47 1.63 4.21 126 T_REMOTE_IMAGE 2588 2.76 1.61 3.23 127 XM_SendGrid 2578 1.34 1.60 1.24 128 HTTPS_HTTP_MISMATCH 2565 1.02 1.60 0.79 129 TR_XM_INV_DKIM 2526 0.48 1.57 0.04 130 ALL_TRUSTED 2494 19.70 1.55 27.03 131 URI_NOVOWEL 2354 1.47 1.46 1.48 132 KHOP_HELO_FCRDNS 2306 1.10 1.43 0.96 133 TR_Mismatch_TLD_02 2273 0.47 1.41 0.08 134 XM_HighProb1 2263 0.41 1.41 0.00 135 XMSubMetaI_00 2262 0.74 1.41 0.47 136 XMPhish30 2224 0.75 1.38 0.50 137 XMReplyNow 2221 0.54 1.38 0.20 138 T_XMDrugObfuBody_00 2205 0.78 1.37 0.54 139 RCVD_IN_IADB_LISTED 2166 3.14 1.35 3.87 140 XMBdyGiftCard01 2131 0.71 1.33 0.47 141 HTML_TAG_BALANCE_BODY 2095 0.64 1.30 0.37 142 URI_TRY_3LD 2083 0.82 1.30 0.63 143 XMClaimOffer 2057 0.47 1.28 0.14 144 XM_B_COVIDMETA 2057 0.53 1.28 0.23 145 XMNoVowels 2005 0.76 1.25 0.56 146 XMHTML_After_End 1963 0.75 1.22 0.57 147 RCVD_IN_IADB_SPF 1937 2.77 1.20 3.41 148 XM_B_Phish66 1886 0.50 1.17 0.23 149 T_MONEY_PERCENT 1873 0.64 1.16 0.43 150 TR_LOTS_OF_MONEY2 1873 0.64 1.16 0.43 151 TR_XM_InvalidRelay 1857 0.35 1.15 0.03 152 TR_Symld_Words 1845 1.31 1.15 1.38 153 THIS_AD 1833 0.55 1.14 0.32 154 RCVD_IN_IADB_SENDERID 1829 2.53 1.14 3.10 155 RCVD_IN_IADB_DK 1828 2.47 1.14 3.02 156 XMSexyCombo_01 1821 0.49 1.13 0.24 157 XMGenDplmaNmb 1769 0.90 1.10 0.82 158 XMPhish14 1759 0.59 1.09 0.39 159 DKIM_ADSP_CUSTOM_MED 1756 0.89 1.09 0.81 160 XM_UB99 1755 0.32 1.09 0.01 161 RELAYCOUNTRY_FR 1751 0.45 1.09 0.19 162 XM_Combo_Sbj 1740 0.42 1.08 0.15 163 TM2_M_A_HREF_HREF 1708 0.45 1.06 0.21 164 MPART_ALT_DIFF_COUNT 1699 0.64 1.06 0.47 165 BAYES_20 1675 2.49 1.04 3.08 166 AC_BR_BONANZA 1665 0.34 1.04 0.06 167 TR_MetaPhish_Combo_01 1656 0.93 1.03 0.89 168 SCC_BODY_URI_ONLY 1646 1.85 1.02 2.19 169 XM_H_PHPMailer 1635 0.73 1.02 0.62 170 TR_XM_RelayPhish 1634 0.34 1.02 0.06 171 NML_ADSP_CUSTOM_MED 1623 0.69 1.01 0.57 172 XM_H_Undi_Recip 1603 0.38 1.00 0.14 173 TR_XM_Base64_L1 1567 0.35 0.97 0.10 174 TR_XM_Base64_M1 1565 0.66 0.97 0.53 175 DIET_1 1555 0.42 0.97 0.20 176 XM_UB60 1483 0.33 0.92 0.09 177 FORGED_GMAIL_RCVD 1482 0.60 0.92 0.47 178 PLING_QUERY 1472 0.55 0.92 0.40 179 XMBody_78 1468 0.45 0.91 0.26 180 XM_OfRef7 1467 0.41 0.91 0.21 181 FROM_SUSPICIOUS_NTLD 1451 0.28 0.90 0.02 182 RCVD_IN_VALIDITY_RPBL 1437 0.28 0.89 0.03 183 TR_XM_DK_SendGrid 1420 0.85 0.88 0.84 184 T_XMDrugObfuBody_10 1406 0.26 0.87 0.02 185 RDNS_DYNAMIC 1391 0.46 0.87 0.30 186 XM_ProductURIs 1387 0.74 0.86 0.69 187 HOSTED_IMG_MULTI_PUB_01 1349 0.25 0.84 0.01 188 XMMoneyMeta_00 1347 0.55 0.84 0.43 189 URIBL_DBL_SPAM 1347 0.24 0.84 0.00 190 TooManyTo_002 1341 1.89 0.83 2.31 191 XMSubMetaSxObfu_03 1331 0.47 0.83 0.33 192 XM_B_DNDMA 1310 0.39 0.81 0.22 193 XM_B_SEO 1288 0.33 0.80 0.14 194 TR_XM_Undi_Recip19 1278 0.27 0.79 0.06 195 T_Symld_Words_02 1241 0.49 0.77 0.38 196 XM_UB999 1236 0.22 0.77 0.00 197 TR_XM_SEO4 1227 0.28 0.76 0.08 198 SHOPIFY_IMG_NOT_RCVD_SFY 1226 0.43 0.76 0.29 199 HTML_FONT_SIZE_HUGE 1215 9.43 0.76 12.93 200 BAYES_00 1205 6.21 0.75 8.42 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 344485 89.46 96.74 86.52 2 T_SCC_BODY_TEXT_LINE 331980 82.74 81.16 83.38 3 DCC_CHECK_NEGATIVE 284214 58.79 27.61 71.39 4 RELAYCOUNTRY_US 278675 71.99 76.93 69.99 5 DKIM_SIGNED 257008 71.87 89.99 64.55 6 XM_DK_Pass 252673 70.22 86.97 63.46 7 DKIM_VALID 249257 69.27 85.79 62.61 8 XM_B_Unicode 236733 67.04 85.80 59.46 9 BAYES_50 227174 51.95 39.29 57.06 10 DKIM_VALID_AU 199817 53.98 63.36 50.19 11 XMListUnsubscribeExists 169877 51.22 72.39 42.67 12 XM_B_SpammyWords 147347 47.55 73.65 37.01 13 XM_B_Unicode3 135941 38.04 47.68 34.14 14 DCC_CHECK 113774 41.18 72.38 28.58 15 MIME_HTML_ONLY 112889 29.58 32.61 28.35 16 ALL_TRUSTED 107609 19.70 1.55 27.03 17 DKIM_VALID_EF 103461 28.20 33.69 25.99 18 T_TM2_M_HEADER_IN_MSG 100703 24.52 22.61 25.29 19 XM_Multi_Part_URI 100047 23.48 19.41 25.13 20 HTML_FONT_LOW_CONTRAST 94852 27.28 35.83 23.82 21 RCVD_IN_MSPIKE_H2 92169 24.05 26.28 23.15 22 FVGT_m_MULTI_ODD 86168 24.92 33.04 21.64 23 LOC_TINY_FONT_1 83187 26.19 39.29 20.89 24 XMSubLong 78355 20.56 22.75 19.68 25 T_KAM_HTML_FONT_INVALID 71616 21.32 29.56 17.99 26 XM_B_SpammyWords2 60594 23.23 43.05 15.22 27 BAYES_60 51879 11.61 8.10 13.03 28 HTML_FONT_SIZE_HUGE 51471 9.43 0.76 12.93 29 TR_XM_DK_Unsub 48981 15.89 24.79 12.30 30 USER_IN_DEF_DKIM_WL 37982 7.53 2.56 9.54 31 UNPARSEABLE_RELAY 35881 10.41 13.86 9.01 32 BAYES_00 33531 6.21 0.75 8.42 33 TooManyTo_001 30834 7.21 5.90 7.74 34 XM_B_Unsub 30414 10.01 15.90 7.64 35 LotsOfNums_01 30086 7.37 6.91 7.56 36 TR_MAX_INTL_RELAY 28558 9.38 14.86 7.17 37 XM_DKIMWhitelistDomains 27487 4.92 0.01 6.90 38 XM_Evil_Numbers_Gen 26247 7.38 9.35 6.59 39 TR_XM_DK_Bayes 23952 4.45 0.56 6.02 40 TR_XM_BayesUnsub 23792 8.68 15.39 5.98 41 TR_XM_DK_Bayes1 23683 4.39 0.54 5.95 42 LOTS_OF_MONEY 23033 8.22 14.25 5.79 43 XM_H_GMP 22954 5.30 4.15 5.77 44 IN_ZIMBRA_NJ_WHITELIST 22501 4.05 0.08 5.65 45 RCVD_IN_MSPIKE_WL 21716 6.90 10.49 5.45 46 RCVD_IN_MSPIKE_H3 21716 6.90 10.49 5.45 47 TR_XM_DK_Bayes2 20767 3.85 0.48 5.22 48 ANY_BOUNCE_MESSAGE 20507 4.38 2.47 5.15 49 BOUNCE_MESSAGE 20505 4.38 2.46 5.15 50 XM_DK_Undo_02 19316 16.36 44.85 4.85 51 BAYES_99 18517 13.14 34.17 4.65 52 MIME_QP_LONG_LINE 18037 4.04 2.82 4.53 53 T_TooManySym_01 17603 3.86 2.46 4.42 54 XM_H_Long_From01 17464 4.64 5.27 4.39 55 BAYES_80 17447 5.73 9.08 4.38 56 HTML_IMAGE_RATIO_02 17380 5.11 6.95 4.37 57 BAYES_40 16763 3.47 1.63 4.21 58 XMStrtUSub 16717 4.04 3.65 4.20 59 TR_XM_SpammyWords4 15986 6.56 12.85 4.02 60 XM_PDF 15395 2.96 0.72 3.87 61 RCVD_IN_IADB_LISTED 15394 3.14 1.35 3.87 62 BOTNET_IPINHOSTNAME 15290 6.56 13.31 3.84 63 XMSubMetaSx_00 14959 4.58 6.61 3.76 64 RELAYCOUNTRY_META 14767 8.99 22.07 3.71 65 XM_B_SpammyWords3 14454 6.61 13.98 3.63 66 XM_Body_Dirty_Words 14009 5.23 9.48 3.52 67 BAYES_999 13884 10.08 26.42 3.49 68 RCVD_IN_VALIDITY_SAFE 13799 3.19 2.50 3.47 69 XM_UncommonTLD01 13641 4.04 5.55 3.43 70 HTML_IMAGE_RATIO_04 13591 4.01 5.48 3.41 71 RCVD_IN_IADB_SPF 13567 2.77 1.20 3.41 72 MPART_ALT_DIFF 13430 4.29 6.56 3.37 73 T_REMOTE_IMAGE 12863 2.76 1.61 3.23 74 RCVD_IN_IADB_SENDERID 12339 2.53 1.14 3.10 75 BAYES_20 12263 2.49 1.04 3.08 76 XM_B_SpammyTLD 12153 3.33 4.01 3.05 77 RCVD_IN_VALIDITY_CERTIFIED 12137 2.76 2.04 3.05 78 RCVD_IN_IADB_DK 12005 2.47 1.14 3.02 79 FSL_BULK_SIG 11829 4.29 7.56 2.97 80 XM_SPF_SoftFail 11450 3.33 4.45 2.88 81 XM_B_Phish_Phrases 11114 3.74 6.09 2.79 82 BAYES_95 11092 3.53 5.39 2.79 83 MAILING_LIST_MULTI 9485 2.23 1.86 2.38 84 BAYES_05 9470 1.85 0.56 2.38 85 RCVD_IN_IADB_VOUCHED 9369 1.85 0.62 2.35 86 TooManyTo_002 9210 1.89 0.83 2.31 87 XMNumbers 8903 2.90 4.53 2.24 88 T_TooManySym_02 8860 1.79 0.72 2.23 89 SCC_BODY_URI_ONLY 8716 1.85 1.02 2.19 90 MIME_HTML_MOSTLY 8534 2.77 4.30 2.14 91 HTML_IMAGE_RATIO_06 8310 2.82 4.63 2.09 92 TR_XM_SpammyRelay 7955 6.49 17.62 2.00 93 DKIM_INVALID 7751 2.60 4.21 1.95 94 MIME_HTML_ONLY_MULTI 7675 2.44 3.70 1.93 95 TR_XM_DKIM_Undo 7349 11.35 34.87 1.85 96 TM2_M_URI_OPT_OUT 7305 2.39 3.75 1.83 97 INVALID_MSGID 7118 1.31 0.14 1.79 98 HTML_IMAGE_RATIO_08 7060 2.28 3.55 1.77 99 HTML_MIME_NO_HTML_TAG 7010 1.79 1.87 1.76 100 XM_CamelCaseFrm001 6723 1.96 2.63 1.69 101 XM_B_Unsub2 6525 1.89 2.53 1.64 102 RCVD_IN_IADB_OPTIN 6488 1.27 0.39 1.63 103 HELO_NODOT 6399 1.33 0.66 1.61 104 HELO_NO_DOMAIN 6394 1.33 0.66 1.61 105 XM_DK_Undo_01 6371 1.66 1.80 1.60 106 TO_MALFORMED 6306 1.13 0.01 1.58 107 XMSexyCombo_05 6150 2.73 5.66 1.54 108 XMDiploma_00 5977 1.77 2.44 1.50 109 T_XMDrugObfuBody_14 5937 2.01 3.29 1.49 110 URI_NOVOWEL 5879 1.47 1.46 1.48 111 TR_XM_PhishingBody 5874 2.27 4.25 1.48 112 XM_B_Investor 5775 2.16 3.93 1.45 113 TR_XM_UnparsRelay 5700 3.18 7.51 1.43 114 UNTRUSTED_Relay 5499 2.89 6.62 1.38 115 TR_Symld_Words 5485 1.31 1.15 1.38 116 SUBJ_ALL_CAPS 5460 1.53 1.92 1.37 117 T_XMDrugObfuBody_08 5396 1.97 3.48 1.36 118 FROM_EXCESS_BASE64 5234 1.55 2.14 1.31 119 XMGappySubj_01 5120 0.99 0.27 1.29 120 IN_HORDE_ADDRESS_BOOK 5027 0.92 0.08 1.26 121 TooManyTo_003 5006 1.10 0.72 1.26 122 XM_SendGrid 4922 1.34 1.60 1.24 123 TVD_RCVD_IP 4835 1.06 0.68 1.21 124 TM2_M_VERY_LONG_WORD 4739 1.80 3.33 1.19 125 BOTNET 4579 3.49 9.29 1.15 126 TR_DCC_Bayes_99 4510 7.78 24.24 1.13 127 TR_XM_SpammyWords5 4483 2.16 4.73 1.13 128 XMBody_95 4482 0.89 0.29 1.13 129 XM_OfRef6 4408 2.01 4.26 1.11 130 XM_GoogleGroups 4361 0.92 0.48 1.10 131 RELAYCOUNTRY_CA 4226 4.41 12.69 1.06 132 XMBSHREFv2 4179 0.86 0.38 1.05 133 URI_HEX 4120 1.30 1.95 1.03 134 XMCapTrack 3827 0.78 0.33 0.96 135 KHOP_HELO_FCRDNS 3815 1.10 1.43 0.96 136 TVD_SPACE_RATIO 3791 0.72 0.13 0.95 137 TooManyTo_004 3757 0.86 0.66 0.94 138 XM_H_Long_From02 3596 1.12 1.66 0.90 139 TR_MetaPhish_Combo_01 3553 0.93 1.03 0.89 140 T_FILL_THIS_FORM_SHORT 3501 2.27 5.71 0.88 141 TR_XM_DK_SendGrid 3354 0.85 0.88 0.84 142 XMGenDplmaNmb 3273 0.90 1.10 0.82 143 DKIM_ADSP_CUSTOM_MED 3207 0.89 1.09 0.81 144 T_TooManySym_03 3194 0.65 0.27 0.80 145 XM_UB50 3192 1.46 3.09 0.80 146 HTTPS_HTTP_MISMATCH 3139 1.02 1.60 0.79 147 SpammyFromTLD_01 3087 1.17 2.15 0.78 148 TooManyTo_005 3057 0.73 0.62 0.77 149 XMGappySubj_02 2915 0.54 0.07 0.73 150 XM_ShortIntro_01 2887 0.63 0.39 0.73 151 XM_H_Trusted_IP 2879 0.52 0.00 0.72 152 TR_Mismatch_TLD_01 2828 0.68 0.59 0.71 153 XMStockSpam_06 2789 1.05 1.90 0.70 154 XM_ProductURIs 2741 0.74 0.86 0.69 155 RCVD_IN_RP_SAFE 2705 0.63 0.52 0.68 156 URI_TRY_3LD 2508 0.82 1.30 0.63 157 RELAYCOUNTRY_AU 2493 1.05 2.10 0.63 158 XM_H_PHPMailer 2453 0.73 1.02 0.62 159 XMSubNoVowel 2392 0.57 0.49 0.60 160 RCVD_IN_RP_CERTIFIED 2388 0.55 0.42 0.60 161 FROM_GOV_DKIM_AU 2377 0.47 0.17 0.60 162 XMBrknScrpt_02 2334 0.95 1.84 0.59 163 XMBody_17 2333 2.47 7.15 0.59 164 MSGID_NOFQDN1 2321 0.42 0.01 0.58 165 XM_B_SpammyWords4 2272 0.97 1.95 0.57 166 XMHTML_After_End 2253 0.75 1.22 0.57 167 NML_ADSP_CUSTOM_MED 2252 0.69 1.01 0.57 168 FILL_THIS_FORM 2246 0.48 0.29 0.56 169 XMNoVowels 2238 0.76 1.25 0.56 170 T_XMDrugObfuBody_00 2157 0.78 1.37 0.54 171 TR_XM_Base64_M1 2115 0.66 0.97 0.53 172 XM_B_FormFill 2111 0.39 0.04 0.53 173 SHORT_HELO_AND_INLINE_IMAGE 2099 0.39 0.04 0.53 174 XM_B_COPY_HTML 2095 0.58 0.71 0.53 175 TO_NO_BRKTS_HTML_ONLY 2012 0.46 0.33 0.51 176 RCVD_IN_BL_SPAMCOP_NET 2003 4.30 13.70 0.50 177 T_OBFU_PDF_ATTACH 2000 0.38 0.09 0.50 178 HTML_IMAGE_ONLY_12 1997 0.39 0.11 0.50 179 XMPhish30 1972 0.75 1.38 0.50 180 XMSubMetaI_00 1880 0.74 1.41 0.47 181 MPART_ALT_DIFF_COUNT 1867 0.64 1.06 0.47 182 XMBdyGiftCard01 1860 0.71 1.33 0.47 183 FORGED_GMAIL_RCVD 1855 0.60 0.92 0.47 184 RELAYCOUNTRY_GB 1849 0.50 0.59 0.46 185 USER_IN_WELCOMELIST 1812 0.32 0.00 0.46 186 USER_IN_WHITELIST 1812 0.32 0.00 0.46 187 T_XMHurry_00 1752 0.92 2.11 0.44 188 TR_XM_PHPForged 1743 0.89 2.02 0.44 189 T_MONEY_PERCENT 1731 0.64 1.16 0.43 190 TR_LOTS_OF_MONEY2 1731 0.64 1.16 0.43 191 XMMoneyMeta_00 1718 0.55 0.84 0.43 192 TR_XM_FormFill2 1705 0.86 1.91 0.43 193 TR_XM_PHPDW 1678 0.86 1.94 0.42 194 XM_H_PHPOS 1644 0.84 1.90 0.41 195 FROM_GOV_SPOOF 1643 0.31 0.05 0.41 196 PLING_QUERY 1590 0.55 0.92 0.40 197 TR_LOTS_OF_MONEY3 1556 1.13 2.96 0.39 198 XMPhish14 1556 0.59 1.09 0.39 199 TM2_M_BODY_EMPTY 1526 0.33 0.20 0.38 200 T_Symld_Words_02 1505 0.49 0.77 0.38 ----------------------------------------------------------------------