Email: 480219 Autolearn: 0 AvgScore: 3.64 AvgScanTime: 1.06 sec Spam: 143381 Autolearn: 0 AvgScore: 13.38 AvgScanTime: 1.17 sec Ham: 336838 Autolearn: 0 AvgScore: -0.51 AvgScanTime: 1.02 sec Time Spent Running SA: 142.06 hours Time Spent Processing Spam: 46.80 hours Time Spent Processing Ham: 95.26 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136277 87.84 95.05 84.77 2 DKIM_SIGNED 130634 78.25 91.11 72.77 3 XM_DK_Pass 125152 76.06 87.29 71.29 4 DKIM_VALID 123238 74.87 85.95 70.15 5 XM_B_Unicode 119161 71.77 83.11 66.95 6 T_SCC_BODY_TEXT_LINE 114461 82.17 79.83 83.17 7 RELAYCOUNTRY_US 111781 78.83 77.96 79.19 8 XMListUnsubscribeExists 104171 54.45 72.65 46.70 9 XM_B_SpammyWords 103380 51.43 72.10 42.63 10 DCC_CHECK 100275 42.11 69.94 30.26 11 DKIM_VALID_AU 94200 59.17 65.70 56.39 12 XM_B_Unicode3 66420 40.42 46.32 37.91 13 XM_DK_Undo_02 61939 16.73 43.20 5.47 14 XM_B_SpammyWords2 58642 23.77 40.90 16.47 15 LOC_TINY_FONT_1 56351 28.09 39.30 23.32 16 BAYES_50 54922 51.97 38.30 57.79 17 HTML_FONT_LOW_CONTRAST 50046 29.10 34.90 26.62 18 BAYES_99 48406 13.44 33.76 4.79 19 TR_XM_DKIM_Undo 47905 11.40 33.41 2.03 20 DKIM_VALID_EF 45150 30.27 31.49 29.75 21 MIME_HTML_ONLY 45147 23.27 31.49 19.77 22 FVGT_m_MULTI_ODD 43641 27.01 30.44 25.55 23 DCC_CHECK_NEGATIVE 43086 57.86 30.05 69.69 24 T_KAM_HTML_FONT_INVALID 40894 22.62 28.52 20.11 25 BAYES_999 37835 10.52 26.39 3.76 26 RCVD_IN_MSPIKE_H2 37071 26.10 25.85 26.21 27 T_TM2_M_HEADER_IN_MSG 33987 28.42 23.70 30.42 28 TR_DCC_Bayes_99 33198 7.80 23.15 1.27 29 XMSubLong 33063 22.07 23.06 21.64 30 TR_XM_DK_Unsub 32530 16.30 22.69 13.58 31 RELAYCOUNTRY_META 30376 9.23 21.19 4.13 32 XM_Multi_Part_URI 26576 14.87 18.54 13.31 33 TR_XM_SpammyRelay 23644 6.47 16.49 2.21 34 XM_B_Unsub 22101 9.83 15.41 7.45 35 TR_MAX_INTL_RELAY 21664 9.24 15.11 6.75 36 XM_B_SpammyWords3 21319 7.05 14.87 3.73 37 TR_XM_BayesUnsub 20924 8.41 14.59 5.78 38 LOTS_OF_MONEY 20517 8.71 14.31 6.33 39 BOTNET_IPINHOSTNAME 19530 6.90 13.62 4.04 40 TR_XM_SpammyWords2 18601 4.12 12.97 0.35 41 TR_XM_SpammyWords4 17978 6.76 12.54 4.29 42 UNPARSEABLE_RELAY 17896 10.83 12.48 10.13 43 RELAYCOUNTRY_CA 16414 4.28 11.45 1.22 44 RCVD_IN_BL_SPAMCOP_NET 16152 3.73 11.27 0.52 45 BOTNET 13670 3.66 9.53 1.17 46 TR_XM_SPAMCOP 12968 2.87 9.04 0.24 47 BAYES_80 12967 5.53 9.04 4.03 48 XM_UncommonTLD01 12807 5.50 8.93 4.04 49 XM_Body_Dirty_Words 12749 5.19 8.89 3.62 50 RCVD_IN_MSPIKE_H3 12431 6.86 8.67 6.08 51 RCVD_IN_MSPIKE_WL 12431 6.86 8.67 6.09 52 XM_Evil_Numbers_Gen 12250 7.65 8.54 7.28 53 FSL_BULK_SIG 10927 4.32 7.62 2.91 54 BAYES_60 10890 8.43 7.60 8.79 55 MPART_ALT_DIFF 10312 4.79 7.19 3.77 56 TR_XM_UnparsRelay 9969 3.09 6.95 1.45 57 XMBody_17 9902 2.52 6.91 0.65 58 UNTRUSTED_Relay 9725 3.17 6.78 1.64 59 LotsOfNums_01 9209 7.56 6.42 8.04 60 HTML_IMAGE_RATIO_02 8759 5.43 6.11 5.13 61 XMSubMetaSx_00 8242 4.14 5.75 3.45 62 XM_SPF_SoftFail 8232 4.23 5.74 3.59 63 XMNumbers 7854 3.46 5.48 2.61 64 TooManyTo_001 7698 8.14 5.37 9.32 65 BAYES_95 7669 3.50 5.35 2.71 66 XM_H_Long_From01 7632 5.07 5.32 4.96 67 T_FILL_THIS_FORM_SHORT 7577 2.33 5.28 1.07 68 DKIM_INVALID 7396 3.38 5.16 2.62 69 XM_H_GMP 7319 6.41 5.10 6.96 70 XM_B_Phish_Phrases 7237 3.97 5.05 3.51 71 HTML_IMAGE_RATIO_04 7221 4.45 5.04 4.20 72 XM_B_Investor 7177 2.66 5.01 1.66 73 MIME_HTML_MOSTLY 6896 3.17 4.81 2.48 74 XMSexyCombo_05 6560 2.42 4.58 1.50 75 HTML_IMAGE_RATIO_06 6406 2.83 4.47 2.14 76 XM_OfRef6 6364 2.23 4.44 1.28 77 TR_XM_PhishingBody 6281 2.35 4.38 1.48 78 SpammyFromTLD_01 6199 1.96 4.32 0.95 79 T_XMDrugObfuBody_14 6157 2.76 4.29 2.11 80 TR_XM_SpammyWords5 6099 2.09 4.25 1.18 81 MIME_HTML_ONLY_MULTI 6049 2.70 4.22 2.06 82 XM_B_SpammyTLD 5812 2.88 4.05 2.38 83 XMStrtUSub 5145 4.15 3.59 4.39 84 TM2_M_URI_OPT_OUT 5015 2.33 3.50 1.83 85 TR_XM_FormFill 4864 1.05 3.39 0.05 86 HTML_IMAGE_RATIO_08 4849 2.25 3.38 1.76 87 TR_XM_PHPForged 4808 1.38 3.35 0.55 88 T_XMDrugObfuBody_08 4768 2.04 3.33 1.49 89 TR_XM_PHPDW 4726 1.37 3.30 0.56 90 TR_XM_FormFill2 4610 1.35 3.22 0.55 91 XM_H_PHPOS 4596 1.33 3.21 0.53 92 XM_URI_RBL 4500 1.03 3.14 0.14 93 MIME_QP_LONG_LINE 4481 4.29 3.13 4.79 94 XMDiploma_00 4396 2.23 3.07 1.87 95 TR_XM_BayesRelay 4212 0.88 2.94 0.00 96 XM_UB50 4176 1.59 2.91 1.03 97 TM2_M_VERY_LONG_WORD 3891 1.76 2.71 1.35 98 SUBJ_ALL_CAPS 3735 1.79 2.60 1.45 99 RCVD_IN_VALIDITY_SAFE 3639 3.71 2.54 4.21 100 FONT_INVIS_LONG_LINE 3623 0.77 2.53 0.03 101 XM_CamelCaseFrm001 3578 2.33 2.50 2.25 102 T_TooManySym_01 3503 4.40 2.44 5.24 103 BAYES_40 3448 4.21 2.40 4.98 104 FROM_EXCESS_BASE64 3436 1.78 2.40 1.52 105 TR_LOTS_OF_MONEY3 3378 0.96 2.36 0.36 106 HTTPS_HTTP_MISMATCH 3326 1.37 2.32 0.97 107 XM_B_SpammyWords4 3277 0.99 2.29 0.44 108 SCC_BODY_URI_ONLY 3170 2.67 2.21 2.87 109 XM_B_Unsub2 3169 1.59 2.21 1.32 110 RELAYCOUNTRY_AU 3076 1.13 2.15 0.70 111 TR_XM_NoHeaderRelay 2999 0.70 2.09 0.11 112 RCVD_IN_VALIDITY_CERTIFIED 2976 3.19 2.08 3.67 113 USER_IN_DEF_DKIM_WL 2950 8.12 2.06 10.70 114 MAILING_LIST_MULTI 2911 2.41 2.03 2.57 115 URI_HEX 2817 1.35 1.96 1.08 116 TR_XM_INV_DKIM 2795 0.62 1.95 0.05 117 BAYES_20 2788 3.23 1.94 3.78 118 TM2_M_BODY_EMPTY 2728 0.93 1.90 0.51 119 T_XMHurry_00 2705 0.87 1.89 0.44 120 ANY_BOUNCE_MESSAGE 2659 3.96 1.85 4.85 121 BOUNCE_MESSAGE 2658 3.96 1.85 4.85 122 XMEmptyBody_01 2648 0.61 1.85 0.08 123 XM_B_DNDMA 2598 0.84 1.81 0.43 124 XM_DK_Undo_01 2554 1.89 1.78 1.93 125 URI_NOVOWEL 2510 1.63 1.75 1.57 126 XM_HighProb1 2472 0.52 1.72 0.00 127 XMStockSpam_06 2469 1.39 1.72 1.26 128 SpammyFromTLD_02 2398 0.69 1.67 0.28 129 XMHTML_After_End 2382 0.89 1.66 0.56 130 T_REMOTE_IMAGE 2331 3.20 1.63 3.87 131 TR_Mismatch_TLD_02 2308 0.53 1.61 0.06 132 XM_DIRTYINTL 2276 0.59 1.59 0.17 133 HTML_MIME_NO_HTML_TAG 2197 1.98 1.53 2.17 134 XMBrknScrpt_02 2190 0.80 1.53 0.49 135 XM_UB99 2180 0.46 1.52 0.00 136 XM_SendGrid 2102 1.42 1.47 1.40 137 ALL_TRUSTED 2085 12.73 1.45 17.54 138 KHOP_HELO_FCRDNS 2082 1.41 1.45 1.40 139 XMPhish14 2057 0.77 1.43 0.49 140 XMReplyNow 2039 0.63 1.42 0.30 141 XM_H_Undi_Recip 2023 0.55 1.41 0.19 142 HTML_TAG_BALANCE_BODY 1984 0.68 1.38 0.39 143 DKIM_ADSP_CUSTOM_MED 1978 1.14 1.38 1.04 144 T_XMDrugObfuBody_00 1962 0.79 1.37 0.54 145 LongTLD 1927 0.64 1.34 0.34 146 TR_Symld_Words 1917 1.50 1.34 1.57 147 XMLngstWrd_00 1913 1.17 1.33 1.10 148 BOTNET_NORDNS 1890 0.40 1.32 0.01 149 AC_BR_BONANZA 1854 0.45 1.29 0.09 150 RCVD_IN_IADB_LISTED 1797 3.03 1.25 3.79 151 XMGenDplmaNmb 1776 1.10 1.24 1.05 152 RDNS_DYNAMIC 1760 0.64 1.23 0.39 153 XMPhish30 1751 0.64 1.22 0.40 154 DIET_1 1746 0.56 1.22 0.28 155 RCVD_IN_PSBL 1731 0.68 1.21 0.46 156 URI_TRY_3LD 1724 0.96 1.20 0.85 157 TR_MetaPhish_Combo_01 1702 0.82 1.19 0.67 158 TR_XM_InvalidRelay 1668 0.37 1.16 0.03 159 HK_RANDOM_REPLYTO 1668 0.42 1.16 0.10 160 XMBdyGiftCard01 1657 0.80 1.16 0.65 161 XMSubMetaI_00 1654 0.80 1.15 0.66 162 THIS_AD 1623 0.57 1.13 0.33 163 XM_B_COPY_HTML 1606 0.75 1.12 0.60 164 XM_UB999 1586 0.33 1.11 0.00 165 NML_ADSP_CUSTOM_MED 1576 0.83 1.10 0.72 166 RCVD_IN_IADB_SPF 1567 2.70 1.09 3.38 167 RELAYCOUNTRY_IN 1547 0.37 1.08 0.07 168 FORGED_GMAIL_RCVD 1546 0.73 1.08 0.58 169 XMSexyCombo_01 1532 0.46 1.07 0.21 170 TR_XM_Base64_M1 1519 0.71 1.06 0.56 171 RCVD_IN_IADB_DK 1482 2.38 1.03 2.95 172 RCVD_IN_IADB_SENDERID 1469 2.45 1.02 3.06 173 TR_XM_Undi_Recip19 1412 0.36 0.98 0.09 174 XM_H_Long_From02 1404 1.13 0.98 1.19 175 MPART_ALT_DIFF_COUNT 1385 0.70 0.97 0.59 176 TR_Caps_n_Bayes_99 1384 0.30 0.97 0.01 177 XM_B_Phish66 1375 0.49 0.96 0.29 178 TM2_M_A_HREF_HREF 1363 0.46 0.95 0.25 179 TVD_RCVD_IP 1355 1.35 0.95 1.53 180 TR_XM_DK_SendGrid 1352 0.94 0.94 0.94 181 RELAYCOUNTRY_FR 1349 0.45 0.94 0.24 182 URIBL_DBL_SPAM 1338 0.28 0.93 0.01 183 BAYES_05 1336 2.46 0.93 3.11 184 PDS_OTHER_BAD_TLD 1318 0.40 0.92 0.18 185 RCVD_IN_VALIDITY_RPBL 1286 0.30 0.90 0.04 186 SUBJ_DOLLARS 1278 0.40 0.89 0.19 187 HELO_DYNAMIC_SPLIT_IP 1271 0.27 0.89 0.01 188 TR_LOTS_OF_MONEY2 1265 0.45 0.88 0.26 189 T_MONEY_PERCENT 1265 0.45 0.88 0.26 190 XM_ProductURIs 1264 1.09 0.88 1.18 191 TR_Mismatch_TLD_01 1257 0.80 0.88 0.77 192 TR_XM_Spammywords 1249 0.39 0.87 0.18 193 XM_S_SpammyWords 1249 0.39 0.87 0.18 194 XM_B_COVIDMETA 1216 0.44 0.85 0.26 195 TR_XM_Undi_RecipCombo2 1189 0.26 0.83 0.01 196 TR_XM_Base64_L1 1183 0.32 0.83 0.10 197 TooManyTo_002 1153 2.33 0.80 2.98 198 T_TooManySym_02 1122 2.10 0.78 2.66 199 RELAYCOUNTRY_DE 1121 0.47 0.78 0.34 200 XM_UB80 1120 0.25 0.78 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 285527 87.84 95.05 84.77 2 T_SCC_BODY_TEXT_LINE 280144 82.17 79.83 83.17 3 RELAYCOUNTRY_US 266757 78.83 77.96 79.19 4 DKIM_SIGNED 245130 78.25 91.11 72.77 5 XM_DK_Pass 240123 76.06 87.29 71.29 6 DKIM_VALID 236304 74.87 85.95 70.15 7 DCC_CHECK_NEGATIVE 234748 57.86 30.05 69.69 8 XM_B_Unicode 225508 71.77 83.11 66.95 9 BAYES_50 194651 51.97 38.30 57.79 10 DKIM_VALID_AU 189956 59.17 65.70 56.39 11 XMListUnsubscribeExists 157299 54.45 72.65 46.70 12 XM_B_SpammyWords 143593 51.43 72.10 42.63 13 XM_B_Unicode3 127706 40.42 46.32 37.91 14 T_TM2_M_HEADER_IN_MSG 102482 28.42 23.70 30.42 15 DCC_CHECK 101927 42.11 69.94 30.26 16 DKIM_VALID_EF 100193 30.27 31.49 29.75 17 HTML_FONT_LOW_CONTRAST 89675 29.10 34.90 26.62 18 RCVD_IN_MSPIKE_H2 88277 26.10 25.85 26.21 19 FVGT_m_MULTI_ODD 86071 27.01 30.44 25.55 20 LOC_TINY_FONT_1 78550 28.09 39.30 23.32 21 XMSubLong 72906 22.07 23.06 21.64 22 T_KAM_HTML_FONT_INVALID 67745 22.62 28.52 20.11 23 MIME_HTML_ONLY 66607 23.27 31.49 19.77 24 ALL_TRUSTED 59069 12.73 1.45 17.54 25 XM_B_SpammyWords2 55489 23.77 40.90 16.47 26 TR_XM_DK_Unsub 45733 16.30 22.69 13.58 27 XM_Multi_Part_URI 44841 14.87 18.54 13.31 28 USER_IN_DEF_DKIM_WL 36044 8.12 2.06 10.70 29 UNPARSEABLE_RELAY 34127 10.83 12.48 10.13 30 BAYES_00 33741 7.22 0.66 10.02 31 TooManyTo_001 31393 8.14 5.37 9.32 32 BAYES_60 29598 8.43 7.60 8.79 33 LotsOfNums_01 27091 7.56 6.42 8.04 34 XM_DKIMWhitelistDomains 25997 5.42 0.01 7.72 35 XM_B_Unsub 25094 9.83 15.41 7.45 36 XM_Evil_Numbers_Gen 24508 7.65 8.54 7.28 37 XM_H_GMP 23441 6.41 5.10 6.96 38 TR_MAX_INTL_RELAY 22721 9.24 15.11 6.75 39 TR_XM_DK_Bayes 22614 4.84 0.44 6.71 40 IN_ZIMBRA_NJ_WHITELIST 22145 4.64 0.09 6.57 41 TR_XM_DK_Bayes1 22048 4.71 0.41 6.55 42 LOTS_OF_MONEY 21321 8.71 14.31 6.33 43 RCVD_IN_MSPIKE_WL 20497 6.86 8.67 6.09 44 RCVD_IN_MSPIKE_H3 20496 6.86 8.67 6.08 45 TR_XM_BayesUnsub 19463 8.41 14.59 5.78 46 TR_XM_DK_Bayes2 18756 4.01 0.36 5.57 47 XM_DK_Undo_02 18409 16.73 43.20 5.47 48 T_TooManySym_01 17646 4.40 2.44 5.24 49 HTML_IMAGE_RATIO_02 17293 5.43 6.11 5.13 50 BAYES_40 16789 4.21 2.40 4.98 51 XM_H_Long_From01 16693 5.07 5.32 4.96 52 ANY_BOUNCE_MESSAGE 16353 3.96 1.85 4.85 53 BOUNCE_MESSAGE 16352 3.96 1.85 4.85 54 BAYES_99 16147 13.44 33.76 4.79 55 MIME_QP_LONG_LINE 16121 4.29 3.13 4.79 56 XM_PDF 15727 3.46 0.63 4.67 57 XMStrtUSub 14804 4.15 3.59 4.39 58 TR_XM_SpammyWords4 14466 6.76 12.54 4.29 59 RCVD_IN_VALIDITY_SAFE 14194 3.71 2.54 4.21 60 HTML_IMAGE_RATIO_04 14132 4.45 5.04 4.20 61 RELAYCOUNTRY_META 13926 9.23 21.19 4.13 62 BOTNET_IPINHOSTNAME 13610 6.90 13.62 4.04 63 XM_UncommonTLD01 13608 5.50 8.93 4.04 64 BAYES_80 13572 5.53 9.04 4.03 65 T_REMOTE_IMAGE 13028 3.20 1.63 3.87 66 RCVD_IN_IADB_LISTED 12767 3.03 1.25 3.79 67 BAYES_20 12718 3.23 1.94 3.78 68 MPART_ALT_DIFF 12698 4.79 7.19 3.77 69 BAYES_999 12671 10.52 26.39 3.76 70 XM_B_SpammyWords3 12555 7.05 14.87 3.73 71 RCVD_IN_VALIDITY_CERTIFIED 12357 3.19 2.08 3.67 72 XM_Body_Dirty_Words 12178 5.19 8.89 3.62 73 XM_SPF_SoftFail 12087 4.23 5.74 3.59 74 XM_B_Phish_Phrases 11814 3.97 5.05 3.51 75 XMSubMetaSx_00 11635 4.14 5.75 3.45 76 RCVD_IN_IADB_SPF 11392 2.70 1.09 3.38 77 BAYES_05 10479 2.46 0.93 3.11 78 RCVD_IN_IADB_SENDERID 10294 2.45 1.02 3.06 79 TooManyTo_002 10026 2.33 0.80 2.98 80 RCVD_IN_IADB_DK 9948 2.38 1.03 2.95 81 FSL_BULK_SIG 9800 4.32 7.62 2.91 82 SCC_BODY_URI_ONLY 9659 2.67 2.21 2.87 83 BAYES_95 9142 3.50 5.35 2.71 84 T_TooManySym_02 8966 2.10 0.78 2.66 85 DKIM_INVALID 8826 3.38 5.16 2.62 86 XMNumbers 8783 3.46 5.48 2.61 87 MAILING_LIST_MULTI 8672 2.41 2.03 2.57 88 MIME_HTML_MOSTLY 8342 3.17 4.81 2.48 89 XM_B_SpammyTLD 8012 2.88 4.05 2.38 90 RCVD_IN_IADB_VOUCHED 7657 1.77 0.60 2.27 91 XM_CamelCaseFrm001 7590 2.33 2.50 2.25 92 TR_XM_SpammyRelay 7445 6.47 16.49 2.21 93 INVALID_MSGID 7377 1.60 0.22 2.19 94 HTML_MIME_NO_HTML_TAG 7315 1.98 1.53 2.17 95 HTML_IMAGE_RATIO_06 7192 2.83 4.47 2.14 96 T_XMDrugObfuBody_14 7116 2.76 4.29 2.11 97 HELO_NODOT 7090 1.57 0.32 2.10 98 HELO_NO_DOMAIN 7082 1.57 0.32 2.10 99 MIME_HTML_ONLY_MULTI 6928 2.70 4.22 2.06 100 TR_XM_DKIM_Undo 6836 11.40 33.41 2.03 101 XM_DK_Undo_01 6507 1.89 1.78 1.93 102 TO_MALFORMED 6326 1.32 0.02 1.88 103 XMDiploma_00 6308 2.23 3.07 1.87 104 TM2_M_URI_OPT_OUT 6180 2.33 3.50 1.83 105 HTML_IMAGE_RATIO_08 5933 2.25 3.38 1.76 106 XM_B_Investor 5594 2.66 5.01 1.66 107 UNTRUSTED_Relay 5520 3.17 6.78 1.64 108 TooManyTo_003 5434 1.33 0.68 1.61 109 RCVD_IN_IADB_OPTIN 5333 1.23 0.39 1.58 110 TR_Symld_Words 5298 1.50 1.34 1.57 111 URI_NOVOWEL 5296 1.63 1.75 1.57 112 TVD_RCVD_IP 5151 1.35 0.95 1.53 113 FROM_EXCESS_BASE64 5119 1.78 2.40 1.52 114 XMSexyCombo_05 5052 2.42 4.58 1.50 115 T_XMDrugObfuBody_08 5027 2.04 3.33 1.49 116 TR_XM_PhishingBody 4993 2.35 4.38 1.48 117 TR_XM_UnparsRelay 4888 3.09 6.95 1.45 118 SUBJ_ALL_CAPS 4884 1.79 2.60 1.45 119 XMGappySubj_01 4875 1.06 0.14 1.45 120 IN_HORDE_ADDRESS_BOOK 4827 1.03 0.09 1.43 121 XM_SendGrid 4727 1.42 1.47 1.40 122 KHOP_HELO_FCRDNS 4709 1.41 1.45 1.40 123 TM2_M_VERY_LONG_WORD 4545 1.76 2.71 1.35 124 XM_B_Unsub2 4452 1.59 2.21 1.32 125 XM_OfRef6 4324 2.23 4.44 1.28 126 TR_DCC_Bayes_99 4272 7.80 23.15 1.27 127 XMCapTrack 4234 0.99 0.35 1.26 128 XMStockSpam_06 4229 1.39 1.72 1.26 129 XM_GoogleGroups 4219 1.04 0.53 1.25 130 RELAYCOUNTRY_CA 4123 4.28 11.45 1.22 131 TooManyTo_004 4035 1.03 0.63 1.20 132 XM_H_Long_From02 4001 1.13 0.98 1.19 133 TVD_SPACE_RATIO 3985 0.86 0.09 1.18 134 XM_ProductURIs 3971 1.09 0.88 1.18 135 TR_XM_SpammyWords5 3960 2.09 4.25 1.18 136 BOTNET 3928 3.66 9.53 1.17 137 XMBSHREFv2 3837 0.89 0.31 1.14 138 XMBody_95 3771 0.86 0.25 1.12 139 XMLngstWrd_00 3692 1.17 1.33 1.10 140 URI_HEX 3647 1.35 1.96 1.08 141 T_FILL_THIS_FORM_SHORT 3609 2.33 5.28 1.07 142 XMGenDplmaNmb 3521 1.10 1.24 1.05 143 DKIM_ADSP_CUSTOM_MED 3505 1.14 1.38 1.04 144 XM_UB50 3466 1.59 2.91 1.03 145 XMGappySubj_02 3427 0.73 0.06 1.02 146 TooManyTo_005 3426 0.89 0.59 1.02 147 HTTPS_HTTP_MISMATCH 3253 1.37 2.32 0.97 148 SpammyFromTLD_01 3208 1.96 4.32 0.95 149 TR_XM_DK_SendGrid 3183 0.94 0.94 0.94 150 T_TooManySym_03 3141 0.73 0.27 0.93 151 XM_ShortIntro_01 2910 0.79 0.61 0.86 152 URI_TRY_3LD 2875 0.96 1.20 0.85 153 RCVD_IN_RP_SAFE 2734 0.76 0.62 0.81 154 TR_Mismatch_TLD_01 2584 0.80 0.88 0.77 155 NML_ADSP_CUSTOM_MED 2420 0.83 1.10 0.72 156 MSGID_NOFQDN1 2418 0.51 0.02 0.72 157 RCVD_IN_RP_CERTIFIED 2389 0.65 0.50 0.71 158 RELAYCOUNTRY_AU 2372 1.13 2.15 0.70 159 XM_H_PHPMailer 2351 0.70 0.69 0.70 160 XM_H_Trusted_IP 2283 0.48 0.00 0.68 161 TR_MetaPhish_Combo_01 2250 0.82 1.19 0.67 162 XMSubMetaI_00 2210 0.80 1.15 0.66 163 XMBody_17 2199 2.52 6.91 0.65 164 XMNoVowels 2179 0.60 0.51 0.65 165 XMBdyGiftCard01 2175 0.80 1.16 0.65 166 FILL_THIS_FORM 2133 0.57 0.41 0.63 167 MIME_HEADER_CTYPE_ONLY 2126 0.48 0.12 0.63 168 XM_B_FormFill 2123 0.49 0.15 0.63 169 SHORT_HELO_AND_INLINE_IMAGE 2096 0.46 0.06 0.62 170 USER_IN_WHITELIST 2059 0.43 0.00 0.61 171 USER_IN_WELCOMELIST 2059 0.43 0.00 0.61 172 T_OBFU_PDF_ATTACH 2054 0.46 0.10 0.61 173 XM_B_COPY_HTML 2015 0.75 1.12 0.60 174 XMSubNoVowel 2014 0.57 0.51 0.60 175 MPART_ALT_DIFF_COUNT 1987 0.70 0.97 0.59 176 FORGED_GMAIL_RCVD 1959 0.73 1.08 0.58 177 XMMoneyMeta_00 1919 0.61 0.71 0.57 178 XMHTML_After_End 1888 0.89 1.66 0.56 179 TO_NO_BRKTS_HTML_ONLY 1875 0.50 0.35 0.56 180 TR_XM_Base64_M1 1873 0.71 1.06 0.56 181 TR_XM_PHPDW 1872 1.37 3.30 0.56 182 TR_XM_FormFill2 1860 1.35 3.22 0.55 183 TR_XM_PHPForged 1838 1.38 3.35 0.55 184 T_XMDrugObfuBody_00 1829 0.79 1.37 0.54 185 XMSubMetaSxObfu_02 1827 0.56 0.59 0.54 186 XM_H_PHPOS 1784 1.33 3.21 0.53 187 RCVD_IN_BL_SPAMCOP_NET 1754 3.73 11.27 0.52 188 HTML_IMAGE_ONLY_32 1743 0.40 0.13 0.52 189 TM2_M_BODY_EMPTY 1730 0.93 1.90 0.51 190 FROM_GOV_DKIM_AU 1705 0.39 0.10 0.51 191 XMPhish14 1651 0.77 1.43 0.49 192 XMBrknScrpt_02 1647 0.80 1.53 0.49 193 RELAYCOUNTRY_GB 1557 0.55 0.77 0.46 194 HTML_IMAGE_ONLY_28 1553 0.42 0.32 0.46 195 RCVD_IN_PSBL 1544 0.68 1.21 0.46 196 RCVD_IN_SORBS_DUL 1518 0.49 0.60 0.45 197 T_XMHurry_00 1480 0.87 1.89 0.44 198 XM_B_SpammyWords4 1477 0.99 2.29 0.44 199 XM_B_DNDMA 1445 0.84 1.81 0.43 200 T_Symld_Words_02 1431 0.49 0.64 0.42 ----------------------------------------------------------------------