Email: 596495 Autolearn: 0 AvgScore: 2.37 AvgScanTime: 1.29 sec Spam: 175354 Autolearn: 0 AvgScore: 12.88 AvgScanTime: 1.39 sec Ham: 421141 Autolearn: 0 AvgScore: -2.01 AvgScanTime: 1.25 sec Time Spent Running SA: 214.32 hours Time Spent Processing Spam: 67.78 hours Time Spent Processing Ham: 146.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 156296 69.35 89.13 61.11 2 HTML_MESSAGE 152102 87.86 86.74 88.33 3 XM_DK_Pass 150779 67.60 85.99 59.94 4 DKIM_VALID 149170 66.74 85.07 59.11 5 RELAYCOUNTRY_US 137564 77.67 78.45 77.34 6 XM_B_Unicode 133561 74.21 76.17 73.39 7 XMListUnsubscribeExists 126741 49.58 72.28 40.13 8 DKIM_VALID_AU 117722 53.41 67.13 47.70 9 T_SCC_BODY_TEXT_LINE 111042 68.87 63.32 71.17 10 XM_B_SpammyWords 109220 45.97 62.29 39.18 11 DCC_CHECK 109029 37.88 62.18 27.76 12 XM_B_Unicode3 70380 44.21 40.14 45.91 13 XM_DK_Undo_02 67840 15.06 38.69 5.22 14 DCC_CHECK_NEGATIVE 66303 62.09 37.81 72.20 15 BAYES_50 65875 52.46 37.57 58.66 16 XM_B_SpammyWords2 61960 20.69 35.33 14.59 17 LOC_TINY_FONT_1 61557 24.43 35.10 19.98 18 HTML_FONT_LOW_CONTRAST 54406 25.53 31.03 23.24 19 BAYES_99 54111 12.01 30.86 4.17 20 MIME_HTML_ONLY 51901 28.03 29.60 27.38 21 TR_XM_DKIM_Undo 50756 10.12 28.94 2.28 22 FVGT_m_MULTI_ODD 50714 22.57 28.92 19.93 23 DKIM_VALID_EF 49584 25.27 28.28 24.02 24 T_KAM_HTML_FONT_INVALID 45695 19.65 26.06 16.98 25 XMSubLong 43537 26.08 24.83 26.60 26 RCVD_IN_MSPIKE_H2 42926 22.41 24.48 21.55 27 BAYES_999 42506 9.38 24.24 3.20 28 TR_DCC_Bayes_99 36254 7.14 20.67 1.50 29 T_TM2_M_HEADER_IN_MSG 36062 23.27 20.57 24.40 30 TR_XM_DK_Unsub 35340 13.75 20.15 11.09 31 XM_UncommonTLD01 32500 7.91 18.53 3.48 32 RELAYCOUNTRY_META 30489 7.68 17.39 3.64 33 XM_Multi_Part_URI 29712 13.46 16.94 12.01 34 XM_B_Unsub 24520 12.51 13.98 11.90 35 XMNumbers 23582 5.54 13.45 2.25 36 TR_XM_BayesUnsub 23576 11.37 13.44 10.50 37 TR_XM_SpammyRelay 22649 5.24 12.92 2.05 38 TR_MAX_INTL_RELAY 22206 7.89 12.66 5.90 39 LOTS_OF_MONEY 21705 7.48 12.38 5.44 40 XM_B_SpammyWords3 21548 6.33 12.29 3.85 41 SpammyFromTLD_01 21102 4.09 12.03 0.78 42 BOTNET_IPINHOSTNAME 20826 6.04 11.88 3.62 43 UNPARSEABLE_RELAY 20445 9.06 11.66 7.98 44 XM_SPF_SoftFail 20443 5.42 11.66 2.82 45 TR_XM_PHPForged 20196 3.65 11.52 0.37 46 TR_XM_PHPDW 20139 3.64 11.48 0.38 47 TR_XM_FormFill2 20046 3.63 11.43 0.38 48 XM_H_PHPOS 20034 3.62 11.42 0.37 49 TR_XM_SpammyWords4 19704 5.93 11.24 3.72 50 TR_XM_SpammyWords2 19322 3.54 11.02 0.43 51 TM2_M_BODY_EMPTY 18387 3.37 10.49 0.41 52 XMEmptyBody_01 18306 3.15 10.44 0.12 53 RCVD_IN_BL_SPAMCOP_NET 17185 3.32 9.80 0.62 54 XM_Body_Dirty_Words 15802 4.81 9.01 3.05 55 RELAYCOUNTRY_CA 15371 3.42 8.77 1.20 56 XM_Evil_Numbers_Gen 15023 8.21 8.57 8.06 57 BOTNET 14428 3.24 8.23 1.17 58 BAYES_80 13915 4.79 7.94 3.47 59 TR_XM_SPAMCOP 13255 2.41 7.56 0.27 60 BAYES_60 11861 7.04 6.76 7.15 61 TR_XM_UnparsRelay 11823 2.92 6.74 1.33 62 RCVD_IN_MSPIKE_WL 11201 5.42 6.39 5.01 63 RCVD_IN_MSPIKE_H3 11201 5.42 6.39 5.01 64 LotsOfNums_01 11068 6.43 6.31 6.47 65 MPART_ALT_DIFF 11035 8.10 6.29 8.85 66 FSL_BULK_SIG 10808 3.79 6.16 2.80 67 UNTRUSTED_Relay 10623 2.65 6.06 1.23 68 SCC_BODY_URI_ONLY 10298 3.17 5.87 2.04 69 XM_B_SpammyTLD 10082 3.28 5.75 2.24 70 XMSexyCombo_05 9594 2.57 5.47 1.36 71 XMSubMetaSx_00 9551 3.79 5.45 3.10 72 HTML_IMAGE_RATIO_02 9158 4.37 5.22 4.02 73 HTML_IMAGE_RATIO_04 8989 11.82 5.13 14.61 74 BAYES_40 8880 5.01 5.06 4.99 75 XM_B_Phish_Phrases 8717 3.70 4.97 3.17 76 TooManyTo_001 8695 10.40 4.96 12.67 77 XM_H_Long_From01 8637 4.55 4.93 4.39 78 BAYES_20 8562 3.97 4.88 3.59 79 ALL_TRUSTED 8300 15.41 4.73 19.85 80 XMBody_17 7951 1.64 4.53 0.43 81 MIME_HTML_MOSTLY 7861 2.80 4.48 2.09 82 BAYES_95 7560 2.98 4.31 2.42 83 SpammyFromTLD_02 7376 1.62 4.21 0.55 84 DKIM_INVALID 7126 2.61 4.06 2.00 85 XM_B_Investor 7117 2.08 4.06 1.26 86 XM_H_GMP 7085 5.06 4.04 5.48 87 HTML_IMAGE_RATIO_06 7026 4.26 4.01 4.37 88 XM_OfRef6 6445 1.81 3.68 1.04 89 TR_XM_PhishingBody 6352 2.31 3.62 1.76 90 T_XMDrugObfuBody_14 6308 2.11 3.60 1.49 91 TR_XM_SpammyWords5 6250 1.81 3.56 1.08 92 T_FILL_THIS_FORM_SHORT 5631 1.61 3.21 0.95 93 XMDiploma_00 5626 5.96 3.21 7.11 94 T_XMDrugObfuBody_08 5450 1.91 3.11 1.41 95 XM_UB50 5201 1.39 2.97 0.73 96 MIME_HTML_ONLY_MULTI 5182 5.90 2.96 7.13 97 MIME_QP_LONG_LINE 4976 3.77 2.84 4.16 98 HTML_IMAGE_ONLY_16 4955 1.19 2.83 0.50 99 HTML_IMAGE_RATIO_08 4944 2.21 2.82 1.95 100 XM_B_SpammyTLD2 4908 0.86 2.80 0.06 101 XM_URI_RBL 4874 0.91 2.78 0.13 102 TM2_M_VERY_LONG_WORD 4690 1.45 2.67 0.94 103 TM2_M_URI_OPT_OUT 4682 2.03 2.67 1.77 104 RCVD_IN_VALIDITY_SAFE 4631 3.37 2.64 3.67 105 XMStrtUSub 4377 7.77 2.50 9.96 106 XM_CamelCaseFrm001 4337 1.86 2.47 1.60 107 T_TooManySym_01 4163 3.94 2.37 4.59 108 XM_B_SpammyWords4 3890 1.26 2.22 0.86 109 TR_LOTS_OF_MONEY3 3772 0.94 2.15 0.43 110 RCVD_IN_VALIDITY_CERTIFIED 3767 2.92 2.15 3.24 111 FONT_INVIS_LONG_LINE 3736 0.65 2.13 0.03 112 XM_B_Unsub2 3714 1.44 2.12 1.16 113 HK_RANDOM_REPLYTO 3592 0.68 2.05 0.11 114 BAYES_05 3519 2.95 2.01 3.34 115 USER_IN_DEF_DKIM_WL 3402 7.47 1.94 9.78 116 URI_NOVOWEL 3378 1.41 1.93 1.20 117 TR_XM_FormFill 3374 0.58 1.92 0.02 118 TR_XM_BayesRelay 3364 0.56 1.92 0.00 119 TR_XM_NoHeaderRelay 3293 0.62 1.88 0.09 120 RELAYCOUNTRY_AU 3251 1.02 1.85 0.67 121 XMBrknScrpt_02 3247 0.87 1.85 0.46 122 URI_HEX 3031 1.08 1.73 0.81 123 XMStockSpam_06 2944 1.18 1.68 0.97 124 FROM_EXCESS_BASE64 2913 1.61 1.66 1.59 125 XM_DIRTYINTL 2881 0.60 1.64 0.16 126 XM_DK_Undo_01 2780 1.55 1.59 1.53 127 HTML_MIME_NO_HTML_TAG 2769 2.01 1.58 2.19 128 MAILING_LIST_MULTI 2755 2.07 1.57 2.28 129 XMGenDplmaNmb 2752 4.99 1.57 6.41 130 SUBJ_ALL_CAPS 2739 1.31 1.56 1.20 131 TR_XM_INV_DKIM 2736 0.49 1.56 0.05 132 ANY_BOUNCE_MESSAGE 2731 3.77 1.56 4.70 133 BOUNCE_MESSAGE 2730 3.77 1.56 4.70 134 T_REMOTE_IMAGE 2678 2.55 1.53 2.98 135 RELAYCOUNTRY_IN 2375 0.43 1.35 0.05 136 XM_HighProb1 2375 0.40 1.35 0.00 137 RCVD_IN_IADB_LISTED 2374 2.69 1.35 3.24 138 T_XMHurry_00 2342 0.66 1.34 0.38 139 XMHTML_After_End 2322 0.67 1.32 0.39 140 XM_SendGrid 2317 1.20 1.32 1.15 141 KHOP_HELO_FCRDNS 2292 1.06 1.31 0.95 142 BOTNET_NORDNS 2266 0.39 1.29 0.01 143 URIBL_DBL_SPAM 2241 0.38 1.28 0.01 144 RCVD_IN_IADB_SPF 2167 2.39 1.24 2.87 145 XMPhish30 2098 0.70 1.20 0.49 146 AC_BR_BONANZA 2085 0.39 1.19 0.05 147 URI_TRY_3LD 2069 0.81 1.18 0.66 148 RCVD_IN_IADB_SENDERID 2050 2.18 1.17 2.60 149 RCVD_IN_IADB_DK 2019 2.13 1.15 2.54 150 HTML_TAG_BALANCE_BODY 1999 0.57 1.14 0.34 151 T_XMDrugObfuBody_00 1987 0.67 1.13 0.47 152 XMSexyCombo_01 1986 0.47 1.13 0.19 153 BODY_EMPTY 1963 0.33 1.12 0.00 154 THIS_AD 1940 0.58 1.11 0.36 155 LongTLD 1895 0.54 1.08 0.31 156 XMReplyNow 1834 0.45 1.05 0.20 157 HTTPS_HTTP_MISMATCH 1825 0.82 1.04 0.72 158 PDS_OTHER_BAD_TLD 1818 0.40 1.04 0.14 159 DKIM_ADSP_CUSTOM_MED 1775 0.81 1.01 0.73 160 XMBdyGiftCard01 1731 0.62 0.99 0.47 161 XM_UB99 1724 0.29 0.98 0.00 162 T_Symld_Words_02 1721 0.63 0.98 0.49 163 TR_XM_InvalidRelay 1704 0.30 0.97 0.02 164 TM2_M_A_HREF_HREF 1668 0.40 0.95 0.18 165 TR_Mismatch_TLD_02 1648 0.38 0.94 0.15 166 XM_B_COVIDMETA 1612 0.46 0.92 0.27 167 XM_H_PHPMailer 1606 0.64 0.92 0.53 168 XM_B_Phish66 1587 0.46 0.91 0.28 169 NML_ADSP_CUSTOM_MED 1580 0.63 0.90 0.52 170 T_MONEY_PERCENT 1555 0.41 0.89 0.22 171 TR_LOTS_OF_MONEY2 1555 0.41 0.89 0.22 172 XM_OfRef7 1550 0.35 0.88 0.13 173 TR_XM_Base64_M1 1534 0.69 0.87 0.61 174 XMSubMetaI_00 1528 0.54 0.87 0.40 175 XMMoneyMeta_00 1521 0.64 0.87 0.54 176 TR_Symld_Words 1517 1.12 0.87 1.22 177 XM_B_COPY_HTML 1509 0.66 0.86 0.58 178 RDNS_DYNAMIC 1502 0.46 0.86 0.30 179 XMPhish14 1484 0.72 0.85 0.67 180 TR_MetaPhish_Combo_01 1473 0.75 0.84 0.71 181 XMLngstWrd_00 1455 0.75 0.83 0.72 182 TR_XM_DK_SendGrid 1455 0.77 0.83 0.74 183 FORGED_GMAIL_RCVD 1444 0.52 0.82 0.40 184 MPART_ALT_DIFF_COUNT 1428 0.59 0.81 0.49 185 RCVD_IN_VALIDITY_RPBL 1420 0.25 0.81 0.02 186 XM_H_Undi_Recip 1401 0.32 0.80 0.12 187 XMBody_78 1399 0.36 0.80 0.17 188 XM_ProductURIs 1396 0.56 0.80 0.47 189 XM_UB60 1377 0.27 0.79 0.05 190 FROM_SUSPICIOUS_NTLD 1351 0.24 0.77 0.02 191 XM_UB999 1334 0.23 0.76 0.00 192 TooManyTo_002 1307 1.71 0.75 2.12 193 RELAYCOUNTRY_FR 1303 0.36 0.74 0.20 194 XM_H_Long_From02 1291 0.89 0.74 0.96 195 XM_B_SEO 1267 0.31 0.72 0.14 196 TM2_M_OBFU_COMMENT 1246 0.40 0.71 0.27 197 SHOPIFY_IMG_NOT_RCVD_SFY 1244 0.37 0.71 0.23 198 TVD_RCVD_IP 1243 1.17 0.71 1.36 199 XMSubMetaSSx_00 1243 0.29 0.71 0.12 200 XM_UB80 1234 0.22 0.70 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 371998 87.86 86.74 88.33 2 RELAYCOUNTRY_US 325709 77.67 78.45 77.34 3 XM_B_Unicode 309090 74.21 76.17 73.39 4 DCC_CHECK_NEGATIVE 304060 62.09 37.81 72.20 5 T_SCC_BODY_TEXT_LINE 299740 68.87 63.32 71.17 6 DKIM_SIGNED 257365 69.35 89.13 61.11 7 XM_DK_Pass 252452 67.60 85.99 59.94 8 DKIM_VALID 248932 66.74 85.07 59.11 9 BAYES_50 247057 52.46 37.57 58.66 10 DKIM_VALID_AU 200886 53.41 67.13 47.70 11 XM_B_Unicode3 193358 44.21 40.14 45.91 12 XMListUnsubscribeExists 168992 49.58 72.28 40.13 13 XM_B_SpammyWords 165011 45.97 62.29 39.18 14 DCC_CHECK 116894 37.88 62.18 27.76 15 MIME_HTML_ONLY 115311 28.03 29.60 27.38 16 XMSubLong 112007 26.08 24.83 26.60 17 T_TM2_M_HEADER_IN_MSG 102750 23.27 20.57 24.40 18 DKIM_VALID_EF 101150 25.27 28.28 24.02 19 HTML_FONT_LOW_CONTRAST 97856 25.53 31.03 23.24 20 RCVD_IN_MSPIKE_H2 90747 22.41 24.48 21.55 21 LOC_TINY_FONT_1 84154 24.43 35.10 19.98 22 FVGT_m_MULTI_ODD 83920 22.57 28.92 19.93 23 ALL_TRUSTED 83595 15.41 4.73 19.85 24 T_KAM_HTML_FONT_INVALID 71529 19.65 26.06 16.98 25 HTML_IMAGE_RATIO_04 61519 11.82 5.13 14.61 26 XM_B_SpammyWords2 61426 20.69 35.33 14.59 27 HTML_FONT_FACE_BAD 55182 9.44 0.63 13.10 28 TooManyTo_001 53341 10.40 4.96 12.67 29 BAYES_00 51349 8.79 0.61 12.19 30 XM_H_Trusted_IP 51162 8.58 0.00 12.15 31 XM_Multi_Part_URI 50570 13.46 16.94 12.01 32 XM_B_Unsub 50100 12.51 13.98 11.90 33 TR_XM_DK_Unsub 46690 13.75 20.15 11.09 34 TR_XM_BayesUnsub 44235 11.37 13.44 10.50 35 XMStrtUSub 41958 7.77 2.50 9.96 36 USER_IN_DEF_DKIM_WL 41174 7.47 1.94 9.78 37 MPART_ALT_DIFF 37291 8.10 6.29 8.85 38 XM_Evil_Numbers_Gen 33940 8.21 8.57 8.06 39 UNPARSEABLE_RELAY 33625 9.06 11.66 7.98 40 BAYES_60 30122 7.04 6.76 7.15 41 MIME_HTML_ONLY_MULTI 30016 5.90 2.96 7.13 42 XMDiploma_00 29954 5.96 3.21 7.11 43 XM_DKIMWhitelistDomains 29431 4.98 0.17 6.99 44 LotsOfNums_01 27264 6.43 6.31 6.47 45 XMGenDplmaNmb 26985 4.99 1.57 6.41 46 TR_MAX_INTL_RELAY 24841 7.89 12.66 5.90 47 IN_ZIMBRA_NJ_WHITELIST 23592 3.97 0.05 5.60 48 TR_XM_DK_Bayes 23361 4.06 0.47 5.55 49 XM_H_GMP 23075 5.06 4.04 5.48 50 TR_XM_DK_Bayes1 23052 4.00 0.47 5.47 51 LOTS_OF_MONEY 22907 7.48 12.38 5.44 52 XM_DK_Undo_02 21992 15.06 38.69 5.22 53 RCVD_IN_MSPIKE_H3 21113 5.42 6.39 5.01 54 RCVD_IN_MSPIKE_WL 21113 5.42 6.39 5.01 55 BAYES_40 21032 5.01 5.06 4.99 56 ANY_BOUNCE_MESSAGE 19784 3.77 1.56 4.70 57 BOUNCE_MESSAGE 19783 3.77 1.56 4.70 58 TR_XM_DK_Bayes2 19679 3.42 0.40 4.67 59 T_TooManySym_01 19349 3.94 2.37 4.59 60 XMSubNoVowel 18691 3.26 0.43 4.44 61 XM_H_Long_From01 18504 4.55 4.93 4.39 62 HTML_IMAGE_RATIO_06 18390 4.26 4.01 4.37 63 BAYES_99 17546 12.01 30.86 4.17 64 MIME_QP_LONG_LINE 17538 3.77 2.84 4.16 65 HTML_IMAGE_RATIO_02 16934 4.37 5.22 4.02 66 XM_B_SpammyWords3 16227 6.33 12.29 3.85 67 TR_XM_SpammyWords4 15664 5.93 11.24 3.72 68 RCVD_IN_VALIDITY_SAFE 15468 3.37 2.64 3.67 69 RELAYCOUNTRY_META 15322 7.68 17.39 3.64 70 BOTNET_IPINHOSTNAME 15231 6.04 11.88 3.62 71 BAYES_20 15126 3.97 4.88 3.59 72 XM_PDF 14933 2.63 0.42 3.55 73 XM_UncommonTLD01 14663 7.91 18.53 3.48 74 BAYES_80 14632 4.79 7.94 3.47 75 BAYES_05 14073 2.95 2.01 3.34 76 RCVD_IN_IADB_LISTED 13650 2.69 1.35 3.24 77 RCVD_IN_VALIDITY_CERTIFIED 13644 2.92 2.15 3.24 78 BAYES_999 13461 9.38 24.24 3.20 79 XM_B_Phish_Phrases 13330 3.70 4.97 3.17 80 XMSubMetaSx_00 13069 3.79 5.45 3.10 81 XM_Body_Dirty_Words 12861 4.81 9.01 3.05 82 T_REMOTE_IMAGE 12529 2.55 1.53 2.98 83 RCVD_IN_IADB_SPF 12107 2.39 1.24 2.87 84 XM_SPF_SoftFail 11896 5.42 11.66 2.82 85 FSL_BULK_SIG 11803 3.79 6.16 2.80 86 RCVD_IN_IADB_SENDERID 10956 2.18 1.17 2.60 87 RCVD_IN_IADB_DK 10704 2.13 1.15 2.54 88 BAYES_95 10202 2.98 4.31 2.42 89 MAILING_LIST_MULTI 9618 2.07 1.57 2.28 90 TR_XM_DKIM_Undo 9587 10.12 28.94 2.28 91 XMNumbers 9492 5.54 13.45 2.25 92 XM_B_SpammyTLD 9454 3.28 5.75 2.24 93 HTML_MIME_NO_HTML_TAG 9202 2.01 1.58 2.19 94 T_TooManySym_02 9009 1.70 0.63 2.14 95 TooManyTo_002 8910 1.71 0.75 2.12 96 MIME_HTML_MOSTLY 8817 2.80 4.48 2.09 97 TR_XM_SpammyRelay 8630 5.24 12.92 2.05 98 SCC_BODY_URI_ONLY 8587 3.17 5.87 2.04 99 DKIM_INVALID 8433 2.61 4.06 2.00 100 XMSubGarbage 8368 1.41 0.03 1.99 101 XMSubLongNoVowel 8344 1.43 0.12 1.98 102 RCVD_IN_IADB_VOUCHED 8330 1.57 0.58 1.98 103 HTML_IMAGE_RATIO_08 8222 2.21 2.82 1.95 104 TM2_M_URI_OPT_OUT 7434 2.03 2.67 1.77 105 TR_XM_PhishingBody 7428 2.31 3.62 1.76 106 INVALID_MSGID 7068 1.23 0.14 1.68 107 XM_CamelCaseFrm001 6742 1.86 2.47 1.60 108 FROM_EXCESS_BASE64 6709 1.61 1.66 1.59 109 HELO_NODOT 6516 1.26 0.57 1.55 110 HELO_NO_DOMAIN 6510 1.26 0.57 1.55 111 XM_DK_Undo_01 6449 1.55 1.59 1.53 112 TO_MALFORMED 6335 1.07 0.02 1.50 113 TR_DCC_Bayes_99 6315 7.14 20.67 1.50 114 T_XMDrugObfuBody_14 6269 2.11 3.60 1.49 115 T_XMDrugObfuBody_08 5935 1.91 3.11 1.41 116 TVD_RCVD_IP 5739 1.17 0.71 1.36 117 XMSexyCombo_05 5713 2.57 5.47 1.36 118 TR_XM_UnparsRelay 5588 2.92 6.74 1.33 119 RCVD_IN_IADB_OPTIN 5538 1.05 0.40 1.31 120 XM_B_Investor 5318 2.08 4.06 1.26 121 TooManyTo_003 5252 1.07 0.64 1.25 122 UNTRUSTED_Relay 5194 2.65 6.06 1.23 123 TR_Symld_Words 5139 1.12 0.87 1.22 124 SUBJ_ALL_CAPS 5063 1.31 1.56 1.20 125 RELAYCOUNTRY_CA 5057 3.42 8.77 1.20 126 URI_NOVOWEL 5043 1.41 1.93 1.20 127 XMGappySubj_01 5034 0.87 0.09 1.20 128 BOTNET 4918 3.24 8.23 1.17 129 XM_B_Unsub2 4883 1.44 2.12 1.16 130 IN_HORDE_ADDRESS_BOOK 4857 0.83 0.05 1.15 131 XM_SendGrid 4828 1.20 1.32 1.15 132 TR_XM_SpammyWords5 4528 1.81 3.56 1.08 133 XM_GoogleGroups 4380 0.87 0.46 1.04 134 XM_OfRef6 4369 1.81 3.68 1.04 135 XMCapTrack 4172 0.79 0.32 0.99 136 XMStockSpam_06 4078 1.18 1.68 0.97 137 XM_H_Long_From02 4032 0.89 0.74 0.96 138 XM_E_Blogspot 4028 0.72 0.14 0.96 139 KHOP_HELO_FCRDNS 4015 1.06 1.31 0.95 140 T_FILL_THIS_FORM_SHORT 3997 1.61 3.21 0.95 141 TM2_M_VERY_LONG_WORD 3952 1.45 2.67 0.94 142 XMBSHREFv2 3946 0.75 0.31 0.94 143 TVD_SPACE_RATIO 3865 0.68 0.10 0.92 144 TooManyTo_004 3862 0.82 0.59 0.92 145 XM_B_SpammyWords4 3624 1.26 2.22 0.86 146 MSGID_NOFQDN1 3527 0.60 0.02 0.84 147 URI_HEX 3418 1.08 1.73 0.81 148 XMBody_95 3397 0.65 0.26 0.81 149 T_TooManySym_03 3323 0.64 0.27 0.79 150 SpammyFromTLD_01 3295 4.09 12.03 0.78 151 TR_XM_DK_SendGrid 3120 0.77 0.83 0.74 152 FROM_GOV_DKIM_AU 3096 0.64 0.40 0.74 153 XM_UB50 3088 1.39 2.97 0.73 154 TooManyTo_005 3078 0.68 0.56 0.73 155 DKIM_ADSP_CUSTOM_MED 3056 0.81 1.01 0.73 156 HTTPS_HTTP_MISMATCH 3037 0.82 1.04 0.72 157 XMLngstWrd_00 3013 0.75 0.83 0.72 158 TR_MetaPhish_Combo_01 3002 0.75 0.84 0.71 159 XMGappySubj_02 2868 0.49 0.04 0.68 160 XM_ShortIntro_01 2854 0.61 0.44 0.68 161 XMPhish14 2840 0.72 0.85 0.67 162 RELAYCOUNTRY_AU 2809 1.02 1.85 0.67 163 URI_TRY_3LD 2770 0.81 1.18 0.66 164 RCVD_IN_BL_SPAMCOP_NET 2621 3.32 9.80 0.62 165 TR_XM_Base64_M1 2574 0.69 0.87 0.61 166 XM_B_COPY_HTML 2436 0.66 0.86 0.58 167 RCVD_IN_RP_SAFE 2407 0.57 0.55 0.57 168 SpammyFromTLD_02 2310 1.62 4.21 0.55 169 XMMoneyMeta_00 2291 0.64 0.87 0.54 170 XM_H_PHPMailer 2227 0.64 0.92 0.53 171 T_OBFU_PDF_ATTACH 2190 0.38 0.06 0.52 172 NML_ADSP_CUSTOM_MED 2171 0.63 0.90 0.52 173 RCVD_IN_RP_CERTIFIED 2152 0.50 0.47 0.51 174 SHORT_HELO_AND_INLINE_IMAGE 2140 0.37 0.05 0.51 175 HTML_IMAGE_ONLY_16 2122 1.19 2.83 0.50 176 XMNoVowels 2087 0.48 0.44 0.50 177 MPART_ALT_DIFF_COUNT 2066 0.59 0.81 0.49 178 T_Symld_Words_02 2065 0.63 0.98 0.49 179 XMPhish30 2048 0.70 1.20 0.49 180 USER_IN_WHITELIST 2024 0.34 0.00 0.48 181 USER_IN_WELCOMELIST 2024 0.34 0.00 0.48 182 T_XMDrugObfuBody_00 1997 0.67 1.13 0.47 183 FILL_THIS_FORM 1991 0.43 0.32 0.47 184 XMBdyGiftCard01 1979 0.62 0.99 0.47 185 XM_ProductURIs 1973 0.56 0.80 0.47 186 XMBrknScrpt_02 1950 0.87 1.85 0.46 187 TR_LOTS_OF_MONEY3 1826 0.94 2.15 0.43 188 XMBody_17 1812 1.64 4.53 0.43 189 TR_XM_SpammyWords2 1805 3.54 11.02 0.43 190 TR_Mismatch_TLD_01 1756 0.47 0.59 0.42 191 TM2_M_BODY_EMPTY 1719 3.37 10.49 0.41 192 RELAYCOUNTRY_GB 1709 0.48 0.66 0.41 193 XMSubMetaI_00 1692 0.54 0.87 0.40 194 FORGED_GMAIL_RCVD 1679 0.52 0.82 0.40 195 FROM_GOV_SPOOF 1661 0.29 0.03 0.39 196 XMHTML_After_End 1655 0.67 1.32 0.39 197 HTML_IMAGE_ONLY_32 1644 0.32 0.14 0.39 198 T_XMHurry_00 1602 0.66 1.34 0.38 199 TR_XM_FormFill2 1594 3.63 11.43 0.38 200 TR_XM_PHPDW 1588 3.64 11.48 0.38 ----------------------------------------------------------------------