Email: 775796 Autolearn: 0 AvgScore: 2.36 AvgScanTime: 1.08 sec Spam: 153306 Autolearn: 0 AvgScore: 13.01 AvgScanTime: 1.51 sec Ham: 622490 Autolearn: 0 AvgScore: -0.26 AvgScanTime: 0.98 sec Time Spent Running SA: 233.40 hours Time Spent Processing Spam: 64.27 hours Time Spent Processing Ham: 169.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 153010 99.63 99.81 99.59 2 HTML_MESSAGE 148840 58.64 97.09 49.17 3 DKIM_SIGNED 140399 52.83 91.58 43.29 4 XM_DK_Pass 135240 51.55 88.22 42.52 5 DKIM_VALID 133452 50.84 87.05 41.92 6 XM_B_Unicode 130329 48.73 85.01 39.80 7 RELAYCOUNTRY_US 123083 53.46 80.29 46.85 8 XMListUnsubscribeExists 112454 37.49 73.35 28.65 9 DCC_CHECK 110882 46.66 72.33 40.33 10 XM_B_SpammyWords 109839 34.53 71.65 25.39 11 DKIM_VALID_AU 99168 39.45 64.69 33.24 12 XM_DK_Undo_02 70570 11.81 46.03 3.38 13 XM_B_Unicode3 68213 27.33 44.49 23.11 14 LOC_TINY_FONT_1 63276 20.07 41.27 14.85 15 XM_B_SpammyWords2 62992 16.54 41.09 10.50 16 BAYES_50 59259 47.36 38.65 49.50 17 HTML_FONT_LOW_CONTRAST 55512 20.09 36.21 16.11 18 BAYES_99 54862 9.17 35.79 2.61 19 TR_XM_DKIM_Undo 52685 7.92 34.37 1.40 20 FVGT_m_MULTI_ODD 51780 18.50 33.78 14.74 21 DKIM_VALID_EF 48825 19.39 31.85 16.33 22 RCVD_IN_MSPIKE_H2 47216 19.29 30.80 16.45 23 MIME_HTML_ONLY 46007 14.53 30.01 10.72 24 T_KAM_HTML_FONT_INVALID 44562 15.50 29.07 12.16 25 BAYES_999 42660 7.06 27.83 1.95 26 DCC_CHECK_NEGATIVE 42396 53.31 27.65 59.63 27 TR_DCC_Bayes_99 38750 5.67 25.28 0.84 28 XMSubLong 37079 14.98 24.19 12.72 29 TR_XM_DK_Unsub 36541 10.81 23.84 7.60 30 T_TM2_M_HEADER_IN_MSG 35682 18.34 23.28 17.12 31 XM_Multi_Part_URI 31085 10.46 20.28 8.04 32 RELAYCOUNTRY_META 30875 5.88 20.14 2.37 33 TR_XM_SpammyRelay 25009 4.33 16.31 1.38 34 XM_B_Unsub 24325 6.86 15.87 4.64 35 TR_XM_BayesUnsub 23525 6.08 15.35 3.79 36 UNPARSEABLE_RELAY 22579 7.97 14.73 6.31 37 BOTNET_IPINHOSTNAME 22561 4.83 14.72 2.39 38 LOTS_OF_MONEY 22016 5.61 14.36 3.45 39 XM_B_SpammyWords3 21240 4.83 13.85 2.60 40 TR_MAX_INTL_RELAY 21182 5.87 13.82 3.91 41 TR_XM_SpammyWords2 20538 2.97 13.40 0.41 42 TR_XM_SpammyWords4 19663 4.39 12.83 2.32 43 RCVD_IN_BL_SPAMCOP_NET 17966 2.62 11.72 0.38 44 RELAYCOUNTRY_CA 16538 2.70 10.79 0.71 45 BOTNET 14920 2.52 9.73 0.74 46 TR_XM_SPAMCOP 14701 2.09 9.59 0.24 47 XM_Evil_Numbers_Gen 14661 5.54 9.56 4.55 48 BAYES_80 13202 3.61 8.61 2.37 49 RCVD_IN_MSPIKE_WL 12948 4.53 8.45 3.57 50 RCVD_IN_MSPIKE_H3 12948 4.53 8.45 3.57 51 TR_XM_UnparsRelay 12472 2.46 8.14 1.06 52 FSL_BULK_SIG 12078 20.52 7.88 23.63 53 BAYES_60 11830 5.73 7.72 5.24 54 HTML_IMAGE_RATIO_02 11157 3.68 7.28 2.79 55 LotsOfNums_01 10918 5.40 7.12 4.97 56 XM_Body_Dirty_Words 10512 2.53 6.86 1.47 57 XM_UncommonTLD01 9481 2.86 6.18 2.04 58 UNTRUSTED_Relay 9403 1.95 6.13 0.92 59 MPART_ALT_DIFF 9330 2.86 6.09 2.07 60 TooManyTo_001 9134 5.39 5.96 5.25 61 XMSubMetaSx_00 8775 2.75 5.72 2.02 62 XMBody_17 8258 1.33 5.39 0.33 63 XM_B_Phish_Phrases 7930 2.68 5.17 2.07 64 XM_SPF_SoftFail 7611 2.50 4.96 1.89 65 BAYES_95 7523 2.20 4.91 1.54 66 XM_B_Investor 7450 1.80 4.86 1.04 67 XM_H_Long_From01 7411 3.28 4.83 2.90 68 XM_H_GMP 7372 4.01 4.81 3.82 69 HTML_IMAGE_RATIO_04 7354 2.94 4.80 2.48 70 HTML_IMAGE_RATIO_06 7332 2.38 4.78 1.79 71 TM2_M_URI_OPT_OUT 7216 1.67 4.71 0.92 72 DKIM_INVALID 6947 2.00 4.53 1.37 73 XMSexyCombo_05 6748 1.56 4.40 0.85 74 XM_OfRef6 6576 1.43 4.29 0.72 75 HTML_IMAGE_RATIO_08 6298 1.86 4.11 1.31 76 TR_XM_SpammyWords5 6207 1.34 4.05 0.68 77 T_XMDrugObfuBody_14 6115 1.64 3.99 1.06 78 TR_XM_PhishingBody 5819 1.47 3.80 0.90 79 MIME_QP_LONG_LINE 5633 3.12 3.67 2.99 80 T_FILL_THIS_FORM_SHORT 5599 1.18 3.65 0.57 81 T_TooManySym_01 5392 3.31 3.52 3.26 82 MIME_HTML_MOSTLY 5387 1.75 3.51 1.32 83 RCVD_IN_VALIDITY_SAFE 5244 2.70 3.42 2.52 84 XMStrtUSub 5220 2.69 3.40 2.51 85 MIME_HTML_ONLY_MULTI 5070 1.60 3.31 1.18 86 XMNumbers 4988 1.91 3.25 1.58 87 T_XMDrugObfuBody_08 4962 1.41 3.24 0.96 88 XM_B_SpammyTLD 4943 1.73 3.22 1.36 89 TM2_M_VERY_LONG_WORD 4902 1.16 3.20 0.66 90 SUBJ_ALL_CAPS 4703 1.24 3.07 0.79 91 XM_UB50 4617 1.04 3.01 0.55 92 XM_CamelCaseFrm001 4585 1.53 2.99 1.17 93 USER_IN_DEF_DKIM_WL 4280 6.75 2.79 7.73 94 RCVD_IN_VALIDITY_CERTIFIED 4145 2.26 2.70 2.15 95 XM_URI_RBL 4081 0.60 2.66 0.09 96 XMDiploma_00 4016 1.31 2.62 0.98 97 SpammyFromTLD_01 3937 0.87 2.57 0.45 98 TR_LOTS_OF_MONEY3 3840 0.72 2.50 0.28 99 XM_B_SpammyWords4 3611 0.81 2.36 0.43 100 TR_XM_BayesRelay 3472 0.45 2.26 0.00 101 RELAYCOUNTRY_AU 3467 0.77 2.26 0.40 102 XM_B_Unsub2 3396 1.13 2.22 0.86 103 TR_XM_NoHeaderRelay 3385 0.50 2.21 0.08 104 ANY_BOUNCE_MESSAGE 3348 36.75 2.18 45.27 105 BOUNCE_MESSAGE 3338 36.75 2.18 45.27 106 MAILING_LIST_MULTI 3206 1.79 2.09 1.72 107 TR_XM_FormFill 3203 0.42 2.09 0.01 108 FONT_INVIS_LONG_LINE 2980 0.40 1.94 0.02 109 T_REMOTE_IMAGE 2793 2.05 1.82 2.11 110 XMBrknScrpt_02 2765 0.68 1.80 0.40 111 SpammyFromTLD_02 2758 0.52 1.80 0.21 112 URI_TRY_3LD 2734 0.64 1.78 0.35 113 URI_HEX 2703 0.86 1.76 0.63 114 FROM_EXCESS_BASE64 2685 1.30 1.75 1.18 115 XM_DK_Undo_01 2643 1.26 1.72 1.15 116 XMStockSpam_06 2639 0.70 1.72 0.45 117 TR_XM_INV_DKIM 2559 0.35 1.67 0.03 118 XM_H_Long_From02 2550 0.83 1.66 0.62 119 RCVD_IN_IADB_LISTED 2547 2.44 1.66 2.64 120 BAYES_40 2397 7.04 1.56 8.39 121 TR_XM_PHPDW 2396 0.51 1.56 0.25 122 TR_Mismatch_TLD_02 2374 0.34 1.55 0.04 123 TR_XM_PHPForged 2360 0.51 1.54 0.26 124 HK_RANDOM_REPLYTO 2329 0.34 1.52 0.05 125 TR_XM_FormFill2 2301 0.50 1.50 0.25 126 XM_H_PHPOS 2293 0.49 1.50 0.24 127 RCVD_IN_IADB_SPF 2276 2.17 1.48 2.34 128 XM_SendGrid 2232 0.94 1.46 0.82 129 RCVD_IN_IADB_DK 2156 1.92 1.41 2.05 130 RCVD_IN_IADB_SENDERID 2137 1.96 1.39 2.10 131 XMReplyNow 2134 0.40 1.39 0.15 132 HTML_MIME_NO_HTML_TAG 2120 1.16 1.38 1.10 133 KHOP_HELO_FCRDNS 2057 0.82 1.34 0.69 134 T_XMHurry_00 2045 0.47 1.33 0.26 135 XM_HighProb1 2044 0.27 1.33 0.00 136 XMGenDplmaNmb 1997 0.66 1.30 0.50 137 XMPhish30 1956 0.49 1.28 0.29 138 XMHTML_After_End 1928 0.42 1.26 0.22 139 BAYES_20 1918 1.79 1.25 1.93 140 DIET_1 1911 0.45 1.25 0.25 141 XMHTMLBadTable_001 1880 0.46 1.23 0.27 142 HTML_TAG_BALANCE_BODY 1870 0.51 1.22 0.33 143 T_XMDrugObfuBody_00 1853 0.56 1.21 0.40 144 ALL_TRUSTED 1852 41.36 1.21 51.25 145 XM_DIRTYINTL 1835 0.27 1.20 0.04 146 HTTPS_HTTP_MISMATCH 1835 0.69 1.20 0.56 147 XMBdyGiftCard01 1830 0.56 1.19 0.40 148 XMSubMetaI_00 1828 0.53 1.19 0.37 149 TR_Symld_Words 1813 0.98 1.18 0.93 150 TR_Caps_n_Bayes_99 1802 0.24 1.18 0.01 151 DKIM_ADSP_NXDOMAIN 1799 0.34 1.17 0.14 152 AC_BR_BONANZA 1789 0.26 1.17 0.04 153 XM_H_Undi_Recip 1707 0.30 1.11 0.10 154 MPART_ALT_DIFF_COUNT 1695 0.52 1.11 0.37 155 RCVD_IN_VALIDITY_RPBL 1673 0.25 1.09 0.04 156 TooManyTo_002 1667 1.50 1.09 1.60 157 TR_XM_InvalidRelay 1661 0.22 1.08 0.01 158 PLING_QUERY 1642 0.42 1.07 0.26 159 XMLngstWrd_00 1616 11.98 1.05 14.67 160 DKIM_ADSP_CUSTOM_MED 1611 0.63 1.05 0.52 161 LongTLD 1608 0.33 1.05 0.16 162 XM_OfRef7 1582 0.34 1.03 0.17 163 XM_B_Phish66 1573 0.35 1.03 0.18 164 AC_HTML_NONSENSE_TAGS 1544 0.24 1.01 0.05 165 XM_UB99 1533 0.20 1.00 0.00 166 RELAYCOUNTRY_FR 1510 0.31 0.98 0.14 167 TM2_M_A_HREF_HREF 1504 0.31 0.98 0.14 168 XM_B_DNDMA 1486 0.33 0.97 0.17 169 SCC_BODY_URI_ONLY 1483 18.73 0.97 23.11 170 TooManyTo_003 1469 0.90 0.96 0.88 171 XMBody_78 1458 0.33 0.95 0.18 172 T_Symld_Words_02 1456 0.46 0.95 0.33 173 RDNS_DYNAMIC 1448 0.33 0.94 0.18 174 BOTNET_NORDNS 1438 0.19 0.94 0.01 175 URI_NOVOWEL 1437 0.93 0.94 0.92 176 XM_ProductURIs 1423 0.46 0.93 0.35 177 TR_MetaPhish_Combo_01 1422 0.56 0.93 0.47 178 TR_XM_Base64_M1 1417 0.56 0.92 0.47 179 TooManyTo_004 1376 0.70 0.90 0.65 180 TR_XM_Undi_Recip19 1366 0.20 0.89 0.04 181 RELAYCOUNTRY_CN 1355 0.22 0.88 0.06 182 NML_ADSP_CUSTOM_MED 1353 0.46 0.88 0.36 183 THIS_AD 1344 0.31 0.88 0.18 184 T_STY_INVIS_DIRECT 1341 0.28 0.87 0.13 185 TooManyTo_005 1307 0.58 0.85 0.52 186 XM_B_COPY_HTML 1282 0.49 0.84 0.40 187 T_TooManySym_02 1269 1.39 0.83 1.53 188 TVD_RCVD_IP 1264 0.92 0.82 0.95 189 XM_ShortIntro_01 1244 0.47 0.81 0.39 190 PDS_OTHER_BAD_TLD 1239 0.21 0.81 0.07 191 BAYES_00 1223 21.69 0.80 26.83 192 FORGED_GMAIL_RCVD 1217 0.40 0.79 0.30 193 TR_LOTS_OF_MONEY2 1200 0.29 0.78 0.17 194 T_MONEY_PERCENT 1200 0.29 0.78 0.17 195 XM_UB60 1191 0.19 0.78 0.04 196 XMPhish14 1149 0.32 0.75 0.22 197 TR_XM_DK_SendGrid 1144 0.56 0.75 0.52 198 TM2_M_OBFU_COMMENT 1139 0.28 0.74 0.16 199 URIBL_BLACK 1131 0.16 0.74 0.02 200 TR_XM_Base64_L1 1127 0.21 0.74 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 619932 99.63 99.81 99.59 2 DCC_CHECK_NEGATIVE 371214 53.31 27.65 59.63 3 ALL_TRUSTED 319056 41.36 1.21 51.25 4 BAYES_50 308152 47.36 38.65 49.50 5 HTML_MESSAGE 306090 58.64 97.09 49.17 6 RELAYCOUNTRY_US 291619 53.46 80.29 46.85 7 ANY_BOUNCE_MESSAGE 281786 36.75 2.18 45.27 8 BOUNCE_MESSAGE 281777 36.75 2.18 45.27 9 DKIM_SIGNED 269474 52.83 91.58 43.29 10 XM_DK_Pass 264662 51.55 88.22 42.52 11 DKIM_VALID 260933 50.84 87.05 41.92 12 DCC_CHECK 251075 46.66 72.33 40.33 13 XM_B_Unicode 247724 48.73 85.01 39.80 14 DKIM_VALID_AU 206892 39.45 64.69 33.24 15 XMListUnsubscribeExists 178373 37.49 73.35 28.65 16 BAYES_00 167043 21.69 0.80 26.83 17 XM_B_SpammyWords 158061 34.53 71.65 25.39 18 FSL_BULK_SIG 147122 20.52 7.88 23.63 19 SCC_BODY_URI_ONLY 143838 18.73 0.97 23.11 20 XM_B_Unicode3 143838 27.33 44.49 23.11 21 T_TM2_M_HEADER_IN_MSG 106578 18.34 23.28 17.12 22 RCVD_IN_MSPIKE_H2 102415 19.29 30.80 16.45 23 DKIM_VALID_EF 101633 19.39 31.85 16.33 24 HTML_FONT_LOW_CONTRAST 100313 20.09 36.21 16.11 25 LOC_TINY_FONT_1 92438 20.07 41.27 14.85 26 FVGT_m_MULTI_ODD 91743 18.50 33.78 14.74 27 XMLngstWrd_00 91302 11.98 1.05 14.67 28 XMSubLong 79168 14.98 24.19 12.72 29 T_KAM_HTML_FONT_INVALID 75674 15.50 29.07 12.16 30 MIME_HTML_ONLY 66726 14.53 30.01 10.72 31 XM_B_SpammyWords2 65353 16.54 41.09 10.50 32 BAYES_40 52217 7.04 1.56 8.39 33 XM_Multi_Part_URI 50064 10.46 20.28 8.04 34 USER_IN_DEF_DKIM_WL 48088 6.75 2.79 7.73 35 TR_XM_DK_Unsub 47286 10.81 23.84 7.60 36 UNPARSEABLE_RELAY 39284 7.97 14.73 6.31 37 TooManyTo_001 32677 5.39 5.96 5.25 38 BAYES_60 32594 5.73 7.72 5.24 39 LotsOfNums_01 30956 5.40 7.12 4.97 40 XM_B_Unsub 28858 6.86 15.87 4.64 41 XM_Evil_Numbers_Gen 28328 5.54 9.56 4.55 42 XM_DKIMWhitelistDomains 27339 3.56 0.21 4.39 43 IN_ZIMBRA_NJ_WHITELIST 24537 3.18 0.07 3.94 44 TR_MAX_INTL_RELAY 24361 5.87 13.82 3.91 45 XM_H_GMP 23754 4.01 4.81 3.82 46 TR_XM_BayesUnsub 23608 6.08 15.35 3.79 47 TR_XM_DK_Bayes 22664 3.03 0.57 3.64 48 TR_XM_DK_Bayes1 22318 2.99 0.57 3.59 49 RCVD_IN_MSPIKE_WL 22225 4.53 8.45 3.57 50 RCVD_IN_MSPIKE_H3 22224 4.53 8.45 3.57 51 LOTS_OF_MONEY 21480 5.61 14.36 3.45 52 XM_DK_Undo_02 21064 11.81 46.03 3.38 53 T_TooManySym_01 20272 3.31 3.52 3.26 54 TR_XM_DK_Bayes2 19286 2.58 0.49 3.10 55 MIME_QP_LONG_LINE 18591 3.12 3.67 2.99 56 XM_H_Long_From01 18036 3.28 4.83 2.90 57 HTML_IMAGE_RATIO_02 17386 3.68 7.28 2.79 58 XM_PDF 16778 2.29 0.62 2.70 59 RCVD_IN_IADB_LISTED 16414 2.44 1.66 2.64 60 BAYES_99 16255 9.17 35.79 2.61 61 XM_B_SpammyWords3 16212 4.83 13.85 2.60 62 RCVD_IN_VALIDITY_SAFE 15696 2.70 3.42 2.52 63 XMStrtUSub 15654 2.69 3.40 2.51 64 HTML_IMAGE_RATIO_04 15467 2.94 4.80 2.48 65 BOTNET_IPINHOSTNAME 14905 4.83 14.72 2.39 66 BAYES_80 14776 3.61 8.61 2.37 67 RELAYCOUNTRY_META 14758 5.88 20.14 2.37 68 RCVD_IN_IADB_SPF 14563 2.17 1.48 2.34 69 TR_XM_SpammyWords4 14418 4.39 12.83 2.32 70 RCVD_IN_VALIDITY_CERTIFIED 13358 2.26 2.70 2.15 71 T_REMOTE_IMAGE 13119 2.05 1.82 2.11 72 RCVD_IN_IADB_SENDERID 13103 1.96 1.39 2.10 73 XM_B_Phish_Phrases 12895 2.68 5.17 2.07 74 MPART_ALT_DIFF 12891 2.86 6.09 2.07 75 RCVD_IN_IADB_DK 12769 1.92 1.41 2.05 76 XM_UncommonTLD01 12673 2.86 6.18 2.04 77 XMSubMetaSx_00 12547 2.75 5.72 2.02 78 BAYES_999 12111 7.06 27.83 1.95 79 BAYES_20 12002 1.79 1.25 1.93 80 XM_SPF_SoftFail 11780 2.50 4.96 1.89 81 HTML_IMAGE_RATIO_06 11168 2.38 4.78 1.79 82 MAILING_LIST_MULTI 10677 1.79 2.09 1.72 83 RCVD_IN_IADB_VOUCHED 10053 1.44 0.73 1.61 84 TooManyTo_002 9943 1.50 1.09 1.60 85 BAYES_05 9873 1.41 0.71 1.59 86 XMNumbers 9811 1.91 3.25 1.58 87 BAYES_95 9577 2.20 4.91 1.54 88 T_TooManySym_02 9519 1.39 0.83 1.53 89 XM_Body_Dirty_Words 9149 2.53 6.86 1.47 90 TR_XM_DKIM_Undo 8745 7.92 34.37 1.40 91 TR_XM_SpammyRelay 8602 4.33 16.31 1.38 92 DKIM_INVALID 8541 2.00 4.53 1.37 93 XM_B_SpammyTLD 8496 1.73 3.22 1.36 94 MIME_HTML_MOSTLY 8197 1.75 3.51 1.32 95 HTML_IMAGE_RATIO_08 8170 1.86 4.11 1.31 96 FROM_EXCESS_BASE64 7366 1.30 1.75 1.18 97 MIME_HTML_ONLY_MULTI 7360 1.60 3.31 1.18 98 XM_CamelCaseFrm001 7258 1.53 2.99 1.17 99 XM_DK_Undo_01 7169 1.26 1.72 1.15 100 HELO_NODOT 7049 0.97 0.30 1.13 101 HELO_NO_DOMAIN 7042 0.97 0.30 1.13 102 INVALID_MSGID 6996 0.93 0.14 1.12 103 RCVD_IN_IADB_OPTIN 6920 0.98 0.47 1.11 104 TO_MALFORMED 6877 0.89 0.02 1.10 105 HTML_MIME_NO_HTML_TAG 6876 1.16 1.38 1.10 106 TR_XM_UnparsRelay 6614 2.46 8.14 1.06 107 T_XMDrugObfuBody_14 6589 1.64 3.99 1.06 108 XM_B_Investor 6481 1.80 4.86 1.04 109 MSGID_NOFQDN1 6425 0.84 0.04 1.03 110 XMDiploma_00 6112 1.31 2.62 0.98 111 T_XMDrugObfuBody_08 5993 1.41 3.24 0.96 112 TVD_RCVD_IP 5888 0.92 0.82 0.95 113 TR_Symld_Words 5797 0.98 1.18 0.93 114 URI_NOVOWEL 5753 0.93 0.94 0.92 115 TM2_M_URI_OPT_OUT 5704 1.67 4.71 0.92 116 UNTRUSTED_Relay 5702 1.95 6.13 0.92 117 TR_XM_PhishingBody 5606 1.47 3.80 0.90 118 TooManyTo_003 5509 0.90 0.96 0.88 119 XM_B_Unsub2 5382 1.13 2.22 0.86 120 XMGappySubj_01 5367 0.75 0.27 0.86 121 XMSexyCombo_05 5316 1.56 4.40 0.85 122 TR_DCC_Bayes_99 5211 5.67 25.28 0.84 123 XM_SendGrid 5089 0.94 1.46 0.82 124 IN_HORDE_ADDRESS_BOOK 4989 0.65 0.05 0.80 125 SUBJ_ALL_CAPS 4897 1.24 3.07 0.79 126 BOTNET 4594 2.52 9.73 0.74 127 XM_OfRef6 4501 1.43 4.29 0.72 128 RELAYCOUNTRY_CA 4441 2.70 10.79 0.71 129 XM_GoogleGroups 4325 0.66 0.53 0.69 130 XMCapTrack 4310 0.62 0.34 0.69 131 XMBSHREFv2 4282 0.60 0.25 0.69 132 KHOP_HELO_FCRDNS 4273 0.82 1.34 0.69 133 XMBody_95 4268 0.59 0.20 0.69 134 TR_XM_SpammyWords5 4204 1.34 4.05 0.68 135 TM2_M_VERY_LONG_WORD 4103 1.16 3.20 0.66 136 TooManyTo_004 4043 0.70 0.90 0.65 137 URI_HEX 3941 0.86 1.76 0.63 138 XM_H_Long_From02 3871 0.83 1.66 0.62 139 TVD_SPACE_RATIO 3815 0.51 0.10 0.61 140 T_FILL_THIS_FORM_SHORT 3565 1.18 3.65 0.57 141 HTTPS_HTTP_MISMATCH 3488 0.69 1.20 0.56 142 XM_UB50 3444 1.04 3.01 0.55 143 T_TooManySym_03 3386 0.51 0.35 0.54 144 DKIM_ADSP_CUSTOM_MED 3254 0.63 1.05 0.52 145 TR_XM_DK_SendGrid 3218 0.56 0.75 0.52 146 TooManyTo_005 3208 0.58 0.85 0.52 147 XMGenDplmaNmb 3116 0.66 1.30 0.50 148 XMGappySubj_02 3038 0.43 0.18 0.49 149 XM_H_Trusted_IP 3031 0.39 0.00 0.49 150 TR_MetaPhish_Combo_01 2937 0.56 0.93 0.47 151 TR_XM_Base64_M1 2914 0.56 0.92 0.47 152 XMStockSpam_06 2826 0.70 1.72 0.45 153 SpammyFromTLD_01 2810 0.87 2.57 0.45 154 XM_B_SpammyWords4 2669 0.81 2.36 0.43 155 XMNoVowels 2611 0.42 0.44 0.42 156 TR_XM_SpammyWords2 2541 2.97 13.40 0.41 157 XM_H_PHPMailer 2540 0.46 0.66 0.41 158 T_OBFU_PDF_ATTACH 2531 0.35 0.12 0.41 159 XMBdyGiftCard01 2521 0.56 1.19 0.40 160 XM_B_COPY_HTML 2506 0.49 0.84 0.40 161 XMBrknScrpt_02 2502 0.68 1.80 0.40 162 RELAYCOUNTRY_AU 2487 0.77 2.26 0.40 163 T_XMDrugObfuBody_00 2462 0.56 1.21 0.40 164 XM_ShortIntro_01 2398 0.47 0.81 0.39 165 RCVD_IN_BL_SPAMCOP_NET 2340 2.62 11.72 0.38 166 MPART_ALT_DIFF_COUNT 2301 0.52 1.11 0.37 167 XMSubMetaI_00 2275 0.53 1.19 0.37 168 SHORT_HELO_AND_INLINE_IMAGE 2235 0.30 0.04 0.36 169 NML_ADSP_CUSTOM_MED 2233 0.46 0.88 0.36 170 FROM_GOV_DKIM_AU 2231 0.31 0.10 0.36 171 URI_TRY_3LD 2209 0.64 1.78 0.35 172 XM_ProductURIs 2182 0.46 0.93 0.35 173 XMMoneyMeta_00 2109 0.41 0.71 0.34 174 T_Symld_Words_02 2081 0.46 0.95 0.33 175 XM_B_FormFill 2077 0.28 0.05 0.33 176 HTML_TAG_BALANCE_BODY 2073 0.51 1.22 0.33 177 XMBody_17 2067 1.33 5.39 0.33 178 XMSubNoVowel 2033 0.34 0.39 0.33 179 USER_IN_WELCOMELIST 1954 0.25 0.00 0.31 180 USER_IN_WHITELIST 1954 0.25 0.00 0.31 181 FILL_THIS_FORM 1947 0.35 0.50 0.31 182 RCVD_IN_PSBL 1867 0.35 0.54 0.30 183 FORGED_GMAIL_RCVD 1851 0.40 0.79 0.30 184 XMPhish30 1830 0.49 1.28 0.29 185 TR_LOTS_OF_MONEY3 1719 0.72 2.50 0.28 186 HTML_IMAGE_ONLY_28 1676 0.30 0.42 0.27 187 XMHTMLBadTable_001 1657 0.46 1.23 0.27 188 TO_NO_BRKTS_HTML_ONLY 1636 0.25 0.20 0.26 189 GMD_PDF_EMPTY_BODY 1630 0.22 0.05 0.26 190 T_XMHurry_00 1625 0.47 1.33 0.26 191 PLING_QUERY 1618 0.42 1.07 0.26 192 RELAYCOUNTRY_GB 1613 0.35 0.73 0.26 193 HTML_IMAGE_ONLY_32 1600 0.23 0.14 0.26 194 TR_XM_PHPForged 1590 0.51 1.54 0.26 195 DIET_1 1569 0.45 1.25 0.25 196 TR_XM_PHPDW 1559 0.51 1.56 0.25 197 TR_XM_FormFill2 1553 0.50 1.50 0.25 198 XMSubMetaSxObfu_02 1515 0.28 0.45 0.24 199 TR_XM_SPAMCOP 1511 2.09 9.59 0.24 200 XM_H_PHPOS 1494 0.49 1.50 0.24 ----------------------------------------------------------------------