Email: 600037 Autolearn: 0 AvgScore: 3.14 AvgScanTime: 1.35 sec Spam: 150734 Autolearn: 0 AvgScore: 13.01 AvgScanTime: 1.64 sec Ham: 449303 Autolearn: 0 AvgScore: -0.17 AvgScanTime: 1.25 sec Time Spent Running SA: 224.81 hours Time Spent Processing Spam: 68.67 hours Time Spent Processing Ham: 156.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 150430 99.56 99.80 99.48 2 HTML_MESSAGE 146358 75.76 97.10 68.60 3 DKIM_SIGNED 138132 67.52 91.64 59.43 4 XM_DK_Pass 132469 65.81 87.88 58.41 5 DKIM_VALID 130819 64.96 86.79 57.64 6 XM_B_Unicode 129192 63.84 85.71 56.51 7 RELAYCOUNTRY_US 122556 67.55 81.31 62.93 8 XMListUnsubscribeExists 109501 48.05 72.65 39.80 9 DCC_CHECK 108915 45.93 72.26 37.10 10 XM_B_SpammyWords 108306 45.01 71.85 36.01 11 DKIM_VALID_AU 97625 50.84 64.77 46.17 12 XM_B_Unicode3 70610 35.23 46.84 31.33 13 XM_DK_Undo_02 66983 14.55 44.44 4.52 14 LOC_TINY_FONT_1 65060 26.10 43.16 20.37 15 XM_B_SpammyWords2 63567 22.90 42.17 16.44 16 BAYES_50 58283 50.94 38.67 55.06 17 HTML_FONT_LOW_CONTRAST 54622 26.03 36.24 22.61 18 BAYES_99 52058 11.22 34.54 3.40 19 FVGT_m_MULTI_ODD 51107 23.85 33.91 20.47 20 TR_XM_DKIM_Undo 49511 9.62 32.85 1.82 21 DKIM_VALID_EF 47670 24.93 31.63 22.69 22 RCVD_IN_MSPIKE_H2 47331 25.02 31.40 22.87 23 MIME_HTML_ONLY 45508 18.24 30.19 14.23 24 T_KAM_HTML_FONT_INVALID 43827 19.99 29.08 16.95 25 DCC_CHECK_NEGATIVE 41804 54.04 27.73 62.87 26 BAYES_999 40058 8.60 26.58 2.57 27 TR_DCC_Bayes_99 36119 6.84 23.96 1.09 28 XMSubLong 35258 18.86 23.39 17.34 29 T_TM2_M_HEADER_IN_MSG 35124 24.15 23.30 24.44 30 TR_XM_DK_Unsub 34894 13.99 23.15 10.92 31 XM_Multi_Part_URI 29791 12.90 19.76 10.60 32 RELAYCOUNTRY_META 28975 7.36 19.22 3.39 33 XM_B_Unsub 24806 9.05 16.46 6.57 34 TR_XM_BayesUnsub 23795 7.86 15.79 5.20 35 LOTS_OF_MONEY 22971 8.69 15.24 6.50 36 TR_XM_SpammyRelay 22508 5.21 14.93 1.95 37 TR_MAX_INTL_RELAY 22400 7.76 14.86 5.37 38 BOTNET_IPINHOSTNAME 22226 6.20 14.75 3.33 39 UNPARSEABLE_RELAY 21166 10.41 14.04 9.19 40 TR_XM_SpammyWords4 20719 7.11 13.75 4.88 41 XM_B_SpammyWords3 20231 5.95 13.42 3.45 42 TR_XM_SpammyWords2 19291 3.54 12.80 0.43 43 RCVD_IN_BL_SPAMCOP_NET 18130 3.49 12.03 0.63 44 TR_XM_SPAMCOP 14908 2.75 9.89 0.35 45 RELAYCOUNTRY_CA 14787 3.38 9.81 1.22 46 BOTNET 14742 3.18 9.78 0.97 47 XM_Evil_Numbers_Gen 14606 6.55 9.69 5.49 48 BAYES_80 13842 4.77 9.18 3.29 49 BAYES_60 12092 7.39 8.02 7.18 50 RCVD_IN_MSPIKE_H3 11713 5.76 7.77 5.09 51 RCVD_IN_MSPIKE_WL 11713 5.76 7.77 5.09 52 FSL_BULK_SIG 11355 12.28 7.53 13.87 53 TR_XM_UnparsRelay 11233 2.95 7.45 1.44 54 HTML_IMAGE_RATIO_02 10667 4.76 7.08 3.98 55 XM_Body_Dirty_Words 10538 3.33 6.99 2.11 56 LotsOfNums_01 10504 6.72 6.97 6.64 57 XMSubMetaSx_00 9916 3.72 6.58 2.76 58 MPART_ALT_DIFF 9563 3.61 6.34 2.70 59 TooManyTo_001 8665 6.36 5.75 6.56 60 XM_UncommonTLD01 8643 3.69 5.73 3.01 61 UNTRUSTED_Relay 8359 2.30 5.55 1.21 62 BAYES_95 8112 2.91 5.38 2.09 63 XMBody_17 7769 1.67 5.15 0.50 64 XM_SPF_SoftFail 7727 3.19 5.13 2.53 65 XM_B_Phish_Phrases 7633 3.11 5.06 2.45 66 HTML_IMAGE_RATIO_04 7450 3.68 4.94 3.26 67 XM_H_Long_From01 7415 4.48 4.92 4.34 68 HTML_IMAGE_RATIO_06 7388 3.05 4.90 2.43 69 DKIM_INVALID 7313 2.56 4.85 1.79 70 XM_H_GMP 7229 4.91 4.80 4.95 71 XM_B_Investor 6604 2.22 4.38 1.49 72 T_XMDrugObfuBody_14 6526 2.13 4.33 1.39 73 XMSexyCombo_05 6376 1.81 4.23 1.00 74 TM2_M_URI_OPT_OUT 6326 2.06 4.20 1.34 75 TR_XM_SpammyWords5 6239 1.77 4.14 0.98 76 TR_XM_PhishingBody 6023 2.10 4.00 1.46 77 XM_OfRef6 5634 1.66 3.74 0.96 78 MIME_HTML_ONLY_MULTI 5577 2.03 3.70 1.46 79 TM2_M_VERY_LONG_WORD 5508 1.80 3.65 1.17 80 XM_B_SpammyTLD 5497 2.52 3.65 2.14 81 HTML_IMAGE_RATIO_08 5484 2.14 3.64 1.64 82 XMStrtUSub 5351 3.59 3.55 3.60 83 MIME_HTML_MOSTLY 5344 2.23 3.55 1.79 84 MIME_QP_LONG_LINE 5253 3.95 3.48 4.10 85 XMNumbers 5243 2.48 3.48 2.14 86 TR_LOTS_OF_MONEY3 4763 1.07 3.16 0.37 87 USER_IN_DEF_DKIM_WL 4697 8.41 3.12 10.18 88 T_XMDrugObfuBody_08 4555 1.81 3.02 1.40 89 XM_CamelCaseFrm001 4546 2.05 3.02 1.72 90 RCVD_IN_VALIDITY_SAFE 4507 3.72 2.99 3.96 91 T_FILL_THIS_FORM_SHORT 4447 1.29 2.95 0.73 92 XM_URI_RBL 4317 0.81 2.86 0.13 93 SUBJ_ALL_CAPS 4293 1.56 2.85 1.13 94 XM_UB50 4109 1.26 2.73 0.76 95 RELAYCOUNTRY_AU 3880 1.06 2.57 0.55 96 RCVD_IN_VALIDITY_CERTIFIED 3841 3.22 2.55 3.45 97 XM_B_SpammyWords4 3819 1.02 2.53 0.51 98 XMDiploma_00 3775 1.68 2.50 1.40 99 XM_B_Unsub2 3574 1.57 2.37 1.30 100 SpammyFromTLD_01 3550 1.13 2.36 0.72 101 ANY_BOUNCE_MESSAGE 3367 18.40 2.23 23.82 102 BOUNCE_MESSAGE 3364 18.40 2.23 23.82 103 TR_XM_NoHeaderRelay 3357 0.62 2.23 0.08 104 T_TooManySym_01 3348 3.59 2.22 4.05 105 TR_XM_BayesRelay 3266 0.54 2.17 0.00 106 URI_HEX 2948 1.20 1.96 0.95 107 HTML_MIME_NO_HTML_TAG 2928 1.73 1.94 1.66 108 MAILING_LIST_MULTI 2842 2.12 1.89 2.20 109 FROM_EXCESS_BASE64 2818 1.46 1.87 1.33 110 TR_XM_FormFill 2801 0.48 1.86 0.02 111 TR_XM_INV_DKIM 2739 0.49 1.82 0.05 112 XM_H_Long_From02 2689 1.11 1.78 0.89 113 URI_TRY_3LD 2551 0.86 1.69 0.58 114 BAYES_40 2501 5.64 1.66 6.97 115 T_XMDrugObfuBody_00 2468 0.79 1.64 0.51 116 XMStockSpam_06 2452 0.92 1.63 0.68 117 SpammyFromTLD_02 2382 0.60 1.58 0.27 118 XM_DK_Undo_01 2375 1.52 1.58 1.51 119 XMBrknScrpt_02 2304 0.83 1.53 0.59 120 FONT_INVIS_LONG_LINE 2286 0.42 1.52 0.05 121 TR_XM_PHPForged 2274 0.59 1.51 0.29 122 XM_HighProb1 2255 0.38 1.50 0.01 123 T_REMOTE_IMAGE 2234 2.53 1.48 2.89 124 XM_SendGrid 2231 1.23 1.48 1.15 125 TR_XM_PHPDW 2205 0.58 1.46 0.28 126 TR_XM_FormFill2 2165 0.58 1.44 0.29 127 XM_H_PHPOS 2152 0.57 1.43 0.28 128 ALL_TRUSTED 2042 25.99 1.35 34.26 129 DKIM_ADSP_NXDOMAIN 2009 0.51 1.33 0.23 130 XMBdyGiftCard01 2008 0.62 1.33 0.38 131 THIS_AD 2005 0.62 1.33 0.39 132 XMGenDplmaNmb 1987 0.93 1.32 0.80 133 MPART_ALT_DIFF_COUNT 1970 0.79 1.31 0.62 134 TR_Mismatch_TLD_02 1938 0.37 1.29 0.06 135 AC_BR_BONANZA 1926 0.38 1.28 0.09 136 BAYES_20 1892 2.28 1.26 2.63 137 XMReplyNow 1888 0.46 1.25 0.20 138 XMPhish30 1850 0.70 1.23 0.53 139 PLING_QUERY 1845 0.59 1.22 0.37 140 TR_Caps_n_Bayes_99 1836 0.33 1.22 0.04 141 RCVD_IN_IADB_LISTED 1815 2.62 1.20 3.10 142 KHOP_HELO_FCRDNS 1794 0.92 1.19 0.83 143 T_XMHurry_00 1788 0.60 1.19 0.40 144 RCVD_IN_VALIDITY_RPBL 1741 0.32 1.16 0.04 145 HK_RANDOM_REPLYTO 1689 0.35 1.12 0.09 146 XMPhish14 1683 0.56 1.12 0.37 147 XMHTML_After_End 1664 0.49 1.10 0.28 148 HTTPS_HTTP_MISMATCH 1656 0.80 1.10 0.69 149 HTML_TAG_BALANCE_BODY 1656 0.66 1.10 0.51 150 TR_LOTS_OF_MONEY2 1606 0.43 1.07 0.22 151 T_MONEY_PERCENT 1606 0.43 1.07 0.22 152 RCVD_IN_IADB_SPF 1593 2.30 1.06 2.72 153 RDNS_DYNAMIC 1513 0.41 1.00 0.21 154 DKIM_ADSP_CUSTOM_MED 1508 0.80 1.00 0.73 155 XM_H_Undi_Recip 1497 0.34 0.99 0.12 156 HTML_FONT_FACE_BAD 1476 0.49 0.98 0.32 157 RCVD_IN_IADB_DK 1472 2.01 0.98 2.35 158 XM_B_Phish66 1457 0.41 0.97 0.22 159 RCVD_IN_IADB_SENDERID 1453 2.05 0.96 2.41 160 BOTNET_NORDNS 1448 0.25 0.96 0.01 161 XM_DIRTYINTL 1406 0.28 0.93 0.06 162 XMBody_78 1404 0.39 0.93 0.21 163 TR_XM_Base64_M1 1403 0.70 0.93 0.62 164 TR_XM_InvalidRelay 1397 0.27 0.93 0.05 165 RELAYCOUNTRY_FR 1395 0.37 0.93 0.19 166 XM_B_DNDMA 1392 0.38 0.92 0.20 167 TR_XM_DK_SendGrid 1372 0.83 0.91 0.80 168 XMMoneyMeta_00 1372 0.56 0.91 0.44 169 XMSubMetaSxObfu_03 1361 0.42 0.90 0.25 170 TR_Symld_Words 1360 1.03 0.90 1.08 171 XM_ProductURIs 1354 0.63 0.90 0.53 172 HOSTED_IMG_MULTI_PUB_01 1354 0.24 0.90 0.01 173 URI_NOVOWEL 1342 1.14 0.89 1.22 174 TooManyTo_002 1341 1.64 0.89 1.90 175 T_STY_INVIS_DIRECT 1323 0.34 0.88 0.16 176 XM_B_SEO 1322 0.38 0.88 0.21 177 SCC_BODY_URI_ONLY 1312 9.67 0.87 12.62 178 TVD_RCVD_IP 1298 1.11 0.86 1.20 179 XMSexyCombo_01 1294 0.39 0.86 0.24 180 RELAYCOUNTRY_CN 1275 0.26 0.85 0.06 181 XM_UB60 1262 0.25 0.84 0.05 182 XMSubMetaI_00 1253 0.58 0.83 0.50 183 TR_MetaPhish_Combo_01 1251 0.64 0.83 0.57 184 TM2_M_OBFU_COMMENT 1236 0.34 0.82 0.18 185 LongTLD 1223 0.41 0.81 0.28 186 XM_UB99 1205 0.20 0.80 0.00 187 TR_XM_SEO4 1202 0.29 0.80 0.13 188 NML_ADSP_CUSTOM_MED 1195 0.57 0.79 0.50 189 TR_XM_Base64_L1 1189 0.31 0.79 0.15 190 TR_XM_Undi_Recip19 1172 0.23 0.78 0.04 191 RELAYCOUNTRY_GB 1161 0.43 0.77 0.32 192 TM2_M_A_HREF_HREF 1135 0.31 0.75 0.17 193 FORGED_GMAIL_RCVD 1135 0.50 0.75 0.41 194 T_TooManySym_02 1125 1.68 0.75 1.99 195 XM_B_COVIDMETA 1117 0.37 0.74 0.25 196 TooManyTo_003 1100 0.99 0.73 1.08 197 HELO_DYNAMIC_SPLIT_IP 1093 0.18 0.73 0.00 198 XM_B_COPY_HTML 1088 0.56 0.72 0.51 199 AC_HTML_NONSENSE_TAGS 1077 0.20 0.71 0.03 200 DIET_1 1075 0.30 0.71 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 446974 99.56 99.80 99.48 2 HTML_MESSAGE 308240 75.76 97.10 68.60 3 RELAYCOUNTRY_US 282739 67.55 81.31 62.93 4 DCC_CHECK_NEGATIVE 282464 54.04 27.73 62.87 5 DKIM_SIGNED 267002 67.52 91.64 59.43 6 XM_DK_Pass 262422 65.81 87.88 58.41 7 DKIM_VALID 258958 64.96 86.79 57.64 8 XM_B_Unicode 253891 63.84 85.71 56.51 9 BAYES_50 247401 50.94 38.67 55.06 10 DKIM_VALID_AU 207450 50.84 64.77 46.17 11 XMListUnsubscribeExists 178825 48.05 72.65 39.80 12 DCC_CHECK 166672 45.93 72.26 37.10 13 XM_B_SpammyWords 161798 45.01 71.85 36.01 14 ALL_TRUSTED 153916 25.99 1.35 34.26 15 XM_B_Unicode3 140778 35.23 46.84 31.33 16 T_TM2_M_HEADER_IN_MSG 109809 24.15 23.30 24.44 17 ANY_BOUNCE_MESSAGE 107043 18.40 2.23 23.82 18 BOUNCE_MESSAGE 107023 18.40 2.23 23.82 19 RCVD_IN_MSPIKE_H2 102769 25.02 31.40 22.87 20 DKIM_VALID_EF 101943 24.93 31.63 22.69 21 HTML_FONT_LOW_CONTRAST 101591 26.03 36.24 22.61 22 FVGT_m_MULTI_ODD 91993 23.85 33.91 20.47 23 LOC_TINY_FONT_1 91536 26.10 43.16 20.37 24 XMSubLong 77889 18.86 23.39 17.34 25 BAYES_00 77604 13.09 0.61 17.27 26 T_KAM_HTML_FONT_INVALID 76137 19.99 29.08 16.95 27 XM_B_SpammyWords2 73856 22.90 42.17 16.44 28 MIME_HTML_ONLY 63938 18.24 30.19 14.23 29 FSL_BULK_SIG 62300 12.28 7.53 13.87 30 SCC_BODY_URI_ONLY 56717 9.67 0.87 12.62 31 TR_XM_DK_Unsub 49079 13.99 23.15 10.92 32 XM_Multi_Part_URI 47630 12.90 19.76 10.60 33 USER_IN_DEF_DKIM_WL 45751 8.41 3.12 10.18 34 UNPARSEABLE_RELAY 41309 10.41 14.04 9.19 35 BAYES_60 32249 7.39 8.02 7.18 36 BAYES_40 31334 5.64 1.66 6.97 37 LotsOfNums_01 29844 6.72 6.97 6.64 38 XM_B_Unsub 29525 9.05 16.46 6.57 39 TooManyTo_001 29487 6.36 5.75 6.56 40 LOTS_OF_MONEY 29192 8.69 15.24 6.50 41 XM_DKIMWhitelistDomains 26600 4.44 0.02 5.92 42 XM_Evil_Numbers_Gen 24674 6.55 9.69 5.49 43 IN_ZIMBRA_NJ_WHITELIST 24206 4.06 0.09 5.39 44 TR_MAX_INTL_RELAY 24147 7.76 14.86 5.37 45 TR_XM_BayesUnsub 23362 7.86 15.79 5.20 46 RCVD_IN_MSPIKE_H3 22862 5.76 7.77 5.09 47 RCVD_IN_MSPIKE_WL 22862 5.76 7.77 5.09 48 XM_H_GMP 22239 4.91 4.80 4.95 49 TR_XM_SpammyWords4 21925 7.11 13.75 4.88 50 TR_XM_DK_Bayes 21616 3.72 0.45 4.81 51 TR_XM_DK_Bayes1 21325 3.67 0.44 4.75 52 XM_DK_Undo_02 20308 14.55 44.44 4.52 53 XM_H_Long_From01 19486 4.48 4.92 4.34 54 TR_XM_DK_Bayes2 18733 3.21 0.36 4.17 55 MIME_QP_LONG_LINE 18425 3.95 3.48 4.10 56 T_TooManySym_01 18195 3.59 2.22 4.05 57 HTML_IMAGE_RATIO_02 17883 4.76 7.08 3.98 58 RCVD_IN_VALIDITY_SAFE 17801 3.72 2.99 3.96 59 XMStrtUSub 16162 3.59 3.55 3.60 60 XM_PDF 15878 2.78 0.54 3.53 61 RCVD_IN_VALIDITY_CERTIFIED 15508 3.22 2.55 3.45 62 XM_B_SpammyWords3 15480 5.95 13.42 3.45 63 BAYES_99 15274 11.22 34.54 3.40 64 RELAYCOUNTRY_META 15211 7.36 19.22 3.39 65 BOTNET_IPINHOSTNAME 14953 6.20 14.75 3.33 66 BAYES_80 14763 4.77 9.18 3.29 67 HTML_IMAGE_RATIO_04 14641 3.68 4.94 3.26 68 RCVD_IN_IADB_LISTED 13917 2.62 1.20 3.10 69 XM_UncommonTLD01 13506 3.69 5.73 3.01 70 T_REMOTE_IMAGE 12970 2.53 1.48 2.89 71 XMSubMetaSx_00 12395 3.72 6.58 2.76 72 RCVD_IN_IADB_SPF 12214 2.30 1.06 2.72 73 MPART_ALT_DIFF 12115 3.61 6.34 2.70 74 BAYES_20 11802 2.28 1.26 2.63 75 BAYES_999 11566 8.60 26.58 2.57 76 XM_SPF_SoftFail 11385 3.19 5.13 2.53 77 XM_B_Phish_Phrases 11005 3.11 5.06 2.45 78 HTML_IMAGE_RATIO_06 10910 3.05 4.90 2.43 79 RCVD_IN_IADB_SENDERID 10839 2.05 0.96 2.41 80 RCVD_IN_IADB_DK 10567 2.01 0.98 2.35 81 MAILING_LIST_MULTI 9885 2.12 1.89 2.20 82 XM_B_SpammyTLD 9633 2.52 3.65 2.14 83 XMNumbers 9612 2.48 3.48 2.14 84 BAYES_05 9497 1.76 0.69 2.11 85 XM_Body_Dirty_Words 9469 3.33 6.99 2.11 86 BAYES_95 9379 2.91 5.38 2.09 87 RCVD_IN_IADB_VOUCHED 9253 1.70 0.62 2.06 88 T_TooManySym_02 8951 1.68 0.75 1.99 89 TR_XM_SpammyRelay 8776 5.21 14.93 1.95 90 TooManyTo_002 8517 1.64 0.89 1.90 91 TR_XM_DKIM_Undo 8186 9.62 32.85 1.82 92 MIME_HTML_MOSTLY 8063 2.23 3.55 1.79 93 DKIM_INVALID 8044 2.56 4.85 1.79 94 XM_CamelCaseFrm001 7749 2.05 3.02 1.72 95 HTML_MIME_NO_HTML_TAG 7456 1.73 1.94 1.66 96 HTML_IMAGE_RATIO_08 7385 2.14 3.64 1.64 97 INVALID_MSGID 7254 1.24 0.12 1.61 98 TO_MALFORMED 6892 1.16 0.03 1.53 99 XM_DK_Undo_01 6771 1.52 1.58 1.51 100 MSGID_NOFQDN1 6751 1.13 0.03 1.50 101 XM_B_Investor 6709 2.22 4.38 1.49 102 TR_XM_PhishingBody 6582 2.10 4.00 1.46 103 MIME_HTML_ONLY_MULTI 6576 2.03 3.70 1.46 104 TR_XM_UnparsRelay 6463 2.95 7.45 1.44 105 RCVD_IN_IADB_OPTIN 6371 1.16 0.39 1.42 106 XMDiploma_00 6293 1.68 2.50 1.40 107 T_XMDrugObfuBody_08 6284 1.81 3.02 1.40 108 HELO_NODOT 6282 1.13 0.31 1.40 109 HELO_NO_DOMAIN 6281 1.12 0.31 1.40 110 T_XMDrugObfuBody_14 6256 2.13 4.33 1.39 111 TM2_M_URI_OPT_OUT 6014 2.06 4.20 1.34 112 FROM_EXCESS_BASE64 5964 1.46 1.87 1.33 113 XM_B_Unsub2 5834 1.57 2.37 1.30 114 URI_NOVOWEL 5482 1.14 0.89 1.22 115 RELAYCOUNTRY_CA 5479 3.38 9.81 1.22 116 UNTRUSTED_Relay 5430 2.30 5.55 1.21 117 TVD_RCVD_IP 5385 1.11 0.86 1.20 118 TM2_M_VERY_LONG_WORD 5277 1.80 3.65 1.17 119 XM_SendGrid 5160 1.23 1.48 1.15 120 SUBJ_ALL_CAPS 5065 1.56 2.85 1.13 121 IN_HORDE_ADDRESS_BOOK 4966 0.85 0.08 1.11 122 TR_DCC_Bayes_99 4912 6.84 23.96 1.09 123 TooManyTo_003 4859 0.99 0.73 1.08 124 TR_Symld_Words 4833 1.03 0.90 1.08 125 XMGappySubj_01 4725 0.81 0.11 1.05 126 XMSexyCombo_05 4498 1.81 4.23 1.00 127 XMBSHREFv2 4465 0.82 0.30 0.99 128 TR_XM_SpammyWords5 4403 1.77 4.14 0.98 129 BOTNET 4359 3.18 9.78 0.97 130 XM_GoogleGroups 4327 0.86 0.56 0.96 131 XM_OfRef6 4321 1.66 3.74 0.96 132 URI_HEX 4280 1.20 1.96 0.95 133 XM_H_Long_From02 3982 1.11 1.78 0.89 134 XMBody_95 3930 0.76 0.43 0.87 135 XMCapTrack 3763 0.72 0.36 0.84 136 TVD_SPACE_RATIO 3754 0.66 0.13 0.84 137 KHOP_HELO_FCRDNS 3713 0.92 1.19 0.83 138 TR_XM_DK_SendGrid 3603 0.83 0.91 0.80 139 XMGenDplmaNmb 3578 0.93 1.32 0.80 140 TooManyTo_004 3515 0.75 0.67 0.78 141 XM_UB50 3434 1.26 2.73 0.76 142 T_FILL_THIS_FORM_SHORT 3299 1.29 2.95 0.73 143 DKIM_ADSP_CUSTOM_MED 3296 0.80 1.00 0.73 144 SpammyFromTLD_01 3237 1.13 2.36 0.72 145 T_TooManySym_03 3155 0.61 0.32 0.70 146 HTTPS_HTTP_MISMATCH 3121 0.80 1.10 0.69 147 XMStockSpam_06 3052 0.92 1.63 0.68 148 RCVD_IN_BL_SPAMCOP_NET 2834 3.49 12.03 0.63 149 XMGappySubj_02 2795 0.48 0.06 0.62 150 TR_XM_Base64_M1 2782 0.70 0.93 0.62 151 MPART_ALT_DIFF_COUNT 2766 0.79 1.31 0.62 152 TooManyTo_005 2762 0.62 0.62 0.61 153 T_Symld_Words_02 2696 0.62 0.69 0.60 154 XMBrknScrpt_02 2668 0.83 1.53 0.59 155 URI_TRY_3LD 2616 0.86 1.69 0.58 156 TR_MetaPhish_Combo_01 2560 0.64 0.83 0.57 157 XMNoVowels 2469 0.54 0.53 0.55 158 RELAYCOUNTRY_AU 2454 1.06 2.57 0.55 159 XM_H_PHPMailer 2431 0.58 0.71 0.54 160 XM_ProductURIs 2400 0.63 0.90 0.53 161 XMPhish30 2377 0.70 1.23 0.53 162 HTML_TAG_BALANCE_BODY 2309 0.66 1.10 0.51 163 XM_B_COPY_HTML 2293 0.56 0.72 0.51 164 T_XMDrugObfuBody_00 2287 0.79 1.64 0.51 165 XM_B_SpammyWords4 2281 1.02 2.53 0.51 166 FROM_GOV_DKIM_AU 2275 0.41 0.13 0.51 167 XM_ShortIntro_01 2257 0.50 0.48 0.50 168 NML_ADSP_CUSTOM_MED 2239 0.57 0.79 0.50 169 XMSubMetaI_00 2238 0.58 0.83 0.50 170 XMBody_17 2227 1.67 5.15 0.50 171 RCVD_IN_PSBL 2222 0.54 0.69 0.49 172 SHORT_HELO_AND_INLINE_IMAGE 2145 0.37 0.06 0.48 173 T_OBFU_PDF_ATTACH 2115 0.38 0.11 0.47 174 USER_IN_WHITELIST 2043 0.34 0.00 0.45 175 USER_IN_WELCOMELIST 2043 0.34 0.00 0.45 176 XMMoneyMeta_00 1959 0.56 0.91 0.44 177 TR_XM_SpammyWords2 1932 3.54 12.80 0.43 178 FILL_THIS_FORM 1912 0.39 0.27 0.43 179 FORGED_GMAIL_RCVD 1859 0.50 0.75 0.41 180 T_XMHurry_00 1802 0.60 1.19 0.40 181 THIS_AD 1742 0.62 1.33 0.39 182 TO_NO_BRKTS_HTML_ONLY 1736 0.36 0.30 0.39 183 XMBdyGiftCard01 1706 0.62 1.33 0.38 184 PLING_QUERY 1683 0.59 1.22 0.37 185 XMPhish14 1678 0.56 1.12 0.37 186 TR_LOTS_OF_MONEY3 1667 1.07 3.16 0.37 187 XM_B_FormFill 1663 0.31 0.13 0.37 188 TR_XM_SPAMCOP 1572 2.75 9.89 0.35 189 XMDateMe_00 1535 0.35 0.39 0.34 190 SHOPIFY_IMG_NOT_RCVD_SFY 1523 0.39 0.55 0.34 191 XMLngstWrd_00 1479 0.35 0.43 0.33 192 HTML_FONT_FACE_BAD 1445 0.49 0.98 0.32 193 HTML_IMAGE_ONLY_32 1425 0.27 0.13 0.32 194 RELAYCOUNTRY_GB 1420 0.43 0.77 0.32 195 HTML_IMAGE_ONLY_20 1409 0.38 0.59 0.31 196 TM2_M_BODY_EMPTY 1401 0.26 0.11 0.31 197 XMSubMetaSxObfu_02 1385 0.36 0.52 0.31 198 GMD_PDF_EMPTY_BODY 1385 0.25 0.07 0.31 199 RELAYCOUNTRY_DE 1299 0.32 0.42 0.29 200 TR_XM_FormFill2 1295 0.58 1.44 0.29 ----------------------------------------------------------------------