Email: 520906 Autolearn: 0 AvgScore: 4.21 AvgScanTime: 1.37 sec Spam: 169453 Autolearn: 0 AvgScore: 13.44 AvgScanTime: 1.50 sec Ham: 351453 Autolearn: 0 AvgScore: -0.25 AvgScanTime: 1.31 sec Time Spent Running SA: 198.25 hours Time Spent Processing Spam: 70.39 hours Time Spent Processing Ham: 127.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 169114 99.58 99.80 99.48 2 HTML_MESSAGE 164421 89.62 97.03 86.05 3 DKIM_SIGNED 154214 80.54 91.01 75.49 4 XM_DK_Pass 146632 78.10 86.53 74.03 5 DKIM_VALID 144794 77.08 85.45 73.04 6 XM_B_Unicode 144227 74.75 85.11 69.75 7 RELAYCOUNTRY_US 133912 80.45 79.03 81.14 8 DCC_CHECK 126218 46.97 74.49 33.70 9 XM_B_SpammyWords 123200 53.20 72.70 43.79 10 XMListUnsubscribeExists 121374 57.11 71.63 50.11 11 DKIM_VALID_AU 107507 59.54 63.44 57.66 12 XM_DK_Undo_02 77911 18.49 45.98 5.23 13 XM_B_Unicode3 75381 41.35 44.48 39.85 14 XM_B_SpammyWords2 74177 26.81 43.77 18.64 15 LOC_TINY_FONT_1 70127 30.10 41.38 24.66 16 BAYES_50 63213 52.27 37.30 59.49 17 HTML_FONT_LOW_CONTRAST 62641 31.14 36.97 28.32 18 BAYES_99 62516 14.73 36.89 4.05 19 TR_XM_DKIM_Undo 59033 12.69 34.84 2.01 20 FVGT_m_MULTI_ODD 55723 28.21 32.88 25.96 21 RCVD_IN_MSPIKE_H2 53933 30.42 31.83 29.74 22 MIME_HTML_ONLY 53838 22.58 31.77 18.15 23 DKIM_VALID_EF 52379 29.61 30.91 28.98 24 BAYES_999 49954 11.62 29.48 3.01 25 T_KAM_HTML_FONT_INVALID 47959 23.81 28.30 21.64 26 TR_DCC_Bayes_99 45758 9.79 27.00 1.49 27 DCC_CHECK_NEGATIVE 43206 53.00 25.50 66.26 28 XMSubLong 39175 22.31 23.12 21.92 29 TR_XM_DK_Unsub 38204 16.60 22.55 13.73 30 T_TM2_M_HEADER_IN_MSG 37675 26.81 22.23 29.02 31 RELAYCOUNTRY_META 36431 9.89 21.50 4.29 32 XM_Multi_Part_URI 35869 16.07 21.17 13.61 33 XM_B_Unsub 30031 10.98 17.72 7.73 34 LOTS_OF_MONEY 29496 9.98 17.41 6.39 35 TR_XM_BayesUnsub 29124 9.71 17.19 6.11 36 TR_XM_SpammyRelay 28923 7.10 17.07 2.30 37 TR_XM_SpammyWords4 27232 8.21 16.07 4.41 38 TR_XM_SpammyWords2 25748 5.28 15.19 0.49 39 TR_MAX_INTL_RELAY 24789 9.43 14.63 6.92 40 XM_B_SpammyWords3 23278 7.97 13.74 5.20 41 BOTNET_IPINHOSTNAME 22689 7.04 13.39 3.98 42 UNPARSEABLE_RELAY 22095 11.64 13.04 10.96 43 RCVD_IN_BL_SPAMCOP_NET 21332 4.48 12.59 0.56 44 RELAYCOUNTRY_CA 18482 4.52 10.91 1.44 45 TR_XM_SPAMCOP 18477 3.77 10.90 0.33 46 BOTNET 15826 3.83 9.34 1.17 47 FSL_BULK_SIG 15615 5.74 9.21 4.06 48 RCVD_IN_MSPIKE_H3 15552 7.28 9.18 6.37 49 RCVD_IN_MSPIKE_WL 15552 7.28 9.18 6.37 50 XM_Evil_Numbers_Gen 15528 7.80 9.16 7.15 51 BAYES_80 14978 5.75 8.84 4.26 52 BAYES_60 13214 8.87 7.80 9.39 53 TR_XM_UnparsRelay 12241 3.44 7.22 1.62 54 LotsOfNums_01 12202 8.32 7.20 8.85 55 XM_Body_Dirty_Words 11669 4.08 6.89 2.73 56 UNTRUSTED_Relay 11306 3.19 6.67 1.51 57 HTML_IMAGE_RATIO_02 11074 5.25 6.54 4.63 58 MPART_ALT_DIFF 10954 4.56 6.46 3.64 59 XMSubMetaSx_00 10950 4.59 6.46 3.69 60 XMBody_17 10381 2.52 6.13 0.78 61 XM_UncommonTLD01 9967 4.42 5.88 3.72 62 XM_B_Phish_Phrases 9467 3.95 5.59 3.16 63 DKIM_INVALID 9420 3.46 5.56 2.44 64 BAYES_95 9037 3.53 5.33 2.66 65 HTML_IMAGE_RATIO_06 8854 3.71 5.23 2.98 66 TooManyTo_001 8640 7.60 5.10 8.80 67 TR_LOTS_OF_MONEY3 8476 2.17 5.00 0.80 68 XM_B_Investor 8283 2.90 4.89 1.95 69 XM_SPF_SoftFail 8180 3.69 4.83 3.14 70 XMSexyCombo_05 8142 2.50 4.80 1.40 71 XM_H_Long_From01 7825 5.20 4.62 5.48 72 HTML_IMAGE_RATIO_04 7546 4.13 4.45 3.97 73 XM_OfRef6 7524 2.28 4.44 1.24 74 XM_H_GMP 7176 5.75 4.23 6.47 75 MIME_HTML_MOSTLY 6766 2.75 3.99 2.16 76 TR_XM_PhishingBody 6656 2.37 3.93 1.62 77 TM2_M_URI_OPT_OUT 6550 2.26 3.87 1.48 78 MIME_QP_LONG_LINE 6498 4.99 3.83 5.55 79 TR_XM_NoHeaderRelay 6435 1.34 3.80 0.16 80 TR_XM_SpammyWords5 6275 2.14 3.70 1.39 81 T_TooManySym_01 6162 5.04 3.64 5.71 82 XMStrtUSub 6152 3.88 3.63 4.00 83 USER_IN_DEF_DKIM_WL 6090 9.55 3.59 12.42 84 XM_UB50 5930 1.74 3.50 0.89 85 HTML_IMAGE_RATIO_08 5326 2.72 3.14 2.52 86 T_XMDrugObfuBody_14 5265 2.18 3.11 1.73 87 XMNumbers 5175 2.97 3.05 2.92 88 T_XMDrugObfuBody_08 5105 1.89 3.01 1.35 89 TM2_M_VERY_LONG_WORD 5063 1.82 2.99 1.25 90 MIME_HTML_ONLY_MULTI 5048 2.40 2.98 2.12 91 T_FILL_THIS_FORM_SHORT 5010 1.61 2.96 0.96 92 XM_B_SpammyTLD 4999 2.52 2.95 2.32 93 XM_B_Unsub2 4996 1.93 2.95 1.44 94 RCVD_IN_VALIDITY_SAFE 4834 4.09 2.85 4.69 95 XMDiploma_00 4690 2.23 2.77 1.97 96 XM_CamelCaseFrm001 4621 2.24 2.73 2.01 97 XMBrknScrpt_02 4605 1.45 2.72 0.84 98 ANY_BOUNCE_MESSAGE 4265 3.83 2.52 4.46 99 BOUNCE_MESSAGE 4263 3.83 2.52 4.46 100 TR_XM_BayesRelay 4055 0.78 2.39 0.00 101 RCVD_IN_VALIDITY_CERTIFIED 4036 3.54 2.38 4.10 102 XMStockSpam_06 4018 1.33 2.37 0.83 103 SpammyFromTLD_01 3872 1.26 2.28 0.77 104 SUBJ_ALL_CAPS 3822 1.76 2.26 1.53 105 FONT_INVIS_LONG_LINE 3809 0.75 2.25 0.03 106 RELAYCOUNTRY_AU 3794 1.19 2.24 0.68 107 FROM_EXCESS_BASE64 3635 1.77 2.15 1.59 108 XM_URI_RBL 3423 0.76 2.02 0.15 109 XM_B_SpammyWords4 3370 1.30 1.99 0.97 110 HTML_MIME_NO_HTML_TAG 3336 2.10 1.97 2.16 111 T_XMHurry_00 3320 1.04 1.96 0.59 112 TR_Symld_Words 3317 1.63 1.96 1.47 113 DKIM_ADSP_NXDOMAIN 3312 0.85 1.95 0.31 114 TR_XM_INV_DKIM 3304 0.68 1.95 0.06 115 RCVD_IN_VALIDITY_RPBL 3275 0.68 1.93 0.07 116 T_REMOTE_IMAGE 3157 3.05 1.86 3.62 117 MAILING_LIST_MULTI 3096 2.62 1.83 3.00 118 XM_B_SEO 3001 0.77 1.77 0.29 119 TR_XM_SEO4 2889 0.68 1.70 0.19 120 XM_DK_Undo_01 2885 1.78 1.70 1.82 121 XM_ProductURIs 2820 1.10 1.66 0.83 122 SpammyFromTLD_02 2743 0.82 1.62 0.44 123 ALL_TRUSTED 2739 10.92 1.62 15.41 124 BOTNET_NORDNS 2692 0.52 1.59 0.01 125 TR_XM_FormFill 2677 0.53 1.58 0.02 126 XMNoVowels 2596 0.96 1.53 0.69 127 RELAYCOUNTRY_RU 2580 0.51 1.52 0.03 128 BAYES_40 2540 3.69 1.50 4.74 129 URI_TRY_3LD 2457 0.98 1.45 0.76 130 XMBdyGiftCard01 2435 0.95 1.44 0.72 131 PLING_QUERY 2431 0.79 1.43 0.47 132 HK_RANDOM_REPLYTO 2420 0.53 1.43 0.10 133 URIBL_DBL_SPAM 2415 0.47 1.43 0.02 134 THIS_AD 2391 0.70 1.41 0.35 135 HTTPS_HTTP_MISMATCH 2378 1.05 1.40 0.88 136 TR_XM_PHPForged 2329 0.67 1.37 0.33 137 XMPhish30 2300 0.73 1.36 0.43 138 T_XMDrugObfuBody_00 2268 0.78 1.34 0.51 139 XM_H_Long_From02 2237 1.19 1.32 1.13 140 TR_XM_PHPDW 2222 0.65 1.31 0.33 141 AC_BR_BONANZA 2198 0.48 1.30 0.08 142 TR_XM_FormFill2 2188 0.65 1.29 0.34 143 URI_NOVOWEL 2166 1.20 1.28 1.16 144 URI_HEX 2165 1.32 1.28 1.33 145 XM_H_PHPOS 2164 0.63 1.28 0.32 146 TR_Mismatch_TLD_02 2156 0.47 1.27 0.08 147 HOSTED_IMG_MULTI_PUB_01 2133 0.42 1.26 0.01 148 XMGenDplmaNmb 2088 1.09 1.23 1.02 149 T_Symld_Words_02 2018 0.71 1.19 0.48 150 XM_SendGrid 2009 1.37 1.19 1.46 151 XMSlimDrugH 2002 0.61 1.18 0.34 152 RCVD_IN_IADB_LISTED 2002 3.15 1.18 4.10 153 XM_DIRTYINTL 1951 0.43 1.15 0.08 154 BAYES_20 1944 2.62 1.15 3.33 155 KHOP_HELO_FCRDNS 1923 1.15 1.13 1.16 156 HTML_TAG_BALANCE_BODY 1908 0.81 1.13 0.66 157 MPART_ALT_DIFF_COUNT 1905 0.76 1.12 0.58 158 RELAYCOUNTRY_CN 1811 0.43 1.07 0.12 159 TR_MetaPhish_Combo_01 1784 0.97 1.05 0.93 160 RCVD_IN_IADB_SPF 1756 2.76 1.04 3.59 161 LongTLD 1753 0.57 1.03 0.35 162 XMReplyNow 1752 0.54 1.03 0.31 163 DKIM_ADSP_CUSTOM_MED 1734 0.88 1.02 0.81 164 XMHTML_After_End 1732 0.66 1.02 0.48 165 TR_XM_InvalidRelay 1712 0.34 1.01 0.02 166 XM_BadFromFormat 1697 0.40 1.00 0.10 167 XM_B_DNDMA 1680 0.64 0.99 0.47 168 TR_Caps_n_Bayes_99 1674 0.34 0.99 0.02 169 RCVD_IN_IADB_DK 1663 2.40 0.98 3.08 170 XM_HighProb1 1647 0.32 0.97 0.00 171 RCVD_IN_IADB_SENDERID 1642 2.47 0.97 3.19 172 XMSubMetaI_00 1635 0.75 0.96 0.65 173 XM_ShortIntro_01 1630 0.93 0.96 0.91 174 RELAYCOUNTRY_FR 1619 0.46 0.96 0.22 175 DIET_1 1599 0.44 0.94 0.19 176 XM_UB60 1583 0.36 0.93 0.08 177 XMPhish14 1583 0.55 0.93 0.37 178 XMSolicitRefs_4 1581 0.35 0.93 0.07 179 XM_H_Undi_Recip 1579 0.41 0.93 0.15 180 XM_B_Phish66 1576 0.59 0.93 0.42 181 XMClaimOffer 1566 0.49 0.92 0.29 182 NML_ADSP_CUSTOM_MED 1534 0.67 0.91 0.56 183 T_MONEY_PERCENT 1530 0.40 0.90 0.16 184 TR_LOTS_OF_MONEY2 1530 0.40 0.90 0.16 185 XM_UB99 1530 0.30 0.90 0.00 186 XM_DKIMWhitelistDomains 1499 5.18 0.88 7.25 187 T_MANY_PILL_PRICE 1472 0.31 0.87 0.03 188 RDNS_DYNAMIC 1470 0.48 0.87 0.29 189 XM_H_PHPMailer 1461 0.86 0.86 0.86 190 SCC_BODY_URI_ONLY 1457 2.28 0.86 2.97 191 AC_HTML_NONSENSE_TAGS 1431 0.30 0.84 0.04 192 TR_XM_Base64_M1 1402 0.66 0.83 0.59 193 XMBounce_01 1388 0.28 0.82 0.02 194 XMBody_78 1386 0.43 0.82 0.24 195 RELAYCOUNTRY_IN 1382 0.31 0.82 0.06 196 SUBJ_DOLLARS 1369 0.44 0.81 0.27 197 TR_XM_DK_SendGrid 1366 0.92 0.81 0.97 198 RELAYCOUNTRY_GB 1360 0.58 0.80 0.47 199 TM2_M_A_HREF_HREF 1351 0.44 0.80 0.27 200 T_TooManySym_02 1350 2.05 0.80 2.65 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 349610 99.58 99.80 99.48 2 HTML_MESSAGE 302419 89.62 97.03 86.05 3 RELAYCOUNTRY_US 285164 80.45 79.03 81.14 4 DKIM_SIGNED 265307 80.54 91.01 75.49 5 XM_DK_Pass 260176 78.10 86.53 74.03 6 DKIM_VALID 256718 77.08 85.45 73.04 7 XM_B_Unicode 245125 74.75 85.11 69.75 8 DCC_CHECK_NEGATIVE 232872 53.00 25.50 66.26 9 BAYES_50 209084 52.27 37.30 59.49 10 DKIM_VALID_AU 202631 59.54 63.44 57.66 11 XMListUnsubscribeExists 176115 57.11 71.63 50.11 12 XM_B_SpammyWords 153907 53.20 72.70 43.79 13 XM_B_Unicode3 140039 41.35 44.48 39.85 14 DCC_CHECK 118426 46.97 74.49 33.70 15 RCVD_IN_MSPIKE_H2 104511 30.42 31.83 29.74 16 T_TM2_M_HEADER_IN_MSG 101995 26.81 22.23 29.02 17 DKIM_VALID_EF 101861 29.61 30.91 28.98 18 HTML_FONT_LOW_CONTRAST 99548 31.14 36.97 28.32 19 FVGT_m_MULTI_ODD 91231 28.21 32.88 25.96 20 LOC_TINY_FONT_1 86656 30.10 41.38 24.66 21 XMSubLong 77051 22.31 23.12 21.92 22 T_KAM_HTML_FONT_INVALID 76052 23.81 28.30 21.64 23 XM_B_SpammyWords2 65501 26.81 43.77 18.64 24 MIME_HTML_ONLY 63776 22.58 31.77 18.15 25 ALL_TRUSTED 54155 10.92 1.62 15.41 26 TR_XM_DK_Unsub 48255 16.60 22.55 13.73 27 XM_Multi_Part_URI 47833 16.07 21.17 13.61 28 USER_IN_DEF_DKIM_WL 43638 9.55 3.59 12.42 29 UNPARSEABLE_RELAY 38524 11.64 13.04 10.96 30 BAYES_60 33004 8.87 7.80 9.39 31 BAYES_00 32912 6.53 0.66 9.36 32 LotsOfNums_01 31118 8.32 7.20 8.85 33 TooManyTo_001 30929 7.60 5.10 8.80 34 XM_B_Unsub 27163 10.98 17.72 7.73 35 XM_DKIMWhitelistDomains 25475 5.18 0.88 7.25 36 XM_Evil_Numbers_Gen 25116 7.80 9.16 7.15 37 TR_MAX_INTL_RELAY 24326 9.43 14.63 6.92 38 IN_ZIMBRA_NJ_WHITELIST 23858 4.61 0.10 6.79 39 XM_H_GMP 22755 5.75 4.23 6.47 40 LOTS_OF_MONEY 22474 9.98 17.41 6.39 41 RCVD_IN_MSPIKE_WL 22396 7.28 9.18 6.37 42 RCVD_IN_MSPIKE_H3 22396 7.28 9.18 6.37 43 TR_XM_BayesUnsub 21463 9.71 17.19 6.11 44 TR_XM_DK_Bayes 21184 4.22 0.49 6.03 45 TR_XM_DK_Bayes1 20883 4.17 0.48 5.94 46 T_TooManySym_01 20080 5.04 3.64 5.71 47 MIME_QP_LONG_LINE 19502 4.99 3.83 5.55 48 XM_H_Long_From01 19273 5.20 4.62 5.48 49 XM_DK_Undo_02 18398 18.49 45.98 5.23 50 XM_B_SpammyWords3 18261 7.97 13.74 5.20 51 TR_XM_DK_Bayes2 17607 3.50 0.38 5.01 52 BAYES_40 16676 3.69 1.50 4.74 53 XM_PDF 16648 3.39 0.59 4.74 54 RCVD_IN_VALIDITY_SAFE 16466 4.09 2.85 4.69 55 HTML_IMAGE_RATIO_02 16255 5.25 6.54 4.63 56 ANY_BOUNCE_MESSAGE 15663 3.83 2.52 4.46 57 BOUNCE_MESSAGE 15662 3.83 2.52 4.46 58 TR_XM_SpammyWords4 15512 8.21 16.07 4.41 59 RELAYCOUNTRY_META 15089 9.89 21.50 4.29 60 BAYES_80 14957 5.75 8.84 4.26 61 RCVD_IN_IADB_LISTED 14418 3.15 1.18 4.10 62 RCVD_IN_VALIDITY_CERTIFIED 14413 3.54 2.38 4.10 63 FSL_BULK_SIG 14278 5.74 9.21 4.06 64 BAYES_99 14218 14.73 36.89 4.05 65 XMStrtUSub 14072 3.88 3.63 4.00 66 BOTNET_IPINHOSTNAME 13983 7.04 13.39 3.98 67 HTML_IMAGE_RATIO_04 13947 4.13 4.45 3.97 68 XM_UncommonTLD01 13079 4.42 5.88 3.72 69 XMSubMetaSx_00 12964 4.59 6.46 3.69 70 MPART_ALT_DIFF 12795 4.56 6.46 3.64 71 T_REMOTE_IMAGE 12720 3.05 1.86 3.62 72 RCVD_IN_IADB_SPF 12633 2.76 1.04 3.59 73 BAYES_20 11689 2.62 1.15 3.33 74 RCVD_IN_IADB_SENDERID 11210 2.47 0.97 3.19 75 XM_B_Phish_Phrases 11107 3.95 5.59 3.16 76 XM_SPF_SoftFail 11045 3.69 4.83 3.14 77 RCVD_IN_IADB_DK 10834 2.40 0.98 3.08 78 BAYES_999 10570 11.62 29.48 3.01 79 MAILING_LIST_MULTI 10535 2.62 1.83 3.00 80 HTML_IMAGE_RATIO_06 10458 3.71 5.23 2.98 81 SCC_BODY_URI_ONLY 10438 2.28 0.86 2.97 82 XMNumbers 10275 2.97 3.05 2.92 83 RCVD_IN_IADB_VOUCHED 9712 2.04 0.55 2.76 84 XM_Body_Dirty_Words 9588 4.08 6.89 2.73 85 BAYES_05 9562 2.01 0.53 2.72 86 BAYES_95 9349 3.53 5.33 2.66 87 T_TooManySym_02 9319 2.05 0.80 2.65 88 TooManyTo_002 9121 1.98 0.70 2.60 89 HTML_IMAGE_RATIO_08 8852 2.72 3.14 2.52 90 DKIM_INVALID 8589 3.46 5.56 2.44 91 XM_B_SpammyTLD 8153 2.52 2.95 2.32 92 TR_XM_SpammyRelay 8084 7.10 17.07 2.30 93 HTML_MIME_NO_HTML_TAG 7608 2.10 1.97 2.16 94 MIME_HTML_MOSTLY 7578 2.75 3.99 2.16 95 MIME_HTML_ONLY_MULTI 7457 2.40 2.98 2.12 96 INVALID_MSGID 7213 1.43 0.13 2.05 97 HELO_NODOT 7196 1.50 0.37 2.05 98 HELO_NO_DOMAIN 7191 1.48 0.31 2.05 99 XM_CamelCaseFrm001 7072 2.24 2.73 2.01 100 TR_XM_DKIM_Undo 7063 12.69 34.84 2.01 101 XMDiploma_00 6913 2.23 2.77 1.97 102 TO_MALFORMED 6903 1.33 0.03 1.96 103 XM_B_Investor 6842 2.90 4.89 1.95 104 RCVD_IN_IADB_OPTIN 6695 1.40 0.37 1.90 105 XM_DK_Undo_01 6413 1.78 1.70 1.82 106 T_XMDrugObfuBody_14 6093 2.18 3.11 1.73 107 TR_XM_UnparsRelay 5692 3.44 7.22 1.62 108 TR_XM_PhishingBody 5689 2.37 3.93 1.62 109 FROM_EXCESS_BASE64 5600 1.77 2.15 1.59 110 TooManyTo_003 5450 1.25 0.61 1.55 111 SUBJ_ALL_CAPS 5360 1.76 2.26 1.53 112 UNTRUSTED_Relay 5290 3.19 6.67 1.51 113 TR_DCC_Bayes_99 5228 9.79 27.00 1.49 114 TM2_M_URI_OPT_OUT 5205 2.26 3.87 1.48 115 TR_Symld_Words 5177 1.63 1.96 1.47 116 XM_SendGrid 5125 1.37 1.19 1.46 117 RELAYCOUNTRY_CA 5074 4.52 10.91 1.44 118 XM_B_Unsub2 5066 1.93 2.95 1.44 119 IN_HORDE_ADDRESS_BOOK 4921 0.97 0.06 1.40 120 XMSexyCombo_05 4903 2.50 4.80 1.40 121 TR_XM_SpammyWords5 4887 2.14 3.70 1.39 122 XMGappySubj_01 4826 0.97 0.15 1.37 123 TVD_RCVD_IP 4815 1.17 0.74 1.37 124 T_XMDrugObfuBody_08 4758 1.89 3.01 1.35 125 URI_HEX 4687 1.32 1.28 1.33 126 XM_GoogleGroups 4416 1.00 0.48 1.26 127 TM2_M_VERY_LONG_WORD 4408 1.82 2.99 1.25 128 XM_OfRef6 4352 2.28 4.44 1.24 129 BOTNET 4123 3.83 9.34 1.17 130 URI_NOVOWEL 4089 1.20 1.28 1.16 131 KHOP_HELO_FCRDNS 4088 1.15 1.13 1.16 132 XMCapTrack 4085 0.92 0.41 1.16 133 XMBSHREFv2 4034 0.89 0.35 1.15 134 XM_H_Long_From02 3971 1.19 1.32 1.13 135 TooManyTo_004 3902 0.93 0.57 1.11 136 TVD_SPACE_RATIO 3790 0.76 0.11 1.08 137 XMGenDplmaNmb 3596 1.09 1.23 1.02 138 TR_XM_DK_SendGrid 3421 0.92 0.81 0.97 139 XM_B_SpammyWords4 3413 1.30 1.99 0.97 140 T_TooManySym_03 3400 0.74 0.26 0.97 141 T_FILL_THIS_FORM_SHORT 3367 1.61 2.96 0.96 142 TR_MetaPhish_Combo_01 3260 0.97 1.05 0.93 143 XM_ShortIntro_01 3207 0.93 0.96 0.91 144 TooManyTo_005 3163 0.78 0.53 0.90 145 XM_H_Trusted_IP 3128 0.60 0.00 0.89 146 XM_UB50 3121 1.74 3.50 0.89 147 HTTPS_HTTP_MISMATCH 3093 1.05 1.40 0.88 148 XM_H_PHPMailer 3012 0.86 0.86 0.86 149 XMBrknScrpt_02 2950 1.45 2.72 0.84 150 XMStockSpam_06 2919 1.33 2.37 0.83 151 XM_ProductURIs 2911 1.10 1.66 0.83 152 DKIM_ADSP_CUSTOM_MED 2858 0.88 1.02 0.81 153 TR_LOTS_OF_MONEY3 2806 2.17 5.00 0.80 154 XMBody_17 2756 2.52 6.13 0.78 155 SpammyFromTLD_01 2689 1.26 2.28 0.77 156 URI_TRY_3LD 2671 0.98 1.45 0.76 157 XMBdyGiftCard01 2526 0.95 1.44 0.72 158 XMNoVowels 2426 0.96 1.53 0.69 159 XMGappySubj_02 2413 0.48 0.05 0.69 160 RELAYCOUNTRY_AU 2387 1.19 2.24 0.68 161 HTML_TAG_BALANCE_BODY 2324 0.81 1.13 0.66 162 FROM_GOV_DKIM_AU 2305 0.49 0.15 0.66 163 XMSubMetaI_00 2271 0.75 0.96 0.65 164 XMMoneyMeta_00 2217 0.67 0.74 0.63 165 SHORT_HELO_AND_INLINE_IMAGE 2210 0.44 0.06 0.63 166 T_OBFU_PDF_ATTACH 2206 0.45 0.08 0.63 167 XMBody_95 2188 0.46 0.11 0.62 168 XMSubNoVowel 2149 0.60 0.59 0.61 169 T_XMHurry_00 2088 1.04 1.96 0.59 170 FILL_THIS_FORM 2071 0.53 0.40 0.59 171 TR_XM_Base64_M1 2060 0.66 0.83 0.59 172 MPART_ALT_DIFF_COUNT 2035 0.76 1.12 0.58 173 RCVD_IN_BL_SPAMCOP_NET 1979 4.48 12.59 0.56 174 NML_ADSP_CUSTOM_MED 1975 0.67 0.91 0.56 175 XM_B_COPY_HTML 1936 0.62 0.76 0.55 176 HTML_FONT_FACE_BAD 1896 0.62 0.78 0.54 177 TO_NO_BRKTS_HTML_ONLY 1816 0.47 0.38 0.52 178 USER_IN_WELCOMELIST 1789 0.34 0.00 0.51 179 USER_IN_WHITELIST 1789 0.34 0.00 0.51 180 T_XMDrugObfuBody_00 1789 0.78 1.34 0.51 181 XMLngstWrd_00 1777 0.55 0.65 0.51 182 TR_XM_SpammyWords2 1732 5.28 15.19 0.49 183 T_Symld_Words_02 1698 0.71 1.19 0.48 184 XMHTML_After_End 1696 0.66 1.02 0.48 185 PLING_QUERY 1664 0.79 1.43 0.47 186 XM_B_FormFill 1660 0.35 0.08 0.47 187 RELAYCOUNTRY_GB 1654 0.58 0.80 0.47 188 XM_B_DNDMA 1652 0.64 0.99 0.47 189 FORGED_GMAIL_RCVD 1651 0.55 0.72 0.47 190 XMSolicitRefs_0 1593 0.43 0.39 0.45 191 XMSubMetaSxObfu_02 1561 0.50 0.61 0.44 192 HTML_IMAGE_ONLY_32 1548 0.42 0.37 0.44 193 SpammyFromTLD_02 1530 0.82 1.62 0.44 194 XMPhish30 1520 0.73 1.36 0.43 195 XM_B_Phish66 1490 0.59 0.93 0.42 196 HTML_IMAGE_ONLY_20 1489 0.46 0.52 0.42 197 SHOPIFY_IMG_NOT_RCVD_SFY 1470 0.44 0.48 0.42 198 XMDateMe_00 1445 0.46 0.57 0.41 199 HTML_IMAGE_ONLY_28 1397 0.39 0.37 0.40 200 MISSING_HEADERS 1360 0.41 0.46 0.39 ----------------------------------------------------------------------