Email: 482152 Autolearn: 0 AvgScore: 4.14 AvgScanTime: 1.45 sec Spam: 151052 Autolearn: 0 AvgScore: 13.60 AvgScanTime: 1.56 sec Ham: 331100 Autolearn: 0 AvgScore: -0.17 AvgScanTime: 1.40 sec Time Spent Running SA: 193.88 hours Time Spent Processing Spam: 65.34 hours Time Spent Processing Ham: 128.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 150651 99.56 99.73 99.49 2 HTML_MESSAGE 146095 88.80 96.72 85.19 3 DKIM_SIGNED 135730 80.87 89.86 76.78 4 XM_DK_Pass 130495 78.95 86.39 75.55 5 DKIM_VALID 128645 77.95 85.17 74.66 6 XM_B_Unicode 127874 74.42 84.66 69.75 7 RELAYCOUNTRY_US 119749 80.59 79.28 81.19 8 XM_B_SpammyWords 109518 53.34 72.50 44.60 9 XMListUnsubscribeExists 108701 57.80 71.96 51.35 10 DCC_CHECK 108414 46.87 71.77 35.51 11 DKIM_VALID_AU 96213 60.97 63.70 59.73 12 XM_DK_Undo_02 70167 18.88 46.45 6.30 13 XM_B_Unicode3 68412 42.32 45.29 40.96 14 XM_B_SpammyWords2 63122 26.17 41.79 19.04 15 LOC_TINY_FONT_1 61292 31.14 40.58 26.84 16 BAYES_50 57260 52.37 37.91 58.97 17 BAYES_99 55151 15.05 36.51 5.26 18 HTML_FONT_LOW_CONTRAST 54923 31.38 36.36 29.11 19 TR_XM_DKIM_Undo 53517 13.13 35.43 2.95 20 RCVD_IN_MSPIKE_H2 49206 31.11 32.58 30.45 21 FVGT_m_MULTI_ODD 48083 26.83 31.83 24.55 22 MIME_HTML_ONLY 46934 23.25 31.07 19.69 23 DKIM_VALID_EF 45732 29.06 30.28 28.50 24 BAYES_999 44249 12.07 29.29 4.21 25 T_KAM_HTML_FONT_INVALID 44098 23.46 29.19 20.85 26 DCC_CHECK_NEGATIVE 42621 53.10 28.22 64.45 27 TR_DCC_Bayes_99 38392 9.27 25.42 1.90 28 TR_XM_DK_Unsub 33565 16.07 22.22 13.26 29 T_TM2_M_HEADER_IN_MSG 33537 25.26 22.20 26.66 30 XMSubLong 31499 21.23 20.85 21.40 31 XM_Multi_Part_URI 30785 16.26 20.38 14.38 32 RELAYCOUNTRY_META 30104 9.21 19.93 4.31 33 TR_XM_SpammyRelay 24415 6.71 16.16 2.40 34 XM_B_Unsub 24291 10.66 16.08 8.19 35 TR_XM_BayesUnsub 23132 9.37 15.31 6.65 36 UNPARSEABLE_RELAY 23129 12.54 15.31 11.28 37 TR_XM_SpammyWords2 22732 5.08 15.05 0.53 38 LOTS_OF_MONEY 22419 8.89 14.84 6.17 39 RCVD_IN_BL_SPAMCOP_NET 21619 4.95 14.31 0.68 40 TR_MAX_INTL_RELAY 21453 8.97 14.20 6.58 41 XM_B_SpammyWords3 21044 7.63 13.93 4.76 42 TR_XM_SpammyWords4 20366 7.00 13.48 4.04 43 BOTNET_IPINHOSTNAME 19355 7.17 12.81 4.59 44 TR_XM_SPAMCOP 19328 4.33 12.80 0.47 45 RELAYCOUNTRY_CA 16119 4.22 10.67 1.28 46 BOTNET 13782 3.87 9.12 1.47 47 BAYES_80 13297 5.59 8.80 4.12 48 RCVD_IN_MSPIKE_WL 13273 7.01 8.79 6.20 49 RCVD_IN_MSPIKE_H3 13273 7.01 8.79 6.20 50 TR_XM_UnparsRelay 12287 3.83 8.13 1.86 51 XM_Evil_Numbers_Gen 12018 8.03 7.96 8.06 52 BAYES_60 11957 9.11 7.92 9.65 53 FSL_BULK_SIG 11504 5.70 7.62 4.83 54 LotsOfNums_01 10308 8.09 6.82 8.67 55 XMBody_17 10134 2.61 6.71 0.74 56 XM_UncommonTLD01 9765 4.58 6.46 3.72 57 HTML_IMAGE_RATIO_02 9288 5.17 6.15 4.73 58 XMSubMetaSx_00 8982 4.15 5.95 3.33 59 MPART_ALT_DIFF 8837 4.30 5.85 3.59 60 XM_SPF_SoftFail 8752 3.78 5.79 2.86 61 XM_Body_Dirty_Words 8562 4.51 5.67 3.98 62 UNTRUSTED_Relay 8380 2.82 5.55 1.57 63 XM_B_Phish_Phrases 8195 3.74 5.43 2.97 64 TooManyTo_001 7956 7.51 5.27 8.54 65 BAYES_95 7647 3.27 5.06 2.45 66 XM_OfRef6 7361 2.35 4.87 1.19 67 XM_H_GMP 7151 5.77 4.73 6.25 68 DKIM_INVALID 7085 2.92 4.69 2.11 69 HTML_IMAGE_RATIO_04 7067 5.08 4.68 5.26 70 TR_XM_SpammyWords5 7036 2.49 4.66 1.49 71 XM_H_Long_From01 7000 5.28 4.63 5.58 72 XMStrtUSub 6935 4.96 4.59 5.13 73 T_FILL_THIS_FORM_SHORT 6460 1.96 4.28 0.90 74 TR_XM_PhishingBody 6302 2.37 4.17 1.55 75 XM_B_Investor 6228 2.43 4.12 1.65 76 XMNumbers 6068 3.23 4.02 2.87 77 XMSexyCombo_05 6064 2.26 4.01 1.46 78 TM2_M_URI_OPT_OUT 6005 2.67 3.98 2.08 79 T_XMDrugObfuBody_14 5796 2.33 3.84 1.64 80 HTML_IMAGE_RATIO_06 5614 3.00 3.72 2.67 81 MIME_HTML_MOSTLY 5541 2.74 3.67 2.32 82 XMDiploma_00 5301 2.42 3.51 1.93 83 XM_B_SpammyTLD 5007 2.75 3.31 2.49 84 HTML_IMAGE_RATIO_08 4973 2.27 3.29 1.80 85 MIME_HTML_ONLY_MULTI 4915 2.28 3.25 1.83 86 T_XMDrugObfuBody_08 4894 1.97 3.24 1.39 87 MIME_QP_LONG_LINE 4802 4.78 3.18 5.51 88 XM_CamelCaseFrm001 4673 2.55 3.09 2.31 89 TM2_M_VERY_LONG_WORD 4605 1.89 3.05 1.37 90 TR_XM_BayesRelay 4557 0.95 3.02 0.00 91 USER_IN_DEF_DKIM_WL 4515 10.97 2.99 14.61 92 TR_LOTS_OF_MONEY3 4187 1.18 2.77 0.46 93 RCVD_IN_VALIDITY_SAFE 4129 4.51 2.73 5.32 94 FONT_INVIS_LONG_LINE 4112 0.88 2.72 0.04 95 SUBJ_ALL_CAPS 3969 1.94 2.63 1.63 96 ALL_TRUSTED 3939 11.39 2.61 15.39 97 T_TooManySym_01 3924 4.66 2.60 5.59 98 SpammyFromTLD_01 3912 1.32 2.59 0.75 99 XM_UB50 3890 1.44 2.58 0.92 100 RCVD_IN_VALIDITY_RPBL 3819 0.82 2.53 0.04 101 TR_XM_FormFill 3811 0.80 2.52 0.01 102 RELAYCOUNTRY_AU 3760 1.40 2.49 0.90 103 XM_URI_RBL 3506 0.83 2.32 0.15 104 RCVD_IN_VALIDITY_CERTIFIED 3437 3.79 2.28 4.49 105 XM_B_SpammyWords4 3336 1.20 2.21 0.74 106 SpammyFromTLD_02 3313 1.03 2.19 0.50 107 XM_B_Unsub2 3265 1.66 2.16 1.43 108 T_REMOTE_IMAGE 3246 3.20 2.15 3.68 109 XM_B_SEO 3245 1.09 2.15 0.61 110 TR_XM_NoHeaderRelay 3185 0.76 2.11 0.14 111 FROM_EXCESS_BASE64 3146 1.85 2.08 1.75 112 TR_XM_INV_DKIM 3032 0.67 2.01 0.06 113 XMPhish30 3020 1.00 2.00 0.55 114 XMBrknScrpt_02 2937 1.11 1.94 0.72 115 TR_XM_SEO4 2916 0.87 1.93 0.38 116 KHOP_HELO_FCRDNS 2827 1.42 1.87 1.21 117 HTML_MIME_NO_HTML_TAG 2822 2.04 1.87 2.12 118 XM_DK_Undo_01 2771 1.78 1.83 1.76 119 T_XMHurry_00 2647 0.92 1.75 0.54 120 TR_XM_PHPForged 2526 0.84 1.67 0.46 121 MAILING_LIST_MULTI 2496 2.46 1.65 2.83 122 TR_XM_PHPDW 2435 0.82 1.61 0.46 123 XMGenDplmaNmb 2428 1.18 1.61 0.99 124 XMStockSpam_06 2400 1.33 1.59 1.22 125 TR_XM_FormFill2 2395 0.82 1.59 0.47 126 XM_H_PHPOS 2376 0.80 1.57 0.45 127 ANY_BOUNCE_MESSAGE 2271 3.68 1.50 4.67 128 BOUNCE_MESSAGE 2269 3.68 1.50 4.67 129 URI_TRY_3LD 2260 0.94 1.50 0.69 130 HK_RANDOM_REPLYTO 2224 0.52 1.47 0.09 131 URI_NOVOWEL 2217 1.34 1.47 1.29 132 BAYES_40 2209 3.47 1.46 4.38 133 THIS_AD 2198 0.80 1.46 0.50 134 BOTNET_NORDNS 2160 0.46 1.43 0.01 135 HTTPS_HTTP_MISMATCH 2126 1.00 1.41 0.81 136 TR_Symld_Words 2115 1.35 1.40 1.33 137 T_XMDrugObfuBody_00 1958 1.15 1.30 1.09 138 XMSubMetaI_00 1940 0.93 1.28 0.77 139 HOSTED_IMG_MULTI_PUB_01 1935 0.41 1.28 0.02 140 RCVD_IN_IADB_LISTED 1928 3.51 1.28 4.53 141 XM_SendGrid 1916 1.36 1.27 1.41 142 DKIM_ADSP_NXDOMAIN 1890 0.58 1.25 0.28 143 HTML_TAG_BALANCE_BODY 1880 0.75 1.24 0.52 144 URIBL_DBL_SPAM 1877 0.41 1.24 0.03 145 URI_HEX 1864 1.07 1.23 1.00 146 XM_HighProb1 1853 0.39 1.23 0.00 147 AC_BR_BONANZA 1841 0.44 1.22 0.09 148 TR_XM_Base64_M1 1833 0.96 1.21 0.84 149 TR_XM_RelayPhish 1820 0.41 1.20 0.04 150 DKIM_ADSP_CUSTOM_MED 1789 1.11 1.18 1.08 151 BAYES_20 1777 2.60 1.18 3.25 152 RCVD_IN_IADB_SPF 1755 3.06 1.16 3.93 153 RDNS_DYNAMIC 1711 0.58 1.13 0.33 154 RCVD_IN_IADB_DK 1647 2.63 1.09 3.34 155 XM_B_COPY_HTML 1639 0.97 1.09 0.92 156 TR_XM_InvalidRelay 1633 0.35 1.08 0.02 157 RCVD_IN_IADB_SENDERID 1619 2.71 1.07 3.46 158 XMBdyGiftCard01 1602 0.96 1.06 0.92 159 TR_MetaPhish_Combo_01 1558 0.80 1.03 0.69 160 XM_H_Long_From02 1553 1.05 1.03 1.06 161 XM_DIRTYINTL 1519 0.43 1.01 0.17 162 NML_ADSP_CUSTOM_MED 1516 0.79 1.00 0.69 163 TM2_M_OBFU_COMMENT 1496 0.55 0.99 0.35 164 XMHTML_After_End 1487 0.60 0.98 0.43 165 TR_Mismatch_TLD_02 1487 0.38 0.98 0.10 166 XMHTMLBadTable_001 1481 0.51 0.98 0.29 167 T_STY_INVIS_DIRECT 1470 0.49 0.97 0.27 168 TooManyTo_002 1469 2.06 0.97 2.55 169 XM_ProductURIs 1468 0.70 0.97 0.57 170 TR_Caps_n_Bayes_99 1427 0.30 0.94 0.01 171 SCC_BODY_URI_ONLY 1401 2.61 0.93 3.38 172 TR_Mismatch_TLD_01 1385 0.46 0.92 0.25 173 MPART_ALT_DIFF_COUNT 1373 0.71 0.91 0.62 174 XMReplyNow 1362 0.45 0.90 0.24 175 XM_H_PHPMailer 1359 0.76 0.90 0.69 176 XM_UB60 1355 0.33 0.90 0.07 177 XM_UB99 1315 0.28 0.87 0.00 178 PLING_QUERY 1313 0.51 0.87 0.35 179 RELAYCOUNTRY_RU 1304 0.28 0.86 0.01 180 PDS_OTHER_BAD_TLD 1301 0.36 0.86 0.13 181 T_TooManySym_02 1301 2.24 0.86 2.87 182 XM_B_DNDMA 1287 0.72 0.85 0.66 183 HTML_FONT_SIZE_LARGE 1283 0.31 0.85 0.07 184 SHOPIFY_IMG_NOT_RCVD_SFY 1278 0.61 0.85 0.51 185 TooManyTo_003 1271 1.23 0.84 1.41 186 TVD_RCVD_IP 1269 1.23 0.84 1.40 187 FORGED_GMAIL_RCVD 1268 0.76 0.84 0.73 188 TM2_M_A_HREF_HREF 1268 0.48 0.84 0.32 189 XM_H_Undi_Recip 1262 0.38 0.84 0.17 190 AC_HTML_NONSENSE_TAGS 1259 0.29 0.83 0.04 191 TR_XM_SpoofStaff 1259 0.35 0.83 0.14 192 XMSpoofStaff2 1246 0.34 0.82 0.11 193 XM_H_SpoofStaff4 1240 0.37 0.82 0.16 194 TR_XM_PSC1 1239 0.33 0.82 0.11 195 TR_XM_DK_SendGrid 1235 0.91 0.82 0.95 196 XM_B_Phish66 1221 0.43 0.81 0.26 197 URI_PHISH 1195 0.26 0.79 0.02 198 RELAYCOUNTRY_KR 1194 0.25 0.79 0.00 199 TooManyTo_004 1188 0.93 0.79 1.00 200 HELO_DYNAMIC_SPLIT_IP 1170 0.25 0.77 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 329402 99.56 99.73 99.49 2 HTML_MESSAGE 282078 88.80 96.72 85.19 3 RELAYCOUNTRY_US 268824 80.59 79.28 81.19 4 DKIM_SIGNED 254203 80.87 89.86 76.78 5 XM_DK_Pass 250145 78.95 86.39 75.55 6 DKIM_VALID 247207 77.95 85.17 74.66 7 XM_B_Unicode 230944 74.42 84.66 69.75 8 DCC_CHECK_NEGATIVE 213385 53.10 28.22 64.45 9 DKIM_VALID_AU 197761 60.97 63.70 59.73 10 BAYES_50 195251 52.37 37.91 58.97 11 XMListUnsubscribeExists 170006 57.80 71.96 51.35 12 XM_B_SpammyWords 147658 53.34 72.50 44.60 13 XM_B_Unicode3 135615 42.32 45.29 40.96 14 DCC_CHECK 117564 46.87 71.77 35.51 15 RCVD_IN_MSPIKE_H2 100809 31.11 32.58 30.45 16 HTML_FONT_LOW_CONTRAST 96371 31.38 36.36 29.11 17 DKIM_VALID_EF 94358 29.06 30.28 28.50 18 LOC_TINY_FONT_1 88858 31.14 40.58 26.84 19 T_TM2_M_HEADER_IN_MSG 88271 25.26 22.20 26.66 20 FVGT_m_MULTI_ODD 81285 26.83 31.83 24.55 21 XMSubLong 70870 21.23 20.85 21.40 22 T_KAM_HTML_FONT_INVALID 69034 23.46 29.19 20.85 23 MIME_HTML_ONLY 65184 23.25 31.07 19.69 24 XM_B_SpammyWords2 63039 26.17 41.79 19.04 25 ALL_TRUSTED 50956 11.39 2.61 15.39 26 USER_IN_DEF_DKIM_WL 48369 10.97 2.99 14.61 27 XM_Multi_Part_URI 47605 16.26 20.38 14.38 28 TR_XM_DK_Unsub 43913 16.07 22.22 13.26 29 UNPARSEABLE_RELAY 37352 12.54 15.31 11.28 30 BAYES_60 31944 9.11 7.92 9.65 31 BAYES_00 30507 6.50 0.54 9.21 32 LotsOfNums_01 28692 8.09 6.82 8.67 33 TooManyTo_001 28274 7.51 5.27 8.54 34 XM_B_Unsub 27114 10.66 16.08 8.19 35 XM_DKIMWhitelistDomains 26901 5.64 0.20 8.12 36 XM_Evil_Numbers_Gen 26695 8.03 7.96 8.06 37 IN_ZIMBRA_NJ_WHITELIST 23016 4.80 0.09 6.95 38 TR_XM_DK_Bayes 22503 4.77 0.33 6.80 39 TR_XM_DK_Bayes1 22299 4.73 0.33 6.73 40 TR_XM_BayesUnsub 22029 9.37 15.31 6.65 41 TR_MAX_INTL_RELAY 21781 8.97 14.20 6.58 42 XM_DK_Undo_02 20844 18.88 46.45 6.30 43 XM_H_GMP 20680 5.77 4.73 6.25 44 RCVD_IN_MSPIKE_H3 20531 7.01 8.79 6.20 45 RCVD_IN_MSPIKE_WL 20531 7.01 8.79 6.20 46 LOTS_OF_MONEY 20442 8.89 14.84 6.17 47 TR_XM_DK_Bayes2 19452 4.12 0.26 5.87 48 T_TooManySym_01 18524 4.66 2.60 5.59 49 XM_H_Long_From01 18463 5.28 4.63 5.58 50 MIME_QP_LONG_LINE 18242 4.78 3.18 5.51 51 RCVD_IN_VALIDITY_SAFE 17616 4.51 2.73 5.32 52 HTML_IMAGE_RATIO_04 17411 5.08 4.68 5.26 53 BAYES_99 17410 15.05 36.51 5.26 54 XMStrtUSub 16990 4.96 4.59 5.13 55 FSL_BULK_SIG 15986 5.70 7.62 4.83 56 XM_B_SpammyWords3 15755 7.63 13.93 4.76 57 HTML_IMAGE_RATIO_02 15651 5.17 6.15 4.73 58 XM_PDF 15587 3.46 0.73 4.71 59 ANY_BOUNCE_MESSAGE 15456 3.68 1.50 4.67 60 BOUNCE_MESSAGE 15455 3.68 1.50 4.67 61 BOTNET_IPINHOSTNAME 15206 7.17 12.81 4.59 62 RCVD_IN_IADB_LISTED 15015 3.51 1.28 4.53 63 RCVD_IN_VALIDITY_CERTIFIED 14850 3.79 2.28 4.49 64 BAYES_40 14501 3.47 1.46 4.38 65 RELAYCOUNTRY_META 14280 9.21 19.93 4.31 66 BAYES_999 13931 12.07 29.29 4.21 67 BAYES_80 13645 5.59 8.80 4.12 68 TR_XM_SpammyWords4 13380 7.00 13.48 4.04 69 XM_Body_Dirty_Words 13171 4.51 5.67 3.98 70 RCVD_IN_IADB_SPF 13010 3.06 1.16 3.93 71 XM_UncommonTLD01 12327 4.58 6.46 3.72 72 T_REMOTE_IMAGE 12179 3.20 2.15 3.68 73 MPART_ALT_DIFF 11887 4.30 5.85 3.59 74 RCVD_IN_IADB_SENDERID 11462 2.71 1.07 3.46 75 SCC_BODY_URI_ONLY 11198 2.61 0.93 3.38 76 RCVD_IN_IADB_DK 11057 2.63 1.09 3.34 77 XMSubMetaSx_00 11039 4.15 5.95 3.33 78 BAYES_20 10759 2.60 1.18 3.25 79 RCVD_IN_IADB_VOUCHED 10487 2.34 0.53 3.17 80 XM_B_Phish_Phrases 9831 3.74 5.43 2.97 81 TR_XM_DKIM_Undo 9779 13.13 35.43 2.95 82 XMNumbers 9513 3.23 4.02 2.87 83 T_TooManySym_02 9507 2.24 0.86 2.87 84 XM_SPF_SoftFail 9473 3.78 5.79 2.86 85 MAILING_LIST_MULTI 9372 2.46 1.65 2.83 86 BAYES_05 8958 2.05 0.62 2.71 87 HTML_IMAGE_RATIO_06 8848 3.00 3.72 2.67 88 TooManyTo_002 8448 2.06 0.97 2.55 89 XM_B_SpammyTLD 8229 2.75 3.31 2.49 90 BAYES_95 8118 3.27 5.06 2.45 91 TR_XM_SpammyRelay 7949 6.71 16.16 2.40 92 MIME_HTML_MOSTLY 7693 2.74 3.67 2.32 93 XM_CamelCaseFrm001 7636 2.55 3.09 2.31 94 INVALID_MSGID 7207 1.54 0.15 2.18 95 TO_MALFORMED 7043 1.47 0.01 2.13 96 RCVD_IN_IADB_OPTIN 7035 1.58 0.38 2.12 97 HTML_MIME_NO_HTML_TAG 7028 2.04 1.87 2.12 98 DKIM_INVALID 6996 2.92 4.69 2.11 99 TM2_M_URI_OPT_OUT 6877 2.67 3.98 2.08 100 XMDiploma_00 6381 2.42 3.51 1.93 101 TR_DCC_Bayes_99 6307 9.27 25.42 1.90 102 TR_XM_UnparsRelay 6159 3.83 8.13 1.86 103 MIME_HTML_ONLY_MULTI 6061 2.28 3.25 1.83 104 HTML_IMAGE_RATIO_08 5961 2.27 3.29 1.80 105 XM_DK_Undo_01 5829 1.78 1.83 1.76 106 FROM_EXCESS_BASE64 5781 1.85 2.08 1.75 107 XM_B_Investor 5477 2.43 4.12 1.65 108 T_XMDrugObfuBody_14 5433 2.33 3.84 1.64 109 SUBJ_ALL_CAPS 5395 1.94 2.63 1.63 110 UNTRUSTED_Relay 5214 2.82 5.55 1.57 111 TR_XM_PhishingBody 5128 2.37 4.17 1.55 112 HELO_NODOT 5104 1.15 0.30 1.54 113 HELO_NO_DOMAIN 5098 1.15 0.30 1.54 114 IN_HORDE_ADDRESS_BOOK 5030 1.06 0.07 1.52 115 TR_XM_SpammyWords5 4948 2.49 4.66 1.49 116 BOTNET 4880 3.87 9.12 1.47 117 XMSexyCombo_05 4824 2.26 4.01 1.46 118 XM_B_Unsub2 4750 1.66 2.16 1.43 119 TooManyTo_003 4683 1.23 0.84 1.41 120 XM_SendGrid 4655 1.36 1.27 1.41 121 TVD_RCVD_IP 4638 1.23 0.84 1.40 122 T_XMDrugObfuBody_08 4610 1.97 3.24 1.39 123 TM2_M_VERY_LONG_WORD 4520 1.89 3.05 1.37 124 TR_Symld_Words 4409 1.35 1.40 1.33 125 XMGappySubj_01 4347 0.97 0.21 1.31 126 URI_NOVOWEL 4259 1.34 1.47 1.29 127 RELAYCOUNTRY_CA 4240 4.22 10.67 1.28 128 XMStockSpam_06 4023 1.33 1.59 1.22 129 KHOP_HELO_FCRDNS 3996 1.42 1.87 1.21 130 XM_OfRef6 3950 2.35 4.87 1.19 131 XM_GoogleGroups 3796 0.96 0.56 1.15 132 XMBSHREFv2 3773 0.89 0.35 1.14 133 TVD_SPACE_RATIO 3692 0.80 0.10 1.12 134 T_XMDrugObfuBody_00 3606 1.15 1.30 1.09 135 DKIM_ADSP_CUSTOM_MED 3567 1.11 1.18 1.08 136 T_TooManySym_03 3559 0.83 0.29 1.07 137 XM_H_Long_From02 3503 1.05 1.03 1.06 138 TooManyTo_004 3311 0.93 0.79 1.00 139 URI_HEX 3310 1.07 1.23 1.00 140 XMGenDplmaNmb 3264 1.18 1.61 0.99 141 TR_XM_DK_SendGrid 3140 0.91 0.82 0.95 142 T_OBFU_PDF_ATTACH 3078 0.68 0.13 0.93 143 XMCapTrack 3067 0.77 0.42 0.93 144 XM_B_COPY_HTML 3047 0.97 1.09 0.92 145 XMBdyGiftCard01 3031 0.96 1.06 0.92 146 XM_UB50 3030 1.44 2.58 0.92 147 RELAYCOUNTRY_AU 2990 1.40 2.49 0.90 148 T_FILL_THIS_FORM_SHORT 2973 1.96 4.28 0.90 149 TR_XM_Base64_M1 2772 0.96 1.21 0.84 150 XMNoVowels 2734 0.80 0.73 0.83 151 TooManyTo_005 2729 0.80 0.76 0.82 152 HTTPS_HTTP_MISMATCH 2678 1.00 1.41 0.81 153 XMSubMetaI_00 2559 0.93 1.28 0.77 154 SpammyFromTLD_01 2470 1.32 2.59 0.75 155 XMBody_17 2458 2.61 6.71 0.74 156 FROM_GOV_DKIM_AU 2454 0.56 0.17 0.74 157 XM_B_SpammyWords4 2450 1.20 2.21 0.74 158 FORGED_GMAIL_RCVD 2416 0.76 0.84 0.73 159 XMBrknScrpt_02 2394 1.11 1.94 0.72 160 XM_RXBody 2328 0.60 0.38 0.70 161 NML_ADSP_CUSTOM_MED 2297 0.79 1.00 0.69 162 URI_TRY_3LD 2294 0.94 1.50 0.69 163 TR_MetaPhish_Combo_01 2293 0.80 1.03 0.69 164 XM_H_PHPMailer 2293 0.76 0.90 0.69 165 XM_B_FormFill 2242 0.48 0.05 0.68 166 RCVD_IN_BL_SPAMCOP_NET 2237 4.95 14.31 0.68 167 XM_B_DNDMA 2182 0.72 0.85 0.66 168 XMGappySubj_02 2142 0.46 0.06 0.65 169 XM_ShortIntro_01 2079 0.58 0.48 0.63 170 FILL_THIS_FORM 2069 0.56 0.41 0.62 171 XMBody_95 2053 0.49 0.20 0.62 172 MPART_ALT_DIFF_COUNT 2044 0.71 0.91 0.62 173 XM_B_SEO 2028 1.09 2.15 0.61 174 XM_ProductURIs 1888 0.70 0.97 0.57 175 USER_IN_WHITELIST 1833 0.38 0.00 0.55 176 USER_IN_WELCOMELIST 1833 0.38 0.00 0.55 177 XMPhish30 1825 1.00 2.00 0.55 178 T_XMHurry_00 1781 0.92 1.75 0.54 179 TR_XM_SpammyWords2 1764 5.08 15.05 0.53 180 HTML_FONT_FACE_BAD 1744 0.55 0.60 0.53 181 HTML_TAG_BALANCE_BODY 1725 0.75 1.24 0.52 182 SHORT_HELO_AND_INLINE_IMAGE 1683 0.36 0.03 0.51 183 SHOPIFY_IMG_NOT_RCVD_SFY 1682 0.61 0.85 0.51 184 SpammyFromTLD_02 1660 1.03 2.19 0.50 185 THIS_AD 1643 0.80 1.46 0.50 186 XMSolicitRefs_0 1634 0.47 0.43 0.49 187 RELAYCOUNTRY_GB 1611 0.52 0.60 0.49 188 T_Symld_Words_02 1600 0.50 0.55 0.48 189 TR_XM_FormFill2 1559 0.82 1.59 0.47 190 TR_XM_SPAMCOP 1556 4.33 12.80 0.47 191 TR_XM_PHPForged 1523 0.84 1.67 0.46 192 TR_LOTS_OF_MONEY3 1516 1.18 2.77 0.46 193 TR_XM_PHPDW 1513 0.82 1.61 0.46 194 XM_H_PHPOS 1490 0.80 1.57 0.45 195 XMHTML_After_End 1418 0.60 0.98 0.43 196 BASE64_LENGTH_79_INF 1378 0.33 0.15 0.42 197 XMSubMetaSxObfu_02 1330 0.38 0.35 0.40 198 XMMoneyMeta_00 1330 0.48 0.65 0.40 199 HTML_IMAGE_ONLY_20 1322 0.38 0.34 0.40 200 HTML_IMAGE_ONLY_32 1318 0.42 0.48 0.40 ----------------------------------------------------------------------