Email: 431038 Autolearn: 0 AvgScore: 4.75 AvgScanTime: 1.36 sec Spam: 147894 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 1.49 sec Ham: 283144 Autolearn: 0 AvgScore: -0.11 AvgScanTime: 1.29 sec Time Spent Running SA: 162.86 hours Time Spent Processing Spam: 61.31 hours Time Spent Processing Ham: 101.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142659 87.78 96.46 83.24 2 DKIM_SIGNED 131572 79.41 88.96 74.42 3 XM_DK_Pass 126390 77.46 85.46 73.29 4 RELAYCOUNTRY_US 125736 81.34 85.02 79.42 5 DKIM_VALID 125171 76.64 84.64 72.46 6 XM_B_Unicode 123738 74.22 83.67 69.28 7 DCC_CHECK 113180 53.69 76.53 41.76 8 XMListUnsubscribeExists 105276 57.20 71.18 49.90 9 XM_B_SpammyWords 103870 53.46 70.23 44.70 10 DKIM_VALID_AU 98789 61.52 66.80 58.76 11 XM_B_Unicode3 73975 45.60 50.02 43.30 12 LOC_TINY_FONT_1 72547 35.01 49.05 27.67 13 XM_B_SpammyWords2 62417 26.61 42.20 18.47 14 BAYES_50 60515 53.47 40.92 60.03 15 HTML_FONT_LOW_CONTRAST 58237 32.55 39.38 28.99 16 XM_DK_Undo_02 57331 16.55 38.76 4.95 17 RCVD_IN_MSPIKE_H2 55245 33.85 37.35 32.02 18 FVGT_m_MULTI_ODD 50434 26.66 34.10 22.77 19 T_KAM_HTML_FONT_INVALID 46446 23.76 31.40 19.77 20 BAYES_99 45503 12.88 30.77 3.54 21 MIME_HTML_ONLY 41294 22.72 27.92 20.00 22 TR_XM_DKIM_Undo 40055 10.62 27.08 2.02 23 DKIM_VALID_EF 37679 26.49 25.48 27.02 24 BAYES_999 35920 10.04 24.29 2.61 25 XM_Multi_Part_URI 34761 19.08 23.50 16.77 26 XMSubLong 34006 22.73 22.99 22.60 27 DCC_CHECK_NEGATIVE 32980 45.89 22.30 58.21 28 TR_DCC_Bayes_99 31961 8.40 21.61 1.50 29 T_TM2_M_HEADER_IN_MSG 30687 25.39 20.75 27.82 30 XM_B_Unsub 28576 12.15 19.32 8.40 31 TR_XM_BayesUnsub 27921 11.00 18.88 6.88 32 TR_XM_DK_Unsub 27020 13.98 18.27 11.74 33 UNPARSEABLE_RELAY 25016 13.07 16.91 11.06 34 RELAYCOUNTRY_META 22587 7.64 15.27 3.66 35 TR_MAX_INTL_RELAY 21912 9.04 14.82 6.02 36 XM_B_SpammyWords3 20586 7.78 13.92 4.57 37 LOTS_OF_MONEY 19133 9.35 12.94 7.47 38 TR_XM_SpammyWords4 17617 7.56 11.91 5.29 39 BOTNET_IPINHOSTNAME 17593 6.10 11.90 3.08 40 TR_XM_SpammyRelay 16627 5.20 11.24 2.05 41 TR_XM_SpammyWords2 15402 3.76 10.41 0.29 42 XM_Evil_Numbers_Gen 15021 10.09 10.16 10.06 43 BAYES_80 13669 5.64 9.24 3.75 44 RCVD_IN_BL_SPAMCOP_NET 13164 3.48 8.90 0.64 45 XM_Body_Dirty_Words 12847 4.84 8.69 2.83 46 BAYES_60 12714 9.09 8.60 9.35 47 FSL_BULK_SIG 12591 7.86 8.51 7.52 48 LotsOfNums_01 12392 8.19 8.38 8.10 49 TR_XM_UnparsRelay 12228 4.02 8.27 1.80 50 XM_B_Phish_Phrases 11914 6.14 8.06 5.14 51 BOTNET 11903 3.60 8.05 1.28 52 HTML_IMAGE_RATIO_02 11618 5.89 7.86 4.86 53 XM_B_PhoneNumber 11336 8.05 7.66 8.24 54 TR_XM_SPAMCOP 11099 2.84 7.50 0.40 55 TooManyTo_001 10580 7.81 7.15 8.16 56 XMSubMetaSx_00 10018 4.58 6.77 3.43 57 RELAYCOUNTRY_CA 9172 3.04 6.20 1.39 58 MPART_ALT_DIFF 8845 4.84 5.98 4.24 59 XM_UncommonTLD01 8569 4.67 5.79 4.08 60 BAYES_95 7854 3.31 5.31 2.26 61 XM_B_SEO 7845 2.71 5.30 1.35 62 XM_H_Long_From01 7676 5.09 5.19 5.03 63 UNTRUSTED_Relay 7355 2.69 4.97 1.49 64 T_XMDrugObfuBody_14 7119 2.87 4.81 1.86 65 TR_XM_SEO4 7061 2.27 4.77 0.97 66 TR_XM_PhishingBody 6930 2.84 4.69 1.88 67 XMSexyCombo_05 6871 2.68 4.65 1.66 68 TM2_M_VERY_LONG_WORD 6804 2.53 4.60 1.45 69 XM_H_GMP 6662 4.82 4.50 4.98 70 XM_B_SpammyTLD 6498 4.33 4.39 4.29 71 XM_B_Investor 6492 2.45 4.39 1.44 72 HTML_IMAGE_RATIO_04 6458 5.14 4.37 5.54 73 DKIM_INVALID 6401 2.77 4.33 1.96 74 XMStrtUSub 6081 5.01 4.11 5.47 75 XM_SPF_SoftFail 5880 2.48 3.98 1.70 76 XMNumbers 5639 3.28 3.81 3.00 77 RCVD_IN_MSPIKE_WL 5624 5.02 3.80 5.66 78 RCVD_IN_MSPIKE_H3 5624 5.02 3.80 5.66 79 TR_XM_SpammyWords5 5452 2.21 3.69 1.44 80 MIME_HTML_ONLY_MULTI 5341 3.03 3.61 2.73 81 HTML_IMAGE_RATIO_06 5100 3.26 3.45 3.16 82 TM2_M_URI_OPT_OUT 4850 2.47 3.28 2.04 83 HTML_IMAGE_RATIO_08 4764 2.57 3.22 2.23 84 TooManyTo_002 4724 2.33 3.19 1.87 85 XMDiploma_00 4716 2.10 3.19 1.54 86 XM_CamelCaseFrm001 4667 2.88 3.16 2.73 87 MIME_HTML_MOSTLY 4651 2.41 3.14 2.03 88 MIME_QP_LONG_LINE 4644 4.64 3.14 5.43 89 TR_LOTS_OF_MONEY3 4470 1.51 3.02 0.72 90 RELAYCOUNTRY_AU 4388 1.37 2.97 0.54 91 T_XMHurry_00 4323 1.50 2.92 0.76 92 XMBody_17 4243 1.29 2.87 0.47 93 TR_XM_FormFill 4156 0.98 2.81 0.02 94 RCVD_IN_VALIDITY_RPBL 4129 0.99 2.79 0.05 95 FROM_EXCESS_BASE64 4047 2.36 2.74 2.17 96 XMBrknScrpt_02 3988 1.58 2.70 1.00 97 TR_XM_NoHeaderRelay 3942 1.06 2.67 0.22 98 USER_IN_DEF_DKIM_WL 3840 10.72 2.60 14.97 99 XM_OfRef6 3686 1.53 2.49 1.03 100 T_XMDrugObfuBody_08 3667 1.81 2.48 1.45 101 XM_B_Unsub2 3658 1.59 2.47 1.13 102 XM_B_URI_Unicode 3495 2.06 2.36 1.90 103 XM_UB50 3495 1.38 2.36 0.86 104 XM_URI_RBL 3481 1.10 2.35 0.45 105 XM_B_SpammyWords4 3267 1.13 2.21 0.57 106 XM_B_FormFill 3266 0.87 2.21 0.17 107 XM_Appointment_Request 3241 0.76 2.19 0.01 108 T_TooManySym_01 3191 4.71 2.16 6.05 109 URI_HEX 3135 1.49 2.12 1.15 110 RCVD_IN_VALIDITY_SAFE 3114 3.82 2.11 4.72 111 SpammyFromTLD_01 3065 1.29 2.07 0.88 112 SUSP_UTF8_WORD_SUBJ 2921 0.71 1.98 0.05 113 MAILING_LIST_MULTI 2897 2.38 1.96 2.61 114 XM_H_Long_From02 2684 1.38 1.81 1.15 115 T_FILL_THIS_FORM_SHORT 2664 1.16 1.80 0.83 116 RCVD_IN_VALIDITY_CERTIFIED 2535 3.16 1.71 3.91 117 TR_XM_PHPForged 2476 0.91 1.67 0.52 118 TR_XM_PHPDW 2451 0.91 1.66 0.52 119 TR_XM_FormFill2 2433 0.91 1.65 0.52 120 XM_H_PHPOS 2404 0.89 1.63 0.51 121 XMStockSpam_06 2366 1.84 1.60 1.97 122 XMSubMetaI_00 2363 1.33 1.60 1.19 123 XM_DK_Undo_01 2341 1.56 1.58 1.55 124 SpammyFromTLD_02 2285 0.67 1.55 0.21 125 T_XMDrugObfuBody_00 2284 1.01 1.54 0.74 126 BAYES_40 2231 3.96 1.51 5.23 127 XMPhish30 2165 0.83 1.46 0.50 128 SUBJ_ALL_CAPS 2152 1.33 1.46 1.26 129 XMGenDplmaNmb 2043 0.94 1.38 0.71 130 HTTPS_HTTP_MISMATCH 2039 0.95 1.38 0.73 131 KHOP_HELO_FCRDNS 2005 1.18 1.36 1.10 132 XM_SendGrid 1988 1.33 1.34 1.32 133 MPART_ALT_DIFF_COUNT 1987 0.82 1.34 0.54 134 ALL_TRUSTED 1937 11.76 1.31 17.21 135 HTML_MIME_NO_HTML_TAG 1925 1.84 1.30 2.11 136 SHOPIFY_IMG_NOT_RCVD_SFY 1855 0.58 1.25 0.23 137 DIET_1 1838 0.77 1.24 0.53 138 T_STY_INVIS_DIRECT 1787 0.59 1.21 0.27 139 T_REMOTE_IMAGE 1771 2.71 1.20 3.50 140 RCVD_IN_IADB_LISTED 1766 2.95 1.19 3.86 141 RELAYCOUNTRY_FR 1760 0.54 1.19 0.20 142 XMPhish14 1704 0.85 1.15 0.69 143 BOTNET_NORDNS 1704 0.40 1.15 0.01 144 SHORTCIRCUIT 1698 0.39 1.15 0.00 145 RCVD_IN_ZEN_LASTEXTERNAL 1698 0.39 1.15 0.00 146 TR_XM_Base64_M1 1664 0.89 1.13 0.76 147 XMBdyGiftCard01 1654 0.93 1.12 0.83 148 HTML_TAG_BALANCE_BODY 1649 0.83 1.11 0.69 149 XM_S_SpammyWords 1641 0.47 1.11 0.13 150 TR_XM_Spammywords 1641 0.47 1.11 0.13 151 XM_B_COPY_HTML 1633 0.82 1.10 0.67 152 BAYES_20 1626 2.54 1.10 3.30 153 DKIM_ADSP_CUSTOM_MED 1562 0.88 1.06 0.78 154 RCVD_IN_IADB_SPF 1553 2.60 1.05 3.40 155 TR_XM_INV_DKIM 1542 0.41 1.04 0.07 156 XM_B_REG_HTML 1539 0.47 1.04 0.17 157 DKIM_ADSP_NXDOMAIN 1518 0.55 1.03 0.30 158 URI_NOVOWEL 1498 2.51 1.01 3.29 159 XM_B_Phish66 1492 0.54 1.01 0.29 160 RCVD_IN_IADB_DK 1480 2.28 1.00 2.94 161 XMPhish08 1476 0.57 1.00 0.35 162 XMSexyCombo_01 1472 0.45 1.00 0.16 163 RCVD_IN_IADB_SENDERID 1471 2.35 0.99 3.05 164 RCVD_IN_PSBL 1467 0.38 0.99 0.07 165 XMHTMLBadTable_001 1457 0.50 0.99 0.25 166 XMHTML_After_End 1456 0.54 0.98 0.31 167 XM_B_COVIDMETA 1449 0.48 0.98 0.21 168 RDNS_DYNAMIC 1446 0.56 0.98 0.34 169 TR_XM_RelayPhish 1419 0.37 0.96 0.06 170 PDS_RDNS_DYNAMIC_FP 1418 0.43 0.96 0.16 171 TVD_RCVD_IP 1416 0.69 0.96 0.55 172 TR_Symld_Words 1415 1.66 0.96 2.03 173 TR_LOTS_OF_MONEY2 1392 0.43 0.94 0.16 174 T_MONEY_PERCENT 1392 0.43 0.94 0.16 175 TooManyTo_003 1363 1.16 0.92 1.29 176 URI_TRY_3LD 1362 0.68 0.92 0.56 177 AC_BR_BONANZA 1355 0.38 0.92 0.10 178 TR_XM_Base64_L1 1349 0.40 0.91 0.13 179 XMReplyNow 1339 0.46 0.91 0.23 180 XMBody_78 1315 0.51 0.89 0.32 181 TooManyTo_004 1303 0.89 0.88 0.90 182 FORGED_GMAIL_RCVD 1280 0.62 0.87 0.49 183 NO_DNS_FOR_FROM 1271 0.52 0.86 0.34 184 TR_XM_InvalidRelay 1262 0.31 0.85 0.02 185 TooManyTo_005 1257 0.76 0.85 0.71 186 HELO_DYNAMIC_SPLIT_IP 1253 0.30 0.85 0.01 187 LongTLD 1249 0.51 0.84 0.33 188 TR_XM_MaxWHORU 1229 0.47 0.83 0.28 189 THIS_AD 1179 0.42 0.80 0.22 190 LONGLN_LOW_CONTRAST 1172 0.42 0.79 0.23 191 NML_ADSP_CUSTOM_MED 1169 0.63 0.79 0.55 192 XMSubMetaSxObfu_03 1169 0.52 0.79 0.38 193 XM_ProductURIs 1163 1.00 0.79 1.11 194 XM_HighProb1 1161 0.27 0.79 0.01 195 XM_UB99 1155 0.27 0.78 0.01 196 XM_B_DNDMA 1101 0.58 0.74 0.49 197 TR_MetaPhish_Combo_01 1084 0.72 0.73 0.72 198 XM_PDF 1084 2.93 0.73 4.07 199 TM2_M_OBFU_COMMENT 1077 0.48 0.73 0.35 200 DEAR_FRIEND 1076 0.30 0.73 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 235701 87.78 96.46 83.24 2 RELAYCOUNTRY_US 224883 81.34 85.02 79.42 3 DKIM_SIGNED 210703 79.41 88.96 74.42 4 XM_DK_Pass 207510 77.46 85.46 73.29 5 DKIM_VALID 205166 76.64 84.64 72.46 6 XM_B_Unicode 196161 74.22 83.67 69.28 7 BAYES_50 169980 53.47 40.92 60.03 8 DKIM_VALID_AU 166384 61.52 66.80 58.76 9 DCC_CHECK_NEGATIVE 164808 45.89 22.30 58.21 10 XMListUnsubscribeExists 141297 57.20 71.18 49.90 11 XM_B_SpammyWords 126566 53.46 70.23 44.70 12 XM_B_Unicode3 122593 45.60 50.02 43.30 13 DCC_CHECK 118238 53.69 76.53 41.76 14 RCVD_IN_MSPIKE_H2 90656 33.85 37.35 32.02 15 HTML_FONT_LOW_CONTRAST 82075 32.55 39.38 28.99 16 T_TM2_M_HEADER_IN_MSG 78771 25.39 20.75 27.82 17 LOC_TINY_FONT_1 78350 35.01 49.05 27.67 18 DKIM_VALID_EF 76497 26.49 25.48 27.02 19 FVGT_m_MULTI_ODD 64463 26.66 34.10 22.77 20 XMSubLong 63985 22.73 22.99 22.60 21 MIME_HTML_ONLY 56619 22.72 27.92 20.00 22 T_KAM_HTML_FONT_INVALID 55985 23.76 31.40 19.77 23 XM_B_SpammyWords2 52297 26.61 42.20 18.47 24 ALL_TRUSTED 48736 11.76 1.31 17.21 25 XM_Multi_Part_URI 47484 19.08 23.50 16.77 26 USER_IN_DEF_DKIM_WL 42377 10.72 2.60 14.97 27 TR_XM_DK_Unsub 33228 13.98 18.27 11.74 28 UNPARSEABLE_RELAY 31323 13.07 16.91 11.06 29 BAYES_00 29834 7.17 0.72 10.54 30 XM_Evil_Numbers_Gen 28471 10.09 10.16 10.06 31 BAYES_60 26476 9.09 8.60 9.35 32 XM_DKIMWhitelistDomains 24800 5.79 0.11 8.76 33 XM_B_Unsub 23782 12.15 19.32 8.40 34 XM_B_PhoneNumber 23345 8.05 7.66 8.24 35 TooManyTo_001 23098 7.81 7.15 8.16 36 LotsOfNums_01 22921 8.19 8.38 8.10 37 TR_XM_DK_Bayes 21342 5.16 0.61 7.54 38 FSL_BULK_SIG 21286 7.86 8.51 7.52 39 LOTS_OF_MONEY 21155 9.35 12.94 7.47 40 TR_XM_DK_Bayes1 21112 5.11 0.61 7.46 41 TR_XM_BayesUnsub 19473 11.00 18.88 6.88 42 TR_XM_DK_Bayes2 18382 4.35 0.24 6.49 43 IN_ZIMBRA_NJ_WHITELIST 17388 4.07 0.09 6.14 44 T_TooManySym_01 17119 4.71 2.16 6.05 45 TR_MAX_INTL_RELAY 17052 9.04 14.82 6.02 46 RCVD_IN_MSPIKE_WL 16028 5.02 3.80 5.66 47 RCVD_IN_MSPIKE_H3 16026 5.02 3.80 5.66 48 HTML_IMAGE_RATIO_04 15685 5.14 4.37 5.54 49 XMStrtUSub 15495 5.01 4.11 5.47 50 MIME_QP_LONG_LINE 15368 4.64 3.14 5.43 51 TR_XM_SpammyWords4 14977 7.56 11.91 5.29 52 BAYES_40 14821 3.96 1.51 5.23 53 XM_B_Phish_Phrases 14540 6.14 8.06 5.14 54 XM_H_Long_From01 14249 5.09 5.19 5.03 55 XM_H_GMP 14105 4.82 4.50 4.98 56 XM_DK_Undo_02 14004 16.55 38.76 4.95 57 HTML_IMAGE_RATIO_02 13751 5.89 7.86 4.86 58 RCVD_IN_VALIDITY_SAFE 13356 3.82 2.11 4.72 59 XM_B_SpammyWords3 12946 7.78 13.92 4.57 60 XM_B_SpammyTLD 12149 4.33 4.39 4.29 61 MPART_ALT_DIFF 12004 4.84 5.98 4.24 62 XM_UncommonTLD01 11547 4.67 5.79 4.08 63 XM_PDF 11535 2.93 0.73 4.07 64 RCVD_IN_VALIDITY_CERTIFIED 11066 3.16 1.71 3.91 65 RCVD_IN_IADB_LISTED 10940 2.95 1.19 3.86 66 BOUNCE_MESSAGE 10793 2.74 0.70 3.81 67 ANY_BOUNCE_MESSAGE 10793 2.74 0.70 3.81 68 BAYES_80 10627 5.64 9.24 3.75 69 RELAYCOUNTRY_META 10362 7.64 15.27 3.66 70 BAYES_99 10021 12.88 30.77 3.54 71 T_REMOTE_IMAGE 9923 2.71 1.20 3.50 72 XMSubMetaSx_00 9702 4.58 6.77 3.43 73 RCVD_IN_IADB_SPF 9636 2.60 1.05 3.40 74 BAYES_20 9334 2.54 1.10 3.30 75 URI_NOVOWEL 9304 2.51 1.01 3.29 76 HTML_IMAGE_RATIO_06 8939 3.26 3.45 3.16 77 BOTNET_IPINHOSTNAME 8713 6.10 11.90 3.08 78 RCVD_IN_IADB_SENDERID 8646 2.35 0.99 3.05 79 XMNumbers 8486 3.28 3.81 3.00 80 RCVD_IN_IADB_DK 8332 2.28 1.00 2.94 81 T_TooManySym_02 8085 2.08 0.61 2.86 82 XM_Body_Dirty_Words 8016 4.84 8.69 2.83 83 XM_CamelCaseFrm001 7740 2.88 3.16 2.73 84 MIME_HTML_ONLY_MULTI 7731 3.03 3.61 2.73 85 MAILING_LIST_MULTI 7377 2.38 1.96 2.61 86 BAYES_999 7377 10.04 24.29 2.61 87 RCVD_IN_IADB_VOUCHED 7226 1.86 0.53 2.55 88 INVALID_MSGID 6957 1.66 0.13 2.46 89 BAYES_95 6410 3.31 5.31 2.26 90 HTML_IMAGE_RATIO_08 6303 2.57 3.22 2.23 91 TO_MALFORMED 6268 1.45 0.00 2.21 92 FROM_EXCESS_BASE64 6133 2.36 2.74 2.17 93 HTML_MIME_NO_HTML_TAG 5988 1.84 1.30 2.11 94 TR_XM_SpammyRelay 5798 5.20 11.24 2.05 95 TM2_M_URI_OPT_OUT 5779 2.47 3.28 2.04 96 TR_Symld_Words 5743 1.66 0.96 2.03 97 MIME_HTML_MOSTLY 5737 2.41 3.14 2.03 98 TR_XM_DKIM_Undo 5724 10.62 27.08 2.02 99 BAYES_05 5637 1.55 0.69 1.99 100 XMStockSpam_06 5568 1.84 1.60 1.97 101 DKIM_INVALID 5537 2.77 4.33 1.96 102 XM_B_URI_Unicode 5392 2.06 2.36 1.90 103 TR_XM_PhishingBody 5325 2.84 4.69 1.88 104 XMGappySubj_01 5320 1.29 0.16 1.88 105 TooManyTo_002 5301 2.33 3.19 1.87 106 T_XMDrugObfuBody_14 5269 2.87 4.81 1.86 107 TR_XM_UnparsRelay 5100 4.02 8.27 1.80 108 RCVD_IN_IADB_OPTIN 5046 1.28 0.32 1.78 109 XM_SPF_SoftFail 4807 2.48 3.98 1.70 110 XMSexyCombo_05 4692 2.68 4.65 1.66 111 XM_DK_Undo_01 4383 1.56 1.58 1.55 112 XMDiploma_00 4357 2.10 3.19 1.54 113 TR_DCC_Bayes_99 4246 8.40 21.61 1.50 114 XMGappySubj_02 4245 1.00 0.06 1.50 115 UNTRUSTED_Relay 4231 2.69 4.97 1.49 116 IN_HORDE_ADDRESS_BOOK 4179 1.02 0.14 1.48 117 T_XMDrugObfuBody_08 4117 1.81 2.48 1.45 118 TM2_M_VERY_LONG_WORD 4111 2.53 4.60 1.45 119 TR_XM_SpammyWords5 4073 2.21 3.69 1.44 120 XM_B_Investor 4069 2.45 4.39 1.44 121 RELAYCOUNTRY_CA 3923 3.04 6.20 1.39 122 XM_B_SEO 3835 2.71 5.30 1.35 123 XM_SendGrid 3739 1.33 1.34 1.32 124 XM_TLDProd2 3661 0.97 0.35 1.29 125 TooManyTo_003 3657 1.16 0.92 1.29 126 TVD_SPACE_RATIO 3630 0.88 0.12 1.28 127 BOTNET 3628 3.60 8.05 1.28 128 SUBJ_ALL_CAPS 3570 1.33 1.46 1.26 129 XMSubMetaI_00 3381 1.33 1.60 1.19 130 XMNoVowels 3376 0.89 0.32 1.19 131 URI_HEX 3268 1.49 2.12 1.15 132 XM_H_Long_From02 3262 1.38 1.81 1.15 133 XM_B_Unsub2 3187 1.59 2.47 1.13 134 XM_ProductURIs 3137 1.00 0.79 1.11 135 KHOP_HELO_FCRDNS 3101 1.18 1.36 1.10 136 XM_H_Trusted_IP 3030 0.70 0.00 1.07 137 HELO_NODOT 2998 0.82 0.36 1.06 138 HELO_NO_DOMAIN 2996 0.82 0.36 1.06 139 XM_OfRef6 2910 1.53 2.49 1.03 140 T_TooManySym_03 2903 0.73 0.16 1.03 141 XMBrknScrpt_02 2838 1.58 2.70 1.00 142 TR_XM_SEO4 2743 2.27 4.77 0.97 143 XM_GoogleGroups 2602 0.79 0.55 0.92 144 XMSolicitRefs_0 2597 0.81 0.59 0.92 145 XMCapTrack 2556 0.78 0.54 0.90 146 TooManyTo_004 2540 0.89 0.88 0.90 147 SpammyFromTLD_01 2505 1.29 2.07 0.88 148 TR_XM_DK_SendGrid 2454 0.80 0.66 0.87 149 XM_UB50 2443 1.38 2.36 0.86 150 T_FILL_THIS_FORM_SHORT 2346 1.16 1.80 0.83 151 XMBdyGiftCard01 2343 0.93 1.12 0.83 152 XMBody_95 2294 0.58 0.14 0.81 153 DKIM_ADSP_CUSTOM_MED 2215 0.88 1.06 0.78 154 TR_XM_Base64_M1 2164 0.89 1.13 0.76 155 T_XMHurry_00 2149 1.50 2.92 0.76 156 XMSubNoVowel 2146 0.68 0.52 0.76 157 T_XMDrugObfuBody_00 2084 1.01 1.54 0.74 158 HTTPS_HTTP_MISMATCH 2064 0.95 1.38 0.73 159 TR_LOTS_OF_MONEY3 2042 1.51 3.02 0.72 160 TR_MetaPhish_Combo_01 2040 0.72 0.73 0.72 161 XMGenDplmaNmb 2006 0.94 1.38 0.71 162 TooManyTo_005 2006 0.76 0.85 0.71 163 XM_ShortIntro_01 1986 0.63 0.48 0.70 164 HTML_TAG_BALANCE_BODY 1946 0.83 1.11 0.69 165 XMPhish14 1941 0.85 1.15 0.69 166 XM_B_COPY_HTML 1900 0.82 1.10 0.67 167 XM_H_PHPMailer 1889 0.68 0.70 0.67 168 RCVD_IN_BL_SPAMCOP_NET 1819 3.48 8.90 0.64 169 T_Symld_Words_02 1747 0.61 0.59 0.62 170 T_OBFU_PDF_ATTACH 1707 0.48 0.24 0.60 171 RCVD_IN_PBL 1623 0.63 0.73 0.57 172 XM_B_SpammyWords4 1620 1.13 2.21 0.57 173 URI_TRY_3LD 1580 0.68 0.92 0.56 174 TVD_RCVD_IP 1553 0.69 0.96 0.55 175 NML_ADSP_CUSTOM_MED 1545 0.63 0.79 0.55 176 MPART_ALT_DIFF_COUNT 1537 0.82 1.34 0.54 177 RELAYCOUNTRY_AU 1522 1.37 2.97 0.54 178 DIET_1 1501 0.77 1.24 0.53 179 TR_XM_FormFill2 1472 0.91 1.65 0.52 180 TR_XM_PHPDW 1470 0.91 1.66 0.52 181 XMLngstWrd_00 1464 0.52 0.52 0.52 182 TR_XM_PHPForged 1462 0.91 1.67 0.52 183 XM_H_PHPOS 1443 0.89 1.63 0.51 184 XMPhish30 1408 0.83 1.46 0.50 185 XM_B_DNDMA 1399 0.58 0.74 0.49 186 FORGED_GMAIL_RCVD 1398 0.62 0.87 0.49 187 XMMoneyMeta_00 1398 0.55 0.65 0.49 188 XMBody_17 1334 1.29 2.87 0.47 189 FROM_GOV_DKIM_AU 1299 0.33 0.08 0.46 190 HTML_IMAGE_ONLY_32 1298 0.36 0.18 0.46 191 XM_URI_RBL 1275 1.10 2.35 0.45 192 USER_IN_WHITELIST 1222 0.28 0.00 0.43 193 USER_IN_WELCOMELIST 1222 0.28 0.00 0.43 194 HTML_FONT_FACE_BAD 1165 0.51 0.71 0.41 195 TR_XM_SPAMCOP 1138 2.84 7.50 0.40 196 OOOBOUNCE_MESSAGE 1134 0.27 0.01 0.40 197 HTML_IMAGE_ONLY_20 1132 0.39 0.37 0.40 198 TM2_M_BODY_EMPTY 1102 0.29 0.09 0.39 199 FILL_THIS_FORM 1098 0.42 0.47 0.39 200 MSGID_FROM_MTA_HEADER 1081 0.28 0.07 0.38 ----------------------------------------------------------------------