Email: 466996 Autolearn: 0 AvgScore: 4.89 AvgScanTime: 1.41 sec Spam: 153745 Autolearn: 0 AvgScore: 14.58 AvgScanTime: 1.52 sec Ham: 313251 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 1.35 sec Time Spent Running SA: 182.34 hours Time Spent Processing Spam: 64.96 hours Time Spent Processing Ham: 117.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 147656 90.09 96.04 87.17 2 DKIM_SIGNED 138717 81.17 90.23 76.72 3 XM_DK_Pass 132595 78.92 86.24 75.32 4 DKIM_VALID 131198 77.89 85.33 74.23 5 XM_B_Unicode 130633 75.44 84.97 70.76 6 RELAYCOUNTRY_US 128611 82.10 83.65 81.34 7 DCC_CHECK 118231 51.91 76.90 39.64 8 XMListUnsubscribeExists 108182 56.53 70.36 49.75 9 XM_B_SpammyWords 107329 53.34 69.81 45.26 10 DKIM_VALID_AU 102992 62.22 66.99 59.88 11 LOC_TINY_FONT_1 75982 34.87 49.42 27.72 12 XM_B_Unicode3 75276 43.34 48.96 40.59 13 XM_DK_Undo_02 62616 16.43 40.73 4.51 14 BAYES_50 61933 54.58 40.28 61.60 15 XM_B_SpammyWords2 61737 26.17 40.16 19.30 16 HTML_FONT_LOW_CONTRAST 61289 31.46 39.86 27.34 17 RCVD_IN_MSPIKE_H2 61046 36.78 39.71 35.35 18 FVGT_m_MULTI_ODD 53534 28.29 34.82 25.09 19 T_KAM_HTML_FONT_INVALID 48560 24.80 31.58 21.47 20 BAYES_99 45950 11.90 29.89 3.07 21 TR_XM_DKIM_Undo 45094 10.96 29.33 1.95 22 DKIM_VALID_EF 44321 29.27 28.83 29.49 23 MIME_HTML_ONLY 41523 22.14 27.01 19.75 24 XMSubLong 36095 23.56 23.48 23.60 25 BAYES_999 35349 9.13 22.99 2.33 26 TR_DCC_Bayes_99 33481 7.95 21.78 1.16 27 T_TM2_M_HEADER_IN_MSG 33254 26.91 21.63 29.50 28 DCC_CHECK_NEGATIVE 33123 47.54 21.54 60.30 29 TR_XM_DK_Unsub 32324 15.64 21.02 12.99 30 XM_Multi_Part_URI 31922 15.80 20.76 13.36 31 UNPARSEABLE_RELAY 27007 13.62 17.57 11.68 32 XM_B_Unsub 26480 11.95 17.22 9.36 33 TR_XM_BayesUnsub 25559 10.29 16.62 7.18 34 TR_MAX_INTL_RELAY 23397 8.68 15.22 5.47 35 RELAYCOUNTRY_META 22827 7.34 14.85 3.66 36 XM_B_SpammyWords3 22671 8.27 14.75 5.10 37 LOTS_OF_MONEY 20142 8.62 13.10 6.43 38 TR_XM_SpammyWords4 18053 6.75 11.74 4.30 39 BOTNET_IPINHOSTNAME 17860 6.02 11.62 3.28 40 TR_XM_SpammyWords2 17217 3.93 11.20 0.36 41 TR_XM_SpammyRelay 16487 4.77 10.72 1.85 42 FSL_BULK_SIG 15782 8.09 10.27 7.02 43 RCVD_IN_BL_SPAMCOP_NET 15574 3.74 10.13 0.60 44 BAYES_80 14784 5.44 9.62 3.39 45 XM_Evil_Numbers_Gen 14709 8.76 9.57 8.37 46 BOTNET 14486 4.05 9.42 1.41 47 TR_XM_UnparsRelay 14037 4.02 9.13 1.52 48 BAYES_60 13542 7.41 8.81 6.73 49 TR_XM_SPAMCOP 12470 2.90 8.11 0.35 50 XM_B_Phish_Phrases 12295 6.15 8.00 5.24 51 LotsOfNums_01 11601 8.09 7.55 8.36 52 XM_Body_Dirty_Words 10937 4.10 7.11 2.62 53 HTML_IMAGE_RATIO_02 10598 5.46 6.89 4.75 54 XM_UncommonTLD01 10339 5.22 6.72 4.48 55 XM_B_PhoneNumber 9403 8.87 6.12 10.22 56 RELAYCOUNTRY_CA 8983 2.59 5.84 0.99 57 MPART_ALT_DIFF 8523 4.80 5.54 4.44 58 XM_H_Long_From01 8290 5.84 5.39 6.06 59 XMSubMetaSx_00 8248 4.07 5.36 3.43 60 BAYES_95 8154 3.14 5.30 2.08 61 UNTRUSTED_Relay 8131 2.74 5.29 1.48 62 DKIM_INVALID 7519 3.28 4.89 2.49 63 TR_XM_SpammyWords5 7210 2.36 4.69 1.22 64 TR_XM_PhishingBody 7129 2.64 4.64 1.65 65 HTML_IMAGE_RATIO_04 7110 4.06 4.62 3.79 66 XM_B_Investor 6819 2.52 4.44 1.58 67 XM_H_GMP 6797 5.61 4.42 6.20 68 XMStrtUSub 6562 4.44 4.27 4.53 69 HTML_IMAGE_RATIO_06 6337 3.93 4.12 3.83 70 TM2_M_VERY_LONG_WORD 6150 2.20 4.00 1.32 71 T_XMDrugObfuBody_14 6080 2.69 3.95 2.06 72 XMSexyCombo_05 6007 2.07 3.91 1.16 73 XM_B_SpammyTLD 5904 2.97 3.84 2.55 74 XM_OfRef6 5889 2.08 3.83 1.22 75 RCVD_IN_MSPIKE_H3 5819 4.76 3.78 5.24 76 RCVD_IN_MSPIKE_WL 5819 4.76 3.78 5.24 77 MIME_QP_LONG_LINE 5490 4.74 3.57 5.32 78 HTML_IMAGE_RATIO_08 5458 2.75 3.55 2.36 79 MIME_HTML_ONLY_MULTI 5443 3.04 3.54 2.79 80 RCVD_IN_VALIDITY_RPBL 5375 1.23 3.50 0.12 81 XMNumbers 5361 3.04 3.49 2.82 82 TooManyTo_001 5131 6.65 3.34 8.27 83 TM2_M_URI_OPT_OUT 5005 2.47 3.26 2.08 84 XMDiploma_00 4834 2.18 3.14 1.71 85 T_XMDrugObfuBody_08 4636 2.06 3.02 1.59 86 XM_CamelCaseFrm001 4525 2.63 2.94 2.47 87 XM_SPF_SoftFail 4455 1.89 2.90 1.40 88 MIME_HTML_MOSTLY 4322 2.33 2.81 2.09 89 RELAYCOUNTRY_AU 4216 1.33 2.74 0.63 90 XM_B_Unsub2 4196 1.94 2.73 1.55 91 XM_B_URI_Unicode 4143 2.37 2.69 2.21 92 XM_UB50 4096 1.53 2.66 0.97 93 XM_B_SpammyWords4 3797 1.23 2.47 0.63 94 T_XMHurry_00 3691 1.25 2.40 0.69 95 SUBJ_ALL_CAPS 3689 1.86 2.40 1.59 96 T_TooManySym_01 3673 4.62 2.39 5.71 97 KHOP_HELO_FCRDNS 3507 1.55 2.28 1.19 98 XM_URI_RBL 3492 1.05 2.27 0.45 99 USER_IN_DEF_DKIM_WL 3370 9.52 2.19 13.12 100 FROM_EXCESS_BASE64 3365 1.71 2.19 1.47 101 XMBody_17 3348 1.00 2.18 0.42 102 T_XMDrugObfuBody_00 3338 1.27 2.17 0.82 103 T_FILL_THIS_FORM_SHORT 3320 1.38 2.16 1.00 104 TR_LOTS_OF_MONEY3 3287 1.14 2.14 0.65 105 RCVD_IN_VALIDITY_SAFE 3268 3.53 2.13 4.22 106 TR_XM_NoHeaderRelay 3264 0.86 2.12 0.24 107 MAILING_LIST_MULTI 3241 2.85 2.11 3.22 108 XMNoVowels 3139 1.90 2.04 1.83 109 ALL_TRUSTED 3103 11.20 2.02 15.70 110 TR_XM_INV_DKIM 3064 0.78 1.99 0.19 111 SpammyFromTLD_02 3038 0.94 1.98 0.44 112 TR_Mismatch_TLD_02 2978 0.69 1.94 0.08 113 SpammyFromTLD_01 2880 1.23 1.87 0.92 114 T_REMOTE_IMAGE 2813 3.22 1.83 3.91 115 RCVD_IN_PSBL 2786 0.68 1.81 0.12 116 BAYES_40 2734 4.25 1.78 5.46 117 RCVD_IN_VALIDITY_CERTIFIED 2721 3.02 1.77 3.63 118 DIET_1 2666 0.81 1.73 0.35 119 RCVD_IN_PBL 2614 1.05 1.70 0.73 120 XMGenDplmaNmb 2522 1.13 1.64 0.88 121 XMStockSpam_06 2518 1.46 1.64 1.37 122 RDNS_DYNAMIC 2487 0.67 1.62 0.21 123 HTML_MIME_NO_HTML_TAG 2465 2.49 1.60 2.92 124 PDS_RDNS_DYNAMIC_FP 2448 0.59 1.59 0.09 125 XM_H_Long_From02 2440 1.09 1.59 0.84 126 NO_DNS_FOR_FROM 2435 0.71 1.58 0.29 127 HK_RANDOM_REPLYTO 2407 0.58 1.57 0.09 128 URI_HEX 2405 1.44 1.56 1.38 129 TR_XM_MaxWHORU 2405 0.66 1.56 0.22 130 RCVD_IN_ZEN_LASTEXTERNAL 2380 0.51 1.55 0.00 131 SHORTCIRCUIT 2380 0.51 1.55 0.00 132 XMPhish30 2307 0.86 1.50 0.55 133 TVD_RCVD_IP 2261 0.95 1.47 0.69 134 BAYES_20 2256 3.06 1.47 3.84 135 XM_DK_Undo_01 2240 1.60 1.46 1.67 136 DEAR_FRIEND 2116 0.50 1.38 0.06 137 URI_TRY_3LD 2083 0.90 1.35 0.68 138 XM_B_Phish66 2080 0.67 1.35 0.34 139 XMBdyGiftCard01 2022 0.83 1.32 0.59 140 XMDateMe_00 1973 0.74 1.28 0.48 141 XMBrknScrpt_02 1965 1.08 1.28 0.98 142 MPART_ALT_DIFF_COUNT 1961 1.10 1.28 1.02 143 XM_SendGrid 1957 1.29 1.27 1.30 144 TR_MetaPhish_Combo_01 1941 0.97 1.26 0.83 145 LongTLD 1922 0.73 1.25 0.47 146 XM_B_COPY_HTML 1888 0.86 1.23 0.67 147 HTML_TAG_BALANCE_BODY 1836 0.88 1.19 0.73 148 HTTPS_HTTP_MISMATCH 1818 0.90 1.18 0.77 149 HTML_FONT_TINY_NORDNS 1776 0.42 1.16 0.05 150 XM_B_SEO 1757 0.54 1.14 0.25 151 TR_XM_PHPForged 1733 0.59 1.13 0.32 152 TR_XM_PHPDW 1724 0.58 1.12 0.32 153 SHOPIFY_IMG_NOT_RCVD_SFY 1712 0.54 1.11 0.25 154 TR_XM_RelayPhish 1710 0.42 1.11 0.08 155 XMSubMetaI_00 1708 0.63 1.11 0.40 156 TR_XM_FormFill2 1688 0.58 1.10 0.33 157 DKIM_ADSP_CUSTOM_MED 1672 1.15 1.09 1.18 158 XM_H_PHPOS 1658 0.56 1.08 0.31 159 TR_XM_SEO4 1622 0.41 1.05 0.10 160 RCVD_IN_IADB_LISTED 1610 2.99 1.05 3.94 161 RCVD_IN_IADB_SPF 1545 2.67 1.00 3.48 162 TM2_M_OBFU_COMMENT 1542 0.58 1.00 0.38 163 XM_B_DNDMA 1533 0.84 1.00 0.77 164 RCVD_IN_IADB_DK 1523 2.36 0.99 3.04 165 RCVD_IN_IADB_SENDERID 1512 2.41 0.98 3.12 166 XMBody_78 1500 0.62 0.98 0.45 167 RELAYCOUNTRY_FR 1484 0.50 0.97 0.27 168 URI_NOVOWEL 1473 1.69 0.96 2.05 169 TO_MALFORMED 1449 1.66 0.94 2.01 170 XMPhish14 1436 0.61 0.93 0.45 171 ANY_BOUNCE_MESSAGE 1401 2.48 0.91 3.25 172 BOUNCE_MESSAGE 1400 2.48 0.91 3.25 173 MultiRelay_CC 1386 0.40 0.90 0.15 174 XM_B_REG_HTML 1384 0.46 0.90 0.24 175 XM_ProductURIs 1358 0.54 0.88 0.37 176 RELAYCOUNTRY_GB 1341 0.58 0.87 0.44 177 TR_Symld_Words 1341 1.42 0.87 1.69 178 TR_XM_FormFill 1306 0.29 0.85 0.01 179 DKIM_ADSP_NXDOMAIN 1305 0.49 0.85 0.32 180 ADVANCE_FEE_4_NEW_MONEY 1294 0.28 0.84 0.00 181 XM_UB99 1292 0.28 0.84 0.00 182 TM2_M_A_HREF_HREF 1286 0.43 0.84 0.24 183 MONEY_FRAUD_5 1274 0.27 0.83 0.00 184 T_STY_INVIS_DIRECT 1270 0.55 0.83 0.42 185 NML_ADSP_CUSTOM_MED 1267 0.85 0.82 0.86 186 XMHTML_After_End 1258 0.46 0.82 0.28 187 XMReplyNow 1242 0.40 0.81 0.20 188 FORGED_GMAIL_RCVD 1241 0.84 0.81 0.86 189 TR_XM_DK_SendGrid 1234 0.78 0.80 0.76 190 TR_XM_InvalidRelay 1233 0.27 0.80 0.01 191 HTML_IMAGE_ONLY_20 1222 0.61 0.79 0.52 192 URIBL_BLACK 1218 0.30 0.79 0.06 193 FONT_INVIS_LONG_LINE 1217 0.34 0.79 0.11 194 XM_HighProb1 1214 0.27 0.79 0.01 195 XMSlimDrugH 1185 0.71 0.77 0.68 196 TR_XM_Base64_M1 1169 0.64 0.76 0.58 197 TR_Caps_n_Bayes_99 1168 0.26 0.76 0.01 198 XM_B_COVIDMETA 1167 0.36 0.76 0.16 199 TR_XM_Spammywords 1163 0.37 0.76 0.18 200 XM_S_SpammyWords 1163 0.37 0.76 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 273071 90.09 96.04 87.17 2 RELAYCOUNTRY_US 254784 82.10 83.65 81.34 3 DKIM_SIGNED 240322 81.17 90.23 76.72 4 XM_DK_Pass 235952 78.92 86.24 75.32 5 DKIM_VALID 232527 77.89 85.33 74.23 6 XM_B_Unicode 221660 75.44 84.97 70.76 7 BAYES_50 192969 54.58 40.28 61.60 8 DCC_CHECK_NEGATIVE 188900 47.54 21.54 60.30 9 DKIM_VALID_AU 187570 62.22 66.99 59.88 10 XMListUnsubscribeExists 155828 56.53 70.36 49.75 11 XM_B_SpammyWords 141784 53.34 69.81 45.26 12 XM_B_Unicode3 127143 43.34 48.96 40.59 13 DCC_CHECK 124173 51.91 76.90 39.64 14 RCVD_IN_MSPIKE_H2 110728 36.78 39.71 35.35 15 T_TM2_M_HEADER_IN_MSG 92418 26.91 21.63 29.50 16 DKIM_VALID_EF 92364 29.27 28.83 29.49 17 LOC_TINY_FONT_1 86840 34.87 49.42 27.72 18 HTML_FONT_LOW_CONTRAST 85649 31.46 39.86 27.34 19 FVGT_m_MULTI_ODD 78587 28.29 34.82 25.09 20 XMSubLong 73929 23.56 23.48 23.60 21 T_KAM_HTML_FONT_INVALID 67243 24.80 31.58 21.47 22 MIME_HTML_ONLY 61875 22.14 27.01 19.75 23 XM_B_SpammyWords2 60456 26.17 40.16 19.30 24 ALL_TRUSTED 49190 11.20 2.02 15.70 25 XM_Multi_Part_URI 41865 15.80 20.76 13.36 26 USER_IN_DEF_DKIM_WL 41097 9.52 2.19 13.12 27 TR_XM_DK_Unsub 40703 15.64 21.02 12.99 28 UNPARSEABLE_RELAY 36601 13.62 17.57 11.68 29 BAYES_00 35854 7.91 0.71 11.45 30 XM_B_PhoneNumber 32024 8.87 6.12 10.22 31 XM_B_Unsub 29329 11.95 17.22 9.36 32 XM_Evil_Numbers_Gen 26211 8.76 9.57 8.37 33 LotsOfNums_01 26178 8.09 7.55 8.36 34 TooManyTo_001 25917 6.65 3.34 8.27 35 TR_XM_DK_Bayes 24514 5.43 0.55 7.83 36 TR_XM_DK_Bayes1 23989 5.31 0.54 7.66 37 TR_XM_BayesUnsub 22492 10.29 16.62 7.18 38 IN_ZIMBRA_NJ_WHITELIST 22147 4.78 0.12 7.07 39 FSL_BULK_SIG 21977 8.09 10.27 7.02 40 BAYES_60 21072 7.41 8.81 6.73 41 XM_DKIMWhitelistDomains 20305 4.36 0.03 6.48 42 TR_XM_DK_Bayes2 20215 4.45 0.38 6.45 43 LOTS_OF_MONEY 20131 8.62 13.10 6.43 44 XM_H_GMP 19424 5.61 4.42 6.20 45 XM_H_Long_From01 18977 5.84 5.39 6.06 46 T_TooManySym_01 17892 4.62 2.39 5.71 47 TR_MAX_INTL_RELAY 17146 8.68 15.22 5.47 48 BAYES_40 17110 4.25 1.78 5.46 49 MIME_QP_LONG_LINE 16661 4.74 3.57 5.32 50 XM_B_Phish_Phrases 16423 6.15 8.00 5.24 51 RCVD_IN_MSPIKE_H3 16408 4.76 3.78 5.24 52 RCVD_IN_MSPIKE_WL 16408 4.76 3.78 5.24 53 XM_B_SpammyWords3 15972 8.27 14.75 5.10 54 XM_PDF 14977 3.43 0.68 4.78 55 HTML_IMAGE_RATIO_02 14886 5.46 6.89 4.75 56 XMStrtUSub 14178 4.44 4.27 4.53 57 XM_DK_Undo_02 14121 16.43 40.73 4.51 58 XM_UncommonTLD01 14040 5.22 6.72 4.48 59 MPART_ALT_DIFF 13896 4.80 5.54 4.44 60 TR_XM_SpammyWords4 13470 6.75 11.74 4.30 61 RCVD_IN_VALIDITY_SAFE 13218 3.53 2.13 4.22 62 RCVD_IN_IADB_LISTED 12349 2.99 1.05 3.94 63 T_REMOTE_IMAGE 12233 3.22 1.83 3.91 64 BAYES_20 12026 3.06 1.47 3.84 65 HTML_IMAGE_RATIO_06 12013 3.93 4.12 3.83 66 HTML_IMAGE_RATIO_04 11866 4.06 4.62 3.79 67 RELAYCOUNTRY_META 11458 7.34 14.85 3.66 68 RCVD_IN_VALIDITY_CERTIFIED 11378 3.02 1.77 3.63 69 RCVD_IN_IADB_SPF 10910 2.67 1.00 3.48 70 XMSubMetaSx_00 10748 4.07 5.36 3.43 71 BAYES_80 10628 5.44 9.62 3.39 72 BOTNET_IPINHOSTNAME 10272 6.02 11.62 3.28 73 ANY_BOUNCE_MESSAGE 10181 2.48 0.91 3.25 74 BOUNCE_MESSAGE 10180 2.48 0.91 3.25 75 MAILING_LIST_MULTI 10085 2.85 2.11 3.22 76 T_TooManySym_02 9986 2.38 0.73 3.19 77 RCVD_IN_IADB_SENDERID 9763 2.41 0.98 3.12 78 BAYES_99 9614 11.90 29.89 3.07 79 RCVD_IN_IADB_DK 9511 2.36 0.99 3.04 80 HTML_MIME_NO_HTML_TAG 9141 2.49 1.60 2.92 81 TooManyTo_002 8965 2.10 0.55 2.86 82 XMNumbers 8830 3.04 3.49 2.82 83 MIME_HTML_ONLY_MULTI 8742 3.04 3.54 2.79 84 XM_Body_Dirty_Words 8193 4.10 7.11 2.62 85 XM_B_SpammyTLD 7980 2.97 3.84 2.55 86 DKIM_INVALID 7795 3.28 4.89 2.49 87 RCVD_IN_IADB_VOUCHED 7786 1.77 0.30 2.49 88 XM_CamelCaseFrm001 7750 2.63 2.94 2.47 89 BAYES_05 7470 1.80 0.59 2.38 90 HTML_IMAGE_RATIO_08 7399 2.75 3.55 2.36 91 BAYES_999 7299 9.13 22.99 2.33 92 INVALID_MSGID 7222 1.59 0.14 2.31 93 XM_B_URI_Unicode 6936 2.37 2.69 2.21 94 MIME_HTML_MOSTLY 6545 2.33 2.81 2.09 95 TM2_M_URI_OPT_OUT 6524 2.47 3.26 2.08 96 BAYES_95 6502 3.14 5.30 2.08 97 T_XMDrugObfuBody_14 6466 2.69 3.95 2.06 98 URI_NOVOWEL 6428 1.69 0.96 2.05 99 TO_MALFORMED 6287 1.66 0.94 2.01 100 TR_XM_DKIM_Undo 6096 10.96 29.33 1.95 101 TR_XM_SpammyRelay 5794 4.77 10.72 1.85 102 XMNoVowels 5748 1.90 2.04 1.83 103 RCVD_IN_IADB_OPTIN 5521 1.25 0.21 1.76 104 XMDiploma_00 5353 2.18 3.14 1.71 105 TR_Symld_Words 5306 1.42 0.87 1.69 106 XM_DK_Undo_01 5242 1.60 1.46 1.67 107 TR_XM_PhishingBody 5183 2.64 4.64 1.65 108 TooManyTo_003 5181 1.27 0.47 1.65 109 T_XMDrugObfuBody_08 4984 2.06 3.02 1.59 110 SUBJ_ALL_CAPS 4979 1.86 2.40 1.59 111 XM_B_Investor 4934 2.52 4.44 1.58 112 XM_B_Unsub2 4857 1.94 2.73 1.55 113 TR_XM_UnparsRelay 4749 4.02 9.13 1.52 114 IN_HORDE_ADDRESS_BOOK 4657 1.02 0.08 1.49 115 UNTRUSTED_Relay 4648 2.74 5.29 1.48 116 FROM_EXCESS_BASE64 4605 1.71 2.19 1.47 117 BOTNET 4415 4.05 9.42 1.41 118 XM_SPF_SoftFail 4374 1.89 2.90 1.40 119 URI_HEX 4338 1.44 1.56 1.38 120 XMStockSpam_06 4284 1.46 1.64 1.37 121 TM2_M_VERY_LONG_WORD 4121 2.20 4.00 1.32 122 XM_SendGrid 4057 1.29 1.27 1.30 123 T_TooManySym_03 4026 0.92 0.18 1.29 124 HELO_NODOT 3999 0.89 0.11 1.28 125 HELO_NO_DOMAIN 3995 0.89 0.11 1.28 126 XMCapTrack 3917 0.97 0.40 1.25 127 TR_XM_SpammyWords5 3829 2.36 4.69 1.22 128 XM_OfRef6 3807 2.08 3.83 1.22 129 XMGappySubj_01 3767 0.85 0.13 1.20 130 KHOP_HELO_FCRDNS 3723 1.55 2.28 1.19 131 TooManyTo_004 3712 0.93 0.40 1.18 132 XM_GoogleGroups 3703 1.00 0.64 1.18 133 DKIM_ADSP_CUSTOM_MED 3690 1.15 1.09 1.18 134 XMSexyCombo_05 3643 2.07 3.91 1.16 135 TR_DCC_Bayes_99 3633 7.95 21.78 1.16 136 TVD_SPACE_RATIO 3264 0.76 0.18 1.04 137 MPART_ALT_DIFF_COUNT 3181 1.10 1.28 1.02 138 T_FILL_THIS_FORM_SHORT 3127 1.38 2.16 1.00 139 RELAYCOUNTRY_CA 3111 2.59 5.84 0.99 140 XMBrknScrpt_02 3056 1.08 1.28 0.98 141 TooManyTo_005 3045 0.77 0.36 0.97 142 XM_UB50 3041 1.53 2.66 0.97 143 SpammyFromTLD_01 2878 1.23 1.87 0.92 144 FROM_GOV_DKIM_AU 2779 0.65 0.16 0.89 145 XMGenDplmaNmb 2771 1.13 1.64 0.88 146 FORGED_GMAIL_RCVD 2689 0.84 0.81 0.86 147 NML_ADSP_CUSTOM_MED 2680 0.85 0.82 0.86 148 XM_H_Long_From02 2636 1.09 1.59 0.84 149 TR_MetaPhish_Combo_01 2603 0.97 1.26 0.83 150 XM_ShortIntro_01 2600 0.70 0.45 0.83 151 T_XMDrugObfuBody_00 2581 1.27 2.17 0.82 152 XM_H_PHPMailer 2489 0.73 0.59 0.79 153 TO_NO_BRKTS_HTML_ONLY 2454 0.65 0.39 0.78 154 XM_B_DNDMA 2408 0.84 1.00 0.77 155 HTTPS_HTTP_MISMATCH 2402 0.90 1.18 0.77 156 TR_XM_DK_SendGrid 2396 0.78 0.80 0.76 157 T_Symld_Words_02 2305 0.69 0.60 0.74 158 RCVD_IN_PBL 2291 1.05 1.70 0.73 159 HTML_TAG_BALANCE_BODY 2276 0.88 1.19 0.73 160 T_OBFU_PDF_ATTACH 2153 0.52 0.17 0.69 161 TVD_RCVD_IP 2153 0.95 1.47 0.69 162 T_XMHurry_00 2153 1.25 2.40 0.69 163 XMBody_95 2146 0.50 0.12 0.69 164 XMSlimDrugH 2138 0.71 0.77 0.68 165 URI_TRY_3LD 2121 0.90 1.35 0.68 166 XM_B_COPY_HTML 2108 0.86 1.23 0.67 167 XMGappySubj_02 2085 0.46 0.04 0.67 168 TR_LOTS_OF_MONEY3 2035 1.14 2.14 0.65 169 XMLngstWrd_00 1999 0.64 0.64 0.64 170 RELAYCOUNTRY_AU 1986 1.33 2.74 0.63 171 XM_B_SpammyWords4 1966 1.23 2.47 0.63 172 RCVD_IN_BL_SPAMCOP_NET 1876 3.74 10.13 0.60 173 XMBdyGiftCard01 1853 0.83 1.32 0.59 174 TR_XM_Base64_M1 1831 0.64 0.76 0.58 175 XMPhish30 1731 0.86 1.50 0.55 176 MSGID_FROM_MTA_HEADER 1657 0.38 0.09 0.53 177 XM_B_FormFill 1657 0.40 0.14 0.53 178 XMSubMetaSxObfu_03 1638 0.58 0.70 0.52 179 HTML_IMAGE_ONLY_20 1627 0.61 0.79 0.52 180 XMMoneyMeta_00 1580 0.57 0.72 0.50 181 XMDateMe_00 1495 0.74 1.28 0.48 182 LongTLD 1465 0.73 1.25 0.47 183 HTML_FONT_FACE_BAD 1462 0.53 0.66 0.47 184 XMLngstWrd_01 1453 0.46 0.46 0.46 185 PLING_QUERY 1428 0.55 0.73 0.46 186 XM_URI_RBL 1408 1.05 2.27 0.45 187 XMBody_78 1406 0.62 0.98 0.45 188 XMBSHREFv2 1405 0.43 0.40 0.45 189 XMPhish14 1394 0.61 0.93 0.45 190 SpammyFromTLD_02 1373 0.94 1.98 0.44 191 RELAYCOUNTRY_GB 1370 0.58 0.87 0.44 192 HTML_IMAGE_ONLY_32 1345 0.34 0.16 0.43 193 HELO_MISC_IP 1335 0.31 0.08 0.43 194 XMBody_17 1316 1.00 2.18 0.42 195 T_STY_INVIS_DIRECT 1308 0.55 0.83 0.42 196 XM_Ancestry_Forge 1287 0.28 0.00 0.41 197 SHORT_HELO_AND_INLINE_IMAGE 1278 0.28 0.03 0.41 198 MISSING_HEADERS 1253 0.41 0.44 0.40 199 USER_IN_WELCOMELIST 1250 0.27 0.00 0.40 200 USER_IN_WHITELIST 1250 0.27 0.00 0.40 ----------------------------------------------------------------------