Email: 546973 Autolearn: 0 AvgScore: 2.59 AvgScanTime: 1.46 sec Spam: 147354 Autolearn: 0 AvgScore: 14.62 AvgScanTime: 1.70 sec Ham: 399619 Autolearn: 0 AvgScore: -1.85 AvgScanTime: 1.38 sec Time Spent Running SA: 222.20 hours Time Spent Processing Spam: 69.39 hours Time Spent Processing Ham: 152.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138755 89.83 94.16 88.23 2 DKIM_SIGNED 131726 69.56 89.39 62.25 3 RELAYCOUNTRY_US 125236 83.27 84.99 82.63 4 XM_DK_Pass 125145 67.45 84.93 61.00 5 DKIM_VALID 123267 66.40 83.65 60.04 6 XM_B_Unicode 121711 72.77 82.60 69.14 7 DCC_CHECK 109612 43.74 74.39 32.44 8 XMListUnsubscribeExists 101822 46.64 69.10 38.36 9 XM_B_SpammyWords 100922 50.12 68.49 43.35 10 DKIM_VALID_AU 95308 52.07 64.68 47.42 11 XM_B_Unicode3 73009 44.04 49.55 42.01 12 LOC_TINY_FONT_1 70219 27.34 47.65 19.85 13 BAYES_50 62396 53.11 42.34 57.08 14 XM_DK_Undo_02 60295 13.74 40.92 3.72 15 XM_B_SpammyWords2 59277 22.04 40.23 15.34 16 RCVD_IN_MSPIKE_H2 54688 30.73 37.11 28.38 17 HTML_FONT_LOW_CONTRAST 53203 29.04 36.11 26.44 18 T_KAM_HTML_FONT_INVALID 48053 21.68 32.61 17.65 19 FVGT_m_MULTI_ODD 47605 23.07 32.31 19.66 20 DKIM_VALID_EF 45558 26.39 30.92 24.72 21 BAYES_99 43111 9.72 29.26 2.51 22 MIME_HTML_ONLY 41856 24.62 28.41 23.22 23 TR_XM_DKIM_Undo 41194 8.60 27.96 1.47 24 XMSubLong 38213 24.97 25.93 24.61 25 DCC_CHECK_NEGATIVE 35007 55.72 23.76 67.51 26 BAYES_999 33596 7.48 22.80 1.83 27 XM_Multi_Part_URI 33410 14.14 22.67 10.99 28 T_TM2_M_HEADER_IN_MSG 31427 27.00 21.33 29.09 29 TR_DCC_Bayes_99 31172 6.27 21.15 0.78 30 TR_XM_DK_Unsub 30994 12.83 21.03 9.80 31 UNPARSEABLE_RELAY 26360 11.93 17.89 9.74 32 XM_B_Unsub 23892 9.98 16.21 7.68 33 TR_XM_BayesUnsub 22573 8.38 15.32 5.82 34 TR_MAX_INTL_RELAY 20946 6.91 14.21 4.22 35 LOTS_OF_MONEY 20906 7.70 14.19 5.30 36 XM_B_SpammyWords3 20702 6.14 14.05 3.23 37 RELAYCOUNTRY_META 20388 6.01 13.84 3.12 38 TR_XM_SpammyWords4 16866 5.71 11.45 3.59 39 BOTNET_IPINHOSTNAME 16414 4.70 11.14 2.32 40 TR_XM_SpammyWords2 16334 3.19 11.08 0.28 41 RCVD_IN_BL_SPAMCOP_NET 15836 3.39 10.75 0.68 42 XM_Evil_Numbers_Gen 15229 10.26 10.33 10.24 43 TR_XM_SpammyRelay 14979 3.81 10.17 1.47 44 FSL_BULK_SIG 13926 7.82 9.45 7.22 45 BOTNET 13308 3.18 9.03 1.02 46 XM_Body_Dirty_Words 13077 4.22 8.87 2.50 47 BAYES_80 12876 4.25 8.74 2.59 48 XM_B_Phish_Phrases 12813 5.70 8.70 4.59 49 TR_XM_UnparsRelay 12524 3.07 8.50 1.07 50 XMSubMetaSx_00 12450 4.97 8.45 3.68 51 TR_XM_SPAMCOP 11980 2.46 8.13 0.37 52 BAYES_60 11914 7.03 8.09 6.64 53 LotsOfNums_01 11461 9.34 7.78 9.92 54 XM_H_Long_From01 9772 5.30 6.63 4.81 55 MPART_ALT_DIFF 9617 7.95 6.53 8.47 56 HTML_IMAGE_RATIO_02 9252 4.35 6.28 3.63 57 XM_B_PhoneNumber 8939 7.71 6.07 8.32 58 XM_H_GMP 8567 5.08 5.81 4.81 59 DKIM_INVALID 8459 3.16 5.74 2.21 60 TR_XM_PhishingBody 8189 2.76 5.56 1.72 61 XM_UncommonTLD01 7819 4.35 5.31 3.99 62 BAYES_95 7591 2.58 5.15 1.63 63 T_XMDrugObfuBody_14 7347 2.59 4.99 1.70 64 XMSexyCombo_05 7269 2.50 4.93 1.60 65 XM_B_Investor 7066 2.45 4.80 1.59 66 UNTRUSTED_Relay 6970 2.20 4.73 1.27 67 RELAYCOUNTRY_CA 6471 1.81 4.39 0.86 68 TM2_M_VERY_LONG_WORD 6404 5.15 4.35 5.44 69 HTML_IMAGE_RATIO_04 6299 10.79 4.27 13.19 70 MIME_HTML_ONLY_MULTI 6149 6.23 4.17 6.98 71 TooManyTo_001 6099 6.86 4.14 7.86 72 HTML_IMAGE_RATIO_06 5848 4.03 3.97 4.05 73 RCVD_IN_VALIDITY_RPBL 5763 1.14 3.91 0.12 74 XMDiploma_00 5652 2.05 3.84 1.39 75 XMNumbers 5355 3.03 3.63 2.81 76 XM_B_SpammyTLD 5290 2.35 3.59 1.90 77 XMStrtUSub 5102 9.00 3.46 11.04 78 RCVD_IN_MSPIKE_H3 4899 4.49 3.32 4.93 79 RCVD_IN_MSPIKE_WL 4899 4.49 3.32 4.93 80 MIME_HTML_MOSTLY 4747 2.22 3.22 1.85 81 XM_OfRef6 4705 1.49 3.19 0.86 82 HTML_IMAGE_RATIO_08 4634 2.19 3.14 1.84 83 XM_SPF_SoftFail 4574 1.86 3.10 1.40 84 TR_XM_SpammyWords5 4515 1.69 3.06 1.18 85 XM_DK_Undo_01 4490 1.77 3.05 1.30 86 RELAYCOUNTRY_AU 4489 1.18 3.05 0.50 87 MIME_QP_LONG_LINE 4479 4.15 3.04 4.56 88 XM_CamelCaseFrm001 4431 2.08 3.01 1.74 89 XM_SendGrid 4364 1.79 2.96 1.36 90 T_XMDrugObfuBody_08 4026 1.55 2.73 1.11 91 XM_B_URI_Unicode 3826 1.86 2.60 1.59 92 XM_B_Unsub2 3800 1.58 2.58 1.22 93 T_TooManySym_01 3704 4.18 2.51 4.80 94 TM2_M_URI_OPT_OUT 3657 1.61 2.48 1.29 95 HTML_MIME_NO_HTML_TAG 3644 2.54 2.47 2.56 96 MAILING_LIST_MULTI 3629 2.48 2.46 2.49 97 XM_URI_RBL 3612 0.95 2.45 0.40 98 XM_B_SpammyWords4 3526 1.07 2.39 0.58 99 XM_B_Phish66 3341 0.81 2.27 0.28 100 XM_UB50 3315 1.19 2.25 0.80 101 FROM_EXCESS_BASE64 3177 1.81 2.16 1.68 102 TR_XM_NoHeaderRelay 3148 0.69 2.14 0.16 103 DKIM_ADSP_NXDOMAIN 3078 0.73 2.09 0.24 104 TR_XM_INV_DKIM 3061 0.63 2.08 0.10 105 XMGenDplmaNmb 3012 1.13 2.04 0.79 106 XMStockSpam_06 2998 1.44 2.03 1.22 107 USER_IN_DEF_DKIM_WL 2980 8.07 2.02 10.30 108 T_REMOTE_IMAGE 2937 3.26 1.99 3.73 109 ALL_TRUSTED 2923 11.33 1.98 14.78 110 NO_DNS_FOR_FROM 2895 0.68 1.96 0.21 111 TR_XM_MaxWHORU 2885 0.65 1.96 0.17 112 T_XMDrugObfuBody_00 2848 1.07 1.93 0.76 113 SpammyFromTLD_01 2749 1.09 1.87 0.80 114 T_FILL_THIS_FORM_SHORT 2710 1.08 1.84 0.80 115 SHORTCIRCUIT 2687 0.49 1.82 0.00 116 RCVD_IN_ZEN_LASTEXTERNAL 2687 0.49 1.82 0.00 117 T_XMHurry_00 2606 0.80 1.77 0.44 118 XM_PDF 2497 4.39 1.69 5.38 119 BAYES_40 2456 4.94 1.67 6.15 120 TR_LOTS_OF_MONEY3 2425 0.57 1.65 0.18 121 XMBody_17 2407 0.66 1.63 0.30 122 XMSexyCombo_01 2381 0.65 1.62 0.29 123 SpammyFromTLD_02 2371 0.70 1.61 0.36 124 RCVD_IN_VALIDITY_SAFE 2349 2.76 1.59 3.19 125 SUSP_UTF8_WORD_SUBJ 2322 0.43 1.58 0.01 126 XMPhish30 2298 0.78 1.56 0.50 127 XMBrknScrpt_02 2260 0.95 1.53 0.73 128 TR_Symld_Words 2243 1.27 1.52 1.17 129 XM_B_COPY_HTML 2223 0.88 1.51 0.65 130 XMBody_78 2190 0.59 1.49 0.26 131 DKIM_ADSP_CUSTOM_MED 2185 1.00 1.48 0.82 132 KHOP_HELO_FCRDNS 2159 3.00 1.47 3.57 133 XM_H_Long_From02 2129 1.01 1.44 0.85 134 ANY_BOUNCE_MESSAGE 2116 5.78 1.44 7.38 135 BOUNCE_MESSAGE 2100 5.77 1.43 7.38 136 HTTPS_HTTP_MISMATCH 2018 1.06 1.37 0.94 137 SUSP_UTF8_WORD_COMBO 2003 0.39 1.36 0.03 138 XM_B_SEO 1932 0.50 1.31 0.19 139 TR_XM_PHPForged 1927 0.52 1.31 0.23 140 URI_HEX 1927 1.05 1.31 0.95 141 BAYES_20 1897 3.44 1.29 4.24 142 TR_XM_PHPDW 1893 0.52 1.28 0.24 143 RELAYCOUNTRY_GB 1874 0.63 1.27 0.39 144 TR_XM_FormFill2 1872 0.51 1.27 0.24 145 SUBJ_ALL_CAPS 1871 1.16 1.27 1.12 146 XM_DIRTYINTL 1865 0.41 1.27 0.09 147 XM_H_PHPOS 1843 0.50 1.25 0.23 148 RCVD_IN_VALIDITY_CERTIFIED 1795 2.22 1.22 2.60 149 NML_ADSP_CUSTOM_MED 1792 0.74 1.22 0.56 150 XM_B_COVIDMETA 1780 0.44 1.21 0.15 151 DIET_1 1749 0.51 1.19 0.26 152 MIME_CHARSET_FARAWAY 1731 1.72 1.17 1.93 153 URI_TRY_3LD 1727 0.68 1.17 0.50 154 TR_XM_SEO4 1723 0.38 1.17 0.09 155 XMHTML_After_End 1701 0.50 1.15 0.26 156 RCVD_IN_IADB_LISTED 1694 2.86 1.15 3.50 157 FORGED_GMAIL_RCVD 1655 0.70 1.12 0.54 158 XMBdyGiftCard01 1642 0.46 1.11 0.21 159 HOSTED_IMG_MULTI_PUB_01 1634 0.31 1.11 0.02 160 URI_NOVOWEL 1616 1.28 1.10 1.35 161 MPART_ALT_DIFF_COUNT 1609 0.70 1.09 0.56 162 TR_LOTS_OF_MONEY2 1600 0.41 1.09 0.15 163 T_MONEY_PERCENT 1600 0.41 1.09 0.15 164 XM_B_DNDMA 1564 0.71 1.06 0.57 165 TR_XM_Base64_M1 1552 0.66 1.05 0.52 166 XMReplyNow 1522 0.45 1.03 0.23 167 RCVD_IN_IADB_SPF 1508 2.52 1.02 3.07 168 XM_OfRef7 1507 0.42 1.02 0.20 169 TM2_M_A_HREF_HREF 1489 0.40 1.01 0.18 170 TR_XM_RelayPhish 1482 0.31 1.01 0.05 171 RCVD_IN_PBL 1476 0.69 1.00 0.58 172 TM2_M_OBFU_COMMENT 1468 0.60 1.00 0.45 173 RCVD_IN_IADB_SENDERID 1452 2.27 0.99 2.74 174 RCVD_IN_IADB_DK 1438 2.21 0.98 2.66 175 HTML_IMAGE_ONLY_20 1434 0.54 0.97 0.38 176 HTML_TAG_BALANCE_BODY 1408 0.72 0.96 0.63 177 RDNS_DYNAMIC 1395 0.48 0.95 0.31 178 SHOPIFY_IMG_NOT_RCVD_SFY 1385 0.38 0.94 0.17 179 XM_Body_Dirty_Words_01 1376 0.28 0.93 0.04 180 XM_GoogleGroups 1364 0.92 0.93 0.92 181 PDS_RDNS_DYNAMIC_FP 1363 0.39 0.92 0.19 182 XMPhish14 1358 0.74 0.92 0.67 183 T_OBFU_PDF_ATTACH 1345 1.01 0.91 1.04 184 XM_B_REG_HTML 1340 0.35 0.91 0.15 185 XM_H_Undi_Recip 1335 0.37 0.91 0.18 186 TR_Mismatch_TLD_01 1304 0.35 0.88 0.15 187 XMSlimDrugH 1275 0.52 0.87 0.39 188 T_STY_INVIS_DIRECT 1267 0.48 0.86 0.33 189 RCVD_IN_SORBS_DUL 1261 0.26 0.86 0.04 190 LongTLD 1234 0.49 0.84 0.36 191 BAYES_00 1233 11.70 0.84 15.71 192 TR_XM_DK_SendGrid 1204 0.85 0.82 0.86 193 TVD_RCVD_IP 1200 0.72 0.81 0.68 194 TooManyTo_002 1185 2.14 0.80 2.63 195 BAYES_05 1184 2.74 0.80 3.46 196 XMMoneyMeta_00 1176 0.53 0.80 0.43 197 XM_UB99 1163 0.21 0.79 0.00 198 RELAYCOUNTRY_FR 1153 0.40 0.78 0.25 199 XMSubMetaI_00 1150 0.52 0.78 0.43 200 DATE_IN_PAST_03_06 1145 0.26 0.78 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 352591 89.83 94.16 88.23 2 RELAYCOUNTRY_US 330210 83.27 84.99 82.63 3 XM_B_Unicode 276302 72.77 82.60 69.14 4 DCC_CHECK_NEGATIVE 269776 55.72 23.76 67.51 5 DKIM_SIGNED 248751 69.56 89.39 62.25 6 XM_DK_Pass 243782 67.45 84.93 61.00 7 DKIM_VALID 239917 66.40 83.65 60.04 8 BAYES_50 228111 53.11 42.34 57.08 9 DKIM_VALID_AU 189491 52.07 64.68 47.42 10 XM_B_SpammyWords 173248 50.12 68.49 43.35 11 XM_B_Unicode3 167864 44.04 49.55 42.01 12 XMListUnsubscribeExists 153313 46.64 69.10 38.36 13 DCC_CHECK 129643 43.74 74.39 32.44 14 T_TM2_M_HEADER_IN_MSG 116269 27.00 21.33 29.09 15 RCVD_IN_MSPIKE_H2 113404 30.73 37.11 28.38 16 HTML_FONT_LOW_CONTRAST 105656 29.04 36.11 26.44 17 DKIM_VALID_EF 98782 26.39 30.92 24.72 18 XMSubLong 98352 24.97 25.93 24.61 19 MIME_HTML_ONLY 92806 24.62 28.41 23.22 20 LOC_TINY_FONT_1 79332 27.34 47.65 19.85 21 FVGT_m_MULTI_ODD 78562 23.07 32.31 19.66 22 T_KAM_HTML_FONT_INVALID 70528 21.68 32.61 17.65 23 BAYES_00 62769 11.70 0.84 15.71 24 XM_B_SpammyWords2 61284 22.04 40.23 15.34 25 ALL_TRUSTED 59073 11.33 1.98 14.78 26 HTML_IMAGE_RATIO_04 52696 10.79 4.27 13.19 27 HTML_FONT_FACE_BAD 48354 8.98 0.52 12.10 28 XM_H_Trusted_IP 45969 8.40 0.00 11.50 29 XMStrtUSub 44112 9.00 3.46 11.04 30 XM_Multi_Part_URI 43921 14.14 22.67 10.99 31 USER_IN_DEF_DKIM_WL 41164 8.07 2.02 10.30 32 XM_Evil_Numbers_Gen 40914 10.26 10.33 10.24 33 LotsOfNums_01 39640 9.34 7.78 9.92 34 TR_XM_DK_Unsub 39174 12.83 21.03 9.80 35 UNPARSEABLE_RELAY 38915 11.93 17.89 9.74 36 MPART_ALT_DIFF 33850 7.95 6.53 8.47 37 XM_B_PhoneNumber 33232 7.71 6.07 8.32 38 TooManyTo_001 31396 6.86 4.14 7.86 39 XM_B_Unsub 30699 9.98 16.21 7.68 40 ANY_BOUNCE_MESSAGE 29494 5.78 1.44 7.38 41 BOUNCE_MESSAGE 29484 5.77 1.43 7.38 42 FSL_BULK_SIG 28857 7.82 9.45 7.22 43 MIME_HTML_ONLY_MULTI 27907 6.23 4.17 6.98 44 BAYES_60 26520 7.03 8.09 6.64 45 TR_XM_DK_Bayes 26465 5.04 0.73 6.62 46 TR_XM_DK_Bayes1 25894 4.93 0.72 6.48 47 BAYES_40 24565 4.94 1.67 6.15 48 IN_ZIMBRA_NJ_WHITELIST 23890 4.40 0.11 5.98 49 TR_XM_BayesUnsub 23241 8.38 15.32 5.82 50 TR_XM_DK_Bayes2 22015 4.17 0.54 5.51 51 TM2_M_VERY_LONG_WORD 21755 5.15 4.35 5.44 52 XM_PDF 21490 4.39 1.69 5.38 53 LOTS_OF_MONEY 21194 7.70 14.19 5.30 54 XM_DKIMWhitelistDomains 20551 3.77 0.05 5.14 55 RCVD_IN_MSPIKE_WL 19683 4.49 3.32 4.93 56 RCVD_IN_MSPIKE_H3 19683 4.49 3.32 4.93 57 XM_H_Long_From01 19233 5.30 6.63 4.81 58 XM_H_GMP 19214 5.08 5.81 4.81 59 T_TooManySym_01 19172 4.18 2.51 4.80 60 XM_B_Phish_Phrases 18354 5.70 8.70 4.59 61 MIME_QP_LONG_LINE 18222 4.15 3.04 4.56 62 XMSubNoVowel 17050 3.28 0.59 4.27 63 BAYES_20 16927 3.44 1.29 4.24 64 TR_MAX_INTL_RELAY 16865 6.91 14.21 4.22 65 HTML_IMAGE_RATIO_06 16180 4.03 3.97 4.05 66 XM_UncommonTLD01 15964 4.35 5.31 3.99 67 T_REMOTE_IMAGE 14887 3.26 1.99 3.73 68 XM_DK_Undo_02 14853 13.74 40.92 3.72 69 XMSubMetaSx_00 14725 4.97 8.45 3.68 70 HTML_IMAGE_RATIO_02 14523 4.35 6.28 3.63 71 TR_XM_SpammyWords4 14361 5.71 11.45 3.59 72 KHOP_HELO_FCRDNS 14263 3.00 1.47 3.57 73 RCVD_IN_IADB_LISTED 13976 2.86 1.15 3.50 74 BAYES_05 13819 2.74 0.80 3.46 75 XM_B_SpammyWords3 12901 6.14 14.05 3.23 76 RCVD_IN_VALIDITY_SAFE 12737 2.76 1.59 3.19 77 RELAYCOUNTRY_META 12480 6.01 13.84 3.12 78 RCVD_IN_IADB_SPF 12257 2.52 1.02 3.07 79 XMNumbers 11210 3.03 3.63 2.81 80 SHORT_URI_2 10938 2.17 0.63 2.74 81 RCVD_IN_IADB_SENDERID 10937 2.27 0.99 2.74 82 HTML_IMAGE_ONLY_32 10887 2.04 0.18 2.72 83 RCVD_IN_IADB_DK 10639 2.21 0.98 2.66 84 TooManyTo_002 10508 2.14 0.80 2.63 85 RCVD_IN_VALIDITY_CERTIFIED 10373 2.22 1.22 2.60 86 BAYES_80 10356 4.25 8.74 2.59 87 HTML_MIME_NO_HTML_TAG 10236 2.54 2.47 2.56 88 BAYES_99 10050 9.72 29.26 2.51 89 XM_Body_Dirty_Words 9979 4.22 8.87 2.50 90 T_TooManySym_02 9968 2.01 0.68 2.49 91 MAILING_LIST_MULTI 9946 2.48 2.46 2.49 92 BOTNET_IPINHOSTNAME 9290 4.70 11.14 2.32 93 RCVD_IN_IADB_VOUCHED 9234 1.85 0.59 2.31 94 DKIM_INVALID 8834 3.16 5.74 2.21 95 XMSubLongNoVowel 7935 1.54 0.33 1.99 96 XMSubGarbage 7747 1.45 0.13 1.94 97 MIME_CHARSET_FARAWAY 7704 1.72 1.17 1.93 98 XM_B_SpammyTLD 7582 2.35 3.59 1.90 99 INVALID_MSGID 7516 1.45 0.27 1.88 100 MIME_HTML_MOSTLY 7373 2.22 3.22 1.85 101 HTML_IMAGE_RATIO_08 7353 2.19 3.14 1.84 102 BAYES_999 7294 7.48 22.80 1.83 103 XM_CamelCaseFrm001 6940 2.08 3.01 1.74 104 TR_XM_PhishingBody 6888 2.76 5.56 1.72 105 T_XMDrugObfuBody_14 6801 2.59 4.99 1.70 106 FROM_EXCESS_BASE64 6733 1.81 2.16 1.68 107 CHARSET_FARAWAY_HEADER 6576 1.23 0.11 1.65 108 BAYES_95 6496 2.58 5.15 1.63 109 XMSexyCombo_05 6398 2.50 4.93 1.60 110 XM_B_URI_Unicode 6357 1.86 2.60 1.59 111 XM_B_Investor 6340 2.45 4.80 1.59 112 RCVD_IN_IADB_OPTIN 6301 1.26 0.40 1.58 113 TO_MALFORMED 6198 1.14 0.01 1.55 114 TR_XM_DKIM_Undo 5864 8.60 27.96 1.47 115 TR_XM_SpammyRelay 5856 3.81 10.17 1.47 116 XM_SPF_SoftFail 5581 1.86 3.10 1.40 117 XMDiploma_00 5570 2.05 3.84 1.39 118 TooManyTo_003 5476 1.19 0.72 1.37 119 XM_SendGrid 5422 1.79 2.96 1.36 120 URI_NOVOWEL 5406 1.28 1.10 1.35 121 XM_DK_Undo_01 5199 1.77 3.05 1.30 122 TM2_M_URI_OPT_OUT 5158 1.61 2.48 1.29 123 UNTRUSTED_Relay 5090 2.20 4.73 1.27 124 IN_HORDE_ADDRESS_BOOK 4932 0.92 0.08 1.23 125 XMStockSpam_06 4881 1.44 2.03 1.22 126 XM_B_Unsub2 4869 1.58 2.58 1.22 127 TR_XM_SpammyWords5 4730 1.69 3.06 1.18 128 TR_Symld_Words 4680 1.27 1.52 1.17 129 XM_H_PHPMailer 4675 1.05 0.74 1.17 130 XMCapTrack 4494 1.00 0.65 1.12 131 SUBJ_ALL_CAPS 4481 1.16 1.27 1.12 132 T_XMDrugObfuBody_08 4446 1.55 2.73 1.11 133 TVD_SPACE_RATIO 4399 0.85 0.16 1.10 134 XMGappySubj_01 4371 0.85 0.18 1.09 135 TR_XM_UnparsRelay 4287 3.07 8.50 1.07 136 T_OBFU_PDF_ATTACH 4156 1.01 0.91 1.04 137 HELO_NODOT 4108 0.82 0.27 1.03 138 HELO_NO_DOMAIN 4106 0.82 0.27 1.03 139 BOTNET 4071 3.18 9.03 1.02 140 TooManyTo_004 4065 0.92 0.67 1.02 141 T_TooManySym_03 4062 0.80 0.21 1.02 142 URI_HEX 3797 1.05 1.31 0.95 143 HTTPS_HTTP_MISMATCH 3756 1.06 1.37 0.94 144 XM_E_Blogspot 3707 0.72 0.15 0.93 145 XM_GoogleGroups 3691 0.92 0.93 0.92 146 SHORT_URI_3 3618 0.69 0.12 0.91 147 TR_XM_DK_SendGrid 3442 0.85 0.82 0.86 148 RELAYCOUNTRY_CA 3432 1.81 4.39 0.86 149 XM_OfRef6 3431 1.49 3.19 0.86 150 XM_ProductURIs 3410 0.83 0.76 0.85 151 XM_H_Long_From02 3378 1.01 1.44 0.85 152 TooManyTo_005 3335 0.78 0.63 0.83 153 DKIM_ADSP_CUSTOM_MED 3280 1.00 1.48 0.82 154 TR_MetaPhish_Combo_01 3247 0.76 0.60 0.81 155 XM_UB50 3212 1.19 2.25 0.80 156 SpammyFromTLD_01 3198 1.09 1.87 0.80 157 T_FILL_THIS_FORM_SHORT 3182 1.08 1.84 0.80 158 XMGenDplmaNmb 3146 1.13 2.04 0.79 159 TR_DCC_Bayes_99 3102 6.27 21.15 0.78 160 T_XMDrugObfuBody_00 3025 1.07 1.93 0.76 161 XMBrknScrpt_02 2915 0.95 1.53 0.73 162 FROM_GOV_DKIM_AU 2795 0.62 0.40 0.70 163 XM_ShortIntro_01 2766 0.66 0.59 0.69 164 TVD_RCVD_IP 2734 0.72 0.81 0.68 165 RCVD_IN_BL_SPAMCOP_NET 2733 3.39 10.75 0.68 166 XMNoVowels 2692 0.63 0.53 0.67 167 XMPhish14 2688 0.74 0.92 0.67 168 XMLngstWrd_00 2679 0.61 0.45 0.67 169 TM2_M_BODY_EMPTY 2668 0.53 0.15 0.67 170 XMGappySubj_02 2642 0.50 0.05 0.66 171 T_TVD_MIME_NO_HEADERS 2639 0.49 0.03 0.66 172 XM_B_COPY_HTML 2581 0.88 1.51 0.65 173 HTML_TAG_BALANCE_BODY 2529 0.72 0.96 0.63 174 T_Symld_Words_02 2407 0.60 0.60 0.60 175 XM_B_FormFill 2396 0.44 0.03 0.60 176 XM_B_SpammyWords4 2317 1.07 2.39 0.58 177 RCVD_IN_PBL 2305 0.69 1.00 0.58 178 XM_B_DNDMA 2297 0.71 1.06 0.57 179 NML_ADSP_CUSTOM_MED 2236 0.74 1.22 0.56 180 MPART_ALT_DIFF_COUNT 2231 0.70 1.09 0.56 181 XMBody_95 2181 0.47 0.26 0.55 182 FORGED_GMAIL_RCVD 2176 0.70 1.12 0.54 183 GMD_PDF_EMPTY_BODY 2161 0.43 0.14 0.54 184 TR_XM_Base64_M1 2076 0.66 1.05 0.52 185 URI_TRY_3LD 1998 0.68 1.17 0.50 186 XMPhish30 1995 0.78 1.56 0.50 187 RELAYCOUNTRY_AU 1986 1.18 3.05 0.50 188 HTML_IMAGE_ONLY_28 1807 0.41 0.28 0.45 189 TR_XM_SpoofStaff 1806 0.37 0.15 0.45 190 TM2_M_OBFU_COMMENT 1802 0.60 1.00 0.45 191 XM_H_SpoofStaff4 1781 0.35 0.11 0.45 192 TRACKER_ID 1772 0.37 0.15 0.44 193 T_XMHurry_00 1752 0.80 1.77 0.44 194 MISSING_HEADERS 1732 0.46 0.55 0.43 195 XMSubMetaI_00 1716 0.52 0.78 0.43 196 XMMoneyMeta_00 1713 0.53 0.80 0.43 197 XM_H_OutlookMailer 1619 0.33 0.11 0.41 198 TO_NO_BRKTS_HTML_ONLY 1618 0.39 0.36 0.40 199 XM_URI_RBL 1592 0.95 2.45 0.40 200 XMSlimDrugH 1576 0.52 0.87 0.39 ----------------------------------------------------------------------