Email: 472563 Autolearn: 0 AvgScore: 4.47 AvgScanTime: 1.37 sec Spam: 150541 Autolearn: 0 AvgScore: 14.55 AvgScanTime: 1.52 sec Ham: 322022 Autolearn: 0 AvgScore: -0.25 AvgScanTime: 1.30 sec Time Spent Running SA: 180.07 hours Time Spent Processing Spam: 63.44 hours Time Spent Processing Ham: 116.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143780 88.77 95.51 85.62 2 DKIM_SIGNED 133817 80.05 88.89 75.92 3 XM_DK_Pass 126893 77.43 84.29 74.22 4 DKIM_VALID 125640 76.35 83.46 73.03 5 RELAYCOUNTRY_US 124913 81.99 82.98 81.53 6 XM_B_Unicode 124370 73.46 82.62 69.18 7 DCC_CHECK 115504 51.21 76.73 39.28 8 XMListUnsubscribeExists 106215 55.58 70.56 48.57 9 XM_B_SpammyWords 103386 52.15 68.68 44.43 10 DKIM_VALID_AU 99590 60.81 66.15 58.31 11 XM_B_Unicode3 76590 43.87 50.88 40.60 12 LOC_TINY_FONT_1 75531 33.95 50.17 26.36 13 BAYES_50 62105 53.36 41.25 59.01 14 XM_B_SpammyWords2 60945 25.36 40.48 18.28 15 XM_DK_Undo_02 59032 15.65 39.21 4.63 16 HTML_FONT_LOW_CONTRAST 58284 30.90 38.72 27.25 17 RCVD_IN_MSPIKE_H2 56333 35.23 37.42 34.20 18 FVGT_m_MULTI_ODD 51377 27.67 34.13 24.66 19 T_KAM_HTML_FONT_INVALID 48187 24.39 32.01 20.83 20 BAYES_99 45291 12.73 30.09 4.62 21 MIME_HTML_ONLY 42022 22.44 27.91 19.88 22 DKIM_VALID_EF 41103 28.42 27.30 28.94 23 TR_XM_DKIM_Undo 40884 9.97 27.16 1.94 24 XMSubLong 37320 24.37 24.79 24.17 25 BAYES_999 34584 9.87 22.97 3.75 26 TR_DCC_Bayes_99 33354 7.81 22.16 1.10 27 T_TM2_M_HEADER_IN_MSG 32909 28.69 21.86 31.88 28 XM_Multi_Part_URI 32691 15.81 21.72 13.04 29 DCC_CHECK_NEGATIVE 32572 48.23 21.64 60.66 30 TR_XM_DK_Unsub 29206 14.59 19.40 12.35 31 UNPARSEABLE_RELAY 26831 13.90 17.82 12.07 32 XM_B_Unsub 25330 11.87 16.83 9.55 33 TR_XM_BayesUnsub 24403 10.07 16.21 7.20 34 RELAYCOUNTRY_META 23701 7.63 15.74 3.84 35 TR_MAX_INTL_RELAY 22515 8.52 14.96 5.51 36 XM_B_SpammyWords3 22275 8.04 14.80 4.88 37 LOTS_OF_MONEY 17308 7.76 11.50 6.01 38 BOTNET_IPINHOSTNAME 16569 5.61 11.01 3.08 39 TR_XM_SpammyWords2 16357 3.75 10.87 0.43 40 TR_XM_SpammyRelay 15802 4.64 10.50 1.90 41 TR_XM_SpammyWords4 15469 6.06 10.28 4.08 42 RCVD_IN_BL_SPAMCOP_NET 15402 3.77 10.23 0.76 43 FSL_BULK_SIG 14881 7.99 9.89 7.10 44 BOTNET 14328 4.08 9.52 1.54 45 BAYES_80 13728 5.20 9.12 3.37 46 XM_Evil_Numbers_Gen 13672 8.63 9.08 8.42 47 TR_XM_UnparsRelay 13285 3.88 8.82 1.57 48 LotsOfNums_01 12478 8.07 8.29 7.97 49 BAYES_60 12427 8.40 8.25 8.47 50 TR_XM_SPAMCOP 12346 2.91 8.20 0.43 51 XM_Body_Dirty_Words 12113 4.27 8.05 2.51 52 XMSubMetaSx_00 12056 5.77 8.01 4.72 53 XM_B_Phish_Phrases 11909 6.49 7.91 5.83 54 HTML_IMAGE_RATIO_02 11382 5.75 7.56 4.91 55 UNTRUSTED_Relay 10475 3.22 6.96 1.47 56 XM_UncommonTLD01 10049 5.10 6.68 4.36 57 XM_B_PhoneNumber 9684 9.18 6.43 10.47 58 MPART_ALT_DIFF 9309 4.95 6.18 4.37 59 DKIM_INVALID 8177 3.70 5.43 2.89 60 BAYES_95 8131 3.18 5.40 2.14 61 XM_H_Long_From01 7934 5.63 5.27 5.79 62 RCVD_IN_VALIDITY_RPBL 7843 1.76 5.21 0.15 63 TR_XM_PhishingBody 7766 2.79 5.16 1.68 64 RELAYCOUNTRY_CA 7649 2.28 5.08 0.97 65 XM_H_GMP 7454 5.50 4.95 5.76 66 XM_B_Investor 6991 2.48 4.64 1.46 67 HTML_IMAGE_RATIO_06 6826 3.44 4.53 2.93 68 HTML_IMAGE_RATIO_04 6588 4.28 4.38 4.24 69 XMSexyCombo_05 6423 2.32 4.27 1.41 70 XM_OfRef6 6391 2.32 4.25 1.42 71 T_XMDrugObfuBody_14 6310 2.71 4.19 2.02 72 RCVD_IN_MSPIKE_WL 6156 5.30 4.09 5.87 73 RCVD_IN_MSPIKE_H3 6156 5.30 4.09 5.87 74 XMStrtUSub 5643 4.27 3.75 4.51 75 TM2_M_VERY_LONG_WORD 5588 2.18 3.71 1.46 76 XM_B_SpammyTLD 5502 2.97 3.65 2.65 77 TooManyTo_001 5440 7.33 3.61 9.07 78 XM_SPF_SoftFail 5314 2.39 3.53 1.86 79 XM_UB50 5211 1.73 3.46 0.93 80 XM_CamelCaseFrm001 5120 3.25 3.40 3.18 81 MIME_HTML_ONLY_MULTI 5033 2.84 3.34 2.61 82 XMNumbers 5015 3.06 3.33 2.93 83 TM2_M_URI_OPT_OUT 4725 2.19 3.14 1.74 84 HTML_IMAGE_RATIO_08 4663 2.43 3.10 2.11 85 MIME_QP_LONG_LINE 4631 4.53 3.08 5.21 86 MIME_HTML_MOSTLY 4615 2.56 3.07 2.32 87 TR_XM_SpammyWords5 4523 1.86 3.00 1.32 88 DKIM_ADSP_NXDOMAIN 4443 1.13 2.95 0.28 89 NO_DNS_FOR_FROM 4355 1.12 2.89 0.28 90 TR_XM_MaxWHORU 4310 1.07 2.86 0.24 91 T_XMDrugObfuBody_08 4282 1.99 2.84 1.59 92 XM_URI_RBL 4256 1.15 2.83 0.36 93 RELAYCOUNTRY_AU 4210 1.42 2.80 0.78 94 T_REMOTE_IMAGE 4171 3.22 2.77 3.43 95 XMDiploma_00 3869 1.83 2.57 1.48 96 T_TooManySym_01 3816 4.94 2.53 6.07 97 FROM_EXCESS_BASE64 3595 1.89 2.39 1.65 98 MAILING_LIST_MULTI 3561 2.85 2.37 3.08 99 XM_B_URI_Unicode 3514 2.00 2.33 1.84 100 XM_B_Unsub2 3361 1.71 2.23 1.47 101 LongTLD 3337 1.01 2.22 0.44 102 XM_DK_Undo_01 3306 1.89 2.20 1.74 103 RCVD_IN_VALIDITY_SAFE 3293 3.60 2.19 4.26 104 T_XMHurry_00 3257 1.13 2.16 0.64 105 XMPhish30 3168 1.08 2.10 0.59 106 TR_XM_INV_DKIM 3104 0.79 2.06 0.19 107 XM_B_SpammyWords4 3090 1.11 2.05 0.66 108 TR_XM_NoHeaderRelay 3083 0.84 2.05 0.27 109 T_XMDrugObfuBody_00 3017 1.30 2.00 0.98 110 XMStockSpam_06 2953 1.50 1.96 1.29 111 SpammyFromTLD_02 2917 0.95 1.94 0.49 112 XM_H_Long_From02 2827 1.35 1.88 1.10 113 USER_IN_DEF_DKIM_WL 2803 9.83 1.86 13.56 114 BAYES_40 2617 3.95 1.74 4.99 115 HTML_MIME_NO_HTML_TAG 2562 2.29 1.70 2.57 116 XMBody_17 2505 0.76 1.66 0.33 117 RCVD_IN_VALIDITY_CERTIFIED 2447 2.66 1.63 3.15 118 RCVD_IN_ZEN_LASTEXTERNAL 2420 0.51 1.61 0.00 119 SHORTCIRCUIT 2420 0.51 1.61 0.00 120 URI_HEX 2385 1.28 1.58 1.13 121 HTML_SHORT_LINK_IMG_1 2380 0.53 1.58 0.04 122 SpammyFromTLD_01 2285 1.24 1.52 1.12 123 ALL_TRUSTED 2247 11.00 1.49 15.44 124 XM_B_COPY_HTML 2211 1.07 1.47 0.88 125 HTML_IMAGE_ONLY_08 2148 0.56 1.43 0.15 126 XM_SendGrid 2089 1.62 1.39 1.73 127 HDRS_LCASE_IMGONLY 2081 0.47 1.38 0.05 128 T_FILL_THIS_FORM_SHORT 2075 1.11 1.38 0.99 129 SUSP_UTF8_WORD_SUBJ 2059 0.45 1.37 0.03 130 XMBrknScrpt_02 2029 1.10 1.35 0.99 131 XMGenDplmaNmb 2024 0.99 1.34 0.83 132 XM_OfRef7 1940 0.54 1.29 0.19 133 XM_B_SEO 1936 0.57 1.29 0.24 134 TR_XM_RelayPhish 1882 0.44 1.25 0.06 135 KHOP_HELO_FCRDNS 1876 1.56 1.25 1.70 136 SUBJ_ALL_CAPS 1794 1.30 1.19 1.36 137 TR_XM_PHPForged 1776 0.61 1.18 0.35 138 XMHTML_After_End 1758 0.59 1.17 0.31 139 HTTPS_HTTP_MISMATCH 1757 0.95 1.17 0.85 140 TR_XM_PHPDW 1752 0.61 1.16 0.35 141 BAYES_20 1750 2.92 1.16 3.75 142 TR_XM_Base64_M1 1743 0.82 1.16 0.66 143 TR_XM_InvalidRelay 1740 0.38 1.16 0.02 144 T_MONEY_PERCENT 1739 0.50 1.16 0.19 145 TR_LOTS_OF_MONEY2 1739 0.50 1.16 0.19 146 RCVD_IN_IADB_LISTED 1722 3.10 1.14 4.02 147 TR_XM_FormFill2 1722 0.60 1.14 0.35 148 XMNoVowels 1719 0.95 1.14 0.86 149 DKIM_ADSP_CUSTOM_MED 1711 1.01 1.14 0.95 150 RELAYCOUNTRY_FR 1687 0.53 1.12 0.26 151 XM_H_PHPOS 1686 0.58 1.12 0.33 152 BODY_URI_ONLY 1684 0.36 1.12 0.00 153 XM_B_COVIDMETA 1672 0.55 1.11 0.29 154 URI_NOVOWEL 1670 1.60 1.11 1.83 155 XM_UB99 1655 0.35 1.10 0.00 156 XM_B_DNDMA 1642 0.79 1.09 0.64 157 HK_RANDOM_REPLYTO 1641 0.40 1.09 0.08 158 SHOPIFY_IMG_NOT_RCVD_SFY 1634 0.49 1.09 0.22 159 TR_XM_SEO4 1626 0.42 1.08 0.11 160 XM_S_SpammyWords 1607 0.48 1.07 0.20 161 TR_XM_Spammywords 1605 0.48 1.07 0.20 162 URI_TRY_3LD 1603 0.71 1.06 0.54 163 SUSP_UTF8_WORD_COMBO 1572 0.37 1.04 0.05 164 RELAYCOUNTRY_TH 1566 0.33 1.04 0.00 165 XM_B_Phish66 1547 0.54 1.03 0.32 166 RCVD_IN_PSBL 1544 0.52 1.03 0.28 167 XMReplyNow 1543 0.54 1.02 0.32 168 RCVD_IN_IADB_SPF 1541 2.72 1.02 3.51 169 XMPhish14 1535 0.62 1.02 0.43 170 HOSTED_IMG_MULTI_PUB_01 1487 0.32 0.99 0.01 171 XM_UB60 1482 0.35 0.98 0.05 172 TR_Symld_Words 1460 1.40 0.97 1.60 173 RELAYCOUNTRY_GB 1454 0.66 0.97 0.52 174 RCVD_IN_IADB_SENDERID 1453 2.43 0.97 3.11 175 RCVD_IN_IADB_DK 1453 2.38 0.97 3.04 176 DIET_1 1444 0.51 0.96 0.30 177 XMSexyCombo_01 1441 0.44 0.96 0.19 178 TR_XM_DK_SendGrid 1433 1.03 0.95 1.07 179 XMMoneyMeta_00 1408 0.63 0.94 0.49 180 HTML_TAG_BALANCE_BODY 1400 0.71 0.93 0.61 181 HTML_FONT_FACE_BAD 1390 0.57 0.92 0.41 182 T_Symld_Words_02 1386 0.77 0.92 0.70 183 TR_MetaPhish_Combo_01 1376 1.12 0.91 1.22 184 BOTNET_NORDNS 1367 0.29 0.91 0.01 185 RCVD_IN_PBL 1358 0.78 0.90 0.73 186 XMBdyGiftCard01 1345 0.67 0.89 0.56 187 NML_ADSP_CUSTOM_MED 1339 0.73 0.89 0.65 188 MPART_ALT_DIFF_COUNT 1335 0.66 0.89 0.55 189 T_STY_INVIS_DIRECT 1317 0.50 0.87 0.33 190 XM_ProductURIs 1299 0.67 0.86 0.59 191 TM2_M_A_HREF_HREF 1296 0.44 0.86 0.24 192 XMBSHREFv2 1261 0.51 0.84 0.36 193 URIBL_BLACK 1256 0.29 0.83 0.04 194 XM_UB999 1252 0.27 0.83 0.00 195 THIS_AD 1246 0.55 0.83 0.42 196 DATE_IN_PAST_03_06 1238 0.31 0.82 0.08 197 XMBody_78 1234 0.45 0.82 0.27 198 XM_DIRTYINTL 1228 0.32 0.82 0.08 199 BAYES_00 1205 8.00 0.80 11.36 200 RDNS_DYNAMIC 1204 0.45 0.80 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 275722 88.77 95.51 85.62 2 RELAYCOUNTRY_US 262560 81.99 82.98 81.53 3 DKIM_SIGNED 244487 80.05 88.89 75.92 4 XM_DK_Pass 238995 77.43 84.29 74.22 5 DKIM_VALID 235175 76.35 83.46 73.03 6 XM_B_Unicode 222760 73.46 82.62 69.18 7 DCC_CHECK_NEGATIVE 195352 48.23 21.64 60.66 8 BAYES_50 190041 53.36 41.25 59.01 9 DKIM_VALID_AU 187758 60.81 66.15 58.31 10 XMListUnsubscribeExists 156421 55.58 70.56 48.57 11 XM_B_SpammyWords 143060 52.15 68.68 44.43 12 XM_B_Unicode3 130747 43.87 50.88 40.60 13 DCC_CHECK 126500 51.21 76.73 39.28 14 RCVD_IN_MSPIKE_H2 110138 35.23 37.42 34.20 15 T_TM2_M_HEADER_IN_MSG 102665 28.69 21.86 31.88 16 DKIM_VALID_EF 93197 28.42 27.30 28.94 17 HTML_FONT_LOW_CONTRAST 87737 30.90 38.72 27.25 18 LOC_TINY_FONT_1 84898 33.95 50.17 26.36 19 FVGT_m_MULTI_ODD 79396 27.67 34.13 24.66 20 XMSubLong 77830 24.37 24.79 24.17 21 T_KAM_HTML_FONT_INVALID 67087 24.39 32.01 20.83 22 MIME_HTML_ONLY 64028 22.44 27.91 19.88 23 XM_B_SpammyWords2 58880 25.36 40.48 18.28 24 ALL_TRUSTED 49713 11.00 1.49 15.44 25 USER_IN_DEF_DKIM_WL 43670 9.83 1.86 13.56 26 XM_Multi_Part_URI 42000 15.81 21.72 13.04 27 TR_XM_DK_Unsub 39757 14.59 19.40 12.35 28 UNPARSEABLE_RELAY 38859 13.90 17.82 12.07 29 BAYES_00 36586 8.00 0.80 11.36 30 XM_B_PhoneNumber 33714 9.18 6.43 10.47 31 XM_B_Unsub 30748 11.87 16.83 9.55 32 TooManyTo_001 29199 7.33 3.61 9.07 33 BAYES_60 27262 8.40 8.25 8.47 34 XM_Evil_Numbers_Gen 27111 8.63 9.08 8.42 35 LotsOfNums_01 25678 8.07 8.29 7.97 36 TR_XM_BayesUnsub 23191 10.07 16.21 7.20 37 IN_ZIMBRA_NJ_WHITELIST 22909 4.88 0.10 7.11 38 FSL_BULK_SIG 22871 7.99 9.89 7.10 39 TR_XM_DK_Bayes 22859 5.05 0.68 7.10 40 TR_XM_DK_Bayes1 22501 4.97 0.67 6.99 41 XM_DKIMWhitelistDomains 21789 4.62 0.03 6.77 42 T_TooManySym_01 19542 4.94 2.53 6.07 43 LOTS_OF_MONEY 19352 7.76 11.50 6.01 44 TR_XM_DK_Bayes2 19336 4.28 0.58 6.00 45 RCVD_IN_MSPIKE_WL 18907 5.30 4.09 5.87 46 RCVD_IN_MSPIKE_H3 18907 5.30 4.09 5.87 47 XM_B_Phish_Phrases 18775 6.49 7.91 5.83 48 XM_H_Long_From01 18649 5.63 5.27 5.79 49 XM_H_GMP 18556 5.50 4.95 5.76 50 TR_MAX_INTL_RELAY 17749 8.52 14.96 5.51 51 MIME_QP_LONG_LINE 16780 4.53 3.08 5.21 52 BAYES_40 16055 3.95 1.74 4.99 53 HTML_IMAGE_RATIO_02 15804 5.75 7.56 4.91 54 XM_B_SpammyWords3 15723 8.04 14.80 4.88 55 XMSubMetaSx_00 15193 5.77 8.01 4.72 56 XM_DK_Undo_02 14923 15.65 39.21 4.63 57 XM_PDF 14904 3.33 0.54 4.63 58 BAYES_99 14872 12.73 30.09 4.62 59 XMStrtUSub 14523 4.27 3.75 4.51 60 MPART_ALT_DIFF 14066 4.95 6.18 4.37 61 XM_UncommonTLD01 14042 5.10 6.68 4.36 62 RCVD_IN_VALIDITY_SAFE 13727 3.60 2.19 4.26 63 HTML_IMAGE_RATIO_04 13660 4.28 4.38 4.24 64 TR_XM_SpammyWords4 13152 6.06 10.28 4.08 65 RCVD_IN_IADB_LISTED 12948 3.10 1.14 4.02 66 RELAYCOUNTRY_META 12360 7.63 15.74 3.84 67 BAYES_20 12068 2.92 1.16 3.75 68 BAYES_999 12062 9.87 22.97 3.75 69 RCVD_IN_IADB_SPF 11308 2.72 1.02 3.51 70 T_REMOTE_IMAGE 11051 3.22 2.77 3.43 71 BAYES_80 10837 5.20 9.12 3.37 72 XM_CamelCaseFrm001 10251 3.25 3.40 3.18 73 RCVD_IN_VALIDITY_CERTIFIED 10141 2.66 1.63 3.15 74 TooManyTo_002 10037 2.31 0.57 3.12 75 RCVD_IN_IADB_SENDERID 10018 2.43 0.97 3.11 76 BOTNET_IPINHOSTNAME 9929 5.61 11.01 3.08 77 MAILING_LIST_MULTI 9920 2.85 2.37 3.08 78 T_TooManySym_02 9827 2.32 0.75 3.05 79 RCVD_IN_IADB_DK 9797 2.38 0.97 3.04 80 XMNumbers 9449 3.06 3.33 2.93 81 HTML_IMAGE_RATIO_06 9448 3.44 4.53 2.93 82 DKIM_INVALID 9312 3.70 5.43 2.89 83 ANY_BOUNCE_MESSAGE 9180 2.15 0.65 2.85 84 BOUNCE_MESSAGE 9177 2.15 0.65 2.85 85 XM_B_SpammyTLD 8539 2.97 3.65 2.65 86 RCVD_IN_IADB_VOUCHED 8530 1.97 0.52 2.65 87 MIME_HTML_ONLY_MULTI 8408 2.84 3.34 2.61 88 HTML_MIME_NO_HTML_TAG 8263 2.29 1.70 2.57 89 XM_Body_Dirty_Words 8073 4.27 8.05 2.51 90 MIME_HTML_MOSTLY 7469 2.56 3.07 2.32 91 BAYES_05 7391 1.74 0.55 2.30 92 INVALID_MSGID 7324 1.62 0.21 2.27 93 BAYES_95 6906 3.18 5.40 2.14 94 HTML_IMAGE_RATIO_08 6805 2.43 3.10 2.11 95 T_XMDrugObfuBody_14 6498 2.71 4.19 2.02 96 TR_XM_DKIM_Undo 6243 9.97 27.16 1.94 97 TO_MALFORMED 6228 1.32 0.01 1.93 98 TR_XM_SpammyRelay 6130 4.64 10.50 1.90 99 RCVD_IN_IADB_OPTIN 6015 1.38 0.34 1.87 100 XM_SPF_SoftFail 6000 2.39 3.53 1.86 101 XM_B_URI_Unicode 5933 2.00 2.33 1.84 102 URI_NOVOWEL 5877 1.60 1.11 1.83 103 TM2_M_URI_OPT_OUT 5618 2.19 3.14 1.74 104 XM_DK_Undo_01 5617 1.89 2.20 1.74 105 XM_SendGrid 5559 1.62 1.39 1.73 106 KHOP_HELO_FCRDNS 5479 1.56 1.25 1.70 107 TooManyTo_003 5474 1.31 0.49 1.70 108 TR_XM_PhishingBody 5408 2.79 5.16 1.68 109 FROM_EXCESS_BASE64 5317 1.89 2.39 1.65 110 TR_Symld_Words 5163 1.40 0.97 1.60 111 T_XMDrugObfuBody_08 5121 1.99 2.84 1.59 112 TR_XM_UnparsRelay 5068 3.88 8.82 1.57 113 BOTNET 4955 4.08 9.52 1.54 114 IN_HORDE_ADDRESS_BOOK 4819 1.05 0.09 1.50 115 XMDiploma_00 4764 1.83 2.57 1.48 116 XMGappySubj_01 4754 1.06 0.17 1.48 117 XM_B_Unsub2 4735 1.71 2.23 1.47 118 UNTRUSTED_Relay 4735 3.22 6.96 1.47 119 XM_B_Investor 4713 2.48 4.64 1.46 120 TM2_M_VERY_LONG_WORD 4698 2.18 3.71 1.46 121 XM_OfRef6 4559 2.32 4.25 1.42 122 XMSexyCombo_05 4549 2.32 4.27 1.41 123 HELO_NODOT 4426 1.01 0.24 1.37 124 HELO_NO_DOMAIN 4418 1.01 0.24 1.37 125 SUBJ_ALL_CAPS 4371 1.30 1.19 1.36 126 TR_XM_SpammyWords5 4246 1.86 3.00 1.32 127 XMStockSpam_06 4148 1.50 1.96 1.29 128 TooManyTo_004 4093 1.00 0.42 1.27 129 T_TooManySym_03 3980 0.91 0.21 1.24 130 XMCapTrack 3959 1.00 0.51 1.23 131 TR_MetaPhish_Combo_01 3921 1.12 0.91 1.22 132 XM_GoogleGroups 3817 1.05 0.77 1.19 133 URI_HEX 3644 1.28 1.58 1.13 134 SpammyFromTLD_01 3598 1.24 1.52 1.12 135 TR_DCC_Bayes_99 3557 7.81 22.16 1.10 136 XM_H_Long_From02 3542 1.35 1.88 1.10 137 TR_XM_DK_SendGrid 3456 1.03 0.95 1.07 138 TooManyTo_005 3400 0.85 0.41 1.06 139 XMBrknScrpt_02 3191 1.10 1.35 0.99 140 T_FILL_THIS_FORM_SHORT 3183 1.11 1.38 0.99 141 T_XMDrugObfuBody_00 3143 1.30 2.00 0.98 142 TVD_SPACE_RATIO 3133 0.70 0.11 0.97 143 RELAYCOUNTRY_CA 3122 2.28 5.08 0.97 144 DKIM_ADSP_CUSTOM_MED 3051 1.01 1.14 0.95 145 FROM_GOV_DKIM_AU 3009 0.68 0.14 0.93 146 XM_UB50 2980 1.73 3.46 0.93 147 XM_B_COPY_HTML 2845 1.07 1.47 0.88 148 XMNoVowels 2768 0.95 1.14 0.86 149 HTTPS_HTTP_MISMATCH 2749 0.95 1.17 0.85 150 TVD_RCVD_IP 2715 0.80 0.72 0.84 151 XMGappySubj_02 2688 0.59 0.07 0.83 152 XMGenDplmaNmb 2676 0.99 1.34 0.83 153 RELAYCOUNTRY_AU 2524 1.42 2.80 0.78 154 XM_ShortIntro_01 2461 0.69 0.54 0.76 155 RCVD_IN_BL_SPAMCOP_NET 2433 3.77 10.23 0.76 156 XM_B_FormFill 2393 0.51 0.01 0.74 157 RCVD_IN_PBL 2350 0.78 0.90 0.73 158 T_Symld_Words_02 2251 0.77 0.92 0.70 159 XMBody_95 2250 0.55 0.22 0.70 160 XM_B_SpammyWords4 2140 1.11 2.05 0.66 161 MSGID_FROM_MTA_HEADER 2138 0.49 0.11 0.66 162 TR_XM_Base64_M1 2136 0.82 1.16 0.66 163 XM_H_PHPMailer 2127 0.66 0.67 0.66 164 NML_ADSP_CUSTOM_MED 2090 0.73 0.89 0.65 165 T_XMHurry_00 2076 1.13 2.16 0.64 166 XM_B_DNDMA 2073 0.79 1.09 0.64 167 XMSubMetaSxObfu_03 1966 0.63 0.67 0.61 168 HTML_TAG_BALANCE_BODY 1960 0.71 0.93 0.61 169 XMPhish30 1913 1.08 2.10 0.59 170 FORGED_GMAIL_RCVD 1900 0.66 0.80 0.59 171 XM_ProductURIs 1889 0.67 0.86 0.59 172 XMOemUri 1828 0.52 0.42 0.57 173 XMBdyGiftCard01 1818 0.67 0.89 0.56 174 MPART_ALT_DIFF_COUNT 1767 0.66 0.89 0.55 175 XMSlimDrugH 1732 0.55 0.59 0.54 176 URI_TRY_3LD 1729 0.71 1.06 0.54 177 XMSubMetaI_00 1691 0.61 0.79 0.53 178 RELAYCOUNTRY_GB 1683 0.66 0.97 0.52 179 HTML_IMAGE_ONLY_32 1650 0.40 0.16 0.51 180 T_OBFU_PDF_ATTACH 1605 0.38 0.11 0.50 181 MISSING_HEADERS 1602 0.48 0.45 0.50 182 XMMoneyMeta_00 1573 0.63 0.94 0.49 183 SpammyFromTLD_02 1572 0.95 1.94 0.49 184 TM2_M_OBFU_COMMENT 1497 0.56 0.76 0.46 185 HTML_IMAGE_ONLY_20 1467 0.50 0.61 0.46 186 LongTLD 1422 1.01 2.22 0.44 187 FROM_GOV_SPOOF 1410 0.32 0.08 0.44 188 TR_XM_SPAMCOP 1400 2.91 8.20 0.43 189 HTML_IMAGE_ONLY_28 1389 0.46 0.53 0.43 190 XMPhish14 1384 0.62 1.02 0.43 191 TR_XM_SpammyWords2 1380 3.75 10.87 0.43 192 SHORT_HELO_AND_INLINE_IMAGE 1377 0.30 0.03 0.43 193 THIS_AD 1360 0.55 0.83 0.42 194 USER_IN_WELCOMELIST 1338 0.28 0.00 0.42 195 USER_IN_WHITELIST 1338 0.28 0.00 0.42 196 HTML_FONT_FACE_BAD 1309 0.57 0.92 0.41 197 FILL_THIS_FORM 1305 0.33 0.17 0.41 198 XMLngstWrd_00 1278 0.38 0.35 0.40 199 TM2_M_BODY_EMPTY 1270 0.29 0.05 0.39 200 TO_NO_BRKTS_HTML_ONLY 1251 0.35 0.27 0.39 ----------------------------------------------------------------------