Email: 536696 Autolearn: 0 AvgScore: 5.06 AvgScanTime: 1.43 sec Spam: 189811 Autolearn: 0 AvgScore: 15.34 AvgScanTime: 1.52 sec Ham: 346885 Autolearn: 0 AvgScore: -0.57 AvgScanTime: 1.38 sec Time Spent Running SA: 213.15 hours Time Spent Processing Spam: 80.34 hours Time Spent Processing Ham: 132.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 182724 90.19 96.27 86.87 2 DKIM_SIGNED 163101 80.01 85.93 76.77 3 XM_B_Unicode 158954 75.06 83.74 70.31 4 XM_DK_Pass 157697 77.53 83.08 74.49 5 DKIM_VALID 156676 76.76 82.54 73.60 6 RELAYCOUNTRY_US 148621 80.56 78.30 81.79 7 DCC_CHECK 139685 48.77 73.59 35.19 8 XM_B_SpammyWords 127268 53.07 67.05 45.42 9 XMListUnsubscribeExists 125210 57.15 65.97 52.33 10 DKIM_VALID_AU 117519 59.37 61.91 57.98 11 RCVD_IN_MSPIKE_H2 88297 43.20 46.52 41.39 12 XM_B_Unicode3 83588 41.92 44.04 40.76 13 XM_DK_Undo_02 76260 18.37 40.18 6.44 14 BAYES_50 75848 51.30 39.96 57.51 15 XM_B_SpammyWords2 69320 25.24 36.52 19.07 16 MIME_HTML_ONLY 68543 25.68 36.11 19.97 17 LOC_TINY_FONT_1 65638 27.37 34.58 23.42 18 HTML_FONT_LOW_CONTRAST 63803 30.33 33.61 28.53 19 DKIM_VALID_EF 63631 29.81 33.52 27.78 20 BAYES_99 63157 15.26 33.27 5.40 21 FVGT_m_MULTI_ODD 62424 28.91 32.89 26.74 22 TR_XM_DKIM_Undo 62281 14.33 32.81 4.21 23 T_KAM_HTML_FONT_INVALID 56033 23.51 29.52 20.22 24 DCC_CHECK_NEGATIVE 50080 51.19 26.38 64.77 25 BAYES_999 48970 11.95 25.80 4.38 26 TR_DCC_Bayes_99 46612 9.75 24.56 1.65 27 RELAYCOUNTRY_META 44046 10.70 23.21 3.86 28 XMSubLong 42626 22.55 22.46 22.60 29 XM_Body_Dirty_Words 41828 15.30 22.04 11.61 30 T_TM2_M_HEADER_IN_MSG 35247 25.03 18.57 28.57 31 XM_Multi_Part_URI 32009 14.07 16.86 12.55 32 FSL_BULK_SIG 30777 7.66 16.21 2.98 33 XM_B_Unsub 29918 10.82 15.76 8.12 34 TR_XM_BayesUnsub 29253 9.50 15.41 6.26 35 LOTS_OF_MONEY 28195 10.33 14.85 7.86 36 RCVD_IN_MSPIKE_WL 26560 16.59 13.99 18.01 37 TR_XM_SpammyRelay 26328 6.13 13.87 1.90 38 BOTNET_IPINHOSTNAME 25451 7.85 13.41 4.81 39 UNPARSEABLE_RELAY 24657 9.89 12.99 8.20 40 BOTNET 24488 5.58 12.90 1.57 41 TR_XM_UnparsRelay 24273 8.71 12.79 6.48 42 TR_XM_SpammyWords4 23865 7.65 12.57 4.95 43 RCVD_IN_BL_SPAMCOP_NET 22278 4.39 11.74 0.37 44 RCVD_IN_MSPIKE_H3 21540 11.94 11.35 12.26 45 XM_B_SpammyWords3 21308 7.26 11.23 5.09 46 XMSexyCombo_05 21042 6.07 11.09 3.33 47 TR_XM_SpammyWords2 19212 4.07 10.12 0.76 48 UNTRUSTED_Relay 17601 4.16 9.27 1.36 49 RELAYCOUNTRY_CA 17494 4.00 9.22 1.15 50 XM_H_Long_From01 17360 6.49 9.15 5.04 51 XM_UncommonTLD01 17318 5.73 9.12 3.88 52 BAYES_80 16611 5.98 8.75 4.47 53 XM_Evil_Numbers_Gen 15113 7.87 7.96 7.83 54 TR_XM_PhishingBody 14850 4.76 7.82 3.08 55 BAYES_60 14547 8.69 7.66 9.25 56 T_REMOTE_IMAGE 14161 5.01 7.46 3.66 57 RCVD_IN_MSPIKE_BL 13959 2.86 7.35 0.40 58 XM_SPF_SoftFail 13717 3.89 7.23 2.06 59 TR_XM_SPAMCOP 13660 2.66 7.20 0.18 60 TR_XM_MSPIKECOMBO 13363 2.74 7.04 0.39 61 XM_CamelCaseFrm001 12820 3.58 6.75 1.84 62 MPART_ALT_DIFF 12548 5.73 6.61 5.26 63 LotsOfNums_01 12487 8.33 6.58 9.29 64 XM_SendGrid 11954 5.84 6.30 5.59 65 XMSubMetaSx_00 11421 4.24 6.02 3.26 66 HTML_IMAGE_RATIO_02 11219 5.79 5.91 5.73 67 RCVD_IN_VALIDITY_RPBL 11177 2.09 5.89 0.02 68 BAYES_95 10988 3.88 5.79 2.84 69 XM_B_SpammyTLD 9709 3.45 5.12 2.54 70 XM_B_Phish_Phrases 9405 3.89 4.95 3.31 71 TR_XM_SpammyWords3 8861 1.77 4.67 0.18 72 HTML_IMAGE_ONLY_24 8812 1.87 4.64 0.35 73 T_XMDrugObfuBody_08 8747 2.57 4.61 1.45 74 XM_B_Investor 8631 3.12 4.55 2.33 75 HTTP_EXCESSIVE_ESCAPES 8586 1.62 4.52 0.03 76 XM_DIRTYINTL 8283 1.75 4.36 0.32 77 XMBody_17 8154 1.96 4.30 0.68 78 XM_UB50 7948 2.03 4.19 0.85 79 TR_XM_SpammyWords5 7844 2.55 4.13 1.68 80 MIME_HTML_ONLY_MULTI 7538 3.65 3.97 3.48 81 HTML_IMAGE_RATIO_04 7515 4.70 3.96 5.10 82 TR_XM_DK_SendGrid 7451 3.72 3.93 3.60 83 XMNumbers 7448 4.04 3.92 4.10 84 TooManyTo_001 7434 6.73 3.92 8.26 85 MIME_HTML_MOSTLY 7316 3.08 3.85 2.65 86 BOTNET_NORDNS 7135 1.34 3.76 0.01 87 TM2_M_VERY_LONG_WORD 7123 2.31 3.75 1.51 88 T_XMDrugObfuBody_14 6951 2.29 3.66 1.53 89 RCVD_IN_PSBL 6929 1.49 3.65 0.31 90 HTML_IMAGE_RATIO_06 6670 3.43 3.51 3.38 91 XM_OfRef6 6646 2.23 3.50 1.54 92 XM_B_Phish66 6553 2.39 3.45 1.80 93 T_FILL_THIS_FORM_SHORT 6528 1.80 3.44 0.90 94 RCVD_IN_MSPIKE_L3 6465 1.44 3.41 0.36 95 DKIM_INVALID 6425 3.25 3.38 3.17 96 HTML_MIME_NO_HTML_TAG 6403 2.78 3.37 2.45 97 MIME_QP_LONG_LINE 6289 4.86 3.31 5.70 98 RCVD_IN_MSPIKE_L5 6223 1.17 3.28 0.02 99 URIBL_DBL_SPAM 6175 1.16 3.25 0.01 100 XMStrtUSub 6168 3.93 3.25 4.30 101 XM_DK_Undo_01 6004 2.07 3.16 1.47 102 HTML_IMAGE_RATIO_08 5801 2.65 3.06 2.43 103 XMDiploma_00 5668 1.99 2.99 1.45 104 SpammyFromTLD_01 5657 1.56 2.98 0.78 105 SpammyFromTLD_02 5139 1.28 2.71 0.50 106 URI_NOVOWEL 5103 2.82 2.69 2.90 107 XM_H_Undi_Recip 4882 1.05 2.57 0.22 108 XM_B_Unsub2 4852 1.93 2.56 1.58 109 XM_UB99 4754 0.89 2.50 0.00 110 TM2_M_URI_OPT_OUT 4718 2.31 2.49 2.21 111 RCVD_IN_MSPIKE_H4 4697 3.84 2.47 4.58 112 FONT_INVIS_LONG_LINE 4649 1.00 2.45 0.21 113 PDS_OTHER_BAD_TLD 4626 0.99 2.44 0.20 114 MIME_BASE64_TEXT 4535 0.94 2.39 0.14 115 TR_XM_MSPIKECOMBO2 4500 0.87 2.37 0.05 116 RCVD_IN_VALIDITY_SAFE 4362 3.71 2.30 4.49 117 FROM_EXCESS_BASE64 4312 2.32 2.27 2.34 118 TR_LOTS_OF_MONEY3 4171 1.05 2.20 0.43 119 TR_XM_InvalidRelay 4158 0.79 2.19 0.02 120 XMPhish08 4086 0.94 2.15 0.27 121 XM_B_SpammyWords4 4085 1.27 2.15 0.79 122 SUBJ_ALL_CAPS 4041 1.89 2.13 1.76 123 XMPhishDuo 3898 0.74 2.05 0.02 124 XM_UB999 3885 0.73 2.05 0.00 125 RCVD_IN_IADB_LISTED 3881 4.39 2.04 5.67 126 XM_GoogleGroups 3860 1.86 2.03 1.76 127 XMLngstWrd_00 3764 1.43 1.98 1.12 128 TR_XM_NoHeaderRelay 3714 0.77 1.96 0.12 129 XMLngstWrd_01 3700 1.37 1.95 1.05 130 TVD_RCVD_SPACE_BRACKET 3684 0.69 1.94 0.00 131 T_TooManySym_01 3629 4.92 1.91 6.57 132 XMLngstWrd_02 3591 1.28 1.89 0.94 133 ALL_TRUSTED 3582 10.50 1.89 15.21 134 XMReplyNow 3562 0.85 1.88 0.28 135 T_XMHurry_00 3531 1.10 1.86 0.68 136 XMLngstWrd_03 3478 1.21 1.83 0.86 137 HK_RANDOM_REPLYTO 3460 0.69 1.82 0.08 138 RCVD_IN_IADB_SPF 3455 3.90 1.82 5.04 139 XM_URI_RBL 3453 0.74 1.82 0.14 140 XMSexyCombo_01 3407 0.91 1.79 0.43 141 RCVD_IN_VALIDITY_CERTIFIED 3407 3.21 1.79 3.99 142 XMLngstWrd_04 3385 1.15 1.78 0.80 143 RCVD_IN_IADB_DK 3280 3.46 1.73 4.40 144 RCVD_IN_IADB_SENDERID 3271 3.53 1.72 4.52 145 BAYES_40 3258 3.74 1.72 4.85 146 TR_XM_FormFill 3252 0.64 1.71 0.05 147 USER_IN_DEF_DKIM_WL 3217 8.90 1.69 12.85 148 URI_PHP_REDIR 3186 0.59 1.68 0.00 149 XM_H_Long_From02 3161 1.46 1.67 1.35 150 XMPhish11 3157 0.63 1.66 0.07 151 XMBrknScrpt_02 3141 1.05 1.65 0.72 152 TR_XM_SB_Phish 3091 1.99 1.63 2.18 153 HTML_TITLE_SUBJ_DIFF 3058 0.94 1.61 0.58 154 PDS_FROM_NAME_TO_DOMAIN 3036 0.57 1.60 0.00 155 PDS_FRNOM_TODOM_NAKED_TO 3019 0.57 1.59 0.00 156 UPPERCASE_75_100 2997 0.92 1.58 0.55 157 MPART_ALT_DIFF_COUNT 2995 0.95 1.58 0.61 158 MAILING_LIST_MULTI 2984 2.27 1.57 2.65 159 XM_B_COVIDMETA 2979 0.80 1.57 0.38 160 XMSubPhish11 2959 1.95 1.56 2.16 161 HTTPS_HTTP_MISMATCH 2956 1.08 1.56 0.82 162 DKIM_ADSP_DISCARD 2941 0.55 1.55 0.00 163 URI_WP_HACKED_2 2921 0.55 1.54 0.01 164 XMPhish30 2901 0.95 1.53 0.63 165 TR_XM_PHPDW 2896 0.82 1.53 0.43 166 T_XMDrugObfuBody_00 2808 1.04 1.48 0.80 167 TR_XM_PHPForged 2780 0.75 1.46 0.37 168 XMPhish19 2776 0.52 1.46 0.01 169 TR_XM_FormFill2 2737 0.75 1.44 0.36 170 XM_H_PHPOS 2723 0.74 1.43 0.36 171 URI_HEX 2720 1.46 1.43 1.47 172 RELAYCOUNTRY_RU 2698 0.51 1.42 0.02 173 XMStockSpam_06 2689 1.30 1.42 1.24 174 TR_XM_PhishingBody3 2611 0.49 1.38 0.00 175 RELAYCOUNTRY_AU 2608 0.71 1.37 0.34 176 RELAYCOUNTRY_CN 2557 0.52 1.35 0.07 177 XMBdyGiftCard01 2484 0.99 1.31 0.81 178 HTML_TAG_BALANCE_BODY 2442 1.04 1.29 0.91 179 TR_XM_Undi_Recip5 2425 0.46 1.28 0.01 180 RELAYCOUNTRY_GB 2424 0.83 1.28 0.58 181 URIBL_BLACK 2398 0.48 1.26 0.05 182 TR_XM_MaxSPIKE 2394 0.48 1.26 0.05 183 BAYES_20 2365 2.79 1.25 3.64 184 REMOVE_BEFORE_LINK 2327 0.61 1.23 0.28 185 TR_XM_BayesRelay 2276 0.43 1.20 0.00 186 TR_XM_Base64_M1 2274 1.01 1.20 0.90 187 RELAYCOUNTRY_IN 2268 0.46 1.19 0.06 188 RCVD_IN_RP_RNBL 2264 0.42 1.19 0.00 189 XMHTML_After_End 2215 0.98 1.17 0.88 190 XMGenDplmaNmb 2205 0.90 1.16 0.75 191 UNDISC_MONEY 2068 0.39 1.09 0.00 192 RELAYCOUNTRY_FR 2067 0.55 1.09 0.26 193 TR_XM_Undi_Recip2 2067 0.40 1.09 0.02 194 LONGLN_LOW_CONTRAST 2066 0.66 1.09 0.43 195 TR_XM_SpoofStaff 2045 0.46 1.08 0.13 196 FORM_FRAUD_5 2035 0.38 1.07 0.00 197 TR_MetaPhish_Combo_01 2033 0.81 1.07 0.67 198 KHOP_HELO_FCRDNS 2031 1.25 1.07 1.35 199 URI_TRY_3LD 2023 0.83 1.07 0.69 200 XMSubNoVowel 1991 0.83 1.05 0.70 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 301332 90.19 96.27 86.87 2 RELAYCOUNTRY_US 283719 80.56 78.30 81.79 3 DKIM_SIGNED 266311 80.01 85.93 76.77 4 XM_DK_Pass 258378 77.53 83.08 74.49 5 DKIM_VALID 255302 76.76 82.54 73.60 6 XM_B_Unicode 243902 75.06 83.74 70.31 7 DCC_CHECK_NEGATIVE 224664 51.19 26.38 64.77 8 DKIM_VALID_AU 201107 59.37 61.91 57.98 9 BAYES_50 199503 51.30 39.96 57.51 10 XMListUnsubscribeExists 181514 57.15 65.97 52.33 11 XM_B_SpammyWords 157543 53.07 67.05 45.42 12 RCVD_IN_MSPIKE_H2 143581 43.20 46.52 41.39 13 XM_B_Unicode3 141400 41.92 44.04 40.76 14 DCC_CHECK 122078 48.77 73.59 35.19 15 T_TM2_M_HEADER_IN_MSG 99095 25.03 18.57 28.57 16 HTML_FONT_LOW_CONTRAST 98959 30.33 33.61 28.53 17 DKIM_VALID_EF 96367 29.81 33.52 27.78 18 FVGT_m_MULTI_ODD 92758 28.91 32.89 26.74 19 LOC_TINY_FONT_1 81235 27.37 34.58 23.42 20 XMSubLong 78380 22.55 22.46 22.60 21 T_KAM_HTML_FONT_INVALID 70154 23.51 29.52 20.22 22 MIME_HTML_ONLY 69272 25.68 36.11 19.97 23 XM_B_SpammyWords2 66156 25.24 36.52 19.07 24 RCVD_IN_MSPIKE_WL 62463 16.59 13.99 18.01 25 ALL_TRUSTED 52757 10.50 1.89 15.21 26 USER_IN_DEF_DKIM_WL 44558 8.90 1.69 12.85 27 XM_Multi_Part_URI 43526 14.07 16.86 12.55 28 RCVD_IN_MSPIKE_H3 42517 11.94 11.35 12.26 29 XM_Body_Dirty_Words 40263 15.30 22.04 11.61 30 BAYES_00 33672 6.60 0.93 9.71 31 LotsOfNums_01 32216 8.33 6.58 9.29 32 BAYES_60 32086 8.69 7.66 9.25 33 XM_DKIMWhitelistDomains 31101 5.82 0.06 8.97 34 TooManyTo_001 28665 6.73 3.92 8.26 35 UNPARSEABLE_RELAY 28443 9.89 12.99 8.20 36 XM_B_Unsub 28152 10.82 15.76 8.12 37 LOTS_OF_MONEY 27257 10.33 14.85 7.86 38 XM_Evil_Numbers_Gen 27149 7.87 7.96 7.83 39 IN_ZIMBRA_NJ_WHITELIST 23657 4.44 0.09 6.82 40 T_TooManySym_01 22796 4.92 1.91 6.57 41 TR_XM_UnparsRelay 22492 8.71 12.79 6.48 42 XM_DK_Undo_02 22344 18.37 40.18 6.44 43 TR_XM_BayesUnsub 21714 9.50 15.41 6.26 44 TR_XM_DK_Bayes 20942 4.14 0.67 6.04 45 TR_XM_DK_Bayes1 20597 4.07 0.67 5.94 46 HTML_IMAGE_RATIO_02 19877 5.79 5.91 5.73 47 MIME_QP_LONG_LINE 19772 4.86 3.31 5.70 48 RCVD_IN_IADB_LISTED 19669 4.39 2.04 5.67 49 XM_SendGrid 19395 5.84 6.30 5.59 50 BAYES_99 18748 15.26 33.27 5.40 51 TR_XM_DK_Bayes2 18336 3.64 0.62 5.29 52 MPART_ALT_DIFF 18231 5.73 6.61 5.26 53 HTML_IMAGE_RATIO_04 17703 4.70 3.96 5.10 54 XM_B_SpammyWords3 17663 7.26 11.23 5.09 55 RCVD_IN_IADB_SPF 17478 3.90 1.82 5.04 56 XM_H_Long_From01 17472 6.49 9.15 5.04 57 TR_XM_SpammyWords4 17166 7.65 12.57 4.95 58 BAYES_40 16839 3.74 1.72 4.85 59 BOTNET_IPINHOSTNAME 16687 7.85 13.41 4.81 60 XM_PDF 16486 3.27 0.57 4.75 61 RCVD_IN_MSPIKE_H4 15894 3.84 2.47 4.58 62 RCVD_IN_IADB_SENDERID 15686 3.53 1.72 4.52 63 RCVD_IN_VALIDITY_SAFE 15573 3.71 2.30 4.49 64 BAYES_80 15498 5.98 8.75 4.47 65 RCVD_IN_IADB_DK 15265 3.46 1.73 4.40 66 BAYES_999 15184 11.95 25.80 4.38 67 XMStrtUSub 14908 3.93 3.25 4.30 68 TR_XM_DKIM_Undo 14609 14.33 32.81 4.21 69 XMNumbers 14217 4.04 3.92 4.10 70 T_TooManySym_02 14186 2.88 0.67 4.09 71 RCVD_IN_VALIDITY_CERTIFIED 13827 3.21 1.79 3.99 72 XM_UncommonTLD01 13451 5.73 9.12 3.88 73 RELAYCOUNTRY_META 13389 10.70 23.21 3.86 74 T_REMOTE_IMAGE 12708 5.01 7.46 3.66 75 BAYES_20 12611 2.79 1.25 3.64 76 TR_XM_DK_SendGrid 12498 3.72 3.93 3.60 77 RCVD_IN_IADB_VOUCHED 12178 2.61 0.96 3.51 78 MIME_HTML_ONLY_MULTI 12061 3.65 3.97 3.48 79 HTML_IMAGE_RATIO_06 11727 3.43 3.51 3.38 80 XMSexyCombo_05 11554 6.07 11.09 3.33 81 XM_B_Phish_Phrases 11494 3.89 4.95 3.31 82 XMSubMetaSx_00 11324 4.24 6.02 3.26 83 DKIM_INVALID 11009 3.25 3.38 3.17 84 TR_XM_PhishingBody 10678 4.76 7.82 3.08 85 FSL_BULK_SIG 10321 7.66 16.21 2.98 86 URI_NOVOWEL 10051 2.82 2.69 2.90 87 BAYES_95 9847 3.88 5.79 2.84 88 MIME_HTML_MOSTLY 9197 3.08 3.85 2.65 89 MAILING_LIST_MULTI 9188 2.27 1.57 2.65 90 XM_B_SpammyTLD 8827 3.45 5.12 2.54 91 HTML_MIME_NO_HTML_TAG 8494 2.78 3.37 2.45 92 HTML_IMAGE_RATIO_08 8427 2.65 3.06 2.43 93 RCVD_IN_IADB_OPTIN 8135 1.72 0.58 2.35 94 FROM_EXCESS_BASE64 8130 2.32 2.27 2.34 95 XM_B_Investor 8093 3.12 4.55 2.33 96 BAYES_05 8081 1.74 0.67 2.33 97 TM2_M_URI_OPT_OUT 7672 2.31 2.49 2.21 98 TR_XM_SB_Phish 7563 1.99 1.63 2.18 99 XMSubPhish11 7504 1.95 1.56 2.16 100 TooManyTo_002 7424 1.54 0.44 2.14 101 XM_SPF_SoftFail 7149 3.89 7.23 2.06 102 XM_H_Trusted_IP 6832 1.27 0.00 1.97 103 ANY_BOUNCE_MESSAGE 6781 1.47 0.59 1.95 104 BOUNCE_MESSAGE 6780 1.47 0.59 1.95 105 INVALID_MSGID 6700 1.30 0.14 1.93 106 TR_XM_SpammyRelay 6591 6.13 13.87 1.90 107 IN_HORDE_ADDRESS_BOOK 6388 1.24 0.14 1.84 108 XM_CamelCaseFrm001 6388 3.58 6.75 1.84 109 XM_B_Phish66 6256 2.39 3.45 1.80 110 MSGID_NOFQDN1 6239 1.18 0.06 1.80 111 SUBJ_ALL_CAPS 6115 1.89 2.13 1.76 112 XM_GoogleGroups 6115 1.86 2.03 1.76 113 T_TooManySym_03 6065 1.24 0.31 1.75 114 HELO_NODOT 6045 1.24 0.32 1.74 115 HELO_NO_DOMAIN 6038 1.23 0.31 1.74 116 TVD_RCVD_IP 5977 1.23 0.33 1.72 117 TO_MALFORMED 5941 1.12 0.05 1.71 118 TR_XM_SpammyWords5 5835 2.55 4.13 1.68 119 TR_DCC_Bayes_99 5736 9.75 24.56 1.65 120 TVD_SPACE_RATIO 5642 1.09 0.10 1.63 121 XM_B_Unsub2 5494 1.93 2.56 1.58 122 BOTNET 5460 5.58 12.90 1.57 123 XM_OfRef6 5339 2.23 3.50 1.54 124 T_XMDrugObfuBody_14 5323 2.29 3.66 1.53 125 TR_Symld_Words 5285 1.33 0.98 1.52 126 TM2_M_VERY_LONG_WORD 5253 2.31 3.75 1.51 127 XM_DK_Undo_01 5113 2.07 3.16 1.47 128 URI_HEX 5092 1.46 1.43 1.47 129 XMDiploma_00 5023 1.99 2.99 1.45 130 T_XMDrugObfuBody_08 5020 2.57 4.61 1.45 131 TooManyTo_003 4995 1.05 0.34 1.44 132 UNTRUSTED_Relay 4733 4.16 9.27 1.36 133 XM_H_Long_From02 4682 1.46 1.67 1.35 134 KHOP_HELO_FCRDNS 4667 1.25 1.07 1.35 135 XMGappySubj_01 4539 0.90 0.14 1.31 136 XMStockSpam_06 4302 1.30 1.42 1.24 137 XMBSHREFv2 4248 0.88 0.25 1.22 138 RCVD_IN_MSPIKE_H5 4052 0.82 0.17 1.17 139 HTML_FONT_FACE_BAD 4051 0.99 0.66 1.17 140 RELAYCOUNTRY_CA 3985 4.00 9.22 1.15 141 XMLngstWrd_00 3892 1.43 1.98 1.12 142 XMCapTrack 3785 0.82 0.32 1.09 143 XMBody_95 3723 0.75 0.15 1.07 144 XMLngstWrd_01 3634 1.37 1.95 1.05 145 TooManyTo_004 3575 0.77 0.29 1.03 146 XMLngstWrd_02 3253 1.28 1.89 0.94 147 DKIM_ADSP_CUSTOM_MED 3203 0.89 0.84 0.92 148 HTML_TAG_BALANCE_BODY 3158 1.04 1.29 0.91 149 TR_XM_Base64_M1 3138 1.01 1.20 0.90 150 T_FILL_THIS_FORM_SHORT 3119 1.80 3.44 0.90 151 XMHTML_After_End 3068 0.98 1.17 0.88 152 RCVD_IN_RP_SAFE 3058 0.75 0.51 0.88 153 XMLngstWrd_03 2998 1.21 1.83 0.86 154 FVGT_m_MULTI_ODD_EMAIL 2957 0.62 0.20 0.85 155 XM_UB50 2943 2.03 4.19 0.85 156 TooManyTo_005 2882 0.61 0.21 0.83 157 HTTPS_HTTP_MISMATCH 2851 1.08 1.56 0.82 158 XMBdyGiftCard01 2816 0.99 1.31 0.81 159 FROM_GOV_DKIM_AU 2805 0.59 0.19 0.81 160 T_XMDrugObfuBody_00 2781 1.04 1.48 0.80 161 XMLngstWrd_04 2775 1.15 1.78 0.80 162 RCVD_IN_RP_CERTIFIED 2758 0.64 0.37 0.80 163 XM_B_SpammyWords4 2742 1.27 2.15 0.79 164 SpammyFromTLD_01 2708 1.56 2.98 0.78 165 TR_XM_SpammyWords2 2638 4.07 10.12 0.76 166 XMGenDplmaNmb 2607 0.90 1.16 0.75 167 XMBrknScrpt_02 2487 1.05 1.65 0.72 168 XMSubNoVowel 2445 0.83 1.05 0.70 169 URI_TRY_3LD 2410 0.83 1.07 0.69 170 XMBody_17 2353 1.96 4.30 0.68 171 T_XMHurry_00 2353 1.10 1.86 0.68 172 TR_MetaPhish_Combo_01 2321 0.81 1.07 0.67 173 T_OBFU_PDF_ATTACH 2249 0.45 0.08 0.65 174 HTML_IMAGE_ONLY_20 2215 0.57 0.45 0.64 175 XMPhish30 2182 0.95 1.53 0.63 176 XM_H_PHPMailer 2151 0.60 0.55 0.62 177 PLING_QUERY 2150 0.69 0.83 0.62 178 MPART_ALT_DIFF_COUNT 2130 0.95 1.58 0.61 179 XMSubMetaSxObfu_02 2087 0.56 0.47 0.60 180 XM_OfRef7 2066 0.74 1.01 0.60 181 XMSlimDrugH 2040 0.69 0.87 0.59 182 XM_ShortIntro_01 2038 0.46 0.23 0.59 183 RELAYCOUNTRY_GB 2010 0.83 1.28 0.58 184 XM_B_COPY_HTML 2006 0.70 0.93 0.58 185 HTML_TITLE_SUBJ_DIFF 1995 0.94 1.61 0.58 186 NML_ADSP_CUSTOM_MED 1951 0.57 0.60 0.56 187 SHORT_HELO_AND_INLINE_IMAGE 1935 0.38 0.06 0.56 188 UPPERCASE_75_100 1920 0.92 1.58 0.55 189 XM_ProductURIs 1895 0.68 0.92 0.55 190 FORGED_GMAIL_RCVD 1872 0.61 0.73 0.54 191 XMHTMLBadTable_001 1806 0.59 0.73 0.52 192 XMNoVowels 1775 0.46 0.37 0.51 193 XMMoneyMeta_00 1749 0.55 0.63 0.50 194 SpammyFromTLD_02 1727 1.28 2.71 0.50 195 T_Symld_Words_02 1671 0.59 0.79 0.48 196 HTML_IMAGE_ONLY_28 1654 0.43 0.35 0.48 197 XMSubMetaI_00 1649 0.61 0.86 0.48 198 LongTLD 1642 0.51 0.58 0.47 199 TR_XM_Base64_L1 1634 0.56 0.72 0.47 200 XM_S_SpammyWords 1609 0.64 0.97 0.46 ----------------------------------------------------------------------