Email: 487148 Autolearn: 0 AvgScore: 3.65 AvgScanTime: 1.38 sec Spam: 155079 Autolearn: 0 AvgScore: 13.44 AvgScanTime: 1.49 sec Ham: 332069 Autolearn: 0 AvgScore: -0.92 AvgScanTime: 1.32 sec Time Spent Running SA: 186.47 hours Time Spent Processing Spam: 64.33 hours Time Spent Processing Ham: 122.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145767 88.43 94.00 85.82 2 DKIM_SIGNED 138843 79.51 89.53 74.83 3 XM_DK_Pass 136276 77.50 87.88 72.66 4 DKIM_VALID 134763 76.43 86.90 71.54 5 RELAYCOUNTRY_US 124797 80.17 80.47 80.02 6 XM_B_Unicode 123639 71.81 79.73 68.11 7 DCC_CHECK 111204 45.91 71.71 33.86 8 XMListUnsubscribeExists 111019 55.17 71.59 47.50 9 XM_B_SpammyWords 107774 52.20 69.50 44.13 10 DKIM_VALID_AU 104751 59.85 67.55 56.25 11 RCVD_IN_MSPIKE_H2 74202 42.42 47.85 39.88 12 XM_DK_Undo_02 69967 18.76 45.12 6.45 13 XM_B_Unicode3 64801 38.98 41.79 37.67 14 BAYES_50 61231 52.32 39.48 58.31 15 XM_B_SpammyWords2 60171 25.31 38.80 19.02 16 LOC_TINY_FONT_1 58802 27.56 37.92 22.72 17 DKIM_VALID_EF 57097 32.07 36.82 29.86 18 HTML_FONT_LOW_CONTRAST 56017 30.23 36.12 27.48 19 TR_XM_DKIM_Undo 54424 14.27 35.09 4.54 20 BAYES_99 53393 14.24 34.43 4.81 21 FVGT_m_MULTI_ODD 53080 28.69 34.23 26.11 22 T_KAM_HTML_FONT_INVALID 46950 22.71 30.27 19.18 23 MIME_HTML_ONLY 45300 22.26 29.21 19.01 24 DCC_CHECK_NEGATIVE 43847 54.05 28.27 66.09 25 BAYES_999 40586 10.91 26.17 3.78 26 TR_DCC_Bayes_99 37836 8.71 24.40 1.38 27 T_TM2_M_HEADER_IN_MSG 35279 29.51 22.75 32.67 28 XM_Body_Dirty_Words 34879 15.11 22.49 11.67 29 XMSubLong 33247 22.07 21.44 22.37 30 RELAYCOUNTRY_META 31159 9.08 20.09 3.94 31 XM_Multi_Part_URI 29211 14.14 18.84 11.94 32 TR_XM_SpammyRelay 23378 5.92 15.07 1.65 33 XM_B_Unsub 23269 10.14 15.00 7.87 34 RCVD_IN_MSPIKE_WL 23026 17.30 14.85 18.44 35 TR_XM_BayesUnsub 22612 9.03 14.58 6.43 36 BOTNET_IPINHOSTNAME 20242 7.58 13.05 5.03 37 RCVD_IN_MSPIKE_H3 19165 12.08 12.36 11.94 38 LOTS_OF_MONEY 18708 8.39 12.06 6.68 39 TR_XM_SpammyWords2 18312 4.33 11.81 0.84 40 XM_B_SpammyWords3 17919 6.76 11.55 4.52 41 XM_UncommonTLD01 17229 6.35 11.11 4.13 42 TR_XM_SpammyWords4 16351 6.43 10.54 4.50 43 UNPARSEABLE_RELAY 15983 9.44 10.31 9.04 44 RELAYCOUNTRY_CA 15059 3.99 9.71 1.31 45 XMSexyCombo_05 14886 5.36 9.60 3.37 46 RCVD_IN_BL_SPAMCOP_NET 14798 3.30 9.54 0.39 47 BOTNET 14625 4.23 9.43 1.80 48 XM_Evil_Numbers_Gen 14562 8.31 9.39 7.81 49 FSL_BULK_SIG 14391 6.18 9.28 4.74 50 BAYES_80 13596 5.68 8.77 4.24 51 BAYES_60 12425 8.71 8.01 9.04 52 MPART_ALT_DIFF 12196 5.38 7.86 4.22 53 UNTRUSTED_Relay 12076 3.45 7.79 1.43 54 LotsOfNums_01 12062 7.98 7.78 8.08 55 TooManyTo_001 10896 8.50 7.03 9.19 56 TR_XM_SPAMCOP 10806 2.35 6.97 0.19 57 TR_XM_PhishingBody 10745 4.41 6.93 3.24 58 HTML_IMAGE_RATIO_02 9745 6.08 6.28 5.98 59 XMSubMetaSx_00 9726 4.10 6.27 3.08 60 XM_B_SpammyTLD 9594 3.40 6.19 2.10 61 TR_XM_UnparsRelay 9433 2.95 6.08 1.49 62 XM_B_Phish_Phrases 9297 3.83 6.00 2.82 63 XM_SendGrid 8884 5.77 5.73 5.79 64 SpammyFromTLD_02 8860 1.98 5.71 0.23 65 BAYES_95 8613 3.62 5.55 2.72 66 XM_B_Investor 8400 2.82 5.42 1.61 67 T_XMDrugObfuBody_08 8036 2.78 5.18 1.66 68 XM_H_Long_From01 7597 5.05 4.90 5.12 69 TM2_M_VERY_LONG_WORD 7455 2.54 4.81 1.49 70 XMBody_17 7303 2.15 4.71 0.96 71 MIME_HTML_MOSTLY 7180 3.21 4.63 2.54 72 MIME_HTML_ONLY_MULTI 6712 3.07 4.33 2.48 73 XMStrtUSub 6487 4.87 4.18 5.19 74 T_XMDrugObfuBody_14 6362 2.31 4.10 1.48 75 XM_SPF_SoftFail 6275 2.97 4.05 2.46 76 LongTLD 6265 1.48 4.04 0.28 77 FROM_SUSPICIOUS_NTLD 6145 1.30 3.96 0.05 78 HTML_IMAGE_RATIO_04 6055 4.12 3.90 4.22 79 TR_XM_SpammyWords5 6007 2.07 3.87 1.23 80 T_FILL_THIS_FORM_SHORT 5976 1.88 3.85 0.96 81 XM_DIRTYINTL 5907 1.49 3.81 0.40 82 XM_B_Phish66 5901 2.57 3.81 1.99 83 FROM_SUSPICIOUS_NTLD_FP 5887 1.24 3.80 0.04 84 XMNumbers 5732 4.21 3.70 4.46 85 RCVD_IN_VALIDITY_SAFE 5685 4.67 3.67 5.14 86 TR_XM_DK_SendGrid 5683 3.78 3.66 3.83 87 XM_UB50 5402 1.75 3.48 0.94 88 HTML_IMAGE_RATIO_06 5398 3.40 3.48 3.36 89 RCVD_IN_MSPIKE_BL 5346 1.39 3.45 0.44 90 TR_XM_MSPIKECOMBO 5316 1.39 3.43 0.44 91 PDS_OTHER_BAD_TLD 5310 1.22 3.42 0.20 92 USER_IN_DEF_DKIM_WL 5112 9.81 3.30 12.85 93 HTML_MIME_NO_HTML_TAG 5055 2.57 3.26 2.25 94 HTML_IMAGE_RATIO_08 5039 2.65 3.25 2.38 95 XMDiploma_00 4839 2.13 3.12 1.66 96 RCVD_IN_VALIDITY_CERTIFIED 4758 4.07 3.07 4.53 97 XM_OfRef6 4720 1.69 3.04 1.05 98 MIME_QP_LONG_LINE 4690 4.30 3.02 4.89 99 URI_NOVOWEL 4502 2.63 2.90 2.50 100 RCVD_IN_MSPIKE_L3 4313 1.16 2.78 0.40 101 HK_RANDOM_REPLYTO 4267 0.94 2.75 0.09 102 XM_B_Unsub2 4164 1.98 2.69 1.66 103 DKIM_INVALID 4080 3.08 2.63 3.29 104 FROM_EXCESS_BASE64 3962 2.42 2.55 2.36 105 TM2_M_URI_OPT_OUT 3948 1.96 2.55 1.69 106 T_TooManySym_01 3855 5.64 2.49 7.11 107 XM_DK_Undo_01 3766 1.92 2.43 1.68 108 T_REMOTE_IMAGE 3756 3.40 2.42 3.86 109 SpammyFromTLD_01 3718 1.40 2.40 0.93 110 TR_XM_FormFill 3650 0.77 2.35 0.02 111 URIBL_DBL_SPAM 3611 0.75 2.33 0.01 112 DATE_IN_PAST_12_24 3599 0.75 2.32 0.02 113 RCVD_IN_MSPIKE_H4 3597 4.33 2.32 5.26 114 XMLngstWrd_00 3516 1.30 2.27 0.84 115 XMLngstWrd_01 3481 1.24 2.24 0.76 116 XM_GoogleGroups 3415 1.79 2.20 1.60 117 XMLngstWrd_02 3370 1.14 2.17 0.66 118 XM_B_SpammyWords4 3310 1.31 2.13 0.92 119 TR_XM_SpammyWords3 3300 0.86 2.13 0.26 120 TR_XM_NoHeaderRelay 3232 0.75 2.08 0.12 121 RCVD_IN_IADB_LISTED 3181 3.94 2.05 4.82 122 URI_HEX 3162 1.43 2.04 1.14 123 FONT_INVIS_LONG_LINE 3142 0.70 2.03 0.07 124 XM_CamelCaseFrm001 3119 1.93 2.01 1.89 125 TR_Mismatch_TLD_02 3103 0.70 2.00 0.09 126 SUBJ_ALL_CAPS 2993 1.74 1.93 1.65 127 XMLngstWrd_03 2965 1.01 1.91 0.58 128 KHOP_HELO_FCRDNS 2929 1.82 1.89 1.78 129 XM_H_Undi_Recip 2901 0.82 1.87 0.33 130 XM_B_COVIDMETA 2871 0.87 1.85 0.41 131 XMLngstWrd_04 2829 0.93 1.82 0.51 132 XM_URI_RBL 2733 0.66 1.76 0.14 133 T_XMDrugObfuBody_00 2721 1.03 1.75 0.70 134 RCVD_IN_IADB_SPF 2719 3.49 1.75 4.29 135 XMStockSpam_06 2687 1.52 1.73 1.42 136 T_XMHurry_00 2655 0.88 1.71 0.49 137 XMBdyGiftCard01 2641 1.23 1.70 1.00 138 HTML_TITLE_SUBJ_DIFF 2627 0.77 1.69 0.34 139 XMSexyCombo_01 2597 0.78 1.67 0.36 140 RCVD_IN_IADB_DK 2583 3.05 1.67 3.70 141 RCVD_IN_IADB_SENDERID 2558 3.14 1.65 3.84 142 TR_XM_SB_Phish 2550 2.09 1.64 2.29 143 HTTPS_HTTP_MISMATCH 2538 1.17 1.64 0.95 144 MAILING_LIST_MULTI 2531 2.41 1.63 2.77 145 ALL_TRUSTED 2477 12.09 1.60 16.99 146 RCVD_IN_VALIDITY_RPBL 2474 0.54 1.60 0.05 147 UPPERCASE_75_100 2473 0.74 1.59 0.34 148 TR_XM_PHPDW 2379 0.78 1.53 0.43 149 TR_XM_BayesRelay 2348 0.48 1.51 0.00 150 XMSubPhish11 2302 2.02 1.48 2.27 151 TR_XM_PHPForged 2293 0.74 1.48 0.40 152 TR_XM_FormFill2 2251 0.73 1.45 0.39 153 XM_H_PHPOS 2236 0.72 1.44 0.39 154 XMGenDplmaNmb 2178 1.00 1.40 0.82 155 TR_XM_Base64_M1 2175 1.26 1.40 1.19 156 TM2_M_A_HREF_HREF 2166 0.59 1.40 0.21 157 XMBrknScrpt_02 2147 0.97 1.38 0.78 158 HTML_TAG_BALANCE_BODY 2140 0.92 1.38 0.70 159 BOTNET_NORDNS 2106 0.44 1.36 0.01 160 BAYES_40 2051 3.90 1.32 5.11 161 XM_UB60 2008 0.47 1.29 0.08 162 XMHTML_After_End 1979 1.10 1.28 1.02 163 TR_XM_InvalidRelay 1966 0.42 1.27 0.02 164 RELAYCOUNTRY_IN 1961 0.46 1.26 0.08 165 BOUNCE_MESSAGE 1921 1.79 1.24 2.05 166 ANY_BOUNCE_MESSAGE 1921 1.79 1.24 2.05 167 TR_LOTS_OF_MONEY3 1900 0.64 1.23 0.36 168 XMPhish30 1893 0.81 1.22 0.61 169 XM_PDF 1892 3.89 1.22 5.13 170 XM_H_Long_From02 1878 0.98 1.21 0.87 171 DIET_1 1860 0.63 1.20 0.36 172 XM_UB99 1851 0.38 1.19 0.00 173 TR_XM_MSPIKECOMBO2 1802 0.38 1.16 0.02 174 XM_RXBody 1797 0.51 1.16 0.20 175 URIBL_BLACK 1794 0.40 1.16 0.04 176 RELAYCOUNTRY_RU 1791 0.39 1.15 0.03 177 XM_B_DNDMA 1728 0.60 1.11 0.36 178 RELAYCOUNTRY_AU 1706 0.55 1.10 0.29 179 XM_B_SEO 1704 0.45 1.10 0.14 180 BAYES_20 1653 2.98 1.07 3.88 181 RCVD_IN_IADB_VOUCHED 1640 2.37 1.06 2.98 182 NO_DNS_FOR_FROM 1632 0.59 1.05 0.37 183 TR_XM_SEO4 1620 0.39 1.04 0.08 184 XMReplyNow 1616 0.51 1.04 0.26 185 TR_XM_MaxWHORU 1614 0.52 1.04 0.27 186 XMSubMetaSxObfu_03 1608 0.59 1.04 0.38 187 TR_Symld_Words 1592 1.55 1.03 1.80 188 MPART_ALT_DIFF_COUNT 1587 0.70 1.02 0.55 189 URI_PHP_REDIR 1573 0.33 1.01 0.01 190 XM_UB80 1559 0.33 1.01 0.02 191 XMSubMetaI_00 1523 0.71 0.98 0.58 192 TR_XM_Base64_L1 1501 0.44 0.97 0.20 193 XMPhish08 1499 0.46 0.97 0.22 194 T_MONEY_PERCENT 1497 0.45 0.97 0.21 195 TR_LOTS_OF_MONEY2 1497 0.45 0.97 0.21 196 TR_XM_MaxSPIKE 1467 0.31 0.95 0.02 197 TR_XM_COVIDMETA1 1449 0.42 0.93 0.17 198 RELAYCOUNTRY_FR 1442 0.50 0.93 0.29 199 XM_UB999 1434 0.30 0.92 0.00 200 SHOPIFY_IMG_NOT_RCVD_SFY 1430 0.46 0.92 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 284994 88.43 94.00 85.82 2 RELAYCOUNTRY_US 265727 80.17 80.47 80.02 3 DKIM_SIGNED 248482 79.51 89.53 74.83 4 XM_DK_Pass 241273 77.50 87.88 72.66 5 DKIM_VALID 237569 76.43 86.90 71.54 6 XM_B_Unicode 226159 71.81 79.73 68.11 7 DCC_CHECK_NEGATIVE 219468 54.05 28.27 66.09 8 BAYES_50 193632 52.32 39.48 58.31 9 DKIM_VALID_AU 186795 59.85 67.55 56.25 10 XMListUnsubscribeExists 157735 55.17 71.59 47.50 11 XM_B_SpammyWords 146530 52.20 69.50 44.13 12 RCVD_IN_MSPIKE_H2 132434 42.42 47.85 39.88 13 XM_B_Unicode3 125098 38.98 41.79 37.67 14 DCC_CHECK 112444 45.91 71.71 33.86 15 T_TM2_M_HEADER_IN_MSG 108482 29.51 22.75 32.67 16 DKIM_VALID_EF 99141 32.07 36.82 29.86 17 HTML_FONT_LOW_CONTRAST 91251 30.23 36.12 27.48 18 FVGT_m_MULTI_ODD 86698 28.69 34.23 26.11 19 LOC_TINY_FONT_1 75438 27.56 37.92 22.72 20 XMSubLong 74287 22.07 21.44 22.37 21 T_KAM_HTML_FONT_INVALID 63704 22.71 30.27 19.18 22 XM_B_SpammyWords2 63147 25.31 38.80 19.02 23 MIME_HTML_ONLY 63125 22.26 29.21 19.01 24 RCVD_IN_MSPIKE_WL 61230 17.30 14.85 18.44 25 ALL_TRUSTED 56425 12.09 1.60 16.99 26 USER_IN_DEF_DKIM_WL 42666 9.81 3.30 12.85 27 RCVD_IN_MSPIKE_H3 39662 12.08 12.36 11.94 28 XM_Multi_Part_URI 39650 14.14 18.84 11.94 29 XM_Body_Dirty_Words 38751 15.11 22.49 11.67 30 BAYES_00 31535 6.71 0.76 9.50 31 TooManyTo_001 30509 8.50 7.03 9.19 32 XM_DKIMWhitelistDomains 30385 6.25 0.05 9.15 33 UNPARSEABLE_RELAY 30026 9.44 10.31 9.04 34 BAYES_60 30004 8.71 8.01 9.04 35 LotsOfNums_01 26821 7.98 7.78 8.08 36 XM_B_Unsub 26126 10.14 15.00 7.87 37 XM_Evil_Numbers_Gen 25930 8.31 9.39 7.81 38 T_TooManySym_01 23607 5.64 2.49 7.11 39 IN_ZIMBRA_NJ_WHITELIST 22383 4.62 0.08 6.74 40 LOTS_OF_MONEY 22185 8.39 12.06 6.68 41 XM_DK_Undo_02 21423 18.76 45.12 6.45 42 TR_XM_BayesUnsub 21355 9.03 14.58 6.43 43 TR_XM_DK_Bayes 20450 4.37 0.53 6.16 44 TR_XM_DK_Bayes1 20032 4.28 0.52 6.03 45 HTML_IMAGE_RATIO_02 19859 6.08 6.28 5.98 46 XM_SendGrid 19229 5.77 5.73 5.79 47 RCVD_IN_MSPIKE_H4 17477 4.33 2.32 5.26 48 TR_XM_DK_Bayes2 17449 3.73 0.47 5.25 49 XMStrtUSub 17242 4.87 4.18 5.19 50 RCVD_IN_VALIDITY_SAFE 17075 4.67 3.67 5.14 51 XM_PDF 17047 3.89 1.22 5.13 52 XM_H_Long_From01 17002 5.05 4.90 5.12 53 BAYES_40 16959 3.90 1.32 5.11 54 BOTNET_IPINHOSTNAME 16690 7.58 13.05 5.03 55 MIME_QP_LONG_LINE 16248 4.30 3.02 4.89 56 RCVD_IN_IADB_LISTED 16007 3.94 2.05 4.82 57 BAYES_99 15988 14.24 34.43 4.81 58 FSL_BULK_SIG 15739 6.18 9.28 4.74 59 TR_XM_DKIM_Undo 15072 14.27 35.09 4.54 60 RCVD_IN_VALIDITY_CERTIFIED 15046 4.07 3.07 4.53 61 XM_B_SpammyWords3 15003 6.76 11.55 4.52 62 TR_XM_SpammyWords4 14957 6.43 10.54 4.50 63 XMNumbers 14795 4.21 3.70 4.46 64 T_TooManySym_02 14422 3.23 0.85 4.34 65 RCVD_IN_IADB_SPF 14260 3.49 1.75 4.29 66 BAYES_80 14094 5.68 8.77 4.24 67 MPART_ALT_DIFF 14000 5.38 7.86 4.22 68 HTML_IMAGE_RATIO_04 14000 4.12 3.90 4.22 69 XM_UncommonTLD01 13706 6.35 11.11 4.13 70 RELAYCOUNTRY_META 13086 9.08 20.09 3.94 71 BAYES_20 12888 2.98 1.07 3.88 72 T_REMOTE_IMAGE 12816 3.40 2.42 3.86 73 RCVD_IN_IADB_SENDERID 12737 3.14 1.65 3.84 74 TR_XM_DK_SendGrid 12723 3.78 3.66 3.83 75 BAYES_999 12550 10.91 26.17 3.78 76 RCVD_IN_IADB_DK 12294 3.05 1.67 3.70 77 XMSexyCombo_05 11203 5.36 9.60 3.37 78 HTML_IMAGE_RATIO_06 11151 3.40 3.48 3.36 79 DKIM_INVALID 10913 3.08 2.63 3.29 80 TR_XM_PhishingBody 10755 4.41 6.93 3.24 81 XMSubMetaSx_00 10237 4.10 6.27 3.08 82 RCVD_IN_IADB_VOUCHED 9891 2.37 1.06 2.98 83 XM_B_Phish_Phrases 9380 3.83 6.00 2.82 84 MAILING_LIST_MULTI 9213 2.41 1.63 2.77 85 BAYES_95 9043 3.62 5.55 2.72 86 TooManyTo_002 8449 1.96 0.70 2.54 87 MIME_HTML_MOSTLY 8445 3.21 4.63 2.54 88 URI_NOVOWEL 8314 2.63 2.90 2.50 89 MIME_HTML_ONLY_MULTI 8221 3.07 4.33 2.48 90 XM_SPF_SoftFail 8176 2.97 4.05 2.46 91 BAYES_05 7925 1.82 0.61 2.39 92 HTML_IMAGE_RATIO_08 7890 2.65 3.25 2.38 93 FROM_EXCESS_BASE64 7827 2.42 2.55 2.36 94 TR_XM_SB_Phish 7618 2.09 1.64 2.29 95 XMSubPhish11 7537 2.02 1.48 2.27 96 HTML_MIME_NO_HTML_TAG 7470 2.57 3.26 2.25 97 XM_B_SpammyTLD 6965 3.40 6.19 2.10 98 RCVD_IN_IADB_OPTIN 6933 1.61 0.60 2.09 99 ANY_BOUNCE_MESSAGE 6823 1.79 1.24 2.05 100 BOUNCE_MESSAGE 6822 1.79 1.24 2.05 101 HELO_NODOT 6741 1.59 0.66 2.03 102 HELO_NO_DOMAIN 6739 1.59 0.66 2.03 103 INVALID_MSGID 6715 1.43 0.15 2.02 104 TVD_RCVD_IP 6609 1.44 0.27 1.99 105 XM_B_Phish66 6609 2.57 3.81 1.99 106 XM_CamelCaseFrm001 6292 1.93 2.01 1.89 107 MSGID_NOFQDN1 6255 1.29 0.03 1.88 108 IN_HORDE_ADDRESS_BOOK 6154 1.29 0.07 1.85 109 BOTNET 5972 4.23 9.43 1.80 110 TR_Symld_Words 5970 1.55 1.03 1.80 111 TO_MALFORMED 5942 1.23 0.03 1.79 112 KHOP_HELO_FCRDNS 5927 1.82 1.89 1.78 113 T_TooManySym_03 5905 1.33 0.36 1.78 114 TooManyTo_003 5662 1.35 0.60 1.71 115 TM2_M_URI_OPT_OUT 5620 1.96 2.55 1.69 116 XM_DK_Undo_01 5565 1.92 2.43 1.68 117 XMDiploma_00 5521 2.13 3.12 1.66 118 T_XMDrugObfuBody_08 5509 2.78 5.18 1.66 119 XM_B_Unsub2 5496 1.98 2.69 1.66 120 TR_XM_SpammyRelay 5469 5.92 15.07 1.65 121 SUBJ_ALL_CAPS 5468 1.74 1.93 1.65 122 TVD_SPACE_RATIO 5440 1.14 0.07 1.64 123 XM_B_Investor 5349 2.82 5.42 1.61 124 XM_GoogleGroups 5316 1.79 2.20 1.60 125 TR_XM_UnparsRelay 4951 2.95 6.08 1.49 126 TM2_M_VERY_LONG_WORD 4936 2.54 4.81 1.49 127 T_XMDrugObfuBody_14 4913 2.31 4.10 1.48 128 UNTRUSTED_Relay 4747 3.45 7.79 1.43 129 XMStockSpam_06 4714 1.52 1.73 1.42 130 TR_DCC_Bayes_99 4593 8.71 24.40 1.38 131 RELAYCOUNTRY_CA 4357 3.99 9.71 1.31 132 TooManyTo_004 4156 1.00 0.45 1.25 133 XMCapTrack 4100 0.98 0.43 1.23 134 TR_XM_SpammyWords5 4097 2.07 3.87 1.23 135 RCVD_IN_MSPIKE_H5 4091 0.89 0.17 1.23 136 XMBSHREFv2 3979 0.95 0.43 1.20 137 HTML_FONT_FACE_BAD 3977 1.04 0.69 1.20 138 TR_XM_Base64_M1 3948 1.26 1.40 1.19 139 URI_HEX 3788 1.43 2.04 1.14 140 XM_H_Trusted_IP 3777 0.78 0.00 1.14 141 XMGappySubj_01 3720 0.83 0.20 1.12 142 RCVD_IN_RP_SAFE 3499 0.95 0.72 1.05 143 XM_OfRef6 3495 1.69 3.04 1.05 144 TooManyTo_005 3463 0.84 0.41 1.04 145 XMHTML_After_End 3377 1.10 1.28 1.02 146 XMBdyGiftCard01 3337 1.23 1.70 1.00 147 DKIM_ADSP_CUSTOM_MED 3247 0.92 0.80 0.98 148 T_FILL_THIS_FORM_SHORT 3190 1.88 3.85 0.96 149 XMBody_17 3187 2.15 4.71 0.96 150 HTTPS_HTTP_MISMATCH 3162 1.17 1.64 0.95 151 XM_UB50 3126 1.75 3.48 0.94 152 SpammyFromTLD_01 3094 1.40 2.40 0.93 153 RCVD_IN_RP_CERTIFIED 3079 0.82 0.58 0.93 154 XM_B_SpammyWords4 3070 1.31 2.13 0.92 155 XMBody_95 3006 0.66 0.13 0.91 156 FVGT_m_MULTI_ODD_EMAIL 2964 0.66 0.15 0.89 157 XM_H_Long_From02 2873 0.98 1.21 0.87 158 XMLngstWrd_00 2805 1.30 2.27 0.84 159 TR_XM_SpammyWords2 2792 4.33 11.81 0.84 160 XMGenDplmaNmb 2713 1.00 1.40 0.82 161 XMBrknScrpt_02 2574 0.97 1.38 0.78 162 XMLngstWrd_01 2538 1.24 2.24 0.76 163 FROM_GOV_DKIM_AU 2456 0.54 0.11 0.74 164 XM_H_PHPMailer 2403 0.74 0.76 0.72 165 HTML_TAG_BALANCE_BODY 2323 0.92 1.38 0.70 166 T_XMDrugObfuBody_00 2319 1.03 1.75 0.70 167 XM_ShortIntro_01 2263 0.68 0.66 0.68 168 HTML_IMAGE_ONLY_20 2203 0.62 0.52 0.66 169 XMLngstWrd_02 2197 1.14 2.17 0.66 170 NML_ADSP_CUSTOM_MED 2124 0.64 0.65 0.64 171 T_OBFU_PDF_ATTACH 2116 0.47 0.11 0.64 172 XMPhish30 2034 0.81 1.22 0.61 173 XMNoVowels 2004 0.51 0.31 0.60 174 TR_MetaPhish_Combo_01 1972 0.66 0.81 0.59 175 DKIM_ADSP_NXDOMAIN 1960 0.68 0.86 0.59 176 XM_B_COPY_HTML 1959 0.61 0.65 0.59 177 SHORT_HELO_AND_INLINE_IMAGE 1948 0.46 0.18 0.59 178 XMLngstWrd_03 1935 1.01 1.91 0.58 179 XMSubMetaI_00 1916 0.71 0.98 0.58 180 URI_TRY_3LD 1905 0.68 0.92 0.57 181 MPART_ALT_DIFF_COUNT 1836 0.70 1.02 0.55 182 XMhairloss01 1805 0.39 0.07 0.54 183 XMMoneyMeta_00 1800 0.58 0.66 0.54 184 FORGED_GMAIL_RCVD 1770 0.58 0.67 0.53 185 T_MANY_PILL_PRICE 1767 0.36 0.00 0.53 186 T_Symld_Words_02 1749 0.63 0.86 0.53 187 XMLngstWrd_04 1701 0.93 1.82 0.51 188 XM_ProductURIs 1699 0.64 0.92 0.51 189 RCVD_IN_SORBS_DUL 1692 0.42 0.22 0.51 190 MISSING_HEADERS 1677 0.49 0.44 0.51 191 XMSubMetaSxObfu_02 1656 0.50 0.51 0.50 192 HTML_IMAGE_ONLY_32 1652 0.43 0.27 0.50 193 XMOemUri 1648 0.46 0.38 0.50 194 HTML_IMAGE_ONLY_28 1633 0.42 0.26 0.49 195 T_XMHurry_00 1619 0.88 1.71 0.49 196 RELAYCOUNTRY_GB 1597 0.51 0.57 0.48 197 XMSubNoVowel 1563 0.42 0.32 0.47 198 TR_MSPIKEBAYES00 1482 0.31 0.01 0.45 199 RCVD_IN_MSPIKE_BL 1447 1.39 3.45 0.44 200 TR_XM_MSPIKECOMBO 1445 1.39 3.43 0.44 ----------------------------------------------------------------------