Email: 637792 Autolearn: 0 AvgScore: 4.39 AvgScanTime: 1.52 sec Spam: 212530 Autolearn: 0 AvgScore: 13.20 AvgScanTime: 1.65 sec Ham: 425262 Autolearn: 0 AvgScore: -0.02 AvgScanTime: 1.45 sec Time Spent Running SA: 268.95 hours Time Spent Processing Spam: 97.26 hours Time Spent Processing Ham: 171.69 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 205899 90.69 96.88 87.60 2 DKIM_SIGNED 200062 82.82 94.13 77.17 3 XM_DK_Pass 196028 80.98 92.24 75.36 4 DKIM_VALID 194581 80.18 91.55 74.50 5 XM_B_Unicode 179741 75.26 84.57 70.61 6 RELAYCOUNTRY_US 177239 81.85 83.39 81.07 7 XMListUnsubscribeExists 162419 60.61 76.42 52.72 8 DCC_CHECK 151776 47.25 71.41 35.17 9 XM_B_SpammyWords 148134 53.85 69.70 45.93 10 DKIM_VALID_AU 146483 61.94 68.92 58.44 11 RCVD_IN_MSPIKE_H2 114574 45.89 53.91 41.89 12 XM_DK_Undo_02 98447 19.80 46.32 6.54 13 XM_B_Unicode3 93615 41.22 44.05 39.81 14 BAYES_50 88653 52.22 41.71 57.46 15 FVGT_m_MULTI_ODD 88578 32.21 41.68 27.48 16 LOC_TINY_FONT_1 86092 30.50 40.51 25.51 17 XM_B_SpammyWords2 80914 25.56 38.07 19.30 18 TR_XM_DKIM_Undo 75157 14.84 35.36 4.58 19 HTML_FONT_LOW_CONTRAST 74494 30.98 35.05 28.94 20 DKIM_VALID_EF 72020 29.98 33.89 28.03 21 BAYES_99 70733 14.24 33.28 4.73 22 MIME_HTML_ONLY 65226 22.95 30.69 19.08 23 T_KAM_HTML_FONT_INVALID 65210 24.06 30.68 20.75 24 DCC_CHECK_NEGATIVE 60720 52.72 28.57 64.79 25 BAYES_999 54885 11.01 25.82 3.61 26 TR_DCC_Bayes_99 52108 9.33 24.52 1.74 27 T_TM2_M_HEADER_IN_MSG 45160 25.23 21.25 27.22 28 XM_Body_Dirty_Words 44865 13.89 21.11 10.29 29 XMSubLong 43827 20.13 20.62 19.89 30 RELAYCOUNTRY_META 40001 8.95 18.82 4.01 31 XM_Multi_Part_URI 39307 14.48 18.49 12.48 32 LOTS_OF_MONEY 35611 11.09 16.76 8.26 33 RCVD_IN_MSPIKE_WL 35448 18.15 16.68 18.88 34 XM_B_Unsub 31570 10.53 14.85 8.37 35 UNPARSEABLE_RELAY 31221 11.40 14.69 9.76 36 TR_XM_SpammyWords4 30698 8.15 14.44 5.00 37 BOTNET_IPINHOSTNAME 30673 8.17 14.43 5.05 38 TR_XM_BayesUnsub 30583 9.51 14.39 7.08 39 RCVD_IN_MSPIKE_H3 28364 12.40 13.35 11.92 40 TR_XM_SpammyRelay 28302 5.59 13.32 1.73 41 XM_B_SpammyWords3 24895 6.50 11.71 3.89 42 RCVD_IN_BL_SPAMCOP_NET 24069 4.15 11.32 0.57 43 TR_XM_SpammyWords2 24032 4.34 11.31 0.86 44 XM_Evil_Numbers_Gen 23233 8.98 10.93 8.00 45 TR_XM_SPAMCOP 21715 3.68 10.22 0.41 46 RELAYCOUNTRY_CA 20924 4.06 9.85 1.17 47 MPART_ALT_DIFF 19389 6.92 9.12 5.81 48 TR_XM_UnparsRelay 18924 4.27 8.90 1.96 49 XMSexyCombo_05 18838 4.70 8.86 2.61 50 BAYES_80 18118 6.33 8.52 5.24 51 FSL_BULK_SIG 17396 4.92 8.19 3.29 52 BOTNET 16765 3.72 7.89 1.63 53 XM_UncommonTLD01 16742 5.51 7.88 4.33 54 BAYES_60 15824 9.26 7.45 10.16 55 LotsOfNums_01 15624 8.75 7.35 9.45 56 TM2_M_VERY_LONG_WORD 14571 3.53 6.86 1.87 57 XM_SendGrid 14511 5.88 6.83 5.41 58 MIME_HTML_ONLY_MULTI 13884 3.99 6.53 2.73 59 HTML_IMAGE_RATIO_02 13738 6.20 6.46 6.06 60 TR_LOTS_OF_MONEY3 13598 3.69 6.40 2.34 61 TR_XM_PhishingBody 13425 4.69 6.32 3.87 62 XM_B_Phish_Phrases 12978 4.51 6.11 3.72 63 XM_H_Long_From01 12265 5.62 5.77 5.55 64 HTML_MIME_NO_HTML_TAG 11931 3.46 5.61 2.38 65 UNTRUSTED_Relay 10902 2.65 5.13 1.41 66 BAYES_95 10625 3.76 5.00 3.14 67 XM_GoogleGroups 10361 3.14 4.88 2.27 68 XM_B_SpammyTLD 10264 3.13 4.83 2.28 69 XMLngstWrd_00 10015 2.52 4.71 1.43 70 XMLngstWrd_01 9961 2.46 4.69 1.35 71 XMStrtUSub 9894 4.99 4.66 5.16 72 XMLngstWrd_02 9791 2.35 4.61 1.22 73 XM_B_Investor 9756 2.58 4.59 1.57 74 HTML_IMAGE_RATIO_04 9735 4.57 4.58 4.57 75 TR_XM_SpammyWords5 9720 2.66 4.57 1.70 76 XMLngstWrd_03 9587 2.20 4.51 1.05 77 XMSubMetaSx_00 9531 3.41 4.48 2.87 78 XMLngstWrd_04 9493 2.13 4.47 0.96 79 TR_XM_DK_SendGrid 9230 3.86 4.34 3.62 80 HTML_TITLE_SUBJ_DIFF 8980 1.84 4.23 0.65 81 UPPERCASE_75_100 8867 1.82 4.17 0.64 82 TooManyTo_001 8804 6.55 4.14 7.75 83 XM_B_Phish66 8341 2.65 3.92 2.02 84 T_XMDrugObfuBody_08 8334 2.36 3.92 1.58 85 MIME_QP_LONG_LINE 8291 5.13 3.90 5.75 86 HTML_IMAGE_RATIO_06 8285 4.08 3.90 4.17 87 XMNumbers 8197 3.76 3.86 3.72 88 XMBody_17 8173 1.63 3.85 0.53 89 XM_DIRTYINTL 8061 1.47 3.79 0.31 90 T_XMHurry_00 7931 1.97 3.73 1.09 91 MIME_HTML_MOSTLY 7528 3.62 3.54 3.65 92 T_FILL_THIS_FORM_SHORT 7427 1.68 3.49 0.78 93 XM_SPF_SoftFail 7212 2.37 3.39 1.85 94 XM_OfRef6 6968 1.68 3.28 0.87 95 RCVD_IN_VALIDITY_SAFE 6811 4.53 3.20 5.20 96 HTML_IMAGE_RATIO_08 6799 2.80 3.20 2.61 97 SUBJ_ALL_CAPS 6508 2.39 3.06 2.05 98 SpammyFromTLD_01 6494 2.13 3.06 1.67 99 T_XMDrugObfuBody_14 6461 1.90 3.04 1.34 100 RCVD_IN_MSPIKE_H4 6343 4.79 2.98 5.69 101 SpammyFromTLD_02 6146 1.28 2.89 0.48 102 TM2_M_URI_OPT_OUT 6130 2.22 2.88 1.89 103 USER_IN_DEF_DKIM_WL 5888 8.90 2.77 11.97 104 XM_UB50 5783 1.52 2.72 0.92 105 RCVD_IN_MSPIKE_BL 5744 1.22 2.70 0.48 106 TR_XM_MSPIKECOMBO 5664 1.21 2.67 0.48 107 DKIM_INVALID 5481 2.64 2.58 2.67 108 RCVD_IN_VALIDITY_CERTIFIED 5374 3.82 2.53 4.46 109 XM_B_Unsub2 4925 1.98 2.32 1.81 110 URIBL_DBL_SPAM 4810 0.76 2.26 0.01 111 MAILING_LIST_MULTI 4786 3.07 2.25 3.48 112 FROM_EXCESS_BASE64 4746 2.42 2.23 2.51 113 TR_XM_SpammyWords3 4725 0.92 2.22 0.27 114 XMDiploma_00 4694 1.76 2.21 1.53 115 FONT_INVIS_LONG_LINE 4675 0.79 2.20 0.08 116 XM_CamelCaseFrm001 4657 2.18 2.19 2.18 117 T_REMOTE_IMAGE 4652 3.72 2.19 4.49 118 XMBrknScrpt_02 4611 1.26 2.17 0.81 119 HK_RANDOM_REPLYTO 4606 0.79 2.17 0.10 120 URI_HEX 4506 1.54 2.12 1.24 121 XM_B_SpammyWords4 4394 1.06 2.07 0.55 122 RCVD_IN_IADB_LISTED 4359 4.40 2.05 5.58 123 T_TooManySym_01 4244 4.77 2.00 6.16 124 XM_DK_Undo_01 4041 1.59 1.90 1.43 125 RCVD_IN_IADB_SPF 3927 3.93 1.85 4.97 126 PDS_OTHER_BAD_TLD 3911 0.75 1.84 0.20 127 URI_NOVOWEL 3828 2.25 1.80 2.48 128 RCVD_IN_IADB_DK 3795 3.50 1.79 4.36 129 TR_XM_NoHeaderRelay 3785 0.68 1.78 0.14 130 RCVD_IN_IADB_SENDERID 3764 3.60 1.77 4.51 131 URI_PHP_REDIR 3743 0.59 1.76 0.00 132 RCVD_IN_MSPIKE_L5 3683 0.60 1.73 0.04 133 XM_B_COVIDMETA 3672 0.92 1.73 0.52 134 TR_XM_FormFill 3633 0.58 1.71 0.01 135 HTTPS_HTTP_MISMATCH 3625 1.13 1.71 0.84 136 XMStockSpam_06 3585 1.12 1.69 0.84 137 T_XMDrugObfuBody_00 3534 1.14 1.66 0.89 138 TR_XM_SB_Phish 3329 2.08 1.57 2.34 139 XMSexyCombo_01 3311 0.87 1.56 0.52 140 XM_URI_RBL 3273 0.60 1.54 0.13 141 MPART_ALT_DIFF_COUNT 3257 0.91 1.53 0.60 142 BAYES_40 3178 3.51 1.50 4.52 143 XMSubPhish11 3059 2.02 1.44 2.31 144 TR_XM_PHPDW 2993 0.97 1.41 0.75 145 RELAYCOUNTRY_AU 2945 0.69 1.39 0.34 146 TR_XM_PHPForged 2908 0.94 1.37 0.72 147 REMOVE_BEFORE_LINK 2897 0.61 1.36 0.24 148 TR_XM_BayesRelay 2859 0.45 1.35 0.00 149 XMSubMetaI_00 2852 0.95 1.34 0.75 150 TR_XM_FormFill2 2845 0.93 1.34 0.72 151 XM_H_PHPOS 2827 0.92 1.33 0.71 152 XMGenDplmaNmb 2781 0.93 1.31 0.74 153 URIBL_BLACK 2750 0.48 1.29 0.07 154 TR_XM_Base64_M1 2671 1.09 1.26 1.00 155 HTML_TAG_BALANCE_BODY 2666 0.85 1.25 0.65 156 XM_H_Undi_Recip 2646 0.55 1.25 0.21 157 XMBdyGiftCard01 2642 1.07 1.24 0.99 158 ALL_TRUSTED 2611 11.02 1.23 15.91 159 XM_B_DNDMA 2436 0.56 1.15 0.27 160 XMHTML_After_End 2389 0.96 1.12 0.88 161 BAYES_20 2317 2.58 1.09 3.32 162 TR_Caps_n_Bayes_99 2278 0.40 1.07 0.07 163 XMClaimOffer 2278 0.47 1.07 0.17 164 URI_TRY_3LD 2197 0.76 1.03 0.63 165 XMReplyNow 2185 0.49 1.03 0.22 166 XMPhish30 2102 0.93 0.99 0.90 167 RCVD_IN_VALIDITY_RPBL 2073 0.37 0.98 0.07 168 TR_XM_Undi_Recip5 2014 0.32 0.95 0.00 169 TM2_M_A_HREF_HREF 2005 0.51 0.94 0.29 170 TR_XM_COVIDMETA1 1945 0.41 0.92 0.16 171 T_Symld_Words_02 1943 0.68 0.91 0.57 172 TR_XM_Undi_Recip11 1938 0.33 0.91 0.05 173 TR_LOTS_OF_MONEY2 1931 0.51 0.91 0.30 174 T_MONEY_PERCENT 1931 0.51 0.91 0.30 175 KHOP_HELO_FCRDNS 1914 0.95 0.90 0.98 176 THIS_AD 1899 0.51 0.89 0.32 177 TR_MetaPhish_Combo_01 1897 0.75 0.89 0.68 178 XM_H_Long_From02 1859 1.07 0.87 1.17 179 UNDISC_MONEY 1854 0.29 0.87 0.00 180 TR_Symld_Words 1851 1.16 0.87 1.30 181 TR_XM_InvalidRelay 1804 0.30 0.85 0.02 182 BAYES_00 1797 6.53 0.85 9.36 183 RCVD_IN_IADB_VOUCHED 1784 2.53 0.84 3.38 184 XM_ProductURIs 1781 0.64 0.84 0.54 185 TR_XM_COVIDMETA4 1745 0.37 0.82 0.14 186 SHOPIFY_IMG_NOT_RCVD_SFY 1690 0.39 0.80 0.19 187 RELAYCOUNTRY_FR 1681 0.45 0.79 0.28 188 TR_XM_Undi_RecipCombo2 1675 0.26 0.79 0.00 189 HTML_FONT_FACE_BAD 1671 0.90 0.79 0.96 190 RCVD_IN_MSPIKE_L3 1663 0.55 0.78 0.43 191 XM_B_SEO 1661 0.38 0.78 0.18 192 TR_XM_Base64_L1 1642 0.58 0.77 0.48 193 TR_XM_Spammywords 1625 0.38 0.76 0.18 194 XM_S_SpammyWords 1625 0.38 0.76 0.18 195 XM_UB99 1611 0.26 0.76 0.01 196 LONGLN_LOW_CONTRAST 1602 0.50 0.75 0.37 197 BOTNET_NORDNS 1580 0.25 0.74 0.01 198 XM_Body_Dirty_Words_01 1569 0.32 0.74 0.12 199 TR_XM_Undi_Recip2 1557 0.27 0.73 0.03 200 RELAYCOUNTRY_IN 1531 0.29 0.72 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 372524 90.69 96.88 87.60 2 RELAYCOUNTRY_US 344763 81.85 83.39 81.07 3 DKIM_SIGNED 328176 82.82 94.13 77.17 4 XM_DK_Pass 320470 80.98 92.24 75.36 5 DKIM_VALID 316823 80.18 91.55 74.50 6 XM_B_Unicode 300260 75.26 84.57 70.61 7 DCC_CHECK_NEGATIVE 275518 52.72 28.57 64.79 8 DKIM_VALID_AU 248542 61.94 68.92 58.44 9 BAYES_50 244371 52.22 41.71 57.46 10 XMListUnsubscribeExists 224177 60.61 76.42 52.72 11 XM_B_SpammyWords 195333 53.85 69.70 45.93 12 RCVD_IN_MSPIKE_H2 178130 45.89 53.91 41.89 13 XM_B_Unicode3 169295 41.22 44.05 39.81 14 DCC_CHECK 149556 47.25 71.41 35.17 15 HTML_FONT_LOW_CONTRAST 123081 30.98 35.05 28.94 16 DKIM_VALID_EF 119180 29.98 33.89 28.03 17 FVGT_m_MULTI_ODD 116862 32.21 41.68 27.48 18 T_TM2_M_HEADER_IN_MSG 115748 25.23 21.25 27.22 19 LOC_TINY_FONT_1 108465 30.50 40.51 25.51 20 T_KAM_HTML_FONT_INVALID 88263 24.06 30.68 20.75 21 XMSubLong 84571 20.13 20.62 19.89 22 XM_B_SpammyWords2 82075 25.56 38.07 19.30 23 MIME_HTML_ONLY 81124 22.95 30.69 19.08 24 RCVD_IN_MSPIKE_WL 80310 18.15 16.68 18.88 25 ALL_TRUSTED 67680 11.02 1.23 15.91 26 XM_Multi_Part_URI 53058 14.48 18.49 12.48 27 USER_IN_DEF_DKIM_WL 50904 8.90 2.77 11.97 28 RCVD_IN_MSPIKE_H3 50692 12.40 13.35 11.92 29 XM_Body_Dirty_Words 43739 13.89 21.11 10.29 30 BAYES_60 43216 9.26 7.45 10.16 31 UNPARSEABLE_RELAY 41488 11.40 14.69 9.76 32 LotsOfNums_01 40175 8.75 7.35 9.45 33 BAYES_00 39823 6.53 0.85 9.36 34 XM_B_Unsub 35608 10.53 14.85 8.37 35 LOTS_OF_MONEY 35110 11.09 16.76 8.26 36 XM_DKIMWhitelistDomains 34880 5.50 0.09 8.20 37 XM_Evil_Numbers_Gen 34013 8.98 10.93 8.00 38 TooManyTo_001 32968 6.55 4.14 7.75 39 TR_XM_BayesUnsub 30099 9.51 14.39 7.08 40 IN_ZIMBRA_NJ_WHITELIST 28824 4.55 0.09 6.78 41 XM_DK_Undo_02 27815 19.80 46.32 6.54 42 TR_XM_DK_Bayes 26304 4.34 0.65 6.19 43 T_TooManySym_01 26200 4.77 2.00 6.16 44 TR_XM_DK_Bayes1 25903 4.28 0.65 6.09 45 HTML_IMAGE_RATIO_02 25790 6.20 6.46 6.06 46 MPART_ALT_DIFF 24727 6.92 9.12 5.81 47 MIME_QP_LONG_LINE 24455 5.13 3.90 5.75 48 RCVD_IN_MSPIKE_H4 24196 4.79 2.98 5.69 49 RCVD_IN_IADB_LISTED 23718 4.40 2.05 5.58 50 XM_H_Long_From01 23606 5.62 5.77 5.55 51 XM_SendGrid 23010 5.88 6.83 5.41 52 BAYES_80 22282 6.33 8.52 5.24 53 RCVD_IN_VALIDITY_SAFE 22104 4.53 3.20 5.20 54 XMStrtUSub 21923 4.99 4.66 5.16 55 TR_XM_DK_Bayes2 21854 3.61 0.55 5.14 56 BOTNET_IPINHOSTNAME 21464 8.17 14.43 5.05 57 TR_XM_SpammyWords4 21273 8.15 14.44 5.00 58 XM_PDF 21217 3.52 0.59 4.99 59 RCVD_IN_IADB_SPF 21146 3.93 1.85 4.97 60 BAYES_99 20101 14.24 33.28 4.73 61 TR_XM_DKIM_Undo 19464 14.84 35.36 4.58 62 HTML_IMAGE_RATIO_04 19414 4.57 4.58 4.57 63 BAYES_40 19209 3.51 1.50 4.52 64 RCVD_IN_IADB_SENDERID 19171 3.60 1.77 4.51 65 T_REMOTE_IMAGE 19080 3.72 2.19 4.49 66 RCVD_IN_VALIDITY_CERTIFIED 18979 3.82 2.53 4.46 67 RCVD_IN_IADB_DK 18547 3.50 1.79 4.36 68 XM_UncommonTLD01 18426 5.51 7.88 4.33 69 HTML_IMAGE_RATIO_06 17721 4.08 3.90 4.17 70 RELAYCOUNTRY_META 17071 8.95 18.82 4.01 71 XM_B_SpammyWords3 16542 6.50 11.71 3.89 72 TR_XM_PhishingBody 16475 4.69 6.32 3.87 73 XM_B_Phish_Phrases 15807 4.51 6.11 3.72 74 XMNumbers 15805 3.76 3.86 3.72 75 MIME_HTML_MOSTLY 15531 3.62 3.54 3.65 76 TR_XM_DK_SendGrid 15406 3.86 4.34 3.62 77 BAYES_999 15363 11.01 25.82 3.61 78 MAILING_LIST_MULTI 14799 3.07 2.25 3.48 79 T_TooManySym_02 14650 2.47 0.53 3.44 80 RCVD_IN_IADB_VOUCHED 14369 2.53 0.84 3.38 81 BAYES_20 14127 2.58 1.09 3.32 82 FSL_BULK_SIG 13983 4.92 8.19 3.29 83 BAYES_95 13368 3.76 5.00 3.14 84 XMSubMetaSx_00 12190 3.41 4.48 2.87 85 MIME_HTML_ONLY_MULTI 11591 3.99 6.53 2.73 86 DKIM_INVALID 11353 2.64 2.58 2.67 87 XMSexyCombo_05 11115 4.70 8.86 2.61 88 HTML_IMAGE_RATIO_08 11081 2.80 3.20 2.61 89 FROM_EXCESS_BASE64 10666 2.42 2.23 2.51 90 URI_NOVOWEL 10553 2.25 1.80 2.48 91 HTML_MIME_NO_HTML_TAG 10142 3.46 5.61 2.38 92 TR_XM_SB_Phish 9961 2.08 1.57 2.34 93 TR_LOTS_OF_MONEY3 9944 3.69 6.40 2.34 94 XMSubPhish11 9821 2.02 1.44 2.31 95 XM_B_SpammyTLD 9704 3.13 4.83 2.28 96 XM_GoogleGroups 9659 3.14 4.88 2.27 97 RCVD_IN_IADB_OPTIN 9500 1.64 0.45 2.23 98 XM_CamelCaseFrm001 9261 2.18 2.19 2.18 99 BAYES_05 8762 1.57 0.60 2.06 100 SUBJ_ALL_CAPS 8704 2.39 3.06 2.05 101 XM_B_Phish66 8590 2.65 3.92 2.02 102 ANY_BOUNCE_MESSAGE 8413 1.49 0.50 1.98 103 BOUNCE_MESSAGE 8411 1.49 0.50 1.98 104 TR_XM_UnparsRelay 8314 4.27 8.90 1.96 105 TooManyTo_002 8222 1.48 0.57 1.93 106 TM2_M_URI_OPT_OUT 8044 2.22 2.88 1.89 107 TM2_M_VERY_LONG_WORD 7944 3.53 6.86 1.87 108 XM_SPF_SoftFail 7884 2.37 3.39 1.85 109 XM_B_Unsub2 7703 1.98 2.32 1.81 110 IN_HORDE_ADDRESS_BOOK 7644 1.22 0.08 1.80 111 TR_DCC_Bayes_99 7403 9.33 24.52 1.74 112 TR_XM_SpammyRelay 7364 5.59 13.32 1.73 113 TR_XM_SpammyWords5 7250 2.66 4.57 1.70 114 SpammyFromTLD_01 7118 2.13 3.06 1.67 115 INVALID_MSGID 7082 1.15 0.11 1.67 116 BOTNET 6945 3.72 7.89 1.63 117 T_XMDrugObfuBody_08 6722 2.36 3.92 1.58 118 XM_B_Investor 6695 2.58 4.59 1.57 119 MSGID_NOFQDN1 6560 1.04 0.03 1.54 120 XMDiploma_00 6512 1.76 2.21 1.53 121 HELO_NODOT 6409 1.16 0.46 1.51 122 HELO_NO_DOMAIN 6401 1.16 0.46 1.51 123 XM_DK_Undo_01 6098 1.59 1.90 1.43 124 XMLngstWrd_00 6085 2.52 4.71 1.43 125 XM_H_Trusted_IP 6074 0.95 0.00 1.43 126 TO_MALFORMED 6036 0.95 0.01 1.42 127 UNTRUSTED_Relay 6011 2.65 5.13 1.41 128 T_TooManySym_03 5804 1.00 0.26 1.36 129 XMLngstWrd_01 5752 2.46 4.69 1.35 130 TVD_RCVD_IP 5749 0.96 0.18 1.35 131 T_XMDrugObfuBody_14 5688 1.90 3.04 1.34 132 TR_Symld_Words 5526 1.16 0.87 1.30 133 TooManyTo_003 5520 1.02 0.47 1.30 134 TVD_SPACE_RATIO 5485 0.88 0.05 1.29 135 RCVD_IN_MSPIKE_H5 5422 0.97 0.35 1.27 136 MISSING_MIMEOLE 5395 0.89 0.13 1.27 137 HTML_OBFUSCATE_20_30 5395 0.89 0.13 1.27 138 URI_HEX 5294 1.54 2.12 1.24 139 XMLngstWrd_02 5173 2.35 4.61 1.22 140 XMBSHREFv2 5059 0.97 0.53 1.19 141 XM_H_Long_From02 4982 1.07 0.87 1.17 142 RELAYCOUNTRY_CA 4971 4.06 9.85 1.17 143 XMBody_95 4656 0.77 0.11 1.09 144 T_XMHurry_00 4626 1.97 3.73 1.09 145 XMGappySubj_01 4503 0.75 0.14 1.06 146 XMLngstWrd_03 4458 2.20 4.51 1.05 147 XMCapTrack 4446 0.78 0.25 1.05 148 RCVD_IN_RP_SAFE 4317 0.92 0.72 1.02 149 TR_XM_Base64_M1 4256 1.09 1.26 1.00 150 XMBdyGiftCard01 4213 1.07 1.24 0.99 151 KHOP_HELO_FCRDNS 4168 0.95 0.90 0.98 152 XMLngstWrd_04 4070 2.13 4.47 0.96 153 HTML_FONT_FACE_BAD 4070 0.90 0.79 0.96 154 TooManyTo_004 3996 0.76 0.40 0.94 155 XM_UB50 3903 1.52 2.72 0.92 156 XMPhish30 3817 0.93 0.99 0.90 157 RCVD_IN_RP_CERTIFIED 3810 0.78 0.53 0.90 158 T_XMDrugObfuBody_00 3767 1.14 1.66 0.89 159 XMHTML_After_End 3747 0.96 1.12 0.88 160 XM_OfRef6 3719 1.68 3.28 0.87 161 TR_XM_SpammyWords2 3640 4.34 11.31 0.86 162 DKIM_ADSP_CUSTOM_MED 3616 0.76 0.59 0.85 163 XMStockSpam_06 3574 1.12 1.69 0.84 164 HTTPS_HTTP_MISMATCH 3553 1.13 1.71 0.84 165 XMBrknScrpt_02 3454 1.26 2.17 0.81 166 FROM_GOV_DKIM_AU 3375 0.62 0.27 0.79 167 T_FILL_THIS_FORM_SHORT 3296 1.68 3.49 0.78 168 URI_TRUNCATED 3228 0.54 0.11 0.76 169 XMSubMetaI_00 3196 0.95 1.34 0.75 170 TR_XM_PHPDW 3187 0.97 1.41 0.75 171 TooManyTo_005 3170 0.62 0.37 0.75 172 XMGenDplmaNmb 3153 0.93 1.31 0.74 173 TR_XM_PHPForged 3064 0.94 1.37 0.72 174 TR_XM_FormFill2 3063 0.93 1.34 0.72 175 XM_H_PHPOS 3022 0.92 1.33 0.71 176 FVGT_m_MULTI_ODD_EMAIL 3001 0.52 0.14 0.71 177 T_HTML_ATTACH 2938 0.48 0.05 0.69 178 TR_MetaPhish_Combo_01 2898 0.75 0.89 0.68 179 TO_NO_BRKTS_FROM_MSSP 2889 0.49 0.10 0.68 180 XMSubNoVowel 2846 0.55 0.33 0.67 181 FROM_MISSPACED 2793 0.44 0.01 0.66 182 HTML_TAG_BALANCE_BODY 2784 0.85 1.25 0.65 183 HTML_TITLE_SUBJ_DIFF 2780 1.84 4.23 0.65 184 UPPERCASE_75_100 2733 1.82 4.17 0.64 185 XM_ShortIntro_01 2730 0.53 0.29 0.64 186 TVD_PH_BODY_ACCOUNTS_PRE 2696 0.48 0.17 0.63 187 URI_TRY_3LD 2665 0.76 1.03 0.63 188 T_OBFU_PDF_ATTACH 2624 0.45 0.10 0.62 189 MPART_ALT_DIFF_COUNT 2566 0.91 1.53 0.60 190 RELAYCOUNTRY_GB 2467 0.61 0.67 0.58 191 XM_B_COPY_HTML 2444 0.61 0.69 0.57 192 RCVD_IN_BL_SPAMCOP_NET 2428 4.15 11.32 0.57 193 T_Symld_Words_02 2408 0.68 0.91 0.57 194 XM_B_SpammyWords4 2355 1.06 2.07 0.55 195 XM_ProductURIs 2308 0.64 0.84 0.54 196 XM_H_PHPMailer 2292 0.55 0.57 0.54 197 XMBody_17 2246 1.63 3.85 0.53 198 FORGED_GMAIL_RCVD 2227 0.52 0.51 0.52 199 XMNoVowels 2222 0.47 0.37 0.52 200 XMSexyCombo_01 2215 0.87 1.56 0.52 ----------------------------------------------------------------------