Email: 296123 Autolearn: 0 AvgScore: 4.14 AvgScanTime: 1.28 sec Spam: 102948 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.29 sec Ham: 193175 Autolearn: 0 AvgScore: -1.08 AvgScanTime: 1.27 sec Time Spent Running SA: 104.92 hours Time Spent Processing Spam: 36.98 hours Time Spent Processing Ham: 67.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96614 87.13 93.85 83.56 2 DKIM_SIGNED 94579 84.53 91.87 80.62 3 XM_DK_Pass 93278 82.56 90.61 78.27 4 DKIM_VALID 91931 81.72 89.30 77.68 5 XM_B_Unicode 87185 77.06 84.69 73.00 6 RELAYCOUNTRY_US 80049 79.99 77.76 81.18 7 XMListUnsubscribeExists 77154 63.47 74.94 57.35 8 DCC_CHECK 76910 54.57 74.71 43.83 9 DKIM_VALID_AU 72730 68.47 70.65 67.31 10 XM_B_SpammyWords 71301 54.84 69.26 47.16 11 XM_DK_Undo_02 51272 22.34 49.80 7.70 12 RCVD_IN_MSPIKE_H2 49873 43.88 48.44 41.44 13 XM_B_Unicode3 49431 47.35 48.02 46.99 14 LOC_TINY_FONT_1 43325 35.95 42.08 32.68 15 BAYES_99 41361 17.89 40.18 6.02 16 XM_B_SpammyWords2 41203 27.43 40.02 20.72 17 TR_XM_DKIM_Undo 39143 16.42 38.02 4.90 18 HTML_FONT_LOW_CONTRAST 38492 34.45 37.39 32.88 19 DKIM_VALID_EF 38217 32.27 37.12 29.68 20 BAYES_50 35367 49.80 34.35 58.03 21 FVGT_m_MULTI_ODD 33443 29.03 32.49 27.19 22 BAYES_999 33009 14.34 32.06 4.89 23 MIME_HTML_ONLY 31679 25.60 30.77 22.84 24 TR_DCC_Bayes_99 30474 12.29 29.60 3.07 25 T_KAM_HTML_FONT_INVALID 28761 23.13 27.94 20.56 26 DCC_CHECK_NEGATIVE 26021 45.41 25.28 56.14 27 XM_Body_Dirty_Words 23255 16.59 22.59 13.39 28 XMSubLong 21592 22.88 20.97 23.89 29 RELAYCOUNTRY_META 21066 9.84 20.46 4.18 30 XM_Multi_Part_URI 19834 17.92 19.27 17.20 31 T_TM2_M_HEADER_IN_MSG 19417 20.35 18.86 21.14 32 RCVD_IN_MSPIKE_WL 16672 18.88 16.19 20.32 33 TR_XM_SpammyRelay 16337 6.80 15.87 1.96 34 XM_B_Unsub 14614 10.48 14.20 8.50 35 TR_XM_SpammyWords2 14385 5.91 13.97 1.61 36 TR_XM_BayesUnsub 14371 9.48 13.96 7.10 37 UNPARSEABLE_RELAY 14039 12.07 13.64 11.24 38 RCVD_IN_MSPIKE_H3 13105 12.15 12.73 11.84 39 RELAYCOUNTRY_CA 13034 5.38 12.66 1.50 40 XM_B_SpammyWords3 12851 8.39 12.48 6.20 41 BOTNET_IPINHOSTNAME 12625 7.94 12.26 5.63 42 XMSexyCombo_05 10323 6.83 10.03 5.12 43 XM_UncommonTLD01 10159 6.36 9.87 4.50 44 RCVD_IN_BL_SPAMCOP_NET 9875 3.61 9.59 0.42 45 LOTS_OF_MONEY 9534 6.79 9.26 5.48 46 FSL_BULK_SIG 9341 5.38 9.07 3.41 47 TR_XM_UnparsRelay 9212 4.75 8.95 2.51 48 TooManyTo_001 9061 7.60 8.80 6.95 49 XM_Evil_Numbers_Gen 9020 10.12 8.76 10.84 50 BAYES_80 9013 6.25 8.75 4.92 51 HTML_IMAGE_RATIO_02 8569 8.59 8.32 8.73 52 UNTRUSTED_Relay 8511 4.12 8.27 1.92 53 BOTNET 8376 3.91 8.14 1.66 54 TR_XM_SpammyWords4 8358 5.29 8.12 3.78 55 XM_B_SpammyTLD 8281 4.24 8.04 2.22 56 TR_XM_SPAMCOP 8113 2.88 7.88 0.21 57 BAYES_60 7795 10.08 7.57 11.41 58 XM_SendGrid 7188 6.85 6.98 6.78 59 LotsOfNums_01 6175 7.47 6.00 8.25 60 TR_XM_PhishingBody 6056 4.28 5.88 3.43 61 SpammyFromTLD_02 6050 2.19 5.88 0.23 62 RCVD_IN_VALIDITY_SAFE 5971 7.37 5.80 8.21 63 MPART_ALT_DIFF 5838 5.26 5.67 5.04 64 BAYES_95 5613 3.96 5.45 3.17 65 PDS_OTHER_BAD_TLD 5509 1.99 5.35 0.20 66 XMSubMetaSx_00 5468 4.00 5.31 3.31 67 XM_H_Long_From01 5249 4.95 5.10 4.87 68 XMStrtUSub 4939 6.18 4.80 6.92 69 XMBody_17 4861 2.02 4.72 0.58 70 TR_XM_SpammyWords5 4852 2.36 4.71 1.11 71 FROM_SUSPICIOUS_NTLD 4701 1.62 4.57 0.05 72 LongTLD 4681 1.67 4.55 0.14 73 RCVD_IN_VALIDITY_CERTIFIED 4609 6.12 4.48 7.00 74 TR_XM_DK_SendGrid 4608 4.64 4.48 4.72 75 FROM_SUSPICIOUS_NTLD_FP 4595 1.59 4.46 0.05 76 HTML_IMAGE_RATIO_04 4515 5.36 4.39 5.88 77 XM_B_Phish_Phrases 4397 3.67 4.27 3.35 78 XM_DIRTYINTL 4126 1.56 4.01 0.25 79 T_XMDrugObfuBody_08 3952 2.19 3.84 1.31 80 XM_OfRef6 3912 1.96 3.80 0.98 81 MIME_HTML_MOSTLY 3861 3.63 3.75 3.56 82 TM2_M_VERY_LONG_WORD 3853 2.30 3.74 1.54 83 HK_RANDOM_REPLYTO 3786 1.34 3.68 0.10 84 XM_UB99 3773 1.28 3.66 0.01 85 T_XMDrugObfuBody_14 3723 2.28 3.62 1.57 86 T_FILL_THIS_FORM_SHORT 3715 1.61 3.61 0.54 87 DATE_IN_PAST_06_12 3659 1.30 3.55 0.10 88 MIME_HTML_ONLY_MULTI 3546 2.89 3.44 2.60 89 HTML_IMAGE_RATIO_08 3539 3.22 3.44 3.11 90 HTML_IMAGE_RATIO_06 3515 4.73 3.41 5.44 91 XM_B_Investor 3439 2.02 3.34 1.31 92 XM_SPF_SoftFail 3420 1.94 3.32 1.21 93 USER_IN_DEF_DKIM_WL 3385 13.01 3.29 18.20 94 XM_UB999 3265 1.11 3.17 0.01 95 SUBJ_ALL_CAPS 3184 1.75 3.09 1.04 96 RCVD_IN_MSPIKE_H4 3172 5.58 3.08 6.91 97 XMNumbers 3117 4.60 3.03 5.43 98 XM_B_SpammyWords4 2728 1.52 2.65 0.92 99 XM_DK_Undo_01 2706 1.74 2.63 1.26 100 DKIM_INVALID 2648 2.82 2.57 2.94 101 FROM_EXCESS_BASE64 2576 3.23 2.50 3.62 102 XM_B_Phish66 2559 1.82 2.49 1.46 103 FONT_INVIS_LONG_LINE 2559 0.90 2.49 0.05 104 XMBdyGiftCard01 2500 2.07 2.43 1.87 105 URIBL_DBL_SPAM 2439 0.84 2.37 0.02 106 RCVD_IN_MSPIKE_BL 2435 1.01 2.37 0.29 107 XM_UB50 2420 1.59 2.35 1.18 108 TR_XM_MSPIKECOMBO 2374 0.99 2.31 0.29 109 XM_CamelCaseFrm001 2366 2.16 2.30 2.09 110 TR_XM_FormFill 2351 0.80 2.28 0.01 111 RCVD_IN_VALIDITY_RPBL 2305 0.80 2.24 0.03 112 T_TooManySym_01 2241 6.63 2.18 9.01 113 T_REMOTE_IMAGE 2226 3.03 2.16 3.49 114 TM2_M_URI_OPT_OUT 2204 1.98 2.14 1.89 115 XMDiploma_00 2167 1.70 2.10 1.48 116 HTML_MIME_NO_HTML_TAG 2062 1.52 2.00 1.26 117 T_XMHurry_00 2030 1.39 1.97 1.08 118 SpammyFromTLD_01 2014 0.94 1.96 0.39 119 XMPhish30 2008 1.39 1.95 1.10 120 TR_XM_BayesRelay 1988 0.68 1.93 0.01 121 TR_XM_NoHeaderRelay 1969 0.75 1.91 0.13 122 XM_URI_RBL 1894 0.74 1.84 0.16 123 XM_H_Undi_Recip 1862 0.74 1.81 0.18 124 TR_XM_PHPDW 1840 0.87 1.79 0.39 125 XMSexyCombo_01 1838 0.85 1.79 0.35 126 XM_B_Unsub2 1830 1.25 1.78 0.97 127 XMReplyNow 1817 0.76 1.76 0.22 128 XM_GoogleGroups 1767 1.46 1.72 1.32 129 XM_B_REG_HTML 1764 1.11 1.71 0.79 130 HTML_TAG_BALANCE_BODY 1756 1.05 1.71 0.70 131 TR_XM_PHPForged 1718 0.79 1.67 0.32 132 MAILING_LIST_MULTI 1699 1.89 1.65 2.02 133 TR_XM_FormFill2 1692 0.78 1.64 0.33 134 MIME_QP_LONG_LINE 1688 2.75 1.64 3.34 135 XM_H_PHPOS 1683 0.77 1.63 0.31 136 TR_Caps_n_Bayes_99 1653 0.59 1.61 0.04 137 TR_XM_SB_Phish 1558 1.52 1.51 1.52 138 TR_XM_Undi_Recip11 1537 0.53 1.49 0.02 139 THIS_AD 1536 0.89 1.49 0.57 140 MPART_ALT_DIFF_COUNT 1506 1.04 1.46 0.82 141 XMSubPhish11 1478 1.48 1.44 1.50 142 KHOP_HELO_FCRDNS 1448 0.91 1.41 0.64 143 XMLngstWrd_00 1440 1.15 1.40 1.01 144 XMLngstWrd_01 1406 1.06 1.37 0.90 145 BAYES_00 1386 5.68 1.35 7.99 146 TR_XM_SpammyWords3 1354 0.56 1.32 0.15 147 XMBrknScrpt_02 1341 0.82 1.30 0.56 148 XMStockSpam_06 1338 2.06 1.30 2.47 149 XMLngstWrd_02 1336 0.92 1.30 0.71 150 TR_Mismatch_TLD_02 1319 0.50 1.28 0.09 151 DIET_1 1317 0.72 1.28 0.43 152 XMSubMetaI_00 1290 0.89 1.25 0.69 153 ALL_TRUSTED 1285 10.31 1.25 15.13 154 TR_XM_DK_Bayes 1276 4.74 1.24 6.60 155 BOTNET_NORDNS 1245 0.43 1.21 0.01 156 URI_HEX 1207 1.29 1.17 1.36 157 TR_LOTS_OF_MONEY3 1199 0.54 1.16 0.20 158 XMBody_78 1193 0.72 1.16 0.49 159 TR_XM_Undi_Recip5 1185 0.40 1.15 0.01 160 RCVD_IN_RP_SAFE 1181 1.48 1.15 1.66 161 HTTPS_HTTP_MISMATCH 1179 0.69 1.15 0.45 162 MONEY_FRAUD_3 1171 0.40 1.14 0.00 163 RCVD_IN_MSPIKE_L5 1169 0.43 1.14 0.05 164 XM_H_PHPMailer 1159 0.80 1.13 0.63 165 RCVD_IN_PSBL 1143 0.88 1.11 0.75 166 FILL_THIS_FORM 1134 0.63 1.10 0.38 167 BAYES_40 1126 2.93 1.09 3.91 168 XM_Body_Dirty_Words_01 1126 0.69 1.09 0.48 169 URI_NOVOWEL 1122 1.35 1.09 1.49 170 TR_XM_Base64_M1 1111 1.10 1.08 1.11 171 TR_XM_Undi_Recip2 1110 0.39 1.08 0.02 172 TR_XM_Undi_RecipCombo2 1094 0.37 1.06 0.00 173 DEAR_SOMETHING 1081 0.41 1.05 0.07 174 MONEY_FORM 1078 0.37 1.05 0.00 175 TR_Sbj_FN_Bdy 1070 0.43 1.04 0.11 176 XM_OfRef7 1068 0.40 1.04 0.06 177 XMHTML_After_End 1063 0.89 1.03 0.82 178 RCVD_IN_IADB_LISTED 1061 2.18 1.03 2.80 179 TR_XM_InvalidRelay 1045 0.38 1.02 0.04 180 T_XMDrugObfuBody_00 1045 0.77 1.02 0.64 181 UNDISC_MONEY 1042 0.35 1.01 0.00 182 XMClaimOffer 1042 0.43 1.01 0.11 183 RELAYCOUNTRY_AU 1027 0.51 1.00 0.24 184 TR_MetaPhish_Combo_01 1024 0.69 0.99 0.53 185 RELAYCOUNTRY_CN 1015 0.40 0.99 0.09 186 TR_Symld_Words 1001 1.20 0.97 1.33 187 PLING_QUERY 991 0.66 0.96 0.50 188 HTML_FONT_FACE_BAD 981 1.11 0.95 1.19 189 HTML_TEXT_INVISIBLE_STYLE 975 0.60 0.95 0.41 190 XMHTMLBadTable_001 958 0.70 0.93 0.57 191 TR_XM_Undi_Recip9 958 0.32 0.93 0.00 192 URIBL_BLACK 955 0.34 0.93 0.03 193 XMLngstWrd_03 944 0.69 0.92 0.57 194 XMGenDplmaNmb 943 0.76 0.92 0.67 195 RCVD_IN_IADB_SPF 942 1.98 0.92 2.54 196 HELO_NODOT 933 0.58 0.91 0.40 197 SHOPIFY_IMG_NOT_RCVD_SFY 931 0.54 0.90 0.35 198 HELO_NO_DOMAIN 930 0.58 0.90 0.40 199 URI_PHP_REDIR 927 0.32 0.90 0.00 200 TR_Mismatch_TLD_01 924 0.49 0.90 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161412 87.13 93.85 83.56 2 RELAYCOUNTRY_US 156814 79.99 77.76 81.18 3 DKIM_SIGNED 155743 84.53 91.87 80.62 4 XM_DK_Pass 151201 82.56 90.61 78.27 5 DKIM_VALID 150054 81.72 89.30 77.68 6 XM_B_Unicode 141022 77.06 84.69 73.00 7 DKIM_VALID_AU 130019 68.47 70.65 67.31 8 BAYES_50 112095 49.80 34.35 58.03 9 XMListUnsubscribeExists 110786 63.47 74.94 57.35 10 DCC_CHECK_NEGATIVE 108449 45.41 25.28 56.14 11 XM_B_SpammyWords 91093 54.84 69.26 47.16 12 XM_B_Unicode3 90776 47.35 48.02 46.99 13 DCC_CHECK 84674 54.57 74.71 43.83 14 RCVD_IN_MSPIKE_H2 80052 43.88 48.44 41.44 15 HTML_FONT_LOW_CONTRAST 63520 34.45 37.39 32.88 16 LOC_TINY_FONT_1 63125 35.95 42.08 32.68 17 DKIM_VALID_EF 57340 32.27 37.12 29.68 18 FVGT_m_MULTI_ODD 52526 29.03 32.49 27.19 19 XMSubLong 46148 22.88 20.97 23.89 20 MIME_HTML_ONLY 44122 25.60 30.77 22.84 21 T_TM2_M_HEADER_IN_MSG 40834 20.35 18.86 21.14 22 XM_B_SpammyWords2 40022 27.43 40.02 20.72 23 T_KAM_HTML_FONT_INVALID 39723 23.13 27.94 20.56 24 RCVD_IN_MSPIKE_WL 39248 18.88 16.19 20.32 25 USER_IN_DEF_DKIM_WL 35154 13.01 3.29 18.20 26 XM_Multi_Part_URI 33228 17.92 19.27 17.20 27 ALL_TRUSTED 29235 10.31 1.25 15.13 28 XM_DKIMWhitelistDomains 25973 8.81 0.12 13.45 29 XM_Body_Dirty_Words 25870 16.59 22.59 13.39 30 RCVD_IN_MSPIKE_H3 22879 12.15 12.73 11.84 31 BAYES_60 22049 10.08 7.57 11.41 32 UNPARSEABLE_RELAY 21708 12.07 13.64 11.24 33 XM_Evil_Numbers_Gen 20941 10.12 8.76 10.84 34 T_TooManySym_01 17404 6.63 2.18 9.01 35 HTML_IMAGE_RATIO_02 16862 8.59 8.32 8.73 36 XM_B_Unsub 16412 10.48 14.20 8.50 37 LotsOfNums_01 15936 7.47 6.00 8.25 38 RCVD_IN_VALIDITY_SAFE 15865 7.37 5.80 8.21 39 BAYES_00 15441 5.68 1.35 7.99 40 XM_DK_Undo_02 14873 22.34 49.80 7.70 41 TR_XM_BayesUnsub 13710 9.48 13.96 7.10 42 RCVD_IN_VALIDITY_CERTIFIED 13523 6.12 4.48 7.00 43 TooManyTo_001 13432 7.60 8.80 6.95 44 XMStrtUSub 13374 6.18 4.80 6.92 45 RCVD_IN_MSPIKE_H4 13345 5.58 3.08 6.91 46 XM_SendGrid 13091 6.85 6.98 6.78 47 TR_XM_DK_Bayes 12749 4.74 1.24 6.60 48 TR_XM_DK_Bayes1 12476 4.48 0.76 6.46 49 T_TooManySym_02 12264 4.35 0.60 6.35 50 XM_B_SpammyWords3 11983 8.39 12.48 6.20 51 TR_XM_DK_Bayes2 11651 4.19 0.74 6.03 52 BAYES_99 11624 17.89 40.18 6.02 53 HTML_IMAGE_RATIO_04 11364 5.36 4.39 5.88 54 IN_ZIMBRA_NJ_WHITELIST 11066 3.75 0.05 5.73 55 BOTNET_IPINHOSTNAME 10880 7.94 12.26 5.63 56 LOTS_OF_MONEY 10580 6.79 9.26 5.48 57 HTML_IMAGE_RATIO_06 10504 4.73 3.41 5.44 58 XMNumbers 10491 4.60 3.03 5.43 59 XMSexyCombo_05 9896 6.83 10.03 5.12 60 MPART_ALT_DIFF 9727 5.26 5.67 5.04 61 BAYES_80 9497 6.25 8.75 4.92 62 TR_XM_DKIM_Undo 9473 16.42 38.02 4.90 63 BAYES_999 9441 14.34 32.06 4.89 64 XM_H_Long_From01 9412 4.95 5.10 4.87 65 TR_XM_DK_SendGrid 9126 4.64 4.48 4.72 66 XM_UncommonTLD01 8686 6.36 9.87 4.50 67 RELAYCOUNTRY_META 8077 9.84 20.46 4.18 68 BAYES_40 7552 2.93 1.09 3.91 69 TR_XM_SpammyWords4 7296 5.29 8.12 3.78 70 FROM_EXCESS_BASE64 6989 3.23 2.50 3.62 71 INVALID_MSGID 6971 2.44 0.24 3.61 72 MIME_HTML_MOSTLY 6883 3.63 3.75 3.56 73 T_REMOTE_IMAGE 6747 3.03 2.16 3.49 74 MSGID_NOFQDN1 6650 2.28 0.11 3.44 75 TR_XM_PhishingBody 6617 4.28 5.88 3.43 76 FSL_BULK_SIG 6583 5.38 9.07 3.41 77 XM_B_Phish_Phrases 6481 3.67 4.27 3.35 78 MIME_QP_LONG_LINE 6451 2.75 1.64 3.34 79 XMSubMetaSx_00 6390 4.00 5.31 3.31 80 BAYES_95 6120 3.96 5.45 3.17 81 TO_MALFORMED 6013 2.04 0.04 3.11 82 HTML_IMAGE_RATIO_08 6010 3.22 3.44 3.11 83 TR_DCC_Bayes_99 5921 12.29 29.60 3.07 84 DKIM_INVALID 5689 2.82 2.57 2.94 85 BAYES_20 5516 2.14 0.79 2.86 86 RCVD_IN_IADB_LISTED 5402 2.18 1.03 2.80 87 T_TooManySym_03 5039 1.79 0.25 2.61 88 MIME_HTML_ONLY_MULTI 5025 2.89 3.44 2.60 89 RCVD_IN_IADB_SPF 4909 1.98 0.92 2.54 90 TR_XM_UnparsRelay 4849 4.75 8.95 2.51 91 TVD_SPACE_RATIO 4831 1.67 0.11 2.50 92 XMStockSpam_06 4765 2.06 1.30 2.47 93 RCVD_IN_IADB_SENDERID 4519 1.83 0.86 2.34 94 RCVD_IN_IADB_DK 4450 1.81 0.88 2.30 95 XM_B_SpammyTLD 4281 4.24 8.04 2.22 96 TVD_RCVD_IP 4179 1.50 0.25 2.16 97 IN_HORDE_ADDRESS_BOOK 4121 1.41 0.06 2.13 98 XM_PDF 4102 1.51 0.35 2.12 99 XM_CamelCaseFrm001 4045 2.16 2.30 2.09 100 MAILING_LIST_MULTI 3902 1.89 1.65 2.02 101 TR_XM_SpammyRelay 3790 6.80 15.87 1.96 102 UNTRUSTED_Relay 3702 4.12 8.27 1.92 103 TM2_M_URI_OPT_OUT 3655 1.98 2.14 1.89 104 XMBdyGiftCard01 3620 2.07 2.43 1.87 105 BAYES_05 3280 1.27 0.46 1.70 106 RCVD_IN_RP_SAFE 3212 1.48 1.15 1.66 107 BOTNET 3201 3.91 8.14 1.66 108 TR_XM_SpammyWords2 3109 5.91 13.97 1.61 109 RCVD_IN_IADB_VOUCHED 3093 1.21 0.46 1.60 110 T_XMDrugObfuBody_14 3028 2.28 3.62 1.57 111 RCVD_IN_MSPIKE_H5 3024 1.15 0.38 1.57 112 TM2_M_VERY_LONG_WORD 2971 2.30 3.74 1.54 113 TR_XM_SB_Phish 2945 1.52 1.51 1.52 114 FVGT_m_MULTI_ODD_EMAIL 2932 1.04 0.15 1.52 115 XMBody_95 2927 1.02 0.10 1.52 116 RELAYCOUNTRY_CA 2905 5.38 12.66 1.50 117 XMSubPhish11 2905 1.48 1.44 1.50 118 URI_NOVOWEL 2887 1.35 1.09 1.49 119 XMDiploma_00 2867 1.70 2.10 1.48 120 XM_B_Phish66 2823 1.82 2.49 1.46 121 XMBSHREFv2 2793 1.00 0.16 1.45 122 RCVD_IN_RP_CERTIFIED 2760 1.23 0.86 1.43 123 XMGappySubj_01 2755 1.00 0.20 1.43 124 XM_H_Trusted_IP 2631 0.89 0.00 1.36 125 URI_HEX 2624 1.29 1.17 1.36 126 BOUNCE_MESSAGE 2589 1.03 0.46 1.34 127 ANY_BOUNCE_MESSAGE 2589 1.03 0.46 1.34 128 TR_Symld_Words 2566 1.20 0.97 1.33 129 XM_GoogleGroups 2544 1.46 1.72 1.32 130 XM_H_Long_From02 2532 1.13 0.78 1.31 131 XM_B_Investor 2531 2.02 3.34 1.31 132 T_XMDrugObfuBody_08 2527 2.19 3.84 1.31 133 TooManyTo_002 2476 1.07 0.68 1.28 134 XM_DK_Undo_01 2441 1.74 2.63 1.26 135 HTML_MIME_NO_HTML_TAG 2439 1.52 2.00 1.26 136 XM_SPF_SoftFail 2332 1.94 3.32 1.21 137 HTML_FONT_FACE_BAD 2308 1.11 0.95 1.19 138 XM_UB50 2289 1.59 2.35 1.18 139 TR_XM_Base64_M1 2150 1.10 1.08 1.11 140 TR_XM_SpammyWords5 2135 2.36 4.71 1.11 141 XMPhish30 2120 1.39 1.95 1.10 142 T_XMHurry_00 2090 1.39 1.97 1.08 143 XM_RXBody 2087 0.89 0.54 1.08 144 SUBJ_ALL_CAPS 2011 1.75 3.09 1.04 145 XM_B_COPY_HTML 1995 0.96 0.83 1.03 146 RCVD_IN_IADB_OPTIN 1991 0.77 0.28 1.03 147 XMLngstWrd_00 1955 1.15 1.40 1.01 148 XM_OfRef6 1887 1.96 3.80 0.98 149 XM_B_Unsub2 1868 1.25 1.78 0.97 150 TooManyTo_003 1822 0.83 0.62 0.94 151 XM_B_SpammyWords4 1784 1.52 2.65 0.92 152 XMLngstWrd_01 1747 1.06 1.37 0.90 153 DKIM_ADSP_CUSTOM_MED 1745 0.86 0.79 0.90 154 MPART_ALT_DIFF_COUNT 1587 1.04 1.46 0.82 155 XMHTML_After_End 1584 0.89 1.03 0.82 156 XM_B_REG_HTML 1535 1.11 1.71 0.79 157 XMSubNoVowel 1473 0.70 0.59 0.76 158 RCVD_IN_PSBL 1453 0.88 1.11 0.75 159 TooManyTo_004 1435 0.69 0.58 0.74 160 XMLngstWrd_02 1376 0.92 1.30 0.71 161 HTML_IMAGE_ONLY_20 1350 0.61 0.45 0.70 162 HTML_TAG_BALANCE_BODY 1348 1.05 1.71 0.70 163 XMSubMetaI_00 1333 0.89 1.25 0.69 164 XMGenDplmaNmb 1300 0.76 0.92 0.67 165 USER_IN_WHITELIST 1246 0.42 0.00 0.65 166 USER_IN_WELCOMELIST 1246 0.42 0.00 0.65 167 KHOP_HELO_FCRDNS 1242 0.91 1.41 0.64 168 TooManyTo_005 1237 0.61 0.57 0.64 169 T_XMDrugObfuBody_00 1232 0.77 1.02 0.64 170 XM_H_PHPMailer 1213 0.80 1.13 0.63 171 XMBody_17 1117 2.02 4.72 0.58 172 XMHTMLBadTable_001 1105 0.70 0.93 0.57 173 THIS_AD 1102 0.89 1.49 0.57 174 XMLngstWrd_03 1095 0.69 0.92 0.57 175 XMBrknScrpt_02 1079 0.82 1.30 0.56 176 XM_ProductURIs 1060 0.64 0.80 0.55 177 T_FILL_THIS_FORM_SHORT 1044 1.61 3.61 0.54 178 XM_S_SubURI 1029 0.36 0.02 0.53 179 TR_MetaPhish_Combo_01 1023 0.69 0.99 0.53 180 URI_TRY_3LD 1007 0.61 0.78 0.52 181 NML_ADSP_CUSTOM_MED 988 0.56 0.65 0.51 182 TR_XM_Base64_L1 987 0.57 0.68 0.51 183 DATE_IN_PAST_03_06 976 0.39 0.18 0.51 184 PLING_QUERY 974 0.66 0.96 0.50 185 T_TooManySym_04 957 0.39 0.18 0.50 186 XMNoVowels 949 0.57 0.72 0.49 187 XMBody_78 944 0.72 1.16 0.49 188 FORGED_GMAIL_RCVD 941 0.53 0.60 0.49 189 XM_Body_Dirty_Words_01 930 0.69 1.09 0.48 190 XM_B_COVIDMETA 905 0.46 0.44 0.47 191 XMLngstWrd_04 896 0.60 0.86 0.46 192 HTTPS_HTTP_MISMATCH 873 0.69 1.15 0.45 193 AC_BR_BONANZA 838 0.38 0.29 0.43 194 XMSubMetaSxObfu_02 837 0.52 0.67 0.43 195 RELAYCOUNTRY_AT 831 0.39 0.31 0.43 196 DIET_1 829 0.72 1.28 0.43 197 LOW_PRICE 822 0.48 0.59 0.43 198 XMPhish08 822 0.57 0.84 0.43 199 XMSubMetaSxObfu_03 813 0.44 0.48 0.42 200 RCVD_IN_BL_SPAMCOP_NET 805 3.61 9.59 0.42 ----------------------------------------------------------------------