Email: 289362 Autolearn: 0 AvgScore: 4.08 AvgScanTime: 1.10 sec Spam: 101768 Autolearn: 0 AvgScore: 13.79 AvgScanTime: 1.19 sec Ham: 187594 Autolearn: 0 AvgScore: -1.18 AvgScanTime: 1.05 sec Time Spent Running SA: 88.48 hours Time Spent Processing Spam: 33.67 hours Time Spent Processing Ham: 54.81 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96413 85.40 94.74 80.33 2 DKIM_SIGNED 91443 80.54 89.85 75.48 3 XM_DK_Pass 88871 78.95 87.33 74.40 4 XM_B_Unicode 88762 75.24 87.22 68.75 5 DKIM_VALID 88140 78.37 86.61 73.90 6 T_SCC_BODY_TEXT_LINE 82827 82.63 81.39 83.30 7 RELAYCOUNTRY_US 79946 79.08 78.56 79.37 8 DCC_CHECK 75299 49.66 73.99 36.46 9 XM_B_SpammyWords 74685 54.03 73.39 43.52 10 XMListUnsubscribeExists 73126 59.96 71.86 53.51 11 DKIM_VALID_AU 66922 63.76 65.76 62.68 12 XM_DK_Undo_02 49140 21.93 48.29 7.63 13 XM_B_Unicode3 46680 43.37 45.87 42.02 14 XM_B_SpammyWords2 42516 26.47 41.78 18.17 15 BAYES_99 39424 17.73 38.74 6.33 16 LOC_TINY_FONT_1 38812 30.69 38.14 26.65 17 TR_XM_DKIM_Undo 38523 15.29 37.85 3.05 18 HTML_FONT_LOW_CONTRAST 37655 33.06 37.00 30.92 19 BAYES_50 36939 49.73 36.30 57.02 20 FVGT_m_MULTI_ODD 34387 28.90 33.79 26.25 21 DKIM_VALID_EF 32116 30.41 31.56 29.79 22 MIME_HTML_ONLY 32106 24.68 31.55 20.96 23 BAYES_999 31617 14.18 31.07 5.02 24 TR_DCC_Bayes_99 28076 11.21 27.59 2.32 25 T_KAM_HTML_FONT_INVALID 27237 22.06 26.76 19.51 26 DCC_CHECK_NEGATIVE 26453 50.32 25.99 63.51 27 TR_XM_DK_Unsub 24115 18.28 23.70 15.34 28 T_TM2_M_HEADER_IN_MSG 22666 22.27 22.27 22.27 29 RCVD_IN_MSPIKE_H2 21463 20.60 21.09 20.34 30 RELAYCOUNTRY_META 20855 9.51 20.49 3.56 31 XMSubLong 20774 21.37 20.41 21.88 32 XM_Multi_Part_URI 18723 16.66 18.40 15.72 33 TR_XM_SpammyRelay 17710 7.48 17.40 2.10 34 XM_B_Unsub 16139 11.08 15.86 8.49 35 TR_XM_BayesUnsub 15614 9.92 15.34 6.97 36 TR_XM_SpammyWords2 15246 5.72 14.98 0.70 37 RCVD_IN_BL_SPAMCOP_NET 15209 5.87 14.94 0.95 38 BOTNET_IPINHOSTNAME 14477 8.80 14.23 5.85 39 UNPARSEABLE_RELAY 14421 11.99 14.17 10.81 40 LOTS_OF_MONEY 14125 8.21 13.88 5.14 41 XM_Body_Dirty_Words 12961 8.19 12.74 5.72 42 XM_B_SpammyWords3 12957 7.74 12.73 5.03 43 RELAYCOUNTRY_CA 12789 5.32 12.57 1.40 44 TR_XM_SpammyWords4 12383 6.20 12.17 2.96 45 TR_XM_SPAMCOP 11690 4.27 11.49 0.35 46 BOTNET 10152 4.35 9.98 1.30 47 FSL_BULK_SIG 9995 5.31 9.82 2.86 48 RCVD_IN_MSPIKE_H3 9831 7.29 9.66 6.00 49 RCVD_IN_MSPIKE_WL 9831 7.31 9.66 6.04 50 BAYES_80 8937 6.07 8.78 4.59 51 XM_Evil_Numbers_Gen 8573 7.82 8.42 7.50 52 TR_XM_UnparsRelay 7793 4.00 7.66 2.01 53 HTML_IMAGE_RATIO_02 7569 6.28 7.44 5.66 54 BAYES_60 7039 9.44 6.92 10.80 55 HTML_IMAGE_RATIO_04 6783 5.78 6.67 5.30 56 XM_UncommonTLD01 6503 5.25 6.39 4.63 57 UNTRUSTED_Relay 6221 3.10 6.11 1.47 58 XMSexyCombo_05 5836 3.34 5.73 2.04 59 TooManyTo_001 5826 6.46 5.72 6.86 60 MPART_ALT_DIFF 5746 4.78 5.65 4.31 61 LotsOfNums_01 5685 6.96 5.59 7.71 62 XMBody_17 5547 2.25 5.45 0.51 63 XMSubMetaSx_00 5537 4.62 5.44 4.17 64 BAYES_95 5219 3.85 5.13 3.16 65 XM_H_Long_From01 4959 4.98 4.87 5.04 66 MIME_HTML_MOSTLY 4686 3.46 4.60 2.84 67 XM_OfRef6 4624 2.47 4.54 1.34 68 XM_B_Phish_Phrases 4446 3.58 4.37 3.16 69 TR_XM_BayesRelay 4417 1.53 4.34 0.00 70 T_XMDrugObfuBody_14 4399 2.72 4.32 1.85 71 HTML_IMAGE_RATIO_06 4305 3.30 4.23 2.79 72 TR_XM_PhishingBody 4191 2.66 4.12 1.87 73 T_FILL_THIS_FORM_SHORT 4096 1.72 4.02 0.47 74 T_XMDrugObfuBody_08 3839 2.31 3.77 1.52 75 XMStrtUSub 3750 4.93 3.68 5.61 76 HTML_IMAGE_RATIO_08 3583 2.84 3.52 2.48 77 RCVD_IN_VALIDITY_SAFE 3576 5.40 3.51 6.43 78 TR_LOTS_OF_MONEY3 3527 1.60 3.47 0.58 79 MIME_HTML_ONLY_MULTI 3370 2.82 3.31 2.55 80 DKIM_INVALID 3303 2.17 3.25 1.59 81 XM_B_Investor 3278 1.91 3.22 1.20 82 XM_SPF_SoftFail 3264 2.78 3.21 2.55 83 TR_XM_SpammyWords5 3251 2.04 3.19 1.42 84 XM_URI_RBL 3233 1.26 3.18 0.22 85 XM_B_SpammyTLD 3228 2.75 3.17 2.52 86 SpammyFromTLD_01 3160 1.40 3.11 0.47 87 TM2_M_VERY_LONG_WORD 3157 1.95 3.10 1.32 88 XM_UB50 3091 1.54 3.04 0.73 89 TM2_M_URI_OPT_OUT 3023 2.34 2.97 1.99 90 XMNumbers 2940 2.91 2.89 2.92 91 RCVD_IN_VALIDITY_CERTIFIED 2817 4.46 2.77 5.38 92 XM_CamelCaseFrm001 2767 2.67 2.72 2.65 93 TR_XM_FormFill 2649 0.92 2.60 0.01 94 HK_RANDOM_REPLYTO 2643 0.98 2.60 0.10 95 TR_XM_PHPDW 2581 1.13 2.54 0.37 96 T_REMOTE_IMAGE 2566 3.20 2.52 3.57 97 TR_XM_PHPForged 2554 1.12 2.51 0.36 98 USER_IN_DEF_DKIM_WL 2515 11.48 2.47 16.37 99 TR_XM_FormFill2 2437 1.08 2.39 0.36 100 XM_H_PHPOS 2413 1.05 2.37 0.34 101 XM_B_SpammyWords4 2388 1.48 2.35 1.02 102 HTML_MIME_NO_HTML_TAG 2345 1.72 2.30 1.40 103 RELAYCOUNTRY_AU 2305 1.06 2.26 0.40 104 HTML_TAG_BALANCE_BODY 2230 1.07 2.19 0.46 105 AC_BR_BONANZA 2219 0.86 2.18 0.15 106 T_TooManySym_01 2203 5.51 2.16 7.33 107 TR_Mismatch_TLD_02 2202 0.82 2.16 0.08 108 XM_HighProb1 2200 0.77 2.16 0.01 109 FROM_EXCESS_BASE64 2196 2.50 2.16 2.69 110 BOTNET_NORDNS 2194 0.77 2.16 0.01 111 XMDiploma_00 2177 2.04 2.14 1.99 112 XMBdyGiftCard01 2107 1.33 2.07 0.93 113 T_XMHurry_00 2089 1.11 2.05 0.59 114 XM_B_Unsub2 2088 1.57 2.05 1.31 115 TR_XM_NoHeaderRelay 2088 0.81 2.05 0.13 116 XM_DIRTYINTL 1985 0.83 1.95 0.21 117 URI_TRY_3LD 1985 1.11 1.95 0.65 118 URI_HEX 1981 1.21 1.95 0.81 119 SUBJ_ALL_CAPS 1957 1.60 1.92 1.43 120 XMStockSpam_06 1930 1.26 1.90 0.91 121 XM_DK_Undo_01 1831 1.81 1.80 1.81 122 FONT_INVIS_LONG_LINE 1778 0.65 1.75 0.05 123 MIME_QP_LONG_LINE 1718 3.06 1.69 3.81 124 T_XMDrugObfuBody_00 1716 1.16 1.69 0.88 125 BAYES_40 1683 3.10 1.65 3.88 126 URI_NOVOWEL 1621 1.46 1.59 1.39 127 XMPhish30 1586 1.13 1.56 0.89 128 MAILING_LIST_MULTI 1585 1.96 1.56 2.19 129 ANY_BOUNCE_MESSAGE 1569 4.27 1.54 5.75 130 BOUNCE_MESSAGE 1566 4.27 1.54 5.75 131 XM_ProductURIs 1532 0.98 1.51 0.70 132 SCC_BODY_URI_ONLY 1477 2.81 1.45 3.55 133 SpammyFromTLD_02 1461 0.65 1.44 0.22 134 HTTPS_HTTP_MISMATCH 1451 0.84 1.43 0.52 135 XMReplyNow 1419 0.65 1.39 0.25 136 XM_H_PHPMailer 1416 0.99 1.39 0.77 137 RCVD_IN_VALIDITY_RPBL 1377 0.50 1.35 0.04 138 RCVD_IN_PSBL 1366 0.63 1.34 0.24 139 URIBL_DBL_SPAM 1355 0.47 1.33 0.01 140 NO_DNS_FOR_FROM 1322 0.69 1.30 0.36 141 DIET_1 1305 0.63 1.28 0.27 142 TR_XM_INV_DKIM 1273 0.48 1.25 0.06 143 ALL_TRUSTED 1250 11.76 1.23 17.47 144 XMSubMetaI_00 1232 0.83 1.21 0.63 145 MPART_ALT_DIFF_COUNT 1212 0.94 1.19 0.81 146 XM_SendGrid 1199 1.23 1.18 1.26 147 KHOP_HELO_FCRDNS 1190 1.05 1.17 0.98 148 BAYES_20 1179 2.15 1.16 2.69 149 TR_XM_MaxWHORU 1171 0.58 1.15 0.27 150 TR_XM_RelayPhish 1132 0.46 1.11 0.10 151 XMBrknScrpt_02 1111 0.75 1.09 0.56 152 XMPhish14 1084 0.63 1.07 0.39 153 TooManyTo_002 1045 1.61 1.03 1.92 154 XM_H_Undi_Recip 1031 0.45 1.01 0.15 155 RDNS_DYNAMIC 1001 0.59 0.98 0.38 156 TR_Mismatch_TLD_01 996 0.54 0.98 0.31 157 RCVD_IN_IADB_LISTED 991 2.42 0.97 3.21 158 XMSexyCombo_01 983 0.49 0.97 0.22 159 TR_Caps_n_Bayes_99 971 0.34 0.95 0.01 160 HTML_FONT_FACE_BAD 959 0.67 0.94 0.52 161 XM_H_Long_From02 951 1.13 0.93 1.24 162 XM_UB99 947 0.33 0.93 0.01 163 HTML_TAG_BALANCE_CENTER 943 0.37 0.93 0.07 164 TVD_RCVD_IP 932 2.07 0.92 2.70 165 XM_B_COPY_HTML 928 0.87 0.91 0.85 166 TooManyTo_003 918 0.93 0.90 0.95 167 XM_B_Phish66 916 0.46 0.90 0.23 168 XMSlimDrugH 908 0.64 0.89 0.50 169 XM_RXBody 897 0.46 0.88 0.23 170 THIS_AD 892 0.57 0.88 0.41 171 TooManyTo_004 891 0.76 0.88 0.70 172 TR_MetaPhish_Combo_01 889 0.72 0.87 0.63 173 TM2_M_OBFU_COMMENT 877 0.50 0.86 0.31 174 RCVD_IN_IADB_SPF 858 2.19 0.84 2.92 175 TooManyTo_005 855 0.68 0.84 0.60 176 TR_XM_InvalidRelay 842 0.30 0.83 0.01 177 SUBJ_DOLLARS 833 0.43 0.82 0.22 178 XM_OfRef7 830 0.38 0.82 0.14 179 XM_H_PHPOS_M 824 0.33 0.81 0.07 180 XMGenDplmaNmb 823 0.62 0.81 0.53 181 DKIM_ADSP_CUSTOM_MED 822 0.82 0.81 0.82 182 T_STY_INVIS_DIRECT 814 0.41 0.80 0.20 183 RCVD_IN_IADB_DK 806 1.98 0.79 2.63 184 HELO_DYNAMIC_SPLIT_IP 806 0.28 0.79 0.01 185 RCVD_IN_IADB_SENDERID 805 2.04 0.79 2.72 186 RCVD_IN_RP_SAFE 800 1.09 0.79 1.25 187 BODY_URI_ONLY 786 0.28 0.77 0.01 188 XMBody_78 784 0.46 0.77 0.30 189 GOOG_STO_IMG_NOHTML 781 0.36 0.77 0.14 190 URIBL_CSS_A 779 0.30 0.77 0.04 191 URIBL_CSS 779 0.30 0.77 0.04 192 NML_ADSP_CUSTOM_MED 773 0.62 0.76 0.55 193 SHOPIFY_IMG_NOT_RCVD_SFY 770 0.64 0.76 0.58 194 XMLngstWrd_00 770 0.55 0.76 0.43 195 TR_LOTS_OF_MONEY2 766 0.33 0.75 0.11 196 T_MONEY_PERCENT 766 0.33 0.75 0.11 197 XM_UB60 758 0.30 0.74 0.05 198 HTML_FONT_TINY_NORDNS 751 0.34 0.74 0.12 199 XMHTML_After_End 744 0.57 0.73 0.49 200 PDS_OTHER_BAD_TLD 736 0.34 0.72 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 156259 82.63 81.39 83.30 2 HTML_MESSAGE 150695 85.40 94.74 80.33 3 RELAYCOUNTRY_US 148890 79.08 78.56 79.37 4 DKIM_SIGNED 141603 80.54 89.85 75.48 5 XM_DK_Pass 139569 78.95 87.33 74.40 6 DKIM_VALID 138627 78.37 86.61 73.90 7 XM_B_Unicode 128967 75.24 87.22 68.75 8 DCC_CHECK_NEGATIVE 119148 50.32 25.99 63.51 9 DKIM_VALID_AU 117583 63.76 65.76 62.68 10 BAYES_50 106963 49.73 36.30 57.02 11 XMListUnsubscribeExists 100384 59.96 71.86 53.51 12 XM_B_SpammyWords 81648 54.03 73.39 43.52 13 XM_B_Unicode3 78826 43.37 45.87 42.02 14 DCC_CHECK 68402 49.66 73.99 36.46 15 HTML_FONT_LOW_CONTRAST 58007 33.06 37.00 30.92 16 DKIM_VALID_EF 55887 30.41 31.56 29.79 17 LOC_TINY_FONT_1 49990 30.69 38.14 26.65 18 FVGT_m_MULTI_ODD 49238 28.90 33.79 26.25 19 T_TM2_M_HEADER_IN_MSG 41777 22.27 22.27 22.27 20 XMSubLong 41050 21.37 20.41 21.88 21 MIME_HTML_ONLY 39321 24.68 31.55 20.96 22 RCVD_IN_MSPIKE_H2 38150 20.60 21.09 20.34 23 T_KAM_HTML_FONT_INVALID 36598 22.06 26.76 19.51 24 XM_B_SpammyWords2 34077 26.47 41.78 18.17 25 ALL_TRUSTED 32774 11.76 1.23 17.47 26 USER_IN_DEF_DKIM_WL 30703 11.48 2.47 16.37 27 XM_Multi_Part_URI 29484 16.66 18.40 15.72 28 TR_XM_DK_Unsub 28784 18.28 23.70 15.34 29 UNPARSEABLE_RELAY 20274 11.99 14.17 10.81 30 BAYES_60 20265 9.44 6.92 10.80 31 XM_DKIMWhitelistDomains 18938 6.56 0.04 10.10 32 BAYES_00 16124 5.79 0.63 8.60 33 XM_B_Unsub 15932 11.08 15.86 8.49 34 LotsOfNums_01 14459 6.96 5.59 7.71 35 XM_DK_Undo_02 14313 21.93 48.29 7.63 36 XM_Evil_Numbers_Gen 14066 7.82 8.42 7.50 37 T_TooManySym_01 13749 5.51 2.16 7.33 38 TR_XM_BayesUnsub 13081 9.92 15.34 6.97 39 TR_XM_DK_Bayes 13050 4.64 0.38 6.96 40 TR_XM_DK_Bayes1 12955 4.61 0.38 6.91 41 TooManyTo_001 12866 6.46 5.72 6.86 42 RCVD_IN_VALIDITY_SAFE 12063 5.40 3.51 6.43 43 BAYES_99 11874 17.73 38.74 6.33 44 TR_XM_DK_Bayes2 11561 4.11 0.34 6.16 45 RCVD_IN_MSPIKE_WL 11332 7.31 9.66 6.04 46 RCVD_IN_MSPIKE_H3 11260 7.29 9.66 6.00 47 BOTNET_IPINHOSTNAME 10980 8.80 14.23 5.85 48 IN_ZIMBRA_NJ_WHITELIST 10971 3.82 0.08 5.85 49 ANY_BOUNCE_MESSAGE 10790 4.27 1.54 5.75 50 BOUNCE_MESSAGE 10788 4.27 1.54 5.75 51 XM_Body_Dirty_Words 10730 8.19 12.74 5.72 52 HTML_IMAGE_RATIO_02 10613 6.28 7.44 5.66 53 XMStrtUSub 10529 4.93 3.68 5.61 54 RCVD_IN_VALIDITY_CERTIFIED 10090 4.46 2.77 5.38 55 HTML_IMAGE_RATIO_04 9940 5.78 6.67 5.30 56 LOTS_OF_MONEY 9634 8.21 13.88 5.14 57 XM_H_Long_From01 9455 4.98 4.87 5.04 58 XM_B_SpammyWords3 9428 7.74 12.73 5.03 59 BAYES_999 9417 14.18 31.07 5.02 60 XM_UncommonTLD01 8690 5.25 6.39 4.63 61 BAYES_80 8613 6.07 8.78 4.59 62 MPART_ALT_DIFF 8091 4.78 5.65 4.31 63 XMSubMetaSx_00 7826 4.62 5.44 4.17 64 BAYES_40 7278 3.10 1.65 3.88 65 MIME_QP_LONG_LINE 7138 3.06 1.69 3.81 66 INVALID_MSGID 7084 2.51 0.19 3.78 67 T_TooManySym_02 6693 2.53 0.61 3.57 68 T_REMOTE_IMAGE 6688 3.20 2.52 3.57 69 RELAYCOUNTRY_META 6676 9.51 20.49 3.56 70 SCC_BODY_URI_ONLY 6658 2.81 1.45 3.55 71 TO_MALFORMED 6121 2.14 0.07 3.26 72 RCVD_IN_IADB_LISTED 6025 2.42 0.97 3.21 73 BAYES_95 5931 3.85 5.13 3.16 74 XM_B_Phish_Phrases 5922 3.58 4.37 3.16 75 TR_XM_DKIM_Undo 5722 15.29 37.85 3.05 76 TR_XM_SpammyWords4 5548 6.20 12.17 2.96 77 BAYES_05 5491 2.14 0.68 2.93 78 XMNumbers 5472 2.91 2.89 2.92 79 RCVD_IN_IADB_SPF 5470 2.19 0.84 2.92 80 FSL_BULK_SIG 5358 5.31 9.82 2.86 81 MIME_HTML_MOSTLY 5323 3.46 4.60 2.84 82 HTML_IMAGE_RATIO_06 5231 3.30 4.23 2.79 83 RCVD_IN_IADB_SENDERID 5109 2.04 0.79 2.72 84 TVD_RCVD_IP 5060 2.07 0.92 2.70 85 BAYES_20 5054 2.15 1.16 2.69 86 FROM_EXCESS_BASE64 5046 2.50 2.16 2.69 87 XM_CamelCaseFrm001 4973 2.67 2.72 2.65 88 RCVD_IN_IADB_DK 4932 1.98 0.79 2.63 89 XM_PDF 4862 1.77 0.25 2.59 90 MIME_HTML_ONLY_MULTI 4789 2.82 3.31 2.55 91 XM_SPF_SoftFail 4787 2.78 3.21 2.55 92 XM_B_SpammyTLD 4730 2.75 3.17 2.52 93 HTML_IMAGE_RATIO_08 4648 2.84 3.52 2.48 94 TR_DCC_Bayes_99 4358 11.21 27.59 2.32 95 MAILING_LIST_MULTI 4099 1.96 1.56 2.19 96 TR_XM_SpammyRelay 3935 7.48 17.40 2.10 97 XMSexyCombo_05 3834 3.34 5.73 2.04 98 TR_XM_UnparsRelay 3772 4.00 7.66 2.01 99 TM2_M_URI_OPT_OUT 3738 2.34 2.97 1.99 100 RCVD_IN_IADB_VOUCHED 3734 1.45 0.46 1.99 101 XMDiploma_00 3726 2.04 2.14 1.99 102 TooManyTo_002 3609 1.61 1.03 1.92 103 TR_XM_PhishingBody 3501 2.66 4.12 1.87 104 T_XMDrugObfuBody_14 3466 2.72 4.32 1.85 105 XMGappySubj_01 3417 1.24 0.16 1.82 106 XM_DK_Undo_01 3394 1.81 1.80 1.81 107 XMBSHREFv2 3360 1.24 0.22 1.79 108 IN_HORDE_ADDRESS_BOOK 3324 1.17 0.06 1.77 109 TVD_SPACE_RATIO 3284 1.17 0.09 1.75 110 DKIM_INVALID 2976 2.17 3.25 1.59 111 XMGappySubj_02 2907 1.02 0.05 1.55 112 XMBody_95 2874 1.02 0.09 1.53 113 T_XMDrugObfuBody_08 2846 2.31 3.77 1.52 114 UNTRUSTED_Relay 2754 3.10 6.11 1.47 115 SUBJ_ALL_CAPS 2686 1.60 1.92 1.43 116 TR_XM_SpammyWords5 2660 2.04 3.19 1.42 117 HTML_MIME_NO_HTML_TAG 2628 1.72 2.30 1.40 118 RELAYCOUNTRY_CA 2617 5.32 12.57 1.40 119 TR_Symld_Words 2612 1.14 0.67 1.39 120 URI_NOVOWEL 2604 1.46 1.59 1.39 121 XM_OfRef6 2521 2.47 4.54 1.34 122 TM2_M_VERY_LONG_WORD 2479 1.95 3.10 1.32 123 XM_B_Unsub2 2463 1.57 2.05 1.31 124 RCVD_IN_IADB_OPTIN 2460 0.95 0.29 1.31 125 BOTNET 2437 4.35 9.98 1.30 126 XM_GoogleGroups 2404 1.01 0.50 1.28 127 XM_SendGrid 2357 1.23 1.18 1.26 128 RCVD_IN_RP_SAFE 2346 1.09 0.79 1.25 129 MSGID_NOFQDN1 2343 0.81 0.01 1.25 130 XM_H_Long_From02 2323 1.13 0.93 1.24 131 T_TooManySym_03 2258 0.88 0.29 1.20 132 XM_B_Investor 2251 1.91 3.22 1.20 133 RCVD_IN_RP_CERTIFIED 1944 0.89 0.63 1.04 134 XM_B_SpammyWords4 1908 1.48 2.35 1.02 135 KHOP_HELO_FCRDNS 1842 1.05 1.17 0.98 136 RCVD_IN_BL_SPAMCOP_NET 1785 5.87 14.94 0.95 137 TooManyTo_003 1773 0.93 0.90 0.95 138 XMBdyGiftCard01 1746 1.33 2.07 0.93 139 XMStockSpam_06 1702 1.26 1.90 0.91 140 XMPhish30 1675 1.13 1.56 0.89 141 TR_XM_DK_SendGrid 1662 0.83 0.71 0.89 142 USER_IN_WHITELIST 1654 0.57 0.00 0.88 143 USER_IN_WELCOMELIST 1654 0.57 0.00 0.88 144 T_XMDrugObfuBody_00 1649 1.16 1.69 0.88 145 XM_B_COPY_HTML 1590 0.87 0.91 0.85 146 DKIM_ADSP_CUSTOM_MED 1545 0.82 0.81 0.82 147 URI_HEX 1523 1.21 1.95 0.81 148 MPART_ALT_DIFF_COUNT 1519 0.94 1.19 0.81 149 XM_H_PHPMailer 1437 0.99 1.39 0.77 150 XM_UB50 1378 1.54 3.04 0.73 151 TooManyTo_004 1322 0.76 0.88 0.70 152 XM_ProductURIs 1310 0.98 1.51 0.70 153 TR_XM_SpammyWords2 1306 5.72 14.98 0.70 154 XMNoVowels 1301 0.62 0.48 0.69 155 T_OBFU_PDF_ATTACH 1249 0.44 0.03 0.67 156 XM_B_REG_HTML 1239 0.59 0.47 0.66 157 XM_B_FormFill 1226 0.45 0.08 0.65 158 URI_TRY_3LD 1218 1.11 1.95 0.65 159 TR_XM_Base64_M1 1199 0.66 0.70 0.64 160 TR_MetaPhish_Combo_01 1184 0.72 0.87 0.63 161 XMSubMetaI_00 1177 0.83 1.21 0.63 162 TooManyTo_005 1127 0.68 0.84 0.60 163 XM_H_Trusted_IP 1120 0.39 0.00 0.60 164 T_XMHurry_00 1114 1.11 2.05 0.59 165 SHOPIFY_IMG_NOT_RCVD_SFY 1094 0.64 0.76 0.58 166 TR_LOTS_OF_MONEY3 1092 1.60 3.47 0.58 167 XMBrknScrpt_02 1057 0.75 1.09 0.56 168 NML_ADSP_CUSTOM_MED 1023 0.62 0.76 0.55 169 XMSubNoVowel 1017 0.53 0.50 0.54 170 XM_shorewaves_Whitelist 1012 0.35 0.00 0.54 171 XMSubMetaSxObfu_02 999 0.44 0.26 0.53 172 XMGenDplmaNmb 985 0.62 0.81 0.53 173 HTML_FONT_FACE_BAD 984 0.67 0.94 0.52 174 HTTPS_HTTP_MISMATCH 974 0.84 1.43 0.52 175 XMBody_17 966 2.25 5.45 0.51 176 XMSlimDrugH 933 0.64 0.89 0.50 177 XMHTML_After_End 917 0.57 0.73 0.49 178 FORGED_GMAIL_RCVD 913 0.54 0.64 0.49 179 T_FILL_THIS_FORM_SHORT 886 1.72 4.02 0.47 180 SpammyFromTLD_01 884 1.40 3.11 0.47 181 T_TooManySym_04 865 0.36 0.17 0.46 182 HTML_TAG_BALANCE_BODY 859 1.07 2.19 0.46 183 HELO_NODOT 850 0.54 0.70 0.45 184 HELO_NO_DOMAIN 849 0.54 0.70 0.45 185 FILL_THIS_FORM 829 0.45 0.47 0.44 186 RCVD_IN_IADB_OPTIN_GT50 827 0.30 0.05 0.44 187 XM_H_SpoofStaff4 819 0.30 0.05 0.44 188 XMLngstWrd_00 811 0.55 0.76 0.43 189 XMCapTrack 799 0.38 0.29 0.43 190 XM_ShortIntro_01 796 0.47 0.56 0.42 191 XM_S_SubURI 788 0.30 0.09 0.42 192 HTML_IMAGE_ONLY_20 773 0.43 0.48 0.41 193 TR_XM_SpoofStaff 771 0.30 0.09 0.41 194 XMSpoofStaff2 768 0.29 0.07 0.41 195 TR_XM_PSC1 767 0.28 0.05 0.41 196 THIS_AD 766 0.57 0.88 0.41 197 RELAYCOUNTRY_AU 759 1.06 2.26 0.40 198 PLING_QUERY 758 0.47 0.60 0.40 199 TR_MetaPhish_Sub_02 739 0.26 0.00 0.39 200 XMPhish14 731 0.63 1.07 0.39 ----------------------------------------------------------------------