Email: 298488 Autolearn: 0 AvgScore: 3.97 AvgScanTime: 1.11 sec Spam: 102403 Autolearn: 0 AvgScore: 14.18 AvgScanTime: 1.15 sec Ham: 196085 Autolearn: 0 AvgScore: -1.37 AvgScanTime: 1.08 sec Time Spent Running SA: 91.84 hours Time Spent Processing Spam: 32.83 hours Time Spent Processing Ham: 59.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 93179 78.56 90.99 72.07 2 HTML_MESSAGE 92778 84.68 90.60 81.58 3 XM_DK_Pass 91048 77.26 88.91 71.17 4 DKIM_VALID 90011 76.58 87.90 70.67 5 XM_B_Unicode 89608 76.58 87.51 70.87 6 T_SCC_BODY_TEXT_LINE 83520 82.70 81.56 83.30 7 RELAYCOUNTRY_US 80073 79.11 78.19 79.59 8 XM_B_SpammyWords 77412 56.10 75.60 45.92 9 DCC_CHECK 75787 48.89 74.01 35.77 10 XMListUnsubscribeExists 71504 58.26 69.83 52.22 11 DKIM_VALID_AU 65362 61.65 63.83 60.51 12 XM_DK_Undo_02 52641 21.51 51.41 5.89 13 XM_B_Unicode3 46271 45.22 45.19 45.23 14 XM_B_SpammyWords2 45059 29.87 44.00 22.49 15 TR_XM_DKIM_Undo 42574 16.17 41.57 2.91 16 BAYES_99 39077 16.55 38.16 5.26 17 BAYES_50 37255 50.64 36.38 58.08 18 FVGT_m_MULTI_ODD 36013 28.26 35.17 24.66 19 LOC_TINY_FONT_1 35101 30.25 34.28 28.15 20 DKIM_VALID_EF 34897 29.10 34.08 26.50 21 HTML_FONT_LOW_CONTRAST 34807 31.12 33.99 29.62 22 BAYES_999 30775 12.98 30.05 4.06 23 MIME_HTML_ONLY 30210 26.39 29.50 24.76 24 TR_DCC_Bayes_99 28093 10.72 27.43 2.00 25 DCC_CHECK_NEGATIVE 26602 51.09 25.98 64.21 26 T_KAM_HTML_FONT_INVALID 25768 21.51 25.16 19.60 27 RCVD_IN_MSPIKE_H2 25065 21.14 24.48 19.39 28 TR_XM_DK_Unsub 21961 16.29 21.45 13.60 29 RELAYCOUNTRY_META 21956 9.88 21.44 3.84 30 T_TM2_M_HEADER_IN_MSG 20703 20.59 20.22 20.78 31 XMSubLong 19740 22.96 19.28 24.89 32 TR_XM_SpammyRelay 18410 7.55 17.98 2.11 33 XM_Multi_Part_URI 18137 16.03 17.71 15.15 34 RCVD_IN_BL_SPAMCOP_NET 17841 6.41 17.42 0.66 35 LOTS_OF_MONEY 17313 9.53 16.91 5.67 36 XM_B_SpammyWords3 16345 9.71 15.96 6.45 37 TR_XM_SpammyWords4 15783 8.04 15.41 4.19 38 TR_XM_SPAMCOP 15351 5.29 14.99 0.23 39 BOTNET_IPINHOSTNAME 14852 7.63 14.50 4.04 40 TR_XM_SpammyWords2 14490 5.30 14.15 0.68 41 XM_B_Unsub 13936 11.39 13.61 10.23 42 RELAYCOUNTRY_CA 13893 5.71 13.57 1.61 43 TR_XM_BayesUnsub 13544 8.78 13.23 6.46 44 FSL_BULK_SIG 13191 5.83 12.88 2.15 45 XM_Body_Dirty_Words 13018 8.59 12.71 6.44 46 UNPARSEABLE_RELAY 12962 10.93 12.66 10.03 47 XM_UncommonTLD01 11535 6.71 11.26 4.33 48 RCVD_IN_MSPIKE_H3 10008 6.80 9.77 5.24 49 RCVD_IN_MSPIKE_WL 10008 6.80 9.77 5.24 50 BAYES_80 9523 6.14 9.30 4.48 51 BOTNET 9477 3.79 9.25 0.93 52 TR_XM_PhishingBody 8283 4.14 8.09 2.07 53 TR_XM_UnparsRelay 7814 3.72 7.63 1.68 54 HTML_IMAGE_RATIO_02 7788 6.72 7.61 6.26 55 BAYES_60 7516 9.34 7.34 10.38 56 XM_Evil_Numbers_Gen 7333 8.51 7.16 9.21 57 XMBody_17 6604 2.64 6.45 0.66 58 XMSexyCombo_05 6275 4.47 6.13 3.61 59 HTML_IMAGE_RATIO_04 6194 5.87 6.05 5.77 60 XMSubMetaSx_00 6075 4.97 5.93 4.46 61 TooManyTo_001 5971 6.63 5.83 7.05 62 UNTRUSTED_Relay 5781 3.00 5.65 1.62 63 MPART_ALT_DIFF 5459 7.77 5.33 9.04 64 LotsOfNums_01 5389 6.65 5.26 7.38 65 BAYES_95 5351 3.77 5.23 3.01 66 XM_B_Phish66 5184 1.87 5.06 0.21 67 T_XMDrugObfuBody_14 4969 3.97 4.85 3.51 68 LongTLD 4930 1.73 4.81 0.12 69 MIME_HTML_MOSTLY 4659 4.14 4.55 3.92 70 XM_B_Phish_Phrases 4646 4.07 4.54 3.82 71 XMStrtUSub 4581 5.59 4.47 6.17 72 TR_XM_SpammyWords5 4519 2.21 4.41 1.06 73 TR_LOTS_OF_MONEY3 4515 1.92 4.41 0.63 74 RCVD_IN_VALIDITY_SAFE 4493 6.35 4.39 7.37 75 TR_XM_BayesRelay 4401 1.47 4.30 0.00 76 T_FILL_THIS_FORM_SHORT 4377 1.83 4.27 0.55 77 RCVD_IN_VALIDITY_RPBL 4200 1.44 4.10 0.06 78 XMLngstWrd_00 4159 1.78 4.06 0.59 79 XMLngstWrd_01 3964 1.56 3.87 0.35 80 XMLngstWrd_02 3923 1.47 3.83 0.24 81 XM_H_Long_From01 3887 4.32 3.80 4.59 82 RCVD_IN_VALIDITY_CERTIFIED 3730 5.37 3.64 6.28 83 HTML_IMAGE_RATIO_08 3544 2.70 3.46 2.30 84 HTML_IMAGE_RATIO_06 3513 2.83 3.43 2.51 85 XM_B_Investor 3475 2.01 3.39 1.29 86 XMNumbers 3343 3.04 3.26 2.92 87 T_XMDrugObfuBody_08 3301 2.02 3.22 1.40 88 HK_RANDOM_REPLYTO 3282 1.15 3.20 0.07 89 DKIM_INVALID 3168 1.98 3.09 1.40 90 XM_SPF_SoftFail 3165 2.50 3.09 2.19 91 XM_URI_RBL 3151 1.17 3.08 0.17 92 HTML_TAG_BALANCE_BODY 3123 1.44 3.05 0.60 93 XM_OfRef6 3121 1.65 3.05 0.92 94 XMLngstWrd_03 3107 1.16 3.03 0.18 95 TR_XM_FormFill 2879 0.97 2.81 0.01 96 XM_CamelCaseFrm001 2837 2.32 2.77 2.09 97 XM_B_SpammyTLD 2803 2.57 2.74 2.48 98 TM2_M_URI_OPT_OUT 2802 4.98 2.74 6.15 99 SpammyFromTLD_01 2797 1.20 2.73 0.40 100 MIME_HTML_ONLY_MULTI 2794 5.06 2.73 6.28 101 XM_UB50 2791 1.52 2.73 0.89 102 TM2_M_VERY_LONG_WORD 2776 1.76 2.71 1.27 103 SpammyFromTLD_02 2628 1.02 2.57 0.21 104 SUBJ_ALL_CAPS 2625 1.41 2.56 0.81 105 USER_IN_DEF_DKIM_WL 2623 11.47 2.56 16.12 106 FROM_EXCESS_BASE64 2517 2.58 2.46 2.64 107 XMLngstWrd_04 2485 0.90 2.43 0.10 108 TR_XM_PHPDW 2462 0.97 2.40 0.23 109 TR_XM_PHPForged 2454 0.97 2.40 0.22 110 XM_SendGrid 2396 1.74 2.34 1.43 111 TR_XM_FormFill2 2394 0.95 2.34 0.22 112 HTML_MIME_NO_HTML_TAG 2375 1.69 2.32 1.36 113 XM_H_PHPOS 2372 0.92 2.32 0.20 114 XM_B_SpammyWords4 2348 1.23 2.29 0.68 115 FONT_INVIS_LONG_LINE 2336 0.84 2.28 0.09 116 AC_BR_BONANZA 2270 0.85 2.22 0.14 117 T_REMOTE_IMAGE 2179 2.35 2.13 2.47 118 XM_HighProb1 2107 0.71 2.06 0.00 119 URI_TRY_3LD 2102 1.10 2.05 0.61 120 XMDiploma_00 2092 1.68 2.04 1.49 121 TM2_M_A_HREF_HREF 2086 1.02 2.04 0.49 122 TR_Mismatch_TLD_02 2081 0.74 2.03 0.07 123 TR_XM_NoHeaderRelay 2054 0.75 2.01 0.09 124 T_TooManySym_01 2042 6.09 1.99 8.24 125 HTTPS_HTTP_MISMATCH 2035 1.04 1.99 0.54 126 RELAYCOUNTRY_AU 2011 0.97 1.96 0.46 127 MIME_QP_LONG_LINE 1966 2.73 1.92 3.15 128 XMPhish30 1941 1.19 1.90 0.82 129 XM_DIRTYINTL 1910 0.77 1.87 0.20 130 T_XMHurry_00 1883 1.05 1.84 0.63 131 XMBdyGiftCard01 1867 2.25 1.82 2.48 132 RCVD_IN_PSBL 1839 0.73 1.80 0.17 133 BOTNET_NORDNS 1793 0.61 1.75 0.01 134 XM_B_Unsub2 1732 1.31 1.69 1.12 135 XM_H_Undi_Recip 1682 0.67 1.64 0.17 136 T_XMDrugObfuBody_00 1647 1.01 1.61 0.69 137 URI_HEX 1616 1.16 1.58 0.94 138 XMReplyNow 1479 0.66 1.44 0.25 139 DIET_1 1476 0.72 1.44 0.35 140 URIBL_DBL_SPAM 1472 0.50 1.44 0.01 141 DKIM_ADSP_NXDOMAIN 1436 0.71 1.40 0.35 142 MAILING_LIST_MULTI 1417 1.82 1.38 2.06 143 XMStockSpam_06 1417 1.46 1.38 1.49 144 XM_H_PHPMailer 1413 0.97 1.38 0.76 145 BAYES_40 1332 3.09 1.30 4.02 146 TR_XM_Undi_Recip5 1326 0.45 1.29 0.01 147 XMSubMetaI_00 1322 0.80 1.29 0.54 148 TR_XM_Undi_Recip11 1310 0.47 1.28 0.04 149 XM_H_Long_From02 1300 1.01 1.27 0.87 150 XMSexyCombo_01 1299 0.69 1.27 0.38 151 ALL_TRUSTED 1269 11.48 1.24 16.83 152 XM_DK_Undo_01 1267 1.44 1.24 1.55 153 UNDISC_MONEY 1162 0.39 1.13 0.00 154 HTML_FONT_FACE_BAD 1117 0.70 1.09 0.50 155 KHOP_HELO_FCRDNS 1115 0.80 1.09 0.65 156 HK_SCAM 1111 0.38 1.08 0.01 157 BAYES_20 1096 2.20 1.07 2.80 158 HTML_IMAGE_ONLY_20 1088 0.63 1.06 0.40 159 ADVANCE_FEE_2_NEW_MONEY 1085 0.37 1.06 0.01 160 TR_MetaPhish_Combo_01 1079 0.75 1.05 0.59 161 MONEY_FRAUD_3 1076 0.36 1.05 0.00 162 RCVD_IN_IADB_LISTED 1050 2.06 1.03 2.61 163 XMSubMetaSxObfu_03 1045 0.53 1.02 0.28 164 FORGED_RELAY_MUA_TO_MX 1041 0.37 1.02 0.03 165 TooManyTo_002 1025 1.70 1.00 2.07 166 T_MONEY_PERCENT 1018 0.40 0.99 0.10 167 TR_LOTS_OF_MONEY2 1018 0.40 0.99 0.10 168 TR_XM_INV_DKIM 1009 0.37 0.99 0.05 169 XM_UB99 1008 0.34 0.98 0.00 170 THIS_AD 994 0.55 0.97 0.32 171 ANY_BOUNCE_MESSAGE 973 4.06 0.95 5.69 172 BOUNCE_MESSAGE 972 4.06 0.95 5.69 173 TR_XM_Base64_M1 971 0.89 0.95 0.86 174 TR_Caps_n_Bayes_99 960 0.33 0.94 0.01 175 TR_Mismatch_TLD_01 958 0.46 0.94 0.21 176 RCVD_IN_IADB_SPF 955 1.89 0.93 2.38 177 XM_B_COPY_HTML 954 0.87 0.93 0.84 178 MPART_ALT_DIFF_COUNT 954 0.75 0.93 0.66 179 RCVD_IN_RP_SAFE 950 1.31 0.93 1.52 180 TooManyTo_003 950 0.99 0.93 1.02 181 TooManyTo_004 934 0.85 0.91 0.82 182 RDNS_DYNAMIC 916 0.54 0.89 0.36 183 TooManyTo_005 910 0.77 0.89 0.71 184 RCVD_IN_IADB_DK 900 1.69 0.88 2.11 185 XM_H_PHPOS_M 898 0.34 0.88 0.06 186 RCVD_IN_IADB_SENDERID 893 1.75 0.87 2.21 187 XMSlimDrugH 892 0.48 0.87 0.28 188 MONEY_NOHTML 885 0.30 0.86 0.01 189 XM_Combo_Sbj 852 0.45 0.83 0.25 190 SUBJ_DOLLARS 843 0.49 0.82 0.32 191 TVD_RCVD_IP 833 1.13 0.81 1.29 192 TR_XM_InvalidRelay 829 0.29 0.81 0.02 193 XMGenDplmaNmb 828 0.62 0.81 0.51 194 RCVD_IN_RP_RNBL 822 0.28 0.80 0.01 195 DKIM_ADSP_CUSTOM_MED 814 0.81 0.79 0.81 196 URI_NOVOWEL 803 1.03 0.78 1.16 197 XM_B_REG_HTML 794 0.62 0.78 0.54 198 T_STY_INVIS_DIRECT 793 0.39 0.77 0.19 199 XM_ProductURIs 780 0.75 0.76 0.74 200 HELO_DYNAMIC_SPLIT_IP 777 0.26 0.76 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 163331 82.70 81.56 83.30 2 HTML_MESSAGE 159972 84.68 90.60 81.58 3 RELAYCOUNTRY_US 156064 79.11 78.19 79.59 4 DKIM_SIGNED 141327 78.56 90.99 72.07 5 XM_DK_Pass 139557 77.26 88.91 71.17 6 XM_B_Unicode 138974 76.58 87.51 70.87 7 DKIM_VALID 138578 76.58 87.90 70.67 8 DCC_CHECK_NEGATIVE 125905 51.09 25.98 64.21 9 DKIM_VALID_AU 118647 61.65 63.83 60.51 10 BAYES_50 113885 50.64 36.38 58.08 11 XMListUnsubscribeExists 102400 58.26 69.83 52.22 12 XM_B_SpammyWords 90046 56.10 75.60 45.92 13 XM_B_Unicode3 88697 45.22 45.19 45.23 14 DCC_CHECK 70130 48.89 74.01 35.77 15 HTML_FONT_LOW_CONTRAST 58074 31.12 33.99 29.62 16 LOC_TINY_FONT_1 55198 30.25 34.28 28.15 17 DKIM_VALID_EF 51970 29.10 34.08 26.50 18 XMSubLong 48797 22.96 19.28 24.89 19 MIME_HTML_ONLY 48557 26.39 29.50 24.76 20 FVGT_m_MULTI_ODD 48346 28.26 35.17 24.66 21 XM_B_SpammyWords2 44097 29.87 44.00 22.49 22 T_TM2_M_HEADER_IN_MSG 40747 20.59 20.22 20.78 23 T_KAM_HTML_FONT_INVALID 38431 21.51 25.16 19.60 24 RCVD_IN_MSPIKE_H2 38026 21.14 24.48 19.39 25 ALL_TRUSTED 33008 11.48 1.24 16.83 26 USER_IN_DEF_DKIM_WL 31615 11.47 2.56 16.12 27 XM_Multi_Part_URI 29708 16.03 17.71 15.15 28 TR_XM_DK_Unsub 26665 16.29 21.45 13.60 29 BAYES_60 20361 9.34 7.34 10.38 30 XM_DKIMWhitelistDomains 20333 6.83 0.06 10.37 31 XM_B_Unsub 20050 11.39 13.61 10.23 32 UNPARSEABLE_RELAY 19677 10.93 12.66 10.03 33 XM_Evil_Numbers_Gen 18064 8.51 7.16 9.21 34 MPART_ALT_DIFF 17728 7.77 5.33 9.04 35 BAYES_00 17720 6.13 0.57 9.04 36 T_TooManySym_01 16149 6.09 1.99 8.24 37 LotsOfNums_01 14471 6.65 5.26 7.38 38 RCVD_IN_VALIDITY_SAFE 14448 6.35 4.39 7.37 39 TooManyTo_001 13833 6.63 5.83 7.05 40 TR_XM_BayesUnsub 12671 8.78 13.23 6.46 41 XM_B_SpammyWords3 12650 9.71 15.96 6.45 42 XM_Body_Dirty_Words 12628 8.59 12.71 6.44 43 MIME_HTML_ONLY_MULTI 12306 5.06 2.73 6.28 44 RCVD_IN_VALIDITY_CERTIFIED 12306 5.37 3.64 6.28 45 HTML_IMAGE_RATIO_02 12284 6.72 7.61 6.26 46 XMStrtUSub 12094 5.59 4.47 6.17 47 TM2_M_URI_OPT_OUT 12052 4.98 2.74 6.15 48 XM_DK_Undo_02 11556 21.51 51.41 5.89 49 HTML_IMAGE_RATIO_04 11314 5.87 6.05 5.77 50 BOUNCE_MESSAGE 11158 4.06 0.95 5.69 51 ANY_BOUNCE_MESSAGE 11158 4.06 0.95 5.69 52 LOTS_OF_MONEY 11122 9.53 16.91 5.67 53 TR_XM_DK_Bayes 10620 3.69 0.38 5.42 54 TR_XM_DK_Bayes1 10560 3.67 0.37 5.39 55 BAYES_99 10314 16.55 38.16 5.26 56 RCVD_IN_MSPIKE_WL 10276 6.80 9.77 5.24 57 RCVD_IN_MSPIKE_H3 10276 6.80 9.77 5.24 58 IN_ZIMBRA_NJ_WHITELIST 10199 3.44 0.06 5.20 59 XM_H_Trusted_IP 9818 3.29 0.00 5.01 60 TR_XM_DK_Bayes2 9149 3.17 0.29 4.67 61 XM_H_Long_From01 9010 4.32 3.80 4.59 62 BAYES_80 8793 6.14 9.30 4.48 63 XMSubMetaSx_00 8745 4.97 5.93 4.46 64 XM_UncommonTLD01 8483 6.71 11.26 4.33 65 TR_XM_SpammyWords4 8219 8.04 15.41 4.19 66 BAYES_999 7956 12.98 30.05 4.06 67 BOTNET_IPINHOSTNAME 7918 7.63 14.50 4.04 68 BAYES_40 7880 3.09 1.30 4.02 69 MIME_HTML_MOSTLY 7693 4.14 4.55 3.92 70 RELAYCOUNTRY_META 7527 9.88 21.44 3.84 71 XM_B_Phish_Phrases 7489 4.07 4.54 3.82 72 XMSexyCombo_05 7078 4.47 6.13 3.61 73 INVALID_MSGID 6953 2.39 0.18 3.55 74 T_TooManySym_02 6936 2.54 0.63 3.54 75 T_XMDrugObfuBody_14 6891 3.97 4.85 3.51 76 SCC_BODY_URI_ONLY 6684 2.48 0.70 3.41 77 MIME_QP_LONG_LINE 6175 2.73 1.92 3.15 78 TO_MALFORMED 6129 2.07 0.06 3.13 79 BAYES_95 5906 3.77 5.23 3.01 80 BAYES_05 5745 2.15 0.65 2.93 81 XMNumbers 5720 3.04 3.26 2.92 82 TR_XM_DKIM_Undo 5699 16.17 41.57 2.91 83 BAYES_20 5481 2.20 1.07 2.80 84 FROM_EXCESS_BASE64 5179 2.58 2.46 2.64 85 RCVD_IN_IADB_LISTED 5113 2.06 1.03 2.61 86 HTML_IMAGE_RATIO_06 4928 2.83 3.43 2.51 87 XM_B_SpammyTLD 4871 2.57 2.74 2.48 88 XMBdyGiftCard01 4861 2.25 1.82 2.48 89 T_REMOTE_IMAGE 4845 2.35 2.13 2.47 90 RCVD_IN_IADB_SPF 4675 1.89 0.93 2.38 91 XM_PDF 4521 1.60 0.24 2.31 92 HTML_IMAGE_RATIO_08 4504 2.70 3.46 2.30 93 RCVD_IN_IADB_SENDERID 4324 1.75 0.87 2.21 94 XM_SPF_SoftFail 4304 2.50 3.09 2.19 95 FSL_BULK_SIG 4224 5.83 12.88 2.15 96 TR_XM_SpammyRelay 4138 7.55 17.98 2.11 97 RCVD_IN_IADB_DK 4131 1.69 0.88 2.11 98 XM_CamelCaseFrm001 4102 2.32 2.77 2.09 99 TR_XM_PhishingBody 4064 4.14 8.09 2.07 100 TooManyTo_002 4055 1.70 1.00 2.07 101 MAILING_LIST_MULTI 4030 1.82 1.38 2.06 102 TR_DCC_Bayes_99 3913 10.72 27.43 2.00 103 XMSubNoVowel 3839 1.44 0.44 1.96 104 XMGappySubj_01 3447 1.25 0.27 1.76 105 TVD_SPACE_RATIO 3372 1.16 0.10 1.72 106 IN_HORDE_ADDRESS_BOOK 3361 1.15 0.07 1.71 107 TR_XM_UnparsRelay 3286 3.72 7.63 1.68 108 RCVD_IN_IADB_VOUCHED 3259 1.23 0.41 1.66 109 UNTRUSTED_Relay 3167 3.00 5.65 1.62 110 RELAYCOUNTRY_CA 3163 5.71 13.57 1.61 111 XM_DK_Undo_01 3034 1.44 1.24 1.55 112 RCVD_IN_RP_SAFE 2973 1.31 0.93 1.52 113 XMStockSpam_06 2928 1.46 1.38 1.49 114 XMGappySubj_02 2924 1.01 0.08 1.49 115 XMDiploma_00 2921 1.68 2.04 1.49 116 XMBody_95 2891 1.00 0.08 1.47 117 XM_SendGrid 2812 1.74 2.34 1.43 118 DKIM_INVALID 2749 1.98 3.09 1.40 119 T_XMDrugObfuBody_08 2737 2.02 3.22 1.40 120 HTML_MIME_NO_HTML_TAG 2673 1.69 2.32 1.36 121 RCVD_IN_RP_CERTIFIED 2540 1.11 0.76 1.30 122 XM_B_Investor 2534 2.01 3.39 1.29 123 TVD_RCVD_IP 2533 1.13 0.81 1.29 124 TM2_M_VERY_LONG_WORD 2491 1.76 2.71 1.27 125 T_TooManySym_03 2437 0.91 0.27 1.24 126 XM_GoogleGroups 2383 0.96 0.47 1.22 127 TR_Symld_Words 2382 1.03 0.66 1.21 128 MSGID_NOFQDN1 2373 0.81 0.03 1.21 129 RCVD_IN_IADB_OPTIN 2333 0.88 0.30 1.19 130 URI_NOVOWEL 2283 1.03 0.78 1.16 131 XM_B_Unsub2 2192 1.31 1.69 1.12 132 TR_XM_DK_SendGrid 2111 0.96 0.74 1.08 133 TR_XM_SpammyWords5 2075 2.21 4.41 1.06 134 XM_B_COVIDMETA 2015 0.92 0.73 1.03 135 TooManyTo_003 2002 0.99 0.93 1.02 136 URI_HEX 1840 1.16 1.58 0.94 137 BOTNET 1832 3.79 9.25 0.93 138 XM_OfRef6 1805 1.65 3.05 0.92 139 XM_UB50 1738 1.52 2.73 0.89 140 XM_H_Long_From02 1704 1.01 1.27 0.87 141 TR_XM_Base64_M1 1678 0.89 0.95 0.86 142 XM_B_COPY_HTML 1642 0.87 0.93 0.84 143 TooManyTo_004 1613 0.85 0.91 0.82 144 XMPhish30 1604 1.19 1.90 0.82 145 DKIM_ADSP_CUSTOM_MED 1589 0.81 0.79 0.81 146 SUBJ_ALL_CAPS 1586 1.41 2.56 0.81 147 USER_IN_WELCOMELIST 1517 0.51 0.00 0.77 148 USER_IN_WHITELIST 1517 0.51 0.00 0.77 149 XM_B_FormFill 1495 0.52 0.06 0.76 150 XM_H_PHPMailer 1488 0.97 1.38 0.76 151 XM_ProductURIs 1459 0.75 0.76 0.74 152 TooManyTo_005 1384 0.77 0.89 0.71 153 T_XMDrugObfuBody_00 1355 1.01 1.61 0.69 154 TR_XM_SpammyWords2 1335 5.30 14.15 0.68 155 XM_B_SpammyWords4 1331 1.23 2.29 0.68 156 PLING_QUERY 1315 0.66 0.64 0.67 157 RCVD_IN_BL_SPAMCOP_NET 1301 6.41 17.42 0.66 158 MPART_ALT_DIFF_COUNT 1297 0.75 0.93 0.66 159 XMBody_17 1286 2.64 6.45 0.66 160 XMBSHREFv2 1279 0.50 0.22 0.65 161 KHOP_HELO_FCRDNS 1273 0.80 1.09 0.65 162 T_XMHurry_00 1242 1.05 1.84 0.63 163 TR_LOTS_OF_MONEY3 1230 1.92 4.41 0.63 164 URI_TRY_3LD 1195 1.10 2.05 0.61 165 HTML_TAG_BALANCE_BODY 1183 1.44 3.05 0.60 166 XMLngstWrd_00 1165 1.78 4.06 0.59 167 TR_MetaPhish_Combo_01 1150 0.75 1.05 0.59 168 XM_E_Blogspot 1130 0.43 0.15 0.58 169 FILL_THIS_FORM 1121 0.53 0.45 0.57 170 XMNoVowels 1116 0.50 0.38 0.57 171 SHOPIFY_IMG_NOT_RCVD_SFY 1093 0.61 0.71 0.56 172 NML_ADSP_CUSTOM_MED 1082 0.61 0.73 0.55 173 T_FILL_THIS_FORM_SHORT 1079 1.83 4.27 0.55 174 HTTPS_HTTP_MISMATCH 1059 1.04 1.99 0.54 175 XM_B_REG_HTML 1057 0.62 0.78 0.54 176 XMSubMetaI_00 1057 0.80 1.29 0.54 177 XMOemUri 1037 0.42 0.20 0.53 178 XMGenDplmaNmb 1009 0.62 0.81 0.51 179 XMPhish14 1000 0.53 0.56 0.51 180 HTML_FONT_FACE_BAD 972 0.70 1.09 0.50 181 T_OBFU_PDF_ATTACH 970 0.34 0.05 0.49 182 TM2_M_A_HREF_HREF 967 1.02 2.04 0.49 183 FORGED_GMAIL_RCVD 965 0.53 0.59 0.49 184 XMPhish08 962 0.49 0.47 0.49 185 XMBody_78 961 0.48 0.47 0.49 186 FILL_THIS_FORM_LONG 933 0.44 0.36 0.48 187 XM_RXBody 924 0.51 0.60 0.47 188 T_TooManySym_04 909 0.35 0.14 0.46 189 RELAYCOUNTRY_AU 896 0.97 1.96 0.46 190 XMBrknScrpt_02 895 0.55 0.73 0.46 191 HELO_NODOT 874 0.54 0.72 0.45 192 HELO_NO_DOMAIN 874 0.54 0.72 0.45 193 XM_ShortIntro_01 866 0.45 0.47 0.44 194 XMHTML_After_End 864 0.48 0.56 0.44 195 DATE_IN_PAST_03_06 852 0.37 0.25 0.43 196 TRACKER_ID 818 0.30 0.08 0.42 197 XMCapTrack 812 0.36 0.25 0.41 198 RCVD_IN_IADB_OPTIN_GT50 809 0.30 0.08 0.41 199 XM_B_DNDMA 795 0.43 0.47 0.41 200 SpammyFromTLD_01 784 1.20 2.73 0.40 ----------------------------------------------------------------------