Email: 499795 Autolearn: 0 AvgScore: 4.13 AvgScanTime: 1.28 sec Spam: 156748 Autolearn: 0 AvgScore: 13.86 AvgScanTime: 1.46 sec Ham: 343047 Autolearn: 0 AvgScore: -0.31 AvgScanTime: 1.19 sec Time Spent Running SA: 177.03 hours Time Spent Processing Spam: 63.77 hours Time Spent Processing Ham: 113.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 151000 87.76 96.33 83.85 2 DKIM_SIGNED 143033 79.63 91.25 74.32 3 XM_DK_Pass 135073 76.82 86.17 72.54 4 XM_B_Unicode 132997 72.27 84.85 66.52 5 DKIM_VALID 132354 75.50 84.44 71.42 6 T_SCC_BODY_TEXT_LINE 127725 82.67 81.48 83.21 7 RELAYCOUNTRY_US 122504 79.60 78.15 80.25 8 DCC_CHECK 116344 45.00 74.22 31.65 9 XM_B_SpammyWords 114307 52.00 72.92 42.44 10 XMListUnsubscribeExists 114188 55.61 72.85 47.73 11 DKIM_VALID_AU 96596 58.15 61.63 56.56 12 XM_DK_Undo_02 71480 17.87 45.60 5.20 13 XM_B_Unicode3 70169 39.51 44.77 37.10 14 TR_MAX_INTL_RELAY 67101 17.58 42.81 6.06 15 XM_B_SpammyWords2 66328 24.89 42.32 16.93 16 LOC_TINY_FONT_1 61563 28.56 39.28 23.67 17 BAYES_50 59146 52.81 37.73 59.70 18 BAYES_99 56920 14.06 36.31 3.89 19 TR_XM_DKIM_Undo 56062 12.58 35.77 1.99 20 HTML_FONT_LOW_CONTRAST 54670 29.17 34.88 26.56 21 MIME_HTML_ONLY 53747 23.52 34.29 18.61 22 DKIM_VALID_EF 52392 30.67 33.42 29.41 23 FVGT_m_MULTI_ODD 50714 27.90 32.35 25.86 24 T_KAM_HTML_FONT_INVALID 45143 22.90 28.80 20.21 25 BAYES_999 44420 10.93 28.34 2.97 26 TR_DCC_Bayes_99 41167 9.03 26.26 1.16 27 DCC_CHECK_NEGATIVE 40394 54.97 25.77 68.32 28 TR_XM_DK_Unsub 39195 17.38 25.01 13.89 29 T_TM2_M_HEADER_IN_MSG 37512 29.26 23.93 31.70 30 RCVD_IN_MSPIKE_H2 37501 24.03 23.92 24.08 31 RELAYCOUNTRY_META 35119 10.46 22.40 5.00 32 XMSubLong 34878 22.90 22.25 23.19 33 TR_XM_SpammyRelay 29143 7.53 18.59 2.47 34 XM_Multi_Part_URI 28070 14.62 17.91 13.12 35 XM_B_Unsub 23508 9.79 15.00 7.41 36 TR_XM_BayesUnsub 22760 8.48 14.52 5.72 37 TR_XM_SpammyWords2 22750 4.76 14.51 0.31 38 BOTNET_IPINHOSTNAME 22743 8.02 14.51 5.05 39 UNPARSEABLE_RELAY 22418 11.44 14.30 10.13 40 RCVD_IN_BL_SPAMCOP_NET 21254 4.66 13.56 0.60 41 LOTS_OF_MONEY 20856 8.53 13.31 6.35 42 RELAYCOUNTRY_CA 20709 5.18 13.21 1.51 43 XM_B_SpammyWords3 19718 6.52 12.58 3.76 44 TR_XM_SpammyWords4 18709 6.72 11.94 4.34 45 TR_XM_SPAMCOP 17504 3.67 11.17 0.24 46 BOTNET 17448 4.55 11.13 1.54 47 RCVD_IN_MSPIKE_H3 17326 7.84 11.05 6.37 48 RCVD_IN_MSPIKE_WL 17326 7.84 11.05 6.37 49 XM_Evil_Numbers_Gen 15393 8.30 9.82 7.60 50 BAYES_80 13456 5.38 8.58 3.92 51 FSL_BULK_SIG 13181 4.91 8.41 3.31 52 XM_Body_Dirty_Words 12751 5.00 8.13 3.56 53 BAYES_60 11803 8.45 7.53 8.87 54 TR_XM_UnparsRelay 11778 3.37 7.51 1.47 55 HTML_IMAGE_RATIO_02 10906 5.74 6.96 5.18 56 DKIM_INVALID 10679 4.13 6.81 2.90 57 LotsOfNums_01 10226 7.55 6.52 8.03 58 XMBody_17 10103 2.44 6.45 0.62 59 XM_UncommonTLD01 10070 4.60 6.42 3.76 60 BAYES_95 9855 3.45 6.29 2.16 61 MPART_ALT_DIFF 9599 4.23 6.12 3.37 62 XMSubMetaSx_00 9406 4.43 6.00 3.71 63 TooManyTo_001 9251 8.20 5.90 9.25 64 UNTRUSTED_Relay 9217 2.91 5.88 1.55 65 XM_H_Long_From01 8089 4.99 5.16 4.91 66 XMSexyCombo_05 8017 2.56 5.11 1.40 67 XM_B_Phish_Phrases 7950 4.05 5.07 3.58 68 T_FILL_THIS_FORM_SHORT 7728 2.25 4.93 1.03 69 HTML_IMAGE_RATIO_04 7326 4.17 4.67 3.94 70 TR_XM_BayesRelay 6688 1.34 4.27 0.00 71 XM_B_Investor 6651 2.42 4.24 1.59 72 XM_H_GMP 6567 5.85 4.19 6.61 73 TR_XM_SpammyWords5 6505 2.25 4.15 1.39 74 XM_SPF_SoftFail 6487 3.54 4.14 3.27 75 MIME_HTML_ONLY_MULTI 6477 2.60 4.13 1.89 76 HTML_IMAGE_RATIO_06 6443 2.78 4.11 2.17 77 TM2_M_URI_OPT_OUT 6424 2.89 4.10 2.34 78 XMNumbers 6308 3.12 4.02 2.71 79 XM_OfRef6 5950 2.05 3.80 1.26 80 TR_XM_PhishingBody 5814 2.22 3.71 1.54 81 T_XMDrugObfuBody_08 5777 2.26 3.69 1.60 82 T_XMDrugObfuBody_14 5737 2.36 3.66 1.76 83 XMStrtUSub 5665 4.12 3.61 4.36 84 XM_B_SpammyTLD 5577 2.69 3.56 2.30 85 MIME_HTML_MOSTLY 5568 2.57 3.55 2.11 86 RCVD_IN_VALIDITY_SAFE 5426 3.73 3.46 3.85 87 FONT_INVIS_LONG_LINE 4864 1.02 3.10 0.06 88 TR_XM_FormFill 4860 0.98 3.10 0.01 89 USER_IN_DEF_DKIM_WL 4753 8.66 3.03 11.23 90 SpammyFromTLD_01 4723 1.47 3.01 0.76 91 TR_LOTS_OF_MONEY3 4584 1.22 2.92 0.45 92 MIME_QP_LONG_LINE 4484 4.22 2.86 4.85 93 RCVD_IN_VALIDITY_CERTIFIED 4468 3.24 2.85 3.41 94 TM2_M_VERY_LONG_WORD 4433 1.79 2.83 1.32 95 XM_UB50 4401 1.49 2.81 0.89 96 HTML_IMAGE_RATIO_08 4330 2.09 2.76 1.78 97 XM_URI_RBL 4287 0.95 2.73 0.13 98 T_TooManySym_01 4194 5.83 2.68 7.27 99 XM_CamelCaseFrm001 4111 2.31 2.62 2.17 100 RELAYCOUNTRY_AU 4043 1.25 2.58 0.64 101 XMDiploma_00 3994 1.87 2.55 1.56 102 XM_B_SpammyWords4 3613 1.13 2.30 0.59 103 XM_B_Unsub2 3543 1.56 2.26 1.24 104 URI_HEX 3535 1.37 2.26 0.97 105 TR_Mismatch_TLD_02 3392 0.73 2.16 0.08 106 TR_XM_INV_DKIM 3295 0.70 2.10 0.06 107 T_REMOTE_IMAGE 3292 3.11 2.10 3.57 108 NO_DNS_FOR_FROM 3213 0.91 2.05 0.39 109 FROM_EXCESS_BASE64 3177 2.35 2.03 2.50 110 SUBJ_ALL_CAPS 3154 1.53 2.01 1.31 111 TR_XM_NoHeaderRelay 3131 0.72 2.00 0.13 112 SpammyFromTLD_02 2995 0.78 1.91 0.26 113 TR_XM_MaxWHORU 2986 0.78 1.90 0.27 114 XMReplyNow 2975 0.78 1.90 0.27 115 HK_RANDOM_REPLYTO 2945 0.66 1.88 0.10 116 TR_XM_PHPForged 2893 0.99 1.85 0.60 117 TR_XM_PHPDW 2885 0.99 1.84 0.60 118 MAILING_LIST_MULTI 2865 3.42 1.83 4.15 119 T_XMHurry_00 2845 0.85 1.82 0.41 120 TR_XM_FormFill2 2830 0.97 1.81 0.60 121 XM_H_PHPOS 2808 0.96 1.79 0.58 122 XM_DK_Undo_01 2801 2.01 1.79 2.11 123 XMStockSpam_06 2645 1.44 1.69 1.33 124 ANY_BOUNCE_MESSAGE 2623 3.65 1.67 4.56 125 BOUNCE_MESSAGE 2618 3.65 1.67 4.56 126 URI_TRY_3LD 2587 0.97 1.65 0.66 127 BOTNET_NORDNS 2553 0.52 1.63 0.01 128 RCVD_IN_IADB_LISTED 2547 3.41 1.62 4.23 129 XM_SendGrid 2525 1.47 1.61 1.41 130 HTTPS_HTTP_MISMATCH 2347 1.03 1.50 0.82 131 HTML_MIME_NO_HTML_TAG 2284 1.94 1.46 2.16 132 XM_HighProb1 2269 0.46 1.45 0.00 133 RCVD_IN_IADB_SPF 2227 3.02 1.42 3.75 134 XMBrknScrpt_02 2194 0.74 1.40 0.44 135 XM_DIRTYINTL 2181 0.61 1.39 0.25 136 BAYES_40 2142 3.68 1.37 4.73 137 AC_BR_BONANZA 2119 0.52 1.35 0.14 138 RCVD_IN_IADB_DK 2113 2.69 1.35 3.30 139 RCVD_IN_IADB_SENDERID 2112 2.75 1.35 3.39 140 XMBdyGiftCard01 2106 0.74 1.34 0.46 141 HTML_TAG_BALANCE_BODY 2099 0.74 1.34 0.47 142 KHOP_HELO_FCRDNS 2097 1.54 1.34 1.63 143 T_XMDrugObfuBody_10 2048 0.43 1.31 0.02 144 XMPhish30 2038 0.77 1.30 0.53 145 TR_Symld_Words 1976 1.56 1.26 1.69 146 ALL_TRUSTED 1948 11.58 1.24 16.30 147 XMGenDplmaNmb 1874 0.93 1.20 0.81 148 TM2_M_A_HREF_HREF 1864 0.58 1.19 0.30 149 XMHTML_After_End 1858 0.79 1.19 0.61 150 URI_NOVOWEL 1838 1.56 1.17 1.73 151 T_XMDrugObfuBody_00 1794 1.10 1.14 1.08 152 RDNS_DYNAMIC 1793 0.85 1.14 0.72 153 RCVD_IN_VALIDITY_RPBL 1744 0.41 1.11 0.09 154 XM_B_DNDMA 1737 0.60 1.11 0.37 155 TR_XM_InvalidRelay 1725 0.37 1.10 0.04 156 XM_UB99 1702 0.34 1.09 0.00 157 TR_XM_Base64_M1 1681 0.80 1.07 0.67 158 XM_H_Undi_Recip 1674 0.52 1.07 0.27 159 BAYES_20 1672 2.72 1.07 3.48 160 PLING_QUERY 1660 0.81 1.06 0.70 161 XM_H_PHPMailer 1656 0.98 1.06 0.94 162 RCVD_IN_PSBL 1628 0.54 1.04 0.31 163 TR_XM_DK_SendGrid 1620 0.94 1.03 0.90 164 TR_MetaPhish_Combo_01 1581 1.02 1.01 1.02 165 SUBJ_DOLLARS 1560 0.55 1.00 0.35 166 DKIM_ADSP_CUSTOM_MED 1523 0.96 0.97 0.96 167 XMLngstWrd_00 1523 0.78 0.97 0.69 168 PDS_OTHER_BAD_TLD 1509 0.39 0.96 0.12 169 DIET_1 1490 0.46 0.95 0.23 170 NORDNS_LOW_CONTRAST 1480 0.36 0.94 0.09 171 XMSubMetaI_00 1472 0.68 0.94 0.57 172 MPART_ALT_DIFF_COUNT 1441 0.63 0.92 0.50 173 URIBL_DBL_SPAM 1417 0.29 0.90 0.00 174 T_Symld_Words_02 1403 0.56 0.90 0.41 175 XMSexyCombo_01 1379 0.46 0.88 0.27 176 XM_B_COPY_HTML 1376 0.69 0.88 0.61 177 XM_B_Phish66 1365 0.53 0.87 0.37 178 XM_Combo_Sbj 1352 0.38 0.86 0.15 179 FORGED_GMAIL_RCVD 1341 0.64 0.86 0.54 180 TVD_RCVD_IP 1326 1.25 0.85 1.43 181 XM_UB999 1321 0.27 0.84 0.00 182 T_MONEY_PERCENT 1313 0.40 0.84 0.20 183 TR_LOTS_OF_MONEY2 1313 0.40 0.84 0.20 184 HOSTED_IMG_MULTI_PUB_01 1311 0.27 0.84 0.00 185 TooManyTo_002 1302 2.20 0.83 2.83 186 XMPhish14 1296 0.50 0.83 0.36 187 XM_H_Long_From02 1293 0.94 0.82 0.99 188 XM_ProductURIs 1278 0.78 0.82 0.77 189 SCC_BODY_URI_ONLY 1271 2.07 0.81 2.65 190 XM_B_SEO 1270 0.34 0.81 0.13 191 SHOPIFY_IMG_NOT_RCVD_SFY 1267 0.40 0.81 0.22 192 RELAYCOUNTRY_FR 1265 0.40 0.81 0.22 193 XM_B_COVIDMETA 1259 0.45 0.80 0.29 194 XM_UB60 1240 0.29 0.79 0.06 195 XMBody_78 1221 0.42 0.78 0.25 196 FORGED_RELAY_MUA_TO_MX 1178 0.25 0.75 0.02 197 DKIM_ADSP_NXDOMAIN 1173 0.41 0.75 0.26 198 TooManyTo_003 1171 1.42 0.75 1.72 199 T_TooManySym_02 1164 2.80 0.74 3.75 200 XM_B_Crypto 1161 0.36 0.74 0.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 287628 87.76 96.33 83.85 2 T_SCC_BODY_TEXT_LINE 285436 82.67 81.48 83.21 3 RELAYCOUNTRY_US 275308 79.60 78.15 80.25 4 DKIM_SIGNED 254936 79.63 91.25 74.32 5 XM_DK_Pass 248851 76.82 86.17 72.54 6 DKIM_VALID 244995 75.50 84.44 71.42 7 DCC_CHECK_NEGATIVE 234353 54.97 25.77 68.32 8 XM_B_Unicode 228182 72.27 84.85 66.52 9 BAYES_50 204805 52.81 37.73 59.70 10 DKIM_VALID_AU 194024 58.15 61.63 56.56 11 XMListUnsubscribeExists 163735 55.61 72.85 47.73 12 XM_B_SpammyWords 145583 52.00 72.92 42.44 13 XM_B_Unicode3 127283 39.51 44.77 37.10 14 T_TM2_M_HEADER_IN_MSG 108739 29.26 23.93 31.70 15 DCC_CHECK 108563 45.00 74.22 31.65 16 DKIM_VALID_EF 100896 30.67 33.42 29.41 17 HTML_FONT_LOW_CONTRAST 91098 29.17 34.88 26.56 18 FVGT_m_MULTI_ODD 88727 27.90 32.35 25.86 19 RCVD_IN_MSPIKE_H2 82603 24.03 23.92 24.08 20 LOC_TINY_FONT_1 81197 28.56 39.28 23.67 21 XMSubLong 79552 22.90 22.25 23.19 22 T_KAM_HTML_FONT_INVALID 69314 22.90 28.80 20.21 23 MIME_HTML_ONLY 63824 23.52 34.29 18.61 24 XM_B_SpammyWords2 58063 24.89 42.32 16.93 25 ALL_TRUSTED 55916 11.58 1.24 16.30 26 TR_XM_DK_Unsub 47654 17.38 25.01 13.89 27 XM_Multi_Part_URI 45014 14.62 17.91 13.12 28 USER_IN_DEF_DKIM_WL 38518 8.66 3.03 11.23 29 BAYES_00 35868 7.35 0.56 10.46 30 UNPARSEABLE_RELAY 34752 11.44 14.30 10.13 31 TooManyTo_001 31718 8.20 5.90 9.25 32 BAYES_60 30440 8.45 7.53 8.87 33 XM_DKIMWhitelistDomains 27910 5.61 0.07 8.14 34 LotsOfNums_01 27530 7.55 6.52 8.03 35 XM_Evil_Numbers_Gen 26083 8.30 9.82 7.60 36 XM_B_Unsub 25432 9.79 15.00 7.41 37 T_TooManySym_01 24952 5.83 2.68 7.27 38 TR_XM_DK_Bayes 23866 4.90 0.39 6.96 39 TR_XM_DK_Bayes1 23478 4.82 0.39 6.84 40 IN_ZIMBRA_NJ_WHITELIST 22935 4.61 0.08 6.69 41 XM_H_GMP 22685 5.85 4.19 6.61 42 RCVD_IN_MSPIKE_WL 21858 7.84 11.05 6.37 43 RCVD_IN_MSPIKE_H3 21858 7.84 11.05 6.37 44 LOTS_OF_MONEY 21781 8.53 13.31 6.35 45 TR_MAX_INTL_RELAY 20786 17.58 42.81 6.06 46 TR_XM_DK_Bayes2 20378 4.18 0.32 5.94 47 TR_XM_BayesUnsub 19618 8.48 14.52 5.72 48 XM_DK_Undo_02 17823 17.87 45.60 5.20 49 HTML_IMAGE_RATIO_02 17769 5.74 6.96 5.18 50 BOTNET_IPINHOSTNAME 17333 8.02 14.51 5.05 51 RELAYCOUNTRY_META 17147 10.46 22.40 5.00 52 XM_H_Long_From01 16858 4.99 5.16 4.91 53 MIME_QP_LONG_LINE 16631 4.22 2.86 4.85 54 BAYES_40 16227 3.68 1.37 4.73 55 XM_PDF 16221 3.46 0.68 4.73 56 ANY_BOUNCE_MESSAGE 15633 3.65 1.67 4.56 57 BOUNCE_MESSAGE 15629 3.65 1.67 4.56 58 XMStrtUSub 14949 4.12 3.61 4.36 59 TR_XM_SpammyWords4 14898 6.72 11.94 4.34 60 RCVD_IN_IADB_LISTED 14495 3.41 1.62 4.23 61 MAILING_LIST_MULTI 14224 3.42 1.83 4.15 62 HTML_IMAGE_RATIO_04 13520 4.17 4.67 3.94 63 BAYES_80 13432 5.38 8.58 3.92 64 BAYES_99 13354 14.06 36.31 3.89 65 RCVD_IN_VALIDITY_SAFE 13210 3.73 3.46 3.85 66 XM_UncommonTLD01 12914 4.60 6.42 3.76 67 XM_B_SpammyWords3 12891 6.52 12.58 3.76 68 RCVD_IN_IADB_SPF 12863 3.02 1.42 3.75 69 T_TooManySym_02 12855 2.80 0.74 3.75 70 XMSubMetaSx_00 12715 4.43 6.00 3.71 71 XM_B_Phish_Phrases 12277 4.05 5.07 3.58 72 T_REMOTE_IMAGE 12242 3.11 2.10 3.57 73 XM_Body_Dirty_Words 12226 5.00 8.13 3.56 74 BAYES_20 11945 2.72 1.07 3.48 75 RCVD_IN_VALIDITY_CERTIFIED 11714 3.24 2.85 3.41 76 RCVD_IN_IADB_SENDERID 11618 2.75 1.35 3.39 77 MPART_ALT_DIFF 11566 4.23 6.12 3.37 78 FSL_BULK_SIG 11342 4.91 8.41 3.31 79 RCVD_IN_IADB_DK 11324 2.69 1.35 3.30 80 XM_SPF_SoftFail 11206 3.54 4.14 3.27 81 BAYES_999 10194 10.93 28.34 2.97 82 DKIM_INVALID 9941 4.13 6.81 2.90 83 TooManyTo_002 9711 2.20 0.83 2.83 84 BAYES_05 9543 2.08 0.55 2.78 85 XMNumbers 9291 3.12 4.02 2.71 86 SCC_BODY_URI_ONLY 9092 2.07 0.81 2.65 87 RCVD_IN_IADB_VOUCHED 8854 2.00 0.71 2.58 88 FROM_EXCESS_BASE64 8564 2.35 2.03 2.50 89 TR_XM_SpammyRelay 8483 7.53 18.59 2.47 90 TM2_M_URI_OPT_OUT 8033 2.89 4.10 2.34 91 XM_B_SpammyTLD 7874 2.69 3.56 2.30 92 HTML_IMAGE_RATIO_06 7456 2.78 4.11 2.17 93 XM_CamelCaseFrm001 7429 2.31 2.62 2.17 94 HTML_MIME_NO_HTML_TAG 7422 1.94 1.46 2.16 95 BAYES_95 7400 3.45 6.29 2.16 96 HELO_NODOT 7330 1.64 0.56 2.14 97 HELO_NO_DOMAIN 7328 1.64 0.56 2.14 98 MIME_HTML_MOSTLY 7254 2.57 3.55 2.11 99 XM_DK_Undo_01 7236 2.01 1.79 2.11 100 INVALID_MSGID 7091 1.48 0.19 2.07 101 TR_XM_DKIM_Undo 6831 12.58 35.77 1.99 102 XMNoVowels 6514 1.47 0.54 1.90 103 MIME_HTML_ONLY_MULTI 6497 2.60 4.13 1.89 104 TO_MALFORMED 6308 1.27 0.02 1.84 105 HTML_IMAGE_RATIO_08 6091 2.09 2.76 1.78 106 T_XMDrugObfuBody_14 6050 2.36 3.66 1.76 107 RCVD_IN_IADB_OPTIN 6006 1.34 0.44 1.75 108 URI_NOVOWEL 5944 1.56 1.17 1.73 109 TooManyTo_003 5914 1.42 0.75 1.72 110 TR_Symld_Words 5809 1.56 1.26 1.69 111 KHOP_HELO_FCRDNS 5596 1.54 1.34 1.63 112 T_XMDrugObfuBody_08 5505 2.26 3.69 1.60 113 XM_B_Investor 5468 2.42 4.24 1.59 114 XMDiploma_00 5349 1.87 2.55 1.56 115 UNTRUSTED_Relay 5326 2.91 5.88 1.55 116 BOTNET 5285 4.55 11.13 1.54 117 TR_XM_PhishingBody 5279 2.22 3.71 1.54 118 RELAYCOUNTRY_CA 5194 5.18 13.21 1.51 119 IN_HORDE_ADDRESS_BOOK 5103 1.05 0.08 1.49 120 TR_XM_UnparsRelay 5045 3.37 7.51 1.47 121 T_TooManySym_03 5011 1.09 0.28 1.46 122 TVD_RCVD_IP 4911 1.25 0.85 1.43 123 XM_SendGrid 4822 1.47 1.61 1.41 124 XMSexyCombo_05 4788 2.56 5.11 1.40 125 TR_XM_SpammyWords5 4762 2.25 4.15 1.39 126 XM_GoogleGroups 4612 1.07 0.46 1.34 127 XMStockSpam_06 4575 1.44 1.69 1.33 128 TM2_M_VERY_LONG_WORD 4515 1.79 2.83 1.32 129 XMCapTrack 4510 1.03 0.40 1.31 130 SUBJ_ALL_CAPS 4503 1.53 2.01 1.31 131 TooManyTo_004 4414 1.10 0.70 1.29 132 XMGappySubj_01 4387 0.98 0.32 1.28 133 XM_OfRef6 4316 2.05 3.80 1.26 134 XM_B_Unsub2 4259 1.56 2.26 1.24 135 TVD_SPACE_RATIO 4054 0.86 0.17 1.18 136 XMBody_95 4007 0.93 0.40 1.17 137 TR_DCC_Bayes_99 3985 9.03 26.26 1.16 138 XMBSHREFv2 3976 0.92 0.40 1.16 139 TooManyTo_005 3719 0.95 0.66 1.08 140 T_XMDrugObfuBody_00 3718 1.10 1.14 1.08 141 T_FILL_THIS_FORM_SHORT 3532 2.25 4.93 1.03 142 TR_MetaPhish_Combo_01 3496 1.02 1.01 1.02 143 XM_H_Long_From02 3381 0.94 0.82 0.99 144 URI_HEX 3328 1.37 2.26 0.97 145 DKIM_ADSP_CUSTOM_MED 3286 0.96 0.97 0.96 146 XM_H_PHPMailer 3225 0.98 1.06 0.94 147 TR_XM_DK_SendGrid 3072 0.94 1.03 0.90 148 XM_UB50 3036 1.49 2.81 0.89 149 HTTPS_HTTP_MISMATCH 2814 1.03 1.50 0.82 150 FROM_GOV_DKIM_AU 2782 0.60 0.14 0.81 151 XMGenDplmaNmb 2767 0.93 1.20 0.81 152 RELAYCOUNTRY_NL 2745 0.68 0.42 0.80 153 XMGappySubj_02 2656 0.56 0.10 0.77 154 XM_ProductURIs 2631 0.78 0.82 0.77 155 XM_ShortIntro_01 2625 0.66 0.43 0.77 156 SpammyFromTLD_01 2608 1.47 3.01 0.76 157 RCVD_IN_RP_SAFE 2531 0.73 0.70 0.74 158 T_TooManySym_04 2509 0.54 0.13 0.73 159 RDNS_DYNAMIC 2472 0.85 1.14 0.72 160 PLING_QUERY 2398 0.81 1.06 0.70 161 XMLngstWrd_00 2377 0.78 0.97 0.69 162 MSGID_NOFQDN1 2319 0.47 0.01 0.68 163 TR_XM_Base64_M1 2305 0.80 1.07 0.67 164 XM_RXBody 2290 0.65 0.61 0.67 165 RCVD_IN_RP_CERTIFIED 2270 0.62 0.54 0.66 166 SHORT_HELO_AND_INLINE_IMAGE 2261 0.47 0.06 0.66 167 URI_TRY_3LD 2253 0.97 1.65 0.66 168 TR_XM_SB_Phish 2250 0.58 0.40 0.66 169 XM_H_Trusted_IP 2197 0.44 0.00 0.64 170 RELAYCOUNTRY_AU 2195 1.25 2.58 0.64 171 NML_ADSP_CUSTOM_MED 2128 0.65 0.71 0.62 172 XMBody_17 2115 2.44 6.45 0.62 173 XM_B_COPY_HTML 2093 0.69 0.88 0.61 174 XMHTML_After_End 2082 0.79 1.19 0.61 175 TO_NO_BRKTS_HTML_ONLY 2075 0.47 0.17 0.60 176 FILL_THIS_FORM 2066 0.49 0.24 0.60 177 TR_XM_PHPForged 2063 0.99 1.85 0.60 178 RCVD_IN_BL_SPAMCOP_NET 2051 4.66 13.56 0.60 179 TR_XM_PHPDW 2051 0.99 1.84 0.60 180 HTML_IMAGE_ONLY_32 2049 0.48 0.22 0.60 181 TR_XM_FormFill2 2042 0.97 1.81 0.60 182 XM_B_SpammyWords4 2034 1.13 2.30 0.59 183 XMSubPhish11 2023 0.52 0.35 0.59 184 USER_IN_WELCOMELIST 1992 0.40 0.00 0.58 185 USER_IN_WHITELIST 1992 0.40 0.00 0.58 186 XM_H_PHPOS 1976 0.96 1.79 0.58 187 XMSubMetaI_00 1943 0.68 0.94 0.57 188 T_OBFU_PDF_ATTACH 1893 0.40 0.08 0.55 189 FORGED_GMAIL_RCVD 1865 0.64 0.86 0.54 190 XMPhish30 1809 0.77 1.30 0.53 191 XMSubNoVowel 1796 0.47 0.34 0.52 192 RELAYCOUNTRY_GB 1742 0.55 0.64 0.51 193 MPART_ALT_DIFF_COUNT 1721 0.63 0.92 0.50 194 XMMoneyMeta_00 1715 0.49 0.47 0.50 195 XM_B_FormFill 1669 0.34 0.04 0.49 196 HTML_IMAGE_ONLY_20 1600 0.49 0.54 0.47 197 HTML_TAG_BALANCE_BODY 1598 0.74 1.34 0.47 198 HTML_IMAGE_ONLY_28 1590 0.41 0.30 0.46 199 XMBdyGiftCard01 1571 0.74 1.34 0.46 200 RCVD_IN_SORBS_DUL 1563 0.33 0.05 0.46 ----------------------------------------------------------------------