Email: 542817 Autolearn: 0 AvgScore: 4.03 AvgScanTime: 1.16 sec Spam: 170603 Autolearn: 0 AvgScore: 13.09 AvgScanTime: 1.30 sec Ham: 372214 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 1.10 sec Time Spent Running SA: 175.48 hours Time Spent Processing Spam: 61.42 hours Time Spent Processing Ham: 114.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164615 89.54 96.49 86.35 2 DKIM_SIGNED 155009 79.12 90.86 73.73 3 XM_DK_Pass 148181 76.94 86.86 72.40 4 DKIM_VALID 146731 76.02 86.01 71.44 5 XM_B_Unicode 145596 73.84 85.34 68.57 6 RELAYCOUNTRY_US 140534 80.26 82.37 79.29 7 T_SCC_BODY_TEXT_LINE 137844 82.51 80.80 83.30 8 DCC_CHECK 123695 45.11 72.50 32.55 9 XM_B_SpammyWords 122866 52.86 72.02 44.08 10 XMListUnsubscribeExists 122852 57.08 72.01 50.23 11 DKIM_VALID_AU 110356 59.40 64.69 56.98 12 XM_B_Unicode3 75581 41.13 44.30 39.68 13 XM_DK_Undo_02 73944 17.64 43.34 5.86 14 LOC_TINY_FONT_1 70649 29.40 41.41 23.90 15 XM_B_SpammyWords2 70073 25.47 41.07 18.31 16 BAYES_50 66432 53.01 38.94 59.46 17 HTML_FONT_LOW_CONTRAST 64471 32.28 37.79 29.76 18 FVGT_m_MULTI_ODD 59481 28.72 34.87 25.90 19 BAYES_99 59190 14.18 34.69 4.77 20 TR_XM_DKIM_Undo 55613 11.85 32.60 2.34 21 DKIM_VALID_EF 52194 28.75 30.59 27.90 22 MIME_HTML_ONLY 51040 22.16 29.92 18.60 23 T_KAM_HTML_FONT_INVALID 48417 23.39 28.38 21.10 24 DCC_CHECK_NEGATIVE 46876 54.86 27.48 67.41 25 BAYES_999 46412 11.15 27.20 3.79 26 RCVD_IN_MSPIKE_H2 46346 25.43 27.17 24.64 27 TR_DCC_Bayes_99 41403 8.61 24.27 1.44 28 T_TM2_M_HEADER_IN_MSG 40844 26.15 23.94 27.17 29 XMSubLong 38690 22.14 22.68 21.90 30 TR_XM_DK_Unsub 37604 16.36 22.04 13.76 31 XM_Multi_Part_URI 30565 15.34 17.92 14.15 32 RELAYCOUNTRY_META 28750 8.21 16.85 4.25 33 LOTS_OF_MONEY 28460 10.01 16.68 6.95 34 XM_B_Unsub 27728 10.53 16.25 7.91 35 TR_XM_BayesUnsub 26712 9.23 15.66 6.28 36 TR_MAX_INTL_RELAY 25337 9.25 14.85 6.68 37 TR_XM_SpammyWords4 24999 7.80 14.65 4.66 38 UNPARSEABLE_RELAY 24280 12.03 14.23 11.02 39 BOTNET_IPINHOSTNAME 23933 7.55 14.03 4.58 40 TR_XM_SpammyWords2 22647 4.50 13.27 0.48 41 TR_XM_SpammyRelay 22326 5.75 13.09 2.39 42 XM_B_SpammyWords3 21982 6.96 12.88 4.24 43 RCVD_IN_BL_SPAMCOP_NET 18270 3.84 10.71 0.69 44 XM_Body_Dirty_Words 17032 5.92 9.98 4.06 45 BOTNET 16719 3.99 9.80 1.32 46 BAYES_80 15602 5.68 9.15 4.09 47 XM_Evil_Numbers_Gen 15373 7.74 9.01 7.16 48 FSL_BULK_SIG 15329 5.15 8.99 3.39 49 RELAYCOUNTRY_CA 13979 3.33 8.19 1.10 50 TR_XM_SPAMCOP 13842 2.75 8.11 0.29 51 TR_XM_UnparsRelay 13067 3.60 7.66 1.73 52 BAYES_60 12901 8.56 7.56 9.02 53 LotsOfNums_01 12296 8.06 7.21 8.44 54 RCVD_IN_MSPIKE_WL 11806 6.25 6.92 5.94 55 RCVD_IN_MSPIKE_H3 11806 6.25 6.92 5.94 56 HTML_IMAGE_RATIO_02 11224 5.56 6.58 5.09 57 UNTRUSTED_Relay 11140 3.16 6.53 1.61 58 TR_LOTS_OF_MONEY3 10505 2.61 6.16 0.99 59 XMSubMetaSx_00 10416 5.13 6.11 4.68 60 HTML_IMAGE_RATIO_04 10407 4.57 6.10 3.87 61 XMBody_17 9841 2.34 5.77 0.76 62 TooManyTo_001 9538 7.39 5.59 8.21 63 XM_UncommonTLD01 9404 4.09 5.51 3.44 64 MPART_ALT_DIFF 9388 5.20 5.50 5.07 65 BAYES_95 9126 3.46 5.35 2.59 66 XM_H_Long_From01 8664 5.06 5.08 5.05 67 XMSexyCombo_05 8526 2.77 5.00 1.74 68 XM_B_Phish_Phrases 8472 3.76 4.97 3.21 69 XM_SPF_SoftFail 8354 3.54 4.90 2.91 70 DKIM_INVALID 8278 3.10 4.85 2.29 71 HTML_IMAGE_RATIO_06 7858 3.12 4.61 2.44 72 XMNumbers 7805 3.34 4.57 2.77 73 XM_B_Investor 7539 2.56 4.42 1.70 74 TR_XM_SpammyWords5 7470 2.35 4.38 1.42 75 XM_H_GMP 6945 5.48 4.07 6.12 76 XM_B_SpammyTLD 6937 3.06 4.07 2.60 77 MIME_QP_LONG_LINE 6693 4.93 3.92 5.39 78 XM_UB50 6583 1.95 3.86 1.07 79 XMStrtUSub 6580 4.22 3.86 4.39 80 T_XMDrugObfuBody_08 6537 2.27 3.83 1.56 81 TR_XM_PhishingBody 6364 2.38 3.73 1.77 82 XM_OfRef6 5917 1.86 3.47 1.12 83 T_XMDrugObfuBody_14 5733 2.17 3.36 1.63 84 TM2_M_URI_OPT_OUT 5710 2.31 3.35 1.84 85 MIME_HTML_ONLY_MULTI 5670 2.54 3.32 2.19 86 T_FILL_THIS_FORM_SHORT 5595 1.70 3.28 0.97 87 MIME_HTML_MOSTLY 5217 3.32 3.06 3.44 88 XMBrknScrpt_02 5040 1.38 2.95 0.65 89 XM_URI_RBL 4645 0.97 2.72 0.17 90 TM2_M_VERY_LONG_WORD 4599 1.67 2.70 1.19 91 HTML_IMAGE_RATIO_08 4419 2.24 2.59 2.08 92 RCVD_IN_VALIDITY_SAFE 4393 3.53 2.57 3.97 93 SpammyFromTLD_01 4351 1.26 2.55 0.66 94 XM_B_Unsub2 4283 1.77 2.51 1.42 95 XM_CamelCaseFrm001 4264 2.35 2.50 2.28 96 TR_XM_PHPForged 4187 1.00 2.45 0.34 97 TR_XM_PHPDW 4162 1.00 2.44 0.33 98 TR_XM_FormFill2 4107 0.98 2.41 0.33 99 XMDiploma_00 4095 1.66 2.40 1.31 100 XM_H_PHPOS 4085 0.97 2.39 0.32 101 TR_XM_BayesRelay 3923 0.72 2.30 0.00 102 T_TooManySym_01 3917 4.21 2.30 5.09 103 T_XMHurry_00 3785 1.06 2.22 0.53 104 RELAYCOUNTRY_AU 3726 1.32 2.18 0.93 105 XM_B_SpammyWords4 3607 1.07 2.11 0.59 106 USER_IN_DEF_DKIM_WL 3522 8.63 2.06 11.64 107 FONT_INVIS_LONG_LINE 3479 0.75 2.04 0.16 108 TR_XM_NoHeaderRelay 3478 0.71 2.04 0.10 109 FROM_EXCESS_BASE64 3462 2.02 2.03 2.01 110 RCVD_IN_VALIDITY_CERTIFIED 3459 3.04 2.03 3.51 111 RCVD_IN_IADB_LISTED 3371 3.80 1.98 4.64 112 URI_HEX 3366 1.44 1.97 1.20 113 TR_XM_FormFill 3350 0.62 1.96 0.01 114 TR_XM_INV_DKIM 3192 0.62 1.87 0.04 115 ANY_BOUNCE_MESSAGE 3168 3.43 1.86 4.15 116 BOUNCE_MESSAGE 3164 3.43 1.85 4.15 117 SUBJ_ALL_CAPS 3095 1.43 1.81 1.26 118 HTML_MIME_NO_HTML_TAG 3020 2.07 1.77 2.20 119 RCVD_IN_IADB_SPF 2998 3.40 1.76 4.15 120 XM_H_Long_From02 2985 1.28 1.75 1.07 121 T_REMOTE_IMAGE 2962 2.84 1.74 3.35 122 BAYES_40 2887 3.78 1.69 4.73 123 RCVD_IN_IADB_SENDERID 2873 3.11 1.68 3.77 124 RCVD_IN_IADB_DK 2863 3.04 1.68 3.67 125 MAILING_LIST_MULTI 2860 2.43 1.68 2.77 126 URI_TRY_3LD 2857 1.11 1.67 0.84 127 AC_BR_BONANZA 2819 0.59 1.65 0.10 128 XM_DK_Undo_01 2783 1.70 1.63 1.73 129 XMStockSpam_06 2755 1.16 1.61 0.95 130 RCVD_IN_PSBL 2656 0.68 1.56 0.27 131 HTTPS_HTTP_MISMATCH 2640 1.10 1.55 0.90 132 SpammyFromTLD_02 2619 0.78 1.54 0.43 133 XMSexyCombo_01 2456 0.69 1.44 0.35 134 HTML_TAG_BALANCE_BODY 2454 0.72 1.44 0.40 135 XM_DIRTYINTL 2445 0.61 1.43 0.23 136 XM_HighProb1 2415 0.45 1.42 0.00 137 BOTNET_NORDNS 2355 0.44 1.38 0.01 138 SCC_BODY_URI_ONLY 2313 2.13 1.36 2.48 139 XMBdyGiftCard01 2311 0.89 1.35 0.68 140 XM_SendGrid 2305 1.35 1.35 1.35 141 KHOP_HELO_FCRDNS 2284 1.17 1.34 1.09 142 RCVD_IN_VALIDITY_RPBL 2231 0.47 1.31 0.09 143 XMPhish30 2228 0.74 1.31 0.48 144 XMSubMetaI_00 2197 0.84 1.29 0.64 145 BAYES_20 2197 2.79 1.29 3.48 146 XMClaimOffer 2084 0.55 1.22 0.24 147 PLING_QUERY 2075 0.63 1.22 0.37 148 XMGenDplmaNmb 2074 0.85 1.22 0.68 149 T_XMDrugObfuBody_00 1998 0.88 1.17 0.75 150 TR_XM_InvalidRelay 1974 0.38 1.16 0.02 151 TR_Mismatch_TLD_02 1904 0.41 1.12 0.08 152 URI_NOVOWEL 1887 1.67 1.11 1.93 153 DKIM_ADSP_CUSTOM_MED 1875 0.90 1.10 0.80 154 ALL_TRUSTED 1860 12.21 1.09 17.31 155 HK_RANDOM_REPLYTO 1854 0.40 1.09 0.09 156 XMHTML_After_End 1831 0.81 1.07 0.68 157 XMReplyNow 1830 0.50 1.07 0.23 158 TR_XM_Base64_M1 1765 0.88 1.03 0.81 159 DATE_IN_PAST_03_06 1718 0.38 1.01 0.09 160 TR_Symld_Words 1717 1.25 1.01 1.36 161 XM_B_Phish66 1693 0.51 0.99 0.28 162 RELAYCOUNTRY_FR 1673 0.45 0.98 0.21 163 FORGED_GMAIL_RCVD 1657 0.63 0.97 0.47 164 XMBody_78 1650 0.50 0.97 0.29 165 XMPhish14 1621 0.69 0.95 0.57 166 NML_ADSP_CUSTOM_MED 1574 0.65 0.92 0.53 167 XM_H_PHPMailer 1570 0.73 0.92 0.65 168 TR_MetaPhish_Combo_01 1551 0.82 0.91 0.77 169 RDNS_DYNAMIC 1487 0.55 0.87 0.40 170 XM_B_COVIDMETA 1485 0.41 0.87 0.21 171 XMLngstWrd_00 1482 0.69 0.87 0.61 172 TR_XM_Spammywords 1460 0.48 0.86 0.30 173 XM_S_SpammyWords 1460 0.48 0.86 0.30 174 T_XMDrugObfuBody_10 1452 0.29 0.85 0.04 175 XM_UB99 1445 0.27 0.85 0.00 176 T_TooManySym_02 1433 1.96 0.84 2.48 177 TR_XM_DK_SendGrid 1427 0.87 0.84 0.89 178 DEAR_FRIEND 1407 0.31 0.82 0.08 179 MISSING_HEADERS 1393 0.52 0.82 0.38 180 SHOPIFY_IMG_NOT_RCVD_SFY 1375 0.47 0.81 0.32 181 TM2_M_BODY_EMPTY 1358 0.60 0.80 0.51 182 MPART_ALT_DIFF_COUNT 1350 0.57 0.79 0.47 183 TooManyTo_002 1349 1.88 0.79 2.39 184 HTML_IMAGE_ONLY_32 1345 0.57 0.79 0.47 185 AC_HTML_NONSENSE_TAGS 1324 0.28 0.78 0.05 186 TVD_RCVD_IP 1319 1.25 0.77 1.47 187 REMOVE_BEFORE_LINK 1310 0.42 0.77 0.25 188 XM_B_COPY_HTML 1300 0.55 0.76 0.45 189 RCVD_IN_IADB_VOUCHED 1288 2.11 0.75 2.73 190 BAYES_00 1288 6.57 0.75 9.23 191 XM_ProductURIs 1287 0.60 0.75 0.54 192 XM_B_DNDMA 1259 0.44 0.74 0.30 193 XMEmptyBody_01 1257 0.27 0.74 0.05 194 SUBJ_DOLLARS 1256 0.47 0.74 0.34 195 READY_TO_SHIP 1230 0.30 0.72 0.10 196 XMDateMe_00 1215 0.51 0.71 0.41 197 XM_Combo_Sbj 1214 0.40 0.71 0.25 198 XMSexyCombo_04 1204 0.28 0.71 0.08 199 TooManyTo_003 1191 1.17 0.70 1.39 200 TM2_M_OBFU_COMMENT 1187 0.39 0.70 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 321417 89.54 96.49 86.35 2 T_SCC_BODY_TEXT_LINE 310037 82.51 80.80 83.30 3 RELAYCOUNTRY_US 295129 80.26 82.37 79.29 4 DKIM_SIGNED 274446 79.12 90.86 73.73 5 XM_DK_Pass 269466 76.94 86.86 72.40 6 DKIM_VALID 265906 76.02 86.01 71.44 7 XM_B_Unicode 255221 73.84 85.34 68.57 8 DCC_CHECK_NEGATIVE 250911 54.86 27.48 67.41 9 BAYES_50 221327 53.01 38.94 59.46 10 DKIM_VALID_AU 212103 59.40 64.69 56.98 11 XMListUnsubscribeExists 186963 57.08 72.01 50.23 12 XM_B_SpammyWords 164059 52.86 72.02 44.08 13 XM_B_Unicode3 147697 41.13 44.30 39.68 14 DCC_CHECK 121157 45.11 72.50 32.55 15 HTML_FONT_LOW_CONTRAST 110775 32.28 37.79 29.76 16 DKIM_VALID_EF 103843 28.75 30.59 27.90 17 T_TM2_M_HEADER_IN_MSG 101129 26.15 23.94 27.17 18 FVGT_m_MULTI_ODD 96407 28.72 34.87 25.90 19 RCVD_IN_MSPIKE_H2 91716 25.43 27.17 24.64 20 LOC_TINY_FONT_1 88955 29.40 41.41 23.90 21 XMSubLong 81512 22.14 22.68 21.90 22 T_KAM_HTML_FONT_INVALID 78555 23.39 28.38 21.10 23 MIME_HTML_ONLY 69229 22.16 29.92 18.60 24 XM_B_SpammyWords2 68168 25.47 41.07 18.31 25 ALL_TRUSTED 64428 12.21 1.09 17.31 26 XM_Multi_Part_URI 52683 15.34 17.92 14.15 27 TR_XM_DK_Unsub 51207 16.36 22.04 13.76 28 USER_IN_DEF_DKIM_WL 43314 8.63 2.06 11.64 29 UNPARSEABLE_RELAY 41024 12.03 14.23 11.02 30 BAYES_00 34367 6.57 0.75 9.23 31 BAYES_60 33566 8.56 7.56 9.02 32 LotsOfNums_01 31432 8.06 7.21 8.44 33 TooManyTo_001 30572 7.39 5.59 8.21 34 XM_B_Unsub 29426 10.53 16.25 7.91 35 XM_DKIMWhitelistDomains 28038 5.18 0.03 7.53 36 XM_Evil_Numbers_Gen 26667 7.74 9.01 7.16 37 LOTS_OF_MONEY 25851 10.01 16.68 6.95 38 TR_MAX_INTL_RELAY 24874 9.25 14.85 6.68 39 IN_ZIMBRA_NJ_WHITELIST 24723 4.58 0.07 6.64 40 TR_XM_DK_Bayes 23942 4.60 0.60 6.43 41 TR_XM_DK_Bayes1 23614 4.54 0.59 6.34 42 TR_XM_BayesUnsub 23382 9.23 15.66 6.28 43 XM_H_GMP 22791 5.48 4.07 6.12 44 RCVD_IN_MSPIKE_WL 22115 6.25 6.92 5.94 45 RCVD_IN_MSPIKE_H3 22115 6.25 6.92 5.94 46 XM_DK_Undo_02 21796 17.64 43.34 5.86 47 TR_XM_DK_Bayes2 20283 3.88 0.45 5.45 48 XM_PDF 20163 3.89 0.57 5.42 49 MIME_QP_LONG_LINE 20048 4.93 3.92 5.39 50 HTML_IMAGE_RATIO_02 18933 5.56 6.58 5.09 51 T_TooManySym_01 18931 4.21 2.30 5.09 52 MPART_ALT_DIFF 18864 5.20 5.50 5.07 53 XM_H_Long_From01 18805 5.06 5.08 5.05 54 BAYES_99 17770 14.18 34.69 4.77 55 BAYES_40 17618 3.78 1.69 4.73 56 XMSubMetaSx_00 17421 5.13 6.11 4.68 57 TR_XM_SpammyWords4 17363 7.80 14.65 4.66 58 RCVD_IN_IADB_LISTED 17270 3.80 1.98 4.64 59 BOTNET_IPINHOSTNAME 17059 7.55 14.03 4.58 60 XMStrtUSub 16344 4.22 3.86 4.39 61 RELAYCOUNTRY_META 15831 8.21 16.85 4.25 62 XM_B_SpammyWords3 15794 6.96 12.88 4.24 63 ANY_BOUNCE_MESSAGE 15447 3.43 1.86 4.15 64 BOUNCE_MESSAGE 15446 3.43 1.85 4.15 65 RCVD_IN_IADB_SPF 15435 3.40 1.76 4.15 66 BAYES_80 15219 5.68 9.15 4.09 67 XM_Body_Dirty_Words 15102 5.92 9.98 4.06 68 RCVD_IN_VALIDITY_SAFE 14780 3.53 2.57 3.97 69 HTML_IMAGE_RATIO_04 14394 4.57 6.10 3.87 70 BAYES_999 14096 11.15 27.20 3.79 71 RCVD_IN_IADB_SENDERID 14017 3.11 1.68 3.77 72 RCVD_IN_IADB_DK 13663 3.04 1.68 3.67 73 RCVD_IN_VALIDITY_CERTIFIED 13053 3.04 2.03 3.51 74 BAYES_20 12938 2.79 1.29 3.48 75 MIME_HTML_MOSTLY 12821 3.32 3.06 3.44 76 XM_UncommonTLD01 12804 4.09 5.51 3.44 77 FSL_BULK_SIG 12626 5.15 8.99 3.39 78 T_REMOTE_IMAGE 12478 2.84 1.74 3.35 79 XM_B_Phish_Phrases 11946 3.76 4.97 3.21 80 XM_SPF_SoftFail 10837 3.54 4.90 2.91 81 MAILING_LIST_MULTI 10317 2.43 1.68 2.77 82 XMNumbers 10304 3.34 4.57 2.77 83 RCVD_IN_IADB_VOUCHED 10143 2.11 0.75 2.73 84 BAYES_05 9757 1.98 0.57 2.62 85 XM_B_SpammyTLD 9662 3.06 4.07 2.60 86 BAYES_95 9648 3.46 5.35 2.59 87 SCC_BODY_URI_ONLY 9242 2.13 1.36 2.48 88 T_TooManySym_02 9220 1.96 0.84 2.48 89 HTML_IMAGE_RATIO_06 9090 3.12 4.61 2.44 90 TR_XM_SpammyRelay 8879 5.75 13.09 2.39 91 TooManyTo_002 8879 1.88 0.79 2.39 92 TR_XM_DKIM_Undo 8709 11.85 32.60 2.34 93 DKIM_INVALID 8540 3.10 4.85 2.29 94 XM_CamelCaseFrm001 8501 2.35 2.50 2.28 95 HTML_MIME_NO_HTML_TAG 8194 2.07 1.77 2.20 96 MIME_HTML_ONLY_MULTI 8141 2.54 3.32 2.19 97 HTML_IMAGE_RATIO_08 7749 2.24 2.59 2.08 98 FROM_EXCESS_BASE64 7477 2.02 2.03 2.01 99 URI_NOVOWEL 7184 1.67 1.11 1.93 100 INVALID_MSGID 7105 1.38 0.21 1.91 101 TM2_M_URI_OPT_OUT 6850 2.31 3.35 1.84 102 RCVD_IN_IADB_OPTIN 6823 1.40 0.45 1.83 103 TR_XM_PhishingBody 6576 2.38 3.73 1.77 104 XMSexyCombo_05 6492 2.77 5.00 1.74 105 XM_DK_Undo_01 6449 1.70 1.63 1.73 106 TR_XM_UnparsRelay 6448 3.60 7.66 1.73 107 HELO_NODOT 6339 1.35 0.59 1.70 108 XM_B_Investor 6334 2.56 4.42 1.70 109 HELO_NO_DOMAIN 6334 1.35 0.59 1.70 110 TO_MALFORMED 6251 1.15 0.01 1.68 111 T_XMDrugObfuBody_14 6068 2.17 3.36 1.63 112 UNTRUSTED_Relay 6000 3.16 6.53 1.61 113 T_XMDrugObfuBody_08 5812 2.27 3.83 1.56 114 TVD_RCVD_IP 5465 1.25 0.77 1.47 115 TR_DCC_Bayes_99 5358 8.61 24.27 1.44 116 XM_B_Unsub2 5302 1.77 2.51 1.42 117 TR_XM_SpammyWords5 5278 2.35 4.38 1.42 118 TooManyTo_003 5182 1.17 0.70 1.39 119 IN_HORDE_ADDRESS_BOOK 5173 0.98 0.08 1.39 120 XMGappySubj_01 5152 1.00 0.15 1.38 121 HTML_EXTRA_CLOSE 5120 0.95 0.02 1.38 122 TR_Symld_Words 5076 1.25 1.01 1.36 123 XM_SendGrid 5010 1.35 1.35 1.35 124 BOTNET 4929 3.99 9.80 1.32 125 XMDiploma_00 4890 1.66 2.40 1.31 126 SUBJ_ALL_CAPS 4692 1.43 1.81 1.26 127 XM_GoogleGroups 4674 1.03 0.54 1.26 128 XMBSHREFv2 4657 0.96 0.31 1.25 129 TVD_SPACE_RATIO 4517 0.86 0.09 1.21 130 URI_HEX 4477 1.44 1.97 1.20 131 TM2_M_VERY_LONG_WORD 4442 1.67 2.70 1.19 132 XM_OfRef6 4163 1.86 3.47 1.12 133 RELAYCOUNTRY_CA 4097 3.33 8.19 1.10 134 KHOP_HELO_FCRDNS 4075 1.17 1.34 1.09 135 XM_UB50 3998 1.95 3.86 1.07 136 XM_H_Long_From02 3969 1.28 1.75 1.07 137 XMCapTrack 3819 0.81 0.35 1.03 138 TooManyTo_004 3780 0.90 0.64 1.02 139 TR_LOTS_OF_MONEY3 3681 2.61 6.16 0.99 140 T_FILL_THIS_FORM_SHORT 3622 1.70 3.28 0.97 141 XMBody_95 3593 0.73 0.21 0.97 142 XMStockSpam_06 3527 1.16 1.61 0.95 143 RELAYCOUNTRY_AU 3466 1.32 2.18 0.93 144 HTTPS_HTTP_MISMATCH 3343 1.10 1.55 0.90 145 TR_XM_DK_SendGrid 3314 0.87 0.84 0.89 146 T_TooManySym_03 3221 0.72 0.39 0.87 147 URI_TRY_3LD 3144 1.11 1.67 0.84 148 TooManyTo_005 3134 0.77 0.60 0.84 149 T_OBFU_PDF_ATTACH 3080 0.61 0.13 0.83 150 TR_XM_Base64_M1 3023 0.88 1.03 0.81 151 DKIM_ADSP_CUSTOM_MED 2985 0.90 1.10 0.80 152 RCVD_IN_RP_SAFE 2948 0.70 0.49 0.79 153 TR_MetaPhish_Combo_01 2878 0.82 0.91 0.77 154 XMGappySubj_02 2853 0.54 0.05 0.77 155 XMBody_17 2840 2.34 5.77 0.76 156 T_XMDrugObfuBody_00 2797 0.88 1.17 0.75 157 FROM_GOV_DKIM_AU 2718 0.54 0.12 0.73 158 XM_H_Trusted_IP 2634 0.49 0.00 0.71 159 XMNoVowels 2629 0.58 0.30 0.71 160 RCVD_IN_RP_CERTIFIED 2591 0.60 0.37 0.70 161 RCVD_IN_BL_SPAMCOP_NET 2560 3.84 10.71 0.69 162 XMHTML_After_End 2544 0.81 1.07 0.68 163 XMBdyGiftCard01 2525 0.89 1.35 0.68 164 XMGenDplmaNmb 2519 0.85 1.22 0.68 165 XM_ShortIntro_01 2475 0.59 0.42 0.66 166 SpammyFromTLD_01 2469 1.26 2.55 0.66 167 XMBrknScrpt_02 2434 1.38 2.95 0.65 168 XM_H_PHPMailer 2408 0.73 0.92 0.65 169 XMSubNoVowel 2383 0.57 0.40 0.64 170 XMSubMetaI_00 2377 0.84 1.29 0.64 171 MSGID_NOFQDN1 2315 0.43 0.02 0.62 172 XMLngstWrd_00 2259 0.69 0.87 0.61 173 XM_B_SpammyWords4 2183 1.07 2.11 0.59 174 T_Symld_Words_02 2143 0.59 0.62 0.58 175 XMPhish14 2125 0.69 0.95 0.57 176 FILL_THIS_FORM 2118 0.51 0.37 0.57 177 XM_ProductURIs 1996 0.60 0.75 0.54 178 T_XMHurry_00 1975 1.06 2.22 0.53 179 NML_ADSP_CUSTOM_MED 1959 0.65 0.92 0.53 180 RELAYCOUNTRY_GB 1949 0.57 0.66 0.52 181 FORGED_OUTLOOK_TAGS 1935 0.46 0.33 0.52 182 TM2_M_BODY_EMPTY 1898 0.60 0.80 0.51 183 USER_IN_WELCOMELIST 1893 0.35 0.00 0.51 184 USER_IN_WHITELIST 1893 0.35 0.00 0.51 185 SHORT_HELO_AND_INLINE_IMAGE 1857 0.35 0.03 0.50 186 XMSubMetaSxObfu_02 1803 0.44 0.36 0.48 187 TR_XM_SpammyWords2 1787 4.50 13.27 0.48 188 XMPhish30 1769 0.74 1.31 0.48 189 MPART_ALT_DIFF_COUNT 1758 0.57 0.79 0.47 190 FORGED_GMAIL_RCVD 1751 0.63 0.97 0.47 191 HTML_IMAGE_ONLY_32 1739 0.57 0.79 0.47 192 TRACKER_ID 1702 0.35 0.11 0.46 193 XM_B_COPY_HTML 1664 0.55 0.76 0.45 194 HTML_IMAGE_ONLY_28 1638 0.38 0.25 0.44 195 HTML_IMAGE_ONLY_20 1628 0.44 0.44 0.44 196 XM_B_FormFill 1627 0.31 0.03 0.44 197 SpammyFromTLD_02 1607 0.78 1.54 0.43 198 GMD_PDF_EMPTY_BODY 1578 0.31 0.08 0.42 199 XMMoneyMeta_00 1566 0.46 0.56 0.42 200 XMSubMetaSxObfu_03 1560 0.48 0.61 0.42 ----------------------------------------------------------------------