Email: 557251 Autolearn: 0 AvgScore: 4.19 AvgScanTime: 1.28 sec Spam: 188861 Autolearn: 0 AvgScore: 12.55 AvgScanTime: 1.31 sec Ham: 368390 Autolearn: 0 AvgScore: -0.09 AvgScanTime: 1.27 sec Time Spent Running SA: 198.57 hours Time Spent Processing Spam: 68.85 hours Time Spent Processing Ham: 129.72 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 164238 76.33 86.96 70.87 2 HTML_MESSAGE 161596 86.42 85.56 86.85 3 XM_DK_Pass 159004 74.53 84.19 69.57 4 DKIM_VALID 157392 73.64 83.34 68.67 5 RELAYCOUNTRY_US 144586 76.28 76.56 76.13 6 XM_B_Unicode 143443 73.49 75.95 72.23 7 XMListUnsubscribeExists 135317 56.00 71.65 47.97 8 DKIM_VALID_AU 124918 58.81 66.14 55.05 9 DCC_CHECK 123934 44.66 65.62 33.92 10 XM_B_SpammyWords 113997 47.24 60.36 40.52 11 XM_B_Unicode3 80342 41.71 42.54 41.28 12 BAYES_50 74609 53.03 39.50 59.96 13 XM_DK_Undo_02 68698 16.12 36.37 5.74 14 XM_B_SpammyWords2 66794 22.89 35.37 16.50 15 DCC_CHECK_NEGATIVE 64910 55.30 34.37 66.03 16 LOC_TINY_FONT_1 63213 27.42 33.47 24.32 17 MIME_HTML_ONLY 58766 26.39 31.12 23.97 18 HTML_FONT_LOW_CONTRAST 56921 27.42 30.14 26.02 19 BAYES_99 53409 12.55 28.28 4.49 20 XMSubLong 52226 25.25 27.65 24.02 21 TR_XM_DKIM_Undo 52210 10.92 27.64 2.34 22 FVGT_m_MULTI_ODD 52194 25.69 27.64 24.70 23 DKIM_VALID_EF 48974 26.55 25.93 26.86 24 T_KAM_HTML_FONT_INVALID 45948 21.36 24.33 19.84 25 RCVD_IN_MSPIKE_H2 44518 24.75 23.57 25.35 26 BAYES_999 41862 9.82 22.17 3.48 27 T_TM2_M_HEADER_IN_MSG 38045 24.57 20.14 26.84 28 TR_DCC_Bayes_99 37753 7.82 19.99 1.58 29 TR_XM_DK_Unsub 35809 15.04 18.96 13.02 30 XM_UncommonTLD01 35489 9.16 18.79 4.23 31 RELAYCOUNTRY_META 31359 8.43 16.60 4.24 32 XM_B_Unsub 31304 12.39 16.58 10.25 33 TR_XM_BayesUnsub 30558 11.06 16.18 8.44 34 XM_Multi_Part_URI 30298 14.15 16.04 13.18 35 XMNumbers 27513 6.67 14.57 2.62 36 TR_XM_SpammyRelay 24918 6.03 13.19 2.35 37 SpammyFromTLD_01 24532 4.97 12.99 0.86 38 XM_B_SpammyWords3 24397 7.10 12.92 4.12 39 TR_XM_PHPForged 23967 4.63 12.69 0.49 40 TR_XM_PHPDW 23882 4.62 12.65 0.50 41 TR_XM_FormFill2 23836 4.61 12.62 0.50 42 XM_H_PHPOS 23815 4.60 12.61 0.49 43 TR_MAX_INTL_RELAY 23606 8.27 12.50 6.10 44 LOTS_OF_MONEY 22551 8.00 11.94 5.99 45 UNPARSEABLE_RELAY 22377 10.49 11.85 9.80 46 XM_SPF_SoftFail 21966 7.36 11.63 5.16 47 BOTNET_IPINHOSTNAME 21655 6.71 11.47 4.28 48 TM2_M_BODY_EMPTY 21116 4.10 11.18 0.46 49 XMEmptyBody_01 21072 3.88 11.16 0.16 50 TR_XM_SpammyWords2 20469 3.96 10.84 0.43 51 TR_XM_SpammyWords4 20371 6.29 10.79 3.98 52 RCVD_IN_BL_SPAMCOP_NET 17922 3.63 9.49 0.62 53 RELAYCOUNTRY_CA 17440 3.95 9.23 1.24 54 TooManyTo_001 15943 10.03 8.44 10.84 55 XM_Evil_Numbers_Gen 15078 7.41 7.98 7.11 56 FSL_BULK_SIG 14790 5.62 7.83 4.49 57 BAYES_80 14568 5.03 7.71 3.65 58 TR_XM_SPAMCOP 14108 2.75 7.47 0.34 59 BOTNET 14092 3.47 7.46 1.42 60 ALL_TRUSTED 14035 16.07 7.43 20.50 61 XM_Body_Dirty_Words 13533 4.24 7.17 2.73 62 TR_XM_UnparsRelay 12367 3.27 6.55 1.59 63 BAYES_60 12020 7.65 6.36 8.31 64 RCVD_IN_MSPIKE_H3 11698 6.01 6.19 5.92 65 RCVD_IN_MSPIKE_WL 11698 6.01 6.19 5.92 66 LotsOfNums_01 11423 7.49 6.05 8.23 67 BAYES_40 11150 5.79 5.90 5.73 68 XMSubMetaSx_00 10979 4.60 5.81 3.97 69 XMDiploma_00 10954 4.56 5.80 3.93 70 HTML_IMAGE_RATIO_02 10928 5.21 5.79 4.91 71 MPART_ALT_DIFF 10063 4.41 5.33 3.94 72 BAYES_20 9941 4.07 5.26 3.46 73 XMBody_17 9797 2.18 5.19 0.63 74 UNTRUSTED_Relay 9331 2.74 4.94 1.61 75 XMGenDplmaNmb 9322 3.90 4.94 3.38 76 XM_B_Phish_Phrases 9140 3.72 4.84 3.14 77 XM_H_Long_From01 8497 5.25 4.50 5.64 78 HTML_IMAGE_RATIO_04 8471 4.06 4.49 3.85 79 BAYES_95 8423 3.13 4.46 2.45 80 XMSexyCombo_05 8287 2.26 4.39 1.16 81 XM_H_GMP 8076 5.47 4.28 6.09 82 HTML_IMAGE_RATIO_06 7760 3.12 4.11 2.62 83 XM_OfRef6 7713 2.14 4.08 1.14 84 XM_B_Investor 7255 2.32 3.84 1.54 85 SpammyFromTLD_02 6990 1.85 3.70 0.90 86 T_FILL_THIS_FORM_SHORT 6917 1.89 3.66 0.98 87 TR_XM_SpammyWords5 6887 2.09 3.65 1.29 88 DKIM_INVALID 6846 2.69 3.62 2.21 89 TM2_M_URI_OPT_OUT 6229 2.43 3.30 1.98 90 T_XMDrugObfuBody_14 6203 2.33 3.28 1.85 91 MIME_HTML_MOSTLY 6198 2.53 3.28 2.14 92 XM_B_SpammyTLD 5949 2.77 3.15 2.57 93 TR_XM_PhishingBody 5789 2.23 3.07 1.80 94 T_XMDrugObfuBody_08 5730 1.93 3.03 1.37 95 MIME_HTML_ONLY_MULTI 5548 2.49 2.94 2.27 96 MIME_QP_LONG_LINE 5179 3.95 2.74 4.57 97 HTML_IMAGE_RATIO_08 4937 2.45 2.61 2.36 98 RCVD_IN_VALIDITY_SAFE 4923 4.42 2.61 5.34 99 USER_IN_DEF_DKIM_WL 4851 9.04 2.57 12.36 100 XMStrtUSub 4838 3.43 2.56 3.88 101 TM2_M_VERY_LONG_WORD 4642 1.62 2.46 1.19 102 XM_UB50 4519 1.46 2.39 0.99 103 TR_LOTS_OF_MONEY3 4490 1.03 2.38 0.34 104 HTML_FONT_FACE_BAD 4419 1.77 2.34 1.48 105 XM_CamelCaseFrm001 4360 2.16 2.31 2.09 106 RCVD_IN_VALIDITY_CERTIFIED 4231 3.80 2.24 4.60 107 TR_XM_FormFill 4037 0.74 2.14 0.02 108 BAYES_05 3803 2.38 2.01 2.57 109 XM_URI_RBL 3766 0.77 1.99 0.15 110 T_TooManySym_01 3676 3.95 1.95 4.98 111 TR_XM_BayesRelay 3631 0.65 1.92 0.00 112 HTML_IMAGE_ONLY_20 3507 1.21 1.86 0.87 113 XM_B_Unsub2 3431 1.44 1.82 1.25 114 SUBJ_ALL_CAPS 3373 1.48 1.79 1.33 115 RELAYCOUNTRY_AU 3202 1.09 1.70 0.78 116 XMStockSpam_06 3151 1.01 1.67 0.67 117 XM_B_SpammyWords4 3131 0.96 1.66 0.60 118 FONT_INVIS_LONG_LINE 3121 0.59 1.65 0.05 119 XMBrknScrpt_02 3107 0.92 1.65 0.54 120 XMReplyNow 3047 0.74 1.61 0.29 121 T_REMOTE_IMAGE 3006 2.79 1.59 3.41 122 HK_RANDOM_REPLYTO 2899 0.59 1.53 0.11 123 XM_H_Long_From02 2885 1.16 1.53 0.98 124 FROM_EXCESS_BASE64 2875 1.84 1.52 2.01 125 TM2_M_A_HREF_HREF 2805 0.63 1.49 0.19 126 MAILING_LIST_MULTI 2754 2.29 1.46 2.71 127 URI_NOVOWEL 2734 1.51 1.45 1.54 128 T_XMDrugObfuBody_00 2716 0.99 1.44 0.76 129 RCVD_IN_IADB_LISTED 2665 3.21 1.41 4.13 130 XM_SendGrid 2663 1.38 1.41 1.36 131 XM_H_Undi_Recip 2626 0.57 1.39 0.14 132 TR_XM_INV_DKIM 2506 0.49 1.33 0.05 133 TR_XM_NoHeaderRelay 2497 0.52 1.32 0.11 134 XM_B_DNDMA 2488 0.73 1.32 0.43 135 T_XMHurry_00 2413 0.73 1.28 0.45 136 URI_HEX 2412 1.23 1.28 1.20 137 HTML_MIME_NO_HTML_TAG 2391 1.73 1.27 1.97 138 ANY_BOUNCE_MESSAGE 2388 3.02 1.26 3.92 139 BOUNCE_MESSAGE 2388 3.02 1.26 3.92 140 XM_DK_Undo_01 2387 1.57 1.26 1.72 141 RCVD_IN_IADB_SPF 2351 2.85 1.24 3.67 142 TR_XM_Undi_Recip19 2336 0.46 1.24 0.06 143 LongTLD 2324 0.60 1.23 0.28 144 KHOP_HELO_FCRDNS 2278 1.18 1.21 1.17 145 RCVD_IN_IADB_DK 2233 2.52 1.18 3.21 146 RCVD_IN_IADB_SENDERID 2220 2.59 1.18 3.31 147 HTML_TAG_BALANCE_BODY 2215 0.67 1.17 0.41 148 AC_BR_BONANZA 2130 0.43 1.13 0.07 149 XM_DIRTYINTL 2128 0.50 1.13 0.17 150 HTTPS_HTTP_MISMATCH 2107 0.87 1.12 0.74 151 BOTNET_NORDNS 2100 0.38 1.11 0.01 152 TR_Symld_Words 2096 1.28 1.11 1.37 153 XM_HighProb1 2094 0.38 1.11 0.00 154 XMPhish30 2067 0.75 1.09 0.58 155 THIS_AD 2037 0.58 1.08 0.33 156 URI_TRY_3LD 2023 0.77 1.07 0.62 157 XMSubMetaI_00 2021 0.69 1.07 0.49 158 XMSexyCombo_01 1931 0.48 1.02 0.21 159 XMSlimDrugH 1886 0.50 1.00 0.24 160 RELAYCOUNTRY_IN 1856 0.36 0.98 0.05 161 XM_B_COVIDMETA 1856 0.55 0.98 0.32 162 XMBdyGiftCard01 1845 0.93 0.98 0.91 163 TR_XM_Undi_RecipCombo2 1822 0.33 0.96 0.00 164 UNDISC_MONEY 1813 0.33 0.96 0.00 165 RCVD_IN_VALIDITY_RPBL 1812 0.35 0.96 0.04 166 XMHTML_After_End 1811 0.62 0.96 0.45 167 TR_Mismatch_TLD_02 1790 0.37 0.95 0.07 168 TR_XM_Undi_Recip2 1776 0.33 0.94 0.01 169 TR_XM_DK_SendGrid 1743 0.90 0.92 0.89 170 XM_H_PHPMailer 1659 0.68 0.88 0.58 171 DKIM_ADSP_CUSTOM_MED 1620 0.85 0.86 0.84 172 T_Symld_Words_02 1575 0.64 0.83 0.53 173 XMMoneyMeta_00 1535 0.62 0.81 0.52 174 URIBL_DBL_SPAM 1531 0.28 0.81 0.01 175 RDNS_DYNAMIC 1489 0.54 0.79 0.41 176 TR_XM_InvalidRelay 1479 0.28 0.78 0.02 177 PDS_OTHER_BAD_TLD 1458 0.32 0.77 0.09 178 PLING_QUERY 1434 0.54 0.76 0.43 179 XM_RXBody 1419 0.44 0.75 0.28 180 TR_XM_Undi_Recip11 1418 0.27 0.75 0.02 181 MIME_HEADER_CTYPE_ONLY 1412 2.74 0.75 3.76 182 TR_XM_Base64_M1 1398 0.74 0.74 0.74 183 XM_B_Phish66 1389 0.43 0.74 0.28 184 XM_UB99 1384 0.25 0.73 0.00 185 XMPhish14 1375 0.60 0.73 0.54 186 SHOPIFY_IMG_NOT_RCVD_SFY 1364 0.47 0.72 0.34 187 XMSubMetaSxObfu_03 1342 0.60 0.71 0.54 188 NML_ADSP_CUSTOM_MED 1336 0.62 0.71 0.57 189 T_MONEY_PERCENT 1336 0.45 0.71 0.32 190 TR_LOTS_OF_MONEY2 1336 0.45 0.71 0.32 191 XM_ProductURIs 1307 0.64 0.69 0.61 192 XM_B_COPY_HTML 1292 0.77 0.68 0.82 193 TooManyTo_002 1292 1.77 0.68 2.33 194 DIET_1 1277 0.39 0.68 0.24 195 RELAYCOUNTRY_FR 1274 0.37 0.67 0.22 196 TVD_RCVD_IP 1274 1.11 0.67 1.33 197 XM_UB80 1268 0.24 0.67 0.02 198 XMHTMLBadTable_001 1267 0.42 0.67 0.29 199 MPART_ALT_DIFF_COUNT 1264 0.66 0.67 0.66 200 FORGED_GMAIL_RCVD 1249 0.55 0.66 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 319958 86.42 85.56 86.85 2 RELAYCOUNTRY_US 280463 76.28 76.56 76.13 3 XM_B_Unicode 266089 73.49 75.95 72.23 4 DKIM_SIGNED 261093 76.33 86.96 70.87 5 XM_DK_Pass 256301 74.53 84.19 69.57 6 DKIM_VALID 252969 73.64 83.34 68.67 7 DCC_CHECK_NEGATIVE 243246 55.30 34.37 66.03 8 BAYES_50 220886 53.03 39.50 59.96 9 DKIM_VALID_AU 202784 58.81 66.14 55.05 10 XMListUnsubscribeExists 176731 56.00 71.65 47.97 11 XM_B_Unicode3 152068 41.71 42.54 41.28 12 XM_B_SpammyWords 149272 47.24 60.36 40.52 13 DCC_CHECK 124955 44.66 65.62 33.92 14 DKIM_VALID_EF 98949 26.55 25.93 26.86 15 T_TM2_M_HEADER_IN_MSG 98864 24.57 20.14 26.84 16 HTML_FONT_LOW_CONTRAST 95857 27.42 30.14 26.02 17 RCVD_IN_MSPIKE_H2 93394 24.75 23.57 25.35 18 FVGT_m_MULTI_ODD 90975 25.69 27.64 24.70 19 LOC_TINY_FONT_1 89586 27.42 33.47 24.32 20 XMSubLong 88490 25.25 27.65 24.02 21 MIME_HTML_ONLY 88285 26.39 31.12 23.97 22 ALL_TRUSTED 75505 16.07 7.43 20.50 23 T_KAM_HTML_FONT_INVALID 73082 21.36 24.33 19.84 24 XM_B_SpammyWords2 60771 22.89 35.37 16.50 25 XM_Multi_Part_URI 48544 14.15 16.04 13.18 26 TR_XM_DK_Unsub 47981 15.04 18.96 13.02 27 USER_IN_DEF_DKIM_WL 45548 9.04 2.57 12.36 28 TooManyTo_001 39936 10.03 8.44 10.84 29 XM_B_Unsub 37754 12.39 16.58 10.25 30 UNPARSEABLE_RELAY 36103 10.49 11.85 9.80 31 BAYES_00 34576 6.37 0.50 9.39 32 TR_XM_BayesUnsub 31076 11.06 16.18 8.44 33 BAYES_60 30626 7.65 6.36 8.31 34 LotsOfNums_01 30323 7.49 6.05 8.23 35 XM_DKIMWhitelistDomains 26789 4.82 0.04 7.27 36 XM_Evil_Numbers_Gen 26199 7.41 7.98 7.11 37 IN_ZIMBRA_NJ_WHITELIST 25335 4.57 0.06 6.88 38 TR_XM_DK_Bayes 25104 4.63 0.37 6.81 39 TR_XM_DK_Bayes1 24729 4.56 0.36 6.71 40 TR_MAX_INTL_RELAY 22466 8.27 12.50 6.10 41 XM_H_GMP 22433 5.47 4.28 6.09 42 LOTS_OF_MONEY 22056 8.00 11.94 5.99 43 RCVD_IN_MSPIKE_WL 21803 6.01 6.19 5.92 44 RCVD_IN_MSPIKE_H3 21803 6.01 6.19 5.92 45 TR_XM_DK_Bayes2 21337 3.93 0.30 5.79 46 XM_DK_Undo_02 21150 16.12 36.37 5.74 47 BAYES_40 21101 5.79 5.90 5.73 48 XM_H_Long_From01 20776 5.25 4.50 5.64 49 RCVD_IN_VALIDITY_SAFE 19681 4.42 2.61 5.34 50 XM_SPF_SoftFail 19024 7.36 11.63 5.16 51 T_TooManySym_01 18363 3.95 1.95 4.98 52 HTML_IMAGE_RATIO_02 18093 5.21 5.79 4.91 53 RCVD_IN_VALIDITY_CERTIFIED 16954 3.80 2.24 4.60 54 MIME_QP_LONG_LINE 16834 3.95 2.74 4.57 55 FSL_BULK_SIG 16539 5.62 7.83 4.49 56 BAYES_99 16536 12.55 28.28 4.49 57 BOTNET_IPINHOSTNAME 15755 6.71 11.47 4.28 58 RELAYCOUNTRY_META 15604 8.43 16.60 4.24 59 XM_UncommonTLD01 15574 9.16 18.79 4.23 60 XM_PDF 15397 2.92 0.45 4.18 61 RCVD_IN_IADB_LISTED 15221 3.21 1.41 4.13 62 XM_B_SpammyWords3 15164 7.10 12.92 4.12 63 TR_XM_SpammyWords4 14655 6.29 10.79 3.98 64 XMSubMetaSx_00 14639 4.60 5.81 3.97 65 MPART_ALT_DIFF 14501 4.41 5.33 3.94 66 XMDiploma_00 14466 4.56 5.80 3.93 67 ANY_BOUNCE_MESSAGE 14451 3.02 1.26 3.92 68 BOUNCE_MESSAGE 14450 3.02 1.26 3.92 69 XMStrtUSub 14278 3.43 2.56 3.88 70 HTML_IMAGE_RATIO_04 14181 4.06 4.49 3.85 71 MIME_HEADER_CTYPE_ONLY 13867 2.74 0.75 3.76 72 RCVD_IN_IADB_SPF 13524 2.85 1.24 3.67 73 BAYES_80 13439 5.03 7.71 3.65 74 BAYES_999 12834 9.82 22.17 3.48 75 BAYES_20 12736 4.07 5.26 3.46 76 T_REMOTE_IMAGE 12555 2.79 1.59 3.41 77 XMGenDplmaNmb 12434 3.90 4.94 3.38 78 RCVD_IN_IADB_SENDERID 12196 2.59 1.18 3.31 79 RCVD_IN_IADB_DK 11810 2.52 1.18 3.21 80 XM_B_Phish_Phrases 11563 3.72 4.84 3.14 81 XM_Body_Dirty_Words 10069 4.24 7.17 2.73 82 MAILING_LIST_MULTI 9997 2.29 1.46 2.71 83 HTML_IMAGE_RATIO_06 9645 3.12 4.11 2.62 84 XMNumbers 9640 6.67 14.57 2.62 85 XM_B_SpammyTLD 9476 2.77 3.15 2.57 86 BAYES_05 9468 2.38 2.01 2.57 87 RCVD_IN_IADB_VOUCHED 9194 1.85 0.60 2.50 88 T_TooManySym_02 9178 1.85 0.59 2.49 89 BAYES_95 9021 3.13 4.46 2.45 90 HTML_IMAGE_RATIO_08 8691 2.45 2.61 2.36 91 TR_XM_SpammyRelay 8659 6.03 13.19 2.35 92 TR_XM_DKIM_Undo 8636 10.92 27.64 2.34 93 TooManyTo_002 8592 1.77 0.68 2.33 94 MIME_HTML_ONLY_MULTI 8351 2.49 2.94 2.27 95 DKIM_INVALID 8124 2.69 3.62 2.21 96 MIME_HTML_MOSTLY 7897 2.53 3.28 2.14 97 XM_CamelCaseFrm001 7689 2.16 2.31 2.09 98 FROM_EXCESS_BASE64 7403 1.84 1.52 2.01 99 TM2_M_URI_OPT_OUT 7293 2.43 3.30 1.98 100 HTML_MIME_NO_HTML_TAG 7257 1.73 1.27 1.97 101 INVALID_MSGID 7106 1.35 0.23 1.93 102 T_XMDrugObfuBody_14 6804 2.33 3.28 1.85 103 TR_XM_PhishingBody 6640 2.23 3.07 1.80 104 MSGID_NOFQDN1 6606 1.24 0.15 1.79 105 XM_DK_Undo_01 6335 1.57 1.26 1.72 106 RCVD_IN_IADB_OPTIN 6300 1.25 0.36 1.71 107 TO_MALFORMED 6291 1.14 0.02 1.71 108 HELO_NODOT 6169 1.31 0.60 1.67 109 HELO_NO_DOMAIN 6164 1.31 0.60 1.67 110 UNTRUSTED_Relay 5939 2.74 4.94 1.61 111 TR_XM_UnparsRelay 5854 3.27 6.55 1.59 112 TR_DCC_Bayes_99 5827 7.82 19.99 1.58 113 XM_B_Investor 5674 2.32 3.84 1.54 114 URI_NOVOWEL 5659 1.51 1.45 1.54 115 HTML_FONT_FACE_BAD 5447 1.77 2.34 1.48 116 BOTNET 5249 3.47 7.46 1.42 117 XMGappySubj_01 5184 0.97 0.13 1.41 118 TooManyTo_003 5076 1.11 0.58 1.38 119 T_XMDrugObfuBody_08 5041 1.93 3.03 1.37 120 TR_Symld_Words 5035 1.28 1.11 1.37 121 XM_SendGrid 5028 1.38 1.41 1.36 122 IN_HORDE_ADDRESS_BOOK 4917 0.91 0.07 1.33 123 TVD_RCVD_IP 4892 1.11 0.67 1.33 124 SUBJ_ALL_CAPS 4890 1.48 1.79 1.33 125 TR_XM_SpammyWords5 4756 2.09 3.65 1.29 126 XM_GoogleGroups 4678 0.99 0.46 1.27 127 XM_B_Unsub2 4600 1.44 1.82 1.25 128 RELAYCOUNTRY_CA 4572 3.95 9.23 1.24 129 XMBody_95 4513 0.88 0.19 1.23 130 URI_HEX 4415 1.23 1.28 1.20 131 TM2_M_VERY_LONG_WORD 4373 1.62 2.46 1.19 132 KHOP_HELO_FCRDNS 4322 1.18 1.21 1.17 133 XMSexyCombo_05 4283 2.26 4.39 1.16 134 XM_OfRef6 4205 2.14 4.08 1.14 135 XMBSHREFv2 3974 0.85 0.39 1.08 136 TVD_SPACE_RATIO 3916 0.74 0.12 1.06 137 XM_UB50 3632 1.46 2.39 0.99 138 T_FILL_THIS_FORM_SHORT 3625 1.89 3.66 0.98 139 XMCapTrack 3623 0.75 0.30 0.98 140 TooManyTo_004 3598 0.83 0.54 0.98 141 XM_H_Long_From02 3593 1.16 1.53 0.98 142 XMBdyGiftCard01 3348 0.93 0.98 0.91 143 SpammyFromTLD_02 3304 1.85 3.70 0.90 144 TR_XM_DK_SendGrid 3283 0.90 0.92 0.89 145 TR_MetaPhish_Combo_01 3263 0.81 0.65 0.89 146 XM_H_Trusted_IP 3249 0.58 0.00 0.88 147 T_TooManySym_03 3248 0.64 0.16 0.88 148 HTML_IMAGE_ONLY_20 3222 1.21 1.86 0.87 149 XMGappySubj_02 3220 0.60 0.07 0.87 150 SpammyFromTLD_01 3178 4.97 12.99 0.86 151 DKIM_ADSP_CUSTOM_MED 3090 0.85 0.86 0.84 152 XM_B_COPY_HTML 3016 0.77 0.68 0.82 153 TooManyTo_005 2896 0.69 0.50 0.79 154 RELAYCOUNTRY_AU 2887 1.09 1.70 0.78 155 FROM_GOV_DKIM_AU 2812 0.55 0.12 0.76 156 T_XMDrugObfuBody_00 2797 0.99 1.44 0.76 157 TR_XM_Base64_M1 2730 0.74 0.74 0.74 158 HTTPS_HTTP_MISMATCH 2714 0.87 1.12 0.74 159 XM_ShortIntro_01 2559 0.61 0.43 0.69 160 XMSubNoVowel 2479 0.56 0.35 0.67 161 XMStockSpam_06 2472 1.01 1.67 0.67 162 MPART_ALT_DIFF_COUNT 2424 0.66 0.67 0.66 163 XMBody_17 2338 2.18 5.19 0.63 164 XMNoVowels 2290 0.55 0.42 0.62 165 RCVD_IN_BL_SPAMCOP_NET 2285 3.63 9.49 0.62 166 URI_TRY_3LD 2282 0.77 1.07 0.62 167 XM_ProductURIs 2241 0.64 0.69 0.61 168 T_OBFU_PDF_ATTACH 2227 0.42 0.07 0.60 169 XM_B_SpammyWords4 2204 0.96 1.66 0.60 170 XM_H_PHPMailer 2149 0.68 0.88 0.58 171 XMPhish30 2129 0.75 1.09 0.58 172 NML_ADSP_CUSTOM_MED 2094 0.62 0.71 0.57 173 USER_IN_WHITELIST 2006 0.36 0.00 0.54 174 USER_IN_WELCOMELIST 2006 0.36 0.00 0.54 175 XMBrknScrpt_02 2003 0.92 1.65 0.54 176 XMPhish14 1979 0.60 0.73 0.54 177 XMSubMetaSxObfu_03 1975 0.60 0.71 0.54 178 T_Symld_Words_02 1969 0.64 0.83 0.53 179 XMMoneyMeta_00 1932 0.62 0.81 0.52 180 SHORT_HELO_AND_INLINE_IMAGE 1901 0.35 0.04 0.52 181 FILL_THIS_FORM 1879 0.44 0.32 0.51 182 RELAYCOUNTRY_GB 1860 0.54 0.60 0.50 183 TR_XM_PHPDW 1853 4.62 12.65 0.50 184 TR_XM_FormFill2 1851 4.61 12.62 0.50 185 TR_XM_PHPForged 1822 4.63 12.69 0.49 186 FORGED_GMAIL_RCVD 1815 0.55 0.66 0.49 187 XMSubMetaI_00 1811 0.69 1.07 0.49 188 XM_H_PHPOS 1804 4.60 12.61 0.49 189 TM2_M_BODY_EMPTY 1706 4.10 11.18 0.46 190 T_XMHurry_00 1658 0.73 1.28 0.45 191 XMHTML_After_End 1644 0.62 0.96 0.45 192 XM_B_DNDMA 1594 0.73 1.32 0.43 193 TR_XM_SpammyWords2 1587 3.96 10.84 0.43 194 PLING_QUERY 1579 0.54 0.76 0.43 195 HTML_TAG_BALANCE_BODY 1512 0.67 1.17 0.41 196 RDNS_DYNAMIC 1509 0.54 0.79 0.41 197 XMOemUri 1448 0.31 0.16 0.39 198 HTML_IMAGE_ONLY_32 1428 0.30 0.12 0.39 199 XMSubMetaSxObfu_02 1396 0.39 0.42 0.38 200 TO_NO_BRKTS_HTML_ONLY 1337 0.32 0.23 0.36 ----------------------------------------------------------------------