Email: 582699 Autolearn: 0 AvgScore: 2.38 AvgScanTime: 1.50 sec Spam: 172155 Autolearn: 0 AvgScore: 13.51 AvgScanTime: 1.68 sec Ham: 410544 Autolearn: 0 AvgScore: -2.29 AvgScanTime: 1.42 sec Time Spent Running SA: 242.37 hours Time Spent Processing Spam: 80.15 hours Time Spent Processing Ham: 162.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 171806 99.53 99.80 99.42 2 HTML_MESSAGE 165027 90.25 95.86 87.90 3 DKIM_SIGNED 158536 73.25 92.09 65.35 4 XM_DK_Pass 151534 71.18 88.02 64.12 5 XM_B_Unicode 150169 77.35 87.23 73.21 6 DKIM_VALID 149186 70.17 86.66 63.25 7 RELAYCOUNTRY_US 138062 81.84 80.20 82.53 8 XM_B_SpammyWords 127480 51.81 74.05 42.49 9 DCC_CHECK 126079 42.17 73.24 29.15 10 XMListUnsubscribeExists 125980 52.14 73.18 43.32 11 DKIM_VALID_AU 108619 54.32 63.09 50.64 12 XM_DK_Undo_02 84223 17.71 48.92 4.61 13 XM_B_SpammyWords2 77059 25.36 44.76 17.22 14 XM_B_Unicode3 76963 43.72 44.71 43.30 15 LOC_TINY_FONT_1 68626 27.29 39.86 22.02 16 BAYES_99 65523 13.71 38.06 3.50 17 TR_XM_DKIM_Undo 65187 12.49 37.87 1.84 18 BAYES_50 64738 52.08 37.60 58.15 19 FVGT_m_MULTI_ODD 61657 26.98 35.81 23.27 20 HTML_FONT_LOW_CONTRAST 59880 27.89 34.78 25.01 21 DKIM_VALID_EF 56508 27.34 32.82 25.05 22 RCVD_IN_MSPIKE_H2 55098 27.62 32.00 25.78 23 BAYES_999 52951 10.98 30.76 2.69 24 MIME_HTML_ONLY 52661 24.22 30.59 21.55 25 T_KAM_HTML_FONT_INVALID 49610 21.43 28.82 18.33 26 TR_DCC_Bayes_99 48180 9.15 27.99 1.25 27 DCC_CHECK_NEGATIVE 46050 57.79 26.75 70.81 28 TR_XM_DK_Unsub 40436 15.24 23.49 11.78 29 XMSubLong 36854 22.09 21.41 22.38 30 T_TM2_M_HEADER_IN_MSG 35438 23.70 20.58 25.01 31 RELAYCOUNTRY_META 35109 8.71 20.39 3.81 32 LOTS_OF_MONEY 32739 10.00 19.02 6.22 33 XM_Multi_Part_URI 31773 14.07 18.46 12.23 34 TR_XM_SpammyWords4 29814 8.18 17.32 4.35 35 TR_XM_SpammyRelay 28457 6.40 16.53 2.15 36 TR_XM_SpammyWords2 27517 5.11 15.98 0.55 37 RCVD_IN_BL_SPAMCOP_NET 25546 4.76 14.84 0.54 38 XM_B_Unsub 25467 9.09 14.79 6.70 39 TR_XM_BayesUnsub 24186 7.89 14.05 5.31 40 TR_MAX_INTL_RELAY 23384 8.09 13.58 5.78 41 XM_B_SpammyWords3 22865 6.96 13.28 4.31 42 BOTNET_IPINHOSTNAME 22507 6.21 13.07 3.33 43 UNPARSEABLE_RELAY 22132 10.28 12.86 9.21 44 TR_XM_SPAMCOP 20407 3.75 11.85 0.35 45 RELAYCOUNTRY_CA 19033 4.13 11.06 1.23 46 RCVD_IN_MSPIKE_WL 16751 6.63 9.73 5.34 47 RCVD_IN_MSPIKE_H3 16751 6.63 9.73 5.34 48 BOTNET 15212 3.33 8.84 1.02 49 FSL_BULK_SIG 14524 5.17 8.44 3.80 50 BAYES_80 14346 4.97 8.33 3.57 51 XM_Evil_Numbers_Gen 13597 7.90 7.90 7.91 52 BAYES_60 12716 7.82 7.39 8.00 53 XMBody_17 12659 2.63 7.35 0.65 54 TR_XM_UnparsRelay 11806 2.94 6.86 1.30 55 XM_Body_Dirty_Words 11646 3.84 6.76 2.61 56 XMSubMetaSx_00 10675 4.28 6.20 3.48 57 LotsOfNums_01 10385 6.83 6.03 7.17 58 XM_H_Long_From01 10105 5.18 5.87 4.89 59 XM_UncommonTLD01 10067 4.05 5.85 3.29 60 MPART_ALT_DIFF 9948 7.46 5.78 8.17 61 XM_B_Phish_Phrases 9698 3.64 5.63 2.81 62 UNTRUSTED_Relay 9587 2.59 5.57 1.34 63 HTML_IMAGE_RATIO_06 9472 5.27 5.50 5.17 64 DKIM_INVALID 9350 3.09 5.43 2.10 65 XMSexyCombo_05 9151 2.80 5.32 1.74 66 HTML_IMAGE_RATIO_04 8997 11.65 5.23 14.35 67 TR_LOTS_OF_MONEY3 8972 2.20 5.21 0.94 68 TooManyTo_001 8764 6.70 5.09 7.38 69 HTML_IMAGE_RATIO_02 8512 4.19 4.94 3.88 70 BAYES_95 8437 3.00 4.90 2.21 71 XM_SPF_SoftFail 8229 3.45 4.78 2.89 72 TR_XM_SpammyWords5 7819 2.22 4.54 1.24 73 XM_OfRef6 7520 2.10 4.37 1.15 74 T_FILL_THIS_FORM_SHORT 7322 1.93 4.25 0.96 75 XM_B_Investor 7240 2.30 4.21 1.51 76 XM_H_GMP 6976 5.12 4.05 5.57 77 XMNumbers 6367 3.00 3.70 2.71 78 TR_XM_PhishingBody 6053 2.09 3.52 1.50 79 TR_XM_BayesRelay 6013 1.03 3.49 0.00 80 T_XMDrugObfuBody_14 5967 2.12 3.47 1.56 81 XMStrtUSub 5963 7.90 3.46 9.76 82 MIME_QP_LONG_LINE 5943 4.19 3.45 4.49 83 XM_B_SpammyTLD 5768 2.49 3.35 2.12 84 XMBrknScrpt_02 5731 1.54 3.33 0.79 85 TM2_M_VERY_LONG_WORD 5469 1.76 3.18 1.16 86 MIME_HTML_ONLY_MULTI 5450 5.69 3.17 6.75 87 TM2_M_URI_OPT_OUT 5259 1.82 3.05 1.31 88 T_XMDrugObfuBody_08 5106 1.84 2.97 1.37 89 MIME_HTML_MOSTLY 4899 2.23 2.85 1.98 90 HTML_IMAGE_RATIO_08 4784 2.15 2.78 1.88 91 XM_UB50 4697 1.37 2.73 0.80 92 TR_XM_FormFill 4644 0.81 2.70 0.02 93 FONT_INVIS_LONG_LINE 4611 0.89 2.68 0.14 94 USER_IN_DEF_DKIM_WL 4546 8.56 2.64 11.05 95 T_TooManySym_01 4544 4.03 2.64 4.62 96 SUBJ_ALL_CAPS 4530 1.85 2.63 1.52 97 XMDiploma_00 4469 1.97 2.60 1.71 98 RCVD_IN_VALIDITY_SAFE 4444 3.72 2.58 4.20 99 TR_XM_NoHeaderRelay 4430 0.83 2.57 0.09 100 SpammyFromTLD_01 4182 1.24 2.43 0.74 101 XM_CamelCaseFrm001 4135 2.17 2.40 2.08 102 XM_B_Unsub2 4111 1.52 2.39 1.16 103 XMStockSpam_06 4070 1.32 2.36 0.88 104 T_REMOTE_IMAGE 4014 3.02 2.33 3.31 105 RELAYCOUNTRY_AU 3884 1.14 2.26 0.67 106 ANY_BOUNCE_MESSAGE 3819 3.69 2.22 4.30 107 XM_SendGrid 3818 1.62 2.22 1.37 108 BOUNCE_MESSAGE 3818 3.69 2.22 4.30 109 T_XMHurry_00 3808 1.05 2.21 0.57 110 HTML_MIME_NO_HTML_TAG 3749 1.95 2.18 1.86 111 RCVD_IN_VALIDITY_CERTIFIED 3607 3.19 2.10 3.65 112 TR_XM_INV_DKIM 3565 0.65 2.07 0.05 113 HOSTED_IMG_MULTI_PUB_01 3430 0.60 1.99 0.02 114 XM_URI_RBL 3350 0.68 1.95 0.15 115 TR_Mismatch_TLD_01 3195 0.84 1.86 0.41 116 TR_XM_DK_SendGrid 3170 1.24 1.84 0.98 117 URI_HEX 3154 1.21 1.83 0.95 118 HTTPS_HTTP_MISMATCH 3134 1.12 1.82 0.83 119 DKIM_ADSP_NXDOMAIN 3090 0.69 1.79 0.23 120 XM_B_SEO 3079 0.77 1.79 0.34 121 XMLngstWrd_00 3052 1.03 1.77 0.72 122 SpammyFromTLD_02 3032 0.76 1.76 0.33 123 XM_B_SpammyWords4 3017 0.97 1.75 0.65 124 TR_Mismatch_TLD_02 2978 0.57 1.73 0.09 125 TR_XM_SEO4 2896 0.68 1.68 0.26 126 RCVD_IN_VALIDITY_RPBL 2887 0.52 1.68 0.04 127 TR_Symld_Words 2883 1.40 1.67 1.28 128 MAILING_LIST_MULTI 2871 2.20 1.67 2.43 129 URI_TRY_3LD 2863 1.11 1.66 0.88 130 XM_DK_Undo_01 2684 1.54 1.56 1.54 131 BAYES_40 2615 4.02 1.52 5.07 132 XMGenDplmaNmb 2594 1.03 1.51 0.83 133 XMLngstWrd_01 2593 0.80 1.51 0.50 134 HK_RANDOM_REPLYTO 2581 0.49 1.50 0.07 135 FROM_EXCESS_BASE64 2515 1.56 1.46 1.60 136 XMLngstWrd_02 2512 0.74 1.46 0.44 137 XMLngstWrd_03 2426 0.69 1.41 0.39 138 ALL_TRUSTED 2393 10.60 1.39 14.47 139 XM_ProductURIs 2317 0.82 1.35 0.61 140 T_XMDrugObfuBody_00 2258 0.94 1.31 0.78 141 XMLngstWrd_04 2255 0.63 1.31 0.34 142 XM_Combo_Sbj 2241 0.65 1.30 0.38 143 XM_DIRTYINTL 2188 0.43 1.27 0.07 144 TR_XM_PHPForged 2154 0.60 1.25 0.32 145 BAYES_20 2092 2.88 1.22 3.58 146 XMHTML_After_End 2091 0.66 1.21 0.43 147 TR_XM_PHPDW 2079 0.59 1.21 0.33 148 TR_XM_FormFill2 2051 0.59 1.19 0.33 149 HTML_TAG_BALANCE_BODY 2035 0.68 1.18 0.47 150 XM_H_PHPOS 2026 0.57 1.18 0.32 151 XMPhish30 2004 0.66 1.16 0.44 152 AC_BR_BONANZA 1960 0.41 1.14 0.11 153 XMBdyGiftCard01 1892 0.91 1.10 0.83 154 XM_B_Phish66 1873 0.49 1.09 0.24 155 TR_Caps_n_Bayes_99 1866 0.33 1.08 0.02 156 XMSubMetaSxObfu_03 1865 0.70 1.08 0.54 157 KHOP_HELO_FCRDNS 1856 1.03 1.08 1.01 158 URI_NOVOWEL 1851 0.98 1.08 0.94 159 XMReplyNow 1825 0.46 1.06 0.21 160 RCVD_IN_IADB_LISTED 1808 2.70 1.05 3.40 161 XMBody_78 1767 0.48 1.03 0.25 162 XM_B_COVIDMETA 1757 0.41 1.02 0.16 163 XM_H_Undi_Recip 1751 0.41 1.02 0.16 164 RELAYCOUNTRY_CN 1723 0.35 1.00 0.08 165 URIBL_DBL_SPAM 1712 0.30 0.99 0.01 166 TR_LOTS_OF_MONEY2 1685 0.47 0.98 0.25 167 T_MONEY_PERCENT 1685 0.47 0.98 0.25 168 XMSlimDrugH 1680 0.45 0.98 0.23 169 XM_H_Long_From02 1674 0.95 0.97 0.94 170 PLING_QUERY 1658 0.56 0.96 0.40 171 T_Symld_Words_02 1657 0.60 0.96 0.45 172 LongTLD 1653 0.51 0.96 0.31 173 DKIM_ADSP_CUSTOM_MED 1648 0.82 0.96 0.76 174 PDS_OTHER_BAD_TLD 1640 0.36 0.95 0.12 175 TR_XM_InvalidRelay 1637 0.29 0.95 0.02 176 XM_UB60 1633 0.32 0.95 0.06 177 TR_MetaPhish_Combo_01 1632 0.94 0.95 0.94 178 HTML_IMAGE_ONLY_20 1611 0.52 0.94 0.35 179 XM_B_COPY_HTML 1581 0.70 0.92 0.61 180 RDNS_DYNAMIC 1578 0.46 0.92 0.27 181 RCVD_IN_IADB_SPF 1573 2.36 0.91 2.97 182 THIS_AD 1561 0.45 0.91 0.25 183 RELAYCOUNTRY_FR 1553 0.39 0.90 0.18 184 XM_HighProb1 1551 0.27 0.90 0.00 185 RCVD_IN_PSBL 1549 0.39 0.90 0.18 186 XMClaimOffer 1498 0.49 0.87 0.33 187 DIET_1 1489 0.39 0.86 0.18 188 XMBounce_01 1486 0.28 0.86 0.03 189 RCVD_IN_IADB_SENDERID 1466 2.13 0.85 2.66 190 RCVD_IN_IADB_DK 1463 2.06 0.85 2.57 191 XM_PDF 1461 3.38 0.85 4.44 192 XMSexyCombo_01 1419 0.35 0.82 0.16 193 NML_ADSP_CUSTOM_MED 1412 0.59 0.82 0.49 194 XM_UB99 1388 0.24 0.81 0.01 195 HTML_FONT_FACE_BAD 1368 10.31 0.79 14.29 196 T_STY_INVIS_DIRECT 1366 0.44 0.79 0.30 197 TVD_RCVD_IP 1349 1.11 0.78 1.25 198 XM_S_SpammyWords 1326 0.41 0.77 0.25 199 TR_XM_Spammywords 1326 0.41 0.77 0.25 200 RELAYCOUNTRY_RU 1325 0.25 0.77 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 408168 99.53 99.80 99.42 2 HTML_MESSAGE 360851 90.25 95.86 87.90 3 RELAYCOUNTRY_US 338804 81.84 80.20 82.53 4 XM_B_Unicode 300552 77.35 87.23 73.21 5 DCC_CHECK_NEGATIVE 290710 57.79 26.75 70.81 6 DKIM_SIGNED 268309 73.25 92.09 65.35 7 XM_DK_Pass 263249 71.18 88.02 64.12 8 DKIM_VALID 259677 70.17 86.66 63.25 9 BAYES_50 238746 52.08 37.60 58.15 10 DKIM_VALID_AU 207912 54.32 63.09 50.64 11 XMListUnsubscribeExists 177829 52.14 73.18 43.32 12 XM_B_Unicode3 177771 43.72 44.71 43.30 13 XM_B_SpammyWords 174432 51.81 74.05 42.49 14 DCC_CHECK 119654 42.17 73.24 29.15 15 RCVD_IN_MSPIKE_H2 105847 27.62 32.00 25.78 16 DKIM_VALID_EF 102828 27.34 32.82 25.05 17 T_TM2_M_HEADER_IN_MSG 102665 23.70 20.58 25.01 18 HTML_FONT_LOW_CONTRAST 102661 27.89 34.78 25.01 19 FVGT_m_MULTI_ODD 95540 26.98 35.81 23.27 20 XMSubLong 91878 22.09 21.41 22.38 21 LOC_TINY_FONT_1 90403 27.29 39.86 22.02 22 MIME_HTML_ONLY 88492 24.22 30.59 21.55 23 T_KAM_HTML_FONT_INVALID 75238 21.43 28.82 18.33 24 XM_B_SpammyWords2 70693 25.36 44.76 17.22 25 ALL_TRUSTED 59391 10.60 1.39 14.47 26 HTML_IMAGE_RATIO_04 58893 11.65 5.23 14.35 27 HTML_FONT_FACE_BAD 58686 10.31 0.79 14.29 28 XM_H_Trusted_IP 52851 9.07 0.00 12.87 29 BAYES_00 51655 9.01 0.48 12.58 30 XM_Multi_Part_URI 50215 14.07 18.46 12.23 31 TR_XM_DK_Unsub 48373 15.24 23.49 11.78 32 USER_IN_DEF_DKIM_WL 45349 8.56 2.64 11.05 33 XMStrtUSub 40058 7.90 3.46 9.76 34 UNPARSEABLE_RELAY 37795 10.28 12.86 9.21 35 MPART_ALT_DIFF 33535 7.46 5.78 8.17 36 BAYES_60 32842 7.82 7.39 8.00 37 XM_Evil_Numbers_Gen 32463 7.90 7.90 7.91 38 TooManyTo_001 30294 6.70 5.09 7.38 39 LotsOfNums_01 29416 6.83 6.03 7.17 40 MIME_HTML_ONLY_MULTI 27708 5.69 3.17 6.75 41 XM_B_Unsub 27523 9.09 14.79 6.70 42 LOTS_OF_MONEY 25540 10.00 19.02 6.22 43 IN_ZIMBRA_NJ_WHITELIST 24719 4.27 0.10 6.02 44 TR_MAX_INTL_RELAY 23732 8.09 13.58 5.78 45 XM_DKIMWhitelistDomains 23526 4.24 0.68 5.73 46 XMSubNoVowel 23248 4.08 0.30 5.66 47 XM_H_GMP 22876 5.12 4.05 5.57 48 TR_XM_DK_Bayes 22787 4.02 0.36 5.55 49 TR_XM_DK_Bayes1 22480 3.96 0.35 5.48 50 RCVD_IN_MSPIKE_WL 21906 6.63 9.73 5.34 51 RCVD_IN_MSPIKE_H3 21905 6.63 9.73 5.34 52 TR_XM_BayesUnsub 21790 7.89 14.05 5.31 53 HTML_IMAGE_RATIO_06 21226 5.27 5.50 5.17 54 BAYES_40 20815 4.02 1.52 5.07 55 XM_H_Long_From01 20082 5.18 5.87 4.89 56 T_TooManySym_01 18962 4.03 2.64 4.62 57 XM_DK_Undo_02 18945 17.71 48.92 4.61 58 TR_XM_DK_Bayes2 18903 3.33 0.28 4.60 59 MIME_QP_LONG_LINE 18446 4.19 3.45 4.49 60 XM_PDF 18233 3.38 0.85 4.44 61 TR_XM_SpammyWords4 17874 8.18 17.32 4.35 62 XM_B_SpammyWords3 17679 6.96 13.28 4.31 63 ANY_BOUNCE_MESSAGE 17668 3.69 2.22 4.30 64 BOUNCE_MESSAGE 17664 3.69 2.22 4.30 65 RCVD_IN_VALIDITY_SAFE 17232 3.72 2.58 4.20 66 HTML_IMAGE_RATIO_02 15932 4.19 4.94 3.88 67 RELAYCOUNTRY_META 15640 8.71 20.39 3.81 68 FSL_BULK_SIG 15588 5.17 8.44 3.80 69 RCVD_IN_VALIDITY_CERTIFIED 14984 3.19 2.10 3.65 70 BAYES_20 14686 2.88 1.22 3.58 71 BAYES_80 14638 4.97 8.33 3.57 72 BAYES_99 14358 13.71 38.06 3.50 73 XMSubMetaSx_00 14271 4.28 6.20 3.48 74 XMSubLongNoVowel 14104 2.44 0.07 3.44 75 RCVD_IN_IADB_LISTED 13938 2.70 1.05 3.40 76 XMSubGarbage 13897 2.39 0.02 3.39 77 BAYES_05 13734 2.50 0.50 3.35 78 BOTNET_IPINHOSTNAME 13674 6.21 13.07 3.33 79 T_REMOTE_IMAGE 13598 3.02 2.33 3.31 80 XM_UncommonTLD01 13508 4.05 5.85 3.29 81 RCVD_IN_IADB_SPF 12197 2.36 0.91 2.97 82 XM_SPF_SoftFail 11871 3.45 4.78 2.89 83 XM_B_Phish_Phrases 11533 3.64 5.63 2.81 84 XMNumbers 11126 3.00 3.70 2.71 85 BAYES_999 11056 10.98 30.76 2.69 86 RCVD_IN_IADB_SENDERID 10937 2.13 0.85 2.66 87 SCC_BODY_URI_ONLY 10745 2.04 0.67 2.62 88 XM_Body_Dirty_Words 10735 3.84 6.76 2.61 89 RCVD_IN_IADB_DK 10547 2.06 0.85 2.57 90 MAILING_LIST_MULTI 9966 2.20 1.67 2.43 91 TooManyTo_002 9611 1.86 0.72 2.34 92 RCVD_IN_IADB_VOUCHED 9482 1.79 0.55 2.31 93 T_TooManySym_02 9236 1.81 0.75 2.25 94 BAYES_95 9069 3.00 4.90 2.21 95 TR_XM_SpammyRelay 8846 6.40 16.53 2.15 96 XM_B_SpammyTLD 8718 2.49 3.35 2.12 97 DKIM_INVALID 8632 3.09 5.43 2.10 98 XM_CamelCaseFrm001 8528 2.17 2.40 2.08 99 MIME_HTML_MOSTLY 8123 2.23 2.85 1.98 100 HTML_IMAGE_RATIO_08 7721 2.15 2.78 1.88 101 HTML_MIME_NO_HTML_TAG 7631 1.95 2.18 1.86 102 TR_XM_DKIM_Undo 7573 12.49 37.87 1.84 103 INVALID_MSGID 7293 1.31 0.20 1.78 104 TO_MALFORMED 7168 1.24 0.02 1.75 105 XMSexyCombo_05 7142 2.80 5.32 1.74 106 HELO_NODOT 7131 1.32 0.34 1.74 107 HELO_NO_DOMAIN 7122 1.32 0.34 1.73 108 XMDiploma_00 7021 1.97 2.60 1.71 109 FROM_EXCESS_BASE64 6586 1.56 1.46 1.60 110 RCVD_IN_IADB_OPTIN 6485 1.22 0.37 1.58 111 T_XMDrugObfuBody_14 6414 2.12 3.47 1.56 112 XM_DK_Undo_01 6305 1.54 1.56 1.54 113 SUBJ_ALL_CAPS 6250 1.85 2.63 1.52 114 XM_B_Investor 6181 2.30 4.21 1.51 115 TR_XM_PhishingBody 6140 2.09 3.52 1.50 116 XM_SendGrid 5638 1.62 2.22 1.37 117 T_XMDrugObfuBody_08 5624 1.84 2.97 1.37 118 UNTRUSTED_Relay 5519 2.59 5.57 1.34 119 TM2_M_URI_OPT_OUT 5368 1.82 3.05 1.31 120 TR_XM_UnparsRelay 5351 2.94 6.86 1.30 121 TR_Symld_Words 5262 1.40 1.67 1.28 122 TR_DCC_Bayes_99 5127 9.15 27.99 1.25 123 TVD_RCVD_IP 5118 1.11 0.78 1.25 124 TR_XM_SpammyWords5 5107 2.22 4.54 1.24 125 TooManyTo_003 5092 1.06 0.62 1.24 126 RELAYCOUNTRY_CA 5053 4.13 11.06 1.23 127 IN_HORDE_ADDRESS_BOOK 4986 0.88 0.07 1.21 128 TM2_M_VERY_LONG_WORD 4774 1.76 3.18 1.16 129 XM_B_Unsub2 4744 1.52 2.39 1.16 130 XM_OfRef6 4721 2.10 4.37 1.15 131 XMCapTrack 4345 0.85 0.35 1.06 132 XMGappySubj_01 4260 0.80 0.24 1.04 133 XM_GoogleGroups 4236 0.88 0.51 1.03 134 BOTNET 4176 3.33 8.84 1.02 135 KHOP_HELO_FCRDNS 4145 1.03 1.08 1.01 136 TR_XM_DK_SendGrid 4029 1.24 1.84 0.98 137 TVD_SPACE_RATIO 3961 0.72 0.12 0.96 138 T_FILL_THIS_FORM_SHORT 3952 1.93 4.25 0.96 139 URI_HEX 3901 1.21 1.83 0.95 140 XM_H_Long_From02 3853 0.95 0.97 0.94 141 TR_MetaPhish_Combo_01 3849 0.94 0.95 0.94 142 URI_NOVOWEL 3847 0.98 1.08 0.94 143 TR_LOTS_OF_MONEY3 3839 2.20 5.21 0.94 144 XM_E_Blogspot 3761 0.66 0.05 0.92 145 XMStockSpam_06 3620 1.32 2.36 0.88 146 TooManyTo_004 3609 0.78 0.55 0.88 147 XMBSHREFv2 3603 0.71 0.30 0.88 148 URI_TRY_3LD 3601 1.11 1.66 0.88 149 T_OBFU_PDF_ATTACH 3541 0.65 0.14 0.86 150 HTTPS_HTTP_MISMATCH 3421 1.12 1.82 0.83 151 XMGenDplmaNmb 3394 1.03 1.51 0.83 152 XMBdyGiftCard01 3391 0.91 1.10 0.83 153 T_TooManySym_03 3314 0.66 0.30 0.81 154 XM_UB50 3295 1.37 2.73 0.80 155 XMBrknScrpt_02 3248 1.54 3.33 0.79 156 T_XMDrugObfuBody_00 3209 0.94 1.31 0.78 157 DKIM_ADSP_CUSTOM_MED 3126 0.82 0.96 0.76 158 SpammyFromTLD_01 3037 1.24 2.43 0.74 159 XMLngstWrd_00 2972 1.03 1.77 0.72 160 TooManyTo_005 2887 0.65 0.52 0.70 161 XM_B_FormFill 2766 0.49 0.04 0.67 162 RELAYCOUNTRY_AU 2749 1.14 2.26 0.67 163 XM_ShortIntro_01 2676 0.63 0.56 0.65 164 XMBody_17 2663 2.63 7.35 0.65 165 XM_B_SpammyWords4 2659 0.97 1.75 0.65 166 XM_H_PHPMailer 2519 0.60 0.58 0.61 167 XM_B_COPY_HTML 2495 0.70 0.92 0.61 168 XM_ProductURIs 2485 0.82 1.35 0.61 169 MPART_ALT_DIFF_COUNT 2456 0.65 0.76 0.60 170 XMNoVowels 2432 0.62 0.68 0.59 171 T_XMHurry_00 2321 1.05 2.21 0.57 172 FROM_GOV_DKIM_AU 2307 0.50 0.35 0.56 173 SHORT_HELO_AND_INLINE_IMAGE 2296 0.40 0.03 0.56 174 XMGappySubj_02 2275 0.43 0.12 0.55 175 XMOemUri 2247 0.44 0.18 0.55 176 FILL_THIS_FORM 2247 0.50 0.39 0.55 177 TR_XM_SpammyWords2 2241 5.11 15.98 0.55 178 RCVD_IN_BL_SPAMCOP_NET 2212 4.76 14.84 0.54 179 XMSubMetaSxObfu_03 2203 0.70 1.08 0.54 180 XMLngstWrd_01 2071 0.80 1.51 0.50 181 XMPhish14 2010 0.51 0.57 0.49 182 NML_ADSP_CUSTOM_MED 2003 0.59 0.82 0.49 183 TR_XM_Base64_M1 1999 0.55 0.69 0.49 184 XMBody_95 1983 0.41 0.22 0.48 185 XMMoneyMeta_00 1938 0.55 0.74 0.47 186 XMSubMetaI_00 1933 0.55 0.75 0.47 187 HTML_TAG_BALANCE_BODY 1910 0.68 1.18 0.47 188 T_Symld_Words_02 1831 0.60 0.96 0.45 189 FORGED_GMAIL_RCVD 1820 0.50 0.65 0.44 190 XMPhish30 1819 0.66 1.16 0.44 191 XMLngstWrd_02 1815 0.74 1.46 0.44 192 TM2_M_BODY_EMPTY 1786 0.34 0.10 0.44 193 XMHTML_After_End 1758 0.66 1.21 0.43 194 TO_NO_BRKTS_HTML_ONLY 1734 0.37 0.26 0.42 195 USER_IN_WELCOMELIST 1730 0.30 0.00 0.42 196 USER_IN_WHITELIST 1730 0.30 0.00 0.42 197 RELAYCOUNTRY_GB 1708 0.51 0.73 0.42 198 TR_Mismatch_TLD_01 1693 0.84 1.86 0.41 199 XM_B_DNDMA 1632 0.50 0.74 0.40 200 PLING_QUERY 1628 0.56 0.96 0.40 ----------------------------------------------------------------------