Email: 347771 Autolearn: 0 AvgScore: 4.83 AvgScanTime: 1.11 sec Spam: 117539 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 1.20 sec Ham: 230232 Autolearn: 0 AvgScore: 0.31 AvgScanTime: 1.06 sec Time Spent Running SA: 106.79 hours Time Spent Processing Spam: 39.24 hours Time Spent Processing Ham: 67.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 117401 99.78 99.88 99.72 2 HTML_MESSAGE 112764 89.81 95.94 86.69 3 DKIM_SIGNED 108982 75.02 92.72 65.99 4 XM_DK_Pass 104643 73.05 89.03 64.89 5 DKIM_VALID 103463 72.48 88.02 64.55 6 XM_B_Unicode 102588 79.95 87.28 76.21 7 RELAYCOUNTRY_US 91924 72.03 78.21 68.87 8 XMListUnsubscribeExists 88663 57.06 75.43 47.68 9 XM_B_SpammyWords 88281 61.84 75.11 55.06 10 DCC_CHECK 86156 47.00 73.30 33.57 11 DKIM_VALID_AU 77337 58.88 65.80 55.35 12 XM_DK_Undo_02 58996 20.79 50.19 5.79 13 XM_B_SpammyWords2 52998 27.37 45.09 18.33 14 XM_B_Unicode3 51917 39.81 44.17 37.58 15 BAYES_99 47409 16.73 40.33 4.67 16 LOC_TINY_FONT_1 46581 30.10 39.63 25.24 17 TR_XM_DKIM_Undo 46529 14.97 39.59 2.41 18 HTML_FONT_LOW_CONTRAST 40470 29.72 34.43 27.31 19 RCVD_IN_MSPIKE_H2 40444 29.18 34.41 26.52 20 FVGT_m_MULTI_ODD 39838 26.48 33.89 22.70 21 BAYES_50 39689 53.01 33.77 62.83 22 BAYES_999 38243 13.38 32.54 3.60 23 DKIM_VALID_EF 36679 27.11 31.21 25.02 24 T_KAM_HTML_FONT_INVALID 36431 22.67 30.99 18.41 25 TR_DCC_Bayes_99 34214 11.08 29.11 1.88 26 MIME_HTML_ONLY 33266 21.11 28.30 17.44 27 DCC_CHECK_NEGATIVE 31370 52.98 26.69 66.41 28 TR_XM_DK_Unsub 27684 16.68 23.55 13.17 29 T_TM2_M_HEADER_IN_MSG 26546 29.05 22.58 32.35 30 RELAYCOUNTRY_META 25649 9.79 21.82 3.64 31 XMSubLong 22130 27.03 18.83 31.21 32 TR_XM_SpammyRelay 20816 7.45 17.71 2.21 33 TR_XM_SpammyWords2 20634 6.40 17.56 0.70 34 XM_Multi_Part_URI 19519 14.75 16.61 13.81 35 RCVD_IN_BL_SPAMCOP_NET 18430 5.81 15.68 0.77 36 LOTS_OF_MONEY 18017 8.37 15.33 4.82 37 TR_MAX_INTL_RELAY 17925 9.59 15.25 6.70 38 XM_B_SpammyWords3 17772 8.66 15.12 5.36 39 XM_B_Unsub 17425 9.46 14.82 6.72 40 TR_XM_SPAMCOP 16936 5.28 14.41 0.62 41 TR_XM_BayesUnsub 16562 8.43 14.09 5.53 42 UNPARSEABLE_RELAY 16087 10.81 13.69 9.34 43 TR_XM_SpammyWords4 16026 6.87 13.63 3.42 44 RELAYCOUNTRY_CA 15554 5.57 13.23 1.66 45 BOTNET_IPINHOSTNAME 13563 7.04 11.54 4.75 46 RCVD_IN_MSPIKE_H3 12849 6.82 10.93 4.72 47 RCVD_IN_MSPIKE_WL 12849 6.82 10.93 4.72 48 XMBody_17 11821 4.09 10.06 1.04 49 BAYES_80 10880 5.87 9.26 4.15 50 BAYES_60 9087 10.04 7.73 11.22 51 TR_XM_UnparsRelay 8674 3.44 7.38 1.43 52 FSL_BULK_SIG 8259 4.53 7.03 3.26 53 BOTNET 8201 3.02 6.98 1.00 54 HTML_IMAGE_RATIO_02 7235 5.44 6.16 5.07 55 XM_Body_Dirty_Words 7198 3.80 6.12 2.61 56 XM_Evil_Numbers_Gen 6919 6.43 5.89 6.71 57 MPART_ALT_DIFF 6858 4.10 5.83 3.22 58 UNTRUSTED_Relay 6773 2.88 5.76 1.41 59 BAYES_95 6593 3.59 5.61 2.55 60 XM_H_GMP 6450 6.04 5.49 6.32 61 XM_UncommonTLD01 6240 4.53 5.31 4.13 62 LotsOfNums_01 5850 5.94 4.98 6.44 63 XM_OfRef6 5638 2.61 4.80 1.49 64 XMSubMetaSx_00 5590 4.65 4.76 4.59 65 DKIM_INVALID 5519 2.54 4.70 1.44 66 T_FILL_THIS_FORM_SHORT 5501 1.91 4.68 0.50 67 HTML_IMAGE_RATIO_06 5336 2.89 4.54 2.05 68 TooManyTo_001 5319 5.32 4.53 5.72 69 TR_LOTS_OF_MONEY3 5003 1.91 4.26 0.70 70 XM_B_Investor 4894 2.11 4.16 1.06 71 XM_SPF_SoftFail 4843 2.98 4.12 2.40 72 TR_XM_SpammyWords5 4808 2.34 4.09 1.45 73 XM_H_Long_From01 4787 4.39 4.07 4.55 74 T_XMDrugObfuBody_14 4772 2.50 4.06 1.70 75 HTML_IMAGE_RATIO_08 4667 2.50 3.97 1.75 76 XMSexyCombo_05 4602 2.38 3.92 1.59 77 XM_B_SEO 4502 2.02 3.83 1.10 78 XM_B_Phish_Phrases 4500 13.00 3.83 17.68 79 TR_XM_BayesRelay 4252 1.22 3.62 0.00 80 T_XMDrugObfuBody_08 4140 2.05 3.52 1.30 81 XM_B_SpammyWords4 4113 1.68 3.50 0.75 82 RCVD_IN_VALIDITY_SAFE 4112 5.39 3.50 6.35 83 RCVD_IN_VALIDITY_RPBL 4104 1.26 3.49 0.12 84 TR_XM_PhishingBody 4101 2.15 3.49 1.46 85 XMNumbers 4079 3.37 3.47 3.32 86 TR_XM_SEO4 4042 1.55 3.44 0.59 87 MIME_HTML_MOSTLY 4011 2.71 3.41 2.36 88 TM2_M_URI_OPT_OUT 3999 12.23 3.40 16.74 89 XM_B_SpammyTLD 3957 12.30 3.37 16.86 90 FONT_INVIS_LONG_LINE 3929 1.16 3.34 0.04 91 XMStrtUSub 3888 4.53 3.31 5.15 92 MIME_HTML_ONLY_MULTI 3863 2.18 3.29 1.62 93 HTML_IMAGE_RATIO_04 3708 3.48 3.15 3.65 94 XM_CamelCaseFrm001 3659 2.36 3.11 1.97 95 TM2_M_VERY_LONG_WORD 3577 1.74 3.04 1.08 96 XM_UB50 3481 1.53 2.96 0.80 97 TR_XM_FormFill 3446 1.00 2.93 0.01 98 RCVD_IN_VALIDITY_CERTIFIED 3249 4.36 2.76 5.17 99 USER_IN_DEF_DKIM_WL 3187 10.93 2.71 15.12 100 XM_URI_RBL 3184 1.02 2.71 0.15 101 T_XMHurry_00 3144 1.29 2.67 0.59 102 HOSTED_IMG_MULTI_PUB_01 3098 0.91 2.64 0.03 103 MIME_QP_LONG_LINE 3045 12.88 2.59 18.14 104 SpammyFromTLD_01 3010 1.15 2.56 0.43 105 T_TooManySym_01 2885 4.35 2.45 5.32 106 TR_XM_NoHeaderRelay 2873 0.88 2.44 0.07 107 XM_B_Unsub2 2799 1.57 2.38 1.16 108 BOUNCE_MESSAGE 2781 4.82 2.37 6.07 109 ANY_BOUNCE_MESSAGE 2781 4.83 2.37 6.08 110 XMDiploma_00 2740 1.81 2.33 1.54 111 TR_XM_INV_DKIM 2709 0.83 2.30 0.08 112 RELAYCOUNTRY_AU 2441 1.02 2.08 0.48 113 XMBrknScrpt_02 2346 1.18 2.00 0.76 114 TR_XM_PHPForged 2263 0.80 1.93 0.23 115 AC_BR_BONANZA 2251 0.77 1.92 0.18 116 URI_TRY_3LD 2234 1.23 1.90 0.88 117 TR_XM_PHPDW 2233 0.80 1.90 0.23 118 SUBJ_ALL_CAPS 2187 1.07 1.86 0.66 119 XMReplyNow 2180 0.78 1.85 0.23 120 TR_XM_FormFill2 2173 0.78 1.85 0.23 121 XM_H_PHPOS 2162 0.76 1.84 0.22 122 HK_RANDOM_REPLYTO 2138 0.71 1.82 0.15 123 T_REMOTE_IMAGE 2029 2.49 1.73 2.87 124 FROM_EXCESS_BASE64 2021 1.82 1.72 1.88 125 DKIM_ADSP_NXDOMAIN 2018 0.83 1.72 0.37 126 XM_HighProb1 1855 0.54 1.58 0.00 127 XMStockSpam_06 1792 0.91 1.52 0.60 128 HTTPS_HTTP_MISMATCH 1776 0.74 1.51 0.35 129 XM_DK_Undo_01 1742 1.51 1.48 1.53 130 XM_H_Undi_Recip 1675 0.55 1.43 0.11 131 ALL_TRUSTED 1652 18.80 1.41 27.69 132 BAYES_40 1647 2.82 1.40 3.54 133 TR_XM_Undi_Recip19 1523 0.49 1.30 0.07 134 SpammyFromTLD_02 1501 0.53 1.28 0.15 135 TR_Mismatch_TLD_02 1460 0.47 1.24 0.08 136 XMBdyGiftCard01 1450 0.99 1.23 0.87 137 T_STY_INVIS_DIRECT 1425 0.64 1.21 0.35 138 HTML_TAG_BALANCE_BODY 1422 0.88 1.21 0.71 139 XMNoVowels 1392 0.71 1.18 0.47 140 XMPhish30 1383 0.85 1.18 0.68 141 T_XMDrugObfuBody_00 1378 0.71 1.17 0.47 142 SCC_BODY_URI_ONLY 1372 2.20 1.17 2.73 143 XM_B_COPY_HTML 1355 0.99 1.15 0.91 144 MAILING_LIST_MULTI 1341 1.59 1.14 1.82 145 XM_SendGrid 1315 1.13 1.12 1.14 146 KHOP_HELO_FCRDNS 1286 1.32 1.09 1.44 147 URI_HEX 1207 0.82 1.03 0.72 148 TR_MetaPhish_Combo_01 1207 0.80 1.03 0.68 149 TR_XM_Undi_RecipCombo2 1183 0.34 1.01 0.00 150 HTML_MIME_NO_HTML_TAG 1179 1.60 1.00 1.91 151 XMBounce_01 1157 0.35 0.98 0.02 152 XM_DIRTYINTL 1141 0.39 0.97 0.09 153 TooManyTo_002 1111 1.51 0.95 1.79 154 MPART_ALT_DIFF_COUNT 1102 0.85 0.94 0.80 155 RDNS_DYNAMIC 1096 0.54 0.93 0.35 156 THIS_AD 1095 0.53 0.93 0.32 157 TM2_M_OBFU_COMMENT 1078 0.49 0.92 0.27 158 XMSubMetaI_00 1071 0.56 0.91 0.38 159 BAYES_20 1070 1.83 0.91 2.30 160 PLING_QUERY 1047 0.56 0.89 0.39 161 TooManyTo_003 1047 0.79 0.89 0.73 162 TR_Caps_n_Bayes_99 1038 0.31 0.88 0.01 163 TVD_RCVD_IP 1028 1.63 0.87 2.02 164 DKIM_ADSP_CUSTOM_MED 1020 0.88 0.87 0.89 165 TooManyTo_004 1017 0.68 0.87 0.58 166 XMSubMetaSxObfu_03 1009 0.58 0.86 0.44 167 XM_OfRef7 1004 0.43 0.85 0.21 168 XM_UB99 999 0.29 0.85 0.00 169 XMGenDplmaNmb 997 0.73 0.85 0.67 170 URG_BIZ 991 0.32 0.84 0.05 171 XM_B_DNDMA 980 0.58 0.83 0.45 172 URIBL_DBL_SPAM 980 0.29 0.83 0.01 173 DIET_1 975 0.42 0.83 0.21 174 TooManyTo_005 963 0.61 0.82 0.51 175 HELO_DYNAMIC_SPLIT_IP 962 0.28 0.82 0.01 176 URI_NOVOWEL 960 0.83 0.82 0.83 177 XM_UB60 959 0.32 0.82 0.07 178 T_XMDrugObfuBody_10 958 0.29 0.82 0.01 179 XM_H_Long_From02 955 0.95 0.81 1.02 180 TR_XM_InvalidRelay 955 0.29 0.81 0.02 181 UNDISC_MONEY 953 0.28 0.81 0.00 182 T_Symld_Words_02 940 0.44 0.80 0.25 183 XMHTML_After_End 935 0.46 0.80 0.30 184 TR_XM_DK_SendGrid 906 0.77 0.77 0.77 185 TR_XM_Undi_Recip5 904 0.26 0.77 0.00 186 NML_ADSP_CUSTOM_MED 896 0.63 0.76 0.56 187 XMPhish14 896 0.50 0.76 0.37 188 RELAYCOUNTRY_CN 890 0.27 0.76 0.02 189 XM_H_PHPMailer 887 0.73 0.75 0.71 190 T_TooManySym_02 864 2.22 0.74 2.98 191 RCVD_IN_PSBL 862 0.38 0.73 0.20 192 XMSexyCombo_01 860 0.39 0.73 0.21 193 SHOPIFY_IMG_NOT_RCVD_SFY 853 0.56 0.73 0.48 194 BOTNET_NORDNS 836 0.24 0.71 0.00 195 XM_B_Phish66 835 0.38 0.71 0.22 196 AC_HTML_NONSENSE_TAGS 832 0.25 0.71 0.01 197 PDS_OTHER_BAD_TLD 831 0.31 0.71 0.10 198 XMLngstWrd_00 829 0.41 0.71 0.25 199 RELAYCOUNTRY_IN 829 0.26 0.71 0.04 200 TR_Mismatch_TLD_01 807 0.47 0.69 0.35 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 229588 99.78 99.88 99.72 2 HTML_MESSAGE 199578 89.81 95.94 86.69 3 XM_B_Unicode 175469 79.95 87.28 76.21 4 RELAYCOUNTRY_US 158572 72.03 78.21 68.87 5 DCC_CHECK_NEGATIVE 152894 52.98 26.69 66.41 6 DKIM_SIGNED 151931 75.02 92.72 65.99 7 XM_DK_Pass 149405 73.05 89.03 64.89 8 DKIM_VALID 148610 72.48 88.02 64.55 9 BAYES_50 144658 53.01 33.77 62.83 10 DKIM_VALID_AU 127429 58.88 65.80 55.35 11 XM_B_SpammyWords 126777 61.84 75.11 55.06 12 XMListUnsubscribeExists 109780 57.06 75.43 47.68 13 XM_B_Unicode3 86514 39.81 44.17 37.58 14 DCC_CHECK 77294 47.00 73.30 33.57 15 T_TM2_M_HEADER_IN_MSG 74488 29.05 22.58 32.35 16 XMSubLong 71856 27.03 18.83 31.21 17 ALL_TRUSTED 63743 18.80 1.41 27.69 18 HTML_FONT_LOW_CONTRAST 62878 29.72 34.43 27.31 19 RCVD_IN_MSPIKE_H2 61052 29.18 34.41 26.52 20 LOC_TINY_FONT_1 58109 30.10 39.63 25.24 21 DKIM_VALID_EF 57594 27.11 31.21 25.02 22 FVGT_m_MULTI_ODD 52269 26.48 33.89 22.70 23 T_KAM_HTML_FONT_INVALID 42393 22.67 30.99 18.41 24 XM_B_SpammyWords2 42195 27.37 45.09 18.33 25 MIME_QP_LONG_LINE 41759 12.88 2.59 18.14 26 XM_B_Phish_Phrases 40705 13.00 3.83 17.68 27 MIME_HTML_ONLY 40155 21.11 28.30 17.44 28 XM_B_SpammyTLD 38819 12.30 3.37 16.86 29 TM2_M_URI_OPT_OUT 38549 12.23 3.40 16.74 30 USER_IN_DEF_DKIM_WL 34808 10.93 2.71 15.12 31 XM_Multi_Part_URI 31794 14.75 16.61 13.81 32 TR_XM_DK_Unsub 30317 16.68 23.55 13.17 33 BAYES_60 25824 10.04 7.73 11.22 34 UNPARSEABLE_RELAY 21503 10.81 13.69 9.34 35 XM_DKIMWhitelistDomains 19287 5.55 0.03 8.38 36 BAYES_00 16863 5.01 0.48 7.32 37 XM_B_Unsub 15475 9.46 14.82 6.72 38 XM_Evil_Numbers_Gen 15453 6.43 5.89 6.71 39 TR_MAX_INTL_RELAY 15425 9.59 15.25 6.70 40 LotsOfNums_01 14819 5.94 4.98 6.44 41 RCVD_IN_VALIDITY_SAFE 14617 5.39 3.50 6.35 42 XM_H_GMP 14548 6.04 5.49 6.32 43 ANY_BOUNCE_MESSAGE 14002 4.83 2.37 6.08 44 BOUNCE_MESSAGE 13979 4.82 2.37 6.07 45 XM_DK_Undo_02 13322 20.79 50.19 5.79 46 TooManyTo_001 13167 5.32 4.53 5.72 47 TR_XM_DK_Bayes 12960 3.85 0.36 5.63 48 TR_XM_DK_Bayes1 12902 3.83 0.36 5.60 49 TR_XM_BayesUnsub 12742 8.43 14.09 5.53 50 XM_B_SpammyWords3 12348 8.66 15.12 5.36 51 T_TooManySym_01 12253 4.35 2.45 5.32 52 RCVD_IN_VALIDITY_CERTIFIED 11909 4.36 2.76 5.17 53 XMStrtUSub 11852 4.53 3.31 5.15 54 HTML_IMAGE_RATIO_02 11682 5.44 6.16 5.07 55 TR_XM_DK_Bayes2 11138 3.29 0.26 4.84 56 IN_ZIMBRA_NJ_WHITELIST 11100 3.21 0.04 4.82 57 LOTS_OF_MONEY 11086 8.37 15.33 4.82 58 BOTNET_IPINHOSTNAME 10932 7.04 11.54 4.75 59 RCVD_IN_MSPIKE_H3 10859 6.82 10.93 4.72 60 RCVD_IN_MSPIKE_WL 10859 6.82 10.93 4.72 61 BAYES_99 10757 16.73 40.33 4.67 62 XMSubMetaSx_00 10569 4.65 4.76 4.59 63 XM_H_Long_From01 10482 4.39 4.07 4.55 64 BAYES_80 9546 5.87 9.26 4.15 65 XM_UncommonTLD01 9511 4.53 5.31 4.13 66 HTML_IMAGE_RATIO_04 8394 3.48 3.15 3.65 67 RELAYCOUNTRY_META 8390 9.79 21.82 3.64 68 BAYES_999 8299 13.38 32.54 3.60 69 BAYES_40 8152 2.82 1.40 3.54 70 TR_XM_SpammyWords4 7872 6.87 13.63 3.42 71 XMNumbers 7639 3.37 3.47 3.32 72 FSL_BULK_SIG 7508 4.53 7.03 3.26 73 MPART_ALT_DIFF 7410 4.10 5.83 3.22 74 INVALID_MSGID 7280 2.14 0.15 3.16 75 TO_MALFORMED 6957 2.00 0.01 3.02 76 T_TooManySym_02 6858 2.22 0.74 2.98 77 T_REMOTE_IMAGE 6618 2.49 1.73 2.87 78 SCC_BODY_URI_ONLY 6293 2.20 1.17 2.73 79 XM_Body_Dirty_Words 6006 3.80 6.12 2.61 80 BAYES_95 5877 3.59 5.61 2.55 81 TR_XM_DKIM_Undo 5545 14.97 39.59 2.41 82 XM_SPF_SoftFail 5523 2.98 4.12 2.40 83 MIME_HTML_MOSTLY 5424 2.71 3.41 2.36 84 RCVD_IN_IADB_LISTED 5414 1.78 0.66 2.35 85 BAYES_20 5305 1.83 0.91 2.30 86 TR_XM_SpammyRelay 5080 7.45 17.71 2.21 87 RCVD_IN_IADB_SPF 4912 1.61 0.59 2.13 88 HTML_IMAGE_RATIO_06 4718 2.89 4.54 2.05 89 TVD_RCVD_IP 4640 1.63 0.87 2.02 90 XM_PDF 4613 1.42 0.28 2.00 91 RCVD_IN_IADB_SENDERID 4555 1.50 0.55 1.98 92 XM_CamelCaseFrm001 4544 2.36 3.11 1.97 93 RCVD_IN_IADB_DK 4469 1.47 0.56 1.94 94 HTML_MIME_NO_HTML_TAG 4391 1.60 1.00 1.91 95 FROM_EXCESS_BASE64 4325 1.82 1.72 1.88 96 TR_DCC_Bayes_99 4322 11.08 29.11 1.88 97 MAILING_LIST_MULTI 4198 1.59 1.14 1.82 98 TooManyTo_002 4128 1.51 0.95 1.79 99 HTML_IMAGE_RATIO_08 4026 2.50 3.97 1.75 100 T_XMDrugObfuBody_14 3924 2.50 4.06 1.70 101 XMBSHREFv2 3879 1.17 0.15 1.68 102 RELAYCOUNTRY_CA 3832 5.57 13.23 1.66 103 MIME_HTML_ONLY_MULTI 3719 2.18 3.29 1.62 104 XMSexyCombo_05 3669 2.38 3.92 1.59 105 XMDiploma_00 3557 1.81 2.33 1.54 106 XM_DK_Undo_01 3514 1.51 1.48 1.53 107 TVD_SPACE_RATIO 3438 1.02 0.10 1.49 108 XM_OfRef6 3425 2.61 4.80 1.49 109 IN_HORDE_ADDRESS_BOOK 3382 1.00 0.08 1.47 110 TR_XM_PhishingBody 3367 2.15 3.49 1.46 111 TR_XM_SpammyWords5 3328 2.34 4.09 1.45 112 DKIM_INVALID 3321 2.54 4.70 1.44 113 KHOP_HELO_FCRDNS 3312 1.32 1.09 1.44 114 TR_XM_UnparsRelay 3289 3.44 7.38 1.43 115 UNTRUSTED_Relay 3252 2.88 5.76 1.41 116 BAYES_05 3250 1.11 0.51 1.41 117 RCVD_IN_IADB_VOUCHED 3066 0.99 0.33 1.33 118 T_XMDrugObfuBody_08 2993 2.05 3.52 1.30 119 XMGappySubj_01 2708 0.87 0.26 1.18 120 XM_B_Unsub2 2665 1.57 2.38 1.16 121 XM_SendGrid 2625 1.13 1.12 1.14 122 XM_B_SEO 2525 2.02 3.83 1.10 123 TR_Symld_Words 2503 0.94 0.64 1.09 124 TM2_M_VERY_LONG_WORD 2477 1.74 3.04 1.08 125 XM_B_Investor 2435 2.11 4.16 1.06 126 XMBody_17 2398 4.09 10.06 1.04 127 XM_H_Long_From02 2337 0.95 0.81 1.02 128 BOTNET 2310 3.02 6.98 1.00 129 T_TooManySym_03 2271 0.76 0.32 0.99 130 RCVD_IN_IADB_OPTIN 2187 0.71 0.23 0.95 131 TR_XM_Base64_M1 2136 0.75 0.40 0.93 132 XMGappySubj_02 2128 0.63 0.07 0.92 133 XM_GoogleGroups 2112 0.79 0.54 0.92 134 XM_B_COPY_HTML 2089 0.99 1.15 0.91 135 DKIM_ADSP_CUSTOM_MED 2038 0.88 0.87 0.89 136 XM_B_FormFill 2031 0.59 0.03 0.88 137 URI_TRY_3LD 2028 1.23 1.90 0.88 138 XMBdyGiftCard01 2009 0.99 1.23 0.87 139 URI_NOVOWEL 1918 0.83 0.82 0.83 140 T_TVD_MIME_NO_HEADERS 1879 0.64 0.29 0.82 141 XM_UB50 1842 1.53 2.96 0.80 142 MPART_ALT_DIFF_COUNT 1837 0.85 0.94 0.80 143 TR_XM_DK_SendGrid 1782 0.77 0.77 0.77 144 RCVD_IN_BL_SPAMCOP_NET 1764 5.81 15.68 0.77 145 XMBrknScrpt_02 1744 1.18 2.00 0.76 146 XM_B_SpammyWords4 1719 1.68 3.50 0.75 147 TooManyTo_003 1691 0.79 0.89 0.73 148 FILL_THIS_FORM 1685 0.55 0.20 0.73 149 URI_HEX 1658 0.82 1.03 0.72 150 XM_H_PHPMailer 1642 0.73 0.75 0.71 151 HTML_TAG_BALANCE_BODY 1627 0.88 1.21 0.71 152 TR_LOTS_OF_MONEY3 1623 1.91 4.26 0.70 153 XMBody_95 1614 0.50 0.12 0.70 154 TR_XM_SpammyWords2 1610 6.40 17.56 0.70 155 TR_MetaPhish_Combo_01 1577 0.80 1.03 0.68 156 XMPhish30 1563 0.85 1.18 0.68 157 XMGenDplmaNmb 1549 0.73 0.85 0.67 158 SUBJ_ALL_CAPS 1522 1.07 1.86 0.66 159 TR_XM_SPAMCOP 1425 5.28 14.41 0.62 160 XMStockSpam_06 1372 0.91 1.52 0.60 161 FORGED_GMAIL_RCVD 1362 0.62 0.68 0.59 162 TR_XM_SEO4 1358 1.55 3.44 0.59 163 T_XMHurry_00 1350 1.29 2.67 0.59 164 TooManyTo_004 1334 0.68 0.87 0.58 165 USER_IN_WELCOMELIST 1325 0.38 0.00 0.58 166 USER_IN_WHITELIST 1325 0.38 0.00 0.58 167 NML_ADSP_CUSTOM_MED 1291 0.63 0.76 0.56 168 XM_ProductURIs 1184 0.55 0.62 0.51 169 XMSubMetaSxObfu_02 1182 0.40 0.18 0.51 170 FILL_THIS_FORM_LONG 1171 0.38 0.12 0.51 171 TooManyTo_005 1165 0.61 0.82 0.51 172 T_FILL_THIS_FORM_SHORT 1145 1.91 4.68 0.50 173 HTML_FONT_FACE_BAD 1127 0.54 0.64 0.49 174 HTML_EXTRA_CLOSE 1119 0.33 0.02 0.49 175 RELAYCOUNTRY_AU 1111 1.02 2.08 0.48 176 SHOPIFY_IMG_NOT_RCVD_SFY 1094 0.56 0.73 0.48 177 T_XMDrugObfuBody_00 1083 0.71 1.17 0.47 178 XMNoVowels 1081 0.71 1.18 0.47 179 XM_B_DNDMA 1038 0.58 0.83 0.45 180 XMSubMetaSxObfu_03 1022 0.58 0.86 0.44 181 XM_B_REG_HTML 995 0.49 0.60 0.43 182 SpammyFromTLD_01 982 1.15 2.56 0.43 183 PLING_QUERY 894 0.56 0.89 0.39 184 XMSubMetaI_00 871 0.56 0.91 0.38 185 DKIM_ADSP_NXDOMAIN 863 0.83 1.72 0.37 186 HELO_NODOT 856 0.33 0.25 0.37 187 HELO_NO_DOMAIN 852 0.33 0.25 0.37 188 T_TooManySym_04 844 0.29 0.15 0.37 189 XMPhish14 842 0.50 0.76 0.37 190 T_OBFU_PDF_ATTACH 839 0.25 0.04 0.36 191 TR_Mismatch_TLD_01 812 0.47 0.69 0.35 192 HTML_IMAGE_ONLY_20 807 0.41 0.54 0.35 193 T_STY_INVIS_DIRECT 805 0.64 1.21 0.35 194 HTTPS_HTTP_MISMATCH 802 0.74 1.51 0.35 195 RDNS_DYNAMIC 796 0.54 0.93 0.35 196 XM_S_SubURI 767 0.24 0.04 0.33 197 XM_ShortIntro_01 760 0.34 0.37 0.33 198 HTML_IMAGE_ONLY_16 745 0.25 0.11 0.32 199 THIS_AD 743 0.53 0.93 0.32 200 CTE_8BIT_MISMATCH 736 0.22 0.01 0.32 ----------------------------------------------------------------------