Email: 299219 Autolearn: 0 AvgScore: 3.20 AvgScanTime: 1.40 sec Spam: 83634 Autolearn: 0 AvgScore: 13.28 AvgScanTime: 1.34 sec Ham: 215585 Autolearn: 0 AvgScore: -0.70 AvgScanTime: 1.42 sec Time Spent Running SA: 116.05 hours Time Spent Processing Spam: 31.18 hours Time Spent Processing Ham: 84.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 83606 99.97 99.97 99.97 2 HTML_MESSAGE 79941 89.22 95.58 86.75 3 DKIM_SIGNED 75672 84.77 90.48 82.55 4 XM_DK_Pass 72885 82.95 87.15 81.33 5 DKIM_VALID 71678 82.19 85.70 80.83 6 XM_B_Unicode 71629 79.25 85.65 76.77 7 XM_B_SpammyWords 65643 58.95 78.49 51.36 8 XMListUnsubscribeExists 63054 67.26 75.39 64.10 9 RELAYCOUNTRY_US 59378 79.30 71.00 82.52 10 XM_DK_Undo_02 53520 24.40 63.99 9.05 11 DKIM_VALID_AU 50446 67.27 60.32 69.97 12 TR_XM_DKIM_Undo 44381 18.05 53.07 4.46 13 XM_B_SpammyWords2 42254 32.49 50.52 25.50 14 BAYES_99 41029 18.79 49.06 7.05 15 XM_B_Unicode3 33542 45.44 40.11 47.50 16 BAYES_999 31486 14.34 37.65 5.30 17 DKIM_VALID_EF 29280 30.15 35.01 28.27 18 RCVD_IN_MSPIKE_H2 29173 32.94 34.88 32.19 19 HTML_FONT_LOW_CONTRAST 28675 35.66 34.29 36.20 20 LOC_TINY_FONT_1 28364 35.22 33.91 35.72 21 FVGT_m_MULTI_ODD 25895 30.27 30.96 30.01 22 MIME_HTML_ONLY 25789 23.73 30.84 20.98 23 TR_XM_DK_Unsub 23990 20.08 28.68 16.75 24 RELAYCOUNTRY_META 23927 11.68 28.61 5.12 25 T_KAM_HTML_FONT_INVALID 22870 23.48 27.35 21.98 26 BAYES_50 21756 48.20 26.01 56.81 27 TR_XM_SpammyWords2 21062 8.13 25.18 1.52 28 TR_XM_SpammyRelay 19824 9.01 23.70 3.32 29 RCVD_IN_BL_SPAMCOP_NET 19757 7.67 23.62 1.49 30 TR_XM_SPAMCOP 17939 6.67 21.45 0.93 31 T_TM2_M_HEADER_IN_MSG 17008 20.26 20.34 20.24 32 RELAYCOUNTRY_CA 14754 6.93 17.64 2.77 33 LOTS_OF_MONEY 14529 10.70 17.37 8.12 34 XMSubLong 14266 21.83 17.06 23.69 35 XM_B_SpammyWords3 13669 10.47 16.34 8.19 36 TR_XM_SpammyWords4 13483 9.24 16.12 6.57 37 XM_Multi_Part_URI 13357 16.77 15.97 17.08 38 TR_MAX_INTL_RELAY 12900 11.75 15.42 10.32 39 XM_B_Unsub 12283 9.79 14.69 7.88 40 RCVD_IN_MSPIKE_WL 11880 8.10 14.20 5.74 41 RCVD_IN_MSPIKE_H3 11880 8.10 14.20 5.74 42 TR_XM_BayesUnsub 11842 8.82 14.16 6.76 43 BOTNET_IPINHOSTNAME 10403 7.90 12.44 6.15 44 UNPARSEABLE_RELAY 9480 12.40 11.34 12.81 45 XMBody_17 8582 4.06 10.26 1.66 46 BAYES_80 7884 7.07 9.43 6.16 47 BOTNET 7751 3.45 9.27 1.19 48 HK_RANDOM_REPLYTO 7079 2.54 8.46 0.24 49 TR_XM_UnparsRelay 6232 4.08 7.45 2.77 50 UNTRUSTED_Relay 6202 3.45 7.42 1.91 51 XM_Body_Dirty_Words 6026 4.54 7.21 3.51 52 BAYES_60 5962 10.48 7.13 11.78 53 XM_OfRef6 5476 2.75 6.55 1.27 54 TR_LOTS_OF_MONEY3 5204 2.89 6.22 1.60 55 XM_UncommonTLD01 5141 5.00 6.15 4.55 56 RCVD_IN_VALIDITY_RPBL 4873 2.10 5.83 0.66 57 XM_H_GMP 4618 6.23 5.52 6.50 58 BAYES_95 4606 4.54 5.51 4.16 59 TR_XM_SpammyWords5 4421 2.31 5.29 1.15 60 XMSubMetaSx_00 4313 4.54 5.16 4.30 61 MPART_ALT_DIFF 4221 4.43 5.05 4.19 62 HTML_IMAGE_RATIO_02 4205 6.23 5.03 6.69 63 XM_Evil_Numbers_Gen 4163 8.26 4.98 9.54 64 TR_XM_BayesRelay 4053 1.36 4.85 0.00 65 DKIM_INVALID 3994 2.57 4.78 1.72 66 T_FILL_THIS_FORM_SHORT 3825 1.77 4.57 0.69 67 XMSexyCombo_05 3733 2.50 4.46 1.73 68 T_XMDrugObfuBody_14 3702 2.64 4.43 1.95 69 XMStrtUSub 3634 5.02 4.35 5.28 70 TooManyTo_001 3534 5.67 4.23 6.23 71 XM_SPF_SoftFail 3489 3.24 4.17 2.87 72 XM_B_SEO 3341 1.97 3.99 1.18 73 XM_B_Phish_Phrases 3274 3.77 3.91 3.72 74 FONT_INVIS_LONG_LINE 3196 1.13 3.82 0.09 75 XM_B_Investor 3195 2.25 3.82 1.64 76 MIME_HTML_MOSTLY 3169 3.17 3.79 2.93 77 XM_URI_RBL 3133 1.17 3.75 0.17 78 TR_XM_PhishingBody 3104 2.79 3.71 2.43 79 LotsOfNums_01 3090 6.65 3.69 7.80 80 HOSTED_IMG_MULTI_PUB_01 2988 1.10 3.57 0.14 81 HTML_IMAGE_RATIO_08 2976 2.86 3.56 2.59 82 XMNumbers 2930 3.27 3.50 3.18 83 TR_XM_SEO4 2901 1.45 3.47 0.67 84 SUBJ_ALL_CAPS 2896 1.64 3.46 0.93 85 XM_H_Long_From01 2883 4.46 3.45 4.86 86 HTML_IMAGE_RATIO_06 2825 3.80 3.38 3.96 87 T_XMDrugObfuBody_08 2818 1.95 3.37 1.39 88 XM_UB50 2687 1.67 3.21 1.08 89 HTML_IMAGE_RATIO_04 2646 4.46 3.16 4.96 90 TR_XM_NoHeaderRelay 2570 0.99 3.07 0.18 91 XMReplyNow 2564 1.05 3.07 0.27 92 SpammyFromTLD_01 2429 1.23 2.90 0.58 93 XM_B_SpammyTLD 2327 2.69 2.78 2.66 94 TM2_M_VERY_LONG_WORD 2264 2.04 2.71 1.78 95 XM_B_PhoneNumber 2238 5.21 2.68 6.20 96 XM_CamelCaseFrm001 2216 2.79 2.65 2.85 97 TR_XM_PHPDW 2178 0.88 2.60 0.21 98 TR_XM_PHPForged 2159 0.86 2.58 0.20 99 RELAYCOUNTRY_AU 2112 1.07 2.53 0.51 100 TR_XM_FormFill2 2108 0.85 2.52 0.21 101 XM_H_PHPOS 2103 0.84 2.51 0.19 102 XM_B_Unsub2 2084 1.52 2.49 1.14 103 ALL_TRUSTED 2079 9.62 2.49 12.39 104 XM_HighProb1 2072 0.70 2.48 0.01 105 TM2_M_URI_OPT_OUT 2044 2.25 2.44 2.17 106 MIME_HTML_ONLY_MULTI 2023 2.27 2.42 2.22 107 TR_XM_FormFill 1951 0.68 2.33 0.04 108 RCVD_IN_VALIDITY_SAFE 1946 6.61 2.33 8.27 109 T_XMHurry_00 1944 1.38 2.32 1.01 110 TR_Mismatch_TLD_02 1915 0.71 2.29 0.10 111 XM_B_SpammyWords4 1870 1.40 2.24 1.08 112 TR_XM_INV_DKIM 1799 0.66 2.15 0.08 113 URI_TRY_3LD 1795 1.57 2.15 1.34 114 T_TooManySym_01 1775 5.47 2.12 6.77 115 XM_DIRTYINTL 1751 0.91 2.09 0.46 116 HTML_TAG_BALANCE_BODY 1739 1.07 2.08 0.67 117 T_XMDrugObfuBody_10 1675 0.60 2.00 0.06 118 XMDiploma_00 1660 1.64 1.98 1.51 119 HTML_MIME_NO_HTML_TAG 1651 1.55 1.97 1.39 120 XMBrknScrpt_02 1591 1.68 1.90 1.59 121 URIBL_DBL_SPAM 1541 0.52 1.84 0.00 122 T_STY_INVIS_DIRECT 1494 0.80 1.79 0.41 123 RCVD_IN_VALIDITY_CERTIFIED 1470 5.68 1.76 7.20 124 MAILING_LIST_MULTI 1452 1.93 1.74 2.01 125 TR_Caps_n_Bayes_99 1308 0.45 1.56 0.01 126 KHOP_HELO_FCRDNS 1282 0.89 1.53 0.64 127 XMStockSpam_06 1278 2.10 1.53 2.32 128 AC_HTML_NONSENSE_TAGS 1262 0.44 1.51 0.03 129 TooManyTo_002 1231 1.54 1.47 1.57 130 AC_BR_BONANZA 1215 0.81 1.45 0.56 131 FROM_EXCESS_BASE64 1201 2.25 1.44 2.57 132 TooManyTo_003 1186 0.97 1.42 0.80 133 TooManyTo_004 1162 0.84 1.39 0.63 134 RDNS_DYNAMIC 1158 0.60 1.38 0.29 135 TooManyTo_005 1141 0.77 1.36 0.55 136 SpammyFromTLD_02 1124 0.54 1.34 0.23 137 TVD_RCVD_IP 1121 1.87 1.34 2.08 138 T_REMOTE_IMAGE 1114 2.26 1.33 2.62 139 XMSlimDrugH 1113 0.59 1.33 0.31 140 HTTPS_HTTP_MISMATCH 1102 0.92 1.32 0.76 141 MY_SERVERS_FOUND 1086 0.42 1.30 0.08 142 TR_XM_InvalidRelay 1079 0.39 1.29 0.04 143 T_XMDrugObfuBody_00 1053 0.78 1.26 0.59 144 USER_IN_DEF_DKIM_WL 1047 14.11 1.25 19.10 145 XM_UB99 1040 0.35 1.24 0.00 146 BAYES_40 1003 2.90 1.20 3.57 147 DKIM_ADSP_NXDOMAIN 991 0.77 1.18 0.61 148 XM_DK_Undo_01 987 1.48 1.18 1.59 149 THIS_AD 985 0.91 1.18 0.80 150 BOUNCE_MESSAGE 984 2.40 1.18 2.87 151 ANY_BOUNCE_MESSAGE 984 2.40 1.18 2.87 152 DIET_1 971 0.74 1.16 0.58 153 RCVD_IN_PSBL 960 0.95 1.15 0.87 154 XMSexyCombo_01 930 0.56 1.11 0.34 155 XMPhish14 923 0.73 1.10 0.58 156 XMFrmHeader_28 914 0.31 1.09 0.00 157 XM_B_Phish66 912 0.55 1.09 0.33 158 XM_SendGrid 910 1.33 1.09 1.43 159 XMSubMetaI_00 910 0.99 1.09 0.95 160 URI_NOVOWEL 903 0.85 1.08 0.76 161 BOTNET_NORDNS 893 0.30 1.07 0.01 162 TR_Mismatch_TLD_01 883 0.45 1.06 0.22 163 XM_UB60 875 0.38 1.05 0.13 164 HELO_DYNAMIC_SPLIT_IP 850 0.29 1.02 0.01 165 TR_Symld_Words 833 1.08 1.00 1.12 166 XM_H_Undi_Recip 810 0.37 0.97 0.14 167 XMGenDplmaNmb 788 0.71 0.94 0.63 168 XM_H_Long_From02 779 0.97 0.93 0.99 169 MIME_QP_LONG_LINE 776 2.45 0.93 3.04 170 HTML_IMAGE_ONLY_20 748 0.50 0.89 0.34 171 BAYES_20 738 2.14 0.88 2.62 172 URIBL_CSS 721 0.28 0.86 0.05 173 URIBL_CSS_A 721 0.28 0.86 0.05 174 HTML_FONT_FACE_BAD 720 0.67 0.86 0.60 175 XMHTML_After_End 720 0.44 0.86 0.28 176 DKIM_ADSP_CUSTOM_MED 711 0.68 0.85 0.61 177 XM_UB80 709 0.27 0.85 0.04 178 XM_Combo_Sbj 706 0.38 0.84 0.19 179 XM_UB999 702 0.24 0.84 0.00 180 TR_XM_DK_SendGrid 700 1.03 0.84 1.10 181 XM_B_COPY_HTML 697 0.96 0.83 1.01 182 MISSING_HEADERS 694 0.39 0.83 0.21 183 MIME_CHARSET_FARAWAY 692 0.53 0.83 0.42 184 HTML_FONT_SIZE_LARGE 682 0.25 0.82 0.04 185 RELAYCOUNTRY_IN 664 0.25 0.79 0.04 186 RCVD_IN_IADB_LISTED 662 1.54 0.79 1.83 187 TM2_M_A_HREF_HREF 658 0.53 0.79 0.43 188 XM_H_PHPMailer 652 0.63 0.78 0.58 189 NML_ADSP_CUSTOM_MED 644 0.49 0.77 0.37 190 HTML_IMAGE_ONLY_08 639 0.28 0.76 0.09 191 MPART_ALT_DIFF_COUNT 633 0.82 0.76 0.85 192 URI_HEX 628 0.95 0.75 1.02 193 RELAYCOUNTRY_FR 626 0.32 0.75 0.15 194 XM_ProductURIs 624 1.25 0.75 1.45 195 FORGED_GMAIL_RCVD 609 0.44 0.73 0.33 196 TR_XM_Undi_Recip19 605 0.26 0.72 0.08 197 T_Symld_Words_02 603 0.39 0.72 0.26 198 TR_XM_RelayPhish 600 0.24 0.72 0.05 199 TR_XM_Base64_M1 577 0.91 0.69 0.99 200 XMSubNoVowel 574 0.38 0.69 0.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 215525 99.97 99.97 99.97 2 HTML_MESSAGE 187024 89.22 95.58 86.75 3 DKIM_SIGNED 177969 84.77 90.48 82.55 4 RELAYCOUNTRY_US 177902 79.30 71.00 82.52 5 XM_DK_Pass 175332 82.95 87.15 81.33 6 DKIM_VALID 174265 82.19 85.70 80.83 7 XM_B_Unicode 165504 79.25 85.65 76.77 8 DKIM_VALID_AU 150844 67.27 60.32 69.97 9 XMListUnsubscribeExists 138187 67.26 75.39 64.10 10 BAYES_50 122466 48.20 26.01 56.81 11 XM_B_SpammyWords 110732 58.95 78.49 51.36 12 XM_B_Unicode3 102409 45.44 40.11 47.50 13 HTML_FONT_LOW_CONTRAST 78038 35.66 34.29 36.20 14 LOC_TINY_FONT_1 77013 35.22 33.91 35.72 15 RCVD_IN_MSPIKE_H2 69402 32.94 34.88 32.19 16 FVGT_m_MULTI_ODD 64687 30.27 30.96 30.01 17 DKIM_VALID_EF 60945 30.15 35.01 28.27 18 XM_B_SpammyWords2 54975 32.49 50.52 25.50 19 XMSubLong 51066 21.83 17.06 23.69 20 T_KAM_HTML_FONT_INVALID 47396 23.48 27.35 21.98 21 MIME_HTML_ONLY 45229 23.73 30.84 20.98 22 T_TM2_M_HEADER_IN_MSG 43627 20.26 20.34 20.24 23 USER_IN_DEF_DKIM_WL 41181 14.11 1.25 19.10 24 XM_Multi_Part_URI 36831 16.77 15.97 17.08 25 TR_XM_DK_Unsub 36102 20.08 28.68 16.75 26 UNPARSEABLE_RELAY 27625 12.40 11.34 12.81 27 ALL_TRUSTED 26702 9.62 2.49 12.39 28 BAYES_60 25388 10.48 7.13 11.78 29 TR_MAX_INTL_RELAY 22250 11.75 15.42 10.32 30 XM_DKIMWhitelistDomains 21408 7.17 0.05 9.93 31 XM_Evil_Numbers_Gen 20567 8.26 4.98 9.54 32 XM_DK_Undo_02 19504 24.40 63.99 9.05 33 RCVD_IN_VALIDITY_SAFE 17822 6.61 2.33 8.27 34 XM_B_SpammyWords3 17648 10.47 16.34 8.19 35 LOTS_OF_MONEY 17498 10.70 17.37 8.12 36 XM_B_Unsub 16996 9.79 14.69 7.88 37 LotsOfNums_01 16806 6.65 3.69 7.80 38 RCVD_IN_VALIDITY_CERTIFIED 15515 5.68 1.76 7.20 39 BAYES_99 15192 18.79 49.06 7.05 40 T_TooManySym_01 14598 5.47 2.12 6.77 41 TR_XM_BayesUnsub 14563 8.82 14.16 6.76 42 HTML_IMAGE_RATIO_02 14428 6.23 5.03 6.69 43 TR_XM_SpammyWords4 14163 9.24 16.12 6.57 44 XM_H_GMP 14019 6.23 5.52 6.50 45 BAYES_00 13599 4.63 0.32 6.31 46 TooManyTo_001 13428 5.67 4.23 6.23 47 XM_B_PhoneNumber 13356 5.21 2.68 6.20 48 BAYES_80 13270 7.07 9.43 6.16 49 BOTNET_IPINHOSTNAME 13248 7.90 12.44 6.15 50 RCVD_IN_MSPIKE_H3 12367 8.10 14.20 5.74 51 RCVD_IN_MSPIKE_WL 12367 8.10 14.20 5.74 52 BAYES_999 11430 14.34 37.65 5.30 53 XMStrtUSub 11384 5.02 4.35 5.28 54 TR_XM_DK_Bayes 11041 3.76 0.26 5.12 55 RELAYCOUNTRY_META 11032 11.68 28.61 5.12 56 TR_XM_DK_Bayes1 10949 3.72 0.23 5.08 57 HTML_IMAGE_RATIO_04 10702 4.46 3.16 4.96 58 XM_H_Long_From01 10467 4.46 3.45 4.86 59 IN_ZIMBRA_NJ_WHITELIST 9918 3.32 0.02 4.60 60 XM_UncommonTLD01 9817 5.00 6.15 4.55 61 TR_XM_DKIM_Undo 9625 18.05 53.07 4.46 62 TR_XM_DK_Bayes2 9453 3.20 0.16 4.38 63 XMSubMetaSx_00 9276 4.54 5.16 4.30 64 MPART_ALT_DIFF 9028 4.43 5.05 4.19 65 BAYES_95 8977 4.54 5.51 4.16 66 HTML_IMAGE_RATIO_06 8547 3.80 3.38 3.96 67 XM_B_Phish_Phrases 8014 3.77 3.91 3.72 68 BAYES_40 7686 2.90 1.20 3.57 69 XM_Body_Dirty_Words 7561 4.54 7.21 3.51 70 TO_MALFORMED 7263 2.43 0.00 3.37 71 TR_XM_SpammyRelay 7150 9.01 23.70 3.32 72 INVALID_MSGID 6964 2.37 0.14 3.23 73 T_TooManySym_02 6916 2.46 0.52 3.21 74 XMNumbers 6860 3.27 3.50 3.18 75 MIME_QP_LONG_LINE 6559 2.45 0.93 3.04 76 MIME_HTML_MOSTLY 6321 3.17 3.79 2.93 77 XM_SPF_SoftFail 6193 3.24 4.17 2.87 78 ANY_BOUNCE_MESSAGE 6189 2.40 1.18 2.87 79 BOUNCE_MESSAGE 6189 2.40 1.18 2.87 80 XM_CamelCaseFrm001 6140 2.79 2.65 2.85 81 TR_XM_UnparsRelay 5972 4.08 7.45 2.77 82 RELAYCOUNTRY_CA 5971 6.93 17.64 2.77 83 XM_B_SpammyTLD 5736 2.69 2.78 2.66 84 XMBdyGiftCard01 5678 2.04 0.51 2.63 85 BAYES_20 5656 2.14 0.88 2.62 86 T_REMOTE_IMAGE 5641 2.26 1.33 2.62 87 HTML_IMAGE_RATIO_08 5594 2.86 3.56 2.59 88 FROM_EXCESS_BASE64 5531 2.25 1.44 2.57 89 TR_XM_PhishingBody 5232 2.79 3.71 2.43 90 XMStockSpam_06 5001 2.10 1.53 2.32 91 MIME_HTML_ONLY_MULTI 4777 2.27 2.42 2.22 92 TM2_M_URI_OPT_OUT 4676 2.25 2.44 2.17 93 TVD_RCVD_IP 4487 1.87 1.34 2.08 94 MAILING_LIST_MULTI 4337 1.93 1.74 2.01 95 T_XMDrugObfuBody_14 4194 2.64 4.43 1.95 96 UNTRUSTED_Relay 4128 3.45 7.42 1.91 97 RCVD_IN_IADB_LISTED 3944 1.54 0.79 1.83 98 XMBSHREFv2 3859 1.35 0.22 1.79 99 TM2_M_VERY_LONG_WORD 3839 2.04 2.71 1.78 100 XM_PDF 3743 1.33 0.30 1.74 101 XMSexyCombo_05 3740 2.50 4.46 1.73 102 DKIM_INVALID 3704 2.57 4.78 1.72 103 RCVD_IN_IADB_SPF 3660 1.38 0.57 1.70 104 XMBody_17 3580 4.06 10.26 1.66 105 XM_B_Investor 3529 2.25 3.82 1.64 106 TR_LOTS_OF_MONEY3 3442 2.89 6.22 1.60 107 XMBrknScrpt_02 3433 1.68 1.90 1.59 108 XM_DK_Undo_01 3433 1.48 1.18 1.59 109 TooManyTo_002 3391 1.54 1.47 1.57 110 RCVD_IN_IADB_SENDERID 3366 1.26 0.48 1.56 111 BAYES_05 3347 1.25 0.46 1.55 112 RCVD_IN_IADB_DK 3312 1.24 0.47 1.54 113 TVD_SPACE_RATIO 3286 1.12 0.09 1.52 114 TR_XM_SpammyWords2 3272 8.13 25.18 1.52 115 IN_HORDE_ADDRESS_BOOK 3268 1.10 0.03 1.52 116 XMDiploma_00 3262 1.64 1.98 1.51 117 RCVD_IN_BL_SPAMCOP_NET 3207 7.67 23.62 1.49 118 XM_ProductURIs 3123 1.25 0.75 1.45 119 XM_SendGrid 3081 1.33 1.09 1.43 120 T_XMDrugObfuBody_08 3007 1.95 3.37 1.39 121 HTML_MIME_NO_HTML_TAG 2986 1.55 1.97 1.39 122 URI_TRY_3LD 2894 1.57 2.15 1.34 123 XM_OfRef6 2740 2.75 6.55 1.27 124 BOTNET 2567 3.45 9.27 1.19 125 XM_B_SEO 2554 1.97 3.99 1.18 126 XMGappySubj_01 2510 0.89 0.19 1.16 127 T_TooManySym_03 2488 0.88 0.18 1.15 128 TR_XM_SpammyWords5 2477 2.31 5.29 1.15 129 XM_B_Unsub2 2461 1.52 2.49 1.14 130 RCVD_IN_IADB_VOUCHED 2447 1.00 0.64 1.14 131 TR_Symld_Words 2412 1.08 1.00 1.12 132 XM_GoogleGroups 2396 0.93 0.47 1.11 133 TR_XM_DK_SendGrid 2373 1.03 0.84 1.10 134 XM_B_SpammyWords4 2322 1.40 2.24 1.08 135 XM_UB50 2319 1.67 3.21 1.08 136 URI_HEX 2201 0.95 0.75 1.02 137 T_XMHurry_00 2187 1.38 2.32 1.01 138 XM_B_COPY_HTML 2168 0.96 0.83 1.01 139 XM_H_Long_From02 2137 0.97 0.93 0.99 140 TR_XM_Base64_M1 2137 0.91 0.69 0.99 141 XMPhish30 2114 0.87 0.59 0.98 142 XMSubMetaI_00 2057 0.99 1.09 0.95 143 XMGappySubj_02 2030 0.71 0.13 0.94 144 TR_XM_SPAMCOP 2004 6.67 21.45 0.93 145 SUBJ_ALL_CAPS 2002 1.64 3.46 0.93 146 RCVD_IN_PSBL 1873 0.95 1.15 0.87 147 MPART_ALT_DIFF_COUNT 1830 0.82 0.76 0.85 148 RCVD_IN_IADB_OPTIN 1816 0.72 0.40 0.84 149 THIS_AD 1731 0.91 1.18 0.80 150 TooManyTo_003 1729 0.97 1.42 0.80 151 XMSubMetaSxObfu_02 1708 0.66 0.31 0.79 152 USER_IN_WELCOMELIST 1674 0.56 0.00 0.78 153 USER_IN_WHITELIST 1674 0.56 0.00 0.78 154 URI_NOVOWEL 1646 0.85 1.08 0.76 155 HTTPS_HTTP_MISMATCH 1644 0.92 1.32 0.76 156 XM_B_DNDMA 1587 0.66 0.45 0.74 157 T_FILL_THIS_FORM_SHORT 1478 1.77 4.57 0.69 158 HTML_TAG_BALANCE_BODY 1448 1.07 2.08 0.67 159 TR_XM_SEO4 1434 1.45 3.47 0.67 160 SHOPIFY_IMG_NOT_RCVD_SFY 1422 0.64 0.59 0.66 161 RCVD_IN_VALIDITY_RPBL 1421 2.10 5.83 0.66 162 XM_B_FormFill 1402 0.49 0.08 0.65 163 KHOP_HELO_FCRDNS 1373 0.89 1.53 0.64 164 XMGenDplmaNmb 1349 0.71 0.94 0.63 165 TooManyTo_004 1348 0.84 1.39 0.63 166 TR_MetaPhish_Combo_01 1323 0.62 0.64 0.61 167 DKIM_ADSP_CUSTOM_MED 1310 0.68 0.85 0.61 168 DKIM_ADSP_NXDOMAIN 1307 0.77 1.18 0.61 169 HTML_FONT_FACE_BAD 1297 0.67 0.86 0.60 170 XMBody_95 1277 0.45 0.09 0.59 171 T_XMDrugObfuBody_00 1270 0.78 1.26 0.59 172 LOW_PRICE 1264 0.48 0.20 0.59 173 XMPhish14 1257 0.73 1.10 0.58 174 SpammyFromTLD_01 1252 1.23 2.90 0.58 175 XM_B_REG_HTML 1251 0.55 0.46 0.58 176 XM_H_PHPMailer 1248 0.63 0.78 0.58 177 DIET_1 1242 0.74 1.16 0.58 178 AC_BR_BONANZA 1199 0.81 1.45 0.56 179 XMLngstWrd_00 1194 0.59 0.69 0.55 180 TooManyTo_005 1177 0.77 1.36 0.55 181 PLING_QUERY 1112 0.53 0.58 0.52 182 RELAYCOUNTRY_AU 1100 1.07 2.53 0.51 183 FILL_THIS_FORM 1100 0.46 0.33 0.51 184 XMPhish08 1050 0.52 0.60 0.49 185 AD_PREFS 1035 0.36 0.03 0.48 186 XMClaimOffer 1004 0.52 0.67 0.47 187 T_TooManySym_04 990 0.34 0.02 0.46 188 XMNoVowels 989 0.43 0.36 0.46 189 XM_DIRTYINTL 985 0.91 2.09 0.46 190 TM2_M_OBFU_COMMENT 939 0.50 0.65 0.44 191 TM2_M_A_HREF_HREF 924 0.53 0.79 0.43 192 MIME_CHARSET_FARAWAY 900 0.53 0.83 0.42 193 T_STY_INVIS_DIRECT 889 0.80 1.79 0.41 194 NUMERIC_HTTP_ADDR 847 0.34 0.22 0.39 195 XM_RXBody 837 0.45 0.60 0.39 196 XMSubMetaSxObfu_03 824 0.46 0.66 0.38 197 SUBJ_DOLLARS 811 0.45 0.65 0.38 198 LongTLD 808 0.40 0.46 0.37 199 NML_ADSP_CUSTOM_MED 808 0.49 0.77 0.37 200 XM_S_SubURI 796 0.28 0.05 0.37 ----------------------------------------------------------------------