Email: 303163 Autolearn: 0 AvgScore: 4.82 AvgScanTime: 1.13 sec Spam: 110023 Autolearn: 0 AvgScore: 13.37 AvgScanTime: 1.24 sec Ham: 193140 Autolearn: 0 AvgScore: -0.06 AvgScanTime: 1.07 sec Time Spent Running SA: 95.37 hours Time Spent Processing Spam: 37.84 hours Time Spent Processing Ham: 57.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 106676 84.80 96.96 77.88 2 DKIM_SIGNED 101126 79.96 91.91 73.16 3 XM_DK_Pass 98251 78.39 89.30 72.18 4 DKIM_VALID 97484 77.85 88.60 71.72 5 XM_B_Unicode 96294 75.08 87.52 67.99 6 RELAYCOUNTRY_US 94163 79.09 85.58 75.39 7 DCC_CHECK 85529 56.04 77.74 43.69 8 XMListUnsubscribeExists 85298 62.49 77.53 53.92 9 DKIM_VALID_AU 82507 66.84 74.99 62.19 10 XM_B_SpammyWords 81728 54.42 74.28 43.11 11 XM_DK_Undo_02 54238 22.34 49.30 6.99 12 XM_B_Unicode3 49696 42.38 45.17 40.79 13 HTML_FONT_LOW_CONTRAST 47596 35.52 43.26 31.11 14 LOC_TINY_FONT_1 46871 33.38 42.60 28.13 15 RCVD_IN_MSPIKE_H2 46734 35.53 42.48 31.57 16 XM_B_SpammyWords2 45962 27.95 41.77 20.08 17 BAYES_99 45352 18.62 41.22 5.75 18 FVGT_m_MULTI_ODD 41698 30.09 37.90 25.64 19 TR_XM_DKIM_Undo 40884 15.32 37.16 2.88 20 BAYES_999 37339 15.21 33.94 4.54 21 BAYES_50 36073 49.97 32.79 59.77 22 TR_DCC_Bayes_99 34713 13.17 31.55 2.70 23 T_KAM_HTML_FONT_INVALID 30982 21.91 28.16 18.34 24 DKIM_VALID_EF 29841 28.27 27.12 28.93 25 DCC_CHECK_NEGATIVE 24482 43.93 22.25 56.28 26 T_TM2_M_HEADER_IN_MSG 24478 23.54 22.25 24.27 27 MIME_HTML_ONLY 24177 20.54 21.97 19.73 28 TR_XM_DK_Unsub 22694 17.65 20.63 15.96 29 XM_Multi_Part_URI 21617 21.73 19.65 22.91 30 XMSubLong 20025 19.75 18.20 20.64 31 LOTS_OF_MONEY 18968 9.86 17.24 5.65 32 TR_XM_SpammyWords2 18175 6.58 16.52 0.92 33 TR_XM_SpammyWords4 17714 8.50 16.10 4.17 34 RELAYCOUNTRY_META 16149 7.83 14.68 3.93 35 TR_MAX_INTL_RELAY 15973 10.28 14.52 7.87 36 UNPARSEABLE_RELAY 15328 12.31 13.93 11.38 37 XM_B_SpammyWords3 14968 8.57 13.60 5.71 38 XM_B_Unsub 14878 9.71 13.52 7.54 39 BOTNET_IPINHOSTNAME 14672 8.00 13.34 4.95 40 TR_XM_BayesUnsub 14231 8.82 12.93 6.48 41 TR_XM_SpammyRelay 12329 5.38 11.21 2.06 42 RCVD_IN_BL_SPAMCOP_NET 10730 4.07 9.75 0.83 43 BAYES_80 9695 6.17 8.81 4.66 44 BAYES_60 9407 10.01 8.55 10.84 45 TR_XM_SPAMCOP 9151 3.36 8.32 0.53 46 TR_LOTS_OF_MONEY3 8841 3.63 8.04 1.11 47 TR_XM_UnparsRelay 8824 4.34 8.02 2.24 48 XMBody_17 8545 3.46 7.77 1.00 49 XM_Body_Dirty_Words 8436 4.39 7.67 2.52 50 BOTNET 8385 3.47 7.62 1.10 51 HTML_IMAGE_RATIO_02 8102 6.45 7.36 5.93 52 XM_Evil_Numbers_Gen 7181 7.93 6.53 8.74 53 FSL_BULK_SIG 7089 6.33 6.44 6.26 54 LotsOfNums_01 7083 7.11 6.44 7.49 55 XMSubMetaSx_00 6607 5.51 6.01 5.23 56 UNTRUSTED_Relay 6531 3.52 5.94 2.15 57 RELAYCOUNTRY_CA 6401 3.23 5.82 1.75 58 T_XMDrugObfuBody_14 6050 3.15 5.50 1.81 59 HTML_IMAGE_RATIO_04 5976 5.09 5.43 4.89 60 MPART_ALT_DIFF 5933 4.40 5.39 3.83 61 BAYES_95 5904 3.99 5.37 3.21 62 RCVD_IN_VALIDITY_SAFE 5445 6.57 4.95 7.49 63 XM_SPF_SoftFail 5353 3.34 4.87 2.47 64 TooManyTo_001 5345 6.06 4.86 6.75 65 XM_UncommonTLD01 5111 4.85 4.65 4.97 66 XM_H_GMP 4906 6.44 4.46 7.57 67 XMStrtUSub 4891 5.73 4.45 6.46 68 MIME_HTML_MOSTLY 4844 3.34 4.40 2.74 69 XM_B_Investor 4679 2.92 4.25 2.16 70 XM_B_SEO 4678 2.11 4.25 0.88 71 TR_XM_PhishingBody 4662 2.58 4.24 1.63 72 XM_H_Long_From01 4488 4.37 4.08 4.54 73 TR_XM_SpammyWords5 4469 2.48 4.06 1.57 74 XMSexyCombo_05 4437 2.91 4.03 2.28 75 XM_OfRef6 4311 2.54 3.92 1.76 76 RCVD_IN_VALIDITY_CERTIFIED 4251 5.12 3.86 5.84 77 HTML_IMAGE_RATIO_06 4237 2.92 3.85 2.38 78 TR_XM_SEO4 4028 1.62 3.66 0.46 79 T_XMHurry_00 4022 1.76 3.66 0.69 80 XM_B_PhoneNumber 4014 5.69 3.65 6.86 81 TM2_M_VERY_LONG_WORD 3845 2.12 3.49 1.33 82 HTML_IMAGE_RATIO_08 3797 2.52 3.45 1.98 83 XM_CamelCaseFrm001 3694 2.57 3.36 2.12 84 T_XMDrugObfuBody_08 3679 2.04 3.34 1.30 85 DKIM_INVALID 3642 2.12 3.31 1.44 86 XM_B_Phish_Phrases 3624 3.31 3.29 3.32 87 XM_URI_RBL 3592 1.30 3.26 0.17 88 USER_IN_DEF_DKIM_WL 3466 12.87 3.15 18.40 89 SUBJ_ALL_CAPS 3352 1.95 3.05 1.33 90 MIME_HTML_ONLY_MULTI 3307 2.38 3.01 2.02 91 URI_TRY_3LD 3276 1.72 2.98 1.00 92 XMNumbers 3140 2.98 2.85 3.06 93 XM_UB50 3125 1.60 2.84 0.90 94 AC_BR_BONANZA 3028 1.14 2.75 0.22 95 XM_B_SpammyTLD 2948 7.04 2.68 9.53 96 XMBrknScrpt_02 2878 1.74 2.62 1.24 97 TR_XM_NoHeaderRelay 2832 1.00 2.57 0.10 98 T_TooManySym_01 2767 4.81 2.51 6.11 99 XMDiploma_00 2417 1.60 2.20 1.26 100 XM_B_SpammyWords4 2406 2.09 2.19 2.04 101 FROM_EXCESS_BASE64 2384 2.22 2.17 2.25 102 HTML_TAG_BALANCE_BODY 2361 1.21 2.15 0.68 103 RELAYCOUNTRY_AU 2355 1.06 2.14 0.45 104 XM_HighProb1 2348 0.78 2.13 0.01 105 RCVD_IN_MSPIKE_WL 2302 4.24 2.09 5.47 106 RCVD_IN_MSPIKE_H3 2302 4.24 2.09 5.47 107 TM2_M_URI_OPT_OUT 2294 1.81 2.09 1.65 108 XM_B_Unsub2 2252 1.41 2.05 1.05 109 MPART_ALT_DIFF_COUNT 2166 1.19 1.97 0.74 110 RCVD_IN_VALIDITY_RPBL 2123 0.75 1.93 0.08 111 XMStockSpam_06 2107 1.74 1.92 1.64 112 MIME_QP_LONG_LINE 1931 2.77 1.76 3.34 113 TR_XM_PHPDW 1900 0.75 1.73 0.20 114 TR_XM_PHPForged 1883 0.74 1.71 0.19 115 TR_XM_FormFill2 1833 0.73 1.67 0.20 116 XM_H_PHPOS 1822 0.71 1.66 0.18 117 XMReplyNow 1741 0.75 1.58 0.28 118 XMSlimDrugH 1674 0.78 1.52 0.36 119 MAILING_LIST_MULTI 1604 1.92 1.46 2.18 120 XMBdyGiftCard01 1583 1.30 1.44 1.22 121 DIET_1 1571 0.75 1.43 0.36 122 SpammyFromTLD_01 1555 0.77 1.41 0.41 123 KHOP_HELO_FCRDNS 1554 0.92 1.41 0.65 124 BAYES_40 1537 4.10 1.40 5.64 125 AC_HTML_NONSENSE_TAGS 1514 0.51 1.38 0.01 126 T_FILL_THIS_FORM_SHORT 1511 1.40 1.37 1.41 127 XM_B_COPY_HTML 1491 0.96 1.36 0.73 128 TR_Caps_n_Bayes_99 1491 0.51 1.36 0.04 129 ALL_TRUSTED 1466 13.43 1.33 20.32 130 XM_DIRTYINTL 1441 0.53 1.31 0.09 131 XMPhish30 1432 0.74 1.30 0.43 132 TR_XM_InvalidRelay 1405 0.49 1.28 0.04 133 MISSING_HEADERS 1376 0.61 1.25 0.24 134 URI_HEX 1373 1.64 1.25 1.86 135 TR_XM_INV_DKIM 1372 0.51 1.25 0.10 136 LONGLN_LOW_CONTRAST 1371 0.65 1.25 0.30 137 SHOPIFY_IMG_NOT_RCVD_SFY 1362 0.75 1.24 0.48 138 XM_DK_Undo_01 1349 1.45 1.23 1.58 139 T_REMOTE_IMAGE 1336 2.20 1.21 2.77 140 HTTPS_HTTP_MISMATCH 1322 0.92 1.20 0.75 141 SpammyFromTLD_02 1224 0.52 1.11 0.18 142 XM_UB60 1221 0.44 1.11 0.06 143 T_STY_INVIS_DIRECT 1203 0.62 1.09 0.35 144 XMClaimOffer 1175 0.65 1.07 0.41 145 XMPhish08 1157 0.63 1.05 0.39 146 XMSubMetaI_00 1155 0.81 1.05 0.67 147 HTML_MIME_NO_HTML_TAG 1144 1.21 1.04 1.31 148 ANY_BOUNCE_MESSAGE 1127 2.46 1.02 3.27 149 BOUNCE_MESSAGE 1127 2.46 1.02 3.27 150 TooManyTo_002 1126 1.56 1.02 1.86 151 XMPhish14 1108 0.66 1.01 0.47 152 BAYES_20 1091 2.11 0.99 2.75 153 T_XMDrugObfuBody_00 1071 0.81 0.97 0.71 154 TooManyTo_003 1064 0.94 0.97 0.93 155 XM_SendGrid 1030 1.06 0.94 1.14 156 URI_NOVOWEL 1028 5.54 0.93 8.17 157 TooManyTo_004 1025 0.81 0.93 0.74 158 T_MONEY_PERCENT 1022 0.51 0.93 0.28 159 TR_LOTS_OF_MONEY2 1022 0.51 0.93 0.28 160 HTML_FONT_FACE_BAD 1000 0.58 0.91 0.40 161 TooManyTo_005 1000 0.73 0.91 0.64 162 REPLYTO_WITHOUT_TO_CC 999 0.34 0.91 0.02 163 LongTLD 977 0.43 0.89 0.17 164 XM_ProductURIs 977 0.75 0.89 0.67 165 RDNS_DYNAMIC 971 0.57 0.88 0.39 166 TR_XM_FormFill 947 0.32 0.86 0.01 167 TVD_RCVD_IP 947 1.74 0.86 2.25 168 RCVD_IN_PSBL 946 0.70 0.86 0.61 169 LOADSA_MONEY_COMBO 944 0.33 0.86 0.03 170 PDS_RDNS_DYNAMIC_FP 943 0.38 0.86 0.11 171 XM_UB99 934 0.31 0.85 0.01 172 TR_MetaPhish_Combo_01 932 0.85 0.85 0.85 173 XMSexyCombo_01 917 0.43 0.83 0.21 174 PLING_QUERY 914 0.63 0.83 0.52 175 TR_XM_Base64_M1 912 0.77 0.83 0.73 176 TR_Mismatch_TLD_01 910 0.49 0.83 0.30 177 XMHTMLBadTable_001 900 0.45 0.82 0.24 178 T_TooManySym_02 885 2.60 0.80 3.62 179 HOSTED_IMG_MULTI_PUB_01 875 0.30 0.80 0.02 180 XM_H_PHPMailer 872 0.68 0.79 0.62 181 TM2_M_OBFU_COMMENT 859 0.46 0.78 0.28 182 TR_Symld_Words 854 1.14 0.78 1.35 183 DKIM_ADSP_NXDOMAIN 832 0.58 0.76 0.48 184 BOTNET_NORDNS 830 0.28 0.75 0.01 185 XMGenDplmaNmb 827 0.58 0.75 0.49 186 XM_ShortIntro_01 827 0.45 0.75 0.28 187 FROM_MISSP_EH_MATCH 822 0.27 0.75 0.00 188 XM_H_Long_From02 817 0.88 0.74 0.96 189 XM_B_Phish66 814 0.45 0.74 0.29 190 DKIM_ADSP_CUSTOM_MED 808 0.90 0.73 0.99 191 TO_NO_BRKTS_FROM_MSSP 807 0.27 0.73 0.01 192 TR_Mismatch_TLD_02 803 0.29 0.73 0.04 193 FORGED_MUA_OUTLOOK 800 0.29 0.73 0.04 194 HTML_FONT_TINY_NORDNS 798 0.29 0.73 0.05 195 XMWghtMeta_00 794 0.30 0.72 0.06 196 FROM_MISSPACED 792 0.26 0.72 0.00 197 HELO_DYNAMIC_SPLIT_IP 791 0.26 0.72 0.01 198 AXB_XMAILER_MIMEOLE_OL_024C2 791 0.26 0.72 0.00 199 XFER_LOTSA_MONEY 789 0.27 0.72 0.01 200 FSL_CTYPE_WIN1251 789 0.26 0.72 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150414 84.80 96.96 77.88 2 RELAYCOUNTRY_US 145601 79.09 85.58 75.39 3 DKIM_SIGNED 141294 79.96 91.91 73.16 4 XM_DK_Pass 139404 78.39 89.30 72.18 5 DKIM_VALID 138519 77.85 88.60 71.72 6 XM_B_Unicode 131312 75.08 87.52 67.99 7 DKIM_VALID_AU 120113 66.84 74.99 62.19 8 BAYES_50 115431 49.97 32.79 59.77 9 DCC_CHECK_NEGATIVE 108700 43.93 22.25 56.28 10 XMListUnsubscribeExists 104149 62.49 77.53 53.92 11 DCC_CHECK 84376 56.04 77.74 43.69 12 XM_B_SpammyWords 83254 54.42 74.28 43.11 13 XM_B_Unicode3 78773 42.38 45.17 40.79 14 RCVD_IN_MSPIKE_H2 60969 35.53 42.48 31.57 15 HTML_FONT_LOW_CONTRAST 60094 35.52 43.26 31.11 16 DKIM_VALID_EF 55878 28.27 27.12 28.93 17 LOC_TINY_FONT_1 54336 33.38 42.60 28.13 18 FVGT_m_MULTI_ODD 49524 30.09 37.90 25.64 19 T_TM2_M_HEADER_IN_MSG 46878 23.54 22.25 24.27 20 XM_Multi_Part_URI 44246 21.73 19.65 22.91 21 XMSubLong 39863 19.75 18.20 20.64 22 ALL_TRUSTED 39250 13.43 1.33 20.32 23 XM_B_SpammyWords2 38778 27.95 41.77 20.08 24 MIME_HTML_ONLY 38102 20.54 21.97 19.73 25 USER_IN_DEF_DKIM_WL 35537 12.87 3.15 18.40 26 T_KAM_HTML_FONT_INVALID 35431 21.91 28.16 18.34 27 TR_XM_DK_Unsub 30825 17.65 20.63 15.96 28 UNPARSEABLE_RELAY 21981 12.31 13.93 11.38 29 BAYES_60 20936 10.01 8.55 10.84 30 XM_DKIMWhitelistDomains 20207 6.79 0.33 10.46 31 XM_B_SpammyTLD 18399 7.04 2.68 9.53 32 XM_Evil_Numbers_Gen 16874 7.93 6.53 8.74 33 URI_NOVOWEL 15773 5.54 0.93 8.17 34 TR_MAX_INTL_RELAY 15198 10.28 14.52 7.87 35 XM_H_GMP 14613 6.44 4.46 7.57 36 XM_B_Unsub 14570 9.71 13.52 7.54 37 RCVD_IN_VALIDITY_SAFE 14461 6.57 4.95 7.49 38 LotsOfNums_01 14461 7.11 6.44 7.49 39 XM_DK_Undo_02 13499 22.34 49.30 6.99 40 XM_B_PhoneNumber 13250 5.69 3.65 6.86 41 TooManyTo_001 13038 6.06 4.86 6.75 42 TR_XM_BayesUnsub 12512 8.82 12.93 6.48 43 XMStrtUSub 12486 5.73 4.45 6.46 44 FSL_BULK_SIG 12097 6.33 6.44 6.26 45 T_TooManySym_01 11800 4.81 2.51 6.11 46 HTML_IMAGE_RATIO_02 11452 6.45 7.36 5.93 47 RCVD_IN_VALIDITY_CERTIFIED 11282 5.12 3.86 5.84 48 BAYES_00 11201 3.81 0.32 5.80 49 BAYES_99 11098 18.62 41.22 5.75 50 XM_B_SpammyWords3 11025 8.57 13.60 5.71 51 LOTS_OF_MONEY 10920 9.86 17.24 5.65 52 BAYES_40 10896 4.10 1.40 5.64 53 RCVD_IN_MSPIKE_WL 10567 4.24 2.09 5.47 54 RCVD_IN_MSPIKE_H3 10567 4.24 2.09 5.47 55 IN_ZIMBRA_NJ_WHITELIST 10128 3.37 0.09 5.24 56 XMSubMetaSx_00 10109 5.51 6.01 5.23 57 XM_UncommonTLD01 9607 4.85 4.65 4.97 58 BOTNET_IPINHOSTNAME 9570 8.00 13.34 4.95 59 HTML_IMAGE_RATIO_04 9448 5.09 5.43 4.89 60 TR_XM_DK_Bayes 9446 3.20 0.23 4.89 61 TR_XM_DK_Bayes1 9381 3.17 0.20 4.86 62 BAYES_80 8995 6.17 8.81 4.66 63 BAYES_999 8763 15.21 33.94 4.54 64 XM_H_Long_From01 8760 4.37 4.08 4.54 65 TR_XM_DK_Bayes2 8375 2.81 0.13 4.34 66 TR_XM_SpammyWords4 8056 8.50 16.10 4.17 67 RELAYCOUNTRY_META 7593 7.83 14.68 3.93 68 MPART_ALT_DIFF 7404 4.40 5.39 3.83 69 TO_MALFORMED 7075 2.35 0.06 3.66 70 XM_TLDProd2 7034 2.41 0.24 3.64 71 T_TooManySym_02 6983 2.60 0.80 3.62 72 INVALID_MSGID 6760 2.32 0.25 3.50 73 MIME_QP_LONG_LINE 6455 2.77 1.76 3.34 74 XM_B_Phish_Phrases 6417 3.31 3.29 3.32 75 ANY_BOUNCE_MESSAGE 6319 2.46 1.02 3.27 76 BOUNCE_MESSAGE 6319 2.46 1.02 3.27 77 BAYES_95 6200 3.99 5.37 3.21 78 XMNumbers 5905 2.98 2.85 3.06 79 TR_XM_DKIM_Undo 5558 15.32 37.16 2.88 80 T_REMOTE_IMAGE 5348 2.20 1.21 2.77 81 BAYES_20 5319 2.11 0.99 2.75 82 MIME_HTML_MOSTLY 5291 3.34 4.40 2.74 83 TR_DCC_Bayes_99 5222 13.17 31.55 2.70 84 XM_Body_Dirty_Words 4874 4.39 7.67 2.52 85 RCVD_IN_IADB_LISTED 4855 1.86 0.71 2.51 86 XM_SPF_SoftFail 4763 3.34 4.87 2.47 87 HTML_IMAGE_RATIO_06 4605 2.92 3.85 2.38 88 RCVD_IN_IADB_SPF 4404 1.68 0.62 2.28 89 XMSexyCombo_05 4397 2.91 4.03 2.28 90 FROM_EXCESS_BASE64 4352 2.22 2.17 2.25 91 TVD_RCVD_IP 4337 1.74 0.86 2.25 92 TR_XM_UnparsRelay 4333 4.34 8.02 2.24 93 MAILING_LIST_MULTI 4215 1.92 1.46 2.18 94 XM_B_Investor 4167 2.92 4.25 2.16 95 UNTRUSTED_Relay 4149 3.52 5.94 2.15 96 XM_CamelCaseFrm001 4102 2.57 3.36 2.12 97 RCVD_IN_IADB_SENDERID 4047 1.54 0.57 2.10 98 RCVD_IN_IADB_DK 3993 1.53 0.58 2.07 99 TR_XM_SpammyRelay 3986 5.38 11.21 2.06 100 XM_B_SpammyWords4 3932 2.09 2.19 2.04 101 MIME_HTML_ONLY_MULTI 3903 2.38 3.01 2.02 102 HTML_IMAGE_RATIO_08 3829 2.52 3.45 1.98 103 XMBSHREFv2 3824 1.33 0.18 1.98 104 TooManyTo_002 3591 1.56 1.02 1.86 105 URI_HEX 3591 1.64 1.25 1.86 106 XM_PDF 3584 1.30 0.31 1.86 107 T_XMDrugObfuBody_14 3500 3.15 5.50 1.81 108 XM_OfRef6 3402 2.54 3.92 1.76 109 RELAYCOUNTRY_CA 3378 3.23 5.82 1.75 110 TVD_SPACE_RATIO 3320 1.13 0.08 1.72 111 TM2_M_URI_OPT_OUT 3192 1.81 2.09 1.65 112 XMStockSpam_06 3160 1.74 1.92 1.64 113 TR_XM_PhishingBody 3153 2.58 4.24 1.63 114 IN_HORDE_ADDRESS_BOOK 3095 1.04 0.06 1.60 115 BAYES_05 3064 1.21 0.54 1.59 116 XM_DK_Undo_01 3053 1.45 1.23 1.58 117 TR_XM_SpammyWords5 3036 2.48 4.06 1.57 118 RCVD_IN_IADB_VOUCHED 2866 1.08 0.36 1.48 119 XMGappySubj_01 2818 1.10 0.46 1.46 120 DKIM_INVALID 2775 2.12 3.31 1.44 121 T_FILL_THIS_FORM_SHORT 2731 1.40 1.37 1.41 122 T_TooManySym_03 2639 1.02 0.42 1.37 123 TR_Symld_Words 2612 1.14 0.78 1.35 124 TM2_M_VERY_LONG_WORD 2567 2.12 3.49 1.33 125 SUBJ_ALL_CAPS 2566 1.95 3.05 1.33 126 HTML_MIME_NO_HTML_TAG 2538 1.21 1.04 1.31 127 T_XMDrugObfuBody_08 2508 2.04 3.34 1.30 128 XMDiploma_00 2443 1.60 2.20 1.26 129 XMBrknScrpt_02 2396 1.74 2.62 1.24 130 XM_GoogleGroups 2392 1.02 0.63 1.24 131 XMBdyGiftCard01 2353 1.30 1.44 1.22 132 XMGappySubj_02 2316 0.88 0.32 1.20 133 XM_SendGrid 2198 1.06 0.94 1.14 134 TR_LOTS_OF_MONEY3 2149 3.63 8.04 1.11 135 BOTNET 2123 3.47 7.62 1.10 136 XM_B_Unsub2 2023 1.41 2.05 1.05 137 RCVD_IN_IADB_OPTIN 2007 0.74 0.22 1.04 138 URI_TRY_3LD 1940 1.72 2.98 1.00 139 XMBody_17 1932 3.46 7.77 1.00 140 DKIM_ADSP_CUSTOM_MED 1907 0.90 0.73 0.99 141 XM_H_Long_From02 1856 0.88 0.74 0.96 142 TooManyTo_003 1798 0.94 0.97 0.93 143 TR_XM_SpammyWords2 1784 6.58 16.52 0.92 144 USER_IN_WELCOMELIST 1773 0.58 0.00 0.92 145 USER_IN_WHITELIST 1773 0.58 0.00 0.92 146 XM_UB50 1737 1.60 2.84 0.90 147 XM_B_SEO 1706 2.11 4.25 0.88 148 NO_DNS_FOR_FROM 1681 0.69 0.39 0.87 149 TR_MetaPhish_Combo_01 1640 0.85 0.85 0.85 150 RCVD_IN_BL_SPAMCOP_NET 1602 4.07 9.75 0.83 151 XMSubMetaSxObfu_03 1509 0.70 0.55 0.78 152 HTTPS_HTTP_MISMATCH 1457 0.92 1.20 0.75 153 MPART_ALT_DIFF_COUNT 1428 1.19 1.97 0.74 154 TooManyTo_004 1428 0.81 0.93 0.74 155 TR_XM_DK_SendGrid 1427 0.72 0.70 0.74 156 XM_B_COPY_HTML 1418 0.96 1.36 0.73 157 XMBody_95 1415 0.51 0.13 0.73 158 TR_XM_Base64_M1 1412 0.77 0.83 0.73 159 T_XMDrugObfuBody_00 1379 0.81 0.97 0.71 160 XM_B_FormFill 1367 0.49 0.10 0.71 161 T_XMHurry_00 1328 1.76 3.66 0.69 162 HTML_TAG_BALANCE_BODY 1314 1.21 2.15 0.68 163 XM_ProductURIs 1295 0.75 0.89 0.67 164 XMSubMetaI_00 1286 0.81 1.05 0.67 165 FORGED_GMAIL_RCVD 1257 0.64 0.63 0.65 166 TM2_M_BODY_EMPTY 1257 0.44 0.08 0.65 167 KHOP_HELO_FCRDNS 1250 0.92 1.41 0.65 168 NML_ADSP_CUSTOM_MED 1247 0.65 0.66 0.65 169 TooManyTo_005 1228 0.73 0.91 0.64 170 XM_H_PHPMailer 1192 0.68 0.79 0.62 171 RCVD_IN_PSBL 1171 0.70 0.86 0.61 172 XMSubMetaSxObfu_02 1120 0.50 0.35 0.58 173 T_TooManySym_04 1098 0.38 0.05 0.57 174 XM_B_DNDMA 1085 0.55 0.54 0.56 175 XMNoVowels 1038 0.45 0.28 0.54 176 TR_XM_SPAMCOP 1023 3.36 8.32 0.53 177 PLING_QUERY 1007 0.63 0.83 0.52 178 XMEmptyBody_01 991 0.34 0.04 0.51 179 XMGenDplmaNmb 944 0.58 0.75 0.49 180 HELO_NODOT 924 0.41 0.28 0.48 181 SHOPIFY_IMG_NOT_RCVD_SFY 922 0.75 1.24 0.48 182 HELO_NO_DOMAIN 922 0.41 0.28 0.48 183 DKIM_ADSP_NXDOMAIN 918 0.58 0.76 0.48 184 XMPhish14 907 0.66 1.01 0.47 185 XMWhlSbjSex 894 0.35 0.14 0.46 186 TR_XM_SEO4 881 1.62 3.66 0.46 187 RELAYCOUNTRY_AU 861 1.06 2.14 0.45 188 XMLngstWrd_00 843 0.45 0.47 0.44 189 XMPhish30 825 0.74 1.30 0.43 190 SpammyFromTLD_01 789 0.77 1.41 0.41 191 XMClaimOffer 784 0.65 1.07 0.41 192 XM_S_SubURI 781 0.28 0.06 0.40 193 HTML_FONT_FACE_BAD 772 0.58 0.91 0.40 194 RDNS_DYNAMIC 759 0.57 0.88 0.39 195 XMPhish08 758 0.63 1.05 0.39 196 XM_RXBody 748 0.46 0.59 0.39 197 LOW_PRICE 740 0.31 0.18 0.38 198 HTML_IMAGE_ONLY_20 735 0.37 0.34 0.38 199 CTE_8BIT_MISMATCH 726 0.24 0.01 0.38 200 HTML_IMAGE_ONLY_16 711 0.25 0.03 0.37 ----------------------------------------------------------------------