Email: 538990 Autolearn: 0 AvgScore: 4.87 AvgScanTime: 1.19 sec Spam: 191378 Autolearn: 0 AvgScore: 13.33 AvgScanTime: 1.33 sec Ham: 347612 Autolearn: 0 AvgScore: 0.22 AvgScanTime: 1.12 sec Time Spent Running SA: 178.79 hours Time Spent Processing Spam: 70.88 hours Time Spent Processing Ham: 107.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 185015 90.41 96.68 86.96 2 DKIM_SIGNED 177036 82.07 92.51 76.33 3 XM_DK_Pass 171668 80.18 89.70 74.94 4 DKIM_VALID 169419 79.12 88.53 73.93 5 XM_B_Unicode 166600 76.41 87.05 70.55 6 RELAYCOUNTRY_US 165631 83.76 86.55 82.22 7 DCC_CHECK 147531 52.27 77.09 38.61 8 XMListUnsubscribeExists 146805 61.02 76.71 52.38 9 XM_B_SpammyWords 143661 56.40 75.07 46.12 10 DKIM_VALID_AU 137929 64.16 72.07 59.80 11 XM_DK_Undo_02 91621 20.71 47.87 5.76 12 XM_B_Unicode3 87943 42.44 45.95 40.51 13 XM_B_SpammyWords2 85102 28.55 44.47 19.78 14 LOC_TINY_FONT_1 84643 32.20 44.23 25.58 15 HTML_FONT_LOW_CONTRAST 80583 33.70 42.11 29.07 16 RCVD_IN_MSPIKE_H2 79681 35.67 41.64 32.39 17 BAYES_99 76890 17.18 40.18 4.52 18 FVGT_m_MULTI_ODD 74714 30.93 39.04 26.46 19 TR_XM_DKIM_Undo 70749 14.71 36.97 2.46 20 BAYES_50 70515 52.50 36.85 61.11 21 BAYES_999 63376 14.01 33.12 3.49 22 T_KAM_HTML_FONT_INVALID 57978 24.33 30.30 21.05 23 TR_DCC_Bayes_99 57755 11.88 30.18 1.80 24 DKIM_VALID_EF 54921 28.60 28.70 28.55 25 T_TM2_M_HEADER_IN_MSG 47384 28.57 24.76 30.66 26 DCC_CHECK_NEGATIVE 43824 47.69 22.90 61.34 27 MIME_HTML_ONLY 42690 20.17 22.31 18.99 28 TR_XM_DK_Unsub 42018 16.77 21.96 13.91 29 XMSubLong 39643 21.86 20.71 22.49 30 XM_Multi_Part_URI 37989 16.91 19.85 15.29 31 LOTS_OF_MONEY 35433 10.88 18.51 6.68 32 TR_XM_SpammyWords4 32860 9.00 17.17 4.50 33 TR_XM_SpammyWords2 32491 6.54 16.98 0.79 34 XM_B_SpammyWords3 27865 8.67 14.56 5.42 35 UNPARSEABLE_RELAY 27139 12.20 14.18 11.11 36 XM_B_Unsub 25983 9.80 13.58 7.72 37 RELAYCOUNTRY_META 25363 7.36 13.25 4.11 38 TR_MAX_INTL_RELAY 25271 9.15 13.20 6.91 39 TR_XM_BayesUnsub 25196 8.81 13.17 6.41 40 BOTNET_IPINHOSTNAME 24945 7.20 13.03 3.99 41 TR_XM_SpammyRelay 18765 4.90 9.81 2.20 42 XM_Evil_Numbers_Gen 17744 8.93 9.27 8.74 43 RCVD_IN_BL_SPAMCOP_NET 16642 3.49 8.70 0.63 44 BAYES_80 15328 5.57 8.01 4.22 45 LotsOfNums_01 14911 9.28 7.79 10.10 46 BOTNET 14634 3.48 7.65 1.19 47 TR_XM_UnparsRelay 14015 3.75 7.32 1.78 48 FSL_BULK_SIG 13792 6.20 7.21 5.65 49 TR_XM_SPAMCOP 13728 2.76 7.17 0.33 50 BAYES_60 13411 8.40 7.01 9.16 51 TR_LOTS_OF_MONEY3 13212 2.97 6.90 0.80 52 XMBody_17 12805 2.87 6.69 0.77 53 XM_Body_Dirty_Words 12194 4.15 6.37 2.93 54 HTML_IMAGE_RATIO_02 11654 5.44 6.09 5.08 55 XM_B_PhoneNumber 11282 8.62 5.90 10.13 56 HTML_IMAGE_RATIO_04 10840 4.34 5.66 3.61 57 UNTRUSTED_Relay 10531 3.01 5.50 1.64 58 XMSubMetaSx_00 10467 4.49 5.47 3.96 59 MPART_ALT_DIFF 9982 4.13 5.22 3.53 60 XM_SPF_SoftFail 9726 3.82 5.08 3.12 61 XM_H_Long_From01 9581 5.25 5.01 5.38 62 BAYES_95 9223 3.44 4.82 2.68 63 XM_UncommonTLD01 8989 4.20 4.70 3.93 64 XM_OfRef6 8900 2.32 4.65 1.04 65 XM_B_Investor 8785 2.64 4.59 1.56 66 XM_B_SEO 8769 2.41 4.58 1.21 67 RCVD_IN_VALIDITY_RPBL 8287 1.65 4.33 0.18 68 XM_B_Phish_Phrases 8261 4.48 4.32 4.58 69 RELAYCOUNTRY_CA 8217 2.26 4.29 1.15 70 TR_XM_PhishingBody 8047 2.55 4.20 1.64 71 TooManyTo_001 8013 6.77 4.19 8.20 72 TR_XM_SpammyWords5 7904 2.83 4.13 2.12 73 TR_XM_SEO4 7842 1.90 4.10 0.69 74 DKIM_INVALID 7617 2.96 3.98 2.39 75 RCVD_IN_VALIDITY_SAFE 7614 4.90 3.98 5.41 76 XM_H_GMP 7492 5.34 3.91 6.13 77 TM2_M_VERY_LONG_WORD 7384 3.07 3.86 2.63 78 HTML_IMAGE_RATIO_06 7100 3.39 3.71 3.21 79 T_XMDrugObfuBody_08 7005 2.39 3.66 1.69 80 XMSexyCombo_05 6714 2.06 3.51 1.27 81 XMStrtUSub 6579 4.02 3.44 4.34 82 XMNumbers 6394 2.84 3.34 2.56 83 T_XMDrugObfuBody_14 6365 2.23 3.33 1.62 84 MIME_HTML_MOSTLY 6290 2.63 3.29 2.27 85 MIME_QP_LONG_LINE 6269 4.58 3.28 5.29 86 HTML_IMAGE_RATIO_08 6180 2.53 3.23 2.15 87 MIME_HTML_ONLY_MULTI 6162 2.36 3.22 1.88 88 XM_B_SpammyTLD 5969 3.55 3.12 3.79 89 RCVD_IN_MSPIKE_WL 5685 4.85 2.97 5.89 90 RCVD_IN_MSPIKE_H3 5685 4.85 2.97 5.89 91 RCVD_IN_VALIDITY_CERTIFIED 5589 3.64 2.92 4.04 92 USER_IN_DEF_DKIM_WL 5563 10.36 2.91 14.46 93 XM_URI_RBL 5539 1.22 2.89 0.29 94 T_XMHurry_00 5441 1.50 2.84 0.75 95 XM_CamelCaseFrm001 5414 2.55 2.83 2.39 96 URI_TRY_3LD 5284 1.48 2.76 0.78 97 TM2_M_URI_OPT_OUT 5248 2.01 2.74 1.60 98 XM_UB50 5184 1.53 2.71 0.88 99 XMBrknScrpt_02 5072 1.68 2.65 1.15 100 XM_B_SpammyWords4 4865 1.31 2.54 0.63 101 XMDiploma_00 4851 2.15 2.53 1.94 102 SUBJ_ALL_CAPS 4799 2.36 2.51 2.28 103 T_TooManySym_01 4370 4.25 2.28 5.33 104 RELAYCOUNTRY_AU 4201 1.32 2.20 0.83 105 T_REMOTE_IMAGE 3946 3.06 2.06 3.61 106 ALL_TRUSTED 3898 10.02 2.04 14.42 107 XM_B_Unsub2 3805 1.54 1.99 1.29 108 XMStockSpam_06 3769 1.21 1.97 0.79 109 MAILING_LIST_MULTI 3594 2.54 1.88 2.90 110 TR_XM_NoHeaderRelay 3578 0.74 1.87 0.12 111 HTML_TAG_BALANCE_BODY 3459 1.08 1.81 0.69 112 SpammyFromTLD_01 3239 1.17 1.69 0.89 113 KHOP_HELO_FCRDNS 3224 1.82 1.68 1.89 114 FROM_EXCESS_BASE64 3188 1.89 1.67 2.02 115 T_FILL_THIS_FORM_SHORT 3117 1.15 1.63 0.89 116 XM_DK_Undo_01 3083 1.85 1.61 1.98 117 XM_H_Long_From02 3045 1.18 1.59 0.96 118 HOSTED_IMG_MULTI_PUB_01 3040 0.58 1.59 0.02 119 AC_BR_BONANZA 2900 0.60 1.52 0.09 120 HTML_MIME_NO_HTML_TAG 2873 2.05 1.50 2.35 121 TR_XM_InvalidRelay 2753 0.53 1.44 0.03 122 T_XMDrugObfuBody_00 2612 1.09 1.36 0.93 123 BAYES_40 2561 3.58 1.34 4.82 124 RCVD_IN_IADB_LISTED 2536 2.88 1.33 3.74 125 XMGenDplmaNmb 2530 1.18 1.32 1.11 126 LONGLN_LOW_CONTRAST 2525 0.66 1.32 0.30 127 T_MONEY_PERCENT 2424 0.68 1.27 0.36 128 TR_LOTS_OF_MONEY2 2424 0.68 1.27 0.36 129 XM_B_COPY_HTML 2384 0.78 1.25 0.52 130 TR_XM_PHPForged 2361 0.65 1.23 0.34 131 DKIM_ADSP_CUSTOM_MED 2346 1.02 1.23 0.91 132 TR_XM_PHPDW 2344 0.66 1.22 0.34 133 TR_XM_FormFill2 2309 0.65 1.21 0.35 134 XM_H_PHPOS 2294 0.64 1.20 0.33 135 XM_SendGrid 2272 1.32 1.19 1.40 136 SpammyFromTLD_02 2262 0.66 1.18 0.38 137 XM_HighProb1 2256 0.43 1.18 0.02 138 XMPhish14 2244 0.68 1.17 0.41 139 URI_HEX 2235 1.14 1.17 1.12 140 TR_Caps_n_Bayes_99 2233 0.42 1.17 0.01 141 XMPhish30 2165 0.78 1.13 0.58 142 RCVD_IN_IADB_SPF 2160 2.52 1.13 3.29 143 XMReplyNow 2131 0.58 1.11 0.29 144 NML_ADSP_CUSTOM_MED 2075 0.73 1.08 0.54 145 XMBdyGiftCard01 2075 0.91 1.08 0.81 146 RELAYCOUNTRY_FR 2033 0.51 1.06 0.21 147 HTTPS_HTTP_MISMATCH 2019 0.85 1.05 0.74 148 RCVD_IN_IADB_DK 2016 2.21 1.05 2.85 149 RCVD_IN_IADB_SENDERID 2004 2.26 1.05 2.92 150 URI_NOVOWEL 1988 2.22 1.04 2.87 151 XM_ProductURIs 1969 0.75 1.03 0.60 152 URIBL_DBL_SPAM 1964 0.38 1.03 0.02 153 XM_B_Phish66 1913 0.56 1.00 0.32 154 XM_B_DNDMA 1896 0.91 0.99 0.86 155 XMSubMetaI_00 1893 0.80 0.99 0.69 156 RDNS_DYNAMIC 1800 0.62 0.94 0.45 157 BAYES_20 1797 2.35 0.94 3.13 158 TR_XM_INV_DKIM 1794 0.37 0.94 0.05 159 PLING_QUERY 1789 0.67 0.93 0.53 160 FORGED_GMAIL_RCVD 1771 0.70 0.93 0.58 161 PDS_RDNS_DYNAMIC_FP 1761 0.51 0.92 0.28 162 MPART_ALT_DIFF_COUNT 1747 0.65 0.91 0.50 163 XM_DIRTYINTL 1744 0.41 0.91 0.13 164 TR_MetaPhish_Combo_01 1720 0.87 0.90 0.85 165 XMSexyCombo_01 1695 0.48 0.89 0.26 166 XMHTML_After_End 1692 0.50 0.88 0.29 167 XM_UB99 1684 0.32 0.88 0.01 168 THIS_AD 1677 0.58 0.88 0.41 169 BOTNET_NORDNS 1661 0.31 0.87 0.01 170 XMHTMLBadTable_001 1641 0.48 0.86 0.28 171 T_STY_INVIS_DIRECT 1637 0.51 0.86 0.31 172 TR_Symld_Words 1612 1.26 0.84 1.49 173 XMMoneyMeta_00 1607 0.62 0.84 0.50 174 TVD_RCVD_IP 1597 1.21 0.83 1.42 175 TR_XM_Base64_M1 1596 0.80 0.83 0.78 176 TR_XM_FormFill 1575 0.31 0.82 0.02 177 XMSubMetaSxObfu_03 1537 0.52 0.80 0.36 178 RELAYCOUNTRY_GB 1515 0.56 0.79 0.44 179 XMPhish08 1494 0.45 0.78 0.27 180 TM2_M_BODY_EMPTY 1491 0.51 0.78 0.37 181 XM_OfRef7 1457 0.36 0.76 0.14 182 TooManyTo_002 1455 1.94 0.76 2.59 183 HTML_FONT_FACE_BAD 1418 0.54 0.74 0.42 184 XM_B_COVIDMETA 1416 0.35 0.74 0.13 185 XMEmptyBody_01 1390 0.32 0.73 0.10 186 RCVD_IN_PSBL 1385 0.44 0.72 0.28 187 DKIM_ADSP_NXDOMAIN 1353 0.44 0.71 0.30 188 XMClaimOffer 1346 0.51 0.70 0.40 189 XM_UB60 1341 0.29 0.70 0.07 190 MISSING_HEADERS 1324 0.50 0.69 0.39 191 TR_XM_COVIDMETA4 1307 0.32 0.68 0.11 192 TooManyTo_003 1280 1.19 0.67 1.48 193 XMSubMetaSSx_00 1270 0.33 0.66 0.15 194 HELO_DYNAMIC_SPLIT_IP 1257 0.24 0.66 0.00 195 XM_UB999 1248 0.24 0.65 0.01 196 LOADSA_MONEY_COMBO 1243 0.27 0.65 0.06 197 TR_XM_DK_SendGrid 1240 0.81 0.65 0.90 198 XM_H_Undi_Recip 1224 0.35 0.64 0.19 199 RCVD_IN_IADB_VOUCHED 1213 1.88 0.63 2.57 200 T_Symld_Words_02 1211 0.57 0.63 0.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 302294 90.41 96.68 86.96 2 RELAYCOUNTRY_US 285819 83.76 86.55 82.22 3 DKIM_SIGNED 265327 82.07 92.51 76.33 4 XM_DK_Pass 260490 80.18 89.70 74.94 5 DKIM_VALID 257006 79.12 88.53 73.93 6 XM_B_Unicode 245225 76.41 87.05 70.55 7 DCC_CHECK_NEGATIVE 213210 47.69 22.90 61.34 8 BAYES_50 212442 52.50 36.85 61.11 9 DKIM_VALID_AU 207871 64.16 72.07 59.80 10 XMListUnsubscribeExists 182082 61.02 76.71 52.38 11 XM_B_SpammyWords 160335 56.40 75.07 46.12 12 XM_B_Unicode3 140829 42.44 45.95 40.51 13 DCC_CHECK 134220 52.27 77.09 38.61 14 RCVD_IN_MSPIKE_H2 112575 35.67 41.64 32.39 15 T_TM2_M_HEADER_IN_MSG 106588 28.57 24.76 30.66 16 HTML_FONT_LOW_CONTRAST 101054 33.70 42.11 29.07 17 DKIM_VALID_EF 99255 28.60 28.70 28.55 18 FVGT_m_MULTI_ODD 91972 30.93 39.04 26.46 19 LOC_TINY_FONT_1 88920 32.20 44.23 25.58 20 XMSubLong 78175 21.86 20.71 22.49 21 T_KAM_HTML_FONT_INVALID 73164 24.33 30.30 21.05 22 XM_B_SpammyWords2 68756 28.55 44.47 19.78 23 MIME_HTML_ONLY 66028 20.17 22.31 18.99 24 XM_Multi_Part_URI 53166 16.91 19.85 15.29 25 USER_IN_DEF_DKIM_WL 50258 10.36 2.91 14.46 26 ALL_TRUSTED 50119 10.02 2.04 14.42 27 TR_XM_DK_Unsub 48368 16.77 21.96 13.91 28 UNPARSEABLE_RELAY 38606 12.20 14.18 11.11 29 XM_B_PhoneNumber 35204 8.62 5.90 10.13 30 LotsOfNums_01 35110 9.28 7.79 10.10 31 BAYES_60 31841 8.40 7.01 9.16 32 XM_Evil_Numbers_Gen 30377 8.93 9.27 8.74 33 BAYES_00 29387 5.61 0.45 8.45 34 TooManyTo_001 28502 6.77 4.19 8.20 35 XM_B_Unsub 26836 9.80 13.58 7.72 36 IN_ZIMBRA_NJ_WHITELIST 25226 4.72 0.10 7.26 37 TR_MAX_INTL_RELAY 24024 9.15 13.20 6.91 38 XM_DKIMWhitelistDomains 23361 4.34 0.02 6.72 39 LOTS_OF_MONEY 23219 10.88 18.51 6.68 40 TR_XM_BayesUnsub 22276 8.81 13.17 6.41 41 XM_H_GMP 21312 5.34 3.91 6.13 42 TR_XM_DK_Bayes 20698 3.95 0.32 5.95 43 RCVD_IN_MSPIKE_H3 20460 4.85 2.97 5.89 44 RCVD_IN_MSPIKE_WL 20460 4.85 2.97 5.89 45 TR_XM_DK_Bayes1 20406 3.90 0.31 5.87 46 XM_DK_Undo_02 20012 20.71 47.87 5.76 47 FSL_BULK_SIG 19645 6.20 7.21 5.65 48 XM_B_SpammyWords3 18841 8.67 14.56 5.42 49 RCVD_IN_VALIDITY_SAFE 18816 4.90 3.98 5.41 50 XM_H_Long_From01 18709 5.25 5.01 5.38 51 T_TooManySym_01 18514 4.25 2.28 5.33 52 MIME_QP_LONG_LINE 18403 4.58 3.28 5.29 53 HTML_IMAGE_RATIO_02 17650 5.44 6.09 5.08 54 TR_XM_DK_Bayes2 17379 3.30 0.22 5.00 55 BAYES_40 16748 3.58 1.34 4.82 56 XM_B_Phish_Phrases 15904 4.48 4.32 4.58 57 BAYES_99 15723 17.18 40.18 4.52 58 XM_PDF 15717 3.13 0.60 4.52 59 TR_XM_SpammyWords4 15643 9.00 17.17 4.50 60 XMStrtUSub 15096 4.02 3.44 4.34 61 BAYES_80 14671 5.57 8.01 4.22 62 RELAYCOUNTRY_META 14298 7.36 13.25 4.11 63 RCVD_IN_VALIDITY_CERTIFIED 14040 3.64 2.92 4.04 64 BOTNET_IPINHOSTNAME 13879 7.20 13.03 3.99 65 XMSubMetaSx_00 13756 4.49 5.47 3.96 66 XM_UncommonTLD01 13675 4.20 4.70 3.93 67 ANY_BOUNCE_MESSAGE 13180 2.65 0.59 3.79 68 BOUNCE_MESSAGE 13180 2.65 0.59 3.79 69 XM_B_SpammyTLD 13172 3.55 3.12 3.79 70 RCVD_IN_IADB_LISTED 13003 2.88 1.33 3.74 71 HTML_IMAGE_RATIO_04 12555 4.34 5.66 3.61 72 T_REMOTE_IMAGE 12548 3.06 2.06 3.61 73 MPART_ALT_DIFF 12263 4.13 5.22 3.53 74 BAYES_999 12127 14.01 33.12 3.49 75 RCVD_IN_IADB_SPF 11429 2.52 1.13 3.29 76 HTML_IMAGE_RATIO_06 11155 3.39 3.71 3.21 77 BAYES_20 10876 2.35 0.94 3.13 78 XM_SPF_SoftFail 10844 3.82 5.08 3.12 79 XM_Body_Dirty_Words 10180 4.15 6.37 2.93 80 RCVD_IN_IADB_SENDERID 10159 2.26 1.05 2.92 81 MAILING_LIST_MULTI 10097 2.54 1.88 2.90 82 URI_NOVOWEL 9972 2.22 1.04 2.87 83 RCVD_IN_IADB_DK 9913 2.21 1.05 2.85 84 T_TooManySym_02 9835 2.04 0.61 2.83 85 BAYES_95 9331 3.44 4.82 2.68 86 TM2_M_VERY_LONG_WORD 9156 3.07 3.86 2.63 87 TooManyTo_002 9005 1.94 0.76 2.59 88 RCVD_IN_IADB_VOUCHED 8920 1.88 0.63 2.57 89 XMNumbers 8891 2.84 3.34 2.56 90 TR_XM_DKIM_Undo 8543 14.71 36.97 2.46 91 DKIM_INVALID 8321 2.96 3.98 2.39 92 XM_CamelCaseFrm001 8310 2.55 2.83 2.39 93 HTML_MIME_NO_HTML_TAG 8168 2.05 1.50 2.35 94 SUBJ_ALL_CAPS 7942 2.36 2.51 2.28 95 MIME_HTML_MOSTLY 7908 2.63 3.29 2.27 96 TR_XM_SpammyRelay 7651 4.90 9.81 2.20 97 HTML_IMAGE_RATIO_08 7470 2.53 3.23 2.15 98 TR_XM_SpammyWords5 7363 2.83 4.13 2.12 99 INVALID_MSGID 7161 1.36 0.10 2.06 100 FROM_EXCESS_BASE64 7005 1.89 1.67 2.02 101 XM_DK_Undo_01 6873 1.85 1.61 1.98 102 XMDiploma_00 6743 2.15 2.53 1.94 103 BAYES_05 6593 1.37 0.41 1.90 104 KHOP_HELO_FCRDNS 6580 1.82 1.68 1.89 105 TO_MALFORMED 6558 1.22 0.02 1.89 106 MIME_HTML_ONLY_MULTI 6549 2.36 3.22 1.88 107 TR_DCC_Bayes_99 6274 11.88 30.18 1.80 108 TR_XM_UnparsRelay 6184 3.75 7.32 1.78 109 RCVD_IN_IADB_OPTIN 6093 1.26 0.37 1.75 110 HELO_NODOT 6029 1.23 0.32 1.73 111 HELO_NO_DOMAIN 6025 1.23 0.31 1.73 112 T_XMDrugObfuBody_08 5886 2.39 3.66 1.69 113 UNTRUSTED_Relay 5708 3.01 5.50 1.64 114 TR_XM_PhishingBody 5686 2.55 4.20 1.64 115 T_XMDrugObfuBody_14 5641 2.23 3.33 1.62 116 TM2_M_URI_OPT_OUT 5563 2.01 2.74 1.60 117 XM_B_Investor 5432 2.64 4.59 1.56 118 TR_Symld_Words 5184 1.26 0.84 1.49 119 TooManyTo_003 5157 1.19 0.67 1.48 120 TVD_RCVD_IP 4921 1.21 0.83 1.42 121 IN_HORDE_ADDRESS_BOOK 4910 0.94 0.08 1.41 122 XM_SendGrid 4864 1.32 1.19 1.40 123 HTML_EXTRA_CLOSE 4488 0.84 0.03 1.29 124 XM_B_Unsub2 4488 1.54 1.99 1.29 125 XMSexyCombo_05 4402 2.06 3.51 1.27 126 XM_B_SEO 4210 2.41 4.58 1.21 127 XM_GoogleGroups 4169 0.98 0.58 1.20 128 BOTNET 4130 3.48 7.65 1.19 129 XMBrknScrpt_02 3999 1.68 2.65 1.15 130 RELAYCOUNTRY_CA 3990 2.26 4.29 1.15 131 URI_HEX 3887 1.14 1.17 1.12 132 XMGenDplmaNmb 3842 1.18 1.32 1.11 133 XMGappySubj_01 3830 0.75 0.11 1.10 134 TooManyTo_004 3747 0.91 0.62 1.08 135 XMBSHREFv2 3737 0.80 0.30 1.08 136 TVD_SPACE_RATIO 3648 0.73 0.15 1.05 137 XMCapTrack 3609 0.81 0.40 1.04 138 XM_OfRef6 3603 2.32 4.65 1.04 139 T_TooManySym_03 3397 0.70 0.18 0.98 140 XM_H_Long_From02 3335 1.18 1.59 0.96 141 T_XMDrugObfuBody_00 3239 1.09 1.36 0.93 142 DKIM_ADSP_CUSTOM_MED 3164 1.02 1.23 0.91 143 TR_XM_DK_SendGrid 3116 0.81 0.65 0.90 144 T_FILL_THIS_FORM_SHORT 3106 1.15 1.63 0.89 145 SpammyFromTLD_01 3083 1.17 1.69 0.89 146 XM_UB50 3055 1.53 2.71 0.88 147 TooManyTo_005 3036 0.77 0.58 0.87 148 XM_RXBody 3033 0.72 0.44 0.87 149 XM_B_DNDMA 3000 0.91 0.99 0.86 150 XM_TLDProd2 2984 0.68 0.35 0.86 151 TR_MetaPhish_Combo_01 2955 0.87 0.90 0.85 152 RELAYCOUNTRY_AU 2891 1.32 2.20 0.83 153 XMBdyGiftCard01 2803 0.91 1.08 0.81 154 TR_LOTS_OF_MONEY3 2789 2.97 6.90 0.80 155 TR_XM_SpammyWords2 2762 6.54 16.98 0.79 156 XMStockSpam_06 2759 1.21 1.97 0.79 157 XMBody_95 2741 0.59 0.24 0.79 158 URI_TRY_3LD 2714 1.48 2.76 0.78 159 TR_XM_Base64_M1 2713 0.80 0.83 0.78 160 XMBody_17 2678 2.87 6.69 0.77 161 XMNoVowels 2657 0.65 0.44 0.76 162 T_XMHurry_00 2620 1.50 2.84 0.75 163 HTTPS_HTTP_MISMATCH 2561 0.85 1.05 0.74 164 XM_H_PHPMailer 2471 0.63 0.48 0.71 165 FROM_GOV_DKIM_AU 2463 0.57 0.32 0.71 166 XM_ShortIntro_01 2441 0.61 0.43 0.70 167 XMSubMetaI_00 2414 0.80 0.99 0.69 168 TR_XM_SEO4 2396 1.90 4.10 0.69 169 HTML_TAG_BALANCE_BODY 2389 1.08 1.81 0.69 170 RCVD_IN_BL_SPAMCOP_NET 2193 3.49 8.70 0.63 171 XM_B_SpammyWords4 2188 1.31 2.54 0.63 172 T_OBFU_PDF_ATTACH 2158 0.44 0.10 0.62 173 XMGappySubj_02 2116 0.41 0.04 0.61 174 XM_ProductURIs 2082 0.75 1.03 0.60 175 USER_IN_WHITELIST 2059 0.38 0.00 0.59 176 USER_IN_WELCOMELIST 2059 0.38 0.00 0.59 177 XMPhish30 2013 0.78 1.13 0.58 178 FORGED_GMAIL_RCVD 2000 0.70 0.93 0.58 179 T_Symld_Words_02 1873 0.57 0.63 0.54 180 NML_ADSP_CUSTOM_MED 1868 0.73 1.08 0.54 181 PLING_QUERY 1847 0.67 0.93 0.53 182 TO_NO_BRKTS_HTML_ONLY 1834 0.41 0.20 0.53 183 XM_B_COPY_HTML 1806 0.78 1.25 0.52 184 SHORT_HELO_AND_INLINE_IMAGE 1804 0.35 0.05 0.52 185 XM_B_FormFill 1794 0.35 0.05 0.52 186 XMOemUri 1789 0.40 0.19 0.51 187 HTML_IMAGE_ONLY_32 1759 0.38 0.17 0.51 188 MPART_ALT_DIFF_COUNT 1755 0.65 0.91 0.50 189 XMMoneyMeta_00 1746 0.62 0.84 0.50 190 XMSlimDrugH 1664 0.52 0.58 0.48 191 RDNS_DYNAMIC 1552 0.62 0.94 0.45 192 XMSolicitRefs_0 1541 0.44 0.42 0.44 193 RELAYCOUNTRY_GB 1530 0.56 0.79 0.44 194 HTML_FONT_FACE_BAD 1474 0.54 0.74 0.42 195 HTML_IMAGE_ONLY_20 1473 0.45 0.50 0.42 196 MSGID_FROM_MTA_HEADER 1447 0.30 0.08 0.42 197 XMPhish14 1437 0.68 1.17 0.41 198 THIS_AD 1423 0.58 0.88 0.41 199 HTML_IMAGE_ONLY_28 1395 0.38 0.33 0.40 200 XMClaimOffer 1394 0.51 0.70 0.40 ----------------------------------------------------------------------