Email: 535611 Autolearn: 0 AvgScore: 4.31 AvgScanTime: 1.19 sec Spam: 159758 Autolearn: 0 AvgScore: 13.25 AvgScanTime: 1.32 sec Ham: 375853 Autolearn: 0 AvgScore: 0.51 AvgScanTime: 1.14 sec Time Spent Running SA: 177.32 hours Time Spent Processing Spam: 58.70 hours Time Spent Processing Ham: 118.62 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154411 89.52 96.65 86.48 2 DKIM_SIGNED 147604 76.06 92.39 69.11 3 XM_DK_Pass 141197 73.90 88.38 67.74 4 DKIM_VALID 139531 72.73 87.34 66.52 5 XM_B_Unicode 138694 74.29 86.82 68.96 6 RELAYCOUNTRY_US 137581 82.44 86.12 80.87 7 DCC_CHECK 121601 47.32 76.12 35.08 8 XMListUnsubscribeExists 118991 53.60 74.48 44.73 9 XM_B_SpammyWords 118133 52.20 73.94 42.95 10 DKIM_VALID_AU 114399 59.08 71.61 53.75 11 LOC_TINY_FONT_1 73672 30.54 46.11 23.92 12 XM_B_Unicode3 73197 43.71 45.82 42.81 13 XM_DK_Undo_02 72222 16.87 45.21 4.82 14 XM_B_SpammyWords2 67498 24.54 42.25 17.01 15 RCVD_IN_MSPIKE_H2 64143 32.74 40.15 29.59 16 HTML_FONT_LOW_CONTRAST 62787 34.89 39.30 33.02 17 BAYES_99 59928 13.65 37.51 3.51 18 BAYES_50 59405 55.23 37.18 62.90 19 FVGT_m_MULTI_ODD 55694 26.86 34.86 23.46 20 TR_XM_DKIM_Undo 54543 11.59 34.14 2.01 21 BAYES_999 48717 10.98 30.49 2.69 22 T_KAM_HTML_FONT_INVALID 48418 21.81 30.31 18.20 23 TR_DCC_Bayes_99 45216 9.35 28.30 1.29 24 DKIM_VALID_EF 42962 27.14 26.89 27.25 25 MIME_HTML_ONLY 41269 20.94 25.83 18.86 26 DCC_CHECK_NEGATIVE 38134 52.64 23.87 64.87 27 T_TM2_M_HEADER_IN_MSG 37787 31.28 23.65 34.52 28 XMSubLong 36230 22.58 22.68 22.54 29 XM_Multi_Part_URI 32171 16.29 20.14 14.65 30 TR_XM_DK_Unsub 30198 13.98 18.90 11.89 31 LOTS_OF_MONEY 26815 9.36 16.78 6.20 32 XM_B_SpammyWords3 24988 7.70 15.64 4.32 33 XM_B_Unsub 24629 9.80 15.42 7.41 34 UNPARSEABLE_RELAY 24605 11.67 15.40 10.09 35 TR_XM_SpammyWords2 23981 4.92 15.01 0.63 36 TR_XM_BayesUnsub 23928 8.63 14.98 5.93 37 RELAYCOUNTRY_META 23693 7.03 14.83 3.72 38 TR_XM_SpammyWords4 23575 7.49 14.76 4.41 39 TR_MAX_INTL_RELAY 22287 8.37 13.95 5.99 40 BOTNET_IPINHOSTNAME 20617 5.87 12.91 2.88 41 TR_XM_SpammyRelay 17501 4.60 10.95 1.90 42 XM_Evil_Numbers_Gen 15038 10.13 9.41 10.44 43 BOTNET 14188 3.55 8.88 1.29 44 TR_XM_UnparsRelay 14021 3.79 8.78 1.67 45 BAYES_80 13828 5.19 8.66 3.71 46 BAYES_60 12321 8.45 7.71 8.76 47 FSL_BULK_SIG 12050 5.97 7.54 5.30 48 RCVD_IN_BL_SPAMCOP_NET 10919 2.42 6.83 0.54 49 LotsOfNums_01 10839 9.13 6.78 10.13 50 HTML_IMAGE_RATIO_04 10613 4.30 6.64 3.30 51 HTML_IMAGE_RATIO_02 10591 5.13 6.63 4.50 52 XM_Body_Dirty_Words 9648 3.34 6.04 2.19 53 XMSubMetaSx_00 9435 4.44 5.91 3.82 54 XM_H_Long_From01 9370 5.20 5.87 4.92 55 MPART_ALT_DIFF 9161 4.11 5.73 3.42 56 RELAYCOUNTRY_CA 9126 2.45 5.71 1.06 57 XM_UncommonTLD01 9040 5.08 5.66 4.83 58 XM_B_PhoneNumber 8953 8.44 5.60 9.64 59 TR_XM_SPAMCOP 8951 1.85 5.60 0.25 60 UNTRUSTED_Relay 8933 2.65 5.59 1.40 61 XM_B_Phish_Phrases 8648 5.32 5.41 5.28 62 XM_B_Investor 8388 2.52 5.25 1.35 63 XM_SPF_SoftFail 8101 3.65 5.07 3.04 64 DKIM_INVALID 8073 3.33 5.05 2.60 65 BAYES_95 7840 3.06 4.91 2.28 66 TooManyTo_001 7741 7.56 4.85 8.71 67 TR_XM_SpammyWords5 7694 2.44 4.82 1.43 68 XM_B_SEO 7677 2.33 4.81 1.28 69 HTML_IMAGE_RATIO_06 7591 3.69 4.75 3.24 70 RCVD_IN_VALIDITY_RPBL 7227 1.51 4.52 0.23 71 XMSexyCombo_05 7056 2.77 4.42 2.07 72 TR_XM_SEO4 6859 1.90 4.29 0.88 73 XM_H_GMP 6848 4.92 4.29 5.18 74 XM_OfRef6 6625 2.01 4.15 1.09 75 XM_B_SpammyTLD 6356 4.10 3.98 4.16 76 XMBody_17 6176 1.48 3.87 0.46 77 RCVD_IN_VALIDITY_SAFE 6159 4.08 3.86 4.18 78 XMNumbers 6123 3.12 3.83 2.82 79 TR_XM_PhishingBody 6002 2.11 3.76 1.41 80 T_XMDrugObfuBody_14 5984 2.19 3.75 1.53 81 TR_LOTS_OF_MONEY3 5685 1.40 3.56 0.49 82 XM_CamelCaseFrm001 5660 2.51 3.54 2.07 83 MIME_HTML_MOSTLY 5473 2.50 3.43 2.11 84 MIME_HTML_ONLY_MULTI 5358 2.45 3.35 2.06 85 XM_URI_RBL 5317 1.27 3.33 0.39 86 RCVD_IN_MSPIKE_H3 5282 4.50 3.31 5.00 87 RCVD_IN_MSPIKE_WL 5282 4.50 3.31 5.00 88 T_TooManySym_01 5166 4.74 3.23 5.38 89 USER_IN_DEF_DKIM_WL 5096 9.65 3.19 12.40 90 SUBJ_ALL_CAPS 4985 1.80 3.12 1.24 91 HTML_IMAGE_RATIO_08 4943 2.25 3.09 1.89 92 TM2_M_VERY_LONG_WORD 4904 5.95 3.07 7.17 93 XM_UB50 4874 1.51 3.05 0.86 94 XMStrtUSub 4816 4.12 3.01 4.60 95 XMBrknScrpt_02 4742 1.43 2.97 0.78 96 MIME_QP_LONG_LINE 4669 4.17 2.92 4.71 97 RCVD_IN_VALIDITY_CERTIFIED 4641 3.18 2.91 3.30 98 TM2_M_URI_OPT_OUT 4323 1.72 2.71 1.30 99 T_XMDrugObfuBody_08 4241 1.75 2.65 1.37 100 XMDiploma_00 4067 1.92 2.55 1.65 101 XM_B_SpammyWords4 3954 1.16 2.47 0.60 102 RELAYCOUNTRY_AU 3646 1.14 2.28 0.66 103 XM_B_Unsub2 3554 1.71 2.22 1.49 104 MAILING_LIST_MULTI 3483 2.44 2.18 2.56 105 XM_DK_Undo_01 3308 1.88 2.07 1.80 106 SpammyFromTLD_01 3114 1.16 1.95 0.82 107 FROM_EXCESS_BASE64 3088 1.71 1.93 1.62 108 TR_Caps_n_Bayes_99 3007 0.59 1.88 0.04 109 T_XMDrugObfuBody_00 2918 1.11 1.83 0.80 110 HTML_TAG_BALANCE_BODY 2827 1.07 1.77 0.77 111 SpammyFromTLD_02 2735 1.52 1.71 1.44 112 T_REMOTE_IMAGE 2671 2.87 1.67 3.37 113 T_XMHurry_00 2630 0.88 1.65 0.55 114 XMStockSpam_06 2604 1.54 1.63 1.51 115 TR_XM_NoHeaderRelay 2551 0.55 1.60 0.11 116 URI_NOVOWEL 2496 2.64 1.56 3.09 117 HTTPS_HTTP_MISMATCH 2442 1.10 1.53 0.92 118 BAYES_40 2379 4.17 1.49 5.30 119 HTML_MIME_NO_HTML_TAG 2371 2.02 1.48 2.25 120 DIET_1 2305 0.60 1.44 0.24 121 TR_XM_INV_DKIM 2295 0.48 1.44 0.07 122 URI_TRY_3LD 2292 1.00 1.43 0.81 123 TR_XM_PHPDW 2260 0.75 1.41 0.47 124 T_MONEY_PERCENT 2251 0.62 1.41 0.29 125 TR_XM_PHPForged 2251 0.75 1.41 0.47 126 TR_LOTS_OF_MONEY2 2251 0.62 1.41 0.29 127 RCVD_IN_IADB_LISTED 2228 2.71 1.39 3.27 128 TR_XM_FormFill2 2204 0.74 1.38 0.47 129 ALL_TRUSTED 2196 11.82 1.37 16.26 130 XM_H_PHPOS 2193 0.73 1.37 0.46 131 XM_B_DNDMA 2152 0.84 1.35 0.62 132 XM_HighProb1 2096 0.40 1.31 0.01 133 T_Symld_Words_02 2093 0.76 1.31 0.53 134 KHOP_HELO_FCRDNS 2077 3.26 1.30 4.09 135 XMHTML_After_End 2046 0.59 1.28 0.29 136 TR_MetaPhish_Combo_01 2015 0.97 1.26 0.84 137 TR_Symld_Words 2008 1.70 1.26 1.89 138 T_FILL_THIS_FORM_SHORT 1994 1.04 1.25 0.96 139 URI_HEX 1976 1.04 1.24 0.96 140 URIBL_DBL_SPAM 1965 0.37 1.23 0.00 141 XM_SendGrid 1954 1.21 1.22 1.20 142 RCVD_IN_IADB_SPF 1947 2.39 1.22 2.89 143 THIS_AD 1940 0.68 1.21 0.45 144 BAYES_20 1923 2.70 1.20 3.33 145 XMPhish30 1919 0.66 1.20 0.43 146 AC_BR_BONANZA 1915 0.41 1.20 0.08 147 XM_B_COPY_HTML 1819 0.73 1.14 0.56 148 T_TooManySym_02 1819 2.26 1.14 2.73 149 RCVD_IN_IADB_DK 1817 2.12 1.14 2.54 150 XMGenDplmaNmb 1812 0.90 1.13 0.80 151 RCVD_IN_IADB_SENDERID 1785 2.16 1.12 2.61 152 TR_XM_InvalidRelay 1749 0.34 1.09 0.02 153 XMSlimDrugH 1749 0.62 1.09 0.42 154 XM_ProductURIs 1735 0.59 1.09 0.38 155 XMSubMetaI_00 1694 0.77 1.06 0.64 156 XMReplyNow 1603 0.47 1.00 0.24 157 RDNS_DYNAMIC 1508 0.45 0.94 0.24 158 MPART_ALT_DIFF_COUNT 1493 0.63 0.93 0.50 159 TM2_M_OBFU_COMMENT 1488 0.49 0.93 0.30 160 BOTNET_NORDNS 1474 0.28 0.92 0.01 161 PDS_RDNS_DYNAMIC_FP 1468 0.35 0.92 0.11 162 XM_H_Undi_Recip 1467 0.44 0.92 0.23 163 XMPhish14 1467 0.55 0.92 0.40 164 DKIM_ADSP_CUSTOM_MED 1461 0.91 0.91 0.91 165 TR_XM_Base64_M1 1456 0.72 0.91 0.63 166 XM_UB99 1435 0.27 0.90 0.00 167 XM_H_Long_From02 1426 0.95 0.89 0.97 168 LongTLD 1414 0.51 0.89 0.35 169 XMBdyGiftCard01 1395 1.01 0.87 1.06 170 TR_Mismatch_TLD_02 1367 0.31 0.86 0.07 171 XM_B_Phish66 1362 0.42 0.85 0.23 172 XMClaimOffer 1313 0.44 0.82 0.28 173 TVD_RCVD_IP 1277 0.54 0.80 0.42 174 T_STY_INVIS_DIRECT 1263 0.44 0.79 0.29 175 SHOPIFY_IMG_NOT_RCVD_SFY 1257 0.47 0.79 0.33 176 SUBJ_DOLLARS 1246 0.48 0.78 0.36 177 XM_BadFromFormat 1242 0.31 0.78 0.11 178 RELAYCOUNTRY_FR 1235 0.37 0.77 0.19 179 TR_XM_RelayPhish 1227 0.28 0.77 0.07 180 XM_B_REG_HTML 1226 0.52 0.77 0.42 181 BAYES_05 1224 1.52 0.77 1.84 182 RCVD_IN_IADB_VOUCHED 1214 1.72 0.76 2.12 183 TooManyTo_002 1209 2.57 0.76 3.34 184 MIME_CHARSET_FARAWAY 1205 2.97 0.75 3.92 185 RELAYCOUNTRY_IN 1198 0.27 0.75 0.06 186 XMWghtMeta_00 1194 0.23 0.75 0.01 187 ANY_BOUNCE_MESSAGE 1183 6.65 0.74 9.17 188 BOUNCE_MESSAGE 1180 6.65 0.74 9.17 189 TR_XM_Undi_Recip19 1165 0.26 0.73 0.07 190 TR_Mismatch_TLD_01 1152 0.35 0.72 0.19 191 FORGED_GMAIL_RCVD 1134 0.58 0.71 0.53 192 HELO_DYNAMIC_SPLIT_IP 1133 0.22 0.71 0.01 193 HTML_FONT_FACE_BAD 1128 0.44 0.71 0.33 194 NML_ADSP_CUSTOM_MED 1128 0.66 0.71 0.64 195 XMPhish08 1124 0.41 0.70 0.29 196 TM2_M_A_HREF_HREF 1118 0.39 0.70 0.26 197 XMSlimDrugs 1112 0.22 0.70 0.02 198 XMMoneyMeta_00 1098 0.59 0.69 0.55 199 TR_XM_DK_SendGrid 1095 0.77 0.69 0.80 200 XM_UB999 1093 0.21 0.68 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 325055 89.52 96.65 86.48 2 RELAYCOUNTRY_US 303971 82.44 86.12 80.87 3 DKIM_SIGNED 259760 76.06 92.39 69.11 4 XM_B_Unicode 259190 74.29 86.82 68.96 5 XM_DK_Pass 254610 73.90 88.38 67.74 6 DKIM_VALID 250004 72.73 87.34 66.52 7 DCC_CHECK_NEGATIVE 243828 52.64 23.87 64.87 8 BAYES_50 236423 55.23 37.18 62.90 9 DKIM_VALID_AU 202036 59.08 71.61 53.75 10 XMListUnsubscribeExists 168111 53.60 74.48 44.73 11 XM_B_SpammyWords 161435 52.20 73.94 42.95 12 XM_B_Unicode3 160912 43.71 45.82 42.81 13 DCC_CHECK 131832 47.32 76.12 35.08 14 T_TM2_M_HEADER_IN_MSG 129738 31.28 23.65 34.52 15 HTML_FONT_LOW_CONTRAST 124097 34.89 39.30 33.02 16 RCVD_IN_MSPIKE_H2 111224 32.74 40.15 29.59 17 DKIM_VALID_EF 102417 27.14 26.89 27.25 18 LOC_TINY_FONT_1 89892 30.54 46.11 23.92 19 FVGT_m_MULTI_ODD 88159 26.86 34.86 23.46 20 XMSubLong 84699 22.58 22.68 22.54 21 MIME_HTML_ONLY 70873 20.94 25.83 18.86 22 T_KAM_HTML_FONT_INVALID 68413 21.81 30.31 18.20 23 XM_B_SpammyWords2 63927 24.54 42.25 17.01 24 ALL_TRUSTED 61116 11.82 1.37 16.26 25 XM_Multi_Part_URI 55075 16.29 20.14 14.65 26 USER_IN_DEF_DKIM_WL 46608 9.65 3.19 12.40 27 TR_XM_DK_Unsub 44674 13.98 18.90 11.89 28 XM_Evil_Numbers_Gen 39241 10.13 9.41 10.44 29 LotsOfNums_01 38084 9.13 6.78 10.13 30 UNPARSEABLE_RELAY 37906 11.67 15.40 10.09 31 XM_B_PhoneNumber 36237 8.44 5.60 9.64 32 ANY_BOUNCE_MESSAGE 34453 6.65 0.74 9.17 33 BOUNCE_MESSAGE 34452 6.65 0.74 9.17 34 BAYES_60 32939 8.45 7.71 8.76 35 TooManyTo_001 32725 7.56 4.85 8.71 36 BAYES_00 31416 6.04 0.57 8.36 37 XM_B_Unsub 27849 9.80 15.42 7.41 38 TM2_M_VERY_LONG_WORD 26958 5.95 3.07 7.17 39 HTML_IMAGE_ONLY_32 25526 4.82 0.17 6.79 40 XM_DKIMWhitelistDomains 24817 4.70 0.21 6.60 41 IN_ZIMBRA_NJ_WHITELIST 23751 4.46 0.09 6.32 42 LOTS_OF_MONEY 23302 9.36 16.78 6.20 43 TR_MAX_INTL_RELAY 22526 8.37 13.95 5.99 44 TR_XM_DK_Bayes 22374 4.30 0.41 5.95 45 TR_XM_BayesUnsub 22285 8.63 14.98 5.93 46 TR_XM_DK_Bayes1 21402 4.11 0.40 5.69 47 T_TooManySym_01 20224 4.74 3.23 5.38 48 BAYES_40 19933 4.17 1.49 5.30 49 FSL_BULK_SIG 19917 5.97 7.54 5.30 50 XM_B_Phish_Phrases 19829 5.32 5.41 5.28 51 XM_H_GMP 19480 4.92 4.29 5.18 52 RCVD_IN_MSPIKE_H3 18810 4.50 3.31 5.00 53 RCVD_IN_MSPIKE_WL 18810 4.50 3.31 5.00 54 XM_H_Long_From01 18487 5.20 5.87 4.92 55 XM_UncommonTLD01 18153 5.08 5.66 4.83 56 XM_DK_Undo_02 18134 16.87 45.21 4.82 57 TR_XM_DK_Bayes2 18017 3.45 0.29 4.79 58 MIME_QP_LONG_LINE 17688 4.17 2.92 4.71 59 XMStrtUSub 17276 4.12 3.01 4.60 60 HTML_IMAGE_RATIO_02 16895 5.13 6.63 4.50 61 TR_XM_SpammyWords4 16567 7.49 14.76 4.41 62 XM_B_SpammyWords3 16247 7.70 15.64 4.32 63 XM_PDF 15991 3.17 0.62 4.25 64 RCVD_IN_VALIDITY_SAFE 15718 4.08 3.86 4.18 65 XM_B_SpammyTLD 15626 4.10 3.98 4.16 66 KHOP_HELO_FCRDNS 15383 3.26 1.30 4.09 67 MIME_CHARSET_FARAWAY 14725 2.97 0.75 3.92 68 XMSubMetaSx_00 14352 4.44 5.91 3.82 69 RELAYCOUNTRY_META 13980 7.03 14.83 3.72 70 CHARSET_FARAWAY_HEADER 13979 2.63 0.06 3.72 71 BAYES_80 13962 5.19 8.66 3.71 72 BAYES_99 13199 13.65 37.51 3.51 73 MPART_ALT_DIFF 12867 4.11 5.73 3.42 74 T_REMOTE_IMAGE 12676 2.87 1.67 3.37 75 TooManyTo_002 12570 2.57 0.76 3.34 76 BAYES_20 12516 2.70 1.20 3.33 77 HTML_IMAGE_RATIO_04 12416 4.30 6.64 3.30 78 RCVD_IN_VALIDITY_CERTIFIED 12387 3.18 2.91 3.30 79 RCVD_IN_IADB_LISTED 12284 2.71 1.39 3.27 80 HTML_IMAGE_RATIO_06 12183 3.69 4.75 3.24 81 URI_NOVOWEL 11629 2.64 1.56 3.09 82 XM_SPF_SoftFail 11426 3.65 5.07 3.04 83 RCVD_IN_IADB_SPF 10874 2.39 1.22 2.89 84 BOTNET_IPINHOSTNAME 10821 5.87 12.91 2.88 85 XMNumbers 10585 3.12 3.83 2.82 86 T_TooManySym_02 10274 2.26 1.14 2.73 87 BAYES_999 10101 10.98 30.49 2.69 88 RCVD_IN_IADB_SENDERID 9805 2.16 1.12 2.61 89 DKIM_INVALID 9756 3.33 5.05 2.60 90 MAILING_LIST_MULTI 9605 2.44 2.18 2.56 91 RCVD_IN_IADB_DK 9539 2.12 1.14 2.54 92 XMLngstWrd_00 8661 1.75 0.45 2.30 93 BAYES_95 8555 3.06 4.91 2.28 94 HTML_MIME_NO_HTML_TAG 8456 2.02 1.48 2.25 95 XM_Body_Dirty_Words 8235 3.34 6.04 2.19 96 RCVD_IN_IADB_VOUCHED 7981 1.72 0.76 2.12 97 MIME_HTML_MOSTLY 7917 2.50 3.43 2.11 98 XMSexyCombo_05 7776 2.77 4.42 2.07 99 XM_CamelCaseFrm001 7762 2.51 3.54 2.07 100 MIME_HTML_ONLY_MULTI 7742 2.45 3.35 2.06 101 TR_XM_DKIM_Undo 7538 11.59 34.14 2.01 102 INVALID_MSGID 7352 1.40 0.10 1.96 103 TR_XM_SpammyRelay 7137 4.60 10.95 1.90 104 HTML_IMAGE_RATIO_08 7121 2.25 3.09 1.89 105 TR_Symld_Words 7089 1.70 1.26 1.89 106 HELO_NODOT 6998 1.41 0.34 1.86 107 HELO_NO_DOMAIN 6994 1.40 0.33 1.86 108 BAYES_05 6908 1.52 0.77 1.84 109 XM_DK_Undo_01 6763 1.88 2.07 1.80 110 TO_MALFORMED 6673 1.25 0.00 1.78 111 TR_XM_UnparsRelay 6269 3.79 8.78 1.67 112 XMDiploma_00 6190 1.92 2.55 1.65 113 TooManyTo_003 6165 1.35 0.66 1.64 114 FROM_EXCESS_BASE64 6086 1.71 1.93 1.62 115 T_XMDrugObfuBody_14 5747 2.19 3.75 1.53 116 XMStockSpam_06 5669 1.54 1.63 1.51 117 XM_B_Unsub2 5600 1.71 2.22 1.49 118 RCVD_IN_IADB_OPTIN 5518 1.18 0.50 1.47 119 SpammyFromTLD_02 5416 1.52 1.71 1.44 120 TR_XM_SpammyWords5 5359 2.44 4.82 1.43 121 TR_XM_PhishingBody 5306 2.11 3.76 1.41 122 UNTRUSTED_Relay 5248 2.65 5.59 1.40 123 T_XMDrugObfuBody_08 5140 1.75 2.65 1.37 124 XM_B_Investor 5085 2.52 5.25 1.35 125 TM2_M_URI_OPT_OUT 4871 1.72 2.71 1.30 126 TR_DCC_Bayes_99 4842 9.35 28.30 1.29 127 BOTNET 4831 3.55 8.88 1.29 128 XM_B_SEO 4804 2.33 4.81 1.28 129 IN_HORDE_ADDRESS_BOOK 4759 0.92 0.10 1.27 130 SUBJ_ALL_CAPS 4652 1.80 3.12 1.24 131 TooManyTo_004 4562 1.03 0.60 1.21 132 XM_SendGrid 4524 1.21 1.22 1.20 133 XM_B_FormFill 4510 0.90 0.19 1.20 134 XMCapTrack 4126 0.95 0.61 1.10 135 XM_OfRef6 4115 2.01 4.15 1.09 136 XM_GoogleGroups 4114 0.96 0.66 1.09 137 TVD_SPACE_RATIO 4074 0.80 0.13 1.08 138 XM_TLDProd2 3998 0.83 0.28 1.06 139 XMBdyGiftCard01 3989 1.01 0.87 1.06 140 RELAYCOUNTRY_CA 3977 2.45 5.71 1.06 141 XMGappySubj_01 3948 0.82 0.27 1.05 142 XM_RXBody 3749 0.85 0.50 1.00 143 TooManyTo_005 3724 0.87 0.57 0.99 144 XM_H_Long_From02 3642 0.95 0.89 0.97 145 T_FILL_THIS_FORM_SHORT 3593 1.04 1.25 0.96 146 URI_HEX 3593 1.04 1.24 0.96 147 T_TooManySym_03 3590 0.78 0.38 0.96 148 HTTPS_HTTP_MISMATCH 3476 1.10 1.53 0.92 149 DKIM_ADSP_CUSTOM_MED 3439 0.91 0.91 0.91 150 XMSubMetaSxObfu_03 3383 0.79 0.52 0.90 151 TR_XM_SEO4 3303 1.90 4.29 0.88 152 XM_UB50 3232 1.51 3.05 0.86 153 TR_MetaPhish_Combo_01 3163 0.97 1.26 0.84 154 SpammyFromTLD_01 3092 1.16 1.95 0.82 155 URI_TRY_3LD 3052 1.00 1.43 0.81 156 TR_XM_DK_SendGrid 3019 0.77 0.69 0.80 157 XMGenDplmaNmb 3006 0.90 1.13 0.80 158 T_XMDrugObfuBody_00 3004 1.11 1.83 0.80 159 XM_ShortIntro_01 2937 0.67 0.42 0.78 160 XMBrknScrpt_02 2935 1.43 2.97 0.78 161 HTML_TAG_BALANCE_BODY 2889 1.07 1.77 0.77 162 XMNoVowels 2598 0.60 0.38 0.69 163 FROM_GOV_DKIM_AU 2518 0.50 0.10 0.67 164 XMGappySubj_02 2476 0.50 0.14 0.66 165 RELAYCOUNTRY_AU 2472 1.14 2.28 0.66 166 XMBody_95 2444 0.50 0.15 0.65 167 XMSubMetaI_00 2420 0.77 1.06 0.64 168 NML_ADSP_CUSTOM_MED 2392 0.66 0.71 0.64 169 TR_XM_Base64_M1 2384 0.72 0.91 0.63 170 TR_XM_SpammyWords2 2376 4.92 15.01 0.63 171 XM_B_DNDMA 2323 0.84 1.35 0.62 172 XM_B_SpammyWords4 2269 1.16 2.47 0.60 173 XM_H_PHPMailer 2166 0.60 0.66 0.58 174 XM_B_COPY_HTML 2104 0.73 1.14 0.56 175 XMMoneyMeta_00 2066 0.59 0.69 0.55 176 T_XMHurry_00 2058 0.88 1.65 0.55 177 XMLngstWrd_01 2055 0.50 0.40 0.55 178 T_TVD_MIME_NO_HEADERS 2052 0.40 0.06 0.55 179 RCVD_IN_BL_SPAMCOP_NET 2042 2.42 6.83 0.54 180 SHORT_HELO_AND_INLINE_IMAGE 2041 0.40 0.06 0.54 181 T_OBFU_PDF_ATTACH 1994 0.40 0.10 0.53 182 FORGED_GMAIL_RCVD 1989 0.58 0.71 0.53 183 T_Symld_Words_02 1983 0.76 1.31 0.53 184 MPART_ALT_DIFF_COUNT 1870 0.63 0.93 0.50 185 TR_LOTS_OF_MONEY3 1827 1.40 3.56 0.49 186 TR_XM_FormFill2 1773 0.74 1.38 0.47 187 TR_XM_PHPForged 1772 0.75 1.41 0.47 188 TR_XM_PHPDW 1760 0.75 1.41 0.47 189 HTML_IMAGE_ONLY_20 1750 0.47 0.49 0.47 190 FILL_THIS_FORM 1750 0.43 0.35 0.47 191 XMBody_17 1732 1.48 3.87 0.46 192 XM_H_PHPOS 1730 0.73 1.37 0.46 193 TO_NO_BRKTS_HTML_ONLY 1721 0.39 0.21 0.46 194 THIS_AD 1689 0.68 1.21 0.45 195 HTML_IMAGE_ONLY_28 1676 0.44 0.42 0.45 196 MISSING_HEADERS 1672 0.47 0.52 0.44 197 XMPhish30 1632 0.66 1.20 0.43 198 RELAYCOUNTRY_GB 1617 0.50 0.68 0.43 199 TVD_RCVD_IP 1592 0.54 0.80 0.42 200 USER_IN_WELCOMELIST 1574 0.29 0.00 0.42 ----------------------------------------------------------------------