Email: 517371 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.40 sec Spam: 165682 Autolearn: 0 AvgScore: 14.82 AvgScanTime: 1.48 sec Ham: 351689 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 1.36 sec Time Spent Running SA: 201.15 hours Time Spent Processing Spam: 68.05 hours Time Spent Processing Ham: 133.10 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 158017 90.27 95.37 87.87 2 DKIM_SIGNED 148237 80.38 89.47 76.10 3 XM_DK_Pass 141565 78.17 85.44 74.74 4 RELAYCOUNTRY_US 140372 83.49 84.72 82.92 5 DKIM_VALID 138972 76.90 83.88 73.61 6 XM_B_Unicode 138657 74.67 83.69 70.43 7 DCC_CHECK 126371 51.25 76.27 39.46 8 XM_B_SpammyWords 119795 54.12 72.30 45.56 9 XMListUnsubscribeExists 118629 56.27 71.60 49.04 10 DKIM_VALID_AU 111436 61.75 67.26 59.16 11 XM_B_Unicode3 76299 43.49 46.05 42.28 12 LOC_TINY_FONT_1 73732 31.60 44.50 25.53 13 XM_DK_Undo_02 67194 16.87 40.56 5.71 14 BAYES_50 65475 53.88 39.52 60.65 15 XM_B_SpammyWords2 65190 25.38 39.35 18.81 16 HTML_FONT_LOW_CONTRAST 64812 33.88 39.12 31.41 17 RCVD_IN_MSPIKE_H2 62930 34.76 37.98 33.25 18 BAYES_99 55352 13.31 33.41 3.84 19 FVGT_m_MULTI_ODD 52853 26.74 31.90 24.31 20 T_KAM_HTML_FONT_INVALID 49669 23.36 29.98 20.25 21 TR_XM_DKIM_Undo 49231 11.20 29.71 2.48 22 MIME_HTML_ONLY 47335 22.18 28.57 19.17 23 DKIM_VALID_EF 44530 29.08 26.88 30.11 24 BAYES_999 44340 10.56 26.76 2.93 25 TR_DCC_Bayes_99 41016 8.85 24.76 1.36 26 XMSubLong 38601 22.98 23.30 22.82 27 T_TM2_M_HEADER_IN_MSG 37758 29.04 22.79 31.98 28 DCC_CHECK_NEGATIVE 36609 48.20 22.10 60.50 29 XM_Multi_Part_URI 33695 16.04 20.34 14.02 30 TR_XM_DK_Unsub 30881 14.69 18.64 12.83 31 XM_B_Unsub 26411 10.94 15.94 8.59 32 LOTS_OF_MONEY 26162 10.04 15.79 7.33 33 UNPARSEABLE_RELAY 26116 12.82 15.76 11.43 34 TR_XM_BayesUnsub 25492 9.52 15.39 6.76 35 TR_XM_SpammyWords4 23501 8.23 14.18 5.42 36 RELAYCOUNTRY_META 23220 7.34 14.01 4.19 37 TR_MAX_INTL_RELAY 22968 8.34 13.86 5.74 38 XM_B_SpammyWords3 22727 7.91 13.72 5.18 39 BOTNET_IPINHOSTNAME 21456 6.56 12.95 3.54 40 TR_XM_SpammyWords2 19603 4.08 11.83 0.43 41 TR_XM_SpammyRelay 17270 4.70 10.42 2.01 42 BOTNET 16215 4.31 9.79 1.72 43 XM_Evil_Numbers_Gen 16038 9.97 9.68 10.10 44 BAYES_80 14272 5.16 8.61 3.53 45 TR_XM_UnparsRelay 13804 3.79 8.33 1.65 46 FSL_BULK_SIG 13209 6.78 7.97 6.21 47 BAYES_60 13075 8.49 7.89 8.77 48 LotsOfNums_01 12807 7.78 7.73 7.81 49 XM_Body_Dirty_Words 12382 4.30 7.47 2.81 50 XM_B_Phish_Phrases 12372 5.50 7.47 4.57 51 XM_B_PhoneNumber 12062 8.67 7.28 9.33 52 HTML_IMAGE_RATIO_02 11233 5.55 6.78 4.97 53 XM_UncommonTLD01 10551 4.67 6.37 3.87 54 UNTRUSTED_Relay 9921 3.04 5.99 1.65 55 XMSubMetaSx_00 9462 3.75 5.71 2.83 56 HTML_IMAGE_RATIO_04 9401 4.78 5.67 4.35 57 DKIM_INVALID 9265 3.49 5.59 2.49 58 XM_H_Long_From01 9206 5.37 5.56 5.28 59 XM_SPF_SoftFail 9204 3.13 5.56 1.99 60 RCVD_IN_BL_SPAMCOP_NET 9181 2.24 5.54 0.69 61 XM_B_SEO 8872 2.58 5.35 1.27 62 MPART_ALT_DIFF 8758 4.30 5.29 3.84 63 TooManyTo_001 8549 7.09 5.16 8.00 64 RELAYCOUNTRY_CA 8471 2.39 5.11 1.11 65 XMSexyCombo_05 8255 2.74 4.98 1.68 66 BAYES_95 8193 3.08 4.95 2.21 67 TR_XM_SEO4 7839 2.03 4.73 0.76 68 XMStrtUSub 7538 4.99 4.55 5.20 69 XM_H_GMP 7476 5.15 4.51 5.45 70 XMBody_17 7389 1.80 4.46 0.55 71 TR_XM_SPAMCOP 7147 1.59 4.31 0.31 72 HTML_IMAGE_RATIO_06 6788 3.52 4.10 3.25 73 XM_B_Investor 6670 2.13 4.03 1.24 74 TR_XM_SpammyWords5 6303 2.22 3.80 1.47 75 TR_XM_PhishingBody 6278 2.21 3.79 1.47 76 XMNumbers 6024 3.03 3.64 2.74 77 XM_B_SpammyTLD 5895 2.85 3.56 2.51 78 HTML_IMAGE_RATIO_08 5843 2.70 3.53 2.31 79 RCVD_IN_MSPIKE_H3 5799 4.92 3.50 5.58 80 RCVD_IN_MSPIKE_WL 5799 4.92 3.50 5.58 81 XM_URI_RBL 5783 1.45 3.49 0.49 82 MIME_HTML_ONLY_MULTI 5641 2.65 3.40 2.30 83 TR_LOTS_OF_MONEY3 5583 1.43 3.37 0.52 84 T_XMDrugObfuBody_14 5394 2.32 3.26 1.88 85 XM_CamelCaseFrm001 5269 2.43 3.18 2.08 86 XM_UB50 5137 1.66 3.10 0.98 87 MIME_QP_LONG_LINE 5107 4.42 3.08 5.05 88 RCVD_IN_VALIDITY_RPBL 5072 1.10 3.06 0.18 89 TM2_M_VERY_LONG_WORD 5049 3.55 3.05 3.78 90 TM2_M_URI_OPT_OUT 5021 2.23 3.03 1.86 91 MIME_HTML_MOSTLY 4946 2.53 2.99 2.31 92 T_FILL_THIS_FORM_SHORT 4940 1.55 2.98 0.88 93 XM_OfRef6 4820 1.61 2.91 0.99 94 XMBrknScrpt_02 4757 1.71 2.87 1.17 95 T_XMDrugObfuBody_08 4740 1.89 2.86 1.43 96 SpammyFromTLD_01 4545 1.49 2.74 0.90 97 T_TooManySym_01 4498 4.77 2.71 5.73 98 XM_B_Unsub2 4447 2.07 2.68 1.79 99 RCVD_IN_VALIDITY_SAFE 4437 4.21 2.68 4.93 100 XMDiploma_00 4025 1.92 2.43 1.68 101 XM_B_SpammyWords4 3886 1.42 2.35 0.98 102 XM_B_URI_Unicode 3866 2.01 2.33 1.86 103 FROM_EXCESS_BASE64 3657 2.29 2.21 2.33 104 RELAYCOUNTRY_AU 3648 1.21 2.20 0.75 105 XMStockSpam_06 3487 1.79 2.10 1.64 106 T_XMHurry_00 3359 0.97 2.03 0.48 107 USER_IN_DEF_DKIM_WL 3324 9.86 2.01 13.55 108 XM_DK_Undo_01 3314 1.82 2.00 1.74 109 TR_LOTS_OF_MONEY2 3110 0.81 1.88 0.31 110 T_MONEY_PERCENT 3110 0.81 1.88 0.31 111 LONGLN_LOW_CONTRAST 3088 0.88 1.86 0.41 112 SUBJ_ALL_CAPS 3068 1.57 1.85 1.43 113 MAILING_LIST_MULTI 2950 2.68 1.78 3.10 114 RCVD_IN_VALIDITY_CERTIFIED 2949 3.29 1.78 4.01 115 TR_XM_InvalidRelay 2889 0.57 1.74 0.02 116 SpammyFromTLD_02 2840 0.70 1.71 0.22 117 TR_XM_NoHeaderRelay 2803 0.62 1.69 0.12 118 ALL_TRUSTED 2777 9.98 1.68 13.90 119 T_REMOTE_IMAGE 2731 3.04 1.65 3.70 120 XM_SendGrid 2694 1.59 1.63 1.57 121 RCVD_IN_ZEN_LASTEXTERNAL 2684 0.52 1.62 0.00 122 SHORTCIRCUIT 2684 0.52 1.62 0.00 123 TR_XM_INV_DKIM 2623 0.56 1.58 0.08 124 HTML_MIME_NO_HTML_TAG 2606 1.96 1.57 2.14 125 BAYES_40 2582 3.75 1.56 4.79 126 URI_HEX 2497 1.15 1.51 0.99 127 TR_XM_FormFill 2491 0.49 1.50 0.01 128 XM_B_REG_HTML 2388 0.58 1.44 0.18 129 THIS_AD 2356 0.77 1.42 0.46 130 DIET_1 2350 0.62 1.42 0.25 131 XMSubMetaI_00 2251 0.97 1.36 0.78 132 TR_XM_PHPForged 2250 0.89 1.36 0.67 133 XM_HighProb1 2248 0.44 1.36 0.00 134 RCVD_IN_IADB_LISTED 2242 2.95 1.35 3.70 135 XMGenDplmaNmb 2236 0.97 1.35 0.80 136 TR_XM_PHPDW 2204 0.88 1.33 0.66 137 TR_XM_FormFill2 2156 0.87 1.30 0.66 138 XM_H_PHPOS 2132 0.86 1.29 0.65 139 XM_B_COVIDMETA 2129 0.53 1.28 0.18 140 URI_TRY_3LD 2083 0.90 1.26 0.73 141 HTTPS_HTTP_MISMATCH 2046 0.94 1.23 0.80 142 T_XMDrugObfuBody_00 2019 0.81 1.22 0.61 143 LongTLD 2014 0.63 1.22 0.36 144 TooManyTo_002 2005 1.89 1.21 2.21 145 XMBdyGiftCard01 2005 1.07 1.21 1.01 146 RCVD_IN_IADB_SPF 1990 2.58 1.20 3.23 147 XMHTMLBadTable_001 1934 0.57 1.17 0.29 148 MPART_ALT_DIFF_COUNT 1913 0.64 1.15 0.39 149 XMPhish30 1891 0.70 1.14 0.49 150 BAYES_20 1890 2.78 1.14 3.55 151 SHOPIFY_IMG_NOT_RCVD_SFY 1878 0.51 1.13 0.22 152 RCVD_IN_IADB_DK 1877 2.29 1.13 2.83 153 RCVD_IN_IADB_SENDERID 1871 2.33 1.13 2.90 154 XM_DIRTYINTL 1869 0.54 1.13 0.26 155 RCVD_IN_PSBL 1863 0.41 1.12 0.07 156 KHOP_HELO_FCRDNS 1855 2.17 1.12 2.66 157 DKIM_ADSP_CUSTOM_MED 1844 0.93 1.11 0.84 158 URI_NOVOWEL 1817 1.33 1.10 1.44 159 RELAYCOUNTRY_CN 1815 0.40 1.10 0.08 160 XMHTML_After_End 1754 0.56 1.06 0.32 161 XMReplyNow 1727 0.49 1.04 0.24 162 XM_H_Long_From02 1643 0.97 0.99 0.96 163 TR_Mismatch_TLD_02 1625 0.38 0.98 0.10 164 T_Symld_Words_02 1605 0.83 0.97 0.77 165 XM_H_Undi_Recip 1601 0.50 0.97 0.28 166 TR_MetaPhish_Combo_01 1568 0.78 0.95 0.70 167 XM_ProductURIs 1562 1.02 0.94 1.05 168 HTML_TAG_BALANCE_BODY 1545 0.72 0.93 0.62 169 NML_ADSP_CUSTOM_MED 1514 0.66 0.91 0.55 170 RDNS_DYNAMIC 1499 0.55 0.90 0.38 171 XM_B_Phish66 1473 0.50 0.89 0.31 172 PDS_RDNS_DYNAMIC_FP 1470 0.44 0.89 0.23 173 TM2_M_OBFU_COMMENT 1470 0.59 0.89 0.45 174 XMSexyCombo_01 1458 0.40 0.88 0.17 175 BOTNET_NORDNS 1456 0.29 0.88 0.01 176 TR_XM_Base64_M1 1451 0.83 0.88 0.80 177 XM_B_COPY_HTML 1445 0.66 0.87 0.57 178 HOSTED_IMG_MULTI_PUB_01 1433 0.33 0.86 0.08 179 RCVD_IN_SORBS_DUL 1417 0.31 0.86 0.05 180 TR_XM_Undi_Recip19 1402 0.34 0.85 0.11 181 T_STY_INVIS_DIRECT 1400 0.48 0.84 0.32 182 XM_UB60 1395 0.34 0.84 0.11 183 XM_UB99 1395 0.27 0.84 0.01 184 TR_Symld_Words 1380 1.22 0.83 1.40 185 RELAYCOUNTRY_FR 1327 0.41 0.80 0.23 186 AC_BR_BONANZA 1308 0.32 0.79 0.09 187 FROM_SUSPICIOUS_NTLD 1306 0.27 0.79 0.03 188 TVD_RCVD_IP 1279 0.64 0.77 0.58 189 TR_XM_Base64_L1 1276 0.33 0.77 0.13 190 TM2_M_A_HREF_HREF 1260 0.38 0.76 0.20 191 RCVD_IN_PBL 1250 0.73 0.75 0.71 192 SUBJ_DOLLARS 1235 0.42 0.75 0.27 193 XM_B_DNDMA 1233 0.89 0.74 0.96 194 FORGED_GMAIL_RCVD 1224 0.58 0.74 0.50 195 PLING_QUERY 1214 0.47 0.73 0.34 196 T_TooManySym_02 1213 2.14 0.73 2.80 197 TR_XM_RelayPhish 1209 0.28 0.73 0.07 198 HELO_DYNAMIC_SPLIT_IP 1202 0.25 0.73 0.03 199 TR_XM_COVIDMETA4 1197 0.27 0.72 0.06 200 XMPhish14 1193 0.51 0.72 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 309030 90.27 95.37 87.87 2 RELAYCOUNTRY_US 291604 83.49 84.72 82.92 3 DKIM_SIGNED 267644 80.38 89.47 76.10 4 XM_DK_Pass 262861 78.17 85.44 74.74 5 DKIM_VALID 258870 76.90 83.88 73.61 6 XM_B_Unicode 247677 74.67 83.69 70.43 7 BAYES_50 213307 53.88 39.52 60.65 8 DCC_CHECK_NEGATIVE 212771 48.20 22.10 60.50 9 DKIM_VALID_AU 208059 61.75 67.26 59.16 10 XMListUnsubscribeExists 172471 56.27 71.60 49.04 11 XM_B_SpammyWords 160216 54.12 72.30 45.56 12 XM_B_Unicode3 148698 43.49 46.05 42.28 13 DCC_CHECK 138784 51.25 76.27 39.46 14 RCVD_IN_MSPIKE_H2 116923 34.76 37.98 33.25 15 T_TM2_M_HEADER_IN_MSG 112479 29.04 22.79 31.98 16 HTML_FONT_LOW_CONTRAST 110452 33.88 39.12 31.41 17 DKIM_VALID_EF 105909 29.08 26.88 30.11 18 LOC_TINY_FONT_1 89778 31.60 44.50 25.53 19 FVGT_m_MULTI_ODD 85497 26.74 31.90 24.31 20 XMSubLong 80265 22.98 23.30 22.82 21 T_KAM_HTML_FONT_INVALID 71200 23.36 29.98 20.25 22 MIME_HTML_ONLY 67410 22.18 28.57 19.17 23 XM_B_SpammyWords2 66140 25.38 39.35 18.81 24 XM_Multi_Part_URI 49293 16.04 20.34 14.02 25 ALL_TRUSTED 48875 9.98 1.68 13.90 26 USER_IN_DEF_DKIM_WL 47664 9.86 2.01 13.55 27 TR_XM_DK_Unsub 45107 14.69 18.64 12.83 28 UNPARSEABLE_RELAY 40200 12.82 15.76 11.43 29 BAYES_00 36760 7.33 0.71 10.45 30 XM_Evil_Numbers_Gen 35531 9.97 9.68 10.10 31 XM_B_PhoneNumber 32803 8.67 7.28 9.33 32 BAYES_60 30838 8.49 7.89 8.77 33 XM_B_Unsub 30203 10.94 15.94 8.59 34 XM_DKIMWhitelistDomains 29516 5.72 0.04 8.39 35 TooManyTo_001 28130 7.09 5.16 8.00 36 LotsOfNums_01 27456 7.78 7.73 7.81 37 TR_XM_DK_Bayes 27134 5.43 0.56 7.72 38 TR_XM_DK_Bayes1 26651 5.33 0.56 7.58 39 LOTS_OF_MONEY 25796 10.04 15.79 7.33 40 TR_XM_BayesUnsub 23766 9.52 15.39 6.76 41 IN_ZIMBRA_NJ_WHITELIST 23680 4.62 0.15 6.73 42 TR_XM_DK_Bayes2 22722 4.52 0.41 6.46 43 FSL_BULK_SIG 21852 6.78 7.97 6.21 44 TR_MAX_INTL_RELAY 20177 8.34 13.86 5.74 45 T_TooManySym_01 20169 4.77 2.71 5.73 46 XM_DK_Undo_02 20092 16.87 40.56 5.71 47 RCVD_IN_MSPIKE_H3 19633 4.92 3.50 5.58 48 RCVD_IN_MSPIKE_WL 19633 4.92 3.50 5.58 49 ANY_BOUNCE_MESSAGE 19540 3.99 0.66 5.56 50 BOUNCE_MESSAGE 19540 3.99 0.66 5.56 51 XM_H_GMP 19168 5.15 4.51 5.45 52 TR_XM_SpammyWords4 19056 8.23 14.18 5.42 53 XM_H_Long_From01 18553 5.37 5.56 5.28 54 XMStrtUSub 18286 4.99 4.55 5.20 55 XM_B_SpammyWords3 18200 7.91 13.72 5.18 56 MIME_QP_LONG_LINE 17771 4.42 3.08 5.05 57 HTML_IMAGE_RATIO_02 17495 5.55 6.78 4.97 58 RCVD_IN_VALIDITY_SAFE 17354 4.21 2.68 4.93 59 BAYES_40 16835 3.75 1.56 4.79 60 XM_PDF 16336 3.37 0.67 4.65 61 XM_B_Phish_Phrases 16089 5.50 7.47 4.57 62 HTML_IMAGE_RATIO_04 15316 4.78 5.67 4.35 63 RELAYCOUNTRY_META 14742 7.34 14.01 4.19 64 RCVD_IN_VALIDITY_CERTIFIED 14096 3.29 1.78 4.01 65 XM_UncommonTLD01 13609 4.67 6.37 3.87 66 MPART_ALT_DIFF 13509 4.30 5.29 3.84 67 BAYES_99 13497 13.31 33.41 3.84 68 TM2_M_VERY_LONG_WORD 13295 3.55 3.05 3.78 69 T_REMOTE_IMAGE 13021 3.04 1.65 3.70 70 RCVD_IN_IADB_LISTED 13001 2.95 1.35 3.70 71 BAYES_20 12475 2.78 1.14 3.55 72 BOTNET_IPINHOSTNAME 12459 6.56 12.95 3.54 73 BAYES_80 12410 5.16 8.61 3.53 74 HTML_IMAGE_ONLY_32 11437 2.26 0.16 3.25 75 HTML_IMAGE_RATIO_06 11427 3.52 4.10 3.25 76 RCVD_IN_IADB_SPF 11375 2.58 1.20 3.23 77 MAILING_LIST_MULTI 10897 2.68 1.78 3.10 78 BAYES_999 10287 10.56 26.76 2.93 79 RCVD_IN_IADB_SENDERID 10207 2.33 1.13 2.90 80 RCVD_IN_IADB_DK 9969 2.29 1.13 2.83 81 XMSubMetaSx_00 9946 3.75 5.71 2.83 82 XM_Body_Dirty_Words 9885 4.30 7.47 2.81 83 T_TooManySym_02 9857 2.14 0.73 2.80 84 XMNumbers 9649 3.03 3.64 2.74 85 KHOP_HELO_FCRDNS 9367 2.17 1.12 2.66 86 XM_B_SpammyTLD 8833 2.85 3.56 2.51 87 DKIM_INVALID 8774 3.49 5.59 2.49 88 TR_XM_DKIM_Undo 8734 11.20 29.71 2.48 89 RCVD_IN_IADB_VOUCHED 8653 1.89 0.69 2.46 90 FROM_EXCESS_BASE64 8194 2.29 2.21 2.33 91 MIME_HTML_MOSTLY 8132 2.53 2.99 2.31 92 HTML_IMAGE_RATIO_08 8107 2.70 3.53 2.31 93 MIME_HTML_ONLY_MULTI 8077 2.65 3.40 2.30 94 BAYES_05 7803 1.70 0.59 2.22 95 TooManyTo_002 7782 1.89 1.21 2.21 96 BAYES_95 7759 3.08 4.95 2.21 97 HTML_MIME_NO_HTML_TAG 7538 1.96 1.57 2.14 98 INVALID_MSGID 7462 1.48 0.12 2.12 99 XM_CamelCaseFrm001 7320 2.43 3.18 2.08 100 TR_XM_SpammyRelay 7065 4.70 10.42 2.01 101 XM_SPF_SoftFail 7011 3.13 5.56 1.99 102 T_XMDrugObfuBody_14 6626 2.32 3.26 1.88 103 TM2_M_URI_OPT_OUT 6531 2.23 3.03 1.86 104 XM_B_URI_Unicode 6526 2.01 2.33 1.86 105 XM_B_Unsub2 6286 2.07 2.68 1.79 106 TO_MALFORMED 6254 1.21 0.01 1.78 107 MIME_CHARSET_FARAWAY 6113 1.35 0.52 1.74 108 XM_DK_Undo_01 6104 1.82 2.00 1.74 109 BOTNET 6062 4.31 9.79 1.72 110 XMDiploma_00 5914 1.92 2.43 1.68 111 XMSexyCombo_05 5912 2.74 4.98 1.68 112 RCVD_IN_IADB_OPTIN 5827 1.26 0.42 1.66 113 UNTRUSTED_Relay 5813 3.04 5.99 1.65 114 TR_XM_UnparsRelay 5807 3.79 8.33 1.65 115 XMStockSpam_06 5756 1.79 2.10 1.64 116 XM_SendGrid 5526 1.59 1.63 1.57 117 TooManyTo_003 5421 1.26 0.68 1.54 118 CHARSET_FARAWAY_HEADER 5266 1.04 0.07 1.50 119 TR_XM_SpammyWords5 5178 2.22 3.80 1.47 120 TR_XM_PhishingBody 5176 2.21 3.79 1.47 121 URI_NOVOWEL 5059 1.33 1.10 1.44 122 SUBJ_ALL_CAPS 5032 1.57 1.85 1.43 123 T_XMDrugObfuBody_08 5020 1.89 2.86 1.43 124 IN_HORDE_ADDRESS_BOOK 5005 1.02 0.15 1.42 125 TR_Symld_Words 4941 1.22 0.83 1.40 126 TR_DCC_Bayes_99 4777 8.85 24.76 1.36 127 XM_B_SEO 4452 2.58 5.35 1.27 128 XMLngstWrd_00 4443 0.98 0.39 1.26 129 XM_B_Investor 4365 2.13 4.03 1.24 130 XMCapTrack 4287 1.01 0.58 1.22 131 HELO_NODOT 4221 0.88 0.20 1.20 132 XM_GoogleGroups 4221 1.02 0.63 1.20 133 HELO_NO_DOMAIN 4219 0.88 0.20 1.20 134 XMBrknScrpt_02 4099 1.71 2.87 1.17 135 TooManyTo_004 4066 0.98 0.62 1.16 136 TVD_SPACE_RATIO 4035 0.82 0.12 1.15 137 XMGappySubj_01 3902 0.82 0.19 1.11 138 RELAYCOUNTRY_CA 3896 2.39 5.11 1.11 139 XM_ProductURIs 3700 1.02 0.94 1.05 140 T_TooManySym_03 3683 0.79 0.26 1.05 141 FROM_GOV_DKIM_AU 3657 0.76 0.16 1.04 142 XMBdyGiftCard01 3554 1.07 1.21 1.01 143 XM_OfRef6 3489 1.61 2.91 0.99 144 URI_HEX 3469 1.15 1.51 0.99 145 XM_B_SpammyWords4 3459 1.42 2.35 0.98 146 XM_UB50 3457 1.66 3.10 0.98 147 TooManyTo_005 3442 0.85 0.58 0.98 148 XM_H_Long_From02 3370 0.97 0.99 0.96 149 XM_B_DNDMA 3362 0.89 0.74 0.96 150 TR_XM_DK_SendGrid 3258 0.86 0.72 0.93 151 SpammyFromTLD_01 3167 1.49 2.74 0.90 152 T_FILL_THIS_FORM_SHORT 3080 1.55 2.98 0.88 153 XM_ShortIntro_01 3008 0.75 0.51 0.86 154 DKIM_ADSP_CUSTOM_MED 2946 0.93 1.11 0.84 155 XMNoVowels 2945 0.74 0.55 0.84 156 TR_XM_Base64_M1 2825 0.83 0.88 0.80 157 HTTPS_HTTP_MISMATCH 2821 0.94 1.23 0.80 158 XMGenDplmaNmb 2807 0.97 1.35 0.80 159 XMSubMetaI_00 2752 0.97 1.36 0.78 160 T_Symld_Words_02 2698 0.83 0.97 0.77 161 TR_XM_SEO4 2687 2.03 4.73 0.76 162 RELAYCOUNTRY_AU 2630 1.21 2.20 0.75 163 URI_TRY_3LD 2551 0.90 1.26 0.73 164 RCVD_IN_PBL 2504 0.73 0.75 0.71 165 XMGappySubj_02 2485 0.50 0.07 0.71 166 T_OBFU_PDF_ATTACH 2480 0.56 0.25 0.71 167 XMBody_95 2471 0.53 0.15 0.70 168 TR_MetaPhish_Combo_01 2465 0.78 0.95 0.70 169 XM_H_PHPMailer 2427 0.67 0.63 0.69 170 RCVD_IN_BL_SPAMCOP_NET 2420 2.24 5.54 0.69 171 TR_XM_PHPForged 2346 0.89 1.36 0.67 172 TR_XM_PHPDW 2329 0.88 1.33 0.66 173 TR_XM_FormFill2 2324 0.87 1.30 0.66 174 XM_H_PHPOS 2296 0.86 1.29 0.65 175 HTML_TAG_BALANCE_BODY 2196 0.72 0.93 0.62 176 T_XMDrugObfuBody_00 2160 0.81 1.22 0.61 177 TVD_RCVD_IP 2048 0.64 0.77 0.58 178 XM_B_COPY_HTML 1993 0.66 0.87 0.57 179 XMBody_17 1945 1.80 4.46 0.55 180 NML_ADSP_CUSTOM_MED 1923 0.66 0.91 0.55 181 MSGID_FROM_MTA_HEADER 1913 0.40 0.11 0.54 182 TM2_M_BODY_EMPTY 1886 0.39 0.09 0.54 183 HTML_IMAGE_ONLY_20 1883 0.50 0.44 0.54 184 TR_LOTS_OF_MONEY3 1822 1.43 3.37 0.52 185 FORGED_GMAIL_RCVD 1751 0.58 0.74 0.50 186 XMPhish30 1731 0.70 1.14 0.49 187 XM_URI_RBL 1723 1.45 3.49 0.49 188 T_XMHurry_00 1679 0.97 2.03 0.48 189 RELAYCOUNTRY_GB 1642 0.55 0.72 0.47 190 HTML_IMAGE_ONLY_28 1631 0.39 0.23 0.46 191 THIS_AD 1612 0.77 1.42 0.46 192 XMLngstWrd_01 1600 0.42 0.35 0.45 193 XMMoneyMeta_00 1579 0.48 0.56 0.45 194 TM2_M_OBFU_COMMENT 1575 0.59 0.89 0.45 195 MISSING_HEADERS 1549 0.45 0.47 0.44 196 TR_XM_SpammyWords2 1496 4.08 11.83 0.43 197 HTML_FONT_FACE_BAD 1493 0.48 0.59 0.42 198 T_TVD_MIME_NO_HEADERS 1491 0.30 0.03 0.42 199 XMSubNoVowel 1487 0.43 0.44 0.42 200 USER_IN_WHITELIST 1472 0.28 0.00 0.42 ----------------------------------------------------------------------