Email: 411569 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.29 sec Spam: 134573 Autolearn: 0 AvgScore: 14.21 AvgScanTime: 1.42 sec Ham: 276996 Autolearn: 0 AvgScore: 0.02 AvgScanTime: 1.23 sec Time Spent Running SA: 147.86 hours Time Spent Processing Spam: 53.06 hours Time Spent Processing Ham: 94.80 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 129473 87.74 96.21 83.62 2 DKIM_SIGNED 120923 79.52 89.86 74.49 3 XM_DK_Pass 115741 77.42 86.01 73.25 4 DKIM_VALID 114662 76.57 85.20 72.38 5 RELAYCOUNTRY_US 113927 80.83 84.66 78.97 6 XM_B_Unicode 112036 73.57 83.25 68.86 7 DCC_CHECK 104949 54.04 77.99 42.40 8 XMListUnsubscribeExists 96778 56.36 71.91 48.81 9 XM_B_SpammyWords 95061 52.97 70.64 44.38 10 DKIM_VALID_AU 90636 62.04 67.35 59.46 11 LOC_TINY_FONT_1 69325 34.72 51.51 26.57 12 XM_B_Unicode3 65861 43.65 48.94 41.08 13 BAYES_50 56781 53.44 42.19 58.90 14 XM_B_SpammyWords2 55055 25.12 40.91 17.44 15 HTML_FONT_LOW_CONTRAST 54396 32.86 40.42 29.18 16 XM_DK_Undo_02 52932 16.47 39.33 5.36 17 RCVD_IN_MSPIKE_H2 50879 34.72 37.81 33.22 18 FVGT_m_MULTI_ODD 46750 27.35 34.74 23.77 19 T_KAM_HTML_FONT_INVALID 44291 23.69 32.91 19.20 20 BAYES_99 39084 12.04 29.04 3.78 21 TR_XM_DKIM_Undo 36160 10.03 26.87 1.84 22 MIME_HTML_ONLY 36088 21.84 26.82 19.43 23 DKIM_VALID_EF 35933 27.99 26.70 28.61 24 XMSubLong 30970 22.39 23.01 22.08 25 BAYES_999 30115 9.32 22.38 2.98 26 XM_Multi_Part_URI 29826 18.16 22.16 16.22 27 TR_DCC_Bayes_99 29436 8.32 21.87 1.73 28 T_TM2_M_HEADER_IN_MSG 28981 25.28 21.54 27.09 29 DCC_CHECK_NEGATIVE 28297 45.61 21.03 57.56 30 TR_XM_DK_Unsub 24725 14.56 18.37 12.70 31 XM_B_Unsub 23573 12.32 17.52 9.79 32 TR_XM_BayesUnsub 22884 10.47 17.00 7.29 33 UNPARSEABLE_RELAY 22796 13.18 16.94 11.36 34 RELAYCOUNTRY_META 21285 7.84 15.82 3.97 35 TR_MAX_INTL_RELAY 21192 8.78 15.75 5.40 36 XM_B_SpammyWords3 20587 8.01 15.30 4.47 37 LOTS_OF_MONEY 19249 9.13 14.30 6.61 38 TR_XM_SpammyWords4 17389 7.16 12.92 4.36 39 BOTNET_IPINHOSTNAME 17104 6.37 12.71 3.29 40 TR_XM_SpammyRelay 15925 5.31 11.83 2.13 41 BOTNET 13984 4.37 10.39 1.44 42 XM_Evil_Numbers_Gen 13814 8.99 10.27 8.37 43 TR_XM_SpammyWords2 13736 3.59 10.21 0.38 44 BAYES_80 13268 5.51 9.86 3.40 45 XM_Body_Dirty_Words 12542 5.42 9.32 3.53 46 RCVD_IN_BL_SPAMCOP_NET 12183 3.34 9.05 0.57 47 BAYES_60 12023 8.78 8.93 8.70 48 FSL_BULK_SIG 11812 8.52 8.78 8.40 49 TR_XM_UnparsRelay 11483 3.78 8.53 1.47 50 TR_XM_SPAMCOP 10170 2.65 7.56 0.27 51 LotsOfNums_01 10139 7.97 7.53 8.18 52 XM_B_Phish_Phrases 9972 5.49 7.41 4.56 53 HTML_IMAGE_RATIO_02 9517 5.59 7.07 4.87 54 MPART_ALT_DIFF 9382 5.30 6.97 4.48 55 RELAYCOUNTRY_CA 8600 3.09 6.39 1.48 56 XMSubMetaSx_00 7964 4.53 5.92 3.85 57 XM_UncommonTLD01 7854 4.70 5.84 4.15 58 UNTRUSTED_Relay 7779 3.04 5.78 1.71 59 TooManyTo_001 7753 8.10 5.76 9.24 60 BAYES_95 7561 3.18 5.62 1.99 61 XM_H_Long_From01 7411 5.50 5.51 5.49 62 XM_B_PhoneNumber 7251 7.41 5.39 8.40 63 XMStrtUSub 7064 4.98 5.25 4.85 64 XM_B_SpammyTLD 6963 4.94 5.17 4.82 65 TR_XM_PhishingBody 6610 2.84 4.91 1.83 66 XM_H_GMP 6439 4.80 4.78 4.81 67 DKIM_INVALID 6261 2.95 4.65 2.12 68 T_XMDrugObfuBody_14 6251 2.44 4.65 1.37 69 XMSexyCombo_05 6116 2.30 4.54 1.21 70 XM_B_SEO 6045 2.15 4.49 1.01 71 HTML_IMAGE_RATIO_04 5937 4.35 4.41 4.32 72 XM_B_Investor 5593 2.59 4.16 1.82 73 MIME_QP_LONG_LINE 5401 5.59 4.01 6.36 74 TR_XM_SEO4 5367 1.78 3.99 0.70 75 XM_CamelCaseFrm001 5338 3.10 3.97 2.69 76 RCVD_IN_MSPIKE_WL 5140 4.82 3.82 5.31 77 RCVD_IN_MSPIKE_H3 5140 4.82 3.82 5.31 78 TR_LOTS_OF_MONEY3 5137 1.93 3.82 1.01 79 TM2_M_VERY_LONG_WORD 5104 2.40 3.79 1.72 80 TR_XM_SpammyWords5 4993 2.39 3.71 1.75 81 HTML_IMAGE_RATIO_06 4858 2.98 3.61 2.67 82 MIME_HTML_ONLY_MULTI 4651 2.66 3.46 2.27 83 T_XMHurry_00 4589 1.70 3.41 0.88 84 MIME_HTML_MOSTLY 4560 2.86 3.39 2.60 85 RCVD_IN_VALIDITY_RPBL 4554 1.15 3.38 0.07 86 XMNumbers 4538 3.04 3.37 2.88 87 TM2_M_URI_OPT_OUT 4501 3.34 3.34 3.34 88 XM_SPF_SoftFail 4460 1.93 3.31 1.26 89 HTML_IMAGE_RATIO_08 4244 2.85 3.15 2.71 90 XM_UB50 4220 1.65 3.14 0.93 91 XMBody_17 4213 1.43 3.13 0.60 92 FROM_EXCESS_BASE64 4089 2.31 3.04 1.96 93 XM_B_SpammyWords4 3868 1.45 2.87 0.76 94 XM_OfRef6 3799 1.52 2.82 0.89 95 TR_XM_NoHeaderRelay 3730 1.09 2.77 0.27 96 DKIM_ADSP_NXDOMAIN 3719 1.11 2.76 0.31 97 T_XMDrugObfuBody_08 3668 1.80 2.73 1.36 98 RELAYCOUNTRY_AU 3557 1.27 2.64 0.60 99 URI_HEX 3335 1.61 2.48 1.19 100 RCVD_IN_VALIDITY_SAFE 3283 4.09 2.44 4.89 101 XM_URI_RBL 3253 1.13 2.42 0.50 102 T_TooManySym_01 3191 4.52 2.37 5.56 103 BOTNET_NORDNS 3154 0.78 2.34 0.01 104 XMBrknScrpt_02 3114 1.60 2.31 1.25 105 XMDiploma_00 3004 1.54 2.23 1.21 106 SpammyFromTLD_01 2989 1.26 2.22 0.80 107 USER_IN_DEF_DKIM_WL 2985 9.93 2.22 13.68 108 TR_XM_PHPDW 2885 0.94 2.14 0.36 109 TR_XM_PHPForged 2869 0.93 2.13 0.34 110 TR_XM_FormFill2 2820 0.92 2.10 0.35 111 XM_H_PHPOS 2793 0.90 2.08 0.34 112 RCVD_IN_VALIDITY_CERTIFIED 2713 3.24 2.02 3.84 113 XM_B_Unsub2 2711 1.67 2.01 1.50 114 XM_B_URI_Unicode 2587 1.79 1.92 1.73 115 HTML_MIME_NO_HTML_TAG 2560 2.22 1.90 2.37 116 T_FILL_THIS_FORM_SHORT 2517 1.14 1.87 0.78 117 ANY_BOUNCE_MESSAGE 2494 2.74 1.85 3.17 118 BOUNCE_MESSAGE 2494 2.74 1.85 3.17 119 T_XMDrugObfuBody_00 2467 1.13 1.83 0.79 120 SUBJ_ALL_CAPS 2454 1.70 1.82 1.64 121 XMStockSpam_06 2429 1.16 1.80 0.84 122 XM_DK_Undo_01 2313 1.61 1.72 1.56 123 XM_H_Long_From02 2309 1.33 1.72 1.14 124 XM_B_COPY_HTML 2282 1.10 1.70 0.81 125 XMPhish14 2254 0.84 1.67 0.43 126 MAILING_LIST_MULTI 2225 2.14 1.65 2.37 127 RCVD_IN_PSBL 2151 0.57 1.60 0.08 128 NO_DNS_FOR_FROM 2087 0.75 1.55 0.36 129 TR_XM_MaxWHORU 2077 0.71 1.54 0.30 130 URIBL_CSS_A 2048 0.54 1.52 0.07 131 URIBL_CSS 2048 0.54 1.52 0.07 132 SH_BODYURI_REVERSE_CSS 2031 0.54 1.51 0.06 133 KHOP_HELO_FCRDNS 1987 1.27 1.48 1.18 134 SUSP_UTF8_WORD_SUBJ 1934 0.49 1.44 0.02 135 MPART_ALT_DIFF_COUNT 1931 0.98 1.43 0.75 136 HTTPS_HTTP_MISMATCH 1931 0.91 1.43 0.65 137 BAYES_40 1877 4.18 1.39 5.53 138 SpammyFromTLD_02 1841 0.77 1.37 0.48 139 XM_DIRTYINTL 1835 0.50 1.36 0.07 140 XMLngstWrd_00 1826 0.81 1.36 0.55 141 XMPhish30 1806 0.78 1.34 0.51 142 XM_GoogleGroups 1788 1.18 1.33 1.10 143 XMBounce_01 1771 0.44 1.32 0.02 144 TR_XM_Base64_M1 1769 0.87 1.31 0.66 145 TooManyTo_002 1735 2.16 1.29 2.58 146 T_STY_INVIS_DIRECT 1728 0.67 1.28 0.37 147 XMLngstWrd_01 1703 0.67 1.27 0.38 148 XMSubMetaI_00 1664 0.81 1.24 0.60 149 TooManyTo_003 1659 1.29 1.23 1.32 150 XMLngstWrd_02 1647 0.60 1.22 0.29 151 SHOPIFY_IMG_NOT_RCVD_SFY 1614 0.54 1.20 0.22 152 TooManyTo_004 1614 1.01 1.20 0.92 153 ALL_TRUSTED 1597 12.11 1.19 17.41 154 TooManyTo_005 1588 0.88 1.18 0.74 155 XM_B_Phish66 1585 0.76 1.18 0.56 156 AC_BR_BONANZA 1579 0.48 1.17 0.14 157 XMLngstWrd_03 1569 0.53 1.17 0.21 158 RCVD_IN_IADB_LISTED 1540 2.80 1.14 3.60 159 T_REMOTE_IMAGE 1531 2.88 1.14 3.73 160 XM_SendGrid 1530 1.26 1.14 1.32 161 TR_Symld_Words 1519 1.35 1.13 1.46 162 XM_ProductURIs 1509 0.73 1.12 0.53 163 XMGenDplmaNmb 1502 0.71 1.12 0.51 164 URI_TRY_3LD 1496 0.86 1.11 0.73 165 HTML_TAG_BALANCE_BODY 1491 0.84 1.11 0.71 166 PLING_QUERY 1486 0.71 1.10 0.52 167 XMLngstWrd_04 1481 0.48 1.10 0.18 168 NORDNS_LOW_CONTRAST 1446 0.38 1.07 0.04 169 URI_NOVOWEL 1431 2.58 1.06 3.32 170 DIET_1 1430 0.60 1.06 0.37 171 XMSexyCombo_01 1420 0.46 1.06 0.16 172 RDNS_DYNAMIC 1408 0.57 1.05 0.34 173 XMReplyNow 1406 0.47 1.04 0.19 174 XMBdyGiftCard01 1395 0.76 1.04 0.63 175 T_MONEY_PERCENT 1378 0.47 1.02 0.20 176 TR_LOTS_OF_MONEY2 1378 0.47 1.02 0.20 177 PDS_RDNS_DYNAMIC_FP 1373 0.45 1.02 0.17 178 RCVD_IN_IADB_SPF 1352 2.50 1.00 3.23 179 XM_B_Crypto 1343 0.37 1.00 0.06 180 HOSTED_IMG_MULTI_PUB_01 1317 0.34 0.98 0.03 181 BAYES_20 1314 2.89 0.98 3.82 182 XMHTMLBadTable_001 1288 0.51 0.96 0.30 183 TR_XM_INV_DKIM 1287 0.35 0.96 0.05 184 RCVD_IN_IADB_DK 1286 2.25 0.96 2.88 185 SHORTCIRCUIT 1272 0.31 0.95 0.00 186 RCVD_IN_ZEN_LASTEXTERNAL 1272 0.31 0.95 0.00 187 RCVD_IN_IADB_SENDERID 1272 2.29 0.95 2.95 188 XM_B_REG_HTML 1266 0.44 0.94 0.19 189 XM_UB99 1261 0.31 0.94 0.00 190 XM_B_COVIDMETA 1250 0.45 0.93 0.21 191 TM2_M_OBFU_COMMENT 1240 0.54 0.92 0.35 192 TR_XM_RelayPhish 1235 0.34 0.92 0.05 193 HTML_FONT_TINY_NORDNS 1232 0.33 0.92 0.04 194 DKIM_ADSP_CUSTOM_MED 1192 0.74 0.89 0.67 195 XMSubMetaSxObfu_03 1170 0.70 0.87 0.62 196 RELAYCOUNTRY_TH 1164 0.29 0.86 0.01 197 TVD_RCVD_IP 1133 0.72 0.84 0.67 198 LongTLD 1130 0.53 0.84 0.38 199 HTML_FONT_FACE_BAD 1121 0.52 0.83 0.37 200 XMSlimDrugH 1107 0.99 0.82 1.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 231619 87.74 96.21 83.62 2 RELAYCOUNTRY_US 218754 80.83 84.66 78.97 3 DKIM_SIGNED 206345 79.52 89.86 74.49 4 XM_DK_Pass 202897 77.42 86.01 73.25 5 DKIM_VALID 200484 76.57 85.20 72.38 6 XM_B_Unicode 190747 73.57 83.25 68.86 7 DKIM_VALID_AU 164713 62.04 67.35 59.46 8 BAYES_50 163163 53.44 42.19 58.90 9 DCC_CHECK_NEGATIVE 159433 45.61 21.03 57.56 10 XMListUnsubscribeExists 135196 56.36 71.91 48.81 11 XM_B_SpammyWords 122933 52.97 70.64 44.38 12 DCC_CHECK 117457 54.04 77.99 42.40 13 XM_B_Unicode3 113781 43.65 48.94 41.08 14 RCVD_IN_MSPIKE_H2 92008 34.72 37.81 33.22 15 HTML_FONT_LOW_CONTRAST 80827 32.86 40.42 29.18 16 DKIM_VALID_EF 79262 27.99 26.70 28.61 17 T_TM2_M_HEADER_IN_MSG 75047 25.28 21.54 27.09 18 LOC_TINY_FONT_1 73586 34.72 51.51 26.57 19 FVGT_m_MULTI_ODD 65832 27.35 34.74 23.77 20 XMSubLong 61166 22.39 23.01 22.08 21 MIME_HTML_ONLY 53810 21.84 26.82 19.43 22 T_KAM_HTML_FONT_INVALID 53192 23.69 32.91 19.20 23 XM_B_SpammyWords2 48320 25.12 40.91 17.44 24 ALL_TRUSTED 48230 12.11 1.19 17.41 25 XM_Multi_Part_URI 44931 18.16 22.16 16.22 26 USER_IN_DEF_DKIM_WL 37890 9.93 2.22 13.68 27 TR_XM_DK_Unsub 35179 14.56 18.37 12.70 28 BAYES_00 32173 7.98 0.51 11.61 29 UNPARSEABLE_RELAY 31469 13.18 16.94 11.36 30 XM_B_Unsub 27118 12.32 17.52 9.79 31 TooManyTo_001 25595 8.10 5.76 9.24 32 BAYES_60 24096 8.78 8.93 8.70 33 FSL_BULK_SIG 23265 8.52 8.78 8.40 34 XM_B_PhoneNumber 23258 7.41 5.39 8.40 35 XM_Evil_Numbers_Gen 23187 8.99 10.27 8.37 36 LotsOfNums_01 22660 7.97 7.53 8.18 37 TR_XM_DK_Bayes 22402 5.57 0.40 8.09 38 TR_XM_DK_Bayes1 22093 5.50 0.40 7.98 39 XM_DKIMWhitelistDomains 20618 5.03 0.05 7.44 40 TR_XM_BayesUnsub 20198 10.47 17.00 7.29 41 TR_XM_DK_Bayes2 19253 4.76 0.25 6.95 42 IN_ZIMBRA_NJ_WHITELIST 18312 4.49 0.12 6.61 43 LOTS_OF_MONEY 18310 9.13 14.30 6.61 44 MIME_QP_LONG_LINE 17607 5.59 4.01 6.36 45 T_TooManySym_01 15403 4.52 2.37 5.56 46 BAYES_40 15327 4.18 1.39 5.53 47 XM_H_Long_From01 15210 5.50 5.51 5.49 48 TR_MAX_INTL_RELAY 14949 8.78 15.75 5.40 49 XM_DK_Undo_02 14848 16.47 39.33 5.36 50 RCVD_IN_MSPIKE_H3 14712 4.82 3.82 5.31 51 RCVD_IN_MSPIKE_WL 14712 4.82 3.82 5.31 52 RCVD_IN_VALIDITY_SAFE 13545 4.09 2.44 4.89 53 HTML_IMAGE_RATIO_02 13493 5.59 7.07 4.87 54 XMStrtUSub 13444 4.98 5.25 4.85 55 XM_B_SpammyTLD 13363 4.94 5.17 4.82 56 XM_H_GMP 13317 4.80 4.78 4.81 57 XM_B_Phish_Phrases 12631 5.49 7.41 4.56 58 MPART_ALT_DIFF 12413 5.30 6.97 4.48 59 XM_B_SpammyWords3 12382 8.01 15.30 4.47 60 TR_XM_SpammyWords4 12087 7.16 12.92 4.36 61 HTML_IMAGE_RATIO_04 11968 4.35 4.41 4.32 62 XM_PDF 11825 2.99 0.36 4.27 63 XM_UncommonTLD01 11502 4.70 5.84 4.15 64 RELAYCOUNTRY_META 10992 7.84 15.82 3.97 65 XMSubMetaSx_00 10665 4.53 5.92 3.85 66 RCVD_IN_VALIDITY_CERTIFIED 10636 3.24 2.02 3.84 67 BAYES_20 10568 2.89 0.98 3.82 68 BAYES_99 10474 12.04 29.04 3.78 69 T_REMOTE_IMAGE 10333 2.88 1.14 3.73 70 RCVD_IN_IADB_LISTED 9984 2.80 1.14 3.60 71 XM_Body_Dirty_Words 9785 5.42 9.32 3.53 72 BAYES_80 9424 5.51 9.86 3.40 73 TM2_M_URI_OPT_OUT 9245 3.34 3.34 3.34 74 URI_NOVOWEL 9189 2.58 1.06 3.32 75 BOTNET_IPINHOSTNAME 9118 6.37 12.71 3.29 76 RCVD_IN_IADB_SPF 8956 2.50 1.00 3.23 77 ANY_BOUNCE_MESSAGE 8777 2.74 1.85 3.17 78 BOUNCE_MESSAGE 8774 2.74 1.85 3.17 79 BAYES_999 8241 9.32 22.38 2.98 80 RCVD_IN_IADB_SENDERID 8164 2.29 0.95 2.95 81 XMNumbers 7989 3.04 3.37 2.88 82 RCVD_IN_IADB_DK 7988 2.25 0.96 2.88 83 T_TooManySym_02 7783 2.16 0.82 2.81 84 HTML_IMAGE_RATIO_08 7506 2.85 3.15 2.71 85 XM_CamelCaseFrm001 7438 3.10 3.97 2.69 86 HTML_IMAGE_RATIO_06 7402 2.98 3.61 2.67 87 MIME_HTML_MOSTLY 7201 2.86 3.39 2.60 88 TooManyTo_002 7156 2.16 1.29 2.58 89 INVALID_MSGID 7057 1.76 0.13 2.55 90 HTML_MIME_NO_HTML_TAG 6569 2.22 1.90 2.37 91 MAILING_LIST_MULTI 6565 2.14 1.65 2.37 92 MIME_HTML_ONLY_MULTI 6281 2.66 3.46 2.27 93 BAYES_05 6250 1.69 0.53 2.26 94 TO_MALFORMED 6227 1.52 0.01 2.25 95 TR_XM_SpammyRelay 5910 5.31 11.83 2.13 96 DKIM_INVALID 5861 2.95 4.65 2.12 97 RCVD_IN_IADB_VOUCHED 5842 1.58 0.49 2.11 98 BAYES_95 5519 3.18 5.62 1.99 99 FROM_EXCESS_BASE64 5427 2.31 3.04 1.96 100 XMGappySubj_01 5127 1.29 0.14 1.85 101 TR_XM_DKIM_Undo 5110 10.03 26.87 1.84 102 TR_XM_PhishingBody 5079 2.84 4.91 1.83 103 XM_B_Investor 5055 2.59 4.16 1.82 104 TR_XM_SpammyWords5 4855 2.39 3.71 1.75 105 TR_DCC_Bayes_99 4792 8.32 21.87 1.73 106 XM_B_URI_Unicode 4782 1.79 1.92 1.73 107 TM2_M_VERY_LONG_WORD 4775 2.40 3.79 1.72 108 UNTRUSTED_Relay 4733 3.04 5.78 1.71 109 SUBJ_ALL_CAPS 4546 1.70 1.82 1.64 110 IN_HORDE_ADDRESS_BOOK 4352 1.11 0.16 1.57 111 XM_DK_Undo_01 4315 1.61 1.72 1.56 112 XM_B_Unsub2 4146 1.67 2.01 1.50 113 RELAYCOUNTRY_CA 4111 3.09 6.39 1.48 114 TR_XM_UnparsRelay 4080 3.78 8.53 1.47 115 TR_Symld_Words 4048 1.35 1.13 1.46 116 RCVD_IN_IADB_OPTIN 4033 1.07 0.29 1.46 117 BOTNET 3992 4.37 10.39 1.44 118 T_XMDrugObfuBody_14 3805 2.44 4.65 1.37 119 T_XMDrugObfuBody_08 3760 1.80 2.73 1.36 120 TooManyTo_003 3669 1.29 1.23 1.32 121 XM_SendGrid 3663 1.26 1.14 1.32 122 ACT_NOW_CAPS 3528 0.98 0.37 1.27 123 TVD_SPACE_RATIO 3518 0.89 0.12 1.27 124 XM_SPF_SoftFail 3496 1.93 3.31 1.26 125 XMBrknScrpt_02 3470 1.60 2.31 1.25 126 XMGappySubj_02 3399 0.84 0.04 1.23 127 SHORT_URI_3 3374 0.89 0.21 1.22 128 XMSexyCombo_05 3360 2.30 4.54 1.21 129 XMDiploma_00 3342 1.54 2.23 1.21 130 URI_HEX 3301 1.61 2.48 1.19 131 KHOP_HELO_FCRDNS 3256 1.27 1.48 1.18 132 XM_H_Long_From02 3152 1.33 1.72 1.14 133 XM_TLDProd2 3141 0.84 0.25 1.13 134 XM_GoogleGroups 3060 1.18 1.33 1.10 135 XMSlimDrugH 2952 0.99 0.82 1.07 136 TR_LOTS_OF_MONEY3 2792 1.93 3.82 1.01 137 XM_B_SEO 2785 2.15 4.49 1.01 138 T_TooManySym_03 2719 0.71 0.14 0.98 139 FROM_GOV_DKIM_AU 2678 0.69 0.13 0.97 140 HELO_NODOT 2674 0.74 0.28 0.97 141 HELO_NO_DOMAIN 2670 0.74 0.27 0.96 142 XM_UB50 2586 1.65 3.14 0.93 143 TooManyTo_004 2554 1.01 1.20 0.92 144 XM_OfRef6 2470 1.52 2.82 0.89 145 XMCapTrack 2460 0.74 0.44 0.89 146 T_XMHurry_00 2426 1.70 3.41 0.88 147 TR_XM_DK_SendGrid 2345 0.82 0.76 0.85 148 XMStockSpam_06 2335 1.16 1.80 0.84 149 XM_H_PHPMailer 2283 0.81 0.78 0.82 150 XM_B_FormFill 2244 0.55 0.02 0.81 151 XM_B_COPY_HTML 2238 1.10 1.70 0.81 152 SpammyFromTLD_01 2207 1.26 2.22 0.80 153 T_XMDrugObfuBody_00 2183 1.13 1.83 0.79 154 T_FILL_THIS_FORM_SHORT 2171 1.14 1.87 0.78 155 XM_B_SpammyWords4 2116 1.45 2.87 0.76 156 XM_B_DNDMA 2103 0.75 0.73 0.76 157 MPART_ALT_DIFF_COUNT 2086 0.98 1.43 0.75 158 TooManyTo_005 2046 0.88 1.18 0.74 159 URI_TRY_3LD 2025 0.86 1.11 0.73 160 HTML_TAG_BALANCE_BODY 1969 0.84 1.11 0.71 161 TR_XM_SEO4 1942 1.78 3.99 0.70 162 TR_MetaPhish_Combo_01 1866 0.65 0.59 0.67 163 DKIM_ADSP_CUSTOM_MED 1853 0.74 0.89 0.67 164 TVD_RCVD_IP 1845 0.72 0.84 0.67 165 XM_ShortIntro_01 1841 0.60 0.47 0.66 166 TR_XM_Base64_M1 1832 0.87 1.31 0.66 167 HTTPS_HTTP_MISMATCH 1795 0.91 1.43 0.65 168 XMBdyGiftCard01 1735 0.76 1.04 0.63 169 XMBody_95 1719 0.47 0.15 0.62 170 XMSubMetaSxObfu_03 1713 0.70 0.87 0.62 171 HTML_IMAGE_ONLY_32 1710 0.48 0.19 0.62 172 RCVD_IN_PBL 1667 0.66 0.78 0.60 173 XMSubMetaI_00 1660 0.81 1.24 0.60 174 XMBody_17 1655 1.43 3.13 0.60 175 RELAYCOUNTRY_AU 1655 1.27 2.64 0.60 176 RCVD_IN_BL_SPAMCOP_NET 1573 3.34 9.05 0.57 177 XM_B_Phish66 1550 0.76 1.18 0.56 178 T_Symld_Words_02 1549 0.62 0.75 0.56 179 XMLngstWrd_00 1528 0.81 1.36 0.55 180 XMNoVowels 1482 0.49 0.38 0.54 181 XM_ProductURIs 1475 0.73 1.12 0.53 182 USER_IN_WHITELIST 1451 0.35 0.00 0.52 183 USER_IN_WELCOMELIST 1451 0.35 0.00 0.52 184 T_OBFU_PDF_ATTACH 1446 0.37 0.06 0.52 185 PLING_QUERY 1431 0.71 1.10 0.52 186 XMClaimOffer 1426 0.48 0.40 0.51 187 XMPhish30 1411 0.78 1.34 0.51 188 XMGenDplmaNmb 1411 0.71 1.12 0.51 189 XM_URI_RBL 1380 1.13 2.42 0.50 190 NML_ADSP_CUSTOM_MED 1368 0.55 0.66 0.49 191 SpammyFromTLD_02 1331 0.77 1.37 0.48 192 XMMoneyMeta_00 1298 0.55 0.71 0.47 193 FILL_THIS_FORM 1289 0.46 0.44 0.47 194 XMPhish14 1184 0.84 1.67 0.43 195 TM2_M_BODY_EMPTY 1161 0.30 0.05 0.42 196 NUMERIC_HTTP_ADDR 1147 0.34 0.19 0.41 197 HTML_IMAGE_ONLY_20 1124 0.50 0.70 0.41 198 XMOemUri 1087 0.32 0.18 0.39 199 MSGID_FROM_MTA_HEADER 1067 0.28 0.07 0.39 200 LongTLD 1058 0.53 0.84 0.38 ----------------------------------------------------------------------