Email: 488218 Autolearn: 0 AvgScore: 4.81 AvgScanTime: 1.32 sec Spam: 154576 Autolearn: 0 AvgScore: 14.89 AvgScanTime: 1.45 sec Ham: 333642 Autolearn: 0 AvgScore: 0.14 AvgScanTime: 1.26 sec Time Spent Running SA: 178.88 hours Time Spent Processing Spam: 62.47 hours Time Spent Processing Ham: 116.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144052 89.61 93.19 87.95 2 DKIM_SIGNED 135060 78.15 87.37 73.87 3 XM_DK_Pass 128872 75.98 83.37 72.55 4 RELAYCOUNTRY_US 128126 80.56 82.89 79.49 5 XM_B_Unicode 127060 74.42 82.20 70.82 6 DKIM_VALID 126693 74.75 81.96 71.41 7 DCC_CHECK 116564 49.34 75.41 37.26 8 XM_B_SpammyWords 107616 52.37 69.62 44.38 9 XMListUnsubscribeExists 106306 53.40 68.77 46.27 10 DKIM_VALID_AU 100276 59.19 64.87 56.56 11 LOC_TINY_FONT_1 76904 32.79 49.75 24.93 12 XM_B_Unicode3 75261 42.54 48.69 39.70 13 BAYES_50 64951 55.47 42.02 61.70 14 XM_B_SpammyWords2 62755 25.23 40.60 18.12 15 HTML_FONT_LOW_CONTRAST 57794 29.62 37.39 26.02 16 XM_DK_Undo_02 57443 14.55 37.16 4.08 17 RCVD_IN_MSPIKE_H2 55074 34.00 35.63 33.24 18 FVGT_m_MULTI_ODD 50471 26.81 32.65 24.10 19 T_KAM_HTML_FONT_INVALID 48748 23.81 31.54 20.23 20 BAYES_99 46974 11.64 30.39 2.95 21 TR_XM_DKIM_Undo 40188 9.33 26.00 1.61 22 DKIM_VALID_EF 40041 28.10 25.90 29.12 23 MIME_HTML_ONLY 39843 21.36 25.78 19.32 24 XMSubLong 37567 22.94 24.30 22.32 25 BAYES_999 36874 9.03 23.85 2.16 26 DCC_CHECK_NEGATIVE 35158 50.04 22.74 62.69 27 T_TM2_M_HEADER_IN_MSG 34915 28.54 22.59 31.30 28 XM_Multi_Part_URI 34493 15.74 22.31 12.69 29 TR_DCC_Bayes_99 33676 7.56 21.79 0.97 30 TR_XM_DK_Unsub 27530 13.87 17.81 12.04 31 XM_B_Unsub 27040 11.82 17.49 9.19 32 TR_XM_BayesUnsub 26278 10.11 17.00 6.92 33 UNPARSEABLE_RELAY 25690 12.86 16.62 11.11 34 RELAYCOUNTRY_META 24507 7.75 15.85 4.00 35 XM_B_SpammyWords3 23251 7.66 15.04 4.25 36 TR_MAX_INTL_RELAY 21928 8.27 14.19 5.52 37 LOTS_OF_MONEY 19108 8.92 12.36 7.33 38 TR_XM_SpammyRelay 18885 5.28 12.22 2.07 39 TR_XM_SpammyWords4 17035 5.96 11.02 3.62 40 BOTNET_IPINHOSTNAME 17002 5.48 11.00 2.93 41 TR_XM_SpammyWords2 16407 3.56 10.61 0.30 42 XM_Evil_Numbers_Gen 15805 9.11 10.22 8.60 43 FSL_BULK_SIG 15250 7.75 9.87 6.77 44 BOTNET 14233 3.73 9.21 1.20 45 BAYES_80 13629 5.16 8.82 3.46 46 LotsOfNums_01 13541 8.44 8.76 8.30 47 TR_XM_UnparsRelay 13447 3.67 8.70 1.33 48 BAYES_60 13190 8.41 8.53 8.35 49 XM_Body_Dirty_Words 13097 4.44 8.47 2.58 50 XM_B_Phish_Phrases 12955 6.22 8.38 5.23 51 RCVD_IN_BL_SPAMCOP_NET 10646 2.60 6.89 0.62 52 XMSubMetaSx_00 10222 4.66 6.61 3.75 53 HTML_IMAGE_RATIO_02 10039 5.05 6.49 4.39 54 XM_UncommonTLD01 9854 4.78 6.37 4.04 55 XM_B_PhoneNumber 9635 9.05 6.23 10.36 56 MPART_ALT_DIFF 9185 4.88 5.94 4.39 57 UNTRUSTED_Relay 9130 2.98 5.91 1.63 58 XM_H_Long_From01 8593 5.32 5.56 5.21 59 TR_XM_SPAMCOP 8536 1.98 5.52 0.34 60 DKIM_INVALID 8367 3.40 5.41 2.46 61 BAYES_95 7843 3.02 5.07 2.06 62 RELAYCOUNTRY_CA 7815 2.42 5.06 1.19 63 XM_H_GMP 7562 5.34 4.89 5.55 64 TooManyTo_001 7508 8.14 4.86 9.66 65 XM_B_SpammyTLD 7448 2.88 4.82 1.98 66 HTML_IMAGE_RATIO_04 7394 4.09 4.78 3.77 67 XM_B_Investor 7042 2.64 4.56 1.76 68 T_XMDrugObfuBody_14 6837 2.58 4.42 1.72 69 TR_XM_PhishingBody 6813 2.93 4.41 2.24 70 XMSexyCombo_05 6790 2.33 4.39 1.38 71 XMStrtUSub 6751 4.63 4.37 4.74 72 HTML_IMAGE_RATIO_06 6526 3.55 4.22 3.23 73 TM2_M_VERY_LONG_WORD 6272 2.25 4.06 1.41 74 MIME_HTML_ONLY_MULTI 6242 3.21 4.04 2.83 75 TR_XM_SpammyWords5 6230 2.19 4.03 1.34 76 RCVD_IN_VALIDITY_RPBL 5589 1.23 3.62 0.12 77 XMNumbers 5467 2.98 3.54 2.72 78 MIME_QP_LONG_LINE 5277 5.39 3.41 6.31 79 TM2_M_URI_OPT_OUT 5214 2.95 3.37 2.75 80 TR_XM_NoHeaderRelay 5106 1.23 3.30 0.27 81 HTML_IMAGE_RATIO_08 5050 2.68 3.27 2.41 82 XM_OfRef6 4995 1.65 3.23 0.92 83 RCVD_IN_MSPIKE_H3 4985 4.88 3.22 5.64 84 RCVD_IN_MSPIKE_WL 4985 4.88 3.22 5.64 85 XM_SPF_SoftFail 4767 2.10 3.08 1.64 86 MIME_HTML_MOSTLY 4646 2.26 3.01 1.91 87 XM_CamelCaseFrm001 4568 2.32 2.96 2.03 88 XMBody_17 4489 1.17 2.90 0.36 89 XM_UB50 4479 1.60 2.90 1.00 90 ALL_TRUSTED 4369 12.63 2.83 17.17 91 XMDiploma_00 4148 2.90 2.68 2.99 92 RELAYCOUNTRY_AU 4127 1.32 2.67 0.70 93 XM_URI_RBL 4112 1.05 2.66 0.30 94 XM_B_SpammyWords4 4108 1.28 2.66 0.64 95 T_XMDrugObfuBody_08 3984 1.81 2.58 1.45 96 T_XMHurry_00 3964 1.15 2.56 0.50 97 XM_B_Unsub2 3895 1.64 2.52 1.23 98 MAILING_LIST_MULTI 3592 2.84 2.32 3.07 99 RCVD_IN_VALIDITY_SAFE 3479 3.50 2.25 4.08 100 XM_B_URI_Unicode 3457 2.43 2.24 2.52 101 XMStockSpam_06 3446 1.25 2.23 0.80 102 T_TooManySym_01 3371 4.64 2.18 5.78 103 FROM_EXCESS_BASE64 3368 1.86 2.18 1.71 104 SUSP_UTF8_WORD_SUBJ 3357 0.70 2.17 0.02 105 T_XMDrugObfuBody_00 3255 1.11 2.11 0.65 106 SpammyFromTLD_01 3187 1.24 2.06 0.86 107 SpammyFromTLD_02 3123 0.81 2.02 0.24 108 SUBJ_ALL_CAPS 3109 1.61 2.01 1.43 109 DKIM_ADSP_NXDOMAIN 3061 0.81 1.98 0.27 110 BOTNET_NORDNS 3060 0.64 1.98 0.02 111 SUSP_UTF8_WORD_COMBO 3050 0.66 1.97 0.05 112 XM_H_Long_From02 3005 1.36 1.94 1.09 113 XMBody_78 2999 0.82 1.94 0.31 114 RELAYCOUNTRY_FR 2946 0.80 1.91 0.28 115 HTML_MIME_NO_HTML_TAG 2943 2.25 1.90 2.41 116 USER_IN_DEF_DKIM_WL 2908 8.53 1.88 11.62 117 XM_DK_Undo_01 2883 1.69 1.87 1.61 118 URI_HEX 2847 1.36 1.84 1.14 119 TR_Mismatch_TLD_02 2814 0.64 1.82 0.09 120 SHORTCIRCUIT 2780 0.57 1.80 0.00 121 RCVD_IN_ZEN_LASTEXTERNAL 2780 0.57 1.80 0.00 122 XMSubMetaI_00 2743 1.32 1.77 1.11 123 XM_B_SEO 2724 0.76 1.76 0.29 124 NO_DNS_FOR_FROM 2672 0.77 1.73 0.33 125 TR_XM_MaxWHORU 2652 0.74 1.72 0.28 126 XMBrknScrpt_02 2548 1.12 1.65 0.87 127 TR_XM_INV_DKIM 2389 0.53 1.55 0.06 128 XM_B_COPY_HTML 2338 1.06 1.51 0.86 129 XMGenDplmaNmb 2324 2.07 1.50 2.34 130 RCVD_IN_VALIDITY_CERTIFIED 2322 2.46 1.50 2.91 131 T_FILL_THIS_FORM_SHORT 2321 1.17 1.50 1.02 132 XM_B_Phish66 2303 0.80 1.49 0.48 133 TR_XM_SEO4 2254 0.57 1.46 0.15 134 XM_SendGrid 2203 1.47 1.43 1.49 135 BAYES_40 2195 3.91 1.42 5.06 136 XM_B_COVIDMETA 2191 0.61 1.42 0.23 137 KHOP_HELO_FCRDNS 2107 1.44 1.36 1.47 138 XMReplyNow 2107 0.66 1.36 0.33 139 DKIM_ADSP_CUSTOM_MED 2092 1.11 1.35 0.99 140 TM2_M_BODY_EMPTY 2077 0.71 1.34 0.41 141 T_REMOTE_IMAGE 2070 3.26 1.34 4.15 142 RCVD_IN_XBL 2068 0.45 1.34 0.04 143 DIET_1 2038 0.69 1.32 0.40 144 XMPhish30 2027 0.91 1.31 0.72 145 XMEmptyBody_01 1992 0.46 1.29 0.08 146 RCVD_IN_IADB_LISTED 1958 3.15 1.27 4.03 147 LongTLD 1955 0.70 1.26 0.44 148 THIS_AD 1908 0.74 1.23 0.51 149 XMHTML_After_End 1884 1.58 1.22 1.75 150 HTTPS_HTTP_MISMATCH 1871 1.25 1.21 1.27 151 URI_NOVOWEL 1867 1.37 1.21 1.45 152 TR_Symld_Words 1862 1.49 1.20 1.62 153 TR_XM_PHPDW 1849 0.59 1.20 0.31 154 TR_XM_PHPForged 1848 0.59 1.20 0.31 155 XMBdyGiftCard01 1801 0.73 1.17 0.53 156 TR_XM_FormFill2 1801 0.58 1.17 0.31 157 TR_XM_Base64_M1 1784 0.77 1.15 0.60 158 XM_H_PHPOS 1768 0.57 1.14 0.30 159 RCVD_IN_IADB_SPF 1743 2.77 1.13 3.53 160 XM_B_REG_HTML 1685 0.48 1.09 0.19 161 RCVD_IN_IADB_SENDERID 1657 2.51 1.07 3.17 162 RCVD_IN_SORBS_DUL 1654 0.37 1.07 0.05 163 RCVD_IN_IADB_DK 1650 2.43 1.07 3.07 164 XM_ProductURIs 1648 0.89 1.07 0.81 165 XMSexyCombo_01 1639 0.43 1.06 0.14 166 NML_ADSP_CUSTOM_MED 1608 0.83 1.04 0.73 167 HTML_TAG_BALANCE_BODY 1574 0.71 1.02 0.57 168 XM_OfRef7 1571 0.43 1.02 0.16 169 XM_H_Undi_Recip 1554 0.47 1.01 0.22 170 XMMoneyMeta_00 1541 0.70 1.00 0.56 171 FORGED_GMAIL_RCVD 1536 0.75 0.99 0.64 172 URI_TRY_3LD 1534 0.72 0.99 0.59 173 XM_DIRTYINTL 1504 0.37 0.97 0.09 174 TM2_M_A_HREF_HREF 1495 0.44 0.97 0.19 175 TR_LOTS_OF_MONEY2 1483 0.59 0.96 0.42 176 T_MONEY_PERCENT 1483 0.59 0.96 0.42 177 TR_XM_RelayPhish 1482 0.36 0.96 0.09 178 XMPhish14 1443 0.78 0.93 0.71 179 RCVD_IN_PBL 1438 0.78 0.93 0.71 180 URIBL_BLACK 1425 0.33 0.92 0.05 181 RDNS_DYNAMIC 1420 0.53 0.92 0.34 182 BOUNCE_MESSAGE 1419 2.62 0.92 3.42 183 ANY_BOUNCE_MESSAGE 1419 2.62 0.92 3.42 184 XMSlimDrugH 1419 0.71 0.92 0.61 185 TVD_RCVD_IP 1415 0.81 0.92 0.76 186 TR_LOTS_OF_MONEY3 1411 0.42 0.91 0.20 187 RELAYCOUNTRY_RU 1402 0.30 0.91 0.02 188 BAYES_20 1399 2.66 0.91 3.48 189 MISSING_HEADERS 1393 0.62 0.90 0.50 190 MPART_ALT_DIFF_COUNT 1392 0.63 0.90 0.51 191 PDS_RDNS_DYNAMIC_FP 1381 0.42 0.89 0.21 192 FROM_SUSPICIOUS_NTLD 1351 0.31 0.87 0.04 193 RCVD_IN_PSBL 1351 0.38 0.87 0.15 194 DEAR_FRIEND 1351 0.30 0.87 0.04 195 SHOPIFY_IMG_NOT_RCVD_SFY 1305 0.49 0.84 0.32 196 XMSubMetaSxObfu_02 1303 0.42 0.84 0.23 197 XMSubMetaSxObfu_03 1290 0.63 0.83 0.53 198 XM_UB99 1278 0.26 0.83 0.00 199 XM_UB80 1275 0.27 0.82 0.01 200 FROM_SUSPICIOUS_NTLD_FP 1270 0.28 0.82 0.02 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 293430 89.61 93.19 87.95 2 RELAYCOUNTRY_US 265205 80.56 82.89 79.49 3 DKIM_SIGNED 246461 78.15 87.37 73.87 4 XM_DK_Pass 242072 75.98 83.37 72.55 5 DKIM_VALID 238248 74.75 81.96 71.41 6 XM_B_Unicode 236287 74.42 82.20 70.82 7 DCC_CHECK_NEGATIVE 209165 50.04 22.74 62.69 8 BAYES_50 205855 55.47 42.02 61.70 9 DKIM_VALID_AU 188708 59.19 64.87 56.56 10 XMListUnsubscribeExists 154390 53.40 68.77 46.27 11 XM_B_SpammyWords 148060 52.37 69.62 44.38 12 XM_B_Unicode3 132451 42.54 48.69 39.70 13 DCC_CHECK 124314 49.34 75.41 37.26 14 RCVD_IN_MSPIKE_H2 110913 34.00 35.63 33.24 15 T_TM2_M_HEADER_IN_MSG 104417 28.54 22.59 31.30 16 DKIM_VALID_EF 97145 28.10 25.90 29.12 17 HTML_FONT_LOW_CONTRAST 86814 29.62 37.39 26.02 18 LOC_TINY_FONT_1 83177 32.79 49.75 24.93 19 FVGT_m_MULTI_ODD 80414 26.81 32.65 24.10 20 XMSubLong 74453 22.94 24.30 22.32 21 T_KAM_HTML_FONT_INVALID 67505 23.81 31.54 20.23 22 MIME_HTML_ONLY 64460 21.36 25.78 19.32 23 XM_B_SpammyWords2 60446 25.23 40.60 18.12 24 ALL_TRUSTED 57282 12.63 2.83 17.17 25 XM_Multi_Part_URI 42348 15.74 22.31 12.69 26 TR_XM_DK_Unsub 40165 13.87 17.81 12.04 27 USER_IN_DEF_DKIM_WL 38758 8.53 1.88 11.62 28 UNPARSEABLE_RELAY 37079 12.86 16.62 11.11 29 BAYES_00 35959 7.55 0.60 10.78 30 XM_B_PhoneNumber 34561 9.05 6.23 10.36 31 TooManyTo_001 32225 8.14 4.86 9.66 32 XM_B_Unsub 30646 11.82 17.49 9.19 33 XM_Evil_Numbers_Gen 28683 9.11 10.22 8.60 34 BAYES_60 27863 8.41 8.53 8.35 35 LotsOfNums_01 27686 8.44 8.76 8.30 36 LOTS_OF_MONEY 24458 8.92 12.36 7.33 37 TR_XM_BayesUnsub 23076 10.11 17.00 6.92 38 XM_DKIMWhitelistDomains 22725 4.67 0.05 6.81 39 FSL_BULK_SIG 22574 7.75 9.87 6.77 40 IN_ZIMBRA_NJ_WHITELIST 22394 4.62 0.12 6.71 41 TR_XM_DK_Bayes 21581 4.56 0.44 6.47 42 TR_XM_DK_Bayes1 21186 4.48 0.43 6.35 43 MIME_QP_LONG_LINE 21051 5.39 3.41 6.31 44 T_TooManySym_01 19298 4.64 2.18 5.78 45 RCVD_IN_MSPIKE_WL 18826 4.88 3.22 5.64 46 RCVD_IN_MSPIKE_H3 18826 4.88 3.22 5.64 47 XM_H_GMP 18520 5.34 4.89 5.55 48 TR_XM_DK_Bayes2 18508 3.89 0.32 5.55 49 TR_MAX_INTL_RELAY 18431 8.27 14.19 5.52 50 XM_B_Phish_Phrases 17436 6.22 8.38 5.23 51 XM_H_Long_From01 17381 5.32 5.56 5.21 52 BAYES_40 16884 3.91 1.42 5.06 53 XMStrtUSub 15830 4.63 4.37 4.74 54 XM_PDF 15538 3.40 0.69 4.66 55 MPART_ALT_DIFF 14639 4.88 5.94 4.39 56 HTML_IMAGE_RATIO_02 14632 5.05 6.49 4.39 57 XM_B_SpammyWords3 14167 7.66 15.04 4.25 58 T_REMOTE_IMAGE 13858 3.26 1.34 4.15 59 RCVD_IN_VALIDITY_SAFE 13615 3.50 2.25 4.08 60 XM_DK_Undo_02 13598 14.55 37.16 4.08 61 XM_UncommonTLD01 13488 4.78 6.37 4.04 62 RCVD_IN_IADB_LISTED 13439 3.15 1.27 4.03 63 RELAYCOUNTRY_META 13331 7.75 15.85 4.00 64 HTML_IMAGE_RATIO_04 12578 4.09 4.78 3.77 65 XMSubMetaSx_00 12508 4.66 6.61 3.75 66 TR_XM_SpammyWords4 12086 5.96 11.02 3.62 67 RCVD_IN_IADB_SPF 11787 2.77 1.13 3.53 68 BAYES_20 11599 2.66 0.91 3.48 69 BAYES_80 11540 5.16 8.82 3.46 70 ANY_BOUNCE_MESSAGE 11394 2.62 0.92 3.42 71 BOUNCE_MESSAGE 11394 2.62 0.92 3.42 72 HTML_IMAGE_RATIO_06 10784 3.55 4.22 3.23 73 RCVD_IN_IADB_SENDERID 10589 2.51 1.07 3.17 74 TooManyTo_002 10282 2.36 0.80 3.08 75 MAILING_LIST_MULTI 10254 2.84 2.32 3.07 76 RCVD_IN_IADB_DK 10234 2.43 1.07 3.07 77 XMDiploma_00 9987 2.90 2.68 2.99 78 BAYES_99 9843 11.64 30.39 2.95 79 BOTNET_IPINHOSTNAME 9775 5.48 11.00 2.93 80 RCVD_IN_VALIDITY_CERTIFIED 9696 2.46 1.50 2.91 81 T_TooManySym_02 9457 2.14 0.64 2.83 82 MIME_HTML_ONLY_MULTI 9445 3.21 4.04 2.83 83 TM2_M_URI_OPT_OUT 9188 2.95 3.37 2.75 84 XMNumbers 9064 2.98 3.54 2.72 85 RCVD_IN_IADB_VOUCHED 8851 1.99 0.56 2.65 86 XM_Body_Dirty_Words 8597 4.44 8.47 2.58 87 XM_B_URI_Unicode 8410 2.43 2.24 2.52 88 DKIM_INVALID 8213 3.40 5.41 2.46 89 HTML_IMAGE_RATIO_08 8041 2.68 3.27 2.41 90 HTML_MIME_NO_HTML_TAG 8032 2.25 1.90 2.41 91 XMGenDplmaNmb 7800 2.07 1.50 2.34 92 INVALID_MSGID 7685 1.69 0.38 2.30 93 TR_XM_PhishingBody 7483 2.93 4.41 2.24 94 BAYES_05 7213 1.62 0.45 2.16 95 BAYES_999 7209 9.03 23.85 2.16 96 TR_XM_SpammyRelay 6900 5.28 12.22 2.07 97 BAYES_95 6884 3.02 5.07 2.06 98 XM_CamelCaseFrm001 6777 2.32 2.96 2.03 99 XM_B_SpammyTLD 6595 2.88 4.82 1.98 100 MIME_HTML_MOSTLY 6383 2.26 3.01 1.91 101 TO_MALFORMED 6218 1.28 0.01 1.86 102 RCVD_IN_IADB_OPTIN 6124 1.36 0.32 1.84 103 XM_B_Investor 5865 2.64 4.56 1.76 104 XMHTML_After_End 5843 1.58 1.22 1.75 105 TooManyTo_003 5809 1.42 0.72 1.74 106 T_XMDrugObfuBody_14 5747 2.58 4.42 1.72 107 FROM_EXCESS_BASE64 5713 1.86 2.18 1.71 108 XM_SPF_SoftFail 5476 2.10 3.08 1.64 109 UNTRUSTED_Relay 5428 2.98 5.91 1.63 110 TR_Symld_Words 5406 1.49 1.20 1.62 111 XM_DK_Undo_01 5361 1.69 1.87 1.61 112 TR_XM_DKIM_Undo 5361 9.33 26.00 1.61 113 XM_SendGrid 4956 1.47 1.43 1.49 114 KHOP_HELO_FCRDNS 4905 1.44 1.36 1.47 115 URI_NOVOWEL 4838 1.37 1.21 1.45 116 T_XMDrugObfuBody_08 4834 1.81 2.58 1.45 117 SUBJ_ALL_CAPS 4761 1.61 2.01 1.43 118 TM2_M_VERY_LONG_WORD 4719 2.25 4.06 1.41 119 IN_HORDE_ADDRESS_BOOK 4690 1.02 0.18 1.41 120 XMSexyCombo_05 4606 2.33 4.39 1.38 121 HELO_NODOT 4525 1.02 0.31 1.36 122 HELO_NO_DOMAIN 4515 1.02 0.31 1.35 123 TR_XM_SpammyWords5 4480 2.19 4.03 1.34 124 TR_XM_UnparsRelay 4452 3.67 8.70 1.33 125 TooManyTo_004 4412 1.12 0.67 1.32 126 XMCapTrack 4358 1.06 0.52 1.31 127 HTTPS_HTTP_MISMATCH 4232 1.25 1.21 1.27 128 XM_B_Unsub2 4114 1.64 2.52 1.23 129 BOTNET 3995 3.73 9.21 1.20 130 RELAYCOUNTRY_CA 3983 2.42 5.06 1.19 131 TVD_SPACE_RATIO 3917 0.85 0.15 1.17 132 XM_GoogleGroups 3901 1.01 0.66 1.17 133 URI_HEX 3812 1.36 1.84 1.14 134 XMSubMetaI_00 3720 1.32 1.77 1.11 135 TooManyTo_005 3692 0.96 0.63 1.11 136 XM_H_Long_From02 3625 1.36 1.94 1.09 137 XMGappySubj_01 3487 0.77 0.16 1.05 138 T_FILL_THIS_FORM_SHORT 3408 1.17 1.50 1.02 139 XM_UB50 3343 1.60 2.90 1.00 140 DKIM_ADSP_CUSTOM_MED 3308 1.11 1.35 0.99 141 T_TooManySym_03 3277 0.73 0.18 0.98 142 TR_DCC_Bayes_99 3222 7.56 21.79 0.97 143 TR_XM_DK_SendGrid 3190 0.91 0.80 0.96 144 XM_OfRef6 3065 1.65 3.23 0.92 145 XMBrknScrpt_02 2916 1.12 1.65 0.87 146 XM_H_Trusted_IP 2888 0.59 0.00 0.87 147 SpammyFromTLD_01 2878 1.24 2.06 0.86 148 XM_B_COPY_HTML 2860 1.06 1.51 0.86 149 XM_ShortIntro_01 2809 0.73 0.49 0.84 150 XM_ProductURIs 2715 0.89 1.07 0.81 151 XMStockSpam_06 2661 1.25 2.23 0.80 152 TVD_RCVD_IP 2536 0.81 0.92 0.76 153 XMNoVowels 2524 0.71 0.60 0.76 154 XMBody_95 2494 0.62 0.34 0.75 155 XMSubNoVowel 2468 0.71 0.66 0.74 156 FROM_GOV_DKIM_AU 2449 0.54 0.13 0.73 157 NML_ADSP_CUSTOM_MED 2435 0.83 1.04 0.73 158 XMPhish30 2399 0.91 1.31 0.72 159 XM_B_FormFill 2370 0.49 0.02 0.71 160 RCVD_IN_PBL 2368 0.78 0.93 0.71 161 XMPhish14 2365 0.78 0.93 0.71 162 TR_MetaPhish_Combo_01 2341 0.68 0.63 0.70 163 RELAYCOUNTRY_AU 2330 1.32 2.67 0.70 164 XMGappySubj_02 2192 0.47 0.07 0.66 165 XMLngstWrd_00 2165 0.56 0.37 0.65 166 T_XMDrugObfuBody_00 2152 1.11 2.11 0.65 167 XM_B_SpammyWords4 2144 1.28 2.66 0.64 168 FORGED_GMAIL_RCVD 2144 0.75 0.99 0.64 169 RCVD_IN_BL_SPAMCOP_NET 2064 2.60 6.89 0.62 170 XM_H_PHPMailer 2051 0.62 0.64 0.61 171 XMSlimDrugH 2037 0.71 0.92 0.61 172 TR_XM_Base64_M1 1996 0.77 1.15 0.60 173 URI_TRY_3LD 1982 0.72 0.99 0.59 174 T_OBFU_PDF_ATTACH 1971 0.44 0.12 0.59 175 HTML_TAG_BALANCE_BODY 1915 0.71 1.02 0.57 176 XMMoneyMeta_00 1855 0.70 1.00 0.56 177 XMBdyGiftCard01 1778 0.73 1.17 0.53 178 XMSubMetaSxObfu_03 1772 0.63 0.83 0.53 179 HTML_IMAGE_ONLY_32 1721 0.42 0.22 0.52 180 MPART_ALT_DIFF_COUNT 1692 0.63 0.90 0.51 181 THIS_AD 1687 0.74 1.23 0.51 182 T_XMHurry_00 1669 1.15 2.56 0.50 183 MIME_CHARSET_FARAWAY 1663 0.55 0.66 0.50 184 MISSING_HEADERS 1656 0.62 0.90 0.50 185 TO_NO_BRKTS_HTML_ONLY 1614 0.41 0.25 0.48 186 XM_B_Phish66 1608 0.80 1.49 0.48 187 T_Symld_Words_02 1598 0.53 0.65 0.48 188 XM_B_DNDMA 1598 0.56 0.75 0.48 189 FROM_GOV_SPOOF 1593 0.37 0.13 0.48 190 MSGID_FROM_MTA_HEADER 1515 0.33 0.06 0.45 191 FILL_THIS_FORM 1511 0.51 0.63 0.45 192 XM_S_SpammyWords 1482 0.54 0.76 0.44 193 TR_XM_Spammywords 1481 0.54 0.76 0.44 194 LongTLD 1472 0.70 1.26 0.44 195 RELAYCOUNTRY_GB 1463 0.54 0.77 0.44 196 HTML_IMAGE_ONLY_28 1446 0.40 0.32 0.43 197 XMLngstWrd_01 1433 0.39 0.31 0.43 198 XMDateMe_00 1426 0.42 0.39 0.43 199 T_MONEY_PERCENT 1410 0.59 0.96 0.42 200 TR_LOTS_OF_MONEY2 1410 0.59 0.96 0.42 ----------------------------------------------------------------------