Email: 494440 Autolearn: 0 AvgScore: 4.44 AvgScanTime: 1.42 sec Spam: 150996 Autolearn: 0 AvgScore: 14.83 AvgScanTime: 1.57 sec Ham: 343444 Autolearn: 0 AvgScore: -0.12 AvgScanTime: 1.36 sec Time Spent Running SA: 195.51 hours Time Spent Processing Spam: 66.05 hours Time Spent Processing Ham: 129.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143728 90.15 95.19 87.94 2 DKIM_SIGNED 131968 77.98 87.40 73.84 3 XM_DK_Pass 125608 75.62 83.19 72.29 4 RELAYCOUNTRY_US 124703 80.41 82.59 79.45 5 XM_B_Unicode 124006 74.62 82.13 71.32 6 DKIM_VALID 123984 74.53 82.11 71.20 7 DCC_CHECK 114861 49.90 76.07 38.40 8 XMListUnsubscribeExists 104481 53.61 69.19 46.75 9 XM_B_SpammyWords 102009 52.18 67.56 45.42 10 DKIM_VALID_AU 97492 58.96 64.57 56.50 11 LOC_TINY_FONT_1 75646 32.76 50.10 25.14 12 XM_B_Unicode3 74083 42.30 49.06 39.33 13 BAYES_50 60447 52.85 40.03 58.49 14 XM_B_SpammyWords2 59979 25.63 39.72 19.44 15 XM_DK_Undo_02 58117 14.71 38.49 4.25 16 RCVD_IN_MSPIKE_H2 56957 34.55 37.72 33.16 17 HTML_FONT_LOW_CONTRAST 56524 29.55 37.43 26.09 18 FVGT_m_MULTI_ODD 49541 26.39 32.81 23.57 19 T_KAM_HTML_FONT_INVALID 48407 24.41 32.06 21.05 20 BAYES_99 46575 11.40 30.85 2.85 21 MIME_HTML_ONLY 44172 22.53 29.25 19.58 22 DKIM_VALID_EF 42185 28.31 27.94 28.48 23 TR_XM_DKIM_Undo 40615 9.55 26.90 1.92 24 XMSubLong 36837 24.20 24.40 24.11 25 BAYES_999 35917 8.73 23.79 2.11 26 TR_DCC_Bayes_99 35182 7.82 23.30 1.01 27 XM_Multi_Part_URI 34898 15.95 23.11 12.80 28 DCC_CHECK_NEGATIVE 33520 49.54 22.20 61.56 29 T_TM2_M_HEADER_IN_MSG 32795 28.59 21.72 31.61 30 TR_XM_DK_Unsub 29991 14.24 19.86 11.77 31 UNPARSEABLE_RELAY 27336 13.54 18.10 11.53 32 XM_B_Unsub 25330 11.60 16.78 9.33 33 TR_XM_BayesUnsub 24488 9.89 16.22 7.10 34 RELAYCOUNTRY_META 23994 7.43 15.89 3.71 35 TR_MAX_INTL_RELAY 23062 8.41 15.27 5.40 36 XM_B_SpammyWords3 21679 7.26 14.36 4.14 37 TR_XM_SpammyWords2 18087 3.89 11.98 0.33 38 LOTS_OF_MONEY 17896 8.95 11.85 7.67 39 FSL_BULK_SIG 16346 8.28 10.83 7.16 40 TR_XM_SpammyWords4 16063 7.30 10.64 5.83 41 BOTNET_IPINHOSTNAME 15401 5.09 10.20 2.84 42 RCVD_IN_BL_SPAMCOP_NET 15031 3.53 9.95 0.70 43 TR_XM_SpammyRelay 14972 4.39 9.92 1.96 44 BAYES_80 14206 5.17 9.41 3.31 45 TR_XM_UnparsRelay 14080 3.95 9.32 1.59 46 BOTNET 13681 3.66 9.06 1.28 47 XM_Evil_Numbers_Gen 13569 8.13 8.99 7.75 48 XM_UncommonTLD01 12895 5.31 8.54 3.88 49 LotsOfNums_01 12840 8.20 8.50 8.06 50 XM_Body_Dirty_Words 12780 4.30 8.46 2.47 51 BAYES_60 12499 8.21 8.28 8.17 52 TR_XM_SPAMCOP 12121 2.78 8.03 0.48 53 UNTRUSTED_Relay 11987 3.56 7.94 1.64 54 XMSubMetaSx_00 11628 5.19 7.70 4.09 55 XM_B_Phish_Phrases 11227 5.66 7.44 4.88 56 HTML_IMAGE_RATIO_02 10384 5.18 6.88 4.44 57 XM_B_PhoneNumber 9439 8.75 6.25 9.85 58 XM_H_Long_From01 9087 5.52 6.02 5.29 59 MPART_ALT_DIFF 8740 4.85 5.79 4.44 60 XM_B_Investor 8420 2.89 5.58 1.71 61 BAYES_95 8253 3.12 5.47 2.08 62 DKIM_INVALID 7984 3.45 5.29 2.65 63 XM_H_GMP 7573 5.47 5.02 5.67 64 RCVD_IN_VALIDITY_RPBL 7494 1.68 4.96 0.23 65 T_XMDrugObfuBody_14 7223 2.76 4.78 1.87 66 XMStrtUSub 7085 4.31 4.69 4.14 67 RELAYCOUNTRY_CA 7083 2.12 4.69 1.00 68 XMSexyCombo_05 6900 2.37 4.57 1.41 69 HTML_IMAGE_RATIO_06 6812 3.59 4.51 3.18 70 TR_XM_PhishingBody 6528 2.50 4.32 1.69 71 XMNumbers 6397 3.23 4.24 2.79 72 HTML_IMAGE_RATIO_04 6256 3.97 4.14 3.89 73 T_REMOTE_IMAGE 6219 3.71 4.12 3.53 74 XM_B_SpammyTLD 5906 2.86 3.91 2.40 75 TR_XM_SpammyWords5 5876 2.04 3.89 1.22 76 HTML_IMAGE_RATIO_08 5783 3.35 3.83 3.13 77 RCVD_IN_MSPIKE_H3 5672 4.98 3.76 5.52 78 RCVD_IN_MSPIKE_WL 5672 4.98 3.76 5.52 79 SpammyFromTLD_02 5403 1.40 3.58 0.44 80 TM2_M_VERY_LONG_WORD 5390 2.08 3.57 1.42 81 XM_UB50 5329 1.75 3.53 0.96 82 XM_OfRef6 5276 1.73 3.49 0.95 83 TooManyTo_001 5273 6.90 3.49 8.39 84 TM2_M_URI_OPT_OUT 5109 2.21 3.38 1.69 85 XMDiploma_00 5005 2.00 3.31 1.43 86 NO_DNS_FOR_FROM 5003 1.20 3.31 0.27 87 XM_SPF_SoftFail 4976 2.08 3.30 1.55 88 TR_XM_MaxWHORU 4964 1.16 3.29 0.22 89 DKIM_ADSP_NXDOMAIN 4952 1.19 3.28 0.27 90 MIME_HTML_ONLY_MULTI 4877 2.92 3.23 2.79 91 MIME_HTML_MOSTLY 4830 2.44 3.20 2.10 92 MIME_QP_LONG_LINE 4552 4.46 3.01 5.10 93 XM_CamelCaseFrm001 4425 2.42 2.93 2.19 94 XM_URI_RBL 3998 1.06 2.65 0.36 95 HTML_SHORT_LINK_IMG_1 3986 0.91 2.64 0.14 96 HDRS_LCASE_IMGONLY 3962 0.88 2.62 0.11 97 RELAYCOUNTRY_AU 3929 1.28 2.60 0.70 98 T_XMDrugObfuBody_08 3911 1.80 2.59 1.46 99 T_TooManySym_01 3891 4.81 2.58 5.80 100 XM_B_Unsub2 3828 1.80 2.54 1.48 101 LongTLD 3735 1.05 2.47 0.42 102 MAILING_LIST_MULTI 3663 2.88 2.43 3.07 103 T_XMHurry_00 3523 1.13 2.33 0.60 104 FROM_EXCESS_BASE64 3460 1.93 2.29 1.77 105 HTML_IMAGE_ONLY_08 3420 0.88 2.26 0.27 106 XM_B_URI_Unicode 3384 2.05 2.24 1.97 107 TR_XM_NoHeaderRelay 3215 0.85 2.13 0.28 108 XM_B_SpammyWords4 3188 1.07 2.11 0.62 109 XM_DK_Undo_01 3036 1.80 2.01 1.70 110 TR_XM_INV_DKIM 2956 0.70 1.96 0.14 111 XMStockSpam_06 2726 1.06 1.81 0.73 112 BAYES_40 2712 4.45 1.80 5.61 113 RCVD_IN_VALIDITY_SAFE 2689 3.30 1.78 3.97 114 T_XMDrugObfuBody_00 2683 1.14 1.78 0.86 115 FROM_SUSPICIOUS_NTLD 2625 0.57 1.74 0.06 116 HTML_MIME_NO_HTML_TAG 2619 2.05 1.73 2.19 117 URI_HEX 2576 1.30 1.71 1.13 118 XMGenDplmaNmb 2572 1.09 1.70 0.82 119 RCVD_IN_ZEN_LASTEXTERNAL 2568 0.52 1.70 0.00 120 SHORTCIRCUIT 2568 0.52 1.70 0.00 121 SUBJ_ALL_CAPS 2537 1.37 1.68 1.23 122 HTTPS_HTTP_MISMATCH 2496 1.17 1.65 0.96 123 SpammyFromTLD_01 2473 1.08 1.64 0.84 124 XM_H_Long_From02 2461 1.07 1.63 0.83 125 ALL_TRUSTED 2401 12.54 1.59 17.36 126 BODY_URI_ONLY 2347 0.48 1.55 0.01 127 RELAYCOUNTRY_TH 2284 0.48 1.51 0.03 128 XM_SendGrid 2268 1.46 1.50 1.45 129 XMHTML_After_End 2190 0.66 1.45 0.31 130 XMBody_17 2178 0.64 1.44 0.28 131 T_MONEY_PERCENT 2172 0.63 1.44 0.28 132 TR_LOTS_OF_MONEY2 2172 0.63 1.44 0.28 133 USER_IN_DEF_DKIM_WL 2147 9.04 1.42 12.38 134 T_FILL_THIS_FORM_SHORT 2144 1.03 1.42 0.86 135 FROM_SUSPICIOUS_NTLD_FP 2122 0.45 1.41 0.02 136 T_PDS_OTHER_BAD_TLD 2119 0.59 1.40 0.24 137 RCVD_IN_VALIDITY_CERTIFIED 2040 2.41 1.35 2.87 138 XM_B_DNDMA 2015 0.67 1.33 0.38 139 RELAYCOUNTRY_FR 1997 0.57 1.32 0.23 140 XMPhish30 1996 0.75 1.32 0.50 141 PLING_QUERY 1991 0.74 1.32 0.48 142 XMPhish14 1909 0.76 1.26 0.54 143 KHOP_HELO_FCRDNS 1891 1.35 1.25 1.39 144 XM_B_COPY_HTML 1880 1.17 1.25 1.13 145 XM_DIRTYINTL 1877 0.46 1.24 0.11 146 RCVD_IN_IADB_LISTED 1862 3.15 1.23 4.00 147 XM_UB60 1858 0.41 1.23 0.05 148 URI_NOVOWEL 1854 1.40 1.23 1.48 149 TR_XM_PHPForged 1849 0.68 1.22 0.44 150 XMBrknScrpt_02 1847 1.00 1.22 0.90 151 HK_RANDOM_ENVFROM 1834 0.48 1.21 0.15 152 XM_B_SEO 1820 0.55 1.21 0.27 153 HTML_TAG_BALANCE_BODY 1815 0.75 1.20 0.55 154 TR_XM_PHPDW 1795 0.66 1.19 0.43 155 XMReplyNow 1793 0.56 1.19 0.29 156 TR_XM_FormFill2 1781 0.67 1.18 0.44 157 DKIM_ADSP_CUSTOM_MED 1777 0.99 1.18 0.91 158 T_Symld_Words_02 1769 0.84 1.17 0.70 159 XMSexyCombo_01 1763 0.48 1.17 0.17 160 XM_H_PHPOS 1755 0.65 1.16 0.43 161 DIET_1 1746 0.54 1.16 0.27 162 BAYES_20 1745 3.10 1.16 3.96 163 XM_UB99 1729 0.35 1.15 0.00 164 XMBody_78 1706 0.56 1.13 0.30 165 XMSubMetaI_00 1637 0.69 1.08 0.52 166 RCVD_IN_PBL 1632 0.84 1.08 0.73 167 SUSP_UTF8_WORD_SUBJ 1610 0.33 1.07 0.01 168 XMMoneyMeta_00 1601 0.80 1.06 0.69 169 XM_ProductURIs 1597 0.63 1.06 0.44 170 URI_TRY_3LD 1597 0.72 1.06 0.58 171 SHORT_IMG_SUSP_NTLD 1596 0.32 1.06 0.00 172 TR_XM_SEO4 1587 0.39 1.05 0.10 173 RCVD_IN_IADB_SPF 1581 2.73 1.05 3.48 174 SHOPIFY_IMG_NOT_RCVD_SFY 1552 0.48 1.03 0.24 175 TR_XM_Base64_M1 1538 0.79 1.02 0.69 176 SUSP_UTF8_WORD_COMBO 1536 0.33 1.02 0.03 177 HTML_FONT_SIZE_LARGE 1512 0.37 1.00 0.09 178 RCVD_IN_IADB_DK 1501 2.37 0.99 2.98 179 RCVD_IN_XBL 1489 0.31 0.99 0.02 180 XM_B_Phish66 1481 0.52 0.98 0.31 181 RCVD_IN_IADB_SENDERID 1468 2.43 0.97 3.08 182 TR_Mismatch_TLD_02 1465 0.34 0.97 0.06 183 XM_UB80 1458 0.30 0.97 0.01 184 TR_Symld_Words 1448 1.37 0.96 1.56 185 RELAYCOUNTRY_RU 1447 0.30 0.96 0.01 186 MIME_CHARSET_FARAWAY 1426 0.52 0.94 0.33 187 HOSTED_IMG_MULTI_PUB_01 1382 0.28 0.92 0.01 188 T_STY_INVIS_DIRECT 1355 0.49 0.90 0.31 189 BOTNET_NORDNS 1348 0.28 0.89 0.01 190 NML_ADSP_CUSTOM_MED 1347 0.70 0.89 0.62 191 RCVD_IN_SORBS_DUL 1310 0.30 0.87 0.05 192 TR_XM_RelayPhish 1289 0.30 0.85 0.06 193 XM_HighProb1 1284 0.26 0.85 0.01 194 XMSlimDrugH 1246 0.55 0.83 0.43 195 RELAYCOUNTRY_GB 1227 0.54 0.81 0.41 196 URIBL_BLACK 1198 0.31 0.79 0.10 197 XMSubMetaSxObfu_03 1197 0.46 0.79 0.32 198 XM_H_Undi_Recip 1194 0.39 0.79 0.22 199 XMNoVowels 1187 0.81 0.79 0.82 200 BOUNCE_MESSAGE 1181 2.28 0.78 2.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 302022 90.15 95.19 87.94 2 RELAYCOUNTRY_US 272876 80.41 82.59 79.45 3 DKIM_SIGNED 253615 77.98 87.40 73.84 4 XM_DK_Pass 248277 75.62 83.19 72.29 5 XM_B_Unicode 244941 74.62 82.13 71.32 6 DKIM_VALID 244517 74.53 82.11 71.20 7 DCC_CHECK_NEGATIVE 211410 49.54 22.20 61.56 8 BAYES_50 200864 52.85 40.03 58.49 9 DKIM_VALID_AU 194033 58.96 64.57 56.50 10 XMListUnsubscribeExists 160572 53.61 69.19 46.75 11 XM_B_SpammyWords 155982 52.18 67.56 45.42 12 XM_B_Unicode3 135060 42.30 49.06 39.33 13 DCC_CHECK 131884 49.90 76.07 38.40 14 RCVD_IN_MSPIKE_H2 113881 34.55 37.72 33.16 15 T_TM2_M_HEADER_IN_MSG 108570 28.59 21.72 31.61 16 DKIM_VALID_EF 97808 28.31 27.94 28.48 17 HTML_FONT_LOW_CONTRAST 89600 29.55 37.43 26.09 18 LOC_TINY_FONT_1 86357 32.76 50.10 25.14 19 XMSubLong 82802 24.20 24.40 24.11 20 FVGT_m_MULTI_ODD 80958 26.39 32.81 23.57 21 T_KAM_HTML_FONT_INVALID 72296 24.41 32.06 21.05 22 MIME_HTML_ONLY 67232 22.53 29.25 19.58 23 XM_B_SpammyWords2 66768 25.63 39.72 19.44 24 ALL_TRUSTED 59624 12.54 1.59 17.36 25 BAYES_00 45286 9.37 0.68 13.19 26 XM_Multi_Part_URI 43957 15.95 23.11 12.80 27 USER_IN_DEF_DKIM_WL 42533 9.04 1.42 12.38 28 TR_XM_DK_Unsub 40437 14.24 19.86 11.77 29 UNPARSEABLE_RELAY 39610 13.54 18.10 11.53 30 XM_B_PhoneNumber 33843 8.75 6.25 9.85 31 XM_B_Unsub 32029 11.60 16.78 9.33 32 TooManyTo_001 28829 6.90 3.49 8.39 33 BAYES_60 28071 8.21 8.28 8.17 34 LotsOfNums_01 27695 8.20 8.50 8.06 35 XM_Evil_Numbers_Gen 26618 8.13 8.99 7.75 36 LOTS_OF_MONEY 26349 8.95 11.85 7.67 37 TR_XM_DK_Bayes 25204 5.27 0.56 7.34 38 TR_XM_DK_Bayes1 24703 5.17 0.55 7.19 39 FSL_BULK_SIG 24596 8.28 10.83 7.16 40 TR_XM_BayesUnsub 24399 9.89 16.22 7.10 41 IN_ZIMBRA_NJ_WHITELIST 22616 4.60 0.08 6.59 42 XM_DKIMWhitelistDomains 21535 4.47 0.37 6.27 43 TR_XM_DK_Bayes2 20996 4.38 0.45 6.11 44 TR_XM_SpammyWords4 20023 7.30 10.64 5.83 45 T_TooManySym_01 19905 4.81 2.58 5.80 46 XM_H_GMP 19462 5.47 5.02 5.67 47 BAYES_40 19272 4.45 1.80 5.61 48 RCVD_IN_MSPIKE_WL 18955 4.98 3.76 5.52 49 RCVD_IN_MSPIKE_H3 18954 4.98 3.76 5.52 50 TR_MAX_INTL_RELAY 18534 8.41 15.27 5.40 51 XM_H_Long_From01 18183 5.52 6.02 5.29 52 MIME_QP_LONG_LINE 17516 4.46 3.01 5.10 53 XM_B_Phish_Phrases 16753 5.66 7.44 4.88 54 XM_PDF 15317 3.29 0.63 4.46 55 HTML_IMAGE_RATIO_02 15238 5.18 6.88 4.44 56 MPART_ALT_DIFF 15237 4.85 5.79 4.44 57 XM_DK_Undo_02 14601 14.71 38.49 4.25 58 XM_B_SpammyWords3 14231 7.26 14.36 4.14 59 XMStrtUSub 14204 4.31 4.69 4.14 60 XMSubMetaSx_00 14058 5.19 7.70 4.09 61 RCVD_IN_IADB_LISTED 13734 3.15 1.23 4.00 62 RCVD_IN_VALIDITY_SAFE 13631 3.30 1.78 3.97 63 BAYES_20 13595 3.10 1.16 3.96 64 HTML_IMAGE_RATIO_04 13363 3.97 4.14 3.89 65 XM_UncommonTLD01 13337 5.31 8.54 3.88 66 RELAYCOUNTRY_META 12742 7.43 15.89 3.71 67 T_REMOTE_IMAGE 12140 3.71 4.12 3.53 68 RCVD_IN_IADB_SPF 11938 2.73 1.05 3.48 69 BAYES_80 11374 5.17 9.41 3.31 70 HTML_IMAGE_RATIO_06 10936 3.59 4.51 3.18 71 HTML_IMAGE_RATIO_08 10760 3.35 3.83 3.13 72 RCVD_IN_IADB_SENDERID 10563 2.43 0.97 3.08 73 MAILING_LIST_MULTI 10556 2.88 2.43 3.07 74 RCVD_IN_IADB_DK 10233 2.37 0.99 2.98 75 BOUNCE_MESSAGE 10082 2.28 0.78 2.94 76 ANY_BOUNCE_MESSAGE 10082 2.28 0.78 2.94 77 T_TooManySym_02 10064 2.24 0.66 2.93 78 TooManyTo_002 10045 2.24 0.68 2.92 79 RCVD_IN_VALIDITY_CERTIFIED 9861 2.41 1.35 2.87 80 BAYES_99 9785 11.40 30.85 2.85 81 BOTNET_IPINHOSTNAME 9770 5.09 10.20 2.84 82 XMNumbers 9585 3.23 4.24 2.79 83 MIME_HTML_ONLY_MULTI 9582 2.92 3.23 2.79 84 RCVD_IN_IADB_VOUCHED 9240 2.07 0.67 2.69 85 DKIM_INVALID 9098 3.45 5.29 2.65 86 XM_Body_Dirty_Words 8472 4.30 8.46 2.47 87 XM_B_SpammyTLD 8252 2.86 3.91 2.40 88 BAYES_05 8010 1.81 0.63 2.33 89 XM_CamelCaseFrm001 7536 2.42 2.93 2.19 90 HTML_MIME_NO_HTML_TAG 7514 2.05 1.73 2.19 91 XM_ShortIntro_01 7416 1.65 0.49 2.16 92 INVALID_MSGID 7280 1.53 0.18 2.12 93 BAYES_999 7240 8.73 23.79 2.11 94 MIME_HTML_MOSTLY 7227 2.44 3.20 2.10 95 BAYES_95 7154 3.12 5.47 2.08 96 XM_B_URI_Unicode 6749 2.05 2.24 1.97 97 TR_XM_SpammyRelay 6715 4.39 9.92 1.96 98 TR_XM_DKIM_Undo 6588 9.55 26.90 1.92 99 RCVD_IN_IADB_OPTIN 6437 1.43 0.41 1.87 100 T_XMDrugObfuBody_14 6434 2.76 4.78 1.87 101 TO_MALFORMED 6239 1.27 0.01 1.82 102 FROM_EXCESS_BASE64 6084 1.93 2.29 1.77 103 XM_B_Investor 5859 2.89 5.58 1.71 104 XM_DK_Undo_01 5854 1.80 2.01 1.70 105 TR_XM_PhishingBody 5815 2.50 4.32 1.69 106 TM2_M_URI_OPT_OUT 5810 2.21 3.38 1.69 107 UNTRUSTED_Relay 5632 3.56 7.94 1.64 108 TR_XM_UnparsRelay 5472 3.95 9.32 1.59 109 TR_Symld_Words 5346 1.37 0.96 1.56 110 XM_SPF_SoftFail 5319 2.08 3.30 1.55 111 TooManyTo_003 5319 1.26 0.61 1.55 112 XM_B_Unsub2 5082 1.80 2.54 1.48 113 URI_NOVOWEL 5079 1.40 1.23 1.48 114 T_XMDrugObfuBody_08 5002 1.80 2.59 1.46 115 XM_SendGrid 4969 1.46 1.50 1.45 116 XMDiploma_00 4898 2.00 3.31 1.43 117 TM2_M_VERY_LONG_WORD 4870 2.08 3.57 1.42 118 XMSexyCombo_05 4837 2.37 4.57 1.41 119 IN_HORDE_ADDRESS_BOOK 4834 1.00 0.09 1.41 120 KHOP_HELO_FCRDNS 4782 1.35 1.25 1.39 121 XMGappySubj_01 4701 1.00 0.16 1.37 122 HELO_NODOT 4493 1.00 0.29 1.31 123 HELO_NO_DOMAIN 4480 0.99 0.29 1.30 124 BOTNET 4407 3.66 9.06 1.28 125 XMCapTrack 4263 1.05 0.60 1.24 126 XM_GoogleGroups 4245 1.07 0.70 1.24 127 SUBJ_ALL_CAPS 4230 1.37 1.68 1.23 128 T_TooManySym_03 4219 0.92 0.23 1.23 129 TR_XM_SpammyWords5 4190 2.04 3.89 1.22 130 TooManyTo_004 4009 0.99 0.58 1.17 131 XM_B_COPY_HTML 3889 1.17 1.25 1.13 132 URI_HEX 3872 1.30 1.71 1.13 133 TR_DCC_Bayes_99 3478 7.82 23.30 1.01 134 RELAYCOUNTRY_CA 3418 2.12 4.69 1.00 135 TVD_SPACE_RATIO 3334 0.73 0.19 0.97 136 XM_UB50 3312 1.75 3.53 0.96 137 HTTPS_HTTP_MISMATCH 3311 1.17 1.65 0.96 138 TooManyTo_005 3294 0.83 0.54 0.96 139 XM_OfRef6 3269 1.73 3.49 0.95 140 TR_XM_DK_SendGrid 3262 0.88 0.72 0.95 141 DKIM_ADSP_CUSTOM_MED 3133 0.99 1.18 0.91 142 TR_MetaPhish_Combo_01 3120 0.85 0.72 0.91 143 XMBrknScrpt_02 3089 1.00 1.22 0.90 144 XM_H_Trusted_IP 3076 0.62 0.00 0.90 145 T_XMDrugObfuBody_00 2967 1.14 1.78 0.86 146 T_FILL_THIS_FORM_SHORT 2953 1.03 1.42 0.86 147 FROM_GOV_DKIM_AU 2885 0.65 0.20 0.84 148 SpammyFromTLD_01 2878 1.08 1.64 0.84 149 XM_H_Long_From02 2850 1.07 1.63 0.83 150 XMGenDplmaNmb 2817 1.09 1.70 0.82 151 XMNoVowels 2805 0.81 0.79 0.82 152 XM_B_FormFill 2629 0.55 0.05 0.77 153 XMStockSpam_06 2521 1.06 1.81 0.73 154 RCVD_IN_PBL 2510 0.84 1.08 0.73 155 XMSubNoVowel 2508 0.63 0.40 0.73 156 RCVD_IN_BL_SPAMCOP_NET 2407 3.53 9.95 0.70 157 XMGappySubj_02 2407 0.51 0.07 0.70 158 RELAYCOUNTRY_AU 2392 1.28 2.60 0.70 159 T_Symld_Words_02 2392 0.84 1.17 0.70 160 TR_XM_Base64_M1 2379 0.79 1.02 0.69 161 XMMoneyMeta_00 2354 0.80 1.06 0.69 162 XMBody_95 2164 0.49 0.16 0.63 163 NML_ADSP_CUSTOM_MED 2129 0.70 0.89 0.62 164 XM_B_SpammyWords4 2120 1.07 2.11 0.62 165 XM_H_PHPMailer 2115 0.66 0.75 0.62 166 T_XMHurry_00 2060 1.13 2.33 0.60 167 URI_TRY_3LD 1979 0.72 1.06 0.58 168 FORGED_GMAIL_RCVD 1902 0.62 0.76 0.55 169 MISSING_HEADERS 1901 0.57 0.61 0.55 170 HTML_TAG_BALANCE_BODY 1879 0.75 1.20 0.55 171 XMBdyGiftCard01 1860 0.60 0.75 0.54 172 XMPhish14 1859 0.76 1.26 0.54 173 HTML_IMAGE_ONLY_32 1834 0.43 0.18 0.53 174 XMSubMetaI_00 1778 0.69 1.08 0.52 175 XMLngstWrd_00 1742 0.55 0.64 0.51 176 XMPhish30 1703 0.75 1.32 0.50 177 T_OBFU_PDF_ATTACH 1696 0.39 0.15 0.49 178 PLING_QUERY 1665 0.74 1.32 0.48 179 FROM_GOV_SPOOF 1650 0.37 0.13 0.48 180 TR_XM_SPAMCOP 1638 2.78 8.03 0.48 181 MSGID_FROM_MTA_HEADER 1627 0.35 0.08 0.47 182 HTML_IMAGE_ONLY_28 1594 0.41 0.27 0.46 183 MPART_ALT_DIFF_COUNT 1564 0.55 0.76 0.46 184 TM2_M_BODY_EMPTY 1557 0.35 0.12 0.45 185 TVD_RCVD_IP 1556 0.53 0.71 0.45 186 SpammyFromTLD_02 1527 1.40 3.58 0.44 187 XM_ProductURIs 1515 0.63 1.06 0.44 188 TR_XM_PHPForged 1508 0.68 1.22 0.44 189 TR_XM_FormFill2 1508 0.67 1.18 0.44 190 TR_XM_PHPDW 1489 0.66 1.19 0.43 191 XMSlimDrugH 1465 0.55 0.83 0.43 192 XM_H_PHPOS 1464 0.65 1.16 0.43 193 HTML_IMAGE_ONLY_20 1453 0.42 0.41 0.42 194 SHORT_HELO_AND_INLINE_IMAGE 1453 0.30 0.03 0.42 195 LongTLD 1446 1.05 2.47 0.42 196 SUBJ_DOLLARS 1431 0.50 0.68 0.42 197 TO_NO_BRKTS_HTML_ONLY 1429 0.36 0.22 0.42 198 RELAYCOUNTRY_GB 1425 0.54 0.81 0.41 199 FILL_THIS_FORM 1409 0.38 0.32 0.41 200 XMDateMe_00 1301 0.38 0.39 0.38 ----------------------------------------------------------------------