Email: 465156 Autolearn: 0 AvgScore: 4.66 AvgScanTime: 1.31 sec Spam: 146769 Autolearn: 0 AvgScore: 15.05 AvgScanTime: 1.42 sec Ham: 318387 Autolearn: 0 AvgScore: -0.13 AvgScanTime: 1.25 sec Time Spent Running SA: 168.70 hours Time Spent Processing Spam: 57.79 hours Time Spent Processing Ham: 110.92 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140308 90.15 95.60 87.65 2 DKIM_SIGNED 127589 79.90 86.93 76.66 3 XM_DK_Pass 121458 77.50 82.75 75.08 4 RELAYCOUNTRY_US 121089 82.24 82.50 82.12 5 DKIM_VALID 119882 76.42 81.68 74.00 6 XM_B_Unicode 119852 73.92 81.66 70.35 7 DCC_CHECK 110219 50.83 75.10 39.64 8 XM_B_SpammyWords 104582 53.36 71.26 45.12 9 XMListUnsubscribeExists 98823 53.94 67.33 47.77 10 DKIM_VALID_AU 94145 60.82 64.15 59.29 11 XM_B_Unicode3 72381 43.91 49.32 41.42 12 LOC_TINY_FONT_1 69815 33.07 47.57 26.38 13 BAYES_50 61894 55.04 42.17 60.97 14 XM_B_SpammyWords2 58674 25.03 39.98 18.15 15 RCVD_IN_MSPIKE_H2 55811 36.60 38.03 35.95 16 HTML_FONT_LOW_CONTRAST 54151 30.40 36.90 27.40 17 XM_DK_Undo_02 54079 14.57 36.85 4.30 18 FVGT_m_MULTI_ODD 47066 27.45 32.07 25.32 19 MIME_HTML_ONLY 46166 24.20 31.45 20.85 20 T_KAM_HTML_FONT_INVALID 45988 24.64 31.33 21.55 21 BAYES_99 42529 11.05 28.98 2.78 22 DKIM_VALID_EF 40761 28.96 27.77 29.51 23 TR_XM_DKIM_Undo 38165 9.43 26.00 1.78 24 XMSubLong 34046 23.14 23.20 23.11 25 DCC_CHECK_NEGATIVE 33814 48.54 23.04 60.29 26 BAYES_999 32843 8.48 22.38 2.07 27 XM_Multi_Part_URI 32039 15.97 21.83 13.28 28 TR_DCC_Bayes_99 31574 7.38 21.51 0.86 29 T_TM2_M_HEADER_IN_MSG 30711 26.52 20.92 29.10 30 XM_B_Unsub 28398 12.52 19.35 9.37 31 TR_XM_DK_Unsub 28154 14.28 19.18 12.02 32 TR_XM_BayesUnsub 27228 10.58 18.55 6.90 33 UNPARSEABLE_RELAY 24591 13.65 16.75 12.21 34 RELAYCOUNTRY_META 23686 7.75 16.14 3.88 35 TR_MAX_INTL_RELAY 21248 8.19 14.48 5.29 36 XM_B_SpammyWords3 20272 7.13 13.81 4.05 37 TR_XM_SpammyRelay 18008 5.34 12.27 2.14 38 LOTS_OF_MONEY 16712 7.58 11.39 5.82 39 FSL_BULK_SIG 15859 9.13 10.81 8.35 40 BOTNET_IPINHOSTNAME 15665 5.51 10.67 3.13 41 TR_XM_SpammyWords2 15623 3.53 10.64 0.25 42 TR_XM_SpammyWords4 14866 5.85 10.13 3.87 43 BOTNET 14658 4.17 9.99 1.48 44 XM_Evil_Numbers_Gen 14447 9.23 9.84 8.94 45 BAYES_80 13270 5.08 9.04 3.26 46 RCVD_IN_BL_SPAMCOP_NET 12795 3.19 8.72 0.64 47 TR_XM_UnparsRelay 12621 3.73 8.60 1.49 48 XM_B_Phish_Phrases 12534 6.53 8.54 5.60 49 XM_Body_Dirty_Words 12141 4.56 8.27 2.85 50 BAYES_60 12138 6.98 8.27 6.39 51 XM_UncommonTLD01 12006 5.44 8.18 4.18 52 LotsOfNums_01 11507 8.14 7.84 8.28 53 UNTRUSTED_Relay 10834 3.35 7.38 1.50 54 HTML_IMAGE_RATIO_02 9944 5.21 6.78 4.48 55 XMSubMetaSx_00 9679 4.79 6.59 3.96 56 TR_XM_SPAMCOP 9591 2.35 6.53 0.41 57 XM_B_PhoneNumber 8976 9.04 6.12 10.39 58 MPART_ALT_DIFF 8486 4.57 5.78 4.01 59 XM_H_Long_From01 8022 5.61 5.47 5.68 60 XM_SPF_SoftFail 7918 2.83 5.39 1.64 61 DKIM_INVALID 7707 3.48 5.25 2.66 62 RELAYCOUNTRY_CA 7691 2.52 5.24 1.26 63 XMStrtUSub 7609 5.39 5.18 5.48 64 BAYES_95 7318 2.96 4.99 2.02 65 TR_XM_PhishingBody 7078 2.80 4.82 1.86 66 XMSexyCombo_05 7053 2.65 4.81 1.65 67 XM_H_GMP 7008 5.35 4.77 5.62 68 HTML_IMAGE_RATIO_04 6534 4.29 4.45 4.21 69 T_XMDrugObfuBody_14 6408 2.55 4.37 1.71 70 RCVD_IN_VALIDITY_RPBL 6324 1.42 4.31 0.09 71 SpammyFromTLD_02 6175 1.63 4.21 0.44 72 XM_B_Investor 5992 2.46 4.08 1.71 73 XM_B_SpammyTLD 5966 3.07 4.06 2.61 74 XMNoVowels 5824 2.89 3.97 2.39 75 XM_UB50 5537 1.83 3.77 0.94 76 RCVD_IN_MSPIKE_H3 5533 4.90 3.77 5.42 77 RCVD_IN_MSPIKE_WL 5533 4.90 3.77 5.42 78 HTML_IMAGE_RATIO_08 5516 2.66 3.76 2.16 79 HTML_IMAGE_RATIO_06 5281 3.61 3.60 3.62 80 TM2_M_VERY_LONG_WORD 5225 1.99 3.56 1.27 81 XM_OfRef6 5086 1.78 3.47 1.01 82 TooManyTo_001 5057 7.12 3.45 8.82 83 XMNumbers 4774 3.18 3.25 3.15 84 XM_B_URI_Unicode 4674 2.43 3.18 2.09 85 T_REMOTE_IMAGE 4671 4.01 3.18 4.40 86 TR_XM_NoHeaderRelay 4649 1.13 3.17 0.18 87 TR_XM_SpammyWords5 4631 2.13 3.16 1.66 88 MIME_HTML_ONLY_MULTI 4603 2.54 3.14 2.26 89 MIME_HTML_MOSTLY 4575 2.41 3.12 2.09 90 MIME_QP_LONG_LINE 4540 4.49 3.09 5.13 91 T_XMDrugObfuBody_08 4536 2.10 3.09 1.64 92 TM2_M_URI_OPT_OUT 4382 2.24 2.99 1.89 93 RCVD_IN_PSBL 4170 1.23 2.84 0.48 94 XM_CamelCaseFrm001 4020 2.51 2.74 2.41 95 XM_URI_RBL 3961 1.08 2.70 0.33 96 RELAYCOUNTRY_AU 3946 1.20 2.69 0.51 97 XM_B_Unsub2 3918 1.87 2.67 1.50 98 XM_B_SpammyWords4 3811 1.24 2.60 0.61 99 XMDiploma_00 3777 1.93 2.57 1.64 100 TR_XM_InvalidRelay 3363 0.73 2.29 0.01 101 T_TooManySym_01 3351 4.65 2.28 5.74 102 XMPhish30 3331 1.13 2.27 0.60 103 XMBody_17 3308 0.94 2.25 0.33 104 RCVD_IN_VALIDITY_SAFE 3300 3.84 2.25 4.57 105 DKIM_ADSP_NXDOMAIN 3131 0.88 2.13 0.31 106 MAILING_LIST_MULTI 3119 2.59 2.13 2.80 107 T_XMHurry_00 3054 1.01 2.08 0.51 108 NO_DNS_FOR_FROM 2988 0.88 2.04 0.35 109 BOTNET_NORDNS 2971 0.64 2.02 0.01 110 TR_XM_MaxWHORU 2963 0.84 2.02 0.30 111 DIET_1 2853 0.86 1.94 0.36 112 T_XMDrugObfuBody_00 2790 1.15 1.90 0.81 113 T_FILL_THIS_FORM_SHORT 2745 1.33 1.87 1.08 114 TR_XM_INV_DKIM 2731 0.70 1.86 0.17 115 USER_IN_DEF_DKIM_WL 2708 9.61 1.85 13.19 116 RCVD_IN_ZEN_LASTEXTERNAL 2685 0.58 1.83 0.00 117 SHORTCIRCUIT 2685 0.58 1.83 0.00 118 FROM_EXCESS_BASE64 2671 1.71 1.82 1.65 119 XM_H_Long_From02 2667 1.33 1.82 1.11 120 BAYES_40 2616 4.54 1.78 5.81 121 HTML_MIME_NO_HTML_TAG 2591 2.43 1.77 2.74 122 XMGenDplmaNmb 2591 1.15 1.77 0.87 123 SpammyFromTLD_01 2577 1.17 1.76 0.90 124 RCVD_IN_VALIDITY_CERTIFIED 2430 2.86 1.66 3.42 125 XMStockSpam_06 2409 1.34 1.64 1.20 126 SUBJ_ALL_CAPS 2374 1.66 1.62 1.68 127 XM_SendGrid 2324 1.61 1.58 1.62 128 TO_NO_BRKTS_HTML_ONLY 2309 0.93 1.57 0.63 129 URI_HEX 2270 1.49 1.55 1.46 130 XM_DK_Undo_01 2122 1.47 1.45 1.47 131 NORDNS_LOW_CONTRAST 2105 0.49 1.43 0.05 132 ALL_TRUSTED 2084 10.48 1.42 14.66 133 XMBrknScrpt_02 2034 0.90 1.39 0.68 134 XM_DIRTYINTL 2017 0.50 1.37 0.10 135 KHOP_HELO_FCRDNS 1990 1.61 1.36 1.73 136 XM_B_COPY_HTML 1949 1.07 1.33 0.94 137 RCVD_IN_IADB_LISTED 1934 3.03 1.32 3.82 138 XMSubMetaI_00 1929 0.68 1.31 0.39 139 XM_B_SEO 1922 0.68 1.31 0.38 140 HK_RANDOM_REPLYTO 1884 0.50 1.28 0.14 141 HTML_IMAGE_ONLY_12 1844 0.59 1.26 0.28 142 BAYES_20 1840 3.28 1.25 4.21 143 LongTLD 1798 0.74 1.23 0.52 144 STY_INVIS_DIRECT 1790 0.56 1.22 0.25 145 T_Symld_Words_02 1783 0.82 1.21 0.63 146 XMCmmnCold 1775 0.41 1.21 0.04 147 XM_UB99 1773 0.38 1.21 0.00 148 XM_B_Phish66 1768 0.62 1.20 0.35 149 RCVD_IN_IADB_SPF 1754 2.68 1.20 3.37 150 RELAYCOUNTRY_NL 1753 0.43 1.19 0.07 151 RCVD_IN_PBL 1702 0.90 1.16 0.78 152 RCVD_IN_IADB_DK 1677 2.35 1.14 2.91 153 RCVD_IN_IADB_SENDERID 1670 2.41 1.14 2.99 154 HOSTED_IMG_MULTI_PUB_01 1654 0.37 1.13 0.02 155 URI_NOVOWEL 1653 1.49 1.13 1.66 156 TR_Mismatch_TLD_02 1640 0.41 1.12 0.08 157 MPART_ALT_DIFF_COUNT 1631 0.85 1.11 0.73 158 TR_Symld_Words 1628 1.48 1.11 1.66 159 TR_XM_DK_SendGrid 1625 1.10 1.11 1.09 160 XM_OfRef7 1616 0.49 1.10 0.21 161 XM_BadFromFormat 1600 0.42 1.09 0.11 162 TR_XM_SEO4 1583 0.49 1.08 0.22 163 FONT_INVIS_LONG_LINE 1554 0.38 1.06 0.07 164 T_MONEY_PERCENT 1535 0.45 1.05 0.18 165 TR_LOTS_OF_MONEY2 1535 0.45 1.05 0.18 166 BAYES_00 1518 8.57 1.03 12.05 167 TR_XM_PHPDW 1513 0.62 1.03 0.43 168 XM_ProductURIs 1512 0.59 1.03 0.39 169 XMSexyCombo_01 1492 0.50 1.02 0.26 170 HK_RANDOM_FROM 1490 0.42 1.02 0.14 171 TR_XM_PHPForged 1485 0.61 1.01 0.42 172 TM2_M_OBFU_COMMENT 1475 0.56 1.00 0.36 173 TR_XM_FormFill2 1450 0.60 0.99 0.42 174 XM_B_COVIDMETA 1450 0.45 0.99 0.20 175 XM_B_DNDMA 1434 0.69 0.98 0.56 176 HTML_TAG_BALANCE_BODY 1430 0.76 0.97 0.67 177 XM_H_PHPOS 1427 0.59 0.97 0.41 178 XM_UB60 1424 0.35 0.97 0.06 179 DKIM_ADSP_CUSTOM_MED 1399 0.87 0.95 0.83 180 XMHTML_After_End 1398 0.51 0.95 0.31 181 SHOPIFY_IMG_NOT_RCVD_SFY 1394 0.47 0.95 0.25 182 XM_HighProb1 1377 0.30 0.94 0.01 183 RELAYCOUNTRY_FR 1370 0.48 0.93 0.26 184 XMSlimDrugH 1361 0.63 0.93 0.49 185 LOW_PRICE 1360 0.45 0.93 0.23 186 RCVD_IN_SORBS_DUL 1325 0.32 0.90 0.06 187 XM_UB999 1310 0.28 0.89 0.00 188 HTTPS_HTTP_MISMATCH 1297 0.90 0.88 0.90 189 TR_XM_DK_Bayes 1283 5.86 0.87 8.16 190 XMBody_78 1282 0.49 0.87 0.32 191 PLING_QUERY 1281 0.65 0.87 0.55 192 TR_MetaPhish_Combo_01 1261 0.76 0.86 0.72 193 TR_XM_DK_Bayes1 1260 5.76 0.86 8.02 194 XMBdyGiftCard01 1252 0.59 0.85 0.47 195 XM_B_REG_HTML 1243 0.48 0.85 0.30 196 XMMoneyMeta_00 1236 0.62 0.84 0.52 197 URI_TRY_3LD 1206 0.65 0.82 0.57 198 TM2_M_A_HREF_HREF 1159 0.42 0.79 0.25 199 RDNS_DYNAMIC 1145 0.44 0.78 0.29 200 XM_GoogleGroups 1142 1.05 0.78 1.18 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279052 90.15 95.60 87.65 2 RELAYCOUNTRY_US 261475 82.24 82.50 82.12 3 DKIM_SIGNED 244067 79.90 86.93 76.66 4 XM_DK_Pass 239043 77.50 82.75 75.08 5 DKIM_VALID 235591 76.42 81.68 74.00 6 XM_B_Unicode 223998 73.92 81.66 70.35 7 BAYES_50 194123 55.04 42.17 60.97 8 DCC_CHECK_NEGATIVE 191965 48.54 23.04 60.29 9 DKIM_VALID_AU 188767 60.82 64.15 59.29 10 XMListUnsubscribeExists 152088 53.94 67.33 47.77 11 XM_B_SpammyWords 143645 53.36 71.26 45.12 12 XM_B_Unicode3 131889 43.91 49.32 41.42 13 DCC_CHECK 126207 50.83 75.10 39.64 14 RCVD_IN_MSPIKE_H2 114455 36.60 38.03 35.95 15 DKIM_VALID_EF 93960 28.96 27.77 29.51 16 T_TM2_M_HEADER_IN_MSG 92656 26.52 20.92 29.10 17 HTML_FONT_LOW_CONTRAST 87244 30.40 36.90 27.40 18 LOC_TINY_FONT_1 84004 33.07 47.57 26.38 19 FVGT_m_MULTI_ODD 80604 27.45 32.07 25.32 20 XMSubLong 73588 23.14 23.20 23.11 21 T_KAM_HTML_FONT_INVALID 68613 24.64 31.33 21.55 22 MIME_HTML_ONLY 66390 24.20 31.45 20.85 23 XM_B_SpammyWords2 57774 25.03 39.98 18.15 24 ALL_TRUSTED 46660 10.48 1.42 14.66 25 XM_Multi_Part_URI 42269 15.97 21.83 13.28 26 USER_IN_DEF_DKIM_WL 42001 9.61 1.85 13.19 27 UNPARSEABLE_RELAY 38890 13.65 16.75 12.21 28 BAYES_00 38367 8.57 1.03 12.05 29 TR_XM_DK_Unsub 38264 14.28 19.18 12.02 30 XM_B_PhoneNumber 33096 9.04 6.12 10.39 31 XM_B_Unsub 29817 12.52 19.35 9.37 32 XM_Evil_Numbers_Gen 28479 9.23 9.84 8.94 33 TooManyTo_001 28073 7.12 3.45 8.82 34 FSL_BULK_SIG 26601 9.13 10.81 8.35 35 LotsOfNums_01 26373 8.14 7.84 8.28 36 TR_XM_DK_Bayes 25994 5.86 0.87 8.16 37 TR_XM_DK_Bayes1 25545 5.76 0.86 8.02 38 IN_ZIMBRA_NJ_WHITELIST 22539 4.88 0.10 7.08 39 TR_XM_DK_Bayes2 22156 4.94 0.55 6.96 40 TR_XM_BayesUnsub 21976 10.58 18.55 6.90 41 BAYES_60 20330 6.98 8.27 6.39 42 XM_DKIMWhitelistDomains 20266 4.36 0.02 6.37 43 LOTS_OF_MONEY 18532 7.58 11.39 5.82 44 BAYES_40 18503 4.54 1.78 5.81 45 T_TooManySym_01 18276 4.65 2.28 5.74 46 XM_H_Long_From01 18078 5.61 5.47 5.68 47 XM_H_GMP 17901 5.35 4.77 5.62 48 XM_B_Phish_Phrases 17825 6.53 8.54 5.60 49 XMStrtUSub 17459 5.39 5.18 5.48 50 RCVD_IN_MSPIKE_WL 17255 4.90 3.77 5.42 51 RCVD_IN_MSPIKE_H3 17255 4.90 3.77 5.42 52 XM_PDF 17000 3.89 0.75 5.34 53 TR_MAX_INTL_RELAY 16830 8.19 14.48 5.29 54 MIME_QP_LONG_LINE 16333 4.49 3.09 5.13 55 RCVD_IN_VALIDITY_SAFE 14542 3.84 2.25 4.57 56 HTML_IMAGE_RATIO_02 14274 5.21 6.78 4.48 57 T_REMOTE_IMAGE 13994 4.01 3.18 4.40 58 XM_DK_Undo_02 13702 14.57 36.85 4.30 59 BAYES_20 13410 3.28 1.25 4.21 60 HTML_IMAGE_RATIO_04 13398 4.29 4.45 4.21 61 XM_UncommonTLD01 13312 5.44 8.18 4.18 62 XM_B_SpammyWords3 12899 7.13 13.81 4.05 63 MPART_ALT_DIFF 12756 4.57 5.78 4.01 64 XMSubMetaSx_00 12624 4.79 6.59 3.96 65 RELAYCOUNTRY_META 12359 7.75 16.14 3.88 66 TR_XM_SpammyWords4 12323 5.85 10.13 3.87 67 RCVD_IN_IADB_LISTED 12148 3.03 1.32 3.82 68 HTML_IMAGE_RATIO_06 11534 3.61 3.60 3.62 69 RCVD_IN_VALIDITY_CERTIFIED 10877 2.86 1.66 3.42 70 RCVD_IN_IADB_SPF 10719 2.68 1.20 3.37 71 BAYES_80 10372 5.08 9.04 3.26 72 ANY_BOUNCE_MESSAGE 10266 2.40 0.62 3.22 73 BOUNCE_MESSAGE 10228 2.39 0.61 3.21 74 XMNumbers 10024 3.18 3.25 3.15 75 BOTNET_IPINHOSTNAME 9967 5.51 10.67 3.13 76 T_TooManySym_02 9668 2.31 0.74 3.04 77 RCVD_IN_IADB_SENDERID 9521 2.41 1.14 2.99 78 RCVD_IN_IADB_DK 9255 2.35 1.14 2.91 79 TooManyTo_002 9252 2.18 0.62 2.91 80 XM_Body_Dirty_Words 9061 4.56 8.27 2.85 81 MAILING_LIST_MULTI 8926 2.59 2.13 2.80 82 BAYES_99 8860 11.05 28.98 2.78 83 HTML_MIME_NO_HTML_TAG 8712 2.43 1.77 2.74 84 DKIM_INVALID 8476 3.48 5.25 2.66 85 XM_B_SpammyTLD 8311 3.07 4.06 2.61 86 RCVD_IN_IADB_VOUCHED 8121 1.93 0.59 2.55 87 BAYES_05 7948 1.91 0.65 2.50 88 XM_CamelCaseFrm001 7675 2.51 2.74 2.41 89 XMNoVowels 7603 2.89 3.97 2.39 90 INVALID_MSGID 7310 1.63 0.17 2.30 91 MIME_HTML_ONLY_MULTI 7205 2.54 3.14 2.26 92 HTML_IMAGE_RATIO_08 6878 2.66 3.76 2.16 93 TR_XM_SpammyRelay 6813 5.34 12.27 2.14 94 MIME_HTML_MOSTLY 6655 2.41 3.12 2.09 95 XM_B_URI_Unicode 6640 2.43 3.18 2.09 96 BAYES_999 6597 8.48 22.38 2.07 97 BAYES_95 6447 2.96 4.99 2.02 98 TO_MALFORMED 6208 1.35 0.05 1.95 99 TM2_M_URI_OPT_OUT 6015 2.24 2.99 1.89 100 TR_XM_PhishingBody 5935 2.80 4.82 1.86 101 TR_XM_DKIM_Undo 5680 9.43 26.00 1.78 102 RCVD_IN_IADB_OPTIN 5619 1.32 0.35 1.76 103 KHOP_HELO_FCRDNS 5521 1.61 1.36 1.73 104 XM_B_Investor 5454 2.46 4.08 1.71 105 T_XMDrugObfuBody_14 5432 2.55 4.37 1.71 106 SUBJ_ALL_CAPS 5350 1.66 1.62 1.68 107 TR_XM_SpammyWords5 5295 2.13 3.16 1.66 108 URI_NOVOWEL 5289 1.49 1.13 1.66 109 TR_Symld_Words 5278 1.48 1.11 1.66 110 FROM_EXCESS_BASE64 5260 1.71 1.82 1.65 111 XMSexyCombo_05 5252 2.65 4.81 1.65 112 XM_SPF_SoftFail 5234 2.83 5.39 1.64 113 T_XMDrugObfuBody_08 5232 2.10 3.09 1.64 114 TooManyTo_003 5224 1.28 0.51 1.64 115 XMDiploma_00 5209 1.93 2.57 1.64 116 XM_SendGrid 5149 1.61 1.58 1.62 117 XM_B_Unsub2 4781 1.87 2.67 1.50 118 UNTRUSTED_Relay 4764 3.35 7.38 1.50 119 TR_XM_UnparsRelay 4739 3.73 8.60 1.49 120 IN_HORDE_ADDRESS_BOOK 4729 1.05 0.12 1.49 121 BOTNET 4721 4.17 9.99 1.48 122 XM_DK_Undo_01 4696 1.47 1.45 1.47 123 HELO_NODOT 4679 1.10 0.30 1.47 124 HELO_NO_DOMAIN 4674 1.10 0.30 1.47 125 URI_HEX 4638 1.49 1.55 1.46 126 XMCapTrack 4061 1.04 0.53 1.28 127 TM2_M_VERY_LONG_WORD 4034 1.99 3.56 1.27 128 RELAYCOUNTRY_CA 4020 2.52 5.24 1.26 129 T_TooManySym_03 3893 0.91 0.24 1.22 130 XMStockSpam_06 3813 1.34 1.64 1.20 131 XM_GoogleGroups 3752 1.05 0.78 1.18 132 TooManyTo_004 3705 0.94 0.45 1.16 133 XMGappySubj_01 3602 0.85 0.23 1.13 134 XM_H_Long_From02 3530 1.33 1.82 1.11 135 TR_XM_DK_SendGrid 3478 1.10 1.11 1.09 136 T_FILL_THIS_FORM_SHORT 3447 1.33 1.87 1.08 137 TVD_SPACE_RATIO 3377 0.80 0.25 1.06 138 XM_OfRef6 3213 1.78 3.47 1.01 139 TooManyTo_005 3015 0.78 0.41 0.95 140 XM_B_COPY_HTML 3007 1.07 1.33 0.94 141 XM_UB50 2991 1.83 3.77 0.94 142 FROM_GOV_DKIM_AU 2954 0.75 0.35 0.93 143 HTTPS_HTTP_MISMATCH 2871 0.90 0.88 0.90 144 SpammyFromTLD_01 2860 1.17 1.76 0.90 145 XMGenDplmaNmb 2774 1.15 1.77 0.87 146 TR_DCC_Bayes_99 2744 7.38 21.51 0.86 147 T_OBFU_PDF_ATTACH 2657 0.63 0.17 0.83 148 DKIM_ADSP_CUSTOM_MED 2636 0.87 0.95 0.83 149 XM_H_PHPMailer 2571 0.75 0.62 0.81 150 T_XMDrugObfuBody_00 2566 1.15 1.90 0.81 151 XM_ShortIntro_01 2501 0.71 0.56 0.79 152 RCVD_IN_PBL 2495 0.90 1.16 0.78 153 TR_XM_Base64_M1 2484 0.77 0.75 0.78 154 MPART_ALT_DIFF_COUNT 2323 0.85 1.11 0.73 155 TVD_RCVD_IP 2297 0.71 0.69 0.72 156 TR_MetaPhish_Combo_01 2281 0.76 0.86 0.72 157 XMBody_95 2194 0.53 0.17 0.69 158 XMBrknScrpt_02 2162 0.90 1.39 0.68 159 HTML_TAG_BALANCE_BODY 2124 0.76 0.97 0.67 160 HTML_IMAGE_ONLY_20 2089 0.63 0.58 0.66 161 RCVD_IN_BL_SPAMCOP_NET 2045 3.19 8.72 0.64 162 T_Symld_Words_02 2021 0.82 1.21 0.63 163 TO_NO_BRKTS_HTML_ONLY 1997 0.93 1.57 0.63 164 XMPhish14 1969 0.67 0.78 0.62 165 XM_B_SpammyWords4 1939 1.24 2.60 0.61 166 XMPhish30 1922 1.13 2.27 0.60 167 XM_B_FormFill 1862 0.41 0.02 0.58 168 URI_TRY_3LD 1816 0.65 0.82 0.57 169 NML_ADSP_CUSTOM_MED 1797 0.62 0.73 0.56 170 XM_B_DNDMA 1786 0.69 0.98 0.56 171 PLING_QUERY 1742 0.65 0.87 0.55 172 FORGED_GMAIL_RCVD 1671 0.58 0.69 0.52 173 XMMoneyMeta_00 1669 0.62 0.84 0.52 174 XMLngstWrd_00 1664 0.45 0.28 0.52 175 LongTLD 1640 0.74 1.23 0.52 176 T_XMHurry_00 1626 1.01 2.08 0.51 177 XMGappySubj_02 1622 0.39 0.13 0.51 178 MISSING_HEADERS 1622 0.51 0.50 0.51 179 RELAYCOUNTRY_AU 1621 1.20 2.69 0.51 180 XMSlimDrugH 1563 0.63 0.93 0.49 181 HTML_IMAGE_ONLY_32 1556 0.41 0.24 0.49 182 RELAYCOUNTRY_GB 1539 0.55 0.69 0.48 183 MIME_CHARSET_FARAWAY 1537 0.55 0.69 0.48 184 RCVD_IN_PSBL 1529 1.23 2.84 0.48 185 MSGID_FROM_MTA_HEADER 1526 0.35 0.07 0.48 186 XMBdyGiftCard01 1491 0.59 0.85 0.47 187 FROM_GOV_SPOOF 1448 0.34 0.08 0.45 188 TVD_PH_BODY_ACCOUNTS_PRE 1446 0.39 0.24 0.45 189 HTML_IMAGE_ONLY_28 1445 0.50 0.61 0.45 190 HTML_FONT_FACE_BAD 1414 0.46 0.48 0.44 191 XM_Body_Obfu01 1403 0.40 0.32 0.44 192 SpammyFromTLD_02 1403 1.63 4.21 0.44 193 USER_IN_WHITELIST 1382 0.30 0.00 0.43 194 USER_IN_WELCOMELIST 1382 0.30 0.00 0.43 195 TR_XM_PHPDW 1371 0.62 1.03 0.43 196 T_TVD_MIME_NO_HEADERS 1367 0.31 0.06 0.43 197 TR_XM_PHPForged 1342 0.61 1.01 0.42 198 TR_XM_FormFill2 1338 0.60 0.99 0.42 199 TR_XM_SPAMCOP 1319 2.35 6.53 0.41 200 XM_H_PHPOS 1306 0.59 0.97 0.41 ----------------------------------------------------------------------