Email: 433287 Autolearn: 0 AvgScore: 4.95 AvgScanTime: 1.34 sec Spam: 140563 Autolearn: 0 AvgScore: 14.85 AvgScanTime: 1.44 sec Ham: 292724 Autolearn: 0 AvgScore: 0.20 AvgScanTime: 1.30 sec Time Spent Running SA: 161.50 hours Time Spent Processing Spam: 56.20 hours Time Spent Processing Ham: 105.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133805 88.56 95.19 85.37 2 DKIM_SIGNED 121473 79.76 86.42 76.57 3 RELAYCOUNTRY_US 116594 81.90 82.95 81.40 4 XM_B_Unicode 115702 73.80 82.31 69.71 5 XM_DK_Pass 115441 77.39 82.13 75.12 6 DKIM_VALID 114212 76.39 81.25 74.05 7 DCC_CHECK 106230 51.06 75.57 39.30 8 XM_B_SpammyWords 96779 52.57 68.85 44.75 9 XMListUnsubscribeExists 95904 55.51 68.23 49.40 10 DKIM_VALID_AU 91119 61.13 64.82 59.36 11 XM_B_Unicode3 70051 43.94 49.84 41.11 12 LOC_TINY_FONT_1 67262 33.72 47.85 26.93 13 BAYES_50 57775 55.07 41.10 61.78 14 XM_B_SpammyWords2 56694 26.09 40.33 19.25 15 RCVD_IN_MSPIKE_H2 55158 36.75 39.24 35.55 16 HTML_FONT_LOW_CONTRAST 54373 30.84 38.68 27.08 17 XM_DK_Undo_02 52825 15.69 37.58 5.17 18 T_KAM_HTML_FONT_INVALID 44908 24.65 31.95 21.14 19 FVGT_m_MULTI_ODD 44478 26.59 31.64 24.16 20 BAYES_99 42011 12.27 29.89 3.82 21 MIME_HTML_ONLY 41120 23.46 29.25 20.68 22 DKIM_VALID_EF 38702 28.73 27.53 29.30 23 TR_XM_DKIM_Undo 37360 10.06 26.58 2.12 24 BAYES_999 32375 9.41 23.03 2.87 25 DCC_CHECK_NEGATIVE 32154 48.40 22.88 60.66 26 XM_Multi_Part_URI 31953 15.97 22.73 12.73 27 XMSubLong 31798 23.37 22.62 23.73 28 T_TM2_M_HEADER_IN_MSG 31551 27.23 22.45 29.53 29 TR_DCC_Bayes_99 30214 7.89 21.49 1.35 30 TR_XM_DK_Unsub 26511 15.12 18.86 13.32 31 UNPARSEABLE_RELAY 23379 12.91 16.63 11.12 32 XM_B_Unsub 22180 11.00 15.78 8.71 33 RELAYCOUNTRY_META 21622 7.86 15.38 4.25 34 TR_XM_BayesUnsub 21147 9.33 15.04 6.59 35 TR_MAX_INTL_RELAY 20488 8.59 14.58 5.71 36 XM_B_SpammyWords3 20254 7.93 14.41 4.83 37 LOTS_OF_MONEY 16689 8.05 11.87 6.22 38 TR_XM_SpammyWords2 15727 4.00 11.19 0.54 39 TR_XM_SpammyWords4 15189 6.22 10.81 4.02 40 TR_XM_SpammyRelay 15147 4.89 10.78 2.07 41 BOTNET 15071 4.55 10.72 1.58 42 FSL_BULK_SIG 14846 8.37 10.56 7.31 43 XM_Body_Dirty_Words 14032 5.12 9.98 2.79 44 BOTNET_IPINHOSTNAME 13953 5.55 9.93 3.45 45 XM_Evil_Numbers_Gen 13059 9.23 9.29 9.20 46 BAYES_80 12916 5.38 9.19 3.55 47 XM_UncommonTLD01 12269 5.77 8.73 4.35 48 BAYES_60 12084 7.25 8.60 6.60 49 RCVD_IN_BL_SPAMCOP_NET 12082 3.13 8.60 0.50 50 TR_XM_UnparsRelay 11098 3.55 7.90 1.46 51 XM_B_Phish_Phrases 10692 5.85 7.61 5.00 52 LotsOfNums_01 10552 8.19 7.51 8.51 53 UNTRUSTED_Relay 9681 3.21 6.89 1.44 54 XMSubMetaSx_00 9608 4.70 6.84 3.68 55 TR_XM_SPAMCOP 9484 2.39 6.75 0.29 56 MPART_ALT_DIFF 8068 4.95 5.74 4.57 57 XMSexyCombo_05 8060 2.80 5.73 1.39 58 HTML_IMAGE_RATIO_02 7931 4.86 5.64 4.48 59 XM_H_Long_From01 7800 5.83 5.55 5.96 60 RELAYCOUNTRY_CA 7358 2.48 5.23 1.15 61 DKIM_INVALID 7261 3.38 5.17 2.52 62 T_XMDrugObfuBody_14 7225 3.11 5.14 2.14 63 BAYES_95 7202 3.12 5.12 2.15 64 HTML_IMAGE_RATIO_04 7092 4.66 5.05 4.48 65 XM_B_PhoneNumber 7006 8.02 4.98 9.47 66 RCVD_IN_VALIDITY_RPBL 6893 1.62 4.90 0.04 67 TR_XM_PhishingBody 6852 2.65 4.87 1.59 68 XM_H_GMP 6574 5.41 4.68 5.76 69 TM2_M_VERY_LONG_WORD 6530 2.41 4.65 1.33 70 T_REMOTE_IMAGE 6361 3.90 4.53 3.60 71 XM_B_Investor 6055 2.55 4.31 1.71 72 XMStrtUSub 5825 4.46 4.14 4.61 73 XM_B_SpammyTLD 5318 3.16 3.78 2.86 74 RCVD_IN_MSPIKE_WL 5309 4.94 3.78 5.50 75 RCVD_IN_MSPIKE_H3 5309 4.94 3.78 5.50 76 HTML_IMAGE_RATIO_06 5247 3.17 3.73 2.90 77 TooManyTo_001 5242 7.06 3.73 8.66 78 RCVD_IN_PSBL 5177 1.59 3.68 0.59 79 XM_UB50 5045 1.79 3.59 0.92 80 TR_XM_SpammyWords5 4737 2.13 3.37 1.54 81 XM_OfRef6 4637 1.87 3.30 1.19 82 XM_CamelCaseFrm001 4464 2.57 3.18 2.28 83 MIME_HTML_MOSTLY 4382 2.56 3.12 2.29 84 XM_SPF_SoftFail 4375 1.99 3.11 1.45 85 MIME_HTML_ONLY_MULTI 4348 2.93 3.09 2.85 86 XMNoVowels 4296 2.98 3.06 2.94 87 T_XMDrugObfuBody_08 4282 2.29 3.05 1.92 88 XMNumbers 4172 3.21 2.97 3.33 89 MIME_QP_LONG_LINE 4044 4.41 2.88 5.15 90 XM_URI_RBL 3969 1.17 2.82 0.38 91 XMDiploma_00 3922 1.92 2.79 1.51 92 XM_B_Unsub2 3874 1.80 2.76 1.34 93 XM_B_URI_Unicode 3755 2.22 2.67 2.00 94 NO_DNS_FOR_FROM 3638 1.04 2.59 0.30 95 TR_XM_MaxWHORU 3573 1.00 2.54 0.25 96 RELAYCOUNTRY_AU 3527 1.31 2.51 0.73 97 DKIM_ADSP_NXDOMAIN 3524 1.03 2.51 0.32 98 TM2_M_URI_OPT_OUT 3456 2.02 2.46 1.80 99 MAILING_LIST_MULTI 3437 3.66 2.45 4.25 100 HTML_IMAGE_RATIO_08 3377 1.99 2.40 1.79 101 RCVD_IN_VALIDITY_SAFE 3278 3.33 2.33 3.81 102 FROM_EXCESS_BASE64 3248 2.10 2.31 1.99 103 T_XMHurry_00 3234 1.12 2.30 0.55 104 T_TooManySym_01 3203 5.29 2.28 6.73 105 SpammyFromTLD_01 3032 1.28 2.16 0.86 106 XMBody_17 3019 1.02 2.15 0.47 107 HTML_IMAGE_ONLY_16 2909 0.89 2.07 0.32 108 RCVD_IN_VALIDITY_CERTIFIED 2868 2.62 2.04 2.90 109 TR_XM_NoHeaderRelay 2734 0.74 1.95 0.16 110 XM_B_SpammyWords4 2727 1.00 1.94 0.55 111 SpammyFromTLD_02 2724 1.06 1.94 0.64 112 SUBJ_ALL_CAPS 2711 1.66 1.93 1.53 113 XMStockSpam_06 2679 1.55 1.91 1.38 114 XMGenDplmaNmb 2631 1.14 1.87 0.79 115 HTML_MIME_NO_HTML_TAG 2618 2.38 1.86 2.63 116 NORDNS_LOW_CONTRAST 2604 0.62 1.85 0.03 117 T_FILL_THIS_FORM_SHORT 2585 1.34 1.84 1.10 118 USER_IN_DEF_DKIM_WL 2573 9.70 1.83 13.48 119 ALL_TRUSTED 2546 11.03 1.81 15.46 120 BAYES_40 2471 4.13 1.76 5.27 121 XMPhish30 2470 0.88 1.76 0.45 122 XMBrknScrpt_02 2416 1.23 1.72 1.00 123 DIET_1 2364 0.85 1.68 0.45 124 T_XMDrugObfuBody_00 2349 1.04 1.67 0.74 125 XM_DK_Undo_01 2343 1.62 1.67 1.60 126 XMBdyGiftCard01 2310 0.91 1.64 0.56 127 KHOP_HELO_FCRDNS 2191 1.55 1.56 1.54 128 TR_XM_INV_DKIM 2168 0.60 1.54 0.14 129 TR_LOTS_OF_MONEY3 2161 0.69 1.54 0.28 130 SHORTCIRCUIT 2161 0.50 1.54 0.00 131 RCVD_IN_ZEN_LASTEXTERNAL 2161 0.50 1.54 0.00 132 XM_SendGrid 2158 1.37 1.54 1.29 133 XM_BadFromFormat 2111 0.56 1.50 0.12 134 TO_NO_BRKTS_HTML_ONLY 2034 0.85 1.45 0.56 135 URI_HEX 1982 1.15 1.41 1.03 136 TO_NO_BRKTS_FROM_MSSP 1972 0.46 1.40 0.01 137 XM_B_SEO 1960 0.61 1.39 0.24 138 XM_B_COPY_HTML 1874 0.95 1.33 0.77 139 FROM_MISSP_REPLYTO 1861 0.43 1.32 0.00 140 TM2_M_OBFU_COMMENT 1854 0.73 1.32 0.44 141 BOTNET_NORDNS 1854 0.43 1.32 0.01 142 T_STY_INVIS_DIRECT 1837 0.67 1.31 0.37 143 XMReplyNow 1830 0.58 1.30 0.23 144 URI_TRY_3LD 1829 0.71 1.30 0.42 145 BAYES_20 1809 3.00 1.29 3.82 146 HK_RANDOM_REPLYTO 1797 0.52 1.28 0.16 147 XM_B_Phish66 1773 0.77 1.26 0.53 148 XMSubMetaI_00 1760 0.73 1.25 0.48 149 XM_B_DNDMA 1694 0.82 1.21 0.64 150 RCVD_IN_PBL 1652 0.87 1.18 0.73 151 RELAYCOUNTRY_FR 1646 0.53 1.17 0.22 152 RCVD_IN_IADB_LISTED 1644 3.01 1.17 3.89 153 ANY_BOUNCE_MESSAGE 1634 2.96 1.16 3.83 154 BOUNCE_MESSAGE 1631 2.96 1.16 3.82 155 SHOPIFY_IMG_NOT_RCVD_SFY 1616 0.55 1.15 0.26 156 XMSexyCombo_01 1609 0.56 1.14 0.28 157 TR_XM_InvalidRelay 1592 0.38 1.13 0.01 158 LongTLD 1563 0.69 1.11 0.49 159 XM_ProductURIs 1552 0.82 1.10 0.69 160 RDNS_DYNAMIC 1537 0.57 1.09 0.32 161 XM_HighProb1 1532 0.36 1.09 0.02 162 XM_H_Long_From02 1520 1.07 1.08 1.07 163 MALE_ENHANCE 1516 0.36 1.08 0.01 164 PDS_RDNS_DYNAMIC_FP 1500 0.48 1.07 0.20 165 URI_NOVOWEL 1484 1.45 1.06 1.64 166 TR_Mismatch_TLD_02 1481 0.41 1.05 0.10 167 XMPhish14 1480 0.58 1.05 0.36 168 HTML_TAG_BALANCE_BODY 1464 0.69 1.04 0.52 169 TR_XM_PHPDW 1464 0.58 1.04 0.35 170 TR_XM_Base64_M1 1463 0.92 1.04 0.86 171 TR_XM_SEO4 1455 0.41 1.04 0.11 172 TR_XM_PHPForged 1449 0.57 1.03 0.35 173 XM_UB99 1447 0.34 1.03 0.00 174 RCVD_IN_IADB_SPF 1433 2.63 1.02 3.40 175 TR_MetaPhish_Combo_01 1425 0.74 1.01 0.61 176 TR_XM_FormFill2 1418 0.57 1.01 0.35 177 TR_XM_RelayPhish 1407 0.38 1.00 0.08 178 XM_B_COVIDMETA 1406 0.43 1.00 0.15 179 MIME_CHARSET_FARAWAY 1395 0.59 0.99 0.40 180 XM_H_PHPOS 1391 0.55 0.99 0.34 181 RCVD_IN_IADB_DK 1353 2.30 0.96 2.94 182 RCVD_IN_IADB_SENDERID 1351 2.36 0.96 3.03 183 XM_B_REG_HTML 1344 0.45 0.96 0.21 184 PLING_QUERY 1343 0.60 0.96 0.43 185 J_POPCORN_WO_D 1341 0.44 0.95 0.19 186 XM_UB60 1325 0.34 0.94 0.06 187 XM_DIRTYINTL 1313 0.38 0.93 0.11 188 MPART_ALT_DIFF_COUNT 1310 0.65 0.93 0.51 189 TVD_RCVD_IP 1303 0.75 0.93 0.67 190 XMSlimDrugH 1297 0.61 0.92 0.47 191 HTTPS_HTTP_MISMATCH 1260 0.78 0.90 0.72 192 DKIM_ADSP_CUSTOM_MED 1252 0.95 0.89 0.98 193 HOSTED_IMG_MULTI_PUB_01 1245 0.34 0.89 0.08 194 T_Symld_Words_02 1216 0.80 0.87 0.77 195 BAYES_00 1213 7.52 0.86 10.71 196 HK_RANDOM_FROM 1179 0.37 0.84 0.15 197 MultiRelay_CC 1138 0.37 0.81 0.15 198 TR_XM_DK_SendGrid 1125 0.83 0.80 0.84 199 RELAYCOUNTRY_UA 1120 0.26 0.80 0.00 200 TR_Symld_Words 1105 1.38 0.79 1.66 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 249913 88.56 95.19 85.37 2 RELAYCOUNTRY_US 238270 81.90 82.95 81.40 3 DKIM_SIGNED 224127 79.76 86.42 76.57 4 XM_DK_Pass 219892 77.39 82.13 75.12 5 DKIM_VALID 216758 76.39 81.25 74.05 6 XM_B_Unicode 204050 73.80 82.31 69.71 7 BAYES_50 180834 55.07 41.10 61.78 8 DCC_CHECK_NEGATIVE 177559 48.40 22.88 60.66 9 DKIM_VALID_AU 173767 61.13 64.82 59.36 10 XMListUnsubscribeExists 144610 55.51 68.23 49.40 11 XM_B_SpammyWords 131007 52.57 68.85 44.75 12 XM_B_Unicode3 120337 43.94 49.84 41.11 13 DCC_CHECK 115026 51.06 75.57 39.30 14 RCVD_IN_MSPIKE_H2 104057 36.75 39.24 35.55 15 T_TM2_M_HEADER_IN_MSG 86443 27.23 22.45 29.53 16 DKIM_VALID_EF 85776 28.73 27.53 29.30 17 HTML_FONT_LOW_CONTRAST 79267 30.84 38.68 27.08 18 LOC_TINY_FONT_1 78823 33.72 47.85 26.93 19 FVGT_m_MULTI_ODD 70716 26.59 31.64 24.16 20 XMSubLong 69476 23.37 22.62 23.73 21 T_KAM_HTML_FONT_INVALID 61883 24.65 31.95 21.14 22 MIME_HTML_ONLY 60523 23.46 29.25 20.68 23 XM_B_SpammyWords2 56345 26.09 40.33 19.25 24 ALL_TRUSTED 45245 11.03 1.81 15.46 25 USER_IN_DEF_DKIM_WL 39446 9.70 1.83 13.48 26 TR_XM_DK_Unsub 38982 15.12 18.86 13.32 27 XM_Multi_Part_URI 37263 15.97 22.73 12.73 28 UNPARSEABLE_RELAY 32564 12.91 16.63 11.12 29 BAYES_00 31364 7.52 0.86 10.71 30 XM_B_PhoneNumber 27728 8.02 4.98 9.47 31 XM_Evil_Numbers_Gen 26940 9.23 9.29 9.20 32 XM_B_Unsub 25498 11.00 15.78 8.71 33 TooManyTo_001 25355 7.06 3.73 8.66 34 LotsOfNums_01 24925 8.19 7.51 8.51 35 FSL_BULK_SIG 21405 8.37 10.56 7.31 36 TR_XM_DK_Bayes 21032 5.05 0.60 7.18 37 TR_XM_DK_Bayes1 20629 4.95 0.59 7.05 38 XM_DKIMWhitelistDomains 20502 4.75 0.06 7.00 39 IN_ZIMBRA_NJ_WHITELIST 20409 4.76 0.17 6.97 40 T_TooManySym_01 19712 5.29 2.28 6.73 41 BAYES_60 19332 7.25 8.60 6.60 42 TR_XM_BayesUnsub 19296 9.33 15.04 6.59 43 LOTS_OF_MONEY 18201 8.05 11.87 6.22 44 TR_XM_DK_Bayes2 17563 4.21 0.50 6.00 45 XM_H_Long_From01 17449 5.83 5.55 5.96 46 XM_H_GMP 16848 5.41 4.68 5.76 47 TR_MAX_INTL_RELAY 16711 8.59 14.58 5.71 48 RCVD_IN_MSPIKE_WL 16112 4.94 3.78 5.50 49 RCVD_IN_MSPIKE_H3 16110 4.94 3.78 5.50 50 BAYES_40 15439 4.13 1.76 5.27 51 XM_DK_Undo_02 15137 15.69 37.58 5.17 52 MIME_QP_LONG_LINE 15068 4.41 2.88 5.15 53 XM_B_Phish_Phrases 14640 5.85 7.61 5.00 54 XM_PDF 14605 3.59 0.67 4.99 55 XM_B_SpammyWords3 14126 7.93 14.41 4.83 56 XMStrtUSub 13482 4.46 4.14 4.61 57 MPART_ALT_DIFF 13374 4.95 5.74 4.57 58 HTML_IMAGE_RATIO_02 13113 4.86 5.64 4.48 59 HTML_IMAGE_RATIO_04 13113 4.66 5.05 4.48 60 XM_UncommonTLD01 12744 5.77 8.73 4.35 61 RELAYCOUNTRY_META 12444 7.86 15.38 4.25 62 MAILING_LIST_MULTI 12433 3.66 2.45 4.25 63 TR_XM_SpammyWords4 11770 6.22 10.81 4.02 64 RCVD_IN_IADB_LISTED 11379 3.01 1.17 3.89 65 ANY_BOUNCE_MESSAGE 11199 2.96 1.16 3.83 66 BAYES_20 11195 3.00 1.29 3.82 67 BOUNCE_MESSAGE 11194 2.96 1.16 3.82 68 BAYES_99 11168 12.27 29.89 3.82 69 RCVD_IN_VALIDITY_SAFE 11152 3.33 2.33 3.81 70 T_TooManySym_02 10805 2.68 0.57 3.69 71 XMSubMetaSx_00 10762 4.70 6.84 3.68 72 T_REMOTE_IMAGE 10525 3.90 4.53 3.60 73 BAYES_80 10402 5.38 9.19 3.55 74 BOTNET_IPINHOSTNAME 10106 5.55 9.93 3.45 75 RCVD_IN_IADB_SPF 9950 2.63 1.02 3.40 76 XMNumbers 9735 3.21 2.97 3.33 77 TooManyTo_002 8914 2.27 0.67 3.05 78 RCVD_IN_IADB_SENDERID 8868 2.36 0.96 3.03 79 XMNoVowels 8611 2.98 3.06 2.94 80 RCVD_IN_IADB_DK 8603 2.30 0.96 2.94 81 HTML_IMAGE_RATIO_06 8492 3.17 3.73 2.90 82 RCVD_IN_VALIDITY_CERTIFIED 8482 2.62 2.04 2.90 83 BAYES_999 8407 9.41 23.03 2.87 84 XM_B_SpammyTLD 8382 3.16 3.78 2.86 85 MIME_HTML_ONLY_MULTI 8336 2.93 3.09 2.85 86 XM_Body_Dirty_Words 8173 5.12 9.98 2.79 87 HTML_MIME_NO_HTML_TAG 7686 2.38 1.86 2.63 88 RCVD_IN_IADB_VOUCHED 7678 1.95 0.54 2.62 89 DKIM_INVALID 7369 3.38 5.17 2.52 90 INVALID_MSGID 7319 1.75 0.19 2.50 91 MIME_HTML_MOSTLY 6697 2.56 3.12 2.29 92 BAYES_05 6680 1.75 0.65 2.28 93 XM_CamelCaseFrm001 6666 2.57 3.18 2.28 94 BAYES_95 6302 3.12 5.12 2.15 95 TO_MALFORMED 6287 1.46 0.02 2.15 96 T_XMDrugObfuBody_14 6269 3.11 5.14 2.14 97 TR_XM_DKIM_Undo 6208 10.06 26.58 2.12 98 TR_XM_SpammyRelay 6055 4.89 10.78 2.07 99 XM_B_URI_Unicode 5858 2.22 2.67 2.00 100 FROM_EXCESS_BASE64 5830 2.10 2.31 1.99 101 T_XMDrugObfuBody_08 5625 2.29 3.05 1.92 102 RCVD_IN_IADB_OPTIN 5505 1.37 0.31 1.88 103 TM2_M_URI_OPT_OUT 5277 2.02 2.46 1.80 104 HTML_IMAGE_RATIO_08 5229 1.99 2.40 1.79 105 TooManyTo_003 5218 1.39 0.57 1.78 106 XM_B_Investor 5015 2.55 4.31 1.71 107 XMGappySubj_01 4908 1.17 0.12 1.68 108 TR_Symld_Words 4856 1.38 0.79 1.66 109 URI_NOVOWEL 4815 1.45 1.06 1.64 110 XM_DK_Undo_01 4676 1.62 1.67 1.60 111 TR_XM_PhishingBody 4643 2.65 4.87 1.59 112 BOTNET 4637 4.55 10.72 1.58 113 IN_HORDE_ADDRESS_BOOK 4619 1.11 0.12 1.58 114 TR_XM_SpammyWords5 4513 2.13 3.37 1.54 115 KHOP_HELO_FCRDNS 4507 1.55 1.56 1.54 116 SUBJ_ALL_CAPS 4480 1.66 1.93 1.53 117 T_TooManySym_03 4464 1.09 0.18 1.52 118 XMDiploma_00 4415 1.92 2.79 1.51 119 TR_XM_UnparsRelay 4275 3.55 7.90 1.46 120 XM_SPF_SoftFail 4255 1.99 3.11 1.45 121 UNTRUSTED_Relay 4211 3.21 6.89 1.44 122 XMSexyCombo_05 4070 2.80 5.73 1.39 123 XMStockSpam_06 4048 1.55 1.91 1.38 124 TooManyTo_004 3965 1.08 0.51 1.35 125 TR_DCC_Bayes_99 3956 7.89 21.49 1.35 126 XM_B_Unsub2 3925 1.80 2.76 1.34 127 TM2_M_VERY_LONG_WORD 3906 2.41 4.65 1.33 128 XM_SendGrid 3788 1.37 1.54 1.29 129 XM_GoogleGroups 3726 1.10 0.73 1.27 130 FROM_GOV_DKIM_AU 3607 0.88 0.15 1.23 131 HELO_NODOT 3529 0.90 0.26 1.21 132 HELO_NO_DOMAIN 3524 0.88 0.19 1.20 133 XM_OfRef6 3483 1.87 3.30 1.19 134 RELAYCOUNTRY_CA 3374 2.48 5.23 1.15 135 TooManyTo_005 3306 0.91 0.47 1.13 136 XMCapTrack 3278 0.87 0.36 1.12 137 T_FILL_THIS_FORM_SHORT 3221 1.34 1.84 1.10 138 XM_H_Long_From02 3123 1.07 1.08 1.07 139 TVD_SPACE_RATIO 3039 0.79 0.28 1.04 140 URI_HEX 3014 1.15 1.41 1.03 141 XMBrknScrpt_02 2920 1.23 1.72 1.00 142 DKIM_ADSP_CUSTOM_MED 2879 0.95 0.89 0.98 143 XM_UB50 2692 1.79 3.59 0.92 144 TR_XM_Base64_M1 2512 0.92 1.04 0.86 145 SpammyFromTLD_01 2504 1.28 2.16 0.86 146 TR_XM_DK_SendGrid 2462 0.83 0.80 0.84 147 XM_H_PHPMailer 2459 0.78 0.65 0.84 148 XMGappySubj_02 2435 0.57 0.03 0.83 149 T_TVD_MIME_NO_HEADERS 2404 0.56 0.02 0.82 150 XMGenDplmaNmb 2307 1.14 1.87 0.79 151 XM_ShortIntro_01 2271 0.74 0.66 0.78 152 T_Symld_Words_02 2262 0.80 0.87 0.77 153 XM_B_COPY_HTML 2261 0.95 1.33 0.77 154 T_OBFU_PDF_ATTACH 2192 0.56 0.15 0.75 155 T_XMDrugObfuBody_00 2168 1.04 1.67 0.74 156 RCVD_IN_PBL 2132 0.87 1.18 0.73 157 RELAYCOUNTRY_AU 2128 1.31 2.51 0.73 158 HTTPS_HTTP_MISMATCH 2105 0.78 0.90 0.72 159 XM_ProductURIs 2012 0.82 1.10 0.69 160 TVD_RCVD_IP 1964 0.75 0.93 0.67 161 XM_B_DNDMA 1873 0.82 1.21 0.64 162 SpammyFromTLD_02 1868 1.06 1.94 0.64 163 FORGED_GMAIL_RCVD 1850 0.64 0.66 0.63 164 NML_ADSP_CUSTOM_MED 1846 0.64 0.66 0.63 165 XMBody_95 1833 0.48 0.19 0.63 166 TR_MetaPhish_Combo_01 1800 0.74 1.01 0.61 167 RCVD_IN_PSBL 1727 1.59 3.68 0.59 168 T_TooManySym_04 1689 0.40 0.03 0.58 169 TO_NO_BRKTS_HTML_ONLY 1638 0.85 1.45 0.56 170 XMBdyGiftCard01 1633 0.91 1.64 0.56 171 XM_B_SpammyWords4 1609 1.00 1.94 0.55 172 T_XMHurry_00 1603 1.12 2.30 0.55 173 RELAYCOUNTRY_GB 1596 0.58 0.67 0.55 174 TR_XM_SpammyWords2 1587 4.00 11.19 0.54 175 XMLngstWrd_00 1567 0.54 0.55 0.54 176 XM_B_Phish66 1555 0.77 1.26 0.53 177 XM_B_FormFill 1554 0.37 0.02 0.53 178 HTML_TAG_BALANCE_BODY 1512 0.69 1.04 0.52 179 HTML_IMAGE_ONLY_20 1510 0.56 0.67 0.52 180 MPART_ALT_DIFF_COUNT 1495 0.65 0.93 0.51 181 RCVD_IN_BL_SPAMCOP_NET 1460 3.13 8.60 0.50 182 LongTLD 1434 0.69 1.11 0.49 183 XMSubNoVowel 1423 0.52 0.59 0.49 184 XMSubMetaI_00 1411 0.73 1.25 0.48 185 FILL_THIS_FORM 1411 0.40 0.23 0.48 186 XMBody_17 1381 1.02 2.15 0.47 187 XMSlimDrugH 1362 0.61 0.92 0.47 188 MSGID_FROM_MTA_HEADER 1324 0.34 0.12 0.45 189 XMPhish30 1324 0.88 1.76 0.45 190 XMBSHREFv2 1318 0.46 0.49 0.45 191 DIET_1 1313 0.85 1.68 0.45 192 XMLngstWrd_01 1303 0.45 0.46 0.45 193 TM2_M_OBFU_COMMENT 1299 0.73 1.32 0.44 194 USER_IN_WELCOMELIST 1284 0.30 0.00 0.44 195 USER_IN_WHITELIST 1284 0.30 0.00 0.44 196 SUBJ_DOLLARS 1281 0.45 0.47 0.44 197 PLING_QUERY 1269 0.60 0.96 0.43 198 URI_TRY_3LD 1236 0.71 1.30 0.42 199 XMDateMe_00 1213 0.41 0.40 0.41 200 TM2_M_BODY_EMPTY 1200 0.36 0.25 0.41 ----------------------------------------------------------------------