Email: 304069 Autolearn: 0 AvgScore: 4.42 AvgScanTime: 1.32 sec Spam: 96367 Autolearn: 0 AvgScore: 13.52 AvgScanTime: 1.39 sec Ham: 207702 Autolearn: 0 AvgScore: 0.20 AvgScanTime: 1.29 sec Time Spent Running SA: 111.48 hours Time Spent Processing Spam: 37.10 hours Time Spent Processing Ham: 74.38 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 89515 78.47 92.89 71.78 2 HTML_MESSAGE 89203 86.77 92.57 84.08 3 XM_DK_Pass 86436 76.79 89.69 70.81 4 DKIM_VALID 85860 76.25 89.10 70.29 5 XM_B_Unicode 84915 74.91 88.12 68.78 6 RELAYCOUNTRY_US 82683 82.32 85.80 80.71 7 DCC_CHECK 76090 53.75 78.96 42.05 8 XMListUnsubscribeExists 66899 55.07 69.42 48.41 9 DKIM_VALID_AU 66159 62.13 68.65 59.11 10 XM_B_SpammyWords 64915 52.61 67.36 45.77 11 XM_B_Unicode3 52808 48.32 54.80 45.31 12 LOC_TINY_FONT_1 47872 36.34 49.68 30.15 13 XM_DK_Undo_02 44736 17.98 46.42 4.78 14 RCVD_IN_MSPIKE_H2 42042 38.10 43.63 35.54 15 BAYES_50 38399 55.00 39.85 62.03 16 HTML_FONT_LOW_CONTRAST 36649 34.49 38.03 32.85 17 XM_B_SpammyWords2 36525 25.98 37.90 20.45 18 FVGT_m_MULTI_ODD 35002 27.41 36.32 23.27 19 BAYES_99 31319 12.69 32.50 3.49 20 DKIM_VALID_EF 30799 29.39 31.96 28.20 21 TR_XM_DKIM_Undo 29595 11.02 30.71 1.88 22 T_KAM_HTML_FONT_INVALID 29422 23.64 30.53 20.44 23 MIME_HTML_ONLY 25399 23.83 26.36 22.66 24 BAYES_999 24066 9.71 24.97 2.63 25 TR_DCC_Bayes_99 23073 8.35 23.94 1.12 26 XM_Multi_Part_URI 20460 16.19 21.23 13.86 27 DCC_CHECK_NEGATIVE 19733 46.05 20.48 57.92 28 TR_XM_DK_Unsub 19255 15.13 19.98 12.88 29 XMSubLong 18645 23.04 19.35 24.75 30 T_TM2_M_HEADER_IN_MSG 18180 23.75 18.87 26.02 31 UNPARSEABLE_RELAY 18026 14.79 18.71 12.98 32 XM_B_Unsub 16399 12.07 17.02 9.77 33 TR_XM_BayesUnsub 15943 10.19 16.54 7.24 34 TR_MAX_INTL_RELAY 14936 8.77 15.50 5.64 35 XM_B_SpammyWords3 14891 8.47 15.45 5.22 36 RELAYCOUNTRY_META 13954 6.58 14.48 2.92 37 FSL_BULK_SIG 12979 10.27 13.47 8.79 38 RCVD_IN_BL_SPAMCOP_NET 12661 4.72 13.14 0.82 39 LOTS_OF_MONEY 11899 7.88 12.35 5.80 40 TR_XM_SpammyWords2 11368 4.02 11.80 0.42 41 TR_XM_SpammyRelay 10482 4.55 10.88 1.61 42 TR_XM_UnparsRelay 9799 4.46 10.17 1.82 43 BAYES_80 9376 5.40 9.73 3.39 44 TR_XM_PhishingBody 8896 4.00 9.23 1.57 45 BOTNET_IPINHOSTNAME 8732 5.06 9.06 3.21 46 BOTNET 8611 3.52 8.94 1.01 47 BAYES_60 8024 7.02 8.33 6.41 48 XM_Evil_Numbers_Gen 7536 9.92 7.82 10.89 49 TR_XM_SpammyWords4 7343 5.25 7.62 4.16 50 RCVD_IN_VALIDITY_RPBL 6881 2.41 7.14 0.22 51 XM_B_Phish_Phrases 6782 5.17 7.04 4.30 52 HTML_IMAGE_RATIO_02 6679 5.44 6.93 4.74 53 TR_XM_SPAMCOP 6584 2.53 6.83 0.53 54 RELAYCOUNTRY_CA 6323 2.78 6.56 1.03 55 LotsOfNums_01 6310 9.23 6.55 10.48 56 XM_Body_Dirty_Words 6155 3.98 6.39 2.87 57 XMSubMetaSx_00 5731 4.32 5.95 3.57 58 XM_UncommonTLD01 5567 5.86 5.78 5.90 59 MPART_ALT_DIFF 5535 4.96 5.74 4.60 60 BAYES_95 5266 3.27 5.46 2.24 61 XM_H_Long_From01 5184 5.13 5.38 5.01 62 XM_SendGrid 5015 2.65 5.20 1.46 63 XM_H_GMP 4993 5.36 5.18 5.45 64 HTML_IMAGE_RATIO_04 4922 4.52 5.11 4.25 65 XM_B_Phish66 4902 1.91 5.09 0.43 66 TR_LOTS_OF_MONEY3 4830 1.84 5.01 0.37 67 T_XMDrugObfuBody_14 4173 3.33 4.33 2.86 68 XMStrtUSub 4158 6.01 4.31 6.80 69 XMLngstWrd_00 4093 1.67 4.25 0.48 70 UNTRUSTED_Relay 3959 2.28 4.11 1.43 71 XMLngstWrd_01 3955 1.57 4.10 0.40 72 XMLngstWrd_02 3916 1.51 4.06 0.33 73 XMLngstWrd_03 3878 1.46 4.02 0.27 74 XM_B_PhoneNumber 3795 5.71 3.94 6.53 75 DKIM_INVALID 3655 2.22 3.79 1.48 76 TM2_M_VERY_LONG_WORD 3577 5.23 3.71 5.93 77 XM_CamelCaseFrm001 3436 2.56 3.57 2.09 78 XM_B_SpammyTLD 3419 2.60 3.55 2.16 79 MIME_HTML_MOSTLY 3334 2.67 3.46 2.30 80 XMSexyCombo_05 3289 2.38 3.41 1.90 81 MIME_HTML_ONLY_MULTI 3288 2.99 3.41 2.79 82 TR_XM_SpammyWords5 3275 1.85 3.40 1.13 83 XM_B_Investor 3254 2.01 3.38 1.37 84 HTML_IMAGE_RATIO_06 3069 3.32 3.18 3.38 85 TooManyTo_001 3020 5.22 3.13 6.19 86 HTML_IMAGE_RATIO_08 2911 2.32 3.02 2.00 87 T_FILL_THIS_FORM_SHORT 2890 1.55 3.00 0.88 88 XMBody_17 2603 1.16 2.70 0.44 89 RCVD_IN_MSPIKE_WL 2586 3.96 2.68 4.55 90 RCVD_IN_MSPIKE_H3 2586 3.96 2.68 4.55 91 XMPhish30 2578 1.30 2.68 0.66 92 XM_SPF_SoftFail 2547 1.46 2.64 0.91 93 RELAYCOUNTRY_AU 2537 1.11 2.63 0.40 94 RCVD_IN_VALIDITY_SAFE 2489 4.07 2.58 4.76 95 XMDiploma_00 2437 1.62 2.53 1.19 96 XM_OfRef6 2378 1.46 2.47 1.00 97 TM2_M_URI_OPT_OUT 2301 1.80 2.39 1.52 98 SUBJ_ALL_CAPS 2267 1.80 2.35 1.55 99 TR_XM_NoHeaderRelay 2178 0.84 2.26 0.18 100 XMNumbers 2163 3.04 2.24 3.41 101 XM_B_Unsub2 2161 1.44 2.24 1.07 102 RCVD_IN_VALIDITY_CERTIFIED 2147 3.19 2.23 3.64 103 T_XMHurry_00 2130 1.10 2.21 0.58 104 T_XMDrugObfuBody_08 2089 1.82 2.17 1.66 105 XMLngstWrd_04 2074 0.81 2.15 0.19 106 T_TooManySym_01 2008 5.49 2.08 7.08 107 XM_B_SpammyWords4 2002 1.20 2.08 0.80 108 T_XMDrugObfuBody_00 1968 1.12 2.04 0.69 109 USER_IN_DEF_DKIM_WL 1947 11.21 2.02 15.48 110 FROM_EXCESS_BASE64 1944 2.03 2.02 2.04 111 DIET_1 1928 0.99 2.00 0.53 112 MAILING_LIST_MULTI 1926 1.98 2.00 1.98 113 XM_URI_RBL 1873 0.85 1.94 0.35 114 SpammyFromTLD_01 1840 1.19 1.91 0.86 115 MIME_QP_LONG_LINE 1779 2.87 1.85 3.34 116 T_REMOTE_IMAGE 1775 2.93 1.84 3.44 117 SpammyFromTLD_02 1698 0.70 1.76 0.21 118 XMStockSpam_06 1690 2.04 1.75 2.17 119 XM_UB50 1626 1.11 1.69 0.84 120 XM_B_URI_Unicode 1578 1.58 1.64 1.55 121 XMBrknScrpt_02 1575 1.24 1.63 1.06 122 TR_XM_INV_DKIM 1570 0.65 1.63 0.20 123 SHOPIFY_IMG_NOT_RCVD_SFY 1567 0.77 1.63 0.37 124 HTML_MIME_NO_HTML_TAG 1463 2.65 1.52 3.18 125 XM_DK_Undo_01 1463 1.20 1.52 1.06 126 XMBdyGiftCard01 1451 0.99 1.51 0.75 127 KHOP_HELO_FCRDNS 1450 2.96 1.50 3.63 128 LongTLD 1432 0.71 1.49 0.34 129 BAYES_40 1429 4.66 1.48 6.13 130 HTML_FONT_TINY_NORDNS 1428 0.50 1.48 0.04 131 TR_XM_PHPDW 1406 0.61 1.46 0.21 132 ALL_TRUSTED 1405 11.70 1.46 16.45 133 TR_XM_PHPForged 1396 0.61 1.45 0.22 134 TR_XM_FormFill2 1371 0.60 1.42 0.22 135 XM_H_PHPOS 1352 0.58 1.40 0.20 136 HTML_TAG_BALANCE_BODY 1348 0.97 1.40 0.78 137 HK_RANDOM_REPLYTO 1285 0.50 1.33 0.11 138 MPART_ALT_DIFF_COUNT 1263 0.80 1.31 0.56 139 RCVD_IN_PSBL 1235 0.52 1.28 0.17 140 XM_B_COPY_HTML 1228 1.00 1.27 0.88 141 XMReplyNow 1164 0.52 1.21 0.20 142 URI_HEX 1163 1.07 1.21 1.01 143 DKIM_ADSP_NXDOMAIN 1120 0.65 1.16 0.41 144 TM2_M_OBFU_COMMENT 1089 0.64 1.13 0.41 145 XM_H_Long_From02 1051 0.81 1.09 0.67 146 T_STY_INVIS_DIRECT 1035 0.87 1.07 0.78 147 XM_ProductURIs 1032 0.74 1.07 0.59 148 BAYES_20 1032 3.22 1.07 4.21 149 FONT_INVIS_LONG_LINE 1006 0.40 1.04 0.10 150 RDNS_DYNAMIC 1006 0.53 1.04 0.29 151 RCVD_IN_PBL 1003 0.67 1.04 0.50 152 HOSTED_IMG_MULTI_PUB_01 989 0.34 1.03 0.03 153 TVD_RCVD_IP 987 0.88 1.02 0.81 154 PDS_RDNS_DYNAMIC_FP 974 0.40 1.01 0.12 155 URI_NOVOWEL 967 1.51 1.00 1.74 156 XM_B_DNDMA 965 0.76 1.00 0.65 157 XM_B_REG_HTML 962 0.46 1.00 0.21 158 URI_TRY_3LD 950 0.61 0.99 0.44 159 XMSubMetaI_00 949 0.59 0.98 0.41 160 BOTNET_NORDNS 934 0.31 0.97 0.01 161 DKIM_ADSP_CUSTOM_MED 931 0.77 0.97 0.68 162 TR_Mismatch_TLD_01 926 0.44 0.96 0.19 163 TR_XM_SEO4 881 0.34 0.91 0.07 164 TR_XM_RelayPhish 878 0.34 0.91 0.08 165 TR_XM_DK_SendGrid 871 1.00 0.90 1.04 166 XM_UB99 867 0.29 0.90 0.00 167 XM_B_SEO 865 0.43 0.90 0.21 168 SUSP_UTF8_WORD_SUBJ 854 0.29 0.89 0.02 169 XMGenDplmaNmb 842 0.58 0.87 0.45 170 TR_Mismatch_TLD_02 839 0.34 0.87 0.09 171 J_POPCORN_WO_D 832 0.44 0.86 0.24 172 XMBody_78 827 0.43 0.86 0.24 173 XMClaimOffer 782 0.43 0.81 0.25 174 XM_DIRTYINTL 767 0.31 0.80 0.08 175 XMNoVowels 761 0.88 0.79 0.91 176 NML_ADSP_CUSTOM_MED 759 0.53 0.79 0.41 177 TR_Caps_n_Bayes_99 758 0.25 0.79 0.00 178 HTTPS_HTTP_MISMATCH 753 0.50 0.78 0.37 179 TR_XM_Base64_M1 748 0.72 0.78 0.69 180 FORGED_GMAIL_RCVD 747 0.55 0.78 0.45 181 RELAYCOUNTRY_GB 747 0.45 0.78 0.30 182 TR_Symld_Words 738 1.70 0.77 2.13 183 T_MONEY_PERCENT 729 0.39 0.76 0.22 184 TR_LOTS_OF_MONEY2 729 0.39 0.76 0.22 185 XMSubMetaSxObfu_03 726 0.95 0.75 1.05 186 HTML_FONT_FACE_BAD 720 0.51 0.75 0.40 187 ANY_BOUNCE_MESSAGE 719 6.25 0.75 8.81 188 BOUNCE_MESSAGE 719 6.25 0.75 8.81 189 DEAR_SOMETHING 717 0.27 0.74 0.04 190 RCVD_IN_XBL 707 0.24 0.73 0.02 191 MultiRelay_CC 700 0.29 0.73 0.09 192 XM_TLDProd2 693 0.44 0.72 0.31 193 HELO_DYNAMIC_SPLIT_IP 689 0.23 0.71 0.01 194 XMSlimDrugH 689 0.53 0.71 0.44 195 XM_HighProb1 687 0.23 0.71 0.01 196 TR_XM_InvalidRelay 679 0.23 0.70 0.01 197 TM2_M_A_HREF_HREF 673 0.33 0.70 0.16 198 TR_XM_Base64_L1 673 0.30 0.70 0.11 199 XMSexyCombo_01 672 0.81 0.70 0.87 200 TR_MetaPhish_Combo_01 670 0.64 0.70 0.61 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 174628 86.77 92.57 84.08 2 RELAYCOUNTRY_US 167631 82.32 85.80 80.71 3 DKIM_SIGNED 149081 78.47 92.89 71.78 4 XM_DK_Pass 147067 76.79 89.69 70.81 5 DKIM_VALID 146000 76.25 89.10 70.29 6 XM_B_Unicode 142853 74.91 88.12 68.78 7 BAYES_50 128839 55.00 39.85 62.03 8 DKIM_VALID_AU 122763 62.13 68.65 59.11 9 DCC_CHECK_NEGATIVE 120303 46.05 20.48 57.92 10 XMListUnsubscribeExists 100546 55.07 69.42 48.41 11 XM_B_SpammyWords 95069 52.61 67.36 45.77 12 XM_B_Unicode3 94113 48.32 54.80 45.31 13 DCC_CHECK 87338 53.75 78.96 42.05 14 RCVD_IN_MSPIKE_H2 73822 38.10 43.63 35.54 15 HTML_FONT_LOW_CONTRAST 68226 34.49 38.03 32.85 16 LOC_TINY_FONT_1 62620 36.34 49.68 30.15 17 DKIM_VALID_EF 58571 29.39 31.96 28.20 18 T_TM2_M_HEADER_IN_MSG 54050 23.75 18.87 26.02 19 XMSubLong 51407 23.04 19.35 24.75 20 FVGT_m_MULTI_ODD 48336 27.41 36.32 23.27 21 MIME_HTML_ONLY 47066 23.83 26.36 22.66 22 XM_B_SpammyWords2 42483 25.98 37.90 20.45 23 T_KAM_HTML_FONT_INVALID 42451 23.64 30.53 20.44 24 ALL_TRUSTED 34174 11.70 1.46 16.45 25 USER_IN_DEF_DKIM_WL 32154 11.21 2.02 15.48 26 XM_Multi_Part_URI 28781 16.19 21.23 13.86 27 UNPARSEABLE_RELAY 26958 14.79 18.71 12.98 28 TR_XM_DK_Unsub 26759 15.13 19.98 12.88 29 XM_Evil_Numbers_Gen 22620 9.92 7.82 10.89 30 LotsOfNums_01 21757 9.23 6.55 10.48 31 XM_B_Unsub 20287 12.07 17.02 9.77 32 BAYES_00 19940 6.71 0.49 9.60 33 XM_DKIMWhitelistDomains 19124 6.50 0.67 9.21 34 ANY_BOUNCE_MESSAGE 18298 6.25 0.75 8.81 35 BOUNCE_MESSAGE 18297 6.25 0.75 8.81 36 FSL_BULK_SIG 18257 10.27 13.47 8.79 37 TR_XM_BayesUnsub 15040 10.19 16.54 7.24 38 T_TooManySym_01 14700 5.49 2.08 7.08 39 XMStrtUSub 14121 6.01 4.31 6.80 40 TR_XM_DK_Bayes 14065 4.75 0.40 6.77 41 TR_XM_DK_Bayes1 13892 4.69 0.40 6.69 42 XM_B_PhoneNumber 13568 5.71 3.94 6.53 43 BAYES_60 13322 7.02 8.33 6.41 44 TooManyTo_001 12867 5.22 3.13 6.19 45 BAYES_40 12726 4.66 1.48 6.13 46 TM2_M_VERY_LONG_WORD 12322 5.23 3.71 5.93 47 XM_UncommonTLD01 12261 5.86 5.78 5.90 48 TR_XM_DK_Bayes2 12076 4.06 0.29 5.81 49 LOTS_OF_MONEY 12052 7.88 12.35 5.80 50 TR_MAX_INTL_RELAY 11716 8.77 15.50 5.64 51 XM_H_GMP 11316 5.36 5.18 5.45 52 IN_ZIMBRA_NJ_WHITELIST 11132 3.69 0.10 5.36 53 XM_PDF 11115 3.87 0.68 5.35 54 XM_B_SpammyWords3 10850 8.47 15.45 5.22 55 XM_H_Long_From01 10412 5.13 5.38 5.01 56 XM_DK_Undo_02 9929 17.98 46.42 4.78 57 RCVD_IN_VALIDITY_SAFE 9886 4.07 2.58 4.76 58 HTML_IMAGE_RATIO_02 9850 5.44 6.93 4.74 59 MAY_BE_FORGED 9811 3.24 0.04 4.72 60 MPART_ALT_DIFF 9549 4.96 5.74 4.60 61 RCVD_IN_MSPIKE_H3 9449 3.96 2.68 4.55 62 RCVD_IN_MSPIKE_WL 9449 3.96 2.68 4.55 63 XM_B_Phish_Phrases 8933 5.17 7.04 4.30 64 HTML_IMAGE_RATIO_04 8823 4.52 5.11 4.25 65 BAYES_20 8753 3.22 1.07 4.21 66 TR_XM_SpammyWords4 8633 5.25 7.62 4.16 67 T_TooManySym_02 7929 2.78 0.56 3.82 68 RCVD_IN_VALIDITY_CERTIFIED 7558 3.19 2.23 3.64 69 KHOP_HELO_FCRDNS 7543 2.96 1.50 3.63 70 XMSubMetaSx_00 7409 4.32 5.95 3.57 71 BAYES_99 7258 12.69 32.50 3.49 72 T_REMOTE_IMAGE 7139 2.93 1.84 3.44 73 XMNumbers 7080 3.04 2.24 3.41 74 BAYES_80 7051 5.40 9.73 3.39 75 HTML_IMAGE_RATIO_06 7016 3.32 3.18 3.38 76 MIME_QP_LONG_LINE 6937 2.87 1.85 3.34 77 INVALID_MSGID 6711 2.28 0.24 3.23 78 BOTNET_IPINHOSTNAME 6660 5.06 9.06 3.21 79 HTML_MIME_NO_HTML_TAG 6600 2.65 1.52 3.18 80 TO_MALFORMED 6280 2.09 0.08 3.02 81 RELAYCOUNTRY_META 6067 6.58 14.48 2.92 82 XM_Body_Dirty_Words 5956 3.98 6.39 2.87 83 T_XMDrugObfuBody_14 5940 3.33 4.33 2.86 84 MIME_HTML_ONLY_MULTI 5794 2.99 3.41 2.79 85 TooManyTo_002 5530 2.01 0.60 2.66 86 BAYES_999 5472 9.71 24.97 2.63 87 MIME_CHARSET_FARAWAY 5372 1.96 0.62 2.59 88 BAYES_05 5147 1.86 0.53 2.48 89 RCVD_IN_IADB_LISTED 5130 1.88 0.62 2.47 90 MIME_HTML_MOSTLY 4774 2.67 3.46 2.30 91 BAYES_95 4662 3.27 5.46 2.24 92 CHARSET_FARAWAY_HEADER 4637 1.57 0.14 2.23 93 XMStockSpam_06 4500 2.04 1.75 2.17 94 RCVD_IN_IADB_SPF 4499 1.66 0.57 2.17 95 XM_B_SpammyTLD 4492 2.60 3.55 2.16 96 TR_Symld_Words 4427 1.70 0.77 2.13 97 XM_CamelCaseFrm001 4346 2.56 3.57 2.09 98 FROM_EXCESS_BASE64 4233 2.03 2.02 2.04 99 HTML_IMAGE_RATIO_08 4155 2.32 3.02 2.00 100 MAILING_LIST_MULTI 4109 1.98 2.00 1.98 101 RCVD_IN_IADB_SENDERID 4047 1.51 0.56 1.95 102 RCVD_IN_IADB_DK 3961 1.48 0.56 1.91 103 XMSexyCombo_05 3939 2.38 3.41 1.90 104 TR_XM_DKIM_Undo 3913 11.02 30.71 1.88 105 TR_XM_UnparsRelay 3773 4.46 10.17 1.82 106 URI_NOVOWEL 3623 1.51 1.00 1.74 107 T_XMDrugObfuBody_08 3452 1.82 2.17 1.66 108 RCVD_IN_IADB_VOUCHED 3388 1.20 0.26 1.63 109 IN_HORDE_ADDRESS_BOOK 3385 1.14 0.07 1.63 110 TR_XM_SpammyRelay 3351 4.55 10.88 1.61 111 TVD_SPACE_RATIO 3275 1.13 0.16 1.58 112 TR_XM_PhishingBody 3262 4.00 9.23 1.57 113 SUBJ_ALL_CAPS 3218 1.80 2.35 1.55 114 XM_B_URI_Unicode 3213 1.58 1.64 1.55 115 T_TooManySym_03 3171 1.11 0.20 1.53 116 TM2_M_URI_OPT_OUT 3158 1.80 2.39 1.52 117 T_TVD_MIME_NO_HEADERS 3106 1.04 0.05 1.50 118 DKIM_INVALID 3081 2.22 3.79 1.48 119 T_OBFU_PDF_ATTACH 3034 1.06 0.19 1.46 120 XM_SendGrid 3031 2.65 5.20 1.46 121 UNTRUSTED_Relay 2979 2.28 4.11 1.43 122 XM_B_Investor 2855 2.01 3.38 1.37 123 LOW_PRICE 2671 1.01 0.41 1.29 124 XMGappySubj_01 2547 0.97 0.41 1.23 125 XMDiploma_00 2481 1.62 2.53 1.19 126 RCVD_IN_IADB_OPTIN 2434 0.86 0.17 1.17 127 XM_B_FormFill 2407 0.80 0.01 1.16 128 TooManyTo_003 2404 0.95 0.51 1.16 129 TR_XM_SpammyWords5 2339 1.85 3.40 1.13 130 TR_DCC_Bayes_99 2319 8.35 23.94 1.12 131 XM_B_Unsub2 2213 1.44 2.24 1.07 132 XMBrknScrpt_02 2205 1.24 1.63 1.06 133 XM_DK_Undo_01 2199 1.20 1.52 1.06 134 XMSubMetaSxObfu_03 2177 0.95 0.75 1.05 135 TR_XM_DK_SendGrid 2155 1.00 0.90 1.04 136 RELAYCOUNTRY_CA 2135 2.78 6.56 1.03 137 URI_HEX 2100 1.07 1.21 1.01 138 BOTNET 2092 3.52 8.94 1.01 139 XM_OfRef6 2067 1.46 2.47 1.00 140 XMGappySubj_02 1990 0.67 0.04 0.96 141 HTML_EXTRA_CLOSE 1919 0.65 0.05 0.92 142 XMNoVowels 1900 0.88 0.79 0.91 143 XM_SPF_SoftFail 1897 1.46 2.64 0.91 144 T_FILL_THIS_FORM_SHORT 1834 1.55 3.00 0.88 145 XMSubMetaSx_01 1831 0.73 0.39 0.88 146 TM2_M_BODY_EMPTY 1830 0.63 0.09 0.88 147 XM_B_COPY_HTML 1826 1.00 1.27 0.88 148 XM_GoogleGroups 1813 0.81 0.69 0.87 149 XMSexyCombo_01 1805 0.81 0.70 0.87 150 SpammyFromTLD_01 1776 1.19 1.91 0.86 151 XM_UB50 1737 1.11 1.69 0.84 152 XM_H_PHPMailer 1710 0.78 0.67 0.82 153 RCVD_IN_BL_SPAMCOP_NET 1696 4.72 13.14 0.82 154 TVD_RCVD_IP 1680 0.88 1.02 0.81 155 XM_B_SpammyWords4 1659 1.20 2.08 0.80 156 TooManyTo_004 1648 0.68 0.44 0.79 157 GMD_PDF_EMPTY_BODY 1633 0.56 0.08 0.79 158 T_STY_INVIS_DIRECT 1623 0.87 1.07 0.78 159 HTML_TAG_BALANCE_BODY 1610 0.97 1.40 0.78 160 XMSexyCombo_04 1576 0.58 0.21 0.76 161 XMBody_95 1567 0.55 0.10 0.75 162 XMBdyGiftCard01 1558 0.99 1.51 0.75 163 XMSexyCombo_02 1556 0.57 0.18 0.75 164 TooManyTo_005 1473 0.62 0.42 0.71 165 T_XMDrugObfuBody_00 1442 1.12 2.04 0.69 166 TR_XM_Base64_M1 1431 0.72 0.78 0.69 167 DKIM_ADSP_CUSTOM_MED 1402 0.77 0.97 0.68 168 XM_H_Long_From02 1398 0.81 1.09 0.67 169 XMPhish30 1367 1.30 2.68 0.66 170 XM_B_DNDMA 1340 0.76 1.00 0.65 171 HELO_MISC_IP 1275 0.46 0.13 0.61 172 TR_MetaPhish_Combo_01 1268 0.64 0.70 0.61 173 XM_ProductURIs 1221 0.74 1.07 0.59 174 T_XMHurry_00 1214 1.10 2.21 0.58 175 USER_IN_WHITELIST 1184 0.39 0.00 0.57 176 USER_IN_WELCOMELIST 1184 0.39 0.00 0.57 177 XMBSHREFv2 1173 0.48 0.28 0.56 178 MPART_ALT_DIFF_COUNT 1170 0.80 1.31 0.56 179 PLING_QUERY 1136 0.59 0.67 0.55 180 FROM_GOV_DKIM_AU 1129 0.39 0.06 0.54 181 TR_XM_SPAMCOP 1107 2.53 6.83 0.53 182 DIET_1 1096 0.99 2.00 0.53 183 RCVD_IN_PBL 1038 0.67 1.04 0.50 184 XMSubEmpty 1034 0.39 0.17 0.50 185 XMLngstWrd_00 989 1.67 4.25 0.48 186 FILL_THIS_FORM 988 0.41 0.26 0.48 187 XM_ShortIntro_01 965 0.43 0.36 0.46 188 XMGenDplmaNmb 935 0.58 0.87 0.45 189 HTML_IMAGE_ONLY_28 934 0.36 0.17 0.45 190 FORGED_GMAIL_RCVD 933 0.55 0.78 0.45 191 URI_TRY_3LD 919 0.61 0.99 0.44 192 BASE64_LENGTH_79_INF 917 0.40 0.32 0.44 193 XMBody_17 913 1.16 2.70 0.44 194 XMSlimDrugH 911 0.53 0.71 0.44 195 T_TooManySym_04 910 0.31 0.04 0.44 196 HTML_IMAGE_ONLY_24 902 0.34 0.12 0.43 197 XMMoneyMeta_00 898 0.46 0.51 0.43 198 XM_B_Phish66 895 1.91 5.09 0.43 199 MISSING_SUBJECT 871 0.31 0.06 0.42 200 XMNoSubject 871 0.31 0.06 0.42 ----------------------------------------------------------------------