Email: 509556 Autolearn: 0 AvgScore: 4.77 AvgScanTime: 1.35 sec Spam: 133682 Autolearn: 0 AvgScore: 14.98 AvgScanTime: 1.38 sec Ham: 375874 Autolearn: 0 AvgScore: 1.15 AvgScanTime: 1.34 sec Time Spent Running SA: 191.31 hours Time Spent Processing Spam: 51.15 hours Time Spent Processing Ham: 140.16 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 124754 90.64 93.32 89.68 2 DKIM_SIGNED 117203 66.53 87.67 59.00 3 XM_DK_Pass 111496 64.53 83.40 57.81 4 XM_B_Unicode 110217 76.66 82.45 74.61 5 DKIM_VALID 110143 63.49 82.39 56.77 6 RELAYCOUNTRY_US 109584 83.64 81.97 84.24 7 DCC_CHECK 99932 41.79 74.75 30.07 8 XM_B_SpammyWords 91966 53.88 68.79 48.57 9 XMListUnsubscribeExists 88128 44.14 65.92 36.39 10 DKIM_VALID_AU 86151 50.50 64.44 45.54 11 XM_B_Unicode3 62653 40.90 46.87 38.78 12 LOC_TINY_FONT_1 62519 34.88 46.77 30.66 13 BAYES_50 53691 58.02 40.16 64.38 14 XM_B_SpammyWords2 53160 21.76 39.77 15.36 15 RCVD_IN_MSPIKE_H2 53116 31.39 39.73 28.42 16 XM_DK_Undo_02 51074 12.55 38.21 3.43 17 HTML_FONT_LOW_CONTRAST 46009 39.44 34.42 41.23 18 FVGT_m_MULTI_ODD 41545 24.02 31.08 21.51 19 T_KAM_HTML_FONT_INVALID 41237 19.95 30.85 16.07 20 BAYES_99 39406 9.55 29.48 2.46 21 DKIM_VALID_EF 39231 25.52 29.35 24.16 22 MIME_HTML_ONLY 39165 19.68 29.30 16.26 23 TR_XM_DKIM_Undo 36752 8.27 27.49 1.43 24 XMSubLong 31959 24.07 23.91 24.12 25 DCC_CHECK_NEGATIVE 31334 57.71 23.44 69.89 26 BAYES_999 29827 7.24 22.31 1.87 27 T_TM2_M_HEADER_IN_MSG 29537 39.83 22.09 46.14 28 TR_DCC_Bayes_99 28539 6.21 21.35 0.83 29 XM_Multi_Part_URI 26822 12.60 20.06 9.94 30 TR_XM_DK_Unsub 26402 12.58 19.75 10.03 31 XM_B_Unsub 24654 10.28 18.44 7.37 32 TR_XM_BayesUnsub 23649 8.77 17.69 5.59 33 UNPARSEABLE_RELAY 22065 11.48 16.51 9.69 34 RELAYCOUNTRY_META 22016 6.38 16.47 2.79 35 TR_MAX_INTL_RELAY 19811 7.30 14.82 4.62 36 XM_B_SpammyWords3 18862 6.46 14.11 3.74 37 LOTS_OF_MONEY 17899 7.26 13.39 5.07 38 TR_XM_SpammyRelay 16047 4.19 12.00 1.41 39 BOTNET_IPINHOSTNAME 15802 4.78 11.82 2.27 40 BOTNET 15582 3.79 11.66 0.99 41 FSL_BULK_SIG 15140 7.02 11.33 5.49 42 TR_XM_SpammyWords4 14383 5.30 10.76 3.36 43 TR_XM_SpammyWords2 13966 2.93 10.45 0.26 44 XM_Evil_Numbers_Gen 13149 17.78 9.84 20.61 45 BAYES_80 12369 4.43 9.25 2.71 46 XM_B_Phish_Phrases 12066 5.38 9.03 4.08 47 BAYES_60 11625 6.10 8.70 5.17 48 TR_XM_UnparsRelay 11063 3.06 8.28 1.20 49 RCVD_IN_BL_SPAMCOP_NET 10317 2.36 7.72 0.46 50 LotsOfNums_01 10235 17.95 7.66 21.61 51 XM_Body_Dirty_Words 8934 3.02 6.68 1.71 52 HTML_IMAGE_RATIO_02 8916 4.30 6.67 3.46 53 UNTRUSTED_Relay 8667 2.53 6.48 1.13 54 XMSubMetaSx_00 8659 4.05 6.48 3.19 55 RELAYCOUNTRY_CA 8415 2.28 6.29 0.85 56 MPART_ALT_DIFF 8186 4.00 6.12 3.25 57 XM_UncommonTLD01 8183 4.11 6.12 3.39 58 TR_XM_SPAMCOP 7923 1.73 5.93 0.24 59 XM_B_PhoneNumber 7547 8.60 5.65 9.66 60 XM_H_Long_From01 7434 4.86 5.56 4.61 61 XM_H_GMP 7246 5.08 5.42 4.96 62 DKIM_INVALID 7060 3.04 5.28 2.24 63 BAYES_95 6976 2.77 5.22 1.90 64 XMNumbers 6677 3.17 4.99 2.52 65 HTML_IMAGE_RATIO_04 6550 3.74 4.90 3.32 66 TR_XM_SpammyWords5 6341 2.26 4.74 1.37 67 XMSexyCombo_05 6140 2.22 4.59 1.37 68 TooManyTo_001 5904 6.53 4.42 7.28 69 TR_XM_PhishingBody 5902 1.99 4.41 1.13 70 TM2_M_VERY_LONG_WORD 5669 17.27 4.24 21.90 71 T_XMDrugObfuBody_14 5570 2.19 4.17 1.49 72 XMStrtUSub 5443 4.02 4.07 4.00 73 HTML_IMAGE_RATIO_06 5395 9.69 4.04 11.70 74 XM_B_Investor 5378 1.97 4.02 1.24 75 RCVD_IN_MSPIKE_WL 5186 4.24 3.88 4.37 76 RCVD_IN_MSPIKE_H3 5186 4.24 3.88 4.37 77 MIME_HTML_MOSTLY 4792 2.37 3.58 1.94 78 XM_CamelCaseFrm001 4522 2.25 3.38 1.84 79 XM_UB50 4309 1.34 3.22 0.67 80 XM_SPF_SoftFail 4308 1.71 3.22 1.17 81 MIME_HTML_ONLY_MULTI 4300 2.19 3.22 1.83 82 XM_B_SpammyTLD 4251 2.28 3.18 1.95 83 T_XMDrugObfuBody_08 4219 1.66 3.16 1.12 84 TR_XM_NoHeaderRelay 4203 0.93 3.14 0.15 85 XM_B_URI_Unicode 4162 2.03 3.11 1.65 86 XM_B_Unsub2 3969 1.80 2.97 1.39 87 HTML_IMAGE_RATIO_08 3864 2.01 2.89 1.70 88 SUBJ_ALL_CAPS 3863 1.85 2.89 1.48 89 MIME_QP_LONG_LINE 3805 3.47 2.85 3.70 90 XM_URI_RBL 3771 0.98 2.82 0.33 91 RCVD_IN_VALIDITY_RPBL 3731 0.77 2.79 0.05 92 RCVD_IN_VALIDITY_SAFE 3589 3.05 2.68 3.18 93 XMBody_17 3584 1.04 2.68 0.46 94 RELAYCOUNTRY_AU 3547 0.96 2.65 0.35 95 XM_OfRef6 3386 1.47 2.53 1.10 96 XM_B_SpammyWords4 3370 1.04 2.52 0.51 97 TM2_M_URI_OPT_OUT 3238 1.66 2.42 1.39 98 XMDiploma_00 3216 1.68 2.41 1.42 99 T_TooManySym_01 3205 4.05 2.40 4.64 100 RCVD_IN_VALIDITY_CERTIFIED 3196 2.44 2.39 2.46 101 T_XMHurry_00 3148 0.94 2.35 0.44 102 T_REMOTE_IMAGE 3133 2.72 2.34 2.86 103 ALL_TRUSTED 3061 10.55 2.29 13.49 104 MAILING_LIST_MULTI 2900 2.00 2.17 1.93 105 T_XMDrugObfuBody_00 2771 0.98 2.07 0.59 106 FROM_EXCESS_BASE64 2757 1.65 2.06 1.51 107 SpammyFromTLD_02 2710 0.65 2.03 0.16 108 BAYES_40 2702 5.95 2.02 7.35 109 DIET_1 2651 0.71 1.98 0.25 110 KHOP_HELO_FCRDNS 2644 8.94 1.98 11.42 111 DKIM_ADSP_NXDOMAIN 2500 0.70 1.87 0.28 112 HTML_MIME_NO_HTML_TAG 2491 2.22 1.86 2.34 113 TR_XM_INV_DKIM 2482 0.58 1.86 0.13 114 SpammyFromTLD_01 2476 1.00 1.85 0.70 115 RCVD_IN_ZEN_LASTEXTERNAL 2399 0.47 1.79 0.00 116 SHORTCIRCUIT 2399 0.47 1.79 0.00 117 ANY_BOUNCE_MESSAGE 2398 17.82 1.79 23.52 118 BOUNCE_MESSAGE 2398 17.82 1.79 23.52 119 T_FILL_THIS_FORM_SHORT 2287 1.10 1.71 0.89 120 XMBrknScrpt_02 2287 0.96 1.71 0.69 121 USER_IN_DEF_DKIM_WL 2220 7.70 1.66 9.84 122 XMStockSpam_06 2214 1.24 1.66 1.10 123 RCVD_IN_PSBL 2199 0.48 1.64 0.06 124 BAYES_20 2158 3.34 1.61 3.95 125 XM_SendGrid 2139 1.24 1.60 1.12 126 HTML_FONT_TINY_NORDNS 2132 0.45 1.59 0.05 127 URI_HEX 2019 1.17 1.51 1.06 128 MPART_ALT_DIFF_COUNT 2002 0.84 1.50 0.60 129 XMPhish30 1962 0.62 1.47 0.32 130 TR_Mismatch_TLD_01 1959 0.50 1.47 0.15 131 XM_H_Undi_Recip 1940 0.55 1.45 0.23 132 BOTNET_NORDNS 1924 0.38 1.44 0.01 133 XM_B_Phish66 1919 0.55 1.44 0.24 134 XMGenDplmaNmb 1874 0.96 1.40 0.81 135 XM_DK_Undo_01 1844 1.31 1.38 1.29 136 LongTLD 1830 0.61 1.37 0.35 137 URI_TRY_3LD 1771 0.80 1.32 0.61 138 RELAYCOUNTRY_RU 1738 0.35 1.30 0.01 139 HTML_TAG_BALANCE_BODY 1719 0.66 1.29 0.44 140 DEAR_SOMETHING 1697 0.35 1.27 0.02 141 TR_XM_PHPDW 1663 0.53 1.24 0.28 142 XM_B_SEO 1662 0.46 1.24 0.18 143 THIS_AD 1656 0.60 1.24 0.38 144 XM_H_Long_From02 1656 0.82 1.24 0.66 145 TR_XM_Base64_M1 1651 0.79 1.24 0.63 146 TR_LOTS_OF_MONEY3 1622 0.52 1.21 0.28 147 TR_XM_PHPForged 1617 0.52 1.21 0.28 148 TR_XM_FormFill2 1601 0.52 1.20 0.28 149 XMHTMLBadTable_001 1594 0.45 1.19 0.18 150 T_MONEY_PERCENT 1565 0.49 1.17 0.24 151 TR_LOTS_OF_MONEY2 1565 0.49 1.17 0.24 152 XM_H_PHPOS 1564 0.51 1.17 0.27 153 XM_ProductURIs 1553 0.59 1.16 0.38 154 TR_XM_Undi_Recip19 1549 0.37 1.16 0.09 155 XM_HighProb1 1544 0.31 1.15 0.01 156 TR_XM_Undi_RecipCombo2 1500 0.30 1.12 0.01 157 XM_B_COPY_HTML 1476 0.62 1.10 0.44 158 RCVD_IN_PBL 1472 0.72 1.10 0.59 159 TR_Mismatch_TLD_02 1462 0.32 1.09 0.05 160 SHOPIFY_IMG_NOT_RCVD_SFY 1457 0.42 1.09 0.18 161 XM_B_DNDMA 1457 0.52 1.09 0.32 162 HTTPS_HTTP_MISMATCH 1408 0.70 1.05 0.57 163 UNDISC_MONEY 1406 0.28 1.05 0.00 164 FILL_THIS_FORM 1405 0.66 1.05 0.52 165 TM2_M_OBFU_COMMENT 1403 0.50 1.05 0.31 166 XM_RXBody 1398 0.40 1.05 0.18 167 DKIM_ADSP_CUSTOM_MED 1393 0.87 1.04 0.81 168 TR_XM_SEO4 1384 0.35 1.04 0.10 169 TR_MetaPhish_Combo_01 1379 0.64 1.03 0.50 170 XMLngstWrd_00 1378 1.35 1.03 1.46 171 RCVD_IN_SORBS_DUL 1372 0.30 1.03 0.04 172 XMSexyCombo_01 1370 0.35 1.02 0.11 173 TR_Sbj_FN_Bdy 1368 0.35 1.02 0.11 174 BAYES_00 1360 7.59 1.02 9.93 175 URI_NOVOWEL 1355 1.25 1.01 1.33 176 XM_B_REG_HTML 1349 0.42 1.01 0.21 177 TR_XM_Undi_Recip5 1329 0.26 0.99 0.00 178 XMHTML_After_End 1295 0.45 0.97 0.27 179 RELAYCOUNTRY_FR 1288 0.40 0.96 0.20 180 TR_Symld_Words 1282 1.25 0.96 1.35 181 MultiRelay_CC 1281 0.31 0.96 0.07 182 RDNS_DYNAMIC 1273 0.44 0.95 0.26 183 HK_SCAM 1265 0.25 0.95 0.01 184 XMSlimDrugH 1262 0.61 0.94 0.49 185 XMBdyGiftCard01 1260 0.79 0.94 0.74 186 XMReplyNow 1256 0.43 0.94 0.25 187 XM_UB99 1254 0.25 0.94 0.01 188 FILL_THIS_FORM_LONG 1254 0.37 0.94 0.17 189 MONEY_FORM 1244 0.25 0.93 0.01 190 TR_XM_Undi_RecipCombo3 1233 0.24 0.92 0.00 191 PDS_RDNS_DYNAMIC_FP 1221 0.36 0.91 0.17 192 MONEY_FRAUD_5 1216 0.24 0.91 0.00 193 TR_XM_Undi_Recip2 1216 0.24 0.91 0.01 194 XM_UB60 1215 0.27 0.91 0.05 195 RCVD_IN_IADB_LISTED 1208 2.11 0.90 2.54 196 T_Symld_Words_02 1173 0.51 0.88 0.38 197 MAY_BE_FORGED 1171 15.71 0.88 20.99 198 XMClaimOffer 1154 0.33 0.86 0.14 199 FONT_INVIS_LONG_LINE 1153 0.28 0.86 0.07 200 XM_H_PHPMailer 1149 0.75 0.86 0.72 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 337083 90.64 93.32 89.68 2 RELAYCOUNTRY_US 316623 83.64 81.97 84.24 3 XM_B_Unicode 280432 76.66 82.45 74.61 4 DCC_CHECK_NEGATIVE 262713 57.71 23.44 69.89 5 BAYES_50 241973 58.02 40.16 64.38 6 DKIM_SIGNED 221784 66.53 87.67 59.00 7 XM_DK_Pass 217310 64.53 83.40 57.81 8 DKIM_VALID 213376 63.49 82.39 56.77 9 XM_B_SpammyWords 182571 53.88 68.79 48.57 10 T_TM2_M_HEADER_IN_MSG 173419 39.83 22.09 46.14 11 DKIM_VALID_AU 171162 50.50 64.44 45.54 12 HTML_FONT_LOW_CONTRAST 154984 39.44 34.42 41.23 13 XM_B_Unicode3 145747 40.90 46.87 38.78 14 XMListUnsubscribeExists 136795 44.14 65.92 36.39 15 LOC_TINY_FONT_1 115235 34.88 46.77 30.66 16 DCC_CHECK 113027 41.79 74.75 30.07 17 RCVD_IN_MSPIKE_H2 106829 31.39 39.73 28.42 18 DKIM_VALID_EF 90821 25.52 29.35 24.16 19 XMSubLong 90679 24.07 23.91 24.12 20 BOUNCE_MESSAGE 88414 17.82 1.79 23.52 21 ANY_BOUNCE_MESSAGE 88414 17.82 1.79 23.52 22 TM2_M_VERY_LONG_WORD 82311 17.27 4.24 21.90 23 LotsOfNums_01 81242 17.95 7.66 21.61 24 FVGT_m_MULTI_ODD 80852 24.02 31.08 21.51 25 MAY_BE_FORGED 78888 15.71 0.88 20.99 26 XM_Evil_Numbers_Gen 77475 17.78 9.84 20.61 27 MIME_HTML_ONLY 61102 19.68 29.30 16.26 28 T_KAM_HTML_FONT_INVALID 60413 19.95 30.85 16.07 29 XM_B_SpammyWords2 57728 21.76 39.77 15.36 30 ALL_TRUSTED 50711 10.55 2.29 13.49 31 HTML_IMAGE_RATIO_06 43981 9.69 4.04 11.70 32 KHOP_HELO_FCRDNS 42925 8.94 1.98 11.42 33 TR_XM_DK_Unsub 37716 12.58 19.75 10.03 34 XM_Multi_Part_URI 37365 12.60 20.06 9.94 35 BAYES_00 37336 7.59 1.02 9.93 36 USER_IN_DEF_DKIM_WL 36994 7.70 1.66 9.84 37 UNPARSEABLE_RELAY 36423 11.48 16.51 9.69 38 XM_B_PhoneNumber 36294 8.60 5.65 9.66 39 XM_B_Unsub 27713 10.28 18.44 7.37 40 BAYES_40 27631 5.95 2.02 7.35 41 TooManyTo_001 27352 6.53 4.42 7.28 42 TR_XM_DK_Bayes 22449 4.62 0.83 5.97 43 TR_XM_DK_Bayes1 21906 4.51 0.82 5.83 44 TR_XM_BayesUnsub 21029 8.77 17.69 5.59 45 FSL_BULK_SIG 20647 7.02 11.33 5.49 46 XM_DKIMWhitelistDomains 20297 4.04 0.21 5.40 47 IN_ZIMBRA_NJ_WHITELIST 19651 3.88 0.10 5.23 48 BAYES_60 19435 6.10 8.70 5.17 49 LOTS_OF_MONEY 19070 7.26 13.39 5.07 50 XM_H_GMP 18646 5.08 5.42 4.96 51 TR_XM_DK_Bayes2 18545 3.81 0.64 4.93 52 T_TooManySym_01 17433 4.05 2.40 4.64 53 TR_MAX_INTL_RELAY 17384 7.30 14.82 4.62 54 XM_H_Long_From01 17318 4.86 5.56 4.61 55 MIME_CHARSET_FARAWAY 16828 3.46 0.61 4.48 56 RCVD_IN_MSPIKE_WL 16444 4.24 3.88 4.37 57 RCVD_IN_MSPIKE_H3 16444 4.24 3.88 4.37 58 CHARSET_FARAWAY_HEADER 16363 3.31 0.38 4.35 59 XM_B_Phish_Phrases 15351 5.38 9.03 4.08 60 XMStrtUSub 15042 4.02 4.07 4.00 61 BAYES_20 14840 3.34 1.61 3.95 62 XM_PDF 14640 3.10 0.85 3.89 63 XM_B_SpammyWords3 14069 6.46 14.11 3.74 64 MIME_QP_LONG_LINE 13898 3.47 2.85 3.70 65 HTML_IMAGE_ONLY_32 13842 2.77 0.19 3.68 66 HTML_IMAGE_RATIO_02 12989 4.30 6.67 3.46 67 XM_DK_Undo_02 12882 12.55 38.21 3.43 68 XM_UncommonTLD01 12758 4.11 6.12 3.39 69 TR_XM_SpammyWords4 12616 5.30 10.76 3.36 70 HTML_IMAGE_RATIO_04 12485 3.74 4.90 3.32 71 MPART_ALT_DIFF 12206 4.00 6.12 3.25 72 XMSubMetaSx_00 11984 4.05 6.48 3.19 73 RCVD_IN_VALIDITY_SAFE 11965 3.05 2.68 3.18 74 T_REMOTE_IMAGE 10740 2.72 2.34 2.86 75 RELAYCOUNTRY_META 10472 6.38 16.47 2.79 76 TooManyTo_002 10324 2.17 0.55 2.75 77 BAYES_80 10202 4.43 9.25 2.71 78 RCVD_IN_IADB_LISTED 9536 2.11 0.90 2.54 79 XMNumbers 9476 3.17 4.99 2.52 80 T_TooManySym_02 9383 2.01 0.65 2.50 81 BAYES_99 9248 9.55 29.48 2.46 82 RCVD_IN_VALIDITY_CERTIFIED 9242 2.44 2.39 2.46 83 HTML_MIME_NO_HTML_TAG 8804 2.22 1.86 2.34 84 BOTNET_IPINHOSTNAME 8550 4.78 11.82 2.27 85 DKIM_INVALID 8408 3.04 5.28 2.24 86 RCVD_IN_IADB_SPF 8327 1.85 0.83 2.22 87 BAYES_05 8051 1.78 0.74 2.14 88 RCVD_IN_IADB_SENDERID 7390 1.66 0.80 1.97 89 XM_B_SpammyTLD 7346 2.28 3.18 1.95 90 MIME_HTML_MOSTLY 7290 2.37 3.58 1.94 91 MAILING_LIST_MULTI 7270 2.00 2.17 1.93 92 INVALID_MSGID 7214 1.48 0.23 1.92 93 RCVD_IN_IADB_DK 7170 1.62 0.81 1.91 94 BAYES_95 7152 2.77 5.22 1.90 95 BAYES_999 7047 7.24 22.31 1.87 96 XM_CamelCaseFrm001 6925 2.25 3.38 1.84 97 MIME_HTML_ONLY_MULTI 6881 2.19 3.22 1.83 98 RCVD_IN_IADB_VOUCHED 6598 1.38 0.33 1.76 99 XM_Body_Dirty_Words 6436 3.02 6.68 1.71 100 HTML_IMAGE_RATIO_08 6385 2.01 2.89 1.70 101 TO_MALFORMED 6297 1.25 0.06 1.68 102 XM_B_URI_Unicode 6193 2.03 3.11 1.65 103 FROM_EXCESS_BASE64 5673 1.65 2.06 1.51 104 T_XMDrugObfuBody_14 5605 2.19 4.17 1.49 105 SUBJ_ALL_CAPS 5567 1.85 2.89 1.48 106 TooManyTo_003 5539 1.21 0.46 1.47 107 XMLngstWrd_00 5495 1.35 1.03 1.46 108 TR_XM_DKIM_Undo 5382 8.27 27.49 1.43 109 XMDiploma_00 5349 1.68 2.41 1.42 110 TR_XM_SpammyRelay 5293 4.19 12.00 1.41 111 XM_B_Unsub2 5221 1.80 2.97 1.39 112 TM2_M_URI_OPT_OUT 5213 1.66 2.42 1.39 113 XMSexyCombo_05 5168 2.22 4.59 1.37 114 TR_XM_SpammyWords5 5152 2.26 4.74 1.37 115 TR_Symld_Words 5063 1.25 0.96 1.35 116 URI_NOVOWEL 4991 1.25 1.01 1.33 117 XM_DK_Undo_01 4843 1.31 1.38 1.29 118 RCVD_IN_IADB_OPTIN 4774 0.99 0.21 1.27 119 XM_B_Investor 4643 1.97 4.02 1.24 120 TR_XM_UnparsRelay 4524 3.06 8.28 1.20 121 XM_SPF_SoftFail 4383 1.71 3.22 1.17 122 IN_HORDE_ADDRESS_BOOK 4380 0.89 0.12 1.17 123 HELO_NODOT 4375 0.96 0.40 1.16 124 HELO_NO_DOMAIN 4374 0.96 0.40 1.16 125 UNTRUSTED_Relay 4242 2.53 6.48 1.13 126 TR_XM_PhishingBody 4237 1.99 4.41 1.13 127 T_XMDrugObfuBody_08 4219 1.66 3.16 1.12 128 XM_SendGrid 4204 1.24 1.60 1.12 129 XMCapTrack 4157 0.93 0.44 1.11 130 XMStockSpam_06 4128 1.24 1.66 1.10 131 XM_OfRef6 4126 1.47 2.53 1.10 132 TooManyTo_004 4086 0.90 0.39 1.09 133 URI_HEX 3968 1.17 1.51 1.06 134 TVD_SPACE_RATIO 3887 0.82 0.20 1.03 135 BOTNET 3716 3.79 11.66 0.99 136 T_TooManySym_03 3623 0.77 0.21 0.96 137 TooManyTo_005 3421 0.76 0.36 0.91 138 T_FILL_THIS_FORM_SHORT 3333 1.10 1.71 0.89 139 RELAYCOUNTRY_CA 3187 2.28 6.29 0.85 140 XMGappySubj_01 3163 0.67 0.17 0.84 141 TR_DCC_Bayes_99 3123 6.21 21.35 0.83 142 XM_GoogleGroups 3105 0.82 0.80 0.83 143 DKIM_ADSP_CUSTOM_MED 3036 0.87 1.04 0.81 144 XMGenDplmaNmb 3034 0.96 1.40 0.81 145 TR_XM_DK_SendGrid 2931 0.78 0.77 0.78 146 XMSubMetaSxObfu_03 2821 0.74 0.72 0.75 147 XMBdyGiftCard01 2781 0.79 0.94 0.74 148 XM_H_PHPMailer 2697 0.75 0.86 0.72 149 XM_ShortIntro_01 2670 0.64 0.45 0.71 150 XMSubMetaI_00 2652 0.74 0.83 0.71 151 SpammyFromTLD_01 2638 1.00 1.85 0.70 152 XMBrknScrpt_02 2609 0.96 1.71 0.69 153 XM_UB50 2512 1.34 3.22 0.67 154 XM_H_Long_From02 2498 0.82 1.24 0.66 155 TR_XM_Base64_M1 2366 0.79 1.24 0.63 156 URI_TRY_3LD 2296 0.80 1.32 0.61 157 XM_B_FormFill 2283 0.46 0.05 0.61 158 MPART_ALT_DIFF_COUNT 2254 0.84 1.50 0.60 159 T_XMDrugObfuBody_00 2219 0.98 2.07 0.59 160 RCVD_IN_PBL 2213 0.72 1.10 0.59 161 HTTPS_HTTP_MISMATCH 2161 0.70 1.05 0.57 162 T_OBFU_PDF_ATTACH 2158 0.48 0.21 0.57 163 FROM_GOV_DKIM_AU 2079 0.47 0.24 0.55 164 NML_ADSP_CUSTOM_MED 2055 0.61 0.77 0.55 165 TVD_RCVD_IP 2000 0.58 0.71 0.53 166 FILL_THIS_FORM 1963 0.66 1.05 0.52 167 XMNoVowels 1940 0.59 0.80 0.52 168 XM_B_SpammyWords4 1921 1.04 2.52 0.51 169 TO_NO_BRKTS_HTML_ONLY 1912 0.49 0.43 0.51 170 FORGED_GMAIL_RCVD 1895 0.57 0.77 0.50 171 TR_MetaPhish_Combo_01 1883 0.64 1.03 0.50 172 XMGappySubj_02 1866 0.39 0.07 0.50 173 XMSlimDrugH 1828 0.61 0.94 0.49 174 MSGID_FROM_MTA_HEADER 1780 0.40 0.20 0.47 175 RCVD_IN_BL_SPAMCOP_NET 1719 2.36 7.72 0.46 176 XMBody_17 1719 1.04 2.68 0.46 177 HTML_IMAGE_ONLY_20 1716 0.49 0.59 0.46 178 XM_B_COPY_HTML 1662 0.62 1.10 0.44 179 T_XMHurry_00 1652 0.94 2.35 0.44 180 XMLngstWrd_01 1650 0.54 0.81 0.44 181 HTML_TAG_BALANCE_BODY 1642 0.66 1.29 0.44 182 XMBody_95 1528 0.34 0.16 0.41 183 T_TVD_MIME_NO_HEADERS 1517 0.31 0.04 0.40 184 XM_ProductURIs 1444 0.59 1.16 0.38 185 T_Symld_Words_02 1443 0.51 0.88 0.38 186 XMDateMe_00 1433 0.41 0.51 0.38 187 MISSING_HEADERS 1428 0.44 0.61 0.38 188 THIS_AD 1422 0.60 1.24 0.38 189 XMMoneyMeta_00 1400 0.47 0.73 0.37 190 RELAYCOUNTRY_GB 1346 0.42 0.61 0.36 191 RELAYCOUNTRY_AU 1329 0.96 2.65 0.35 192 TM2_M_BODY_EMPTY 1308 0.29 0.11 0.35 193 LongTLD 1302 0.61 1.37 0.35 194 SHORT_HELO_AND_INLINE_IMAGE 1293 0.26 0.03 0.34 195 XMPhish14 1291 0.44 0.73 0.34 196 URI_DOTEDU 1283 0.30 0.18 0.34 197 XMBSHREFv2 1266 0.37 0.48 0.34 198 XM_URI_RBL 1241 0.98 2.82 0.33 199 USER_IN_WHITELIST 1239 0.24 0.00 0.33 200 USER_IN_WELCOMELIST 1239 0.24 0.00 0.33 ----------------------------------------------------------------------