Email: 263901 Autolearn: 0 AvgScore: 4.72 AvgScanTime: 1.33 sec Spam: 86555 Autolearn: 0 AvgScore: 13.92 AvgScanTime: 1.37 sec Ham: 177346 Autolearn: 0 AvgScore: 0.24 AvgScanTime: 1.31 sec Time Spent Running SA: 97.66 hours Time Spent Processing Spam: 32.93 hours Time Spent Processing Ham: 64.74 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 82193 87.25 94.96 83.49 2 DKIM_SIGNED 77716 76.91 89.79 70.63 3 XM_DK_Pass 75114 75.22 86.78 69.57 4 DKIM_VALID 74596 74.65 86.18 69.02 5 XM_B_Unicode 73503 74.80 84.92 69.86 6 RELAYCOUNTRY_US 71800 80.88 82.95 79.87 7 DCC_CHECK 68680 56.94 79.35 46.00 8 XMListUnsubscribeExists 63125 57.57 72.93 50.07 9 XM_B_SpammyWords 60513 54.51 69.91 46.99 10 DKIM_VALID_AU 60135 62.68 69.48 59.37 11 XM_B_Unicode3 44371 48.30 51.26 46.85 12 LOC_TINY_FONT_1 42903 37.17 49.57 31.13 13 RCVD_IN_MSPIKE_H2 37230 37.33 43.01 34.56 14 XM_DK_Undo_02 36522 16.77 42.20 4.35 15 HTML_FONT_LOW_CONTRAST 33024 36.39 38.15 35.53 16 XM_B_SpammyWords2 32569 25.35 37.63 19.35 17 BAYES_50 31321 55.33 36.19 64.68 18 BAYES_99 29199 13.33 33.73 3.37 19 T_KAM_HTML_FONT_INVALID 28506 24.34 32.93 20.15 20 TR_XM_DKIM_Undo 26686 11.32 30.83 1.79 21 FVGT_m_MULTI_ODD 25968 26.69 30.00 25.07 22 DKIM_VALID_EF 23865 26.68 27.57 26.25 23 MIME_HTML_ONLY 23807 22.82 27.51 20.54 24 BAYES_999 22429 10.27 25.91 2.63 25 TR_DCC_Bayes_99 22228 9.35 25.68 1.38 26 XMSubLong 19239 22.14 22.23 22.10 27 XM_Multi_Part_URI 18914 18.40 21.85 16.72 28 TR_XM_DK_Unsub 17745 15.11 20.50 12.48 29 DCC_CHECK_NEGATIVE 17288 42.82 19.97 53.97 30 T_TM2_M_HEADER_IN_MSG 15870 24.57 18.34 27.62 31 TR_MAX_INTL_RELAY 14391 9.42 16.63 5.90 32 UNPARSEABLE_RELAY 14374 13.79 16.61 12.42 33 XM_B_Unsub 14184 11.32 16.39 8.85 34 RELAYCOUNTRY_META 14125 7.48 16.32 3.17 35 TR_XM_BayesUnsub 13707 9.84 15.84 6.91 36 XM_B_SpammyWords3 13346 9.16 15.42 6.11 37 TR_XM_SpammyWords2 10496 4.26 12.13 0.43 38 TR_XM_SpammyRelay 10189 4.98 11.77 1.67 39 BAYES_80 8795 5.77 10.16 3.62 40 BAYES_60 8540 7.81 9.87 6.81 41 RCVD_IN_BL_SPAMCOP_NET 8212 3.52 9.49 0.61 42 FSL_BULK_SIG 8004 8.57 9.25 8.24 43 TR_XM_UnparsRelay 7993 3.97 9.23 1.41 44 BOTNET_IPINHOSTNAME 7956 5.16 9.19 3.20 45 BOTNET 7867 3.70 9.09 1.07 46 HTML_IMAGE_RATIO_02 7209 6.44 8.33 5.52 47 LOTS_OF_MONEY 7072 6.30 8.17 5.38 48 XM_Body_Dirty_Words 6938 4.32 8.02 2.51 49 XM_Evil_Numbers_Gen 6745 11.00 7.79 12.56 50 RELAYCOUNTRY_CA 6728 3.31 7.77 1.14 51 TR_XM_SPAMCOP 6460 2.62 7.46 0.25 52 XMSubMetaSx_00 5784 4.36 6.68 3.23 53 TR_XM_SpammyWords4 5692 4.63 6.58 3.68 54 XM_UncommonTLD01 5569 5.43 6.43 4.94 55 LotsOfNums_01 5461 8.99 6.31 10.30 56 MPART_ALT_DIFF 5423 5.00 6.27 4.39 57 XM_B_Phish_Phrases 5304 5.46 6.13 5.13 58 BAYES_95 5169 3.48 5.97 2.26 59 UNTRUSTED_Relay 4978 3.08 5.75 1.77 60 XMSexyCombo_05 4563 2.53 5.27 1.19 61 XM_H_GMP 4551 5.99 5.26 6.34 62 XMStrtUSub 4542 5.22 5.25 5.21 63 HTML_IMAGE_RATIO_04 4392 5.17 5.07 5.22 64 T_XMDrugObfuBody_14 4152 2.91 4.80 1.99 65 XM_H_Long_From01 4058 5.43 4.69 5.79 66 MIME_HTML_MOSTLY 3917 3.32 4.53 2.74 67 RCVD_IN_MSPIKE_H3 3761 4.56 4.35 4.66 68 RCVD_IN_MSPIKE_WL 3761 4.56 4.35 4.66 69 TR_XM_PhishingBody 3625 2.69 4.19 1.96 70 XM_B_PhoneNumber 3577 5.16 4.13 5.66 71 HTML_IMAGE_RATIO_06 3362 3.45 3.88 3.24 72 DKIM_INVALID 3120 2.26 3.60 1.61 73 XM_CamelCaseFrm001 3107 3.18 3.59 2.97 74 TM2_M_VERY_LONG_WORD 3043 6.15 3.52 7.44 75 XM_B_SpammyTLD 2995 2.99 3.46 2.77 76 RCVD_IN_VALIDITY_SAFE 2844 5.16 3.29 6.07 77 XM_B_Investor 2838 1.88 3.28 1.20 78 DIET_1 2824 1.60 3.26 0.78 79 TooManyTo_001 2759 5.00 3.19 5.88 80 RCVD_IN_VALIDITY_RPBL 2752 1.06 3.18 0.02 81 TM2_M_URI_OPT_OUT 2735 2.10 3.16 1.58 82 XM_URI_RBL 2698 1.40 3.12 0.56 83 MIME_HTML_ONLY_MULTI 2669 2.75 3.08 2.58 84 XM_OfRef6 2637 1.69 3.05 1.02 85 XMBody_17 2495 1.46 2.88 0.76 86 T_XMHurry_00 2458 1.40 2.84 0.70 87 TR_XM_SpammyWords5 2422 1.54 2.80 0.92 88 RCVD_IN_VALIDITY_CERTIFIED 2335 4.17 2.70 4.89 89 XM_SPF_SoftFail 2265 1.41 2.62 0.82 90 XM_UB50 2250 1.54 2.60 1.03 91 T_FILL_THIS_FORM_SHORT 2246 1.54 2.59 1.03 92 HTML_IMAGE_RATIO_08 2203 2.25 2.55 2.10 93 RELAYCOUNTRY_AU 2153 1.10 2.49 0.42 94 XMNumbers 2142 3.17 2.47 3.51 95 FROM_EXCESS_BASE64 2134 2.48 2.47 2.49 96 T_XMDrugObfuBody_08 2125 2.18 2.46 2.05 97 TR_XM_NoHeaderRelay 2045 0.92 2.36 0.21 98 XM_B_URI_Unicode 1969 1.81 2.27 1.58 99 SpammyFromTLD_01 1953 1.22 2.26 0.71 100 RCVD_IN_PSBL 1894 0.82 2.19 0.16 101 XM_B_Unsub2 1867 1.53 2.16 1.23 102 XMSlimDrugH 1763 1.07 2.04 0.60 103 XM_B_SpammyWords4 1748 1.20 2.02 0.80 104 SUBJ_ALL_CAPS 1721 1.21 1.99 0.84 105 T_XMDrugObfuBody_00 1717 1.02 1.98 0.55 106 SpammyFromTLD_02 1701 0.73 1.97 0.13 107 MAILING_LIST_MULTI 1689 2.22 1.95 2.35 108 XMDiploma_00 1674 1.72 1.93 1.61 109 ALL_TRUSTED 1644 11.96 1.90 16.87 110 USER_IN_DEF_DKIM_WL 1614 12.27 1.86 17.35 111 XM_B_REG_HTML 1546 0.78 1.79 0.28 112 KHOP_HELO_FCRDNS 1521 2.94 1.76 3.52 113 XMBdyGiftCard01 1457 1.28 1.68 1.08 114 XM_B_COPY_HTML 1445 1.68 1.67 1.69 115 HTML_FONT_TINY_NORDNS 1427 0.58 1.65 0.05 116 SHOPIFY_IMG_NOT_RCVD_SFY 1377 0.77 1.59 0.37 117 TR_XM_PHPForged 1331 0.66 1.54 0.23 118 TR_XM_PHPDW 1331 0.65 1.54 0.22 119 XMStockSpam_06 1329 2.23 1.54 2.57 120 TR_XM_FormFill2 1324 0.65 1.53 0.22 121 TR_XM_INV_DKIM 1323 0.65 1.53 0.21 122 MIME_QP_LONG_LINE 1321 2.29 1.53 2.66 123 T_TooManySym_01 1302 5.25 1.50 7.07 124 XM_H_PHPOS 1296 0.63 1.50 0.21 125 XMPhish30 1275 1.02 1.47 0.81 126 XMReplyNow 1272 0.61 1.47 0.19 127 BOTNET_NORDNS 1268 0.49 1.46 0.01 128 XM_HighProb1 1265 0.49 1.46 0.01 129 XMSubMetaI_00 1262 0.89 1.46 0.62 130 XM_B_Phish66 1224 0.73 1.41 0.40 131 XM_RXBody 1222 0.73 1.41 0.40 132 HTML_MIME_NO_HTML_TAG 1172 1.71 1.35 1.88 133 LongTLD 1157 0.55 1.34 0.17 134 BAYES_40 1141 4.07 1.32 5.41 135 MPART_ALT_DIFF_COUNT 1126 0.82 1.30 0.59 136 URI_HEX 1112 1.05 1.28 0.93 137 TR_Mismatch_TLD_02 1105 0.46 1.28 0.06 138 XMWghtMeta_00 1075 0.42 1.24 0.02 139 RCVD_IN_PBL 1067 0.78 1.23 0.56 140 T_REMOTE_IMAGE 1026 2.12 1.19 2.57 141 T_STY_INVIS_DIRECT 1009 0.72 1.17 0.50 142 URI_TRY_3LD 1005 0.77 1.16 0.58 143 MultiRelay_CC 1001 0.47 1.16 0.13 144 XMClaimOffer 987 0.61 1.14 0.35 145 TR_LOTS_OF_MONEY3 977 0.51 1.13 0.21 146 HTML_FONT_FACE_BAD 947 0.61 1.09 0.38 147 T_Symld_Words_02 945 0.49 1.09 0.19 148 XM_UB99 937 0.36 1.08 0.01 149 XM_SendGrid 921 1.11 1.06 1.14 150 XM_DK_Undo_01 920 1.51 1.06 1.73 151 RDNS_DYNAMIC 913 0.54 1.05 0.29 152 RCVD_IN_XBL 908 0.35 1.05 0.01 153 DKIM_ADSP_NXDOMAIN 905 0.68 1.05 0.50 154 XMBrknScrpt_02 902 1.25 1.04 1.35 155 TR_XM_FormFill 889 0.34 1.03 0.00 156 LOW_PRICE 882 1.12 1.02 1.17 157 PDS_RDNS_DYNAMIC_FP 859 0.39 0.99 0.10 158 XM_DIRTYINTL 849 0.36 0.98 0.06 159 HOSTED_IMG_MULTI_PUB_01 846 0.33 0.98 0.01 160 URI_NOVOWEL 845 1.37 0.98 1.56 161 XMBody_78 830 0.51 0.96 0.30 162 XM_H_Long_From02 824 0.78 0.95 0.70 163 BAYES_20 819 2.58 0.95 3.37 164 XMSlimDrugs 814 0.33 0.94 0.03 165 TVD_RCVD_IP 807 0.94 0.93 0.95 166 XMSexyCombo_01 805 0.42 0.93 0.17 167 XM_H_PHPMailer 776 0.79 0.90 0.75 168 TR_MetaPhish_Combo_01 771 0.72 0.89 0.64 169 TR_XM_Base64_M1 763 0.76 0.88 0.70 170 SUSP_UTF8_WORD_SUBJ 755 0.29 0.87 0.01 171 XMHTML_After_End 748 0.51 0.86 0.34 172 ANY_BOUNCE_MESSAGE 740 6.92 0.85 9.88 173 BOUNCE_MESSAGE 740 6.92 0.85 9.88 174 TM2_M_OBFU_COMMENT 739 0.79 0.85 0.75 175 DKIM_ADSP_CUSTOM_MED 739 0.91 0.85 0.94 176 AC_HTML_NONSENSE_TAGS 736 0.33 0.85 0.08 177 HELO_DYNAMIC_SPLIT_IP 725 0.28 0.84 0.01 178 HTML_TAG_BALANCE_BODY 724 0.99 0.84 1.07 179 RCVD_IN_SBL_CSS 721 0.29 0.83 0.02 180 TR_Mismatch_TLD_01 720 0.41 0.83 0.21 181 TM2_M_A_HREF_HREF 709 0.39 0.82 0.18 182 TR_Symld_Words 685 1.00 0.79 1.10 183 XMGenDplmaNmb 682 0.61 0.79 0.53 184 XM_H_Undi_Recip 672 0.33 0.78 0.11 185 HTTPS_HTTP_MISMATCH 671 0.54 0.78 0.42 186 FONT_INVIS_LONG_LINE 650 0.33 0.75 0.12 187 XM_UB999 641 0.25 0.74 0.01 188 TR_XM_RelayPhish 638 0.28 0.74 0.06 189 XM_B_DNDMA 635 0.67 0.73 0.64 190 NML_ADSP_CUSTOM_MED 631 0.67 0.73 0.64 191 XM_Combo_Sbj 630 0.42 0.73 0.27 192 FROM_SUSPICIOUS_NTLD 620 0.26 0.72 0.03 193 T_XMDrugObfuBody_10 614 0.24 0.71 0.01 194 RELAYCOUNTRY_RU 609 0.24 0.70 0.02 195 XM_GoogleGroups 607 1.07 0.70 1.25 196 XM_ProductURIs 602 0.62 0.70 0.58 197 XMPhish14 598 0.57 0.69 0.50 198 HTML_IMAGE_ONLY_20 587 0.51 0.68 0.42 199 XM_OfRef7 587 0.41 0.68 0.28 200 FORGED_GMAIL_RCVD 578 0.65 0.67 0.64 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148067 87.25 94.96 83.49 2 RELAYCOUNTRY_US 141641 80.88 82.95 79.87 3 DKIM_SIGNED 125256 76.91 89.79 70.63 4 XM_B_Unicode 123893 74.80 84.92 69.86 5 XM_DK_Pass 123384 75.22 86.78 69.57 6 DKIM_VALID 122400 74.65 86.18 69.02 7 BAYES_50 114699 55.33 36.19 64.68 8 DKIM_VALID_AU 105289 62.68 69.48 59.37 9 DCC_CHECK_NEGATIVE 95717 42.82 19.97 53.97 10 XMListUnsubscribeExists 88795 57.57 72.93 50.07 11 XM_B_SpammyWords 83339 54.51 69.91 46.99 12 XM_B_Unicode3 83090 48.30 51.26 46.85 13 DCC_CHECK 81582 56.94 79.35 46.00 14 HTML_FONT_LOW_CONTRAST 63019 36.39 38.15 35.53 15 RCVD_IN_MSPIKE_H2 61283 37.33 43.01 34.56 16 LOC_TINY_FONT_1 55202 37.17 49.57 31.13 17 T_TM2_M_HEADER_IN_MSG 48982 24.57 18.34 27.62 18 DKIM_VALID_EF 46552 26.68 27.57 26.25 19 FVGT_m_MULTI_ODD 44469 26.69 30.00 25.07 20 XMSubLong 39189 22.14 22.23 22.10 21 MIME_HTML_ONLY 36421 22.82 27.51 20.54 22 T_KAM_HTML_FONT_INVALID 35731 24.34 32.93 20.15 23 XM_B_SpammyWords2 34322 25.35 37.63 19.35 24 USER_IN_DEF_DKIM_WL 30762 12.27 1.86 17.35 25 ALL_TRUSTED 29917 11.96 1.90 16.87 26 XM_Multi_Part_URI 29650 18.40 21.85 16.72 27 XM_Evil_Numbers_Gen 22279 11.00 7.79 12.56 28 TR_XM_DK_Unsub 22127 15.11 20.50 12.48 29 UNPARSEABLE_RELAY 22026 13.79 16.61 12.42 30 LotsOfNums_01 18260 8.99 6.31 10.30 31 ANY_BOUNCE_MESSAGE 17516 6.92 0.85 9.88 32 BOUNCE_MESSAGE 17516 6.92 0.85 9.88 33 XM_B_Unsub 15691 11.32 16.39 8.85 34 XM_DKIMWhitelistDomains 15555 5.93 0.12 8.77 35 BAYES_00 15391 6.03 0.61 8.68 36 FSL_BULK_SIG 14606 8.57 9.25 8.24 37 TM2_M_VERY_LONG_WORD 13195 6.15 3.52 7.44 38 HTML_IMAGE_ONLY_32 12744 4.87 0.13 7.19 39 T_TooManySym_01 12543 5.25 1.50 7.07 40 TR_XM_BayesUnsub 12258 9.84 15.84 6.91 41 BAYES_60 12082 7.81 9.87 6.81 42 TR_XM_DK_Bayes 11784 4.64 0.53 6.64 43 TR_XM_DK_Bayes1 11674 4.60 0.53 6.58 44 XM_H_GMP 11250 5.99 5.26 6.34 45 XM_B_SpammyWords3 10829 9.16 15.42 6.11 46 RCVD_IN_VALIDITY_SAFE 10762 5.16 3.29 6.07 47 MAY_BE_FORGED 10529 4.04 0.15 5.94 48 TR_MAX_INTL_RELAY 10456 9.42 16.63 5.90 49 TooManyTo_001 10426 5.00 3.19 5.88 50 XM_H_Long_From01 10262 5.43 4.69 5.79 51 TR_XM_DK_Bayes2 10191 3.97 0.34 5.75 52 XM_B_PhoneNumber 10034 5.16 4.13 5.66 53 HTML_IMAGE_RATIO_02 9783 6.44 8.33 5.52 54 BAYES_40 9587 4.07 1.32 5.41 55 LOTS_OF_MONEY 9541 6.30 8.17 5.38 56 HTML_IMAGE_RATIO_04 9254 5.17 5.07 5.22 57 XMStrtUSub 9242 5.22 5.25 5.21 58 XM_B_Phish_Phrases 9097 5.46 6.13 5.13 59 IN_ZIMBRA_NJ_WHITELIST 8982 3.42 0.06 5.06 60 XM_UncommonTLD01 8767 5.43 6.43 4.94 61 RCVD_IN_VALIDITY_CERTIFIED 8669 4.17 2.70 4.89 62 RCVD_IN_MSPIKE_WL 8266 4.56 4.35 4.66 63 RCVD_IN_MSPIKE_H3 8265 4.56 4.35 4.66 64 T_TooManySym_02 7789 3.09 0.43 4.39 65 MPART_ALT_DIFF 7782 5.00 6.27 4.39 66 XM_DK_Undo_02 7722 16.77 42.20 4.35 67 INVALID_MSGID 6622 2.70 0.60 3.73 68 TR_XM_SpammyWords4 6533 4.63 6.58 3.68 69 BAYES_80 6425 5.77 10.16 3.62 70 TO_MALFORMED 6282 2.40 0.05 3.54 71 KHOP_HELO_FCRDNS 6237 2.94 1.76 3.52 72 XMNumbers 6222 3.17 2.47 3.51 73 BAYES_99 5983 13.33 33.73 3.37 74 BAYES_20 5982 2.58 0.95 3.37 75 HTML_IMAGE_RATIO_06 5751 3.45 3.88 3.24 76 XMSubMetaSx_00 5733 4.36 6.68 3.23 77 BOTNET_IPINHOSTNAME 5668 5.16 9.19 3.20 78 RELAYCOUNTRY_META 5621 7.48 16.32 3.17 79 MIME_CHARSET_FARAWAY 5313 2.19 0.54 3.00 80 XM_CamelCaseFrm001 5274 3.18 3.59 2.97 81 CHARSET_FARAWAY_HEADER 5061 1.99 0.23 2.85 82 XM_B_SpammyTLD 4907 2.99 3.46 2.77 83 MIME_HTML_MOSTLY 4855 3.32 4.53 2.74 84 MIME_QP_LONG_LINE 4720 2.29 1.53 2.66 85 BAYES_999 4661 10.27 25.91 2.63 86 MIME_HTML_ONLY_MULTI 4576 2.75 3.08 2.58 87 T_REMOTE_IMAGE 4564 2.12 1.19 2.57 88 XMStockSpam_06 4564 2.23 1.54 2.57 89 XM_Body_Dirty_Words 4456 4.32 8.02 2.51 90 FROM_EXCESS_BASE64 4419 2.48 2.47 2.49 91 MAILING_LIST_MULTI 4168 2.22 1.95 2.35 92 BAYES_95 4012 3.48 5.97 2.26 93 TooManyTo_002 3950 1.70 0.61 2.23 94 HTML_IMAGE_RATIO_08 3731 2.25 2.55 2.10 95 XM_PDF 3659 1.58 0.60 2.06 96 T_XMDrugObfuBody_08 3634 2.18 2.46 2.05 97 T_XMDrugObfuBody_14 3529 2.91 4.80 1.99 98 TR_XM_PhishingBody 3483 2.69 4.19 1.96 99 HTML_MIME_NO_HTML_TAG 3330 1.71 1.35 1.88 100 T_TooManySym_03 3204 1.26 0.15 1.81 101 BAYES_05 3183 1.38 0.55 1.79 102 TR_XM_DKIM_Undo 3176 11.32 30.83 1.79 103 RCVD_IN_IADB_LISTED 3169 1.36 0.49 1.79 104 UNTRUSTED_Relay 3146 3.08 5.75 1.77 105 XM_DK_Undo_01 3070 1.51 1.06 1.73 106 XM_B_COPY_HTML 2991 1.68 1.67 1.69 107 TR_XM_SpammyRelay 2966 4.98 11.77 1.67 108 IN_HORDE_ADDRESS_BOOK 2932 1.16 0.16 1.65 109 XMGappySubj_01 2863 1.12 0.10 1.61 110 XMDiploma_00 2857 1.72 1.93 1.61 111 DKIM_INVALID 2856 2.26 3.60 1.61 112 RCVD_IN_IADB_SPF 2816 1.21 0.44 1.59 113 TM2_M_URI_OPT_OUT 2801 2.10 3.16 1.58 114 XM_B_URI_Unicode 2795 1.81 2.27 1.58 115 URI_NOVOWEL 2773 1.37 0.98 1.56 116 TVD_SPACE_RATIO 2706 1.09 0.19 1.53 117 RCVD_IN_IADB_SENDERID 2541 1.10 0.43 1.43 118 TR_XM_UnparsRelay 2492 3.97 9.23 1.41 119 T_TVD_MIME_NO_HEADERS 2477 0.95 0.04 1.40 120 RCVD_IN_IADB_DK 2475 1.08 0.44 1.40 121 TR_DCC_Bayes_99 2455 9.35 25.68 1.38 122 XMBrknScrpt_02 2392 1.25 1.04 1.35 123 XMGappySubj_02 2385 0.92 0.03 1.34 124 XM_GoogleGroups 2210 1.07 0.70 1.25 125 RCVD_IN_IADB_VOUCHED 2182 0.89 0.19 1.23 126 XM_B_Unsub2 2180 1.53 2.16 1.23 127 XM_B_Investor 2121 1.88 3.28 1.20 128 XMSexyCombo_05 2118 2.53 5.27 1.19 129 LOW_PRICE 2083 1.12 1.02 1.17 130 TooManyTo_003 2033 0.95 0.55 1.15 131 XM_SendGrid 2018 1.11 1.06 1.14 132 RELAYCOUNTRY_CA 2015 3.31 7.77 1.14 133 TR_Symld_Words 1945 1.00 0.79 1.10 134 XMBdyGiftCard01 1920 1.28 1.68 1.08 135 HTML_TAG_BALANCE_BODY 1898 0.99 0.84 1.07 136 BOTNET 1893 3.70 9.09 1.07 137 XM_UB50 1822 1.54 2.60 1.03 138 T_FILL_THIS_FORM_SHORT 1821 1.54 2.59 1.03 139 XM_OfRef6 1814 1.69 3.05 1.02 140 TVD_RCVD_IP 1683 0.94 0.93 0.95 141 DKIM_ADSP_CUSTOM_MED 1662 0.91 0.85 0.94 142 URI_HEX 1647 1.05 1.28 0.93 143 TR_XM_SpammyWords5 1630 1.54 2.80 0.92 144 RCVD_IN_IADB_OPTIN 1598 0.64 0.11 0.90 145 TR_XM_DK_SendGrid 1540 0.80 0.66 0.87 146 TooManyTo_004 1501 0.74 0.52 0.85 147 SUBJ_ALL_CAPS 1485 1.21 1.99 0.84 148 DATE_IN_PAST_06_12 1475 0.58 0.07 0.83 149 XM_SPF_SoftFail 1454 1.41 2.62 0.82 150 XMPhish30 1429 1.02 1.47 0.81 151 XM_B_SpammyWords4 1425 1.20 2.02 0.80 152 DIET_1 1386 1.60 3.26 0.78 153 XM_B_FormFill 1366 0.55 0.09 0.77 154 XMBody_17 1349 1.46 2.88 0.76 155 TM2_M_OBFU_COMMENT 1333 0.79 0.85 0.75 156 XM_H_PHPMailer 1322 0.79 0.90 0.75 157 TooManyTo_005 1289 0.65 0.50 0.73 158 SpammyFromTLD_01 1254 1.22 2.26 0.71 159 HELO_MISC_IP 1244 0.50 0.08 0.70 160 TR_XM_Base64_M1 1242 0.76 0.88 0.70 161 T_XMHurry_00 1234 1.40 2.84 0.70 162 XM_H_Long_From02 1234 0.78 0.95 0.70 163 USER_IN_WELCOMELIST 1155 0.44 0.00 0.65 164 USER_IN_WHITELIST 1155 0.44 0.00 0.65 165 XMBSHREFv2 1149 0.54 0.31 0.65 166 XMBody_95 1146 0.48 0.14 0.65 167 TR_MetaPhish_Combo_01 1140 0.72 0.89 0.64 168 NML_ADSP_CUSTOM_MED 1139 0.67 0.73 0.64 169 FORGED_GMAIL_RCVD 1139 0.65 0.67 0.64 170 XM_B_DNDMA 1135 0.67 0.73 0.64 171 XMNoVowels 1124 0.63 0.61 0.63 172 XMSubMetaI_00 1092 0.89 1.46 0.62 173 RCVD_IN_BL_SPAMCOP_NET 1088 3.52 9.49 0.61 174 XMSlimDrugH 1069 1.07 2.04 0.60 175 MPART_ALT_DIFF_COUNT 1042 0.82 1.30 0.59 176 MSGID_FROM_MTA_HEADER 1036 0.41 0.05 0.58 177 XM_ProductURIs 1034 0.62 0.70 0.58 178 URI_TRY_3LD 1021 0.77 1.16 0.58 179 XMLngstWrd_00 1020 0.53 0.43 0.58 180 RCVD_IN_PBL 1002 0.78 1.23 0.56 181 XM_URI_RBL 989 1.40 3.12 0.56 182 T_XMDrugObfuBody_00 980 1.02 1.98 0.55 183 T_TooManySym_04 975 0.38 0.02 0.55 184 T_FILL_THIS_FORM_FRAUD_PHISH 945 0.40 0.14 0.53 185 DATE_IN_PAST_12_24 938 0.41 0.16 0.53 186 XMGenDplmaNmb 936 0.61 0.79 0.53 187 HTML_TAG_BALANCE_CENTER 932 0.46 0.31 0.53 188 XMPhish14 895 0.57 0.69 0.50 189 T_STY_INVIS_DIRECT 893 0.72 1.17 0.50 190 DKIM_ADSP_NXDOMAIN 879 0.68 1.05 0.50 191 THIS_AD 811 0.52 0.65 0.46 192 XMLngstWrd_01 803 0.39 0.27 0.45 193 XM_S_SubURI 783 0.32 0.07 0.44 194 XM_ShortIntro_01 775 0.45 0.47 0.44 195 NO_DNS_FOR_FROM 772 0.51 0.66 0.44 196 TR_XM_SpammyWords2 757 4.26 12.13 0.43 197 HTML_IMAGE_ONLY_20 753 0.51 0.68 0.42 198 HTTPS_HTTP_MISMATCH 743 0.54 0.78 0.42 199 RELAYCOUNTRY_AU 743 1.10 2.49 0.42 200 AD_PREFS 728 0.30 0.09 0.41 ----------------------------------------------------------------------