Email: 463569 Autolearn: 0 AvgScore: 4.51 AvgScanTime: 1.28 sec Spam: 135433 Autolearn: 0 AvgScore: 14.92 AvgScanTime: 1.41 sec Ham: 328136 Autolearn: 0 AvgScore: 0.21 AvgScanTime: 1.23 sec Time Spent Running SA: 165.20 hours Time Spent Processing Spam: 53.07 hours Time Spent Processing Ham: 112.13 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 127921 89.45 94.45 87.39 2 DKIM_SIGNED 119002 75.66 87.87 70.62 3 XM_DK_Pass 112669 73.36 83.19 69.30 4 XM_B_Unicode 112525 73.25 83.09 69.20 5 DKIM_VALID 111556 72.20 82.37 68.00 6 RELAYCOUNTRY_US 110549 80.07 81.63 79.43 7 DCC_CHECK 100732 46.34 74.38 34.77 8 XM_B_SpammyWords 91910 51.53 67.86 44.79 9 XMListUnsubscribeExists 91734 50.52 67.73 43.42 10 DKIM_VALID_AU 88281 57.64 65.18 54.52 11 XM_B_Unicode3 65647 41.78 48.47 39.02 12 LOC_TINY_FONT_1 65151 31.49 48.11 24.63 13 BAYES_50 57010 56.25 42.09 62.09 14 RCVD_IN_MSPIKE_H2 54712 35.91 40.40 34.06 15 XM_B_SpammyWords2 54185 25.32 40.01 19.25 16 XM_DK_Undo_02 51657 13.96 38.14 3.98 17 HTML_FONT_LOW_CONTRAST 48612 29.66 35.89 27.09 18 FVGT_m_MULTI_ODD 43282 26.26 31.96 23.91 19 T_KAM_HTML_FONT_INVALID 41970 23.16 30.99 19.94 20 MIME_HTML_ONLY 38967 22.15 28.77 19.42 21 BAYES_99 38860 10.36 28.69 2.79 22 DKIM_VALID_EF 38262 28.80 28.25 29.03 23 TR_XM_DKIM_Undo 37378 9.23 27.60 1.64 24 XMSubLong 35326 23.56 26.08 22.52 25 DCC_CHECK_NEGATIVE 32141 53.06 23.73 65.17 26 T_TM2_M_HEADER_IN_MSG 29934 30.91 22.10 34.55 27 BAYES_999 29622 7.87 21.87 2.09 28 XM_Multi_Part_URI 28046 14.79 20.71 12.34 29 TR_DCC_Bayes_99 27512 6.62 20.31 0.97 30 TR_XM_DK_Unsub 26413 14.22 19.50 12.04 31 XM_B_Unsub 22777 11.32 16.82 9.06 32 UNPARSEABLE_RELAY 22605 12.98 16.69 11.45 33 RELAYCOUNTRY_META 22123 7.22 16.34 3.46 34 TR_XM_BayesUnsub 22027 9.79 16.26 7.11 35 XM_B_SpammyWords3 21486 7.51 15.86 4.06 36 TR_MAX_INTL_RELAY 19479 7.96 14.38 5.30 37 LOTS_OF_MONEY 16118 8.25 11.90 6.75 38 TR_XM_SpammyRelay 15249 4.50 11.26 1.71 39 BOTNET 14470 3.97 10.68 1.20 40 BOTNET_IPINHOSTNAME 13969 4.87 10.31 2.62 41 TR_XM_SpammyWords4 13797 6.34 10.19 4.75 42 FSL_BULK_SIG 13577 7.67 10.02 6.70 43 TR_XM_SpammyWords2 13442 3.14 9.93 0.33 44 XM_Evil_Numbers_Gen 13413 10.05 9.90 10.11 45 BAYES_80 12209 5.01 9.01 3.36 46 RCVD_IN_BL_SPAMCOP_NET 11647 2.86 8.60 0.50 47 BAYES_60 11490 7.02 8.48 6.42 48 TR_XM_UnparsRelay 11222 3.45 8.29 1.46 49 XM_B_Phish_Phrases 11215 5.74 8.28 4.69 50 LotsOfNums_01 10216 9.08 7.54 9.72 51 XMSubMetaSx_00 9527 4.87 7.03 3.98 52 TR_XM_SPAMCOP 9196 2.20 6.79 0.31 53 UNTRUSTED_Relay 9179 3.08 6.78 1.56 54 XM_Body_Dirty_Words 9059 3.47 6.69 2.14 55 HTML_IMAGE_RATIO_02 8846 4.91 6.53 4.24 56 RELAYCOUNTRY_CA 8429 2.49 6.22 0.95 57 XM_UncommonTLD01 8384 4.75 6.19 4.15 58 MPART_ALT_DIFF 7978 4.77 5.89 4.31 59 XM_B_PhoneNumber 7680 8.40 5.67 9.52 60 DKIM_INVALID 7446 3.46 5.50 2.63 61 XM_H_GMP 7184 5.72 5.30 5.90 62 XM_H_Long_From01 6947 5.31 5.13 5.38 63 BAYES_95 6711 2.82 4.96 1.94 64 XM_B_Investor 6581 2.44 4.86 1.44 65 HTML_IMAGE_RATIO_04 6405 4.31 4.73 4.14 66 XMSexyCombo_05 6040 2.48 4.46 1.66 67 TM2_M_VERY_LONG_WORD 5902 4.75 4.36 4.91 68 T_XMDrugObfuBody_14 5787 2.78 4.27 2.16 69 TR_XM_SpammyWords5 5595 2.08 4.13 1.23 70 XM_B_SpammyTLD 5517 2.89 4.07 2.40 71 XMStrtUSub 5501 4.37 4.06 4.49 72 TR_XM_PhishingBody 5433 2.18 4.01 1.42 73 TooManyTo_001 5370 7.42 3.97 8.84 74 RCVD_IN_MSPIKE_H3 5320 4.68 3.93 4.99 75 RCVD_IN_MSPIKE_WL 5320 4.68 3.93 4.99 76 XMNumbers 5038 3.07 3.72 2.81 77 HTML_IMAGE_RATIO_06 4909 2.91 3.62 2.61 78 XM_UB50 4888 1.78 3.61 1.02 79 MIME_HTML_MOSTLY 4774 2.45 3.52 2.01 80 T_XMDrugObfuBody_08 4732 2.11 3.49 1.54 81 XM_SPF_SoftFail 4331 1.93 3.20 1.40 82 MIME_HTML_ONLY_MULTI 4318 2.73 3.19 2.54 83 XM_CamelCaseFrm001 4233 2.38 3.13 2.07 84 XM_URI_RBL 4131 1.10 3.05 0.30 85 XM_OfRef6 4038 1.67 2.98 1.12 86 XM_B_Unsub2 3963 1.96 2.93 1.56 87 XM_B_SpammyWords4 3958 1.37 2.92 0.73 88 XMBody_17 3847 1.18 2.84 0.50 89 XMDiploma_00 3833 2.14 2.83 1.86 90 RCVD_IN_VALIDITY_RPBL 3796 0.86 2.80 0.06 91 XM_B_URI_Unicode 3644 2.43 2.69 2.32 92 MIME_QP_LONG_LINE 3632 3.90 2.68 4.40 93 MAILING_LIST_MULTI 3601 2.65 2.66 2.65 94 HTML_IMAGE_RATIO_08 3489 2.04 2.58 1.83 95 T_TooManySym_01 3486 4.85 2.57 5.79 96 KHOP_HELO_FCRDNS 3451 3.01 2.55 3.20 97 RELAYCOUNTRY_AU 3354 1.05 2.48 0.46 98 TM2_M_URI_OPT_OUT 3256 1.89 2.40 1.68 99 ALL_TRUSTED 3254 13.24 2.40 17.72 100 FROM_EXCESS_BASE64 3153 1.77 2.33 1.53 101 RCVD_IN_VALIDITY_SAFE 3147 3.33 2.32 3.74 102 TR_XM_INV_DKIM 3129 0.79 2.31 0.16 103 HTML_MIME_NO_HTML_TAG 2942 2.59 2.17 2.76 104 T_XMDrugObfuBody_00 2865 1.09 2.12 0.67 105 SpammyFromTLD_02 2848 0.76 2.10 0.21 106 RCVD_IN_VALIDITY_CERTIFIED 2718 2.63 2.01 2.89 107 TR_XM_NoHeaderRelay 2705 0.73 2.00 0.21 108 DIET_1 2640 0.85 1.95 0.40 109 T_XMHurry_00 2609 0.97 1.93 0.58 110 SHORTCIRCUIT 2545 0.55 1.88 0.00 111 RCVD_IN_ZEN_LASTEXTERNAL 2545 0.55 1.88 0.00 112 BAYES_40 2509 4.74 1.85 5.92 113 XMStockSpam_06 2493 1.45 1.84 1.29 114 SpammyFromTLD_01 2437 1.22 1.80 0.98 115 RCVD_IN_PSBL 2437 0.63 1.80 0.15 116 T_REMOTE_IMAGE 2426 3.13 1.79 3.69 117 HTML_FONT_TINY_NORDNS 2294 0.56 1.69 0.09 118 USER_IN_DEF_DKIM_WL 2238 8.73 1.65 11.65 119 XMLngstWrd_00 2198 0.95 1.62 0.67 120 T_FILL_THIS_FORM_SHORT 2181 1.32 1.61 1.19 121 XMGenDplmaNmb 2160 1.13 1.59 0.94 122 ANY_BOUNCE_MESSAGE 2148 5.22 1.59 6.72 123 BOUNCE_MESSAGE 2148 5.22 1.59 6.72 124 SUBJ_ALL_CAPS 2137 1.58 1.58 1.57 125 MPART_ALT_DIFF_COUNT 2042 0.81 1.51 0.53 126 BOTNET_NORDNS 2009 0.44 1.48 0.02 127 URI_NOVOWEL 1993 1.44 1.47 1.43 128 URI_HEX 1992 1.21 1.47 1.10 129 XMPhish30 1981 0.75 1.46 0.46 130 XMBrknScrpt_02 1980 1.06 1.46 0.90 131 BAYES_20 1963 3.40 1.45 4.21 132 XMReplyNow 1960 0.63 1.45 0.30 133 LongTLD 1912 0.71 1.41 0.42 134 TR_LOTS_OF_MONEY2 1895 0.56 1.40 0.21 135 T_MONEY_PERCENT 1895 0.56 1.40 0.21 136 TR_LOTS_OF_MONEY3 1849 0.58 1.37 0.26 137 NORDNS_LOW_CONTRAST 1831 0.46 1.35 0.09 138 HTML_TAG_BALANCE_BODY 1802 0.86 1.33 0.66 139 TR_XM_PHPForged 1800 0.71 1.33 0.45 140 XM_DK_Undo_01 1793 1.54 1.32 1.63 141 TR_XM_FormFill2 1782 0.70 1.32 0.45 142 TR_XM_PHPDW 1775 0.70 1.31 0.45 143 XM_B_COPY_HTML 1774 0.76 1.31 0.54 144 TM2_M_A_HREF_HREF 1756 0.53 1.30 0.21 145 XM_SendGrid 1739 1.31 1.28 1.33 146 XM_H_PHPOS 1735 0.68 1.28 0.44 147 XMSubMetaI_00 1730 0.70 1.28 0.46 148 RCVD_IN_PBL 1713 0.92 1.26 0.78 149 HTTPS_HTTP_MISMATCH 1685 0.97 1.24 0.86 150 TR_MetaPhish_Combo_01 1683 0.89 1.24 0.74 151 XMLngstWrd_01 1665 0.74 1.23 0.54 152 RELAYCOUNTRY_FR 1663 0.51 1.23 0.21 153 URI_TRY_3LD 1655 0.72 1.22 0.51 154 THIS_AD 1620 0.77 1.20 0.59 155 XM_B_SEO 1597 0.50 1.18 0.23 156 XM_ProductURIs 1588 0.64 1.17 0.42 157 XM_H_Long_From02 1543 0.93 1.14 0.85 158 XMLngstWrd_02 1540 0.63 1.14 0.42 159 XMNoVowels 1525 0.84 1.13 0.72 160 TR_Symld_Words 1510 1.54 1.11 1.71 161 HTML_IMAGE_ONLY_20 1510 0.76 1.11 0.61 162 TR_XM_Base64_M1 1497 0.87 1.11 0.78 163 DKIM_ADSP_NXDOMAIN 1489 0.58 1.10 0.37 164 MultiRelay_CC 1468 0.45 1.08 0.18 165 XM_HighProb1 1458 0.32 1.08 0.01 166 DKIM_ADSP_CUSTOM_MED 1438 0.95 1.06 0.90 167 TR_XM_SEO4 1436 0.37 1.06 0.09 168 XMHTML_After_End 1434 0.56 1.06 0.36 169 XM_H_Undi_Recip 1424 0.53 1.05 0.31 170 XMLngstWrd_03 1419 0.54 1.05 0.32 171 XM_B_REG_HTML 1402 0.43 1.04 0.18 172 XM_UB99 1387 0.30 1.02 0.00 173 XMBdyGiftCard01 1372 0.90 1.01 0.86 174 T_STY_INVIS_DIRECT 1369 0.59 1.01 0.42 175 TR_Mismatch_TLD_01 1344 0.40 0.99 0.16 176 RCVD_IN_SORBS_DUL 1332 0.32 0.98 0.04 177 XMLngstWrd_04 1324 0.48 0.98 0.28 178 SHOPIFY_IMG_NOT_RCVD_SFY 1320 0.43 0.97 0.21 179 XM_PDF 1316 3.68 0.97 4.80 180 XMSlimDrugH 1315 0.60 0.97 0.45 181 XM_DIRTYINTL 1309 0.33 0.97 0.07 182 TM2_M_OBFU_COMMENT 1306 0.52 0.96 0.34 183 TRACKER_ID 1278 0.44 0.94 0.23 184 NO_DNS_FOR_FROM 1273 0.47 0.94 0.28 185 XM_B_Phish66 1252 0.47 0.92 0.28 186 TR_XM_MaxWHORU 1240 0.42 0.92 0.21 187 XMSolicitRefs_0 1231 0.46 0.91 0.28 188 TR_XM_RelayPhish 1222 0.33 0.90 0.09 189 RDNS_DYNAMIC 1204 0.45 0.89 0.26 190 RCVD_IN_IADB_LISTED 1187 2.36 0.88 2.97 191 HOSTED_IMG_MULTI_PUB_01 1179 0.26 0.87 0.01 192 PDS_RDNS_DYNAMIC_FP 1169 0.36 0.86 0.15 193 XM_B_DNDMA 1169 0.59 0.86 0.48 194 BAYES_00 1167 8.00 0.86 10.95 195 TR_XM_Undi_Recip19 1158 0.33 0.86 0.11 196 TR_Mismatch_TLD_02 1148 0.29 0.85 0.06 197 XM_H_PHPMailer 1140 0.80 0.84 0.79 198 NML_ADSP_CUSTOM_MED 1137 0.68 0.84 0.61 199 TR_XM_InvalidRelay 1135 0.26 0.84 0.02 200 XMMoneyMeta_00 1127 0.55 0.83 0.43 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 286759 89.45 94.45 87.39 2 RELAYCOUNTRY_US 260650 80.07 81.63 79.43 3 DKIM_SIGNED 231741 75.66 87.87 70.62 4 XM_DK_Pass 227400 73.36 83.19 69.30 5 XM_B_Unicode 227054 73.25 83.09 69.20 6 DKIM_VALID 223126 72.20 82.37 68.00 7 DCC_CHECK_NEGATIVE 213834 53.06 23.73 65.17 8 BAYES_50 203732 56.25 42.09 62.09 9 DKIM_VALID_AU 178905 57.64 65.18 54.52 10 XM_B_SpammyWords 146961 51.53 67.86 44.79 11 XMListUnsubscribeExists 142479 50.52 67.73 43.42 12 XM_B_Unicode3 128044 41.78 48.47 39.02 13 DCC_CHECK 114108 46.34 74.38 34.77 14 T_TM2_M_HEADER_IN_MSG 113372 30.91 22.10 34.55 15 RCVD_IN_MSPIKE_H2 111771 35.91 40.40 34.06 16 DKIM_VALID_EF 95264 28.80 28.25 29.03 17 HTML_FONT_LOW_CONTRAST 88876 29.66 35.89 27.09 18 LOC_TINY_FONT_1 80835 31.49 48.11 24.63 19 FVGT_m_MULTI_ODD 78458 26.26 31.96 23.91 20 XMSubLong 73897 23.56 26.08 22.52 21 T_KAM_HTML_FONT_INVALID 65414 23.16 30.99 19.94 22 MIME_HTML_ONLY 63722 22.15 28.77 19.42 23 XM_B_SpammyWords2 63179 25.32 40.01 19.25 24 ALL_TRUSTED 58130 13.24 2.40 17.72 25 XM_Multi_Part_URI 40501 14.79 20.71 12.34 26 TR_XM_DK_Unsub 39520 14.22 19.50 12.04 27 USER_IN_DEF_DKIM_WL 38221 8.73 1.65 11.65 28 UNPARSEABLE_RELAY 37575 12.98 16.69 11.45 29 BAYES_00 35919 8.00 0.86 10.95 30 XM_Evil_Numbers_Gen 33164 10.05 9.90 10.11 31 LotsOfNums_01 31886 9.08 7.54 9.72 32 XM_B_PhoneNumber 31238 8.40 5.67 9.52 33 XM_B_Unsub 29715 11.32 16.82 9.06 34 TooManyTo_001 29004 7.42 3.97 8.84 35 TR_XM_BayesUnsub 23334 9.79 16.26 7.11 36 TR_XM_DK_Bayes 22763 5.09 0.63 6.94 37 TR_XM_DK_Bayes1 22240 4.98 0.62 6.78 38 LOTS_OF_MONEY 22133 8.25 11.90 6.75 39 BOUNCE_MESSAGE 22046 5.22 1.59 6.72 40 ANY_BOUNCE_MESSAGE 22046 5.22 1.59 6.72 41 FSL_BULK_SIG 21998 7.67 10.02 6.70 42 BAYES_60 21053 7.02 8.48 6.42 43 IN_ZIMBRA_NJ_WHITELIST 20649 4.49 0.12 6.29 44 XM_DKIMWhitelistDomains 20487 4.47 0.18 6.24 45 BAYES_40 19441 4.74 1.85 5.92 46 XM_H_GMP 19354 5.72 5.30 5.90 47 T_TooManySym_01 19000 4.85 2.57 5.79 48 TR_XM_DK_Bayes2 18750 4.17 0.44 5.71 49 XM_H_Long_From01 17670 5.31 5.13 5.38 50 TR_MAX_INTL_RELAY 17401 7.96 14.38 5.30 51 RCVD_IN_MSPIKE_WL 16363 4.68 3.93 4.99 52 RCVD_IN_MSPIKE_H3 16362 4.68 3.93 4.99 53 TM2_M_VERY_LONG_WORD 16100 4.75 4.36 4.91 54 XM_PDF 15750 3.68 0.97 4.80 55 TR_XM_SpammyWords4 15571 6.34 10.19 4.75 56 XM_B_Phish_Phrases 15400 5.74 8.28 4.69 57 XMStrtUSub 14741 4.37 4.06 4.49 58 HTML_IMAGE_ONLY_32 14716 3.24 0.22 4.48 59 MIME_QP_LONG_LINE 14431 3.90 2.68 4.40 60 MPART_ALT_DIFF 14146 4.77 5.89 4.31 61 HTML_IMAGE_RATIO_02 13924 4.91 6.53 4.24 62 BAYES_20 13817 3.40 1.45 4.21 63 XM_UncommonTLD01 13614 4.75 6.19 4.15 64 HTML_IMAGE_RATIO_04 13595 4.31 4.73 4.14 65 XM_B_SpammyWords3 13338 7.51 15.86 4.06 66 XM_DK_Undo_02 13071 13.96 38.14 3.98 67 XMSubMetaSx_00 13063 4.87 7.03 3.98 68 MAY_BE_FORGED 12596 2.92 0.70 3.84 69 RCVD_IN_VALIDITY_SAFE 12270 3.33 2.32 3.74 70 T_REMOTE_IMAGE 12103 3.13 1.79 3.69 71 RELAYCOUNTRY_META 11340 7.22 16.34 3.46 72 BAYES_80 11029 5.01 9.01 3.36 73 TooManyTo_002 10493 2.50 0.79 3.20 74 KHOP_HELO_FCRDNS 10485 3.01 2.55 3.20 75 T_TooManySym_02 10435 2.44 0.63 3.18 76 RCVD_IN_IADB_LISTED 9746 2.36 0.88 2.97 77 RCVD_IN_VALIDITY_CERTIFIED 9468 2.63 2.01 2.89 78 XMNumbers 9213 3.07 3.72 2.81 79 BAYES_99 9171 10.36 28.69 2.79 80 HTML_MIME_NO_HTML_TAG 9058 2.59 2.17 2.76 81 MAILING_LIST_MULTI 8699 2.65 2.66 2.65 82 DKIM_INVALID 8615 3.46 5.50 2.63 83 BOTNET_IPINHOSTNAME 8595 4.87 10.31 2.62 84 HTML_IMAGE_RATIO_06 8580 2.91 3.62 2.61 85 RCVD_IN_IADB_SPF 8507 2.07 0.80 2.59 86 MIME_HTML_ONLY_MULTI 8324 2.73 3.19 2.54 87 XM_B_SpammyTLD 7878 2.89 4.07 2.40 88 XM_B_URI_Unicode 7622 2.43 2.69 2.32 89 BAYES_05 7597 1.85 0.71 2.32 90 RCVD_IN_IADB_SENDERID 7580 1.86 0.76 2.31 91 RCVD_IN_IADB_DK 7402 1.83 0.78 2.26 92 INVALID_MSGID 7263 1.64 0.24 2.21 93 T_XMDrugObfuBody_14 7099 2.78 4.27 2.16 94 XM_Body_Dirty_Words 7021 3.47 6.69 2.14 95 BAYES_999 6845 7.87 21.87 2.09 96 XM_CamelCaseFrm001 6796 2.38 3.13 2.07 97 MIME_HTML_MOSTLY 6606 2.45 3.52 2.01 98 RCVD_IN_IADB_VOUCHED 6603 1.53 0.35 2.01 99 TooManyTo_003 6373 1.58 0.71 1.94 100 BAYES_95 6363 2.82 4.96 1.94 101 MIME_CHARSET_FARAWAY 6292 1.52 0.56 1.92 102 TO_MALFORMED 6281 1.37 0.05 1.91 103 XMDiploma_00 6092 2.14 2.83 1.86 104 HTML_IMAGE_RATIO_08 5990 2.04 2.58 1.83 105 CHARSET_FARAWAY_HEADER 5793 1.34 0.29 1.77 106 TR_XM_SpammyRelay 5608 4.50 11.26 1.71 107 TR_Symld_Words 5606 1.54 1.11 1.71 108 TM2_M_URI_OPT_OUT 5520 1.89 2.40 1.68 109 XMSexyCombo_05 5442 2.48 4.46 1.66 110 TR_XM_DKIM_Undo 5389 9.23 27.60 1.64 111 XM_DK_Undo_01 5352 1.54 1.32 1.63 112 SUBJ_ALL_CAPS 5165 1.58 1.58 1.57 113 XM_B_Unsub2 5128 1.96 2.93 1.56 114 UNTRUSTED_Relay 5113 3.08 6.78 1.56 115 T_XMDrugObfuBody_08 5057 2.11 3.49 1.54 116 FROM_EXCESS_BASE64 5033 1.77 2.33 1.53 117 TR_XM_UnparsRelay 4785 3.45 8.29 1.46 118 XM_B_Investor 4714 2.44 4.86 1.44 119 URI_NOVOWEL 4690 1.44 1.47 1.43 120 TooManyTo_004 4682 1.19 0.61 1.43 121 TR_XM_PhishingBody 4670 2.18 4.01 1.42 122 XM_SPF_SoftFail 4601 1.93 3.20 1.40 123 RCVD_IN_IADB_OPTIN 4508 1.03 0.21 1.37 124 HELO_NODOT 4486 1.09 0.43 1.37 125 HELO_NO_DOMAIN 4478 1.09 0.43 1.36 126 IN_HORDE_ADDRESS_BOOK 4360 0.97 0.10 1.33 127 XM_SendGrid 4348 1.31 1.28 1.33 128 XMCapTrack 4287 1.06 0.48 1.31 129 XMStockSpam_06 4247 1.45 1.84 1.29 130 T_TooManySym_03 4063 0.93 0.18 1.24 131 TR_XM_SpammyWords5 4025 2.08 4.13 1.23 132 XM_GoogleGroups 4002 1.07 0.72 1.22 133 BOTNET 3926 3.97 10.68 1.20 134 T_FILL_THIS_FORM_SHORT 3915 1.32 1.61 1.19 135 TooManyTo_005 3868 1.00 0.55 1.18 136 XMGappySubj_01 3719 0.87 0.22 1.13 137 XM_OfRef6 3691 1.67 2.98 1.12 138 URI_HEX 3619 1.21 1.47 1.10 139 TVD_SPACE_RATIO 3470 0.85 0.35 1.06 140 XM_UB50 3361 1.78 3.61 1.02 141 SpammyFromTLD_01 3200 1.22 1.80 0.98 142 TR_DCC_Bayes_99 3181 6.62 20.31 0.97 143 RELAYCOUNTRY_CA 3101 2.49 6.22 0.95 144 XMGenDplmaNmb 3071 1.13 1.59 0.94 145 DKIM_ADSP_CUSTOM_MED 2958 0.95 1.06 0.90 146 XMBrknScrpt_02 2953 1.06 1.46 0.90 147 XM_ShortIntro_01 2920 0.80 0.58 0.89 148 TR_XM_DK_SendGrid 2875 0.83 0.73 0.88 149 XMBdyGiftCard01 2822 0.90 1.01 0.86 150 HTTPS_HTTP_MISMATCH 2820 0.97 1.24 0.86 151 XM_H_Long_From02 2783 0.93 1.14 0.85 152 XMGappySubj_02 2618 0.58 0.06 0.80 153 XM_H_PHPMailer 2583 0.80 0.84 0.79 154 XMSubMetaSxObfu_03 2583 0.79 0.78 0.79 155 TO_NO_BRKTS_HTML_ONLY 2566 0.70 0.52 0.78 156 RCVD_IN_PBL 2559 0.92 1.26 0.78 157 TR_XM_Base64_M1 2548 0.87 1.11 0.78 158 TR_MetaPhish_Combo_01 2435 0.89 1.24 0.74 159 XM_B_SpammyWords4 2382 1.37 2.92 0.73 160 XMNoVowels 2360 0.84 1.13 0.72 161 T_OBFU_PDF_ATTACH 2215 0.54 0.20 0.68 162 T_XMDrugObfuBody_00 2203 1.09 2.12 0.67 163 XMLngstWrd_00 2189 0.95 1.62 0.67 164 HTML_TAG_BALANCE_BODY 2181 0.86 1.33 0.66 165 XMSubMetaSx_01 2153 0.55 0.30 0.66 166 NML_ADSP_CUSTOM_MED 2017 0.68 0.84 0.61 167 HTML_IMAGE_ONLY_20 2002 0.76 1.11 0.61 168 THIS_AD 1940 0.77 1.20 0.59 169 T_XMHurry_00 1899 0.97 1.93 0.58 170 MSGID_FROM_MTA_HEADER 1872 0.45 0.15 0.57 171 FROM_GOV_DKIM_AU 1849 0.44 0.16 0.56 172 TVD_RCVD_IP 1783 0.59 0.69 0.54 173 XMLngstWrd_01 1778 0.74 1.23 0.54 174 XM_B_FormFill 1771 0.40 0.05 0.54 175 XM_B_COPY_HTML 1762 0.76 1.31 0.54 176 MPART_ALT_DIFF_COUNT 1732 0.81 1.51 0.53 177 FORGED_GMAIL_RCVD 1710 0.58 0.71 0.52 178 URI_TRY_3LD 1663 0.72 1.22 0.51 179 XMDateMe_00 1654 0.49 0.46 0.50 180 XMBody_17 1638 1.18 2.84 0.50 181 RCVD_IN_BL_SPAMCOP_NET 1632 2.86 8.60 0.50 182 XM_B_DNDMA 1563 0.59 0.86 0.48 183 T_Symld_Words_02 1558 0.56 0.75 0.47 184 MISSING_HEADERS 1513 0.49 0.57 0.46 185 RELAYCOUNTRY_AU 1513 1.05 2.48 0.46 186 XMPhish30 1511 0.75 1.46 0.46 187 XMSubMetaI_00 1507 0.70 1.28 0.46 188 FILL_THIS_FORM 1495 0.39 0.24 0.46 189 TR_XM_FormFill2 1482 0.70 1.32 0.45 190 TR_XM_PHPDW 1477 0.70 1.31 0.45 191 XMSlimDrugH 1472 0.60 0.97 0.45 192 TR_XM_PHPForged 1471 0.71 1.33 0.45 193 RELAYCOUNTRY_GB 1467 0.55 0.79 0.45 194 XMBody_95 1466 0.38 0.22 0.45 195 XMPhish14 1465 0.52 0.69 0.45 196 XM_H_PHPOS 1439 0.68 1.28 0.44 197 HTML_IMAGE_ONLY_28 1407 0.40 0.33 0.43 198 XMMoneyMeta_00 1402 0.55 0.83 0.43 199 LongTLD 1394 0.71 1.41 0.42 200 XM_ProductURIs 1387 0.64 1.17 0.42 ----------------------------------------------------------------------