Email: 484306 Autolearn: 0 AvgScore: 5.04 AvgScanTime: 1.40 sec Spam: 159715 Autolearn: 0 AvgScore: 14.49 AvgScanTime: 1.52 sec Ham: 324591 Autolearn: 0 AvgScore: 0.40 AvgScanTime: 1.35 sec Time Spent Running SA: 188.65 hours Time Spent Processing Spam: 67.30 hours Time Spent Processing Ham: 121.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152851 90.38 95.70 87.77 2 DKIM_SIGNED 143887 79.71 90.09 74.60 3 XM_B_Unicode 135413 75.55 84.78 71.01 4 RELAYCOUNTRY_US 134044 81.70 83.93 80.61 5 XM_DK_Pass 133744 76.69 83.74 73.22 6 DKIM_VALID 132472 75.69 82.94 72.13 7 DCC_CHECK 120983 51.27 75.75 39.23 8 XM_B_SpammyWords 113316 53.36 70.95 44.70 9 XMListUnsubscribeExists 111258 55.99 69.66 49.26 10 DKIM_VALID_AU 102955 60.01 64.46 57.82 11 LOC_TINY_FONT_1 83157 36.61 52.07 29.00 12 XM_B_Unicode3 83126 45.17 52.05 41.79 13 XM_B_SpammyWords2 67197 26.66 42.07 19.07 14 BAYES_50 64856 55.12 40.61 62.26 15 HTML_FONT_LOW_CONTRAST 62375 31.64 39.05 27.99 16 XM_DK_Undo_02 61682 15.57 38.62 4.23 17 RCVD_IN_MSPIKE_H2 60751 36.08 38.04 35.12 18 FVGT_m_MULTI_ODD 53541 28.34 33.52 25.78 19 T_KAM_HTML_FONT_INVALID 50293 25.15 31.49 22.03 20 BAYES_99 47039 11.69 29.45 2.94 21 TR_XM_DKIM_Undo 45699 10.71 28.61 1.91 22 DKIM_VALID_EF 45628 28.68 28.57 28.74 23 MIME_HTML_ONLY 44026 22.89 27.57 20.59 24 XMSubLong 40638 24.14 25.44 23.50 25 DCC_CHECK_NEGATIVE 36281 48.18 22.72 60.71 26 BAYES_999 36183 8.97 22.65 2.24 27 TR_DCC_Bayes_99 34517 7.85 21.61 1.08 28 T_TM2_M_HEADER_IN_MSG 34015 26.99 21.30 29.79 29 TR_XM_DK_Unsub 33099 15.68 20.72 13.20 30 UNPARSEABLE_RELAY 31791 14.57 19.90 11.94 31 XM_Multi_Part_URI 30964 15.28 19.39 13.26 32 XM_B_Unsub 27582 11.65 17.27 8.88 33 TR_XM_BayesUnsub 26633 10.05 16.68 6.79 34 XM_B_SpammyWords3 26153 8.51 16.37 4.65 35 TR_MAX_INTL_RELAY 24445 8.70 15.31 5.46 36 RELAYCOUNTRY_META 23310 7.26 14.59 3.65 37 LOTS_OF_MONEY 18354 7.86 11.49 6.08 38 TR_XM_SpammyWords2 18313 4.05 11.47 0.41 39 TR_XM_UnparsRelay 17688 4.67 11.07 1.52 40 BOTNET_IPINHOSTNAME 17481 5.67 10.95 3.07 41 XM_Evil_Numbers_Gen 17449 10.35 10.93 10.06 42 TR_XM_SpammyRelay 17418 4.98 10.91 2.06 43 TR_XM_SpammyWords4 16673 6.12 10.44 3.99 44 BOTNET 15583 4.09 9.76 1.30 45 BAYES_80 15381 5.42 9.63 3.35 46 FSL_BULK_SIG 15006 7.77 9.40 6.97 47 BAYES_60 14267 7.65 8.93 7.02 48 XM_B_Phish_Phrases 14160 6.26 8.87 4.98 49 RCVD_IN_BL_SPAMCOP_NET 13980 3.22 8.75 0.50 50 LotsOfNums_01 13276 9.06 8.31 9.42 51 T_SCC_BODY_TEXT_LINE 12322 8.23 7.71 8.49 52 DKIM_INVALID 11415 4.01 7.15 2.47 53 HTML_IMAGE_RATIO_02 11199 5.33 7.01 4.51 54 XMSubMetaSx_00 11177 4.85 7.00 3.79 55 TR_XM_SPAMCOP 10654 2.41 6.67 0.31 56 XM_Body_Dirty_Words 10280 3.68 6.44 2.33 57 XM_B_PhoneNumber 9599 8.74 6.01 10.09 58 RELAYCOUNTRY_CA 9395 2.63 5.88 1.03 59 HTML_IMAGE_RATIO_04 9311 4.67 5.83 4.09 60 XM_UncommonTLD01 9082 4.54 5.69 3.98 61 MPART_ALT_DIFF 9008 4.51 5.64 3.95 62 BAYES_95 8630 3.19 5.40 2.10 63 TM2_M_VERY_LONG_WORD 8425 3.67 5.28 2.88 64 UNTRUSTED_Relay 8333 2.74 5.22 1.52 65 XM_H_Long_From01 7774 5.57 4.87 5.91 66 HTML_IMAGE_RATIO_06 7760 4.55 4.86 4.40 67 TR_XM_PhishingBody 7400 2.75 4.63 1.83 68 XMSexyCombo_05 7235 2.31 4.53 1.22 69 XM_B_Investor 7211 2.53 4.51 1.55 70 XM_H_GMP 6726 4.99 4.21 5.38 71 T_XMDrugObfuBody_14 6504 2.61 4.07 1.89 72 XMStrtUSub 6372 4.36 3.99 4.54 73 XM_B_SpammyTLD 6089 3.03 3.81 2.65 74 TooManyTo_001 5713 6.81 3.58 8.40 75 TR_XM_SpammyWords5 5579 2.33 3.49 1.76 76 XM_OfRef6 5100 1.81 3.19 1.13 77 XMNumbers 5072 2.89 3.18 2.75 78 RCVD_IN_MSPIKE_WL 5064 4.49 3.17 5.13 79 RCVD_IN_MSPIKE_H3 5064 4.49 3.17 5.13 80 MIME_HTML_ONLY_MULTI 4969 2.58 3.11 2.31 81 MIME_HTML_MOSTLY 4867 2.50 3.05 2.23 82 RCVD_IN_VALIDITY_RPBL 4850 1.05 3.04 0.07 83 HTML_IMAGE_RATIO_08 4766 2.46 2.98 2.20 84 T_XMDrugObfuBody_08 4723 1.93 2.96 1.43 85 XM_B_URI_Unicode 4522 2.26 2.83 1.98 86 XM_SPF_SoftFail 4499 1.84 2.82 1.36 87 T_XMHurry_00 4461 1.47 2.79 0.82 88 KHOP_HELO_FCRDNS 4456 2.31 2.79 2.07 89 MIME_QP_LONG_LINE 4348 4.28 2.72 5.04 90 TM2_M_URI_OPT_OUT 4268 2.02 2.67 1.69 91 XMDiploma_00 4234 1.95 2.65 1.61 92 XM_URI_RBL 4190 1.13 2.62 0.40 93 XM_B_Unsub2 4107 1.73 2.57 1.32 94 XM_CamelCaseFrm001 4004 2.50 2.51 2.49 95 RELAYCOUNTRY_AU 3951 1.20 2.47 0.57 96 BOUNCE_MESSAGE 3902 4.22 2.44 5.09 97 ANY_BOUNCE_MESSAGE 3902 4.22 2.44 5.09 98 XM_UB50 3826 1.40 2.40 0.91 99 XM_B_SpammyWords4 3784 1.22 2.37 0.66 100 TR_XM_INV_DKIM 3780 0.91 2.37 0.19 101 T_XMDrugObfuBody_00 3721 1.30 2.33 0.79 102 MAILING_LIST_MULTI 3628 2.45 2.27 2.53 103 T_TooManySym_01 3513 4.40 2.20 5.49 104 TR_XM_NoHeaderRelay 3490 0.87 2.19 0.22 105 RCVD_IN_VALIDITY_SAFE 3446 3.61 2.16 4.32 106 DIET_1 3295 0.88 2.06 0.30 107 FROM_EXCESS_BASE64 3155 1.96 1.98 1.95 108 ALL_TRUSTED 3141 11.57 1.97 16.29 109 SpammyFromTLD_02 2977 0.88 1.86 0.39 110 USER_IN_DEF_DKIM_WL 2950 9.19 1.85 12.80 111 NO_DNS_FOR_FROM 2914 0.79 1.82 0.28 112 XMBody_17 2895 0.82 1.81 0.34 113 TR_XM_MaxWHORU 2888 0.74 1.81 0.21 114 HTML_MIME_NO_HTML_TAG 2855 2.39 1.79 2.69 115 BAYES_40 2848 4.14 1.78 5.30 116 XMStockSpam_06 2845 1.42 1.78 1.24 117 DKIM_ADSP_NXDOMAIN 2808 0.79 1.76 0.31 118 MAY_BE_FORGED 2788 1.68 1.75 1.64 119 XM_H_Long_From02 2773 1.14 1.74 0.84 120 TR_MetaPhish_Combo_01 2707 1.02 1.69 0.69 121 XM_DIRTYINTL 2655 0.61 1.66 0.09 122 RCVD_IN_VALIDITY_CERTIFIED 2633 2.67 1.65 3.17 123 SpammyFromTLD_01 2584 1.04 1.62 0.75 124 SUBJ_ALL_CAPS 2531 1.92 1.58 2.09 125 XM_DK_Undo_01 2487 1.69 1.56 1.76 126 RCVD_IN_ZEN_LASTEXTERNAL 2424 0.50 1.52 0.00 127 SHORTCIRCUIT 2424 0.50 1.52 0.00 128 HTTPS_HTTP_MISMATCH 2404 1.03 1.51 0.79 129 T_REMOTE_IMAGE 2360 2.89 1.48 3.58 130 URI_HEX 2332 1.38 1.46 1.34 131 TR_LOTS_OF_MONEY3 2307 0.72 1.44 0.36 132 T_FILL_THIS_FORM_SHORT 2296 1.11 1.44 0.95 133 RCVD_IN_PSBL 2286 0.61 1.43 0.21 134 XMPhish30 2267 0.90 1.42 0.64 135 BAYES_20 2251 3.05 1.41 3.86 136 RELAYCOUNTRY_FR 2182 0.62 1.37 0.25 137 XM_B_DNDMA 2180 0.82 1.36 0.56 138 XM_SendGrid 2156 1.41 1.35 1.44 139 XMBdyGiftCard01 2019 1.23 1.26 1.21 140 XM_B_Phish66 1948 0.65 1.22 0.37 141 URI_NOVOWEL 1934 1.79 1.21 2.08 142 XMGenDplmaNmb 1913 0.98 1.20 0.88 143 URI_TRY_3LD 1906 0.69 1.19 0.44 144 XMBrknScrpt_02 1903 0.96 1.19 0.85 145 XMBody_78 1854 0.67 1.16 0.43 146 LongTLD 1848 0.68 1.16 0.45 147 SHOPIFY_IMG_NOT_RCVD_SFY 1735 0.56 1.09 0.30 148 DKIM_ADSP_CUSTOM_MED 1663 0.85 1.04 0.75 149 XM_HighProb1 1651 0.35 1.03 0.01 150 XM_B_COPY_HTML 1648 0.81 1.03 0.70 151 MPART_ALT_DIFF_COUNT 1645 0.75 1.03 0.61 152 XM_B_SEO 1630 0.50 1.02 0.24 153 RCVD_IN_PBL 1622 0.76 1.02 0.63 154 HTML_FONT_TINY_NORDNS 1618 0.37 1.01 0.05 155 TR_Mismatch_TLD_02 1598 0.38 1.00 0.08 156 XM_B_COVIDMETA 1580 0.45 0.99 0.19 157 TR_XM_PHPForged 1579 0.53 0.99 0.31 158 XM_OfRef7 1564 0.50 0.98 0.26 159 TR_XM_PHPDW 1563 0.53 0.98 0.31 160 TR_XM_Base64_M1 1563 0.74 0.98 0.63 161 XMMoneyMeta_00 1555 0.63 0.97 0.46 162 TR_XM_FormFill2 1548 0.53 0.97 0.31 163 TR_XM_SEO4 1546 0.40 0.97 0.12 164 TM2_M_OBFU_COMMENT 1530 0.54 0.96 0.33 165 HTML_IMAGE_ONLY_20 1518 0.67 0.95 0.53 166 XM_H_PHPOS 1517 0.52 0.95 0.30 167 TR_Symld_Words 1504 1.44 0.94 1.69 168 NORDNS_LOW_CONTRAST 1503 0.34 0.94 0.04 169 PLING_QUERY 1491 0.55 0.93 0.36 170 URIBL_BLACK 1489 0.34 0.93 0.06 171 XM_UB99 1488 0.31 0.93 0.01 172 XMHTML_After_End 1448 0.55 0.91 0.38 173 XMPhish14 1404 0.58 0.88 0.44 174 XMReplyNow 1399 0.42 0.88 0.20 175 BOTNET_NORDNS 1398 0.30 0.88 0.01 176 XM_H_DKIM_GOOG 1395 0.31 0.87 0.03 177 T_STY_INVIS_DIRECT 1371 0.59 0.86 0.45 178 FONT_INVIS_LONG_LINE 1370 0.37 0.86 0.13 179 TM2_M_A_HREF_HREF 1362 0.46 0.85 0.27 180 NML_ADSP_CUSTOM_MED 1362 0.63 0.85 0.52 181 RDNS_DYNAMIC 1359 0.48 0.85 0.30 182 TR_LOTS_OF_MONEY2 1350 0.38 0.85 0.15 183 T_MONEY_PERCENT 1350 0.38 0.85 0.15 184 UNICODE_OBFU_ASC 1346 0.28 0.84 0.01 185 XMSubMetaI_00 1342 0.53 0.84 0.38 186 TR_XM_DK_SendGrid 1342 0.93 0.84 0.98 187 XM_S_SpammyWords 1341 0.53 0.84 0.38 188 TR_XM_Spammywords 1340 0.53 0.84 0.38 189 XM_ProductURIs 1298 0.67 0.81 0.59 190 HTML_FONT_FACE_BAD 1291 0.49 0.81 0.34 191 XMSexyCombo_01 1287 0.37 0.81 0.15 192 HTML_TAG_BALANCE_BODY 1284 0.73 0.80 0.70 193 FORGED_GMAIL_RCVD 1275 0.58 0.80 0.48 194 RELAYCOUNTRY_GB 1252 0.59 0.78 0.49 195 XM_PDF 1242 3.37 0.78 4.65 196 XM_B_REG_HTML 1229 0.42 0.77 0.24 197 SUSP_UTF8_WORD_SUBJ 1228 0.36 0.77 0.15 198 TR_XM_RelayPhish 1216 0.32 0.76 0.11 199 PDS_RDNS_DYNAMIC_FP 1205 0.37 0.75 0.17 200 TVD_RCVD_IP 1200 0.65 0.75 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 284885 90.38 95.70 87.77 2 RELAYCOUNTRY_US 261651 81.70 83.93 80.61 3 DKIM_SIGNED 242136 79.71 90.09 74.60 4 XM_DK_Pass 237663 76.69 83.74 73.22 5 DKIM_VALID 234118 75.69 82.94 72.13 6 XM_B_Unicode 230501 75.55 84.78 71.01 7 BAYES_50 202106 55.12 40.61 62.26 8 DCC_CHECK_NEGATIVE 197050 48.18 22.72 60.71 9 DKIM_VALID_AU 187666 60.01 64.46 57.82 10 XMListUnsubscribeExists 159901 55.99 69.66 49.26 11 XM_B_SpammyWords 145094 53.36 70.95 44.70 12 XM_B_Unicode3 135640 45.17 52.05 41.79 13 DCC_CHECK 127339 51.27 75.75 39.23 14 RCVD_IN_MSPIKE_H2 114003 36.08 38.04 35.12 15 T_TM2_M_HEADER_IN_MSG 96704 26.99 21.30 29.79 16 LOC_TINY_FONT_1 94130 36.61 52.07 29.00 17 DKIM_VALID_EF 93287 28.68 28.57 28.74 18 HTML_FONT_LOW_CONTRAST 90859 31.64 39.05 27.99 19 FVGT_m_MULTI_ODD 83693 28.34 33.52 25.78 20 XMSubLong 76282 24.14 25.44 23.50 21 T_KAM_HTML_FONT_INVALID 71517 25.15 31.49 22.03 22 MIME_HTML_ONLY 66838 22.89 27.57 20.59 23 XM_B_SpammyWords2 61895 26.66 42.07 19.07 24 ALL_TRUSTED 52881 11.57 1.97 16.29 25 XM_Multi_Part_URI 43037 15.28 19.39 13.26 26 TR_XM_DK_Unsub 42843 15.68 20.72 13.20 27 USER_IN_DEF_DKIM_WL 41544 9.19 1.85 12.80 28 UNPARSEABLE_RELAY 38768 14.57 19.90 11.94 29 BAYES_00 34942 7.42 0.63 10.76 30 XM_B_PhoneNumber 32750 8.74 6.01 10.09 31 XM_Evil_Numbers_Gen 32664 10.35 10.93 10.06 32 LotsOfNums_01 30589 9.06 8.31 9.42 33 XM_B_Unsub 28820 11.65 17.27 8.88 34 T_SCC_BODY_TEXT_LINE 27545 8.23 7.71 8.49 35 TooManyTo_001 27278 6.81 3.58 8.40 36 TR_XM_DK_Bayes 23288 4.98 0.52 7.17 37 TR_XM_DK_Bayes1 22856 4.89 0.51 7.04 38 BAYES_60 22801 7.65 8.93 7.02 39 FSL_BULK_SIG 22621 7.77 9.40 6.97 40 TR_XM_BayesUnsub 22040 10.05 16.68 6.79 41 IN_ZIMBRA_NJ_WHITELIST 21667 4.53 0.17 6.68 42 TR_XM_DK_Bayes2 19725 4.20 0.39 6.08 43 LOTS_OF_MONEY 19723 7.86 11.49 6.08 44 XM_DKIMWhitelistDomains 19366 4.00 0.02 5.97 45 XM_H_Long_From01 19181 5.57 4.87 5.91 46 T_TooManySym_01 17807 4.40 2.20 5.49 47 TR_MAX_INTL_RELAY 17710 8.70 15.31 5.46 48 XM_H_GMP 17448 4.99 4.21 5.38 49 BAYES_40 17205 4.14 1.78 5.30 50 RCVD_IN_MSPIKE_WL 16662 4.49 3.17 5.13 51 RCVD_IN_MSPIKE_H3 16662 4.49 3.17 5.13 52 ANY_BOUNCE_MESSAGE 16512 4.22 2.44 5.09 53 BOUNCE_MESSAGE 16512 4.22 2.44 5.09 54 MIME_QP_LONG_LINE 16374 4.28 2.72 5.04 55 XM_B_Phish_Phrases 16157 6.26 8.87 4.98 56 XM_PDF 15098 3.37 0.78 4.65 57 XM_B_SpammyWords3 15082 8.51 16.37 4.65 58 XMStrtUSub 14748 4.36 3.99 4.54 59 HTML_IMAGE_RATIO_02 14631 5.33 7.01 4.51 60 HTML_IMAGE_RATIO_06 14283 4.55 4.86 4.40 61 RCVD_IN_VALIDITY_SAFE 14015 3.61 2.16 4.32 62 XM_DK_Undo_02 13723 15.57 38.62 4.23 63 HTML_IMAGE_RATIO_04 13288 4.67 5.83 4.09 64 TR_XM_SpammyWords4 12952 6.12 10.44 3.99 65 XM_UncommonTLD01 12911 4.54 5.69 3.98 66 MPART_ALT_DIFF 12825 4.51 5.64 3.95 67 BAYES_20 12538 3.05 1.41 3.86 68 XMSubMetaSx_00 12295 4.85 7.00 3.79 69 RELAYCOUNTRY_META 11853 7.26 14.59 3.65 70 T_REMOTE_IMAGE 11622 2.89 1.48 3.58 71 RCVD_IN_IADB_LISTED 11463 2.61 0.73 3.53 72 BAYES_80 10881 5.42 9.63 3.35 73 RCVD_IN_VALIDITY_CERTIFIED 10278 2.67 1.65 3.17 74 RCVD_IN_IADB_SPF 10081 2.31 0.68 3.11 75 BOTNET_IPINHOSTNAME 9969 5.67 10.95 3.07 76 TooManyTo_002 9845 2.23 0.61 3.03 77 BAYES_99 9553 11.69 29.45 2.94 78 TM2_M_VERY_LONG_WORD 9354 3.67 5.28 2.88 79 T_TooManySym_02 9228 2.10 0.59 2.84 80 RCVD_IN_IADB_SENDERID 9066 2.09 0.66 2.79 81 XMNumbers 8912 2.89 3.18 2.75 82 RCVD_IN_IADB_DK 8814 2.04 0.66 2.72 83 HTML_MIME_NO_HTML_TAG 8719 2.39 1.79 2.69 84 XM_B_SpammyTLD 8604 3.03 3.81 2.65 85 MAILING_LIST_MULTI 8217 2.45 2.27 2.53 86 XM_CamelCaseFrm001 8096 2.50 2.51 2.49 87 DKIM_INVALID 8018 4.01 7.15 2.47 88 BAYES_05 7743 1.81 0.63 2.39 89 RCVD_IN_IADB_VOUCHED 7586 1.65 0.26 2.34 90 XM_Body_Dirty_Words 7550 3.68 6.44 2.33 91 MIME_HTML_ONLY_MULTI 7504 2.58 3.11 2.31 92 BAYES_999 7268 8.97 22.65 2.24 93 INVALID_MSGID 7240 1.58 0.26 2.23 94 MIME_HTML_MOSTLY 7234 2.50 3.05 2.23 95 HTML_IMAGE_RATIO_08 7148 2.46 2.98 2.20 96 BAYES_95 6818 3.19 5.40 2.10 97 SUBJ_ALL_CAPS 6773 1.92 1.58 2.09 98 URI_NOVOWEL 6756 1.79 1.21 2.08 99 KHOP_HELO_FCRDNS 6731 2.31 2.79 2.07 100 TR_XM_SpammyRelay 6689 4.98 10.91 2.06 101 XM_B_URI_Unicode 6415 2.26 2.83 1.98 102 FROM_EXCESS_BASE64 6335 1.96 1.98 1.95 103 TO_MALFORMED 6282 1.31 0.03 1.94 104 TR_XM_DKIM_Undo 6193 10.71 28.61 1.91 105 TO_NO_BRKTS_HTML_ONLY 6153 1.40 0.40 1.90 106 T_XMDrugObfuBody_14 6145 2.61 4.07 1.89 107 TR_XM_PhishingBody 5925 2.75 4.63 1.83 108 TR_XM_SpammyWords5 5723 2.33 3.49 1.76 109 XM_DK_Undo_01 5710 1.69 1.56 1.76 110 TM2_M_URI_OPT_OUT 5493 2.02 2.67 1.69 111 TR_Symld_Words 5485 1.44 0.94 1.69 112 TooManyTo_003 5453 1.30 0.52 1.68 113 MAY_BE_FORGED 5326 1.68 1.75 1.64 114 RCVD_IN_IADB_OPTIN 5268 1.15 0.20 1.62 115 XMDiploma_00 5228 1.95 2.65 1.61 116 XM_B_Investor 5041 2.53 4.51 1.55 117 TR_XM_UnparsRelay 4931 4.67 11.07 1.52 118 UNTRUSTED_Relay 4929 2.74 5.22 1.52 119 XM_SendGrid 4681 1.41 1.35 1.44 120 T_XMDrugObfuBody_08 4634 1.93 2.96 1.43 121 IN_HORDE_ADDRESS_BOOK 4476 0.96 0.10 1.38 122 XM_SPF_SoftFail 4427 1.84 2.82 1.36 123 URI_HEX 4354 1.38 1.46 1.34 124 XM_B_Unsub2 4274 1.73 2.57 1.32 125 BOTNET 4209 4.09 9.76 1.30 126 HELO_NODOT 4089 0.88 0.11 1.26 127 HELO_NO_DOMAIN 4087 0.88 0.11 1.26 128 XMStockSpam_06 4018 1.42 1.78 1.24 129 XM_GoogleGroups 4006 1.07 0.73 1.23 130 TooManyTo_004 3973 0.97 0.47 1.22 131 XMLngstWrd_00 3954 0.95 0.42 1.22 132 XMSexyCombo_05 3953 2.31 4.53 1.22 133 XMBdyGiftCard01 3936 1.23 1.26 1.21 134 XMCapTrack 3920 0.95 0.44 1.21 135 T_TooManySym_03 3659 0.82 0.19 1.13 136 XM_OfRef6 3654 1.81 3.19 1.13 137 TR_DCC_Bayes_99 3510 7.85 21.61 1.08 138 XMGappySubj_01 3474 0.82 0.30 1.07 139 RELAYCOUNTRY_CA 3350 2.63 5.88 1.03 140 TVD_SPACE_RATIO 3335 0.78 0.27 1.03 141 TR_XM_DK_SendGrid 3178 0.93 0.84 0.98 142 TooManyTo_005 3164 0.79 0.40 0.97 143 T_FILL_THIS_FORM_SHORT 3072 1.11 1.44 0.95 144 XM_UB50 2965 1.40 2.40 0.91 145 XMGenDplmaNmb 2856 0.98 1.20 0.88 146 MIME_CHARSET_FARAWAY 2842 0.70 0.35 0.88 147 XM_ShortIntro_01 2774 0.67 0.30 0.85 148 XMBrknScrpt_02 2770 0.96 1.19 0.85 149 XM_H_Long_From02 2735 1.14 1.74 0.84 150 T_XMHurry_00 2648 1.47 2.79 0.82 151 FROM_GOV_DKIM_AU 2608 0.58 0.13 0.80 152 HTTPS_HTTP_MISMATCH 2576 1.03 1.51 0.79 153 T_XMDrugObfuBody_00 2562 1.30 2.33 0.79 154 CHARSET_FARAWAY_HEADER 2502 0.58 0.19 0.77 155 SpammyFromTLD_01 2444 1.04 1.62 0.75 156 DKIM_ADSP_CUSTOM_MED 2436 0.85 1.04 0.75 157 XMLngstWrd_01 2298 0.57 0.30 0.71 158 XM_H_PHPMailer 2297 0.67 0.58 0.71 159 HTML_TAG_BALANCE_BODY 2261 0.73 0.80 0.70 160 XM_B_COPY_HTML 2261 0.81 1.03 0.70 161 TR_MetaPhish_Combo_01 2231 1.02 1.69 0.69 162 HTML_IMAGE_ONLY_32 2209 0.51 0.18 0.68 163 XM_B_SpammyWords4 2136 1.22 2.37 0.66 164 T_OBFU_PDF_ATTACH 2119 0.47 0.11 0.65 165 XMPhish30 2074 0.90 1.42 0.64 166 RCVD_IN_PBL 2061 0.76 1.02 0.63 167 TR_XM_Base64_M1 2038 0.74 0.98 0.63 168 XM_B_FormFill 2001 0.42 0.01 0.62 169 MPART_ALT_DIFF_COUNT 1988 0.75 1.03 0.61 170 TVD_RCVD_IP 1952 0.65 0.75 0.60 171 XM_ProductURIs 1930 0.67 0.81 0.59 172 XMLngstWrd_02 1905 0.47 0.24 0.59 173 XMNoVowels 1850 0.60 0.66 0.57 174 RELAYCOUNTRY_AU 1846 1.20 2.47 0.57 175 XMGappySubj_02 1837 0.41 0.09 0.57 176 XMDateMe_00 1828 0.50 0.38 0.56 177 XM_B_DNDMA 1806 0.82 1.36 0.56 178 MSGID_FROM_MTA_HEADER 1786 0.41 0.13 0.55 179 XMSlimDrugH 1755 0.56 0.60 0.54 180 HTML_IMAGE_ONLY_20 1717 0.67 0.95 0.53 181 NML_ADSP_CUSTOM_MED 1677 0.63 0.85 0.52 182 XMBody_95 1638 0.37 0.10 0.50 183 RCVD_IN_BL_SPAMCOP_NET 1609 3.22 8.75 0.50 184 RELAYCOUNTRY_GB 1586 0.59 0.78 0.49 185 FORGED_GMAIL_RCVD 1543 0.58 0.80 0.48 186 XMMoneyMeta_00 1484 0.63 0.97 0.46 187 T_STY_INVIS_DIRECT 1475 0.59 0.86 0.45 188 XMLngstWrd_03 1467 0.36 0.19 0.45 189 LongTLD 1455 0.68 1.16 0.45 190 URI_TRY_3LD 1426 0.69 1.19 0.44 191 XMPhish14 1420 0.58 0.88 0.44 192 T_Symld_Words_02 1393 0.47 0.56 0.43 193 XMBSHREFv2 1391 0.42 0.40 0.43 194 XMBody_78 1382 0.67 1.16 0.43 195 XMSubNoVowel 1353 0.40 0.36 0.42 196 TR_XM_SpammyWords2 1321 4.05 11.47 0.41 197 XM_URI_RBL 1305 1.13 2.62 0.40 198 HTML_IMAGE_ONLY_28 1300 0.42 0.45 0.40 199 HELO_MISC_IP 1296 0.30 0.09 0.40 200 XMLngstWrd_04 1294 0.32 0.15 0.40 ----------------------------------------------------------------------