Email: 534302 Autolearn: 0 AvgScore: 3.00 AvgScanTime: 1.31 sec Spam: 145406 Autolearn: 0 AvgScore: 15.47 AvgScanTime: 1.52 sec Ham: 388896 Autolearn: 0 AvgScore: -1.66 AvgScanTime: 1.24 sec Time Spent Running SA: 194.82 hours Time Spent Processing Spam: 61.25 hours Time Spent Processing Ham: 133.56 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138564 91.15 95.29 89.60 2 DKIM_SIGNED 126618 68.74 87.08 61.88 3 XM_DK_Pass 119495 66.55 82.18 60.70 4 XM_B_Unicode 118475 77.43 81.48 75.92 5 DKIM_VALID 118255 65.62 81.33 59.75 6 RELAYCOUNTRY_US 116063 77.41 79.82 76.50 7 DCC_CHECK 107522 47.32 73.95 37.36 8 XM_B_SpammyWords 98328 49.82 67.62 43.16 9 XMListUnsubscribeExists 95881 46.22 65.94 38.85 10 DKIM_VALID_AU 92975 52.55 63.94 48.29 11 XM_B_Unicode3 69661 45.62 47.91 44.76 12 LOC_TINY_FONT_1 68374 29.20 47.02 22.54 13 BAYES_50 59584 53.45 40.98 58.11 14 RCVD_IN_MSPIKE_H2 59396 33.01 40.85 30.07 15 XM_B_SpammyWords2 57389 24.11 39.47 18.37 16 XM_DK_Undo_02 56445 13.43 38.82 3.94 17 HTML_FONT_LOW_CONTRAST 53312 26.76 36.66 23.06 18 MIME_HTML_ONLY 47606 27.40 32.74 25.41 19 FVGT_m_MULTI_ODD 45329 23.25 31.17 20.28 20 T_KAM_HTML_FONT_INVALID 43074 20.67 29.62 17.32 21 BAYES_99 43041 9.95 29.60 2.60 22 DKIM_VALID_EF 42854 26.10 29.47 24.84 23 TR_XM_DKIM_Undo 40648 8.91 27.95 1.79 24 XMSubLong 39098 26.31 26.89 26.09 25 DCC_CHECK_NEGATIVE 35541 52.21 24.44 62.60 26 BAYES_999 33656 7.76 23.15 2.00 27 T_TM2_M_HEADER_IN_MSG 32553 26.24 22.39 27.68 28 TR_XM_DK_Unsub 31164 13.51 21.43 10.55 29 TR_DCC_Bayes_99 29881 6.24 20.55 0.89 30 XM_Multi_Part_URI 28979 13.61 19.93 11.25 31 XM_B_Unsub 26098 10.38 17.95 7.55 32 UNPARSEABLE_RELAY 25508 12.01 17.54 9.93 33 RELAYCOUNTRY_META 25268 6.85 17.38 2.91 34 TR_XM_BayesUnsub 25219 8.88 17.34 5.72 35 TR_MAX_INTL_RELAY 20710 6.92 14.24 4.18 36 XM_B_SpammyWords3 20307 6.58 13.97 3.82 37 BOTNET 18141 4.38 12.48 1.36 38 LOTS_OF_MONEY 17175 8.77 11.81 7.63 39 TR_XM_SpammyRelay 17132 4.22 11.78 1.39 40 FSL_BULK_SIG 15873 9.14 10.92 8.47 41 TR_XM_SpammyWords4 15773 7.40 10.85 6.12 42 BOTNET_IPINHOSTNAME 15527 4.95 10.68 2.81 43 TR_XM_SpammyWords2 15360 3.14 10.56 0.37 44 XM_B_Phish_Phrases 13669 5.78 9.40 4.43 45 RCVD_IN_BL_SPAMCOP_NET 13666 2.87 9.40 0.43 46 TR_XM_UnparsRelay 13532 3.36 9.31 1.13 47 XM_Evil_Numbers_Gen 13330 8.61 9.17 8.40 48 BAYES_80 13211 4.30 9.09 2.51 49 UNTRUSTED_Relay 12887 3.30 8.86 1.22 50 BAYES_60 12326 6.34 8.48 5.55 51 T_SCC_BODY_TEXT_LINE 11434 8.26 7.86 8.41 52 TR_XM_SPAMCOP 11215 2.28 7.71 0.25 53 XM_Body_Dirty_Words 10759 3.74 7.40 2.38 54 LotsOfNums_01 10153 6.72 6.98 6.63 55 XMSubMetaSx_00 9408 4.13 6.47 3.25 56 MPART_ALT_DIFF 9045 7.86 6.22 8.47 57 XM_B_PhoneNumber 8940 7.73 6.15 8.32 58 XMStrtUSub 8698 8.72 5.98 9.74 59 XM_SPF_SoftFail 8532 2.45 5.87 1.17 60 XM_H_Long_From01 8409 4.96 5.78 4.66 61 DKIM_INVALID 8363 3.11 5.75 2.13 62 HTML_IMAGE_RATIO_02 8198 4.08 5.64 3.49 63 RELAYCOUNTRY_CA 7963 2.07 5.48 0.79 64 XM_UncommonTLD01 7650 3.92 5.26 3.42 65 HTML_IMAGE_RATIO_04 7262 10.22 4.99 12.17 66 TR_XM_PhishingBody 7232 2.64 4.97 1.77 67 XM_H_GMP 7105 4.79 4.89 4.75 68 BAYES_95 6951 2.52 4.78 1.67 69 XMSexyCombo_05 6865 2.21 4.72 1.27 70 XM_UB50 6462 1.78 4.44 0.79 71 RCVD_IN_VALIDITY_RPBL 6406 1.25 4.41 0.07 72 BOTNET_NORDNS 6354 1.20 4.37 0.01 73 RCVD_IN_PBL 6053 1.54 4.16 0.56 74 T_XMDrugObfuBody_14 5907 2.33 4.06 1.68 75 XM_B_Investor 5818 2.03 4.00 1.29 76 TooManyTo_001 5541 6.18 3.81 7.07 77 TR_XM_InvalidRelay 5473 1.03 3.76 0.01 78 MIME_HTML_ONLY_MULTI 5427 6.04 3.73 6.90 79 XM_OfRef6 5237 1.67 3.60 0.95 80 XM_B_SpammyTLD 5208 2.97 3.58 2.74 81 FROM_EXCESS_BASE64 5182 1.98 3.56 1.39 82 XMNumbers 5079 2.84 3.49 2.60 83 MIME_QP_LONG_LINE 5055 3.92 3.48 4.09 84 XM_CamelCaseFrm001 4956 1.94 3.41 1.40 85 TM2_M_VERY_LONG_WORD 4838 1.65 3.33 1.02 86 TR_XM_SpammyWords5 4810 1.70 3.31 1.09 87 MIME_HTML_MOSTLY 4616 2.27 3.17 1.94 88 RELAYCOUNTRY_KR 4613 0.87 3.17 0.02 89 T_XMDrugObfuBody_08 4603 1.82 3.17 1.31 90 XM_B_URI_Unicode 4601 2.01 3.16 1.58 91 XM_B_Unsub2 4521 1.91 3.11 1.46 92 HTML_IMAGE_RATIO_06 4427 4.18 3.04 4.60 93 XMDiploma_00 4390 1.75 3.02 1.27 94 ALL_TRUSTED 4231 16.21 2.91 21.19 95 RCVD_IN_MSPIKE_WL 3983 3.87 2.74 4.29 96 RCVD_IN_MSPIKE_H3 3983 3.87 2.74 4.29 97 HTML_FONT_TINY_NORDNS 3954 0.78 2.72 0.05 98 TR_XM_INV_DKIM 3920 0.83 2.70 0.13 99 XM_URI_RBL 3918 0.99 2.69 0.35 100 XM_B_SpammyWords4 3884 1.17 2.67 0.61 101 HTML_IMAGE_RATIO_08 3795 2.23 2.61 2.09 102 RELAYCOUNTRY_AU 3732 0.99 2.57 0.40 103 TR_XM_RelayPhish 3556 0.73 2.45 0.09 104 MAILING_LIST_MULTI 3538 2.41 2.43 2.40 105 T_TooManySym_01 3521 3.94 2.42 4.50 106 BAYES_40 3521 6.26 2.42 7.70 107 T_HTML_ATTACH 3397 4.33 2.34 5.08 108 T_XMHurry_00 3361 1.17 2.31 0.75 109 XMBody_17 3312 0.87 2.28 0.34 110 T_FILL_THIS_FORM_SHORT 3277 1.20 2.25 0.81 111 TR_XM_NoHeaderRelay 3146 0.71 2.16 0.16 112 XMStockSpam_06 2910 1.36 2.00 1.12 113 RCVD_IN_VALIDITY_SAFE 2902 3.23 2.00 3.69 114 SpammyFromTLD_02 2821 0.82 1.94 0.41 115 TM2_M_URI_OPT_OUT 2814 1.70 1.94 1.62 116 TR_LOTS_OF_MONEY3 2686 0.78 1.85 0.38 117 NORDNS_LOW_CONTRAST 2628 0.52 1.81 0.04 118 USER_IN_DEF_DKIM_WL 2623 8.34 1.80 10.79 119 HTML_MIME_NO_HTML_TAG 2564 2.03 1.76 2.13 120 BAYES_20 2555 3.96 1.76 4.79 121 T_XMDrugObfuBody_00 2550 1.05 1.75 0.79 122 TR_XM_SpoofStaff 2496 0.58 1.72 0.15 123 T_REMOTE_IMAGE 2460 2.78 1.69 3.18 124 URI_PHISH 2449 0.52 1.68 0.08 125 URI_TRY_3LD 2421 0.79 1.66 0.47 126 HTML_IMAGE_ONLY_20 2361 0.84 1.62 0.54 127 XMPhish30 2351 0.94 1.62 0.69 128 TR_XM_SpoofStaff4 2340 0.51 1.61 0.10 129 XMBrknScrpt_02 2328 0.79 1.60 0.48 130 SHORTCIRCUIT 2321 0.43 1.60 0.00 131 RCVD_IN_ZEN_LASTEXTERNAL 2321 0.43 1.60 0.00 132 TR_XM_SpoofStaff2 2297 0.43 1.58 0.00 133 T_OBFU_HTML_ATTACH 2286 0.43 1.57 0.00 134 XMSpoofStaff 2278 0.43 1.57 0.00 135 TR_XM_HtmlAttach 2274 0.43 1.56 0.00 136 TR_XM_SB_Phish1 2263 0.43 1.56 0.01 137 SpammyFromTLD_01 2253 0.90 1.55 0.66 138 SUBJ_ALL_CAPS 2227 1.30 1.53 1.21 139 XM_DK_Undo_01 2213 1.56 1.52 1.58 140 URI_HEX 2210 1.13 1.52 0.99 141 XM_SendGrid 2193 1.24 1.51 1.14 142 XMGenDplmaNmb 2112 0.91 1.45 0.71 143 XM_B_Phish66 2100 0.59 1.44 0.27 144 URI_NOVOWEL 2093 1.42 1.44 1.41 145 RCVD_IN_VALIDITY_CERTIFIED 2048 2.55 1.41 2.97 146 RCVD_IN_PSBL 2021 0.49 1.39 0.16 147 XM_UB60 1992 0.41 1.37 0.05 148 DKIM_ADSP_CUSTOM_MED 1948 0.84 1.34 0.66 149 HTTPS_HTTP_MISMATCH 1932 0.84 1.33 0.66 150 KHOP_HELO_FCRDNS 1897 1.19 1.30 1.14 151 TR_XM_PHPDW 1884 0.53 1.30 0.25 152 XM_B_COPY_HTML 1871 0.82 1.29 0.64 153 TR_XM_PHPForged 1869 0.53 1.29 0.24 154 TR_XM_FormFill2 1855 0.52 1.28 0.24 155 ANY_BOUNCE_MESSAGE 1854 3.25 1.28 3.99 156 TR_MetaPhish_Combo_01 1853 0.76 1.27 0.57 157 BOUNCE_MESSAGE 1851 3.25 1.27 3.99 158 XM_H_PHPOS 1825 0.51 1.26 0.23 159 XM_H_Long_From02 1717 0.85 1.18 0.73 160 HTML_TAG_BALANCE_BODY 1705 0.67 1.17 0.48 161 TR_XM_Base64_M1 1664 0.67 1.14 0.50 162 NML_ADSP_CUSTOM_MED 1642 0.62 1.13 0.43 163 RELAYCOUNTRY_FR 1640 0.48 1.13 0.23 164 SHOPIFY_IMG_NOT_RCVD_SFY 1630 0.45 1.12 0.20 165 T_MONEY_PERCENT 1598 0.42 1.10 0.17 166 TR_LOTS_OF_MONEY2 1598 0.42 1.10 0.17 167 XM_B_SEO 1542 0.45 1.06 0.22 168 T_STY_INVIS_DIRECT 1497 0.54 1.03 0.35 169 RCVD_IN_IADB_LISTED 1493 2.21 1.03 2.65 170 XM_UB99 1488 0.28 1.02 0.00 171 XM_B_DNDMA 1474 0.57 1.01 0.41 172 TM2_M_OBFU_COMMENT 1469 0.61 1.01 0.46 173 LongTLD 1457 0.51 1.00 0.33 174 XMHTML_After_End 1451 0.53 1.00 0.35 175 TR_XM_SEO4 1446 0.35 0.99 0.11 176 XM_B_REG_HTML 1444 0.40 0.99 0.18 177 XMSubMetaI_00 1425 0.45 0.98 0.26 178 MPART_ALT_DIFF_COUNT 1419 0.61 0.98 0.48 179 FORGED_GMAIL_RCVD 1416 0.56 0.97 0.40 180 XMSexyCombo_01 1414 0.39 0.97 0.17 181 XMSubMetaSxObfu_03 1400 0.49 0.96 0.31 182 XM_UB80 1393 0.27 0.96 0.01 183 XM_DIRTYINTL 1387 0.31 0.95 0.06 184 TR_Symld_Words 1374 1.23 0.94 1.33 185 DIET_1 1372 0.46 0.94 0.28 186 DKIM_ADSP_NXDOMAIN 1366 0.45 0.94 0.26 187 T_Symld_Words_02 1364 0.65 0.94 0.54 188 RCVD_IN_IADB_SPF 1347 1.96 0.93 2.35 189 XM_HighProb1 1343 0.26 0.92 0.01 190 RCVD_IN_IADB_DK 1328 1.75 0.91 2.07 191 RCVD_IN_IADB_SENDERID 1318 1.78 0.91 2.11 192 HTML_FONT_FACE_BAD 1304 8.44 0.90 11.26 193 XM_PDF 1304 3.23 0.90 4.11 194 XM_B_COVIDMETA 1302 0.33 0.90 0.11 195 XMPhish14 1285 0.63 0.88 0.53 196 XMMoneyMeta_00 1272 0.55 0.87 0.43 197 XM_ProductURIs 1254 0.48 0.86 0.34 198 MultiRelay_CC 1246 0.31 0.86 0.11 199 TR_XM_DK_SendGrid 1245 0.76 0.86 0.73 200 RELAYCOUNTRY_GB 1240 0.52 0.85 0.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 348455 91.15 95.29 89.60 2 RELAYCOUNTRY_US 297516 77.41 79.82 76.50 3 XM_B_Unicode 295260 77.43 81.48 75.92 4 DCC_CHECK_NEGATIVE 243430 52.21 24.44 62.60 5 DKIM_SIGNED 240643 68.74 87.08 61.88 6 XM_DK_Pass 236067 66.55 82.18 60.70 7 DKIM_VALID 232376 65.62 81.33 59.75 8 BAYES_50 225989 53.45 40.98 58.11 9 DKIM_VALID_AU 187805 52.55 63.94 48.29 10 XM_B_Unicode3 174074 45.62 47.91 44.76 11 XM_B_SpammyWords 167843 49.82 67.62 43.16 12 XMListUnsubscribeExists 151069 46.22 65.94 38.85 13 DCC_CHECK 145292 47.32 73.95 37.36 14 RCVD_IN_MSPIKE_H2 116959 33.01 40.85 30.07 15 T_TM2_M_HEADER_IN_MSG 107631 26.24 22.39 27.68 16 XMSubLong 101454 26.31 26.89 26.09 17 MIME_HTML_ONLY 98802 27.40 32.74 25.41 18 DKIM_VALID_EF 96605 26.10 29.47 24.84 19 HTML_FONT_LOW_CONTRAST 89660 26.76 36.66 23.06 20 LOC_TINY_FONT_1 87649 29.20 47.02 22.54 21 ALL_TRUSTED 82394 16.21 2.91 21.19 22 FVGT_m_MULTI_ODD 78879 23.25 31.17 20.28 23 XM_B_SpammyWords2 71457 24.11 39.47 18.37 24 T_KAM_HTML_FONT_INVALID 67342 20.67 29.62 17.32 25 BAYES_00 53210 10.12 0.59 13.68 26 HTML_IMAGE_RATIO_04 47325 10.22 4.99 12.17 27 HTML_FONT_FACE_BAD 43774 8.44 0.90 11.26 28 XM_Multi_Part_URI 43742 13.61 19.93 11.25 29 USER_IN_DEF_DKIM_WL 41948 8.34 1.80 10.79 30 XM_H_Trusted_IP 41532 7.77 0.00 10.68 31 TR_XM_DK_Unsub 41015 13.51 21.43 10.55 32 UNPARSEABLE_RELAY 38636 12.01 17.54 9.93 33 XMStrtUSub 37893 8.72 5.98 9.74 34 MPART_ALT_DIFF 32947 7.86 6.22 8.47 35 FSL_BULK_SIG 32945 9.14 10.92 8.47 36 T_SCC_BODY_TEXT_LINE 32723 8.26 7.86 8.41 37 XM_Evil_Numbers_Gen 32671 8.61 9.17 8.40 38 XM_B_PhoneNumber 32348 7.73 6.15 8.32 39 BAYES_40 29933 6.26 2.42 7.70 40 LOTS_OF_MONEY 29669 8.77 11.81 7.63 41 XM_B_Unsub 29357 10.38 17.95 7.55 42 TooManyTo_001 27503 6.18 3.81 7.07 43 MIME_HTML_ONLY_MULTI 26826 6.04 3.73 6.90 44 TR_XM_DK_Bayes 26251 5.02 0.40 6.75 45 LotsOfNums_01 25769 6.72 6.98 6.63 46 TR_XM_DK_Bayes1 25662 4.91 0.38 6.60 47 TR_XM_SpammyWords4 23785 7.40 10.85 6.12 48 XM_DKIMWhitelistDomains 22737 4.26 0.01 5.85 49 TR_XM_BayesUnsub 22253 8.88 17.34 5.72 50 TR_XM_DK_Bayes2 22019 4.19 0.26 5.66 51 IN_ZIMBRA_NJ_WHITELIST 21785 4.12 0.17 5.60 52 BAYES_60 21569 6.34 8.48 5.55 53 T_HTML_ATTACH 19749 4.33 2.34 5.08 54 BAYES_20 18617 3.96 1.76 4.79 55 XM_H_GMP 18492 4.79 4.89 4.75 56 XM_H_Long_From01 18104 4.96 5.78 4.66 57 HTML_IMAGE_RATIO_06 17905 4.18 3.04 4.60 58 T_TooManySym_01 17507 3.94 2.42 4.50 59 XM_B_Phish_Phrases 17231 5.78 9.40 4.43 60 RCVD_IN_MSPIKE_WL 16680 3.87 2.74 4.29 61 RCVD_IN_MSPIKE_H3 16680 3.87 2.74 4.29 62 TR_MAX_INTL_RELAY 16263 6.92 14.24 4.18 63 TO_IN_SUBJ 16166 3.26 0.84 4.16 64 XM_PDF 15971 3.23 0.90 4.11 65 MIME_QP_LONG_LINE 15909 3.92 3.48 4.09 66 XMSubNoVowel 15642 3.02 0.36 4.02 67 ANY_BOUNCE_MESSAGE 15530 3.25 1.28 3.99 68 BOUNCE_MESSAGE 15529 3.25 1.27 3.99 69 XM_DK_Undo_02 15314 13.43 38.82 3.94 70 XM_B_SpammyWords3 14854 6.58 13.97 3.82 71 RCVD_IN_VALIDITY_SAFE 14355 3.23 2.00 3.69 72 HTML_IMAGE_RATIO_02 13587 4.08 5.64 3.49 73 XM_UncommonTLD01 13281 3.92 5.26 3.42 74 BAYES_05 13219 2.67 0.72 3.40 75 XMSubMetaSx_00 12652 4.13 6.47 3.25 76 T_REMOTE_IMAGE 12376 2.78 1.69 3.18 77 RCVD_IN_VALIDITY_CERTIFIED 11555 2.55 1.41 2.97 78 RELAYCOUNTRY_META 11325 6.85 17.38 2.91 79 BOTNET_IPINHOSTNAME 10945 4.95 10.68 2.81 80 XM_B_SpammyTLD 10643 2.97 3.58 2.74 81 RCVD_IN_IADB_LISTED 10320 2.21 1.03 2.65 82 XMNumbers 10112 2.84 3.49 2.60 83 BAYES_99 10102 9.95 29.60 2.60 84 BAYES_80 9746 4.30 9.09 2.51 85 T_TooManySym_02 9385 1.94 0.67 2.41 86 MAILING_LIST_MULTI 9327 2.41 2.43 2.40 87 XM_Body_Dirty_Words 9242 3.74 7.40 2.38 88 RCVD_IN_IADB_SPF 9136 1.96 0.93 2.35 89 TooManyTo_002 9023 1.85 0.59 2.32 90 HTML_MIME_NO_HTML_TAG 8268 2.03 1.76 2.13 91 DKIM_INVALID 8267 3.11 5.75 2.13 92 RCVD_IN_IADB_SENDERID 8218 1.78 0.91 2.11 93 HTML_IMAGE_RATIO_08 8112 2.23 2.61 2.09 94 RCVD_IN_IADB_DK 8048 1.75 0.91 2.07 95 XMSubLongNoVowel 8005 1.52 0.09 2.06 96 XMSubGarbage 7846 1.48 0.03 2.02 97 BAYES_999 7782 7.76 23.15 2.00 98 MIME_HTML_MOSTLY 7536 2.27 3.17 1.94 99 INVALID_MSGID 7373 1.46 0.29 1.90 100 TR_XM_DKIM_Undo 6975 8.91 27.95 1.79 101 TR_XM_PhishingBody 6868 2.64 4.97 1.77 102 T_XMDrugObfuBody_14 6536 2.33 4.06 1.68 103 BAYES_95 6503 2.52 4.78 1.67 104 RCVD_IN_IADB_VOUCHED 6494 1.32 0.37 1.67 105 TO_MALFORMED 6298 1.19 0.04 1.62 106 TM2_M_URI_OPT_OUT 6293 1.70 1.94 1.62 107 XM_DK_Undo_01 6146 1.56 1.52 1.58 108 XM_B_URI_Unicode 6137 2.01 3.16 1.58 109 XM_B_Unsub2 5679 1.91 3.11 1.46 110 URI_NOVOWEL 5479 1.42 1.44 1.41 111 XM_CamelCaseFrm001 5426 1.94 3.41 1.40 112 TR_XM_SpammyRelay 5399 4.22 11.78 1.39 113 FROM_EXCESS_BASE64 5398 1.98 3.56 1.39 114 TooManyTo_003 5295 1.13 0.52 1.36 115 BOTNET 5287 4.38 12.48 1.36 116 TR_Symld_Words 5174 1.23 0.94 1.33 117 T_XMDrugObfuBody_08 5096 1.82 3.17 1.31 118 XM_B_Investor 5027 2.03 4.00 1.29 119 XMDiploma_00 4949 1.75 3.02 1.27 120 XMSexyCombo_05 4924 2.21 4.72 1.27 121 UNTRUSTED_Relay 4744 3.30 8.86 1.22 122 SUBJ_ALL_CAPS 4696 1.30 1.53 1.21 123 XM_SPF_SoftFail 4545 2.45 5.87 1.17 124 IN_HORDE_ADDRESS_BOOK 4489 0.88 0.14 1.15 125 KHOP_HELO_FCRDNS 4443 1.19 1.30 1.14 126 XM_SendGrid 4436 1.24 1.51 1.14 127 RCVD_IN_IADB_OPTIN 4405 0.87 0.18 1.13 128 TR_XM_UnparsRelay 4396 3.36 9.31 1.13 129 XMStockSpam_06 4342 1.36 2.00 1.12 130 TR_XM_SpammyWords5 4253 1.70 3.31 1.09 131 HELO_NODOT 4226 0.83 0.14 1.09 132 HELO_NO_DOMAIN 4217 0.82 0.12 1.08 133 XMGappySubj_01 4137 0.87 0.35 1.06 134 XMCapTrack 4112 0.89 0.46 1.06 135 TM2_M_VERY_LONG_WORD 3974 1.65 3.33 1.02 136 XM_GoogleGroups 3967 0.93 0.70 1.02 137 TooManyTo_004 3958 0.87 0.47 1.02 138 T_TooManySym_03 3853 0.78 0.22 0.99 139 URI_HEX 3844 1.13 1.52 0.99 140 XM_OfRef6 3688 1.67 3.60 0.95 141 XM_E_Blogspot 3553 0.69 0.11 0.91 142 TVD_SPACE_RATIO 3538 0.75 0.32 0.91 143 TR_DCC_Bayes_99 3463 6.24 20.55 0.89 144 TooManyTo_005 3312 0.74 0.44 0.85 145 FROM_GOV_DKIM_AU 3308 0.74 0.43 0.85 146 T_FILL_THIS_FORM_SHORT 3161 1.20 2.25 0.81 147 RELAYCOUNTRY_CA 3090 2.07 5.48 0.79 148 T_XMDrugObfuBody_00 3071 1.05 1.75 0.79 149 XM_UB50 3055 1.78 4.44 0.79 150 T_XMHurry_00 2906 1.17 2.31 0.75 151 TR_XM_DK_SendGrid 2831 0.76 0.86 0.73 152 XM_H_Long_From02 2824 0.85 1.18 0.73 153 XMGenDplmaNmb 2749 0.91 1.45 0.71 154 XM_ShortIntro_01 2736 0.62 0.38 0.70 155 XMPhish30 2668 0.94 1.62 0.69 156 SpammyFromTLD_01 2581 0.90 1.55 0.66 157 XMNoVowels 2581 0.65 0.60 0.66 158 DKIM_ADSP_CUSTOM_MED 2554 0.84 1.34 0.66 159 HTTPS_HTTP_MISMATCH 2551 0.84 1.33 0.66 160 TO_NO_BRKTS_HTML_ONLY 2527 0.62 0.55 0.65 161 T_OBFU_PDF_ATTACH 2506 0.50 0.11 0.64 162 XM_B_COPY_HTML 2491 0.82 1.29 0.64 163 XMLngstWrd_00 2482 0.64 0.65 0.64 164 XM_H_PHPMailer 2475 0.59 0.45 0.64 165 XM_B_SpammyWords4 2374 1.17 2.67 0.61 166 XMGappySubj_02 2276 0.45 0.07 0.59 167 TR_MetaPhish_Combo_01 2216 0.76 1.27 0.57 168 RCVD_IN_PBL 2164 1.54 4.16 0.56 169 HTML_IMAGE_ONLY_20 2113 0.84 1.62 0.54 170 TVD_RCVD_IP 2112 0.56 0.62 0.54 171 T_Symld_Words_02 2102 0.65 0.94 0.54 172 XMBdyGiftCard01 2073 0.57 0.67 0.53 173 XMPhish14 2073 0.63 0.88 0.53 174 XMBody_95 2030 0.44 0.21 0.52 175 TR_XM_Base64_M1 1937 0.67 1.14 0.50 176 HTML_IMAGE_ONLY_32 1878 0.42 0.26 0.48 177 XMBrknScrpt_02 1876 0.79 1.60 0.48 178 HTML_TAG_BALANCE_BODY 1849 0.67 1.17 0.48 179 MPART_ALT_DIFF_COUNT 1848 0.61 0.98 0.48 180 URI_TRY_3LD 1823 0.79 1.66 0.47 181 TM2_M_OBFU_COMMENT 1798 0.61 1.01 0.46 182 XMLngstWrd_01 1790 0.48 0.53 0.46 183 XMSlimDrugH 1708 0.47 0.54 0.44 184 RCVD_IN_BL_SPAMCOP_NET 1672 2.87 9.40 0.43 185 NML_ADSP_CUSTOM_MED 1666 0.62 1.13 0.43 186 XMMoneyMeta_00 1655 0.55 0.87 0.43 187 XM_B_FormFill 1644 0.31 0.02 0.42 188 TM2_M_BODY_EMPTY 1593 0.32 0.07 0.41 189 SpammyFromTLD_02 1580 0.82 1.94 0.41 190 MSGID_FROM_MTA_HEADER 1579 0.32 0.11 0.41 191 XM_B_DNDMA 1577 0.57 1.01 0.41 192 RELAYCOUNTRY_AU 1562 0.99 2.57 0.40 193 FORGED_GMAIL_RCVD 1551 0.56 0.97 0.40 194 RELAYCOUNTRY_GB 1516 0.52 0.85 0.39 195 TR_LOTS_OF_MONEY3 1460 0.78 1.85 0.38 196 XMBSHREFv2 1451 0.36 0.32 0.37 197 XMSubMetaSxObfu_02 1436 0.36 0.34 0.37 198 TR_XM_SpammyWords2 1436 3.14 10.56 0.37 199 XMDateMe_00 1390 0.36 0.37 0.36 200 XM_URI_RBL 1375 0.99 2.69 0.35 ----------------------------------------------------------------------