Email: 528072 Autolearn: 0 AvgScore: 4.89 AvgScanTime: 1.29 sec Spam: 168322 Autolearn: 0 AvgScore: 13.74 AvgScanTime: 1.41 sec Ham: 359750 Autolearn: 0 AvgScore: 0.75 AvgScanTime: 1.23 sec Time Spent Running SA: 188.82 hours Time Spent Processing Spam: 65.86 hours Time Spent Processing Ham: 122.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 157446 89.76 93.54 87.99 2 XM_B_Unicode 143643 76.49 85.34 72.35 3 DKIM_SIGNED 123165 66.98 73.17 64.08 4 XM_B_SpammyWords 122439 54.83 72.74 46.45 5 XM_DK_Pass 116526 64.91 69.23 62.90 6 RELAYCOUNTRY_US 112120 67.87 66.61 68.47 7 DKIM_VALID 109873 62.38 65.28 61.02 8 DCC_CHECK 103670 41.56 61.59 32.19 9 XM_B_Unicode3 96136 47.64 57.11 43.20 10 XMListUnsubscribeExists 92560 44.30 54.99 39.30 11 DKIM_VALID_AU 87414 49.87 51.93 48.90 12 LOC_TINY_FONT_1 82817 36.38 49.20 30.39 13 BAYES_50 80268 57.47 47.69 62.04 14 XM_B_SpammyWords2 78831 28.23 46.83 19.53 15 DCC_CHECK_NEGATIVE 62253 57.95 36.98 67.76 16 T_KAM_HTML_FONT_INVALID 59571 27.45 35.39 23.73 17 XM_Multi_Part_URI 58834 28.61 34.95 25.65 18 HTML_FONT_LOW_CONTRAST 58075 29.05 34.50 26.50 19 RCVD_IN_MSPIKE_H2 54305 30.56 32.26 29.77 20 FVGT_m_MULTI_ODD 54023 27.17 32.10 24.87 21 XM_B_Unsub 51974 24.14 30.88 20.98 22 XM_DK_Undo_02 50312 12.19 29.89 3.92 23 TR_XM_BayesUnsub 49914 20.93 29.65 16.85 24 BAYES_99 40359 9.53 23.98 2.77 25 MIME_HTML_ONLY 39580 19.42 23.51 17.51 26 DKIM_VALID_EF 38721 24.88 23.00 25.76 27 TR_XM_DKIM_Undo 37328 8.36 22.18 1.89 28 ALL_TRUSTED 35337 26.52 20.99 29.11 29 T_TM2_M_HEADER_IN_MSG 34808 26.34 20.68 28.98 30 XMSubLong 33926 20.29 20.16 20.36 31 XM_B_SpammyWords3 33325 9.73 19.80 5.02 32 BOUNCE_MESSAGE 32497 18.21 19.31 17.70 33 ANY_BOUNCE_MESSAGE 32497 18.21 19.31 17.70 34 BAYES_999 31155 7.34 18.51 2.12 35 XM_B_Phish_Phrases 31083 11.17 18.47 7.75 36 TR_DCC_Bayes_99 27184 5.88 16.15 1.07 37 TR_XM_DK_Unsub 26839 12.36 15.95 10.69 38 UNPARSEABLE_RELAY 25191 12.07 14.97 10.72 39 LOTS_OF_MONEY 24492 8.94 14.55 6.32 40 TR_MAX_INTL_RELAY 23525 7.57 13.98 4.57 41 TR_XM_SpammyWords4 22358 7.13 13.28 4.26 42 RELAYCOUNTRY_META 21881 6.55 13.00 3.53 43 XM_Evil_Numbers_Gen 18188 9.24 10.81 8.51 44 TR_XM_SpammyWords2 15925 3.32 9.46 0.45 45 TR_XM_SpammyRelay 15192 4.09 9.03 1.78 46 BAYES_80 14974 4.76 8.90 2.82 47 BOTNET_IPINHOSTNAME 14785 4.49 8.78 2.49 48 FSL_BULK_SIG 14250 7.06 8.47 6.41 49 LotsOfNums_01 14209 7.66 8.44 7.30 50 BAYES_60 13867 7.17 8.24 6.67 51 XM_B_Unsub2 13653 6.05 8.11 5.09 52 DKIM_INVALID 13292 4.60 7.90 3.06 53 T_SCC_BODY_TEXT_LINE 13182 8.26 7.83 8.46 54 TR_XM_UnparsRelay 12726 3.23 7.56 1.21 55 XM_Body_Dirty_Words 12368 4.08 7.35 2.54 56 BOTNET 11884 3.10 7.06 1.24 57 RCVD_IN_BL_SPAMCOP_NET 11171 2.39 6.64 0.40 58 XM_B_Investor 10951 3.30 6.51 1.80 59 XM_B_PhoneNumber 10809 8.37 6.42 9.29 60 HTML_IMAGE_RATIO_02 10020 4.79 5.95 4.24 61 XM_B_SpammyTLD 9640 3.37 5.73 2.26 62 TR_XM_PhishingBody 9389 2.67 5.58 1.30 63 MPART_ALT_DIFF 9350 4.44 5.55 3.91 64 TR_XM_SPAMCOP 9299 1.90 5.52 0.20 65 XMSubMetaSx_00 8943 3.42 5.31 2.54 66 RELAYCOUNTRY_CA 8387 2.14 4.98 0.81 67 XM_UncommonTLD01 8238 4.04 4.89 3.64 68 UNTRUSTED_Relay 8029 2.36 4.77 1.23 69 BAYES_95 8001 2.71 4.75 1.75 70 XM_B_SpammyWords4 7899 1.89 4.69 0.57 71 XM_H_GMP 7282 5.15 4.33 5.53 72 XM_H_Long_From01 7196 4.43 4.28 4.50 73 HTML_IMAGE_RATIO_04 7080 4.30 4.21 4.34 74 MIME_HTML_MOSTLY 6505 2.72 3.86 2.19 75 T_XMDrugObfuBody_14 6451 2.54 3.83 1.94 76 XMStrtUSub 6325 3.93 3.76 4.01 77 XMSexyCombo_05 6146 1.76 3.65 0.88 78 T_XMDrugObfuBody_08 5951 2.78 3.54 2.43 79 TR_XM_SpammyWords5 5921 1.82 3.52 1.03 80 TooManyTo_001 5738 6.42 3.41 7.83 81 TM2_M_VERY_LONG_WORD 5663 2.13 3.36 1.55 82 XMDiploma_00 5498 2.07 3.27 1.51 83 HTML_IMAGE_RATIO_06 5427 3.36 3.22 3.42 84 XM_CamelCaseFrm001 5404 2.11 3.21 1.60 85 XMGppyBdWords 5387 1.13 3.20 0.17 86 XMEqualsVooDoo_00 5273 1.03 3.13 0.05 87 XMNumbers 5258 2.75 3.12 2.58 88 XM_OfRef6 5193 1.80 3.09 1.20 89 HTML_IMAGE_RATIO_08 5116 3.13 3.04 3.18 90 HTML_FONT_FACE_BAD 4849 1.50 2.88 0.85 91 XMStockSpam_06 4546 1.72 2.70 1.27 92 MIME_HTML_ONLY_MULTI 4539 2.32 2.70 2.15 93 TR_XM_INV_DKIM 4486 0.96 2.67 0.17 94 T_XMHurry_00 4405 1.28 2.62 0.66 95 RCVD_IN_MSPIKE_WL 4390 3.88 2.61 4.48 96 RCVD_IN_MSPIKE_H3 4390 3.88 2.61 4.47 97 XM_URI_RBL 4341 1.00 2.58 0.26 98 XM_SPF_SoftFail 4273 1.72 2.54 1.33 99 URI_OPTOUT_3LD 4208 1.23 2.50 0.64 100 T_XMDrugObfuBody_00 4079 1.64 2.42 1.28 101 XMBody_17 3945 1.12 2.34 0.54 102 XM_B_URI_Unicode 3866 2.05 2.30 1.93 103 TM2_M_URI_OPT_OUT 3856 2.91 2.29 3.20 104 MIME_QP_LONG_LINE 3824 3.56 2.27 4.17 105 XMLngstWrd_00 3816 1.45 2.27 1.07 106 THIS_AD 3731 1.38 2.22 0.98 107 HTML_MIME_NO_HTML_TAG 3605 2.45 2.14 2.59 108 BAYES_40 3574 4.71 2.12 5.92 109 XM_UB50 3567 1.22 2.12 0.80 110 TR_XM_NoHeaderRelay 3435 0.78 2.04 0.19 111 HTML_NONELEMENT_30_40 3399 0.65 2.02 0.01 112 RELAYCOUNTRY_AU 3356 1.04 1.99 0.59 113 XMGenDplmaNmb 3251 1.25 1.93 0.93 114 T_TooManySym_01 3192 4.68 1.90 5.99 115 XMHTML_After_End 3148 0.84 1.87 0.35 116 T_FILL_THIS_FORM_SHORT 3085 1.36 1.83 1.14 117 MAILING_LIST_MULTI 3024 2.60 1.80 2.98 118 RCVD_IN_VALIDITY_SAFE 2978 2.88 1.77 3.40 119 KHOP_HELO_FCRDNS 2940 1.47 1.75 1.34 120 TR_XM_PhishingBody2 2908 0.56 1.73 0.01 121 FROM_EXCESS_BASE64 2849 1.67 1.69 1.66 122 XMBrknScrpt_02 2848 1.14 1.69 0.88 123 XMLngstWrd_01 2791 1.01 1.66 0.70 124 SpammyFromTLD_01 2773 1.06 1.65 0.78 125 HTTPS_HTTP_MISMATCH 2752 1.16 1.63 0.95 126 URI_HEX 2731 1.18 1.62 0.97 127 DIET_1 2728 0.73 1.62 0.31 128 T_REMOTE_IMAGE 2667 2.71 1.58 3.24 129 SUBJ_ALL_CAPS 2640 1.39 1.57 1.31 130 BAYES_20 2535 3.35 1.51 4.21 131 XM_B_Phish66 2514 0.69 1.49 0.32 132 XM_DK_Undo_01 2496 1.65 1.48 1.73 133 XMPhish30 2475 0.80 1.47 0.49 134 SpammyFromTLD_02 2442 0.59 1.45 0.19 135 RCVD_IN_PSBL 2413 0.65 1.43 0.28 136 USER_IN_DEF_DKIM_WL 2404 7.79 1.43 10.76 137 RCVD_IN_ZEN_LASTEXTERNAL 2380 0.45 1.41 0.00 138 SHORTCIRCUIT 2380 0.45 1.41 0.00 139 RCVD_IN_VALIDITY_RPBL 2377 0.50 1.41 0.07 140 XMPhish08 2302 0.51 1.37 0.11 141 HTML_FONT_TINY_NORDNS 2276 0.47 1.35 0.06 142 RELAYCOUNTRY_FR 2168 0.53 1.29 0.18 143 XM_B_DNDMA 2029 0.61 1.21 0.33 144 XM_SendGrid 2024 1.24 1.20 1.26 145 XM_PDF 2022 3.48 1.20 4.55 146 TR_XM_Base64_L1 2020 0.47 1.20 0.12 147 BASE64_LENGTH_79_INF 2002 0.62 1.19 0.35 148 TR_LOTS_OF_MONEY3 2001 0.49 1.19 0.16 149 TR_LOTS_OF_MONEY2 1955 0.54 1.16 0.25 150 T_MONEY_PERCENT 1955 0.54 1.16 0.25 151 XM_B_COPY_HTML 1942 0.84 1.15 0.69 152 XM_ProductURIs 1917 0.67 1.14 0.45 153 HTML_TAG_BALANCE_BODY 1908 0.69 1.13 0.48 154 XMSubMetaI_00 1887 0.69 1.12 0.49 155 URI_NOVOWEL 1838 1.50 1.09 1.69 156 XM_DIRTYINTL 1829 0.41 1.09 0.09 157 DKIM_ADSP_CUSTOM_MED 1816 0.92 1.08 0.85 158 XM_B_REG_HTML 1805 0.58 1.07 0.35 159 RCVD_IN_VALIDITY_CERTIFIED 1805 2.33 1.07 2.92 160 TR_MetaPhish_Combo_01 1800 0.79 1.07 0.65 161 XM_B_COVIDMETA 1765 0.45 1.05 0.17 162 URI_TRY_3LD 1716 0.68 1.02 0.52 163 XM_B_SEO 1665 0.46 0.99 0.21 164 TR_XM_InvalidRelay 1652 0.32 0.98 0.01 165 XM_UB99 1632 0.31 0.97 0.00 166 TR_XM_Base64_M1 1629 0.89 0.97 0.86 167 SHOPIFY_IMG_NOT_RCVD_SFY 1619 0.52 0.96 0.32 168 T_Symld_Words_02 1609 0.65 0.96 0.51 169 TM2_M_OBFU_COMMENT 1604 0.56 0.95 0.37 170 RCVD_IN_PBL 1600 0.72 0.95 0.62 171 XM_H_Long_From02 1557 0.80 0.93 0.73 172 XMLngstWrd_02 1556 0.67 0.92 0.56 173 XMReplyNow 1551 0.43 0.92 0.20 174 TR_XM_PHPForged 1549 0.56 0.92 0.39 175 TR_XM_SEO4 1534 0.37 0.91 0.11 176 TR_XM_PHPDW 1532 0.55 0.91 0.38 177 TR_XM_FormFill2 1521 0.55 0.90 0.38 178 MultiRelay_CC 1491 0.38 0.89 0.15 179 XM_H_PHPOS 1490 0.54 0.89 0.37 180 XMPhish14 1439 0.52 0.85 0.36 181 NML_ADSP_CUSTOM_MED 1428 0.64 0.85 0.54 182 BAYES_00 1406 8.01 0.84 11.36 183 TR_XM_RelayPhish 1406 0.32 0.84 0.08 184 LongTLD 1403 0.55 0.83 0.42 185 TR_Symld_Words 1387 1.25 0.82 1.45 186 MPART_ALT_DIFF_COUNT 1384 0.59 0.82 0.49 187 FORGED_GMAIL_RCVD 1351 0.60 0.80 0.51 188 XM_HighProb1 1350 0.26 0.80 0.01 189 XM_B_Crypto 1341 0.35 0.80 0.14 190 XMSubMetaSxObfu_03 1314 0.44 0.78 0.28 191 XMBdyGiftCard01 1297 0.58 0.77 0.49 192 T_STY_INVIS_DIRECT 1296 0.50 0.77 0.37 193 XM_Nigeria_01 1246 0.26 0.74 0.03 194 RDNS_DYNAMIC 1246 0.36 0.74 0.19 195 URIBL_BLACK 1223 0.26 0.73 0.04 196 HTML_IMAGE_ONLY_20 1207 0.65 0.72 0.62 197 XM_UB999 1203 0.23 0.71 0.00 198 XMLngstWrd_03 1194 0.40 0.71 0.25 199 RELAYCOUNTRY_GB 1189 0.53 0.71 0.45 200 TM2_M_A_HREF_HREF 1174 0.43 0.70 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 316557 89.76 93.54 87.99 2 XM_B_Unicode 260286 76.49 85.34 72.35 3 RELAYCOUNTRY_US 246307 67.87 66.61 68.47 4 DCC_CHECK_NEGATIVE 243780 57.95 36.98 67.76 5 DKIM_SIGNED 230543 66.98 73.17 64.08 6 XM_DK_Pass 226268 64.91 69.23 62.90 7 BAYES_50 223197 57.47 47.69 62.04 8 DKIM_VALID 219534 62.38 65.28 61.02 9 DKIM_VALID_AU 175915 49.87 51.93 48.90 10 XM_B_SpammyWords 167109 54.83 72.74 46.45 11 XM_B_Unicode3 155418 47.64 57.11 43.20 12 XMListUnsubscribeExists 141390 44.30 54.99 39.30 13 DCC_CHECK 115803 41.56 61.59 32.19 14 LOC_TINY_FONT_1 109317 36.38 49.20 30.39 15 RCVD_IN_MSPIKE_H2 107097 30.56 32.26 29.77 16 ALL_TRUSTED 104707 26.52 20.99 29.11 17 T_TM2_M_HEADER_IN_MSG 104267 26.34 20.68 28.98 18 HTML_FONT_LOW_CONTRAST 95342 29.05 34.50 26.50 19 DKIM_VALID_EF 92688 24.88 23.00 25.76 20 XM_Multi_Part_URI 92261 28.61 34.95 25.65 21 FVGT_m_MULTI_ODD 89473 27.17 32.10 24.87 22 T_KAM_HTML_FONT_INVALID 85376 27.45 35.39 23.73 23 XM_B_Unsub 75487 24.14 30.88 20.98 24 XMSubLong 73230 20.29 20.16 20.36 25 XM_B_SpammyWords2 70266 28.23 46.83 19.53 26 BOUNCE_MESSAGE 63670 18.21 19.31 17.70 27 ANY_BOUNCE_MESSAGE 63670 18.21 19.31 17.70 28 MIME_HTML_ONLY 62988 19.42 23.51 17.51 29 TR_XM_BayesUnsub 60610 20.93 29.65 16.85 30 BAYES_00 40874 8.01 0.84 11.36 31 USER_IN_DEF_DKIM_WL 38720 7.79 1.43 10.76 32 UNPARSEABLE_RELAY 38548 12.07 14.97 10.72 33 TR_XM_DK_Unsub 38443 12.36 15.95 10.69 34 XM_B_PhoneNumber 33409 8.37 6.42 9.29 35 XM_Evil_Numbers_Gen 30626 9.24 10.81 8.51 36 T_SCC_BODY_TEXT_LINE 30452 8.26 7.83 8.46 37 TooManyTo_001 28166 6.42 3.41 7.83 38 XM_B_Phish_Phrases 27878 11.17 18.47 7.75 39 LotsOfNums_01 26252 7.66 8.44 7.30 40 TR_XM_DK_Bayes 24026 4.71 0.50 6.68 41 BAYES_60 23983 7.17 8.24 6.67 42 TR_XM_DK_Bayes1 23202 4.54 0.45 6.45 43 FSL_BULK_SIG 23054 7.06 8.47 6.41 44 LOTS_OF_MONEY 22727 8.94 14.55 6.32 45 T_TooManySym_01 21537 4.68 1.90 5.99 46 BAYES_40 21293 4.71 2.12 5.92 47 XM_DKIMWhitelistDomains 20715 3.94 0.04 5.76 48 XM_H_GMP 19896 5.15 4.33 5.53 49 IN_ZIMBRA_NJ_WHITELIST 19773 3.78 0.11 5.50 50 TR_XM_DK_Bayes2 19161 3.76 0.41 5.33 51 XM_B_Unsub2 18311 6.05 8.11 5.09 52 XM_B_SpammyWords3 18059 9.73 19.80 5.02 53 TR_MAX_INTL_RELAY 16441 7.57 13.98 4.57 54 XM_PDF 16372 3.48 1.20 4.55 55 XM_H_Long_From01 16205 4.43 4.28 4.50 56 RCVD_IN_MSPIKE_WL 16102 3.88 2.61 4.48 57 RCVD_IN_MSPIKE_H3 16093 3.88 2.61 4.47 58 HTML_IMAGE_RATIO_04 15627 4.30 4.21 4.34 59 TR_XM_SpammyWords4 15313 7.13 13.28 4.26 60 HTML_IMAGE_RATIO_02 15261 4.79 5.95 4.24 61 BAYES_20 15154 3.35 1.51 4.21 62 MIME_QP_LONG_LINE 14985 3.56 2.27 4.17 63 XMStrtUSub 14442 3.93 3.76 4.01 64 XM_DK_Undo_02 14086 12.19 29.89 3.92 65 MPART_ALT_DIFF 14077 4.44 5.55 3.91 66 XM_UncommonTLD01 13078 4.04 4.89 3.64 67 RELAYCOUNTRY_META 12688 6.55 13.00 3.53 68 HTML_IMAGE_RATIO_06 12316 3.36 3.22 3.42 69 RCVD_IN_VALIDITY_SAFE 12236 2.88 1.77 3.40 70 T_REMOTE_IMAGE 11659 2.71 1.58 3.24 71 TM2_M_URI_OPT_OUT 11509 2.91 2.29 3.20 72 HTML_IMAGE_RATIO_08 11437 3.13 3.04 3.18 73 T_TooManySym_02 11052 2.28 0.60 3.07 74 DKIM_INVALID 11009 4.60 7.90 3.06 75 MAILING_LIST_MULTI 10732 2.60 1.80 2.98 76 RCVD_IN_VALIDITY_CERTIFIED 10521 2.33 1.07 2.92 77 RCVD_IN_IADB_LISTED 10185 2.14 0.67 2.83 78 BAYES_80 10139 4.76 8.90 2.82 79 BAYES_99 9964 9.53 23.98 2.77 80 TooManyTo_002 9709 2.05 0.66 2.70 81 HTML_MIME_NO_HTML_TAG 9329 2.45 2.14 2.59 82 XMNumbers 9284 2.75 3.12 2.58 83 XM_Body_Dirty_Words 9154 4.08 7.35 2.54 84 XMSubMetaSx_00 9137 3.42 5.31 2.54 85 RCVD_IN_IADB_SPF 8966 1.90 0.63 2.49 86 BOTNET_IPINHOSTNAME 8950 4.49 8.78 2.49 87 BAYES_05 8847 1.86 0.57 2.46 88 T_XMDrugObfuBody_08 8731 2.78 3.54 2.43 89 XM_B_SpammyTLD 8136 3.37 5.73 2.26 90 RCVD_IN_IADB_SENDERID 8064 1.72 0.61 2.24 91 MIME_HTML_MOSTLY 7867 2.72 3.86 2.19 92 RCVD_IN_IADB_DK 7810 1.67 0.61 2.17 93 MIME_HTML_ONLY_MULTI 7731 2.32 2.70 2.15 94 BAYES_999 7616 7.34 18.51 2.12 95 INVALID_MSGID 7571 1.50 0.19 2.10 96 T_XMDrugObfuBody_14 6973 2.54 3.83 1.94 97 XM_B_URI_Unicode 6944 2.05 2.30 1.93 98 TR_XM_DKIM_Undo 6794 8.36 22.18 1.89 99 RCVD_IN_IADB_VOUCHED 6672 1.35 0.28 1.85 100 XM_B_Investor 6484 3.30 6.51 1.80 101 TR_XM_SpammyRelay 6413 4.09 9.03 1.78 102 BAYES_95 6291 2.71 4.75 1.75 103 TO_MALFORMED 6230 1.19 0.03 1.73 104 XM_DK_Undo_01 6206 1.65 1.48 1.73 105 URI_NOVOWEL 6067 1.50 1.09 1.69 106 FROM_EXCESS_BASE64 5977 1.67 1.69 1.66 107 TooManyTo_003 5785 1.28 0.58 1.61 108 XM_CamelCaseFrm001 5741 2.11 3.21 1.60 109 TM2_M_VERY_LONG_WORD 5576 2.13 3.36 1.55 110 XMDiploma_00 5432 2.07 3.27 1.51 111 TR_Symld_Words 5223 1.25 0.82 1.45 112 KHOP_HELO_FCRDNS 4818 1.47 1.75 1.34 113 XM_SPF_SoftFail 4787 1.72 2.54 1.33 114 SUBJ_ALL_CAPS 4724 1.39 1.57 1.31 115 HELO_NODOT 4693 0.92 0.11 1.30 116 TR_XM_PhishingBody 4688 2.67 5.58 1.30 117 HELO_NO_DOMAIN 4687 0.92 0.11 1.30 118 XMCapTrack 4599 0.99 0.36 1.28 119 T_XMDrugObfuBody_00 4594 1.64 2.42 1.28 120 XMStockSpam_06 4555 1.72 2.70 1.27 121 XM_SendGrid 4518 1.24 1.20 1.26 122 RCVD_IN_IADB_OPTIN 4493 0.90 0.15 1.25 123 XMNoVowels 4488 0.97 0.38 1.25 124 BOTNET 4462 3.10 7.06 1.24 125 T_TooManySym_03 4461 0.89 0.15 1.24 126 UNTRUSTED_Relay 4415 2.36 4.77 1.23 127 TR_XM_UnparsRelay 4349 3.23 7.56 1.21 128 TooManyTo_004 4342 0.99 0.52 1.21 129 XM_OfRef6 4315 1.80 3.09 1.20 130 IN_HORDE_ADDRESS_BOOK 4196 0.83 0.10 1.17 131 T_FILL_THIS_FORM_SHORT 4091 1.36 1.83 1.14 132 TR_DCC_Bayes_99 3861 5.88 16.15 1.07 133 XM_GoogleGroups 3858 0.93 0.62 1.07 134 XMLngstWrd_00 3855 1.45 2.27 1.07 135 TR_XM_SpammyWords5 3691 1.82 3.52 1.03 136 TVD_SPACE_RATIO 3659 0.76 0.22 1.02 137 TooManyTo_005 3642 0.85 0.49 1.01 138 XM_ShortIntro_01 3577 0.83 0.49 0.99 139 THIS_AD 3538 1.38 2.22 0.98 140 URI_HEX 3487 1.18 1.62 0.97 141 HTTPS_HTTP_MISMATCH 3400 1.16 1.63 0.95 142 XMGenDplmaNmb 3345 1.25 1.93 0.93 143 XMSexyCombo_05 3172 1.76 3.65 0.88 144 XMBrknScrpt_02 3164 1.14 1.69 0.88 145 XMGappySubj_01 3119 0.69 0.31 0.87 146 HTML_IMAGE_ONLY_32 3104 0.65 0.19 0.86 147 TR_XM_Base64_M1 3094 0.89 0.97 0.86 148 DKIM_ADSP_CUSTOM_MED 3061 0.92 1.08 0.85 149 HTML_FONT_FACE_BAD 3053 1.50 2.88 0.85 150 TR_XM_DK_SendGrid 2956 0.75 0.58 0.82 151 RELAYCOUNTRY_CA 2916 2.14 4.98 0.81 152 XM_UB50 2865 1.22 2.12 0.80 153 SpammyFromTLD_01 2807 1.06 1.65 0.78 154 XM_H_PHPMailer 2646 0.66 0.51 0.74 155 XM_H_Long_From02 2643 0.80 0.93 0.73 156 XMLngstWrd_01 2527 1.01 1.66 0.70 157 XM_B_COPY_HTML 2473 0.84 1.15 0.69 158 T_XMHurry_00 2368 1.28 2.62 0.66 159 TR_MetaPhish_Combo_01 2352 0.79 1.07 0.65 160 URI_OPTOUT_3LD 2305 1.23 2.50 0.64 161 TO_NO_BRKTS_HTML_ONLY 2273 0.56 0.41 0.63 162 HTML_IMAGE_ONLY_20 2233 0.65 0.72 0.62 163 RCVD_IN_PBL 2220 0.72 0.95 0.62 164 TVD_RCVD_IP 2215 0.60 0.56 0.62 165 RELAYCOUNTRY_AU 2133 1.04 1.99 0.59 166 T_OBFU_PDF_ATTACH 2066 0.44 0.17 0.57 167 XM_B_SpammyWords4 2059 1.89 4.69 0.57 168 XMGappySubj_02 2014 0.41 0.08 0.56 169 XMLngstWrd_02 2006 0.67 0.92 0.56 170 FROM_GOV_DKIM_AU 1954 0.40 0.08 0.54 171 XMBody_17 1952 1.12 2.34 0.54 172 NML_ADSP_CUSTOM_MED 1948 0.64 0.85 0.54 173 URI_TRY_3LD 1879 0.68 1.02 0.52 174 FORGED_GMAIL_RCVD 1839 0.60 0.80 0.51 175 T_Symld_Words_02 1820 0.65 0.96 0.51 176 XMBdyGiftCard01 1779 0.58 0.77 0.49 177 XMSubMetaI_00 1761 0.69 1.12 0.49 178 XMPhish30 1756 0.80 1.47 0.49 179 MPART_ALT_DIFF_COUNT 1752 0.59 0.82 0.49 180 HTML_TAG_BALANCE_BODY 1730 0.69 1.13 0.48 181 T_TVD_MIME_NO_HEADERS 1679 0.33 0.03 0.47 182 XMDateMe_00 1657 0.46 0.45 0.46 183 TR_XM_SpammyWords2 1633 3.32 9.46 0.45 184 XMBody_95 1632 0.35 0.13 0.45 185 SHORT_HELO_AND_INLINE_IMAGE 1616 0.32 0.04 0.45 186 RELAYCOUNTRY_GB 1607 0.53 0.71 0.45 187 XM_ProductURIs 1604 0.67 1.14 0.45 188 RELAYCOUNTRY_NL 1566 0.35 0.17 0.44 189 T_TooManySym_04 1560 0.31 0.04 0.43 190 XMBSHREFv2 1550 0.43 0.42 0.43 191 XM_B_FormFill 1527 0.30 0.03 0.42 192 XMSlimDrugH 1526 0.46 0.52 0.42 193 XMOemUri 1526 0.35 0.20 0.42 194 LongTLD 1521 0.55 0.83 0.42 195 HTML_IMAGE_ONLY_16 1508 0.34 0.18 0.42 196 RCVD_IN_BL_SPAMCOP_NET 1438 2.39 6.64 0.40 197 XMMoneyMeta_00 1423 0.42 0.48 0.40 198 HELO_MISC_IP 1423 0.29 0.05 0.40 199 TR_XM_PHPForged 1388 0.56 0.92 0.39 200 TR_XM_PHPDW 1381 0.55 0.91 0.38 ----------------------------------------------------------------------