Email: 510102 Autolearn: 0 AvgScore: 3.03 AvgScanTime: 1.38 sec Spam: 150833 Autolearn: 0 AvgScore: 14.89 AvgScanTime: 1.56 sec Ham: 359269 Autolearn: 0 AvgScore: -1.95 AvgScanTime: 1.30 sec Time Spent Running SA: 195.16 hours Time Spent Processing Spam: 65.30 hours Time Spent Processing Ham: 129.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142538 90.60 94.50 88.96 2 DKIM_SIGNED 135829 74.38 90.05 67.80 3 XM_DK_Pass 127180 71.83 84.32 66.59 4 XM_B_Unicode 126554 76.61 83.90 73.54 5 DKIM_VALID 125868 70.88 83.45 65.60 6 RELAYCOUNTRY_US 124271 82.68 82.39 82.80 7 DCC_CHECK 112183 48.15 74.38 37.14 8 XM_B_SpammyWords 104655 51.16 69.38 43.51 9 DKIM_VALID_AU 101275 57.04 67.14 52.80 10 XMListUnsubscribeExists 99444 50.19 65.93 43.58 11 XM_B_Unicode3 74890 45.39 49.65 43.60 12 LOC_TINY_FONT_1 70804 31.17 46.94 24.55 13 BAYES_50 62567 52.37 41.48 56.94 14 RCVD_IN_MSPIKE_H2 61596 34.07 40.84 31.23 15 XM_B_SpammyWords2 61527 23.33 40.79 16.01 16 XM_DK_Undo_02 57934 14.64 38.41 4.66 17 HTML_FONT_LOW_CONTRAST 52900 27.69 35.07 24.59 18 FVGT_m_MULTI_ODD 48972 25.58 32.47 22.69 19 T_KAM_HTML_FONT_INVALID 48105 23.40 31.89 19.83 20 BAYES_99 45143 11.03 29.93 3.10 21 DKIM_VALID_EF 44919 27.90 29.78 27.11 22 MIME_HTML_ONLY 44053 24.79 29.21 22.94 23 TR_XM_DKIM_Undo 42267 9.92 28.02 2.32 24 XMSubLong 39672 23.59 26.30 22.45 25 DCC_CHECK_NEGATIVE 36284 51.35 24.06 62.81 26 BAYES_999 34621 8.48 22.95 2.41 27 T_TM2_M_HEADER_IN_MSG 31871 25.40 21.13 27.19 28 XM_Multi_Part_URI 31775 14.68 21.07 12.00 29 TR_DCC_Bayes_99 31448 7.07 20.85 1.29 30 TR_XM_DK_Unsub 31092 14.38 20.61 11.76 31 XM_B_Unsub 30339 11.73 20.11 8.21 32 TR_XM_BayesUnsub 29330 10.05 19.45 6.11 33 UNPARSEABLE_RELAY 29107 13.18 19.30 10.62 34 RELAYCOUNTRY_META 24771 7.41 16.42 3.63 35 XM_B_SpammyWords3 23107 7.31 15.32 3.95 36 TR_MAX_INTL_RELAY 22368 7.85 14.83 4.92 37 LOTS_OF_MONEY 20978 8.16 13.91 5.74 38 TR_XM_SpammyWords4 18279 6.45 12.12 4.07 39 BOTNET_IPINHOSTNAME 17682 5.57 11.72 2.98 40 TR_XM_SpammyRelay 17531 4.73 11.62 1.84 41 FSL_BULK_SIG 16955 9.44 11.24 8.68 42 TR_XM_SpammyWords2 16155 3.49 10.71 0.46 43 TR_XM_UnparsRelay 15486 4.00 10.27 1.37 44 BOTNET 15473 4.14 10.26 1.57 45 RCVD_IN_BL_SPAMCOP_NET 14263 3.16 9.46 0.52 46 BAYES_80 13605 4.77 9.02 2.99 47 XM_Evil_Numbers_Gen 13467 9.29 8.93 9.44 48 XM_B_Phish_Phrases 13160 5.79 8.72 4.56 49 XM_Body_Dirty_Words 13087 4.40 8.68 2.60 50 BAYES_60 12508 6.84 8.29 6.24 51 T_SCC_BODY_TEXT_LINE 11870 8.28 7.87 8.46 52 LotsOfNums_01 11144 6.93 7.39 6.73 53 TR_XM_SPAMCOP 10593 2.26 7.02 0.26 54 XM_B_PhoneNumber 10561 8.66 7.00 9.35 55 DKIM_INVALID 9961 3.50 6.60 2.19 56 UNTRUSTED_Relay 9784 3.00 6.49 1.53 57 HTML_IMAGE_RATIO_02 9765 4.83 6.47 4.14 58 XMSubMetaSx_00 9710 4.30 6.44 3.41 59 MPART_ALT_DIFF 9422 8.28 6.25 9.13 60 XM_UncommonTLD01 9229 4.48 6.12 3.79 61 RELAYCOUNTRY_CA 8859 2.37 5.87 0.90 62 TR_XM_PhishingBody 8286 2.71 5.49 1.54 63 BAYES_95 7998 2.92 5.30 1.92 64 XM_H_Long_From01 7837 5.16 5.20 5.15 65 XM_H_GMP 7704 5.26 5.11 5.33 66 T_XMDrugObfuBody_14 7294 2.78 4.84 1.91 67 XMStrtUSub 7080 8.90 4.69 10.67 68 XM_B_Investor 7057 2.38 4.68 1.42 69 XMSexyCombo_05 6867 2.28 4.55 1.32 70 HTML_IMAGE_RATIO_04 6808 10.93 4.51 13.62 71 MIME_HTML_MOSTLY 6208 2.69 4.12 2.10 72 XM_OfRef6 5943 1.90 3.94 1.05 73 TooManyTo_001 5734 6.79 3.80 8.04 74 TR_XM_SpammyWords5 5703 1.94 3.78 1.17 75 XMNumbers 5681 2.97 3.77 2.63 76 XM_B_SpammyTLD 5616 2.74 3.72 2.33 77 XM_B_URI_Unicode 5527 2.34 3.66 1.79 78 T_XMDrugObfuBody_08 5460 2.45 3.62 1.96 79 MIME_HTML_ONLY_MULTI 5385 6.26 3.57 7.38 80 TM2_M_VERY_LONG_WORD 5358 1.93 3.55 1.25 81 HTML_IMAGE_RATIO_06 5289 4.23 3.51 4.54 82 XM_B_Unsub2 4935 1.96 3.27 1.41 83 TR_XM_NoHeaderRelay 4881 1.11 3.24 0.22 84 XM_CamelCaseFrm001 4870 2.27 3.23 1.87 85 MIME_QP_LONG_LINE 4695 4.16 3.11 4.60 86 XM_UB50 4596 1.55 3.05 0.92 87 XM_SPF_SoftFail 4552 1.87 3.02 1.38 88 XMDiploma_00 4492 1.87 2.98 1.40 89 TR_XM_INV_DKIM 4383 0.97 2.91 0.15 90 RCVD_IN_MSPIKE_H3 4332 4.34 2.87 4.96 91 RCVD_IN_MSPIKE_WL 4332 4.35 2.87 4.97 92 HTML_IMAGE_RATIO_08 4323 2.22 2.87 1.95 93 RELAYCOUNTRY_AU 4243 1.31 2.81 0.68 94 RCVD_IN_VALIDITY_RPBL 4149 0.87 2.75 0.08 95 HTML_MIME_NO_HTML_TAG 4147 2.41 2.75 2.26 96 XM_URI_RBL 4065 1.07 2.70 0.38 97 KHOP_HELO_FCRDNS 3873 1.63 2.57 1.23 98 XM_B_SpammyWords4 3752 1.21 2.49 0.68 99 XMBody_17 3602 1.04 2.39 0.47 100 MAILING_LIST_MULTI 3592 2.52 2.38 2.57 101 T_TooManySym_01 3564 4.35 2.36 5.18 102 XMStockSpam_06 3452 1.53 2.29 1.21 103 TM2_M_URI_OPT_OUT 3261 1.84 2.16 1.70 104 USER_IN_DEF_DKIM_WL 3062 8.88 2.03 11.75 105 ALL_TRUSTED 3043 10.65 2.02 14.27 106 FROM_EXCESS_BASE64 2986 1.77 1.98 1.69 107 T_REMOTE_IMAGE 2934 2.91 1.95 3.31 108 T_XMHurry_00 2921 1.00 1.94 0.61 109 T_XMDrugObfuBody_00 2913 1.06 1.93 0.69 110 RCVD_IN_VALIDITY_SAFE 2884 2.91 1.91 3.33 111 XM_DK_Undo_01 2866 1.78 1.90 1.73 112 BAYES_40 2770 4.70 1.84 5.90 113 T_FILL_THIS_FORM_SHORT 2767 1.15 1.83 0.86 114 SpammyFromTLD_02 2663 0.80 1.77 0.40 115 URI_HEX 2596 1.21 1.72 1.00 116 XMBrknScrpt_02 2580 0.92 1.71 0.59 117 SpammyFromTLD_01 2510 1.06 1.66 0.81 118 TR_LOTS_OF_MONEY3 2484 0.75 1.65 0.37 119 XM_B_Phish66 2481 0.75 1.64 0.38 120 XMGenDplmaNmb 2479 1.03 1.64 0.77 121 XM_B_COPY_HTML 2424 1.18 1.61 1.00 122 RELAYCOUNTRY_FR 2418 0.64 1.60 0.24 123 RCVD_IN_PSBL 2376 0.66 1.58 0.28 124 SHORTCIRCUIT 2328 0.46 1.54 0.00 125 RCVD_IN_ZEN_LASTEXTERNAL 2328 0.46 1.54 0.00 126 BOTNET_NORDNS 2219 0.45 1.47 0.02 127 XMPhish30 2155 0.76 1.43 0.48 128 HTTPS_HTTP_MISMATCH 2134 0.89 1.41 0.67 129 XM_SendGrid 2130 1.37 1.41 1.35 130 SUBJ_ALL_CAPS 2015 1.30 1.34 1.29 131 BAYES_20 2010 3.87 1.33 4.94 132 HTML_IMAGE_ONLY_20 1997 0.78 1.32 0.56 133 RCVD_IN_VALIDITY_CERTIFIED 1992 2.35 1.32 2.78 134 URI_TRY_3LD 1987 0.74 1.32 0.50 135 DIET_1 1955 0.58 1.30 0.27 136 TR_MetaPhish_Combo_01 1914 0.82 1.27 0.63 137 XMBody_78 1900 0.56 1.26 0.27 138 XM_UB99 1832 0.37 1.21 0.01 139 HTML_FONT_TINY_NORDNS 1828 0.57 1.21 0.29 140 TR_XM_PHPDW 1827 0.60 1.21 0.34 141 XM_H_Long_From02 1824 0.90 1.21 0.77 142 MISSING_HEADERS 1819 0.59 1.21 0.34 143 URI_NOVOWEL 1819 1.38 1.21 1.45 144 TR_XM_PHPForged 1818 0.59 1.21 0.34 145 XMSexyCombo_01 1812 0.46 1.20 0.15 146 TR_XM_FormFill2 1796 0.59 1.19 0.33 147 RCVD_IN_PBL 1781 0.81 1.18 0.66 148 XM_H_PHPOS 1763 0.58 1.17 0.33 149 TR_XM_RelayPhish 1743 0.41 1.16 0.10 150 THIS_AD 1732 0.54 1.15 0.29 151 XM_S_SpammyWords 1718 0.50 1.14 0.23 152 TR_XM_Spammywords 1717 0.50 1.14 0.23 153 HTML_TAG_BALANCE_BODY 1704 0.67 1.13 0.47 154 XM_DIRTYINTL 1703 0.40 1.13 0.09 155 XMPhish14 1682 0.59 1.12 0.37 156 DKIM_ADSP_NXDOMAIN 1668 0.53 1.11 0.29 157 TR_LOTS_OF_MONEY2 1663 0.52 1.10 0.28 158 T_MONEY_PERCENT 1663 0.52 1.10 0.28 159 SHOPIFY_IMG_NOT_RCVD_SFY 1657 0.50 1.10 0.25 160 XMSlimDrugH 1626 0.65 1.08 0.47 161 XM_ProductURIs 1603 0.64 1.06 0.47 162 TR_XM_SEO4 1596 0.46 1.06 0.20 163 MultiRelay_CC 1560 0.39 1.03 0.12 164 MPART_ALT_DIFF_COUNT 1558 0.67 1.03 0.52 165 XM_B_SEO 1543 0.52 1.02 0.31 166 LongTLD 1539 0.56 1.02 0.36 167 TR_XM_InvalidRelay 1530 0.31 1.01 0.01 168 TM2_M_OBFU_COMMENT 1517 0.53 1.01 0.33 169 XM_B_COVIDMETA 1513 0.45 1.00 0.21 170 ANY_BOUNCE_MESSAGE 1509 2.75 1.00 3.48 171 BOUNCE_MESSAGE 1508 2.75 1.00 3.48 172 DKIM_ADSP_CUSTOM_MED 1492 0.87 0.99 0.82 173 XM_B_REG_HTML 1486 0.64 0.99 0.49 174 XM_H_Undi_Recip 1474 0.41 0.98 0.17 175 XM_H_DKIM_GOOG 1466 0.31 0.97 0.03 176 TR_Symld_Words 1449 1.28 0.96 1.41 177 XM_PDF 1428 3.26 0.95 4.23 178 XM_OfRef7 1408 0.44 0.93 0.24 179 RCVD_IN_IADB_LISTED 1400 2.60 0.93 3.30 180 XMBdyGiftCard01 1382 0.67 0.92 0.57 181 TM2_M_A_HREF_HREF 1358 0.45 0.90 0.26 182 RELAYCOUNTRY_GB 1352 0.59 0.90 0.46 183 XMHTML_After_End 1337 0.51 0.89 0.36 184 XM_BadFromFormat 1333 0.34 0.88 0.11 185 T_STY_INVIS_DIRECT 1332 0.51 0.88 0.36 186 TR_Mismatch_TLD_02 1320 0.32 0.88 0.09 187 RCVD_IN_XBL 1302 0.27 0.86 0.02 188 RCVD_IN_IADB_SPF 1293 2.28 0.86 2.88 189 NML_ADSP_CUSTOM_MED 1286 0.62 0.85 0.53 190 RCVD_IN_IADB_DK 1269 2.00 0.84 2.49 191 RCVD_IN_IADB_SENDERID 1266 2.07 0.84 2.58 192 FILL_THIS_FORM 1245 0.47 0.83 0.32 193 XM_UB999 1233 0.25 0.82 0.01 194 RDNS_DYNAMIC 1231 0.39 0.82 0.22 195 TR_XM_Undi_Recip19 1202 0.29 0.80 0.08 196 HTML_FONT_FACE_BAD 1199 8.81 0.79 12.17 197 T_DATE_IN_FUTURE_Q_PLUS 1198 0.25 0.79 0.01 198 XM_H_PHPMailer 1191 0.78 0.79 0.78 199 RCVD_IN_SORBS_DUL 1166 0.25 0.77 0.03 200 FORGED_GMAIL_RCVD 1166 0.58 0.77 0.49 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 319617 90.60 94.50 88.96 2 RELAYCOUNTRY_US 297483 82.68 82.39 82.80 3 XM_B_Unicode 264212 76.61 83.90 73.54 4 DKIM_SIGNED 243567 74.38 90.05 67.80 5 XM_DK_Pass 239227 71.83 84.32 66.59 6 DKIM_VALID 235689 70.88 83.45 65.60 7 DCC_CHECK_NEGATIVE 225670 51.35 24.06 62.81 8 BAYES_50 204567 52.37 41.48 56.94 9 DKIM_VALID_AU 189698 57.04 67.14 52.80 10 XM_B_Unicode3 156629 45.39 49.65 43.60 11 XMListUnsubscribeExists 156554 50.19 65.93 43.58 12 XM_B_SpammyWords 156325 51.16 69.38 43.51 13 DCC_CHECK 133433 48.15 74.38 37.14 14 RCVD_IN_MSPIKE_H2 112206 34.07 40.84 31.23 15 T_TM2_M_HEADER_IN_MSG 97692 25.40 21.13 27.19 16 DKIM_VALID_EF 97400 27.90 29.78 27.11 17 HTML_FONT_LOW_CONTRAST 88330 27.69 35.07 24.59 18 LOC_TINY_FONT_1 88196 31.17 46.94 24.55 19 MIME_HTML_ONLY 82406 24.79 29.21 22.94 20 FVGT_m_MULTI_ODD 81503 25.58 32.47 22.69 21 XMSubLong 80665 23.59 26.30 22.45 22 T_KAM_HTML_FONT_INVALID 71249 23.40 31.89 19.83 23 XM_B_SpammyWords2 57505 23.33 40.79 16.01 24 BAYES_00 52019 10.38 0.62 14.48 25 ALL_TRUSTED 51259 10.65 2.02 14.27 26 HTML_IMAGE_RATIO_04 48939 10.93 4.51 13.62 27 HTML_FONT_FACE_BAD 43719 8.81 0.79 12.17 28 XM_Multi_Part_URI 43116 14.68 21.07 12.00 29 TR_XM_DK_Unsub 42243 14.38 20.61 11.76 30 USER_IN_DEF_DKIM_WL 42217 8.88 2.03 11.75 31 XM_H_Trusted_IP 40926 8.02 0.00 11.39 32 XMStrtUSub 38320 8.90 4.69 10.67 33 UNPARSEABLE_RELAY 38137 13.18 19.30 10.62 34 XM_Evil_Numbers_Gen 33922 9.29 8.93 9.44 35 XM_B_PhoneNumber 33607 8.66 7.00 9.35 36 MPART_ALT_DIFF 32805 8.28 6.25 9.13 37 FSL_BULK_SIG 31188 9.44 11.24 8.68 38 T_SCC_BODY_TEXT_LINE 30381 8.28 7.87 8.46 39 XM_B_Unsub 29487 11.73 20.11 8.21 40 TooManyTo_001 28891 6.79 3.80 8.04 41 MIME_HTML_ONLY_MULTI 26523 6.26 3.57 7.38 42 TR_XM_DK_Bayes 25134 5.07 0.50 7.00 43 TR_XM_DK_Bayes1 24638 4.97 0.49 6.86 44 LotsOfNums_01 24183 6.93 7.39 6.73 45 XM_DKIMWhitelistDomains 23457 4.61 0.04 6.53 46 BAYES_60 22403 6.84 8.29 6.24 47 TR_XM_BayesUnsub 21935 10.05 19.45 6.11 48 BAYES_40 21205 4.70 1.84 5.90 49 IN_ZIMBRA_NJ_WHITELIST 21075 4.19 0.19 5.87 50 TR_XM_DK_Bayes2 20755 4.17 0.35 5.78 51 LOTS_OF_MONEY 20640 8.16 13.91 5.74 52 XM_H_GMP 19133 5.26 5.11 5.33 53 T_TooManySym_01 18612 4.35 2.36 5.18 54 XM_H_Long_From01 18486 5.16 5.20 5.15 55 RCVD_IN_MSPIKE_WL 17856 4.35 2.87 4.97 56 RCVD_IN_MSPIKE_H3 17815 4.34 2.87 4.96 57 BAYES_20 17755 3.87 1.33 4.94 58 TR_MAX_INTL_RELAY 17689 7.85 14.83 4.92 59 XM_DK_Undo_02 16757 14.64 38.41 4.66 60 MIME_QP_LONG_LINE 16521 4.16 3.11 4.60 61 XM_B_Phish_Phrases 16383 5.79 8.72 4.56 62 HTML_IMAGE_RATIO_06 16312 4.23 3.51 4.54 63 XMSubNoVowel 15520 3.20 0.53 4.32 64 XM_PDF 15194 3.26 0.95 4.23 65 HTML_IMAGE_RATIO_02 14888 4.83 6.47 4.14 66 TR_XM_SpammyWords4 14616 6.45 12.12 4.07 67 XM_B_SpammyWords3 14204 7.31 15.32 3.95 68 XM_UncommonTLD01 13606 4.48 6.12 3.79 69 RELAYCOUNTRY_META 13025 7.41 16.42 3.63 70 BAYES_05 12531 2.64 0.64 3.49 71 ANY_BOUNCE_MESSAGE 12510 2.75 1.00 3.48 72 BOUNCE_MESSAGE 12504 2.75 1.00 3.48 73 XMSubMetaSx_00 12246 4.30 6.44 3.41 74 RCVD_IN_VALIDITY_SAFE 11954 2.91 1.91 3.33 75 T_REMOTE_IMAGE 11885 2.91 1.95 3.31 76 RCVD_IN_IADB_LISTED 11851 2.60 0.93 3.30 77 BAYES_99 11137 11.03 29.93 3.10 78 BAYES_80 10728 4.77 9.02 2.99 79 BOTNET_IPINHOSTNAME 10722 5.57 11.72 2.98 80 RCVD_IN_IADB_SPF 10350 2.28 0.86 2.88 81 RCVD_IN_VALIDITY_CERTIFIED 9998 2.35 1.32 2.78 82 T_TooManySym_02 9901 2.15 0.71 2.76 83 XMNumbers 9452 2.97 3.77 2.63 84 TooManyTo_002 9381 2.04 0.69 2.61 85 XM_Body_Dirty_Words 9352 4.40 8.68 2.60 86 RCVD_IN_IADB_SENDERID 9273 2.07 0.84 2.58 87 MAILING_LIST_MULTI 9247 2.52 2.38 2.57 88 RCVD_IN_IADB_DK 8949 2.00 0.84 2.49 89 BAYES_999 8643 8.48 22.95 2.41 90 XM_B_SpammyTLD 8358 2.74 3.72 2.33 91 TR_XM_DKIM_Undo 8340 9.92 28.02 2.32 92 HTML_MIME_NO_HTML_TAG 8129 2.41 2.75 2.26 93 RCVD_IN_IADB_VOUCHED 8009 1.65 0.26 2.23 94 DKIM_INVALID 7878 3.50 6.60 2.19 95 XMSubLongNoVowel 7854 1.60 0.22 2.19 96 XMSubGarbage 7671 1.54 0.14 2.14 97 MIME_HTML_MOSTLY 7531 2.69 4.12 2.10 98 INVALID_MSGID 7240 1.51 0.30 2.02 99 T_XMDrugObfuBody_08 7057 2.45 3.62 1.96 100 HTML_IMAGE_RATIO_08 7016 2.22 2.87 1.95 101 BAYES_95 6912 2.92 5.30 1.92 102 T_XMDrugObfuBody_14 6866 2.78 4.84 1.91 103 XM_CamelCaseFrm001 6711 2.27 3.23 1.87 104 TR_XM_SpammyRelay 6606 4.73 11.62 1.84 105 XM_B_URI_Unicode 6419 2.34 3.66 1.79 106 TO_MALFORMED 6258 1.23 0.02 1.74 107 XM_DK_Undo_01 6216 1.78 1.90 1.73 108 TM2_M_URI_OPT_OUT 6124 1.84 2.16 1.70 109 FROM_EXCESS_BASE64 6067 1.77 1.98 1.69 110 BOTNET 5643 4.14 10.26 1.57 111 TR_XM_PhishingBody 5545 2.71 5.49 1.54 112 UNTRUSTED_Relay 5495 3.00 6.49 1.53 113 RCVD_IN_IADB_OPTIN 5432 1.11 0.15 1.51 114 TooManyTo_003 5265 1.21 0.59 1.47 115 URI_NOVOWEL 5203 1.38 1.21 1.45 116 XM_B_Investor 5096 2.38 4.68 1.42 117 TR_Symld_Words 5077 1.28 0.96 1.41 118 XM_B_Unsub2 5068 1.96 3.27 1.41 119 XMDiploma_00 5028 1.87 2.98 1.40 120 XM_SPF_SoftFail 4966 1.87 3.02 1.38 121 TR_XM_UnparsRelay 4923 4.00 10.27 1.37 122 XM_SendGrid 4835 1.37 1.41 1.35 123 XMSexyCombo_05 4753 2.28 4.55 1.32 124 IN_HORDE_ADDRESS_BOOK 4676 0.97 0.17 1.30 125 SUBJ_ALL_CAPS 4634 1.30 1.34 1.29 126 TR_DCC_Bayes_99 4618 7.07 20.85 1.29 127 TM2_M_VERY_LONG_WORD 4506 1.93 3.55 1.25 128 KHOP_HELO_FCRDNS 4429 1.63 2.57 1.23 129 HELO_NODOT 4416 0.95 0.27 1.23 130 HELO_NO_DOMAIN 4414 0.94 0.26 1.23 131 XMStockSpam_06 4360 1.53 2.29 1.21 132 TR_XM_SpammyWords5 4201 1.94 3.78 1.17 133 XM_GoogleGroups 4060 1.02 0.75 1.13 134 T_TooManySym_03 4056 0.85 0.20 1.13 135 TooManyTo_004 3848 0.91 0.52 1.07 136 XM_OfRef6 3760 1.90 3.94 1.05 137 XMCapTrack 3754 0.86 0.42 1.04 138 XM_B_COPY_HTML 3593 1.18 1.61 1.00 139 URI_HEX 3589 1.21 1.72 1.00 140 TVD_SPACE_RATIO 3386 0.72 0.19 0.94 141 XM_UB50 3304 1.55 3.05 0.92 142 XM_E_Blogspot 3257 0.67 0.11 0.91 143 XMGappySubj_01 3239 0.73 0.31 0.90 144 RELAYCOUNTRY_CA 3225 2.37 5.87 0.90 145 TooManyTo_005 3136 0.76 0.49 0.87 146 T_FILL_THIS_FORM_SHORT 3092 1.15 1.83 0.86 147 FROM_GOV_DKIM_AU 3086 0.74 0.44 0.86 148 TR_XM_DK_SendGrid 3012 0.81 0.75 0.84 149 TVD_RCVD_IP 3004 0.80 0.71 0.84 150 DKIM_ADSP_CUSTOM_MED 2932 0.87 0.99 0.82 151 XM_ShortIntro_01 2925 0.69 0.38 0.81 152 SpammyFromTLD_01 2896 1.06 1.66 0.81 153 XM_H_PHPMailer 2798 0.78 0.79 0.78 154 XMGenDplmaNmb 2771 1.03 1.64 0.77 155 XM_H_Long_From02 2755 0.90 1.21 0.77 156 T_OBFU_PDF_ATTACH 2528 0.55 0.17 0.70 157 T_XMDrugObfuBody_00 2480 1.06 1.93 0.69 158 RELAYCOUNTRY_AU 2428 1.31 2.81 0.68 159 XM_B_SpammyWords4 2428 1.21 2.49 0.68 160 HTTPS_HTTP_MISMATCH 2402 0.89 1.41 0.67 161 TR_XM_Base64_M1 2394 0.68 0.70 0.67 162 RCVD_IN_PBL 2361 0.81 1.18 0.66 163 TO_NO_BRKTS_HTML_ONLY 2308 0.59 0.47 0.64 164 TR_MetaPhish_Combo_01 2255 0.82 1.27 0.63 165 T_XMHurry_00 2184 1.00 1.94 0.61 166 XMBrknScrpt_02 2110 0.92 1.71 0.59 167 XMBdyGiftCard01 2056 0.67 0.92 0.57 168 XMNoVowels 2021 0.52 0.41 0.56 169 HTML_IMAGE_ONLY_20 2006 0.78 1.32 0.56 170 T_Symld_Words_02 1930 0.59 0.73 0.54 171 NML_ADSP_CUSTOM_MED 1893 0.62 0.85 0.53 172 MPART_ALT_DIFF_COUNT 1882 0.67 1.03 0.52 173 XM_B_FormFill 1878 0.38 0.02 0.52 174 RCVD_IN_BL_SPAMCOP_NET 1858 3.16 9.46 0.52 175 XMBSHREFv2 1829 0.46 0.34 0.51 176 XMBody_95 1810 0.42 0.23 0.50 177 URI_TRY_3LD 1808 0.74 1.32 0.50 178 FORGED_GMAIL_RCVD 1772 0.58 0.77 0.49 179 HTML_IMAGE_ONLY_32 1769 0.43 0.27 0.49 180 XM_B_REG_HTML 1764 0.64 0.99 0.49 181 XMPhish30 1715 0.76 1.43 0.48 182 XMGappySubj_02 1714 0.35 0.05 0.48 183 XMSlimDrugH 1706 0.65 1.08 0.47 184 HTML_TAG_BALANCE_BODY 1701 0.67 1.13 0.47 185 XMBody_17 1700 1.04 2.39 0.47 186 MSGID_FROM_MTA_HEADER 1698 0.38 0.16 0.47 187 XMMoneyMeta_00 1698 0.54 0.69 0.47 188 XMLngstWrd_00 1689 0.51 0.61 0.47 189 XM_ProductURIs 1673 0.64 1.06 0.47 190 RELAYCOUNTRY_GB 1656 0.59 0.90 0.46 191 TR_XM_SpammyWords2 1644 3.49 10.71 0.46 192 XMDateMe_00 1485 0.38 0.32 0.41 193 XMSubMetaSxObfu_03 1464 0.50 0.71 0.41 194 SpammyFromTLD_02 1431 0.80 1.77 0.40 195 HELO_MISC_IP 1428 0.29 0.04 0.40 196 SHORT_HELO_AND_INLINE_IMAGE 1422 0.29 0.02 0.40 197 HTML_IMAGE_ONLY_28 1417 0.48 0.70 0.39 198 TM2_M_BODY_EMPTY 1388 0.29 0.07 0.39 199 XM_B_DNDMA 1383 0.49 0.74 0.38 200 XM_URI_RBL 1373 1.07 2.70 0.38 ----------------------------------------------------------------------