Email: 557373 Autolearn: 0 AvgScore: 2.66 AvgScanTime: 1.32 sec Spam: 141783 Autolearn: 0 AvgScore: 14.48 AvgScanTime: 1.54 sec Ham: 415590 Autolearn: 0 AvgScore: -1.38 AvgScanTime: 1.25 sec Time Spent Running SA: 204.82 hours Time Spent Processing Spam: 60.81 hours Time Spent Processing Ham: 144.01 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 135611 91.26 95.65 89.76 2 DKIM_SIGNED 123873 66.64 87.37 59.57 3 XM_DK_Pass 117244 64.62 82.69 58.45 4 RELAYCOUNTRY_US 116754 84.68 82.35 85.47 5 DKIM_VALID 116271 63.76 82.01 57.54 6 XM_B_Unicode 116250 73.82 81.99 71.03 7 DCC_CHECK 104054 45.88 73.39 36.49 8 XM_B_SpammyWords 98606 49.56 69.55 42.74 9 XMListUnsubscribeExists 94095 44.84 66.37 37.49 10 DKIM_VALID_AU 92530 51.10 65.26 46.27 11 XM_B_Unicode3 66205 45.25 46.69 44.76 12 LOC_TINY_FONT_1 64471 27.92 45.47 21.93 13 BAYES_50 58796 54.39 41.47 58.80 14 T_SCC_BODY_TEXT_LINE 55286 41.37 38.99 42.18 15 HTML_FONT_LOW_CONTRAST 54950 34.11 38.76 32.53 16 XM_B_SpammyWords2 54914 20.82 38.73 14.71 17 XM_DK_Undo_02 54506 12.70 38.44 3.92 18 FVGT_m_MULTI_ODD 46955 24.63 33.12 21.73 19 T_KAM_HTML_FONT_INVALID 44573 20.37 31.44 16.59 20 BAYES_99 42043 9.64 29.65 2.82 21 MIME_HTML_ONLY 41588 23.09 29.33 20.96 22 DKIM_VALID_EF 41513 25.32 29.28 23.97 23 TR_XM_DKIM_Undo 40621 8.74 28.65 1.94 24 XMSubLong 38547 25.88 27.19 25.43 25 DCC_CHECK_NEGATIVE 35310 53.66 24.90 63.47 26 BAYES_999 32867 7.52 23.18 2.17 27 T_TM2_M_HEADER_IN_MSG 32819 28.38 23.15 30.17 28 TR_XM_DK_Unsub 30564 13.38 21.56 10.59 29 XM_Multi_Part_URI 29541 13.23 20.84 10.63 30 TR_DCC_Bayes_99 29408 6.09 20.74 1.10 31 XM_B_Unsub 26097 10.05 18.41 7.20 32 TR_XM_BayesUnsub 24918 8.38 17.57 5.24 33 UNPARSEABLE_RELAY 24099 11.67 17.00 9.86 34 RELAYCOUNTRY_META 22743 6.45 16.04 3.18 35 XM_B_SpammyWords3 20948 6.76 14.77 4.02 36 TR_MAX_INTL_RELAY 20941 6.94 14.77 4.27 37 RCVD_IN_MSPIKE_H2 19512 12.12 13.76 11.56 38 LOTS_OF_MONEY 19350 7.34 13.65 5.18 39 BOTNET_IPINHOSTNAME 18497 5.03 13.05 2.29 40 TR_XM_SpammyWords4 17223 5.69 12.15 3.49 41 XM_Evil_Numbers_Gen 16741 12.41 11.81 12.61 42 TR_XM_SpammyRelay 16091 4.13 11.35 1.67 43 TR_XM_SpammyWords2 15341 3.10 10.82 0.47 44 BOTNET 14564 3.42 10.27 1.09 45 FSL_BULK_SIG 14431 10.70 10.18 10.88 46 XM_B_Phish_Phrases 14276 5.61 10.07 4.09 47 TR_XM_UnparsRelay 13538 3.44 9.55 1.35 48 LotsOfNums_01 13418 8.22 9.46 7.79 49 BAYES_80 13063 4.31 9.21 2.64 50 BAYES_60 11492 5.73 8.11 4.93 51 XM_Body_Dirty_Words 11246 3.68 7.93 2.23 52 RCVD_IN_MSPIKE_WL 10150 9.21 7.16 9.91 53 RCVD_IN_BL_SPAMCOP_NET 10054 2.22 7.09 0.56 54 XM_B_PhoneNumber 9269 7.64 6.54 8.01 55 RELAYCOUNTRY_CA 9125 2.37 6.44 0.98 56 XM_UncommonTLD01 9065 4.18 6.39 3.43 57 XMSubMetaSx_00 8693 3.50 6.13 2.60 58 MPART_ALT_DIFF 8639 7.52 6.09 8.01 59 TM2_M_VERY_LONG_WORD 8216 6.55 5.79 6.80 60 UNTRUSTED_Relay 8117 2.32 5.72 1.15 61 XMStrtUSub 7959 8.36 5.61 9.30 62 XM_H_Long_From01 7826 4.80 5.52 4.55 63 HTML_IMAGE_RATIO_02 7701 4.02 5.43 3.54 64 DKIM_INVALID 7602 2.88 5.36 2.03 65 XM_B_Investor 7472 2.34 5.27 1.34 66 BAYES_95 7449 2.55 5.25 1.62 67 HTML_IMAGE_RATIO_04 6863 11.24 4.84 13.43 68 XM_OfRef6 6851 1.89 4.83 0.88 69 TR_XM_PhishingBody 6770 2.08 4.77 1.16 70 TooManyTo_001 6535 6.59 4.61 7.27 71 XM_H_GMP 6332 4.68 4.47 4.75 72 T_XMDrugObfuBody_14 6114 2.30 4.31 1.62 73 ANY_BOUNCE_MESSAGE 5730 9.55 4.04 11.43 74 BOUNCE_MESSAGE 5704 9.55 4.02 11.43 75 RCVD_IN_MSPIKE_H3 5628 4.63 3.97 4.86 76 MIME_QP_LONG_LINE 5529 4.41 3.90 4.58 77 XMNumbers 5474 3.23 3.86 3.02 78 XMSexyCombo_05 5307 1.51 3.74 0.75 79 MIME_HTML_MOSTLY 5291 2.34 3.73 1.87 80 XM_B_SpammyTLD 5266 2.65 3.71 2.28 81 XM_CamelCaseFrm001 5241 2.09 3.70 1.55 82 XM_B_Unsub2 5145 1.76 3.63 1.12 83 TR_XM_SpammyWords5 5114 1.79 3.61 1.16 84 HTML_IMAGE_RATIO_06 4882 3.91 3.44 4.07 85 MIME_HTML_ONLY_MULTI 4758 5.71 3.36 6.51 86 XMDiploma_00 4552 1.80 3.21 1.32 87 KHOP_HELO_FCRDNS 4424 5.64 3.12 6.50 88 XM_B_SpammyWords4 4386 1.46 3.09 0.90 89 XM_SPF_SoftFail 4289 1.57 3.03 1.08 90 XM_B_URI_Unicode 4094 1.88 2.89 1.53 91 T_XMDrugObfuBody_08 4067 1.68 2.87 1.27 92 TR_XM_NoHeaderRelay 4065 0.89 2.87 0.21 93 XM_URI_RBL 3973 0.95 2.80 0.32 94 SHORT_URI_2 3949 6.81 2.79 8.18 95 TR_XM_INV_DKIM 3848 0.80 2.71 0.15 96 T_FILL_THIS_FORM_SHORT 3798 1.22 2.68 0.72 97 TR_XM_SPAMCOP 3734 0.78 2.63 0.15 98 RCVD_IN_MSPIKE_H5 3666 3.79 2.59 4.21 99 RCVD_IN_MSPIKE_BL 3643 0.89 2.57 0.31 100 TR_XM_MSPIKECOMBO 3643 0.89 2.57 0.31 101 XM_UB50 3623 1.21 2.56 0.75 102 T_XMHurry_00 3538 1.11 2.50 0.64 103 TR_LOTS_OF_MONEY3 3530 1.00 2.49 0.50 104 HTML_IMAGE_RATIO_08 3444 2.02 2.43 1.88 105 RELAYCOUNTRY_AU 3439 0.96 2.43 0.46 106 T_TooManySym_01 3350 4.16 2.36 4.78 107 USER_IN_DEF_DKIM_WL 3336 7.94 2.35 9.84 108 XMBody_17 3286 0.86 2.32 0.36 109 MAY_BE_FORGED 3238 4.46 2.28 5.20 110 TM2_M_URI_OPT_OUT 3223 2.16 2.27 2.12 111 ALL_TRUSTED 3135 9.55 2.21 12.06 112 HTML_IMAGE_ONLY_32 3089 5.72 2.18 6.93 113 MAILING_LIST_MULTI 3039 2.36 2.14 2.43 114 BAYES_40 3008 6.45 2.12 7.93 115 FROM_EXCESS_BASE64 2846 1.49 2.01 1.31 116 XMStockSpam_06 2828 1.31 1.99 1.08 117 RCVD_IN_VALIDITY_SAFE 2799 2.64 1.97 2.87 118 RCVD_IN_VALIDITY_RPBL 2746 0.52 1.94 0.04 119 XMBrknScrpt_02 2743 1.03 1.93 0.72 120 SUBJ_ALL_CAPS 2646 1.32 1.87 1.14 121 XMGenDplmaNmb 2598 0.96 1.83 0.66 122 HTML_MIME_NO_HTML_TAG 2570 2.13 1.81 2.23 123 SpammyFromTLD_02 2563 0.76 1.81 0.40 124 SpammyFromTLD_01 2419 0.96 1.71 0.70 125 SHORTCIRCUIT 2402 0.43 1.69 0.00 126 RCVD_IN_ZEN_LASTEXTERNAL 2402 0.43 1.69 0.00 127 URI_TRY_3LD 2369 0.80 1.67 0.50 128 XMBody_78 2358 0.66 1.66 0.32 129 HTML_IMAGE_ONLY_20 2297 0.72 1.62 0.41 130 XM_ProductURIs 2284 0.74 1.61 0.44 131 XM_DK_Undo_01 2257 1.54 1.59 1.52 132 RCVD_IN_VALIDITY_CERTIFIED 2110 2.17 1.49 2.40 133 RDNS_DYNAMIC 2074 0.48 1.46 0.15 134 XMPhish30 2038 0.63 1.44 0.36 135 URI_HEX 2035 1.06 1.44 0.93 136 XM_OfRef7 2028 0.55 1.43 0.25 137 T_XMDrugObfuBody_00 2018 0.91 1.42 0.73 138 T_REMOTE_IMAGE 2001 2.51 1.41 2.89 139 MPART_ALT_DIFF_COUNT 1988 0.66 1.40 0.40 140 XM_SendGrid 1971 1.15 1.39 1.06 141 HTTPS_HTTP_MISMATCH 1940 0.82 1.37 0.64 142 XM_B_Phish66 1913 0.54 1.35 0.26 143 XM_B_COPY_HTML 1871 0.90 1.32 0.76 144 TR_XM_SpammyWords3 1778 0.43 1.25 0.15 145 URI_NOVOWEL 1774 1.23 1.25 1.23 146 BAYES_20 1759 4.50 1.24 5.61 147 TR_Mismatch_TLD_02 1748 0.36 1.23 0.06 148 RCVD_IN_MSPIKE_L3 1732 0.54 1.22 0.30 149 TR_LOTS_OF_MONEY2 1687 0.49 1.19 0.26 150 T_MONEY_PERCENT 1687 0.49 1.19 0.26 151 RCVD_IN_PSBL 1671 0.49 1.18 0.25 152 HTML_TAG_BALANCE_BODY 1670 0.62 1.18 0.42 153 RELAYCOUNTRY_FR 1624 0.44 1.15 0.20 154 RCVD_IN_IADB_LISTED 1623 2.37 1.14 2.79 155 DKIM_ADSP_NXDOMAIN 1603 0.48 1.13 0.26 156 RELAYCOUNTRY_GB 1600 0.60 1.13 0.42 157 XM_H_Long_From02 1596 0.78 1.13 0.66 158 TR_XM_PHPForged 1580 0.50 1.11 0.29 159 TVD_RCVD_IP 1578 0.69 1.11 0.54 160 XM_B_COVIDMETA 1573 0.37 1.11 0.12 161 TR_XM_FormFill2 1558 0.50 1.10 0.29 162 TR_XM_PHPDW 1556 0.49 1.10 0.29 163 TR_XM_RelayPhish 1555 0.34 1.10 0.08 164 DIET_1 1530 0.47 1.08 0.26 165 TR_Symld_Words 1522 1.23 1.07 1.28 166 XM_H_PHPOS 1516 0.48 1.07 0.28 167 RCVD_IN_IADB_SPF 1505 2.08 1.06 2.43 168 SHOPIFY_IMG_NOT_RCVD_SFY 1505 0.43 1.06 0.22 169 RCVD_IN_MSPIKE_L5 1497 0.27 1.06 0.01 170 XM_UB99 1495 0.27 1.05 0.01 171 XM_DIRTYINTL 1480 0.32 1.04 0.08 172 RCVD_IN_IADB_DK 1479 1.83 1.04 2.10 173 RCVD_IN_IADB_SENDERID 1475 1.88 1.04 2.17 174 RCVD_IN_PBL 1459 0.74 1.03 0.64 175 LongTLD 1447 0.60 1.02 0.46 176 MultiRelay_CC 1425 0.36 1.01 0.14 177 XMPhish14 1398 0.48 0.99 0.30 178 XMSexyCombo_01 1371 0.34 0.97 0.13 179 XM_HighProb1 1363 0.25 0.96 0.01 180 XM_B_SEO 1357 0.39 0.96 0.20 181 XMSubMetaI_00 1347 0.49 0.95 0.34 182 XMHTML_After_End 1332 0.48 0.94 0.33 183 XM_PDF 1315 3.35 0.93 4.18 184 HTML_FONT_TINY_NORDNS 1308 0.26 0.92 0.04 185 XMBdyGiftCard01 1296 0.45 0.91 0.29 186 XM_B_DNDMA 1280 0.49 0.90 0.35 187 TR_MetaPhish_Combo_01 1279 0.68 0.90 0.60 188 T_STY_INVIS_DIRECT 1277 0.51 0.90 0.38 189 HELO_DYNAMIC_SPLIT_IP 1253 0.23 0.88 0.01 190 DKIM_ADSP_CUSTOM_MED 1238 0.68 0.87 0.62 191 RCVD_IN_SORBS_DUL 1224 0.24 0.86 0.03 192 XM_B_REG_HTML 1219 0.35 0.86 0.17 193 XM_UB60 1214 0.25 0.86 0.05 194 TR_XM_DK_SendGrid 1199 0.71 0.85 0.66 195 PDS_RDNS_DYNAMIC_FP 1195 0.24 0.84 0.03 196 URIBL_BLACK 1192 0.24 0.84 0.04 197 XM_GoogleGroups 1185 1.02 0.84 1.08 198 TR_XM_SEO4 1181 0.28 0.83 0.09 199 RELAYCOUNTRY_CN 1178 0.28 0.83 0.09 200 TR_XM_InvalidRelay 1129 0.21 0.80 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 373026 91.26 95.65 89.76 2 RELAYCOUNTRY_US 355205 84.68 82.35 85.47 3 XM_B_Unicode 295193 73.82 81.99 71.03 4 DCC_CHECK_NEGATIVE 263772 53.66 24.90 63.47 5 DKIM_SIGNED 247561 66.64 87.37 59.57 6 BAYES_50 244369 54.39 41.47 58.80 7 XM_DK_Pass 242904 64.62 82.69 58.45 8 DKIM_VALID 239113 63.76 82.01 57.54 9 DKIM_VALID_AU 192290 51.10 65.26 46.27 10 XM_B_Unicode3 186010 45.25 46.69 44.76 11 XM_B_SpammyWords 177630 49.56 69.55 42.74 12 T_SCC_BODY_TEXT_LINE 175303 41.37 38.99 42.18 13 XMListUnsubscribeExists 155810 44.84 66.37 37.49 14 DCC_CHECK 151660 45.88 73.39 36.49 15 HTML_FONT_LOW_CONTRAST 135176 34.11 38.76 32.53 16 T_TM2_M_HEADER_IN_MSG 125371 28.38 23.15 30.17 17 XMSubLong 105705 25.88 27.19 25.43 18 DKIM_VALID_EF 99601 25.32 29.28 23.97 19 LOC_TINY_FONT_1 91123 27.92 45.47 21.93 20 FVGT_m_MULTI_ODD 90317 24.63 33.12 21.73 21 MIME_HTML_ONLY 87096 23.09 29.33 20.96 22 T_KAM_HTML_FONT_INVALID 68955 20.37 31.44 16.59 23 XM_B_SpammyWords2 61119 20.82 38.73 14.71 24 HTML_IMAGE_RATIO_04 55806 11.24 4.84 13.43 25 XM_Evil_Numbers_Gen 52412 12.41 11.81 12.61 26 BAYES_00 51643 9.41 0.57 12.43 27 HTML_FONT_FACE_BAD 50644 9.28 0.75 12.19 28 ALL_TRUSTED 50119 9.55 2.21 12.06 29 RCVD_IN_MSPIKE_H2 48055 12.12 13.76 11.56 30 XM_H_Trusted_IP 47873 8.59 0.00 11.52 31 ANY_BOUNCE_MESSAGE 47522 9.55 4.04 11.43 32 BOUNCE_MESSAGE 47519 9.55 4.02 11.43 33 FSL_BULK_SIG 45217 10.70 10.18 10.88 34 XM_Multi_Part_URI 44179 13.23 20.84 10.63 35 TR_XM_DK_Unsub 44024 13.38 21.56 10.59 36 RCVD_IN_MSPIKE_WL 41190 9.21 7.16 9.91 37 UNPARSEABLE_RELAY 40968 11.67 17.00 9.86 38 USER_IN_DEF_DKIM_WL 40895 7.94 2.35 9.84 39 XMStrtUSub 38661 8.36 5.61 9.30 40 SHORT_URI_2 33987 6.81 2.79 8.18 41 XM_B_PhoneNumber 33303 7.64 6.54 8.01 42 MPART_ALT_DIFF 33270 7.52 6.09 8.01 43 BAYES_40 32951 6.45 2.12 7.93 44 LotsOfNums_01 32375 8.22 9.46 7.79 45 TooManyTo_001 30209 6.59 4.61 7.27 46 XM_B_Unsub 29920 10.05 18.41 7.20 47 HTML_IMAGE_ONLY_32 28812 5.72 2.18 6.93 48 TM2_M_VERY_LONG_WORD 28265 6.55 5.79 6.80 49 MIME_HTML_ONLY_MULTI 27048 5.71 3.36 6.51 50 KHOP_HELO_FCRDNS 27022 5.64 3.12 6.50 51 IN_ZIMBRA_NJ_WHITELIST 24362 4.40 0.11 5.86 52 BAYES_20 23327 4.50 1.24 5.61 53 TR_XM_DK_Bayes 23322 4.30 0.45 5.61 54 TR_XM_DK_Bayes1 22805 4.20 0.44 5.49 55 XMSubNoVowel 22397 4.13 0.45 5.39 56 TR_XM_BayesUnsub 21768 8.38 17.57 5.24 57 MAY_BE_FORGED 21605 4.46 2.28 5.20 58 LOTS_OF_MONEY 21540 7.34 13.65 5.18 59 BAYES_60 20472 5.73 8.11 4.93 60 XM_DKIMWhitelistDomains 20376 3.66 0.03 4.90 61 RCVD_IN_MSPIKE_H3 20177 4.63 3.97 4.86 62 T_TooManySym_01 19857 4.16 2.36 4.78 63 XM_H_GMP 19728 4.68 4.47 4.75 64 TR_XM_DK_Bayes2 19113 3.52 0.37 4.60 65 MIME_QP_LONG_LINE 19040 4.41 3.90 4.58 66 XM_H_Long_From01 18901 4.80 5.52 4.55 67 SHORT_URI_3 18427 3.37 0.27 4.43 68 TR_MAX_INTL_RELAY 17746 6.94 14.77 4.27 69 RCVD_IN_MSPIKE_H5 17485 3.79 2.59 4.21 70 XM_PDF 17367 3.35 0.93 4.18 71 XM_B_Phish_Phrases 16999 5.61 10.07 4.09 72 HTML_IMAGE_RATIO_06 16895 3.91 3.44 4.07 73 XM_B_SpammyWords3 16711 6.76 14.77 4.02 74 XM_DK_Undo_02 16303 12.70 38.44 3.92 75 HTML_IMAGE_RATIO_02 14720 4.02 5.43 3.54 76 TR_XM_SpammyWords4 14502 5.69 12.15 3.49 77 XM_UncommonTLD01 14258 4.18 6.39 3.43 78 BAYES_05 13369 2.57 0.67 3.22 79 RELAYCOUNTRY_META 13215 6.45 16.04 3.18 80 T_TVD_MIME_NO_HEADERS 12914 2.37 0.19 3.11 81 XMSubLongNoVowel 12826 2.32 0.09 3.09 82 XMSubGarbage 12658 2.28 0.02 3.05 83 XMNumbers 12550 3.23 3.86 3.02 84 T_REMOTE_IMAGE 11997 2.51 1.41 2.89 85 RCVD_IN_VALIDITY_SAFE 11931 2.64 1.97 2.87 86 BAYES_99 11713 9.64 29.65 2.82 87 RCVD_IN_IADB_LISTED 11586 2.37 1.14 2.79 88 BAYES_80 10981 4.31 9.21 2.64 89 XMSubMetaSx_00 10790 3.50 6.13 2.60 90 MAILING_LIST_MULTI 10108 2.36 2.14 2.43 91 RCVD_IN_IADB_SPF 10094 2.08 1.06 2.43 92 RCVD_IN_VALIDITY_CERTIFIED 9974 2.17 1.49 2.40 93 T_TooManySym_02 9893 1.93 0.59 2.38 94 TooManyTo_002 9716 1.94 0.78 2.34 95 BOTNET_IPINHOSTNAME 9526 5.03 13.05 2.29 96 XM_B_SpammyTLD 9481 2.65 3.71 2.28 97 HTML_MIME_NO_HTML_TAG 9284 2.13 1.81 2.23 98 XM_Body_Dirty_Words 9254 3.68 7.93 2.23 99 MIME_CHARSET_FARAWAY 9150 1.75 0.42 2.20 100 BAYES_999 9039 7.52 23.18 2.17 101 RCVD_IN_IADB_SENDERID 9006 1.88 1.04 2.17 102 TM2_M_URI_OPT_OUT 8803 2.16 2.27 2.12 103 CHARSET_FARAWAY_HEADER 8761 1.62 0.18 2.11 104 RCVD_IN_IADB_DK 8708 1.83 1.04 2.10 105 DKIM_INVALID 8448 2.88 5.36 2.03 106 TR_XM_DKIM_Undo 8066 8.74 28.65 1.94 107 HTML_IMAGE_RATIO_08 7821 2.02 2.43 1.88 108 MIME_HTML_MOSTLY 7774 2.34 3.73 1.87 109 RCVD_IN_IADB_VOUCHED 7751 1.49 0.38 1.87 110 INVALID_MSGID 7507 1.43 0.31 1.81 111 TR_XM_SpammyRelay 6936 4.13 11.35 1.67 112 BAYES_95 6745 2.55 5.25 1.62 113 T_XMDrugObfuBody_14 6728 2.30 4.31 1.62 114 XM_CamelCaseFrm001 6432 2.09 3.70 1.55 115 XM_B_URI_Unicode 6379 1.88 2.89 1.53 116 XM_DK_Undo_01 6304 1.54 1.59 1.52 117 TO_MALFORMED 6267 1.13 0.01 1.51 118 TR_XM_UnparsRelay 5629 3.44 9.55 1.35 119 TooManyTo_003 5591 1.17 0.66 1.35 120 XM_B_Investor 5561 2.34 5.27 1.34 121 RCVD_IN_IADB_OPTIN 5488 1.07 0.35 1.32 122 XMDiploma_00 5482 1.80 3.21 1.32 123 FROM_EXCESS_BASE64 5440 1.49 2.01 1.31 124 XMLngstWrd_00 5359 1.06 0.40 1.29 125 TR_Symld_Words 5328 1.23 1.07 1.28 126 T_XMDrugObfuBody_08 5285 1.68 2.87 1.27 127 URI_NOVOWEL 5099 1.23 1.25 1.23 128 HELO_NODOT 4975 0.93 0.14 1.20 129 HELO_NO_DOMAIN 4959 0.92 0.12 1.19 130 TR_XM_SpammyWords5 4837 1.79 3.61 1.16 131 TR_XM_PhishingBody 4812 2.08 4.77 1.16 132 UNTRUSTED_Relay 4789 2.32 5.72 1.15 133 SUBJ_ALL_CAPS 4738 1.32 1.87 1.14 134 XM_B_Unsub2 4653 1.76 3.63 1.12 135 TR_DCC_Bayes_99 4554 6.09 20.74 1.10 136 BOTNET 4520 3.42 10.27 1.09 137 XM_GoogleGroups 4507 1.02 0.84 1.08 138 XM_SPF_SoftFail 4489 1.57 3.03 1.08 139 XMStockSpam_06 4479 1.31 1.99 1.08 140 XM_SendGrid 4418 1.15 1.39 1.06 141 XMCapTrack 4233 0.89 0.52 1.02 142 T_TooManySym_03 4204 0.80 0.17 1.01 143 XMGappySubj_01 4189 0.87 0.48 1.01 144 IN_HORDE_ADDRESS_BOOK 4188 0.78 0.10 1.01 145 TooManyTo_004 4131 0.90 0.62 0.99 146 RELAYCOUNTRY_CA 4088 2.37 6.44 0.98 147 URI_HEX 3856 1.06 1.44 0.93 148 TVD_SPACE_RATIO 3830 0.72 0.12 0.92 149 XM_B_SpammyWords4 3755 1.46 3.09 0.90 150 XM_OfRef6 3676 1.89 4.83 0.88 151 XM_E_Blogspot 3538 0.69 0.20 0.85 152 RCVD_IN_MSPIKE_H4 3528 0.79 0.60 0.85 153 XM_ShortIntro_01 3379 0.74 0.53 0.81 154 TooManyTo_005 3259 0.73 0.57 0.78 155 TO_EQ_FM_DOM_HTML_IMG 3171 0.57 0.00 0.76 156 XM_B_COPY_HTML 3157 0.90 1.32 0.76 157 XM_UB50 3131 1.21 2.56 0.75 158 XMSexyCombo_05 3130 1.51 3.74 0.75 159 T_XMDrugObfuBody_00 3053 0.91 1.42 0.73 160 T_OBFU_PDF_ATTACH 3016 0.60 0.22 0.73 161 T_FILL_THIS_FORM_SHORT 3003 1.22 2.68 0.72 162 XMBrknScrpt_02 2999 1.03 1.93 0.72 163 XM_H_PHPMailer 2930 0.64 0.47 0.71 164 SpammyFromTLD_01 2915 0.96 1.71 0.70 165 FROM_GOV_DKIM_AU 2837 0.61 0.42 0.68 166 XMGenDplmaNmb 2761 0.96 1.83 0.66 167 TR_XM_DK_SendGrid 2746 0.71 0.85 0.66 168 XM_H_Long_From02 2736 0.78 1.13 0.66 169 T_XMHurry_00 2667 1.11 2.50 0.64 170 RCVD_IN_PBL 2663 0.74 1.03 0.64 171 HTTPS_HTTP_MISMATCH 2654 0.82 1.37 0.64 172 DKIM_ADSP_CUSTOM_MED 2572 0.68 0.87 0.62 173 TR_MetaPhish_Combo_01 2500 0.68 0.90 0.60 174 XMNoVowels 2348 0.52 0.40 0.56 175 RCVD_IN_BL_SPAMCOP_NET 2321 2.22 7.09 0.56 176 TVD_RCVD_IP 2250 0.69 1.11 0.54 177 TO_NO_BRKTS_HTML_ONLY 2236 0.58 0.70 0.54 178 XM_RXBody 2096 0.50 0.47 0.50 179 URI_TRY_3LD 2093 0.80 1.67 0.50 180 TR_LOTS_OF_MONEY3 2063 1.00 2.49 0.50 181 TR_XM_Base64_M1 2053 0.56 0.74 0.49 182 XMLngstWrd_01 1967 0.44 0.35 0.47 183 TR_XM_SpammyWords2 1941 3.10 10.82 0.47 184 RELAYCOUNTRY_AU 1931 0.96 2.43 0.46 185 LongTLD 1902 0.60 1.02 0.46 186 XMGappySubj_02 1891 0.36 0.06 0.46 187 T_Symld_Words_02 1857 0.52 0.73 0.45 188 XM_B_FormFill 1856 0.35 0.05 0.45 189 TM2_M_OBFU_COMMENT 1847 0.51 0.71 0.44 190 XM_ProductURIs 1834 0.74 1.61 0.44 191 XMSlimDrugH 1794 0.48 0.60 0.43 192 HTML_TAG_BALANCE_BODY 1763 0.62 1.18 0.42 193 RELAYCOUNTRY_GB 1735 0.60 1.13 0.42 194 TM2_M_BODY_EMPTY 1715 0.33 0.07 0.41 195 HTML_IMAGE_ONLY_20 1695 0.72 1.62 0.41 196 MPART_ALT_DIFF_COUNT 1680 0.66 1.40 0.40 197 SpammyFromTLD_02 1680 0.76 1.81 0.40 198 MSGID_FROM_MTA_HEADER 1674 0.36 0.25 0.40 199 NML_ADSP_CUSTOM_MED 1624 0.46 0.65 0.39 200 T_STY_INVIS_DIRECT 1589 0.51 0.90 0.38 ----------------------------------------------------------------------