Email: 492701 Autolearn: 0 AvgScore: 4.21 AvgScanTime: 1.29 sec Spam: 136893 Autolearn: 0 AvgScore: 15.14 AvgScanTime: 1.51 sec Ham: 355808 Autolearn: 0 AvgScore: 0.00 AvgScanTime: 1.21 sec Time Spent Running SA: 177.04 hours Time Spent Processing Spam: 57.48 hours Time Spent Processing Ham: 119.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 130433 84.95 95.28 80.98 2 DKIM_SIGNED 121253 75.26 88.58 70.14 3 XM_B_Unicode 114858 70.45 83.90 65.28 4 XM_DK_Pass 114004 72.94 83.28 68.96 5 DKIM_VALID 112995 71.97 82.54 67.90 6 RELAYCOUNTRY_US 111083 76.79 81.15 75.11 7 DCC_CHECK 104564 50.39 76.38 40.39 8 XM_B_SpammyWords 94965 50.66 69.37 43.46 9 XMListUnsubscribeExists 92034 50.79 67.23 44.47 10 DKIM_VALID_AU 90302 57.80 65.97 54.66 11 XM_B_Unicode3 66749 40.55 48.76 37.38 12 LOC_TINY_FONT_1 63376 31.76 46.30 26.17 13 BAYES_50 55845 52.91 40.79 57.58 14 T_SCC_BODY_TEXT_LINE 54504 41.27 39.82 41.83 15 XM_DK_Undo_02 53621 14.50 39.17 5.01 16 XM_B_SpammyWords2 53006 23.15 38.72 17.16 17 HTML_FONT_LOW_CONTRAST 49090 28.34 35.86 25.45 18 FVGT_m_MULTI_ODD 46017 26.36 33.62 23.57 19 T_KAM_HTML_FONT_INVALID 42206 23.50 30.83 20.68 20 BAYES_99 41759 11.17 30.50 3.73 21 MIME_HTML_ONLY 40526 21.43 29.60 18.29 22 DKIM_VALID_EF 39591 28.21 28.92 27.94 23 TR_XM_DKIM_Undo 39021 9.61 28.50 2.33 24 XMSubLong 36559 22.71 26.71 21.17 25 BAYES_999 31497 8.51 23.01 2.93 26 T_TM2_M_HEADER_IN_MSG 30337 27.22 22.16 29.17 27 TR_DCC_Bayes_99 30113 7.24 22.00 1.57 28 DCC_CHECK_NEGATIVE 29788 49.06 21.76 59.56 29 TR_XM_DK_Unsub 28989 14.86 21.18 12.43 30 XM_Multi_Part_URI 28407 15.13 20.75 12.97 31 XM_B_Unsub 27483 11.69 20.08 8.46 32 TR_XM_BayesUnsub 26291 9.96 19.21 6.40 33 UNPARSEABLE_RELAY 24951 13.00 18.23 10.99 34 RELAYCOUNTRY_META 23875 7.29 17.44 3.38 35 TR_MAX_INTL_RELAY 20256 8.10 14.80 5.52 36 XM_B_SpammyWords3 20169 7.31 14.73 4.46 37 RCVD_IN_MSPIKE_H2 18683 14.06 13.65 14.22 38 BOTNET_IPINHOSTNAME 18575 5.63 13.57 2.58 39 LOTS_OF_MONEY 18005 8.21 13.15 6.31 40 FSL_BULK_SIG 17988 11.88 13.14 11.39 41 TR_XM_SpammyRelay 16826 4.66 12.29 1.72 42 TR_XM_SpammyWords4 16372 6.73 11.96 4.72 43 BOTNET 16146 4.13 11.79 1.18 44 TR_XM_SpammyWords2 14861 3.38 10.86 0.50 45 XM_Evil_Numbers_Gen 13865 8.76 10.13 8.23 46 TR_XM_UnparsRelay 13152 3.93 9.61 1.75 47 XM_B_Phish_Phrases 12764 6.06 9.32 4.80 48 BAYES_80 12256 4.92 8.95 3.36 49 RCVD_IN_BL_SPAMCOP_NET 11102 2.71 8.11 0.64 50 BAYES_60 10794 6.59 7.88 6.09 51 RCVD_IN_MSPIKE_WL 10762 11.44 7.86 12.82 52 LotsOfNums_01 10372 7.42 7.58 7.37 53 XMSubMetaSx_00 10285 4.27 7.51 3.03 54 XM_B_PhoneNumber 10065 8.92 7.35 9.52 55 XM_Body_Dirty_Words 9876 3.73 7.21 2.39 56 HTML_IMAGE_RATIO_02 9609 4.95 7.02 4.16 57 UNTRUSTED_Relay 9257 2.89 6.76 1.40 58 RELAYCOUNTRY_CA 8522 2.34 6.23 0.84 59 DKIM_INVALID 8258 3.29 6.03 2.23 60 MPART_ALT_DIFF 8088 4.69 5.91 4.22 61 XMStrtUSub 7776 5.06 5.68 4.82 62 XM_UncommonTLD01 7436 4.29 5.43 3.85 63 BAYES_95 7366 3.05 5.38 2.16 64 XM_H_Long_From01 7356 5.36 5.37 5.35 65 XM_B_Investor 7207 2.73 5.26 1.75 66 RCVD_IN_MSPIKE_BL 7071 1.81 5.17 0.52 67 TR_XM_MSPIKECOMBO 7069 1.81 5.16 0.52 68 HTML_IMAGE_RATIO_04 6967 3.75 5.09 3.24 69 TooManyTo_001 6695 7.12 4.89 7.98 70 TR_XM_PhishingBody 6590 2.47 4.81 1.57 71 MIME_QP_LONG_LINE 6204 4.69 4.53 4.75 72 TR_XM_SpammyWords5 6187 2.18 4.52 1.28 73 RCVD_IN_MSPIKE_H3 6068 5.29 4.43 5.61 74 XMNumbers 5985 3.79 4.37 3.57 75 XM_H_GMP 5985 5.24 4.37 5.57 76 XMSexyCombo_05 5799 1.93 4.24 1.04 77 TM2_M_VERY_LONG_WORD 5547 1.91 4.05 1.09 78 T_XMDrugObfuBody_14 5384 2.31 3.93 1.69 79 XM_UB50 5382 1.76 3.93 0.93 80 XM_B_SpammyTLD 5177 2.83 3.78 2.47 81 MIME_HTML_MOSTLY 5152 2.70 3.76 2.29 82 XM_OfRef6 5116 1.72 3.74 0.95 83 XM_CamelCaseFrm001 4952 2.41 3.62 1.95 84 T_XMDrugObfuBody_08 4641 1.98 3.39 1.43 85 HTML_IMAGE_RATIO_06 4627 2.85 3.38 2.64 86 TR_XM_NoHeaderRelay 4572 1.08 3.34 0.22 87 TR_XM_SpammyWords3 4545 1.10 3.32 0.25 88 XMDiploma_00 4455 2.03 3.25 1.56 89 MIME_HTML_ONLY_MULTI 4361 2.47 3.19 2.19 90 XM_B_URI_Unicode 4320 2.22 3.16 1.86 91 XMBody_17 4213 1.15 3.08 0.40 92 XM_SPF_SoftFail 4202 1.85 3.07 1.38 93 RCVD_IN_VALIDITY_RPBL 4136 0.90 3.02 0.09 94 XM_URI_RBL 4131 1.08 3.02 0.33 95 DKIM_ADSP_NXDOMAIN 3853 1.01 2.81 0.32 96 XM_B_Unsub2 3743 1.73 2.73 1.35 97 XM_B_SpammyWords4 3738 1.26 2.73 0.69 98 HTML_IMAGE_RATIO_08 3570 2.32 2.61 2.20 99 RCVD_IN_MSPIKE_L3 3562 1.04 2.60 0.44 100 RELAYCOUNTRY_AU 3509 1.14 2.56 0.60 101 T_TooManySym_01 3448 4.57 2.52 5.36 102 USER_IN_DEF_DKIM_WL 3293 8.89 2.41 11.38 103 RCVD_IN_MSPIKE_H5 3292 4.82 2.40 5.75 104 T_FILL_THIS_FORM_SHORT 3268 1.28 2.39 0.85 105 MAILING_LIST_MULTI 3124 2.81 2.28 3.01 106 TR_XM_SPAMCOP 3085 0.73 2.25 0.15 107 ALL_TRUSTED 3081 16.60 2.25 22.13 108 RCVD_IN_MSPIKE_L5 3075 0.68 2.25 0.07 109 TM2_M_URI_OPT_OUT 3033 1.63 2.22 1.41 110 TR_XM_INV_DKIM 3016 0.70 2.20 0.13 111 HTML_MIME_NO_HTML_TAG 2976 2.37 2.17 2.44 112 FROM_EXCESS_BASE64 2912 1.66 2.13 1.48 113 XMStockSpam_06 2866 1.11 2.09 0.73 114 TR_LOTS_OF_MONEY3 2832 0.86 2.07 0.39 115 BAYES_40 2808 5.09 2.05 6.26 116 RCVD_IN_VALIDITY_SAFE 2740 3.04 2.00 3.45 117 T_XMHurry_00 2617 0.99 1.91 0.64 118 SpammyFromTLD_02 2615 0.90 1.91 0.52 119 ANY_BOUNCE_MESSAGE 2535 7.97 1.85 10.33 120 BOUNCE_MESSAGE 2524 7.97 1.84 10.33 121 SHORTCIRCUIT 2520 0.51 1.84 0.00 122 RCVD_IN_ZEN_LASTEXTERNAL 2520 0.51 1.84 0.00 123 KHOP_HELO_FCRDNS 2482 1.71 1.81 1.67 124 XM_DK_Undo_01 2436 1.67 1.78 1.63 125 SpammyFromTLD_01 2422 1.07 1.77 0.80 126 SUBJ_ALL_CAPS 2406 1.49 1.76 1.38 127 XMGenDplmaNmb 2333 1.07 1.70 0.83 128 XMBrknScrpt_02 2332 1.04 1.70 0.78 129 T_REMOTE_IMAGE 2198 2.89 1.61 3.38 130 T_XMDrugObfuBody_00 2194 1.37 1.60 1.28 131 URI_TRY_3LD 2172 0.81 1.59 0.51 132 HTTPS_HTTP_MISMATCH 2149 1.02 1.57 0.81 133 URI_HEX 2128 1.33 1.55 1.25 134 XM_SendGrid 2117 1.35 1.55 1.27 135 XMPhish30 2101 0.81 1.53 0.53 136 URI_NOVOWEL 2085 1.53 1.52 1.54 137 XM_H_Long_From02 2060 0.96 1.50 0.75 138 RCVD_IN_VALIDITY_CERTIFIED 1998 2.39 1.46 2.74 139 BOTNET_NORDNS 1975 0.41 1.44 0.01 140 RELAYCOUNTRY_TH 1972 0.40 1.44 0.00 141 DIET_1 1957 0.63 1.43 0.33 142 XM_ProductURIs 1952 0.74 1.43 0.47 143 RCVD_IN_PSBL 1906 0.53 1.39 0.20 144 MPART_ALT_DIFF_COUNT 1877 0.79 1.37 0.57 145 TR_Symld_Words 1849 1.71 1.35 1.85 146 XM_B_DNDMA 1842 0.71 1.35 0.47 147 XMBounce_01 1817 0.37 1.33 0.01 148 RCVD_IN_IADB_LISTED 1805 3.15 1.32 3.85 149 BAYES_20 1791 6.29 1.31 8.20 150 XM_B_SEO 1785 0.60 1.30 0.32 151 RDNS_DYNAMIC 1780 0.48 1.30 0.16 152 XM_B_COPY_HTML 1722 0.85 1.26 0.69 153 TR_XM_SEO4 1663 0.46 1.21 0.17 154 XM_H_DKIM_GOOG 1651 0.35 1.21 0.02 155 TR_Mismatch_TLD_02 1618 0.41 1.18 0.12 156 XM_B_Phish66 1602 0.55 1.17 0.31 157 RCVD_IN_IADB_SPF 1598 2.74 1.17 3.35 158 T_Symld_Words_02 1586 0.77 1.16 0.63 159 TVD_RCVD_IP 1585 0.85 1.16 0.73 160 TR_XM_Spammywords 1578 0.44 1.15 0.16 161 XM_S_SpammyWords 1578 0.44 1.15 0.16 162 TR_XM_PHPDW 1570 0.54 1.15 0.30 163 TR_XM_RelayPhish 1566 0.39 1.14 0.11 164 TR_XM_PHPForged 1548 0.53 1.13 0.31 165 XMSubMetaI_00 1540 0.64 1.12 0.46 166 TR_XM_FormFill2 1536 0.53 1.12 0.30 167 RCVD_IN_IADB_SENDERID 1532 2.44 1.12 2.95 168 RCVD_IN_IADB_DK 1531 2.39 1.12 2.88 169 TR_XM_MSPIKECOMBO2 1521 0.32 1.11 0.02 170 XM_H_PHPOS 1510 0.52 1.10 0.29 171 RELAYCOUNTRY_FR 1506 0.54 1.10 0.32 172 SHOPIFY_IMG_NOT_RCVD_SFY 1502 0.51 1.10 0.28 173 XM_HighProb1 1501 0.31 1.10 0.01 174 DKIM_ADSP_CUSTOM_MED 1494 0.87 1.09 0.79 175 URIBL_BLACK 1470 0.34 1.07 0.06 176 XMHTML_After_End 1469 0.59 1.07 0.40 177 TR_Mismatch_TLD_01 1461 0.46 1.07 0.22 178 T_MONEY_PERCENT 1453 0.43 1.06 0.18 179 TR_LOTS_OF_MONEY2 1453 0.43 1.06 0.18 180 RELAYCOUNTRY_GB 1432 0.62 1.05 0.46 181 XMBdyGiftCard01 1411 0.65 1.03 0.50 182 HELO_DYNAMIC_SPLIT_IP 1406 0.29 1.03 0.01 183 RCVD_IN_MSPIKE_H4 1402 1.34 1.02 1.46 184 XMBody_78 1394 0.54 1.02 0.36 185 XM_UB99 1370 0.28 1.00 0.00 186 HTML_FONT_TINY_NORDNS 1365 0.31 1.00 0.05 187 HTML_IMAGE_ONLY_20 1362 0.56 0.99 0.39 188 TR_XM_InvalidRelay 1349 0.28 0.99 0.01 189 XMSexyCombo_01 1331 0.40 0.97 0.17 190 XM_DIRTYINTL 1311 0.32 0.96 0.08 191 RCVD_IN_SORBS_DUL 1287 0.30 0.94 0.05 192 XMPhish14 1258 0.57 0.92 0.43 193 TR_MetaPhish_Combo_01 1248 0.79 0.91 0.74 194 DEAR_FRIEND 1227 0.29 0.90 0.05 195 NML_ADSP_CUSTOM_MED 1225 0.60 0.89 0.48 196 LongTLD 1210 0.56 0.88 0.44 197 HTML_TAG_BALANCE_BODY 1207 0.65 0.88 0.57 198 XPRIO 1198 0.25 0.88 0.01 199 TR_XM_Base64_M1 1192 0.63 0.87 0.53 200 TR_XM_DK_SendGrid 1177 0.85 0.86 0.85 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 288138 84.95 95.28 80.98 2 RELAYCOUNTRY_US 267243 76.79 81.15 75.11 3 DKIM_SIGNED 249556 75.26 88.58 70.14 4 XM_DK_Pass 245368 72.94 83.28 68.96 5 DKIM_VALID 241608 71.97 82.54 67.90 6 XM_B_Unicode 232257 70.45 83.90 65.28 7 DCC_CHECK_NEGATIVE 211934 49.06 21.76 59.56 8 BAYES_50 204858 52.91 40.79 57.58 9 DKIM_VALID_AU 194481 57.80 65.97 54.66 10 XMListUnsubscribeExists 158227 50.79 67.23 44.47 11 XM_B_SpammyWords 154642 50.66 69.37 43.46 12 T_SCC_BODY_TEXT_LINE 148829 41.27 39.82 41.83 13 DCC_CHECK 143709 50.39 76.38 40.39 14 XM_B_Unicode3 133018 40.55 48.76 37.38 15 T_TM2_M_HEADER_IN_MSG 103782 27.22 22.16 29.17 16 DKIM_VALID_EF 99397 28.21 28.92 27.94 17 LOC_TINY_FONT_1 93122 31.76 46.30 26.17 18 HTML_FONT_LOW_CONTRAST 90557 28.34 35.86 25.45 19 FVGT_m_MULTI_ODD 83855 26.36 33.62 23.57 20 ALL_TRUSTED 78726 16.60 2.25 22.13 21 XMSubLong 75325 22.71 26.71 21.17 22 T_KAM_HTML_FONT_INVALID 73582 23.50 30.83 20.68 23 MIME_HTML_ONLY 65076 21.43 29.60 18.29 24 XM_B_SpammyWords2 61040 23.15 38.72 17.16 25 RCVD_IN_MSPIKE_H2 50595 14.06 13.65 14.22 26 XM_Multi_Part_URI 46153 15.13 20.75 12.97 27 RCVD_IN_MSPIKE_WL 45605 11.44 7.86 12.82 28 TR_XM_DK_Unsub 44220 14.86 21.18 12.43 29 FSL_BULK_SIG 40535 11.88 13.14 11.39 30 USER_IN_DEF_DKIM_WL 40500 8.89 2.41 11.38 31 UNPARSEABLE_RELAY 39108 13.00 18.23 10.99 32 BAYES_00 36876 7.65 0.61 10.36 33 ANY_BOUNCE_MESSAGE 36749 7.97 1.85 10.33 34 BOUNCE_MESSAGE 36748 7.97 1.84 10.33 35 XM_B_PhoneNumber 33860 8.92 7.35 9.52 36 XM_B_Unsub 30105 11.69 20.08 8.46 37 XM_Evil_Numbers_Gen 29272 8.76 10.13 8.23 38 BAYES_20 29193 6.29 1.31 8.20 39 TooManyTo_001 28396 7.12 4.89 7.98 40 LotsOfNums_01 26208 7.42 7.58 7.37 41 TR_XM_DK_Bayes 23839 4.96 0.45 6.70 42 TR_XM_DK_Bayes1 23378 4.87 0.45 6.57 43 IN_ZIMBRA_NJ_WHITELIST 23313 4.76 0.11 6.55 44 TR_XM_BayesUnsub 22765 9.96 19.21 6.40 45 LOTS_OF_MONEY 22434 8.21 13.15 6.31 46 BAYES_40 22279 5.09 2.05 6.26 47 XM_DKIMWhitelistDomains 22205 4.52 0.04 6.24 48 BAYES_60 21651 6.59 7.88 6.09 49 RCVD_IN_MSPIKE_H5 20444 4.82 2.40 5.75 50 RCVD_IN_MSPIKE_H3 19974 5.29 4.43 5.61 51 TR_XM_DK_Bayes2 19913 4.15 0.38 5.60 52 XM_H_GMP 19815 5.24 4.37 5.57 53 TR_MAX_INTL_RELAY 19647 8.10 14.80 5.52 54 T_TooManySym_01 19074 4.57 2.52 5.36 55 XM_H_Long_From01 19031 5.36 5.37 5.35 56 XM_DK_Undo_02 17815 14.50 39.17 5.01 57 XMStrtUSub 17146 5.06 5.68 4.82 58 XM_B_Phish_Phrases 17075 6.06 9.32 4.80 59 MIME_QP_LONG_LINE 16915 4.69 4.53 4.75 60 TR_XM_SpammyWords4 16806 6.73 11.96 4.72 61 XM_B_SpammyWords3 15860 7.31 14.73 4.46 62 XM_PDF 15381 3.35 0.82 4.32 63 MPART_ALT_DIFF 15011 4.69 5.91 4.22 64 HTML_IMAGE_RATIO_02 14798 4.95 7.02 4.16 65 RCVD_IN_IADB_LISTED 13709 3.15 1.32 3.85 66 XM_UncommonTLD01 13697 4.29 5.43 3.85 67 BAYES_99 13255 11.17 30.50 3.73 68 XMNumbers 12695 3.79 4.37 3.57 69 RCVD_IN_VALIDITY_SAFE 12262 3.04 2.00 3.45 70 RELAYCOUNTRY_META 12043 7.29 17.44 3.38 71 T_REMOTE_IMAGE 12026 2.89 1.61 3.38 72 BAYES_80 11962 4.92 8.95 3.36 73 RCVD_IN_IADB_SPF 11908 2.74 1.17 3.35 74 HTML_IMAGE_RATIO_04 11533 3.75 5.09 3.24 75 XMSubMetaSx_00 10768 4.27 7.51 3.03 76 MAILING_LIST_MULTI 10714 2.81 2.28 3.01 77 RCVD_IN_IADB_SENDERID 10508 2.44 1.12 2.95 78 BAYES_999 10415 8.51 23.01 2.93 79 RCVD_IN_IADB_DK 10240 2.39 1.12 2.88 80 TooManyTo_002 10093 2.21 0.58 2.84 81 T_TooManySym_02 10085 2.22 0.64 2.83 82 RCVD_IN_VALIDITY_CERTIFIED 9760 2.39 1.46 2.74 83 HTML_IMAGE_RATIO_06 9393 2.85 3.38 2.64 84 RCVD_IN_IADB_VOUCHED 9388 2.08 0.63 2.64 85 BOTNET_IPINHOSTNAME 9174 5.63 13.57 2.58 86 XM_B_SpammyTLD 8790 2.83 3.78 2.47 87 HTML_MIME_NO_HTML_TAG 8689 2.37 2.17 2.44 88 XM_Body_Dirty_Words 8502 3.73 7.21 2.39 89 TR_XM_DKIM_Undo 8306 9.61 28.50 2.33 90 MIME_HTML_MOSTLY 8145 2.70 3.76 2.29 91 BAYES_05 8044 1.82 0.67 2.26 92 DKIM_INVALID 7948 3.29 6.03 2.23 93 HTML_IMAGE_RATIO_08 7841 2.32 2.61 2.20 94 MIME_HTML_ONLY_MULTI 7791 2.47 3.19 2.19 95 BAYES_95 7679 3.05 5.38 2.16 96 INVALID_MSGID 7603 1.60 0.19 2.14 97 XM_CamelCaseFrm001 6940 2.41 3.62 1.95 98 URI_OPTOUT_3LD 6854 1.43 0.16 1.93 99 RCVD_IN_IADB_OPTIN 6675 1.46 0.39 1.88 100 XM_B_URI_Unicode 6618 2.22 3.16 1.86 101 TR_Symld_Words 6569 1.71 1.35 1.85 102 TO_MALFORMED 6275 1.28 0.02 1.76 103 XM_B_Investor 6220 2.73 5.26 1.75 104 TR_XM_UnparsRelay 6214 3.93 9.61 1.75 105 TR_XM_SpammyRelay 6113 4.66 12.29 1.72 106 T_XMDrugObfuBody_14 6003 2.31 3.93 1.69 107 KHOP_HELO_FCRDNS 5928 1.71 1.81 1.67 108 XM_DK_Undo_01 5783 1.67 1.78 1.63 109 TooManyTo_003 5653 1.28 0.48 1.59 110 TR_DCC_Bayes_99 5580 7.24 22.00 1.57 111 TR_XM_PhishingBody 5579 2.47 4.81 1.57 112 XMDiploma_00 5539 2.03 3.25 1.56 113 URI_NOVOWEL 5464 1.53 1.52 1.54 114 FROM_EXCESS_BASE64 5251 1.66 2.13 1.48 115 RCVD_IN_MSPIKE_H4 5187 1.34 1.02 1.46 116 T_XMDrugObfuBody_08 5101 1.98 3.39 1.43 117 TM2_M_URI_OPT_OUT 5008 1.63 2.22 1.41 118 UNTRUSTED_Relay 4997 2.89 6.76 1.40 119 SUBJ_ALL_CAPS 4914 1.49 1.76 1.38 120 XM_SPF_SoftFail 4912 1.85 3.07 1.38 121 XM_B_Unsub2 4799 1.73 2.73 1.35 122 XMGappySubj_01 4615 0.98 0.17 1.30 123 HELO_NODOT 4592 1.00 0.26 1.29 124 HELO_NO_DOMAIN 4583 1.00 0.26 1.29 125 XM_GoogleGroups 4567 1.15 0.79 1.28 126 T_XMDrugObfuBody_00 4563 1.37 1.60 1.28 127 TR_XM_SpammyWords5 4544 2.18 4.52 1.28 128 XM_SendGrid 4526 1.35 1.55 1.27 129 URI_HEX 4445 1.33 1.55 1.25 130 BOTNET 4186 4.13 11.79 1.18 131 IN_HORDE_ADDRESS_BOOK 4157 0.88 0.12 1.17 132 T_TooManySym_03 4153 0.90 0.22 1.17 133 XMCapTrack 4084 0.96 0.48 1.15 134 TooManyTo_004 4054 0.94 0.42 1.14 135 TM2_M_VERY_LONG_WORD 3874 1.91 4.05 1.09 136 XMSexyCombo_05 3704 1.93 4.24 1.04 137 T_TVD_MIME_NO_HEADERS 3480 0.72 0.05 0.98 138 XM_OfRef6 3375 1.72 3.74 0.95 139 TVD_SPACE_RATIO 3345 0.72 0.14 0.94 140 XM_UB50 3312 1.76 3.93 0.93 141 TooManyTo_005 3250 0.76 0.38 0.91 142 XM_ShortIntro_01 3129 0.74 0.39 0.88 143 T_FILL_THIS_FORM_SHORT 3037 1.28 2.39 0.85 144 TR_XM_DK_SendGrid 3018 0.85 0.86 0.85 145 RELAYCOUNTRY_CA 2985 2.34 6.23 0.84 146 XMGenDplmaNmb 2945 1.07 1.70 0.83 147 XM_H_PHPMailer 2918 0.77 0.65 0.82 148 HTTPS_HTTP_MISMATCH 2876 1.02 1.57 0.81 149 SpammyFromTLD_01 2832 1.07 1.77 0.80 150 DKIM_ADSP_CUSTOM_MED 2807 0.87 1.09 0.79 151 XMBrknScrpt_02 2793 1.04 1.70 0.78 152 FROM_GOV_DKIM_AU 2715 0.60 0.17 0.76 153 XM_H_Long_From02 2655 0.96 1.50 0.75 154 TR_MetaPhish_Combo_01 2647 0.79 0.91 0.74 155 RCVD_IN_PBL 2638 0.75 0.76 0.74 156 XMStockSpam_06 2615 1.11 2.09 0.73 157 TVD_RCVD_IP 2606 0.85 1.16 0.73 158 SHORT_URI_2 2501 0.52 0.06 0.70 159 SHORT_URI_3 2493 0.52 0.07 0.70 160 XM_B_SpammyWords4 2464 1.26 2.73 0.69 161 XM_B_COPY_HTML 2452 0.85 1.26 0.69 162 XMGappySubj_02 2395 0.50 0.05 0.67 163 XMSlimDrugH 2295 0.63 0.60 0.65 164 T_XMHurry_00 2282 0.99 1.91 0.64 165 XM_B_FormFill 2269 0.47 0.05 0.64 166 RCVD_IN_BL_SPAMCOP_NET 2268 2.71 8.11 0.64 167 T_Symld_Words_02 2232 0.77 1.16 0.63 168 RELAYCOUNTRY_AU 2130 1.14 2.56 0.60 169 T_OBFU_PDF_ATTACH 2126 0.48 0.17 0.60 170 XMNoVowels 2060 0.53 0.42 0.58 171 HTML_TAG_BALANCE_BODY 2020 0.65 0.88 0.57 172 MPART_ALT_DIFF_COUNT 2015 0.79 1.37 0.57 173 XMMoneyMeta_00 2002 0.61 0.73 0.56 174 XMPhish30 1897 0.81 1.53 0.53 175 TR_XM_Base64_M1 1893 0.63 0.87 0.53 176 TO_NO_BRKTS_HTML_ONLY 1873 0.56 0.65 0.53 177 XMLngstWrd_00 1856 0.47 0.33 0.52 178 SpammyFromTLD_02 1838 0.90 1.91 0.52 179 TR_XM_MSPIKECOMBO 1836 1.81 5.16 0.52 180 RCVD_IN_MSPIKE_BL 1836 1.81 5.17 0.52 181 URI_TRY_3LD 1820 0.81 1.59 0.51 182 XMBdyGiftCard01 1795 0.65 1.03 0.50 183 TR_XM_SpammyWords2 1791 3.38 10.86 0.50 184 MSGID_FROM_MTA_HEADER 1728 0.40 0.17 0.49 185 T_STY_INVIS_DIRECT 1719 0.56 0.76 0.48 186 XMDateMe_00 1716 0.46 0.42 0.48 187 NML_ADSP_CUSTOM_MED 1707 0.60 0.89 0.48 188 XM_ProductURIs 1682 0.74 1.43 0.47 189 FORGED_GMAIL_RCVD 1658 0.57 0.84 0.47 190 XM_B_DNDMA 1658 0.71 1.35 0.47 191 XMSubMetaI_00 1634 0.64 1.12 0.46 192 RELAYCOUNTRY_GB 1627 0.62 1.05 0.46 193 TM2_M_OBFU_COMMENT 1605 0.50 0.65 0.45 194 XMLngstWrd_01 1599 0.41 0.29 0.45 195 RCVD_IN_MSPIKE_L3 1561 1.04 2.60 0.44 196 LongTLD 1549 0.56 0.88 0.44 197 XMPhish14 1542 0.57 0.92 0.43 198 XMBSHREFv2 1535 0.41 0.36 0.43 199 HTML_IMAGE_ONLY_32 1487 0.44 0.50 0.42 200 XMBody_17 1436 1.15 3.08 0.40 ----------------------------------------------------------------------