Email: 408181 Autolearn: 0 AvgScore: 5.06 AvgScanTime: 1.42 sec Spam: 124505 Autolearn: 0 AvgScore: 14.58 AvgScanTime: 1.60 sec Ham: 283676 Autolearn: 0 AvgScore: 0.89 AvgScanTime: 1.34 sec Time Spent Running SA: 160.98 hours Time Spent Processing Spam: 55.31 hours Time Spent Processing Ham: 105.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 118388 88.67 95.09 85.86 2 DKIM_SIGNED 112823 80.20 90.62 75.63 3 XM_DK_Pass 107950 78.34 86.70 74.66 4 DKIM_VALID 107099 77.52 86.02 73.79 5 XM_B_Unicode 105812 75.50 84.99 71.34 6 RELAYCOUNTRY_US 101479 82.31 81.51 82.66 7 DCC_CHECK 93592 51.48 75.17 41.08 8 XMListUnsubscribeExists 85497 53.93 68.67 47.45 9 XM_B_SpammyWords 85391 52.56 68.58 45.53 10 DKIM_VALID_AU 84254 62.49 67.67 60.21 11 XM_B_Unicode3 63754 43.51 51.21 40.13 12 LOC_TINY_FONT_1 61340 34.37 49.27 27.83 13 BAYES_50 50772 54.88 40.78 61.07 14 XM_DK_Undo_02 49824 15.95 40.02 5.39 15 XM_B_SpammyWords2 49006 25.94 39.36 20.05 16 HTML_FONT_LOW_CONTRAST 44281 29.66 35.57 27.06 17 FVGT_m_MULTI_ODD 43293 28.00 34.77 25.03 18 DKIM_VALID_EF 38969 31.33 31.30 31.35 19 BAYES_99 38781 12.13 31.15 3.78 20 T_KAM_HTML_FONT_INVALID 36783 24.03 29.54 21.61 21 TR_XM_DKIM_Undo 35868 10.34 28.81 2.23 22 MIME_HTML_ONLY 35742 22.72 28.71 20.09 23 XMSubLong 31605 23.67 25.38 22.92 24 BAYES_999 29831 9.30 23.96 2.86 25 DCC_CHECK_NEGATIVE 29306 48.10 23.54 58.89 26 TR_XM_DK_Unsub 28043 16.35 22.52 13.65 27 XM_Multi_Part_URI 27255 16.25 21.89 13.78 28 TR_DCC_Bayes_99 27191 7.70 21.84 1.50 29 T_TM2_M_HEADER_IN_MSG 27024 28.03 21.71 30.80 30 RCVD_IN_MSPIKE_H2 25018 17.65 20.09 16.57 31 UNPARSEABLE_RELAY 23073 14.79 18.53 13.14 32 XM_B_Unsub 22872 12.17 18.37 9.46 33 TR_XM_BayesUnsub 22015 10.42 17.68 7.23 34 RELAYCOUNTRY_META 21510 7.66 17.28 3.43 35 TR_MAX_INTL_RELAY 18887 8.85 15.17 6.07 36 XM_B_SpammyWords3 18862 9.16 15.15 6.53 37 LOTS_OF_MONEY 16606 8.50 13.34 6.38 38 TR_XM_SpammyRelay 15481 5.04 12.43 1.80 39 TR_XM_SpammyWords4 14495 6.36 11.64 4.04 40 BOTNET_IPINHOSTNAME 14051 5.97 11.29 3.64 41 XM_Evil_Numbers_Gen 13259 9.52 10.65 9.02 42 TR_XM_UnparsRelay 12829 4.45 10.30 1.89 43 FSL_BULK_SIG 12642 10.07 10.15 10.04 44 RCVD_IN_MSPIKE_WL 12277 15.39 9.86 17.82 45 TR_XM_SpammyWords2 12133 3.27 9.74 0.43 46 BAYES_80 11651 5.45 9.36 3.73 47 BOTNET 11582 4.01 9.30 1.68 48 RCVD_IN_BL_SPAMCOP_NET 11473 3.14 9.21 0.48 49 LotsOfNums_01 10787 9.33 8.66 9.62 50 XM_B_Phish_Phrases 10573 7.85 8.49 7.57 51 BAYES_60 9780 7.24 7.86 6.97 52 XM_Body_Dirty_Words 9342 4.37 7.50 3.00 53 HTML_IMAGE_RATIO_02 8406 5.04 6.75 4.29 54 XMSubMetaSx_00 8083 4.65 6.49 3.84 55 MPART_ALT_DIFF 8081 5.36 6.49 4.86 56 RELAYCOUNTRY_CA 8064 2.45 6.48 0.69 57 UNTRUSTED_Relay 8028 3.00 6.45 1.49 58 XM_UncommonTLD01 7449 4.68 5.98 4.10 59 XM_B_PhoneNumber 7365 7.95 5.92 8.85 60 XM_H_Long_From01 7275 5.78 5.84 5.76 61 XM_B_Investor 7139 2.65 5.73 1.30 62 BAYES_95 6848 3.30 5.50 2.33 63 XM_H_GMP 6774 5.52 5.44 5.55 64 HTML_IMAGE_RATIO_04 6649 5.19 5.34 5.12 65 TR_XM_PhishingBody 6301 2.59 5.06 1.51 66 RCVD_IN_MSPIKE_H3 5971 7.00 4.80 7.96 67 XM_OfRef6 5968 2.12 4.79 0.95 68 T_XMDrugObfuBody_14 5931 2.83 4.76 1.98 69 DKIM_INVALID 5724 2.68 4.60 1.84 70 RCVD_IN_MSPIKE_BL 5636 2.12 4.53 1.06 71 TR_XM_MSPIKECOMBO 5636 2.12 4.53 1.06 72 XM_B_SpammyTLD 5553 3.41 4.46 2.94 73 TR_XM_SPAMCOP 5543 1.47 4.45 0.16 74 XMStrtUSub 5513 4.70 4.43 4.82 75 XMSexyCombo_05 5154 1.93 4.14 0.96 76 MIME_HTML_MOSTLY 4528 2.88 3.64 2.55 77 XMDiploma_00 4518 2.24 3.63 1.63 78 TR_XM_SpammyWords3 4445 1.39 3.57 0.43 79 TM2_M_VERY_LONG_WORD 4369 3.94 3.51 4.13 80 TooManyTo_001 4361 6.42 3.50 7.70 81 MIME_QP_LONG_LINE 4355 4.29 3.50 4.63 82 MIME_HTML_ONLY_MULTI 4299 2.93 3.45 2.70 83 XM_CamelCaseFrm001 4278 2.54 3.44 2.15 84 XM_SPF_SoftFail 4223 2.12 3.39 1.57 85 XM_UB50 4125 1.67 3.31 0.95 86 XM_URI_RBL 4052 1.26 3.25 0.38 87 TR_XM_SpammyWords5 4044 1.93 3.25 1.36 88 XMNumbers 4011 3.28 3.22 3.30 89 XM_B_URI_Unicode 3997 2.37 3.21 2.00 90 HTML_IMAGE_RATIO_06 3920 3.21 3.15 3.24 91 T_XMDrugObfuBody_08 3848 1.95 3.09 1.44 92 XM_B_Unsub2 3691 1.77 2.96 1.25 93 RCVD_IN_MSPIKE_L3 3648 1.48 2.93 0.85 94 USER_IN_DEF_DKIM_WL 3615 10.05 2.90 13.19 95 T_FILL_THIS_FORM_SHORT 3602 1.47 2.89 0.85 96 RELAYCOUNTRY_AU 3559 1.32 2.86 0.64 97 RCVD_IN_VALIDITY_SAFE 3480 3.35 2.80 3.59 98 RCVD_IN_MSPIKE_H4 3453 3.66 2.77 4.05 99 HTML_IMAGE_RATIO_08 3377 2.72 2.71 2.72 100 TM2_M_URI_OPT_OUT 3221 1.99 2.59 1.72 101 XMBody_17 3180 1.17 2.55 0.56 102 TR_XM_NoHeaderRelay 3172 0.91 2.55 0.19 103 T_TooManySym_01 3025 4.81 2.43 5.86 104 FROM_EXCESS_BASE64 3013 1.57 2.42 1.20 105 RCVD_IN_VALIDITY_CERTIFIED 2956 2.88 2.37 3.10 106 TR_XM_INV_DKIM 2912 0.72 2.34 0.01 107 XMBrknScrpt_02 2900 1.36 2.33 0.94 108 RCVD_IN_MSPIKE_H5 2854 4.74 2.29 5.81 109 T_XMHurry_00 2830 1.21 2.27 0.74 110 SpammyFromTLD_02 2808 1.12 2.26 0.63 111 XM_B_SpammyWords4 2755 1.05 2.21 0.54 112 MAILING_LIST_MULTI 2697 2.61 2.17 2.81 113 TR_XM_INTL_Spamhaus 2657 0.77 2.13 0.16 114 XMGenDplmaNmb 2615 1.34 2.10 1.01 115 RCVD_IN_VALIDITY_RPBL 2584 0.67 2.08 0.05 116 MPART_ALT_DIFF_COUNT 2512 0.95 2.02 0.48 117 XMPhish30 2473 0.86 1.99 0.37 118 XM_DK_Undo_01 2453 1.91 1.97 1.88 119 XMStockSpam_06 2448 1.57 1.97 1.40 120 RCVD_IN_IADB_LISTED 2375 3.06 1.91 3.57 121 TR_LOTS_OF_MONEY3 2367 0.85 1.90 0.39 122 RELAYCOUNTRY_FR 2365 0.76 1.90 0.25 123 RCVD_IN_PSBL 2277 0.90 1.83 0.49 124 SpammyFromTLD_01 2269 1.00 1.82 0.64 125 KHOP_HELO_FCRDNS 2222 2.58 1.78 2.94 126 RCVD_IN_PBL 2196 0.99 1.76 0.65 127 XMBdyGiftCard01 2166 0.77 1.74 0.34 128 TR_LOTS_OF_MONEY2 2161 0.68 1.74 0.22 129 T_MONEY_PERCENT 2161 0.68 1.74 0.22 130 RCVD_IN_IADB_SPF 2153 2.69 1.73 3.11 131 RCVD_IN_XBL 2146 0.54 1.72 0.01 132 URI_HEX 2133 1.37 1.71 1.22 133 TR_XM_MSPIKECOMBO2 2086 0.55 1.68 0.06 134 RCVD_IN_IADB_DK 2059 2.34 1.65 2.64 135 XM_H_Long_From02 2037 1.11 1.64 0.88 136 XM_SendGrid 2013 1.59 1.62 1.58 137 RCVD_IN_IADB_SENDERID 1992 2.40 1.60 2.74 138 ALL_TRUSTED 1983 10.45 1.59 14.34 139 BAYES_40 1930 4.14 1.55 5.27 140 XM_B_COPY_HTML 1914 0.99 1.54 0.74 141 RCVD_IN_SBL_CSS 1886 0.49 1.51 0.05 142 T_XMDrugObfuBody_00 1876 1.07 1.51 0.88 143 URI_NOVOWEL 1849 1.33 1.49 1.26 144 XM_B_Phish66 1842 0.73 1.48 0.39 145 SUBJ_ALL_CAPS 1829 1.52 1.47 1.55 146 HTML_MIME_NO_HTML_TAG 1815 2.26 1.46 2.61 147 TR_XM_GMP_BULK_SIG 1806 0.54 1.45 0.13 148 BOTNET_NORDNS 1777 0.44 1.43 0.01 149 XM_ProductURIs 1736 0.76 1.39 0.48 150 MultiRelay_CC 1718 0.51 1.38 0.12 151 XM_Nigeria_01 1712 0.48 1.38 0.09 152 TM2_M_OBFU_COMMENT 1690 0.65 1.36 0.34 153 XM_HighProb1 1688 0.42 1.36 0.01 154 T_REMOTE_IMAGE 1670 3.11 1.34 3.88 155 DKIM_ADSP_CUSTOM_MED 1663 0.95 1.34 0.78 156 RDNS_DYNAMIC 1600 0.52 1.29 0.18 157 HTML_IMAGE_ONLY_20 1584 0.71 1.27 0.47 158 RCVD_IN_ZEN_LASTEXTERNAL 1574 0.39 1.26 0.00 159 SHORTCIRCUIT 1574 0.39 1.26 0.00 160 TR_XM_PHPForged 1564 0.68 1.26 0.42 161 URI_TRY_3LD 1557 0.75 1.25 0.53 162 PDS_RDNS_DYNAMIC_FP 1555 0.40 1.25 0.03 163 TR_XM_FormFill2 1542 0.67 1.24 0.43 164 TR_MetaPhish_Combo_01 1536 0.86 1.23 0.69 165 TR_XM_PHPDW 1533 0.68 1.23 0.43 166 TVD_RCVD_IP 1532 1.17 1.23 1.15 167 XM_B_DNDMA 1514 0.90 1.22 0.76 168 DIET_1 1513 0.60 1.22 0.33 169 XM_H_PHPOS 1510 0.66 1.21 0.42 170 NML_ADSP_CUSTOM_MED 1472 0.72 1.18 0.52 171 HK_RANDOM_REPLYTO 1470 0.44 1.18 0.12 172 RELAYCOUNTRY_GB 1457 0.77 1.17 0.60 173 LONGLN_LOW_CONTRAST 1447 0.56 1.16 0.29 174 TR_XM_MaxSPIKE 1427 0.39 1.15 0.06 175 XM_B_SEO 1425 0.46 1.14 0.16 176 XMMoneyMeta_00 1425 0.70 1.14 0.50 177 TR_XM_FormFill 1407 0.36 1.13 0.02 178 XM_DIRTYINTL 1406 0.39 1.13 0.07 179 TR_XM_Base64_M1 1402 0.77 1.13 0.61 180 BAYES_20 1392 2.93 1.12 3.72 181 FILL_THIS_FORM 1386 0.56 1.11 0.31 182 TR_XM_DK_SendGrid 1374 1.05 1.10 1.03 183 STY_INVIS_DIRECT 1359 0.63 1.09 0.42 184 FORGED_GMAIL_RCVD 1352 0.69 1.09 0.51 185 TR_XM_RelayPhish 1335 0.38 1.07 0.07 186 XM_OfRef7 1335 0.44 1.07 0.17 187 TR_XM_InvalidRelay 1327 0.33 1.07 0.01 188 RCVD_IN_MSPIKE_L4 1327 0.47 1.07 0.21 189 SHOPIFY_IMG_NOT_RCVD_SFY 1314 0.52 1.06 0.28 190 XM_UB99 1300 0.32 1.04 0.00 191 URIBL_BLACK 1275 0.32 1.02 0.01 192 XMBody_78 1254 0.49 1.01 0.26 193 HTML_TAG_BALANCE_BODY 1243 0.60 1.00 0.42 194 LongTLD 1231 0.63 0.99 0.48 195 XM_B_COVIDMETA 1191 0.43 0.96 0.20 196 URIBL_SBL_A 1187 0.29 0.95 0.00 197 URIBL_SBL 1187 0.29 0.95 0.00 198 XM_GoogleGroups 1186 1.17 0.95 1.27 199 SH_BODYURI_REVERSE_SBL 1186 0.29 0.95 0.00 200 HTML_FONT_TINY_NORDNS 1171 0.36 0.94 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243562 88.67 95.09 85.86 2 RELAYCOUNTRY_US 234498 82.31 81.51 82.66 3 DKIM_SIGNED 214531 80.20 90.62 75.63 4 XM_DK_Pass 211801 78.34 86.70 74.66 5 DKIM_VALID 209318 77.52 86.02 73.79 6 XM_B_Unicode 202384 75.50 84.99 71.34 7 BAYES_50 173255 54.88 40.78 61.07 8 DKIM_VALID_AU 170806 62.49 67.67 60.21 9 DCC_CHECK_NEGATIVE 167049 48.10 23.54 58.89 10 XMListUnsubscribeExists 134618 53.93 68.67 47.45 11 XM_B_SpammyWords 129144 52.56 68.58 45.53 12 DCC_CHECK 116520 51.48 75.17 41.08 13 XM_B_Unicode3 113848 43.51 51.21 40.13 14 DKIM_VALID_EF 88923 31.33 31.30 31.35 15 T_TM2_M_HEADER_IN_MSG 87370 28.03 21.71 30.80 16 LOC_TINY_FONT_1 78949 34.37 49.27 27.83 17 HTML_FONT_LOW_CONTRAST 76767 29.66 35.57 27.06 18 FVGT_m_MULTI_ODD 70993 28.00 34.77 25.03 19 XMSubLong 65029 23.67 25.38 22.92 20 T_KAM_HTML_FONT_INVALID 61290 24.03 29.54 21.61 21 MIME_HTML_ONLY 56991 22.72 28.71 20.09 22 XM_B_SpammyWords2 56869 25.94 39.36 20.05 23 RCVD_IN_MSPIKE_WL 50558 15.39 9.86 17.82 24 RCVD_IN_MSPIKE_H2 47011 17.65 20.09 16.57 25 ALL_TRUSTED 40676 10.45 1.59 14.34 26 XM_Multi_Part_URI 39092 16.25 21.89 13.78 27 TR_XM_DK_Unsub 38713 16.35 22.52 13.65 28 USER_IN_DEF_DKIM_WL 37410 10.05 2.90 13.19 29 UNPARSEABLE_RELAY 37286 14.79 18.53 13.14 30 BAYES_00 31085 7.86 0.81 10.96 31 FSL_BULK_SIG 28469 10.07 10.15 10.04 32 LotsOfNums_01 27280 9.33 8.66 9.62 33 XM_B_Unsub 26822 12.17 18.37 9.46 34 XM_Evil_Numbers_Gen 25587 9.52 10.65 9.02 35 XM_B_PhoneNumber 25093 7.95 5.92 8.85 36 TR_XM_DK_Bayes 22921 5.82 0.66 8.08 37 TR_XM_DK_Bayes1 22677 5.76 0.66 7.99 38 RCVD_IN_MSPIKE_H3 22593 7.00 4.80 7.96 39 TooManyTo_001 21846 6.42 3.50 7.70 40 XM_B_Phish_Phrases 21462 7.85 8.49 7.57 41 TR_XM_BayesUnsub 20500 10.42 17.68 7.23 42 XM_DKIMWhitelistDomains 19987 4.91 0.05 7.05 43 BAYES_60 19783 7.24 7.86 6.97 44 TR_XM_DK_Bayes2 19469 4.91 0.47 6.86 45 XM_B_SpammyWords3 18522 9.16 15.15 6.53 46 ANY_BOUNCE_MESSAGE 18236 4.73 0.88 6.43 47 BOUNCE_MESSAGE 18235 4.73 0.87 6.43 48 LOTS_OF_MONEY 18088 8.50 13.34 6.38 49 TR_MAX_INTL_RELAY 17218 8.85 15.17 6.07 50 T_TooManySym_01 16611 4.81 2.43 5.86 51 RCVD_IN_MSPIKE_H5 16475 4.74 2.29 5.81 52 XM_H_Long_From01 16327 5.78 5.84 5.76 53 XM_H_GMP 15745 5.52 5.44 5.55 54 XM_DK_Undo_02 15292 15.95 40.02 5.39 55 BAYES_40 14953 4.14 1.55 5.27 56 HTML_IMAGE_RATIO_04 14521 5.19 5.34 5.12 57 MPART_ALT_DIFF 13792 5.36 6.49 4.86 58 XMStrtUSub 13664 4.70 4.43 4.82 59 MIME_QP_LONG_LINE 13146 4.29 3.50 4.63 60 XM_PDF 12242 3.23 0.75 4.32 61 HTML_IMAGE_RATIO_02 12180 5.04 6.75 4.29 62 TM2_M_VERY_LONG_WORD 11722 3.94 3.51 4.13 63 XM_UncommonTLD01 11635 4.68 5.98 4.10 64 RCVD_IN_MSPIKE_H4 11490 3.66 2.77 4.05 65 TR_XM_SpammyWords4 11462 6.36 11.64 4.04 66 T_REMOTE_IMAGE 11009 3.11 1.34 3.88 67 XMSubMetaSx_00 10892 4.65 6.49 3.84 68 BAYES_99 10736 12.13 31.15 3.78 69 BAYES_80 10595 5.45 9.36 3.73 70 BAYES_20 10554 2.93 1.12 3.72 71 BOTNET_IPINHOSTNAME 10331 5.97 11.29 3.64 72 RCVD_IN_VALIDITY_SAFE 10190 3.35 2.80 3.59 73 RCVD_IN_IADB_LISTED 10127 3.06 1.91 3.57 74 RELAYCOUNTRY_META 9738 7.66 17.28 3.43 75 XMNumbers 9374 3.28 3.22 3.30 76 HTML_IMAGE_RATIO_06 9194 3.21 3.15 3.24 77 T_TooManySym_02 9036 2.42 0.67 3.19 78 RCVD_IN_IADB_SPF 8809 2.69 1.73 3.11 79 RCVD_IN_VALIDITY_CERTIFIED 8780 2.88 2.37 3.10 80 XM_Body_Dirty_Words 8509 4.37 7.50 3.00 81 XM_B_SpammyTLD 8346 3.41 4.46 2.94 82 KHOP_HELO_FCRDNS 8327 2.58 1.78 2.94 83 BAYES_999 8121 9.30 23.96 2.86 84 MAILING_LIST_MULTI 7960 2.61 2.17 2.81 85 RCVD_IN_IADB_SENDERID 7786 2.40 1.60 2.74 86 HTML_IMAGE_RATIO_08 7713 2.72 2.71 2.72 87 MIME_HTML_ONLY_MULTI 7660 2.93 3.45 2.70 88 RCVD_IN_IADB_DK 7499 2.34 1.65 2.64 89 HTML_MIME_NO_HTML_TAG 7402 2.26 1.46 2.61 90 MIME_HTML_MOSTLY 7238 2.88 3.64 2.55 91 INVALID_MSGID 7078 1.80 0.22 2.50 92 RCVD_IN_IADB_VOUCHED 6895 1.93 0.79 2.43 93 TooManyTo_002 6842 1.86 0.62 2.41 94 BAYES_95 6617 3.30 5.50 2.33 95 MSGID_NOFQDN1 6417 1.58 0.01 2.26 96 TO_MALFORMED 6406 1.58 0.02 2.26 97 HTML_EXTRA_CLOSE 6329 1.57 0.05 2.23 98 TR_XM_DKIM_Undo 6327 10.34 28.81 2.23 99 XM_CamelCaseFrm001 6102 2.54 3.44 2.15 100 BAYES_05 6098 1.68 0.62 2.15 101 XM_B_URI_Unicode 5660 2.37 3.21 2.00 102 T_XMDrugObfuBody_14 5604 2.83 4.76 1.98 103 TR_XM_UnparsRelay 5348 4.45 10.30 1.89 104 XM_DK_Undo_01 5333 1.91 1.97 1.88 105 DKIM_INVALID 5213 2.68 4.60 1.84 106 TR_XM_SpammyRelay 5110 5.04 12.43 1.80 107 RCVD_IN_IADB_OPTIN 4995 1.39 0.56 1.76 108 TM2_M_URI_OPT_OUT 4885 1.99 2.59 1.72 109 BOTNET 4775 4.01 9.30 1.68 110 XMDiploma_00 4619 2.24 3.63 1.63 111 XM_SendGrid 4489 1.59 1.62 1.58 112 XM_SPF_SoftFail 4445 2.12 3.39 1.57 113 SUBJ_ALL_CAPS 4395 1.52 1.47 1.55 114 XMGappySubj_01 4326 1.25 0.62 1.52 115 TR_XM_PhishingBody 4282 2.59 5.06 1.51 116 TR_DCC_Bayes_99 4259 7.70 21.84 1.50 117 TooManyTo_003 4234 1.19 0.50 1.49 118 UNTRUSTED_Relay 4221 3.00 6.45 1.49 119 T_XMDrugObfuBody_08 4095 1.95 3.09 1.44 120 TR_Symld_Words 3988 1.25 0.91 1.41 121 IN_HORDE_ADDRESS_BOOK 3976 1.01 0.10 1.40 122 XMStockSpam_06 3975 1.57 1.97 1.40 123 FROM_GOV_DKIM_AU 3904 1.02 0.22 1.38 124 TR_XM_SpammyWords5 3849 1.93 3.25 1.36 125 XM_B_Investor 3681 2.65 5.73 1.30 126 XM_GoogleGroups 3593 1.17 0.95 1.27 127 URI_NOVOWEL 3579 1.33 1.49 1.26 128 XM_B_Unsub2 3547 1.77 2.96 1.25 129 T_TooManySym_03 3510 0.92 0.20 1.24 130 URI_HEX 3469 1.37 1.71 1.22 131 FROM_EXCESS_BASE64 3411 1.57 2.42 1.20 132 TVD_RCVD_IP 3255 1.17 1.23 1.15 133 TooManyTo_004 3120 0.89 0.42 1.10 134 HELO_NODOT 3117 0.84 0.25 1.10 135 HELO_NO_DOMAIN 3112 0.84 0.25 1.10 136 XMCapTrack 3071 0.91 0.51 1.08 137 RCVD_IN_MSPIKE_BL 3017 2.12 4.53 1.06 138 TR_XM_MSPIKECOMBO 3017 2.12 4.53 1.06 139 TR_XM_DK_SendGrid 2909 1.05 1.10 1.03 140 XMGenDplmaNmb 2858 1.34 2.10 1.01 141 TVD_SPACE_RATIO 2783 0.72 0.13 0.98 142 XMSexyCombo_05 2733 1.93 4.14 0.96 143 XM_OfRef6 2704 2.12 4.79 0.95 144 XM_UB50 2681 1.67 3.31 0.95 145 XMBrknScrpt_02 2663 1.36 2.33 0.94 146 TooManyTo_005 2538 0.74 0.39 0.89 147 T_XMDrugObfuBody_00 2497 1.07 1.51 0.88 148 XM_H_Long_From02 2496 1.11 1.64 0.88 149 XM_ShortIntro_01 2423 0.72 0.41 0.85 150 RCVD_IN_MSPIKE_L3 2408 1.48 2.93 0.85 151 T_FILL_THIS_FORM_SHORT 2406 1.47 2.89 0.85 152 XMGappySubj_02 2365 0.69 0.38 0.83 153 XMSubMetaSxObfu_03 2324 0.78 0.70 0.82 154 XM_H_PHPMailer 2254 0.73 0.57 0.79 155 DKIM_ADSP_CUSTOM_MED 2206 0.95 1.34 0.78 156 XM_B_DNDMA 2169 0.90 1.22 0.76 157 T_TVD_MIME_NO_HEADERS 2160 0.55 0.05 0.76 158 XM_B_COPY_HTML 2112 0.99 1.54 0.74 159 T_XMHurry_00 2111 1.21 2.27 0.74 160 TR_MetaPhish_Combo_01 1968 0.86 1.23 0.69 161 HTML_IMAGE_ONLY_32 1966 0.53 0.14 0.69 162 RELAYCOUNTRY_CA 1948 2.45 6.48 0.69 163 RCVD_IN_PBL 1839 0.99 1.76 0.65 164 SpammyFromTLD_01 1828 1.00 1.82 0.64 165 RELAYCOUNTRY_AU 1820 1.32 2.86 0.64 166 SpammyFromTLD_02 1777 1.12 2.26 0.63 167 XMSexyCombo_01 1745 0.67 0.80 0.62 168 TR_XM_Base64_M1 1742 0.77 1.13 0.61 169 T_OBFU_PDF_ATTACH 1742 0.46 0.12 0.61 170 RELAYCOUNTRY_GB 1705 0.77 1.17 0.60 171 XMBSHREFv2 1663 0.57 0.54 0.59 172 XMNoVowels 1631 0.58 0.59 0.57 173 HTTPS_HTTP_MISMATCH 1626 0.66 0.86 0.57 174 XMBody_17 1585 1.17 2.55 0.56 175 T_Symld_Words_02 1575 0.57 0.60 0.56 176 XM_B_SpammyWords4 1519 1.05 2.21 0.54 177 TO_NO_BRKTS_HTML_ONLY 1499 0.48 0.38 0.53 178 URI_TRY_3LD 1491 0.75 1.25 0.53 179 NML_ADSP_CUSTOM_MED 1480 0.72 1.18 0.52 180 FORGED_GMAIL_RCVD 1457 0.69 1.09 0.51 181 XMMoneyMeta_00 1424 0.70 1.14 0.50 182 RCVD_IN_PSBL 1396 0.90 1.83 0.49 183 XMSubMetaI_00 1393 0.62 0.93 0.49 184 RCVD_IN_BL_SPAMCOP_NET 1362 3.14 9.21 0.48 185 MPART_ALT_DIFF_COUNT 1358 0.95 2.02 0.48 186 LongTLD 1356 0.63 0.99 0.48 187 XM_ProductURIs 1354 0.76 1.39 0.48 188 HTML_IMAGE_ONLY_20 1332 0.71 1.27 0.47 189 XMSlimDrugH 1304 0.51 0.63 0.46 190 MSGID_FROM_MTA_HEADER 1284 0.41 0.30 0.45 191 XMLngstWrd_00 1271 0.48 0.56 0.45 192 HTML_FONT_FACE_BAD 1237 0.45 0.48 0.44 193 XMPhish14 1230 0.57 0.88 0.43 194 TR_XM_PHPDW 1229 0.68 1.23 0.43 195 TR_XM_SpammyWords2 1227 3.27 9.74 0.43 196 TR_XM_SpammyWords3 1222 1.39 3.57 0.43 197 XMBody_95 1218 0.33 0.10 0.43 198 TR_XM_FormFill2 1206 0.67 1.24 0.43 199 STY_INVIS_DIRECT 1205 0.63 1.09 0.42 200 TR_XM_PHPForged 1204 0.68 1.26 0.42 ----------------------------------------------------------------------