Email: 464976 Autolearn: 0 AvgScore: 5.44 AvgScanTime: 1.34 sec Spam: 142724 Autolearn: 0 AvgScore: 15.04 AvgScanTime: 1.49 sec Ham: 322252 Autolearn: 0 AvgScore: 1.19 AvgScanTime: 1.28 sec Time Spent Running SA: 173.34 hours Time Spent Processing Spam: 59.12 hours Time Spent Processing Ham: 114.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136055 89.45 95.33 86.85 2 DKIM_SIGNED 127904 78.30 89.62 73.29 3 XM_DK_Pass 119408 75.75 83.66 72.25 4 DKIM_VALID 118495 74.88 83.02 71.27 5 XM_B_Unicode 118275 75.81 82.87 72.69 6 RELAYCOUNTRY_US 115039 82.51 80.60 83.36 7 DCC_CHECK 108808 50.75 76.24 39.46 8 XM_B_SpammyWords 96831 53.13 67.84 46.62 9 XMListUnsubscribeExists 95177 52.19 66.69 45.77 10 DKIM_VALID_AU 93043 60.61 65.19 58.58 11 XM_B_Unicode3 68445 43.10 47.96 40.95 12 LOC_TINY_FONT_1 66777 34.20 46.79 28.63 13 BAYES_50 57388 55.67 40.21 62.51 14 XM_DK_Undo_02 56329 15.17 39.47 4.42 15 XM_B_SpammyWords2 55925 27.16 39.18 21.84 16 FVGT_m_MULTI_ODD 49873 27.95 34.94 24.85 17 HTML_FONT_LOW_CONTRAST 49721 29.80 34.84 27.57 18 BAYES_99 44638 11.82 31.28 3.21 19 DKIM_VALID_EF 43493 30.17 30.47 30.04 20 MIME_HTML_ONLY 42989 21.79 30.12 18.10 21 T_KAM_HTML_FONT_INVALID 41470 23.37 29.06 20.86 22 TR_XM_DKIM_Undo 40657 10.04 28.49 1.88 23 XMSubLong 34835 23.71 24.41 23.40 24 BAYES_999 34144 8.98 23.92 2.37 25 TR_DCC_Bayes_99 32148 7.73 22.52 1.17 26 DCC_CHECK_NEGATIVE 31807 48.76 22.29 60.49 27 TR_XM_DK_Unsub 31559 15.70 22.11 12.86 28 T_TM2_M_HEADER_IN_MSG 30272 30.49 21.21 34.60 29 RCVD_IN_MSPIKE_H2 29189 17.19 20.45 15.74 30 XM_Multi_Part_URI 28751 15.38 20.14 13.27 31 XM_B_Unsub 26887 11.86 18.84 8.77 32 RELAYCOUNTRY_META 26287 7.98 18.42 3.36 33 TR_XM_BayesUnsub 25802 10.46 18.08 7.09 34 UNPARSEABLE_RELAY 24972 13.66 17.50 11.95 35 TR_MAX_INTL_RELAY 23195 8.91 16.25 5.66 36 XM_B_SpammyWords3 20486 7.95 14.35 5.11 37 LOTS_OF_MONEY 19631 8.30 13.75 5.88 38 TR_XM_SpammyRelay 17931 5.01 12.56 1.66 39 BOTNET_IPINHOSTNAME 17912 5.87 12.55 2.91 40 TR_XM_SpammyWords4 17409 6.31 12.20 3.71 41 FSL_BULK_SIG 17073 9.77 11.96 8.80 42 RCVD_IN_BL_SPAMCOP_NET 15267 3.60 10.70 0.46 43 BOTNET 14733 3.95 10.32 1.13 44 XM_Evil_Numbers_Gen 14372 10.02 10.07 10.00 45 RCVD_IN_MSPIKE_WL 14089 14.89 9.87 17.11 46 TR_XM_UnparsRelay 13836 4.24 9.69 1.82 47 BAYES_80 13574 5.34 9.51 3.50 48 TR_XM_SpammyWords2 13234 3.11 9.27 0.39 49 LotsOfNums_01 12336 11.19 8.64 12.31 50 XM_B_Phish_Phrases 11938 6.64 8.36 5.88 51 BAYES_60 11841 7.10 8.30 6.57 52 UNTRUSTED_Relay 11157 3.52 7.82 1.62 53 XM_UncommonTLD01 10831 5.11 7.59 4.02 54 XM_Body_Dirty_Words 10201 3.65 7.15 2.10 55 XMSubMetaSx_00 10054 4.32 7.04 3.11 56 MPART_ALT_DIFF 9834 5.32 6.89 4.63 57 RCVD_IN_MSPIKE_BL 9819 2.63 6.88 0.74 58 TR_XM_MSPIKECOMBO 9814 2.62 6.88 0.74 59 XM_B_PhoneNumber 9739 8.37 6.82 9.06 60 RELAYCOUNTRY_CA 9416 2.54 6.60 0.74 61 DKIM_INVALID 9409 3.42 6.59 2.02 62 HTML_IMAGE_RATIO_02 9040 4.59 6.33 3.81 63 XM_H_Long_From01 8134 5.48 5.70 5.38 64 TR_XM_PhishingBody 7724 3.04 5.41 1.99 65 BAYES_95 7706 3.16 5.40 2.16 66 XM_H_GMP 7375 5.38 5.17 5.48 67 XM_B_Investor 7150 2.68 5.01 1.65 68 XMStrtUSub 6995 4.97 4.90 5.00 69 TR_XM_SPAMCOP 6805 1.57 4.77 0.16 70 RCVD_IN_MSPIKE_H3 6592 6.83 4.62 7.81 71 XM_SPF_SoftFail 6591 2.49 4.62 1.55 72 HTML_IMAGE_RATIO_04 6495 4.52 4.55 4.50 73 MIME_QP_LONG_LINE 6374 4.96 4.47 5.18 74 RCVD_IN_MSPIKE_L3 6344 1.77 4.44 0.59 75 XM_OfRef6 6239 2.01 4.37 0.97 76 T_XMDrugObfuBody_14 5854 2.51 4.10 1.80 77 XMSexyCombo_05 5831 1.91 4.09 0.94 78 TR_XM_SpammyWords3 5621 1.44 3.94 0.33 79 XM_B_SpammyTLD 5583 2.95 3.91 2.52 80 T_FILL_THIS_FORM_SHORT 5523 1.84 3.87 0.94 81 TM2_M_VERY_LONG_WORD 5439 6.35 3.81 7.47 82 TooManyTo_001 5414 6.70 3.79 7.99 83 XMNumbers 5388 3.73 3.78 3.71 84 MIME_HTML_MOSTLY 4979 2.73 3.49 2.40 85 FROM_EXCESS_BASE64 4845 1.96 3.39 1.32 86 TR_XM_SpammyWords5 4662 2.14 3.27 1.64 87 HTML_IMAGE_RATIO_06 4631 4.10 3.24 4.48 88 XM_URI_RBL 4508 1.17 3.16 0.29 89 XMDiploma_00 4506 2.07 3.16 1.59 90 MIME_HTML_ONLY_MULTI 4404 2.61 3.09 2.39 91 TR_XM_INTL_Spamhaus 4383 1.06 3.07 0.17 92 XM_B_Unsub2 4381 1.78 3.07 1.20 93 HTML_IMAGE_RATIO_08 4337 2.59 3.04 2.39 94 RCVD_IN_MSPIKE_H4 4176 3.48 2.93 3.73 95 XM_UB50 4143 1.60 2.90 1.02 96 XM_CamelCaseFrm001 4113 2.10 2.88 1.75 97 T_XMDrugObfuBody_08 4069 1.83 2.85 1.38 98 TR_XM_INV_DKIM 4009 0.88 2.81 0.02 99 TR_XM_NoHeaderRelay 3910 0.97 2.74 0.19 100 RCVD_IN_PBL 3860 1.33 2.70 0.72 101 USER_IN_DEF_DKIM_WL 3827 9.71 2.68 12.82 102 RELAYCOUNTRY_AU 3809 1.14 2.67 0.46 103 XM_B_URI_Unicode 3773 2.06 2.64 1.79 104 TR_XM_MSPIKECOMBO2 3754 0.82 2.63 0.02 105 TR_Symld_Words 3748 1.79 2.63 1.42 106 RCVD_IN_VALIDITY_SAFE 3598 3.27 2.52 3.60 107 TR_XM_InvalidRelay 3567 0.78 2.50 0.01 108 SpammyFromTLD_02 3540 1.12 2.48 0.52 109 T_TooManySym_01 3470 5.01 2.43 6.15 110 RCVD_IN_MSPIKE_H5 3321 4.58 2.33 5.58 111 XMBody_17 3292 0.93 2.31 0.32 112 TM2_M_URI_OPT_OUT 3208 1.96 2.25 1.84 113 DKIM_ADSP_NXDOMAIN 3181 0.89 2.23 0.29 114 XMBrknScrpt_02 3099 1.22 2.17 0.80 115 MAILING_LIST_MULTI 3000 3.02 2.10 3.43 116 XMGenDplmaNmb 2959 1.18 2.07 0.79 117 XM_UB99 2948 0.63 2.07 0.00 118 RCVD_IN_VALIDITY_CERTIFIED 2924 2.82 2.05 3.17 119 T_XMHurry_00 2908 1.01 2.04 0.56 120 XMPhish30 2865 1.08 2.01 0.67 121 T_HTML_ATTACH 2781 0.66 1.95 0.09 122 XM_B_SpammyWords4 2764 1.22 1.94 0.90 123 TR_XM_MaxSPIKE 2699 0.59 1.89 0.02 124 XMStockSpam_06 2613 1.09 1.83 0.76 125 SpammyFromTLD_01 2606 1.10 1.83 0.77 126 T_XMDrugObfuBody_00 2603 1.11 1.82 0.79 127 XMBdyGiftCard01 2481 0.92 1.74 0.55 128 XM_B_Phish66 2450 0.87 1.72 0.50 129 RELAYCOUNTRY_BR 2371 0.51 1.66 0.00 130 URI_HEX 2316 1.30 1.62 1.16 131 RCVD_IN_VALIDITY_RPBL 2297 0.52 1.61 0.03 132 T_OBFU_HTML_ATTACH 2297 0.50 1.61 0.00 133 TR_XM_HtmlAttach 2296 0.50 1.61 0.00 134 HTML_IMAGE_ONLY_20 2286 0.86 1.60 0.53 135 T_REMOTE_IMAGE 2258 2.99 1.58 3.62 136 XM_DK_Undo_01 2216 1.76 1.55 1.85 137 MPART_ALT_DIFF_COUNT 2185 0.85 1.53 0.54 138 RCVD_IN_MSPIKE_L4 2155 0.56 1.51 0.15 139 XM_SendGrid 2147 1.51 1.50 1.51 140 HTML_MIME_NO_HTML_TAG 2141 2.12 1.50 2.40 141 BAYES_40 2140 4.30 1.50 5.54 142 XM_UB999 2123 0.46 1.49 0.00 143 RCVD_IN_ZEN_LASTEXTERNAL 2090 0.45 1.46 0.00 144 SHORTCIRCUIT 2090 0.45 1.46 0.00 145 SUBJ_ALL_CAPS 2011 1.38 1.41 1.37 146 XM_H_Long_From02 1994 0.93 1.40 0.73 147 RCVD_IN_PSBL 1989 0.71 1.39 0.41 148 ALL_TRUSTED 1970 9.90 1.38 13.68 149 KHOP_HELO_FCRDNS 1913 3.50 1.34 4.46 150 RCVD_IN_IADB_LISTED 1871 2.63 1.31 3.21 151 TR_XM_GMP_BULK_SIG 1832 0.53 1.28 0.19 152 TM2_M_A_HREF_HREF 1831 0.55 1.28 0.22 153 XM_B_COPY_HTML 1830 0.85 1.28 0.66 154 URI_TRY_3LD 1804 0.74 1.26 0.51 155 XM_H_DKIM_GOOG 1789 0.39 1.25 0.01 156 RELAYCOUNTRY_FR 1783 0.59 1.25 0.30 157 TR_LOTS_OF_MONEY3 1781 0.59 1.25 0.30 158 TR_LOTS_OF_MONEY2 1779 0.47 1.25 0.13 159 T_MONEY_PERCENT 1779 0.47 1.25 0.13 160 ANY_BOUNCE_MESSAGE 1762 6.74 1.23 9.19 161 BOUNCE_MESSAGE 1762 6.74 1.23 9.19 162 XM_B_SEO 1759 0.51 1.23 0.18 163 RCVD_IN_IADB_SPF 1727 2.34 1.21 2.84 164 TR_Mismatch_TLD_02 1721 0.42 1.21 0.07 165 XMSexyCombo_01 1701 0.48 1.19 0.17 166 XM_B_DNDMA 1697 0.74 1.19 0.54 167 XM_HighProb1 1681 0.36 1.18 0.00 168 URI_NOVOWEL 1656 1.29 1.16 1.35 169 XM_ProductURIs 1652 0.71 1.16 0.51 170 MultiRelay_CC 1651 0.45 1.16 0.14 171 RDNS_DYNAMIC 1642 0.45 1.15 0.14 172 PDS_RDNS_DYNAMIC_FP 1626 0.37 1.14 0.02 173 RCVD_IN_XBL 1624 0.36 1.14 0.02 174 URIBL_BLACK 1624 0.36 1.14 0.02 175 TR_XM_Bayes_Spamhaus 1622 0.35 1.14 0.00 176 RCVD_IN_IADB_DK 1620 2.08 1.14 2.49 177 DIET_1 1606 0.60 1.13 0.37 178 LONGLN_LOW_CONTRAST 1605 0.49 1.12 0.21 179 TM2_M_OBFU_COMMENT 1576 0.51 1.10 0.24 180 RCVD_IN_IADB_SENDERID 1574 2.11 1.10 2.56 181 TR_XM_PHPForged 1560 0.60 1.09 0.38 182 HTML_FONT_TINY_NORDNS 1540 0.38 1.08 0.07 183 TR_XM_PHPDW 1539 0.59 1.08 0.38 184 TR_XM_RelayPhish 1536 0.38 1.08 0.07 185 BAYES_20 1534 3.24 1.07 4.20 186 LongTLD 1534 0.69 1.07 0.51 187 TR_XM_FormFill2 1527 0.59 1.07 0.38 188 XM_H_PHPOS 1508 0.58 1.06 0.37 189 T_Symld_Words_02 1492 1.06 1.05 1.06 190 TR_XM_SEO4 1471 0.38 1.03 0.09 191 XM_UB60 1447 0.35 1.01 0.06 192 XM_DIRTYINTL 1410 0.34 0.99 0.06 193 SH_BODYURI_REVERSE_SBL 1408 0.31 0.99 0.00 194 URIBL_SBL_A 1407 0.30 0.99 0.00 195 URIBL_SBL 1407 0.30 0.99 0.00 196 TVD_RCVD_IP 1401 0.91 0.98 0.87 197 XMBody_78 1391 0.59 0.97 0.43 198 TR_XM_FormFill 1382 0.30 0.97 0.01 199 STY_INVIS_DIRECT 1368 0.52 0.96 0.32 200 RELAYCOUNTRY_GB 1357 0.71 0.95 0.60 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 279873 89.45 95.33 86.85 2 RELAYCOUNTRY_US 268628 82.51 80.60 83.36 3 DKIM_SIGNED 236188 78.30 89.62 73.29 4 XM_B_Unicode 234237 75.81 82.87 72.69 5 XM_DK_Pass 232833 75.75 83.66 72.25 6 DKIM_VALID 229683 74.88 83.02 71.27 7 BAYES_50 201448 55.67 40.21 62.51 8 DCC_CHECK_NEGATIVE 194935 48.76 22.29 60.49 9 DKIM_VALID_AU 188782 60.61 65.19 58.58 10 XM_B_SpammyWords 150220 53.13 67.84 46.62 11 XMListUnsubscribeExists 147507 52.19 66.69 45.77 12 XM_B_Unicode3 131958 43.10 47.96 40.95 13 DCC_CHECK 127165 50.75 76.24 39.46 14 T_TM2_M_HEADER_IN_MSG 111515 30.49 21.21 34.60 15 DKIM_VALID_EF 96806 30.17 30.47 30.04 16 LOC_TINY_FONT_1 92268 34.20 46.79 28.63 17 HTML_FONT_LOW_CONTRAST 88847 29.80 34.84 27.57 18 FVGT_m_MULTI_ODD 80086 27.95 34.94 24.85 19 XMSubLong 75419 23.71 24.41 23.40 20 XM_B_SpammyWords2 70377 27.16 39.18 21.84 21 T_KAM_HTML_FONT_INVALID 67217 23.37 29.06 20.86 22 MIME_HTML_ONLY 58330 21.79 30.12 18.10 23 RCVD_IN_MSPIKE_WL 55144 14.89 9.87 17.11 24 RCVD_IN_MSPIKE_H2 50733 17.19 20.45 15.74 25 ALL_TRUSTED 44083 9.90 1.38 13.68 26 XM_Multi_Part_URI 42761 15.38 20.14 13.27 27 TR_XM_DK_Unsub 41456 15.70 22.11 12.86 28 USER_IN_DEF_DKIM_WL 41310 9.71 2.68 12.82 29 LotsOfNums_01 39674 11.19 8.64 12.31 30 UNPARSEABLE_RELAY 38524 13.66 17.50 11.95 31 BAYES_00 32397 7.18 0.70 10.05 32 XM_Evil_Numbers_Gen 32238 10.02 10.07 10.00 33 ANY_BOUNCE_MESSAGE 29600 6.74 1.23 9.19 34 BOUNCE_MESSAGE 29599 6.74 1.23 9.19 35 XM_B_PhoneNumber 29194 8.37 6.82 9.06 36 FSL_BULK_SIG 28370 9.77 11.96 8.80 37 XM_B_Unsub 28248 11.86 18.84 8.77 38 TooManyTo_001 25732 6.70 3.79 7.99 39 RCVD_IN_MSPIKE_H3 25162 6.83 4.62 7.81 40 TM2_M_VERY_LONG_WORD 24074 6.35 3.81 7.47 41 TR_XM_BayesUnsub 22835 10.46 18.08 7.09 42 TR_XM_DK_Bayes 22832 5.09 0.58 7.09 43 TR_XM_DK_Bayes1 22582 5.03 0.58 7.01 44 BAYES_60 21178 7.10 8.30 6.57 45 T_TooManySym_01 19827 5.01 2.43 6.15 46 XM_DKIMWhitelistDomains 19669 4.24 0.04 6.10 47 TR_XM_DK_Bayes2 19590 4.30 0.29 6.08 48 LOTS_OF_MONEY 18944 8.30 13.75 5.88 49 XM_B_Phish_Phrases 18941 6.64 8.36 5.88 50 TR_MAX_INTL_RELAY 18253 8.91 16.25 5.66 51 RCVD_IN_MSPIKE_H5 17973 4.58 2.33 5.58 52 BAYES_40 17844 4.30 1.50 5.54 53 XM_H_GMP 17659 5.38 5.17 5.48 54 XM_H_Long_From01 17328 5.48 5.70 5.38 55 MIME_QP_LONG_LINE 16701 4.96 4.47 5.18 56 XM_B_SpammyWords3 16460 7.95 14.35 5.11 57 XMStrtUSub 16121 4.97 4.90 5.00 58 MPART_ALT_DIFF 14923 5.32 6.89 4.63 59 HTML_IMAGE_RATIO_04 14511 4.52 4.55 4.50 60 HTML_IMAGE_RATIO_06 14442 4.10 3.24 4.48 61 KHOP_HELO_FCRDNS 14367 3.50 1.34 4.46 62 XM_DK_Undo_02 14228 15.17 39.47 4.42 63 XM_PDF 14073 3.28 0.82 4.37 64 BAYES_20 13528 3.24 1.07 4.20 65 XM_UncommonTLD01 12949 5.11 7.59 4.02 66 HTML_IMAGE_RATIO_02 12280 4.59 6.33 3.81 67 RCVD_IN_MSPIKE_H4 12009 3.48 2.93 3.73 68 XMNumbers 11959 3.73 3.78 3.71 69 TR_XM_SpammyWords4 11949 6.31 12.20 3.71 70 T_REMOTE_IMAGE 11660 2.99 1.58 3.62 71 RCVD_IN_VALIDITY_SAFE 11613 3.27 2.52 3.60 72 BAYES_80 11274 5.34 9.51 3.50 73 MAILING_LIST_MULTI 11051 3.02 2.10 3.43 74 T_TooManySym_02 11008 2.57 0.67 3.42 75 RELAYCOUNTRY_META 10835 7.98 18.42 3.36 76 RCVD_IN_IADB_LISTED 10335 2.63 1.31 3.21 77 BAYES_99 10331 11.82 31.28 3.21 78 RCVD_IN_VALIDITY_CERTIFIED 10203 2.82 2.05 3.17 79 XMSubMetaSx_00 10020 4.32 7.04 3.11 80 BOTNET_IPINHOSTNAME 9376 5.87 12.55 2.91 81 RCVD_IN_IADB_SPF 9140 2.34 1.21 2.84 82 RCVD_IN_IADB_SENDERID 8245 2.11 1.10 2.56 83 XM_B_SpammyTLD 8115 2.95 3.91 2.52 84 RCVD_IN_IADB_DK 8040 2.08 1.14 2.49 85 TooManyTo_002 7969 1.89 0.57 2.47 86 MIME_HTML_MOSTLY 7727 2.73 3.49 2.40 87 HTML_MIME_NO_HTML_TAG 7723 2.12 1.50 2.40 88 MIME_HTML_ONLY_MULTI 7712 2.61 3.09 2.39 89 HTML_IMAGE_RATIO_08 7706 2.59 3.04 2.39 90 BAYES_999 7629 8.98 23.92 2.37 91 INVALID_MSGID 7419 1.69 0.31 2.30 92 BAYES_05 7277 1.74 0.57 2.26 93 BAYES_95 6974 3.16 5.40 2.16 94 XM_Body_Dirty_Words 6769 3.65 7.15 2.10 95 TO_MALFORMED 6697 1.44 0.00 2.08 96 MSGID_NOFQDN1 6606 1.46 0.13 2.05 97 DKIM_INVALID 6505 3.42 6.59 2.02 98 RCVD_IN_IADB_VOUCHED 6499 1.58 0.60 2.02 99 TR_XM_PhishingBody 6423 3.04 5.41 1.99 100 TR_XM_DKIM_Undo 6045 10.04 28.49 1.88 101 XM_DK_Undo_01 5975 1.76 1.55 1.85 102 TM2_M_URI_OPT_OUT 5917 1.96 2.25 1.84 103 TR_XM_UnparsRelay 5864 4.24 9.69 1.82 104 T_XMDrugObfuBody_14 5794 2.51 4.10 1.80 105 XM_B_URI_Unicode 5784 2.06 2.64 1.79 106 XM_CamelCaseFrm001 5639 2.10 2.88 1.75 107 TR_XM_SpammyRelay 5354 5.01 12.56 1.66 108 XM_B_Investor 5313 2.68 5.01 1.65 109 TooManyTo_003 5272 1.28 0.48 1.64 110 TR_XM_SpammyWords5 5271 2.14 3.27 1.64 111 UNTRUSTED_Relay 5215 3.52 7.82 1.62 112 XMDiploma_00 5133 2.07 3.16 1.59 113 XM_SPF_SoftFail 5007 2.49 4.62 1.55 114 XM_SendGrid 4853 1.51 1.50 1.51 115 MIME_CHARSET_FARAWAY 4825 1.19 0.50 1.50 116 HTML_IMAGE_ONLY_32 4748 1.16 0.44 1.47 117 CHARSET_FARAWAY_HEADER 4611 1.09 0.31 1.43 118 TR_Symld_Words 4587 1.79 2.63 1.42 119 RCVD_IN_IADB_OPTIN 4537 1.11 0.44 1.41 120 HELO_NODOT 4532 1.02 0.16 1.41 121 HELO_NO_DOMAIN 4530 1.02 0.16 1.41 122 T_XMDrugObfuBody_08 4442 1.83 2.85 1.38 123 SUBJ_ALL_CAPS 4422 1.38 1.41 1.37 124 TVD_SPACE_RATIO 4381 0.99 0.17 1.36 125 XM_GoogleGroups 4349 1.23 0.95 1.35 126 XMLngstWrd_00 4346 1.07 0.46 1.35 127 URI_NOVOWEL 4342 1.29 1.16 1.35 128 FROM_EXCESS_BASE64 4263 1.96 3.39 1.32 129 IN_HORDE_ADDRESS_BOOK 4112 0.91 0.07 1.28 130 TooManyTo_004 4109 1.01 0.40 1.28 131 XM_B_Unsub2 3875 1.78 3.07 1.20 132 TR_DCC_Bayes_99 3781 7.73 22.52 1.17 133 T_TooManySym_03 3751 0.88 0.25 1.16 134 URI_HEX 3735 1.30 1.62 1.16 135 XMGappySubj_01 3654 0.88 0.31 1.13 136 BOTNET 3650 3.95 10.32 1.13 137 XMCapTrack 3635 0.92 0.45 1.13 138 T_Symld_Words_02 3421 1.06 1.05 1.06 139 TooManyTo_005 3310 0.82 0.35 1.03 140 XM_UB50 3292 1.60 2.90 1.02 141 XM_OfRef6 3113 2.01 4.37 0.97 142 TR_XM_DK_SendGrid 3076 0.92 0.86 0.95 143 XMSexyCombo_05 3043 1.91 4.09 0.94 144 T_FILL_THIS_FORM_SHORT 3039 1.84 3.87 0.94 145 XM_ShortIntro_01 3030 0.76 0.36 0.94 146 XM_B_SpammyWords4 2913 1.22 1.94 0.90 147 TVD_RCVD_IP 2815 0.91 0.98 0.87 148 XMBrknScrpt_02 2569 1.22 2.17 0.80 149 T_XMDrugObfuBody_00 2559 1.11 1.82 0.79 150 DKIM_ADSP_CUSTOM_MED 2545 0.83 0.94 0.79 151 XMGenDplmaNmb 2530 1.18 2.07 0.79 152 FROM_GOV_DKIM_AU 2516 0.66 0.38 0.78 153 SpammyFromTLD_01 2489 1.10 1.83 0.77 154 XMStockSpam_06 2448 1.09 1.83 0.76 155 RCVD_IN_MSPIKE_BL 2398 2.63 6.88 0.74 156 RELAYCOUNTRY_CA 2388 2.54 6.60 0.74 157 TR_XM_MSPIKECOMBO 2385 2.62 6.88 0.74 158 TR_MetaPhish_Combo_01 2381 0.74 0.76 0.74 159 XM_H_Long_From02 2353 0.93 1.40 0.73 160 RCVD_IN_PBL 2333 1.33 2.70 0.72 161 XM_H_PHPMailer 2290 0.63 0.46 0.71 162 HTTPS_HTTP_MISMATCH 2204 0.76 0.92 0.68 163 XMPhish30 2165 1.08 2.01 0.67 164 XM_B_COPY_HTML 2137 0.85 1.28 0.66 165 XMNoVowels 2087 0.60 0.50 0.65 166 TR_XM_Base64_M1 2004 0.67 0.77 0.62 167 T_OBFU_PDF_ATTACH 1941 0.47 0.16 0.60 168 RELAYCOUNTRY_GB 1929 0.71 0.95 0.60 169 XMBSHREFv2 1925 0.52 0.36 0.60 170 LOW_PRICE 1914 0.49 0.24 0.59 171 TO_NO_BRKTS_HTML_ONLY 1898 0.47 0.22 0.59 172 RCVD_IN_MSPIKE_L3 1893 1.77 4.44 0.59 173 T_TVD_MIME_NO_HEADERS 1876 0.41 0.03 0.58 174 T_XMHurry_00 1806 1.01 2.04 0.56 175 XMPhish14 1800 0.67 0.91 0.56 176 XMBdyGiftCard01 1784 0.92 1.74 0.55 177 NML_ADSP_CUSTOM_MED 1751 0.62 0.78 0.54 178 MPART_ALT_DIFF_COUNT 1750 0.85 1.53 0.54 179 XM_B_DNDMA 1739 0.74 1.19 0.54 180 HTML_IMAGE_ONLY_20 1714 0.86 1.60 0.53 181 XMGappySubj_02 1706 0.41 0.13 0.53 182 SpammyFromTLD_02 1676 1.12 2.48 0.52 183 MSGID_FROM_MTA_HEADER 1656 0.47 0.36 0.51 184 LongTLD 1654 0.69 1.07 0.51 185 XMEqualsVooDoo_00 1654 0.40 0.15 0.51 186 URI_TRY_3LD 1652 0.74 1.26 0.51 187 HTML_TAG_BALANCE_BODY 1650 0.59 0.77 0.51 188 XM_ProductURIs 1632 0.71 1.16 0.51 189 XMSlimDrugH 1628 0.60 0.81 0.51 190 XM_B_Phish66 1601 0.87 1.72 0.50 191 FORGED_GMAIL_RCVD 1521 0.52 0.64 0.47 192 RELAYCOUNTRY_AU 1492 1.14 2.67 0.46 193 RCVD_IN_BL_SPAMCOP_NET 1471 3.60 10.70 0.46 194 XMSolicitRefs_0 1408 0.47 0.56 0.44 195 SHORT_HELO_AND_INLINE_IMAGE 1399 0.31 0.03 0.43 196 XMDateMe_00 1384 0.45 0.51 0.43 197 XMMoneyMeta_00 1376 0.55 0.82 0.43 198 XMLngstWrd_01 1370 0.39 0.32 0.43 199 XMBody_78 1370 0.59 0.97 0.43 200 RCVD_IN_PSBL 1310 0.71 1.39 0.41 ----------------------------------------------------------------------