Email: 577866 Autolearn: 0 AvgScore: 4.78 AvgScanTime: 1.38 sec Spam: 168224 Autolearn: 0 AvgScore: 12.85 AvgScanTime: 1.70 sec Ham: 409642 Autolearn: 0 AvgScore: 1.47 AvgScanTime: 1.24 sec Time Spent Running SA: 220.86 hours Time Spent Processing Spam: 79.67 hours Time Spent Processing Ham: 141.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 167990 99.66 99.86 99.58 2 HTML_MESSAGE 164160 91.77 97.58 89.38 3 DKIM_SIGNED 144200 70.01 85.72 63.56 4 XM_B_Unicode 135403 71.76 80.49 68.17 5 XM_DK_Pass 135127 67.60 80.33 62.37 6 DKIM_VALID 133824 66.81 79.55 61.58 7 RELAYCOUNTRY_US 131180 77.35 77.98 77.09 8 DCC_CHECK 125979 45.07 74.89 32.82 9 XM_B_SpammyWords 119287 51.08 70.91 42.94 10 DKIM_VALID_AU 106683 55.21 63.42 51.84 11 XMListUnsubscribeExists 105286 47.46 62.59 41.25 12 XM_B_Unicode3 81518 44.29 48.46 42.58 13 LOC_TINY_FONT_1 76871 31.81 45.70 26.11 14 BAYES_50 74015 53.95 44.00 58.04 15 XM_DK_Undo_02 64752 14.32 38.49 4.39 16 XM_B_SpammyWords2 63538 23.74 37.77 17.97 17 HTML_FONT_LOW_CONTRAST 63167 28.29 37.55 24.49 18 FVGT_m_MULTI_ODD 58411 25.50 34.72 21.72 19 MIME_HTML_ONLY 56860 28.84 33.80 26.80 20 BAYES_99 51137 10.93 30.40 2.93 21 DKIM_VALID_EF 48631 26.08 28.91 24.91 22 T_KAM_HTML_FONT_INVALID 45715 20.62 27.18 17.92 23 TR_XM_DKIM_Undo 45527 9.05 27.06 1.66 24 XMSubLong 44264 23.40 26.31 22.20 25 DCC_CHECK_NEGATIVE 42151 54.86 25.06 67.10 26 BAYES_999 39715 8.35 23.61 2.08 27 XM_Multi_Part_URI 37106 14.78 22.06 11.80 28 TR_DCC_Bayes_99 34910 6.71 20.75 0.94 29 TR_XM_DK_Unsub 33822 13.87 20.11 11.31 30 RCVD_IN_MSPIKE_H2 33349 15.09 19.82 13.15 31 T_TM2_M_HEADER_IN_MSG 33175 23.63 19.72 25.24 32 XM_B_Unsub 32299 10.93 19.20 7.54 33 UNPARSEABLE_RELAY 31302 12.16 18.61 9.51 34 TR_XM_BayesUnsub 30796 9.53 18.31 5.93 35 FSL_BULK_SIG 26657 8.25 15.85 5.13 36 RELAYCOUNTRY_META 25945 6.54 15.42 2.90 37 TR_MAX_INTL_RELAY 24037 8.14 14.29 5.61 38 XM_B_SpammyWords3 22217 7.50 13.21 5.16 39 LOTS_OF_MONEY 21718 7.60 12.91 5.42 40 RCVD_IN_MSPIKE_WL 20778 16.72 12.35 18.51 41 TR_XM_SpammyWords4 19117 5.95 11.36 3.72 42 TR_XM_SpammyRelay 18842 4.40 11.20 1.61 43 BOTNET_IPINHOSTNAME 18488 11.59 10.99 11.84 44 TR_XM_UnparsRelay 17774 4.13 10.57 1.48 45 TR_XM_SpammyWords2 17364 3.17 10.32 0.23 46 RCVD_IN_BL_SPAMCOP_NET 17168 3.36 10.21 0.56 47 TR_XM_SpammyWords5 16581 4.32 9.86 2.04 48 XM_Evil_Numbers_Gen 16257 9.46 9.66 9.38 49 BOTNET 15479 3.56 9.20 1.25 50 BAYES_80 14613 5.02 8.69 3.51 51 XM_B_Phish_Phrases 14595 6.30 8.68 5.32 52 TM2_M_URI_OPT_OUT 14347 4.34 8.53 2.62 53 SUBJ_ALL_CAPS 13964 8.52 8.30 8.61 54 HTML_MIME_NO_HTML_TAG 13068 8.98 7.77 9.48 55 ALL_TRUSTED 13039 16.72 7.75 20.41 56 BAYES_60 12323 10.29 7.33 11.50 57 RCVD_IN_MSPIKE_BL 12066 2.69 7.17 0.85 58 TR_XM_MSPIKECOMBO 12018 2.68 7.14 0.85 59 LotsOfNums_01 11714 8.05 6.96 8.50 60 UNTRUSTED_Relay 11460 2.89 6.81 1.28 61 MPART_ALT_DIFF 11343 7.64 6.74 8.00 62 BASE64_LENGTH_79_INF 11337 2.84 6.74 1.24 63 DKIM_INVALID 10376 3.20 6.17 1.98 64 XM_B_PhoneNumber 10240 7.78 6.09 8.48 65 XMSubMetaSx_00 9945 3.53 5.91 2.55 66 HTML_IMAGE_RATIO_02 9883 4.44 5.87 3.85 67 RCVD_IN_MSPIKE_H3 9532 7.27 5.67 7.93 68 XM_UncommonTLD01 9350 3.78 5.56 3.05 69 HTML_IMAGE_RATIO_04 9272 10.94 5.51 13.17 70 TR_XM_PhishingBody 9188 2.55 5.46 1.35 71 XM_Body_Dirty_Words 8653 2.93 5.14 2.02 72 TR_XM_SPAMCOP 8636 1.63 5.13 0.19 73 RELAYCOUNTRY_CA 8632 1.84 5.13 0.50 74 XM_H_Long_From01 8554 4.88 5.08 4.80 75 BAYES_95 8228 2.91 4.89 2.10 76 XM_H_GMP 8161 4.36 4.85 4.16 77 TR_XM_SpammyWords3 8068 1.70 4.80 0.43 78 T_XMDrugObfuBody_14 7864 2.49 4.67 1.59 79 RCVD_IN_MSPIKE_L3 7402 1.78 4.40 0.71 80 XM_B_SpammyTLD 7015 2.95 4.17 2.45 81 XMStrtUSub 6876 7.46 4.09 8.85 82 XM_B_Investor 6539 2.04 3.89 1.28 83 XMSexyCombo_05 6403 1.62 3.81 0.73 84 MIME_HTML_ONLY_MULTI 6162 5.41 3.66 6.13 85 TM2_M_VERY_LONG_WORD 6141 3.31 3.65 3.17 86 XM_B_Unsub2 6050 2.05 3.60 1.42 87 HTML_IMAGE_RATIO_06 5775 4.54 3.43 4.99 88 RCVD_IN_MSPIKE_H4 5729 3.92 3.41 4.13 89 TooManyTo_001 5636 5.31 3.35 6.11 90 TR_XM_INV_DKIM 5627 0.99 3.34 0.02 91 MIME_HTML_MOSTLY 5619 2.52 3.34 2.19 92 XM_OfRef6 5526 1.49 3.28 0.75 93 RCVD_IN_MSPIKE_H5 5517 5.53 3.28 6.46 94 XMNumbers 5418 3.02 3.22 2.93 95 XM_CamelCaseFrm001 5239 2.35 3.11 2.04 96 T_FILL_THIS_FORM_SHORT 5012 1.40 2.98 0.76 97 TR_XM_MSPIKECOMBO2 4886 0.91 2.90 0.09 98 MIME_QP_LONG_LINE 4733 4.07 2.81 4.58 99 XMDiploma_00 4602 1.62 2.74 1.16 100 RELAYCOUNTRY_AU 4424 1.15 2.63 0.54 101 XM_B_URI_Unicode 4408 1.98 2.62 1.72 102 XMBody_17 4401 1.06 2.62 0.42 103 T_XMDrugObfuBody_08 4387 1.66 2.61 1.28 104 TR_XM_NoHeaderRelay 4387 0.86 2.61 0.15 105 XM_UB50 4376 1.38 2.60 0.88 106 XMPhish30 4213 1.03 2.50 0.42 107 XM_SPF_SoftFail 4117 1.39 2.45 0.96 108 HTML_IMAGE_RATIO_08 4088 2.40 2.43 2.38 109 XM_B_SpammyWords4 4082 1.29 2.43 0.83 110 XM_URI_RBL 4001 0.85 2.38 0.22 111 USER_IN_DEF_DKIM_WL 3823 9.21 2.27 12.05 112 XMStockSpam_06 3762 1.34 2.24 0.98 113 T_TooManySym_01 3711 4.71 2.21 5.73 114 T_XMHurry_00 3699 1.14 2.20 0.71 115 RCVD_IN_MSPIKE_L4 3274 0.66 1.95 0.13 116 BAYES_40 3257 4.09 1.94 4.97 117 RCVD_IN_VALIDITY_SAFE 3218 3.12 1.91 3.62 118 TR_XM_MaxSPIKE 3196 0.59 1.90 0.05 119 SpammyFromTLD_02 3151 0.82 1.87 0.39 120 RCVD_IN_VALIDITY_RPBL 3077 0.55 1.83 0.03 121 MPART_ALT_DIFF_COUNT 2978 0.84 1.77 0.46 122 MAILING_LIST_MULTI 2954 2.75 1.76 3.15 123 XMBrknScrpt_02 2930 1.17 1.74 0.94 124 SpammyFromTLD_01 2888 0.90 1.72 0.56 125 T_XMDrugObfuBody_00 2823 1.05 1.68 0.79 126 T_REMOTE_IMAGE 2818 2.59 1.68 2.96 127 XMGenDplmaNmb 2790 0.93 1.66 0.63 128 TR_LOTS_OF_MONEY3 2739 0.74 1.63 0.38 129 XMSubNoVowel 2711 2.70 1.61 3.14 130 RCVD_IN_PSBL 2697 0.48 1.60 0.01 131 HTML_IMAGE_ONLY_20 2671 0.78 1.59 0.44 132 XM_UB99 2664 0.46 1.58 0.00 133 RCVD_IN_IADB_LISTED 2632 2.20 1.56 2.46 134 XM_DK_Undo_01 2626 1.64 1.56 1.68 135 BOTNET_NORDNS 2622 0.46 1.56 0.00 136 XM_H_Long_From02 2462 0.93 1.46 0.71 137 HTML_FONT_FACE_BAD 2439 7.81 1.45 10.42 138 URI_NOVOWEL 2430 1.10 1.44 0.96 139 URI_TRY_3LD 2420 0.80 1.44 0.54 140 FROM_EXCESS_BASE64 2411 1.68 1.43 1.78 141 RELAYCOUNTRY_FR 2316 0.59 1.38 0.26 142 T_MONEY_PERCENT 2309 0.53 1.37 0.18 143 TR_LOTS_OF_MONEY2 2309 0.53 1.37 0.18 144 RCVD_IN_VALIDITY_CERTIFIED 2243 2.60 1.33 3.11 145 XM_B_DNDMA 2233 0.74 1.33 0.50 146 RCVD_IN_IADB_SPF 2216 1.93 1.32 2.19 147 XM_SendGrid 2200 1.22 1.31 1.19 148 XM_B_COPY_HTML 2133 0.78 1.27 0.58 149 DKIM_ADSP_NXDOMAIN 2105 0.54 1.25 0.24 150 ANY_BOUNCE_MESSAGE 2053 4.21 1.22 5.44 151 BOUNCE_MESSAGE 2051 4.21 1.22 5.44 152 XM_B_Phish66 2046 0.63 1.22 0.39 153 BAYES_20 2039 2.81 1.21 3.46 154 RCVD_IN_IADB_DK 2034 1.71 1.21 1.91 155 HTTPS_HTTP_MISMATCH 2034 0.79 1.21 0.61 156 URI_HEX 2033 1.04 1.21 0.97 157 DIET_1 2029 0.57 1.21 0.31 158 RCVD_IN_IADB_SENDERID 1994 1.76 1.19 1.99 159 XM_B_SEO 1988 0.47 1.18 0.18 160 XM_UB999 1955 0.34 1.16 0.00 161 XMSubMetaI_00 1934 0.60 1.15 0.38 162 XMSubLongNoVowel 1907 1.42 1.13 1.54 163 KHOP_HELO_FCRDNS 1861 1.55 1.11 1.73 164 TR_Mismatch_TLD_02 1822 0.37 1.08 0.07 165 RDNS_DYNAMIC 1767 0.39 1.05 0.11 166 THIS_AD 1729 0.52 1.03 0.31 167 XMBody_78 1727 0.51 1.03 0.29 168 T_Symld_Words_02 1716 0.72 1.02 0.60 169 TR_XM_SEO4 1704 0.36 1.01 0.09 170 TM2_M_OBFU_COMMENT 1675 0.50 1.00 0.29 171 TR_Symld_Words 1654 1.28 0.98 1.40 172 XMPhish14 1651 0.53 0.98 0.34 173 XM_UB60 1641 0.34 0.98 0.07 174 XMBdyGiftCard01 1632 0.74 0.97 0.64 175 TR_XM_RelayPhish 1632 0.33 0.97 0.07 176 PLING_QUERY 1616 0.62 0.96 0.48 177 TM2_M_A_HREF_HREF 1612 0.45 0.96 0.24 178 XM_UB80 1592 0.28 0.95 0.01 179 XM_ProductURIs 1589 0.52 0.94 0.35 180 SHOPIFY_IMG_NOT_RCVD_SFY 1557 0.39 0.93 0.17 181 NORDNS_LOW_CONTRAST 1552 0.70 0.92 0.61 182 RCVD_IN_IADB_VOUCHED 1525 1.34 0.91 1.52 183 BAYES_00 1515 8.43 0.90 11.53 184 XM_PDF 1511 2.68 0.90 3.41 185 TR_XM_DK_SendGrid 1492 0.87 0.89 0.86 186 TR_XM_GMP_BULK_SIG 1474 0.32 0.88 0.10 187 TR_MetaPhish_Combo_01 1469 1.05 0.87 1.12 188 TVD_RCVD_IP 1436 0.85 0.85 0.84 189 XMHTML_After_End 1435 0.45 0.85 0.28 190 MIXED_HREF_CASE 1433 0.34 0.85 0.13 191 RELAYCOUNTRY_RU 1405 0.25 0.84 0.01 192 DKIM_ADSP_CUSTOM_MED 1377 0.68 0.82 0.62 193 MultiRelay_CC 1374 0.30 0.82 0.09 194 RCVD_IN_MSPIKE_L5 1342 0.24 0.80 0.01 195 TR_XM_Base64_M1 1341 0.75 0.80 0.73 196 TR_BOTNET_NEGATE 1339 0.35 0.80 0.17 197 RELAYCOUNTRY_GB 1275 0.62 0.76 0.56 198 TR_XM_Spammywords 1273 0.45 0.76 0.32 199 XM_S_SpammyWords 1273 0.45 0.76 0.32 200 HELO_DYNAMIC_SPLIT_IP 1249 0.22 0.74 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 407930 99.66 99.86 99.58 2 HTML_MESSAGE 366120 91.77 97.58 89.38 3 RELAYCOUNTRY_US 315797 77.35 77.98 77.09 4 XM_B_Unicode 279258 71.76 80.49 68.17 5 DCC_CHECK_NEGATIVE 274890 54.86 25.06 67.10 6 DKIM_SIGNED 260378 70.01 85.72 63.56 7 XM_DK_Pass 255483 67.60 80.33 62.37 8 DKIM_VALID 252250 66.81 79.55 61.58 9 BAYES_50 237764 53.95 44.00 58.04 10 DKIM_VALID_AU 212350 55.21 63.42 51.84 11 XM_B_SpammyWords 175901 51.08 70.91 42.94 12 XM_B_Unicode3 174445 44.29 48.46 42.58 13 XMListUnsubscribeExists 168960 47.46 62.59 41.25 14 DCC_CHECK 134447 45.07 74.89 32.82 15 MIME_HTML_ONLY 109804 28.84 33.80 26.80 16 LOC_TINY_FONT_1 106943 31.81 45.70 26.11 17 T_TM2_M_HEADER_IN_MSG 103384 23.63 19.72 25.24 18 DKIM_VALID_EF 102055 26.08 28.91 24.91 19 HTML_FONT_LOW_CONTRAST 100311 28.29 37.55 24.49 20 XMSubLong 90942 23.40 26.31 22.20 21 FVGT_m_MULTI_ODD 88965 25.50 34.72 21.72 22 ALL_TRUSTED 83590 16.72 7.75 20.41 23 RCVD_IN_MSPIKE_WL 75837 16.72 12.35 18.51 24 XM_B_SpammyWords2 73630 23.74 37.77 17.97 25 T_KAM_HTML_FONT_INVALID 73421 20.62 27.18 17.92 26 HTML_IMAGE_RATIO_04 53969 10.94 5.51 13.17 27 RCVD_IN_MSPIKE_H2 53858 15.09 19.82 13.15 28 USER_IN_DEF_DKIM_WL 49381 9.21 2.27 12.05 29 BOTNET_IPINHOSTNAME 48503 11.59 10.99 11.84 30 XM_Multi_Part_URI 48320 14.78 22.06 11.80 31 BAYES_00 47216 8.43 0.90 11.53 32 BAYES_60 47112 10.29 7.33 11.50 33 TR_XM_DK_Unsub 46330 13.87 20.11 11.31 34 HTML_FONT_FACE_BAD 42702 7.81 1.45 10.42 35 UNPARSEABLE_RELAY 38941 12.16 18.61 9.51 36 HTML_MIME_NO_HTML_TAG 38822 8.98 7.77 9.48 37 XM_Evil_Numbers_Gen 38435 9.46 9.66 9.38 38 XMStrtUSub 36239 7.46 4.09 8.85 39 SUBJ_ALL_CAPS 35283 8.52 8.30 8.61 40 LotsOfNums_01 34808 8.05 6.96 8.50 41 XM_B_PhoneNumber 34724 7.78 6.09 8.48 42 MPART_ALT_DIFF 32784 7.64 6.74 8.00 43 RCVD_IN_MSPIKE_H3 32473 7.27 5.67 7.93 44 XM_B_Unsub 30886 10.93 19.20 7.54 45 RCVD_IN_MSPIKE_H5 26451 5.53 3.28 6.46 46 MIME_HTML_ONLY_MULTI 25105 5.41 3.66 6.13 47 TooManyTo_001 25047 5.31 3.35 6.11 48 TR_XM_BayesUnsub 24283 9.53 18.31 5.93 49 T_TooManySym_01 23480 4.71 2.21 5.73 50 XM_DKIMWhitelistDomains 23390 4.06 0.05 5.71 51 TR_MAX_INTL_RELAY 22982 8.14 14.29 5.61 52 ANY_BOUNCE_MESSAGE 22291 4.21 1.22 5.44 53 BOUNCE_MESSAGE 22290 4.21 1.22 5.44 54 LOTS_OF_MONEY 22211 7.60 12.91 5.42 55 XM_B_Phish_Phrases 21813 6.30 8.68 5.32 56 XM_B_SpammyWords3 21139 7.50 13.21 5.16 57 FSL_BULK_SIG 21016 8.25 15.85 5.13 58 HTML_IMAGE_RATIO_06 20434 4.54 3.43 4.99 59 BAYES_40 20352 4.09 1.94 4.97 60 TR_XM_DK_Bayes 20160 3.70 0.74 4.92 61 TR_XM_DK_Bayes1 19883 3.65 0.73 4.85 62 XM_H_Long_From01 19645 4.88 5.08 4.80 63 MIME_QP_LONG_LINE 18765 4.07 2.81 4.58 64 XM_DK_Undo_02 17983 14.32 38.49 4.39 65 TR_XM_DK_Bayes2 17255 3.14 0.53 4.21 66 XM_H_GMP 17032 4.36 4.85 4.16 67 RCVD_IN_MSPIKE_H4 16913 3.92 3.41 4.13 68 HTML_IMAGE_RATIO_02 15789 4.44 5.87 3.85 69 TR_XM_SpammyWords4 15248 5.95 11.36 3.72 70 RCVD_IN_VALIDITY_SAFE 14820 3.12 1.91 3.62 71 BAYES_80 14375 5.02 8.69 3.51 72 BAYES_20 14177 2.81 1.21 3.46 73 XM_PDF 13967 2.68 0.90 3.41 74 TM2_M_VERY_LONG_WORD 12990 3.31 3.65 3.17 75 MAILING_LIST_MULTI 12923 2.75 1.76 3.15 76 XMSubNoVowel 12868 2.70 1.61 3.14 77 RCVD_IN_VALIDITY_CERTIFIED 12753 2.60 1.33 3.11 78 XM_UncommonTLD01 12512 3.78 5.56 3.05 79 T_REMOTE_IMAGE 12127 2.59 1.68 2.96 80 XMNumbers 12011 3.02 3.22 2.93 81 BAYES_99 12002 10.93 30.40 2.93 82 T_TooManySym_02 11945 2.23 0.56 2.92 83 RELAYCOUNTRY_META 11868 6.54 15.42 2.90 84 TM2_M_URI_OPT_OUT 10729 4.34 8.53 2.62 85 XMSubMetaSx_00 10452 3.53 5.91 2.55 86 RCVD_IN_IADB_LISTED 10058 2.20 1.56 2.46 87 XM_B_SpammyTLD 10040 2.95 4.17 2.45 88 HTML_IMAGE_RATIO_08 9758 2.40 2.43 2.38 89 MIME_HTML_MOSTLY 8963 2.52 3.34 2.19 90 RCVD_IN_IADB_SPF 8957 1.93 1.32 2.19 91 BAYES_95 8602 2.91 4.89 2.10 92 BAYES_999 8520 8.35 23.61 2.08 93 XM_CamelCaseFrm001 8363 2.35 3.11 2.04 94 TR_XM_SpammyWords5 8361 4.32 9.86 2.04 95 XM_Body_Dirty_Words 8273 2.93 5.14 2.02 96 RCVD_IN_IADB_SENDERID 8162 1.76 1.19 1.99 97 DKIM_INVALID 8128 3.20 6.17 1.98 98 BAYES_05 8039 1.58 0.65 1.96 99 TO_MALFORMED 7938 1.38 0.01 1.94 100 RCVD_IN_IADB_DK 7830 1.71 1.21 1.91 101 TooManyTo_002 7446 1.44 0.51 1.82 102 FROM_EXCESS_BASE64 7295 1.68 1.43 1.78 103 KHOP_HELO_FCRDNS 7084 1.55 1.11 1.73 104 XM_B_URI_Unicode 7060 1.98 2.62 1.72 105 INVALID_MSGID 6909 1.29 0.31 1.69 106 XM_DK_Undo_01 6862 1.64 1.56 1.68 107 TR_XM_DKIM_Undo 6790 9.05 27.06 1.66 108 TR_XM_SpammyRelay 6585 4.40 11.20 1.61 109 T_XMDrugObfuBody_14 6528 2.49 4.67 1.59 110 XMSubLongNoVowel 6290 1.42 1.13 1.54 111 RCVD_IN_IADB_VOUCHED 6238 1.34 0.91 1.52 112 XMSubGarbage 6191 1.28 0.73 1.51 113 MAY_BE_FORGED 6088 1.10 0.17 1.49 114 TR_XM_UnparsRelay 6069 4.13 10.57 1.48 115 XM_B_Unsub2 5811 2.05 3.60 1.42 116 TR_Symld_Words 5743 1.28 0.98 1.40 117 TR_XM_PhishingBody 5545 2.55 5.46 1.35 118 UNTRUSTED_Relay 5258 2.89 6.81 1.28 119 XM_B_Investor 5250 2.04 3.89 1.28 120 T_XMDrugObfuBody_08 5226 1.66 2.61 1.28 121 HELO_NODOT 5217 1.03 0.44 1.27 122 HELO_NO_DOMAIN 5206 1.03 0.43 1.27 123 T_TooManySym_03 5196 0.95 0.17 1.27 124 BOTNET 5114 3.56 9.20 1.25 125 BASE64_LENGTH_79_INF 5066 2.84 6.74 1.24 126 TooManyTo_003 4887 0.97 0.42 1.19 127 XM_SendGrid 4865 1.22 1.31 1.19 128 XMDiploma_00 4761 1.62 2.74 1.16 129 TR_MetaPhish_Combo_01 4591 1.05 0.87 1.12 130 XM_GoogleGroups 4543 0.99 0.71 1.11 131 XMGappySubj_01 4374 0.82 0.22 1.07 132 RCVD_IN_IADB_OPTIN 4338 0.94 0.65 1.06 133 XMNoVowels 4197 0.88 0.53 1.02 134 IN_HORDE_ADDRESS_BOOK 4160 0.74 0.07 1.02 135 XMStockSpam_06 4008 1.34 2.24 0.98 136 URI_HEX 3993 1.04 1.21 0.97 137 XM_SPF_SoftFail 3932 1.39 2.45 0.96 138 URI_NOVOWEL 3926 1.10 1.44 0.96 139 XMBrknScrpt_02 3859 1.17 1.74 0.94 140 TR_DCC_Bayes_99 3842 6.71 20.75 0.94 141 FROM_GOV_DKIM_AU 3809 0.78 0.43 0.93 142 TooManyTo_004 3720 0.75 0.37 0.91 143 XM_UB50 3625 1.38 2.60 0.88 144 XMCapTrack 3552 0.76 0.51 0.87 145 TR_XM_DK_SendGrid 3521 0.87 0.89 0.86 146 RCVD_IN_MSPIKE_BL 3486 2.69 7.17 0.85 147 TR_XM_MSPIKECOMBO 3481 2.68 7.14 0.85 148 TVD_RCVD_IP 3453 0.85 0.85 0.84 149 XM_B_SpammyWords4 3385 1.29 2.43 0.83 150 XMLngstWrd_00 3298 0.71 0.47 0.81 151 T_XMDrugObfuBody_00 3234 1.05 1.68 0.79 152 XM_ShortIntro_01 3233 0.70 0.49 0.79 153 T_FILL_THIS_FORM_SHORT 3101 1.40 2.98 0.76 154 XM_OfRef6 3080 1.49 3.28 0.75 155 TooManyTo_005 3053 0.62 0.33 0.75 156 MIME_CHARSET_FARAWAY 3043 0.60 0.24 0.74 157 TR_XM_Base64_M1 2998 0.75 0.80 0.73 158 XMSexyCombo_05 2970 1.62 3.81 0.73 159 TVD_SPACE_RATIO 2954 0.55 0.14 0.72 160 RCVD_IN_MSPIKE_L3 2906 1.78 4.40 0.71 161 T_XMHurry_00 2903 1.14 2.20 0.71 162 XM_H_Long_From02 2890 0.93 1.46 0.71 163 XM_E_Blogspot 2763 0.59 0.39 0.67 164 CHARSET_FARAWAY_HEADER 2660 0.49 0.12 0.65 165 XMBdyGiftCard01 2628 0.74 0.97 0.64 166 XMGenDplmaNmb 2592 0.93 1.66 0.63 167 DKIM_ADSP_CUSTOM_MED 2547 0.68 0.82 0.62 168 HTTPS_HTTP_MISMATCH 2519 0.79 1.21 0.61 169 XM_H_PHPMailer 2513 0.55 0.38 0.61 170 NORDNS_LOW_CONTRAST 2488 0.70 0.92 0.61 171 T_Symld_Words_02 2442 0.72 1.02 0.60 172 XM_B_COPY_HTML 2364 0.78 1.27 0.58 173 SpammyFromTLD_01 2308 0.90 1.72 0.56 174 RELAYCOUNTRY_GB 2298 0.62 0.76 0.56 175 RCVD_IN_BL_SPAMCOP_NET 2275 3.36 10.21 0.56 176 URI_TRY_3LD 2221 0.80 1.44 0.54 177 RELAYCOUNTRY_AU 2213 1.15 2.63 0.54 178 XMBSHREFv2 2213 0.48 0.34 0.54 179 T_TooManySym_04 2131 0.38 0.02 0.52 180 T_OBFU_PDF_ATTACH 2080 0.44 0.28 0.51 181 TO_NO_BRKTS_HTML_ONLY 2078 0.42 0.19 0.51 182 XM_B_DNDMA 2045 0.74 1.33 0.50 183 RELAYCOUNTRY_CA 2028 1.84 5.13 0.50 184 PLING_QUERY 1952 0.62 0.96 0.48 185 XMSlimDrugH 1949 0.53 0.65 0.48 186 XMGappySubj_02 1925 0.35 0.05 0.47 187 MPART_ALT_DIFF_COUNT 1893 0.84 1.77 0.46 188 HTML_IMAGE_ONLY_20 1812 0.78 1.59 0.44 189 XMSolicitRefs_0 1798 0.45 0.46 0.44 190 XMSubMetaSxObfu_03 1749 0.50 0.67 0.43 191 TR_XM_SpammyWords3 1745 1.70 4.80 0.43 192 XMBody_17 1713 1.06 2.62 0.42 193 XMPhish30 1713 1.03 2.50 0.42 194 SpammyFromTLD_02 1586 0.82 1.87 0.39 195 XM_B_Phish66 1580 0.63 1.22 0.39 196 XMLngstWrd_01 1567 0.39 0.42 0.38 197 SHORT_HELO_AND_INLINE_IMAGE 1561 0.30 0.10 0.38 198 TR_LOTS_OF_MONEY3 1545 0.74 1.63 0.38 199 XMSubMetaI_00 1541 0.60 1.15 0.38 200 FORGED_GMAIL_RCVD 1509 0.44 0.60 0.37 ----------------------------------------------------------------------