Email: 288326 Autolearn: 0 AvgScore: 3.39 AvgScanTime: 1.25 sec Spam: 93648 Autolearn: 0 AvgScore: 14.26 AvgScanTime: 1.42 sec Ham: 194678 Autolearn: 0 AvgScore: -1.83 AvgScanTime: 1.17 sec Time Spent Running SA: 100.37 hours Time Spent Processing Spam: 37.05 hours Time Spent Processing Ham: 63.32 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88318 86.33 94.31 82.49 2 DKIM_SIGNED 81710 73.59 87.25 67.02 3 XM_DK_Pass 79842 71.29 85.26 64.56 4 DKIM_VALID 79382 70.86 84.77 64.16 5 RELAYCOUNTRY_US 75498 74.83 80.62 72.05 6 XM_B_Unicode 74837 68.72 79.91 63.33 7 DCC_CHECK 68639 45.78 73.29 32.54 8 XMListUnsubscribeExists 65795 53.36 70.26 45.24 9 DKIM_VALID_AU 63677 58.41 68.00 53.79 10 XM_B_SpammyWords 60702 46.34 64.82 37.45 11 RCVD_IN_MSPIKE_H2 44299 37.28 47.30 32.45 12 XM_DK_Undo_02 41432 19.08 44.24 6.98 13 XM_B_Unicode3 40724 41.88 43.49 41.11 14 BAYES_50 35866 45.78 38.30 49.38 15 BAYES_99 35145 21.49 37.53 13.78 16 LOC_TINY_FONT_1 33927 27.33 36.23 23.05 17 XM_B_SpammyWords2 33910 23.20 36.21 16.95 18 TR_XM_DKIM_Undo 33346 14.83 35.61 4.84 19 HTML_FONT_LOW_CONTRAST 32492 34.50 34.70 34.40 20 MIME_HTML_ONLY 32481 24.27 34.68 19.25 21 FVGT_m_MULTI_ODD 32122 27.74 34.30 24.59 22 BAYES_999 28085 16.12 29.99 9.45 23 DKIM_VALID_EF 27538 27.27 29.41 26.24 24 T_KAM_HTML_FONT_INVALID 25428 19.93 27.15 16.46 25 DCC_CHECK_NEGATIVE 24991 54.20 26.69 67.43 26 TR_DCC_Bayes_99 24746 10.19 26.42 2.38 27 XM_Body_Dirty_Words 22102 16.23 23.60 12.69 28 RELAYCOUNTRY_META 22036 10.03 23.53 3.53 29 T_TM2_M_HEADER_IN_MSG 18402 20.09 19.65 20.30 30 XMSubLong 17945 21.44 19.16 22.53 31 UNPARSEABLE_RELAY 15932 10.97 17.01 8.06 32 TR_XM_UnparsRelay 15562 9.75 16.62 6.45 33 XM_Multi_Part_URI 14793 13.61 15.80 12.56 34 RCVD_IN_MSPIKE_WL 14205 15.04 15.17 14.98 35 XM_B_Unsub 13005 10.30 13.89 8.57 36 RCVD_IN_MSPIKE_H3 12646 11.46 13.50 10.48 37 TR_XM_BayesUnsub 12619 9.12 13.47 7.02 38 TR_XM_SpammyRelay 12543 5.18 13.39 1.23 39 TR_XM_SpammyWords2 11933 5.15 12.74 1.50 40 BOTNET 11719 4.91 12.51 1.25 41 BOTNET_IPINHOSTNAME 11608 8.23 12.40 6.23 42 MPART_ALT_DIFF 11122 6.93 11.88 4.56 43 LOTS_OF_MONEY 11038 7.56 11.79 5.53 44 XM_B_SpammyWords3 10990 7.00 11.74 4.72 45 RCVD_IN_BL_SPAMCOP_NET 10759 4.18 11.49 0.67 46 FSL_BULK_SIG 10738 5.85 11.47 3.16 47 XMSexyCombo_05 10353 6.10 11.06 3.72 48 RELAYCOUNTRY_CA 9093 4.05 9.71 1.33 49 TR_XM_SpammyWords4 8683 5.52 9.27 3.71 50 XM_UncommonTLD01 8651 6.09 9.24 4.58 51 TM2_M_VERY_LONG_WORD 8146 3.78 8.70 1.41 52 BAYES_80 8006 6.23 8.55 5.12 53 MIME_HTML_ONLY_MULTI 7662 4.62 8.18 2.91 54 UNTRUSTED_Relay 7615 3.54 8.13 1.33 55 HTML_IMAGE_RATIO_02 7067 6.93 7.55 6.63 56 XM_H_Long_From01 7034 5.33 7.51 4.28 57 TR_XM_SPAMCOP 7032 2.62 7.51 0.27 58 BAYES_60 6986 9.88 7.46 11.04 59 XM_SendGrid 6610 5.69 7.06 5.03 60 XM_Evil_Numbers_Gen 6583 7.34 7.03 7.49 61 HTML_MIME_NO_HTML_TAG 6250 3.33 6.67 1.72 62 XMLngstWrd_00 6083 2.64 6.50 0.79 63 XMLngstWrd_01 6008 2.53 6.42 0.65 64 XMLngstWrd_02 5938 2.39 6.34 0.49 65 LotsOfNums_01 5778 6.85 6.17 7.17 66 XM_GoogleGroups 5661 2.77 6.04 1.19 67 TR_XM_PhishingBody 5541 3.69 5.92 2.63 68 XMLngstWrd_03 5506 2.17 5.88 0.38 69 XMLngstWrd_04 5450 2.09 5.82 0.30 70 HTML_TITLE_SUBJ_DIFF 5343 1.88 5.71 0.04 71 UPPERCASE_75_100 5313 1.85 5.67 0.01 72 XMStrtUSub 5134 5.80 5.48 5.95 73 XM_DIRTYINTL 5131 1.94 5.48 0.24 74 BAYES_95 4835 4.17 5.16 3.69 75 XMSubMetaSx_00 4700 3.75 5.02 3.14 76 RCVD_IN_VALIDITY_SAFE 4680 5.89 5.00 6.33 77 XM_CamelCaseFrm001 4603 2.68 4.92 1.61 78 TooManyTo_001 4479 5.97 4.78 6.53 79 T_REMOTE_IMAGE 4360 3.72 4.66 3.27 80 MIME_HTML_MOSTLY 4338 3.16 4.63 2.45 81 XM_B_Investor 4248 2.20 4.54 1.07 82 TR_XM_DK_SendGrid 4228 3.72 4.51 3.33 83 RCVD_IN_VALIDITY_RPBL 4221 1.48 4.51 0.03 84 T_XMDrugObfuBody_14 4161 2.63 4.44 1.75 85 XM_SPF_SoftFail 3955 2.75 4.22 2.04 86 RCVD_IN_VALIDITY_CERTIFIED 3872 5.18 4.13 5.68 87 HTML_IMAGE_RATIO_04 3782 5.30 4.04 5.90 88 XM_B_Phish_Phrases 3696 3.88 3.95 3.85 89 TR_XM_SpammyWords5 3652 2.16 3.90 1.32 90 RCVD_IN_MSPIKE_BL 3633 1.63 3.88 0.55 91 T_FILL_THIS_FORM_SHORT 3611 1.57 3.86 0.47 92 XM_B_SpammyTLD 3606 2.67 3.85 2.10 93 BOTNET_NORDNS 3544 1.23 3.78 0.01 94 XM_OfRef6 3522 1.89 3.76 0.99 95 TR_XM_MSPIKECOMBO 3420 1.56 3.65 0.55 96 XM_UB50 3355 1.73 3.58 0.83 97 HTML_IMAGE_RATIO_06 3295 3.59 3.52 3.62 98 SpammyFromTLD_01 3251 1.39 3.47 0.38 99 XMNumbers 2948 5.24 3.15 6.25 100 XMDiploma_00 2841 1.90 3.03 1.35 101 USER_IN_DEF_DKIM_WL 2813 11.43 3.00 15.48 102 SUBJ_ALL_CAPS 2656 1.56 2.84 0.95 103 XM_B_Phish66 2625 1.64 2.80 1.08 104 T_TooManySym_01 2483 7.24 2.65 9.45 105 T_XMDrugObfuBody_08 2411 1.74 2.57 1.33 106 HTML_IMAGE_RATIO_08 2367 2.18 2.53 2.02 107 XMBody_17 2347 1.16 2.51 0.51 108 DKIM_INVALID 2328 2.73 2.49 2.85 109 RCVD_IN_PSBL 2304 0.91 2.46 0.16 110 XM_B_DynamicLink 2282 0.82 2.44 0.04 111 XM_DK_Undo_01 2206 1.48 2.36 1.06 112 TM2_M_URI_OPT_OUT 2196 2.21 2.34 2.15 113 XM_B_Unsub2 2162 1.30 2.31 0.81 114 SpammyFromTLD_02 2138 0.87 2.28 0.19 115 TR_LOTS_OF_MONEY3 2054 0.87 2.19 0.23 116 TR_XM_FormFill 1986 0.69 2.12 0.01 117 XM_UB99 1977 0.69 2.11 0.00 118 KHOP_HELO_FCRDNS 1960 1.75 2.09 1.58 119 MPART_ALT_DIFF_COUNT 1953 1.16 2.09 0.72 120 PDS_OTHER_BAD_TLD 1899 0.98 2.03 0.48 121 URIBL_DBL_SPAM 1827 0.64 1.95 0.01 122 XMStockSpam_06 1800 1.67 1.92 1.54 123 HK_RANDOM_REPLYTO 1784 0.71 1.91 0.13 124 XMBdyGiftCard01 1777 1.45 1.90 1.23 125 XMReplyNow 1772 0.77 1.89 0.23 126 XM_H_Undi_Recip 1750 0.73 1.87 0.18 127 HTML_TAG_BALANCE_BODY 1742 0.95 1.86 0.52 128 URI_NOVOWEL 1727 1.60 1.84 1.48 129 TR_XM_PHPForged 1713 0.76 1.83 0.25 130 TR_XM_PHPDW 1710 0.82 1.83 0.33 131 MIME_QP_LONG_LINE 1708 2.67 1.82 3.07 132 FROM_EXCESS_BASE64 1666 2.67 1.78 3.09 133 RCVD_IN_MSPIKE_L5 1664 0.58 1.78 0.00 134 TR_XM_FormFill2 1644 0.74 1.76 0.25 135 XM_H_PHPOS 1632 0.72 1.74 0.23 136 TR_XM_BayesRelay 1596 0.56 1.70 0.00 137 HTML_FONT_TINY_NORDNS 1585 0.60 1.69 0.07 138 XMBrknScrpt_02 1579 1.11 1.69 0.84 139 XM_B_SpammyWords4 1574 0.99 1.68 0.65 140 XMGenDplmaNmb 1573 1.02 1.68 0.70 141 XM_UB999 1561 0.54 1.67 0.00 142 TR_XM_SpammyWords3 1524 0.67 1.63 0.21 143 RCVD_IN_MSPIKE_H4 1499 3.42 1.60 4.29 144 HTML_IMAGE_ONLY_20 1485 1.18 1.59 0.98 145 TM2_M_A_HREF_HREF 1463 0.60 1.56 0.13 146 ALL_TRUSTED 1463 17.60 1.56 25.31 147 XMSexyCombo_01 1459 0.80 1.56 0.43 148 XM_URI_RBL 1372 0.55 1.47 0.10 149 HTML_SHORT_LINK_IMG_3 1372 0.50 1.47 0.04 150 RCVD_IN_IADB_LISTED 1366 2.50 1.46 2.99 151 TR_XM_MSPIKECOMBO2 1357 0.53 1.45 0.10 152 TR_XM_NoHeaderRelay 1294 0.51 1.38 0.10 153 BAYES_40 1254 3.26 1.34 4.19 154 RELAYCOUNTRY_RU 1249 0.45 1.33 0.03 155 URI_HEX 1238 1.14 1.32 1.05 156 RCVD_IN_IADB_SPF 1221 2.25 1.30 2.70 157 XM_ProductURIs 1200 0.93 1.28 0.76 158 MIME_BASE64_TEXT 1176 0.50 1.26 0.14 159 RCVD_IN_MSPIKE_L3 1157 0.57 1.24 0.25 160 T_XMHurry_00 1156 0.71 1.23 0.46 161 RELAYCOUNTRY_AU 1153 0.54 1.23 0.21 162 MONEY_NOHTML 1134 0.43 1.21 0.06 163 RCVD_IN_IADB_SENDERID 1124 2.06 1.20 2.48 164 RELAYCOUNTRY_CN 1116 0.41 1.19 0.04 165 RCVD_IN_IADB_DK 1115 2.01 1.19 2.40 166 LOADSA_MONEY_COMBO 1072 0.38 1.14 0.02 167 TR_XM_SB_Phish 1066 1.39 1.14 1.52 168 XM_Lotto 1045 0.45 1.12 0.13 169 RELAYCOUNTRY_IN 1037 0.38 1.11 0.03 170 DIET_1 1030 0.57 1.10 0.32 171 MAILING_LIST_MULTI 1019 1.59 1.09 1.84 172 XMHTML_After_End 1017 0.74 1.09 0.57 173 SHOPIFY_IMG_NOT_RCVD_SFY 1005 0.48 1.07 0.20 174 XMHTMLBadTable_001 1005 0.82 1.07 0.70 175 T_XMDrugObfuBody_00 1001 0.59 1.07 0.36 176 HTTPS_HTTP_MISMATCH 996 0.79 1.06 0.66 177 XM_Body_Dirty_Words_01 995 0.44 1.06 0.14 178 XMSubNoVowel 987 1.72 1.05 2.04 179 THIS_AD 977 0.52 1.04 0.27 180 FONT_INVIS_LONG_LINE 966 0.38 1.03 0.06 181 RCVD_IN_RP_SAFE 949 1.15 1.01 1.22 182 XM_H_Long_From02 945 1.05 1.01 1.06 183 RELAYCOUNTRY_GB 933 0.58 1.00 0.38 184 URI_TRY_3LD 925 0.59 0.99 0.40 185 PLING_QUERY 919 0.51 0.98 0.28 186 TR_Caps_n_Bayes_99 918 0.36 0.98 0.06 187 XMPhish08 916 0.43 0.98 0.17 188 XMSubPhish11 912 1.33 0.97 1.50 189 XFER_LOTSA_MONEY 908 0.32 0.97 0.01 190 HK_SCAM 904 0.31 0.97 0.00 191 TR_Symld_Words 897 1.46 0.96 1.70 192 TVD_RCVD_SPACE_BRACKET 888 0.31 0.95 0.00 193 XM_TLDProd2 887 0.44 0.95 0.20 194 XMPhish30 886 1.01 0.95 1.04 195 XMSubMetaI_00 883 0.57 0.94 0.39 196 TR_Mismatch_TLD_01 881 0.47 0.94 0.24 197 XMClaimOffer 858 0.36 0.92 0.09 198 FROM_SUSPICIOUS_NTLD 840 0.34 0.90 0.07 199 TR_Mismatch_TLD_02 825 0.34 0.88 0.08 200 DKIM_ADSP_CUSTOM_MED 816 0.89 0.87 0.90 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160590 86.33 94.31 82.49 2 RELAYCOUNTRY_US 140264 74.83 80.62 72.05 3 DCC_CHECK_NEGATIVE 131273 54.20 26.69 67.43 4 DKIM_SIGNED 130464 73.59 87.25 67.02 5 XM_DK_Pass 125692 71.29 85.26 64.56 6 DKIM_VALID 124913 70.86 84.77 64.16 7 XM_B_Unicode 123295 68.72 79.91 63.33 8 DKIM_VALID_AU 104725 58.41 68.00 53.79 9 BAYES_50 96135 45.78 38.30 49.38 10 XMListUnsubscribeExists 88066 53.36 70.26 45.24 11 XM_B_Unicode3 80035 41.88 43.49 41.11 12 XM_B_SpammyWords 72909 46.34 64.82 37.45 13 HTML_FONT_LOW_CONTRAST 66967 34.50 34.70 34.40 14 DCC_CHECK 63350 45.78 73.29 32.54 15 RCVD_IN_MSPIKE_H2 63181 37.28 47.30 32.45 16 DKIM_VALID_EF 51086 27.27 29.41 26.24 17 ALL_TRUSTED 49269 17.60 1.56 25.31 18 FVGT_m_MULTI_ODD 47863 27.74 34.30 24.59 19 LOC_TINY_FONT_1 44881 27.33 36.23 23.05 20 XMSubLong 43858 21.44 19.16 22.53 21 T_TM2_M_HEADER_IN_MSG 39521 20.09 19.65 20.30 22 MIME_HTML_ONLY 37484 24.27 34.68 19.25 23 XM_B_SpammyWords2 32993 23.20 36.21 16.95 24 T_KAM_HTML_FONT_INVALID 32041 19.93 27.15 16.46 25 USER_IN_DEF_DKIM_WL 30134 11.43 3.00 15.48 26 RCVD_IN_MSPIKE_WL 29172 15.04 15.17 14.98 27 BAYES_99 26819 21.49 37.53 13.78 28 XM_Body_Dirty_Words 24697 16.23 23.60 12.69 29 XM_Multi_Part_URI 24452 13.61 15.80 12.56 30 XM_DKIMWhitelistDomains 22598 7.86 0.06 11.61 31 BAYES_60 21502 9.88 7.46 11.04 32 RCVD_IN_MSPIKE_H3 20406 11.46 13.50 10.48 33 BAYES_999 18405 16.12 29.99 9.45 34 T_TooManySym_01 18389 7.24 2.65 9.45 35 XM_B_Unsub 16684 10.30 13.89 8.57 36 UNPARSEABLE_RELAY 15697 10.97 17.01 8.06 37 NUMERIC_HTTP_ADDR 15675 5.53 0.28 8.05 38 NORMAL_HTTP_TO_IP 15347 5.38 0.18 7.88 39 BAYES_00 15273 5.46 0.50 7.85 40 XM_Evil_Numbers_Gen 14591 7.34 7.03 7.49 41 LotsOfNums_01 13966 6.85 6.17 7.17 42 TR_XM_BayesUnsub 13665 9.12 13.47 7.02 43 XM_DK_Undo_02 13584 19.08 44.24 6.98 44 HTML_IMAGE_RATIO_02 12915 6.93 7.55 6.63 45 TooManyTo_001 12721 5.97 4.78 6.53 46 TR_XM_UnparsRelay 12559 9.75 16.62 6.45 47 RCVD_IN_VALIDITY_SAFE 12316 5.89 5.00 6.33 48 XMNumbers 12166 5.24 3.15 6.25 49 BOTNET_IPINHOSTNAME 12126 8.23 12.40 6.23 50 T_TooManySym_02 12052 4.37 0.59 6.19 51 XMStrtUSub 11579 5.80 5.48 5.95 52 HTML_IMAGE_RATIO_04 11487 5.30 4.04 5.90 53 RCVD_IN_VALIDITY_CERTIFIED 11065 5.18 4.13 5.68 54 LOTS_OF_MONEY 10767 7.56 11.79 5.53 55 IN_ZIMBRA_NJ_WHITELIST 10059 3.52 0.10 5.17 56 BAYES_80 9966 6.23 8.55 5.12 57 XM_SendGrid 9787 5.69 7.06 5.03 58 TR_XM_DK_Bayes 9773 3.53 0.43 5.02 59 TR_XM_DK_Bayes1 9659 3.49 0.43 4.96 60 TR_XM_DKIM_Undo 9421 14.83 35.61 4.84 61 XM_B_SpammyWords3 9187 7.00 11.74 4.72 62 XM_UncommonTLD01 8913 6.09 9.24 4.58 63 MPART_ALT_DIFF 8871 6.93 11.88 4.56 64 TR_XM_DK_Bayes2 8736 3.11 0.24 4.49 65 RCVD_IN_MSPIKE_H4 8348 3.42 1.60 4.29 66 XM_H_Long_From01 8332 5.33 7.51 4.28 67 BAYES_40 8153 3.26 1.34 4.19 68 URIBL_CSS_A 7824 2.83 0.36 4.02 69 URIBL_CSS 7824 2.83 0.36 4.02 70 XM_H_Trusted_IP 7773 2.70 0.00 3.99 71 XM_B_Phish_Phrases 7502 3.88 3.95 3.85 72 ANY_BOUNCE_MESSAGE 7459 2.80 0.66 3.83 73 BOUNCE_MESSAGE 7459 2.80 0.66 3.83 74 XMSexyCombo_05 7248 6.10 11.06 3.72 75 TR_XM_SpammyWords4 7224 5.52 9.27 3.71 76 BAYES_95 7175 4.17 5.16 3.69 77 HTML_IMAGE_RATIO_06 7057 3.59 3.52 3.62 78 INVALID_MSGID 7041 2.51 0.21 3.62 79 TVD_RCVD_IP 6922 2.51 0.33 3.56 80 RELAYCOUNTRY_META 6877 10.03 23.53 3.53 81 TR_XM_DK_SendGrid 6484 3.72 4.51 3.33 82 T_REMOTE_IMAGE 6362 3.72 4.66 3.27 83 FSL_BULK_SIG 6143 5.85 11.47 3.16 84 XMSubMetaSx_00 6107 3.75 5.02 3.14 85 FROM_EXCESS_BASE64 6021 2.67 1.78 3.09 86 MIME_QP_LONG_LINE 5978 2.67 1.82 3.07 87 TO_MALFORMED 5916 2.05 0.01 3.04 88 RCVD_IN_IADB_LISTED 5830 2.50 1.46 2.99 89 BAYES_20 5689 2.22 0.77 2.92 90 MIME_HTML_ONLY_MULTI 5669 4.62 8.18 2.91 91 DKIM_INVALID 5551 2.73 2.49 2.85 92 RCVD_IN_IADB_SPF 5264 2.25 1.30 2.70 93 TR_XM_PhishingBody 5112 3.69 5.92 2.63 94 T_TooManySym_03 4887 1.77 0.23 2.51 95 RCVD_IN_IADB_SENDERID 4823 2.06 1.20 2.48 96 XM_PDF 4818 1.87 0.61 2.47 97 MIME_HTML_MOSTLY 4769 3.16 4.63 2.45 98 RCVD_IN_IADB_DK 4669 2.01 1.19 2.40 99 TR_DCC_Bayes_99 4629 10.19 26.42 2.38 100 XMBSHREFv2 4191 1.54 0.25 2.15 101 TM2_M_URI_OPT_OUT 4178 2.21 2.34 2.15 102 XM_B_SpammyTLD 4079 2.67 3.85 2.10 103 XMSubNoVowel 3975 1.72 1.05 2.04 104 BAYES_05 3964 1.50 0.39 2.04 105 XM_SPF_SoftFail 3963 2.75 4.22 2.04 106 HTML_IMAGE_RATIO_08 3931 2.18 2.53 2.02 107 IN_HORDE_ADDRESS_BOOK 3929 1.39 0.09 2.02 108 RCVD_IN_IADB_VOUCHED 3709 1.51 0.69 1.91 109 MAILING_LIST_MULTI 3575 1.59 1.09 1.84 110 T_XMDrugObfuBody_14 3411 2.63 4.44 1.75 111 HTML_MIME_NO_HTML_TAG 3351 3.33 6.67 1.72 112 TR_Symld_Words 3314 1.46 0.96 1.70 113 XMGappySubj_01 3221 1.15 0.09 1.65 114 XM_CamelCaseFrm001 3136 2.68 4.92 1.61 115 KHOP_HELO_FCRDNS 3083 1.75 2.09 1.58 116 TVD_SPACE_RATIO 3048 1.10 0.12 1.57 117 XM_B_SEO 3037 1.24 0.58 1.56 118 XMStockSpam_06 3003 1.67 1.92 1.54 119 TR_XM_SB_Phish 2955 1.39 1.14 1.52 120 TR_XM_SpammyWords2 2929 5.15 12.74 1.50 121 FVGT_m_MULTI_ODD_EMAIL 2917 1.04 0.10 1.50 122 XMSubPhish11 2914 1.33 0.97 1.50 123 URI_NOVOWEL 2872 1.60 1.84 1.48 124 TM2_M_VERY_LONG_WORD 2744 3.78 8.70 1.41 125 XMDiploma_00 2630 1.90 3.03 1.35 126 UNTRUSTED_Relay 2597 3.54 8.13 1.33 127 T_XMDrugObfuBody_08 2595 1.74 2.57 1.33 128 RELAYCOUNTRY_CA 2587 4.05 9.71 1.33 129 RCVD_IN_IADB_OPTIN 2583 1.03 0.43 1.33 130 TR_XM_SpammyWords5 2578 2.16 3.90 1.32 131 BOTNET 2438 4.91 12.51 1.25 132 TooManyTo_002 2411 1.08 0.75 1.24 133 XMBdyGiftCard01 2396 1.45 1.90 1.23 134 TR_XM_SpammyRelay 2385 5.18 13.39 1.23 135 RCVD_IN_RP_SAFE 2374 1.15 1.01 1.22 136 MSGID_NOFQDN1 2365 0.82 0.01 1.21 137 XM_GoogleGroups 2321 2.77 6.04 1.19 138 RCVD_IN_RP_CERTIFIED 2124 1.01 0.83 1.09 139 XM_B_Phish66 2094 1.64 2.80 1.08 140 XM_B_Investor 2091 2.20 4.54 1.07 141 XM_H_Long_From02 2073 1.05 1.01 1.06 142 XM_DK_Undo_01 2063 1.48 2.36 1.06 143 HTML_FONT_FACE_BAD 2058 0.93 0.67 1.06 144 URI_HEX 2042 1.14 1.32 1.05 145 XMPhish30 2018 1.01 0.95 1.04 146 XM_OfRef6 1937 1.89 3.76 0.99 147 XM_shorewaves_Whitelist 1927 0.67 0.00 0.99 148 TVD_SPACE_RATIO_MINFP 1911 0.73 0.20 0.98 149 HTML_IMAGE_ONLY_20 1903 1.18 1.59 0.98 150 SUBJ_ALL_CAPS 1840 1.56 2.84 0.95 151 XMBody_95 1811 0.67 0.12 0.93 152 XM_B_COPY_HTML 1801 0.91 0.87 0.93 153 TooManyTo_003 1789 0.85 0.70 0.92 154 DKIM_ADSP_CUSTOM_MED 1744 0.89 0.87 0.90 155 T_MANY_PILL_PRICE 1721 0.60 0.02 0.88 156 XMBrknScrpt_02 1631 1.11 1.69 0.84 157 XM_UB50 1622 1.73 3.58 0.83 158 XM_B_Unsub2 1583 1.30 2.31 0.81 159 XMLngstWrd_00 1536 2.64 6.50 0.79 160 TR_MetaPhish_Combo_01 1506 0.70 0.55 0.77 161 XM_ProductURIs 1487 0.93 1.28 0.76 162 TooManyTo_004 1410 0.71 0.67 0.72 163 MPART_ALT_DIFF_COUNT 1403 1.16 2.09 0.72 164 XMHTMLBadTable_001 1362 0.82 1.07 0.70 165 XMGenDplmaNmb 1355 1.02 1.68 0.70 166 RCVD_IN_BL_SPAMCOP_NET 1296 4.18 11.49 0.67 167 HTTPS_HTTP_MISMATCH 1292 0.79 1.06 0.66 168 XMLngstWrd_01 1275 2.53 6.42 0.65 169 XM_B_SpammyWords4 1273 0.99 1.68 0.65 170 XM_H_PHPMailer 1270 0.72 0.87 0.65 171 BODY_ENHANCEMENT2 1240 0.43 0.01 0.64 172 TooManyTo_005 1222 0.63 0.63 0.63 173 USER_IN_WELCOMELIST 1215 0.42 0.00 0.62 174 USER_IN_WHITELIST 1215 0.42 0.00 0.62 175 XMSlimDrugH 1129 0.65 0.81 0.58 176 XMHTML_After_End 1119 0.74 1.09 0.57 177 RDNS_DYNAMIC 1096 0.59 0.64 0.56 178 RCVD_IN_MSPIKE_BL 1070 1.63 3.88 0.55 179 XM_S_SubURI 1067 0.38 0.03 0.55 180 TR_XM_MSPIKECOMBO 1066 1.56 3.65 0.55 181 XM_B_REG_HTML 1030 0.56 0.62 0.53 182 XMSubMetaSxObfu_02 1009 0.44 0.27 0.52 183 NML_ADSP_CUSTOM_MED 1006 0.60 0.78 0.52 184 HTML_TAG_BALANCE_BODY 1006 0.95 1.86 0.52 185 FORGED_GMAIL_RCVD 1002 0.59 0.75 0.51 186 XM_B_COVIDMETA 998 0.57 0.68 0.51 187 XMBody_17 991 1.16 2.51 0.51 188 XMLngstWrd_02 962 2.39 6.34 0.49 189 PDS_OTHER_BAD_TLD 928 0.98 2.03 0.48 190 T_FILL_THIS_FORM_SHORT 918 1.57 3.86 0.47 191 DATE_IN_PAST_03_06 904 0.45 0.41 0.46 192 T_TooManySym_04 896 0.37 0.18 0.46 193 T_XMHurry_00 890 0.71 1.23 0.46 194 XMSexyCombo_01 834 0.80 1.56 0.43 195 HELO_NO_DOMAIN 822 0.45 0.51 0.42 196 HELO_NODOT 822 0.46 0.53 0.42 197 XMCapTrack 802 0.35 0.22 0.41 198 URI_TRY_3LD 783 0.59 0.99 0.40 199 XMNoVowels 766 0.36 0.28 0.39 200 XMSubMetaI_00 765 0.57 0.94 0.39 ----------------------------------------------------------------------