Email: 288775 Autolearn: 0 AvgScore: 4.57 AvgScanTime: 1.10 sec Spam: 104311 Autolearn: 0 AvgScore: 14.24 AvgScanTime: 1.16 sec Ham: 184464 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 1.07 sec Time Spent Running SA: 88.12 hours Time Spent Processing Spam: 33.53 hours Time Spent Processing Ham: 54.59 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 99371 84.92 95.26 79.07 2 DKIM_SIGNED 93271 79.17 89.42 73.37 3 XM_B_Unicode 91980 74.87 88.18 67.34 4 XM_DK_Pass 90989 77.81 87.23 72.48 5 DKIM_VALID 89738 76.99 86.03 71.88 6 T_SCC_BODY_TEXT_LINE 84565 82.58 81.07 83.44 7 XMListUnsubscribeExists 80931 61.76 77.59 52.81 8 XM_B_SpammyWords 80154 54.57 76.84 41.97 9 DCC_CHECK 77844 51.15 74.63 37.88 10 RELAYCOUNTRY_US 76147 77.09 73.00 79.40 11 DKIM_VALID_AU 64721 61.93 62.05 61.87 12 XM_DK_Undo_02 53699 23.31 51.48 7.38 13 XM_B_Unicode3 47801 43.62 45.83 42.38 14 XM_B_SpammyWords2 47726 27.86 45.75 17.74 15 TR_XM_DKIM_Undo 45465 17.66 43.59 3.00 16 BAYES_99 42957 18.80 41.18 6.14 17 LOC_TINY_FONT_1 38959 31.48 37.35 28.16 18 MIME_HTML_ONLY 36313 26.23 34.81 21.38 19 HTML_FONT_LOW_CONTRAST 36209 32.47 34.71 31.20 20 BAYES_999 34325 15.03 32.91 4.92 21 BAYES_50 33699 48.84 32.31 58.19 22 DKIM_VALID_EF 33306 29.41 31.93 27.99 23 FVGT_m_MULTI_ODD 32177 27.96 30.85 26.33 24 TR_DCC_Bayes_99 31130 12.41 29.84 2.56 25 T_KAM_HTML_FONT_INVALID 29791 23.13 28.56 20.06 26 TR_XM_DK_Unsub 27500 19.03 26.36 14.89 27 RELAYCOUNTRY_META 27119 11.74 26.00 3.68 28 DCC_CHECK_NEGATIVE 26452 48.82 25.36 62.09 29 TR_XM_SpammyRelay 23607 9.39 22.63 1.91 30 T_TM2_M_HEADER_IN_MSG 22678 22.30 21.74 22.61 31 RCVD_IN_MSPIKE_H2 22538 21.70 21.61 21.75 32 XMSubLong 21153 23.26 20.28 24.95 33 RELAYCOUNTRY_CA 19845 7.84 19.02 1.52 34 RCVD_IN_BL_SPAMCOP_NET 19480 7.32 18.67 0.90 35 TR_XM_SpammyWords2 19362 7.04 18.56 0.52 36 XM_Multi_Part_URI 17784 16.14 17.05 15.62 37 TR_XM_SPAMCOP 16305 5.78 15.63 0.21 38 BOTNET_IPINHOSTNAME 15718 9.20 15.07 5.89 39 RCVD_IN_MSPIKE_H3 15514 9.45 14.87 6.39 40 RCVD_IN_MSPIKE_WL 15514 9.45 14.87 6.39 41 XM_B_SpammyWords3 13677 7.55 13.11 4.41 42 XM_Body_Dirty_Words 12548 8.54 12.03 6.56 43 XM_B_Unsub 12348 9.28 11.84 7.83 44 UNPARSEABLE_RELAY 12236 10.92 11.73 10.46 45 TR_XM_BayesUnsub 12071 8.29 11.57 6.43 46 LOTS_OF_MONEY 10634 6.77 10.19 4.84 47 BAYES_80 10168 6.39 9.75 4.49 48 BOTNET 10088 4.33 9.67 1.31 49 TR_XM_SpammyWords4 9337 5.40 8.95 3.39 50 XMBody_17 8578 3.35 8.22 0.60 51 FSL_BULK_SIG 8287 4.75 7.94 2.95 52 BAYES_60 8120 9.73 7.78 10.83 53 XM_Evil_Numbers_Gen 7631 8.15 7.32 8.63 54 HTML_IMAGE_RATIO_02 7628 6.33 7.31 5.78 55 TR_XM_BayesRelay 7404 2.57 7.10 0.00 56 TR_XM_UnparsRelay 7193 3.60 6.90 1.73 57 T_FILL_THIS_FORM_SHORT 7163 2.74 6.87 0.40 58 XM_UncommonTLD01 6987 5.35 6.70 4.59 59 HK_RANDOM_REPLYTO 6725 2.37 6.45 0.07 60 BAYES_95 6093 4.04 5.84 3.03 61 HTML_IMAGE_RATIO_04 6079 5.54 5.83 5.37 62 XMSexyCombo_05 5727 4.60 5.49 4.09 63 XMSubMetaSx_00 5448 5.30 5.22 5.34 64 TR_XM_SpammyWords5 5429 2.71 5.20 1.30 65 TooManyTo_001 5399 7.38 5.18 8.63 66 UNTRUSTED_Relay 5362 2.91 5.14 1.64 67 FONT_INVIS_LONG_LINE 5331 1.88 5.11 0.06 68 XMStrtUSub 5133 5.63 4.92 6.02 69 HTML_IMAGE_RATIO_08 5062 3.21 4.85 2.27 70 LotsOfNums_01 5017 6.57 4.81 7.57 71 MPART_ALT_DIFF 4814 4.28 4.62 4.08 72 TR_XM_FormFill 4769 1.66 4.57 0.01 73 XM_B_Phish_Phrases 4725 4.12 4.53 3.89 74 XMNumbers 4457 3.39 4.27 2.90 75 XM_H_Long_From01 4364 4.55 4.18 4.75 76 XM_OfRef6 4204 2.13 4.03 1.06 77 XM_H_GMP 4144 6.37 3.97 7.72 78 SpammyFromTLD_01 3982 1.70 3.82 0.50 79 XM_SPF_SoftFail 3973 3.00 3.81 2.55 80 MIME_HTML_MOSTLY 3916 3.29 3.75 3.02 81 T_XMDrugObfuBody_14 3860 2.65 3.70 2.06 82 RCVD_IN_VALIDITY_SAFE 3750 5.84 3.60 7.11 83 XM_B_Investor 3738 2.13 3.58 1.30 84 T_XMDrugObfuBody_08 3702 2.06 3.55 1.22 85 DKIM_INVALID 3533 2.18 3.39 1.49 86 USER_IN_DEF_DKIM_WL 3486 12.08 3.34 17.02 87 HTML_IMAGE_RATIO_06 3485 2.94 3.34 2.72 88 TR_XM_PhishingBody 3329 2.45 3.19 2.04 89 TR_Mismatch_TLD_02 3306 1.26 3.17 0.18 90 XM_B_SpammyTLD 3225 2.71 3.09 2.49 91 XM_URI_RBL 3158 1.20 3.03 0.16 92 RCVD_IN_VALIDITY_CERTIFIED 3144 5.14 3.01 6.34 93 MIME_HTML_ONLY_MULTI 3107 2.61 2.98 2.40 94 TM2_M_URI_OPT_OUT 2990 2.37 2.87 2.08 95 HTML_TAG_BALANCE_BODY 2812 1.39 2.70 0.65 96 XMDiploma_00 2794 2.01 2.68 1.63 97 XM_B_SpammyWords4 2754 1.35 2.64 0.62 98 AC_BR_BONANZA 2683 1.02 2.57 0.14 99 TM2_M_VERY_LONG_WORD 2578 1.69 2.47 1.24 100 FROM_EXCESS_BASE64 2509 2.72 2.41 2.90 101 XMBdyGiftCard01 2497 1.80 2.39 1.46 102 XM_UB50 2453 1.40 2.35 0.86 103 XM_CamelCaseFrm001 2452 2.34 2.35 2.33 104 SUBJ_ALL_CAPS 2306 1.39 2.21 0.92 105 TR_LOTS_OF_MONEY3 2291 0.99 2.20 0.31 106 XM_HighProb1 2149 0.75 2.06 0.00 107 BOTNET_NORDNS 2012 0.70 1.93 0.00 108 RELAYCOUNTRY_AU 1977 0.96 1.90 0.43 109 T_XMHurry_00 1975 1.04 1.89 0.56 110 TR_XM_PHPForged 1956 0.84 1.88 0.26 111 TR_XM_PHPDW 1947 0.85 1.87 0.27 112 T_TooManySym_01 1910 5.57 1.83 7.69 113 TM2_M_A_HREF_HREF 1889 0.92 1.81 0.42 114 TR_XM_FormFill2 1881 0.82 1.80 0.26 115 XM_H_PHPOS 1854 0.79 1.78 0.23 116 T_XMDrugObfuBody_00 1764 1.03 1.69 0.65 117 URI_TRY_3LD 1750 1.06 1.68 0.71 118 DIET_1 1746 0.80 1.67 0.31 119 XM_DIRTYINTL 1716 0.73 1.65 0.21 120 XMSexyCombo_01 1716 0.85 1.65 0.39 121 XMStockSpam_06 1715 1.62 1.64 1.61 122 ALL_TRUSTED 1687 11.54 1.62 17.14 123 XMReplyNow 1657 0.77 1.59 0.30 124 T_REMOTE_IMAGE 1645 2.33 1.58 2.75 125 XMPhish30 1623 1.20 1.56 1.00 126 TR_XM_NoHeaderRelay 1611 0.60 1.54 0.07 127 XM_B_Unsub2 1582 1.30 1.52 1.19 128 MAILING_LIST_MULTI 1570 1.95 1.51 2.21 129 HTML_MIME_NO_HTML_TAG 1540 1.28 1.48 1.17 130 URI_HEX 1502 1.06 1.44 0.84 131 MIME_QP_LONG_LINE 1482 2.58 1.42 3.23 132 RCVD_IN_VALIDITY_RPBL 1418 0.51 1.36 0.03 133 BAYES_40 1408 3.02 1.35 3.97 134 XM_SendGrid 1402 1.32 1.34 1.30 135 XM_H_Long_From02 1396 1.13 1.34 1.01 136 XM_B_COPY_HTML 1391 1.01 1.33 0.82 137 XM_H_PHPMailer 1389 1.04 1.33 0.87 138 TR_XM_InvalidRelay 1387 0.49 1.33 0.02 139 KHOP_HELO_FCRDNS 1363 0.96 1.31 0.76 140 XMSlimDrugH 1359 0.62 1.30 0.24 141 XMBrknScrpt_02 1291 0.80 1.24 0.55 142 HOSTED_IMG_MULTI_PUB_01 1279 0.45 1.23 0.01 143 SpammyFromTLD_02 1271 0.55 1.22 0.17 144 T_XMDrugObfuBody_10 1271 0.46 1.22 0.03 145 TR_XM_Base64_M1 1232 1.14 1.18 1.12 146 ANY_BOUNCE_MESSAGE 1231 4.16 1.18 5.84 147 BOUNCE_MESSAGE 1229 4.16 1.18 5.84 148 XM_DK_Undo_01 1228 1.52 1.18 1.71 149 RDNS_DYNAMIC 1197 0.65 1.15 0.37 150 TR_XM_INV_DKIM 1156 0.44 1.11 0.06 151 HTML_TEXT_INVISIBLE_STYLE 1127 0.60 1.08 0.33 152 XM_B_DNDMA 1079 0.58 1.03 0.32 153 XMSubMetaI_00 1051 0.90 1.01 0.84 154 XM_H_Undi_Recip 1040 0.47 1.00 0.18 155 TR_Caps_n_Bayes_99 1036 0.38 0.99 0.04 156 HTML_TAG_BALANCE_CENTER 1035 0.55 0.99 0.30 157 PLING_QUERY 1024 0.54 0.98 0.29 158 XM_Body_Dirty_Words_01 1023 0.44 0.98 0.13 159 RCVD_IN_PSBL 1022 0.65 0.98 0.47 160 NO_DNS_FOR_FROM 1017 0.60 0.97 0.39 161 SUBJ_DOLLARS 1009 0.64 0.97 0.46 162 TR_XM_MaxWHORU 1008 0.53 0.97 0.28 163 T_Symld_Words_02 1002 1.14 0.96 1.25 164 PDS_OTHER_BAD_TLD 996 0.42 0.95 0.12 165 XMGenDplmaNmb 992 0.93 0.95 0.91 166 HTTPS_HTTP_MISMATCH 986 0.68 0.95 0.54 167 FORGED_RELAY_MUA_TO_MX 982 0.35 0.94 0.02 168 TR_Mismatch_TLD_01 959 0.48 0.92 0.23 169 TR_XM_DK_SendGrid 951 0.92 0.91 0.93 170 XMBody_78 949 0.53 0.91 0.32 171 BAYES_20 941 2.00 0.90 2.62 172 SHOPIFY_IMG_NOT_RCVD_SFY 915 0.58 0.88 0.42 173 XM_RXBody 911 1.00 0.87 1.08 174 TR_XM_RelayPhish 888 0.33 0.85 0.04 175 XM_Combo_Sbj 870 0.43 0.83 0.21 176 T_MONEY_PERCENT 862 0.37 0.83 0.11 177 TR_LOTS_OF_MONEY2 862 0.37 0.83 0.11 178 LongTLD 853 0.38 0.82 0.13 179 DKIM_ADSP_CUSTOM_MED 831 0.81 0.80 0.81 180 XM_UB99 830 0.29 0.80 0.00 181 MPART_ALT_DIFF_COUNT 820 0.73 0.79 0.70 182 GOOG_STO_IMG_NOHTML 820 0.35 0.79 0.10 183 MIME_HEADER_CTYPE_ONLY 810 0.35 0.78 0.11 184 XM_H_PHPOS_M 809 0.33 0.78 0.08 185 XM_ProductURIs 809 0.68 0.78 0.63 186 XM_B_REG_HTML 806 0.70 0.77 0.65 187 URI_NOVOWEL 789 1.02 0.76 1.18 188 T_STY_INVIS_DIRECT 781 0.41 0.75 0.22 189 TVD_RCVD_IP 773 2.07 0.74 2.82 190 TM2_M_OBFU_COMMENT 770 0.42 0.74 0.25 191 RCVD_IN_IADB_LISTED 754 2.00 0.72 2.72 192 RCVD_IN_RP_SAFE 749 1.12 0.72 1.34 193 NML_ADSP_CUSTOM_MED 744 0.61 0.71 0.56 194 TR_XM_Undi_Recip5 742 0.26 0.71 0.00 195 XM_OfRef7 737 0.32 0.71 0.10 196 T_TooManySym_02 736 2.67 0.71 3.78 197 XM_UB60 735 0.29 0.70 0.05 198 XMBody_29 721 0.31 0.69 0.09 199 TR_XM_Undi_Recip11 705 0.27 0.68 0.03 200 HELO_DYNAMIC_SPLIT_IP 694 0.24 0.67 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 153919 82.58 81.07 83.44 2 RELAYCOUNTRY_US 146459 77.09 73.00 79.40 3 HTML_MESSAGE 145848 84.92 95.26 79.07 4 DKIM_SIGNED 135344 79.17 89.42 73.37 5 XM_DK_Pass 133701 77.81 87.23 72.48 6 DKIM_VALID 132591 76.99 86.03 71.88 7 XM_B_Unicode 124212 74.87 88.18 67.34 8 DCC_CHECK_NEGATIVE 114536 48.82 25.36 62.09 9 DKIM_VALID_AU 114129 61.93 62.05 61.87 10 BAYES_50 107337 48.84 32.31 58.19 11 XMListUnsubscribeExists 97417 61.76 77.59 52.81 12 XM_B_Unicode3 78173 43.62 45.83 42.38 13 XM_B_SpammyWords 77420 54.57 76.84 41.97 14 DCC_CHECK 69877 51.15 74.63 37.88 15 HTML_FONT_LOW_CONTRAST 57547 32.47 34.71 31.20 16 LOC_TINY_FONT_1 51954 31.48 37.35 28.16 17 DKIM_VALID_EF 51631 29.41 31.93 27.99 18 FVGT_m_MULTI_ODD 48564 27.96 30.85 26.33 19 XMSubLong 46028 23.26 20.28 24.95 20 T_TM2_M_HEADER_IN_MSG 41713 22.30 21.74 22.61 21 RCVD_IN_MSPIKE_H2 40120 21.70 21.61 21.75 22 MIME_HTML_ONLY 39437 26.23 34.81 21.38 23 T_KAM_HTML_FONT_INVALID 36998 23.13 28.56 20.06 24 XM_B_SpammyWords2 32722 27.86 45.75 17.74 25 ALL_TRUSTED 31625 11.54 1.62 17.14 26 USER_IN_DEF_DKIM_WL 31392 12.08 3.34 17.02 27 XM_Multi_Part_URI 28819 16.14 17.05 15.62 28 TR_XM_DK_Unsub 27465 19.03 26.36 14.89 29 BAYES_60 19977 9.73 7.78 10.83 30 XM_DKIMWhitelistDomains 19801 6.86 0.01 10.73 31 UNPARSEABLE_RELAY 19303 10.92 11.73 10.46 32 XM_Evil_Numbers_Gen 15913 8.15 7.32 8.63 33 TooManyTo_001 15911 7.38 5.18 8.63 34 BAYES_00 14475 5.17 0.44 7.85 35 XM_B_Unsub 14445 9.28 11.84 7.83 36 XM_H_GMP 14245 6.37 3.97 7.72 37 T_TooManySym_01 14187 5.57 1.83 7.69 38 LotsOfNums_01 13963 6.57 4.81 7.57 39 XM_DK_Undo_02 13608 23.31 51.48 7.38 40 RCVD_IN_VALIDITY_SAFE 13120 5.84 3.60 7.11 41 XM_Body_Dirty_Words 12104 8.54 12.03 6.56 42 TR_XM_DK_Bayes 11898 4.26 0.38 6.45 43 TR_XM_BayesUnsub 11855 8.29 11.57 6.43 44 RCVD_IN_MSPIKE_WL 11783 9.45 14.87 6.39 45 RCVD_IN_MSPIKE_H3 11783 9.45 14.87 6.39 46 RCVD_IN_VALIDITY_CERTIFIED 11702 5.14 3.01 6.34 47 TR_XM_DK_Bayes1 11687 4.18 0.38 6.34 48 BAYES_99 11323 18.80 41.18 6.14 49 XMStrtUSub 11113 5.63 4.92 6.02 50 BOTNET_IPINHOSTNAME 10859 9.20 15.07 5.89 51 ANY_BOUNCE_MESSAGE 10774 4.16 1.18 5.84 52 BOUNCE_MESSAGE 10773 4.16 1.18 5.84 53 HTML_IMAGE_RATIO_02 10656 6.33 7.31 5.78 54 TR_XM_DK_Bayes2 10481 3.71 0.22 5.68 55 HTML_IMAGE_RATIO_04 9911 5.54 5.83 5.37 56 XMSubMetaSx_00 9856 5.30 5.22 5.34 57 IN_ZIMBRA_NJ_WHITELIST 9619 3.35 0.06 5.21 58 BAYES_999 9076 15.03 32.91 4.92 59 LOTS_OF_MONEY 8929 6.77 10.19 4.84 60 XM_H_Long_From01 8767 4.55 4.18 4.75 61 XM_UncommonTLD01 8461 5.35 6.70 4.59 62 BAYES_80 8279 6.39 9.75 4.49 63 XM_B_SpammyWords3 8131 7.55 13.11 4.41 64 XMSexyCombo_05 7543 4.60 5.49 4.09 65 MPART_ALT_DIFF 7534 4.28 4.62 4.08 66 BAYES_40 7315 3.02 1.35 3.97 67 XM_B_Phish_Phrases 7172 4.12 4.53 3.89 68 INVALID_MSGID 7011 2.49 0.17 3.80 69 T_TooManySym_02 6979 2.67 0.71 3.78 70 RELAYCOUNTRY_META 6792 11.74 26.00 3.68 71 SCC_BODY_URI_ONLY 6603 2.53 0.66 3.58 72 TR_XM_SpammyWords4 6246 5.40 8.95 3.39 73 TO_MALFORMED 6123 2.13 0.01 3.32 74 MIME_QP_LONG_LINE 5961 2.58 1.42 3.23 75 BAYES_95 5582 4.04 5.84 3.03 76 MIME_HTML_MOSTLY 5579 3.29 3.75 3.02 77 TooManyTo_002 5573 2.07 0.39 3.02 78 TR_XM_DKIM_Undo 5526 17.66 43.59 3.00 79 FSL_BULK_SIG 5440 4.75 7.94 2.95 80 BAYES_05 5350 2.01 0.44 2.90 81 FROM_EXCESS_BASE64 5345 2.72 2.41 2.90 82 XMNumbers 5345 3.39 4.27 2.90 83 TVD_RCVD_IP 5204 2.07 0.74 2.82 84 T_REMOTE_IMAGE 5077 2.33 1.58 2.75 85 RCVD_IN_IADB_LISTED 5021 2.00 0.72 2.72 86 HTML_IMAGE_RATIO_06 5011 2.94 3.34 2.72 87 XMGappySubj_01 4855 1.74 0.16 2.63 88 BAYES_20 4824 2.00 0.90 2.62 89 TR_DCC_Bayes_99 4716 12.41 29.84 2.56 90 XM_SPF_SoftFail 4697 3.00 3.81 2.55 91 XM_B_SpammyTLD 4602 2.71 3.09 2.49 92 RCVD_IN_IADB_SPF 4556 1.81 0.65 2.47 93 MIME_HTML_ONLY_MULTI 4430 2.61 2.98 2.40 94 XM_CamelCaseFrm001 4301 2.34 2.35 2.33 95 HTML_IMAGE_RATIO_08 4196 3.21 4.85 2.27 96 RCVD_IN_IADB_SENDERID 4195 1.68 0.62 2.27 97 XMBSHREFv2 4182 1.51 0.16 2.27 98 RCVD_IN_IADB_DK 4108 1.65 0.64 2.23 99 MAILING_LIST_MULTI 4073 1.95 1.51 2.21 100 TM2_M_URI_OPT_OUT 3842 2.37 2.87 2.08 101 T_XMDrugObfuBody_14 3794 2.65 3.70 2.06 102 TR_XM_PhishingBody 3757 2.45 3.19 2.04 103 XMGappySubj_02 3721 1.30 0.05 2.02 104 TR_XM_SpammyRelay 3521 9.39 22.63 1.91 105 TVD_SPACE_RATIO 3463 1.24 0.12 1.88 106 XM_B_FormFill 3392 1.19 0.04 1.84 107 XM_PDF 3382 1.27 0.27 1.83 108 IN_HORDE_ADDRESS_BOOK 3333 1.18 0.08 1.81 109 TR_XM_UnparsRelay 3192 3.60 6.90 1.73 110 XM_DK_Undo_01 3148 1.52 1.18 1.71 111 UNTRUSTED_Relay 3027 2.91 5.14 1.64 112 RCVD_IN_IADB_VOUCHED 3027 1.16 0.30 1.64 113 XMDiploma_00 3008 2.01 2.68 1.63 114 XMStockSpam_06 2964 1.62 1.64 1.61 115 RELAYCOUNTRY_CA 2805 7.84 19.02 1.52 116 DKIM_INVALID 2753 2.18 3.39 1.49 117 XMBdyGiftCard01 2688 1.80 2.39 1.46 118 XMBody_95 2620 0.94 0.10 1.42 119 RCVD_IN_RP_SAFE 2481 1.12 0.72 1.34 120 BOTNET 2415 4.33 9.67 1.31 121 XM_B_Investor 2402 2.13 3.58 1.30 122 XM_SendGrid 2399 1.32 1.34 1.30 123 TR_XM_SpammyWords5 2395 2.71 5.20 1.30 124 T_TooManySym_03 2393 0.91 0.23 1.30 125 MSGID_NOFQDN1 2360 0.83 0.03 1.28 126 T_Symld_Words_02 2303 1.14 0.96 1.25 127 TM2_M_VERY_LONG_WORD 2295 1.69 2.47 1.24 128 XM_GoogleGroups 2264 0.94 0.43 1.23 129 T_XMDrugObfuBody_08 2253 2.06 3.55 1.22 130 RCVD_IN_RP_CERTIFIED 2237 0.99 0.60 1.21 131 XM_B_Unsub2 2186 1.30 1.52 1.19 132 RCVD_IN_IADB_OPTIN 2173 0.82 0.20 1.18 133 URI_NOVOWEL 2168 1.02 0.76 1.18 134 HTML_MIME_NO_HTML_TAG 2163 1.28 1.48 1.17 135 TR_XM_Base64_M1 2068 1.14 1.18 1.12 136 XM_RXBody 1991 1.00 0.87 1.08 137 TR_Symld_Words 1986 0.86 0.49 1.08 138 XM_OfRef6 1947 2.13 4.03 1.06 139 XM_H_Long_From02 1862 1.13 1.34 1.01 140 XMPhish30 1839 1.20 1.56 1.00 141 TR_XM_DK_SendGrid 1718 0.92 0.91 0.93 142 SUBJ_ALL_CAPS 1703 1.39 2.21 0.92 143 TooManyTo_003 1694 0.71 0.34 0.92 144 XM_H_Trusted_IP 1683 0.58 0.00 0.91 145 XMGenDplmaNmb 1680 0.93 0.95 0.91 146 RCVD_IN_BL_SPAMCOP_NET 1668 7.32 18.67 0.90 147 USER_IN_WHITELIST 1643 0.57 0.00 0.89 148 USER_IN_WELCOMELIST 1643 0.57 0.00 0.89 149 XM_H_PHPMailer 1614 1.04 1.33 0.87 150 XM_UB50 1581 1.40 2.35 0.86 151 URI_HEX 1546 1.06 1.44 0.84 152 XMSubMetaI_00 1546 0.90 1.01 0.84 153 XM_B_COVIDMETA 1542 0.66 0.36 0.84 154 XM_B_COPY_HTML 1513 1.01 1.33 0.82 155 DKIM_ADSP_CUSTOM_MED 1501 0.81 0.80 0.81 156 XMSubMetaSxObfu_02 1419 0.57 0.23 0.77 157 KHOP_HELO_FCRDNS 1399 0.96 1.31 0.76 158 URI_TRY_3LD 1317 1.06 1.68 0.71 159 MPART_ALT_DIFF_COUNT 1287 0.73 0.79 0.70 160 TooManyTo_004 1285 0.56 0.31 0.70 161 XMSubNoVowel 1282 0.59 0.40 0.69 162 XM_B_REG_HTML 1206 0.70 0.77 0.65 163 T_XMDrugObfuBody_00 1198 1.03 1.69 0.65 164 HTML_TAG_BALANCE_BODY 1195 1.39 2.70 0.65 165 XM_ProductURIs 1158 0.68 0.78 0.63 166 XM_B_SpammyWords4 1147 1.35 2.64 0.62 167 XMBody_17 1107 3.35 8.22 0.60 168 TooManyTo_005 1103 0.48 0.28 0.60 169 TR_MetaPhish_Combo_01 1042 0.60 0.65 0.56 170 T_XMHurry_00 1036 1.04 1.89 0.56 171 NML_ADSP_CUSTOM_MED 1024 0.61 0.71 0.56 172 XMBrknScrpt_02 1020 0.80 1.24 0.55 173 HTTPS_HTTP_MISMATCH 989 0.68 0.95 0.54 174 FILL_THIS_FORM 986 0.49 0.40 0.53 175 HTML_FONT_FACE_BAD 963 0.57 0.65 0.52 176 TR_XM_SpammyWords2 960 7.04 18.56 0.52 177 XMNoVowels 950 0.44 0.30 0.52 178 SpammyFromTLD_01 927 1.70 3.82 0.50 179 FORGED_GMAIL_RCVD 894 0.55 0.65 0.48 180 T_TooManySym_04 880 0.36 0.16 0.48 181 XMLngstWrd_00 877 0.39 0.25 0.48 182 RCVD_IN_PSBL 858 0.65 0.98 0.47 183 XMSubMetaSxObfu_03 855 0.50 0.57 0.46 184 SUBJ_DOLLARS 848 0.64 0.97 0.46 185 TRACKER_ID 842 0.31 0.06 0.46 186 XMWhlSbjSex 806 0.38 0.27 0.44 187 RELAYCOUNTRY_AU 802 0.96 1.90 0.43 188 XMPhish14 783 0.50 0.62 0.42 189 TM2_M_A_HREF_HREF 775 0.92 1.81 0.42 190 XM_S_SubURI 773 0.28 0.05 0.42 191 SHOPIFY_IMG_NOT_RCVD_SFY 772 0.58 0.88 0.42 192 XMCapTrack 771 0.36 0.27 0.42 193 FILL_THIS_FORM_LONG 754 0.34 0.21 0.41 194 HELO_NO_DOMAIN 750 0.49 0.63 0.41 195 HELO_NODOT 750 0.49 0.63 0.41 196 T_FILL_THIS_FORM_SHORT 745 2.74 6.87 0.40 197 LOW_PRICE 739 0.36 0.28 0.40 198 CTE_8BIT_MISMATCH 732 0.26 0.02 0.40 199 HTML_IMAGE_ONLY_20 729 0.38 0.35 0.40 200 XMSexyCombo_01 727 0.85 1.65 0.39 ----------------------------------------------------------------------