Email: 367331 Autolearn: 0 AvgScore: 3.63 AvgScanTime: 1.19 sec Spam: 118414 Autolearn: 0 AvgScore: 14.22 AvgScanTime: 1.31 sec Ham: 248917 Autolearn: 0 AvgScore: -1.41 AvgScanTime: 1.13 sec Time Spent Running SA: 121.25 hours Time Spent Processing Spam: 43.11 hours Time Spent Processing Ham: 78.14 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 112533 86.26 95.03 82.09 2 DKIM_SIGNED 99790 79.37 84.27 77.04 3 XM_DK_Pass 97550 78.10 82.38 76.07 4 DKIM_VALID 96040 76.53 81.11 74.36 5 DCC_CHECK 90015 55.15 76.02 45.22 6 XM_B_Unicode 87586 71.44 73.97 70.24 7 RELAYCOUNTRY_US 86895 78.86 73.38 81.47 8 XMListUnsubscribeExists 80400 55.81 67.90 50.05 9 DKIM_VALID_AU 78517 63.49 66.31 62.15 10 XM_B_SpammyWords 77411 52.78 65.37 46.78 11 XM_DK_Undo_02 58500 22.02 49.40 8.99 12 XM_B_Unicode3 52018 44.17 43.93 44.28 13 BAYES_99 49248 18.84 41.59 8.02 14 LOC_TINY_FONT_1 47278 31.61 39.93 27.66 15 XM_B_SpammyWords2 45288 25.01 38.25 18.72 16 TR_XM_DKIM_Undo 44881 16.82 37.90 6.79 17 MIME_HTML_ONLY 41211 25.85 34.80 21.59 18 HTML_FONT_LOW_CONTRAST 40434 31.58 34.15 30.36 19 BAYES_999 38880 14.92 32.83 6.39 20 TR_DCC_Bayes_99 38195 13.29 32.26 4.27 21 BAYES_50 36196 47.72 30.57 55.89 22 DKIM_VALID_EF 33335 31.89 28.15 33.67 23 RCVD_IN_MSPIKE_WL 29513 34.75 24.92 39.43 24 FVGT_m_MULTI_ODD 29267 24.64 24.72 24.60 25 RELAYCOUNTRY_META 28305 11.30 23.90 5.30 26 T_KAM_HTML_FONT_INVALID 27122 18.02 22.90 15.69 27 DCC_CHECK_NEGATIVE 26834 43.60 22.66 53.56 28 RCVD_IN_MSPIKE_H2 26098 20.86 22.04 20.31 29 XM_Body_Dirty_Words 24173 14.65 20.41 11.90 30 XMSubLong 24057 21.00 20.32 21.32 31 XM_UncommonTLD01 22206 8.90 18.75 4.22 32 UNTRUSTED_Relay 22045 7.69 18.62 2.49 33 T_TM2_M_HEADER_IN_MSG 21806 21.56 18.42 23.06 34 XM_Multi_Part_URI 18313 14.47 15.47 14.00 35 BOTNET 18035 5.92 15.23 1.49 36 TR_XM_SpammyWords2 17908 6.03 15.12 1.70 37 XMSexyCombo_05 16784 7.63 14.17 4.51 38 FSL_BULK_SIG 15728 8.52 13.28 6.25 39 XM_B_Unsub 15296 11.42 12.92 10.71 40 RCVD_IN_MSPIKE_H4 14715 14.70 12.43 15.78 41 XM_B_SpammyWords3 14049 7.13 11.86 4.87 42 BOTNET_IPINHOSTNAME 13914 8.01 11.75 6.23 43 RCVD_IN_MSPIKE_H3 13406 16.07 11.32 18.33 44 MPART_ALT_DIFF 13003 7.40 10.98 5.69 45 HTML_IMAGE_RATIO_02 12345 9.00 10.43 8.33 46 XM_Evil_Numbers_Gen 11972 8.94 10.11 8.38 47 XMSubMetaSx_00 11965 6.57 10.10 4.90 48 BAYES_80 11755 7.39 9.93 6.19 49 UNPARSEABLE_RELAY 11100 8.60 9.37 8.23 50 TR_XM_UnparsRelay 10954 7.93 9.25 7.30 51 SpammyFromTLD_02 10192 2.88 8.61 0.15 52 MIME_HTML_MOSTLY 9671 4.68 8.17 3.03 53 LOTS_OF_MONEY 9471 6.79 8.00 6.22 54 LotsOfNums_01 9052 7.46 7.64 7.37 55 RCVD_IN_BL_SPAMCOP_NET 8514 2.82 7.19 0.74 56 BAYES_95 8512 5.12 7.19 4.13 57 BAYES_60 8410 9.81 7.10 11.09 58 XM_B_Phish_Phrases 8407 7.77 7.10 8.08 59 RCVD_IN_RP_SAFE 8403 9.08 7.10 10.03 60 KHOP_HELO_FCRDNS 8046 3.55 6.79 2.01 61 TooManyTo_001 7951 6.71 6.71 6.71 62 XM_SendGrid 7856 7.12 6.63 7.34 63 TR_XM_SpammyWords4 7779 4.52 6.57 3.54 64 RELAYCOUNTRY_CA 7387 3.11 6.24 1.62 65 HTML_IMAGE_RATIO_04 7295 6.91 6.16 7.27 66 XM_H_Long_From01 6954 5.43 5.87 5.22 67 XMNumbers 6673 4.48 5.64 3.93 68 XMStrtUSub 6650 8.81 5.62 10.32 69 RCVD_IN_RP_CERTIFIED 6616 8.08 5.59 9.27 70 XM_B_SpammyTLD 6600 3.50 5.57 2.52 71 XM_UB50 6446 2.94 5.44 1.75 72 HTML_IMAGE_ONLY_12 6303 1.81 5.32 0.14 73 XM_UB99 6262 1.71 5.29 0.00 74 HTML_SHORT_LINK_IMG_1 6227 1.71 5.26 0.02 75 TR_XM_PhishingBody 6224 3.38 5.26 2.49 76 RELAYCOUNTRY_FR 6047 1.99 5.11 0.51 77 URIBL_SBL_A 6003 2.41 5.07 1.14 78 BODY_URI_ONLY 6001 1.64 5.07 0.01 79 HTML_FONT_SIZE_LARGE 5994 1.70 5.06 0.10 80 SpammyFromTLD_01 5845 1.90 4.94 0.46 81 HTML_MIME_NO_HTML_TAG 5245 2.41 4.43 1.46 82 RCVD_IN_MSPIKE_BL 4611 1.38 3.89 0.18 83 TR_XM_MSPIKECOMBO 4577 1.37 3.87 0.18 84 TR_XM_DK_SendGrid 4381 4.33 3.70 4.63 85 XMBdyGiftCard01 4297 1.80 3.63 0.92 86 URIBL_DBL_SPAM 4161 1.14 3.51 0.01 87 TM2_M_URI_OPT_OUT 4153 3.29 3.51 3.18 88 TR_Sbj_FN_Bdy 4121 1.22 3.48 0.14 89 XM_UB999 4054 1.11 3.42 0.00 90 MIME_HTML_ONLY_MULTI 4052 3.60 3.42 3.68 91 HTML_IMAGE_RATIO_06 3916 3.50 3.31 3.59 92 XM_DIRTYINTL 3843 1.38 3.25 0.50 93 XMSubEmpty 3837 1.17 3.24 0.18 94 PDS_OTHER_BAD_TLD 3769 1.61 3.18 0.86 95 BODY_EMPTY 3767 1.04 3.18 0.03 96 MISSING_SUBJECT 3760 1.07 3.18 0.06 97 XMNoSubject 3760 1.07 3.18 0.06 98 DKIM_INVALID 3750 2.84 3.17 2.68 99 XMDiploma_00 3750 2.14 3.17 1.65 100 FROM_EXCESS_BASE64 3735 3.21 3.15 3.24 101 TR_XM_SpammyWords5 3527 2.01 2.98 1.54 102 BOTNET_NORDNS 3521 0.97 2.97 0.01 103 RCVD_IN_RP_RNBL 3458 0.97 2.92 0.04 104 TR_XM_BayesRelay 3434 0.95 2.90 0.03 105 XMSexyCombo_01 3289 1.71 2.78 1.20 106 URI_HEX 3189 1.61 2.69 1.10 107 XM_SPF_SoftFail 3147 1.64 2.66 1.15 108 XM_UB80 3119 0.88 2.63 0.04 109 XM_UB95 3078 0.85 2.60 0.02 110 TR_XM_MaxBayes 3058 0.86 2.58 0.04 111 FROM_SUSPICIOUS_NTLD 3005 0.90 2.54 0.12 112 FROM_SUSPICIOUS_NTLD_FP 2963 0.88 2.50 0.11 113 XM_DK_Undo_01 2962 1.97 2.50 1.71 114 RCVD_IN_MSPIKE_L5 2936 0.83 2.48 0.05 115 XM_CamelCaseFrm001 2911 2.06 2.46 1.86 116 RCVD_IN_PSBL 2826 0.86 2.39 0.14 117 XMSubMetaI_00 2803 1.20 2.37 0.65 118 TR_XM_SpammyWords3 2790 0.83 2.36 0.11 119 XM_B_Phish66 2742 1.70 2.32 1.41 120 XM_OfRef6 2688 1.36 2.27 0.93 121 XM_UB60 2649 0.86 2.24 0.20 122 T_FILL_THIS_FORM_SHORT 2616 1.12 2.21 0.59 123 XM_B_SpammyWords4 2605 1.17 2.20 0.68 124 XMBrknScrpt_02 2557 1.17 2.16 0.71 125 T_TooManySym_01 2526 5.03 2.13 6.41 126 TM2_M_VERY_LONG_WORD 2514 1.64 2.12 1.42 127 T_XMDrugObfuBody_08 2486 1.45 2.10 1.15 128 T_XMDrugObfuBody_14 2372 2.37 2.00 2.55 129 MIME_QP_LONG_LINE 2197 2.98 1.86 3.51 130 XMSubMetaSSx_00 2166 0.79 1.83 0.29 131 URI_PHP_REDIR 2118 0.58 1.79 0.00 132 XM_B_Unsub2 2108 1.32 1.78 1.10 133 HTML_IMAGE_RATIO_08 2106 2.03 1.78 2.15 134 XMStockSpam_06 2056 1.73 1.74 1.73 135 DATE_IN_PAST_12_24 2028 0.57 1.71 0.03 136 T_XMDrugObfuBody_00 1997 1.08 1.69 0.79 137 XMGenDplmaNmb 1996 1.02 1.69 0.70 138 RELAYCOUNTRY_DE 1959 0.89 1.65 0.52 139 T_XMHurry_00 1946 0.86 1.64 0.49 140 SUBJ_ALL_CAPS 1901 1.28 1.61 1.12 141 XMLngstWrd_00 1900 1.18 1.60 0.98 142 TR_XM_PHPDW 1875 0.75 1.58 0.35 143 XMPhish08 1872 0.63 1.58 0.17 144 HTTPS_HTTP_MISMATCH 1872 0.86 1.58 0.51 145 T_REMOTE_IMAGE 1855 2.44 1.57 2.86 146 RELAYCOUNTRY_IN 1853 0.55 1.56 0.07 147 XMLngstWrd_01 1848 1.11 1.56 0.89 148 RELAYCOUNTRY_NL 1820 0.65 1.54 0.23 149 TR_XM_FormFill 1744 0.48 1.47 0.01 150 NUMERIC_HTTP_ADDR 1638 0.64 1.38 0.29 151 PLING_QUERY 1622 0.81 1.37 0.55 152 TR_XM_PHPForged 1612 0.60 1.36 0.24 153 TR_XM_FormFill2 1606 0.60 1.36 0.23 154 BAYES_40 1600 2.53 1.35 3.09 155 XM_H_PHPOS 1594 0.59 1.35 0.23 156 XMSexyCombo_04 1567 1.03 1.32 0.89 157 RCVD_IN_IADB_LISTED 1518 2.53 1.28 3.13 158 TR_Symld_Words 1485 1.26 1.25 1.27 159 RELAYCOUNTRY_GB 1479 1.10 1.25 1.03 160 XM_URI_RBL 1452 0.53 1.23 0.19 161 HK_RANDOM_REPLYTO 1450 0.49 1.22 0.14 162 LongTLD 1448 0.46 1.22 0.10 163 TR_XM_INV_DKIM 1436 0.48 1.21 0.13 164 URIBL_BLACK 1422 0.41 1.20 0.03 165 RCVD_IN_MSPIKE_H5 1392 3.98 1.18 5.32 166 RCVD_IN_IADB_SPF 1382 2.22 1.17 2.72 167 XM_PDF 1372 2.87 1.16 3.69 168 XM_JunkDunk 1364 0.37 1.15 0.00 169 XM_B_COVIDMETA 1353 0.78 1.14 0.60 170 DIET_1 1339 0.73 1.13 0.53 171 RCVD_IN_IADB_DK 1307 1.96 1.10 2.36 172 XMHTML_After_End 1294 0.79 1.09 0.65 173 RCVD_IN_IADB_SENDERID 1284 2.01 1.08 2.45 174 URI_NOVOWEL 1278 1.57 1.08 1.80 175 TR_XM_RelayPhish 1278 0.42 1.08 0.11 176 NO_DNS_FOR_FROM 1272 0.55 1.07 0.31 177 XMSubMetaSxObfu_03 1270 0.62 1.07 0.41 178 BAYES_20 1267 1.86 1.07 2.24 179 TR_XM_MaxWHORU 1228 0.53 1.04 0.29 180 TR_XM_SB_Phish 1210 1.35 1.02 1.51 181 XM_RXBody 1203 1.19 1.02 1.27 182 HTML_IMAGE_ONLY_16 1199 0.45 1.01 0.19 183 RCVD_IN_MSPIKE_L3 1192 0.40 1.01 0.11 184 XMHTMLBadTable_001 1190 0.79 1.00 0.69 185 XMSubPhish11 1181 1.34 1.00 1.51 186 XMLngstWrd_02 1170 0.56 0.99 0.36 187 DEAR_FRIEND 1163 0.36 0.98 0.06 188 HTML_FONT_SIZE_HUGE 1143 0.49 0.97 0.27 189 XMBody_17 1141 0.58 0.96 0.39 190 URI_TRY_3LD 1137 1.05 0.96 1.09 191 XMSlimDrugH 1134 0.58 0.96 0.40 192 ALL_TRUSTED 1131 9.96 0.96 14.24 193 XMBody_78 1126 0.59 0.95 0.41 194 MAILING_LIST_MULTI 1123 1.92 0.95 2.39 195 HTML_FONT_FACE_BAD 1120 1.39 0.95 1.60 196 XM_Body_Dirty_Words_01 1113 0.45 0.94 0.21 197 MY_SERVERS_FOUND 1078 0.91 0.91 0.91 198 XMLngstWrd_03 1057 0.48 0.89 0.28 199 XMPhish30 1050 0.68 0.89 0.59 200 XM_ProductURIs 1041 0.81 0.88 0.78 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 204326 86.26 95.03 82.09 2 RELAYCOUNTRY_US 202785 78.86 73.38 81.47 3 DKIM_SIGNED 191761 79.37 84.27 77.04 4 XM_DK_Pass 189350 78.10 82.38 76.07 5 DKIM_VALID 185088 76.53 81.11 74.36 6 XM_B_Unicode 174841 71.44 73.97 70.24 7 DKIM_VALID_AU 154705 63.49 66.31 62.15 8 BAYES_50 139111 47.72 30.57 55.89 9 DCC_CHECK_NEGATIVE 133332 43.60 22.66 53.56 10 XMListUnsubscribeExists 124590 55.81 67.90 50.05 11 XM_B_SpammyWords 116449 52.78 65.37 46.78 12 DCC_CHECK 112566 55.15 76.02 45.22 13 XM_B_Unicode3 110214 44.17 43.93 44.28 14 RCVD_IN_MSPIKE_WL 98137 34.75 24.92 39.43 15 DKIM_VALID_EF 83816 31.89 28.15 33.67 16 HTML_FONT_LOW_CONTRAST 75571 31.58 34.15 30.36 17 LOC_TINY_FONT_1 68845 31.61 39.93 27.66 18 FVGT_m_MULTI_ODD 61239 24.64 24.72 24.60 19 T_TM2_M_HEADER_IN_MSG 57400 21.56 18.42 23.06 20 MIME_HTML_ONLY 53737 25.85 34.80 21.59 21 XMSubLong 53079 21.00 20.32 21.32 22 RCVD_IN_MSPIKE_H2 50544 20.86 22.04 20.31 23 XM_B_SpammyWords2 46587 25.01 38.25 18.72 24 RCVD_IN_MSPIKE_H3 45617 16.07 11.32 18.33 25 XM_DKIMWhitelistDomains 40029 10.92 0.06 16.08 26 RCVD_IN_MSPIKE_H4 39277 14.70 12.43 15.78 27 T_KAM_HTML_FONT_INVALID 39055 18.02 22.90 15.69 28 ALL_TRUSTED 35450 9.96 0.96 14.24 29 XM_Multi_Part_URI 34848 14.47 15.47 14.00 30 XM_Body_Dirty_Words 29627 14.65 20.41 11.90 31 BAYES_60 27611 9.81 7.10 11.09 32 XM_B_Unsub 26651 11.42 12.92 10.71 33 XMStrtUSub 25697 8.81 5.62 10.32 34 RCVD_IN_RP_SAFE 24955 9.08 7.10 10.03 35 RCVD_IN_RP_CERTIFIED 23081 8.08 5.59 9.27 36 XM_DK_Undo_02 22373 22.02 49.40 8.99 37 XM_Evil_Numbers_Gen 20859 8.94 10.11 8.38 38 HTML_IMAGE_RATIO_02 20728 9.00 10.43 8.33 39 UNPARSEABLE_RELAY 20483 8.60 9.37 8.23 40 XM_B_Phish_Phrases 20123 7.77 7.10 8.08 41 BAYES_99 19956 18.84 41.59 8.02 42 BAYES_00 19832 5.56 0.49 7.97 43 LotsOfNums_01 18342 7.46 7.64 7.37 44 XM_SendGrid 18280 7.12 6.63 7.34 45 TR_XM_UnparsRelay 18164 7.93 9.25 7.30 46 HTML_IMAGE_RATIO_04 18085 6.91 6.16 7.27 47 TR_XM_DKIM_Undo 16910 16.82 37.90 6.79 48 TooManyTo_001 16699 6.71 6.71 6.71 49 T_TooManySym_01 15956 5.03 2.13 6.41 50 BAYES_999 15918 14.92 32.83 6.39 51 FSL_BULK_SIG 15552 8.52 13.28 6.25 52 BOTNET_IPINHOSTNAME 15505 8.01 11.75 6.23 53 LOTS_OF_MONEY 15485 6.79 8.00 6.22 54 BAYES_80 15398 7.39 9.93 6.19 55 TR_XM_DK_Bayes 15315 4.30 0.39 6.15 56 TR_XM_DK_Bayes1 15115 4.24 0.38 6.07 57 MPART_ALT_DIFF 14166 7.40 10.98 5.69 58 TR_XM_DK_Bayes2 14047 3.94 0.37 5.64 59 RCVD_IN_MSPIKE_H5 13243 3.98 1.18 5.32 60 RELAYCOUNTRY_META 13198 11.30 23.90 5.30 61 XM_H_Long_From01 12990 5.43 5.87 5.22 62 XMSubMetaSx_00 12186 6.57 10.10 4.90 63 XM_B_SpammyWords3 12127 7.13 11.86 4.87 64 TR_XM_DK_SendGrid 11520 4.33 3.70 4.63 65 IN_ZIMBRA_NJ_WHITELIST 11361 3.10 0.04 4.56 66 XMSexyCombo_05 11238 7.63 14.17 4.51 67 TR_DCC_Bayes_99 10635 13.29 32.26 4.27 68 XM_UncommonTLD01 10503 8.90 18.75 4.22 69 XM_H_Trusted_IP 10339 2.81 0.00 4.15 70 BAYES_95 10279 5.12 7.19 4.13 71 XMNumbers 9781 4.48 5.64 3.93 72 T_TooManySym_02 9432 2.75 0.56 3.79 73 XM_PDF 9177 2.87 1.16 3.69 74 MIME_HTML_ONLY_MULTI 9171 3.60 3.42 3.68 75 HTML_IMAGE_RATIO_06 8933 3.50 3.31 3.59 76 TR_XM_SpammyWords4 8822 4.52 6.57 3.54 77 MIME_QP_LONG_LINE 8734 2.98 1.86 3.51 78 FROM_EXCESS_BASE64 8074 3.21 3.15 3.24 79 TVD_RCVD_IP 7940 2.28 0.37 3.19 80 TM2_M_URI_OPT_OUT 7915 3.29 3.51 3.18 81 RCVD_IN_IADB_LISTED 7791 2.53 1.28 3.13 82 INVALID_MSGID 7707 2.27 0.52 3.10 83 BAYES_40 7691 2.53 1.35 3.09 84 MIME_HTML_MOSTLY 7530 4.68 8.17 3.03 85 MSGID_NOFQDN1 7247 1.99 0.05 2.91 86 T_REMOTE_IMAGE 7111 2.44 1.57 2.86 87 RCVD_IN_IADB_SPF 6767 2.22 1.17 2.72 88 DKIM_INVALID 6673 2.84 3.17 2.68 89 T_XMDrugObfuBody_14 6339 2.37 2.00 2.55 90 TO_MALFORMED 6266 1.71 0.00 2.52 91 XM_B_SpammyTLD 6261 3.50 5.57 2.52 92 TR_XM_PhishingBody 6207 3.38 5.26 2.49 93 ANY_BOUNCE_MESSAGE 6203 1.90 0.65 2.49 94 BOUNCE_MESSAGE 6202 1.90 0.64 2.49 95 UNTRUSTED_Relay 6193 7.69 18.62 2.49 96 RCVD_IN_IADB_SENDERID 6094 2.01 1.08 2.45 97 MAILING_LIST_MULTI 5948 1.92 0.95 2.39 98 RCVD_IN_IADB_DK 5880 1.96 1.10 2.36 99 HELO_MISC_IP 5652 1.57 0.10 2.27 100 BAYES_20 5566 1.86 1.07 2.24 101 HTML_IMAGE_RATIO_08 5353 2.03 1.78 2.15 102 USER_IN_DEF_DKIM_WL 5163 1.43 0.06 2.07 103 KHOP_HELO_FCRDNS 4995 3.55 6.79 2.01 104 XMBSHREFv2 4720 1.31 0.09 1.90 105 XM_CamelCaseFrm001 4642 2.06 2.46 1.86 106 RCVD_IN_IADB_VOUCHED 4629 1.42 0.48 1.86 107 URI_NOVOWEL 4483 1.57 1.08 1.80 108 IN_HORDE_ADDRESS_BOOK 4431 1.23 0.07 1.78 109 XM_UB50 4344 2.94 5.44 1.75 110 XMStockSpam_06 4307 1.73 1.74 1.73 111 XM_DK_Undo_01 4260 1.97 2.50 1.71 112 TR_XM_SpammyWords2 4240 6.03 15.12 1.70 113 XMSubNoVowel 4158 1.40 0.82 1.67 114 XMDiploma_00 4113 2.14 3.17 1.65 115 RELAYCOUNTRY_CA 4023 3.11 6.24 1.62 116 HTML_FONT_FACE_BAD 3987 1.39 0.95 1.60 117 TR_XM_SpammyWords5 3838 2.01 2.98 1.54 118 TR_XM_SB_Phish 3764 1.35 1.02 1.51 119 XMSubPhish11 3750 1.34 1.00 1.51 120 BOTNET 3703 5.92 15.23 1.49 121 HTML_MIME_NO_HTML_TAG 3625 2.41 4.43 1.46 122 TooManyTo_002 3596 1.17 0.59 1.44 123 TM2_M_VERY_LONG_WORD 3524 1.64 2.12 1.42 124 XM_B_Phish66 3516 1.70 2.32 1.41 125 XM_GoogleGroups 3490 1.12 0.52 1.40 126 BAYES_05 3471 1.17 0.71 1.39 127 XM_RXBody 3169 1.19 1.02 1.27 128 TR_Symld_Words 3155 1.26 1.25 1.27 129 XMGappySubj_01 3110 0.88 0.10 1.25 130 XMSexyCombo_01 2982 1.71 2.78 1.20 131 XM_H_Long_From02 2962 1.05 0.76 1.19 132 RCVD_IN_IADB_OPTIN 2890 0.92 0.42 1.16 133 XM_SPF_SoftFail 2873 1.64 2.66 1.15 134 T_XMDrugObfuBody_08 2858 1.45 2.10 1.15 135 URIBL_SBL_A 2841 2.41 5.07 1.14 136 SUBJ_ALL_CAPS 2795 1.28 1.61 1.12 137 XM_B_Unsub2 2745 1.32 1.78 1.10 138 URI_HEX 2732 1.61 2.69 1.10 139 URI_TRY_3LD 2722 1.05 0.96 1.09 140 TVD_SPACE_RATIO 2660 0.76 0.12 1.07 141 TR_MSPIKEBAYES00 2653 0.73 0.02 1.07 142 XMBody_95 2622 0.75 0.12 1.05 143 DKIM_ADSP_CUSTOM_MED 2576 0.93 0.70 1.03 144 RELAYCOUNTRY_GB 2569 1.10 1.25 1.03 145 XMLngstWrd_00 2449 1.18 1.60 0.98 146 TooManyTo_003 2436 0.83 0.53 0.98 147 T_TooManySym_03 2353 0.71 0.21 0.95 148 XM_OfRef6 2310 1.36 2.27 0.93 149 XMBdyGiftCard01 2298 1.80 3.63 0.92 150 MY_SERVERS_FOUND 2263 0.91 0.91 0.91 151 XMSexyCombo_04 2223 1.03 1.32 0.89 152 XMLngstWrd_01 2214 1.11 1.56 0.89 153 PDS_OTHER_BAD_TLD 2130 1.61 3.18 0.86 154 HTML_IMAGE_ONLY_20 2099 0.67 0.30 0.84 155 XMSubMetaSxObfu_04 2043 0.60 0.12 0.82 156 SUBJ_BUY 2028 0.60 0.14 0.81 157 T_XMDrugObfuBody_00 1976 1.08 1.69 0.79 158 TooManyTo_004 1956 0.67 0.41 0.79 159 XM_ProductURIs 1942 0.81 0.88 0.78 160 T_MANY_PILL_PRICE 1929 0.54 0.05 0.77 161 RCVD_IN_BL_SPAMCOP_NET 1849 2.82 7.19 0.74 162 RDNS_DYNAMIC 1843 0.77 0.83 0.74 163 XMBrknScrpt_02 1759 1.17 2.16 0.71 164 XMGenDplmaNmb 1733 1.02 1.69 0.70 165 XMHTMLBadTable_001 1714 0.79 1.00 0.69 166 TooManyTo_005 1690 0.58 0.37 0.68 167 XM_B_SpammyWords4 1687 1.17 2.20 0.68 168 NML_ADSP_CUSTOM_MED 1665 0.65 0.62 0.67 169 USER_IN_WELCOMELIST 1660 0.45 0.00 0.67 170 USER_IN_WHITELIST 1660 0.45 0.00 0.67 171 TVD_SPACE_RATIO_MINFP 1655 0.57 0.36 0.66 172 HELO_NO_DOMAIN 1617 0.59 0.46 0.65 173 HELO_NODOT 1617 0.59 0.47 0.65 174 XMHTML_After_End 1609 0.79 1.09 0.65 175 XMSubMetaI_00 1609 1.20 2.37 0.65 176 XMSubMetaSxObfu_02 1555 0.52 0.30 0.62 177 XM_B_COVIDMETA 1496 0.78 1.14 0.60 178 URI_OPTOUT_3LD 1490 0.67 0.83 0.60 179 FORGED_GMAIL_RCVD 1489 0.58 0.55 0.60 180 T_FILL_THIS_FORM_SHORT 1481 1.12 2.21 0.59 181 XMPhish30 1462 0.68 0.89 0.59 182 XM_B_REG_HTML 1433 0.56 0.51 0.58 183 TR_MetaPhish_Combo_01 1427 0.55 0.50 0.57 184 XM_H_PHPMailer 1361 0.65 0.87 0.55 185 PLING_QUERY 1358 0.81 1.37 0.55 186 XM_B_COPY_HTML 1339 0.53 0.52 0.54 187 DIET_1 1331 0.73 1.13 0.53 188 RELAYCOUNTRY_DE 1296 0.89 1.65 0.52 189 RELAYCOUNTRY_FR 1275 1.99 5.11 0.51 190 HTTPS_HTTP_MISMATCH 1275 0.86 1.58 0.51 191 SHOPIFY_IMG_NOT_RCVD_SFY 1274 0.55 0.64 0.51 192 XM_DIRTYINTL 1235 1.38 3.25 0.50 193 T_XMHurry_00 1209 0.86 1.64 0.49 194 XMCapTrack 1181 0.41 0.28 0.47 195 SUBJ_DOLLARS 1180 0.60 0.88 0.47 196 SpammyFromTLD_01 1148 1.90 4.94 0.46 197 XMNoVowels 1145 0.56 0.78 0.46 198 T_TooManySym_04 1043 0.32 0.10 0.42 199 XMBody_78 1031 0.59 0.95 0.41 200 MPART_ALT_DIFF_COUNT 1028 0.46 0.56 0.41 ----------------------------------------------------------------------