Email: 291282 Autolearn: 0 AvgScore: 4.65 AvgScanTime: 1.13 sec Spam: 105956 Autolearn: 0 AvgScore: 14.41 AvgScanTime: 1.17 sec Ham: 185326 Autolearn: 0 AvgScore: -0.94 AvgScanTime: 1.10 sec Time Spent Running SA: 91.06 hours Time Spent Processing Spam: 34.52 hours Time Spent Processing Ham: 56.54 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102006 86.87 96.27 81.49 2 DKIM_SIGNED 95809 81.90 90.42 77.03 3 XM_DK_Pass 93349 80.45 88.10 76.08 4 DKIM_VALID 90861 79.25 85.75 75.53 5 XM_B_Unicode 88817 75.70 83.82 71.06 6 T_SCC_BODY_TEXT_LINE 86491 82.78 81.63 83.45 7 RELAYCOUNTRY_US 80709 78.32 76.17 79.56 8 XMListUnsubscribeExists 78502 62.61 74.09 56.05 9 DCC_CHECK 77466 52.49 73.11 40.70 10 XM_B_SpammyWords 76051 54.46 71.78 44.56 11 DKIM_VALID_AU 66753 64.52 63.00 65.39 12 XM_DK_Undo_02 51985 21.84 49.06 6.28 13 TR_MAX_INTL_RELAY 48748 21.79 46.01 7.94 14 XM_B_Unicode3 46875 45.30 44.24 45.91 15 XM_B_SpammyWords2 43605 28.00 41.15 20.47 16 BAYES_99 42000 17.76 39.64 5.25 17 TR_XM_DKIM_Undo 41996 16.04 39.64 2.55 18 LOC_TINY_FONT_1 40810 32.59 38.52 29.19 19 MIME_HTML_ONLY 37397 25.63 35.29 20.10 20 HTML_FONT_LOW_CONTRAST 35868 33.54 33.85 33.36 21 BAYES_50 35270 48.94 33.29 57.89 22 DKIM_VALID_EF 35071 30.76 33.10 29.42 23 BAYES_999 33205 14.00 31.34 4.09 24 FVGT_m_MULTI_ODD 32913 29.62 31.06 28.79 25 TR_DCC_Bayes_99 30745 11.81 29.02 1.97 26 T_KAM_HTML_FONT_INVALID 29700 23.53 28.03 20.96 27 DCC_CHECK_NEGATIVE 28481 47.49 26.88 59.27 28 TR_XM_DK_Unsub 27554 19.72 26.01 16.13 29 RCVD_IN_MSPIKE_H2 26641 25.67 25.14 25.97 30 RELAYCOUNTRY_META 25941 11.48 24.48 4.04 31 T_TM2_M_HEADER_IN_MSG 22419 21.31 21.16 21.40 32 TR_XM_SpammyRelay 20784 8.65 19.62 2.37 33 XM_Multi_Part_URI 18793 16.88 17.74 16.39 34 TR_XM_SpammyWords2 18176 6.63 17.15 0.61 35 XMSubLong 17515 21.31 16.53 24.04 36 RCVD_IN_BL_SPAMCOP_NET 17239 6.39 16.27 0.75 37 RELAYCOUNTRY_CA 16725 6.70 15.78 1.51 38 UNPARSEABLE_RELAY 15688 12.05 14.81 10.48 39 TR_XM_SPAMCOP 14595 5.19 13.77 0.28 40 BOTNET_IPINHOSTNAME 14059 8.76 13.27 6.18 41 XM_B_Unsub 14033 10.18 13.24 8.42 42 RCVD_IN_MSPIKE_WL 13767 8.74 12.99 6.30 43 RCVD_IN_MSPIKE_H3 13767 8.74 12.99 6.30 44 TR_XM_BayesUnsub 13700 9.25 12.93 7.15 45 XM_B_SpammyWords3 12739 8.20 12.02 6.02 46 BOTNET 10810 4.45 10.20 1.16 47 LOTS_OF_MONEY 10230 7.28 9.65 5.93 48 BAYES_80 9417 6.33 8.89 4.87 49 BAYES_60 9395 10.31 8.87 11.14 50 XM_UncommonTLD01 9307 6.21 8.78 4.73 51 TR_XM_SpammyWords4 8787 5.84 8.29 4.44 52 TR_XM_UnparsRelay 8727 3.95 8.24 1.51 53 XM_Body_Dirty_Words 8572 5.89 8.09 4.64 54 HTML_IMAGE_RATIO_02 8425 6.84 7.95 6.20 55 XM_Evil_Numbers_Gen 8055 8.50 7.60 9.01 56 MPART_ALT_DIFF 7882 5.30 7.44 4.08 57 XMBody_17 7852 3.10 7.41 0.64 58 FSL_BULK_SIG 7040 4.43 6.64 3.16 59 XMSubMetaSx_00 6785 5.27 6.40 4.62 60 T_FILL_THIS_FORM_SHORT 6721 2.61 6.34 0.47 61 BAYES_95 6526 3.95 6.16 2.69 62 TR_XM_BayesRelay 6359 2.18 6.00 0.00 63 TooManyTo_001 6175 6.54 5.83 6.95 64 XMStrtUSub 6113 6.02 5.77 6.17 65 UNTRUSTED_Relay 5958 3.24 5.62 1.88 66 XMSexyCombo_05 5671 3.74 5.35 2.83 67 XM_H_GMP 5643 6.99 5.33 7.94 68 LotsOfNums_01 5563 7.11 5.25 8.17 69 MIME_HTML_MOSTLY 5460 3.85 5.15 3.11 70 HK_RANDOM_REPLYTO 5337 1.88 5.04 0.07 71 DKIM_INVALID 4948 2.65 4.67 1.50 72 XM_B_Phish_Phrases 4817 3.35 4.55 2.66 73 FONT_INVIS_LONG_LINE 4767 1.70 4.50 0.10 74 XM_H_Long_From01 4645 4.71 4.38 4.90 75 HTML_IMAGE_RATIO_04 4612 4.63 4.35 4.79 76 XM_OfRef6 4586 2.30 4.33 1.14 77 RCVD_IN_VALIDITY_SAFE 4555 6.83 4.30 8.28 78 FROM_EXCESS_BASE64 4516 3.33 4.26 2.80 79 TR_XM_FormFill 4507 1.55 4.25 0.01 80 TR_XM_SpammyWords5 4397 2.83 4.15 2.08 81 T_REMOTE_IMAGE 4326 3.33 4.08 2.90 82 TR_XM_PhishingBody 4219 3.40 3.98 3.07 83 T_XMDrugObfuBody_14 4198 2.67 3.96 1.93 84 SpammyFromTLD_02 4146 1.54 3.91 0.19 85 USER_IN_DEF_DKIM_WL 4110 12.82 3.88 17.94 86 HTML_IMAGE_RATIO_06 4085 3.17 3.86 2.77 87 SCC_BODY_URI_ONLY 3973 3.70 3.75 3.67 88 TM2_M_URI_OPT_OUT 3898 2.72 3.68 2.17 89 HTML_IMAGE_RATIO_08 3821 2.56 3.61 1.96 90 RCVD_IN_VALIDITY_CERTIFIED 3804 5.98 3.59 7.34 91 XMNumbers 3790 3.35 3.58 3.22 92 XM_SPF_SoftFail 3786 2.78 3.57 2.32 93 T_XMDrugObfuBody_08 3697 2.12 3.49 1.34 94 MIME_HTML_ONLY_MULTI 3544 2.62 3.34 2.21 95 XM_B_SpammyTLD 3508 2.95 3.31 2.75 96 XM_B_Investor 3435 2.09 3.24 1.43 97 HOSTED_IMG_MULTI_PUB_01 3426 1.18 3.23 0.01 98 SpammyFromTLD_01 3277 1.40 3.09 0.44 99 XM_CamelCaseFrm001 3175 2.64 3.00 2.43 100 T_TooManySym_01 2903 5.08 2.74 6.41 101 HTML_IMAGE_ONLY_08 2879 1.06 2.72 0.12 102 XM_UB50 2852 1.66 2.69 1.07 103 XM_URI_RBL 2836 1.11 2.68 0.21 104 HTML_SHORT_LINK_IMG_1 2739 0.95 2.59 0.02 105 URIBL_DBL_ABUSE_SPAM 2735 0.94 2.58 0.00 106 TM2_M_VERY_LONG_WORD 2716 1.81 2.56 1.37 107 HDRS_MISSP 2691 0.93 2.54 0.01 108 BODY_URI_ONLY 2685 0.92 2.53 0.00 109 TR_LOTS_OF_MONEY3 2655 1.14 2.51 0.36 110 HTML_TAG_BALANCE_BODY 2642 1.15 2.49 0.39 111 T_XMHurry_00 2503 1.26 2.36 0.62 112 KHOP_HELO_FCRDNS 2448 1.32 2.31 0.76 113 TR_Mismatch_TLD_02 2441 0.87 2.30 0.04 114 TR_XM_PHPDW 2406 0.95 2.27 0.20 115 TR_XM_PHPForged 2394 0.96 2.26 0.22 116 TR_XM_FormFill2 2357 0.94 2.22 0.21 117 XM_H_PHPOS 2337 0.92 2.21 0.19 118 TR_XM_NoHeaderRelay 2274 0.88 2.15 0.15 119 XMDiploma_00 2177 1.60 2.05 1.33 120 XMStockSpam_06 2169 1.77 2.05 1.61 121 XMBdyGiftCard01 2164 1.35 2.04 0.96 122 AC_BR_BONANZA 2151 0.84 2.03 0.16 123 SUBJ_ALL_CAPS 2123 1.70 2.00 1.53 124 RELAYCOUNTRY_AU 2046 1.12 1.93 0.66 125 XM_B_Unsub2 2017 1.34 1.90 1.02 126 XM_HighProb1 2002 0.69 1.89 0.00 127 XM_B_SpammyWords4 1923 1.17 1.81 0.81 128 XMPhish30 1856 1.79 1.75 1.82 129 BOTNET_NORDNS 1772 0.61 1.67 0.01 130 URI_HEX 1767 1.13 1.67 0.82 131 XMReplyNow 1735 0.78 1.64 0.30 132 HTML_MIME_NO_HTML_TAG 1727 1.45 1.63 1.34 133 T_XMDrugObfuBody_10 1602 0.56 1.51 0.02 134 URI_TRY_3LD 1581 1.13 1.49 0.93 135 XM_DIRTYINTL 1501 0.86 1.42 0.54 136 XM_SendGrid 1478 1.32 1.39 1.27 137 MAILING_LIST_MULTI 1474 1.84 1.39 2.10 138 XM_DK_Undo_01 1465 1.67 1.38 1.83 139 MIME_QP_LONG_LINE 1432 2.70 1.35 3.47 140 BAYES_40 1425 3.21 1.34 4.27 141 HTML_FONT_SIZE_LARGE 1406 0.52 1.33 0.06 142 XM_H_PHPMailer 1370 0.94 1.29 0.74 143 FVGT_m_MULTI_ODD_EMAIL 1360 0.49 1.28 0.03 144 LONG_JUNK_URI2 1337 0.50 1.26 0.07 145 TR_XM_INV_DKIM 1307 0.49 1.23 0.06 146 XMGetyour 1299 0.46 1.23 0.03 147 HTML_IMAGE_ONLY_24 1291 0.58 1.22 0.22 148 RCVD_IN_VALIDITY_RPBL 1282 0.50 1.21 0.10 149 HTTPS_HTTP_MISMATCH 1278 0.79 1.21 0.55 150 ALL_TRUSTED 1259 11.06 1.19 16.70 151 SHOPIFY_IMG_NOT_RCVD_SFY 1226 0.64 1.16 0.35 152 RELAYCOUNTRY_HU 1218 0.42 1.15 0.00 153 XM_RXBody 1214 0.58 1.15 0.26 154 XM_S_GiftBonus 1205 0.41 1.14 0.00 155 XM_H_Undi_Recip 1193 0.51 1.13 0.16 156 T_XMDrugObfuBody_00 1192 0.70 1.12 0.46 157 XM_ProductURIs 1188 0.87 1.12 0.72 158 RCVD_IN_PSBL 1119 0.82 1.06 0.68 159 URI_NOVOWEL 1119 1.10 1.06 1.12 160 PLING_QUERY 1106 0.74 1.04 0.56 161 HTML_FONT_FACE_BAD 1094 0.72 1.03 0.54 162 RDNS_DYNAMIC 1086 0.75 1.02 0.60 163 PDS_OTHER_BAD_TLD 1086 0.46 1.02 0.14 164 XM_H_Long_From02 1085 0.98 1.02 0.96 165 BAYES_20 1084 2.23 1.02 2.92 166 BOUNCE_MESSAGE 1083 4.09 1.02 5.85 167 ANY_BOUNCE_MESSAGE 1083 4.09 1.02 5.85 168 XMBody_29 1077 0.43 1.02 0.09 169 TR_XM_DK_SendGrid 1073 0.97 1.01 0.94 170 XM_UB99 1031 0.36 0.97 0.00 171 TooManyTo_002 1017 1.57 0.96 1.92 172 TVD_RCVD_IP 999 2.08 0.94 2.74 173 XM_B_COPY_HTML 989 0.92 0.93 0.92 174 HTML_TEXT_INVISIBLE_STYLE 984 0.37 0.93 0.06 175 TR_XM_InvalidRelay 980 0.35 0.92 0.02 176 TooManyTo_003 975 0.95 0.92 0.96 177 XM_B_DNDMA 975 0.54 0.92 0.32 178 MPART_ALT_DIFF_COUNT 955 0.89 0.90 0.89 179 DIET_1 952 0.71 0.90 0.61 180 TooManyTo_004 951 0.82 0.90 0.78 181 XMPhish14 945 0.74 0.89 0.65 182 GOOG_STO_IMG_NOHTML 936 0.48 0.88 0.26 183 TR_Symld_Words 936 1.03 0.88 1.11 184 XMSubMetaI_00 935 0.65 0.88 0.51 185 XMBrknScrpt_02 934 0.62 0.88 0.47 186 TooManyTo_005 928 0.75 0.88 0.68 187 THIS_AD 916 0.54 0.86 0.35 188 RCVD_IN_RP_SAFE 896 1.33 0.85 1.60 189 TR_Caps_n_Bayes_99 887 0.31 0.84 0.00 190 XM_H_PHPOS_M 880 0.33 0.83 0.04 191 TR_Mismatch_TLD_01 879 0.48 0.83 0.28 192 TM2_M_OBFU_COMMENT 872 0.43 0.82 0.20 193 RCVD_IN_IADB_LISTED 856 2.05 0.81 2.76 194 TR_XM_Undi_Recip5 832 0.29 0.79 0.01 195 XMSubMetaSxObfu_03 821 0.49 0.77 0.32 196 XMSexyCombo_01 819 0.42 0.77 0.21 197 XM_B_Phish66 816 0.42 0.77 0.22 198 HELO_NODOT 812 0.57 0.77 0.46 199 HELO_NO_DOMAIN 811 0.57 0.77 0.46 200 TR_XM_Base64_M1 810 0.80 0.76 0.82 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 154646 82.78 81.63 83.45 2 HTML_MESSAGE 151023 86.87 96.27 81.49 3 RELAYCOUNTRY_US 147437 78.32 76.17 79.56 4 DKIM_SIGNED 142763 81.90 90.42 77.03 5 XM_DK_Pass 141001 80.45 88.10 76.08 6 DKIM_VALID 139984 79.25 85.75 75.53 7 XM_B_Unicode 131694 75.70 83.82 71.06 8 DKIM_VALID_AU 121177 64.52 63.00 65.39 9 DCC_CHECK_NEGATIVE 109838 47.49 26.88 59.27 10 BAYES_50 107281 48.94 33.29 57.89 11 XMListUnsubscribeExists 103875 62.61 74.09 56.05 12 XM_B_Unicode3 85075 45.30 44.24 45.91 13 XM_B_SpammyWords 82579 54.46 71.78 44.56 14 DCC_CHECK 75427 52.49 73.11 40.70 15 HTML_FONT_LOW_CONTRAST 61830 33.54 33.85 33.36 16 DKIM_VALID_EF 54529 30.76 33.10 29.42 17 LOC_TINY_FONT_1 54105 32.59 38.52 29.19 18 FVGT_m_MULTI_ODD 53356 29.62 31.06 28.79 19 RCVD_IN_MSPIKE_H2 48124 25.67 25.14 25.97 20 XMSubLong 44547 21.31 16.53 24.04 21 T_TM2_M_HEADER_IN_MSG 39656 21.31 21.16 21.40 22 T_KAM_HTML_FONT_INVALID 38841 23.53 28.03 20.96 23 XM_B_SpammyWords2 37945 28.00 41.15 20.47 24 MIME_HTML_ONLY 37259 25.63 35.29 20.10 25 USER_IN_DEF_DKIM_WL 33243 12.82 3.88 17.94 26 ALL_TRUSTED 30947 11.06 1.19 16.70 27 XM_Multi_Part_URI 30378 16.88 17.74 16.39 28 TR_XM_DK_Unsub 29890 19.72 26.01 16.13 29 XM_DKIMWhitelistDomains 21622 7.44 0.04 11.67 30 BAYES_60 20643 10.31 8.87 11.14 31 UNPARSEABLE_RELAY 19418 12.05 14.81 10.48 32 XM_Evil_Numbers_Gen 16692 8.50 7.60 9.01 33 XM_B_Unsub 15613 10.18 13.24 8.42 34 RCVD_IN_VALIDITY_SAFE 15347 6.83 4.30 8.28 35 LotsOfNums_01 15142 7.11 5.25 8.17 36 BAYES_00 14918 5.25 0.34 8.05 37 XM_H_GMP 14722 6.99 5.33 7.94 38 TR_MAX_INTL_RELAY 14721 21.79 46.01 7.94 39 RCVD_IN_VALIDITY_CERTIFIED 13612 5.98 3.59 7.34 40 TR_XM_BayesUnsub 13250 9.25 12.93 7.15 41 TooManyTo_001 12886 6.54 5.83 6.95 42 TR_XM_DK_Bayes 12060 4.24 0.28 6.51 43 TR_XM_DK_Bayes1 11899 4.18 0.27 6.42 44 T_TooManySym_01 11888 5.08 2.74 6.41 45 RCVD_IN_MSPIKE_H3 11678 8.74 12.99 6.30 46 RCVD_IN_MSPIKE_WL 11678 8.74 12.99 6.30 47 XM_DK_Undo_02 11633 21.84 49.06 6.28 48 HTML_IMAGE_RATIO_02 11493 6.84 7.95 6.20 49 BOTNET_IPINHOSTNAME 11459 8.76 13.27 6.18 50 XMStrtUSub 11426 6.02 5.77 6.17 51 XM_B_SpammyWords3 11150 8.20 12.02 6.02 52 LOTS_OF_MONEY 10988 7.28 9.65 5.93 53 ANY_BOUNCE_MESSAGE 10840 4.09 1.02 5.85 54 BOUNCE_MESSAGE 10840 4.09 1.02 5.85 55 TR_XM_DK_Bayes2 10746 3.77 0.21 5.80 56 IN_ZIMBRA_NJ_WHITELIST 10318 3.56 0.06 5.57 57 BAYES_99 9728 17.76 39.64 5.25 58 XM_H_Long_From01 9084 4.71 4.38 4.90 59 BAYES_80 9020 6.33 8.89 4.87 60 HTML_IMAGE_RATIO_04 8879 4.63 4.35 4.79 61 XM_UncommonTLD01 8771 6.21 8.78 4.73 62 XM_Body_Dirty_Words 8593 5.89 8.09 4.64 63 XMSubMetaSx_00 8567 5.27 6.40 4.62 64 TR_XM_SpammyWords4 8222 5.84 8.29 4.44 65 BAYES_40 7916 3.21 1.34 4.27 66 BAYES_999 7576 14.00 31.34 4.09 67 MPART_ALT_DIFF 7565 5.30 7.44 4.08 68 RELAYCOUNTRY_META 7489 11.48 24.48 4.04 69 INVALID_MSGID 6806 2.40 0.16 3.67 70 SCC_BODY_URI_ONLY 6802 3.70 3.75 3.67 71 T_TooManySym_02 6785 2.52 0.52 3.66 72 MIME_QP_LONG_LINE 6424 2.70 1.35 3.47 73 TO_MALFORMED 6289 2.16 0.01 3.39 74 XMNumbers 5966 3.35 3.58 3.22 75 FSL_BULK_SIG 5855 4.43 6.64 3.16 76 MIME_HTML_MOSTLY 5763 3.85 5.15 3.11 77 TR_XM_PhishingBody 5697 3.40 3.98 3.07 78 BAYES_05 5417 2.02 0.45 2.92 79 BAYES_20 5414 2.23 1.02 2.92 80 T_REMOTE_IMAGE 5369 3.33 4.08 2.90 81 XMSexyCombo_05 5237 3.74 5.35 2.83 82 FROM_EXCESS_BASE64 5191 3.33 4.26 2.80 83 HTML_IMAGE_RATIO_06 5139 3.17 3.86 2.77 84 RCVD_IN_IADB_LISTED 5109 2.05 0.81 2.76 85 XM_B_SpammyTLD 5088 2.95 3.31 2.75 86 TVD_RCVD_IP 5071 2.08 0.94 2.74 87 BAYES_95 4987 3.95 6.16 2.69 88 XM_B_Phish_Phrases 4931 3.35 4.55 2.66 89 TR_XM_DKIM_Undo 4719 16.04 39.64 2.55 90 RCVD_IN_IADB_SPF 4641 1.86 0.74 2.50 91 XM_CamelCaseFrm001 4508 2.64 3.00 2.43 92 TR_XM_SpammyRelay 4401 8.65 19.62 2.37 93 XM_SPF_SoftFail 4307 2.78 3.57 2.32 94 RCVD_IN_IADB_SENDERID 4277 1.72 0.70 2.31 95 RCVD_IN_IADB_DK 4246 1.71 0.69 2.29 96 MIME_HTML_ONLY_MULTI 4102 2.62 3.34 2.21 97 XMBSHREFv2 4042 1.47 0.23 2.18 98 TM2_M_URI_OPT_OUT 4021 2.72 3.68 2.17 99 MAILING_LIST_MULTI 3884 1.84 1.39 2.10 100 TR_XM_SpammyWords5 3854 2.83 4.15 2.08 101 TR_DCC_Bayes_99 3657 11.81 29.02 1.97 102 HTML_IMAGE_RATIO_08 3640 2.56 3.61 1.96 103 XM_PDF 3625 1.35 0.28 1.96 104 T_XMDrugObfuBody_14 3580 2.67 3.96 1.93 105 TooManyTo_002 3555 1.57 0.96 1.92 106 UNTRUSTED_Relay 3487 3.24 5.62 1.88 107 XM_DK_Undo_01 3388 1.67 1.38 1.83 108 XMPhish30 3371 1.79 1.75 1.82 109 TVD_SPACE_RATIO 3267 1.19 0.18 1.76 110 IN_HORDE_ADDRESS_BOOK 3225 1.13 0.05 1.74 111 XMBody_95 3136 1.11 0.09 1.69 112 XMStockSpam_06 2986 1.77 2.05 1.61 113 RCVD_IN_RP_SAFE 2969 1.33 0.85 1.60 114 SUBJ_ALL_CAPS 2837 1.70 2.00 1.53 115 RELAYCOUNTRY_CA 2805 6.70 15.78 1.51 116 TR_XM_UnparsRelay 2792 3.95 8.24 1.51 117 DKIM_INVALID 2779 2.65 4.67 1.50 118 XMGappySubj_01 2732 1.15 0.59 1.47 119 RCVD_IN_IADB_VOUCHED 2723 1.06 0.33 1.47 120 XM_B_Investor 2652 2.09 3.24 1.43 121 RCVD_IN_RP_CERTIFIED 2647 1.17 0.73 1.43 122 TM2_M_VERY_LONG_WORD 2547 1.81 2.56 1.37 123 HTML_MIME_NO_HTML_TAG 2488 1.45 1.63 1.34 124 T_XMDrugObfuBody_08 2483 2.12 3.49 1.34 125 XMDiploma_00 2470 1.60 2.05 1.33 126 XM_GoogleGroups 2453 1.00 0.45 1.32 127 XMGappySubj_02 2412 1.00 0.49 1.30 128 T_TooManySym_03 2381 0.92 0.27 1.28 129 XM_SendGrid 2360 1.32 1.39 1.27 130 MSGID_NOFQDN1 2293 0.80 0.03 1.24 131 BOTNET 2152 4.45 10.20 1.16 132 XM_OfRef6 2105 2.30 4.33 1.14 133 URI_NOVOWEL 2075 1.10 1.06 1.12 134 TR_Symld_Words 2057 1.03 0.88 1.11 135 XM_UB50 1987 1.66 2.69 1.07 136 RCVD_IN_IADB_OPTIN 1891 0.74 0.24 1.02 137 XM_B_Unsub2 1884 1.34 1.90 1.02 138 USER_IN_WHITELIST 1832 0.63 0.00 0.99 139 USER_IN_WELCOMELIST 1832 0.63 0.00 0.99 140 XM_H_Long_From02 1783 0.98 1.02 0.96 141 TooManyTo_003 1781 0.95 0.92 0.96 142 XMBdyGiftCard01 1779 1.35 2.04 0.96 143 TR_XM_DK_SendGrid 1740 0.97 1.01 0.94 144 URI_TRY_3LD 1722 1.13 1.49 0.93 145 XM_B_COPY_HTML 1703 0.92 0.93 0.92 146 MPART_ALT_DIFF_COUNT 1641 0.89 0.90 0.89 147 TR_XM_Base64_M1 1527 0.80 0.76 0.82 148 URI_HEX 1521 1.13 1.67 0.82 149 XM_H_Trusted_IP 1509 0.52 0.00 0.81 150 XM_B_SpammyWords4 1493 1.17 1.81 0.81 151 XMSlimDrugH 1480 0.71 0.56 0.80 152 DKIM_ADSP_CUSTOM_MED 1446 0.68 0.50 0.78 153 TooManyTo_004 1443 0.82 0.90 0.78 154 KHOP_HELO_FCRDNS 1407 1.32 2.31 0.76 155 RCVD_IN_BL_SPAMCOP_NET 1384 6.39 16.27 0.75 156 XM_H_PHPMailer 1363 0.94 1.29 0.74 157 XM_ProductURIs 1337 0.87 1.12 0.72 158 XM_B_FormFill 1299 0.46 0.03 0.70 159 TooManyTo_005 1262 0.75 0.88 0.68 160 RCVD_IN_PSBL 1261 0.82 1.06 0.68 161 XMSubNoVowel 1259 0.64 0.56 0.68 162 XM_B_REG_HTML 1238 0.63 0.56 0.67 163 TR_MetaPhish_Combo_01 1233 0.70 0.75 0.67 164 RELAYCOUNTRY_AU 1218 1.12 1.93 0.66 165 FILL_THIS_FORM 1205 0.52 0.29 0.65 166 XMPhish14 1202 0.74 0.89 0.65 167 XMBody_17 1182 3.10 7.41 0.64 168 XMSubMetaSxObfu_02 1179 0.49 0.24 0.64 169 T_XMHurry_00 1157 1.26 2.36 0.62 170 TR_XM_SpammyWords2 1133 6.63 17.15 0.61 171 DIET_1 1126 0.71 0.90 0.61 172 RDNS_DYNAMIC 1109 0.75 1.02 0.60 173 PLING_QUERY 1043 0.74 1.04 0.56 174 XMSolicitRefs_0 1034 0.48 0.36 0.56 175 HTTPS_HTTP_MISMATCH 1016 0.79 1.21 0.55 176 FILL_THIS_FORM_LONG 1006 0.41 0.19 0.54 177 XMGenDplmaNmb 1003 0.59 0.69 0.54 178 XM_DIRTYINTL 999 0.86 1.42 0.54 179 HTML_FONT_FACE_BAD 992 0.72 1.03 0.54 180 TRACKER_ID 953 0.36 0.08 0.51 181 XMSubMetaI_00 945 0.65 0.88 0.51 182 NML_ADSP_CUSTOM_MED 908 0.47 0.43 0.49 183 T_TooManySym_04 899 0.36 0.14 0.49 184 FORGED_GMAIL_RCVD 884 0.46 0.42 0.48 185 DATE_IN_PAST_06_12 882 0.35 0.13 0.48 186 T_FILL_THIS_FORM_SHORT 880 2.61 6.34 0.47 187 TR_LOTS_OF_MONEY2 878 0.49 0.52 0.47 188 T_MONEY_PERCENT 878 0.49 0.52 0.47 189 XMBrknScrpt_02 866 0.62 0.88 0.47 190 HELO_NO_DOMAIN 856 0.57 0.77 0.46 191 HELO_NODOT 856 0.57 0.77 0.46 192 T_XMDrugObfuBody_00 855 0.70 1.12 0.46 193 SpammyFromTLD_01 814 1.40 3.09 0.44 194 XMCapTrack 790 0.43 0.45 0.43 195 XM_S_SubURI 789 0.28 0.03 0.43 196 XMNoVowels 751 0.42 0.45 0.41 197 DKIM_ADSP_NXDOMAIN 732 0.42 0.46 0.39 198 CTE_8BIT_MISMATCH 730 0.25 0.01 0.39 199 HTML_TAG_BALANCE_BODY 715 1.15 2.49 0.39 200 XMSolicitRefs_4 713 0.28 0.10 0.38 ----------------------------------------------------------------------