Email: 296083 Autolearn: 0 AvgScore: 4.55 AvgScanTime: 1.22 sec Spam: 110015 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 1.29 sec Ham: 186068 Autolearn: 0 AvgScore: -0.82 AvgScanTime: 1.18 sec Time Spent Running SA: 100.20 hours Time Spent Processing Spam: 39.33 hours Time Spent Processing Ham: 60.86 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102279 85.55 92.97 81.16 2 DKIM_SIGNED 100115 82.05 91.00 76.75 3 XM_DK_Pass 97606 80.55 88.72 75.72 4 DKIM_VALID 96606 79.93 87.81 75.27 5 XM_B_Unicode 91796 75.62 83.44 70.99 6 T_SCC_BODY_TEXT_LINE 87055 81.89 79.13 83.52 7 RELAYCOUNTRY_US 85464 78.94 77.68 79.69 8 XMListUnsubscribeExists 81669 62.41 74.23 55.41 9 DCC_CHECK 78534 50.29 71.38 37.82 10 XM_B_SpammyWords 77721 53.98 70.65 44.13 11 DKIM_VALID_AU 74340 65.89 67.57 64.89 12 XM_DK_Undo_02 51303 21.55 46.63 6.71 13 XM_B_Unicode3 47923 43.45 43.56 43.38 14 TR_MAX_INTL_RELAY 47571 21.21 43.24 8.19 15 XM_B_SpammyWords2 45950 27.41 41.77 18.92 16 LOC_TINY_FONT_1 44309 33.14 40.28 28.92 17 BAYES_99 40306 17.01 36.64 5.40 18 TR_XM_DKIM_Undo 39719 14.90 36.10 2.37 19 BAYES_50 39073 49.49 35.52 57.75 20 HTML_FONT_LOW_CONTRAST 38853 33.92 35.32 33.10 21 FVGT_m_MULTI_ODD 35189 28.32 31.99 26.15 22 DKIM_VALID_EF 34507 30.29 31.37 29.65 23 MIME_HTML_ONLY 34210 25.05 31.10 21.48 24 T_KAM_HTML_FONT_INVALID 31897 23.72 28.99 20.60 25 BAYES_999 31523 13.28 28.65 4.19 26 DCC_CHECK_NEGATIVE 31463 49.68 28.60 62.15 27 TR_DCC_Bayes_99 28675 11.07 26.06 2.21 28 RCVD_IN_MSPIKE_H2 27349 25.01 24.86 25.10 29 TR_XM_DK_Unsub 26152 18.71 23.77 15.72 30 T_TM2_M_HEADER_IN_MSG 24620 22.14 22.38 22.00 31 RELAYCOUNTRY_META 21754 9.91 19.77 4.08 32 XMSubLong 21676 21.11 19.70 21.94 33 XM_Multi_Part_URI 18824 16.57 17.11 16.26 34 TR_XM_SpammyRelay 18145 7.64 16.49 2.41 35 TR_XM_SpammyWords2 17064 6.04 15.51 0.43 36 XM_B_Unsub 16315 10.93 14.83 8.62 37 RCVD_IN_BL_SPAMCOP_NET 15920 5.94 14.47 0.89 38 TR_XM_BayesUnsub 15827 9.81 14.39 7.10 39 UNPARSEABLE_RELAY 15739 11.93 14.31 10.52 40 XM_B_SpammyWords3 13894 7.81 12.63 4.97 41 RELAYCOUNTRY_CA 13440 5.54 12.22 1.59 42 BOTNET_IPINHOSTNAME 13173 8.19 11.97 5.95 43 TR_XM_SPAMCOP 12251 4.42 11.14 0.45 44 LOTS_OF_MONEY 11279 7.03 10.25 5.13 45 RCVD_IN_MSPIKE_WL 10441 7.30 9.49 6.00 46 RCVD_IN_MSPIKE_H3 10441 7.30 9.49 6.00 47 XM_Body_Dirty_Words 10293 5.87 9.36 3.81 48 BAYES_80 9803 6.34 8.91 4.81 49 HTML_IMAGE_RATIO_02 9409 7.33 8.55 6.60 50 FSL_BULK_SIG 9197 5.07 8.36 3.12 51 XM_Evil_Numbers_Gen 9110 7.85 8.28 7.59 52 TR_XM_SpammyWords4 9014 5.14 8.19 3.34 53 TR_XM_UnparsRelay 8725 4.01 7.93 1.69 54 BAYES_60 8704 9.90 7.91 11.08 55 XM_UncommonTLD01 8557 5.98 7.78 4.92 56 XMBody_17 8470 3.37 7.70 0.82 57 UNTRUSTED_Relay 8158 3.83 7.42 1.71 58 BOTNET 7810 3.41 7.10 1.23 59 BAYES_95 6892 4.07 6.26 2.78 60 LotsOfNums_01 6700 6.92 6.09 7.41 61 MPART_ALT_DIFF 6556 4.86 5.96 4.21 62 TooManyTo_001 6168 6.70 5.61 7.34 63 XM_H_Long_From01 5915 5.22 5.38 5.13 64 XMNumbers 5717 3.92 5.20 3.17 65 T_FILL_THIS_FORM_SHORT 5613 2.28 5.10 0.61 66 XM_SPF_SoftFail 5592 3.49 5.08 2.55 67 SpammyFromTLD_01 5516 2.26 5.01 0.64 68 HTML_IMAGE_RATIO_04 5382 4.86 4.89 4.84 69 XMSexyCombo_05 5370 3.00 4.88 1.89 70 TR_XM_PHPForged 5317 2.03 4.83 0.37 71 TR_XM_PHPDW 5301 2.01 4.82 0.35 72 XM_H_GMP 5282 6.67 4.80 7.78 73 MIME_HTML_MOSTLY 5281 3.38 4.80 2.54 74 TR_XM_FormFill2 5256 2.00 4.78 0.36 75 XM_H_PHPOS 5239 1.98 4.76 0.34 76 XM_OfRef6 5147 2.46 4.68 1.14 77 XMSubMetaSx_00 5121 4.44 4.65 4.31 78 XM_B_Phish_Phrases 4990 3.55 4.54 2.96 79 HTML_IMAGE_RATIO_08 4954 3.11 4.50 2.29 80 HTML_IMAGE_RATIO_06 4878 3.50 4.43 2.94 81 XM_UB50 4527 2.11 4.11 0.93 82 USER_IN_DEF_DKIM_WL 4493 12.28 4.08 17.13 83 T_XMDrugObfuBody_14 4429 2.71 4.03 1.92 84 XM_B_SpammyTLD 4235 3.08 3.85 2.62 85 RCVD_IN_VALIDITY_SAFE 4182 5.97 3.80 7.25 86 T_XMDrugObfuBody_08 4123 2.42 3.75 1.63 87 TR_XM_BayesRelay 4015 1.36 3.65 0.00 88 TM2_M_URI_OPT_OUT 3973 2.65 3.61 2.09 89 TR_XM_SpammyWords5 3924 2.03 3.57 1.12 90 XMStrtUSub 3795 5.12 3.45 6.11 91 TR_XM_FormFill 3794 1.29 3.45 0.01 92 FONT_INVIS_LONG_LINE 3780 1.33 3.44 0.08 93 MIME_HTML_ONLY_MULTI 3581 2.69 3.26 2.35 94 DKIM_INVALID 3509 2.12 3.19 1.48 95 TR_XM_PhishingBody 3426 2.53 3.11 2.18 96 XM_CamelCaseFrm001 3405 2.90 3.10 2.78 97 RCVD_IN_VALIDITY_CERTIFIED 3380 5.10 3.07 6.30 98 XM_B_Investor 3333 1.93 3.03 1.27 99 TM2_M_VERY_LONG_WORD 3219 1.99 2.93 1.44 100 XM_URI_RBL 3217 1.22 2.92 0.22 101 SCC_BODY_URI_ONLY 3129 3.35 2.84 3.66 102 XM_B_SpammyWords4 2985 1.41 2.71 0.64 103 TM2_M_BODY_EMPTY 2894 1.17 2.63 0.30 104 TR_LOTS_OF_MONEY3 2840 1.25 2.58 0.46 105 XMEmptyBody_01 2839 1.03 2.58 0.12 106 SUBJ_ALL_CAPS 2665 1.58 2.42 1.08 107 RELAYCOUNTRY_AU 2635 1.26 2.40 0.59 108 T_TooManySym_01 2609 4.94 2.37 6.46 109 FROM_EXCESS_BASE64 2460 2.67 2.24 2.93 110 T_XMHurry_00 2456 1.22 2.23 0.62 111 XMBdyGiftCard01 2402 1.49 2.18 1.08 112 KHOP_HELO_FCRDNS 2394 1.15 2.18 0.54 113 TR_XM_NoHeaderRelay 2352 0.86 2.14 0.11 114 XMDiploma_00 2187 1.63 1.99 1.41 115 XM_B_Unsub2 2106 1.52 1.91 1.28 116 URI_TRY_3LD 2070 1.22 1.88 0.83 117 XM_DIRTYINTL 2044 0.83 1.86 0.23 118 XMStockSpam_06 2037 1.18 1.85 0.79 119 XM_HighProb1 2013 0.68 1.83 0.00 120 URI_NOVOWEL 1939 1.40 1.76 1.19 121 HK_RANDOM_REPLYTO 1920 0.72 1.75 0.12 122 XM_DK_Undo_01 1869 1.71 1.70 1.72 123 XM_H_Long_From02 1863 1.48 1.69 1.35 124 T_REMOTE_IMAGE 1861 2.64 1.69 3.20 125 MIME_QP_LONG_LINE 1823 2.87 1.66 3.59 126 AC_BR_BONANZA 1820 0.71 1.65 0.15 127 HTML_TAG_BALANCE_BODY 1815 0.92 1.65 0.49 128 BAYES_20 1768 2.38 1.61 2.83 129 BAYES_40 1744 3.12 1.59 4.03 130 TR_Mismatch_TLD_02 1697 0.66 1.54 0.13 131 URI_HEX 1657 1.09 1.51 0.84 132 BOTNET_NORDNS 1598 0.55 1.45 0.01 133 RCVD_IN_PSBL 1552 0.92 1.41 0.63 134 XMReplyNow 1543 0.66 1.40 0.22 135 MPART_ALT_DIFF_COUNT 1527 1.08 1.39 0.90 136 XM_SendGrid 1519 1.31 1.38 1.27 137 MAILING_LIST_MULTI 1514 1.82 1.38 2.08 138 XM_H_Undi_Recip 1464 0.63 1.33 0.22 139 XM_H_PHPMailer 1454 0.98 1.32 0.78 140 XM_Combo_Sbj 1453 0.61 1.32 0.19 141 SpammyFromTLD_02 1434 0.60 1.30 0.19 142 XMPhish30 1426 1.01 1.30 0.85 143 TR_XM_InvalidRelay 1398 0.49 1.27 0.03 144 RDNS_DYNAMIC 1326 0.68 1.21 0.36 145 XM_OfRef7 1303 0.56 1.18 0.19 146 TR_MetaPhish_Combo_01 1285 0.90 1.17 0.74 147 SHOPIFY_IMG_NOT_RCVD_SFY 1269 0.72 1.15 0.47 148 ALL_TRUSTED 1222 10.87 1.11 16.63 149 URIBL_DBL_SPAM 1182 0.40 1.07 0.01 150 TR_XM_INV_DKIM 1180 0.44 1.07 0.07 151 BAYES_05 1161 2.17 1.06 2.83 152 TR_Caps_n_Bayes_99 1159 0.40 1.05 0.02 153 TVD_RCVD_IP 1141 1.98 1.04 2.54 154 XM_B_COPY_HTML 1134 0.92 1.03 0.85 155 XM_DrugUnitList 1115 0.38 1.01 0.00 156 HTTPS_HTTP_MISMATCH 1115 0.79 1.01 0.66 157 XM_UB99 1110 0.38 1.01 0.00 158 HELO_DYNAMIC_SPLIT_IP 1104 0.38 1.00 0.01 159 PDS_OTHER_BAD_TLD 1086 0.44 0.99 0.11 160 RCVD_IN_IADB_LISTED 1086 2.25 0.99 3.00 161 HTML_FONT_FACE_BAD 1081 0.70 0.98 0.53 162 TR_XM_DK_SendGrid 1071 0.90 0.97 0.86 163 XM_B_Crypto 1071 0.47 0.97 0.18 164 XMHTML_After_End 1062 0.82 0.97 0.74 165 BOUNCE_MESSAGE 1047 3.84 0.95 5.55 166 ANY_BOUNCE_MESSAGE 1047 3.84 0.95 5.55 167 XMSubMetaI_00 1045 0.63 0.95 0.44 168 DIET_1 1036 0.53 0.94 0.29 169 HTML_MIME_NO_HTML_TAG 1018 1.12 0.93 1.24 170 T_TooManySym_02 1017 2.74 0.92 3.81 171 GOOG_STO_IMG_NOHTML 1001 0.40 0.91 0.10 172 TooManyTo_002 1000 1.39 0.91 1.67 173 TM2_M_OBFU_COMMENT 990 0.52 0.90 0.30 174 T_XMDrugObfuBody_10 990 0.34 0.90 0.02 175 XM_ProductURIs 984 0.89 0.89 0.89 176 TR_Symld_Words 983 1.09 0.89 1.20 177 T_XMDrugObfuBody_00 976 0.73 0.89 0.63 178 XM_UB60 965 0.36 0.88 0.06 179 RCVD_IN_IADB_SPF 964 2.05 0.88 2.74 180 TR_XM_Undi_Recip5 962 0.33 0.87 0.00 181 XM_B_DNDMA 945 0.80 0.86 0.77 182 TR_XM_Undi_RecipCombo2 941 0.32 0.86 0.00 183 TR_XM_Base64_M1 934 0.95 0.85 1.01 184 RCVD_IN_VALIDITY_RPBL 933 0.34 0.85 0.04 185 TooManyTo_003 926 0.81 0.84 0.79 186 XMBody_78 926 0.58 0.84 0.42 187 THIS_AD 922 0.44 0.84 0.21 188 XMSexyCombo_01 922 0.43 0.84 0.19 189 SUBJ_DOLLARS 916 0.52 0.83 0.34 190 TR_Mismatch_TLD_01 912 0.51 0.83 0.32 191 RCVD_IN_IADB_DK 905 1.85 0.82 2.46 192 RCVD_IN_IADB_SENDERID 899 1.89 0.82 2.53 193 TooManyTo_004 898 0.68 0.82 0.60 194 RCVD_IN_RP_SAFE 890 1.20 0.81 1.44 195 TooManyTo_005 888 0.63 0.81 0.53 196 XM_H_PHPOS_M 885 0.33 0.80 0.06 197 FILL_THIS_FORM 865 0.65 0.79 0.56 198 XMSlimDrugH 865 0.46 0.79 0.26 199 XM_RXBody 864 0.51 0.79 0.34 200 DKIM_ADSP_CUSTOM_MED 861 0.82 0.78 0.85 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 155406 81.89 79.13 83.52 2 HTML_MESSAGE 151016 85.55 92.97 81.16 3 RELAYCOUNTRY_US 148275 78.94 77.68 79.69 4 DKIM_SIGNED 142816 82.05 91.00 76.75 5 XM_DK_Pass 140894 80.55 88.72 75.72 6 DKIM_VALID 140053 79.93 87.81 75.27 7 XM_B_Unicode 132092 75.62 83.44 70.99 8 DKIM_VALID_AU 120740 65.89 67.57 64.89 9 DCC_CHECK_NEGATIVE 115642 49.68 28.60 62.15 10 BAYES_50 107454 49.49 35.52 57.75 11 XMListUnsubscribeExists 103109 62.41 74.23 55.41 12 XM_B_SpammyWords 82103 53.98 70.65 44.13 13 XM_B_Unicode3 80720 43.45 43.56 43.38 14 DCC_CHECK 70375 50.29 71.38 37.82 15 HTML_FONT_LOW_CONTRAST 61583 33.92 35.32 33.10 16 DKIM_VALID_EF 55173 30.29 31.37 29.65 17 LOC_TINY_FONT_1 53819 33.14 40.28 28.92 18 FVGT_m_MULTI_ODD 48655 28.32 31.99 26.15 19 RCVD_IN_MSPIKE_H2 46705 25.01 24.86 25.10 20 T_TM2_M_HEADER_IN_MSG 40936 22.14 22.38 22.00 21 XMSubLong 40832 21.11 19.70 21.94 22 MIME_HTML_ONLY 39968 25.05 31.10 21.48 23 T_KAM_HTML_FONT_INVALID 38336 23.72 28.99 20.60 24 XM_B_SpammyWords2 35203 27.41 41.77 18.92 25 USER_IN_DEF_DKIM_WL 31876 12.28 4.08 17.13 26 ALL_TRUSTED 30950 10.87 1.11 16.63 27 XM_Multi_Part_URI 30246 16.57 17.11 16.26 28 TR_XM_DK_Unsub 29251 18.71 23.77 15.72 29 BAYES_60 20612 9.90 7.91 11.08 30 UNPARSEABLE_RELAY 19576 11.93 14.31 10.52 31 XM_DKIMWhitelistDomains 19404 6.57 0.04 10.43 32 XM_B_Unsub 16041 10.93 14.83 8.62 33 BAYES_00 15799 5.52 0.51 8.49 34 TR_MAX_INTL_RELAY 15236 21.21 43.24 8.19 35 XM_H_GMP 14475 6.67 4.80 7.78 36 XM_Evil_Numbers_Gen 14121 7.85 8.28 7.59 37 LotsOfNums_01 13779 6.92 6.09 7.41 38 TooManyTo_001 13661 6.70 5.61 7.34 39 TR_XM_DK_Bayes 13521 4.71 0.39 7.27 40 RCVD_IN_VALIDITY_SAFE 13485 5.97 3.80 7.25 41 TR_XM_DK_Bayes1 13462 4.69 0.39 7.23 42 TR_XM_BayesUnsub 13213 9.81 14.39 7.10 43 XM_DK_Undo_02 12491 21.55 46.63 6.71 44 HTML_IMAGE_RATIO_02 12282 7.33 8.55 6.60 45 T_TooManySym_01 12027 4.94 2.37 6.46 46 TR_XM_DK_Bayes2 11884 4.14 0.35 6.39 47 RCVD_IN_VALIDITY_CERTIFIED 11722 5.10 3.07 6.30 48 XMStrtUSub 11369 5.12 3.45 6.11 49 RCVD_IN_MSPIKE_WL 11169 7.30 9.49 6.00 50 RCVD_IN_MSPIKE_H3 11169 7.30 9.49 6.00 51 BOTNET_IPINHOSTNAME 11078 8.19 11.97 5.95 52 IN_ZIMBRA_NJ_WHITELIST 10499 3.57 0.07 5.64 53 ANY_BOUNCE_MESSAGE 10323 3.84 0.95 5.55 54 BOUNCE_MESSAGE 10323 3.84 0.95 5.55 55 BAYES_99 10046 17.01 36.64 5.40 56 LOTS_OF_MONEY 9547 7.03 10.25 5.13 57 XM_H_Long_From01 9540 5.22 5.38 5.13 58 XM_B_SpammyWords3 9244 7.81 12.63 4.97 59 XM_UncommonTLD01 9154 5.98 7.78 4.92 60 HTML_IMAGE_RATIO_04 9002 4.86 4.89 4.84 61 BAYES_80 8956 6.34 8.91 4.81 62 XMSubMetaSx_00 8021 4.44 4.65 4.31 63 MPART_ALT_DIFF 7833 4.86 5.96 4.21 64 BAYES_999 7788 13.28 28.65 4.19 65 RELAYCOUNTRY_META 7585 9.91 19.77 4.08 66 BAYES_40 7502 3.12 1.59 4.03 67 T_TooManySym_02 7092 2.74 0.92 3.81 68 XM_Body_Dirty_Words 7081 5.87 9.36 3.81 69 INVALID_MSGID 6853 2.38 0.18 3.68 70 SCC_BODY_URI_ONLY 6801 3.35 2.84 3.66 71 MIME_QP_LONG_LINE 6684 2.87 1.66 3.59 72 TO_MALFORMED 6289 2.12 0.00 3.38 73 TR_XM_SpammyWords4 6209 5.14 8.19 3.34 74 T_REMOTE_IMAGE 5962 2.64 1.69 3.20 75 XMNumbers 5902 3.92 5.20 3.17 76 FSL_BULK_SIG 5809 5.07 8.36 3.12 77 RCVD_IN_IADB_LISTED 5574 2.25 0.99 3.00 78 XM_B_Phish_Phrases 5514 3.55 4.54 2.96 79 HTML_IMAGE_RATIO_06 5472 3.50 4.43 2.94 80 FROM_EXCESS_BASE64 5458 2.67 2.24 2.93 81 BAYES_05 5266 2.17 1.06 2.83 82 BAYES_20 5265 2.38 1.61 2.83 83 XM_CamelCaseFrm001 5168 2.90 3.10 2.78 84 BAYES_95 5167 4.07 6.26 2.78 85 RCVD_IN_IADB_SPF 5100 2.05 0.88 2.74 86 XM_B_SpammyTLD 4882 3.08 3.85 2.62 87 XM_SPF_SoftFail 4746 3.49 5.08 2.55 88 MIME_HTML_MOSTLY 4722 3.38 4.80 2.54 89 TVD_RCVD_IP 4719 1.98 1.04 2.54 90 RCVD_IN_IADB_SENDERID 4704 1.89 0.82 2.53 91 RCVD_IN_IADB_DK 4578 1.85 0.82 2.46 92 TR_XM_SpammyRelay 4477 7.64 16.49 2.41 93 TR_XM_DKIM_Undo 4405 14.90 36.10 2.37 94 MIME_HTML_ONLY_MULTI 4373 2.69 3.26 2.35 95 HTML_IMAGE_RATIO_08 4264 3.11 4.50 2.29 96 XMBSHREFv2 4118 1.45 0.17 2.21 97 TR_DCC_Bayes_99 4112 11.07 26.06 2.21 98 TR_XM_PhishingBody 4057 2.53 3.11 2.18 99 TM2_M_URI_OPT_OUT 3883 2.65 3.61 2.09 100 MAILING_LIST_MULTI 3865 1.82 1.38 2.08 101 XM_PDF 3845 1.38 0.23 2.07 102 XMGappySubj_01 3657 1.31 0.20 1.97 103 T_XMDrugObfuBody_14 3581 2.71 4.03 1.92 104 XMSexyCombo_05 3510 3.00 4.88 1.89 105 IN_HORDE_ADDRESS_BOOK 3451 1.18 0.05 1.85 106 TVD_SPACE_RATIO 3368 1.19 0.15 1.81 107 XMBody_95 3341 1.19 0.17 1.80 108 XM_DK_Undo_01 3199 1.71 1.70 1.72 109 UNTRUSTED_Relay 3173 3.83 7.42 1.71 110 TR_XM_UnparsRelay 3139 4.01 7.93 1.69 111 RCVD_IN_IADB_VOUCHED 3123 1.22 0.44 1.68 112 XMGappySubj_02 3111 1.09 0.11 1.67 113 TooManyTo_002 3103 1.39 0.91 1.67 114 T_XMDrugObfuBody_08 3029 2.42 3.75 1.63 115 RELAYCOUNTRY_CA 2960 5.54 12.22 1.59 116 DKIM_INVALID 2763 2.12 3.19 1.48 117 TM2_M_VERY_LONG_WORD 2677 1.99 2.93 1.44 118 RCVD_IN_RP_SAFE 2675 1.20 0.81 1.44 119 XMDiploma_00 2627 1.63 1.99 1.41 120 XM_H_Long_From02 2512 1.48 1.69 1.35 121 XM_B_Unsub2 2384 1.52 1.91 1.28 122 XM_B_Investor 2367 1.93 3.03 1.27 123 XM_SendGrid 2357 1.31 1.38 1.27 124 RCVD_IN_RP_CERTIFIED 2345 1.03 0.63 1.26 125 HTML_MIME_NO_HTML_TAG 2301 1.12 0.93 1.24 126 MSGID_NOFQDN1 2295 0.78 0.01 1.23 127 BOTNET 2292 3.41 7.10 1.23 128 T_TooManySym_03 2272 0.88 0.30 1.22 129 TR_Symld_Words 2240 1.09 0.89 1.20 130 URI_NOVOWEL 2216 1.40 1.76 1.19 131 XM_GoogleGroups 2190 0.92 0.49 1.18 132 XM_OfRef6 2127 2.46 4.68 1.14 133 TR_XM_SpammyWords5 2084 2.03 3.57 1.12 134 RCVD_IN_IADB_OPTIN 2079 0.82 0.31 1.12 135 XMBdyGiftCard01 2009 1.49 2.18 1.08 136 SUBJ_ALL_CAPS 2009 1.58 2.42 1.08 137 USER_IN_WELCOMELIST 2000 0.68 0.00 1.07 138 USER_IN_WHITELIST 2000 0.68 0.00 1.07 139 TR_XM_Base64_M1 1874 0.95 0.85 1.01 140 XM_UB50 1728 2.11 4.11 0.93 141 MPART_ALT_DIFF_COUNT 1683 1.08 1.39 0.90 142 RCVD_IN_BL_SPAMCOP_NET 1663 5.94 14.47 0.89 143 XM_ProductURIs 1656 0.89 0.89 0.89 144 TR_XM_DK_SendGrid 1603 0.90 0.97 0.86 145 XM_B_COPY_HTML 1586 0.92 1.03 0.85 146 XMPhish30 1575 1.01 1.30 0.85 147 DKIM_ADSP_CUSTOM_MED 1573 0.82 0.78 0.85 148 URI_HEX 1566 1.09 1.51 0.84 149 URI_TRY_3LD 1547 1.22 1.88 0.83 150 XMBody_17 1520 3.37 7.70 0.82 151 TooManyTo_003 1471 0.81 0.84 0.79 152 XMStockSpam_06 1468 1.18 1.85 0.79 153 XM_H_PHPMailer 1455 0.98 1.32 0.78 154 XM_B_DNDMA 1429 0.80 0.86 0.77 155 XMHTML_After_End 1373 0.82 0.97 0.74 156 TR_MetaPhish_Combo_01 1373 0.90 1.17 0.74 157 XMSubMetaSxObfu_02 1311 0.57 0.35 0.70 158 HTTPS_HTTP_MISMATCH 1236 0.79 1.01 0.66 159 XMGenDplmaNmb 1204 0.63 0.59 0.65 160 XM_B_SpammyWords4 1197 1.41 2.71 0.64 161 SpammyFromTLD_01 1189 2.26 5.01 0.64 162 XM_Walgreens_Forge 1188 0.42 0.06 0.64 163 T_XMDrugObfuBody_00 1181 0.73 0.89 0.63 164 RCVD_IN_PSBL 1166 0.92 1.41 0.63 165 XM_B_FormFill 1164 0.40 0.03 0.63 166 T_XMHurry_00 1145 1.22 2.23 0.62 167 T_FILL_THIS_FORM_SHORT 1127 2.28 5.10 0.61 168 TooManyTo_004 1120 0.68 0.82 0.60 169 RELAYCOUNTRY_AU 1100 1.26 2.40 0.59 170 NML_ADSP_CUSTOM_MED 1056 0.60 0.67 0.57 171 FILL_THIS_FORM 1050 0.65 0.79 0.56 172 XMPhish08 1047 0.54 0.51 0.56 173 PLING_QUERY 1045 0.64 0.77 0.56 174 KHOP_HELO_FCRDNS 1007 1.15 2.18 0.54 175 HTML_FONT_FACE_BAD 988 0.70 0.98 0.53 176 TooManyTo_005 987 0.63 0.81 0.53 177 FORGED_GMAIL_RCVD 971 0.57 0.66 0.52 178 XM_Ancestry_Forge 964 0.33 0.00 0.52 179 FONT_INVIS_POSTEXTRAS 942 0.33 0.03 0.51 180 XM_H_Trusted_IP 927 0.31 0.00 0.50 181 HTML_TAG_BALANCE_BODY 903 0.92 1.65 0.49 182 SHOPIFY_IMG_NOT_RCVD_SFY 875 0.72 1.15 0.47 183 XMSubNoVowel 873 0.44 0.40 0.47 184 XMLngstWrd_00 866 0.49 0.52 0.47 185 T_TooManySym_04 852 0.34 0.13 0.46 186 TR_LOTS_OF_MONEY3 851 1.25 2.58 0.46 187 TR_XM_SPAMCOP 838 4.42 11.14 0.45 188 TRACKER_ID 830 0.31 0.09 0.45 189 XMBrknScrpt_02 829 0.53 0.69 0.45 190 XMSubMetaI_00 828 0.63 0.95 0.44 191 XM_S_SubURI 827 0.29 0.03 0.44 192 XMPhish14 820 0.47 0.53 0.44 193 FILL_THIS_FORM_LONG 819 0.54 0.72 0.44 194 TR_XM_SpammyWords2 805 6.04 15.51 0.43 195 XM_B_REG_HTML 790 0.45 0.51 0.42 196 XMBody_78 777 0.58 0.84 0.42 197 XMNoVowels 738 0.33 0.22 0.40 198 DKIM_ADSP_NXDOMAIN 731 0.42 0.47 0.39 199 CTE_8BIT_MISMATCH 725 0.25 0.02 0.39 200 XMHTMLBadTable_001 709 0.43 0.52 0.38 ----------------------------------------------------------------------