Email: 292810 Autolearn: 0 AvgScore: 4.04 AvgScanTime: 1.10 sec Spam: 93461 Autolearn: 0 AvgScore: 13.59 AvgScanTime: 1.17 sec Ham: 199349 Autolearn: 0 AvgScore: -0.44 AvgScanTime: 1.06 sec Time Spent Running SA: 89.35 hours Time Spent Processing Spam: 30.42 hours Time Spent Processing Ham: 58.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 86804 86.16 92.88 83.01 2 DKIM_SIGNED 86221 75.97 92.25 68.33 3 XM_DK_Pass 83102 74.27 88.92 67.40 4 DKIM_VALID 82060 73.63 87.80 66.98 5 XM_B_Unicode 79387 77.17 84.94 73.53 6 T_SCC_BODY_TEXT_LINE 73418 82.00 78.55 83.61 7 RELAYCOUNTRY_US 72419 72.65 77.49 70.38 8 XMListUnsubscribeExists 71263 58.05 76.25 49.52 9 XM_B_SpammyWords 67532 50.38 72.26 40.13 10 DCC_CHECK 65113 46.50 69.67 35.64 11 DKIM_VALID_AU 63026 61.07 67.44 58.09 12 XM_DK_Undo_02 44028 19.42 47.11 6.43 13 XM_B_Unicode3 42421 41.61 45.39 39.84 14 XM_B_SpammyWords2 38070 25.17 40.73 17.88 15 LOC_TINY_FONT_1 36665 31.00 39.23 27.14 16 BAYES_99 35025 15.78 37.48 5.61 17 TR_XM_DKIM_Undo 34236 13.53 36.63 2.70 18 HTML_FONT_LOW_CONTRAST 33258 37.32 35.58 38.13 19 BAYES_50 31982 53.18 34.22 62.07 20 FVGT_m_MULTI_ODD 28522 26.16 30.52 24.11 21 DKIM_VALID_EF 28380 27.57 30.37 26.26 22 DCC_CHECK_NEGATIVE 28330 53.47 30.31 64.33 23 BAYES_999 27706 12.44 29.64 4.38 24 MIME_HTML_ONLY 27675 22.06 29.61 18.52 25 RCVD_IN_MSPIKE_H2 25498 25.25 27.28 24.30 26 T_KAM_HTML_FONT_INVALID 24920 20.08 26.66 16.99 27 TR_DCC_Bayes_99 24551 9.78 26.27 2.05 28 TR_XM_DK_Unsub 21638 17.17 23.15 14.36 29 RELAYCOUNTRY_META 20367 9.37 21.79 3.55 30 T_TM2_M_HEADER_IN_MSG 20245 19.56 21.66 18.58 31 XMSubLong 18864 20.66 20.18 20.89 32 XM_Multi_Part_URI 16958 21.46 18.14 23.01 33 TR_XM_SpammyRelay 16878 7.22 18.06 2.13 34 TR_XM_SpammyWords2 14081 5.17 15.07 0.54 35 TR_MAX_INTL_RELAY 13818 9.51 14.78 7.04 36 UNPARSEABLE_RELAY 13019 11.68 13.93 10.63 37 RCVD_IN_BL_SPAMCOP_NET 12818 4.84 13.71 0.68 38 XM_B_SpammyWords3 12323 7.54 13.19 4.90 39 XM_B_Unsub 12212 9.30 13.07 7.53 40 RELAYCOUNTRY_CA 11990 5.10 12.83 1.48 41 BOTNET_IPINHOSTNAME 11848 7.64 12.68 5.28 42 TR_XM_BayesUnsub 11782 8.39 12.61 6.42 43 TR_XM_SPAMCOP 10187 3.68 10.90 0.29 44 LOTS_OF_MONEY 9451 6.17 10.11 4.32 45 RCVD_IN_MSPIKE_H3 8873 6.74 9.49 5.45 46 RCVD_IN_MSPIKE_WL 8873 6.74 9.49 5.45 47 XM_Body_Dirty_Words 8638 5.85 9.24 4.27 48 BAYES_80 8426 5.70 9.02 4.15 49 XM_UncommonTLD01 8422 5.91 9.01 4.45 50 TR_XM_SpammyWords4 8402 4.88 8.99 2.95 51 XM_Evil_Numbers_Gen 7641 7.77 8.18 7.58 52 TR_XM_UnparsRelay 7396 3.76 7.91 1.81 53 BOTNET 7328 3.28 7.84 1.14 54 BAYES_60 7274 9.30 7.78 10.01 55 HTML_IMAGE_RATIO_02 7192 6.25 7.70 5.58 56 XMBody_17 7090 2.89 7.59 0.68 57 XMNumbers 6505 4.36 6.96 3.14 58 XMSubMetaSx_00 6379 5.00 6.83 4.15 59 UNTRUSTED_Relay 6173 3.20 6.60 1.60 60 TooManyTo_001 5729 5.87 6.13 5.74 61 MPART_ALT_DIFF 5650 11.36 6.05 13.86 62 HTML_IMAGE_RATIO_04 5646 5.61 6.04 5.40 63 XMSexyCombo_05 5530 3.61 5.92 2.52 64 TR_XM_PHPForged 5354 1.98 5.73 0.23 65 TR_XM_PHPDW 5318 1.97 5.69 0.23 66 FSL_BULK_SIG 5274 3.95 5.64 3.16 67 TR_XM_FormFill2 5242 1.94 5.61 0.22 68 XM_H_PHPOS 5218 1.92 5.58 0.20 69 XM_SPF_SoftFail 5163 3.11 5.52 1.98 70 SpammyFromTLD_01 5091 2.09 5.45 0.52 71 LotsOfNums_01 4981 6.31 5.33 6.76 72 BAYES_95 4952 3.66 5.30 2.89 73 XM_H_GMP 4796 6.20 5.13 6.69 74 TR_XM_SpammyWords5 4751 2.49 5.08 1.27 75 T_FILL_THIS_FORM_SHORT 4688 1.93 5.02 0.48 76 XM_H_Long_From01 4604 4.47 4.93 4.25 77 MIME_HTML_MOSTLY 4447 10.20 4.76 12.75 78 DKIM_INVALID 4161 2.34 4.45 1.35 79 T_XMDrugObfuBody_14 4068 2.34 4.35 1.40 80 XMStrtUSub 4065 5.55 4.35 6.11 81 XM_B_Phish_Phrases 3979 3.46 4.26 3.09 82 HTML_IMAGE_RATIO_06 3753 3.24 4.02 2.88 83 RCVD_IN_VALIDITY_SAFE 3744 6.33 4.01 7.42 84 TR_XM_PhishingBody 3683 2.83 3.94 2.31 85 XM_OfRef6 3513 1.70 3.76 0.74 86 TR_XM_BayesRelay 3296 1.13 3.53 0.00 87 XM_UB50 3255 1.72 3.48 0.90 88 XM_B_SpammyTLD 3199 3.68 3.42 3.79 89 XM_B_Investor 3098 1.80 3.31 1.09 90 XM_URI_RBL 3095 1.18 3.31 0.18 91 SCC_BODY_URI_ONLY 3076 3.49 3.29 3.58 92 MIME_HTML_ONLY_MULTI 3011 2.44 3.22 2.07 93 TR_XM_FormFill 2978 1.03 3.19 0.01 94 RCVD_IN_VALIDITY_CERTIFIED 2935 5.63 3.14 6.80 95 T_XMDrugObfuBody_08 2923 1.79 3.13 1.17 96 T_XMHurry_00 2885 1.61 3.09 0.92 97 TM2_M_BODY_EMPTY 2877 1.11 3.08 0.18 98 XMEmptyBody_01 2844 1.02 3.04 0.07 99 FONT_INVIS_LONG_LINE 2807 0.98 3.00 0.04 100 TM2_M_URI_OPT_OUT 2796 2.39 2.99 2.11 101 SUBJ_ALL_CAPS 2721 1.47 2.91 0.80 102 XM_CamelCaseFrm001 2612 2.15 2.79 1.84 103 HTML_IMAGE_RATIO_08 2542 2.11 2.72 1.82 104 TR_LOTS_OF_MONEY3 2325 0.91 2.49 0.18 105 USER_IN_DEF_DKIM_WL 2318 11.32 2.48 15.47 106 BAYES_20 2314 2.49 2.48 2.50 107 TR_XM_NoHeaderRelay 2297 0.84 2.46 0.09 108 TM2_M_VERY_LONG_WORD 2276 1.52 2.44 1.09 109 T_TooManySym_01 2271 4.85 2.43 5.98 110 RELAYCOUNTRY_AU 2237 1.03 2.39 0.39 111 XMBrknScrpt_02 2210 1.11 2.36 0.53 112 AC_BR_BONANZA 2157 0.86 2.31 0.18 113 BAYES_40 2130 3.38 2.28 3.89 114 HTML_TAG_BALANCE_BODY 2080 1.06 2.23 0.51 115 XM_HighProb1 2027 0.70 2.17 0.01 116 XM_B_SpammyWords4 1988 1.20 2.13 0.76 117 XM_B_Unsub2 1955 1.36 2.09 1.02 118 XMDiploma_00 1868 1.57 2.00 1.38 119 FROM_EXCESS_BASE64 1866 2.02 2.00 2.03 120 XMStockSpam_06 1845 1.67 1.97 1.53 121 XMSubMetaI_00 1732 1.42 1.85 1.22 122 XMReplyNow 1720 0.74 1.84 0.22 123 XM_H_PHPMailer 1681 1.05 1.80 0.69 124 THIS_AD 1672 0.93 1.79 0.53 125 KHOP_HELO_FCRDNS 1667 0.90 1.78 0.48 126 BOTNET_NORDNS 1644 0.57 1.76 0.02 127 MAILING_LIST_MULTI 1639 1.99 1.75 2.10 128 XM_DIRTYINTL 1628 0.64 1.74 0.12 129 URI_HEX 1599 1.16 1.71 0.90 130 HK_RANDOM_REPLYTO 1570 0.60 1.68 0.10 131 TR_XM_InvalidRelay 1566 0.55 1.68 0.02 132 MIME_QP_LONG_LINE 1559 2.52 1.67 2.92 133 T_REMOTE_IMAGE 1527 2.32 1.63 2.64 134 SHOPIFY_IMG_NOT_RCVD_SFY 1523 0.75 1.63 0.34 135 DIET_1 1493 0.90 1.60 0.57 136 XMBdyGiftCard01 1433 1.22 1.53 1.07 137 TR_Mismatch_TLD_02 1420 0.57 1.52 0.12 138 XMPhish30 1373 1.31 1.47 1.24 139 URI_NOVOWEL 1364 1.17 1.46 1.03 140 SpammyFromTLD_02 1295 0.58 1.39 0.21 141 HTML_MIME_NO_HTML_TAG 1259 1.31 1.35 1.29 142 XMClaimOffer 1231 0.59 1.32 0.25 143 XM_DK_Undo_01 1204 1.48 1.29 1.57 144 ALL_TRUSTED 1179 18.25 1.26 26.22 145 XM_SendGrid 1171 1.19 1.25 1.16 146 T_XMDrugObfuBody_10 1132 0.40 1.21 0.03 147 TR_XM_INV_DKIM 1119 0.42 1.20 0.06 148 T_XMDrugObfuBody_00 1113 0.58 1.19 0.29 149 URI_TRY_3LD 1110 0.89 1.19 0.76 150 XM_H_PHPOS_M 1108 0.42 1.19 0.07 151 HTTPS_HTTP_MISMATCH 1108 0.66 1.19 0.42 152 BOUNCE_MESSAGE 1095 4.18 1.17 5.58 153 ANY_BOUNCE_MESSAGE 1095 4.18 1.17 5.58 154 DKIM_ADSP_CUSTOM_MED 1087 0.96 1.16 0.86 155 RDNS_DYNAMIC 1080 0.59 1.16 0.32 156 URIBL_DBL_SPAM 1066 0.37 1.14 0.00 157 TR_Caps_n_Bayes_99 1054 0.37 1.13 0.01 158 MPART_ALT_DIFF_COUNT 1031 0.89 1.10 0.79 159 TR_Mismatch_TLD_01 1020 0.52 1.09 0.26 160 TVD_RCVD_IP 1012 1.84 1.08 2.20 161 NML_ADSP_CUSTOM_MED 1011 0.71 1.08 0.54 162 XM_H_Long_From02 991 1.00 1.06 0.97 163 RCVD_IN_PSBL 988 0.60 1.06 0.38 164 TM2_M_OBFU_COMMENT 978 0.57 1.05 0.35 165 XM_UB99 960 0.33 1.03 0.00 166 FORGED_GMAIL_RCVD 959 0.70 1.03 0.54 167 HELO_NODOT 953 0.52 1.02 0.29 168 HELO_NO_DOMAIN 950 0.52 1.02 0.29 169 XM_RXBody 940 1.03 1.01 1.04 170 XMSexyCombo_01 937 0.45 1.00 0.20 171 FSL_HELO_NON_FQDN_1 925 0.32 0.99 0.00 172 HELO_DYNAMIC_SPLIT_IP 921 0.32 0.99 0.00 173 RCVD_IN_RP_SAFE 917 1.27 0.98 1.41 174 TR_MetaPhish_Combo_01 902 0.72 0.97 0.60 175 XM_B_Phish66 897 0.47 0.96 0.24 176 RCVD_IN_VALIDITY_RPBL 893 0.34 0.96 0.06 177 TR_Symld_Words 874 0.89 0.94 0.86 178 XM_B_COPY_HTML 844 0.96 0.90 0.98 179 TR_XM_Base64_M1 819 0.72 0.88 0.65 180 T_STY_INVIS_DIRECT 818 0.38 0.88 0.15 181 PLING_QUERY 811 0.50 0.87 0.33 182 TooManyTo_002 795 1.13 0.85 1.27 183 T_MONEY_PERCENT 785 0.35 0.84 0.12 184 TR_LOTS_OF_MONEY2 785 0.35 0.84 0.12 185 BAYES_05 783 2.09 0.84 2.68 186 XM_H_Undi_Recip 767 0.33 0.82 0.10 187 XMGenDplmaNmb 766 0.52 0.82 0.38 188 TR_XM_DK_SendGrid 763 0.83 0.82 0.84 189 XM_Combo_Sbj 759 0.38 0.81 0.18 190 RCVD_IN_IADB_LISTED 754 1.84 0.81 2.33 191 TooManyTo_003 752 0.74 0.80 0.71 192 XM_UB999 750 0.26 0.80 0.00 193 RCVD_IN_RP_CERTIFIED 742 1.13 0.79 1.28 194 XM_ProductURIs 741 0.71 0.79 0.67 195 HTML_TITLE_SUBJ_DIFF 731 0.26 0.78 0.02 196 SUBJ_DOLLARS 730 0.54 0.78 0.42 197 XMHTML_After_End 728 0.52 0.78 0.41 198 HTML_FONT_FACE_BAD 727 0.50 0.78 0.37 199 TooManyTo_004 722 0.63 0.77 0.56 200 XMPhish14 716 0.56 0.77 0.47 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 166676 82.00 78.55 83.61 2 HTML_MESSAGE 165470 86.16 92.88 83.01 3 XM_B_Unicode 146575 77.17 84.94 73.53 4 RELAYCOUNTRY_US 140309 72.65 77.49 70.38 5 DKIM_SIGNED 136218 75.97 92.25 68.33 6 XM_DK_Pass 134366 74.27 88.92 67.40 7 DKIM_VALID 133526 73.63 87.80 66.98 8 DCC_CHECK_NEGATIVE 128247 53.47 30.31 64.33 9 BAYES_50 123738 53.18 34.22 62.07 10 DKIM_VALID_AU 115803 61.07 67.44 58.09 11 XMListUnsubscribeExists 98719 58.05 76.25 49.52 12 XM_B_SpammyWords 79992 50.38 72.26 40.13 13 XM_B_Unicode3 79427 41.61 45.39 39.84 14 HTML_FONT_LOW_CONTRAST 76012 37.32 35.58 38.13 15 DCC_CHECK 71057 46.50 69.67 35.64 16 LOC_TINY_FONT_1 54109 31.00 39.23 27.14 17 DKIM_VALID_EF 52355 27.57 30.37 26.26 18 ALL_TRUSTED 52271 18.25 1.26 26.22 19 RCVD_IN_MSPIKE_H2 48446 25.25 27.28 24.30 20 FVGT_m_MULTI_ODD 48067 26.16 30.52 24.11 21 XM_Multi_Part_URI 45869 21.46 18.14 23.01 22 XMSubLong 41639 20.66 20.18 20.89 23 T_TM2_M_HEADER_IN_MSG 37030 19.56 21.66 18.58 24 MIME_HTML_ONLY 36911 22.06 29.61 18.52 25 XM_B_SpammyWords2 35634 25.17 40.73 17.88 26 T_KAM_HTML_FONT_INVALID 33875 20.08 26.66 16.99 27 USER_IN_DEF_DKIM_WL 30840 11.32 2.48 15.47 28 TR_XM_DK_Unsub 28629 17.17 23.15 14.36 29 MPART_ALT_DIFF 27621 11.36 6.05 13.86 30 MIME_HTML_MOSTLY 25415 10.20 4.76 12.75 31 XM_DKIMWhitelistDomains 21202 7.25 0.01 10.64 32 UNPARSEABLE_RELAY 21191 11.68 13.93 10.63 33 BAYES_60 19946 9.30 7.78 10.01 34 HTML_OBFUSCATE_20_30 16749 5.75 0.09 8.40 35 XM_Evil_Numbers_Gen 15105 7.77 8.18 7.58 36 XM_B_Unsub 15016 9.30 13.07 7.53 37 RCVD_IN_VALIDITY_SAFE 14795 6.33 4.01 7.42 38 TR_MAX_INTL_RELAY 14031 9.51 14.78 7.04 39 RCVD_IN_VALIDITY_CERTIFIED 13548 5.63 3.14 6.80 40 LotsOfNums_01 13485 6.31 5.33 6.76 41 XM_H_GMP 13344 6.20 5.13 6.69 42 XM_DK_Undo_02 12824 19.42 47.11 6.43 43 TR_XM_BayesUnsub 12791 8.39 12.61 6.42 44 BAYES_00 12364 4.42 0.61 6.20 45 XMStrtUSub 12173 5.55 4.35 6.11 46 T_TooManySym_01 11927 4.85 2.43 5.98 47 TooManyTo_001 11445 5.87 6.13 5.74 48 BAYES_99 11186 15.78 37.48 5.61 49 BOUNCE_MESSAGE 11131 4.18 1.17 5.58 50 ANY_BOUNCE_MESSAGE 11131 4.18 1.17 5.58 51 HTML_IMAGE_RATIO_02 11121 6.25 7.70 5.58 52 RCVD_IN_MSPIKE_H3 10858 6.74 9.49 5.45 53 RCVD_IN_MSPIKE_WL 10858 6.74 9.49 5.45 54 HTML_IMAGE_RATIO_04 10770 5.61 6.04 5.40 55 BOTNET_IPINHOSTNAME 10520 7.64 12.68 5.28 56 TR_XM_DK_Bayes 10190 3.64 0.51 5.11 57 TR_XM_DK_Bayes1 10114 3.60 0.45 5.07 58 XM_B_SpammyWords3 9761 7.54 13.19 4.90 59 IN_ZIMBRA_NJ_WHITELIST 9102 3.12 0.05 4.57 60 TR_XM_DK_Bayes2 9002 3.20 0.40 4.52 61 XM_UncommonTLD01 8869 5.91 9.01 4.45 62 BAYES_999 8725 12.44 29.64 4.38 63 LOTS_OF_MONEY 8603 6.17 10.11 4.32 64 XM_Body_Dirty_Words 8506 5.85 9.24 4.27 65 XM_H_Long_From01 8478 4.47 4.93 4.25 66 BAYES_80 8274 5.70 9.02 4.15 67 XMSubMetaSx_00 8264 5.00 6.83 4.15 68 BAYES_40 7760 3.38 2.28 3.89 69 XM_B_SpammyTLD 7564 3.68 3.42 3.79 70 SCC_BODY_URI_ONLY 7131 3.49 3.29 3.58 71 RELAYCOUNTRY_META 7078 9.37 21.79 3.55 72 INVALID_MSGID 6889 2.44 0.27 3.46 73 T_TooManySym_02 6833 2.55 0.68 3.43 74 FSL_BULK_SIG 6292 3.95 5.64 3.16 75 XMNumbers 6269 4.36 6.96 3.14 76 TO_MALFORMED 6243 2.20 0.21 3.13 77 XM_B_Phish_Phrases 6165 3.46 4.26 3.09 78 TR_XM_SpammyWords4 5873 4.88 8.99 2.95 79 MIME_QP_LONG_LINE 5827 2.52 1.67 2.92 80 BAYES_95 5755 3.66 5.30 2.89 81 HTML_IMAGE_RATIO_06 5743 3.24 4.02 2.88 82 TR_XM_DKIM_Undo 5383 13.53 36.63 2.70 83 BAYES_05 5347 2.09 0.84 2.68 84 T_REMOTE_IMAGE 5257 2.32 1.63 2.64 85 XMSexyCombo_05 5030 3.61 5.92 2.52 86 BAYES_20 4979 2.49 2.48 2.50 87 RCVD_IN_IADB_LISTED 4645 1.84 0.81 2.33 88 TR_XM_PhishingBody 4607 2.83 3.94 2.31 89 TVD_RCVD_IP 4389 1.84 1.08 2.20 90 TR_XM_SpammyRelay 4252 7.22 18.06 2.13 91 TM2_M_URI_OPT_OUT 4209 2.39 2.99 2.11 92 RCVD_IN_IADB_SPF 4185 1.66 0.74 2.10 93 MAILING_LIST_MULTI 4182 1.99 1.75 2.10 94 MIME_HTML_ONLY_MULTI 4125 2.44 3.22 2.07 95 TR_DCC_Bayes_99 4091 9.78 26.27 2.05 96 FROM_EXCESS_BASE64 4044 2.02 2.00 2.03 97 XM_SPF_SoftFail 3941 3.11 5.52 1.98 98 RCVD_IN_IADB_SENDERID 3876 1.55 0.70 1.94 99 XMBSHREFv2 3810 1.37 0.22 1.91 100 RCVD_IN_IADB_DK 3800 1.52 0.71 1.91 101 XM_CamelCaseFrm001 3670 2.15 2.79 1.84 102 HTML_IMAGE_RATIO_08 3633 2.11 2.72 1.82 103 TR_XM_UnparsRelay 3616 3.76 7.91 1.81 104 T_HTML_ATTACH 3520 1.24 0.13 1.77 105 XM_PDF 3324 1.22 0.26 1.67 106 UNTRUSTED_Relay 3194 3.20 6.60 1.60 107 XM_DK_Undo_01 3129 1.48 1.29 1.57 108 TVD_SPACE_RATIO 3124 1.10 0.09 1.57 109 IN_HORDE_ADDRESS_BOOK 3085 1.07 0.04 1.55 110 XMStockSpam_06 3050 1.67 1.97 1.53 111 XMBody_95 2986 1.05 0.10 1.50 112 XMGappySubj_01 2970 1.09 0.23 1.49 113 RELAYCOUNTRY_CA 2950 5.10 12.83 1.48 114 RCVD_IN_RP_SAFE 2816 1.27 0.98 1.41 115 T_XMDrugObfuBody_14 2784 2.34 4.35 1.40 116 RCVD_IN_IADB_VOUCHED 2761 1.05 0.34 1.39 117 XMDiploma_00 2743 1.57 2.00 1.38 118 DKIM_INVALID 2692 2.34 4.45 1.35 119 HTML_MIME_NO_HTML_TAG 2565 1.31 1.35 1.29 120 RCVD_IN_RP_CERTIFIED 2556 1.13 0.79 1.28 121 TR_XM_SpammyWords5 2531 2.49 5.08 1.27 122 TooManyTo_002 2525 1.13 0.85 1.27 123 XMGappySubj_02 2505 0.88 0.07 1.26 124 XMPhish30 2474 1.31 1.47 1.24 125 XMSubMetaI_00 2434 1.42 1.85 1.22 126 T_XMDrugObfuBody_08 2331 1.79 3.13 1.17 127 T_TooManySym_03 2326 0.91 0.38 1.17 128 XM_SendGrid 2318 1.19 1.25 1.16 129 MSGID_NOFQDN1 2299 0.80 0.04 1.15 130 BOTNET 2282 3.28 7.84 1.14 131 XM_GoogleGroups 2268 0.94 0.52 1.14 132 TM2_M_VERY_LONG_WORD 2177 1.52 2.44 1.09 133 XM_B_Investor 2169 1.80 3.31 1.09 134 XMBdyGiftCard01 2131 1.22 1.53 1.07 135 XM_RXBody 2081 1.03 1.01 1.04 136 URI_NOVOWEL 2049 1.17 1.46 1.03 137 XM_B_Unsub2 2034 1.36 2.09 1.02 138 XM_B_COPY_HTML 1962 0.96 0.90 0.98 139 XM_H_Long_From02 1927 1.00 1.06 0.97 140 RCVD_IN_IADB_OPTIN 1905 0.73 0.24 0.96 141 T_XMHurry_00 1826 1.61 3.09 0.92 142 URI_HEX 1791 1.16 1.71 0.90 143 XM_UB50 1786 1.72 3.48 0.90 144 USER_IN_WHITELIST 1737 0.59 0.00 0.87 145 USER_IN_WELCOMELIST 1737 0.59 0.00 0.87 146 TR_Symld_Words 1724 0.89 0.94 0.86 147 DKIM_ADSP_CUSTOM_MED 1715 0.96 1.16 0.86 148 TR_XM_DK_SendGrid 1680 0.83 0.82 0.84 149 XMSubNoVowel 1619 0.66 0.33 0.81 150 SUBJ_ALL_CAPS 1593 1.47 2.91 0.80 151 MPART_ALT_DIFF_COUNT 1576 0.89 1.10 0.79 152 XM_H_Trusted_IP 1532 0.52 0.00 0.77 153 XM_B_SpammyWords4 1523 1.20 2.13 0.76 154 URI_TRY_3LD 1508 0.89 1.19 0.76 155 XM_OfRef6 1473 1.70 3.76 0.74 156 TooManyTo_003 1412 0.74 0.80 0.71 157 XM_H_PHPMailer 1385 1.05 1.80 0.69 158 RCVD_IN_BL_SPAMCOP_NET 1364 4.84 13.71 0.68 159 XMSubMetaSxObfu_02 1363 0.60 0.42 0.68 160 XMBody_17 1361 2.89 7.59 0.68 161 XM_ProductURIs 1339 0.71 0.79 0.67 162 TR_XM_Base64_M1 1296 0.72 0.88 0.65 163 TR_MetaPhish_Combo_01 1197 0.72 0.97 0.60 164 DIET_1 1144 0.90 1.60 0.57 165 TooManyTo_004 1124 0.63 0.77 0.56 166 FORGED_GMAIL_RCVD 1077 0.70 1.03 0.54 167 NML_ADSP_CUSTOM_MED 1075 0.71 1.08 0.54 168 TR_XM_SpammyWords2 1070 5.17 15.07 0.54 169 THIS_AD 1065 0.93 1.79 0.53 170 XMBrknScrpt_02 1048 1.11 2.36 0.53 171 SpammyFromTLD_01 1036 2.09 5.45 0.52 172 HTML_TAG_BALANCE_BODY 1013 1.06 2.23 0.51 173 XMSolicitRefs_0 1007 0.49 0.44 0.51 174 KHOP_HELO_FCRDNS 966 0.90 1.78 0.48 175 T_FILL_THIS_FORM_SHORT 966 1.93 5.02 0.48 176 TooManyTo_005 952 0.57 0.76 0.48 177 XMPhish14 932 0.56 0.77 0.47 178 XMLngstWrd_00 927 0.51 0.60 0.47 179 XMNoVowels 898 0.41 0.31 0.45 180 T_TooManySym_04 865 0.35 0.18 0.43 181 SUBJ_DOLLARS 840 0.54 0.78 0.42 182 XM_Ancestry_Forge 839 0.29 0.01 0.42 183 HTTPS_HTTP_MISMATCH 835 0.66 1.19 0.42 184 XM_B_REG_HTML 822 0.40 0.38 0.41 185 XM_B_COVIDMETA 821 0.40 0.37 0.41 186 XMHTML_After_End 808 0.52 0.78 0.41 187 XM_S_SubURI 801 0.30 0.08 0.40 188 XM_B_DNDMA 779 0.44 0.53 0.39 189 RELAYCOUNTRY_AU 777 1.03 2.39 0.39 190 RCVD_IN_PSBL 766 0.60 1.06 0.38 191 XMGenDplmaNmb 765 0.52 0.82 0.38 192 HTML_FONT_FACE_BAD 730 0.50 0.78 0.37 193 CTE_8BIT_MISMATCH 723 0.26 0.03 0.36 194 TM2_M_OBFU_COMMENT 692 0.57 1.05 0.35 195 DKIM_ADSP_NXDOMAIN 689 0.38 0.47 0.35 196 SHOPIFY_IMG_NOT_RCVD_SFY 682 0.75 1.63 0.34 197 HTML_IMAGE_ONLY_20 669 0.38 0.48 0.34 198 NO_DNS_FOR_FROM 663 0.37 0.44 0.33 199 PLING_QUERY 659 0.50 0.87 0.33 200 RELAYCOUNTRY_GB 657 0.40 0.55 0.33 ----------------------------------------------------------------------