Email: 325286 Autolearn: 0 AvgScore: 4.02 AvgScanTime: 1.12 sec Spam: 105459 Autolearn: 0 AvgScore: 13.06 AvgScanTime: 1.21 sec Ham: 219827 Autolearn: 0 AvgScore: -0.32 AvgScanTime: 1.07 sec Time Spent Running SA: 100.79 hours Time Spent Processing Spam: 35.52 hours Time Spent Processing Ham: 65.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 97946 86.46 92.88 83.38 2 DKIM_SIGNED 96205 79.78 91.23 74.28 3 XM_DK_Pass 93309 77.94 88.48 72.88 4 DKIM_VALID 92564 77.30 87.77 72.28 5 XM_B_Unicode 88796 76.69 84.20 73.09 6 RELAYCOUNTRY_US 85998 78.38 81.55 76.87 7 T_SCC_BODY_TEXT_LINE 83653 82.05 79.32 83.36 8 XMListUnsubscribeExists 77183 60.99 73.19 55.14 9 DCC_CHECK 73827 47.29 70.01 36.39 10 XM_B_SpammyWords 71111 49.66 67.43 41.14 11 DKIM_VALID_AU 70430 62.33 66.78 60.20 12 XM_B_Unicode3 49392 44.68 46.84 43.65 13 XM_DK_Undo_02 46601 19.16 44.19 7.15 14 LOC_TINY_FONT_1 44599 32.84 42.29 28.31 15 HTML_FONT_LOW_CONTRAST 40522 36.01 38.42 34.85 16 XM_B_SpammyWords2 39648 23.29 37.60 16.42 17 BAYES_50 38559 50.84 36.56 57.69 18 BAYES_99 36818 15.73 34.91 6.53 19 FVGT_m_MULTI_ODD 35271 29.71 33.45 27.91 20 TR_XM_DKIM_Undo 33345 11.86 31.62 2.38 21 RCVD_IN_MSPIKE_H2 31805 27.36 30.16 26.01 22 DCC_CHECK_NEGATIVE 31613 52.69 29.98 63.59 23 MIME_HTML_ONLY 29918 22.70 28.37 19.99 24 DKIM_VALID_EF 29228 28.31 27.72 28.59 25 BAYES_999 29161 12.49 27.65 5.21 26 T_KAM_HTML_FONT_INVALID 27931 22.00 26.49 19.85 27 TR_DCC_Bayes_99 25099 9.02 23.80 1.92 28 T_TM2_M_HEADER_IN_MSG 22880 22.17 21.70 22.40 29 XM_Multi_Part_URI 22219 18.29 21.07 16.96 30 XMSubLong 20671 21.28 19.60 22.08 31 TR_XM_DK_Unsub 20312 17.60 19.26 16.81 32 RELAYCOUNTRY_META 18772 8.75 17.80 4.41 33 UNPARSEABLE_RELAY 17000 13.33 16.12 12.00 34 TR_MAX_INTL_RELAY 15617 9.95 14.81 7.62 35 XM_B_Unsub 15001 9.84 14.22 7.73 36 BOTNET_IPINHOSTNAME 14842 7.94 14.07 5.00 37 TR_XM_BayesUnsub 14581 8.78 13.83 6.36 38 TR_XM_SpammyRelay 14202 5.98 13.47 2.39 39 TR_XM_SpammyWords2 12760 4.26 12.10 0.50 40 XM_B_SpammyWords3 11666 6.15 11.06 3.79 41 RCVD_IN_BL_SPAMCOP_NET 10987 3.91 10.42 0.79 42 XM_Body_Dirty_Words 10235 5.68 9.71 3.75 43 LOTS_OF_MONEY 10054 6.35 9.53 4.82 44 XM_Evil_Numbers_Gen 10008 8.75 9.49 8.39 45 BAYES_80 9870 6.14 9.36 4.59 46 TR_XM_UnparsRelay 9778 4.37 9.27 2.01 47 HTML_IMAGE_RATIO_02 9620 6.78 9.12 5.66 48 BOTNET 9382 3.60 8.90 1.05 49 XM_UncommonTLD01 8630 5.81 8.18 4.68 50 BAYES_60 8587 9.88 8.14 10.71 51 TR_XM_SpammyWords4 8566 4.98 8.12 3.47 52 RELAYCOUNTRY_CA 8490 3.60 8.05 1.47 53 TR_XM_SPAMCOP 7999 2.74 7.58 0.42 54 XMNumbers 7823 4.78 7.42 3.51 55 FSL_BULK_SIG 7368 4.30 6.99 3.01 56 UNTRUSTED_Relay 7319 3.65 6.94 2.07 57 XMSubMetaSx_00 7211 5.23 6.84 4.45 58 HTML_IMAGE_RATIO_04 6610 5.53 6.27 5.17 59 XM_SPF_SoftFail 6539 3.60 6.20 2.35 60 TooManyTo_001 6494 6.55 6.16 6.74 61 XMBody_17 6263 2.30 5.94 0.55 62 RCVD_IN_MSPIKE_H3 5905 5.78 5.60 5.86 63 RCVD_IN_MSPIKE_WL 5905 5.78 5.60 5.86 64 LotsOfNums_01 5869 7.24 5.57 8.05 65 MPART_ALT_DIFF 5848 6.72 5.55 7.28 66 TR_XM_SpammyWords5 5626 2.79 5.33 1.57 67 TR_XM_PHPForged 5562 2.10 5.27 0.57 68 TR_XM_PHPDW 5416 2.04 5.14 0.56 69 XM_H_Long_From01 5410 5.15 5.13 5.15 70 TR_XM_FormFill2 5379 2.04 5.10 0.58 71 XM_H_PHPOS 5360 2.02 5.08 0.55 72 BAYES_95 5255 3.66 4.98 3.03 73 XMSexyCombo_05 5231 2.91 4.96 1.92 74 XM_H_GMP 5135 6.16 4.87 6.78 75 SpammyFromTLD_01 4617 1.89 4.38 0.69 76 MIME_HTML_MOSTLY 4406 4.98 4.18 5.37 77 XMStrtUSub 4380 4.44 4.15 4.58 78 TR_XM_PhishingBody 4314 2.61 4.09 1.91 79 T_XMDrugObfuBody_14 4004 2.35 3.80 1.65 80 HTML_IMAGE_RATIO_06 3995 2.83 3.79 2.37 81 XM_B_SpammyTLD 3864 2.95 3.66 2.61 82 XM_B_Phish_Phrases 3863 2.83 3.66 2.43 83 T_XMDrugObfuBody_08 3853 2.06 3.65 1.30 84 T_FILL_THIS_FORM_SHORT 3848 1.60 3.65 0.62 85 TM2_M_URI_OPT_OUT 3700 2.86 3.51 2.55 86 DKIM_INVALID 3641 2.47 3.45 2.00 87 XM_OfRef6 3639 1.80 3.45 1.01 88 XM_UB50 3504 1.91 3.32 1.24 89 SCC_BODY_URI_ONLY 3424 3.10 3.25 3.04 90 XM_B_Investor 3404 2.06 3.23 1.50 91 TM2_M_VERY_LONG_WORD 3380 1.91 3.21 1.29 92 XM_CamelCaseFrm001 3314 2.70 3.14 2.49 93 SUBJ_ALL_CAPS 3304 1.92 3.13 1.34 94 FROM_EXCESS_BASE64 3301 2.66 3.13 2.43 95 USER_IN_DEF_DKIM_WL 3078 10.40 2.92 13.99 96 MIME_HTML_ONLY_MULTI 3034 2.70 2.88 2.61 97 RCVD_IN_VALIDITY_SAFE 2986 4.79 2.83 5.73 98 BAYES_40 2938 4.04 2.79 4.64 99 TM2_M_BODY_EMPTY 2881 1.06 2.73 0.26 100 XM_URI_RBL 2855 0.97 2.71 0.14 101 XMEmptyBody_01 2844 0.92 2.70 0.07 102 TR_XM_NoHeaderRelay 2790 0.92 2.65 0.10 103 HTML_IMAGE_RATIO_08 2638 2.01 2.50 1.77 104 XM_B_Unsub2 2507 1.46 2.38 1.02 105 RELAYCOUNTRY_AU 2495 1.06 2.37 0.44 106 MIME_QP_LONG_LINE 2494 3.52 2.36 4.07 107 TR_XM_FormFill 2271 0.73 2.15 0.05 108 T_TooManySym_01 2240 4.84 2.12 6.15 109 RCVD_IN_VALIDITY_CERTIFIED 2191 4.11 2.08 5.09 110 XMSubMetaI_00 2177 1.44 2.06 1.14 111 BAYES_20 2159 2.69 2.05 2.99 112 T_REMOTE_IMAGE 2065 2.51 1.96 2.77 113 AC_BR_BONANZA 2012 0.68 1.91 0.08 114 URI_HEX 1993 1.47 1.89 1.27 115 T_XMHurry_00 1975 1.10 1.87 0.73 116 XMDiploma_00 1970 1.34 1.87 1.09 117 XM_B_SpammyWords4 1965 0.96 1.86 0.53 118 THIS_AD 1897 1.03 1.80 0.66 119 TR_LOTS_OF_MONEY3 1889 0.68 1.79 0.15 120 MAILING_LIST_MULTI 1874 2.50 1.78 2.84 121 XMSexyCombo_01 1867 0.75 1.77 0.26 122 XMBrknScrpt_02 1837 1.00 1.74 0.64 123 TR_XM_BayesRelay 1824 0.56 1.73 0.00 124 XMStockSpam_06 1807 1.53 1.71 1.44 125 BOTNET_NORDNS 1745 0.54 1.65 0.01 126 SpammyFromTLD_02 1730 0.67 1.64 0.20 127 XM_HighProb1 1719 0.53 1.63 0.00 128 HTML_TAG_BALANCE_BODY 1650 0.74 1.56 0.35 129 XM_DK_Undo_01 1648 1.52 1.56 1.50 130 BOUNCE_MESSAGE 1632 4.11 1.55 5.35 131 ANY_BOUNCE_MESSAGE 1632 4.11 1.55 5.35 132 SHOPIFY_IMG_NOT_RCVD_SFY 1628 0.84 1.54 0.51 133 XM_H_PHPMailer 1612 1.04 1.53 0.81 134 XM_SendGrid 1608 1.36 1.52 1.28 135 HTML_MIME_NO_HTML_TAG 1591 1.50 1.51 1.50 136 XM_H_Long_From02 1550 1.25 1.47 1.14 137 HTTPS_HTTP_MISMATCH 1536 0.87 1.46 0.59 138 ALL_TRUSTED 1513 13.38 1.43 19.11 139 XM_DIRTYINTL 1477 0.56 1.40 0.16 140 TR_XM_Spammywords 1469 0.64 1.39 0.28 141 XM_S_SpammyWords 1469 0.64 1.39 0.28 142 KHOP_HELO_FCRDNS 1458 0.89 1.38 0.65 143 TR_Caps_n_Bayes_99 1434 0.46 1.36 0.02 144 XMPhish30 1429 0.82 1.36 0.57 145 XM_B_COPY_HTML 1376 0.92 1.30 0.73 146 RDNS_DYNAMIC 1370 0.66 1.30 0.36 147 TR_XM_InvalidRelay 1368 0.44 1.30 0.03 148 RCVD_IN_IADB_LISTED 1335 2.85 1.27 3.61 149 RCVD_IN_VALIDITY_RPBL 1255 0.44 1.19 0.09 150 XM_UB99 1245 0.39 1.18 0.01 151 FONT_INVIS_LONG_LINE 1239 0.41 1.17 0.04 152 TR_Mismatch_TLD_02 1237 0.43 1.17 0.07 153 TR_XM_INV_DKIM 1228 0.41 1.16 0.05 154 XMBdyGiftCard01 1219 1.17 1.16 1.18 155 RCVD_IN_IADB_SPF 1212 2.58 1.15 3.26 156 XMSexyCombo_04 1205 0.41 1.14 0.06 157 TVD_RCVD_IP 1198 1.72 1.14 2.01 158 MPART_ALT_DIFF_COUNT 1197 0.89 1.14 0.77 159 XMReplyNow 1187 0.48 1.13 0.17 160 DKIM_ADSP_CUSTOM_MED 1185 0.97 1.12 0.89 161 RCVD_IN_IADB_DK 1181 2.34 1.12 2.92 162 RCVD_IN_IADB_SENDERID 1180 2.38 1.12 2.99 163 RCVD_IN_PSBL 1168 0.59 1.11 0.35 164 XM_H_Undi_Recip 1133 0.45 1.07 0.15 165 HELO_DYNAMIC_SPLIT_IP 1086 0.34 1.03 0.02 166 XMPhish14 1083 0.83 1.03 0.73 167 T_XMDrugObfuBody_10 1081 0.37 1.03 0.06 168 NML_ADSP_CUSTOM_MED 1040 0.73 0.99 0.61 169 HK_RANDOM_REPLYTO 1016 0.39 0.96 0.11 170 TR_Mismatch_TLD_01 1015 0.50 0.96 0.27 171 FORGED_GMAIL_RCVD 1013 0.66 0.96 0.51 172 URI_NOVOWEL 1001 1.21 0.95 1.33 173 DIET_1 994 0.50 0.94 0.28 174 XM_UB60 988 0.36 0.94 0.08 175 XMClaimOffer 976 0.70 0.93 0.59 176 XMGenDplmaNmb 975 0.57 0.92 0.39 177 TR_XM_Base64_M1 967 0.73 0.92 0.64 178 XM_H_PHPOS_M 967 0.36 0.92 0.10 179 XMPhish08 952 0.51 0.90 0.33 180 TooManyTo_002 933 1.65 0.88 2.01 181 XM_UB999 929 0.29 0.88 0.01 182 AC_HTML_NONSENSE_TAGS 917 0.29 0.87 0.01 183 XMSubGiftCard1 909 0.32 0.86 0.06 184 TR_MetaPhish_Combo_01 907 0.70 0.86 0.62 185 TM2_M_OBFU_COMMENT 881 0.44 0.84 0.25 186 HELO_NODOT 878 0.48 0.83 0.31 187 HELO_NO_DOMAIN 874 0.48 0.83 0.31 188 XM_ProductURIs 868 0.81 0.82 0.80 189 TooManyTo_003 864 1.03 0.82 1.14 190 XMLngstWrd_00 856 0.72 0.81 0.68 191 URI_TRY_3LD 855 0.83 0.81 0.84 192 TR_Symld_Words 851 1.07 0.81 1.19 193 TooManyTo_004 832 0.88 0.79 0.92 194 T_XMDrugObfuBody_00 827 0.52 0.78 0.40 195 TR_XM_DK_SendGrid 825 0.84 0.78 0.87 196 XMBody_29 823 0.32 0.78 0.10 197 MISSING_HEADERS 818 0.45 0.78 0.30 198 XM_B_Phish66 813 0.41 0.77 0.23 199 FSL_HELO_NON_FQDN_1 804 0.25 0.76 0.01 200 TooManyTo_005 803 0.80 0.76 0.82 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 183301 86.46 92.88 83.38 2 T_SCC_BODY_TEXT_LINE 183239 82.05 79.32 83.36 3 RELAYCOUNTRY_US 168971 78.38 81.55 76.87 4 DKIM_SIGNED 163292 79.78 91.23 74.28 5 XM_B_Unicode 160681 76.69 84.20 73.09 6 XM_DK_Pass 160210 77.94 88.48 72.88 7 DKIM_VALID 158887 77.30 87.77 72.28 8 DCC_CHECK_NEGATIVE 139789 52.69 29.98 63.59 9 DKIM_VALID_AU 132326 62.33 66.78 60.20 10 BAYES_50 126808 50.84 36.56 57.69 11 XMListUnsubscribeExists 121216 60.99 73.19 55.14 12 XM_B_Unicode3 95949 44.68 46.84 43.65 13 XM_B_SpammyWords 90431 49.66 67.43 41.14 14 DCC_CHECK 80003 47.29 70.01 36.39 15 HTML_FONT_LOW_CONTRAST 76599 36.01 38.42 34.85 16 DKIM_VALID_EF 62849 28.31 27.72 28.59 17 LOC_TINY_FONT_1 62224 32.84 42.29 28.31 18 FVGT_m_MULTI_ODD 61356 29.71 33.45 27.91 19 RCVD_IN_MSPIKE_H2 57181 27.36 30.16 26.01 20 T_TM2_M_HEADER_IN_MSG 49232 22.17 21.70 22.40 21 XMSubLong 48540 21.28 19.60 22.08 22 MIME_HTML_ONLY 43934 22.70 28.37 19.99 23 T_KAM_HTML_FONT_INVALID 43633 22.00 26.49 19.85 24 ALL_TRUSTED 42018 13.38 1.43 19.11 25 XM_Multi_Part_URI 37283 18.29 21.07 16.96 26 TR_XM_DK_Unsub 36951 17.60 19.26 16.81 27 XM_B_SpammyWords2 36099 23.29 37.60 16.42 28 USER_IN_DEF_DKIM_WL 30745 10.40 2.92 13.99 29 UNPARSEABLE_RELAY 26373 13.33 16.12 12.00 30 BAYES_60 23547 9.88 8.14 10.71 31 XM_DKIMWhitelistDomains 20168 6.24 0.11 9.17 32 XM_Evil_Numbers_Gen 18451 8.75 9.49 8.39 33 LotsOfNums_01 17697 7.24 5.57 8.05 34 XM_B_Unsub 16999 9.84 14.22 7.73 35 TR_MAX_INTL_RELAY 16758 9.95 14.81 7.62 36 BAYES_00 16071 5.10 0.49 7.31 37 MPART_ALT_DIFF 16000 6.72 5.55 7.28 38 XM_DK_Undo_02 15727 19.16 44.19 7.15 39 XM_H_GMP 14899 6.16 4.87 6.78 40 TooManyTo_001 14811 6.55 6.16 6.74 41 BAYES_99 14357 15.73 34.91 6.53 42 TR_XM_BayesUnsub 13979 8.78 13.83 6.36 43 T_TooManySym_01 13511 4.84 2.12 6.15 44 RCVD_IN_MSPIKE_H3 12884 5.78 5.60 5.86 45 RCVD_IN_MSPIKE_WL 12884 5.78 5.60 5.86 46 TR_XM_DK_Bayes 12844 4.08 0.41 5.84 47 TR_XM_DK_Bayes1 12753 4.05 0.39 5.80 48 RCVD_IN_VALIDITY_SAFE 12606 4.79 2.83 5.73 49 HTML_IMAGE_RATIO_02 12444 6.78 9.12 5.66 50 MIME_HTML_MOSTLY 11800 4.98 4.18 5.37 51 BOUNCE_MESSAGE 11753 4.11 1.55 5.35 52 ANY_BOUNCE_MESSAGE 11753 4.11 1.55 5.35 53 BAYES_999 11454 12.49 27.65 5.21 54 HTML_IMAGE_RATIO_04 11375 5.53 6.27 5.17 55 XM_H_Long_From01 11326 5.15 5.13 5.15 56 TR_XM_DK_Bayes2 11320 3.58 0.32 5.15 57 RCVD_IN_VALIDITY_CERTIFIED 11191 4.11 2.08 5.09 58 IN_ZIMBRA_NJ_WHITELIST 11142 3.44 0.04 5.07 59 BOTNET_IPINHOSTNAME 10989 7.94 14.07 5.00 60 LOTS_OF_MONEY 10588 6.35 9.53 4.82 61 XM_UncommonTLD01 10280 5.81 8.18 4.68 62 BAYES_40 10194 4.04 2.79 4.64 63 BAYES_80 10089 6.14 9.36 4.59 64 XMStrtUSub 10078 4.44 4.15 4.58 65 XMSubMetaSx_00 9786 5.23 6.84 4.45 66 RELAYCOUNTRY_META 9702 8.75 17.80 4.41 67 MIME_QP_LONG_LINE 8953 3.52 2.36 4.07 68 XM_B_SpammyWords3 8323 6.15 11.06 3.79 69 XM_Body_Dirty_Words 8236 5.68 9.71 3.75 70 RCVD_IN_IADB_LISTED 7929 2.85 1.27 3.61 71 XMNumbers 7712 4.78 7.42 3.51 72 T_TooManySym_02 7654 2.56 0.65 3.48 73 TR_XM_SpammyWords4 7636 4.98 8.12 3.47 74 RCVD_IN_IADB_SPF 7165 2.58 1.15 3.26 75 HTML_OBFUSCATE_10_20 6728 2.08 0.02 3.06 76 SCC_BODY_URI_ONLY 6673 3.10 3.25 3.04 77 BAYES_95 6664 3.66 4.98 3.03 78 FSL_BULK_SIG 6615 4.30 6.99 3.01 79 BAYES_20 6576 2.69 2.05 2.99 80 RCVD_IN_IADB_SENDERID 6573 2.38 1.12 2.99 81 INVALID_MSGID 6429 2.03 0.18 2.92 82 RCVD_IN_IADB_DK 6424 2.34 1.12 2.92 83 TO_MALFORMED 6261 2.02 0.28 2.85 84 MAILING_LIST_MULTI 6248 2.50 1.78 2.84 85 T_REMOTE_IMAGE 6084 2.51 1.96 2.77 86 XM_B_SpammyTLD 5744 2.95 3.66 2.61 87 MIME_HTML_ONLY_MULTI 5744 2.70 2.88 2.61 88 TM2_M_URI_OPT_OUT 5607 2.86 3.51 2.55 89 BAYES_05 5519 1.93 0.71 2.51 90 XM_CamelCaseFrm001 5463 2.70 3.14 2.49 91 XM_B_Phish_Phrases 5343 2.83 3.66 2.43 92 FROM_EXCESS_BASE64 5339 2.66 3.13 2.43 93 TR_XM_SpammyRelay 5261 5.98 13.47 2.39 94 TR_XM_DKIM_Undo 5233 11.86 31.62 2.38 95 HTML_IMAGE_RATIO_06 5200 2.83 3.79 2.37 96 XM_SPF_SoftFail 5171 3.60 6.20 2.35 97 UNTRUSTED_Relay 4547 3.65 6.94 2.07 98 RCVD_IN_IADB_VOUCHED 4537 1.55 0.48 2.06 99 TR_XM_UnparsRelay 4422 4.37 9.27 2.01 100 TooManyTo_002 4419 1.65 0.88 2.01 101 TVD_RCVD_IP 4411 1.72 1.14 2.01 102 DKIM_INVALID 4405 2.47 3.45 2.00 103 TR_DCC_Bayes_99 4229 9.02 23.80 1.92 104 XMSexyCombo_05 4228 2.91 4.96 1.92 105 TR_XM_PhishingBody 4190 2.61 4.09 1.91 106 HTML_IMAGE_RATIO_08 3896 2.01 2.50 1.77 107 XM_PDF 3711 1.24 0.31 1.69 108 MISSING_MIMEOLE 3704 1.14 0.02 1.68 109 XMBSHREFv2 3655 1.23 0.31 1.66 110 T_XMDrugObfuBody_14 3636 2.35 3.80 1.65 111 IN_HORDE_ADDRESS_BOOK 3596 1.12 0.03 1.64 112 TR_XM_SpammyWords5 3458 2.79 5.33 1.57 113 XM_B_Investor 3304 2.06 3.23 1.50 114 XM_DK_Undo_01 3303 1.52 1.56 1.50 115 HTML_MIME_NO_HTML_TAG 3299 1.50 1.51 1.50 116 TVD_SPACE_RATIO 3228 1.02 0.10 1.47 117 RELAYCOUNTRY_CA 3224 3.60 8.05 1.47 118 RCVD_IN_IADB_OPTIN 3200 1.08 0.29 1.46 119 XMStockSpam_06 3167 1.53 1.71 1.44 120 XMGappySubj_01 3027 0.98 0.15 1.38 121 XMBody_95 2960 0.97 0.19 1.35 122 SUBJ_ALL_CAPS 2943 1.92 3.13 1.34 123 URI_NOVOWEL 2924 1.21 0.95 1.33 124 XM_GoogleGroups 2901 1.05 0.48 1.32 125 T_XMDrugObfuBody_08 2860 2.06 3.65 1.30 126 TM2_M_VERY_LONG_WORD 2830 1.91 3.21 1.29 127 XM_SendGrid 2810 1.36 1.52 1.28 128 URI_HEX 2798 1.47 1.89 1.27 129 XM_UB50 2722 1.91 3.32 1.24 130 T_TooManySym_03 2621 0.89 0.26 1.19 131 TR_Symld_Words 2619 1.07 0.81 1.19 132 XMGappySubj_02 2593 0.83 0.09 1.18 133 XMBdyGiftCard01 2590 1.17 1.16 1.18 134 RCVD_IN_RP_SAFE 2509 0.94 0.53 1.14 135 XM_H_Long_From02 2504 1.25 1.47 1.14 136 TooManyTo_003 2496 1.03 0.82 1.14 137 XMSubMetaI_00 2496 1.44 2.06 1.14 138 XMDiploma_00 2395 1.34 1.87 1.09 139 XM_H_Trusted_IP 2373 0.73 0.00 1.08 140 BOTNET 2319 3.60 8.90 1.05 141 MSGID_NOFQDN1 2245 0.69 0.01 1.02 142 RCVD_IN_RP_CERTIFIED 2244 0.81 0.38 1.02 143 XM_B_Unsub2 2236 1.46 2.38 1.02 144 XM_OfRef6 2230 1.80 3.45 1.01 145 TooManyTo_004 2031 0.88 0.79 0.92 146 DKIM_ADSP_CUSTOM_MED 1956 0.97 1.12 0.89 147 TR_XM_DK_SendGrid 1918 0.84 0.78 0.87 148 USER_IN_WELCOMELIST 1850 0.57 0.00 0.84 149 USER_IN_WHITELIST 1850 0.57 0.00 0.84 150 URI_TRY_3LD 1843 0.83 0.81 0.84 151 TooManyTo_005 1808 0.80 0.76 0.82 152 XM_H_PHPMailer 1773 1.04 1.53 0.81 153 XM_ProductURIs 1758 0.81 0.82 0.80 154 RCVD_IN_BL_SPAMCOP_NET 1738 3.91 10.42 0.79 155 MPART_ALT_DIFF_COUNT 1686 0.89 1.14 0.77 156 XMPhish14 1614 0.83 1.03 0.73 157 XM_B_COPY_HTML 1605 0.92 1.30 0.73 158 T_XMHurry_00 1598 1.10 1.87 0.73 159 SpammyFromTLD_01 1519 1.89 4.38 0.69 160 XMLngstWrd_00 1495 0.72 0.81 0.68 161 XMSubNoVowel 1467 0.62 0.52 0.67 162 THIS_AD 1448 1.03 1.80 0.66 163 KHOP_HELO_FCRDNS 1438 0.89 1.38 0.65 164 TR_XM_Base64_M1 1415 0.73 0.92 0.64 165 XMBrknScrpt_02 1402 1.00 1.74 0.64 166 XMHTML_After_End 1368 0.66 0.75 0.62 167 XMNoVowels 1364 0.57 0.47 0.62 168 T_FILL_THIS_FORM_SHORT 1362 1.60 3.65 0.62 169 TR_MetaPhish_Combo_01 1354 0.70 0.86 0.62 170 NML_ADSP_CUSTOM_MED 1340 0.73 0.99 0.61 171 HTTPS_HTTP_MISMATCH 1307 0.87 1.46 0.59 172 XMClaimOffer 1288 0.70 0.93 0.59 173 TR_XM_FormFill2 1269 2.04 5.10 0.58 174 TR_XM_PHPForged 1257 2.10 5.27 0.57 175 XMPhish30 1249 0.82 1.36 0.57 176 TR_XM_PHPDW 1227 2.04 5.14 0.56 177 XMBody_17 1209 2.30 5.94 0.55 178 XMSubMetaSxObfu_02 1208 0.53 0.50 0.55 179 XM_H_PHPOS 1200 2.02 5.08 0.55 180 XMSubMetaSxObfu_03 1185 0.55 0.58 0.54 181 XM_B_SpammyWords4 1173 0.96 1.86 0.53 182 FORGED_GMAIL_RCVD 1132 0.66 0.96 0.51 183 SHOPIFY_IMG_NOT_RCVD_SFY 1118 0.84 1.54 0.51 184 RELAYCOUNTRY_GB 1117 0.57 0.71 0.51 185 TR_XM_SpammyWords2 1102 4.26 12.10 0.50 186 DKIM_ADSP_NXDOMAIN 1084 0.58 0.75 0.49 187 FILL_THIS_FORM 1081 0.47 0.43 0.49 188 XM_B_FormFill 1054 0.34 0.04 0.48 189 XM_B_DNDMA 1013 0.47 0.50 0.46 190 RELAYCOUNTRY_AU 967 1.06 2.37 0.44 191 T_TooManySym_04 948 0.34 0.15 0.43 192 TR_XM_SPAMCOP 926 2.74 7.58 0.42 193 XMMoneyMeta_00 884 0.48 0.66 0.40 194 SUBJ_DOLLARS 879 0.51 0.75 0.40 195 T_XMDrugObfuBody_00 878 0.52 0.78 0.40 196 FILL_THIS_FORM_LONG 873 0.38 0.33 0.40 197 XMGenDplmaNmb 867 0.57 0.92 0.39 198 TO_NO_BRKTS_HTML_ONLY 863 0.40 0.43 0.39 199 XMCapTrack 841 0.36 0.32 0.38 200 RELAYCOUNTRY_DE 828 0.40 0.44 0.38 ----------------------------------------------------------------------