Email: 276935 Autolearn: 0 AvgScore: 3.81 AvgScanTime: 1.31 sec Spam: 94565 Autolearn: 0 AvgScore: 13.07 AvgScanTime: 1.42 sec Ham: 182370 Autolearn: 0 AvgScore: -0.99 AvgScanTime: 1.26 sec Time Spent Running SA: 101.09 hours Time Spent Processing Spam: 37.22 hours Time Spent Processing Ham: 63.87 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 90349 85.88 95.54 80.87 2 DKIM_SIGNED 86577 80.88 91.55 75.34 3 XM_DK_Pass 83743 79.14 88.56 74.26 4 DKIM_VALID 83220 78.59 88.00 73.71 5 XM_B_Unicode 79148 74.58 83.70 69.85 6 RELAYCOUNTRY_US 77952 79.61 82.43 78.14 7 T_SCC_BODY_TEXT_LINE 76781 82.78 81.19 83.60 8 DKIM_VALID_AU 69323 66.41 73.31 62.84 9 DCC_CHECK 69188 50.14 73.16 38.21 10 XMListUnsubscribeExists 68535 59.09 72.47 52.15 11 XM_B_SpammyWords 65706 52.27 69.48 43.34 12 XM_B_Unicode3 44542 44.13 47.10 42.59 13 XM_DK_Undo_02 42939 20.63 45.41 7.79 14 LOC_TINY_FONT_1 41738 33.43 44.14 27.88 15 BAYES_99 38095 18.27 40.28 6.86 16 XM_B_SpammyWords2 37954 25.91 40.14 18.54 17 HTML_FONT_LOW_CONTRAST 35526 34.21 37.57 32.47 18 FVGT_m_MULTI_ODD 35427 30.15 37.46 26.36 19 BAYES_50 31872 48.81 33.70 56.65 20 TR_XM_DKIM_Undo 31575 13.48 33.39 3.16 21 BAYES_999 30242 14.51 31.98 5.45 22 RCVD_IN_MSPIKE_H2 28359 27.89 29.99 26.80 23 TR_DCC_Bayes_99 27114 11.69 28.67 2.88 24 T_KAM_HTML_FONT_INVALID 26586 23.59 28.11 21.24 25 DCC_CHECK_NEGATIVE 25369 49.84 26.83 61.77 26 DKIM_VALID_EF 23070 28.31 24.40 30.35 27 MIME_HTML_ONLY 22195 21.20 23.47 20.02 28 T_TM2_M_HEADER_IN_MSG 19412 22.26 20.53 23.15 29 XM_Multi_Part_URI 17179 16.62 18.17 15.82 30 XMSubLong 17130 20.57 18.11 21.84 31 TR_XM_DK_Unsub 16019 15.82 16.94 15.24 32 RELAYCOUNTRY_META 15736 8.39 16.64 4.12 33 XM_B_Unsub 15269 11.38 16.15 8.90 34 UNPARSEABLE_RELAY 15071 12.58 15.94 10.84 35 TR_XM_BayesUnsub 14913 10.24 15.77 7.37 36 XM_B_SpammyWords3 14765 8.78 15.61 5.23 37 TR_XM_SpammyWords2 14324 5.75 15.15 0.87 38 TR_MAX_INTL_RELAY 13984 10.10 14.79 7.67 39 BOTNET_IPINHOSTNAME 13266 8.59 14.03 5.77 40 LOTS_OF_MONEY 11161 7.56 11.80 5.37 41 TR_XM_SpammyRelay 11036 5.68 11.67 2.57 42 XM_Body_Dirty_Words 10071 6.27 10.65 3.99 43 TR_XM_SpammyWords4 9371 5.86 9.91 3.76 44 TR_XM_UnparsRelay 8486 4.28 8.97 1.85 45 BAYES_80 8384 5.98 8.87 4.49 46 XM_Evil_Numbers_Gen 8359 7.82 8.84 7.29 47 BAYES_60 8072 10.14 8.54 10.98 48 BOTNET 7911 3.63 8.37 1.17 49 RELAYCOUNTRY_CA 7741 3.94 8.19 1.74 50 HTML_IMAGE_RATIO_02 7676 7.05 8.12 6.50 51 FSL_BULK_SIG 7554 5.98 7.99 4.93 52 XMSubMetaSx_00 6953 5.45 7.35 4.46 53 LotsOfNums_01 6490 6.98 6.86 7.03 54 MPART_ALT_DIFF 6379 4.86 6.75 3.89 55 XM_UncommonTLD01 6327 5.60 6.69 5.03 56 TooManyTo_001 6194 6.76 6.55 6.87 57 XMBody_17 5467 2.44 5.78 0.70 58 UNTRUSTED_Relay 5384 3.04 5.69 1.67 59 XMSexyCombo_05 5379 3.15 5.69 1.83 60 BAYES_95 5145 3.95 5.44 3.18 61 RCVD_IN_BL_SPAMCOP_NET 4939 2.32 5.22 0.82 62 MIME_HTML_MOSTLY 4907 3.42 5.19 2.50 63 XM_SPF_SoftFail 4857 3.56 5.14 2.74 64 HTML_IMAGE_RATIO_04 4805 5.03 5.08 5.01 65 XM_H_GMP 4611 7.25 4.88 8.48 66 XM_H_Long_From01 4536 4.99 4.80 5.10 67 T_XMDrugObfuBody_14 4323 2.96 4.57 2.13 68 XM_B_Investor 4260 2.42 4.50 1.34 69 HTML_IMAGE_RATIO_06 4228 3.03 4.47 2.28 70 XMBrknScrpt_02 4064 1.99 4.30 0.80 71 XM_B_Phish_Phrases 3958 3.55 4.19 3.22 72 TR_XM_PhishingBody 3914 2.55 4.14 1.72 73 T_XMDrugObfuBody_08 3889 2.41 4.11 1.53 74 XM_B_SpammyTLD 3592 3.24 3.80 2.95 75 XM_OfRef6 3585 2.24 3.79 1.44 76 MIME_HTML_ONLY_MULTI 3486 2.63 3.69 2.08 77 RCVD_IN_VALIDITY_SAFE 3451 5.20 3.65 6.00 78 DKIM_INVALID 3357 2.28 3.55 1.63 79 HTML_IMAGE_RATIO_08 3301 2.56 3.49 2.08 80 XMStrtUSub 3289 4.77 3.48 5.44 81 XM_CamelCaseFrm001 3203 2.68 3.39 2.31 82 TM2_M_VERY_LONG_WORD 3179 2.02 3.36 1.32 83 USER_IN_DEF_DKIM_WL 3074 11.44 3.25 15.69 84 XMNumbers 3065 3.29 3.24 3.32 85 TR_XM_SpammyWords5 3051 1.93 3.23 1.25 86 TR_XM_SPAMCOP 2972 1.41 3.14 0.50 87 RCVD_IN_VALIDITY_CERTIFIED 2879 4.58 3.04 5.38 88 SpammyFromTLD_02 2877 1.19 3.04 0.23 89 XM_URI_RBL 2858 1.17 3.02 0.21 90 XM_B_SpammyWords4 2706 1.52 2.86 0.82 91 T_FILL_THIS_FORM_SHORT 2565 1.43 2.71 0.77 92 TR_XM_NoHeaderRelay 2445 1.00 2.59 0.18 93 TR_LOTS_OF_MONEY3 2437 1.27 2.58 0.59 94 XM_B_Unsub2 2391 1.77 2.53 1.37 95 TM2_M_URI_OPT_OUT 2362 2.10 2.50 1.90 96 RELAYCOUNTRY_AU 2359 1.16 2.49 0.47 97 AC_BR_BONANZA 2290 0.91 2.42 0.13 98 XM_UB50 2250 1.44 2.38 0.95 99 FROM_EXCESS_BASE64 2209 2.22 2.34 2.16 100 MIME_QP_LONG_LINE 2203 3.23 2.33 3.69 101 SUBJ_ALL_CAPS 2104 1.38 2.22 0.94 102 TR_XM_PHPForged 1983 0.95 2.10 0.36 103 T_TooManySym_01 1980 5.13 2.09 6.71 104 T_XMHurry_00 1975 1.06 2.09 0.53 105 XM_DK_Undo_01 1971 1.86 2.08 1.75 106 XM_HighProb1 1948 0.71 2.06 0.00 107 RCVD_IN_MSPIKE_WL 1909 4.69 2.02 6.08 108 RCVD_IN_MSPIKE_H3 1909 4.69 2.02 6.08 109 TR_XM_PHPDW 1903 0.92 2.01 0.36 110 TR_XM_FormFill 1896 0.69 2.00 0.01 111 TR_XM_FormFill2 1865 0.91 1.97 0.36 112 XMSubMetaSxObfu_03 1855 1.02 1.96 0.53 113 XM_H_PHPOS 1851 0.89 1.96 0.34 114 XMBdyGiftCard01 1813 1.32 1.92 1.01 115 MAILING_LIST_MULTI 1779 2.18 1.88 2.34 116 HTML_TAG_BALANCE_BODY 1777 0.92 1.88 0.43 117 RCVD_IN_VALIDITY_RPBL 1696 0.65 1.79 0.06 118 RCVD_IN_PSBL 1611 0.88 1.70 0.45 119 KHOP_HELO_FCRDNS 1604 1.05 1.70 0.71 120 SpammyFromTLD_01 1590 1.03 1.68 0.69 121 TR_XM_INV_DKIM 1566 0.63 1.66 0.10 122 T_REMOTE_IMAGE 1517 2.97 1.60 3.68 123 XMStockSpam_06 1496 1.03 1.58 0.75 124 XM_DIRTYINTL 1465 0.67 1.55 0.21 125 URI_HEX 1444 1.33 1.53 1.23 126 XMReplyNow 1421 0.68 1.50 0.26 127 XMSubMetaI_00 1418 0.74 1.50 0.34 128 TR_Mismatch_TLD_01 1369 0.71 1.45 0.33 129 XMPhish30 1362 0.95 1.44 0.69 130 ALL_TRUSTED 1317 12.35 1.39 18.04 131 XMDiploma_00 1316 1.48 1.39 1.52 132 XM_SendGrid 1302 1.28 1.38 1.23 133 XMSexyCombo_01 1263 0.66 1.34 0.30 134 RCVD_IN_IADB_LISTED 1249 2.62 1.32 3.29 135 BAYES_40 1238 3.05 1.31 3.95 136 TooManyTo_002 1219 1.51 1.29 1.62 137 TR_Mismatch_TLD_02 1217 0.48 1.29 0.06 138 RELAYCOUNTRY_DE 1200 0.65 1.27 0.33 139 LongTLD 1195 0.55 1.26 0.18 140 RCVD_IN_IADB_SPF 1187 2.40 1.26 2.99 141 RELAYCOUNTRY_GB 1181 0.63 1.25 0.31 142 XM_UB99 1174 0.43 1.24 0.00 143 RCVD_IN_IADB_DK 1160 2.18 1.23 2.68 144 RCVD_IN_IADB_SENDERID 1141 2.21 1.21 2.74 145 URI_NOVOWEL 1134 1.21 1.20 1.22 146 TooManyTo_003 1132 1.00 1.20 0.90 147 TR_XM_InvalidRelay 1116 0.42 1.18 0.03 148 HTTPS_HTTP_MISMATCH 1115 0.81 1.18 0.63 149 XM_B_Phish66 1100 0.61 1.16 0.33 150 TM2_M_A_HREF_HREF 1087 0.48 1.15 0.14 151 TooManyTo_004 1085 0.85 1.15 0.69 152 MPART_ALT_DIFF_COUNT 1069 0.95 1.13 0.86 153 PDS_OTHER_BAD_TLD 1061 0.53 1.12 0.22 154 TooManyTo_005 1060 0.78 1.12 0.60 155 RDNS_DYNAMIC 1053 0.68 1.11 0.45 156 XM_H_Undi_Recip 1029 0.44 1.09 0.11 157 SHOPIFY_IMG_NOT_RCVD_SFY 1020 0.62 1.08 0.38 158 FORGED_RELAY_MUA_TO_MX 1018 0.38 1.08 0.02 159 ANY_BOUNCE_MESSAGE 999 4.15 1.06 5.75 160 URI_TRY_3LD 997 1.02 1.05 1.00 161 BOUNCE_MESSAGE 997 4.15 1.05 5.75 162 BAYES_20 982 2.26 1.04 2.90 163 XM_ProductURIs 966 0.72 1.02 0.56 164 TVD_RCVD_IP 956 2.25 1.01 2.90 165 XMClaimOffer 956 0.40 1.01 0.09 166 TR_Caps_n_Bayes_99 953 0.35 1.01 0.02 167 TR_XM_DK_SendGrid 948 0.91 1.00 0.86 168 HTML_MIME_NO_HTML_TAG 937 1.30 0.99 1.46 169 DIET_1 930 0.50 0.98 0.25 170 PLING_QUERY 924 0.83 0.98 0.75 171 TR_XM_Base64_M1 912 0.99 0.96 1.01 172 XMBody_78 911 0.59 0.96 0.39 173 XM_H_Long_From02 910 1.20 0.96 1.32 174 HELO_DYNAMIC_SPLIT_IP 905 0.33 0.96 0.01 175 BOTNET_NORDNS 898 0.33 0.95 0.01 176 SCC_BODY_URI_ONLY 892 2.71 0.94 3.63 177 THIS_AD 885 0.48 0.94 0.25 178 T_HTML_ATTACH 883 0.36 0.93 0.06 179 TR_XM_Undi_Recip19 881 0.37 0.93 0.08 180 XM_B_COPY_HTML 879 1.43 0.93 1.69 181 T_STY_INVIS_DIRECT 873 0.50 0.92 0.28 182 T_TooManySym_02 873 2.93 0.92 3.97 183 MultiRelay_CC 866 0.34 0.92 0.04 184 T_XMDrugObfuBody_00 866 0.59 0.92 0.43 185 DKIM_ADSP_CUSTOM_MED 835 1.12 0.88 1.25 186 FROM_SUSPICIOUS_NTLD 832 0.32 0.88 0.03 187 XMPhish14 826 0.48 0.87 0.28 188 XMHTML_After_End 821 0.54 0.87 0.37 189 RCVD_IN_RP_SAFE 797 1.03 0.84 1.13 190 SUBJ_DOLLARS 796 0.50 0.84 0.32 191 TR_MetaPhish_Combo_01 791 0.75 0.84 0.70 192 TM2_M_OBFU_COMMENT 788 0.45 0.83 0.25 193 T_MONEY_PERCENT 788 0.52 0.83 0.36 194 AC_HTML_NONSENSE_TAGS 788 0.29 0.83 0.01 195 TR_LOTS_OF_MONEY2 788 0.52 0.83 0.36 196 XM_Sft_Co_L33T 787 0.44 0.83 0.24 197 FROM_SUSPICIOUS_NTLD_FP 783 0.30 0.83 0.03 198 SCRIPT_GIBBERISH 776 0.28 0.82 0.00 199 XM_RXBody 770 0.35 0.81 0.11 200 TR_XM_Base64_L1 767 0.42 0.81 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 152468 82.78 81.19 83.60 2 HTML_MESSAGE 147488 85.88 95.54 80.87 3 RELAYCOUNTRY_US 142505 79.61 82.43 78.14 4 DKIM_SIGNED 137396 80.88 91.55 75.34 5 XM_DK_Pass 135422 79.14 88.56 74.26 6 DKIM_VALID 134428 78.59 88.00 73.71 7 XM_B_Unicode 127381 74.58 83.70 69.85 8 DKIM_VALID_AU 114599 66.41 73.31 62.84 9 DCC_CHECK_NEGATIVE 112650 49.84 26.83 61.77 10 BAYES_50 103310 48.81 33.70 56.65 11 XMListUnsubscribeExists 95109 59.09 72.47 52.15 12 XM_B_SpammyWords 79043 52.27 69.48 43.34 13 XM_B_Unicode3 77664 44.13 47.10 42.59 14 DCC_CHECK 69675 50.14 73.16 38.21 15 HTML_FONT_LOW_CONTRAST 59214 34.21 37.57 32.47 16 DKIM_VALID_EF 55341 28.31 24.40 30.35 17 LOC_TINY_FONT_1 50841 33.43 44.14 27.88 18 RCVD_IN_MSPIKE_H2 48883 27.89 29.99 26.80 19 FVGT_m_MULTI_ODD 48070 30.15 37.46 26.36 20 T_TM2_M_HEADER_IN_MSG 42222 22.26 20.53 23.15 21 XMSubLong 39828 20.57 18.11 21.84 22 T_KAM_HTML_FONT_INVALID 38735 23.59 28.11 21.24 23 MIME_HTML_ONLY 36502 21.20 23.47 20.02 24 XM_B_SpammyWords2 33807 25.91 40.14 18.54 25 ALL_TRUSTED 32892 12.35 1.39 18.04 26 XM_Multi_Part_URI 28852 16.62 18.17 15.82 27 USER_IN_DEF_DKIM_WL 28609 11.44 3.25 15.69 28 TR_XM_DK_Unsub 27791 15.82 16.94 15.24 29 XM_DKIMWhitelistDomains 21358 7.73 0.04 11.71 30 BAYES_60 20016 10.14 8.54 10.98 31 UNPARSEABLE_RELAY 19761 12.58 15.94 10.84 32 XM_B_Unsub 16238 11.38 16.15 8.90 33 XM_H_GMP 15458 7.25 4.88 8.48 34 BAYES_00 14458 5.36 0.40 7.93 35 XM_DK_Undo_02 14198 20.63 45.41 7.79 36 TR_MAX_INTL_RELAY 13991 10.10 14.79 7.67 37 TR_XM_BayesUnsub 13435 10.24 15.77 7.37 38 XM_Evil_Numbers_Gen 13295 7.82 8.84 7.29 39 LotsOfNums_01 12829 6.98 6.86 7.03 40 TooManyTo_001 12526 6.76 6.55 6.87 41 BAYES_99 12514 18.27 40.28 6.86 42 T_TooManySym_01 12237 5.13 2.09 6.71 43 TR_XM_DK_Bayes 11897 4.39 0.27 6.52 44 HTML_IMAGE_RATIO_02 11861 7.05 8.12 6.50 45 TR_XM_DK_Bayes1 11815 4.36 0.27 6.48 46 RCVD_IN_MSPIKE_H3 11082 4.69 2.02 6.08 47 RCVD_IN_MSPIKE_WL 11082 4.69 2.02 6.08 48 RCVD_IN_VALIDITY_SAFE 10944 5.20 3.65 6.00 49 BOTNET_IPINHOSTNAME 10515 8.59 14.03 5.77 50 BOUNCE_MESSAGE 10486 4.15 1.05 5.75 51 ANY_BOUNCE_MESSAGE 10486 4.15 1.06 5.75 52 TR_XM_DK_Bayes2 10431 3.83 0.20 5.72 53 IN_ZIMBRA_NJ_WHITELIST 9969 3.62 0.06 5.47 54 BAYES_999 9947 14.51 31.98 5.45 55 XMStrtUSub 9925 4.77 3.48 5.44 56 RCVD_IN_VALIDITY_CERTIFIED 9808 4.58 3.04 5.38 57 LOTS_OF_MONEY 9787 7.56 11.80 5.37 58 XM_B_SpammyWords3 9542 8.78 15.61 5.23 59 XM_H_Long_From01 9296 4.99 4.80 5.10 60 XM_UncommonTLD01 9171 5.60 6.69 5.03 61 HTML_IMAGE_RATIO_04 9133 5.03 5.08 5.01 62 FSL_BULK_SIG 8997 5.98 7.99 4.93 63 BAYES_80 8186 5.98 8.87 4.49 64 XMSubMetaSx_00 8141 5.45 7.35 4.46 65 RELAYCOUNTRY_META 7510 8.39 16.64 4.12 66 INVALID_MSGID 7287 2.70 0.19 4.00 67 XM_Body_Dirty_Words 7282 6.27 10.65 3.99 68 T_TooManySym_02 7249 2.93 0.92 3.97 69 BAYES_40 7212 3.05 1.31 3.95 70 MPART_ALT_DIFF 7088 4.86 6.75 3.89 71 TR_XM_SpammyWords4 6853 5.86 9.91 3.76 72 MIME_QP_LONG_LINE 6732 3.23 2.33 3.69 73 T_REMOTE_IMAGE 6717 2.97 1.60 3.68 74 SCC_BODY_URI_ONLY 6625 2.71 0.94 3.63 75 TO_MALFORMED 6236 2.26 0.02 3.42 76 XMNumbers 6060 3.29 3.24 3.32 77 RCVD_IN_IADB_LISTED 6000 2.62 1.32 3.29 78 XM_B_Phish_Phrases 5873 3.55 4.19 3.22 79 BAYES_95 5804 3.95 5.44 3.18 80 TR_XM_DKIM_Undo 5762 13.48 33.39 3.16 81 BAYES_05 5578 2.16 0.41 3.06 82 RCVD_IN_IADB_SPF 5449 2.40 1.26 2.99 83 XM_B_SpammyTLD 5385 3.24 3.80 2.95 84 BAYES_20 5290 2.26 1.04 2.90 85 TVD_RCVD_IP 5283 2.25 1.01 2.90 86 TR_DCC_Bayes_99 5251 11.69 28.67 2.88 87 XM_SPF_SoftFail 5000 3.56 5.14 2.74 88 RCVD_IN_IADB_SENDERID 4993 2.21 1.21 2.74 89 RCVD_IN_IADB_DK 4879 2.18 1.23 2.68 90 TR_XM_SpammyRelay 4685 5.68 11.67 2.57 91 MIME_HTML_MOSTLY 4558 3.42 5.19 2.50 92 XM_PDF 4474 1.71 0.27 2.45 93 MAILING_LIST_MULTI 4268 2.18 1.88 2.34 94 XM_CamelCaseFrm001 4219 2.68 3.39 2.31 95 HTML_IMAGE_RATIO_06 4161 3.03 4.47 2.28 96 FROM_EXCESS_BASE64 3932 2.22 2.34 2.16 97 T_XMDrugObfuBody_14 3887 2.96 4.57 2.13 98 XMBSHREFv2 3829 1.46 0.22 2.10 99 MIME_HTML_ONLY_MULTI 3802 2.63 3.69 2.08 100 HTML_IMAGE_RATIO_08 3798 2.56 3.49 2.08 101 TM2_M_URI_OPT_OUT 3462 2.10 2.50 1.90 102 RCVD_IN_IADB_VOUCHED 3443 1.40 0.46 1.89 103 TR_XM_UnparsRelay 3375 4.28 8.97 1.85 104 XMGappySubj_01 3338 1.25 0.14 1.83 105 XMSexyCombo_05 3337 3.15 5.69 1.83 106 IN_HORDE_ADDRESS_BOOK 3275 1.21 0.08 1.80 107 TVD_SPACE_RATIO 3202 1.19 0.09 1.76 108 XM_DK_Undo_01 3191 1.86 2.08 1.75 109 RELAYCOUNTRY_CA 3171 3.94 8.19 1.74 110 TR_XM_PhishingBody 3136 2.55 4.14 1.72 111 XM_B_COPY_HTML 3089 1.43 0.93 1.69 112 UNTRUSTED_Relay 3048 3.04 5.69 1.67 113 DKIM_INVALID 2968 2.28 3.55 1.63 114 XMGappySubj_02 2966 1.08 0.04 1.63 115 TooManyTo_002 2963 1.51 1.29 1.62 116 T_XMDrugObfuBody_08 2796 2.41 4.11 1.53 117 XMDiploma_00 2775 1.48 1.39 1.52 118 HTML_MIME_NO_HTML_TAG 2657 1.30 0.99 1.46 119 XMBody_95 2642 1.03 0.22 1.45 120 XM_OfRef6 2623 2.24 3.79 1.44 121 XM_B_Unsub2 2497 1.77 2.53 1.37 122 TR_Symld_Words 2494 1.17 0.80 1.37 123 XM_B_Investor 2451 2.42 4.50 1.34 124 XM_H_Long_From02 2410 1.20 0.96 1.32 125 TM2_M_VERY_LONG_WORD 2403 2.02 3.36 1.32 126 MSGID_NOFQDN1 2384 0.87 0.02 1.31 127 XM_GoogleGroups 2383 1.02 0.45 1.31 128 RCVD_IN_IADB_OPTIN 2381 0.94 0.23 1.31 129 T_TooManySym_03 2314 0.93 0.26 1.27 130 TR_XM_SpammyWords5 2281 1.93 3.23 1.25 131 DKIM_ADSP_CUSTOM_MED 2280 1.12 0.88 1.25 132 XM_SendGrid 2250 1.28 1.38 1.23 133 URI_HEX 2248 1.33 1.53 1.23 134 URI_NOVOWEL 2216 1.21 1.20 1.22 135 BOTNET 2132 3.63 8.37 1.17 136 RCVD_IN_RP_SAFE 2056 1.03 0.84 1.13 137 USER_IN_WELCOMELIST 1934 0.70 0.00 1.06 138 USER_IN_WHITELIST 1934 0.70 0.00 1.06 139 RCVD_IN_RP_CERTIFIED 1843 0.91 0.70 1.01 140 TR_XM_Base64_M1 1841 0.99 0.96 1.01 141 XMBdyGiftCard01 1835 1.32 1.92 1.01 142 URI_TRY_3LD 1816 1.02 1.05 1.00 143 XM_UB50 1734 1.44 2.38 0.95 144 SUBJ_ALL_CAPS 1709 1.38 2.22 0.94 145 XMGenDplmaNmb 1669 0.85 0.72 0.92 146 TooManyTo_003 1637 1.00 1.20 0.90 147 NML_ADSP_CUSTOM_MED 1636 0.86 0.78 0.90 148 FORGED_GMAIL_RCVD 1598 0.82 0.70 0.88 149 TR_XM_SpammyWords2 1594 5.75 15.15 0.87 150 MPART_ALT_DIFF_COUNT 1574 0.95 1.13 0.86 151 TR_XM_DK_SendGrid 1572 0.91 1.00 0.86 152 XM_H_PHPMailer 1537 0.79 0.69 0.84 153 RCVD_IN_BL_SPAMCOP_NET 1493 2.32 5.22 0.82 154 XM_B_SpammyWords4 1491 1.52 2.86 0.82 155 XMBrknScrpt_02 1456 1.99 4.30 0.80 156 T_FILL_THIS_FORM_SHORT 1400 1.43 2.71 0.77 157 PLING_QUERY 1375 0.83 0.98 0.75 158 XMStockSpam_06 1365 1.03 1.58 0.75 159 KHOP_HELO_FCRDNS 1298 1.05 1.70 0.71 160 TR_MetaPhish_Combo_01 1280 0.75 0.84 0.70 161 XMBody_17 1279 2.44 5.78 0.70 162 XMPhish30 1263 0.95 1.44 0.69 163 TooManyTo_004 1262 0.85 1.15 0.69 164 SpammyFromTLD_01 1251 1.03 1.68 0.69 165 HTTPS_HTTP_MISMATCH 1141 0.81 1.18 0.63 166 XMSubMetaSxObfu_02 1126 0.51 0.32 0.62 167 TooManyTo_005 1090 0.78 1.12 0.60 168 TR_LOTS_OF_MONEY3 1074 1.27 2.58 0.59 169 XM_ProductURIs 1022 0.72 1.02 0.56 170 XM_H_Trusted_IP 983 0.35 0.00 0.54 171 T_XMHurry_00 972 1.06 2.09 0.53 172 XMSubMetaSxObfu_03 964 1.02 1.96 0.53 173 XMNoVowels 943 0.51 0.50 0.52 174 XMSubNoVowel 938 0.52 0.54 0.51 175 TR_XM_SPAMCOP 919 1.41 3.14 0.50 176 HELO_NODOT 917 0.36 0.08 0.50 177 HELO_NO_DOMAIN 917 0.36 0.08 0.50 178 FILL_THIS_FORM 873 0.40 0.23 0.48 179 XM_B_REG_HTML 869 0.57 0.76 0.48 180 T_TooManySym_04 864 0.36 0.15 0.47 181 RELAYCOUNTRY_AU 855 1.16 2.49 0.47 182 XM_ShortIntro_01 846 0.52 0.64 0.46 183 RDNS_DYNAMIC 828 0.68 1.11 0.45 184 RCVD_IN_PSBL 824 0.88 1.70 0.45 185 HTML_FONT_FACE_BAD 804 0.55 0.76 0.44 186 XM_B_FormFill 795 0.30 0.04 0.44 187 XM_S_SubURI 791 0.32 0.10 0.43 188 HTML_TAG_BALANCE_BODY 781 0.92 1.88 0.43 189 T_XMDrugObfuBody_00 780 0.59 0.92 0.43 190 XMCapTrack 776 0.41 0.37 0.43 191 XM_B_DNDMA 745 0.53 0.77 0.41 192 DKIM_ADSP_NXDOMAIN 740 0.43 0.48 0.41 193 CTE_8BIT_MISMATCH 725 0.27 0.03 0.40 194 XMBody_78 711 0.59 0.96 0.39 195 XMSolicitRefs_0 703 0.42 0.49 0.39 196 T_OBFU_PDF_ATTACH 701 0.27 0.05 0.38 197 SHOPIFY_IMG_NOT_RCVD_SFY 687 0.62 1.08 0.38 198 FILL_THIS_FORM_LONG 681 0.30 0.16 0.37 199 XMHTML_After_End 679 0.54 0.87 0.37 200 NO_DNS_FOR_FROM 669 0.40 0.46 0.37 ----------------------------------------------------------------------