Email: 270696 Autolearn: 0 AvgScore: 3.65 AvgScanTime: 1.12 sec Spam: 88333 Autolearn: 0 AvgScore: 13.33 AvgScanTime: 1.19 sec Ham: 182363 Autolearn: 0 AvgScore: -1.04 AvgScanTime: 1.08 sec Time Spent Running SA: 84.05 hours Time Spent Processing Spam: 29.29 hours Time Spent Processing Ham: 54.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84714 85.42 95.90 80.34 2 DKIM_SIGNED 81715 81.39 92.51 76.01 3 XM_DK_Pass 79006 79.73 89.44 75.02 4 DKIM_VALID 78047 79.04 88.36 74.52 5 XM_B_Unicode 76175 75.29 86.24 69.99 6 T_SCC_BODY_TEXT_LINE 71435 82.63 80.87 83.49 7 RELAYCOUNTRY_US 69224 78.81 78.37 79.03 8 XMListUnsubscribeExists 67273 61.83 76.16 54.90 9 XM_B_SpammyWords 65801 54.10 74.49 44.23 10 DCC_CHECK 64150 51.08 72.62 40.64 11 DKIM_VALID_AU 59325 65.71 67.16 65.01 12 XM_DK_Undo_02 42103 20.18 47.66 6.86 13 XM_B_Unicode3 40847 45.35 46.24 44.92 14 XM_B_SpammyWords2 38615 27.32 43.72 19.38 15 LOC_TINY_FONT_1 36281 33.19 41.07 29.37 16 BAYES_99 35372 17.23 40.04 6.18 17 TR_XM_DKIM_Undo 32898 14.03 37.24 2.78 18 HTML_FONT_LOW_CONTRAST 30665 33.08 34.72 32.29 19 BAYES_50 29985 49.51 33.95 57.05 20 FVGT_m_MULTI_ODD 28948 28.92 32.77 27.06 21 BAYES_999 27894 13.58 31.58 4.87 22 MIME_HTML_ONLY 27538 23.66 31.18 20.02 23 T_KAM_HTML_FONT_INVALID 27249 23.86 30.85 20.48 24 DKIM_VALID_EF 26589 29.51 30.10 29.22 25 RCVD_IN_MSPIKE_H2 25146 27.50 28.47 27.03 26 TR_DCC_Bayes_99 24977 10.87 28.28 2.43 27 DCC_CHECK_NEGATIVE 24173 48.90 27.37 59.32 28 TR_XM_DK_Unsub 20102 18.06 22.76 15.78 29 T_TM2_M_HEADER_IN_MSG 19160 22.59 21.69 23.02 30 RELAYCOUNTRY_META 18403 9.43 20.83 3.91 31 XMSubLong 16721 21.63 18.93 22.94 32 XM_Multi_Part_URI 16592 16.60 18.78 15.54 33 TR_XM_SpammyRelay 15058 7.19 17.05 2.42 34 TR_XM_SpammyWords2 14190 5.54 16.06 0.44 35 TR_MAX_INTL_RELAY 13970 10.64 15.82 8.13 36 XM_B_Unsub 12384 10.37 14.02 8.60 37 BOTNET_IPINHOSTNAME 12069 8.59 13.66 6.13 38 TR_XM_BayesUnsub 11997 9.40 13.58 7.37 39 UNPARSEABLE_RELAY 11981 11.80 13.56 10.95 40 XM_B_SpammyWords3 11509 7.38 13.03 4.64 41 RELAYCOUNTRY_CA 11337 5.36 12.83 1.74 42 RCVD_IN_BL_SPAMCOP_NET 10794 4.32 12.22 0.50 43 LOTS_OF_MONEY 9725 7.35 11.01 5.57 44 TR_XM_SpammyWords4 8727 6.02 9.88 4.15 45 XM_Body_Dirty_Words 8626 5.76 9.77 3.82 46 BAYES_80 8306 6.36 9.40 4.88 47 TR_XM_SPAMCOP 8275 3.18 9.37 0.19 48 RCVD_IN_MSPIKE_H3 7934 6.87 8.98 5.85 49 RCVD_IN_MSPIKE_WL 7934 6.87 8.98 5.85 50 XMBody_17 7636 3.29 8.64 0.70 51 TR_XM_UnparsRelay 7183 3.77 8.13 1.65 52 HTML_IMAGE_RATIO_02 7099 7.27 8.04 6.90 53 XM_Evil_Numbers_Gen 7097 8.16 8.03 8.22 54 BOTNET 7055 3.42 7.99 1.22 55 BAYES_60 7016 10.07 7.94 11.10 56 TooManyTo_001 6007 7.06 6.80 7.18 57 XMSubMetaSx_00 5813 5.07 6.58 4.34 58 MPART_ALT_DIFF 5382 4.69 6.09 4.00 59 HTML_IMAGE_RATIO_04 5375 5.83 6.08 5.71 60 LotsOfNums_01 5333 6.67 6.04 6.97 61 T_FILL_THIS_FORM_SHORT 5198 2.28 5.88 0.54 62 BAYES_95 5109 4.08 5.78 3.25 63 XMSexyCombo_05 5093 3.30 5.77 2.10 64 FSL_BULK_SIG 5074 4.80 5.74 4.34 65 UNTRUSTED_Relay 4789 2.93 5.42 1.72 66 XM_H_Long_From01 4395 5.03 4.98 5.05 67 T_XMDrugObfuBody_14 4341 3.07 4.91 2.17 68 XM_H_GMP 4289 7.03 4.86 8.09 69 XM_UncommonTLD01 4230 4.69 4.79 4.64 70 MIME_HTML_MOSTLY 4162 3.31 4.71 2.62 71 HTML_IMAGE_RATIO_06 4015 3.60 4.55 3.14 72 XM_B_Phish_Phrases 3989 3.49 4.52 3.00 73 TR_XM_PhishingBody 3984 2.77 4.51 1.93 74 XM_OfRef6 3720 2.13 4.21 1.12 75 DKIM_INVALID 3668 2.36 4.15 1.49 76 XM_SPF_SoftFail 3665 3.16 4.15 2.69 77 FONT_INVIS_LONG_LINE 3596 1.39 4.07 0.09 78 XMStrtUSub 3596 5.58 4.07 6.32 79 TR_XM_FormFill 3555 1.32 4.02 0.01 80 RCVD_IN_VALIDITY_SAFE 3432 6.32 3.89 7.50 81 MIME_HTML_ONLY_MULTI 3423 2.89 3.88 2.41 82 TR_XM_SpammyWords5 3411 2.15 3.86 1.32 83 TR_XM_BayesRelay 3227 1.19 3.65 0.00 84 TM2_M_URI_OPT_OUT 3099 2.54 3.51 2.07 85 XMNumbers 3034 3.36 3.43 3.32 86 XM_B_Investor 2902 1.93 3.29 1.28 87 T_XMDrugObfuBody_08 2831 1.95 3.20 1.35 88 RCVD_IN_VALIDITY_CERTIFIED 2777 5.69 3.14 6.92 89 HTML_IMAGE_RATIO_08 2721 2.70 3.08 2.52 90 USER_IN_DEF_DKIM_WL 2699 12.19 3.06 16.61 91 XM_B_SpammyTLD 2651 3.02 3.00 3.04 92 XM_CamelCaseFrm001 2533 2.55 2.87 2.40 93 TM2_M_VERY_LONG_WORD 2527 1.72 2.86 1.17 94 FROM_EXCESS_BASE64 2487 2.23 2.82 1.94 95 XM_URI_RBL 2403 1.05 2.72 0.23 96 TR_XM_PHPForged 2341 1.06 2.65 0.28 97 XM_UB50 2337 1.51 2.65 0.96 98 TR_XM_PHPDW 2304 1.03 2.61 0.26 99 TR_XM_FormFill2 2258 1.01 2.56 0.27 100 TR_LOTS_OF_MONEY3 2253 1.03 2.55 0.29 101 XM_H_PHPOS 2242 0.99 2.54 0.24 102 XMDiploma_00 2220 1.79 2.51 1.44 103 T_XMHurry_00 2192 1.21 2.48 0.59 104 T_TooManySym_01 2170 5.07 2.46 6.33 105 XMBrknScrpt_02 2053 1.20 2.32 0.66 106 SUBJ_ALL_CAPS 2037 1.45 2.31 1.04 107 XMStockSpam_06 2033 1.87 2.30 1.66 108 TR_XM_NoHeaderRelay 2032 0.85 2.30 0.15 109 XM_B_Unsub2 1983 1.38 2.24 0.96 110 AC_BR_BONANZA 1962 0.82 2.22 0.14 111 RELAYCOUNTRY_AU 1854 0.97 2.10 0.43 112 HTML_TAG_BALANCE_BODY 1806 1.09 2.04 0.63 113 XM_B_SpammyWords4 1757 1.34 1.99 1.02 114 XMPhish30 1591 1.08 1.80 0.73 115 MIME_QP_LONG_LINE 1563 2.69 1.77 3.13 116 XM_HighProb1 1534 0.57 1.74 0.00 117 SpammyFromTLD_01 1518 0.82 1.72 0.39 118 SpammyFromTLD_02 1491 0.70 1.69 0.23 119 TR_XM_INV_DKIM 1460 0.59 1.65 0.07 120 XM_SendGrid 1429 1.39 1.62 1.27 121 T_XMDrugObfuBody_00 1413 0.91 1.60 0.57 122 XM_DIRTYINTL 1402 0.61 1.59 0.13 123 T_REMOTE_IMAGE 1395 2.43 1.58 2.84 124 URI_HEX 1373 1.02 1.55 0.76 125 DIET_1 1369 0.75 1.55 0.36 126 HTTPS_HTTP_MISMATCH 1329 0.85 1.50 0.54 127 XMBdyGiftCard01 1319 1.41 1.49 1.37 128 BOTNET_NORDNS 1318 0.49 1.49 0.01 129 MAILING_LIST_MULTI 1301 2.02 1.47 2.29 130 XMReplyNow 1291 0.68 1.46 0.31 131 ALL_TRUSTED 1270 12.10 1.44 17.26 132 XM_H_PHPMailer 1265 0.98 1.43 0.77 133 HK_RANDOM_REPLYTO 1205 0.53 1.36 0.13 134 TR_XM_Base64_L1 1171 0.58 1.33 0.22 135 XMSubMetaI_00 1158 0.85 1.31 0.62 136 KHOP_HELO_FCRDNS 1134 0.91 1.28 0.72 137 XM_DK_Undo_01 1108 1.51 1.25 1.63 138 URI_TRY_3LD 1088 1.11 1.23 1.05 139 BAYES_40 1054 3.15 1.19 4.10 140 XM_UB99 1050 0.39 1.19 0.00 141 TR_Caps_n_Bayes_99 1036 0.39 1.17 0.01 142 SHOPIFY_IMG_NOT_RCVD_SFY 1003 0.66 1.14 0.43 143 HTML_MIME_NO_HTML_TAG 988 1.28 1.12 1.35 144 XMSexyCombo_01 986 0.48 1.12 0.17 145 DKIM_ADSP_CUSTOM_MED 986 1.09 1.12 1.08 146 XMPhish14 985 0.66 1.12 0.43 147 RCVD_IN_VALIDITY_RPBL 979 0.39 1.11 0.04 148 XMSubMetaSxObfu_03 975 0.64 1.10 0.41 149 THIS_AD 964 0.50 1.09 0.21 150 TR_XM_Base64_M1 954 0.93 1.08 0.85 151 XMGppyBdWords 948 0.50 1.07 0.22 152 TR_XM_DK_SendGrid 948 1.00 1.07 0.97 153 XM_H_Long_From02 938 1.07 1.06 1.07 154 NML_ADSP_CUSTOM_MED 908 0.86 1.03 0.79 155 XM_H_Undi_Recip 887 0.41 1.00 0.12 156 XM_B_Phish66 880 0.54 1.00 0.31 157 T_Symld_Words_02 872 0.57 0.99 0.37 158 XM_H_PHPOS_M 868 0.39 0.98 0.10 159 MPART_ALT_DIFF_COUNT 865 0.97 0.98 0.97 160 FORGED_GMAIL_RCVD 856 0.79 0.97 0.70 161 PDS_OTHER_BAD_TLD 852 0.50 0.96 0.27 162 TR_Mismatch_TLD_01 850 0.52 0.96 0.30 163 TooManyTo_002 848 1.52 0.96 1.80 164 BOUNCE_MESSAGE 842 4.29 0.95 5.90 165 TR_XM_InvalidRelay 842 0.33 0.95 0.02 166 ANY_BOUNCE_MESSAGE 842 4.29 0.95 5.90 167 XM_UB999 833 0.31 0.94 0.00 168 TR_Mismatch_TLD_02 816 0.37 0.92 0.10 169 TooManyTo_003 805 0.92 0.91 0.92 170 XMClaimOffer 804 0.35 0.91 0.08 171 T_STY_INVIS_DIRECT 804 0.50 0.91 0.30 172 TR_XM_Undi_Recip19 804 0.36 0.91 0.09 173 TR_Symld_Words 801 1.08 0.91 1.16 174 SUBJ_DOLLARS 800 0.47 0.91 0.26 175 XM_B_COPY_HTML 799 1.44 0.90 1.69 176 TooManyTo_004 780 0.79 0.88 0.74 177 TR_LOTS_OF_MONEY2 778 0.59 0.88 0.45 178 T_MONEY_PERCENT 778 0.59 0.88 0.45 179 SCC_BODY_URI_ONLY 778 2.82 0.88 3.76 180 FORGED_RELAY_MUA_TO_MX 775 0.30 0.88 0.02 181 RDNS_DYNAMIC 772 0.58 0.87 0.43 182 TooManyTo_005 746 0.70 0.84 0.63 183 PLING_QUERY 739 0.57 0.84 0.44 184 TM2_M_OBFU_COMMENT 732 0.42 0.83 0.23 185 XMGenDplmaNmb 730 0.84 0.83 0.84 186 BAYES_20 728 2.23 0.82 2.91 187 TVD_RCVD_IP 721 2.12 0.82 2.76 188 XMSlimDrugH 721 0.43 0.82 0.24 189 XM_ProductURIs 717 0.70 0.81 0.65 190 XM_RXBody 712 0.33 0.81 0.10 191 HELO_NODOT 708 0.59 0.80 0.49 192 URI_NOVOWEL 707 0.96 0.80 1.03 193 HELO_NO_DOMAIN 702 0.59 0.79 0.49 194 TR_MetaPhish_Combo_01 694 0.71 0.79 0.68 195 RCVD_IN_RP_SAFE 690 1.28 0.78 1.53 196 RCVD_IN_PSBL 687 0.58 0.78 0.49 197 RCVD_IN_IADB_LISTED 686 2.06 0.78 2.68 198 FSL_HELO_NON_FQDN_1 683 0.26 0.77 0.00 199 TM2_M_A_HREF_HREF 678 0.37 0.77 0.18 200 URIBL_DBL_SPAM 661 0.25 0.75 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 152250 82.63 80.87 83.49 2 HTML_MESSAGE 146518 85.42 95.90 80.34 3 RELAYCOUNTRY_US 144119 78.81 78.37 79.03 4 DKIM_SIGNED 138611 81.39 92.51 76.01 5 XM_DK_Pass 136812 79.73 89.44 75.02 6 DKIM_VALID 135902 79.04 88.36 74.52 7 XM_B_Unicode 127628 75.29 86.24 69.99 8 DKIM_VALID_AU 118553 65.71 67.16 65.01 9 DCC_CHECK_NEGATIVE 108185 48.90 27.37 59.32 10 BAYES_50 104032 49.51 33.95 57.05 11 XMListUnsubscribeExists 100109 61.83 76.16 54.90 12 XM_B_Unicode3 81909 45.35 46.24 44.92 13 XM_B_SpammyWords 80657 54.10 74.49 44.23 14 DCC_CHECK 74113 51.08 72.62 40.64 15 HTML_FONT_LOW_CONTRAST 58885 33.08 34.72 32.29 16 LOC_TINY_FONT_1 53553 33.19 41.07 29.37 17 DKIM_VALID_EF 53284 29.51 30.10 29.22 18 FVGT_m_MULTI_ODD 49348 28.92 32.77 27.06 19 RCVD_IN_MSPIKE_H2 49300 27.50 28.47 27.03 20 T_TM2_M_HEADER_IN_MSG 41987 22.59 21.69 23.02 21 XMSubLong 41843 21.63 18.93 22.94 22 T_KAM_HTML_FONT_INVALID 37352 23.86 30.85 20.48 23 MIME_HTML_ONLY 36503 23.66 31.18 20.02 24 XM_B_SpammyWords2 35337 27.32 43.72 19.38 25 ALL_TRUSTED 31483 12.10 1.44 17.26 26 USER_IN_DEF_DKIM_WL 30291 12.19 3.06 16.61 27 TR_XM_DK_Unsub 28781 18.06 22.76 15.78 28 XM_Multi_Part_URI 28347 16.60 18.78 15.54 29 XM_DKIMWhitelistDomains 22347 8.26 0.03 12.25 30 BAYES_60 20251 10.07 7.94 11.10 31 UNPARSEABLE_RELAY 19974 11.80 13.56 10.95 32 XM_B_Unsub 15691 10.37 14.02 8.60 33 XM_Evil_Numbers_Gen 14985 8.16 8.03 8.22 34 TR_MAX_INTL_RELAY 14831 10.64 15.82 8.13 35 XM_H_GMP 14749 7.03 4.86 8.09 36 RCVD_IN_VALIDITY_SAFE 13674 6.32 3.89 7.50 37 TR_XM_BayesUnsub 13445 9.40 13.58 7.37 38 BAYES_00 13441 5.10 0.42 7.37 39 TooManyTo_001 13099 7.06 6.80 7.18 40 LotsOfNums_01 12710 6.67 6.04 6.97 41 RCVD_IN_VALIDITY_CERTIFIED 12620 5.69 3.14 6.92 42 HTML_IMAGE_RATIO_02 12582 7.27 8.04 6.90 43 XM_DK_Undo_02 12510 20.18 47.66 6.86 44 T_TooManySym_01 11550 5.07 2.46 6.33 45 XMStrtUSub 11522 5.58 4.07 6.32 46 BAYES_99 11263 17.23 40.04 6.18 47 BOTNET_IPINHOSTNAME 11184 8.59 13.66 6.13 48 TR_XM_DK_Bayes 10990 4.17 0.35 6.03 49 TR_XM_DK_Bayes1 10928 4.13 0.29 5.99 50 ANY_BOUNCE_MESSAGE 10760 4.29 0.95 5.90 51 BOUNCE_MESSAGE 10760 4.29 0.95 5.90 52 RCVD_IN_MSPIKE_H3 10669 6.87 8.98 5.85 53 RCVD_IN_MSPIKE_WL 10669 6.87 8.98 5.85 54 HTML_IMAGE_RATIO_04 10416 5.83 6.08 5.71 55 LOTS_OF_MONEY 10162 7.35 11.01 5.57 56 TR_XM_DK_Bayes2 9789 3.67 0.18 5.37 57 IN_ZIMBRA_NJ_WHITELIST 9328 3.46 0.04 5.12 58 XM_H_Long_From01 9213 5.03 4.98 5.05 59 BAYES_80 8898 6.36 9.40 4.88 60 BAYES_999 8874 13.58 31.58 4.87 61 XM_B_SpammyWords3 8467 7.38 13.03 4.64 62 XM_UncommonTLD01 8460 4.69 4.79 4.64 63 XMSubMetaSx_00 7915 5.07 6.58 4.34 64 FSL_BULK_SIG 7913 4.80 5.74 4.34 65 TR_XM_SpammyWords4 7571 6.02 9.88 4.15 66 BAYES_40 7468 3.15 1.19 4.10 67 MPART_ALT_DIFF 7302 4.69 6.09 4.00 68 RELAYCOUNTRY_META 7123 9.43 20.83 3.91 69 XM_Body_Dirty_Words 6958 5.76 9.77 3.82 70 T_TooManySym_02 6882 2.75 0.62 3.77 71 SCC_BODY_URI_ONLY 6860 2.82 0.88 3.76 72 INVALID_MSGID 6841 2.60 0.22 3.75 73 TO_MALFORMED 6231 2.31 0.02 3.42 74 XMNumbers 6061 3.36 3.43 3.32 75 BAYES_95 5931 4.08 5.78 3.25 76 BAYES_05 5765 2.27 0.44 3.16 77 HTML_IMAGE_RATIO_06 5721 3.60 4.55 3.14 78 MIME_QP_LONG_LINE 5712 2.69 1.77 3.13 79 XM_B_SpammyTLD 5537 3.02 3.00 3.04 80 XM_B_Phish_Phrases 5464 3.49 4.52 3.00 81 BAYES_20 5304 2.23 0.82 2.91 82 T_REMOTE_IMAGE 5185 2.43 1.58 2.84 83 TR_XM_DKIM_Undo 5070 14.03 37.24 2.78 84 TVD_RCVD_IP 5029 2.12 0.82 2.76 85 XM_SPF_SoftFail 4902 3.16 4.15 2.69 86 RCVD_IN_IADB_LISTED 4889 2.06 0.78 2.68 87 MIME_HTML_MOSTLY 4786 3.31 4.71 2.62 88 HTML_IMAGE_RATIO_08 4597 2.70 3.08 2.52 89 RCVD_IN_IADB_SPF 4441 1.87 0.71 2.44 90 TR_DCC_Bayes_99 4437 10.87 28.28 2.43 91 TR_XM_SpammyRelay 4417 7.19 17.05 2.42 92 MIME_HTML_ONLY_MULTI 4392 2.89 3.88 2.41 93 XM_CamelCaseFrm001 4383 2.55 2.87 2.40 94 MAILING_LIST_MULTI 4179 2.02 1.47 2.29 95 RCVD_IN_IADB_SENDERID 4099 1.73 0.67 2.25 96 RCVD_IN_IADB_DK 4012 1.71 0.69 2.20 97 T_XMDrugObfuBody_14 3962 3.07 4.91 2.17 98 XMSexyCombo_05 3837 3.30 5.77 2.10 99 XMBSHREFv2 3791 1.51 0.33 2.08 100 XMGappySubj_01 3784 1.43 0.11 2.07 101 TM2_M_URI_OPT_OUT 3781 2.54 3.51 2.07 102 FROM_EXCESS_BASE64 3537 2.23 2.82 1.94 103 TR_XM_PhishingBody 3518 2.77 4.51 1.93 104 XM_PDF 3509 1.42 0.38 1.92 105 TooManyTo_002 3275 1.52 0.96 1.80 106 XMGappySubj_02 3256 1.22 0.06 1.79 107 TVD_SPACE_RATIO 3197 1.23 0.15 1.75 108 RELAYCOUNTRY_CA 3167 5.36 12.83 1.74 109 UNTRUSTED_Relay 3137 2.93 5.42 1.72 110 XM_B_COPY_HTML 3088 1.44 0.90 1.69 111 IN_HORDE_ADDRESS_BOOK 3058 1.15 0.06 1.68 112 XMStockSpam_06 3029 1.87 2.30 1.66 113 TR_XM_UnparsRelay 3012 3.77 8.13 1.65 114 XM_DK_Undo_01 2974 1.51 1.25 1.63 115 RCVD_IN_RP_SAFE 2787 1.28 0.78 1.53 116 DKIM_INVALID 2709 2.36 4.15 1.49 117 RCVD_IN_IADB_VOUCHED 2707 1.10 0.29 1.48 118 XMDiploma_00 2631 1.79 2.51 1.44 119 XMBody_95 2604 0.99 0.10 1.43 120 RCVD_IN_RP_CERTIFIED 2599 1.16 0.60 1.43 121 XMBdyGiftCard01 2506 1.41 1.49 1.37 122 XM_GoogleGroups 2476 1.07 0.49 1.36 123 HTML_MIME_NO_HTML_TAG 2467 1.28 1.12 1.35 124 T_XMDrugObfuBody_08 2460 1.95 3.20 1.35 125 TR_XM_SpammyWords5 2402 2.15 3.86 1.32 126 XM_B_Investor 2332 1.93 3.29 1.28 127 XM_SendGrid 2323 1.39 1.62 1.27 128 MSGID_NOFQDN1 2323 0.87 0.04 1.27 129 T_TooManySym_03 2288 0.93 0.26 1.25 130 BOTNET 2216 3.42 7.99 1.22 131 TM2_M_VERY_LONG_WORD 2134 1.72 2.86 1.17 132 TR_Symld_Words 2116 1.08 0.91 1.16 133 XM_OfRef6 2039 2.13 4.21 1.12 134 DKIM_ADSP_CUSTOM_MED 1964 1.09 1.12 1.08 135 XM_H_Long_From02 1951 1.07 1.06 1.07 136 RCVD_IN_IADB_OPTIN 1927 0.78 0.20 1.06 137 URI_TRY_3LD 1916 1.11 1.23 1.05 138 SUBJ_ALL_CAPS 1899 1.45 2.31 1.04 139 URI_NOVOWEL 1879 0.96 0.80 1.03 140 XM_B_SpammyWords4 1857 1.34 1.99 1.02 141 MPART_ALT_DIFF_COUNT 1764 0.97 0.98 0.97 142 TR_XM_DK_SendGrid 1764 1.00 1.07 0.97 143 USER_IN_WHITELIST 1756 0.65 0.00 0.96 144 USER_IN_WELCOMELIST 1756 0.65 0.00 0.96 145 XM_B_Unsub2 1750 1.38 2.24 0.96 146 XM_UB50 1748 1.51 2.65 0.96 147 TooManyTo_003 1682 0.92 0.91 0.92 148 TR_XM_Base64_M1 1557 0.93 1.08 0.85 149 XMGenDplmaNmb 1534 0.84 0.83 0.84 150 NML_ADSP_CUSTOM_MED 1432 0.86 1.03 0.79 151 XM_H_PHPMailer 1398 0.98 1.43 0.77 152 URI_HEX 1391 1.02 1.55 0.76 153 TooManyTo_004 1355 0.79 0.88 0.74 154 XMPhish30 1336 1.08 1.80 0.73 155 KHOP_HELO_FCRDNS 1320 0.91 1.28 0.72 156 XMSubMetaSxObfu_02 1301 0.60 0.37 0.71 157 XMBody_17 1273 3.29 8.64 0.70 158 FORGED_GMAIL_RCVD 1271 0.79 0.97 0.70 159 XM_H_Trusted_IP 1269 0.47 0.00 0.70 160 XMNoVowels 1268 0.60 0.40 0.70 161 XMSubNoVowel 1267 0.63 0.48 0.69 162 TR_MetaPhish_Combo_01 1240 0.71 0.79 0.68 163 XMBrknScrpt_02 1203 1.20 2.32 0.66 164 XM_ProductURIs 1180 0.70 0.81 0.65 165 TooManyTo_005 1154 0.70 0.84 0.63 166 HTML_TAG_BALANCE_BODY 1148 1.09 2.04 0.63 167 XMSubMetaI_00 1133 0.85 1.31 0.62 168 T_XMHurry_00 1075 1.21 2.48 0.59 169 T_XMDrugObfuBody_00 1046 0.91 1.60 0.57 170 XM_B_FormFill 1004 0.38 0.02 0.55 171 T_FILL_THIS_FORM_SHORT 986 2.28 5.88 0.54 172 XM_B_REG_HTML 979 0.50 0.42 0.54 173 HTTPS_HTTP_MISMATCH 978 0.85 1.50 0.54 174 RCVD_IN_BL_SPAMCOP_NET 910 4.32 12.22 0.50 175 FILL_THIS_FORM 901 0.43 0.31 0.49 176 HELO_NODOT 900 0.59 0.80 0.49 177 HELO_NO_DOMAIN 896 0.59 0.79 0.49 178 RCVD_IN_PSBL 893 0.58 0.78 0.49 179 T_TooManySym_04 859 0.37 0.16 0.47 180 XM_B_DNDMA 832 0.54 0.72 0.46 181 TR_LOTS_OF_MONEY2 821 0.59 0.88 0.45 182 T_MONEY_PERCENT 821 0.59 0.88 0.45 183 XM_S_SubURI 818 0.32 0.06 0.45 184 TR_XM_SpammyWords2 797 5.54 16.06 0.44 185 PLING_QUERY 796 0.57 0.84 0.44 186 RDNS_DYNAMIC 792 0.58 0.87 0.43 187 XMPhish14 791 0.66 1.12 0.43 188 RELAYCOUNTRY_AU 783 0.97 2.10 0.43 189 XMHTML_After_End 782 0.53 0.75 0.43 190 DKIM_ADSP_NXDOMAIN 780 0.44 0.48 0.43 191 SHOPIFY_IMG_NOT_RCVD_SFY 777 0.66 1.14 0.43 192 XMSubMetaSxObfu_03 748 0.64 1.10 0.41 193 HTML_FONT_FACE_BAD 744 0.45 0.55 0.41 194 BAD_CREDIT 731 0.27 0.01 0.40 195 CTE_8BIT_MISMATCH 723 0.27 0.01 0.40 196 XM_B_COVIDMETA 722 0.36 0.27 0.40 197 FILL_THIS_FORM_LONG 717 0.31 0.15 0.39 198 NO_DNS_FOR_FROM 704 0.41 0.46 0.39 199 SpammyFromTLD_01 703 0.82 1.72 0.39 200 XM_Walgreens_Forge 703 0.27 0.02 0.39 ----------------------------------------------------------------------