Email: 313196 Autolearn: 0 AvgScore: 4.62 AvgScanTime: 1.14 sec Spam: 124723 Autolearn: 0 AvgScore: 12.96 AvgScanTime: 1.09 sec Ham: 188473 Autolearn: 0 AvgScore: -0.90 AvgScanTime: 1.17 sec Time Spent Running SA: 98.78 hours Time Spent Processing Spam: 37.70 hours Time Spent Processing Ham: 61.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 117269 84.53 94.02 78.25 2 XM_DK_Pass 114411 83.03 91.73 77.27 3 DKIM_VALID 113296 82.40 90.84 76.81 4 RELAYCOUNTRY_US 100627 80.25 80.68 79.96 5 XMListUnsubscribeExists 99044 65.42 79.41 56.17 6 HTML_MESSAGE 96059 79.72 77.02 81.51 7 DKIM_VALID_AU 91131 68.81 73.07 66.00 8 XM_B_Unicode 86618 69.65 69.45 69.78 9 DCC_CHECK 74137 47.28 59.44 39.23 10 XM_B_SpammyWords 73980 50.61 59.32 44.84 11 XM_DK_Undo_02 51587 20.97 41.36 7.47 12 DCC_CHECK_NEGATIVE 50579 52.71 40.55 60.75 13 XM_B_Unicode3 47168 41.36 37.82 43.71 14 XM_B_SpammyWords2 42238 25.92 33.87 20.66 15 BAYES_99 41698 17.14 33.43 6.36 16 TR_XM_DKIM_Undo 39713 14.62 31.84 3.23 17 LOC_TINY_FONT_1 38995 29.94 31.27 29.06 18 BAYES_50 35851 45.58 28.74 56.72 19 HTML_FONT_LOW_CONTRAST 34331 30.39 27.53 32.28 20 FVGT_m_MULTI_ODD 33106 26.43 26.54 26.36 21 BAYES_999 33051 13.62 26.50 5.10 22 RCVD_IN_MSPIKE_H2 31136 26.87 24.96 28.13 23 DKIM_VALID_EF 31042 27.75 24.89 29.64 24 T_KAM_HTML_FONT_INVALID 30244 22.12 24.25 20.71 25 TR_DCC_Bayes_99 29744 11.04 23.85 2.56 26 XM_UncommonTLD01 29703 12.31 23.82 4.69 27 MIME_HTML_ONLY 29674 22.75 23.79 22.06 28 XMNumbers 27712 10.84 22.22 3.31 29 SpammyFromTLD_01 26678 8.87 21.39 0.58 30 TR_XM_PHPForged 26353 8.69 21.13 0.46 31 TR_XM_PHPDW 26254 8.66 21.05 0.46 32 TR_XM_FormFill2 26233 8.66 21.03 0.47 33 XM_H_PHPOS 26208 8.64 21.01 0.45 34 XMSubLong 25920 21.44 20.78 21.88 35 TR_XM_DK_Unsub 24355 17.10 19.53 15.49 36 TM2_M_BODY_EMPTY 24233 8.01 19.43 0.45 37 XMEmptyBody_01 24204 7.87 19.41 0.24 38 RELAYCOUNTRY_META 23031 9.98 18.47 4.37 39 T_TM2_M_HEADER_IN_MSG 21464 19.87 17.21 21.62 40 TR_XM_SpammyRelay 19546 7.78 15.67 2.55 41 XM_Multi_Part_URI 18201 15.32 14.59 15.80 42 TR_XM_SpammyWords2 16828 5.96 13.49 0.98 43 TR_MAX_INTL_RELAY 16629 10.11 13.33 7.98 44 XM_SPF_SoftFail 16194 6.74 12.98 2.60 45 XM_B_Unsub 15776 10.07 12.65 8.37 46 XM_B_SpammyWords3 15744 8.39 12.62 5.59 47 TR_XM_BayesUnsub 15281 9.03 12.25 6.89 48 RELAYCOUNTRY_CA 15055 6.04 12.07 2.05 49 UNPARSEABLE_RELAY 14446 11.40 11.58 11.27 50 RCVD_IN_BL_SPAMCOP_NET 14199 5.08 11.38 0.90 51 BOTNET_IPINHOSTNAME 12556 7.38 10.07 5.60 52 LOTS_OF_MONEY 12215 7.80 9.79 6.48 53 TR_XM_SPAMCOP 11400 3.93 9.14 0.49 54 TR_XM_SpammyWords4 10794 6.28 8.65 4.71 55 BAYES_80 10105 6.09 8.10 4.76 56 BAYES_40 9691 5.46 7.77 3.92 57 BAYES_20 9466 4.68 7.59 2.75 58 RCVD_IN_MSPIKE_WL 9125 6.56 7.32 6.06 59 RCVD_IN_MSPIKE_H3 9125 6.56 7.32 6.06 60 TR_XM_UnparsRelay 8808 4.13 7.06 2.20 61 BOTNET 8047 3.25 6.45 1.13 62 XMBody_17 7781 2.99 6.24 0.83 63 BAYES_60 7534 9.12 6.04 11.15 64 TooManyTo_001 7340 6.16 5.89 6.35 65 XM_Evil_Numbers_Gen 7300 7.17 5.85 8.04 66 XM_Body_Dirty_Words 7246 4.49 5.81 3.62 67 FSL_BULK_SIG 7085 4.63 5.68 3.94 68 HTML_IMAGE_RATIO_02 6899 6.31 5.53 6.83 69 BAYES_95 6203 3.92 4.97 3.22 70 XMSubMetaSx_00 6082 4.92 4.88 4.95 71 MPART_ALT_DIFF 5959 4.44 4.78 4.21 72 LotsOfNums_01 5601 6.52 4.49 7.87 73 HTML_IMAGE_RATIO_04 5211 4.91 4.18 5.39 74 XM_H_GMP 5143 6.25 4.12 7.66 75 UNTRUSTED_Relay 5139 2.67 4.12 1.72 76 T_FILL_THIS_FORM_SHORT 4987 1.96 4.00 0.60 77 XMSexyCombo_05 4741 3.16 3.80 2.73 78 HTML_IMAGE_RATIO_06 4700 3.00 3.77 2.49 79 XM_H_Long_From01 4536 4.44 3.64 4.97 80 XM_OfRef6 4404 2.10 3.53 1.15 81 XM_B_Phish_Phrases 4076 3.39 3.27 3.47 82 DKIM_INVALID 3973 2.14 3.19 1.44 83 TR_XM_SpammyWords5 3961 2.07 3.18 1.34 84 RCVD_IN_VALIDITY_SAFE 3958 6.12 3.17 8.07 85 XM_B_Investor 3940 2.09 3.16 1.38 86 T_XMDrugObfuBody_14 3860 2.46 3.09 2.04 87 T_XMDrugObfuBody_08 3801 2.20 3.05 1.64 88 MIME_HTML_MOSTLY 3790 2.76 3.04 2.57 89 SUBJ_ALL_CAPS 3772 1.84 3.02 1.06 90 MIME_HTML_ONLY_MULTI 3705 2.61 2.97 2.37 91 HTML_IMAGE_RATIO_08 3685 2.24 2.95 1.77 92 FONT_INVIS_LONG_LINE 3645 1.21 2.92 0.08 93 BAYES_05 3631 2.96 2.91 3.00 94 XM_B_SpammyTLD 3581 2.77 2.87 2.70 95 USER_IN_DEF_DKIM_WL 3468 12.55 2.78 19.02 96 TR_XM_PhishingBody 3435 2.27 2.75 1.94 97 TM2_M_URI_OPT_OUT 3416 2.44 2.74 2.24 98 TR_XM_FormFill 3297 1.07 2.64 0.02 99 XM_CamelCaseFrm001 3153 2.66 2.53 2.76 100 TR_LOTS_OF_MONEY3 3148 1.30 2.52 0.49 101 RCVD_IN_VALIDITY_CERTIFIED 3065 5.13 2.46 6.91 102 TR_XM_BayesRelay 3048 0.97 2.44 0.00 103 TM2_M_VERY_LONG_WORD 2792 1.66 2.24 1.28 104 XMStrtUSub 2767 4.12 2.22 5.38 105 T_XMHurry_00 2708 1.40 2.17 0.90 106 XM_URI_RBL 2687 1.00 2.15 0.23 107 XMBrknScrpt_02 2511 1.29 2.01 0.82 108 XM_UB50 2333 1.29 1.87 0.91 109 AC_BR_BONANZA 2302 0.83 1.85 0.16 110 RELAYCOUNTRY_AU 2259 1.09 1.81 0.61 111 FROM_EXCESS_BASE64 2216 2.10 1.78 2.31 112 XM_B_SpammyWords4 2120 1.15 1.70 0.79 113 TR_XM_NoHeaderRelay 2009 0.70 1.61 0.10 114 XMDiploma_00 1874 1.47 1.50 1.45 115 T_TooManySym_01 1867 5.03 1.50 7.37 116 XM_B_Unsub2 1866 1.34 1.50 1.24 117 MIME_QP_LONG_LINE 1847 2.85 1.48 3.76 118 HTML_TAG_BALANCE_BODY 1833 0.82 1.47 0.40 119 XM_HighProb1 1810 0.58 1.45 0.00 120 HK_RANDOM_REPLYTO 1708 0.62 1.37 0.13 121 XMStockSpam_06 1692 1.57 1.36 1.71 122 ALL_TRUSTED 1685 10.13 1.35 15.94 123 TR_Mismatch_TLD_02 1672 0.56 1.34 0.04 124 T_REMOTE_IMAGE 1637 2.61 1.31 3.46 125 XMBdyGiftCard01 1618 1.35 1.30 1.39 126 XM_B_COPY_HTML 1611 1.10 1.29 0.97 127 BOTNET_NORDNS 1544 0.50 1.24 0.01 128 THIS_AD 1495 0.75 1.20 0.46 129 URIBL_DBL_SPAM 1466 0.49 1.18 0.03 130 MAILING_LIST_MULTI 1465 1.86 1.17 2.32 131 HTML_MIME_NO_HTML_TAG 1458 1.60 1.17 1.88 132 XMReplyNow 1453 0.61 1.16 0.24 133 KHOP_HELO_FCRDNS 1413 0.74 1.13 0.47 134 XM_H_PHPMailer 1391 0.85 1.12 0.67 135 XM_DK_Undo_01 1364 1.49 1.09 1.76 136 XM_SendGrid 1361 1.24 1.09 1.33 137 XMPhish30 1343 0.83 1.08 0.67 138 HTTPS_HTTP_MISMATCH 1339 0.84 1.07 0.68 139 TR_XM_INV_DKIM 1326 0.46 1.06 0.06 140 TR_XM_InvalidRelay 1292 0.43 1.04 0.02 141 XM_H_Undi_Recip 1291 0.48 1.04 0.11 142 URI_TRY_3LD 1269 0.89 1.02 0.80 143 PDS_OTHER_BAD_TLD 1215 0.47 0.97 0.14 144 DIET_1 1213 0.66 0.97 0.46 145 MPART_ALT_DIFF_COUNT 1207 0.90 0.97 0.86 146 URI_NOVOWEL 1200 1.12 0.96 1.22 147 URI_HEX 1197 1.00 0.96 1.03 148 SpammyFromTLD_02 1175 0.51 0.94 0.22 149 AC_HTML_NONSENSE_TAGS 1137 0.38 0.91 0.02 150 SHOPIFY_IMG_NOT_RCVD_SFY 1108 0.64 0.89 0.47 151 XM_H_Long_From02 1091 1.13 0.87 1.30 152 BOUNCE_MESSAGE 1087 3.74 0.87 5.64 153 ANY_BOUNCE_MESSAGE 1087 3.74 0.87 5.64 154 XMSubMetaI_00 1084 0.84 0.87 0.82 155 T_STY_INVIS_DIRECT 1054 0.55 0.85 0.36 156 TR_XM_Undi_RecipCombo2 1047 0.34 0.84 0.00 157 TR_XM_DK_SendGrid 1031 0.90 0.83 0.95 158 LongTLD 1022 0.50 0.82 0.29 159 RDNS_DYNAMIC 1015 0.55 0.81 0.37 160 DKIM_ADSP_CUSTOM_MED 1009 0.74 0.81 0.70 161 RCVD_IN_IADB_LISTED 1007 2.16 0.81 3.05 162 TR_Symld_Words 979 1.00 0.78 1.14 163 TR_XM_Base64_M1 966 0.93 0.77 1.04 164 XMHTML_After_End 966 0.46 0.77 0.25 165 XM_DIRTYINTL 958 0.44 0.77 0.22 166 RCVD_IN_VALIDITY_RPBL 952 0.33 0.76 0.04 167 TVD_RCVD_IP 934 1.80 0.75 2.49 168 TR_Caps_n_Bayes_99 929 0.31 0.74 0.02 169 NML_ADSP_CUSTOM_MED 917 0.56 0.74 0.45 170 TM2_M_OBFU_COMMENT 908 0.48 0.73 0.32 171 TR_XM_Undi_Recip11 905 0.30 0.73 0.01 172 RCVD_IN_IADB_SPF 890 1.98 0.71 2.82 173 T_XMDrugObfuBody_10 885 0.31 0.71 0.05 174 XM_UB99 868 0.28 0.70 0.01 175 RCVD_IN_IADB_SENDERID 848 1.85 0.68 2.62 176 RCVD_IN_IADB_DK 845 1.82 0.68 2.58 177 TR_XM_Undi_Recip19 828 0.31 0.66 0.08 178 XM_ProductURIs 828 0.67 0.66 0.67 179 XMSexyCombo_01 825 0.40 0.66 0.23 180 TR_Mismatch_TLD_01 814 0.43 0.65 0.28 181 XM_UB80 814 0.27 0.65 0.02 182 TR_XM_RelayPhish 811 0.32 0.65 0.10 183 XM_RXBody 811 0.40 0.65 0.23 184 RELAYCOUNTRY_DE 799 0.43 0.64 0.29 185 XM_H_PHPOS_M 798 0.30 0.64 0.08 186 TR_XM_Base64_L1 796 0.36 0.64 0.18 187 TooManyTo_002 794 1.24 0.64 1.64 188 FORGED_GMAIL_RCVD 784 0.50 0.63 0.42 189 XM_OfRef7 783 0.33 0.63 0.13 190 TR_MetaPhish_Combo_01 777 0.60 0.62 0.59 191 HELO_DYNAMIC_SPLIT_IP 772 0.25 0.62 0.01 192 T_Symld_Words_02 760 0.41 0.61 0.27 193 PLING_QUERY 756 0.55 0.61 0.51 194 GOOG_STO_IMG_NOHTML 755 0.37 0.61 0.21 195 XMGenDplmaNmb 753 0.72 0.60 0.80 196 RCVD_IN_PSBL 722 0.64 0.58 0.68 197 TooManyTo_003 717 0.74 0.57 0.85 198 HOSTED_IMG_MULTI_PUB_01 715 0.26 0.57 0.05 199 HELO_NODOT 701 0.50 0.56 0.46 200 HELO_NO_DOMAIN 699 0.50 0.56 0.46 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 153619 79.72 77.02 81.51 2 RELAYCOUNTRY_US 150698 80.25 80.68 79.96 3 DKIM_SIGNED 147484 84.53 94.02 78.25 4 XM_DK_Pass 145631 83.03 91.73 77.27 5 DKIM_VALID 144763 82.40 90.84 76.81 6 XM_B_Unicode 131525 69.65 69.45 69.78 7 DKIM_VALID_AU 124385 68.81 73.07 66.00 8 DCC_CHECK_NEGATIVE 114494 52.71 40.55 60.75 9 BAYES_50 106898 45.58 28.74 56.72 10 XMListUnsubscribeExists 105861 65.42 79.41 56.17 11 XM_B_SpammyWords 84514 50.61 59.32 44.84 12 XM_B_Unicode3 82383 41.36 37.82 43.71 13 DCC_CHECK 73944 47.28 59.44 39.23 14 HTML_FONT_LOW_CONTRAST 60847 30.39 27.53 32.28 15 DKIM_VALID_EF 55867 27.75 24.89 29.64 16 LOC_TINY_FONT_1 54768 29.94 31.27 29.06 17 RCVD_IN_MSPIKE_H2 53025 26.87 24.96 28.13 18 FVGT_m_MULTI_ODD 49677 26.43 26.54 26.36 19 MIME_HTML_ONLY 41583 22.75 23.79 22.06 20 XMSubLong 41233 21.44 20.78 21.88 21 T_TM2_M_HEADER_IN_MSG 40756 19.87 17.21 21.62 22 T_KAM_HTML_FONT_INVALID 39025 22.12 24.25 20.71 23 XM_B_SpammyWords2 38930 25.92 33.87 20.66 24 USER_IN_DEF_DKIM_WL 35840 12.55 2.78 19.02 25 ALL_TRUSTED 30043 10.13 1.35 15.94 26 XM_Multi_Part_URI 29782 15.32 14.59 15.80 27 TR_XM_DK_Unsub 29191 17.10 19.53 15.49 28 XM_DKIMWhitelistDomains 22078 7.06 0.02 11.71 29 UNPARSEABLE_RELAY 21246 11.40 11.58 11.27 30 BAYES_60 21023 9.12 6.04 11.15 31 XM_B_Unsub 15770 10.07 12.65 8.37 32 BAYES_00 15291 5.05 0.43 8.11 33 RCVD_IN_VALIDITY_SAFE 15204 6.12 3.17 8.07 34 XM_Evil_Numbers_Gen 15148 7.17 5.85 8.04 35 TR_MAX_INTL_RELAY 15039 10.11 13.33 7.98 36 LotsOfNums_01 14829 6.52 4.49 7.87 37 XM_H_GMP 14442 6.25 4.12 7.66 38 XM_DK_Undo_02 14078 20.97 41.36 7.47 39 T_TooManySym_01 13897 5.03 1.50 7.37 40 TR_XM_DK_Bayes 13389 4.41 0.33 7.10 41 TR_XM_DK_Bayes1 13307 4.38 0.33 7.06 42 RCVD_IN_VALIDITY_CERTIFIED 13017 5.13 2.46 6.91 43 TR_XM_BayesUnsub 12986 9.03 12.25 6.89 44 HTML_IMAGE_RATIO_02 12870 6.31 5.53 6.83 45 LOTS_OF_MONEY 12214 7.80 9.79 6.48 46 BAYES_99 11995 17.14 33.43 6.36 47 TooManyTo_001 11967 6.16 5.89 6.35 48 TR_XM_DK_Bayes2 11827 3.90 0.30 6.28 49 RCVD_IN_MSPIKE_WL 11416 6.56 7.32 6.06 50 RCVD_IN_MSPIKE_H3 11416 6.56 7.32 6.06 51 BOUNCE_MESSAGE 10631 3.74 0.87 5.64 52 ANY_BOUNCE_MESSAGE 10631 3.74 0.87 5.64 53 BOTNET_IPINHOSTNAME 10549 7.38 10.07 5.60 54 XM_B_SpammyWords3 10531 8.39 12.62 5.59 55 IN_ZIMBRA_NJ_WHITELIST 10421 3.35 0.06 5.53 56 HTML_IMAGE_RATIO_04 10158 4.91 4.18 5.39 57 XMStrtUSub 10133 4.12 2.22 5.38 58 BAYES_999 9621 13.62 26.50 5.10 59 XM_H_Long_From01 9371 4.44 3.64 4.97 60 XMSubMetaSx_00 9333 4.92 4.88 4.95 61 BAYES_80 8967 6.09 8.10 4.76 62 TR_XM_SpammyWords4 8884 6.28 8.65 4.71 63 XM_UncommonTLD01 8839 12.31 23.82 4.69 64 T_TooManySym_02 8664 2.91 0.35 4.60 65 RELAYCOUNTRY_META 8232 9.98 18.47 4.37 66 MPART_ALT_DIFF 7940 4.44 4.78 4.21 67 FSL_BULK_SIG 7425 4.63 5.68 3.94 68 BAYES_40 7395 5.46 7.77 3.92 69 MIME_QP_LONG_LINE 7093 2.85 1.48 3.76 70 INVALID_MSGID 6976 2.32 0.24 3.70 71 XM_Body_Dirty_Words 6832 4.49 5.81 3.62 72 MSGID_NOFQDN1 6532 2.14 0.14 3.47 73 XM_B_Phish_Phrases 6531 3.39 3.27 3.47 74 T_REMOTE_IMAGE 6522 2.61 1.31 3.46 75 TO_MALFORMED 6266 2.02 0.04 3.32 76 XMNumbers 6247 10.84 22.22 3.31 77 TR_XM_DKIM_Undo 6082 14.62 31.84 3.23 78 BAYES_95 6069 3.92 4.97 3.22 79 RCVD_IN_IADB_LISTED 5752 2.16 0.81 3.05 80 BAYES_05 5651 2.96 2.91 3.00 81 RCVD_IN_IADB_SPF 5311 1.98 0.71 2.82 82 XM_CamelCaseFrm001 5193 2.66 2.53 2.76 83 BAYES_20 5180 4.68 7.59 2.75 84 XMSexyCombo_05 5145 3.16 3.80 2.73 85 XM_B_SpammyTLD 5086 2.77 2.87 2.70 86 RCVD_IN_IADB_SENDERID 4943 1.85 0.68 2.62 87 XM_SPF_SoftFail 4908 6.74 12.98 2.60 88 RCVD_IN_IADB_DK 4855 1.82 0.68 2.58 89 MIME_HTML_MOSTLY 4840 2.76 3.04 2.57 90 TR_DCC_Bayes_99 4829 11.04 23.85 2.56 91 TR_XM_SpammyRelay 4813 7.78 15.67 2.55 92 TVD_RCVD_IP 4699 1.80 0.75 2.49 93 HTML_IMAGE_RATIO_06 4685 3.00 3.77 2.49 94 MIME_HTML_ONLY_MULTI 4473 2.61 2.97 2.37 95 MAILING_LIST_MULTI 4372 1.86 1.17 2.32 96 XM_PDF 4367 1.51 0.28 2.32 97 FROM_EXCESS_BASE64 4353 2.10 1.78 2.31 98 TM2_M_URI_OPT_OUT 4225 2.44 2.74 2.24 99 TR_XM_UnparsRelay 4142 4.13 7.06 2.20 100 XMBSHREFv2 3912 1.32 0.17 2.08 101 RELAYCOUNTRY_CA 3855 6.04 12.07 2.05 102 T_XMDrugObfuBody_14 3851 2.46 3.09 2.04 103 TR_XM_PhishingBody 3659 2.27 2.75 1.94 104 HTML_MIME_NO_HTML_TAG 3547 1.60 1.17 1.88 105 HTML_IMAGE_RATIO_08 3332 2.24 2.95 1.77 106 XM_DK_Undo_01 3313 1.49 1.09 1.76 107 TVD_SPACE_RATIO 3292 1.09 0.09 1.75 108 IN_HORDE_ADDRESS_BOOK 3269 1.06 0.04 1.73 109 UNTRUSTED_Relay 3233 2.67 4.12 1.72 110 XMStockSpam_06 3222 1.57 1.36 1.71 111 RCVD_IN_IADB_VOUCHED 3151 1.13 0.32 1.67 112 T_XMDrugObfuBody_08 3100 2.20 3.05 1.64 113 TooManyTo_002 3088 1.24 0.64 1.64 114 XMGappySubj_01 3071 1.11 0.32 1.63 115 XMDiploma_00 2738 1.47 1.50 1.45 116 DKIM_INVALID 2721 2.14 3.19 1.44 117 XMBdyGiftCard01 2613 1.35 1.30 1.39 118 XM_B_Investor 2601 2.09 3.16 1.38 119 XMBody_95 2556 0.88 0.15 1.36 120 XMGappySubj_02 2551 0.92 0.27 1.35 121 TR_XM_SpammyWords5 2519 2.07 3.18 1.34 122 XM_SendGrid 2516 1.24 1.09 1.33 123 XM_H_Long_From02 2445 1.13 0.87 1.30 124 T_TooManySym_03 2432 0.83 0.12 1.29 125 TM2_M_VERY_LONG_WORD 2414 1.66 2.24 1.28 126 XM_GoogleGroups 2358 0.89 0.35 1.25 127 XM_B_Unsub2 2328 1.34 1.50 1.24 128 URI_NOVOWEL 2293 1.12 0.96 1.22 129 XMSubMetaSxObfu_03 2251 0.90 0.44 1.19 130 RCVD_IN_IADB_OPTIN 2205 0.79 0.21 1.17 131 XM_OfRef6 2174 2.10 3.53 1.15 132 TR_Symld_Words 2146 1.00 0.78 1.14 133 BOTNET 2137 3.25 6.45 1.13 134 SUBJ_ALL_CAPS 1995 1.84 3.02 1.06 135 TR_XM_Base64_M1 1962 0.93 0.77 1.04 136 URI_HEX 1934 1.00 0.96 1.03 137 USER_IN_WHITELIST 1864 0.60 0.00 0.99 138 USER_IN_WELCOMELIST 1864 0.60 0.00 0.99 139 TR_XM_SpammyWords2 1853 5.96 13.49 0.98 140 XM_B_COPY_HTML 1834 1.10 1.29 0.97 141 TR_XM_DK_SendGrid 1789 0.90 0.83 0.95 142 XMSubMetaSx_01 1765 0.62 0.15 0.94 143 XM_UB50 1719 1.29 1.87 0.91 144 RCVD_IN_BL_SPAMCOP_NET 1698 5.08 11.38 0.90 145 T_XMHurry_00 1687 1.40 2.17 0.90 146 MPART_ALT_DIFF_COUNT 1617 0.90 0.97 0.86 147 TooManyTo_003 1600 0.74 0.57 0.85 148 XMBody_17 1572 2.99 6.24 0.83 149 XMSubMetaI_00 1546 0.84 0.87 0.82 150 XMBrknScrpt_02 1538 1.29 2.01 0.82 151 XMGenDplmaNmb 1506 0.72 0.60 0.80 152 URI_TRY_3LD 1503 0.89 1.02 0.80 153 XM_B_SpammyWords4 1485 1.15 1.70 0.79 154 XMNoVowels 1432 0.61 0.40 0.76 155 DKIM_ADSP_CUSTOM_MED 1312 0.74 0.81 0.70 156 RCVD_IN_PSBL 1285 0.64 0.58 0.68 157 HTTPS_HTTP_MISMATCH 1282 0.84 1.07 0.68 158 XMPhish30 1268 0.83 1.08 0.67 159 XM_ProductURIs 1265 0.67 0.66 0.67 160 XM_H_PHPMailer 1260 0.85 1.12 0.67 161 TooManyTo_004 1221 0.60 0.54 0.65 162 FROM_GOV_DKIM_AU 1155 0.38 0.03 0.61 163 RELAYCOUNTRY_AU 1142 1.09 1.81 0.61 164 T_FILL_THIS_FORM_SHORT 1136 1.96 4.00 0.60 165 XMSubMetaSxObfu_02 1135 0.54 0.44 0.60 166 TR_MetaPhish_Combo_01 1104 0.60 0.62 0.59 167 XM_H_Trusted_IP 1093 0.35 0.00 0.58 168 SpammyFromTLD_01 1088 8.87 21.39 0.58 169 TooManyTo_005 1081 0.55 0.52 0.57 170 XMPhish08 1072 0.54 0.49 0.57 171 XMMoneyMeta_00 1047 0.44 0.27 0.56 172 XMSubNoVowel 997 0.47 0.39 0.53 173 T_TooManySym_04 984 0.33 0.03 0.52 174 PLING_QUERY 961 0.55 0.61 0.51 175 HTML_FONT_FACE_BAD 948 0.51 0.53 0.50 176 TR_LOTS_OF_MONEY3 928 1.30 2.52 0.49 177 TR_XM_SPAMCOP 919 3.93 9.14 0.49 178 FILL_THIS_FORM 910 0.39 0.25 0.48 179 XM_B_DNDMA 900 0.51 0.55 0.48 180 XM_WL_UtahGOV 897 0.29 0.00 0.48 181 KHOP_HELO_FCRDNS 895 0.74 1.13 0.47 182 XM_B_FormFill 893 0.30 0.04 0.47 183 SHOPIFY_IMG_NOT_RCVD_SFY 886 0.64 0.89 0.47 184 TR_XM_FormFill2 877 8.66 21.03 0.47 185 TR_XM_PHPForged 873 8.69 21.13 0.46 186 TR_XM_PHPDW 869 8.66 21.05 0.46 187 HELO_NODOT 868 0.50 0.56 0.46 188 THIS_AD 867 0.75 1.20 0.46 189 HELO_NO_DOMAIN 865 0.50 0.56 0.46 190 DIET_1 861 0.66 0.97 0.46 191 TM2_M_BODY_EMPTY 857 8.01 19.43 0.45 192 XM_H_PHPOS 853 8.64 21.01 0.45 193 T_XMDrugObfuBody_00 847 0.48 0.53 0.45 194 NML_ADSP_CUSTOM_MED 846 0.56 0.74 0.45 195 DKIM_ADSP_NXDOMAIN 828 0.41 0.36 0.44 196 XM_B_REG_HTML 820 0.43 0.43 0.44 197 XM_S_SubURI 795 0.28 0.06 0.42 198 FORGED_GMAIL_RCVD 790 0.50 0.63 0.42 199 HTML_TAG_BALANCE_BODY 748 0.82 1.47 0.40 200 XMLngstWrd_00 746 0.37 0.34 0.40 ----------------------------------------------------------------------