Email: 303046 Autolearn: 0 AvgScore: 4.61 AvgScanTime: 1.07 sec Spam: 119594 Autolearn: 0 AvgScore: 13.09 AvgScanTime: 1.00 sec Ham: 183452 Autolearn: 0 AvgScore: -0.92 AvgScanTime: 1.11 sec Time Spent Running SA: 89.73 hours Time Spent Processing Spam: 33.22 hours Time Spent Processing Ham: 56.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DKIM_SIGNED 111939 83.98 93.60 77.71 2 XM_DK_Pass 109217 82.31 91.32 76.43 3 DKIM_VALID 108076 81.63 90.37 75.94 4 XMListUnsubscribeExists 97445 66.88 81.48 57.37 5 RELAYCOUNTRY_US 94986 79.54 79.42 79.61 6 HTML_MESSAGE 91648 79.35 76.63 81.12 7 DKIM_VALID_AU 87915 68.78 73.51 65.70 8 XM_B_Unicode 84108 71.14 70.33 71.67 9 XM_B_SpammyWords 72359 50.99 60.50 44.79 10 DCC_CHECK 69941 47.19 58.48 39.83 11 DCC_CHECK_NEGATIVE 49644 52.79 41.51 60.14 12 XM_DK_Undo_02 48306 20.39 40.39 7.34 13 XM_B_Unicode3 43962 41.82 36.76 45.11 14 XM_B_SpammyWords2 41941 25.88 35.07 19.89 15 BAYES_99 39755 17.03 33.24 6.46 16 TR_XM_DKIM_Undo 38868 14.68 32.50 3.07 17 LOC_TINY_FONT_1 36404 30.25 30.44 30.12 18 BAYES_50 34469 45.76 28.82 56.81 19 HTML_FONT_LOW_CONTRAST 32370 30.22 27.07 32.27 20 FVGT_m_MULTI_ODD 31199 27.40 26.09 28.25 21 BAYES_999 31106 13.37 26.01 5.13 22 XM_UncommonTLD01 29945 12.93 25.04 5.03 23 DKIM_VALID_EF 28934 27.28 24.19 29.29 24 TR_DCC_Bayes_99 28545 10.90 23.87 2.44 25 MIME_HTML_ONLY 28122 21.32 23.51 19.88 26 RCVD_IN_MSPIKE_H2 27563 26.49 23.05 28.73 27 T_KAM_HTML_FONT_INVALID 27111 21.01 22.67 19.94 28 XMNumbers 26715 10.91 22.34 3.45 29 TR_XM_PHPForged 26189 8.88 21.90 0.39 30 TR_XM_PHPDW 26156 8.87 21.87 0.40 31 TR_XM_FormFill2 26106 8.85 21.83 0.38 32 XM_H_PHPOS 26095 8.84 21.82 0.37 33 SpammyFromTLD_01 25701 8.92 21.49 0.72 34 TM2_M_BODY_EMPTY 23820 8.06 19.92 0.33 35 XMEmptyBody_01 23783 7.97 19.89 0.20 36 RELAYCOUNTRY_META 23717 10.56 19.83 4.52 37 TR_XM_DK_Unsub 23466 17.56 19.62 16.22 38 T_TM2_M_HEADER_IN_MSG 20299 19.88 16.97 21.77 39 TR_XM_SpammyRelay 20192 8.29 16.88 2.68 40 XMSubLong 18596 20.14 15.55 23.13 41 XM_Multi_Part_URI 17313 15.82 14.48 16.69 42 TR_XM_SpammyWords2 16946 5.99 14.17 0.65 43 TR_MAX_INTL_RELAY 15828 10.26 13.23 8.32 44 XM_SPF_SoftFail 15786 6.84 13.20 2.70 45 RELAYCOUNTRY_CA 15519 6.47 12.98 2.23 46 XM_B_SpammyWords3 15141 8.47 12.66 5.74 47 RCVD_IN_BL_SPAMCOP_NET 13593 4.91 11.37 0.71 48 BOTNET_IPINHOSTNAME 13227 7.82 11.06 5.71 49 XM_B_Unsub 12654 8.80 10.58 7.63 50 UNPARSEABLE_RELAY 12310 10.96 10.29 11.39 51 TR_XM_BayesUnsub 12226 7.85 10.22 6.31 52 LOTS_OF_MONEY 12022 7.62 10.05 6.04 53 TR_XM_SPAMCOP 11178 3.88 9.35 0.32 54 TR_XM_SpammyWords4 10948 6.30 9.15 4.44 55 BAYES_40 9850 5.59 8.24 3.86 56 BAYES_80 9541 6.20 7.98 5.04 57 RCVD_IN_MSPIKE_WL 9524 6.79 7.96 6.03 58 RCVD_IN_MSPIKE_H3 9524 6.79 7.96 6.03 59 BAYES_20 9003 4.57 7.53 2.64 60 XMBody_17 8991 3.51 7.52 0.90 61 BOTNET 8369 3.46 7.00 1.15 62 BAYES_60 7653 9.67 6.40 11.80 63 TR_XM_UnparsRelay 7618 3.57 6.37 1.75 64 TooManyTo_001 7541 6.58 6.31 6.75 65 XM_Evil_Numbers_Gen 6911 7.59 5.78 8.78 66 HTML_IMAGE_RATIO_02 6807 6.31 5.69 6.71 67 XM_Body_Dirty_Words 6320 3.94 5.28 3.06 68 T_FILL_THIS_FORM_SHORT 6261 2.42 5.24 0.58 69 FSL_BULK_SIG 6209 3.89 5.19 3.03 70 BAYES_95 5807 3.90 4.86 3.27 71 XMSubMetaSx_00 5644 4.58 4.72 4.49 72 HTML_IMAGE_RATIO_04 5531 5.23 4.62 5.63 73 UNTRUSTED_Relay 5365 2.83 4.49 1.75 74 LotsOfNums_01 5308 6.43 4.44 7.72 75 MPART_ALT_DIFF 5126 4.25 4.29 4.23 76 XMStrtUSub 4712 5.59 3.94 6.67 77 XM_H_GMP 4610 6.25 3.85 7.82 78 USER_IN_DEF_DKIM_WL 4497 13.15 3.76 19.28 79 TR_XM_FormFill 4442 1.49 3.71 0.04 80 T_XMDrugObfuBody_14 4354 2.54 3.64 1.82 81 XM_H_Long_From01 4160 4.41 3.48 5.01 82 XM_B_Phish_Phrases 4094 2.96 3.42 2.65 83 RCVD_IN_VALIDITY_SAFE 4091 7.04 3.42 9.39 84 TR_XM_SpammyWords5 4090 2.08 3.42 1.21 85 XM_B_Investor 3939 2.18 3.29 1.46 86 DKIM_INVALID 3863 2.35 3.23 1.77 87 TR_LOTS_OF_MONEY3 3848 1.65 3.22 0.63 88 SUBJ_ALL_CAPS 3792 1.74 3.17 0.81 89 HTML_IMAGE_RATIO_06 3740 2.93 3.13 2.79 90 XM_OfRef6 3707 1.94 3.10 1.19 91 TR_XM_BayesRelay 3670 1.21 3.07 0.00 92 MIME_HTML_MOSTLY 3647 3.01 3.05 2.98 93 HK_RANDOM_REPLYTO 3626 1.28 3.03 0.13 94 FONT_INVIS_LONG_LINE 3514 1.18 2.94 0.03 95 XM_B_SpammyTLD 3464 2.83 2.90 2.78 96 T_XMDrugObfuBody_08 3441 2.01 2.88 1.44 97 TM2_M_URI_OPT_OUT 3411 2.38 2.85 2.07 98 RCVD_IN_VALIDITY_CERTIFIED 3388 6.08 2.83 8.19 99 TR_XM_PhishingBody 3231 2.21 2.70 1.88 100 XMSexyCombo_05 3223 1.97 2.69 1.50 101 BAYES_05 3221 2.82 2.69 2.90 102 MIME_HTML_ONLY_MULTI 3114 2.34 2.60 2.17 103 HTML_IMAGE_RATIO_08 2973 2.15 2.49 1.93 104 XMDiploma_00 2885 1.99 2.41 1.72 105 XM_URI_RBL 2810 1.06 2.35 0.22 106 XM_CamelCaseFrm001 2718 2.45 2.27 2.57 107 XM_B_SpammyWords4 2650 1.36 2.22 0.81 108 TM2_M_VERY_LONG_WORD 2622 1.64 2.19 1.29 109 XM_UB50 2436 1.41 2.04 0.99 110 FROM_EXCESS_BASE64 2351 2.20 1.97 2.35 111 AC_BR_BONANZA 2238 0.81 1.87 0.12 112 RELAYCOUNTRY_AU 2238 0.98 1.87 0.39 113 T_XMHurry_00 2202 1.06 1.84 0.54 114 DIET_1 2075 1.19 1.74 0.83 115 HTML_TAG_BALANCE_BODY 2064 0.97 1.73 0.48 116 TR_XM_NoHeaderRelay 2051 0.74 1.71 0.10 117 BOTNET_NORDNS 2013 0.67 1.68 0.01 118 XMBrknScrpt_02 1938 1.06 1.62 0.70 119 XM_HighProb1 1839 0.61 1.54 0.00 120 T_TooManySym_01 1777 4.31 1.49 6.15 121 LongTLD 1735 0.74 1.45 0.28 122 XMBdyGiftCard01 1706 1.47 1.43 1.51 123 SpammyFromTLD_02 1683 0.66 1.41 0.18 124 HTTPS_HTTP_MISMATCH 1675 0.90 1.40 0.58 125 MIME_QP_LONG_LINE 1646 2.47 1.38 3.18 126 TR_Mismatch_TLD_02 1641 0.58 1.37 0.07 127 URI_HEX 1627 1.17 1.36 1.05 128 XMStockSpam_06 1559 1.44 1.30 1.54 129 THIS_AD 1540 0.73 1.29 0.36 130 TR_Caps_n_Bayes_99 1480 0.50 1.24 0.01 131 XMPhish30 1461 0.87 1.22 0.64 132 XMReplyNow 1440 0.62 1.20 0.24 133 TR_XM_INV_DKIM 1431 0.52 1.20 0.07 134 XM_H_PHPMailer 1430 0.91 1.20 0.72 135 T_REMOTE_IMAGE 1422 2.29 1.19 3.00 136 MAILING_LIST_MULTI 1400 1.89 1.17 2.36 137 ALL_TRUSTED 1377 10.26 1.15 16.19 138 XM_SendGrid 1376 1.33 1.15 1.45 139 XM_B_Unsub2 1369 1.02 1.14 0.94 140 RCVD_IN_PSBL 1316 0.77 1.10 0.55 141 URIBL_DBL_SPAM 1311 0.45 1.10 0.02 142 URI_TRY_3LD 1304 0.99 1.09 0.93 143 ANY_BOUNCE_MESSAGE 1250 3.88 1.05 5.73 144 BOUNCE_MESSAGE 1249 3.88 1.04 5.73 145 SHOPIFY_IMG_NOT_RCVD_SFY 1247 0.75 1.04 0.56 146 RCVD_IN_VALIDITY_RPBL 1200 0.42 1.00 0.03 147 KHOP_HELO_FCRDNS 1182 0.69 0.99 0.50 148 XM_B_COPY_HTML 1162 1.15 0.97 1.26 149 XMSexyCombo_01 1148 0.50 0.96 0.20 150 XMSubMetaI_00 1130 0.70 0.94 0.54 151 XMGenDplmaNmb 1117 0.83 0.93 0.76 152 XM_DK_Undo_01 1097 1.42 0.92 1.75 153 PDS_OTHER_BAD_TLD 1088 0.44 0.91 0.13 154 XM_DIRTYINTL 1084 0.48 0.91 0.20 155 T_XMDrugObfuBody_00 1080 0.64 0.90 0.47 156 XM_H_Long_From02 1078 1.00 0.90 1.07 157 TR_XM_Base64_L1 1078 0.49 0.90 0.23 158 HTML_MIME_NO_HTML_TAG 1056 1.12 0.88 1.28 159 TVD_RCVD_IP 1050 1.88 0.88 2.53 160 TR_XM_InvalidRelay 1045 0.36 0.87 0.02 161 MPART_ALT_DIFF_COUNT 1038 0.97 0.87 1.04 162 T_STY_INVIS_DIRECT 1029 0.48 0.86 0.24 163 RDNS_DYNAMIC 1028 0.56 0.86 0.36 164 XM_RXBody 1016 0.53 0.85 0.33 165 XM_H_PHPOS_M 1010 0.38 0.84 0.08 166 TR_XM_DK_SendGrid 979 0.98 0.82 1.08 167 HOSTED_IMG_MULTI_PUB_01 971 0.35 0.81 0.04 168 TR_XM_Base64_M1 971 0.84 0.81 0.85 169 XM_UB99 968 0.32 0.81 0.00 170 TM2_M_A_HREF_HREF 922 0.42 0.77 0.18 171 TooManyTo_002 910 1.22 0.76 1.52 172 HELO_NO_DOMAIN 901 0.55 0.75 0.42 173 HELO_NODOT 901 0.55 0.75 0.42 174 FSL_HELO_NON_FQDN_1 883 0.30 0.74 0.01 175 HELO_DYNAMIC_SPLIT_IP 875 0.29 0.73 0.01 176 TooManyTo_003 867 0.82 0.72 0.89 177 URG_BIZ 851 0.37 0.71 0.14 178 PLING_QUERY 849 0.66 0.71 0.63 179 TooManyTo_004 832 0.69 0.70 0.69 180 XM_H_Undi_Recip 828 0.35 0.69 0.12 181 XMSolicitRefs_0 827 0.66 0.69 0.63 182 FROM_SUSPICIOUS_NTLD 826 0.30 0.69 0.05 183 T_XMDrugObfuBody_10 820 0.29 0.69 0.04 184 TR_Mismatch_TLD_01 817 0.43 0.68 0.26 185 TooManyTo_005 813 0.62 0.68 0.58 186 DKIM_ADSP_CUSTOM_MED 809 0.81 0.68 0.89 187 AC_HTML_NONSENSE_TAGS 804 0.28 0.67 0.02 188 RCVD_IN_IADB_LISTED 796 1.95 0.67 2.78 189 URI_NOVOWEL 793 0.88 0.66 1.02 190 FROM_SUSPICIOUS_NTLD_FP 780 0.29 0.65 0.05 191 TR_Symld_Words 774 0.85 0.65 0.98 192 TR_MetaPhish_Combo_01 770 0.58 0.64 0.54 193 TO_IN_SUBJ 764 0.31 0.64 0.10 194 XM_UB80 762 0.27 0.64 0.02 195 XMClaimOffer 760 0.34 0.64 0.14 196 TR_XM_RelayPhish 742 0.27 0.62 0.05 197 XM_UB999 741 0.25 0.62 0.00 198 RCVD_IN_IADB_SPF 735 1.77 0.61 2.53 199 XM_S_SpammyWords 721 0.34 0.60 0.16 200 TR_XM_Spammywords 721 0.34 0.60 0.16 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148813 79.35 76.63 81.12 2 RELAYCOUNTRY_US 146046 79.54 79.42 79.61 3 DKIM_SIGNED 142557 83.98 93.60 77.71 4 XM_DK_Pass 140218 82.31 91.32 76.43 5 DKIM_VALID 139309 81.63 90.37 75.94 6 XM_B_Unicode 131472 71.14 70.33 71.67 7 DKIM_VALID_AU 120531 68.78 73.51 65.70 8 DCC_CHECK_NEGATIVE 110335 52.79 41.51 60.14 9 XMListUnsubscribeExists 105238 66.88 81.48 57.37 10 BAYES_50 104217 45.76 28.82 56.81 11 XM_B_Unicode3 82762 41.82 36.76 45.11 12 XM_B_SpammyWords 82170 50.99 60.50 44.79 13 DCC_CHECK 73073 47.19 58.48 39.83 14 HTML_FONT_LOW_CONTRAST 59199 30.22 27.07 32.27 15 LOC_TINY_FONT_1 55257 30.25 30.44 30.12 16 DKIM_VALID_EF 53731 27.28 24.19 29.29 17 RCVD_IN_MSPIKE_H2 52708 26.49 23.05 28.73 18 FVGT_m_MULTI_ODD 51832 27.40 26.09 28.25 19 XMSubLong 42440 20.14 15.55 23.13 20 T_TM2_M_HEADER_IN_MSG 39940 19.88 16.97 21.77 21 T_KAM_HTML_FONT_INVALID 36572 21.01 22.67 19.94 22 XM_B_SpammyWords2 36495 25.88 35.07 19.89 23 MIME_HTML_ONLY 36475 21.32 23.51 19.88 24 USER_IN_DEF_DKIM_WL 35368 13.15 3.76 19.28 25 XM_Multi_Part_URI 30626 15.82 14.48 16.69 26 TR_XM_DK_Unsub 29756 17.56 19.62 16.22 27 ALL_TRUSTED 29705 10.26 1.15 16.19 28 BAYES_60 21649 9.67 6.40 11.80 29 XM_DKIMWhitelistDomains 21281 7.02 0.00 11.60 30 UNPARSEABLE_RELAY 20898 10.96 10.29 11.39 31 RCVD_IN_VALIDITY_SAFE 17231 7.04 3.42 9.39 32 XM_Evil_Numbers_Gen 16098 7.59 5.78 8.78 33 TR_MAX_INTL_RELAY 15259 10.26 13.23 8.32 34 RCVD_IN_VALIDITY_CERTIFIED 15026 6.08 2.83 8.19 35 XM_H_GMP 14345 6.25 3.85 7.82 36 LotsOfNums_01 14171 6.43 4.44 7.72 37 XM_B_Unsub 14005 8.80 10.58 7.63 38 XM_DK_Undo_02 13473 20.39 40.39 7.34 39 BAYES_00 13238 4.46 0.24 7.22 40 TooManyTo_001 12388 6.58 6.31 6.75 41 HTML_IMAGE_RATIO_02 12301 6.31 5.69 6.71 42 XMStrtUSub 12238 5.59 3.94 6.67 43 BAYES_99 11848 17.03 33.24 6.46 44 TR_XM_BayesUnsub 11578 7.85 10.22 6.31 45 TR_XM_DK_Bayes 11469 3.87 0.21 6.25 46 TR_XM_DK_Bayes1 11368 3.81 0.16 6.20 47 T_TooManySym_01 11285 4.31 1.49 6.15 48 LOTS_OF_MONEY 11077 7.62 10.05 6.04 49 RCVD_IN_MSPIKE_H3 11061 6.79 7.96 6.03 50 RCVD_IN_MSPIKE_WL 11061 6.79 7.96 6.03 51 XM_B_SpammyWords3 10522 8.47 12.66 5.74 52 BOUNCE_MESSAGE 10505 3.88 1.04 5.73 53 ANY_BOUNCE_MESSAGE 10505 3.88 1.05 5.73 54 BOTNET_IPINHOSTNAME 10473 7.82 11.06 5.71 55 TR_XM_DK_Bayes2 10342 3.47 0.14 5.64 56 HTML_IMAGE_RATIO_04 10326 5.23 4.62 5.63 57 IN_ZIMBRA_NJ_WHITELIST 9640 3.20 0.05 5.25 58 BAYES_999 9402 13.37 26.01 5.13 59 BAYES_80 9254 6.20 7.98 5.04 60 XM_UncommonTLD01 9233 12.93 25.04 5.03 61 XM_H_Long_From01 9199 4.41 3.48 5.01 62 RELAYCOUNTRY_META 8297 10.56 19.83 4.52 63 XMSubMetaSx_00 8233 4.58 4.72 4.49 64 TR_XM_SpammyWords4 8146 6.30 9.15 4.44 65 MPART_ALT_DIFF 7761 4.25 4.29 4.23 66 BAYES_40 7086 5.59 8.24 3.86 67 T_TooManySym_02 6766 2.34 0.28 3.69 68 INVALID_MSGID 6669 2.34 0.35 3.64 69 MSGID_NOFQDN1 6344 2.19 0.25 3.46 70 XMNumbers 6333 10.91 22.34 3.45 71 TO_MALFORMED 6281 2.08 0.03 3.42 72 BAYES_95 6003 3.90 4.86 3.27 73 MIME_QP_LONG_LINE 5841 2.47 1.38 3.18 74 TR_XM_DKIM_Undo 5624 14.68 32.50 3.07 75 XM_Body_Dirty_Words 5622 3.94 5.28 3.06 76 FSL_BULK_SIG 5565 3.89 5.19 3.03 77 T_REMOTE_IMAGE 5505 2.29 1.19 3.00 78 MIME_HTML_MOSTLY 5476 3.01 3.05 2.98 79 BAYES_05 5320 2.82 2.69 2.90 80 HTML_IMAGE_RATIO_06 5125 2.93 3.13 2.79 81 RCVD_IN_IADB_LISTED 5107 1.95 0.67 2.78 82 XM_B_SpammyTLD 5098 2.83 2.90 2.78 83 XM_SPF_SoftFail 4946 6.84 13.20 2.70 84 TR_XM_SpammyRelay 4916 8.29 16.88 2.68 85 XM_B_Phish_Phrases 4867 2.96 3.42 2.65 86 BAYES_20 4836 4.57 7.53 2.64 87 XM_CamelCaseFrm001 4709 2.45 2.27 2.57 88 TVD_RCVD_IP 4647 1.88 0.88 2.53 89 RCVD_IN_IADB_SPF 4642 1.77 0.61 2.53 90 TR_DCC_Bayes_99 4472 10.90 23.87 2.44 91 MAILING_LIST_MULTI 4332 1.89 1.17 2.36 92 RCVD_IN_IADB_SENDERID 4321 1.66 0.59 2.36 93 FROM_EXCESS_BASE64 4311 2.20 1.97 2.35 94 RCVD_IN_IADB_DK 4238 1.63 0.59 2.31 95 RELAYCOUNTRY_CA 4098 6.47 12.98 2.23 96 XMBSHREFv2 4019 1.40 0.19 2.19 97 MIME_HTML_ONLY_MULTI 3977 2.34 2.60 2.17 98 TM2_M_URI_OPT_OUT 3799 2.38 2.85 2.07 99 XMGappySubj_01 3689 1.32 0.25 2.01 100 HTML_IMAGE_RATIO_08 3546 2.15 2.49 1.93 101 TR_XM_PhishingBody 3453 2.21 2.70 1.88 102 XM_PDF 3401 1.22 0.24 1.85 103 T_XMDrugObfuBody_14 3331 2.54 3.64 1.82 104 XMGappySubj_02 3275 1.10 0.05 1.79 105 DKIM_INVALID 3248 2.35 3.23 1.77 106 TVD_SPACE_RATIO 3219 1.10 0.11 1.75 107 TR_XM_UnparsRelay 3213 3.57 6.37 1.75 108 XM_DK_Undo_01 3210 1.42 0.92 1.75 109 UNTRUSTED_Relay 3208 2.83 4.49 1.75 110 XMDiploma_00 3157 1.99 2.41 1.72 111 XMBody_95 3108 1.08 0.14 1.69 112 IN_HORDE_ADDRESS_BOOK 3054 1.02 0.04 1.66 113 XMStockSpam_06 2816 1.44 1.30 1.54 114 TooManyTo_002 2786 1.22 0.76 1.52 115 XMBdyGiftCard01 2762 1.47 1.43 1.51 116 XMSexyCombo_05 2759 1.97 2.69 1.50 117 RCVD_IN_IADB_VOUCHED 2754 1.00 0.24 1.50 118 XM_B_Investor 2679 2.18 3.29 1.46 119 XM_SendGrid 2666 1.33 1.15 1.45 120 T_XMDrugObfuBody_08 2642 2.01 2.88 1.44 121 XM_GoogleGroups 2512 0.98 0.39 1.37 122 T_TooManySym_03 2403 0.83 0.09 1.31 123 TM2_M_VERY_LONG_WORD 2361 1.64 2.19 1.29 124 HTML_MIME_NO_HTML_TAG 2351 1.12 0.88 1.28 125 XM_B_COPY_HTML 2312 1.15 0.97 1.26 126 TR_XM_SpammyWords5 2223 2.08 3.42 1.21 127 XM_OfRef6 2180 1.94 3.10 1.19 128 BOTNET 2107 3.46 7.00 1.15 129 TR_XM_DK_SendGrid 1977 0.98 0.82 1.08 130 XM_H_Long_From02 1967 1.00 0.90 1.07 131 URI_HEX 1931 1.17 1.36 1.05 132 XM_ProductURIs 1919 0.87 0.60 1.05 133 MPART_ALT_DIFF_COUNT 1906 0.97 0.87 1.04 134 RCVD_IN_IADB_OPTIN 1879 0.69 0.19 1.02 135 URI_NOVOWEL 1865 0.88 0.66 1.02 136 USER_IN_WELCOMELIST 1842 0.61 0.00 1.00 137 USER_IN_WHITELIST 1842 0.61 0.00 1.00 138 XM_UB50 1824 1.41 2.04 0.99 139 TR_Symld_Words 1796 0.85 0.65 0.98 140 XM_B_Unsub2 1730 1.02 1.14 0.94 141 URI_TRY_3LD 1697 0.99 1.09 0.93 142 XMBody_17 1651 3.51 7.52 0.90 143 DKIM_ADSP_CUSTOM_MED 1640 0.81 0.68 0.89 144 TooManyTo_003 1627 0.82 0.72 0.89 145 TR_XM_Base64_M1 1562 0.84 0.81 0.85 146 DIET_1 1527 1.19 1.74 0.83 147 XM_B_SpammyWords4 1486 1.36 2.22 0.81 148 SUBJ_ALL_CAPS 1480 1.74 3.17 0.81 149 XM_H_Trusted_IP 1454 0.48 0.00 0.79 150 XMGenDplmaNmb 1396 0.83 0.93 0.76 151 SpammyFromTLD_01 1317 8.92 21.49 0.72 152 XMSubNoVowel 1317 0.65 0.55 0.72 153 XM_H_PHPMailer 1313 0.91 1.20 0.72 154 RCVD_IN_BL_SPAMCOP_NET 1298 4.91 11.37 0.71 155 XMBrknScrpt_02 1285 1.06 1.62 0.70 156 TooManyTo_004 1263 0.69 0.70 0.69 157 TR_XM_SpammyWords2 1201 5.99 14.17 0.65 158 XMPhish30 1170 0.87 1.22 0.64 159 TR_LOTS_OF_MONEY3 1163 1.65 3.22 0.63 160 XMSolicitRefs_0 1160 0.66 0.69 0.63 161 PLING_QUERY 1153 0.66 0.71 0.63 162 XMSubMetaSxObfu_02 1132 0.55 0.43 0.62 163 TooManyTo_005 1071 0.62 0.68 0.58 164 FILL_THIS_FORM 1070 0.44 0.22 0.58 165 T_FILL_THIS_FORM_SHORT 1069 2.42 5.24 0.58 166 HTTPS_HTTP_MISMATCH 1056 0.90 1.40 0.58 167 FORGED_GMAIL_RCVD 1053 0.55 0.52 0.57 168 XMPhish08 1044 0.52 0.44 0.57 169 SHOPIFY_IMG_NOT_RCVD_SFY 1027 0.75 1.04 0.56 170 RCVD_IN_PSBL 1006 0.77 1.10 0.55 171 T_XMHurry_00 997 1.06 1.84 0.54 172 TR_MetaPhish_Combo_01 997 0.58 0.64 0.54 173 XMSubMetaI_00 984 0.70 0.94 0.54 174 T_TooManySym_04 971 0.33 0.01 0.53 175 XMLngstWrd_00 957 0.50 0.48 0.52 176 XM_B_REG_HTML 955 0.53 0.54 0.52 177 KHOP_HELO_FCRDNS 918 0.69 0.99 0.50 178 NML_ADSP_CUSTOM_MED 905 0.54 0.60 0.49 179 XMNoVowels 877 0.43 0.36 0.48 180 HTML_TAG_BALANCE_BODY 873 0.97 1.73 0.48 181 FILL_THIS_FORM_LONG 858 0.35 0.16 0.47 182 T_XMDrugObfuBody_00 856 0.64 0.90 0.47 183 HTML_FONT_FACE_BAD 849 0.52 0.60 0.46 184 SUBJ_DOLLARS 840 0.40 0.32 0.46 185 DKIM_ADSP_NXDOMAIN 822 0.45 0.46 0.45 186 XM_B_DNDMA 810 0.45 0.47 0.44 187 XM_S_SubURI 782 0.27 0.03 0.43 188 T_FILL_THIS_FORM_LOAN 778 0.29 0.07 0.42 189 NO_DNS_FOR_FROM 778 0.34 0.21 0.42 190 HELO_NODOT 771 0.55 0.75 0.42 191 HELO_NO_DOMAIN 767 0.55 0.75 0.42 192 XMPhish14 761 0.44 0.47 0.41 193 AD_PREFS 749 0.25 0.02 0.41 194 TR_XM_PHPDW 731 8.87 21.87 0.40 195 CTE_8BIT_MISMATCH 726 0.25 0.03 0.40 196 RELAYCOUNTRY_AU 721 0.98 1.87 0.39 197 TR_XM_PHPForged 708 8.88 21.90 0.39 198 XMCapTrack 704 0.29 0.14 0.38 199 TR_XM_FormFill2 702 8.85 21.83 0.38 200 XMHTML_After_End 698 0.45 0.55 0.38 ----------------------------------------------------------------------