Email: 347175 Autolearn: 0 AvgScore: 3.59 AvgScanTime: 1.20 sec Spam: 104014 Autolearn: 0 AvgScore: 13.83 AvgScanTime: 1.43 sec Ham: 243161 Autolearn: 0 AvgScore: -0.78 AvgScanTime: 1.10 sec Time Spent Running SA: 115.45 hours Time Spent Processing Spam: 41.24 hours Time Spent Processing Ham: 74.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 99379 72.61 95.54 62.81 2 DKIM_SIGNED 96006 69.56 92.30 59.83 3 XM_DK_Pass 93262 68.24 89.66 59.08 4 DKIM_VALID 92134 67.66 88.58 58.71 5 XM_B_Unicode 88537 63.37 85.12 54.06 6 RELAYCOUNTRY_US 78962 65.67 75.91 61.28 7 XMListUnsubscribeExists 78348 52.79 75.32 43.14 8 XM_B_SpammyWords 78303 46.08 75.28 33.59 9 DCC_CHECK 78105 44.10 75.09 30.84 10 DKIM_VALID_AU 68634 55.03 65.99 50.34 11 XM_DK_Undo_02 54742 19.95 52.63 5.98 12 XM_B_Unicode3 47399 36.67 45.57 32.86 13 XM_B_SpammyWords2 45938 23.58 44.17 14.77 14 TR_XM_DKIM_Undo 43445 14.30 41.77 2.55 15 BAYES_99 43330 15.96 41.66 4.97 16 LOC_TINY_FONT_1 41941 27.80 40.32 22.44 17 HTML_FONT_LOW_CONTRAST 35997 28.11 34.61 25.34 18 BAYES_999 34194 12.61 32.87 3.95 19 DKIM_VALID_EF 33156 25.28 31.88 22.45 20 FVGT_m_MULTI_ODD 33150 24.10 31.87 20.77 21 BAYES_50 33014 45.98 31.74 52.08 22 MIME_HTML_ONLY 32334 20.45 31.09 15.90 23 TR_DCC_Bayes_99 32260 10.75 31.02 2.07 24 RCVD_IN_MSPIKE_H2 32013 24.63 30.78 22.00 25 T_KAM_HTML_FONT_INVALID 29168 19.42 28.04 15.73 26 DCC_CHECK_NEGATIVE 25892 55.88 24.89 69.14 27 TR_XM_DK_Unsub 25650 15.93 24.66 12.20 28 RELAYCOUNTRY_META 25003 9.38 24.04 3.11 29 T_TM2_M_HEADER_IN_MSG 23477 18.74 22.57 17.11 30 TR_XM_SpammyRelay 21389 7.44 20.56 1.83 31 XMSubLong 18383 16.77 17.67 16.39 32 RCVD_IN_BL_SPAMCOP_NET 18333 5.74 17.63 0.66 33 TR_XM_SpammyWords2 17900 5.63 17.21 0.68 34 TR_MAX_INTL_RELAY 16995 9.26 16.34 6.24 35 XM_Multi_Part_URI 16902 13.59 16.25 12.46 36 RELAYCOUNTRY_CA 16436 5.77 15.80 1.48 37 TR_XM_SPAMCOP 15550 4.81 14.95 0.47 38 XM_B_SpammyWords3 15394 7.43 14.80 4.28 39 XM_B_Unsub 14912 8.50 14.34 6.00 40 LOTS_OF_MONEY 14655 7.81 14.09 5.12 41 TR_XM_BayesUnsub 14368 7.47 13.81 4.76 42 UNPARSEABLE_RELAY 13290 9.84 12.78 8.58 43 TR_XM_SpammyWords4 13072 6.02 12.57 3.22 44 BOTNET_IPINHOSTNAME 12940 6.84 12.44 4.44 45 RCVD_IN_MSPIKE_WL 11977 6.61 11.51 4.52 46 RCVD_IN_MSPIKE_H3 11977 6.61 11.51 4.52 47 BAYES_80 10198 5.53 9.80 3.71 48 XMBody_17 9510 3.30 9.14 0.81 49 XM_Body_Dirty_Words 9108 4.71 8.76 2.99 50 BAYES_60 8152 8.48 7.84 8.76 51 FSL_BULK_SIG 8111 4.74 7.80 3.43 52 TR_XM_UnparsRelay 7804 3.26 7.50 1.44 53 XM_Evil_Numbers_Gen 7713 6.54 7.42 6.17 54 BOTNET 7373 2.85 7.09 1.04 55 HTML_IMAGE_RATIO_02 6834 5.26 6.57 4.69 56 XMSubMetaSx_00 6759 4.26 6.50 3.30 57 XM_H_GMP 6357 6.26 6.11 6.33 58 XMSexyCombo_05 6189 2.98 5.95 1.71 59 XM_UncommonTLD01 6098 4.26 5.86 3.58 60 UNTRUSTED_Relay 6093 2.63 5.86 1.25 61 BAYES_95 6089 3.52 5.85 2.53 62 MPART_ALT_DIFF 6055 3.86 5.82 3.03 63 TooManyTo_001 5825 5.52 5.60 5.49 64 LotsOfNums_01 5675 5.93 5.46 6.13 65 T_FILL_THIS_FORM_SHORT 5321 1.83 5.12 0.43 66 XM_SPF_SoftFail 5300 2.88 5.10 1.93 67 HTML_IMAGE_RATIO_08 5243 2.60 5.04 1.55 68 HTML_IMAGE_RATIO_04 5091 4.27 4.89 4.00 69 XM_H_Long_From01 4870 4.61 4.68 4.58 70 TR_XM_SpammyWords5 4671 2.16 4.49 1.17 71 RCVD_IN_VALIDITY_SAFE 4653 5.45 4.47 5.86 72 XM_OfRef6 4648 2.08 4.47 1.05 73 USER_IN_DEF_DKIM_WL 4624 11.93 4.45 15.14 74 T_XMDrugObfuBody_14 4607 2.18 4.43 1.21 75 MIME_HTML_MOSTLY 4383 2.87 4.21 2.29 76 HTML_IMAGE_RATIO_06 4150 2.45 3.99 1.80 77 XMStrtUSub 4112 3.98 3.95 3.99 78 XM_B_Phish_Phrases 4091 2.70 3.93 2.17 79 RCVD_IN_VALIDITY_CERTIFIED 4037 4.65 3.88 4.98 80 TR_XM_BayesRelay 3989 1.15 3.84 0.00 81 DKIM_INVALID 3872 1.90 3.72 1.12 82 TR_LOTS_OF_MONEY3 3853 1.50 3.70 0.55 83 XM_B_Investor 3730 1.83 3.59 1.07 84 TM2_M_URI_OPT_OUT 3676 2.05 3.53 1.42 85 FONT_INVIS_LONG_LINE 3547 1.04 3.41 0.03 86 TR_XM_PhishingBody 3461 1.84 3.33 1.20 87 XMNumbers 3372 3.03 3.24 2.93 88 TR_XM_FormFill 3337 0.97 3.21 0.02 89 MIME_HTML_ONLY_MULTI 3333 2.10 3.20 1.63 90 T_XMDrugObfuBody_08 3272 1.64 3.15 0.99 91 XM_CamelCaseFrm001 3136 2.22 3.01 1.88 92 SUBJ_ALL_CAPS 3081 1.44 2.96 0.79 93 HK_RANDOM_REPLYTO 2788 0.87 2.68 0.10 94 XM_UB50 2748 1.20 2.64 0.59 95 XM_B_SpammyTLD 2695 2.42 2.59 2.35 96 TM2_M_VERY_LONG_WORD 2673 1.44 2.57 0.95 97 XM_URI_RBL 2657 0.88 2.55 0.16 98 XM_B_SpammyWords4 2601 1.15 2.50 0.57 99 XMBrknScrpt_02 2583 1.12 2.48 0.54 100 AC_BR_BONANZA 2477 0.78 2.38 0.10 101 TR_XM_NoHeaderRelay 2362 0.72 2.27 0.06 102 RELAYCOUNTRY_AU 2338 0.90 2.25 0.32 103 SpammyFromTLD_01 2298 0.96 2.21 0.42 104 XMBdyGiftCard01 2256 1.18 2.17 0.76 105 KHOP_HELO_FCRDNS 2248 0.96 2.16 0.45 106 FROM_EXCESS_BASE64 2217 2.01 2.13 1.96 107 TR_XM_PHPForged 1892 0.72 1.82 0.25 108 TR_XM_PHPDW 1834 0.69 1.76 0.22 109 T_TooManySym_01 1832 4.05 1.76 5.03 110 TR_XM_FormFill2 1792 0.68 1.72 0.23 111 XM_H_PHPOS 1784 0.66 1.72 0.22 112 XMReplyNow 1764 0.67 1.70 0.22 113 T_XMHurry_00 1753 0.89 1.69 0.55 114 MIME_QP_LONG_LINE 1730 2.64 1.66 3.05 115 XM_B_Unsub2 1720 1.24 1.65 1.07 116 XMDiploma_00 1711 1.47 1.64 1.40 117 TM2_M_A_HREF_HREF 1682 0.58 1.62 0.13 118 XM_HighProb1 1669 0.48 1.60 0.00 119 HTML_TAG_BALANCE_BODY 1655 0.79 1.59 0.45 120 URI_NOVOWEL 1643 1.11 1.58 0.91 121 XM_DK_Undo_01 1552 1.34 1.49 1.28 122 T_STY_INVIS_DIRECT 1548 0.59 1.49 0.20 123 URI_HEX 1545 0.99 1.49 0.77 124 XMSexyCombo_01 1539 0.73 1.48 0.40 125 XM_DIRTYINTL 1533 0.72 1.47 0.39 126 XMStockSpam_06 1531 0.89 1.47 0.64 127 AC_HTML_NONSENSE_TAGS 1516 0.45 1.46 0.02 128 TR_XM_INV_DKIM 1493 0.47 1.44 0.06 129 T_REMOTE_IMAGE 1492 2.45 1.43 2.88 130 TR_Caps_n_Bayes_99 1488 0.44 1.43 0.01 131 LongTLD 1465 0.52 1.41 0.14 132 URI_TRY_3LD 1429 0.95 1.37 0.78 133 XMPhish30 1429 0.77 1.37 0.52 134 MAILING_LIST_MULTI 1417 1.75 1.36 1.92 135 TR_XM_InvalidRelay 1417 0.42 1.36 0.01 136 XM_H_Undi_Recip 1375 0.46 1.32 0.09 137 DKIM_ADSP_CUSTOM_MED 1365 0.93 1.31 0.76 138 XM_SendGrid 1327 1.08 1.28 0.99 139 NML_ADSP_CUSTOM_MED 1311 0.75 1.26 0.53 140 SpammyFromTLD_02 1307 0.63 1.26 0.36 141 TR_Mismatch_TLD_02 1303 0.40 1.25 0.04 142 THIS_AD 1295 0.60 1.25 0.32 143 BAYES_40 1255 4.63 1.21 6.09 144 XM_H_Long_From02 1230 1.03 1.18 0.96 145 TR_XM_Undi_Recip19 1229 0.40 1.18 0.06 146 MONEY_FROM_MISSP 1221 0.39 1.17 0.06 147 MPART_ALT_DIFF_COUNT 1217 0.80 1.17 0.65 148 RCVD_IN_VALIDITY_RPBL 1210 0.37 1.16 0.03 149 BOTNET_NORDNS 1209 0.35 1.16 0.01 150 XM_UB99 1206 0.35 1.16 0.01 151 HTML_MIME_NO_HTML_TAG 1204 1.29 1.16 1.35 152 FORGED_GMAIL_RCVD 1202 0.67 1.16 0.46 153 ALL_TRUSTED 1182 25.37 1.14 35.73 154 RDNS_DYNAMIC 1163 0.55 1.12 0.31 155 FSL_CTYPE_WIN1251 1151 0.33 1.11 0.00 156 DIET_1 1149 0.55 1.10 0.32 157 HOSTED_IMG_MULTI_PUB_01 1139 0.33 1.10 0.01 158 TR_Symld_Words 1133 1.00 1.09 0.96 159 FORGED_MUA_OUTLOOK 1129 0.35 1.09 0.03 160 MISSING_HEADERS 1123 0.45 1.08 0.18 161 AXB_XMAILER_MIMEOLE_OL_024C2 1118 0.32 1.07 0.00 162 FSL_NEW_HELO_USER 1112 0.32 1.07 0.00 163 TR_XM_Undi_RecipCombo2 1097 0.32 1.05 0.00 164 ANY_BOUNCE_MESSAGE 1096 18.94 1.05 26.59 165 BOUNCE_MESSAGE 1094 18.94 1.05 26.59 166 RCVD_IN_PSBL 1089 0.71 1.05 0.57 167 TVD_RCVD_IP 1077 1.81 1.04 2.14 168 HTTPS_HTTP_MISMATCH 1077 0.63 1.04 0.45 169 FROM_MISSP_MSFT 1074 0.31 1.03 0.00 170 TO_NO_BRKTS_FROM_MSSP 1055 0.31 1.01 0.00 171 TO_NO_BRKTS_MSFT 1053 0.30 1.01 0.00 172 XM_B_COPY_HTML 1020 0.79 0.98 0.71 173 REPLYTO_WITHOUT_TO_CC 988 0.30 0.95 0.03 174 TR_XM_Undi_Recip11 956 0.28 0.92 0.01 175 TR_MetaPhish_Combo_01 951 0.83 0.91 0.79 176 TooManyTo_002 948 1.24 0.91 1.37 177 XM_UB999 947 0.28 0.91 0.00 178 BAYES_20 943 1.83 0.91 2.23 179 TR_XM_DK_SendGrid 935 0.77 0.90 0.72 180 XMSubMetaI_00 933 0.80 0.90 0.76 181 XM_B_REG_HTML 930 0.54 0.89 0.38 182 XMGenDplmaNmb 922 0.68 0.89 0.59 183 T_XMDrugObfuBody_00 916 0.61 0.88 0.49 184 TR_Sbj_FN_Bdy 903 0.33 0.87 0.11 185 XM_UB60 893 0.29 0.86 0.04 186 RCVD_IN_IADB_LISTED 890 1.89 0.86 2.33 187 XM_OfRef7 887 0.32 0.85 0.09 188 TR_XM_Undi_Recip2 885 0.26 0.85 0.01 189 TooManyTo_003 875 0.70 0.84 0.65 190 XM_B_Phish66 873 0.39 0.84 0.19 191 TR_Mismatch_TLD_01 859 0.42 0.83 0.25 192 XM_H_PHPMailer 853 0.68 0.82 0.63 193 JH_SPAMMY_HEADERS 853 0.25 0.82 0.00 194 XMSexyCombo_04 841 0.28 0.81 0.05 195 TooManyTo_004 840 0.58 0.81 0.49 196 TR_LOTS_OF_MONEY2 829 0.39 0.80 0.22 197 T_MONEY_PERCENT 829 0.39 0.80 0.22 198 FROM_MISSPACED 824 0.24 0.79 0.00 199 XMBody_78 824 0.35 0.79 0.16 200 FROM_MISSP_EH_MATCH 820 0.24 0.79 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 168116 55.88 24.89 69.14 2 HTML_MESSAGE 152720 72.61 95.54 62.81 3 RELAYCOUNTRY_US 149019 65.67 75.91 61.28 4 DKIM_SIGNED 145494 69.56 92.30 59.83 5 XM_DK_Pass 143664 68.24 89.66 59.08 6 DKIM_VALID 142768 67.66 88.58 58.71 7 XM_B_Unicode 131452 63.37 85.12 54.06 8 BAYES_50 126630 45.98 31.74 52.08 9 DKIM_VALID_AU 122414 55.03 65.99 50.34 10 XMListUnsubscribeExists 104911 52.79 75.32 43.14 11 ALL_TRUSTED 86882 25.37 1.14 35.73 12 XM_B_SpammyWords 81675 46.08 75.28 33.59 13 XM_B_Unicode3 79900 36.67 45.57 32.86 14 DCC_CHECK 74997 44.10 75.09 30.84 15 ANY_BOUNCE_MESSAGE 64661 18.94 1.05 26.59 16 BOUNCE_MESSAGE 64658 18.94 1.05 26.59 17 HTML_FONT_LOW_CONTRAST 61611 28.11 34.61 25.34 18 DKIM_VALID_EF 54595 25.28 31.88 22.45 19 LOC_TINY_FONT_1 54573 27.80 40.32 22.44 20 RCVD_IN_MSPIKE_H2 53486 24.63 30.78 22.00 21 FVGT_m_MULTI_ODD 50509 24.10 31.87 20.77 22 BAYES_00 42078 12.26 0.46 17.30 23 T_TM2_M_HEADER_IN_MSG 41596 18.74 22.57 17.11 24 XMSubLong 39852 16.77 17.67 16.39 25 MIME_HTML_ONLY 38663 20.45 31.09 15.90 26 T_KAM_HTML_FONT_INVALID 38247 19.42 28.04 15.73 27 USER_IN_DEF_DKIM_WL 36805 11.93 4.45 15.14 28 XM_B_SpammyWords2 35919 23.58 44.17 14.77 29 XM_Multi_Part_URI 30287 13.59 16.25 12.46 30 TR_XM_DK_Unsub 29654 15.93 24.66 12.20 31 BAYES_60 21295 8.48 7.84 8.76 32 UNPARSEABLE_RELAY 20856 9.84 12.78 8.58 33 XM_DKIMWhitelistDomains 18508 5.35 0.06 7.61 34 XM_H_GMP 15393 6.26 6.11 6.33 35 TR_MAX_INTL_RELAY 15162 9.26 16.34 6.24 36 XM_Evil_Numbers_Gen 14999 6.54 7.42 6.17 37 LotsOfNums_01 14904 5.93 5.46 6.13 38 BAYES_40 14810 4.63 1.21 6.09 39 XM_B_Unsub 14593 8.50 14.34 6.00 40 XM_DK_Undo_02 14533 19.95 52.63 5.98 41 RCVD_IN_VALIDITY_SAFE 14251 5.45 4.47 5.86 42 TooManyTo_001 13352 5.52 5.60 5.49 43 TR_XM_DK_Bayes 12636 3.74 0.32 5.20 44 TR_XM_DK_Bayes1 12562 3.71 0.32 5.17 45 LOTS_OF_MONEY 12454 7.81 14.09 5.12 46 T_TooManySym_01 12243 4.05 1.76 5.03 47 RCVD_IN_VALIDITY_CERTIFIED 12109 4.65 3.88 4.98 48 BAYES_99 12087 15.96 41.66 4.97 49 TR_XM_BayesUnsub 11578 7.47 13.81 4.76 50 HTML_IMAGE_RATIO_02 11414 5.26 6.57 4.69 51 TR_XM_DK_Bayes2 11256 3.33 0.29 4.63 52 XM_H_Long_From01 11146 4.61 4.68 4.58 53 RCVD_IN_MSPIKE_H3 10984 6.61 11.51 4.52 54 RCVD_IN_MSPIKE_WL 10984 6.61 11.51 4.52 55 IN_ZIMBRA_NJ_WHITELIST 10882 3.15 0.06 4.48 56 BOTNET_IPINHOSTNAME 10792 6.84 12.44 4.44 57 XM_B_SpammyWords3 10418 7.43 14.80 4.28 58 HTML_IMAGE_RATIO_04 9736 4.27 4.89 4.00 59 XMStrtUSub 9697 3.98 3.95 3.99 60 BAYES_999 9601 12.61 32.87 3.95 61 BAYES_80 9016 5.53 9.80 3.71 62 XM_UncommonTLD01 8704 4.26 5.86 3.58 63 FSL_BULK_SIG 8334 4.74 7.80 3.43 64 XMSubMetaSx_00 8022 4.26 6.50 3.30 65 TR_XM_SpammyWords4 7823 6.02 12.57 3.22 66 RELAYCOUNTRY_META 7558 9.38 24.04 3.11 67 MIME_QP_LONG_LINE 7423 2.64 1.66 3.05 68 MPART_ALT_DIFF 7359 3.86 5.82 3.03 69 XM_Body_Dirty_Words 7261 4.71 8.76 2.99 70 XMNumbers 7134 3.03 3.24 2.93 71 T_REMOTE_IMAGE 7010 2.45 1.43 2.88 72 T_TooManySym_02 6939 2.19 0.65 2.85 73 INVALID_MSGID 6894 2.08 0.31 2.84 74 TO_MALFORMED 6728 1.98 0.12 2.77 75 MSGID_NOFQDN1 6433 1.91 0.19 2.65 76 TR_XM_DKIM_Undo 6210 14.30 41.77 2.55 77 BAYES_95 6140 3.52 5.85 2.53 78 XM_B_SpammyTLD 5712 2.42 2.59 2.35 79 BAYES_05 5690 1.80 0.52 2.34 80 RCVD_IN_IADB_LISTED 5670 1.89 0.86 2.33 81 MIME_HTML_MOSTLY 5574 2.87 4.21 2.29 82 XM_PDF 5479 1.70 0.40 2.25 83 BAYES_20 5415 1.83 0.91 2.23 84 XM_B_Phish_Phrases 5270 2.70 3.93 2.17 85 TVD_RCVD_IP 5210 1.81 1.04 2.14 86 RCVD_IN_IADB_SPF 5185 1.72 0.77 2.13 87 TR_DCC_Bayes_99 5044 10.75 31.02 2.07 88 RCVD_IN_IADB_SENDERID 4791 1.59 0.71 1.97 89 FROM_EXCESS_BASE64 4772 2.01 2.13 1.96 90 RCVD_IN_IADB_DK 4714 1.58 0.73 1.94 91 XM_SPF_SoftFail 4705 2.88 5.10 1.93 92 MAILING_LIST_MULTI 4675 1.75 1.36 1.92 93 XM_CamelCaseFrm001 4578 2.22 3.01 1.88 94 TR_XM_SpammyRelay 4451 7.44 20.56 1.83 95 HTML_IMAGE_RATIO_06 4365 2.45 3.99 1.80 96 XMSexyCombo_05 4170 2.98 5.95 1.71 97 XMBSHREFv2 4050 1.25 0.27 1.67 98 MIME_HTML_ONLY_MULTI 3966 2.10 3.20 1.63 99 HTML_IMAGE_RATIO_08 3775 2.60 5.04 1.55 100 XMGappySubj_01 3734 1.18 0.34 1.54 101 RELAYCOUNTRY_CA 3595 5.77 15.80 1.48 102 TR_XM_UnparsRelay 3506 3.26 7.50 1.44 103 TM2_M_URI_OPT_OUT 3443 2.05 3.53 1.42 104 XMDiploma_00 3406 1.47 1.64 1.40 105 TooManyTo_002 3342 1.24 0.91 1.37 106 TVD_SPACE_RATIO 3338 0.99 0.10 1.37 107 HTML_MIME_NO_HTML_TAG 3283 1.29 1.16 1.35 108 RCVD_IN_IADB_VOUCHED 3277 1.06 0.37 1.35 109 IN_HORDE_ADDRESS_BOOK 3118 0.91 0.04 1.28 110 XM_DK_Undo_01 3116 1.34 1.49 1.28 111 UNTRUSTED_Relay 3050 2.63 5.86 1.25 112 T_XMDrugObfuBody_14 2953 2.18 4.43 1.21 113 TR_XM_PhishingBody 2915 1.84 3.33 1.20 114 TR_XM_SpammyWords5 2837 2.16 4.49 1.17 115 DKIM_INVALID 2726 1.90 3.72 1.12 116 XMGappySubj_02 2713 0.79 0.04 1.12 117 XM_B_Investor 2610 1.83 3.59 1.07 118 XM_B_Unsub2 2599 1.24 1.65 1.07 119 XM_OfRef6 2559 2.08 4.47 1.05 120 BOTNET 2526 2.85 7.09 1.04 121 T_XMDrugObfuBody_08 2417 1.64 3.15 0.99 122 XM_SendGrid 2416 1.08 1.28 0.99 123 XMBody_95 2362 0.74 0.20 0.97 124 T_TooManySym_03 2362 0.73 0.16 0.97 125 TR_Symld_Words 2345 1.00 1.09 0.96 126 XM_H_Long_From02 2331 1.03 1.18 0.96 127 TM2_M_VERY_LONG_WORD 2318 1.44 2.57 0.95 128 XM_GoogleGroups 2297 0.78 0.40 0.94 129 URI_NOVOWEL 2218 1.11 1.58 0.91 130 TR_XM_Base64_M1 2167 0.86 0.78 0.89 131 RCVD_IN_IADB_OPTIN 2112 0.68 0.24 0.87 132 XMBody_17 1962 3.30 9.14 0.81 133 SUBJ_ALL_CAPS 1928 1.44 2.96 0.79 134 TR_MetaPhish_Combo_01 1918 0.83 0.91 0.79 135 XMLngstWrd_00 1914 0.63 0.26 0.79 136 URI_TRY_3LD 1886 0.95 1.37 0.78 137 URI_HEX 1875 0.99 1.49 0.77 138 XMSubMetaI_00 1858 0.80 0.90 0.76 139 DKIM_ADSP_CUSTOM_MED 1854 0.93 1.31 0.76 140 XMBdyGiftCard01 1840 1.18 2.17 0.76 141 USER_IN_WHITELIST 1835 0.53 0.00 0.75 142 USER_IN_WELCOMELIST 1835 0.53 0.00 0.75 143 TR_XM_DK_SendGrid 1747 0.77 0.90 0.72 144 XM_B_COPY_HTML 1723 0.79 0.98 0.71 145 TR_XM_SpammyWords2 1663 5.63 17.21 0.68 146 RCVD_IN_BL_SPAMCOP_NET 1597 5.74 17.63 0.66 147 MPART_ALT_DIFF_COUNT 1572 0.80 1.17 0.65 148 TooManyTo_003 1571 0.70 0.84 0.65 149 XMStockSpam_06 1567 0.89 1.47 0.64 150 XM_H_PHPMailer 1520 0.68 0.82 0.63 151 XM_UB50 1434 1.20 2.64 0.59 152 XMGenDplmaNmb 1429 0.68 0.89 0.59 153 RCVD_IN_PSBL 1387 0.71 1.05 0.57 154 XM_B_SpammyWords4 1382 1.15 2.50 0.57 155 SUBJ_DOLLARS 1366 0.55 0.52 0.56 156 TR_LOTS_OF_MONEY3 1345 1.50 3.70 0.55 157 T_XMHurry_00 1339 0.89 1.69 0.55 158 XMBrknScrpt_02 1320 1.12 2.48 0.54 159 NML_ADSP_CUSTOM_MED 1299 0.75 1.26 0.53 160 XM_B_FormFill 1275 0.38 0.04 0.52 161 XMPhish30 1257 0.77 1.37 0.52 162 XM_ProductURIs 1235 0.57 0.70 0.51 163 XMNoVowels 1206 0.49 0.48 0.50 164 T_XMDrugObfuBody_00 1192 0.61 0.88 0.49 165 HTML_FONT_FACE_BAD 1186 0.54 0.65 0.49 166 FROM_GOV_DKIM_AU 1183 0.36 0.06 0.49 167 TooManyTo_004 1182 0.58 0.81 0.49 168 TR_XM_SPAMCOP 1142 4.81 14.95 0.47 169 FORGED_GMAIL_RCVD 1122 0.67 1.16 0.46 170 HTTPS_HTTP_MISMATCH 1104 0.63 1.04 0.45 171 KHOP_HELO_FCRDNS 1099 0.96 2.16 0.45 172 FILL_THIS_FORM 1097 0.42 0.33 0.45 173 HTML_TAG_BALANCE_BODY 1096 0.79 1.59 0.45 174 XMSubMetaSxObfu_02 1085 0.45 0.45 0.45 175 SHOPIFY_IMG_NOT_RCVD_SFY 1051 0.47 0.56 0.43 176 T_FILL_THIS_FORM_SHORT 1045 1.83 5.12 0.43 177 SpammyFromTLD_01 1021 0.96 2.21 0.42 178 TooManyTo_005 1016 0.52 0.76 0.42 179 HELO_NODOT 1008 0.39 0.32 0.41 180 HELO_NO_DOMAIN 1006 0.38 0.32 0.41 181 XMSexyCombo_01 980 0.73 1.48 0.40 182 XM_DIRTYINTL 957 0.72 1.47 0.39 183 T_TooManySym_04 953 0.28 0.03 0.39 184 XM_B_REG_HTML 931 0.54 0.89 0.38 185 GMD_PDF_EMPTY_BODY 894 0.27 0.04 0.37 186 DKIM_ADSP_NXDOMAIN 872 0.39 0.46 0.36 187 SpammyFromTLD_02 870 0.63 1.26 0.36 188 XM_S_SubURI 837 0.26 0.05 0.34 189 THIS_AD 784 0.60 1.25 0.32 190 NO_DNS_FOR_FROM 784 0.34 0.37 0.32 191 RELAYCOUNTRY_AU 783 0.90 2.25 0.32 192 PLING_QUERY 771 0.40 0.59 0.32 193 DIET_1 769 0.55 1.10 0.32 194 RDNS_DYNAMIC 763 0.55 1.12 0.31 195 T_OBFU_PDF_ATTACH 746 0.23 0.04 0.31 196 XMHTMLBadTable_001 725 0.38 0.56 0.30 197 CTE_8BIT_MISMATCH 724 0.38 0.57 0.30 198 XMSubMetaSxObfu_03 720 0.28 0.25 0.30 199 XM_B_DNDMA 718 0.38 0.58 0.30 200 TM2_M_OBFU_COMMENT 708 0.38 0.60 0.29 ----------------------------------------------------------------------