Email: 292155 Autolearn: 0 AvgScore: 3.87 AvgScanTime: 1.13 sec Spam: 92901 Autolearn: 0 AvgScore: 13.68 AvgScanTime: 1.20 sec Ham: 199254 Autolearn: 0 AvgScore: -0.70 AvgScanTime: 1.09 sec Time Spent Running SA: 91.38 hours Time Spent Processing Spam: 30.94 hours Time Spent Processing Ham: 60.44 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89304 82.06 96.13 75.50 2 DKIM_SIGNED 85420 78.51 91.95 72.25 3 XM_DK_Pass 82611 76.92 88.92 71.32 4 DKIM_VALID 81378 76.18 87.60 70.85 5 XM_B_Unicode 80802 72.60 86.98 65.89 6 RELAYCOUNTRY_US 72823 75.26 78.39 73.81 7 XMListUnsubscribeExists 70638 60.34 76.04 53.02 8 DCC_CHECK 68894 50.20 74.16 39.04 9 XM_B_SpammyWords 68412 51.19 73.64 40.72 10 DKIM_VALID_AU 61195 62.76 65.87 61.31 11 XM_DK_Undo_02 46149 20.47 49.68 6.85 12 XM_B_Unicode3 42883 43.60 46.16 42.40 13 XM_B_SpammyWords2 39082 25.89 42.07 18.35 14 BAYES_99 38073 17.02 40.98 5.84 15 LOC_TINY_FONT_1 36684 32.48 39.49 29.21 16 TR_XM_DKIM_Undo 35570 14.22 38.29 2.99 17 HTML_FONT_LOW_CONTRAST 33217 32.37 35.76 30.79 18 BAYES_50 31003 48.85 33.37 56.07 19 FVGT_m_MULTI_ODD 30239 28.44 32.55 26.52 20 BAYES_999 30238 13.43 32.55 4.52 21 RCVD_IN_MSPIKE_H2 29461 28.22 31.71 26.59 22 MIME_HTML_ONLY 28777 22.36 30.98 18.34 23 TR_DCC_Bayes_99 27707 11.23 29.82 2.56 24 DKIM_VALID_EF 27542 28.00 29.65 27.23 25 T_KAM_HTML_FONT_INVALID 26862 22.22 28.91 19.09 26 DCC_CHECK_NEGATIVE 23994 49.77 25.83 60.94 27 TR_XM_DK_Unsub 21830 17.63 23.50 14.90 28 T_TM2_M_HEADER_IN_MSG 21314 22.22 22.94 21.88 29 RELAYCOUNTRY_META 19861 9.60 21.38 4.11 30 XMSubLong 17349 20.21 18.67 20.93 31 TR_XM_SpammyRelay 16631 7.36 17.90 2.45 32 XM_Multi_Part_URI 16127 15.90 17.36 15.22 33 TR_XM_SpammyWords2 15142 5.68 16.30 0.73 34 TR_MAX_INTL_RELAY 13932 9.72 15.00 7.26 35 RCVD_IN_BL_SPAMCOP_NET 13876 5.22 14.94 0.68 36 XM_B_Unsub 13377 9.83 14.40 7.70 37 TR_XM_BayesUnsub 13027 8.77 14.02 6.31 38 BOTNET_IPINHOSTNAME 12889 8.10 13.87 5.40 39 LOTS_OF_MONEY 12576 8.14 13.54 5.62 40 XM_B_SpammyWords3 12519 7.23 13.48 4.31 41 RELAYCOUNTRY_CA 12460 5.61 13.41 1.97 42 UNPARSEABLE_RELAY 12316 11.49 13.26 10.67 43 TR_XM_SPAMCOP 11842 4.35 12.75 0.43 44 TR_XM_SpammyWords4 11509 6.67 12.39 4.00 45 RCVD_IN_MSPIKE_H3 9101 7.04 9.80 5.76 46 RCVD_IN_MSPIKE_WL 9101 7.04 9.80 5.76 47 XMBody_17 8941 3.60 9.62 0.79 48 BAYES_80 8640 5.86 9.30 4.25 49 BAYES_60 7415 9.56 7.98 10.30 50 XM_Evil_Numbers_Gen 7166 7.87 7.71 7.94 51 BOTNET 7131 3.19 7.68 1.10 52 TR_XM_UnparsRelay 6986 3.57 7.52 1.73 53 HTML_IMAGE_RATIO_02 6681 6.43 7.19 6.07 54 XM_Body_Dirty_Words 6567 4.02 7.07 2.60 55 FSL_BULK_SIG 6421 4.36 6.91 3.16 56 XMSubMetaSx_00 6326 4.97 6.81 4.12 57 TooManyTo_001 5621 6.57 6.05 6.81 58 MPART_ALT_DIFF 5311 4.06 5.72 3.29 59 XM_H_GMP 5048 6.85 5.43 7.51 60 UNTRUSTED_Relay 5007 2.84 5.39 1.66 61 LotsOfNums_01 4994 6.41 5.38 6.89 62 XM_UncommonTLD01 4991 4.59 5.37 4.22 63 BAYES_95 4886 3.72 5.26 3.01 64 T_XMDrugObfuBody_14 4878 2.77 5.25 1.61 65 XM_SPF_SoftFail 4713 3.25 5.07 2.40 66 T_FILL_THIS_FORM_SHORT 4649 1.90 5.00 0.45 67 XM_OfRef6 4521 2.31 4.87 1.12 68 XMSexyCombo_05 4503 2.64 4.85 1.61 69 HTML_IMAGE_RATIO_06 4436 3.33 4.77 2.65 70 HTML_IMAGE_RATIO_04 4300 5.00 4.63 5.17 71 TR_XM_SpammyWords5 4255 2.42 4.58 1.42 72 RCVD_IN_VALIDITY_SAFE 4044 7.47 4.35 8.92 73 DKIM_INVALID 4042 2.33 4.35 1.39 74 TR_XM_BayesRelay 4031 1.38 4.34 0.00 75 XMStrtUSub 4021 5.25 4.33 5.68 76 TR_LOTS_OF_MONEY3 3934 1.76 4.23 0.60 77 MIME_HTML_MOSTLY 3830 3.30 4.12 2.92 78 XM_B_Investor 3808 2.19 4.10 1.30 79 FONT_INVIS_LONG_LINE 3706 1.29 3.99 0.04 80 XM_H_Long_From01 3578 4.52 3.85 4.83 81 RCVD_IN_VALIDITY_CERTIFIED 3494 6.71 3.76 8.09 82 USER_IN_DEF_DKIM_WL 3462 13.45 3.73 17.99 83 XM_B_Phish_Phrases 3313 2.97 3.57 2.70 84 MIME_HTML_ONLY_MULTI 3301 2.28 3.55 1.69 85 TR_XM_PhishingBody 3294 2.58 3.55 2.12 86 HK_RANDOM_REPLYTO 3270 1.19 3.52 0.11 87 XMNumbers 3260 3.42 3.51 3.38 88 TR_XM_FormFill 3244 1.12 3.49 0.02 89 TM2_M_URI_OPT_OUT 3176 2.24 3.42 1.70 90 HTML_IMAGE_RATIO_08 3119 2.52 3.36 2.13 91 T_XMDrugObfuBody_08 3063 1.96 3.30 1.33 92 XM_CamelCaseFrm001 2840 2.48 3.06 2.20 93 XM_B_SpammyTLD 2794 2.83 3.01 2.74 94 XMDiploma_00 2761 2.45 2.97 2.21 95 XM_URI_RBL 2661 1.02 2.86 0.16 96 XM_UB50 2574 1.53 2.77 0.95 97 SUBJ_ALL_CAPS 2549 1.62 2.74 1.09 98 AC_BR_BONANZA 2475 0.92 2.66 0.11 99 RELAYCOUNTRY_AU 2324 1.06 2.50 0.39 100 FROM_EXCESS_BASE64 2219 2.06 2.39 1.91 101 TM2_M_VERY_LONG_WORD 2219 1.63 2.39 1.28 102 XM_B_SpammyWords4 2167 1.24 2.33 0.73 103 TR_XM_NoHeaderRelay 1924 0.73 2.07 0.11 104 URI_TRY_3LD 1829 1.19 1.97 0.82 105 KHOP_HELO_FCRDNS 1818 0.99 1.96 0.55 106 TR_XM_PHPForged 1813 0.75 1.95 0.19 107 DIET_1 1809 1.04 1.95 0.61 108 XMReplyNow 1776 0.81 1.91 0.29 109 HTML_TAG_BALANCE_BODY 1750 1.06 1.88 0.68 110 TR_XM_PHPDW 1728 0.71 1.86 0.18 111 TR_XM_FormFill2 1683 0.71 1.81 0.20 112 XM_H_PHPOS 1676 0.69 1.80 0.17 113 SpammyFromTLD_01 1667 0.83 1.79 0.38 114 XMStockSpam_06 1640 1.59 1.77 1.51 115 T_TooManySym_01 1638 5.13 1.76 6.71 116 XMBrknScrpt_02 1633 1.10 1.76 0.79 117 XM_HighProb1 1632 0.56 1.76 0.01 118 XM_B_Unsub2 1617 1.25 1.74 1.02 119 T_XMHurry_00 1579 0.88 1.70 0.49 120 TR_XM_INV_DKIM 1563 0.59 1.68 0.08 121 T_STY_INVIS_DIRECT 1506 0.69 1.62 0.26 122 MIME_QP_LONG_LINE 1470 2.47 1.58 2.89 123 SpammyFromTLD_02 1396 0.59 1.50 0.17 124 T_REMOTE_IMAGE 1392 2.19 1.50 2.51 125 XMPhish30 1390 1.25 1.50 1.13 126 HTML_MIME_NO_HTML_TAG 1376 1.36 1.48 1.30 127 MAILING_LIST_MULTI 1314 2.11 1.41 2.43 128 TR_XM_InvalidRelay 1290 0.46 1.39 0.02 129 XM_SendGrid 1277 1.25 1.37 1.19 130 XM_OfRef7 1253 0.56 1.35 0.19 131 THIS_AD 1245 0.62 1.34 0.29 132 XM_H_Long_From02 1244 1.09 1.34 0.97 133 ALL_TRUSTED 1236 15.65 1.33 22.33 134 XM_DK_Undo_01 1229 1.46 1.32 1.53 135 RDNS_DYNAMIC 1226 0.67 1.32 0.36 136 TVD_RCVD_IP 1153 2.22 1.24 2.67 137 DKIM_ADSP_CUSTOM_MED 1147 1.07 1.23 1.00 138 URI_HEX 1141 1.03 1.23 0.94 139 BAYES_40 1130 3.46 1.22 4.51 140 XMSlimDrugH 1128 0.55 1.21 0.24 141 TR_Symld_Words 1122 1.17 1.21 1.16 142 XMGenDplmaNmb 1120 1.10 1.21 1.06 143 BOTNET_NORDNS 1098 0.38 1.18 0.01 144 BOUNCE_MESSAGE 1068 8.29 1.15 11.62 145 ANY_BOUNCE_MESSAGE 1068 8.29 1.15 11.62 146 NML_ADSP_CUSTOM_MED 1067 0.81 1.15 0.66 147 RCVD_IN_VALIDITY_RPBL 1057 0.38 1.14 0.03 148 TR_XM_Base64_M1 1056 0.85 1.14 0.72 149 XMBdyGiftCard01 1046 1.25 1.13 1.30 150 TR_Caps_n_Bayes_99 1018 0.37 1.10 0.03 151 XM_B_COPY_HTML 994 1.25 1.07 1.33 152 HTTPS_HTTP_MISMATCH 981 0.71 1.06 0.54 153 T_XMDrugObfuBody_00 966 0.74 1.04 0.61 154 TR_XM_DK_SendGrid 966 0.96 1.04 0.93 155 XM_UB99 960 0.33 1.03 0.01 156 AC_HTML_NONSENSE_TAGS 959 0.34 1.03 0.02 157 XM_DIRTYINTL 955 0.39 1.03 0.09 158 FORGED_GMAIL_RCVD 950 0.69 1.02 0.54 159 TR_Mismatch_TLD_02 942 0.36 1.01 0.05 160 URI_NOVOWEL 940 1.06 1.01 1.08 161 XM_H_PHPMailer 939 0.84 1.01 0.76 162 MONEY_FROM_MISSP 936 0.37 1.01 0.07 163 PLING_QUERY 928 0.65 1.00 0.48 164 FSL_CTYPE_WIN1251 923 0.32 0.99 0.00 165 LongTLD 922 0.40 0.99 0.13 166 TR_XM_Base64_L1 918 0.43 0.99 0.17 167 TM2_M_OBFU_COMMENT 907 0.51 0.98 0.30 168 FORGED_MUA_OUTLOOK 905 0.34 0.97 0.04 169 FSL_NEW_HELO_USER 890 0.30 0.96 0.00 170 AXB_XMAILER_MIMEOLE_OL_024C2 886 0.30 0.95 0.00 171 BAYES_20 879 2.07 0.95 2.59 172 XMSubMetaI_00 874 0.57 0.94 0.40 173 TooManyTo_002 872 1.37 0.94 1.57 174 RCVD_IN_PSBL 872 0.86 0.94 0.82 175 TM2_M_A_HREF_HREF 860 0.42 0.93 0.18 176 TR_Mismatch_TLD_01 856 0.45 0.92 0.23 177 XM_B_Phish66 852 0.44 0.92 0.22 178 XMBody_78 848 0.39 0.91 0.14 179 TO_NO_BRKTS_MSFT 834 0.29 0.90 0.00 180 HELO_DYNAMIC_SPLIT_IP 823 0.29 0.89 0.02 181 TO_NO_BRKTS_FROM_MSSP 819 0.28 0.88 0.01 182 XM_H_Undi_Recip 813 0.36 0.88 0.12 183 TooManyTo_003 806 0.84 0.87 0.83 184 MPART_ALT_DIFF_COUNT 794 0.91 0.85 0.94 185 FROM_MISSP_MSFT 788 0.27 0.85 0.00 186 MISSING_HEADERS 776 0.43 0.84 0.24 187 TooManyTo_004 764 0.69 0.82 0.63 188 XMSolicitRefs_0 762 0.85 0.82 0.86 189 PDS_OTHER_BAD_TLD 755 0.34 0.81 0.11 190 TR_MetaPhish_Combo_01 753 0.69 0.81 0.63 191 XM_ProductURIs 750 0.71 0.81 0.66 192 TooManyTo_005 739 0.61 0.80 0.53 193 XM_B_SEO 693 0.33 0.75 0.13 194 XM_B_REG_HTML 689 0.54 0.74 0.44 195 SUBJ_DOLLARS 688 0.73 0.74 0.72 196 RCVD_IN_IADB_LISTED 686 1.86 0.74 2.38 197 XM_UB999 685 0.24 0.74 0.01 198 SHOPIFY_IMG_NOT_RCVD_SFY 684 0.65 0.74 0.61 199 XMSubMetaSxObfu_03 683 0.51 0.74 0.41 200 XMSexyCombo_01 681 0.41 0.73 0.25 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150442 82.06 96.13 75.50 2 RELAYCOUNTRY_US 147064 75.26 78.39 73.81 3 DKIM_SIGNED 143955 78.51 91.95 72.25 4 XM_DK_Pass 142109 76.92 88.92 71.32 5 DKIM_VALID 141181 76.18 87.60 70.85 6 XM_B_Unicode 131296 72.60 86.98 65.89 7 DKIM_VALID_AU 122160 62.76 65.87 61.31 8 DCC_CHECK_NEGATIVE 121417 49.77 25.83 60.94 9 BAYES_50 111723 48.85 33.37 56.07 10 XMListUnsubscribeExists 105639 60.34 76.04 53.02 11 XM_B_Unicode3 84484 43.60 46.16 42.40 12 XM_B_SpammyWords 81132 51.19 73.64 40.72 13 DCC_CHECK 77782 50.20 74.16 39.04 14 HTML_FONT_LOW_CONTRAST 61346 32.37 35.76 30.79 15 LOC_TINY_FONT_1 58198 32.48 39.49 29.21 16 DKIM_VALID_EF 54264 28.00 29.65 27.23 17 RCVD_IN_MSPIKE_H2 52977 28.22 31.71 26.59 18 FVGT_m_MULTI_ODD 52846 28.44 32.55 26.52 19 ALL_TRUSTED 44492 15.65 1.33 22.33 20 T_TM2_M_HEADER_IN_MSG 43598 22.22 22.94 21.88 21 XMSubLong 41705 20.21 18.67 20.93 22 T_KAM_HTML_FONT_INVALID 38047 22.22 28.91 19.09 23 XM_B_SpammyWords2 36564 25.89 42.07 18.35 24 MIME_HTML_ONLY 36551 22.36 30.98 18.34 25 USER_IN_DEF_DKIM_WL 35839 13.45 3.73 17.99 26 XM_Multi_Part_URI 30328 15.90 17.36 15.22 27 TR_XM_DK_Unsub 29681 17.63 23.50 14.90 28 ANY_BOUNCE_MESSAGE 23149 8.29 1.15 11.62 29 BOUNCE_MESSAGE 23147 8.29 1.15 11.62 30 UNPARSEABLE_RELAY 21262 11.49 13.26 10.67 31 BAYES_00 20922 7.30 0.42 10.50 32 BAYES_60 20523 9.56 7.98 10.30 33 XM_DKIMWhitelistDomains 20475 7.01 0.00 10.28 34 RCVD_IN_VALIDITY_SAFE 17779 7.47 4.35 8.92 35 RCVD_IN_VALIDITY_CERTIFIED 16111 6.71 3.76 8.09 36 XM_Evil_Numbers_Gen 15814 7.87 7.71 7.94 37 XM_B_Unsub 15343 9.83 14.40 7.70 38 XM_H_GMP 14956 6.85 5.43 7.51 39 TR_MAX_INTL_RELAY 14469 9.72 15.00 7.26 40 LotsOfNums_01 13733 6.41 5.38 6.89 41 XM_DK_Undo_02 13649 20.47 49.68 6.85 42 TooManyTo_001 13561 6.57 6.05 6.81 43 T_TooManySym_01 13362 5.13 1.76 6.71 44 TR_XM_BayesUnsub 12581 8.77 14.02 6.31 45 HTML_IMAGE_RATIO_02 12093 6.43 7.19 6.07 46 TR_XM_DK_Bayes 12042 4.22 0.32 6.04 47 TR_XM_DK_Bayes1 11946 4.18 0.29 6.00 48 BAYES_99 11642 17.02 40.98 5.84 49 RCVD_IN_MSPIKE_H3 11468 7.04 9.80 5.76 50 RCVD_IN_MSPIKE_WL 11468 7.04 9.80 5.76 51 XMStrtUSub 11313 5.25 4.33 5.68 52 LOTS_OF_MONEY 11191 8.14 13.54 5.62 53 BOTNET_IPINHOSTNAME 10765 8.10 13.87 5.40 54 TR_XM_DK_Bayes2 10650 3.70 0.19 5.34 55 HTML_IMAGE_RATIO_04 10311 5.00 4.63 5.17 56 IN_ZIMBRA_NJ_WHITELIST 9829 3.38 0.04 4.93 57 XM_H_Long_From01 9629 4.52 3.85 4.83 58 BAYES_999 8999 13.43 32.55 4.52 59 BAYES_40 8993 3.46 1.22 4.51 60 XM_B_SpammyWords3 8595 7.23 13.48 4.31 61 BAYES_80 8477 5.86 9.30 4.25 62 XM_UncommonTLD01 8408 4.59 5.37 4.22 63 XMSubMetaSx_00 8205 4.97 6.81 4.12 64 RELAYCOUNTRY_META 8185 9.60 21.38 4.11 65 TR_XM_SpammyWords4 7973 6.67 12.39 4.00 66 T_TooManySym_02 7887 2.88 0.57 3.96 67 TO_MALFORMED 6887 2.39 0.09 3.46 68 INVALID_MSGID 6856 2.48 0.42 3.44 69 XMNumbers 6728 3.42 3.51 3.38 70 MPART_ALT_DIFF 6561 4.06 5.72 3.29 71 MSGID_NOFQDN1 6456 2.30 0.29 3.24 72 FSL_BULK_SIG 6306 4.36 6.91 3.16 73 BAYES_95 5988 3.72 5.26 3.01 74 TR_XM_DKIM_Undo 5967 14.22 38.29 2.99 75 BAYES_05 5825 2.16 0.52 2.92 76 MIME_HTML_MOSTLY 5809 3.30 4.12 2.92 77 MIME_QP_LONG_LINE 5760 2.47 1.58 2.89 78 XM_B_SpammyTLD 5463 2.83 3.01 2.74 79 XM_B_Phish_Phrases 5371 2.97 3.57 2.70 80 TVD_RCVD_IP 5324 2.22 1.24 2.67 81 HTML_IMAGE_RATIO_06 5288 3.33 4.77 2.65 82 XM_Body_Dirty_Words 5172 4.02 7.07 2.60 83 BAYES_20 5161 2.07 0.95 2.59 84 TR_DCC_Bayes_99 5100 11.23 29.82 2.56 85 T_REMOTE_IMAGE 5000 2.19 1.50 2.51 86 TR_XM_SpammyRelay 4872 7.36 17.90 2.45 87 MAILING_LIST_MULTI 4844 2.11 1.41 2.43 88 XM_SPF_SoftFail 4791 3.25 5.07 2.40 89 RCVD_IN_IADB_LISTED 4746 1.86 0.74 2.38 90 XMDiploma_00 4405 2.45 2.97 2.21 91 XM_CamelCaseFrm001 4393 2.48 3.06 2.20 92 RCVD_IN_IADB_SPF 4261 1.67 0.66 2.14 93 HTML_IMAGE_RATIO_08 4240 2.52 3.36 2.13 94 TR_XM_PhishingBody 4234 2.58 3.55 2.12 95 XM_PDF 3990 1.49 0.38 2.00 96 XMBSHREFv2 3938 1.44 0.28 1.98 97 RELAYCOUNTRY_CA 3918 5.61 13.41 1.97 98 RCVD_IN_IADB_SENDERID 3886 1.53 0.62 1.95 99 RCVD_IN_IADB_DK 3818 1.51 0.63 1.92 100 FROM_EXCESS_BASE64 3798 2.06 2.39 1.91 101 XMGappySubj_01 3592 1.27 0.13 1.80 102 TR_XM_UnparsRelay 3444 3.57 7.52 1.73 103 TM2_M_URI_OPT_OUT 3380 2.24 3.42 1.70 104 MIME_HTML_ONLY_MULTI 3374 2.28 3.55 1.69 105 UNTRUSTED_Relay 3302 2.84 5.39 1.66 106 TVD_SPACE_RATIO 3241 1.13 0.08 1.63 107 T_XMDrugObfuBody_14 3206 2.77 5.25 1.61 108 XMSexyCombo_05 3205 2.64 4.85 1.61 109 TooManyTo_002 3119 1.37 0.94 1.57 110 XM_DK_Undo_01 3046 1.46 1.32 1.53 111 IN_HORDE_ADDRESS_BOOK 3035 1.05 0.04 1.52 112 XMStockSpam_06 3016 1.59 1.77 1.51 113 XMGappySubj_02 2982 1.04 0.07 1.50 114 RCVD_IN_IADB_VOUCHED 2866 1.09 0.35 1.44 115 TR_XM_SpammyWords5 2824 2.42 4.58 1.42 116 DKIM_INVALID 2774 2.33 4.35 1.39 117 XMBody_95 2772 1.03 0.24 1.39 118 T_XMDrugObfuBody_08 2651 1.96 3.30 1.33 119 XM_B_COPY_HTML 2650 1.25 1.07 1.33 120 XM_B_Investor 2594 2.19 4.10 1.30 121 XMBdyGiftCard01 2594 1.25 1.13 1.30 122 HTML_MIME_NO_HTML_TAG 2584 1.36 1.48 1.30 123 TM2_M_VERY_LONG_WORD 2555 1.63 2.39 1.28 124 T_TooManySym_03 2545 0.94 0.21 1.28 125 XM_SendGrid 2381 1.25 1.37 1.19 126 TR_Symld_Words 2308 1.17 1.21 1.16 127 XM_GoogleGroups 2295 0.96 0.54 1.15 128 XMPhish30 2250 1.25 1.50 1.13 129 XM_OfRef6 2222 2.31 4.87 1.12 130 BOTNET 2197 3.19 7.68 1.10 131 SUBJ_ALL_CAPS 2177 1.62 2.74 1.09 132 URI_NOVOWEL 2156 1.06 1.01 1.08 133 XMGenDplmaNmb 2105 1.10 1.21 1.06 134 XM_B_Unsub2 2027 1.25 1.74 1.02 135 RCVD_IN_IADB_OPTIN 2011 0.77 0.26 1.01 136 XM_RXBody 1985 0.90 0.68 1.00 137 DKIM_ADSP_CUSTOM_MED 1984 1.07 1.23 1.00 138 XM_H_Long_From02 1928 1.09 1.34 0.97 139 XM_UB50 1888 1.53 2.77 0.95 140 MPART_ALT_DIFF_COUNT 1869 0.91 0.85 0.94 141 URI_HEX 1867 1.03 1.23 0.94 142 TR_XM_DK_SendGrid 1846 0.96 1.04 0.93 143 USER_IN_WELCOMELIST 1813 0.62 0.00 0.91 144 USER_IN_WHITELIST 1813 0.62 0.00 0.91 145 XMSolicitRefs_0 1709 0.85 0.82 0.86 146 TooManyTo_003 1660 0.84 0.87 0.83 147 URI_TRY_3LD 1639 1.19 1.97 0.82 148 XMhairloss01 1635 0.59 0.08 0.82 149 RCVD_IN_PSBL 1630 0.86 0.94 0.82 150 T_MANY_PILL_PRICE 1602 0.55 0.00 0.80 151 XMBody_17 1574 3.60 9.62 0.79 152 XMBrknScrpt_02 1572 1.10 1.76 0.79 153 XM_H_PHPMailer 1511 0.84 1.01 0.76 154 XMLngstWrd_00 1493 0.61 0.31 0.75 155 TR_XM_SpammyWords2 1459 5.68 16.30 0.73 156 XM_B_SpammyWords4 1454 1.24 2.33 0.73 157 XMNoVowels 1442 0.62 0.40 0.72 158 SUBJ_DOLLARS 1437 0.73 0.74 0.72 159 TR_XM_Base64_M1 1432 0.85 1.14 0.72 160 RCVD_IN_BL_SPAMCOP_NET 1364 5.22 14.94 0.68 161 HTML_TAG_BALANCE_BODY 1353 1.06 1.88 0.68 162 XM_ProductURIs 1318 0.71 0.81 0.66 163 FILL_THIS_FORM 1315 0.55 0.33 0.66 164 NML_ADSP_CUSTOM_MED 1313 0.81 1.15 0.66 165 TooManyTo_004 1258 0.69 0.82 0.63 166 TR_MetaPhish_Combo_01 1251 0.69 0.81 0.63 167 SHOPIFY_IMG_NOT_RCVD_SFY 1225 0.65 0.74 0.61 168 DIET_1 1225 1.04 1.95 0.61 169 T_XMDrugObfuBody_00 1209 0.74 1.04 0.61 170 TR_LOTS_OF_MONEY3 1198 1.76 4.23 0.60 171 XMSubMetaSxObfu_02 1169 0.49 0.30 0.59 172 XM_B_FormFill 1088 0.40 0.07 0.55 173 KHOP_HELO_FCRDNS 1087 0.99 1.96 0.55 174 HTTPS_HTTP_MISMATCH 1084 0.71 1.06 0.54 175 FORGED_GMAIL_RCVD 1070 0.69 1.02 0.54 176 TooManyTo_005 1057 0.61 0.80 0.53 177 T_TooManySym_04 1026 0.36 0.04 0.51 178 T_XMHurry_00 986 0.88 1.70 0.49 179 PLING_QUERY 963 0.65 1.00 0.48 180 HTML_FONT_FACE_BAD 942 0.55 0.71 0.47 181 XMPhish14 928 0.48 0.50 0.47 182 HELO_NO_DOMAIN 894 0.42 0.36 0.45 183 HELO_NODOT 894 0.42 0.36 0.45 184 T_FILL_THIS_FORM_SHORT 891 1.90 5.00 0.45 185 XM_B_REG_HTML 875 0.54 0.74 0.44 186 TR_XM_SPAMCOP 861 4.35 12.75 0.43 187 DKIM_ADSP_NXDOMAIN 838 0.46 0.56 0.42 188 XMSubMetaSxObfu_03 808 0.51 0.74 0.41 189 XMSubMetaI_00 799 0.57 0.94 0.40 190 XM_S_SubURI 795 0.29 0.07 0.40 191 RELAYCOUNTRY_AU 787 1.06 2.50 0.39 192 NO_DNS_FOR_FROM 765 0.38 0.37 0.38 193 GMD_PDF_EMPTY_BODY 761 0.27 0.03 0.38 194 XMSubMetaD_03 758 0.30 0.14 0.38 195 SpammyFromTLD_01 756 0.83 1.79 0.38 196 MIME_CHARSET_FARAWAY 755 0.40 0.44 0.38 197 FILL_THIS_FORM_LONG 745 0.31 0.18 0.37 198 T_FILL_THIS_FORM_LOAN 740 0.31 0.17 0.37 199 CTE_8BIT_MISMATCH 728 0.41 0.50 0.37 200 RDNS_DYNAMIC 725 0.67 1.32 0.36 ----------------------------------------------------------------------