Email: 504066 Autolearn: 0 AvgScore: 2.25 AvgScanTime: 1.04 sec Spam: 111453 Autolearn: 0 AvgScore: 13.40 AvgScanTime: 1.46 sec Ham: 392613 Autolearn: 0 AvgScore: -0.91 AvgScanTime: 0.92 sec Time Spent Running SA: 145.44 hours Time Spent Processing Spam: 45.24 hours Time Spent Processing Ham: 100.20 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 105603 98.64 94.75 99.74 2 DKIM_SIGNED 102858 49.19 92.29 36.95 3 HTML_MESSAGE 101757 50.08 91.30 38.38 4 XM_DK_Pass 100141 48.26 89.85 36.45 5 DKIM_VALID 98773 47.83 88.62 36.25 6 XM_B_Unicode 90134 43.99 80.87 33.53 7 RELAYCOUNTRY_US 88009 46.78 78.97 37.65 8 XMListUnsubscribeExists 84036 37.40 75.40 26.62 9 DCC_CHECK 80604 30.20 72.32 18.24 10 XM_B_SpammyWords 78363 32.03 70.31 21.16 11 DKIM_VALID_AU 76256 39.22 68.42 30.93 12 XM_DK_Undo_02 52513 13.17 47.12 3.54 13 XM_B_Unicode3 46341 25.38 41.58 20.79 14 XM_B_SpammyWords2 45711 16.42 41.01 9.44 15 LOC_TINY_FONT_1 43694 19.67 39.20 14.13 16 BAYES_99 41703 10.50 37.42 2.86 17 TR_XM_DKIM_Undo 40033 9.13 35.92 1.52 18 HTML_FONT_LOW_CONTRAST 38363 19.59 34.42 15.38 19 BAYES_50 36791 43.23 33.01 46.13 20 FVGT_m_MULTI_ODD 34987 17.26 31.39 13.24 21 RCVD_IN_MSPIKE_H2 34659 17.80 31.10 14.02 22 BAYES_999 33018 8.28 29.63 2.22 23 DKIM_VALID_EF 32553 17.36 29.21 13.99 24 MIME_HTML_ONLY 32224 14.12 28.91 9.92 25 TR_DCC_Bayes_99 30882 7.04 27.71 1.18 26 DCC_CHECK_NEGATIVE 30835 69.79 27.67 81.75 27 T_KAM_HTML_FONT_INVALID 30099 13.04 27.01 9.08 28 TR_XM_DK_Unsub 24632 10.81 22.10 7.61 29 RELAYCOUNTRY_META 23506 6.15 21.09 1.90 30 XMSubLong 23484 13.14 21.07 10.89 31 T_TM2_M_HEADER_IN_MSG 23250 12.69 20.86 10.37 32 TR_XM_SpammyRelay 19810 4.86 17.77 1.19 33 XM_Multi_Part_URI 18351 9.52 16.47 7.55 34 RCVD_IN_BL_SPAMCOP_NET 16434 3.54 14.75 0.36 35 TR_XM_SpammyWords2 16344 3.60 14.66 0.46 36 TR_MAX_INTL_RELAY 16219 6.11 14.55 3.71 37 XM_B_Unsub 16095 6.15 14.44 3.79 38 TR_XM_BayesUnsub 15452 5.51 13.86 3.14 39 UNPARSEABLE_RELAY 15294 7.31 13.72 5.49 40 XM_B_SpammyWords3 15146 5.27 13.59 2.91 41 LOTS_OF_MONEY 14884 5.47 13.35 3.23 42 RELAYCOUNTRY_CA 13679 3.44 12.27 0.94 43 TR_XM_SPAMCOP 13278 2.83 11.91 0.25 44 TR_XM_SpammyWords4 13198 4.46 11.84 2.37 45 BOTNET_IPINHOSTNAME 12811 4.61 11.49 2.66 46 XM_UncommonTLD01 11683 4.03 10.48 2.20 47 RCVD_IN_MSPIKE_H3 9748 4.22 8.75 2.93 48 RCVD_IN_MSPIKE_WL 9748 4.22 8.75 2.93 49 BAYES_80 9733 3.63 8.73 2.19 50 XMBody_17 9152 2.25 8.21 0.56 51 FSL_BULK_SIG 8928 3.03 8.01 1.62 52 BAYES_60 8706 5.90 7.81 5.36 53 XM_Body_Dirty_Words 8526 3.33 7.65 2.10 54 TR_XM_UnparsRelay 8356 2.37 7.50 0.91 55 XMNumbers 8237 2.79 7.39 1.49 56 XM_Evil_Numbers_Gen 7517 4.71 6.74 4.13 57 TR_XM_PHPForged 7507 1.61 6.74 0.16 58 XM_SPF_SoftFail 7502 2.40 6.73 1.17 59 SpammyFromTLD_01 7467 1.69 6.70 0.27 60 TR_XM_PHPDW 7428 1.59 6.66 0.15 61 BOTNET 7399 1.91 6.64 0.57 62 TR_XM_FormFill2 7374 1.58 6.62 0.15 63 XM_H_PHPOS 7366 1.57 6.61 0.14 64 HTML_IMAGE_RATIO_02 6963 3.56 6.25 2.80 65 UNTRUSTED_Relay 6761 1.89 6.07 0.70 66 XM_OfRef6 6737 1.87 6.04 0.69 67 XMSubMetaSx_00 6646 2.93 5.96 2.07 68 SCC_BODY_URI_ONLY 6461 23.46 5.80 28.47 69 BAYES_95 6150 2.41 5.52 1.52 70 T_XMDrugObfuBody_14 5836 1.80 5.24 0.83 71 TM2_M_BODY_EMPTY 5797 1.26 5.20 0.14 72 T_FILL_THIS_FORM_SHORT 5784 1.39 5.19 0.31 73 XMEmptyBody_01 5769 1.18 5.18 0.05 74 XM_H_GMP 5769 4.06 5.18 3.74 75 TR_LOTS_OF_MONEY3 5747 1.43 5.16 0.37 76 HTML_IMAGE_RATIO_04 5707 2.99 5.12 2.38 77 LotsOfNums_01 5660 4.07 5.08 3.79 78 MPART_ALT_DIFF 5484 2.51 4.92 1.83 79 XM_B_Investor 5130 1.62 4.60 0.78 80 TooManyTo_001 5038 3.46 4.52 3.16 81 XM_H_Long_From01 4839 3.02 4.34 2.64 82 XMSexyCombo_05 4605 1.97 4.13 1.36 83 RCVD_IN_VALIDITY_SAFE 4125 3.69 3.70 3.68 84 XM_B_Phish_Phrases 4108 1.86 3.69 1.34 85 DKIM_INVALID 4085 1.36 3.67 0.70 86 MIME_HTML_MOSTLY 3792 1.81 3.40 1.35 87 HTML_IMAGE_RATIO_06 3783 1.57 3.39 1.05 88 USER_IN_DEF_DKIM_WL 3720 8.28 3.34 9.69 89 HTML_IMAGE_RATIO_08 3606 1.49 3.24 1.00 90 XMStrtUSub 3595 2.67 3.23 2.51 91 TR_XM_FormFill 3586 0.72 3.22 0.02 92 TR_XM_SpammyWords5 3444 1.12 3.09 0.56 93 RCVD_IN_VALIDITY_CERTIFIED 3388 3.11 3.04 3.13 94 MIME_HTML_ONLY_MULTI 3377 1.42 3.03 0.97 95 TR_XM_PhishingBody 3369 1.23 3.02 0.73 96 BAYES_40 3315 7.87 2.97 9.26 97 TM2_M_VERY_LONG_WORD 3304 1.23 2.96 0.74 98 XM_B_SpammyTLD 3281 1.74 2.94 1.40 99 T_XMDrugObfuBody_08 3233 1.15 2.90 0.65 100 TM2_M_URI_OPT_OUT 3216 1.32 2.89 0.88 101 TR_XM_BayesRelay 3174 0.63 2.85 0.00 102 BAYES_20 3135 1.63 2.81 1.29 103 XM_URI_RBL 3084 0.69 2.77 0.11 104 XM_CamelCaseFrm001 3017 1.60 2.71 1.29 105 T_TooManySym_01 2770 2.97 2.49 3.11 106 FONT_INVIS_LONG_LINE 2739 0.57 2.46 0.04 107 SUBJ_ALL_CAPS 2633 0.93 2.36 0.52 108 XM_B_SpammyWords4 2618 0.88 2.35 0.46 109 TR_XM_NoHeaderRelay 2568 0.54 2.30 0.04 110 XM_UB50 2514 0.80 2.26 0.38 111 RELAYCOUNTRY_AU 2457 0.66 2.20 0.22 112 XMBrknScrpt_02 2283 0.83 2.05 0.48 113 FROM_EXCESS_BASE64 2209 1.35 1.98 1.18 114 AC_BR_BONANZA 2170 0.50 1.95 0.09 115 KHOP_HELO_FCRDNS 2103 0.60 1.89 0.23 116 URI_TRY_3LD 2085 0.68 1.87 0.34 117 XM_HighProb1 2083 0.42 1.87 0.00 118 T_XMHurry_00 2028 0.70 1.82 0.38 119 RCVD_IN_VALIDITY_RPBL 1991 0.43 1.79 0.04 120 DIET_1 1952 0.50 1.75 0.15 121 XMDiploma_00 1941 1.04 1.74 0.84 122 THIS_AD 1853 0.58 1.66 0.28 123 XM_B_Unsub2 1805 0.79 1.62 0.55 124 T_REMOTE_IMAGE 1797 1.59 1.61 1.58 125 MIME_QP_LONG_LINE 1787 1.74 1.60 1.77 126 T_STY_INVIS_DIRECT 1738 0.48 1.56 0.18 127 HK_RANDOM_REPLYTO 1686 0.38 1.51 0.06 128 XM_DK_Undo_01 1656 0.98 1.49 0.84 129 XM_DIRTYINTL 1655 0.37 1.48 0.06 130 XMStockSpam_06 1588 0.91 1.42 0.77 131 FSL_CTYPE_WIN1251 1543 0.31 1.38 0.00 132 FORGED_MUA_OUTLOOK 1535 0.32 1.38 0.02 133 FSL_NEW_HELO_USER 1533 0.30 1.38 0.00 134 AXB_XMAILER_MIMEOLE_OL_024C2 1526 0.30 1.37 0.00 135 XMSexyCombo_01 1501 0.35 1.35 0.07 136 XMReplyNow 1499 0.37 1.34 0.09 137 HTML_TAG_BALANCE_BODY 1496 0.46 1.34 0.21 138 XMBdyGiftCard01 1467 0.68 1.32 0.50 139 TO_NO_BRKTS_FROM_MSSP 1400 0.28 1.26 0.00 140 MPART_ALT_DIFF_COUNT 1395 0.57 1.25 0.38 141 XMPhish30 1389 0.49 1.25 0.28 142 BAYES_05 1387 1.41 1.24 1.45 143 TO_NO_BRKTS_MSFT 1384 0.27 1.24 0.00 144 FROM_MISSP_MSFT 1382 0.27 1.24 0.00 145 XM_SendGrid 1379 0.72 1.24 0.57 146 FROM_MISSP_EH_MATCH 1373 0.27 1.23 0.00 147 URI_HEX 1370 0.68 1.23 0.53 148 FROM_MISSPACED 1368 0.27 1.23 0.00 149 ALL_TRUSTED 1353 47.46 1.21 60.58 150 AC_HTML_NONSENSE_TAGS 1316 0.27 1.18 0.01 151 TR_XM_INV_DKIM 1304 0.29 1.17 0.03 152 MAILING_LIST_MULTI 1246 1.09 1.12 1.08 153 SpammyFromTLD_02 1238 0.45 1.11 0.27 154 XM_OfRef7 1231 0.29 1.10 0.06 155 XM_H_Undi_Recip 1219 0.29 1.09 0.06 156 TR_MetaPhish_Combo_01 1218 0.52 1.09 0.36 157 URI_NOVOWEL 1191 0.64 1.07 0.52 158 BOUNCE_MESSAGE 1190 43.27 1.07 55.25 159 ANY_BOUNCE_MESSAGE 1190 43.27 1.07 55.25 160 FORGED_OUTLOOK_TAGS 1185 0.24 1.06 0.00 161 FORGED_OUTLOOK_HTML 1185 0.24 1.06 0.00 162 RELAYCOUNTRY_JP 1109 0.23 1.00 0.01 163 TR_XM_InvalidRelay 1104 0.23 0.99 0.01 164 XM_ProductURIs 1094 0.65 0.98 0.56 165 XM_UB80 1082 0.22 0.97 0.01 166 XM_UB60 1074 0.23 0.96 0.03 167 TR_Mismatch_TLD_02 1070 0.23 0.96 0.02 168 RCVD_IN_PSBL 1063 0.52 0.95 0.40 169 LongTLD 1059 0.27 0.95 0.07 170 MSOE_MID_WRONG_CASE 1055 0.21 0.95 0.00 171 DEAR_BENEFICIARY 1054 0.21 0.95 0.00 172 BOTNET_NORDNS 1053 0.21 0.94 0.00 173 DKIM_ADSP_CUSTOM_MED 1038 0.52 0.93 0.40 174 TR_Symld_Words 998 0.62 0.90 0.55 175 TR_XM_Base64_M1 996 0.54 0.89 0.44 176 XM_UB99 992 0.20 0.89 0.00 177 NML_ADSP_CUSTOM_MED 991 0.38 0.89 0.24 178 FAKE_REPLY_C 984 0.20 0.88 0.00 179 HTML_MIME_NO_HTML_TAG 981 0.71 0.88 0.66 180 T_XMDrugObfuBody_10 966 0.21 0.87 0.02 181 T_XMDrugObfuBody_00 966 0.38 0.87 0.24 182 TM2_M_OBFU_COMMENT 962 0.36 0.86 0.21 183 TO_MALFORMED 955 1.51 0.86 1.70 184 PDS_OTHER_BAD_TLD 955 0.24 0.86 0.06 185 BOGUS_MSM_HDRS 938 0.19 0.84 0.00 186 HDR_ORDER_FTSDMCXX_DIRECT 935 0.19 0.84 0.00 187 RDNS_DYNAMIC 929 0.31 0.83 0.16 188 FORGED_GMAIL_RCVD 928 0.37 0.83 0.25 189 DEAR_FRIEND 919 0.24 0.82 0.07 190 PLING_QUERY 907 0.43 0.81 0.32 191 XMSlimDrugH 905 0.29 0.81 0.14 192 TR_Caps_n_Bayes_99 899 0.18 0.81 0.01 193 UNDISC_MONEY 898 0.18 0.81 0.00 194 XM_H_PHPMailer 880 0.42 0.79 0.32 195 XMSubMetaSSx_00 879 0.28 0.79 0.14 196 TR_Mismatch_TLD_01 876 0.28 0.79 0.13 197 TVD_RCVD_IP 875 1.13 0.79 1.23 198 XM_B_COPY_HTML 870 0.52 0.78 0.44 199 TR_XM_Undi_RecipCombo2 858 0.17 0.77 0.00 200 DKIM_ADSP_NXDOMAIN 849 0.32 0.76 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 391600 98.64 94.75 99.74 2 DCC_CHECK_NEGATIVE 320951 69.79 27.67 81.75 3 ALL_TRUSTED 237859 47.46 1.21 60.58 4 BOUNCE_MESSAGE 216904 43.27 1.07 55.25 5 ANY_BOUNCE_MESSAGE 216904 43.27 1.07 55.25 6 BAYES_50 181100 43.23 33.01 46.13 7 HTML_MESSAGE 150678 50.08 91.30 38.38 8 RELAYCOUNTRY_US 147801 46.78 78.97 37.65 9 DKIM_SIGNED 145080 49.19 92.29 36.95 10 XM_DK_Pass 143103 48.26 89.85 36.45 11 DKIM_VALID 142321 47.83 88.62 36.25 12 XM_B_Unicode 131625 43.99 80.87 33.53 13 DKIM_VALID_AU 121423 39.22 68.42 30.93 14 BAYES_00 117567 23.43 0.47 29.94 15 SCC_BODY_URI_ONLY 111792 23.46 5.80 28.47 16 XMListUnsubscribeExists 104494 37.40 75.40 26.62 17 XM_B_SpammyWords 83071 32.03 70.31 21.16 18 XM_B_Unicode3 81611 25.38 41.58 20.79 19 DCC_CHECK 71608 30.20 72.32 18.24 20 HTML_FONT_LOW_CONTRAST 60390 19.59 34.42 15.38 21 LOC_TINY_FONT_1 55467 19.67 39.20 14.13 22 RCVD_IN_MSPIKE_H2 55044 17.80 31.10 14.02 23 DKIM_VALID_EF 54928 17.36 29.21 13.99 24 FVGT_m_MULTI_ODD 52001 17.26 31.39 13.24 25 XMSubLong 42741 13.14 21.07 10.89 26 T_TM2_M_HEADER_IN_MSG 40708 12.69 20.86 10.37 27 MIME_HTML_ONLY 38956 14.12 28.91 9.92 28 USER_IN_DEF_DKIM_WL 38037 8.28 3.34 9.69 29 XM_B_SpammyWords2 37068 16.42 41.01 9.44 30 BAYES_40 36342 7.87 2.97 9.26 31 T_KAM_HTML_FONT_INVALID 35648 13.04 27.01 9.08 32 TR_XM_DK_Unsub 29871 10.81 22.10 7.61 33 XM_Multi_Part_URI 29623 9.52 16.47 7.55 34 UNPARSEABLE_RELAY 21569 7.31 13.72 5.49 35 BAYES_60 21034 5.90 7.81 5.36 36 XM_DKIMWhitelistDomains 20009 3.97 0.02 5.10 37 XM_Evil_Numbers_Gen 16200 4.71 6.74 4.13 38 XM_B_Unsub 14883 6.15 14.44 3.79 39 LotsOfNums_01 14865 4.07 5.08 3.79 40 XM_H_GMP 14686 4.06 5.18 3.74 41 TR_MAX_INTL_RELAY 14568 6.11 14.55 3.71 42 RCVD_IN_VALIDITY_SAFE 14460 3.69 3.70 3.68 43 XM_DK_Undo_02 13882 13.17 47.12 3.54 44 LOTS_OF_MONEY 12697 5.47 13.35 3.23 45 TR_XM_DK_Bayes 12471 2.54 0.32 3.18 46 TooManyTo_001 12411 3.46 4.52 3.16 47 TR_XM_DK_Bayes1 12397 2.53 0.32 3.16 48 TR_XM_BayesUnsub 12324 5.51 13.86 3.14 49 RCVD_IN_VALIDITY_CERTIFIED 12289 3.11 3.04 3.13 50 T_TooManySym_01 12200 2.97 2.49 3.11 51 RCVD_IN_MSPIKE_WL 11513 4.22 8.75 2.93 52 RCVD_IN_MSPIKE_H3 11513 4.22 8.75 2.93 53 XM_B_SpammyWords3 11427 5.27 13.59 2.91 54 BAYES_99 11242 10.50 37.42 2.86 55 HTML_IMAGE_RATIO_02 11002 3.56 6.25 2.80 56 TR_XM_DK_Bayes2 10992 2.23 0.24 2.80 57 IN_ZIMBRA_NJ_WHITELIST 10615 2.11 0.04 2.70 58 BOTNET_IPINHOSTNAME 10431 4.61 11.49 2.66 59 XM_H_Long_From01 10380 3.02 4.34 2.64 60 XMStrtUSub 9864 2.67 3.23 2.51 61 HTML_IMAGE_RATIO_04 9348 2.99 5.12 2.38 62 TR_XM_SpammyWords4 9295 4.46 11.84 2.37 63 BAYES_999 8697 8.28 29.63 2.22 64 XM_UncommonTLD01 8618 4.03 10.48 2.20 65 BAYES_80 8581 3.63 8.73 2.19 66 XM_Body_Dirty_Words 8236 3.33 7.65 2.10 67 XMSubMetaSx_00 8109 2.93 5.96 2.07 68 RELAYCOUNTRY_META 7474 6.15 21.09 1.90 69 XMLngstWrd_00 7416 1.55 0.35 1.89 70 INVALID_MSGID 7203 1.47 0.17 1.83 71 MPART_ALT_DIFF 7187 2.51 4.92 1.83 72 MIME_QP_LONG_LINE 6968 1.74 1.60 1.77 73 T_TooManySym_02 6761 1.49 0.65 1.72 74 MSGID_NOFQDN1 6694 1.33 0.03 1.70 75 TO_MALFORMED 6661 1.51 0.86 1.70 76 FSL_BULK_SIG 6341 3.03 8.01 1.62 77 T_REMOTE_IMAGE 6197 1.59 1.61 1.58 78 BAYES_95 5985 2.41 5.52 1.52 79 TR_XM_DKIM_Undo 5981 9.13 35.92 1.52 80 XMNumbers 5836 2.79 7.39 1.49 81 BAYES_05 5697 1.41 1.24 1.45 82 XM_B_SpammyTLD 5486 1.74 2.94 1.40 83 RCVD_IN_IADB_LISTED 5365 1.23 0.74 1.37 84 XMSexyCombo_05 5320 1.97 4.13 1.36 85 MIME_HTML_MOSTLY 5315 1.81 3.40 1.35 86 XM_B_Phish_Phrases 5280 1.86 3.69 1.34 87 BAYES_20 5064 1.63 2.81 1.29 88 XM_CamelCaseFrm001 5051 1.60 2.71 1.29 89 RCVD_IN_IADB_SPF 4933 1.13 0.67 1.26 90 TVD_RCVD_IP 4843 1.13 0.79 1.23 91 TR_XM_SpammyRelay 4681 4.86 17.77 1.19 92 XM_PDF 4627 0.97 0.23 1.18 93 RCVD_IN_IADB_SENDERID 4627 1.06 0.63 1.18 94 TR_DCC_Bayes_99 4626 7.04 27.71 1.18 95 FROM_EXCESS_BASE64 4617 1.35 1.98 1.18 96 XM_SPF_SoftFail 4585 2.40 6.73 1.17 97 RCVD_IN_IADB_DK 4551 1.05 0.65 1.16 98 MAILING_LIST_MULTI 4234 1.09 1.12 1.08 99 HTML_IMAGE_RATIO_06 4115 1.57 3.39 1.05 100 XMBSHREFv2 3950 0.83 0.19 1.01 101 HTML_IMAGE_RATIO_08 3907 1.49 3.24 1.00 102 MIME_HTML_ONLY_MULTI 3799 1.42 3.03 0.97 103 RELAYCOUNTRY_CA 3682 3.44 12.27 0.94 104 TR_XM_UnparsRelay 3591 2.37 7.50 0.91 105 TM2_M_URI_OPT_OUT 3460 1.32 2.89 0.88 106 XMGappySubj_01 3358 0.70 0.14 0.86 107 XMDiploma_00 3315 1.04 1.74 0.84 108 TVD_SPACE_RATIO 3286 0.67 0.09 0.84 109 XM_DK_Undo_01 3279 0.98 1.49 0.84 110 IN_HORDE_ADDRESS_BOOK 3253 0.65 0.04 0.83 111 T_XMDrugObfuBody_14 3241 1.80 5.24 0.83 112 XM_B_Investor 3050 1.62 4.60 0.78 113 XMStockSpam_06 3024 0.91 1.42 0.77 114 RCVD_IN_IADB_VOUCHED 2960 0.66 0.31 0.75 115 TM2_M_VERY_LONG_WORD 2895 1.23 2.96 0.74 116 TR_XM_PhishingBody 2852 1.23 3.02 0.73 117 TooManyTo_002 2832 0.72 0.72 0.72 118 DKIM_INVALID 2759 1.36 3.67 0.70 119 UNTRUSTED_Relay 2756 1.89 6.07 0.70 120 XM_OfRef6 2701 1.87 6.04 0.69 121 XMBody_95 2652 0.55 0.10 0.68 122 HTML_MIME_NO_HTML_TAG 2589 0.71 0.88 0.66 123 T_XMDrugObfuBody_08 2567 1.15 2.90 0.65 124 XM_H_Long_From02 2368 0.59 0.56 0.60 125 T_TooManySym_03 2273 0.51 0.26 0.58 126 XM_SendGrid 2245 0.72 1.24 0.57 127 BOTNET 2234 1.91 6.64 0.57 128 XMBody_17 2210 2.25 8.21 0.56 129 TR_XM_SpammyWords5 2198 1.12 3.09 0.56 130 XM_ProductURIs 2190 0.65 0.98 0.56 131 XM_B_Unsub2 2178 0.79 1.62 0.55 132 XMSolicitRefs_0 2155 0.52 0.40 0.55 133 TR_Symld_Words 2146 0.62 0.90 0.55 134 URI_HEX 2078 0.68 1.23 0.53 135 XMGappySubj_02 2058 0.42 0.04 0.52 136 URI_NOVOWEL 2036 0.64 1.07 0.52 137 SUBJ_ALL_CAPS 2036 0.93 2.36 0.52 138 XM_GoogleGroups 2004 0.49 0.43 0.51 139 XMBdyGiftCard01 1967 0.68 1.32 0.50 140 RCVD_IN_IADB_OPTIN 1950 0.43 0.21 0.50 141 XMBrknScrpt_02 1879 0.83 2.05 0.48 142 USER_IN_WELCOMELIST 1859 0.37 0.00 0.47 143 USER_IN_WHITELIST 1859 0.37 0.00 0.47 144 TR_XM_SpammyWords2 1816 3.60 14.66 0.46 145 XM_B_SpammyWords4 1807 0.88 2.35 0.46 146 TR_XM_Base64_M1 1736 0.54 0.89 0.44 147 XM_B_COPY_HTML 1733 0.52 0.78 0.44 148 TR_XM_DK_SendGrid 1655 0.48 0.67 0.42 149 T_MANY_PILL_PRICE 1607 0.32 0.00 0.41 150 TooManyTo_003 1589 0.45 0.63 0.40 151 DKIM_ADSP_CUSTOM_MED 1561 0.52 0.93 0.40 152 RCVD_IN_PSBL 1553 0.52 0.95 0.40 153 XMGenDplmaNmb 1536 0.47 0.75 0.39 154 XM_UB50 1497 0.80 2.26 0.38 155 T_XMHurry_00 1491 0.70 1.82 0.38 156 MPART_ALT_DIFF_COUNT 1487 0.57 1.25 0.38 157 TR_LOTS_OF_MONEY3 1440 1.43 5.16 0.37 158 TR_MetaPhish_Combo_01 1420 0.52 1.09 0.36 159 RCVD_IN_BL_SPAMCOP_NET 1405 3.54 14.75 0.36 160 XMSubMetaI_00 1356 0.42 0.68 0.35 161 URI_TRY_3LD 1338 0.68 1.87 0.34 162 PLING_QUERY 1253 0.43 0.81 0.32 163 TooManyTo_004 1243 0.38 0.60 0.32 164 XM_H_PHPMailer 1237 0.42 0.79 0.32 165 T_FILL_THIS_FORM_SHORT 1230 1.39 5.19 0.31 166 XMSubMetaSxObfu_02 1218 0.33 0.41 0.31 167 SHOPIFY_IMG_NOT_RCVD_SFY 1206 0.40 0.72 0.31 168 THIS_AD 1084 0.58 1.66 0.28 169 XMPhish30 1082 0.49 1.25 0.28 170 TooManyTo_005 1069 0.34 0.57 0.27 171 FILL_THIS_FORM 1055 0.30 0.42 0.27 172 SpammyFromTLD_02 1054 0.45 1.11 0.27 173 SpammyFromTLD_01 1041 1.69 6.70 0.27 174 FROM_GOV_DKIM_AU 1013 0.21 0.04 0.26 175 HTTPS_HTTP_MISMATCH 1011 0.34 0.61 0.26 176 HTML_FONT_FACE_BAD 1000 0.33 0.59 0.25 177 XMNoVowels 995 0.30 0.47 0.25 178 TR_XM_SPAMCOP 984 2.83 11.91 0.25 179 FORGED_GMAIL_RCVD 962 0.37 0.83 0.25 180 NML_ADSP_CUSTOM_MED 944 0.38 0.89 0.24 181 T_XMDrugObfuBody_00 935 0.38 0.87 0.24 182 XM_B_REG_HTML 924 0.34 0.69 0.24 183 NUMERIC_HTTP_ADDR 918 0.20 0.07 0.23 184 KHOP_HELO_FCRDNS 906 0.60 1.89 0.23 185 XMLngstWrd_01 894 0.24 0.29 0.23 186 XM_B_FormFill 855 0.20 0.14 0.22 187 RELAYCOUNTRY_AU 851 0.66 2.20 0.22 188 TM2_M_OBFU_COMMENT 841 0.36 0.86 0.21 189 HTML_TAG_BALANCE_BODY 819 0.46 1.34 0.21 190 XM_S_SubURI 810 0.19 0.12 0.21 191 T_TooManySym_04 794 0.19 0.14 0.20 192 SUBJ_DOLLARS 786 0.27 0.52 0.20 193 XMLngstWrd_02 766 0.21 0.27 0.20 194 HELO_NODOT 762 0.21 0.29 0.19 195 HELO_NO_DOMAIN 762 0.21 0.27 0.19 196 DKIM_ADSP_NXDOMAIN 748 0.32 0.76 0.19 197 CTE_8BIT_MISMATCH 745 0.15 0.02 0.19 198 XM_B_DNDMA 706 0.28 0.63 0.18 199 T_STY_INVIS_DIRECT 692 0.48 1.56 0.18 200 T_OBFU_PDF_ATTACH 688 0.14 0.03 0.18 ----------------------------------------------------------------------