Email: 294077 Autolearn: 0 AvgScore: 4.16 AvgScanTime: 1.11 sec Spam: 101061 Autolearn: 0 AvgScore: 13.40 AvgScanTime: 1.18 sec Ham: 193016 Autolearn: 0 AvgScore: -0.68 AvgScanTime: 1.07 sec Time Spent Running SA: 90.67 hours Time Spent Processing Spam: 33.12 hours Time Spent Processing Ham: 57.55 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 100614 99.56 99.56 99.56 2 HTML_MESSAGE 97543 86.84 96.52 81.77 3 DKIM_SIGNED 93337 82.24 92.36 76.95 4 XM_DK_Pass 89899 80.38 88.96 75.89 5 DKIM_VALID 88747 79.71 87.82 75.47 6 XM_B_Unicode 86828 75.75 85.92 70.43 7 RELAYCOUNTRY_US 79628 79.06 78.79 79.19 8 DCC_CHECK 74942 52.33 74.16 40.90 9 XM_B_SpammyWords 74692 55.15 73.91 45.33 10 XMListUnsubscribeExists 74516 62.31 73.73 56.33 11 DKIM_VALID_AU 67015 64.93 66.31 64.20 12 XM_DK_Undo_02 51285 22.52 50.75 7.74 13 XM_B_Unicode3 44304 43.76 43.84 43.71 14 XM_B_SpammyWords2 44088 29.05 43.63 21.41 15 BAYES_99 42294 18.20 41.85 5.82 16 LOC_TINY_FONT_1 40590 33.59 40.16 30.15 17 TR_XM_DKIM_Undo 39763 16.02 39.35 3.80 18 HTML_FONT_LOW_CONTRAST 36029 34.00 35.65 33.14 19 BAYES_999 33545 14.36 33.19 4.50 20 FVGT_m_MULTI_ODD 33204 29.45 32.86 27.66 21 BAYES_50 33174 49.03 32.83 57.52 22 RCVD_IN_MSPIKE_H2 32769 30.64 32.42 29.70 23 MIME_HTML_ONLY 31557 24.60 31.23 21.13 24 DKIM_VALID_EF 30887 29.60 30.56 29.10 25 TR_DCC_Bayes_99 30795 12.04 30.47 2.39 26 T_KAM_HTML_FONT_INVALID 29057 22.89 28.75 19.82 27 DCC_CHECK_NEGATIVE 26113 47.65 25.84 59.06 28 TR_XM_DK_Unsub 23161 18.26 22.92 15.82 29 T_TM2_M_HEADER_IN_MSG 20961 21.74 20.74 22.27 30 RELAYCOUNTRY_META 20480 9.74 20.26 4.23 31 XMSubLong 20371 20.86 20.16 21.23 32 XM_Multi_Part_URI 18384 16.18 18.19 15.13 33 TR_XM_SpammyWords2 17998 6.70 17.81 0.88 34 TR_XM_SpammyRelay 17237 7.65 17.06 2.72 35 XM_B_Unsub 16256 10.28 16.09 7.24 36 TR_XM_BayesUnsub 15862 9.27 15.70 5.90 37 TR_MAX_INTL_RELAY 15094 10.26 14.94 7.81 38 RCVD_IN_BL_SPAMCOP_NET 14838 5.69 14.68 0.99 39 UNPARSEABLE_RELAY 14642 12.79 14.49 11.91 40 LOTS_OF_MONEY 13343 8.61 13.20 6.21 41 TR_XM_SPAMCOP 12714 4.68 12.58 0.55 42 RELAYCOUNTRY_CA 12680 5.71 12.55 2.13 43 XM_B_SpammyWords3 12478 8.59 12.35 6.63 44 BOTNET_IPINHOSTNAME 12065 8.12 11.94 6.12 45 TR_XM_SpammyWords4 11985 6.99 11.86 4.43 46 RCVD_IN_MSPIKE_H3 9625 7.24 9.52 6.05 47 RCVD_IN_MSPIKE_WL 9625 7.24 9.52 6.05 48 BAYES_80 9196 6.15 9.10 4.60 49 XMBody_17 8831 3.74 8.74 1.12 50 XM_Evil_Numbers_Gen 8378 8.22 8.29 8.18 51 TR_XM_UnparsRelay 8226 4.18 8.14 2.10 52 BAYES_60 7771 9.95 7.69 11.13 53 BOTNET 7470 3.66 7.39 1.71 54 XM_Body_Dirty_Words 7251 4.94 7.17 3.77 55 FSL_BULK_SIG 7156 5.32 7.08 4.40 56 HTML_IMAGE_RATIO_02 6822 6.07 6.75 5.71 57 XMSubMetaSx_00 6092 5.03 6.03 4.50 58 MPART_ALT_DIFF 5848 4.46 5.79 3.76 59 XM_UncommonTLD01 5744 4.97 5.68 4.60 60 LotsOfNums_01 5686 6.70 5.63 7.27 61 BAYES_95 5567 3.99 5.51 3.20 62 XM_H_GMP 5138 6.84 5.08 7.76 63 UNTRUSTED_Relay 5042 2.74 4.99 1.56 64 TooManyTo_001 5041 6.46 4.99 7.23 65 XMSexyCombo_05 4979 3.37 4.93 2.55 66 T_XMDrugObfuBody_14 4946 2.93 4.89 1.90 67 HTML_IMAGE_RATIO_04 4913 4.91 4.86 4.93 68 DKIM_INVALID 4590 2.53 4.54 1.48 69 XM_SPF_SoftFail 4518 3.31 4.47 2.70 70 TR_XM_SpammyWords5 4435 2.41 4.39 1.37 71 USER_IN_DEF_DKIM_WL 4432 14.25 4.39 19.41 72 T_FILL_THIS_FORM_SHORT 4393 1.90 4.35 0.61 73 RCVD_IN_VALIDITY_SAFE 4262 6.20 4.22 7.24 74 XM_B_Investor 4236 2.39 4.19 1.45 75 XM_B_Phish_Phrases 4106 4.15 4.06 4.20 76 HTML_IMAGE_RATIO_06 4071 2.82 4.03 2.19 77 TR_LOTS_OF_MONEY3 3951 1.85 3.91 0.76 78 MIME_HTML_MOSTLY 3939 3.07 3.90 2.64 79 MIME_HTML_ONLY_MULTI 3912 2.74 3.87 2.15 80 XM_OfRef6 3797 1.99 3.76 1.07 81 XMStrtUSub 3769 4.69 3.73 5.19 82 XM_H_Long_From01 3646 4.93 3.61 5.62 83 RCVD_IN_VALIDITY_CERTIFIED 3633 5.33 3.59 6.24 84 SUBJ_ALL_CAPS 3569 1.80 3.53 0.90 85 XM_B_SpammyTLD 3392 2.85 3.36 2.58 86 TR_XM_PhishingBody 3389 2.23 3.35 1.64 87 TR_XM_BayesRelay 3268 1.11 3.23 0.00 88 TM2_M_URI_OPT_OUT 3219 2.32 3.19 1.87 89 HTML_IMAGE_RATIO_08 3192 2.07 3.16 1.49 90 XM_CamelCaseFrm001 3035 2.57 3.00 2.34 91 T_XMDrugObfuBody_08 3017 2.32 2.99 1.97 92 TR_XM_FormFill 2948 1.02 2.92 0.02 93 XM_URI_RBL 2891 1.12 2.86 0.21 94 TM2_M_VERY_LONG_WORD 2835 2.05 2.81 1.65 95 XMNumbers 2778 3.32 2.75 3.63 96 SpammyFromTLD_01 2584 1.30 2.56 0.64 97 FONT_INVIS_LONG_LINE 2540 0.92 2.51 0.09 98 XM_UB50 2479 1.39 2.45 0.83 99 FROM_EXCESS_BASE64 2465 2.23 2.44 2.12 100 T_TooManySym_01 2440 5.31 2.41 6.83 101 XM_B_SpammyWords4 2294 1.40 2.27 0.95 102 T_XMHurry_00 2284 1.20 2.26 0.64 103 RELAYCOUNTRY_AU 2181 1.07 2.16 0.50 104 HTML_MIME_NO_HTML_TAG 2153 1.74 2.13 1.54 105 XMBrknScrpt_02 2100 1.32 2.08 0.92 106 ALL_TRUSTED 2071 11.73 2.05 16.80 107 TR_XM_PHPForged 2071 0.90 2.05 0.30 108 XMDiploma_00 2053 1.93 2.03 1.88 109 TR_XM_PHPDW 2027 0.87 2.01 0.28 110 XM_B_Unsub2 2000 1.60 1.98 1.40 111 TR_XM_INV_DKIM 1999 0.72 1.98 0.07 112 TR_XM_FormFill2 1984 0.87 1.96 0.30 113 XM_H_PHPOS 1979 0.85 1.96 0.27 114 XM_HighProb1 1939 0.66 1.92 0.00 115 MIME_QP_LONG_LINE 1890 3.08 1.87 3.71 116 TR_XM_NoHeaderRelay 1847 0.67 1.83 0.06 117 XMReplyNow 1845 0.78 1.83 0.24 118 TR_Caps_n_Bayes_99 1811 0.63 1.79 0.02 119 URI_TRY_3LD 1787 1.17 1.77 0.86 120 URI_HEX 1739 1.35 1.72 1.15 121 XM_DK_Undo_01 1690 1.65 1.67 1.64 122 XMBdyGiftCard01 1677 1.07 1.66 0.76 123 HK_RANDOM_REPLYTO 1564 0.60 1.55 0.10 124 T_REMOTE_IMAGE 1543 2.74 1.53 3.38 125 SpammyFromTLD_02 1504 0.67 1.49 0.24 126 HTML_TAG_BALANCE_BODY 1491 0.90 1.48 0.60 127 T_STY_INVIS_DIRECT 1484 0.69 1.47 0.28 128 MAILING_LIST_MULTI 1464 1.90 1.45 2.14 129 AC_BR_BONANZA 1431 0.57 1.42 0.13 130 XMPhish30 1397 0.87 1.38 0.60 131 XMStockSpam_06 1343 1.44 1.33 1.50 132 TR_XM_Base64_M1 1285 0.96 1.27 0.80 133 AC_HTML_NONSENSE_TAGS 1280 0.46 1.27 0.04 134 THIS_AD 1274 0.87 1.26 0.66 135 XM_B_COPY_HTML 1264 1.01 1.25 0.89 136 BAYES_40 1262 3.12 1.25 4.10 137 MPART_ALT_DIFF_COUNT 1248 0.99 1.23 0.86 138 HTTPS_HTTP_MISMATCH 1246 0.87 1.23 0.68 139 TR_Mismatch_TLD_02 1208 0.45 1.20 0.05 140 TooManyTo_002 1157 2.08 1.14 2.58 141 T_XMDrugObfuBody_00 1154 0.78 1.14 0.59 142 KHOP_HELO_FCRDNS 1146 0.76 1.13 0.56 143 BOTNET_NORDNS 1111 0.38 1.10 0.01 144 XM_SendGrid 1106 1.25 1.09 1.32 145 ANY_BOUNCE_MESSAGE 1088 3.97 1.08 5.48 146 BOUNCE_MESSAGE 1088 3.97 1.08 5.48 147 TR_XM_InvalidRelay 1080 0.38 1.07 0.02 148 XM_ProductURIs 1080 0.92 1.07 0.84 149 TooManyTo_003 1060 0.90 1.05 0.82 150 RCVD_IN_VALIDITY_RPBL 1043 0.42 1.03 0.10 151 XM_DIRTYINTL 1040 0.42 1.03 0.11 152 HTML_TEXT_INVISIBLE_STYLE 1026 0.49 1.02 0.21 153 XMSexyCombo_01 1024 1.00 1.01 0.99 154 TooManyTo_004 1014 0.73 1.00 0.59 155 TooManyTo_005 987 0.65 0.98 0.48 156 XM_H_PHPMailer 961 0.85 0.95 0.79 157 DIET_1 955 0.49 0.94 0.26 158 XMSlimDrugH 949 0.50 0.94 0.27 159 RDNS_DYNAMIC 945 0.54 0.94 0.34 160 TR_XM_Base64_L1 915 0.42 0.91 0.16 161 XM_B_Phish66 910 0.52 0.90 0.32 162 T_XMDrugObfuBody_10 878 0.32 0.87 0.03 163 BAYES_20 873 2.15 0.86 2.82 164 SCC_BODY_URI_ONLY 872 3.22 0.86 4.45 165 TVD_RCVD_IP 865 1.95 0.86 2.52 166 TR_Mismatch_TLD_01 861 0.49 0.85 0.30 167 DKIM_ADSP_NXDOMAIN 852 0.52 0.84 0.35 168 RCVD_IN_PSBL 851 1.01 0.84 1.10 169 HOSTED_IMG_MULTI_PUB_01 839 0.30 0.83 0.02 170 XM_H_Long_From02 839 1.09 0.83 1.23 171 T_TooManySym_02 820 2.52 0.81 3.42 172 XM_OfRef7 816 0.42 0.81 0.22 173 XM_UB99 814 0.28 0.81 0.01 174 XMClaimOffer 796 0.49 0.79 0.34 175 DKIM_ADSP_CUSTOM_MED 794 0.87 0.79 0.91 176 XM_RXBody 789 0.39 0.78 0.18 177 TM2_M_OBFU_COMMENT 782 0.53 0.77 0.41 178 TR_Symld_Words 780 1.59 0.77 2.02 179 SUBJ_DOLLARS 773 0.47 0.76 0.31 180 XM_H_Undi_Recip 771 0.33 0.76 0.10 181 TR_XM_DK_SendGrid 770 0.86 0.76 0.92 182 XMGenDplmaNmb 765 0.76 0.76 0.76 183 HTML_FONT_FACE_BAD 748 0.62 0.74 0.56 184 HELO_DYNAMIC_SPLIT_IP 748 0.26 0.74 0.01 185 XM_UB60 724 0.29 0.72 0.06 186 XM_B_REG_HTML 717 0.54 0.71 0.45 187 NML_ADSP_CUSTOM_MED 709 0.66 0.70 0.64 188 XM_B_DNDMA 708 0.64 0.70 0.61 189 PDS_OTHER_BAD_TLD 705 0.32 0.70 0.13 190 XMSubMetaI_00 700 0.76 0.69 0.79 191 RCVD_IN_IADB_LISTED 698 1.85 0.69 2.46 192 TM2_M_A_HREF_HREF 697 0.33 0.69 0.14 193 XMHTMLBadTable_001 693 0.39 0.69 0.23 194 XMHTML_After_End 692 0.42 0.68 0.28 195 XMBody_78 690 0.40 0.68 0.25 196 TR_MetaPhish_Combo_01 683 0.77 0.68 0.82 197 URI_NOVOWEL 673 0.77 0.67 0.83 198 XM_S_SpammyWords 662 0.33 0.66 0.16 199 TR_XM_Spammywords 662 0.33 0.66 0.16 200 RELAYCOUNTRY_IN 654 0.26 0.65 0.05 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 192169 99.56 99.56 99.56 2 HTML_MESSAGE 157834 86.84 96.52 81.77 3 RELAYCOUNTRY_US 152856 79.06 78.79 79.19 4 DKIM_SIGNED 148522 82.24 92.36 76.95 5 XM_DK_Pass 146481 80.38 88.96 75.89 6 DKIM_VALID 145664 79.71 87.82 75.47 7 XM_B_Unicode 135947 75.75 85.92 70.43 8 DKIM_VALID_AU 123925 64.93 66.31 64.20 9 DCC_CHECK_NEGATIVE 114004 47.65 25.84 59.06 10 BAYES_50 111025 49.03 32.83 57.52 11 XMListUnsubscribeExists 108722 62.31 73.73 56.33 12 XM_B_SpammyWords 87493 55.15 73.91 45.33 13 XM_B_Unicode3 84370 43.76 43.84 43.71 14 DCC_CHECK 78950 52.33 74.16 40.90 15 HTML_FONT_LOW_CONTRAST 63967 34.00 35.65 33.14 16 LOC_TINY_FONT_1 58186 33.59 40.16 30.15 17 RCVD_IN_MSPIKE_H2 57327 30.64 32.42 29.70 18 DKIM_VALID_EF 56160 29.60 30.56 29.10 19 FVGT_m_MULTI_ODD 53394 29.45 32.86 27.66 20 T_TM2_M_HEADER_IN_MSG 42983 21.74 20.74 22.27 21 XM_B_SpammyWords2 41329 29.05 43.63 21.41 22 XMSubLong 40983 20.86 20.16 21.23 23 MIME_HTML_ONLY 40786 24.60 31.23 21.13 24 T_KAM_HTML_FONT_INVALID 38257 22.89 28.75 19.82 25 USER_IN_DEF_DKIM_WL 37463 14.25 4.39 19.41 26 ALL_TRUSTED 32423 11.73 2.05 16.80 27 TR_XM_DK_Unsub 30531 18.26 22.92 15.82 28 XM_Multi_Part_URI 29210 16.18 18.19 15.13 29 UNPARSEABLE_RELAY 22984 12.79 14.49 11.91 30 BAYES_60 21489 9.95 7.69 11.13 31 XM_DKIMWhitelistDomains 20444 6.98 0.07 10.59 32 XM_Evil_Numbers_Gen 15782 8.22 8.29 8.18 33 BAYES_00 15411 5.37 0.38 7.98 34 TR_MAX_INTL_RELAY 15070 10.26 14.94 7.81 35 XM_H_GMP 14981 6.84 5.08 7.76 36 XM_DK_Undo_02 14930 22.52 50.75 7.74 37 LotsOfNums_01 14031 6.70 5.63 7.27 38 RCVD_IN_VALIDITY_SAFE 13980 6.20 4.22 7.24 39 XM_B_Unsub 13974 10.28 16.09 7.24 40 TooManyTo_001 13957 6.46 4.99 7.23 41 T_TooManySym_01 13187 5.31 2.41 6.83 42 TR_XM_DK_Bayes 13187 4.57 0.26 6.83 43 TR_XM_DK_Bayes1 13102 4.54 0.26 6.79 44 XM_B_SpammyWords3 12788 8.59 12.35 6.63 45 RCVD_IN_VALIDITY_CERTIFIED 12050 5.33 3.59 6.24 46 LOTS_OF_MONEY 11983 8.61 13.20 6.21 47 BOTNET_IPINHOSTNAME 11813 8.12 11.94 6.12 48 TR_XM_DK_Bayes2 11773 4.07 0.20 6.10 49 RCVD_IN_MSPIKE_WL 11679 7.24 9.52 6.05 50 RCVD_IN_MSPIKE_H3 11679 7.24 9.52 6.05 51 TR_XM_BayesUnsub 11386 9.27 15.70 5.90 52 BAYES_99 11240 18.20 41.85 5.82 53 HTML_IMAGE_RATIO_02 11018 6.07 6.75 5.71 54 XM_H_Long_From01 10848 4.93 3.61 5.62 55 BOUNCE_MESSAGE 10580 3.97 1.08 5.48 56 ANY_BOUNCE_MESSAGE 10580 3.97 1.08 5.48 57 IN_ZIMBRA_NJ_WHITELIST 10399 3.55 0.05 5.39 58 XMStrtUSub 10017 4.69 3.73 5.19 59 HTML_IMAGE_RATIO_04 9521 4.91 4.86 4.93 60 XM_UncommonTLD01 8882 4.97 5.68 4.60 61 BAYES_80 8878 6.15 9.10 4.60 62 BAYES_999 8693 14.36 33.19 4.50 63 XMSubMetaSx_00 8690 5.03 6.03 4.50 64 SCC_BODY_URI_ONLY 8595 3.22 0.86 4.45 65 TR_XM_SpammyWords4 8558 6.99 11.86 4.43 66 FSL_BULK_SIG 8494 5.32 7.08 4.40 67 RELAYCOUNTRY_META 8163 9.74 20.26 4.23 68 XM_B_Phish_Phrases 8099 4.15 4.06 4.20 69 BAYES_40 7913 3.12 1.25 4.10 70 TR_XM_DKIM_Undo 7343 16.02 39.35 3.80 71 XM_Body_Dirty_Words 7272 4.94 7.17 3.77 72 MPART_ALT_DIFF 7266 4.46 5.79 3.76 73 MIME_QP_LONG_LINE 7163 3.08 1.87 3.71 74 XMNumbers 6998 3.32 2.75 3.63 75 INVALID_MSGID 6990 2.43 0.15 3.62 76 TO_MALFORMED 6861 2.34 0.02 3.55 77 T_TooManySym_02 6605 2.52 0.81 3.42 78 MSGID_NOFQDN1 6599 2.26 0.04 3.42 79 T_REMOTE_IMAGE 6516 2.74 1.53 3.38 80 BAYES_95 6177 3.99 5.51 3.20 81 BAYES_20 5452 2.15 0.86 2.82 82 BAYES_05 5430 2.03 0.52 2.81 83 TR_XM_SpammyRelay 5254 7.65 17.06 2.72 84 XM_SPF_SoftFail 5209 3.31 4.47 2.70 85 MIME_HTML_MOSTLY 5099 3.07 3.90 2.64 86 XM_B_SpammyTLD 4978 2.85 3.36 2.58 87 TooManyTo_002 4971 2.08 1.14 2.58 88 XMSexyCombo_05 4921 3.37 4.93 2.55 89 TVD_RCVD_IP 4858 1.95 0.86 2.52 90 RCVD_IN_IADB_LISTED 4757 1.85 0.69 2.46 91 TR_DCC_Bayes_99 4611 12.04 30.47 2.39 92 XM_PDF 4583 1.66 0.28 2.37 93 XM_CamelCaseFrm001 4525 2.57 3.00 2.34 94 RCVD_IN_IADB_SPF 4310 1.67 0.59 2.23 95 HTML_IMAGE_RATIO_06 4221 2.82 4.03 2.19 96 MIME_HTML_ONLY_MULTI 4152 2.74 3.87 2.15 97 MAILING_LIST_MULTI 4135 1.90 1.45 2.14 98 RELAYCOUNTRY_CA 4113 5.71 12.55 2.13 99 FROM_EXCESS_BASE64 4096 2.23 2.44 2.12 100 XMBSHREFv2 4091 1.46 0.21 2.12 101 TR_XM_UnparsRelay 4062 4.18 8.14 2.10 102 RCVD_IN_IADB_SENDERID 3950 1.53 0.55 2.05 103 TR_Symld_Words 3903 1.59 0.77 2.02 104 RCVD_IN_IADB_DK 3883 1.51 0.56 2.01 105 T_XMDrugObfuBody_08 3794 2.32 2.99 1.97 106 T_XMDrugObfuBody_14 3659 2.93 4.89 1.90 107 XMDiploma_00 3630 1.93 2.03 1.88 108 TM2_M_URI_OPT_OUT 3610 2.32 3.19 1.87 109 IN_HORDE_ADDRESS_BOOK 3507 1.21 0.05 1.82 110 BOTNET 3292 3.66 7.39 1.71 111 TVD_SPACE_RATIO 3232 1.16 0.16 1.67 112 TM2_M_VERY_LONG_WORD 3192 2.05 2.81 1.65 113 XM_DK_Undo_01 3169 1.65 1.67 1.64 114 TR_XM_PhishingBody 3162 2.23 3.35 1.64 115 UNTRUSTED_Relay 3020 2.74 4.99 1.56 116 HTML_MIME_NO_HTML_TAG 2966 1.74 2.13 1.54 117 RCVD_IN_IADB_VOUCHED 2959 1.13 0.37 1.53 118 XM_B_FormFill 2921 1.00 0.02 1.51 119 XMStockSpam_06 2887 1.44 1.33 1.50 120 HTML_IMAGE_RATIO_08 2884 2.07 3.16 1.49 121 DKIM_INVALID 2858 2.53 4.54 1.48 122 XM_B_Investor 2807 2.39 4.19 1.45 123 XM_B_Unsub2 2693 1.60 1.98 1.40 124 TR_XM_SpammyWords5 2649 2.41 4.39 1.37 125 XMBody_95 2620 0.95 0.18 1.36 126 XM_SendGrid 2556 1.25 1.09 1.32 127 XMGappySubj_01 2480 0.98 0.39 1.28 128 XM_H_Long_From02 2375 1.09 0.83 1.23 129 T_TooManySym_03 2230 0.88 0.35 1.16 130 URI_HEX 2219 1.35 1.72 1.15 131 XM_GoogleGroups 2216 0.92 0.48 1.15 132 XMSubMetaSxObfu_03 2186 0.92 0.52 1.13 133 XMBody_17 2163 3.74 8.74 1.12 134 RCVD_IN_PSBL 2126 1.01 0.84 1.10 135 XM_OfRef6 2056 1.99 3.76 1.07 136 RCVD_IN_IADB_OPTIN 2024 0.77 0.25 1.05 137 XMGappySubj_02 1941 0.68 0.07 1.01 138 XMSexyCombo_01 1920 1.00 1.01 0.99 139 RCVD_IN_BL_SPAMCOP_NET 1908 5.69 14.68 0.99 140 XM_B_SpammyWords4 1826 1.40 2.27 0.95 141 XMSubMetaSx_01 1811 0.69 0.22 0.94 142 USER_IN_WELCOMELIST 1785 0.61 0.00 0.92 143 USER_IN_WHITELIST 1785 0.61 0.00 0.92 144 XMBrknScrpt_02 1782 1.32 2.08 0.92 145 TR_XM_DK_SendGrid 1772 0.86 0.76 0.92 146 DKIM_ADSP_CUSTOM_MED 1753 0.87 0.79 0.91 147 SUBJ_ALL_CAPS 1729 1.80 3.53 0.90 148 XM_B_COPY_HTML 1717 1.01 1.25 0.89 149 TR_XM_SpammyWords2 1700 6.70 17.81 0.88 150 XMSexyCombo_04 1698 0.74 0.48 0.88 151 XMSexyCombo_02 1674 0.65 0.22 0.87 152 MPART_ALT_DIFF_COUNT 1667 0.99 1.23 0.86 153 URI_TRY_3LD 1657 1.17 1.77 0.86 154 XM_ProductURIs 1614 0.92 1.07 0.84 155 URI_NOVOWEL 1605 0.77 0.67 0.83 156 XM_UB50 1594 1.39 2.45 0.83 157 TR_MetaPhish_Combo_01 1588 0.77 0.68 0.82 158 TooManyTo_003 1575 0.90 1.05 0.82 159 TR_XM_Base64_M1 1552 0.96 1.27 0.80 160 XM_H_PHPMailer 1532 0.85 0.95 0.79 161 XMSubMetaI_00 1530 0.76 0.69 0.79 162 TR_LOTS_OF_MONEY3 1475 1.85 3.91 0.76 163 XMBdyGiftCard01 1468 1.07 1.66 0.76 164 XMGenDplmaNmb 1458 0.76 0.76 0.76 165 HTTPS_HTTP_MISMATCH 1311 0.87 1.23 0.68 166 FILL_THIS_FORM 1283 0.54 0.31 0.66 167 THIS_AD 1271 0.87 1.26 0.66 168 T_XMHurry_00 1242 1.20 2.26 0.64 169 SpammyFromTLD_01 1239 1.30 2.56 0.64 170 NML_ADSP_CUSTOM_MED 1228 0.66 0.70 0.64 171 XMSubMetaSxObfu_02 1194 0.55 0.42 0.62 172 T_FILL_THIS_FORM_SHORT 1181 1.90 4.35 0.61 173 XM_B_DNDMA 1173 0.64 0.70 0.61 174 HTML_TAG_BALANCE_BODY 1156 0.90 1.48 0.60 175 XMPhish30 1156 0.87 1.38 0.60 176 TooManyTo_004 1143 0.73 1.00 0.59 177 XM_Lotto 1133 0.50 0.33 0.59 178 T_XMDrugObfuBody_00 1130 0.78 1.14 0.59 179 PLING_QUERY 1127 0.59 0.61 0.58 180 SHOPIFY_IMG_NOT_RCVD_SFY 1113 0.59 0.61 0.58 181 KHOP_HELO_FCRDNS 1088 0.76 1.13 0.56 182 HTML_FONT_FACE_BAD 1073 0.62 0.74 0.56 183 TR_XM_SPAMCOP 1061 4.68 12.58 0.55 184 XMNoVowels 1035 0.51 0.46 0.54 185 FORGED_GMAIL_RCVD 1002 0.55 0.61 0.52 186 RELAYCOUNTRY_AU 964 1.07 2.16 0.50 187 TooManyTo_005 934 0.65 0.98 0.48 188 XMLngstWrd_00 889 0.38 0.24 0.46 189 T_OBFU_PDF_ATTACH 888 0.32 0.04 0.46 190 XM_B_REG_HTML 869 0.54 0.71 0.45 191 XMPhish14 861 0.49 0.56 0.45 192 HELO_NODOT 806 0.37 0.28 0.42 193 HELO_NO_DOMAIN 803 0.37 0.28 0.42 194 FILL_THIS_FORM_LONG 800 0.35 0.23 0.41 195 T_TooManySym_04 797 0.34 0.19 0.41 196 TM2_M_OBFU_COMMENT 785 0.53 0.77 0.41 197 XM_S_SubURI 766 0.29 0.10 0.40 198 XMLngstWrd_01 762 0.33 0.20 0.39 199 CTE_8BIT_MISMATCH 738 0.27 0.05 0.38 200 XMCapTrack 693 0.30 0.19 0.36 ----------------------------------------------------------------------