Email: 292210 Autolearn: 0 AvgScore: 4.50 AvgScanTime: 1.12 sec Spam: 103164 Autolearn: 0 AvgScore: 13.83 AvgScanTime: 1.15 sec Ham: 189046 Autolearn: 0 AvgScore: -0.60 AvgScanTime: 1.11 sec Time Spent Running SA: 91.13 hours Time Spent Processing Spam: 33.02 hours Time Spent Processing Ham: 58.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 102989 99.76 99.83 99.72 2 HTML_MESSAGE 99285 86.92 96.24 81.83 3 DKIM_SIGNED 95338 83.32 92.41 78.36 4 XM_DK_Pass 91470 81.37 88.66 77.38 5 DKIM_VALID 90415 80.72 87.64 76.94 6 XM_B_Unicode 89260 77.19 86.52 72.10 7 RELAYCOUNTRY_US 79750 78.60 77.30 79.30 8 DCC_CHECK 77374 54.32 75.00 43.03 9 XMListUnsubscribeExists 76880 64.03 74.52 58.30 10 XM_B_SpammyWords 76720 56.14 74.37 46.20 11 DKIM_VALID_AU 69753 66.90 67.61 66.51 12 XM_DK_Undo_02 51897 22.46 50.31 7.26 13 XM_B_Unicode3 47480 45.88 46.02 45.80 14 XM_B_SpammyWords2 46526 30.92 45.10 23.18 15 BAYES_99 43507 18.87 42.17 6.15 16 TR_XM_DKIM_Undo 40656 16.04 39.41 3.29 17 LOC_TINY_FONT_1 39063 33.90 37.86 31.73 18 HTML_FONT_LOW_CONTRAST 36297 34.69 35.18 34.42 19 BAYES_999 34907 15.07 33.84 4.84 20 RCVD_IN_MSPIKE_H2 34322 31.54 33.27 30.60 21 BAYES_50 32999 48.80 31.99 57.98 22 FVGT_m_MULTI_ODD 32790 29.57 31.78 28.36 23 DKIM_VALID_EF 32345 29.82 31.35 28.99 24 TR_DCC_Bayes_99 32149 12.80 31.16 2.78 25 MIME_HTML_ONLY 30112 23.30 29.19 20.09 26 T_KAM_HTML_FONT_INVALID 27067 22.77 26.24 20.87 27 DCC_CHECK_NEGATIVE 25775 45.66 24.98 56.95 28 TR_XM_DK_Unsub 24118 18.76 23.38 16.24 29 RELAYCOUNTRY_META 23355 10.58 22.64 4.00 30 T_TM2_M_HEADER_IN_MSG 20574 20.93 19.94 21.47 31 TR_XM_SpammyWords2 19245 7.21 18.65 0.97 32 XM_Multi_Part_URI 18990 17.19 18.41 16.53 33 TR_XM_SpammyRelay 18983 8.19 18.40 2.62 34 XMSubLong 18360 20.85 17.80 22.52 35 LOTS_OF_MONEY 17223 10.29 16.69 6.80 36 TR_MAX_INTL_RELAY 16252 10.65 15.75 7.87 37 TR_XM_SpammyWords4 16245 9.02 15.75 5.34 38 XM_B_SpammyWords3 15912 10.17 15.42 7.30 39 XM_B_Unsub 15225 10.33 14.76 7.91 40 TR_XM_BayesUnsub 14793 9.37 14.34 6.66 41 RELAYCOUNTRY_CA 14012 6.05 13.58 1.94 42 RCVD_IN_BL_SPAMCOP_NET 13796 5.16 13.37 0.68 43 BOTNET_IPINHOSTNAME 13697 8.24 13.28 5.49 44 UNPARSEABLE_RELAY 13448 11.95 13.04 11.36 45 TR_XM_SPAMCOP 11494 4.20 11.14 0.41 46 RCVD_IN_MSPIKE_WL 10177 7.72 9.86 6.55 47 RCVD_IN_MSPIKE_H3 10177 7.72 9.86 6.55 48 BAYES_80 9853 6.47 9.55 4.78 49 XMBody_17 9310 3.90 9.02 1.10 50 BAYES_60 8482 10.47 8.22 11.69 51 BOTNET 8307 3.67 8.05 1.28 52 FSL_BULK_SIG 7578 5.16 7.35 3.96 53 TR_XM_UnparsRelay 7504 3.69 7.27 1.74 54 XM_Body_Dirty_Words 7173 4.85 6.95 3.70 55 TR_LOTS_OF_MONEY3 6778 2.89 6.57 0.88 56 XMSubMetaSx_00 6646 5.43 6.44 4.87 57 UNTRUSTED_Relay 6420 3.32 6.22 1.73 58 HTML_IMAGE_RATIO_02 6248 6.00 6.06 5.96 59 XM_Evil_Numbers_Gen 6215 8.40 6.02 9.70 60 MPART_ALT_DIFF 6164 4.59 5.97 3.83 61 XM_UncommonTLD01 6065 5.21 5.88 4.85 62 BAYES_95 5739 3.96 5.56 3.08 63 TooManyTo_001 5407 5.94 5.24 6.32 64 XM_H_GMP 5404 7.15 5.24 8.20 65 XM_SPF_SoftFail 5245 3.68 5.08 2.91 66 LotsOfNums_01 5019 6.26 4.87 7.02 67 XMStrtUSub 4951 5.65 4.80 6.12 68 XMSexyCombo_05 4941 3.31 4.79 2.50 69 DKIM_INVALID 4923 2.60 4.77 1.42 70 HTML_IMAGE_RATIO_04 4747 5.87 4.60 6.56 71 XM_B_Investor 4518 2.60 4.38 1.62 72 XM_B_Phish_Phrases 4482 4.09 4.34 3.95 73 XM_OfRef6 4449 2.31 4.31 1.22 74 XM_H_Long_From01 4428 4.92 4.29 5.26 75 MIME_HTML_MOSTLY 4385 3.36 4.25 2.88 76 HTML_IMAGE_RATIO_06 4278 3.34 4.15 2.89 77 T_XMDrugObfuBody_14 4242 2.59 4.11 1.76 78 RCVD_IN_VALIDITY_SAFE 4238 7.19 4.11 8.88 79 TR_XM_PhishingBody 3885 2.58 3.77 1.93 80 USER_IN_DEF_DKIM_WL 3800 14.83 3.68 20.91 81 TR_XM_SpammyWords5 3782 2.15 3.67 1.32 82 TM2_M_URI_OPT_OUT 3737 2.51 3.62 1.90 83 XM_B_SpammyTLD 3601 2.84 3.49 2.49 84 RCVD_IN_VALIDITY_CERTIFIED 3516 6.29 3.41 7.86 85 T_FILL_THIS_FORM_SHORT 3476 1.49 3.37 0.47 86 HTML_IMAGE_RATIO_08 3436 2.68 3.33 2.32 87 MIME_HTML_ONLY_MULTI 3432 2.35 3.33 1.82 88 TR_XM_BayesRelay 3424 1.17 3.32 0.00 89 T_XMDrugObfuBody_08 3301 2.20 3.20 1.66 90 TM2_M_VERY_LONG_WORD 3169 1.90 3.07 1.26 91 XM_UB50 3107 1.68 3.01 0.96 92 XM_CamelCaseFrm001 3023 2.73 2.93 2.62 93 XMDiploma_00 2960 1.98 2.87 1.49 94 XM_URI_RBL 2902 1.09 2.81 0.15 95 XMNumbers 2840 3.35 2.75 3.67 96 XM_B_SpammyWords4 2812 1.61 2.73 1.00 97 T_TooManySym_01 2712 5.69 2.63 7.36 98 XMBrknScrpt_02 2675 1.54 2.59 0.97 99 SUBJ_ALL_CAPS 2636 1.56 2.56 1.01 100 RELAYCOUNTRY_AU 2384 1.09 2.31 0.42 101 DIET_1 2312 1.19 2.24 0.61 102 TR_XM_NoHeaderRelay 2185 0.82 2.12 0.11 103 TR_XM_PHPForged 2182 0.89 2.12 0.22 104 AC_BR_BONANZA 2179 0.87 2.11 0.19 105 RCVD_IN_VALIDITY_RPBL 2154 0.81 2.09 0.12 106 SpammyFromTLD_01 2075 1.07 2.01 0.56 107 TR_XM_INV_DKIM 2053 0.75 1.99 0.07 108 T_XMHurry_00 1996 1.15 1.93 0.72 109 TR_XM_PHPDW 1959 0.79 1.90 0.18 110 FONT_INVIS_LONG_LINE 1957 0.69 1.90 0.04 111 TR_XM_FormFill 1936 0.67 1.88 0.02 112 TR_XM_FormFill2 1917 0.78 1.86 0.19 113 URI_TRY_3LD 1917 1.22 1.86 0.87 114 MIME_QP_LONG_LINE 1915 2.59 1.86 2.98 115 XM_H_PHPOS 1911 0.76 1.85 0.17 116 HTML_MIME_NO_HTML_TAG 1897 1.50 1.84 1.32 117 T_REMOTE_IMAGE 1787 2.46 1.73 2.86 118 HTML_TAG_BALANCE_BODY 1765 1.06 1.71 0.71 119 XM_B_Unsub2 1718 1.23 1.67 1.00 120 FROM_EXCESS_BASE64 1702 2.08 1.65 2.31 121 HOSTED_IMG_MULTI_PUB_01 1645 0.58 1.59 0.03 122 XM_HighProb1 1617 0.56 1.57 0.00 123 BOTNET_NORDNS 1608 0.64 1.56 0.13 124 TR_XM_InvalidRelay 1606 0.57 1.56 0.03 125 SpammyFromTLD_02 1564 0.76 1.52 0.34 126 XM_DK_Undo_01 1553 1.60 1.51 1.65 127 XMStockSpam_06 1504 1.71 1.46 1.85 128 XM_DIRTYINTL 1469 0.61 1.42 0.17 129 MAILING_LIST_MULTI 1457 1.88 1.41 2.14 130 XMSlimDrugH 1451 0.68 1.41 0.28 131 HK_RANDOM_REPLYTO 1446 0.55 1.40 0.09 132 ALL_TRUSTED 1443 11.33 1.40 16.75 133 KHOP_HELO_FCRDNS 1443 0.82 1.40 0.51 134 XMPhish30 1416 0.98 1.37 0.76 135 RCVD_IN_PSBL 1410 1.06 1.37 0.89 136 URI_HEX 1384 1.26 1.34 1.22 137 RELAYCOUNTRY_IN 1312 0.47 1.27 0.03 138 T_STY_INVIS_DIRECT 1301 0.73 1.26 0.45 139 XMReplyNow 1299 0.65 1.26 0.31 140 XM_UB99 1287 0.44 1.25 0.00 141 T_XMDrugObfuBody_00 1234 0.93 1.20 0.78 142 AC_HTML_NONSENSE_TAGS 1234 0.44 1.20 0.02 143 TR_Mismatch_TLD_02 1230 0.47 1.19 0.08 144 HTTPS_HTTP_MISMATCH 1227 0.73 1.19 0.48 145 XMSexyCombo_01 1212 1.06 1.17 1.00 146 LongTLD 1183 0.53 1.15 0.20 147 SUBJ_DOLLARS 1156 0.61 1.12 0.33 148 THIS_AD 1134 0.62 1.10 0.36 149 XMBdyGiftCard01 1131 1.39 1.10 1.55 150 HTML_FONT_FACE_BAD 1108 0.75 1.07 0.58 151 XM_B_COPY_HTML 1089 1.25 1.06 1.36 152 XM_SendGrid 1087 1.18 1.05 1.25 153 BAYES_40 1086 2.84 1.05 3.81 154 TooManyTo_002 1076 1.36 1.04 1.53 155 TR_Caps_n_Bayes_99 1075 0.38 1.04 0.01 156 URIBL_DBL_SPAM 1072 0.37 1.04 0.01 157 TooManyTo_003 1035 0.97 1.00 0.96 158 DKIM_ADSP_NXDOMAIN 1021 0.61 0.99 0.40 159 TooManyTo_004 1008 0.85 0.98 0.78 160 RDNS_DYNAMIC 1004 0.59 0.97 0.38 161 URI_NOVOWEL 998 0.86 0.97 0.81 162 TooManyTo_005 984 0.77 0.95 0.67 163 MPART_ALT_DIFF_COUNT 982 0.87 0.95 0.83 164 DKIM_ADSP_CUSTOM_MED 980 1.01 0.95 1.05 165 XM_UB999 976 0.33 0.95 0.00 166 XM_H_PHPMailer 974 0.88 0.94 0.85 167 ANY_BOUNCE_MESSAGE 966 3.84 0.94 5.42 168 BOUNCE_MESSAGE 966 3.84 0.94 5.42 169 XMPhish14 959 0.67 0.93 0.53 170 XMSubMetaI_00 940 0.71 0.91 0.60 171 T_MONEY_PERCENT 938 0.42 0.91 0.16 172 TR_LOTS_OF_MONEY2 938 0.42 0.91 0.16 173 XMSubMetaSxObfu_03 934 0.56 0.91 0.37 174 XM_B_Phish66 899 0.47 0.87 0.25 175 NML_ADSP_CUSTOM_MED 892 0.78 0.86 0.74 176 XM_H_Long_From02 890 0.97 0.86 1.03 177 TVD_RCVD_IP 890 1.98 0.86 2.60 178 TR_Mismatch_TLD_01 885 0.49 0.86 0.29 179 XM_UB60 878 0.34 0.85 0.07 180 TR_MetaPhish_Combo_01 864 0.69 0.84 0.62 181 XM_H_Undi_Recip 862 0.39 0.84 0.15 182 TR_XM_DK_SendGrid 837 0.92 0.81 0.97 183 FORGED_GMAIL_RCVD 803 0.69 0.78 0.64 184 HELO_DYNAMIC_SPLIT_IP 799 0.28 0.77 0.01 185 PLING_QUERY 795 0.56 0.77 0.44 186 XMWghtMeta_00 789 0.29 0.76 0.04 187 T_XMDrugObfuBody_10 782 0.29 0.76 0.04 188 NO_DNS_FOR_FROM 780 0.48 0.76 0.33 189 XMGenDplmaNmb 770 0.64 0.75 0.59 190 BAYES_20 770 1.98 0.75 2.66 191 XMBody_78 760 0.37 0.74 0.18 192 TR_XM_MaxWHORU 755 0.44 0.73 0.27 193 XMHTML_After_End 748 0.44 0.73 0.28 194 XMNoVowels 747 0.64 0.72 0.59 195 XMGppyBdWords 742 0.31 0.72 0.08 196 TM2_M_OBFU_COMMENT 730 0.43 0.71 0.28 197 TR_XM_Undi_Recip19 719 0.29 0.70 0.08 198 TR_Symld_Words 711 0.93 0.69 1.07 199 TM2_M_A_HREF_HREF 708 0.34 0.69 0.15 200 XMHTMLBadTable_001 696 0.43 0.67 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 188511 99.76 99.83 99.72 2 HTML_MESSAGE 154690 86.92 96.24 81.83 3 RELAYCOUNTRY_US 149918 78.60 77.30 79.30 4 DKIM_SIGNED 148135 83.32 92.41 78.36 5 XM_DK_Pass 146290 81.37 88.66 77.38 6 DKIM_VALID 145454 80.72 87.64 76.94 7 XM_B_Unicode 136307 77.19 86.52 72.10 8 DKIM_VALID_AU 125730 66.90 67.61 66.51 9 XMListUnsubscribeExists 110208 64.03 74.52 58.30 10 BAYES_50 109606 48.80 31.99 57.98 11 DCC_CHECK_NEGATIVE 107656 45.66 24.98 56.95 12 XM_B_SpammyWords 87340 56.14 74.37 46.20 13 XM_B_Unicode3 86579 45.88 46.02 45.80 14 DCC_CHECK 81354 54.32 75.00 43.03 15 HTML_FONT_LOW_CONTRAST 65072 34.69 35.18 34.42 16 LOC_TINY_FONT_1 59987 33.90 37.86 31.73 17 RCVD_IN_MSPIKE_H2 57855 31.54 33.27 30.60 18 DKIM_VALID_EF 54801 29.82 31.35 28.99 19 FVGT_m_MULTI_ODD 53608 29.57 31.78 28.36 20 XM_B_SpammyWords2 43824 30.92 45.10 23.18 21 XMSubLong 42572 20.85 17.80 22.52 22 T_TM2_M_HEADER_IN_MSG 40581 20.93 19.94 21.47 23 USER_IN_DEF_DKIM_WL 39537 14.83 3.68 20.91 24 T_KAM_HTML_FONT_INVALID 39458 22.77 26.24 20.87 25 MIME_HTML_ONLY 37972 23.30 29.19 20.09 26 ALL_TRUSTED 31659 11.33 1.40 16.75 27 XM_Multi_Part_URI 31241 17.19 18.41 16.53 28 TR_XM_DK_Unsub 30710 18.76 23.38 16.24 29 BAYES_60 22102 10.47 8.22 11.69 30 XM_DKIMWhitelistDomains 21978 7.54 0.06 11.63 31 UNPARSEABLE_RELAY 21467 11.95 13.04 11.36 32 XM_Evil_Numbers_Gen 18329 8.40 6.02 9.70 33 RCVD_IN_VALIDITY_SAFE 16783 7.19 4.11 8.88 34 XM_H_GMP 15496 7.15 5.24 8.20 35 XM_B_Unsub 14957 10.33 14.76 7.91 36 TR_MAX_INTL_RELAY 14875 10.65 15.75 7.87 37 RCVD_IN_VALIDITY_CERTIFIED 14866 6.29 3.41 7.86 38 T_TooManySym_01 13906 5.69 2.63 7.36 39 XM_B_SpammyWords3 13803 10.17 15.42 7.30 40 XM_DK_Undo_02 13721 22.46 50.31 7.26 41 BAYES_00 13351 4.69 0.34 7.06 42 LotsOfNums_01 13274 6.26 4.87 7.02 43 LOTS_OF_MONEY 12860 10.29 16.69 6.80 44 TR_XM_BayesUnsub 12589 9.37 14.34 6.66 45 HTML_IMAGE_RATIO_04 12393 5.87 4.60 6.56 46 RCVD_IN_MSPIKE_H3 12376 7.72 9.86 6.55 47 RCVD_IN_MSPIKE_WL 12376 7.72 9.86 6.55 48 TooManyTo_001 11939 5.94 5.24 6.32 49 BAYES_99 11624 18.87 42.17 6.15 50 XMStrtUSub 11571 5.65 4.80 6.12 51 TR_XM_DK_Bayes 11421 4.00 0.25 6.04 52 TR_XM_DK_Bayes1 11307 3.96 0.25 5.98 53 HTML_IMAGE_RATIO_02 11275 6.00 6.06 5.96 54 BOTNET_IPINHOSTNAME 10374 8.24 13.28 5.49 55 BOUNCE_MESSAGE 10243 3.84 0.94 5.42 56 ANY_BOUNCE_MESSAGE 10243 3.84 0.94 5.42 57 TR_XM_SpammyWords4 10098 9.02 15.75 5.34 58 TR_XM_DK_Bayes2 10072 3.52 0.21 5.33 59 IN_ZIMBRA_NJ_WHITELIST 9947 3.43 0.06 5.26 60 XM_H_Long_From01 9943 4.92 4.29 5.26 61 XMSubMetaSx_00 9209 5.43 6.44 4.87 62 XM_UncommonTLD01 9160 5.21 5.88 4.85 63 BAYES_999 9142 15.07 33.84 4.84 64 BAYES_80 9042 6.47 9.55 4.78 65 SCC_BODY_URI_ONLY 8291 3.05 0.61 4.39 66 RELAYCOUNTRY_META 7565 10.58 22.64 4.00 67 FSL_BULK_SIG 7491 5.16 7.35 3.96 68 XM_B_Phish_Phrases 7468 4.09 4.34 3.95 69 T_TooManySym_02 7295 2.71 0.62 3.86 70 MPART_ALT_DIFF 7247 4.59 5.97 3.83 71 BAYES_40 7203 2.84 1.05 3.81 72 XM_Body_Dirty_Words 7003 4.85 6.95 3.70 73 INVALID_MSGID 6990 2.46 0.20 3.70 74 XMNumbers 6938 3.35 2.75 3.67 75 TO_MALFORMED 6652 2.29 0.03 3.52 76 TR_XM_DKIM_Undo 6220 16.04 39.41 3.29 77 BAYES_95 5831 3.96 5.56 3.08 78 MIME_QP_LONG_LINE 5641 2.59 1.86 2.98 79 XM_SPF_SoftFail 5497 3.68 5.08 2.91 80 HTML_IMAGE_RATIO_06 5470 3.34 4.15 2.89 81 MIME_HTML_MOSTLY 5436 3.36 4.25 2.88 82 T_REMOTE_IMAGE 5404 2.46 1.73 2.86 83 BAYES_05 5258 1.93 0.36 2.78 84 TR_DCC_Bayes_99 5251 12.80 31.16 2.78 85 BAYES_20 5029 1.98 0.75 2.66 86 TR_XM_SpammyRelay 4960 8.19 18.40 2.62 87 XM_CamelCaseFrm001 4947 2.73 2.93 2.62 88 TVD_RCVD_IP 4910 1.98 0.86 2.60 89 XMSexyCombo_05 4729 3.31 4.79 2.50 90 XM_B_SpammyTLD 4702 2.84 3.49 2.49 91 RCVD_IN_IADB_LISTED 4678 1.83 0.65 2.47 92 HTML_IMAGE_RATIO_08 4381 2.68 3.33 2.32 93 FROM_EXCESS_BASE64 4374 2.08 1.65 2.31 94 XMBSHREFv2 4139 1.49 0.20 2.19 95 RCVD_IN_IADB_SPF 4114 1.61 0.57 2.18 96 MAILING_LIST_MULTI 4040 1.88 1.41 2.14 97 XM_PDF 3737 1.38 0.29 1.98 98 RCVD_IN_IADB_SENDERID 3684 1.45 0.53 1.95 99 RELAYCOUNTRY_CA 3664 6.05 13.58 1.94 100 TR_XM_PhishingBody 3646 2.58 3.77 1.93 101 TM2_M_URI_OPT_OUT 3590 2.51 3.62 1.90 102 RCVD_IN_IADB_DK 3576 1.41 0.54 1.89 103 XMStockSpam_06 3502 1.71 1.46 1.85 104 MIME_HTML_ONLY_MULTI 3442 2.35 3.33 1.82 105 IN_HORDE_ADDRESS_BOOK 3364 1.17 0.06 1.78 106 T_XMDrugObfuBody_14 3323 2.59 4.11 1.76 107 TR_XM_UnparsRelay 3288 3.69 7.27 1.74 108 UNTRUSTED_Relay 3278 3.32 6.22 1.73 109 TVD_SPACE_RATIO 3263 1.14 0.07 1.73 110 RCVD_IN_IADB_VOUCHED 3228 1.22 0.34 1.71 111 T_XMDrugObfuBody_08 3129 2.20 3.20 1.66 112 XM_DK_Undo_01 3117 1.60 1.51 1.65 113 XM_B_Investor 3066 2.60 4.38 1.62 114 XMBdyGiftCard01 2924 1.39 1.10 1.55 115 TooManyTo_002 2899 1.36 1.04 1.53 116 XMDiploma_00 2812 1.98 2.87 1.49 117 DKIM_INVALID 2681 2.60 4.77 1.42 118 XM_B_COPY_HTML 2562 1.25 1.06 1.36 119 TR_XM_SpammyWords5 2504 2.15 3.67 1.32 120 XMGappySubj_01 2493 0.90 0.14 1.32 121 HTML_MIME_NO_HTML_TAG 2488 1.50 1.84 1.32 122 BOTNET 2428 3.67 8.05 1.28 123 TM2_M_VERY_LONG_WORD 2373 1.90 3.07 1.26 124 RCVD_IN_IADB_OPTIN 2370 0.90 0.26 1.25 125 XM_GoogleGroups 2366 1.00 0.53 1.25 126 XM_SendGrid 2361 1.18 1.05 1.25 127 T_TooManySym_03 2309 0.89 0.29 1.22 128 URI_HEX 2305 1.26 1.34 1.22 129 XM_OfRef6 2301 2.31 4.31 1.22 130 XMGappySubj_02 2098 0.75 0.10 1.11 131 XMBody_17 2078 3.90 9.02 1.10 132 TR_Symld_Words 2018 0.93 0.69 1.07 133 DKIM_ADSP_CUSTOM_MED 1977 1.01 0.95 1.05 134 XM_H_Long_From02 1953 0.97 0.86 1.03 135 SUBJ_ALL_CAPS 1916 1.56 2.56 1.01 136 XMSexyCombo_01 1893 1.06 1.17 1.00 137 XM_B_SpammyWords4 1889 1.61 2.73 1.00 138 XM_B_Unsub2 1882 1.23 1.67 1.00 139 TR_XM_DK_SendGrid 1841 0.92 0.81 0.97 140 XMBrknScrpt_02 1836 1.54 2.59 0.97 141 TR_XM_SpammyWords2 1829 7.21 18.65 0.97 142 XM_UB50 1810 1.68 3.01 0.96 143 TooManyTo_003 1806 0.97 1.00 0.96 144 RCVD_IN_PSBL 1680 1.06 1.37 0.89 145 TR_LOTS_OF_MONEY3 1663 2.89 6.57 0.88 146 URI_TRY_3LD 1637 1.22 1.86 0.87 147 USER_IN_WELCOMELIST 1635 0.56 0.00 0.86 148 USER_IN_WHITELIST 1635 0.56 0.00 0.86 149 TR_XM_Base64_M1 1618 0.79 0.67 0.86 150 XMSexyCombo_04 1611 0.74 0.52 0.85 151 XM_H_PHPMailer 1606 0.88 0.94 0.85 152 MPART_ALT_DIFF_COUNT 1574 0.87 0.95 0.83 153 URI_NOVOWEL 1522 0.86 0.97 0.81 154 T_XMDrugObfuBody_00 1472 0.93 1.20 0.78 155 TooManyTo_004 1468 0.85 0.98 0.78 156 XMPhish30 1441 0.98 1.37 0.76 157 NML_ADSP_CUSTOM_MED 1396 0.78 0.86 0.74 158 XMSubMetaSxObfu_02 1394 0.65 0.50 0.74 159 T_XMHurry_00 1369 1.15 1.93 0.72 160 HTML_TAG_BALANCE_BODY 1339 1.06 1.71 0.71 161 RCVD_IN_BL_SPAMCOP_NET 1285 5.16 13.37 0.68 162 TooManyTo_005 1273 0.77 0.95 0.67 163 XMBody_95 1267 0.47 0.12 0.67 164 XM_ProductURIs 1256 0.65 0.64 0.66 165 SHOPIFY_IMG_NOT_RCVD_SFY 1213 0.63 0.61 0.64 166 FORGED_GMAIL_RCVD 1203 0.69 0.78 0.64 167 TR_MetaPhish_Combo_01 1163 0.69 0.84 0.62 168 DIET_1 1153 1.19 2.24 0.61 169 XMSubMetaI_00 1135 0.71 0.91 0.60 170 XMGenDplmaNmb 1114 0.64 0.75 0.59 171 XMNoVowels 1112 0.64 0.72 0.59 172 HTML_FONT_FACE_BAD 1090 0.75 1.07 0.58 173 SpammyFromTLD_01 1061 1.07 2.01 0.56 174 AD_PREFS 1058 0.38 0.04 0.56 175 XMPhish14 1004 0.67 0.93 0.53 176 KHOP_HELO_FCRDNS 964 0.82 1.40 0.51 177 HELO_NODOT 914 0.43 0.32 0.48 178 HELO_NO_DOMAIN 913 0.43 0.32 0.48 179 HTTPS_HTTP_MISMATCH 903 0.73 1.19 0.48 180 T_FILL_THIS_FORM_SHORT 887 1.49 3.37 0.47 181 T_TooManySym_04 858 0.35 0.17 0.45 182 XMOemUri 848 0.35 0.16 0.45 183 T_STY_INVIS_DIRECT 842 0.73 1.26 0.45 184 PLING_QUERY 834 0.56 0.77 0.44 185 FILL_THIS_FORM 832 0.45 0.47 0.44 186 XM_S_SubURI 827 0.35 0.20 0.44 187 RELAYCOUNTRY_AU 789 1.09 2.31 0.42 188 TR_XM_SPAMCOP 773 4.20 11.14 0.41 189 NUMERIC_HTTP_ADDR 757 0.32 0.16 0.40 190 DKIM_ADSP_NXDOMAIN 756 0.61 0.99 0.40 191 HTML_IMAGE_ONLY_16 742 0.27 0.06 0.39 192 CTE_8BIT_MISMATCH 731 0.26 0.02 0.39 193 RDNS_DYNAMIC 720 0.59 0.97 0.38 194 XM_B_DNDMA 711 0.46 0.62 0.38 195 XMSubMetaSxObfu_03 701 0.56 0.91 0.37 196 XM_B_FormFill 698 0.26 0.07 0.37 197 XM_Walgreens_Forge 688 0.25 0.03 0.36 198 XM_B_REG_HTML 681 0.45 0.61 0.36 199 THIS_AD 678 0.62 1.10 0.36 200 XMSubNoVowel 677 0.44 0.60 0.36 ----------------------------------------------------------------------