Email: 272058 Autolearn: 0 AvgScore: 4.53 AvgScanTime: 1.11 sec Spam: 99389 Autolearn: 0 AvgScore: 13.84 AvgScanTime: 1.13 sec Ham: 172669 Autolearn: 0 AvgScore: -0.83 AvgScanTime: 1.09 sec Time Spent Running SA: 83.57 hours Time Spent Processing Spam: 31.15 hours Time Spent Processing Ham: 52.42 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 99245 99.77 99.86 99.73 2 HTML_MESSAGE 95270 87.95 95.86 83.40 3 DKIM_SIGNED 90673 83.26 91.23 78.67 4 XM_DK_Pass 87524 81.42 88.06 77.60 5 DKIM_VALID 86356 80.65 86.89 77.05 6 XM_B_Unicode 84883 77.53 85.40 73.00 7 XM_B_SpammyWords 75326 57.09 75.79 46.33 8 XMListUnsubscribeExists 75192 63.93 75.65 57.18 9 RELAYCOUNTRY_US 74114 78.32 74.57 80.47 10 DCC_CHECK 72814 52.82 73.26 41.05 11 DKIM_VALID_AU 65302 66.11 65.70 66.34 12 XM_DK_Undo_02 48128 22.07 48.42 6.90 13 XM_B_Unicode3 46844 45.79 47.13 45.02 14 XM_B_SpammyWords2 45472 30.17 45.75 21.19 15 BAYES_99 39120 17.93 39.36 5.59 16 TR_XM_DKIM_Undo 38602 15.95 38.84 2.77 17 LOC_TINY_FONT_1 36920 32.94 37.15 30.51 18 HTML_FONT_LOW_CONTRAST 33417 33.65 33.62 33.66 19 BAYES_50 33280 49.98 33.48 59.47 20 RCVD_IN_MSPIKE_H2 32567 31.82 32.77 31.28 21 BAYES_999 30734 14.03 30.92 4.31 22 T_KAM_HTML_FONT_INVALID 29401 23.98 29.58 20.75 23 FVGT_m_MULTI_ODD 29280 28.79 29.46 28.41 24 DKIM_VALID_EF 28955 29.76 29.13 30.11 25 TR_DCC_Bayes_99 27923 11.68 28.09 2.24 26 MIME_HTML_ONLY 27615 22.76 27.78 19.87 27 DCC_CHECK_NEGATIVE 26560 47.15 26.72 58.91 28 RELAYCOUNTRY_META 24447 11.72 24.60 4.30 29 TR_XM_DK_Unsub 22619 18.57 22.76 16.17 30 T_TM2_M_HEADER_IN_MSG 22302 21.84 22.44 21.50 31 TR_XM_SpammyRelay 20151 9.13 20.27 2.71 32 XM_Multi_Part_URI 19704 17.28 19.83 15.82 33 TR_XM_SpammyWords2 17922 6.96 18.03 0.58 34 XMSubLong 17889 21.93 18.00 24.20 35 TR_MAX_INTL_RELAY 15761 10.90 15.86 8.05 36 XM_B_SpammyWords3 15555 9.44 15.65 5.86 37 RELAYCOUNTRY_CA 14972 6.83 15.06 2.09 38 RCVD_IN_BL_SPAMCOP_NET 14679 5.88 14.77 0.76 39 XM_B_Unsub 13986 10.39 14.07 8.27 40 TR_XM_BayesUnsub 13383 9.40 13.47 7.06 41 UNPARSEABLE_RELAY 13190 11.93 13.27 11.16 42 BOTNET_IPINHOSTNAME 13156 8.79 13.24 6.24 43 TR_XM_SPAMCOP 13001 5.15 13.08 0.58 44 LOTS_OF_MONEY 12693 8.26 12.77 5.66 45 TR_XM_SpammyWords4 11665 6.95 11.74 4.20 46 XMBody_17 9996 4.20 10.06 0.83 47 RCVD_IN_MSPIKE_H3 9865 7.95 9.93 6.81 48 RCVD_IN_MSPIKE_WL 9865 7.95 9.93 6.81 49 BAYES_80 9443 6.52 9.50 4.81 50 BAYES_60 8231 10.50 8.28 11.78 51 BOTNET 7885 3.60 7.93 1.11 52 TR_XM_UnparsRelay 7346 3.81 7.39 1.74 53 FSL_BULK_SIG 7148 4.93 7.19 3.63 54 T_FILL_THIS_FORM_SHORT 7078 3.07 7.12 0.74 55 XM_Evil_Numbers_Gen 6814 8.04 6.86 8.71 56 UNTRUSTED_Relay 6729 3.61 6.77 1.80 57 MPART_ALT_DIFF 6650 4.76 6.69 3.66 58 XM_Body_Dirty_Words 6582 4.22 6.62 2.84 59 HTML_IMAGE_RATIO_02 6483 6.02 6.52 5.73 60 XMSubMetaSx_00 6251 5.82 6.29 5.55 61 TooManyTo_001 6205 6.36 6.24 6.43 62 BAYES_95 5904 4.23 5.94 3.24 63 XM_H_GMP 5328 7.55 5.36 8.81 64 LotsOfNums_01 5313 6.81 5.35 7.65 65 XM_OfRef6 5137 2.71 5.17 1.29 66 HTML_IMAGE_RATIO_04 4854 5.30 4.88 5.54 67 XM_UncommonTLD01 4847 4.92 4.88 4.95 68 TR_XM_FormFill 4812 1.78 4.84 0.02 69 MIME_HTML_MOSTLY 4576 3.15 4.60 2.32 70 XMStrtUSub 4503 5.29 4.53 5.73 71 TR_XM_SpammyWords5 4434 2.68 4.46 1.66 72 XMSexyCombo_05 4330 2.86 4.36 2.00 73 DKIM_INVALID 4317 2.61 4.34 1.62 74 XM_SPF_SoftFail 4222 3.33 4.25 2.80 75 RCVD_IN_VALIDITY_SAFE 4167 7.19 4.19 8.91 76 T_XMDrugObfuBody_14 4142 2.83 4.17 2.07 77 HK_RANDOM_REPLYTO 4038 1.58 4.06 0.16 78 XM_B_SEO 4027 2.63 4.05 1.82 79 TR_XM_BayesRelay 3946 1.45 3.97 0.00 80 XM_B_Investor 3809 2.37 3.83 1.53 81 XM_B_Phish_Phrases 3790 3.79 3.81 3.77 82 TR_LOTS_OF_MONEY3 3712 1.65 3.73 0.45 83 TR_XM_PhishingBody 3666 2.49 3.69 1.80 84 XM_H_Long_From01 3648 4.58 3.67 5.10 85 XM_CamelCaseFrm001 3567 2.99 3.59 2.65 86 HOSTED_IMG_MULTI_PUB_01 3502 1.30 3.52 0.02 87 FONT_INVIS_LONG_LINE 3448 1.33 3.47 0.10 88 USER_IN_DEF_DKIM_WL 3407 13.76 3.43 19.71 89 XM_UB50 3369 1.84 3.39 0.94 90 HTML_IMAGE_RATIO_06 3350 3.21 3.37 3.12 91 TR_XM_SEO4 3345 1.96 3.37 1.14 92 RCVD_IN_VALIDITY_RPBL 3342 1.32 3.36 0.15 93 RCVD_IN_VALIDITY_CERTIFIED 3331 6.05 3.35 7.61 94 XMNumbers 3059 3.64 3.08 3.97 95 HTML_IMAGE_RATIO_08 2987 2.60 3.01 2.36 96 T_XMDrugObfuBody_08 2953 2.07 2.97 1.54 97 TM2_M_VERY_LONG_WORD 2952 1.93 2.97 1.33 98 T_TooManySym_01 2884 5.44 2.90 6.89 99 MIME_HTML_ONLY_MULTI 2879 2.34 2.90 2.01 100 TR_XM_NoHeaderRelay 2806 1.10 2.82 0.11 101 XM_B_SpammyWords4 2798 1.64 2.82 0.96 102 XM_B_SpammyTLD 2746 2.55 2.76 2.43 103 TM2_M_URI_OPT_OUT 2658 2.17 2.67 1.87 104 SUBJ_ALL_CAPS 2654 1.68 2.67 1.10 105 MIME_QP_LONG_LINE 2630 3.06 2.65 3.30 106 T_XMDrugObfuBody_10 2316 0.90 2.33 0.08 107 RELAYCOUNTRY_AU 2230 1.13 2.24 0.50 108 T_XMHurry_00 2190 1.18 2.20 0.60 109 ALL_TRUSTED 2172 10.50 2.19 15.29 110 TR_XM_PHPForged 2145 0.94 2.16 0.23 111 TR_XM_PHPDW 2073 0.91 2.09 0.23 112 TR_XM_FormFill2 2065 0.91 2.08 0.24 113 XMDiploma_00 2057 1.99 2.07 1.94 114 ANY_BOUNCE_MESSAGE 2056 2.81 2.07 3.23 115 BOUNCE_MESSAGE 2056 2.81 2.07 3.23 116 XM_H_PHPOS 2029 0.88 2.04 0.21 117 HTTPS_HTTP_MISMATCH 1973 1.25 1.99 0.83 118 TM2_M_A_HREF_HREF 1911 0.97 1.92 0.42 119 FROM_EXCESS_BASE64 1898 2.01 1.91 2.06 120 DKIM_ADSP_NXDOMAIN 1896 0.97 1.91 0.43 121 HTML_TAG_BALANCE_BODY 1876 1.18 1.89 0.78 122 TR_XM_INV_DKIM 1876 0.73 1.89 0.07 123 URIBL_DBL_SPAM 1822 0.69 1.83 0.03 124 XM_URI_RBL 1772 0.76 1.78 0.18 125 XMBrknScrpt_02 1678 1.07 1.69 0.72 126 XM_B_Unsub2 1628 1.35 1.64 1.18 127 SpammyFromTLD_01 1615 0.84 1.62 0.38 128 URI_HEX 1573 1.05 1.58 0.75 129 URI_TRY_3LD 1560 1.11 1.57 0.85 130 DIET_1 1512 0.81 1.52 0.39 131 XM_DIRTYINTL 1500 0.59 1.51 0.06 132 XMSexyCombo_01 1486 0.65 1.50 0.17 133 BAYES_40 1479 3.01 1.49 3.89 134 T_REMOTE_IMAGE 1438 2.42 1.45 2.98 135 XMPhish30 1282 0.94 1.29 0.75 136 MAILING_LIST_MULTI 1274 1.87 1.28 2.20 137 XM_SendGrid 1265 1.31 1.27 1.33 138 XMReplyNow 1257 0.67 1.26 0.32 139 TooManyTo_002 1255 1.61 1.26 1.80 140 KHOP_HELO_FCRDNS 1212 1.00 1.22 0.87 141 T_STY_INVIS_DIRECT 1200 0.73 1.21 0.45 142 TooManyTo_003 1198 1.09 1.21 1.02 143 XMSlimDrugH 1193 0.63 1.20 0.31 144 SpammyFromTLD_02 1168 0.54 1.18 0.17 145 XMBounce_01 1165 0.44 1.17 0.02 146 XM_H_Undi_Recip 1165 0.53 1.17 0.17 147 TR_Caps_n_Bayes_99 1154 0.53 1.16 0.16 148 TooManyTo_004 1154 0.95 1.16 0.82 149 XMStockSpam_06 1147 1.49 1.15 1.68 150 XM_Combo_Sbj 1145 0.58 1.15 0.25 151 DKIM_ADSP_CUSTOM_MED 1137 0.91 1.14 0.78 152 TooManyTo_005 1123 0.88 1.13 0.73 153 XM_UB60 1122 0.46 1.13 0.07 154 RELAYCOUNTRY_CN 1122 0.43 1.13 0.03 155 T_XMDrugObfuBody_00 1119 0.72 1.13 0.49 156 XM_H_Long_From02 1109 1.07 1.12 1.04 157 XM_DK_Undo_01 1103 1.55 1.11 1.80 158 XMBdyGiftCard01 1085 1.24 1.09 1.33 159 XM_RXBody 1079 0.64 1.09 0.39 160 NML_ADSP_CUSTOM_MED 1052 0.72 1.06 0.52 161 HTML_MIME_NO_HTML_TAG 1027 1.28 1.03 1.41 162 XM_H_PHPMailer 997 0.90 1.00 0.84 163 XM_B_Phish66 990 0.52 1.00 0.25 164 XMNoVowels 987 0.73 0.99 0.59 165 RCVD_IN_PSBL 969 0.60 0.97 0.38 166 TR_Mismatch_TLD_01 968 0.50 0.97 0.23 167 BAYES_20 953 2.04 0.96 2.66 168 BOTNET_NORDNS 950 0.35 0.96 0.00 169 XM_B_COPY_HTML 950 1.18 0.96 1.31 170 TR_XM_DK_SendGrid 920 0.94 0.93 0.95 171 RDNS_DYNAMIC 903 0.57 0.91 0.38 172 TR_Mismatch_TLD_02 888 0.36 0.89 0.05 173 URI_NOVOWEL 877 0.98 0.88 1.03 174 TR_XM_InvalidRelay 867 0.33 0.87 0.02 175 XMPhish14 865 0.62 0.87 0.48 176 XM_B_DNDMA 864 0.69 0.87 0.59 177 XMClaimOffer 863 0.72 0.87 0.64 178 TVD_RCVD_IP 859 2.46 0.86 3.38 179 XM_UB99 859 0.32 0.86 0.00 180 XMSexyCombo_04 845 0.32 0.85 0.02 181 TR_MetaPhish_Combo_01 840 0.71 0.85 0.63 182 XMHTMLBadTable_001 837 0.52 0.84 0.33 183 XMSubMetaSxObfu_03 835 0.63 0.84 0.52 184 T_TooManySym_02 829 2.82 0.83 3.97 185 PLING_QUERY 822 0.70 0.83 0.62 186 SCC_BODY_URI_ONLY 819 2.11 0.82 2.85 187 TM2_M_OBFU_COMMENT 809 0.50 0.81 0.31 188 LongTLD 804 0.41 0.81 0.17 189 XMFrmHeader_28 804 0.30 0.81 0.00 190 HTML_TEXT_INVISIBLE_STYLE 801 0.42 0.81 0.20 191 TR_XM_Undi_Recip11 792 0.31 0.80 0.03 192 XM_ProductURIs 787 1.33 0.79 1.64 193 MPART_ALT_DIFF_COUNT 771 0.97 0.78 1.08 194 THIS_AD 765 0.41 0.77 0.20 195 FORGED_GMAIL_RCVD 763 0.57 0.77 0.46 196 XM_HighProb1 761 0.28 0.77 0.01 197 UNDISC_MONEY 751 0.28 0.76 0.00 198 TR_Symld_Words 750 1.06 0.75 1.24 199 TR_XM_Undi_Recip5 727 0.27 0.73 0.00 200 HELO_DYNAMIC_SPLIT_IP 717 0.27 0.72 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 T_SCC_BODY_TEXT_LINE 172195 99.77 99.86 99.73 2 HTML_MESSAGE 144001 87.95 95.86 83.40 3 RELAYCOUNTRY_US 138952 78.32 74.57 80.47 4 DKIM_SIGNED 135838 83.26 91.23 78.67 5 XM_DK_Pass 133996 81.42 88.06 77.60 6 DKIM_VALID 133046 80.65 86.89 77.05 7 XM_B_Unicode 126055 77.53 85.40 73.00 8 DKIM_VALID_AU 114550 66.11 65.70 66.34 9 BAYES_50 102692 49.98 33.48 59.47 10 DCC_CHECK_NEGATIVE 101723 47.15 26.72 58.91 11 XMListUnsubscribeExists 98732 63.93 75.65 57.18 12 XM_B_SpammyWords 79989 57.09 75.79 46.33 13 XM_B_Unicode3 77733 45.79 47.13 45.02 14 DCC_CHECK 70884 52.82 73.26 41.05 15 HTML_FONT_LOW_CONTRAST 58120 33.65 33.62 33.66 16 RCVD_IN_MSPIKE_H2 54011 31.82 32.77 31.28 17 LOC_TINY_FONT_1 52684 32.94 37.15 30.51 18 DKIM_VALID_EF 51997 29.76 29.13 30.11 19 FVGT_m_MULTI_ODD 49053 28.79 29.46 28.41 20 XMSubLong 41783 21.93 18.00 24.20 21 T_TM2_M_HEADER_IN_MSG 37125 21.84 22.44 21.50 22 XM_B_SpammyWords2 36597 30.17 45.75 21.19 23 T_KAM_HTML_FONT_INVALID 35829 23.98 29.58 20.75 24 MIME_HTML_ONLY 34304 22.76 27.78 19.87 25 USER_IN_DEF_DKIM_WL 34027 13.76 3.43 19.71 26 TR_XM_DK_Unsub 27912 18.57 22.76 16.17 27 XM_Multi_Part_URI 27312 17.28 19.83 15.82 28 ALL_TRUSTED 26403 10.50 2.19 15.29 29 XM_DKIMWhitelistDomains 21212 7.80 0.01 12.28 30 BAYES_60 20346 10.50 8.28 11.78 31 UNPARSEABLE_RELAY 19272 11.93 13.27 11.16 32 RCVD_IN_VALIDITY_SAFE 15382 7.19 4.19 8.91 33 XM_H_GMP 15217 7.55 5.36 8.81 34 XM_Evil_Numbers_Gen 15048 8.04 6.86 8.71 35 XM_B_Unsub 14274 10.39 14.07 8.27 36 TR_MAX_INTL_RELAY 13899 10.90 15.86 8.05 37 LotsOfNums_01 13213 6.81 5.35 7.65 38 RCVD_IN_VALIDITY_CERTIFIED 13142 6.05 3.35 7.61 39 BAYES_00 12213 4.65 0.43 7.07 40 TR_XM_BayesUnsub 12199 9.40 13.47 7.06 41 XM_DK_Undo_02 11915 22.07 48.42 6.90 42 T_TooManySym_01 11903 5.44 2.90 6.89 43 RCVD_IN_MSPIKE_WL 11755 7.95 9.93 6.81 44 RCVD_IN_MSPIKE_H3 11755 7.95 9.93 6.81 45 TooManyTo_001 11102 6.36 6.24 6.43 46 BOTNET_IPINHOSTNAME 10770 8.79 13.24 6.24 47 XM_B_SpammyWords3 10122 9.44 15.65 5.86 48 TR_XM_DK_Bayes 9973 3.79 0.35 5.78 49 HTML_IMAGE_RATIO_02 9898 6.02 6.52 5.73 50 XMStrtUSub 9892 5.29 4.53 5.73 51 TR_XM_DK_Bayes1 9887 3.75 0.32 5.73 52 LOTS_OF_MONEY 9772 8.26 12.77 5.66 53 BAYES_99 9651 17.93 39.36 5.59 54 XMSubMetaSx_00 9581 5.82 6.29 5.55 55 HTML_IMAGE_RATIO_04 9560 5.30 4.88 5.54 56 IN_ZIMBRA_NJ_WHITELIST 9413 3.48 0.05 5.45 57 XM_H_Long_From01 8802 4.58 3.67 5.10 58 TR_XM_DK_Bayes2 8679 3.30 0.30 5.03 59 XM_UncommonTLD01 8540 4.92 4.88 4.95 60 BAYES_80 8305 6.52 9.50 4.81 61 BAYES_999 7437 14.03 30.92 4.31 62 RELAYCOUNTRY_META 7433 11.72 24.60 4.30 63 TR_XM_SpammyWords4 7249 6.95 11.74 4.20 64 TO_MALFORMED 6993 2.58 0.03 4.05 65 INVALID_MSGID 6954 2.62 0.18 4.03 66 XMNumbers 6856 3.64 3.08 3.97 67 T_TooManySym_02 6847 2.82 0.83 3.97 68 BAYES_40 6713 3.01 1.49 3.89 69 XM_B_Phish_Phrases 6509 3.79 3.81 3.77 70 MPART_ALT_DIFF 6312 4.76 6.69 3.66 71 FSL_BULK_SIG 6267 4.93 7.19 3.63 72 TVD_RCVD_IP 5842 2.46 0.86 3.38 73 MIME_QP_LONG_LINE 5690 3.06 2.65 3.30 74 BAYES_95 5591 4.23 5.94 3.24 75 ANY_BOUNCE_MESSAGE 5579 2.81 2.07 3.23 76 BOUNCE_MESSAGE 5578 2.81 2.07 3.23 77 HTML_IMAGE_RATIO_06 5395 3.21 3.37 3.12 78 T_REMOTE_IMAGE 5146 2.42 1.45 2.98 79 SCC_BODY_URI_ONLY 4928 2.11 0.82 2.85 80 XM_Body_Dirty_Words 4908 4.22 6.62 2.84 81 XM_SPF_SoftFail 4828 3.33 4.25 2.80 82 TR_XM_DKIM_Undo 4789 15.95 38.84 2.77 83 XMBSHREFv2 4760 1.83 0.23 2.76 84 TR_XM_SpammyRelay 4676 9.13 20.27 2.71 85 BAYES_20 4601 2.04 0.96 2.66 86 XM_CamelCaseFrm001 4571 2.99 3.59 2.65 87 RCVD_IN_IADB_LISTED 4297 1.79 0.58 2.49 88 XM_B_SpammyTLD 4191 2.55 2.76 2.43 89 HTML_IMAGE_RATIO_08 4079 2.60 3.01 2.36 90 MIME_HTML_MOSTLY 4001 3.15 4.60 2.32 91 TR_DCC_Bayes_99 3866 11.68 28.09 2.24 92 RCVD_IN_IADB_SPF 3855 1.61 0.52 2.23 93 MAILING_LIST_MULTI 3801 1.87 1.28 2.20 94 XM_PDF 3707 1.46 0.27 2.15 95 RELAYCOUNTRY_CA 3608 6.83 15.06 2.09 96 T_XMDrugObfuBody_14 3570 2.83 4.17 2.07 97 FROM_EXCESS_BASE64 3562 2.01 1.91 2.06 98 RCVD_IN_IADB_SENDERID 3535 1.48 0.48 2.05 99 MIME_HTML_ONLY_MULTI 3474 2.34 2.90 2.01 100 RCVD_IN_IADB_DK 3456 1.45 0.49 2.00 101 XMSexyCombo_05 3446 2.86 4.36 2.00 102 XMDiploma_00 3348 1.99 2.07 1.94 103 IN_HORDE_ADDRESS_BOOK 3316 1.24 0.06 1.92 104 TVD_SPACE_RATIO 3309 1.25 0.09 1.92 105 TM2_M_URI_OPT_OUT 3236 2.17 2.67 1.87 106 XM_B_SEO 3137 2.63 4.05 1.82 107 TooManyTo_002 3116 1.61 1.26 1.80 108 TR_XM_PhishingBody 3108 2.49 3.69 1.80 109 XM_DK_Undo_01 3106 1.55 1.11 1.80 110 UNTRUSTED_Relay 3101 3.61 6.77 1.80 111 TR_XM_UnparsRelay 3006 3.81 7.39 1.74 112 XMStockSpam_06 2908 1.49 1.15 1.68 113 TR_XM_SpammyWords5 2865 2.68 4.46 1.66 114 XM_ProductURIs 2826 1.33 0.79 1.64 115 XMGappySubj_01 2797 1.07 0.11 1.62 116 DKIM_INVALID 2792 2.61 4.34 1.62 117 RCVD_IN_IADB_VOUCHED 2668 1.09 0.29 1.55 118 T_XMDrugObfuBody_08 2667 2.07 2.97 1.54 119 XM_B_Investor 2640 2.37 3.83 1.53 120 BAYES_05 2555 1.14 0.56 1.48 121 HTML_MIME_NO_HTML_TAG 2442 1.28 1.03 1.41 122 XMGappySubj_02 2411 0.91 0.06 1.40 123 T_TooManySym_03 2409 1.01 0.34 1.40 124 TM2_M_VERY_LONG_WORD 2300 1.93 2.97 1.33 125 XM_SendGrid 2292 1.31 1.27 1.33 126 XMBdyGiftCard01 2291 1.24 1.09 1.33 127 XM_B_COPY_HTML 2265 1.18 0.96 1.31 128 XM_GoogleGroups 2254 1.03 0.55 1.31 129 XM_OfRef6 2225 2.71 5.17 1.29 130 TR_Symld_Words 2140 1.06 0.75 1.24 131 XM_B_Unsub2 2044 1.35 1.64 1.18 132 TR_XM_SEO4 1977 1.96 3.37 1.14 133 RCVD_IN_IADB_OPTIN 1926 0.78 0.20 1.12 134 BOTNET 1918 3.60 7.93 1.11 135 SUBJ_ALL_CAPS 1906 1.68 2.67 1.10 136 LOW_PRICE 1884 0.76 0.20 1.09 137 MPART_ALT_DIFF_COUNT 1872 0.97 0.78 1.08 138 XM_H_Long_From02 1798 1.07 1.12 1.04 139 URI_NOVOWEL 1780 0.98 0.88 1.03 140 TooManyTo_003 1760 1.09 1.21 1.02 141 XM_B_SpammyWords4 1662 1.64 2.82 0.96 142 TR_XM_DK_SendGrid 1638 0.94 0.93 0.95 143 XM_UB50 1627 1.84 3.39 0.94 144 T_MANY_PILL_PRICE 1588 0.61 0.06 0.92 145 XMSubMetaSxObfu_02 1549 0.67 0.29 0.90 146 KHOP_HELO_FCRDNS 1505 1.00 1.22 0.87 147 XMGenDplmaNmb 1478 0.80 0.71 0.86 148 URI_TRY_3LD 1473 1.11 1.57 0.85 149 XM_H_PHPMailer 1445 0.90 1.00 0.84 150 TR_XM_Base64_M1 1445 0.72 0.51 0.84 151 HTTPS_HTTP_MISMATCH 1439 1.25 1.99 0.83 152 XMBody_17 1432 4.20 10.06 0.83 153 TooManyTo_004 1420 0.95 1.16 0.82 154 XMBody_95 1403 0.57 0.14 0.81 155 USER_IN_WHITELIST 1356 0.50 0.00 0.79 156 USER_IN_WELCOMELIST 1356 0.50 0.00 0.79 157 HTML_TAG_BALANCE_BODY 1345 1.18 1.89 0.78 158 DKIM_ADSP_CUSTOM_MED 1345 0.91 1.14 0.78 159 RCVD_IN_BL_SPAMCOP_NET 1320 5.88 14.77 0.76 160 URI_HEX 1292 1.05 1.58 0.75 161 XMPhish30 1288 0.94 1.29 0.75 162 T_FILL_THIS_FORM_SHORT 1277 3.07 7.12 0.74 163 FILL_THIS_FORM 1264 0.56 0.27 0.73 164 TooManyTo_005 1262 0.88 1.13 0.73 165 XMBrknScrpt_02 1246 1.07 1.69 0.72 166 XM_B_FormFill 1132 0.43 0.04 0.66 167 XMClaimOffer 1108 0.72 0.87 0.64 168 TR_MetaPhish_Combo_01 1096 0.71 0.85 0.63 169 PLING_QUERY 1072 0.70 0.83 0.62 170 T_XMHurry_00 1031 1.18 2.20 0.60 171 XM_B_DNDMA 1012 0.69 0.87 0.59 172 XMNoVowels 1011 0.73 0.99 0.59 173 TR_XM_SpammyWords2 1007 6.96 18.03 0.58 174 TR_XM_SPAMCOP 1007 5.15 13.08 0.58 175 SHOPIFY_IMG_NOT_RCVD_SFY 977 0.62 0.71 0.57 176 NML_ADSP_CUSTOM_MED 895 0.72 1.06 0.52 177 XMSubMetaSxObfu_03 891 0.63 0.84 0.52 178 T_TooManySym_04 885 0.39 0.18 0.51 179 T_TVD_MIME_NO_HEADERS 863 0.36 0.12 0.50 180 RELAYCOUNTRY_AU 855 1.13 2.24 0.50 181 T_XMDrugObfuBody_00 853 0.72 1.13 0.49 182 XMPhish14 822 0.62 0.87 0.48 183 FORGED_GMAIL_RCVD 788 0.57 0.77 0.46 184 XM_S_SubURI 786 0.31 0.04 0.46 185 TR_LOTS_OF_MONEY3 781 1.65 3.73 0.45 186 T_STY_INVIS_DIRECT 777 0.73 1.21 0.45 187 HTML_FONT_FACE_BAD 774 0.47 0.50 0.45 188 XMSubMetaI_00 774 0.53 0.68 0.45 189 DKIM_ADSP_NXDOMAIN 736 0.97 1.91 0.43 190 TM2_M_A_HREF_HREF 732 0.97 1.92 0.42 191 CTE_8BIT_MISMATCH 731 0.28 0.03 0.42 192 FILL_THIS_FORM_LONG 726 0.32 0.15 0.42 193 XM_B_REG_HTML 715 0.51 0.67 0.41 194 HELO_NODOT 700 0.37 0.30 0.41 195 HELO_NO_DOMAIN 700 0.37 0.30 0.41 196 XMHTML_After_End 687 0.51 0.69 0.40 197 DIET_1 681 0.81 1.52 0.39 198 XM_RXBody 675 0.64 1.09 0.39 199 AD_PREFS 672 0.26 0.03 0.39 200 RCVD_IN_PSBL 662 0.60 0.97 0.38 ----------------------------------------------------------------------