Email: 320494 Autolearn: 0 AvgScore: 4.19 AvgScanTime: 1.17 sec Spam: 113617 Autolearn: 0 AvgScore: 13.10 AvgScanTime: 1.26 sec Ham: 206877 Autolearn: 0 AvgScore: -0.70 AvgScanTime: 1.12 sec Time Spent Running SA: 104.05 hours Time Spent Processing Spam: 39.84 hours Time Spent Processing Ham: 64.21 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109298 88.90 96.20 84.90 2 DKIM_SIGNED 104854 81.77 92.29 75.99 3 XM_DK_Pass 101865 80.26 89.66 75.11 4 DKIM_VALID 101089 79.77 88.97 74.72 5 XM_B_Unicode 99057 78.75 87.19 74.11 6 RELAYCOUNTRY_US 98668 83.88 86.84 82.25 7 DCC_CHECK 88394 56.34 77.80 44.56 8 XMListUnsubscribeExists 87623 63.46 77.12 55.95 9 XM_B_SpammyWords 83842 57.46 73.79 48.49 10 DKIM_VALID_AU 83287 67.60 73.31 64.46 11 XM_DK_Undo_02 53241 21.45 46.86 7.49 12 XM_B_Unicode3 51991 44.46 45.76 43.74 13 LOC_TINY_FONT_1 49351 33.18 43.44 27.55 14 RCVD_IN_MSPIKE_H2 49107 36.61 43.22 32.98 15 XM_B_SpammyWords2 47885 29.79 42.15 23.00 16 HTML_FONT_LOW_CONTRAST 47176 36.39 41.52 33.57 17 FVGT_m_MULTI_ODD 44161 31.62 38.87 27.64 18 BAYES_99 43340 17.08 38.15 5.51 19 BAYES_50 40193 49.62 35.38 57.45 20 TR_XM_DKIM_Undo 40179 14.76 35.36 3.45 21 BAYES_999 34279 13.44 30.17 4.25 22 TR_DCC_Bayes_99 33253 12.04 29.27 2.58 23 T_KAM_HTML_FONT_INVALID 32852 23.69 28.91 20.83 24 DKIM_VALID_EF 31141 28.96 27.41 29.82 25 DCC_CHECK_NEGATIVE 25213 43.64 22.19 55.42 26 T_TM2_M_HEADER_IN_MSG 24359 22.14 21.44 22.53 27 MIME_HTML_ONLY 24197 22.51 21.30 23.18 28 TR_XM_DK_Unsub 24103 18.41 21.21 16.87 29 XM_Multi_Part_URI 22662 17.90 19.95 16.77 30 XMSubLong 21119 20.16 18.59 21.03 31 LOTS_OF_MONEY 20224 11.10 17.80 7.42 32 TR_XM_SpammyWords4 18375 9.36 16.17 5.62 33 TR_XM_SpammyWords2 17251 6.11 15.18 1.12 34 UNPARSEABLE_RELAY 17172 12.60 15.11 11.21 35 TR_MAX_INTL_RELAY 17003 10.25 14.97 7.66 36 RELAYCOUNTRY_META 16295 7.87 14.34 4.32 37 XM_B_Unsub 15282 11.77 13.45 10.84 38 XM_B_SpammyWords3 14939 9.53 13.15 7.55 39 BOTNET_IPINHOSTNAME 14753 8.25 12.98 5.65 40 TR_XM_BayesUnsub 14658 9.10 12.90 7.02 41 TR_XM_SpammyRelay 12301 5.73 10.83 2.93 42 RCVD_IN_BL_SPAMCOP_NET 10604 3.88 9.33 0.88 43 BAYES_80 10416 6.12 9.17 4.45 44 BAYES_60 9378 9.68 8.25 10.46 45 TR_XM_UnparsRelay 8925 3.86 7.86 1.66 46 TR_XM_SPAMCOP 8916 3.12 7.85 0.53 47 XM_Body_Dirty_Words 8542 4.86 7.52 3.40 48 BOTNET 8468 3.68 7.45 1.61 49 TR_LOTS_OF_MONEY3 8417 3.77 7.41 1.78 50 XMBody_17 7982 3.25 7.03 1.17 51 XM_Evil_Numbers_Gen 7725 7.22 6.80 7.45 52 FSL_BULK_SIG 7484 6.52 6.59 6.48 53 LotsOfNums_01 7484 7.13 6.59 7.43 54 HTML_IMAGE_RATIO_02 7424 6.11 6.53 5.87 55 RELAYCOUNTRY_CA 6333 3.26 5.57 1.98 56 BAYES_95 6307 4.04 5.55 3.21 57 XMSubMetaSx_00 6026 4.28 5.30 3.72 58 UNTRUSTED_Relay 5974 3.11 5.26 1.94 59 XM_SPF_SoftFail 5784 3.37 5.09 2.43 60 MPART_ALT_DIFF 5738 6.99 5.05 8.05 61 HTML_IMAGE_RATIO_04 5459 4.37 4.80 4.13 62 XM_UncommonTLD01 5263 4.70 4.63 4.74 63 XM_H_GMP 5180 6.04 4.56 6.85 64 TooManyTo_001 5040 5.26 4.44 5.71 65 XMStrtUSub 4929 5.55 4.34 6.22 66 T_XMDrugObfuBody_14 4892 2.97 4.31 2.24 67 T_XMHurry_00 4772 2.23 4.20 1.15 68 HTML_IMAGE_RATIO_06 4722 2.90 4.16 2.21 69 XM_B_SEO 4675 2.04 4.11 0.90 70 XM_B_PhoneNumber 4671 5.61 4.11 6.43 71 XM_H_Long_From01 4661 4.64 4.10 4.94 72 XM_B_Investor 4478 2.51 3.94 1.72 73 RCVD_IN_VALIDITY_SAFE 4457 6.15 3.92 7.38 74 TR_XM_PhishingBody 4420 2.42 3.89 1.62 75 XMSexyCombo_05 4113 2.56 3.62 1.98 76 XM_OfRef6 4095 2.21 3.60 1.44 77 TR_XM_SpammyWords5 4005 1.93 3.53 1.05 78 MIME_HTML_MOSTLY 3936 2.85 3.46 2.51 79 TR_XM_SEO4 3797 1.48 3.34 0.45 80 USER_IN_DEF_DKIM_WL 3795 11.99 3.34 16.74 81 T_XMDrugObfuBody_08 3766 2.33 3.31 1.79 82 DKIM_INVALID 3765 2.00 3.31 1.28 83 XM_B_SpammyTLD 3693 3.50 3.25 3.64 84 MIME_HTML_ONLY_MULTI 3660 5.12 3.22 6.17 85 TM2_M_VERY_LONG_WORD 3659 1.95 3.22 1.25 86 XM_CamelCaseFrm001 3647 2.60 3.21 2.27 87 XM_B_Phish_Phrases 3610 2.89 3.18 2.73 88 RCVD_IN_VALIDITY_CERTIFIED 3565 4.95 3.14 5.95 89 HTML_IMAGE_RATIO_08 3519 2.62 3.10 2.36 90 XM_URI_RBL 3442 1.20 3.03 0.20 91 XM_UB50 3232 1.55 2.84 0.84 92 XMBrknScrpt_02 3213 1.98 2.83 1.52 93 URI_TRY_3LD 3175 1.85 2.79 1.33 94 XMNumbers 3036 2.76 2.67 2.81 95 XMDiploma_00 2958 1.95 2.60 1.59 96 SUBJ_ALL_CAPS 2914 1.58 2.56 1.04 97 AC_BR_BONANZA 2862 1.01 2.52 0.18 98 RCVD_IN_MSPIKE_H3 2613 4.38 2.30 5.52 99 RCVD_IN_MSPIKE_WL 2613 4.38 2.30 5.52 100 XM_B_SpammyWords4 2509 1.32 2.21 0.83 101 XMStockSpam_06 2479 1.32 2.18 0.85 102 HTML_TAG_BALANCE_BODY 2386 1.21 2.10 0.71 103 RELAYCOUNTRY_AU 2364 1.18 2.08 0.69 104 LONGLN_LOW_CONTRAST 2298 0.98 2.02 0.40 105 RCVD_IN_VALIDITY_RPBL 2296 0.79 2.02 0.12 106 TM2_M_URI_OPT_OUT 2287 4.37 2.01 5.66 107 XM_B_Unsub2 2247 1.56 1.98 1.32 108 TR_XM_NoHeaderRelay 2214 0.82 1.95 0.21 109 MIME_QP_LONG_LINE 2212 2.99 1.95 3.57 110 T_TooManySym_01 2174 4.45 1.91 5.84 111 XMBdyGiftCard01 2136 1.43 1.88 1.19 112 XM_HighProb1 2080 0.65 1.83 0.01 113 TR_XM_PHPDW 2028 0.79 1.78 0.24 114 TR_XM_PHPForged 2017 0.78 1.78 0.23 115 FROM_EXCESS_BASE64 2000 2.09 1.76 2.28 116 TR_XM_FormFill2 1962 0.76 1.73 0.23 117 XM_H_PHPOS 1950 0.75 1.72 0.22 118 T_REMOTE_IMAGE 1880 2.66 1.65 3.22 119 T_FILL_THIS_FORM_SHORT 1791 1.12 1.58 0.86 120 XMReplyNow 1787 0.72 1.57 0.26 121 MAILING_LIST_MULTI 1775 1.72 1.56 1.81 122 XM_DK_Undo_01 1731 1.64 1.52 1.70 123 MPART_ALT_DIFF_COUNT 1695 1.00 1.49 0.73 124 SpammyFromTLD_01 1656 0.81 1.46 0.45 125 KHOP_HELO_FCRDNS 1655 1.19 1.46 1.04 126 BAYES_40 1621 3.24 1.43 4.23 127 SpammyFromTLD_02 1567 0.63 1.38 0.22 128 T_XMDrugObfuBody_00 1434 0.91 1.26 0.72 129 AC_HTML_NONSENSE_TAGS 1428 0.46 1.26 0.03 130 ANY_BOUNCE_MESSAGE 1421 3.09 1.25 4.09 131 BOUNCE_MESSAGE 1421 3.09 1.25 4.09 132 XMPhish30 1412 0.82 1.24 0.59 133 TR_Caps_n_Bayes_99 1393 0.44 1.23 0.01 134 XM_B_COPY_HTML 1364 1.06 1.20 0.99 135 TR_XM_InvalidRelay 1354 0.44 1.19 0.02 136 HOSTED_IMG_MULTI_PUB_01 1327 0.43 1.17 0.02 137 T_STY_INVIS_DIRECT 1301 0.65 1.15 0.38 138 TR_XM_INV_DKIM 1255 0.44 1.10 0.07 139 ALL_TRUSTED 1252 9.03 1.10 13.38 140 XMSubMetaI_00 1229 1.02 1.08 0.98 141 XMClaimOffer 1208 0.59 1.06 0.33 142 TooManyTo_002 1206 1.35 1.06 1.50 143 HTTPS_HTTP_MISMATCH 1198 0.76 1.05 0.59 144 TR_Mismatch_TLD_01 1195 0.55 1.05 0.27 145 URI_NOVOWEL 1186 1.88 1.04 2.35 146 RDNS_DYNAMIC 1176 0.62 1.04 0.39 147 XMSexyCombo_01 1175 0.50 1.03 0.21 148 XM_H_Long_From02 1168 1.05 1.03 1.06 149 XMGenDplmaNmb 1167 0.76 1.03 0.62 150 BAYES_20 1159 2.31 1.02 3.02 151 TR_XM_Base64_M1 1155 0.89 1.02 0.81 152 XM_B_Phish66 1154 0.52 1.02 0.25 153 DIET_1 1140 0.57 1.00 0.33 154 PDS_RDNS_DYNAMIC_FP 1138 0.44 1.00 0.13 155 PLING_QUERY 1136 0.94 1.00 0.90 156 RELAYCOUNTRY_FR 1129 0.47 0.99 0.18 157 TooManyTo_003 1120 0.85 0.99 0.78 158 TVD_RCVD_IP 1114 1.76 0.98 2.19 159 SHOPIFY_IMG_NOT_RCVD_SFY 1113 0.63 0.98 0.43 160 RCVD_IN_IADB_LISTED 1110 2.04 0.98 2.63 161 BOTNET_NORDNS 1110 0.35 0.98 0.01 162 URI_HEX 1104 1.07 0.97 1.12 163 XM_DIRTYINTL 1091 0.40 0.96 0.09 164 TR_Mismatch_TLD_02 1090 0.40 0.96 0.09 165 DKIM_ADSP_NXDOMAIN 1088 0.61 0.96 0.42 166 XMHTMLBadTable_001 1085 0.51 0.95 0.26 167 HTML_MIME_NO_HTML_TAG 1082 1.23 0.95 1.39 168 DKIM_ADSP_CUSTOM_MED 1075 0.79 0.95 0.70 169 TooManyTo_004 1072 0.71 0.94 0.58 170 TR_XM_FormFill 1057 0.34 0.93 0.01 171 XM_ProductURIs 1048 0.70 0.92 0.58 172 TooManyTo_005 1046 0.65 0.92 0.50 173 RCVD_IN_PSBL 1013 0.74 0.89 0.65 174 HTML_FONT_TINY_NORDNS 1010 0.34 0.89 0.04 175 XMSlimDrugH 1002 0.71 0.88 0.62 176 XM_SendGrid 1002 1.11 0.88 1.24 177 T_MONEY_PERCENT 998 0.46 0.88 0.23 178 TR_LOTS_OF_MONEY2 998 0.46 0.88 0.23 179 THIS_AD 965 0.64 0.85 0.52 180 RCVD_IN_IADB_SPF 963 1.84 0.85 2.39 181 XMPhish14 956 0.47 0.84 0.27 182 TR_MetaPhish_Combo_01 954 0.74 0.84 0.69 183 XM_B_DNDMA 950 0.65 0.84 0.55 184 XM_H_PHPMailer 937 0.63 0.82 0.52 185 GOOG_STO_IMG_NOHTML 899 0.39 0.79 0.17 186 FORGED_GMAIL_RCVD 892 0.56 0.79 0.44 187 HTML_FONT_FACE_BAD 886 0.65 0.78 0.57 188 NML_ADSP_CUSTOM_MED 874 0.53 0.77 0.40 189 RCVD_IN_IADB_DK 874 1.67 0.77 2.16 190 RCVD_IN_IADB_SENDERID 868 1.71 0.76 2.22 191 HTML_TAG_BALANCE_HEAD 867 0.35 0.76 0.12 192 URIBL_DBL_SPAM 847 0.27 0.75 0.01 193 XM_Dr_From 828 0.34 0.73 0.12 194 DEAR_FRIEND 824 0.28 0.73 0.04 195 XMHTML_After_End 788 0.36 0.69 0.18 196 TM2_M_OBFU_COMMENT 779 0.46 0.69 0.33 197 NORDNS_LOW_CONTRAST 767 0.36 0.68 0.18 198 HTML_OBFUSCATE_05_10 761 0.30 0.67 0.10 199 TM2_M_A_HREF_HREF 759 0.34 0.67 0.15 200 HELO_DYNAMIC_SPLIT_IP 758 0.25 0.67 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 175637 88.90 96.20 84.90 2 RELAYCOUNTRY_US 170161 83.88 86.84 82.25 3 DKIM_SIGNED 157213 81.77 92.29 75.99 4 XM_DK_Pass 155378 80.26 89.66 75.11 5 DKIM_VALID 154569 79.77 88.97 74.72 6 XM_B_Unicode 153326 78.75 87.19 74.11 7 DKIM_VALID_AU 133357 67.60 73.31 64.46 8 BAYES_50 118851 49.62 35.38 57.45 9 XMListUnsubscribeExists 115747 63.46 77.12 55.95 10 DCC_CHECK_NEGATIVE 114650 43.64 22.19 55.42 11 XM_B_SpammyWords 100313 57.46 73.79 48.49 12 DCC_CHECK 92180 56.34 77.80 44.56 13 XM_B_Unicode3 90497 44.46 45.76 43.74 14 HTML_FONT_LOW_CONTRAST 69444 36.39 41.52 33.57 15 RCVD_IN_MSPIKE_H2 68228 36.61 43.22 32.98 16 DKIM_VALID_EF 61682 28.96 27.41 29.82 17 FVGT_m_MULTI_ODD 57180 31.62 38.87 27.64 18 LOC_TINY_FONT_1 56989 33.18 43.44 27.55 19 MIME_HTML_ONLY 47962 22.51 21.30 23.18 20 XM_B_SpammyWords2 47591 29.79 42.15 23.00 21 T_TM2_M_HEADER_IN_MSG 46607 22.14 21.44 22.53 22 XMSubLong 43500 20.16 18.59 21.03 23 T_KAM_HTML_FONT_INVALID 43087 23.69 28.91 20.83 24 TR_XM_DK_Unsub 34897 18.41 21.21 16.87 25 XM_Multi_Part_URI 34695 17.90 19.95 16.77 26 USER_IN_DEF_DKIM_WL 34623 11.99 3.34 16.74 27 ALL_TRUSTED 27674 9.03 1.10 13.38 28 UNPARSEABLE_RELAY 23201 12.60 15.11 11.21 29 XM_B_Unsub 22432 11.77 13.45 10.84 30 BAYES_60 21636 9.68 8.25 10.46 31 BAYES_00 20562 6.57 0.43 9.94 32 XM_DKIMWhitelistDomains 19166 6.00 0.05 9.26 33 MPART_ALT_DIFF 16659 6.99 5.05 8.05 34 TR_MAX_INTL_RELAY 15841 10.25 14.97 7.66 35 XM_B_SpammyWords3 15618 9.53 13.15 7.55 36 XM_DK_Undo_02 15495 21.45 46.86 7.49 37 XM_Evil_Numbers_Gen 15404 7.22 6.80 7.45 38 LotsOfNums_01 15364 7.13 6.59 7.43 39 LOTS_OF_MONEY 15354 11.10 17.80 7.42 40 RCVD_IN_VALIDITY_SAFE 15268 6.15 3.92 7.38 41 TR_XM_BayesUnsub 14519 9.10 12.90 7.02 42 XM_H_GMP 14175 6.04 4.56 6.85 43 TR_XM_DK_Bayes 13580 4.34 0.30 6.56 44 TR_XM_DK_Bayes1 13502 4.32 0.29 6.53 45 FSL_BULK_SIG 13415 6.52 6.59 6.48 46 XM_B_PhoneNumber 13300 5.61 4.11 6.43 47 XMStrtUSub 12872 5.55 4.34 6.22 48 MIME_HTML_ONLY_MULTI 12754 5.12 3.22 6.17 49 RCVD_IN_VALIDITY_CERTIFIED 12301 4.95 3.14 5.95 50 HTML_IMAGE_RATIO_02 12154 6.11 6.53 5.87 51 T_TooManySym_01 12087 4.45 1.91 5.84 52 TR_XM_DK_Bayes2 11969 3.81 0.21 5.79 53 TooManyTo_001 11808 5.26 4.44 5.71 54 TM2_M_URI_OPT_OUT 11719 4.37 2.01 5.66 55 BOTNET_IPINHOSTNAME 11690 8.25 12.98 5.65 56 TR_XM_SpammyWords4 11631 9.36 16.17 5.62 57 RCVD_IN_MSPIKE_H3 11419 4.38 2.30 5.52 58 RCVD_IN_MSPIKE_WL 11419 4.38 2.30 5.52 59 BAYES_99 11409 17.08 38.15 5.51 60 IN_ZIMBRA_NJ_WHITELIST 11262 3.54 0.06 5.44 61 XM_H_Long_From01 10221 4.64 4.10 4.94 62 XM_UncommonTLD01 9799 4.70 4.63 4.74 63 BAYES_80 9205 6.12 9.17 4.45 64 RELAYCOUNTRY_META 8937 7.87 14.34 4.32 65 BAYES_999 8782 13.44 30.17 4.25 66 BAYES_40 8752 3.24 1.43 4.23 67 XM_H_Trusted_IP 8695 2.71 0.00 4.20 68 HTML_IMAGE_RATIO_04 8547 4.37 4.80 4.13 69 ANY_BOUNCE_MESSAGE 8469 3.09 1.25 4.09 70 BOUNCE_MESSAGE 8469 3.09 1.25 4.09 71 XMSubMetaSx_00 7705 4.28 5.30 3.72 72 XM_B_SpammyTLD 7535 3.50 3.25 3.64 73 MIME_QP_LONG_LINE 7383 2.99 1.95 3.57 74 TR_XM_DKIM_Undo 7140 14.76 35.36 3.45 75 TO_MALFORMED 7066 2.21 0.02 3.42 76 XM_Body_Dirty_Words 7043 4.86 7.52 3.40 77 T_TooManySym_02 6987 2.39 0.59 3.38 78 INVALID_MSGID 6828 2.19 0.16 3.30 79 T_REMOTE_IMAGE 6658 2.66 1.65 3.22 80 BAYES_95 6634 4.04 5.55 3.21 81 BAYES_20 6250 2.31 1.02 3.02 82 TR_XM_SpammyRelay 6059 5.73 10.83 2.93 83 XMNumbers 5816 2.76 2.67 2.81 84 XM_B_Phish_Phrases 5652 2.89 3.18 2.73 85 RCVD_IN_IADB_LISTED 5434 2.04 0.98 2.63 86 TR_DCC_Bayes_99 5342 12.04 29.27 2.58 87 MIME_HTML_MOSTLY 5199 2.85 3.46 2.51 88 XM_SPF_SoftFail 5026 3.37 5.09 2.43 89 RCVD_IN_IADB_SPF 4950 1.84 0.85 2.39 90 HTML_IMAGE_RATIO_08 4883 2.62 3.10 2.36 91 URI_NOVOWEL 4853 1.88 1.04 2.35 92 FROM_EXCESS_BASE64 4707 2.09 1.76 2.28 93 XM_CamelCaseFrm001 4690 2.60 3.21 2.27 94 T_XMDrugObfuBody_14 4627 2.97 4.31 2.24 95 RCVD_IN_IADB_SENDERID 4602 1.71 0.76 2.22 96 HTML_IMAGE_RATIO_06 4569 2.90 4.16 2.21 97 TVD_RCVD_IP 4523 1.76 0.98 2.19 98 RCVD_IN_IADB_DK 4477 1.67 0.77 2.16 99 XM_PDF 4477 1.53 0.37 2.16 100 XMSexyCombo_05 4103 2.56 3.62 1.98 101 RELAYCOUNTRY_CA 4100 3.26 5.57 1.98 102 UNTRUSTED_Relay 4004 3.11 5.26 1.94 103 XMBSHREFv2 3860 1.32 0.31 1.87 104 MAILING_LIST_MULTI 3747 1.72 1.56 1.81 105 T_XMDrugObfuBody_08 3700 2.33 3.31 1.79 106 TR_LOTS_OF_MONEY3 3680 3.77 7.41 1.78 107 BAYES_05 3578 1.34 0.62 1.73 108 XM_B_Investor 3557 2.51 3.94 1.72 109 XM_DK_Undo_01 3510 1.64 1.52 1.70 110 TR_XM_UnparsRelay 3434 3.86 7.86 1.66 111 TVD_SPACE_RATIO 3372 1.09 0.11 1.63 112 TR_XM_PhishingBody 3345 2.42 3.89 1.62 113 BOTNET 3338 3.68 7.45 1.61 114 IN_HORDE_ADDRESS_BOOK 3335 1.08 0.11 1.61 115 XMDiploma_00 3299 1.95 2.60 1.59 116 XMBrknScrpt_02 3146 1.98 2.83 1.52 117 TooManyTo_002 3111 1.35 1.06 1.50 118 RCVD_IN_IADB_VOUCHED 3108 1.17 0.56 1.50 119 XM_OfRef6 2973 2.21 3.60 1.44 120 HTML_MIME_NO_HTML_TAG 2874 1.23 0.95 1.39 121 XMSubNoVowel 2784 0.99 0.35 1.35 122 URI_TRY_3LD 2752 1.85 2.79 1.33 123 XM_B_Unsub2 2738 1.56 1.98 1.32 124 XMGappySubj_01 2650 0.91 0.24 1.28 125 DKIM_INVALID 2644 2.00 3.31 1.28 126 TR_Symld_Words 2625 1.03 0.61 1.27 127 TM2_M_VERY_LONG_WORD 2583 1.95 3.22 1.25 128 XM_SendGrid 2565 1.11 0.88 1.24 129 XMBdyGiftCard01 2457 1.43 1.88 1.19 130 T_TooManySym_03 2452 0.83 0.18 1.19 131 XMBody_17 2419 3.25 7.03 1.17 132 T_XMHurry_00 2385 2.23 4.20 1.15 133 URI_HEX 2324 1.07 0.97 1.12 134 TR_XM_SpammyWords2 2317 6.11 15.18 1.12 135 RCVD_IN_IADB_OPTIN 2219 0.82 0.37 1.07 136 XM_H_Long_From02 2196 1.05 1.03 1.06 137 TR_XM_SpammyWords5 2178 1.93 3.53 1.05 138 XM_GoogleGroups 2159 0.88 0.59 1.04 139 KHOP_HELO_FCRDNS 2154 1.19 1.46 1.04 140 SUBJ_ALL_CAPS 2144 1.58 2.56 1.04 141 XMGappySubj_02 2137 0.68 0.03 1.03 142 T_TVD_MIME_NO_HEADERS 2096 0.66 0.02 1.01 143 XM_B_COPY_HTML 2040 1.06 1.20 0.99 144 XMSubMetaI_00 2027 1.02 1.08 0.98 145 USER_IN_WELCOMELIST 1900 0.59 0.00 0.92 146 USER_IN_WHITELIST 1900 0.59 0.00 0.92 147 FROM_GOV_DKIM_AU 1870 0.61 0.08 0.90 148 PLING_QUERY 1870 0.94 1.00 0.90 149 XM_B_SEO 1864 2.04 4.11 0.90 150 XMBody_95 1853 0.62 0.12 0.90 151 RCVD_IN_BL_SPAMCOP_NET 1822 3.88 9.33 0.88 152 T_FILL_THIS_FORM_SHORT 1788 1.12 1.58 0.86 153 XMStockSpam_06 1751 1.32 2.18 0.85 154 XM_UB50 1728 1.55 2.84 0.84 155 XM_B_SpammyWords4 1710 1.32 2.21 0.83 156 TR_XM_DK_SendGrid 1696 0.75 0.62 0.82 157 TR_XM_Base64_M1 1685 0.89 1.02 0.81 158 HTML_EXTRA_CLOSE 1665 0.53 0.02 0.80 159 NO_DNS_FOR_FROM 1639 0.66 0.41 0.79 160 TooManyTo_003 1609 0.85 0.99 0.78 161 MPART_ALT_DIFF_COUNT 1518 1.00 1.49 0.73 162 XMSubMetaSxObfu_02 1510 0.69 0.62 0.73 163 XM_TLDProd2 1503 0.53 0.17 0.73 164 T_XMDrugObfuBody_00 1483 0.91 1.26 0.72 165 HTML_TAG_BALANCE_BODY 1478 1.21 2.10 0.71 166 DKIM_ADSP_CUSTOM_MED 1444 0.79 0.95 0.70 167 RELAYCOUNTRY_AU 1428 1.18 2.08 0.69 168 TR_MetaPhish_Combo_01 1423 0.74 0.84 0.69 169 RCVD_IN_PSBL 1354 0.74 0.89 0.65 170 XMSlimDrugH 1286 0.71 0.88 0.62 171 XMGenDplmaNmb 1276 0.76 1.03 0.62 172 HTTPS_HTTP_MISMATCH 1225 0.76 1.05 0.59 173 XMPhish30 1223 0.82 1.24 0.59 174 TooManyTo_004 1207 0.71 0.94 0.58 175 XM_ProductURIs 1206 0.70 0.92 0.58 176 HTML_FONT_FACE_BAD 1189 0.65 0.78 0.57 177 XM_B_DNDMA 1131 0.65 0.84 0.55 178 XM_E_Blogspot 1100 0.38 0.09 0.53 179 TR_XM_SPAMCOP 1091 3.12 7.85 0.53 180 THIS_AD 1083 0.64 0.85 0.52 181 T_TooManySym_04 1080 0.36 0.05 0.52 182 XM_H_PHPMailer 1068 0.63 0.82 0.52 183 XM_B_FormFill 1062 0.36 0.09 0.51 184 TooManyTo_005 1035 0.65 0.92 0.50 185 XMLngstWrd_00 963 0.45 0.41 0.47 186 SpammyFromTLD_01 936 0.81 1.46 0.45 187 TR_XM_SEO4 933 1.48 3.34 0.45 188 XMPhish08 929 0.52 0.66 0.45 189 FORGED_GMAIL_RCVD 916 0.56 0.79 0.44 190 SHOPIFY_IMG_NOT_RCVD_SFY 895 0.63 0.98 0.43 191 DKIM_ADSP_NXDOMAIN 869 0.61 0.96 0.42 192 XM_B_REG_HTML 852 0.47 0.57 0.41 193 XMNoVowels 848 0.32 0.15 0.41 194 HELO_NODOT 839 0.36 0.29 0.41 195 HELO_NO_DOMAIN 838 0.36 0.29 0.41 196 NML_ADSP_CUSTOM_MED 835 0.53 0.77 0.40 197 LONGLN_LOW_CONTRAST 831 0.98 2.02 0.40 198 RDNS_DYNAMIC 811 0.62 1.04 0.39 199 XM_S_SubURI 797 0.27 0.05 0.39 200 T_OBFU_PDF_ATTACH 796 0.28 0.10 0.38 ----------------------------------------------------------------------