Email: 315136 Autolearn: 0 AvgScore: 5.22 AvgScanTime: 1.14 sec Spam: 117572 Autolearn: 0 AvgScore: 13.63 AvgScanTime: 1.22 sec Ham: 197564 Autolearn: 0 AvgScore: 0.22 AvgScanTime: 1.10 sec Time Spent Running SA: 100.20 hours Time Spent Processing Spam: 39.80 hours Time Spent Processing Ham: 60.40 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 112848 86.29 95.98 80.52 2 DKIM_SIGNED 108974 80.58 92.69 73.37 3 XM_DK_Pass 106301 79.08 90.41 72.34 4 DKIM_VALID 105450 78.48 89.69 71.80 5 XM_B_Unicode 103123 75.48 87.71 68.19 6 RELAYCOUNTRY_US 100796 80.65 85.73 77.63 7 DCC_CHECK 91694 56.97 77.99 44.45 8 XMListUnsubscribeExists 89131 62.08 75.81 53.91 9 DKIM_VALID_AU 89072 67.17 75.76 62.07 10 XM_B_SpammyWords 86482 55.72 73.56 45.11 11 XM_DK_Undo_02 61453 23.51 52.27 6.40 12 LOC_TINY_FONT_1 58623 37.25 49.86 29.75 13 XM_B_Unicode3 52372 44.45 44.54 44.39 14 BAYES_99 52017 19.93 44.24 5.47 15 XM_B_SpammyWords2 50300 28.75 42.78 20.41 16 RCVD_IN_MSPIKE_H2 49740 35.80 42.31 31.93 17 TR_XM_DKIM_Undo 46453 16.61 39.51 2.99 18 HTML_FONT_LOW_CONTRAST 45730 33.29 38.90 29.95 19 BAYES_999 43752 16.58 37.21 4.30 20 FVGT_m_MULTI_ODD 42059 29.09 35.77 25.11 21 TR_DCC_Bayes_99 40228 14.16 34.22 2.22 22 BAYES_50 37023 49.22 31.49 59.77 23 T_KAM_HTML_FONT_INVALID 34682 23.16 29.50 19.39 24 DKIM_VALID_EF 29625 25.88 25.20 26.28 25 MIME_HTML_ONLY 26915 22.06 22.89 21.56 26 DCC_CHECK_NEGATIVE 25862 43.02 22.00 55.52 27 T_TM2_M_HEADER_IN_MSG 24104 23.09 20.50 24.63 28 XMSubLong 23917 21.63 20.34 22.40 29 TR_XM_DK_Unsub 22151 15.53 18.84 13.56 30 TR_XM_SpammyWords2 22033 7.60 18.74 0.98 31 XM_Multi_Part_URI 21901 18.65 18.63 18.66 32 RELAYCOUNTRY_META 17791 8.49 15.13 4.54 33 XM_B_Unsub 17306 10.09 14.72 7.34 34 UNPARSEABLE_RELAY 17159 12.20 14.59 10.77 35 LOTS_OF_MONEY 17009 9.05 14.47 5.83 36 TR_XM_BayesUnsub 16777 9.12 14.27 6.06 37 TR_MAX_INTL_RELAY 16566 9.71 14.09 7.11 38 XM_B_SpammyWords3 16439 9.02 13.98 6.07 39 TR_XM_SpammyWords4 15044 7.39 12.80 4.18 40 BOTNET_IPINHOSTNAME 14108 6.89 12.00 3.85 41 TR_XM_SpammyRelay 13115 6.01 11.15 2.94 42 TR_XM_UnparsRelay 10526 4.39 8.95 1.67 43 RCVD_IN_BL_SPAMCOP_NET 10420 3.83 8.86 0.83 44 XMBody_17 10255 3.68 8.72 0.68 45 BAYES_80 10181 5.89 8.66 4.24 46 XM_Evil_Numbers_Gen 9611 8.80 8.17 9.17 47 BOTNET 9065 3.81 7.71 1.48 48 BAYES_60 8911 9.77 7.58 11.08 49 FSL_BULK_SIG 8824 7.12 7.51 6.89 50 TR_XM_SPAMCOP 8651 3.01 7.36 0.43 51 HTML_IMAGE_RATIO_02 8301 6.23 7.06 5.74 52 XM_Body_Dirty_Words 7986 4.40 6.79 2.98 53 MPART_ALT_DIFF 7458 5.23 6.34 4.57 54 RCVD_IN_VALIDITY_SAFE 7154 6.55 6.08 6.82 55 RELAYCOUNTRY_CA 7074 3.43 6.02 1.90 56 LotsOfNums_01 6962 7.27 5.92 8.07 57 XM_H_Long_From01 6832 5.10 5.81 4.68 58 XMSubMetaSx_00 6767 4.85 5.76 4.31 59 UNTRUSTED_Relay 6665 3.13 5.67 1.62 60 XM_H_GMP 6494 5.65 5.52 5.73 61 HTML_IMAGE_RATIO_04 6277 4.75 5.34 4.40 62 HTML_IMAGE_RATIO_08 6137 3.37 5.22 2.27 63 XM_UncommonTLD01 6081 4.78 5.17 4.55 64 BAYES_95 6042 3.71 5.14 2.87 65 USER_IN_DEF_DKIM_WL 5859 12.85 4.98 17.53 66 XM_SPF_SoftFail 5638 2.67 4.80 1.40 67 TR_XM_SpammyWords5 5576 3.02 4.74 1.99 68 RCVD_IN_VALIDITY_CERTIFIED 5569 5.01 4.74 5.17 69 HTML_IMAGE_RATIO_06 5270 3.24 4.48 2.49 70 XM_B_Investor 5190 2.50 4.41 1.36 71 T_XMDrugObfuBody_14 5133 2.81 4.37 1.88 72 XM_B_PhoneNumber 5095 6.50 4.33 7.80 73 XMSexyCombo_05 5078 3.33 4.32 2.73 74 RCVD_IN_VALIDITY_RPBL 5042 1.73 4.29 0.20 75 XM_B_SEO 5025 2.20 4.27 0.96 76 XM_B_Phish_Phrases 5018 4.38 4.27 4.44 77 TooManyTo_001 4906 6.38 4.17 7.70 78 XMBrknScrpt_02 4860 2.64 4.13 1.75 79 MIME_HTML_MOSTLY 4731 3.27 4.02 2.82 80 XMStrtUSub 4619 4.99 3.93 5.62 81 TR_XM_SEO4 4503 1.81 3.83 0.61 82 XM_CamelCaseFrm001 4332 3.25 3.68 3.00 83 TR_XM_PhishingBody 4295 2.37 3.65 1.61 84 TM2_M_VERY_LONG_WORD 4286 2.27 3.65 1.46 85 TR_LOTS_OF_MONEY3 4277 1.70 3.64 0.55 86 XM_OfRef6 4268 1.98 3.63 1.01 87 MIME_HTML_ONLY_MULTI 4113 2.84 3.50 2.45 88 XM_URI_RBL 4070 1.55 3.46 0.41 89 SUBJ_ALL_CAPS 4068 2.12 3.46 1.32 90 RCVD_IN_MSPIKE_WL 4024 3.99 3.42 4.33 91 RCVD_IN_MSPIKE_H3 4024 3.99 3.42 4.33 92 XM_B_SpammyTLD 3946 5.17 3.36 6.26 93 DKIM_INVALID 3524 2.10 3.00 1.57 94 XM_UB50 3513 1.70 2.99 0.93 95 RELAYCOUNTRY_AU 3441 1.74 2.93 1.04 96 XMNumbers 3299 3.27 2.81 3.54 97 TM2_M_URI_OPT_OUT 2995 2.08 2.55 1.80 98 T_XMDrugObfuBody_08 2947 1.96 2.51 1.63 99 FROM_EXCESS_BASE64 2889 2.47 2.46 2.48 100 XM_B_SpammyWords4 2755 1.33 2.34 0.73 101 XMDiploma_00 2737 1.80 2.33 1.49 102 TR_Caps_n_Bayes_99 2546 0.84 2.17 0.05 103 HTML_TAG_BALANCE_BODY 2457 1.20 2.09 0.66 104 T_TooManySym_01 2319 4.57 1.97 6.11 105 XM_B_Unsub2 2262 1.50 1.92 1.24 106 XMBdyGiftCard01 2244 1.57 1.91 1.38 107 T_XMHurry_00 2153 1.06 1.83 0.60 108 TR_XM_NoHeaderRelay 2139 0.73 1.82 0.08 109 XM_HighProb1 2121 0.68 1.80 0.01 110 KHOP_HELO_FCRDNS 2089 1.61 1.78 1.51 111 AC_BR_BONANZA 2033 0.72 1.73 0.11 112 SpammyFromTLD_01 1992 0.94 1.69 0.50 113 MAILING_LIST_MULTI 1977 2.05 1.68 2.27 114 T_REMOTE_IMAGE 1966 2.57 1.67 3.10 115 URI_NOVOWEL 1940 3.54 1.65 4.66 116 T_XMDrugObfuBody_00 1911 1.18 1.63 0.91 117 URI_TRY_3LD 1766 1.21 1.50 1.03 118 XM_DK_Undo_01 1764 1.63 1.50 1.71 119 T_MONEY_PERCENT 1742 0.73 1.48 0.29 120 TR_LOTS_OF_MONEY2 1742 0.73 1.48 0.29 121 URI_HEX 1737 1.08 1.48 0.84 122 MIME_QP_LONG_LINE 1720 2.79 1.46 3.58 123 XMStockSpam_06 1712 1.49 1.46 1.51 124 SpammyFromTLD_02 1698 0.69 1.44 0.23 125 TR_XM_PHPDW 1686 0.69 1.43 0.24 126 XMSubMetaI_00 1674 1.01 1.42 0.76 127 TR_XM_PHPForged 1641 0.67 1.40 0.24 128 XM_B_COPY_HTML 1633 1.08 1.39 0.89 129 XMReplyNow 1611 0.64 1.37 0.20 130 TR_XM_FormFill2 1596 0.66 1.36 0.25 131 XM_H_PHPOS 1583 0.64 1.35 0.22 132 T_FILL_THIS_FORM_SHORT 1574 0.87 1.34 0.60 133 THIS_AD 1568 0.95 1.33 0.72 134 T_STY_INVIS_DIRECT 1556 0.66 1.32 0.27 135 URIBL_DBL_SPAM 1536 0.50 1.31 0.02 136 XM_ProductURIs 1536 1.39 1.31 1.43 137 TVD_RCVD_IP 1480 0.91 1.26 0.70 138 XMPhish30 1454 0.87 1.24 0.65 139 TR_Symld_Words 1438 1.86 1.22 2.24 140 DIET_1 1414 0.61 1.20 0.26 141 MPART_ALT_DIFF_COUNT 1393 0.76 1.18 0.50 142 TR_XM_INV_DKIM 1380 0.48 1.17 0.07 143 BAYES_40 1372 3.69 1.17 5.19 144 XM_H_Undi_Recip 1337 0.49 1.14 0.10 145 RDNS_DYNAMIC 1330 0.64 1.13 0.35 146 ALL_TRUSTED 1320 12.00 1.12 18.48 147 RELAYCOUNTRY_IN 1315 0.46 1.12 0.07 148 RCVD_IN_PSBL 1303 0.50 1.11 0.13 149 PDS_RDNS_DYNAMIC_FP 1302 0.48 1.11 0.11 150 XM_B_DNDMA 1293 0.97 1.10 0.90 151 BOTNET_NORDNS 1283 0.41 1.09 0.01 152 TR_XM_InvalidRelay 1275 0.42 1.08 0.02 153 SHOPIFY_IMG_NOT_RCVD_SFY 1270 0.71 1.08 0.49 154 LongTLD 1245 0.51 1.06 0.18 155 XM_B_REG_HTML 1240 0.66 1.05 0.43 156 XM_B_Phish66 1216 0.61 1.03 0.35 157 TR_Mismatch_TLD_01 1199 0.55 1.02 0.27 158 XM_SendGrid 1189 1.06 1.01 1.09 159 TR_XM_Base64_M1 1160 0.77 0.99 0.65 160 HTML_TAG_BALANCE_CENTER 1159 0.54 0.99 0.27 161 ANY_BOUNCE_MESSAGE 1148 3.26 0.98 4.61 162 BOUNCE_MESSAGE 1147 3.26 0.98 4.61 163 HELO_DYNAMIC_SPLIT_IP 1097 0.36 0.93 0.01 164 XM_S_SpammyWords 1083 0.39 0.92 0.07 165 TR_XM_Spammywords 1083 0.39 0.92 0.07 166 TooManyTo_002 1083 2.46 0.92 3.38 167 PLING_QUERY 1047 0.60 0.89 0.43 168 BAYES_20 1027 2.16 0.87 2.93 169 TR_Mismatch_TLD_02 1007 0.35 0.86 0.05 170 TM2_M_OBFU_COMMENT 1005 0.58 0.85 0.41 171 TR_XM_Base64_L1 987 0.44 0.84 0.20 172 TooManyTo_003 968 0.86 0.82 0.89 173 TR_MetaPhish_Combo_01 959 0.70 0.82 0.63 174 XM_UB60 951 0.35 0.81 0.08 175 TooManyTo_004 949 0.73 0.81 0.69 176 HTML_MIME_NO_HTML_TAG 949 1.26 0.81 1.54 177 TR_XM_Undi_Recip19 942 0.34 0.80 0.06 178 FSL_CTYPE_WIN1251 941 0.30 0.80 0.00 179 FROM_MISSP_REPLYTO 936 0.30 0.80 0.00 180 AXB_XMAILER_MIMEOLE_OL_024C2 934 0.30 0.79 0.00 181 XM_OfRef7 934 0.46 0.79 0.25 182 FORGED_MUA_OUTLOOK 934 0.32 0.79 0.04 183 TooManyTo_005 926 0.67 0.79 0.60 184 XMSexyCombo_01 915 0.43 0.78 0.22 185 TR_XM_DK_SendGrid 914 0.77 0.78 0.76 186 JH_SPAMMY_HEADERS 912 0.29 0.78 0.00 187 MISSING_HEADERS 907 0.45 0.77 0.25 188 FSL_NEW_HELO_USER 887 0.28 0.75 0.00 189 DKIM_ADSP_CUSTOM_MED 881 0.79 0.75 0.81 190 FROM_MISSP_EH_MATCH 870 0.28 0.74 0.00 191 SUBJ_DOLLARS 865 0.48 0.74 0.32 192 XPRIO 859 0.28 0.73 0.01 193 HTML_TEXT_INVISIBLE_STYLE 857 0.46 0.73 0.29 194 XM_H_PHPMailer 851 0.73 0.72 0.73 195 FROM_MISSPACED 848 0.27 0.72 0.00 196 TR_XM_FormFill 844 0.28 0.72 0.02 197 AC_HTML_NONSENSE_TAGS 823 0.29 0.70 0.04 198 HTTPS_HTTP_MISMATCH 820 0.58 0.70 0.51 199 XMHTML_After_End 819 0.39 0.70 0.21 200 T_Symld_Words_02 810 0.40 0.69 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159070 86.29 95.98 80.52 2 RELAYCOUNTRY_US 153360 80.65 85.73 77.63 3 DKIM_SIGNED 144960 80.58 92.69 73.37 4 XM_DK_Pass 142921 79.08 90.41 72.34 5 DKIM_VALID 141856 78.48 89.69 71.80 6 XM_B_Unicode 134726 75.48 87.71 68.19 7 DKIM_VALID_AU 122619 67.17 75.76 62.07 8 BAYES_50 118077 49.22 31.49 59.77 9 DCC_CHECK_NEGATIVE 109695 43.02 22.00 55.52 10 XMListUnsubscribeExists 106508 62.08 75.81 53.91 11 XM_B_SpammyWords 89121 55.72 73.56 45.11 12 DCC_CHECK 87824 56.97 77.99 44.45 13 XM_B_Unicode3 87708 44.45 44.54 44.39 14 RCVD_IN_MSPIKE_H2 63081 35.80 42.31 31.93 15 HTML_FONT_LOW_CONTRAST 59165 33.29 38.90 29.95 16 LOC_TINY_FONT_1 58776 37.25 49.86 29.75 17 DKIM_VALID_EF 51917 25.88 25.20 26.28 18 FVGT_m_MULTI_ODD 49611 29.09 35.77 25.11 19 T_TM2_M_HEADER_IN_MSG 48652 23.09 20.50 24.63 20 XMSubLong 44250 21.63 20.34 22.40 21 MIME_HTML_ONLY 42597 22.06 22.89 21.56 22 XM_B_SpammyWords2 40314 28.75 42.78 20.41 23 T_KAM_HTML_FONT_INVALID 38303 23.16 29.50 19.39 24 XM_Multi_Part_URI 36867 18.65 18.63 18.66 25 ALL_TRUSTED 36501 12.00 1.12 18.48 26 USER_IN_DEF_DKIM_WL 34636 12.85 4.98 17.53 27 TR_XM_DK_Unsub 26791 15.53 18.84 13.56 28 BAYES_60 21891 9.77 7.58 11.08 29 UNPARSEABLE_RELAY 21286 12.20 14.59 10.77 30 XM_Evil_Numbers_Gen 18125 8.80 8.17 9.17 31 XM_DKIMWhitelistDomains 17709 5.63 0.03 8.96 32 LotsOfNums_01 15949 7.27 5.92 8.07 33 XM_B_PhoneNumber 15401 6.50 4.33 7.80 34 TooManyTo_001 15205 6.38 4.17 7.70 35 XM_B_Unsub 14501 10.09 14.72 7.34 36 TR_MAX_INTL_RELAY 14043 9.71 14.09 7.11 37 FSL_BULK_SIG 13614 7.12 7.51 6.89 38 BAYES_00 13578 4.46 0.41 6.87 39 RCVD_IN_VALIDITY_SAFE 13481 6.55 6.08 6.82 40 XM_DK_Undo_02 12635 23.51 52.27 6.40 41 XM_B_SpammyTLD 12362 5.17 3.36 6.26 42 T_TooManySym_01 12077 4.57 1.97 6.11 43 XM_B_SpammyWords3 11992 9.02 13.98 6.07 44 TR_XM_BayesUnsub 11966 9.12 14.27 6.06 45 LOTS_OF_MONEY 11518 9.05 14.47 5.83 46 HTML_IMAGE_RATIO_02 11347 6.23 7.06 5.74 47 TR_XM_DK_Bayes 11332 3.70 0.29 5.74 48 XM_H_GMP 11312 5.65 5.52 5.73 49 IN_ZIMBRA_NJ_WHITELIST 11235 3.58 0.05 5.69 50 TR_XM_DK_Bayes1 11194 3.66 0.28 5.67 51 XMStrtUSub 11108 4.99 3.93 5.62 52 BAYES_99 10803 19.93 44.24 5.47 53 BAYES_40 10250 3.69 1.17 5.19 54 RCVD_IN_VALIDITY_CERTIFIED 10222 5.01 4.74 5.17 55 TR_XM_DK_Bayes2 9760 3.16 0.17 4.94 56 XM_H_Long_From01 9242 5.10 5.81 4.68 57 URI_NOVOWEL 9212 3.54 1.65 4.66 58 ANY_BOUNCE_MESSAGE 9113 3.26 0.98 4.61 59 BOUNCE_MESSAGE 9113 3.26 0.98 4.61 60 MPART_ALT_DIFF 9038 5.23 6.34 4.57 61 XM_UncommonTLD01 8994 4.78 5.17 4.55 62 RELAYCOUNTRY_META 8968 8.49 15.13 4.54 63 XM_B_Phish_Phrases 8776 4.38 4.27 4.44 64 HTML_IMAGE_RATIO_04 8697 4.75 5.34 4.40 65 RCVD_IN_MSPIKE_H3 8548 3.99 3.42 4.33 66 RCVD_IN_MSPIKE_WL 8548 3.99 3.42 4.33 67 XMSubMetaSx_00 8520 4.85 5.76 4.31 68 BAYES_999 8505 16.58 37.21 4.30 69 BAYES_80 8374 5.89 8.66 4.24 70 TR_XM_SpammyWords4 8257 7.39 12.80 4.18 71 BOTNET_IPINHOSTNAME 7599 6.89 12.00 3.85 72 INVALID_MSGID 7119 2.32 0.18 3.60 73 T_TooManySym_02 7077 2.42 0.46 3.58 74 MIME_QP_LONG_LINE 7064 2.79 1.46 3.58 75 XMNumbers 6994 3.27 2.81 3.54 76 TO_MALFORMED 6699 2.14 0.03 3.39 77 TooManyTo_002 6676 2.46 0.92 3.38 78 T_REMOTE_IMAGE 6118 2.57 1.67 3.10 79 XM_CamelCaseFrm001 5920 3.25 3.68 3.00 80 TR_XM_DKIM_Undo 5906 16.61 39.51 2.99 81 XM_Body_Dirty_Words 5880 4.40 6.79 2.98 82 TR_XM_SpammyRelay 5811 6.01 11.15 2.94 83 BAYES_20 5791 2.16 0.87 2.93 84 BAYES_95 5664 3.71 5.14 2.87 85 MIME_HTML_MOSTLY 5575 3.27 4.02 2.82 86 XMSexyCombo_05 5402 3.33 4.32 2.73 87 HTML_IMAGE_RATIO_06 4927 3.24 4.48 2.49 88 FROM_EXCESS_BASE64 4902 2.47 2.46 2.48 89 MIME_HTML_ONLY_MULTI 4846 2.84 3.50 2.45 90 RCVD_IN_IADB_LISTED 4740 1.75 0.66 2.40 91 MAILING_LIST_MULTI 4480 2.05 1.68 2.27 92 HTML_IMAGE_RATIO_08 4477 3.37 5.22 2.27 93 XM_PDF 4472 1.53 0.30 2.26 94 TR_Symld_Words 4416 1.86 1.22 2.24 95 TR_DCC_Bayes_99 4394 14.16 34.22 2.22 96 XM_B_FormFill 4351 1.42 0.09 2.20 97 RCVD_IN_IADB_SPF 4273 1.57 0.57 2.16 98 RCVD_IN_IADB_SENDERID 3950 1.45 0.52 2.00 99 TR_XM_SpammyWords5 3938 3.02 4.74 1.99 100 RCVD_IN_IADB_DK 3872 1.42 0.52 1.96 101 RELAYCOUNTRY_CA 3747 3.43 6.02 1.90 102 T_XMDrugObfuBody_14 3718 2.81 4.37 1.88 103 XM_TLDProd2 3678 1.24 0.19 1.86 104 TM2_M_URI_OPT_OUT 3554 2.08 2.55 1.80 105 XMBrknScrpt_02 3459 2.64 4.13 1.75 106 XM_DK_Undo_01 3375 1.63 1.50 1.71 107 IN_HORDE_ADDRESS_BOOK 3300 1.07 0.06 1.67 108 TR_XM_UnparsRelay 3295 4.39 8.95 1.67 109 TVD_SPACE_RATIO 3281 1.09 0.13 1.66 110 T_XMDrugObfuBody_08 3215 1.96 2.51 1.63 111 UNTRUSTED_Relay 3203 3.13 5.67 1.62 112 TR_XM_PhishingBody 3176 2.37 3.65 1.61 113 BAYES_05 3134 1.16 0.44 1.59 114 DKIM_INVALID 3104 2.10 3.00 1.57 115 HTML_MIME_NO_HTML_TAG 3034 1.26 0.81 1.54 116 RCVD_IN_IADB_VOUCHED 3000 1.09 0.37 1.52 117 XMStockSpam_06 2989 1.49 1.46 1.51 118 KHOP_HELO_FCRDNS 2977 1.61 1.78 1.51 119 XMDiploma_00 2947 1.80 2.33 1.49 120 BOTNET 2932 3.81 7.71 1.48 121 TM2_M_VERY_LONG_WORD 2879 2.27 3.65 1.46 122 XM_ProductURIs 2833 1.39 1.31 1.43 123 XM_SPF_SoftFail 2762 2.67 4.80 1.40 124 XMBdyGiftCard01 2718 1.57 1.91 1.38 125 XM_B_Investor 2683 2.50 4.41 1.36 126 XMGappySubj_01 2664 0.91 0.19 1.35 127 SUBJ_ALL_CAPS 2599 2.12 3.46 1.32 128 T_TooManySym_03 2473 0.84 0.15 1.25 129 XM_B_Unsub2 2459 1.50 1.92 1.24 130 XM_RXBody 2300 0.90 0.46 1.16 131 XM_H_Long_From02 2275 0.97 0.66 1.15 132 XM_GoogleGroups 2214 0.90 0.54 1.12 133 XM_SendGrid 2159 1.06 1.01 1.09 134 XMGappySubj_02 2139 0.73 0.14 1.08 135 T_TVD_MIME_NO_HEADERS 2128 0.68 0.02 1.08 136 RCVD_IN_IADB_OPTIN 2072 0.74 0.22 1.05 137 RELAYCOUNTRY_AU 2046 1.74 2.93 1.04 138 URI_TRY_3LD 2034 1.21 1.50 1.03 139 XMLngstWrd_00 1993 0.88 0.66 1.01 140 XM_OfRef6 1986 1.98 3.63 1.01 141 TR_XM_SpammyWords2 1931 7.60 18.74 0.98 142 XM_B_SEO 1904 2.20 4.27 0.96 143 XMLngstWrd_01 1841 0.82 0.64 0.93 144 XM_UB50 1832 1.70 2.99 0.93 145 T_XMDrugObfuBody_00 1803 1.18 1.63 0.91 146 HTML_EXTRA_CLOSE 1798 0.58 0.04 0.91 147 XM_B_DNDMA 1777 0.97 1.10 0.90 148 XM_B_COPY_HTML 1763 1.08 1.39 0.89 149 TooManyTo_003 1752 0.86 0.82 0.89 150 URI_HEX 1664 1.08 1.48 0.84 151 RCVD_IN_BL_SPAMCOP_NET 1645 3.83 8.86 0.83 152 XMLngstWrd_02 1621 0.74 0.60 0.82 153 DKIM_ADSP_CUSTOM_MED 1594 0.79 0.75 0.81 154 XMBody_95 1510 0.51 0.09 0.76 155 TR_XM_DK_SendGrid 1504 0.77 0.78 0.76 156 XMSubMetaI_00 1501 1.01 1.42 0.76 157 USER_IN_WHITELIST 1479 0.47 0.00 0.75 158 USER_IN_WELCOMELIST 1479 0.47 0.00 0.75 159 XM_H_PHPMailer 1446 0.73 0.72 0.73 160 XMLngstWrd_03 1436 0.67 0.56 0.73 161 XM_B_SpammyWords4 1435 1.33 2.34 0.73 162 THIS_AD 1431 0.95 1.33 0.72 163 TVD_RCVD_IP 1377 0.91 1.26 0.70 164 FILL_THIS_FORM 1376 0.55 0.29 0.70 165 TooManyTo_004 1361 0.73 0.81 0.69 166 XMBody_17 1346 3.68 8.72 0.68 167 XMLngstWrd_04 1313 0.61 0.51 0.66 168 HTML_TAG_BALANCE_BODY 1313 1.20 2.09 0.66 169 HTML_IMAGE_ONLY_12 1289 0.58 0.45 0.65 170 XMPhish30 1285 0.87 1.24 0.65 171 TR_XM_Base64_M1 1275 0.77 0.99 0.65 172 TR_MetaPhish_Combo_01 1252 0.70 0.82 0.63 173 TR_XM_SEO4 1208 1.81 3.83 0.61 174 TooManyTo_005 1183 0.67 0.79 0.60 175 T_XMHurry_00 1177 1.06 1.83 0.60 176 T_FILL_THIS_FORM_SHORT 1177 0.87 1.34 0.60 177 TR_LOTS_OF_MONEY3 1079 1.70 3.64 0.55 178 NML_ADSP_CUSTOM_MED 1051 0.58 0.66 0.53 179 T_TooManySym_04 1006 0.33 0.03 0.51 180 FORGED_GMAIL_RCVD 1004 0.54 0.59 0.51 181 XMGenDplmaNmb 1004 0.57 0.66 0.51 182 HTTPS_HTTP_MISMATCH 1003 0.58 0.70 0.51 183 MPART_ALT_DIFF_COUNT 991 0.76 1.18 0.50 184 SpammyFromTLD_01 984 0.94 1.69 0.50 185 XMNoVowels 964 0.39 0.22 0.49 186 SHOPIFY_IMG_NOT_RCVD_SFY 960 0.71 1.08 0.49 187 HTML_FONT_FACE_BAD 955 0.55 0.66 0.48 188 DKIM_ADSP_NXDOMAIN 895 0.52 0.63 0.45 189 PLING_QUERY 856 0.60 0.89 0.43 190 XM_B_REG_HTML 853 0.66 1.05 0.43 191 TM2_M_BODY_EMPTY 852 0.29 0.05 0.43 192 HTML_SHORT_LINK_IMG_2 850 0.42 0.41 0.43 193 TR_XM_SPAMCOP 843 3.01 7.36 0.43 194 XM_ShortIntro_01 837 0.50 0.62 0.42 195 XMOemUri 834 0.38 0.31 0.42 196 XMCapTrack 820 0.41 0.39 0.42 197 XM_URI_RBL 819 1.55 3.46 0.41 198 HELO_NODOT 818 0.36 0.26 0.41 199 HELO_NO_DOMAIN 816 0.36 0.26 0.41 200 TM2_M_OBFU_COMMENT 813 0.58 0.85 0.41 ----------------------------------------------------------------------