Email: 315386 Autolearn: 0 AvgScore: 5.11 AvgScanTime: 1.35 sec Spam: 118499 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 1.42 sec Ham: 196887 Autolearn: 0 AvgScore: -0.04 AvgScanTime: 1.30 sec Time Spent Running SA: 118.06 hours Time Spent Processing Spam: 46.75 hours Time Spent Processing Ham: 71.31 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 113340 87.26 95.65 82.22 2 DKIM_SIGNED 110167 83.14 92.97 77.23 3 XM_DK_Pass 107229 81.59 90.49 76.23 4 DKIM_VALID 106476 81.02 89.85 75.70 5 XM_B_Unicode 103592 77.31 87.42 71.23 6 RELAYCOUNTRY_US 103090 82.53 87.00 79.84 7 DCC_CHECK 93289 59.38 78.73 47.74 8 XMListUnsubscribeExists 90210 63.15 76.13 55.33 9 DKIM_VALID_AU 88399 68.24 74.60 64.41 10 XM_B_SpammyWords 87086 56.39 73.49 46.10 11 LOC_TINY_FONT_1 58407 38.66 49.29 32.26 12 XM_DK_Undo_02 57386 21.95 48.43 6.01 13 XM_B_Unicode3 56630 47.17 47.79 46.80 14 XM_B_SpammyWords2 51001 29.70 43.04 21.68 15 RCVD_IN_MSPIKE_H2 49234 37.24 41.55 34.65 16 HTML_FONT_LOW_CONTRAST 48515 36.03 40.94 33.07 17 BAYES_99 48212 18.23 40.69 4.72 18 TR_XM_DKIM_Undo 42959 15.17 36.25 2.49 19 FVGT_m_MULTI_ODD 41637 29.73 35.14 26.48 20 BAYES_50 40841 49.76 34.47 58.97 21 BAYES_999 39421 14.76 33.27 3.62 22 TR_DCC_Bayes_99 37539 13.11 31.68 1.94 23 T_KAM_HTML_FONT_INVALID 33931 23.30 28.63 20.09 24 MIME_HTML_ONLY 29553 22.63 24.94 21.24 25 DKIM_VALID_EF 29520 27.10 24.91 28.42 26 XM_Multi_Part_URI 24647 19.14 20.80 18.14 27 DCC_CHECK_NEGATIVE 24625 40.40 20.78 52.22 28 T_TM2_M_HEADER_IN_MSG 23892 22.04 20.16 23.16 29 XMSubLong 23604 21.84 19.92 23.00 30 TR_XM_DK_Unsub 22039 16.08 18.60 14.56 31 UNPARSEABLE_RELAY 19668 13.42 16.60 11.51 32 TR_XM_SpammyWords2 19515 6.70 16.47 0.82 33 XM_B_Unsub 18177 11.73 15.34 9.55 34 XM_B_SpammyWords3 18084 9.62 15.26 6.23 35 TR_XM_BayesUnsub 17726 10.45 14.96 7.73 36 TR_MAX_INTL_RELAY 17015 10.53 14.36 8.23 37 RELAYCOUNTRY_META 16634 7.77 14.04 4.00 38 BOTNET_IPINHOSTNAME 15398 7.15 12.99 3.63 39 LOTS_OF_MONEY 14714 8.10 12.42 5.51 40 TR_XM_SpammyWords4 13226 6.57 11.16 3.81 41 TR_XM_SpammyRelay 12453 5.46 10.51 2.42 42 TR_XM_UnparsRelay 11705 4.86 9.88 1.84 43 XM_Evil_Numbers_Gen 10805 9.52 9.12 9.76 44 BAYES_80 10390 6.38 8.77 4.94 45 HTML_IMAGE_RATIO_02 10109 7.20 8.53 6.41 46 RCVD_IN_BL_SPAMCOP_NET 8994 3.30 7.59 0.71 47 FSL_BULK_SIG 8861 7.54 7.48 7.58 48 BOTNET 8692 3.54 7.34 1.25 49 BAYES_60 8680 9.56 7.32 10.91 50 XM_Body_Dirty_Words 8338 4.20 7.04 2.49 51 XMSubMetaSx_00 7691 4.70 6.49 3.62 52 RCVD_IN_VALIDITY_SAFE 7594 7.19 6.41 7.66 53 LotsOfNums_01 7244 7.18 6.11 7.82 54 TR_XM_SPAMCOP 6931 2.40 5.85 0.33 55 RELAYCOUNTRY_CA 6891 3.20 5.82 1.62 56 MPART_ALT_DIFF 6823 5.29 5.76 5.01 57 XM_H_Long_From01 6817 5.39 5.75 5.17 58 HTML_IMAGE_RATIO_04 6607 4.96 5.58 4.60 59 XM_UncommonTLD01 6406 4.82 5.41 4.47 60 RCVD_IN_VALIDITY_CERTIFIED 6299 5.76 5.32 6.03 61 UNTRUSTED_Relay 6139 2.99 5.18 1.67 62 USER_IN_DEF_DKIM_WL 6051 13.55 5.11 18.63 63 BAYES_95 5995 3.95 5.06 3.28 64 TooManyTo_001 5827 5.89 4.92 6.47 65 XMBody_17 5805 2.29 4.90 0.73 66 XM_SPF_SoftFail 5581 2.68 4.71 1.46 67 XM_B_PhoneNumber 5468 5.78 4.61 6.47 68 XMSexyCombo_05 5336 2.66 4.50 1.55 69 TR_LOTS_OF_MONEY3 5208 1.86 4.39 0.33 70 T_XMDrugObfuBody_14 5117 2.90 4.32 2.05 71 XM_OfRef6 5112 2.27 4.31 1.04 72 XM_H_GMP 5090 5.16 4.30 5.68 73 XM_B_SEO 5040 2.15 4.25 0.88 74 XM_B_Phish_Phrases 4944 4.51 4.17 4.72 75 XMStrtUSub 4868 5.66 4.11 6.59 76 TR_XM_SpammyWords5 4759 2.43 4.02 1.47 77 TM2_M_VERY_LONG_WORD 4758 2.62 4.02 1.78 78 MIME_HTML_MOSTLY 4690 3.58 3.96 3.35 79 XM_CamelCaseFrm001 4664 3.97 3.94 3.99 80 XMBrknScrpt_02 4608 2.14 3.89 1.10 81 HTML_IMAGE_RATIO_08 4601 2.54 3.88 1.74 82 TR_XM_SEO4 4466 1.72 3.77 0.48 83 TR_XM_PhishingBody 4450 2.60 3.76 1.91 84 XM_B_Investor 4348 2.09 3.67 1.15 85 HTML_IMAGE_RATIO_06 4204 2.88 3.55 2.48 86 MIME_HTML_ONLY_MULTI 4063 2.71 3.43 2.27 87 XM_B_SpammyTLD 4021 5.40 3.39 6.62 88 XM_URI_RBL 3998 1.52 3.37 0.40 89 XMNumbers 3896 3.13 3.29 3.03 90 DKIM_INVALID 3691 2.12 3.11 1.53 91 XM_B_URI_Unicode 3346 1.97 2.82 1.46 92 RCVD_IN_MSPIKE_H3 3296 4.04 2.78 4.80 93 RCVD_IN_MSPIKE_WL 3296 4.04 2.78 4.80 94 XM_UB50 3275 1.61 2.76 0.91 95 TM2_M_URI_OPT_OUT 3270 2.26 2.76 1.96 96 SUBJ_ALL_CAPS 3240 1.84 2.73 1.31 97 T_FILL_THIS_FORM_SHORT 3038 1.34 2.56 0.61 98 T_XMDrugObfuBody_00 2980 1.52 2.51 0.91 99 T_XMDrugObfuBody_08 2940 1.69 2.48 1.21 100 RCVD_IN_VALIDITY_RPBL 2916 1.05 2.46 0.19 101 XM_B_SpammyWords4 2902 1.32 2.45 0.64 102 TR_XM_NoHeaderRelay 2897 1.01 2.44 0.14 103 XMBdyGiftCard01 2804 1.86 2.37 1.55 104 FROM_EXCESS_BASE64 2764 2.73 2.33 2.97 105 SpammyFromTLD_01 2707 1.11 2.28 0.41 106 MIME_QP_LONG_LINE 2630 3.02 2.22 3.50 107 RELAYCOUNTRY_AU 2583 1.27 2.18 0.73 108 T_XMHurry_00 2577 1.70 2.17 1.42 109 XMDiploma_00 2447 1.52 2.06 1.18 110 TM2_M_OBFU_COMMENT 2311 1.05 1.95 0.51 111 T_TooManySym_01 2258 5.35 1.91 7.42 112 XM_HighProb1 2081 0.67 1.76 0.01 113 XM_B_Unsub2 2048 1.36 1.73 1.14 114 HTML_TAG_BALANCE_BODY 1983 1.07 1.67 0.70 115 XMStockSpam_06 1980 1.58 1.67 1.53 116 XMReplyNow 1971 0.82 1.66 0.31 117 TR_XM_PHPDW 1897 0.73 1.60 0.21 118 DIET_1 1895 0.80 1.60 0.31 119 URI_HEX 1887 1.08 1.59 0.77 120 TR_XM_PHPForged 1887 0.73 1.59 0.21 121 URI_TRY_3LD 1885 1.05 1.59 0.72 122 TR_XM_FormFill2 1843 0.72 1.56 0.21 123 XM_H_PHPOS 1820 0.70 1.54 0.20 124 XMSubMetaI_00 1775 0.91 1.50 0.56 125 URI_NOVOWEL 1754 2.81 1.48 3.60 126 THIS_AD 1730 0.93 1.46 0.61 127 MAILING_LIST_MULTI 1688 1.86 1.42 2.12 128 XM_B_COPY_HTML 1679 0.95 1.42 0.67 129 XM_DK_Undo_01 1658 1.54 1.40 1.62 130 SpammyFromTLD_02 1630 0.67 1.38 0.25 131 TR_XM_FormFill 1614 0.52 1.36 0.02 132 BAYES_40 1601 3.39 1.35 4.62 133 TooManyTo_002 1546 1.92 1.30 2.29 134 XMPhish30 1536 1.00 1.30 0.82 135 MISSING_HEADERS 1485 0.61 1.25 0.22 136 XM_ProductURIs 1475 0.86 1.24 0.63 137 T_REMOTE_IMAGE 1460 2.48 1.23 3.23 138 T_STY_INVIS_DIRECT 1426 0.75 1.20 0.48 139 RCVD_IN_XBL 1394 0.45 1.18 0.01 140 TR_XM_INV_DKIM 1383 0.49 1.17 0.08 141 HTML_TEXT_INVISIBLE_STYLE 1382 0.65 1.17 0.34 142 REPLYTO_WITHOUT_TO_CC 1370 0.45 1.16 0.03 143 MPART_ALT_DIFF_COUNT 1358 0.89 1.15 0.74 144 TR_Caps_n_Bayes_99 1289 0.43 1.09 0.03 145 XM_SendGrid 1284 1.12 1.08 1.15 146 XM_H_Long_From02 1283 1.25 1.08 1.35 147 FORGED_MUA_OUTLOOK 1277 0.43 1.08 0.04 148 XM_B_REG_HTML 1277 0.76 1.08 0.58 149 FSL_NEW_HELO_USER 1260 0.40 1.06 0.00 150 FROM_MISSP_MSFT 1256 0.40 1.06 0.00 151 FROM_MISSP_REPLYTO 1248 0.40 1.05 0.00 152 AXB_XMAILER_MIMEOLE_OL_024C2 1229 0.39 1.04 0.00 153 BAYES_20 1225 2.12 1.03 2.77 154 XMSexyCombo_01 1224 0.53 1.03 0.23 155 FROM_MISSP_EH_MATCH 1202 0.38 1.01 0.00 156 FROM_MISSPACED 1195 0.38 1.01 0.00 157 KHOP_HELO_FCRDNS 1193 1.09 1.01 1.14 158 ALL_TRUSTED 1189 10.62 1.00 16.41 159 XM_B_DNDMA 1186 1.06 1.00 1.09 160 TO_NO_BRKTS_FROM_MSSP 1180 0.38 1.00 0.00 161 RDNS_DYNAMIC 1159 0.55 0.98 0.30 162 BOTNET_NORDNS 1156 0.37 0.98 0.01 163 T_MONEY_PERCENT 1146 0.43 0.97 0.11 164 TR_LOTS_OF_MONEY2 1146 0.43 0.97 0.11 165 XMGenDplmaNmb 1140 0.62 0.96 0.42 166 AC_BR_BONANZA 1139 0.43 0.96 0.11 167 HTML_MIME_NO_HTML_TAG 1130 1.36 0.95 1.60 168 SHOPIFY_IMG_NOT_RCVD_SFY 1128 0.71 0.95 0.57 169 TO_NO_BRKTS_MSFT 1124 0.36 0.95 0.00 170 TR_Symld_Words 1120 1.13 0.95 1.24 171 PDS_RDNS_DYNAMIC_FP 1119 0.38 0.94 0.05 172 LongTLD 1117 0.49 0.94 0.22 173 TooManyTo_003 1103 0.87 0.93 0.84 174 TooManyTo_004 1084 0.74 0.91 0.64 175 XM_Combo_Sbj 1075 0.56 0.91 0.35 176 TooManyTo_005 1067 0.69 0.90 0.56 177 XM_UB99 1062 0.34 0.90 0.01 178 XMSubMetaSxObfu_03 1059 0.52 0.89 0.29 179 XPRIO 1053 0.34 0.89 0.00 180 XM_B_Phish66 1043 0.48 0.88 0.24 181 RCVD_IN_IADB_LISTED 1036 1.85 0.87 2.44 182 TR_XM_Base64_M1 1014 0.87 0.86 0.88 183 TR_MetaPhish_Combo_01 1013 0.73 0.85 0.66 184 RCVD_IN_PSBL 1000 0.37 0.84 0.09 185 URG_BIZ 999 0.33 0.84 0.02 186 TVD_RCVD_IP 995 0.76 0.84 0.71 187 SUBJ_DOLLARS 986 0.51 0.83 0.31 188 XM_DIRTYINTL 959 0.35 0.81 0.07 189 XMSolicitRefs_0 958 0.50 0.81 0.31 190 ANY_BOUNCE_MESSAGE 943 2.83 0.80 4.05 191 BOUNCE_MESSAGE 943 2.83 0.80 4.05 192 RCVD_IN_IADB_SPF 941 1.68 0.79 2.22 193 TR_Mismatch_TLD_01 913 0.45 0.77 0.26 194 RCVD_IN_IADB_DK 912 1.53 0.77 1.98 195 XMPhish08 910 0.61 0.77 0.51 196 TR_XM_DK_SendGrid 907 0.78 0.77 0.79 197 XMPhish14 903 0.46 0.76 0.28 198 TR_XM_InvalidRelay 898 0.31 0.76 0.03 199 XMHTML_After_End 896 0.42 0.76 0.23 200 XM_OfRef7 891 0.43 0.75 0.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161874 87.26 95.65 82.22 2 RELAYCOUNTRY_US 157195 82.53 87.00 79.84 3 DKIM_SIGNED 152050 83.14 92.97 77.23 4 XM_DK_Pass 150094 81.59 90.49 76.23 5 DKIM_VALID 149043 81.02 89.85 75.70 6 XM_B_Unicode 140236 77.31 87.42 71.23 7 DKIM_VALID_AU 126814 68.24 74.60 64.41 8 BAYES_50 116105 49.76 34.47 58.97 9 XMListUnsubscribeExists 108942 63.15 76.13 55.33 10 DCC_CHECK_NEGATIVE 102805 40.40 20.78 52.22 11 DCC_CHECK 93985 59.38 78.73 47.74 12 XM_B_Unicode3 92150 47.17 47.79 46.80 13 XM_B_SpammyWords 90758 56.39 73.49 46.10 14 RCVD_IN_MSPIKE_H2 68218 37.24 41.55 34.65 15 HTML_FONT_LOW_CONTRAST 65106 36.03 40.94 33.07 16 LOC_TINY_FONT_1 63513 38.66 49.29 32.26 17 DKIM_VALID_EF 55952 27.10 24.91 28.42 18 FVGT_m_MULTI_ODD 52139 29.73 35.14 26.48 19 T_TM2_M_HEADER_IN_MSG 45608 22.04 20.16 23.16 20 XMSubLong 45291 21.84 19.92 23.00 21 XM_B_SpammyWords2 42684 29.70 43.04 21.68 22 MIME_HTML_ONLY 41826 22.63 24.94 21.24 23 T_KAM_HTML_FONT_INVALID 39560 23.30 28.63 20.09 24 USER_IN_DEF_DKIM_WL 36682 13.55 5.11 18.63 25 XM_Multi_Part_URI 35716 19.14 20.80 18.14 26 ALL_TRUSTED 32311 10.62 1.00 16.41 27 TR_XM_DK_Unsub 28674 16.08 18.60 14.56 28 UNPARSEABLE_RELAY 22656 13.42 16.60 11.51 29 BAYES_60 21485 9.56 7.32 10.91 30 XM_Evil_Numbers_Gen 19210 9.52 9.12 9.76 31 XM_B_Unsub 18805 11.73 15.34 9.55 32 XM_DKIMWhitelistDomains 18046 5.75 0.07 9.17 33 BAYES_00 16250 5.29 0.37 8.25 34 TR_MAX_INTL_RELAY 16199 10.53 14.36 8.23 35 LotsOfNums_01 15401 7.18 6.11 7.82 36 TR_XM_BayesUnsub 15221 10.45 14.96 7.73 37 RCVD_IN_VALIDITY_SAFE 15084 7.19 6.41 7.66 38 FSL_BULK_SIG 14915 7.54 7.48 7.58 39 T_TooManySym_01 14604 5.35 1.91 7.42 40 TR_XM_DK_Bayes 13948 4.54 0.30 7.08 41 TR_XM_DK_Bayes1 13818 4.49 0.30 7.02 42 XM_B_SpammyTLD 13025 5.40 3.39 6.62 43 XMStrtUSub 12976 5.66 4.11 6.59 44 XM_B_PhoneNumber 12748 5.78 4.61 6.47 45 TooManyTo_001 12736 5.89 4.92 6.47 46 HTML_IMAGE_RATIO_02 12612 7.20 8.53 6.41 47 XM_B_SpammyWords3 12261 9.62 15.26 6.23 48 RCVD_IN_VALIDITY_CERTIFIED 11869 5.76 5.32 6.03 49 XM_DK_Undo_02 11839 21.95 48.43 6.01 50 TR_XM_DK_Bayes2 11784 3.81 0.21 5.99 51 XM_H_GMP 11193 5.16 4.30 5.68 52 IN_ZIMBRA_NJ_WHITELIST 11016 3.51 0.04 5.60 53 LOTS_OF_MONEY 10845 8.10 12.42 5.51 54 XM_H_Long_From01 10177 5.39 5.75 5.17 55 MPART_ALT_DIFF 9869 5.29 5.76 5.01 56 BAYES_80 9734 6.38 8.77 4.94 57 RCVD_IN_MSPIKE_H3 9443 4.04 2.78 4.80 58 RCVD_IN_MSPIKE_WL 9443 4.04 2.78 4.80 59 BAYES_99 9295 18.23 40.69 4.72 60 XM_B_Phish_Phrases 9293 4.51 4.17 4.72 61 BAYES_40 9095 3.39 1.35 4.62 62 HTML_IMAGE_RATIO_04 9048 4.96 5.58 4.60 63 XM_UncommonTLD01 8801 4.82 5.41 4.47 64 BOUNCE_MESSAGE 7972 2.83 0.80 4.05 65 ANY_BOUNCE_MESSAGE 7972 2.83 0.80 4.05 66 RELAYCOUNTRY_META 7885 7.77 14.04 4.00 67 XM_CamelCaseFrm001 7847 3.97 3.94 3.99 68 T_TooManySym_02 7739 2.65 0.52 3.93 69 TR_XM_SpammyWords4 7499 6.57 11.16 3.81 70 BOTNET_IPINHOSTNAME 7153 7.15 12.99 3.63 71 XMSubMetaSx_00 7136 4.70 6.49 3.62 72 BAYES_999 7131 14.76 33.27 3.62 73 URI_NOVOWEL 7097 2.81 1.48 3.60 74 INVALID_MSGID 6922 2.24 0.12 3.52 75 MIME_QP_LONG_LINE 6889 3.02 2.22 3.50 76 TO_MALFORMED 6648 2.11 0.01 3.38 77 MIME_HTML_MOSTLY 6596 3.58 3.96 3.35 78 BAYES_95 6461 3.95 5.06 3.28 79 T_REMOTE_IMAGE 6355 2.48 1.23 3.23 80 XMNumbers 5967 3.13 3.29 3.03 81 FROM_EXCESS_BASE64 5844 2.73 2.33 2.97 82 BAYES_20 5451 2.12 1.03 2.77 83 XM_Body_Dirty_Words 4908 4.20 7.04 2.49 84 TR_XM_DKIM_Undo 4896 15.17 36.25 2.49 85 HTML_IMAGE_RATIO_06 4886 2.88 3.55 2.48 86 RCVD_IN_IADB_LISTED 4807 1.85 0.87 2.44 87 TR_XM_SpammyRelay 4767 5.46 10.51 2.42 88 XM_PDF 4539 1.53 0.23 2.31 89 TooManyTo_002 4512 1.92 1.30 2.29 90 MIME_HTML_ONLY_MULTI 4478 2.71 3.43 2.27 91 RCVD_IN_IADB_SPF 4372 1.68 0.79 2.22 92 MAILING_LIST_MULTI 4181 1.86 1.42 2.12 93 T_XMDrugObfuBody_14 4039 2.90 4.32 2.05 94 RCVD_IN_IADB_SENDERID 4005 1.55 0.75 2.03 95 RCVD_IN_IADB_DK 3899 1.53 0.77 1.98 96 TM2_M_URI_OPT_OUT 3866 2.26 2.76 1.96 97 TR_DCC_Bayes_99 3823 13.11 31.68 1.94 98 TR_XM_PhishingBody 3755 2.60 3.76 1.91 99 TR_XM_UnparsRelay 3616 4.86 9.88 1.84 100 TM2_M_VERY_LONG_WORD 3500 2.62 4.02 1.78 101 HTML_IMAGE_RATIO_08 3420 2.54 3.88 1.74 102 IN_HORDE_ADDRESS_BOOK 3324 1.08 0.06 1.69 103 UNTRUSTED_Relay 3288 2.99 5.18 1.67 104 TVD_SPACE_RATIO 3201 1.05 0.09 1.63 105 XM_DK_Undo_01 3198 1.54 1.40 1.62 106 RELAYCOUNTRY_CA 3190 3.20 5.82 1.62 107 HTML_MIME_NO_HTML_TAG 3150 1.36 0.95 1.60 108 XMBdyGiftCard01 3056 1.86 2.37 1.55 109 XMSexyCombo_05 3047 2.66 4.50 1.55 110 BAYES_05 3011 1.12 0.44 1.53 111 XMStockSpam_06 3009 1.58 1.67 1.53 112 DKIM_INVALID 3007 2.12 3.11 1.53 113 RCVD_IN_IADB_VOUCHED 2952 1.10 0.43 1.50 114 TR_XM_SpammyWords5 2892 2.43 4.02 1.47 115 XM_SPF_SoftFail 2877 2.68 4.71 1.46 116 XM_B_URI_Unicode 2867 1.97 2.82 1.46 117 XM_TLDProd2 2829 1.00 0.28 1.44 118 T_XMHurry_00 2792 1.70 2.17 1.42 119 XMGappySubj_01 2665 0.88 0.09 1.35 120 XM_H_Long_From02 2658 1.25 1.08 1.35 121 SUBJ_ALL_CAPS 2577 1.84 2.73 1.31 122 T_TooManySym_03 2474 0.84 0.15 1.26 123 BOTNET 2469 3.54 7.34 1.25 124 TR_Symld_Words 2441 1.13 0.95 1.24 125 T_XMDrugObfuBody_08 2389 1.69 2.48 1.21 126 XMManySubDom_06 2350 0.76 0.04 1.19 127 XM_B_FormFill 2348 0.88 0.35 1.19 128 SPOOF_COM2OTH 2335 0.74 0.00 1.19 129 XMDiploma_00 2332 1.52 2.06 1.18 130 XM_SendGrid 2264 1.12 1.08 1.15 131 XMGappySubj_02 2257 0.73 0.04 1.15 132 XM_B_Investor 2256 2.09 3.67 1.15 133 KHOP_HELO_FCRDNS 2251 1.09 1.01 1.14 134 XM_B_Unsub2 2248 1.36 1.73 1.14 135 RCVD_IN_IADB_OPTIN 2246 0.80 0.23 1.14 136 XMBrknScrpt_02 2157 2.14 3.89 1.10 137 XM_B_DNDMA 2148 1.06 1.00 1.09 138 T_TVD_MIME_NO_HEADERS 2140 0.71 0.08 1.09 139 XM_GoogleGroups 2102 0.87 0.55 1.07 140 XMBody_95 2097 0.72 0.15 1.07 141 XM_OfRef6 2057 2.27 4.31 1.04 142 HTML_EXTRA_CLOSE 1804 0.58 0.02 0.92 143 T_XMDrugObfuBody_00 1801 1.52 2.51 0.91 144 XM_UB50 1790 1.61 2.76 0.91 145 XMManySubDom_07 1749 0.56 0.02 0.89 146 XM_B_SEO 1735 2.15 4.25 0.88 147 TR_XM_Base64_M1 1727 0.87 0.86 0.88 148 TooManyTo_003 1652 0.87 0.93 0.84 149 TR_XM_SpammyWords2 1621 6.70 16.47 0.82 150 XMPhish30 1607 1.00 1.30 0.82 151 TR_XM_DK_SendGrid 1556 0.78 0.77 0.79 152 USER_IN_WELCOMELIST 1525 0.48 0.00 0.77 153 USER_IN_WHITELIST 1525 0.48 0.00 0.77 154 URI_HEX 1515 1.08 1.59 0.77 155 DKIM_ADSP_CUSTOM_MED 1504 0.73 0.66 0.76 156 MPART_ALT_DIFF_COUNT 1449 0.89 1.15 0.74 157 RELAYCOUNTRY_AU 1438 1.27 2.18 0.73 158 XMBody_17 1431 2.29 4.90 0.73 159 URI_TRY_3LD 1419 1.05 1.59 0.72 160 RCVD_IN_BL_SPAMCOP_NET 1403 3.30 7.59 0.71 161 TVD_RCVD_IP 1395 0.76 0.84 0.71 162 XMClaimOffer 1392 0.64 0.53 0.71 163 HTML_TAG_BALANCE_BODY 1377 1.07 1.67 0.70 164 PLING_QUERY 1346 0.56 0.36 0.68 165 XM_B_COPY_HTML 1324 0.95 1.42 0.67 166 TR_MetaPhish_Combo_01 1294 0.73 0.85 0.66 167 FILL_THIS_FORM 1290 0.63 0.59 0.66 168 XM_B_SpammyWords4 1264 1.32 2.45 0.64 169 TooManyTo_004 1260 0.74 0.91 0.64 170 XM_ProductURIs 1234 0.86 1.24 0.63 171 XM_H_PHPMailer 1223 0.60 0.56 0.62 172 THIS_AD 1210 0.93 1.46 0.61 173 T_FILL_THIS_FORM_SHORT 1196 1.34 2.56 0.61 174 XMNoVowels 1141 0.54 0.47 0.58 175 XMLngstWrd_00 1139 0.52 0.42 0.58 176 XM_B_REG_HTML 1134 0.76 1.08 0.58 177 HTTPS_HTTP_MISMATCH 1124 0.63 0.74 0.57 178 SHOPIFY_IMG_NOT_RCVD_SFY 1113 0.71 0.95 0.57 179 XMSubMetaI_00 1105 0.91 1.50 0.56 180 TooManyTo_005 1103 0.69 0.90 0.56 181 T_TooManySym_04 1015 0.34 0.06 0.52 182 XMPhish08 1006 0.61 0.77 0.51 183 TM2_M_OBFU_COMMENT 1006 1.05 1.95 0.51 184 XMLngstWrd_01 993 0.47 0.40 0.50 185 RCVD_IN_PBL 955 0.58 0.73 0.49 186 TR_XM_SEO4 949 1.72 3.77 0.48 187 T_STY_INVIS_DIRECT 936 0.75 1.20 0.48 188 NML_ADSP_CUSTOM_MED 925 0.51 0.56 0.47 189 TM2_M_A_HREF_HREF 902 0.48 0.52 0.46 190 FORGED_GMAIL_RCVD 898 0.50 0.58 0.46 191 HTML_FONT_FACE_BAD 894 0.57 0.75 0.45 192 XMBSHREFv2 884 0.35 0.20 0.45 193 DKIM_ADSP_NXDOMAIN 839 0.49 0.59 0.43 194 HTML_IMAGE_ONLY_20 835 0.37 0.27 0.42 195 XMGenDplmaNmb 823 0.62 0.96 0.42 196 XMOemUri 807 0.33 0.19 0.41 197 SpammyFromTLD_01 805 1.11 2.28 0.41 198 XM_URI_RBL 794 1.52 3.37 0.40 199 XMLngstWrd_02 777 0.38 0.35 0.39 200 XM_S_SubURI 773 0.26 0.05 0.39 ----------------------------------------------------------------------