Email: 287875 Autolearn: 0 AvgScore: 4.55 AvgScanTime: 1.39 sec Spam: 97916 Autolearn: 0 AvgScore: 13.91 AvgScanTime: 1.43 sec Ham: 189959 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.36 sec Time Spent Running SA: 110.81 hours Time Spent Processing Spam: 38.96 hours Time Spent Processing Ham: 71.84 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93860 88.76 95.86 85.10 2 DKIM_SIGNED 88312 83.64 90.19 80.26 3 XM_DK_Pass 85006 81.88 86.82 79.33 4 DKIM_VALID 84408 81.31 86.20 78.79 5 XM_B_Unicode 84148 78.52 85.94 74.70 6 RELAYCOUNTRY_US 80511 82.29 82.22 82.32 7 DCC_CHECK 77704 61.52 79.36 52.32 8 XMListUnsubscribeExists 72790 63.36 74.34 57.70 9 XM_B_SpammyWords 68753 56.41 70.22 49.29 10 DKIM_VALID_AU 68065 68.49 69.51 67.97 11 XM_B_Unicode3 50672 51.20 51.75 50.91 12 LOC_TINY_FONT_1 47854 39.65 48.87 34.89 13 RCVD_IN_MSPIKE_H2 41800 38.42 42.69 36.22 14 XM_DK_Undo_02 39910 17.65 40.76 5.74 15 HTML_FONT_LOW_CONTRAST 39803 37.25 40.65 35.49 16 XM_B_SpammyWords2 39520 29.21 40.36 23.45 17 BAYES_50 37874 53.00 38.68 60.39 18 BAYES_99 33339 14.44 34.05 4.33 19 FVGT_m_MULTI_ODD 33212 29.85 33.92 27.75 20 MIME_HTML_ONLY 28741 24.01 29.35 21.25 21 TR_XM_DKIM_Undo 28432 11.55 29.04 2.53 22 T_KAM_HTML_FONT_INVALID 28432 23.68 29.04 20.92 23 BAYES_999 26634 11.40 27.20 3.25 24 TR_DCC_Bayes_99 25104 9.94 25.64 1.86 25 DKIM_VALID_EF 24810 27.65 25.34 28.84 26 XM_Multi_Part_URI 22665 21.05 23.15 19.97 27 XMSubLong 20928 22.63 21.37 23.27 28 DCC_CHECK_NEGATIVE 19744 38.31 20.16 47.66 29 T_TM2_M_HEADER_IN_MSG 18695 20.45 19.09 21.15 30 TR_XM_DK_Unsub 17812 15.11 18.19 13.53 31 RELAYCOUNTRY_META 17317 8.57 17.69 3.87 32 UNPARSEABLE_RELAY 17100 14.13 17.46 12.41 33 XM_B_Unsub 15714 12.32 16.05 10.40 34 TR_XM_BayesUnsub 15086 11.04 15.41 8.79 35 XM_B_SpammyWords3 14980 9.44 15.30 6.43 36 TR_MAX_INTL_RELAY 14100 9.50 14.40 6.98 37 BOTNET_IPINHOSTNAME 13086 7.12 13.36 3.90 38 TR_XM_SpammyRelay 12738 5.88 13.01 2.21 39 TR_XM_SpammyWords2 11128 4.28 11.36 0.63 40 XM_Evil_Numbers_Gen 9084 10.50 9.28 11.13 41 HTML_IMAGE_RATIO_02 9010 7.39 9.20 6.45 42 LOTS_OF_MONEY 8950 6.56 9.14 5.23 43 TR_XM_UnparsRelay 8839 4.25 9.03 1.79 44 BOTNET 8812 4.02 9.00 1.46 45 BAYES_80 8730 5.76 8.92 4.13 46 BAYES_60 8593 10.07 8.78 10.74 47 FSL_BULK_SIG 8434 8.09 8.61 7.82 48 XM_Body_Dirty_Words 8421 5.13 8.60 3.34 49 UNTRUSTED_Relay 8003 4.08 8.17 1.96 50 TR_XM_SpammyWords4 7450 5.09 7.61 3.79 51 LotsOfNums_01 7138 7.40 7.29 7.46 52 XM_B_Phish_Phrases 6885 6.57 7.03 6.33 53 TooManyTo_001 6681 6.01 6.82 5.59 54 XM_UncommonTLD01 6653 5.42 6.79 4.71 55 MPART_ALT_DIFF 6421 6.10 6.56 5.87 56 XMSubMetaSx_00 6411 4.37 6.55 3.25 57 XM_H_Long_From01 6378 5.59 6.51 5.12 58 RELAYCOUNTRY_CA 6210 3.20 6.34 1.58 59 XMSexyCombo_05 5839 3.38 5.96 2.05 60 RCVD_IN_BL_SPAMCOP_NET 5658 2.45 5.78 0.74 61 XM_B_PhoneNumber 5367 5.71 5.48 5.83 62 XM_SPF_SoftFail 5208 2.78 5.32 1.48 63 XM_H_GMP 5178 5.65 5.29 5.83 64 BAYES_95 4936 3.59 5.04 2.84 65 TR_XM_SpammyWords5 4595 3.07 4.69 2.23 66 XMBody_17 4569 2.02 4.67 0.66 67 TR_XM_SPAMCOP 4535 1.81 4.63 0.35 68 T_XMDrugObfuBody_14 4528 2.83 4.62 1.90 69 XM_B_SEO 4499 2.61 4.59 1.58 70 XM_CamelCaseFrm001 4250 3.88 4.34 3.64 71 MIME_HTML_MOSTLY 4187 4.19 4.28 4.14 72 XMStrtUSub 4186 4.88 4.28 5.19 73 XM_UB50 4059 2.04 4.15 0.95 74 HTML_IMAGE_RATIO_04 4022 5.64 4.11 6.44 75 TR_XM_SEO4 3975 2.15 4.06 1.17 76 TR_XM_PhishingBody 3973 3.25 4.06 2.84 77 DKIM_INVALID 3904 2.32 3.99 1.46 78 RCVD_IN_VALIDITY_SAFE 3703 7.36 3.78 9.21 79 XM_B_Investor 3641 2.05 3.72 1.20 80 RCVD_IN_VALIDITY_RPBL 3629 1.41 3.71 0.22 81 MIME_HTML_ONLY_MULTI 3623 2.84 3.70 2.40 82 XM_OfRef6 3545 1.61 3.62 0.58 83 TR_XM_NoHeaderRelay 3526 1.37 3.60 0.22 84 HTML_IMAGE_RATIO_06 3320 3.19 3.39 3.09 85 XM_B_SpammyTLD 3293 3.32 3.36 3.30 86 TM2_M_VERY_LONG_WORD 3287 2.24 3.36 1.66 87 HTML_IMAGE_RATIO_08 3255 2.94 3.32 2.74 88 XMNumbers 3160 3.69 3.23 3.93 89 XMBrknScrpt_02 3101 2.04 3.17 1.46 90 RELAYCOUNTRY_AU 3061 1.42 3.13 0.54 91 SUBJ_ALL_CAPS 3054 1.79 3.12 1.10 92 T_TooManySym_01 2866 5.49 2.93 6.81 93 RCVD_IN_VALIDITY_CERTIFIED 2791 6.11 2.85 7.79 94 RCVD_IN_MSPIKE_WL 2776 4.25 2.84 4.98 95 RCVD_IN_MSPIKE_H3 2776 4.25 2.84 4.98 96 TM2_M_URI_OPT_OUT 2711 2.30 2.77 2.06 97 XM_URI_RBL 2664 1.22 2.72 0.45 98 FROM_EXCESS_BASE64 2661 2.60 2.72 2.54 99 DIET_1 2590 1.34 2.65 0.66 100 T_FILL_THIS_FORM_SHORT 2528 1.28 2.58 0.60 101 T_XMDrugObfuBody_08 2517 2.24 2.57 2.07 102 SpammyFromTLD_01 2515 1.27 2.57 0.61 103 T_XMHurry_00 2446 1.70 2.50 1.30 104 XM_B_REG_HTML 2385 0.98 2.44 0.24 105 XMStockSpam_06 2313 2.63 2.36 2.77 106 MIME_QP_LONG_LINE 2305 3.01 2.35 3.35 107 USER_IN_DEF_DKIM_WL 2270 14.85 2.32 21.30 108 XMSubMetaI_00 2178 1.44 2.22 1.04 109 MAILING_LIST_MULTI 2063 2.14 2.11 2.16 110 XM_B_SpammyWords4 1991 1.15 2.03 0.70 111 XM_B_Unsub2 1987 1.54 2.03 1.29 112 THIS_AD 1986 1.04 2.03 0.53 113 SHOPIFY_IMG_NOT_RCVD_SFY 1952 0.94 1.99 0.40 114 XM_B_URI_Unicode 1875 2.13 1.91 2.25 115 TR_Mismatch_TLD_02 1871 0.68 1.91 0.05 116 XMDiploma_00 1856 1.43 1.90 1.19 117 BAYES_40 1686 3.51 1.72 4.43 118 TooManyTo_002 1670 1.49 1.71 1.38 119 XMPhish30 1606 1.43 1.64 1.32 120 SpammyFromTLD_02 1564 0.67 1.60 0.19 121 XM_DIRTYINTL 1552 0.63 1.59 0.13 122 XM_DK_Undo_01 1530 1.57 1.56 1.58 123 URI_HEX 1433 1.19 1.46 1.05 124 HOSTED_IMG_MULTI_PUB_01 1409 0.57 1.44 0.12 125 TR_XM_FormFill 1405 0.50 1.43 0.01 126 TR_LOTS_OF_MONEY3 1387 0.69 1.42 0.31 127 TR_XM_InvalidRelay 1364 0.49 1.39 0.02 128 FILL_THIS_FORM 1359 0.59 1.39 0.17 129 XMBdyGiftCard01 1328 2.48 1.36 3.06 130 XM_UB60 1301 0.51 1.33 0.08 131 XMHTMLBadTable_001 1272 0.58 1.30 0.21 132 RELAYCOUNTRY_DE 1257 0.68 1.28 0.37 133 BAYES_20 1250 2.44 1.28 3.04 134 T_STY_INVIS_DIRECT 1248 0.75 1.27 0.48 135 HTML_TAG_BALANCE_BODY 1246 1.07 1.27 0.97 136 T_REMOTE_IMAGE 1224 2.31 1.25 2.85 137 DKIM_ADSP_NXDOMAIN 1214 0.72 1.24 0.45 138 FROM_MISSP_REPLYTO 1198 0.42 1.22 0.00 139 T_XMDrugObfuBody_00 1193 0.95 1.22 0.82 140 TR_Caps_n_Bayes_99 1189 0.45 1.21 0.06 141 ALL_TRUSTED 1187 9.47 1.21 13.73 142 RDNS_DYNAMIC 1174 0.60 1.20 0.30 143 MISSING_HEADERS 1168 0.56 1.19 0.24 144 PDS_RDNS_DYNAMIC_FP 1157 0.42 1.18 0.03 145 RCVD_IN_PSBL 1140 0.50 1.16 0.16 146 FORGED_MUA_OUTLOOK 1129 0.42 1.15 0.05 147 LongTLD 1129 0.51 1.15 0.19 148 RCVD_IN_XBL 1120 0.40 1.14 0.02 149 XM_B_COPY_HTML 1108 1.22 1.13 1.26 150 AXB_XMAILER_MIMEOLE_OL_024C2 1107 0.38 1.13 0.00 151 XM_OfRef7 1107 0.42 1.13 0.05 152 TVD_RCVD_IP 1104 0.84 1.13 0.69 153 FSL_NEW_HELO_USER 1098 0.38 1.12 0.00 154 XM_B_Phish66 1096 0.58 1.12 0.30 155 XM_UB99 1096 0.38 1.12 0.01 156 HTML_MIME_NO_HTML_TAG 1096 1.28 1.12 1.37 157 MPART_ALT_DIFF_COUNT 1096 0.87 1.12 0.75 158 MONEY_FROM_MISSP 1084 0.38 1.11 0.00 159 FROM_MISSP_MSFT 1083 0.38 1.11 0.00 160 TO_NO_BRKTS_FROM_MSSP 1083 0.38 1.11 0.00 161 REPLYTO_WITHOUT_TO_CC 1079 0.39 1.10 0.02 162 FSL_CTYPE_WIN1251 1067 0.37 1.09 0.00 163 RELAYCOUNTRY_FR 1058 0.54 1.08 0.26 164 NSL_RCVD_FROM_USER 1056 0.37 1.08 0.00 165 XM_SendGrid 1051 1.15 1.07 1.20 166 URI_NOVOWEL 1039 1.53 1.06 1.77 167 RCVD_IN_IADB_LISTED 1038 2.09 1.06 2.62 168 HTTPS_HTTP_MISMATCH 1023 0.69 1.04 0.50 169 TO_NO_BRKTS_MSFT 1023 0.36 1.04 0.01 170 TR_XM_PHPForged 1015 0.49 1.04 0.20 171 TR_MetaPhish_Combo_01 1014 0.98 1.04 0.95 172 TR_XM_PHPDW 1006 0.48 1.03 0.20 173 FROM_MISSP_USER 1000 0.35 1.02 0.00 174 DKIM_ADSP_CUSTOM_MED 983 0.92 1.00 0.88 175 HELO_DYNAMIC_SPLIT_IP 964 0.34 0.98 0.01 176 HK_SCAM 963 0.34 0.98 0.01 177 XM_H_Long_From02 962 0.96 0.98 0.95 178 TR_XM_FormFill2 962 0.47 0.98 0.20 179 FROM_MISSP_EH_MATCH 957 0.33 0.98 0.00 180 XMSlimDrugH 948 0.64 0.97 0.46 181 ANY_BOUNCE_MESSAGE 943 2.80 0.96 3.75 182 BOUNCE_MESSAGE 943 2.80 0.96 3.75 183 XM_H_PHPOS 942 0.45 0.96 0.19 184 XM_H_Undi_Recip 928 0.42 0.95 0.15 185 RCVD_IN_IADB_SPF 927 1.86 0.95 2.33 186 MONEY_FORM 923 0.32 0.94 0.00 187 FROM_MISSPACED 916 0.32 0.94 0.00 188 MONEY_FRAUD_8 906 0.32 0.93 0.00 189 BOTNET_NORDNS 904 0.32 0.92 0.00 190 XM_RXBody 903 0.97 0.92 0.99 191 TR_XM_Spammywords 901 0.51 0.92 0.30 192 KHOP_HELO_FCRDNS 901 0.84 0.92 0.81 193 XM_S_SpammyWords 901 0.51 0.92 0.30 194 MIME_CHARSET_FARAWAY 899 0.58 0.92 0.40 195 TR_LOTS_OF_MONEY1 888 0.31 0.91 0.01 196 XM_ProductURIs 882 0.73 0.90 0.64 197 XMGenDplmaNmb 880 0.62 0.90 0.47 198 RCVD_IN_IADB_DK 880 1.67 0.90 2.07 199 AC_BR_BONANZA 878 0.37 0.90 0.10 200 RCVD_IN_IADB_SENDERID 878 1.69 0.90 2.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 161656 88.76 95.86 85.10 2 RELAYCOUNTRY_US 156377 82.29 82.22 82.32 3 DKIM_SIGNED 152455 83.64 90.19 80.26 4 XM_DK_Pass 150694 81.88 86.82 79.33 5 DKIM_VALID 149673 81.31 86.20 78.79 6 XM_B_Unicode 141897 78.52 85.94 74.70 7 DKIM_VALID_AU 129113 68.49 69.51 67.97 8 BAYES_50 114709 53.00 38.68 60.39 9 XMListUnsubscribeExists 109605 63.36 74.34 57.70 10 DCC_CHECK 99395 61.52 79.36 52.32 11 XM_B_Unicode3 96709 51.20 51.75 50.91 12 XM_B_SpammyWords 93639 56.41 70.22 49.29 13 DCC_CHECK_NEGATIVE 90528 38.31 20.16 47.66 14 RCVD_IN_MSPIKE_H2 68811 38.42 42.69 36.22 15 HTML_FONT_LOW_CONTRAST 67425 37.25 40.65 35.49 16 LOC_TINY_FONT_1 66280 39.65 48.87 34.89 17 DKIM_VALID_EF 54776 27.65 25.34 28.84 18 FVGT_m_MULTI_ODD 52711 29.85 33.92 27.75 19 XM_B_SpammyWords2 44554 29.21 40.36 23.45 20 XMSubLong 44207 22.63 21.37 23.27 21 USER_IN_DEF_DKIM_WL 40468 14.85 2.32 21.30 22 MIME_HTML_ONLY 40364 24.01 29.35 21.25 23 T_TM2_M_HEADER_IN_MSG 40174 20.45 19.09 21.15 24 T_KAM_HTML_FONT_INVALID 39747 23.68 29.04 20.92 25 XM_Multi_Part_URI 37927 21.05 23.15 19.97 26 ALL_TRUSTED 26074 9.47 1.21 13.73 27 TR_XM_DK_Unsub 25692 15.11 18.19 13.53 28 UNPARSEABLE_RELAY 23577 14.13 17.46 12.41 29 XM_DKIMWhitelistDomains 22905 7.96 0.01 12.06 30 XM_Evil_Numbers_Gen 21143 10.50 9.28 11.13 31 BAYES_60 20394 10.07 8.78 10.74 32 XM_B_Unsub 19760 12.32 16.05 10.40 33 RCVD_IN_VALIDITY_SAFE 17487 7.36 3.78 9.21 34 TR_XM_BayesUnsub 16692 11.04 15.41 8.79 35 BAYES_00 15950 5.71 0.49 8.40 36 FSL_BULK_SIG 14857 8.09 8.61 7.82 37 RCVD_IN_VALIDITY_CERTIFIED 14789 6.11 2.85 7.79 38 TR_XM_DK_Bayes 14183 5.06 0.41 7.47 39 LotsOfNums_01 14176 7.40 7.29 7.46 40 TR_XM_DK_Bayes1 14066 5.02 0.40 7.40 41 TR_MAX_INTL_RELAY 13255 9.50 14.40 6.98 42 T_TooManySym_01 12945 5.49 2.93 6.81 43 TR_XM_DK_Bayes2 12585 4.45 0.22 6.63 44 HTML_IMAGE_RATIO_02 12258 7.39 9.20 6.45 45 HTML_IMAGE_RATIO_04 12226 5.64 4.11 6.44 46 XM_B_SpammyWords3 12207 9.44 15.30 6.43 47 XM_B_Phish_Phrases 12030 6.57 7.03 6.33 48 MPART_ALT_DIFF 11144 6.10 6.56 5.87 49 XM_H_GMP 11076 5.65 5.29 5.83 50 XM_B_PhoneNumber 11069 5.71 5.48 5.83 51 XM_DK_Undo_02 10906 17.65 40.76 5.74 52 TooManyTo_001 10613 6.01 6.82 5.59 53 IN_ZIMBRA_NJ_WHITELIST 10044 3.52 0.09 5.29 54 LOTS_OF_MONEY 9940 6.56 9.14 5.23 55 XMStrtUSub 9861 4.88 4.28 5.19 56 XM_H_Long_From01 9728 5.59 6.51 5.12 57 RCVD_IN_MSPIKE_H3 9451 4.25 2.84 4.98 58 RCVD_IN_MSPIKE_WL 9451 4.25 2.84 4.98 59 XM_UncommonTLD01 8950 5.42 6.79 4.71 60 BAYES_40 8422 3.51 1.72 4.43 61 BAYES_99 8216 14.44 34.05 4.33 62 MIME_HTML_MOSTLY 7871 4.19 4.28 4.14 63 BAYES_80 7852 5.76 8.92 4.13 64 XMNumbers 7470 3.69 3.23 3.93 65 BOTNET_IPINHOSTNAME 7413 7.12 13.36 3.90 66 RELAYCOUNTRY_META 7348 8.57 17.69 3.87 67 T_TooManySym_02 7273 2.74 0.63 3.83 68 TR_XM_SpammyWords4 7199 5.09 7.61 3.79 69 BOUNCE_MESSAGE 7128 2.80 0.96 3.75 70 ANY_BOUNCE_MESSAGE 7128 2.80 0.96 3.75 71 XM_CamelCaseFrm001 6921 3.88 4.34 3.64 72 INVALID_MSGID 6788 2.45 0.28 3.57 73 MIME_QP_LONG_LINE 6371 3.01 2.35 3.35 74 XM_Body_Dirty_Words 6348 5.13 8.60 3.34 75 XM_B_SpammyTLD 6263 3.32 3.36 3.30 76 TO_MALFORMED 6185 2.19 0.13 3.26 77 BAYES_999 6183 11.40 27.20 3.25 78 XMSubMetaSx_00 6178 4.37 6.55 3.25 79 HTML_IMAGE_RATIO_06 5877 3.19 3.39 3.09 80 XMBdyGiftCard01 5821 2.48 1.36 3.06 81 BAYES_20 5781 2.44 1.28 3.04 82 T_REMOTE_IMAGE 5418 2.31 1.25 2.85 83 BAYES_95 5398 3.59 5.04 2.84 84 TR_XM_PhishingBody 5392 3.25 4.06 2.84 85 XMStockSpam_06 5268 2.63 2.36 2.77 86 HTML_IMAGE_RATIO_08 5202 2.94 3.32 2.74 87 RCVD_IN_IADB_LISTED 4976 2.09 1.06 2.62 88 FROM_EXCESS_BASE64 4823 2.60 2.72 2.54 89 TR_XM_DKIM_Undo 4807 11.55 29.04 2.53 90 MIME_HTML_ONLY_MULTI 4567 2.84 3.70 2.40 91 RCVD_IN_IADB_SPF 4433 1.86 0.95 2.33 92 XM_B_URI_Unicode 4267 2.13 1.91 2.25 93 TR_XM_SpammyWords5 4245 3.07 4.69 2.23 94 TR_XM_SpammyRelay 4194 5.88 13.01 2.21 95 MAILING_LIST_MULTI 4101 2.14 2.11 2.16 96 RCVD_IN_IADB_SENDERID 3993 1.69 0.90 2.10 97 T_XMDrugObfuBody_08 3938 2.24 2.57 2.07 98 RCVD_IN_IADB_DK 3925 1.67 0.90 2.07 99 TM2_M_URI_OPT_OUT 3908 2.30 2.77 2.06 100 XMSexyCombo_05 3887 3.38 5.96 2.05 101 UNTRUSTED_Relay 3729 4.08 8.17 1.96 102 XMGappySubj_01 3673 1.34 0.20 1.93 103 T_XMDrugObfuBody_14 3608 2.83 4.62 1.90 104 TR_DCC_Bayes_99 3524 9.94 25.64 1.86 105 XM_PDF 3412 1.29 0.31 1.80 106 TR_XM_UnparsRelay 3409 4.25 9.03 1.79 107 URI_NOVOWEL 3355 1.53 1.06 1.77 108 XMGappySubj_02 3325 1.20 0.14 1.75 109 BAYES_05 3236 1.32 0.58 1.70 110 IN_HORDE_ADDRESS_BOOK 3211 1.17 0.15 1.69 111 RCVD_IN_IADB_VOUCHED 3177 1.27 0.49 1.67 112 TVD_SPACE_RATIO 3176 1.14 0.11 1.67 113 TM2_M_VERY_LONG_WORD 3156 2.24 3.36 1.66 114 XM_B_SEO 3009 2.61 4.59 1.58 115 RELAYCOUNTRY_CA 2998 3.20 6.34 1.58 116 XM_DK_Undo_01 2996 1.57 1.56 1.58 117 XM_SPF_SoftFail 2802 2.78 5.32 1.48 118 DKIM_INVALID 2782 2.32 3.99 1.46 119 XMBrknScrpt_02 2782 2.04 3.17 1.46 120 BOTNET 2767 4.02 9.00 1.46 121 TooManyTo_002 2623 1.49 1.71 1.38 122 HTML_MIME_NO_HTML_TAG 2597 1.28 1.12 1.37 123 T_TooManySym_03 2533 0.97 0.26 1.33 124 XMPhish30 2509 1.43 1.64 1.32 125 T_XMHurry_00 2461 1.70 2.50 1.30 126 XM_B_Unsub2 2441 1.54 2.03 1.29 127 XM_B_COPY_HTML 2393 1.22 1.13 1.26 128 RCVD_IN_IADB_OPTIN 2308 0.89 0.25 1.21 129 XM_B_Investor 2273 2.05 3.72 1.20 130 XM_SendGrid 2271 1.15 1.07 1.20 131 XMDiploma_00 2252 1.43 1.90 1.19 132 XM_B_DNDMA 2228 1.07 0.88 1.17 133 TR_XM_SEO4 2216 2.15 4.06 1.17 134 TR_Symld_Words 2167 0.99 0.70 1.14 135 XM_GoogleGroups 2109 0.98 0.73 1.11 136 SUBJ_ALL_CAPS 2094 1.79 3.12 1.10 137 URI_HEX 1998 1.19 1.46 1.05 138 XMSubMetaI_00 1974 1.44 2.22 1.04 139 XM_RXBody 1875 0.97 0.92 0.99 140 HTML_TAG_BALANCE_BODY 1834 1.07 1.27 0.97 141 TR_MetaPhish_Combo_01 1810 0.98 1.04 0.95 142 XM_UB50 1800 2.04 4.15 0.95 143 XM_H_Long_From02 1798 0.96 0.98 0.95 144 TR_XM_DK_SendGrid 1707 0.87 0.82 0.90 145 TR_XM_Base64_M1 1700 0.84 0.73 0.89 146 DKIM_ADSP_CUSTOM_MED 1675 0.92 1.00 0.88 147 XMBody_95 1674 0.66 0.24 0.88 148 TooManyTo_003 1645 0.85 0.81 0.87 149 T_XMDrugObfuBody_00 1555 0.95 1.22 0.82 150 KHOP_HELO_FCRDNS 1530 0.84 0.92 0.81 151 T_TVD_MIME_NO_HEADERS 1479 0.54 0.09 0.78 152 URI_TRY_3LD 1473 0.79 0.83 0.78 153 MPART_ALT_DIFF_COUNT 1417 0.87 1.12 0.75 154 RCVD_IN_BL_SPAMCOP_NET 1406 2.45 5.78 0.74 155 USER_IN_WHITELIST 1344 0.47 0.00 0.71 156 USER_IN_WELCOMELIST 1344 0.47 0.00 0.71 157 XM_B_SpammyWords4 1328 1.15 2.03 0.70 158 TVD_RCVD_IP 1316 0.84 1.13 0.69 159 XMPhish14 1313 0.65 0.56 0.69 160 XMNoVowels 1311 0.58 0.38 0.69 161 HTML_IMAGE_ONLY_20 1308 0.56 0.31 0.69 162 TooManyTo_004 1308 0.71 0.76 0.69 163 HTML_TEXT_INVISIBLE_STYLE 1286 0.52 0.21 0.68 164 DIET_1 1257 1.34 2.65 0.66 165 XMBody_17 1251 2.02 4.67 0.66 166 HTML_TAG_BALANCE_CENTER 1244 0.50 0.21 0.65 167 SUBJ_DOLLARS 1235 0.61 0.54 0.65 168 XM_ProductURIs 1224 0.73 0.90 0.64 169 TM2_M_OBFU_COMMENT 1224 0.73 0.88 0.64 170 XM_H_PHPMailer 1203 0.66 0.70 0.63 171 TR_XM_SpammyWords2 1200 4.28 11.36 0.63 172 SpammyFromTLD_01 1153 1.27 2.57 0.61 173 XMSubNoVowel 1148 0.58 0.53 0.60 174 T_FILL_THIS_FORM_SHORT 1144 1.28 2.58 0.60 175 AD_PREFS 1102 0.40 0.06 0.58 176 XM_OfRef6 1102 1.61 3.62 0.58 177 TooManyTo_005 1098 0.63 0.73 0.58 178 RCVD_IN_PBL 1092 0.66 0.83 0.57 179 FORGED_GMAIL_RCVD 1091 0.67 0.86 0.57 180 XMSolicitRefs_0 1027 0.50 0.41 0.54 181 RELAYCOUNTRY_AU 1023 1.42 3.13 0.54 182 XMClaimOffer 1017 0.62 0.79 0.54 183 FROM_GOV_DKIM_AU 1014 0.36 0.02 0.53 184 T_TooManySym_04 1005 0.37 0.06 0.53 185 THIS_AD 1002 1.04 2.03 0.53 186 HTML_FONT_FACE_BAD 981 0.63 0.84 0.52 187 XMLngstWrd_00 981 0.44 0.29 0.52 188 NML_ADSP_CUSTOM_MED 979 0.64 0.88 0.52 189 MSGID_FROM_MTA_HEADER 965 0.56 0.66 0.51 190 HTTPS_HTTP_MISMATCH 952 0.69 1.04 0.50 191 NO_DNS_FOR_FROM 913 0.57 0.73 0.48 192 T_STY_INVIS_DIRECT 907 0.75 1.27 0.48 193 XMPhish08 903 0.54 0.67 0.48 194 XMGenDplmaNmb 899 0.62 0.90 0.47 195 XMSlimDrugH 881 0.64 0.97 0.46 196 XM_H_Trusted_IP 867 0.30 0.00 0.46 197 XM_Walgreens_Forge 857 0.31 0.03 0.45 198 XM_URI_RBL 848 1.22 2.72 0.45 199 DKIM_ADSP_NXDOMAIN 846 0.72 1.24 0.45 200 FONT_INVIS_POSTEXTRAS 824 0.30 0.03 0.43 ----------------------------------------------------------------------