Email: 307712 Autolearn: 0 AvgScore: 4.57 AvgScanTime: 1.28 sec Spam: 106375 Autolearn: 0 AvgScore: 13.30 AvgScanTime: 1.35 sec Ham: 201337 Autolearn: 0 AvgScore: -0.05 AvgScanTime: 1.24 sec Time Spent Running SA: 109.12 hours Time Spent Processing Spam: 39.79 hours Time Spent Processing Ham: 69.34 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 103093 87.65 96.91 82.76 2 DKIM_SIGNED 96902 82.19 91.09 77.49 3 XM_DK_Pass 93465 80.34 87.86 76.36 4 DKIM_VALID 92793 79.86 87.23 75.97 5 RELAYCOUNTRY_US 91744 82.48 86.25 80.49 6 XM_B_Unicode 91574 76.80 86.09 71.89 7 DCC_CHECK 84161 56.84 79.12 45.06 8 XMListUnsubscribeExists 77907 60.90 73.24 54.38 9 XM_B_SpammyWords 76682 56.54 72.09 48.33 10 DKIM_VALID_AU 75208 64.52 70.70 61.26 11 LOC_TINY_FONT_1 54822 37.83 51.54 30.59 12 XM_B_Unicode3 53234 45.85 50.04 43.64 13 XM_B_SpammyWords2 44718 28.16 42.04 20.83 14 HTML_FONT_LOW_CONTRAST 44585 33.35 41.91 28.82 15 XM_DK_Undo_02 44039 17.81 41.40 5.35 16 BAYES_50 42779 52.45 40.22 58.92 17 RCVD_IN_MSPIKE_H2 42579 36.92 40.03 35.27 18 FVGT_m_MULTI_ODD 37972 29.81 35.70 26.70 19 T_KAM_HTML_FONT_INVALID 34940 26.48 32.85 23.12 20 BAYES_99 33382 13.46 31.38 4.00 21 TR_XM_DKIM_Undo 30495 11.44 28.67 2.34 22 DKIM_VALID_EF 28893 28.97 27.16 29.93 23 MIME_HTML_ONLY 27984 20.97 26.31 18.16 24 BAYES_999 25582 10.32 24.05 3.06 25 TR_DCC_Bayes_99 25259 9.29 23.75 1.65 26 XM_Multi_Part_URI 23954 19.84 22.52 18.43 27 XMSubLong 22311 20.41 20.97 20.12 28 DCC_CHECK_NEGATIVE 21848 43.03 20.54 54.92 29 T_TM2_M_HEADER_IN_MSG 21074 21.26 19.81 22.02 30 TR_XM_DK_Unsub 20539 16.03 19.31 14.30 31 XM_B_Unsub 20038 12.62 18.84 9.33 32 TR_XM_BayesUnsub 19080 10.95 17.94 7.25 33 LOTS_OF_MONEY 17714 13.05 16.65 11.15 34 UNPARSEABLE_RELAY 17583 15.07 16.53 14.30 35 TR_MAX_INTL_RELAY 16777 9.39 15.77 6.02 36 TR_XM_SpammyWords4 16036 10.72 15.07 8.41 37 XM_B_SpammyWords3 15963 8.17 15.01 4.56 38 RELAYCOUNTRY_META 15491 7.07 14.56 3.12 39 TR_XM_SpammyWords2 12280 4.26 11.54 0.41 40 BOTNET_IPINHOSTNAME 12247 6.20 11.51 3.40 41 TR_XM_SpammyRelay 11836 5.06 11.13 1.86 42 XM_Evil_Numbers_Gen 10966 9.19 10.31 8.60 43 XM_Body_Dirty_Words 10363 5.57 9.74 3.36 44 BAYES_80 10268 5.71 9.65 3.62 45 RCVD_IN_BL_SPAMCOP_NET 10229 3.79 9.62 0.71 46 BOTNET 10017 4.02 9.42 1.17 47 BAYES_60 9554 9.59 8.98 9.91 48 TR_XM_UnparsRelay 9176 4.21 8.63 1.88 49 FSL_BULK_SIG 8910 8.82 8.38 9.05 50 TR_XM_SPAMCOP 8741 3.15 8.22 0.47 51 TR_LOTS_OF_MONEY3 8153 4.32 7.66 2.55 52 HTML_IMAGE_RATIO_02 7842 6.09 7.37 5.41 53 LotsOfNums_01 7331 8.04 6.89 8.64 54 RELAYCOUNTRY_CA 7011 3.16 6.59 1.34 55 XM_B_Phish_Phrases 6838 5.45 6.43 4.94 56 XM_B_SpammyTLD 6773 7.67 6.37 8.36 57 BAYES_95 6233 3.59 5.86 2.40 58 T_XMHurry_00 6036 3.09 5.67 1.73 59 XMStrtUSub 5915 6.04 5.56 6.29 60 XMSubMetaSx_00 5869 4.55 5.52 4.04 61 MPART_ALT_DIFF 5640 4.39 5.30 3.91 62 XM_UncommonTLD01 5620 6.27 5.28 6.78 63 TooManyTo_001 5456 5.83 5.13 6.20 64 T_XMDrugObfuBody_14 5434 2.84 5.11 1.64 65 UNTRUSTED_Relay 5170 2.50 4.86 1.25 66 XM_H_Long_From01 5105 4.99 4.80 5.09 67 XM_B_PhoneNumber 5009 6.96 4.71 8.15 68 XM_H_GMP 4970 4.82 4.67 4.90 69 XM_B_Investor 4475 2.19 4.21 1.12 70 TR_XM_PhishingBody 4475 2.34 4.21 1.35 71 XMBody_17 4342 1.94 4.08 0.81 72 XMSexyCombo_05 4270 2.05 4.01 1.01 73 DKIM_INVALID 4109 2.33 3.86 1.52 74 XM_OfRef6 3947 2.02 3.71 1.13 75 TR_XM_SpammyWords5 3880 2.07 3.65 1.24 76 HTML_IMAGE_RATIO_06 3814 2.77 3.59 2.33 77 XMNumbers 3794 3.36 3.57 3.26 78 TM2_M_VERY_LONG_WORD 3781 2.36 3.55 1.73 79 URI_HEX 3688 2.03 3.47 1.27 80 HTML_IMAGE_RATIO_04 3683 4.33 3.46 4.78 81 MIME_HTML_ONLY_MULTI 3624 2.79 3.41 2.47 82 XM_CamelCaseFrm001 3547 2.76 3.33 2.46 83 RCVD_IN_MSPIKE_WL 3532 4.25 3.32 4.74 84 RCVD_IN_MSPIKE_H3 3532 4.25 3.32 4.74 85 RCVD_IN_VALIDITY_RPBL 3492 1.17 3.28 0.05 86 MIME_HTML_MOSTLY 3316 2.40 3.12 2.03 87 XMBrknScrpt_02 3237 1.94 3.04 1.35 88 HTML_IMAGE_RATIO_08 3113 2.44 2.93 2.18 89 DKIM_ADSP_NXDOMAIN 3087 1.24 2.90 0.36 90 FROM_EXCESS_BASE64 2851 2.03 2.68 1.69 91 XM_UB50 2851 1.33 2.68 0.62 92 XMDiploma_00 2819 1.84 2.65 1.42 93 DIET_1 2776 1.22 2.61 0.49 94 RELAYCOUNTRY_AU 2725 1.23 2.56 0.53 95 MIME_QP_LONG_LINE 2670 5.18 2.51 6.59 96 XMStockSpam_06 2668 1.76 2.51 1.36 97 XM_URI_RBL 2644 1.19 2.49 0.51 98 XM_SPF_SoftFail 2606 2.22 2.45 2.10 99 TR_XM_NoHeaderRelay 2599 0.98 2.44 0.20 100 XM_B_SpammyWords4 2503 1.05 2.35 0.35 101 RCVD_IN_VALIDITY_SAFE 2463 4.52 2.32 5.68 102 T_XMDrugObfuBody_08 2420 3.13 2.27 3.58 103 T_TooManySym_01 2310 5.01 2.17 6.52 104 TM2_M_URI_OPT_OUT 2291 2.63 2.15 2.89 105 USER_IN_DEF_DKIM_WL 2290 10.20 2.15 14.45 106 T_REMOTE_IMAGE 2151 2.76 2.02 3.15 107 RCVD_IN_VALIDITY_CERTIFIED 2110 3.68 1.98 4.58 108 BOTNET_NORDNS 2100 0.69 1.97 0.02 109 XM_B_URI_Unicode 2079 1.70 1.95 1.57 110 XM_B_Unsub2 2015 1.30 1.89 0.99 111 TR_XM_PHPForged 1997 0.74 1.88 0.14 112 TR_XM_PHPDW 1991 0.74 1.87 0.14 113 SpammyFromTLD_01 1966 2.50 1.85 2.84 114 TR_XM_FormFill2 1962 0.73 1.84 0.14 115 XM_H_PHPOS 1936 0.72 1.82 0.13 116 KHOP_HELO_FCRDNS 1920 1.36 1.80 1.13 117 SUBJ_ALL_CAPS 1917 1.29 1.80 1.01 118 MAILING_LIST_MULTI 1902 2.22 1.79 2.45 119 ANY_BOUNCE_MESSAGE 1822 2.98 1.71 3.65 120 BOUNCE_MESSAGE 1822 2.98 1.71 3.65 121 T_FILL_THIS_FORM_SHORT 1757 0.87 1.65 0.46 122 T_XMDrugObfuBody_00 1736 0.90 1.63 0.52 123 NO_DNS_FOR_FROM 1690 0.80 1.59 0.39 124 TR_XM_MaxWHORU 1665 0.76 1.57 0.33 125 THIS_AD 1572 0.73 1.48 0.33 126 BAYES_40 1538 5.06 1.45 6.97 127 AC_BR_BONANZA 1508 0.61 1.42 0.19 128 XM_DK_Undo_01 1487 1.33 1.40 1.30 129 XMPhish30 1469 0.82 1.38 0.52 130 XM_B_COPY_HTML 1463 1.10 1.38 0.95 131 XMBdyGiftCard01 1463 0.90 1.38 0.65 132 TR_Symld_Words 1458 1.22 1.37 1.14 133 URI_TRY_3LD 1447 0.99 1.36 0.79 134 T_STY_INVIS_DIRECT 1436 0.76 1.35 0.45 135 XM_ProductURIs 1435 0.77 1.35 0.47 136 URIBL_CSS_A 1402 0.50 1.32 0.06 137 URIBL_CSS 1402 0.50 1.32 0.06 138 XMSexyCombo_01 1383 0.55 1.30 0.16 139 XMSubMetaI_00 1380 0.80 1.30 0.54 140 SH_BODYURI_REVERSE_CSS 1377 0.49 1.29 0.06 141 HTML_TAG_BALANCE_BODY 1355 0.76 1.27 0.49 142 DEAR_FRIEND 1353 0.68 1.27 0.36 143 SpammyFromTLD_02 1338 0.53 1.26 0.15 144 SUSP_UTF8_WORD_SUBJ 1297 0.45 1.22 0.04 145 HTTPS_HTTP_MISMATCH 1294 0.78 1.22 0.55 146 XMBounce_01 1289 0.43 1.21 0.01 147 SHOPIFY_IMG_NOT_RCVD_SFY 1271 0.64 1.19 0.35 148 XM_B_REG_HTML 1259 0.55 1.18 0.21 149 TR_XM_INV_DKIM 1228 0.43 1.15 0.04 150 XM_B_Phish66 1222 0.67 1.15 0.42 151 ALL_TRUSTED 1220 11.19 1.15 16.50 152 TR_LOTS_OF_MONEY2 1193 0.69 1.12 0.46 153 T_MONEY_PERCENT 1193 0.69 1.12 0.46 154 TR_XM_Base64_M1 1192 0.88 1.12 0.75 155 XM_DIRTYINTL 1182 0.44 1.11 0.09 156 TooManyTo_002 1168 1.41 1.10 1.57 157 NORDNS_LOW_CONTRAST 1136 0.41 1.07 0.06 158 TooManyTo_003 1127 0.86 1.06 0.75 159 RDNS_DYNAMIC 1123 0.54 1.06 0.26 160 BAYES_20 1121 2.44 1.05 3.18 161 PDS_RDNS_DYNAMIC_FP 1104 0.38 1.04 0.04 162 XM_H_Long_From02 1101 0.83 1.04 0.72 163 LongTLD 1099 0.51 1.03 0.24 164 XMHTMLBadTable_001 1099 0.49 1.03 0.20 165 XMGenDplmaNmb 1096 0.67 1.03 0.48 166 TooManyTo_004 1094 0.70 1.03 0.53 167 TM2_M_OBFU_COMMENT 1089 0.77 1.02 0.63 168 TooManyTo_005 1072 0.64 1.01 0.45 169 XMReplyNow 1069 0.52 1.00 0.26 170 MPART_ALT_DIFF_COUNT 1046 0.59 0.98 0.38 171 TVD_RCVD_IP 1025 0.85 0.96 0.79 172 RCVD_IN_IADB_LISTED 999 2.83 0.94 3.82 173 XMSlimDrugH 990 0.53 0.93 0.32 174 XM_HighProb1 969 0.32 0.91 0.01 175 T_TooManySym_02 967 2.67 0.91 3.60 176 RCVD_IN_PSBL 945 0.36 0.89 0.08 177 XM_SendGrid 937 0.97 0.88 1.01 178 HTML_MIME_NO_HTML_TAG 916 1.19 0.86 1.36 179 RCVD_IN_IADB_SPF 896 2.51 0.84 3.40 180 RELAYCOUNTRY_FR 890 0.44 0.84 0.23 181 XMPhish14 883 0.41 0.83 0.19 182 RCVD_IN_IADB_DK 869 2.23 0.82 2.98 183 RCVD_IN_IADB_SENDERID 868 2.30 0.82 3.09 184 XM_H_PHPMailer 860 0.67 0.81 0.60 185 XMBody_78 860 0.39 0.81 0.17 186 HELO_DYNAMIC_SPLIT_IP 849 0.28 0.80 0.01 187 T_PDS_OTHER_BAD_TLD 832 0.41 0.78 0.21 188 URI_NOVOWEL 815 2.90 0.77 4.02 189 XM_UB99 811 0.27 0.76 0.01 190 HTML_FONT_FACE_BAD 798 0.55 0.75 0.44 191 XM_B_SEO 794 0.44 0.75 0.27 192 J_POPCORN_W_RD 792 0.46 0.74 0.31 193 RCVD_IN_PBL 782 0.56 0.74 0.47 194 TR_Mismatch_TLD_01 778 0.42 0.73 0.26 195 XM_GoogleGroups 761 0.90 0.72 1.00 196 XM_XX_Yahoo 746 0.38 0.70 0.21 197 DKIM_ADSP_CUSTOM_MED 741 0.77 0.70 0.81 198 XM_ShortIntro_01 738 0.46 0.69 0.34 199 AC_HTML_NONSENSE_TAGS 729 0.28 0.69 0.06 200 TR_XM_Base64_L1 726 0.31 0.68 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 166624 87.65 96.91 82.76 2 RELAYCOUNTRY_US 162050 82.48 86.25 80.49 3 DKIM_SIGNED 156020 82.19 91.09 77.49 4 XM_DK_Pass 153741 80.34 87.86 76.36 5 DKIM_VALID 152961 79.86 87.23 75.97 6 XM_B_Unicode 144736 76.80 86.09 71.89 7 DKIM_VALID_AU 123338 64.52 70.70 61.26 8 BAYES_50 118622 52.45 40.22 58.92 9 DCC_CHECK_NEGATIVE 110567 43.03 20.54 54.92 10 XMListUnsubscribeExists 109494 60.90 73.24 54.38 11 XM_B_SpammyWords 97299 56.54 72.09 48.33 12 DCC_CHECK 90732 56.84 79.12 45.06 13 XM_B_Unicode3 87860 45.85 50.04 43.64 14 RCVD_IN_MSPIKE_H2 71018 36.92 40.03 35.27 15 LOC_TINY_FONT_1 61580 37.83 51.54 30.59 16 DKIM_VALID_EF 60257 28.97 27.16 29.93 17 HTML_FONT_LOW_CONTRAST 58022 33.35 41.91 28.82 18 FVGT_m_MULTI_ODD 53748 29.81 35.70 26.70 19 T_KAM_HTML_FONT_INVALID 46543 26.48 32.85 23.12 20 T_TM2_M_HEADER_IN_MSG 44336 21.26 19.81 22.02 21 XM_B_SpammyWords2 41944 28.16 42.04 20.83 22 XMSubLong 40506 20.41 20.97 20.12 23 XM_Multi_Part_URI 37102 19.84 22.52 18.43 24 MIME_HTML_ONLY 36556 20.97 26.31 18.16 25 ALL_TRUSTED 33214 11.19 1.15 16.50 26 USER_IN_DEF_DKIM_WL 29100 10.20 2.15 14.45 27 UNPARSEABLE_RELAY 28796 15.07 16.53 14.30 28 TR_XM_DK_Unsub 28787 16.03 19.31 14.30 29 LOTS_OF_MONEY 22451 13.05 16.65 11.15 30 XM_DKIMWhitelistDomains 20728 6.81 0.22 10.30 31 BAYES_60 19943 9.59 8.98 9.91 32 BAYES_00 18859 6.30 0.50 9.37 33 XM_B_Unsub 18784 12.62 18.84 9.33 34 FSL_BULK_SIG 18227 8.82 8.38 9.05 35 LotsOfNums_01 17395 8.04 6.89 8.64 36 XM_Evil_Numbers_Gen 17312 9.19 10.31 8.60 37 TR_XM_SpammyWords4 16936 10.72 15.07 8.41 38 XM_B_SpammyTLD 16830 7.67 6.37 8.36 39 XM_B_PhoneNumber 16416 6.96 4.71 8.15 40 TR_XM_DK_Bayes 15440 5.16 0.41 7.67 41 TR_XM_DK_Bayes1 15334 5.12 0.41 7.62 42 TR_XM_BayesUnsub 14605 10.95 17.94 7.25 43 BAYES_40 14032 5.06 1.45 6.97 44 XM_UncommonTLD01 13660 6.27 5.28 6.78 45 TR_XM_DK_Bayes2 13388 4.42 0.20 6.65 46 MIME_QP_LONG_LINE 13262 5.18 2.51 6.59 47 T_TooManySym_01 13118 5.01 2.17 6.52 48 XMStrtUSub 12670 6.04 5.56 6.29 49 TooManyTo_001 12480 5.83 5.13 6.20 50 TR_MAX_INTL_RELAY 12124 9.39 15.77 6.02 51 RCVD_IN_VALIDITY_SAFE 11442 4.52 2.32 5.68 52 IN_ZIMBRA_NJ_WHITELIST 11050 3.61 0.06 5.49 53 HTML_IMAGE_RATIO_02 10897 6.09 7.37 5.41 54 XM_DK_Undo_02 10769 17.81 41.40 5.35 55 XM_H_Long_From01 10242 4.99 4.80 5.09 56 XM_B_Phish_Phrases 9938 5.45 6.43 4.94 57 XM_H_GMP 9875 4.82 4.67 4.90 58 HTML_IMAGE_RATIO_04 9627 4.33 3.46 4.78 59 RCVD_IN_MSPIKE_WL 9545 4.25 3.32 4.74 60 RCVD_IN_MSPIKE_H3 9545 4.25 3.32 4.74 61 RCVD_IN_VALIDITY_CERTIFIED 9218 3.68 1.98 4.58 62 XM_B_SpammyWords3 9187 8.17 15.01 4.56 63 XMSubMetaSx_00 8131 4.55 5.52 4.04 64 URI_NOVOWEL 8095 2.90 0.77 4.02 65 BAYES_99 8048 13.46 31.38 4.00 66 MPART_ALT_DIFF 7877 4.39 5.30 3.91 67 RCVD_IN_IADB_LISTED 7695 2.83 0.94 3.82 68 ANY_BOUNCE_MESSAGE 7351 2.98 1.71 3.65 69 BOUNCE_MESSAGE 7350 2.98 1.71 3.65 70 BAYES_80 7297 5.71 9.65 3.62 71 T_TooManySym_02 7254 2.67 0.91 3.60 72 T_XMDrugObfuBody_08 7200 3.13 2.27 3.58 73 INVALID_MSGID 7038 2.36 0.20 3.50 74 BOTNET_IPINHOSTNAME 6846 6.20 11.51 3.40 75 RCVD_IN_IADB_SPF 6840 2.51 0.84 3.40 76 XM_Body_Dirty_Words 6771 5.57 9.74 3.36 77 XMNumbers 6554 3.36 3.57 3.26 78 BAYES_20 6398 2.44 1.05 3.18 79 TO_MALFORMED 6355 2.07 0.00 3.16 80 T_REMOTE_IMAGE 6337 2.76 2.02 3.15 81 RELAYCOUNTRY_META 6276 7.07 14.56 3.12 82 RCVD_IN_IADB_SENDERID 6215 2.30 0.82 3.09 83 BAYES_999 6162 10.32 24.05 3.06 84 RCVD_IN_IADB_DK 6004 2.23 0.82 2.98 85 TM2_M_URI_OPT_OUT 5812 2.63 2.15 2.89 86 SpammyFromTLD_01 5725 2.50 1.85 2.84 87 TR_LOTS_OF_MONEY3 5141 4.32 7.66 2.55 88 MIME_HTML_ONLY_MULTI 4971 2.79 3.41 2.47 89 XM_CamelCaseFrm001 4946 2.76 3.33 2.46 90 MAILING_LIST_MULTI 4927 2.22 1.79 2.45 91 FUZZY_PHARMACY 4856 1.58 0.00 2.41 92 BAYES_95 4823 3.59 5.86 2.40 93 TR_XM_DKIM_Undo 4704 11.44 28.67 2.34 94 HTML_IMAGE_RATIO_06 4696 2.77 3.59 2.33 95 XM_PDF 4631 1.56 0.15 2.30 96 RCVD_IN_IADB_VOUCHED 4626 1.64 0.38 2.30 97 HTML_IMAGE_RATIO_08 4384 2.44 2.93 2.18 98 XM_SPF_SoftFail 4232 2.22 2.45 2.10 99 MIME_HTML_MOSTLY 4083 2.40 3.12 2.03 100 TR_XM_UnparsRelay 3794 4.21 8.63 1.88 101 TR_XM_SpammyRelay 3745 5.06 11.13 1.86 102 TM2_M_VERY_LONG_WORD 3478 2.36 3.55 1.73 103 T_XMHurry_00 3478 3.09 5.67 1.73 104 FROM_EXCESS_BASE64 3402 2.03 2.68 1.69 105 IN_HORDE_ADDRESS_BOOK 3395 1.15 0.12 1.69 106 TR_DCC_Bayes_99 3327 9.29 23.75 1.65 107 BAYES_05 3315 1.28 0.58 1.65 108 T_XMDrugObfuBody_14 3302 2.84 5.11 1.64 109 RCVD_IN_IADB_OPTIN 3210 1.12 0.22 1.59 110 TVD_SPACE_RATIO 3202 1.08 0.11 1.59 111 TooManyTo_002 3157 1.41 1.10 1.57 112 XM_B_URI_Unicode 3155 1.70 1.95 1.57 113 XM_TLDProd2 3139 1.13 0.32 1.56 114 DKIM_INVALID 3059 2.33 3.86 1.52 115 XMGappySubj_01 2957 1.01 0.15 1.47 116 XMDiploma_00 2855 1.84 2.65 1.42 117 T_TooManySym_03 2816 0.99 0.22 1.40 118 HTML_MIME_NO_HTML_TAG 2740 1.19 0.86 1.36 119 XMStockSpam_06 2738 1.76 2.51 1.36 120 XMBrknScrpt_02 2718 1.94 3.04 1.35 121 TR_XM_PhishingBody 2712 2.34 4.21 1.35 122 RELAYCOUNTRY_CA 2701 3.16 6.59 1.34 123 XM_DK_Undo_01 2608 1.33 1.40 1.30 124 XMGappySubj_02 2571 0.84 0.02 1.28 125 URI_HEX 2548 2.03 3.47 1.27 126 XM_B_SpammyTLD2 2524 0.87 0.13 1.25 127 UNTRUSTED_Relay 2510 2.50 4.86 1.25 128 TR_XM_SpammyWords5 2505 2.07 3.65 1.24 129 SHORT_URI_3 2382 0.84 0.20 1.18 130 BOTNET 2353 4.02 9.42 1.17 131 TR_Symld_Words 2299 1.22 1.37 1.14 132 XM_OfRef6 2270 2.02 3.71 1.13 133 KHOP_HELO_FCRDNS 2267 1.36 1.80 1.13 134 XM_B_Investor 2263 2.19 4.21 1.12 135 T_TVD_MIME_NO_HEADERS 2070 0.68 0.03 1.03 136 SUBJ_ALL_CAPS 2043 1.29 1.80 1.01 137 XM_SendGrid 2042 0.97 0.88 1.01 138 XMSexyCombo_05 2041 2.05 4.01 1.01 139 XM_GoogleGroups 2017 0.90 0.72 1.00 140 XM_B_Unsub2 1997 1.30 1.89 0.99 141 XMBody_95 1936 0.67 0.12 0.96 142 XM_B_COPY_HTML 1916 1.10 1.38 0.95 143 XM_RXBody 1850 0.78 0.51 0.92 144 HTML_EXTRA_CLOSE 1809 0.60 0.04 0.90 145 XM_B_DNDMA 1776 0.73 0.45 0.88 146 XMLngstWrd_00 1765 0.72 0.44 0.88 147 DKIM_ADSP_CUSTOM_MED 1631 0.77 0.70 0.81 148 XMBody_17 1626 1.94 4.08 0.81 149 TVD_RCVD_IP 1594 0.85 0.96 0.79 150 URI_TRY_3LD 1587 0.99 1.36 0.79 151 TR_XM_Base64_M1 1520 0.88 1.12 0.75 152 TooManyTo_003 1516 0.86 1.06 0.75 153 XM_H_Long_From02 1457 0.83 1.04 0.72 154 RCVD_IN_BL_SPAMCOP_NET 1430 3.79 9.62 0.71 155 TR_XM_DK_SendGrid 1413 0.69 0.65 0.70 156 USER_IN_WHITELIST 1402 0.46 0.00 0.70 157 USER_IN_WELCOMELIST 1402 0.46 0.00 0.70 158 T_TooManySym_04 1388 0.47 0.05 0.69 159 XMBdyGiftCard01 1303 0.90 1.38 0.65 160 TM2_M_OBFU_COMMENT 1268 0.77 1.02 0.63 161 XM_UB50 1241 1.33 2.68 0.62 162 XM_H_PHPMailer 1205 0.67 0.81 0.60 163 XMClaimOffer 1175 0.60 0.64 0.58 164 XM_B_FormFill 1141 0.38 0.01 0.57 165 FORGED_GMAIL_RCVD 1132 0.54 0.51 0.56 166 HTTPS_HTTP_MISMATCH 1100 0.78 1.22 0.55 167 XMSubMetaI_00 1078 0.80 1.30 0.54 168 TR_MetaPhish_Combo_01 1070 0.57 0.64 0.53 169 RELAYCOUNTRY_AU 1064 1.23 2.56 0.53 170 TooManyTo_004 1064 0.70 1.03 0.53 171 XMPhish30 1052 0.82 1.38 0.52 172 NML_ADSP_CUSTOM_MED 1051 0.53 0.55 0.52 173 T_XMDrugObfuBody_00 1048 0.90 1.63 0.52 174 XM_URI_RBL 1031 1.19 2.49 0.51 175 XMNoVowels 994 0.41 0.27 0.49 176 DIET_1 989 1.22 2.61 0.49 177 HTML_TAG_BALANCE_BODY 979 0.76 1.27 0.49 178 XMGenDplmaNmb 967 0.67 1.03 0.48 179 XMBSHREFv2 946 0.54 0.67 0.47 180 RCVD_IN_PBL 946 0.56 0.74 0.47 181 XM_ProductURIs 944 0.77 1.35 0.47 182 TR_XM_SPAMCOP 937 3.15 8.22 0.47 183 HTML_TEXT_INVISIBLE_STYLE 929 0.40 0.29 0.46 184 TR_LOTS_OF_MONEY2 924 0.69 1.12 0.46 185 T_MONEY_PERCENT 924 0.69 1.12 0.46 186 T_FILL_THIS_FORM_SHORT 922 0.87 1.65 0.46 187 T_STY_INVIS_DIRECT 902 0.76 1.35 0.45 188 TooManyTo_005 898 0.64 1.01 0.45 189 HTML_FONT_FACE_BAD 886 0.55 0.75 0.44 190 FILL_THIS_FORM 884 0.48 0.57 0.44 191 MIME_CHARSET_FARAWAY 872 0.48 0.57 0.43 192 XM_B_Phish66 842 0.67 1.15 0.42 193 TR_XM_SpammyWords2 823 4.26 11.54 0.41 194 NO_DNS_FOR_FROM 786 0.80 1.59 0.39 195 XMWhlSbjSex 778 0.34 0.26 0.39 196 XM_S_SubURI 766 0.26 0.04 0.38 197 MPART_ALT_DIFF_COUNT 760 0.59 0.98 0.38 198 XMSubMetaSxObfu_03 751 0.45 0.60 0.37 199 XMOemUri 734 0.30 0.18 0.36 200 DEAR_FRIEND 733 0.68 1.27 0.36 ----------------------------------------------------------------------