Email: 257824 Autolearn: 0 AvgScore: 4.73 AvgScanTime: 1.29 sec Spam: 92017 Autolearn: 0 AvgScore: 13.73 AvgScanTime: 1.38 sec Ham: 165807 Autolearn: 0 AvgScore: -0.27 AvgScanTime: 1.23 sec Time Spent Running SA: 92.07 hours Time Spent Processing Spam: 35.25 hours Time Spent Processing Ham: 56.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88619 87.68 96.31 82.89 2 DKIM_SIGNED 82095 79.69 89.22 74.40 3 XM_DK_Pass 79370 77.87 86.26 73.22 4 DKIM_VALID 78943 77.42 85.79 72.78 5 XM_B_Unicode 76439 74.03 83.07 69.01 6 RELAYCOUNTRY_US 76283 79.71 82.90 77.95 7 DCC_CHECK 71518 56.17 77.72 44.21 8 XMListUnsubscribeExists 67664 58.21 73.53 49.70 9 XM_B_SpammyWords 65183 54.91 70.84 46.07 10 DKIM_VALID_AU 64377 64.75 69.96 61.85 11 LOC_TINY_FONT_1 47992 36.45 52.16 27.73 12 XM_B_Unicode3 46156 46.24 50.16 44.06 13 XM_B_SpammyWords2 39163 28.22 42.56 20.25 14 XM_DK_Undo_02 38732 18.65 42.09 5.63 15 HTML_FONT_LOW_CONTRAST 37422 34.76 40.67 31.48 16 RCVD_IN_MSPIKE_H2 34817 36.57 37.84 35.86 17 BAYES_50 34091 51.93 37.05 60.19 18 BAYES_99 32748 15.60 35.59 4.50 19 T_KAM_HTML_FONT_INVALID 31627 24.95 34.37 19.73 20 FVGT_m_MULTI_ODD 31102 27.73 33.80 24.37 21 TR_XM_DKIM_Undo 26831 11.90 29.16 2.32 22 BAYES_999 25564 12.00 27.78 3.24 23 TR_DCC_Bayes_99 24663 10.54 26.80 1.51 24 MIME_HTML_ONLY 24007 22.60 26.09 20.67 25 XM_Multi_Part_URI 23074 18.99 25.08 15.62 26 DKIM_VALID_EF 22325 27.65 24.26 29.53 27 XMSubLong 20781 22.52 22.58 22.49 28 DCC_CHECK_NEGATIVE 19989 43.61 21.72 55.76 29 T_TM2_M_HEADER_IN_MSG 17977 23.58 19.54 25.82 30 TR_XM_DK_Unsub 15994 14.60 17.38 13.06 31 XM_B_SpammyWords3 15905 10.58 17.28 6.85 32 XM_B_Unsub 15509 11.77 16.85 8.95 33 UNPARSEABLE_RELAY 15328 13.35 16.66 11.51 34 TR_XM_BayesUnsub 14985 10.38 16.29 7.11 35 TR_MAX_INTL_RELAY 14342 9.97 15.59 6.85 36 RELAYCOUNTRY_META 13813 7.91 15.01 3.97 37 TR_XM_SpammyWords2 12765 5.40 13.87 0.70 38 TR_XM_SpammyRelay 10863 5.62 11.81 2.19 39 BOTNET_IPINHOSTNAME 10305 6.46 11.20 3.82 40 XM_Body_Dirty_Words 9949 5.58 10.81 2.68 41 LOTS_OF_MONEY 9921 6.84 10.78 4.65 42 TR_XM_SpammyWords4 9007 5.46 9.79 3.06 43 BAYES_80 8623 5.98 9.37 4.09 44 TR_XM_UnparsRelay 8065 4.27 8.76 1.77 45 FSL_BULK_SIG 8031 9.97 8.73 10.66 46 BOTNET 7998 4.11 8.69 1.56 47 BAYES_60 7932 10.18 8.62 11.04 48 XM_Evil_Numbers_Gen 7751 8.32 8.42 8.26 49 HTML_IMAGE_RATIO_02 7741 6.53 8.41 5.49 50 RCVD_IN_BL_SPAMCOP_NET 7279 3.31 7.91 0.76 51 XM_B_Phish_Phrases 6662 5.48 7.24 4.50 52 LotsOfNums_01 6613 7.21 7.19 7.22 53 RELAYCOUNTRY_CA 6471 3.66 7.03 1.79 54 UNTRUSTED_Relay 6087 3.39 6.62 1.59 55 TR_XM_SPAMCOP 5732 2.49 6.23 0.42 56 MPART_ALT_DIFF 5575 5.13 6.06 4.61 57 BAYES_95 5487 3.90 5.96 2.76 58 XM_H_GMP 5373 6.18 5.84 6.37 59 TooManyTo_001 5311 6.72 5.77 7.25 60 XMSubMetaSx_00 5095 5.04 5.54 4.76 61 T_XMDrugObfuBody_14 5054 3.27 5.49 2.03 62 XM_UncommonTLD01 5041 5.56 5.48 5.61 63 XM_B_SpammyTLD 4768 3.73 5.18 2.93 64 XM_H_Long_From01 4716 5.00 5.13 4.93 65 XM_B_Investor 4395 2.52 4.78 1.27 66 MIME_HTML_MOSTLY 4314 3.43 4.69 2.72 67 XMSexyCombo_05 4217 2.36 4.58 1.13 68 HTML_IMAGE_RATIO_04 3968 4.08 4.31 3.96 69 XMStrtUSub 3913 5.17 4.25 5.68 70 XM_B_PhoneNumber 3744 5.32 4.07 6.02 71 TR_XM_PhishingBody 3655 2.47 3.97 1.63 72 RCVD_IN_VALIDITY_RPBL 3648 1.48 3.96 0.11 73 TM2_M_VERY_LONG_WORD 3456 2.39 3.76 1.63 74 XM_CamelCaseFrm001 3338 3.19 3.63 2.95 75 DKIM_ADSP_NXDOMAIN 3263 1.55 3.55 0.44 76 MIME_HTML_ONLY_MULTI 3210 3.03 3.49 2.78 77 DKIM_INVALID 3152 2.27 3.43 1.62 78 XM_UB50 3146 1.80 3.42 0.90 79 HTML_IMAGE_RATIO_06 3070 2.52 3.34 2.06 80 HTML_IMAGE_RATIO_08 2852 2.32 3.10 1.89 81 RCVD_IN_VALIDITY_SAFE 2779 4.73 3.02 5.68 82 T_XMHurry_00 2754 1.39 2.99 0.50 83 TR_XM_SpammyWords5 2588 1.90 2.81 1.39 84 FROM_EXCESS_BASE64 2561 2.35 2.78 2.10 85 XMNumbers 2551 3.48 2.77 3.87 86 XMBody_17 2462 1.31 2.68 0.56 87 RCVD_IN_VALIDITY_CERTIFIED 2460 3.85 2.67 4.50 88 RCVD_IN_MSPIKE_H3 2457 3.97 2.67 4.69 89 RCVD_IN_MSPIKE_WL 2457 3.97 2.67 4.69 90 RELAYCOUNTRY_AU 2448 1.34 2.66 0.60 91 T_TooManySym_01 2435 6.43 2.65 8.54 92 XMDiploma_00 2382 1.68 2.59 1.17 93 XM_SPF_SoftFail 2368 1.51 2.57 0.92 94 XM_B_URI_Unicode 2358 2.09 2.56 1.82 95 USER_IN_DEF_DKIM_WL 2261 11.92 2.46 17.17 96 XM_URI_RBL 2182 1.16 2.37 0.49 97 T_XMDrugObfuBody_08 2141 1.57 2.33 1.15 98 T_XMDrugObfuBody_00 2114 1.14 2.30 0.49 99 BOUNCE_MESSAGE 2091 3.62 2.27 4.38 100 ANY_BOUNCE_MESSAGE 2091 3.63 2.27 4.38 101 XMBrknScrpt_02 2045 1.57 2.22 1.20 102 BOTNET_NORDNS 2038 0.80 2.21 0.01 103 TR_XM_NoHeaderRelay 2011 0.91 2.19 0.20 104 NO_DNS_FOR_FROM 1955 1.04 2.12 0.43 105 TR_XM_MaxWHORU 1932 0.98 2.10 0.36 106 MAILING_LIST_MULTI 1922 2.37 2.09 2.52 107 XM_B_Unsub2 1912 1.40 2.08 1.03 108 XM_DK_Undo_01 1904 1.89 2.07 1.79 109 DIET_1 1888 1.14 2.05 0.63 110 TM2_M_URI_OPT_OUT 1866 2.68 2.03 3.04 111 XM_B_SpammyWords4 1848 1.42 2.01 1.10 112 SH_BODYURI_REVERSE_CSS 1794 0.73 1.95 0.06 113 URIBL_CSS_A 1791 0.73 1.95 0.06 114 URIBL_CSS 1791 0.73 1.95 0.06 115 XM_OfRef6 1768 1.45 1.92 1.19 116 XM_B_COPY_HTML 1760 1.57 1.91 1.39 117 SUSP_UTF8_WORD_SUBJ 1737 0.70 1.89 0.04 118 MIME_QP_LONG_LINE 1693 3.75 1.84 4.80 119 XM_ProductURIs 1671 1.03 1.82 0.59 120 TR_XM_PHPForged 1654 0.97 1.80 0.51 121 TR_XM_PHPDW 1651 0.97 1.79 0.52 122 XMStockSpam_06 1605 1.07 1.74 0.70 123 TR_XM_FormFill2 1602 0.95 1.74 0.51 124 XM_H_PHPOS 1579 0.93 1.72 0.50 125 XMBdyGiftCard01 1520 1.05 1.65 0.71 126 XMBounce_01 1517 0.60 1.65 0.02 127 SpammyFromTLD_01 1498 1.05 1.63 0.74 128 URI_HEX 1472 1.23 1.60 1.02 129 ALL_TRUSTED 1469 12.26 1.60 18.18 130 SpammyFromTLD_02 1447 0.69 1.57 0.20 131 XMBody_78 1419 0.69 1.54 0.22 132 HTML_TAG_BALANCE_BODY 1412 0.99 1.53 0.69 133 XMPhish30 1391 1.03 1.51 0.77 134 T_MONEY_PERCENT 1363 0.62 1.48 0.15 135 TR_LOTS_OF_MONEY2 1363 0.62 1.48 0.15 136 TR_Symld_Words 1320 1.44 1.43 1.44 137 XMSlimDrugH 1317 0.78 1.43 0.42 138 SUBJ_ALL_CAPS 1284 1.15 1.40 1.02 139 XMGenDplmaNmb 1226 0.79 1.33 0.49 140 HTTPS_HTTP_MISMATCH 1215 0.74 1.32 0.42 141 URI_NOVOWEL 1186 1.16 1.29 1.09 142 KHOP_HELO_FCRDNS 1185 1.32 1.29 1.34 143 XM_H_Long_From02 1185 1.16 1.29 1.09 144 BAYES_40 1179 3.07 1.28 4.06 145 XM_DIRTYINTL 1175 0.50 1.28 0.08 146 LongTLD 1161 0.66 1.26 0.33 147 XM_B_REG_HTML 1149 0.64 1.25 0.30 148 SHOPIFY_IMG_NOT_RCVD_SFY 1136 0.64 1.23 0.30 149 T_FILL_THIS_FORM_SHORT 1130 0.83 1.23 0.61 150 HTML_MIME_NO_HTML_TAG 1128 1.49 1.23 1.64 151 AC_BR_BONANZA 1126 0.58 1.22 0.22 152 NORDNS_LOW_CONTRAST 1052 0.45 1.14 0.06 153 TR_Mismatch_TLD_01 1045 0.62 1.14 0.33 154 XMReplyNow 1043 0.54 1.13 0.22 155 T_REMOTE_IMAGE 1036 2.54 1.13 3.33 156 XMSubMetaI_00 1035 0.83 1.12 0.66 157 TR_LOTS_OF_MONEY3 1025 0.52 1.11 0.19 158 TM2_M_OBFU_COMMENT 999 0.74 1.09 0.54 159 RCVD_IN_PSBL 979 0.52 1.06 0.22 160 RDNS_DYNAMIC 959 0.79 1.04 0.66 161 TR_XM_RelayPhish 958 0.42 1.04 0.08 162 PLING_QUERY 952 0.73 1.03 0.55 163 XMHTMLBadTable_001 952 0.56 1.03 0.30 164 PDS_RDNS_DYNAMIC_FP 947 0.61 1.03 0.38 165 TR_Mismatch_TLD_02 933 0.40 1.01 0.06 166 DEAR_FRIEND 929 0.39 1.01 0.04 167 T_STY_INVIS_DIRECT 918 0.61 1.00 0.40 168 TR_XM_INV_DKIM 914 0.40 0.99 0.07 169 XM_SendGrid 913 1.04 0.99 1.07 170 TVD_RCVD_IP 909 1.09 0.99 1.15 171 DKIM_ADSP_CUSTOM_MED 908 0.81 0.99 0.71 172 TooManyTo_002 885 1.78 0.96 2.24 173 MPART_ALT_DIFF_COUNT 884 0.61 0.96 0.41 174 XM_UB99 881 0.34 0.96 0.00 175 XM_B_Phish66 869 0.58 0.94 0.38 176 TR_XM_Base64_M1 861 0.89 0.94 0.87 177 TooManyTo_003 851 1.24 0.92 1.42 178 XMSexyCombo_01 840 0.42 0.91 0.15 179 TooManyTo_004 822 1.07 0.89 1.17 180 SUBJ_DOLLARS 807 0.56 0.88 0.38 181 TooManyTo_005 799 0.99 0.87 1.05 182 XM_H_Undi_Recip 798 0.39 0.87 0.12 183 HOSTED_IMG_MULTI_PUB_01 793 0.38 0.86 0.10 184 THIS_AD 785 0.49 0.85 0.29 185 XM_HighProb1 775 0.32 0.84 0.02 186 XM_UB60 769 0.33 0.84 0.05 187 NML_ADSP_CUSTOM_MED 741 0.56 0.81 0.43 188 XM_GoogleGroups 737 1.15 0.80 1.34 189 HELO_DYNAMIC_SPLIT_IP 733 0.29 0.80 0.01 190 XM_B_SEO 730 0.45 0.79 0.26 191 TR_XM_Undi_Recip19 730 0.33 0.79 0.08 192 J_POPCORN_W_RD 711 0.50 0.77 0.34 193 URI_TRY_3LD 711 0.78 0.77 0.79 194 XMHTML_After_End 710 0.40 0.77 0.20 195 XMSolicitRefs_0 704 0.44 0.77 0.26 196 FROM_SUSPICIOUS_NTLD 703 0.30 0.76 0.03 197 FORGED_GMAIL_RCVD 700 0.56 0.76 0.45 198 RELAYCOUNTRY_FR 697 0.38 0.76 0.17 199 XMPhish08 696 0.33 0.76 0.09 200 XM_B_DNDMA 689 0.74 0.75 0.73 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137435 87.68 96.31 82.89 2 RELAYCOUNTRY_US 129240 79.71 82.90 77.95 3 DKIM_SIGNED 123361 79.69 89.22 74.40 4 XM_DK_Pass 121397 77.87 86.26 73.22 5 DKIM_VALID 120670 77.42 85.79 72.78 6 XM_B_Unicode 114418 74.03 83.07 69.01 7 DKIM_VALID_AU 102552 64.75 69.96 61.85 8 BAYES_50 99796 51.93 37.05 60.19 9 DCC_CHECK_NEGATIVE 92449 43.61 21.72 55.76 10 XMListUnsubscribeExists 82411 58.21 73.53 49.70 11 XM_B_SpammyWords 76379 54.91 70.84 46.07 12 DCC_CHECK 73298 56.17 77.72 44.21 13 XM_B_Unicode3 73050 46.24 50.16 44.06 14 RCVD_IN_MSPIKE_H2 59458 36.57 37.84 35.86 15 HTML_FONT_LOW_CONTRAST 52188 34.76 40.67 31.48 16 DKIM_VALID_EF 48959 27.65 24.26 29.53 17 LOC_TINY_FONT_1 45972 36.45 52.16 27.73 18 T_TM2_M_HEADER_IN_MSG 42807 23.58 19.54 25.82 19 FVGT_m_MULTI_ODD 40403 27.73 33.80 24.37 20 XMSubLong 37285 22.52 22.58 22.49 21 MIME_HTML_ONLY 34274 22.60 26.09 20.67 22 XM_B_SpammyWords2 33583 28.22 42.56 20.25 23 T_KAM_HTML_FONT_INVALID 32709 24.95 34.37 19.73 24 ALL_TRUSTED 30150 12.26 1.60 18.18 25 USER_IN_DEF_DKIM_WL 28476 11.92 2.46 17.17 26 XM_Multi_Part_URI 25895 18.99 25.08 15.62 27 TR_XM_DK_Unsub 21656 14.60 17.38 13.06 28 UNPARSEABLE_RELAY 19083 13.35 16.66 11.51 29 BAYES_60 18310 10.18 8.62 11.04 30 FSL_BULK_SIG 17679 9.97 8.73 10.66 31 XM_B_Unsub 14842 11.77 16.85 8.95 32 BAYES_00 14759 5.89 0.47 8.90 33 T_TooManySym_01 14153 6.43 2.65 8.54 34 XM_DKIMWhitelistDomains 14054 5.47 0.04 8.48 35 XM_Evil_Numbers_Gen 13698 8.32 8.42 8.26 36 TooManyTo_001 12026 6.72 5.77 7.25 37 LotsOfNums_01 11974 7.21 7.19 7.22 38 TR_XM_BayesUnsub 11790 10.38 16.29 7.11 39 TR_XM_DK_Bayes 11392 4.56 0.40 6.87 40 XM_B_SpammyWords3 11363 10.58 17.28 6.85 41 TR_MAX_INTL_RELAY 11363 9.97 15.59 6.85 42 TR_XM_DK_Bayes1 11291 4.52 0.39 6.81 43 XM_H_GMP 10555 6.18 5.84 6.37 44 IN_ZIMBRA_NJ_WHITELIST 10032 3.92 0.07 6.05 45 TR_XM_DK_Bayes2 10005 3.95 0.19 6.03 46 XM_B_PhoneNumber 9975 5.32 4.07 6.02 47 T_TooManySym_02 9792 3.99 0.53 5.91 48 RCVD_IN_VALIDITY_SAFE 9418 4.73 3.02 5.68 49 XMStrtUSub 9410 5.17 4.25 5.68 50 XM_DK_Undo_02 9343 18.65 42.09 5.63 51 XM_UncommonTLD01 9295 5.56 5.48 5.61 52 HTML_IMAGE_RATIO_02 9097 6.53 8.41 5.49 53 XM_H_Long_From01 8174 5.00 5.13 4.93 54 MIME_QP_LONG_LINE 7965 3.75 1.84 4.80 55 XMSubMetaSx_00 7899 5.04 5.54 4.76 56 RCVD_IN_MSPIKE_H3 7769 3.97 2.67 4.69 57 RCVD_IN_MSPIKE_WL 7769 3.97 2.67 4.69 58 LOTS_OF_MONEY 7704 6.84 10.78 4.65 59 MPART_ALT_DIFF 7650 5.13 6.06 4.61 60 RCVD_IN_VALIDITY_CERTIFIED 7466 3.85 2.67 4.50 61 BAYES_99 7464 15.60 35.59 4.50 62 XM_B_Phish_Phrases 7462 5.48 7.24 4.50 63 ANY_BOUNCE_MESSAGE 7257 3.63 2.27 4.38 64 BOUNCE_MESSAGE 7255 3.62 2.27 4.38 65 INVALID_MSGID 7138 2.84 0.20 4.31 66 BAYES_80 6782 5.98 9.37 4.09 67 BAYES_40 6735 3.07 1.28 4.06 68 RELAYCOUNTRY_META 6589 7.91 15.01 3.97 69 HTML_IMAGE_RATIO_04 6559 4.08 4.31 3.96 70 TO_MALFORMED 6549 2.54 0.01 3.95 71 XMNumbers 6414 3.48 2.77 3.87 72 BOTNET_IPINHOSTNAME 6339 6.46 11.20 3.82 73 T_REMOTE_IMAGE 5521 2.54 1.13 3.33 74 BAYES_999 5365 12.00 27.78 3.24 75 TR_XM_SpammyWords4 5076 5.46 9.79 3.06 76 TM2_M_URI_OPT_OUT 5040 2.68 2.03 3.04 77 XM_CamelCaseFrm001 4897 3.19 3.63 2.95 78 XM_B_SpammyTLD 4860 3.73 5.18 2.93 79 BAYES_20 4634 2.06 0.75 2.79 80 MIME_HTML_ONLY_MULTI 4614 3.03 3.49 2.78 81 XM_PDF 4609 1.88 0.27 2.78 82 BAYES_95 4577 3.90 5.96 2.76 83 MIME_HTML_MOSTLY 4517 3.43 4.69 2.72 84 XM_Body_Dirty_Words 4444 5.58 10.81 2.68 85 MAILING_LIST_MULTI 4177 2.37 2.09 2.52 86 RCVD_IN_IADB_LISTED 4137 1.77 0.46 2.50 87 TR_XM_DKIM_Undo 3848 11.90 29.16 2.32 88 RCVD_IN_IADB_SPF 3758 1.60 0.40 2.27 89 TooManyTo_002 3709 1.78 0.96 2.24 90 TR_XM_SpammyRelay 3628 5.62 11.81 2.19 91 FROM_EXCESS_BASE64 3485 2.35 2.78 2.10 92 RCVD_IN_IADB_SENDERID 3466 1.48 0.39 2.09 93 HTML_IMAGE_RATIO_06 3418 2.52 3.34 2.06 94 XMGappySubj_01 3405 1.36 0.11 2.05 95 RCVD_IN_IADB_DK 3381 1.45 0.39 2.04 96 T_XMDrugObfuBody_14 3365 3.27 5.49 2.03 97 TVD_SPACE_RATIO 3158 1.28 0.16 1.90 98 XMGappySubj_02 3144 1.23 0.02 1.90 99 HTML_IMAGE_RATIO_08 3141 2.32 3.10 1.89 100 XM_B_URI_Unicode 3019 2.09 2.56 1.82 101 RELAYCOUNTRY_CA 2974 3.66 7.03 1.79 102 XM_DK_Undo_01 2969 1.89 2.07 1.79 103 TR_XM_UnparsRelay 2941 4.27 8.76 1.77 104 IN_HORDE_ADDRESS_BOOK 2921 1.17 0.10 1.76 105 TO_IN_SUBJ 2836 1.19 0.25 1.71 106 T_TooManySym_03 2784 1.12 0.12 1.68 107 BAYES_05 2749 1.20 0.37 1.66 108 HTML_MIME_NO_HTML_TAG 2719 1.49 1.23 1.64 109 TR_XM_PhishingBody 2706 2.47 3.97 1.63 110 TM2_M_VERY_LONG_WORD 2705 2.39 3.76 1.63 111 DKIM_INVALID 2691 2.27 3.43 1.62 112 UNTRUSTED_Relay 2644 3.39 6.62 1.59 113 BOTNET 2587 4.11 8.69 1.56 114 RCVD_IN_IADB_VOUCHED 2536 1.06 0.22 1.53 115 TR_DCC_Bayes_99 2500 10.54 26.80 1.51 116 TR_Symld_Words 2392 1.44 1.43 1.44 117 TooManyTo_003 2347 1.24 0.92 1.42 118 TR_XM_SpammyWords5 2302 1.90 2.81 1.39 119 T_TVD_MIME_NO_HEADERS 2300 0.90 0.03 1.39 120 XM_B_COPY_HTML 2297 1.57 1.91 1.39 121 KHOP_HELO_FCRDNS 2226 1.32 1.29 1.34 122 XM_GoogleGroups 2220 1.15 0.80 1.34 123 XM_B_Investor 2100 2.52 4.78 1.27 124 XMBrknScrpt_02 1997 1.57 2.22 1.20 125 XM_OfRef6 1974 1.45 1.92 1.19 126 XMDiploma_00 1947 1.68 2.59 1.17 127 TooManyTo_004 1940 1.07 0.89 1.17 128 TVD_RCVD_IP 1910 1.09 0.99 1.15 129 T_XMDrugObfuBody_08 1906 1.57 2.33 1.15 130 XMSexyCombo_05 1872 2.36 4.58 1.13 131 XM_B_SpammyWords4 1820 1.42 2.01 1.10 132 URI_NOVOWEL 1805 1.16 1.29 1.09 133 XM_H_Long_From02 1804 1.16 1.29 1.09 134 HTML_IMAGE_ONLY_28 1790 0.73 0.11 1.08 135 XM_SendGrid 1773 1.04 0.99 1.07 136 HTML_EXTRA_CLOSE 1764 0.70 0.03 1.06 137 TooManyTo_005 1744 0.99 0.87 1.05 138 RCVD_IN_IADB_OPTIN 1729 0.72 0.15 1.04 139 XM_B_Unsub2 1706 1.40 2.08 1.03 140 URI_HEX 1694 1.23 1.60 1.02 141 SUBJ_ALL_CAPS 1686 1.15 1.40 1.02 142 XMBody_95 1678 0.69 0.11 1.01 143 XM_H_PHPMailer 1607 0.88 0.71 0.97 144 XM_SPF_SoftFail 1519 1.51 2.57 0.92 145 XM_UB50 1484 1.80 3.42 0.90 146 TR_XM_Base64_M1 1436 0.89 0.94 0.87 147 USER_IN_WELCOMELIST 1346 0.52 0.00 0.81 148 USER_IN_WHITELIST 1346 0.52 0.00 0.81 149 TR_MetaPhish_Combo_01 1316 0.78 0.74 0.79 150 URI_TRY_3LD 1309 0.78 0.77 0.79 151 XMPhish30 1271 1.03 1.51 0.77 152 RCVD_IN_BL_SPAMCOP_NET 1259 3.31 7.91 0.76 153 TR_XM_DK_SendGrid 1241 0.74 0.73 0.75 154 SpammyFromTLD_01 1222 1.05 1.63 0.74 155 XM_B_DNDMA 1212 0.74 0.75 0.73 156 XMBdyGiftCard01 1182 1.05 1.65 0.71 157 DKIM_ADSP_CUSTOM_MED 1181 0.81 0.99 0.71 158 XMStockSpam_06 1166 1.07 1.74 0.70 159 TR_XM_SpammyWords2 1153 5.40 13.87 0.70 160 HTML_TAG_BALANCE_BODY 1149 0.99 1.53 0.69 161 XMSubMetaI_00 1093 0.83 1.12 0.66 162 RDNS_DYNAMIC 1089 0.79 1.04 0.66 163 FILL_THIS_FORM 1077 0.53 0.30 0.65 164 XM_B_FormFill 1065 0.42 0.02 0.64 165 XMNoVowels 1061 0.57 0.44 0.64 166 DIET_1 1049 1.14 2.05 0.63 167 RCVD_IN_PBL 1044 0.66 0.72 0.63 168 T_FILL_THIS_FORM_SHORT 1011 0.83 1.23 0.61 169 RELAYCOUNTRY_AU 999 1.34 2.66 0.60 170 XM_ProductURIs 975 1.03 1.82 0.59 171 XMClaimOffer 963 0.52 0.41 0.58 172 T_TooManySym_04 936 0.37 0.03 0.56 173 XMSubMetaSxObfu_03 933 0.51 0.41 0.56 174 XMBody_17 925 1.31 2.68 0.56 175 PLING_QUERY 918 0.73 1.03 0.55 176 TM2_M_OBFU_COMMENT 901 0.74 1.09 0.54 177 HTML_IMAGE_ONLY_32 898 0.39 0.10 0.54 178 TR_XM_PHPDW 858 0.97 1.79 0.52 179 TR_XM_FormFill2 846 0.95 1.74 0.51 180 TR_XM_PHPForged 842 0.97 1.80 0.51 181 XMBSHREFv2 837 0.42 0.26 0.50 182 XM_H_PHPOS 829 0.93 1.72 0.50 183 T_XMHurry_00 824 1.39 2.99 0.50 184 T_XMDrugObfuBody_00 813 1.14 2.30 0.49 185 XM_URI_RBL 810 1.16 2.37 0.49 186 XMGenDplmaNmb 809 0.79 1.33 0.49 187 XM_S_SubURI 788 0.32 0.05 0.48 188 HTML_IMAGE_ONLY_20 768 0.43 0.37 0.46 189 XMCapTrack 765 0.48 0.52 0.46 190 BASE64_LENGTH_79_INF 750 0.33 0.10 0.45 191 XM_ShortIntro_01 749 0.45 0.45 0.45 192 FORGED_GMAIL_RCVD 748 0.56 0.76 0.45 193 XMLngstWrd_00 743 0.42 0.38 0.45 194 MIME_CHARSET_FARAWAY 738 0.51 0.63 0.45 195 DKIM_ADSP_NXDOMAIN 736 1.55 3.55 0.44 196 NO_DNS_FOR_FROM 718 1.04 2.12 0.43 197 NML_ADSP_CUSTOM_MED 713 0.56 0.81 0.43 198 XMSlimDrugH 703 0.78 1.43 0.42 199 HTML_FONT_FACE_BAD 700 0.49 0.63 0.42 200 TR_XM_SPAMCOP 697 2.49 6.23 0.42 ----------------------------------------------------------------------