Email: 248066 Autolearn: 0 AvgScore: 4.47 AvgScanTime: 1.28 sec Spam: 85574 Autolearn: 0 AvgScore: 13.53 AvgScanTime: 1.33 sec Ham: 162492 Autolearn: 0 AvgScore: -0.30 AvgScanTime: 1.25 sec Time Spent Running SA: 88.34 hours Time Spent Processing Spam: 31.71 hours Time Spent Processing Ham: 56.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 81888 87.17 95.69 82.68 2 DKIM_SIGNED 77474 80.40 90.53 75.06 3 XM_DK_Pass 74023 78.31 86.50 73.99 4 DKIM_VALID 73397 77.68 85.77 73.43 5 RELAYCOUNTRY_US 72237 80.10 84.41 77.82 6 XM_B_Unicode 71606 75.54 83.68 71.25 7 DCC_CHECK 67643 58.63 79.05 47.87 8 XMListUnsubscribeExists 63827 59.56 74.59 51.64 9 XM_B_SpammyWords 60822 54.74 71.08 46.14 10 DKIM_VALID_AU 60729 65.85 70.97 63.16 11 LOC_TINY_FONT_1 45656 38.42 53.35 30.55 12 XM_B_Unicode3 43683 47.73 51.05 45.99 13 XM_B_SpammyWords2 35742 27.36 41.77 19.77 14 HTML_FONT_LOW_CONTRAST 35375 35.04 41.34 31.73 15 XM_DK_Undo_02 34769 17.12 40.63 4.74 16 RCVD_IN_MSPIKE_H2 33962 37.42 39.69 36.23 17 BAYES_50 30716 52.34 35.89 61.00 18 BAYES_99 30413 14.84 35.54 3.94 19 FVGT_m_MULTI_ODD 27361 27.80 31.97 25.60 20 T_KAM_HTML_FONT_INVALID 26860 22.95 31.39 18.50 21 TR_XM_DKIM_Undo 25165 11.50 29.41 2.06 22 BAYES_999 24171 11.69 28.25 2.97 23 TR_DCC_Bayes_99 23666 10.48 27.66 1.43 24 MIME_HTML_ONLY 22117 22.20 25.85 20.28 25 DKIM_VALID_EF 20473 26.73 23.92 28.20 26 XM_Multi_Part_URI 20110 18.70 23.50 16.17 27 XMSubLong 20101 24.60 23.49 25.19 28 DCC_CHECK_NEGATIVE 17474 41.17 20.42 52.10 29 T_TM2_M_HEADER_IN_MSG 15756 22.28 18.41 24.31 30 TR_XM_DK_Unsub 14567 14.40 17.02 13.01 31 RELAYCOUNTRY_META 14220 8.62 16.62 4.41 32 TR_MAX_INTL_RELAY 13922 9.89 16.27 6.53 33 XM_B_SpammyWords3 13600 9.02 15.89 5.41 34 XM_B_Unsub 13193 11.61 15.42 9.61 35 TR_XM_BayesUnsub 12800 10.14 14.96 7.61 36 UNPARSEABLE_RELAY 12315 12.63 14.39 11.70 37 TR_XM_SpammyWords2 11748 5.05 13.73 0.49 38 TR_XM_SpammyRelay 10806 5.88 12.63 2.33 39 BOTNET_IPINHOSTNAME 10204 6.27 11.92 3.29 40 XM_Body_Dirty_Words 9314 5.23 10.88 2.26 41 BAYES_80 8535 6.04 9.97 3.96 42 BAYES_60 7897 10.12 9.23 10.59 43 HTML_IMAGE_RATIO_02 7648 6.63 8.94 5.41 44 LotsOfNums_01 7304 7.19 8.54 6.48 45 TR_XM_UnparsRelay 6716 3.81 7.85 1.69 46 XM_Evil_Numbers_Gen 6536 8.98 7.64 9.69 47 LOTS_OF_MONEY 6456 6.08 7.54 5.32 48 MPART_ALT_DIFF 6417 5.25 7.50 4.07 49 BOTNET 6289 3.25 7.35 1.09 50 XMSubMetaSx_00 6001 6.21 7.01 5.78 51 RCVD_IN_BL_SPAMCOP_NET 5930 2.69 6.93 0.45 52 RELAYCOUNTRY_CA 5833 3.69 6.82 2.04 53 FSL_BULK_SIG 5673 8.87 6.63 10.05 54 TR_XM_SpammyWords4 5604 4.32 6.55 3.15 55 XM_B_Phish_Phrases 5414 5.80 6.33 5.52 56 XM_UncommonTLD01 5167 5.66 6.04 5.46 57 TR_XM_SPAMCOP 5107 2.28 5.97 0.33 58 BAYES_95 5079 3.73 5.94 2.57 59 T_XMDrugObfuBody_14 4832 3.42 5.65 2.25 60 XM_H_Long_From01 4810 5.18 5.62 4.95 61 XM_H_GMP 4769 6.41 5.57 6.85 62 UNTRUSTED_Relay 4476 2.98 5.23 1.80 63 TooManyTo_001 4315 6.63 5.04 7.47 64 MIME_HTML_MOSTLY 4268 3.50 4.99 2.71 65 XMStrtUSub 4132 5.34 4.83 5.61 66 DKIM_INVALID 4077 2.71 4.76 1.63 67 XMSexyCombo_05 4017 2.74 4.69 1.70 68 TR_XM_PhishingBody 3953 3.68 4.62 3.19 69 MIME_HTML_ONLY_MULTI 3865 3.08 4.52 2.32 70 XM_B_SpammyTLD 3709 3.22 4.33 2.63 71 XM_B_Investor 3402 2.22 3.98 1.29 72 XM_CamelCaseFrm001 3394 3.26 3.97 2.89 73 XM_B_PhoneNumber 3337 4.94 3.90 5.49 74 HTML_IMAGE_RATIO_04 3333 4.74 3.89 5.19 75 TR_XM_SpammyWords5 3158 1.90 3.69 0.96 76 XMNumbers 3147 3.69 3.68 3.70 77 RCVD_IN_VALIDITY_RPBL 3073 1.34 3.59 0.15 78 TM2_M_VERY_LONG_WORD 2798 2.29 3.27 1.78 79 TR_XM_NoHeaderRelay 2749 1.29 3.21 0.28 80 RCVD_IN_VALIDITY_SAFE 2732 6.30 3.19 7.94 81 HTML_IMAGE_RATIO_08 2603 2.38 3.04 2.03 82 MIME_QP_LONG_LINE 2535 3.94 2.96 4.46 83 TM2_M_URI_OPT_OUT 2471 3.35 2.89 3.59 84 HTML_IMAGE_RATIO_06 2466 2.45 2.88 2.23 85 RCVD_IN_VALIDITY_CERTIFIED 2465 5.56 2.88 6.97 86 XMBody_17 2404 1.37 2.81 0.61 87 XM_URI_RBL 2331 1.21 2.72 0.42 88 SUSP_UTF8_WORD_SUBJ 2264 0.97 2.65 0.09 89 RELAYCOUNTRY_AU 2232 1.29 2.61 0.60 90 FROM_EXCESS_BASE64 2208 2.52 2.58 2.49 91 XMDiploma_00 2197 2.29 2.57 2.14 92 T_TooManySym_01 2174 5.79 2.54 7.50 93 KHOP_HELO_FCRDNS 2165 1.50 2.53 0.96 94 XM_B_URI_Unicode 2152 2.14 2.51 1.94 95 XM_UB50 2137 1.55 2.50 1.04 96 XM_SPF_SoftFail 2116 1.42 2.47 0.87 97 RCVD_IN_MSPIKE_WL 2114 4.12 2.47 4.99 98 RCVD_IN_MSPIKE_H3 2114 4.12 2.47 4.99 99 T_XMDrugObfuBody_00 2025 1.46 2.37 0.99 100 TR_XM_PHPDW 1991 0.95 2.33 0.23 101 USER_IN_DEF_DKIM_WL 1960 12.81 2.29 18.36 102 TR_XM_PHPForged 1939 0.93 2.27 0.23 103 TR_XM_FormFill2 1918 0.93 2.24 0.23 104 T_XMHurry_00 1897 1.20 2.22 0.67 105 XM_H_PHPOS 1895 0.91 2.21 0.22 106 XMPhish30 1873 1.67 2.19 1.40 107 XMBrknScrpt_02 1821 1.47 2.13 1.12 108 T_XMDrugObfuBody_08 1820 1.62 2.13 1.35 109 XM_OfRef6 1756 1.21 2.05 0.76 110 XM_B_SpammyWords4 1692 1.05 1.98 0.57 111 XM_B_COPY_HTML 1631 1.72 1.91 1.62 112 SpammyFromTLD_02 1579 0.77 1.85 0.21 113 SUBJ_ALL_CAPS 1546 1.03 1.81 0.61 114 MAILING_LIST_MULTI 1492 2.33 1.74 2.64 115 NO_DNS_FOR_FROM 1474 0.90 1.72 0.47 116 TR_XM_MaxWHORU 1464 0.84 1.71 0.38 117 RELAYCOUNTRY_FR 1444 0.71 1.69 0.20 118 DIET_1 1435 1.05 1.68 0.73 119 SpammyFromTLD_01 1435 1.03 1.68 0.68 120 XM_DK_Undo_01 1411 1.63 1.65 1.62 121 XMStockSpam_06 1411 1.73 1.65 1.77 122 ALL_TRUSTED 1404 12.25 1.64 17.83 123 XM_ProductURIs 1392 0.89 1.63 0.50 124 AC_BR_BONANZA 1330 0.66 1.55 0.20 125 XMReplyNow 1325 0.81 1.55 0.42 126 DKIM_ADSP_NXDOMAIN 1324 0.84 1.55 0.46 127 URI_HEX 1321 1.19 1.54 1.00 128 XMBody_78 1321 0.62 1.54 0.14 129 XM_B_Unsub2 1305 1.22 1.52 1.06 130 XM_B_REG_HTML 1251 0.67 1.46 0.25 131 LongTLD 1203 0.62 1.41 0.21 132 HTML_TAG_BALANCE_BODY 1195 1.09 1.40 0.93 133 HTTPS_HTTP_MISMATCH 1180 0.81 1.38 0.50 134 SHOPIFY_IMG_NOT_RCVD_SFY 1164 0.70 1.36 0.35 135 TR_Symld_Words 1161 1.38 1.36 1.39 136 TR_XM_INV_DKIM 1114 0.52 1.30 0.12 137 TooManyTo_002 1090 1.75 1.27 2.01 138 T_FILL_THIS_FORM_SHORT 1085 0.85 1.27 0.63 139 THIS_AD 1074 0.66 1.26 0.35 140 PLING_QUERY 1068 0.70 1.25 0.41 141 BAYES_40 1063 3.33 1.24 4.43 142 XMSexyCombo_01 1062 0.51 1.24 0.13 143 TooManyTo_003 1039 1.27 1.21 1.30 144 XM_HighProb1 1030 0.42 1.20 0.01 145 RCVD_IN_PBL 1016 0.84 1.19 0.66 146 DEAR_FRIEND 1005 0.43 1.17 0.04 147 TVD_RCVD_IP 998 0.99 1.17 0.89 148 RDNS_DYNAMIC 997 0.62 1.17 0.34 149 TooManyTo_004 991 1.09 1.16 1.06 150 PDS_RDNS_DYNAMIC_FP 978 0.45 1.14 0.09 151 TooManyTo_005 972 1.00 1.14 0.93 152 XM_H_Long_From02 963 1.03 1.13 0.99 153 T_STY_INVIS_DIRECT 948 0.65 1.11 0.40 154 HTML_MIME_NO_HTML_TAG 895 1.48 1.05 1.70 155 TM2_M_OBFU_COMMENT 879 0.79 1.03 0.67 156 XM_H_PHPMailer 874 0.79 1.02 0.66 157 T_REMOTE_IMAGE 869 2.36 1.02 3.07 158 XM_UB99 868 0.36 1.01 0.01 159 NORDNS_LOW_CONTRAST 850 0.36 0.99 0.03 160 XM_H_Undi_Recip 836 0.42 0.98 0.13 161 XMSubNoVowel 826 0.61 0.97 0.42 162 XMSubMetaI_00 819 0.80 0.96 0.72 163 XMGenDplmaNmb 805 1.17 0.94 1.29 164 RCVD_IN_XBL 790 0.34 0.92 0.04 165 DATE_IN_PAST_96_XX 778 0.32 0.91 0.00 166 BAYES_20 772 2.40 0.90 3.19 167 XM_DIRTYINTL 765 0.36 0.89 0.07 168 XM_B_Phish66 764 0.50 0.89 0.29 169 TR_Mismatch_TLD_02 760 0.34 0.89 0.06 170 MPART_ALT_DIFF_COUNT 756 0.65 0.88 0.53 171 TR_LOTS_OF_MONEY3 753 0.48 0.88 0.27 172 TR_Mismatch_TLD_01 746 0.51 0.87 0.32 173 HELO_DYNAMIC_SPLIT_IP 745 0.31 0.87 0.01 174 BOTNET_NORDNS 745 0.31 0.87 0.01 175 XMBdyGiftCard01 738 1.11 0.86 1.24 176 TR_XM_Undi_Recip19 729 0.35 0.85 0.09 177 DKIM_ADSP_CUSTOM_MED 727 0.89 0.85 0.91 178 XM_SendGrid 710 1.06 0.83 1.19 179 ANY_BOUNCE_MESSAGE 698 2.78 0.82 3.81 180 BOUNCE_MESSAGE 697 2.77 0.81 3.81 181 XMSlimDrugH 686 0.84 0.80 0.86 182 XM_B_COVIDMETA 683 0.47 0.80 0.30 183 FROM_SUSPICIOUS_NTLD 666 0.32 0.78 0.08 184 HTML_FONT_FACE_BAD 644 0.60 0.75 0.53 185 TR_Caps_n_Bayes_99 639 0.26 0.75 0.00 186 XMPhish14 637 1.02 0.74 1.17 187 MIME_CHARSET_FARAWAY 635 0.50 0.74 0.37 188 TR_XM_Base64_M1 635 0.67 0.74 0.64 189 J_POPCORN_W_RD 634 0.41 0.74 0.24 190 XM_B_Crypto 633 0.28 0.74 0.04 191 TR_XM_RelayPhish 631 0.30 0.74 0.07 192 XM_UB999 628 0.26 0.73 0.01 193 XM_GoogleGroups 628 1.22 0.73 1.48 194 SUBJ_DOLLARS 627 0.38 0.73 0.20 195 NML_ADSP_CUSTOM_MED 599 0.65 0.70 0.62 196 URI_NOVOWEL 590 0.95 0.69 1.09 197 HOSTED_IMG_MULTI_PUB_01 584 0.29 0.68 0.08 198 XM_B_SEO 584 0.44 0.68 0.31 199 XMPhish08 582 0.41 0.68 0.27 200 AC_HTML_NONSENSE_TAGS 577 0.28 0.67 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 134341 87.17 95.69 82.68 2 RELAYCOUNTRY_US 126452 80.10 84.41 77.82 3 DKIM_SIGNED 121964 80.40 90.53 75.06 4 XM_DK_Pass 120232 78.31 86.50 73.99 5 DKIM_VALID 119313 77.68 85.77 73.43 6 XM_B_Unicode 115782 75.54 83.68 71.25 7 DKIM_VALID_AU 102622 65.85 70.97 63.16 8 BAYES_50 99122 52.34 35.89 61.00 9 DCC_CHECK_NEGATIVE 84666 41.17 20.42 52.10 10 XMListUnsubscribeExists 83916 59.56 74.59 51.64 11 DCC_CHECK 77788 58.63 79.05 47.87 12 XM_B_SpammyWords 74971 54.74 71.08 46.14 13 XM_B_Unicode3 74730 47.73 51.05 45.99 14 RCVD_IN_MSPIKE_H2 58871 37.42 39.69 36.23 15 HTML_FONT_LOW_CONTRAST 51558 35.04 41.34 31.73 16 LOC_TINY_FONT_1 49647 38.42 53.35 30.55 17 DKIM_VALID_EF 45828 26.73 23.92 28.20 18 FVGT_m_MULTI_ODD 41601 27.80 31.97 25.60 19 XMSubLong 40927 24.60 23.49 25.19 20 T_TM2_M_HEADER_IN_MSG 39501 22.28 18.41 24.31 21 MIME_HTML_ONLY 32949 22.20 25.85 20.28 22 XM_B_SpammyWords2 32119 27.36 41.77 19.77 23 T_KAM_HTML_FONT_INVALID 30061 22.95 31.39 18.50 24 USER_IN_DEF_DKIM_WL 29829 12.81 2.29 18.36 25 ALL_TRUSTED 28974 12.25 1.64 17.83 26 XM_Multi_Part_URI 26271 18.70 23.50 16.17 27 TR_XM_DK_Unsub 21146 14.40 17.02 13.01 28 UNPARSEABLE_RELAY 19011 12.63 14.39 11.70 29 BAYES_60 17208 10.12 9.23 10.59 30 FSL_BULK_SIG 16337 8.87 6.63 10.05 31 XM_Evil_Numbers_Gen 15739 8.98 7.64 9.69 32 XM_B_Unsub 15610 11.61 15.42 9.61 33 XM_DKIMWhitelistDomains 15371 6.20 0.02 9.46 34 BAYES_00 14086 5.79 0.32 8.67 35 RCVD_IN_VALIDITY_SAFE 12899 6.30 3.19 7.94 36 TR_XM_BayesUnsub 12358 10.14 14.96 7.61 37 T_TooManySym_01 12184 5.79 2.54 7.50 38 TooManyTo_001 12131 6.63 5.04 7.47 39 RCVD_IN_VALIDITY_CERTIFIED 11321 5.56 2.88 6.97 40 XM_H_GMP 11127 6.41 5.57 6.85 41 TR_XM_DK_Bayes 10829 4.45 0.24 6.66 42 TR_XM_DK_Bayes1 10721 4.40 0.24 6.60 43 TR_MAX_INTL_RELAY 10615 9.89 16.27 6.53 44 LotsOfNums_01 10531 7.19 8.54 6.48 45 TR_XM_DK_Bayes2 9725 3.96 0.13 5.98 46 XMSubMetaSx_00 9397 6.21 7.01 5.78 47 XMStrtUSub 9108 5.34 4.83 5.61 48 XM_B_Phish_Phrases 8972 5.80 6.33 5.52 49 XM_B_PhoneNumber 8920 4.94 3.90 5.49 50 IN_ZIMBRA_NJ_WHITELIST 8884 3.62 0.11 5.47 51 XM_UncommonTLD01 8865 5.66 6.04 5.46 52 HTML_IMAGE_RATIO_02 8796 6.63 8.94 5.41 53 XM_B_SpammyWords3 8783 9.02 15.89 5.41 54 LOTS_OF_MONEY 8638 6.08 7.54 5.32 55 HTML_IMAGE_RATIO_04 8435 4.74 3.89 5.19 56 RCVD_IN_MSPIKE_H3 8114 4.12 2.47 4.99 57 RCVD_IN_MSPIKE_WL 8114 4.12 2.47 4.99 58 XM_H_Long_From01 8050 5.18 5.62 4.95 59 XM_DK_Undo_02 7708 17.12 40.63 4.74 60 MIME_QP_LONG_LINE 7242 3.94 2.96 4.46 61 BAYES_40 7195 3.33 1.24 4.43 62 RELAYCOUNTRY_META 7165 8.62 16.62 4.41 63 T_TooManySym_02 7114 3.05 0.52 4.38 64 INVALID_MSGID 6700 2.81 0.33 4.12 65 MPART_ALT_DIFF 6617 5.25 7.50 4.07 66 BAYES_80 6441 6.04 9.97 3.96 67 TO_MALFORMED 6406 2.59 0.01 3.94 68 BAYES_99 6402 14.84 35.54 3.94 69 ANY_BOUNCE_MESSAGE 6186 2.78 0.82 3.81 70 BOUNCE_MESSAGE 6186 2.77 0.81 3.81 71 XMNumbers 6009 3.69 3.68 3.70 72 TM2_M_URI_OPT_OUT 5835 3.35 2.89 3.59 73 BOTNET_IPINHOSTNAME 5338 6.27 11.92 3.29 74 BAYES_20 5186 2.40 0.90 3.19 75 TR_XM_PhishingBody 5182 3.68 4.62 3.19 76 TR_XM_SpammyWords4 5121 4.32 6.55 3.15 77 T_REMOTE_IMAGE 4981 2.36 1.02 3.07 78 BAYES_999 4819 11.69 28.25 2.97 79 XM_CamelCaseFrm001 4703 3.26 3.97 2.89 80 MIME_HTML_MOSTLY 4404 3.50 4.99 2.71 81 MAILING_LIST_MULTI 4289 2.33 1.74 2.64 82 XM_B_SpammyTLD 4279 3.22 4.33 2.63 83 BAYES_95 4168 3.73 5.94 2.57 84 FROM_EXCESS_BASE64 4042 2.52 2.58 2.49 85 TR_XM_SpammyRelay 3792 5.88 12.63 2.33 86 MIME_HTML_ONLY_MULTI 3772 3.08 4.52 2.32 87 XM_Body_Dirty_Words 3666 5.23 10.88 2.26 88 T_XMDrugObfuBody_14 3648 3.42 5.65 2.25 89 XM_PDF 3639 1.60 0.38 2.24 90 HTML_IMAGE_RATIO_06 3620 2.45 2.88 2.23 91 XMGappySubj_01 3596 1.49 0.11 2.21 92 RCVD_IN_IADB_LISTED 3581 1.61 0.47 2.20 93 XMDiploma_00 3485 2.29 2.57 2.14 94 TR_XM_DKIM_Undo 3352 11.50 29.41 2.06 95 RELAYCOUNTRY_CA 3316 3.69 6.82 2.04 96 HTML_IMAGE_RATIO_08 3298 2.38 3.04 2.03 97 TooManyTo_002 3258 1.75 1.27 2.01 98 RCVD_IN_IADB_SPF 3217 1.44 0.41 1.98 99 TVD_SPACE_RATIO 3203 1.36 0.19 1.97 100 XM_B_URI_Unicode 3145 2.14 2.51 1.94 101 XMGappySubj_02 3085 1.26 0.04 1.90 102 IN_HORDE_ADDRESS_BOOK 3050 1.28 0.14 1.88 103 RCVD_IN_IADB_SENDERID 2940 1.32 0.39 1.81 104 UNTRUSTED_Relay 2924 2.98 5.23 1.80 105 TM2_M_VERY_LONG_WORD 2889 2.29 3.27 1.78 106 RCVD_IN_IADB_DK 2886 1.30 0.39 1.78 107 XMStockSpam_06 2875 1.73 1.65 1.77 108 XMSexyCombo_05 2768 2.74 4.69 1.70 109 HTML_MIME_NO_HTML_TAG 2767 1.48 1.05 1.70 110 TR_XM_UnparsRelay 2740 3.81 7.85 1.69 111 BAYES_05 2682 1.24 0.45 1.65 112 DKIM_INVALID 2651 2.71 4.76 1.63 113 XM_DK_Undo_01 2634 1.63 1.65 1.62 114 XM_B_COPY_HTML 2626 1.72 1.91 1.62 115 T_TooManySym_03 2452 1.04 0.16 1.51 116 XM_GoogleGroups 2398 1.22 0.73 1.48 117 RCVD_IN_IADB_VOUCHED 2357 1.03 0.22 1.45 118 TR_DCC_Bayes_99 2330 10.48 27.66 1.43 119 XMPhish30 2274 1.67 2.19 1.40 120 TR_Symld_Words 2253 1.38 1.36 1.39 121 T_XMDrugObfuBody_08 2195 1.62 2.13 1.35 122 HTML_FONT_SIZE_LARGE 2166 1.02 0.43 1.33 123 TooManyTo_003 2114 1.27 1.21 1.30 124 XMGenDplmaNmb 2094 1.17 0.94 1.29 125 XM_B_Investor 2093 2.22 3.98 1.29 126 XMBdyGiftCard01 2019 1.11 0.86 1.24 127 XM_SendGrid 1927 1.06 0.83 1.19 128 XMBody_95 1921 0.84 0.18 1.18 129 XMPhish14 1899 1.02 0.74 1.17 130 XMBrknScrpt_02 1825 1.47 2.13 1.12 131 URI_NOVOWEL 1776 0.95 0.69 1.09 132 BOTNET 1774 3.25 7.35 1.09 133 TooManyTo_004 1718 1.09 1.16 1.06 134 XM_B_Unsub2 1717 1.22 1.52 1.06 135 XM_UB50 1698 1.55 2.50 1.04 136 RCVD_IN_IADB_OPTIN 1696 0.73 0.12 1.04 137 XMHTML_After_End 1672 0.90 0.65 1.03 138 URI_HEX 1622 1.19 1.54 1.00 139 XM_H_Long_From02 1602 1.03 1.13 0.99 140 T_XMDrugObfuBody_00 1601 1.46 2.37 0.99 141 KHOP_HELO_FCRDNS 1560 1.50 2.53 0.96 142 TR_XM_SpammyWords5 1552 1.90 3.69 0.96 143 T_TVD_MIME_NO_HEADERS 1527 0.63 0.05 0.94 144 HTML_TAG_BALANCE_BODY 1505 1.09 1.40 0.93 145 TooManyTo_005 1504 1.00 1.14 0.93 146 DKIM_ADSP_CUSTOM_MED 1474 0.89 0.85 0.91 147 TVD_RCVD_IP 1453 0.99 1.17 0.89 148 TR_XM_DK_SendGrid 1420 0.77 0.58 0.87 149 XM_SPF_SoftFail 1417 1.42 2.47 0.87 150 XMSlimDrugH 1399 0.84 0.80 0.86 151 HTML_IMAGE_ONLY_28 1356 0.59 0.12 0.83 152 USER_IN_WHITELIST 1335 0.54 0.00 0.82 153 USER_IN_WELCOMELIST 1335 0.54 0.00 0.82 154 XM_OfRef6 1242 1.21 2.05 0.76 155 URI_TRY_3LD 1231 0.72 0.65 0.76 156 XM_B_DNDMA 1212 0.66 0.49 0.75 157 DIET_1 1179 1.05 1.68 0.73 158 XMSubMetaI_00 1165 0.80 0.96 0.72 159 SpammyFromTLD_01 1109 1.03 1.68 0.68 160 T_XMHurry_00 1090 1.20 2.22 0.67 161 TM2_M_OBFU_COMMENT 1084 0.79 1.03 0.67 162 XM_H_PHPMailer 1076 0.79 1.02 0.66 163 RCVD_IN_PBL 1068 0.84 1.19 0.66 164 MSGID_FROM_MTA_HEADER 1045 0.47 0.15 0.64 165 TR_XM_Base64_M1 1037 0.67 0.74 0.64 166 T_FILL_THIS_FORM_SHORT 1019 0.85 1.27 0.63 167 T_TooManySym_04 1010 0.42 0.04 0.62 168 NML_ADSP_CUSTOM_MED 1007 0.65 0.70 0.62 169 T_HTML_TAG_BALANCE_CENTER 1006 0.49 0.24 0.62 170 SUBJ_ALL_CAPS 997 1.03 1.81 0.61 171 XMBody_17 991 1.37 2.81 0.61 172 RELAYCOUNTRY_AU 978 1.29 2.61 0.60 173 XMClaimOffer 974 0.50 0.30 0.60 174 XMBSHREFv2 972 0.47 0.23 0.60 175 XMSubMetaSxObfu_03 959 0.61 0.66 0.59 176 XMNoVowels 931 0.52 0.43 0.57 177 XM_B_SpammyWords4 923 1.05 1.98 0.57 178 TR_MetaPhish_Combo_01 904 0.56 0.57 0.56 179 FORGED_GMAIL_RCVD 898 0.57 0.59 0.55 180 XMSolicitRefs_0 893 0.58 0.64 0.55 181 MPART_ALT_DIFF_COUNT 863 0.65 0.88 0.53 182 XMOemUri 855 0.45 0.30 0.53 183 HTML_FONT_FACE_BAD 854 0.60 0.75 0.53 184 XM_B_FormFill 842 0.35 0.02 0.52 185 AD_PREFS 832 0.37 0.10 0.51 186 HTTPS_HTTP_MISMATCH 817 0.81 1.38 0.50 187 XM_ProductURIs 810 0.89 1.63 0.50 188 TR_XM_SpammyWords2 789 5.05 13.73 0.49 189 XM_S_SubURI 768 0.33 0.05 0.47 190 NO_DNS_FOR_FROM 762 0.90 1.72 0.47 191 DKIM_ADSP_NXDOMAIN 754 0.84 1.55 0.46 192 HTML_TEXT_INVISIBLE_STYLE 743 0.37 0.21 0.46 193 RCVD_IN_BL_SPAMCOP_NET 733 2.69 6.93 0.45 194 XMLngstWrd_00 732 0.41 0.33 0.45 195 HTML_IMAGE_ONLY_20 690 0.49 0.61 0.42 196 XM_URI_RBL 681 1.21 2.72 0.42 197 XMSubNoVowel 681 0.61 0.97 0.42 198 XMReplyNow 678 0.81 1.55 0.42 199 PLING_QUERY 661 0.70 1.25 0.41 200 T_STY_INVIS_DIRECT 657 0.65 1.11 0.40 ----------------------------------------------------------------------