Email: 252372 Autolearn: 0 AvgScore: 5.06 AvgScanTime: 1.32 sec Spam: 88665 Autolearn: 0 AvgScore: 13.65 AvgScanTime: 1.37 sec Ham: 163707 Autolearn: 0 AvgScore: 0.41 AvgScanTime: 1.29 sec Time Spent Running SA: 92.34 hours Time Spent Processing Spam: 33.63 hours Time Spent Processing Ham: 58.71 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84507 87.94 95.31 83.94 2 DKIM_SIGNED 79567 80.70 89.74 75.81 3 XM_DK_Pass 76450 78.83 86.22 74.83 4 DKIM_VALID 75845 78.26 85.54 74.31 5 XM_B_Unicode 75040 77.15 84.63 73.10 6 RELAYCOUNTRY_US 74077 80.13 83.55 78.29 7 DCC_CHECK 70515 59.11 79.53 48.05 8 XMListUnsubscribeExists 67006 60.84 75.57 52.86 9 XM_B_SpammyWords 63836 55.46 72.00 46.50 10 DKIM_VALID_AU 63622 66.33 71.76 63.40 11 LOC_TINY_FONT_1 47866 38.79 53.99 30.57 12 XM_B_Unicode3 46888 48.07 52.88 45.47 13 XM_B_SpammyWords2 38036 29.06 42.90 21.56 14 XM_DK_Undo_02 36042 18.19 40.65 6.02 15 HTML_FONT_LOW_CONTRAST 35956 34.48 40.55 31.19 16 RCVD_IN_MSPIKE_H2 33229 36.16 37.48 35.44 17 BAYES_50 32496 52.87 36.65 61.65 18 BAYES_99 30973 14.74 34.93 3.81 19 T_KAM_HTML_FONT_INVALID 28743 23.15 32.42 18.13 20 FVGT_m_MULTI_ODD 27666 26.91 31.20 24.59 21 TR_XM_DKIM_Undo 25647 11.56 28.93 2.15 22 BAYES_999 23989 11.38 27.06 2.89 23 TR_DCC_Bayes_99 23811 10.41 26.86 1.50 24 MIME_HTML_ONLY 21335 21.29 24.06 19.79 25 DKIM_VALID_EF 20985 26.90 23.67 28.65 26 XM_Multi_Part_URI 20689 19.11 23.33 16.82 27 XMSubLong 20080 22.97 22.65 23.15 28 DCC_CHECK_NEGATIVE 17677 40.69 19.94 51.93 29 T_TM2_M_HEADER_IN_MSG 16621 21.94 18.75 23.67 30 TR_XM_DK_Unsub 15216 14.73 17.16 13.42 31 TR_MAX_INTL_RELAY 14941 10.02 16.85 6.32 32 XM_B_SpammyWords3 14454 9.10 16.30 5.20 33 RELAYCOUNTRY_META 13930 7.92 15.71 3.70 34 UNPARSEABLE_RELAY 13285 13.51 14.98 12.72 35 XM_B_Unsub 12313 11.79 13.89 10.65 36 TR_XM_BayesUnsub 11970 10.32 13.50 8.60 37 TR_XM_SpammyWords2 11969 5.03 13.50 0.44 38 TR_XM_SpammyRelay 9976 5.17 11.25 1.88 39 BOTNET_IPINHOSTNAME 9694 6.96 10.93 4.81 40 LOTS_OF_MONEY 9581 7.78 10.81 6.14 41 XM_Body_Dirty_Words 9056 6.12 10.21 3.90 42 BAYES_80 8950 6.01 10.09 3.80 43 TR_XM_SpammyWords4 8691 5.78 9.80 3.60 44 BAYES_60 7869 9.84 8.87 10.37 45 TR_XM_UnparsRelay 7549 4.01 8.51 1.57 46 HTML_IMAGE_RATIO_02 7160 6.56 8.08 5.74 47 BOTNET 7078 4.28 7.98 2.27 48 FSL_BULK_SIG 6947 8.10 7.84 8.25 49 XM_Evil_Numbers_Gen 6476 9.44 7.30 10.60 50 LotsOfNums_01 6473 7.42 7.30 7.48 51 XM_UncommonTLD01 6325 6.04 7.13 5.45 52 RELAYCOUNTRY_CA 6026 3.44 6.80 1.63 53 RCVD_IN_BL_SPAMCOP_NET 5943 2.76 6.70 0.62 54 BAYES_95 5434 3.79 6.13 2.52 55 XMSubMetaSx_00 5406 4.64 6.10 3.84 56 XM_H_Long_From01 5266 5.41 5.94 5.13 57 MPART_ALT_DIFF 5256 4.90 5.93 4.34 58 XM_B_Phish_Phrases 5109 6.00 5.76 6.13 59 UNTRUSTED_Relay 5044 3.15 5.69 1.77 60 XM_H_GMP 4811 5.72 5.43 5.87 61 TR_XM_SPAMCOP 4710 2.15 5.31 0.44 62 T_XMDrugObfuBody_14 4595 3.12 5.18 2.00 63 XM_B_Investor 4233 2.61 4.77 1.43 64 XM_B_SpammyTLD 4220 3.02 4.76 2.08 65 XMSexyCombo_05 3925 2.42 4.43 1.33 66 DKIM_INVALID 3722 2.45 4.20 1.50 67 HTML_IMAGE_RATIO_04 3697 4.78 4.17 5.11 68 SUSP_UTF8_WORD_SUBJ 3663 1.46 4.13 0.02 69 TR_XM_PhishingBody 3489 2.51 3.94 1.74 70 MIME_HTML_MOSTLY 3470 3.07 3.91 2.61 71 SUSP_UTF8_WORD_COMBO 3447 1.40 3.89 0.05 72 TooManyTo_001 3425 6.24 3.86 7.52 73 XMStrtUSub 3364 5.36 3.79 6.20 74 XM_B_PhoneNumber 3308 5.34 3.73 6.22 75 TM2_M_VERY_LONG_WORD 3216 2.60 3.63 2.05 76 XM_CamelCaseFrm001 3164 2.96 3.57 2.63 77 RCVD_IN_VALIDITY_SAFE 2814 5.89 3.17 7.36 78 T_XMDrugObfuBody_00 2813 2.05 3.17 1.45 79 MIME_HTML_ONLY_MULTI 2810 2.67 3.17 2.41 80 HTML_IMAGE_RATIO_06 2790 3.14 3.15 3.14 81 TR_XM_SpammyWords5 2706 1.98 3.05 1.39 82 XMNumbers 2539 3.28 2.86 3.50 83 RCVD_IN_VALIDITY_RPBL 2513 1.12 2.83 0.19 84 RCVD_IN_VALIDITY_CERTIFIED 2462 4.57 2.78 5.54 85 RELAYCOUNTRY_AU 2445 1.30 2.76 0.51 86 XMBody_17 2405 1.26 2.71 0.48 87 T_XMHurry_00 2398 1.33 2.70 0.58 88 XM_SPF_SoftFail 2379 1.62 2.68 1.05 89 TR_XM_NoHeaderRelay 2282 1.08 2.57 0.27 90 XMBrknScrpt_02 2280 1.80 2.57 1.38 91 XM_UB50 2277 1.51 2.57 0.94 92 TM2_M_URI_OPT_OUT 2190 3.26 2.47 3.68 93 RCVD_IN_MSPIKE_H3 2175 3.76 2.45 4.47 94 RCVD_IN_MSPIKE_WL 2175 3.76 2.45 4.47 95 XM_OfRef6 2166 1.43 2.44 0.88 96 T_XMDrugObfuBody_08 2107 1.72 2.38 1.36 97 XMBody_78 2031 0.89 2.29 0.13 98 XMDiploma_00 1980 2.23 2.23 2.23 99 XM_URI_RBL 1979 1.14 2.23 0.56 100 HTML_IMAGE_RATIO_08 1967 2.03 2.22 1.94 101 XM_B_COPY_HTML 1964 1.55 2.22 1.19 102 ALL_TRUSTED 1931 12.36 2.18 17.88 103 SpammyFromTLD_02 1908 0.90 2.15 0.22 104 USER_IN_DEF_DKIM_WL 1841 12.25 2.08 17.75 105 SpammyFromTLD_01 1822 1.14 2.05 0.64 106 DIET_1 1817 1.07 2.05 0.54 107 XM_B_URI_Unicode 1816 2.13 2.05 2.18 108 DKIM_ADSP_NXDOMAIN 1770 1.01 2.00 0.47 109 TR_XM_PHPForged 1728 0.80 1.95 0.18 110 FROM_EXCESS_BASE64 1727 2.08 1.95 2.16 111 TR_XM_PHPDW 1721 0.79 1.94 0.17 112 XM_B_SpammyWords4 1697 1.04 1.91 0.57 113 TR_XM_FormFill2 1684 0.79 1.90 0.18 114 XM_H_PHPOS 1655 0.76 1.87 0.16 115 XMStockSpam_06 1648 1.72 1.86 1.65 116 T_TooManySym_01 1613 5.29 1.82 7.17 117 MAILING_LIST_MULTI 1607 2.24 1.81 2.47 118 NO_DNS_FOR_FROM 1602 0.93 1.81 0.46 119 XMPhish30 1582 1.13 1.78 0.78 120 HTML_TAG_BALANCE_BODY 1567 1.14 1.77 0.80 121 TR_XM_MaxWHORU 1563 0.86 1.76 0.37 122 SH_BODYURI_REVERSE_CSS 1505 0.64 1.70 0.07 123 URIBL_CSS_A 1504 0.64 1.70 0.07 124 URIBL_CSS 1504 0.64 1.70 0.07 125 SUBJ_ALL_CAPS 1501 1.14 1.69 0.84 126 MIME_QP_LONG_LINE 1492 4.05 1.68 5.33 127 TR_Mismatch_TLD_02 1486 0.63 1.68 0.07 128 XM_B_REG_HTML 1476 0.77 1.66 0.29 129 THIS_AD 1458 1.04 1.64 0.71 130 XMSubMetaI_00 1433 1.06 1.62 0.76 131 TR_XM_INV_DKIM 1431 0.63 1.61 0.10 132 T_FILL_THIS_FORM_SHORT 1426 1.02 1.61 0.71 133 T_REMOTE_IMAGE 1414 2.41 1.59 2.85 134 XMSubNoVowel 1322 0.71 1.49 0.29 135 XM_DK_Undo_01 1303 1.54 1.47 1.59 136 XM_B_Unsub2 1284 1.90 1.45 2.14 137 LongTLD 1223 0.63 1.38 0.23 138 T_STY_INVIS_DIRECT 1221 0.78 1.38 0.45 139 HTTPS_HTTP_MISMATCH 1218 0.78 1.37 0.46 140 XMReplyNow 1210 0.69 1.36 0.33 141 URI_HEX 1203 1.27 1.36 1.23 142 XM_ProductURIs 1152 0.77 1.30 0.49 143 TR_LOTS_OF_MONEY3 1135 0.65 1.28 0.31 144 KHOP_HELO_FCRDNS 1126 1.14 1.27 1.07 145 XMSubLongNoVowel 1099 0.44 1.24 0.01 146 AC_BR_BONANZA 1063 0.58 1.20 0.25 147 XMBdyGiftCard01 1047 1.26 1.18 1.30 148 XMSlimDrugH 1042 0.74 1.18 0.51 149 BAYES_40 1041 3.14 1.17 4.21 150 RELAYCOUNTRY_FR 1007 0.49 1.14 0.15 151 RDNS_DYNAMIC 990 0.66 1.12 0.41 152 PDS_RDNS_DYNAMIC_FP 973 0.47 1.10 0.13 153 BOTNET_NORDNS 949 0.38 1.07 0.01 154 TVD_RCVD_IP 949 1.02 1.07 0.99 155 HTML_MIME_NO_HTML_TAG 936 1.37 1.06 1.54 156 XM_B_SEO 934 0.58 1.05 0.32 157 TR_LOTS_OF_MONEY2 913 0.45 1.03 0.13 158 T_MONEY_PERCENT 913 0.45 1.03 0.13 159 SHOPIFY_IMG_NOT_RCVD_SFY 898 0.77 1.01 0.64 160 XM_DIRTYINTL 891 0.39 1.00 0.06 161 URI_TRY_3LD 888 0.85 1.00 0.76 162 XM_OfRef7 884 0.46 1.00 0.18 163 HOSTED_IMG_MULTI_PUB_01 880 0.39 0.99 0.06 164 XMSexyCombo_01 860 0.46 0.97 0.19 165 XM_UB99 858 0.35 0.97 0.01 166 RCVD_IN_PBL 854 0.73 0.96 0.60 167 XM_H_Long_From02 849 1.05 0.96 1.09 168 TR_Symld_Words 845 1.08 0.95 1.15 169 XM_ShortIntro_01 844 0.58 0.95 0.38 170 DKIM_ADSP_CUSTOM_MED 840 0.93 0.95 0.91 171 TM2_M_OBFU_COMMENT 832 0.72 0.94 0.61 172 XM_UB60 820 0.35 0.92 0.04 173 XM_SendGrid 808 1.23 0.91 1.41 174 AC_HTML_NONSENSE_TAGS 797 0.37 0.90 0.08 175 TR_Mismatch_TLD_01 794 0.48 0.90 0.26 176 URI_NOVOWEL 787 1.00 0.89 1.06 177 XM_H_PHPMailer 786 0.76 0.89 0.69 178 FROM_SUSPICIOUS_NTLD 782 0.36 0.88 0.07 179 MPART_ALT_DIFF_COUNT 777 0.74 0.88 0.67 180 RCVD_IN_XBL 777 0.32 0.88 0.02 181 HELO_DYNAMIC_SPLIT_IP 762 0.31 0.86 0.01 182 XM_Nigeria_01 749 0.34 0.84 0.06 183 TR_XM_RelayPhish 747 0.33 0.84 0.06 184 MISSING_HEADERS 745 0.52 0.84 0.34 185 XM_HighProb1 741 0.30 0.84 0.00 186 BAYES_20 737 2.19 0.83 2.93 187 T_Symld_Words_02 728 0.52 0.82 0.36 188 NML_ADSP_CUSTOM_MED 725 0.69 0.82 0.61 189 TR_XM_SEO4 712 0.39 0.80 0.17 190 FROM_SUSPICIOUS_NTLD_FP 711 0.30 0.80 0.03 191 TR_XM_FormFill 698 0.29 0.79 0.02 192 RELAYCOUNTRY_RU 682 0.29 0.77 0.02 193 XM_GoogleGroups 680 1.11 0.77 1.30 194 XM_H_Undi_Recip 677 0.34 0.76 0.11 195 XMSubMetaSxObfu_03 676 0.62 0.76 0.54 196 TR_XM_InvalidRelay 676 0.27 0.76 0.01 197 MIME_CHARSET_FARAWAY 670 0.62 0.76 0.54 198 XMGenDplmaNmb 662 1.34 0.75 1.66 199 BOUNCE_MESSAGE 652 3.02 0.74 4.26 200 ANY_BOUNCE_MESSAGE 652 3.02 0.74 4.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137423 87.94 95.31 83.94 2 RELAYCOUNTRY_US 128161 80.13 83.55 78.29 3 DKIM_SIGNED 124104 80.70 89.74 75.81 4 XM_DK_Pass 122497 78.83 86.22 74.83 5 DKIM_VALID 121650 78.26 85.54 74.31 6 XM_B_Unicode 119675 77.15 84.63 73.10 7 DKIM_VALID_AU 103786 66.33 71.76 63.40 8 BAYES_50 100926 52.87 36.65 61.65 9 XMListUnsubscribeExists 86542 60.84 75.57 52.86 10 DCC_CHECK_NEGATIVE 85010 40.69 19.94 51.93 11 DCC_CHECK 78666 59.11 79.53 48.05 12 XM_B_SpammyWords 76127 55.46 72.00 46.50 13 XM_B_Unicode3 74431 48.07 52.88 45.47 14 RCVD_IN_MSPIKE_H2 58023 36.16 37.48 35.44 15 HTML_FONT_LOW_CONTRAST 51058 34.48 40.55 31.19 16 LOC_TINY_FONT_1 50041 38.79 53.99 30.57 17 DKIM_VALID_EF 46902 26.90 23.67 28.65 18 FVGT_m_MULTI_ODD 40249 26.91 31.20 24.59 19 T_TM2_M_HEADER_IN_MSG 38752 21.94 18.75 23.67 20 XMSubLong 37890 22.97 22.65 23.15 21 XM_B_SpammyWords2 35294 29.06 42.90 21.56 22 MIME_HTML_ONLY 32399 21.29 24.06 19.79 23 T_KAM_HTML_FONT_INVALID 29676 23.15 32.42 18.13 24 ALL_TRUSTED 29274 12.36 2.18 17.88 25 USER_IN_DEF_DKIM_WL 29066 12.25 2.08 17.75 26 XM_Multi_Part_URI 27541 19.11 23.33 16.82 27 TR_XM_DK_Unsub 21968 14.73 17.16 13.42 28 UNPARSEABLE_RELAY 20822 13.51 14.98 12.72 29 XM_B_Unsub 17436 11.79 13.89 10.65 30 XM_Evil_Numbers_Gen 17348 9.44 7.30 10.60 31 BAYES_60 16977 9.84 8.87 10.37 32 XM_DKIMWhitelistDomains 16392 6.52 0.06 10.01 33 BAYES_00 14880 6.01 0.34 9.09 34 TR_XM_BayesUnsub 14083 10.32 13.50 8.60 35 FSL_BULK_SIG 13499 8.10 7.84 8.25 36 TooManyTo_001 12314 6.24 3.86 7.52 37 LotsOfNums_01 12252 7.42 7.30 7.48 38 RCVD_IN_VALIDITY_SAFE 12043 5.89 3.17 7.36 39 T_TooManySym_01 11743 5.29 1.82 7.17 40 TR_XM_DK_Bayes 11672 4.72 0.26 7.13 41 TR_XM_DK_Bayes1 11597 4.69 0.26 7.08 42 TR_MAX_INTL_RELAY 10352 10.02 16.85 6.32 43 XM_B_PhoneNumber 10177 5.34 3.73 6.22 44 TR_XM_DK_Bayes2 10174 4.08 0.14 6.21 45 XMStrtUSub 10156 5.36 3.79 6.20 46 LOTS_OF_MONEY 10046 7.78 10.81 6.14 47 XM_B_Phish_Phrases 10037 6.00 5.76 6.13 48 XM_DK_Undo_02 9858 18.19 40.65 6.02 49 XM_H_GMP 9613 5.72 5.43 5.87 50 HTML_IMAGE_RATIO_02 9390 6.56 8.08 5.74 51 RCVD_IN_VALIDITY_CERTIFIED 9073 4.57 2.78 5.54 52 XM_UncommonTLD01 8917 6.04 7.13 5.45 53 IN_ZIMBRA_NJ_WHITELIST 8832 3.52 0.05 5.40 54 MIME_QP_LONG_LINE 8718 4.05 1.68 5.33 55 XM_B_SpammyWords3 8512 9.10 16.30 5.20 56 XM_H_Long_From01 8397 5.41 5.94 5.13 57 HTML_IMAGE_RATIO_04 8360 4.78 4.17 5.11 58 BOTNET_IPINHOSTNAME 7880 6.96 10.93 4.81 59 RCVD_IN_MSPIKE_H3 7320 3.76 2.45 4.47 60 RCVD_IN_MSPIKE_WL 7320 3.76 2.45 4.47 61 MPART_ALT_DIFF 7107 4.90 5.93 4.34 62 T_TooManySym_02 6983 2.95 0.53 4.27 63 BOUNCE_MESSAGE 6977 3.02 0.74 4.26 64 ANY_BOUNCE_MESSAGE 6977 3.02 0.74 4.26 65 BAYES_40 6890 3.14 1.17 4.21 66 INVALID_MSGID 6606 2.69 0.19 4.04 67 XM_Body_Dirty_Words 6380 6.12 10.21 3.90 68 XMSubMetaSx_00 6292 4.64 6.10 3.84 69 BAYES_99 6231 14.74 34.93 3.81 70 BAYES_80 6227 6.01 10.09 3.80 71 TO_MALFORMED 6203 2.46 0.00 3.79 72 RELAYCOUNTRY_META 6049 7.92 15.71 3.70 73 TM2_M_URI_OPT_OUT 6032 3.26 2.47 3.68 74 TR_XM_SpammyWords4 5893 5.78 9.80 3.60 75 XMNumbers 5727 3.28 2.86 3.50 76 HTML_IMAGE_RATIO_06 5144 3.14 3.15 3.14 77 BAYES_20 4798 2.19 0.83 2.93 78 BAYES_999 4738 11.38 27.06 2.89 79 T_REMOTE_IMAGE 4673 2.41 1.59 2.85 80 XM_CamelCaseFrm001 4301 2.96 3.57 2.63 81 MIME_HTML_MOSTLY 4272 3.07 3.91 2.61 82 BAYES_95 4119 3.79 6.13 2.52 83 MAILING_LIST_MULTI 4041 2.24 1.81 2.47 84 MIME_HTML_ONLY_MULTI 3939 2.67 3.17 2.41 85 RCVD_IN_IADB_LISTED 3898 1.76 0.62 2.38 86 BOTNET 3722 4.28 7.98 2.27 87 XMDiploma_00 3654 2.23 2.23 2.23 88 XM_B_URI_Unicode 3562 2.13 2.05 2.18 89 FROM_EXCESS_BASE64 3528 2.08 1.95 2.16 90 XM_PDF 3527 1.49 0.26 2.15 91 TR_XM_DKIM_Undo 3525 11.56 28.93 2.15 92 RCVD_IN_IADB_SPF 3513 1.59 0.55 2.15 93 XM_B_Unsub2 3499 1.90 1.45 2.14 94 XM_B_SpammyTLD 3409 3.02 4.76 2.08 95 TM2_M_VERY_LONG_WORD 3356 2.60 3.63 2.05 96 TVD_SPACE_RATIO 3319 1.37 0.17 2.03 97 T_XMDrugObfuBody_14 3276 3.12 5.18 2.00 98 RCVD_IN_IADB_SENDERID 3212 1.46 0.52 1.96 99 HTML_IMAGE_RATIO_08 3168 2.03 2.22 1.94 100 RCVD_IN_IADB_DK 3142 1.43 0.53 1.92 101 TR_XM_SpammyRelay 3075 5.17 11.25 1.88 102 TooManyTo_002 2972 1.41 0.67 1.82 103 IN_HORDE_ADDRESS_BOOK 2944 1.22 0.16 1.80 104 UNTRUSTED_Relay 2896 3.15 5.69 1.77 105 TR_XM_PhishingBody 2847 2.51 3.94 1.74 106 XMGenDplmaNmb 2725 1.34 0.75 1.66 107 XMStockSpam_06 2702 1.72 1.86 1.65 108 XMGappySubj_01 2672 1.09 0.10 1.63 109 RELAYCOUNTRY_CA 2663 3.44 6.80 1.63 110 BAYES_05 2659 1.21 0.45 1.62 111 XM_DK_Undo_01 2595 1.54 1.47 1.59 112 TR_XM_UnparsRelay 2567 4.01 8.51 1.57 113 XM_Body_Dirty_Words_01 2546 1.19 0.52 1.56 114 HTML_MIME_NO_HTML_TAG 2523 1.37 1.06 1.54 115 RCVD_IN_IADB_VOUCHED 2469 1.07 0.27 1.51 116 TR_DCC_Bayes_99 2456 10.41 26.86 1.50 117 DKIM_INVALID 2454 2.45 4.20 1.50 118 T_TooManySym_03 2431 1.01 0.12 1.48 119 XMGappySubj_02 2427 0.97 0.03 1.48 120 XMHTML_After_End 2387 1.17 0.64 1.46 121 T_XMDrugObfuBody_00 2367 2.05 3.17 1.45 122 XM_B_Investor 2348 2.61 4.77 1.43 123 XM_SendGrid 2307 1.23 0.91 1.41 124 FROM_GOV_DKIM_AU 2286 0.92 0.04 1.40 125 TR_XM_SpammyWords5 2281 1.98 3.05 1.39 126 XMBrknScrpt_02 2267 1.80 2.57 1.38 127 T_XMDrugObfuBody_08 2231 1.72 2.38 1.36 128 XMSexyCombo_05 2185 2.42 4.43 1.33 129 XM_GoogleGroups 2130 1.11 0.77 1.30 130 XMBdyGiftCard01 2126 1.26 1.18 1.30 131 URI_HEX 2011 1.27 1.36 1.23 132 XM_B_COPY_HTML 1946 1.55 2.22 1.19 133 TR_Symld_Words 1878 1.08 0.95 1.15 134 TooManyTo_003 1789 0.92 0.60 1.09 135 XM_H_Long_From02 1789 1.05 0.96 1.09 136 KHOP_HELO_FCRDNS 1744 1.14 1.27 1.07 137 URI_NOVOWEL 1735 1.00 0.89 1.06 138 XM_SPF_SoftFail 1718 1.62 2.68 1.05 139 RCVD_IN_IADB_OPTIN 1698 0.73 0.16 1.04 140 TR_XM_Base64_M1 1677 0.88 0.62 1.02 141 TR_XM_DK_SendGrid 1649 0.89 0.69 1.01 142 TVD_RCVD_IP 1626 1.02 1.07 0.99 143 T_TVD_MIME_NO_HEADERS 1613 0.65 0.03 0.99 144 XM_UB50 1538 1.51 2.57 0.94 145 XMLngstWrd_00 1498 0.70 0.30 0.92 146 DKIM_ADSP_CUSTOM_MED 1495 0.93 0.95 0.91 147 TooManyTo_004 1452 0.77 0.56 0.89 148 XM_OfRef6 1445 1.43 2.44 0.88 149 XMBody_95 1381 0.59 0.12 0.84 150 SUBJ_ALL_CAPS 1381 1.14 1.69 0.84 151 HTML_TAG_BALANCE_BODY 1314 1.14 1.77 0.80 152 XMPhish30 1280 1.13 1.78 0.78 153 URI_TRY_3LD 1245 0.85 1.00 0.76 154 XMSubMetaI_00 1243 1.06 1.62 0.76 155 TooManyTo_005 1225 0.67 0.53 0.75 156 XM_B_DNDMA 1201 0.67 0.55 0.73 157 TR_MetaPhish_Combo_01 1174 0.70 0.66 0.72 158 THIS_AD 1164 1.04 1.64 0.71 159 T_FILL_THIS_FORM_SHORT 1158 1.02 1.61 0.71 160 XM_H_PHPMailer 1136 0.76 0.89 0.69 161 MPART_ALT_DIFF_COUNT 1103 0.74 0.88 0.67 162 XMBSHREFv2 1094 0.51 0.23 0.67 163 SpammyFromTLD_01 1052 1.14 2.05 0.64 164 SHOPIFY_IMG_NOT_RCVD_SFY 1051 0.77 1.01 0.64 165 XMNoVowels 1017 0.65 0.72 0.62 166 RCVD_IN_BL_SPAMCOP_NET 1016 2.76 6.70 0.62 167 T_TooManySym_04 1011 0.41 0.03 0.62 168 NML_ADSP_CUSTOM_MED 1004 0.69 0.82 0.61 169 TM2_M_OBFU_COMMENT 992 0.72 0.94 0.61 170 RCVD_IN_PBL 986 0.73 0.96 0.60 171 T_XMHurry_00 953 1.33 2.70 0.58 172 FORGED_GMAIL_RCVD 943 0.61 0.69 0.58 173 XM_B_SpammyWords4 933 1.04 1.91 0.57 174 XMLngstWrd_01 931 0.45 0.23 0.57 175 XM_URI_RBL 910 1.14 2.23 0.56 176 PLING_QUERY 907 0.62 0.73 0.55 177 MIME_CHARSET_FARAWAY 885 0.62 0.76 0.54 178 XMSubMetaSxObfu_03 883 0.62 0.76 0.54 179 DIET_1 877 1.07 2.05 0.54 180 XMSlimDrugH 835 0.74 1.18 0.51 181 HTML_FONT_FACE_BAD 832 0.58 0.73 0.51 182 RELAYCOUNTRY_AU 832 1.30 2.76 0.51 183 XM_S_SubURI 823 0.34 0.05 0.50 184 XM_ProductURIs 800 0.77 1.30 0.49 185 XMBody_17 784 1.26 2.71 0.48 186 XM_B_FormFill 773 0.32 0.04 0.47 187 DKIM_ADSP_NXDOMAIN 769 1.01 2.00 0.47 188 XMLngstWrd_02 764 0.36 0.18 0.47 189 HTTPS_HTTP_MISMATCH 753 0.78 1.37 0.46 190 MSGID_FROM_MTA_HEADER 752 0.34 0.12 0.46 191 NO_DNS_FOR_FROM 749 0.93 1.81 0.46 192 T_STY_INVIS_DIRECT 738 0.78 1.38 0.45 193 XMCapTrack 732 0.41 0.34 0.45 194 TR_XM_SpammyWords2 727 5.03 13.50 0.44 195 XMPhish14 723 0.51 0.64 0.44 196 TR_XM_SPAMCOP 718 2.15 5.31 0.44 197 FONT_INVIS_POSTEXTRAS 677 0.28 0.02 0.41 198 XM_Walgreens_Forge 676 0.28 0.02 0.41 199 XMClaimOffer 664 0.40 0.39 0.41 200 RDNS_DYNAMIC 664 0.66 1.12 0.41 ----------------------------------------------------------------------