Email: 258132 Autolearn: 0 AvgScore: 4.98 AvgScanTime: 1.36 sec Spam: 92176 Autolearn: 0 AvgScore: 13.98 AvgScanTime: 1.44 sec Ham: 165956 Autolearn: 0 AvgScore: -0.02 AvgScanTime: 1.31 sec Time Spent Running SA: 97.33 hours Time Spent Processing Spam: 36.99 hours Time Spent Processing Ham: 60.35 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 88033 87.52 95.51 83.09 2 DKIM_SIGNED 82700 81.00 89.72 76.16 3 XM_DK_Pass 78652 78.48 85.33 74.68 4 DKIM_VALID 78030 77.89 84.65 74.14 5 RELAYCOUNTRY_US 77490 81.34 84.07 79.83 6 XM_B_Unicode 76602 74.92 83.10 70.38 7 DCC_CHECK 72145 59.98 78.27 49.82 8 XMListUnsubscribeExists 66779 61.20 72.45 54.96 9 DKIM_VALID_AU 63957 65.33 69.39 63.08 10 XM_B_SpammyWords 63679 54.15 69.08 45.86 11 LOC_TINY_FONT_1 49288 38.91 53.47 30.83 12 XM_B_Unicode3 48925 48.42 53.08 45.83 13 RCVD_IN_MSPIKE_H2 38573 38.52 41.85 36.67 14 XM_DK_Undo_02 37927 17.93 41.15 5.03 15 HTML_FONT_LOW_CONTRAST 37077 34.92 40.22 31.97 16 XM_B_SpammyWords2 35510 27.36 38.52 21.16 17 BAYES_50 33637 50.41 36.49 58.14 18 BAYES_99 30742 14.30 33.35 3.71 19 FVGT_m_MULTI_ODD 29048 28.22 31.51 26.39 20 T_KAM_HTML_FONT_INVALID 28432 24.04 30.85 20.26 21 TR_XM_DKIM_Undo 26735 11.79 29.00 2.23 22 DKIM_VALID_EF 24893 27.67 27.01 28.04 23 MIME_HTML_ONLY 23973 23.26 26.01 21.74 24 BAYES_999 23673 10.92 25.68 2.73 25 TR_DCC_Bayes_99 23656 10.27 25.66 1.72 26 XM_Multi_Part_URI 21613 18.39 23.45 15.58 27 XMSubLong 20707 23.04 22.46 23.36 28 DCC_CHECK_NEGATIVE 19616 39.85 21.28 50.16 29 TR_XM_DK_Unsub 17177 15.71 18.64 14.08 30 T_TM2_M_HEADER_IN_MSG 16700 20.31 18.12 21.53 31 TR_MAX_INTL_RELAY 15836 10.26 17.18 6.41 32 UNPARSEABLE_RELAY 15071 13.59 16.35 12.06 33 RELAYCOUNTRY_META 14415 7.94 15.64 3.66 34 XM_B_Unsub 13662 11.51 14.82 9.66 35 XM_B_SpammyWords3 13424 9.89 14.56 7.30 36 TR_XM_BayesUnsub 13136 9.72 14.25 7.21 37 TR_XM_SpammyWords2 10968 4.70 11.90 0.69 38 BOTNET 9955 4.70 10.80 1.31 39 LOTS_OF_MONEY 9663 7.18 10.48 5.35 40 BOTNET_IPINHOSTNAME 9454 5.82 10.26 3.35 41 BAYES_80 9427 6.10 10.23 3.80 42 BAYES_60 9095 10.32 9.87 10.57 43 XM_Body_Dirty_Words 8986 5.17 9.75 2.63 44 TR_XM_SpammyRelay 8903 4.60 9.66 1.79 45 TR_XM_SpammyWords4 8843 6.03 9.59 4.06 46 TR_XM_UnparsRelay 8459 4.37 9.18 1.69 47 RCVD_IN_BL_SPAMCOP_NET 8232 3.60 8.93 0.64 48 XM_Evil_Numbers_Gen 7656 8.96 8.31 9.32 49 FSL_BULK_SIG 7183 8.57 7.79 9.00 50 HTML_IMAGE_RATIO_02 6960 6.84 7.55 6.45 51 TR_XM_SPAMCOP 6784 2.90 7.36 0.42 52 XM_H_GMP 6716 6.62 7.29 6.25 53 MPART_ALT_DIFF 6691 5.71 7.26 4.84 54 UNTRUSTED_Relay 6583 3.62 7.14 1.66 55 RCVD_IN_VALIDITY_RPBL 6424 2.61 6.97 0.19 56 XM_UncommonTLD01 6188 5.77 6.71 5.25 57 XMSubMetaSx_00 5982 5.64 6.49 5.17 58 LotsOfNums_01 5945 6.91 6.45 7.17 59 XM_B_Phish_Phrases 5828 5.38 6.32 4.86 60 BAYES_95 5618 3.85 6.09 2.61 61 RELAYCOUNTRY_CA 5043 2.95 5.47 1.55 62 XMSexyCombo_05 4988 2.95 5.41 1.58 63 XM_H_Long_From01 4775 5.66 5.18 5.93 64 TR_XM_PhishingBody 4709 2.84 5.11 1.57 65 T_XMDrugObfuBody_14 4672 3.48 5.07 2.59 66 DKIM_INVALID 4670 3.11 5.07 2.02 67 NO_DNS_FOR_FROM 4209 2.06 4.57 0.67 68 TR_XM_MaxWHORU 3984 1.88 4.32 0.53 69 HTML_IMAGE_RATIO_06 3905 3.31 4.24 2.80 70 TR_XM_SpammyWords5 3894 2.61 4.22 1.71 71 XM_B_SpammyTLD 3889 3.29 4.22 2.78 72 HTML_IMAGE_RATIO_04 3791 4.96 4.11 5.43 73 XM_B_PhoneNumber 3625 5.74 3.93 6.74 74 XM_B_Investor 3584 2.11 3.89 1.12 75 MIME_HTML_ONLY_MULTI 3507 3.06 3.80 2.65 76 RCVD_IN_MSPIKE_WL 3340 4.55 3.62 5.06 77 RCVD_IN_MSPIKE_H3 3340 4.55 3.62 5.06 78 XM_SPF_SoftFail 3292 1.99 3.57 1.12 79 XM_OfRef6 3208 1.71 3.48 0.72 80 XMNumbers 3193 4.05 3.46 4.38 81 TooManyTo_001 3189 6.11 3.46 7.58 82 MIME_HTML_MOSTLY 3107 2.99 3.37 2.78 83 BOTNET_NORDNS 3047 1.23 3.31 0.08 84 XMStrtUSub 3020 4.82 3.28 5.68 85 RCVD_IN_VALIDITY_SAFE 3015 5.24 3.27 6.33 86 DKIM_ADSP_NXDOMAIN 2999 1.52 3.25 0.56 87 SUBJ_ALL_CAPS 2873 1.64 3.12 0.81 88 HTML_IMAGE_RATIO_08 2867 2.37 3.11 1.96 89 TM2_M_VERY_LONG_WORD 2734 2.51 2.97 2.25 90 XMPhish30 2672 1.48 2.90 0.69 91 XM_CamelCaseFrm001 2632 2.76 2.86 2.71 92 XM_UB50 2609 1.59 2.83 0.89 93 T_XMDrugObfuBody_08 2567 1.97 2.78 1.52 94 SUSP_UTF8_WORD_SUBJ 2555 1.01 2.77 0.04 95 XM_H_Undi_Recip 2468 1.03 2.68 0.11 96 T_XMHurry_00 2464 1.29 2.67 0.52 97 TR_XM_Undi_Recip19 2374 0.97 2.58 0.07 98 RCVD_IN_VALIDITY_CERTIFIED 2302 4.05 2.50 4.91 99 XMBody_17 2284 1.27 2.48 0.60 100 TM2_M_URI_OPT_OUT 2154 2.16 2.34 2.06 101 XM_URI_RBL 2154 1.41 2.34 0.90 102 TR_XM_Undi_Recip11 2099 0.83 2.28 0.02 103 RELAYCOUNTRY_AU 2099 1.14 2.28 0.50 104 UNDISC_MONEY 2010 0.78 2.18 0.00 105 USER_IN_DEF_DKIM_WL 1991 12.25 2.16 17.85 106 TR_XM_NoHeaderRelay 1938 0.88 2.10 0.20 107 FROM_EXCESS_BASE64 1903 2.43 2.06 2.64 108 XM_B_Unsub2 1852 1.46 2.01 1.16 109 SUSP_UTF8_WORD_COMBO 1848 0.77 2.00 0.08 110 MAILING_LIST_MULTI 1795 2.26 1.95 2.44 111 DEAR_BENEFICIARY 1794 0.73 1.95 0.05 112 XM_B_SpammyWords4 1790 1.15 1.94 0.72 113 HK_SCAM 1784 0.73 1.94 0.05 114 T_REMOTE_IMAGE 1771 2.48 1.92 2.79 115 XMDiploma_00 1765 1.45 1.91 1.19 116 DIET_1 1749 0.95 1.90 0.42 117 T_FILL_THIS_FORM_SHORT 1707 1.05 1.85 0.60 118 KHOP_HELO_FCRDNS 1697 1.21 1.84 0.87 119 TR_XM_Undi_RecipCombo2 1667 0.65 1.81 0.01 120 T_TooManySym_01 1662 5.73 1.80 7.91 121 XM_B_COPY_HTML 1647 1.48 1.79 1.31 122 XM_B_URI_Unicode 1641 1.53 1.78 1.39 123 SpammyFromTLD_02 1637 0.76 1.78 0.19 124 TR_XM_PHPDW 1609 0.81 1.75 0.29 125 LongTLD 1596 0.75 1.73 0.21 126 TR_XM_PHPForged 1576 0.80 1.71 0.29 127 TR_XM_FormFill2 1566 0.79 1.70 0.28 128 XM_H_PHPOS 1528 0.77 1.66 0.27 129 XM_DK_Undo_01 1521 1.48 1.65 1.39 130 XM_UB99 1516 0.59 1.64 0.00 131 XMBdyGiftCard01 1495 1.33 1.62 1.17 132 HTTPS_HTTP_MISMATCH 1485 0.85 1.61 0.42 133 TR_XM_Undi_Recip5 1464 0.57 1.59 0.00 134 XMStockSpam_06 1440 1.67 1.56 1.73 135 HTML_MIME_NO_HTML_TAG 1434 1.70 1.56 1.77 136 TR_MetaPhish_Combo_01 1427 0.90 1.55 0.54 137 HTML_TAG_BALANCE_BODY 1392 1.52 1.51 1.52 138 TR_Sbj_FN_Bdy 1377 0.60 1.49 0.10 139 SHOPIFY_IMG_NOT_RCVD_SFY 1363 0.78 1.48 0.40 140 MIME_QP_LONG_LINE 1346 2.62 1.46 3.26 141 XMBrknScrpt_02 1346 1.30 1.46 1.22 142 XMReplyNow 1338 0.72 1.45 0.31 143 SpammyFromTLD_01 1332 0.92 1.45 0.62 144 TR_XM_InvalidRelay 1327 0.52 1.44 0.01 145 TR_XM_INV_DKIM 1288 0.64 1.40 0.22 146 XM_B_REG_HTML 1279 0.68 1.39 0.29 147 BAYES_40 1271 3.74 1.38 5.06 148 RCVD_IN_PSBL 1259 0.88 1.37 0.60 149 ALL_TRUSTED 1240 11.13 1.35 16.56 150 MILLION_USD 1221 0.50 1.32 0.04 151 XM_ProductURIs 1221 0.89 1.32 0.64 152 ADVANCE_FEE_4_NEW_MONEY 1206 0.49 1.31 0.04 153 URI_HEX 1185 1.07 1.29 0.95 154 HOSTED_IMG_MULTI_PUB_01 1142 0.46 1.24 0.03 155 T_XMDrugObfuBody_00 1106 0.79 1.20 0.57 156 XM_UB999 1075 0.42 1.17 0.00 157 MPART_ALT_DIFF_COUNT 1043 0.77 1.13 0.56 158 RDNS_DYNAMIC 1029 0.63 1.12 0.35 159 DKIM_ADSP_CUSTOM_MED 1025 0.91 1.11 0.80 160 T_STY_INVIS_DIRECT 1015 0.69 1.10 0.46 161 THIS_AD 1013 0.71 1.10 0.49 162 PDS_RDNS_DYNAMIC_FP 1004 0.44 1.09 0.08 163 XM_SendGrid 1001 1.13 1.09 1.16 164 FROM_SUSPICIOUS_NTLD 995 0.44 1.08 0.09 165 BAYES_20 994 2.68 1.08 3.56 166 TM2_M_OBFU_COMMENT 971 0.86 1.05 0.75 167 XM_H_Long_From02 971 1.06 1.05 1.06 168 XM_UB60 951 0.40 1.03 0.04 169 PLING_QUERY 941 0.60 1.02 0.36 170 XMGenDplmaNmb 939 0.66 1.02 0.47 171 RELAYCOUNTRY_CN 938 0.40 1.02 0.05 172 TR_XM_FormFill 914 0.36 0.99 0.01 173 TR_LOTS_OF_MONEY3 890 0.53 0.97 0.28 174 NML_ADSP_CUSTOM_MED 879 0.66 0.95 0.50 175 XM_OfRef7 865 0.44 0.94 0.16 176 RCVD_IN_PBL 857 0.69 0.93 0.56 177 XMSexyCombo_01 854 0.47 0.93 0.22 178 URI_TRY_3LD 850 0.72 0.92 0.61 179 RELAYCOUNTRY_RU 849 0.35 0.92 0.03 180 XMBody_78 836 0.43 0.91 0.17 181 SUBJ_DOLLARS 825 0.42 0.90 0.16 182 XM_B_DNDMA 812 0.77 0.88 0.70 183 RELAYCOUNTRY_GB 801 0.49 0.87 0.27 184 TR_Mismatch_TLD_01 797 0.51 0.86 0.31 185 XMHTML_After_End 797 0.47 0.86 0.25 186 TR_XM_SB_Phish 790 0.39 0.86 0.13 187 XM_S_SpammyWords 787 0.40 0.85 0.14 188 TR_XM_Spammywords 787 0.40 0.85 0.14 189 TR_Caps_n_Bayes_99 782 0.31 0.85 0.01 190 FORGED_GMAIL_RCVD 779 0.62 0.85 0.49 191 XMSubMetaI_00 773 0.54 0.84 0.38 192 XM_GoogleGroups 773 1.09 0.84 1.24 193 MIME_CHARSET_FARAWAY 771 0.62 0.84 0.51 194 PDS_SHORT_SPOOFED_URL 770 0.30 0.84 0.00 195 XM_Combo_Sbj 763 0.47 0.83 0.28 196 XM_B_SEO 756 0.44 0.82 0.23 197 TVD_RCVD_IP 755 0.97 0.82 1.05 198 AC_HTML_NONSENSE_TAGS 753 0.34 0.82 0.07 199 XMSubPhish11 730 0.35 0.79 0.11 200 TR_Symld_Words 727 0.94 0.79 1.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 137891 87.52 95.51 83.09 2 RELAYCOUNTRY_US 132487 81.34 84.07 79.83 3 DKIM_SIGNED 126396 81.00 89.72 76.16 4 XM_DK_Pass 123928 78.48 85.33 74.68 5 DKIM_VALID 123038 77.89 84.65 74.14 6 XM_B_Unicode 116796 74.92 83.10 70.38 7 DKIM_VALID_AU 104687 65.33 69.39 63.08 8 BAYES_50 96486 50.41 36.49 58.14 9 XMListUnsubscribeExists 91210 61.20 72.45 54.96 10 DCC_CHECK_NEGATIVE 83247 39.85 21.28 50.16 11 DCC_CHECK 82671 59.98 78.27 49.82 12 XM_B_SpammyWords 76102 54.15 69.08 45.86 13 XM_B_Unicode3 76062 48.42 53.08 45.83 14 RCVD_IN_MSPIKE_H2 60854 38.52 41.85 36.67 15 HTML_FONT_LOW_CONTRAST 53062 34.92 40.22 31.97 16 LOC_TINY_FONT_1 51156 38.91 53.47 30.83 17 DKIM_VALID_EF 46532 27.67 27.01 28.04 18 FVGT_m_MULTI_ODD 43796 28.22 31.51 26.39 19 XMSubLong 38765 23.04 22.46 23.36 20 MIME_HTML_ONLY 36081 23.26 26.01 21.74 21 T_TM2_M_HEADER_IN_MSG 35734 20.31 18.12 21.53 22 XM_B_SpammyWords2 35111 27.36 38.52 21.16 23 T_KAM_HTML_FONT_INVALID 33628 24.04 30.85 20.26 24 USER_IN_DEF_DKIM_WL 29622 12.25 2.16 17.85 25 ALL_TRUSTED 27479 11.13 1.35 16.56 26 XM_Multi_Part_URI 25848 18.39 23.45 15.58 27 TR_XM_DK_Unsub 23373 15.71 18.64 14.08 28 UNPARSEABLE_RELAY 20015 13.59 16.35 12.06 29 BAYES_00 17671 7.04 0.53 10.65 30 BAYES_60 17544 10.32 9.87 10.57 31 XM_B_Unsub 16037 11.51 14.82 9.66 32 XM_Evil_Numbers_Gen 15461 8.96 8.31 9.32 33 FSL_BULK_SIG 14932 8.57 7.79 9.00 34 XM_DKIMWhitelistDomains 14685 5.75 0.17 8.85 35 T_TooManySym_01 13131 5.73 1.80 7.91 36 TooManyTo_001 12582 6.11 3.46 7.58 37 XM_B_SpammyWords3 12115 9.89 14.56 7.30 38 TR_XM_DK_Bayes 12010 4.77 0.33 7.24 39 TR_XM_BayesUnsub 11959 9.72 14.25 7.21 40 TR_XM_DK_Bayes1 11916 4.73 0.33 7.18 41 LotsOfNums_01 11900 6.91 6.45 7.17 42 XM_B_PhoneNumber 11188 5.74 3.93 6.74 43 HTML_IMAGE_RATIO_02 10706 6.84 7.55 6.45 44 TR_MAX_INTL_RELAY 10641 10.26 17.18 6.41 45 TR_XM_DK_Bayes2 10638 4.19 0.18 6.41 46 RCVD_IN_VALIDITY_SAFE 10513 5.24 3.27 6.33 47 XM_H_GMP 10373 6.62 7.29 6.25 48 XM_H_Long_From01 9837 5.66 5.18 5.93 49 XMStrtUSub 9423 4.82 3.28 5.68 50 HTML_IMAGE_RATIO_04 9016 4.96 4.11 5.43 51 LOTS_OF_MONEY 8871 7.18 10.48 5.35 52 IN_ZIMBRA_NJ_WHITELIST 8850 3.45 0.05 5.33 53 XM_UncommonTLD01 8711 5.77 6.71 5.25 54 XMSubMetaSx_00 8577 5.64 6.49 5.17 55 BAYES_40 8396 3.74 1.38 5.06 56 RCVD_IN_MSPIKE_H3 8395 4.55 3.62 5.06 57 RCVD_IN_MSPIKE_WL 8395 4.55 3.62 5.06 58 XM_DK_Undo_02 8345 17.93 41.15 5.03 59 RCVD_IN_VALIDITY_CERTIFIED 8145 4.05 2.50 4.91 60 XM_B_Phish_Phrases 8061 5.38 6.32 4.86 61 MPART_ALT_DIFF 8040 5.71 7.26 4.84 62 T_TooManySym_02 7802 3.21 0.53 4.70 63 XMNumbers 7264 4.05 3.46 4.38 64 TR_XM_SpammyWords4 6735 6.03 9.59 4.06 65 INVALID_MSGID 6639 2.69 0.34 4.00 66 BAYES_80 6311 6.10 10.23 3.80 67 TO_MALFORMED 6220 2.41 0.00 3.75 68 BAYES_99 6160 14.30 33.35 3.71 69 RELAYCOUNTRY_META 6075 7.94 15.64 3.66 70 BAYES_20 5914 2.68 1.08 3.56 71 ANY_BOUNCE_MESSAGE 5777 2.45 0.59 3.48 72 BOUNCE_MESSAGE 5777 2.45 0.59 3.48 73 BOTNET_IPINHOSTNAME 5566 5.82 10.26 3.35 74 MIME_QP_LONG_LINE 5408 2.62 1.46 3.26 75 HTML_IMAGE_RATIO_06 4649 3.31 4.24 2.80 76 T_REMOTE_IMAGE 4628 2.48 1.92 2.79 77 MIME_HTML_MOSTLY 4617 2.99 3.37 2.78 78 XM_B_SpammyTLD 4608 3.29 4.22 2.78 79 RCVD_IN_IADB_LISTED 4525 1.97 0.61 2.73 80 BAYES_999 4525 10.92 25.68 2.73 81 XM_CamelCaseFrm001 4496 2.76 2.86 2.71 82 TooManyTo_002 4395 1.95 0.71 2.65 83 MIME_HTML_ONLY_MULTI 4390 3.06 3.80 2.65 84 FROM_EXCESS_BASE64 4374 2.43 2.06 2.64 85 XM_Body_Dirty_Words 4362 5.17 9.75 2.63 86 BAYES_95 4328 3.85 6.09 2.61 87 T_XMDrugObfuBody_14 4300 3.48 5.07 2.59 88 MAILING_LIST_MULTI 4050 2.26 1.95 2.44 89 RCVD_IN_IADB_SPF 3955 1.71 0.51 2.38 90 TM2_M_VERY_LONG_WORD 3740 2.51 2.97 2.25 91 TR_XM_DKIM_Undo 3707 11.79 29.00 2.23 92 XM_PDF 3516 1.55 0.54 2.12 93 RCVD_IN_IADB_SENDERID 3514 1.53 0.48 2.12 94 TM2_M_URI_OPT_OUT 3413 2.16 2.34 2.06 95 RCVD_IN_IADB_DK 3405 1.49 0.48 2.05 96 DKIM_INVALID 3358 3.11 5.07 2.02 97 RCVD_IN_IADB_VOUCHED 3343 1.41 0.31 2.01 98 T_TooManySym_03 3316 1.34 0.15 2.00 99 HTML_IMAGE_RATIO_08 3255 2.37 3.11 1.96 100 BAYES_05 3139 1.40 0.53 1.89 101 XMGappySubj_01 3044 1.23 0.15 1.83 102 IN_HORDE_ADDRESS_BOOK 3036 1.22 0.12 1.83 103 TR_XM_SpammyRelay 2968 4.60 9.66 1.79 104 HTML_MIME_NO_HTML_TAG 2943 1.70 1.56 1.77 105 XMStockSpam_06 2867 1.67 1.56 1.73 106 TR_DCC_Bayes_99 2862 10.27 25.66 1.72 107 TR_XM_SpammyWords5 2836 2.61 4.22 1.71 108 TR_XM_UnparsRelay 2811 4.37 9.18 1.69 109 UNTRUSTED_Relay 2762 3.62 7.14 1.66 110 XMGappySubj_02 2676 1.05 0.03 1.61 111 XMSexyCombo_05 2628 2.95 5.41 1.58 112 TR_XM_PhishingBody 2610 2.84 5.11 1.57 113 RELAYCOUNTRY_CA 2580 2.95 5.47 1.55 114 URI_NOVOWEL 2568 1.27 0.77 1.55 115 HTML_TAG_BALANCE_BODY 2527 1.52 1.51 1.52 116 T_XMDrugObfuBody_08 2520 1.97 2.78 1.52 117 XM_H_PHPMailer 2490 1.17 0.58 1.50 118 TVD_SPACE_RATIO 2487 1.01 0.13 1.50 119 RCVD_IN_IADB_OPTIN 2414 1.00 0.18 1.45 120 XM_B_URI_Unicode 2312 1.53 1.78 1.39 121 XM_DK_Undo_01 2303 1.48 1.65 1.39 122 BOTNET 2178 4.70 10.80 1.31 123 XM_B_COPY_HTML 2178 1.48 1.79 1.31 124 XM_B_FormFill 2090 0.81 0.01 1.26 125 XM_GoogleGroups 2053 1.09 0.84 1.24 126 XMBrknScrpt_02 2019 1.30 1.46 1.22 127 XMDiploma_00 1968 1.45 1.91 1.19 128 XMBdyGiftCard01 1940 1.33 1.62 1.17 129 XM_SendGrid 1927 1.13 1.09 1.16 130 XM_B_Unsub2 1918 1.46 2.01 1.16 131 XM_B_Investor 1857 2.11 3.89 1.12 132 XM_SPF_SoftFail 1852 1.99 3.57 1.12 133 TR_XM_Base64_M1 1820 0.91 0.58 1.10 134 XM_H_Long_From02 1760 1.06 1.05 1.06 135 TVD_RCVD_IP 1739 0.97 0.82 1.05 136 TR_Symld_Words 1704 0.94 0.79 1.03 137 TooManyTo_003 1692 0.89 0.66 1.02 138 T_MANY_PILL_PRICE 1589 0.62 0.01 0.96 139 URI_HEX 1583 1.07 1.29 0.95 140 XM_URI_RBL 1497 1.41 2.34 0.90 141 XM_UB50 1485 1.59 2.83 0.89 142 KHOP_HELO_FCRDNS 1436 1.21 1.84 0.87 143 XM_H_OutlookMailer 1384 0.55 0.05 0.83 144 XMBody_95 1365 0.57 0.11 0.82 145 TR_XM_DK_SendGrid 1362 0.81 0.79 0.82 146 TooManyTo_004 1360 0.76 0.64 0.82 147 SUBJ_ALL_CAPS 1350 1.64 3.12 0.81 148 DKIM_ADSP_CUSTOM_MED 1320 0.91 1.11 0.80 149 TM2_M_OBFU_COMMENT 1246 0.86 1.05 0.75 150 XMNoVowels 1223 0.67 0.56 0.74 151 XM_OfRef6 1199 1.71 3.48 0.72 152 XM_B_SpammyWords4 1189 1.15 1.94 0.72 153 TooManyTo_005 1172 0.68 0.62 0.71 154 XM_B_DNDMA 1168 0.77 0.88 0.70 155 TR_XM_SpammyWords2 1153 4.70 11.90 0.69 156 USER_IN_WHITELIST 1146 0.44 0.00 0.69 157 USER_IN_WELCOMELIST 1146 0.44 0.00 0.69 158 XMPhish30 1145 1.48 2.90 0.69 159 NO_DNS_FOR_FROM 1111 2.06 4.57 0.67 160 T_TVD_MIME_NO_HEADERS 1101 0.47 0.11 0.66 161 XMBSHREFv2 1088 0.50 0.21 0.66 162 XM_ProductURIs 1070 0.89 1.32 0.64 163 RCVD_IN_BL_SPAMCOP_NET 1065 3.60 8.93 0.64 164 MSGID_FROM_MTA_HEADER 1056 0.44 0.08 0.64 165 SpammyFromTLD_01 1030 0.92 1.45 0.62 166 T_TooManySym_04 1026 0.41 0.03 0.62 167 URI_TRY_3LD 1012 0.72 0.92 0.61 168 XMSlimDrugH 1009 0.65 0.73 0.61 169 XMBody_17 1001 1.27 2.48 0.60 170 RCVD_IN_PSBL 1000 0.88 1.37 0.60 171 T_FILL_THIS_FORM_SHORT 997 1.05 1.85 0.60 172 T_XMDrugObfuBody_00 946 0.79 1.20 0.57 173 MPART_ALT_DIFF_COUNT 936 0.77 1.13 0.56 174 RCVD_IN_PBL 934 0.69 0.93 0.56 175 DKIM_ADSP_NXDOMAIN 926 1.52 3.25 0.56 176 TR_MetaPhish_Combo_01 901 0.90 1.55 0.54 177 TR_XM_MaxWHORU 875 1.88 4.32 0.53 178 T_XMHurry_00 866 1.29 2.67 0.52 179 XMLngstWrd_00 862 0.43 0.27 0.52 180 MIME_CHARSET_FARAWAY 842 0.62 0.84 0.51 181 RELAYCOUNTRY_AU 834 1.14 2.28 0.50 182 NML_ADSP_CUSTOM_MED 834 0.66 0.95 0.50 183 AD_PREFS 832 0.33 0.03 0.50 184 T_Symld_Words_02 825 0.57 0.70 0.50 185 FORGED_GMAIL_RCVD 816 0.62 0.85 0.49 186 THIS_AD 808 0.71 1.10 0.49 187 XM_S_SubURI 782 0.32 0.05 0.47 188 XMGenDplmaNmb 772 0.66 1.02 0.47 189 T_STY_INVIS_DIRECT 771 0.69 1.10 0.46 190 XMSubMetaSSx_00 768 0.54 0.68 0.46 191 XMPhish14 706 0.53 0.72 0.43 192 TR_XM_SPAMCOP 703 2.90 7.36 0.42 193 HTML_FONT_FACE_BAD 701 0.54 0.76 0.42 194 HTTPS_HTTP_MISMATCH 701 0.85 1.61 0.42 195 DIET_1 701 0.95 1.90 0.42 196 XMWrdNumbWrd 691 0.29 0.05 0.42 197 XMCapTrack 689 0.43 0.47 0.42 198 HTML_IMAGE_ONLY_20 673 0.41 0.42 0.41 199 SHOPIFY_IMG_NOT_RCVD_SFY 656 0.78 1.48 0.40 200 XMSubNoVowel 638 0.49 0.69 0.38 ----------------------------------------------------------------------