Email: 265269 Autolearn: 0 AvgScore: 5.18 AvgScanTime: 1.33 sec Spam: 97685 Autolearn: 0 AvgScore: 14.15 AvgScanTime: 1.36 sec Ham: 167584 Autolearn: 0 AvgScore: -0.05 AvgScanTime: 1.31 sec Time Spent Running SA: 97.77 hours Time Spent Processing Spam: 36.92 hours Time Spent Processing Ham: 60.85 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93823 88.39 96.05 83.93 2 DKIM_SIGNED 85605 81.29 87.63 77.59 3 RELAYCOUNTRY_US 82225 81.58 84.17 80.07 4 XM_B_Unicode 81390 76.26 83.32 72.14 5 XM_DK_Pass 81362 78.80 83.29 76.18 6 DKIM_VALID 80833 78.27 82.75 75.65 7 DCC_CHECK 76597 58.97 78.41 47.64 8 XMListUnsubscribeExists 69128 60.40 70.77 54.36 9 XM_B_SpammyWords 65465 54.36 67.02 46.98 10 DKIM_VALID_AU 65141 65.36 66.68 64.60 11 XM_B_Unicode3 51235 48.70 52.45 46.52 12 LOC_TINY_FONT_1 48955 38.61 50.12 31.90 13 XM_DK_Undo_02 41530 19.10 42.51 5.45 14 RCVD_IN_MSPIKE_H2 41230 39.22 42.21 37.49 15 XM_B_SpammyWords2 38416 28.11 39.33 21.57 16 HTML_FONT_LOW_CONTRAST 38151 34.42 39.06 31.71 17 BAYES_50 35494 52.30 36.34 61.61 18 BAYES_99 34831 15.76 35.66 4.17 19 T_KAM_HTML_FONT_INVALID 32098 25.52 32.86 21.25 20 FVGT_m_MULTI_ODD 30865 27.46 31.60 25.05 21 TR_XM_DKIM_Undo 28901 12.40 29.59 2.38 22 MIME_HTML_ONLY 27866 24.24 28.53 21.75 23 BAYES_999 27323 12.33 27.97 3.21 24 TR_DCC_Bayes_99 26329 10.91 26.95 1.55 25 DKIM_VALID_EF 25723 27.98 26.33 28.94 26 XM_Multi_Part_URI 22221 18.31 22.75 15.72 27 DCC_CHECK_NEGATIVE 20597 40.83 21.09 52.34 28 XMSubLong 20538 22.31 21.02 23.07 29 T_TM2_M_HEADER_IN_MSG 19739 22.15 20.21 23.29 30 TR_XM_DK_Unsub 18829 16.03 19.28 14.13 31 UNPARSEABLE_RELAY 16602 13.74 17.00 11.84 32 XM_B_Unsub 16022 11.64 16.40 8.87 33 RELAYCOUNTRY_META 15690 8.46 16.06 4.04 34 TR_XM_BayesUnsub 15569 10.18 15.94 6.83 35 TR_MAX_INTL_RELAY 15206 10.09 15.57 6.91 36 XM_B_SpammyWords3 14643 9.69 14.99 6.61 37 TR_XM_SpammyWords2 13717 5.66 14.04 0.77 38 RCVD_IN_BL_SPAMCOP_NET 11826 4.89 12.11 0.68 39 TR_XM_SpammyRelay 10095 5.13 10.33 2.10 40 FSL_BULK_SIG 9847 9.64 10.08 9.38 41 BOTNET 9746 4.69 9.98 1.60 42 BAYES_80 9456 6.20 9.68 4.18 43 LOTS_OF_MONEY 9088 7.23 9.30 6.01 44 TR_XM_UnparsRelay 8778 4.33 8.99 1.62 45 BOTNET_IPINHOSTNAME 8752 5.77 8.96 3.91 46 BAYES_60 8406 7.92 8.61 7.52 47 TR_XM_SpammyWords4 8235 5.72 8.43 4.14 48 XM_Body_Dirty_Words 8216 5.32 8.41 3.52 49 TR_XM_SPAMCOP 8079 3.29 8.27 0.39 50 HTML_IMAGE_RATIO_02 7732 6.46 7.92 5.61 51 XM_Evil_Numbers_Gen 7695 9.00 7.88 9.65 52 XM_UncommonTLD01 7313 6.17 7.49 5.40 53 RCVD_IN_VALIDITY_RPBL 6936 2.67 7.10 0.09 54 XM_B_Phish_Phrases 6848 5.71 7.01 4.95 55 UNTRUSTED_Relay 6816 3.65 6.98 1.71 56 LotsOfNums_01 6699 7.25 6.86 7.48 57 XMSubMetaSx_00 6481 5.05 6.63 4.12 58 MPART_ALT_DIFF 6375 5.99 6.53 5.67 59 XM_H_GMP 5746 6.38 5.88 6.67 60 BAYES_95 5433 3.77 5.56 2.73 61 RELAYCOUNTRY_CA 5352 3.01 5.48 1.57 62 XM_H_Long_From01 5006 5.41 5.12 5.58 63 XMStrtUSub 4901 5.77 5.02 6.21 64 DKIM_INVALID 4772 3.02 4.89 1.94 65 T_XMDrugObfuBody_14 4671 2.99 4.78 1.95 66 HTML_IMAGE_RATIO_06 4355 3.86 4.46 3.50 67 RCVD_IN_PSBL 4318 2.13 4.42 0.79 68 T_REMOTE_IMAGE 4237 3.83 4.34 3.54 69 HTML_IMAGE_RATIO_04 4214 4.18 4.31 4.10 70 HTML_IMAGE_RATIO_08 4179 2.73 4.28 1.82 71 MIME_HTML_MOSTLY 4139 3.30 4.24 2.76 72 XMSexyCombo_05 4049 2.98 4.14 2.31 73 XM_B_Investor 3957 2.36 4.05 1.37 74 TR_XM_PhishingBody 3852 2.57 3.94 1.77 75 TooManyTo_001 3836 5.60 3.93 6.57 76 XM_B_PhoneNumber 3626 5.34 3.71 6.29 77 MIME_HTML_ONLY_MULTI 3467 3.50 3.55 3.48 78 XMNoVowels 3378 2.77 3.46 2.37 79 XM_OfRef6 3333 1.90 3.41 1.02 80 XM_UB50 3328 1.86 3.41 0.96 81 DKIM_ADSP_NXDOMAIN 3308 1.61 3.39 0.57 82 NO_DNS_FOR_FROM 3282 1.51 3.36 0.44 83 XM_B_SpammyTLD 3236 2.91 3.31 2.68 84 TR_XM_MaxWHORU 3229 1.44 3.31 0.35 85 XM_CamelCaseFrm001 3218 3.12 3.29 3.02 86 RCVD_IN_MSPIKE_WL 2945 4.35 3.01 5.12 87 RCVD_IN_MSPIKE_H3 2945 4.35 3.01 5.12 88 TR_XM_SpammyWords5 2864 1.98 2.93 1.42 89 XMBody_17 2843 1.46 2.91 0.62 90 RCVD_IN_VALIDITY_SAFE 2840 4.57 2.91 5.53 91 TM2_M_VERY_LONG_WORD 2779 1.90 2.84 1.34 92 FROM_EXCESS_BASE64 2727 2.59 2.79 2.47 93 DIET_1 2714 1.45 2.78 0.67 94 NORDNS_LOW_CONTRAST 2712 1.05 2.78 0.04 95 USER_IN_DEF_DKIM_WL 2595 13.03 2.66 19.07 96 XMNumbers 2589 3.48 2.65 3.97 97 XM_SPF_SoftFail 2570 1.64 2.63 1.05 98 XM_URI_RBL 2522 1.27 2.58 0.50 99 RCVD_IN_VALIDITY_CERTIFIED 2510 3.50 2.57 4.04 100 XM_B_SpammyWords4 2470 1.50 2.53 0.90 101 T_XMHurry_00 2384 1.53 2.44 1.00 102 RELAYCOUNTRY_AU 2366 1.34 2.42 0.70 103 TR_XM_NoHeaderRelay 2323 0.98 2.38 0.16 104 XM_B_Unsub2 2229 1.60 2.28 1.21 105 SpammyFromTLD_01 2213 1.25 2.27 0.66 106 T_STY_INVIS_DIRECT 2130 1.09 2.18 0.46 107 MAILING_LIST_MULTI 2128 2.58 2.18 2.81 108 TM2_M_URI_OPT_OUT 2066 1.96 2.11 1.87 109 XM_B_URI_Unicode 1999 1.96 2.05 1.91 110 T_XMDrugObfuBody_08 1951 1.56 2.00 1.31 111 XMDiploma_00 1885 1.49 1.93 1.24 112 KHOP_HELO_FCRDNS 1884 1.43 1.93 1.14 113 SpammyFromTLD_02 1881 0.88 1.93 0.28 114 T_XMDrugObfuBody_00 1822 0.95 1.87 0.42 115 T_TooManySym_01 1803 5.47 1.85 7.58 116 FIN_FREE 1799 0.74 1.84 0.09 117 T_FILL_THIS_FORM_SHORT 1786 1.07 1.83 0.62 118 XMSlimDrugH 1735 0.96 1.78 0.48 119 SUBJ_ALL_CAPS 1684 1.31 1.72 1.07 120 XMBdyGiftCard01 1673 1.24 1.71 0.96 121 ALL_TRUSTED 1672 10.87 1.71 16.21 122 XMStockSpam_06 1671 1.66 1.71 1.63 123 LongTLD 1657 0.83 1.70 0.33 124 MIME_QP_LONG_LINE 1562 2.88 1.60 3.63 125 HTML_MIME_NO_HTML_TAG 1556 1.68 1.59 1.73 126 XMPhish30 1535 1.09 1.57 0.81 127 BAYES_40 1533 3.83 1.57 5.14 128 XMBrknScrpt_02 1532 1.24 1.57 1.06 129 XM_DK_Undo_01 1506 1.62 1.54 1.66 130 HK_RANDOM_REPLYTO 1500 0.76 1.54 0.30 131 TR_LOTS_OF_MONEY3 1481 0.77 1.52 0.33 132 HTML_IMAGE_ONLY_16 1459 0.76 1.49 0.34 133 TR_XM_INV_DKIM 1426 0.68 1.46 0.23 134 XM_B_COPY_HTML 1394 1.20 1.43 1.07 135 HTML_TITLE_SUBJ_DIFF 1341 0.56 1.37 0.08 136 TR_XM_PHPForged 1338 0.66 1.37 0.25 137 XMReplyNow 1333 0.67 1.36 0.27 138 XM_H_Long_From02 1318 1.23 1.35 1.15 139 BOTNET_NORDNS 1307 0.50 1.34 0.01 140 TR_XM_PHPDW 1296 0.64 1.33 0.25 141 TR_XM_FormFill2 1291 0.65 1.32 0.25 142 RCVD_IN_PBL 1274 0.90 1.30 0.66 143 SHOPIFY_IMG_NOT_RCVD_SFY 1264 0.70 1.29 0.35 144 XM_H_PHPOS 1256 0.62 1.29 0.24 145 RELAYCOUNTRY_FR 1213 0.60 1.24 0.22 146 TM2_M_OBFU_COMMENT 1192 0.67 1.22 0.35 147 RDNS_DYNAMIC 1189 0.60 1.22 0.25 148 XM_B_REG_HTML 1186 0.62 1.21 0.28 149 TR_Symld_Words 1180 1.37 1.21 1.47 150 XM_HighProb1 1173 0.45 1.20 0.02 151 XM_UB99 1171 0.44 1.20 0.00 152 XM_SendGrid 1171 1.17 1.20 1.16 153 HTML_TAG_BALANCE_BODY 1166 0.91 1.19 0.75 154 PDS_RDNS_DYNAMIC_FP 1161 0.48 1.19 0.06 155 MPART_ALT_DIFF_COUNT 1110 0.81 1.14 0.61 156 XMSubMetaI_00 1099 0.71 1.13 0.47 157 MultiRelay_CC 1072 0.50 1.10 0.15 158 XM_B_Phish66 1072 0.62 1.10 0.35 159 URI_HEX 1050 1.05 1.07 1.04 160 FROM_SUSPICIOUS_NTLD 1045 0.42 1.07 0.04 161 TR_XM_Base64_M1 1028 0.94 1.05 0.88 162 URI_TRY_3LD 1028 0.76 1.05 0.59 163 DKIM_ADSP_CUSTOM_MED 1008 0.97 1.03 0.94 164 TVD_RCVD_IP 1001 1.03 1.02 1.03 165 XM_DIRTYINTL 959 0.43 0.98 0.11 166 BAYES_20 953 2.53 0.98 3.43 167 XM_UB60 949 0.41 0.97 0.08 168 TR_XM_InvalidRelay 945 0.36 0.97 0.01 169 XMGenDplmaNmb 924 0.63 0.95 0.45 170 XMSexyCombo_01 914 0.53 0.94 0.30 171 HTML_IMAGE_ONLY_20 913 0.66 0.93 0.51 172 MIME_CHARSET_FARAWAY 908 0.64 0.93 0.47 173 XM_B_DNDMA 908 0.76 0.93 0.67 174 THIS_AD 893 0.59 0.91 0.41 175 TR_XM_DK_SendGrid 890 0.86 0.91 0.83 176 XM_H_PHPMailer 889 0.89 0.91 0.88 177 TR_MetaPhish_Combo_01 883 0.72 0.90 0.62 178 HOSTED_IMG_MULTI_PUB_01 879 0.35 0.90 0.02 179 RELAYCOUNTRY_RU 877 0.35 0.90 0.04 180 TR_Mismatch_TLD_01 870 0.50 0.89 0.27 181 TooManyTo_002 860 1.80 0.88 2.34 182 NML_ADSP_CUSTOM_MED 854 0.73 0.87 0.65 183 XM_ProductURIs 853 0.63 0.87 0.49 184 TR_XM_RelayPhish 845 0.36 0.87 0.06 185 HTML_FONT_TINY_NORDNS 843 0.34 0.86 0.04 186 XM_UB999 837 0.32 0.86 0.00 187 J_POPCORN_WO_D 829 0.46 0.85 0.24 188 XMSlimDrugs 825 0.33 0.84 0.02 189 XMWghtMeta_00 823 0.32 0.84 0.02 190 HTML_FONT_FACE_BAD 821 0.65 0.84 0.54 191 TR_Mismatch_TLD_02 811 0.34 0.83 0.06 192 XM_GoogleGroups 807 1.10 0.83 1.26 193 TooManyTo_003 803 1.14 0.82 1.32 194 HELO_DYNAMIC_SPLIT_IP 801 0.31 0.82 0.01 195 XM_OfRef7 791 0.44 0.81 0.22 196 SUBJ_DOLLARS 785 0.70 0.80 0.63 197 PLING_QUERY 776 0.67 0.79 0.60 198 URI_NOVOWEL 773 1.25 0.79 1.52 199 XM_B_SEO 755 0.45 0.77 0.26 200 TooManyTo_004 746 0.91 0.76 0.99 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140652 88.39 96.05 83.93 2 RELAYCOUNTRY_US 134186 81.58 84.17 80.07 3 DKIM_SIGNED 130024 81.29 87.63 77.59 4 XM_DK_Pass 127670 78.80 83.29 76.18 5 DKIM_VALID 126781 78.27 82.75 75.65 6 XM_B_Unicode 120898 76.26 83.32 72.14 7 DKIM_VALID_AU 108252 65.36 66.68 64.60 8 BAYES_50 103244 52.30 36.34 61.61 9 XMListUnsubscribeExists 91091 60.40 70.77 54.36 10 DCC_CHECK_NEGATIVE 87717 40.83 21.09 52.34 11 DCC_CHECK 79835 58.97 78.41 47.64 12 XM_B_SpammyWords 78735 54.36 67.02 46.98 13 XM_B_Unicode3 77958 48.70 52.45 46.52 14 RCVD_IN_MSPIKE_H2 62819 39.22 42.21 37.49 15 LOC_TINY_FONT_1 53467 38.61 50.12 31.90 16 HTML_FONT_LOW_CONTRAST 53147 34.42 39.06 31.71 17 DKIM_VALID_EF 48491 27.98 26.33 28.94 18 FVGT_m_MULTI_ODD 41975 27.46 31.60 25.05 19 T_TM2_M_HEADER_IN_MSG 39027 22.15 20.21 23.29 20 XMSubLong 38655 22.31 21.02 23.07 21 MIME_HTML_ONLY 36443 24.24 28.53 21.75 22 XM_B_SpammyWords2 36143 28.11 39.33 21.57 23 T_KAM_HTML_FONT_INVALID 35611 25.52 32.86 21.25 24 USER_IN_DEF_DKIM_WL 31964 13.03 2.66 19.07 25 ALL_TRUSTED 27160 10.87 1.71 16.21 26 XM_Multi_Part_URI 26340 18.31 22.75 15.72 27 TR_XM_DK_Unsub 23685 16.03 19.28 14.13 28 UNPARSEABLE_RELAY 19842 13.74 17.00 11.84 29 XM_Evil_Numbers_Gen 16177 9.00 7.88 9.65 30 FSL_BULK_SIG 15725 9.64 10.08 9.38 31 BAYES_00 15605 6.12 0.63 9.31 32 XM_DKIMWhitelistDomains 15470 5.85 0.06 9.23 33 XM_B_Unsub 14858 11.64 16.40 8.87 34 T_TooManySym_01 12704 5.47 1.85 7.58 35 TR_XM_DK_Bayes 12631 4.96 0.54 7.54 36 BAYES_60 12597 7.92 8.61 7.52 37 LotsOfNums_01 12540 7.25 6.86 7.48 38 TR_XM_DK_Bayes1 12490 4.91 0.54 7.45 39 TR_MAX_INTL_RELAY 11572 10.09 15.57 6.91 40 TR_XM_BayesUnsub 11439 10.18 15.94 6.83 41 XM_H_GMP 11174 6.38 5.88 6.67 42 XM_B_SpammyWords3 11069 9.69 14.99 6.61 43 TR_XM_DK_Bayes2 11036 4.32 0.42 6.59 44 TooManyTo_001 11010 5.60 3.93 6.57 45 XM_B_PhoneNumber 10545 5.34 3.71 6.29 46 XMStrtUSub 10400 5.77 5.02 6.21 47 LOTS_OF_MONEY 10078 7.23 9.30 6.01 48 MPART_ALT_DIFF 9510 5.99 6.53 5.67 49 HTML_IMAGE_RATIO_02 9408 6.46 7.92 5.61 50 IN_ZIMBRA_NJ_WHITELIST 9351 3.57 0.11 5.58 51 XM_H_Long_From01 9349 5.41 5.12 5.58 52 RCVD_IN_VALIDITY_SAFE 9272 4.57 2.91 5.53 53 XM_DK_Undo_02 9134 19.10 42.51 5.45 54 XM_UncommonTLD01 9048 6.17 7.49 5.40 55 BAYES_40 8617 3.83 1.57 5.14 56 RCVD_IN_MSPIKE_WL 8585 4.35 3.01 5.12 57 RCVD_IN_MSPIKE_H3 8585 4.35 3.01 5.12 58 XM_B_Phish_Phrases 8293 5.71 7.01 4.95 59 T_TooManySym_02 7762 3.09 0.46 4.63 60 ANY_BOUNCE_MESSAGE 7562 3.09 0.66 4.51 61 BOUNCE_MESSAGE 7554 3.09 0.65 4.51 62 INVALID_MSGID 7119 2.79 0.28 4.25 63 BAYES_80 7002 6.20 9.68 4.18 64 BAYES_99 6986 15.76 35.66 4.17 65 TR_XM_SpammyWords4 6930 5.72 8.43 4.14 66 XMSubMetaSx_00 6907 5.05 6.63 4.12 67 HTML_IMAGE_RATIO_04 6864 4.18 4.31 4.10 68 RCVD_IN_VALIDITY_CERTIFIED 6768 3.50 2.57 4.04 69 RELAYCOUNTRY_META 6764 8.46 16.06 4.04 70 XMNumbers 6655 3.48 2.65 3.97 71 BOTNET_IPINHOSTNAME 6556 5.77 8.96 3.91 72 TO_MALFORMED 6287 2.42 0.14 3.75 73 MIME_QP_LONG_LINE 6078 2.88 1.60 3.63 74 T_REMOTE_IMAGE 5927 3.83 4.34 3.54 75 XM_Body_Dirty_Words 5899 5.32 8.41 3.52 76 HTML_IMAGE_RATIO_06 5873 3.86 4.46 3.50 77 MIME_HTML_ONLY_MULTI 5825 3.50 3.55 3.48 78 BAYES_20 5753 2.53 0.98 3.43 79 BAYES_999 5383 12.33 27.97 3.21 80 XM_CamelCaseFrm001 5066 3.12 3.29 3.02 81 MAILING_LIST_MULTI 4717 2.58 2.18 2.81 82 MIME_HTML_MOSTLY 4627 3.30 4.24 2.76 83 XM_PDF 4576 1.87 0.40 2.73 84 BAYES_95 4567 3.77 5.56 2.73 85 XM_B_SpammyTLD 4489 2.91 3.31 2.68 86 FROM_EXCESS_BASE64 4132 2.59 2.79 2.47 87 RCVD_IN_IADB_LISTED 4023 1.73 0.59 2.40 88 TR_XM_DKIM_Undo 3983 12.40 29.59 2.38 89 XMNoVowels 3974 2.77 3.46 2.37 90 TooManyTo_002 3918 1.80 0.88 2.34 91 XMSexyCombo_05 3863 2.98 4.14 2.31 92 RCVD_IN_IADB_SPF 3629 1.56 0.52 2.17 93 TR_XM_SpammyRelay 3522 5.13 10.33 2.10 94 RCVD_IN_IADB_SENDERID 3287 1.42 0.50 1.96 95 T_XMDrugObfuBody_14 3270 2.99 4.78 1.95 96 T_TooManySym_03 3247 1.27 0.12 1.94 97 DKIM_INVALID 3243 3.02 4.89 1.94 98 RCVD_IN_IADB_DK 3242 1.41 0.50 1.93 99 BAYES_05 3209 1.39 0.50 1.91 100 XM_B_URI_Unicode 3202 1.96 2.05 1.91 101 TM2_M_URI_OPT_OUT 3134 1.96 2.11 1.87 102 IN_HORDE_ADDRESS_BOOK 3107 1.22 0.13 1.85 103 HTML_IMAGE_RATIO_08 3055 2.73 4.28 1.82 104 TR_XM_PhishingBody 2969 2.57 3.94 1.77 105 HTML_MIME_NO_HTML_TAG 2905 1.68 1.59 1.73 106 UNTRUSTED_Relay 2859 3.65 6.98 1.71 107 XM_DK_Undo_01 2787 1.62 1.54 1.66 108 XMStockSpam_06 2728 1.66 1.71 1.63 109 TR_XM_UnparsRelay 2710 4.33 8.99 1.62 110 RCVD_IN_IADB_VOUCHED 2684 1.12 0.29 1.60 111 BOTNET 2684 4.69 9.98 1.60 112 TVD_SPACE_RATIO 2682 1.11 0.26 1.60 113 RELAYCOUNTRY_CA 2635 3.01 5.48 1.57 114 TR_DCC_Bayes_99 2601 10.91 26.95 1.55 115 URI_NOVOWEL 2551 1.25 0.79 1.52 116 TR_Symld_Words 2463 1.37 1.21 1.47 117 TR_XM_SpammyWords5 2382 1.98 2.93 1.42 118 XM_B_Investor 2297 2.36 4.05 1.37 119 TM2_M_VERY_LONG_WORD 2250 1.90 2.84 1.34 120 XMGappySubj_01 2227 0.88 0.11 1.33 121 TooManyTo_003 2213 1.14 0.82 1.32 122 T_XMDrugObfuBody_08 2194 1.56 2.00 1.31 123 XM_GoogleGroups 2108 1.10 0.83 1.26 124 XMDiploma_00 2075 1.49 1.93 1.24 125 T_TVD_MIME_NO_HEADERS 2026 0.78 0.04 1.21 126 XM_B_Unsub2 2022 1.60 2.28 1.21 127 RCVD_IN_IADB_OPTIN 1963 0.81 0.19 1.17 128 XM_SendGrid 1939 1.17 1.20 1.16 129 XM_H_Long_From02 1934 1.23 1.35 1.15 130 KHOP_HELO_FCRDNS 1917 1.43 1.93 1.14 131 LOW_PRICE 1797 0.82 0.39 1.07 132 SUBJ_ALL_CAPS 1793 1.31 1.72 1.07 133 XM_B_COPY_HTML 1785 1.20 1.43 1.07 134 XMBrknScrpt_02 1769 1.24 1.57 1.06 135 XM_SPF_SoftFail 1768 1.64 2.63 1.05 136 XMGappySubj_02 1767 0.67 0.02 1.05 137 HTML_EXTRA_CLOSE 1749 0.73 0.20 1.04 138 URI_HEX 1744 1.05 1.07 1.04 139 TVD_RCVD_IP 1733 1.03 1.02 1.03 140 XM_OfRef6 1709 1.90 3.41 1.02 141 T_XMHurry_00 1677 1.53 2.44 1.00 142 TooManyTo_004 1662 0.91 0.76 0.99 143 XM_UB50 1611 1.86 3.41 0.96 144 XMBdyGiftCard01 1604 1.24 1.71 0.96 145 DKIM_ADSP_CUSTOM_MED 1573 0.97 1.03 0.94 146 XM_B_SpammyWords4 1506 1.50 2.53 0.90 147 TR_XM_Base64_M1 1478 0.94 1.05 0.88 148 XM_H_PHPMailer 1477 0.89 0.91 0.88 149 TR_XM_DK_SendGrid 1388 0.86 0.91 0.83 150 TooManyTo_005 1376 0.79 0.75 0.82 151 XMPhish30 1359 1.09 1.57 0.81 152 RCVD_IN_PSBL 1319 2.13 4.42 0.79 153 TR_XM_SpammyWords2 1292 5.66 14.04 0.77 154 XMBody_95 1276 0.51 0.08 0.76 155 USER_IN_WELCOMELIST 1258 0.47 0.00 0.75 156 USER_IN_WHITELIST 1258 0.47 0.00 0.75 157 HTML_TAG_BALANCE_BODY 1255 0.91 1.19 0.75 158 HELO_MISC_IP 1221 0.51 0.14 0.73 159 RELAYCOUNTRY_AU 1180 1.34 2.42 0.70 160 RCVD_IN_BL_SPAMCOP_NET 1139 4.89 12.11 0.68 161 XMBSHREFv2 1139 0.64 0.57 0.68 162 DIET_1 1128 1.45 2.78 0.67 163 XM_B_DNDMA 1121 0.76 0.93 0.67 164 SpammyFromTLD_01 1104 1.25 2.27 0.66 165 RCVD_IN_PBL 1103 0.90 1.30 0.66 166 NML_ADSP_CUSTOM_MED 1081 0.73 0.87 0.65 167 SUBJ_DOLLARS 1059 0.70 0.80 0.63 168 XMBody_17 1041 1.46 2.91 0.62 169 T_FILL_THIS_FORM_SHORT 1040 1.07 1.83 0.62 170 TR_MetaPhish_Combo_01 1034 0.72 0.90 0.62 171 MPART_ALT_DIFF_COUNT 1028 0.81 1.14 0.61 172 PLING_QUERY 1006 0.67 0.79 0.60 173 URI_TRY_3LD 996 0.76 1.05 0.59 174 FORGED_GMAIL_RCVD 971 0.65 0.76 0.58 175 XMMoneyMeta_00 967 0.61 0.66 0.58 176 DKIM_ADSP_NXDOMAIN 954 1.61 3.39 0.57 177 T_TooManySym_04 910 0.35 0.03 0.54 178 HTML_FONT_FACE_BAD 899 0.65 0.84 0.54 179 HTML_IMAGE_ONLY_20 849 0.66 0.93 0.51 180 XM_URI_RBL 836 1.27 2.58 0.50 181 XM_B_FormFill 818 0.31 0.01 0.49 182 XM_ProductURIs 816 0.63 0.87 0.49 183 XMSlimDrugH 812 0.96 1.78 0.48 184 XM_S_SubURI 811 0.32 0.05 0.48 185 XMSubMetaI_00 793 0.71 1.13 0.47 186 MIME_CHARSET_FARAWAY 790 0.64 0.93 0.47 187 T_STY_INVIS_DIRECT 771 1.09 2.18 0.46 188 XM_RXBody 770 0.57 0.76 0.46 189 XMSubMetaSxObfu_03 761 0.48 0.52 0.45 190 XMGenDplmaNmb 759 0.63 0.95 0.45 191 XMCapTrack 735 0.36 0.22 0.44 192 NO_DNS_FOR_FROM 731 1.51 3.36 0.44 193 T_XMDrugObfuBody_00 709 0.95 1.87 0.42 194 BASE64_LENGTH_79_INF 704 0.31 0.11 0.42 195 T_OBFU_PDF_ATTACH 696 0.28 0.05 0.42 196 HTTPS_HTTP_MISMATCH 689 0.47 0.58 0.41 197 THIS_AD 680 0.59 0.91 0.41 198 XM_ShortIntro_01 673 0.50 0.66 0.40 199 BAD_CREDIT 672 0.32 0.19 0.40 200 XMPhish14 661 0.43 0.50 0.39 ----------------------------------------------------------------------