Email: 359722 Autolearn: 0 AvgScore: 5.54 AvgScanTime: 1.48 sec Spam: 98864 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.37 sec Ham: 260858 Autolearn: 0 AvgScore: 2.36 AvgScanTime: 1.52 sec Time Spent Running SA: 148.00 hours Time Spent Processing Spam: 37.51 hours Time Spent Processing Ham: 110.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93858 91.24 94.94 89.84 2 DKIM_SIGNED 90264 60.34 91.30 48.61 3 XM_DK_Pass 87814 59.07 88.82 47.80 4 DKIM_VALID 87160 58.66 88.16 47.48 5 XM_B_Unicode 84607 83.08 85.58 82.14 6 RELAYCOUNTRY_US 83686 86.45 84.65 87.13 7 DCC_CHECK 78909 43.69 79.82 30.00 8 DKIM_VALID_AU 72528 49.54 73.36 40.52 9 XMListUnsubscribeExists 68296 43.59 69.08 33.93 10 XM_B_SpammyWords 67771 66.82 68.55 66.16 11 XM_B_Unicode3 50942 35.61 51.53 29.57 12 LOC_TINY_FONT_1 47766 54.42 48.31 56.74 13 RCVD_IN_MSPIKE_H2 41321 29.17 41.80 24.38 14 XM_DK_Undo_02 41248 14.23 41.72 3.81 15 XM_B_SpammyWords2 37710 20.63 38.14 13.99 16 BAYES_50 37121 60.23 37.55 68.83 17 HTML_FONT_LOW_CONTRAST 36715 50.11 37.14 55.02 18 BAYES_99 33137 11.27 33.52 2.83 19 FVGT_m_MULTI_ODD 30718 20.60 31.07 16.63 20 T_KAM_HTML_FONT_INVALID 30714 18.77 31.07 14.11 21 DKIM_VALID_EF 30373 21.69 30.72 18.26 22 TR_XM_DKIM_Undo 28697 9.17 29.03 1.65 23 MIME_HTML_ONLY 25573 16.70 25.87 13.23 24 BAYES_999 25380 8.64 25.67 2.18 25 TR_DCC_Bayes_99 24549 7.62 24.83 1.10 26 XMSubLong 21881 17.54 22.13 15.80 27 XM_Multi_Part_URI 21595 12.98 21.84 9.62 28 T_TM2_M_HEADER_IN_MSG 20717 43.63 20.96 52.22 29 TR_XM_DK_Unsub 20326 12.08 20.56 8.87 30 DCC_CHECK_NEGATIVE 19519 56.18 19.74 69.98 31 XM_B_Unsub 17666 9.39 17.87 6.18 32 RELAYCOUNTRY_META 17380 6.27 17.58 1.99 33 TR_XM_BayesUnsub 17151 8.19 17.35 4.71 34 UNPARSEABLE_RELAY 16118 10.30 16.30 8.03 35 TR_MAX_INTL_RELAY 16072 7.78 16.26 4.56 36 XM_B_SpammyWords3 14073 7.12 14.23 4.42 37 TR_XM_SpammyRelay 13151 4.46 13.30 1.12 38 FSL_BULK_SIG 11726 7.67 11.86 6.08 39 TR_XM_SpammyWords2 10840 3.29 10.96 0.38 40 LOTS_OF_MONEY 10729 5.89 10.85 4.01 41 BAYES_80 9819 4.80 9.93 2.86 42 BOTNET_IPINHOSTNAME 9422 4.45 9.53 2.53 43 BOTNET 9028 3.16 9.13 0.90 44 TR_XM_UnparsRelay 8869 3.25 8.97 1.08 45 BAYES_60 8865 5.67 8.97 4.42 46 TR_XM_SpammyWords4 8369 4.41 8.47 2.87 47 HTML_IMAGE_RATIO_02 7894 4.52 7.98 3.21 48 XM_Evil_Numbers_Gen 7772 32.94 7.86 42.44 49 RCVD_IN_BL_SPAMCOP_NET 7615 2.51 7.70 0.54 50 XM_Body_Dirty_Words 7167 3.11 7.25 1.54 51 XMSubMetaSx_00 7092 3.68 7.17 2.36 52 XM_B_Phish_Phrases 7047 4.54 7.13 3.56 53 RELAYCOUNTRY_CA 6757 2.41 6.83 0.73 54 XM_UncommonTLD01 6468 4.21 6.54 3.33 55 XM_H_GMP 6438 4.97 6.51 4.38 56 TR_XM_SPAMCOP 6386 2.03 6.46 0.35 57 LotsOfNums_01 6250 25.40 6.32 32.63 58 BAYES_95 5832 2.85 5.90 1.70 59 XM_H_Long_From01 5802 4.28 5.87 3.68 60 MPART_ALT_DIFF 5546 3.65 5.61 2.91 61 XMSexyCombo_05 5507 2.17 5.57 0.88 62 UNTRUSTED_Relay 5141 2.12 5.20 0.96 63 HTML_IMAGE_RATIO_04 4975 3.46 5.03 2.86 64 TR_XM_SpammyWords5 4575 1.91 4.63 0.87 65 T_XMDrugObfuBody_14 4516 2.27 4.57 1.40 66 HTML_IMAGE_RATIO_06 4191 28.35 4.24 37.49 67 XM_CamelCaseFrm001 4016 2.35 4.06 1.70 68 XMStrtUSub 3980 3.72 4.03 3.61 69 XM_B_PhoneNumber 3966 4.16 4.01 4.22 70 XMNumbers 3871 2.79 3.92 2.36 71 RCVD_IN_VALIDITY_RPBL 3696 1.05 3.74 0.03 72 RCVD_IN_MSPIKE_H3 3646 3.28 3.69 3.12 73 RCVD_IN_MSPIKE_WL 3646 3.28 3.69 3.12 74 TM2_M_VERY_LONG_WORD 3645 27.82 3.69 36.96 75 SpammyFromTLD_02 3632 1.13 3.67 0.16 76 TR_XM_PhishingBody 3569 1.89 3.61 1.24 77 MIME_HTML_MOSTLY 3567 2.33 3.61 1.84 78 DIET_1 3538 1.29 3.58 0.43 79 XM_B_Investor 3522 1.64 3.56 0.92 80 SUBJ_ALL_CAPS 3449 1.56 3.49 0.83 81 MIME_HTML_ONLY_MULTI 3300 1.99 3.34 1.48 82 TooManyTo_001 3182 3.80 3.22 4.02 83 HTML_IMAGE_RATIO_08 3132 2.30 3.17 1.97 84 DKIM_INVALID 3104 1.69 3.14 1.13 85 XM_OfRef6 3080 1.26 3.12 0.56 86 XM_B_SpammyTLD 2940 2.16 2.97 1.86 87 RCVD_IN_VALIDITY_SAFE 2797 3.56 2.83 3.84 88 XM_URI_RBL 2724 1.05 2.76 0.41 89 TR_XM_NoHeaderRelay 2590 0.79 2.62 0.10 90 XM_B_COPY_HTML 2530 1.23 2.56 0.73 91 RELAYCOUNTRY_NL 2528 0.74 2.56 0.04 92 XM_B_SpammyWords4 2505 1.06 2.53 0.50 93 XM_SPF_SoftFail 2498 1.10 2.53 0.56 94 SH_BODYURI_REVERSE_CSS 2489 0.95 2.52 0.36 95 XM_UB50 2480 1.06 2.51 0.51 96 URIBL_CSS_A 2469 0.94 2.50 0.34 97 URIBL_CSS 2469 0.94 2.50 0.34 98 T_XMDrugObfuBody_08 2400 1.36 2.43 0.95 99 RCVD_IN_VALIDITY_CERTIFIED 2342 2.72 2.37 2.85 100 SpammyFromTLD_01 2320 0.96 2.35 0.43 101 TM2_M_URI_OPT_OUT 2273 1.39 2.30 1.05 102 T_XMHurry_00 2267 1.01 2.29 0.52 103 RELAYCOUNTRY_AU 2242 0.85 2.27 0.31 104 T_XMDrugObfuBody_00 2236 1.02 2.26 0.55 105 XM_B_Unsub2 2211 1.18 2.24 0.78 106 ALL_TRUSTED 2065 8.48 2.09 10.90 107 USER_IN_DEF_DKIM_WL 2012 9.01 2.04 11.65 108 XMSlimDrugH 2001 0.77 2.02 0.30 109 XMDiploma_00 1943 1.21 1.97 0.93 110 T_FILL_THIS_FORM_SHORT 1918 0.89 1.94 0.49 111 T_TooManySym_01 1887 4.11 1.91 4.95 112 XM_B_URI_Unicode 1857 1.19 1.88 0.93 113 XMBody_17 1842 0.73 1.86 0.30 114 FROM_EXCESS_BASE64 1811 1.48 1.83 1.34 115 BOTNET_NORDNS 1783 0.50 1.80 0.01 116 XMBdyGiftCard01 1740 0.99 1.76 0.70 117 RCVD_IN_PSBL 1706 0.59 1.73 0.16 118 XM_H_Undi_Recip 1661 0.52 1.68 0.08 119 XMStockSpam_06 1660 1.24 1.68 1.08 120 MAILING_LIST_MULTI 1642 1.49 1.66 1.42 121 XM_DK_Undo_01 1586 1.08 1.60 0.88 122 DATE_IN_PAST_03_06 1556 0.50 1.57 0.10 123 XMBrknScrpt_02 1550 0.90 1.57 0.65 124 XMClaimOffer 1497 0.59 1.51 0.24 125 SHOPIFY_IMG_NOT_RCVD_SFY 1485 0.57 1.50 0.22 126 TR_XM_Undi_Recip19 1477 0.45 1.49 0.05 127 XMWghtMeta_00 1473 0.43 1.49 0.03 128 BAYES_40 1451 6.39 1.47 8.26 129 KHOP_HELO_FCRDNS 1442 14.07 1.46 18.86 130 LOADSA_MONEY_COMBO 1408 0.42 1.42 0.04 131 MPART_ALT_DIFF_COUNT 1379 0.70 1.39 0.44 132 NO_DNS_FOR_FROM 1379 0.60 1.39 0.30 133 LONG_JUNK_URI 1374 0.40 1.39 0.02 134 TR_XM_Undi_RecipCombo2 1363 0.38 1.38 0.00 135 XMPhish30 1363 0.71 1.38 0.45 136 TR_Sbj_FN_Bdy 1362 0.42 1.38 0.06 137 UNDISC_MONEY 1353 0.38 1.37 0.00 138 XM_HighProb1 1344 0.38 1.36 0.01 139 TR_XM_PHPDW 1339 0.48 1.35 0.15 140 XFER_LOTSA_MONEY 1326 0.40 1.34 0.04 141 TR_XM_MaxWHORU 1318 0.54 1.33 0.24 142 URI_NOVOWEL 1312 1.21 1.33 1.17 143 TR_XM_PHPForged 1306 0.47 1.32 0.14 144 RELAYCOUNTRY_RU 1303 0.37 1.32 0.01 145 TR_XM_Undi_Recip5 1302 0.36 1.32 0.00 146 TR_XM_FormFill2 1293 0.47 1.31 0.15 147 T_REMOTE_IMAGE 1288 2.03 1.30 2.31 148 TR_XM_Undi_Recip2 1284 0.36 1.30 0.00 149 HTML_FONT_TINY_NORDNS 1279 0.37 1.29 0.03 150 XMSlimDrugs 1272 0.37 1.29 0.03 151 XM_H_PHPOS 1271 0.45 1.29 0.14 152 TR_Mismatch_TLD_02 1247 0.38 1.26 0.04 153 XMSubMetaI_00 1246 0.74 1.26 0.55 154 ADVANCE_FEE_5_NEW_MONEY 1239 0.34 1.25 0.00 155 DKIM_ADSP_CUSTOM_MED 1225 0.75 1.24 0.57 156 XM_ProductURIs 1217 0.71 1.23 0.52 157 RCVD_IN_PBL 1196 0.57 1.21 0.32 158 MIME_QP_LONG_LINE 1194 1.95 1.21 2.23 159 T_STY_INVIS_DIRECT 1188 0.64 1.20 0.43 160 TM2_M_OBFU_COMMENT 1177 0.62 1.19 0.41 161 XM_B_DNDMA 1176 0.69 1.19 0.51 162 THIS_AD 1169 0.55 1.18 0.30 163 XMSexyCombo_01 1167 0.41 1.18 0.11 164 TR_Symld_Words 1163 0.93 1.18 0.84 165 URI_HEX 1162 0.85 1.18 0.73 166 XM_B_REG_HTML 1155 0.44 1.17 0.17 167 HTML_MIME_NO_HTML_TAG 1103 1.23 1.12 1.27 168 NML_ADSP_CUSTOM_MED 1100 0.57 1.11 0.37 169 BAYES_20 1094 2.53 1.11 3.06 170 HTML_TAG_BALANCE_BODY 1085 0.63 1.10 0.45 171 XMReplyNow 1053 0.41 1.07 0.16 172 FORGED_GMAIL_RCVD 1051 0.57 1.06 0.38 173 TR_XM_INV_DKIM 1048 0.38 1.06 0.13 174 XM_SendGrid 1045 0.81 1.06 0.71 175 TR_XM_SpoofStaff 1038 0.40 1.05 0.15 176 TR_Caps_n_Bayes_99 1038 0.30 1.05 0.02 177 TR_XM_PSC1 1006 0.37 1.02 0.12 178 XM_RXBody 1005 0.40 1.02 0.16 179 XM_UB99 1002 0.28 1.01 0.00 180 XM_DIRTYINTL 1001 0.31 1.01 0.04 181 XMSpoofStaff2 1000 0.37 1.01 0.12 182 HK_RANDOM_REPLYTO 999 0.35 1.01 0.09 183 XM_H_SpoofStaff4 996 0.38 1.01 0.15 184 TR_LOTS_OF_MONEY3 983 0.39 0.99 0.17 185 ANY_BOUNCE_MESSAGE 974 28.68 0.99 39.17 186 BOUNCE_MESSAGE 974 28.68 0.99 39.17 187 TR_XM_SpoofStaff4 971 0.35 0.98 0.12 188 URI_TRY_3LD 958 0.59 0.97 0.45 189 XM_H_Long_From02 957 0.64 0.97 0.51 190 TR_XM_SpoofStaff2 943 0.26 0.95 0.00 191 XMSubMetaSx_01 937 0.29 0.95 0.04 192 PP_MIME_FAKE_ASCII_TEXT 933 0.33 0.94 0.09 193 RCVD_IN_XBL 927 0.27 0.94 0.01 194 XM_B_Phish66 912 0.42 0.92 0.23 195 XM_H_PHPMailer 904 0.61 0.91 0.49 196 MultiRelay_CC 896 0.27 0.91 0.03 197 XMBody_78 893 0.36 0.90 0.15 198 LongTLD 890 0.33 0.90 0.12 199 J_POPCORN_WO_D 866 0.39 0.88 0.20 200 TR_MetaPhish_Combo_01 855 0.53 0.86 0.41 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 234359 91.24 94.94 89.84 2 RELAYCOUNTRY_US 227281 86.45 84.65 87.13 3 XM_B_Unicode 214265 83.08 85.58 82.14 4 DCC_CHECK_NEGATIVE 182560 56.18 19.74 69.98 5 BAYES_50 179536 60.23 37.55 68.83 6 XM_B_SpammyWords 172580 66.82 68.55 66.16 7 LOC_TINY_FONT_1 148007 54.42 48.31 56.74 8 HTML_FONT_LOW_CONTRAST 143537 50.11 37.14 55.02 9 T_TM2_M_HEADER_IN_MSG 136216 43.63 20.96 52.22 10 DKIM_SIGNED 126805 60.34 91.30 48.61 11 XM_DK_Pass 124690 59.07 88.82 47.80 12 DKIM_VALID 123847 58.66 88.16 47.48 13 XM_Evil_Numbers_Gen 110703 32.94 7.86 42.44 14 DKIM_VALID_AU 105693 49.54 73.36 40.52 15 ANY_BOUNCE_MESSAGE 102179 28.68 0.99 39.17 16 BOUNCE_MESSAGE 102179 28.68 0.99 39.17 17 HTML_IMAGE_RATIO_06 97786 28.35 4.24 37.49 18 TM2_M_VERY_LONG_WORD 96421 27.82 3.69 36.96 19 MAY_BE_FORGED 94041 26.26 0.41 36.05 20 XMListUnsubscribeExists 88505 43.59 69.08 33.93 21 LotsOfNums_01 85105 25.40 6.32 32.63 22 DCC_CHECK 78248 43.69 79.82 30.00 23 XM_B_Unicode3 77138 35.61 51.53 29.57 24 RCVD_IN_MSPIKE_H2 63599 29.17 41.80 24.38 25 KHOP_HELO_FCRDNS 49187 14.07 1.46 18.86 26 DKIM_VALID_EF 47641 21.69 30.72 18.26 27 FVGT_m_MULTI_ODD 43393 20.60 31.07 16.63 28 XMSubLong 41209 17.54 22.13 15.80 29 T_KAM_HTML_FONT_INVALID 36795 18.77 31.07 14.11 30 XM_B_SpammyWords2 36490 20.63 38.14 13.99 31 MIME_HTML_ONLY 34513 16.70 25.87 13.23 32 USER_IN_DEF_DKIM_WL 30387 9.01 2.04 11.65 33 ALL_TRUSTED 28424 8.48 2.09 10.90 34 XM_Multi_Part_URI 25089 12.98 21.84 9.62 35 TR_XM_DK_Unsub 23126 12.08 20.56 8.87 36 BAYES_40 21538 6.39 1.47 8.26 37 UNPARSEABLE_RELAY 20949 10.30 16.30 8.03 38 BAYES_00 17704 5.06 0.52 6.79 39 XM_B_Unsub 16110 9.39 17.87 6.18 40 FSL_BULK_SIG 15863 7.67 11.86 6.08 41 XM_DKIMWhitelistDomains 14921 4.23 0.31 5.72 42 TR_XM_DK_Bayes 13556 3.88 0.42 5.20 43 TR_XM_DK_Bayes1 13414 3.84 0.41 5.14 44 T_TooManySym_01 12908 4.11 1.91 4.95 45 TR_XM_BayesUnsub 12295 8.19 17.35 4.71 46 TR_MAX_INTL_RELAY 11897 7.78 16.26 4.56 47 TR_XM_DK_Bayes2 11760 3.35 0.30 4.51 48 XM_B_SpammyWords3 11531 7.12 14.23 4.42 49 BAYES_60 11528 5.67 8.97 4.42 50 XM_H_GMP 11423 4.97 6.51 4.38 51 XM_B_PhoneNumber 11006 4.16 4.01 4.22 52 TooManyTo_001 10483 3.80 3.22 4.02 53 LOTS_OF_MONEY 10469 5.89 10.85 4.01 54 RCVD_IN_VALIDITY_SAFE 10021 3.56 2.83 3.84 55 XM_DK_Undo_02 9942 14.23 41.72 3.81 56 XM_H_Long_From01 9598 4.28 5.87 3.68 57 XMStrtUSub 9409 3.72 4.03 3.61 58 XM_B_Phish_Phrases 9299 4.54 7.13 3.56 59 IN_ZIMBRA_NJ_WHITELIST 9282 2.61 0.11 3.56 60 XM_UncommonTLD01 8690 4.21 6.54 3.33 61 HTML_IMAGE_RATIO_02 8366 4.52 7.98 3.21 62 RCVD_IN_MSPIKE_WL 8144 3.28 3.69 3.12 63 RCVD_IN_MSPIKE_H3 8144 3.28 3.69 3.12 64 BAYES_20 7991 2.53 1.11 3.06 65 T_TooManySym_02 7859 2.35 0.61 3.01 66 MPART_ALT_DIFF 7589 3.65 5.61 2.91 67 TR_XM_SpammyWords4 7498 4.41 8.47 2.87 68 BAYES_80 7463 4.80 9.93 2.86 69 HTML_IMAGE_RATIO_04 7457 3.46 5.03 2.86 70 RCVD_IN_VALIDITY_CERTIFIED 7447 2.72 2.37 2.85 71 BAYES_99 7387 11.27 33.52 2.83 72 INVALID_MSGID 6916 1.99 0.23 2.65 73 BOTNET_IPINHOSTNAME 6592 4.45 9.53 2.53 74 TO_MALFORMED 6276 1.75 0.03 2.41 75 XMNumbers 6164 2.79 3.92 2.36 76 XMSubMetaSx_00 6157 3.68 7.17 2.36 77 T_REMOTE_IMAGE 6013 2.03 1.30 2.31 78 MIME_QP_LONG_LINE 5817 1.95 1.21 2.23 79 BAYES_999 5685 8.64 25.67 2.18 80 RELAYCOUNTRY_META 5189 6.27 17.58 1.99 81 HTML_IMAGE_RATIO_08 5143 2.30 3.17 1.97 82 XM_B_SpammyTLD 4844 2.16 2.97 1.86 83 MIME_HTML_MOSTLY 4798 2.33 3.61 1.84 84 XM_CamelCaseFrm001 4441 2.35 4.06 1.70 85 BAYES_95 4431 2.85 5.90 1.70 86 XM_PDF 4334 1.30 0.35 1.66 87 TR_XM_DKIM_Undo 4301 9.17 29.03 1.65 88 TooManyTo_002 4043 1.23 0.39 1.55 89 RCVD_IN_IADB_LISTED 4013 1.26 0.53 1.54 90 XM_Body_Dirty_Words 4012 3.11 7.25 1.54 91 MIME_HTML_ONLY_MULTI 3868 1.99 3.34 1.48 92 MAILING_LIST_MULTI 3705 1.49 1.66 1.42 93 T_XMDrugObfuBody_14 3641 2.27 4.57 1.40 94 RCVD_IN_IADB_SPF 3608 1.13 0.47 1.38 95 FROM_EXCESS_BASE64 3504 1.48 1.83 1.34 96 HTML_MIME_NO_HTML_TAG 3306 1.23 1.12 1.27 97 BAYES_05 3279 1.08 0.61 1.26 98 RCVD_IN_IADB_SENDERID 3257 1.03 0.45 1.25 99 TR_XM_PhishingBody 3246 1.89 3.61 1.24 100 RCVD_IN_IADB_DK 3215 1.02 0.45 1.23 101 IN_HORDE_ADDRESS_BOOK 3148 0.90 0.10 1.21 102 T_TooManySym_03 3111 0.91 0.16 1.19 103 URI_NOVOWEL 3041 1.21 1.33 1.17 104 DKIM_INVALID 2958 1.69 3.14 1.13 105 TR_XM_SpammyRelay 2909 4.46 13.30 1.12 106 TR_DCC_Bayes_99 2876 7.62 24.83 1.10 107 XMStockSpam_06 2817 1.24 1.68 1.08 108 TR_XM_UnparsRelay 2808 3.25 8.97 1.08 109 XMGappySubj_01 2729 0.80 0.15 1.05 110 TM2_M_URI_OPT_OUT 2726 1.39 2.30 1.05 111 RCVD_IN_IADB_VOUCHED 2638 0.81 0.27 1.01 112 TVD_SPACE_RATIO 2638 0.78 0.19 1.01 113 UNTRUSTED_Relay 2501 2.12 5.20 0.96 114 T_XMDrugObfuBody_08 2491 1.36 2.43 0.95 115 XM_B_URI_Unicode 2435 1.19 1.88 0.93 116 XMDiploma_00 2427 1.21 1.97 0.93 117 XM_B_Investor 2389 1.64 3.56 0.92 118 BOTNET 2350 3.16 9.13 0.90 119 XMSexyCombo_05 2289 2.17 5.57 0.88 120 XM_DK_Undo_01 2288 1.08 1.60 0.88 121 TR_XM_SpammyWords5 2280 1.91 4.63 0.87 122 TR_Symld_Words 2179 0.93 1.18 0.84 123 SUBJ_ALL_CAPS 2175 1.56 3.49 0.83 124 XMGappySubj_02 2081 0.59 0.05 0.80 125 XM_B_Unsub2 2047 1.18 2.24 0.78 126 T_TVD_MIME_NO_HEADERS 2020 0.57 0.02 0.77 127 URI_HEX 1912 0.85 1.18 0.73 128 XM_B_COPY_HTML 1896 1.23 2.56 0.73 129 RELAYCOUNTRY_CA 1895 2.41 6.83 0.73 130 XM_GoogleGroups 1882 0.71 0.69 0.72 131 XM_SendGrid 1862 0.81 1.06 0.71 132 XMBdyGiftCard01 1821 0.99 1.76 0.70 133 RCVD_IN_IADB_OPTIN 1813 0.55 0.17 0.70 134 XM_B_FormFill 1787 0.50 0.01 0.69 135 TVD_RCVD_IP 1785 0.69 0.71 0.68 136 LOW_PRICE 1742 0.56 0.27 0.67 137 XMBrknScrpt_02 1703 0.90 1.57 0.65 138 TooManyTo_003 1637 0.56 0.37 0.63 139 HTML_EXTRA_CLOSE 1623 0.46 0.02 0.62 140 DKIM_ADSP_CUSTOM_MED 1486 0.75 1.24 0.57 141 XM_SPF_SoftFail 1464 1.10 2.53 0.56 142 XM_OfRef6 1450 1.26 3.12 0.56 143 T_XMDrugObfuBody_00 1424 1.02 2.26 0.55 144 XMSubMetaI_00 1422 0.74 1.26 0.55 145 TR_XM_DK_SendGrid 1415 0.61 0.78 0.54 146 RCVD_IN_BL_SPAMCOP_NET 1398 2.51 7.70 0.54 147 TR_XM_Base64_M1 1378 0.54 0.57 0.53 148 T_XMHurry_00 1356 1.01 2.29 0.52 149 XM_ProductURIs 1350 0.71 1.23 0.52 150 XM_H_Long_From02 1342 0.64 0.97 0.51 151 XM_UB50 1333 1.06 2.51 0.51 152 XM_B_DNDMA 1321 0.69 1.19 0.51 153 TooManyTo_004 1305 0.46 0.35 0.50 154 XM_B_SpammyWords4 1297 1.06 2.53 0.50 155 HELO_MISC_IP 1291 0.39 0.11 0.49 156 XM_H_PHPMailer 1286 0.61 0.91 0.49 157 XMBody_95 1280 0.38 0.08 0.49 158 T_FILL_THIS_FORM_SHORT 1276 0.89 1.94 0.49 159 HTML_TAG_BALANCE_BODY 1185 0.63 1.10 0.45 160 XMPhish30 1178 0.71 1.38 0.45 161 XMBSHREFv2 1172 0.39 0.22 0.45 162 URI_TRY_3LD 1168 0.59 0.97 0.45 163 USER_IN_WELCOMELIST 1155 0.32 0.00 0.44 164 USER_IN_WHITELIST 1155 0.32 0.00 0.44 165 MPART_ALT_DIFF_COUNT 1139 0.70 1.39 0.44 166 SpammyFromTLD_01 1125 0.96 2.35 0.43 167 T_STY_INVIS_DIRECT 1124 0.64 1.20 0.43 168 TooManyTo_005 1116 0.40 0.33 0.43 169 DIET_1 1116 1.29 3.58 0.43 170 TM2_M_OBFU_COMMENT 1065 0.62 1.19 0.41 171 XM_URI_RBL 1059 1.05 2.76 0.41 172 TR_MetaPhish_Combo_01 1059 0.53 0.86 0.41 173 XMSubNoVowel 1043 0.42 0.48 0.40 174 TR_XM_SpammyWords2 997 3.29 10.96 0.38 175 FORGED_GMAIL_RCVD 997 0.57 1.06 0.38 176 NML_ADSP_CUSTOM_MED 962 0.57 1.11 0.37 177 SH_BODYURI_REVERSE_CSS 929 0.95 2.52 0.36 178 TR_XM_SPAMCOP 909 2.03 6.46 0.35 179 T_TooManySym_04 897 0.26 0.03 0.34 180 URIBL_CSS 895 0.94 2.50 0.34 181 URIBL_CSS_A 895 0.94 2.50 0.34 182 DKIM_ADSP_NXDOMAIN 879 0.41 0.60 0.34 183 XMNoVowels 878 0.48 0.86 0.34 184 XM_ShortIntro_01 858 0.34 0.36 0.33 185 RCVD_IN_PBL 846 0.57 1.21 0.32 186 RELAYCOUNTRY_AU 803 0.85 2.27 0.31 187 XMLngstWrd_00 797 0.34 0.43 0.31 188 THIS_AD 794 0.55 1.18 0.30 189 XMBody_17 787 0.73 1.86 0.30 190 NO_DNS_FOR_FROM 785 0.60 1.39 0.30 191 XMSlimDrugH 781 0.77 2.02 0.30 192 XM_S_SubURI 775 0.23 0.05 0.30 193 XMGenDplmaNmb 774 0.43 0.77 0.30 194 HTML_FONT_FACE_BAD 763 0.37 0.57 0.29 195 MSGID_FROM_MTA_HEADER 700 0.21 0.07 0.27 196 SUSP_UTF8_WORD_SUBJ 685 0.35 0.57 0.26 197 HTML_IMAGE_ONLY_20 676 0.24 0.19 0.26 198 XMPhish08 671 0.36 0.63 0.26 199 XMPhish14 668 0.34 0.57 0.26 200 HTTPS_HTTP_MISMATCH 665 0.40 0.79 0.25 ----------------------------------------------------------------------