Email: 268664 Autolearn: 0 AvgScore: 4.91 AvgScanTime: 1.37 sec Spam: 95619 Autolearn: 0 AvgScore: 13.70 AvgScanTime: 1.44 sec Ham: 173045 Autolearn: 0 AvgScore: 0.05 AvgScanTime: 1.32 sec Time Spent Running SA: 101.90 hours Time Spent Processing Spam: 38.37 hours Time Spent Processing Ham: 63.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 91710 88.24 95.91 84.00 2 DKIM_SIGNED 86090 81.64 90.03 77.00 3 XM_DK_Pass 83280 79.91 87.10 75.94 4 XM_B_Unicode 82940 77.25 86.74 72.01 5 DKIM_VALID 82803 79.39 86.60 75.40 6 RELAYCOUNTRY_US 79770 81.46 83.42 80.38 7 DCC_CHECK 74898 58.29 78.33 47.22 8 XM_B_SpammyWords 68976 55.42 72.14 46.19 9 XMListUnsubscribeExists 67360 59.66 70.45 53.70 10 DKIM_VALID_AU 66348 65.94 69.39 64.04 11 XM_B_Unicode3 48646 48.00 50.87 46.41 12 LOC_TINY_FONT_1 47237 38.55 49.40 32.55 13 XM_DK_Undo_02 42003 19.22 43.93 5.57 14 RCVD_IN_MSPIKE_H2 41822 39.95 43.74 37.85 15 XM_B_SpammyWords2 38841 27.47 40.62 20.20 16 HTML_FONT_LOW_CONTRAST 35947 33.67 37.59 31.51 17 BAYES_50 34796 52.68 36.39 61.68 18 BAYES_99 33014 15.05 34.53 4.29 19 TR_XM_DKIM_Undo 30977 12.97 32.40 2.24 20 T_KAM_HTML_FONT_INVALID 30311 25.13 31.70 21.50 21 FVGT_m_MULTI_ODD 30180 28.03 31.56 26.09 22 MIME_HTML_ONLY 26969 24.09 28.20 21.82 23 DKIM_VALID_EF 26313 28.44 27.52 28.95 24 BAYES_999 25736 11.73 26.92 3.34 25 TR_DCC_Bayes_99 24151 9.99 25.26 1.55 26 XMSubLong 21017 23.07 21.98 23.68 27 DCC_CHECK_NEGATIVE 20189 41.49 21.11 52.76 28 XM_Multi_Part_URI 19934 17.56 20.85 15.74 29 TR_XM_DK_Unsub 19636 16.62 20.54 14.46 30 T_TM2_M_HEADER_IN_MSG 19129 22.57 20.01 23.99 31 XM_B_Unsub 17879 13.23 18.70 10.21 32 TR_XM_BayesUnsub 17418 11.73 18.22 8.15 33 UNPARSEABLE_RELAY 17400 14.99 18.20 13.22 34 XM_B_SpammyWords3 16140 9.76 16.88 5.82 35 RELAYCOUNTRY_META 15249 7.97 15.95 3.56 36 TR_MAX_INTL_RELAY 14885 10.01 15.57 6.93 37 TR_XM_SpammyWords2 12167 4.81 12.72 0.43 38 TR_XM_SpammyRelay 11681 5.78 12.22 2.23 39 FSL_BULK_SIG 10379 10.00 10.85 9.53 40 RCVD_IN_BL_SPAMCOP_NET 10195 4.21 10.66 0.65 41 LOTS_OF_MONEY 10108 7.63 10.57 6.00 42 TR_XM_UnparsRelay 9511 4.57 9.95 1.59 43 BAYES_80 9155 6.23 9.57 4.38 44 BOTNET_IPINHOSTNAME 9017 5.94 9.43 4.01 45 TR_XM_SpammyWords4 8915 5.91 9.32 4.03 46 BAYES_60 8577 8.18 8.97 7.74 47 TR_XM_SPAMCOP 8360 3.31 8.74 0.30 48 BOTNET 8164 4.03 8.54 1.53 49 XM_Evil_Numbers_Gen 8057 9.05 8.43 9.39 50 HTML_IMAGE_RATIO_02 7483 6.68 7.83 6.05 51 RELAYCOUNTRY_CA 6780 3.42 7.09 1.39 52 XM_B_Phish_Phrases 6630 5.38 6.93 4.53 53 XM_Body_Dirty_Words 6626 4.10 6.93 2.54 54 LotsOfNums_01 5877 6.54 6.15 6.76 55 XM_UncommonTLD01 5820 5.45 6.09 5.10 56 MPART_ALT_DIFF 5733 5.56 6.00 5.32 57 UNTRUSTED_Relay 5480 3.04 5.73 1.55 58 XMSubMetaSx_00 5450 4.36 5.70 3.62 59 BAYES_95 5345 3.63 5.59 2.55 60 XM_H_GMP 4865 5.92 5.09 6.38 61 HTML_IMAGE_RATIO_04 4826 4.51 5.05 4.21 62 T_XMDrugObfuBody_14 4398 3.03 4.60 2.17 63 XMSexyCombo_05 4213 2.60 4.41 1.60 64 XM_H_Long_From01 4183 5.20 4.37 5.66 65 TR_XM_PhishingBody 3991 2.58 4.17 1.69 66 XMStrtUSub 3892 5.01 4.07 5.52 67 XM_B_PhoneNumber 3811 5.39 3.99 6.17 68 RCVD_IN_MSPIKE_WL 3764 4.50 3.94 4.82 69 RCVD_IN_MSPIKE_H3 3764 4.50 3.94 4.82 70 MIME_HTML_MOSTLY 3518 2.94 3.68 2.53 71 HTML_IMAGE_RATIO_06 3513 2.89 3.67 2.45 72 XM_SPF_SoftFail 3506 1.94 3.67 0.99 73 XM_B_Investor 3436 2.16 3.59 1.37 74 TM2_M_URI_OPT_OUT 3432 2.43 3.59 1.79 75 XM_CamelCaseFrm001 3346 3.19 3.50 3.03 76 XM_OfRef6 3335 1.98 3.49 1.15 77 DKIM_INVALID 3287 2.25 3.44 1.60 78 XM_B_SpammyTLD 3239 2.92 3.39 2.67 79 MIME_HTML_ONLY_MULTI 3230 3.35 3.38 3.33 80 TM2_M_VERY_LONG_WORD 3114 2.13 3.26 1.51 81 RCVD_IN_VALIDITY_SAFE 2976 4.72 3.11 5.61 82 RCVD_IN_VALIDITY_RPBL 2974 1.13 3.11 0.03 83 TooManyTo_001 2889 5.10 3.02 6.24 84 TR_XM_SpammyWords5 2828 1.72 2.96 1.03 85 XM_B_Unsub2 2821 1.89 2.95 1.31 86 USER_IN_DEF_DKIM_WL 2722 12.36 2.85 17.62 87 HTML_IMAGE_RATIO_08 2713 3.05 2.84 3.17 88 XM_URI_RBL 2685 1.29 2.81 0.45 89 XMDiploma_00 2653 2.22 2.77 1.92 90 T_FILL_THIS_FORM_SHORT 2620 1.67 2.74 1.08 91 RCVD_IN_VALIDITY_CERTIFIED 2582 3.72 2.70 4.29 92 XMNumbers 2579 3.25 2.70 3.56 93 XMBody_17 2570 1.38 2.69 0.66 94 T_XMHurry_00 2526 1.34 2.64 0.63 95 XM_B_URI_Unicode 2521 1.97 2.64 1.60 96 FROM_EXCESS_BASE64 2375 2.06 2.48 1.83 97 RCVD_IN_PBL 2300 1.22 2.41 0.56 98 T_XMDrugObfuBody_00 2222 1.23 2.32 0.62 99 T_XMDrugObfuBody_08 2218 1.93 2.32 1.71 100 XM_B_SpammyWords4 2194 1.22 2.29 0.63 101 XM_UB50 2166 1.39 2.27 0.90 102 RELAYCOUNTRY_AU 2110 1.21 2.21 0.66 103 TR_XM_NoHeaderRelay 2033 0.88 2.13 0.19 104 MultiRelay_CC 2022 0.83 2.11 0.12 105 XMSlimDrugH 1985 1.09 2.08 0.55 106 MPART_ALT_DIFF_COUNT 1942 1.16 2.03 0.68 107 ALL_TRUSTED 1902 11.23 1.99 16.33 108 XM_H_Long_From02 1843 1.34 1.93 1.02 109 RCVD_IN_PSBL 1834 0.78 1.92 0.15 110 MAILING_LIST_MULTI 1831 2.11 1.91 2.21 111 SpammyFromTLD_02 1780 0.79 1.86 0.20 112 T_TooManySym_01 1744 5.36 1.82 7.31 113 TR_LOTS_OF_MONEY3 1733 0.92 1.81 0.43 114 T_Symld_Words_02 1706 0.77 1.78 0.21 115 XM_DK_Undo_01 1694 1.67 1.77 1.61 116 XMMoneyMeta_00 1683 0.77 1.76 0.22 117 SpammyFromTLD_01 1667 1.05 1.74 0.67 118 HTML_FONT_TINY_NORDNS 1662 0.65 1.74 0.05 119 TR_XM_InvalidRelay 1641 0.62 1.72 0.01 120 T_REMOTE_IMAGE 1623 2.84 1.70 3.46 121 XMStockSpam_06 1622 1.71 1.70 1.72 122 XMBdyGiftCard01 1581 1.29 1.65 1.08 123 RELAYCOUNTRY_IN 1575 0.62 1.65 0.05 124 DIET_1 1542 1.13 1.61 0.86 125 BAYES_40 1506 3.76 1.58 4.96 126 TR_XM_PHPForged 1489 0.76 1.56 0.32 127 TR_XM_PHPDW 1480 0.75 1.55 0.30 128 TR_XM_FormFill2 1477 0.75 1.54 0.30 129 XMPhish30 1464 1.07 1.53 0.81 130 SUBJ_ALL_CAPS 1444 1.20 1.51 1.04 131 LongTLD 1430 0.69 1.50 0.24 132 XM_H_PHPOS 1426 0.72 1.49 0.29 133 XM_B_REG_HTML 1400 0.69 1.46 0.26 134 TR_XM_INV_DKIM 1396 0.64 1.46 0.19 135 SHOPIFY_IMG_NOT_RCVD_SFY 1390 0.74 1.45 0.35 136 XM_B_COPY_HTML 1335 1.14 1.40 0.99 137 BOTNET_NORDNS 1331 0.50 1.39 0.01 138 XM_HighProb1 1318 0.50 1.38 0.01 139 BAYES_00 1317 6.38 1.38 9.14 140 KHOP_HELO_FCRDNS 1299 1.20 1.36 1.11 141 XMBrknScrpt_02 1283 1.31 1.34 1.30 142 HTML_MIME_NO_HTML_TAG 1279 1.70 1.34 1.91 143 MIME_QP_LONG_LINE 1271 2.68 1.33 3.42 144 TR_XM_Base64_M1 1256 0.95 1.31 0.75 145 XM_B_DNDMA 1246 1.08 1.30 0.95 146 XM_SendGrid 1245 1.28 1.30 1.27 147 RELAYCOUNTRY_SK 1219 0.45 1.27 0.00 148 XMSubMetaI_00 1212 0.94 1.27 0.76 149 URI_TRY_3LD 1185 0.77 1.24 0.51 150 T_STY_INVIS_DIRECT 1147 0.79 1.20 0.57 151 XM_B_Phish66 1124 0.59 1.18 0.27 152 URI_HEX 1109 1.17 1.16 1.18 153 TM2_M_OBFU_COMMENT 1102 0.78 1.15 0.57 154 XMReplyNow 1030 0.52 1.08 0.21 155 HOSTED_IMG_MULTI_PUB_01 1022 0.42 1.07 0.06 156 DKIM_ADSP_NXDOMAIN 1008 0.79 1.05 0.64 157 TR_XM_FormFill 997 0.38 1.04 0.01 158 TR_Mismatch_TLD_02 982 0.41 1.03 0.07 159 URI_NOVOWEL 968 1.56 1.01 1.87 160 XM_DIRTYINTL 958 0.40 1.00 0.06 161 HTML_TAG_BALANCE_BODY 926 0.95 0.97 0.93 162 XM_H_PHPMailer 925 0.94 0.97 0.93 163 HTTPS_HTTP_MISMATCH 909 0.63 0.95 0.45 164 PLING_QUERY 907 0.69 0.95 0.55 165 FONT_INVIS_LONG_LINE 900 0.42 0.94 0.14 166 BAYES_20 900 2.51 0.94 3.37 167 HTML_FONT_FACE_BAD 898 0.64 0.94 0.47 168 XM_Combo_Sbj 889 0.45 0.93 0.18 169 XM_ProductURIs 884 0.79 0.92 0.71 170 XMSexyCombo_01 881 0.45 0.92 0.19 171 XM_UB99 871 0.33 0.91 0.01 172 TR_MetaPhish_Combo_01 844 0.77 0.88 0.70 173 TR_XM_RelayPhish 840 0.37 0.88 0.09 174 TR_Mismatch_TLD_01 837 0.48 0.88 0.27 175 TR_XM_DK_SendGrid 833 0.92 0.87 0.95 176 XMBody_78 824 0.46 0.86 0.24 177 DKIM_ADSP_CUSTOM_MED 815 0.82 0.85 0.81 178 RCVD_IN_XBL 808 0.31 0.85 0.01 179 TM2_M_A_HREF_HREF 800 0.43 0.84 0.20 180 J_POPCORN_WO_D 785 0.46 0.82 0.26 181 XMGenDplmaNmb 779 0.81 0.81 0.81 182 TR_LOTS_OF_MONEY2 776 0.39 0.81 0.16 183 T_MONEY_PERCENT 776 0.39 0.81 0.16 184 XM_RXBody 771 0.62 0.81 0.52 185 AC_HTML_NONSENSE_TAGS 755 0.36 0.79 0.12 186 XM_B_SEO 753 0.42 0.79 0.21 187 XMHTML_After_End 739 0.49 0.77 0.33 188 RELAYCOUNTRY_GB 720 0.47 0.75 0.31 189 NO_DNS_FOR_FROM 713 0.56 0.75 0.45 190 XM_GoogleGroups 708 1.05 0.74 1.22 191 XM_OfRef7 696 0.42 0.73 0.25 192 THIS_AD 695 0.50 0.73 0.37 193 TR_XM_MaxWHORU 693 0.48 0.72 0.34 194 NML_ADSP_CUSTOM_MED 685 0.61 0.72 0.55 195 RDNS_DYNAMIC 685 0.43 0.72 0.28 196 XMSolicitRefs_0 674 0.42 0.70 0.26 197 PDS_RDNS_DYNAMIC_FP 669 0.30 0.70 0.08 198 HTML_IMAGE_ONLY_20 667 0.50 0.70 0.39 199 XMPhish08 664 0.38 0.69 0.21 200 FORGED_GMAIL_RCVD 660 0.57 0.69 0.51 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145354 88.24 95.91 84.00 2 RELAYCOUNTRY_US 139097 81.46 83.42 80.38 3 DKIM_SIGNED 133246 81.64 90.03 77.00 4 XM_DK_Pass 131412 79.91 87.10 75.94 5 DKIM_VALID 130480 79.39 86.60 75.40 6 XM_B_Unicode 124608 77.25 86.74 72.01 7 DKIM_VALID_AU 110810 65.94 69.39 64.04 8 BAYES_50 106739 52.68 36.39 61.68 9 XMListUnsubscribeExists 92931 59.66 70.45 53.70 10 DCC_CHECK_NEGATIVE 91292 41.49 21.11 52.76 11 DCC_CHECK 81710 58.29 78.33 47.22 12 XM_B_Unicode3 80311 48.00 50.87 46.41 13 XM_B_SpammyWords 79923 55.42 72.14 46.19 14 RCVD_IN_MSPIKE_H2 65497 39.95 43.74 37.85 15 LOC_TINY_FONT_1 56328 38.55 49.40 32.55 16 HTML_FONT_LOW_CONTRAST 54518 33.67 37.59 31.51 17 DKIM_VALID_EF 50092 28.44 27.52 28.95 18 FVGT_m_MULTI_ODD 45139 28.03 31.56 26.09 19 T_TM2_M_HEADER_IN_MSG 41518 22.57 20.01 23.99 20 XMSubLong 40977 23.07 21.98 23.68 21 MIME_HTML_ONLY 37759 24.09 28.20 21.82 22 T_KAM_HTML_FONT_INVALID 37201 25.13 31.70 21.50 23 XM_B_SpammyWords2 34962 27.47 40.62 20.20 24 USER_IN_DEF_DKIM_WL 30484 12.36 2.85 17.62 25 ALL_TRUSTED 28257 11.23 1.99 16.33 26 XM_Multi_Part_URI 27231 17.56 20.85 15.74 27 TR_XM_DK_Unsub 25025 16.62 20.54 14.46 28 UNPARSEABLE_RELAY 22885 14.99 18.20 13.22 29 XM_B_Unsub 17660 13.23 18.70 10.21 30 FSL_BULK_SIG 16492 10.00 10.85 9.53 31 XM_DKIMWhitelistDomains 16349 6.12 0.10 9.45 32 XM_Evil_Numbers_Gen 16252 9.05 8.43 9.39 33 BAYES_00 15811 6.38 1.38 9.14 34 TR_XM_BayesUnsub 14107 11.73 18.22 8.15 35 BAYES_60 13394 8.18 8.97 7.74 36 T_TooManySym_01 12653 5.36 1.82 7.31 37 TR_XM_DK_Bayes 12087 4.67 0.47 6.98 38 TR_MAX_INTL_RELAY 11998 10.01 15.57 6.93 39 TR_XM_DK_Bayes1 11977 4.62 0.47 6.92 40 LotsOfNums_01 11698 6.54 6.15 6.76 41 XM_H_GMP 11044 5.92 5.09 6.38 42 TooManyTo_001 10801 5.10 3.02 6.24 43 XM_B_PhoneNumber 10680 5.39 3.99 6.17 44 HTML_IMAGE_RATIO_02 10463 6.68 7.83 6.05 45 TR_XM_DK_Bayes2 10390 3.95 0.23 6.00 46 LOTS_OF_MONEY 10385 7.63 10.57 6.00 47 XM_B_SpammyWords3 10069 9.76 16.88 5.82 48 XM_H_Long_From01 9793 5.20 4.37 5.66 49 RCVD_IN_VALIDITY_SAFE 9708 4.72 3.11 5.61 50 XM_DK_Undo_02 9646 19.22 43.93 5.57 51 XMStrtUSub 9557 5.01 4.07 5.52 52 IN_ZIMBRA_NJ_WHITELIST 9246 3.48 0.10 5.34 53 MPART_ALT_DIFF 9212 5.56 6.00 5.32 54 XM_UncommonTLD01 8818 5.45 6.09 5.10 55 BAYES_40 8591 3.76 1.58 4.96 56 RCVD_IN_MSPIKE_H3 8338 4.50 3.94 4.82 57 RCVD_IN_MSPIKE_WL 8338 4.50 3.94 4.82 58 XM_B_Phish_Phrases 7835 5.38 6.93 4.53 59 T_TooManySym_02 7760 3.04 0.42 4.48 60 BAYES_80 7573 6.23 9.57 4.38 61 RCVD_IN_VALIDITY_CERTIFIED 7424 3.72 2.70 4.29 62 BAYES_99 7424 15.05 34.53 4.29 63 HTML_IMAGE_RATIO_04 7291 4.51 5.05 4.21 64 ANY_BOUNCE_MESSAGE 7049 2.86 0.67 4.07 65 BOUNCE_MESSAGE 7048 2.86 0.66 4.07 66 TR_XM_SpammyWords4 6969 5.91 9.32 4.03 67 BOTNET_IPINHOSTNAME 6944 5.94 9.43 4.01 68 INVALID_MSGID 6737 2.71 0.56 3.89 69 XMSubMetaSx_00 6271 4.36 5.70 3.62 70 TO_MALFORMED 6256 2.35 0.06 3.62 71 RELAYCOUNTRY_META 6163 7.97 15.95 3.56 72 XMNumbers 6154 3.25 2.70 3.56 73 T_REMOTE_IMAGE 5996 2.84 1.70 3.46 74 MIME_QP_LONG_LINE 5916 2.68 1.33 3.42 75 BAYES_20 5832 2.51 0.94 3.37 76 BAYES_999 5777 11.73 26.92 3.34 77 MIME_HTML_ONLY_MULTI 5768 3.35 3.38 3.33 78 HTML_IMAGE_RATIO_08 5493 3.05 2.84 3.17 79 XM_CamelCaseFrm001 5235 3.19 3.50 3.03 80 XM_B_SpammyTLD 4612 2.92 3.39 2.67 81 BAYES_95 4417 3.63 5.59 2.55 82 XM_Body_Dirty_Words 4395 4.10 6.93 2.54 83 MIME_HTML_MOSTLY 4385 2.94 3.68 2.53 84 XM_PDF 4307 1.85 0.69 2.49 85 HTML_IMAGE_RATIO_06 4244 2.89 3.67 2.45 86 RCVD_IN_IADB_LISTED 3895 1.63 0.50 2.25 87 TR_XM_DKIM_Undo 3880 12.97 32.40 2.24 88 TR_XM_SpammyRelay 3859 5.78 12.22 2.23 89 MAILING_LIST_MULTI 3826 2.11 1.91 2.21 90 TooManyTo_002 3825 1.60 0.50 2.21 91 T_XMDrugObfuBody_14 3747 3.03 4.60 2.17 92 RCVD_IN_IADB_SPF 3454 1.44 0.44 2.00 93 XMDiploma_00 3314 2.22 2.77 1.92 94 HTML_MIME_NO_HTML_TAG 3300 1.70 1.34 1.91 95 BAYES_05 3257 1.40 0.52 1.88 96 URI_NOVOWEL 3232 1.56 1.01 1.87 97 T_TooManySym_03 3221 1.26 0.16 1.86 98 IN_HORDE_ADDRESS_BOOK 3220 1.27 0.19 1.86 99 FROM_EXCESS_BASE64 3167 2.06 2.48 1.83 100 RCVD_IN_IADB_SENDERID 3134 1.32 0.42 1.81 101 TM2_M_URI_OPT_OUT 3099 2.43 3.59 1.79 102 RCVD_IN_IADB_DK 3087 1.30 0.42 1.78 103 XMStockSpam_06 2984 1.71 1.70 1.72 104 T_XMDrugObfuBody_08 2959 1.93 2.32 1.71 105 TR_XM_PhishingBody 2929 2.58 4.17 1.69 106 XMGappySubj_01 2835 1.10 0.14 1.64 107 XM_DK_Undo_01 2791 1.67 1.77 1.61 108 DKIM_INVALID 2766 2.25 3.44 1.60 109 XMSexyCombo_05 2765 2.60 4.41 1.60 110 XM_B_URI_Unicode 2762 1.97 2.64 1.60 111 TR_XM_UnparsRelay 2755 4.57 9.95 1.59 112 TVD_SPACE_RATIO 2716 1.07 0.17 1.57 113 TR_DCC_Bayes_99 2681 9.99 25.26 1.55 114 UNTRUSTED_Relay 2681 3.04 5.73 1.55 115 BOTNET 2654 4.03 8.54 1.53 116 TM2_M_VERY_LONG_WORD 2607 2.13 3.26 1.51 117 TR_Symld_Words 2578 1.17 0.60 1.49 118 RCVD_IN_IADB_VOUCHED 2553 1.04 0.26 1.48 119 LOW_PRICE 2496 1.10 0.49 1.44 120 RELAYCOUNTRY_CA 2410 3.42 7.09 1.39 121 XM_B_Investor 2366 2.16 3.59 1.37 122 XM_B_Unsub2 2259 1.89 2.95 1.31 123 XMBrknScrpt_02 2247 1.31 1.34 1.30 124 XM_SendGrid 2195 1.28 1.30 1.27 125 XMGappySubj_02 2176 0.82 0.03 1.26 126 XM_GoogleGroups 2103 1.05 0.74 1.22 127 T_TVD_MIME_NO_HEADERS 2050 0.78 0.05 1.18 128 URI_HEX 2045 1.17 1.16 1.18 129 XM_OfRef6 1985 1.98 3.49 1.15 130 KHOP_HELO_FCRDNS 1914 1.20 1.36 1.11 131 XMBdyGiftCard01 1877 1.29 1.65 1.08 132 T_FILL_THIS_FORM_SHORT 1870 1.67 2.74 1.08 133 TVD_RCVD_IP 1795 0.88 0.61 1.04 134 SUBJ_ALL_CAPS 1792 1.20 1.51 1.04 135 TR_XM_SpammyWords5 1785 1.72 2.96 1.03 136 TooManyTo_003 1783 0.82 0.44 1.03 137 XM_H_Long_From02 1768 1.34 1.93 1.02 138 RCVD_IN_IADB_OPTIN 1750 0.71 0.16 1.01 139 XM_B_COPY_HTML 1716 1.14 1.40 0.99 140 XM_SPF_SoftFail 1712 1.94 3.67 0.99 141 XM_B_DNDMA 1652 1.08 1.30 0.95 142 TR_XM_DK_SendGrid 1649 0.92 0.87 0.95 143 HTML_TAG_BALANCE_BODY 1616 0.95 0.97 0.93 144 XM_H_PHPMailer 1611 0.94 0.97 0.93 145 XM_UB50 1557 1.39 2.27 0.90 146 HTML_EXTRA_CLOSE 1515 0.59 0.06 0.88 147 DIET_1 1494 1.13 1.61 0.86 148 XM_B_FormFill 1461 0.57 0.09 0.84 149 XMBody_95 1461 0.59 0.12 0.84 150 XMGenDplmaNmb 1409 0.81 0.81 0.81 151 XMPhish30 1408 1.07 1.53 0.81 152 DKIM_ADSP_CUSTOM_MED 1395 0.82 0.85 0.81 153 HELO_MISC_IP 1393 0.55 0.09 0.80 154 TooManyTo_004 1373 0.66 0.41 0.79 155 XMBSHREFv2 1325 0.59 0.27 0.77 156 XMSubMetaI_00 1319 0.94 1.27 0.76 157 TR_XM_Base64_M1 1297 0.95 1.31 0.75 158 XM_ProductURIs 1230 0.79 0.92 0.71 159 XMNoVowels 1227 0.59 0.38 0.71 160 USER_IN_WELCOMELIST 1225 0.46 0.00 0.71 161 USER_IN_WHITELIST 1225 0.46 0.00 0.71 162 TR_MetaPhish_Combo_01 1214 0.77 0.88 0.70 163 TooManyTo_005 1198 0.59 0.40 0.69 164 MPART_ALT_DIFF_COUNT 1179 1.16 2.03 0.68 165 SpammyFromTLD_01 1153 1.05 1.74 0.67 166 XMBody_17 1144 1.38 2.69 0.66 167 RELAYCOUNTRY_AU 1140 1.21 2.21 0.66 168 RCVD_IN_BL_SPAMCOP_NET 1123 4.21 10.66 0.65 169 DKIM_ADSP_NXDOMAIN 1116 0.79 1.05 0.64 170 XM_B_SpammyWords4 1089 1.22 2.29 0.63 171 T_XMHurry_00 1082 1.34 2.64 0.63 172 FONT_INVIS_MSGID 1078 0.45 0.12 0.62 173 T_XMDrugObfuBody_00 1077 1.23 2.32 0.62 174 XMClaimOffer 1021 0.50 0.34 0.59 175 TM2_M_OBFU_COMMENT 981 0.78 1.15 0.57 176 T_STY_INVIS_DIRECT 980 0.79 1.20 0.57 177 XMLngstWrd_00 969 0.47 0.32 0.56 178 RCVD_IN_PBL 965 1.22 2.41 0.56 179 PLING_QUERY 951 0.69 0.95 0.55 180 NML_ADSP_CUSTOM_MED 947 0.61 0.72 0.55 181 XMSlimDrugH 944 1.09 2.08 0.55 182 T_TooManySym_04 910 0.35 0.03 0.53 183 XM_RXBody 899 0.62 0.81 0.52 184 URI_TRY_3LD 885 0.77 1.24 0.51 185 FORGED_GMAIL_RCVD 883 0.57 0.69 0.51 186 XMLngstWrd_01 833 0.40 0.27 0.48 187 HTML_FONT_FACE_BAD 819 0.64 0.94 0.47 188 T_OBFU_PDF_ATTACH 794 0.33 0.08 0.46 189 XM_S_SubURI 783 0.31 0.06 0.45 190 NO_DNS_FOR_FROM 782 0.56 0.75 0.45 191 HTTPS_HTTP_MISMATCH 781 0.63 0.95 0.45 192 XM_URI_RBL 775 1.29 2.81 0.45 193 HTML_IMAGE_ONLY_28 762 0.34 0.15 0.44 194 XMSubMetaSxObfu_03 761 0.42 0.38 0.44 195 TR_XM_SpammyWords2 748 4.81 12.72 0.43 196 TR_LOTS_OF_MONEY3 747 0.92 1.81 0.43 197 DATE_IN_PAST_06_12 742 0.30 0.06 0.43 198 XM_ShortIntro_01 710 0.38 0.32 0.41 199 XMCapTrack 690 0.35 0.25 0.40 200 HTML_IMAGE_ONLY_20 674 0.50 0.70 0.39 ----------------------------------------------------------------------