Email: 276781 Autolearn: 0 AvgScore: 4.95 AvgScanTime: 1.38 sec Spam: 99968 Autolearn: 0 AvgScore: 13.70 AvgScanTime: 1.48 sec Ham: 176813 Autolearn: 0 AvgScore: 0.01 AvgScanTime: 1.32 sec Time Spent Running SA: 105.96 hours Time Spent Processing Spam: 41.20 hours Time Spent Processing Ham: 64.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93883 88.06 93.91 84.75 2 DKIM_SIGNED 90531 82.31 90.56 77.65 3 XM_DK_Pass 85329 79.74 85.36 76.57 4 XM_B_Unicode 85287 77.50 85.31 73.09 5 DKIM_VALID 84842 79.26 84.87 76.08 6 RELAYCOUNTRY_US 83867 81.93 83.89 80.82 7 DCC_CHECK 78895 59.20 78.92 48.05 8 XMListUnsubscribeExists 73182 61.90 73.21 55.50 9 DKIM_VALID_AU 67715 65.82 67.74 64.74 10 XM_B_SpammyWords 67569 54.77 67.59 47.53 11 XM_B_Unicode3 51644 48.66 51.66 46.96 12 LOC_TINY_FONT_1 48328 39.37 48.34 34.30 13 RCVD_IN_MSPIKE_H2 43041 40.09 43.05 38.42 14 XM_DK_Undo_02 40902 18.31 40.92 5.53 15 XM_B_SpammyWords2 40557 28.21 40.57 21.22 16 BAYES_50 40183 54.37 40.20 62.39 17 HTML_FONT_LOW_CONTRAST 37652 33.73 37.66 31.50 18 T_KAM_HTML_FONT_INVALID 32318 25.60 32.33 21.79 19 FVGT_m_MULTI_ODD 31578 28.52 31.59 26.79 20 BAYES_99 31147 13.95 31.16 4.22 21 TR_XM_DKIM_Undo 29568 12.33 29.58 2.58 22 DKIM_VALID_EF 28505 29.42 28.51 29.93 23 MIME_HTML_ONLY 24673 22.91 24.68 21.91 24 BAYES_999 23837 10.74 23.84 3.33 25 TR_DCC_Bayes_99 23349 9.55 23.36 1.75 26 TR_XM_DK_Unsub 22494 17.94 22.50 15.35 27 XMSubLong 21651 22.30 21.66 22.66 28 XM_Multi_Part_URI 21232 18.40 21.24 16.79 29 DCC_CHECK_NEGATIVE 20616 40.62 20.62 51.92 30 T_TM2_M_HEADER_IN_MSG 19465 21.51 19.47 22.66 31 UNPARSEABLE_RELAY 17085 15.08 17.09 13.94 32 XM_B_Unsub 16399 12.14 16.40 9.72 33 TR_XM_BayesUnsub 15742 10.62 15.75 7.72 34 TR_MAX_INTL_RELAY 15515 9.62 15.52 6.29 35 RELAYCOUNTRY_META 15150 7.62 15.15 3.35 36 XM_B_SpammyWords3 14091 9.32 14.10 6.62 37 LOTS_OF_MONEY 12644 8.70 12.65 6.46 38 BOTNET 12110 5.18 12.11 1.26 39 TR_XM_SpammyWords2 11825 4.61 11.83 0.53 40 TR_XM_SpammyRelay 10982 5.19 10.99 1.92 41 BOTNET_IPINHOSTNAME 10530 6.05 10.53 3.52 42 RCVD_IN_BL_SPAMCOP_NET 10305 4.15 10.31 0.67 43 TR_XM_SpammyWords4 9789 6.53 9.79 4.68 44 BAYES_80 9734 5.97 9.74 3.85 45 XM_Evil_Numbers_Gen 9571 9.76 9.57 9.86 46 TR_XM_UnparsRelay 8813 4.36 8.82 1.83 47 BAYES_60 8574 7.63 8.58 7.10 48 TR_XM_SPAMCOP 8157 3.10 8.16 0.24 49 FSL_BULK_SIG 8129 8.87 8.13 9.29 50 LotsOfNums_01 7617 7.46 7.62 7.37 51 XM_Body_Dirty_Words 7608 4.43 7.61 2.64 52 XM_B_Phish_Phrases 7498 5.53 7.50 4.41 53 HTML_IMAGE_RATIO_02 7469 6.26 7.47 5.57 54 RELAYCOUNTRY_CA 7059 3.33 7.06 1.23 55 XMSubMetaSx_00 7023 4.80 7.03 3.54 56 XM_UncommonTLD01 5970 5.41 5.97 5.10 57 DKIM_INVALID 5689 3.06 5.69 1.57 58 MPART_ALT_DIFF 5605 5.42 5.61 5.31 59 BAYES_95 5570 3.57 5.57 2.44 60 XM_H_Long_From01 5151 5.67 5.15 5.96 61 XM_H_GMP 5098 5.70 5.10 6.04 62 XM_B_SpammyTLD 4975 3.56 4.98 2.75 63 UNTRUSTED_Relay 4941 2.81 4.94 1.61 64 XMSexyCombo_05 4585 2.43 4.59 1.21 65 HTML_IMAGE_RATIO_04 4410 4.32 4.41 4.26 66 XMBody_17 4404 2.06 4.41 0.73 67 TR_XM_PhishingBody 4233 2.59 4.23 1.65 68 T_XMDrugObfuBody_14 4091 2.75 4.09 1.99 69 XM_B_PhoneNumber 4019 5.23 4.02 5.92 70 XMStrtUSub 3962 4.72 3.96 5.15 71 RCVD_IN_MSPIKE_WL 3619 4.33 3.62 4.73 72 RCVD_IN_MSPIKE_H3 3619 4.33 3.62 4.73 73 XM_B_Investor 3602 2.14 3.60 1.31 74 TR_XM_SpammyWords5 3348 2.08 3.35 1.36 75 MIME_HTML_MOSTLY 3340 2.97 3.34 2.75 76 TR_LOTS_OF_MONEY3 3271 1.54 3.27 0.56 77 XM_CamelCaseFrm001 3258 2.86 3.26 2.64 78 MIME_HTML_ONLY_MULTI 3227 3.24 3.23 3.24 79 RCVD_IN_VALIDITY_RPBL 3166 1.20 3.17 0.09 80 HTML_IMAGE_RATIO_06 3140 2.92 3.14 2.80 81 XMNumbers 3065 3.63 3.07 3.95 82 XM_OfRef6 3063 1.73 3.06 0.98 83 XM_URI_RBL 3034 1.44 3.03 0.54 84 T_XMHurry_00 3004 1.57 3.00 0.77 85 TM2_M_VERY_LONG_WORD 2990 1.96 2.99 1.37 86 KHOP_HELO_FCRDNS 2987 1.85 2.99 1.21 87 DIET_1 2949 1.44 2.95 0.58 88 TooManyTo_001 2916 4.97 2.92 6.13 89 T_XMDrugObfuBody_08 2874 1.82 2.87 1.22 90 URI_HEX 2783 1.82 2.78 1.28 91 RELAYCOUNTRY_AU 2684 1.27 2.68 0.46 92 XMDiploma_00 2647 1.81 2.65 1.34 93 DKIM_ADSP_NXDOMAIN 2569 1.23 2.57 0.47 94 RDNS_DYNAMIC 2543 1.08 2.54 0.24 95 PDS_RDNS_DYNAMIC_FP 2514 0.94 2.51 0.05 96 XM_B_Unsub2 2512 1.80 2.51 1.39 97 T_FILL_THIS_FORM_SHORT 2434 1.42 2.43 0.84 98 XM_SPF_SoftFail 2401 1.44 2.40 0.89 99 NO_DNS_FOR_FROM 2390 1.13 2.39 0.41 100 HTML_IMAGE_RATIO_08 2381 2.66 2.38 2.82 101 TR_XM_MaxWHORU 2373 1.06 2.37 0.32 102 ALL_TRUSTED 2371 11.02 2.37 15.91 103 TR_XM_NoHeaderRelay 2357 0.97 2.36 0.18 104 TM2_M_URI_OPT_OUT 2352 2.02 2.35 1.84 105 XM_UB50 2349 1.47 2.35 0.97 106 RCVD_IN_VALIDITY_SAFE 2303 4.55 2.30 5.83 107 FROM_EXCESS_BASE64 2268 2.37 2.27 2.43 108 USER_IN_DEF_DKIM_WL 2252 12.20 2.25 17.82 109 ANY_BOUNCE_MESSAGE 2162 3.55 2.16 4.34 110 BOUNCE_MESSAGE 2162 3.55 2.16 4.34 111 SpammyFromTLD_01 2109 1.17 2.11 0.63 112 T_XMDrugObfuBody_00 2049 1.21 2.05 0.74 113 T_TooManySym_01 2048 5.17 2.05 6.93 114 XM_B_URI_Unicode 2024 1.68 2.02 1.49 115 RCVD_IN_VALIDITY_CERTIFIED 2013 3.51 2.01 4.36 116 XM_B_SpammyWords4 1943 1.52 1.94 1.28 117 MPART_ALT_DIFF_COUNT 1898 1.16 1.90 0.74 118 LOADSA_MONEY_COMBO 1818 0.68 1.82 0.03 119 MAILING_LIST_MULTI 1815 2.08 1.82 2.23 120 XM_UCStrings02 1815 0.73 1.82 0.11 121 HTML_FONT_TINY_NORDNS 1746 0.66 1.75 0.04 122 XFER_LOTSA_MONEY 1735 0.64 1.74 0.02 123 XMStockSpam_06 1727 1.67 1.73 1.64 124 XMSubMetaI_00 1711 0.93 1.71 0.48 125 BAYES_40 1702 3.90 1.70 5.13 126 SHOPIFY_IMG_NOT_RCVD_SFY 1700 0.86 1.70 0.39 127 T_TVD_MIME_NO_HEADERS 1688 1.61 1.69 1.56 128 SpammyFromTLD_02 1688 0.76 1.69 0.23 129 TR_XM_INV_DKIM 1682 0.74 1.68 0.21 130 MILLION_HUNDRED 1664 0.60 1.66 0.00 131 ADVANCE_FEE_2_NEW_MONEY 1646 0.60 1.65 0.00 132 XM_Nigeria_01 1643 0.60 1.64 0.01 133 NA_DOLLARS 1623 0.59 1.62 0.00 134 MIME_QP_LONG_LINE 1616 2.89 1.62 3.61 135 RCVD_IN_PSBL 1610 0.75 1.61 0.26 136 LongTLD 1577 0.78 1.58 0.33 137 XM_B_COPY_HTML 1559 1.22 1.56 1.04 138 SUBJ_ALL_CAPS 1527 1.24 1.53 1.08 139 XMPhish30 1402 1.01 1.40 0.79 140 XM_HighProb1 1377 0.51 1.38 0.02 141 BAYES_20 1369 2.72 1.37 3.49 142 T_REMOTE_IMAGE 1365 2.45 1.37 3.07 143 HOSTED_IMG_MULTI_PUB_01 1323 0.50 1.32 0.03 144 XMBody_78 1319 0.65 1.32 0.27 145 T_STY_INVIS_DIRECT 1317 0.87 1.32 0.61 146 HTML_MIME_NO_HTML_TAG 1300 1.98 1.30 2.36 147 XMBrknScrpt_02 1290 1.27 1.29 1.25 148 XM_DK_Undo_01 1284 1.47 1.28 1.58 149 XMGenDplmaNmb 1280 0.78 1.28 0.49 150 XM_ProductURIs 1273 0.93 1.27 0.74 151 TR_XM_PHPDW 1259 0.70 1.26 0.38 152 NORDNS_LOW_CONTRAST 1246 0.49 1.25 0.06 153 URI_TRY_3LD 1240 0.90 1.24 0.71 154 TR_XM_FormFill2 1237 0.68 1.24 0.37 155 TR_XM_PHPForged 1236 0.68 1.24 0.36 156 THIS_AD 1231 0.76 1.23 0.50 157 URI_NOVOWEL 1223 1.68 1.22 1.94 158 XM_B_REG_HTML 1222 0.62 1.22 0.28 159 TM2_M_OBFU_COMMENT 1220 0.88 1.22 0.69 160 DKIM_ADSP_CUSTOM_MED 1219 0.93 1.22 0.76 161 XM_DIRTYINTL 1200 0.47 1.20 0.06 162 XMBdyGiftCard01 1199 1.12 1.20 1.07 163 XM_H_PHPOS 1198 0.66 1.20 0.36 164 TR_XM_Base64_M1 1146 1.07 1.15 1.02 165 TR_Mismatch_TLD_02 1133 0.47 1.13 0.10 166 XM_B_DNDMA 1132 0.76 1.13 0.56 167 RCVD_IN_PBL 1119 0.76 1.12 0.55 168 HTML_FONT_FACE_BAD 1111 0.74 1.11 0.54 169 XMReplyNow 1072 0.52 1.07 0.21 170 TR_MetaPhish_Combo_01 1061 0.74 1.06 0.57 171 NML_ADSP_CUSTOM_MED 1037 0.72 1.04 0.54 172 XM_SendGrid 1024 1.09 1.02 1.13 173 HTML_TAG_BALANCE_BODY 1012 0.93 1.01 0.89 174 FORGED_GMAIL_RCVD 1005 0.69 1.01 0.51 175 BOTNET_NORDNS 1002 0.38 1.00 0.03 176 MultiRelay_CC 985 0.40 0.99 0.07 177 XM_B_Phish66 984 0.55 0.98 0.31 178 XM_RXBody 928 0.60 0.93 0.41 179 HTTPS_HTTP_MISMATCH 927 0.59 0.93 0.40 180 J_POPCORN_WO_D 916 0.56 0.92 0.37 181 TVD_RCVD_IP 900 0.95 0.90 0.98 182 FONT_INVIS_LONG_LINE 891 0.38 0.89 0.09 183 XM_H_Long_From02 885 0.80 0.89 0.75 184 XMSlimDrugH 856 0.59 0.86 0.45 185 XMSexyCombo_01 853 0.41 0.85 0.16 186 XMPhish14 821 0.50 0.82 0.32 187 AC_HTML_NONSENSE_TAGS 820 0.34 0.82 0.07 188 XMSubMetaI_01 816 0.31 0.82 0.02 189 RELAYCOUNTRY_FR 806 0.40 0.81 0.16 190 TR_Mismatch_TLD_01 798 0.42 0.80 0.21 191 XM_B_SEO 796 0.40 0.80 0.18 192 TR_XM_Base64_L1 795 0.35 0.80 0.10 193 PLING_QUERY 779 0.57 0.78 0.45 194 XMSubMetaD_03 777 0.29 0.78 0.02 195 XM_H_PHPMailer 776 0.75 0.78 0.74 196 T_MONEY_PERCENT 775 0.39 0.78 0.17 197 TR_LOTS_OF_MONEY2 775 0.39 0.78 0.17 198 HELO_DYNAMIC_SPLIT_IP 772 0.29 0.77 0.02 199 XM_UB99 757 0.28 0.76 0.01 200 XM_PDF 752 1.79 0.75 2.38 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 149854 88.06 93.91 84.75 2 RELAYCOUNTRY_US 142894 81.93 83.89 80.82 3 DKIM_SIGNED 137296 82.31 90.56 77.65 4 XM_DK_Pass 135386 79.74 85.36 76.57 5 DKIM_VALID 134521 79.26 84.87 76.08 6 XM_B_Unicode 129226 77.50 85.31 73.09 7 DKIM_VALID_AU 114473 65.82 67.74 64.74 8 BAYES_50 110316 54.37 40.20 62.39 9 XMListUnsubscribeExists 98134 61.90 73.21 55.50 10 DCC_CHECK_NEGATIVE 91800 40.62 20.62 51.92 11 DCC_CHECK 84952 59.20 78.92 48.05 12 XM_B_SpammyWords 84034 54.77 67.59 47.53 13 XM_B_Unicode3 83034 48.66 51.66 46.96 14 RCVD_IN_MSPIKE_H2 67925 40.09 43.05 38.42 15 LOC_TINY_FONT_1 60646 39.37 48.34 34.30 16 HTML_FONT_LOW_CONTRAST 55698 33.73 37.66 31.50 17 DKIM_VALID_EF 52928 29.42 28.51 29.93 18 FVGT_m_MULTI_ODD 47369 28.52 31.59 26.79 19 XMSubLong 40074 22.30 21.66 22.66 20 T_TM2_M_HEADER_IN_MSG 40059 21.51 19.47 22.66 21 MIME_HTML_ONLY 38739 22.91 24.68 21.91 22 T_KAM_HTML_FONT_INVALID 38531 25.60 32.33 21.79 23 XM_B_SpammyWords2 37528 28.21 40.57 21.22 24 USER_IN_DEF_DKIM_WL 31516 12.20 2.25 17.82 25 XM_Multi_Part_URI 29692 18.40 21.24 16.79 26 ALL_TRUSTED 28134 11.02 2.37 15.91 27 TR_XM_DK_Unsub 27148 17.94 22.50 15.35 28 UNPARSEABLE_RELAY 24643 15.08 17.09 13.94 29 XM_Evil_Numbers_Gen 17439 9.76 9.57 9.86 30 XM_B_Unsub 17194 12.14 16.40 9.72 31 BAYES_00 16691 6.22 0.52 9.44 32 XM_DKIMWhitelistDomains 16556 6.00 0.05 9.36 33 FSL_BULK_SIG 16421 8.87 8.13 9.29 34 TR_XM_BayesUnsub 13649 10.62 15.75 7.72 35 TR_XM_DK_Bayes 13603 5.08 0.46 7.69 36 TR_XM_DK_Bayes1 13502 5.04 0.46 7.64 37 LotsOfNums_01 13028 7.46 7.62 7.37 38 BAYES_60 12547 7.63 8.58 7.10 39 T_TooManySym_01 12256 5.17 2.05 6.93 40 TR_XM_DK_Bayes2 12110 4.50 0.36 6.85 41 XM_B_SpammyWords3 11698 9.32 14.10 6.62 42 LOTS_OF_MONEY 11424 8.70 12.65 6.46 43 TR_MAX_INTL_RELAY 11123 9.62 15.52 6.29 44 TooManyTo_001 10831 4.97 2.92 6.13 45 XM_H_GMP 10684 5.70 5.10 6.04 46 XM_H_Long_From01 10546 5.67 5.15 5.96 47 XM_B_PhoneNumber 10469 5.23 4.02 5.92 48 RCVD_IN_VALIDITY_SAFE 10301 4.55 2.30 5.83 49 HTML_IMAGE_RATIO_02 9849 6.26 7.47 5.57 50 XM_DK_Undo_02 9772 18.31 40.92 5.53 51 IN_ZIMBRA_NJ_WHITELIST 9546 3.48 0.10 5.40 52 MPART_ALT_DIFF 9395 5.42 5.61 5.31 53 XMStrtUSub 9102 4.72 3.96 5.15 54 BAYES_40 9079 3.90 1.70 5.13 55 XM_UncommonTLD01 9017 5.41 5.97 5.10 56 RCVD_IN_MSPIKE_WL 8371 4.33 3.62 4.73 57 RCVD_IN_MSPIKE_H3 8371 4.33 3.62 4.73 58 TR_XM_SpammyWords4 8274 6.53 9.79 4.68 59 XM_B_Phish_Phrases 7801 5.53 7.50 4.41 60 RCVD_IN_VALIDITY_CERTIFIED 7710 3.51 2.01 4.36 61 BOUNCE_MESSAGE 7666 3.55 2.16 4.34 62 ANY_BOUNCE_MESSAGE 7666 3.55 2.16 4.34 63 HTML_IMAGE_RATIO_04 7535 4.32 4.41 4.26 64 T_TooManySym_02 7517 2.85 0.36 4.25 65 BAYES_99 7465 13.95 31.16 4.22 66 XMNumbers 6987 3.63 3.07 3.95 67 BAYES_80 6803 5.97 9.74 3.85 68 INVALID_MSGID 6605 2.58 0.53 3.74 69 MIME_QP_LONG_LINE 6388 2.89 1.62 3.61 70 TO_MALFORMED 6261 2.29 0.07 3.54 71 XMSubMetaSx_00 6256 4.80 7.03 3.54 72 BOTNET_IPINHOSTNAME 6222 6.05 10.53 3.52 73 BAYES_20 6162 2.72 1.37 3.49 74 RELAYCOUNTRY_META 5931 7.62 15.15 3.35 75 BAYES_999 5891 10.74 23.84 3.33 76 MIME_HTML_ONLY_MULTI 5729 3.24 3.23 3.24 77 T_REMOTE_IMAGE 5421 2.45 1.37 3.07 78 HTML_IMAGE_RATIO_08 4983 2.66 2.38 2.82 79 HTML_IMAGE_RATIO_06 4947 2.92 3.14 2.80 80 MIME_HTML_MOSTLY 4868 2.97 3.34 2.75 81 XM_B_SpammyTLD 4868 3.56 4.98 2.75 82 XM_CamelCaseFrm001 4665 2.86 3.26 2.64 83 XM_Body_Dirty_Words 4661 4.43 7.61 2.64 84 TR_XM_DKIM_Undo 4559 12.33 29.58 2.58 85 RCVD_IN_IADB_LISTED 4324 1.79 0.64 2.45 86 BAYES_95 4315 3.57 5.57 2.44 87 FROM_EXCESS_BASE64 4296 2.37 2.27 2.43 88 XM_PDF 4202 1.79 0.75 2.38 89 HTML_MIME_NO_HTML_TAG 4168 1.98 1.30 2.36 90 RCVD_IN_IADB_SPF 3949 1.64 0.58 2.23 91 MAILING_LIST_MULTI 3939 2.08 1.82 2.23 92 RCVD_IN_IADB_SENDERID 3620 1.51 0.56 2.05 93 TooManyTo_002 3574 1.46 0.47 2.02 94 RCVD_IN_IADB_DK 3573 1.49 0.56 2.02 95 T_XMDrugObfuBody_14 3511 2.75 4.09 1.99 96 URI_NOVOWEL 3434 1.68 1.22 1.94 97 BAYES_05 3428 1.50 0.72 1.94 98 TR_XM_SpammyRelay 3396 5.19 10.99 1.92 99 TM2_M_URI_OPT_OUT 3247 2.02 2.35 1.84 100 TR_XM_UnparsRelay 3241 4.36 8.82 1.83 101 IN_HORDE_ADDRESS_BOOK 3132 1.16 0.08 1.77 102 T_TooManySym_03 3118 1.17 0.12 1.76 103 TR_DCC_Bayes_99 3088 9.55 23.36 1.75 104 TR_XM_PhishingBody 2925 2.59 4.23 1.65 105 XMStockSpam_06 2907 1.67 1.73 1.64 106 UNTRUSTED_Relay 2848 2.81 4.94 1.61 107 XM_DK_Undo_01 2790 1.47 1.28 1.58 108 DKIM_INVALID 2775 3.06 5.69 1.57 109 T_TVD_MIME_NO_HEADERS 2766 1.61 1.69 1.56 110 TVD_SPACE_RATIO 2728 1.07 0.24 1.54 111 XMGappySubj_01 2674 1.01 0.13 1.51 112 XM_B_URI_Unicode 2626 1.68 2.02 1.49 113 RCVD_IN_IADB_VOUCHED 2510 1.00 0.25 1.42 114 XM_B_Unsub2 2461 1.80 2.51 1.39 115 TM2_M_VERY_LONG_WORD 2429 1.96 2.99 1.37 116 TR_XM_SpammyWords5 2401 2.08 3.35 1.36 117 XMDiploma_00 2367 1.81 2.65 1.34 118 XM_B_Investor 2325 2.14 3.60 1.31 119 TR_Symld_Words 2294 0.99 0.46 1.30 120 XMGappySubj_02 2258 0.82 0.02 1.28 121 XM_B_SpammyWords4 2257 1.52 1.94 1.28 122 URI_HEX 2256 1.82 2.78 1.28 123 BOTNET 2236 5.18 12.11 1.26 124 XMBrknScrpt_02 2216 1.27 1.29 1.25 125 RELAYCOUNTRY_CA 2166 3.33 7.06 1.23 126 T_XMDrugObfuBody_08 2151 1.82 2.87 1.22 127 XMSexyCombo_05 2148 2.43 4.59 1.21 128 KHOP_HELO_FCRDNS 2132 1.85 2.99 1.21 129 HTML_EXTRA_CLOSE 2083 0.76 0.01 1.18 130 XM_GoogleGroups 2051 1.00 0.71 1.16 131 XM_SendGrid 1999 1.09 1.02 1.13 132 SUBJ_ALL_CAPS 1908 1.24 1.53 1.08 133 XMBdyGiftCard01 1888 1.12 1.20 1.07 134 TooManyTo_003 1874 0.83 0.42 1.06 135 RCVD_IN_IADB_OPTIN 1839 0.72 0.15 1.04 136 XM_B_COPY_HTML 1831 1.22 1.56 1.04 137 TR_XM_Base64_M1 1809 1.07 1.15 1.02 138 XM_OfRef6 1733 1.73 3.06 0.98 139 TVD_RCVD_IP 1730 0.95 0.90 0.98 140 XM_UB50 1719 1.47 2.35 0.97 141 DATE_IN_PAST_06_12 1697 0.65 0.11 0.96 142 XM_SPF_SoftFail 1577 1.44 2.40 0.89 143 HTML_TAG_BALANCE_BODY 1565 0.93 1.01 0.89 144 TR_XM_DK_SendGrid 1496 0.80 0.71 0.85 145 T_FILL_THIS_FORM_SHORT 1494 1.42 2.43 0.84 146 FROM_GOV_DKIM_AU 1423 0.53 0.06 0.80 147 XMPhish30 1391 1.01 1.40 0.79 148 T_XMHurry_00 1355 1.57 3.00 0.77 149 HELO_MISC_IP 1353 0.52 0.08 0.77 150 DKIM_ADSP_CUSTOM_MED 1350 0.93 1.22 0.76 151 XM_H_Long_From02 1331 0.80 0.89 0.75 152 TooManyTo_004 1318 0.62 0.40 0.75 153 MPART_ALT_DIFF_COUNT 1312 1.16 1.90 0.74 154 XM_ProductURIs 1310 0.93 1.27 0.74 155 XM_H_PHPMailer 1300 0.75 0.78 0.74 156 T_XMDrugObfuBody_00 1300 1.21 2.05 0.74 157 XMBody_17 1286 2.06 4.41 0.73 158 URI_TRY_3LD 1255 0.90 1.24 0.71 159 TM2_M_OBFU_COMMENT 1222 0.88 1.22 0.69 160 XMBody_95 1189 0.49 0.16 0.67 161 RCVD_IN_BL_SPAMCOP_NET 1183 4.15 10.31 0.67 162 USER_IN_WHITELIST 1167 0.42 0.00 0.66 163 USER_IN_WELCOMELIST 1167 0.42 0.00 0.66 164 XMBSHREFv2 1159 0.49 0.21 0.66 165 XM_B_FormFill 1134 0.41 0.00 0.64 166 TooManyTo_005 1120 0.54 0.38 0.63 167 SpammyFromTLD_01 1116 1.17 2.11 0.63 168 T_STY_INVIS_DIRECT 1084 0.87 1.32 0.61 169 XMNoVowels 1078 0.60 0.60 0.61 170 DIET_1 1033 1.44 2.95 0.58 171 DATE_IN_PAST_03_06 1026 0.48 0.30 0.58 172 TR_MetaPhish_Combo_01 999 0.74 1.06 0.57 173 TR_LOTS_OF_MONEY3 996 1.54 3.27 0.56 174 XM_B_DNDMA 983 0.76 1.13 0.56 175 RCVD_IN_PBL 971 0.76 1.12 0.55 176 XM_URI_RBL 960 1.44 3.03 0.54 177 NML_ADSP_CUSTOM_MED 960 0.72 1.04 0.54 178 HTML_FONT_FACE_BAD 948 0.74 1.11 0.54 179 XMLngstWrd_00 943 0.44 0.29 0.53 180 TR_XM_SpammyWords2 931 4.61 11.83 0.53 181 FORGED_GMAIL_RCVD 909 0.69 1.01 0.51 182 T_TooManySym_04 890 0.33 0.02 0.50 183 THIS_AD 883 0.76 1.23 0.50 184 XM_WL_UtahGOV 881 0.32 0.00 0.50 185 XMGenDplmaNmb 868 0.78 1.28 0.49 186 XMSubMetaI_00 857 0.93 1.71 0.48 187 DKIM_ADSP_NXDOMAIN 832 1.23 2.57 0.47 188 XMLngstWrd_01 825 0.37 0.21 0.47 189 RELAYCOUNTRY_AU 820 1.27 2.68 0.46 190 HTML_IMAGE_ONLY_20 799 0.45 0.46 0.45 191 T_OBFU_PDF_ATTACH 789 0.35 0.18 0.45 192 XMSlimDrugH 788 0.59 0.86 0.45 193 PLING_QUERY 787 0.57 0.78 0.45 194 XM_S_SubURI 787 0.30 0.05 0.45 195 XM_ShortIntro_01 763 0.42 0.40 0.43 196 XMCapTrack 748 0.37 0.27 0.42 197 XMHTML_After_End 742 0.52 0.69 0.42 198 XMClaimOffer 737 0.48 0.58 0.42 199 NO_DNS_FOR_FROM 724 1.13 2.39 0.41 200 XM_RXBody 723 0.60 0.93 0.41 ----------------------------------------------------------------------