Email: 277100 Autolearn: 0 AvgScore: 5.31 AvgScanTime: 1.32 sec Spam: 106003 Autolearn: 0 AvgScore: 14.10 AvgScanTime: 1.36 sec Ham: 171097 Autolearn: 0 AvgScore: -0.14 AvgScanTime: 1.29 sec Time Spent Running SA: 101.60 hours Time Spent Processing Spam: 40.11 hours Time Spent Processing Ham: 61.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101888 88.45 96.12 83.70 2 DKIM_SIGNED 96201 82.61 90.75 77.57 3 XM_B_Unicode 90944 76.94 85.79 71.46 4 RELAYCOUNTRY_US 88749 82.23 83.72 81.31 5 XM_DK_Pass 87037 77.96 82.11 75.39 6 DKIM_VALID 86699 77.45 81.79 74.77 7 DCC_CHECK 86382 61.43 81.49 49.00 8 XMListUnsubscribeExists 75517 60.61 71.24 54.02 9 XM_B_SpammyWords 75261 56.64 71.00 47.75 10 DKIM_VALID_AU 65686 62.69 61.97 63.14 11 XM_B_Unicode3 56979 48.54 53.75 45.31 12 LOC_TINY_FONT_1 53555 40.10 50.52 33.65 13 RCVD_IN_MSPIKE_H2 46098 39.96 43.49 37.77 14 XM_B_SpammyWords2 44869 29.06 42.33 20.84 15 XM_DK_Undo_02 42787 19.17 40.36 6.04 16 HTML_FONT_LOW_CONTRAST 42336 34.83 39.94 31.66 17 BAYES_50 38305 52.27 36.14 62.26 18 BAYES_99 34641 15.39 32.68 4.68 19 FVGT_m_MULTI_ODD 34313 28.87 32.37 26.71 20 T_KAM_HTML_FONT_INVALID 34032 25.31 32.10 21.09 21 TR_XM_DKIM_Undo 32117 13.22 30.30 2.64 22 MIME_HTML_ONLY 30592 25.20 28.86 22.94 23 DKIM_VALID_EF 29155 28.83 27.50 29.65 24 BAYES_999 26845 11.98 25.32 3.71 25 TR_DCC_Bayes_99 26669 10.83 25.16 1.95 26 UNPARSEABLE_RELAY 22877 16.90 21.58 14.00 27 XMSubLong 22248 22.23 20.99 23.00 28 TR_XM_DK_Unsub 21823 17.03 20.59 14.83 29 XM_Multi_Part_URI 21138 17.51 19.94 16.00 30 T_TM2_M_HEADER_IN_MSG 20750 21.12 19.57 22.08 31 DCC_CHECK_NEGATIVE 19148 38.38 18.06 50.97 32 XM_B_Unsub 18626 12.94 17.57 10.07 33 TR_MAX_INTL_RELAY 18208 10.17 17.18 5.83 34 TR_XM_BayesUnsub 18140 11.21 17.11 7.55 35 XM_B_SpammyWords3 17981 10.49 16.96 6.47 36 RELAYCOUNTRY_META 16787 8.01 15.84 3.17 37 TR_XM_SpammyWords2 14356 5.51 13.54 0.54 38 TR_XM_UnparsRelay 13552 6.01 12.78 1.82 39 RCVD_IN_BL_SPAMCOP_NET 11861 4.80 11.19 0.84 40 TR_XM_SpammyRelay 11529 5.33 10.88 1.90 41 BAYES_80 11418 6.27 10.77 3.47 42 BAYES_60 11070 8.30 10.44 6.97 43 BOTNET 11037 4.68 10.41 1.13 44 LOTS_OF_MONEY 10788 7.61 10.18 6.03 45 FSL_BULK_SIG 9992 10.39 9.43 10.99 46 TR_XM_SpammyWords4 9728 6.09 9.18 4.19 47 BOTNET_IPINHOSTNAME 9671 5.69 9.12 3.56 48 DKIM_INVALID 9502 5.16 8.96 2.80 49 TR_XM_SPAMCOP 8886 3.43 8.38 0.37 50 T_SCC_BODY_TEXT_LINE 8519 8.34 8.04 8.53 51 RCVD_IN_VALIDITY_RPBL 8011 2.98 7.56 0.15 52 XM_Evil_Numbers_Gen 7875 8.71 7.43 9.50 53 XM_B_Phish_Phrases 7367 5.38 6.95 4.40 54 RELAYCOUNTRY_CA 7350 3.51 6.93 1.38 55 XMSubMetaSx_00 7022 5.05 6.62 4.07 56 HTML_IMAGE_RATIO_02 6845 5.63 6.46 5.12 57 UNTRUSTED_Relay 6538 3.28 6.17 1.49 58 XM_Body_Dirty_Words 6419 3.91 6.06 2.59 59 BAYES_95 6313 3.73 5.96 2.35 60 XM_UncommonTLD01 6260 5.33 5.91 4.98 61 XMStrtUSub 5830 5.78 5.50 5.96 62 HTML_IMAGE_RATIO_04 5502 4.33 5.19 3.79 63 MPART_ALT_DIFF 5470 5.23 5.16 5.27 64 LotsOfNums_01 5134 6.02 4.84 6.76 65 XMSexyCombo_05 4889 2.83 4.61 1.73 66 XM_B_Investor 4848 2.66 4.57 1.47 67 XM_H_GMP 4739 5.50 4.47 6.14 68 T_XMDrugObfuBody_14 4436 3.34 4.18 2.82 69 TR_XM_PhishingBody 4434 2.51 4.18 1.47 70 XM_H_Long_From01 4389 5.29 4.14 6.01 71 T_XMHurry_00 4349 2.31 4.10 1.20 72 XM_B_SpammyTLD 3750 3.23 3.54 3.04 73 XM_B_PhoneNumber 3643 5.29 3.44 6.44 74 T_REMOTE_IMAGE 3616 3.62 3.41 3.75 75 XMBody_17 3586 1.72 3.38 0.69 76 KHOP_HELO_FCRDNS 3539 2.08 3.34 1.31 77 HTML_IMAGE_RATIO_06 3502 2.96 3.30 2.74 78 TR_XM_SpammyWords5 3483 2.05 3.29 1.28 79 MIME_HTML_MOSTLY 3445 3.06 3.25 2.93 80 XMNumbers 3337 3.71 3.15 4.06 81 XM_CamelCaseFrm001 3281 3.18 3.10 3.22 82 XM_B_Unsub2 3171 1.97 2.99 1.34 83 RCVD_IN_MSPIKE_WL 3150 4.02 2.97 4.66 84 RCVD_IN_MSPIKE_H3 3150 4.02 2.97 4.66 85 DIET_1 3033 1.39 2.86 0.48 86 MIME_HTML_ONLY_MULTI 2962 2.92 2.79 3.00 87 DKIM_ADSP_NXDOMAIN 2885 1.35 2.72 0.51 88 XM_SPF_SoftFail 2804 1.59 2.65 0.94 89 RCVD_IN_PSBL 2766 1.19 2.61 0.30 90 TM2_M_VERY_LONG_WORD 2765 1.88 2.61 1.43 91 HTML_IMAGE_RATIO_08 2757 2.71 2.60 2.77 92 TooManyTo_001 2700 4.96 2.55 6.45 93 NO_DNS_FOR_FROM 2698 1.25 2.55 0.45 94 TR_XM_MaxWHORU 2688 1.18 2.54 0.34 95 XMDiploma_00 2667 1.92 2.52 1.56 96 XM_UB50 2662 1.47 2.51 0.82 97 T_XMDrugObfuBody_08 2654 1.69 2.50 1.19 98 XM_URI_RBL 2634 1.19 2.48 0.39 99 TR_XM_NoHeaderRelay 2569 1.02 2.42 0.15 100 XM_OfRef6 2568 1.43 2.42 0.82 101 TR_XM_INV_DKIM 2550 1.06 2.41 0.23 102 RCVD_IN_VALIDITY_SAFE 2545 4.40 2.40 5.64 103 RELAYCOUNTRY_AU 2413 1.06 2.28 0.30 104 TR_LOTS_OF_MONEY3 2312 1.17 2.18 0.55 105 T_XMDrugObfuBody_00 2295 1.22 2.17 0.63 106 XM_B_SpammyWords4 2204 1.27 2.08 0.77 107 SpammyFromTLD_01 2201 1.04 2.08 0.39 108 T_FILL_THIS_FORM_SHORT 2194 1.19 2.07 0.65 109 T_STY_INVIS_DIRECT 2189 1.16 2.07 0.61 110 RCVD_IN_VALIDITY_CERTIFIED 2189 3.30 2.07 4.07 111 XM_B_URI_Unicode 2175 1.79 2.05 1.62 112 SpammyFromTLD_02 2164 1.10 2.04 0.52 113 FROM_EXCESS_BASE64 2118 2.24 2.00 2.39 114 T_TooManySym_01 2068 5.53 1.95 7.74 115 XM_H_DKIM_GOOG 2062 0.79 1.95 0.08 116 XMBrknScrpt_02 1990 1.57 1.88 1.37 117 MAILING_LIST_MULTI 1966 1.88 1.85 1.90 118 TM2_M_URI_OPT_OUT 1958 2.02 1.85 2.12 119 USER_IN_DEF_DKIM_WL 1942 11.74 1.83 17.87 120 ALL_TRUSTED 1868 10.27 1.76 15.53 121 XMBdyGiftCard01 1747 1.27 1.65 1.04 122 HTML_MIME_NO_HTML_TAG 1736 1.78 1.64 1.87 123 NORDNS_LOW_CONTRAST 1660 0.64 1.57 0.07 124 TR_XM_PHPDW 1620 0.77 1.53 0.30 125 TR_XM_PHPForged 1590 0.75 1.50 0.29 126 TR_XM_FormFill2 1581 0.75 1.49 0.30 127 XM_DK_Undo_01 1572 1.50 1.48 1.51 128 XM_H_PHPOS 1543 0.73 1.46 0.28 129 MPART_ALT_DIFF_COUNT 1530 0.98 1.44 0.70 130 HTML_FONT_TINY_NORDNS 1527 0.57 1.44 0.04 131 MIME_QP_LONG_LINE 1526 2.66 1.44 3.41 132 XMStockSpam_06 1512 1.53 1.43 1.59 133 BAYES_40 1509 3.77 1.42 5.23 134 TR_MetaPhish_Combo_01 1509 0.87 1.42 0.52 135 PLING_QUERY 1476 0.91 1.39 0.61 136 SUBJ_ALL_CAPS 1469 1.18 1.39 1.05 137 URI_TRY_3LD 1447 0.98 1.37 0.74 138 URI_HEX 1424 1.11 1.34 0.96 139 XM_B_COPY_HTML 1422 1.13 1.34 0.99 140 XMBody_78 1407 0.70 1.33 0.31 141 XMPhish30 1396 0.93 1.32 0.68 142 XMSubMetaI_00 1386 0.96 1.31 0.75 143 TR_Mismatch_TLD_02 1322 0.52 1.25 0.07 144 UNICODE_OBFU_ASC 1320 0.48 1.25 0.01 145 SHOPIFY_IMG_NOT_RCVD_SFY 1291 0.70 1.22 0.38 146 URI_NOVOWEL 1285 1.51 1.21 1.69 147 THIS_AD 1281 0.78 1.21 0.52 148 BOTNET_NORDNS 1281 0.47 1.21 0.01 149 SUSP_UTF8_WORD_SUBJ 1276 0.47 1.20 0.01 150 XM_H_Long_From02 1269 1.01 1.20 0.90 151 XM_B_Phish66 1263 0.63 1.19 0.29 152 RDNS_DYNAMIC 1247 0.59 1.18 0.22 153 XM_UB99 1237 0.45 1.17 0.01 154 BAYES_20 1156 2.57 1.09 3.49 155 AC_HTML_NONSENSE_TAGS 1143 0.48 1.08 0.11 156 XM_SendGrid 1143 1.07 1.08 1.06 157 MultiRelay_CC 1130 0.44 1.07 0.05 158 LongTLD 1130 0.63 1.07 0.36 159 RCVD_IN_PBL 1122 0.69 1.06 0.46 160 PDS_RDNS_DYNAMIC_FP 1121 0.42 1.06 0.03 161 XM_B_DNDMA 1100 0.83 1.04 0.70 162 XMSlimDrugH 1089 0.78 1.03 0.62 163 HTML_TAG_BALANCE_BODY 1080 1.07 1.02 1.10 164 XM_HighProb1 1057 0.39 1.00 0.01 165 HTTPS_HTTP_MISMATCH 1041 0.72 0.98 0.56 166 TM2_M_OBFU_COMMENT 1029 0.72 0.97 0.57 167 XM_B_REG_HTML 1021 0.56 0.96 0.30 168 TR_XM_RelayPhish 1013 0.42 0.96 0.09 169 T_MONEY_PERCENT 998 0.46 0.94 0.17 170 TR_LOTS_OF_MONEY2 998 0.46 0.94 0.17 171 SUBJ_DOLLARS 988 0.58 0.93 0.37 172 XMReplyNow 983 0.48 0.93 0.21 173 XM_DIRTYINTL 972 0.39 0.92 0.07 174 XM_ProductURIs 958 0.64 0.90 0.47 175 MISSING_HEADERS 936 0.48 0.88 0.23 176 FUZZY_UNSUBSCRIBE 933 0.34 0.88 0.00 177 FUZZY_PRIVACY 932 0.34 0.88 0.00 178 LONG_INVISIBLE_TEXT 931 0.40 0.88 0.11 179 XMGenDplmaNmb 927 0.72 0.87 0.62 180 HTML_FONT_FACE_BAD 927 0.64 0.87 0.50 181 RELAYCOUNTRY_RU 921 0.35 0.87 0.03 182 TR_Symld_Words 921 1.22 0.87 1.44 183 DKIM_ADSP_CUSTOM_MED 903 0.77 0.85 0.72 184 XM_UB999 899 0.33 0.85 0.00 185 XM_UB60 896 0.35 0.85 0.04 186 TVD_RCVD_IP 894 1.02 0.84 1.12 187 XMSexyCombo_01 858 0.40 0.81 0.15 188 TR_XM_InvalidRelay 844 0.31 0.80 0.01 189 XM_H_PHPMailer 839 0.88 0.79 0.94 190 XM_Combo_Sbj 832 0.46 0.78 0.26 191 TR_XM_DK_SendGrid 814 0.75 0.77 0.74 192 RELAYCOUNTRY_FR 814 0.41 0.77 0.18 193 XM_RXBody 809 0.48 0.76 0.31 194 REPLYTO_WITHOUT_TO_CC 806 0.30 0.76 0.02 195 FORGED_GMAIL_RCVD 796 0.58 0.75 0.47 196 NML_ADSP_CUSTOM_MED 786 0.57 0.74 0.47 197 XMPhish11 785 0.33 0.74 0.08 198 XMSubMetaSSx_00 779 0.38 0.73 0.16 199 J_POPCORN_WO_D 770 0.43 0.73 0.25 200 TR_Mismatch_TLD_01 766 0.46 0.72 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 143210 88.45 96.12 83.70 2 RELAYCOUNTRY_US 139117 82.23 83.72 81.31 3 DKIM_SIGNED 132720 82.61 90.75 77.57 4 XM_DK_Pass 128987 77.96 82.11 75.39 5 DKIM_VALID 127924 77.45 81.79 74.77 6 XM_B_Unicode 122270 76.94 85.79 71.46 7 DKIM_VALID_AU 108037 62.69 61.97 63.14 8 BAYES_50 106528 52.27 36.14 62.26 9 XMListUnsubscribeExists 92427 60.61 71.24 54.02 10 DCC_CHECK_NEGATIVE 87200 38.38 18.06 50.97 11 DCC_CHECK 83837 61.43 81.49 49.00 12 XM_B_SpammyWords 81701 56.64 71.00 47.75 13 XM_B_Unicode3 77526 48.54 53.75 45.31 14 RCVD_IN_MSPIKE_H2 64622 39.96 43.49 37.77 15 LOC_TINY_FONT_1 57573 40.10 50.52 33.65 16 HTML_FONT_LOW_CONTRAST 54166 34.83 39.94 31.66 17 DKIM_VALID_EF 50729 28.83 27.50 29.65 18 FVGT_m_MULTI_ODD 45694 28.87 32.37 26.71 19 XMSubLong 39353 22.23 20.99 23.00 20 MIME_HTML_ONLY 39250 25.20 28.86 22.94 21 T_TM2_M_HEADER_IN_MSG 37780 21.12 19.57 22.08 22 T_KAM_HTML_FONT_INVALID 36089 25.31 32.10 21.09 23 XM_B_SpammyWords2 35662 29.06 42.33 20.84 24 USER_IN_DEF_DKIM_WL 30580 11.74 1.83 17.87 25 XM_Multi_Part_URI 27377 17.51 19.94 16.00 26 ALL_TRUSTED 26579 10.27 1.76 15.53 27 TR_XM_DK_Unsub 25368 17.03 20.59 14.83 28 UNPARSEABLE_RELAY 23947 16.90 21.58 14.00 29 FSL_BULK_SIG 18797 10.39 9.43 10.99 30 XM_B_Unsub 17228 12.94 17.57 10.07 31 BAYES_00 16288 6.09 0.56 9.52 32 XM_Evil_Numbers_Gen 16247 8.71 7.43 9.50 33 XM_DKIMWhitelistDomains 15513 5.70 0.27 9.07 34 T_SCC_BODY_TEXT_LINE 14589 8.34 8.04 8.53 35 T_TooManySym_01 13242 5.53 1.95 7.74 36 TR_XM_BayesUnsub 12912 11.21 17.11 7.55 37 TR_XM_DK_Bayes 12277 4.61 0.48 7.18 38 TR_XM_DK_Bayes1 12184 4.58 0.47 7.12 39 BAYES_60 11924 8.30 10.44 6.97 40 LotsOfNums_01 11558 6.02 4.84 6.76 41 XM_B_SpammyWords3 11077 10.49 16.96 6.47 42 TooManyTo_001 11031 4.96 2.55 6.45 43 XM_B_PhoneNumber 11026 5.29 3.44 6.44 44 TR_XM_DK_Bayes2 10766 4.04 0.39 6.29 45 XM_H_GMP 10503 5.50 4.47 6.14 46 XM_DK_Undo_02 10332 19.17 40.36 6.04 47 LOTS_OF_MONEY 10312 7.61 10.18 6.03 48 XM_H_Long_From01 10275 5.29 4.14 6.01 49 XMStrtUSub 10194 5.78 5.50 5.96 50 IN_ZIMBRA_NJ_WHITELIST 10140 3.70 0.10 5.93 51 TR_MAX_INTL_RELAY 9968 10.17 17.18 5.83 52 RCVD_IN_VALIDITY_SAFE 9658 4.40 2.40 5.64 53 MPART_ALT_DIFF 9013 5.23 5.16 5.27 54 BAYES_40 8949 3.77 1.42 5.23 55 HTML_IMAGE_RATIO_02 8754 5.63 6.46 5.12 56 XM_UncommonTLD01 8513 5.33 5.91 4.98 57 BAYES_99 8014 15.39 32.68 4.68 58 RCVD_IN_MSPIKE_H3 7981 4.02 2.97 4.66 59 RCVD_IN_MSPIKE_WL 7981 4.02 2.97 4.66 60 XM_B_Phish_Phrases 7535 5.38 6.95 4.40 61 T_TooManySym_02 7399 2.83 0.41 4.32 62 TR_XM_SpammyWords4 7161 6.09 9.18 4.19 63 XMSubMetaSx_00 6970 5.05 6.62 4.07 64 BOUNCE_MESSAGE 6968 2.77 0.66 4.07 65 ANY_BOUNCE_MESSAGE 6968 2.77 0.66 4.07 66 RCVD_IN_VALIDITY_CERTIFIED 6965 3.30 2.07 4.07 67 XMNumbers 6955 3.71 3.15 4.06 68 INVALID_MSGID 6805 2.65 0.51 3.98 69 HTML_IMAGE_RATIO_04 6492 4.33 5.19 3.79 70 T_REMOTE_IMAGE 6411 3.62 3.41 3.75 71 BAYES_999 6346 11.98 25.32 3.71 72 TO_MALFORMED 6265 2.27 0.01 3.66 73 BOTNET_IPINHOSTNAME 6092 5.69 9.12 3.56 74 BAYES_20 5971 2.57 1.09 3.49 75 BAYES_80 5945 6.27 10.77 3.47 76 MIME_QP_LONG_LINE 5834 2.66 1.44 3.41 77 XM_CamelCaseFrm001 5517 3.18 3.10 3.22 78 RELAYCOUNTRY_META 5417 8.01 15.84 3.17 79 XM_B_SpammyTLD 5198 3.23 3.54 3.04 80 MIME_HTML_ONLY_MULTI 5130 2.92 2.79 3.00 81 MIME_HTML_MOSTLY 5021 3.06 3.25 2.93 82 T_XMDrugObfuBody_14 4823 3.34 4.18 2.82 83 DKIM_INVALID 4796 5.16 8.96 2.80 84 HTML_IMAGE_RATIO_08 4744 2.71 2.60 2.77 85 HTML_IMAGE_RATIO_06 4696 2.96 3.30 2.74 86 XM_PDF 4552 1.92 0.72 2.66 87 TR_XM_DKIM_Undo 4518 13.22 30.30 2.64 88 XM_Body_Dirty_Words 4428 3.91 6.06 2.59 89 FROM_EXCESS_BASE64 4086 2.24 2.00 2.39 90 BAYES_95 4019 3.73 5.96 2.35 91 RCVD_IN_IADB_LISTED 3938 1.61 0.50 2.30 92 TooManyTo_002 3868 1.53 0.35 2.26 93 TM2_M_URI_OPT_OUT 3627 2.02 1.85 2.12 94 RCVD_IN_IADB_SPF 3549 1.46 0.47 2.07 95 BAYES_05 3458 1.45 0.52 2.02 96 TR_DCC_Bayes_99 3343 10.83 25.16 1.95 97 MAILING_LIST_MULTI 3249 1.88 1.85 1.90 98 TR_XM_SpammyRelay 3247 5.33 10.88 1.90 99 RCVD_IN_IADB_SENDERID 3220 1.34 0.46 1.88 100 HTML_MIME_NO_HTML_TAG 3192 1.78 1.64 1.87 101 RCVD_IN_IADB_DK 3187 1.33 0.46 1.86 102 T_TooManySym_03 3151 1.19 0.15 1.84 103 XMGappySubj_01 3137 1.19 0.16 1.83 104 TR_XM_UnparsRelay 3110 6.01 12.78 1.82 105 IN_HORDE_ADDRESS_BOOK 3089 1.16 0.11 1.81 106 XMSexyCombo_05 2956 2.83 4.61 1.73 107 URI_NOVOWEL 2892 1.51 1.21 1.69 108 XM_B_URI_Unicode 2778 1.79 2.05 1.62 109 TVD_SPACE_RATIO 2757 1.07 0.20 1.61 110 XMStockSpam_06 2721 1.53 1.43 1.59 111 XMDiploma_00 2665 1.92 2.52 1.56 112 XM_DK_Undo_01 2582 1.50 1.48 1.51 113 RCVD_IN_IADB_VOUCHED 2581 1.01 0.21 1.51 114 UNTRUSTED_Relay 2554 3.28 6.17 1.49 115 XM_B_Investor 2523 2.66 4.57 1.47 116 TR_XM_PhishingBody 2519 2.51 4.18 1.47 117 TR_Symld_Words 2466 1.22 0.87 1.44 118 TM2_M_VERY_LONG_WORD 2447 1.88 2.61 1.43 119 RELAYCOUNTRY_CA 2363 3.51 6.93 1.38 120 XMBrknScrpt_02 2352 1.57 1.88 1.37 121 XM_B_Unsub2 2297 1.97 2.99 1.34 122 KHOP_HELO_FCRDNS 2238 2.08 3.34 1.31 123 TR_XM_SpammyWords5 2194 2.05 3.29 1.28 124 XMGappySubj_02 2136 0.79 0.04 1.25 125 T_TVD_MIME_NO_HEADERS 2072 0.77 0.06 1.21 126 T_XMHurry_00 2046 2.31 4.10 1.20 127 T_XMDrugObfuBody_08 2034 1.69 2.50 1.19 128 BOTNET 1933 4.68 10.41 1.13 129 TVD_RCVD_IP 1920 1.02 0.84 1.12 130 XM_GoogleGroups 1911 0.91 0.57 1.12 131 HTML_TAG_BALANCE_BODY 1890 1.07 1.02 1.10 132 HTML_EXTRA_CLOSE 1889 0.70 0.03 1.10 133 XM_SendGrid 1812 1.07 1.08 1.06 134 RCVD_IN_IADB_OPTIN 1810 0.71 0.16 1.06 135 SUBJ_ALL_CAPS 1791 1.18 1.39 1.05 136 XMBdyGiftCard01 1771 1.27 1.65 1.04 137 LOW_PRICE 1762 0.71 0.19 1.03 138 XM_B_COPY_HTML 1697 1.13 1.34 0.99 139 TooManyTo_003 1664 0.72 0.31 0.97 140 URI_HEX 1649 1.11 1.34 0.96 141 XM_SPF_SoftFail 1613 1.59 2.65 0.94 142 XM_H_PHPMailer 1613 0.88 0.79 0.94 143 XM_H_Long_From02 1536 1.01 1.20 0.90 144 XM_B_FormFill 1512 0.55 0.02 0.88 145 XMLngstWrd_00 1505 0.67 0.34 0.88 146 RCVD_IN_BL_SPAMCOP_NET 1443 4.80 11.19 0.84 147 XM_UB50 1404 1.47 2.51 0.82 148 XM_OfRef6 1403 1.43 2.42 0.82 149 FROM_GOV_DKIM_AU 1369 0.53 0.09 0.80 150 HELO_MISC_IP 1337 0.52 0.09 0.78 151 XM_B_SpammyWords4 1318 1.27 2.08 0.77 152 XMBSHREFv2 1307 0.56 0.24 0.76 153 XMSubMetaI_00 1286 0.96 1.31 0.75 154 TR_XM_DK_SendGrid 1274 0.75 0.77 0.74 155 URI_TRY_3LD 1273 0.98 1.37 0.74 156 DKIM_ADSP_CUSTOM_MED 1232 0.77 0.85 0.72 157 XM_B_DNDMA 1204 0.83 1.04 0.70 158 TooManyTo_004 1203 0.55 0.29 0.70 159 USER_IN_WELCOMELIST 1202 0.43 0.00 0.70 160 USER_IN_WHITELIST 1202 0.43 0.00 0.70 161 MPART_ALT_DIFF_COUNT 1199 0.98 1.44 0.70 162 TR_XM_Base64_M1 1188 0.67 0.62 0.69 163 XMBody_17 1178 1.72 3.38 0.69 164 XMPhish30 1171 0.93 1.32 0.68 165 XMBody_95 1122 0.45 0.11 0.66 166 T_FILL_THIS_FORM_SHORT 1110 1.19 2.07 0.65 167 T_XMDrugObfuBody_00 1075 1.22 2.17 0.63 168 XMGenDplmaNmb 1060 0.72 0.87 0.62 169 XMSlimDrugH 1059 0.78 1.03 0.62 170 TooManyTo_005 1052 0.49 0.28 0.61 171 PLING_QUERY 1039 0.91 1.39 0.61 172 T_STY_INVIS_DIRECT 1038 1.16 2.07 0.61 173 XMNoVowels 1008 0.61 0.66 0.59 174 TM2_M_OBFU_COMMENT 974 0.72 0.97 0.57 175 HTTPS_HTTP_MISMATCH 965 0.72 0.98 0.56 176 TR_LOTS_OF_MONEY3 934 1.17 2.18 0.55 177 TR_XM_SpammyWords2 926 5.51 13.54 0.54 178 T_TooManySym_04 893 0.33 0.03 0.52 179 TR_MetaPhish_Combo_01 892 0.87 1.42 0.52 180 SpammyFromTLD_02 892 1.10 2.04 0.52 181 THIS_AD 891 0.78 1.21 0.52 182 T_OBFU_PDF_ATTACH 883 0.34 0.04 0.52 183 DKIM_ADSP_NXDOMAIN 866 1.35 2.72 0.51 184 HTML_FONT_FACE_BAD 859 0.64 0.87 0.50 185 DIET_1 822 1.39 2.86 0.48 186 FORGED_GMAIL_RCVD 812 0.58 0.75 0.47 187 XM_ProductURIs 806 0.64 0.90 0.47 188 NML_ADSP_CUSTOM_MED 796 0.57 0.74 0.47 189 RCVD_IN_PBL 790 0.69 1.06 0.46 190 NO_DNS_FOR_FROM 766 1.25 2.55 0.45 191 XM_S_SubURI 759 0.30 0.06 0.44 192 XMSubMetaSxObfu_02 718 0.43 0.45 0.42 193 TR_XM_SB_Phish 677 0.31 0.17 0.40 194 XM_ShortIntro_01 675 0.39 0.37 0.39 195 SpammyFromTLD_01 667 1.04 2.08 0.39 196 XM_URI_RBL 660 1.19 2.48 0.39 197 SHOPIFY_IMG_NOT_RCVD_SFY 656 0.70 1.22 0.38 198 XMHTML_After_End 654 0.51 0.72 0.38 199 XMSubPhish11 648 0.29 0.15 0.38 200 XMLngstWrd_01 636 0.32 0.23 0.37 ----------------------------------------------------------------------