Email: 260267 Autolearn: 0 AvgScore: 4.71 AvgScanTime: 1.36 sec Spam: 91277 Autolearn: 0 AvgScore: 13.72 AvgScanTime: 1.52 sec Ham: 168990 Autolearn: 0 AvgScore: -0.15 AvgScanTime: 1.28 sec Time Spent Running SA: 98.58 hours Time Spent Processing Spam: 38.58 hours Time Spent Processing Ham: 60.00 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87363 88.08 95.71 83.96 2 DKIM_SIGNED 82789 82.30 90.70 77.76 3 XM_DK_Pass 79238 80.16 86.81 76.57 4 DKIM_VALID 78742 79.60 86.27 76.00 5 XM_B_Unicode 78246 77.22 85.72 72.63 6 RELAYCOUNTRY_US 76446 82.10 83.75 81.21 7 DCC_CHECK 72561 60.06 79.50 49.57 8 XMListUnsubscribeExists 65253 60.57 71.49 54.67 9 XM_B_SpammyWords 63965 55.04 70.08 46.92 10 DKIM_VALID_AU 63507 66.46 69.58 64.77 11 XM_B_Unicode3 48247 49.56 52.86 47.78 12 LOC_TINY_FONT_1 44043 39.73 48.25 35.13 13 RCVD_IN_MSPIKE_H2 41539 40.66 45.51 38.05 14 XM_DK_Undo_02 39376 18.48 43.14 5.16 15 XM_B_SpammyWords2 36766 27.62 40.28 20.78 16 HTML_FONT_LOW_CONTRAST 33523 33.34 36.73 31.52 17 BAYES_50 33210 52.87 36.38 61.78 18 BAYES_99 32225 14.96 35.30 3.98 19 FVGT_m_MULTI_ODD 29562 28.60 32.39 26.56 20 TR_XM_DKIM_Undo 28882 12.67 31.64 2.42 21 T_KAM_HTML_FONT_INVALID 27966 24.98 30.64 21.93 22 DKIM_VALID_EF 27083 29.91 29.67 30.04 23 BAYES_999 25825 11.92 28.29 3.08 24 MIME_HTML_ONLY 25360 24.53 27.78 22.77 25 TR_DCC_Bayes_99 23759 10.18 26.03 1.62 26 TR_XM_DK_Unsub 20924 17.98 22.92 15.32 27 XMSubLong 19369 23.54 21.22 24.79 28 XM_Multi_Part_URI 19351 17.91 21.20 16.13 29 T_TM2_M_HEADER_IN_MSG 18733 22.97 20.52 24.30 30 DCC_CHECK_NEGATIVE 18340 39.77 20.09 50.40 31 UNPARSEABLE_RELAY 18181 15.47 19.92 13.07 32 XM_B_Unsub 15883 12.54 17.40 9.92 33 TR_XM_BayesUnsub 15359 10.59 16.83 7.22 34 RELAYCOUNTRY_META 14372 7.74 15.75 3.42 35 TR_MAX_INTL_RELAY 14247 9.31 15.61 5.91 36 XM_B_SpammyWords3 13850 9.38 15.17 6.24 37 TR_XM_SpammyWords2 12076 5.05 13.23 0.63 38 TR_XM_SpammyRelay 10577 5.29 11.59 1.88 39 TR_XM_UnparsRelay 10163 5.02 11.13 1.72 40 LOTS_OF_MONEY 9952 8.50 10.90 7.21 41 RCVD_IN_BL_SPAMCOP_NET 9494 4.03 10.40 0.58 42 FSL_BULK_SIG 9025 10.20 9.89 10.36 43 BOTNET_IPINHOSTNAME 9023 5.83 9.89 3.64 44 TR_XM_SpammyWords4 8964 7.10 9.82 5.62 45 BAYES_80 8900 5.73 9.75 3.56 46 BAYES_60 8137 8.20 8.91 7.82 47 XM_Body_Dirty_Words 7965 4.71 8.73 2.55 48 XM_Evil_Numbers_Gen 7659 9.59 8.39 10.24 49 BOTNET 7492 3.68 8.21 1.23 50 TR_XM_SPAMCOP 7457 3.03 8.17 0.25 51 HTML_IMAGE_RATIO_02 7144 6.28 7.83 5.44 52 T_SCC_BODY_TEXT_LINE 7140 8.29 7.82 8.55 53 XMSubMetaSx_00 6942 5.64 7.61 4.58 54 XM_B_Phish_Phrases 6698 5.92 7.34 5.15 55 RELAYCOUNTRY_CA 6242 3.29 6.84 1.38 56 XM_H_GMP 5837 6.43 6.39 6.44 57 MPART_ALT_DIFF 5513 5.38 6.04 5.02 58 XM_H_Long_From01 5467 5.62 5.99 5.42 59 XM_UncommonTLD01 5354 5.23 5.87 4.88 60 LotsOfNums_01 5207 6.42 5.70 6.80 61 BAYES_95 5021 3.45 5.50 2.34 62 UNTRUSTED_Relay 4938 2.89 5.41 1.52 63 HTML_IMAGE_RATIO_04 4805 5.26 5.26 5.26 64 XMSexyCombo_05 4673 3.38 5.12 2.45 65 XMStrtUSub 4671 5.76 5.12 6.11 66 TR_XM_PhishingBody 4553 2.91 4.99 1.78 67 XM_CamelCaseFrm001 4355 3.18 4.77 2.31 68 T_XMDrugObfuBody_14 4189 3.10 4.59 2.30 69 XM_B_PhoneNumber 4083 5.57 4.47 6.17 70 XM_B_SpammyTLD 4048 3.53 4.43 3.04 71 DKIM_INVALID 4047 2.70 4.43 1.76 72 XM_B_Investor 3968 2.39 4.35 1.34 73 TooManyTo_001 3713 5.84 4.07 6.80 74 TR_XM_SpammyWords5 3601 2.23 3.95 1.30 75 T_XMDrugObfuBody_08 3349 2.96 3.67 2.58 76 XMNumbers 3326 3.76 3.64 3.82 77 MIME_HTML_MOSTLY 3186 2.93 3.49 2.63 78 MIME_HTML_ONLY_MULTI 3074 3.12 3.37 2.99 79 RCVD_IN_MSPIKE_H3 2993 4.50 3.28 5.16 80 RCVD_IN_MSPIKE_WL 2993 4.50 3.28 5.17 81 XM_OfRef6 2983 1.79 3.27 0.99 82 T_REMOTE_IMAGE 2884 3.32 3.16 3.41 83 TM2_M_VERY_LONG_WORD 2749 2.00 3.01 1.45 84 XM_B_Unsub2 2728 1.91 2.99 1.33 85 RCVD_IN_VALIDITY_SAFE 2657 4.68 2.91 5.64 86 RELAYCOUNTRY_AU 2452 1.23 2.69 0.45 87 TR_XM_NoHeaderRelay 2450 1.08 2.68 0.22 88 T_XMHurry_00 2439 1.46 2.67 0.81 89 T_FILL_THIS_FORM_SHORT 2408 1.40 2.64 0.73 90 XM_B_SpammyWords4 2403 1.53 2.63 0.93 91 XMDiploma_00 2354 1.95 2.58 1.61 92 FROM_EXCESS_BASE64 2350 2.32 2.57 2.18 93 HTML_IMAGE_RATIO_06 2337 2.47 2.56 2.42 94 KHOP_HELO_FCRDNS 2333 1.63 2.56 1.12 95 T_XMDrugObfuBody_00 2330 1.55 2.55 1.00 96 RCVD_IN_VALIDITY_RPBL 2243 0.90 2.46 0.06 97 XMBody_17 2233 1.39 2.45 0.82 98 XM_SPF_SoftFail 2230 1.50 2.44 0.99 99 HTML_IMAGE_RATIO_08 2177 2.07 2.39 1.90 100 XMBrknScrpt_02 2161 1.49 2.37 1.02 101 RCVD_IN_PSBL 2156 1.14 2.36 0.47 102 USER_IN_DEF_DKIM_WL 2137 13.58 2.34 19.65 103 XM_B_URI_Unicode 2120 1.81 2.32 1.53 104 XM_URI_RBL 2103 1.10 2.30 0.45 105 XM_UB50 1992 1.32 2.18 0.86 106 TM2_M_URI_OPT_OUT 1909 2.07 2.09 2.06 107 MAILING_LIST_MULTI 1878 2.22 2.06 2.31 108 T_TooManySym_01 1859 6.40 2.04 8.75 109 SpammyFromTLD_01 1857 0.95 2.03 0.36 110 ALL_TRUSTED 1835 10.77 2.01 15.50 111 RCVD_IN_VALIDITY_CERTIFIED 1835 3.68 2.01 4.58 112 XM_DK_Undo_01 1713 1.69 1.88 1.59 113 SUBJ_ALL_CAPS 1711 1.32 1.87 1.02 114 XMStockSpam_06 1702 2.36 1.86 2.63 115 TR_XM_INV_DKIM 1699 0.78 1.86 0.20 116 SpammyFromTLD_02 1620 0.78 1.77 0.24 117 MPART_ALT_DIFF_COUNT 1493 1.06 1.64 0.75 118 MIME_QP_LONG_LINE 1464 2.53 1.60 3.02 119 XM_B_COPY_HTML 1440 1.47 1.58 1.41 120 T_STY_INVIS_DIRECT 1440 1.01 1.58 0.70 121 TR_LOTS_OF_MONEY3 1426 0.98 1.56 0.66 122 XM_H_Long_From02 1423 1.02 1.56 0.73 123 XM_B_Phish66 1416 0.87 1.55 0.51 124 HTML_MIME_NO_HTML_TAG 1410 1.52 1.54 1.51 125 XMPhish30 1396 1.01 1.53 0.73 126 HTML_FONT_TINY_NORDNS 1385 0.57 1.52 0.05 127 URI_NOVOWEL 1385 1.64 1.52 1.70 128 HTML_TAG_BALANCE_BODY 1384 1.05 1.52 0.80 129 ANY_BOUNCE_MESSAGE 1355 3.20 1.48 4.13 130 BOUNCE_MESSAGE 1355 3.20 1.48 4.13 131 SHOPIFY_IMG_NOT_RCVD_SFY 1352 0.76 1.48 0.38 132 BAYES_40 1342 3.87 1.47 5.17 133 DIET_1 1341 0.93 1.47 0.65 134 TR_MetaPhish_Combo_01 1314 1.10 1.44 0.91 135 XM_SendGrid 1297 1.35 1.42 1.31 136 XM_DIRTYINTL 1293 0.55 1.42 0.09 137 TM2_M_OBFU_COMMENT 1280 0.88 1.40 0.60 138 XMBdyGiftCard01 1269 1.05 1.39 0.87 139 URI_HEX 1235 1.19 1.35 1.10 140 TR_XM_PHPDW 1197 0.70 1.31 0.37 141 TR_XM_PHPForged 1183 0.69 1.30 0.36 142 DKIM_ADSP_CUSTOM_MED 1173 0.94 1.29 0.75 143 URI_TRY_3LD 1170 0.91 1.28 0.70 144 TR_XM_FormFill2 1161 0.68 1.27 0.36 145 XMGenDplmaNmb 1153 0.85 1.26 0.63 146 XM_H_PHPOS 1145 0.67 1.25 0.35 147 BAYES_20 1103 2.68 1.21 3.48 148 XM_B_REG_HTML 1079 0.60 1.18 0.28 149 HTTPS_HTTP_MISMATCH 1075 0.69 1.18 0.42 150 XM_B_DNDMA 1053 0.70 1.15 0.45 151 J_POPCORN_WO_D 1040 0.67 1.14 0.41 152 LongTLD 1027 0.56 1.13 0.25 153 XM_UB99 1008 0.39 1.10 0.01 154 NML_ADSP_CUSTOM_MED 999 0.68 1.09 0.46 155 TM2_M_A_HREF_HREF 959 0.48 1.05 0.17 156 RCVD_IN_PBL 956 0.71 1.05 0.52 157 XMSexyCombo_01 951 0.46 1.04 0.14 158 XMReplyNow 924 0.45 1.01 0.15 159 FORGED_GMAIL_RCVD 913 0.63 1.00 0.43 160 HTML_IMAGE_ONLY_20 912 0.65 1.00 0.46 161 XM_HighProb1 876 0.34 0.96 0.01 162 T_MONEY_PERCENT 868 0.44 0.95 0.17 163 TR_LOTS_OF_MONEY2 868 0.44 0.95 0.17 164 BOTNET_NORDNS 867 0.34 0.95 0.02 165 XM_ProductURIs 852 0.63 0.93 0.47 166 TR_Mismatch_TLD_02 849 0.36 0.93 0.06 167 XMSubMetaI_00 848 0.69 0.93 0.56 168 TR_XM_RelayPhish 844 0.38 0.92 0.09 169 RDNS_DYNAMIC 841 0.50 0.92 0.27 170 MultiRelay_CC 837 0.37 0.92 0.08 171 LONGWORDS 824 0.32 0.90 0.00 172 TVD_RCVD_IP 822 1.11 0.90 1.22 173 TR_XM_FormFill 798 0.31 0.87 0.01 174 XM_Combo_Sbj 789 0.49 0.86 0.29 175 PLING_QUERY 781 0.65 0.86 0.53 176 FORGED_HOTMAIL_RCVD2 775 0.31 0.85 0.02 177 THIS_AD 772 0.56 0.85 0.41 178 XM_S_SpammyWords 770 0.35 0.84 0.09 179 TR_XM_Spammywords 770 0.35 0.84 0.09 180 HTML_FONT_FACE_BAD 763 0.61 0.84 0.49 181 PDS_RDNS_DYNAMIC_FP 758 0.34 0.83 0.08 182 XMSubMetaSxObfu_03 752 1.10 0.82 1.25 183 TR_Symld_Words 748 1.74 0.82 2.24 184 TR_Mismatch_TLD_01 747 0.44 0.82 0.24 185 XM_B_SEO 745 0.45 0.82 0.25 186 T_TooManySym_02 738 3.33 0.81 4.69 187 HELO_DYNAMIC_SPLIT_IP 730 0.29 0.80 0.01 188 RELAYCOUNTRY_FR 718 0.39 0.79 0.18 189 XM_GoogleGroups 697 1.10 0.76 1.28 190 XMHTMLBadTable_001 695 0.44 0.76 0.27 191 TR_XM_InvalidRelay 695 0.27 0.76 0.01 192 XM_UB999 688 0.27 0.75 0.00 193 DEAR_FRIEND 671 0.29 0.74 0.05 194 XMSubMetaSSx_00 670 0.38 0.73 0.19 195 XM_B_COVIDMETA 667 0.32 0.73 0.10 196 XM_UB60 657 0.28 0.72 0.05 197 XM_H_PHPMailer 656 0.79 0.72 0.82 198 TooManyTo_002 648 1.83 0.71 2.44 199 TR_XM_Base64_M1 645 0.90 0.71 1.00 200 XMPhish11 638 0.29 0.70 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 141881 88.08 95.71 83.96 2 RELAYCOUNTRY_US 137234 82.10 83.75 81.21 3 DKIM_SIGNED 131409 82.30 90.70 77.76 4 XM_DK_Pass 129390 80.16 86.81 76.57 5 DKIM_VALID 128440 79.60 86.27 76.00 6 XM_B_Unicode 122730 77.22 85.72 72.63 7 DKIM_VALID_AU 109460 66.46 69.58 64.77 8 BAYES_50 104399 52.87 36.38 61.78 9 XMListUnsubscribeExists 92388 60.57 71.49 54.67 10 DCC_CHECK_NEGATIVE 85176 39.77 20.09 50.40 11 DCC_CHECK 83764 60.06 79.50 49.57 12 XM_B_Unicode3 80737 49.56 52.86 47.78 13 XM_B_SpammyWords 79296 55.04 70.08 46.92 14 RCVD_IN_MSPIKE_H2 64297 40.66 45.51 38.05 15 LOC_TINY_FONT_1 59372 39.73 48.25 35.13 16 HTML_FONT_LOW_CONTRAST 53263 33.34 36.73 31.52 17 DKIM_VALID_EF 50758 29.91 29.67 30.04 18 FVGT_m_MULTI_ODD 44884 28.60 32.39 26.56 19 XMSubLong 41886 23.54 21.22 24.79 20 T_TM2_M_HEADER_IN_MSG 41060 22.97 20.52 24.30 21 MIME_HTML_ONLY 38477 24.53 27.78 22.77 22 T_KAM_HTML_FONT_INVALID 37052 24.98 30.64 21.93 23 XM_B_SpammyWords2 35108 27.62 40.28 20.78 24 USER_IN_DEF_DKIM_WL 33205 13.58 2.34 19.65 25 XM_Multi_Part_URI 27259 17.91 21.20 16.13 26 ALL_TRUSTED 26186 10.77 2.01 15.50 27 TR_XM_DK_Unsub 25884 17.98 22.92 15.32 28 UNPARSEABLE_RELAY 22081 15.47 19.92 13.07 29 FSL_BULK_SIG 17511 10.20 9.89 10.36 30 XM_Evil_Numbers_Gen 17302 9.59 8.39 10.24 31 XM_DKIMWhitelistDomains 16888 6.52 0.09 9.99 32 XM_B_Unsub 16758 12.54 17.40 9.92 33 BAYES_00 16506 6.51 0.49 9.77 34 T_TooManySym_01 14790 6.40 2.04 8.75 35 T_SCC_BODY_TEXT_LINE 14441 8.29 7.82 8.55 36 BAYES_60 13213 8.20 8.91 7.82 37 TR_XM_DK_Bayes 12541 4.97 0.42 7.42 38 TR_XM_DK_Bayes1 12411 4.91 0.42 7.34 39 TR_XM_BayesUnsub 12203 10.59 16.83 7.22 40 LOTS_OF_MONEY 12179 8.50 10.90 7.21 41 LotsOfNums_01 11493 6.42 5.70 6.80 42 TooManyTo_001 11489 5.84 4.07 6.80 43 XM_H_GMP 10891 6.43 6.39 6.44 44 TR_XM_DK_Bayes2 10838 4.28 0.34 6.41 45 XM_B_SpammyWords3 10553 9.38 15.17 6.24 46 XM_B_PhoneNumber 10422 5.57 4.47 6.17 47 XMStrtUSub 10318 5.76 5.12 6.11 48 TR_MAX_INTL_RELAY 9986 9.31 15.61 5.91 49 RCVD_IN_VALIDITY_SAFE 9525 4.68 2.91 5.64 50 TR_XM_SpammyWords4 9503 7.10 9.82 5.62 51 IN_ZIMBRA_NJ_WHITELIST 9308 3.61 0.08 5.51 52 HTML_IMAGE_RATIO_02 9190 6.28 7.83 5.44 53 XM_H_Long_From01 9154 5.62 5.99 5.42 54 HTML_IMAGE_RATIO_04 8890 5.26 5.26 5.26 55 BAYES_40 8735 3.87 1.47 5.17 56 RCVD_IN_MSPIKE_WL 8729 4.50 3.28 5.17 57 RCVD_IN_MSPIKE_H3 8728 4.50 3.28 5.16 58 XM_DK_Undo_02 8714 18.48 43.14 5.16 59 XM_B_Phish_Phrases 8706 5.92 7.34 5.15 60 MPART_ALT_DIFF 8491 5.38 6.04 5.02 61 XM_UncommonTLD01 8251 5.23 5.87 4.88 62 T_TooManySym_02 7918 3.33 0.81 4.69 63 XMSubMetaSx_00 7747 5.64 7.61 4.58 64 RCVD_IN_VALIDITY_CERTIFIED 7740 3.68 2.01 4.58 65 ANY_BOUNCE_MESSAGE 6982 3.20 1.48 4.13 66 BOUNCE_MESSAGE 6981 3.20 1.48 4.13 67 INVALID_MSGID 6767 2.73 0.37 4.00 68 BAYES_99 6722 14.96 35.30 3.98 69 XMNumbers 6460 3.76 3.64 3.82 70 TO_MALFORMED 6272 2.42 0.03 3.71 71 BOTNET_IPINHOSTNAME 6151 5.83 9.89 3.64 72 BAYES_80 6019 5.73 9.75 3.56 73 BAYES_20 5880 2.68 1.21 3.48 74 RELAYCOUNTRY_META 5776 7.74 15.75 3.42 75 T_REMOTE_IMAGE 5768 3.32 3.16 3.41 76 BAYES_999 5210 11.92 28.29 3.08 77 XM_B_SpammyTLD 5139 3.53 4.43 3.04 78 MIME_QP_LONG_LINE 5110 2.53 1.60 3.02 79 MIME_HTML_ONLY_MULTI 5050 3.12 3.37 2.99 80 XMStockSpam_06 4450 2.36 1.86 2.63 81 MIME_HTML_MOSTLY 4446 2.93 3.49 2.63 82 T_XMDrugObfuBody_08 4364 2.96 3.67 2.58 83 XM_Body_Dirty_Words 4303 4.71 8.73 2.55 84 XMSexyCombo_05 4134 3.38 5.12 2.45 85 TooManyTo_002 4123 1.83 0.71 2.44 86 XM_PDF 4089 1.76 0.53 2.42 87 HTML_IMAGE_RATIO_06 4086 2.47 2.56 2.42 88 TR_XM_DKIM_Undo 4083 12.67 31.64 2.42 89 BAYES_95 3961 3.45 5.50 2.34 90 XM_CamelCaseFrm001 3910 3.18 4.77 2.31 91 MAILING_LIST_MULTI 3902 2.22 2.06 2.31 92 T_XMDrugObfuBody_14 3887 3.10 4.59 2.30 93 RCVD_IN_IADB_LISTED 3828 1.66 0.55 2.27 94 TR_Symld_Words 3781 1.74 0.82 2.24 95 FROM_EXCESS_BASE64 3680 2.32 2.57 2.18 96 BAYES_05 3550 1.57 0.57 2.10 97 TM2_M_URI_OPT_OUT 3480 2.07 2.09 2.06 98 RCVD_IN_IADB_SPF 3466 1.51 0.50 2.05 99 T_TooManySym_03 3257 1.32 0.20 1.93 100 HTML_IMAGE_RATIO_08 3208 2.07 2.39 1.90 101 TR_XM_SpammyRelay 3180 5.29 11.59 1.88 102 RCVD_IN_IADB_SENDERID 3175 1.38 0.47 1.88 103 RCVD_IN_IADB_DK 3105 1.36 0.48 1.84 104 TR_XM_PhishingBody 3012 2.91 4.99 1.78 105 DKIM_INVALID 2969 2.70 4.43 1.76 106 IN_HORDE_ADDRESS_BOOK 2938 1.16 0.10 1.74 107 TR_XM_UnparsRelay 2903 5.02 11.13 1.72 108 URI_NOVOWEL 2875 1.64 1.52 1.70 109 TVD_SPACE_RATIO 2742 1.11 0.15 1.62 110 TR_DCC_Bayes_99 2736 10.18 26.03 1.62 111 XMDiploma_00 2727 1.95 2.58 1.61 112 XM_DK_Undo_01 2679 1.69 1.88 1.59 113 XMGappySubj_01 2637 1.13 0.32 1.56 114 XM_B_URI_Unicode 2587 1.81 2.32 1.53 115 UNTRUSTED_Relay 2575 2.89 5.41 1.52 116 HTML_MIME_NO_HTML_TAG 2557 1.52 1.54 1.51 117 RCVD_IN_IADB_VOUCHED 2486 1.03 0.21 1.47 118 TM2_M_VERY_LONG_WORD 2452 2.00 3.01 1.45 119 XM_B_COPY_HTML 2390 1.47 1.58 1.41 120 RELAYCOUNTRY_CA 2331 3.29 6.84 1.38 121 XM_B_Investor 2262 2.39 4.35 1.34 122 XM_B_Unsub2 2256 1.91 2.99 1.33 123 XM_SendGrid 2221 1.35 1.42 1.31 124 TR_XM_SpammyWords5 2198 2.23 3.95 1.30 125 XM_GoogleGroups 2156 1.10 0.76 1.28 126 XMSubMetaSxObfu_03 2113 1.10 0.82 1.25 127 BOTNET 2074 3.68 8.21 1.23 128 TVD_RCVD_IP 2065 1.11 0.90 1.22 129 XMGappySubj_02 2063 0.81 0.05 1.22 130 T_TVD_MIME_NO_HEADERS 1938 0.75 0.03 1.15 131 KHOP_HELO_FCRDNS 1897 1.63 2.56 1.12 132 TooManyTo_003 1884 0.96 0.66 1.11 133 URI_HEX 1853 1.19 1.35 1.10 134 LOW_PRICE 1768 0.78 0.28 1.05 135 SUBJ_ALL_CAPS 1731 1.32 1.87 1.02 136 XMBrknScrpt_02 1716 1.49 2.37 1.02 137 HTML_EXTRA_CLOSE 1693 0.66 0.02 1.00 138 T_XMDrugObfuBody_00 1692 1.55 2.55 1.00 139 RCVD_IN_IADB_OPTIN 1691 0.70 0.13 1.00 140 TR_XM_Base64_M1 1685 0.90 0.71 1.00 141 XM_OfRef6 1674 1.79 3.27 0.99 142 XMSubMetaSx_01 1672 0.73 0.25 0.99 143 XM_SPF_SoftFail 1669 1.50 2.44 0.99 144 XMBSHREFv2 1660 0.71 0.22 0.98 145 XM_B_SpammyWords4 1568 1.53 2.63 0.93 146 TR_MetaPhish_Combo_01 1543 1.10 1.44 0.91 147 XM_B_FormFill 1510 0.59 0.02 0.89 148 TR_XM_DK_SendGrid 1502 0.82 0.69 0.89 149 XMBdyGiftCard01 1472 1.05 1.39 0.87 150 HELO_MISC_IP 1460 0.58 0.05 0.86 151 XM_UB50 1450 1.32 2.18 0.86 152 XM_H_PHPMailer 1394 0.79 0.72 0.82 153 XMBody_17 1392 1.39 2.45 0.82 154 T_XMHurry_00 1362 1.46 2.67 0.81 155 TooManyTo_004 1361 0.74 0.63 0.81 156 HTML_TAG_BALANCE_BODY 1356 1.05 1.52 0.80 157 DKIM_ADSP_CUSTOM_MED 1267 0.94 1.29 0.75 158 MPART_ALT_DIFF_COUNT 1259 1.06 1.64 0.75 159 XMPhish30 1238 1.01 1.53 0.73 160 XM_H_Long_From02 1229 1.02 1.56 0.73 161 T_FILL_THIS_FORM_SHORT 1226 1.40 2.64 0.73 162 XMBody_95 1221 0.51 0.10 0.72 163 URI_TRY_3LD 1188 0.91 1.28 0.70 164 T_STY_INVIS_DIRECT 1184 1.01 1.58 0.70 165 TooManyTo_005 1179 0.67 0.62 0.70 166 USER_IN_WHITELIST 1139 0.44 0.00 0.67 167 USER_IN_WELCOMELIST 1139 0.44 0.00 0.67 168 TR_LOTS_OF_MONEY3 1114 0.98 1.56 0.66 169 DIET_1 1090 0.93 1.47 0.65 170 XMGenDplmaNmb 1061 0.85 1.26 0.63 171 TR_XM_SpammyWords2 1061 5.05 13.23 0.63 172 TM2_M_OBFU_COMMENT 1008 0.88 1.40 0.60 173 RCVD_IN_BL_SPAMCOP_NET 983 4.03 10.40 0.58 174 XMNoVowels 979 0.54 0.46 0.58 175 XMSubMetaI_00 946 0.69 0.93 0.56 176 XMLngstWrd_00 941 0.47 0.31 0.56 177 T_TooManySym_04 916 0.36 0.02 0.54 178 PLING_QUERY 902 0.65 0.86 0.53 179 RCVD_IN_PBL 887 0.71 1.05 0.52 180 XM_B_Phish66 854 0.87 1.55 0.51 181 XM_ShortIntro_01 846 0.46 0.37 0.50 182 DKIM_ADSP_NXDOMAIN 829 0.51 0.54 0.49 183 HTML_FONT_FACE_BAD 828 0.61 0.84 0.49 184 XMHTML_After_End 816 0.49 0.51 0.48 185 XMLngstWrd_01 815 0.40 0.26 0.48 186 RCVD_IN_PSBL 800 1.14 2.36 0.47 187 XM_ProductURIs 794 0.63 0.93 0.47 188 NML_ADSP_CUSTOM_MED 783 0.68 1.09 0.46 189 HTML_IMAGE_ONLY_20 771 0.65 1.00 0.46 190 XM_S_SubURI 769 0.31 0.05 0.46 191 XM_URI_RBL 759 1.10 2.30 0.45 192 XM_B_DNDMA 758 0.70 1.15 0.45 193 RELAYCOUNTRY_AU 753 1.23 2.69 0.45 194 T_OBFU_PDF_ATTACH 740 0.30 0.05 0.44 195 XMCapTrack 736 0.41 0.37 0.44 196 FORGED_GMAIL_RCVD 720 0.63 1.00 0.43 197 HTTPS_HTTP_MISMATCH 718 0.69 1.18 0.42 198 XMSlimDrugH 713 0.48 0.58 0.42 199 NO_DNS_FOR_FROM 707 0.42 0.43 0.42 200 XMSolicitRefs_0 702 0.51 0.69 0.42 ----------------------------------------------------------------------