Email: 291828 Autolearn: 0 AvgScore: 5.13 AvgScanTime: 1.37 sec Spam: 99647 Autolearn: 0 AvgScore: 13.92 AvgScanTime: 1.46 sec Ham: 192181 Autolearn: 0 AvgScore: 0.56 AvgScanTime: 1.33 sec Time Spent Running SA: 111.37 hours Time Spent Processing Spam: 40.43 hours Time Spent Processing Ham: 70.95 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 93850 88.66 94.18 85.80 2 XM_B_Unicode 84265 77.35 84.56 73.61 3 DKIM_SIGNED 81101 70.41 81.39 64.72 4 XM_DK_Pass 76592 68.10 76.86 63.56 5 RELAYCOUNTRY_US 75410 74.63 75.68 74.09 6 DKIM_VALID 74369 66.67 74.63 62.55 7 XM_B_SpammyWords 72040 56.50 72.30 48.30 8 DCC_CHECK 71312 52.65 71.56 42.85 9 XMListUnsubscribeExists 63346 52.12 63.57 46.18 10 DKIM_VALID_AU 59873 55.71 60.09 53.45 11 XM_B_Unicode3 53642 50.71 53.83 49.09 12 LOC_TINY_FONT_1 49086 39.66 49.26 34.68 13 XM_B_SpammyWords2 43595 28.10 43.75 19.99 14 RCVD_IN_MSPIKE_H2 40147 34.18 40.29 31.01 15 BAYES_50 39457 54.97 39.60 62.94 16 XM_DK_Undo_02 38269 16.06 38.40 4.47 17 HTML_FONT_LOW_CONTRAST 34907 35.80 35.03 36.20 18 BAYES_99 32865 13.61 32.98 3.57 19 T_KAM_HTML_FONT_INVALID 31724 25.51 31.84 22.23 20 FVGT_m_MULTI_ODD 31479 27.73 31.59 25.73 21 TR_XM_DKIM_Undo 28925 11.34 29.03 2.16 22 DCC_CHECK_NEGATIVE 27768 47.13 27.87 57.12 23 XM_Multi_Part_URI 27697 24.29 27.80 22.47 24 DKIM_VALID_EF 26728 25.21 26.82 24.38 25 BAYES_999 26199 10.85 26.29 2.84 26 MIME_HTML_ONLY 25399 20.64 25.49 18.12 27 TR_DCC_Bayes_99 24236 9.38 24.32 1.64 28 XM_B_Unsub 24082 18.78 24.17 15.98 29 TR_XM_BayesUnsub 23270 16.28 23.35 12.61 30 TR_XM_DK_Unsub 19941 14.96 20.01 12.35 31 T_TM2_M_HEADER_IN_MSG 18695 22.96 18.76 25.14 32 UNPARSEABLE_RELAY 18002 13.84 18.07 11.64 33 XMSubLong 17801 18.40 17.86 18.67 34 XM_B_SpammyWords3 16892 9.64 16.95 5.84 35 TR_MAX_INTL_RELAY 14906 8.59 14.96 5.29 36 RELAYCOUNTRY_META 14626 7.06 14.68 3.11 37 TR_XM_SpammyWords2 12791 4.74 12.84 0.54 38 LOTS_OF_MONEY 11993 7.34 12.04 4.91 39 ALL_TRUSTED 11264 18.91 11.30 22.86 40 TR_XM_SpammyWords4 10933 6.08 10.97 3.55 41 BOUNCE_MESSAGE 10815 16.59 10.85 19.57 42 ANY_BOUNCE_MESSAGE 10815 16.59 10.85 19.57 43 XM_B_Phish_Phrases 10734 8.51 10.77 7.34 44 TR_XM_SpammyRelay 10507 4.80 10.54 1.82 45 RCVD_IN_BL_SPAMCOP_NET 10449 3.91 10.49 0.50 46 TR_XM_UnparsRelay 9441 4.13 9.47 1.36 47 BAYES_80 9358 5.31 9.39 3.20 48 BOTNET_IPINHOSTNAME 8701 4.94 8.73 2.97 49 BAYES_60 8501 7.70 8.53 7.27 50 FSL_BULK_SIG 8051 8.17 8.08 8.22 51 XM_Body_Dirty_Words 7949 4.33 7.98 2.44 52 T_SCC_BODY_TEXT_LINE 7879 8.32 7.91 8.53 53 TR_XM_SPAMCOP 7862 2.82 7.89 0.20 54 XM_Evil_Numbers_Gen 7426 10.71 7.45 12.40 55 HTML_IMAGE_RATIO_02 7206 6.07 7.23 5.47 56 BOTNET 7090 3.10 7.12 1.02 57 MPART_ALT_DIFF 6992 5.42 7.02 4.59 58 LotsOfNums_01 6960 6.31 6.98 5.97 59 DKIM_INVALID 6732 3.74 6.76 2.17 60 RELAYCOUNTRY_CA 6499 3.03 6.52 1.22 61 XM_H_GMP 6241 5.98 6.26 5.84 62 XMSubMetaSx_00 6194 4.19 6.22 3.14 63 XM_UncommonTLD01 5654 4.88 5.67 4.46 64 XM_H_Long_From01 5320 5.22 5.34 5.15 65 BAYES_95 5196 3.15 5.21 2.09 66 XM_B_Investor 5160 2.79 5.18 1.55 67 TR_XM_PhishingBody 5124 2.81 5.14 1.61 68 XM_B_Unsub2 5033 4.03 5.05 3.51 69 MIME_HTML_MOSTLY 4857 3.67 4.87 3.05 70 XMStrtUSub 4805 5.09 4.82 5.22 71 UNTRUSTED_Relay 4761 2.64 4.78 1.52 72 HTML_IMAGE_RATIO_04 4379 4.49 4.39 4.53 73 KHOP_HELO_FCRDNS 4368 4.58 4.38 4.69 74 T_XMDrugObfuBody_08 4343 2.62 4.36 1.73 75 XM_B_PhoneNumber 4272 4.91 4.29 5.24 76 T_XMDrugObfuBody_14 4233 2.92 4.25 2.23 77 XM_B_SpammyTLD 3884 2.91 3.90 2.40 78 XM_B_SpammyWords4 3677 1.76 3.69 0.76 79 TooManyTo_001 3656 4.59 3.67 5.06 80 XMSexyCombo_05 3629 2.07 3.64 1.26 81 XM_CamelCaseFrm001 3608 2.66 3.62 2.16 82 XMNumbers 3375 3.63 3.39 3.75 83 TR_XM_SpammyWords5 3365 2.00 3.38 1.29 84 MIME_HTML_ONLY_MULTI 3084 2.65 3.09 2.42 85 TM2_M_VERY_LONG_WORD 3001 5.62 3.01 6.97 86 RCVD_IN_VALIDITY_RPBL 2988 1.06 3.00 0.05 87 TR_XM_NoHeaderRelay 2943 1.14 2.95 0.20 88 XM_SPF_SoftFail 2923 1.54 2.93 0.81 89 T_REMOTE_IMAGE 2919 2.65 2.93 2.50 90 RCVD_IN_MSPIKE_WL 2912 3.68 2.92 4.07 91 RCVD_IN_MSPIKE_H3 2912 3.67 2.92 4.06 92 RCVD_IN_VALIDITY_SAFE 2901 4.70 2.91 5.63 93 HTML_IMAGE_RATIO_06 2788 3.46 2.80 3.80 94 HTML_IMAGE_RATIO_08 2767 2.70 2.78 2.67 95 XMDiploma_00 2678 1.68 2.69 1.16 96 T_FILL_THIS_FORM_SHORT 2672 1.36 2.68 0.67 97 T_XMHurry_00 2639 1.89 2.65 1.50 98 T_XMDrugObfuBody_00 2595 1.66 2.60 1.17 99 TM2_M_URI_OPT_OUT 2492 2.63 2.50 2.70 100 XMBody_17 2423 1.15 2.43 0.49 101 XM_OfRef6 2375 1.66 2.38 1.29 102 DIET_1 2346 1.11 2.35 0.47 103 XM_URI_RBL 2333 1.13 2.34 0.50 104 XMStockSpam_06 2315 2.02 2.32 1.87 105 RELAYCOUNTRY_AU 2315 1.04 2.32 0.38 106 RCVD_IN_PSBL 2276 1.06 2.28 0.42 107 FROM_EXCESS_BASE64 2265 2.32 2.27 2.35 108 T_TooManySym_01 2086 5.23 2.09 6.85 109 XMBrknScrpt_02 2076 1.29 2.08 0.87 110 TR_XM_INV_DKIM 2037 0.82 2.04 0.18 111 USER_IN_DEF_DKIM_WL 2010 11.67 2.02 16.67 112 RCVD_IN_VALIDITY_CERTIFIED 2008 3.74 2.02 4.64 113 XM_UB50 1990 1.28 2.00 0.91 114 MAILING_LIST_MULTI 1920 1.93 1.93 1.93 115 XM_B_COPY_HTML 1845 1.65 1.85 1.55 116 XM_DIRTYINTL 1783 0.69 1.79 0.12 117 XM_H_Long_From02 1674 1.02 1.68 0.67 118 BAYES_40 1673 4.65 1.68 6.18 119 THIS_AD 1657 1.05 1.66 0.73 120 SpammyFromTLD_02 1652 0.66 1.66 0.14 121 XM_H_DKIM_GOOG 1646 0.59 1.65 0.04 122 SpammyFromTLD_01 1627 0.78 1.63 0.34 123 XM_B_URI_Unicode 1614 1.46 1.62 1.38 124 TR_LOTS_OF_MONEY3 1609 0.70 1.61 0.22 125 XM_B_REG_HTML 1568 0.78 1.57 0.36 126 HTML_FONT_TINY_NORDNS 1557 0.56 1.56 0.04 127 SHOPIFY_IMG_NOT_RCVD_SFY 1502 0.81 1.51 0.44 128 DKIM_ADSP_CUSTOM_MED 1492 0.97 1.50 0.69 129 T_DATE_IN_FUTURE_Q_PLUS 1484 0.53 1.49 0.03 130 XMGenDplmaNmb 1479 0.85 1.48 0.52 131 XM_SendGrid 1466 1.23 1.47 1.10 132 HTML_TAG_BALANCE_BODY 1439 1.01 1.44 0.78 133 XMPhish30 1404 0.98 1.41 0.76 134 XM_B_DNDMA 1390 0.82 1.39 0.53 135 SUBJ_ALL_CAPS 1389 1.04 1.39 0.86 136 NML_ADSP_CUSTOM_MED 1353 0.78 1.36 0.48 137 MIME_QP_LONG_LINE 1324 2.08 1.33 2.48 138 XM_B_Phish66 1320 0.62 1.32 0.26 139 XM_DK_Undo_01 1303 1.45 1.31 1.53 140 TR_LOTS_OF_MONEY2 1302 0.50 1.31 0.08 141 T_MONEY_PERCENT 1302 0.50 1.31 0.08 142 TR_XM_FormFill 1301 0.45 1.31 0.01 143 XMLngstWrd_00 1295 0.98 1.30 0.82 144 FORGED_GMAIL_RCVD 1283 0.71 1.29 0.41 145 DEAR_FRIEND 1276 0.45 1.28 0.02 146 URI_OPTOUT_3LD 1271 0.70 1.28 0.40 147 TR_XM_PHPForged 1271 0.64 1.28 0.31 148 TR_XM_PHPDW 1267 0.64 1.27 0.31 149 TR_XM_FormFill2 1261 0.63 1.27 0.31 150 HTML_FONT_FACE_BAD 1256 0.97 1.26 0.81 151 XMGppyBdWords 1245 0.60 1.25 0.27 152 XM_H_PHPOS 1240 0.62 1.24 0.30 153 URI_TRY_3LD 1228 0.74 1.23 0.48 154 URI_HEX 1207 1.01 1.21 0.90 155 HTML_MIME_NO_HTML_TAG 1205 1.36 1.21 1.44 156 XMReplyNow 1176 0.51 1.18 0.16 157 XMHTML_After_End 1163 0.69 1.17 0.44 158 HTTPS_HTTP_MISMATCH 1126 0.66 1.13 0.42 159 TR_XM_Base64_L1 1126 0.43 1.13 0.07 160 TR_MetaPhish_Combo_01 1112 0.77 1.12 0.58 161 RELAYCOUNTRY_FR 1111 0.48 1.11 0.16 162 XMPhish08 1099 0.52 1.10 0.21 163 XM_Nigeria_01 1093 0.46 1.10 0.13 164 LongTLD 1078 0.54 1.08 0.26 165 XM_ProductURIs 1050 0.74 1.05 0.58 166 TR_XM_PhishingBody2 1040 0.36 1.04 0.01 167 RCVD_IN_PBL 1037 0.65 1.04 0.45 168 T_STY_INVIS_DIRECT 1020 0.68 1.02 0.51 169 XMEqualsVooDoo_00 1019 0.37 1.02 0.04 170 TR_XM_Base64_M1 1014 0.98 1.02 0.97 171 BAYES_20 1013 2.95 1.02 3.95 172 MPART_ALT_DIFF_COUNT 1011 0.75 1.01 0.61 173 XM_UB99 1000 0.35 1.00 0.00 174 TM2_M_OBFU_COMMENT 988 0.73 0.99 0.60 175 BOTNET_NORDNS 983 0.34 0.99 0.01 176 XM_B_SEO 981 0.48 0.98 0.22 177 LOADSA_MONEY_COMBO 961 0.34 0.96 0.02 178 FORGED_MUA_OUTLOOK 945 0.35 0.95 0.04 179 TR_XM_Spammywords 935 0.38 0.94 0.08 180 XM_S_SpammyWords 935 0.38 0.94 0.08 181 FSL_CTYPE_WIN1251 933 0.32 0.94 0.00 182 AXB_XMAILER_MIMEOLE_OL_024C2 928 0.32 0.93 0.00 183 HTML_IMAGE_ONLY_20 925 0.68 0.93 0.55 184 FROM_MISSP_REPLYTO 925 0.32 0.93 0.00 185 XMLngstWrd_01 915 0.68 0.92 0.55 186 URI_NOVOWEL 913 1.36 0.92 1.59 187 XM_HighProb1 911 0.32 0.91 0.01 188 URG_BIZ 908 0.34 0.91 0.05 189 XMSlimDrugH 903 0.81 0.91 0.76 190 FSL_NEW_HELO_USER 899 0.31 0.90 0.00 191 FROM_MISSP_MSFT 898 0.31 0.90 0.00 192 TO_NO_BRKTS_FROM_MSSP 896 0.31 0.90 0.01 193 TO_NO_BRKTS_MSFT 892 0.31 0.90 0.00 194 XMSubMetaI_00 889 0.64 0.89 0.52 195 MultiRelay_CC 884 0.36 0.89 0.08 196 XM_GoogleGroups 876 1.07 0.88 1.17 197 RDNS_DYNAMIC 865 0.46 0.87 0.25 198 XM_RXBody 863 0.49 0.87 0.29 199 MONEY_FROM_MISSP 854 0.29 0.86 0.00 200 XFER_LOTSA_MONEY 850 0.30 0.85 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 164893 88.66 94.18 85.80 2 RELAYCOUNTRY_US 142381 74.63 75.68 74.09 3 XM_B_Unicode 141462 77.35 84.56 73.61 4 DKIM_SIGNED 124375 70.41 81.39 64.72 5 XM_DK_Pass 122151 68.10 76.86 63.56 6 BAYES_50 120963 54.97 39.60 62.94 7 DKIM_VALID 120200 66.67 74.63 62.55 8 DCC_CHECK_NEGATIVE 109778 47.13 27.87 57.12 9 DKIM_VALID_AU 102713 55.71 60.09 53.45 10 XM_B_Unicode3 94345 50.71 53.83 49.09 11 XM_B_SpammyWords 92833 56.50 72.30 48.30 12 XMListUnsubscribeExists 88749 52.12 63.57 46.18 13 DCC_CHECK 82350 52.65 71.56 42.85 14 HTML_FONT_LOW_CONTRAST 69563 35.80 35.03 36.20 15 LOC_TINY_FONT_1 66643 39.66 49.26 34.68 16 RCVD_IN_MSPIKE_H2 59590 34.18 40.29 31.01 17 FVGT_m_MULTI_ODD 49450 27.73 31.59 25.73 18 T_TM2_M_HEADER_IN_MSG 48312 22.96 18.76 25.14 19 DKIM_VALID_EF 46848 25.21 26.82 24.38 20 ALL_TRUSTED 43924 18.91 11.30 22.86 21 XM_Multi_Part_URI 43184 24.29 27.80 22.47 22 T_KAM_HTML_FONT_INVALID 42720 25.51 31.84 22.23 23 XM_B_SpammyWords2 38422 28.10 43.75 19.99 24 BOUNCE_MESSAGE 37602 16.59 10.85 19.57 25 ANY_BOUNCE_MESSAGE 37602 16.59 10.85 19.57 26 XMSubLong 35881 18.40 17.86 18.67 27 MIME_HTML_ONLY 34828 20.64 25.49 18.12 28 USER_IN_DEF_DKIM_WL 32035 11.67 2.02 16.67 29 XM_B_Unsub 30712 18.78 24.17 15.98 30 TR_XM_BayesUnsub 24233 16.28 23.35 12.61 31 XM_Evil_Numbers_Gen 23832 10.71 7.45 12.40 32 TR_XM_DK_Unsub 23725 14.96 20.01 12.35 33 UNPARSEABLE_RELAY 22379 13.84 18.07 11.64 34 BAYES_00 16929 5.99 0.56 8.81 35 T_SCC_BODY_TEXT_LINE 16391 8.32 7.91 8.53 36 FSL_BULK_SIG 15804 8.17 8.08 8.22 37 XM_DKIMWhitelistDomains 15039 5.16 0.01 7.83 38 XM_B_Phish_Phrases 14112 8.51 10.77 7.34 39 HTML_IMAGE_ONLY_32 14060 4.85 0.09 7.32 40 BAYES_60 13975 7.70 8.53 7.27 41 TM2_M_VERY_LONG_WORD 13401 5.62 3.01 6.97 42 T_TooManySym_01 13170 5.23 2.09 6.85 43 TR_XM_DK_Bayes 12575 4.43 0.36 6.54 44 TR_XM_DK_Bayes1 12343 4.34 0.32 6.42 45 BAYES_40 11884 4.65 1.68 6.18 46 LotsOfNums_01 11467 6.31 6.98 5.97 47 XM_B_SpammyWords3 11230 9.64 16.95 5.84 48 XM_H_GMP 11217 5.98 6.26 5.84 49 TR_XM_DK_Bayes2 10913 3.82 0.23 5.68 50 RCVD_IN_VALIDITY_SAFE 10828 4.70 2.91 5.63 51 HTML_IMAGE_RATIO_02 10515 6.07 7.23 5.47 52 MAY_BE_FORGED 10452 3.60 0.05 5.44 53 TR_MAX_INTL_RELAY 10159 8.59 14.96 5.29 54 XM_B_PhoneNumber 10068 4.91 4.29 5.24 55 XMStrtUSub 10038 5.09 4.82 5.22 56 XM_H_Long_From01 9904 5.22 5.34 5.15 57 TooManyTo_001 9728 4.59 3.67 5.06 58 LOTS_OF_MONEY 9427 7.34 12.04 4.91 59 KHOP_HELO_FCRDNS 9005 4.58 4.38 4.69 60 RCVD_IN_VALIDITY_CERTIFIED 8910 3.74 2.02 4.64 61 MPART_ALT_DIFF 8818 5.42 7.02 4.59 62 IN_ZIMBRA_NJ_WHITELIST 8753 3.03 0.08 4.55 63 HTML_IMAGE_RATIO_04 8712 4.49 4.39 4.53 64 XM_DK_Undo_02 8591 16.06 38.40 4.47 65 XM_UncommonTLD01 8575 4.88 5.67 4.46 66 T_TooManySym_02 8004 2.92 0.51 4.16 67 RCVD_IN_MSPIKE_WL 7813 3.68 2.92 4.07 68 RCVD_IN_MSPIKE_H3 7811 3.67 2.92 4.06 69 BAYES_20 7593 2.95 1.02 3.95 70 HTML_IMAGE_RATIO_06 7299 3.46 2.80 3.80 71 XMNumbers 7206 3.63 3.39 3.75 72 BAYES_99 6853 13.61 32.98 3.57 73 TR_XM_SpammyWords4 6822 6.08 10.97 3.55 74 INVALID_MSGID 6805 2.50 0.49 3.54 75 XM_B_Unsub2 6738 4.03 5.05 3.51 76 TO_MALFORMED 6287 2.16 0.02 3.27 77 BAYES_80 6142 5.31 9.39 3.20 78 XMSubMetaSx_00 6038 4.19 6.22 3.14 79 RELAYCOUNTRY_META 5979 7.06 14.68 3.11 80 MIME_HTML_MOSTLY 5864 3.67 4.87 3.05 81 BOTNET_IPINHOSTNAME 5716 4.94 8.73 2.97 82 BAYES_999 5450 10.85 26.29 2.84 83 MIME_CHARSET_FARAWAY 5410 1.99 0.39 2.82 84 TM2_M_URI_OPT_OUT 5182 2.63 2.50 2.70 85 HTML_IMAGE_RATIO_08 5123 2.70 2.78 2.67 86 CHARSET_FARAWAY_HEADER 5081 1.80 0.17 2.64 87 T_REMOTE_IMAGE 4809 2.65 2.93 2.50 88 MIME_QP_LONG_LINE 4758 2.08 1.33 2.48 89 T_TVD_MIME_NO_HEADERS 4703 1.62 0.03 2.45 90 XM_Body_Dirty_Words 4683 4.33 7.98 2.44 91 MIME_HTML_ONLY_MULTI 4656 2.65 3.09 2.42 92 XM_B_SpammyTLD 4612 2.91 3.90 2.40 93 FROM_EXCESS_BASE64 4508 2.32 2.27 2.35 94 T_XMDrugObfuBody_14 4279 2.92 4.25 2.23 95 DKIM_INVALID 4175 3.74 6.76 2.17 96 TR_XM_DKIM_Undo 4155 11.34 29.03 2.16 97 XM_CamelCaseFrm001 4148 2.66 3.62 2.16 98 BAYES_95 4010 3.15 5.21 2.09 99 BAYES_05 3826 1.48 0.49 1.99 100 MAILING_LIST_MULTI 3713 1.93 1.93 1.93 101 XMStockSpam_06 3594 2.02 2.32 1.87 102 TR_XM_SpammyRelay 3491 4.80 10.54 1.82 103 RCVD_IN_IADB_LISTED 3458 1.35 0.49 1.80 104 T_TooManySym_03 3402 1.22 0.16 1.77 105 TooManyTo_002 3402 1.37 0.60 1.77 106 T_XMDrugObfuBody_08 3317 2.62 4.36 1.73 107 XM_PDF 3211 1.24 0.42 1.67 108 TR_DCC_Bayes_99 3150 9.38 24.32 1.64 109 RCVD_IN_IADB_SPF 3108 1.22 0.45 1.62 110 TR_XM_PhishingBody 3085 2.81 5.14 1.61 111 URI_NOVOWEL 3050 1.36 0.92 1.59 112 XM_B_Investor 2982 2.79 5.18 1.55 113 XM_B_COPY_HTML 2980 1.65 1.85 1.55 114 XM_DK_Undo_01 2934 1.45 1.31 1.53 115 UNTRUSTED_Relay 2930 2.64 4.78 1.52 116 T_XMHurry_00 2883 1.89 2.65 1.50 117 RCVD_IN_IADB_SENDERID 2840 1.12 0.44 1.48 118 HTML_MIME_NO_HTML_TAG 2777 1.36 1.21 1.44 119 RCVD_IN_IADB_DK 2763 1.10 0.45 1.44 120 IN_HORDE_ADDRESS_BOOK 2742 0.99 0.14 1.43 121 XM_B_URI_Unicode 2652 1.46 1.62 1.38 122 TVD_SPACE_RATIO 2637 0.96 0.16 1.37 123 TR_XM_UnparsRelay 2621 4.13 9.47 1.36 124 XM_OfRef6 2477 1.66 2.38 1.29 125 TR_XM_SpammyWords5 2474 2.00 3.38 1.29 126 XMSexyCombo_05 2420 2.07 3.64 1.26 127 RELAYCOUNTRY_CA 2344 3.03 6.52 1.22 128 XMBdyGiftCard01 2306 1.01 0.65 1.20 129 XMGappySubj_01 2296 0.93 0.42 1.19 130 RCVD_IN_IADB_VOUCHED 2257 0.84 0.19 1.17 131 XM_GoogleGroups 2250 1.07 0.88 1.17 132 T_XMDrugObfuBody_00 2245 1.66 2.60 1.17 133 XMDiploma_00 2229 1.68 2.69 1.16 134 XM_SendGrid 2119 1.23 1.47 1.10 135 TVD_RCVD_IP 2069 0.97 0.77 1.08 136 TR_Symld_Words 2040 0.91 0.63 1.06 137 XMGappySubj_02 2017 0.73 0.12 1.05 138 TooManyTo_003 1967 0.86 0.55 1.02 139 BOTNET 1959 3.10 7.12 1.02 140 TR_XM_Base64_M1 1856 0.98 1.02 0.97 141 XM_UB50 1749 1.28 2.00 0.91 142 URI_HEX 1729 1.01 1.21 0.90 143 XMBSHREFv2 1692 0.74 0.47 0.88 144 XMBrknScrpt_02 1681 1.29 2.08 0.87 145 RCVD_IN_IADB_OPTIN 1669 0.61 0.11 0.87 146 SUBJ_ALL_CAPS 1656 1.04 1.39 0.86 147 XMLngstWrd_00 1567 0.98 1.30 0.82 148 HTML_FONT_FACE_BAD 1563 0.97 1.26 0.81 149 XM_SPF_SoftFail 1558 1.54 2.93 0.81 150 XM_H_PHPMailer 1517 0.72 0.58 0.79 151 HELO_MISC_IP 1513 0.54 0.06 0.79 152 HTML_TAG_BALANCE_BODY 1506 1.01 1.44 0.78 153 TooManyTo_004 1490 0.69 0.53 0.78 154 XMSlimDrugH 1470 0.81 0.91 0.76 155 TR_XM_DK_SendGrid 1459 0.70 0.60 0.76 156 XMPhish30 1454 0.98 1.41 0.76 157 XM_B_SpammyWords4 1454 1.76 3.69 0.76 158 THIS_AD 1400 1.05 1.66 0.73 159 MSGID_FROM_MTA_HEADER 1343 0.51 0.14 0.70 160 DKIM_ADSP_CUSTOM_MED 1327 0.97 1.50 0.69 161 XMBody_95 1304 0.48 0.10 0.68 162 TooManyTo_005 1297 0.62 0.51 0.67 163 XM_H_Long_From02 1295 1.02 1.68 0.67 164 T_FILL_THIS_FORM_SHORT 1289 1.36 2.68 0.67 165 MPART_ALT_DIFF_COUNT 1178 0.75 1.01 0.61 166 TM2_M_OBFU_COMMENT 1144 0.73 0.99 0.60 167 TR_MetaPhish_Combo_01 1124 0.77 1.12 0.58 168 USER_IN_WELCOMELIST 1113 0.38 0.00 0.58 169 USER_IN_WHITELIST 1113 0.38 0.00 0.58 170 XM_ProductURIs 1112 0.74 1.05 0.58 171 HTML_IMAGE_ONLY_20 1063 0.68 0.93 0.55 172 XMLngstWrd_01 1055 0.68 0.92 0.55 173 TR_XM_SpammyWords2 1029 4.74 12.84 0.54 174 T_TooManySym_04 1027 0.36 0.02 0.53 175 XM_B_DNDMA 1017 0.82 1.39 0.53 176 XMGenDplmaNmb 999 0.85 1.48 0.52 177 XMSubMetaI_00 993 0.64 0.89 0.52 178 T_STY_INVIS_DIRECT 971 0.68 1.02 0.51 179 RCVD_IN_BL_SPAMCOP_NET 969 3.91 10.49 0.50 180 XM_URI_RBL 969 1.13 2.34 0.50 181 XMBody_17 937 1.15 2.43 0.49 182 URI_TRY_3LD 932 0.74 1.23 0.48 183 NML_ADSP_CUSTOM_MED 924 0.78 1.36 0.48 184 HTML_EXTRA_CLOSE 914 0.33 0.05 0.48 185 XM_ShortIntro_01 907 0.46 0.43 0.47 186 DKIM_ADSP_NXDOMAIN 903 0.48 0.51 0.47 187 XMNoVowels 900 0.41 0.30 0.47 188 DIET_1 898 1.11 2.35 0.47 189 NO_DNS_FOR_FROM 891 0.45 0.43 0.46 190 RCVD_IN_PBL 873 0.65 1.04 0.45 191 XMHTML_After_End 855 0.69 1.17 0.44 192 SHOPIFY_IMG_NOT_RCVD_SFY 850 0.81 1.51 0.44 193 HTML_TAG_BALANCE_CENTER 827 0.46 0.52 0.43 194 XMLngstWrd_02 810 0.41 0.39 0.42 195 RCVD_IN_PSBL 807 1.06 2.28 0.42 196 HTTPS_HTTP_MISMATCH 798 0.66 1.13 0.42 197 FORGED_GMAIL_RCVD 795 0.71 1.29 0.41 198 XMCapTrack 782 0.37 0.29 0.41 199 AD_PREFS 776 0.32 0.16 0.40 200 XMOemUri 768 0.37 0.33 0.40 ----------------------------------------------------------------------