Email: 258717 Autolearn: 0 AvgScore: 4.92 AvgScanTime: 1.32 sec Spam: 91549 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 1.41 sec Ham: 167168 Autolearn: 0 AvgScore: 0.01 AvgScanTime: 1.27 sec Time Spent Running SA: 94.89 hours Time Spent Processing Spam: 35.78 hours Time Spent Processing Ham: 59.11 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 87491 88.25 95.57 84.24 2 DKIM_SIGNED 82347 81.78 89.95 77.30 3 XM_DK_Pass 79514 79.92 86.85 76.12 4 DKIM_VALID 79207 79.40 86.52 75.51 5 XM_B_Unicode 79155 77.87 86.46 73.16 6 RELAYCOUNTRY_US 74504 80.79 81.38 80.47 7 DCC_CHECK 72647 59.49 79.35 48.61 8 XMListUnsubscribeExists 65319 60.36 71.35 54.35 9 DKIM_VALID_AU 64483 66.36 70.44 64.12 10 XM_B_SpammyWords 64451 54.97 70.40 46.52 11 XM_B_Unicode3 48341 48.64 52.80 46.36 12 LOC_TINY_FONT_1 45989 39.70 50.23 33.94 13 XM_DK_Undo_02 40832 19.50 44.60 5.76 14 RCVD_IN_MSPIKE_H2 37130 38.57 40.56 37.48 15 XM_B_SpammyWords2 36673 27.44 40.06 20.52 16 HTML_FONT_LOW_CONTRAST 34376 34.08 37.55 32.18 17 BAYES_50 32722 51.79 35.74 60.58 18 BAYES_99 32602 15.66 35.61 4.74 19 TR_XM_DKIM_Undo 30620 13.30 33.45 2.26 20 T_KAM_HTML_FONT_INVALID 29676 25.21 32.42 21.27 21 FVGT_m_MULTI_ODD 29148 28.89 31.84 27.27 22 DKIM_VALID_EF 26747 29.68 29.22 29.93 23 BAYES_999 25648 12.29 28.02 3.67 24 MIME_HTML_ONLY 25514 23.69 27.87 21.41 25 TR_DCC_Bayes_99 24311 10.70 26.56 2.01 26 TR_XM_DK_Unsub 20507 17.76 22.40 15.21 27 XMSubLong 20165 22.74 22.03 23.13 28 XM_Multi_Part_URI 19103 17.47 20.87 15.61 29 DCC_CHECK_NEGATIVE 18493 40.33 20.20 51.35 30 T_TM2_M_HEADER_IN_MSG 17565 22.99 19.19 25.08 31 UNPARSEABLE_RELAY 17380 15.26 18.98 13.23 32 XM_B_Unsub 15969 12.66 17.44 10.04 33 RELAYCOUNTRY_META 15876 8.58 17.34 3.78 34 TR_XM_BayesUnsub 15355 10.69 16.77 7.36 35 TR_MAX_INTL_RELAY 14255 9.78 15.57 6.60 36 XM_B_SpammyWords3 13504 9.14 14.75 6.07 37 TR_XM_SpammyWords2 11978 4.96 13.08 0.51 38 TR_XM_SpammyRelay 11558 5.97 12.62 2.32 39 BOTNET_IPINHOSTNAME 10034 6.13 10.96 3.48 40 TR_XM_UnparsRelay 9866 4.93 10.78 1.72 41 BOTNET 9792 4.52 10.70 1.13 42 FSL_BULK_SIG 9384 10.08 10.25 9.99 43 LOTS_OF_MONEY 9046 7.15 9.88 5.66 44 BAYES_80 8865 5.89 9.68 3.81 45 TR_XM_SpammyWords4 8316 5.73 9.08 3.90 46 BAYES_60 8188 8.35 8.94 8.02 47 T_SCC_BODY_TEXT_LINE 7415 8.31 8.10 8.42 48 RCVD_IN_BL_SPAMCOP_NET 7165 3.09 7.83 0.49 49 XM_Evil_Numbers_Gen 7072 8.98 7.72 9.66 50 XM_Body_Dirty_Words 7070 4.55 7.72 2.82 51 RELAYCOUNTRY_CA 6889 3.70 7.52 1.61 52 XM_B_Phish_Phrases 6550 5.39 7.15 4.43 53 HTML_IMAGE_RATIO_02 6460 6.11 7.06 5.59 54 XMSubMetaSx_00 6347 4.91 6.93 3.81 55 UNTRUSTED_Relay 6117 3.47 6.68 1.71 56 MPART_ALT_DIFF 5916 5.58 6.46 5.10 57 LotsOfNums_01 5538 6.72 6.05 7.08 58 XM_UncommonTLD01 5304 5.20 5.79 4.88 59 BAYES_95 5083 3.77 5.55 2.79 60 TR_XM_SPAMCOP 5071 2.10 5.54 0.21 61 XM_H_Long_From01 4902 5.64 5.35 5.79 62 T_XMDrugObfuBody_14 4497 3.41 4.91 2.59 63 HTML_IMAGE_RATIO_04 4337 4.93 4.74 5.04 64 XM_H_GMP 4304 5.97 4.70 6.66 65 XM_B_PhoneNumber 4257 6.11 4.65 6.91 66 XMSexyCombo_05 4213 2.71 4.60 1.67 67 TR_XM_PhishingBody 4208 2.83 4.60 1.87 68 XMStrtUSub 4206 5.46 4.59 5.94 69 XM_CamelCaseFrm001 4139 3.05 4.52 2.25 70 TR_XM_SpammyWords5 3611 2.14 3.94 1.15 71 TooManyTo_001 3394 5.36 3.71 6.27 72 XM_B_SpammyTLD 3349 3.09 3.66 2.78 73 XM_B_SpammyWords4 3278 1.78 3.58 0.80 74 XM_URI_RBL 3218 1.53 3.52 0.44 75 XMNumbers 3204 3.73 3.50 3.85 76 MIME_HTML_MOSTLY 3179 2.91 3.47 2.61 77 DKIM_INVALID 3140 2.38 3.43 1.80 78 MIME_HTML_ONLY_MULTI 3104 3.19 3.39 3.08 79 XM_B_Unsub2 3066 2.00 3.35 1.26 80 XM_B_Investor 2942 2.13 3.21 1.53 81 HTML_IMAGE_RATIO_08 2914 2.88 3.18 2.71 82 RCVD_IN_VALIDITY_SAFE 2786 5.06 3.04 6.17 83 TM2_M_VERY_LONG_WORD 2778 2.03 3.03 1.48 84 XM_OfRef6 2755 1.59 3.01 0.81 85 TR_XM_NoHeaderRelay 2707 1.15 2.96 0.16 86 HTML_IMAGE_RATIO_06 2705 2.61 2.95 2.42 87 RCVD_IN_MSPIKE_WL 2683 4.19 2.93 4.89 88 RCVD_IN_MSPIKE_H3 2683 4.19 2.93 4.88 89 RCVD_IN_VALIDITY_RPBL 2661 1.07 2.91 0.06 90 XM_UB50 2637 1.62 2.88 0.93 91 XM_SPF_SoftFail 2598 1.66 2.84 1.01 92 T_XMDrugObfuBody_08 2575 1.85 2.81 1.33 93 USER_IN_DEF_DKIM_WL 2555 12.89 2.79 18.42 94 RELAYCOUNTRY_AU 2486 1.23 2.72 0.41 95 T_XMDrugObfuBody_00 2416 1.51 2.64 0.89 96 ALL_TRUSTED 2357 11.16 2.57 15.85 97 HTML_FONT_TINY_NORDNS 2246 0.90 2.45 0.05 98 XM_DK_Undo_01 2156 1.97 2.36 1.76 99 RCVD_IN_VALIDITY_CERTIFIED 2101 3.80 2.29 4.63 100 XMDiploma_00 2083 1.55 2.28 1.15 101 XM_B_URI_Unicode 2079 1.89 2.27 1.68 102 T_FILL_THIS_FORM_SHORT 2037 1.17 2.23 0.60 103 SUBJ_ALL_CAPS 2028 1.36 2.22 0.89 104 XMBody_17 1999 1.20 2.18 0.66 105 XMBrknScrpt_02 1985 1.39 2.17 0.97 106 T_XMHurry_00 1972 1.15 2.15 0.61 107 FROM_EXCESS_BASE64 1970 2.02 2.15 1.95 108 DIET_1 1900 0.98 2.08 0.38 109 MAILING_LIST_MULTI 1886 2.09 2.06 2.11 110 T_TooManySym_01 1739 5.61 1.90 7.64 111 TM2_M_URI_OPT_OUT 1729 1.90 1.89 1.91 112 SpammyFromTLD_01 1682 0.91 1.84 0.40 113 HTML_MIME_NO_HTML_TAG 1668 1.72 1.82 1.66 114 XM_B_COPY_HTML 1657 1.48 1.81 1.30 115 MIME_QP_LONG_LINE 1655 2.83 1.81 3.38 116 XM_HighProb1 1608 0.63 1.76 0.01 117 MPART_ALT_DIFF_COUNT 1595 1.04 1.74 0.65 118 TR_XM_INV_DKIM 1539 0.77 1.68 0.27 119 TR_Mismatch_TLD_01 1493 0.75 1.63 0.27 120 XMStockSpam_06 1438 1.58 1.57 1.58 121 THIS_AD 1434 0.76 1.57 0.31 122 SpammyFromTLD_02 1423 0.70 1.55 0.22 123 T_REMOTE_IMAGE 1417 2.71 1.55 3.35 124 DKIM_ADSP_NXDOMAIN 1415 0.88 1.55 0.51 125 RCVD_IN_PSBL 1395 0.85 1.52 0.48 126 BAYES_40 1395 3.76 1.52 4.99 127 URI_NOVOWEL 1348 1.65 1.47 1.74 128 TR_XM_PHPDW 1331 0.80 1.45 0.44 129 XM_B_Phish66 1322 0.71 1.44 0.31 130 TR_XM_PHPForged 1316 0.79 1.44 0.44 131 URI_HEX 1315 1.10 1.44 0.91 132 TR_XM_FormFill2 1300 0.79 1.42 0.44 133 XMReplyNow 1294 0.65 1.41 0.23 134 SHOPIFY_IMG_NOT_RCVD_SFY 1286 0.79 1.40 0.45 135 XM_H_PHPOS 1275 0.77 1.39 0.42 136 XM_ProductURIs 1275 0.94 1.39 0.69 137 XMPhish30 1254 0.99 1.37 0.78 138 HTTPS_HTTP_MISMATCH 1230 0.74 1.34 0.41 139 TR_XM_RelayPhish 1225 0.54 1.34 0.10 140 XMSubMetaI_00 1222 0.97 1.33 0.76 141 RCVD_IN_PBL 1208 0.79 1.32 0.50 142 XMBdyGiftCard01 1190 1.16 1.30 1.08 143 HTML_TAG_BALANCE_BODY 1180 0.91 1.29 0.70 144 BAYES_20 1172 2.62 1.28 3.35 145 TR_LOTS_OF_MONEY3 1167 0.71 1.27 0.39 146 URI_TRY_3LD 1158 0.83 1.26 0.59 147 MISSING_HEADERS 1150 0.59 1.26 0.22 148 KHOP_HELO_FCRDNS 1147 1.25 1.25 1.25 149 XMSlimDrugH 1129 0.77 1.23 0.52 150 XM_DIRTYINTL 1109 0.49 1.21 0.10 151 XM_B_REG_HTML 1101 0.68 1.20 0.39 152 TR_MetaPhish_Combo_01 1099 0.89 1.20 0.73 153 XM_SendGrid 1097 1.17 1.20 1.15 154 ANY_BOUNCE_MESSAGE 1075 2.99 1.17 3.98 155 BOUNCE_MESSAGE 1075 2.98 1.17 3.98 156 TM2_M_OBFU_COMMENT 1067 0.82 1.17 0.63 157 XM_UB99 1054 0.41 1.15 0.01 158 XM_H_Long_From02 1050 0.91 1.15 0.78 159 T_STY_INVIS_DIRECT 1018 0.88 1.11 0.75 160 LongTLD 982 0.52 1.07 0.21 161 BOTNET_NORDNS 960 0.38 1.05 0.02 162 XMGenDplmaNmb 956 0.71 1.04 0.53 163 DKIM_ADSP_CUSTOM_MED 949 0.91 1.04 0.85 164 PLING_QUERY 945 1.12 1.03 1.17 165 MultiRelay_CC 941 0.42 1.03 0.09 166 RDNS_DYNAMIC 893 0.52 0.98 0.27 167 XMSexyCombo_01 883 0.49 0.96 0.23 168 TR_Mismatch_TLD_02 874 0.38 0.95 0.07 169 J_POPCORN_WO_D 865 0.53 0.94 0.30 170 XMSolicitRefs_0 861 0.59 0.94 0.40 171 T_Symld_Words_02 856 0.52 0.94 0.30 172 HTML_IMAGE_ONLY_20 848 0.58 0.93 0.39 173 TVD_RCVD_IP 835 1.09 0.91 1.18 174 NML_ADSP_CUSTOM_MED 824 0.66 0.90 0.53 175 XM_B_SEO 820 0.47 0.90 0.24 176 FROM_MISSP_REPLYTO 805 0.31 0.88 0.00 177 XM_UB80 800 0.32 0.87 0.01 178 FORGED_GMAIL_RCVD 799 0.63 0.87 0.50 179 HELO_DYNAMIC_SPLIT_IP 799 0.31 0.87 0.01 180 PDS_RDNS_DYNAMIC_FP 783 0.33 0.86 0.05 181 REPLYTO_WITHOUT_TO_CC 778 0.32 0.85 0.02 182 XM_OfRef7 775 0.40 0.85 0.16 183 XMBody_78 769 0.52 0.84 0.35 184 RCVD_IN_XBL 769 0.31 0.84 0.02 185 XMSubMetaSxObfu_03 768 0.55 0.84 0.39 186 HTML_FONT_FACE_BAD 746 0.61 0.81 0.49 187 NORDNS_LOW_CONTRAST 744 0.31 0.81 0.03 188 XM_BadFromFormat 739 0.36 0.81 0.12 189 RELAYCOUNTRY_FR 739 0.41 0.81 0.19 190 TR_Caps_n_Bayes_99 738 0.30 0.81 0.02 191 XM_UB60 729 0.32 0.80 0.06 192 TR_XM_SEO4 721 0.33 0.79 0.08 193 TR_XM_Base64_L1 716 0.33 0.78 0.08 194 TRACKER_ID 708 0.40 0.77 0.20 195 XM_B_DNDMA 707 0.60 0.77 0.51 196 TR_Symld_Words 699 1.06 0.76 1.22 197 MIME_HEADER_CTYPE_ONLY 695 0.38 0.76 0.17 198 XM_GoogleGroups 678 1.02 0.74 1.18 199 TR_XM_FormFill 672 0.27 0.73 0.01 200 TR_XM_InvalidRelay 667 0.26 0.73 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 140829 88.25 95.57 84.24 2 RELAYCOUNTRY_US 134520 80.79 81.38 80.47 3 DKIM_SIGNED 129229 81.78 89.95 77.30 4 XM_DK_Pass 127249 79.92 86.85 76.12 5 DKIM_VALID 126224 79.40 86.52 75.51 6 XM_B_Unicode 122306 77.87 86.46 73.16 7 DKIM_VALID_AU 107195 66.36 70.44 64.12 8 BAYES_50 101274 51.79 35.74 60.58 9 XMListUnsubscribeExists 90852 60.36 71.35 54.35 10 DCC_CHECK_NEGATIVE 85845 40.33 20.20 51.35 11 DCC_CHECK 81263 59.49 79.35 48.61 12 XM_B_SpammyWords 77773 54.97 70.40 46.52 13 XM_B_Unicode3 77502 48.64 52.80 46.36 14 RCVD_IN_MSPIKE_H2 62658 38.57 40.56 37.48 15 LOC_TINY_FONT_1 56730 39.70 50.23 33.94 16 HTML_FONT_LOW_CONTRAST 53795 34.08 37.55 32.18 17 DKIM_VALID_EF 50040 29.68 29.22 29.93 18 FVGT_m_MULTI_ODD 45586 28.89 31.84 27.27 19 T_TM2_M_HEADER_IN_MSG 41923 22.99 19.19 25.08 20 XMSubLong 38661 22.74 22.03 23.13 21 MIME_HTML_ONLY 35788 23.69 27.87 21.41 22 T_KAM_HTML_FONT_INVALID 35555 25.21 32.42 21.27 23 XM_B_SpammyWords2 34307 27.44 40.06 20.52 24 USER_IN_DEF_DKIM_WL 30784 12.89 2.79 18.42 25 ALL_TRUSTED 26503 11.16 2.57 15.85 26 XM_Multi_Part_URI 26098 17.47 20.87 15.61 27 TR_XM_DK_Unsub 25433 17.76 22.40 15.21 28 UNPARSEABLE_RELAY 22111 15.26 18.98 13.23 29 XM_B_Unsub 16787 12.66 17.44 10.04 30 FSL_BULK_SIG 16697 10.08 10.25 9.99 31 BAYES_00 16474 6.60 0.65 9.85 32 XM_Evil_Numbers_Gen 16148 8.98 7.72 9.66 33 XM_DKIMWhitelistDomains 14962 5.80 0.04 8.95 34 T_SCC_BODY_TEXT_LINE 14080 8.31 8.10 8.42 35 BAYES_60 13407 8.35 8.94 8.02 36 T_TooManySym_01 12777 5.61 1.90 7.64 37 TR_XM_DK_Bayes 12494 5.01 0.51 7.47 38 TR_XM_DK_Bayes1 12381 4.96 0.50 7.41 39 TR_XM_BayesUnsub 12298 10.69 16.77 7.36 40 LotsOfNums_01 11838 6.72 6.05 7.08 41 XM_B_PhoneNumber 11552 6.11 4.65 6.91 42 XM_H_GMP 11134 5.97 4.70 6.66 43 TR_MAX_INTL_RELAY 11038 9.78 15.57 6.60 44 TR_XM_DK_Bayes2 10969 4.37 0.37 6.56 45 TooManyTo_001 10476 5.36 3.71 6.27 46 RCVD_IN_VALIDITY_SAFE 10313 5.06 3.04 6.17 47 XM_B_SpammyWords3 10149 9.14 14.75 6.07 48 XMStrtUSub 9928 5.46 4.59 5.94 49 XM_H_Long_From01 9687 5.64 5.35 5.79 50 XM_DK_Undo_02 9629 19.50 44.60 5.76 51 LOTS_OF_MONEY 9464 7.15 9.88 5.66 52 HTML_IMAGE_RATIO_02 9352 6.11 7.06 5.59 53 IN_ZIMBRA_NJ_WHITELIST 9116 3.55 0.08 5.45 54 MPART_ALT_DIFF 8520 5.58 6.46 5.10 55 HTML_IMAGE_RATIO_04 8427 4.93 4.74 5.04 56 BAYES_40 8336 3.76 1.52 4.99 57 RCVD_IN_MSPIKE_WL 8168 4.19 2.93 4.89 58 RCVD_IN_MSPIKE_H3 8162 4.19 2.93 4.88 59 XM_UncommonTLD01 8152 5.20 5.79 4.88 60 BAYES_99 7921 15.66 35.61 4.74 61 RCVD_IN_VALIDITY_CERTIFIED 7740 3.80 2.29 4.63 62 T_TooManySym_02 7736 3.16 0.48 4.63 63 XM_B_Phish_Phrases 7398 5.39 7.15 4.43 64 INVALID_MSGID 6749 2.75 0.40 4.04 65 ANY_BOUNCE_MESSAGE 6655 2.99 1.17 3.98 66 BOUNCE_MESSAGE 6645 2.98 1.17 3.98 67 TR_XM_SpammyWords4 6515 5.73 9.08 3.90 68 XMNumbers 6444 3.73 3.50 3.85 69 XMSubMetaSx_00 6368 4.91 6.93 3.81 70 BAYES_80 6368 5.89 9.68 3.81 71 RELAYCOUNTRY_META 6311 8.58 17.34 3.78 72 TO_MALFORMED 6278 2.44 0.03 3.76 73 BAYES_999 6143 12.29 28.02 3.67 74 BOTNET_IPINHOSTNAME 5813 6.13 10.96 3.48 75 MIME_QP_LONG_LINE 5658 2.83 1.81 3.38 76 BAYES_20 5599 2.62 1.28 3.35 77 T_REMOTE_IMAGE 5596 2.71 1.55 3.35 78 MIME_HTML_ONLY_MULTI 5153 3.19 3.39 3.08 79 XM_Body_Dirty_Words 4710 4.55 7.72 2.82 80 BAYES_95 4663 3.77 5.55 2.79 81 XM_B_SpammyTLD 4641 3.09 3.66 2.78 82 HTML_IMAGE_RATIO_08 4534 2.88 3.18 2.71 83 RCVD_IN_IADB_LISTED 4398 1.91 0.59 2.63 84 MIME_HTML_MOSTLY 4358 2.91 3.47 2.61 85 T_XMDrugObfuBody_14 4335 3.41 4.91 2.59 86 TooManyTo_002 4282 1.84 0.51 2.56 87 XM_PDF 4161 1.81 0.57 2.49 88 HTML_IMAGE_RATIO_06 4046 2.61 2.95 2.42 89 RCVD_IN_IADB_SPF 3931 1.71 0.54 2.35 90 TR_XM_SpammyRelay 3878 5.97 12.62 2.32 91 TR_XM_DKIM_Undo 3784 13.30 33.45 2.26 92 XM_CamelCaseFrm001 3754 3.05 4.52 2.25 93 RCVD_IN_IADB_SENDERID 3575 1.57 0.53 2.14 94 MAILING_LIST_MULTI 3529 2.09 2.06 2.11 95 T_TooManySym_03 3505 1.41 0.15 2.10 96 RCVD_IN_IADB_DK 3491 1.53 0.52 2.09 97 TR_DCC_Bayes_99 3368 10.70 26.56 2.01 98 FROM_EXCESS_BASE64 3256 2.02 2.15 1.95 99 TM2_M_URI_OPT_OUT 3188 1.90 1.89 1.91 100 BAYES_05 3121 1.41 0.59 1.87 101 TR_XM_PhishingBody 3121 2.83 4.60 1.87 102 RCVD_IN_IADB_VOUCHED 3062 1.27 0.24 1.83 103 DKIM_INVALID 3005 2.38 3.43 1.80 104 XM_DK_Undo_01 2948 1.97 2.36 1.76 105 URI_NOVOWEL 2915 1.65 1.47 1.74 106 TR_XM_UnparsRelay 2879 4.93 10.78 1.72 107 UNTRUSTED_Relay 2859 3.47 6.68 1.71 108 IN_HORDE_ADDRESS_BOOK 2810 1.11 0.08 1.68 109 XM_B_URI_Unicode 2801 1.89 2.27 1.68 110 XMSexyCombo_05 2794 2.71 4.60 1.67 111 HTML_MIME_NO_HTML_TAG 2774 1.72 1.82 1.66 112 RELAYCOUNTRY_CA 2694 3.70 7.52 1.61 113 XMStockSpam_06 2647 1.58 1.57 1.58 114 TVD_SPACE_RATIO 2588 1.06 0.18 1.55 115 XM_B_Investor 2563 2.13 3.21 1.53 116 TM2_M_VERY_LONG_WORD 2468 2.03 3.03 1.48 117 XMGappySubj_01 2231 0.94 0.22 1.33 118 T_XMDrugObfuBody_08 2222 1.85 2.81 1.33 119 RCVD_IN_IADB_OPTIN 2204 0.91 0.15 1.32 120 XM_B_COPY_HTML 2175 1.48 1.81 1.30 121 XM_B_Unsub2 2098 2.00 3.35 1.26 122 KHOP_HELO_FCRDNS 2097 1.25 1.25 1.25 123 T_TVD_MIME_NO_HEADERS 2053 0.81 0.05 1.23 124 TR_Symld_Words 2037 1.06 0.76 1.22 125 TVD_RCVD_IP 1973 1.09 0.91 1.18 126 XM_GoogleGroups 1972 1.02 0.74 1.18 127 PLING_QUERY 1951 1.12 1.03 1.17 128 XM_B_FormFill 1943 0.76 0.01 1.16 129 TR_XM_SpammyWords5 1926 2.14 3.94 1.15 130 XM_SendGrid 1924 1.17 1.20 1.15 131 HTML_EXTRA_CLOSE 1919 0.76 0.04 1.15 132 XMDiploma_00 1919 1.55 2.28 1.15 133 BOTNET 1891 4.52 10.70 1.13 134 XMGappySubj_02 1849 0.74 0.06 1.11 135 XMBdyGiftCard01 1806 1.16 1.30 1.08 136 TooManyTo_003 1724 0.84 0.48 1.03 137 XM_SPF_SoftFail 1684 1.66 2.84 1.01 138 XMBrknScrpt_02 1618 1.39 2.17 0.97 139 XM_UB50 1554 1.62 2.88 0.93 140 URI_HEX 1523 1.10 1.44 0.91 141 T_XMDrugObfuBody_00 1485 1.51 2.64 0.89 142 SUBJ_ALL_CAPS 1484 1.36 2.22 0.89 143 DKIM_ADSP_CUSTOM_MED 1417 0.91 1.04 0.85 144 HELO_MISC_IP 1391 0.56 0.05 0.83 145 TR_XM_DK_SendGrid 1375 0.77 0.69 0.82 146 XMLngstWrd_00 1363 0.61 0.25 0.82 147 XM_OfRef6 1354 1.59 3.01 0.81 148 XM_B_SpammyWords4 1338 1.78 3.58 0.80 149 TooManyTo_004 1337 0.68 0.46 0.80 150 XMBSHREFv2 1314 0.59 0.23 0.79 151 XM_H_Long_From02 1305 0.91 1.15 0.78 152 XMPhish30 1304 0.99 1.37 0.78 153 XMSubMetaI_00 1277 0.97 1.33 0.76 154 T_STY_INVIS_DIRECT 1257 0.88 1.11 0.75 155 XM_H_PHPMailer 1234 0.72 0.69 0.74 156 TR_MetaPhish_Combo_01 1214 0.89 1.20 0.73 157 T_TooManySym_04 1181 0.46 0.02 0.71 158 HTML_TAG_BALANCE_BODY 1178 0.91 1.29 0.70 159 XM_ProductURIs 1160 0.94 1.39 0.69 160 TooManyTo_005 1158 0.61 0.45 0.69 161 USER_IN_WHITELIST 1134 0.44 0.00 0.68 162 USER_IN_WELCOMELIST 1134 0.44 0.00 0.68 163 XMBody_17 1097 1.20 2.18 0.66 164 XMNoVowels 1088 0.61 0.54 0.65 165 MPART_ALT_DIFF_COUNT 1087 1.04 1.74 0.65 166 TM2_M_OBFU_COMMENT 1057 0.82 1.17 0.63 167 T_XMHurry_00 1015 1.15 2.15 0.61 168 TR_XM_Base64_M1 1007 0.61 0.62 0.60 169 T_FILL_THIS_FORM_SHORT 995 1.17 2.23 0.60 170 URI_TRY_3LD 990 0.83 1.26 0.59 171 XM_ShortIntro_01 969 0.52 0.41 0.58 172 XMBody_95 906 0.39 0.10 0.54 173 NML_ADSP_CUSTOM_MED 894 0.66 0.90 0.53 174 XMGenDplmaNmb 880 0.71 1.04 0.53 175 XMSlimDrugH 866 0.77 1.23 0.52 176 XM_Ancestry_Forge 859 0.34 0.01 0.51 177 XM_B_DNDMA 857 0.60 0.77 0.51 178 DKIM_ADSP_NXDOMAIN 857 0.88 1.55 0.51 179 TR_XM_SpammyWords2 854 4.96 13.08 0.51 180 RCVD_IN_PBL 830 0.79 1.32 0.50 181 FORGED_GMAIL_RCVD 829 0.63 0.87 0.50 182 HTML_FONT_FACE_BAD 826 0.61 0.81 0.49 183 RCVD_IN_BL_SPAMCOP_NET 824 3.09 7.83 0.49 184 RCVD_IN_PSBL 796 0.85 1.52 0.48 185 XMSubNoVowel 780 0.48 0.49 0.47 186 XM_S_SubURI 775 0.32 0.05 0.46 187 NO_DNS_FOR_FROM 771 0.44 0.39 0.46 188 XMHTML_After_End 770 0.49 0.54 0.46 189 XMPhish08 752 0.52 0.66 0.45 190 SHOPIFY_IMG_NOT_RCVD_SFY 749 0.79 1.40 0.45 191 TR_XM_PHPDW 735 0.80 1.45 0.44 192 TR_XM_FormFill2 734 0.79 1.42 0.44 193 TR_XM_PHPForged 732 0.79 1.44 0.44 194 XM_URI_RBL 732 1.53 3.52 0.44 195 XMCapTrack 727 0.39 0.30 0.43 196 MSGID_FROM_MTA_HEADER 725 0.32 0.12 0.43 197 XM_H_PHPOS 706 0.77 1.39 0.42 198 RELAYCOUNTRY_AU 691 1.23 2.72 0.41 199 HTTPS_HTTP_MISMATCH 679 0.74 1.34 0.41 200 SpammyFromTLD_01 669 0.91 1.84 0.40 ----------------------------------------------------------------------