Email: 260611 Autolearn: 0 AvgScore: 5.20 AvgScanTime: 1.29 sec Spam: 96660 Autolearn: 0 AvgScore: 14.00 AvgScanTime: 1.35 sec Ham: 163951 Autolearn: 0 AvgScore: 0.01 AvgScanTime: 1.25 sec Time Spent Running SA: 93.16 hours Time Spent Processing Spam: 36.28 hours Time Spent Processing Ham: 56.89 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 92753 87.95 95.96 83.22 2 DKIM_SIGNED 87019 81.44 90.03 76.39 3 XM_DK_Pass 83335 79.33 86.21 75.28 4 DKIM_VALID 83066 78.92 85.94 74.79 5 XM_B_Unicode 78897 74.99 81.62 71.07 6 RELAYCOUNTRY_US 78742 81.15 81.46 80.97 7 DCC_CHECK 73776 58.63 76.33 48.20 8 XMListUnsubscribeExists 64849 58.39 67.09 53.25 9 XM_B_SpammyWords 63408 52.95 65.60 45.49 10 DKIM_VALID_AU 63332 64.35 65.52 63.66 11 XM_B_Unicode3 47442 46.78 49.08 45.43 12 LOC_TINY_FONT_1 44088 37.84 45.61 33.26 13 XM_DK_Undo_02 42923 20.34 44.41 6.16 14 T_SCC_BODY_TEXT_LINE 39074 41.59 40.42 42.28 15 XM_B_SpammyWords2 37656 27.30 38.96 20.43 16 RCVD_IN_MSPIKE_H2 36094 32.87 37.34 30.23 17 BAYES_99 35089 16.76 36.30 5.23 18 BAYES_50 34986 51.71 36.19 60.85 19 T_KAM_HTML_FONT_INVALID 34849 26.57 36.05 20.98 20 HTML_FONT_LOW_CONTRAST 34595 32.06 35.79 29.86 21 FVGT_m_MULTI_ODD 31634 29.37 32.73 27.39 22 MIME_HTML_ONLY 28756 25.76 29.75 23.41 23 BAYES_999 28022 13.42 28.99 4.24 24 TR_XM_DKIM_Undo 27909 12.25 28.87 2.44 25 DKIM_VALID_EF 27450 29.62 28.40 30.34 26 TR_DCC_Bayes_99 23714 10.26 24.53 1.84 27 DCC_CHECK_NEGATIVE 22431 41.17 23.21 51.76 28 TR_XM_DK_Unsub 21332 18.09 22.07 15.75 29 RELAYCOUNTRY_META 19338 9.66 20.01 3.56 30 XMSubLong 19275 22.07 19.94 23.33 31 XM_Multi_Part_URI 19195 17.32 19.86 15.82 32 XM_B_Unsub 18446 13.94 19.08 10.91 33 T_TM2_M_HEADER_IN_MSG 18284 21.89 18.92 23.64 34 TR_XM_BayesUnsub 17724 11.40 18.34 7.32 35 UNPARSEABLE_RELAY 17044 14.85 17.63 13.21 36 XM_B_SpammyWords3 14443 9.43 14.94 6.18 37 TR_MAX_INTL_RELAY 14341 9.48 14.84 6.32 38 TR_XM_SpammyRelay 12656 6.19 13.09 2.13 39 TR_XM_SpammyWords2 11870 4.93 12.28 0.60 40 FSL_BULK_SIG 11817 11.29 12.23 10.74 41 BOTNET_IPINHOSTNAME 11512 6.69 11.91 3.61 42 BOTNET 9754 4.50 10.09 1.21 43 LOTS_OF_MONEY 9590 7.64 9.92 6.30 44 TR_XM_UnparsRelay 9073 4.58 9.39 1.74 45 XM_UncommonTLD01 8906 6.68 9.21 5.18 46 BAYES_80 8766 5.73 9.07 3.75 47 RCVD_IN_BL_SPAMCOP_NET 8490 3.60 8.78 0.55 48 TR_XM_SpammyWords4 8436 5.92 8.73 4.27 49 XM_Body_Dirty_Words 8144 4.70 8.43 2.51 50 XM_Evil_Numbers_Gen 7827 9.23 8.10 9.89 51 BAYES_60 7782 7.28 8.05 6.83 52 XM_B_SpammyTLD 7707 4.90 7.97 3.09 53 HTML_IMAGE_RATIO_02 7558 6.66 7.82 5.97 54 RELAYCOUNTRY_CA 7483 3.74 7.74 1.37 55 UNTRUSTED_Relay 7027 3.70 7.27 1.59 56 XM_B_Phish_Phrases 6953 5.85 7.19 5.06 57 XMSubMetaSx_00 6787 5.97 7.02 5.35 58 MPART_ALT_DIFF 5554 5.38 5.75 5.17 59 TooManyTo_001 5541 6.61 5.73 7.13 60 LotsOfNums_01 5304 6.71 5.49 7.43 61 TR_XM_SPAMCOP 5235 2.14 5.42 0.22 62 BAYES_95 5208 3.61 5.39 2.56 63 TR_XM_PhishingBody 5018 3.03 5.19 1.75 64 TR_XM_NoHeaderRelay 4957 2.17 5.13 0.43 65 TR_Symld_Words 4895 2.81 5.06 1.49 66 XM_H_GMP 4822 6.08 4.99 6.73 67 XMSexyCombo_05 4692 3.12 4.85 2.09 68 HTML_IMAGE_RATIO_04 4678 4.74 4.84 4.68 69 XM_H_Long_From01 4525 5.11 4.68 5.37 70 XMStrtUSub 4447 5.94 4.60 6.73 71 T_XMDrugObfuBody_14 4323 2.96 4.47 2.06 72 XM_CamelCaseFrm001 4308 3.26 4.46 2.55 73 RCVD_IN_VALIDITY_RPBL 4197 1.64 4.34 0.04 74 XM_UB50 4108 2.14 4.25 0.89 75 DKIM_INVALID 3953 2.52 4.09 1.60 76 TR_XM_SpoofStaff 3917 1.64 4.05 0.22 77 XM_H_SpoofStaff4 3852 1.62 3.99 0.22 78 XMSpoofStaff2 3840 1.59 3.97 0.19 79 TR_XM_PSC1 3835 1.59 3.97 0.19 80 XM_B_PhoneNumber 3725 5.85 3.85 7.03 81 XM_B_Investor 3656 2.33 3.78 1.47 82 T_XMDrugObfuBody_08 3503 2.23 3.62 1.41 83 TR_XM_SpammyWords5 3474 2.27 3.59 1.48 84 XM_OfRef6 3460 1.96 3.58 1.00 85 MIME_HTML_MOSTLY 3401 3.02 3.52 2.73 86 ANY_BOUNCE_MESSAGE 3220 4.04 3.33 4.46 87 BOUNCE_MESSAGE 3219 4.04 3.33 4.46 88 DKIM_ADSP_NXDOMAIN 3208 1.55 3.32 0.50 89 HTML_IMAGE_RATIO_06 3117 2.79 3.22 2.54 90 TM2_M_VERY_LONG_WORD 3110 2.26 3.22 1.69 91 MIME_QP_LONG_LINE 3101 3.36 3.21 3.44 92 XM_B_SpammyWords4 3068 1.88 3.17 1.12 93 XM_URI_RBL 2969 1.43 3.07 0.46 94 XMNumbers 2958 4.64 3.06 5.57 95 MIME_HTML_ONLY_MULTI 2957 3.08 3.06 3.10 96 XMBody_17 2740 1.40 2.83 0.55 97 RCVD_IN_VALIDITY_SAFE 2727 4.70 2.82 5.80 98 RCVD_IN_MSPIKE_WL 2718 4.10 2.81 4.85 99 RCVD_IN_MSPIKE_H3 2718 4.09 2.81 4.85 100 XMBounce_01 2716 1.05 2.81 0.02 101 XM_B_Unsub2 2697 1.91 2.79 1.39 102 TM2_M_URI_OPT_OUT 2695 2.22 2.79 1.89 103 SUBJ_ALL_CAPS 2606 1.83 2.70 1.31 104 USER_IN_DEF_DKIM_WL 2595 12.54 2.68 18.35 105 HTML_IMAGE_RATIO_08 2495 2.10 2.58 1.82 106 T_XMHurry_00 2486 1.46 2.57 0.80 107 RELAYCOUNTRY_AU 2452 1.34 2.54 0.63 108 T_FILL_THIS_FORM_SHORT 2420 1.38 2.50 0.71 109 XM_SPF_SoftFail 2397 1.52 2.48 0.95 110 XMDiploma_00 2249 1.61 2.33 1.19 111 TR_LOTS_OF_MONEY3 2191 1.13 2.27 0.46 112 XMBrknScrpt_02 2155 1.51 2.23 1.09 113 FROM_EXCESS_BASE64 2087 2.16 2.16 2.16 114 KHOP_HELO_FCRDNS 2062 1.71 2.13 1.46 115 XM_B_URI_Unicode 2045 1.75 2.12 1.53 116 XMStockSpam_06 2016 1.95 2.09 1.87 117 RCVD_IN_VALIDITY_CERTIFIED 1967 3.45 2.03 4.29 118 XM_B_Phish66 1727 0.88 1.79 0.34 119 SpammyFromTLD_01 1726 0.95 1.79 0.46 120 T_XMDrugObfuBody_00 1706 1.18 1.76 0.83 121 TR_XM_PHPDW 1705 0.87 1.76 0.35 122 ALL_TRUSTED 1702 10.42 1.76 15.53 123 XM_H_Long_From02 1687 1.21 1.75 0.89 124 TR_XM_PHPForged 1674 0.87 1.73 0.36 125 TR_XM_FormFill2 1671 0.87 1.73 0.36 126 MAILING_LIST_MULTI 1648 2.11 1.70 2.35 127 XM_H_PHPOS 1642 0.84 1.70 0.33 128 RELAYCOUNTRY_TH 1633 0.63 1.69 0.00 129 BAYES_40 1632 3.74 1.69 4.95 130 URI_NOVOWEL 1620 1.66 1.68 1.65 131 XMBdyGiftCard01 1579 1.24 1.63 1.01 132 XM_DK_Undo_01 1564 1.61 1.62 1.60 133 T_TooManySym_01 1508 5.42 1.56 7.69 134 SpammyFromTLD_02 1461 0.67 1.51 0.18 135 BAYES_20 1459 2.74 1.51 3.46 136 RELAYCOUNTRY_CN 1456 0.58 1.51 0.03 137 TR_XM_INV_DKIM 1448 0.69 1.50 0.21 138 XM_B_COPY_HTML 1385 1.13 1.43 0.96 139 URI_HEX 1366 1.16 1.41 1.02 140 XMPhish30 1359 1.01 1.41 0.78 141 XM_HighProb1 1333 0.51 1.38 0.01 142 RELAYCOUNTRY_FR 1328 0.64 1.37 0.21 143 RCVD_IN_PSBL 1324 0.92 1.37 0.65 144 SHOPIFY_IMG_NOT_RCVD_SFY 1299 0.73 1.34 0.37 145 HTML_MIME_NO_HTML_TAG 1287 1.54 1.33 1.66 146 T_REMOTE_IMAGE 1280 2.68 1.32 3.49 147 DIET_1 1228 0.71 1.27 0.38 148 XM_ProductURIs 1228 0.78 1.27 0.49 149 RCVD_IN_PBL 1213 0.76 1.25 0.47 150 BOTNET_NORDNS 1165 0.46 1.21 0.02 151 TR_XM_SpoofStaff2 1116 0.43 1.15 0.00 152 TM2_M_OBFU_COMMENT 1107 0.80 1.15 0.60 153 URI_TRY_3LD 1092 0.88 1.13 0.74 154 HTTPS_HTTP_MISMATCH 1091 0.66 1.13 0.38 155 LONG_JUNK_URI3 1083 0.43 1.12 0.03 156 TR_Mismatch_TLD_02 1071 0.46 1.11 0.07 157 LONG_JUNK_URI 1059 0.42 1.10 0.02 158 XMSubMetaI_00 1047 0.81 1.08 0.66 159 XM_UB99 1045 0.41 1.08 0.01 160 XM_H_DKIM_GOOG 1043 0.43 1.08 0.05 161 MPART_ALT_DIFF_COUNT 1037 0.79 1.07 0.63 162 XM_SendGrid 1012 1.13 1.05 1.18 163 RDNS_DYNAMIC 993 0.55 1.03 0.27 164 XMClaimOffer 990 0.44 1.02 0.09 165 THIS_AD 986 0.57 1.02 0.31 166 TVD_RCVD_IP 977 1.18 1.01 1.29 167 TR_MetaPhish_Combo_01 976 1.08 1.01 1.12 168 XMGenDplmaNmb 969 0.75 1.00 0.60 169 T_STY_INVIS_DIRECT 962 0.81 1.00 0.69 170 XMReplyNow 962 0.55 1.00 0.29 171 XM_B_DNDMA 960 0.80 0.99 0.68 172 HTML_TAG_BALANCE_BODY 956 0.79 0.99 0.67 173 XM_H_PHPMailer 951 0.94 0.98 0.92 174 XM_B_REG_HTML 935 0.53 0.97 0.28 175 DKIM_ADSP_CUSTOM_MED 929 0.85 0.96 0.78 176 XMSexyCombo_01 926 0.48 0.96 0.20 177 HTML_FONT_FACE_BAD 892 0.64 0.92 0.48 178 XM_DIRTYINTL 853 0.38 0.88 0.08 179 HELO_DYNAMIC_SPLIT_IP 843 0.34 0.87 0.03 180 J_POPCORN_WO_D 840 0.54 0.87 0.35 181 HTML_IMAGE_ONLY_20 832 0.59 0.86 0.43 182 XM_B_SEO 830 0.50 0.86 0.29 183 BAYES_05 822 1.57 0.85 2.00 184 TR_XM_FormFill 811 0.32 0.84 0.02 185 NML_ADSP_CUSTOM_MED 810 0.62 0.84 0.49 186 FORGED_GMAIL_RCVD 798 0.61 0.83 0.48 187 LongTLD 789 0.48 0.82 0.28 188 MultiRelay_CC 786 0.36 0.81 0.10 189 TR_XM_Base64_M1 778 0.71 0.80 0.65 190 TR_Mismatch_TLD_01 764 0.47 0.79 0.28 191 TR_XM_SEO4 758 0.36 0.78 0.11 192 XM_UB999 737 0.29 0.76 0.01 193 TR_XM_RelayPhish 731 0.33 0.76 0.08 194 T_MONEY_PERCENT 704 0.39 0.73 0.19 195 TR_LOTS_OF_MONEY2 704 0.39 0.73 0.19 196 XMPhish11 694 0.37 0.72 0.16 197 XM_UB60 693 0.29 0.72 0.04 198 TR_XM_InvalidRelay 691 0.27 0.71 0.01 199 HTML_FONT_TINY_NORDNS 683 0.28 0.71 0.02 200 XMBody_78 678 0.44 0.70 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 136447 87.95 95.96 83.22 2 RELAYCOUNTRY_US 132743 81.15 81.46 80.97 3 DKIM_SIGNED 125235 81.44 90.03 76.39 4 XM_DK_Pass 123415 79.33 86.21 75.28 5 DKIM_VALID 122617 78.92 85.94 74.79 6 XM_B_Unicode 116528 74.99 81.62 71.07 7 DKIM_VALID_AU 104368 64.35 65.52 63.66 8 BAYES_50 99771 51.71 36.19 60.85 9 XMListUnsubscribeExists 87309 58.39 67.09 53.25 10 DCC_CHECK_NEGATIVE 84853 41.17 23.21 51.76 11 DCC_CHECK 79032 58.63 76.33 48.20 12 XM_B_SpammyWords 74583 52.95 65.60 45.49 13 XM_B_Unicode3 74484 46.78 49.08 45.43 14 T_SCC_BODY_TEXT_LINE 69325 41.59 40.42 42.28 15 LOC_TINY_FONT_1 54532 37.84 45.61 33.26 16 DKIM_VALID_EF 49750 29.62 28.40 30.34 17 RCVD_IN_MSPIKE_H2 49563 32.87 37.34 30.23 18 HTML_FONT_LOW_CONTRAST 48953 32.06 35.79 29.86 19 FVGT_m_MULTI_ODD 44901 29.37 32.73 27.39 20 T_TM2_M_HEADER_IN_MSG 38751 21.89 18.92 23.64 21 MIME_HTML_ONLY 38379 25.76 29.75 23.41 22 XMSubLong 38253 22.07 19.94 23.33 23 T_KAM_HTML_FONT_INVALID 34401 26.57 36.05 20.98 24 XM_B_SpammyWords2 33503 27.30 38.96 20.43 25 USER_IN_DEF_DKIM_WL 30079 12.54 2.68 18.35 26 XM_Multi_Part_URI 25935 17.32 19.86 15.82 27 TR_XM_DK_Unsub 25825 18.09 22.07 15.75 28 ALL_TRUSTED 25466 10.42 1.76 15.53 29 UNPARSEABLE_RELAY 21663 14.85 17.63 13.21 30 XM_B_Unsub 17888 13.94 19.08 10.91 31 FSL_BULK_SIG 17605 11.29 12.23 10.74 32 BAYES_00 16975 6.71 0.52 10.35 33 XM_Evil_Numbers_Gen 16220 9.23 8.10 9.89 34 XM_DKIMWhitelistDomains 14813 5.70 0.04 9.04 35 T_TooManySym_01 12611 5.42 1.56 7.69 36 LotsOfNums_01 12189 6.71 5.49 7.43 37 TR_XM_BayesUnsub 11994 11.40 18.34 7.32 38 TR_XM_DK_Bayes 11892 4.71 0.40 7.25 39 TR_XM_DK_Bayes1 11752 4.66 0.40 7.17 40 TooManyTo_001 11685 6.61 5.73 7.13 41 XM_B_PhoneNumber 11519 5.85 3.85 7.03 42 BAYES_60 11191 7.28 8.05 6.83 43 XMStrtUSub 11030 5.94 4.60 6.73 44 XM_H_GMP 11029 6.08 4.99 6.73 45 TR_MAX_INTL_RELAY 10362 9.48 14.84 6.32 46 LOTS_OF_MONEY 10328 7.64 9.92 6.30 47 XM_B_SpammyWords3 10140 9.43 14.94 6.18 48 XM_DK_Undo_02 10093 20.34 44.41 6.16 49 TR_XM_DK_Bayes2 10006 3.91 0.18 6.10 50 HTML_IMAGE_RATIO_02 9790 6.66 7.82 5.97 51 IN_ZIMBRA_NJ_WHITELIST 9774 3.79 0.11 5.96 52 RCVD_IN_VALIDITY_SAFE 9509 4.70 2.82 5.80 53 XMNumbers 9133 4.64 3.06 5.57 54 XM_H_Long_From01 8803 5.11 4.68 5.37 55 XMSubMetaSx_00 8775 5.97 7.02 5.35 56 BAYES_99 8578 16.76 36.30 5.23 57 XM_UncommonTLD01 8493 6.68 9.21 5.18 58 MPART_ALT_DIFF 8478 5.38 5.75 5.17 59 XM_B_Phish_Phrases 8300 5.85 7.19 5.06 60 BAYES_40 8119 3.74 1.69 4.95 61 RCVD_IN_MSPIKE_WL 7955 4.10 2.81 4.85 62 RCVD_IN_MSPIKE_H3 7953 4.09 2.81 4.85 63 HTML_IMAGE_RATIO_04 7665 4.74 4.84 4.68 64 T_TooManySym_02 7626 3.11 0.49 4.65 65 ANY_BOUNCE_MESSAGE 7309 4.04 3.33 4.46 66 BOUNCE_MESSAGE 7305 4.04 3.33 4.46 67 RCVD_IN_VALIDITY_CERTIFIED 7032 3.45 2.03 4.29 68 TR_XM_SpammyWords4 6997 5.92 8.73 4.27 69 BAYES_999 6948 13.42 28.99 4.24 70 INVALID_MSGID 6663 2.69 0.35 4.06 71 TO_MALFORMED 6255 2.40 0.01 3.82 72 BAYES_80 6155 5.73 9.07 3.75 73 BOTNET_IPINHOSTNAME 5925 6.69 11.91 3.61 74 RELAYCOUNTRY_META 5844 9.66 20.01 3.56 75 T_REMOTE_IMAGE 5715 2.68 1.32 3.49 76 BAYES_20 5679 2.74 1.51 3.46 77 MIME_QP_LONG_LINE 5644 3.36 3.21 3.44 78 TooManyTo_002 5164 2.16 0.48 3.15 79 MIME_HTML_ONLY_MULTI 5076 3.08 3.06 3.10 80 XM_B_SpammyTLD 5064 4.90 7.97 3.09 81 MIME_HTML_MOSTLY 4477 3.02 3.52 2.73 82 XM_PDF 4389 1.83 0.40 2.68 83 BAYES_95 4202 3.61 5.39 2.56 84 XM_CamelCaseFrm001 4179 3.26 4.46 2.55 85 HTML_IMAGE_RATIO_06 4163 2.79 3.22 2.54 86 XM_Body_Dirty_Words 4110 4.70 8.43 2.51 87 TR_XM_DKIM_Undo 4004 12.25 28.87 2.44 88 RCVD_IN_IADB_LISTED 3892 1.70 0.56 2.37 89 MAILING_LIST_MULTI 3859 2.11 1.70 2.35 90 FROM_EXCESS_BASE64 3539 2.16 2.16 2.16 91 TR_XM_SpammyRelay 3487 6.19 13.09 2.13 92 RCVD_IN_IADB_SPF 3487 1.53 0.51 2.13 93 XMSexyCombo_05 3433 3.12 4.85 2.09 94 T_XMDrugObfuBody_14 3381 2.96 4.47 2.06 95 BAYES_05 3279 1.57 0.85 2.00 96 T_TooManySym_03 3205 1.28 0.13 1.95 97 RCVD_IN_IADB_SENDERID 3168 1.40 0.49 1.93 98 RCVD_IN_IADB_DK 3102 1.37 0.49 1.89 99 TM2_M_URI_OPT_OUT 3099 2.22 2.79 1.89 100 XMStockSpam_06 3063 1.95 2.09 1.87 101 TR_DCC_Bayes_99 3023 10.26 24.53 1.84 102 HTML_IMAGE_RATIO_08 2979 2.10 2.58 1.82 103 TR_XM_PhishingBody 2877 3.03 5.19 1.75 104 TR_XM_UnparsRelay 2854 4.58 9.39 1.74 105 XM_B_FormFill 2790 1.09 0.05 1.70 106 TM2_M_VERY_LONG_WORD 2767 2.26 3.22 1.69 107 HTML_MIME_NO_HTML_TAG 2721 1.54 1.33 1.66 108 IN_HORDE_ADDRESS_BOOK 2717 1.08 0.11 1.66 109 URI_NOVOWEL 2709 1.66 1.68 1.65 110 TVD_SPACE_RATIO 2644 1.09 0.20 1.61 111 XM_DK_Undo_01 2630 1.61 1.62 1.60 112 DKIM_INVALID 2618 2.52 4.09 1.60 113 UNTRUSTED_Relay 2610 3.70 7.27 1.59 114 RCVD_IN_IADB_VOUCHED 2524 1.06 0.26 1.54 115 XM_B_URI_Unicode 2513 1.75 2.12 1.53 116 TR_Symld_Words 2441 2.81 5.06 1.49 117 TR_XM_SpammyWords5 2431 2.27 3.59 1.48 118 XM_B_Investor 2405 2.33 3.78 1.47 119 KHOP_HELO_FCRDNS 2397 1.71 2.13 1.46 120 T_TVD_MIME_NO_HEADERS 2386 0.93 0.04 1.46 121 T_XMDrugObfuBody_08 2318 2.23 3.62 1.41 122 XM_B_Unsub2 2284 1.91 2.79 1.39 123 RELAYCOUNTRY_CA 2254 3.74 7.74 1.37 124 SUBJ_ALL_CAPS 2155 1.83 2.70 1.31 125 TVD_RCVD_IP 2111 1.18 1.01 1.29 126 XM_GoogleGroups 2073 1.05 0.68 1.26 127 XMGappySubj_01 2064 0.89 0.26 1.26 128 HTML_EXTRA_CLOSE 1980 0.78 0.06 1.21 129 BOTNET 1976 4.50 10.09 1.21 130 XMDiploma_00 1943 1.61 2.33 1.19 131 LOW_PRICE 1933 0.85 0.29 1.18 132 XM_SendGrid 1932 1.13 1.05 1.18 133 TR_MetaPhish_Combo_01 1838 1.08 1.01 1.12 134 XM_B_SpammyWords4 1833 1.88 3.17 1.12 135 TooManyTo_003 1816 0.85 0.42 1.11 136 XMBrknScrpt_02 1783 1.51 2.23 1.09 137 RCVD_IN_IADB_OPTIN 1768 0.73 0.13 1.08 138 URI_HEX 1665 1.16 1.41 1.02 139 XMBdyGiftCard01 1654 1.24 1.63 1.01 140 XM_OfRef6 1635 1.96 3.58 1.00 141 XMBSHREFv2 1627 0.80 0.48 0.99 142 XM_B_COPY_HTML 1566 1.13 1.43 0.96 143 XM_SPF_SoftFail 1561 1.52 2.48 0.95 144 XMGappySubj_02 1528 0.62 0.10 0.93 145 XM_H_PHPMailer 1507 0.94 0.98 0.92 146 XM_UB50 1461 2.14 4.25 0.89 147 XM_H_Long_From02 1455 1.21 1.75 0.89 148 T_XMDrugObfuBody_00 1366 1.18 1.76 0.83 149 TR_XM_DK_SendGrid 1350 0.72 0.54 0.82 150 TooManyTo_004 1349 0.66 0.39 0.82 151 T_XMHurry_00 1312 1.46 2.57 0.80 152 XMSubMetaSxObfu_03 1285 0.71 0.59 0.78 153 DKIM_ADSP_CUSTOM_MED 1279 0.85 0.96 0.78 154 XMPhish30 1275 1.01 1.41 0.78 155 URI_TRY_3LD 1210 0.88 1.13 0.74 156 TooManyTo_005 1174 0.58 0.36 0.72 157 T_FILL_THIS_FORM_SHORT 1164 1.38 2.50 0.71 158 T_STY_INVIS_DIRECT 1137 0.81 1.00 0.69 159 USER_IN_WELCOMELIST 1119 0.43 0.00 0.68 160 USER_IN_WHITELIST 1119 0.43 0.00 0.68 161 XM_B_DNDMA 1116 0.80 0.99 0.68 162 HTML_TAG_BALANCE_BODY 1098 0.79 0.99 0.67 163 XMSubMetaI_00 1076 0.81 1.08 0.66 164 TR_XM_Base64_M1 1072 0.71 0.80 0.65 165 RCVD_IN_PSBL 1068 0.92 1.37 0.65 166 RELAYCOUNTRY_AU 1040 1.34 2.54 0.63 167 MPART_ALT_DIFF_COUNT 1031 0.79 1.07 0.63 168 XMSlimDrugH 997 0.58 0.54 0.61 169 TM2_M_OBFU_COMMENT 983 0.80 1.15 0.60 170 XMGenDplmaNmb 981 0.75 1.00 0.60 171 TR_XM_SpammyWords2 980 4.93 12.28 0.60 172 XMBody_95 942 0.40 0.11 0.57 173 HELO_MISC_IP 921 0.36 0.02 0.56 174 T_TooManySym_04 916 0.37 0.04 0.56 175 XMBody_17 902 1.40 2.83 0.55 176 RCVD_IN_BL_SPAMCOP_NET 894 3.60 8.78 0.55 177 XMMoneyMeta_00 893 0.52 0.49 0.54 178 XMLngstWrd_00 892 0.46 0.32 0.54 179 XM_ShortIntro_01 867 0.50 0.44 0.53 180 XMNoVowels 861 0.56 0.62 0.53 181 T_OBFU_PDF_ATTACH 847 0.34 0.04 0.52 182 DKIM_ADSP_NXDOMAIN 826 1.55 3.32 0.50 183 XM_ProductURIs 808 0.78 1.27 0.49 184 NML_ADSP_CUSTOM_MED 798 0.62 0.84 0.49 185 FORGED_GMAIL_RCVD 791 0.61 0.83 0.48 186 XMLngstWrd_01 789 0.39 0.25 0.48 187 NO_DNS_FOR_FROM 786 0.45 0.40 0.48 188 HTML_FONT_FACE_BAD 780 0.64 0.92 0.48 189 RCVD_IN_PBL 776 0.76 1.25 0.47 190 XMHTML_After_End 775 0.49 0.51 0.47 191 FILL_THIS_FORM 764 0.42 0.33 0.47 192 XM_URI_RBL 760 1.43 3.07 0.46 193 MSGID_FROM_MTA_HEADER 755 0.32 0.09 0.46 194 TR_LOTS_OF_MONEY3 750 1.13 2.27 0.46 195 PLING_QUERY 748 0.48 0.53 0.46 196 SpammyFromTLD_01 746 0.95 1.79 0.46 197 XM_S_SubURI 742 0.32 0.10 0.45 198 XMSubMetaSSx_00 733 0.42 0.38 0.45 199 XMCapTrack 724 0.37 0.24 0.44 200 SUBJ_DOLLARS 708 0.50 0.62 0.43 ----------------------------------------------------------------------