Email: 256330 Autolearn: 0 AvgScore: 4.76 AvgScanTime: 1.31 sec Spam: 85369 Autolearn: 0 AvgScore: 13.61 AvgScanTime: 1.37 sec Ham: 170961 Autolearn: 0 AvgScore: 0.35 AvgScanTime: 1.29 sec Time Spent Running SA: 93.46 hours Time Spent Processing Spam: 32.38 hours Time Spent Processing Ham: 61.08 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 81240 88.08 95.16 84.54 2 DKIM_SIGNED 75284 78.63 88.19 73.86 3 XM_DK_Pass 72734 76.84 85.20 72.67 4 XM_B_Unicode 72640 76.50 85.09 72.21 5 DKIM_VALID 72219 76.35 84.60 72.23 6 RELAYCOUNTRY_US 68685 81.79 80.46 82.45 7 DCC_CHECK 66116 59.16 77.45 50.02 8 XM_B_SpammyWords 60378 56.16 70.73 48.89 9 XMListUnsubscribeExists 60129 59.06 70.43 53.39 10 DKIM_VALID_AU 58337 63.93 68.34 61.73 11 XM_B_Unicode3 44780 49.59 52.45 48.15 12 LOC_TINY_FONT_1 41534 38.88 48.65 34.00 13 XM_DK_Undo_02 36196 18.64 42.40 6.77 14 T_SCC_BODY_TEXT_LINE 34538 41.62 40.46 42.20 15 XM_B_SpammyWords2 34082 26.87 39.92 20.35 16 HTML_FONT_LOW_CONTRAST 33172 38.58 38.86 38.44 17 BAYES_50 30997 54.72 36.31 63.91 18 BAYES_99 30155 15.52 35.32 5.63 19 FVGT_m_MULTI_ODD 27608 28.31 32.34 26.29 20 TR_XM_DKIM_Undo 27172 13.25 31.83 3.98 21 DKIM_VALID_EF 25804 28.54 30.23 27.70 22 T_KAM_HTML_FONT_INVALID 25126 23.09 29.43 19.93 23 MIME_HTML_ONLY 24720 22.79 28.96 19.71 24 BAYES_999 23572 12.21 27.61 4.52 25 TR_DCC_Bayes_99 21288 10.25 24.94 2.92 26 XM_Multi_Part_URI 20003 18.77 23.43 16.44 27 DCC_CHECK_NEGATIVE 18881 40.68 22.12 49.95 28 TR_XM_DK_Unsub 18826 17.42 22.05 15.11 29 XMSubLong 18600 22.45 21.79 22.78 30 RELAYCOUNTRY_META 16056 8.75 18.81 3.72 31 T_TM2_M_HEADER_IN_MSG 15793 23.05 18.50 25.32 32 UNPARSEABLE_RELAY 15772 15.26 18.48 13.65 33 XM_B_Unsub 14872 12.13 17.42 9.50 34 TR_XM_BayesUnsub 14305 10.56 16.76 7.46 35 TR_MAX_INTL_RELAY 13529 9.46 15.85 6.27 36 RCVD_IN_MSPIKE_H2 12305 12.84 14.41 12.05 37 XM_B_SpammyWords3 11747 8.21 13.76 5.43 38 TR_XM_SpammyRelay 11355 5.76 13.30 2.00 39 TR_XM_SpammyWords2 11099 4.90 13.00 0.85 40 BOTNET_IPINHOSTNAME 10093 6.18 11.82 3.37 41 BOTNET 9234 4.37 10.82 1.15 42 TR_XM_UnparsRelay 9039 4.90 10.59 2.07 43 LOTS_OF_MONEY 8826 7.15 10.34 5.55 44 FSL_BULK_SIG 8375 9.40 9.81 9.20 45 BAYES_80 8336 5.69 9.76 3.66 46 BAYES_60 7858 7.38 9.20 6.47 47 TR_XM_SpammyWords4 7823 5.84 9.16 4.19 48 XM_Body_Dirty_Words 6922 5.30 8.11 3.90 49 RELAYCOUNTRY_CA 6846 3.64 8.02 1.45 50 RCVD_IN_MSPIKE_WL 6415 9.59 7.51 10.62 51 UNTRUSTED_Relay 6274 3.62 7.35 1.76 52 HTML_IMAGE_RATIO_02 6204 5.85 7.27 5.15 53 XM_B_Phish_Phrases 6079 6.20 7.12 5.74 54 XM_Evil_Numbers_Gen 6049 11.72 7.09 14.04 55 RCVD_IN_BL_SPAMCOP_NET 5898 2.83 6.91 0.80 56 XMSubMetaSx_00 5827 4.51 6.83 3.36 57 XM_UncommonTLD01 5387 5.38 6.31 4.91 58 MPART_ALT_DIFF 5332 4.72 6.25 3.96 59 LotsOfNums_01 5318 9.28 6.23 10.80 60 BAYES_95 4874 3.64 5.71 2.60 61 XM_H_Long_From01 4536 5.09 5.31 4.98 62 XM_H_GMP 4477 5.86 5.24 6.16 63 TM2_M_VERY_LONG_WORD 4360 6.43 5.11 7.09 64 XMSexyCombo_05 4233 3.33 4.96 2.52 65 TooManyTo_001 3974 4.92 4.66 5.06 66 HTML_IMAGE_RATIO_04 3716 4.84 4.35 5.08 67 MIME_HTML_MOSTLY 3683 3.25 4.31 2.71 68 T_XMDrugObfuBody_14 3680 2.92 4.31 2.22 69 TR_XM_NoHeaderRelay 3626 1.53 4.25 0.17 70 RCVD_IN_MSPIKE_H3 3586 5.01 4.20 5.41 71 XM_B_PhoneNumber 3586 4.96 4.20 5.33 72 TR_XM_PhishingBody 3413 2.55 4.00 1.83 73 RCVD_IN_VALIDITY_SAFE 3337 5.72 3.91 6.62 74 XM_B_SpammyTLD 3282 3.02 3.84 2.61 75 XM_CamelCaseFrm001 3234 2.85 3.79 2.38 76 XM_UB50 3192 1.90 3.74 0.99 77 RCVD_IN_MSPIKE_BL 3114 1.46 3.65 0.36 78 TR_XM_MSPIKECOMBO 3113 1.46 3.65 0.36 79 RCVD_IN_VALIDITY_RPBL 3082 1.22 3.61 0.03 80 DKIM_INVALID 3065 2.28 3.59 1.63 81 XMNumbers 3002 4.14 3.52 4.45 82 XMBody_17 2988 1.62 3.50 0.67 83 XM_B_Investor 2909 2.16 3.41 1.54 84 MIME_HTML_ONLY_MULTI 2906 2.66 3.40 2.29 85 XMStrtUSub 2905 4.54 3.40 5.10 86 T_XMHurry_00 2751 1.78 3.22 1.06 87 FROM_EXCESS_BASE64 2696 2.88 3.16 2.74 88 TR_XM_SpammyWords5 2690 2.28 3.15 1.84 89 XM_OfRef6 2661 1.80 3.12 1.15 90 HTML_IMAGE_RATIO_06 2599 3.11 3.04 3.14 91 T_FILL_THIS_FORM_SHORT 2586 1.44 3.03 0.64 92 RCVD_IN_VALIDITY_CERTIFIED 2561 4.55 3.00 5.33 93 XM_SPF_SoftFail 2390 1.53 2.80 0.90 94 ANY_BOUNCE_MESSAGE 2359 8.23 2.76 10.96 95 BOUNCE_MESSAGE 2352 8.22 2.76 10.96 96 XM_URI_RBL 2345 1.31 2.75 0.59 97 XM_B_Unsub2 2290 1.76 2.68 1.30 98 RELAYCOUNTRY_AU 2278 1.13 2.67 0.35 99 XMBrknScrpt_02 2270 1.71 2.66 1.24 100 RCVD_IN_MSPIKE_H5 2211 3.73 2.59 4.30 101 T_TooManySym_01 2206 6.15 2.58 7.93 102 ALL_TRUSTED 2100 10.17 2.46 14.01 103 HTML_IMAGE_RATIO_08 2078 2.45 2.43 2.45 104 MIME_QP_LONG_LINE 2066 2.63 2.42 2.73 105 MAILING_LIST_MULTI 2014 2.68 2.36 2.84 106 TM2_M_URI_OPT_OUT 1995 1.96 2.34 1.77 107 USER_IN_DEF_DKIM_WL 1957 12.66 2.29 17.84 108 T_XMDrugObfuBody_08 1945 1.59 2.28 1.25 109 XMDiploma_00 1940 1.52 2.27 1.14 110 XM_B_SpammyWords4 1902 1.51 2.23 1.15 111 KHOP_HELO_FCRDNS 1897 3.75 2.22 4.51 112 THIS_AD 1879 1.21 2.20 0.72 113 XM_B_URI_Unicode 1855 1.65 2.17 1.39 114 XMStockSpam_06 1842 1.84 2.16 1.68 115 SpammyFromTLD_01 1839 1.00 2.15 0.43 116 SHOPIFY_IMG_NOT_RCVD_SFY 1784 1.07 2.09 0.55 117 DKIM_ADSP_NXDOMAIN 1767 1.03 2.07 0.51 118 RCVD_IN_MSPIKE_L5 1693 0.66 1.98 0.00 119 SpammyFromTLD_02 1692 0.78 1.98 0.18 120 SUBJ_ALL_CAPS 1671 1.48 1.96 1.25 121 TR_XM_SPAMCOP 1669 0.76 1.96 0.16 122 RCVD_IN_PSBL 1668 0.99 1.95 0.51 123 TR_XM_SpammyWords3 1602 0.78 1.88 0.23 124 XMSubMetaI_00 1585 1.34 1.86 1.08 125 DIET_1 1521 0.97 1.78 0.57 126 XM_ProductURIs 1500 1.38 1.76 1.19 127 URI_HEX 1470 1.21 1.72 0.95 128 XM_B_COPY_HTML 1414 1.45 1.66 1.35 129 BOTNET_NORDNS 1387 0.55 1.62 0.01 130 TR_XM_INV_DKIM 1355 0.68 1.59 0.22 131 TR_XM_FormFill2 1346 0.70 1.58 0.27 132 TR_XM_PHPDW 1344 0.70 1.57 0.26 133 TR_XM_PHPForged 1343 0.70 1.57 0.27 134 RCVD_IN_PBL 1337 0.86 1.57 0.51 135 XM_H_PHPOS 1315 0.68 1.54 0.24 136 TR_LOTS_OF_MONEY3 1291 0.84 1.51 0.50 137 XM_B_REG_HTML 1223 0.68 1.43 0.31 138 RDNS_DYNAMIC 1216 0.66 1.42 0.28 139 XMSexyCombo_01 1208 0.66 1.42 0.29 140 HTML_TAG_BALANCE_BODY 1202 1.03 1.41 0.84 141 TVD_RCVD_IP 1191 1.24 1.40 1.16 142 TR_MetaPhish_Combo_01 1189 0.99 1.39 0.79 143 TR_Mismatch_TLD_02 1181 0.51 1.38 0.07 144 XMBounce_01 1165 0.46 1.36 0.01 145 XMPhish30 1164 1.01 1.36 0.83 146 MIME_CHARSET_FARAWAY 1159 2.11 1.36 2.49 147 XMSlimDrugH 1156 0.70 1.35 0.37 148 BAYES_40 1147 3.70 1.34 4.88 149 XM_DIRTYINTL 1122 0.49 1.31 0.08 150 T_REMOTE_IMAGE 1100 2.04 1.29 2.41 151 T_XMDrugObfuBody_00 1100 0.75 1.29 0.49 152 HELO_DYNAMIC_SPLIT_IP 1096 0.43 1.28 0.01 153 MPART_ALT_DIFF_COUNT 1095 0.90 1.28 0.71 154 XM_HighProb1 1081 0.43 1.27 0.01 155 XM_B_DNDMA 1067 1.12 1.25 1.06 156 URI_TRY_3LD 1039 0.73 1.22 0.49 157 XMBdyGiftCard01 1027 1.35 1.20 1.42 158 XM_H_Long_From02 1007 0.86 1.18 0.71 159 HTML_FONT_TINY_NORDNS 1004 0.41 1.18 0.03 160 TR_XM_InvalidRelay 994 0.40 1.16 0.01 161 TR_Symld_Words 993 1.03 1.16 0.97 162 T_STY_INVIS_DIRECT 988 0.79 1.16 0.61 163 HTML_MIME_NO_HTML_TAG 970 1.30 1.14 1.38 164 URI_NOVOWEL 968 1.45 1.13 1.61 165 CHARSET_FARAWAY_HEADER 963 1.94 1.13 2.34 166 RELAYCOUNTRY_TH 952 0.37 1.12 0.00 167 XM_SendGrid 944 1.12 1.11 1.13 168 XM_DK_Undo_01 941 1.32 1.10 1.43 169 XM_GoogleGroups 925 1.17 1.08 1.21 170 LongTLD 919 0.48 1.08 0.19 171 XMReplyNow 897 0.45 1.05 0.16 172 XM_UB99 896 0.35 1.05 0.00 173 XM_B_Phish66 882 0.53 1.03 0.27 174 TR_XM_Base64_M1 880 0.92 1.03 0.86 175 TR_XM_RelayPhish 879 0.40 1.03 0.09 176 MultiRelay_CC 874 0.41 1.02 0.10 177 XM_UB60 848 0.37 0.99 0.06 178 XMEqualsVooDoo_00 831 0.35 0.97 0.03 179 BAYES_20 823 2.21 0.96 2.83 180 XMEqualsVooDoo_01 823 0.32 0.96 0.00 181 HTTPS_HTTP_MISMATCH 823 0.57 0.96 0.38 182 XMEqualsVooDoo_02 822 0.32 0.96 0.00 183 XMEqualsVooDoo_03 821 0.32 0.96 0.00 184 TR_Mismatch_TLD_01 803 0.47 0.94 0.23 185 RCVD_IN_SBL_CSS 783 0.31 0.92 0.01 186 XM_H_PHPMailer 783 0.95 0.92 0.97 187 RELAYCOUNTRY_CN 780 0.34 0.91 0.05 188 DKIM_ADSP_CUSTOM_MED 769 0.80 0.90 0.76 189 XM_OfRef7 766 0.39 0.90 0.13 190 PDS_RDNS_DYNAMIC_FP 734 0.31 0.86 0.04 191 RCVD_IN_MSPIKE_L4 734 0.29 0.86 0.00 192 HTML_FONT_FACE_BAD 733 0.62 0.86 0.49 193 XMGenDplmaNmb 733 0.63 0.86 0.52 194 XMSubMetaSxObfu_03 722 0.57 0.85 0.44 195 NO_DNS_FOR_FROM 721 0.59 0.84 0.46 196 RELAYCOUNTRY_FR 703 0.43 0.82 0.24 197 PLING_QUERY 702 0.59 0.82 0.47 198 XM_RXBody 691 0.40 0.81 0.19 199 RCVD_IN_MSPIKE_L3 686 0.51 0.80 0.36 200 TR_XM_MaxWHORU 684 0.50 0.80 0.36 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144525 88.08 95.16 84.54 2 RELAYCOUNTRY_US 140961 81.79 80.46 82.45 3 DKIM_SIGNED 126280 78.63 88.19 73.86 4 XM_DK_Pass 124239 76.84 85.20 72.67 5 DKIM_VALID 123493 76.35 84.60 72.23 6 XM_B_Unicode 123453 76.50 85.09 72.21 7 BAYES_50 109258 54.72 36.31 63.91 8 DKIM_VALID_AU 105536 63.93 68.34 61.73 9 XMListUnsubscribeExists 91268 59.06 70.43 53.39 10 DCC_CHECK 85520 59.16 77.45 50.02 11 DCC_CHECK_NEGATIVE 85391 40.68 22.12 49.95 12 XM_B_SpammyWords 83589 56.16 70.73 48.89 13 XM_B_Unicode3 82324 49.59 52.45 48.15 14 T_SCC_BODY_TEXT_LINE 72139 41.62 40.46 42.20 15 HTML_FONT_LOW_CONTRAST 65710 38.58 38.86 38.44 16 LOC_TINY_FONT_1 58133 38.88 48.65 34.00 17 DKIM_VALID_EF 47354 28.54 30.23 27.70 18 FVGT_m_MULTI_ODD 44950 28.31 32.34 26.29 19 T_TM2_M_HEADER_IN_MSG 43281 23.05 18.50 25.32 20 XMSubLong 38942 22.45 21.79 22.78 21 XM_B_SpammyWords2 34794 26.87 39.92 20.35 22 T_KAM_HTML_FONT_INVALID 34072 23.09 29.43 19.93 23 MIME_HTML_ONLY 33703 22.79 28.96 19.71 24 USER_IN_DEF_DKIM_WL 30501 12.66 2.29 17.84 25 XM_Multi_Part_URI 28104 18.77 23.43 16.44 26 TR_XM_DK_Unsub 25832 17.42 22.05 15.11 27 XM_Evil_Numbers_Gen 24001 11.72 7.09 14.04 28 ALL_TRUSTED 23960 10.17 2.46 14.01 29 UNPARSEABLE_RELAY 23333 15.26 18.48 13.65 30 RCVD_IN_MSPIKE_H2 20602 12.84 14.41 12.05 31 ANY_BOUNCE_MESSAGE 18732 8.23 2.76 10.96 32 BOUNCE_MESSAGE 18731 8.22 2.76 10.96 33 LotsOfNums_01 18461 9.28 6.23 10.80 34 RCVD_IN_MSPIKE_WL 18156 9.59 7.51 10.62 35 XM_B_Unsub 16233 12.13 17.42 9.50 36 FSL_BULK_SIG 15721 9.40 9.81 9.20 37 XM_DKIMWhitelistDomains 15271 5.99 0.08 8.93 38 BAYES_00 14420 5.76 0.41 8.43 39 T_TooManySym_01 13558 6.15 2.58 7.93 40 TR_XM_BayesUnsub 12752 10.56 16.76 7.46 41 HTML_IMAGE_ONLY_32 12556 4.94 0.12 7.34 42 TR_XM_DK_Bayes 12146 4.84 0.32 7.10 43 TM2_M_VERY_LONG_WORD 12122 6.43 5.11 7.09 44 TR_XM_DK_Bayes1 12064 4.81 0.31 7.06 45 XM_DK_Undo_02 11572 18.64 42.40 6.77 46 RCVD_IN_VALIDITY_SAFE 11323 5.72 3.91 6.62 47 BAYES_60 11067 7.38 9.20 6.47 48 TR_XM_DK_Bayes2 10747 4.26 0.21 6.29 49 TR_MAX_INTL_RELAY 10717 9.46 15.85 6.27 50 XM_H_GMP 10535 5.86 5.24 6.16 51 XM_B_Phish_Phrases 9815 6.20 7.12 5.74 52 BAYES_99 9625 15.52 35.32 5.63 53 LOTS_OF_MONEY 9490 7.15 10.34 5.55 54 XM_B_SpammyWords3 9291 8.21 13.76 5.43 55 RCVD_IN_MSPIKE_H3 9249 5.01 4.20 5.41 56 XM_B_PhoneNumber 9120 4.96 4.20 5.33 57 RCVD_IN_VALIDITY_CERTIFIED 9107 4.55 3.00 5.33 58 IN_ZIMBRA_NJ_WHITELIST 9070 3.57 0.09 5.31 59 T_TooManySym_02 8877 3.69 0.67 5.19 60 HTML_IMAGE_RATIO_02 8796 5.85 7.27 5.15 61 XMStrtUSub 8721 4.54 3.40 5.10 62 HTML_IMAGE_RATIO_04 8682 4.84 4.35 5.08 63 TooManyTo_001 8650 4.92 4.66 5.06 64 XM_H_Long_From01 8512 5.09 5.31 4.98 65 XM_UncommonTLD01 8392 5.38 6.31 4.91 66 BAYES_40 8344 3.70 1.34 4.88 67 BAYES_999 7719 12.21 27.61 4.52 68 KHOP_HELO_FCRDNS 7714 3.75 2.22 4.51 69 XMNumbers 7616 4.14 3.52 4.45 70 RCVD_IN_MSPIKE_H5 7352 3.73 2.59 4.30 71 TR_XM_SpammyWords4 7156 5.84 9.16 4.19 72 TR_XM_DKIM_Undo 6800 13.25 31.83 3.98 73 MPART_ALT_DIFF 6762 4.72 6.25 3.96 74 XM_Body_Dirty_Words 6676 5.30 8.11 3.90 75 INVALID_MSGID 6498 2.67 0.41 3.80 76 MAY_BE_FORGED 6436 2.72 0.62 3.76 77 RELAYCOUNTRY_META 6368 8.75 18.81 3.72 78 TO_MALFORMED 6261 2.45 0.01 3.66 79 BAYES_80 6258 5.69 9.76 3.66 80 BOTNET_IPINHOSTNAME 5755 6.18 11.82 3.37 81 XMSubMetaSx_00 5740 4.51 6.83 3.36 82 HTML_IMAGE_RATIO_06 5369 3.11 3.04 3.14 83 TR_DCC_Bayes_99 4985 10.25 24.94 2.92 84 MAILING_LIST_MULTI 4860 2.68 2.36 2.84 85 BAYES_20 4840 2.21 0.96 2.83 86 FROM_EXCESS_BASE64 4678 2.88 3.16 2.74 87 MIME_QP_LONG_LINE 4663 2.63 2.42 2.73 88 MIME_HTML_MOSTLY 4641 3.25 4.31 2.71 89 XM_B_SpammyTLD 4458 3.02 3.84 2.61 90 BAYES_95 4453 3.64 5.71 2.60 91 XMSexyCombo_05 4311 3.33 4.96 2.52 92 MIME_CHARSET_FARAWAY 4260 2.11 1.36 2.49 93 HTML_IMAGE_RATIO_08 4197 2.45 2.43 2.45 94 T_TVD_MIME_NO_HEADERS 4154 1.64 0.05 2.43 95 T_REMOTE_IMAGE 4120 2.04 1.29 2.41 96 XM_CamelCaseFrm001 4070 2.85 3.79 2.38 97 CHARSET_FARAWAY_HEADER 4006 1.94 1.13 2.34 98 MIME_HTML_ONLY_MULTI 3919 2.66 3.40 2.29 99 T_XMDrugObfuBody_14 3793 2.92 4.31 2.22 100 RCVD_IN_IADB_LISTED 3679 1.62 0.54 2.15 101 T_TooManySym_03 3614 1.48 0.20 2.11 102 TR_XM_UnparsRelay 3531 4.90 10.59 2.07 103 TR_XM_SpammyRelay 3411 5.76 13.30 2.00 104 RCVD_IN_IADB_SPF 3252 1.43 0.49 1.90 105 XM_PDF 3183 1.41 0.50 1.86 106 TR_XM_SpammyWords5 3145 2.28 3.15 1.84 107 TR_XM_PhishingBody 3131 2.55 4.00 1.83 108 TM2_M_URI_OPT_OUT 3026 1.96 2.34 1.77 109 UNTRUSTED_Relay 3006 3.62 7.35 1.76 110 RCVD_IN_IADB_SENDERID 2919 1.30 0.48 1.71 111 XMStockSpam_06 2876 1.84 2.16 1.68 112 RCVD_IN_IADB_DK 2860 1.28 0.48 1.67 113 DKIM_INVALID 2787 2.28 3.59 1.63 114 URI_NOVOWEL 2752 1.45 1.13 1.61 115 TooManyTo_002 2739 1.26 0.58 1.60 116 BAYES_05 2690 1.23 0.55 1.57 117 XM_B_Investor 2633 2.16 3.41 1.54 118 IN_HORDE_ADDRESS_BOOK 2622 1.06 0.12 1.53 119 TVD_SPACE_RATIO 2593 1.07 0.18 1.52 120 RELAYCOUNTRY_CA 2480 3.64 8.02 1.45 121 RCVD_IN_IADB_VOUCHED 2446 1.02 0.21 1.43 122 XM_DK_Undo_01 2441 1.32 1.10 1.43 123 XMBdyGiftCard01 2427 1.35 1.20 1.42 124 XM_B_URI_Unicode 2368 1.65 2.17 1.39 125 HTML_MIME_NO_HTML_TAG 2365 1.30 1.14 1.38 126 XM_B_COPY_HTML 2304 1.45 1.66 1.35 127 XM_B_Unsub2 2229 1.76 2.68 1.30 128 SUBJ_ALL_CAPS 2133 1.48 1.96 1.25 129 T_XMDrugObfuBody_08 2129 1.59 2.28 1.25 130 XMBrknScrpt_02 2114 1.71 2.66 1.24 131 XMGappySubj_01 2111 0.92 0.28 1.23 132 XM_GoogleGroups 2074 1.17 1.08 1.21 133 XM_ProductURIs 2031 1.38 1.76 1.19 134 TVD_RCVD_IP 1988 1.24 1.40 1.16 135 XM_B_SpammyWords4 1973 1.51 2.23 1.15 136 XM_OfRef6 1963 1.80 3.12 1.15 137 BOTNET 1962 4.37 10.82 1.15 138 XMDiploma_00 1949 1.52 2.27 1.14 139 XM_SendGrid 1935 1.12 1.11 1.13 140 XMSubMetaI_00 1843 1.34 1.86 1.08 141 T_XMHurry_00 1815 1.78 3.22 1.06 142 XM_B_DNDMA 1811 1.12 1.25 1.06 143 RCVD_IN_IADB_OPTIN 1727 0.73 0.16 1.01 144 XMNoVowels 1717 0.83 0.48 1.00 145 XMGappySubj_02 1711 0.72 0.16 1.00 146 XM_UB50 1686 1.90 3.74 0.99 147 TR_Symld_Words 1659 1.03 1.16 0.97 148 XM_H_PHPMailer 1658 0.95 0.92 0.97 149 URI_HEX 1627 1.21 1.72 0.95 150 RCVD_IN_MSPIKE_H4 1555 0.85 0.72 0.91 151 XM_SPF_SoftFail 1539 1.53 2.80 0.90 152 TM2_M_OBFU_COMMENT 1529 0.81 0.64 0.89 153 TooManyTo_003 1490 0.76 0.54 0.87 154 TR_XM_Base64_M1 1471 0.92 1.03 0.86 155 XMBSHREFv2 1451 0.66 0.29 0.85 156 TR_XM_SpammyWords2 1451 4.90 13.00 0.85 157 TR_XM_DK_SendGrid 1435 0.80 0.71 0.84 158 HTML_TAG_BALANCE_BODY 1431 1.03 1.41 0.84 159 XMPhish30 1419 1.01 1.36 0.83 160 RCVD_IN_BL_SPAMCOP_NET 1360 2.83 6.91 0.80 161 TR_MetaPhish_Combo_01 1344 0.99 1.39 0.79 162 DKIM_ADSP_CUSTOM_MED 1293 0.80 0.90 0.76 163 XMBody_95 1263 0.53 0.12 0.74 164 THIS_AD 1232 1.21 2.20 0.72 165 T_TooManySym_04 1231 0.49 0.03 0.72 166 MPART_ALT_DIFF_COUNT 1220 0.90 1.28 0.71 167 XM_H_Long_From02 1208 0.86 1.18 0.71 168 SUBJ_DOLLARS 1187 0.68 0.66 0.69 169 XMBody_17 1153 1.62 3.50 0.67 170 USER_IN_WHITELIST 1109 0.43 0.00 0.65 171 USER_IN_WELCOMELIST 1109 0.43 0.00 0.65 172 T_FILL_THIS_FORM_SHORT 1100 1.44 3.03 0.64 173 TooManyTo_004 1086 0.59 0.51 0.64 174 T_STY_INVIS_DIRECT 1046 0.79 1.16 0.61 175 XM_URI_RBL 1003 1.31 2.75 0.59 176 DIET_1 966 0.97 1.78 0.57 177 HELO_MISC_IP 949 0.38 0.04 0.56 178 SHOPIFY_IMG_NOT_RCVD_SFY 946 1.07 2.09 0.55 179 XMLngstWrd_00 943 0.46 0.28 0.55 180 TooManyTo_005 908 0.52 0.49 0.53 181 XMGenDplmaNmb 887 0.63 0.86 0.52 182 RCVD_IN_PBL 876 0.86 1.57 0.51 183 RCVD_IN_PSBL 874 0.99 1.95 0.51 184 DKIM_ADSP_NXDOMAIN 865 1.03 2.07 0.51 185 MSGID_FROM_MTA_HEADER 863 0.40 0.18 0.50 186 TR_LOTS_OF_MONEY3 858 0.84 1.51 0.50 187 URI_TRY_3LD 845 0.73 1.22 0.49 188 HTML_FONT_FACE_BAD 844 0.62 0.86 0.49 189 T_XMDrugObfuBody_00 833 0.75 1.29 0.49 190 HTML_TAG_BALANCE_CENTER 819 0.52 0.60 0.48 191 FORGED_GMAIL_RCVD 814 0.53 0.65 0.48 192 PLING_QUERY 805 0.59 0.82 0.47 193 XMPhish14 795 0.55 0.73 0.47 194 NO_DNS_FOR_FROM 791 0.59 0.84 0.46 195 XMHTML_After_End 773 0.52 0.66 0.45 196 XM_S_SubURI 768 0.32 0.06 0.45 197 XMLngstWrd_01 764 0.38 0.24 0.45 198 XMSolicitRefs_0 761 0.42 0.38 0.45 199 XM_Ancestry_Forge 753 0.30 0.01 0.44 200 XMSubMetaSxObfu_03 751 0.57 0.85 0.44 ----------------------------------------------------------------------