Email: 321157 Autolearn: 0 AvgScore: 5.57 AvgScanTime: 1.47 sec Spam: 109195 Autolearn: 0 AvgScore: 14.05 AvgScanTime: 1.67 sec Ham: 211962 Autolearn: 0 AvgScore: 1.21 AvgScanTime: 1.36 sec Time Spent Running SA: 130.74 hours Time Spent Processing Spam: 50.71 hours Time Spent Processing Ham: 80.04 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101097 88.48 92.58 86.37 2 DKIM_SIGNED 98061 79.69 89.80 74.48 3 XM_DK_Pass 93860 77.94 85.96 73.81 4 DKIM_VALID 93261 77.34 85.41 73.18 5 XM_B_Unicode 91534 77.97 83.83 74.95 6 RELAYCOUNTRY_US 89951 79.24 82.38 77.62 7 DCC_CHECK 84425 59.57 77.32 50.43 8 XMListUnsubscribeExists 75559 58.68 69.20 53.26 9 DKIM_VALID_AU 75236 64.24 68.90 61.84 10 XM_B_SpammyWords 74180 50.49 67.93 41.51 11 XM_B_Unicode3 58107 51.06 53.21 49.95 12 LOC_TINY_FONT_1 57337 39.90 52.51 33.40 13 XM_DK_Undo_02 43004 17.05 39.38 5.54 14 HTML_FONT_LOW_CONTRAST 42706 34.11 39.11 31.54 15 XM_B_SpammyWords2 42124 24.59 38.58 17.38 16 BAYES_50 42021 55.81 38.48 64.74 17 FVGT_m_MULTI_ODD 36978 28.75 33.86 26.11 18 BAYES_99 34247 13.56 31.36 4.39 19 DKIM_VALID_EF 31838 30.13 29.16 30.63 20 TR_XM_DKIM_Undo 30244 10.79 27.70 2.09 21 T_KAM_HTML_FONT_INVALID 29225 23.44 26.76 21.72 22 MIME_HTML_ONLY 28106 21.39 25.74 19.16 23 BAYES_999 26281 10.37 24.07 3.31 24 RCVD_IN_MSPIKE_H2 25496 19.04 23.35 16.82 25 XM_Multi_Part_URI 25246 17.70 23.12 14.90 26 TR_DCC_Bayes_99 24428 8.87 22.37 1.92 27 DCC_CHECK_NEGATIVE 24140 40.22 22.11 49.55 28 UNPARSEABLE_RELAY 23497 16.63 21.52 14.11 29 XMSubLong 22835 25.11 20.91 27.27 30 TR_XM_DK_Unsub 22678 18.10 20.77 16.73 31 T_TM2_M_HEADER_IN_MSG 22560 21.54 20.66 22.00 32 TR_MAX_INTL_RELAY 18451 10.00 16.90 6.45 33 XM_B_Unsub 17720 11.26 16.23 8.70 34 RELAYCOUNTRY_META 17639 7.81 16.15 3.51 35 TR_XM_BayesUnsub 16942 9.64 15.52 6.61 36 XM_B_SpammyWords3 16025 8.26 14.68 4.95 37 TR_XM_UnparsRelay 13089 5.43 11.99 2.06 38 BOTNET_IPINHOSTNAME 12855 6.48 11.77 3.75 39 LOTS_OF_MONEY 12775 7.14 11.70 4.80 40 XM_Evil_Numbers_Gen 12583 10.83 11.52 10.48 41 TR_XM_SpammyRelay 12065 4.87 11.05 1.69 42 TR_XM_SpammyWords4 11653 5.65 10.67 3.06 43 FSL_BULK_SIG 11109 12.45 10.17 13.63 44 BAYES_80 11066 5.99 10.13 3.86 45 TR_XM_SpammyWords2 10749 3.82 9.84 0.72 46 RCVD_IN_BL_SPAMCOP_NET 10575 3.69 9.68 0.61 47 BAYES_60 10319 8.12 9.45 7.44 48 BOTNET 9222 3.48 8.45 0.93 49 RCVD_IN_MSPIKE_WL 9122 13.84 8.35 16.67 50 XM_B_Phish_Phrases 9098 5.43 8.33 3.93 51 HTML_IMAGE_RATIO_02 8709 5.88 7.98 4.81 52 XM_Body_Dirty_Words 8582 4.66 7.86 3.01 53 UNTRUSTED_Relay 7445 3.64 6.82 2.00 54 LotsOfNums_01 7373 7.34 6.75 7.64 55 XM_UncommonTLD01 7338 5.28 6.72 4.54 56 MPART_ALT_DIFF 7319 5.42 6.70 4.77 57 HTML_IMAGE_RATIO_04 6820 4.92 6.25 4.24 58 BAYES_95 6803 3.83 6.23 2.59 59 XM_H_GMP 6499 6.32 5.95 6.51 60 XMSubMetaSx_00 6241 3.81 5.72 2.84 61 XM_H_Long_From01 6078 5.04 5.57 4.77 62 XMStrtUSub 5445 6.10 4.99 6.68 63 XM_B_SpammyTLD 5258 3.59 4.82 2.96 64 MIME_HTML_MOSTLY 5222 3.58 4.78 2.96 65 RELAYCOUNTRY_CA 5135 2.15 4.70 0.83 66 USER_IN_DEF_DKIM_WL 5020 12.03 4.60 15.85 67 XM_B_Investor 4842 2.26 4.43 1.13 68 DKIM_INVALID 4800 2.35 4.40 1.30 69 XM_SPF_SoftFail 4797 2.17 4.39 1.03 70 XM_B_PhoneNumber 4786 6.24 4.38 7.20 71 RCVD_IN_MSPIKE_H3 4637 6.36 4.25 7.45 72 TooManyTo_001 4596 5.40 4.21 6.01 73 T_XMDrugObfuBody_14 4529 2.64 4.15 1.87 74 TR_XM_PhishingBody 4524 2.34 4.14 1.41 75 TR_XM_SPAMCOP 4257 1.41 3.90 0.13 76 XM_OfRef6 4238 1.89 3.88 0.86 77 XM_CamelCaseFrm001 4197 2.60 3.84 1.97 78 XMSexyCombo_05 4180 1.92 3.83 0.93 79 TR_XM_SpammyWords5 3950 2.37 3.62 1.73 80 TR_XM_NoHeaderRelay 3950 1.37 3.62 0.21 81 XMBdyGiftCard01 3919 1.45 3.59 0.34 82 TM2_M_VERY_LONG_WORD 3748 2.05 3.43 1.33 83 SUBJ_ALL_CAPS 3682 2.29 3.37 1.73 84 RCVD_IN_PBL 3528 1.47 3.23 0.56 85 TM2_M_URI_OPT_OUT 3468 2.12 3.18 1.58 86 RCVD_IN_XBL 3457 1.08 3.17 0.01 87 RCVD_IN_MSPIKE_BL 3422 1.57 3.13 0.77 88 RCVD_IN_SBL_CSS 3422 1.08 3.13 0.02 89 XMStockSpam_06 3417 2.07 3.13 1.52 90 TR_XM_MSPIKECOMBO 3413 1.57 3.13 0.77 91 RCVD_IN_VALIDITY_SAFE 3388 4.34 3.10 4.98 92 XMNumbers 3381 3.87 3.10 4.28 93 MIME_HTML_ONLY_MULTI 3339 2.56 3.06 2.30 94 XM_UB50 3299 1.90 3.02 1.32 95 FROM_EXCESS_BASE64 3216 2.56 2.95 2.37 96 RELAYCOUNTRY_AU 3112 1.27 2.85 0.45 97 RCVD_IN_VALIDITY_RPBL 3083 1.00 2.82 0.06 98 T_XMHurry_00 3031 1.56 2.78 0.93 99 HTML_IMAGE_RATIO_06 3020 3.34 2.77 3.64 100 T_XMDrugObfuBody_08 2973 1.59 2.72 1.01 101 XM_URI_RBL 2877 1.22 2.63 0.49 102 XM_B_Unsub2 2788 1.75 2.55 1.34 103 T_TooManySym_01 2719 5.25 2.49 6.68 104 RCVD_IN_VALIDITY_CERTIFIED 2687 3.49 2.46 4.01 105 TR_XM_INV_DKIM 2672 0.85 2.45 0.03 106 SpammyFromTLD_01 2665 1.06 2.44 0.35 107 HTML_IMAGE_RATIO_08 2644 2.50 2.42 2.54 108 XMDiploma_00 2600 1.77 2.38 1.45 109 MIME_QP_LONG_LINE 2528 3.30 2.32 3.81 110 XMSubMetaI_00 2468 1.47 2.26 1.07 111 RCVD_IN_SBL 2458 0.77 2.25 0.00 112 SHOPIFY_IMG_NOT_RCVD_SFY 2429 1.05 2.22 0.44 113 RCVD_IN_SBL_DROP 2397 0.75 2.20 0.00 114 RCVD_IN_MSPIKE_H4 2361 2.88 2.16 3.25 115 XMBrknScrpt_02 2343 1.44 2.15 1.07 116 ALL_TRUSTED 2343 13.14 2.15 18.80 117 XM_B_URI_Unicode 2325 1.67 2.13 1.43 118 SpammyFromTLD_02 2243 0.83 2.05 0.20 119 MAILING_LIST_MULTI 2187 2.54 2.00 2.82 120 KHOP_HELO_FCRDNS 2132 1.78 1.95 1.69 121 MISSING_HEADERS 2131 0.82 1.95 0.23 122 RCVD_IN_MSPIKE_H5 2124 4.60 1.95 5.97 123 TR_XM_SpammyWords3 2018 0.85 1.85 0.34 124 XMSexyCombo_01 2013 0.70 1.84 0.12 125 XM_B_SpammyWords4 2010 1.09 1.84 0.71 126 MPART_ALT_DIFF_COUNT 2006 0.97 1.84 0.52 127 XM_OfRef7 1987 0.71 1.82 0.14 128 XMPhish30 1948 0.90 1.78 0.45 129 XM_H_Long_From02 1944 1.07 1.78 0.70 130 RCVD_IN_MSPIKE_L3 1915 1.02 1.75 0.64 131 T_REMOTE_IMAGE 1910 2.76 1.75 3.28 132 XMSubMetaSxObfu_03 1886 0.85 1.73 0.40 133 REPLYTO_WITHOUT_TO_CC 1842 0.58 1.69 0.01 134 THIS_AD 1831 0.91 1.68 0.52 135 TR_XM_GMP_BULK_SIG 1828 0.82 1.67 0.39 136 BAYES_40 1820 3.47 1.67 4.40 137 XMBody_17 1810 0.78 1.66 0.33 138 XMSubMetaSSx_00 1796 0.64 1.64 0.12 139 ADVANCE_FEE_4_NEW_MONEY 1751 0.55 1.60 0.00 140 DIET_1 1748 0.77 1.60 0.35 141 TR_Mismatch_TLD_02 1741 0.59 1.59 0.07 142 TR_XM_INTL_Spamhaus 1724 0.63 1.58 0.15 143 FORGED_MUA_OUTLOOK 1720 0.56 1.58 0.03 144 AXB_XMAILER_MIMEOLE_OL_024C2 1710 0.53 1.57 0.00 145 FROM_MISSP_XPRIO 1705 0.54 1.56 0.02 146 MultiRelay_CC 1699 0.62 1.56 0.14 147 UNCLAIMED_MONEY 1686 0.53 1.54 0.00 148 FROM_MISSPACED 1681 0.52 1.54 0.00 149 FROM_MISSP_MSFT 1667 0.52 1.53 0.00 150 STY_INVIS_DIRECT 1667 0.79 1.53 0.40 151 HTML_MIME_NO_HTML_TAG 1660 1.83 1.52 1.99 152 XM_OfRef8 1659 0.52 1.52 0.01 153 TR_XM_Base64_M1 1635 1.17 1.50 1.00 154 T_FILL_THIS_FORM_SHORT 1628 0.95 1.49 0.67 155 MONEY_FRAUD_5 1627 0.51 1.49 0.00 156 FSL_CTYPE_WIN1251 1592 0.50 1.46 0.00 157 XM_SendGrid 1582 1.44 1.45 1.44 158 RELAYCOUNTRY_FR 1573 0.70 1.44 0.32 159 XMGenDplmaNmb 1567 0.99 1.44 0.76 160 FSL_NEW_HELO_USER 1567 0.49 1.44 0.00 161 XMhairloss01 1505 0.48 1.38 0.01 162 XM_B_DNDMA 1502 0.88 1.38 0.62 163 RELAYCOUNTRY_GB 1494 0.81 1.37 0.53 164 URI_HEX 1491 1.15 1.37 1.04 165 XM_ProductURIs 1474 0.87 1.35 0.62 166 XM_DK_Undo_01 1460 1.46 1.34 1.53 167 XM_B_COPY_HTML 1450 1.11 1.33 1.00 168 SH_BODYURI_REVERSE_SBL 1448 0.46 1.33 0.01 169 URIBL_SBL_A 1446 0.45 1.32 0.01 170 URIBL_SBL 1446 0.45 1.32 0.01 171 URI_NOVOWEL 1400 1.31 1.28 1.33 172 T_XMDrugObfuBody_00 1394 0.88 1.28 0.68 173 TVD_RCVD_IP 1394 1.73 1.28 1.97 174 HTML_FONT_TINY_NORDNS 1369 0.44 1.25 0.03 175 XM_UB99 1367 0.43 1.25 0.00 176 RDNS_DYNAMIC 1367 0.54 1.25 0.18 177 TR_XM_PHPForged 1363 0.63 1.25 0.31 178 TR_XM_InvalidRelay 1357 0.43 1.24 0.01 179 PDS_RDNS_DYNAMIC_FP 1344 0.43 1.23 0.02 180 TR_XM_FormFill2 1338 0.62 1.23 0.31 181 TR_XM_PHPDW 1327 0.62 1.22 0.31 182 XM_B_SEO 1323 0.55 1.21 0.20 183 XM_H_PHPOS 1313 0.60 1.20 0.29 184 XM_B_Phish66 1253 0.65 1.15 0.40 185 XM_HighProb1 1235 0.38 1.13 0.00 186 BAYES_20 1227 2.24 1.12 2.81 187 BOTNET_NORDNS 1214 0.38 1.11 0.00 188 HTML_IMAGE_ONLY_20 1212 0.60 1.11 0.34 189 RCVD_IN_IADB_LISTED 1205 2.15 1.10 2.70 190 XM_ShortIntro_01 1199 0.72 1.10 0.52 191 HK_RANDOM_REPLYTO 1197 0.44 1.10 0.10 192 RELAYCOUNTRY_RU 1188 0.41 1.09 0.06 193 XM_H_Undi_Recip 1178 0.50 1.08 0.21 194 DKIM_ADSP_CUSTOM_MED 1173 0.86 1.07 0.74 195 TR_XM_MSPIKECOMBO2 1145 0.38 1.05 0.04 196 TO_NO_BRKTS_FROM_MSSP 1142 0.36 1.05 0.00 197 HELO_DYNAMIC_SPLIT_IP 1140 0.36 1.04 0.00 198 TR_Caps_n_Bayes_99 1081 0.37 0.99 0.05 199 TR_XM_RelayPhish 1071 0.38 0.98 0.07 200 TooManyTo_002 1062 1.81 0.97 2.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 183063 88.48 92.58 86.37 2 RELAYCOUNTRY_US 164531 79.24 82.38 77.62 3 XM_B_Unicode 158862 77.97 83.83 74.95 4 DKIM_SIGNED 157876 79.69 89.80 74.48 5 XM_DK_Pass 156450 77.94 85.96 73.81 6 DKIM_VALID 155121 77.34 85.41 73.18 7 BAYES_50 137224 55.81 38.48 64.74 8 DKIM_VALID_AU 131074 64.24 68.90 61.84 9 XMListUnsubscribeExists 112889 58.68 69.20 53.26 10 DCC_CHECK 106894 59.57 77.32 50.43 11 XM_B_Unicode3 105878 51.06 53.21 49.95 12 DCC_CHECK_NEGATIVE 105023 40.22 22.11 49.55 13 XM_B_SpammyWords 87978 50.49 67.93 41.51 14 LOC_TINY_FONT_1 70799 39.90 52.51 33.40 15 HTML_FONT_LOW_CONTRAST 66853 34.11 39.11 31.54 16 DKIM_VALID_EF 64919 30.13 29.16 30.63 17 XMSubLong 57809 25.11 20.91 27.27 18 FVGT_m_MULTI_ODD 55347 28.75 33.86 26.11 19 T_TM2_M_HEADER_IN_MSG 46629 21.54 20.66 22.00 20 T_KAM_HTML_FONT_INVALID 46048 23.44 26.76 21.72 21 MIME_HTML_ONLY 40602 21.39 25.74 19.16 22 ALL_TRUSTED 39846 13.14 2.15 18.80 23 XM_B_SpammyWords2 36849 24.59 38.58 17.38 24 RCVD_IN_MSPIKE_H2 35656 19.04 23.35 16.82 25 TR_XM_DK_Unsub 35460 18.10 20.77 16.73 26 RCVD_IN_MSPIKE_WL 35333 13.84 8.35 16.67 27 USER_IN_DEF_DKIM_WL 33600 12.03 4.60 15.85 28 XM_Multi_Part_URI 31592 17.70 23.12 14.90 29 UNPARSEABLE_RELAY 29898 16.63 21.52 14.11 30 FSL_BULK_SIG 28888 12.45 10.17 13.63 31 XM_Evil_Numbers_Gen 22212 10.83 11.52 10.48 32 XM_B_Unsub 18436 11.26 16.23 8.70 33 BAYES_00 17434 5.57 0.41 8.23 34 XM_DKIMWhitelistDomains 16400 5.12 0.03 7.74 35 LotsOfNums_01 16200 7.34 6.75 7.64 36 RCVD_IN_MSPIKE_H3 15799 6.36 4.25 7.45 37 BAYES_60 15770 8.12 9.45 7.44 38 XM_B_PhoneNumber 15270 6.24 4.38 7.20 39 T_TooManySym_01 14152 5.25 2.49 6.68 40 XMStrtUSub 14149 6.10 4.99 6.68 41 TR_XM_BayesUnsub 14004 9.64 15.52 6.61 42 XM_H_GMP 13799 6.32 5.95 6.51 43 TR_MAX_INTL_RELAY 13671 10.00 16.90 6.45 44 TooManyTo_001 12737 5.40 4.21 6.01 45 RCVD_IN_MSPIKE_H5 12644 4.60 1.95 5.97 46 TR_XM_DK_Bayes 12634 4.03 0.30 5.96 47 TR_XM_DK_Bayes1 12543 4.01 0.29 5.92 48 XM_DK_Undo_02 11745 17.05 39.38 5.54 49 TO_IN_SUBJ 10855 3.41 0.09 5.12 50 TR_XM_DK_Bayes2 10628 3.38 0.21 5.01 51 RCVD_IN_VALIDITY_SAFE 10561 4.34 3.10 4.98 52 XM_B_SpammyWords3 10499 8.26 14.68 4.95 53 ANY_BOUNCE_MESSAGE 10407 3.55 0.92 4.91 54 BOUNCE_MESSAGE 10404 3.55 0.92 4.91 55 HTML_IMAGE_RATIO_02 10190 5.88 7.98 4.81 56 LOTS_OF_MONEY 10171 7.14 11.70 4.80 57 XM_H_Long_From01 10120 5.04 5.57 4.77 58 MPART_ALT_DIFF 10100 5.42 6.70 4.77 59 XM_UncommonTLD01 9614 5.28 6.72 4.54 60 BAYES_40 9327 3.47 1.67 4.40 61 BAYES_99 9311 13.56 31.36 4.39 62 XMNumbers 9062 3.87 3.10 4.28 63 HTML_IMAGE_RATIO_04 8985 4.92 6.25 4.24 64 T_TooManySym_02 8683 2.89 0.54 4.10 65 RCVD_IN_VALIDITY_CERTIFIED 8507 3.49 2.46 4.01 66 XM_B_Phish_Phrases 8335 5.43 8.33 3.93 67 BAYES_80 8186 5.99 10.13 3.86 68 MIME_QP_LONG_LINE 8077 3.30 2.32 3.81 69 BOTNET_IPINHOSTNAME 7956 6.48 11.77 3.75 70 HTML_IMAGE_RATIO_06 7716 3.34 2.77 3.64 71 RELAYCOUNTRY_META 7449 7.81 16.15 3.51 72 BAYES_999 7022 10.37 24.07 3.31 73 T_REMOTE_IMAGE 6943 2.76 1.75 3.28 74 RCVD_IN_MSPIKE_H4 6890 2.88 2.16 3.25 75 INVALID_MSGID 6626 2.14 0.22 3.13 76 TR_XM_SpammyWords4 6484 5.65 10.67 3.06 77 XM_Body_Dirty_Words 6371 4.66 7.86 3.01 78 TO_MALFORMED 6299 1.96 0.00 2.97 79 XM_B_SpammyTLD 6278 3.59 4.82 2.96 80 MIME_HTML_MOSTLY 6272 3.58 4.78 2.96 81 XMSubMetaSx_00 6011 3.81 5.72 2.84 82 MAILING_LIST_MULTI 5973 2.54 2.00 2.82 83 BAYES_20 5956 2.24 1.12 2.81 84 MSGID_NOFQDN1 5940 1.85 0.00 2.80 85 RCVD_IN_IADB_LISTED 5713 2.15 1.10 2.70 86 BAYES_95 5484 3.83 6.23 2.59 87 HTML_IMAGE_RATIO_08 5391 2.50 2.42 2.54 88 RCVD_IN_IADB_SPF 5180 1.94 0.96 2.44 89 XM_PDF 5031 1.80 0.68 2.37 90 FROM_EXCESS_BASE64 5018 2.56 2.95 2.37 91 MIME_HTML_ONLY_MULTI 4870 2.56 3.06 2.30 92 TooManyTo_002 4749 1.81 0.97 2.24 93 RCVD_IN_IADB_SENDERID 4745 1.78 0.90 2.24 94 RCVD_IN_IADB_DK 4599 1.74 0.90 2.17 95 TR_XM_DKIM_Undo 4421 10.79 27.70 2.09 96 TR_XM_UnparsRelay 4363 5.43 11.99 2.06 97 T_TVD_MIME_NO_HEADERS 4359 1.38 0.07 2.06 98 UNTRUSTED_Relay 4239 3.64 6.82 2.00 99 HTML_MIME_NO_HTML_TAG 4211 1.83 1.52 1.99 100 TVD_RCVD_IP 4178 1.73 1.28 1.97 101 XM_CamelCaseFrm001 4169 2.60 3.84 1.97 102 TR_DCC_Bayes_99 4066 8.87 22.37 1.92 103 T_XMDrugObfuBody_14 3958 2.64 4.15 1.87 104 T_TooManySym_03 3778 1.24 0.18 1.78 105 SUBJ_ALL_CAPS 3673 2.29 3.37 1.73 106 TR_XM_SpammyWords5 3662 2.37 3.62 1.73 107 KHOP_HELO_FCRDNS 3582 1.78 1.95 1.69 108 TR_XM_SpammyRelay 3581 4.87 11.05 1.69 109 RCVD_IN_IADB_VOUCHED 3558 1.31 0.60 1.68 110 TM2_M_URI_OPT_OUT 3341 2.12 3.18 1.58 111 BAYES_05 3270 1.22 0.59 1.54 112 IN_HORDE_ADDRESS_BOOK 3255 1.04 0.08 1.54 113 XM_DK_Undo_01 3234 1.46 1.34 1.53 114 XMStockSpam_06 3221 2.07 3.13 1.52 115 XMDiploma_00 3080 1.77 2.38 1.45 116 XM_SendGrid 3046 1.44 1.45 1.44 117 XM_B_URI_Unicode 3037 1.67 2.13 1.43 118 TR_XM_PhishingBody 2998 2.34 4.14 1.41 119 XM_B_Unsub2 2846 1.75 2.55 1.34 120 TM2_M_VERY_LONG_WORD 2821 2.05 3.43 1.33 121 URI_NOVOWEL 2811 1.31 1.28 1.33 122 XM_UB50 2801 1.90 3.02 1.32 123 DKIM_INVALID 2755 2.35 4.40 1.30 124 TVD_SPACE_RATIO 2722 0.94 0.26 1.28 125 XMGappySubj_01 2681 0.89 0.15 1.26 126 XM_GoogleGroups 2661 1.09 0.77 1.26 127 RCVD_IN_IADB_OPTIN 2618 0.93 0.35 1.24 128 RCVD_IN_PSBL 2486 1.07 0.88 1.17 129 TooManyTo_003 2447 1.04 0.83 1.15 130 XM_B_Investor 2403 2.26 4.43 1.13 131 XMBrknScrpt_02 2269 1.44 2.15 1.07 132 XMSubMetaI_00 2263 1.47 2.26 1.07 133 URI_HEX 2198 1.15 1.37 1.04 134 XM_SPF_SoftFail 2184 2.17 4.39 1.03 135 T_XMDrugObfuBody_08 2137 1.59 2.72 1.01 136 TR_Symld_Words 2130 0.95 0.85 1.00 137 XM_B_COPY_HTML 2115 1.11 1.33 1.00 138 TR_XM_DK_SendGrid 2114 0.93 0.80 1.00 139 TR_XM_Base64_M1 2113 1.17 1.50 1.00 140 XMGappySubj_02 2042 0.64 0.02 0.96 141 TooManyTo_004 1990 0.84 0.64 0.94 142 T_XMHurry_00 1978 1.56 2.78 0.93 143 XMSexyCombo_05 1972 1.92 3.83 0.93 144 BOTNET 1969 3.48 8.45 0.93 145 HTML_IMAGE_ONLY_32 1918 0.67 0.21 0.90 146 XM_OfRef6 1823 1.89 3.88 0.86 147 RELAYCOUNTRY_CA 1759 2.15 4.70 0.83 148 TooManyTo_005 1708 0.74 0.62 0.81 149 XMBSHREFv2 1664 0.67 0.43 0.79 150 RCVD_IN_MSPIKE_BL 1622 1.57 3.13 0.77 151 TR_XM_MSPIKECOMBO 1622 1.57 3.13 0.77 152 XM_B_FormFill 1618 0.51 0.03 0.76 153 XMGenDplmaNmb 1609 0.99 1.44 0.76 154 DKIM_ADSP_CUSTOM_MED 1579 0.86 1.07 0.74 155 XMBody_95 1540 0.54 0.18 0.73 156 TR_XM_SpammyWords2 1523 3.82 9.84 0.72 157 XM_B_SpammyWords4 1502 1.09 1.84 0.71 158 XM_H_Long_From02 1480 1.07 1.78 0.70 159 T_XMDrugObfuBody_00 1433 0.88 1.28 0.68 160 T_FILL_THIS_FORM_SHORT 1420 0.95 1.49 0.67 161 TR_MetaPhish_Combo_01 1377 0.63 0.58 0.65 162 RCVD_IN_MSPIKE_L3 1361 1.02 1.75 0.64 163 TR_XM_GMP_MSPIKE_UNDO2 1345 0.50 0.24 0.63 164 XM_H_PHPMailer 1330 0.61 0.57 0.63 165 XM_B_DNDMA 1319 0.88 1.38 0.62 166 XM_ProductURIs 1310 0.87 1.35 0.62 167 URI_TRY_3LD 1290 0.73 0.96 0.61 168 RCVD_IN_BL_SPAMCOP_NET 1286 3.69 9.68 0.61 169 XMNoVowels 1276 0.50 0.30 0.60 170 XMCapTrack 1263 0.52 0.38 0.60 171 RCVD_IN_PBL 1181 1.47 3.23 0.56 172 RELAYCOUNTRY_GB 1116 0.81 1.37 0.53 173 MPART_ALT_DIFF_COUNT 1108 0.97 1.84 0.52 174 XM_ShortIntro_01 1106 0.72 1.10 0.52 175 THIS_AD 1103 0.91 1.68 0.52 176 T_OBFU_PDF_ATTACH 1097 0.41 0.21 0.52 177 MSGID_FROM_MTA_HEADER 1092 0.45 0.31 0.52 178 XMLngstWrd_00 1068 0.44 0.30 0.50 179 FORGED_GMAIL_RCVD 1059 0.62 0.86 0.50 180 XM_URI_RBL 1039 1.22 2.63 0.49 181 XMSlimDrugH 1032 0.50 0.51 0.49 182 HTTPS_HTTP_MISMATCH 1030 0.53 0.61 0.49 183 T_Symld_Words_02 1021 0.55 0.69 0.48 184 RELAYCOUNTRY_AU 955 1.27 2.85 0.45 185 XM_RXBody 952 0.54 0.72 0.45 186 XMPhish30 945 0.90 1.78 0.45 187 T_TooManySym_04 945 0.31 0.03 0.45 188 DKIM_ADSP_NXDOMAIN 938 0.53 0.70 0.44 189 SHOPIFY_IMG_NOT_RCVD_SFY 937 1.05 2.22 0.44 190 HTML_TAG_BALANCE_BODY 880 0.56 0.84 0.42 191 STY_INVIS_DIRECT 858 0.79 1.53 0.40 192 XMHTML_After_End 858 0.52 0.75 0.40 193 XMSubMetaSxObfu_03 848 0.85 1.73 0.40 194 XM_B_Phish66 839 0.65 1.15 0.40 195 NML_ADSP_CUSTOM_MED 837 0.53 0.80 0.39 196 TR_LOTS_OF_MONEY2 833 0.55 0.86 0.39 197 T_MONEY_PERCENT 833 0.55 0.86 0.39 198 XM_Ancestry_Forge 830 0.26 0.01 0.39 199 XMLngstWrd_01 819 0.34 0.24 0.39 200 TR_XM_GMP_BULK_SIG 817 0.82 1.67 0.39 ----------------------------------------------------------------------