Email: 258244 Autolearn: 0 AvgScore: 5.23 AvgScanTime: 1.47 sec Spam: 86280 Autolearn: 0 AvgScore: 13.90 AvgScanTime: 1.62 sec Ham: 171964 Autolearn: 0 AvgScore: 0.89 AvgScanTime: 1.39 sec Time Spent Running SA: 105.31 hours Time Spent Processing Spam: 38.73 hours Time Spent Processing Ham: 66.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 82350 87.77 95.45 83.91 2 DKIM_SIGNED 80187 78.76 92.94 71.65 3 XM_DK_Pass 74720 76.16 86.60 70.93 4 DKIM_VALID 74109 75.67 85.89 70.54 5 XM_B_Unicode 73117 75.79 84.74 71.30 6 RELAYCOUNTRY_US 70785 82.03 82.04 82.03 7 DCC_CHECK 66468 53.37 77.04 41.49 8 XM_B_SpammyWords 60663 55.33 70.31 47.81 9 DKIM_VALID_AU 60080 64.17 69.63 61.44 10 XMListUnsubscribeExists 58843 56.45 68.20 50.55 11 XM_B_Unicode3 46093 49.59 53.42 47.66 12 LOC_TINY_FONT_1 45027 39.93 52.19 33.78 13 XM_DK_Undo_02 36428 17.71 42.22 5.41 14 XM_B_SpammyWords2 35849 28.13 41.55 21.40 15 HTML_FONT_LOW_CONTRAST 33549 37.22 38.88 36.38 16 BAYES_50 32415 53.47 37.57 61.45 17 FVGT_m_MULTI_ODD 31015 28.95 35.95 25.44 18 BAYES_99 28301 13.88 32.80 4.39 19 TR_XM_DKIM_Undo 26904 11.73 31.18 1.96 20 DKIM_VALID_EF 24970 28.24 28.94 27.89 21 T_KAM_HTML_FONT_INVALID 23606 22.78 27.36 20.48 22 MIME_HTML_ONLY 22323 21.04 25.87 18.61 23 BAYES_999 21345 10.58 24.74 3.48 24 TR_DCC_Bayes_99 20192 9.15 23.40 2.00 25 DCC_CHECK_NEGATIVE 19391 46.44 22.47 58.47 26 TR_XM_DK_Unsub 18671 16.78 21.64 14.34 27 XM_Multi_Part_URI 18360 17.66 21.28 15.85 28 RCVD_IN_MSPIKE_H2 18335 16.48 21.25 14.09 29 XM_B_Unsub 18303 13.42 21.21 9.51 30 TR_XM_BayesUnsub 17369 11.60 20.13 7.32 31 XMSubLong 16177 20.94 18.75 22.05 32 T_TM2_M_HEADER_IN_MSG 16084 23.98 18.64 26.66 33 RELAYCOUNTRY_META 15551 7.83 18.02 2.72 34 TR_MAX_INTL_RELAY 14766 9.83 17.11 6.17 35 UNPARSEABLE_RELAY 13698 14.05 15.88 13.14 36 XM_B_SpammyWords3 12668 9.63 14.68 7.09 37 RCVD_IN_BL_SPAMCOP_NET 12628 5.26 14.64 0.56 38 TR_XM_SpammyRelay 11240 5.33 13.03 1.46 39 TR_XM_SpammyWords2 10163 4.41 11.78 0.72 40 LOTS_OF_MONEY 9139 6.08 10.59 3.82 41 BAYES_80 8940 5.92 10.36 3.69 42 BOTNET_IPINHOSTNAME 8930 6.01 10.35 3.83 43 MPART_ALT_DIFF 8632 6.82 10.00 5.22 44 RCVD_IN_MSPIKE_WL 8626 14.79 10.00 17.19 45 TR_XM_SpammyWords4 8593 4.93 9.96 2.41 46 BOTNET 8488 3.95 9.84 0.99 47 XM_Evil_Numbers_Gen 7949 11.66 9.21 12.88 48 XMSubMetaSx_00 7935 5.44 9.20 3.55 49 FSL_BULK_SIG 7685 6.10 8.91 4.70 50 TR_XM_UnparsRelay 7629 4.12 8.84 1.75 51 RELAYCOUNTRY_CA 7201 3.37 8.35 0.87 52 BAYES_60 7189 7.67 8.33 7.34 53 XM_B_Phish_Phrases 6905 5.84 8.00 4.75 54 DKIM_INVALID 6078 3.09 7.04 1.11 55 TR_XM_MSPIKECOMBO 5680 2.58 6.58 0.57 56 RCVD_IN_MSPIKE_BL 5680 2.58 6.58 0.57 57 TR_XM_SPAMCOP 5539 2.25 6.42 0.15 58 HTML_IMAGE_RATIO_02 5471 5.44 6.34 4.98 59 BAYES_95 5439 3.75 6.30 2.48 60 MIME_HTML_MOSTLY 5330 4.29 6.18 3.34 61 UNTRUSTED_Relay 5076 3.07 5.88 1.66 62 XM_H_GMP 4995 6.02 5.79 6.14 63 HTML_IMAGE_RATIO_04 4891 4.71 5.67 4.22 64 TR_XM_SpammyWords3 4537 1.98 5.26 0.33 65 TR_XM_PhishingBody 4425 2.86 5.13 1.72 66 LotsOfNums_01 4389 9.35 5.09 11.49 67 XM_UncommonTLD01 4348 4.92 5.04 4.85 68 XMStrtUSub 4347 5.34 5.04 5.49 69 XM_H_Long_From01 4151 4.97 4.81 5.05 70 XM_Body_Dirty_Words 4134 3.53 4.79 2.89 71 RCVD_IN_MSPIKE_L3 4028 1.89 4.67 0.49 72 USER_IN_DEF_DKIM_WL 4012 13.19 4.65 17.48 73 RCVD_IN_MSPIKE_H3 3908 6.37 4.53 7.30 74 XM_B_Investor 3892 2.43 4.51 1.39 75 T_XMDrugObfuBody_14 3850 2.58 4.46 1.64 76 XMNumbers 3732 4.52 4.33 4.62 77 TM2_M_VERY_LONG_WORD 3715 6.22 4.31 7.17 78 XMSexyCombo_05 3469 2.28 4.02 1.41 79 XM_URI_RBL 3416 1.68 3.96 0.54 80 TR_XM_SpammyWords5 3410 2.12 3.95 1.20 81 T_XMDrugObfuBody_08 3356 2.74 3.89 2.16 82 XM_B_PhoneNumber 3347 5.87 3.88 6.87 83 XM_B_SpammyTLD 3192 2.92 3.70 2.53 84 XM_OfRef6 3088 1.92 3.58 1.08 85 XM_CamelCaseFrm001 2907 2.57 3.37 2.17 86 RCVD_IN_VALIDITY_RPBL 2849 1.14 3.30 0.05 87 TooManyTo_001 2846 4.78 3.30 5.53 88 XMStockSpam_06 2751 1.64 3.19 0.86 89 XMPhish30 2736 1.50 3.17 0.66 90 RCVD_IN_MSPIKE_H5 2735 4.99 3.17 5.91 91 MIME_QP_LONG_LINE 2710 2.93 3.14 2.82 92 T_FILL_THIS_FORM_SHORT 2692 1.55 3.12 0.76 93 DKIM_ADSP_NXDOMAIN 2690 1.37 3.12 0.50 94 HTML_IMAGE_RATIO_06 2661 3.15 3.08 3.18 95 TR_XM_NoHeaderRelay 2607 1.12 3.02 0.17 96 HTML_IMAGE_RATIO_08 2515 2.92 2.91 2.93 97 XM_B_Unsub2 2494 1.86 2.89 1.35 98 RELAYCOUNTRY_AU 2424 1.20 2.81 0.39 99 FROM_EXCESS_BASE64 2277 2.02 2.64 1.71 100 XM_SPF_SoftFail 2239 1.54 2.60 1.00 101 XM_UB50 2232 1.49 2.59 0.94 102 MIME_HTML_ONLY_MULTI 2219 2.52 2.57 2.49 103 TR_XM_INV_DKIM 2215 0.87 2.57 0.01 104 XMBody_17 2205 1.24 2.56 0.58 105 XM_H_DKIM_GOOG 2178 0.85 2.52 0.00 106 RCVD_IN_MSPIKE_H4 1983 3.42 2.30 3.99 107 RCVD_IN_VALIDITY_SAFE 1937 4.45 2.25 5.55 108 XM_B_SpammyWords4 1906 1.26 2.21 0.79 109 T_TooManySym_01 1900 5.97 2.20 7.86 110 XMDiploma_00 1897 1.75 2.20 1.53 111 SUBJ_ALL_CAPS 1892 1.20 2.19 0.69 112 XM_B_URI_Unicode 1847 1.69 2.14 1.47 113 TR_XM_INTL_Spamhaus 1833 0.82 2.12 0.16 114 THIS_AD 1767 0.96 2.05 0.41 115 T_XMHurry_00 1722 1.05 2.00 0.57 116 XMBrknScrpt_02 1703 1.61 1.97 1.43 117 XMSubMetaI_00 1681 1.00 1.95 0.53 118 TR_XM_MSPIKECOMBO2 1589 0.62 1.84 0.01 119 XMSubMetaSxObfu_04 1573 0.66 1.82 0.08 120 RCVD_IN_XBL 1568 0.62 1.82 0.01 121 BAYES_40 1490 4.34 1.73 5.66 122 XM_HighProb1 1488 0.58 1.72 0.00 123 SpammyFromTLD_01 1464 0.80 1.70 0.34 124 MPART_ALT_DIFF_COUNT 1440 0.97 1.67 0.62 125 BOTNET_NORDNS 1438 0.56 1.67 0.00 126 MAILING_LIST_MULTI 1436 2.08 1.66 2.30 127 TM2_M_URI_OPT_OUT 1422 1.77 1.65 1.83 128 SCC_CANSPAM_2 1422 0.55 1.65 0.00 129 RCVD_IN_SBL_CSS 1409 0.56 1.63 0.01 130 STY_INVIS_DIRECT 1395 0.81 1.62 0.40 131 XM_B_COPY_HTML 1346 1.30 1.56 1.17 132 HTML_IMAGE_ONLY_20 1344 0.86 1.56 0.50 133 RCVD_IN_VALIDITY_CERTIFIED 1337 3.60 1.55 4.63 134 RDNS_DYNAMIC 1292 0.65 1.50 0.23 135 KHOP_HELO_FCRDNS 1289 3.53 1.49 4.55 136 SpammyFromTLD_02 1278 0.62 1.48 0.18 137 XMReplyNow 1273 0.67 1.48 0.26 138 TR_XM_MaxSPIKE 1270 0.50 1.47 0.01 139 RCVD_IN_MSPIKE_L4 1252 0.53 1.45 0.07 140 SHOPIFY_IMG_NOT_RCVD_SFY 1246 0.76 1.44 0.42 141 TVD_RCVD_IP 1246 1.55 1.44 1.60 142 XMBdyGiftCard01 1237 1.31 1.43 1.25 143 DIET_1 1231 0.67 1.43 0.29 144 RCVD_IN_PSBL 1188 0.47 1.38 0.01 145 XM_B_DNDMA 1165 0.67 1.35 0.34 146 URI_HEX 1135 1.19 1.32 1.12 147 HELO_DYNAMIC_SPLIT_IP 1128 0.44 1.31 0.01 148 MultiRelay_CC 1119 0.49 1.30 0.08 149 TR_XM_PHPForged 1100 0.64 1.27 0.33 150 RCVD_IN_PBL 1092 0.79 1.27 0.56 151 HTML_IMAGE_ONLY_28 1071 0.61 1.24 0.29 152 TR_XM_PHPDW 1063 0.63 1.23 0.33 153 XM_SendGrid 1062 1.26 1.23 1.28 154 TR_XM_FormFill2 1058 0.63 1.23 0.33 155 XMBody_78 1044 0.56 1.21 0.24 156 TR_MetaPhish_Combo_01 1039 1.12 1.20 1.08 157 URI_TRY_3LD 1039 0.66 1.20 0.39 158 TR_XM_Base64_L1 1032 0.46 1.20 0.10 159 XM_H_PHPOS 1030 0.61 1.19 0.32 160 ALL_TRUSTED 1010 10.41 1.17 15.05 161 TR_LOTS_OF_MONEY3 1010 0.54 1.17 0.22 162 BAYES_20 1002 3.33 1.16 4.41 163 URI_NOVOWEL 995 1.12 1.15 1.10 164 XM_ProductURIs 982 0.82 1.14 0.66 165 TR_XM_GMP_BULK_SIG 977 0.43 1.13 0.08 166 XM_B_SEO 976 0.48 1.13 0.15 167 T_XMDrugObfuBody_00 973 1.09 1.13 1.08 168 TR_LOTS_OF_MONEY2 969 0.47 1.12 0.14 169 T_MONEY_PERCENT 969 0.47 1.12 0.14 170 XM_B_REG_HTML 967 0.54 1.12 0.24 171 XM_UB99 947 0.37 1.10 0.00 172 T_REMOTE_IMAGE 939 2.39 1.09 3.04 173 HTML_TAG_BALANCE_BODY 932 0.97 1.08 0.91 174 TR_XM_DK_SendGrid 894 0.96 1.04 0.93 175 HTML_FONT_TINY_NORDNS 868 0.36 1.01 0.03 176 XM_DK_Undo_01 861 1.26 1.00 1.40 177 TR_Mismatch_TLD_01 853 0.51 0.99 0.26 178 TR_XM_InvalidRelay 851 0.34 0.99 0.01 179 XM_H_Long_From02 840 0.72 0.97 0.59 180 XMSexyCombo_01 825 0.46 0.96 0.21 181 DKIM_ADSP_CUSTOM_MED 823 0.79 0.95 0.70 182 TR_XM_Base64_M1 823 0.81 0.95 0.73 183 XMGenDplmaNmb 818 0.93 0.95 0.92 184 HTML_MIME_NO_HTML_TAG 778 1.50 0.90 1.80 185 XMSlimDrugH 768 0.71 0.89 0.62 186 TR_XM_RelayPhish 738 0.34 0.86 0.08 187 TM2_M_OBFU_COMMENT 738 0.63 0.86 0.51 188 TR_Symld_Words 732 1.15 0.85 1.30 189 FROMSPACE 730 0.29 0.85 0.02 190 XM_UB60 719 0.33 0.83 0.07 191 TR_Mismatch_TLD_02 718 0.32 0.83 0.06 192 XM_B_Phish66 712 0.55 0.83 0.41 193 NO_DNS_FOR_FROM 703 0.54 0.81 0.40 194 XM_GoogleGroups 698 1.04 0.81 1.16 195 XMPhish14 694 0.56 0.80 0.43 196 XM_DIRTYINTL 690 0.30 0.80 0.05 197 TR_XM_MaxWHORU 689 0.49 0.80 0.33 198 NML_ADSP_CUSTOM_MED 686 0.52 0.80 0.39 199 RELAYCOUNTRY_FR 684 0.42 0.79 0.23 200 XMLongAddy 667 0.35 0.77 0.14 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144302 87.77 95.45 83.91 2 RELAYCOUNTRY_US 141055 82.03 82.04 82.03 3 DKIM_SIGNED 123212 78.76 92.94 71.65 4 XM_B_Unicode 122618 75.79 84.74 71.30 5 XM_DK_Pass 121966 76.16 86.60 70.93 6 DKIM_VALID 121301 75.67 85.89 70.54 7 BAYES_50 105675 53.47 37.57 61.45 8 DKIM_VALID_AU 105648 64.17 69.63 61.44 9 DCC_CHECK_NEGATIVE 100539 46.44 22.47 58.47 10 XMListUnsubscribeExists 86933 56.45 68.20 50.55 11 XM_B_SpammyWords 82222 55.33 70.31 47.81 12 XM_B_Unicode3 81959 49.59 53.42 47.66 13 DCC_CHECK 71354 53.37 77.04 41.49 14 HTML_FONT_LOW_CONTRAST 62568 37.22 38.88 36.38 15 LOC_TINY_FONT_1 58089 39.93 52.19 33.78 16 DKIM_VALID_EF 47967 28.24 28.94 27.89 17 T_TM2_M_HEADER_IN_MSG 45846 23.98 18.64 26.66 18 FVGT_m_MULTI_ODD 43752 28.95 35.95 25.44 19 XMSubLong 37912 20.94 18.75 22.05 20 XM_B_SpammyWords2 36794 28.13 41.55 21.40 21 T_KAM_HTML_FONT_INVALID 35210 22.78 27.36 20.48 22 MIME_HTML_ONLY 32006 21.04 25.87 18.61 23 USER_IN_DEF_DKIM_WL 30057 13.19 4.65 17.48 24 RCVD_IN_MSPIKE_WL 29564 14.79 10.00 17.19 25 XM_Multi_Part_URI 27250 17.66 21.28 15.85 26 ALL_TRUSTED 25882 10.41 1.17 15.05 27 TR_XM_DK_Unsub 24655 16.78 21.64 14.34 28 RCVD_IN_MSPIKE_H2 24223 16.48 21.25 14.09 29 UNPARSEABLE_RELAY 22596 14.05 15.88 13.14 30 XM_Evil_Numbers_Gen 22152 11.66 9.21 12.88 31 ANY_BOUNCE_MESSAGE 20231 8.03 0.58 11.76 32 BOUNCE_MESSAGE 20230 8.03 0.58 11.76 33 LotsOfNums_01 19764 9.35 5.09 11.49 34 XM_B_Unsub 16356 13.42 21.21 9.51 35 BAYES_00 14986 6.03 0.69 8.71 36 XM_DKIMWhitelistDomains 14394 5.59 0.05 8.37 37 T_TooManySym_01 13515 5.97 2.20 7.86 38 BAYES_60 12630 7.67 8.33 7.34 39 TR_XM_BayesUnsub 12584 11.60 20.13 7.32 40 RCVD_IN_MSPIKE_H3 12550 6.37 4.53 7.30 41 TM2_M_VERY_LONG_WORD 12337 6.22 4.31 7.17 42 XM_B_SpammyWords3 12194 9.63 14.68 7.09 43 XM_B_PhoneNumber 11818 5.87 3.88 6.87 44 TR_XM_DK_Bayes 11717 4.73 0.58 6.81 45 TR_XM_DK_Bayes1 11660 4.71 0.58 6.78 46 TR_MAX_INTL_RELAY 10613 9.83 17.11 6.17 47 XM_H_GMP 10556 6.02 5.79 6.14 48 TR_XM_DK_Bayes2 10326 4.15 0.46 6.00 49 RCVD_IN_MSPIKE_H5 10160 4.99 3.17 5.91 50 BAYES_40 9727 4.34 1.73 5.66 51 RCVD_IN_VALIDITY_SAFE 9543 4.45 2.25 5.55 52 TooManyTo_001 9507 4.78 3.30 5.53 53 XMStrtUSub 9434 5.34 5.04 5.49 54 XM_DK_Undo_02 9296 17.71 42.22 5.41 55 MPART_ALT_DIFF 8969 6.82 10.00 5.22 56 XM_H_Long_From01 8688 4.97 4.81 5.05 57 HTML_IMAGE_RATIO_02 8567 5.44 6.34 4.98 58 XM_UncommonTLD01 8345 4.92 5.04 4.85 59 XM_B_Phish_Phrases 8169 5.84 8.00 4.75 60 FSL_BULK_SIG 8076 6.10 8.91 4.70 61 RCVD_IN_VALIDITY_CERTIFIED 7956 3.60 1.55 4.63 62 XMNumbers 7950 4.52 4.33 4.62 63 KHOP_HELO_FCRDNS 7820 3.53 1.49 4.55 64 T_TooManySym_02 7721 3.16 0.51 4.49 65 BAYES_20 7586 3.33 1.16 4.41 66 BAYES_99 7548 13.88 32.80 4.39 67 HTML_IMAGE_RATIO_04 7261 4.71 5.67 4.22 68 RCVD_IN_MSPIKE_H4 6854 3.42 2.30 3.99 69 INVALID_MSGID 6610 2.74 0.54 3.84 70 BOTNET_IPINHOSTNAME 6580 6.01 10.35 3.83 71 LOTS_OF_MONEY 6572 6.08 10.59 3.82 72 BAYES_80 6354 5.92 10.36 3.69 73 TO_MALFORMED 6274 2.43 0.02 3.65 74 XMSubMetaSx_00 6103 5.44 9.20 3.55 75 BAYES_999 5988 10.58 24.74 3.48 76 MSGID_NOFQDN1 5889 2.35 0.22 3.42 77 MIME_HTML_MOSTLY 5743 4.29 6.18 3.34 78 HTML_IMAGE_RATIO_06 5463 3.15 3.08 3.18 79 T_REMOTE_IMAGE 5223 2.39 1.09 3.04 80 HTML_IMAGE_RATIO_08 5031 2.92 2.91 2.93 81 XM_Body_Dirty_Words 4970 3.53 4.79 2.89 82 MIME_QP_LONG_LINE 4845 2.93 3.14 2.82 83 RELAYCOUNTRY_META 4681 7.83 18.02 2.72 84 MIME_CHARSET_FARAWAY 4568 1.92 0.46 2.66 85 T_TVD_MIME_NO_HEADERS 4437 1.73 0.04 2.58 86 CHARSET_FARAWAY_HEADER 4364 1.78 0.27 2.54 87 XM_B_SpammyTLD 4352 2.92 3.70 2.53 88 MIME_HTML_ONLY_MULTI 4289 2.52 2.57 2.49 89 BAYES_95 4258 3.75 6.30 2.48 90 TR_XM_SpammyWords4 4136 4.93 9.96 2.41 91 MAILING_LIST_MULTI 3948 2.08 1.66 2.30 92 XM_CamelCaseFrm001 3732 2.57 3.37 2.17 93 T_XMDrugObfuBody_08 3709 2.74 3.89 2.16 94 TR_DCC_Bayes_99 3432 9.15 23.40 2.00 95 XM_PDF 3410 1.47 0.45 1.98 96 TR_XM_DKIM_Undo 3379 11.73 31.18 1.96 97 TooManyTo_002 3279 1.46 0.56 1.91 98 BAYES_05 3199 1.44 0.60 1.86 99 T_TooManySym_03 3190 1.27 0.12 1.86 100 TM2_M_URI_OPT_OUT 3142 1.77 1.65 1.83 101 HTML_MIME_NO_HTML_TAG 3090 1.50 0.90 1.80 102 RCVD_IN_IADB_LISTED 3062 1.41 0.66 1.78 103 TR_XM_UnparsRelay 3015 4.12 8.84 1.75 104 TR_XM_PhishingBody 2964 2.86 5.13 1.72 105 FROM_EXCESS_BASE64 2935 2.02 2.64 1.71 106 UNTRUSTED_Relay 2863 3.07 5.88 1.66 107 T_XMDrugObfuBody_14 2817 2.58 4.46 1.64 108 RCVD_IN_IADB_SPF 2784 1.26 0.55 1.62 109 TVD_RCVD_IP 2753 1.55 1.44 1.60 110 XMGappySubj_01 2680 1.09 0.16 1.56 111 XMDiploma_00 2634 1.75 2.20 1.53 112 IN_HORDE_ADDRESS_BOOK 2532 1.01 0.08 1.47 113 RCVD_IN_IADB_SENDERID 2532 1.14 0.48 1.47 114 XM_B_URI_Unicode 2530 1.69 2.14 1.47 115 TR_XM_SpammyRelay 2512 5.33 13.03 1.46 116 RCVD_IN_IADB_DK 2494 1.13 0.48 1.45 117 XMBrknScrpt_02 2451 1.61 1.97 1.43 118 XMSexyCombo_05 2424 2.28 4.02 1.41 119 XM_DK_Undo_01 2401 1.26 1.00 1.40 120 TVD_SPACE_RATIO 2394 1.01 0.25 1.39 121 XM_B_Investor 2386 2.43 4.51 1.39 122 XMGappySubj_02 2353 0.92 0.03 1.37 123 XM_B_Unsub2 2314 1.86 2.89 1.35 124 TR_Symld_Words 2239 1.15 0.85 1.30 125 XM_SendGrid 2202 1.26 1.23 1.28 126 XMBdyGiftCard01 2145 1.31 1.43 1.25 127 TR_XM_SpammyWords5 2065 2.12 3.95 1.20 128 XM_B_COPY_HTML 2012 1.30 1.56 1.17 129 XM_GoogleGroups 1988 1.04 0.81 1.16 130 RCVD_IN_IADB_VOUCHED 1963 0.91 0.44 1.14 131 URI_HEX 1927 1.19 1.32 1.12 132 DKIM_INVALID 1911 3.09 7.04 1.11 133 XMBSHREFv2 1906 0.83 0.27 1.11 134 URI_NOVOWEL 1894 1.12 1.15 1.10 135 XM_OfRef6 1863 1.92 3.58 1.08 136 TR_MetaPhish_Combo_01 1861 1.12 1.20 1.08 137 T_XMDrugObfuBody_00 1849 1.09 1.13 1.08 138 XM_SPF_SoftFail 1728 1.54 2.60 1.00 139 BOTNET 1701 3.95 9.84 0.99 140 XM_H_PHPMailer 1656 0.79 0.44 0.96 141 XM_UB50 1618 1.49 2.59 0.94 142 TR_XM_DK_SendGrid 1598 0.96 1.04 0.93 143 XMGenDplmaNmb 1574 0.93 0.95 0.92 144 HTML_TAG_BALANCE_BODY 1573 0.97 1.08 0.91 145 RELAYCOUNTRY_CA 1492 3.37 8.35 0.87 146 TooManyTo_003 1472 0.73 0.48 0.86 147 XMStockSpam_06 1472 1.64 3.19 0.86 148 RCVD_IN_IADB_OPTIN 1438 0.66 0.32 0.84 149 XM_B_SpammyWords4 1355 1.26 2.21 0.79 150 T_FILL_THIS_FORM_SHORT 1299 1.55 3.12 0.76 151 TR_XM_GMP_MSPIKE_UNDO2 1297 0.57 0.21 0.75 152 TR_XM_Base64_M1 1262 0.81 0.95 0.73 153 XM_B_FormFill 1246 0.49 0.03 0.72 154 TR_XM_SpammyWords2 1231 4.41 11.78 0.72 155 HTML_FONT_FACE_BAD 1211 0.64 0.50 0.70 156 DKIM_ADSP_CUSTOM_MED 1205 0.79 0.95 0.70 157 TooManyTo_004 1196 0.61 0.45 0.70 158 SUBJ_ALL_CAPS 1195 1.20 2.19 0.69 159 XM_ProductURIs 1132 0.82 1.14 0.66 160 XMPhish30 1130 1.50 3.17 0.66 161 XMBody_106 1099 0.46 0.09 0.64 162 MSGID_FROM_MTA_HEADER 1085 0.57 0.44 0.63 163 MPART_ALT_DIFF_COUNT 1069 0.97 1.67 0.62 164 XMSlimDrugH 1058 0.71 0.89 0.62 165 XMSubMetaSxObfu_02 1043 0.52 0.35 0.61 166 XM_H_Long_From02 1015 0.72 0.97 0.59 167 TooManyTo_005 1005 0.53 0.42 0.58 168 XMBody_17 1002 1.24 2.56 0.58 169 T_XMHurry_00 987 1.05 2.00 0.57 170 TR_XM_MSPIKECOMBO 972 2.58 6.58 0.57 171 RCVD_IN_MSPIKE_BL 972 2.58 6.58 0.57 172 RCVD_IN_BL_SPAMCOP_NET 958 5.26 14.64 0.56 173 RCVD_IN_PBL 955 0.79 1.27 0.56 174 T_TooManySym_04 944 0.38 0.03 0.55 175 XM_URI_RBL 931 1.68 3.96 0.54 176 XMSubMetaI_00 903 1.00 1.95 0.53 177 AD_PREFS 895 0.38 0.11 0.52 178 TM2_M_OBFU_COMMENT 877 0.63 0.86 0.51 179 HTML_IMAGE_ONLY_20 866 0.86 1.56 0.50 180 XMNoVowels 860 0.52 0.55 0.50 181 DKIM_ADSP_NXDOMAIN 854 1.37 3.12 0.50 182 XMBody_95 847 0.36 0.10 0.49 183 RCVD_IN_MSPIKE_L3 842 1.89 4.67 0.49 184 FORGED_GMAIL_RCVD 832 0.58 0.77 0.48 185 HTML_IMAGE_ONLY_32 802 0.35 0.11 0.47 186 XM_S_SubURI 794 0.32 0.03 0.46 187 XMLngstWrd_00 761 0.38 0.25 0.44 188 XMPhish14 748 0.56 0.80 0.43 189 FILL_THIS_FORM 741 0.36 0.22 0.43 190 XMHTML_After_End 720 0.47 0.56 0.42 191 SHOPIFY_IMG_NOT_RCVD_SFY 719 0.76 1.44 0.42 192 HTML_TAG_BALANCE_CENTER 712 0.46 0.55 0.41 193 THIS_AD 709 0.96 2.05 0.41 194 XM_B_Phish66 706 0.55 0.83 0.41 195 STY_INVIS_DIRECT 696 0.81 1.62 0.40 196 NO_DNS_FOR_FROM 687 0.54 0.81 0.40 197 HTML_TEXT_INVISIBLE_STYLE 682 0.36 0.29 0.40 198 RELAYCOUNTRY_AU 675 1.20 2.81 0.39 199 URI_TRY_3LD 672 0.66 1.20 0.39 200 NML_ADSP_CUSTOM_MED 669 0.52 0.80 0.39 ----------------------------------------------------------------------