Email: 258236 Autolearn: 0 AvgScore: 5.35 AvgScanTime: 1.46 sec Spam: 87492 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.63 sec Ham: 170744 Autolearn: 0 AvgScore: 0.96 AvgScanTime: 1.38 sec Time Spent Running SA: 105.04 hours Time Spent Processing Spam: 39.54 hours Time Spent Processing Ham: 65.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 84188 87.91 96.22 83.65 2 DKIM_SIGNED 80422 79.11 91.92 72.55 3 XM_DK_Pass 75684 76.71 86.50 71.69 4 DKIM_VALID 75166 76.21 85.91 71.25 5 XM_B_Unicode 74239 76.26 84.85 71.85 6 RELAYCOUNTRY_US 71178 81.96 81.35 82.27 7 DCC_CHECK 67393 52.79 77.03 40.37 8 XM_B_SpammyWords 62139 54.74 71.02 46.40 9 DKIM_VALID_AU 60442 64.63 69.08 62.35 10 XMListUnsubscribeExists 60316 56.78 68.94 50.56 11 LOC_TINY_FONT_1 45636 39.63 52.16 33.20 12 XM_B_Unicode3 44698 47.76 51.09 46.06 13 XM_DK_Undo_02 38151 18.98 43.61 6.36 14 XM_B_SpammyWords2 36236 27.50 41.42 20.37 15 HTML_FONT_LOW_CONTRAST 32455 36.36 37.09 35.98 16 BAYES_50 32137 53.07 36.73 61.44 17 FVGT_m_MULTI_ODD 31432 30.15 35.93 27.18 18 BAYES_99 29355 14.75 33.55 5.11 19 TR_XM_DKIM_Undo 28316 12.97 32.36 3.03 20 T_KAM_HTML_FONT_INVALID 26369 24.24 30.14 21.22 21 DKIM_VALID_EF 25906 29.45 29.61 29.37 22 MIME_HTML_ONLY 22853 21.59 26.12 19.26 23 BAYES_999 22301 11.19 25.49 3.86 24 XM_Multi_Part_URI 21465 18.89 24.53 15.99 25 TR_DCC_Bayes_99 21394 9.55 24.45 1.91 26 TR_XM_DK_Unsub 19849 17.07 22.69 14.19 27 DCC_CHECK_NEGATIVE 19510 46.94 22.30 59.56 28 XM_B_Unsub 18225 12.83 20.83 8.72 29 RCVD_IN_MSPIKE_H2 17744 15.94 20.28 13.71 30 TR_XM_BayesUnsub 17275 11.25 19.74 6.90 31 T_TM2_M_HEADER_IN_MSG 16106 24.34 18.41 27.38 32 RELAYCOUNTRY_META 15654 7.84 17.89 2.69 33 XMSubLong 15629 19.94 17.86 21.01 34 TR_MAX_INTL_RELAY 15219 10.26 17.39 6.61 35 XM_B_SpammyWords3 14624 10.11 16.71 6.72 36 UNPARSEABLE_RELAY 14422 13.97 16.48 12.68 37 RCVD_IN_BL_SPAMCOP_NET 11722 4.97 13.40 0.65 38 TR_XM_SpammyRelay 11610 5.46 13.27 1.45 39 TR_XM_SpammyWords2 10737 4.57 12.27 0.63 40 LOTS_OF_MONEY 9544 6.69 10.91 4.53 41 RCVD_IN_MSPIKE_WL 9494 15.63 10.85 18.07 42 BAYES_80 9423 6.26 10.77 3.95 43 TR_XM_SpammyWords4 8765 5.48 10.02 3.16 44 MPART_ALT_DIFF 8575 5.93 9.80 3.94 45 BOTNET 8499 4.35 9.71 1.59 46 BOTNET_IPINHOSTNAME 8391 6.17 9.59 4.42 47 FSL_BULK_SIG 8386 5.79 9.58 3.84 48 XM_Evil_Numbers_Gen 8174 10.91 9.34 11.72 49 XMSubMetaSx_00 8068 5.76 9.22 3.99 50 TR_XM_UnparsRelay 7904 4.18 9.03 1.70 51 BAYES_60 7530 7.41 8.61 6.79 52 RELAYCOUNTRY_CA 6828 3.14 7.80 0.75 53 RCVD_IN_MSPIKE_BL 5917 2.72 6.76 0.65 54 TR_XM_MSPIKECOMBO 5917 2.72 6.76 0.65 55 MIME_HTML_MOSTLY 5648 3.45 6.46 1.91 56 TR_XM_SPAMCOP 5625 2.23 6.43 0.08 57 XM_Body_Dirty_Words 5588 3.58 6.39 2.15 58 XM_B_Phish_Phrases 5572 5.15 6.37 4.52 59 UNTRUSTED_Relay 5563 3.23 6.36 1.63 60 HTML_IMAGE_RATIO_02 5554 5.33 6.35 4.80 61 XMStrtUSub 5417 5.72 6.19 5.48 62 BAYES_95 5414 3.86 6.19 2.66 63 HTML_IMAGE_RATIO_04 5410 4.84 6.18 4.16 64 DKIM_INVALID 5256 2.90 6.01 1.31 65 TR_XM_PhishingBody 5059 3.13 5.78 1.77 66 XM_H_GMP 5045 6.62 5.77 7.06 67 XM_UncommonTLD01 4709 5.24 5.38 5.16 68 RCVD_IN_MSPIKE_L3 4446 2.07 5.08 0.53 69 XM_H_Long_From01 4318 4.98 4.94 5.00 70 TR_XM_SpammyWords3 4304 1.87 4.92 0.31 71 RCVD_IN_MSPIKE_H3 4137 6.60 4.73 7.56 72 T_XMDrugObfuBody_14 4093 2.60 4.68 1.53 73 USER_IN_DEF_DKIM_WL 4062 12.45 4.64 16.45 74 MIME_QP_LONG_LINE 3783 3.30 4.32 2.77 75 TR_XM_SpammyWords5 3737 2.16 4.27 1.08 76 T_XMDrugObfuBody_08 3714 2.81 4.24 2.07 77 XMNumbers 3691 4.33 4.22 4.39 78 LotsOfNums_01 3685 8.15 4.21 10.17 79 TM2_M_VERY_LONG_WORD 3573 5.86 4.08 6.77 80 TooManyTo_001 3529 4.90 4.03 5.34 81 XMBody_17 3403 1.69 3.89 0.56 82 XM_B_PhoneNumber 3260 5.47 3.73 6.37 83 T_FILL_THIS_FORM_SHORT 3236 1.74 3.70 0.74 84 XM_B_Investor 3196 2.12 3.65 1.33 85 DKIM_ADSP_NXDOMAIN 3164 1.53 3.62 0.47 86 TR_XM_NoHeaderRelay 3153 1.31 3.60 0.13 87 XM_B_SpammyTLD 3130 2.74 3.58 2.31 88 XM_OfRef6 3012 1.65 3.44 0.73 89 XMStockSpam_06 2992 1.65 3.42 0.74 90 XM_CamelCaseFrm001 2985 3.09 3.41 2.92 91 RCVD_IN_MSPIKE_H5 2980 4.88 3.41 5.63 92 XMPhish30 2915 1.43 3.33 0.46 93 XMSexyCombo_05 2899 2.17 3.31 1.58 94 XM_B_Unsub2 2627 1.87 3.00 1.30 95 HTML_IMAGE_RATIO_06 2605 3.47 2.98 3.72 96 XMSexyCombo_01 2471 1.06 2.82 0.15 97 RELAYCOUNTRY_AU 2430 1.21 2.78 0.40 98 RCVD_IN_MSPIKE_H4 2377 4.15 2.72 4.89 99 HTML_IMAGE_RATIO_08 2330 3.08 2.66 3.30 100 MIME_HTML_ONLY_MULTI 2317 2.51 2.65 2.44 101 XM_SPF_SoftFail 2244 1.76 2.56 1.35 102 XM_URI_RBL 2199 1.19 2.51 0.52 103 TR_LOTS_OF_MONEY3 2198 1.11 2.51 0.39 104 HK_RANDOM_REPLYTO 2189 0.91 2.50 0.09 105 RCVD_IN_VALIDITY_RPBL 2088 0.82 2.39 0.02 106 T_XMHurry_00 2032 1.17 2.32 0.58 107 XMDiploma_00 1987 1.77 2.27 1.51 108 XM_UB50 1976 1.39 2.26 0.94 109 XM_B_DNDMA 1949 1.15 2.23 0.59 110 FROM_EXCESS_BASE64 1936 1.93 2.21 1.79 111 XMBrknScrpt_02 1894 1.65 2.16 1.39 112 RCVD_IN_VALIDITY_SAFE 1891 4.43 2.16 5.60 113 XM_B_SpammyWords4 1821 1.16 2.08 0.69 114 XM_B_Phish66 1814 1.01 2.07 0.47 115 XM_H_DKIM_GOOG 1806 0.71 2.06 0.01 116 TR_XM_INV_DKIM 1804 0.71 2.06 0.02 117 SpammyFromTLD_02 1736 0.83 1.98 0.24 118 HTML_FONT_TINY_NORDNS 1650 0.66 1.89 0.03 119 XM_B_URI_Unicode 1603 1.65 1.83 1.55 120 TM2_M_URI_OPT_OUT 1596 1.90 1.82 1.95 121 URI_HEX 1591 1.28 1.82 1.01 122 SpammyFromTLD_01 1589 0.84 1.82 0.34 123 T_REMOTE_IMAGE 1588 2.68 1.82 3.12 124 ANY_BOUNCE_MESSAGE 1587 7.80 1.81 10.87 125 BOUNCE_MESSAGE 1585 7.80 1.81 10.87 126 LOW_PRICE 1580 0.78 1.81 0.26 127 SUBJ_ALL_CAPS 1568 1.13 1.79 0.79 128 MAILING_LIST_MULTI 1562 2.09 1.79 2.24 129 T_TooManySym_01 1523 5.57 1.74 7.54 130 STY_INVIS_DIRECT 1506 0.83 1.72 0.37 131 DIET_1 1506 0.86 1.72 0.42 132 TR_XM_MSPIKECOMBO2 1456 0.60 1.66 0.05 133 MPART_ALT_DIFF_COUNT 1421 0.88 1.62 0.49 134 BAYES_40 1383 4.50 1.58 5.99 135 XM_H_Long_From02 1355 0.95 1.55 0.64 136 URI_NOVOWEL 1321 1.31 1.51 1.21 137 SHOPIFY_IMG_NOT_RCVD_SFY 1309 0.73 1.50 0.34 138 KHOP_HELO_FCRDNS 1294 3.49 1.48 4.53 139 XMBdyGiftCard01 1292 1.36 1.48 1.30 140 RDNS_DYNAMIC 1285 0.66 1.47 0.24 141 RCVD_IN_VALIDITY_CERTIFIED 1268 3.69 1.45 4.84 142 URI_TRY_3LD 1216 0.88 1.39 0.61 143 TR_XM_INTL_Spamhaus 1215 0.54 1.39 0.10 144 XMReplyNow 1207 0.65 1.38 0.28 145 XMSubMetaI_00 1200 0.82 1.37 0.54 146 XM_B_COPY_HTML 1188 1.39 1.36 1.41 147 XMGenDplmaNmb 1177 1.01 1.35 0.84 148 TVD_RCVD_IP 1159 1.57 1.32 1.70 149 HTML_IMAGE_ONLY_20 1153 0.80 1.32 0.53 150 TR_XM_RelayPhish 1136 0.47 1.30 0.04 151 HELO_DYNAMIC_SPLIT_IP 1100 0.43 1.26 0.01 152 TR_XM_PHPForged 1099 0.52 1.26 0.14 153 XM_UB99 1099 0.43 1.26 0.00 154 ALL_TRUSTED 1096 10.30 1.25 14.93 155 TR_XM_FormFill2 1091 0.51 1.25 0.14 156 T_XMDrugObfuBody_00 1089 1.10 1.24 1.02 157 TR_XM_PHPDW 1081 0.52 1.24 0.15 158 TR_XM_MaxSPIKE 1074 0.45 1.23 0.05 159 TR_XM_GMP_BULK_SIG 1069 0.50 1.22 0.13 160 XM_UB80 1050 0.42 1.20 0.02 161 XM_H_PHPOS 1049 0.49 1.20 0.13 162 RCVD_IN_PBL 1030 0.76 1.18 0.55 163 TR_Mismatch_TLD_02 1024 0.49 1.17 0.13 164 XM_B_REG_HTML 1023 0.57 1.17 0.26 165 XM_B_SEO 1018 0.50 1.16 0.15 166 XM_SendGrid 1005 1.29 1.15 1.36 167 THIS_AD 961 0.49 1.10 0.18 168 BAYES_20 947 2.73 1.08 3.57 169 SCC_CANSPAM_2 945 0.37 1.08 0.00 170 TR_Mismatch_TLD_01 940 0.57 1.07 0.31 171 XM_ProductURIs 935 0.72 1.07 0.54 172 TR_XM_InvalidRelay 928 0.36 1.06 0.01 173 XM_OfRef7 891 0.45 1.02 0.16 174 XMBounce_01 891 0.36 1.02 0.02 175 HTML_TAG_BALANCE_BODY 877 0.82 1.00 0.72 176 XMBody_78 848 0.49 0.97 0.24 177 HTML_MIME_NO_HTML_TAG 848 1.55 0.97 1.85 178 XM_DK_Undo_01 845 1.25 0.97 1.39 179 DKIM_ADSP_CUSTOM_MED 844 0.81 0.96 0.73 180 BOTNET_NORDNS 841 0.33 0.96 0.00 181 RCVD_IN_PSBL 808 0.33 0.92 0.03 182 FVGT_m_MULTI_ODD_EMAIL 783 0.33 0.89 0.04 183 XM_HighProb1 779 0.30 0.89 0.00 184 XM_UB60 772 0.35 0.88 0.08 185 RCVD_IN_IADB_LISTED 771 1.54 0.88 1.88 186 TR_XM_DK_SendGrid 769 0.99 0.88 1.05 187 XMPhishDuo 764 0.36 0.87 0.10 188 RCVD_IN_MSPIKE_L5 764 0.31 0.87 0.02 189 SUBJ_DOLLARS 763 0.55 0.87 0.38 190 RELAYCOUNTRY_RU 751 0.31 0.86 0.02 191 RELAYCOUNTRY_FR 734 0.49 0.84 0.31 192 FROMSPACE 732 0.30 0.84 0.02 193 XM_DIRTYINTL 718 0.31 0.82 0.04 194 NML_ADSP_CUSTOM_MED 717 0.58 0.82 0.46 195 TR_XM_Base64_M1 708 0.78 0.81 0.76 196 RCVD_IN_MSPIKE_L4 707 0.34 0.81 0.09 197 PLING_QUERY 704 0.54 0.80 0.40 198 XM_UB999 701 0.27 0.80 0.00 199 MultiRelay_CC 697 0.31 0.80 0.06 200 TR_XM_SEO4 690 0.32 0.79 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 142821 87.91 96.22 83.65 2 RELAYCOUNTRY_US 140465 81.96 81.35 82.27 3 DKIM_SIGNED 123881 79.11 91.92 72.55 4 XM_B_Unicode 122687 76.26 84.85 71.85 5 XM_DK_Pass 122408 76.71 86.50 71.69 6 DKIM_VALID 121647 76.21 85.91 71.25 7 DKIM_VALID_AU 106462 64.63 69.08 62.35 8 BAYES_50 104906 53.07 36.73 61.44 9 DCC_CHECK_NEGATIVE 101695 46.94 22.30 59.56 10 XMListUnsubscribeExists 86320 56.78 68.94 50.56 11 XM_B_SpammyWords 79223 54.74 71.02 46.40 12 XM_B_Unicode3 78638 47.76 51.09 46.06 13 DCC_CHECK 68931 52.79 77.03 40.37 14 HTML_FONT_LOW_CONTRAST 61434 36.36 37.09 35.98 15 LOC_TINY_FONT_1 56691 39.63 52.16 33.20 16 DKIM_VALID_EF 50154 29.45 29.61 29.37 17 T_TM2_M_HEADER_IN_MSG 46750 24.34 18.41 27.38 18 FVGT_m_MULTI_ODD 46414 30.15 35.93 27.18 19 T_KAM_HTML_FONT_INVALID 36233 24.24 30.14 21.22 20 XMSubLong 35876 19.94 17.86 21.01 21 XM_B_SpammyWords2 34776 27.50 41.42 20.37 22 MIME_HTML_ONLY 32892 21.59 26.12 19.26 23 RCVD_IN_MSPIKE_WL 30858 15.63 10.85 18.07 24 USER_IN_DEF_DKIM_WL 28088 12.45 4.64 16.45 25 XM_Multi_Part_URI 27304 18.89 24.53 15.99 26 ALL_TRUSTED 25500 10.30 1.25 14.93 27 TR_XM_DK_Unsub 24222 17.07 22.69 14.19 28 RCVD_IN_MSPIKE_H2 23407 15.94 20.28 13.71 29 UNPARSEABLE_RELAY 21642 13.97 16.48 12.68 30 XM_Evil_Numbers_Gen 20012 10.91 9.34 11.72 31 BOUNCE_MESSAGE 18558 7.80 1.81 10.87 32 ANY_BOUNCE_MESSAGE 18558 7.80 1.81 10.87 33 LotsOfNums_01 17367 8.15 4.21 10.17 34 XM_B_Unsub 14894 12.83 20.83 8.72 35 BAYES_00 14856 5.89 0.41 8.70 36 XM_DKIMWhitelistDomains 14526 5.63 0.01 8.51 37 RCVD_IN_MSPIKE_H3 12903 6.60 4.73 7.56 38 T_TooManySym_01 12867 5.57 1.74 7.54 39 XM_H_GMP 12053 6.62 5.77 7.06 40 TR_XM_DK_Bayes 12018 4.75 0.29 7.04 41 TR_XM_DK_Bayes1 11934 4.72 0.29 6.99 42 TR_XM_BayesUnsub 11779 11.25 19.74 6.90 43 BAYES_60 11598 7.41 8.61 6.79 44 TM2_M_VERY_LONG_WORD 11563 5.86 4.08 6.77 45 XM_B_SpammyWords3 11475 10.11 16.71 6.72 46 TR_MAX_INTL_RELAY 11286 10.26 17.39 6.61 47 XM_B_PhoneNumber 10869 5.47 3.73 6.37 48 XM_DK_Undo_02 10856 18.98 43.61 6.36 49 TR_XM_DK_Bayes2 10676 4.21 0.22 6.25 50 BAYES_40 10235 4.50 1.58 5.99 51 RCVD_IN_MSPIKE_H5 9612 4.88 3.41 5.63 52 RCVD_IN_VALIDITY_SAFE 9558 4.43 2.16 5.60 53 XMStrtUSub 9349 5.72 6.19 5.48 54 TooManyTo_001 9121 4.90 4.03 5.34 55 XM_UncommonTLD01 8812 5.24 5.38 5.16 56 BAYES_99 8723 14.75 33.55 5.11 57 XM_H_Long_From01 8544 4.98 4.94 5.00 58 RCVD_IN_MSPIKE_H4 8343 4.15 2.72 4.89 59 RCVD_IN_VALIDITY_CERTIFIED 8270 3.69 1.45 4.84 60 HTML_IMAGE_RATIO_02 8199 5.33 6.35 4.80 61 LOTS_OF_MONEY 7731 6.69 10.91 4.53 62 KHOP_HELO_FCRDNS 7727 3.49 1.48 4.53 63 XM_B_Phish_Phrases 7721 5.15 6.37 4.52 64 T_TooManySym_02 7666 3.11 0.42 4.49 65 BOTNET_IPINHOSTNAME 7545 6.17 9.59 4.42 66 XMNumbers 7492 4.33 4.22 4.39 67 HTML_IMAGE_RATIO_04 7097 4.84 6.18 4.16 68 XMSubMetaSx_00 6811 5.76 9.22 3.99 69 BAYES_80 6742 6.26 10.77 3.95 70 MPART_ALT_DIFF 6732 5.93 9.80 3.94 71 BAYES_999 6598 11.19 25.49 3.86 72 FSL_BULK_SIG 6556 5.79 9.58 3.84 73 INVALID_MSGID 6548 2.71 0.51 3.83 74 TO_MALFORMED 6434 2.49 0.01 3.77 75 HTML_IMAGE_RATIO_06 6350 3.47 2.98 3.72 76 BAYES_20 6095 2.73 1.08 3.57 77 MSGID_NOFQDN1 5884 2.34 0.19 3.45 78 HTML_IMAGE_RATIO_08 5627 3.08 2.66 3.30 79 TR_XM_SpammyWords4 5389 5.48 10.02 3.16 80 T_REMOTE_IMAGE 5325 2.68 1.82 3.12 81 TR_XM_DKIM_Undo 5175 12.97 32.36 3.03 82 XM_CamelCaseFrm001 4992 3.09 3.41 2.92 83 MIME_QP_LONG_LINE 4732 3.30 4.32 2.77 84 T_TVD_MIME_NO_HEADERS 4688 1.84 0.07 2.75 85 RELAYCOUNTRY_META 4591 7.84 17.89 2.69 86 BAYES_95 4541 3.86 6.19 2.66 87 MIME_CHARSET_FARAWAY 4395 1.83 0.37 2.57 88 MIME_HTML_ONLY_MULTI 4165 2.51 2.65 2.44 89 CHARSET_FARAWAY_HEADER 4140 1.69 0.27 2.42 90 XM_B_SpammyTLD 3947 2.74 3.58 2.31 91 MAILING_LIST_MULTI 3829 2.09 1.79 2.24 92 XM_Body_Dirty_Words 3669 3.58 6.39 2.15 93 T_XMDrugObfuBody_08 3539 2.81 4.24 2.07 94 XM_PDF 3370 1.43 0.36 1.97 95 TM2_M_URI_OPT_OUT 3323 1.90 1.82 1.95 96 TR_DCC_Bayes_99 3261 9.55 24.45 1.91 97 MIME_HTML_MOSTLY 3260 3.45 6.46 1.91 98 RCVD_IN_IADB_LISTED 3203 1.54 0.88 1.88 99 T_TooManySym_03 3176 1.27 0.13 1.86 100 HTML_MIME_NO_HTML_TAG 3155 1.55 0.97 1.85 101 FROM_EXCESS_BASE64 3053 1.93 2.21 1.79 102 BAYES_05 3048 1.34 0.48 1.79 103 TR_XM_PhishingBody 3021 3.13 5.78 1.77 104 TooManyTo_002 2984 1.36 0.60 1.75 105 TR_XM_UnparsRelay 2901 4.18 9.03 1.70 106 TVD_RCVD_IP 2897 1.57 1.32 1.70 107 RCVD_IN_IADB_SPF 2864 1.35 0.72 1.68 108 UNTRUSTED_Relay 2782 3.23 6.36 1.63 109 BOTNET 2723 4.35 9.71 1.59 110 XMSexyCombo_05 2704 2.17 3.31 1.58 111 XM_B_URI_Unicode 2650 1.65 1.83 1.55 112 T_XMDrugObfuBody_14 2619 2.60 4.68 1.53 113 RCVD_IN_IADB_SENDERID 2591 1.23 0.67 1.52 114 XMDiploma_00 2586 1.77 2.27 1.51 115 IN_HORDE_ADDRESS_BOOK 2584 1.03 0.08 1.51 116 RCVD_IN_IADB_DK 2513 1.20 0.67 1.47 117 TR_XM_SpammyRelay 2482 5.46 13.27 1.45 118 TVD_SPACE_RATIO 2465 0.98 0.08 1.44 119 XM_B_COPY_HTML 2410 1.39 1.36 1.41 120 XM_DK_Undo_01 2372 1.25 0.97 1.39 121 XMBrknScrpt_02 2365 1.65 2.16 1.39 122 XM_SendGrid 2330 1.29 1.15 1.36 123 XM_SPF_SoftFail 2313 1.76 2.56 1.35 124 XM_B_Investor 2266 2.12 3.65 1.33 125 DKIM_INVALID 2234 2.90 6.01 1.31 126 XMGappySubj_01 2224 0.91 0.13 1.30 127 XMBdyGiftCard01 2222 1.36 1.48 1.30 128 XM_B_Unsub2 2213 1.87 3.00 1.30 129 RCVD_IN_IADB_VOUCHED 2094 0.98 0.50 1.23 130 URI_NOVOWEL 2069 1.31 1.51 1.21 131 XMBSHREFv2 2043 0.90 0.32 1.20 132 XM_GoogleGroups 1942 1.01 0.77 1.14 133 TR_Symld_Words 1866 0.94 0.64 1.09 134 TR_XM_SpammyWords5 1846 2.16 4.27 1.08 135 TR_XM_DK_SendGrid 1795 0.99 0.88 1.05 136 T_XMDrugObfuBody_00 1750 1.10 1.24 1.02 137 XMGappySubj_02 1741 0.68 0.02 1.02 138 URI_HEX 1716 1.28 1.82 1.01 139 RCVD_IN_IADB_OPTIN 1616 0.75 0.36 0.95 140 XM_UB50 1606 1.39 2.26 0.94 141 TooManyTo_003 1582 0.79 0.53 0.93 142 TR_MetaPhish_Combo_01 1564 0.80 0.58 0.92 143 FROM_GOV_DKIM_AU 1455 0.71 0.44 0.85 144 XMGenDplmaNmb 1429 1.01 1.35 0.84 145 TR_XM_GMP_MSPIKE_UNDO2 1412 0.60 0.17 0.83 146 XM_H_PHPMailer 1380 0.69 0.47 0.81 147 SUBJ_ALL_CAPS 1343 1.13 1.79 0.79 148 TR_XM_Base64_M1 1295 0.78 0.81 0.76 149 RELAYCOUNTRY_CA 1275 3.14 7.80 0.75 150 T_FILL_THIS_FORM_SHORT 1265 1.74 3.70 0.74 151 XMStockSpam_06 1262 1.65 3.42 0.74 152 XM_OfRef6 1253 1.65 3.44 0.73 153 DKIM_ADSP_CUSTOM_MED 1249 0.81 0.96 0.73 154 HTML_TAG_BALANCE_BODY 1232 0.82 1.00 0.72 155 TooManyTo_004 1227 0.64 0.49 0.72 156 XMSubMetaSxObfu_03 1207 0.58 0.32 0.71 157 XMLngstWrd_00 1174 0.57 0.35 0.69 158 XM_B_SpammyWords4 1171 1.16 2.08 0.69 159 XMSlimDrugH 1169 0.67 0.65 0.68 160 RCVD_IN_BL_SPAMCOP_NET 1116 4.97 13.40 0.65 161 TR_XM_MSPIKECOMBO 1108 2.72 6.76 0.65 162 RCVD_IN_MSPIKE_BL 1108 2.72 6.76 0.65 163 MSGID_FROM_MTA_HEADER 1107 0.51 0.23 0.65 164 XM_H_Long_From02 1100 0.95 1.55 0.64 165 TR_XM_SpammyWords2 1069 4.57 12.27 0.63 166 URI_TRY_3LD 1046 0.88 1.39 0.61 167 TooManyTo_005 1029 0.55 0.45 0.60 168 AD_PREFS 1014 0.44 0.15 0.59 169 XM_B_DNDMA 1008 1.15 2.23 0.59 170 T_XMHurry_00 984 1.17 2.32 0.58 171 XM_B_FormFill 960 0.38 0.02 0.56 172 XMBody_17 958 1.69 3.89 0.56 173 RCVD_IN_PBL 939 0.76 1.18 0.55 174 T_TooManySym_04 932 0.37 0.03 0.55 175 XM_ProductURIs 924 0.72 1.07 0.54 176 XMSubMetaI_00 921 0.82 1.37 0.54 177 RCVD_IN_MSPIKE_L3 909 2.07 5.08 0.53 178 HTML_IMAGE_ONLY_20 900 0.80 1.32 0.53 179 XMLngstWrd_01 897 0.45 0.31 0.53 180 XM_URI_RBL 884 1.19 2.51 0.52 181 XMPhish14 859 0.56 0.67 0.50 182 XMNoVowels 850 0.44 0.33 0.50 183 XMSubMetaSxObfu_02 847 0.48 0.45 0.50 184 MPART_ALT_DIFF_COUNT 845 0.88 1.62 0.49 185 DKIM_ADSP_NXDOMAIN 798 1.53 3.62 0.47 186 XM_B_Phish66 797 1.01 2.07 0.47 187 NML_ADSP_CUSTOM_MED 793 0.58 0.82 0.46 188 XM_S_SubURI 787 0.32 0.04 0.46 189 XMPhish30 785 1.43 3.33 0.46 190 LONGLN_LOW_CONTRAST 778 0.51 0.60 0.46 191 TM2_M_OBFU_COMMENT 761 0.41 0.35 0.45 192 FORGED_GMAIL_RCVD 756 0.53 0.71 0.44 193 XMBody_95 739 0.32 0.11 0.43 194 HTML_FONT_FACE_BAD 731 0.53 0.72 0.43 195 HTTPS_HTTP_MISMATCH 731 0.49 0.62 0.43 196 DIET_1 723 0.86 1.72 0.42 197 XM_Walgreens_Forge 718 0.28 0.01 0.42 198 XMHTMLBadTable_001 694 0.46 0.55 0.41 199 RELAYCOUNTRY_AU 688 1.21 2.78 0.40 200 PLING_QUERY 684 0.54 0.80 0.40 ----------------------------------------------------------------------