Email: 365068 Autolearn: 0 AvgScore: 2.31 AvgScanTime: 1.89 sec Spam: 89774 Autolearn: 0 AvgScore: 13.48 AvgScanTime: 2.94 sec Ham: 275294 Autolearn: 0 AvgScore: -1.33 AvgScanTime: 1.54 sec Time Spent Running SA: 191.27 hours Time Spent Processing Spam: 73.31 hours Time Spent Processing Ham: 117.96 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 82953 88.14 92.40 86.74 2 DCC_CHECK 68879 56.43 76.72 49.82 3 DKIM_SIGNED 68706 77.38 76.53 77.66 4 RELAYCOUNTRY_US 67363 80.19 75.04 81.87 5 XM_DK_Pass 66992 76.11 74.62 76.60 6 XM_B_Unicode 61624 71.54 68.64 72.48 7 XMListUnsubscribeExists 59574 58.40 66.36 55.81 8 DKIM_VALID 59011 71.25 65.73 73.05 9 DKIM_VALID_AU 46351 58.05 51.63 60.14 10 XM_DK_Undo_02 38301 15.82 42.66 7.06 11 MIME_HTML_ONLY 37766 27.17 42.07 22.31 12 BAYES_50 37557 50.99 41.84 53.97 13 XM_B_Unicode3 33456 42.78 37.27 44.57 14 LOC_TINY_FONT_1 28788 31.08 32.07 30.76 15 BAYES_99 25775 10.31 28.71 4.32 16 RELAYCOUNTRY_META 24978 10.83 27.82 5.29 17 DKIM_VALID_EF 24575 27.36 27.37 27.36 18 HTML_FONT_LOW_CONTRAST 23445 30.90 26.12 32.46 19 T_KAM_HTML_FONT_INVALID 22706 19.02 25.29 16.97 20 TR_DCC_Bayes_99 21228 7.80 23.65 2.63 21 BOTNET 20546 7.47 22.89 2.45 22 FVGT_m_MULTI_ODD 20473 23.06 22.81 23.14 23 BAYES_999 20191 8.18 22.49 3.51 24 DCC_CHECK_NEGATIVE 19649 42.38 21.89 49.06 25 UNTRUSTED_Relay 16473 5.87 18.35 1.80 26 XM_UncommonTLD01 16164 7.71 18.01 4.36 27 XMSubLong 16023 20.07 17.85 20.80 28 T_TM2_M_HEADER_IN_MSG 15793 21.31 17.59 22.52 29 XM_Body_Dirty_Words 15512 15.89 17.28 15.44 30 XM_Multi_Part_URI 15047 15.04 16.76 14.48 31 HTML_IMAGE_RATIO_02 13622 11.45 15.17 10.24 32 FSL_BULK_SIG 13585 10.27 15.13 8.68 33 LOTS_OF_MONEY 13034 9.72 14.52 8.15 34 BOTNET_IPINHOSTNAME 11933 7.78 13.29 5.98 35 XM_UB50 10500 3.73 11.70 1.14 36 DKIM_INVALID 9695 6.13 10.80 4.60 37 XM_B_Unsub 9631 10.27 10.73 10.12 38 XM_SPF_SoftFail 9589 3.38 10.68 1.00 39 XM_CamelCaseFrm001 9505 4.49 10.59 2.50 40 XMSexyCombo_05 8929 6.13 9.95 4.89 41 RCVD_IN_MSPIKE_BL 8894 3.60 9.91 1.54 42 RCVD_IN_RP_RNBL 8669 2.47 9.66 0.13 43 XM_B_Phish_Phrases 8661 8.71 9.65 8.40 44 NO_DNS_FOR_FROM 8505 4.14 9.47 2.40 45 XMBody_17 8017 3.01 8.93 1.08 46 KHOP_HELO_FCRDNS 7960 3.14 8.87 1.27 47 XM_Evil_Numbers_Gen 7909 9.33 8.81 9.50 48 RCVD_IN_MSPIKE_H2 7874 13.08 8.77 14.48 49 BAYES_80 7248 4.38 8.07 3.18 50 BAYES_60 7159 6.51 7.97 6.04 51 RELAYCOUNTRY_CA 6850 3.30 7.63 1.88 52 RDNS_DYNAMIC 6596 2.18 7.35 0.49 53 BODY_URI_ONLY 6516 1.83 7.26 0.06 54 URIBL_SBL_A 6364 2.37 7.09 0.83 55 PDS_OTHER_BAD_TLD 6339 2.92 7.06 1.57 56 RCVD_IN_BL_SPAMCOP_NET 6149 2.03 6.85 0.46 57 LotsOfNums_01 5865 7.74 6.53 8.13 58 MPART_ALT_DIFF 5811 6.81 6.47 6.92 59 XMSubMetaSx_00 5715 4.21 6.37 3.51 60 BOTNET_NORDNS 5653 1.55 6.30 0.01 61 RCVD_IN_MSPIKE_L3 5589 2.58 6.23 1.39 62 XMNumbers 5469 4.18 6.09 3.55 63 XM_H_Long_From01 5369 5.58 5.98 5.44 64 XMHTML_After_End 5275 1.93 5.88 0.64 65 HTML_IMAGE_RATIO_04 5247 7.18 5.84 7.62 66 TR_XM_MaxBayes 5234 1.45 5.83 0.02 67 XMStrtUSub 5006 6.17 5.58 6.36 68 UNPARSEABLE_RELAY 4771 7.46 5.31 8.16 69 T_XMDrugObfuBody_08 4549 2.27 5.07 1.36 70 DKIM_ADSP_NXDOMAIN 4507 1.50 5.02 0.35 71 TooManyTo_001 4425 6.61 4.93 7.16 72 TR_XM_COVIDMETA4 4272 1.84 4.76 0.89 73 MIME_HTML_MOSTLY 4148 4.29 4.62 4.19 74 BAYES_95 4117 2.50 4.59 1.82 75 RELAYCOUNTRY_DE 3942 1.43 4.39 0.46 76 XM_DIRTYINTL 3905 1.43 4.35 0.47 77 RCVD_IN_PSBL 3882 1.30 4.32 0.31 78 XM_OfRef6 3880 1.77 4.32 0.94 79 XM_B_COVIDMETA 3877 2.12 4.32 1.40 80 TR_LOTS_OF_MONEY3 3847 1.47 4.29 0.56 81 SUBJ_ALL_CAPS 3832 1.85 4.27 1.06 82 XM_SendGrid 3772 6.49 4.20 7.24 83 XM_B_SpammyTLD 3724 3.53 4.15 3.33 84 SpammyFromTLD_02 3497 1.34 3.90 0.50 85 T_FILL_THIS_FORM_SHORT 3396 1.87 3.78 1.25 86 DATE_IN_PAST_03_06 3277 0.98 3.65 0.11 87 DATE_IN_PAST_06_12 3266 1.12 3.64 0.29 88 URIBL_DBL_SPAM 3160 0.88 3.52 0.02 89 FROM_SUSPICIOUS_NTLD 3013 0.88 3.36 0.07 90 SCRIPT_GIBBERISH 2997 0.82 3.34 0.00 91 FROM_SUSPICIOUS_NTLD_FP 2967 0.87 3.30 0.07 92 HTML_MIME_NO_HTML_TAG 2854 2.30 3.18 2.01 93 XM_OfRef7 2852 0.83 3.18 0.07 94 TO_MALFORMED 2831 2.73 3.15 2.60 95 RELAYCOUNTRY_FR 2712 0.91 3.02 0.23 96 FROM_EXCESS_BASE64 2649 3.39 2.95 3.54 97 RELAYCOUNTRY_TW 2621 0.77 2.92 0.07 98 HTML_IMAGE_RATIO_08 2610 2.87 2.91 2.86 99 BAYES_40 2589 4.48 2.88 5.00 100 UNCLAIMED_MONEY 2540 0.70 2.83 0.00 101 SHORT_URI 2481 0.69 2.76 0.02 102 MONEY_FRAUD_8 2476 0.68 2.76 0.01 103 DEAR_BENEFICIARY 2475 0.68 2.76 0.01 104 T_FILL_THIS_FORM_FRAUD_PHISH 2462 0.70 2.74 0.03 105 FORM_FRAUD_5 2454 0.68 2.73 0.00 106 MONEY_FORM_SHORT 2445 0.68 2.72 0.01 107 UPPERCASE_75_100 2415 0.67 2.69 0.01 108 XMSpecificSbj 2413 0.66 2.69 0.00 109 XMSubject_63 2395 0.66 2.67 0.00 110 RCVD_IN_MSPIKE_L5 2330 0.74 2.60 0.13 111 RCVD_IN_RP_SAFE 2310 10.81 2.57 13.50 112 RCVD_IN_MSPIKE_H3 2296 7.70 2.56 9.38 113 RCVD_IN_MSPIKE_WL 2296 7.70 2.56 9.38 114 T_XMHurry_00 2206 1.09 2.46 0.65 115 XM_URI_RBL 2206 0.78 2.46 0.23 116 LongTLD 2196 0.72 2.45 0.15 117 TR_XM_PhishingBody 2170 1.92 2.42 1.76 118 BAYES_20 2149 3.50 2.39 3.87 119 MIME_QP_LONG_LINE 2145 3.65 2.39 4.07 120 T_TooManySym_01 2029 5.13 2.26 6.06 121 MIME_HTML_ONLY_MULTI 2028 3.25 2.26 3.57 122 XM_UB60 2023 0.60 2.25 0.06 123 HTML_SHORT_LINK_IMG_1 2001 0.56 2.23 0.01 124 HTML_IMAGE_RATIO_06 1972 3.41 2.20 3.80 125 TR_XM_PHPDW 1932 0.87 2.15 0.45 126 HTML_FONT_SIZE_HUGE 1930 0.66 2.15 0.17 127 URI_TRY_3LD 1923 1.81 2.14 1.71 128 TR_XM_INV_DKIM 1914 0.60 2.13 0.10 129 TR_XM_PHPForged 1885 0.84 2.10 0.42 130 TR_XM_FormFill2 1872 0.83 2.09 0.42 131 XM_H_PHPOS 1867 0.83 2.08 0.42 132 TR_XM_DK_SendGrid 1839 3.68 2.05 4.21 133 BAYES_00 1824 14.92 2.03 19.12 134 SpammyFromTLD_01 1807 0.84 2.01 0.46 135 TM2_M_URI_OPT_OUT 1772 3.50 1.97 3.99 136 XMSexyCombo_01 1707 0.84 1.90 0.50 137 TR_XM_MaxSPIKE 1679 0.50 1.87 0.05 138 XMDiploma_00 1679 1.30 1.87 1.11 139 T_XMDrugObfuBody_14 1611 1.57 1.79 1.50 140 TM2_M_VERY_LONG_WORD 1603 1.65 1.79 1.61 141 URI_HEX 1601 1.35 1.78 1.20 142 XMStockSpam_06 1504 1.54 1.68 1.50 143 XMMoneyMeta_00 1496 0.68 1.67 0.36 144 XMBdyGiftCard01 1456 2.20 1.62 2.39 145 XM_UB80 1379 0.39 1.54 0.02 146 TR_Mismatch_TLD_01 1360 0.53 1.51 0.21 147 XM_B_Unsub2 1345 1.16 1.50 1.05 148 BAYES_05 1338 2.40 1.49 2.69 149 NO_FM_NAME_IP_HOSTN 1303 0.36 1.45 0.00 150 DATE_IN_PAST_12_24 1190 0.79 1.33 0.61 151 TR_XM_RelayPhish 1183 0.47 1.32 0.20 152 RCVD_IN_RP_CERTIFIED 1167 9.60 1.30 12.31 153 TR_XM_DK_Bayes 1165 10.48 1.30 13.48 154 T_REMOTE_IMAGE 1159 2.53 1.29 2.93 155 XMBrknScrpt_02 1148 1.34 1.28 1.36 156 XM_ProductURIs 1133 1.23 1.26 1.22 157 TR_Mismatch_TLD_02 1127 0.36 1.26 0.06 158 RELAYCOUNTRY_GB 1091 1.00 1.22 0.94 159 XMPhish30 1066 0.57 1.19 0.36 160 DKIM_ADSP_CUSTOM_MED 1052 1.24 1.17 1.26 161 HTML_IMAGE_ONLY_08 1051 0.38 1.17 0.13 162 RELAYCOUNTRY_IN 1040 0.33 1.16 0.06 163 RCVD_IN_IADB_LISTED 1031 2.47 1.15 2.91 164 HTML_IMAGE_ONLY_04 1011 0.34 1.13 0.08 165 XM_H_PHPMailer 1000 0.73 1.11 0.60 166 DIET_1 988 0.89 1.10 0.82 167 XMGenDplmaNmb 978 0.76 1.09 0.65 168 RCVD_IN_MSPIKE_L4 976 0.28 1.09 0.01 169 MISSING_HEADERS 975 0.59 1.09 0.43 170 NML_ADSP_CUSTOM_MED 974 0.94 1.08 0.89 171 RELAYCOUNTRY_JP 950 0.29 1.06 0.04 172 FORGED_GMAIL_RCVD 936 0.65 1.04 0.53 173 RCVD_IN_IADB_SPF 929 2.17 1.03 2.54 174 RCVD_IN_IADB_SENDERID 910 1.98 1.01 2.30 175 RCVD_IN_IADB_DK 906 1.94 1.01 2.24 176 XM_UB99 853 0.24 0.95 0.00 177 XM_H_PHPOS_M 850 0.37 0.95 0.19 178 ALL_TRUSTED 837 11.01 0.93 14.30 179 MSGID_SHORT 834 0.24 0.93 0.01 180 XM_DK_Undo_01 832 1.43 0.93 1.60 181 T_XMDrugObfuBody_00 785 0.74 0.87 0.69 182 XMSexyCombo_04 784 0.30 0.87 0.11 183 PLING_QUERY 775 0.53 0.86 0.42 184 DATE_IN_PAST_24_48 748 0.22 0.83 0.02 185 MPART_ALT_DIFF_COUNT 747 0.46 0.83 0.34 186 TR_XM_DK_Bayes1 734 9.83 0.82 12.76 187 XM_UB95 733 0.21 0.82 0.01 188 URIBL_BLACK 733 0.21 0.82 0.01 189 XM_UCStrings02 724 0.25 0.81 0.07 190 FROM_MISSP_DYNIP 719 0.20 0.80 0.00 191 HK_RANDOM_ENVFROM 707 0.31 0.79 0.15 192 RELAYCOUNTRY_AT 699 0.30 0.78 0.15 193 TR_Symld_Words 696 0.93 0.78 0.97 194 MAILING_LIST_MULTI 679 1.76 0.76 2.09 195 XMBody_78 669 0.59 0.75 0.53 196 RELAYCOUNTRY_RU 666 0.25 0.74 0.10 197 HTML_TAG_BALANCE_BODY 665 1.03 0.74 1.12 198 XMReplyNow 658 0.24 0.73 0.08 199 T_Symld_Words_02 657 0.43 0.73 0.33 200 XMSubNoVowel 642 1.11 0.72 1.24 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 238801 88.14 92.40 86.74 2 RELAYCOUNTRY_US 225378 80.19 75.04 81.87 3 DKIM_SIGNED 213781 77.38 76.53 77.66 4 XM_DK_Pass 210879 76.11 74.62 76.60 5 DKIM_VALID 201110 71.25 65.73 73.05 6 XM_B_Unicode 199532 71.54 68.64 72.48 7 DKIM_VALID_AU 165556 58.05 51.63 60.14 8 XMListUnsubscribeExists 153639 58.40 66.36 55.81 9 BAYES_50 148573 50.99 41.84 53.97 10 DCC_CHECK 137143 56.43 76.72 49.82 11 DCC_CHECK_NEGATIVE 135054 42.38 21.89 49.06 12 XM_B_Unicode3 122709 42.78 37.27 44.57 13 HTML_FONT_LOW_CONTRAST 89372 30.90 26.12 32.46 14 LOC_TINY_FONT_1 84687 31.08 32.07 30.76 15 DKIM_VALID_EF 75311 27.36 27.37 27.36 16 FVGT_m_MULTI_ODD 63706 23.06 22.81 23.14 17 T_TM2_M_HEADER_IN_MSG 61996 21.31 17.59 22.52 18 MIME_HTML_ONLY 61409 27.17 42.07 22.31 19 XMSubLong 57257 20.07 17.85 20.80 20 BAYES_00 52627 14.92 2.03 19.12 21 T_KAM_HTML_FONT_INVALID 46729 19.02 25.29 16.97 22 XM_Body_Dirty_Words 42508 15.89 17.28 15.44 23 RCVD_IN_MSPIKE_H2 39876 13.08 8.77 14.48 24 XM_Multi_Part_URI 39863 15.04 16.76 14.48 25 ALL_TRUSTED 39364 11.01 0.93 14.30 26 RCVD_IN_RP_SAFE 37151 10.81 2.57 13.50 27 TR_XM_DK_Bayes 37111 10.48 1.30 13.48 28 TR_XM_DK_Bayes1 35135 9.83 0.82 12.76 29 RCVD_IN_RP_CERTIFIED 33887 9.60 1.30 12.31 30 TR_XM_DK_Bayes2 32942 9.17 0.60 11.97 31 XM_DKIMWhitelistDomains 30233 8.29 0.05 10.98 32 HTML_IMAGE_RATIO_02 28183 11.45 15.17 10.24 33 XM_B_Unsub 27851 10.27 10.73 10.12 34 XM_Evil_Numbers_Gen 26165 9.33 8.81 9.50 35 RCVD_IN_MSPIKE_WL 25819 7.70 2.56 9.38 36 RCVD_IN_MSPIKE_H3 25819 7.70 2.56 9.38 37 FSL_BULK_SIG 23906 10.27 15.13 8.68 38 XM_B_Phish_Phrases 23132 8.71 9.65 8.40 39 UNPARSEABLE_RELAY 22463 7.46 5.31 8.16 40 LOTS_OF_MONEY 22443 9.72 14.52 8.15 41 LotsOfNums_01 22376 7.74 6.53 8.13 42 HTML_IMAGE_RATIO_04 20977 7.18 5.84 7.62 43 XM_SendGrid 19919 6.49 4.20 7.24 44 TooManyTo_001 19723 6.61 4.93 7.16 45 XM_DK_Undo_02 19435 15.82 42.66 7.06 46 MPART_ALT_DIFF 19038 6.81 6.47 6.92 47 XMStrtUSub 17509 6.17 5.58 6.36 48 T_TooManySym_01 16692 5.13 2.26 6.06 49 BAYES_60 16622 6.51 7.97 6.04 50 BOTNET_IPINHOSTNAME 16474 7.78 13.29 5.98 51 XM_H_Long_From01 14989 5.58 5.98 5.44 52 RELAYCOUNTRY_META 14550 10.83 27.82 5.29 53 BAYES_40 13755 4.48 2.88 5.00 54 XMSexyCombo_05 13453 6.13 9.95 4.89 55 DKIM_INVALID 12671 6.13 10.80 4.60 56 XM_UncommonTLD01 11995 7.71 18.01 4.36 57 BAYES_99 11881 10.31 28.71 4.32 58 TR_XM_DK_SendGrid 11583 3.68 2.05 4.21 59 MIME_HTML_MOSTLY 11523 4.29 4.62 4.19 60 MIME_QP_LONG_LINE 11193 3.65 2.39 4.07 61 TM2_M_URI_OPT_OUT 10996 3.50 1.97 3.99 62 BAYES_20 10642 3.50 2.39 3.87 63 HTML_IMAGE_RATIO_06 10460 3.41 2.20 3.80 64 MIME_HTML_ONLY_MULTI 9840 3.25 2.26 3.57 65 XMNumbers 9776 4.18 6.09 3.55 66 FROM_EXCESS_BASE64 9740 3.39 2.95 3.54 67 BAYES_999 9660 8.18 22.49 3.51 68 XMSubMetaSx_00 9650 4.21 6.37 3.51 69 XM_H_Trusted_IP 9589 2.63 0.00 3.48 70 ANY_BOUNCE_MESSAGE 9263 2.59 0.19 3.36 71 BOUNCE_MESSAGE 9236 2.58 0.19 3.35 72 XM_B_SpammyTLD 9158 3.53 4.15 3.33 73 BAYES_80 8759 4.38 8.07 3.18 74 T_REMOTE_IMAGE 8075 2.53 1.29 2.93 75 RCVD_IN_IADB_LISTED 7998 2.47 1.15 2.91 76 HTML_IMAGE_RATIO_08 7882 2.87 2.91 2.86 77 TVD_RCVD_IP 7858 2.27 0.46 2.85 78 IN_ZIMBRA_NJ_WHITELIST 7834 2.15 0.01 2.85 79 INVALID_MSGID 7814 2.22 0.32 2.84 80 T_TooManySym_02 7727 2.28 0.66 2.81 81 BAYES_05 7413 2.40 1.49 2.69 82 TR_DCC_Bayes_99 7236 7.80 23.65 2.63 83 TO_MALFORMED 7153 2.73 3.15 2.60 84 CK_HELO_DYNAMIC_SPLIT_IP 7105 1.98 0.13 2.58 85 HELO_DYNAMIC_IPADDR2 7090 1.96 0.06 2.58 86 RCVD_IN_IADB_SPF 6993 2.17 1.03 2.54 87 XM_CamelCaseFrm001 6893 4.49 10.59 2.50 88 BOTNET 6741 7.47 22.89 2.45 89 NO_DNS_FOR_FROM 6600 4.14 9.47 2.40 90 XMBdyGiftCard01 6591 2.20 1.62 2.39 91 XM_PDF 6540 1.92 0.50 2.38 92 RCVD_IN_IADB_SENDERID 6334 1.98 1.01 2.30 93 RCVD_IN_IADB_DK 6167 1.94 1.01 2.24 94 MAILING_LIST_MULTI 5751 1.76 0.76 2.09 95 HTML_MIME_NO_HTML_TAG 5544 2.30 3.18 2.01 96 RELAYCOUNTRY_CA 5184 3.30 7.63 1.88 97 BAYES_95 5019 2.50 4.59 1.82 98 IN_HORDE_ADDRESS_BOOK 4957 1.37 0.03 1.80 99 UNTRUSTED_Relay 4953 5.87 18.35 1.80 100 TR_XM_PhishingBody 4841 1.92 2.42 1.76 101 RCVD_IN_IADB_VOUCHED 4779 1.39 0.34 1.74 102 URI_TRY_3LD 4702 1.81 2.14 1.71 103 TooManyTo_002 4472 1.33 0.43 1.62 104 TM2_M_VERY_LONG_WORD 4420 1.65 1.79 1.61 105 HTML_FONT_FACE_BAD 4401 1.32 0.47 1.60 106 USER_IN_DEF_DKIM_WL 4397 1.20 0.00 1.60 107 XM_DK_Undo_01 4391 1.43 0.93 1.60 108 PDS_OTHER_BAD_TLD 4332 2.92 7.06 1.57 109 RCVD_IN_MSPIKE_BL 4234 3.60 9.91 1.54 110 XMStockSpam_06 4121 1.54 1.68 1.50 111 T_XMDrugObfuBody_14 4116 1.57 1.79 1.50 112 XM_RXBody 3940 1.22 0.55 1.43 113 XM_GoogleGroups 3879 1.16 0.42 1.41 114 XM_B_COVIDMETA 3858 2.12 4.32 1.40 115 RCVD_IN_MSPIKE_L3 3836 2.58 6.23 1.39 116 T_XMDrugObfuBody_08 3741 2.27 5.07 1.36 117 XMBrknScrpt_02 3740 1.34 1.28 1.36 118 KHOP_HELO_FCRDNS 3485 3.14 8.87 1.27 119 DKIM_ADSP_CUSTOM_MED 3481 1.24 1.17 1.26 120 T_FILL_THIS_FORM_SHORT 3441 1.87 3.78 1.25 121 XMSubNoVowel 3406 1.11 0.72 1.24 122 XM_ProductURIs 3351 1.23 1.26 1.22 123 TooManyTo_003 3311 0.99 0.35 1.20 124 URI_HEX 3311 1.35 1.78 1.20 125 XMGappySubj_01 3219 0.92 0.15 1.17 126 XM_UB50 3128 3.73 11.70 1.14 127 HTML_TAG_BALANCE_BODY 3086 1.03 0.74 1.12 128 XMDiploma_00 3050 1.30 1.87 1.11 129 XMBody_17 2971 3.01 8.93 1.08 130 RCVD_IN_IADB_OPTIN 2916 0.85 0.23 1.06 131 SUBJ_ALL_CAPS 2905 1.85 4.27 1.06 132 XM_B_Unsub2 2904 1.16 1.50 1.05 133 TooManyTo_004 2825 0.85 0.31 1.03 134 XMPhish08 2789 0.94 0.70 1.01 135 XM_SPF_SoftFail 2752 3.38 10.68 1.00 136 XM_H_Long_From02 2690 0.87 0.52 0.98 137 TR_Symld_Words 2683 0.93 0.78 0.97 138 TR_MSPIKEBAYES00 2605 0.72 0.02 0.95 139 XM_OfRef6 2592 1.77 4.32 0.94 140 RELAYCOUNTRY_GB 2577 1.00 1.22 0.94 141 TooManyTo_005 2488 0.75 0.28 0.90 142 TR_XM_COVIDMETA4 2458 1.84 4.76 0.89 143 NML_ADSP_CUSTOM_MED 2448 0.94 1.08 0.89 144 T_TooManySym_03 2414 0.71 0.20 0.88 145 URIBL_SBL_A 2280 2.37 7.09 0.83 146 DIET_1 2262 0.89 1.10 0.82 147 T_XMDrugObfuBody_00 1906 0.74 0.87 0.69 148 XM_B_REG_HTML 1877 0.62 0.44 0.68 149 HTTPS_HTTP_MISMATCH 1847 0.66 0.64 0.67 150 HELO_NODOT 1802 0.61 0.47 0.65 151 XMGenDplmaNmb 1798 0.76 1.09 0.65 152 HELO_NO_DOMAIN 1797 0.61 0.47 0.65 153 T_XMHurry_00 1787 1.09 2.46 0.65 154 XMHTML_After_End 1768 1.93 5.88 0.64 155 DATE_IN_PAST_12_24 1676 0.79 1.33 0.61 156 XM_H_PHPMailer 1653 0.73 1.11 0.60 157 USER_IN_WHITELIST 1649 0.45 0.00 0.60 158 T_OBFU_JPG_ATTACH 1648 0.46 0.02 0.60 159 TR_LOTS_OF_MONEY3 1530 1.47 4.29 0.56 160 TR_MetaPhish_Combo_01 1528 0.52 0.41 0.56 161 XMBody_95 1493 0.43 0.08 0.54 162 XMBody_78 1467 0.59 0.75 0.53 163 FORGED_GMAIL_RCVD 1446 0.65 1.04 0.53 164 XMCapTrack 1446 0.51 0.46 0.53 165 SUBJ_DOLLARS 1437 0.55 0.62 0.52 166 HTML_IMAGE_ONLY_20 1400 0.43 0.20 0.51 167 SpammyFromTLD_02 1389 1.34 3.90 0.50 168 XMSexyCombo_01 1365 0.84 1.90 0.50 169 XMLngstWrd_00 1362 0.48 0.44 0.49 170 RDNS_DYNAMIC 1351 2.18 7.35 0.49 171 XMSubMetaSxObfu_02 1331 0.48 0.48 0.48 172 HTML_OBFUSCATE_05_10 1315 0.39 0.11 0.48 173 XM_DIRTYINTL 1301 1.43 4.35 0.47 174 RELAYCOUNTRY_DE 1279 1.43 4.39 0.46 175 RCVD_IN_BL_SPAMCOP_NET 1266 2.03 6.85 0.46 176 SpammyFromTLD_01 1264 0.84 2.01 0.46 177 XMSubMetaSxObfu_03 1261 0.47 0.49 0.46 178 XMNoVowels 1253 0.46 0.49 0.46 179 XMHTMLBadTable_001 1243 0.43 0.35 0.45 180 TR_XM_PHPDW 1236 0.87 2.15 0.45 181 XMLngstWrd_01 1222 0.44 0.42 0.44 182 XM_B_COPY_HTML 1184 0.50 0.70 0.43 183 MISSING_HEADERS 1174 0.59 1.09 0.43 184 XMSubGiftCard1 1169 0.45 0.51 0.42 185 TR_XM_FormFill2 1168 0.83 2.09 0.42 186 TR_XM_PHPForged 1167 0.84 2.10 0.42 187 XM_Akamai 1165 0.33 0.03 0.42 188 PLING_QUERY 1159 0.53 0.86 0.42 189 XM_H_PHPOS 1147 0.83 2.08 0.42 190 URI_NOVOWEL 1128 0.43 0.49 0.41 191 XMSubMetaI_00 1119 0.48 0.69 0.41 192 T_TooManySym_04 1085 0.32 0.11 0.39 193 THIS_AD 1063 0.35 0.23 0.39 194 BODY_ENHANCEMENT 1058 0.30 0.03 0.38 195 XM_ShortIntro_01 1045 0.46 0.69 0.38 196 XMLngstWrd_02 1017 0.37 0.39 0.37 197 XMPhish14 1013 0.41 0.52 0.37 198 XMBSHREFv2 1010 0.37 0.38 0.37 199 NORDNS_LOW_CONTRAST 1005 0.32 0.19 0.37 200 XMPhish30 1000 0.57 1.19 0.36 ----------------------------------------------------------------------