Email: 366829 Autolearn: 0 AvgScore: -0.09 AvgScanTime: 2.03 sec Spam: 60357 Autolearn: 0 AvgScore: 12.54 AvgScanTime: 3.71 sec Ham: 306472 Autolearn: 0 AvgScore: -2.57 AvgScanTime: 1.70 sec Time Spent Running SA: 206.65 hours Time Spent Processing Spam: 62.15 hours Time Spent Processing Ham: 144.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 59076 98.74 97.88 98.91 2 HTML_MESSAGE 56204 88.99 93.12 88.18 3 DKIM_SIGNED 46944 79.84 77.78 80.24 4 XM_DK_Pass 45488 78.47 75.36 79.08 5 XM_B_Unicode 41297 73.65 68.42 74.68 6 XMListUnsubscribeExists 40509 61.27 67.12 60.12 7 RELAYCOUNTRY_US 40210 80.00 66.62 82.63 8 DKIM_VALID 38328 73.19 63.50 75.09 9 XM_DK_Undo_02 35131 20.39 58.21 12.95 10 DKIM_VALID_AU 29024 59.38 48.09 61.60 11 BAYES_99 27074 14.78 44.86 8.85 12 MIME_HTML_ONLY 26162 26.62 43.35 23.33 13 BAYES_999 22513 12.00 37.30 7.02 14 RELAYCOUNTRY_META 21070 10.67 34.91 5.89 15 DKIM_VALID_EF 20335 28.02 33.69 26.90 16 XM_B_Unicode3 20215 44.32 33.49 46.45 17 LOC_TINY_FONT_1 19284 32.53 31.95 32.64 18 BAYES_50 19174 46.74 31.77 49.69 19 XM_UncommonTLD01 16168 8.08 26.79 4.39 20 BOTNET 16029 7.14 26.56 3.31 21 T_KAM_HTML_FONT_INVALID 15387 19.42 25.49 18.23 22 XMSubLong 15083 21.18 24.99 20.43 23 UNTRUSTED_Relay 14164 5.75 23.47 2.26 24 FVGT_m_MULTI_ODD 13613 23.12 22.55 23.23 25 RCVD_IN_MSPIKE_H2 13568 20.71 22.48 20.36 26 HTML_FONT_LOW_CONTRAST 12499 31.70 20.71 33.86 27 T_TM2_M_HEADER_IN_MSG 11149 19.81 18.47 20.07 28 HTML_IMAGE_RATIO_02 9861 10.89 16.34 9.81 29 BOTNET_IPINHOSTNAME 9833 8.59 16.29 7.08 30 XM_Multi_Part_URI 9257 15.69 15.34 15.76 31 LOTS_OF_MONEY 8912 9.30 14.77 8.22 32 XM_Body_Dirty_Words 8794 15.23 14.57 15.36 33 DKIM_INVALID 8616 6.65 14.28 5.15 34 XM_CamelCaseFrm001 6678 4.27 11.06 2.94 35 RCVD_IN_MSPIKE_BL 6653 2.47 11.02 0.78 36 XMSexyCombo_05 6559 6.39 10.87 5.51 37 RELAYCOUNTRY_CA 6216 3.54 10.30 2.21 38 NO_DNS_FOR_FROM 6181 4.15 10.24 2.95 39 URIBL_SBL_A 6080 2.01 10.07 0.42 40 TR_XM_MaxBayes 5828 1.68 9.66 0.11 41 XM_B_Unsub 5638 9.62 9.34 9.68 42 XM_UB50 4999 2.48 8.28 1.33 43 RCVD_IN_RP_RNBL 4988 1.50 8.26 0.16 44 XMSubMetaSx_00 4863 6.19 8.06 5.82 45 KHOP_HELO_FCRDNS 4833 2.18 8.01 1.03 46 RELAYCOUNTRY_FR 4719 1.52 7.82 0.28 47 RCVD_IN_MSPIKE_L3 4673 1.84 7.74 0.67 48 XM_B_Phish_Phrases 4576 7.83 7.58 7.88 49 XMBody_17 4391 2.22 7.28 1.22 50 T_REMOTE_IMAGE 4360 3.78 7.22 3.11 51 XM_Evil_Numbers_Gen 4345 9.74 7.20 10.24 52 RCVD_IN_BL_SPAMCOP_NET 4324 2.23 7.16 1.26 53 FROM_SUSPICIOUS_NTLD 4036 1.22 6.69 0.14 54 XM_UB99 4007 1.10 6.64 0.01 55 LotsOfNums_01 4005 8.55 6.64 8.93 56 FROM_SUSPICIOUS_NTLD_FP 3955 1.19 6.55 0.13 57 XMNumbers 3801 3.95 6.30 3.49 58 LongTLD 3786 1.21 6.27 0.21 59 BAYES_80 3746 4.97 6.21 4.72 60 MIME_HTML_MOSTLY 3622 3.99 6.00 3.59 61 TR_LOTS_OF_MONEY3 3615 1.63 5.99 0.77 62 XM_UB999 3536 0.97 5.86 0.01 63 PDS_OTHER_BAD_TLD 3391 1.64 5.62 0.86 64 T_XMDrugObfuBody_08 3325 2.22 5.51 1.58 65 BAYES_60 3315 6.59 5.49 6.80 66 RDNS_DYNAMIC 3297 1.30 5.46 0.47 67 BAYES_95 3240 3.31 5.37 2.90 68 BODY_URI_ONLY 3197 0.92 5.30 0.06 69 TR_XM_INV_DKIM 3164 0.99 5.24 0.15 70 SpammyFromTLD_01 3139 1.37 5.20 0.61 71 HTML_IMAGE_RATIO_04 3093 7.68 5.12 8.18 72 MPART_ALT_DIFF 3058 6.48 5.07 6.76 73 HTML_MIME_NO_HTML_TAG 2846 1.88 4.72 1.32 74 TR_XM_MaxSPIKE 2840 0.79 4.71 0.01 75 TooManyTo_001 2753 6.37 4.56 6.72 76 DATE_IN_PAST_03_06 2753 0.82 4.56 0.09 77 XM_H_Long_From01 2723 5.57 4.51 5.78 78 TR_XM_COVIDMETA4 2673 1.27 4.43 0.65 79 TR_XM_PhishingBody 2619 3.35 4.34 3.15 80 BOTNET_NORDNS 2606 0.72 4.32 0.01 81 XM_SPF_SoftFail 2591 1.53 4.29 0.99 82 XM_DIRTYINTL 2539 1.22 4.21 0.63 83 RCVD_IN_MSPIKE_WL 2498 22.87 4.14 26.56 84 XM_B_SpammyTLD 2419 2.68 4.01 2.41 85 T_TooManySym_01 2380 5.61 3.94 5.93 86 DATE_IN_PAST_06_12 2271 0.85 3.76 0.28 87 XMStrtUSub 2255 5.42 3.74 5.75 88 UNPARSEABLE_RELAY 2197 8.10 3.64 8.98 89 HTML_IMAGE_RATIO_08 2165 3.35 3.59 3.30 90 XM_B_COVIDMETA 2059 1.47 3.41 1.09 91 XMHTML_After_End 2000 1.66 3.31 1.34 92 XM_URI_RBL 1918 0.72 3.18 0.23 93 XM_JunkDunk 1908 0.52 3.16 0.00 94 FROM_EXCESS_BASE64 1875 3.73 3.11 3.85 95 NO_FM_NAME_IP_HOSTN 1864 0.51 3.09 0.00 96 TM2_M_URI_OPT_OUT 1787 4.26 2.96 4.52 97 TR_XM_PHPDW 1754 0.81 2.91 0.40 98 T_XMHurry_00 1722 1.11 2.85 0.77 99 XMSubNoVowel 1717 1.36 2.84 1.06 100 TR_XM_PHPForged 1716 0.79 2.84 0.38 101 SpammyFromTLD_02 1700 0.67 2.82 0.25 102 TR_XM_FormFill2 1699 0.78 2.81 0.38 103 XM_H_PHPOS 1693 0.77 2.80 0.37 104 XM_SendGrid 1666 7.02 2.76 7.86 105 DATE_IN_PAST_12_24 1642 0.51 2.72 0.07 106 T_HTML_TAG_BALANCE_CENTER 1641 0.66 2.72 0.25 107 RCVD_IN_PSBL 1609 0.56 2.67 0.15 108 XMBdyGiftCard01 1554 2.22 2.57 2.15 109 XM_UB60 1517 0.52 2.51 0.13 110 XM_OfRef6 1514 1.41 2.51 1.20 111 XM_UB95 1470 0.41 2.44 0.01 112 SUBJ_ALL_CAPS 1467 1.76 2.43 1.63 113 XM_B_Phish66 1389 1.36 2.30 1.17 114 XMBrknScrpt_02 1382 1.30 2.29 1.11 115 XMSubEmpty 1381 0.54 2.29 0.19 116 URI_HEX 1374 1.85 2.28 1.76 117 BAYES_40 1352 3.92 2.24 4.26 118 RCVD_IN_MSPIKE_L5 1328 0.41 2.20 0.06 119 XMSexyCombo_01 1324 1.70 2.19 1.60 120 RCVD_IN_MSPIKE_H4 1293 11.66 2.14 13.53 121 TR_Mismatch_TLD_01 1192 0.50 1.97 0.21 122 DKIM_ADSP_CUSTOM_MED 1184 1.22 1.96 1.07 123 RCVD_IN_MSPIKE_H3 1175 10.63 1.95 12.34 124 RELAYCOUNTRY_NG 1162 0.32 1.93 0.00 125 BAYES_20 1140 3.07 1.89 3.31 126 MIME_QP_LONG_LINE 1131 3.99 1.87 4.41 127 XM_UB80 1128 0.33 1.87 0.03 128 TM2_M_VERY_LONG_WORD 1122 1.68 1.86 1.65 129 NML_ADSP_CUSTOM_MED 1103 0.95 1.83 0.77 130 HTML_IMAGE_ONLY_16 1077 0.42 1.78 0.15 131 HTML_IMAGE_RATIO_06 1069 4.07 1.77 4.52 132 XMStockSpam_06 1065 1.74 1.76 1.74 133 DKIM_ADSP_NXDOMAIN 1063 0.59 1.76 0.36 134 TR_XM_RelayPhish 1030 0.41 1.71 0.15 135 RELAYCOUNTRY_UY 1019 0.28 1.69 0.01 136 ALL_TRUSTED 1012 10.77 1.68 12.56 137 HTML_SHORT_LINK_IMG_2 1010 0.31 1.67 0.04 138 URI_TRY_3LD 995 1.87 1.65 1.91 139 XMSubMetaSSx_00 964 0.55 1.60 0.35 140 FORGED_GMAIL_RCVD 934 0.63 1.55 0.45 141 XM_BadFromFormat 915 0.45 1.52 0.24 142 SCRIPT_GIBBERISH 907 0.25 1.50 0.00 143 T_XMDrugObfuBody_14 899 1.43 1.49 1.42 144 XM_H_PHPMailer 878 0.70 1.45 0.55 145 URIBL_DBL_SPAM 859 0.25 1.42 0.02 146 FROM_MISSP_REPLYTO 836 0.23 1.39 0.00 147 HK_RANDOM_REPLYTO 827 0.38 1.37 0.18 148 XMDiploma_00 811 1.52 1.34 1.55 149 HDRS_MISSP 807 0.34 1.34 0.14 150 RELAYCOUNTRY_AT 773 0.46 1.28 0.30 151 URIBL_BLACK 770 0.22 1.28 0.01 152 SUBJECT_NEEDS_ENCODING 768 0.25 1.27 0.05 153 TR_XM_COVIDMETA1 766 0.43 1.27 0.27 154 SUBJ_ILLEGAL_CHARS 766 0.25 1.27 0.05 155 RELAYCOUNTRY_GB 758 1.01 1.26 0.97 156 XM_H_PHPOS_M 753 0.36 1.25 0.18 157 XM_B_Unsub2 749 1.05 1.24 1.01 158 RELAYCOUNTRY_DE 749 0.46 1.24 0.31 159 MIME_HTML_ONLY_MULTI 748 3.65 1.24 4.12 160 HTML_SHORT_LINK_IMG_1 738 0.22 1.22 0.02 161 HTML_IMAGE_ONLY_08 723 0.30 1.20 0.12 162 TR_Mismatch_TLD_02 717 0.46 1.19 0.31 163 TR_Symld_Words 700 1.17 1.16 1.18 164 RELAYCOUNTRY_IN 696 0.28 1.15 0.11 165 XM_ProductURIs 693 1.81 1.15 1.95 166 BAYES_00 692 14.41 1.15 17.02 167 XMSexyCombo_04 650 0.92 1.08 0.89 168 T_XMDrugObfuBody_00 636 0.79 1.05 0.74 169 XMSubMetaSxObfu_01 630 0.19 1.04 0.02 170 RCVD_IN_RP_SAFE 625 10.36 1.04 12.20 171 HELO_NO_DOMAIN 622 0.57 1.03 0.48 172 T_FILL_THIS_FORM_SHORT 622 0.61 1.03 0.52 173 HELO_NODOT 622 0.57 1.03 0.48 174 MISSING_HEADERS 618 0.45 1.02 0.33 175 XMReplyNow 618 0.25 1.02 0.10 176 BAYES_05 618 2.21 1.02 2.45 177 MIME_HEADER_CTYPE_ONLY 613 0.34 1.02 0.21 178 XM_OfRef7 612 0.32 1.01 0.18 179 RELAYCOUNTRY_CN 610 0.25 1.01 0.10 180 HDRS_LCASE_IMGONLY 606 0.17 1.00 0.00 181 MAILING_LIST_MULTI 593 1.65 0.98 1.78 182 RELAYCOUNTRY_FI 580 0.18 0.96 0.02 183 TM2_M_A_HREF_HREF 569 0.74 0.94 0.70 184 T_Symld_Words_02 565 0.36 0.94 0.24 185 XM_XX_Yahoo 559 0.23 0.93 0.09 186 XM_HighProb1 553 0.16 0.92 0.02 187 XMGenDplmaNmb 551 0.99 0.91 1.01 188 HTML_FONT_SIZE_HUGE 548 0.35 0.91 0.24 189 MPART_ALT_DIFF_COUNT 543 0.47 0.90 0.39 190 REPLYTO_WITHOUT_TO_CC 543 0.20 0.90 0.06 191 SHORT_URI 542 0.16 0.90 0.02 192 TR_Sbj_FN_Bdy 540 0.35 0.89 0.25 193 SUBJ_DOLLARS 538 0.47 0.89 0.39 194 DEAR_FRIEND 538 0.20 0.89 0.07 195 XMSubMetaSxObfu_03 525 0.50 0.87 0.43 196 HK_RANDOM_FROM 522 0.24 0.86 0.11 197 XM_PDF 511 1.42 0.85 1.54 198 RCVD_IN_RP_CERTIFIED 497 9.55 0.82 11.27 199 INVESTMENT_ADVICE 494 0.21 0.82 0.09 200 XMPhish08 480 0.75 0.80 0.74 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 303145 98.74 97.88 98.91 2 HTML_MESSAGE 270248 88.99 93.12 88.18 3 RELAYCOUNTRY_US 253241 80.00 66.62 82.63 4 DKIM_SIGNED 245914 79.84 77.78 80.24 5 XM_DK_Pass 242373 78.47 75.36 79.08 6 DKIM_VALID 230144 73.19 63.50 75.09 7 XM_B_Unicode 228876 73.65 68.42 74.68 8 DKIM_VALID_AU 188785 59.38 48.09 61.60 9 XMListUnsubscribeExists 184249 61.27 67.12 60.12 10 BAYES_50 152272 46.74 31.77 49.69 11 XM_B_Unicode3 142357 44.32 33.49 46.45 12 HTML_FONT_LOW_CONTRAST 103786 31.70 20.71 33.86 13 LOC_TINY_FONT_1 100045 32.53 31.95 32.64 14 DKIM_VALID_EF 82436 28.02 33.69 26.90 15 RCVD_IN_MSPIKE_WL 81396 22.87 4.14 26.56 16 MIME_HTML_ONLY 71499 26.62 43.35 23.33 17 FVGT_m_MULTI_ODD 71195 23.12 22.55 23.23 18 XMSubLong 62601 21.18 24.99 20.43 19 RCVD_IN_MSPIKE_H2 62413 20.71 22.48 20.36 20 T_TM2_M_HEADER_IN_MSG 61510 19.81 18.47 20.07 21 T_KAM_HTML_FONT_INVALID 55857 19.42 25.49 18.23 22 BAYES_00 52163 14.41 1.15 17.02 23 XM_Multi_Part_URI 48297 15.69 15.34 15.76 24 XM_Body_Dirty_Words 47077 15.23 14.57 15.36 25 RCVD_IN_MSPIKE_H4 41478 11.66 2.14 13.53 26 XM_DK_Undo_02 39676 20.39 58.21 12.95 27 ALL_TRUSTED 38500 10.77 1.68 12.56 28 RCVD_IN_MSPIKE_H3 37821 10.63 1.95 12.34 29 RCVD_IN_RP_SAFE 37391 10.36 1.04 12.20 30 TR_XM_DK_Bayes 34956 9.60 0.41 11.41 31 RCVD_IN_RP_CERTIFIED 34549 9.55 0.82 11.27 32 TR_XM_DK_Bayes1 32587 8.91 0.16 10.63 33 XM_DKIMWhitelistDomains 32088 8.75 0.01 10.47 34 XM_Evil_Numbers_Gen 31388 9.74 7.20 10.24 35 TR_XM_DK_Bayes2 30638 8.37 0.13 10.00 36 HTML_IMAGE_RATIO_02 30079 10.89 16.34 9.81 37 XM_B_Unsub 29663 9.62 9.34 9.68 38 UNPARSEABLE_RELAY 27528 8.10 3.64 8.98 39 LotsOfNums_01 27364 8.55 6.64 8.93 40 BAYES_99 27131 14.78 44.86 8.85 41 LOTS_OF_MONEY 25200 9.30 14.77 8.22 42 HTML_IMAGE_RATIO_04 25072 7.68 5.12 8.18 43 XM_B_Phish_Phrases 24164 7.83 7.58 7.88 44 XM_SendGrid 24096 7.02 2.76 7.86 45 BOTNET_IPINHOSTNAME 21684 8.59 16.29 7.08 46 BAYES_999 21512 12.00 37.30 7.02 47 BAYES_60 20844 6.59 5.49 6.80 48 MPART_ALT_DIFF 20707 6.48 5.07 6.76 49 TooManyTo_001 20597 6.37 4.56 6.72 50 T_TooManySym_01 18188 5.61 3.94 5.93 51 RELAYCOUNTRY_META 18054 10.67 34.91 5.89 52 XMSubMetaSx_00 17836 6.19 8.06 5.82 53 XM_H_Long_From01 17702 5.57 4.51 5.78 54 XMStrtUSub 17631 5.42 3.74 5.75 55 XMSexyCombo_05 16880 6.39 10.87 5.51 56 DKIM_INVALID 15770 6.65 14.28 5.15 57 BAYES_80 14478 4.97 6.21 4.72 58 TR_XM_DK_SendGrid 14008 3.95 0.78 4.57 59 HTML_IMAGE_RATIO_06 13844 4.07 1.77 4.52 60 TM2_M_URI_OPT_OUT 13840 4.26 2.96 4.52 61 MIME_QP_LONG_LINE 13511 3.99 1.87 4.41 62 XM_UncommonTLD01 13456 8.08 26.79 4.39 63 IN_ZIMBRA_NJ_WHITELIST 13128 3.58 0.02 4.28 64 BAYES_40 13041 3.92 2.24 4.26 65 MIME_HTML_ONLY_MULTI 12623 3.65 1.24 4.12 66 FROM_EXCESS_BASE64 11790 3.73 3.11 3.85 67 MIME_HTML_MOSTLY 11007 3.99 6.00 3.59 68 BOUNCE_MESSAGE 10859 3.04 0.46 3.54 69 ANY_BOUNCE_MESSAGE 10859 3.04 0.46 3.54 70 XMNumbers 10704 3.95 6.30 3.49 71 T_TooManySym_02 10304 2.94 0.78 3.36 72 RCVD_IN_IADB_LISTED 10288 2.91 0.66 3.36 73 BOTNET 10154 7.14 26.56 3.31 74 BAYES_20 10134 3.07 1.89 3.31 75 HTML_IMAGE_RATIO_08 10121 3.35 3.59 3.30 76 XM_H_Trusted_IP 10037 2.74 0.00 3.28 77 TR_XM_PhishingBody 9658 3.35 4.34 3.15 78 TVD_RCVD_IP 9636 2.68 0.34 3.14 79 T_REMOTE_IMAGE 9520 3.78 7.22 3.11 80 HTML_FONT_FACE_BAD 9278 2.62 0.57 3.03 81 NO_DNS_FOR_FROM 9032 4.15 10.24 2.95 82 XM_CamelCaseFrm001 9000 4.27 11.06 2.94 83 HELO_MISC_IP 8952 2.46 0.14 2.92 84 RCVD_IN_IADB_SPF 8947 2.53 0.55 2.92 85 CK_HELO_DYNAMIC_SPLIT_IP 8946 2.47 0.17 2.92 86 BAYES_95 8903 3.31 5.37 2.90 87 RCVD_IN_IADB_SENDERID 8081 2.29 0.52 2.64 88 RCVD_IN_IADB_DK 7870 2.23 0.53 2.57 89 INVALID_MSGID 7763 2.15 0.23 2.53 90 BAYES_05 7503 2.21 1.02 2.45 91 XM_B_SpammyTLD 7394 2.68 4.01 2.41 92 UNTRUSTED_Relay 6922 5.75 23.47 2.26 93 TO_MALFORMED 6799 1.89 0.21 2.22 94 RELAYCOUNTRY_CA 6786 3.54 10.30 2.21 95 XMBdyGiftCard01 6575 2.22 2.57 2.15 96 RCVD_IN_IADB_VOUCHED 6105 1.71 0.27 1.99 97 XM_ProductURIs 5964 1.81 1.15 1.95 98 URI_TRY_3LD 5848 1.87 1.65 1.91 99 MAILING_LIST_MULTI 5468 1.65 0.98 1.78 100 URI_HEX 5401 1.85 2.28 1.76 101 XMStockSpam_06 5320 1.74 1.76 1.74 102 TM2_M_VERY_LONG_WORD 5056 1.68 1.86 1.65 103 SUBJ_ALL_CAPS 5002 1.76 2.43 1.63 104 XMSexyCombo_01 4911 1.70 2.19 1.60 105 IN_HORDE_ADDRESS_BOOK 4844 1.33 0.08 1.58 106 T_XMDrugObfuBody_08 4831 2.22 5.51 1.58 107 XMDiploma_00 4752 1.52 1.34 1.55 108 XM_PDF 4712 1.42 0.85 1.54 109 T_XMDrugObfuBody_14 4338 1.43 1.49 1.42 110 XM_DK_Undo_01 4268 1.29 0.74 1.39 111 TR_MSPIKEBAYES00 4154 1.13 0.00 1.36 112 XMHTML_After_End 4104 1.66 3.31 1.34 113 XM_UB50 4084 2.48 8.28 1.33 114 HTML_MIME_NO_HTML_TAG 4060 1.88 4.72 1.32 115 USER_IN_DEF_DKIM_WL 4026 1.10 0.01 1.31 116 TooManyTo_002 3925 1.16 0.53 1.28 117 RCVD_IN_BL_SPAMCOP_NET 3862 2.23 7.16 1.26 118 RCVD_IN_IADB_OPTIN 3798 1.07 0.23 1.24 119 XM_GoogleGroups 3761 1.11 0.50 1.23 120 XMBody_17 3752 2.22 7.28 1.22 121 XM_OfRef6 3668 1.41 2.51 1.20 122 TR_Symld_Words 3608 1.17 1.16 1.18 123 XM_B_Phish66 3585 1.36 2.30 1.17 124 XMBrknScrpt_02 3395 1.30 2.29 1.11 125 XMGappySubj_01 3373 0.95 0.16 1.10 126 XM_B_COVIDMETA 3337 1.47 3.41 1.09 127 DKIM_ADSP_CUSTOM_MED 3278 1.22 1.96 1.07 128 XMSubNoVowel 3255 1.36 2.84 1.06 129 KHOP_HELO_FCRDNS 3161 2.18 8.01 1.03 130 XMGenDplmaNmb 3093 0.99 0.91 1.01 131 XM_B_Unsub2 3087 1.05 1.24 1.01 132 XM_SPF_SoftFail 3028 1.53 4.29 0.99 133 RELAYCOUNTRY_GB 2962 1.01 1.26 0.97 134 XMSubMetaSxObfu_02 2890 0.87 0.52 0.94 135 XMSexyCombo_04 2713 0.92 1.08 0.89 136 T_TooManySym_03 2639 0.77 0.29 0.86 137 PDS_OTHER_BAD_TLD 2622 1.64 5.62 0.86 138 TooManyTo_003 2599 0.78 0.41 0.85 139 XM_H_Long_From02 2567 0.78 0.52 0.84 140 XMSubMetaI_00 2545 0.80 0.65 0.83 141 RCVD_IN_MSPIKE_BL 2400 2.47 11.02 0.78 142 TR_LOTS_OF_MONEY3 2373 1.63 5.99 0.77 143 NML_ADSP_CUSTOM_MED 2372 0.95 1.83 0.77 144 T_XMHurry_00 2361 1.11 2.85 0.77 145 XM_B_REG_HTML 2282 0.66 0.20 0.74 146 T_XMDrugObfuBody_00 2278 0.79 1.05 0.74 147 XMPhish08 2276 0.75 0.80 0.74 148 XM_B_COPY_HTML 2203 0.68 0.47 0.72 149 XMPhish14 2154 0.72 0.78 0.70 150 TM2_M_A_HREF_HREF 2132 0.74 0.94 0.70 151 TooManyTo_004 2103 0.63 0.37 0.69 152 RCVD_IN_MSPIKE_H5 2097 0.58 0.05 0.68 153 RCVD_IN_MSPIKE_L3 2065 1.84 7.74 0.67 154 TR_MetaPhish_Combo_01 2048 0.69 0.78 0.67 155 XMBody_78 2012 0.64 0.53 0.66 156 TR_XM_COVIDMETA4 1991 1.27 4.43 0.65 157 XM_DIRTYINTL 1933 1.22 4.21 0.63 158 T_MANY_PILL_PRICE 1928 0.53 0.00 0.63 159 SpammyFromTLD_01 1874 1.37 5.20 0.61 160 XMPhish30 1872 0.62 0.65 0.61 161 TooManyTo_005 1818 0.54 0.29 0.59 162 XMBody_95 1793 0.50 0.04 0.59 163 USER_IN_WHITELIST 1785 0.49 0.00 0.58 164 DIET_1 1707 0.58 0.67 0.56 165 XM_H_PHPMailer 1687 0.70 1.45 0.55 166 TVD_PH_BODY_ACCOUNTS_PRE 1633 0.51 0.40 0.53 167 HTML_IMAGE_ONLY_20 1615 0.51 0.40 0.53 168 T_FILL_THIS_FORM_SHORT 1603 0.61 1.03 0.52 169 HTML_TAG_BALANCE_BODY 1512 0.51 0.57 0.49 170 THIS_AD 1496 0.48 0.45 0.49 171 XMNoVowels 1487 0.47 0.41 0.49 172 T_MONEY_PERCENT 1485 0.48 0.44 0.48 173 TR_LOTS_OF_MONEY2 1485 0.48 0.44 0.48 174 HELO_NODOT 1479 0.57 1.03 0.48 175 HELO_NO_DOMAIN 1471 0.57 1.03 0.48 176 RDNS_DYNAMIC 1454 1.30 5.46 0.47 177 XMHTMLBadTable_001 1418 0.42 0.18 0.46 178 FORGED_GMAIL_RCVD 1365 0.63 1.55 0.45 179 XM_RXBody 1349 0.47 0.61 0.44 180 FILL_THIS_FORM 1342 0.47 0.62 0.44 181 URI_NOVOWEL 1323 0.46 0.59 0.43 182 XMSubMetaSxObfu_03 1320 0.50 0.87 0.43 183 URIBL_SBL_A 1292 2.01 10.07 0.42 184 PLING_QUERY 1239 0.39 0.29 0.40 185 HTTPS_HTTP_MISMATCH 1238 0.40 0.35 0.40 186 TR_XM_PHPDW 1234 0.81 2.91 0.40 187 XMBSHREFv2 1230 0.35 0.08 0.40 188 XMLngstWrd_00 1223 0.38 0.29 0.40 189 MPART_ALT_DIFF_COUNT 1195 0.47 0.90 0.39 190 XMCapTrack 1193 0.40 0.48 0.39 191 SUBJ_DOLLARS 1191 0.47 0.89 0.39 192 HTML_OBFUSCATE_05_10 1165 0.34 0.11 0.38 193 TR_XM_PHPForged 1164 0.79 2.84 0.38 194 TR_XM_FormFill2 1158 0.78 2.81 0.38 195 XM_H_PHPOS 1147 0.77 2.80 0.37 196 T_TooManySym_04 1122 0.33 0.14 0.37 197 DKIM_ADSP_NXDOMAIN 1092 0.59 1.76 0.36 198 XMLngstWrd_01 1089 0.34 0.27 0.36 199 XMSubMetaSSx_00 1068 0.55 1.60 0.35 200 TVD_SPACE_RATIO 1037 0.36 0.47 0.34 ----------------------------------------------------------------------