Email: 383378 Autolearn: 0 AvgScore: 0.36 AvgScanTime: 1.65 sec Spam: 60028 Autolearn: 0 AvgScore: 13.09 AvgScanTime: 3.08 sec Ham: 323350 Autolearn: 0 AvgScore: -2.01 AvgScanTime: 1.39 sec Time Spent Running SA: 175.81 hours Time Spent Processing Spam: 51.30 hours Time Spent Processing Ham: 124.50 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 58541 98.78 97.52 99.02 2 HTML_MESSAGE 48521 79.74 80.83 79.54 3 DKIM_SIGNED 44163 73.40 73.57 73.37 4 XM_DK_Pass 42807 72.13 71.31 72.28 5 XM_B_Unicode 41446 67.80 69.04 67.57 6 RELAYCOUNTRY_US 37281 72.80 62.11 74.79 7 DKIM_VALID 37073 68.07 61.76 69.24 8 XMListUnsubscribeExists 35392 54.83 58.96 54.07 9 XM_DK_Undo_02 29581 19.39 49.28 13.85 10 DKIM_VALID_AU 27210 54.60 45.33 56.32 11 BAYES_99 23318 14.39 38.85 9.85 12 XM_B_Unicode3 22898 41.01 38.15 41.54 13 BAYES_50 20722 43.65 34.52 45.34 14 RELAYCOUNTRY_META 19767 10.27 32.93 6.07 15 FVGT_m_MULTI_ODD 18602 22.07 30.99 20.42 16 BAYES_999 18048 11.51 30.07 8.06 17 BOTNET 16883 7.33 28.13 3.47 18 LOC_TINY_FONT_1 16678 29.29 27.78 29.57 19 DKIM_VALID_EF 16557 26.42 27.58 26.21 20 UNTRUSTED_Relay 16260 6.88 27.09 3.13 21 MIME_HTML_ONLY 16056 23.02 26.75 22.33 22 RCVD_IN_MSPIKE_H2 15797 23.93 26.32 23.49 23 HTML_FONT_LOW_CONTRAST 15463 29.58 25.76 30.29 24 XM_Body_Dirty_Words 13702 15.17 22.83 13.75 25 T_TM2_M_HEADER_IN_MSG 12415 21.10 20.68 21.18 26 XMSubLong 12247 22.32 20.40 22.68 27 XM_Multi_Part_URI 11832 18.26 19.71 17.99 28 T_KAM_HTML_FONT_INVALID 11603 16.38 19.33 15.83 29 BOTNET_IPINHOSTNAME 11363 8.61 18.93 6.69 30 XM_UncommonTLD01 10028 5.47 16.71 3.39 31 RCVD_IN_MSPIKE_BL 9918 3.33 16.52 0.88 32 XMSexyCombo_05 9336 7.05 15.55 5.48 33 RCVD_IN_BL_SPAMCOP_NET 8423 3.24 14.03 1.24 34 XM_B_Unsub 7959 10.12 13.26 9.54 35 RCVD_IN_RP_RNBL 7405 2.09 12.34 0.19 36 LOTS_OF_MONEY 7192 8.23 11.98 7.54 37 DKIM_INVALID 7090 5.33 11.81 4.13 38 XM_UB50 6475 2.80 10.79 1.32 39 LotsOfNums_01 5893 8.09 9.82 7.76 40 HTML_IMAGE_RATIO_02 5838 9.00 9.73 8.87 41 RELAYCOUNTRY_CA 5557 3.40 9.26 2.32 42 NO_DNS_FOR_FROM 5345 3.49 8.90 2.49 43 XM_B_Phish_Phrases 5275 7.18 8.79 6.88 44 BAYES_80 5231 5.31 8.71 4.68 45 RCVD_IN_MSPIKE_L5 4962 1.57 8.27 0.33 46 TR_XM_PhishingBody 4714 3.86 7.85 3.12 47 XMSubMetaSx_00 4699 4.86 7.83 4.31 48 XM_Evil_Numbers_Gen 4629 9.09 7.71 9.34 49 BAYES_60 4526 6.70 7.54 6.55 50 RCVD_IN_MSPIKE_WL 4199 23.53 7.00 26.60 51 UNPARSEABLE_RELAY 4163 7.29 6.94 7.35 52 RCVD_IN_PSBL 4066 1.14 6.77 0.10 53 XM_SPF_SoftFail 3830 2.04 6.38 1.24 54 XM_H_Long_From01 3616 5.04 6.02 4.86 55 SpammyFromTLD_01 3612 1.33 6.02 0.46 56 XM_SendGrid 3528 6.29 5.88 6.37 57 RCVD_IN_MSPIKE_L3 3368 1.31 5.61 0.51 58 TooManyTo_001 3286 6.37 5.47 6.53 59 XM_DIRTYINTL 3229 1.34 5.38 0.59 60 BOTNET_NORDNS 3204 0.85 5.34 0.02 61 XM_B_Phish66 3152 1.97 5.25 1.36 62 PDS_FROM_2_EMAILS 3125 0.86 5.21 0.05 63 FROM_2_EMAILS_SHORT 3099 0.82 5.16 0.02 64 TM2_M_VERY_LONG_WORD 3038 1.74 5.06 1.13 65 BAYES_95 2987 3.22 4.98 2.89 66 NO_FM_NAME_IP_HOSTN 2922 0.77 4.87 0.01 67 XMSubEmpty 2896 0.90 4.82 0.18 68 TR_Mismatch_TLD_02 2891 0.82 4.82 0.08 69 PDS_OTHER_BAD_TLD 2778 0.92 4.63 0.23 70 XM_UB99 2769 0.73 4.61 0.01 71 XMStrtUSub 2731 5.54 4.55 5.72 72 LONG_JUNK_URI 2722 0.76 4.53 0.06 73 URIBL_SBL_A 2708 0.93 4.51 0.27 74 XMNumbers 2658 4.33 4.43 4.31 75 SpammyFromTLD_02 2657 0.87 4.43 0.21 76 PDS_TO_EQ_FROM_NAME 2651 0.71 4.42 0.02 77 RCVD_IN_MSPIKE_H3 2618 14.26 4.36 16.10 78 MPART_ALT_DIFF 2562 5.45 4.27 5.67 79 XM_UB60 2487 0.77 4.14 0.15 80 XM_B_SpammyTLD 2439 1.93 4.06 1.54 81 FROM_EXCESS_BASE64 2418 3.67 4.03 3.60 82 TR_XM_UnparsRelay 2389 1.01 3.98 0.46 83 XMSubNoVowel 2374 1.39 3.95 0.91 84 XMBody_17 2313 1.59 3.85 1.18 85 HTML_IMAGE_RATIO_04 2301 5.66 3.83 6.00 86 XM_B_Unsub2 2249 1.57 3.75 1.17 87 T_XMDrugObfuBody_08 2249 1.89 3.75 1.54 88 XM_UB80 2225 0.63 3.71 0.06 89 TR_XM_INV_DKIM 2159 0.78 3.60 0.25 90 HTML_MIME_NO_HTML_TAG 2135 1.98 3.56 1.69 91 TR_XM_MaxBayes 2130 0.61 3.55 0.06 92 FROM_SUSPICIOUS_NTLD 2100 0.57 3.50 0.03 93 XM_OfRef6 2091 2.04 3.48 1.78 94 MIME_HTML_MOSTLY 2082 3.40 3.47 3.39 95 BODY_URI_ONLY 2045 0.57 3.41 0.04 96 DATE_IN_PAST_03_06 2024 0.63 3.37 0.12 97 FROM_SUSPICIOUS_NTLD_FP 1999 0.55 3.33 0.03 98 HTML_IMAGE_RATIO_08 1997 3.14 3.33 3.10 99 TR_XM_MaxSPIKE 1975 0.60 3.29 0.10 100 TR_XM_SpoofStaff 1866 0.57 3.11 0.09 101 XMSpoofStaff2 1851 0.56 3.08 0.09 102 XMSexyCombo_01 1810 0.95 3.02 0.56 103 MIMEOLE_DIRECT_TO_MX 1766 0.46 2.94 0.00 104 KHOP_HELO_FCRDNS 1760 1.45 2.93 1.18 105 ONLINE_PHARMACY 1705 0.46 2.84 0.01 106 TVD_VISIT_PHARMA 1689 0.45 2.81 0.01 107 TR_XM_MaxWHORU 1685 0.50 2.81 0.07 108 XM_DK_Undo_01 1637 1.56 2.73 1.35 109 TR_XM_PHPDW 1630 0.68 2.72 0.31 110 HK_SCAM 1621 0.44 2.70 0.02 111 TR_XM_PHPForged 1600 0.66 2.67 0.29 112 XMBrknScrpt_02 1600 1.44 2.67 1.22 113 TR_XM_FormFill2 1591 0.66 2.65 0.28 114 XM_H_PHPOS 1585 0.65 2.64 0.28 115 XM_B_COVIDMETA 1578 1.50 2.63 1.29 116 XM_H_SpoofStaff4 1567 0.49 2.61 0.10 117 TR_XM_PSC1 1566 0.49 2.61 0.09 118 HDR_ORDER_FTSDMCXX_DIRECT 1560 0.41 2.60 0.00 119 TR_Sbj_FN_Bdy 1547 0.56 2.58 0.18 120 RCVD_IN_MSPIKE_H4 1519 8.34 2.53 9.42 121 XM_UB999 1514 0.40 2.52 0.01 122 TR_XM_COVIDMETA4 1495 0.77 2.49 0.45 123 RELAYCOUNTRY_CN 1431 0.41 2.38 0.04 124 T_XMHurry_00 1413 1.03 2.35 0.79 125 SUBJ_ALL_CAPS 1384 1.28 2.31 1.09 126 RELAYCOUNTRY_RU 1382 1.15 2.30 0.93 127 HTML_FONT_TINY_NORDNS 1377 0.66 2.29 0.36 128 HELO_NODOT 1358 0.77 2.26 0.50 129 CTYPE_NULL 1347 0.35 2.24 0.00 130 XM_UB95 1341 0.36 2.23 0.01 131 HELO_NO_DOMAIN 1335 0.77 2.22 0.50 132 URI_ONLY_MSGID_MALF 1330 0.35 2.22 0.01 133 DOS_OE_TO_MX 1300 0.34 2.17 0.00 134 MISSING_SUBJECT 1296 0.39 2.16 0.06 135 XMNoSubject 1296 0.39 2.16 0.06 136 XM_URI_RBL 1293 0.51 2.15 0.20 137 XMDiploma_00 1291 1.63 2.15 1.53 138 TR_XM_SpoofStaff2 1283 0.33 2.14 0.00 139 TR_XM_COVIDMETA1 1273 0.55 2.12 0.26 140 LOADSA_MONEY_COMBO 1258 0.39 2.10 0.07 141 XM_CamelCaseFrm001 1254 2.02 2.09 2.00 142 HTML_IMAGE_RATIO_06 1254 3.42 2.09 3.67 143 MISSING_HEADERS 1240 0.52 2.07 0.24 144 XM_ShortIntro_01 1218 0.61 2.03 0.35 145 RELAYCOUNTRY_FR 1211 0.51 2.02 0.24 146 XMGppyBdWords 1210 0.45 2.02 0.16 147 TM2_M_URI_OPT_OUT 1186 11.03 1.98 12.71 148 TR_XM_RelayPhish 1176 0.41 1.96 0.13 149 XMLngstWrd_00 1164 0.68 1.94 0.45 150 TM2_M_A_HREF_HREF 1132 0.59 1.89 0.35 151 URI_HEX 1128 1.57 1.88 1.52 152 XFER_LOTSA_MONEY 1128 0.31 1.88 0.02 153 BAYES_40 1126 3.64 1.88 3.97 154 RDNS_DYNAMIC 1125 0.72 1.87 0.50 155 MIME_CHARSET_FARAWAY 1107 0.39 1.84 0.12 156 RCVD_IN_MSPIKE_ZBI 1078 0.29 1.80 0.01 157 URI_TRY_3LD 1071 1.47 1.78 1.41 158 ADVANCE_FEE_5_NEW_MONEY 1067 0.28 1.78 0.00 159 MILLION_HUNDRED 1048 0.28 1.75 0.01 160 TR_LOTS_OF_MONEY3 1030 0.75 1.72 0.57 161 T_REMOTE_IMAGE 1029 2.37 1.71 2.49 162 HTML_IMAGE_ONLY_16 1028 0.39 1.71 0.15 163 T_TooManySym_01 1026 4.76 1.71 5.32 164 XMSexyCombo_04 1010 0.40 1.68 0.16 165 BAYES_20 1010 4.20 1.68 4.66 166 URI_GOOGLE_PROXY 997 0.29 1.66 0.04 167 DKIM_ADSP_CUSTOM_MED 968 1.09 1.61 1.00 168 IMG_ONLY_FM_DOM_INFO 966 0.25 1.61 0.00 169 CHARSET_FARAWAY_HEADER 963 0.29 1.60 0.05 170 XMBdyGiftCard01 962 1.83 1.60 1.88 171 RELAYCOUNTRY_KR 947 0.26 1.58 0.02 172 RELAYCOUNTRY_GB 930 0.74 1.55 0.59 173 TR_Mismatch_TLD_01 921 0.43 1.53 0.22 174 MPART_ALT_DIFF_COUNT 918 0.53 1.53 0.35 175 T_XMDrugObfuBody_14 912 1.35 1.52 1.32 176 TO_EQ_FM_DIRECT_MX 901 0.24 1.50 0.01 177 CK_HELO_DYNAMIC_SPLIT_IP 888 2.21 1.48 2.34 178 ALL_TRUSTED 887 17.09 1.48 19.99 179 DOS_OUTLOOK_TO_MX 885 0.24 1.47 0.02 180 RELAYCOUNTRY_NG_I 883 0.24 1.47 0.01 181 NML_ADSP_CUSTOM_MED 879 0.81 1.46 0.69 182 MIME_QP_LONG_LINE 869 3.17 1.45 3.48 183 RELAYCOUNTRY_DE 866 0.59 1.44 0.43 184 XM_H_PHPMailer 865 0.68 1.44 0.53 185 MIME_HTML_ONLY_MULTI 862 3.07 1.44 3.38 186 XMStockSpam_06 856 1.46 1.43 1.47 187 TR_Symld_Words 844 1.66 1.41 1.71 188 RELAYCOUNTRY_JP 835 0.24 1.39 0.03 189 XMSubject_38 835 0.27 1.39 0.06 190 XMLngstWrd_01 826 0.55 1.38 0.40 191 INVESTMENT_ADVICE 805 0.33 1.34 0.15 192 TVD_SPACE_RATIO 784 0.45 1.31 0.29 193 XMGenDplmaNmb 778 0.88 1.30 0.80 194 LongTLD 774 0.34 1.29 0.16 195 TVD_SPACE_RATIO_MINFP 767 0.21 1.28 0.01 196 T_FILL_THIS_FORM_SHORT 756 0.58 1.26 0.45 197 XMPhish30 730 0.74 1.22 0.65 198 DATE_IN_FUTURE_03_06 727 0.19 1.21 0.00 199 DATE_IN_FUTURE_06_12 706 0.19 1.18 0.01 200 BASE64_LENGTH_79_INF 693 0.45 1.15 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 320167 98.78 97.52 99.02 2 HTML_MESSAGE 257196 79.74 80.83 79.54 3 RELAYCOUNTRY_US 241820 72.80 62.11 74.79 4 DKIM_SIGNED 237241 73.40 73.57 73.37 5 XM_DK_Pass 233710 72.13 71.31 72.28 6 DKIM_VALID 223882 68.07 61.76 69.24 7 XM_B_Unicode 218480 67.80 69.04 67.57 8 DKIM_VALID_AU 182104 54.60 45.33 56.32 9 XMListUnsubscribeExists 174831 54.83 58.96 54.07 10 BAYES_50 146613 43.65 34.52 45.34 11 XM_B_Unicode3 134310 41.01 38.15 41.54 12 HTML_FONT_LOW_CONTRAST 97935 29.58 25.76 30.29 13 LOC_TINY_FONT_1 95613 29.29 27.78 29.57 14 RCVD_IN_MSPIKE_WL 86007 23.53 7.00 26.60 15 DKIM_VALID_EF 84740 26.42 27.58 26.21 16 RCVD_IN_MSPIKE_H2 75945 23.93 26.32 23.49 17 XMSubLong 73341 22.32 20.40 22.68 18 MIME_HTML_ONLY 72215 23.02 26.75 22.33 19 T_TM2_M_HEADER_IN_MSG 68482 21.10 20.68 21.18 20 FVGT_m_MULTI_ODD 66014 22.07 30.99 20.42 21 ALL_TRUSTED 64647 17.09 1.48 19.99 22 XM_Multi_Part_URI 58163 18.26 19.71 17.99 23 RCVD_IN_MSPIKE_H3 52066 14.26 4.36 16.10 24 T_KAM_HTML_FONT_INVALID 51191 16.38 19.33 15.83 25 BAYES_00 48785 12.83 0.65 15.09 26 XM_DK_Undo_02 44770 19.39 49.28 13.85 27 XM_Body_Dirty_Words 44452 15.17 22.83 13.75 28 TM2_M_URI_OPT_OUT 41085 11.03 1.98 12.71 29 ANY_BOUNCE_MESSAGE 36577 9.61 0.43 11.31 30 BOUNCE_MESSAGE 36575 9.61 0.43 11.31 31 RCVD_IN_RP_SAFE 34926 9.25 0.91 10.80 32 XM_DKIMWhitelistDomains 33525 8.75 0.01 10.37 33 RCVD_IN_RP_CERTIFIED 32594 8.62 0.76 10.08 34 BAYES_99 31840 14.39 38.85 9.85 35 XM_B_Unsub 30832 10.12 13.26 9.54 36 RCVD_IN_MSPIKE_H4 30463 8.34 2.53 9.42 37 XM_Evil_Numbers_Gen 30210 9.09 7.71 9.34 38 HTML_IMAGE_RATIO_02 28685 9.00 9.73 8.87 39 TR_XM_DK_Bayes 26485 6.95 0.27 8.19 40 BAYES_999 26068 11.51 30.07 8.06 41 LotsOfNums_01 25106 8.09 9.82 7.76 42 TR_XM_DK_Bayes1 25083 6.57 0.16 7.76 43 LOTS_OF_MONEY 24366 8.23 11.98 7.54 44 UNPARSEABLE_RELAY 23777 7.29 6.94 7.35 45 TR_XM_DK_Bayes2 23089 6.05 0.15 7.14 46 XM_B_Phish_Phrases 22236 7.18 8.79 6.88 47 BAYES_05 22196 5.93 0.90 6.86 48 BOTNET_IPINHOSTNAME 21644 8.61 18.93 6.69 49 BAYES_60 21177 6.70 7.54 6.55 50 TooManyTo_001 21125 6.37 5.47 6.53 51 XM_SendGrid 20590 6.29 5.88 6.37 52 RELAYCOUNTRY_META 19616 10.27 32.93 6.07 53 HTML_IMAGE_RATIO_04 19392 5.66 3.83 6.00 54 XMStrtUSub 18491 5.54 4.55 5.72 55 MPART_ALT_DIFF 18340 5.45 4.27 5.67 56 XMSexyCombo_05 17705 7.05 15.55 5.48 57 T_TooManySym_01 17208 4.76 1.71 5.32 58 XM_H_Long_From01 15707 5.04 6.02 4.86 59 BAYES_80 15139 5.31 8.71 4.68 60 BAYES_20 15079 4.20 1.68 4.66 61 XMSubMetaSx_00 13951 4.86 7.83 4.31 62 XMNumbers 13924 4.33 4.43 4.31 63 DKIM_INVALID 13359 5.33 11.81 4.13 64 IN_ZIMBRA_NJ_WHITELIST 13146 3.45 0.12 4.07 65 BAYES_40 12837 3.64 1.88 3.97 66 HTML_IMAGE_RATIO_06 11857 3.42 2.09 3.67 67 FROM_EXCESS_BASE64 11633 3.67 4.03 3.60 68 MIME_QP_LONG_LINE 11266 3.17 1.45 3.48 69 BOTNET 11226 7.33 28.13 3.47 70 TR_XM_DK_SendGrid 11153 3.08 1.09 3.45 71 XM_UncommonTLD01 10951 5.47 16.71 3.39 72 MIME_HTML_MOSTLY 10948 3.40 3.47 3.39 73 MIME_HTML_ONLY_MULTI 10916 3.07 1.44 3.38 74 T_TooManySym_02 10271 2.75 0.48 3.18 75 UNTRUSTED_Relay 10133 6.88 27.09 3.13 76 TR_XM_PhishingBody 10087 3.86 7.85 3.12 77 HTML_IMAGE_RATIO_08 10033 3.14 3.33 3.10 78 BAYES_95 9354 3.22 4.98 2.89 79 TVD_RCVD_IP 9141 2.51 0.82 2.83 80 RCVD_IN_IADB_LISTED 9117 2.49 0.68 2.82 81 XM_H_Trusted_IP 8430 2.20 0.00 2.61 82 T_REMOTE_IMAGE 8052 2.37 1.71 2.49 83 NO_DNS_FOR_FROM 8050 3.49 8.90 2.49 84 RCVD_IN_IADB_SPF 7857 2.15 0.62 2.43 85 HELO_MISC_IP 7577 2.12 0.94 2.34 86 CK_HELO_DYNAMIC_SPLIT_IP 7573 2.21 1.48 2.34 87 RELAYCOUNTRY_CA 7496 3.40 9.26 2.32 88 INVALID_MSGID 7350 1.96 0.29 2.27 89 RCVD_IN_IADB_SENDERID 7039 1.93 0.60 2.18 90 RCVD_IN_IADB_DK 6891 1.89 0.61 2.13 91 XM_CamelCaseFrm001 6476 2.02 2.09 2.00 92 TO_MALFORMED 6460 1.69 0.01 2.00 93 XMBdyGiftCard01 6069 1.83 1.60 1.88 94 MAILING_LIST_MULTI 6001 1.73 1.08 1.86 95 XM_OfRef6 5743 2.04 3.48 1.78 96 RCVD_IN_IADB_VOUCHED 5697 1.51 0.13 1.76 97 XM_ProductURIs 5608 1.57 0.72 1.73 98 TR_Symld_Words 5532 1.66 1.41 1.71 99 HTML_MIME_NO_HTML_TAG 5460 1.98 3.56 1.69 100 XM_PDF 5360 1.47 0.46 1.66 101 T_XMDrugObfuBody_08 4985 1.89 3.75 1.54 102 XM_B_SpammyTLD 4965 1.93 4.06 1.54 103 XMDiploma_00 4963 1.63 2.15 1.53 104 URI_HEX 4904 1.57 1.88 1.52 105 IN_HORDE_ADDRESS_BOOK 4847 1.39 0.82 1.50 106 XMGappySubj_01 4802 1.28 0.16 1.49 107 XMStockSpam_06 4756 1.46 1.43 1.47 108 HTML_FONT_FACE_BAD 4714 1.32 0.60 1.46 109 USER_IN_DEF_DKIM_WL 4603 1.20 0.00 1.42 110 T_TooManySym_03 4563 1.22 0.16 1.41 111 URI_TRY_3LD 4554 1.47 1.78 1.41 112 XM_B_Phish66 4388 1.97 5.25 1.36 113 XM_DK_Undo_01 4351 1.56 2.73 1.35 114 XM_UB50 4277 2.80 10.79 1.32 115 T_XMDrugObfuBody_14 4265 1.35 1.52 1.32 116 XM_B_COVIDMETA 4167 1.50 2.63 1.29 117 XM_GoogleGroups 4081 1.13 0.43 1.26 118 TooManyTo_002 4013 1.19 0.93 1.24 119 RCVD_IN_BL_SPAMCOP_NET 4009 3.24 14.03 1.24 120 XM_SPF_SoftFail 4003 2.04 6.38 1.24 121 XMBrknScrpt_02 3933 1.44 2.67 1.22 122 XM_RXBody 3907 1.14 0.77 1.21 123 KHOP_HELO_FCRDNS 3813 1.45 2.93 1.18 124 XMBody_17 3801 1.59 3.85 1.18 125 XM_B_Unsub2 3773 1.57 3.75 1.17 126 XM_H_Long_From02 3721 1.09 0.75 1.15 127 TM2_M_VERY_LONG_WORD 3646 1.74 5.06 1.13 128 TR_MSPIKEBAYES00 3627 0.95 0.00 1.12 129 RCVD_IN_IADB_OPTIN 3548 0.96 0.23 1.10 130 SUBJ_ALL_CAPS 3521 1.28 2.31 1.09 131 RCVD_IN_MSPIKE_H5 3478 0.92 0.10 1.08 132 XMBody_95 3311 0.87 0.06 1.02 133 DKIM_ADSP_CUSTOM_MED 3221 1.09 1.61 1.00 134 RELAYCOUNTRY_RU 3023 1.15 2.30 0.93 135 XMSubNoVowel 2949 1.39 3.95 0.91 136 RCVD_IN_MSPIKE_BL 2858 3.33 16.52 0.88 137 XMSolicitRefs_0 2738 0.75 0.25 0.85 138 XMGenDplmaNmb 2579 0.88 1.30 0.80 139 T_XMHurry_00 2551 1.03 2.35 0.79 140 T_TooManySym_04 2547 0.68 0.07 0.79 141 TR_MetaPhish_Combo_01 2546 0.79 0.83 0.79 142 TooManyTo_003 2487 0.73 0.49 0.77 143 DKIM_ADSP_NXDOMAIN 2486 0.75 0.67 0.77 144 T_XMDrugObfuBody_00 2468 0.78 0.87 0.76 145 XM_B_REG_HTML 2294 0.64 0.29 0.71 146 TR_BOTNET_NEGATE 2242 0.70 0.72 0.69 147 NML_ADSP_CUSTOM_MED 2223 0.81 1.46 0.69 148 PLING_QUERY 2218 0.68 0.63 0.69 149 XM_S_SubURI 2213 0.59 0.07 0.68 150 XMPhish08 2187 0.70 0.81 0.68 151 XMSubMetaI_00 2136 0.66 0.66 0.66 152 XMPhish30 2116 0.74 1.22 0.65 153 XMHTML_After_End 2072 0.72 1.13 0.64 154 XM_Superlative01 2056 0.54 0.04 0.64 155 XM_B_COPY_HTML 2048 0.60 0.42 0.63 156 TooManyTo_004 2036 0.60 0.45 0.63 157 T_TooManySym_05 1960 0.51 0.01 0.61 158 T_MANY_PILL_PRICE 1940 0.51 0.01 0.60 159 RELAYCOUNTRY_GB 1914 0.74 1.55 0.59 160 XM_DIRTYINTL 1910 1.34 5.38 0.59 161 TR_LOTS_OF_MONEY3 1832 0.75 1.72 0.57 162 XMSexyCombo_01 1821 0.95 3.02 0.56 163 SUBJ_DOLLARS 1786 0.53 0.43 0.55 164 USER_IN_WHITELIST 1780 0.46 0.00 0.55 165 TooManyTo_005 1776 0.53 0.39 0.55 166 XM_H_PHPMailer 1723 0.68 1.44 0.53 167 NUMERIC_HTTP_ADDR 1722 0.53 0.53 0.53 168 HTTPS_HTTP_MISMATCH 1705 0.53 0.52 0.53 169 RCVD_IN_MSPIKE_L3 1647 1.31 5.61 0.51 170 RDNS_DYNAMIC 1618 0.72 1.87 0.50 171 HELO_NODOT 1610 0.77 2.26 0.50 172 HELO_NO_DOMAIN 1604 0.77 2.22 0.50 173 XMBSHREFv2 1557 0.42 0.08 0.48 174 XMSubMetaSxObfu_02 1545 0.52 0.75 0.48 175 DIET_1 1527 0.57 1.12 0.47 176 XMSlimDrugH 1518 0.57 1.14 0.47 177 SpammyFromTLD_01 1501 1.33 6.02 0.46 178 TR_XM_UnparsRelay 1478 1.01 3.98 0.46 179 FORGED_GMAIL_RCVD 1454 0.56 1.14 0.45 180 T_Symld_Words_02 1453 0.53 1.00 0.45 181 T_FILL_THIS_FORM_SHORT 1453 0.58 1.26 0.45 182 XMLngstWrd_00 1450 0.68 1.94 0.45 183 TR_XM_COVIDMETA4 1449 0.77 2.49 0.45 184 HTML_IMAGE_ONLY_20 1422 0.39 0.15 0.44 185 XMPhish14 1409 0.47 0.65 0.44 186 RELAYCOUNTRY_DE 1386 0.59 1.44 0.43 187 XMSubMetaSxObfu_03 1375 0.46 0.62 0.43 188 HTML_TAG_BALANCE_BODY 1336 0.49 0.87 0.41 189 XMBody_78 1333 0.45 0.67 0.41 190 XMHTMLBadTable_001 1331 0.42 0.47 0.41 191 XMLngstWrd_01 1290 0.55 1.38 0.40 192 URI_NOVOWEL 1284 0.47 0.85 0.40 193 HTML_FONT_TINY_NORDNS 1148 0.66 2.29 0.36 194 TM2_M_A_HREF_HREF 1132 0.59 1.89 0.35 195 XMMoneyMeta_00 1129 0.38 0.56 0.35 196 XM_ShortIntro_01 1121 0.61 2.03 0.35 197 MPART_ALT_DIFF_COUNT 1118 0.53 1.53 0.35 198 XMNoVowels 1101 0.40 0.72 0.34 199 RCVD_IN_MSPIKE_L5 1076 1.57 8.27 0.33 200 XMCapTrack 1069 0.32 0.28 0.33 ----------------------------------------------------------------------