Email: 379342 Autolearn: 0 AvgScore: 4.23 AvgScanTime: 1.32 sec Spam: 122046 Autolearn: 0 AvgScore: 14.31 AvgScanTime: 1.48 sec Ham: 257296 Autolearn: 0 AvgScore: -0.54 AvgScanTime: 1.25 sec Time Spent Running SA: 139.41 hours Time Spent Processing Spam: 50.18 hours Time Spent Processing Ham: 89.24 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 109008 88.23 89.32 87.71 2 XM_B_Unicode 95238 76.08 78.03 75.16 3 DKIM_SIGNED 92883 80.96 76.10 83.27 4 XM_DK_Pass 90400 79.54 74.07 82.13 5 RELAYCOUNTRY_US 88963 80.48 72.89 84.08 6 DKIM_VALID 88731 77.87 72.70 80.33 7 DCC_CHECK 87865 55.33 71.99 47.43 8 XM_B_SpammyWords 83069 56.57 68.06 51.11 9 XMListUnsubscribeExists 82410 62.06 67.52 59.47 10 DKIM_VALID_AU 69437 62.42 56.89 65.03 11 XM_DK_Undo_02 53231 22.02 43.62 11.77 12 XM_B_Unicode3 46901 43.83 38.43 46.40 13 BAYES_99 46178 17.88 37.84 8.42 14 XM_B_SpammyWords2 45783 28.64 37.51 24.43 15 BAYES_50 43066 46.98 35.29 52.52 16 HTML_FONT_LOW_CONTRAST 40559 33.85 33.23 34.14 17 LOC_TINY_FONT_1 37070 32.09 30.37 32.91 18 BAYES_999 36298 14.36 29.74 7.06 19 MIME_HTML_ONLY 36120 25.02 29.60 22.85 20 TR_DCC_Bayes_99 35289 12.47 28.91 4.67 21 DCC_CHECK_NEGATIVE 32531 43.43 26.65 51.39 22 DKIM_VALID_EF 31699 28.91 25.97 30.30 23 RELAYCOUNTRY_META 30935 11.46 25.35 4.87 24 RCVD_IN_MSPIKE_H2 30416 27.13 24.92 28.18 25 BOTNET 29405 9.36 24.09 2.38 26 XM_Multi_Part_URI 27450 17.35 22.49 14.91 27 XMSubLong 27218 22.20 22.30 22.15 28 FVGT_m_MULTI_ODD 26992 23.18 22.12 23.68 29 T_KAM_HTML_FONT_INVALID 23886 18.56 19.57 18.08 30 T_TM2_M_HEADER_IN_MSG 22840 20.86 18.71 21.88 31 XM_Body_Dirty_Words 21334 16.26 17.48 15.68 32 UNTRUSTED_Relay 20445 7.02 16.75 2.41 33 RCVD_IN_MSPIKE_BL 19955 5.79 16.35 0.78 34 LOTS_OF_MONEY 19638 10.34 16.09 7.62 35 TR_XM_SpammyWords2 18997 7.03 15.57 2.98 36 RCVD_IN_MSPIKE_WL 18336 27.64 15.02 33.63 37 XM_UncommonTLD01 16878 7.16 13.83 4.00 38 HTML_IMAGE_RATIO_02 14898 10.98 12.21 10.39 39 FSL_BULK_SIG 14480 7.73 11.86 5.77 40 XM_B_SpammyWords3 13973 8.01 11.45 6.37 41 XM_B_Unsub 12981 10.71 10.64 10.74 42 BOTNET_IPINHOSTNAME 12933 7.93 10.60 6.66 43 XMSexyCombo_05 12674 7.14 10.38 5.60 44 RCVD_IN_RP_RNBL 12352 3.37 10.12 0.16 45 LotsOfNums_01 12266 9.17 10.05 8.76 46 RCVD_IN_PSBL 11717 3.11 9.60 0.03 47 MPART_ALT_DIFF 11627 6.37 9.53 4.87 48 RCVD_IN_MSPIKE_L5 11626 3.22 9.53 0.23 49 TR_XM_SpammyWords3 11470 3.39 9.40 0.54 50 XM_B_Phish_Phrases 11303 7.49 9.26 6.64 51 XM_Evil_Numbers_Gen 10820 9.43 8.87 9.70 52 DATE_IN_PAST_03_06 10000 2.68 8.19 0.06 53 RCVD_IN_MSPIKE_H3 9942 15.24 8.15 18.60 54 RCVD_IN_BL_SPAMCOP_NET 9875 3.45 8.09 1.26 55 XMSubMetaSx_00 9798 5.39 8.03 4.14 56 RELAYCOUNTRY_CA 9777 3.85 8.01 1.87 57 BAYES_80 9585 6.03 7.85 5.16 58 XM_H_Long_From01 8907 6.15 7.30 5.60 59 BAYES_60 8837 7.59 7.24 7.76 60 TR_XM_PhishingBody 8315 4.55 6.81 3.48 61 MIME_HTML_MOSTLY 8291 4.59 6.79 3.55 62 RCVD_IN_MSPIKE_L3 7885 2.42 6.46 0.50 63 RCVD_IN_MSPIKE_H4 7717 10.79 6.32 12.90 64 XM_UB50 7667 2.67 6.28 0.96 65 XMBrknScrpt_02 7636 2.83 6.26 1.20 66 XM_Lotto 7297 1.96 5.98 0.05 67 BOUNCE_MESSAGE 7284 3.34 5.97 2.09 68 ANY_BOUNCE_MESSAGE 7284 3.34 5.97 2.09 69 TooManyTo_001 7053 6.88 5.78 7.41 70 UNPARSEABLE_RELAY 6922 7.89 5.67 8.94 71 T_REMOTE_IMAGE 6671 3.80 5.47 3.02 72 TR_XM_COVIDMETA4 6603 1.90 5.41 0.23 73 SpammyFromTLD_01 6465 2.09 5.30 0.57 74 XM_OfRef6 6382 2.84 5.23 1.70 75 SpammyFromTLD_02 6368 1.80 5.22 0.18 76 BAYES_95 6297 3.89 5.16 3.29 77 HTML_IMAGE_RATIO_04 6198 5.65 5.08 5.92 78 BOTNET_NORDNS 6131 1.62 5.02 0.01 79 XM_B_SpammyTLD 6094 2.88 4.99 1.88 80 XMBody_17 5732 2.23 4.70 1.06 81 URIBL_SBL_A 5662 1.60 4.64 0.16 82 HTML_IMAGE_RATIO_08 4858 2.98 3.98 2.51 83 HTML_MIME_NO_HTML_TAG 4790 2.27 3.92 1.48 84 URI_HEX 4592 2.29 3.76 1.59 85 XMStrtUSub 4590 5.55 3.76 6.39 86 SUBJ_ALL_CAPS 4585 2.17 3.76 1.41 87 XM_SendGrid 4561 6.78 3.74 8.23 88 TR_XM_MaxSPIKE 4417 1.18 3.62 0.02 89 XMNumbers 4388 4.37 3.60 4.74 90 T_FONT_INVIS_NAKED_TO 4220 2.69 3.46 2.32 91 TR_XM_MaxBayes 4161 1.11 3.41 0.02 92 DKIM_INVALID 4152 3.09 3.40 2.94 93 HTML_IMAGE_RATIO_06 4138 3.52 3.39 3.58 94 XM_SPF_SoftFail 4104 1.73 3.36 0.96 95 XM_BadFromFormat 4080 1.27 3.34 0.29 96 TR_LOTS_OF_MONEY3 4026 1.49 3.30 0.63 97 URI_TRY_3LD 3987 1.97 3.27 1.36 98 XM_UB99 3978 1.06 3.26 0.02 99 XM_DIRTYINTL 3948 1.40 3.23 0.53 100 LH_URI_DOM_IN_PATH 3921 2.15 3.21 1.65 101 HTML_SHORT_LINK_IMG_1 3857 1.03 3.16 0.02 102 RELAYCOUNTRY_FR 3848 1.16 3.15 0.22 103 T_XMDrugObfuBody_08 3774 2.00 3.09 1.48 104 XM_B_COVIDMETA 3725 1.74 3.05 1.11 105 RCVD_IN_RP_SAFE 3724 9.14 3.05 12.02 106 XM_B_Phish66 3703 1.80 3.03 1.22 107 BODY_URI_ONLY 3647 0.98 2.99 0.03 108 FROM_EXCESS_BASE64 3477 3.51 2.85 3.82 109 KHOP_HELO_FCRDNS 3345 1.50 2.74 0.92 110 SHORT_SHORTNER 3313 0.90 2.71 0.04 111 SHORTENED_URL_HREF 3186 1.05 2.61 0.31 112 XMPhish30 3171 1.50 2.60 0.98 113 BAYES_40 3167 3.82 2.59 4.41 114 SHORTENED_URL_SRC 3045 0.80 2.49 0.00 115 SHORTENER_SHORT_IMG 3045 0.80 2.49 0.00 116 XM_OfRef7 2989 0.87 2.45 0.12 117 TR_XM_UnparsRelay 2951 1.28 2.42 0.75 118 RCVD_IN_RP_CERTIFIED 2923 8.39 2.39 11.23 119 TM2_M_URI_OPT_OUT 2892 3.28 2.37 3.72 120 XM_CamelCaseFrm001 2835 2.07 2.32 1.95 121 XMDiploma_00 2827 1.75 2.32 1.48 122 RELAYCOUNTRY_GB 2798 1.19 2.29 0.66 123 XM_B_COPY_HTML 2715 1.19 2.22 0.70 124 T_TooManySym_01 2714 4.97 2.22 6.27 125 XM_UB60 2659 0.75 2.18 0.07 126 SHORT_URI_2 2656 0.72 2.18 0.03 127 TR_Mismatch_TLD_01 2647 0.95 2.17 0.37 128 XMPhish14 2640 1.00 2.16 0.46 129 XM_UB999 2623 0.70 2.15 0.02 130 XMSubNoVowel 2605 1.38 2.13 1.02 131 T_FILL_THIS_FORM_SHORT 2480 1.21 2.03 0.82 132 TR_XM_DK_SendGrid 2373 3.87 1.94 4.79 133 TR_XM_SpoofStaff 2364 0.72 1.94 0.14 134 XMSpoofStaff2 2349 0.71 1.92 0.14 135 TR_XM_PSC1 2346 0.71 1.92 0.14 136 XM_H_SpoofStaff4 2346 0.72 1.92 0.15 137 MIME_HTML_ONLY_MULTI 2327 2.30 1.91 2.49 138 FILL_THIS_FORM 2264 0.81 1.86 0.32 139 XMBdyGiftCard01 2258 1.97 1.85 2.02 140 T_FILL_THIS_FORM_LONG 2209 0.76 1.81 0.26 141 BAYES_20 2197 2.67 1.80 3.09 142 HTML_IMAGE_ONLY_32 2189 0.74 1.79 0.25 143 MIME_CHARSET_FARAWAY 2178 0.67 1.78 0.14 144 HDRS_MISSP 2169 0.69 1.78 0.17 145 MIMEOLE_DIRECT_TO_MX 2163 0.57 1.77 0.00 146 TR_MetaPhish_Combo_01b 2155 0.69 1.77 0.18 147 XMPhish11 2133 0.60 1.75 0.06 148 T_XMHurry_00 2082 1.16 1.71 0.90 149 XM_UB80 2065 0.56 1.69 0.03 150 RELAYCOUNTRY_ZA 2055 0.54 1.68 0.00 151 PDS_FRNOM_TODOM_NAKED_TO 2035 0.54 1.67 0.00 152 PDS_FROM_NAME_TO_DOMAIN 2035 0.54 1.67 0.00 153 CHARSET_FARAWAY_HEADER 2030 0.58 1.66 0.06 154 XMPhish19 2014 0.53 1.65 0.00 155 XMPhishMultiple 1991 0.52 1.63 0.00 156 TR_XM_SpoofStaff2 1987 0.52 1.63 0.00 157 TR_XM_PHPDW 1974 0.75 1.62 0.34 158 MIME_QP_LONG_LINE 1951 3.32 1.60 4.14 159 TR_XM_PHPForged 1937 0.73 1.59 0.32 160 TR_Mismatch_TLD_02 1928 0.55 1.58 0.06 161 TR_XM_FormFill2 1917 0.72 1.57 0.32 162 HTML_IMAGE_ONLY_04 1912 0.53 1.57 0.03 163 XM_H_PHPOS 1911 0.72 1.57 0.31 164 HTML_IMAGE_ONLY_08 1885 0.61 1.54 0.17 165 ADVANCE_FEE_2_NEW_FORM 1818 0.48 1.49 0.00 166 DKIM_ADSP_NXDOMAIN 1743 1.09 1.43 0.92 167 XMHTML_After_End 1741 0.96 1.43 0.73 168 URI_PHP_REDIR 1738 0.46 1.42 0.00 169 NUMERIC_HTTP_ADDR 1737 1.05 1.42 0.87 170 FORM_FRAUD 1734 0.46 1.42 0.00 171 T_XMDrugObfuBody_14 1703 1.44 1.40 1.45 172 NO_DNS_FOR_FROM 1690 1.05 1.38 0.89 173 XM_URI_RBL 1658 0.57 1.36 0.19 174 XMStockSpam_06 1655 1.63 1.36 1.76 175 RELAYCOUNTRY_DE 1634 0.76 1.34 0.48 176 XM_SPF_Unknown 1631 0.68 1.34 0.37 177 TM2_M_VERY_LONG_WORD 1623 1.18 1.33 1.11 178 TR_Caps_n_Bayes_99 1617 0.53 1.32 0.16 179 PLING_QUERY 1614 0.88 1.32 0.67 180 XM_B_SpammyWords4 1614 1.10 1.32 1.00 181 XM_B_Unsub2 1606 1.11 1.32 1.01 182 DIET_1 1583 0.76 1.30 0.50 183 DATE_IN_PAST_06_12 1578 0.48 1.29 0.09 184 DOS_OE_TO_MX 1577 0.42 1.29 0.00 185 RCVD_IN_IADB_LISTED 1564 3.08 1.28 3.93 186 RELAYCOUNTRY_NL 1562 0.64 1.28 0.33 187 BODY_EMPTY 1531 0.40 1.25 0.00 188 FROM_SUSPICIOUS_NTLD 1520 0.42 1.25 0.04 189 NORMAL_HTTP_TO_IP 1514 0.43 1.24 0.04 190 FROM_SUSPICIOUS_NTLD_FP 1492 0.41 1.22 0.02 191 XMSexyCombo_01 1482 0.93 1.21 0.80 192 TR_XM_RelayPhish 1450 0.45 1.19 0.10 193 RDNS_DYNAMIC 1416 0.92 1.16 0.81 194 XM_UB95 1413 0.38 1.16 0.02 195 FROM_MISSP_REPLYTO 1406 0.38 1.15 0.01 196 HK_RANDOM_REPLYTO 1404 0.49 1.15 0.17 197 TR_XM_SB_Phish 1401 1.52 1.15 1.70 198 T_Symld_Words_02 1397 0.60 1.14 0.34 199 T_PDS_OTHER_BAD_TLD 1385 0.64 1.13 0.40 200 TR_Symld_Words 1362 1.69 1.12 1.96 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 225684 88.23 89.32 87.71 2 RELAYCOUNTRY_US 216330 80.48 72.89 84.08 3 DKIM_SIGNED 214245 80.96 76.10 83.27 4 XM_DK_Pass 211328 79.54 74.07 82.13 5 DKIM_VALID 206679 77.87 72.70 80.33 6 XM_B_Unicode 193384 76.08 78.03 75.16 7 DKIM_VALID_AU 167330 62.42 56.89 65.03 8 XMListUnsubscribeExists 153006 62.06 67.52 59.47 9 BAYES_50 135141 46.98 35.29 52.52 10 DCC_CHECK_NEGATIVE 132212 43.43 26.65 51.39 11 XM_B_SpammyWords 131507 56.57 68.06 51.11 12 DCC_CHECK 122023 55.33 71.99 47.43 13 XM_B_Unicode3 119382 43.83 38.43 46.40 14 HTML_FONT_LOW_CONTRAST 87831 33.85 33.23 34.14 15 RCVD_IN_MSPIKE_WL 86525 27.64 15.02 33.63 16 LOC_TINY_FONT_1 84666 32.09 30.37 32.91 17 DKIM_VALID_EF 77953 28.91 25.97 30.30 18 RCVD_IN_MSPIKE_H2 72499 27.13 24.92 28.18 19 XM_B_SpammyWords2 62852 28.64 37.51 24.43 20 FVGT_m_MULTI_ODD 60927 23.18 22.12 23.68 21 MIME_HTML_ONLY 58800 25.02 29.60 22.85 22 XMSubLong 56993 22.20 22.30 22.15 23 T_TM2_M_HEADER_IN_MSG 56302 20.86 18.71 21.88 24 RCVD_IN_MSPIKE_H3 47856 15.24 8.15 18.60 25 T_KAM_HTML_FONT_INVALID 46508 18.56 19.57 18.08 26 XM_Body_Dirty_Words 40343 16.26 17.48 15.68 27 XM_Multi_Part_URI 38356 17.35 22.49 14.91 28 BAYES_00 34550 9.44 1.04 13.43 29 RCVD_IN_MSPIKE_H4 33204 10.79 6.32 12.90 30 XM_DKIMWhitelistDomains 31329 8.26 0.01 12.18 31 RCVD_IN_RP_SAFE 30934 9.14 3.05 12.02 32 XM_DK_Undo_02 30289 22.02 43.62 11.77 33 ALL_TRUSTED 30163 8.21 0.82 11.72 34 RCVD_IN_RP_CERTIFIED 28905 8.39 2.39 11.23 35 TR_XM_DK_Bayes 27824 7.45 0.35 10.81 36 XM_B_Unsub 27636 10.71 10.64 10.74 37 TR_XM_DK_Bayes1 27143 7.27 0.35 10.55 38 HTML_IMAGE_RATIO_02 26739 10.98 12.21 10.39 39 TR_XM_DK_Bayes2 25238 6.75 0.31 9.81 40 XM_Evil_Numbers_Gen 24945 9.43 8.87 9.70 41 UNPARSEABLE_RELAY 23005 7.89 5.67 8.94 42 LotsOfNums_01 22532 9.17 10.05 8.76 43 BAYES_99 21656 17.88 37.84 8.42 44 XM_SendGrid 21171 6.78 3.74 8.23 45 BAYES_60 19962 7.59 7.24 7.76 46 LOTS_OF_MONEY 19602 10.34 16.09 7.62 47 TooManyTo_001 19054 6.88 5.78 7.41 48 BAYES_999 18170 14.36 29.74 7.06 49 BOTNET_IPINHOSTNAME 17139 7.93 10.60 6.66 50 XM_B_Phish_Phrases 17093 7.49 9.26 6.64 51 XMStrtUSub 16448 5.55 3.76 6.39 52 XM_B_SpammyWords3 16398 8.01 11.45 6.37 53 T_TooManySym_01 16137 4.97 2.22 6.27 54 HTML_IMAGE_RATIO_04 15241 5.65 5.08 5.92 55 FSL_BULK_SIG 14837 7.73 11.86 5.77 56 XM_H_Long_From01 14412 6.15 7.30 5.60 57 XMSexyCombo_05 14403 7.14 10.38 5.60 58 BAYES_80 13283 6.03 7.85 5.16 59 IN_ZIMBRA_NJ_WHITELIST 13123 3.46 0.01 5.10 60 RELAYCOUNTRY_META 12542 11.46 25.35 4.87 61 MPART_ALT_DIFF 12532 6.37 9.53 4.87 62 TR_XM_DK_SendGrid 12317 3.87 1.94 4.79 63 XMNumbers 12198 4.37 3.60 4.74 64 TR_DCC_Bayes_99 12015 12.47 28.91 4.67 65 BAYES_40 11339 3.82 2.59 4.41 66 MIME_QP_LONG_LINE 10649 3.32 1.60 4.14 67 XMSubMetaSx_00 10644 5.39 8.03 4.14 68 XM_UncommonTLD01 10300 7.16 13.83 4.00 69 RCVD_IN_IADB_LISTED 10116 3.08 1.28 3.93 70 FROM_EXCESS_BASE64 9821 3.51 2.85 3.82 71 TM2_M_URI_OPT_OUT 9564 3.28 2.37 3.72 72 T_TooManySym_02 9247 2.68 0.75 3.59 73 HTML_IMAGE_RATIO_06 9209 3.52 3.39 3.58 74 MIME_HTML_MOSTLY 9137 4.59 6.79 3.55 75 TR_XM_PhishingBody 8960 4.55 6.81 3.48 76 RCVD_IN_IADB_SPF 8766 2.66 1.09 3.41 77 BAYES_95 8454 3.89 5.16 3.29 78 BAYES_20 7950 2.67 1.80 3.09 79 RCVD_IN_IADB_SENDERID 7807 2.39 1.03 3.03 80 INVALID_MSGID 7769 2.30 0.78 3.02 81 T_REMOTE_IMAGE 7760 3.80 5.47 3.02 82 TR_XM_SpammyWords2 7656 7.03 15.57 2.98 83 DKIM_INVALID 7566 3.09 3.40 2.94 84 RCVD_IN_IADB_DK 7562 2.32 1.02 2.94 85 TVD_RCVD_IP 7486 2.05 0.24 2.91 86 HELO_MISC_IP 6828 1.94 0.45 2.65 87 CK_HELO_DYNAMIC_SPLIT_IP 6825 1.94 0.44 2.65 88 TO_MALFORMED 6509 1.72 0.00 2.53 89 HTML_IMAGE_RATIO_08 6461 2.98 3.98 2.51 90 MIME_HTML_ONLY_MULTI 6405 2.30 1.91 2.49 91 RCVD_IN_IADB_VOUCHED 6347 1.87 0.62 2.47 92 UNTRUSTED_Relay 6196 7.02 16.75 2.41 93 BOTNET 6120 9.36 24.09 2.38 94 T_FONT_INVIS_NAKED_TO 5968 2.69 3.46 2.32 95 XMBSHREFv2 5694 1.56 0.17 2.21 96 RCVD_IN_MSPIKE_H5 5465 1.62 0.55 2.12 97 ANY_BOUNCE_MESSAGE 5377 3.34 5.97 2.09 98 BOUNCE_MESSAGE 5376 3.34 5.97 2.09 99 URI_NOVOWEL 5277 1.69 0.94 2.05 100 XMBdyGiftCard01 5205 1.97 1.85 2.02 101 USER_IN_DEF_DKIM_WL 5121 1.35 0.01 1.99 102 TR_Symld_Words 5045 1.69 1.12 1.96 103 XM_CamelCaseFrm001 5009 2.07 2.32 1.95 104 BAYES_05 4933 1.64 1.06 1.92 105 XM_PDF 4860 1.37 0.27 1.89 106 MAILING_LIST_MULTI 4848 1.51 0.72 1.88 107 XM_B_SpammyTLD 4833 2.88 4.99 1.88 108 RELAYCOUNTRY_CA 4823 3.85 8.01 1.87 109 IN_HORDE_ADDRESS_BOOK 4779 1.27 0.02 1.86 110 XMStockSpam_06 4528 1.63 1.36 1.76 111 XMGappySubj_01 4491 1.20 0.04 1.75 112 XM_DK_Undo_01 4377 1.44 0.87 1.70 113 XM_OfRef6 4377 2.84 5.23 1.70 114 TR_XM_SB_Phish 4372 1.52 1.15 1.70 115 LH_URI_DOM_IN_PATH 4233 2.15 3.21 1.65 116 XMSubPhish11 4156 1.45 1.09 1.62 117 RCVD_IN_IADB_OPTIN 4146 1.25 0.48 1.61 118 URI_HEX 4101 2.29 3.76 1.59 119 TooManyTo_002 4019 1.26 0.63 1.56 120 T_TooManySym_03 3962 1.09 0.13 1.54 121 XMDiploma_00 3817 1.75 2.32 1.48 122 HTML_MIME_NO_HTML_TAG 3814 2.27 3.92 1.48 123 T_XMDrugObfuBody_08 3805 2.00 3.09 1.48 124 T_XMDrugObfuBody_14 3743 1.44 1.40 1.45 125 SUBJ_ALL_CAPS 3632 2.17 3.76 1.41 126 URI_TRY_3LD 3497 1.97 3.27 1.36 127 TR_MSPIKEBAYES00 3321 0.89 0.05 1.29 128 DKIM_ADSP_CUSTOM_MED 3295 1.16 0.91 1.28 129 RCVD_IN_BL_SPAMCOP_NET 3231 3.45 8.09 1.26 130 XM_H_Long_From02 3221 1.06 0.65 1.25 131 XM_B_Phish66 3142 1.80 3.03 1.22 132 XMBrknScrpt_02 3096 2.83 6.26 1.20 133 TooManyTo_003 2944 0.91 0.41 1.14 134 XM_GoogleGroups 2886 0.85 0.29 1.12 135 XM_B_COVIDMETA 2861 1.74 3.05 1.11 136 TM2_M_VERY_LONG_WORD 2850 1.18 1.33 1.11 137 XMBody_17 2724 2.23 4.70 1.06 138 XMSubNoVowel 2624 1.38 2.13 1.02 139 XM_B_Unsub2 2591 1.11 1.32 1.01 140 XM_B_SpammyWords4 2575 1.10 1.32 1.00 141 HTML_TAG_BALANCE_BODY 2570 0.88 0.62 1.00 142 XMPhish30 2512 1.50 2.60 0.98 143 XM_UB50 2473 2.67 6.28 0.96 144 XM_H_Trusted_IP 2461 0.65 0.00 0.96 145 XM_SPF_SoftFail 2460 1.73 3.36 0.96 146 T_TooManySym_04 2455 0.66 0.04 0.95 147 TooManyTo_004 2423 0.74 0.30 0.94 148 DKIM_ADSP_NXDOMAIN 2379 1.09 1.43 0.92 149 XMBody_95 2373 0.65 0.08 0.92 150 KHOP_HELO_FCRDNS 2355 1.50 2.74 0.92 151 XM_ProductURIs 2314 0.90 0.89 0.90 152 T_XMHurry_00 2306 1.16 1.71 0.90 153 NO_DNS_FOR_FROM 2296 1.05 1.38 0.89 154 NUMERIC_HTTP_ADDR 2230 1.05 1.42 0.87 155 XM_S_SubURI 2217 0.60 0.06 0.86 156 XMPhish08 2156 0.78 0.66 0.84 157 NML_ADSP_CUSTOM_MED 2135 0.84 0.85 0.83 158 T_FILL_THIS_FORM_SHORT 2114 1.21 2.03 0.82 159 XMGenDplmaNmb 2093 0.79 0.75 0.81 160 RDNS_DYNAMIC 2085 0.92 1.16 0.81 161 XMSexyCombo_01 2059 0.93 1.21 0.80 162 RCVD_IN_MSPIKE_BL 1996 5.79 16.35 0.78 163 T_TooManySym_05 1946 0.52 0.01 0.76 164 TR_XM_UnparsRelay 1922 1.28 2.42 0.75 165 XMSubMetaSxObfu_02 1896 0.68 0.57 0.74 166 TR_MetaPhish_Combo_01 1886 0.85 1.10 0.73 167 XMHTML_After_End 1885 0.96 1.43 0.73 168 TooManyTo_005 1879 0.58 0.25 0.73 169 HTML_FONT_FACE_BAD 1873 0.74 0.76 0.73 170 USER_IN_WELCOMELIST 1840 0.49 0.00 0.72 171 USER_IN_WHITELIST 1840 0.49 0.00 0.72 172 T_XMDrugObfuBody_00 1834 0.71 0.71 0.71 173 XMHTMLBadTable_001 1825 0.64 0.48 0.71 174 XM_B_COPY_HTML 1789 1.19 2.22 0.70 175 MPART_ALT_DIFF_COUNT 1778 0.81 1.05 0.69 176 PLING_QUERY 1719 0.88 1.32 0.67 177 FORGED_GMAIL_RCVD 1716 0.68 0.71 0.67 178 RELAYCOUNTRY_GB 1705 1.19 2.29 0.66 179 TR_LOTS_OF_MONEY3 1628 1.49 3.30 0.63 180 XMBody_78 1616 0.65 0.70 0.63 181 HELO_NODOT 1575 0.58 0.51 0.61 182 HELO_NO_DOMAIN 1574 0.58 0.51 0.61 183 XM_ShortIntro_01 1558 0.69 0.86 0.61 184 TVD_SPACE_RATIO 1557 0.44 0.09 0.61 185 XM_B_REG_HTML 1538 0.58 0.55 0.60 186 HTML_IMAGE_ONLY_20 1485 0.47 0.24 0.58 187 SpammyFromTLD_01 1477 2.09 5.30 0.57 188 XMSubMetaI_00 1465 0.62 0.72 0.57 189 HTTPS_HTTP_MISMATCH 1452 0.56 0.55 0.56 190 XM_RXBody 1405 0.61 0.75 0.55 191 TR_XM_SpammyWords3 1379 3.39 9.40 0.54 192 XM_DIRTYINTL 1375 1.40 3.23 0.53 193 DIET_1 1299 0.76 1.30 0.50 194 BASE64_LENGTH_79_INF 1294 0.55 0.64 0.50 195 RCVD_IN_MSPIKE_L3 1284 2.42 6.46 0.50 196 SENDGRID_REDIR 1277 0.45 0.35 0.50 197 TM2_M_A_HREF_HREF 1254 0.51 0.55 0.49 198 TR_BOTNET_NEGATE 1250 0.57 0.75 0.49 199 RELAYCOUNTRY_DE 1241 0.76 1.34 0.48 200 XMSolicitRefs_0 1215 0.36 0.14 0.47 ----------------------------------------------------------------------