Email: 450671 Autolearn: 0 AvgScore: 2.99 AvgScanTime: 1.24 sec Spam: 143662 Autolearn: 0 AvgScore: 13.39 AvgScanTime: 1.37 sec Ham: 307009 Autolearn: 0 AvgScore: -1.87 AvgScanTime: 1.18 sec Time Spent Running SA: 155.63 hours Time Spent Processing Spam: 54.70 hours Time Spent Processing Ham: 100.93 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138669 86.29 96.52 81.50 2 DKIM_SIGNED 128826 85.21 89.67 83.12 3 XM_DK_Pass 126727 84.18 88.21 82.29 4 DKIM_VALID 124933 82.74 86.96 80.77 5 DCC_CHECK 116843 62.04 81.33 53.01 6 XM_B_Unicode 115416 73.16 80.34 69.80 7 XMListUnsubscribeExists 112408 61.12 78.24 53.11 8 RELAYCOUNTRY_US 109411 82.77 76.16 85.86 9 XM_B_SpammyWords 104349 60.04 72.64 54.15 10 DKIM_VALID_AU 99494 68.08 69.26 67.53 11 XM_DK_Undo_02 74649 22.68 51.96 8.98 12 XM_B_SpammyWords2 65411 29.40 45.53 21.85 13 TR_XM_DKIM_Undo 62180 18.02 43.28 6.20 14 XM_B_Unicode3 60608 43.02 42.19 43.40 15 LOC_TINY_FONT_1 59452 32.98 41.38 29.05 16 BAYES_99 56892 16.66 39.60 5.93 17 HTML_FONT_LOW_CONTRAST 52796 32.91 36.75 31.11 18 MIME_HTML_ONLY 49277 25.61 34.30 21.54 19 BAYES_50 48005 48.97 33.42 56.24 20 TR_DCC_Bayes_99 46198 12.73 32.16 3.64 21 BAYES_999 45671 13.33 31.79 4.70 22 DKIM_VALID_EF 44280 34.72 30.82 36.54 23 RCVD_IN_MSPIKE_H2 43497 27.47 30.28 26.16 24 T_KAM_HTML_FONT_INVALID 36389 19.10 25.33 16.18 25 RCVD_IN_MSPIKE_WL 35866 34.80 24.97 39.41 26 FVGT_m_MULTI_ODD 35312 23.14 24.58 22.46 27 XMSubLong 33298 21.47 23.18 20.66 28 RELAYCOUNTRY_META 32896 9.95 22.90 3.89 29 T_TM2_M_HEADER_IN_MSG 30237 21.32 21.05 21.45 30 XM_Body_Dirty_Words 27261 14.49 18.98 12.38 31 TR_XM_SpammyWords2 25517 6.53 17.76 1.28 32 DCC_CHECK_NEGATIVE 25038 36.79 17.43 45.85 33 XM_B_SpammyWords3 24287 8.99 16.91 5.28 34 XM_Multi_Part_URI 20538 14.62 14.30 14.77 35 RCVD_IN_MSPIKE_H3 19669 15.74 13.69 16.71 36 LOTS_OF_MONEY 19332 8.69 13.46 6.46 37 XM_UncommonTLD01 18601 6.61 12.95 3.65 38 UNTRUSTED_Relay 18084 5.14 12.59 1.65 39 HTML_IMAGE_RATIO_02 18034 10.06 12.55 8.90 40 BOTNET 17621 5.49 12.27 2.32 41 TR_XM_SpammyWords4 17334 6.92 12.07 4.51 42 BOTNET_IPINHOSTNAME 17151 7.83 11.94 5.91 43 RCVD_IN_BL_SPAMCOP_NET 16358 4.33 11.39 1.02 44 XM_Evil_Numbers_Gen 14984 9.51 10.43 9.08 45 RCVD_IN_MSPIKE_H4 14841 13.46 10.33 14.92 46 XMSexyCombo_05 14519 6.41 10.11 4.68 47 RELAYCOUNTRY_CA 14064 4.02 9.79 1.32 48 XM_B_Unsub 13742 9.94 9.57 10.11 49 BAYES_80 12647 6.65 8.80 5.65 50 MPART_ALT_DIFF 12498 6.01 8.70 4.75 51 FSL_BULK_SIG 12397 6.12 8.63 4.95 52 LotsOfNums_01 11822 8.17 8.23 8.15 53 UNPARSEABLE_RELAY 11758 8.60 8.18 8.80 54 BAYES_60 11419 9.20 7.95 9.79 55 TR_XM_UnparsRelay 11416 7.44 7.95 7.20 56 RCVD_IN_RP_SAFE 10995 10.50 7.65 11.83 57 XM_B_Phish_Phrases 10920 11.13 7.60 12.78 58 TooManyTo_001 10299 6.38 7.17 6.02 59 MIME_HTML_MOSTLY 10177 4.28 7.08 2.97 60 HTML_IMAGE_RATIO_04 9779 6.73 6.81 6.69 61 TR_XM_PhishingBody 9609 3.82 6.69 2.48 62 XMSubMetaSx_00 8990 4.33 6.26 3.44 63 XM_H_Long_From01 8752 5.58 6.09 5.35 64 XM_SendGrid 8413 7.23 5.86 7.88 65 RCVD_IN_RP_CERTIFIED 8194 9.25 5.70 10.91 66 SpammyFromTLD_02 7886 1.89 5.49 0.20 67 BAYES_95 7426 3.96 5.17 3.40 68 TR_XM_SpammyWords5 7094 2.63 4.94 1.55 69 XM_OfRef6 6837 2.06 4.76 0.80 70 XM_UB50 6751 2.12 4.70 0.92 71 TR_LOTS_OF_MONEY3 6630 2.07 4.61 0.88 72 KHOP_HELO_FCRDNS 6372 2.15 4.44 1.09 73 XMStrtUSub 6321 11.07 4.40 14.20 74 URIBL_SBL_A 6298 2.39 4.38 1.45 75 T_REMOTE_IMAGE 6012 3.07 4.18 2.54 76 XM_B_SpammyTLD 5857 3.00 4.08 2.49 77 XM_DK_Undo_01 5703 2.13 3.97 1.27 78 SpammyFromTLD_01 5658 1.57 3.94 0.46 79 XMNumbers 5569 3.62 3.88 3.50 80 XMBdyGiftCard01 5542 2.20 3.86 1.42 81 URI_HEX 5289 2.09 3.68 1.34 82 FROM_EXCESS_BASE64 5182 3.67 3.61 3.70 83 T_FILL_THIS_FORM_SHORT 5154 1.48 3.59 0.49 84 XMBody_17 5147 1.64 3.58 0.73 85 XMBrknScrpt_02 5134 1.89 3.57 1.10 86 XM_B_SpammyWords4 4988 1.68 3.47 0.84 87 XM_B_Phish66 4986 2.05 3.47 1.38 88 TR_XM_DK_SendGrid 4945 4.56 3.44 5.09 89 XMDiploma_00 4859 1.93 3.38 1.25 90 TM2_M_URI_OPT_OUT 4828 2.70 3.36 2.39 91 HTML_IMAGE_RATIO_08 4789 2.53 3.33 2.15 92 RELAYCOUNTRY_FR 4382 1.12 3.05 0.22 93 HTML_IMAGE_ONLY_12 4231 1.02 2.95 0.12 94 HTML_SHORT_LINK_IMG_1 4189 0.94 2.92 0.02 95 TR_XM_BayesRelay 4176 0.95 2.91 0.03 96 RELAYCOUNTRY_IN 4166 0.97 2.90 0.07 97 T_XMDrugObfuBody_08 4162 1.73 2.90 1.18 98 BODY_URI_ONLY 4118 0.92 2.87 0.01 99 SUBJ_ALL_CAPS 4074 1.62 2.84 1.05 100 URIBL_DBL_SPAM 4057 0.91 2.82 0.01 101 T_XMDrugObfuBody_14 4002 2.61 2.79 2.52 102 XM_DIRTYINTL 4001 1.09 2.79 0.30 103 T_TooManySym_01 3995 5.03 2.78 6.08 104 DKIM_INVALID 3893 2.46 2.71 2.35 105 HK_RANDOM_REPLYTO 3809 0.96 2.65 0.17 106 RCVD_IN_MSPIKE_BL 3790 0.93 2.64 0.13 107 XM_SPF_SoftFail 3756 1.61 2.61 1.14 108 MIME_HTML_ONLY_MULTI 3701 2.83 2.58 2.95 109 TR_XM_MSPIKECOMBO 3692 0.90 2.57 0.12 110 XM_UB99 3359 0.75 2.34 0.00 111 XM_CamelCaseFrm001 3312 1.90 2.31 1.71 112 HTML_FONT_SIZE_LARGE 3308 0.84 2.30 0.15 113 HTML_IMAGE_RATIO_06 3221 2.95 2.24 3.28 114 TR_XM_FormFill 3198 0.72 2.23 0.02 115 TR_XM_MaxBayes 3195 0.72 2.22 0.02 116 T_XMHurry_00 2901 1.01 2.02 0.54 117 TM2_M_VERY_LONG_WORD 2811 1.53 1.96 1.33 118 XM_UB60 2768 0.69 1.93 0.10 119 RCVD_IN_MSPIKE_L5 2707 0.64 1.88 0.06 120 RCVD_IN_RP_RNBL 2586 0.59 1.80 0.03 121 TR_Symld_Words 2541 1.40 1.77 1.23 122 DATE_IN_PAST_12_24 2491 0.57 1.73 0.02 123 RCVD_IN_PSBL 2486 0.66 1.73 0.16 124 XMSexyCombo_01 2474 1.03 1.72 0.70 125 XMClaimOffer 2427 0.62 1.69 0.12 126 BAYES_20 2419 2.50 1.68 2.88 127 XM_B_Unsub2 2411 1.51 1.68 1.44 128 MIME_QP_LONG_LINE 2402 3.20 1.67 3.92 129 BAYES_40 2353 3.37 1.64 4.18 130 XM_B_COVIDMETA 2337 0.98 1.63 0.68 131 XMPhish08 2318 0.62 1.61 0.16 132 XMStockSpam_06 2264 1.80 1.58 1.90 133 XMSubMetaI_00 2252 1.12 1.57 0.90 134 XM_UB999 2248 0.50 1.56 0.00 135 URI_NOVOWEL 2210 1.92 1.54 2.10 136 URI_TRY_3LD 2107 1.22 1.47 1.11 137 TR_XM_SpammyWords3 2104 0.51 1.46 0.06 138 BOTNET_NORDNS 2050 0.46 1.43 0.01 139 FORGED_GMAIL_RCVD 1941 0.82 1.35 0.56 140 URI_PHP_REDIR 1913 0.43 1.33 0.00 141 TR_XM_PHPDW 1894 0.61 1.32 0.28 142 XMHTML_After_End 1867 0.97 1.30 0.81 143 RCVD_IN_IADB_LISTED 1864 2.92 1.30 3.68 144 XM_ProductURIs 1854 1.06 1.29 0.95 145 TR_XM_PHPForged 1838 0.54 1.28 0.20 146 TR_Caps_n_Bayes_99 1834 0.45 1.28 0.06 147 TR_XM_COVIDMETA1 1822 0.56 1.27 0.23 148 TR_XM_FormFill2 1815 0.54 1.26 0.21 149 XM_H_PHPOS 1811 0.54 1.26 0.20 150 HTML_MIME_NO_HTML_TAG 1806 1.44 1.26 1.53 151 NUMERIC_HTTP_ADDR 1756 0.50 1.22 0.16 152 XM_UB80 1743 0.40 1.21 0.02 153 XM_OfRef7 1708 0.47 1.19 0.13 154 XMGenDplmaNmb 1679 0.74 1.17 0.54 155 T_XMDrugObfuBody_00 1678 0.83 1.17 0.67 156 XM_S_SpammyWords 1676 0.89 1.17 0.76 157 TR_XM_Spammywords 1676 0.89 1.17 0.76 158 ALL_TRUSTED 1668 7.86 1.16 11.00 159 TR_XM_SB_Phish 1649 1.29 1.15 1.35 160 XM_URI_RBL 1648 0.48 1.15 0.16 161 RCVD_IN_IADB_SPF 1643 2.57 1.14 3.23 162 XMSubPhish11 1613 1.27 1.12 1.34 163 RCVD_IN_IADB_DK 1524 2.27 1.06 2.83 164 XMPhish30 1506 0.67 1.05 0.50 165 TR_XM_INV_DKIM 1504 0.41 1.05 0.11 166 PDS_OTHER_BAD_TLD 1496 1.12 1.04 1.16 167 URIBL_BLACK 1494 0.35 1.04 0.02 168 RCVD_IN_IADB_SENDERID 1487 2.33 1.04 2.93 169 BAYES_00 1474 7.27 1.03 10.19 170 MAILING_LIST_MULTI 1447 1.51 1.01 1.75 171 XM_Body_Obfu01 1425 0.45 0.99 0.20 172 DIET_1 1421 0.64 0.99 0.47 173 HTML_FONT_SIZE_HUGE 1401 0.46 0.98 0.23 174 TR_XM_RelayPhish 1361 0.35 0.95 0.07 175 RCVD_IN_MSPIKE_H5 1356 5.61 0.94 7.79 176 RELAYCOUNTRY_NL 1336 0.44 0.93 0.22 177 XM_UB95 1331 0.31 0.93 0.02 178 HTTPS_HTTP_MISMATCH 1308 0.69 0.91 0.58 179 SUBJ_DOLLARS 1307 0.48 0.91 0.28 180 XM_H_Long_From02 1278 0.97 0.89 1.00 181 T_Symld_Words_02 1267 0.45 0.88 0.24 182 URI_NO_WWW_BIZ_CGI 1260 0.28 0.88 0.00 183 TM2_M_A_HREF_HREF 1247 0.51 0.87 0.35 184 XMNoVowels 1241 0.52 0.86 0.36 185 HTML_FONT_FACE_BAD 1228 1.18 0.85 1.33 186 T_MONEY_PERCENT 1219 0.51 0.85 0.35 187 TR_LOTS_OF_MONEY2 1219 0.51 0.85 0.35 188 XMSexyCombo_04 1214 0.31 0.85 0.06 189 XMSubMetaSxObfu_03 1207 0.48 0.84 0.31 190 XM_Body_Dirty_Words_01 1194 0.53 0.83 0.39 191 HTML_TAG_BALANCE_BODY 1166 0.69 0.81 0.63 192 RDNS_DYNAMIC 1164 0.77 0.81 0.75 193 XM_RXBody 1149 0.81 0.80 0.82 194 TR_Sbj_FN_Bdy 1110 0.37 0.77 0.18 195 XMSlimDrugH 1098 0.38 0.76 0.20 196 GOOGLE_DOC_SUSP 1090 0.25 0.76 0.01 197 THIS_AD 1047 0.36 0.73 0.19 198 TR_Mismatch_TLD_01 1044 0.39 0.73 0.23 199 URIBL_DBL_ABUSE_SPAM 1037 0.24 0.72 0.02 200 INVESTMENT_ADVICE 1030 0.27 0.72 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 RELAYCOUNTRY_US 263587 82.77 76.16 85.86 2 DKIM_SIGNED 255175 85.21 89.67 83.12 3 XM_DK_Pass 252649 84.18 88.21 82.29 4 HTML_MESSAGE 250215 86.29 96.52 81.50 5 DKIM_VALID 247969 82.74 86.96 80.77 6 XM_B_Unicode 214292 73.16 80.34 69.80 7 DKIM_VALID_AU 207322 68.08 69.26 67.53 8 BAYES_50 172669 48.97 33.42 56.24 9 XM_B_SpammyWords 166256 60.04 72.64 54.15 10 XMListUnsubscribeExists 163050 61.12 78.24 53.11 11 DCC_CHECK 162742 62.04 81.33 53.01 12 DCC_CHECK_NEGATIVE 140769 36.79 17.43 45.85 13 XM_B_Unicode3 133253 43.02 42.19 43.40 14 RCVD_IN_MSPIKE_WL 120989 34.80 24.97 39.41 15 DKIM_VALID_EF 112191 34.72 30.82 36.54 16 HTML_FONT_LOW_CONTRAST 95511 32.91 36.75 31.11 17 LOC_TINY_FONT_1 89171 32.98 41.38 29.05 18 RCVD_IN_MSPIKE_H2 80321 27.47 30.28 26.16 19 FVGT_m_MULTI_ODD 68963 23.14 24.58 22.46 20 XM_B_SpammyWords2 67084 29.40 45.53 21.85 21 MIME_HTML_ONLY 66144 25.61 34.30 21.54 22 T_TM2_M_HEADER_IN_MSG 65851 21.32 21.05 21.45 23 XM_DKIMWhitelistDomains 63744 14.16 0.06 20.76 24 XMSubLong 63443 21.47 23.18 20.66 25 RCVD_IN_MSPIKE_H3 51286 15.74 13.69 16.71 26 T_KAM_HTML_FONT_INVALID 49679 19.10 25.33 16.18 27 RCVD_IN_MSPIKE_H4 45798 13.46 10.33 14.92 28 XM_Multi_Part_URI 45359 14.62 14.30 14.77 29 XMStrtUSub 43582 11.07 4.40 14.20 30 XM_B_Phish_Phrases 39229 11.13 7.60 12.78 31 XM_Body_Dirty_Words 38023 14.49 18.98 12.38 32 RCVD_IN_RP_SAFE 36310 10.50 7.65 11.83 33 ALL_TRUSTED 33774 7.86 1.16 11.00 34 RCVD_IN_RP_CERTIFIED 33492 9.25 5.70 10.91 35 BAYES_00 31287 7.27 1.03 10.19 36 XM_B_Unsub 31033 9.94 9.57 10.11 37 BAYES_60 30050 9.20 7.95 9.79 38 XM_Evil_Numbers_Gen 27867 9.51 10.43 9.08 39 XM_DK_Undo_02 27561 22.68 51.96 8.98 40 HTML_IMAGE_RATIO_02 27324 10.06 12.55 8.90 41 UNPARSEABLE_RELAY 27014 8.60 8.18 8.80 42 LotsOfNums_01 25007 8.17 8.23 8.15 43 TR_XM_DK_Bayes 24822 5.71 0.63 8.09 44 XM_SendGrid 24181 7.23 5.86 7.88 45 TR_XM_DK_Bayes1 23917 5.50 0.62 7.79 46 RCVD_IN_MSPIKE_H5 23905 5.61 0.94 7.79 47 TR_XM_UnparsRelay 22098 7.44 7.95 7.20 48 TR_XM_DK_Bayes2 21904 5.04 0.56 7.13 49 HTML_IMAGE_RATIO_04 20539 6.73 6.81 6.69 50 LOTS_OF_MONEY 19847 8.69 13.46 6.46 51 TR_XM_DKIM_Undo 19041 18.02 43.28 6.20 52 T_TooManySym_01 18675 5.03 2.78 6.08 53 TooManyTo_001 18473 6.38 7.17 6.02 54 BAYES_99 18193 16.66 39.60 5.93 55 BOTNET_IPINHOSTNAME 18145 7.83 11.94 5.91 56 BAYES_80 17341 6.65 8.80 5.65 57 XM_H_Long_From01 16414 5.58 6.09 5.35 58 XM_B_SpammyWords3 16213 8.99 16.91 5.28 59 TR_XM_DK_SendGrid 15618 4.56 3.44 5.09 60 FSL_BULK_SIG 15196 6.12 8.63 4.95 61 MPART_ALT_DIFF 14595 6.01 8.70 4.75 62 BAYES_999 14421 13.33 31.79 4.70 63 XMSexyCombo_05 14366 6.41 10.11 4.68 64 TR_XM_SpammyWords4 13847 6.92 12.07 4.51 65 IN_ZIMBRA_NJ_WHITELIST 13840 3.08 0.03 4.51 66 BAYES_40 12828 3.37 1.64 4.18 67 MIME_QP_LONG_LINE 12042 3.20 1.67 3.92 68 RELAYCOUNTRY_META 11943 9.95 22.90 3.89 69 FROM_EXCESS_BASE64 11374 3.67 3.61 3.70 70 RCVD_IN_IADB_LISTED 11300 2.92 1.30 3.68 71 XM_UncommonTLD01 11198 6.61 12.95 3.65 72 TR_DCC_Bayes_99 11175 12.73 32.16 3.64 73 XMNumbers 10751 3.62 3.88 3.50 74 XMSubMetaSx_00 10546 4.33 6.26 3.44 75 BAYES_95 10430 3.96 5.17 3.40 76 HTML_IMAGE_RATIO_06 10083 2.95 2.24 3.28 77 T_TooManySym_02 10026 2.44 0.67 3.27 78 RCVD_IN_IADB_SPF 9920 2.57 1.14 3.23 79 MIME_HTML_MOSTLY 9128 4.28 7.08 2.97 80 MIME_HTML_ONLY_MULTI 9057 2.83 2.58 2.95 81 RCVD_IN_IADB_SENDERID 8992 2.33 1.04 2.93 82 BAYES_20 8847 2.50 1.68 2.88 83 RCVD_IN_IADB_DK 8686 2.27 1.06 2.83 84 T_REMOTE_IMAGE 7808 3.07 4.18 2.54 85 INVALID_MSGID 7786 1.93 0.62 2.54 86 T_XMDrugObfuBody_14 7746 2.61 2.79 2.52 87 XM_H_Trusted_IP 7692 1.71 0.00 2.51 88 XM_B_SpammyTLD 7655 3.00 4.08 2.49 89 TR_XM_PhishingBody 7600 3.82 6.69 2.48 90 TVD_RCVD_IP 7538 1.71 0.11 2.46 91 MSGID_NOFQDN1 7422 1.67 0.09 2.42 92 TM2_M_URI_OPT_OUT 7330 2.70 3.36 2.39 93 DKIM_INVALID 7206 2.46 2.71 2.35 94 BOTNET 7124 5.49 12.27 2.32 95 USER_IN_DEF_DKIM_WL 6786 1.52 0.04 2.21 96 HTML_IMAGE_RATIO_08 6611 2.53 3.33 2.15 97 RCVD_IN_IADB_VOUCHED 6584 1.65 0.60 2.14 98 URI_NOVOWEL 6456 1.92 1.54 2.10 99 TO_MALFORMED 6358 1.41 0.00 2.07 100 HELO_MISC_IP 6160 1.43 0.20 2.01 101 XMStockSpam_06 5832 1.80 1.58 1.90 102 XM_PDF 5469 1.30 0.27 1.78 103 MAILING_LIST_MULTI 5375 1.51 1.01 1.75 104 BAYES_05 5341 1.41 0.71 1.74 105 XM_CamelCaseFrm001 5265 1.90 2.31 1.71 106 ANY_BOUNCE_MESSAGE 5144 1.26 0.38 1.68 107 BOUNCE_MESSAGE 5142 1.26 0.38 1.67 108 UNTRUSTED_Relay 5068 5.14 12.59 1.65 109 IN_HORDE_ADDRESS_BOOK 4983 1.13 0.07 1.62 110 TR_XM_SpammyWords5 4748 2.63 4.94 1.55 111 HTML_MIME_NO_HTML_TAG 4695 1.44 1.26 1.53 112 XMBSHREFv2 4652 1.11 0.25 1.52 113 URIBL_SBL_A 4454 2.39 4.38 1.45 114 XM_B_Unsub2 4415 1.51 1.68 1.44 115 XMBdyGiftCard01 4351 2.20 3.86 1.42 116 XM_B_Phish66 4233 2.05 3.47 1.38 117 RCVD_IN_IADB_OPTIN 4197 1.09 0.48 1.37 118 TR_XM_SB_Phish 4155 1.29 1.15 1.35 119 XMSubPhish11 4124 1.27 1.12 1.34 120 URI_HEX 4111 2.09 3.68 1.34 121 TM2_M_VERY_LONG_WORD 4086 1.53 1.96 1.33 122 HTML_FONT_FACE_BAD 4083 1.18 0.85 1.33 123 RELAYCOUNTRY_CA 4044 4.02 9.79 1.32 124 TooManyTo_002 4008 1.04 0.47 1.31 125 TR_XM_SpammyWords2 3924 6.53 17.76 1.28 126 XM_DK_Undo_01 3902 2.13 3.97 1.27 127 XMDiploma_00 3834 1.93 3.38 1.25 128 TR_Symld_Words 3785 1.40 1.77 1.23 129 T_XMDrugObfuBody_08 3636 1.73 2.90 1.18 130 PDS_OTHER_BAD_TLD 3567 1.12 1.04 1.16 131 XMSubNoVowel 3501 0.98 0.65 1.14 132 XM_SPF_SoftFail 3486 1.61 2.61 1.14 133 URI_TRY_3LD 3399 1.22 1.47 1.11 134 XMBody_95 3387 0.78 0.10 1.10 135 XMBrknScrpt_02 3373 1.89 3.57 1.10 136 KHOP_HELO_FCRDNS 3335 2.15 4.44 1.09 137 XMGappySubj_01 3315 0.75 0.04 1.08 138 SUBJ_ALL_CAPS 3238 1.62 2.84 1.05 139 RCVD_IN_BL_SPAMCOP_NET 3137 4.33 11.39 1.02 140 XM_H_Long_From02 3079 0.97 0.89 1.00 141 DKIM_ADSP_CUSTOM_MED 3075 0.89 0.66 1.00 142 XM_ProductURIs 2931 1.06 1.29 0.95 143 XM_GoogleGroups 2921 0.79 0.45 0.95 144 TooManyTo_003 2859 0.77 0.42 0.93 145 XM_UB50 2819 2.12 4.70 0.92 146 TR_MSPIKEBAYES00 2806 0.64 0.06 0.91 147 XMSubMetaI_00 2778 1.12 1.57 0.90 148 TR_LOTS_OF_MONEY3 2702 2.07 4.61 0.88 149 XM_B_SpammyWords4 2568 1.68 3.47 0.84 150 XM_RXBody 2504 0.81 0.80 0.82 151 XMHTML_After_End 2495 0.97 1.30 0.81 152 XM_OfRef6 2449 2.06 4.76 0.80 153 T_TooManySym_03 2420 0.67 0.43 0.79 154 XM_S_SpammyWords 2335 0.89 1.17 0.76 155 TR_XM_Spammywords 2335 0.89 1.17 0.76 156 TVD_SPACE_RATIO 2325 0.53 0.04 0.76 157 RDNS_DYNAMIC 2288 0.77 0.81 0.75 158 XMBody_17 2251 1.64 3.58 0.73 159 XMHTMLBadTable_001 2227 0.67 0.56 0.73 160 TooManyTo_004 2226 0.62 0.40 0.73 161 FROM_GOV_DKIM_AU 2198 0.50 0.02 0.72 162 XMSexyCombo_01 2151 1.03 1.72 0.70 163 XM_B_COVIDMETA 2090 0.98 1.63 0.68 164 NML_ADSP_CUSTOM_MED 2083 0.65 0.59 0.68 165 T_XMDrugObfuBody_00 2061 0.83 1.17 0.67 166 RELAYCOUNTRY_GB 1990 0.62 0.55 0.65 167 HTML_TAG_BALANCE_BODY 1924 0.69 0.81 0.63 168 TooManyTo_005 1917 0.54 0.37 0.62 169 XM_B_COPY_HTML 1796 0.60 0.63 0.58 170 HTTPS_HTTP_MISMATCH 1792 0.69 0.91 0.58 171 XMOemUri 1765 0.49 0.31 0.57 172 FORGED_GMAIL_RCVD 1734 0.82 1.35 0.56 173 HELO_NO_DOMAIN 1684 0.48 0.33 0.55 174 HELO_NODOT 1684 0.48 0.33 0.55 175 XMGenDplmaNmb 1672 0.74 1.17 0.54 176 T_XMHurry_00 1660 1.01 2.02 0.54 177 XM_Lotto 1656 0.49 0.37 0.54 178 HTML_IMAGE_ONLY_20 1644 0.43 0.20 0.54 179 TR_MetaPhish_Combo_01 1641 0.52 0.48 0.53 180 USER_IN_WELCOMELIST 1633 0.36 0.00 0.53 181 USER_IN_WHITELIST 1633 0.36 0.00 0.53 182 PLING_QUERY 1568 0.54 0.61 0.51 183 XMPhish30 1536 0.67 1.05 0.50 184 SHOPIFY_IMG_NOT_RCVD_SFY 1525 0.48 0.45 0.50 185 T_FILL_THIS_FORM_SHORT 1513 1.48 3.59 0.49 186 XMSubMetaSxObfu_02 1498 0.45 0.38 0.49 187 XM_B_REG_HTML 1483 0.53 0.64 0.48 188 DIET_1 1448 0.64 0.99 0.47 189 XM_H_PHPMailer 1422 0.49 0.54 0.46 190 MISSING_HEADERS 1420 0.39 0.22 0.46 191 SpammyFromTLD_01 1419 1.57 3.94 0.46 192 XMBody_78 1321 0.50 0.65 0.43 193 XM_Ancestry_Forge 1294 0.29 0.00 0.42 194 TR_BOTNET_NEGATE 1230 0.48 0.66 0.40 195 MPART_ALT_DIFF_COUNT 1212 0.44 0.55 0.39 196 XM_Body_Dirty_Words_01 1199 0.53 0.83 0.39 197 TVD_SPACE_RATIO_MINFP 1157 0.35 0.30 0.38 198 XMCapTrack 1147 0.32 0.19 0.37 199 DKIM_ADSP_NXDOMAIN 1113 0.36 0.34 0.36 200 XMNoVowels 1113 0.52 0.86 0.36 ----------------------------------------------------------------------