Email: 268824 Autolearn: 0 AvgScore: 2.34 AvgScanTime: 1.35 sec Spam: 68002 Autolearn: 0 AvgScore: 13.75 AvgScanTime: 1.52 sec Ham: 200822 Autolearn: 0 AvgScore: -1.52 AvgScanTime: 1.29 sec Time Spent Running SA: 101.03 hours Time Spent Processing Spam: 28.80 hours Time Spent Processing Ham: 72.23 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 64362 86.87 94.65 84.24 2 DKIM_SIGNED 60426 79.80 88.86 76.74 3 XM_DK_Pass 58909 78.27 86.63 75.44 4 DKIM_VALID 57619 76.60 84.73 73.85 5 RELAYCOUNTRY_US 54797 80.98 80.58 81.11 6 XM_B_Unicode 54073 73.68 79.52 71.70 7 DCC_CHECK 51234 53.75 75.34 46.44 8 XMListUnsubscribeExists 49739 57.83 73.14 52.64 9 XM_B_SpammyWords 49399 52.86 72.64 46.16 10 DKIM_VALID_AU 42948 60.31 63.16 59.35 11 XM_B_Unicode3 31912 46.45 46.93 46.29 12 XM_DK_Undo_02 30755 19.20 45.23 10.39 13 XM_B_SpammyWords2 27681 25.09 40.71 19.80 14 BAYES_50 27374 48.87 40.25 51.79 15 HTML_FONT_LOW_CONTRAST 26162 31.87 38.47 29.64 16 TR_XM_DKIM_Undo 25228 15.04 37.10 7.56 17 LOC_TINY_FONT_1 24794 31.32 36.46 29.58 18 BAYES_99 22550 15.60 33.16 9.66 19 DKIM_VALID_EF 22448 28.53 33.01 27.02 20 MIME_HTML_ONLY 19191 25.72 28.22 24.87 21 FVGT_m_MULTI_ODD 19120 24.20 28.12 22.88 22 BAYES_999 17491 12.66 25.72 8.23 23 TR_DCC_Bayes_99 17210 9.69 25.31 4.40 24 DCC_CHECK_NEGATIVE 16749 46.23 24.63 53.54 25 RCVD_IN_MSPIKE_WL 16545 30.42 24.33 32.48 26 RCVD_IN_MSPIKE_H2 15580 20.03 22.91 19.05 27 T_KAM_HTML_FONT_INVALID 15168 18.24 22.31 16.86 28 XMSubLong 14887 21.62 21.89 21.53 29 XM_Body_Dirty_Words 14868 15.01 21.86 12.68 30 T_TM2_M_HEADER_IN_MSG 14365 21.33 21.12 21.41 31 RELAYCOUNTRY_META 13512 7.16 19.87 2.86 32 XM_Multi_Part_URI 12584 14.72 18.51 13.43 33 BOTNET_IPINHOSTNAME 11304 8.71 16.62 6.02 34 UNPARSEABLE_RELAY 10223 10.51 15.03 8.98 35 TR_XM_SpammyRelay 9893 4.77 14.55 1.46 36 TR_XM_UnparsRelay 9769 8.74 14.37 6.83 37 XM_B_Unsub 9638 12.42 14.17 11.83 38 RCVD_IN_MSPIKE_H3 9174 14.81 13.49 15.25 39 XM_UncommonTLD01 9115 6.52 13.40 4.19 40 BOTNET 8858 4.54 13.03 1.67 41 TR_XM_SpammyWords2 8672 4.84 12.75 2.16 42 LOTS_OF_MONEY 8557 9.37 12.58 8.28 43 XM_B_SpammyWords3 8541 6.35 12.56 4.25 44 FSL_BULK_SIG 7715 10.81 11.35 10.63 45 RCVD_IN_BL_SPAMCOP_NET 7615 3.56 11.20 0.97 46 XM_SendGrid 7449 8.77 10.95 8.03 47 TR_XM_SpammyWords4 7340 6.51 10.79 5.06 48 RCVD_IN_MSPIKE_H4 7005 13.30 10.30 14.32 49 UNTRUSTED_Relay 6879 3.32 10.12 1.02 50 HTML_IMAGE_RATIO_02 6664 8.32 9.80 7.83 51 XMSexyCombo_05 6513 6.22 9.58 5.08 52 TooManyTo_001 5850 6.82 8.60 6.22 53 BAYES_80 5770 5.51 8.49 4.51 54 MPART_ALT_DIFF 5470 5.69 8.04 4.90 55 RELAYCOUNTRY_CA 5288 2.58 7.78 0.82 56 XM_Evil_Numbers_Gen 5166 9.77 7.60 10.50 57 SpammyFromTLD_02 4867 1.96 7.16 0.20 58 BAYES_60 4857 9.45 7.14 10.23 59 XM_B_SpammyTLD 4756 3.11 6.99 1.79 60 XMSubMetaSx_00 4636 4.78 6.82 4.09 61 XMNumbers 4498 4.78 6.61 4.16 62 MIME_HTML_MOSTLY 4400 3.36 6.47 2.31 63 TR_XM_SpammyWords5 4176 3.01 6.14 1.95 64 TR_XM_DK_SendGrid 4172 5.50 6.14 5.28 65 LotsOfNums_01 4166 8.36 6.13 9.12 66 TR_XM_SPAMCOP 4133 1.80 6.08 0.35 67 TR_XM_PhishingBody 3943 3.81 5.80 3.14 68 XM_H_Long_From01 3886 5.31 5.71 5.17 69 XMStrtUSub 3594 5.67 5.29 5.80 70 XM_B_Phish_Phrases 3577 4.04 5.26 3.62 71 XM_UB50 3488 1.79 5.13 0.66 72 PDS_OTHER_BAD_TLD 3332 1.52 4.90 0.37 73 URIBL_DBL_SPAM 3281 1.25 4.82 0.04 74 BAYES_95 3110 3.31 4.57 2.88 75 HTML_IMAGE_RATIO_04 3022 5.62 4.44 6.02 76 DKIM_INVALID 2807 3.20 4.13 2.89 77 XM_SPF_SoftFail 2722 1.82 4.00 1.08 78 XM_B_Investor 2677 1.85 3.94 1.15 79 SpammyFromTLD_01 2638 1.27 3.88 0.39 80 MIME_HTML_ONLY_MULTI 2546 3.47 3.74 3.37 81 TR_XM_PHPDW 2498 1.17 3.67 0.32 82 HTML_MIME_NO_HTML_TAG 2489 2.73 3.66 2.41 83 TM2_M_URI_OPT_OUT 2393 3.74 3.52 3.81 84 TR_XM_PHPForged 2368 1.09 3.48 0.28 85 FROM_SUSPICIOUS_NTLD 2340 0.93 3.44 0.07 86 TR_Symld_Words 2339 2.48 3.44 2.16 87 TR_XM_FormFill2 2338 1.08 3.44 0.28 88 XM_H_PHPOS 2328 1.07 3.42 0.27 89 T_FILL_THIS_FORM_SHORT 2322 1.48 3.41 0.82 90 FROM_SUSPICIOUS_NTLD_FP 2318 0.91 3.41 0.07 91 RCVD_IN_MSPIKE_BL 2183 0.88 3.21 0.10 92 XM_B_Phish66 2163 1.52 3.18 0.96 93 TR_XM_NoHeaderRelay 2149 0.90 3.16 0.13 94 URI_NOVOWEL 2149 2.54 3.16 2.34 95 TR_XM_MSPIKECOMBO 2143 0.87 3.15 0.09 96 RCVD_IN_MSPIKE_L3 2142 0.87 3.15 0.09 97 RCVD_IN_RP_RNBL 2141 0.83 3.15 0.04 98 HTML_IMAGE_RATIO_06 2111 3.21 3.10 3.25 99 T_XMDrugObfuBody_14 2076 3.46 3.05 3.60 100 XM_OfRef6 2016 1.59 2.96 1.12 101 DATE_IN_PAST_12_24 1998 0.75 2.94 0.01 102 RCVD_IN_RP_SAFE 1978 8.37 2.91 10.22 103 T_XMDrugObfuBody_08 1953 1.44 2.87 0.96 104 XM_GoogleGroups 1897 2.06 2.79 1.81 105 XM_CamelCaseFrm001 1842 2.20 2.71 2.02 106 T_TooManySym_01 1836 6.30 2.70 7.52 107 T_REMOTE_IMAGE 1817 3.89 2.67 4.30 108 XM_H_TOP 1809 0.67 2.66 0.00 109 TM2_M_VERY_LONG_WORD 1796 1.58 2.64 1.22 110 RCVD_IN_VALIDITY_RPBL 1778 0.68 2.61 0.03 111 XMBody_17 1739 1.09 2.56 0.60 112 HTML_IMAGE_ONLY_20 1722 1.91 2.53 1.70 113 KHOP_HELO_FCRDNS 1712 1.26 2.52 0.84 114 XM_DIRTYINTL 1709 0.79 2.51 0.21 115 BAYES_40 1692 4.04 2.49 4.56 116 TR_M_TOP_BAYES 1676 0.62 2.46 0.00 117 MIME_QP_LONG_LINE 1628 4.24 2.39 4.87 118 HTML_IMAGE_RATIO_08 1541 2.54 2.27 2.64 119 BOTNET_NORDNS 1515 0.57 2.23 0.01 120 HTML_TITLE_SUBJ_DIFF 1483 1.11 2.18 0.74 121 XMBrknScrpt_02 1460 1.45 2.15 1.22 122 MAILING_LIST_MULTI 1457 2.38 2.14 2.46 123 HTML_SHORT_LINK_IMG_3 1447 1.12 2.13 0.78 124 XM_DK_Undo_01 1397 1.61 2.05 1.46 125 RELAYCOUNTRY_IN 1395 0.55 2.05 0.05 126 TR_XM_SpammyWords3 1387 0.54 2.04 0.03 127 XM_B_SpammyWords4 1374 1.09 2.02 0.78 128 TR_XM_BayesRelay 1335 0.50 1.96 0.01 129 TR_XM_FormFill 1325 0.50 1.95 0.01 130 ALL_TRUSTED 1290 13.05 1.90 16.83 131 XM_UB99 1283 0.48 1.89 0.00 132 RCVD_IN_IADB_LISTED 1261 3.90 1.85 4.60 133 XMDiploma_00 1256 1.23 1.85 1.02 134 XMSexyCombo_01 1256 0.93 1.85 0.62 135 TR_XM_SB_Phish 1248 1.99 1.84 2.04 136 XM_B_Unsub2 1245 1.34 1.83 1.18 137 FROM_EXCESS_BASE64 1245 3.59 1.83 4.18 138 XMSubPhish11 1219 1.96 1.79 2.02 139 URI_HEX 1188 1.46 1.75 1.36 140 RDNS_DYNAMIC 1185 0.97 1.74 0.70 141 RCVD_IN_RP_CERTIFIED 1167 7.28 1.72 9.16 142 USER_IN_DEF_DKIM_WL 1167 13.33 1.72 17.27 143 URI_PHP_REDIR 1133 0.45 1.67 0.03 144 RELAYCOUNTRY_FR 1122 0.56 1.65 0.19 145 XM_B_COVIDMETA 1117 0.95 1.64 0.71 146 SUBJ_ALL_CAPS 1114 1.48 1.64 1.43 147 BAYES_20 1111 2.45 1.63 2.73 148 RCVD_IN_IADB_SPF 1059 3.44 1.56 4.07 149 JH_SPAMMY_HEADERS 1046 0.39 1.54 0.00 150 T_XMDrugObfuBody_00 1018 0.96 1.50 0.78 151 XM_URI_RBL 1013 0.51 1.49 0.18 152 RCVD_IN_IADB_DK 1012 3.09 1.49 3.63 153 RCVD_IN_IADB_SENDERID 993 3.16 1.46 3.74 154 XMStockSpam_06 968 1.74 1.42 1.85 155 HTML_FONT_FACE_BAD 967 1.08 1.42 0.97 156 XM_UB999 963 0.36 1.42 0.00 157 XM_H_PHPMailer 944 0.71 1.39 0.48 158 HK_RANDOM_REPLYTO 908 0.41 1.34 0.10 159 XM_Body_Dirty_Words_01 906 0.49 1.33 0.20 160 URIBL_BLACK 899 0.34 1.32 0.01 161 RELAYCOUNTRY_AU 861 0.51 1.27 0.25 162 TR_Mismatch_TLD_02 860 0.37 1.26 0.07 163 HTML_IMAGE_ONLY_16 859 0.52 1.26 0.27 164 XMSubNoVowel 856 1.54 1.26 1.64 165 T_XMHurry_00 848 0.67 1.25 0.47 166 DIET_1 846 0.74 1.24 0.56 167 MIME_CHARSET_FARAWAY 842 0.47 1.24 0.21 168 BAYES_00 841 9.14 1.24 11.81 169 SUBJ_DOLLARS 835 0.57 1.23 0.35 170 XMPhish30 833 0.82 1.22 0.68 171 RCVD_IN_VALIDITY_SAFE 831 6.96 1.22 8.90 172 RCVD_IN_PSBL 822 0.33 1.21 0.03 173 TR_XM_COVIDMETA1 818 0.70 1.20 0.53 174 TR_XM_INV_DKIM 812 0.71 1.19 0.54 175 TVD_RCVD_IP 800 2.06 1.18 2.36 176 XM_H_Undi_Recip 798 0.39 1.17 0.12 177 TR_LOTS_OF_MONEY3 796 0.54 1.17 0.33 178 TR_Mismatch_TLD_01 786 0.52 1.16 0.31 179 LOADSA_MONEY_COMBO 761 0.33 1.12 0.06 180 XM_UB60 760 0.32 1.12 0.05 181 TR_XM_COVIDMETA4 737 0.36 1.08 0.12 182 XM_ProductURIs 736 0.93 1.08 0.87 183 TR_BOTNET_NEGATE 736 0.52 1.08 0.33 184 XMNoVowels 728 0.62 1.07 0.47 185 DKIM_ADSP_CUSTOM_MED 721 0.90 1.06 0.84 186 XMHTML_After_End 719 0.75 1.06 0.65 187 SHOPIFY_IMG_NOT_RCVD_SFY 716 0.42 1.05 0.21 188 MISSING_HEADERS 709 0.44 1.04 0.24 189 XMSolicitRefs_0 707 0.46 1.04 0.27 190 XMSlimDrugH 691 0.48 1.02 0.30 191 XMGenDplmaNmb 690 0.67 1.01 0.55 192 XMMoneyMeta_00 683 0.62 1.00 0.50 193 XMBdyGiftCard01 674 1.29 0.99 1.39 194 HTTPS_HTTP_MISMATCH 666 0.64 0.98 0.53 195 XM_H_PHPOS_M 652 0.33 0.96 0.11 196 XMReplyNow 643 0.30 0.95 0.08 197 BAYES_05 629 1.59 0.92 1.82 198 URI_TRY_3LD 624 1.18 0.92 1.27 199 FORGED_GMAIL_RCVD 622 0.61 0.91 0.50 200 XM_ShortIntro_01 619 0.45 0.91 0.29 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 169167 86.87 94.65 84.24 2 RELAYCOUNTRY_US 162896 80.98 80.58 81.11 3 DKIM_SIGNED 154101 79.80 88.86 76.74 4 XM_DK_Pass 151492 78.27 86.63 75.44 5 DKIM_VALID 148299 76.60 84.73 73.85 6 XM_B_Unicode 143988 73.68 79.52 71.70 7 DKIM_VALID_AU 119193 60.31 63.16 59.35 8 DCC_CHECK_NEGATIVE 107518 46.23 24.63 53.54 9 XMListUnsubscribeExists 105716 57.83 73.14 52.64 10 BAYES_50 104010 48.87 40.25 51.79 11 DCC_CHECK 93260 53.75 75.34 46.44 12 XM_B_Unicode3 92954 46.45 46.93 46.29 13 XM_B_SpammyWords 92694 52.86 72.64 46.16 14 RCVD_IN_MSPIKE_WL 65222 30.42 24.33 32.48 15 HTML_FONT_LOW_CONTRAST 59521 31.87 38.47 29.64 16 LOC_TINY_FONT_1 59403 31.32 36.46 29.58 17 DKIM_VALID_EF 54258 28.53 33.01 27.02 18 MIME_HTML_ONLY 49941 25.72 28.22 24.87 19 FVGT_m_MULTI_ODD 45947 24.20 28.12 22.88 20 XMSubLong 43239 21.62 21.89 21.53 21 T_TM2_M_HEADER_IN_MSG 42987 21.33 21.12 21.41 22 XM_B_SpammyWords2 39770 25.09 40.71 19.80 23 RCVD_IN_MSPIKE_H2 38254 20.03 22.91 19.05 24 USER_IN_DEF_DKIM_WL 34679 13.33 1.72 17.27 25 T_KAM_HTML_FONT_INVALID 33868 18.24 22.31 16.86 26 ALL_TRUSTED 33791 13.05 1.90 16.83 27 RCVD_IN_MSPIKE_H3 30628 14.81 13.49 15.25 28 RCVD_IN_MSPIKE_H4 28751 13.30 10.30 14.32 29 XM_Multi_Part_URI 26975 14.72 18.51 13.43 30 XM_Body_Dirty_Words 25470 15.01 21.86 12.68 31 XM_B_Unsub 23756 12.42 14.17 11.83 32 BAYES_00 23718 9.14 1.24 11.81 33 XM_DKIMWhitelistDomains 22817 8.49 0.02 11.36 34 FSL_BULK_SIG 21345 10.81 11.35 10.63 35 XM_Evil_Numbers_Gen 21095 9.77 7.60 10.50 36 XM_DK_Undo_02 20871 19.20 45.23 10.39 37 BAYES_60 20547 9.45 7.14 10.23 38 RCVD_IN_RP_SAFE 20529 8.37 2.91 10.22 39 BAYES_99 19399 15.60 33.16 9.66 40 RCVD_IN_RP_CERTIFIED 18396 7.28 1.72 9.16 41 LotsOfNums_01 18320 8.36 6.13 9.12 42 UNPARSEABLE_RELAY 18032 10.51 15.03 8.98 43 RCVD_IN_VALIDITY_SAFE 17867 6.96 1.22 8.90 44 TR_XM_DK_Bayes 16674 6.41 0.84 8.30 45 LOTS_OF_MONEY 16620 9.37 12.58 8.28 46 BAYES_999 16536 12.66 25.72 8.23 47 TR_XM_DK_Bayes1 16382 6.30 0.82 8.16 48 XM_SendGrid 16116 8.77 10.95 8.03 49 RCVD_IN_VALIDITY_CERTIFIED 16027 6.04 0.32 7.98 50 HTML_IMAGE_RATIO_02 15715 8.32 9.80 7.83 51 TR_XM_DKIM_Undo 15192 15.04 37.10 7.56 52 T_TooManySym_01 15104 6.30 2.70 7.52 53 TR_XM_DK_Bayes2 14691 5.66 0.75 7.32 54 TR_XM_UnparsRelay 13724 8.74 14.37 6.83 55 TooManyTo_001 12488 6.82 8.60 6.22 56 BOTNET_IPINHOSTNAME 12098 8.71 16.62 6.02 57 HTML_IMAGE_RATIO_04 12095 5.62 4.44 6.02 58 XMStrtUSub 11655 5.67 5.29 5.80 59 TR_XM_DK_SendGrid 10602 5.50 6.14 5.28 60 XM_H_Long_From01 10392 5.31 5.71 5.17 61 XMSexyCombo_05 10203 6.22 9.58 5.08 62 TR_XM_SpammyWords4 10171 6.51 10.79 5.06 63 MPART_ALT_DIFF 9838 5.69 8.04 4.90 64 MIME_QP_LONG_LINE 9773 4.24 2.39 4.87 65 RCVD_IN_IADB_LISTED 9232 3.90 1.85 4.60 66 BAYES_40 9166 4.04 2.49 4.56 67 BAYES_80 9050 5.51 8.49 4.51 68 T_TooManySym_02 8905 3.44 0.49 4.43 69 TR_DCC_Bayes_99 8839 9.69 25.31 4.40 70 T_REMOTE_IMAGE 8639 3.89 2.67 4.30 71 XM_B_SpammyWords3 8535 6.35 12.56 4.25 72 XM_UncommonTLD01 8412 6.52 13.40 4.19 73 FROM_EXCESS_BASE64 8395 3.59 1.83 4.18 74 XMNumbers 8354 4.78 6.61 4.16 75 XMSubMetaSx_00 8221 4.78 6.82 4.09 76 RCVD_IN_IADB_SPF 8180 3.44 1.56 4.07 77 ANY_BOUNCE_MESSAGE 7767 3.05 0.63 3.87 78 BOUNCE_MESSAGE 7766 3.05 0.63 3.87 79 TM2_M_URI_OPT_OUT 7653 3.74 3.52 3.81 80 RCVD_IN_IADB_SENDERID 7504 3.16 1.46 3.74 81 RCVD_IN_IADB_DK 7292 3.09 1.49 3.63 82 XM_B_Phish_Phrases 7275 4.04 5.26 3.62 83 T_XMDrugObfuBody_14 7237 3.46 3.05 3.60 84 XM_H_Trusted_IP 7071 2.63 0.00 3.52 85 MIME_HTML_ONLY_MULTI 6776 3.47 3.74 3.37 86 HTML_IMAGE_RATIO_06 6528 3.21 3.10 3.25 87 INVALID_MSGID 6444 2.45 0.23 3.21 88 TR_XM_PhishingBody 6308 3.81 5.80 3.14 89 MSGID_NOFQDN1 6072 2.27 0.06 3.02 90 TO_MALFORMED 5962 2.24 0.09 2.97 91 RCVD_IN_MSPIKE_H5 5843 2.31 0.54 2.91 92 DKIM_INVALID 5802 3.20 4.13 2.89 93 BAYES_95 5791 3.31 4.57 2.88 94 RELAYCOUNTRY_META 5746 7.16 19.87 2.86 95 BAYES_20 5488 2.45 1.63 2.73 96 HTML_IMAGE_RATIO_08 5296 2.54 2.27 2.64 97 XM_PDF 5110 2.01 0.43 2.54 98 RCVD_IN_IADB_VOUCHED 5095 2.11 0.86 2.54 99 MAILING_LIST_MULTI 4940 2.38 2.14 2.46 100 HTML_MIME_NO_HTML_TAG 4841 2.73 3.66 2.41 101 TVD_RCVD_IP 4747 2.06 1.18 2.36 102 URI_NOVOWEL 4692 2.54 3.16 2.34 103 MIME_HTML_MOSTLY 4637 3.36 6.47 2.31 104 IN_HORDE_ADDRESS_BOOK 4490 1.68 0.05 2.24 105 TR_XM_SpammyWords2 4342 4.84 12.75 2.16 106 TR_Symld_Words 4329 2.48 3.44 2.16 107 TR_XM_SB_Phish 4089 1.99 1.84 2.04 108 XM_CamelCaseFrm001 4061 2.20 2.71 2.02 109 XMSubPhish11 4047 1.96 1.79 2.02 110 TR_XM_SpammyWords5 3916 3.01 6.14 1.95 111 XMStockSpam_06 3712 1.74 1.42 1.85 112 BAYES_05 3650 1.59 0.92 1.82 113 XM_GoogleGroups 3642 2.06 2.79 1.81 114 XM_B_SpammyTLD 3595 3.11 6.99 1.79 115 XMBSHREFv2 3526 1.35 0.16 1.76 116 HTML_IMAGE_ONLY_20 3408 1.91 2.53 1.70 117 BOTNET 3344 4.54 13.03 1.67 118 XMSubNoVowel 3286 1.54 1.26 1.64 119 RCVD_IN_IADB_OPTIN 3252 1.39 0.71 1.62 120 XMGappySubj_01 2978 1.19 0.34 1.48 121 XM_DK_Undo_01 2932 1.61 2.05 1.46 122 TR_XM_SpammyRelay 2930 4.77 14.55 1.46 123 SUBJ_ALL_CAPS 2876 1.48 1.64 1.43 124 XMBdyGiftCard01 2791 1.29 0.99 1.39 125 URI_HEX 2741 1.46 1.75 1.36 126 TVD_SPACE_RATIO 2738 1.04 0.09 1.36 127 URI_TRY_3LD 2544 1.18 0.92 1.27 128 TM2_M_VERY_LONG_WORD 2452 1.58 2.64 1.22 129 XMBrknScrpt_02 2448 1.45 2.15 1.22 130 XM_B_Unsub2 2362 1.34 1.83 1.18 131 XM_B_Investor 2302 1.85 3.94 1.15 132 XM_OfRef6 2250 1.59 2.96 1.12 133 XMBody_95 2231 0.87 0.16 1.11 134 TooManyTo_002 2223 0.97 0.58 1.11 135 XM_SPF_SoftFail 2160 1.82 4.00 1.08 136 T_TooManySym_03 2157 0.86 0.22 1.07 137 XM_H_Long_From02 2101 1.00 0.86 1.05 138 UNTRUSTED_Relay 2055 3.32 10.12 1.02 139 XMDiploma_00 2048 1.23 1.85 1.02 140 RCVD_IN_BL_SPAMCOP_NET 1952 3.56 11.20 0.97 141 HTML_FONT_FACE_BAD 1941 1.08 1.42 0.97 142 XM_B_Phish66 1926 1.52 3.18 0.96 143 T_XMDrugObfuBody_08 1923 1.44 2.87 0.96 144 XM_ProductURIs 1755 0.93 1.08 0.87 145 T_MANY_PILL_PRICE 1746 0.65 0.00 0.87 146 XMPhish14 1703 0.78 0.60 0.85 147 KHOP_HELO_FCRDNS 1687 1.26 2.52 0.84 148 TM2_M_A_HREF_HREF 1687 0.76 0.51 0.84 149 DKIM_ADSP_CUSTOM_MED 1685 0.90 1.06 0.84 150 RELAYCOUNTRY_CA 1648 2.58 7.78 0.82 151 T_FILL_THIS_FORM_SHORT 1645 1.48 3.41 0.82 152 TVD_SPACE_RATIO_MINFP 1637 0.73 0.49 0.82 153 XM_B_SpammyWords4 1566 1.09 2.02 0.78 154 T_XMDrugObfuBody_00 1559 0.96 1.50 0.78 155 HTML_SHORT_LINK_IMG_3 1557 1.12 2.13 0.78 156 TooManyTo_003 1549 0.69 0.47 0.77 157 TR_MetaPhish_Combo_01 1506 0.76 0.78 0.75 158 HTML_TITLE_SUBJ_DIFF 1491 1.11 2.18 0.74 159 USER_IN_WELCOMELIST 1470 0.55 0.00 0.73 160 USER_IN_WHITELIST 1470 0.55 0.00 0.73 161 XM_B_COPY_HTML 1433 0.75 0.88 0.71 162 XM_B_COVIDMETA 1425 0.95 1.64 0.71 163 XM_RXBody 1420 0.68 0.58 0.71 164 RDNS_DYNAMIC 1411 0.97 1.74 0.70 165 XM_B_REG_HTML 1385 0.58 0.26 0.69 166 XM_D_tchamptons_WL 1366 0.51 0.00 0.68 167 XMPhish30 1365 0.82 1.22 0.68 168 XMHTMLBadTable_001 1342 0.68 0.71 0.67 169 IN_ZIMBRA_NJ_WHITELIST 1339 0.50 0.01 0.67 170 XM_UB50 1322 1.79 5.13 0.66 171 XMHTML_After_End 1296 0.75 1.06 0.65 172 TR_MSPIKEBAYES00 1266 0.48 0.02 0.63 173 NUMERIC_HTTP_ADDR 1244 0.59 0.49 0.62 174 XMSexyCombo_01 1239 0.93 1.85 0.62 175 XMPhish08 1217 0.64 0.73 0.61 176 XMBody_17 1204 1.09 2.56 0.60 177 TooManyTo_004 1166 0.54 0.42 0.58 178 DIET_1 1132 0.74 1.24 0.56 179 XMSubMetaSxObfu_02 1131 0.55 0.52 0.56 180 XMGenDplmaNmb 1108 0.67 1.01 0.55 181 TR_XM_INV_DKIM 1089 0.71 1.19 0.54 182 TR_XM_COVIDMETA1 1072 0.70 1.20 0.53 183 HTTPS_HTTP_MISMATCH 1055 0.64 0.98 0.53 184 XM_B_DNDMA 1049 0.54 0.58 0.52 185 DATE_IN_PAST_03_06 1047 0.53 0.55 0.52 186 DKIM_ADSP_NXDOMAIN 1037 0.60 0.85 0.52 187 XMLngstWrd_00 1025 0.59 0.84 0.51 188 XMCapTrack 1022 0.45 0.28 0.51 189 NML_ADSP_CUSTOM_MED 1018 0.59 0.83 0.51 190 FORGED_GMAIL_RCVD 1012 0.61 0.91 0.50 191 XMMoneyMeta_00 995 0.62 1.00 0.50 192 RELAYCOUNTRY_GB 984 0.54 0.67 0.49 193 HELO_NODOT 965 0.53 0.69 0.48 194 HELO_NO_DOMAIN 965 0.53 0.69 0.48 195 HTML_TAG_BALANCE_BODY 959 0.57 0.83 0.48 196 MPART_ALT_DIFF_COUNT 957 0.51 0.61 0.48 197 XM_H_PHPMailer 955 0.71 1.39 0.48 198 T_XMHurry_00 941 0.67 1.25 0.47 199 T_TooManySym_04 940 0.37 0.09 0.47 200 XMNoVowels 938 0.62 1.07 0.47 ----------------------------------------------------------------------