Email: 276122 Autolearn: 0 AvgScore: 2.27 AvgScanTime: 1.41 sec Spam: 71888 Autolearn: 0 AvgScore: 13.82 AvgScanTime: 1.57 sec Ham: 204234 Autolearn: 0 AvgScore: -1.80 AvgScanTime: 1.35 sec Time Spent Running SA: 108.07 hours Time Spent Processing Spam: 31.40 hours Time Spent Processing Ham: 76.67 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 66582 85.14 92.62 82.51 2 DKIM_SIGNED 60361 76.51 83.97 73.89 3 XM_DK_Pass 58365 74.67 81.19 72.38 4 DKIM_VALID 57222 73.08 79.60 70.79 5 RELAYCOUNTRY_US 53735 77.52 74.75 78.50 6 XM_B_Unicode 53441 69.30 74.34 67.53 7 XMListUnsubscribeExists 49633 54.62 69.04 49.54 8 DCC_CHECK 49334 49.47 68.63 42.73 9 XM_B_SpammyWords 45881 49.12 63.82 43.94 10 DKIM_VALID_AU 44561 59.40 61.99 58.49 11 XM_DK_Undo_02 31781 17.81 44.21 8.52 12 XM_B_Unicode3 30126 42.56 41.91 42.79 13 BAYES_50 30086 50.03 41.85 52.91 14 LOC_TINY_FONT_1 25513 29.56 35.49 27.48 15 XM_B_SpammyWords2 25443 22.91 35.39 18.52 16 TR_XM_DKIM_Undo 25216 13.98 35.08 6.56 17 BAYES_99 24140 13.83 33.58 6.87 18 HTML_FONT_LOW_CONTRAST 23231 31.01 32.32 30.55 19 MIME_HTML_ONLY 23206 26.06 32.28 23.86 20 DCC_CHECK_NEGATIVE 22529 50.50 31.34 57.24 21 FVGT_m_MULTI_ODD 21132 25.14 29.40 23.64 22 DKIM_VALID_EF 20162 27.41 28.05 27.19 23 BAYES_999 19327 11.22 26.88 5.71 24 RCVD_IN_MSPIKE_H2 17865 20.54 24.85 19.02 25 T_KAM_HTML_FONT_INVALID 17448 18.26 24.27 16.15 26 TR_DCC_Bayes_99 17400 8.67 24.20 3.20 27 RELAYCOUNTRY_META 17117 8.42 23.81 3.00 28 RCVD_IN_MSPIKE_WL 15970 29.43 22.22 31.97 29 XM_Body_Dirty_Words 15492 14.77 21.55 12.38 30 XM_Multi_Part_URI 14608 15.87 20.32 14.30 31 XMSubLong 13193 20.78 18.35 21.63 32 T_TM2_M_HEADER_IN_MSG 12416 21.67 17.27 23.22 33 BOTNET 10860 5.00 15.11 1.44 34 RCVD_IN_MSPIKE_H3 10336 15.30 14.38 15.62 35 UNTRUSTED_Relay 10269 4.63 14.28 1.23 36 UNPARSEABLE_RELAY 9866 10.36 13.72 9.17 37 TR_XM_UnparsRelay 9729 9.07 13.53 7.50 38 BOTNET_IPINHOSTNAME 9169 7.31 12.75 5.39 39 TR_XM_SpammyRelay 8891 4.17 12.37 1.29 40 XM_UncommonTLD01 8759 6.25 12.18 4.17 41 TR_XM_SpammyWords2 8542 4.61 11.88 2.06 42 XM_B_SpammyWords3 8536 6.29 11.87 4.32 43 XM_B_Unsub 8478 12.15 11.79 12.27 44 MPART_ALT_DIFF 8402 8.09 11.69 6.82 45 LOTS_OF_MONEY 7907 7.90 11.00 6.82 46 FSL_BULK_SIG 7788 9.74 10.83 9.36 47 RCVD_IN_BL_SPAMCOP_NET 7172 3.55 9.98 1.28 48 HTML_IMAGE_RATIO_02 7089 8.58 9.86 8.14 49 TR_XM_SpammyWords4 6994 5.65 9.73 4.22 50 XMSexyCombo_05 6792 5.52 9.45 4.14 51 XM_SendGrid 6789 8.11 9.44 7.64 52 HTML_MIME_NO_HTML_TAG 6384 3.92 8.88 2.17 53 XM_Evil_Numbers_Gen 5815 9.41 8.09 9.87 54 RCVD_IN_MSPIKE_H4 5335 11.95 7.42 13.54 55 MIME_HTML_ONLY_MULTI 5290 5.10 7.36 4.30 56 XM_SPF_SoftFail 5004 2.81 6.96 1.35 57 BAYES_80 5001 5.32 6.96 4.74 58 TooManyTo_001 4955 7.68 6.89 7.96 59 RELAYCOUNTRY_CA 4829 2.35 6.72 0.81 60 BAYES_60 4793 9.81 6.67 10.91 61 XMNumbers 4765 5.60 6.63 5.24 62 XM_UB50 4764 2.24 6.63 0.69 63 MIME_HTML_MOSTLY 4664 3.83 6.49 2.89 64 TR_XM_SPAMCOP 4442 1.81 6.18 0.27 65 TR_XM_DK_SendGrid 4383 5.36 6.10 5.09 66 XM_B_Phish_Phrases 4360 3.97 6.06 3.23 67 XMSubMetaSx_00 4260 4.70 5.93 4.26 68 RCVD_IN_VALIDITY_SAFE 4178 7.60 5.81 8.23 69 LotsOfNums_01 4162 7.88 5.79 8.61 70 TM2_M_VERY_LONG_WORD 4064 2.76 5.65 1.74 71 XM_GoogleGroups 4062 2.74 5.65 1.72 72 TR_XM_PhishingBody 4038 3.33 5.62 2.52 73 RCVD_IN_MSPIKE_BL 3969 2.15 5.52 0.96 74 TR_XM_MSPIKECOMBO 3965 2.14 5.52 0.96 75 XM_H_Long_From01 3598 5.30 5.01 5.41 76 SpammyFromTLD_02 3477 1.38 4.84 0.16 77 HTML_IMAGE_RATIO_04 3376 6.22 4.70 6.76 78 XMLngstWrd_00 3299 2.05 4.59 1.15 79 GOOG_STO_IMG_HTML 3299 1.20 4.59 0.01 80 BAYES_95 3269 3.25 4.55 2.80 81 XMLngstWrd_01 3268 1.98 4.55 1.08 82 XMLngstWrd_02 3237 1.89 4.50 0.97 83 XMLngstWrd_03 3214 1.80 4.47 0.85 84 TM2_M_URI_OPT_OUT 3209 5.08 4.46 5.30 85 XMLngstWrd_04 3190 1.75 4.44 0.81 86 DKIM_INVALID 3139 3.43 4.37 3.10 87 ALL_TRUSTED 3135 15.31 4.36 19.16 88 RCVD_IN_VALIDITY_CERTIFIED 3106 6.41 4.32 7.15 89 XM_B_Investor 3072 2.19 4.27 1.45 90 TR_XM_SpammyWords5 2996 2.05 4.17 1.30 91 FROM_MISSP_REPLYTO 2923 1.08 4.07 0.02 92 XMStrtUSub 2882 6.27 4.01 7.06 93 HTML_TITLE_SUBJ_DIFF 2830 1.57 3.94 0.74 94 TR_XM_MaxUnsub 2824 1.45 3.93 0.58 95 SpammyFromTLD_01 2823 1.32 3.93 0.40 96 URI_NOVOWEL 2809 2.49 3.91 1.99 97 TVD_SPACE_RATIO 2740 2.11 3.81 1.51 98 RELAYCOUNTRY_PL 2718 1.00 3.78 0.02 99 UPPERCASE_75_100 2673 1.38 3.72 0.56 100 XM_OfRef6 2654 1.69 3.69 0.98 101 XM_BadFromFormat 2638 1.03 3.67 0.10 102 XM_B_SpammyTLD 2637 2.55 3.67 2.16 103 BODY_URI_ONLY 2549 0.93 3.55 0.00 104 HTML_SHORT_LINK_IMG_1 2536 0.93 3.53 0.01 105 T_FILL_THIS_FORM_SHORT 2532 1.38 3.52 0.62 106 TR_XM_SpammyWords3 2488 1.33 3.46 0.58 107 HTML_IMAGE_RATIO_06 2488 3.93 3.46 4.09 108 T_XMDrugObfuBody_14 2473 3.55 3.44 3.59 109 HTML_IMAGE_ONLY_04 2407 0.90 3.35 0.04 110 HTML_TAG_BALANCE_CENTER 2399 0.97 3.34 0.13 111 HTML_SHORT_CENTER 2394 0.87 3.33 0.01 112 XMBody_17 2363 1.21 3.29 0.48 113 TM2_M_A_HREF_HREF 2300 1.26 3.20 0.58 114 URIBL_DBL_SPAM 2163 0.79 3.01 0.01 115 TR_XM_NoHeaderRelay 2158 0.92 3.00 0.19 116 SUBJ_ALL_CAPS 2074 1.66 2.89 1.22 117 MAILING_LIST_MULTI 2006 2.24 2.79 2.05 118 USER_IN_DEF_DKIM_WL 1956 13.13 2.72 16.79 119 T_REMOTE_IMAGE 1899 3.30 2.64 3.53 120 DKIM_ADSP_CUSTOM_MED 1886 1.40 2.62 0.97 121 T_XMDrugObfuBody_08 1855 1.53 2.58 1.16 122 XM_B_Phish66 1837 1.47 2.56 1.09 123 MIME_QP_LONG_LINE 1822 4.31 2.53 4.94 124 T_TooManySym_01 1807 6.72 2.51 8.20 125 RCVD_IN_MSPIKE_L5 1763 0.76 2.45 0.17 126 TR_XM_PHPDW 1756 0.84 2.44 0.28 127 RCVD_IN_MSPIKE_L3 1680 1.04 2.34 0.58 128 XM_CamelCaseFrm001 1676 1.95 2.33 1.82 129 XM_DIRTYINTL 1595 0.75 2.22 0.23 130 JH_SPAMMY_HEADERS 1593 0.58 2.22 0.00 131 XMBrknScrpt_02 1592 1.54 2.21 1.31 132 XMSexyCombo_01 1564 1.18 2.18 0.83 133 TR_LOTS_OF_MONEY3 1550 0.88 2.16 0.44 134 XMDiploma_00 1533 1.42 2.13 1.18 135 TR_XM_FormFill 1527 0.56 2.12 0.00 136 KHOP_HELO_FCRDNS 1509 1.34 2.10 1.07 137 TR_XM_PHPForged 1502 0.70 2.09 0.21 138 TR_XM_FormFill2 1484 0.70 2.06 0.22 139 XM_H_PHPOS 1475 0.69 2.05 0.21 140 XMBdyGiftCard01 1471 1.59 2.05 1.43 141 XM_DK_Undo_01 1450 1.54 2.02 1.37 142 XM_B_COVIDMETA 1446 0.96 2.01 0.59 143 RELAYCOUNTRY_FR 1382 0.60 1.92 0.13 144 FROM_EXCESS_BASE64 1373 3.57 1.91 4.16 145 BAYES_40 1348 3.92 1.88 4.64 146 XM_B_Unsub2 1316 1.13 1.83 0.88 147 BAYES_20 1313 2.92 1.83 3.31 148 HTML_IMAGE_RATIO_08 1312 2.10 1.83 2.19 149 RCVD_IN_VALIDITY_RPBL 1302 0.57 1.81 0.13 150 BAYES_00 1297 9.11 1.80 11.68 151 BOTNET_NORDNS 1279 0.47 1.78 0.01 152 T_XMHurry_00 1270 0.79 1.77 0.45 153 XMStockSpam_06 1231 1.67 1.71 1.65 154 HTML_FONT_TINY_NORDNS 1207 0.54 1.68 0.14 155 MISSING_HEADERS 1199 0.67 1.67 0.32 156 PDS_OTHER_BAD_TLD 1186 0.78 1.65 0.47 157 XM_B_SpammyWords4 1145 0.80 1.59 0.51 158 XM_UB99 1142 0.41 1.59 0.00 159 TR_Mismatch_TLD_02 1133 0.45 1.58 0.06 160 TM2_M_BODY_EMPTY 1129 0.57 1.57 0.22 161 T_XMDrugObfuBody_00 1124 1.06 1.56 0.88 162 URI_HEX 1117 1.31 1.55 1.23 163 RCVD_IN_PSBL 1114 0.57 1.55 0.22 164 XMEmptyBody_01 1109 0.46 1.54 0.08 165 XMCapTrack 1106 0.72 1.54 0.43 166 REPLYTO_WITHOUT_TO_CC 1065 0.40 1.48 0.02 167 DIET_1 1061 0.72 1.48 0.45 168 XM_Body_Dirty_Words_01 1053 0.53 1.46 0.20 169 XM_H_PHPMailer 1046 0.78 1.46 0.54 170 TR_Mismatch_TLD_01 1031 0.58 1.43 0.28 171 XM_H_Undi_Recip 1011 0.49 1.41 0.17 172 RCVD_IN_RP_SAFE 1003 1.51 1.40 1.54 173 RELAYCOUNTRY_IN 993 0.40 1.38 0.05 174 TR_XM_INV_DKIM 982 0.67 1.37 0.43 175 TR_XM_BayesRelay 969 0.35 1.35 0.00 176 XM_URI_RBL 955 0.42 1.33 0.10 177 RELAYCOUNTRY_AU 938 0.51 1.30 0.23 178 SUBJ_DOLLARS 911 0.55 1.27 0.29 179 XMPhish30 910 0.88 1.27 0.75 180 NML_ADSP_CUSTOM_MED 893 0.82 1.24 0.67 181 XM_UB999 885 0.32 1.23 0.00 182 XMSubMetaI_00 882 0.71 1.23 0.53 183 RELAYCOUNTRY_RU 881 0.33 1.23 0.01 184 RCVD_IN_IADB_LISTED 865 2.86 1.20 3.44 185 XMGenDplmaNmb 862 0.71 1.20 0.54 186 FORGED_GMAIL_RCVD 841 0.70 1.17 0.53 187 URIBL_BLACK 836 0.32 1.16 0.02 188 XM_UB60 820 0.34 1.14 0.06 189 T_Symld_Words_02 810 0.46 1.13 0.22 190 TR_Caps_n_Bayes_99 802 0.44 1.12 0.20 191 XM_B_REG_HTML 795 0.62 1.11 0.45 192 TR_XM_SB_Phish 786 1.55 1.09 1.71 193 XM_ShortIntro_01 775 0.56 1.08 0.38 194 XMSubPhish11 758 1.53 1.05 1.69 195 XM_B_COPY_HTML 757 0.90 1.05 0.84 196 XMPhish08 755 0.39 1.05 0.15 197 XM_UB95 754 0.28 1.05 0.01 198 XM_Lotto 746 0.34 1.04 0.10 199 RCVD_IN_RP_CERTIFIED 744 1.28 1.03 1.36 200 TR_BOTNET_NEGATE 732 0.42 1.02 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 168509 85.14 92.62 82.51 2 RELAYCOUNTRY_US 160325 77.52 74.75 78.50 3 DKIM_SIGNED 150906 76.51 83.97 73.89 4 XM_DK_Pass 147820 74.67 81.19 72.38 5 DKIM_VALID 144572 73.08 79.60 70.79 6 XM_B_Unicode 137925 69.30 74.34 67.53 7 DKIM_VALID_AU 119459 59.40 61.99 58.49 8 DCC_CHECK_NEGATIVE 116903 50.50 31.34 57.24 9 BAYES_50 108053 50.03 41.85 52.91 10 XMListUnsubscribeExists 101180 54.62 69.04 49.54 11 XM_B_SpammyWords 89743 49.12 63.82 43.94 12 XM_B_Unicode3 87385 42.56 41.91 42.79 13 DCC_CHECK 87259 49.47 68.63 42.73 14 RCVD_IN_MSPIKE_WL 65298 29.43 22.22 31.97 15 HTML_FONT_LOW_CONTRAST 62396 31.01 32.32 30.55 16 LOC_TINY_FONT_1 56119 29.56 35.49 27.48 17 DKIM_VALID_EF 55535 27.41 28.05 27.19 18 MIME_HTML_ONLY 48740 26.06 32.28 23.86 19 FVGT_m_MULTI_ODD 48279 25.14 29.40 23.64 20 T_TM2_M_HEADER_IN_MSG 47430 21.67 17.27 23.22 21 XMSubLong 44179 20.78 18.35 21.63 22 ALL_TRUSTED 39140 15.31 4.36 19.16 23 RCVD_IN_MSPIKE_H2 38853 20.54 24.85 19.02 24 XM_B_SpammyWords2 37829 22.91 35.39 18.52 25 USER_IN_DEF_DKIM_WL 34289 13.13 2.72 16.79 26 T_KAM_HTML_FONT_INVALID 32982 18.26 24.27 16.15 27 RCVD_IN_MSPIKE_H3 31907 15.30 14.38 15.62 28 XM_Multi_Part_URI 29210 15.87 20.32 14.30 29 RCVD_IN_MSPIKE_H4 27655 11.95 7.42 13.54 30 XM_Body_Dirty_Words 25290 14.77 21.55 12.38 31 XM_B_Unsub 25063 12.15 11.79 12.27 32 BAYES_00 23854 9.11 1.80 11.68 33 BAYES_60 22292 9.81 6.67 10.91 34 XM_DKIMWhitelistDomains 21620 7.83 0.01 10.59 35 XM_Evil_Numbers_Gen 20163 9.41 8.09 9.87 36 FSL_BULK_SIG 19112 9.74 10.83 9.36 37 UNPARSEABLE_RELAY 18736 10.36 13.72 9.17 38 LotsOfNums_01 17586 7.88 5.79 8.61 39 XM_DK_Undo_02 17408 17.81 44.21 8.52 40 RCVD_IN_VALIDITY_SAFE 16801 7.60 5.81 8.23 41 T_TooManySym_01 16757 6.72 2.51 8.20 42 HTML_IMAGE_RATIO_02 16615 8.58 9.86 8.14 43 TooManyTo_001 16250 7.68 6.89 7.96 44 XM_SendGrid 15613 8.11 9.44 7.64 45 TR_XM_UnparsRelay 15318 9.07 13.53 7.50 46 TR_XM_DK_Bayes 14998 5.54 0.40 7.34 47 TR_XM_DK_Bayes1 14663 5.41 0.39 7.18 48 RCVD_IN_VALIDITY_CERTIFIED 14601 6.41 4.32 7.15 49 XMStrtUSub 14422 6.27 4.01 7.06 50 BAYES_99 14038 13.83 33.58 6.87 51 MPART_ALT_DIFF 13936 8.09 11.69 6.82 52 LOTS_OF_MONEY 13920 7.90 11.00 6.82 53 HTML_IMAGE_RATIO_04 13803 6.22 4.70 6.76 54 TR_XM_DKIM_Undo 13399 13.98 35.08 6.56 55 TR_XM_DK_Bayes2 13375 4.91 0.27 6.55 56 BAYES_999 11665 11.22 26.88 5.71 57 XM_H_Long_From01 11048 5.30 5.01 5.41 58 BOTNET_IPINHOSTNAME 11013 7.31 12.75 5.39 59 TM2_M_URI_OPT_OUT 10818 5.08 4.46 5.30 60 XMNumbers 10704 5.60 6.63 5.24 61 IN_ZIMBRA_NJ_WHITELIST 10667 3.88 0.05 5.22 62 TR_XM_DK_SendGrid 10405 5.36 6.10 5.09 63 MIME_QP_LONG_LINE 10085 4.31 2.53 4.94 64 BAYES_80 9677 5.32 6.96 4.74 65 T_TooManySym_02 9560 3.58 0.47 4.68 66 BAYES_40 9482 3.92 1.88 4.64 67 ANY_BOUNCE_MESSAGE 9409 3.54 0.49 4.61 68 BOUNCE_MESSAGE 9406 3.53 0.49 4.61 69 XM_B_SpammyWords3 8825 6.29 11.87 4.32 70 MIME_HTML_ONLY_MULTI 8790 5.10 7.36 4.30 71 XMSubMetaSx_00 8705 4.70 5.93 4.26 72 TR_XM_SpammyWords4 8619 5.65 9.73 4.22 73 XM_UncommonTLD01 8509 6.25 12.18 4.17 74 FROM_EXCESS_BASE64 8493 3.57 1.91 4.16 75 XMSexyCombo_05 8457 5.52 9.45 4.14 76 HTML_IMAGE_RATIO_06 8351 3.93 3.46 4.09 77 XM_H_Trusted_IP 7886 2.86 0.00 3.86 78 T_XMDrugObfuBody_14 7340 3.55 3.44 3.59 79 INVALID_MSGID 7223 2.66 0.16 3.54 80 T_REMOTE_IMAGE 7203 3.30 2.64 3.53 81 RCVD_IN_IADB_LISTED 7033 2.86 1.20 3.44 82 MSGID_NOFQDN1 6851 2.49 0.03 3.35 83 BAYES_20 6753 2.92 1.83 3.31 84 XM_B_Phish_Phrases 6602 3.97 6.06 3.23 85 TR_DCC_Bayes_99 6536 8.67 24.20 3.20 86 DKIM_INVALID 6334 3.43 4.37 3.10 87 RCVD_IN_IADB_SPF 6240 2.52 1.00 3.06 88 RELAYCOUNTRY_META 6126 8.42 23.81 3.00 89 TO_MALFORMED 6034 2.19 0.02 2.95 90 MIME_HTML_MOSTLY 5910 3.83 6.49 2.89 91 RCVD_IN_MSPIKE_H5 5736 2.19 0.42 2.81 92 BAYES_95 5713 3.25 4.55 2.80 93 RCVD_IN_IADB_SENDERID 5637 2.28 0.93 2.76 94 RCVD_IN_IADB_DK 5476 2.23 0.95 2.68 95 TR_XM_PhishingBody 5155 3.33 5.62 2.52 96 TVD_RCVD_IP 5060 1.87 0.15 2.48 97 XM_PDF 4634 1.78 0.37 2.27 98 IN_HORDE_ADDRESS_BOOK 4484 1.65 0.09 2.20 99 HTML_IMAGE_RATIO_08 4477 2.10 1.83 2.19 100 HTML_MIME_NO_HTML_TAG 4437 3.92 8.88 2.17 101 XM_B_SpammyTLD 4402 2.55 3.67 2.16 102 BAYES_05 4365 1.81 0.88 2.14 103 TR_XM_SpammyWords2 4201 4.61 11.88 2.06 104 MAILING_LIST_MULTI 4184 2.24 2.79 2.05 105 RCVD_IN_IADB_VOUCHED 4109 1.65 0.63 2.01 106 XMBSHREFv2 4091 1.57 0.35 2.00 107 URI_NOVOWEL 4068 2.49 3.91 1.99 108 XM_CamelCaseFrm001 3718 1.95 2.33 1.82 109 TM2_M_VERY_LONG_WORD 3549 2.76 5.65 1.74 110 XM_GoogleGroups 3505 2.74 5.65 1.72 111 TR_XM_SB_Phish 3489 1.55 1.09 1.71 112 XMSubPhish11 3457 1.53 1.05 1.69 113 XMStockSpam_06 3374 1.67 1.71 1.65 114 RCVD_IN_RP_SAFE 3153 1.51 1.40 1.54 115 TVD_SPACE_RATIO 3077 2.11 3.81 1.51 116 TR_Symld_Words 3052 1.30 0.75 1.49 117 HTML_FONT_FACE_BAD 3046 1.22 0.44 1.49 118 XMGappySubj_01 2987 1.15 0.24 1.46 119 XM_B_Investor 2965 2.19 4.27 1.45 120 BOTNET 2948 5.00 15.11 1.44 121 XMBdyGiftCard01 2927 1.59 2.05 1.43 122 XM_DK_Undo_01 2805 1.54 2.02 1.37 123 RCVD_IN_RP_CERTIFIED 2782 1.28 1.03 1.36 124 XM_SPF_SoftFail 2755 2.81 6.96 1.35 125 XMBrknScrpt_02 2669 1.54 2.21 1.31 126 TR_XM_SpammyWords5 2663 2.05 4.17 1.30 127 TooManyTo_002 2643 1.15 0.75 1.29 128 TR_XM_SpammyRelay 2627 4.17 12.37 1.29 129 RCVD_IN_BL_SPAMCOP_NET 2622 3.55 9.98 1.28 130 RCVD_IN_IADB_OPTIN 2606 1.03 0.33 1.28 131 SHORT_URI_2 2595 1.13 0.72 1.27 132 URI_HEX 2514 1.31 1.55 1.23 133 UNTRUSTED_Relay 2514 4.63 14.28 1.23 134 SUBJ_ALL_CAPS 2501 1.66 2.89 1.22 135 XMDiploma_00 2400 1.42 2.13 1.18 136 T_XMDrugObfuBody_08 2377 1.53 2.58 1.16 137 XMLngstWrd_00 2351 2.05 4.59 1.15 138 T_TooManySym_03 2258 0.86 0.14 1.11 139 XMSubNoVowel 2235 1.00 0.73 1.09 140 XM_B_Phish66 2232 1.47 2.56 1.09 141 XMLngstWrd_01 2205 1.98 4.55 1.08 142 KHOP_HELO_FCRDNS 2178 1.34 2.10 1.07 143 XM_H_Long_From02 2049 0.95 0.80 1.00 144 XM_OfRef6 2005 1.69 3.69 0.98 145 XMLngstWrd_02 1985 1.89 4.50 0.97 146 DKIM_ADSP_CUSTOM_MED 1981 1.40 2.62 0.97 147 RCVD_IN_MSPIKE_BL 1957 2.15 5.52 0.96 148 TR_XM_MSPIKECOMBO 1952 2.14 5.52 0.96 149 TooManyTo_003 1912 0.87 0.70 0.94 150 XMBody_95 1794 0.68 0.13 0.88 151 XM_B_Unsub2 1793 1.13 1.83 0.88 152 T_XMDrugObfuBody_00 1792 1.06 1.56 0.88 153 XMLngstWrd_03 1745 1.80 4.47 0.85 154 XM_B_COPY_HTML 1725 0.90 1.05 0.84 155 XMSexyCombo_01 1703 1.18 2.18 0.83 156 RELAYCOUNTRY_CA 1659 2.35 6.72 0.81 157 XMLngstWrd_04 1650 1.75 4.44 0.81 158 XMPhish30 1526 0.88 1.27 0.75 159 HTML_TITLE_SUBJ_DIFF 1511 1.57 3.94 0.74 160 HTML_IMAGE_ONLY_20 1494 0.58 0.15 0.73 161 TooManyTo_004 1464 0.68 0.56 0.72 162 XM_UB50 1409 2.24 6.63 0.69 163 NML_ADSP_CUSTOM_MED 1367 0.82 1.24 0.67 164 RDNS_DYNAMIC 1323 0.65 0.65 0.65 165 USER_IN_WELCOMELIST 1307 0.47 0.00 0.64 166 USER_IN_WHITELIST 1307 0.47 0.00 0.64 167 TR_MetaPhish_Combo_01 1289 0.62 0.59 0.63 168 T_FILL_THIS_FORM_SHORT 1266 1.38 3.52 0.62 169 TooManyTo_005 1260 0.59 0.52 0.62 170 HTTPS_HTTP_MISMATCH 1258 0.65 0.74 0.62 171 XM_ProductURIs 1237 0.66 0.80 0.61 172 XM_B_COVIDMETA 1204 0.96 2.01 0.59 173 TR_XM_MaxUnsub 1188 1.45 3.93 0.58 174 TR_XM_SpammyWords3 1182 1.33 3.46 0.58 175 TM2_M_A_HREF_HREF 1182 1.26 3.20 0.58 176 RCVD_IN_MSPIKE_L3 1179 1.04 2.34 0.58 177 XM_D_tchamptons_WL 1177 0.43 0.00 0.58 178 TR_MSPIKEBAYES00 1156 0.43 0.03 0.57 179 HTML_TAG_BALANCE_BODY 1147 0.67 0.99 0.56 180 UPPERCASE_75_100 1138 1.38 3.72 0.56 181 XMHTMLBadTable_001 1128 0.63 0.85 0.55 182 RELAYCOUNTRY_GB 1123 0.58 0.66 0.55 183 T_TooManySym_04 1107 0.42 0.06 0.54 184 XM_H_PHPMailer 1097 0.78 1.46 0.54 185 XMGenDplmaNmb 1093 0.71 1.20 0.54 186 FORGED_GMAIL_RCVD 1086 0.70 1.17 0.53 187 XMSubMetaI_00 1082 0.71 1.23 0.53 188 MPART_ALT_DIFF_COUNT 1058 0.57 0.73 0.52 189 DATE_IN_PAST_03_06 1058 0.57 0.72 0.52 190 DKIM_ADSP_NXDOMAIN 1053 0.58 0.77 0.52 191 XM_B_SpammyWords4 1051 0.80 1.59 0.51 192 XMPhish14 1049 0.50 0.45 0.51 193 XMSubMetaSxObfu_02 999 0.45 0.33 0.49 194 XMBody_17 973 1.21 3.29 0.48 195 PDS_OTHER_BAD_TLD 956 0.78 1.65 0.47 196 NO_DNS_FOR_FROM 953 0.57 0.87 0.47 197 XMHTML_After_End 938 0.52 0.69 0.46 198 XM_B_REG_HTML 928 0.62 1.11 0.45 199 XMNoVowels 927 0.57 0.90 0.45 200 T_XMHurry_00 921 0.79 1.77 0.45 ----------------------------------------------------------------------