Email: 286953 Autolearn: 0 AvgScore: 2.92 AvgScanTime: 1.33 sec Spam: 85533 Autolearn: 0 AvgScore: 13.67 AvgScanTime: 1.43 sec Ham: 201420 Autolearn: 0 AvgScore: -1.64 AvgScanTime: 1.28 sec Time Spent Running SA: 105.82 hours Time Spent Processing Spam: 34.03 hours Time Spent Processing Ham: 71.79 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 81789 86.75 95.62 82.98 2 DKIM_SIGNED 74959 76.78 87.64 72.18 3 XM_DK_Pass 73663 75.29 86.12 70.69 4 DKIM_VALID 71885 73.67 84.04 69.26 5 RELAYCOUNTRY_US 70443 77.67 82.36 75.68 6 XM_B_Unicode 62937 68.01 73.58 65.64 7 DCC_CHECK 60997 48.06 71.31 38.18 8 XM_B_SpammyWords 59979 53.81 70.12 46.88 9 XMListUnsubscribeExists 59859 55.97 69.98 50.02 10 DKIM_VALID_AU 56099 59.27 65.59 56.58 11 XM_DK_Undo_02 44499 22.52 52.03 10.00 12 TR_XM_DKIM_Undo 35724 17.05 41.77 6.55 13 BAYES_99 33935 17.53 39.67 8.13 14 XM_B_Unicode3 33714 40.35 39.42 40.74 15 LOC_TINY_FONT_1 31811 29.59 37.19 26.36 16 BAYES_50 30172 45.74 35.28 50.18 17 HTML_FONT_LOW_CONTRAST 29687 30.25 34.71 28.36 18 XM_B_SpammyWords2 28843 22.77 33.72 18.12 19 BAYES_999 27922 14.47 32.64 6.75 20 DKIM_VALID_EF 27883 28.76 32.60 27.13 21 FVGT_m_MULTI_ODD 26476 25.54 30.95 23.24 22 MIME_HTML_ONLY 25782 24.05 30.14 21.47 23 TR_DCC_Bayes_99 25596 11.24 29.93 3.31 24 DCC_CHECK_NEGATIVE 24508 51.91 28.65 61.79 25 XM_Body_Dirty_Words 23802 20.02 27.83 16.71 26 T_KAM_HTML_FONT_INVALID 22856 19.75 26.72 16.79 27 RCVD_IN_MSPIKE_WL 21040 28.28 24.60 29.84 28 RCVD_IN_MSPIKE_H2 19002 19.11 22.22 17.80 29 T_TM2_M_HEADER_IN_MSG 16613 20.89 19.42 21.51 30 XMSubLong 16575 20.80 19.38 21.40 31 XM_B_Unsub 15629 16.79 18.27 16.16 32 RCVD_IN_MSPIKE_H3 14553 15.93 17.01 15.48 33 RELAYCOUNTRY_META 14328 6.96 16.75 2.80 34 UNPARSEABLE_RELAY 12378 9.87 14.47 7.91 35 XM_Multi_Part_URI 12302 12.95 14.38 12.34 36 TR_XM_UnparsRelay 11987 8.53 14.01 6.20 37 XM_UncommonTLD01 11311 6.82 13.22 4.10 38 TR_XM_SpammyWords2 11307 5.18 13.22 1.77 39 MPART_ALT_DIFF 10818 7.60 12.65 5.46 40 BOTNET 10370 4.80 12.12 1.69 41 LOTS_OF_MONEY 10248 9.33 11.98 8.20 42 TooManyTo_001 9180 11.45 10.73 11.76 43 XM_B_SpammyWords3 9038 6.20 10.57 4.34 44 TR_XM_SpammyRelay 8991 3.94 10.51 1.15 45 FSL_BULK_SIG 8893 6.89 10.40 5.40 46 XMSexyCombo_05 8840 5.83 10.34 3.91 47 XMSubMetaSx_00 8737 8.17 10.21 7.30 48 BOTNET_IPINHOSTNAME 8623 7.04 10.08 5.75 49 TR_XM_SpammyWords4 8452 6.25 9.88 4.71 50 RCVD_IN_BL_SPAMCOP_NET 7848 3.76 9.18 1.46 51 XM_SendGrid 7764 6.81 9.08 5.85 52 HTML_IMAGE_RATIO_02 7482 7.70 8.75 7.26 53 TR_XM_MaxUnsub 7427 3.64 8.68 1.49 54 BAYES_80 6329 5.49 7.40 4.68 55 UNTRUSTED_Relay 6293 3.03 7.36 1.20 56 MIME_HTML_MOSTLY 6179 3.75 7.22 2.27 57 RCVD_IN_MSPIKE_H4 6160 10.65 7.20 12.11 58 XM_Evil_Numbers_Gen 6005 8.18 7.02 8.67 59 SpammyFromTLD_02 5857 2.38 6.85 0.48 60 TM2_M_URI_OPT_OUT 5742 8.35 6.71 9.04 61 MIME_HTML_ONLY_MULTI 5512 4.60 6.44 3.81 62 BAYES_60 5342 9.51 6.25 10.89 63 TR_XM_DK_SendGrid 5271 4.55 6.16 3.87 64 URI_NOVOWEL 5269 3.91 6.16 2.96 65 TM2_M_VERY_LONG_WORD 5239 3.11 6.13 1.82 66 HTML_MIME_NO_HTML_TAG 5088 3.05 5.95 1.82 67 XMSexyCombo_01 5022 4.74 5.87 4.26 68 MIME_QP_LONG_LINE 4889 8.22 5.72 9.29 69 RELAYCOUNTRY_CA 4885 2.22 5.71 0.74 70 RCVD_IN_MSPIKE_BL 4781 2.28 5.59 0.87 71 TR_XM_MSPIKECOMBO 4772 2.28 5.58 0.87 72 SpammyFromTLD_01 4580 1.86 5.35 0.38 73 XM_B_SpammyTLD 4532 3.11 5.30 2.18 74 LotsOfNums_01 4524 7.82 5.29 8.89 75 ALL_TRUSTED 4390 17.15 5.13 22.25 76 TR_XM_PhishingBody 4384 3.18 5.13 2.36 77 RCVD_IN_VALIDITY_SAFE 4259 6.03 4.98 6.47 78 TR_XM_SPAMCOP 3934 1.62 4.60 0.35 79 XM_B_Investor 3747 2.21 4.38 1.28 80 HTML_IMAGE_RATIO_04 3714 5.67 4.34 6.24 81 XM_B_Phish_Phrases 3662 3.82 4.28 3.62 82 XM_H_Long_From01 3594 5.05 4.20 5.40 83 RCVD_IN_VALIDITY_CERTIFIED 3507 5.15 4.10 5.60 84 T_XMDrugObfuBody_08 3427 2.23 4.01 1.48 85 XM_GoogleGroups 3288 2.19 3.84 1.48 86 BAYES_95 3270 3.25 3.82 3.00 87 TR_XM_SpammyWords3 3252 1.43 3.80 0.42 88 XM_DIRTYINTL 3245 1.33 3.79 0.29 89 JH_SPAMMY_HEADERS 3203 1.12 3.74 0.00 90 XM_UB50 3147 1.58 3.68 0.70 91 XMBody_17 3098 1.51 3.62 0.62 92 DKIM_INVALID 3074 3.12 3.59 2.92 93 XMLngstWrd_00 3048 1.89 3.56 1.19 94 XMLngstWrd_01 3020 1.83 3.53 1.10 95 RCVD_IN_MSPIKE_L3 3014 1.33 3.52 0.40 96 PDS_OTHER_BAD_TLD 2996 1.25 3.50 0.29 97 XMLngstWrd_02 2991 1.75 3.50 1.01 98 HTML_TITLE_SUBJ_DIFF 2979 1.31 3.48 0.39 99 XMLngstWrd_03 2971 1.62 3.47 0.84 100 XMLngstWrd_04 2936 1.55 3.43 0.76 101 UPPERCASE_75_100 2913 1.33 3.41 0.44 102 T_XMDrugObfuBody_14 2913 2.41 3.41 1.98 103 FROM_SUSPICIOUS_NTLD 2884 1.05 3.37 0.06 104 FROM_SUSPICIOUS_NTLD_FP 2842 1.03 3.32 0.06 105 T_REMOTE_IMAGE 2752 3.14 3.22 3.11 106 TR_XM_SpammyWords5 2723 1.89 3.18 1.35 107 XMSpecificSbj 2656 0.93 3.11 0.00 108 T_FILL_THIS_FORM_SHORT 2619 1.25 3.06 0.49 109 XM_SPF_SoftFail 2611 1.83 3.05 1.32 110 SHORT_URI_2 2573 3.52 3.01 3.74 111 XMStrtUSub 2437 4.09 2.85 4.62 112 T_TooManySym_01 2423 5.76 2.83 7.01 113 URIBL_DBL_SPAM 2401 0.84 2.81 0.01 114 XM_B_Phish66 2381 1.66 2.78 1.19 115 XM_Body_Dirty_Words_01 2362 1.06 2.76 0.34 116 XMNumbers 2334 4.10 2.73 4.68 117 XM_OfRef6 2237 1.25 2.62 0.67 118 SUBJ_ALL_CAPS 2228 1.82 2.60 1.49 119 USER_IN_DEF_DKIM_WL 2202 11.90 2.57 15.87 120 BAYES_20 2128 3.66 2.49 4.16 121 XMSexyCombo_02 2048 1.00 2.39 0.40 122 TR_XM_FormFill 2004 0.72 2.34 0.03 123 BAYES_00 1986 9.32 2.32 12.29 124 XM_DK_Undo_01 1968 1.72 2.30 1.47 125 KHOP_HELO_FCRDNS 1947 1.39 2.28 1.02 126 TR_XM_PHPDW 1885 0.89 2.20 0.33 127 HTML_IMAGE_RATIO_06 1874 3.26 2.19 3.72 128 XM_H_TOP 1828 0.64 2.14 0.00 129 XMDiploma_00 1828 1.39 2.14 1.07 130 TR_M_TOP_BAYES 1790 0.62 2.09 0.00 131 RELAYCOUNTRY_FR 1752 0.74 2.05 0.18 132 XM_CamelCaseFrm001 1743 1.72 2.04 1.58 133 XM_B_Unsub2 1694 1.43 1.98 1.20 134 TR_XM_PHPForged 1694 0.76 1.98 0.25 135 BAYES_40 1677 3.81 1.96 4.59 136 TR_XM_FormFill2 1676 0.76 1.96 0.25 137 XM_H_PHPOS 1668 0.75 1.95 0.24 138 XM_B_SpammyWords4 1624 1.14 1.90 0.82 139 XMBdyGiftCard01 1623 1.32 1.90 1.08 140 DATE_IN_PAST_03_06 1610 0.95 1.88 0.55 141 FROM_EXCESS_BASE64 1567 2.87 1.83 3.31 142 TR_XM_NoHeaderRelay 1471 0.62 1.72 0.16 143 XM_URI_RBL 1458 0.60 1.70 0.12 144 HTML_IMAGE_RATIO_08 1367 2.21 1.60 2.47 145 TR_Mismatch_TLD_01 1346 0.71 1.57 0.34 146 SUBJ_DOLLARS 1290 0.79 1.51 0.48 147 TR_Symld_Words 1263 1.49 1.48 1.50 148 RCVD_IN_IADB_LISTED 1222 3.49 1.43 4.37 149 RELAYCOUNTRY_AU 1189 0.54 1.39 0.18 150 TR_XM_INV_DKIM 1182 0.80 1.38 0.55 151 URI_HEX 1174 1.25 1.37 1.20 152 MPART_ALT_DIFF_COUNT 1167 0.82 1.36 0.58 153 T_XMDrugObfuBody_00 1167 0.91 1.36 0.72 154 HK_RANDOM_REPLYTO 1167 0.48 1.36 0.10 155 TR_XM_SB_Phish 1164 1.63 1.36 1.74 156 XMStockSpam_06 1141 1.55 1.33 1.65 157 XMSubPhish11 1134 1.60 1.33 1.72 158 TR_XM_BayesRelay 1122 0.39 1.31 0.00 159 TM2_M_A_HREF_HREF 1111 0.80 1.30 0.58 160 XMSubMetaI_00 1092 0.89 1.28 0.73 161 BOTNET_NORDNS 1087 0.39 1.27 0.02 162 TR_Mismatch_TLD_02 1060 0.44 1.24 0.10 163 SHORT_URI_3 1058 1.72 1.24 1.92 164 URI_NO_WWW_BIZ_CGI 1056 0.37 1.23 0.00 165 RCVD_IN_MSPIKE_L5 1047 0.39 1.22 0.03 166 LongTLD 1040 0.43 1.22 0.09 167 TR_Caps_n_Bayes_99 1024 0.59 1.20 0.33 168 DIET_1 1022 0.58 1.19 0.32 169 XM_H_PHPMailer 1018 0.67 1.19 0.45 170 XMSolicitRefs_0 1012 0.50 1.18 0.21 171 XMHTMLBadTable_001 998 0.80 1.17 0.64 172 HTML_TAG_BALANCE_BODY 997 0.72 1.17 0.54 173 TR_LOTS_OF_MONEY3 983 0.47 1.15 0.19 174 XM_B_Crypto 970 0.42 1.13 0.12 175 T_XMHurry_00 967 0.60 1.13 0.38 176 XMPhish30 962 0.84 1.12 0.72 177 RCVD_IN_RP_SAFE 952 1.20 1.11 1.24 178 RCVD_IN_VALIDITY_RPBL 939 0.34 1.10 0.01 179 RCVD_IN_IADB_SPF 927 3.02 1.08 3.84 180 XM_H_Undi_Recip 895 0.43 1.05 0.17 181 URIBL_BLACK 894 0.33 1.05 0.03 182 FONT_INVIS_LONG_LINE 886 0.35 1.04 0.06 183 RCVD_IN_IADB_DK 834 2.61 0.98 3.31 184 HTML_FONT_SIZE_HUGE 832 0.37 0.97 0.12 185 BODY_URI_ONLY 831 0.32 0.97 0.04 186 XM_ProductURIs 828 1.08 0.97 1.13 187 MAILING_LIST_MULTI 826 1.67 0.97 1.96 188 RCVD_IN_IADB_VOUCHED 820 2.30 0.96 2.87 189 RCVD_IN_IADB_SENDERID 807 2.70 0.94 3.44 190 XMGenDplmaNmb 805 0.56 0.94 0.39 191 XMBrknScrpt_02 802 0.84 0.94 0.80 192 SHOPIFY_IMG_NOT_RCVD_SFY 802 0.41 0.94 0.19 193 TR_MetaPhish_Combo_01 788 0.79 0.92 0.74 194 HTML_TAG_BALANCE_CENTER 786 0.35 0.92 0.10 195 XMSubMetaSx_01 777 0.51 0.91 0.34 196 HTTPS_HTTP_MISMATCH 776 0.58 0.91 0.44 197 XM_UB99 774 0.27 0.90 0.00 198 PLING_QUERY 744 0.84 0.87 0.83 199 RCVD_IN_RP_CERTIFIED 728 1.03 0.85 1.10 200 XM_B_COVIDMETA 712 0.79 0.83 0.77 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 167130 86.75 95.62 82.98 2 RELAYCOUNTRY_US 152440 77.67 82.36 75.68 3 DKIM_SIGNED 145376 76.78 87.64 72.18 4 XM_DK_Pass 142390 75.29 86.12 70.69 5 DKIM_VALID 139500 73.67 84.04 69.26 6 XM_B_Unicode 132215 68.01 73.58 65.64 7 DCC_CHECK_NEGATIVE 124456 51.91 28.65 61.79 8 DKIM_VALID_AU 113969 59.27 65.59 56.58 9 BAYES_50 101076 45.74 35.28 50.18 10 XMListUnsubscribeExists 100741 55.97 69.98 50.02 11 XM_B_SpammyWords 94419 53.81 70.12 46.88 12 XM_B_Unicode3 82059 40.35 39.42 40.74 13 DCC_CHECK 76905 48.06 71.31 38.18 14 RCVD_IN_MSPIKE_WL 60097 28.28 24.60 29.84 15 HTML_FONT_LOW_CONTRAST 57118 30.25 34.71 28.36 16 DKIM_VALID_EF 54644 28.76 32.60 27.13 17 LOC_TINY_FONT_1 53099 29.59 37.19 26.36 18 FVGT_m_MULTI_ODD 46803 25.54 30.95 23.24 19 ALL_TRUSTED 44809 17.15 5.13 22.25 20 T_TM2_M_HEADER_IN_MSG 43329 20.89 19.42 21.51 21 MIME_HTML_ONLY 43239 24.05 30.14 21.47 22 XMSubLong 43108 20.80 19.38 21.40 23 XM_B_SpammyWords2 36503 22.77 33.72 18.12 24 RCVD_IN_MSPIKE_H2 35844 19.11 22.22 17.80 25 T_KAM_HTML_FONT_INVALID 33826 19.75 26.72 16.79 26 XM_Body_Dirty_Words 33654 20.02 27.83 16.71 27 XM_B_Unsub 32551 16.79 18.27 16.16 28 USER_IN_DEF_DKIM_WL 31959 11.90 2.57 15.87 29 RCVD_IN_MSPIKE_H3 31172 15.93 17.01 15.48 30 XM_Multi_Part_URI 24846 12.95 14.38 12.34 31 BAYES_00 24764 9.32 2.32 12.29 32 RCVD_IN_MSPIKE_H4 24400 10.65 7.20 12.11 33 TooManyTo_001 23682 11.45 10.73 11.76 34 XM_DKIMWhitelistDomains 23673 8.26 0.02 11.75 35 BAYES_60 21942 9.51 6.25 10.89 36 XM_DK_Undo_02 20132 22.52 52.03 10.00 37 MIME_QP_LONG_LINE 18705 8.22 5.72 9.29 38 TM2_M_URI_OPT_OUT 18211 8.35 6.71 9.04 39 LotsOfNums_01 17912 7.82 5.29 8.89 40 XM_Evil_Numbers_Gen 17458 8.18 7.02 8.67 41 LOTS_OF_MONEY 16526 9.33 11.98 8.20 42 BAYES_99 16374 17.53 39.67 8.13 43 UNPARSEABLE_RELAY 15934 9.87 14.47 7.91 44 XMSubMetaSx_00 14713 8.17 10.21 7.30 45 HTML_IMAGE_RATIO_02 14618 7.70 8.75 7.26 46 T_TooManySym_01 14119 5.76 2.83 7.01 47 BAYES_999 13601 14.47 32.64 6.75 48 TR_XM_DKIM_Undo 13198 17.05 41.77 6.55 49 RCVD_IN_VALIDITY_SAFE 13037 6.03 4.98 6.47 50 TR_XM_DK_Bayes 12953 4.65 0.47 6.43 51 TR_XM_DK_Bayes1 12681 4.56 0.47 6.30 52 HTML_IMAGE_RATIO_04 12565 5.67 4.34 6.24 53 TR_XM_UnparsRelay 12494 8.53 14.01 6.20 54 XM_SendGrid 11776 6.81 9.08 5.85 55 BOTNET_IPINHOSTNAME 11581 7.04 10.08 5.75 56 TR_XM_DK_Bayes2 11297 4.06 0.42 5.61 57 RCVD_IN_VALIDITY_CERTIFIED 11272 5.15 4.10 5.60 58 IN_ZIMBRA_NJ_WHITELIST 11117 3.89 0.04 5.52 59 MPART_ALT_DIFF 11004 7.60 12.65 5.46 60 FSL_BULK_SIG 10884 6.89 10.40 5.40 61 XM_H_Long_From01 10883 5.05 4.20 5.40 62 TR_XM_SpammyWords4 9482 6.25 9.88 4.71 63 XMNumbers 9425 4.10 2.73 4.68 64 BAYES_80 9424 5.49 7.40 4.68 65 T_TooManySym_02 9355 3.45 0.63 4.64 66 XMStrtUSub 9301 4.09 2.85 4.62 67 BAYES_40 9242 3.81 1.96 4.59 68 RCVD_IN_IADB_LISTED 8797 3.49 1.43 4.37 69 XM_B_SpammyWords3 8747 6.20 10.57 4.34 70 XMSexyCombo_01 8575 4.74 5.87 4.26 71 ANY_BOUNCE_MESSAGE 8434 3.12 0.60 4.19 72 BOUNCE_MESSAGE 8433 3.12 0.60 4.19 73 BAYES_20 8384 3.66 2.49 4.16 74 XM_UncommonTLD01 8264 6.82 13.22 4.10 75 XMSexyCombo_05 7880 5.83 10.34 3.91 76 TR_XM_DK_SendGrid 7788 4.55 6.16 3.87 77 RCVD_IN_IADB_SPF 7744 3.02 1.08 3.84 78 MIME_HTML_ONLY_MULTI 7679 4.60 6.44 3.81 79 SHORT_URI_2 7533 3.52 3.01 3.74 80 INVALID_MSGID 7512 2.66 0.13 3.73 81 HTML_IMAGE_RATIO_06 7489 3.26 2.19 3.72 82 XM_B_Phish_Phrases 7297 3.82 4.28 3.62 83 MSGID_NOFQDN1 7164 2.51 0.03 3.56 84 RCVD_IN_IADB_SENDERID 6932 2.70 0.94 3.44 85 FROM_EXCESS_BASE64 6672 2.87 1.83 3.31 86 TR_DCC_Bayes_99 6669 11.24 29.93 3.31 87 RCVD_IN_IADB_DK 6663 2.61 0.98 3.31 88 T_REMOTE_IMAGE 6267 3.14 3.22 3.11 89 TO_MALFORMED 6149 2.15 0.01 3.05 90 BAYES_95 6051 3.25 3.82 3.00 91 URI_NOVOWEL 5955 3.91 6.16 2.96 92 DKIM_INVALID 5876 3.12 3.59 2.92 93 RCVD_IN_IADB_VOUCHED 5777 2.30 0.96 2.87 94 RELAYCOUNTRY_META 5649 6.96 16.75 2.80 95 TVD_RCVD_IP 5379 1.95 0.26 2.67 96 XM_H_Trusted_IP 5272 1.84 0.00 2.62 97 HTML_IMAGE_RATIO_08 4974 2.21 1.60 2.47 98 XM_PDF 4766 1.76 0.35 2.37 99 TR_XM_PhishingBody 4744 3.18 5.13 2.36 100 MIME_HTML_MOSTLY 4581 3.75 7.22 2.27 101 RCVD_IN_MSPIKE_H5 4525 1.69 0.38 2.25 102 IN_HORDE_ADDRESS_BOOK 4408 1.56 0.07 2.19 103 XM_B_SpammyTLD 4392 3.11 5.30 2.18 104 BAYES_05 4158 1.69 0.80 2.06 105 XMGappySubj_01 4018 1.44 0.12 1.99 106 T_XMDrugObfuBody_14 3998 2.41 3.41 1.98 107 MAILING_LIST_MULTI 3952 1.67 0.97 1.96 108 SHORT_URI_3 3874 1.72 1.24 1.92 109 XMBSHREFv2 3756 1.39 0.26 1.86 110 TM2_M_VERY_LONG_WORD 3672 3.11 6.13 1.82 111 HTML_MIME_NO_HTML_TAG 3669 3.05 5.95 1.82 112 RCVD_IN_IADB_OPTIN 3635 1.41 0.50 1.80 113 XM_H_Long_From02 3608 1.44 0.61 1.79 114 TR_XM_SpammyWords2 3571 5.18 13.22 1.77 115 TR_XM_SB_Phish 3508 1.63 1.36 1.74 116 XMSubPhish11 3470 1.60 1.33 1.72 117 BOTNET 3397 4.80 12.12 1.69 118 XMStockSpam_06 3314 1.55 1.33 1.65 119 TVD_SPACE_RATIO 3238 1.26 0.44 1.61 120 XM_CamelCaseFrm001 3181 1.72 2.04 1.58 121 TR_Symld_Words 3013 1.49 1.48 1.50 122 TR_XM_MaxUnsub 3004 3.64 8.68 1.49 123 SUBJ_ALL_CAPS 2997 1.82 2.60 1.49 124 XM_GoogleGroups 2987 2.19 3.84 1.48 125 T_XMDrugObfuBody_08 2972 2.23 4.01 1.48 126 XM_DK_Undo_01 2961 1.72 2.30 1.47 127 RCVD_IN_BL_SPAMCOP_NET 2931 3.76 9.18 1.46 128 TR_XM_SpammyWords5 2713 1.89 3.18 1.35 129 XM_SPF_SoftFail 2652 1.83 3.05 1.32 130 TooManyTo_002 2634 1.12 0.69 1.31 131 XM_B_Investor 2581 2.21 4.38 1.28 132 RCVD_IN_RP_SAFE 2493 1.20 1.11 1.24 133 URI_HEX 2416 1.25 1.37 1.20 134 UNTRUSTED_Relay 2413 3.03 7.36 1.20 135 XM_B_Unsub2 2412 1.43 1.98 1.20 136 XM_B_Phish66 2391 1.66 2.78 1.19 137 XMLngstWrd_00 2388 1.89 3.56 1.19 138 TR_XM_SpammyRelay 2322 3.94 10.51 1.15 139 XM_ProductURIs 2284 1.08 0.97 1.13 140 XMLngstWrd_01 2218 1.83 3.53 1.10 141 RCVD_IN_RP_CERTIFIED 2214 1.03 0.85 1.10 142 T_TooManySym_03 2187 0.80 0.13 1.09 143 XMBdyGiftCard01 2175 1.32 1.90 1.08 144 XMDiploma_00 2160 1.39 2.14 1.07 145 KHOP_HELO_FCRDNS 2052 1.39 2.28 1.02 146 XMSubNoVowel 2043 0.88 0.57 1.01 147 XMLngstWrd_02 2027 1.75 3.50 1.01 148 XM_D_tchamptons_WL 1984 0.69 0.01 0.99 149 XMBody_95 1948 0.73 0.16 0.97 150 SHORTENED_URL_HREF 1938 0.89 0.73 0.96 151 HTML_FONT_FACE_BAD 1878 0.86 0.70 0.93 152 TooManyTo_003 1850 0.84 0.65 0.92 153 XM_B_COPY_HTML 1816 0.88 0.83 0.90 154 RCVD_IN_MSPIKE_BL 1761 2.28 5.59 0.87 155 TR_XM_MSPIKECOMBO 1760 2.28 5.58 0.87 156 XMLngstWrd_03 1690 1.62 3.47 0.84 157 PLING_QUERY 1674 0.84 0.87 0.83 158 XM_B_SpammyWords4 1644 1.14 1.90 0.82 159 DKIM_ADSP_CUSTOM_MED 1618 0.75 0.62 0.80 160 XMBrknScrpt_02 1607 0.84 0.94 0.80 161 XM_B_COVIDMETA 1548 0.79 0.83 0.77 162 XMLngstWrd_04 1522 1.55 3.43 0.76 163 RELAYCOUNTRY_CA 1493 2.22 5.71 0.74 164 TR_MetaPhish_Combo_01 1483 0.79 0.92 0.74 165 XMSubMetaI_00 1461 0.89 1.28 0.73 166 XMPhish30 1457 0.84 1.12 0.72 167 T_XMDrugObfuBody_00 1453 0.91 1.36 0.72 168 XM_UB50 1400 1.58 3.68 0.70 169 TooManyTo_004 1395 0.67 0.61 0.69 170 URI_TRY_3LD 1389 0.69 0.70 0.69 171 USER_IN_WELCOMELIST 1382 0.48 0.00 0.69 172 USER_IN_WHITELIST 1382 0.48 0.00 0.69 173 HTML_IMAGE_ONLY_20 1369 0.59 0.38 0.68 174 XM_OfRef6 1350 1.25 2.62 0.67 175 XMHTMLBadTable_001 1288 0.80 1.17 0.64 176 RDNS_DYNAMIC 1260 0.64 0.66 0.63 177 XMBody_17 1240 1.51 3.62 0.62 178 TooManyTo_005 1220 0.60 0.58 0.61 179 TM2_M_A_HREF_HREF 1178 0.80 1.30 0.58 180 MPART_ALT_DIFF_COUNT 1172 0.82 1.36 0.58 181 TR_XM_INV_DKIM 1116 0.80 1.38 0.55 182 DATE_IN_PAST_03_06 1106 0.95 1.88 0.55 183 HTML_TAG_BALANCE_BODY 1081 0.72 1.17 0.54 184 DKIM_ADSP_NXDOMAIN 1077 0.46 0.27 0.53 185 NML_ADSP_CUSTOM_MED 1020 0.51 0.53 0.51 186 XMSubMetaSxObfu_02 983 0.49 0.49 0.49 187 RELAYCOUNTRY_GB 983 0.52 0.60 0.49 188 T_FILL_THIS_FORM_SHORT 979 1.25 3.06 0.49 189 SUBJ_DOLLARS 972 0.79 1.51 0.48 190 SpammyFromTLD_02 966 2.38 6.85 0.48 191 TR_MSPIKEBAYES00 935 0.33 0.02 0.46 192 T_TooManySym_04 914 0.34 0.06 0.45 193 HELO_NODOT 911 0.49 0.57 0.45 194 XM_H_PHPMailer 910 0.67 1.19 0.45 195 HELO_NO_DOMAIN 910 0.49 0.56 0.45 196 XMCapTrack 907 0.38 0.21 0.45 197 FORGED_GMAIL_RCVD 903 0.46 0.50 0.45 198 NO_DNS_FOR_FROM 899 0.41 0.33 0.45 199 UPPERCASE_75_100 893 1.33 3.41 0.44 200 RCVD_IN_MSPIKE_L4 882 0.56 0.83 0.44 ----------------------------------------------------------------------