Email: 272977 Autolearn: 0 AvgScore: 3.23 AvgScanTime: 1.22 sec Spam: 84444 Autolearn: 0 AvgScore: 14.35 AvgScanTime: 1.29 sec Ham: 188533 Autolearn: 0 AvgScore: -1.75 AvgScanTime: 1.19 sec Time Spent Running SA: 92.67 hours Time Spent Processing Spam: 30.19 hours Time Spent Processing Ham: 62.49 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 78578 86.25 93.05 83.20 2 DKIM_SIGNED 73152 79.98 86.63 77.01 3 XM_DK_Pass 71993 78.59 85.26 75.60 4 DKIM_VALID 71457 78.05 84.62 75.11 5 RELAYCOUNTRY_US 69701 81.15 82.54 80.53 6 XM_B_Unicode 66221 72.91 78.42 70.45 7 DCC_CHECK 58598 47.18 69.39 37.24 8 XMListUnsubscribeExists 57894 57.69 68.56 52.83 9 DKIM_VALID_AU 56092 62.55 66.43 60.81 10 XM_B_SpammyWords 51588 48.96 61.09 43.52 11 XM_DK_Undo_02 38856 21.12 46.01 9.96 12 XM_B_Unicode3 36278 43.68 42.96 44.00 13 BAYES_99 32742 17.91 38.77 8.56 14 BAYES_50 31635 48.71 37.46 53.75 15 TR_XM_DKIM_Undo 31187 15.41 36.93 5.77 16 LOC_TINY_FONT_1 30758 29.59 36.42 26.52 17 MIME_HTML_ONLY 29490 27.35 34.92 23.96 18 FVGT_m_MULTI_ODD 28914 27.68 34.24 24.74 19 XM_B_SpammyWords2 28415 23.40 33.65 18.80 20 HTML_FONT_LOW_CONTRAST 27378 29.86 32.42 28.72 21 DCC_CHECK_NEGATIVE 25818 52.79 30.57 62.74 22 BAYES_999 25816 14.46 30.57 7.24 23 RCVD_IN_MSPIKE_H2 24582 23.31 29.11 20.71 24 DKIM_VALID_EF 24032 29.02 28.46 29.27 25 TR_DCC_Bayes_99 23272 10.69 27.56 3.13 26 T_KAM_HTML_FONT_INVALID 20289 19.36 24.03 17.27 27 XM_Body_Dirty_Words 19981 16.02 23.66 12.60 28 RELAYCOUNTRY_META 18796 9.25 22.26 3.42 29 RCVD_IN_MSPIKE_WL 18542 28.37 21.96 31.24 30 XMSubLong 18184 21.76 21.53 21.87 31 T_TM2_M_HEADER_IN_MSG 15830 21.09 18.75 22.14 32 UNPARSEABLE_RELAY 15551 12.38 18.42 9.67 33 TR_XM_UnparsRelay 15113 10.95 17.90 7.84 34 XM_Multi_Part_URI 13926 15.46 16.49 14.99 35 XM_B_Unsub 13577 12.75 16.08 11.26 36 RCVD_IN_MSPIKE_H3 12748 16.06 15.10 16.49 37 FSL_BULK_SIG 11544 7.12 13.67 4.18 38 LOTS_OF_MONEY 10944 9.24 12.96 7.58 39 TR_XM_SpammyWords2 10789 4.80 12.78 1.23 40 XMSexyCombo_05 10540 6.46 12.48 3.76 41 BOTNET_IPINHOSTNAME 10410 7.84 12.33 5.83 42 BOTNET 10350 4.89 12.26 1.58 43 XM_B_SpammyWords3 9432 6.42 11.17 4.29 44 TR_XM_SpammyRelay 9403 4.32 11.14 1.26 45 RCVD_IN_BL_SPAMCOP_NET 9197 4.19 10.89 1.19 46 TR_XM_SpammyWords4 8916 6.07 10.56 4.06 47 MPART_ALT_DIFF 8309 7.10 9.84 5.88 48 XM_SendGrid 8105 7.98 9.60 7.25 49 TM2_M_VERY_LONG_WORD 7713 4.54 9.13 2.48 50 XM_UncommonTLD01 7664 5.96 9.08 4.56 51 HTML_IMAGE_RATIO_02 7598 7.83 9.00 7.31 52 UNTRUSTED_Relay 7515 3.50 8.90 1.08 53 XM_Evil_Numbers_Gen 7193 8.78 8.52 8.90 54 BAYES_80 6922 6.20 8.20 5.30 55 MIME_HTML_ONLY_MULTI 6714 5.27 7.95 4.07 56 TR_XM_MaxUnsub 6670 3.69 7.90 1.81 57 RELAYCOUNTRY_CA 6196 3.13 7.34 1.25 58 XM_H_Long_From01 5998 5.79 7.10 5.20 59 HTML_MIME_NO_HTML_TAG 5954 4.05 7.05 2.70 60 BAYES_60 5736 10.54 6.79 12.22 61 RCVD_IN_MSPIKE_H4 5525 10.59 6.54 12.40 62 XMSubMetaSx_00 5364 4.55 6.35 3.74 63 TR_XM_DK_SendGrid 5159 5.22 6.11 4.82 64 TR_XM_SPAMCOP 4872 1.98 5.77 0.28 65 LotsOfNums_01 4849 8.12 5.74 9.19 66 XMLngstWrd_00 4560 3.05 5.40 2.00 67 XM_GoogleGroups 4534 3.19 5.37 2.22 68 TR_XM_PhishingBody 4528 3.36 5.36 2.47 69 XMLngstWrd_01 4492 2.95 5.32 1.89 70 XMLngstWrd_02 4450 2.84 5.27 1.75 71 XM_B_SpammyTLD 4275 2.95 5.06 2.01 72 RCVD_IN_MSPIKE_BL 4247 2.32 5.03 1.10 73 TooManyTo_001 4224 5.50 5.00 5.72 74 BAYES_95 4191 3.83 4.96 3.32 75 T_XMDrugObfuBody_14 4155 3.44 4.92 2.77 76 TR_XM_MSPIKECOMBO 4126 2.27 4.89 1.10 77 XMLngstWrd_03 4086 2.60 4.84 1.60 78 HTML_TITLE_SUBJ_DIFF 4076 2.26 4.83 1.10 79 XMLngstWrd_04 4050 2.52 4.80 1.50 80 XMNumbers 4044 5.40 4.79 5.68 81 RCVD_IN_VALIDITY_SAFE 4035 6.22 4.78 6.86 82 UPPERCASE_75_100 4022 2.24 4.76 1.11 83 XM_DK_Undo_01 3920 2.32 4.64 1.28 84 XM_SPF_SoftFail 3868 2.27 4.58 1.24 85 T_REMOTE_IMAGE 3757 3.69 4.45 3.34 86 XM_OfRef6 3718 1.94 4.40 0.84 87 XM_B_Phish_Phrases 3635 3.96 4.30 3.80 88 T_XMDrugObfuBody_08 3610 2.47 4.28 1.67 89 HTML_IMAGE_RATIO_04 3585 5.20 4.25 5.63 90 T_FILL_THIS_FORM_SHORT 3572 1.78 4.23 0.68 91 TR_XM_SpammyWords5 3522 2.66 4.17 1.99 92 XM_B_Investor 3481 2.32 4.12 1.51 93 XM_DIRTYINTL 3445 1.46 4.08 0.29 94 RCVD_IN_VALIDITY_CERTIFIED 3358 5.20 3.98 5.75 95 BOTNET_NORDNS 3089 1.16 3.66 0.04 96 PDS_OTHER_BAD_TLD 2987 1.30 3.54 0.30 97 XM_UB50 2902 1.53 3.44 0.68 98 XMStrtUSub 2795 4.86 3.31 5.55 99 RCVD_IN_VALIDITY_RPBL 2751 1.02 3.26 0.01 100 SpammyFromTLD_01 2744 1.29 3.25 0.42 101 XM_B_SpammyWords4 2694 1.48 3.19 0.71 102 T_XMDrugObfuBody_00 2663 1.44 3.15 0.68 103 MIME_HTML_MOSTLY 2572 2.66 3.05 2.49 104 XM_CamelCaseFrm001 2436 2.20 2.88 1.90 105 KHOP_HELO_FCRDNS 2401 1.34 2.84 0.67 106 TM2_M_URI_OPT_OUT 2396 2.61 2.84 2.51 107 USER_IN_DEF_DKIM_WL 2377 12.45 2.81 16.77 108 TR_XM_FormFill 2288 0.84 2.71 0.01 109 XM_H_Undi_Recip 2256 0.96 2.67 0.20 110 T_TooManySym_01 2233 6.44 2.64 8.14 111 SpammyFromTLD_02 2232 1.10 2.64 0.40 112 XM_B_Phish66 2195 1.69 2.60 1.29 113 RCVD_IN_MSPIKE_L3 2111 1.15 2.50 0.54 114 HTML_IMAGE_RATIO_06 2018 3.20 2.39 3.56 115 TR_XM_BayesRelay 1903 0.70 2.25 0.01 116 XMSexyCombo_01 1896 0.97 2.25 0.40 117 SUBJ_ALL_CAPS 1818 1.70 2.15 1.50 118 HTML_IMAGE_RATIO_08 1798 2.00 2.13 1.95 119 TR_XM_SpammyWords3 1796 0.89 2.13 0.34 120 XM_UB99 1795 0.66 2.13 0.00 121 XMBody_17 1786 0.99 2.12 0.48 122 FROM_EXCESS_BASE64 1761 3.56 2.09 4.22 123 RCVD_IN_PSBL 1717 0.81 2.03 0.27 124 DKIM_INVALID 1695 1.93 2.01 1.90 125 GOOGLE_DOC_SUSP 1660 0.61 1.97 0.00 126 TR_XM_MSPIKECOMBO2 1646 0.86 1.95 0.37 127 MIME_QP_LONG_LINE 1627 3.53 1.93 4.25 128 XM_H_Long_From02 1606 1.38 1.90 1.15 129 RCVD_IN_IADB_LISTED 1605 3.82 1.90 4.68 130 BODY_URI_ONLY 1592 0.59 1.89 0.02 131 XM_URI_RBL 1570 0.69 1.86 0.17 132 TR_LOTS_OF_MONEY3 1565 0.72 1.85 0.22 133 TR_XM_PHPDW 1542 0.90 1.83 0.48 134 XMBrknScrpt_02 1498 1.18 1.77 0.91 135 MAILING_LIST_MULTI 1489 1.95 1.76 2.04 136 URI_NOVOWEL 1464 2.21 1.73 2.42 137 XM_B_Unsub2 1434 1.52 1.70 1.44 138 XMGppyBdWords 1427 0.61 1.69 0.13 139 TR_Symld_Words 1416 1.81 1.68 1.88 140 XMStockSpam_06 1414 1.04 1.67 0.75 141 TR_XM_PHPForged 1402 0.79 1.66 0.41 142 TR_XM_FormFill2 1395 0.79 1.65 0.40 143 RCVD_IN_IADB_SPF 1389 3.41 1.64 4.20 144 XM_H_PHPOS 1388 0.78 1.64 0.40 145 XM_UB999 1374 0.50 1.63 0.00 146 TR_XM_NoHeaderRelay 1360 0.60 1.61 0.15 147 URI_HEX 1358 1.32 1.61 1.18 148 XMDiploma_00 1357 1.20 1.61 1.02 149 DKIM_ADSP_CUSTOM_MED 1335 1.06 1.58 0.82 150 T_MONEY_PERCENT 1333 0.66 1.58 0.24 151 TR_LOTS_OF_MONEY2 1333 0.66 1.58 0.24 152 RCVD_IN_IADB_DK 1323 3.06 1.57 3.72 153 XMBdyGiftCard01 1320 1.29 1.56 1.17 154 TR_Mismatch_TLD_02 1318 0.54 1.56 0.09 155 RCVD_IN_MSPIKE_L5 1300 0.49 1.54 0.03 156 RCVD_IN_IADB_SENDERID 1295 3.12 1.53 3.83 157 XMPhish30 1281 0.92 1.52 0.65 158 RELAYCOUNTRY_RU 1274 0.48 1.51 0.02 159 HTTPS_HTTP_MISMATCH 1256 0.87 1.49 0.59 160 NML_ADSP_CUSTOM_MED 1253 0.80 1.48 0.49 161 BAYES_40 1218 3.25 1.44 4.06 162 FORGED_GMAIL_RCVD 1218 0.78 1.44 0.48 163 T_HTML_TAG_BALANCE_CENTER 1217 0.54 1.44 0.14 164 T_Symld_Words_02 1201 0.75 1.42 0.45 165 XM_ProductURIs 1182 0.97 1.40 0.78 166 FROM_SUSPICIOUS_NTLD 1166 0.48 1.38 0.07 167 XMSubMetaD_00 1158 0.48 1.37 0.08 168 FROM_SUSPICIOUS_NTLD_FP 1135 0.46 1.34 0.07 169 DIET_1 1134 0.71 1.34 0.43 170 RELAYCOUNTRY_AU 1088 0.52 1.29 0.18 171 URIBL_SBL_A 1082 0.41 1.28 0.02 172 XMObfuSubjects 1076 0.41 1.27 0.03 173 PDS_FROM_2_EMAILS 1076 0.40 1.27 0.01 174 RELAYCOUNTRY_FR 1046 0.53 1.24 0.21 175 FROM_2_EMAILS_SHORT 1044 0.39 1.24 0.00 176 T_XMHurry_00 1040 0.77 1.23 0.56 177 XM_B_REG_HTML 1037 0.67 1.23 0.43 178 XMSubject_38 1024 0.39 1.21 0.02 179 XMHTMLBadTable_001 1012 0.75 1.20 0.55 180 XMSubMetaD_01 1009 0.37 1.19 0.01 181 PDS_TO_EQ_FROM_NAME 1000 0.37 1.18 0.00 182 T_TooManySym_02 979 3.65 1.16 4.77 183 TR_XM_SB_Phish 968 1.52 1.15 1.69 184 RCVD_IN_IADB_VOUCHED 963 2.36 1.14 2.90 185 LongTLD 960 0.48 1.14 0.18 186 ALL_TRUSTED 957 12.25 1.13 17.23 187 XM_HighProb1 945 0.35 1.12 0.00 188 SHOPIFY_IMG_NOT_RCVD_SFY 944 0.54 1.12 0.27 189 XMSubPhish11 928 1.50 1.10 1.68 190 XMClaimOffer 927 0.40 1.10 0.08 191 BAYES_20 925 2.16 1.10 2.63 192 LONG_JUNK_URI 919 0.36 1.09 0.03 193 MIME_CHARSET_FARAWAY 912 0.53 1.08 0.28 194 XM_UB60 912 0.38 1.08 0.06 195 URIBL_BLACK 911 0.35 1.08 0.02 196 TR_Mismatch_TLD_01 899 0.51 1.06 0.27 197 NAME_EMAIL_DIFF 899 0.42 1.06 0.13 198 HTML_IMAGE_ONLY_08 895 0.41 1.06 0.12 199 THIS_AD 894 0.65 1.06 0.46 200 FROM_MULTI_NORDNS 888 0.33 1.05 0.00 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156854 86.25 93.05 83.20 2 RELAYCOUNTRY_US 151829 81.15 82.54 80.53 3 DKIM_SIGNED 145184 79.98 86.63 77.01 4 XM_DK_Pass 142532 78.59 85.26 75.60 5 DKIM_VALID 141610 78.05 84.62 75.11 6 XM_B_Unicode 132814 72.91 78.42 70.45 7 DCC_CHECK_NEGATIVE 118284 52.79 30.57 62.74 8 DKIM_VALID_AU 114646 62.55 66.43 60.81 9 BAYES_50 101342 48.71 37.46 53.75 10 XMListUnsubscribeExists 99597 57.69 68.56 52.83 11 XM_B_Unicode3 82953 43.68 42.96 44.00 12 XM_B_SpammyWords 82053 48.96 61.09 43.52 13 DCC_CHECK 70203 47.18 69.39 37.24 14 RCVD_IN_MSPIKE_WL 58897 28.37 21.96 31.24 15 DKIM_VALID_EF 55186 29.02 28.46 29.27 16 HTML_FONT_LOW_CONTRAST 54141 29.86 32.42 28.72 17 LOC_TINY_FONT_1 50005 29.59 36.42 26.52 18 FVGT_m_MULTI_ODD 46645 27.68 34.24 24.74 19 MIME_HTML_ONLY 45173 27.35 34.92 23.96 20 T_TM2_M_HEADER_IN_MSG 41741 21.09 18.75 22.14 21 XMSubLong 41224 21.76 21.53 21.87 22 RCVD_IN_MSPIKE_H2 39049 23.31 29.11 20.71 23 XM_B_SpammyWords2 35450 23.40 33.65 18.80 24 T_KAM_HTML_FONT_INVALID 32552 19.36 24.03 17.27 25 ALL_TRUSTED 32493 12.25 1.13 17.23 26 USER_IN_DEF_DKIM_WL 31612 12.45 2.81 16.77 27 RCVD_IN_MSPIKE_H3 31092 16.06 15.10 16.49 28 XM_Multi_Part_URI 28265 15.46 16.49 14.99 29 XM_Body_Dirty_Words 23746 16.02 23.66 12.60 30 RCVD_IN_MSPIKE_H4 23381 10.59 6.54 12.40 31 BAYES_60 23035 10.54 6.79 12.22 32 XM_DKIMWhitelistDomains 21643 7.94 0.03 11.48 33 XM_B_Unsub 21232 12.75 16.08 11.26 34 XM_DK_Undo_02 18784 21.12 46.01 9.96 35 UNPARSEABLE_RELAY 18233 12.38 18.42 9.67 36 LotsOfNums_01 17330 8.12 5.74 9.19 37 XM_Evil_Numbers_Gen 16783 8.78 8.52 8.90 38 BAYES_99 16144 17.91 38.77 8.56 39 BAYES_00 15980 6.08 0.72 8.48 40 T_TooManySym_01 15346 6.44 2.64 8.14 41 TR_XM_UnparsRelay 14789 10.95 17.90 7.84 42 LOTS_OF_MONEY 14282 9.24 12.96 7.58 43 HTML_IMAGE_RATIO_02 13781 7.83 9.00 7.31 44 XM_SendGrid 13676 7.98 9.60 7.25 45 BAYES_999 13646 14.46 30.57 7.24 46 RCVD_IN_VALIDITY_SAFE 12940 6.22 4.78 6.86 47 TR_XM_DK_Bayes 11961 4.56 0.58 6.34 48 TR_XM_DK_Bayes1 11856 4.52 0.57 6.29 49 MPART_ALT_DIFF 11086 7.10 9.84 5.88 50 BOTNET_IPINHOSTNAME 10984 7.84 12.33 5.83 51 IN_ZIMBRA_NJ_WHITELIST 10922 4.03 0.09 5.79 52 TR_XM_DKIM_Undo 10878 15.41 36.93 5.77 53 TR_XM_DK_Bayes2 10865 4.10 0.39 5.76 54 RCVD_IN_VALIDITY_CERTIFIED 10837 5.20 3.98 5.75 55 TooManyTo_001 10789 5.50 5.00 5.72 56 XMNumbers 10706 5.40 4.79 5.68 57 HTML_IMAGE_RATIO_04 10613 5.20 4.25 5.63 58 XMStrtUSub 10473 4.86 3.31 5.55 59 BAYES_80 10001 6.20 8.20 5.30 60 XM_H_Long_From01 9797 5.79 7.10 5.20 61 TR_XM_DK_SendGrid 9082 5.22 6.11 4.82 62 T_TooManySym_02 8988 3.65 1.16 4.77 63 RCVD_IN_IADB_LISTED 8823 3.82 1.90 4.68 64 XM_UncommonTLD01 8594 5.96 9.08 4.56 65 XM_B_SpammyWords3 8088 6.42 11.17 4.29 66 MIME_QP_LONG_LINE 8006 3.53 1.93 4.25 67 FROM_EXCESS_BASE64 7947 3.56 2.09 4.22 68 RCVD_IN_IADB_SPF 7923 3.41 1.64 4.20 69 FSL_BULK_SIG 7880 7.12 13.67 4.18 70 MIME_HTML_ONLY_MULTI 7668 5.27 7.95 4.07 71 TR_XM_SpammyWords4 7649 6.07 10.56 4.06 72 BAYES_40 7646 3.25 1.44 4.06 73 RCVD_IN_IADB_SENDERID 7229 3.12 1.53 3.83 74 XM_B_Phish_Phrases 7167 3.96 4.30 3.80 75 XMSexyCombo_05 7094 6.46 12.48 3.76 76 XMSubMetaSx_00 7048 4.55 6.35 3.74 77 INVALID_MSGID 7025 2.66 0.26 3.73 78 RCVD_IN_IADB_DK 7019 3.06 1.57 3.72 79 HTML_IMAGE_RATIO_06 6720 3.20 2.39 3.56 80 MSGID_NOFQDN1 6644 2.45 0.05 3.52 81 RELAYCOUNTRY_META 6444 9.25 22.26 3.42 82 T_REMOTE_IMAGE 6305 3.69 4.45 3.34 83 BAYES_95 6265 3.83 4.96 3.32 84 ANY_BOUNCE_MESSAGE 6224 2.49 0.69 3.30 85 BOUNCE_MESSAGE 6223 2.49 0.69 3.30 86 TO_MALFORMED 6010 2.22 0.07 3.19 87 TR_DCC_Bayes_99 5896 10.69 27.56 3.13 88 RCVD_IN_IADB_VOUCHED 5474 2.36 1.14 2.90 89 XM_H_Trusted_IP 5422 1.99 0.00 2.88 90 T_XMDrugObfuBody_14 5225 3.44 4.92 2.77 91 HTML_MIME_NO_HTML_TAG 5092 4.05 7.05 2.70 92 XM_PDF 5060 1.98 0.41 2.68 93 BAYES_20 4961 2.16 1.10 2.63 94 TM2_M_URI_OPT_OUT 4741 2.61 2.84 2.51 95 MIME_HTML_MOSTLY 4694 2.66 3.05 2.49 96 TM2_M_VERY_LONG_WORD 4682 4.54 9.13 2.48 97 TVD_RCVD_IP 4672 1.86 0.48 2.48 98 TR_XM_PhishingBody 4651 3.36 5.36 2.47 99 URI_NOVOWEL 4563 2.21 1.73 2.42 100 RCVD_IN_MSPIKE_H5 4424 1.72 0.32 2.35 101 XM_GoogleGroups 4179 3.19 5.37 2.22 102 IN_HORDE_ADDRESS_BOOK 4112 1.60 0.31 2.18 103 MAILING_LIST_MULTI 3841 1.95 1.76 2.04 104 XM_B_SpammyTLD 3790 2.95 5.06 2.01 105 XMLngstWrd_00 3772 3.05 5.40 2.00 106 TR_XM_SpammyWords5 3743 2.66 4.17 1.99 107 HTML_IMAGE_RATIO_08 3667 2.00 2.13 1.95 108 XM_CamelCaseFrm001 3579 2.20 2.88 1.90 109 DKIM_INVALID 3574 1.93 2.01 1.90 110 RCVD_IN_IADB_OPTIN 3570 1.50 0.63 1.89 111 XMLngstWrd_01 3563 2.95 5.32 1.89 112 TR_Symld_Words 3538 1.81 1.68 1.88 113 TR_XM_MaxUnsub 3410 3.69 7.90 1.81 114 XMBSHREFv2 3399 1.29 0.15 1.80 115 TVD_SPACE_RATIO 3338 1.52 0.96 1.77 116 XMGappySubj_01 3329 1.24 0.05 1.77 117 XMLngstWrd_02 3305 2.84 5.27 1.75 118 TR_XM_SB_Phish 3183 1.52 1.15 1.69 119 XMSubPhish11 3162 1.50 1.10 1.68 120 BAYES_05 3156 1.32 0.52 1.67 121 T_XMDrugObfuBody_08 3144 2.47 4.28 1.67 122 XMLngstWrd_03 3021 2.60 4.84 1.60 123 BOTNET 2985 4.89 12.26 1.58 124 XM_B_Investor 2846 2.32 4.12 1.51 125 SUBJ_ALL_CAPS 2834 1.70 2.15 1.50 126 XMLngstWrd_04 2830 2.52 4.80 1.50 127 XM_B_Unsub2 2715 1.52 1.70 1.44 128 XM_D_tchamptons_WL 2643 0.97 0.00 1.40 129 RCVD_IN_RP_SAFE 2469 1.22 1.02 1.31 130 XM_B_Phish66 2430 1.69 2.60 1.29 131 XM_DK_Undo_01 2409 2.32 4.64 1.28 132 TR_XM_SpammyRelay 2377 4.32 11.14 1.26 133 RELAYCOUNTRY_CA 2349 3.13 7.34 1.25 134 XM_SPF_SoftFail 2331 2.27 4.58 1.24 135 TR_XM_SpammyWords2 2324 4.80 12.78 1.23 136 RCVD_IN_BL_SPAMCOP_NET 2248 4.19 10.89 1.19 137 URI_HEX 2234 1.32 1.61 1.18 138 XMBdyGiftCard01 2198 1.29 1.56 1.17 139 XM_H_Long_From02 2174 1.38 1.90 1.15 140 RCVD_IN_RP_CERTIFIED 2103 1.02 0.80 1.12 141 UPPERCASE_75_100 2097 2.24 4.76 1.11 142 HTML_TITLE_SUBJ_DIFF 2083 2.26 4.83 1.10 143 RCVD_IN_MSPIKE_BL 2079 2.32 5.03 1.10 144 TR_XM_MSPIKECOMBO 2073 2.27 4.89 1.10 145 UNTRUSTED_Relay 2027 3.50 8.90 1.08 146 XMBody_95 2013 0.75 0.05 1.07 147 TooManyTo_002 2005 0.94 0.66 1.06 148 XMDiploma_00 1923 1.20 1.61 1.02 149 T_TooManySym_03 1874 0.82 0.43 0.99 150 XMSubNoVowel 1833 0.89 0.71 0.97 151 HTML_FONT_FACE_BAD 1796 0.87 0.68 0.95 152 XM_B_COVIDMETA 1779 0.90 0.80 0.94 153 XMBrknScrpt_02 1714 1.18 1.77 0.91 154 HTML_IMAGE_ONLY_20 1711 0.78 0.48 0.91 155 XM_B_COPY_HTML 1619 0.84 0.79 0.86 156 XM_OfRef6 1577 1.94 4.40 0.84 157 TR_MetaPhish_Combo_01 1571 0.89 1.01 0.83 158 DKIM_ADSP_CUSTOM_MED 1549 1.06 1.58 0.82 159 XMSubMetaI_00 1517 0.84 0.92 0.80 160 TooManyTo_003 1471 0.73 0.61 0.78 161 XM_ProductURIs 1462 0.97 1.40 0.78 162 XMStockSpam_06 1417 1.04 1.67 0.75 163 HTML_TAG_BALANCE_BODY 1398 0.78 0.88 0.74 164 MPART_ALT_DIFF_COUNT 1338 0.75 0.83 0.71 165 XM_B_SpammyWords4 1335 1.48 3.19 0.71 166 USER_IN_WELCOMELIST 1309 0.48 0.00 0.69 167 USER_IN_WHITELIST 1309 0.48 0.00 0.69 168 URI_TRY_3LD 1303 0.76 0.92 0.69 169 T_FILL_THIS_FORM_SHORT 1291 1.78 4.23 0.68 170 XM_UB50 1279 1.53 3.44 0.68 171 T_XMDrugObfuBody_00 1276 1.44 3.15 0.68 172 KHOP_HELO_FCRDNS 1268 1.34 2.84 0.67 173 XMPhish30 1223 0.92 1.52 0.65 174 RDNS_DYNAMIC 1210 0.77 1.04 0.64 175 XM_H_PHPMailer 1208 0.62 0.57 0.64 176 XMSubMetaSxObfu_02 1146 0.60 0.59 0.61 177 HTTPS_HTTP_MISMATCH 1116 0.87 1.49 0.59 178 TooManyTo_004 1087 0.58 0.58 0.58 179 PLING_QUERY 1075 0.59 0.65 0.57 180 TM2_M_A_HREF_HREF 1069 0.68 0.92 0.57 181 TM2_M_BODY_EMPTY 1055 0.44 0.19 0.56 182 T_XMHurry_00 1053 0.77 1.23 0.56 183 XMHTMLBadTable_001 1040 0.75 1.20 0.55 184 RCVD_IN_MSPIKE_L3 1026 1.15 2.50 0.54 185 RCVD_IN_MSPIKE_L4 999 0.63 0.85 0.53 186 TR_XM_INV_DKIM 992 0.52 0.52 0.53 187 XMGenDplmaNmb 961 0.58 0.74 0.51 188 TooManyTo_005 940 0.51 0.55 0.50 189 RELAYCOUNTRY_GB 936 0.65 0.99 0.50 190 NML_ADSP_CUSTOM_MED 927 0.80 1.48 0.49 191 XMHTML_After_End 918 0.65 1.00 0.49 192 FORGED_GMAIL_RCVD 910 0.78 1.44 0.48 193 TR_XM_PHPDW 908 0.90 1.83 0.48 194 XMBody_17 907 0.99 2.12 0.48 195 THIS_AD 872 0.65 1.06 0.46 196 T_OBFU_PDF_ATTACH 864 0.35 0.12 0.46 197 XMSubMetaSxObfu_03 860 0.63 1.03 0.46 198 T_Symld_Words_02 841 0.75 1.42 0.45 199 DIET_1 804 0.71 1.34 0.43 200 XM_B_REG_HTML 802 0.67 1.23 0.43 ----------------------------------------------------------------------