Email: 277726 Autolearn: 0 AvgScore: 2.88 AvgScanTime: 1.19 sec Spam: 90839 Autolearn: 0 AvgScore: 13.94 AvgScanTime: 1.31 sec Ham: 186887 Autolearn: 0 AvgScore: -2.49 AvgScanTime: 1.13 sec Time Spent Running SA: 91.81 hours Time Spent Processing Spam: 33.08 hours Time Spent Processing Ham: 58.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 83534 86.45 91.96 83.77 2 DKIM_SIGNED 77407 79.44 85.21 76.63 3 XM_DK_Pass 75461 77.75 83.07 75.16 4 DKIM_VALID 74683 77.18 82.21 74.73 5 XM_B_Unicode 73835 74.97 81.28 71.90 6 RELAYCOUNTRY_US 71772 80.10 79.01 80.63 7 DCC_CHECK 62457 48.42 68.76 38.54 8 XM_B_SpammyWords 61557 53.32 67.76 46.31 9 XMListUnsubscribeExists 61438 58.03 67.63 53.36 10 DKIM_VALID_AU 57895 61.80 63.73 60.87 11 XM_DK_Undo_02 42957 22.00 47.29 9.70 12 XM_B_Unicode3 39609 44.45 43.60 44.87 13 BAYES_99 36256 18.68 39.91 8.36 14 TR_XM_DKIM_Undo 33434 15.88 36.81 5.71 15 XM_B_SpammyWords2 32695 25.75 35.99 20.78 16 LOC_TINY_FONT_1 32194 30.36 35.44 27.90 17 BAYES_50 31884 48.41 35.10 54.87 18 HTML_FONT_LOW_CONTRAST 29193 30.72 32.14 30.03 19 BAYES_999 29003 15.16 31.93 7.00 20 DCC_CHECK_NEGATIVE 28367 51.56 31.23 61.44 21 MIME_HTML_ONLY 27671 25.91 30.46 23.69 22 DKIM_VALID_EF 26421 29.62 29.09 29.88 23 FVGT_m_MULTI_ODD 25307 26.41 27.86 25.71 24 TR_DCC_Bayes_99 24723 10.80 27.22 2.82 25 T_KAM_HTML_FONT_INVALID 22260 20.54 24.50 18.61 26 XM_Body_Dirty_Words 20850 16.61 22.95 13.53 27 RCVD_IN_MSPIKE_H2 20394 20.64 22.45 19.76 28 RCVD_IN_MSPIKE_WL 19110 28.45 21.04 32.06 29 T_TM2_M_HEADER_IN_MSG 18277 21.87 20.12 22.72 30 XMSubLong 17580 21.82 19.35 23.03 31 RELAYCOUNTRY_META 16841 8.10 18.54 3.02 32 XM_Multi_Part_URI 15138 15.04 16.66 14.25 33 LOTS_OF_MONEY 13589 11.32 14.96 9.56 34 UNPARSEABLE_RELAY 13388 11.46 14.74 9.87 35 XM_B_Unsub 13212 12.93 14.54 12.14 36 TR_XM_UnparsRelay 13057 9.98 14.37 7.84 37 RCVD_IN_MSPIKE_H3 12212 15.57 13.44 16.61 38 FSL_BULK_SIG 11855 6.99 13.05 4.05 39 XM_B_SpammyWords3 11143 7.29 12.27 4.88 40 TR_XM_SpammyRelay 11059 4.98 12.17 1.48 41 TR_XM_SpammyWords4 11000 7.84 12.11 5.77 42 UNTRUSTED_Relay 10846 4.74 11.94 1.25 43 TR_XM_SpammyWords2 10606 4.69 11.68 1.29 44 XMSexyCombo_05 10064 6.98 11.08 4.99 45 RCVD_IN_BL_SPAMCOP_NET 9607 4.22 10.58 1.13 46 RCVD_IN_MSPIKE_BL 9524 4.23 10.48 1.18 47 BOTNET_IPINHOSTNAME 9503 7.69 10.46 6.34 48 BOTNET 9403 4.47 10.35 1.62 49 XM_UncommonTLD01 8962 6.38 9.87 4.68 50 RELAYCOUNTRY_CA 7503 3.29 8.26 0.88 51 BAYES_80 7361 6.00 8.10 4.98 52 XM_SendGrid 7294 7.35 8.03 7.02 53 TR_XM_MaxUnsub 6759 3.57 7.44 1.69 54 XM_UB50 6584 2.90 7.25 0.78 55 RCVD_IN_MSPIKE_H4 6573 11.37 7.24 13.38 56 HTML_IMAGE_RATIO_02 6478 7.72 7.13 8.01 57 XM_Evil_Numbers_Gen 6411 8.69 7.06 9.48 58 BAYES_60 6096 10.36 6.71 12.13 59 TM2_M_URI_OPT_OUT 5986 4.64 6.59 3.69 60 TR_XM_MSPIKECOMBO 5922 2.93 6.52 1.18 61 TR_XM_SPAMCOP 5667 2.31 6.24 0.39 62 MIME_QP_LONG_LINE 5511 5.13 6.07 4.68 63 XMSubMetaSx_00 5506 5.46 6.06 5.17 64 SpammyFromTLD_01 5251 2.28 5.78 0.58 65 XM_SPF_SoftFail 5179 3.25 5.70 2.06 66 TR_XM_DK_SendGrid 5164 5.07 5.68 4.77 67 LotsOfNums_01 5136 7.78 5.65 8.81 68 TR_XM_PhishingBody 5106 3.57 5.62 2.57 69 XM_B_Phish_Phrases 5105 4.06 5.62 3.29 70 MPART_ALT_DIFF 5104 5.18 5.62 4.97 71 XMNumbers 4994 5.14 5.50 4.97 72 XM_H_Long_From01 4863 5.28 5.35 5.24 73 BAYES_95 4438 3.78 4.89 3.25 74 T_REMOTE_IMAGE 4384 4.05 4.83 3.68 75 TR_XM_PHPDW 4350 1.96 4.79 0.58 76 RCVD_IN_VALIDITY_SAFE 4320 5.76 4.76 6.25 77 TR_XM_PHPForged 4302 1.89 4.74 0.50 78 T_Symld_Words_02 4283 1.83 4.71 0.43 79 TR_XM_FormFill2 4269 1.88 4.70 0.50 80 XM_H_PHPOS 4261 1.86 4.69 0.49 81 HTML_IMAGE_RATIO_04 4202 5.74 4.63 6.28 82 TR_XM_COVIDMETA4 4200 1.58 4.62 0.10 83 TooManyTo_001 4119 5.71 4.53 6.28 84 HELO_NODOT 4041 1.85 4.45 0.59 85 HELO_NO_DOMAIN 4040 1.85 4.45 0.59 86 XM_B_Investor 4022 2.23 4.43 1.17 87 T_XMDrugObfuBody_14 3935 2.89 4.33 2.20 88 MISSING_HEADERS 3884 1.55 4.28 0.22 89 XM_DIRTYINTL 3841 1.61 4.23 0.33 90 RCVD_IN_VALIDITY_CERTIFIED 3714 5.04 4.09 5.51 91 REPLYTO_WITHOUT_TO_CC 3693 1.35 4.07 0.02 92 RELAYCOUNTRY_NG_I 3607 1.30 3.97 0.00 93 RCVD_IN_MSPIKE_ZBI 3602 1.30 3.97 0.00 94 UReplyToMismatch 3585 1.29 3.95 0.00 95 HTML_IMAGE_RATIO_06 3490 3.36 3.84 3.13 96 XMStrtUSub 3394 4.88 3.74 5.44 97 TR_XM_SpammyWords5 3266 2.19 3.60 1.51 98 XM_B_SpammyTLD 3171 2.43 3.49 1.91 99 T_XMDrugObfuBody_08 3054 1.89 3.36 1.17 100 TR_XM_MSPIKECOMBO2 2968 1.32 3.27 0.37 101 T_TooManySym_01 2962 6.08 3.26 7.45 102 XM_OfRef6 2961 1.53 3.26 0.69 103 RCVD_IN_MSPIKE_L3 2949 1.67 3.25 0.90 104 MIME_HTML_ONLY_MULTI 2881 3.21 3.17 3.22 105 MIME_HTML_MOSTLY 2847 2.81 3.13 2.65 106 TM2_M_BODY_EMPTY 2758 1.20 3.04 0.30 107 RCVD_IN_VALIDITY_RPBL 2741 1.07 3.02 0.12 108 XMEmptyBody_01 2730 1.08 3.01 0.15 109 DKIM_INVALID 2724 2.26 3.00 1.90 110 TM2_M_VERY_LONG_WORD 2703 2.00 2.98 1.52 111 XM_B_Phish66 2582 1.69 2.84 1.13 112 TR_XM_SpammyWords3 2535 1.15 2.79 0.36 113 BOTNET_NORDNS 2463 0.90 2.71 0.02 114 SUBJ_ALL_CAPS 2427 1.72 2.67 1.26 115 RCVD_IN_MSPIKE_L5 2422 0.89 2.67 0.03 116 XM_CamelCaseFrm001 2422 2.12 2.67 1.86 117 USER_IN_DEF_DKIM_WL 2379 12.43 2.62 17.19 118 KHOP_HELO_FCRDNS 2334 1.85 2.57 1.51 119 XM_B_Unsub2 2154 1.56 2.37 1.16 120 RCVD_IN_PSBL 2136 0.88 2.35 0.17 121 XM_UB99 2124 0.77 2.34 0.00 122 T_FILL_THIS_FORM_SHORT 2111 1.08 2.32 0.47 123 HTML_IMAGE_RATIO_08 2109 1.98 2.32 1.81 124 URIBL_DBL_SPAM 1955 0.71 2.15 0.01 125 XM_H_Long_From02 1937 1.29 2.13 0.88 126 URI_NOVOWEL 1924 2.48 2.12 2.65 127 RCVD_IN_IADB_LISTED 1882 3.67 2.07 4.44 128 XM_B_SpammyWords4 1880 1.05 2.07 0.56 129 T_XMDrugObfuBody_00 1832 1.37 2.02 1.05 130 TR_XM_SB_Phish 1827 1.86 2.01 1.79 131 XMDiploma_00 1825 1.54 2.01 1.31 132 PDS_OTHER_BAD_TLD 1816 0.89 2.00 0.35 133 XMBody_17 1787 0.98 1.97 0.50 134 HTML_MIME_NO_HTML_TAG 1768 1.87 1.95 1.83 135 TR_XM_BayesRelay 1766 0.64 1.94 0.01 136 FROM_EXCESS_BASE64 1763 3.27 1.94 3.91 137 BAYES_20 1756 2.30 1.93 2.48 138 HTTPS_HTTP_MISMATCH 1725 0.99 1.90 0.55 139 BAYES_40 1711 2.91 1.88 3.40 140 MAILING_LIST_MULTI 1660 1.92 1.83 1.97 141 XM_UB999 1649 0.59 1.82 0.00 142 XMHTML_After_End 1647 0.96 1.81 0.54 143 TR_XM_MaxSPIKE 1643 0.77 1.81 0.27 144 URI_HEX 1605 1.38 1.77 1.19 145 XM_DK_Undo_01 1594 1.46 1.75 1.32 146 T_XMHurry_00 1574 0.86 1.73 0.44 147 XMSubPhish11 1568 1.75 1.73 1.76 148 DIET_1 1544 0.88 1.70 0.48 149 XMSexyCombo_01 1532 1.49 1.69 1.39 150 RCVD_IN_IADB_SPF 1527 3.20 1.68 3.94 151 HK_RANDOM_REPLYTO 1521 0.64 1.67 0.14 152 ALL_TRUSTED 1506 11.90 1.66 16.88 153 TR_Symld_Words 1497 2.39 1.65 2.75 154 SpammyFromTLD_02 1462 0.65 1.61 0.18 155 XMStockSpam_06 1452 1.69 1.60 1.73 156 XMSubMetaI_00 1434 0.90 1.58 0.57 157 TM2_M_A_HREF_HREF 1387 1.03 1.53 0.79 158 HTML_TAG_BALANCE_BODY 1382 1.08 1.52 0.87 159 XMBdyGiftCard01 1378 1.35 1.52 1.26 160 RCVD_IN_IADB_DK 1374 2.77 1.51 3.38 161 RCVD_IN_IADB_SENDERID 1321 2.86 1.45 3.54 162 DKIM_ADSP_CUSTOM_MED 1304 1.01 1.44 0.81 163 TR_Caps_n_Bayes_99 1296 0.60 1.43 0.20 164 TR_XM_NoHeaderRelay 1261 0.53 1.39 0.11 165 NML_ADSP_CUSTOM_MED 1253 0.78 1.38 0.48 166 HTML_IMAGE_ONLY_16 1251 0.55 1.38 0.15 167 RCVD_IN_IADB_VOUCHED 1241 2.45 1.37 2.98 168 TR_XM_FormFill 1230 0.45 1.35 0.01 169 XM_URI_RBL 1230 0.53 1.35 0.13 170 TR_LOTS_OF_MONEY3 1187 0.59 1.31 0.24 171 XMSubNoVowel 1173 1.04 1.29 0.92 172 FORGED_GMAIL_RCVD 1173 0.74 1.29 0.47 173 HTML_FONT_TINY_NORDNS 1154 0.46 1.27 0.06 174 MPART_ALT_DIFF_COUNT 1117 1.02 1.23 0.92 175 XMReplyNow 1093 0.57 1.20 0.26 176 RELAYCOUNTRY_AU 1091 0.53 1.20 0.21 177 XMPhish30 1060 0.91 1.17 0.78 178 XMGenDplmaNmb 1050 0.83 1.16 0.67 179 TR_BOTNET_NEGATE 1046 0.61 1.15 0.34 180 TR_Mismatch_TLD_02 1044 0.43 1.15 0.08 181 ANY_BOUNCE_MESSAGE 1035 2.96 1.14 3.84 182 BOUNCE_MESSAGE 1034 2.96 1.14 3.84 183 XM_OfRef7 1022 0.44 1.13 0.11 184 XM_B_REG_HTML 1018 0.69 1.12 0.49 185 XM_ProductURIs 1014 1.42 1.12 1.57 186 XM_B_COVIDMETA 1003 0.73 1.10 0.55 187 XM_B_COPY_HTML 998 0.99 1.10 0.94 188 XMHTMLBadTable_001 994 0.87 1.09 0.76 189 MIME_CHARSET_FARAWAY 991 0.52 1.09 0.24 190 SHOPIFY_IMG_NOT_RCVD_SFY 941 0.49 1.04 0.22 191 TR_XM_COVIDMETA1 923 0.41 1.02 0.11 192 MONEY_NOHTML 901 0.37 0.99 0.07 193 RELAYCOUNTRY_FR 899 0.45 0.99 0.19 194 LOADSA_MONEY_COMBO 890 0.34 0.98 0.03 195 FILL_THIS_FORM 888 0.51 0.98 0.28 196 TR_Mismatch_TLD_01 885 0.46 0.97 0.21 197 RELAYCOUNTRY_RU 885 0.34 0.97 0.03 198 RCVD_IN_RP_SAFE 873 1.18 0.96 1.29 199 XM_Body_Dirty_Words_01 863 0.43 0.95 0.18 200 XMPhish08 861 0.45 0.95 0.21 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 156549 86.45 91.96 83.77 2 RELAYCOUNTRY_US 150686 80.10 79.01 80.63 3 DKIM_SIGNED 143208 79.44 85.21 76.63 4 XM_DK_Pass 140464 77.75 83.07 75.16 5 DKIM_VALID 139662 77.18 82.21 74.73 6 XM_B_Unicode 134368 74.97 81.28 71.90 7 DCC_CHECK_NEGATIVE 114831 51.56 31.23 61.44 8 DKIM_VALID_AU 113749 61.80 63.73 60.87 9 BAYES_50 102552 48.41 35.10 54.87 10 XMListUnsubscribeExists 99717 58.03 67.63 53.36 11 XM_B_SpammyWords 86540 53.32 67.76 46.31 12 XM_B_Unicode3 83849 44.45 43.60 44.87 13 DCC_CHECK 72019 48.42 68.76 38.54 14 RCVD_IN_MSPIKE_WL 59907 28.45 21.04 32.06 15 HTML_FONT_LOW_CONTRAST 56115 30.72 32.14 30.03 16 DKIM_VALID_EF 55834 29.62 29.09 29.88 17 LOC_TINY_FONT_1 52135 30.36 35.44 27.90 18 FVGT_m_MULTI_ODD 48041 26.41 27.86 25.71 19 MIME_HTML_ONLY 44281 25.91 30.46 23.69 20 XMSubLong 43031 21.82 19.35 23.03 21 T_TM2_M_HEADER_IN_MSG 42458 21.87 20.12 22.72 22 XM_B_SpammyWords2 38830 25.75 35.99 20.78 23 RCVD_IN_MSPIKE_H2 36922 20.64 22.45 19.76 24 T_KAM_HTML_FONT_INVALID 34777 20.54 24.50 18.61 25 USER_IN_DEF_DKIM_WL 32131 12.43 2.62 17.19 26 ALL_TRUSTED 31543 11.90 1.66 16.88 27 RCVD_IN_MSPIKE_H3 31037 15.57 13.44 16.61 28 XM_Multi_Part_URI 26638 15.04 16.66 14.25 29 XM_Body_Dirty_Words 25285 16.61 22.95 13.53 30 RCVD_IN_MSPIKE_H4 24997 11.37 7.24 13.38 31 XM_DKIMWhitelistDomains 23837 8.66 0.24 12.75 32 XM_B_Unsub 22687 12.93 14.54 12.14 33 BAYES_60 22668 10.36 6.71 12.13 34 UNPARSEABLE_RELAY 18443 11.46 14.74 9.87 35 XM_DK_Undo_02 18131 22.00 47.29 9.70 36 LOTS_OF_MONEY 17862 11.32 14.96 9.56 37 XM_Evil_Numbers_Gen 17711 8.69 7.06 9.48 38 BAYES_00 16655 6.18 0.56 8.91 39 LotsOfNums_01 16459 7.78 5.65 8.81 40 BAYES_99 15623 18.68 39.91 8.36 41 HTML_IMAGE_RATIO_02 14970 7.72 7.13 8.01 42 TR_XM_UnparsRelay 14653 9.98 14.37 7.84 43 T_TooManySym_01 13921 6.08 3.26 7.45 44 XM_SendGrid 13114 7.35 8.03 7.02 45 BAYES_999 13088 15.16 31.93 7.00 46 BOTNET_IPINHOSTNAME 11841 7.69 10.46 6.34 47 HTML_IMAGE_RATIO_04 11742 5.74 4.63 6.28 48 TooManyTo_001 11738 5.71 4.53 6.28 49 RCVD_IN_VALIDITY_SAFE 11681 5.76 4.76 6.25 50 TR_XM_DK_Bayes 11659 4.34 0.44 6.24 51 TR_XM_DK_Bayes1 11547 4.30 0.44 6.18 52 TR_XM_SpammyWords4 10782 7.84 12.11 5.77 53 IN_ZIMBRA_NJ_WHITELIST 10775 3.90 0.08 5.77 54 TR_XM_DKIM_Undo 10674 15.88 36.81 5.71 55 TR_XM_DK_Bayes2 10443 3.86 0.31 5.59 56 RCVD_IN_VALIDITY_CERTIFIED 10293 5.04 4.09 5.51 57 XMStrtUSub 10163 4.88 3.74 5.44 58 XM_H_Long_From01 9788 5.28 5.35 5.24 59 XMSubMetaSx_00 9669 5.46 6.06 5.17 60 XMSexyCombo_05 9334 6.98 11.08 4.99 61 BAYES_80 9305 6.00 8.10 4.98 62 XMNumbers 9282 5.14 5.50 4.97 63 MPART_ALT_DIFF 9281 5.18 5.62 4.97 64 XM_B_SpammyWords3 9114 7.29 12.27 4.88 65 TR_XM_DK_SendGrid 8918 5.07 5.68 4.77 66 T_TooManySym_02 8809 3.40 0.69 4.71 67 XM_UncommonTLD01 8745 6.38 9.87 4.68 68 MIME_QP_LONG_LINE 8738 5.13 6.07 4.68 69 RCVD_IN_IADB_LISTED 8306 3.67 2.07 4.44 70 FSL_BULK_SIG 7570 6.99 13.05 4.05 71 RCVD_IN_IADB_SPF 7359 3.20 1.68 3.94 72 FROM_EXCESS_BASE64 7314 3.27 1.94 3.91 73 ANY_BOUNCE_MESSAGE 7178 2.96 1.14 3.84 74 BOUNCE_MESSAGE 7178 2.96 1.14 3.84 75 INVALID_MSGID 7021 2.58 0.14 3.76 76 TM2_M_URI_OPT_OUT 6895 4.64 6.59 3.69 77 T_REMOTE_IMAGE 6872 4.05 4.83 3.68 78 RCVD_IN_IADB_SENDERID 6623 2.86 1.45 3.54 79 TVD_RCVD_IP 6415 2.39 0.24 3.43 80 BAYES_40 6362 2.91 1.88 3.40 81 RCVD_IN_IADB_DK 6310 2.77 1.51 3.38 82 XM_B_Phish_Phrases 6157 4.06 5.62 3.29 83 BAYES_95 6067 3.78 4.89 3.25 84 MIME_HTML_ONLY_MULTI 6022 3.21 3.17 3.22 85 HTML_IMAGE_RATIO_06 5845 3.36 3.84 3.13 86 TO_MALFORMED 5801 2.09 0.02 3.10 87 RELAYCOUNTRY_META 5650 8.10 18.54 3.02 88 RCVD_IN_IADB_VOUCHED 5565 2.45 1.37 2.98 89 TR_DCC_Bayes_99 5275 10.80 27.22 2.82 90 XM_PDF 5236 2.00 0.35 2.80 91 TR_Symld_Words 5131 2.39 1.65 2.75 92 URI_NOVOWEL 4956 2.48 2.12 2.65 93 MIME_HTML_MOSTLY 4948 2.81 3.13 2.65 94 TR_XM_PhishingBody 4803 3.57 5.62 2.57 95 XM_H_Trusted_IP 4734 1.70 0.00 2.53 96 BAYES_20 4636 2.30 1.93 2.48 97 T_XMDrugObfuBody_14 4105 2.89 4.33 2.20 98 RCVD_IN_MSPIKE_H5 3873 1.51 0.36 2.07 99 XM_SPF_SoftFail 3854 3.25 5.70 2.06 100 IN_HORDE_ADDRESS_BOOK 3837 1.41 0.10 2.05 101 RCVD_IN_IADB_OPTIN 3781 1.65 0.87 2.02 102 MAILING_LIST_MULTI 3679 1.92 1.83 1.97 103 XMBSHREFv2 3635 1.37 0.19 1.95 104 XM_B_SpammyTLD 3575 2.43 3.49 1.91 105 DKIM_INVALID 3546 2.26 3.00 1.90 106 XM_CamelCaseFrm001 3469 2.12 2.67 1.86 107 HTML_MIME_NO_HTML_TAG 3412 1.87 1.95 1.83 108 HTML_IMAGE_RATIO_08 3383 1.98 2.32 1.81 109 TR_XM_SB_Phish 3338 1.86 2.01 1.79 110 XMSubPhish11 3289 1.75 1.73 1.76 111 XMStockSpam_06 3233 1.69 1.60 1.73 112 TR_XM_MaxUnsub 3158 3.57 7.44 1.69 113 TVD_SPACE_RATIO 3057 1.21 0.34 1.64 114 BOTNET 3023 4.47 10.35 1.62 115 BAYES_05 3016 1.37 0.87 1.61 116 XMGappySubj_01 3013 1.14 0.16 1.61 117 XM_ProductURIs 2935 1.42 1.12 1.57 118 TM2_M_VERY_LONG_WORD 2850 2.00 2.98 1.52 119 TR_XM_SpammyWords5 2821 2.19 3.60 1.51 120 KHOP_HELO_FCRDNS 2816 1.85 2.57 1.51 121 XM_D_tchamptons_WL 2807 1.07 0.17 1.50 122 TR_XM_SpammyRelay 2768 4.98 12.17 1.48 123 XMSexyCombo_01 2601 1.49 1.69 1.39 124 XM_DK_Undo_01 2466 1.46 1.75 1.32 125 XMDiploma_00 2446 1.54 2.01 1.31 126 TR_XM_SpammyWords2 2414 4.69 11.68 1.29 127 RCVD_IN_RP_SAFE 2405 1.18 0.96 1.29 128 SUBJ_ALL_CAPS 2363 1.72 2.67 1.26 129 XMBdyGiftCard01 2361 1.35 1.52 1.26 130 MSGID_NOFQDN1 2357 0.85 0.01 1.26 131 TooManyTo_002 2356 1.07 0.69 1.26 132 UNTRUSTED_Relay 2328 4.74 11.94 1.25 133 XM_GoogleGroups 2307 1.06 0.71 1.23 134 XMSubMetaSxObfu_03 2244 0.95 0.45 1.20 135 URI_HEX 2231 1.38 1.77 1.19 136 RCVD_IN_MSPIKE_BL 2212 4.23 10.48 1.18 137 TR_XM_MSPIKECOMBO 2210 2.93 6.52 1.18 138 T_XMDrugObfuBody_08 2192 1.89 3.36 1.17 139 XM_B_Investor 2180 2.23 4.43 1.17 140 XMBody_95 2175 0.84 0.17 1.16 141 RCVD_IN_RP_CERTIFIED 2175 1.05 0.80 1.16 142 XM_B_Unsub2 2170 1.56 2.37 1.16 143 XM_B_Phish66 2112 1.69 2.84 1.13 144 RCVD_IN_BL_SPAMCOP_NET 2107 4.22 10.58 1.13 145 T_XMDrugObfuBody_00 1968 1.37 2.02 1.05 146 T_TooManySym_03 1959 0.79 0.27 1.05 147 HTML_FONT_FACE_BAD 1897 0.95 0.82 1.02 148 XMSexyCombo_04 1854 0.85 0.54 0.99 149 XM_shorewaves_Whitelist 1846 0.66 0.00 0.99 150 XMSubMetaSx_01 1813 0.74 0.27 0.97 151 TR_MetaPhish_Combo_01 1813 0.91 0.78 0.97 152 XM_B_COPY_HTML 1756 0.99 1.10 0.94 153 XMSexyCombo_02 1744 0.74 0.33 0.93 154 MPART_ALT_DIFF_COUNT 1728 1.02 1.23 0.92 155 XMSubNoVowel 1721 1.04 1.29 0.92 156 XMLngstWrd_00 1718 0.89 0.84 0.92 157 TooManyTo_003 1694 0.79 0.56 0.91 158 RCVD_IN_MSPIKE_L3 1688 1.67 3.25 0.90 159 XM_H_Long_From02 1644 1.29 2.13 0.88 160 RELAYCOUNTRY_CA 1636 3.29 8.26 0.88 161 HTML_TAG_BALANCE_BODY 1630 1.08 1.52 0.87 162 XMLngstWrd_01 1567 0.79 0.70 0.84 163 DKIM_ADSP_CUSTOM_MED 1511 1.01 1.44 0.81 164 TM2_M_A_HREF_HREF 1471 1.03 1.53 0.79 165 XMPhish30 1466 0.91 1.17 0.78 166 XM_UB50 1459 2.90 7.25 0.78 167 USER_IN_WELCOMELIST 1452 0.52 0.00 0.78 168 USER_IN_WHITELIST 1452 0.52 0.00 0.78 169 XMHTMLBadTable_001 1414 0.87 1.09 0.76 170 XM_H_PHPMailer 1413 0.79 0.85 0.76 171 XMLngstWrd_02 1323 0.65 0.54 0.71 172 HTML_IMAGE_ONLY_20 1305 0.58 0.35 0.70 173 XM_OfRef6 1298 1.53 3.26 0.69 174 PLING_QUERY 1278 0.75 0.87 0.68 175 XMGenDplmaNmb 1248 0.83 1.16 0.67 176 XM_B_DNDMA 1237 0.69 0.75 0.66 177 TooManyTo_004 1237 0.62 0.53 0.66 178 TR_XM_INV_DKIM 1212 0.74 0.93 0.65 179 URI_TRY_3LD 1206 0.70 0.82 0.65 180 XMBrknScrpt_02 1183 0.73 0.93 0.63 181 RDNS_DYNAMIC 1117 0.59 0.59 0.60 182 HELO_NODOT 1096 1.85 4.45 0.59 183 HELO_NO_DOMAIN 1095 1.85 4.45 0.59 184 SpammyFromTLD_01 1091 2.28 5.78 0.58 185 TR_XM_PHPDW 1085 1.96 4.79 0.58 186 XMSubMetaI_00 1062 0.90 1.58 0.57 187 XM_B_SpammyWords4 1050 1.05 2.07 0.56 188 TooManyTo_005 1048 0.52 0.44 0.56 189 GOOG_STO_IMG_NOHTML 1044 0.58 0.61 0.56 190 XM_B_COVIDMETA 1033 0.73 1.10 0.55 191 HTTPS_HTTP_MISMATCH 1029 0.99 1.90 0.55 192 XMHTML_After_End 1017 0.96 1.81 0.54 193 RELAYCOUNTRY_GB 996 0.55 0.59 0.53 194 XMSubMetaSxObfu_02 993 0.49 0.42 0.53 195 TR_XM_FormFill2 942 1.88 4.70 0.50 196 TR_XM_PHPForged 941 1.89 4.74 0.50 197 XMBody_17 939 0.98 1.97 0.50 198 XM_H_PHPOS 915 1.86 4.69 0.49 199 XM_B_REG_HTML 911 0.69 1.12 0.49 200 TR_MSPIKEBAYES00 907 0.33 0.01 0.49 ----------------------------------------------------------------------