Email: 272839 Autolearn: 0 AvgScore: 4.10 AvgScanTime: 1.23 sec Spam: 100688 Autolearn: 0 AvgScore: 13.66 AvgScanTime: 1.30 sec Ham: 172151 Autolearn: 0 AvgScore: -1.49 AvgScanTime: 1.18 sec Time Spent Running SA: 93.02 hours Time Spent Processing Spam: 36.44 hours Time Spent Processing Ham: 56.57 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 95869 86.02 95.21 80.65 2 DKIM_SIGNED 89711 80.74 89.10 75.85 3 XM_DK_Pass 88290 78.56 87.69 73.22 4 DKIM_VALID 87931 78.21 87.33 72.87 5 RELAYCOUNTRY_US 80985 80.02 80.43 79.77 6 DCC_CHECK 75089 50.84 74.58 36.95 7 XM_B_Unicode 73693 70.82 73.19 69.43 8 DKIM_VALID_AU 72532 64.48 72.04 60.06 9 XMListUnsubscribeExists 72531 59.11 72.04 51.55 10 XM_B_SpammyWords 61445 50.04 61.03 43.61 11 RCVD_IN_MSPIKE_H2 43929 39.16 43.63 36.54 12 BAYES_50 43867 50.40 43.57 54.39 13 XM_B_Unicode3 41600 43.08 41.32 44.11 14 XM_DK_Undo_02 41067 20.52 40.79 8.67 15 MIME_HTML_ONLY 38762 27.65 38.50 21.30 16 FVGT_m_MULTI_ODD 37741 29.49 37.48 24.81 17 LOC_TINY_FONT_1 35739 29.81 35.49 26.49 18 XM_B_SpammyWords2 34724 24.99 34.49 19.44 19 TR_XM_DKIM_Undo 34388 16.55 34.15 6.26 20 BAYES_99 33943 17.05 33.71 7.30 21 HTML_FONT_LOW_CONTRAST 29861 29.84 29.66 29.94 22 DKIM_VALID_EF 27161 28.11 26.98 28.77 23 BAYES_999 26902 13.64 26.72 5.99 24 DCC_CHECK_NEGATIVE 25564 49.13 25.39 63.02 25 T_KAM_HTML_FONT_INVALID 25400 20.86 25.23 18.30 26 RELAYCOUNTRY_META 24765 11.65 24.60 4.07 27 TR_DCC_Bayes_99 23050 10.25 22.89 2.86 28 XM_Body_Dirty_Words 22141 16.71 21.99 13.62 29 XMSubLong 20087 22.49 19.95 23.98 30 T_TM2_M_HEADER_IN_MSG 18983 21.36 18.85 22.82 31 MPART_ALT_DIFF 17607 9.71 17.49 5.16 32 XM_Multi_Part_URI 17020 15.36 16.90 14.46 33 RCVD_IN_MSPIKE_WL 16228 13.48 16.12 11.94 34 UNPARSEABLE_RELAY 15880 11.74 15.77 9.39 35 TR_XM_UnparsRelay 15680 10.49 15.57 7.51 36 RCVD_IN_MSPIKE_H3 15648 11.86 15.54 9.70 37 TM2_M_VERY_LONG_WORD 13891 6.00 13.80 1.43 38 XM_B_Unsub 13457 10.78 13.37 9.27 39 TR_XM_BayesUnsub 13262 9.64 13.17 7.57 40 XM_UncommonTLD01 12918 7.74 12.83 4.76 41 MIME_HTML_ONLY_MULTI 12759 6.51 12.67 2.91 42 TR_XM_SpammyWords2 12512 5.91 12.43 2.10 43 XMSexyCombo_05 11989 7.20 11.91 4.45 44 TR_XM_SpammyRelay 11828 5.45 11.75 1.76 45 BOTNET_IPINHOSTNAME 11659 8.38 11.58 6.51 46 HTML_MIME_NO_HTML_TAG 11520 5.00 11.44 1.23 47 XM_B_SpammyWords3 11503 7.45 11.42 5.12 48 BOTNET 11427 5.12 11.35 1.47 49 XMLngstWrd_00 11242 4.58 11.17 0.72 50 XMLngstWrd_01 11170 4.51 11.09 0.67 51 XMLngstWrd_02 11135 4.44 11.06 0.56 52 XM_GoogleGroups 10868 4.83 10.79 1.34 53 FSL_BULK_SIG 10787 6.14 10.71 3.47 54 XMLngstWrd_03 10725 4.24 10.65 0.49 55 XMLngstWrd_04 10562 4.13 10.49 0.41 56 HTML_TITLE_SUBJ_DIFF 10500 3.86 10.43 0.02 57 UPPERCASE_75_100 10432 3.83 10.36 0.02 58 HTML_IMAGE_RATIO_02 10156 8.31 10.09 7.28 59 UNTRUSTED_Relay 10032 4.42 9.96 1.18 60 RCVD_IN_BL_SPAMCOP_NET 9988 4.17 9.92 0.80 61 RELAYCOUNTRY_CA 8863 4.35 8.80 1.74 62 LOTS_OF_MONEY 8843 7.36 8.78 6.52 63 BAYES_80 8011 6.23 7.96 5.22 64 TR_XM_SpammyWords4 7347 5.37 7.30 4.24 65 XM_SendGrid 7304 6.56 7.25 6.16 66 BAYES_60 7100 9.89 7.05 11.55 67 XM_Evil_Numbers_Gen 6962 8.04 6.91 8.69 68 TR_XM_SPAMCOP 6545 2.71 6.50 0.49 69 XM_H_Long_From01 6206 5.48 6.16 5.09 70 LotsOfNums_01 6019 7.39 5.98 8.21 71 XM_UB50 5528 2.49 5.49 0.73 72 XMSubMetaSx_00 5409 4.19 5.37 3.50 73 XM_DIRTYINTL 5258 2.13 5.22 0.32 74 BAYES_95 5142 3.85 5.11 3.12 75 TR_XM_PhishingBody 5060 3.42 5.03 2.49 76 TR_XM_DK_SendGrid 5015 4.33 4.98 3.95 77 MIME_HTML_MOSTLY 4997 3.91 4.96 3.30 78 T_REMOTE_IMAGE 4715 4.18 4.68 3.89 79 TooManyTo_001 4672 6.04 4.64 6.86 80 SpammyFromTLD_01 4649 1.97 4.62 0.43 81 RCVD_IN_VALIDITY_SAFE 4618 6.40 4.59 7.46 82 XM_B_Phish_Phrases 4511 4.48 4.48 4.49 83 SpammyFromTLD_02 4242 1.65 4.21 0.15 84 XMStrtUSub 4185 5.36 4.16 6.07 85 XM_B_SpammyTLD 4079 2.74 4.05 1.98 86 T_XMDrugObfuBody_14 4044 2.78 4.02 2.05 87 HTML_IMAGE_RATIO_04 3997 5.81 3.97 6.89 88 RCVD_IN_VALIDITY_CERTIFIED 3939 5.45 3.91 6.36 89 XM_SPF_SoftFail 3780 2.27 3.75 1.40 90 XM_B_Investor 3632 2.10 3.61 1.23 91 XM_CamelCaseFrm001 3337 2.39 3.31 1.85 92 URI_NOVOWEL 3295 2.58 3.27 2.18 93 XM_OfRef6 3207 1.97 3.19 1.26 94 T_FILL_THIS_FORM_SHORT 3096 1.58 3.07 0.71 95 RCVD_IN_VALIDITY_RPBL 3068 1.20 3.05 0.12 96 XM_B_Phish66 2941 1.67 2.92 0.94 97 XMBody_17 2925 1.31 2.91 0.38 98 HTML_IMAGE_RATIO_06 2922 3.53 2.90 3.89 99 USER_IN_DEF_DKIM_WL 2886 12.47 2.87 18.08 100 TR_XM_SpammyWords5 2856 1.88 2.84 1.32 101 T_XMDrugObfuBody_08 2845 1.93 2.83 1.41 102 XMDiploma_00 2793 2.41 2.77 2.19 103 XM_DK_Undo_01 2740 1.83 2.72 1.31 104 XMNumbers 2607 5.35 2.59 6.97 105 BOTNET_NORDNS 2559 0.95 2.54 0.02 106 T_TooManySym_01 2449 7.96 2.43 11.19 107 HTML_IMAGE_RATIO_08 2441 2.42 2.42 2.41 108 PDS_OTHER_BAD_TLD 2410 1.12 2.39 0.38 109 XM_B_SpammyWords4 2398 1.76 2.38 1.39 110 RELAYCOUNTRY_IN 2350 0.90 2.33 0.07 111 FROM_EXCESS_BASE64 2274 2.93 2.26 3.32 112 TM2_M_URI_OPT_OUT 2146 2.37 2.13 2.51 113 MIME_QP_LONG_LINE 2127 3.03 2.11 3.57 114 SUBJ_ALL_CAPS 2042 1.49 2.03 1.17 115 XM_H_Undi_Recip 1990 0.85 1.98 0.20 116 XM_B_Unsub2 1990 1.26 1.98 0.84 117 URIBL_DBL_SPAM 1870 0.69 1.86 0.01 118 T_XMHurry_00 1832 0.98 1.82 0.48 119 DKIM_INVALID 1780 2.53 1.77 2.97 120 XM_UB99 1777 0.65 1.76 0.00 121 XMStockSpam_06 1762 1.80 1.75 1.84 122 HTML_TAG_BALANCE_BODY 1725 1.14 1.71 0.81 123 XM_B_DynamicLink 1683 0.64 1.67 0.03 124 TR_XM_SB_Phish 1660 1.95 1.65 2.12 125 TR_XM_FormFill 1645 0.63 1.63 0.04 126 MPART_ALT_DIFF_COUNT 1644 1.20 1.63 0.95 127 TR_Mismatch_TLD_01 1625 0.83 1.61 0.38 128 RCVD_IN_PSBL 1613 0.63 1.60 0.07 129 TR_XM_PHPDW 1576 0.80 1.57 0.36 130 RELAYCOUNTRY_RU 1549 0.58 1.54 0.01 131 XMGenDplmaNmb 1545 1.44 1.53 1.39 132 ALL_TRUSTED 1535 11.55 1.52 17.42 133 TR_XM_PHPForged 1520 0.75 1.51 0.30 134 XMBdyGiftCard01 1514 1.41 1.50 1.35 135 XMSubPhish11 1506 1.88 1.50 2.11 136 TR_XM_FormFill2 1498 0.74 1.49 0.30 137 XMBrknScrpt_02 1493 0.95 1.48 0.64 138 XM_H_PHPOS 1489 0.72 1.48 0.28 139 KHOP_HELO_FCRDNS 1445 1.13 1.44 0.95 140 XMSexyCombo_01 1442 0.76 1.43 0.36 141 XM_ProductURIs 1430 0.97 1.42 0.71 142 XM_Body_Dirty_Words_01 1393 0.74 1.38 0.37 143 HTTPS_HTTP_MISMATCH 1377 0.92 1.37 0.66 144 URI_HEX 1356 1.35 1.35 1.35 145 XM_B_COVIDMETA 1314 0.99 1.31 0.81 146 T_XMDrugObfuBody_00 1308 0.92 1.30 0.69 147 XM_UB999 1291 0.48 1.28 0.00 148 XMSubNoVowel 1289 1.31 1.28 1.32 149 URI_LONG_REPEAT 1281 0.47 1.27 0.00 150 RCVD_IN_IADB_LISTED 1273 3.01 1.26 4.02 151 XM_URI_RBL 1258 0.56 1.25 0.16 152 TR_XM_NoHeaderRelay 1246 0.53 1.24 0.11 153 XMHTML_After_End 1233 0.73 1.22 0.43 154 HK_RANDOM_REPLYTO 1200 0.53 1.19 0.15 155 XMReplyNow 1186 0.56 1.18 0.20 156 TR_Symld_Words 1170 1.29 1.16 1.36 157 TR_XM_BayesRelay 1138 0.42 1.13 0.00 158 RCVD_IN_IADB_SPF 1136 2.64 1.13 3.53 159 XM_UB60 1134 0.45 1.13 0.05 160 XMPhish30 1128 0.87 1.12 0.72 161 RELAYCOUNTRY_AU 1119 0.58 1.11 0.26 162 TR_LOTS_OF_MONEY3 1109 0.53 1.10 0.20 163 RCVD_IN_MSPIKE_BL 1087 0.41 1.08 0.01 164 MAILING_LIST_MULTI 1078 1.78 1.07 2.20 165 RCVD_IN_IADB_DK 1074 2.31 1.07 3.04 166 XMSubMetaI_00 1069 0.66 1.06 0.43 167 RCVD_IN_IADB_SENDERID 1058 2.35 1.05 3.11 168 DIET_1 1051 0.65 1.04 0.42 169 XMHTMLBadTable_001 1020 0.82 1.01 0.71 170 BAYES_40 1006 3.29 1.00 4.63 171 RELAYCOUNTRY_GB 992 0.66 0.99 0.48 172 SHOPIFY_IMG_NOT_RCVD_SFY 983 0.51 0.98 0.24 173 FROM_SUSPICIOUS_NTLD 978 0.41 0.97 0.07 174 LongTLD 961 0.43 0.95 0.12 175 MIME_BASE64_TEXT 959 0.42 0.95 0.12 176 TR_Mismatch_TLD_02 941 0.40 0.93 0.09 177 URI_TRY_3LD 933 0.66 0.93 0.51 178 RCVD_IN_RP_SAFE 933 1.28 0.93 1.49 179 XM_B_REG_HTML 900 0.63 0.89 0.48 180 RELAYCOUNTRY_LT 895 0.33 0.89 0.01 181 URIBL_BLACK 875 0.34 0.87 0.02 182 XM_H_Long_From02 848 1.13 0.84 1.29 183 HTML_FONT_FACE_BAD 843 1.03 0.84 1.15 184 THIS_AD 841 0.51 0.84 0.31 185 MONEY_NOHTML 832 0.36 0.83 0.09 186 XM_B_COPY_HTML 812 1.00 0.81 1.11 187 XMBody_29 796 0.36 0.79 0.11 188 TR_XM_COVIDMETA1 790 0.38 0.78 0.14 189 TR_MetaPhish_Combo_01 787 1.06 0.78 1.22 190 HTML_IMAGE_ONLY_20 781 0.87 0.78 0.92 191 TM2_M_A_HREF_HREF 775 0.44 0.77 0.25 192 TR_XM_MSPIKECOMBO 771 0.29 0.77 0.01 193 FROM_SUSPICIOUS_NTLD_FP 768 0.32 0.76 0.07 194 XM_B_DNDMA 767 0.49 0.76 0.33 195 RELAYCOUNTRY_CN 764 0.31 0.76 0.05 196 TR_Caps_n_Bayes_99 753 0.49 0.75 0.33 197 RCVD_IN_RP_CERTIFIED 751 1.09 0.75 1.29 198 UNDISC_MONEY 749 0.28 0.74 0.00 199 TR_XM_Spammywords 743 0.48 0.74 0.33 200 FONT_INVIS_LONG_LINE 743 0.31 0.74 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 138833 86.02 95.21 80.65 2 RELAYCOUNTRY_US 137331 80.02 80.43 79.77 3 DKIM_SIGNED 130569 80.74 89.10 75.85 4 XM_DK_Pass 126049 78.56 87.69 73.22 5 DKIM_VALID 125451 78.21 87.33 72.87 6 XM_B_Unicode 119526 70.82 73.19 69.43 7 DCC_CHECK_NEGATIVE 108486 49.13 25.39 63.02 8 DKIM_VALID_AU 103386 64.48 72.04 60.06 9 BAYES_50 93638 50.40 43.57 54.39 10 XMListUnsubscribeExists 88739 59.11 72.04 51.55 11 XM_B_Unicode3 75928 43.08 41.32 44.11 12 XM_B_SpammyWords 75079 50.04 61.03 43.61 13 DCC_CHECK 63615 50.84 74.58 36.95 14 RCVD_IN_MSPIKE_H2 62912 39.16 43.63 36.54 15 HTML_FONT_LOW_CONTRAST 51542 29.84 29.66 29.94 16 DKIM_VALID_EF 49522 28.11 26.98 28.77 17 LOC_TINY_FONT_1 45596 29.81 35.49 26.49 18 FVGT_m_MULTI_ODD 42717 29.49 37.48 24.81 19 XMSubLong 41275 22.49 19.95 23.98 20 T_TM2_M_HEADER_IN_MSG 39292 21.36 18.85 22.82 21 MIME_HTML_ONLY 36669 27.65 38.50 21.30 22 XM_B_SpammyWords2 33464 24.99 34.49 19.44 23 T_KAM_HTML_FONT_INVALID 31505 20.86 25.23 18.30 24 USER_IN_DEF_DKIM_WL 31126 12.47 2.87 18.08 25 ALL_TRUSTED 29991 11.55 1.52 17.42 26 XM_Multi_Part_URI 24886 15.36 16.90 14.46 27 XM_Body_Dirty_Words 23455 16.71 21.99 13.62 28 XM_DKIMWhitelistDomains 22133 8.14 0.06 12.86 29 RCVD_IN_MSPIKE_WL 20560 13.48 16.12 11.94 30 BAYES_60 19879 9.89 7.05 11.55 31 T_TooManySym_01 19256 7.96 2.43 11.19 32 RCVD_IN_MSPIKE_H3 16706 11.86 15.54 9.70 33 UNPARSEABLE_RELAY 16162 11.74 15.77 9.39 34 XM_B_Unsub 15958 10.78 13.37 9.27 35 XM_Evil_Numbers_Gen 14964 8.04 6.91 8.69 36 XM_DK_Undo_02 14922 20.52 40.79 8.67 37 BAYES_00 14618 5.54 0.49 8.49 38 LotsOfNums_01 14141 7.39 5.98 8.21 39 TR_XM_BayesUnsub 13027 9.64 13.17 7.57 40 TR_XM_UnparsRelay 12928 10.49 15.57 7.51 41 RCVD_IN_VALIDITY_SAFE 12841 6.40 4.59 7.46 42 BAYES_99 12567 17.05 33.71 7.30 43 HTML_IMAGE_RATIO_02 12524 8.31 10.09 7.28 44 T_TooManySym_02 12522 4.81 0.61 7.27 45 XMNumbers 11991 5.35 2.59 6.97 46 HTML_IMAGE_RATIO_04 11864 5.81 3.97 6.89 47 TooManyTo_001 11810 6.04 4.64 6.86 48 LOTS_OF_MONEY 11228 7.36 8.78 6.52 49 BOTNET_IPINHOSTNAME 11203 8.38 11.58 6.51 50 RCVD_IN_VALIDITY_CERTIFIED 10944 5.45 3.91 6.36 51 TR_XM_DKIM_Undo 10773 16.55 34.15 6.26 52 XM_SendGrid 10603 6.56 7.25 6.16 53 XMStrtUSub 10452 5.36 4.16 6.07 54 BAYES_999 10309 13.64 26.72 5.99 55 TR_XM_DK_Bayes 10167 3.87 0.39 5.91 56 TR_XM_DK_Bayes1 10058 3.83 0.39 5.84 57 IN_ZIMBRA_NJ_WHITELIST 10039 3.71 0.09 5.83 58 TR_XM_DK_Bayes2 9252 3.52 0.35 5.37 59 BAYES_80 8990 6.23 7.96 5.22 60 MPART_ALT_DIFF 8887 9.71 17.49 5.16 61 XM_B_SpammyWords3 8822 7.45 11.42 5.12 62 XM_H_Long_From01 8754 5.48 6.16 5.09 63 XM_UncommonTLD01 8197 7.74 12.83 4.76 64 BAYES_40 7964 3.29 1.00 4.63 65 XM_B_Phish_Phrases 7723 4.48 4.48 4.49 66 XMSexyCombo_05 7663 7.20 11.91 4.45 67 TR_XM_SpammyWords4 7305 5.37 7.30 4.24 68 RELAYCOUNTRY_META 7015 11.65 24.60 4.07 69 RCVD_IN_IADB_LISTED 6926 3.01 1.26 4.02 70 INVALID_MSGID 6867 2.58 0.16 3.99 71 TR_XM_DK_SendGrid 6797 4.33 4.98 3.95 72 HTML_IMAGE_RATIO_06 6701 3.53 2.90 3.89 73 T_REMOTE_IMAGE 6693 4.18 4.68 3.89 74 MIME_QP_LONG_LINE 6145 3.03 2.11 3.57 75 RCVD_IN_IADB_SPF 6076 2.64 1.13 3.53 76 XMSubMetaSx_00 6028 4.19 5.37 3.50 77 FSL_BULK_SIG 5973 6.14 10.71 3.47 78 XM_H_Trusted_IP 5829 2.14 0.00 3.39 79 TO_MALFORMED 5771 2.13 0.05 3.35 80 FROM_EXCESS_BASE64 5723 2.93 2.26 3.32 81 MIME_HTML_MOSTLY 5677 3.91 4.96 3.30 82 BAYES_20 5483 2.27 0.72 3.18 83 BAYES_95 5366 3.85 5.11 3.12 84 RCVD_IN_IADB_SENDERID 5359 2.35 1.05 3.11 85 TVD_RCVD_IP 5312 2.04 0.27 3.09 86 RCVD_IN_IADB_DK 5228 2.31 1.07 3.04 87 DKIM_INVALID 5118 2.53 1.77 2.97 88 RCVD_IN_IADB_VOUCHED 5044 2.06 0.58 2.93 89 MIME_HTML_ONLY_MULTI 5009 6.51 12.67 2.91 90 T_TooManySym_03 4959 1.94 0.32 2.88 91 TR_DCC_Bayes_99 4927 10.25 22.89 2.86 92 BOUNCE_MESSAGE 4896 1.95 0.43 2.84 93 ANY_BOUNCE_MESSAGE 4896 1.95 0.43 2.84 94 TM2_M_URI_OPT_OUT 4313 2.37 2.13 2.51 95 TR_XM_PhishingBody 4282 3.42 5.03 2.49 96 HTML_IMAGE_RATIO_08 4156 2.42 2.42 2.41 97 IN_HORDE_ADDRESS_BOOK 3913 1.46 0.08 2.27 98 MAILING_LIST_MULTI 3785 1.78 1.07 2.20 99 XMDiploma_00 3771 2.41 2.77 2.19 100 URI_NOVOWEL 3755 2.58 3.27 2.18 101 RCVD_IN_MSPIKE_H4 3750 1.58 0.57 2.18 102 TR_XM_SB_Phish 3653 1.95 1.65 2.12 103 BAYES_05 3644 1.48 0.40 2.12 104 XMSubPhish11 3630 1.88 1.50 2.11 105 TR_XM_SpammyWords2 3623 5.91 12.43 2.10 106 XMBSHREFv2 3609 1.39 0.17 2.10 107 RCVD_IN_IADB_OPTIN 3545 1.42 0.31 2.06 108 T_XMDrugObfuBody_14 3537 2.78 4.02 2.05 109 XM_B_SpammyTLD 3401 2.74 4.05 1.98 110 XM_CamelCaseFrm001 3178 2.39 3.31 1.85 111 XM_PDF 3170 1.34 0.47 1.84 112 XMStockSpam_06 3161 1.80 1.75 1.84 113 TR_XM_SpammyRelay 3036 5.45 11.75 1.76 114 XM_B_SEO 3014 1.26 0.41 1.75 115 RELAYCOUNTRY_CA 3000 4.35 8.80 1.74 116 TVD_SPACE_RATIO 2969 1.12 0.10 1.72 117 FVGT_m_MULTI_ODD_EMAIL 2920 1.11 0.10 1.70 118 XMGappySubj_01 2894 1.10 0.11 1.68 119 RCVD_IN_RP_SAFE 2559 1.28 0.93 1.49 120 BOTNET 2539 5.12 11.35 1.47 121 TM2_M_VERY_LONG_WORD 2468 6.00 13.80 1.43 122 T_XMDrugObfuBody_08 2420 1.93 2.83 1.41 123 XM_SPF_SoftFail 2409 2.27 3.75 1.40 124 XM_B_SpammyWords4 2396 1.76 2.38 1.39 125 XMGenDplmaNmb 2394 1.44 1.53 1.39 126 TR_Symld_Words 2340 1.29 1.16 1.36 127 XMBdyGiftCard01 2327 1.41 1.50 1.35 128 MSGID_NOFQDN1 2322 0.86 0.01 1.35 129 URI_HEX 2316 1.35 1.35 1.35 130 XM_GoogleGroups 2308 4.83 10.79 1.34 131 TooManyTo_002 2286 0.97 0.37 1.33 132 TR_XM_SpammyWords5 2281 1.88 2.84 1.32 133 XMSubNoVowel 2272 1.31 1.28 1.32 134 XM_DK_Undo_01 2247 1.83 2.72 1.31 135 RCVD_IN_RP_CERTIFIED 2229 1.09 0.75 1.29 136 XM_H_Long_From02 2223 1.13 0.84 1.29 137 XM_OfRef6 2169 1.97 3.19 1.26 138 HTML_MIME_NO_HTML_TAG 2122 5.00 11.44 1.23 139 XM_B_Investor 2110 2.10 3.61 1.23 140 TR_MetaPhish_Combo_01 2097 1.06 0.78 1.22 141 XM_RXBody 2082 0.99 0.62 1.21 142 UNTRUSTED_Relay 2023 4.42 9.96 1.18 143 SUBJ_ALL_CAPS 2022 1.49 2.03 1.17 144 HTML_FONT_FACE_BAD 1974 1.03 0.84 1.15 145 XM_B_COPY_HTML 1911 1.00 0.81 1.11 146 T_MANY_PILL_PRICE 1735 0.64 0.01 1.01 147 TooManyTo_003 1673 0.73 0.31 0.97 148 DKIM_ADSP_CUSTOM_MED 1658 0.87 0.71 0.96 149 KHOP_HELO_FCRDNS 1641 1.13 1.44 0.95 150 MPART_ALT_DIFF_COUNT 1638 1.20 1.63 0.95 151 XM_B_Phish66 1613 1.67 2.92 0.94 152 HTML_IMAGE_ONLY_20 1580 0.87 0.78 0.92 153 XMBody_95 1551 0.60 0.08 0.90 154 XM_B_Unsub2 1445 1.26 1.98 0.84 155 XM_B_COVIDMETA 1393 0.99 1.31 0.81 156 HTML_TAG_BALANCE_BODY 1389 1.14 1.71 0.81 157 RCVD_IN_BL_SPAMCOP_NET 1381 4.17 9.92 0.80 158 TooManyTo_004 1318 0.58 0.28 0.77 159 XM_H_PHPMailer 1279 0.74 0.74 0.74 160 XM_UB50 1255 2.49 5.49 0.73 161 XMPhish30 1248 0.87 1.12 0.72 162 XMLngstWrd_00 1247 4.58 11.17 0.72 163 XM_ProductURIs 1230 0.97 1.42 0.71 164 XMHTMLBadTable_001 1225 0.82 1.01 0.71 165 T_FILL_THIS_FORM_SHORT 1218 1.58 3.07 0.71 166 T_XMDrugObfuBody_00 1190 0.92 1.30 0.69 167 RDNS_DYNAMIC 1158 0.60 0.47 0.67 168 DATE_IN_PAST_03_06 1157 0.63 0.55 0.67 169 TooManyTo_005 1150 0.52 0.26 0.67 170 XMLngstWrd_01 1146 4.51 11.09 0.67 171 HTTPS_HTTP_MISMATCH 1144 0.92 1.37 0.66 172 USER_IN_WELCOMELIST 1128 0.41 0.00 0.66 173 USER_IN_WHITELIST 1128 0.41 0.00 0.66 174 XMBrknScrpt_02 1105 0.95 1.48 0.64 175 XMPhish14 1095 0.51 0.29 0.64 176 XM_S_SubURI 1051 0.39 0.01 0.61 177 XMSubMetaSxObfu_02 1010 0.63 0.70 0.59 178 FORGED_GMAIL_RCVD 996 0.59 0.61 0.58 179 HELO_NODOT 974 0.52 0.45 0.57 180 HELO_NO_DOMAIN 973 0.52 0.45 0.57 181 XMLngstWrd_02 968 4.44 11.06 0.56 182 NML_ADSP_CUSTOM_MED 931 0.58 0.63 0.54 183 XMSlimDrugH 921 0.57 0.62 0.53 184 HTML_TEXT_INVISIBLE_STYLE 918 0.49 0.42 0.53 185 XMNoVowels 900 0.43 0.27 0.52 186 XM_D_tchamptons_WL 899 0.33 0.00 0.52 187 T_TooManySym_04 893 0.40 0.19 0.52 188 URI_TRY_3LD 875 0.66 0.93 0.51 189 TR_XM_SPAMCOP 849 2.71 6.50 0.49 190 XMLngstWrd_03 841 4.24 10.65 0.49 191 XM_B_REG_HTML 830 0.63 0.89 0.48 192 T_XMHurry_00 830 0.98 1.82 0.48 193 RELAYCOUNTRY_GB 820 0.66 0.99 0.48 194 XM_ShortIntro_01 755 0.42 0.38 0.44 195 XMHTML_After_End 747 0.73 1.22 0.43 196 XMCapTrack 747 0.33 0.15 0.43 197 XMSubMetaI_00 741 0.66 1.06 0.43 198 SpammyFromTLD_01 739 1.97 4.62 0.43 199 XMSubMetaSxObfu_03 738 0.36 0.24 0.43 200 CTE_8BIT_MISMATCH 737 0.27 0.01 0.43 ----------------------------------------------------------------------