Email: 292227 Autolearn: 0 AvgScore: 4.46 AvgScanTime: 1.31 sec Spam: 115525 Autolearn: 0 AvgScore: 14.19 AvgScanTime: 1.40 sec Ham: 176702 Autolearn: 0 AvgScore: -1.90 AvgScanTime: 1.25 sec Time Spent Running SA: 106.01 hours Time Spent Processing Spam: 44.84 hours Time Spent Processing Ham: 61.17 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 110272 87.52 95.45 82.34 2 DKIM_SIGNED 102398 80.22 88.64 74.71 3 XM_DK_Pass 100624 78.83 87.10 73.42 4 DKIM_VALID 100354 78.51 86.87 73.04 5 RELAYCOUNTRY_US 95667 80.54 82.81 79.06 6 XM_B_Unicode 90647 73.00 78.47 69.42 7 DCC_CHECK 84152 50.18 72.84 35.36 8 XMListUnsubscribeExists 80378 59.20 69.58 52.41 9 DKIM_VALID_AU 78075 63.19 67.58 60.32 10 XM_B_SpammyWords 73938 50.95 64.00 42.41 11 RCVD_IN_MSPIKE_H2 53523 40.75 46.33 37.11 12 XM_DK_Undo_02 50973 22.48 44.12 8.32 13 XM_B_Unicode3 50382 44.03 43.61 44.30 14 BAYES_50 47049 48.46 40.73 53.52 15 MIME_HTML_ONLY 45815 28.83 39.66 21.75 16 XM_B_SpammyWords2 42288 25.99 36.61 19.04 17 BAYES_99 42138 18.80 36.48 7.24 18 FVGT_m_MULTI_ODD 41617 29.12 36.02 24.60 19 LOC_TINY_FONT_1 41255 29.71 35.71 25.78 20 TR_XM_DKIM_Undo 41081 16.96 35.56 4.80 21 HTML_FONT_LOW_CONTRAST 38701 31.66 33.50 30.46 22 DKIM_VALID_EF 34080 29.36 29.50 29.27 23 BAYES_999 33938 15.19 29.38 5.92 24 TR_XM_Base64_M1 31565 23.24 27.32 20.56 25 DCC_CHECK_NEGATIVE 31354 49.80 27.14 64.61 26 TR_XM_Base64_L1 31246 16.16 27.05 9.04 27 T_KAM_HTML_FONT_INVALID 30272 21.44 26.20 18.33 28 TR_DCC_Bayes_99 29549 11.37 25.58 2.08 29 XM_Body_Dirty_Words 25609 16.13 22.17 12.18 30 RELAYCOUNTRY_META 23820 10.05 20.62 3.15 31 RCVD_IN_MSPIKE_WL 21891 18.75 18.95 18.63 32 T_TM2_M_HEADER_IN_MSG 21318 20.83 18.45 22.38 33 XMSubLong 19798 20.73 17.14 23.08 34 XM_B_Unsub 19544 12.34 16.92 9.35 35 TR_XM_BayesUnsub 19260 11.15 16.67 7.53 36 XM_Multi_Part_URI 18987 15.65 16.44 15.13 37 RCVD_IN_MSPIKE_H3 18960 14.20 16.41 12.76 38 MPART_ALT_DIFF 16466 8.81 14.25 5.25 39 LOTS_OF_MONEY 16258 10.75 14.07 8.57 40 TR_XM_SpammyWords2 15678 6.06 13.57 1.16 41 UNPARSEABLE_RELAY 13855 9.42 11.99 7.74 42 XMSexyCombo_05 13828 7.40 11.97 4.41 43 XM_B_SpammyWords3 13617 7.28 11.79 4.33 44 TR_XM_UnparsRelay 13552 8.14 11.73 5.79 45 TR_XM_SpammyWords4 13537 7.61 11.72 4.93 46 MIME_HTML_ONLY_MULTI 13309 6.50 11.52 3.21 47 RCVD_IN_BL_SPAMCOP_NET 13266 4.93 11.48 0.64 48 TM2_M_VERY_LONG_WORD 13075 5.30 11.32 1.37 49 TR_XM_SpammyRelay 12955 5.30 11.21 1.44 50 FSL_BULK_SIG 11875 6.34 10.28 3.76 51 HTML_MIME_NO_HTML_TAG 11826 4.95 10.24 1.49 52 BOTNET_IPINHOSTNAME 11768 7.95 10.19 6.49 53 BOTNET 11066 4.71 9.58 1.52 54 XMLngstWrd_00 10983 4.31 9.51 0.92 55 XMLngstWrd_01 10926 4.24 9.46 0.83 56 XMLngstWrd_02 10877 4.15 9.42 0.71 57 XMLngstWrd_03 10467 3.93 9.06 0.57 58 XMLngstWrd_04 10389 3.84 8.99 0.47 59 XM_GoogleGroups 10261 4.29 8.88 1.28 60 RELAYCOUNTRY_CA 10162 4.20 8.80 1.19 61 XM_Evil_Numbers_Gen 10068 8.44 8.71 8.25 62 HTML_TITLE_SUBJ_DIFF 9903 3.40 8.57 0.02 63 UPPERCASE_75_100 9820 3.38 8.50 0.02 64 XM_UncommonTLD01 9708 6.13 8.40 4.65 65 TR_XM_Base64_L2 9228 4.15 7.99 1.65 66 BAYES_80 9066 6.41 7.85 5.48 67 TR_XM_SPAMCOP 9040 3.24 7.83 0.25 68 TR_XM_Base64_C 8546 4.31 7.40 2.30 69 HTML_IMAGE_RATIO_02 8269 7.57 7.16 7.84 70 BAYES_60 8016 9.93 6.94 11.89 71 XM_SendGrid 7998 5.72 6.92 4.94 72 XMSubMetaSx_00 7782 5.38 6.74 4.49 73 XM_H_Long_From01 7781 5.70 6.74 5.02 74 UNTRUSTED_Relay 7698 3.37 6.66 1.21 75 LotsOfNums_01 6695 7.77 5.80 9.06 76 TR_XM_PhishingBody 6641 3.71 5.75 2.38 77 TR_XM_Base64_M2 6530 4.48 5.65 3.71 78 BAYES_95 5819 3.98 5.04 3.29 79 RCVD_IN_VALIDITY_SAFE 5664 6.08 4.90 6.86 80 XM_B_Phish_Phrases 5584 3.58 4.83 2.76 81 USER_IN_DEF_DKIM_WL 5374 12.65 4.65 17.87 82 TR_XM_DK_SendGrid 5161 3.81 4.47 3.38 83 RCVD_IN_MSPIKE_BL 5146 2.40 4.45 1.06 84 TR_XM_MSPIKECOMBO 4876 2.31 4.22 1.06 85 HTML_IMAGE_RATIO_04 4864 4.97 4.21 5.47 86 T_REMOTE_IMAGE 4646 4.00 4.02 3.99 87 RCVD_IN_VALIDITY_CERTIFIED 4596 5.09 3.98 5.81 88 T_XMDrugObfuBody_14 4474 2.70 3.87 1.93 89 XM_DIRTYINTL 4466 1.68 3.87 0.25 90 T_XMDrugObfuBody_08 4381 2.19 3.79 1.14 91 HTML_IMAGE_RATIO_06 4376 3.94 3.79 4.04 92 TooManyTo_001 4365 5.33 3.78 6.35 93 XM_CamelCaseFrm001 4361 2.68 3.77 1.97 94 XMStrtUSub 4330 4.52 3.75 5.03 95 XM_SPF_SoftFail 4190 2.42 3.63 1.64 96 XM_B_Phish66 3996 1.95 3.46 0.97 97 XMBody_17 3960 1.77 3.43 0.69 98 TR_XM_SpammyWords5 3750 2.16 3.25 1.44 99 MIME_HTML_MOSTLY 3662 2.56 3.17 2.16 100 TR_LOTS_OF_MONEY3 3628 1.54 3.14 0.50 101 RCVD_IN_VALIDITY_RPBL 3623 1.25 3.14 0.02 102 XM_B_Investor 3621 1.96 3.13 1.19 103 SpammyFromTLD_01 3596 1.48 3.11 0.42 104 XMNumbers 3426 4.24 2.97 5.07 105 XM_UB50 3422 1.63 2.96 0.75 106 HTML_IMAGE_RATIO_08 3370 2.13 2.92 1.62 107 T_FILL_THIS_FORM_SHORT 3366 1.49 2.91 0.56 108 XM_B_SpammyTLD 3348 2.30 2.90 1.91 109 SpammyFromTLD_02 3337 1.30 2.89 0.26 110 HK_RANDOM_REPLYTO 3140 1.15 2.72 0.13 111 BOTNET_NORDNS 3111 1.07 2.69 0.01 112 XM_OfRef6 3025 1.61 2.62 0.95 113 ALL_TRUSTED 2974 11.95 2.57 18.08 114 XM_B_Unsub2 2935 1.55 2.54 0.90 115 FROM_EXCESS_BASE64 2800 2.92 2.42 3.24 116 TM2_M_URI_OPT_OUT 2703 2.60 2.34 2.77 117 RCVD_IN_MSPIKE_H4 2689 3.99 2.33 5.08 118 XMSexyCombo_01 2576 1.37 2.23 0.81 119 TR_XM_Base64_L3 2523 0.99 2.18 0.21 120 RCVD_IN_MSPIKE_L3 2518 1.24 2.18 0.62 121 XMDiploma_00 2500 1.84 2.16 1.63 122 T_XMHurry_00 2499 1.76 2.16 1.50 123 XM_B_SpammyWords4 2384 1.26 2.06 0.73 124 TR_XM_PHPDW 2382 1.08 2.06 0.44 125 TR_XM_PHPForged 2297 1.40 1.99 1.01 126 HTML_TAG_BALANCE_BODY 2289 1.30 1.98 0.85 127 TR_XM_MSPIKECOMBO2 2286 0.98 1.98 0.33 128 TR_XM_FormFill2 2252 0.97 1.95 0.33 129 XM_H_PHPOS 2245 0.95 1.94 0.31 130 TR_XM_SpammyWords3 2217 0.92 1.92 0.27 131 URI_NOVOWEL 2211 2.15 1.91 2.30 132 T_TooManySym_01 2211 5.79 1.91 8.33 133 KHOP_HELO_FCRDNS 2209 1.51 1.91 1.25 134 XMSubNoVowel 2125 1.42 1.84 1.15 135 SUBJ_ALL_CAPS 2124 1.48 1.84 1.24 136 RCVD_IN_PSBL 2120 0.84 1.84 0.19 137 DKIM_INVALID 2044 1.71 1.77 1.67 138 TR_XM_FormFill 2023 0.70 1.75 0.02 139 XMBrknScrpt_02 2003 1.01 1.73 0.54 140 XM_B_DynamicLink 1911 0.68 1.65 0.05 141 TR_XM_SB_Phish 1863 1.71 1.61 1.78 142 RCVD_IN_IADB_LISTED 1835 3.36 1.59 4.51 143 URI_HEX 1804 1.22 1.56 1.00 144 MIME_QP_LONG_LINE 1755 3.02 1.52 4.01 145 XM_DK_Undo_01 1741 1.31 1.51 1.17 146 XMStockSpam_06 1735 1.58 1.50 1.62 147 TR_XM_BayesRelay 1718 0.59 1.49 0.00 148 RCVD_IN_MSPIKE_L5 1701 0.59 1.47 0.01 149 URI_TRY_3LD 1646 0.84 1.42 0.46 150 XMReplyNow 1629 0.72 1.41 0.26 151 XM_UB99 1621 0.56 1.40 0.00 152 MPART_ALT_DIFF_COUNT 1616 1.02 1.40 0.77 153 RELAYCOUNTRY_RU 1616 0.57 1.40 0.03 154 T_XMDrugObfuBody_00 1583 0.84 1.37 0.50 155 RELAYCOUNTRY_AU 1521 0.67 1.32 0.25 156 RCVD_IN_IADB_SPF 1504 2.96 1.30 4.05 157 XMSubPhish11 1498 1.58 1.30 1.77 158 PDS_OTHER_BAD_TLD 1466 0.58 1.27 0.13 159 URIBL_DBL_SPAM 1433 0.50 1.24 0.02 160 REMOVE_BEFORE_LINK 1398 0.63 1.21 0.24 161 BAYES_40 1396 2.93 1.21 4.06 162 XM_H_Long_From02 1396 1.04 1.21 0.93 163 XMBdyGiftCard01 1390 1.19 1.20 1.19 164 TR_Symld_Words 1389 1.34 1.20 1.44 165 RCVD_IN_IADB_DK 1338 2.59 1.16 3.53 166 RCVD_IN_IADB_SENDERID 1335 2.68 1.16 3.68 167 DIET_1 1328 0.65 1.15 0.33 168 RCVD_IN_IADB_VOUCHED 1325 2.12 1.15 2.76 169 TR_XM_MaxSPIKE 1299 0.54 1.12 0.15 170 TR_MetaPhish_Combo_01 1294 1.17 1.12 1.20 171 MAILING_LIST_MULTI 1270 1.73 1.10 2.14 172 XMHTML_After_End 1266 0.81 1.10 0.63 173 XM_H_Undi_Recip 1265 0.53 1.10 0.15 174 XMSubMetaI_00 1264 0.69 1.09 0.43 175 XM_UB999 1261 0.43 1.09 0.00 176 XM_Combo_Sbj 1254 0.56 1.09 0.22 177 DKIM_ADSP_CUSTOM_MED 1235 1.36 1.07 1.54 178 XMHTMLBadTable_001 1208 0.81 1.05 0.66 179 XMPhish30 1201 0.87 1.04 0.75 180 XMSubMetaSxObfu_02 1189 0.85 1.03 0.73 181 TR_XM_NoHeaderRelay 1183 0.46 1.02 0.10 182 XMClaimOffer 1180 0.46 1.02 0.10 183 HTML_SHORT_LINK_IMG_3 1159 0.41 1.00 0.03 184 RCVD_IN_RP_SAFE 1155 1.17 1.00 1.29 185 HTML_IMAGE_ONLY_20 1153 0.93 1.00 0.88 186 NML_ADSP_CUSTOM_MED 1086 1.10 0.94 1.20 187 FORGED_GMAIL_RCVD 1085 1.07 0.94 1.16 188 XM_B_COVIDMETA 1084 0.88 0.94 0.84 189 XM_H_PHPMailer 1065 1.20 0.92 1.37 190 HTTPS_HTTP_MISMATCH 1048 0.66 0.91 0.50 191 RELAYCOUNTRY_DE 1030 0.47 0.89 0.19 192 MIME_BASE64_TEXT 1028 0.45 0.89 0.17 193 RELAYCOUNTRY_NL 1028 0.43 0.89 0.13 194 TR_XM_Base64_M3 1023 0.96 0.89 1.01 195 HTML_FONT_TINY_NORDNS 1009 0.38 0.87 0.06 196 BOUNCE_MESSAGE 1005 2.30 0.87 3.24 197 ANY_BOUNCE_MESSAGE 1005 2.30 0.87 3.24 198 XM_URI_RBL 1001 0.42 0.87 0.14 199 MILLION_USD 997 0.39 0.86 0.08 200 TR_Mismatch_TLD_02 993 0.39 0.86 0.08 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 145497 87.52 95.45 82.34 2 RELAYCOUNTRY_US 139698 80.54 82.81 79.06 3 DKIM_SIGNED 132017 80.22 88.64 74.71 4 XM_DK_Pass 129732 78.83 87.10 73.42 5 DKIM_VALID 129069 78.51 86.87 73.04 6 XM_B_Unicode 122671 73.00 78.47 69.42 7 DCC_CHECK_NEGATIVE 114166 49.80 27.14 64.61 8 DKIM_VALID_AU 106595 63.19 67.58 60.32 9 BAYES_50 94577 48.46 40.73 53.52 10 XMListUnsubscribeExists 92618 59.20 69.58 52.41 11 XM_B_Unicode3 78283 44.03 43.61 44.30 12 XM_B_SpammyWords 74947 50.95 64.00 42.41 13 RCVD_IN_MSPIKE_H2 65571 40.75 46.33 37.11 14 DCC_CHECK 62483 50.18 72.84 35.36 15 HTML_FONT_LOW_CONTRAST 53831 31.66 33.50 30.46 16 DKIM_VALID_EF 51726 29.36 29.50 29.27 17 LOC_TINY_FONT_1 45561 29.71 35.71 25.78 18 FVGT_m_MULTI_ODD 43469 29.12 36.02 24.60 19 XMSubLong 40777 20.73 17.14 23.08 20 T_TM2_M_HEADER_IN_MSG 39548 20.83 18.45 22.38 21 MIME_HTML_ONLY 38428 28.83 39.66 21.75 22 TR_XM_Base64_M1 36337 23.24 27.32 20.56 23 XM_B_SpammyWords2 33651 25.99 36.61 19.04 24 RCVD_IN_MSPIKE_WL 32914 18.75 18.95 18.63 25 T_KAM_HTML_FONT_INVALID 32381 21.44 26.20 18.33 26 ALL_TRUSTED 31951 11.95 2.57 18.08 27 USER_IN_DEF_DKIM_WL 31585 12.65 4.65 17.87 28 XM_Multi_Part_URI 26737 15.65 16.44 15.13 29 RCVD_IN_MSPIKE_H3 22545 14.20 16.41 12.76 30 XM_DKIMWhitelistDomains 22479 7.78 0.21 12.72 31 XM_Body_Dirty_Words 21515 16.13 22.17 12.18 32 BAYES_60 21011 9.93 6.94 11.89 33 BAYES_00 16935 6.01 0.55 9.58 34 XM_B_Unsub 16519 12.34 16.92 9.35 35 LotsOfNums_01 16005 7.77 5.80 9.06 36 TR_XM_Base64_L1 15974 16.16 27.05 9.04 37 LOTS_OF_MONEY 15145 10.75 14.07 8.57 38 T_TooManySym_01 14720 5.79 1.91 8.33 39 XM_DK_Undo_02 14707 22.48 44.12 8.32 40 XM_Evil_Numbers_Gen 14583 8.44 8.71 8.25 41 HTML_IMAGE_RATIO_02 13861 7.57 7.16 7.84 42 UNPARSEABLE_RELAY 13671 9.42 11.99 7.74 43 TR_XM_BayesUnsub 13310 11.15 16.67 7.53 44 BAYES_99 12791 18.80 36.48 7.24 45 RCVD_IN_VALIDITY_SAFE 12118 6.08 4.90 6.86 46 TR_XM_DK_Bayes 12007 4.31 0.50 6.80 47 TR_XM_DK_Bayes1 11817 4.24 0.49 6.69 48 BOTNET_IPINHOSTNAME 11467 7.95 10.19 6.49 49 TooManyTo_001 11214 5.33 3.78 6.35 50 IN_ZIMBRA_NJ_WHITELIST 11003 3.81 0.11 6.23 51 TR_XM_DK_Bayes2 10722 3.81 0.36 6.07 52 BAYES_999 10456 15.19 29.38 5.92 53 RCVD_IN_VALIDITY_CERTIFIED 10271 5.09 3.98 5.81 54 TR_XM_UnparsRelay 10238 8.14 11.73 5.79 55 BAYES_80 9676 6.41 7.85 5.48 56 HTML_IMAGE_RATIO_04 9658 4.97 4.21 5.47 57 MPART_ALT_DIFF 9284 8.81 14.25 5.25 58 T_TooManySym_02 9154 3.32 0.48 5.18 59 RCVD_IN_MSPIKE_H4 8977 3.99 2.33 5.08 60 XMNumbers 8954 4.24 2.97 5.07 61 XMStrtUSub 8880 4.52 3.75 5.03 62 XM_H_Long_From01 8877 5.70 6.74 5.02 63 XM_SendGrid 8721 5.72 6.92 4.94 64 TR_XM_SpammyWords4 8703 7.61 11.72 4.93 65 TR_XM_DKIM_Undo 8489 16.96 35.56 4.80 66 XM_UncommonTLD01 8209 6.13 8.40 4.65 67 RCVD_IN_IADB_LISTED 7972 3.36 1.59 4.51 68 XMSubMetaSx_00 7941 5.38 6.74 4.49 69 XMSexyCombo_05 7793 7.40 11.97 4.41 70 XM_B_SpammyWords3 7651 7.28 11.79 4.33 71 BAYES_40 7166 2.93 1.21 4.06 72 RCVD_IN_IADB_SPF 7153 2.96 1.30 4.05 73 HTML_IMAGE_RATIO_06 7144 3.94 3.79 4.04 74 MIME_QP_LONG_LINE 7083 3.02 1.52 4.01 75 T_REMOTE_IMAGE 7049 4.00 4.02 3.99 76 INVALID_MSGID 7021 2.50 0.24 3.97 77 FSL_BULK_SIG 6639 6.34 10.28 3.76 78 TR_XM_Base64_M2 6550 4.48 5.65 3.71 79 RCVD_IN_IADB_SENDERID 6506 2.68 1.16 3.68 80 RCVD_IN_IADB_DK 6237 2.59 1.16 3.53 81 TVD_RCVD_IP 6209 2.24 0.29 3.51 82 TR_XM_DK_SendGrid 5967 3.81 4.47 3.38 83 TO_MALFORMED 5914 2.03 0.02 3.35 84 BAYES_95 5814 3.98 5.04 3.29 85 BOUNCE_MESSAGE 5728 2.30 0.87 3.24 86 ANY_BOUNCE_MESSAGE 5728 2.30 0.87 3.24 87 FROM_EXCESS_BASE64 5723 2.92 2.42 3.24 88 MIME_HTML_ONLY_MULTI 5672 6.50 11.52 3.21 89 RELAYCOUNTRY_META 5560 10.05 20.62 3.15 90 BAYES_20 5333 2.15 0.82 3.02 91 XM_H_Trusted_IP 5120 1.75 0.00 2.90 92 TM2_M_URI_OPT_OUT 4893 2.60 2.34 2.77 93 XM_B_Phish_Phrases 4878 3.58 4.83 2.76 94 RCVD_IN_IADB_VOUCHED 4873 2.12 1.15 2.76 95 XM_PDF 4620 1.70 0.30 2.61 96 TR_XM_PhishingBody 4205 3.71 5.75 2.38 97 XMBSHREFv2 4181 1.50 0.17 2.37 98 URI_NOVOWEL 4066 2.15 1.91 2.30 99 TR_XM_Base64_C 4062 4.31 7.40 2.30 100 IN_HORDE_ADDRESS_BOOK 4020 1.41 0.10 2.28 101 MIME_HTML_MOSTLY 3817 2.56 3.17 2.16 102 MAILING_LIST_MULTI 3778 1.73 1.10 2.14 103 TR_DCC_Bayes_99 3672 11.37 25.58 2.08 104 XM_CamelCaseFrm001 3476 2.68 3.77 1.97 105 T_XMDrugObfuBody_14 3407 2.70 3.87 1.93 106 BAYES_05 3398 1.32 0.39 1.92 107 XM_B_SpammyTLD 3382 2.30 2.90 1.91 108 RCVD_IN_IADB_OPTIN 3288 1.42 0.75 1.86 109 TR_XM_SB_Phish 3139 1.71 1.61 1.78 110 XMSubPhish11 3121 1.58 1.30 1.77 111 XMGappySubj_01 3049 1.08 0.10 1.73 112 TVD_SPACE_RATIO 3021 1.08 0.11 1.71 113 DKIM_INVALID 2948 1.71 1.77 1.67 114 TR_XM_Base64_L2 2911 4.15 7.99 1.65 115 XM_SPF_SoftFail 2890 2.42 3.63 1.64 116 XMDiploma_00 2874 1.84 2.16 1.63 117 XMStockSpam_06 2871 1.58 1.50 1.62 118 HTML_IMAGE_RATIO_08 2855 2.13 2.92 1.62 119 DKIM_ADSP_CUSTOM_MED 2727 1.36 1.07 1.54 120 BOTNET 2691 4.71 9.58 1.52 121 T_XMHurry_00 2647 1.76 2.16 1.50 122 HTML_MIME_NO_HTML_TAG 2627 4.95 10.24 1.49 123 TR_XM_SpammyWords5 2548 2.16 3.25 1.44 124 TR_XM_SpammyRelay 2542 5.30 11.21 1.44 125 TR_Symld_Words 2537 1.34 1.20 1.44 126 XM_H_PHPMailer 2429 1.20 0.92 1.37 127 TM2_M_VERY_LONG_WORD 2420 5.30 11.32 1.37 128 MSGID_NOFQDN1 2358 0.82 0.02 1.33 129 RCVD_IN_RP_SAFE 2275 1.17 1.00 1.29 130 XM_GoogleGroups 2268 4.29 8.88 1.28 131 TooManyTo_002 2254 0.87 0.25 1.28 132 KHOP_HELO_FCRDNS 2200 1.51 1.91 1.25 133 SUBJ_ALL_CAPS 2189 1.48 1.84 1.24 134 UNTRUSTED_Relay 2145 3.37 6.66 1.21 135 TR_MetaPhish_Combo_01 2119 1.17 1.12 1.20 136 NML_ADSP_CUSTOM_MED 2115 1.10 0.94 1.20 137 RELAYCOUNTRY_CA 2111 4.20 8.80 1.19 138 XM_B_Investor 2099 1.96 3.13 1.19 139 XMBdyGiftCard01 2099 1.19 1.20 1.19 140 XM_DK_Undo_01 2073 1.31 1.51 1.17 141 FORGED_GMAIL_RCVD 2042 1.07 0.94 1.16 142 TR_XM_SpammyWords2 2041 6.06 13.57 1.16 143 RCVD_IN_RP_CERTIFIED 2029 1.00 0.79 1.15 144 XMSubNoVowel 2027 1.42 1.84 1.15 145 T_XMDrugObfuBody_08 2012 2.19 3.79 1.14 146 XMBody_95 1999 0.76 0.18 1.13 147 T_TooManySym_03 1883 0.73 0.22 1.07 148 HTML_FONT_FACE_BAD 1874 0.94 0.74 1.06 149 RCVD_IN_MSPIKE_BL 1866 2.40 4.45 1.06 150 TR_XM_MSPIKECOMBO 1865 2.31 4.22 1.06 151 TR_XM_PHPForged 1791 1.40 1.99 1.01 152 TR_XM_Base64_M3 1788 0.96 0.89 1.01 153 URI_HEX 1775 1.22 1.56 1.00 154 XM_B_Phish66 1717 1.95 3.46 0.97 155 XM_OfRef6 1680 1.61 2.62 0.95 156 XM_H_Long_From02 1649 1.04 1.21 0.93 157 TooManyTo_003 1641 0.64 0.20 0.93 158 XMLngstWrd_00 1619 4.31 9.51 0.92 159 XM_B_Unsub2 1587 1.55 2.54 0.90 160 HTML_IMAGE_ONLY_20 1552 0.93 1.00 0.88 161 XM_B_COPY_HTML 1544 0.81 0.72 0.87 162 HTML_TAG_BALANCE_BODY 1504 1.30 1.98 0.85 163 XM_B_COVIDMETA 1485 0.88 0.94 0.84 164 XMLngstWrd_01 1468 4.24 9.46 0.83 165 XMSexyCombo_01 1432 1.37 2.23 0.81 166 RCVD_IN_MSPIKE_H5 1392 0.56 0.21 0.79 167 MPART_ALT_DIFF_COUNT 1364 1.02 1.40 0.77 168 USER_IN_WELCOMELIST 1334 0.46 0.00 0.75 169 USER_IN_WHITELIST 1334 0.46 0.00 0.75 170 XMPhish30 1331 0.87 1.04 0.75 171 XM_UB50 1330 1.63 2.96 0.75 172 XM_D_tchamptons_WL 1329 0.46 0.01 0.75 173 XM_B_SpammyWords4 1291 1.26 2.06 0.73 174 XMSubMetaSxObfu_02 1283 0.85 1.03 0.73 175 TooManyTo_004 1266 0.51 0.18 0.72 176 XMLngstWrd_02 1257 4.15 9.42 0.71 177 XM_ProductURIs 1237 0.74 0.80 0.70 178 XMGenDplmaNmb 1222 0.72 0.75 0.69 179 XMBody_17 1218 1.77 3.43 0.69 180 XMHTMLBadTable_001 1161 0.81 1.05 0.66 181 RDNS_DYNAMIC 1148 0.60 0.53 0.65 182 RCVD_IN_BL_SPAMCOP_NET 1130 4.93 11.48 0.64 183 XMHTML_After_End 1105 0.81 1.10 0.63 184 RCVD_IN_MSPIKE_L3 1100 1.24 2.18 0.62 185 TooManyTo_005 1076 0.43 0.17 0.61 186 XM_S_SubURI 1068 0.38 0.03 0.60 187 XMLngstWrd_03 1006 3.93 9.06 0.57 188 T_FILL_THIS_FORM_SHORT 987 1.49 2.91 0.56 189 XM_shorewaves_Whitelist 984 0.34 0.00 0.56 190 XMBrknScrpt_02 963 1.01 1.73 0.54 191 HELO_NODOT 942 0.53 0.51 0.53 192 HELO_NO_DOMAIN 940 0.52 0.51 0.53 193 HTTPS_HTTP_MISMATCH 891 0.66 0.91 0.50 194 TR_LOTS_OF_MONEY3 885 1.54 3.14 0.50 195 T_XMDrugObfuBody_00 875 0.84 1.37 0.50 196 SUBJ_DOLLARS 868 0.59 0.73 0.49 197 XM_B_REG_HTML 852 0.57 0.70 0.48 198 XMLngstWrd_04 836 3.84 8.99 0.47 199 XMSubGiftCard1 829 0.49 0.51 0.47 200 XM_Walgreens_Forge 825 0.40 0.31 0.47 ----------------------------------------------------------------------