Email: 282217 Autolearn: 0 AvgScore: 3.35 AvgScanTime: 1.27 sec Spam: 101144 Autolearn: 0 AvgScore: 14.12 AvgScanTime: 1.43 sec Ham: 181073 Autolearn: 0 AvgScore: -2.66 AvgScanTime: 1.18 sec Time Spent Running SA: 99.25 hours Time Spent Processing Spam: 40.06 hours Time Spent Processing Ham: 59.19 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 96553 86.72 95.46 81.83 2 DKIM_SIGNED 92271 81.11 91.23 75.45 3 XM_DK_Pass 90810 79.71 89.78 74.08 4 DKIM_VALID 90078 79.14 89.06 73.60 5 XM_B_Unicode 86986 75.63 86.00 69.84 6 RELAYCOUNTRY_US 84198 80.96 83.25 79.68 7 DCC_CHECK 72917 49.14 72.09 36.33 8 XM_B_SpammyWords 72623 53.29 71.80 42.94 9 XMListUnsubscribeExists 71818 59.93 71.01 53.74 10 DKIM_VALID_AU 68284 63.42 67.51 61.13 11 RCVD_IN_MSPIKE_H2 53020 43.20 52.42 38.05 12 XM_DK_Undo_02 52455 24.03 51.86 8.48 13 XM_B_Unicode3 45799 44.71 45.28 44.38 14 TR_XM_DKIM_Undo 42721 18.26 42.24 4.86 15 BAYES_99 42244 19.86 41.77 7.62 16 LOC_TINY_FONT_1 40986 31.28 40.52 26.12 17 XM_B_SpammyWords2 40271 26.28 39.82 18.72 18 HTML_FONT_LOW_CONTRAST 35427 31.71 35.03 29.85 19 BAYES_50 34956 47.26 34.56 54.35 20 BAYES_999 34643 16.28 34.25 6.24 21 DKIM_VALID_EF 32939 30.76 32.57 29.74 22 FVGT_m_MULTI_ODD 31659 28.12 31.30 26.34 23 MIME_HTML_ONLY 31312 24.13 30.96 20.32 24 T_KAM_HTML_FONT_INVALID 29469 22.44 29.14 18.70 25 TR_DCC_Bayes_99 29441 12.09 29.11 2.59 26 DCC_CHECK_NEGATIVE 28215 50.84 27.90 63.65 27 XM_Body_Dirty_Words 24809 16.62 24.53 12.20 28 XMSubLong 19720 21.06 19.50 21.94 29 XM_Multi_Part_URI 19398 16.38 19.18 14.81 30 T_TM2_M_HEADER_IN_MSG 18950 21.25 18.74 22.66 31 RELAYCOUNTRY_META 18337 8.58 18.13 3.25 32 XM_B_Unsub 16761 11.81 16.57 9.16 33 TR_XM_BayesUnsub 16437 10.50 16.25 7.28 34 UNPARSEABLE_RELAY 15007 10.83 14.84 8.59 35 TR_XM_SpammyWords2 14816 6.05 14.65 1.24 36 TR_XM_UnparsRelay 14649 9.46 14.48 6.66 37 LOTS_OF_MONEY 14332 9.53 14.17 6.93 38 RCVD_IN_BL_SPAMCOP_NET 13720 5.27 13.56 0.64 39 TR_XM_SpammyRelay 12947 5.56 12.80 1.51 40 TR_XM_SpammyWords4 12385 6.73 12.24 3.65 41 BOTNET_IPINHOSTNAME 12122 8.49 11.98 6.54 42 XMSexyCombo_05 11881 6.55 11.75 3.65 43 RCVD_IN_MSPIKE_WL 11653 15.84 11.52 18.25 44 XM_B_SpammyWords3 11456 7.12 11.33 4.76 45 FSL_BULK_SIG 10067 5.51 9.95 3.04 46 BOTNET 9806 4.49 9.70 1.58 47 TR_XM_SPAMCOP 9076 3.37 8.97 0.24 48 RELAYCOUNTRY_CA 8990 3.97 8.89 1.22 49 XM_Evil_Numbers_Gen 8799 8.86 8.70 8.95 50 RCVD_IN_MSPIKE_H3 8580 10.45 8.48 11.54 51 XM_SendGrid 8215 6.56 8.12 5.68 52 BAYES_80 8163 6.10 8.07 5.00 53 HTML_IMAGE_RATIO_02 7510 7.02 7.43 6.79 54 BAYES_60 7276 9.98 7.19 11.54 55 LotsOfNums_01 6996 8.27 6.92 9.02 56 XM_UncommonTLD01 6852 5.33 6.77 4.52 57 UNTRUSTED_Relay 6669 3.19 6.59 1.29 58 XM_H_Long_From01 6279 5.64 6.21 5.33 59 XMSubMetaSx_00 6179 4.72 6.11 3.94 60 XM_B_Phish_Phrases 6176 4.19 6.11 3.11 61 TR_XM_PhishingBody 5795 3.81 5.73 2.74 62 RCVD_IN_VALIDITY_SAFE 5458 6.58 5.40 7.23 63 MPART_ALT_DIFF 5444 5.14 5.38 5.00 64 BAYES_95 5112 3.95 5.05 3.33 65 TR_XM_DK_SendGrid 5034 4.23 4.98 3.81 66 HTML_IMAGE_RATIO_04 4739 5.09 4.69 5.31 67 T_REMOTE_IMAGE 4494 4.16 4.44 4.00 68 RCVD_IN_MSPIKE_BL 4471 2.17 4.42 0.92 69 TR_XM_SpammyWords5 4390 2.50 4.34 1.47 70 TR_XM_MSPIKECOMBO 4312 2.11 4.26 0.91 71 T_XMDrugObfuBody_14 4289 2.73 4.24 1.89 72 RCVD_IN_VALIDITY_CERTIFIED 4248 5.63 4.20 6.43 73 TooManyTo_001 4240 5.49 4.19 6.22 74 XM_B_SpammyTLD 4210 2.74 4.16 1.95 75 XM_B_Investor 4186 2.45 4.14 1.50 76 XM_DIRTYINTL 4170 1.66 4.12 0.29 77 T_XMDrugObfuBody_08 3979 2.25 3.93 1.31 78 HTML_IMAGE_RATIO_08 3937 2.98 3.89 2.47 79 USER_IN_DEF_DKIM_WL 3918 12.74 3.87 17.69 80 MIME_HTML_MOSTLY 3862 2.99 3.82 2.53 81 XM_SPF_SoftFail 3799 2.86 3.76 2.36 82 XM_CamelCaseFrm001 3708 2.64 3.67 2.07 83 XMNumbers 3552 3.99 3.51 4.26 84 XMBody_17 3393 1.60 3.35 0.62 85 XMStrtUSub 3351 4.85 3.31 5.71 86 SpammyFromTLD_01 3206 1.41 3.17 0.42 87 HTML_IMAGE_RATIO_06 3072 3.22 3.04 3.32 88 XM_UB50 3061 1.57 3.03 0.76 89 T_TooManySym_01 3055 6.19 3.02 7.96 90 XM_B_Phish66 3042 1.72 3.01 0.99 91 XM_OfRef6 3033 1.55 3.00 0.75 92 RCVD_IN_VALIDITY_RPBL 2877 1.04 2.84 0.03 93 TM2_M_VERY_LONG_WORD 2864 1.85 2.83 1.30 94 HK_RANDOM_REPLYTO 2812 1.08 2.78 0.13 95 T_FILL_THIS_FORM_SHORT 2768 1.37 2.74 0.61 96 SUBJ_ALL_CAPS 2755 2.12 2.72 1.79 97 RCVD_IN_MSPIKE_H4 2742 4.61 2.71 5.66 98 URI_NOVOWEL 2738 2.32 2.71 2.10 99 MIME_HTML_ONLY_MULTI 2729 2.91 2.70 3.03 100 FROM_EXCESS_BASE64 2649 3.25 2.62 3.60 101 URIBL_DBL_SPAM 2630 0.94 2.60 0.01 102 BOTNET_NORDNS 2562 0.92 2.53 0.01 103 XMDiploma_00 2498 1.85 2.47 1.51 104 TM2_M_URI_OPT_OUT 2440 2.56 2.41 2.64 105 PDS_OTHER_BAD_TLD 2425 0.94 2.40 0.12 106 XM_DK_Undo_01 2424 1.65 2.40 1.23 107 TR_XM_MSPIKECOMBO2 2419 1.05 2.39 0.31 108 TR_LOTS_OF_MONEY3 2399 1.00 2.37 0.24 109 MIME_QP_LONG_LINE 2383 3.39 2.36 3.97 110 XM_B_Unsub2 2341 1.50 2.31 1.05 111 TR_XM_SpammyWords3 2245 0.97 2.22 0.28 112 XMBrknScrpt_02 2219 1.19 2.19 0.62 113 RCVD_IN_MSPIKE_L3 2208 1.11 2.18 0.51 114 DKIM_INVALID 2193 1.96 2.17 1.85 115 XM_B_SpammyWords4 2084 1.14 2.06 0.63 116 T_XMHurry_00 2002 1.13 1.98 0.66 117 HTML_TAG_BALANCE_BODY 1946 1.30 1.92 0.96 118 XM_H_Undi_Recip 1826 0.75 1.81 0.16 119 XMSexyCombo_01 1811 1.06 1.79 0.66 120 RCVD_IN_IADB_LISTED 1783 3.20 1.76 4.00 121 XM_B_DynamicLink 1749 0.64 1.73 0.04 122 RCVD_IN_PSBL 1745 0.71 1.73 0.14 123 TR_XM_FormFill 1688 0.64 1.67 0.06 124 MPART_ALT_DIFF_COUNT 1647 1.14 1.63 0.86 125 TR_XM_BayesRelay 1622 0.58 1.60 0.00 126 ALL_TRUSTED 1619 11.69 1.60 17.33 127 SpammyFromTLD_02 1592 0.77 1.57 0.32 128 XMSubMetaI_00 1535 1.17 1.52 0.97 129 XMBdyGiftCard01 1520 1.46 1.50 1.44 130 RCVD_IN_MSPIKE_L5 1516 0.54 1.50 0.01 131 TR_XM_PHPDW 1510 0.76 1.49 0.36 132 TR_XM_MaxSPIKE 1493 0.63 1.48 0.16 133 XMReplyNow 1481 0.72 1.46 0.30 134 TR_XM_SB_Phish 1480 1.68 1.46 1.80 135 KHOP_HELO_FCRDNS 1478 1.72 1.46 1.86 136 URI_HEX 1478 1.19 1.46 1.04 137 XM_UB99 1473 0.52 1.46 0.00 138 TR_Symld_Words 1471 1.41 1.45 1.38 139 RCVD_IN_IADB_SPF 1469 2.82 1.45 3.58 140 TR_XM_NoHeaderRelay 1451 0.57 1.43 0.09 141 T_XMDrugObfuBody_00 1430 1.02 1.41 0.80 142 XM_B_COVIDMETA 1430 0.96 1.41 0.71 143 TR_XM_PHPForged 1425 0.68 1.41 0.27 144 XMStockSpam_06 1406 1.04 1.39 0.85 145 TR_XM_FormFill2 1403 0.67 1.39 0.27 146 XM_H_PHPOS 1396 0.66 1.38 0.26 147 PLING_QUERY 1379 0.75 1.36 0.40 148 BAYES_40 1342 2.99 1.33 3.92 149 XMSubPhish11 1329 1.59 1.31 1.75 150 HTTPS_HTTP_MISMATCH 1324 0.79 1.31 0.51 151 RCVD_IN_IADB_DK 1313 2.49 1.30 3.15 152 RCVD_IN_IADB_SENDERID 1295 2.54 1.28 3.24 153 SHOPIFY_IMG_NOT_RCVD_SFY 1292 0.61 1.28 0.24 154 MAILING_LIST_MULTI 1262 1.80 1.25 2.11 155 TR_XM_RelayPhish 1236 0.47 1.22 0.04 156 XM_ProductURIs 1224 0.92 1.21 0.75 157 RCVD_IN_RP_SAFE 1217 1.30 1.20 1.36 158 XM_H_Long_From02 1210 1.11 1.20 1.06 159 XMHTMLBadTable_001 1205 0.92 1.19 0.77 160 MONEY_NOHTML 1187 0.45 1.17 0.04 161 XM_UB999 1171 0.42 1.16 0.00 162 THIS_AD 1152 0.73 1.14 0.50 163 HTML_SHORT_LINK_IMG_3 1152 0.44 1.14 0.05 164 XMPhish30 1135 0.96 1.12 0.87 165 TR_Caps_n_Bayes_99 1117 0.80 1.10 0.62 166 URI_TRY_3LD 1114 0.78 1.10 0.60 167 RELAYCOUNTRY_IN 1114 0.44 1.10 0.07 168 XM_URI_RBL 1110 0.50 1.10 0.17 169 RCVD_IN_IADB_VOUCHED 1108 1.96 1.10 2.44 170 XMClaimOffer 1104 0.44 1.09 0.07 171 HTML_IMAGE_ONLY_20 1092 0.91 1.08 0.81 172 URIBL_BLACK 1087 0.41 1.07 0.03 173 TR_LOTS_OF_MONEY2 1075 0.48 1.06 0.15 174 T_MONEY_PERCENT 1075 0.48 1.06 0.15 175 RELAYCOUNTRY_AU 1055 0.50 1.04 0.19 176 DIET_1 1044 0.63 1.03 0.40 177 TR_XM_Base64_M1 1012 1.09 1.00 1.14 178 BAYES_20 998 2.22 0.99 2.91 179 TR_MetaPhish_Combo_01 984 0.96 0.97 0.95 180 XM_B_DNDMA 983 0.63 0.97 0.43 181 HTML_MIME_NO_HTML_TAG 979 1.21 0.97 1.34 182 TR_XM_Undi_Recip5 960 0.34 0.95 0.01 183 HTML_FONT_TINY_NORDNS 954 0.37 0.94 0.05 184 T_TooManySym_02 952 3.62 0.94 5.12 185 RCVD_IN_RP_CERTIFIED 933 1.10 0.92 1.20 186 XM_B_COPY_HTML 900 0.89 0.89 0.89 187 TR_Mismatch_TLD_01 893 0.52 0.88 0.31 188 URI_PHP_REDIR 863 0.31 0.85 0.00 189 MIME_BASE64_TEXT 862 0.41 0.85 0.17 190 UNDISC_MONEY 858 0.31 0.85 0.00 191 XMGenDplmaNmb 850 0.85 0.84 0.85 192 RELAYCOUNTRY_RU 847 0.32 0.84 0.03 193 XM_UB60 826 0.34 0.82 0.07 194 XMHTML_After_End 817 0.77 0.81 0.75 195 XM_Body_Dirty_Words_01 812 0.37 0.80 0.12 196 DKIM_ADSP_CUSTOM_MED 811 0.84 0.80 0.87 197 REMOVE_BEFORE_LINK 795 0.41 0.79 0.21 198 XM_B_REG_HTML 794 0.58 0.79 0.47 199 RELAYCOUNTRY_CN 771 0.29 0.76 0.03 200 TR_XM_COVIDMETA1 767 0.34 0.76 0.10 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 148180 86.72 95.46 81.83 2 RELAYCOUNTRY_US 144287 80.96 83.25 79.68 3 DKIM_SIGNED 136628 81.11 91.23 75.45 4 XM_DK_Pass 134141 79.71 89.78 74.08 5 DKIM_VALID 133277 79.14 89.06 73.60 6 XM_B_Unicode 126461 75.63 86.00 69.84 7 DCC_CHECK_NEGATIVE 115257 50.84 27.90 63.65 8 DKIM_VALID_AU 110686 63.42 67.51 61.13 9 BAYES_50 98420 47.26 34.56 54.35 10 XMListUnsubscribeExists 97310 59.93 71.01 53.74 11 XM_B_Unicode3 80369 44.71 45.28 44.38 12 XM_B_SpammyWords 77758 53.29 71.80 42.94 13 RCVD_IN_MSPIKE_H2 68901 43.20 52.42 38.05 14 DCC_CHECK 65777 49.14 72.09 36.33 15 HTML_FONT_LOW_CONTRAST 54050 31.71 35.03 29.85 16 DKIM_VALID_EF 53860 30.76 32.57 29.74 17 FVGT_m_MULTI_ODD 47703 28.12 31.30 26.34 18 LOC_TINY_FONT_1 47298 31.28 40.52 26.12 19 T_TM2_M_HEADER_IN_MSG 41023 21.25 18.74 22.66 20 XMSubLong 39722 21.06 19.50 21.94 21 MIME_HTML_ONLY 36793 24.13 30.96 20.32 22 XM_B_SpammyWords2 33900 26.28 39.82 18.72 23 T_KAM_HTML_FONT_INVALID 33854 22.44 29.14 18.70 24 RCVD_IN_MSPIKE_WL 33039 15.84 11.52 18.25 25 USER_IN_DEF_DKIM_WL 32034 12.74 3.87 17.69 26 ALL_TRUSTED 31374 11.69 1.60 17.33 27 XM_Multi_Part_URI 26819 16.38 19.18 14.81 28 XM_DKIMWhitelistDomains 22234 7.91 0.09 12.28 29 XM_Body_Dirty_Words 22099 16.62 24.53 12.20 30 RCVD_IN_MSPIKE_H3 20903 10.45 8.48 11.54 31 BAYES_60 20895 9.98 7.19 11.54 32 BAYES_00 16991 6.18 0.46 9.38 33 XM_B_Unsub 16578 11.81 16.57 9.16 34 LotsOfNums_01 16336 8.27 6.92 9.02 35 XM_Evil_Numbers_Gen 16200 8.86 8.70 8.95 36 UNPARSEABLE_RELAY 15563 10.83 14.84 8.59 37 XM_DK_Undo_02 15354 24.03 51.86 8.48 38 T_TooManySym_01 14415 6.19 3.02 7.96 39 BAYES_99 13796 19.86 41.77 7.62 40 TR_XM_BayesUnsub 13188 10.50 16.25 7.28 41 RCVD_IN_VALIDITY_SAFE 13100 6.58 5.40 7.23 42 LOTS_OF_MONEY 12556 9.53 14.17 6.93 43 HTML_IMAGE_RATIO_02 12288 7.02 7.43 6.79 44 TR_XM_UnparsRelay 12061 9.46 14.48 6.66 45 BOTNET_IPINHOSTNAME 11843 8.49 11.98 6.54 46 RCVD_IN_VALIDITY_CERTIFIED 11635 5.63 4.20 6.43 47 BAYES_999 11302 16.28 34.25 6.24 48 TooManyTo_001 11263 5.49 4.19 6.22 49 TR_XM_DK_Bayes 10933 4.01 0.38 6.04 50 IN_ZIMBRA_NJ_WHITELIST 10922 3.90 0.07 6.03 51 TR_XM_DK_Bayes1 10825 3.97 0.38 5.98 52 XMStrtUSub 10345 4.85 3.31 5.71 53 XM_SendGrid 10287 6.56 8.12 5.68 54 RCVD_IN_MSPIKE_H4 10257 4.61 2.71 5.66 55 TR_XM_DK_Bayes2 9735 3.57 0.35 5.38 56 XM_H_Long_From01 9651 5.64 6.21 5.33 57 HTML_IMAGE_RATIO_04 9612 5.09 4.69 5.31 58 T_TooManySym_02 9263 3.62 0.94 5.12 59 MPART_ALT_DIFF 9061 5.14 5.38 5.00 60 BAYES_80 9054 6.10 8.07 5.00 61 TR_XM_DKIM_Undo 8800 18.26 42.24 4.86 62 XM_B_SpammyWords3 8626 7.12 11.33 4.76 63 XM_UncommonTLD01 8187 5.33 6.77 4.52 64 XMNumbers 7720 3.99 3.51 4.26 65 TVD_RCVD_IP 7675 2.85 0.38 4.24 66 RCVD_IN_IADB_LISTED 7247 3.20 1.76 4.00 67 T_REMOTE_IMAGE 7236 4.16 4.44 4.00 68 MIME_QP_LONG_LINE 7196 3.39 2.36 3.97 69 XMSubMetaSx_00 7130 4.72 6.11 3.94 70 BAYES_40 7107 2.99 1.33 3.92 71 INVALID_MSGID 7036 2.55 0.17 3.89 72 TR_XM_DK_SendGrid 6902 4.23 4.98 3.81 73 XMSexyCombo_05 6610 6.55 11.75 3.65 74 TR_XM_SpammyWords4 6610 6.73 12.24 3.65 75 FROM_EXCESS_BASE64 6524 3.25 2.62 3.60 76 RCVD_IN_IADB_SPF 6480 2.82 1.45 3.58 77 BAYES_95 6024 3.95 5.05 3.33 78 HTML_IMAGE_RATIO_06 6020 3.22 3.04 3.32 79 TO_MALFORMED 5916 2.10 0.01 3.27 80 RELAYCOUNTRY_META 5881 8.58 18.13 3.25 81 RCVD_IN_IADB_SENDERID 5868 2.54 1.28 3.24 82 RCVD_IN_IADB_DK 5701 2.49 1.30 3.15 83 XM_B_Phish_Phrases 5639 4.19 6.11 3.11 84 FSL_BULK_SIG 5497 5.51 9.95 3.04 85 MIME_HTML_ONLY_MULTI 5486 2.91 2.70 3.03 86 BAYES_20 5268 2.22 0.99 2.91 87 TR_XM_PhishingBody 4965 3.81 5.73 2.74 88 XM_H_Trusted_IP 4950 1.75 0.00 2.73 89 TM2_M_URI_OPT_OUT 4781 2.56 2.41 2.64 90 ANY_BOUNCE_MESSAGE 4776 1.89 0.55 2.64 91 BOUNCE_MESSAGE 4776 1.89 0.55 2.64 92 TR_DCC_Bayes_99 4681 12.09 29.11 2.59 93 XM_PDF 4602 1.79 0.45 2.54 94 MIME_HTML_MOSTLY 4585 2.99 3.82 2.53 95 HTML_IMAGE_RATIO_08 4468 2.98 3.89 2.47 96 RCVD_IN_IADB_VOUCHED 4416 1.96 1.10 2.44 97 XM_SPF_SoftFail 4276 2.86 3.76 2.36 98 XMBSHREFv2 4158 1.52 0.14 2.30 99 IN_HORDE_ADDRESS_BOOK 3929 1.43 0.11 2.17 100 MAILING_LIST_MULTI 3824 1.80 1.25 2.11 101 URI_NOVOWEL 3805 2.32 2.71 2.10 102 XM_CamelCaseFrm001 3755 2.64 3.67 2.07 103 XM_B_SpammyTLD 3532 2.74 4.16 1.95 104 BAYES_05 3514 1.45 0.57 1.94 105 T_XMDrugObfuBody_14 3420 2.73 4.24 1.89 106 XMGappySubj_01 3389 1.29 0.24 1.87 107 KHOP_HELO_FCRDNS 3368 1.72 1.46 1.86 108 DKIM_INVALID 3351 1.96 2.17 1.85 109 TR_XM_SB_Phish 3266 1.68 1.46 1.80 110 SUBJ_ALL_CAPS 3234 2.12 2.72 1.79 111 XMSubPhish11 3169 1.59 1.31 1.75 112 TVD_SPACE_RATIO 3112 1.13 0.07 1.72 113 RCVD_IN_IADB_OPTIN 3023 1.32 0.69 1.67 114 BOTNET 2866 4.49 9.70 1.58 115 XMDiploma_00 2736 1.85 2.47 1.51 116 TR_XM_SpammyRelay 2731 5.56 12.80 1.51 117 XM_B_Investor 2725 2.45 4.14 1.50 118 TR_XM_SpammyWords5 2653 2.50 4.34 1.47 119 XMBdyGiftCard01 2600 1.46 1.50 1.44 120 TR_Symld_Words 2504 1.41 1.45 1.38 121 HTML_FONT_FACE_BAD 2463 1.14 0.75 1.36 122 RCVD_IN_RP_SAFE 2458 1.30 1.20 1.36 123 HTML_MIME_NO_HTML_TAG 2425 1.21 0.97 1.34 124 XM_shorewaves_Whitelist 2406 0.85 0.00 1.33 125 MSGID_NOFQDN1 2370 0.85 0.02 1.31 126 T_XMDrugObfuBody_08 2370 2.25 3.93 1.31 127 TM2_M_VERY_LONG_WORD 2357 1.85 2.83 1.30 128 UNTRUSTED_Relay 2337 3.19 6.59 1.29 129 TooManyTo_002 2314 0.97 0.42 1.28 130 TR_XM_SpammyWords2 2249 6.05 14.65 1.24 131 XM_GoogleGroups 2245 1.00 0.57 1.24 132 XM_DK_Undo_01 2220 1.65 2.40 1.23 133 RELAYCOUNTRY_CA 2218 3.97 8.89 1.22 134 RCVD_IN_RP_CERTIFIED 2178 1.10 0.92 1.20 135 TR_XM_Base64_M1 2071 1.09 1.00 1.14 136 XM_D_tchamptons_WL 2060 0.74 0.03 1.14 137 T_TooManySym_03 2052 0.85 0.33 1.13 138 XMBody_95 1962 0.77 0.20 1.08 139 XM_H_Long_From02 1924 1.11 1.20 1.06 140 XM_B_Unsub2 1896 1.50 2.31 1.05 141 RCVD_IN_MSPIKE_H5 1879 0.78 0.33 1.04 142 URI_HEX 1876 1.19 1.46 1.04 143 XM_B_Phish66 1801 1.72 3.01 0.99 144 XMSubMetaI_00 1753 1.17 1.52 0.97 145 HTML_TAG_BALANCE_BODY 1736 1.30 1.92 0.96 146 TooManyTo_003 1720 0.73 0.35 0.95 147 TR_MetaPhish_Combo_01 1713 0.96 0.97 0.95 148 XMSubNoVowel 1705 0.85 0.68 0.94 149 RCVD_IN_MSPIKE_BL 1659 2.17 4.42 0.92 150 TR_XM_MSPIKECOMBO 1656 2.11 4.26 0.91 151 XM_B_COPY_HTML 1608 0.89 0.89 0.89 152 XMPhish30 1583 0.96 1.12 0.87 153 DKIM_ADSP_CUSTOM_MED 1573 0.84 0.80 0.87 154 MPART_ALT_DIFF_COUNT 1560 1.14 1.63 0.86 155 XMStockSpam_06 1542 1.04 1.39 0.85 156 XMGenDplmaNmb 1535 0.85 0.84 0.85 157 HTML_IMAGE_ONLY_20 1463 0.91 1.08 0.81 158 T_XMDrugObfuBody_00 1450 1.02 1.41 0.80 159 XMLngstWrd_00 1432 0.61 0.29 0.79 160 XMHTMLBadTable_001 1386 0.92 1.19 0.77 161 XM_UB50 1372 1.57 3.03 0.76 162 XM_ProductURIs 1363 0.92 1.21 0.75 163 XMHTML_After_End 1358 0.77 0.81 0.75 164 XMSubMetaSxObfu_02 1356 0.59 0.32 0.75 165 XM_OfRef6 1354 1.55 3.00 0.75 166 TooManyTo_004 1337 0.59 0.33 0.74 167 XM_B_COVIDMETA 1287 0.96 1.41 0.71 168 USER_IN_WHITELIST 1255 0.44 0.00 0.69 169 USER_IN_WELCOMELIST 1255 0.44 0.00 0.69 170 XMLngstWrd_01 1211 0.52 0.24 0.67 171 XMSexyCombo_01 1189 1.06 1.79 0.66 172 T_XMHurry_00 1189 1.13 1.98 0.66 173 RCVD_IN_BL_SPAMCOP_NET 1166 5.27 13.56 0.64 174 XMSubMetaSxObfu_03 1151 0.54 0.38 0.64 175 RDNS_DYNAMIC 1151 0.65 0.68 0.64 176 TooManyTo_005 1145 0.51 0.30 0.63 177 XM_B_SpammyWords4 1143 1.14 2.06 0.63 178 TR_Caps_n_Bayes_99 1127 0.80 1.10 0.62 179 XMBrknScrpt_02 1126 1.19 2.19 0.62 180 XMBody_17 1115 1.60 3.35 0.62 181 XM_H_PHPMailer 1108 0.59 0.55 0.61 182 T_FILL_THIS_FORM_SHORT 1105 1.37 2.74 0.61 183 XMPhish14 1090 0.65 0.73 0.60 184 URI_TRY_3LD 1084 0.78 1.10 0.60 185 XM_S_SubURI 1073 0.39 0.03 0.59 186 XM_RXBody 1070 0.51 0.37 0.59 187 TR_XM_INV_DKIM 1019 0.63 0.76 0.56 188 HELO_NODOT 1002 0.43 0.20 0.55 189 HELO_NO_DOMAIN 1002 0.42 0.19 0.55 190 TM2_M_A_HREF_HREF 1002 0.55 0.55 0.55 191 XMLngstWrd_02 988 0.42 0.19 0.55 192 DATE_IN_PAST_03_06 986 0.56 0.59 0.54 193 SUBJ_DOLLARS 977 0.55 0.57 0.54 194 RCVD_IN_MSPIKE_L3 920 1.11 2.18 0.51 195 HTTPS_HTTP_MISMATCH 918 0.79 1.31 0.51 196 FORGED_GMAIL_RCVD 915 0.57 0.68 0.51 197 THIS_AD 908 0.73 1.14 0.50 198 NML_ADSP_CUSTOM_MED 895 0.55 0.66 0.49 199 XMNoVowels 891 0.52 0.58 0.49 200 RELAYCOUNTRY_GB 886 0.51 0.56 0.49 ----------------------------------------------------------------------