Email: 533714 Autolearn: 0 AvgScore: 4.15 AvgScanTime: 1.34 sec Spam: 175028 Autolearn: 0 AvgScore: 13.87 AvgScanTime: 1.44 sec Ham: 358686 Autolearn: 0 AvgScore: -0.59 AvgScanTime: 1.28 sec Time Spent Running SA: 197.92 hours Time Spent Processing Spam: 70.16 hours Time Spent Processing Ham: 127.76 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 166423 90.00 95.08 87.51 2 DKIM_SIGNED 156044 80.40 89.15 76.12 3 XM_DK_Pass 153010 78.41 87.42 74.01 4 DKIM_VALID 151076 77.40 86.32 73.04 5 XM_B_Unicode 146284 75.35 83.58 71.34 6 RELAYCOUNTRY_US 137864 79.79 78.77 80.29 7 DCC_CHECK 128482 49.16 73.41 37.33 8 XMListUnsubscribeExists 127381 57.87 72.78 50.60 9 XM_B_SpammyWords 123884 53.93 70.78 45.71 10 DKIM_VALID_AU 112856 60.13 64.48 58.00 11 RCVD_IN_MSPIKE_H2 85205 43.77 48.68 41.37 12 XM_B_Unicode3 77314 42.35 44.17 41.47 13 XM_DK_Undo_02 77054 18.71 44.02 6.36 14 BAYES_50 73019 52.30 41.72 57.46 15 XM_B_SpammyWords2 71560 26.92 40.88 20.11 16 LOC_TINY_FONT_1 68897 29.82 39.36 25.16 17 TR_XM_DKIM_Undo 62898 14.96 35.94 4.72 18 FVGT_m_MULTI_ODD 62148 29.61 35.51 26.74 19 HTML_FONT_LOW_CONTRAST 60022 30.81 34.29 29.11 20 DKIM_VALID_EF 59455 30.36 33.97 28.60 21 MIME_HTML_ONLY 57707 23.22 32.97 18.47 22 BAYES_99 55809 13.57 31.89 4.63 23 T_KAM_HTML_FONT_INVALID 53552 24.44 30.60 21.43 24 DCC_CHECK_NEGATIVE 46493 50.79 26.56 62.61 25 BAYES_999 42817 10.41 24.46 3.55 26 TR_DCC_Bayes_99 40743 8.68 23.28 1.55 27 T_TM2_M_HEADER_IN_MSG 39101 27.03 22.34 29.32 28 XM_Body_Dirty_Words 39028 15.11 22.30 11.61 29 XMSubLong 37363 22.06 21.35 22.41 30 RELAYCOUNTRY_META 35586 9.17 20.33 3.72 31 XM_Multi_Part_URI 33761 15.32 19.29 13.39 32 RCVD_IN_MSPIKE_WL 27966 17.37 15.98 18.06 33 TR_XM_SpammyRelay 26743 6.19 15.28 1.76 34 BOTNET_IPINHOSTNAME 25199 8.15 14.40 5.10 35 XM_B_Unsub 23978 10.52 13.70 8.97 36 UNPARSEABLE_RELAY 23704 11.20 13.54 10.06 37 TR_XM_BayesUnsub 23450 8.91 13.40 6.72 38 RCVD_IN_MSPIKE_H3 22394 11.52 12.79 10.90 39 XM_B_SpammyWords3 22386 7.54 12.79 4.98 40 LOTS_OF_MONEY 21130 8.00 12.07 6.01 41 TR_XM_SpammyWords2 21074 4.44 12.04 0.74 42 RCVD_IN_BL_SPAMCOP_NET 18632 3.77 10.65 0.41 43 FSL_BULK_SIG 18069 6.33 10.32 4.38 44 XMSexyCombo_05 17850 5.50 10.20 3.21 45 TR_XM_SpammyWords4 17849 5.89 10.20 3.79 46 RELAYCOUNTRY_CA 17462 4.02 9.98 1.12 47 XM_Evil_Numbers_Gen 16453 8.41 9.40 7.92 48 BOTNET 15741 4.14 8.99 1.77 49 TR_XM_SPAMCOP 15427 3.02 8.81 0.19 50 BAYES_80 15082 5.98 8.62 4.70 51 MPART_ALT_DIFF 14818 5.23 8.47 3.65 52 TR_XM_UnparsRelay 14761 4.14 8.43 2.05 53 BAYES_60 13855 9.17 7.92 9.78 54 XM_UncommonTLD01 12875 4.97 7.36 3.80 55 UNTRUSTED_Relay 12670 3.39 7.24 1.51 56 LotsOfNums_01 12270 8.41 7.01 9.09 57 HTML_IMAGE_RATIO_02 11445 6.13 6.54 5.93 58 TR_XM_PhishingBody 11298 4.84 6.45 4.05 59 XM_SendGrid 10921 5.92 6.24 5.77 60 XM_H_Long_From01 10803 5.60 6.17 5.32 61 XMSubMetaSx_00 10257 4.64 5.86 4.05 62 XM_B_Phish_Phrases 9571 4.24 5.47 3.65 63 BAYES_95 9315 3.69 5.32 2.90 64 MIME_HTML_ONLY_MULTI 9131 3.06 5.22 2.01 65 XM_SPF_SoftFail 9120 3.39 5.21 2.50 66 RCVD_IN_MSPIKE_BL 8824 2.16 5.04 0.76 67 XM_B_SpammyTLD 8773 3.11 5.01 2.19 68 XM_B_Investor 8761 2.57 5.01 1.38 69 TooManyTo_001 8712 7.50 4.98 8.72 70 TR_XM_MSPIKECOMBO 8579 2.11 4.90 0.75 71 T_XMDrugObfuBody_08 8133 2.56 4.65 1.54 72 TM2_M_VERY_LONG_WORD 7943 2.44 4.54 1.42 73 XM_DIRTYINTL 7876 1.68 4.50 0.31 74 TR_XM_SpammyWords5 7831 2.64 4.47 1.75 75 HTML_IMAGE_RATIO_04 7635 4.25 4.36 4.19 76 MIME_HTML_MOSTLY 7605 3.09 4.35 2.48 77 XM_OfRef6 7286 2.02 4.16 0.97 78 XMBody_17 7105 1.62 4.06 0.43 79 TR_XM_DK_SendGrid 6913 3.78 3.95 3.69 80 T_FILL_THIS_FORM_SHORT 6868 1.91 3.92 0.92 81 XMNumbers 6744 3.89 3.85 3.90 82 URIBL_DBL_SPAM 6330 1.19 3.62 0.01 83 TR_XM_SpammyWords3 6226 1.46 3.56 0.44 84 SpammyFromTLD_02 6172 1.36 3.53 0.30 85 XM_B_Phish66 6104 2.54 3.49 2.08 86 T_XMDrugObfuBody_14 6100 2.09 3.49 1.42 87 HTML_MIME_NO_HTML_TAG 6075 2.61 3.47 2.19 88 XMStrtUSub 5686 4.30 3.25 4.82 89 ALL_TRUSTED 5492 12.25 3.14 16.70 90 MIME_QP_LONG_LINE 5491 4.53 3.14 5.20 91 XM_DK_Undo_01 5376 2.31 3.07 1.93 92 XM_UB50 5360 1.68 3.06 1.01 93 HTML_IMAGE_RATIO_08 5338 2.64 3.05 2.44 94 XM_URI_RBL 5306 1.10 3.03 0.15 95 RCVD_IN_MSPIKE_H4 5215 4.91 2.98 5.85 96 RCVD_IN_VALIDITY_SAFE 5214 4.86 2.98 5.77 97 HTML_IMAGE_RATIO_06 5045 3.68 2.88 4.06 98 DKIM_INVALID 4968 3.00 2.84 3.08 99 URI_NOVOWEL 4922 2.34 2.81 2.11 100 XMLngstWrd_00 4876 1.25 2.79 0.50 101 XMLngstWrd_01 4776 1.18 2.73 0.43 102 FROM_EXCESS_BASE64 4642 2.58 2.65 2.54 103 XMLngstWrd_02 4633 1.10 2.65 0.34 104 SpammyFromTLD_01 4509 1.37 2.58 0.78 105 TM2_M_URI_OPT_OUT 4504 2.03 2.57 1.76 106 T_REMOTE_IMAGE 4441 3.40 2.54 3.82 107 XM_B_SpammyWords4 4421 1.26 2.53 0.65 108 XM_GoogleGroups 4419 1.66 2.52 1.24 109 HK_RANDOM_REPLYTO 4418 0.89 2.52 0.10 110 RCVD_IN_VALIDITY_CERTIFIED 4341 4.38 2.48 5.30 111 XMDiploma_00 4323 1.78 2.47 1.44 112 USER_IN_DEF_DKIM_WL 4322 9.53 2.47 12.97 113 RCVD_IN_MSPIKE_L5 4290 0.84 2.45 0.06 114 XMLngstWrd_03 4190 0.96 2.39 0.26 115 XMLngstWrd_04 4093 0.90 2.34 0.19 116 SUBJ_ALL_CAPS 4075 2.17 2.33 2.10 117 RCVD_IN_VALIDITY_RPBL 3969 0.81 2.27 0.10 118 PDS_OTHER_BAD_TLD 3947 0.94 2.26 0.30 119 XM_CamelCaseFrm001 3942 2.05 2.25 1.95 120 XM_B_Unsub2 3883 1.88 2.22 1.71 121 URI_PHP_REDIR 3826 0.72 2.19 0.00 122 XM_H_Undi_Recip 3790 0.90 2.17 0.28 123 TR_XM_FormFill 3757 0.72 2.15 0.02 124 TR_XM_NoHeaderRelay 3709 0.78 2.12 0.13 125 RCVD_IN_MSPIKE_L3 3666 1.09 2.09 0.59 126 T_XMHurry_00 3487 1.13 1.99 0.71 127 RCVD_IN_IADB_LISTED 3407 3.83 1.95 4.75 128 TR_XM_SB_Phish 3352 2.16 1.92 2.27 129 T_TooManySym_01 3352 5.03 1.92 6.55 130 HTML_TITLE_SUBJ_DIFF 3332 0.65 1.90 0.03 131 HTTPS_HTTP_MISMATCH 3283 1.10 1.88 0.72 132 TR_Mismatch_TLD_02 3240 0.69 1.85 0.13 133 XMSexyCombo_01 3240 1.31 1.85 1.04 134 UPPERCASE_75_100 3234 0.62 1.85 0.03 135 XMSubPhish11 3193 2.10 1.82 2.24 136 FONT_INVIS_LONG_LINE 3160 0.70 1.81 0.16 137 T_XMDrugObfuBody_00 3152 1.13 1.80 0.81 138 MAILING_LIST_MULTI 3152 2.33 1.80 2.59 139 XMStockSpam_06 3126 1.50 1.79 1.36 140 XMBdyGiftCard01 3063 1.22 1.75 0.96 141 RCVD_IN_IADB_SPF 3057 3.44 1.75 4.26 142 TR_XM_Undi_Recip11 2947 0.59 1.68 0.06 143 RELAYCOUNTRY_IN 2905 0.63 1.66 0.12 144 TR_XM_BayesRelay 2847 0.53 1.63 0.00 145 RCVD_IN_IADB_DK 2846 3.07 1.63 3.78 146 TR_LOTS_OF_MONEY3 2832 0.76 1.62 0.35 147 RCVD_IN_IADB_SENDERID 2821 3.13 1.61 3.87 148 BAYES_40 2759 3.73 1.58 4.79 149 XM_B_COVIDMETA 2695 0.69 1.54 0.28 150 FROM_SUSPICIOUS_NTLD 2688 0.53 1.54 0.05 151 TR_XM_PHPDW 2663 0.97 1.52 0.69 152 XM_UB99 2655 0.50 1.52 0.01 153 URI_HEX 2611 1.36 1.49 1.29 154 TR_XM_PHPForged 2601 0.93 1.49 0.65 155 LongTLD 2600 0.73 1.49 0.36 156 URIBL_BLACK 2587 0.52 1.48 0.05 157 TR_XM_FormFill2 2559 0.91 1.46 0.65 158 XM_H_PHPOS 2545 0.91 1.45 0.64 159 TR_XM_Base64_M1 2491 1.15 1.42 1.01 160 FROM_SUSPICIOUS_NTLD_FP 2469 0.49 1.41 0.04 161 KHOP_HELO_FCRDNS 2465 1.37 1.41 1.35 162 XMHTML_After_End 2452 1.15 1.40 1.03 163 HTML_TAG_BALANCE_BODY 2220 0.85 1.27 0.64 164 RELAYCOUNTRY_AU 2208 0.59 1.26 0.26 165 BAYES_20 2201 3.14 1.26 4.06 166 XMPhish30 2182 1.11 1.25 1.05 167 XMReplyNow 2159 0.84 1.23 0.65 168 XMSubMetaI_00 2137 1.24 1.22 1.25 169 XMSubMetaSxObfu_03 2133 1.11 1.22 1.05 170 TR_XM_COVIDMETA4 2088 0.52 1.19 0.20 171 TR_XM_InvalidRelay 2084 0.40 1.19 0.02 172 MPART_ALT_DIFF_COUNT 2064 0.78 1.18 0.58 173 TR_Mismatch_TLD_01 2057 0.54 1.18 0.24 174 XMPhish14 2007 0.73 1.15 0.53 175 SHOPIFY_IMG_NOT_RCVD_SFY 1977 0.50 1.13 0.20 176 XM_Combo_Sbj 1966 0.50 1.12 0.19 177 XM_B_SEO 1954 0.47 1.12 0.15 178 XMGenDplmaNmb 1945 0.78 1.11 0.62 179 BOTNET_NORDNS 1944 0.37 1.11 0.01 180 XMBrknScrpt_02 1929 0.95 1.10 0.88 181 TR_XM_MSPIKECOMBO2 1918 0.40 1.10 0.05 182 XM_UB999 1892 0.36 1.08 0.00 183 RCVD_IN_PSBL 1881 0.61 1.07 0.38 184 RELAYCOUNTRY_FR 1877 0.56 1.07 0.31 185 XM_B_DNDMA 1838 0.61 1.05 0.39 186 XM_ProductURIs 1836 0.70 1.05 0.52 187 DIET_1 1826 0.63 1.04 0.42 188 TR_XM_Undi_Recip5 1824 0.35 1.04 0.01 189 BAYES_00 1762 6.72 1.01 9.50 190 UNDISC_MONEY 1654 0.31 0.94 0.01 191 XM_UB60 1643 0.36 0.94 0.08 192 URI_TRY_3LD 1642 0.82 0.94 0.76 193 TR_XM_Undi_Recip6 1642 0.31 0.94 0.00 194 RELAYCOUNTRY_GB 1630 0.68 0.93 0.55 195 TR_XM_Spammywords 1620 0.50 0.93 0.30 196 XM_S_SpammyWords 1620 0.50 0.93 0.30 197 TR_XM_COVIDMETA1 1619 0.41 0.92 0.16 198 TR_XM_Undi_Recip2 1598 0.31 0.91 0.02 199 TR_MetaPhish_Combo_01b 1591 0.41 0.91 0.16 200 TR_XM_Undi_RecipCombo2 1580 0.30 0.90 0.01 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 313898 90.00 95.08 87.51 2 RELAYCOUNTRY_US 288001 79.79 78.77 80.29 3 DKIM_SIGNED 273043 80.40 89.15 76.12 4 XM_DK_Pass 265475 78.41 87.42 74.01 5 DKIM_VALID 262000 77.40 86.32 73.04 6 XM_B_Unicode 255894 75.35 83.58 71.34 7 DCC_CHECK_NEGATIVE 224583 50.79 26.56 62.61 8 DKIM_VALID_AU 208055 60.13 64.48 58.00 9 BAYES_50 206105 52.30 41.72 57.46 10 XMListUnsubscribeExists 181501 57.87 72.78 50.60 11 XM_B_SpammyWords 163939 53.93 70.78 45.71 12 XM_B_Unicode3 148730 42.35 44.17 41.47 13 RCVD_IN_MSPIKE_H2 148398 43.77 48.68 41.37 14 DCC_CHECK 133897 49.16 73.41 37.33 15 T_TM2_M_HEADER_IN_MSG 105172 27.03 22.34 29.32 16 HTML_FONT_LOW_CONTRAST 104423 30.81 34.29 29.11 17 DKIM_VALID_EF 102595 30.36 33.97 28.60 18 FVGT_m_MULTI_ODD 95910 29.61 35.51 26.74 19 LOC_TINY_FONT_1 90233 29.82 39.36 25.16 20 XMSubLong 80397 22.06 21.35 22.41 21 T_KAM_HTML_FONT_INVALID 76869 24.44 30.60 21.43 22 XM_B_SpammyWords2 72129 26.92 40.88 20.11 23 MIME_HTML_ONLY 66237 23.22 32.97 18.47 24 RCVD_IN_MSPIKE_WL 64765 17.37 15.98 18.06 25 ALL_TRUSTED 59910 12.25 3.14 16.70 26 XM_Multi_Part_URI 48011 15.32 19.29 13.39 27 USER_IN_DEF_DKIM_WL 46524 9.53 2.47 12.97 28 XM_Body_Dirty_Words 41642 15.11 22.30 11.61 29 RCVD_IN_MSPIKE_H3 39093 11.52 12.79 10.90 30 UNPARSEABLE_RELAY 36077 11.20 13.54 10.06 31 BAYES_60 35079 9.17 7.92 9.78 32 BAYES_00 34091 6.72 1.01 9.50 33 XM_DKIMWhitelistDomains 33471 6.30 0.09 9.33 34 LotsOfNums_01 32622 8.41 7.01 9.09 35 XM_B_Unsub 32166 10.52 13.70 8.97 36 TooManyTo_001 31295 7.50 4.98 8.72 37 XM_Evil_Numbers_Gen 28423 8.41 9.40 7.92 38 IN_ZIMBRA_NJ_WHITELIST 24883 4.69 0.09 6.94 39 TR_XM_BayesUnsub 24111 8.91 13.40 6.72 40 TR_XM_DK_Bayes 23611 4.66 0.71 6.58 41 T_TooManySym_01 23486 5.03 1.92 6.55 42 TR_XM_DK_Bayes1 23164 4.53 0.57 6.46 43 XM_DK_Undo_02 22816 18.71 44.02 6.36 44 LOTS_OF_MONEY 21555 8.00 12.07 6.01 45 HTML_IMAGE_RATIO_02 21261 6.13 6.54 5.93 46 RCVD_IN_MSPIKE_H4 20969 4.91 2.98 5.85 47 RCVD_IN_VALIDITY_SAFE 20705 4.86 2.98 5.77 48 XM_SendGrid 20689 5.92 6.24 5.77 49 TR_XM_DK_Bayes2 20426 3.98 0.47 5.69 50 XM_H_Long_From01 19079 5.60 6.17 5.32 51 RCVD_IN_VALIDITY_CERTIFIED 19028 4.38 2.48 5.30 52 MIME_QP_LONG_LINE 18660 4.53 3.14 5.20 53 BOTNET_IPINHOSTNAME 18282 8.15 14.40 5.10 54 XM_B_SpammyWords3 17857 7.54 12.79 4.98 55 XM_PDF 17740 3.53 0.63 4.95 56 XMStrtUSub 17286 4.30 3.25 4.82 57 BAYES_40 17172 3.73 1.58 4.79 58 RCVD_IN_IADB_LISTED 17046 3.83 1.95 4.75 59 TR_XM_DKIM_Undo 16927 14.96 35.94 4.72 60 BAYES_80 16847 5.98 8.62 4.70 61 BAYES_99 16621 13.57 31.89 4.63 62 FSL_BULK_SIG 15710 6.33 10.32 4.38 63 RCVD_IN_IADB_SPF 15279 3.44 1.75 4.26 64 HTML_IMAGE_RATIO_04 15045 4.25 4.36 4.19 65 HTML_IMAGE_RATIO_06 14578 3.68 2.88 4.06 66 BAYES_20 14574 3.14 1.26 4.06 67 XMSubMetaSx_00 14527 4.64 5.86 4.05 68 TR_XM_PhishingBody 14510 4.84 6.45 4.05 69 T_TooManySym_02 14164 2.84 0.55 3.95 70 XMNumbers 14005 3.89 3.85 3.90 71 RCVD_IN_IADB_SENDERID 13867 3.13 1.61 3.87 72 T_REMOTE_IMAGE 13713 3.40 2.54 3.82 73 XM_UncommonTLD01 13641 4.97 7.36 3.80 74 TR_XM_SpammyWords4 13593 5.89 10.20 3.79 75 RCVD_IN_IADB_DK 13553 3.07 1.63 3.78 76 RELAYCOUNTRY_META 13334 9.17 20.33 3.72 77 TR_XM_DK_SendGrid 13242 3.78 3.95 3.69 78 MPART_ALT_DIFF 13078 5.23 8.47 3.65 79 XM_B_Phish_Phrases 13076 4.24 5.47 3.65 80 BAYES_999 12744 10.41 24.46 3.55 81 XMSexyCombo_05 11502 5.50 10.20 3.21 82 DKIM_INVALID 11043 3.00 2.84 3.08 83 BAYES_95 10384 3.69 5.32 2.90 84 RCVD_IN_IADB_VOUCHED 10325 2.23 0.90 2.88 85 MAILING_LIST_MULTI 9298 2.33 1.80 2.59 86 FROM_EXCESS_BASE64 9116 2.58 2.65 2.54 87 XM_SPF_SoftFail 8970 3.39 5.21 2.50 88 MIME_HTML_MOSTLY 8892 3.09 4.35 2.48 89 HTML_IMAGE_RATIO_08 8748 2.64 3.05 2.44 90 TR_XM_SB_Phish 8154 2.16 1.92 2.27 91 XMSubPhish11 8025 2.10 1.82 2.24 92 TooManyTo_002 7856 1.67 0.60 2.19 93 HTML_MIME_NO_HTML_TAG 7853 2.61 3.47 2.19 94 XM_B_SpammyTLD 7846 3.11 5.01 2.19 95 BAYES_05 7801 1.69 0.70 2.17 96 URI_NOVOWEL 7556 2.34 2.81 2.11 97 SUBJ_ALL_CAPS 7532 2.17 2.33 2.10 98 XM_B_Phish66 7467 2.54 3.49 2.08 99 TR_XM_UnparsRelay 7338 4.14 8.43 2.05 100 MIME_HTML_ONLY_MULTI 7193 3.06 5.22 2.01 101 XM_CamelCaseFrm001 6998 2.05 2.25 1.95 102 INVALID_MSGID 6937 1.34 0.11 1.93 103 XM_DK_Undo_01 6933 2.31 3.07 1.93 104 RCVD_IN_IADB_OPTIN 6850 1.47 0.57 1.91 105 MSGID_NOFQDN1 6497 1.23 0.04 1.81 106 BOUNCE_MESSAGE 6404 1.43 0.70 1.79 107 ANY_BOUNCE_MESSAGE 6404 1.43 0.70 1.79 108 BOTNET 6345 4.14 8.99 1.77 109 IN_HORDE_ADDRESS_BOOK 6340 1.21 0.08 1.77 110 TM2_M_URI_OPT_OUT 6312 2.03 2.57 1.76 111 TR_XM_SpammyRelay 6296 6.19 15.28 1.76 112 HELO_NODOT 6286 1.35 0.53 1.75 113 HELO_NO_DOMAIN 6282 1.35 0.53 1.75 114 TR_XM_SpammyWords5 6280 2.64 4.47 1.75 115 XM_B_Unsub2 6149 1.88 2.22 1.71 116 TO_MALFORMED 5959 1.12 0.01 1.66 117 TVD_RCVD_IP 5921 1.17 0.20 1.65 118 T_TooManySym_03 5740 1.15 0.23 1.60 119 TR_DCC_Bayes_99 5561 8.68 23.28 1.55 120 T_XMDrugObfuBody_08 5525 2.56 4.65 1.54 121 UNTRUSTED_Relay 5425 3.39 7.24 1.51 122 TooManyTo_003 5340 1.16 0.50 1.49 123 TVD_SPACE_RATIO 5267 1.02 0.10 1.47 124 XMDiploma_00 5171 1.78 2.47 1.44 125 TM2_M_VERY_LONG_WORD 5088 2.44 4.54 1.42 126 T_XMDrugObfuBody_14 5076 2.09 3.49 1.42 127 XM_B_Investor 4937 2.57 5.01 1.38 128 XMStockSpam_06 4864 1.50 1.79 1.36 129 KHOP_HELO_FCRDNS 4832 1.37 1.41 1.35 130 TR_Symld_Words 4802 1.19 0.89 1.34 131 RCVD_IN_MSPIKE_H5 4703 0.95 0.20 1.31 132 URI_HEX 4633 1.36 1.49 1.29 133 XMSubMetaI_00 4483 1.24 1.22 1.25 134 XM_GoogleGroups 4454 1.66 2.52 1.24 135 XMBody_95 4416 0.87 0.12 1.23 136 XMCapTrack 4075 0.87 0.31 1.14 137 RCVD_IN_RP_SAFE 4063 0.96 0.59 1.13 138 RELAYCOUNTRY_CA 4000 4.02 9.98 1.12 139 TooManyTo_004 3934 0.86 0.39 1.10 140 XMBSHREFv2 3925 0.80 0.20 1.09 141 XM_H_Long_From02 3868 0.97 0.74 1.08 142 XMSubMetaSxObfu_03 3776 1.11 1.22 1.05 143 XMPhish30 3754 1.11 1.25 1.05 144 RCVD_IN_RP_CERTIFIED 3746 0.86 0.48 1.04 145 XMSexyCombo_01 3737 1.31 1.85 1.04 146 XMGappySubj_01 3706 0.73 0.12 1.03 147 XMHTML_After_End 3681 1.15 1.40 1.03 148 HTML_FONT_FACE_BAD 3661 0.93 0.74 1.02 149 TR_XM_Base64_M1 3640 1.15 1.42 1.01 150 XM_UB50 3616 1.68 3.06 1.01 151 XM_OfRef6 3472 2.02 4.16 0.97 152 XMBdyGiftCard01 3456 1.22 1.75 0.96 153 DKIM_ADSP_CUSTOM_MED 3350 0.83 0.62 0.93 154 T_FILL_THIS_FORM_SHORT 3308 1.91 3.92 0.92 155 TooManyTo_005 3297 0.74 0.36 0.92 156 XMBrknScrpt_02 3150 0.95 1.10 0.88 157 FVGT_m_MULTI_ODD_EMAIL 2967 0.59 0.09 0.83 158 XM_H_Trusted_IP 2937 0.55 0.00 0.82 159 T_XMDrugObfuBody_00 2891 1.13 1.80 0.81 160 SpammyFromTLD_01 2806 1.37 2.58 0.78 161 URI_TRY_3LD 2719 0.82 0.94 0.76 162 RCVD_IN_MSPIKE_BL 2714 2.16 5.04 0.76 163 TR_XM_MSPIKECOMBO 2677 2.11 4.90 0.75 164 TR_MetaPhish_Combo_01 2655 0.77 0.82 0.74 165 TR_XM_SpammyWords2 2639 4.44 12.04 0.74 166 FROM_GOV_DKIM_AU 2587 0.51 0.09 0.72 167 HTTPS_HTTP_MISMATCH 2579 1.10 1.88 0.72 168 T_XMHurry_00 2562 1.13 1.99 0.71 169 XM_RXBody 2525 0.76 0.87 0.70 170 TR_XM_PHPDW 2492 0.97 1.52 0.69 171 XMSexyCombo_04 2464 0.63 0.52 0.69 172 XMNoVowels 2421 0.58 0.40 0.67 173 XM_B_COPY_HTML 2416 0.70 0.77 0.67 174 TR_XM_PHPForged 2343 0.93 1.49 0.65 175 XM_H_PHPMailer 2337 0.66 0.69 0.65 176 TR_XM_FormFill2 2324 0.91 1.46 0.65 177 XM_B_SpammyWords4 2315 1.26 2.53 0.65 178 XMReplyNow 2314 0.84 1.23 0.65 179 HTML_TAG_BALANCE_BODY 2308 0.85 1.27 0.64 180 XM_H_PHPOS 2301 0.91 1.45 0.64 181 XM_ShortIntro_01 2262 0.63 0.61 0.63 182 XMGenDplmaNmb 2209 0.78 1.11 0.62 183 T_OBFU_PDF_ATTACH 2179 0.43 0.07 0.61 184 NML_ADSP_CUSTOM_MED 2129 0.55 0.45 0.59 185 RCVD_IN_MSPIKE_L3 2125 1.09 2.09 0.59 186 MPART_ALT_DIFF_COUNT 2074 0.78 1.18 0.58 187 FORGED_GMAIL_RCVD 2037 0.55 0.51 0.57 188 XMMoneyMeta_00 1991 0.61 0.72 0.56 189 RELAYCOUNTRY_GB 1981 0.68 0.93 0.55 190 XMPhish14 1913 0.73 1.15 0.53 191 SHORT_URI_3 1910 0.51 0.46 0.53 192 TO_NO_BRKTS_HTML_ONLY 1905 0.41 0.15 0.53 193 SHORT_HELO_AND_INLINE_IMAGE 1894 0.38 0.07 0.53 194 XM_ProductURIs 1879 0.70 1.05 0.52 195 HTML_IMAGE_ONLY_20 1799 0.52 0.56 0.50 196 XMLngstWrd_00 1791 1.25 2.79 0.50 197 RCVD_IN_SORBS_DUL 1676 0.36 0.14 0.47 198 HTML_IMAGE_ONLY_32 1671 0.40 0.27 0.47 199 XMSubMetaSxObfu_02 1626 0.43 0.39 0.45 200 MSGID_FROM_MTA_HEADER 1604 0.36 0.19 0.45 ----------------------------------------------------------------------