Email: 563228 Autolearn: 0 AvgScore: -1.41 AvgScanTime: 1.06 sec Spam: 101031 Autolearn: 0 AvgScore: 13.58 AvgScanTime: 1.23 sec Ham: 462197 Autolearn: 0 AvgScore: -4.69 AvgScanTime: 1.02 sec Time Spent Running SA: 165.15 hours Time Spent Processing Spam: 34.44 hours Time Spent Processing Ham: 130.71 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 99245 99.11 98.23 99.30 2 HTML_MESSAGE 91438 74.20 90.50 70.64 3 DKIM_SIGNED 71778 84.34 71.05 87.25 4 XM_DK_Pass 69659 83.30 68.95 86.44 5 XM_B_Unicode 68883 62.06 68.18 60.72 6 DKIM_VALID 68104 81.80 67.41 84.94 7 XM_B_SpammyWords 62040 63.34 61.41 63.77 8 XMListUnsubscribeExists 61327 50.90 60.70 48.75 9 RELAYCOUNTRY_US 57615 81.57 57.03 86.94 10 DKIM_VALID_AU 51535 67.69 51.01 71.33 11 XM_DK_Undo_02 49966 18.12 49.46 11.27 12 BAYES_99 39136 13.59 38.74 8.09 13 RELAYCOUNTRY_META 38341 10.84 37.95 4.91 14 XM_B_SpammyWords2 33159 22.20 32.82 19.87 15 UNTRUSTED_Relay 32369 7.74 32.04 2.43 16 XM_B_Unicode3 31939 35.50 31.61 36.35 17 DKIM_VALID_EF 31877 41.87 31.55 44.12 18 BAYES_50 31491 39.68 31.17 41.54 19 BOTNET 31126 7.20 30.81 2.04 20 BAYES_999 30280 10.83 29.97 6.64 21 LOC_TINY_FONT_1 30104 25.44 29.80 24.49 22 MIME_HTML_ONLY 28851 20.12 28.56 18.28 23 RCVD_IN_MSPIKE_H2 25807 23.04 25.54 22.50 24 HTML_FONT_LOW_CONTRAST 23933 26.02 23.69 26.53 25 T_KAM_HTML_FONT_INVALID 23514 17.25 23.27 15.93 26 XMSubLong 22665 17.89 22.43 16.89 27 FVGT_m_MULTI_ODD 21960 19.91 21.74 19.51 28 XM_UncommonTLD01 21887 6.34 21.66 2.99 29 XM_Multi_Part_URI 19164 13.10 18.97 11.82 30 T_TM2_M_HEADER_IN_MSG 18145 18.99 17.96 19.22 31 RCVD_IN_MSPIKE_BL 17720 3.80 17.54 0.80 32 XM_Body_Dirty_Words 15562 13.42 15.40 12.99 33 MPART_ALT_DIFF 14961 5.59 14.81 3.58 34 TR_XM_SpammyWords2 14864 4.88 14.71 2.73 35 MIME_HTML_MOSTLY 14733 4.43 14.58 2.21 36 XM_B_Unsub 13346 10.11 13.21 9.43 37 LOTS_OF_MONEY 13015 6.71 12.88 5.36 38 BOTNET_IPINHOSTNAME 12544 6.47 12.42 5.17 39 LotsOfNums_01 11151 8.51 11.04 7.96 40 HTML_IMAGE_RATIO_02 10861 7.87 10.75 7.23 41 XM_B_Phish_Phrases 10859 6.28 10.75 5.31 42 XM_UB50 10762 3.02 10.65 1.35 43 XMSexyCombo_05 10247 5.79 10.14 4.84 44 XM_B_SpammyWords3 10016 5.75 9.91 4.84 45 BAYES_80 9587 5.53 9.49 4.67 46 RCVD_IN_MSPIKE_L3 9582 2.15 9.48 0.55 47 RCVD_IN_BL_SPAMCOP_NET 8987 2.75 8.90 1.41 48 XM_SPF_SoftFail 8954 2.35 8.86 0.93 49 RCVD_IN_MSPIKE_WL 8736 22.30 8.65 25.28 50 RCVD_IN_RP_RNBL 8608 1.57 8.52 0.05 51 URI_PHP_REDIR 8502 1.52 8.42 0.01 52 SpammyFromTLD_01 8478 1.96 8.39 0.56 53 BAYES_60 8309 6.59 8.22 6.23 54 T_REMOTE_IMAGE 8295 3.45 8.21 2.40 55 URIBL_SBL_A 7834 1.63 7.75 0.30 56 SpammyFromTLD_02 7546 1.54 7.47 0.24 57 BOTNET_NORDNS 7348 1.31 7.27 0.01 58 TR_XM_SpammyWords3 7120 1.68 7.05 0.51 59 RELAYCOUNTRY_FR 7081 1.50 7.01 0.30 60 XMSubMetaSx_00 7081 3.71 7.01 2.98 61 XM_Evil_Numbers_Gen 7076 8.23 7.00 8.50 62 RELAYCOUNTRY_CA 6916 2.57 6.85 1.64 63 RCVD_IN_MSPIKE_L5 6780 1.35 6.71 0.18 64 XMNumbers 6675 3.88 6.61 3.28 65 XM_UB99 6612 1.18 6.54 0.01 66 SHORTENED_URL_HREF 6257 1.29 6.19 0.22 67 KHOP_HELO_FCRDNS 6107 1.65 6.04 0.68 68 TooManyTo_001 6046 23.22 5.98 26.99 69 SHORT_SHORTNER 5884 1.06 5.82 0.02 70 SHORT_URI_3 5869 1.07 5.81 0.04 71 BODY_URI_ONLY 5835 1.06 5.78 0.03 72 XM_B_SpammyTLD 5741 2.58 5.68 1.90 73 RELAYCOUNTRY_IN 5625 1.07 5.57 0.09 74 HTML_SHORT_LINK_IMG_1 5610 1.01 5.55 0.02 75 ANY_BOUNCE_MESSAGE 5579 2.79 5.52 2.19 76 HTML_IMAGE_ONLY_08 5577 1.08 5.52 0.11 77 BOUNCE_MESSAGE 5568 2.79 5.51 2.19 78 SHORTENER_SHORT_IMG 5525 0.98 5.47 0.00 79 SHORTENED_URL_SRC 5521 0.98 5.46 0.00 80 TR_XM_MaxBayes 5315 0.99 5.26 0.05 81 RCVD_IN_MSPIKE_H3 5244 12.40 5.19 13.98 82 XMBody_17 5242 1.81 5.19 1.07 83 HTML_MIME_NO_HTML_TAG 5139 1.96 5.09 1.28 84 BAYES_95 5099 3.28 5.05 2.89 85 XM_B_Unsub2 4794 2.61 4.75 2.15 86 XM_UB60 4717 0.95 4.67 0.14 87 XM_H_Long_From01 4699 4.30 4.65 4.23 88 TR_XM_MaxSPIKE 4593 0.83 4.55 0.02 89 RCVD_IN_PSBL 4553 0.86 4.51 0.06 90 XM_UB999 4509 0.80 4.46 0.00 91 UNPARSEABLE_RELAY 4482 7.24 4.44 7.86 92 XMBrknScrpt_02 4385 1.92 4.34 1.39 93 TM2_M_URI_OPT_OUT 4175 3.22 4.13 3.02 94 SUBJ_ALL_CAPS 4092 1.95 4.05 1.49 95 TR_XM_PhishingBody 4042 2.86 4.00 2.61 96 XM_UB80 4026 0.74 3.98 0.03 97 XM_DIRTYINTL 3968 1.04 3.93 0.41 98 HTML_IMAGE_RATIO_04 3917 4.67 3.88 4.85 99 XMStrtUSub 3676 4.30 3.64 4.45 100 DKIM_INVALID 3674 2.55 3.64 2.31 101 XM_OfRef6 3546 1.44 3.51 0.98 102 XM_SendGrid 3316 6.49 3.28 7.19 103 RCVD_IN_MSPIKE_H4 3289 8.30 3.26 9.41 104 T_XMDrugObfuBody_08 2971 1.55 2.94 1.24 105 T_FONT_INVIS_NAKED_TO 2906 2.03 2.88 1.84 106 RELAYCOUNTRY_JP 2886 0.57 2.86 0.07 107 XM_B_COVIDMETA 2821 1.09 2.79 0.72 108 MIME_CHARSET_FARAWAY 2772 0.61 2.74 0.14 109 HTML_IMAGE_RATIO_06 2703 3.22 2.68 3.34 110 TR_XM_UnparsRelay 2667 1.00 2.64 0.64 111 XMSubNoVowel 2650 0.97 2.62 0.60 112 T_FILL_THIS_FORM_SHORT 2640 0.97 2.61 0.62 113 BAYES_40 2629 3.28 2.60 3.43 114 T_PDS_OTHER_BAD_TLD 2559 0.90 2.53 0.54 115 XM_BadFromFormat 2536 0.59 2.51 0.17 116 ALL_TRUSTED 2515 7.83 2.49 9.00 117 DATE_IN_PAST_03_06 2492 0.51 2.47 0.08 118 HTML_IMAGE_ONLY_32 2475 0.60 2.45 0.20 119 TR_XM_COVIDMETA4 2421 0.67 2.40 0.29 120 HTML_IMAGE_RATIO_08 2411 2.20 2.39 2.15 121 URI_TRY_3LD 2374 1.38 2.35 1.17 122 XM_UB95 2335 0.43 2.31 0.02 123 URI_OPTOUT_3LD 2233 0.44 2.21 0.05 124 TR_LOTS_OF_MONEY3 2223 0.78 2.20 0.47 125 DKIM_ADSP_CUSTOM_MED 2216 1.17 2.19 0.95 126 FROM_SUSPICIOUS_NTLD 2215 0.44 2.19 0.06 127 TO_IN_SUBJ 2191 0.46 2.17 0.09 128 SUBJECT_NEEDS_ENCODING 2171 0.39 2.15 0.01 129 SUBJ_ILLEGAL_CHARS 2171 0.39 2.15 0.01 130 FROM_EXCESS_BASE64 2160 2.89 2.14 3.06 131 NML_ADSP_CUSTOM_MED 2159 0.93 2.14 0.66 132 TR_Mismatch_TLD_01 2155 0.52 2.13 0.17 133 FROM_SUSPICIOUS_NTLD_FP 2123 0.42 2.10 0.05 134 RELAYCOUNTRY_DE 2097 0.78 2.08 0.50 135 TR_Caps_n_Bayes_99 2071 0.54 2.05 0.21 136 TM2_M_VERY_LONG_WORD 2061 1.33 2.04 1.17 137 BAYES_20 2021 2.42 2.00 2.51 138 XMSexyCombo_01 2018 0.75 2.00 0.48 139 XMDiploma_00 2002 1.76 1.98 1.71 140 XM_CamelCaseFrm001 1989 1.59 1.97 1.50 141 XM_B_Phish66 1943 1.18 1.92 1.02 142 RELAYCOUNTRY_GB 1939 0.86 1.92 0.63 143 TooManyTo_002 1932 18.39 1.91 21.99 144 RELAYCOUNTRY_NL 1882 0.56 1.86 0.28 145 TR_XM_PHPDW 1879 0.59 1.86 0.31 146 XMLngstWrd_00 1879 0.57 1.86 0.29 147 XM_URI_RBL 1856 0.48 1.84 0.18 148 TR_XM_PHPForged 1852 0.58 1.83 0.30 149 URI_HEX 1843 1.68 1.82 1.65 150 TR_XM_FormFill2 1840 0.57 1.82 0.30 151 XM_H_PHPOS 1839 0.57 1.82 0.29 152 LH_URI_DOM_IN_PATH 1837 1.71 1.82 1.69 153 FORGED_GMAIL_RCVD 1827 0.72 1.81 0.48 154 XM_Lotto 1815 0.39 1.80 0.08 155 T_XMHurry_00 1780 1.11 1.76 0.97 156 TooManyTo_003 1758 1.19 1.74 1.07 157 LongTLD 1715 0.43 1.70 0.16 158 XM_B_Crypto 1687 0.34 1.67 0.05 159 PDS_BTC_ID 1683 0.33 1.67 0.04 160 TR_XM_SB_Phish 1652 1.36 1.64 1.30 161 RCVD_IN_RP_SAFE 1648 7.35 1.63 8.60 162 XMSubPhish11 1616 1.35 1.60 1.30 163 XM_SPF_Unknown 1609 0.53 1.59 0.30 164 XMBounce_01 1608 0.37 1.59 0.11 165 T_TooManySym_01 1604 3.73 1.59 4.20 166 CHARSET_FARAWAY_HEADER 1590 0.32 1.57 0.05 167 TR_XM_Crypto2 1587 0.30 1.57 0.02 168 DATE_IN_PAST_06_12 1564 0.32 1.55 0.06 169 MILLION_HUNDRED 1564 0.28 1.55 0.00 170 NUMERIC_HTTP_ADDR 1560 0.76 1.54 0.59 171 XMSexyCombo_04 1534 0.37 1.52 0.12 172 MIMEOLE_DIRECT_TO_MX 1498 0.27 1.48 0.00 173 TR_XM_FormFill 1493 0.33 1.48 0.08 174 TooManyTo_004 1491 0.94 1.48 0.82 175 TR_XM_INV_DKIM 1486 0.38 1.47 0.14 176 DOS_OE_TO_MX 1460 0.26 1.45 0.00 177 T_XMDrugObfuBody_00 1437 0.70 1.42 0.54 178 RDNS_DYNAMIC 1429 0.67 1.41 0.51 179 URI_WP_HACKED_2 1422 0.49 1.41 0.28 180 NORMAL_HTTP_TO_IP 1410 0.27 1.40 0.03 181 TR_XM_DK_SendGrid 1386 3.68 1.37 4.19 182 TR_XM_RelayPhish 1384 0.34 1.37 0.12 183 BAYES_00 1358 22.12 1.34 26.66 184 URI_NO_WWW_BIZ_CGI 1355 0.25 1.34 0.01 185 XMLngstWrd_01 1354 0.45 1.34 0.25 186 MIME_HTML_ONLY_MULTI 1343 1.77 1.33 1.86 187 XMSubMetaSx_01 1341 0.29 1.33 0.06 188 LOCALPART_IN_SUBJECT 1323 0.25 1.31 0.02 189 XM_RXBody 1322 0.69 1.31 0.55 190 XM_B_SpammyWords4 1311 0.67 1.30 0.54 191 HTML_EXTRA_CLOSE 1300 0.26 1.29 0.04 192 RCVD_IN_RP_CERTIFIED 1277 6.90 1.26 8.14 193 MONEY_FORM_SHORT 1256 0.22 1.24 0.00 194 FORM_FRAUD_5 1252 0.22 1.24 0.00 195 T_Symld_Words_02 1238 0.59 1.23 0.45 196 TR_MetaPhish_Combo_01 1232 0.65 1.22 0.53 197 XMStockSpam_06 1226 1.55 1.21 1.63 198 XM_Combo_Sbj 1210 0.34 1.20 0.16 199 HTML_IMAGE_ONLY_28 1204 0.39 1.19 0.21 200 TR_Symld_Words 1201 1.24 1.19 1.26 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 458949 99.11 98.23 99.30 2 DKIM_SIGNED 403271 84.34 71.05 87.25 3 RELAYCOUNTRY_US 401837 81.57 57.03 86.94 4 XM_DK_Pass 399500 83.30 68.95 86.44 5 DKIM_VALID 392605 81.80 67.41 84.94 6 DKIM_VALID_AU 329699 67.69 51.01 71.33 7 HTML_MESSAGE 326493 74.20 90.50 70.64 8 XM_B_SpammyWords 294722 63.34 61.41 63.77 9 XM_B_Unicode 280665 62.06 68.18 60.72 10 XMListUnsubscribeExists 225342 50.90 60.70 48.75 11 DKIM_VALID_EF 203930 41.87 31.55 44.12 12 BAYES_50 191991 39.68 31.17 41.54 13 XM_B_Unicode3 168004 35.50 31.61 36.35 14 XM_DKIMWhitelistDomains 131383 23.33 0.00 28.43 15 TooManyTo_001 124748 23.22 5.98 26.99 16 BAYES_00 123225 22.12 1.34 26.66 17 HTML_FONT_LOW_CONTRAST 122629 26.02 23.69 26.53 18 RCVD_IN_MSPIKE_WL 116844 22.30 8.65 25.28 19 TR_XM_DK_Bayes 115867 20.60 0.17 25.07 20 TR_XM_DK_Bayes1 115074 20.46 0.17 24.90 21 LOC_TINY_FONT_1 113195 25.44 29.80 24.49 22 TR_XM_DK_Bayes2 112413 19.99 0.16 24.32 23 RCVD_IN_MSPIKE_H2 103988 23.04 25.54 22.50 24 TooManyTo_002 101628 18.39 1.91 21.99 25 XM_B_SpammyWords2 91851 22.20 32.82 19.87 26 FVGT_m_MULTI_ODD 90183 19.91 21.74 19.51 27 T_TM2_M_HEADER_IN_MSG 88838 18.99 17.96 19.22 28 MIME_HTML_ONLY 84495 20.12 28.56 18.28 29 XMSubLong 78086 17.89 22.43 16.89 30 T_KAM_HTML_FONT_INVALID 73626 17.25 23.27 15.93 31 RCVD_IN_MSPIKE_H3 64608 12.40 5.19 13.98 32 XM_Body_Dirty_Words 60047 13.42 15.40 12.99 33 XM_Multi_Part_URI 54618 13.10 18.97 11.82 34 XM_DK_Undo_02 52084 18.12 49.46 11.27 35 XM_B_Unsub 43602 10.11 13.21 9.43 36 RCVD_IN_MSPIKE_H4 43475 8.30 3.26 9.41 37 ALL_TRUSTED 41579 7.83 2.49 9.00 38 RCVD_IN_RP_SAFE 39771 7.35 1.63 8.60 39 XM_Evil_Numbers_Gen 39279 8.23 7.00 8.50 40 RCVD_IN_RP_CERTIFIED 37601 6.90 1.26 8.14 41 BAYES_99 37382 13.59 38.74 8.09 42 LotsOfNums_01 36806 8.51 11.04 7.96 43 UNPARSEABLE_RELAY 36308 7.24 4.44 7.86 44 HTML_IMAGE_RATIO_02 33437 7.87 10.75 7.23 45 XM_SendGrid 33212 6.49 3.28 7.19 46 BAYES_999 30695 10.83 29.97 6.64 47 BAYES_60 28782 6.59 8.22 6.23 48 LOTS_OF_MONEY 24758 6.71 12.88 5.36 49 XM_B_Phish_Phrases 24534 6.28 10.75 5.31 50 BOTNET_IPINHOSTNAME 23894 6.47 12.42 5.17 51 RELAYCOUNTRY_META 22689 10.84 37.95 4.91 52 HTML_IMAGE_RATIO_04 22407 4.67 3.88 4.85 53 XM_B_SpammyWords3 22370 5.75 9.91 4.84 54 XMSexyCombo_05 22365 5.79 10.14 4.84 55 BAYES_80 21568 5.53 9.49 4.67 56 XMStrtUSub 20555 4.30 3.64 4.45 57 XM_H_Long_From01 19533 4.30 4.65 4.23 58 T_TooManySym_01 19396 3.73 1.59 4.20 59 TR_XM_DK_SendGrid 19365 3.68 1.37 4.19 60 IN_ZIMBRA_NJ_WHITELIST 18631 3.32 0.06 4.03 61 BAYES_05 18439 3.44 0.95 3.99 62 MIME_QP_LONG_LINE 18161 3.42 1.10 3.93 63 MPART_ALT_DIFF 16542 5.59 14.81 3.58 64 RCVD_IN_IADB_LISTED 16133 3.00 0.78 3.49 65 BAYES_40 15848 3.28 2.60 3.43 66 HTML_IMAGE_RATIO_06 15428 3.22 2.68 3.34 67 XMNumbers 15168 3.88 6.61 3.28 68 RCVD_IN_IADB_SPF 14206 2.64 0.66 3.07 69 FROM_EXCESS_BASE64 14137 2.89 2.14 3.06 70 TM2_M_URI_OPT_OUT 13942 3.22 4.13 3.02 71 XM_UncommonTLD01 13838 6.34 21.66 2.99 72 XMSubMetaSx_00 13791 3.71 7.01 2.98 73 BAYES_95 13373 3.28 5.05 2.89 74 RCVD_IN_IADB_SENDERID 12864 2.39 0.62 2.78 75 TR_XM_SpammyWords2 12628 4.88 14.71 2.73 76 RCVD_IN_IADB_DK 12422 2.32 0.63 2.69 77 TR_XM_PhishingBody 12086 2.86 4.00 2.61 78 BAYES_20 11584 2.42 2.00 2.51 79 UNTRUSTED_Relay 11210 7.74 32.04 2.43 80 T_REMOTE_IMAGE 11114 3.45 8.21 2.40 81 T_TooManySym_02 10893 2.03 0.54 2.36 82 DKIM_INVALID 10666 2.55 3.64 2.31 83 MIME_HTML_MOSTLY 10224 4.43 14.58 2.21 84 ANY_BOUNCE_MESSAGE 10140 2.79 5.52 2.19 85 BOUNCE_MESSAGE 10126 2.79 5.51 2.19 86 HTML_IMAGE_RATIO_08 9957 2.20 2.39 2.15 87 XM_B_Unsub2 9918 2.61 4.75 2.15 88 RCVD_IN_IADB_VOUCHED 9463 1.74 0.35 2.05 89 BOTNET 9422 7.20 30.81 2.04 90 XM_B_SpammyTLD 8764 2.58 5.68 1.90 91 RCVD_IN_MSPIKE_H5 8761 1.59 0.20 1.90 92 MAILING_LIST_MULTI 8723 1.70 0.84 1.89 93 MIME_HTML_ONLY_MULTI 8616 1.77 1.33 1.86 94 T_FONT_INVIS_NAKED_TO 8519 2.03 2.88 1.84 95 XMDiploma_00 7920 1.76 1.98 1.71 96 LH_URI_DOM_IN_PATH 7790 1.71 1.82 1.69 97 TVD_RCVD_IP 7669 1.42 0.33 1.66 98 URI_HEX 7634 1.68 1.82 1.65 99 RELAYCOUNTRY_CA 7580 2.57 6.85 1.64 100 XMStockSpam_06 7518 1.55 1.21 1.63 101 INVALID_MSGID 7036 1.34 0.52 1.52 102 HELO_MISC_IP 7036 1.44 1.09 1.52 103 CK_HELO_DYNAMIC_SPLIT_IP 7034 1.39 0.80 1.52 104 XM_CamelCaseFrm001 6941 1.59 1.97 1.50 105 SUBJ_ALL_CAPS 6902 1.95 4.05 1.49 106 URI_NOVOWEL 6780 1.39 1.05 1.47 107 RCVD_IN_BL_SPAMCOP_NET 6529 2.75 8.90 1.41 108 XMBrknScrpt_02 6430 1.92 4.34 1.39 109 TO_MALFORMED 6383 1.14 0.02 1.38 110 XM_DK_Undo_01 6337 1.25 0.67 1.37 111 XM_UB50 6230 3.02 10.65 1.35 112 XM_PDF 6182 1.17 0.40 1.34 113 T_XMDrugObfuBody_14 6142 1.25 0.89 1.33 114 TR_XM_SB_Phish 6031 1.36 1.64 1.30 115 RCVD_IN_IADB_OPTIN 6016 1.12 0.29 1.30 116 XMSubPhish11 5991 1.35 1.60 1.30 117 XMBSHREFv2 5962 1.09 0.19 1.29 118 HTML_MIME_NO_HTML_TAG 5906 1.96 5.09 1.28 119 TR_Symld_Words 5811 1.24 1.19 1.26 120 T_XMDrugObfuBody_08 5746 1.55 2.94 1.24 121 XMBdyGiftCard01 5489 1.10 0.72 1.19 122 TM2_M_VERY_LONG_WORD 5424 1.33 2.04 1.17 123 URI_TRY_3LD 5411 1.38 2.35 1.17 124 IN_HORDE_ADDRESS_BOOK 5321 0.97 0.15 1.15 125 XMSubMetaI_00 5064 1.03 0.74 1.10 126 XMBody_17 4966 1.81 5.19 1.07 127 TooManyTo_003 4936 1.19 1.74 1.07 128 XMGappySubj_01 4926 0.90 0.14 1.07 129 XM_H_Long_From02 4757 0.92 0.44 1.03 130 XM_B_Phish66 4722 1.18 1.92 1.02 131 USER_IN_DEF_DKIM_WL 4642 0.82 0.00 1.00 132 XM_OfRef6 4550 1.44 3.51 0.98 133 T_XMHurry_00 4472 1.11 1.76 0.97 134 DKIM_ADSP_CUSTOM_MED 4379 1.17 2.19 0.95 135 T_TooManySym_03 4310 0.79 0.15 0.93 136 XM_SPF_SoftFail 4281 2.35 8.86 0.93 137 XM_ProductURIs 4183 0.82 0.45 0.91 138 TooManyTo_004 3813 0.94 1.48 0.82 139 XM_GoogleGroups 3707 0.70 0.25 0.80 140 RCVD_IN_MSPIKE_BL 3680 3.80 17.54 0.80 141 XMBody_95 3443 0.70 0.49 0.74 142 XM_B_COVIDMETA 3345 1.09 2.79 0.72 143 XMHTML_After_End 3190 0.75 1.05 0.69 144 TR_MSPIKEBAYES00 3166 0.56 0.00 0.68 145 KHOP_HELO_FCRDNS 3162 1.65 6.04 0.68 146 TooManyTo_005 3126 0.76 1.12 0.68 147 XMGenDplmaNmb 3117 0.71 0.86 0.67 148 NML_ADSP_CUSTOM_MED 3060 0.93 2.14 0.66 149 SENDGRID_REDIR 3004 0.62 0.46 0.65 150 XMHTMLBadTable_001 2966 0.58 0.32 0.64 151 DKIM_ADSP_NXDOMAIN 2958 0.68 0.84 0.64 152 TR_XM_UnparsRelay 2945 1.00 2.64 0.64 153 RELAYCOUNTRY_GB 2890 0.86 1.92 0.63 154 T_FILL_THIS_FORM_SHORT 2846 0.97 2.61 0.62 155 XMSubNoVowel 2791 0.97 2.62 0.60 156 T_MONEY_PERCENT 2738 0.62 0.75 0.59 157 TR_LOTS_OF_MONEY2 2738 0.62 0.75 0.59 158 NUMERIC_HTTP_ADDR 2726 0.76 1.54 0.59 159 XM_H_Trusted_IP 2690 0.48 0.00 0.58 160 XMPhish14 2643 0.61 0.80 0.57 161 XMPhish08 2639 0.57 0.59 0.57 162 XMBody_78 2600 0.63 0.96 0.56 163 SpammyFromTLD_01 2580 1.96 8.39 0.56 164 XM_RXBody 2557 0.69 1.31 0.55 165 RCVD_IN_MSPIKE_L3 2550 2.15 9.48 0.55 166 T_TooManySym_04 2543 0.46 0.05 0.55 167 T_XMDrugObfuBody_00 2511 0.70 1.42 0.54 168 T_PDS_OTHER_BAD_TLD 2503 0.90 2.53 0.54 169 XM_B_SpammyWords4 2488 0.67 1.30 0.54 170 TR_MetaPhish_Combo_01 2440 0.65 1.22 0.53 171 TR_BOTNET_NEGATE 2376 0.48 0.32 0.51 172 RDNS_DYNAMIC 2347 0.67 1.41 0.51 173 PLING_QUERY 2347 0.61 1.10 0.51 174 NO_DNS_FOR_FROM 2346 0.58 0.90 0.51 175 TR_XM_SpammyWords3 2338 1.68 7.05 0.51 176 RELAYCOUNTRY_DE 2312 0.78 2.08 0.50 177 HTML_FONT_FACE_BAD 2300 0.51 0.56 0.50 178 XM_S_SubURI 2273 0.42 0.08 0.49 179 FORGED_GMAIL_RCVD 2238 0.72 1.81 0.48 180 XMSexyCombo_01 2198 0.75 2.00 0.48 181 XM_B_REG_HTML 2192 0.40 0.04 0.47 182 XM_B_COPY_HTML 2180 0.49 0.58 0.47 183 XM_ShortIntro_01 2161 0.51 0.68 0.47 184 TR_LOTS_OF_MONEY3 2156 0.78 2.20 0.47 185 DIET_1 2069 0.50 0.75 0.45 186 T_Symld_Words_02 2063 0.59 1.23 0.45 187 XMPhish30 2049 0.49 0.72 0.44 188 USER_IN_WELCOMELIST 1966 0.35 0.00 0.43 189 USER_IN_WHITELIST 1966 0.35 0.00 0.43 190 T_TooManySym_05 1930 0.34 0.00 0.42 191 XMSubMetaSxObfu_03 1909 0.49 0.83 0.41 192 XM_DIRTYINTL 1898 1.04 3.93 0.41 193 XMSubMetaSxObfu_02 1888 0.40 0.37 0.41 194 HTTPS_HTTP_MISMATCH 1887 0.45 0.64 0.41 195 HELO_NODOT 1882 0.49 0.86 0.41 196 HELO_NO_DOMAIN 1881 0.49 0.85 0.41 197 XMCapTrack 1869 0.36 0.18 0.40 198 MPART_ALT_DIFF_COUNT 1857 0.49 0.88 0.40 199 THIS_AD 1825 0.39 0.36 0.39 200 HTML_IMAGE_ONLY_20 1707 0.36 0.34 0.37 ----------------------------------------------------------------------