Email: 412600 Autolearn: 0 AvgScore: 4.06 AvgScanTime: 1.23 sec Spam: 136553 Autolearn: 0 AvgScore: 13.91 AvgScanTime: 1.32 sec Ham: 276047 Autolearn: 0 AvgScore: -0.81 AvgScanTime: 1.19 sec Time Spent Running SA: 141.37 hours Time Spent Processing Spam: 50.09 hours Time Spent Processing Ham: 91.28 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 123745 88.91 90.62 88.06 2 DCC_CHECK 108706 56.60 79.61 45.22 3 DKIM_SIGNED 102170 79.45 74.82 81.74 4 XM_DK_Pass 99933 78.15 73.18 80.60 5 DKIM_VALID 98168 76.73 71.89 79.12 6 XM_B_Unicode 97048 73.86 71.07 75.24 7 RELAYCOUNTRY_US 94143 78.91 68.94 83.84 8 XMListUnsubscribeExists 89595 61.67 65.61 59.72 9 XM_B_SpammyWords 85907 55.42 62.91 51.71 10 DKIM_VALID_AU 77967 61.26 57.10 63.31 11 XM_DK_Undo_02 57409 21.17 42.04 10.85 12 BAYES_99 51823 17.74 37.95 7.74 13 XM_B_SpammyWords2 49063 28.08 35.93 24.20 14 HTML_FONT_LOW_CONTRAST 48061 34.28 35.20 33.82 15 XM_B_Unicode3 46879 41.49 34.33 45.02 16 LOC_TINY_FONT_1 44310 30.43 32.45 29.43 17 BAYES_50 43599 46.12 31.93 53.14 18 MIME_HTML_ONLY 42465 25.72 31.10 23.06 19 BAYES_999 39243 13.74 28.74 6.32 20 TR_DCC_Bayes_99 38537 11.77 28.22 3.64 21 RELAYCOUNTRY_META 36882 12.31 27.01 5.04 22 RCVD_IN_MSPIKE_H2 36137 27.05 26.46 27.34 23 DKIM_VALID_EF 33802 28.68 24.75 30.63 24 T_KAM_HTML_FONT_INVALID 32241 19.91 23.61 18.08 25 UNTRUSTED_Relay 31944 9.40 23.39 2.48 26 FVGT_m_MULTI_ODD 30262 23.67 22.16 24.42 27 FSL_BULK_SIG 29076 10.55 21.29 5.24 28 T_TM2_M_HEADER_IN_MSG 28517 22.71 20.88 23.61 29 XMSubLong 28410 21.24 20.81 21.45 30 XM_Multi_Part_URI 26316 16.22 19.27 14.71 31 BOTNET 26128 7.76 19.13 2.14 32 DCC_CHECK_NEGATIVE 25678 42.02 18.80 53.51 33 TR_XM_SpammyWords2 20481 6.55 15.00 2.38 34 LOTS_OF_MONEY 20259 10.82 14.84 8.83 35 XM_Body_Dirty_Words 20200 14.69 14.79 14.64 36 RCVD_IN_MSPIKE_WL 19984 24.84 14.63 29.89 37 T_REMOTE_IMAGE 18507 6.92 13.55 3.64 38 BOTNET_IPINHOSTNAME 18342 8.65 13.43 6.29 39 XM_UncommonTLD01 17852 6.97 13.07 3.95 40 RCVD_IN_MSPIKE_BL 16559 4.67 12.13 0.99 41 HTML_SHORT_LINK_IMG_1 15687 4.00 11.49 0.30 42 HTML_IMAGE_ONLY_12 15547 4.04 11.39 0.41 43 BAYES_60 14397 9.07 10.54 8.35 44 XM_B_SpammyWords3 14131 7.25 10.35 5.71 45 XMBrknScrpt_02 14054 4.60 10.29 1.78 46 LotsOfNums_01 14003 9.30 10.25 8.82 47 XMSexyCombo_05 13771 6.77 10.08 5.14 48 BAYES_80 13381 6.57 9.80 4.98 49 KHOP_HELO_FCRDNS 13127 3.97 9.61 1.18 50 BODY_URI_ONLY 12317 3.18 9.02 0.29 51 XM_UB50 11912 3.66 8.72 1.16 52 RCVD_IN_BL_SPAMCOP_NET 11744 3.76 8.60 1.36 53 XM_B_Unsub 11637 10.15 8.52 10.96 54 XM_B_Phish_Phrases 11105 7.31 8.13 6.91 55 RCVD_IN_RP_RNBL 11007 2.76 8.06 0.13 56 RCVD_IN_MSPIKE_H3 10753 13.55 7.87 16.36 57 HTML_IMAGE_RATIO_02 10554 8.20 7.73 8.43 58 MPART_ALT_DIFF 10136 5.60 7.42 4.69 59 XM_Evil_Numbers_Gen 10007 8.73 7.33 9.42 60 XMSubMetaSx_00 9907 4.94 7.26 3.79 61 TR_XM_SpammyWords3 9675 2.75 7.09 0.60 62 TooManyTo_001 9164 6.55 6.71 6.47 63 XM_OfRef6 8708 3.23 6.38 1.67 64 RELAYCOUNTRY_CA 8601 3.40 6.30 1.97 65 MIME_HTML_MOSTLY 8564 3.64 6.27 2.34 66 RCVD_IN_MSPIKE_H4 8469 9.91 6.20 11.75 67 RCVD_IN_MSPIKE_L3 8103 2.42 5.93 0.68 68 UNPARSEABLE_RELAY 8013 8.27 5.87 9.46 69 BAYES_95 7598 4.11 5.56 3.39 70 SpammyFromTLD_01 6953 2.11 5.09 0.64 71 XM_UB60 6937 1.82 5.08 0.21 72 XM_UB99 6826 1.67 5.00 0.02 73 RCVD_IN_MSPIKE_L5 6779 1.81 4.96 0.24 74 BOTNET_NORDNS 6766 1.66 4.95 0.02 75 URIBL_SBL_A 6730 1.84 4.93 0.31 76 XMStrtUSub 6605 5.04 4.84 5.15 77 XMBody_17 6557 2.25 4.80 0.98 78 SpammyFromTLD_02 6326 1.65 4.63 0.17 79 XM_SendGrid 5941 7.17 4.35 8.57 80 XM_SPF_SoftFail 5893 2.15 4.32 1.08 81 TR_XM_PhishingBody 5826 3.08 4.27 2.49 82 XM_H_Long_From01 5779 4.90 4.23 5.23 83 XMNumbers 5748 4.02 4.21 3.92 84 HTML_FONT_SIZE_LARGE 5360 1.39 3.93 0.14 85 RELAYCOUNTRY_UA 5277 1.35 3.86 0.10 86 HTML_IMAGE_RATIO_04 5209 5.36 3.81 6.13 87 TR_LOTS_OF_MONEY3 5155 1.93 3.78 1.02 88 URI_PHP_REDIR 5113 1.24 3.74 0.01 89 XM_B_SpammyTLD 4863 2.74 3.56 2.34 90 TR_XM_MaxSPIKE 4826 1.19 3.53 0.02 91 HTML_MIME_NO_HTML_TAG 4764 1.86 3.49 1.06 92 HTML_IMAGE_RATIO_06 4712 3.89 3.45 4.10 93 T_FONT_INVIS_NAKED_TO 4663 2.89 3.41 2.63 94 XM_DIRTYINTL 4586 1.47 3.36 0.54 95 URI_HEX 4439 2.01 3.25 1.40 96 SUBJ_ALL_CAPS 4411 1.92 3.23 1.28 97 TR_XM_MaxBayes 4274 1.06 3.13 0.04 98 DATE_IN_PAST_03_06 4234 1.08 3.10 0.09 99 T_XMDrugObfuBody_08 4215 2.28 3.09 1.88 100 XM_UB999 4185 1.02 3.06 0.02 101 DKIM_ADSP_NXDOMAIN 4024 1.53 2.95 0.84 102 URI_TRY_3LD 4006 2.10 2.93 1.68 103 DKIM_INVALID 4002 2.72 2.93 2.62 104 HTML_IMAGE_RATIO_08 3871 2.71 2.83 2.65 105 HDRS_MISSP 3806 1.00 2.79 0.11 106 RCVD_IN_RP_SAFE 3765 8.34 2.76 11.10 107 TR_XM_DK_SendGrid 3758 4.69 2.75 5.65 108 TR_XM_UnparsRelay 3727 1.27 2.73 0.55 109 MIME_HEADER_CTYPE_ONLY 3615 0.92 2.65 0.07 110 RELAYCOUNTRY_FR 3568 1.00 2.61 0.21 111 RCVD_IN_PSBL 3549 0.87 2.60 0.01 112 XMSubNoVowel 3491 1.47 2.56 0.94 113 FROM_EXCESS_BASE64 3365 3.48 2.46 3.98 114 XM_UB80 3356 0.83 2.46 0.02 115 HDRS_LCASE_IMGONLY 3341 0.82 2.45 0.01 116 XM_B_Phish66 3311 1.56 2.42 1.13 117 TM2_M_VERY_LONG_WORD 3269 1.72 2.39 1.38 118 TM2_M_URI_OPT_OUT 3218 3.24 2.36 3.68 119 XM_B_COVIDMETA 3190 1.49 2.34 1.07 120 T_TooManySym_01 3167 4.90 2.32 6.18 121 TR_Mismatch_TLD_02 3118 0.79 2.28 0.06 122 URI_NOVOWEL 3105 2.20 2.27 2.16 123 T_FILL_THIS_FORM_SHORT 3025 1.26 2.22 0.79 124 TR_XM_COVIDMETA4 3009 0.93 2.20 0.31 125 T_XMDrugObfuBody_00 2975 1.32 2.18 0.89 126 TR_Caps_n_Bayes_99 2944 0.83 2.16 0.18 127 HTML_TITLE_SUBJ_DIFF 2927 0.74 2.14 0.05 128 DKIM_ADSP_CUSTOM_MED 2877 1.34 2.11 0.96 129 NML_ADSP_CUSTOM_MED 2828 1.12 2.07 0.65 130 XM_CamelCaseFrm001 2743 1.88 2.01 1.82 131 XMDiploma_00 2724 1.74 1.99 1.61 132 FORGED_GMAIL_RCVD 2706 1.00 1.98 0.51 133 RCVD_IN_RP_CERTIFIED 2686 7.51 1.97 10.25 134 MIME_HTML_ONLY_MULTI 2660 2.64 1.95 2.98 135 XM_OfRef7 2355 0.75 1.72 0.27 136 XMBdyGiftCard01 2289 1.25 1.68 1.04 137 MIME_CHARSET_FARAWAY 2281 0.74 1.67 0.29 138 MIMEOLE_DIRECT_TO_MX 2248 0.55 1.65 0.00 139 SUBJ_BUY 2203 0.58 1.61 0.07 140 CHARSET_FARAWAY_HEADER 2197 0.55 1.61 0.03 141 XMGppyBdWords 2191 0.64 1.60 0.17 142 RELAYCOUNTRY_IN 2188 0.60 1.60 0.11 143 T_XMHurry_00 2171 0.89 1.59 0.54 144 XM_SPF_Unknown 2168 0.74 1.59 0.31 145 XM_B_Unsub2 2166 1.41 1.59 1.32 146 LH_URI_DOM_IN_PATH 2164 1.79 1.58 1.89 147 BAYES_40 2155 3.36 1.58 4.25 148 TR_Sbj_FN_Bdy 2109 0.62 1.54 0.16 149 PDS_FROM_2_EMAILS 2079 0.51 1.52 0.02 150 FROM_2_EMAILS_SHORT 2067 0.51 1.51 0.01 151 RELAYCOUNTRY_ID 1979 0.48 1.45 0.00 152 PDS_TO_EQ_FROM_NAME 1958 0.48 1.43 0.01 153 ANY_BOUNCE_MESSAGE 1947 2.00 1.43 2.28 154 BOUNCE_MESSAGE 1947 2.00 1.43 2.28 155 XMSubMetaD_00 1943 0.53 1.42 0.09 156 TR_XM_FormFill 1924 0.49 1.41 0.03 157 NO_FM_NAME_IP_HOSTN 1912 0.47 1.40 0.01 158 DOS_OE_TO_MX 1869 0.45 1.37 0.00 159 XM_UB95 1848 0.46 1.35 0.01 160 XMSubEmpty 1835 0.55 1.34 0.15 161 TR_XM_PHPDW 1824 0.69 1.34 0.37 162 TR_XM_SB_Phish 1818 1.49 1.33 1.56 163 LONG_JUNK_URI2 1816 0.47 1.33 0.04 164 FROM_SUSPICIOUS_NTLD 1812 0.52 1.33 0.11 165 NUMERIC_HTTP_ADDR 1796 0.79 1.32 0.54 166 LOW_PRICE 1776 0.57 1.30 0.20 167 RELAYCOUNTRY_HK 1775 0.44 1.30 0.01 168 TR_XM_PHPForged 1773 0.67 1.30 0.35 169 RCVD_IN_IADB_LISTED 1770 3.47 1.30 4.55 170 TR_XM_FormFill2 1768 0.66 1.29 0.35 171 XM_H_PHPOS 1766 0.66 1.29 0.34 172 FILL_THIS_FORM 1749 0.59 1.28 0.24 173 XMHTML_After_End 1744 0.89 1.28 0.70 174 XM_URI_RBL 1739 0.54 1.27 0.18 175 XMSexyCombo_01 1734 0.75 1.27 0.49 176 RELAYCOUNTRY_GB 1725 0.88 1.26 0.69 177 FROM_SUSPICIOUS_NTLD_FP 1724 0.49 1.26 0.11 178 FILL_THIS_FORM_LONG 1711 0.50 1.25 0.13 179 XMSubPhish11 1706 1.45 1.25 1.55 180 MIME_QP_LONG_LINE 1705 3.44 1.25 4.52 181 FVGT_m_MULTI_ODD_EMAIL 1704 0.45 1.25 0.05 182 DIET_1 1700 0.80 1.24 0.58 183 T_XMDrugObfuBody_14 1683 1.48 1.23 1.61 184 MISSING_HEADERS 1677 0.59 1.23 0.27 185 XM_B_SpammyWords4 1669 0.84 1.22 0.65 186 RDNS_DYNAMIC 1668 0.99 1.22 0.88 187 BAYES_20 1643 2.59 1.20 3.28 188 TR_XM_RelayPhish 1630 0.49 1.19 0.14 189 FORM_FRAUD 1614 0.39 1.18 0.00 190 TR_XM_SpoofStaff 1586 0.52 1.16 0.21 191 REPLYTO_WITHOUT_TO_CC 1574 0.41 1.15 0.04 192 RELAYCOUNTRY_DE 1572 0.62 1.15 0.36 193 XM_Lotto 1570 0.46 1.15 0.12 194 XMSpoofStaff2 1560 0.51 1.14 0.20 195 T_PDS_OTHER_BAD_TLD 1554 0.93 1.14 0.83 196 XMObfuSubjects 1514 0.39 1.11 0.03 197 TR_Mismatch_TLD_01 1488 0.59 1.09 0.35 198 RCVD_IN_IADB_SPF 1450 3.01 1.06 3.97 199 HK_RANDOM_FROM 1438 0.42 1.05 0.11 200 RCVD_IN_MSPIKE_L4 1431 0.38 1.05 0.06 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 243082 88.91 90.62 88.06 2 RELAYCOUNTRY_US 231436 78.91 68.94 83.84 3 DKIM_SIGNED 225643 79.45 74.82 81.74 4 XM_DK_Pass 222502 78.15 73.18 80.60 5 DKIM_VALID 218420 76.73 71.89 79.12 6 XM_B_Unicode 207696 73.86 71.07 75.24 7 DKIM_VALID_AU 174778 61.26 57.10 63.31 8 XMListUnsubscribeExists 164845 61.67 65.61 59.72 9 DCC_CHECK_NEGATIVE 147717 42.02 18.80 53.51 10 BAYES_50 146687 46.12 31.93 53.14 11 XM_B_SpammyWords 142736 55.42 62.91 51.71 12 DCC_CHECK 124839 56.60 79.61 45.22 13 XM_B_Unicode3 124289 41.49 34.33 45.02 14 HTML_FONT_LOW_CONTRAST 93363 34.28 35.20 33.82 15 DKIM_VALID_EF 84550 28.68 24.75 30.63 16 RCVD_IN_MSPIKE_WL 82510 24.84 14.63 29.89 17 LOC_TINY_FONT_1 81253 30.43 32.45 29.43 18 RCVD_IN_MSPIKE_H2 75484 27.05 26.46 27.34 19 FVGT_m_MULTI_ODD 67403 23.67 22.16 24.42 20 XM_B_SpammyWords2 66793 28.08 35.93 24.20 21 T_TM2_M_HEADER_IN_MSG 65172 22.71 20.88 23.61 22 MIME_HTML_ONLY 63657 25.72 31.10 23.06 23 XMSubLong 59213 21.24 20.81 21.45 24 T_KAM_HTML_FONT_INVALID 49912 19.91 23.61 18.08 25 RCVD_IN_MSPIKE_H3 45158 13.55 7.87 16.36 26 XM_Multi_Part_URI 40616 16.22 19.27 14.71 27 XM_Body_Dirty_Words 40410 14.69 14.79 14.64 28 BAYES_00 35883 8.92 0.66 13.00 29 RCVD_IN_MSPIKE_H4 32436 9.91 6.20 11.75 30 ALL_TRUSTED 31891 7.94 0.63 11.55 31 RCVD_IN_RP_SAFE 30635 8.34 2.76 11.10 32 XM_B_Unsub 30254 10.15 8.52 10.96 33 XM_DK_Undo_02 29949 21.17 42.04 10.85 34 XM_DKIMWhitelistDomains 28589 6.93 0.00 10.36 35 RCVD_IN_RP_CERTIFIED 28303 7.51 1.97 10.25 36 TR_XM_DK_Bayes 27622 6.80 0.32 10.01 37 TR_XM_DK_Bayes1 27098 6.67 0.31 9.82 38 UNPARSEABLE_RELAY 26110 8.27 5.87 9.46 39 XM_Evil_Numbers_Gen 26014 8.73 7.33 9.42 40 TR_XM_DK_Bayes2 25249 6.21 0.28 9.15 41 LOTS_OF_MONEY 24377 10.82 14.84 8.83 42 LotsOfNums_01 24361 9.30 10.25 8.82 43 XM_SendGrid 23647 7.17 4.35 8.57 44 HTML_IMAGE_RATIO_02 23278 8.20 7.73 8.43 45 BAYES_60 23040 9.07 10.54 8.35 46 BAYES_99 21369 17.74 37.95 7.74 47 XM_B_Phish_Phrases 19063 7.31 8.13 6.91 48 TooManyTo_001 17859 6.55 6.71 6.47 49 BAYES_999 17437 13.74 28.74 6.32 50 BOTNET_IPINHOSTNAME 17362 8.65 13.43 6.29 51 T_TooManySym_01 17061 4.90 2.32 6.18 52 HTML_IMAGE_RATIO_04 16914 5.36 3.81 6.13 53 XM_B_SpammyWords3 15773 7.25 10.35 5.71 54 TR_XM_DK_SendGrid 15584 4.69 2.75 5.65 55 FSL_BULK_SIG 14470 10.55 21.29 5.24 56 XM_H_Long_From01 14434 4.90 4.23 5.23 57 XMStrtUSub 14209 5.04 4.84 5.15 58 XMSexyCombo_05 14179 6.77 10.08 5.14 59 IN_ZIMBRA_NJ_WHITELIST 14158 3.45 0.06 5.13 60 RELAYCOUNTRY_META 13903 12.31 27.01 5.04 61 BAYES_80 13743 6.57 9.80 4.98 62 MPART_ALT_DIFF 12959 5.60 7.42 4.69 63 RCVD_IN_IADB_LISTED 12555 3.47 1.30 4.55 64 MIME_QP_LONG_LINE 12483 3.44 1.25 4.52 65 BAYES_40 11720 3.36 1.58 4.25 66 HTML_IMAGE_RATIO_06 11331 3.89 3.45 4.10 67 FROM_EXCESS_BASE64 10978 3.48 2.46 3.98 68 RCVD_IN_IADB_SPF 10953 3.01 1.06 3.97 69 XM_UncommonTLD01 10912 6.97 13.07 3.95 70 XMNumbers 10819 4.02 4.21 3.92 71 XMSubMetaSx_00 10474 4.94 7.26 3.79 72 TM2_M_URI_OPT_OUT 10168 3.24 2.36 3.68 73 T_REMOTE_IMAGE 10042 6.92 13.55 3.64 74 TR_DCC_Bayes_99 10036 11.77 28.22 3.64 75 RCVD_IN_IADB_SENDERID 9766 2.69 0.97 3.54 76 RCVD_IN_IADB_DK 9507 2.62 0.97 3.44 77 T_TooManySym_02 9387 2.49 0.65 3.40 78 BAYES_95 9349 4.11 5.56 3.39 79 BAYES_20 9047 2.59 1.20 3.28 80 TVD_RCVD_IP 8572 2.17 0.29 3.11 81 MIME_HTML_ONLY_MULTI 8224 2.64 1.95 2.98 82 RCVD_IN_IADB_VOUCHED 7684 2.09 0.68 2.78 83 INVALID_MSGID 7562 2.14 0.94 2.74 84 HTML_IMAGE_RATIO_08 7313 2.71 2.83 2.65 85 T_FONT_INVIS_NAKED_TO 7257 2.89 3.41 2.63 86 DKIM_INVALID 7223 2.72 2.93 2.62 87 TR_XM_PhishingBody 6877 3.08 4.27 2.49 88 UNTRUSTED_Relay 6852 9.40 23.39 2.48 89 TR_XM_SpammyWords2 6564 6.55 15.00 2.38 90 HELO_MISC_IP 6560 1.73 0.42 2.38 91 CK_HELO_DYNAMIC_SPLIT_IP 6559 1.80 0.65 2.38 92 MIME_HTML_MOSTLY 6465 3.64 6.27 2.34 93 XM_B_SpammyTLD 6460 2.74 3.56 2.34 94 TO_MALFORMED 6450 1.56 0.00 2.34 95 XM_H_Trusted_IP 6421 1.56 0.00 2.33 96 TR_Symld_Words 6334 1.84 0.93 2.29 97 ANY_BOUNCE_MESSAGE 6298 2.00 1.43 2.28 98 BOUNCE_MESSAGE 6298 2.00 1.43 2.28 99 URI_NOVOWEL 5968 2.20 2.27 2.16 100 BOTNET 5901 7.76 19.13 2.14 101 RELAYCOUNTRY_CA 5446 3.40 6.30 1.97 102 LH_URI_DOM_IN_PATH 5225 1.79 1.58 1.89 103 BAYES_05 5201 1.51 0.76 1.88 104 T_XMDrugObfuBody_08 5198 2.28 3.09 1.88 105 MAILING_LIST_MULTI 5136 1.50 0.76 1.86 106 XM_CamelCaseFrm001 5018 1.88 2.01 1.82 107 RCVD_IN_IADB_OPTIN 5005 1.40 0.55 1.81 108 RCVD_IN_MSPIKE_H5 4916 1.38 0.56 1.78 109 XMBrknScrpt_02 4909 4.60 10.29 1.78 110 IN_HORDE_ADDRESS_BOOK 4877 1.29 0.31 1.77 111 XMBSHREFv2 4845 1.23 0.18 1.76 112 USER_IN_DEF_DKIM_WL 4803 1.17 0.01 1.74 113 URI_TRY_3LD 4648 2.10 2.93 1.68 114 XM_OfRef6 4611 3.23 6.38 1.67 115 XM_PDF 4562 1.19 0.25 1.65 116 XMGappySubj_01 4557 1.14 0.12 1.65 117 XMDiploma_00 4447 1.74 1.99 1.61 118 T_XMDrugObfuBody_14 4438 1.48 1.23 1.61 119 TR_XM_SB_Phish 4316 1.49 1.33 1.56 120 XMSubPhish11 4285 1.45 1.25 1.55 121 XM_DK_Undo_01 4083 1.23 0.73 1.48 122 T_TooManySym_03 3862 0.96 0.08 1.40 123 URI_HEX 3852 2.01 3.25 1.40 124 TM2_M_VERY_LONG_WORD 3810 1.72 2.39 1.38 125 RCVD_IN_BL_SPAMCOP_NET 3765 3.76 8.60 1.36 126 XM_B_Unsub2 3653 1.41 1.59 1.32 127 SUBJ_ALL_CAPS 3523 1.92 3.23 1.28 128 HTML_FONT_FACE_BAD 3490 1.08 0.72 1.26 129 TooManyTo_002 3372 0.93 0.33 1.22 130 XM_ProductURIs 3348 1.08 0.81 1.21 131 KHOP_HELO_FCRDNS 3248 3.97 9.61 1.18 132 XMBody_95 3215 0.82 0.12 1.16 133 XM_UB50 3204 3.66 8.72 1.16 134 XM_GoogleGroups 3158 0.86 0.30 1.14 135 XM_B_Phish66 3126 1.56 2.42 1.13 136 XM_SPF_SoftFail 2983 2.15 4.32 1.08 137 XM_H_Long_From02 2974 0.94 0.67 1.08 138 XM_B_COVIDMETA 2952 1.49 2.34 1.07 139 HTML_MIME_NO_HTML_TAG 2929 1.86 3.49 1.06 140 XMStockSpam_06 2898 1.01 0.93 1.05 141 TR_MSPIKEBAYES00 2877 0.73 0.09 1.04 142 XMBdyGiftCard01 2862 1.25 1.68 1.04 143 TR_LOTS_OF_MONEY3 2823 1.93 3.78 1.02 144 RCVD_IN_MSPIKE_BL 2723 4.67 12.13 0.99 145 XMBody_17 2710 2.25 4.80 0.98 146 DKIM_ADSP_CUSTOM_MED 2638 1.34 2.11 0.96 147 XMSubNoVowel 2582 1.47 2.56 0.94 148 TooManyTo_003 2483 0.67 0.19 0.90 149 T_XMDrugObfuBody_00 2463 1.32 2.18 0.89 150 RDNS_DYNAMIC 2436 0.99 1.22 0.88 151 T_TooManySym_04 2390 0.58 0.01 0.87 152 DKIM_ADSP_NXDOMAIN 2305 1.53 2.95 0.84 153 T_PDS_OTHER_BAD_TLD 2281 0.93 1.14 0.83 154 HTML_TAG_BALANCE_BODY 2270 0.72 0.51 0.82 155 TR_MetaPhish_Combo_01 2243 0.71 0.52 0.81 156 XM_S_SubURI 2215 0.54 0.01 0.80 157 NO_DNS_FOR_FROM 2203 0.74 0.62 0.80 158 T_FILL_THIS_FORM_SHORT 2189 1.26 2.22 0.79 159 USER_IN_WHITELIST 2112 0.51 0.00 0.77 160 USER_IN_WELCOMELIST 2112 0.51 0.00 0.77 161 XMGenDplmaNmb 2031 0.82 0.98 0.74 162 XMHTMLBadTable_001 1962 0.77 0.90 0.71 163 PLING_QUERY 1950 0.67 0.59 0.71 164 HTML_IMAGE_ONLY_20 1948 0.57 0.29 0.71 165 TooManyTo_004 1937 0.53 0.17 0.70 166 XMHTML_After_End 1928 0.89 1.28 0.70 167 RELAYCOUNTRY_GB 1916 0.88 1.26 0.69 168 T_TooManySym_05 1898 0.46 0.00 0.69 169 RCVD_IN_MSPIKE_L3 1885 2.42 5.93 0.68 170 XM_B_REG_HTML 1833 0.55 0.33 0.66 171 NML_ADSP_CUSTOM_MED 1805 1.12 2.07 0.65 172 XM_B_SpammyWords4 1799 0.84 1.22 0.65 173 XMSubMetaSxObfu_02 1766 0.51 0.24 0.64 174 SpammyFromTLD_01 1753 2.11 5.09 0.64 175 XMLngstWrd_00 1732 0.53 0.33 0.63 176 TR_XM_SpammyWords3 1669 2.75 7.09 0.60 177 HELO_NODOT 1663 0.54 0.41 0.60 178 HELO_NO_DOMAIN 1662 0.54 0.41 0.60 179 XM_ShortIntro_01 1654 0.60 0.61 0.60 180 DIET_1 1591 0.80 1.24 0.58 181 SUBJ_DOLLARS 1572 0.63 0.76 0.57 182 XMLngstWrd_01 1552 0.48 0.32 0.56 183 TR_XM_UnparsRelay 1509 1.27 2.73 0.55 184 T_XMHurry_00 1500 0.89 1.59 0.54 185 XMSlimDrugH 1497 0.56 0.60 0.54 186 XM_DIRTYINTL 1492 1.47 3.36 0.54 187 NUMERIC_HTTP_ADDR 1483 0.79 1.32 0.54 188 MPART_ALT_DIFF_COUNT 1466 0.60 0.73 0.53 189 TooManyTo_005 1456 0.40 0.14 0.53 190 XM_B_COPY_HTML 1453 0.53 0.55 0.53 191 XMPhish30 1436 0.65 0.91 0.52 192 XMNoVowels 1431 0.44 0.28 0.52 193 SENDGRID_REDIR 1426 0.48 0.41 0.52 194 FORGED_GMAIL_RCVD 1415 1.00 1.98 0.51 195 XM_D_tchamptons_WL 1410 0.34 0.00 0.51 196 XMSolicitRefs_0 1408 0.44 0.31 0.51 197 XMSexyCombo_01 1362 0.75 1.27 0.49 198 TR_BOTNET_NEGATE 1358 0.53 0.60 0.49 199 TM2_M_A_HREF_HREF 1348 0.51 0.57 0.49 200 HTTPS_HTTP_MISMATCH 1344 0.48 0.47 0.49 ----------------------------------------------------------------------