Email: 377676 Autolearn: 0 AvgScore: 3.91 AvgScanTime: 1.21 sec Spam: 113998 Autolearn: 0 AvgScore: 14.95 AvgScanTime: 1.31 sec Ham: 263678 Autolearn: 0 AvgScore: -0.87 AvgScanTime: 1.17 sec Time Spent Running SA: 127.38 hours Time Spent Processing Spam: 41.49 hours Time Spent Processing Ham: 85.88 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101935 86.85 89.42 85.74 2 DKIM_SIGNED 97623 80.98 85.64 78.97 3 XM_DK_Pass 95439 79.60 83.72 77.82 4 DKIM_VALID 93964 78.04 82.43 76.14 5 DCC_CHECK 86689 54.44 76.04 45.10 6 XM_B_Unicode 85009 73.44 74.57 72.95 7 XM_B_SpammyWords 81634 56.26 71.61 49.63 8 RELAYCOUNTRY_US 81457 79.03 71.45 82.31 9 XMListUnsubscribeExists 80385 59.95 70.51 55.38 10 DKIM_VALID_AU 75218 62.95 65.98 61.64 11 XM_DK_Undo_02 60619 22.75 53.18 9.59 12 TR_XM_DKIM_Undo 48252 17.77 42.33 7.15 13 BAYES_99 47748 17.51 41.88 6.98 14 XM_B_SpammyWords2 43888 28.11 38.50 23.62 15 XM_B_Unicode3 42206 42.34 37.02 44.64 16 HTML_FONT_LOW_CONTRAST 41431 33.23 36.34 31.88 17 LOC_TINY_FONT_1 39446 31.85 34.60 30.67 18 BAYES_999 37228 13.82 32.66 5.67 19 TR_DCC_Bayes_99 34826 11.98 30.55 3.96 20 BAYES_50 33799 45.64 29.65 52.55 21 DKIM_VALID_EF 33311 29.49 29.22 29.61 22 RELAYCOUNTRY_META 32613 11.84 28.61 4.59 23 FVGT_m_MULTI_ODD 29818 22.89 26.16 21.48 24 RCVD_IN_MSPIKE_H2 29545 27.69 25.92 28.46 25 T_KAM_HTML_FONT_INVALID 27078 18.62 23.75 16.40 26 T_TM2_M_HEADER_IN_MSG 25939 22.33 22.75 22.15 27 XMSubLong 25862 22.01 22.69 21.72 28 DCC_CHECK_NEGATIVE 25683 44.30 22.53 53.72 29 MIME_HTML_ONLY 24748 23.62 21.71 24.44 30 BOTNET 23060 7.42 20.23 1.89 31 XM_Multi_Part_URI 22775 16.04 19.98 14.33 32 RCVD_IN_MSPIKE_WL 21142 25.92 18.55 29.11 33 UNTRUSTED_Relay 20887 7.05 18.32 2.18 34 XM_Body_Dirty_Words 20220 15.66 17.74 14.76 35 XM_UncommonTLD01 18259 7.67 16.02 4.06 36 TR_XM_SpammyWords2 18167 6.37 15.94 2.23 37 BOTNET_IPINHOSTNAME 16216 8.30 14.22 5.73 38 XM_B_Unsub 14576 11.58 12.79 11.05 39 MPART_ALT_DIFF 14514 7.93 12.73 5.85 40 RCVD_IN_MSPIKE_BL 14216 4.41 12.47 0.93 41 LOTS_OF_MONEY 13274 9.41 11.64 8.44 42 LotsOfNums_01 12689 9.06 11.13 8.17 43 MIME_HTML_MOSTLY 12302 5.31 10.79 2.94 44 RCVD_IN_MSPIKE_H3 11798 14.81 10.35 16.74 45 XM_B_SpammyWords3 11797 6.94 10.35 5.47 46 RCVD_IN_BL_SPAMCOP_NET 11611 3.83 10.19 1.08 47 XMSexyCombo_05 11425 7.04 10.02 5.74 48 SpammyFromTLD_01 11413 3.50 10.01 0.68 49 XM_Evil_Numbers_Gen 11191 9.36 9.82 9.17 50 HTML_IMAGE_RATIO_02 10154 8.43 8.91 8.22 51 FSL_BULK_SIG 10013 6.85 8.78 6.01 52 XM_B_Phish_Phrases 10011 8.09 8.78 7.79 53 BAYES_80 9988 6.39 8.76 5.36 54 BAYES_60 9494 8.69 8.33 8.84 55 RELAYCOUNTRY_CA 8911 3.65 7.82 1.85 56 RCVD_IN_MSPIKE_H4 8580 9.49 7.53 10.34 57 SUBJ_ALL_CAPS 8219 3.13 7.21 1.37 58 XMSubMetaSx_00 8010 4.79 7.03 3.82 59 TR_XM_SpammyWords3 7972 2.48 6.99 0.52 60 RCVD_IN_MSPIKE_L3 7688 2.54 6.74 0.73 61 XM_OfRef6 7612 3.00 6.68 1.41 62 RCVD_IN_RP_RNBL 7227 2.02 6.34 0.15 63 TooManyTo_001 7139 6.52 6.26 6.63 64 T_XMDrugObfuBody_08 6835 2.88 6.00 1.53 65 HTML_IMAGE_RATIO_04 6395 6.65 5.61 7.10 66 T_XMDrugObfuBody_00 6383 2.22 5.60 0.75 67 BAYES_95 6366 4.09 5.58 3.45 68 URIBL_SBL_A 6190 1.76 5.43 0.18 69 XM_UB99 5965 1.58 5.23 0.01 70 XM_H_Long_From01 5917 5.40 5.19 5.49 71 RCVD_IN_RP_SAFE 5678 9.13 4.98 10.92 72 TR_XM_PhishingBody 5520 3.35 4.84 2.70 73 UNPARSEABLE_RELAY 5514 7.96 4.84 9.31 74 XMNumbers 5365 4.29 4.71 4.11 75 XM_UB50 5320 2.10 4.67 1.00 76 RELAYCOUNTRY_FR 5279 1.53 4.63 0.19 77 XM_B_SpammyTLD 5235 2.74 4.59 1.94 78 RCVD_IN_MSPIKE_L5 5146 1.48 4.51 0.17 79 URI_HEX 5030 2.26 4.41 1.34 80 TM2_M_VERY_LONG_WORD 4578 2.02 4.02 1.16 81 RCVD_IN_RP_CERTIFIED 4361 7.93 3.83 9.71 82 XMBody_17 4331 1.69 3.80 0.78 83 XM_SPF_SoftFail 4283 1.95 3.76 1.17 84 XM_UB999 4249 1.13 3.73 0.00 85 TR_XM_MaxSPIKE 4191 1.12 3.68 0.02 86 TR_XM_MaxBayes 4183 1.11 3.67 0.01 87 XMBrknScrpt_02 4161 1.80 3.65 1.00 88 URI_PHP_REDIR 4159 1.10 3.65 0.00 89 XM_UB60 4152 1.15 3.64 0.08 90 T_FILL_THIS_FORM_SHORT 4130 1.68 3.62 0.84 91 URI_NO_WWW_BIZ_CGI 4064 1.08 3.56 0.00 92 XM_SendGrid 4058 7.01 3.56 8.50 93 XMSubMetaD_00 4006 1.10 3.51 0.06 94 T_FONT_INVIS_NAKED_TO 3955 2.65 3.47 2.30 95 XMStrtUSub 3872 5.48 3.40 6.38 96 XMObfuSubjects 3868 1.04 3.39 0.02 97 TR_Caps_n_Bayes_99 3813 1.07 3.34 0.08 98 SpammyFromTLD_02 3729 1.11 3.27 0.18 99 XM_DIRTYINTL 3666 1.32 3.22 0.50 100 DKIM_INVALID 3659 2.94 3.21 2.83 101 SUBJ_BUY 3655 1.02 3.21 0.07 102 RCVD_IN_PSBL 3640 0.97 3.19 0.01 103 TR_LOTS_OF_MONEY3 3628 1.82 3.18 1.22 104 RELAYCOUNTRY_NL 3615 1.15 3.17 0.28 105 HTML_IMAGE_RATIO_06 3571 3.60 3.13 3.80 106 TVD_SPACE_RATIO 3558 1.19 3.12 0.35 107 PDS_FROM_2_EMAILS 3496 0.95 3.07 0.04 108 XM_B_COVIDMETA 3489 1.52 3.06 0.85 109 FROM_2_EMAILS_SHORT 3469 0.93 3.04 0.02 110 BOTNET_NORDNS 3358 0.90 2.95 0.01 111 PDS_TO_EQ_FROM_NAME 3306 0.88 2.90 0.01 112 URI_TRY_3LD 3253 1.61 2.85 1.07 113 XMGppyBdWords 3239 0.96 2.84 0.15 114 LONG_JUNK_URI3 3168 0.88 2.78 0.05 115 TM2_M_URI_OPT_OUT 3167 4.04 2.78 4.59 116 XMSubNoVowel 3158 1.53 2.77 1.00 117 XMDiploma_00 3158 1.97 2.77 1.63 118 XMSubMetaD_01 3158 0.84 2.77 0.01 119 XM_B_Phish66 3082 1.67 2.70 1.22 120 NO_FM_NAME_IP_HOSTN 2966 0.79 2.60 0.01 121 FROM_EXCESS_BASE64 2942 3.36 2.58 3.70 122 DRUGS_ERECTILE 2937 0.79 2.58 0.02 123 XM_OfRef7 2865 0.83 2.51 0.10 124 FROM_NAME_EQ_TO_G_DRIVE 2639 0.70 2.31 0.01 125 T_XMHurry_00 2582 1.21 2.26 0.75 126 PDS_OTHER_BAD_TLD 2578 0.98 2.26 0.42 127 MIME_HTML_ONLY_MULTI 2537 3.34 2.23 3.82 128 T_REMOTE_IMAGE 2483 2.65 2.18 2.85 129 TVD_SPACE_RATIO_MINFP 2464 0.66 2.16 0.02 130 T_TooManySym_01 2461 5.69 2.16 7.21 131 XMBdyGiftCard01 2458 1.70 2.16 1.50 132 XM_CamelCaseFrm001 2456 1.94 2.15 1.85 133 RELAYCOUNTRY_GB 2451 1.18 2.15 0.76 134 BAYES_40 2429 3.55 2.13 4.17 135 XMSexyCombo_01 2385 1.20 2.09 0.82 136 TR_XM_DK_SendGrid 2367 4.27 2.08 5.21 137 DRUGS_ERECTILE_OBFU 2361 0.64 2.07 0.02 138 XM_UB80 2323 0.63 2.04 0.03 139 HTML_IMAGE_RATIO_08 2305 2.28 2.02 2.39 140 FROM_SUSPICIOUS_NTLD 2279 0.67 2.00 0.10 141 DATE_IN_PAST_12_24 2263 0.64 1.99 0.06 142 FROM_SUSPICIOUS_NTLD_FP 2203 0.65 1.93 0.10 143 TR_XM_UnparsRelay 2164 1.08 1.90 0.73 144 T_XMDrugObfuBody_09 2155 0.59 1.89 0.03 145 KHOP_HELO_FCRDNS 2150 1.26 1.89 1.00 146 TR_XM_COVIDMETA4 2083 0.76 1.83 0.29 147 TR_XM_SpoofStaff 2027 0.62 1.78 0.11 148 RELAYCOUNTRY_RU 2026 0.55 1.78 0.02 149 MIMEOLE_DIRECT_TO_MX 2025 0.54 1.78 0.00 150 LH_URI_DOM_IN_PATH 2024 1.61 1.78 1.54 151 XMSpoofStaff2 2015 0.61 1.77 0.11 152 MIME_QP_LONG_LINE 1988 3.16 1.74 3.77 153 RELAYCOUNTRY_DE 1972 0.77 1.73 0.35 154 TR_XM_PHPDW 1942 0.74 1.70 0.33 155 RCVD_IN_IADB_LISTED 1939 3.15 1.70 3.77 156 DATE_IN_PAST_03_06 1921 0.57 1.69 0.09 157 XMSubMetaD_02 1910 0.51 1.68 0.01 158 TR_XM_RelayPhish 1908 0.57 1.67 0.09 159 MONEY_FRAUD_8 1907 0.51 1.67 0.00 160 TR_XM_PHPForged 1901 0.72 1.67 0.31 161 TR_XM_FormFill2 1899 0.72 1.67 0.31 162 XM_H_PHPOS 1894 0.71 1.66 0.30 163 XM_B_SpammyWords4 1892 1.08 1.66 0.83 164 TR_Symld_Words 1880 2.85 1.65 3.37 165 BAYES_20 1865 2.56 1.64 2.96 166 LongTLD 1857 0.57 1.63 0.11 167 RDNS_DYNAMIC 1853 1.00 1.63 0.73 168 DEAR_BENEFICIARY 1821 0.48 1.60 0.00 169 XM_DK_Undo_01 1814 1.63 1.59 1.65 170 T_FILL_THIS_FORM_FRAUD_PHISH 1805 0.52 1.58 0.06 171 MISSING_HEADERS 1777 0.70 1.56 0.32 172 FORM_FRAUD_5 1756 0.46 1.54 0.00 173 XM_UB95 1753 0.47 1.54 0.02 174 FILL_THIS_FORM 1752 0.79 1.54 0.46 175 XM_B_Unsub2 1738 1.12 1.52 0.94 176 TO_EQ_FM_DIRECT_MX 1735 0.46 1.52 0.01 177 MONEY_FORM_SHORT 1720 0.46 1.51 0.00 178 SHORT_URI 1708 0.47 1.50 0.02 179 FILL_THIS_FORM_LONG 1676 0.65 1.47 0.29 180 UNCLAIMED_MONEY 1676 0.44 1.47 0.00 181 UPPERCASE_75_100 1669 0.46 1.46 0.02 182 TR_XM_SpoofStaff2 1658 0.44 1.45 0.00 183 REPLYTO_WITHOUT_TO_CC 1641 0.45 1.44 0.03 184 RCVD_IN_IADB_SPF 1606 2.74 1.41 3.31 185 XMSubEmpty 1578 0.55 1.38 0.19 186 XMGenDplmaNmb 1566 0.97 1.37 0.79 187 RELAYCOUNTRY_IN 1550 0.45 1.36 0.06 188 XM_H_SpoofStaff4 1548 0.50 1.36 0.13 189 TR_XM_PSC1 1546 0.49 1.36 0.11 190 XMStockSpam_06 1541 1.57 1.35 1.67 191 TR_Mismatch_TLD_01 1499 0.59 1.31 0.28 192 T_FILL_THIS_FORM_LOAN 1494 0.61 1.31 0.30 193 URI_ONLY_MSGID_MALF 1472 0.39 1.29 0.00 194 RCVD_IN_IADB_SENDERID 1453 2.47 1.27 2.99 195 T_XMDrugObfuBody_14 1441 1.72 1.26 1.91 196 DOS_OE_TO_MX 1433 0.38 1.26 0.00 197 XMSlimDrugH 1425 0.60 1.25 0.31 198 SUBJECT_DRUG_GAP_L 1419 0.38 1.24 0.00 199 HDR_ORDER_FTSDMCXX_DIRECT 1415 0.38 1.24 0.00 200 RCVD_IN_IADB_DK 1411 2.39 1.24 2.88 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 226079 86.85 89.42 85.74 2 RELAYCOUNTRY_US 217039 79.03 71.45 82.31 3 DKIM_SIGNED 208229 80.98 85.64 78.97 4 XM_DK_Pass 205198 79.60 83.72 77.82 5 DKIM_VALID 200766 78.04 82.43 76.14 6 XM_B_Unicode 192348 73.44 74.57 72.95 7 DKIM_VALID_AU 162530 62.95 65.98 61.64 8 XMListUnsubscribeExists 146013 59.95 70.51 55.38 9 DCC_CHECK_NEGATIVE 141639 44.30 22.53 53.72 10 BAYES_50 138572 45.64 29.65 52.55 11 XM_B_SpammyWords 130851 56.26 71.61 49.63 12 DCC_CHECK 118917 54.44 76.04 45.10 13 XM_B_Unicode3 117704 42.34 37.02 44.64 14 HTML_FONT_LOW_CONTRAST 84056 33.23 36.34 31.88 15 LOC_TINY_FONT_1 80857 31.85 34.60 30.67 16 DKIM_VALID_EF 78077 29.49 29.22 29.61 17 RCVD_IN_MSPIKE_WL 76764 25.92 18.55 29.11 18 RCVD_IN_MSPIKE_H2 75036 27.69 25.92 28.46 19 MIME_HTML_ONLY 64450 23.62 21.71 24.44 20 XM_B_SpammyWords2 62273 28.11 38.50 23.62 21 T_TM2_M_HEADER_IN_MSG 58404 22.33 22.75 22.15 22 XMSubLong 57265 22.01 22.69 21.72 23 FVGT_m_MULTI_ODD 56650 22.89 26.16 21.48 24 RCVD_IN_MSPIKE_H3 44152 14.81 10.35 16.74 25 T_KAM_HTML_FONT_INVALID 43255 18.62 23.75 16.40 26 XM_Body_Dirty_Words 38909 15.66 17.74 14.76 27 XM_Multi_Part_URI 37789 16.04 19.98 14.33 28 BAYES_00 36374 9.96 1.09 13.79 29 ALL_TRUSTED 35616 9.71 0.92 13.51 30 XM_DKIMWhitelistDomains 32077 8.50 0.01 12.17 31 XM_B_Unsub 29140 11.58 12.79 11.05 32 RCVD_IN_RP_SAFE 28790 9.13 4.98 10.92 33 RCVD_IN_MSPIKE_H4 27267 9.49 7.53 10.34 34 TR_XM_DK_Bayes 25752 6.99 0.58 9.77 35 RCVD_IN_RP_CERTIFIED 25593 7.93 3.83 9.71 36 XM_DK_Undo_02 25285 22.75 53.18 9.59 37 TR_XM_DK_Bayes1 25235 6.85 0.57 9.57 38 UNPARSEABLE_RELAY 24545 7.96 4.84 9.31 39 XM_Evil_Numbers_Gen 24177 9.36 9.82 9.17 40 TR_XM_DK_Bayes2 23521 6.39 0.53 8.92 41 BAYES_60 23309 8.69 8.33 8.84 42 XM_SendGrid 22402 7.01 3.56 8.50 43 LOTS_OF_MONEY 22253 9.41 11.64 8.44 44 HTML_IMAGE_RATIO_02 21682 8.43 8.91 8.22 45 LotsOfNums_01 21533 9.06 11.13 8.17 46 XM_B_Phish_Phrases 20531 8.09 8.78 7.79 47 T_TooManySym_01 19016 5.69 2.16 7.21 48 TR_XM_DKIM_Undo 18854 17.77 42.33 7.15 49 HTML_IMAGE_RATIO_04 18710 6.65 5.61 7.10 50 BAYES_99 18396 17.51 41.88 6.98 51 TooManyTo_001 17479 6.52 6.26 6.63 52 XMStrtUSub 16819 5.48 3.40 6.38 53 FSL_BULK_SIG 15859 6.85 8.78 6.01 54 MPART_ALT_DIFF 15422 7.93 12.73 5.85 55 XMSexyCombo_05 15146 7.04 10.02 5.74 56 BOTNET_IPINHOSTNAME 15117 8.30 14.22 5.73 57 BAYES_999 14963 13.82 32.66 5.67 58 XM_H_Long_From01 14473 5.40 5.19 5.49 59 XM_B_SpammyWords3 14419 6.94 10.35 5.47 60 BAYES_80 14139 6.39 8.76 5.36 61 TR_XM_DK_SendGrid 13750 4.27 2.08 5.21 62 IN_ZIMBRA_NJ_WHITELIST 12813 3.44 0.15 4.86 63 T_TooManySym_02 12310 3.43 0.58 4.67 64 TM2_M_URI_OPT_OUT 12109 4.04 2.78 4.59 65 RELAYCOUNTRY_META 12096 11.84 28.61 4.59 66 BAYES_40 10989 3.55 2.13 4.17 67 XMNumbers 10829 4.29 4.71 4.11 68 XM_UncommonTLD01 10700 7.67 16.02 4.06 69 TR_DCC_Bayes_99 10434 11.98 30.55 3.96 70 MIME_HTML_ONLY_MULTI 10084 3.34 2.23 3.82 71 XMSubMetaSx_00 10064 4.79 7.03 3.82 72 HTML_IMAGE_RATIO_06 10019 3.60 3.13 3.80 73 MIME_QP_LONG_LINE 9951 3.16 1.74 3.77 74 RCVD_IN_IADB_LISTED 9943 3.15 1.70 3.77 75 FROM_EXCESS_BASE64 9763 3.36 2.58 3.70 76 BAYES_95 9085 4.09 5.58 3.45 77 TR_Symld_Words 8896 2.85 1.65 3.37 78 RCVD_IN_IADB_SPF 8730 2.74 1.41 3.31 79 XM_H_Trusted_IP 8306 2.20 0.00 3.15 80 RCVD_IN_IADB_SENDERID 7871 2.47 1.27 2.99 81 BAYES_20 7794 2.56 1.64 2.96 82 MIME_HTML_MOSTLY 7756 5.31 10.79 2.94 83 RCVD_IN_IADB_DK 7597 2.39 1.24 2.88 84 T_REMOTE_IMAGE 7520 2.65 2.18 2.85 85 DKIM_INVALID 7463 2.94 3.21 2.83 86 TR_XM_PhishingBody 7129 3.35 4.84 2.70 87 INVALID_MSGID 7018 2.03 0.58 2.66 88 TVD_RCVD_IP 6847 1.99 0.58 2.60 89 TO_MALFORMED 6419 1.71 0.05 2.43 90 ANY_BOUNCE_MESSAGE 6388 1.91 0.73 2.42 91 BOUNCE_MESSAGE 6387 1.91 0.73 2.42 92 HTML_IMAGE_RATIO_08 6301 2.28 2.02 2.39 93 T_FONT_INVIS_NAKED_TO 6069 2.65 3.47 2.30 94 HELO_MISC_IP 6050 1.80 0.66 2.29 95 CK_HELO_DYNAMIC_SPLIT_IP 6044 1.87 0.91 2.29 96 TR_XM_SpammyWords2 5878 6.37 15.94 2.23 97 RCVD_IN_IADB_VOUCHED 5818 1.84 0.99 2.21 98 UNTRUSTED_Relay 5758 7.05 18.32 2.18 99 XM_PDF 5419 1.55 0.37 2.06 100 RCVD_IN_MSPIKE_H5 5345 1.62 0.67 2.03 101 XM_B_SpammyTLD 5121 2.74 4.59 1.94 102 MAILING_LIST_MULTI 5070 1.60 0.85 1.92 103 T_XMDrugObfuBody_14 5043 1.72 1.26 1.91 104 BAYES_05 5017 1.61 0.93 1.90 105 HTML_FONT_FACE_BAD 4984 1.55 0.75 1.89 106 BOTNET 4973 7.42 20.23 1.89 107 URI_NOVOWEL 4957 1.66 1.15 1.88 108 XMBSHREFv2 4957 1.37 0.18 1.88 109 RELAYCOUNTRY_CA 4872 3.65 7.82 1.85 110 XM_CamelCaseFrm001 4871 1.94 2.15 1.85 111 USER_IN_DEF_DKIM_WL 4870 1.29 0.01 1.85 112 IN_HORDE_ADDRESS_BOOK 4677 1.42 0.62 1.77 113 XMGappySubj_01 4520 1.26 0.20 1.71 114 XMStockSpam_06 4405 1.57 1.35 1.67 115 XM_DK_Undo_01 4354 1.63 1.59 1.65 116 XMDiploma_00 4300 1.97 2.77 1.63 117 TR_XM_SB_Phish 4209 1.48 1.22 1.60 118 XMSubPhish11 4182 1.46 1.17 1.59 119 HTML_MIME_NO_HTML_TAG 4106 1.44 1.17 1.56 120 LH_URI_DOM_IN_PATH 4051 1.61 1.78 1.54 121 T_XMDrugObfuBody_08 4036 2.88 6.00 1.53 122 XMBdyGiftCard01 3946 1.70 2.16 1.50 123 T_TooManySym_03 3906 1.07 0.12 1.48 124 RCVD_IN_IADB_OPTIN 3827 1.25 0.78 1.45 125 FORGED_MUA_OUTLOOK 3774 1.05 0.18 1.43 126 XM_OfRef6 3723 3.00 6.68 1.41 127 SUBJ_ALL_CAPS 3611 3.13 7.21 1.37 128 URI_HEX 3524 2.26 4.41 1.34 129 TooManyTo_002 3451 1.05 0.46 1.31 130 TR_LOTS_OF_MONEY3 3230 1.82 3.18 1.22 131 XM_B_Phish66 3223 1.67 2.70 1.22 132 XM_H_Long_From02 3132 1.11 0.93 1.19 133 XM_SPF_SoftFail 3084 1.95 3.76 1.17 134 TM2_M_VERY_LONG_WORD 3066 2.02 4.02 1.16 135 DKIM_ADSP_CUSTOM_MED 3001 1.16 1.20 1.14 136 TR_MSPIKEBAYES00 2921 0.81 0.13 1.11 137 XM_GoogleGroups 2850 0.87 0.37 1.08 138 RCVD_IN_BL_SPAMCOP_NET 2843 3.83 10.19 1.08 139 URI_TRY_3LD 2818 1.61 2.85 1.07 140 XMBrknScrpt_02 2644 1.80 3.65 1.00 141 XMSubNoVowel 2626 1.53 2.77 1.00 142 KHOP_HELO_FCRDNS 2626 1.26 1.89 1.00 143 XM_UB50 2624 2.10 4.67 1.00 144 T_TooManySym_04 2525 0.68 0.04 0.96 145 XM_B_Unsub2 2487 1.12 1.52 0.94 146 TooManyTo_003 2476 0.76 0.35 0.94 147 RCVD_IN_MSPIKE_BL 2453 4.41 12.47 0.93 148 XM_ProductURIs 2447 0.90 0.83 0.93 149 DKIM_ADSP_NXDOMAIN 2347 0.79 0.55 0.89 150 XMBody_95 2311 0.63 0.07 0.88 151 XM_S_SubURI 2256 0.62 0.07 0.86 152 XM_B_COVIDMETA 2249 1.52 3.06 0.85 153 NO_DNS_FOR_FROM 2221 0.76 0.56 0.84 154 T_FILL_THIS_FORM_SHORT 2204 1.68 3.62 0.84 155 XM_B_SpammyWords4 2194 1.08 1.66 0.83 156 NUMERIC_HTTP_ADDR 2185 0.71 0.45 0.83 157 XMSexyCombo_01 2161 1.20 2.09 0.82 158 NML_ADSP_CUSTOM_MED 2137 0.91 1.15 0.81 159 XMGenDplmaNmb 2093 0.97 1.37 0.79 160 XMBody_17 2062 1.69 3.80 0.78 161 TooManyTo_004 2042 0.61 0.24 0.77 162 T_TooManySym_05 2025 0.54 0.01 0.77 163 TR_MetaPhish_Combo_01 2010 0.76 0.75 0.76 164 RELAYCOUNTRY_GB 2001 1.18 2.15 0.76 165 T_XMDrugObfuBody_00 1984 2.22 5.60 0.75 166 T_XMHurry_00 1983 1.21 2.26 0.75 167 RDNS_DYNAMIC 1929 1.00 1.63 0.73 168 RCVD_IN_MSPIKE_L3 1923 2.54 6.74 0.73 169 TR_XM_UnparsRelay 1918 1.08 1.90 0.73 170 XMPhish08 1914 0.67 0.53 0.73 171 PLING_QUERY 1882 0.69 0.63 0.71 172 SpammyFromTLD_01 1806 3.50 10.01 0.68 173 XMHTMLBadTable_001 1669 0.67 0.74 0.63 174 USER_IN_WHITELIST 1653 0.44 0.00 0.63 175 USER_IN_WELCOMELIST 1653 0.44 0.00 0.63 176 XM_ShortIntro_01 1630 0.61 0.59 0.62 177 HTTPS_HTTP_MISMATCH 1626 0.61 0.59 0.62 178 TooManyTo_005 1612 0.49 0.21 0.61 179 SENDGRID_REDIR 1608 0.55 0.41 0.61 180 DIET_1 1553 0.65 0.80 0.59 181 XM_B_REG_HTML 1509 0.61 0.71 0.57 182 XMHTML_After_End 1494 0.70 0.99 0.57 183 FORGED_GMAIL_RCVD 1459 0.70 1.05 0.55 184 XM_B_COPY_HTML 1442 0.51 0.43 0.55 185 HTML_TAG_BALANCE_BODY 1440 0.67 0.94 0.55 186 XMSubMetaI_00 1425 0.63 0.82 0.54 187 HELO_NODOT 1416 0.52 0.49 0.54 188 HELO_NO_DOMAIN 1415 0.52 0.49 0.54 189 XMLngstWrd_00 1397 0.51 0.47 0.53 190 TR_XM_SpammyWords3 1379 2.48 6.99 0.52 191 XMNoVowels 1316 0.41 0.20 0.50 192 XM_DIRTYINTL 1313 1.32 3.22 0.50 193 TR_LOTS_OF_MONEY2 1292 0.51 0.54 0.49 194 T_MONEY_PERCENT 1292 0.51 0.54 0.49 195 XMSubMetaSxObfu_02 1285 0.40 0.21 0.49 196 HTML_IMAGE_ONLY_20 1238 0.41 0.26 0.47 197 XMLngstWrd_01 1237 0.46 0.44 0.47 198 FILL_THIS_FORM 1221 0.79 1.54 0.46 199 XMOemUri 1219 0.37 0.15 0.46 200 XM_H_PHPMailer 1207 0.53 0.71 0.46 ----------------------------------------------------------------------