Email: 391214 Autolearn: 0 AvgScore: 3.72 AvgScanTime: 1.38 sec Spam: 122161 Autolearn: 0 AvgScore: 13.89 AvgScanTime: 1.38 sec Ham: 269053 Autolearn: 0 AvgScore: -0.89 AvgScanTime: 1.39 sec Time Spent Running SA: 150.34 hours Time Spent Processing Spam: 46.68 hours Time Spent Processing Ham: 103.66 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 114511 88.76 93.74 86.50 2 DKIM_SIGNED 107308 81.62 87.84 78.80 3 XM_DK_Pass 104755 80.22 85.75 77.70 4 DKIM_VALID 103009 78.70 84.32 76.14 5 XM_B_Unicode 95622 75.10 78.28 73.66 6 DCC_CHECK 93990 56.23 76.94 46.82 7 RELAYCOUNTRY_US 93952 80.48 76.91 82.10 8 XMListUnsubscribeExists 89582 60.85 73.33 55.18 9 XM_B_SpammyWords 88736 58.21 72.64 51.65 10 DKIM_VALID_AU 82833 64.13 67.81 62.47 11 XM_DK_Undo_02 60993 21.60 49.93 8.74 12 XM_B_SpammyWords2 53991 31.03 44.20 25.05 13 HTML_FONT_LOW_CONTRAST 50593 34.32 41.42 31.09 14 TR_XM_DKIM_Undo 47485 16.73 38.87 6.67 15 XM_B_Unicode3 47047 43.84 38.51 46.26 16 BAYES_99 46650 16.13 38.19 6.11 17 LOC_TINY_FONT_1 45865 32.48 37.54 30.18 18 BAYES_50 39411 46.39 32.26 52.80 19 BAYES_999 37173 12.87 30.43 4.89 20 DKIM_VALID_EF 36449 29.83 29.84 29.82 21 TR_DCC_Bayes_99 36033 11.81 29.50 3.77 22 RCVD_IN_MSPIKE_H2 34169 27.26 27.97 26.93 23 MIME_HTML_ONLY 31942 25.39 26.15 25.04 24 FVGT_m_MULTI_ODD 29571 22.89 24.21 22.29 25 XMSubLong 29425 21.75 24.09 20.68 26 T_KAM_HTML_FONT_INVALID 28672 18.90 23.47 16.83 27 XM_Multi_Part_URI 27932 16.48 22.86 13.58 28 RELAYCOUNTRY_META 27570 10.18 22.57 4.55 29 DCC_CHECK_NEGATIVE 26626 42.56 21.80 51.98 30 XM_Body_Dirty_Words 25818 16.35 21.13 14.18 31 T_TM2_M_HEADER_IN_MSG 24409 22.28 19.98 23.33 32 RCVD_IN_MSPIKE_WL 21027 26.36 17.21 30.51 33 BOTNET 20799 6.62 17.03 1.90 34 TR_XM_SpammyWords2 20677 6.50 16.93 1.76 35 UNTRUSTED_Relay 18882 6.36 15.46 2.23 36 XM_B_Unsub 18144 13.29 14.85 12.58 37 XM_UncommonTLD01 16689 7.00 13.66 3.98 38 BOTNET_IPINHOSTNAME 16614 8.33 13.60 5.94 39 XM_B_SpammyWords3 16421 9.28 13.44 7.40 40 LOTS_OF_MONEY 15388 8.84 12.60 7.14 41 RCVD_IN_MSPIKE_BL 15234 4.53 12.47 0.92 42 LotsOfNums_01 15187 9.32 12.43 7.90 43 MPART_ALT_DIFF 14867 7.94 12.17 6.02 44 XMSexyCombo_05 14344 7.27 11.74 5.24 45 HTML_IMAGE_RATIO_02 13671 10.03 11.19 9.50 46 MIME_HTML_MOSTLY 12746 5.32 10.43 3.00 47 XM_Evil_Numbers_Gen 11455 10.22 9.38 10.60 48 RCVD_IN_MSPIKE_H3 11239 14.46 9.20 16.85 49 BAYES_80 11198 6.23 9.17 4.90 50 RCVD_IN_BL_SPAMCOP_NET 10990 3.45 9.00 0.93 51 BAYES_60 10584 9.34 8.66 9.64 52 XM_B_Phish_Phrases 10458 8.12 8.56 7.92 53 TR_XM_SpammyWords3 9925 3.00 8.12 0.67 54 RCVD_IN_MSPIKE_L3 9615 2.98 7.87 0.76 55 FSL_BULK_SIG 9018 6.44 7.38 6.02 56 RCVD_IN_MSPIKE_H4 8890 9.85 7.28 11.02 57 XMSubMetaSx_00 8719 5.49 7.14 4.74 58 XMBrknScrpt_02 8403 2.89 6.88 1.08 59 URIBL_SBL_A 7851 2.20 6.43 0.28 60 RELAYCOUNTRY_CA 7638 3.18 6.25 1.78 61 TooManyTo_001 7528 6.35 6.16 6.44 62 XMBody_17 7235 2.79 5.92 1.36 63 UNPARSEABLE_RELAY 7075 8.21 5.79 9.30 64 SpammyFromTLD_01 7002 2.24 5.73 0.65 65 XM_UB50 6772 2.47 5.54 1.07 66 RELAYCOUNTRY_FR 6733 1.91 5.51 0.28 67 RCVD_IN_RP_SAFE 6480 9.07 5.30 10.78 68 HTML_IMAGE_RATIO_04 6470 5.50 5.30 5.60 69 BAYES_95 6396 3.71 5.24 3.01 70 XMDiploma_00 5954 2.57 4.87 1.52 71 XM_SendGrid 5731 7.30 4.69 8.48 72 XM_DIRTYINTL 5723 1.77 4.68 0.45 73 XM_H_Long_From01 5580 4.92 4.57 5.08 74 XMStrtUSub 5541 6.27 4.54 7.05 75 XM_B_SpammyTLD 5226 2.77 4.28 2.08 76 TR_XM_PhishingBody 5192 3.38 4.25 2.98 77 SpammyFromTLD_02 5182 1.46 4.24 0.19 78 HTML_IMAGE_RATIO_06 5065 4.13 4.15 4.12 79 XM_OfRef6 5007 2.19 4.10 1.33 80 RCVD_IN_RP_CERTIFIED 5006 8.28 4.10 10.18 81 URI_HEX 4935 2.04 4.04 1.13 82 TR_XM_MaxSPIKE 4905 1.27 4.02 0.02 83 TR_LOTS_OF_MONEY3 4814 1.79 3.94 0.81 84 RCVD_IN_MSPIKE_L5 4735 1.29 3.88 0.11 85 RCVD_IN_RP_RNBL 4588 1.25 3.76 0.11 86 XM_SPF_SoftFail 4358 1.80 3.57 1.00 87 DKIM_INVALID 4299 2.93 3.52 2.66 88 T_XMDrugObfuBody_08 4292 2.13 3.51 1.50 89 XMGenDplmaNmb 4282 1.69 3.51 0.87 90 XM_UB99 4194 1.07 3.43 0.00 91 T_FONT_INVIS_NAKED_TO 4151 2.50 3.40 2.09 92 HTML_IMAGE_RATIO_08 4101 2.71 3.36 2.42 93 PDS_OTHER_BAD_TLD 3864 1.56 3.16 0.83 94 URI_TRY_3LD 3847 2.08 3.15 1.60 95 TM2_M_VERY_LONG_WORD 3809 1.84 3.12 1.26 96 US_DOLLARS_3 3748 1.70 3.07 1.08 97 T_XMHurry_00 3741 1.58 3.06 0.91 98 SUBJ_ALL_CAPS 3597 1.78 2.94 1.25 99 TM2_M_URI_OPT_OUT 3528 5.30 2.89 6.40 100 XM_UB60 3502 0.95 2.87 0.08 101 XMNumbers 3493 3.96 2.86 4.46 102 TR_XM_MaxBayes 3452 0.89 2.83 0.01 103 BOTNET_NORDNS 3378 0.88 2.77 0.02 104 FROM_EXCESS_BASE64 3377 3.51 2.76 3.85 105 RCVD_IN_PSBL 3374 0.95 2.76 0.12 106 XMSlimDrugH 3345 1.12 2.74 0.39 107 XM_CamelCaseFrm001 3318 2.07 2.72 1.78 108 XM_UB999 3295 0.84 2.70 0.00 109 TR_XM_DK_SendGrid 3280 4.49 2.68 5.31 110 MIME_HTML_ONLY_MULTI 3167 3.50 2.59 3.92 111 BAYES_40 3139 3.72 2.57 4.24 112 HTML_MIME_NO_HTML_TAG 2907 1.62 2.38 1.27 113 T_TooManySym_01 2907 4.73 2.38 5.80 114 XMSexyCombo_01 2871 1.76 2.35 1.50 115 XM_B_Phish66 2786 1.65 2.28 1.36 116 XM_B_COVIDMETA 2664 1.11 2.18 0.62 117 XMBdyGiftCard01 2427 1.68 1.99 1.55 118 XM_UB80 2327 0.61 1.90 0.02 119 TR_XM_UnparsRelay 2308 0.94 1.89 0.51 120 TR_XM_SB_Phish 2272 1.72 1.86 1.66 121 BAYES_20 2253 2.85 1.84 3.31 122 XM_B_SpammyWords4 2241 1.02 1.83 0.65 123 PDS_FROM_2_EMAILS 2181 0.57 1.79 0.02 124 FROM_2_EMAILS_SHORT 2147 0.56 1.76 0.01 125 KHOP_HELO_FCRDNS 2132 1.15 1.75 0.88 126 TR_XM_COVIDMETA4 2060 0.70 1.69 0.25 127 LH_URI_DOM_IN_PATH 2051 1.41 1.68 1.29 128 TR_Symld_Words 2040 1.72 1.67 1.74 129 T_REMOTE_IMAGE 2040 2.31 1.67 2.60 130 PDS_TO_EQ_FROM_NAME 2023 0.52 1.66 0.01 131 RELAYCOUNTRY_DE 1996 0.75 1.63 0.34 132 FROM_SUSPICIOUS_NTLD 1992 0.59 1.63 0.11 133 DATE_IN_PAST_03_06 1985 0.56 1.62 0.08 134 T_XMDrugObfuBody_14 1977 1.76 1.62 1.83 135 XMStockSpam_06 1958 1.55 1.60 1.53 136 TR_XM_PHPDW 1932 0.68 1.58 0.27 137 XM_B_Unsub2 1926 1.14 1.58 0.94 138 NO_FM_NAME_IP_HOSTN 1909 0.49 1.56 0.01 139 LONG_JUNK_URI 1907 0.51 1.56 0.03 140 LongTLD 1894 0.56 1.55 0.11 141 FROM_SUSPICIOUS_NTLD_FP 1879 0.56 1.54 0.11 142 TR_XM_PHPForged 1868 0.66 1.53 0.26 143 T_FILL_THIS_FORM_SHORT 1867 0.98 1.53 0.73 144 TR_XM_FormFill2 1858 0.66 1.52 0.27 145 XM_H_PHPOS 1855 0.65 1.52 0.26 146 XMSexyCombo_04 1788 1.02 1.46 0.82 147 TR_XM_RelayPhish 1762 0.51 1.44 0.08 148 XMSubPhish11 1716 1.55 1.40 1.61 149 MIME_QP_LONG_LINE 1667 3.11 1.36 3.91 150 XM_DK_Undo_01 1600 1.35 1.31 1.36 151 TR_Caps_n_Bayes_99 1594 0.46 1.30 0.07 152 XMSubNoVowel 1576 1.25 1.29 1.23 153 RCVD_IN_IADB_LISTED 1528 2.78 1.25 3.47 154 TR_XM_INV_DKIM 1517 0.48 1.24 0.14 155 TR_Mismatch_TLD_02 1499 0.43 1.23 0.07 156 RDNS_DYNAMIC 1485 0.89 1.22 0.74 157 URI_NOVOWEL 1430 1.55 1.17 1.73 158 RELAYCOUNTRY_NL 1423 0.49 1.16 0.19 159 BAYES_05 1401 1.88 1.15 2.21 160 TR_XM_SpoofStaff 1392 0.43 1.14 0.11 161 XMSubMetaSx_01 1389 0.44 1.14 0.12 162 XMSpoofStaff2 1374 0.42 1.12 0.10 163 URI_PHP_REDIR 1334 0.34 1.09 0.00 164 SHORT_URI 1329 0.35 1.09 0.02 165 XMPhish30 1313 0.63 1.07 0.43 166 SHORT_SHORTNER 1290 0.36 1.06 0.04 167 TR_XM_COVIDMETA1 1289 0.55 1.06 0.32 168 XM_URI_RBL 1288 0.54 1.05 0.30 169 RCVD_IN_IADB_SPF 1266 2.47 1.04 3.11 170 T_XMDrugObfuBody_00 1240 0.67 1.02 0.52 171 TVD_SPACE_RATIO 1218 0.56 1.00 0.36 172 XMSolicitRefs_0 1216 0.49 1.00 0.26 173 XMHTML_After_End 1209 0.65 0.99 0.49 174 HTML_TAG_BALANCE_BODY 1202 0.62 0.98 0.45 175 MIMEOLE_DIRECT_TO_MX 1197 0.31 0.98 0.00 176 XM_ProductURIs 1191 0.96 0.97 0.95 177 RCVD_IN_IADB_SENDERID 1168 2.25 0.96 2.84 178 ALL_TRUSTED 1168 9.71 0.96 13.69 179 RCVD_IN_IADB_DK 1165 2.20 0.95 2.76 180 XM_SPF_Unknown 1147 0.52 0.94 0.32 181 DKIM_ADSP_NXDOMAIN 1145 0.89 0.94 0.87 182 XM_Combo_Sbj 1143 0.44 0.94 0.21 183 BAYES_00 1117 9.76 0.91 13.78 184 INVESTMENT_ADVICE 1113 0.34 0.91 0.08 185 HTML_IMAGE_ONLY_32 1106 0.48 0.91 0.28 186 XM_H_SpoofStaff4 1103 0.38 0.90 0.14 187 XMSexyCombo_02 1103 0.30 0.90 0.03 188 XM_BadFromFormat 1091 0.35 0.89 0.11 189 TR_MetaPhish_Combo_01 1090 0.89 0.89 0.88 190 MIME_CHARSET_FARAWAY 1086 0.35 0.89 0.10 191 TR_XM_PSC1 1084 0.35 0.89 0.10 192 HK_RANDOM_REPLYTO 1077 0.40 0.88 0.18 193 RELAYCOUNTRY_GB 1076 0.74 0.88 0.67 194 MAILING_LIST_MULTI 1067 1.55 0.87 1.86 195 TR_XM_SpoofStaff2 1057 0.27 0.87 0.00 196 REMOVE_BEFORE_LINK 1054 0.43 0.86 0.23 197 TM2_M_A_HREF_HREF 1050 0.46 0.86 0.27 198 TR_Mismatch_TLD_01 1039 0.39 0.85 0.18 199 XMGetyour 1034 0.29 0.85 0.04 200 XMBody_78 1028 0.65 0.84 0.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 232724 88.76 93.74 86.50 2 RELAYCOUNTRY_US 220883 80.48 76.91 82.10 3 DKIM_SIGNED 212010 81.62 87.84 78.80 4 XM_DK_Pass 209058 80.22 85.75 77.70 5 DKIM_VALID 204859 78.70 84.32 76.14 6 XM_B_Unicode 198180 75.10 78.28 73.66 7 DKIM_VALID_AU 168068 64.13 67.81 62.47 8 XMListUnsubscribeExists 148474 60.85 73.33 55.18 9 BAYES_50 142057 46.39 32.26 52.80 10 DCC_CHECK_NEGATIVE 139861 42.56 21.80 51.98 11 XM_B_SpammyWords 138972 58.21 72.64 51.65 12 DCC_CHECK 125980 56.23 76.94 46.82 13 XM_B_Unicode3 124464 43.84 38.51 46.26 14 HTML_FONT_LOW_CONTRAST 83659 34.32 41.42 31.09 15 RCVD_IN_MSPIKE_WL 82099 26.36 17.21 30.51 16 LOC_TINY_FONT_1 81187 32.48 37.54 30.18 17 DKIM_VALID_EF 80232 29.83 29.84 29.82 18 RCVD_IN_MSPIKE_H2 72469 27.26 27.97 26.93 19 XM_B_SpammyWords2 67394 31.03 44.20 25.05 20 MIME_HTML_ONLY 67378 25.39 26.15 25.04 21 T_TM2_M_HEADER_IN_MSG 62764 22.28 19.98 23.33 22 FVGT_m_MULTI_ODD 59967 22.89 24.21 22.29 23 XMSubLong 55650 21.75 24.09 20.68 24 RCVD_IN_MSPIKE_H3 45331 14.46 9.20 16.85 25 T_KAM_HTML_FONT_INVALID 45286 18.90 23.47 16.83 26 XM_Body_Dirty_Words 38154 16.35 21.13 14.18 27 BAYES_00 37081 9.76 0.91 13.78 28 ALL_TRUSTED 36822 9.71 0.96 13.69 29 XM_Multi_Part_URI 36530 16.48 22.86 13.58 30 XM_DKIMWhitelistDomains 34718 8.89 0.04 12.90 31 XM_B_Unsub 33859 13.29 14.85 12.58 32 RCVD_IN_MSPIKE_H4 29646 9.85 7.28 11.02 33 RCVD_IN_RP_SAFE 29001 9.07 5.30 10.78 34 XM_Evil_Numbers_Gen 28514 10.22 9.38 10.60 35 RCVD_IN_RP_CERTIFIED 27390 8.28 4.10 10.18 36 TR_XM_DK_Bayes 26785 7.03 0.58 9.96 37 TR_XM_DK_Bayes1 26235 6.88 0.56 9.75 38 BAYES_60 25937 9.34 8.66 9.64 39 HTML_IMAGE_RATIO_02 25552 10.03 11.19 9.50 40 UNPARSEABLE_RELAY 25031 8.21 5.79 9.30 41 TR_XM_DK_Bayes2 24834 6.51 0.52 9.23 42 XM_DK_Undo_02 23515 21.60 49.93 8.74 43 XM_SendGrid 22813 7.30 4.69 8.48 44 XM_B_Phish_Phrases 21314 8.12 8.56 7.92 45 LotsOfNums_01 21268 9.32 12.43 7.90 46 XM_B_SpammyWords3 19903 9.28 13.44 7.40 47 LOTS_OF_MONEY 19206 8.84 12.60 7.14 48 XMStrtUSub 18969 6.27 4.54 7.05 49 TR_XM_DKIM_Undo 17953 16.73 38.87 6.67 50 TooManyTo_001 17324 6.35 6.16 6.44 51 TM2_M_URI_OPT_OUT 17217 5.30 2.89 6.40 52 BAYES_99 16436 16.13 38.19 6.11 53 MPART_ALT_DIFF 16206 7.94 12.17 6.02 54 FSL_BULK_SIG 16195 6.44 7.38 6.02 55 BOTNET_IPINHOSTNAME 15993 8.33 13.60 5.94 56 T_TooManySym_01 15613 4.73 2.38 5.80 57 HTML_IMAGE_RATIO_04 15057 5.50 5.30 5.60 58 TR_XM_DK_SendGrid 14288 4.49 2.68 5.31 59 XMSexyCombo_05 14102 7.27 11.74 5.24 60 XM_H_Long_From01 13675 4.92 4.57 5.08 61 BAYES_80 13179 6.23 9.17 4.90 62 BAYES_999 13166 12.87 30.43 4.89 63 IN_ZIMBRA_NJ_WHITELIST 12971 3.34 0.09 4.82 64 XMSubMetaSx_00 12742 5.49 7.14 4.74 65 RELAYCOUNTRY_META 12250 10.18 22.57 4.55 66 XMNumbers 11997 3.96 2.86 4.46 67 BAYES_40 11404 3.72 2.57 4.24 68 HTML_IMAGE_RATIO_06 11087 4.13 4.15 4.12 69 XM_UncommonTLD01 10703 7.00 13.66 3.98 70 MIME_HTML_ONLY_MULTI 10539 3.50 2.59 3.92 71 MIME_QP_LONG_LINE 10509 3.11 1.36 3.91 72 FROM_EXCESS_BASE64 10363 3.51 2.76 3.85 73 TR_DCC_Bayes_99 10151 11.81 29.50 3.77 74 XM_H_Trusted_IP 9571 2.45 0.00 3.56 75 RCVD_IN_IADB_LISTED 9347 2.78 1.25 3.47 76 T_TooManySym_02 9106 2.51 0.59 3.38 77 BAYES_20 8894 2.85 1.84 3.31 78 RCVD_IN_IADB_SPF 8378 2.47 1.04 3.11 79 BAYES_95 8100 3.71 5.24 3.01 80 MIME_HTML_MOSTLY 8067 5.32 10.43 3.00 81 TR_XM_PhishingBody 8020 3.38 4.25 2.98 82 INVALID_MSGID 7762 2.07 0.27 2.88 83 RCVD_IN_IADB_SENDERID 7651 2.25 0.96 2.84 84 RCVD_IN_IADB_DK 7424 2.20 0.95 2.76 85 DKIM_INVALID 7151 2.93 3.52 2.66 86 RCVD_IN_MSPIKE_H5 7122 2.05 0.74 2.65 87 T_REMOTE_IMAGE 6994 2.31 1.67 2.60 88 TVD_RCVD_IP 6859 1.87 0.36 2.55 89 HTML_IMAGE_RATIO_08 6511 2.71 3.36 2.42 90 TO_MALFORMED 6477 1.66 0.02 2.41 91 ANY_BOUNCE_MESSAGE 6152 1.69 0.39 2.29 92 BOUNCE_MESSAGE 6151 1.69 0.39 2.29 93 HELO_MISC_IP 6109 1.72 0.50 2.27 94 CK_HELO_DYNAMIC_SPLIT_IP 6097 1.76 0.65 2.27 95 UNTRUSTED_Relay 5993 6.36 15.46 2.23 96 BAYES_05 5949 1.88 1.15 2.21 97 HTML_FONT_FACE_BAD 5755 1.68 0.67 2.14 98 T_FONT_INVIS_NAKED_TO 5631 2.50 3.40 2.09 99 XM_B_SpammyTLD 5605 2.77 4.28 2.08 100 RCVD_IN_IADB_VOUCHED 5223 1.53 0.64 1.94 101 MIME_HEADER_CTYPE_ONLY 5190 1.37 0.13 1.93 102 USER_IN_DEF_DKIM_WL 5143 1.32 0.00 1.91 103 BOTNET 5108 6.62 17.03 1.90 104 IN_HORDE_ADDRESS_BOOK 5073 1.40 0.34 1.89 105 MAILING_LIST_MULTI 5008 1.55 0.87 1.86 106 T_XMDrugObfuBody_14 4913 1.76 1.62 1.83 107 RELAYCOUNTRY_CA 4800 3.18 6.25 1.78 108 XM_CamelCaseFrm001 4799 2.07 2.72 1.78 109 XM_PDF 4765 1.33 0.35 1.77 110 XMBSHREFv2 4746 1.26 0.16 1.76 111 TR_XM_SpammyWords2 4740 6.50 16.93 1.76 112 TR_Symld_Words 4693 1.72 1.67 1.74 113 URI_NOVOWEL 4653 1.55 1.17 1.73 114 TR_XM_SB_Phish 4462 1.72 1.86 1.66 115 XMGappySubj_01 4452 1.18 0.14 1.65 116 XMSubPhish11 4331 1.55 1.40 1.61 117 URI_TRY_3LD 4308 2.08 3.15 1.60 118 XMBdyGiftCard01 4158 1.68 1.99 1.55 119 XMStockSpam_06 4104 1.55 1.60 1.53 120 XMDiploma_00 4098 2.57 4.87 1.52 121 T_XMDrugObfuBody_08 4026 2.13 3.51 1.50 122 XMSexyCombo_01 4023 1.76 2.35 1.50 123 T_TooManySym_03 3884 1.05 0.19 1.44 124 XM_DK_Undo_01 3665 1.35 1.31 1.36 125 XMBody_17 3662 2.79 5.92 1.36 126 XM_B_Phish66 3656 1.65 2.28 1.36 127 XM_OfRef6 3575 2.19 4.10 1.33 128 TooManyTo_002 3562 1.04 0.42 1.32 129 TR_MSPIKEBAYES00 3518 0.91 0.03 1.31 130 LH_URI_DOM_IN_PATH 3474 1.41 1.68 1.29 131 HTML_MIME_NO_HTML_TAG 3430 1.62 2.38 1.27 132 TM2_M_VERY_LONG_WORD 3398 1.84 3.12 1.26 133 SUBJ_ALL_CAPS 3365 1.78 2.94 1.25 134 XMSubNoVowel 3315 1.25 1.29 1.23 135 RCVD_IN_IADB_OPTIN 3314 1.01 0.52 1.23 136 DKIM_ADSP_CUSTOM_MED 3218 1.07 0.79 1.20 137 URI_HEX 3040 2.04 4.04 1.13 138 XM_H_Long_From02 2967 0.98 0.71 1.10 139 XM_GoogleGroups 2927 0.87 0.41 1.09 140 US_DOLLARS_3 2913 1.70 3.07 1.08 141 XMBrknScrpt_02 2905 2.89 6.88 1.08 142 XM_UB50 2872 2.47 5.54 1.07 143 XM_RXBody 2870 0.88 0.48 1.07 144 XM_SPF_SoftFail 2689 1.80 3.57 1.00 145 XM_ProductURIs 2562 0.96 0.97 0.95 146 T_TooManySym_04 2547 0.66 0.02 0.95 147 TooManyTo_003 2546 0.74 0.28 0.95 148 XM_B_Unsub2 2524 1.14 1.58 0.94 149 RCVD_IN_BL_SPAMCOP_NET 2507 3.45 9.00 0.93 150 RCVD_IN_MSPIKE_BL 2469 4.53 12.47 0.92 151 T_XMHurry_00 2446 1.58 3.06 0.91 152 TR_MetaPhish_Combo_01 2373 0.89 0.89 0.88 153 KHOP_HELO_FCRDNS 2370 1.15 1.75 0.88 154 XMGenDplmaNmb 2345 1.69 3.51 0.87 155 DKIM_ADSP_NXDOMAIN 2328 0.89 0.94 0.87 156 XM_S_SubURI 2247 0.60 0.07 0.84 157 PDS_OTHER_BAD_TLD 2238 1.56 3.16 0.83 158 NO_DNS_FOR_FROM 2224 0.81 0.79 0.83 159 XMSexyCombo_04 2214 1.02 1.46 0.82 160 NUMERIC_HTTP_ADDR 2186 0.67 0.35 0.81 161 TR_LOTS_OF_MONEY3 2176 1.79 3.94 0.81 162 XMBody_95 2117 0.57 0.08 0.79 163 TooManyTo_004 2116 0.62 0.26 0.79 164 NML_ADSP_CUSTOM_MED 2084 0.77 0.74 0.77 165 RCVD_IN_MSPIKE_L3 2034 2.98 7.87 0.76 166 T_TooManySym_05 2029 0.52 0.01 0.75 167 RDNS_DYNAMIC 1978 0.89 1.22 0.74 168 T_FILL_THIS_FORM_SHORT 1957 0.98 1.53 0.73 169 T_MANY_PILL_PRICE 1936 0.50 0.03 0.72 170 XMSubMetaSxObfu_02 1911 0.61 0.38 0.71 171 FORGED_GMAIL_RCVD 1866 0.65 0.55 0.69 172 HTTPS_HTTP_MISMATCH 1846 0.73 0.84 0.69 173 TooManyTo_005 1841 0.54 0.23 0.68 174 RELAYCOUNTRY_GB 1811 0.74 0.88 0.67 175 TR_XM_SpammyWords3 1797 3.00 8.12 0.67 176 XM_ShortIntro_01 1788 0.67 0.67 0.66 177 SpammyFromTLD_01 1762 2.24 5.73 0.65 178 SUBJ_DOLLARS 1758 0.64 0.60 0.65 179 XM_B_SpammyWords4 1748 1.02 1.83 0.65 180 XMPhish08 1747 0.58 0.44 0.65 181 XM_B_COVIDMETA 1678 1.11 2.18 0.62 182 USER_IN_WHITELIST 1660 0.42 0.00 0.62 183 USER_IN_WELCOMELIST 1660 0.42 0.00 0.62 184 XM_B_REG_HTML 1643 0.60 0.58 0.61 185 XM_B_COPY_HTML 1624 0.60 0.60 0.60 186 XMHTMLBadTable_001 1587 0.59 0.60 0.59 187 HELO_NODOT 1556 0.60 0.64 0.58 188 HELO_NO_DOMAIN 1555 0.60 0.64 0.58 189 HTML_IMAGE_ONLY_20 1547 0.47 0.23 0.57 190 XMBody_78 1523 0.65 0.84 0.57 191 XMSubMetaI_00 1400 0.59 0.74 0.52 192 T_XMDrugObfuBody_00 1395 0.67 1.02 0.52 193 TR_XM_UnparsRelay 1365 0.94 1.89 0.51 194 XMLngstWrd_00 1331 0.44 0.32 0.49 195 XMHTML_After_End 1326 0.65 0.99 0.49 196 FILL_THIS_FORM 1319 0.48 0.45 0.49 197 XM_S_SpammyWords 1295 0.57 0.76 0.48 198 TR_XM_Spammywords 1294 0.57 0.76 0.48 199 PLING_QUERY 1282 0.52 0.63 0.48 200 XMPhish14 1275 0.45 0.41 0.47 ----------------------------------------------------------------------