Email: 529062 Autolearn: 0 AvgScore: 3.58 AvgScanTime: 1.26 sec Spam: 154414 Autolearn: 0 AvgScore: 14.50 AvgScanTime: 1.48 sec Ham: 374648 Autolearn: 0 AvgScore: -0.93 AvgScanTime: 1.17 sec Time Spent Running SA: 184.81 hours Time Spent Processing Spam: 63.33 hours Time Spent Processing Ham: 121.48 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 144245 79.58 93.41 73.88 2 DKIM_SIGNED 135750 71.43 87.91 64.63 3 XM_DK_Pass 132379 70.20 85.73 63.80 4 DKIM_VALID 130330 68.97 84.40 62.60 5 DCC_CHECK 124746 50.91 80.79 38.60 6 XM_B_Unicode 122737 66.93 79.49 61.75 7 RELAYCOUNTRY_US 117665 71.37 76.20 69.38 8 XMListUnsubscribeExists 115043 53.39 74.50 44.69 9 XM_B_SpammyWords 112533 51.04 72.88 42.04 10 DKIM_VALID_AU 101878 55.49 65.98 51.16 11 XM_DK_Undo_02 85568 21.22 55.41 7.13 12 BAYES_99 70819 17.07 45.86 5.20 13 TR_XM_DKIM_Undo 70690 17.24 45.78 5.48 14 XM_B_SpammyWords2 61450 25.46 39.80 19.55 15 HTML_FONT_LOW_CONTRAST 59644 29.46 38.63 25.68 16 BAYES_999 58043 13.97 37.59 4.24 17 TR_DCC_Bayes_99 56128 12.78 36.35 3.07 18 XM_B_Unicode3 55108 36.34 35.69 36.60 19 LOC_TINY_FONT_1 54869 27.16 35.53 23.71 20 RCVD_IN_MSPIKE_H2 51119 25.16 33.11 21.88 21 DKIM_VALID_EF 48951 26.20 31.70 23.93 22 BAYES_50 44143 45.80 28.59 52.89 23 FVGT_m_MULTI_ODD 40706 20.87 26.36 18.61 24 MIME_HTML_ONLY 36682 22.44 23.76 21.90 25 T_KAM_HTML_FONT_INVALID 35385 16.77 22.92 14.23 26 RELAYCOUNTRY_META 34307 8.82 22.22 3.30 27 XM_Multi_Part_URI 34220 14.44 22.16 11.26 28 T_TM2_M_HEADER_IN_MSG 30588 18.38 19.81 17.79 29 XMSubLong 29784 16.84 19.29 15.83 30 TR_XM_SpammyWords2 29097 6.49 18.84 1.39 31 DCC_CHECK_NEGATIVE 27892 48.03 18.06 60.38 32 BOTNET 27000 6.14 17.49 1.46 33 XM_Body_Dirty_Words 25720 13.17 16.66 11.73 34 RCVD_IN_MSPIKE_WL 23647 22.61 15.31 25.62 35 BOTNET_IPINHOSTNAME 22384 7.40 14.50 4.47 36 LOTS_OF_MONEY 21580 7.80 13.98 5.25 37 UNTRUSTED_Relay 20724 5.07 13.42 1.63 38 XM_UncommonTLD01 19769 6.28 12.80 3.59 39 XM_B_Unsub 19738 10.88 12.78 10.09 40 TR_XM_SpammyWords4 19266 6.07 12.48 3.43 41 XM_B_SpammyWords3 18232 6.75 11.81 4.67 42 URIBL_SBL_A 16994 3.42 11.01 0.29 43 FSL_BULK_SIG 16738 7.37 10.84 5.93 44 LotsOfNums_01 16343 7.63 10.58 6.41 45 MPART_ALT_DIFF 15784 7.85 10.22 6.87 46 RCVD_IN_BL_SPAMCOP_NET 15040 3.27 9.74 0.60 47 XMSexyCombo_05 14245 5.84 9.23 4.45 48 MIME_HTML_MOSTLY 13510 4.47 8.75 2.71 49 XM_Evil_Numbers_Gen 13164 7.37 8.53 6.90 50 BAYES_80 13060 5.38 8.46 4.11 51 HTML_IMAGE_RATIO_02 12888 7.22 8.35 6.76 52 RCVD_IN_MSPIKE_H3 12255 12.22 7.94 13.99 53 RELAYCOUNTRY_CA 12100 3.15 7.84 1.22 54 RCVD_IN_MSPIKE_BL 11789 2.37 7.63 0.20 55 HTML_IMAGE_RATIO_04 11747 6.09 7.61 5.47 56 TR_XM_MSPIKECOMBO 11536 2.32 7.47 0.20 57 UNPARSEABLE_RELAY 11217 7.57 7.26 7.70 58 BAYES_60 10927 6.96 7.08 6.91 59 TR_XM_UnparsRelay 10881 5.95 7.05 5.49 60 RCVD_IN_MSPIKE_H4 9992 8.73 6.47 9.66 61 XMBody_17 9889 2.58 6.40 1.01 62 TR_XM_MaxBayes 9445 1.80 6.12 0.02 63 XM_B_Phish_Phrases 9413 4.74 6.10 4.19 64 TooManyTo_001 9307 5.59 6.03 5.42 65 SpammyFromTLD_01 9145 2.00 5.92 0.38 66 XM_SendGrid 9141 6.80 5.92 7.16 67 HTML_IMAGE_RATIO_06 9114 3.71 5.90 2.80 68 XMSubMetaSx_00 9071 4.03 5.87 3.27 69 BAYES_95 8124 3.37 5.26 2.59 70 RCVD_IN_RP_RNBL 7943 1.57 5.14 0.10 71 TR_LOTS_OF_MONEY3 7884 1.97 5.11 0.68 72 XM_UB50 7758 1.98 5.02 0.73 73 XM_H_Long_From01 7747 4.82 5.02 4.74 74 XM_OfRef6 7269 2.10 4.71 1.02 75 T_XMDrugObfuBody_08 7202 2.38 4.66 1.43 76 T_FONT_INVIS_NAKED_TO 7121 2.45 4.61 1.56 77 RCVD_IN_RP_SAFE 6909 7.91 4.47 9.33 78 TR_XM_SpammyWords5 6836 2.23 4.43 1.32 79 RELAYCOUNTRY_FR 6787 1.42 4.40 0.20 80 XMBrknScrpt_02 6566 1.82 4.25 0.81 81 RCVD_IN_MSPIKE_L5 6524 1.26 4.23 0.04 82 HTML_IMAGE_RATIO_08 6259 2.53 4.05 1.90 83 XMStrtUSub 5973 5.67 3.87 6.42 84 SpammyFromTLD_02 5918 1.22 3.83 0.14 85 URI_TRY_3LD 5705 2.02 3.69 1.34 86 T_FILL_THIS_FORM_SHORT 5697 1.55 3.69 0.67 87 T_XMHurry_00 5499 1.52 3.56 0.68 88 XM_SPF_SoftFail 5471 1.82 3.54 1.11 89 DKIM_INVALID 5420 2.46 3.51 2.03 90 RCVD_IN_PSBL 5417 1.11 3.51 0.13 91 RCVD_IN_RP_CERTIFIED 5393 7.19 3.49 8.72 92 TR_XM_SpammyWords3 5393 1.11 3.49 0.13 93 TR_XM_PhishingBody 5318 2.62 3.44 2.28 94 TR_XM_DK_SendGrid 5315 4.55 3.44 5.01 95 XM_DIRTYINTL 5090 1.17 3.30 0.29 96 SUBJ_ALL_CAPS 5019 1.61 3.25 0.93 97 TM2_M_URI_OPT_OUT 4903 15.58 3.18 20.69 98 XM_UB99 4668 0.89 3.02 0.00 99 URI_HEX 4577 1.58 2.96 1.00 100 FROM_EXCESS_BASE64 4519 2.93 2.93 2.93 101 RCVD_IN_MSPIKE_L3 4465 0.93 2.89 0.12 102 XMNumbers 4334 3.23 2.81 3.40 103 XMSubNoVowel 4226 2.48 2.74 2.37 104 TR_XM_FormFill 4110 0.78 2.66 0.01 105 XM_B_SpammyTLD 4037 2.24 2.61 2.09 106 TM2_M_VERY_LONG_WORD 3779 1.44 2.45 1.03 107 BOTNET_NORDNS 3640 0.69 2.36 0.01 108 T_REMOTE_IMAGE 3551 2.60 2.30 2.72 109 XM_UB999 3472 0.66 2.25 0.00 110 URI_PHP_REDIR 3379 0.65 2.19 0.01 111 MIME_HTML_ONLY_MULTI 3362 4.23 2.18 5.08 112 XM_UB60 3352 0.68 2.17 0.07 113 XMDiploma_00 3341 1.41 2.16 1.10 114 XMSlimDrugH 3205 0.76 2.08 0.22 115 TR_Symld_Words 3107 1.70 2.01 1.57 116 XM_CamelCaseFrm001 3088 1.79 2.00 1.70 117 TVD_SPACE_RATIO_MINFP 3023 0.59 1.96 0.03 118 T_XMDrugObfuBody_12 3011 0.73 1.95 0.23 119 NO_FM_NAME_IP_HOSTN 2961 0.56 1.92 0.00 120 TVD_SPACE_RATIO 2909 0.81 1.88 0.37 121 XM_B_Unsub2 2865 1.31 1.86 1.08 122 T_TooManySym_01 2834 3.85 1.84 4.69 123 TR_XM_SB_Phish 2783 2.35 1.80 2.58 124 BAYES_40 2758 3.10 1.79 3.64 125 T_Symld_Words_02 2748 0.79 1.78 0.38 126 XMSubPhish11 2746 2.34 1.78 2.57 127 XM_B_SpammyWords4 2682 0.90 1.74 0.56 128 XMBdyGiftCard01 2629 1.40 1.70 1.27 129 XM_DK_Undo_01 2616 1.42 1.69 1.30 130 PDS_OTHER_BAD_TLD 2576 1.20 1.67 1.01 131 TR_Caps_n_Bayes_99 2534 0.50 1.64 0.03 132 ALL_TRUSTED 2515 20.09 1.63 27.70 133 HTML_MIME_NO_HTML_TAG 2494 1.35 1.62 1.24 134 MIMEOLE_DIRECT_TO_MX 2447 0.46 1.58 0.00 135 HK_RANDOM_REPLYTO 2417 0.58 1.57 0.18 136 XM_B_Phish66 2406 1.20 1.56 1.06 137 XM_UB80 2375 0.47 1.54 0.03 138 MIME_QP_LONG_LINE 2354 2.76 1.52 3.27 139 KHOP_HELO_FCRDNS 2319 1.07 1.50 0.89 140 PDS_FROM_2_EMAILS 2243 0.44 1.45 0.02 141 FROM_2_EMAILS_SHORT 2229 0.43 1.44 0.01 142 FROM_SUSPICIOUS_NTLD 2224 0.48 1.44 0.09 143 TR_XM_RelayPhish 2218 0.45 1.44 0.05 144 URI_NO_WWW_BIZ_CGI 2209 0.42 1.43 0.01 145 XMSubEmpty 2160 0.99 1.40 0.82 146 TR_XM_INV_DKIM 2136 0.45 1.38 0.06 147 XMSexyCombo_01 2130 0.92 1.38 0.73 148 XMSubMetaD_00 2128 0.44 1.38 0.05 149 TR_XM_PHPDW 2111 0.56 1.37 0.22 150 PDS_TO_EQ_FROM_NAME 2097 0.40 1.36 0.00 151 FROM_SUSPICIOUS_NTLD_FP 2097 0.45 1.36 0.08 152 XMHTML_After_End 2095 0.64 1.36 0.35 153 BAYES_20 2048 2.66 1.33 3.22 154 TR_XM_PHPForged 2014 0.51 1.30 0.18 155 RELAYCOUNTRY_DE 2014 0.58 1.30 0.28 156 TR_XM_FormFill2 2003 0.51 1.30 0.18 157 XM_H_PHPOS 1998 0.50 1.29 0.18 158 DATE_IN_PAST_03_06 1982 0.41 1.28 0.06 159 XMStockSpam_06 1979 1.20 1.28 1.16 160 XMSubMetaSxObfu_03 1955 0.69 1.27 0.45 161 TR_Mismatch_TLD_01 1944 0.59 1.26 0.31 162 HTML_TAG_BALANCE_BODY 1921 0.67 1.24 0.44 163 DOS_OE_TO_MX 1889 0.36 1.22 0.00 164 RCVD_IN_IADB_LISTED 1879 2.70 1.22 3.31 165 DRUGS_ERECTILE 1877 0.38 1.22 0.04 166 T_XMDrugObfuBody_00 1798 0.63 1.16 0.41 167 T_XMDrugObfuBody_14 1783 1.46 1.15 1.59 168 XMBody_78 1769 0.61 1.15 0.40 169 T_STY_INVIS_DIRECT 1715 0.37 1.11 0.07 170 RCVD_IN_IADB_SPF 1700 2.35 1.10 2.87 171 XMSubMetaD_03 1695 0.34 1.10 0.02 172 LONG_JUNK_URI 1689 0.34 1.09 0.03 173 DIET_1 1657 0.57 1.07 0.36 174 TR_XM_MaxSPIKE 1642 0.31 1.06 0.00 175 RDNS_DYNAMIC 1639 0.70 1.06 0.55 176 RELAYCOUNTRY_GB 1595 0.66 1.03 0.50 177 RCVD_IN_IADB_DK 1586 2.06 1.03 2.48 178 RCVD_IN_IADB_SENDERID 1565 2.11 1.01 2.56 179 XM_URI_RBL 1557 0.40 1.01 0.15 180 SUSP_UTF8_WORD_SUBJ 1557 0.33 1.01 0.05 181 XMSubMetaD_01 1557 0.30 1.01 0.00 182 SERGIO_SUBJECT_VIAGRA01 1554 0.30 1.01 0.00 183 XM_Combo_Sbj 1554 0.42 1.01 0.18 184 SUBJECT_DRUG_GAP_C 1540 0.29 1.00 0.00 185 XMSubMetaD_02 1529 0.29 0.99 0.00 186 SUBJECT_DRUG_GAP_L 1524 0.29 0.99 0.00 187 MIME_CHARSET_FARAWAY 1510 0.36 0.98 0.11 188 TR_Mismatch_TLD_02 1508 0.33 0.98 0.07 189 LongTLD 1494 0.35 0.97 0.10 190 XMSubMetaI_00 1493 0.72 0.97 0.62 191 XM_OfRef7 1458 0.33 0.94 0.08 192 URI_NOVOWEL 1441 1.61 0.93 1.90 193 SHORTENED_URL_HREF 1439 0.66 0.93 0.55 194 XM_B_COVIDMETA 1437 0.54 0.93 0.38 195 RELAYCOUNTRY_IN 1423 0.30 0.92 0.04 196 ACT_NOW_CAPS 1411 0.33 0.91 0.09 197 RCVD_IN_MSPIKE_H5 1400 1.66 0.91 1.97 198 XM_UB95 1393 0.27 0.90 0.01 199 REMOVE_BEFORE_LINK 1391 0.42 0.90 0.22 200 TR_XM_COVIDMETA4 1338 0.38 0.87 0.19 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 276804 79.58 93.41 73.88 2 RELAYCOUNTRY_US 259913 71.37 76.20 69.38 3 DKIM_SIGNED 242145 71.43 87.91 64.63 4 XM_DK_Pass 239039 70.20 85.73 63.80 5 DKIM_VALID 234546 68.97 84.40 62.60 6 XM_B_Unicode 231362 66.93 79.49 61.75 7 DCC_CHECK_NEGATIVE 226231 48.03 18.06 60.38 8 BAYES_50 198162 45.80 28.59 52.89 9 DKIM_VALID_AU 191678 55.49 65.98 51.16 10 XMListUnsubscribeExists 167430 53.39 74.50 44.69 11 XM_B_SpammyWords 157491 51.04 72.88 42.04 12 DCC_CHECK 144599 50.91 80.79 38.60 13 XM_B_Unicode3 137129 36.34 35.69 36.60 14 ALL_TRUSTED 103760 20.09 1.63 27.70 15 HTML_FONT_LOW_CONTRAST 96209 29.46 38.63 25.68 16 RCVD_IN_MSPIKE_WL 95994 22.61 15.31 25.62 17 DKIM_VALID_EF 89638 26.20 31.70 23.93 18 LOC_TINY_FONT_1 88844 27.16 35.53 23.71 19 MIME_HTML_ONLY 82032 22.44 23.76 21.90 20 RCVD_IN_MSPIKE_H2 81977 25.16 33.11 21.88 21 TM2_M_URI_OPT_OUT 77517 15.58 3.18 20.69 22 XM_B_SpammyWords2 73228 25.46 39.80 19.55 23 FVGT_m_MULTI_ODD 69721 20.87 26.36 18.61 24 T_TM2_M_HEADER_IN_MSG 66638 18.38 19.81 17.79 25 ANY_BOUNCE_MESSAGE 63246 12.08 0.43 16.88 26 BOUNCE_MESSAGE 63245 12.08 0.43 16.88 27 XMSubLong 59291 16.84 19.29 15.83 28 T_KAM_HTML_FONT_INVALID 53322 16.77 22.92 14.23 29 RCVD_IN_MSPIKE_H3 52414 12.22 7.94 13.99 30 BAYES_00 48052 9.32 0.82 12.83 31 XM_Body_Dirty_Words 43936 13.17 16.66 11.73 32 XM_Multi_Part_URI 42196 14.44 22.16 11.26 33 XM_B_Unsub 37810 10.88 12.78 10.09 34 RCVD_IN_MSPIKE_H4 36187 8.73 6.47 9.66 35 XM_DKIMWhitelistDomains 36042 6.83 0.06 9.62 36 RCVD_IN_RP_SAFE 34944 7.91 4.47 9.33 37 RCVD_IN_RP_CERTIFIED 32660 7.19 3.49 8.72 38 BAYES_05 32273 6.34 0.82 8.61 39 TR_XM_DK_Bayes 29258 5.71 0.60 7.81 40 UNPARSEABLE_RELAY 28859 7.57 7.26 7.70 41 TR_XM_DK_Bayes1 28694 5.59 0.58 7.66 42 XM_SendGrid 26811 6.80 5.92 7.16 43 XM_DK_Undo_02 26694 21.22 55.41 7.13 44 TR_XM_DK_Bayes2 26626 5.19 0.56 7.11 45 BAYES_60 25873 6.96 7.08 6.91 46 XM_Evil_Numbers_Gen 25837 7.37 8.53 6.90 47 MPART_ALT_DIFF 25747 7.85 10.22 6.87 48 HTML_IMAGE_RATIO_02 25321 7.22 8.35 6.76 49 XMStrtUSub 24046 5.67 3.87 6.42 50 LotsOfNums_01 24012 7.63 10.58 6.41 51 FSL_BULK_SIG 22230 7.37 10.84 5.93 52 TR_XM_UnparsRelay 20585 5.95 7.05 5.49 53 TR_XM_DKIM_Undo 20540 17.24 45.78 5.48 54 HTML_IMAGE_RATIO_04 20479 6.09 7.61 5.47 55 TooManyTo_001 20294 5.59 6.03 5.42 56 LOTS_OF_MONEY 19683 7.80 13.98 5.25 57 BAYES_99 19478 17.07 45.86 5.20 58 MIME_HTML_ONLY_MULTI 19043 4.23 2.18 5.08 59 TR_XM_DK_SendGrid 18761 4.55 3.44 5.01 60 XM_H_Long_From01 17770 4.82 5.02 4.74 61 T_TooManySym_01 17560 3.85 1.84 4.69 62 XM_B_SpammyWords3 17506 6.75 11.81 4.67 63 XM_H_Trusted_IP 16926 3.20 0.00 4.52 64 BOTNET_IPINHOSTNAME 16764 7.40 14.50 4.47 65 XMSexyCombo_05 16672 5.84 9.23 4.45 66 BAYES_999 15892 13.97 37.59 4.24 67 XM_B_Phish_Phrases 15684 4.74 6.10 4.19 68 BAYES_80 15391 5.38 8.46 4.11 69 IN_ZIMBRA_NJ_WHITELIST 14734 2.81 0.07 3.93 70 BAYES_40 13634 3.10 1.79 3.64 71 XM_UncommonTLD01 13447 6.28 12.80 3.59 72 TR_XM_SpammyWords4 12852 6.07 12.48 3.43 73 XMNumbers 12739 3.23 2.81 3.40 74 RCVD_IN_IADB_LISTED 12391 2.70 1.22 3.31 75 RELAYCOUNTRY_META 12362 8.82 22.22 3.30 76 XMSubMetaSx_00 12253 4.03 5.87 3.27 77 MIME_QP_LONG_LINE 12236 2.76 1.52 3.27 78 BAYES_20 12046 2.66 1.33 3.22 79 TR_DCC_Bayes_99 11488 12.78 36.35 3.07 80 FROM_EXCESS_BASE64 10968 2.93 2.93 2.93 81 RCVD_IN_IADB_SPF 10740 2.35 1.10 2.87 82 XM_PDF 10686 2.13 0.38 2.85 83 HTML_IMAGE_RATIO_06 10495 3.71 5.90 2.80 84 T_REMOTE_IMAGE 10198 2.60 2.30 2.72 85 MIME_HTML_MOSTLY 10144 4.47 8.75 2.71 86 T_TooManySym_02 9975 2.04 0.54 2.66 87 BAYES_95 9720 3.37 5.26 2.59 88 TR_XM_SB_Phish 9664 2.35 1.80 2.58 89 XMSubPhish11 9626 2.34 1.78 2.57 90 RCVD_IN_IADB_SENDERID 9586 2.11 1.01 2.56 91 RCVD_IN_IADB_DK 9290 2.06 1.03 2.48 92 XMSubNoVowel 8888 2.48 2.74 2.37 93 TR_XM_PhishingBody 8547 2.62 3.44 2.28 94 INVALID_MSGID 8232 1.68 0.43 2.20 95 MSGID_NOFQDN1 7842 1.49 0.03 2.09 96 XM_B_SpammyTLD 7829 2.24 2.61 2.09 97 DKIM_INVALID 7599 2.46 3.51 2.03 98 RCVD_IN_IADB_VOUCHED 7509 1.56 0.48 2.00 99 RCVD_IN_MSPIKE_H5 7393 1.66 0.91 1.97 100 HTML_IMAGE_RATIO_08 7126 2.53 4.05 1.90 101 URI_NOVOWEL 7101 1.61 0.93 1.90 102 TVD_RCVD_IP 6892 1.41 0.38 1.84 103 TO_MALFORMED 6842 1.32 0.10 1.83 104 XM_CamelCaseFrm001 6366 1.79 2.00 1.70 105 MAILING_LIST_MULTI 6278 1.42 0.80 1.68 106 UNTRUSTED_Relay 6105 5.07 13.42 1.63 107 T_XMDrugObfuBody_14 5950 1.46 1.15 1.59 108 TR_Symld_Words 5887 1.70 2.01 1.57 109 T_FONT_INVIS_NAKED_TO 5861 2.45 4.61 1.56 110 HELO_MISC_IP 5675 1.21 0.48 1.51 111 CK_HELO_DYNAMIC_SPLIT_IP 5670 1.30 0.77 1.51 112 BOTNET 5471 6.14 17.49 1.46 113 T_XMDrugObfuBody_08 5376 2.38 4.66 1.43 114 TR_XM_SpammyWords2 5216 6.49 18.84 1.39 115 IN_HORDE_ADDRESS_BOOK 5156 1.04 0.23 1.38 116 URI_TRY_3LD 5003 2.02 3.69 1.34 117 TR_XM_SpammyWords5 4937 2.23 4.43 1.32 118 XMGappySubj_01 4914 1.07 0.48 1.31 119 USER_IN_DEF_DKIM_WL 4887 0.92 0.00 1.30 120 XM_DK_Undo_01 4881 1.42 1.69 1.30 121 RCVD_IN_IADB_OPTIN 4880 1.04 0.41 1.30 122 HTML_FONT_FACE_BAD 4844 1.12 0.71 1.29 123 XMBdyGiftCard01 4776 1.40 1.70 1.27 124 HTML_MIME_NO_HTML_TAG 4647 1.35 1.62 1.24 125 XMBSHREFv2 4633 0.94 0.21 1.24 126 RELAYCOUNTRY_CA 4555 3.15 7.84 1.22 127 XMStockSpam_06 4364 1.20 1.28 1.16 128 XM_SPF_SoftFail 4155 1.82 3.54 1.11 129 XMDiploma_00 4136 1.41 2.16 1.10 130 XM_B_Unsub2 4051 1.31 1.86 1.08 131 TooManyTo_002 3997 0.86 0.36 1.07 132 XM_B_Phish66 3965 1.20 1.56 1.06 133 T_TooManySym_03 3959 0.78 0.10 1.06 134 TM2_M_VERY_LONG_WORD 3855 1.44 2.45 1.03 135 XM_OfRef6 3818 2.10 4.71 1.02 136 PDS_OTHER_BAD_TLD 3790 1.20 1.67 1.01 137 XMBody_17 3766 2.58 6.40 1.01 138 URI_HEX 3761 1.58 2.96 1.00 139 TR_MSPIKEBAYES00 3696 0.71 0.03 0.99 140 SUBJ_ALL_CAPS 3483 1.61 3.25 0.93 141 XM_GoogleGroups 3374 0.75 0.39 0.90 142 KHOP_HELO_FCRDNS 3319 1.07 1.50 0.89 143 XM_H_Long_From02 3242 0.84 0.76 0.87 144 DKIM_ADSP_CUSTOM_MED 3139 0.82 0.77 0.84 145 XMSubEmpty 3082 0.99 1.40 0.82 146 T_OBFU_PDF_ATTACH 3074 0.60 0.06 0.82 147 XMBrknScrpt_02 3048 1.82 4.25 0.81 148 XM_SPF_Unknown 3010 0.75 0.62 0.80 149 XMBody_95 2975 0.58 0.07 0.79 150 TooManyTo_003 2851 0.63 0.30 0.76 151 XMSexyCombo_01 2739 0.92 1.38 0.73 152 XM_UB50 2738 1.98 5.02 0.73 153 DKIM_ADSP_NXDOMAIN 2656 0.72 0.73 0.71 154 T_TooManySym_04 2639 0.51 0.03 0.70 155 XM_RXBody 2634 0.63 0.45 0.70 156 T_XMHurry_00 2548 1.52 3.56 0.68 157 TR_LOTS_OF_MONEY3 2538 1.97 5.11 0.68 158 NO_DNS_FOR_FROM 2528 0.67 0.65 0.67 159 T_FILL_THIS_FORM_SHORT 2501 1.55 3.69 0.67 160 NUMERIC_HTTP_ADDR 2481 0.59 0.43 0.66 161 XMGenDplmaNmb 2361 0.69 0.85 0.63 162 XM_S_SubURI 2335 0.46 0.07 0.62 163 TooManyTo_004 2310 0.52 0.28 0.62 164 XMSubMetaI_00 2307 0.72 0.97 0.62 165 TR_MetaPhish_Combo_01 2283 0.60 0.58 0.61 166 RCVD_IN_BL_SPAMCOP_NET 2235 3.27 9.74 0.60 167 XM_ProductURIs 2150 0.59 0.62 0.57 168 XMPhish08 2134 0.57 0.58 0.57 169 XM_B_SpammyWords4 2082 0.90 1.74 0.56 170 T_TooManySym_05 2080 0.39 0.00 0.56 171 NML_ADSP_CUSTOM_MED 2069 0.59 0.69 0.55 172 SHORTENED_URL_HREF 2046 0.66 0.93 0.55 173 RDNS_DYNAMIC 2045 0.70 1.06 0.55 174 TooManyTo_005 2030 0.46 0.24 0.54 175 PLING_QUERY 2011 0.63 0.85 0.54 176 FROM_GOV_DKIM_AU 1893 0.47 0.39 0.51 177 RELAYCOUNTRY_GB 1888 0.66 1.03 0.50 178 FORGED_GMAIL_RCVD 1835 0.51 0.56 0.49 179 XM_E_Blogspot 1826 0.38 0.10 0.49 180 XMSubMetaSxObfu_02 1801 0.40 0.21 0.48 181 XM_B_REG_HTML 1742 0.43 0.33 0.46 182 XMSubMetaSxObfu_03 1694 0.69 1.27 0.45 183 HTML_TAG_BALANCE_BODY 1633 0.67 1.24 0.44 184 XM_B_COPY_HTML 1604 0.41 0.36 0.43 185 HTML_IMAGE_ONLY_20 1567 0.35 0.18 0.42 186 USER_IN_WHITELIST 1552 0.29 0.00 0.41 187 USER_IN_WELCOMELIST 1552 0.29 0.00 0.41 188 T_XMDrugObfuBody_00 1549 0.63 1.16 0.41 189 HTTPS_HTTP_MISMATCH 1493 0.42 0.47 0.40 190 XMBody_78 1480 0.61 1.15 0.40 191 SUBJ_DOLLARS 1447 0.46 0.66 0.39 192 SpammyFromTLD_01 1426 2.00 5.92 0.38 193 SENDGRID_REDIR 1420 0.51 0.81 0.38 194 T_Symld_Words_02 1415 0.79 1.78 0.38 195 XM_B_COVIDMETA 1405 0.54 0.93 0.38 196 HELO_NODOT 1402 0.42 0.52 0.37 197 TVD_SPACE_RATIO 1402 0.81 1.88 0.37 198 HELO_NO_DOMAIN 1401 0.41 0.51 0.37 199 XMHTMLBadTable_001 1380 0.42 0.55 0.37 200 DIET_1 1358 0.57 1.07 0.36 ----------------------------------------------------------------------