Email: 476723 Autolearn: 0 AvgScore: 3.21 AvgScanTime: 1.00 sec Spam: 126032 Autolearn: 0 AvgScore: 14.37 AvgScanTime: 1.27 sec Ham: 350691 Autolearn: 0 AvgScore: -0.80 AvgScanTime: 0.91 sec Time Spent Running SA: 132.88 hours Time Spent Processing Spam: 44.54 hours Time Spent Processing Ham: 88.33 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 121206 68.52 96.17 58.58 2 DKIM_SIGNED 110816 61.38 87.93 51.84 3 XM_DK_Pass 108695 60.42 86.24 51.14 4 DKIM_VALID 107080 59.30 84.96 50.08 5 DCC_CHECK 102321 43.20 81.19 29.55 6 XM_B_Unicode 101598 57.12 80.61 48.68 7 XMListUnsubscribeExists 95244 45.94 75.57 35.29 8 RELAYCOUNTRY_US 93636 60.46 74.30 55.49 9 XM_B_SpammyWords 88428 41.42 70.16 31.09 10 DKIM_VALID_AU 86080 48.77 68.30 41.76 11 XM_DK_Undo_02 71165 20.00 56.47 6.90 12 BAYES_99 60390 16.95 47.92 5.82 13 TR_XM_DKIM_Undo 58706 15.83 46.58 4.79 14 XM_B_Unicode3 51558 33.09 40.91 30.28 15 XM_B_SpammyWords2 51180 20.16 40.61 12.82 16 BAYES_999 50916 14.26 40.40 4.87 17 TR_DCC_Bayes_99 49132 12.58 38.98 3.09 18 HTML_FONT_LOW_CONTRAST 45242 25.04 35.90 21.14 19 LOC_TINY_FONT_1 44597 24.19 35.39 20.17 20 MIME_HTML_ONLY 40881 20.65 32.44 16.41 21 RCVD_IN_MSPIKE_H2 39175 21.03 31.08 17.41 22 DKIM_VALID_EF 34440 22.32 27.33 20.53 23 BAYES_50 34241 46.00 27.17 52.76 24 FVGT_m_MULTI_ODD 31952 18.53 25.35 16.08 25 RCVD_IN_MSPIKE_WL 31299 22.77 24.83 22.02 26 T_KAM_HTML_FONT_INVALID 31093 14.49 24.67 10.83 27 RELAYCOUNTRY_META 28784 8.18 22.84 2.91 28 T_TM2_M_HEADER_IN_MSG 25983 17.21 20.62 15.98 29 TR_XM_SpammyWords2 24508 6.12 19.45 1.33 30 XMSubLong 24165 15.01 19.17 13.52 31 XM_Body_Dirty_Words 22728 11.03 18.03 8.51 32 DCC_CHECK_NEGATIVE 22010 55.85 17.46 69.65 33 UNTRUSTED_Relay 18899 4.95 15.00 1.34 34 XM_Multi_Part_URI 18458 22.99 14.65 25.98 35 XM_UncommonTLD01 17498 5.70 13.88 2.76 36 RCVD_IN_MSPIKE_H3 17364 12.44 13.78 11.95 37 BOTNET 17311 4.49 13.74 1.17 38 LOTS_OF_MONEY 17109 6.38 13.58 3.79 39 XM_B_SpammyWords3 16422 5.19 13.03 2.37 40 TR_XM_SpammyWords4 15196 5.04 12.06 2.52 41 XMSexyCombo_05 14405 5.40 11.43 3.24 42 BOTNET_IPINHOSTNAME 13933 5.93 11.06 4.08 43 HTML_IMAGE_RATIO_02 13088 7.02 10.38 5.81 44 FSL_BULK_SIG 13007 6.04 10.32 4.50 45 RCVD_IN_BL_SPAMCOP_NET 13005 3.24 10.32 0.70 46 RCVD_IN_MSPIKE_H4 12951 9.01 10.28 8.56 47 XM_B_Unsub 12633 8.01 10.02 7.28 48 UNPARSEABLE_RELAY 11958 6.89 9.49 5.96 49 BAYES_80 11838 5.17 9.39 3.65 50 TR_XM_UnparsRelay 11825 6.33 9.38 5.24 51 MPART_ALT_DIFF 11711 5.75 9.29 4.48 52 RELAYCOUNTRY_CA 11703 3.15 9.29 0.95 53 XM_Evil_Numbers_Gen 11585 7.17 9.19 6.45 54 LotsOfNums_01 11011 6.34 8.74 5.48 55 URIBL_SBL_A 10343 2.73 8.21 0.77 56 XMSubMetaSx_00 9815 4.11 7.79 2.78 57 XM_B_Phish_Phrases 9672 3.84 7.67 2.46 58 MIME_HTML_MOSTLY 9557 3.62 7.58 2.19 59 RCVD_IN_RP_SAFE 9108 7.53 7.23 7.64 60 BAYES_60 9087 7.49 7.21 7.59 61 XM_OfRef6 8768 2.22 6.96 0.52 62 XM_SendGrid 8189 5.72 6.50 5.44 63 SpammyFromTLD_02 7957 1.73 6.31 0.09 64 XMStrtUSub 7919 5.61 6.28 5.36 65 XM_H_Long_From01 7713 4.25 6.12 3.58 66 TR_XM_MaxBayes 7710 1.64 6.12 0.03 67 TooManyTo_001 7368 4.93 5.85 4.59 68 KHOP_HELO_FCRDNS 6902 1.97 5.48 0.71 69 TR_XM_SpammyWords5 6815 2.38 5.41 1.29 70 TR_LOTS_OF_MONEY3 6764 1.56 5.37 0.19 71 T_FILL_THIS_FORM_SHORT 6749 1.65 5.35 0.31 72 XM_DK_Undo_01 6712 2.13 5.33 0.98 73 RCVD_IN_RP_CERTIFIED 6692 6.40 5.31 6.79 74 BAYES_95 6686 3.11 5.31 2.32 75 HTML_IMAGE_RATIO_04 6203 4.93 4.92 4.93 76 SpammyFromTLD_01 6046 1.50 4.80 0.32 77 TR_XM_PhishingBody 5983 2.20 4.75 1.28 78 XM_UB99 5811 1.22 4.61 0.00 79 XMNumbers 5686 3.25 4.51 2.79 80 HTML_FONT_SIZE_LARGE 5028 1.16 3.99 0.15 81 HTML_SHORT_LINK_IMG_1 5022 1.06 3.98 0.01 82 XMBdyGiftCard01 5011 1.51 3.98 0.63 83 TR_XM_FormFill 5002 1.06 3.97 0.01 84 TR_XM_DK_SendGrid 4983 3.65 3.95 3.54 85 XM_UB50 4829 1.65 3.83 0.87 86 FROM_EXCESS_BASE64 4768 2.99 3.78 2.70 87 XMDiploma_00 4714 2.04 3.74 1.43 88 HTML_IMAGE_ONLY_12 4689 1.05 3.72 0.09 89 BODY_URI_ONLY 4655 0.98 3.69 0.00 90 RCVD_IN_MSPIKE_BL 4559 1.11 3.62 0.21 91 RELAYCOUNTRY_FR 4529 1.08 3.59 0.17 92 TR_XM_MSPIKECOMBO 4524 1.10 3.59 0.20 93 XMBody_17 4483 1.27 3.56 0.45 94 SUBJ_ALL_CAPS 4473 1.48 3.55 0.74 95 XM_UB999 4466 0.94 3.54 0.00 96 T_XMHurry_00 4126 1.17 3.27 0.42 97 HTML_IMAGE_RATIO_08 4050 2.27 3.21 1.93 98 T_TooManySym_01 4018 3.82 3.19 4.04 99 XM_B_SpammyTLD 3989 1.94 3.17 1.49 100 XMBrknScrpt_02 3915 1.25 3.11 0.58 101 URI_HEX 3895 1.49 3.09 0.92 102 TM2_M_URI_OPT_OUT 3858 26.58 3.06 35.04 103 DKIM_INVALID 3736 2.08 2.96 1.77 104 DIET_1 3733 1.16 2.96 0.52 105 TR_XM_BayesRelay 3558 0.76 2.82 0.02 106 XM_B_SpammyWords4 3555 0.95 2.82 0.27 107 HTML_IMAGE_RATIO_06 3529 2.94 2.80 2.99 108 RCVD_IN_PSBL 3345 0.77 2.65 0.09 109 RCVD_IN_RP_RNBL 3301 0.73 2.62 0.05 110 XM_SPF_SoftFail 3286 1.25 2.61 0.76 111 XM_DIRTYINTL 3263 0.85 2.59 0.23 112 XM_UB80 3173 0.69 2.52 0.03 113 RCVD_IN_MSPIKE_L5 3163 0.78 2.51 0.16 114 XM_CamelCaseFrm001 3134 1.53 2.49 1.19 115 FONT_INVIS_LONG_LINE 3088 0.73 2.45 0.11 116 TR_XM_SpammyWords3 2902 0.73 2.30 0.17 117 BOTNET_NORDNS 2790 0.59 2.21 0.01 118 HK_RANDOM_REPLYTO 2771 0.64 2.20 0.08 119 T_XMDrugObfuBody_14 2728 2.34 2.16 2.41 120 MIME_HTML_ONLY_MULTI 2699 2.80 2.14 3.04 121 PDS_OTHER_BAD_TLD 2695 1.04 2.14 0.65 122 XM_UB60 2639 0.66 2.09 0.14 123 TR_Caps_n_Bayes_99 2622 0.58 2.08 0.04 124 XM_B_Unsub2 2428 1.00 1.93 0.66 125 TM2_M_VERY_LONG_WORD 2370 1.40 1.88 1.23 126 T_REMOTE_IMAGE 2358 2.03 1.87 2.09 127 XMGenDplmaNmb 2277 0.96 1.81 0.65 128 MIME_QP_LONG_LINE 2252 2.22 1.79 2.38 129 T_XMDrugObfuBody_08 2246 1.02 1.78 0.75 130 XM_B_Phish66 2203 0.96 1.75 0.68 131 URIBL_DBL_SPAM 2131 0.45 1.69 0.01 132 RELAYCOUNTRY_DE 2053 0.68 1.63 0.33 133 XMPhish08 2013 0.50 1.60 0.11 134 RELAYCOUNTRY_IN 1976 0.45 1.57 0.05 135 URI_TRY_3LD 1974 1.01 1.57 0.81 136 URI_PHP_REDIR 1963 0.41 1.56 0.00 137 TR_XM_PHPDW 1929 0.58 1.53 0.24 138 FORGED_GMAIL_RCVD 1908 0.72 1.51 0.44 139 XM_B_COVIDMETA 1907 0.78 1.51 0.52 140 NUMERIC_HTTP_ADDR 1872 0.56 1.49 0.23 141 XM_OfRef7 1856 0.43 1.47 0.06 142 XMSexyCombo_01 1855 0.60 1.47 0.29 143 XMStockSpam_06 1829 1.28 1.45 1.22 144 HTML_MIME_NO_HTML_TAG 1824 1.25 1.45 1.17 145 TR_XM_SB_Phish 1748 1.10 1.39 1.00 146 XM_URI_RBL 1717 0.43 1.36 0.10 147 XMSlimDrugH 1711 0.58 1.36 0.30 148 URI_NOVOWEL 1692 1.22 1.34 1.17 149 XM_UB95 1685 0.36 1.34 0.01 150 TR_XM_PHPForged 1684 0.47 1.34 0.16 151 TR_XM_FormFill2 1675 0.47 1.33 0.17 152 XM_H_PHPOS 1656 0.46 1.31 0.16 153 FROM_SUSPICIOUS_NTLD 1651 0.41 1.31 0.08 154 RCVD_IN_IADB_LISTED 1631 1.92 1.29 2.15 155 XMSubPhish11 1614 1.07 1.28 0.99 156 HTML_FONT_SIZE_HUGE 1613 0.50 1.28 0.22 157 FROM_SUSPICIOUS_NTLD_FP 1591 0.39 1.26 0.08 158 XM_Body_Obfu01 1557 0.41 1.24 0.12 159 TR_XM_INV_DKIM 1522 0.36 1.21 0.05 160 T_XMDrugObfuBody_00 1449 12.71 1.15 16.87 161 BAYES_40 1437 2.26 1.14 2.66 162 URIBL_BLACK 1395 0.31 1.11 0.02 163 RCVD_IN_IADB_SPF 1353 1.67 1.07 1.88 164 TR_Mismatch_TLD_02 1338 0.31 1.06 0.04 165 HTTPS_HTTP_MISMATCH 1333 0.57 1.06 0.40 166 XMPhish30 1305 0.48 1.04 0.28 167 GOOGLE_DOC_SUSP 1290 0.27 1.02 0.00 168 XMSubMetaSSx_00 1269 0.34 1.01 0.10 169 RCVD_IN_IADB_DK 1253 1.47 0.99 1.64 170 XMBody_78 1252 0.51 0.99 0.33 171 TR_Symld_Words 1233 0.80 0.98 0.73 172 SUBJ_DOLLARS 1224 0.36 0.97 0.15 173 RCVD_IN_IADB_SENDERID 1220 1.50 0.97 1.69 174 ALL_TRUSTED 1216 31.25 0.96 42.13 175 TR_XM_COVIDMETA4 1173 0.34 0.93 0.13 176 MAILING_LIST_MULTI 1166 1.39 0.93 1.55 177 RCVD_IN_MSPIKE_L3 1163 0.27 0.92 0.03 178 RELAYCOUNTRY_GB 1158 0.58 0.92 0.46 179 XMSubMetaI_00 1139 0.69 0.90 0.61 180 RDNS_DYNAMIC 1131 0.60 0.90 0.49 181 TR_XM_RelayPhish 1100 0.26 0.87 0.04 182 XM_Body_Dirty_Words_01 1100 0.82 0.87 0.80 183 INVALID_MSGID 1079 1.86 0.86 2.22 184 T_HTML_TAG_BALANCE_CENTER 1060 0.38 0.84 0.21 185 XM_H_PHPMailer 1059 0.46 0.84 0.33 186 INVESTMENT_ADVICE 1049 0.26 0.83 0.06 187 XM_BadFromFormat 1034 0.39 0.82 0.23 188 XMSubMetaSxObfu_03 1032 0.59 0.82 0.51 189 XM_Combo_Sbj 1022 0.29 0.81 0.11 190 URI_NO_WWW_BIZ_CGI 1013 0.22 0.80 0.00 191 XMSubNoVowel 1008 0.99 0.80 1.05 192 BAYES_20 1001 1.47 0.79 1.72 193 XMHTMLBadTable_001 991 0.55 0.79 0.46 194 XMSexyCombo_04 988 0.32 0.78 0.15 195 RELAYCOUNTRY_NL 985 0.31 0.78 0.15 196 RCVD_IN_MSPIKE_H5 984 1.32 0.78 1.51 197 LOADSA_MONEY_COMBO 972 0.21 0.77 0.01 198 XMMoneyMeta_00 948 0.30 0.75 0.14 199 HTML_TAG_BALANCE_BODY 944 0.35 0.75 0.21 200 HTML_FONT_FACE_BAD 943 1.54 0.75 1.83 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 244260 55.85 17.46 69.65 2 HTML_MESSAGE 205437 68.52 96.17 58.58 3 RELAYCOUNTRY_US 194611 60.46 74.30 55.49 4 BAYES_50 185041 46.00 27.17 52.76 5 DKIM_SIGNED 181809 61.38 87.93 51.84 6 XM_DK_Pass 179349 60.42 86.24 51.14 7 DKIM_VALID 175619 59.30 84.96 50.08 8 XM_B_Unicode 170703 57.12 80.61 48.68 9 ALL_TRUSTED 147745 31.25 0.96 42.13 10 DKIM_VALID_AU 146440 48.77 68.30 41.76 11 XMListUnsubscribeExists 123744 45.94 75.57 35.29 12 TM2_M_URI_OPT_OUT 122866 26.58 3.06 35.04 13 ANY_BOUNCE_MESSAGE 121718 25.69 0.61 34.71 14 BOUNCE_MESSAGE 121715 25.69 0.61 34.71 15 XM_B_SpammyWords 109028 41.42 70.16 31.09 16 XM_B_Unicode3 106179 33.09 40.91 30.28 17 DCC_CHECK 103633 43.20 81.19 29.55 18 XM_Multi_Part_URI 91122 22.99 14.65 25.98 19 BAYES_00 77745 16.45 0.53 22.17 20 RCVD_IN_MSPIKE_WL 77235 22.77 24.83 22.02 21 HTML_FONT_LOW_CONTRAST 74136 25.04 35.90 21.14 22 DKIM_VALID_EF 71985 22.32 27.33 20.53 23 LOC_TINY_FONT_1 70739 24.19 35.39 20.17 24 RCVD_IN_MSPIKE_H2 61066 21.03 31.08 17.41 25 T_XMDrugObfuBody_00 59163 12.71 1.15 16.87 26 MIME_HTML_ONLY 57549 20.65 32.44 16.41 27 FVGT_m_MULTI_ODD 56392 18.53 25.35 16.08 28 T_TM2_M_HEADER_IN_MSG 56048 17.21 20.62 15.98 29 XMSubLong 47400 15.01 19.17 13.52 30 XM_B_SpammyWords2 44949 20.16 40.61 12.82 31 RCVD_IN_MSPIKE_H3 41925 12.44 13.78 11.95 32 T_KAM_HTML_FONT_INVALID 37967 14.49 24.67 10.83 33 XM_DKIMWhitelistDomains 31484 6.62 0.05 8.98 34 RCVD_IN_MSPIKE_H4 30021 9.01 10.28 8.56 35 XM_Body_Dirty_Words 29856 11.03 18.03 8.51 36 RCVD_IN_RP_SAFE 26798 7.53 7.23 7.64 37 BAYES_60 26601 7.49 7.21 7.59 38 XM_B_Unsub 25536 8.01 10.02 7.28 39 XM_DK_Undo_02 24197 20.00 56.47 6.90 40 RCVD_IN_RP_CERTIFIED 23814 6.40 5.31 6.79 41 XM_Evil_Numbers_Gen 22615 7.17 9.19 6.45 42 UNPARSEABLE_RELAY 20909 6.89 9.49 5.96 43 BAYES_99 20427 16.95 47.92 5.82 44 HTML_IMAGE_RATIO_02 20392 7.02 10.38 5.81 45 LotsOfNums_01 19230 6.34 8.74 5.48 46 XM_SendGrid 19072 5.72 6.50 5.44 47 XMStrtUSub 18805 5.61 6.28 5.36 48 TR_XM_UnparsRelay 18370 6.33 9.38 5.24 49 HTML_IMAGE_RATIO_04 17289 4.93 4.92 4.93 50 BAYES_999 17077 14.26 40.40 4.87 51 TR_XM_DKIM_Undo 16781 15.83 46.58 4.79 52 TooManyTo_001 16111 4.93 5.85 4.59 53 FSL_BULK_SIG 15784 6.04 10.32 4.50 54 TR_XM_DK_Bayes 15718 3.42 0.46 4.48 55 MPART_ALT_DIFF 15697 5.75 9.29 4.48 56 TR_XM_DK_Bayes1 15490 3.37 0.45 4.42 57 TR_XM_DK_Bayes2 14649 3.19 0.44 4.18 58 BOTNET_IPINHOSTNAME 14318 5.93 11.06 4.08 59 T_TooManySym_01 14170 3.82 3.19 4.04 60 LOTS_OF_MONEY 13290 6.38 13.58 3.79 61 BAYES_80 12785 5.17 9.39 3.65 62 XM_H_Long_From01 12546 4.25 6.12 3.58 63 XM_H_Trusted_IP 12542 2.63 0.00 3.58 64 TR_XM_DK_SendGrid 12406 3.65 3.95 3.54 65 IN_ZIMBRA_NJ_WHITELIST 11739 2.47 0.03 3.35 66 XMSexyCombo_05 11350 5.40 11.43 3.24 67 TR_DCC_Bayes_99 10826 12.58 38.98 3.09 68 MIME_HTML_ONLY_MULTI 10662 2.80 2.14 3.04 69 HTML_IMAGE_RATIO_06 10471 2.94 2.80 2.99 70 RELAYCOUNTRY_META 10203 8.18 22.84 2.91 71 XMNumbers 9786 3.25 4.51 2.79 72 XMSubMetaSx_00 9758 4.11 7.79 2.78 73 XM_UncommonTLD01 9681 5.70 13.88 2.76 74 FROM_EXCESS_BASE64 9466 2.99 3.78 2.70 75 BAYES_40 9315 2.26 1.14 2.66 76 TR_XM_SpammyWords4 8831 5.04 12.06 2.52 77 T_TooManySym_02 8658 1.94 0.46 2.47 78 XM_B_Phish_Phrases 8626 3.84 7.67 2.46 79 T_XMDrugObfuBody_14 8447 2.34 2.16 2.41 80 MIME_QP_LONG_LINE 8341 2.22 1.79 2.38 81 XM_B_SpammyWords3 8327 5.19 13.03 2.37 82 BAYES_95 8119 3.11 5.31 2.32 83 INVALID_MSGID 7783 1.86 0.86 2.22 84 MIME_HTML_MOSTLY 7686 3.62 7.58 2.19 85 RCVD_IN_IADB_LISTED 7524 1.92 1.29 2.15 86 MSGID_NOFQDN1 7484 1.59 0.06 2.13 87 TVD_RCVD_IP 7393 1.57 0.07 2.11 88 T_REMOTE_IMAGE 7323 2.03 1.87 2.09 89 HTML_IMAGE_RATIO_08 6777 2.27 3.21 1.93 90 RCVD_IN_IADB_SPF 6593 1.67 1.07 1.88 91 HTML_FONT_FACE_BAD 6421 1.54 0.75 1.83 92 TO_MALFORMED 6217 1.39 0.34 1.77 93 DKIM_INVALID 6190 2.08 2.96 1.77 94 BAYES_20 6016 1.47 0.79 1.72 95 RCVD_IN_IADB_SENDERID 5927 1.50 0.97 1.69 96 RCVD_IN_IADB_DK 5761 1.47 0.99 1.64 97 MAILING_LIST_MULTI 5437 1.39 0.93 1.55 98 HELO_MISC_IP 5423 1.16 0.08 1.55 99 RCVD_IN_MSPIKE_H5 5289 1.32 0.78 1.51 100 XM_B_SpammyTLD 5239 1.94 3.17 1.49 101 XMDiploma_00 5012 2.04 3.74 1.43 102 UNTRUSTED_Relay 4716 4.95 15.00 1.34 103 TR_XM_SpammyWords2 4669 6.12 19.45 1.33 104 IN_HORDE_ADDRESS_BOOK 4595 0.98 0.07 1.31 105 XM_PDF 4590 1.05 0.33 1.31 106 XMBSHREFv2 4586 0.99 0.12 1.31 107 TR_XM_SpammyWords5 4513 2.38 5.41 1.29 108 TR_XM_PhishingBody 4485 2.20 4.75 1.28 109 USER_IN_DEF_DKIM_WL 4458 0.94 0.00 1.27 110 RCVD_IN_IADB_VOUCHED 4429 1.11 0.67 1.26 111 BAYES_05 4340 1.05 0.51 1.24 112 TM2_M_VERY_LONG_WORD 4325 1.40 1.88 1.23 113 XMStockSpam_06 4267 1.28 1.45 1.22 114 XM_CamelCaseFrm001 4156 1.53 2.49 1.19 115 URI_NOVOWEL 4120 1.22 1.34 1.17 116 HTML_MIME_NO_HTML_TAG 4118 1.25 1.45 1.17 117 BOTNET 4099 4.49 13.74 1.17 118 XMSubNoVowel 3691 0.99 0.80 1.05 119 TR_XM_SB_Phish 3504 1.10 1.39 1.00 120 TooManyTo_002 3488 0.86 0.50 0.99 121 XMSubPhish11 3474 1.07 1.28 0.99 122 XM_DK_Undo_01 3450 2.13 5.33 0.98 123 RELAYCOUNTRY_CA 3333 3.15 9.29 0.95 124 URI_HEX 3230 1.49 3.09 0.92 125 XM_H_Long_From02 3086 0.81 0.63 0.88 126 XM_UB50 3056 1.65 3.83 0.87 127 XM_GoogleGroups 3009 0.74 0.43 0.86 128 XMGappySubj_01 2931 0.64 0.08 0.84 129 RCVD_IN_IADB_OPTIN 2897 0.73 0.48 0.83 130 URI_TRY_3LD 2827 1.01 1.57 0.81 131 DKIM_ADSP_CUSTOM_MED 2798 0.73 0.55 0.80 132 XM_Body_Dirty_Words_01 2789 0.82 0.87 0.80 133 TVD_SPACE_RATIO 2713 0.59 0.06 0.77 134 URIBL_SBL_A 2695 2.73 8.21 0.77 135 XM_SPF_SoftFail 2672 1.25 2.61 0.76 136 T_XMDrugObfuBody_08 2627 1.02 1.78 0.75 137 SUBJ_ALL_CAPS 2604 1.48 3.55 0.74 138 TR_Symld_Words 2562 0.80 0.98 0.73 139 XMBody_95 2560 0.57 0.13 0.73 140 XM_RXBody 2500 0.65 0.48 0.71 141 KHOP_HELO_FCRDNS 2486 1.97 5.48 0.71 142 TooManyTo_003 2464 0.63 0.44 0.70 143 TR_MSPIKEBAYES00 2456 0.52 0.04 0.70 144 RCVD_IN_BL_SPAMCOP_NET 2449 3.24 10.32 0.70 145 XM_B_Phish66 2377 0.96 1.75 0.68 146 XM_B_Unsub2 2321 1.00 1.93 0.66 147 XMGenDplmaNmb 2282 0.96 1.81 0.65 148 PDS_OTHER_BAD_TLD 2273 1.04 2.14 0.65 149 T_TooManySym_03 2228 0.51 0.15 0.64 150 XMBdyGiftCard01 2202 1.51 3.98 0.63 151 XMSubMetaI_00 2147 0.69 0.90 0.61 152 XM_ProductURIs 2127 0.63 0.68 0.61 153 HTML_IMAGE_ONLY_20 2126 0.48 0.13 0.61 154 TooManyTo_004 2040 0.54 0.42 0.58 155 XMBrknScrpt_02 2022 1.25 3.11 0.58 156 T_MANY_PILL_PRICE 1942 0.42 0.03 0.55 157 XM_B_COVIDMETA 1834 0.78 1.51 0.52 158 XM_OfRef6 1818 2.22 6.96 0.52 159 DIET_1 1815 1.16 2.96 0.52 160 XMSubMetaSxObfu_03 1804 0.59 0.82 0.51 161 TooManyTo_005 1779 0.47 0.38 0.51 162 RDNS_DYNAMIC 1715 0.60 0.90 0.49 163 NML_ADSP_CUSTOM_MED 1644 0.47 0.47 0.47 164 XMHTMLBadTable_001 1629 0.55 0.79 0.46 165 USER_IN_WHITELIST 1624 0.34 0.00 0.46 166 USER_IN_WELCOMELIST 1624 0.34 0.00 0.46 167 XMSubMetaSxObfu_02 1620 0.45 0.41 0.46 168 RELAYCOUNTRY_GB 1608 0.58 0.92 0.46 169 XMBody_17 1580 1.27 3.56 0.45 170 XM_B_REG_HTML 1569 0.45 0.47 0.45 171 FORGED_GMAIL_RCVD 1543 0.72 1.51 0.44 172 XMHTML_After_End 1535 0.51 0.71 0.44 173 HELO_NO_DOMAIN 1495 0.44 0.48 0.43 174 HELO_NODOT 1495 0.45 0.52 0.43 175 TR_MetaPhish_Combo_01 1486 0.43 0.45 0.42 176 T_XMHurry_00 1466 1.17 3.27 0.42 177 HTTPS_HTTP_MISMATCH 1394 0.57 1.06 0.40 178 XM_B_COPY_HTML 1364 0.45 0.62 0.39 179 TVD_SPACE_RATIO_MINFP 1330 0.36 0.29 0.38 180 XMBody_78 1171 0.51 0.99 0.33 181 RELAYCOUNTRY_DE 1168 0.68 1.63 0.33 182 XM_H_PHPMailer 1144 0.46 0.84 0.33 183 SpammyFromTLD_01 1114 1.50 4.80 0.32 184 T_FILL_THIS_FORM_SHORT 1095 1.65 5.35 0.31 185 XMCapTrack 1087 0.27 0.16 0.31 186 XMLngstWrd_00 1073 0.41 0.68 0.31 187 SHOPIFY_IMG_NOT_RCVD_SFY 1068 0.39 0.65 0.30 188 XMSlimDrugH 1058 0.58 1.36 0.30 189 PLING_QUERY 1045 0.36 0.53 0.30 190 T_TooManySym_04 1026 0.23 0.06 0.29 191 XMSexyCombo_01 1006 0.60 1.47 0.29 192 XMPhish30 984 0.48 1.04 0.28 193 XM_B_SpammyWords4 964 0.95 2.82 0.27 194 MPART_ALT_DIFF_COUNT 959 0.34 0.52 0.27 195 XMLngstWrd_01 953 0.37 0.66 0.27 196 XM_ShortIntro_01 927 0.28 0.32 0.26 197 FILL_THIS_FORM 898 0.32 0.52 0.26 198 XMNoVowels 854 0.26 0.30 0.24 199 XM_Akamai 852 0.19 0.03 0.24 200 BASE64_LENGTH_79_INF 837 0.20 0.09 0.24 ----------------------------------------------------------------------