Email: 298032 Autolearn: 0 AvgScore: 3.14 AvgScanTime: 1.15 sec Spam: 86252 Autolearn: 0 AvgScore: 14.15 AvgScanTime: 1.43 sec Ham: 211780 Autolearn: 0 AvgScore: -1.34 AvgScanTime: 1.03 sec Time Spent Running SA: 94.98 hours Time Spent Processing Spam: 34.25 hours Time Spent Processing Ham: 60.73 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 80905 84.33 93.80 80.47 2 DKIM_SIGNED 73796 77.96 85.56 74.87 3 XM_DK_Pass 72565 76.79 84.13 73.81 4 DKIM_VALID 71003 75.21 82.32 72.32 5 XM_B_Unicode 67283 69.55 78.01 66.11 6 RELAYCOUNTRY_US 65999 78.27 76.52 78.98 7 DCC_CHECK 65906 53.36 76.41 43.97 8 XMListUnsubscribeExists 61033 52.87 70.76 45.58 9 XM_B_SpammyWords 58765 51.24 68.13 44.36 10 DKIM_VALID_AU 53960 59.31 62.56 57.98 11 XM_DK_Undo_02 44074 20.66 51.10 8.27 12 XM_B_Unicode3 39258 41.66 45.52 40.09 13 XM_B_SpammyWords2 35512 24.34 41.17 17.48 14 BAYES_99 34224 16.62 39.68 7.23 15 TR_XM_DKIM_Undo 33799 15.20 39.19 5.43 16 LOC_TINY_FONT_1 32258 28.46 37.40 24.82 17 BAYES_50 30934 49.92 35.86 55.64 18 MIME_HTML_ONLY 28129 24.99 32.61 21.88 19 HTML_FONT_LOW_CONTRAST 27891 29.21 32.34 27.94 20 BAYES_999 27172 13.24 31.50 5.80 21 DKIM_VALID_EF 26733 32.53 30.99 33.15 22 TR_DCC_Bayes_99 25483 10.76 29.54 3.11 23 FVGT_m_MULTI_ODD 22549 22.98 26.14 21.69 24 T_KAM_HTML_FONT_INVALID 21696 18.06 25.15 15.18 25 XM_Body_Dirty_Words 21452 15.18 24.87 11.23 26 RCVD_IN_MSPIKE_WL 21184 31.97 24.56 34.98 27 RCVD_IN_MSPIKE_H2 20916 22.85 24.25 22.28 28 T_TM2_M_HEADER_IN_MSG 20003 24.46 23.19 24.98 29 XMSubLong 19982 22.50 23.17 22.23 30 RELAYCOUNTRY_META 19723 9.61 22.87 4.22 31 DCC_CHECK_NEGATIVE 18519 44.97 21.47 54.54 32 BOTNET 15664 6.21 18.16 1.34 33 TR_XM_SpammyWords2 14029 5.56 16.27 1.20 34 XM_Multi_Part_URI 13274 12.87 15.39 11.84 35 XMSexyCombo_05 11908 7.12 13.81 4.39 36 XM_B_Unsub 11841 12.19 13.73 11.56 37 LOTS_OF_MONEY 11835 8.75 13.72 6.72 38 UNTRUSTED_Relay 11629 5.28 13.48 1.94 39 BOTNET_IPINHOSTNAME 11609 7.58 13.46 5.19 40 XM_B_SpammyWords3 11450 6.33 13.28 3.50 41 RCVD_IN_MSPIKE_H3 11274 15.80 13.07 16.91 42 FSL_BULK_SIG 11239 10.50 13.03 9.48 43 TR_XM_SpammyWords4 10255 6.02 11.89 3.63 44 XM_UncommonTLD01 10244 6.48 11.88 4.28 45 UNPARSEABLE_RELAY 9691 9.66 11.24 9.01 46 TR_XM_UnparsRelay 9354 8.33 10.84 7.31 47 XM_Evil_Numbers_Gen 8934 9.63 10.36 9.33 48 RCVD_IN_MSPIKE_H4 8891 12.36 10.31 13.19 49 MPART_ALT_DIFF 8883 6.49 10.30 4.94 50 HTML_IMAGE_RATIO_02 8820 7.78 10.23 6.79 51 RCVD_IN_BL_SPAMCOP_NET 8590 3.24 9.96 0.50 52 BAYES_80 7646 6.58 8.86 5.66 53 LotsOfNums_01 7585 8.24 8.79 8.02 54 TR_XM_PhishingBody 7359 4.03 8.53 2.19 55 HTML_IMAGE_RATIO_04 7280 6.68 8.44 5.96 56 MIME_HTML_MOSTLY 7083 4.32 8.21 2.74 57 RELAYCOUNTRY_CA 6876 3.25 7.97 1.32 58 XM_SendGrid 6731 8.00 7.80 8.08 59 XM_B_Phish_Phrases 6347 7.44 7.36 7.47 60 RCVD_IN_MSPIKE_BL 5862 2.10 6.80 0.19 61 TR_XM_MSPIKECOMBO 5858 2.09 6.79 0.18 62 BAYES_60 5814 10.01 6.74 11.34 63 XMSubMetaSx_00 5672 5.43 6.58 4.96 64 RCVD_IN_RP_SAFE 5618 8.13 6.51 8.78 65 XM_H_Long_From01 5244 5.14 6.08 4.76 66 XM_B_Phish66 4880 2.41 5.66 1.09 67 XM_DIRTYINTL 4784 1.82 5.55 0.30 68 SpammyFromTLD_01 4697 1.87 5.45 0.42 69 TooManyTo_001 4609 6.57 5.34 7.07 70 BAYES_95 4336 3.78 5.03 3.28 71 RCVD_IN_RP_CERTIFIED 4328 7.06 5.02 7.89 72 TR_XM_DK_SendGrid 4225 5.14 4.90 5.24 73 XM_UB50 4059 2.37 4.71 1.42 74 RCVD_IN_PSBL 3874 1.39 4.49 0.13 75 XM_B_SpammyTLD 3731 2.50 4.33 1.76 76 TR_XM_SpammyWords5 3632 2.12 4.21 1.26 77 T_REMOTE_IMAGE 3549 3.71 4.11 3.55 78 XMStrtUSub 3324 7.20 3.85 8.57 79 XM_SPF_SoftFail 3254 1.96 3.77 1.23 80 TM2_M_URI_OPT_OUT 3213 3.46 3.73 3.35 81 SpammyFromTLD_02 3200 1.18 3.71 0.15 82 XMNumbers 3118 3.70 3.61 3.74 83 XM_UB99 3048 1.02 3.53 0.00 84 HTML_IMAGE_RATIO_06 3028 3.43 3.51 3.40 85 RCVD_IN_MSPIKE_L4 3022 1.04 3.50 0.03 86 MIME_HTML_ONLY_MULTI 3003 3.02 3.48 2.83 87 T_XMDrugObfuBody_14 2978 2.80 3.45 2.53 88 DKIM_INVALID 2793 2.75 3.24 2.55 89 XM_DrugUnitList 2756 0.93 3.20 0.00 90 URIBL_SBL_A 2672 0.99 3.10 0.13 91 XMBdyGiftCard01 2614 1.29 3.03 0.58 92 RCVD_IN_RP_RNBL 2608 0.89 3.02 0.03 93 XM_CamelCaseFrm001 2545 2.04 2.95 1.66 94 XM_OfRef6 2540 1.56 2.94 0.99 95 FROM_EXCESS_BASE64 2524 3.32 2.93 3.49 96 TR_Symld_Words 2520 2.57 2.92 2.42 97 RELAYCOUNTRY_FR 2422 1.03 2.81 0.31 98 XMBrknScrpt_02 2387 1.42 2.77 0.87 99 HTML_IMAGE_ONLY_20 2385 1.73 2.77 1.31 100 TR_XM_SpammyWords3 2370 0.88 2.75 0.12 101 TR_XM_PhishingBody3 2351 0.79 2.73 0.00 102 RELAYCOUNTRY_IN 2211 0.84 2.56 0.14 103 XMBody_17 2198 1.31 2.55 0.81 104 HTML_IMAGE_RATIO_08 2081 1.93 2.41 1.74 105 RCVD_IN_MSPIKE_L5 2068 0.73 2.40 0.05 106 SUBJ_ALL_CAPS 2065 1.51 2.39 1.15 107 URIBL_DBL_SPAM 2060 0.69 2.39 0.00 108 XM_UB999 2038 0.68 2.36 0.00 109 KHOP_HELO_FCRDNS 1991 1.56 2.31 1.26 110 XMSexyCombo_01 1977 1.75 2.29 1.53 111 T_TooManySym_01 1928 6.20 2.24 7.82 112 TR_XM_BayesRelay 1924 0.67 2.23 0.03 113 TM2_M_VERY_LONG_WORD 1922 1.55 2.23 1.28 114 URI_NO_WWW_BIZ_CGI 1912 0.64 2.22 0.00 115 XM_B_SpammyWords4 1908 0.82 2.21 0.25 116 XMDiploma_00 1865 1.65 2.16 1.44 117 TR_XM_PHPDW 1864 0.88 2.16 0.36 118 BOTNET_NORDNS 1854 0.63 2.15 0.01 119 URI_HEX 1825 1.33 2.12 1.01 120 XM_B_COVIDMETA 1822 1.21 2.11 0.84 121 MIME_QP_LONG_LINE 1805 3.65 2.09 4.28 122 T_FILL_THIS_FORM_SHORT 1719 0.95 1.99 0.53 123 XM_UB80 1679 0.59 1.95 0.04 124 T_XMDrugObfuBody_08 1665 1.35 1.93 1.11 125 TR_XM_PHPForged 1617 0.75 1.87 0.29 126 TR_XM_FormFill2 1598 0.75 1.85 0.30 127 XM_H_PHPOS 1592 0.74 1.85 0.29 128 XM_DK_Undo_01 1564 1.62 1.81 1.54 129 XM_B_Unsub2 1507 1.64 1.75 1.59 130 T_XMHurry_00 1503 0.81 1.74 0.43 131 TR_XM_MaxBayes 1451 0.49 1.68 0.00 132 URI_PHP_REDIR 1451 0.49 1.68 0.00 133 MONEY_NOHTML 1434 0.54 1.66 0.09 134 XMSlimDrugH 1416 0.68 1.64 0.29 135 XM_UB60 1414 0.58 1.64 0.15 136 TR_LOTS_OF_MONEY3 1398 0.60 1.62 0.18 137 TR_XM_SB_Phish 1395 2.04 1.62 2.22 138 XMSubPhish11 1390 2.04 1.61 2.21 139 TR_Mismatch_TLD_01 1375 0.72 1.59 0.36 140 T_XMDrugObfuBody_00 1366 0.89 1.58 0.61 141 HTML_MIME_NO_HTML_TAG 1358 2.24 1.57 2.51 142 RCVD_IN_IADB_LISTED 1355 3.62 1.57 4.45 143 XMStockSpam_06 1347 1.61 1.56 1.63 144 XM_Body_Dirty_Words_01 1274 0.55 1.48 0.17 145 XM_URI_RBL 1239 0.53 1.44 0.17 146 TR_Mismatch_TLD_02 1235 0.47 1.43 0.07 147 URIBL_BLACK 1208 0.42 1.40 0.03 148 PDS_OTHER_BAD_TLD 1194 0.69 1.38 0.41 149 RCVD_IN_IADB_SPF 1180 3.13 1.37 3.85 150 MAILING_LIST_MULTI 1175 2.05 1.36 2.33 151 BAYES_40 1149 3.19 1.33 3.95 152 URI_TRY_3LD 1148 1.12 1.33 1.04 153 T_Symld_Words_02 1132 0.55 1.31 0.24 154 SUBJ_DOLLARS 1130 0.59 1.31 0.29 155 RELAYCOUNTRY_GB 1129 0.83 1.31 0.63 156 RCVD_IN_IADB_DK 1115 2.71 1.29 3.29 157 XMSexyCombo_04 1104 1.04 1.28 0.94 158 RCVD_IN_IADB_SENDERID 1100 2.79 1.28 3.40 159 XMPhish08 1087 0.51 1.26 0.21 160 FROM_SUSPICIOUS_NTLD 1070 0.39 1.24 0.05 161 RELAYCOUNTRY_DE 1058 0.79 1.23 0.61 162 DIET_1 1051 0.72 1.22 0.52 163 XM_UB95 1051 0.37 1.22 0.02 164 DATE_IN_PAST_03_06 1044 0.74 1.21 0.54 165 XMGenDplmaNmb 1029 0.82 1.19 0.67 166 RCVD_IN_MSPIKE_H5 1019 3.81 1.18 4.89 167 FROM_SUSPICIOUS_NTLD_FP 1014 0.37 1.18 0.04 168 TR_XM_INV_DKIM 1009 0.43 1.17 0.13 169 BAYES_20 1002 2.95 1.16 3.68 170 XM_H_PHPMailer 1001 0.74 1.16 0.56 171 XMPhish30 1000 0.73 1.16 0.55 172 ALL_TRUSTED 999 12.89 1.16 17.66 173 XMGppyBdWords 989 0.38 1.15 0.07 174 URI_NOVOWEL 979 2.04 1.14 2.41 175 XMSubMetaI_00 924 0.68 1.07 0.53 176 XM_RXBody 907 0.44 1.05 0.19 177 TR_XM_COVIDMETA4 905 0.48 1.05 0.24 178 T_HTML_TAG_BALANCE_CENTER 867 0.58 1.01 0.40 179 HTML_FONT_SIZE_HUGE 862 0.54 1.00 0.35 180 HK_RANDOM_REPLYTO 856 0.42 0.99 0.19 181 HTML_IMAGE_ONLY_32 837 0.45 0.97 0.24 182 PLING_QUERY 835 0.88 0.97 0.84 183 NUMERIC_HTTP_ADDR 833 0.53 0.97 0.36 184 XMBody_78 829 0.47 0.96 0.26 185 XM_B_COPY_HTML 817 0.71 0.95 0.61 186 FROM_MISSP_REPLYTO 817 0.28 0.95 0.00 187 XMReplyNow 813 0.33 0.94 0.07 188 XMHTML_After_End 792 0.93 0.92 0.94 189 XM_SPF_Unknown 786 0.48 0.91 0.31 190 HTML_FONT_FACE_BAD 780 1.07 0.90 1.13 191 HTML_TAG_BALANCE_BODY 777 0.78 0.90 0.73 192 RCVD_IN_MSPIKE_L3 768 0.33 0.89 0.10 193 XMNoVowels 762 0.61 0.88 0.49 194 XM_Lotto 761 0.28 0.88 0.04 195 XMSubMetaSSx_00 755 0.37 0.88 0.16 196 RELAYCOUNTRY_NG 752 0.25 0.87 0.00 197 XM_BadFromFormat 748 0.54 0.87 0.41 198 TR_XM_COVIDMETA1 741 0.33 0.86 0.12 199 HTTPS_HTTP_MISMATCH 729 0.62 0.85 0.53 200 MPART_ALT_DIFF_COUNT 724 0.47 0.84 0.32 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 170418 84.33 93.80 80.47 2 RELAYCOUNTRY_US 167257 78.27 76.52 78.98 3 DKIM_SIGNED 158554 77.96 85.56 74.87 4 XM_DK_Pass 156307 76.79 84.13 73.81 5 DKIM_VALID 153152 75.21 82.32 72.32 6 XM_B_Unicode 139999 69.55 78.01 66.11 7 DKIM_VALID_AU 122797 59.31 62.56 57.98 8 BAYES_50 117829 49.92 35.86 55.64 9 DCC_CHECK_NEGATIVE 115508 44.97 21.47 54.54 10 XMListUnsubscribeExists 96532 52.87 70.76 45.58 11 XM_B_SpammyWords 93953 51.24 68.13 44.36 12 DCC_CHECK 93125 53.36 76.41 43.97 13 XM_B_Unicode3 84909 41.66 45.52 40.09 14 RCVD_IN_MSPIKE_WL 74087 31.97 24.56 34.98 15 DKIM_VALID_EF 70204 32.53 30.99 33.15 16 HTML_FONT_LOW_CONTRAST 59167 29.21 32.34 27.94 17 T_TM2_M_HEADER_IN_MSG 52905 24.46 23.19 24.98 18 LOC_TINY_FONT_1 52568 28.46 37.40 24.82 19 RCVD_IN_MSPIKE_H2 47176 22.85 24.25 22.28 20 XMSubLong 47084 22.50 23.17 22.23 21 MIME_HTML_ONLY 46339 24.99 32.61 21.88 22 FVGT_m_MULTI_ODD 45927 22.98 26.14 21.69 23 ALL_TRUSTED 37406 12.89 1.16 17.66 24 XM_B_SpammyWords2 37018 24.34 41.17 17.48 25 RCVD_IN_MSPIKE_H3 35806 15.80 13.07 16.91 26 T_KAM_HTML_FONT_INVALID 32143 18.06 25.15 15.18 27 XM_DKIMWhitelistDomains 31519 10.61 0.11 14.88 28 RCVD_IN_MSPIKE_H4 27932 12.36 10.31 13.19 29 XM_Multi_Part_URI 25075 12.87 15.39 11.84 30 XM_B_Unsub 24482 12.19 13.73 11.56 31 BAYES_60 24023 10.01 6.74 11.34 32 XM_Body_Dirty_Words 23793 15.18 24.87 11.23 33 FSL_BULK_SIG 20067 10.50 13.03 9.48 34 XM_Evil_Numbers_Gen 19753 9.63 10.36 9.33 35 UNPARSEABLE_RELAY 19088 9.66 11.24 9.01 36 RCVD_IN_RP_SAFE 18602 8.13 6.51 8.78 37 XMStrtUSub 18141 7.20 3.85 8.57 38 XM_DK_Undo_02 17510 20.66 51.10 8.27 39 XM_SendGrid 17112 8.00 7.80 8.08 40 LotsOfNums_01 16981 8.24 8.79 8.02 41 RCVD_IN_RP_CERTIFIED 16699 7.06 5.02 7.89 42 T_TooManySym_01 16553 6.20 2.24 7.82 43 BAYES_00 16336 5.69 0.73 7.71 44 XM_B_Phish_Phrases 15815 7.44 7.36 7.47 45 TR_XM_UnparsRelay 15473 8.33 10.84 7.31 46 BAYES_99 15320 16.62 39.68 7.23 47 TooManyTo_001 14981 6.57 5.34 7.07 48 HTML_IMAGE_RATIO_02 14371 7.78 10.23 6.79 49 LOTS_OF_MONEY 14242 8.75 13.72 6.72 50 HTML_IMAGE_RATIO_04 12621 6.68 8.44 5.96 51 BAYES_999 12273 13.24 31.50 5.80 52 TR_XM_DK_Bayes 12173 4.25 0.57 5.75 53 BAYES_80 11977 6.58 8.86 5.66 54 TR_XM_DK_Bayes1 11964 4.18 0.57 5.65 55 TR_XM_DKIM_Undo 11509 15.20 39.19 5.43 56 TR_XM_DK_SendGrid 11094 5.14 4.90 5.24 57 BOTNET_IPINHOSTNAME 10992 7.58 13.46 5.19 58 XMSubMetaSx_00 10503 5.43 6.58 4.96 59 TR_XM_DK_Bayes2 10498 3.65 0.45 4.96 60 MPART_ALT_DIFF 10462 6.49 10.30 4.94 61 RCVD_IN_MSPIKE_H5 10349 3.81 1.18 4.89 62 XM_H_Long_From01 10085 5.14 6.08 4.76 63 RCVD_IN_IADB_LISTED 9422 3.62 1.57 4.45 64 T_TooManySym_02 9304 3.34 0.74 4.39 65 XMSexyCombo_05 9300 7.12 13.81 4.39 66 IN_ZIMBRA_NJ_WHITELIST 9210 3.10 0.03 4.35 67 MIME_QP_LONG_LINE 9074 3.65 2.09 4.28 68 XM_UncommonTLD01 9071 6.48 11.88 4.28 69 RELAYCOUNTRY_META 8929 9.61 22.87 4.22 70 BAYES_40 8363 3.19 1.33 3.95 71 RCVD_IN_IADB_SPF 8144 3.13 1.37 3.85 72 INVALID_MSGID 8093 2.85 0.46 3.82 73 XMNumbers 7921 3.70 3.61 3.74 74 BOUNCE_MESSAGE 7851 2.73 0.35 3.71 75 ANY_BOUNCE_MESSAGE 7851 2.73 0.35 3.71 76 BAYES_20 7786 2.95 1.16 3.68 77 XM_H_Trusted_IP 7735 2.60 0.00 3.65 78 MSGID_NOFQDN1 7718 2.66 0.26 3.64 79 TR_XM_SpammyWords4 7681 6.02 11.89 3.63 80 T_REMOTE_IMAGE 7516 3.71 4.11 3.55 81 XM_B_SpammyWords3 7414 6.33 13.28 3.50 82 FROM_EXCESS_BASE64 7381 3.32 2.93 3.49 83 RCVD_IN_IADB_SENDERID 7209 2.79 1.28 3.40 84 HTML_IMAGE_RATIO_06 7202 3.43 3.51 3.40 85 TM2_M_URI_OPT_OUT 7089 3.46 3.73 3.35 86 RCVD_IN_IADB_DK 6964 2.71 1.29 3.29 87 BAYES_95 6938 3.78 5.03 3.28 88 TR_DCC_Bayes_99 6586 10.76 29.54 3.11 89 TO_MALFORMED 6222 2.11 0.08 2.94 90 XM_PDF 6199 2.24 0.54 2.93 91 RCVD_IN_IADB_VOUCHED 6072 2.24 0.72 2.87 92 MIME_HTML_ONLY_MULTI 5984 3.02 3.48 2.83 93 MIME_HTML_MOSTLY 5799 4.32 8.21 2.74 94 TVD_RCVD_IP 5566 1.89 0.09 2.63 95 DKIM_INVALID 5402 2.75 3.24 2.55 96 T_XMDrugObfuBody_14 5357 2.80 3.45 2.53 97 HTML_MIME_NO_HTML_TAG 5317 2.24 1.57 2.51 98 TR_Symld_Words 5133 2.57 2.92 2.42 99 URI_NOVOWEL 5103 2.04 1.14 2.41 100 MAILING_LIST_MULTI 4926 2.05 1.36 2.33 101 IN_HORDE_ADDRESS_BOOK 4870 1.66 0.08 2.30 102 TR_XM_SB_Phish 4697 2.04 1.62 2.22 103 XMSubPhish11 4675 2.04 1.61 2.21 104 TR_XM_PhishingBody 4640 4.03 8.53 2.19 105 UNTRUSTED_Relay 4102 5.28 13.48 1.94 106 RCVD_IN_IADB_OPTIN 3990 1.49 0.51 1.88 107 HELO_MISC_IP 3735 1.26 0.02 1.76 108 XM_B_SpammyTLD 3721 2.50 4.33 1.76 109 HTML_IMAGE_RATIO_08 3681 1.93 2.41 1.74 110 TooManyTo_002 3594 1.40 0.68 1.70 111 XM_CamelCaseFrm001 3525 2.04 2.95 1.66 112 XMStockSpam_06 3457 1.61 1.56 1.63 113 XMBSHREFv2 3386 1.19 0.18 1.60 114 XM_B_Unsub2 3371 1.64 1.75 1.59 115 USER_IN_DEF_DKIM_WL 3361 1.13 0.00 1.59 116 XMGappySubj_01 3351 1.17 0.14 1.58 117 XM_DK_Undo_01 3251 1.62 1.81 1.54 118 XMSexyCombo_01 3248 1.75 2.29 1.53 119 BAYES_05 3208 1.25 0.59 1.51 120 XMSubNoVowel 3146 1.21 0.52 1.49 121 XMDiploma_00 3057 1.65 2.16 1.44 122 XM_UB50 3007 2.37 4.71 1.42 123 BOTNET 2846 6.21 18.16 1.34 124 XMSubMetaSxObfu_03 2831 1.18 0.79 1.34 125 RELAYCOUNTRY_CA 2798 3.25 7.97 1.32 126 HTML_IMAGE_ONLY_20 2780 1.73 2.77 1.31 127 XM_GoogleGroups 2773 1.16 0.78 1.31 128 TM2_M_VERY_LONG_WORD 2703 1.55 2.23 1.28 129 TR_XM_SpammyWords5 2675 2.12 4.21 1.26 130 KHOP_HELO_FCRDNS 2673 1.56 2.31 1.26 131 XM_SPF_SoftFail 2601 1.96 3.77 1.23 132 TVD_SPACE_RATIO 2579 0.92 0.19 1.22 133 TR_XM_SpammyWords2 2548 5.56 16.27 1.20 134 TooManyTo_003 2483 0.99 0.55 1.17 135 SUBJ_ALL_CAPS 2443 1.51 2.39 1.15 136 XMBody_95 2407 0.83 0.07 1.14 137 HTML_FONT_FACE_BAD 2401 1.07 0.90 1.13 138 T_XMDrugObfuBody_08 2354 1.35 1.93 1.11 139 XM_B_Phish66 2306 2.41 5.66 1.09 140 T_TooManySym_03 2221 0.79 0.16 1.05 141 URI_TRY_3LD 2200 1.12 1.33 1.04 142 URI_HEX 2137 1.33 2.12 1.01 143 XM_OfRef6 2099 1.56 2.94 0.99 144 TR_MetaPhish_Combo_01 2039 0.86 0.60 0.96 145 XM_H_Long_From02 2038 0.91 0.78 0.96 146 XMSexyCombo_04 1994 1.04 1.28 0.94 147 XMHTML_After_End 1986 0.93 0.92 0.94 148 XMSubMetaSx_01 1953 0.75 0.32 0.92 149 XMLngstWrd_00 1938 0.78 0.45 0.92 150 DKIM_ADSP_CUSTOM_MED 1919 0.89 0.83 0.91 151 TooManyTo_004 1902 0.78 0.48 0.90 152 XMHTMLBadTable_001 1861 0.86 0.83 0.88 153 XMBrknScrpt_02 1845 1.42 2.77 0.87 154 XMSexyCombo_02 1808 0.70 0.34 0.85 155 XM_B_REG_HTML 1790 0.72 0.42 0.85 156 PLING_QUERY 1783 0.88 0.97 0.84 157 XM_B_COVIDMETA 1781 1.21 2.11 0.84 158 XMBody_17 1716 1.31 2.55 0.81 159 TooManyTo_005 1643 0.67 0.40 0.78 160 XMLngstWrd_01 1617 0.66 0.41 0.76 161 HTML_TAG_BALANCE_BODY 1555 0.78 0.90 0.73 162 HELO_NODOT 1527 0.65 0.46 0.72 163 HELO_NO_DOMAIN 1527 0.65 0.46 0.72 164 USER_IN_WELCOMELIST 1458 0.49 0.00 0.69 165 USER_IN_WHITELIST 1458 0.49 0.00 0.69 166 XMGenDplmaNmb 1420 0.82 1.19 0.67 167 XMLngstWrd_02 1361 0.56 0.35 0.64 168 RELAYCOUNTRY_GB 1332 0.83 1.31 0.63 169 XM_ProductURIs 1319 0.61 0.58 0.62 170 TR_MSPIKEBAYES00 1309 0.44 0.01 0.62 171 RELAYCOUNTRY_DE 1302 0.79 1.23 0.61 172 XM_B_COPY_HTML 1299 0.71 0.95 0.61 173 T_XMDrugObfuBody_00 1293 0.89 1.58 0.61 174 RDNS_DYNAMIC 1288 0.65 0.75 0.61 175 NML_ADSP_CUSTOM_MED 1248 0.63 0.72 0.59 176 XMBdyGiftCard01 1218 1.29 3.03 0.58 177 XM_H_PHPMailer 1191 0.74 1.16 0.56 178 XMCapTrack 1177 0.47 0.26 0.56 179 XMPhish30 1164 0.73 1.16 0.55 180 DATE_IN_PAST_03_06 1151 0.74 1.21 0.54 181 XMLngstWrd_03 1128 0.46 0.29 0.53 182 HTTPS_HTTP_MISMATCH 1128 0.62 0.85 0.53 183 XMSubMetaI_00 1115 0.68 1.07 0.53 184 T_FILL_THIS_FORM_SHORT 1114 0.95 1.99 0.53 185 DIET_1 1105 0.72 1.22 0.52 186 SHOPIFY_IMG_NOT_RCVD_SFY 1069 0.56 0.69 0.50 187 RCVD_IN_BL_SPAMCOP_NET 1068 3.24 9.96 0.50 188 XMSubMetaSxObfu_02 1059 0.43 0.27 0.50 189 FORGED_GMAIL_RCVD 1046 0.55 0.69 0.49 190 XMNoVowels 1043 0.61 0.88 0.49 191 BASE64_LENGTH_79_INF 979 0.35 0.06 0.46 192 T_TooManySym_04 955 0.34 0.06 0.45 193 XM_D_tchamptons_WL 955 0.32 0.00 0.45 194 XM_ShortIntro_01 934 0.48 0.59 0.44 195 TVD_SPACE_RATIO_MINFP 910 0.43 0.42 0.43 196 T_XMHurry_00 908 0.81 1.74 0.43 197 XMLngstWrd_04 893 0.36 0.20 0.42 198 SpammyFromTLD_01 885 1.87 5.45 0.42 199 DKIM_ADSP_NXDOMAIN 865 0.48 0.65 0.41 200 PDS_OTHER_BAD_TLD 861 0.69 1.38 0.41 ----------------------------------------------------------------------