Email: 302992 Autolearn: 0 AvgScore: 1.41 AvgScanTime: 1.43 sec Spam: 81148 Autolearn: 0 AvgScore: 14.26 AvgScanTime: 1.75 sec Ham: 221844 Autolearn: 0 AvgScore: -3.29 AvgScanTime: 1.31 sec Time Spent Running SA: 120.37 hours Time Spent Processing Spam: 39.47 hours Time Spent Processing Ham: 80.90 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 77424 85.20 95.41 81.47 2 DKIM_SIGNED 67079 76.91 82.66 74.81 3 XM_DK_Pass 65681 75.54 80.94 73.56 4 DCC_CHECK 65026 54.39 80.13 44.97 5 DKIM_VALID 63801 73.64 78.62 71.81 6 RELAYCOUNTRY_US 63535 79.24 78.30 79.59 7 XM_B_Unicode 62722 71.45 77.29 69.31 8 XM_B_SpammyWords 57240 51.80 70.54 44.95 9 XMListUnsubscribeExists 54881 54.39 67.63 49.55 10 DKIM_VALID_AU 48135 58.22 59.32 57.81 11 XM_DK_Undo_02 36867 18.62 45.43 8.81 12 XM_B_Unicode3 35662 43.22 43.95 42.95 13 XM_B_SpammyWords2 31775 25.18 39.16 20.07 14 BAYES_50 30793 48.41 37.95 52.23 15 TR_XM_DKIM_Undo 29869 14.61 36.81 6.49 16 MIME_HTML_ONLY 29085 25.97 35.84 22.36 17 BAYES_99 28179 14.40 34.73 6.97 18 HTML_FONT_LOW_CONTRAST 27719 30.18 34.16 28.72 19 LOC_TINY_FONT_1 27040 28.40 33.32 26.60 20 DKIM_VALID_EF 24629 29.07 30.35 28.60 21 RCVD_IN_MSPIKE_H2 22389 24.85 27.59 23.84 22 T_KAM_HTML_FONT_INVALID 22343 19.24 27.53 16.21 23 BAYES_999 22019 11.54 27.13 5.84 24 TR_DCC_Bayes_99 21819 9.66 26.89 3.36 25 FVGT_m_MULTI_ODD 19906 23.63 24.53 23.30 26 XMSubLong 19887 21.17 24.51 19.96 27 T_TM2_M_HEADER_IN_MSG 19688 25.76 24.26 26.31 28 XM_Body_Dirty_Words 18002 14.96 22.18 12.31 29 RCVD_IN_MSPIKE_WL 17978 28.82 22.15 31.25 30 RELAYCOUNTRY_META 16435 8.36 20.25 4.01 31 DCC_CHECK_NEGATIVE 16091 45.59 19.83 55.01 32 FSL_BULK_SIG 14954 11.90 18.43 9.51 33 XM_Multi_Part_URI 12261 13.23 15.11 12.55 34 LOTS_OF_MONEY 12194 9.99 15.03 8.15 35 BOTNET 11813 5.10 14.56 1.64 36 BOTNET_IPINHOSTNAME 11293 7.86 13.92 5.65 37 XMSexyCombo_05 11027 7.22 13.59 4.89 38 UNPARSEABLE_RELAY 11027 9.80 13.59 8.42 39 TR_XM_SpammyWords2 10899 4.71 13.43 1.52 40 XM_B_Unsub 10760 11.80 13.26 11.26 41 UNTRUSTED_Relay 10692 4.99 13.18 2.00 42 TR_XM_UnparsRelay 10676 8.32 13.16 6.55 43 TR_XM_SpammyWords4 10642 7.32 13.11 5.20 44 XM_B_SpammyWords3 10054 6.25 12.39 4.00 45 HTML_IMAGE_RATIO_02 10033 7.93 12.36 6.31 46 RCVD_IN_MSPIKE_H3 9560 14.41 11.78 15.37 47 XM_UncommonTLD01 9436 6.21 11.63 4.22 48 RCVD_IN_BL_SPAMCOP_NET 8441 3.30 10.40 0.70 49 XM_SendGrid 8195 8.19 10.10 7.49 50 T_REMOTE_IMAGE 7885 5.18 9.72 3.52 51 RCVD_IN_MSPIKE_H4 7746 12.26 9.55 13.25 52 BAYES_80 6925 5.65 8.53 4.60 53 XMSubMetaSx_00 6803 5.21 8.38 4.05 54 XM_Evil_Numbers_Gen 6595 9.38 8.13 9.84 55 BAYES_60 6544 9.84 8.06 10.49 56 MPART_ALT_DIFF 6463 5.46 7.96 4.54 57 SpammyFromTLD_02 5556 1.97 6.85 0.18 58 XM_B_Phish_Phrases 5219 5.05 6.43 4.55 59 RELAYCOUNTRY_CA 5129 2.44 6.32 1.02 60 TR_XM_DK_SendGrid 5127 5.26 6.32 4.88 61 XM_H_Long_From01 4954 5.34 6.10 5.07 62 TR_XM_SPAMCOP 4897 1.83 6.03 0.29 63 RCVD_IN_MSPIKE_BL 4880 1.99 6.01 0.51 64 TR_XM_MSPIKECOMBO 4832 1.96 5.95 0.51 65 TooManyTo_001 4821 6.50 5.94 6.71 66 XM_UB50 4677 2.68 5.76 1.56 67 LotsOfNums_01 4634 8.34 5.71 9.30 68 MIME_HTML_MOSTLY 4613 3.33 5.68 2.47 69 HTML_IMAGE_RATIO_04 4226 5.51 5.21 5.62 70 TR_XM_PhishingBody 4037 3.68 4.97 3.21 71 TR_XM_SpammyWords3 3972 1.65 4.89 0.46 72 KHOP_HELO_FCRDNS 3781 3.47 4.66 3.04 73 HTML_MIME_NO_HTML_TAG 3734 2.49 4.60 1.72 74 RCVD_IN_RP_SAFE 3676 7.83 4.53 9.04 75 BAYES_95 3573 3.14 4.40 2.68 76 RCVD_IN_PSBL 3550 1.22 4.37 0.07 77 URIBL_DBL_SPAM 3350 1.12 4.13 0.02 78 HTML_IMAGE_ONLY_20 3332 1.79 4.11 0.95 79 XM_B_SpammyTLD 3300 2.98 4.07 2.58 80 XMNumbers 3295 4.14 4.06 4.17 81 DKIM_INVALID 3278 3.28 4.04 3.00 82 MIME_HTML_ONLY_MULTI 3230 3.19 3.98 2.90 83 HTML_IMAGE_ONLY_08 2947 1.09 3.63 0.16 84 RCVD_IN_RP_CERTIFIED 2936 6.79 3.62 7.94 85 T_TooManySym_01 2919 6.41 3.60 7.44 86 T_HTML_TAG_BALANCE_CENTER 2895 1.07 3.57 0.15 87 XM_SPF_SoftFail 2863 3.16 3.53 3.02 88 URI_NOVOWEL 2828 2.35 3.48 1.93 89 TM2_M_URI_OPT_OUT 2758 3.79 3.40 3.94 90 RCVD_IN_MSPIKE_L4 2737 1.09 3.37 0.26 91 ALIBABA_IMG_NOT_RCVD_ALI 2725 0.90 3.36 0.00 92 HOSTED_IMG_DIRECT_MX 2724 0.90 3.36 0.00 93 XM_DIRTYINTL 2706 1.70 3.33 1.10 94 XMSexyCombo_01 2632 1.58 3.24 0.97 95 HTML_IMAGE_RATIO_06 2621 3.39 3.23 3.45 96 XMStrtUSub 2590 4.95 3.19 5.59 97 XMBody_17 2537 1.19 3.13 0.48 98 TR_XM_SpammyWords5 2499 1.95 3.08 1.53 99 TR_Symld_Words 2401 2.45 2.96 2.27 100 PDS_OTHER_BAD_TLD 2396 1.13 2.95 0.46 101 T_XMHurry_00 2382 1.12 2.94 0.46 102 MIXED_HREF_CASE 2347 0.78 2.89 0.00 103 MIXED_CENTER_CASE 2344 0.78 2.89 0.00 104 MIXED_FONT_CASE 2333 0.77 2.87 0.00 105 MIXED_AREA_CASE 2331 0.77 2.87 0.00 106 MIXED_IMG_CASE 2305 0.77 2.84 0.01 107 XM_OfRef6 2287 1.47 2.82 0.98 108 T_XMDrugObfuBody_14 2135 2.62 2.63 2.61 109 BODY_URI_ONLY 2122 0.71 2.61 0.01 110 XM_B_Phish66 2100 1.76 2.59 1.45 111 TR_LOTS_OF_MONEY3 2098 1.02 2.59 0.44 112 T_XMDrugObfuBody_08 2091 1.61 2.58 1.26 113 MIME_QP_LONG_LINE 1985 3.98 2.45 4.54 114 XM_CamelCaseFrm001 1979 2.17 2.44 2.07 115 DIET_1 1967 1.10 2.42 0.61 116 USER_IN_DEF_DKIM_WL 1957 12.09 2.41 15.63 117 SpammyFromTLD_01 1948 1.05 2.40 0.56 118 T_FILL_THIS_FORM_SHORT 1948 1.08 2.40 0.60 119 XMSlimDrugH 1925 0.90 2.37 0.36 120 TR_XM_PHPDW 1861 0.87 2.29 0.34 121 XMSexyCombo_04 1857 1.08 2.29 0.64 122 RCVD_IN_RP_RNBL 1834 0.62 2.26 0.02 123 XM_Body_Dirty_Words_01 1831 1.10 2.26 0.68 124 XMStockSpam_06 1811 1.57 2.23 1.32 125 XM_B_SpammyWords4 1778 0.88 2.19 0.40 126 URI_GOOG_STO_SPAMMY 1774 0.59 2.19 0.00 127 URI_HEX 1765 1.60 2.18 1.40 128 BAYES_40 1759 3.84 2.17 4.45 129 TM2_M_VERY_LONG_WORD 1752 1.50 2.16 1.26 130 HTML_FONT_SIZE_HUGE 1748 0.61 2.15 0.05 131 XM_UB99 1736 0.57 2.14 0.00 132 HTML_IMAGE_RATIO_08 1717 1.95 2.12 1.89 133 TR_XM_BayesRelay 1673 0.56 2.06 0.01 134 XMBrknScrpt_02 1651 1.40 2.03 1.17 135 FROM_EXCESS_BASE64 1637 2.99 2.02 3.35 136 TR_XM_PHPForged 1633 0.74 2.01 0.28 137 HTML_FONT_SIZE_LARGE 1615 0.60 1.99 0.09 138 DATE_IN_PAST_03_06 1610 0.85 1.98 0.44 139 TR_XM_FormFill2 1602 0.73 1.97 0.28 140 RCVD_IN_IADB_LISTED 1598 3.44 1.97 3.98 141 XM_H_PHPOS 1592 0.72 1.96 0.27 142 JH_SPAMMY_HEADERS 1571 0.52 1.94 0.00 143 URIBL_SBL_A 1547 0.62 1.91 0.14 144 XM_UB60 1526 0.55 1.88 0.06 145 XMDiploma_00 1525 1.41 1.88 1.23 146 ALL_TRUSTED 1498 13.00 1.85 17.07 147 XM_B_Unsub2 1477 1.39 1.82 1.23 148 US_DOLLARS_3 1476 1.45 1.82 1.31 149 BOTNET_NORDNS 1452 0.49 1.79 0.02 150 RCVD_IN_IADB_SPF 1397 3.02 1.72 3.49 151 RCVD_IN_MSPIKE_L5 1382 0.49 1.70 0.05 152 XM_DK_Undo_01 1382 1.50 1.70 1.43 153 SUBJ_ALL_CAPS 1381 1.32 1.70 1.18 154 TR_XM_MaxBayes 1370 0.46 1.69 0.01 155 BAYES_20 1366 3.33 1.68 3.93 156 XM_UB80 1358 0.46 1.67 0.01 157 XM_URI_RBL 1351 0.52 1.66 0.11 158 URI_TRY_3LD 1344 1.36 1.66 1.25 159 BAYES_00 1342 9.71 1.65 12.65 160 RCVD_IN_IADB_SENDERID 1317 2.73 1.62 3.14 161 RCVD_IN_IADB_DK 1312 2.68 1.62 3.06 162 GOOG_STO_IMG_HTML 1301 0.43 1.60 0.00 163 XMBdyGiftCard01 1254 1.13 1.55 0.98 164 TR_XM_SB_Phish 1245 1.62 1.53 1.66 165 XMWghtMeta_00 1234 0.45 1.52 0.06 166 MAILING_LIST_MULTI 1232 1.82 1.52 1.94 167 XMSubPhish11 1216 1.60 1.50 1.64 168 FROM_SUSPICIOUS_NTLD 1193 0.43 1.47 0.05 169 XMSubMetaSxObfu_03 1177 1.00 1.45 0.84 170 TR_XM_FormFill 1165 0.39 1.44 0.01 171 FROM_SUSPICIOUS_NTLD_FP 1156 0.42 1.42 0.05 172 TR_Mismatch_TLD_02 1147 0.43 1.41 0.07 173 XM_RXBody 1134 0.97 1.40 0.82 174 XM_UB999 1126 0.37 1.39 0.00 175 URI_PHP_REDIR 1116 0.38 1.38 0.02 176 XM_H_PHPMailer 1105 0.82 1.36 0.63 177 TR_XM_INV_DKIM 1101 0.50 1.36 0.19 178 TR_Mismatch_TLD_01 1091 0.60 1.34 0.32 179 XM_B_COVIDMETA 1083 1.04 1.33 0.93 180 URIBL_BLACK 1011 0.35 1.25 0.03 181 RELAYCOUNTRY_NL 1009 0.43 1.24 0.13 182 XM_H_Long_From02 985 1.07 1.21 1.02 183 RELAYCOUNTRY_DE 975 0.55 1.20 0.31 184 RELAYCOUNTRY_AZ 947 0.31 1.17 0.00 185 XMGenDplmaNmb 939 0.85 1.16 0.74 186 DKIM_ADSP_CUSTOM_MED 936 0.94 1.15 0.86 187 XMSexyCombo_02 932 0.70 1.15 0.53 188 HK_RANDOM_REPLYTO 911 0.38 1.12 0.11 189 TR_XM_COVIDMETA4 894 0.48 1.10 0.25 190 SHOPIFY_IMG_NOT_RCVD_SFY 893 0.44 1.10 0.19 191 XMPhish30 887 1.12 1.09 1.13 192 XM_B_SexDrugs1 870 0.65 1.07 0.50 193 MISSING_HEADERS 870 0.50 1.07 0.28 194 XM_Body_Dirty_Words_02 867 0.65 1.07 0.50 195 XMSubMetaSx_01 854 0.71 1.05 0.59 196 T_Symld_Words_02 831 0.50 1.02 0.30 197 FORGED_GMAIL_RCVD 829 0.58 1.02 0.42 198 HTML_FONT_FACE_BAD 819 0.94 1.01 0.92 199 HTML_TAG_BALANCE_BODY 806 0.87 0.99 0.83 200 T_XMDrugObfuBody_00 776 0.62 0.96 0.50 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 180737 85.20 95.41 81.47 2 RELAYCOUNTRY_US 176555 79.24 78.30 79.59 3 DKIM_SIGNED 165958 76.91 82.66 74.81 4 XM_DK_Pass 163194 75.54 80.94 73.56 5 DKIM_VALID 159311 73.64 78.62 71.81 6 XM_B_Unicode 153765 71.45 77.29 69.31 7 DKIM_VALID_AU 128253 58.22 59.32 57.81 8 DCC_CHECK_NEGATIVE 122028 45.59 19.83 55.01 9 BAYES_50 115877 48.41 37.95 52.23 10 XMListUnsubscribeExists 109927 54.39 67.63 49.55 11 DCC_CHECK 99767 54.39 80.13 44.97 12 XM_B_SpammyWords 99712 51.80 70.54 44.95 13 XM_B_Unicode3 95277 43.22 43.95 42.95 14 RCVD_IN_MSPIKE_WL 69333 28.82 22.15 31.25 15 HTML_FONT_LOW_CONTRAST 63724 30.18 34.16 28.72 16 DKIM_VALID_EF 63458 29.07 30.35 28.60 17 LOC_TINY_FONT_1 59007 28.40 33.32 26.60 18 T_TM2_M_HEADER_IN_MSG 58364 25.76 24.26 26.31 19 RCVD_IN_MSPIKE_H2 52894 24.85 27.59 23.84 20 FVGT_m_MULTI_ODD 51684 23.63 24.53 23.30 21 MIME_HTML_ONLY 49594 25.97 35.84 22.36 22 XM_B_SpammyWords2 44517 25.18 39.16 20.07 23 XMSubLong 44271 21.17 24.51 19.96 24 ALL_TRUSTED 37879 13.00 1.85 17.07 25 T_KAM_HTML_FONT_INVALID 35952 19.24 27.53 16.21 26 USER_IN_DEF_DKIM_WL 34665 12.09 2.41 15.63 27 RCVD_IN_MSPIKE_H3 34091 14.41 11.78 15.37 28 RCVD_IN_MSPIKE_H4 29391 12.26 9.55 13.25 29 BAYES_00 28071 9.71 1.65 12.65 30 XM_Multi_Part_URI 27833 13.23 15.11 12.55 31 XM_Body_Dirty_Words 27313 14.96 22.18 12.31 32 XM_B_Unsub 24988 11.80 13.26 11.26 33 BAYES_60 23271 9.84 8.06 10.49 34 XM_DKIMWhitelistDomains 22548 7.68 0.90 10.16 35 XM_Evil_Numbers_Gen 21822 9.38 8.13 9.84 36 FSL_BULK_SIG 21098 11.90 18.43 9.51 37 LotsOfNums_01 20642 8.34 5.71 9.30 38 RCVD_IN_RP_SAFE 20050 7.83 4.53 9.04 39 XM_DK_Undo_02 19545 18.62 45.43 8.81 40 UNPARSEABLE_RELAY 18675 9.80 13.59 8.42 41 LOTS_OF_MONEY 18083 9.99 15.03 8.15 42 RCVD_IN_RP_CERTIFIED 17624 6.79 3.62 7.94 43 TR_XM_DK_Bayes 17304 5.88 0.64 7.80 44 TR_XM_DK_Bayes1 16906 5.75 0.62 7.62 45 XM_SendGrid 16617 8.19 10.10 7.49 46 T_TooManySym_01 16495 6.41 3.60 7.44 47 BAYES_99 15460 14.40 34.73 6.97 48 TR_XM_DK_Bayes2 15153 5.13 0.47 6.83 49 TooManyTo_001 14883 6.50 5.94 6.71 50 TR_XM_UnparsRelay 14533 8.32 13.16 6.55 51 TR_XM_DKIM_Undo 14391 14.61 36.81 6.49 52 HTML_IMAGE_RATIO_02 13991 7.93 12.36 6.31 53 BAYES_999 12946 11.54 27.13 5.84 54 BOTNET_IPINHOSTNAME 12531 7.86 13.92 5.65 55 HTML_IMAGE_RATIO_04 12466 5.51 5.21 5.62 56 XMStrtUSub 12404 4.95 3.19 5.59 57 TR_XM_SpammyWords4 11528 7.32 13.11 5.20 58 XM_H_Long_From01 11239 5.34 6.10 5.07 59 IN_ZIMBRA_NJ_WHITELIST 11196 3.70 0.03 5.05 60 XMSexyCombo_05 10843 7.22 13.59 4.89 61 TR_XM_DK_SendGrid 10816 5.26 6.32 4.88 62 BAYES_80 10197 5.65 8.53 4.60 63 XM_B_Phish_Phrases 10095 5.05 6.43 4.55 64 MIME_QP_LONG_LINE 10078 3.98 2.45 4.54 65 MPART_ALT_DIFF 10071 5.46 7.96 4.54 66 BAYES_40 9875 3.84 2.17 4.45 67 XM_UncommonTLD01 9372 6.21 11.63 4.22 68 XMNumbers 9241 4.14 4.06 4.17 69 ANY_BOUNCE_MESSAGE 9219 3.19 0.56 4.16 70 BOUNCE_MESSAGE 9218 3.19 0.56 4.16 71 TVD_RCVD_IP 9169 3.06 0.12 4.13 72 XMSubMetaSx_00 8995 5.21 8.38 4.05 73 RELAYCOUNTRY_META 8896 8.36 20.25 4.01 74 XM_B_SpammyWords3 8871 6.25 12.39 4.00 75 RCVD_IN_IADB_LISTED 8829 3.44 1.97 3.98 76 TM2_M_URI_OPT_OUT 8731 3.79 3.40 3.94 77 BAYES_20 8712 3.33 1.68 3.93 78 INVALID_MSGID 7991 2.67 0.13 3.60 79 T_REMOTE_IMAGE 7805 5.18 9.72 3.52 80 RCVD_IN_IADB_SPF 7742 3.02 1.72 3.49 81 T_TooManySym_02 7655 2.69 0.63 3.45 82 HTML_IMAGE_RATIO_06 7649 3.39 3.23 3.45 83 MSGID_NOFQDN1 7581 2.51 0.03 3.42 84 TR_DCC_Bayes_99 7456 9.66 26.89 3.36 85 FROM_EXCESS_BASE64 7433 2.99 2.02 3.35 86 TR_XM_PhishingBody 7111 3.68 4.97 3.21 87 RCVD_IN_IADB_SENDERID 6967 2.73 1.62 3.14 88 RCVD_IN_IADB_DK 6797 2.68 1.62 3.06 89 KHOP_HELO_FCRDNS 6741 3.47 4.66 3.04 90 XM_SPF_SoftFail 6709 3.16 3.53 3.02 91 DKIM_INVALID 6647 3.28 4.04 3.00 92 MIME_HTML_ONLY_MULTI 6426 3.19 3.98 2.90 93 XM_PDF 6394 2.23 0.46 2.88 94 TO_MALFORMED 6318 2.09 0.01 2.85 95 XM_H_Trusted_IP 6204 2.05 0.00 2.80 96 BAYES_95 5950 3.14 4.40 2.68 97 RCVD_IN_MSPIKE_H5 5851 2.15 0.83 2.64 98 T_XMDrugObfuBody_14 5799 2.62 2.63 2.61 99 XM_B_SpammyTLD 5722 2.98 4.07 2.58 100 MIME_HTML_MOSTLY 5474 3.33 5.68 2.47 101 RCVD_IN_IADB_VOUCHED 5387 2.00 0.83 2.43 102 TR_Symld_Words 5031 2.45 2.96 2.27 103 IN_HORDE_ADDRESS_BOOK 4958 1.65 0.05 2.23 104 XM_CamelCaseFrm001 4587 2.17 2.44 2.07 105 UNTRUSTED_Relay 4434 4.99 13.18 2.00 106 BAYES_05 4421 1.67 0.78 1.99 107 XM_shorewaves_Whitelist 4396 1.45 0.00 1.98 108 MAILING_LIST_MULTI 4295 1.82 1.52 1.94 109 URI_NOVOWEL 4278 2.35 3.48 1.93 110 HTML_IMAGE_RATIO_08 4203 1.95 2.12 1.89 111 HTML_MIME_NO_HTML_TAG 3819 2.49 4.60 1.72 112 TR_XM_SB_Phish 3673 1.62 1.53 1.66 113 XMSubPhish11 3637 1.60 1.50 1.64 114 BOTNET 3628 5.10 14.56 1.64 115 XM_UB50 3451 2.68 5.76 1.56 116 RCVD_IN_IADB_OPTIN 3444 1.29 0.57 1.55 117 TR_XM_SpammyWords5 3396 1.95 3.08 1.53 118 TR_XM_SpammyWords2 3383 4.71 13.43 1.52 119 XM_B_Phish66 3226 1.76 2.59 1.45 120 XM_DK_Undo_01 3165 1.50 1.70 1.43 121 TooManyTo_002 3123 1.26 0.85 1.41 122 URI_HEX 3095 1.60 2.18 1.40 123 XMBSHREFv2 3046 1.04 0.13 1.37 124 XMGappySubj_01 2969 1.01 0.13 1.34 125 XMStockSpam_06 2931 1.57 2.23 1.32 126 US_DOLLARS_3 2913 1.45 1.82 1.31 127 T_XMDrugObfuBody_08 2797 1.61 2.58 1.26 128 TM2_M_VERY_LONG_WORD 2786 1.50 2.16 1.26 129 URI_TRY_3LD 2784 1.36 1.66 1.25 130 XMDiploma_00 2737 1.41 1.88 1.23 131 XM_B_Unsub2 2724 1.39 1.82 1.23 132 SUBJ_ALL_CAPS 2619 1.32 1.70 1.18 133 XM_GoogleGroups 2619 1.02 0.57 1.18 134 XMBrknScrpt_02 2594 1.40 2.03 1.17 135 XMPhish30 2502 1.12 1.09 1.13 136 XMSubNoVowel 2472 1.02 0.77 1.11 137 XM_DIRTYINTL 2442 1.70 3.33 1.10 138 RELAYCOUNTRY_CA 2267 2.44 6.32 1.02 139 XM_H_Long_From02 2260 1.07 1.21 1.02 140 T_TooManySym_03 2225 0.79 0.22 1.00 141 TooManyTo_003 2196 0.93 0.78 0.99 142 XMBdyGiftCard01 2170 1.13 1.55 0.98 143 XM_OfRef6 2163 1.47 2.82 0.98 144 XMBody_95 2162 0.75 0.12 0.97 145 XMSexyCombo_01 2159 1.58 3.24 0.97 146 HTML_IMAGE_ONLY_20 2097 1.79 4.11 0.95 147 XM_B_COVIDMETA 2074 1.04 1.33 0.93 148 HTML_FONT_FACE_BAD 2044 0.94 1.01 0.92 149 TR_MetaPhish_Combo_01 2039 0.89 0.80 0.92 150 RELAYCOUNTRY_FR 2011 0.88 0.80 0.91 151 XMNoVowels 1918 0.89 0.95 0.86 152 DKIM_ADSP_CUSTOM_MED 1904 0.94 1.15 0.86 153 XMSubMetaSxObfu_03 1862 1.00 1.45 0.84 154 HTML_TAG_BALANCE_BODY 1838 0.87 0.99 0.83 155 XM_RXBody 1813 0.97 1.40 0.82 156 XMLngstWrd_00 1746 0.65 0.26 0.79 157 XMHTML_After_End 1737 0.78 0.76 0.78 158 XM_B_COPY_HTML 1717 0.76 0.72 0.77 159 TooManyTo_004 1705 0.76 0.74 0.77 160 XMBounce_01 1684 0.57 0.07 0.76 161 XMHTMLBadTable_001 1667 0.77 0.82 0.75 162 XMGenDplmaNmb 1651 0.85 1.16 0.74 163 XMLngstWrd_01 1558 0.57 0.20 0.70 164 RCVD_IN_BL_SPAMCOP_NET 1549 3.30 10.40 0.70 165 XM_ProductURIs 1516 0.72 0.80 0.68 166 XM_Body_Dirty_Words_01 1511 1.10 2.26 0.68 167 HELO_NODOT 1498 0.69 0.72 0.68 168 HELO_NO_DOMAIN 1497 0.69 0.72 0.67 169 USER_IN_WELCOMELIST 1476 0.49 0.00 0.67 170 USER_IN_WHITELIST 1476 0.49 0.00 0.67 171 TooManyTo_005 1459 0.67 0.70 0.66 172 RELAYCOUNTRY_GB 1431 0.64 0.64 0.65 173 XMSexyCombo_04 1419 1.08 2.29 0.64 174 XM_B_REG_HTML 1417 0.64 0.64 0.64 175 XM_H_PHPMailer 1393 0.82 1.36 0.63 176 RDNS_DYNAMIC 1390 0.61 0.56 0.63 177 DIET_1 1355 1.10 2.42 0.61 178 XMLngstWrd_02 1333 0.48 0.14 0.60 179 TR_MSPIKEBAYES00 1333 0.44 0.01 0.60 180 T_FILL_THIS_FORM_SHORT 1322 1.08 2.40 0.60 181 XMSubMetaSxObfu_02 1299 0.53 0.37 0.59 182 XMSubMetaSx_01 1298 0.71 1.05 0.59 183 TVD_SPACE_RATIO 1272 0.47 0.18 0.57 184 HTTPS_HTTP_MISMATCH 1246 0.56 0.54 0.56 185 SpammyFromTLD_01 1238 1.05 2.40 0.56 186 XMSexyCombo_02 1178 0.70 1.15 0.53 187 NML_ADSP_CUSTOM_MED 1145 0.62 0.89 0.52 188 T_OBFU_PDF_ATTACH 1143 0.39 0.05 0.52 189 RCVD_IN_MSPIKE_BL 1138 1.99 6.01 0.51 190 TR_XM_MSPIKECOMBO 1121 1.96 5.95 0.51 191 XM_SPF_Unknown 1107 0.60 0.89 0.50 192 XM_Body_Dirty_Words_02 1106 0.65 1.07 0.50 193 XM_B_SexDrugs1 1106 0.65 1.07 0.50 194 XMLngstWrd_03 1105 0.40 0.12 0.50 195 T_XMDrugObfuBody_00 1102 0.62 0.96 0.50 196 XMBody_17 1060 1.19 3.13 0.48 197 TR_XM_SpammyWords3 1022 1.65 4.89 0.46 198 PDS_OTHER_BAD_TLD 1018 1.13 2.95 0.46 199 T_XMHurry_00 1017 1.12 2.94 0.46 200 TR_LOTS_OF_MONEY3 986 1.02 2.59 0.44 ----------------------------------------------------------------------