Email: 265736 Autolearn: 0 AvgScore: 3.17 AvgScanTime: 1.57 sec Spam: 75270 Autolearn: 0 AvgScore: 14.73 AvgScanTime: 2.25 sec Ham: 190466 Autolearn: 0 AvgScore: -1.40 AvgScanTime: 1.31 sec Time Spent Running SA: 116.23 hours Time Spent Processing Spam: 47.08 hours Time Spent Processing Ham: 69.15 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 71421 87.24 94.89 84.22 2 DCC_CHECK 59925 56.32 79.61 47.11 3 DKIM_SIGNED 58314 75.83 77.47 75.18 4 XM_DK_Pass 56203 74.04 74.67 73.80 5 XM_B_Unicode 56017 73.03 74.42 72.48 6 DKIM_VALID 54545 72.37 72.47 72.33 7 RELAYCOUNTRY_US 54468 78.55 72.36 80.99 8 XM_B_SpammyWords 48902 49.50 64.97 43.38 9 XMListUnsubscribeExists 47223 54.47 62.74 51.20 10 DKIM_VALID_AU 41628 58.09 55.30 59.19 11 XM_B_Unicode3 31157 44.42 41.39 45.61 12 LOC_TINY_FONT_1 30995 32.86 41.18 29.57 13 XM_DK_Undo_02 30494 17.73 40.51 8.72 14 XM_B_SpammyWords2 28913 24.82 38.41 19.45 15 BAYES_50 28733 48.36 38.17 52.38 16 HTML_FONT_LOW_CONTRAST 25006 33.25 33.22 33.26 17 TR_XM_DKIM_Undo 24177 13.68 32.12 6.39 18 BAYES_99 23570 15.21 31.31 8.84 19 MIME_HTML_ONLY 22666 24.61 30.11 22.43 20 DKIM_VALID_EF 20866 28.19 27.72 28.38 21 RELAYCOUNTRY_META 18697 9.15 24.84 2.95 22 TR_DCC_Bayes_99 18642 9.99 24.77 4.16 23 FVGT_m_MULTI_ODD 18606 24.65 24.72 24.62 24 BAYES_999 18455 12.40 24.52 7.61 25 T_KAM_HTML_FONT_INVALID 17494 18.31 23.24 16.36 26 RCVD_IN_MSPIKE_WL 17302 31.61 22.99 35.02 27 FSL_BULK_SIG 16730 13.31 22.23 9.79 28 RCVD_IN_MSPIKE_H2 16075 19.29 21.36 18.48 29 XM_Body_Dirty_Words 15541 14.55 20.65 12.14 30 DCC_CHECK_NEGATIVE 15316 43.65 20.35 52.86 31 UNTRUSTED_Relay 15114 6.57 20.08 1.24 32 XMSubLong 14926 20.97 19.83 21.43 33 XM_B_Unsub 14553 13.79 19.33 11.60 34 T_TM2_M_HEADER_IN_MSG 13785 21.91 18.31 23.33 35 BOTNET_IPINHOSTNAME 12906 9.03 17.15 5.83 36 XM_UncommonTLD01 12709 7.97 16.88 4.45 37 BOTNET 12131 5.55 16.12 1.38 38 UNPARSEABLE_RELAY 11253 10.90 14.95 9.29 39 RCVD_IN_BL_SPAMCOP_NET 11209 4.87 14.89 0.91 40 XM_Multi_Part_URI 11170 13.95 14.84 13.60 41 TR_XM_UnparsRelay 11009 9.43 14.63 7.38 42 XM_B_SpammyWords3 10284 6.57 13.66 3.77 43 TR_XM_SpammyRelay 10205 4.75 13.56 1.27 44 TR_XM_SpammyWords2 9232 4.87 12.27 1.95 45 XM_SendGrid 8661 9.26 11.51 8.37 46 RCVD_IN_MSPIKE_H4 8462 15.50 11.24 17.18 47 RCVD_IN_MSPIKE_H3 8387 13.61 11.14 14.59 48 LOTS_OF_MONEY 7974 7.63 10.59 6.46 49 HTML_IMAGE_RATIO_02 7373 8.03 9.80 7.33 50 TR_XM_PHPDW 7269 2.99 9.66 0.35 51 TR_XM_PHPForged 7134 2.88 9.48 0.27 52 XMSexyCombo_05 7124 5.90 9.46 4.49 53 TR_XM_FormFill2 7094 2.86 9.42 0.27 54 XM_H_PHPOS 7086 2.85 9.41 0.26 55 TR_XM_SpammyWords4 6760 5.39 8.98 3.96 56 RCVD_IN_RP_RNBL 6522 2.55 8.66 0.14 57 TR_XM_NoHeaderRelay 6338 2.50 8.42 0.17 58 BAYES_80 6290 5.83 8.36 4.84 59 RELAYCOUNTRY_FR 5962 2.35 7.92 0.15 60 BAYES_60 5913 10.05 7.86 10.91 61 URIBL_DBL_SPAM 5892 2.25 7.83 0.04 62 SpammyFromTLD_02 5757 2.29 7.65 0.18 63 XM_Evil_Numbers_Gen 5704 9.03 7.58 9.60 64 XM_UB50 5350 2.59 7.11 0.80 65 MPART_ALT_DIFF 5348 5.71 7.11 5.15 66 TR_XM_DK_SendGrid 5342 5.77 7.10 5.25 67 T_REMOTE_IMAGE 5186 4.14 6.89 3.05 68 XMSubMetaSx_00 5147 4.93 6.84 4.18 69 HTML_IMAGE_RATIO_06 5140 4.68 6.83 3.83 70 HTML_MIME_NO_HTML_TAG 4896 2.99 6.50 1.60 71 KHOP_HELO_FCRDNS 4837 2.54 6.43 1.00 72 TooManyTo_001 4479 6.54 5.95 6.78 73 BOTNET_NORDNS 4374 1.66 5.81 0.02 74 TR_XM_PhishingBody 4318 3.98 5.74 3.29 75 T_HTML_TAG_BALANCE_CENTER 4208 1.61 5.59 0.03 76 LotsOfNums_01 4196 7.51 5.57 8.27 77 RCVD_IN_RP_SAFE 4163 9.16 5.53 10.60 78 RELAYCOUNTRY_CA 4038 2.10 5.36 0.81 79 HTML_IMAGE_ONLY_08 3990 1.58 5.30 0.11 80 XM_H_Long_From01 3929 5.25 5.22 5.26 81 XMDiploma_00 3928 2.27 5.22 1.10 82 XM_B_Phish_Phrases 3902 4.21 5.18 3.83 83 TR_Mismatch_TLD_02 3881 1.51 5.16 0.07 84 TR_XM_SPAMCOP 3872 1.69 5.14 0.32 85 MIME_HTML_MOSTLY 3798 3.00 5.05 2.19 86 DKIM_INVALID 3769 3.46 5.01 2.85 87 BODY_URI_ONLY 3606 1.36 4.79 0.00 88 BAYES_00 3604 9.21 4.79 10.95 89 HTML_IMAGE_RATIO_04 3508 6.34 4.66 7.01 90 XM_B_SpammyTLD 3391 2.90 4.51 2.26 91 XMStrtUSub 3387 5.44 4.50 5.82 92 MIXED_HREF_CASE 3295 1.24 4.38 0.00 93 MIXED_CENTER_CASE 3295 1.24 4.38 0.00 94 MIXED_IMG_CASE 3289 1.24 4.37 0.00 95 MIXED_AREA_CASE 3289 1.24 4.37 0.00 96 MIXED_CTYPE_CASE 3288 1.24 4.37 0.00 97 RDNS_DYNAMIC 3218 1.75 4.28 0.76 98 BAYES_95 3176 3.33 4.22 2.98 99 RCVD_IN_RP_CERTIFIED 3140 8.00 4.17 9.52 100 XMNumbers 2990 4.00 3.97 4.02 101 MIXED_FONT_CASE 2961 1.11 3.93 0.00 102 XM_SPF_SoftFail 2819 2.00 3.75 1.30 103 XM_B_Investor 2720 1.76 3.61 1.03 104 TVD_RCVD_IP 2698 2.89 3.58 2.62 105 SpammyFromTLD_01 2552 1.22 3.39 0.36 106 TM2_M_URI_OPT_OUT 2404 3.77 3.19 4.00 107 HTML_FONT_SIZE_LARGE 2369 0.97 3.15 0.11 108 T_XMDrugObfuBody_08 2367 2.21 3.14 1.85 109 URI_GOOG_STO_SPAMMY 2359 0.89 3.13 0.00 110 T_TooManySym_01 2297 5.80 3.05 6.89 111 XM_OfRef6 2208 1.58 2.93 1.04 112 MIME_HTML_ONLY_MULTI 2185 3.36 2.90 3.54 113 XM_UB60 2176 0.86 2.89 0.06 114 T_XMDrugObfuBody_14 2048 2.70 2.72 2.70 115 XM_DIRTYINTL 1934 0.91 2.57 0.26 116 XM_B_Phish66 1894 1.38 2.52 0.93 117 BAYES_40 1873 3.74 2.49 4.23 118 URI_NOVOWEL 1868 2.42 2.48 2.39 119 TR_XM_SpammyWords5 1769 1.72 2.35 1.47 120 HTML_FONT_SIZE_HUGE 1756 0.70 2.33 0.06 121 DIET_1 1673 0.95 2.22 0.45 122 HTML_IMAGE_RATIO_08 1637 2.87 2.17 3.15 123 XM_UB80 1635 0.63 2.17 0.01 124 T_FILL_THIS_FORM_SHORT 1627 0.98 2.16 0.51 125 MIME_QP_LONG_LINE 1624 3.20 2.16 3.61 126 TM2_M_VERY_LONG_WORD 1597 1.66 2.12 1.48 127 XM_B_SpammyWords4 1592 0.87 2.12 0.38 128 GOOG_STO_IMG_HTML 1573 0.59 2.09 0.00 129 T_XMHurry_00 1563 1.03 2.08 0.62 130 PDS_OTHER_BAD_TLD 1553 1.04 2.06 0.64 131 XM_CamelCaseFrm001 1540 1.96 2.05 1.92 132 XMBrknScrpt_02 1538 1.79 2.04 1.69 133 XMBody_17 1520 0.93 2.02 0.50 134 T_XMDrugObfuBody_00 1519 0.98 2.02 0.57 135 XMBdyGiftCard01 1466 1.42 1.95 1.21 136 TR_XM_SB_Phish 1415 1.77 1.88 1.73 137 FROM_EXCESS_BASE64 1407 3.14 1.87 3.64 138 XMSubPhish11 1401 1.75 1.86 1.71 139 TR_Symld_Words 1344 1.64 1.79 1.59 140 SUBJ_ALL_CAPS 1342 1.32 1.78 1.14 141 BAYES_20 1334 2.57 1.77 2.89 142 XM_DK_Undo_01 1326 1.57 1.76 1.49 143 TR_XM_Spammywords 1308 0.67 1.74 0.25 144 XM_S_SpammyWords 1308 0.67 1.74 0.25 145 RELAYCOUNTRY_IN 1308 0.53 1.74 0.05 146 XM_B_Unsub2 1296 1.18 1.72 0.96 147 MAILING_LIST_MULTI 1292 2.06 1.72 2.19 148 USER_IN_DEF_DKIM_WL 1268 12.21 1.68 16.37 149 ALL_TRUSTED 1268 12.39 1.68 16.62 150 XMStockSpam_06 1257 1.77 1.67 1.80 151 HTML_FONT_FACE_BAD 1257 1.42 1.67 1.33 152 XM_UB99 1215 0.46 1.61 0.00 153 RCVD_IN_IADB_LISTED 1206 3.15 1.60 3.76 154 URI_HEX 1182 1.41 1.57 1.34 155 TR_XM_BayesRelay 1167 0.44 1.55 0.01 156 XMSexyCombo_01 1159 0.73 1.54 0.41 157 TR_XM_INV_DKIM 1118 0.59 1.49 0.24 158 XM_H_PHPMailer 1097 0.76 1.46 0.48 159 XM_Body_Dirty_Words_01 1091 0.55 1.45 0.19 160 XM_URI_RBL 1083 0.53 1.44 0.17 161 XM_B_COVIDMETA 1056 0.90 1.40 0.70 162 XM_H_Undi_Recip 1049 0.52 1.39 0.18 163 RCVD_IN_IADB_SPF 1039 2.74 1.38 3.27 164 URIBL_BLACK 998 0.38 1.33 0.01 165 XMPhish30 991 1.41 1.32 1.45 166 HK_RANDOM_REPLYTO 991 0.44 1.32 0.10 167 JH_SPAMMY_HEADERS 985 0.37 1.31 0.00 168 XMNoVowels 984 1.48 1.31 1.55 169 RCVD_IN_IADB_DK 970 2.40 1.29 2.84 170 RCVD_IN_MSPIKE_BL 960 0.41 1.28 0.07 171 RCVD_IN_IADB_SENDERID 954 2.47 1.27 2.94 172 TR_LOTS_OF_MONEY3 952 0.59 1.26 0.33 173 TR_XM_MSPIKECOMBO 951 0.40 1.26 0.06 174 SUBJ_DOLLARS 933 0.52 1.24 0.24 175 RELAYCOUNTRY_NL 914 0.47 1.21 0.17 176 RCVD_IN_MSPIKE_L3 912 0.39 1.21 0.06 177 XMPhish08 897 0.49 1.19 0.22 178 TR_Mismatch_TLD_01 883 0.54 1.17 0.29 179 TR_XM_FormFill 847 0.32 1.13 0.01 180 XM_UB999 842 0.32 1.12 0.00 181 SHOPIFY_IMG_NOT_RCVD_SFY 830 0.46 1.10 0.21 182 RCVD_IN_PSBL 822 0.44 1.09 0.19 183 TR_XM_Undi_Recip6 801 0.30 1.06 0.00 184 TO_NO_BRKTS_PCNT 797 0.30 1.06 0.00 185 URI_TRY_3LD 783 1.00 1.04 0.99 186 HTML_IMAGE_ONLY_16 774 0.46 1.03 0.23 187 XMSubMetaI_00 756 0.82 1.00 0.75 188 RELAYCOUNTRY_AU 722 0.40 0.96 0.17 189 BAYES_05 719 1.69 0.96 1.98 190 MISSING_HEADERS 716 0.48 0.95 0.29 191 TR_LOTS_OF_MONEY2 710 0.54 0.94 0.38 192 URI_PHP_REDIR 710 0.29 0.94 0.04 193 T_MONEY_PERCENT 710 0.54 0.94 0.38 194 TR_BOTNET_NEGATE 708 0.38 0.94 0.16 195 XM_ProductURIs 687 0.76 0.91 0.70 196 RELAYCOUNTRY_DE 687 0.42 0.91 0.23 197 XM_H_PHPOS_M 682 0.30 0.91 0.07 198 NUMERIC_HTTP_ADDR 676 0.54 0.90 0.40 199 XM_B_COPY_HTML 669 0.82 0.89 0.80 200 DKIM_ADSP_CUSTOM_MED 661 0.95 0.88 0.98 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 160416 87.24 94.89 84.22 2 RELAYCOUNTRY_US 154265 78.55 72.36 80.99 3 DKIM_SIGNED 143201 75.83 77.47 75.18 4 XM_DK_Pass 140558 74.04 74.67 73.80 5 XM_B_Unicode 138058 73.03 74.42 72.48 6 DKIM_VALID 137771 72.37 72.47 72.33 7 DKIM_VALID_AU 112745 58.09 55.30 59.19 8 DCC_CHECK_NEGATIVE 100672 43.65 20.35 52.86 9 BAYES_50 99775 48.36 38.17 52.38 10 XMListUnsubscribeExists 97522 54.47 62.74 51.20 11 DCC_CHECK 89736 56.32 79.61 47.11 12 XM_B_Unicode3 86872 44.42 41.39 45.61 13 XM_B_SpammyWords 82628 49.50 64.97 43.38 14 RCVD_IN_MSPIKE_WL 66706 31.61 22.99 35.02 15 HTML_FONT_LOW_CONTRAST 63348 33.25 33.22 33.26 16 LOC_TINY_FONT_1 56329 32.86 41.18 29.57 17 DKIM_VALID_EF 54049 28.19 27.72 28.38 18 FVGT_m_MULTI_ODD 46901 24.65 24.72 24.62 19 T_TM2_M_HEADER_IN_MSG 44436 21.91 18.31 23.33 20 MIME_HTML_ONLY 42730 24.61 30.11 22.43 21 XMSubLong 40811 20.97 19.83 21.43 22 XM_B_SpammyWords2 37038 24.82 38.41 19.45 23 RCVD_IN_MSPIKE_H2 35197 19.29 21.36 18.48 24 RCVD_IN_MSPIKE_H4 32729 15.50 11.24 17.18 25 ALL_TRUSTED 31664 12.39 1.68 16.62 26 USER_IN_DEF_DKIM_WL 31184 12.21 1.68 16.37 27 T_KAM_HTML_FONT_INVALID 31164 18.31 23.24 16.36 28 RCVD_IN_MSPIKE_H3 27792 13.61 11.14 14.59 29 XM_Multi_Part_URI 25906 13.95 14.84 13.60 30 XM_Body_Dirty_Words 23129 14.55 20.65 12.14 31 XM_B_Unsub 22096 13.79 19.33 11.60 32 BAYES_00 20861 9.21 4.79 10.95 33 XM_DKIMWhitelistDomains 20832 7.85 0.03 10.94 34 BAYES_60 20786 10.05 7.86 10.91 35 RCVD_IN_RP_SAFE 20189 9.16 5.53 10.60 36 FSL_BULK_SIG 18641 13.31 22.23 9.79 37 XM_Evil_Numbers_Gen 18289 9.03 7.58 9.60 38 RCVD_IN_RP_CERTIFIED 18123 8.00 4.17 9.52 39 UNPARSEABLE_RELAY 17703 10.90 14.95 9.29 40 BAYES_99 16838 15.21 31.31 8.84 41 XM_DK_Undo_02 16613 17.73 40.51 8.72 42 XM_SendGrid 15935 9.26 11.51 8.37 43 LotsOfNums_01 15751 7.51 5.57 8.27 44 BAYES_999 14497 12.40 24.52 7.61 45 TR_XM_UnparsRelay 14053 9.43 14.63 7.38 46 HTML_IMAGE_RATIO_02 13970 8.03 9.80 7.33 47 HTML_IMAGE_RATIO_04 13352 6.34 4.66 7.01 48 T_TooManySym_01 13119 5.80 3.05 6.89 49 TR_XM_DK_Bayes 13097 5.08 0.53 6.88 50 TooManyTo_001 12912 6.54 5.95 6.78 51 TR_XM_DK_Bayes1 12853 4.98 0.52 6.75 52 LOTS_OF_MONEY 12311 7.63 10.59 6.46 53 TR_XM_DKIM_Undo 12171 13.68 32.12 6.39 54 TR_XM_DK_Bayes2 11505 4.45 0.43 6.04 55 BOTNET_IPINHOSTNAME 11103 9.03 17.15 5.83 56 XMStrtUSub 11077 5.44 4.50 5.82 57 XM_H_Long_From01 10017 5.25 5.22 5.26 58 TR_XM_DK_SendGrid 9996 5.77 7.10 5.25 59 MPART_ALT_DIFF 9817 5.71 7.11 5.15 60 XM_H_Trusted_IP 9437 3.55 0.00 4.95 61 BAYES_80 9211 5.83 8.36 4.84 62 XMSexyCombo_05 8556 5.90 9.46 4.49 63 XM_UncommonTLD01 8479 7.97 16.88 4.45 64 BAYES_40 8060 3.74 2.49 4.23 65 XMSubMetaSx_00 7953 4.93 6.84 4.18 66 TR_DCC_Bayes_99 7917 9.99 24.77 4.16 67 XMNumbers 7652 4.00 3.97 4.02 68 TM2_M_URI_OPT_OUT 7626 3.77 3.19 4.00 69 TR_XM_SpammyWords4 7550 5.39 8.98 3.96 70 T_TooManySym_02 7444 2.95 0.54 3.91 71 XM_B_Phish_Phrases 7295 4.21 5.18 3.83 72 HTML_IMAGE_RATIO_06 7291 4.68 6.83 3.83 73 XM_B_SpammyWords3 7172 6.57 13.66 3.77 74 RCVD_IN_IADB_LISTED 7167 3.15 1.60 3.76 75 INVALID_MSGID 6987 2.74 0.38 3.67 76 FROM_EXCESS_BASE64 6934 3.14 1.87 3.64 77 MIME_QP_LONG_LINE 6869 3.20 2.16 3.61 78 MIME_HTML_ONLY_MULTI 6745 3.36 2.90 3.54 79 MSGID_NOFQDN1 6723 2.59 0.21 3.53 80 BOUNCE_MESSAGE 6621 2.66 0.59 3.48 81 ANY_BOUNCE_MESSAGE 6621 2.66 0.59 3.48 82 TR_XM_PhishingBody 6262 3.98 5.74 3.29 83 RCVD_IN_IADB_SPF 6236 2.74 1.38 3.27 84 RCVD_IN_MSPIKE_H5 6185 2.50 0.60 3.25 85 TO_MALFORMED 6026 2.29 0.07 3.16 86 HTML_IMAGE_RATIO_08 5991 2.87 2.17 3.15 87 T_REMOTE_IMAGE 5808 4.14 6.89 3.05 88 BAYES_95 5667 3.33 4.22 2.98 89 RELAYCOUNTRY_META 5616 9.15 24.84 2.95 90 RCVD_IN_IADB_SENDERID 5601 2.47 1.27 2.94 91 BAYES_20 5499 2.57 1.77 2.89 92 DKIM_INVALID 5430 3.46 5.01 2.85 93 RCVD_IN_IADB_DK 5414 2.40 1.29 2.84 94 T_XMDrugObfuBody_14 5136 2.70 2.72 2.70 95 TVD_RCVD_IP 4993 2.89 3.58 2.62 96 XMSubNoVowel 4778 2.03 0.83 2.51 97 URI_NOVOWEL 4558 2.42 2.48 2.39 98 RCVD_IN_IADB_VOUCHED 4494 1.91 0.78 2.36 99 IN_HORDE_ADDRESS_BOOK 4432 1.69 0.09 2.33 100 XM_B_SpammyTLD 4312 2.90 4.51 2.26 101 XM_PDF 4180 1.70 0.46 2.19 102 MIME_HTML_MOSTLY 4179 3.00 5.05 2.19 103 MAILING_LIST_MULTI 4174 2.06 1.72 2.19 104 XMBSHREFv2 3900 1.54 0.25 2.05 105 BAYES_05 3762 1.69 0.96 1.98 106 TR_XM_SpammyWords2 3716 4.87 12.27 1.95 107 XM_CamelCaseFrm001 3658 1.96 2.05 1.92 108 T_XMDrugObfuBody_08 3515 2.21 3.14 1.85 109 XMStockSpam_06 3437 1.77 1.67 1.80 110 HELO_MISC_IP 3397 1.31 0.09 1.78 111 TR_XM_SB_Phish 3290 1.77 1.88 1.73 112 XMSubPhish11 3262 1.75 1.86 1.71 113 XMBrknScrpt_02 3227 1.79 2.04 1.69 114 XMGappySubj_01 3134 1.22 0.15 1.65 115 HTML_MIME_NO_HTML_TAG 3038 2.99 6.50 1.60 116 TR_Symld_Words 3019 1.64 1.79 1.59 117 XMNoVowels 2948 1.48 1.31 1.55 118 XM_DK_Undo_01 2842 1.57 1.76 1.49 119 TooManyTo_002 2840 1.28 0.74 1.49 120 TM2_M_VERY_LONG_WORD 2825 1.66 2.12 1.48 121 RCVD_IN_IADB_OPTIN 2799 1.22 0.59 1.47 122 TR_XM_SpammyWords5 2798 1.72 2.35 1.47 123 XMPhish30 2764 1.41 1.32 1.45 124 BOTNET 2628 5.55 16.12 1.38 125 XM_GoogleGroups 2569 1.14 0.62 1.35 126 URI_HEX 2555 1.41 1.57 1.34 127 TVD_SPACE_RATIO_MINFP 2527 1.09 0.49 1.33 128 HTML_FONT_FACE_BAD 2525 1.42 1.67 1.33 129 XM_SPF_SoftFail 2483 2.00 3.75 1.30 130 TR_XM_SpammyRelay 2417 4.75 13.56 1.27 131 UNTRUSTED_Relay 2358 6.57 20.08 1.24 132 XM_RXBody 2345 1.00 0.41 1.23 133 XMBdyGiftCard01 2312 1.42 1.95 1.21 134 T_TooManySym_03 2245 0.88 0.13 1.18 135 HTML_IMAGE_ONLY_20 2203 0.87 0.15 1.16 136 SUBJ_ALL_CAPS 2162 1.32 1.78 1.14 137 XM_H_Long_From02 2100 1.00 0.75 1.10 138 XMDiploma_00 2096 2.27 5.22 1.10 139 TooManyTo_003 2027 0.95 0.65 1.06 140 XM_OfRef6 1979 1.58 2.93 1.04 141 XM_B_Investor 1965 1.76 3.61 1.03 142 KHOP_HELO_FCRDNS 1910 2.54 6.43 1.00 143 URI_TRY_3LD 1882 1.00 1.04 0.99 144 XM_B_DNDMA 1881 0.83 0.43 0.99 145 DKIM_ADSP_CUSTOM_MED 1863 0.95 0.88 0.98 146 XM_B_Unsub2 1836 1.18 1.72 0.96 147 XMBody_95 1804 0.74 0.20 0.95 148 XM_B_Phish66 1777 1.38 2.52 0.93 149 XMAntiAgingB 1755 0.67 0.02 0.92 150 RCVD_IN_BL_SPAMCOP_NET 1737 4.87 14.89 0.91 151 TooManyTo_004 1565 0.76 0.61 0.82 152 RELAYCOUNTRY_CA 1550 2.10 5.36 0.81 153 XM_UB50 1523 2.59 7.11 0.80 154 XM_B_COPY_HTML 1519 0.82 0.89 0.80 155 RDNS_DYNAMIC 1439 1.75 4.28 0.76 156 XMLngstWrd_00 1431 0.70 0.56 0.75 157 XMSubMetaI_00 1430 0.82 1.00 0.75 158 IN_ZIMBRA_NJ_WHITELIST 1363 0.52 0.01 0.72 159 TR_MetaPhish_Combo_01 1332 0.73 0.79 0.70 160 XM_B_COVIDMETA 1329 0.90 1.40 0.70 161 XM_ProductURIs 1327 0.76 0.91 0.70 162 TooManyTo_005 1312 0.65 0.55 0.69 163 USER_IN_WELCOMELIST 1311 0.49 0.00 0.69 164 USER_IN_WHITELIST 1311 0.49 0.00 0.69 165 XMHTMLBadTable_001 1281 0.68 0.71 0.67 166 XMHTML_After_End 1271 0.70 0.77 0.67 167 XMLngstWrd_01 1249 0.62 0.52 0.66 168 PDS_OTHER_BAD_TLD 1212 1.04 2.06 0.64 169 NML_ADSP_CUSTOM_MED 1185 0.68 0.81 0.62 170 T_XMHurry_00 1183 1.03 2.08 0.62 171 XMPhish14 1182 0.64 0.69 0.62 172 XM_B_REG_HTML 1139 0.66 0.81 0.60 173 T_XMDrugObfuBody_00 1092 0.98 2.02 0.57 174 FORGED_GMAIL_RCVD 1081 0.61 0.73 0.57 175 TVD_SPACE_RATIO 1081 0.51 0.38 0.57 176 XMLngstWrd_02 1079 0.54 0.49 0.57 177 T_TooManySym_04 1072 0.42 0.05 0.56 178 XMSubMetaSxObfu_02 1048 0.47 0.27 0.55 179 DATE_IN_PAST_03_06 1032 0.61 0.80 0.54 180 HTTPS_HTTP_MISMATCH 1029 0.60 0.77 0.54 181 TR_MSPIKEBAYES00 1024 0.39 0.02 0.54 182 RELAYCOUNTRY_GB 1022 0.61 0.79 0.54 183 DKIM_ADSP_NXDOMAIN 1003 0.62 0.85 0.53 184 MPART_ALT_DIFF_COUNT 1000 0.62 0.86 0.53 185 XMCapTrack 965 0.45 0.32 0.51 186 T_FILL_THIS_FORM_SHORT 965 0.98 2.16 0.51 187 NO_DNS_FOR_FROM 949 0.55 0.68 0.50 188 XMBody_17 948 0.93 2.02 0.50 189 XM_H_PHPMailer 920 0.76 1.46 0.48 190 HELO_NODOT 907 0.53 0.68 0.48 191 HELO_NO_DOMAIN 907 0.53 0.68 0.48 192 XMGenDplmaNmb 902 0.57 0.81 0.47 193 DIET_1 860 0.95 2.22 0.45 194 XMLngstWrd_03 824 0.44 0.47 0.43 195 HTML_TAG_BALANCE_BODY 816 0.55 0.85 0.43 196 PLING_QUERY 803 0.44 0.47 0.42 197 XM_S_SubURI 794 0.31 0.04 0.42 198 XMSexyCombo_01 782 0.73 1.54 0.41 199 NUMERIC_HTTP_ADDR 771 0.54 0.90 0.40 200 CTE_8BIT_MISMATCH 730 0.28 0.01 0.38 ----------------------------------------------------------------------