Email: 241513 Autolearn: 0 AvgScore: 2.27 AvgScanTime: 1.38 sec Spam: 60610 Autolearn: 0 AvgScore: 14.62 AvgScanTime: 1.60 sec Ham: 180903 Autolearn: 0 AvgScore: -1.87 AvgScanTime: 1.31 sec Time Spent Running SA: 92.65 hours Time Spent Processing Spam: 26.95 hours Time Spent Processing Ham: 65.70 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 56884 86.01 93.85 83.38 2 DKIM_SIGNED 49441 76.14 81.57 74.33 3 XM_DK_Pass 47960 74.79 79.13 73.34 4 DCC_CHECK 47714 54.76 78.72 46.73 5 DKIM_VALID 46727 73.25 77.09 71.96 6 XM_B_Unicode 45623 72.34 75.27 71.36 7 RELAYCOUNTRY_US 44750 77.98 73.83 79.37 8 XMListUnsubscribeExists 41550 55.30 68.55 50.86 9 XM_B_SpammyWords 38324 49.42 63.23 44.79 10 DKIM_VALID_AU 35618 58.90 58.77 58.94 11 XM_B_Unicode3 28264 45.51 46.63 45.14 12 XM_DK_Undo_02 26228 18.29 43.27 9.92 13 BAYES_50 26065 49.61 43.00 51.82 14 LOC_TINY_FONT_1 21344 30.64 35.22 29.11 15 XM_B_SpammyWords2 21073 23.33 34.77 19.49 16 HTML_FONT_LOW_CONTRAST 20611 32.82 34.01 32.42 17 TR_XM_DKIM_Undo 20419 14.27 33.69 7.77 18 MIME_HTML_ONLY 19966 26.31 32.94 24.09 19 BAYES_99 18143 14.27 29.93 9.02 20 DKIM_VALID_EF 17273 28.41 28.50 28.38 21 T_KAM_HTML_FONT_INVALID 16527 18.99 27.27 16.22 22 FVGT_m_MULTI_ODD 15860 24.50 26.17 23.94 23 RCVD_IN_MSPIKE_H2 14408 19.85 23.77 18.53 24 BAYES_999 14408 11.64 23.77 7.57 25 RELAYCOUNTRY_META 14040 8.16 23.16 3.13 26 TR_DCC_Bayes_99 13989 9.46 23.08 4.90 27 XMSubLong 13825 22.06 22.81 21.81 28 RCVD_IN_MSPIKE_WL 13417 31.48 22.14 34.61 29 DCC_CHECK_NEGATIVE 12869 45.21 21.23 53.24 30 XM_Body_Dirty_Words 12440 14.02 20.52 11.84 31 T_TM2_M_HEADER_IN_MSG 11091 21.20 18.30 22.17 32 UNTRUSTED_Relay 10791 5.49 17.80 1.37 33 XM_UncommonTLD01 10695 7.86 17.65 4.59 34 FSL_BULK_SIG 10601 11.83 17.49 9.94 35 XM_Multi_Part_URI 9847 14.89 16.25 14.43 36 BOTNET 9564 5.13 15.78 1.56 37 BOTNET_IPINHOSTNAME 9369 8.23 15.46 5.81 38 UNPARSEABLE_RELAY 9031 10.38 14.90 8.87 39 TR_XM_SpammyRelay 9012 4.82 14.87 1.45 40 TR_XM_UnparsRelay 8823 8.80 14.56 6.87 41 RCVD_IN_BL_SPAMCOP_NET 7627 4.08 12.58 1.23 42 SpammyFromTLD_02 7617 3.30 12.57 0.20 43 RCVD_IN_MSPIKE_H3 7258 14.83 11.97 15.79 44 XM_B_Unsub 6810 12.16 11.24 12.48 45 XM_B_SpammyWords3 6788 6.35 11.20 4.72 46 XM_SendGrid 6614 8.74 10.91 8.02 47 TR_XM_SpammyWords2 6429 4.36 10.61 2.27 48 HTML_MIME_NO_HTML_TAG 6426 4.30 10.60 2.18 49 XMSexyCombo_05 6143 5.97 10.14 4.58 50 RCVD_IN_MSPIKE_H4 5854 14.17 9.66 15.68 51 MPART_ALT_DIFF 5844 6.62 9.64 5.60 52 HTML_IMAGE_RATIO_02 5801 8.62 9.57 8.30 53 T_REMOTE_IMAGE 5601 4.73 9.24 3.22 54 XM_UB50 5007 2.64 8.26 0.76 55 KHOP_HELO_FCRDNS 4787 2.53 7.90 0.73 56 XM_Evil_Numbers_Gen 4758 9.06 7.85 9.47 57 XMNumbers 4754 5.47 7.84 4.67 58 LOTS_OF_MONEY 4683 6.39 7.73 5.95 59 T_HTML_TAG_BALANCE_CENTER 4562 1.94 7.53 0.06 60 TooManyTo_001 4445 6.62 7.33 6.38 61 BAYES_60 4414 9.72 7.28 10.53 62 MIME_HTML_MOSTLY 4394 3.52 7.25 2.27 63 HTML_IMAGE_ONLY_08 4384 1.88 7.23 0.08 64 XMSubMetaSx_00 4285 4.43 7.07 3.55 65 BAYES_80 4234 5.16 6.99 4.55 66 RELAYCOUNTRY_CA 4116 2.35 6.79 0.86 67 BODY_URI_ONLY 3832 1.59 6.32 0.01 68 TR_XM_SPAMCOP 3697 1.79 6.10 0.35 69 MIXED_CENTER_CASE 3640 1.51 6.01 0.00 70 MIXED_HREF_CASE 3639 1.51 6.00 0.00 71 MIXED_IMG_CASE 3633 1.51 5.99 0.00 72 MIXED_AREA_CASE 3632 1.50 5.99 0.00 73 MIXED_CTYPE_CASE 3628 1.50 5.99 0.00 74 TR_XM_SpammyWords4 3511 4.27 5.79 3.76 75 HTML_FONT_SIZE_LARGE 3419 1.54 5.64 0.16 76 XM_H_Long_From01 3409 5.59 5.62 5.58 77 XMStrtUSub 3402 6.00 5.61 6.13 78 LotsOfNums_01 3330 7.88 5.49 8.68 79 TR_XM_DK_SendGrid 3305 5.07 5.45 4.94 80 TR_XM_PhishingBody 3293 3.10 5.43 2.31 81 HTML_IMAGE_RATIO_04 3281 6.77 5.41 7.22 82 MIXED_FONT_CASE 3231 1.34 5.33 0.00 83 URIBL_DBL_SPAM 2955 1.23 4.88 0.00 84 XM_B_SpammyTLD 2793 2.91 4.61 2.33 85 URI_GOOG_STO_SPAMMY 2786 1.15 4.60 0.00 86 RCVD_IN_MSPIKE_BL 2769 1.20 4.57 0.07 87 XM_B_Phish_Phrases 2756 4.39 4.55 4.34 88 DKIM_INVALID 2714 2.89 4.48 2.36 89 HTML_IMAGE_RATIO_06 2573 3.94 4.25 3.84 90 TR_XM_MSPIKECOMBO 2559 1.11 4.22 0.07 91 XM_SPF_SoftFail 2516 1.88 4.15 1.11 92 RCVD_IN_MSPIKE_L3 2497 1.09 4.12 0.07 93 URI_NOVOWEL 2467 2.22 4.07 1.60 94 BAYES_95 2376 3.16 3.92 2.91 95 SpammyFromTLD_01 2325 1.23 3.84 0.36 96 TR_XM_PHPDW 2256 1.18 3.72 0.33 97 T_TooManySym_01 2250 6.84 3.71 7.89 98 RCVD_IN_RP_SAFE 2188 9.40 3.61 11.34 99 XM_B_Investor 2172 1.72 3.58 1.10 100 TR_XM_PHPForged 2158 1.09 3.56 0.26 101 TR_XM_FormFill2 2124 1.07 3.50 0.26 102 XM_H_PHPOS 2111 1.06 3.48 0.25 103 RELAYCOUNTRY_IN 2103 0.90 3.47 0.04 104 BOTNET_NORDNS 2097 0.87 3.46 0.01 105 TR_XM_SpammyWords5 2038 2.19 3.36 1.80 106 T_FILL_THIS_FORM_SHORT 1997 1.20 3.29 0.49 107 MIME_HTML_ONLY_MULTI 1889 3.61 3.12 3.77 108 T_XMDrugObfuBody_14 1873 2.91 3.09 2.84 109 RCVD_IN_RP_RNBL 1832 0.81 3.02 0.07 110 TR_XM_NoHeaderRelay 1807 0.87 2.98 0.17 111 TM2_M_URI_OPT_OUT 1794 3.84 2.96 4.13 112 HTML_IMAGE_RATIO_08 1682 2.47 2.78 2.37 113 BAYES_40 1653 4.14 2.73 4.62 114 XM_GoogleGroups 1648 2.05 2.72 1.82 115 XM_CamelCaseFrm001 1606 2.02 2.65 1.81 116 JH_SPAMMY_HEADERS 1602 0.66 2.64 0.00 117 XM_B_Phish66 1588 1.27 2.62 0.82 118 XM_DIRTYINTL 1585 0.82 2.62 0.21 119 GOOG_STO_IMG_HTML 1556 0.64 2.57 0.00 120 RCVD_IN_VALIDITY_RPBL 1551 0.68 2.56 0.06 121 BAYES_00 1514 9.29 2.50 11.56 122 XMSubMetaI_00 1486 1.41 2.45 1.06 123 T_XMDrugObfuBody_08 1441 1.59 2.38 1.33 124 TR_XM_SpammyWords3 1434 0.61 2.37 0.02 125 BAYES_20 1403 2.79 2.31 2.95 126 HTML_FONT_SIZE_HUGE 1395 0.63 2.30 0.07 127 TM2_M_VERY_LONG_WORD 1391 1.79 2.30 1.62 128 PDS_OTHER_BAD_TLD 1370 1.00 2.26 0.57 129 XMBrknScrpt_02 1359 1.65 2.24 1.45 130 RCVD_IN_RP_CERTIFIED 1355 7.88 2.24 9.77 131 USER_IN_DEF_DKIM_WL 1348 13.24 2.22 16.93 132 XM_OfRef6 1335 1.24 2.20 0.92 133 XMDiploma_00 1335 1.47 2.20 1.23 134 HTML_TITLE_SUBJ_DIFF 1323 1.05 2.18 0.67 135 HTML_IMAGE_ONLY_20 1301 1.83 2.15 1.73 136 MIME_QP_LONG_LINE 1288 3.19 2.13 3.54 137 XM_DK_Undo_01 1259 1.51 2.08 1.32 138 XMBody_17 1249 0.79 2.06 0.36 139 DIET_1 1240 0.89 2.05 0.51 140 HTML_SHORT_LINK_IMG_3 1224 0.99 2.02 0.64 141 RCVD_IN_VALIDITY_SAFE 1220 7.82 2.01 9.77 142 MAILING_LIST_MULTI 1213 2.06 2.00 2.08 143 XM_UB60 1182 0.54 1.95 0.06 144 ALL_TRUSTED 1129 14.05 1.86 18.13 145 URI_HEX 1091 1.44 1.80 1.32 146 RELAYCOUNTRY_NL 1065 0.55 1.76 0.14 147 XM_B_SpammyWords4 1038 0.82 1.71 0.52 148 FROM_EXCESS_BASE64 1031 3.17 1.70 3.66 149 XM_B_Unsub2 1025 1.75 1.69 1.77 150 XMSexyCombo_01 1024 0.71 1.69 0.38 151 XM_UB99 1013 0.42 1.67 0.00 152 URIBL_BLACK 980 0.41 1.62 0.01 153 TR_XM_BayesRelay 973 0.41 1.61 0.01 154 XM_H_PHPMailer 969 0.79 1.60 0.52 155 XMBdyGiftCard01 960 1.51 1.58 1.48 156 XMPhish30 940 0.90 1.55 0.68 157 XMStockSpam_06 926 1.90 1.53 2.02 158 RCVD_IN_PSBL 920 0.38 1.52 0.00 159 RELAYCOUNTRY_FR 916 0.50 1.51 0.15 160 TR_XM_FormFill 913 0.39 1.51 0.01 161 RELAYCOUNTRY_DE 900 0.59 1.48 0.29 162 SUBJ_ALL_CAPS 883 1.28 1.46 1.22 163 XM_URI_RBL 879 0.45 1.45 0.11 164 DATE_IN_PAST_03_06 870 0.77 1.44 0.54 165 SHOPIFY_IMG_NOT_RCVD_SFY 868 0.51 1.43 0.21 166 TR_XM_INV_DKIM 852 0.41 1.41 0.08 167 HTML_FONT_FACE_BAD 835 1.36 1.38 1.36 168 BAYES_05 805 1.85 1.33 2.03 169 TR_Mismatch_TLD_02 771 0.38 1.27 0.08 170 TR_BOTNET_NEGATE 760 0.49 1.25 0.24 171 T_XMHurry_00 760 0.64 1.25 0.43 172 TR_XM_SB_Phish 759 2.53 1.25 2.95 173 RCVD_IN_IADB_LISTED 757 2.47 1.25 2.87 174 TR_Mismatch_TLD_01 753 0.50 1.24 0.25 175 RDNS_DYNAMIC 743 0.84 1.23 0.71 176 XM_UB999 724 0.30 1.19 0.00 177 XMSubPhish11 718 2.50 1.18 2.94 178 XMReplyNow 714 0.35 1.18 0.07 179 TR_XM_COVIDMETA4 711 0.41 1.17 0.15 180 XMGenDplmaNmb 708 0.67 1.17 0.50 181 XM_H_Undi_Recip 708 0.40 1.17 0.15 182 FROM_SUSPICIOUS_NTLD 686 0.34 1.13 0.08 183 RCVD_IN_IADB_SPF 683 2.21 1.13 2.57 184 FROM_SUSPICIOUS_NTLD_FP 680 0.34 1.12 0.07 185 XM_B_COPY_HTML 675 0.97 1.11 0.92 186 T_XMDrugObfuBody_00 670 0.90 1.11 0.83 187 RELAYCOUNTRY_AU 668 0.47 1.10 0.26 188 XM_B_COVIDMETA 660 0.94 1.09 0.89 189 RCVD_IN_VALIDITY_CERTIFIED 654 6.55 1.08 8.38 190 DKIM_ADSP_CUSTOM_MED 651 1.01 1.07 0.99 191 RCVD_IN_IADB_DK 650 1.97 1.07 2.27 192 MONEY_NOHTML 639 0.32 1.05 0.07 193 RCVD_IN_IADB_SENDERID 639 2.02 1.05 2.35 194 XM_Body_Dirty_Words_01 636 0.37 1.05 0.15 195 XM_UB80 621 0.27 1.02 0.02 196 XM_H_PHPOS_M 621 0.31 1.02 0.08 197 TR_LOTS_OF_MONEY3 604 0.37 1.00 0.15 198 XMSubNoVowel 597 1.92 0.98 2.23 199 NML_ADSP_CUSTOM_MED 585 0.73 0.97 0.65 200 MPART_ALT_DIFF_COUNT 575 0.67 0.95 0.58 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 150838 86.01 93.85 83.38 2 RELAYCOUNTRY_US 143591 77.98 73.83 79.37 3 DKIM_SIGNED 134457 76.14 81.57 74.33 4 XM_DK_Pass 132675 74.79 79.13 73.34 5 DKIM_VALID 130184 73.25 77.09 71.96 6 XM_B_Unicode 129096 72.34 75.27 71.36 7 DKIM_VALID_AU 106631 58.90 58.77 58.94 8 DCC_CHECK_NEGATIVE 96320 45.21 21.23 53.24 9 BAYES_50 93749 49.61 43.00 51.82 10 XMListUnsubscribeExists 92015 55.30 68.55 50.86 11 DCC_CHECK 84536 54.76 78.72 46.73 12 XM_B_Unicode3 81653 45.51 46.63 45.14 13 XM_B_SpammyWords 81024 49.42 63.23 44.79 14 RCVD_IN_MSPIKE_WL 62611 31.48 22.14 34.61 15 HTML_FONT_LOW_CONTRAST 58656 32.82 34.01 32.42 16 LOC_TINY_FONT_1 52665 30.64 35.22 29.11 17 DKIM_VALID_EF 51333 28.41 28.50 28.38 18 MIME_HTML_ONLY 43584 26.31 32.94 24.09 19 FVGT_m_MULTI_ODD 43315 24.50 26.17 23.94 20 T_TM2_M_HEADER_IN_MSG 40112 21.20 18.30 22.17 21 XMSubLong 39446 22.06 22.81 21.81 22 XM_B_SpammyWords2 35264 23.33 34.77 19.49 23 RCVD_IN_MSPIKE_H2 33521 19.85 23.77 18.53 24 ALL_TRUSTED 32796 14.05 1.86 18.13 25 USER_IN_DEF_DKIM_WL 30630 13.24 2.22 16.93 26 T_KAM_HTML_FONT_INVALID 29348 18.99 27.27 16.22 27 RCVD_IN_MSPIKE_H3 28560 14.83 11.97 15.79 28 RCVD_IN_MSPIKE_H4 28358 14.17 9.66 15.68 29 XM_Multi_Part_URI 26113 14.89 16.25 14.43 30 XM_B_Unsub 22569 12.16 11.24 12.48 31 XM_Body_Dirty_Words 21412 14.02 20.52 11.84 32 BAYES_00 20914 9.29 2.50 11.56 33 XM_DKIMWhitelistDomains 20772 8.60 0.01 11.48 34 RCVD_IN_RP_SAFE 20512 9.40 3.61 11.34 35 BAYES_60 19054 9.72 7.28 10.53 36 FSL_BULK_SIG 17980 11.83 17.49 9.94 37 XM_DK_Undo_02 17953 18.29 43.27 9.92 38 RCVD_IN_RP_CERTIFIED 17677 7.88 2.24 9.77 39 RCVD_IN_VALIDITY_SAFE 17673 7.82 2.01 9.77 40 XM_Evil_Numbers_Gen 17127 9.06 7.85 9.47 41 BAYES_99 16322 14.27 29.93 9.02 42 UNPARSEABLE_RELAY 16039 10.38 14.90 8.87 43 LotsOfNums_01 15701 7.88 5.49 8.68 44 RCVD_IN_VALIDITY_CERTIFIED 15164 6.55 1.08 8.38 45 HTML_IMAGE_RATIO_02 15019 8.62 9.57 8.30 46 XM_SendGrid 14505 8.74 10.91 8.02 47 T_TooManySym_01 14274 6.84 3.71 7.89 48 TR_XM_DK_Bayes 14189 6.03 0.62 7.84 49 TR_XM_DKIM_Undo 14051 14.27 33.69 7.77 50 TR_XM_DK_Bayes1 13893 5.90 0.60 7.68 51 BAYES_999 13698 11.64 23.77 7.57 52 HTML_IMAGE_RATIO_04 13066 6.77 5.41 7.22 53 TR_XM_DK_Bayes2 12647 5.37 0.52 6.99 54 TR_XM_UnparsRelay 12436 8.80 14.56 6.87 55 TooManyTo_001 11550 6.62 7.33 6.38 56 XMStrtUSub 11083 6.00 5.61 6.13 57 LOTS_OF_MONEY 10757 6.39 7.73 5.95 58 BOTNET_IPINHOSTNAME 10505 8.23 15.46 5.81 59 MPART_ALT_DIFF 10134 6.62 9.64 5.60 60 XM_H_Long_From01 10099 5.59 5.62 5.58 61 T_TooManySym_02 9175 3.95 0.59 5.07 62 TR_XM_DK_SendGrid 8935 5.07 5.45 4.94 63 TR_DCC_Bayes_99 8864 9.46 23.08 4.90 64 XM_H_Trusted_IP 8850 3.66 0.00 4.89 65 XM_B_SpammyWords3 8546 6.35 11.20 4.72 66 XMNumbers 8454 5.47 7.84 4.67 67 BAYES_40 8350 4.14 2.73 4.62 68 XM_UncommonTLD01 8299 7.86 17.65 4.59 69 XMSexyCombo_05 8281 5.97 10.14 4.58 70 BAYES_80 8229 5.16 6.99 4.55 71 XM_B_Phish_Phrases 7857 4.39 4.55 4.34 72 ANY_BOUNCE_MESSAGE 7517 3.25 0.55 4.16 73 BOUNCE_MESSAGE 7517 3.25 0.55 4.16 74 TM2_M_URI_OPT_OUT 7472 3.84 2.96 4.13 75 HTML_IMAGE_RATIO_06 6940 3.94 4.25 3.84 76 MIME_HTML_ONLY_MULTI 6827 3.61 3.12 3.77 77 TR_XM_SpammyWords4 6806 4.27 5.79 3.76 78 FROM_EXCESS_BASE64 6629 3.17 1.70 3.66 79 XMSubMetaSx_00 6422 4.43 7.07 3.55 80 MIME_QP_LONG_LINE 6412 3.19 2.13 3.54 81 INVALID_MSGID 6379 2.71 0.29 3.53 82 MSGID_NOFQDN1 6092 2.56 0.15 3.37 83 TO_MALFORMED 5983 2.48 0.01 3.31 84 T_REMOTE_IMAGE 5831 4.73 9.24 3.22 85 RCVD_IN_MSPIKE_H5 5693 2.48 0.50 3.15 86 RELAYCOUNTRY_META 5661 8.16 23.16 3.13 87 BAYES_20 5344 2.79 2.31 2.95 88 TR_XM_SB_Phish 5343 2.53 1.25 2.95 89 XMSubPhish11 5326 2.50 1.18 2.94 90 BAYES_95 5263 3.16 3.92 2.91 91 RCVD_IN_IADB_LISTED 5198 2.47 1.25 2.87 92 T_XMDrugObfuBody_14 5144 2.91 3.09 2.84 93 TVD_RCVD_IP 4764 2.14 0.68 2.63 94 RCVD_IN_IADB_SPF 4649 2.21 1.13 2.57 95 HTML_IMAGE_RATIO_08 4295 2.47 2.78 2.37 96 DKIM_INVALID 4273 2.89 4.48 2.36 97 RCVD_IN_IADB_SENDERID 4249 2.02 1.05 2.35 98 XM_B_SpammyTLD 4223 2.91 4.61 2.33 99 TR_XM_PhishingBody 4184 3.10 5.43 2.31 100 TR_XM_SpammyWords2 4108 4.36 10.61 2.27 101 RCVD_IN_IADB_DK 4107 1.97 1.07 2.27 102 MIME_HTML_MOSTLY 4100 3.52 7.25 2.27 103 XMBSHREFv2 4084 1.74 0.18 2.26 104 XMSubNoVowel 4041 1.92 0.98 2.23 105 IN_HORDE_ADDRESS_BOOK 4040 1.69 0.06 2.23 106 HTML_MIME_NO_HTML_TAG 3950 4.30 10.60 2.18 107 MAILING_LIST_MULTI 3762 2.06 2.00 2.08 108 BAYES_05 3673 1.85 1.33 2.03 109 XMStockSpam_06 3663 1.90 1.53 2.02 110 XM_PDF 3408 1.52 0.44 1.88 111 XM_GoogleGroups 3299 2.05 2.72 1.82 112 XM_CamelCaseFrm001 3270 2.02 2.65 1.81 113 TR_XM_SpammyWords5 3263 2.19 3.36 1.80 114 XM_B_Unsub2 3194 1.75 1.69 1.77 115 HTML_IMAGE_ONLY_20 3128 1.83 2.15 1.73 116 RCVD_IN_IADB_VOUCHED 3027 1.37 0.48 1.67 117 XMGappySubj_01 2948 1.25 0.13 1.63 118 TM2_M_VERY_LONG_WORD 2924 1.79 2.30 1.62 119 URI_NOVOWEL 2896 2.22 4.07 1.60 120 BOTNET 2823 5.13 15.78 1.56 121 XMBdyGiftCard01 2682 1.51 1.58 1.48 122 TR_XM_SpammyRelay 2630 4.82 14.87 1.45 123 XMBrknScrpt_02 2621 1.65 2.24 1.45 124 TVD_SPACE_RATIO 2518 1.08 0.14 1.39 125 UNTRUSTED_Relay 2476 5.49 17.80 1.37 126 HTML_FONT_FACE_BAD 2458 1.36 1.38 1.36 127 T_XMDrugObfuBody_08 2408 1.59 2.38 1.33 128 URI_HEX 2393 1.44 1.80 1.32 129 XM_DK_Undo_01 2379 1.51 2.08 1.32 130 T_TooManySym_03 2276 0.99 0.21 1.26 131 XMDiploma_00 2221 1.47 2.20 1.23 132 RCVD_IN_BL_SPAMCOP_NET 2218 4.08 12.58 1.23 133 SUBJ_ALL_CAPS 2198 1.28 1.46 1.22 134 TR_MetaPhish_Combo_01 2143 1.08 0.77 1.18 135 TR_Symld_Words 2063 1.03 0.68 1.14 136 TooManyTo_002 2039 1.01 0.67 1.13 137 XM_H_SpoofStaff4 2025 0.86 0.09 1.12 138 XM_SPF_SoftFail 2013 1.88 4.15 1.11 139 XM_B_Investor 1984 1.72 3.58 1.10 140 TVD_SPACE_RATIO_MINFP 1972 0.85 0.14 1.09 141 XMSubMetaI_00 1915 1.41 2.45 1.06 142 XM_H_Long_From02 1908 0.99 0.78 1.05 143 RCVD_IN_IADB_OPTIN 1904 0.92 0.53 1.05 144 XM_ProductURIs 1796 0.98 0.92 0.99 145 DKIM_ADSP_CUSTOM_MED 1787 1.01 1.07 0.99 146 XMLngstWrd_00 1689 0.89 0.76 0.93 147 XM_B_COPY_HTML 1670 0.97 1.11 0.92 148 XM_OfRef6 1659 1.24 2.20 0.92 149 XMBody_95 1640 0.70 0.08 0.91 150 XM_B_COVIDMETA 1618 0.94 1.09 0.89 151 RELAYCOUNTRY_CA 1552 2.35 6.79 0.86 152 T_XMDrugObfuBody_00 1507 0.90 1.11 0.83 153 XMLngstWrd_01 1501 0.79 0.65 0.83 154 XM_B_Phish66 1477 1.27 2.62 0.82 155 TR_MSPIKEBAYES00 1452 0.60 0.01 0.80 156 TooManyTo_003 1439 0.73 0.53 0.80 157 XM_UB50 1378 2.64 8.26 0.76 158 USER_IN_WHITELIST 1367 0.57 0.00 0.76 159 USER_IN_WELCOMELIST 1367 0.57 0.00 0.76 160 KHOP_HELO_FCRDNS 1312 2.53 7.90 0.73 161 URI_TRY_3LD 1292 0.71 0.69 0.71 162 XM_B_REG_HTML 1290 0.65 0.45 0.71 163 XMLngstWrd_02 1290 0.69 0.61 0.71 164 RDNS_DYNAMIC 1279 0.84 1.23 0.71 165 XMPhish30 1226 0.90 1.55 0.68 166 HTML_TITLE_SUBJ_DIFF 1207 1.05 2.18 0.67 167 NML_ADSP_CUSTOM_MED 1181 0.73 0.97 0.65 168 XMHTMLBadTable_001 1169 0.66 0.71 0.65 169 NUMERIC_HTTP_ADDR 1164 0.57 0.33 0.64 170 IN_ZIMBRA_NJ_WHITELIST 1161 0.48 0.01 0.64 171 HTML_SHORT_LINK_IMG_3 1155 0.99 2.02 0.64 172 XMSubMetaSxObfu_02 1128 0.57 0.41 0.62 173 T_TooManySym_04 1083 0.47 0.08 0.60 174 TooManyTo_004 1069 0.56 0.47 0.59 175 XMLngstWrd_03 1052 0.58 0.58 0.58 176 MPART_ALT_DIFF_COUNT 1050 0.67 0.95 0.58 177 PDS_OTHER_BAD_TLD 1035 1.00 2.26 0.57 178 DKIM_ADSP_NXDOMAIN 983 0.50 0.38 0.54 179 DATE_IN_PAST_03_06 982 0.77 1.44 0.54 180 XMHTML_After_End 960 0.57 0.69 0.53 181 FORGED_GMAIL_RCVD 959 0.61 0.84 0.53 182 NO_DNS_FOR_FROM 953 0.48 0.33 0.53 183 XM_H_PHPMailer 948 0.79 1.60 0.52 184 RELAYCOUNTRY_GB 936 0.55 0.67 0.52 185 XM_B_SpammyWords4 934 0.82 1.71 0.52 186 XM_B_DNDMA 929 0.51 0.51 0.51 187 XMCapTrack 922 0.45 0.26 0.51 188 XMLngstWrd_04 917 0.52 0.54 0.51 189 DIET_1 916 0.89 2.05 0.51 190 TooManyTo_005 908 0.48 0.42 0.50 191 XMGenDplmaNmb 902 0.67 1.17 0.50 192 T_FILL_THIS_FORM_SHORT 892 1.20 3.29 0.49 193 HTML_TAG_BALANCE_BODY 886 0.55 0.73 0.49 194 XMPhish08 835 0.50 0.63 0.46 195 XMNoVowels 784 0.45 0.49 0.43 196 T_XMHurry_00 776 0.64 1.25 0.43 197 XMSubMetaSxObfu_03 757 0.38 0.26 0.42 198 XM_S_SubURI 755 0.33 0.05 0.42 199 HELO_NO_DOMAIN 745 0.51 0.80 0.41 200 HELO_NODOT 745 0.51 0.80 0.41 ----------------------------------------------------------------------