Email: 283705 Autolearn: 0 AvgScore: -0.78 AvgScanTime: 1.41 sec Spam: 64943 Autolearn: 0 AvgScore: 13.40 AvgScanTime: 1.67 sec Ham: 218762 Autolearn: 0 AvgScore: -4.99 AvgScanTime: 1.33 sec Time Spent Running SA: 111.01 hours Time Spent Processing Spam: 30.19 hours Time Spent Processing Ham: 80.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 61077 85.00 94.05 82.31 2 DKIM_SIGNED 57474 75.86 88.50 72.11 3 XM_DK_Pass 55446 74.08 85.38 70.73 4 DKIM_VALID 53802 72.30 82.84 69.17 5 RELAYCOUNTRY_US 52481 80.72 80.81 80.70 6 XM_B_Unicode 52390 71.32 80.67 68.55 7 DCC_CHECK 49759 51.42 76.62 43.94 8 XMListUnsubscribeExists 47584 53.89 73.27 48.14 9 XM_B_SpammyWords 46232 50.78 71.19 44.72 10 DKIM_VALID_AU 39887 57.17 61.42 55.91 11 XM_B_Unicode3 30375 43.84 46.77 42.96 12 XM_DK_Undo_02 29885 17.92 46.02 9.58 13 BAYES_50 26479 47.44 40.77 49.42 14 XM_B_SpammyWords2 25933 24.92 39.93 20.47 15 TR_XM_DKIM_Undo 23972 14.07 36.91 7.30 16 LOC_TINY_FONT_1 22293 28.23 34.33 26.42 17 HTML_FONT_LOW_CONTRAST 21806 29.78 33.58 28.65 18 BAYES_99 20502 14.09 31.57 8.90 19 DKIM_VALID_EF 19547 27.18 30.10 26.31 20 MIME_HTML_ONLY 18835 24.82 29.00 23.58 21 FVGT_m_MULTI_ODD 18499 23.84 28.48 22.46 22 T_KAM_HTML_FONT_INVALID 17689 18.65 27.24 16.10 23 TR_DCC_Bayes_99 15892 8.98 24.47 4.38 24 BAYES_999 15690 11.32 24.16 7.51 25 RCVD_IN_MSPIKE_WL 15690 28.45 24.16 29.73 26 DCC_CHECK_NEGATIVE 15173 48.55 23.36 56.03 27 XM_Body_Dirty_Words 14986 15.30 23.08 12.99 28 RCVD_IN_MSPIKE_H2 14841 18.80 22.85 17.60 29 XMSubLong 13748 20.85 21.17 20.76 30 T_TM2_M_HEADER_IN_MSG 13727 24.38 21.14 25.35 31 RELAYCOUNTRY_META 12422 6.73 19.13 3.05 32 XM_Multi_Part_URI 11803 14.04 18.17 12.81 33 UNPARSEABLE_RELAY 9669 10.24 14.89 8.86 34 BOTNET_IPINHOSTNAME 9613 7.62 14.80 5.48 35 LOTS_OF_MONEY 9548 9.77 14.70 8.31 36 TR_XM_SpammyRelay 9456 4.45 14.56 1.45 37 TR_XM_UnparsRelay 9209 8.55 14.18 6.88 38 RCVD_IN_BL_SPAMCOP_NET 9120 4.22 14.04 1.31 39 RCVD_IN_MSPIKE_H3 8946 14.00 13.78 14.06 40 BOTNET 8617 4.39 13.27 1.76 41 TR_XM_SpammyWords4 8348 6.80 12.85 5.01 42 XM_B_Unsub 8134 12.87 12.52 12.98 43 FSL_BULK_SIG 7945 10.31 12.23 9.74 44 XM_B_SpammyWords3 7631 5.56 11.75 3.73 45 TR_XM_SpammyWords2 7553 3.91 11.63 1.62 46 XMSexyCombo_05 7316 6.71 11.27 5.35 47 XM_SendGrid 7207 8.69 11.10 7.98 48 UNTRUSTED_Relay 6657 3.28 10.25 1.21 49 RCVD_IN_MSPIKE_H4 6431 12.49 9.90 13.26 50 HTML_IMAGE_RATIO_02 5909 7.92 9.10 7.57 51 MPART_ALT_DIFF 5778 6.19 8.90 5.38 52 XM_UncommonTLD01 5718 5.01 8.80 3.89 53 BAYES_80 5585 5.70 8.60 4.84 54 XMSubMetaSx_00 5098 5.38 7.85 4.65 55 XM_Evil_Numbers_Gen 4999 8.89 7.70 9.24 56 BAYES_60 4907 9.72 7.56 10.36 57 LotsOfNums_01 4540 7.80 6.99 8.04 58 TR_XM_DK_SendGrid 4317 5.71 6.65 5.43 59 XM_H_Long_From01 4183 5.26 6.44 4.91 60 TR_XM_SPAMCOP 4173 1.87 6.43 0.52 61 RELAYCOUNTRY_CA 4060 2.09 6.25 0.86 62 MIME_HTML_MOSTLY 4059 3.33 6.25 2.46 63 TooManyTo_001 4004 6.85 6.17 7.06 64 DKIM_INVALID 3672 3.56 5.65 2.94 65 RCVD_IN_MSPIKE_BL 3538 1.41 5.45 0.21 66 XM_UB50 3472 1.83 5.35 0.78 67 TR_XM_PhishingBody 3471 3.04 5.34 2.36 68 XM_B_Phish_Phrases 3410 4.43 5.25 4.19 69 HTML_IMAGE_RATIO_04 3344 7.29 5.15 7.93 70 XMNumbers 3205 4.18 4.94 3.96 71 URIBL_DBL_SPAM 3118 1.11 4.80 0.01 72 BAYES_95 2981 3.32 4.59 2.94 73 TR_XM_MaxUnsub 2966 2.23 4.57 1.53 74 TR_XM_MSPIKECOMBO 2920 1.19 4.50 0.21 75 XM_SPF_SoftFail 2881 4.13 4.44 4.04 76 XM_B_SpammyTLD 2808 3.81 4.32 3.66 77 MIME_HTML_ONLY_MULTI 2678 3.70 4.12 3.58 78 XM_OfRef6 2676 1.58 4.12 0.83 79 SpammyFromTLD_02 2562 1.24 3.94 0.44 80 SpammyFromTLD_01 2490 1.15 3.83 0.36 81 XM_B_Investor 2471 1.69 3.80 1.06 82 XMStrtUSub 2369 4.71 3.65 5.02 83 T_TooManySym_01 2340 5.85 3.60 6.52 84 TM2_M_URI_OPT_OUT 2330 4.42 3.59 4.66 85 TR_XM_SpammyWords5 2326 2.03 3.58 1.57 86 RCVD_IN_MSPIKE_L3 2315 0.96 3.56 0.19 87 HTML_MIME_NO_HTML_TAG 2295 2.24 3.53 1.86 88 HTML_IMAGE_RATIO_06 2292 3.00 3.53 2.84 89 TR_XM_SpammyWords3 2270 0.87 3.50 0.09 90 MIME_QP_LONG_LINE 2223 4.33 3.42 4.60 91 T_FILL_THIS_FORM_SHORT 2113 1.19 3.25 0.58 92 XM_DIRTYINTL 2067 0.92 3.18 0.24 93 TR_XM_PHPDW 2019 1.00 3.11 0.37 94 T_XMDrugObfuBody_14 1952 2.52 3.01 2.37 95 TR_XM_PHPForged 1907 0.92 2.94 0.32 96 TR_XM_FormFill2 1895 0.92 2.92 0.32 97 XM_H_PHPOS 1888 0.90 2.91 0.31 98 T_REMOTE_IMAGE 1849 3.60 2.85 3.82 99 URI_NOVOWEL 1830 2.25 2.82 2.08 100 XM_B_Phish66 1807 1.40 2.78 0.98 101 RELAYCOUNTRY_IN 1765 0.66 2.72 0.05 102 HTML_SHORT_LINK_IMG_3 1718 0.78 2.65 0.23 103 BOTNET_NORDNS 1698 0.61 2.61 0.02 104 RCVD_IN_RP_SAFE 1679 7.81 2.59 9.36 105 HTML_IMAGE_RATIO_08 1651 2.45 2.54 2.42 106 T_XMDrugObfuBody_08 1637 1.43 2.52 1.10 107 RCVD_IN_RP_RNBL 1624 0.67 2.50 0.13 108 XM_GoogleGroups 1622 1.65 2.50 1.40 109 XM_B_SpammyWords4 1589 0.95 2.45 0.51 110 XM_DK_Undo_01 1589 1.80 2.45 1.61 111 XM_CamelCaseFrm001 1589 1.89 2.45 1.72 112 BAYES_40 1577 3.98 2.43 4.45 113 MAILING_LIST_MULTI 1574 2.09 2.42 1.99 114 PDS_OTHER_BAD_TLD 1538 0.87 2.37 0.43 115 TM2_M_VERY_LONG_WORD 1533 1.44 2.36 1.17 116 ALL_TRUSTED 1532 13.66 2.36 17.02 117 SUBJ_ALL_CAPS 1525 1.51 2.35 1.26 118 KHOP_HELO_FCRDNS 1508 3.45 2.32 3.79 119 RCVD_IN_IADB_LISTED 1506 3.49 2.32 3.84 120 JH_SPAMMY_HEADERS 1481 0.52 2.28 0.00 121 XMSexyCombo_01 1461 1.31 2.25 1.03 122 USER_IN_DEF_DKIM_WL 1380 12.75 2.12 15.90 123 XMBrknScrpt_02 1363 1.11 2.10 0.82 124 RCVD_IN_VALIDITY_RPBL 1350 0.56 2.08 0.11 125 RCVD_IN_IADB_SPF 1332 3.03 2.05 3.33 126 XMBody_17 1323 0.76 2.04 0.38 127 HTML_IMAGE_ONLY_20 1312 1.84 2.02 1.78 128 XM_B_Unsub2 1308 1.50 2.01 1.35 129 XMDiploma_00 1303 1.37 2.01 1.18 130 RCVD_IN_IADB_DK 1256 2.65 1.93 2.86 131 RCVD_IN_IADB_SENDERID 1251 2.74 1.93 2.98 132 T_XMDrugObfuBody_00 1242 1.16 1.91 0.93 133 TR_XM_BayesRelay 1229 0.44 1.89 0.01 134 XM_B_COVIDMETA 1219 1.18 1.88 0.98 135 DIET_1 1200 0.81 1.85 0.50 136 TR_LOTS_OF_MONEY3 1190 0.61 1.83 0.24 137 DKIM_ADSP_CUSTOM_MED 1180 1.11 1.82 0.90 138 BAYES_20 1151 2.97 1.77 3.33 139 HTML_TITLE_SUBJ_DIFF 1147 0.76 1.77 0.46 140 TR_Symld_Words 1121 1.79 1.73 1.81 141 XM_H_Undi_Recip 1112 0.51 1.71 0.15 142 BAYES_00 1096 10.79 1.69 13.49 143 FORGED_GMAIL_RCVD 1090 0.77 1.68 0.50 144 NML_ADSP_CUSTOM_MED 1085 0.81 1.67 0.56 145 XM_URI_RBL 1079 0.55 1.66 0.22 146 XMStockSpam_06 1036 1.54 1.60 1.53 147 XM_H_PHPMailer 1004 0.78 1.55 0.55 148 URIBL_BLACK 987 0.37 1.52 0.03 149 TR_LOTS_OF_MONEY2 980 0.50 1.51 0.20 150 T_MONEY_PERCENT 980 0.50 1.51 0.20 151 URI_HEX 962 1.23 1.48 1.16 152 XM_UB99 959 0.34 1.48 0.00 153 TR_XM_INV_DKIM 951 0.66 1.46 0.42 154 TR_XM_SB_Phish 950 1.68 1.46 1.75 155 XMSubPhish11 945 1.67 1.46 1.73 156 TM2_M_A_HREF_HREF 903 0.74 1.39 0.55 157 TR_XM_FormFill 903 0.35 1.39 0.04 158 FROM_EXCESS_BASE64 891 3.33 1.37 3.92 159 T_XMHurry_00 889 0.63 1.37 0.41 160 MONEY_NOHTML 880 0.37 1.36 0.07 161 SUBJ_DOLLARS 874 0.69 1.35 0.50 162 TR_XM_NoHeaderRelay 874 0.40 1.35 0.12 163 XMPhish30 873 0.87 1.34 0.72 164 RCVD_IN_RP_CERTIFIED 872 6.64 1.34 8.21 165 URI_PHP_REDIR 868 0.31 1.34 0.00 166 XM_Body_Dirty_Words_01 835 0.43 1.29 0.18 167 RCVD_IN_VALIDITY_SAFE 814 6.54 1.25 8.11 168 TR_XM_Spammywords 802 0.39 1.23 0.14 169 XM_S_SpammyWords 802 0.39 1.23 0.14 170 HTML_IMAGE_ONLY_24 800 0.75 1.23 0.61 171 RELAYCOUNTRY_FR 789 0.39 1.21 0.15 172 HTML_IMAGE_ONLY_16 779 0.42 1.20 0.18 173 TR_Sbj_FN_Bdy 777 0.38 1.20 0.14 174 T_TooManySym_02 770 3.42 1.19 4.08 175 SHOPIFY_IMG_NOT_RCVD_SFY 746 0.48 1.15 0.28 176 XM_UB60 741 0.31 1.14 0.07 177 TR_Mismatch_TLD_01 736 0.45 1.13 0.25 178 MONEY_FORM_SHORT 710 0.26 1.09 0.01 179 XMCmmnCold 687 0.27 1.06 0.03 180 XM_H_PHPOS_M 683 0.34 1.05 0.13 181 DKIM_ADSP_NXDOMAIN 676 0.61 1.04 0.48 182 RELAYCOUNTRY_RU 667 0.26 1.03 0.04 183 TR_XM_COVIDMETA1 662 0.42 1.02 0.24 184 TR_XM_MaxSPIKE 662 0.25 1.02 0.03 185 BAYES_05 655 1.97 1.01 2.26 186 RCVD_IN_PSBL 653 0.36 1.01 0.17 187 XM_B_COPY_HTML 652 0.79 1.00 0.72 188 TR_XM_DK_Bayes 652 5.84 1.00 7.27 189 XM_UB999 651 0.23 1.00 0.00 190 XMBdyGiftCard01 649 1.10 1.00 1.13 191 NO_DNS_FOR_FROM 644 0.54 0.99 0.41 192 XMReplyNow 644 0.28 0.99 0.07 193 TR_XM_DK_Bayes1 640 5.72 0.99 7.13 194 HTTPS_HTTP_MISMATCH 624 0.63 0.96 0.54 195 RCVD_IN_MSPIKE_ZBI 618 0.22 0.95 0.00 196 RCVD_IN_IADB_VOUCHED 616 2.06 0.95 2.39 197 XMGenDplmaNmb 616 0.65 0.95 0.56 198 TR_XM_COVIDMETA4 608 0.36 0.94 0.18 199 RELAYCOUNTRY_AU 607 0.36 0.93 0.20 200 XM_Nigeria_01 597 0.30 0.92 0.11 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 180059 85.00 94.05 82.31 2 RELAYCOUNTRY_US 176530 80.72 80.81 80.70 3 DKIM_SIGNED 157748 75.86 88.50 72.11 4 XM_DK_Pass 154731 74.08 85.38 70.73 5 DKIM_VALID 151308 72.30 82.84 69.17 6 XM_B_Unicode 149961 71.32 80.67 68.55 7 DCC_CHECK_NEGATIVE 122568 48.55 23.36 56.03 8 DKIM_VALID_AU 122304 57.17 61.42 55.91 9 BAYES_50 108121 47.44 40.77 49.42 10 XMListUnsubscribeExists 105303 53.89 73.27 48.14 11 XM_B_SpammyWords 97821 50.78 71.19 44.72 12 DCC_CHECK 96129 51.42 76.62 43.94 13 XM_B_Unicode3 93991 43.84 46.77 42.96 14 RCVD_IN_MSPIKE_WL 65029 28.45 24.16 29.73 15 HTML_FONT_LOW_CONTRAST 62677 29.78 33.58 28.65 16 LOC_TINY_FONT_1 57801 28.23 34.33 26.42 17 DKIM_VALID_EF 57563 27.18 30.10 26.31 18 T_TM2_M_HEADER_IN_MSG 55454 24.38 21.14 25.35 19 MIME_HTML_ONLY 51589 24.82 29.00 23.58 20 FVGT_m_MULTI_ODD 49136 23.84 28.48 22.46 21 XMSubLong 45405 20.85 21.17 20.76 22 XM_B_SpammyWords2 44770 24.92 39.93 20.47 23 RCVD_IN_MSPIKE_H2 38497 18.80 22.85 17.60 24 ALL_TRUSTED 37231 13.66 2.36 17.02 25 T_KAM_HTML_FONT_INVALID 35218 18.65 27.24 16.10 26 USER_IN_DEF_DKIM_WL 34794 12.75 2.12 15.90 27 RCVD_IN_MSPIKE_H3 30766 14.00 13.78 14.06 28 BAYES_00 29518 10.79 1.69 13.49 29 RCVD_IN_MSPIKE_H4 29016 12.49 9.90 13.26 30 XM_Body_Dirty_Words 28415 15.30 23.08 12.99 31 XM_B_Unsub 28392 12.87 12.52 12.98 32 XM_Multi_Part_URI 28026 14.04 18.17 12.81 33 XM_DKIMWhitelistDomains 23558 8.32 0.05 10.77 34 BAYES_60 22662 9.72 7.56 10.36 35 FSL_BULK_SIG 21299 10.31 12.23 9.74 36 XM_DK_Undo_02 20950 17.92 46.02 9.58 37 RCVD_IN_RP_SAFE 20468 7.81 2.59 9.36 38 XM_Evil_Numbers_Gen 20218 8.89 7.70 9.24 39 BAYES_99 19473 14.09 31.57 8.90 40 UNPARSEABLE_RELAY 19392 10.24 14.89 8.86 41 LOTS_OF_MONEY 18180 9.77 14.70 8.31 42 RCVD_IN_RP_CERTIFIED 17952 6.64 1.34 8.21 43 RCVD_IN_VALIDITY_SAFE 17742 6.54 1.25 8.11 44 LotsOfNums_01 17599 7.80 6.99 8.04 45 XM_SendGrid 17456 8.69 11.10 7.98 46 HTML_IMAGE_RATIO_04 17344 7.29 5.15 7.93 47 HTML_IMAGE_RATIO_02 16570 7.92 9.10 7.57 48 BAYES_999 16435 11.32 24.16 7.51 49 TR_XM_DKIM_Undo 15959 14.07 36.91 7.30 50 TR_XM_DK_Bayes 15911 5.84 1.00 7.27 51 TR_XM_DK_Bayes1 15591 5.72 0.99 7.13 52 RCVD_IN_VALIDITY_CERTIFIED 15569 5.57 0.35 7.12 53 TooManyTo_001 15435 6.85 6.17 7.06 54 TR_XM_UnparsRelay 15053 8.55 14.18 6.88 55 T_TooManySym_01 14269 5.85 3.60 6.52 56 TR_XM_DK_Bayes2 13914 5.06 0.70 6.36 57 IN_ZIMBRA_NJ_WHITELIST 12363 4.37 0.06 5.65 58 BOTNET_IPINHOSTNAME 11997 7.62 14.80 5.48 59 TR_XM_DK_SendGrid 11881 5.71 6.65 5.43 60 MPART_ALT_DIFF 11776 6.19 8.90 5.38 61 XMSexyCombo_05 11714 6.71 11.27 5.35 62 TVD_RCVD_IP 11209 3.99 0.15 5.12 63 XM_H_Trusted_IP 11140 3.93 0.00 5.09 64 XMStrtUSub 10981 4.71 3.65 5.02 65 TR_XM_SpammyWords4 10956 6.80 12.85 5.01 66 XM_H_Long_From01 10732 5.26 6.44 4.91 67 BAYES_80 10587 5.70 8.60 4.84 68 TM2_M_URI_OPT_OUT 10204 4.42 3.59 4.66 69 XMSubMetaSx_00 10172 5.38 7.85 4.65 70 MIME_QP_LONG_LINE 10073 4.33 3.42 4.60 71 BAYES_40 9727 3.98 2.43 4.45 72 TR_DCC_Bayes_99 9578 8.98 24.47 4.38 73 XM_B_Phish_Phrases 9167 4.43 5.25 4.19 74 T_TooManySym_02 8933 3.42 1.19 4.08 75 XM_SPF_SoftFail 8841 4.13 4.44 4.04 76 XMNumbers 8656 4.18 4.94 3.96 77 ANY_BOUNCE_MESSAGE 8571 3.22 0.87 3.92 78 BOUNCE_MESSAGE 8571 3.22 0.87 3.92 79 FROM_EXCESS_BASE64 8569 3.33 1.37 3.92 80 XM_UncommonTLD01 8508 5.01 8.80 3.89 81 RCVD_IN_IADB_LISTED 8399 3.49 2.32 3.84 82 T_REMOTE_IMAGE 8366 3.60 2.85 3.82 83 KHOP_HELO_FCRDNS 8283 3.45 2.32 3.79 84 XM_B_SpammyWords3 8154 5.56 11.75 3.73 85 XM_B_SpammyTLD 8005 3.81 4.32 3.66 86 MIME_HTML_ONLY_MULTI 7828 3.70 4.12 3.58 87 INVALID_MSGID 7665 2.74 0.18 3.50 88 BAYES_20 7287 2.97 1.77 3.33 89 RCVD_IN_IADB_SPF 7276 3.03 2.05 3.33 90 MSGID_NOFQDN1 7264 2.58 0.08 3.32 91 RELAYCOUNTRY_META 6665 6.73 19.13 3.05 92 XM_shorewaves_Whitelist 6544 2.31 0.00 2.99 93 RCVD_IN_IADB_SENDERID 6527 2.74 1.93 2.98 94 DKIM_INVALID 6440 3.56 5.65 2.94 95 BAYES_95 6434 3.32 4.59 2.94 96 RCVD_IN_IADB_DK 6252 2.65 1.93 2.86 97 HTML_IMAGE_RATIO_06 6219 3.00 3.53 2.84 98 TO_MALFORMED 5972 2.11 0.00 2.73 99 XM_PDF 5657 2.09 0.41 2.59 100 MIME_HTML_MOSTLY 5389 3.33 6.25 2.46 101 HTML_IMAGE_RATIO_08 5298 2.45 2.54 2.42 102 XMSubNoVowel 5267 2.02 0.73 2.41 103 RCVD_IN_MSPIKE_H5 5247 1.96 0.48 2.40 104 RCVD_IN_IADB_VOUCHED 5239 2.06 0.95 2.39 105 T_XMDrugObfuBody_14 5193 2.52 3.01 2.37 106 TR_XM_PhishingBody 5157 3.04 5.34 2.36 107 BAYES_05 4946 1.97 1.01 2.26 108 IN_HORDE_ADDRESS_BOOK 4581 1.63 0.08 2.09 109 URI_NOVOWEL 4553 2.25 2.82 2.08 110 MAILING_LIST_MULTI 4353 2.09 2.42 1.99 111 HTML_MIME_NO_HTML_TAG 4064 2.24 3.53 1.86 112 TR_Symld_Words 3968 1.79 1.73 1.81 113 HTML_IMAGE_ONLY_20 3896 1.84 2.02 1.78 114 BOTNET 3845 4.39 13.27 1.76 115 TR_XM_SB_Phish 3819 1.68 1.46 1.75 116 XMSubPhish11 3791 1.67 1.46 1.73 117 XM_CamelCaseFrm001 3760 1.89 2.45 1.72 118 XMBSHREFv2 3586 1.29 0.13 1.64 119 TR_XM_SpammyWords2 3544 3.91 11.63 1.62 120 XMGappySubj_01 3538 1.30 0.22 1.62 121 XM_DK_Undo_01 3513 1.80 2.45 1.61 122 RCVD_IN_IADB_OPTIN 3432 1.39 0.80 1.57 123 TR_XM_SpammyWords5 3431 2.03 3.58 1.57 124 TR_XM_MaxUnsub 3355 2.23 4.57 1.53 125 XMStockSpam_06 3340 1.54 1.60 1.53 126 XM_H_Long_From02 3324 1.34 0.72 1.52 127 TR_XM_SpammyRelay 3173 4.45 14.56 1.45 128 XM_GoogleGroups 3062 1.65 2.50 1.40 129 TooManyTo_002 3034 1.23 0.68 1.39 130 XM_B_Unsub2 2957 1.50 2.01 1.35 131 RCVD_IN_BL_SPAMCOP_NET 2857 4.22 14.04 1.31 132 SUBJ_ALL_CAPS 2752 1.51 2.35 1.26 133 UNTRUSTED_Relay 2642 3.28 10.25 1.21 134 TVD_SPACE_RATIO 2592 0.93 0.08 1.18 135 XMDiploma_00 2584 1.37 2.01 1.18 136 TM2_M_VERY_LONG_WORD 2560 1.44 2.36 1.17 137 URI_HEX 2537 1.23 1.48 1.16 138 XMBdyGiftCard01 2474 1.10 1.00 1.13 139 T_XMDrugObfuBody_08 2412 1.43 2.52 1.10 140 XM_B_Investor 2327 1.69 3.80 1.06 141 DATE_IN_PAST_03_06 2316 0.92 0.44 1.06 142 XMSexyCombo_01 2263 1.31 2.25 1.03 143 TVD_SPACE_RATIO_MINFP 2259 0.83 0.13 1.03 144 T_TooManySym_03 2185 0.82 0.23 1.00 145 XM_B_Phish66 2152 1.40 2.78 0.98 146 TooManyTo_003 2146 0.87 0.49 0.98 147 XM_B_COVIDMETA 2135 1.18 1.88 0.98 148 HTML_FONT_FACE_BAD 2115 0.90 0.67 0.97 149 T_XMDrugObfuBody_00 2044 1.16 1.91 0.93 150 XMBody_95 2043 0.77 0.23 0.93 151 DKIM_ADSP_CUSTOM_MED 1958 1.11 1.82 0.90 152 XMLngstWrd_00 1892 0.74 0.33 0.86 153 RELAYCOUNTRY_CA 1875 2.09 6.25 0.86 154 XM_OfRef6 1814 1.58 4.12 0.83 155 XM_ProductURIs 1787 0.82 0.81 0.82 156 XMBrknScrpt_02 1784 1.11 2.10 0.82 157 TR_MetaPhish_Combo_01 1778 0.80 0.75 0.81 158 XM_UB50 1712 1.83 5.35 0.78 159 XMLngstWrd_01 1655 0.64 0.25 0.76 160 XMPhish30 1584 0.87 1.34 0.72 161 XM_B_COPY_HTML 1578 0.79 1.00 0.72 162 XM_B_REG_HTML 1503 0.62 0.41 0.69 163 TooManyTo_004 1458 0.62 0.45 0.67 164 XMLngstWrd_02 1384 0.53 0.17 0.63 165 RDNS_DYNAMIC 1356 0.60 0.55 0.62 166 HTML_IMAGE_ONLY_24 1335 0.75 1.23 0.61 167 USER_IN_WHITELIST 1313 0.46 0.00 0.60 168 USER_IN_WELCOMELIST 1313 0.46 0.00 0.60 169 DATE_IN_PAST_06_12 1278 0.48 0.12 0.58 170 T_FILL_THIS_FORM_SHORT 1260 1.19 3.25 0.58 171 XMHTMLBadTable_001 1239 0.60 0.70 0.57 172 XMGenDplmaNmb 1233 0.65 0.95 0.56 173 TR_MSPIKEBAYES00 1230 0.44 0.03 0.56 174 XM_D_tchamptons_WL 1226 0.43 0.00 0.56 175 NML_ADSP_CUSTOM_MED 1224 0.81 1.67 0.56 176 XMNoVowels 1215 0.58 0.68 0.56 177 TM2_M_A_HREF_HREF 1207 0.74 1.39 0.55 178 XM_H_PHPMailer 1205 0.78 1.55 0.55 179 RELAYCOUNTRY_GB 1197 0.61 0.83 0.55 180 XMCapTrack 1177 0.48 0.28 0.54 181 HTTPS_HTTP_MISMATCH 1172 0.63 0.96 0.54 182 TooManyTo_005 1156 0.50 0.38 0.53 183 TR_XM_SPAMCOP 1143 1.87 6.43 0.52 184 THIS_AD 1131 0.47 0.32 0.52 185 XM_B_SpammyWords4 1107 0.95 2.45 0.51 186 FORGED_GMAIL_RCVD 1102 0.77 1.68 0.50 187 HTML_TAG_BALANCE_BODY 1100 0.59 0.90 0.50 188 XMSubMetaI_00 1099 0.58 0.85 0.50 189 DIET_1 1098 0.81 1.85 0.50 190 HELO_NODOT 1097 0.55 0.73 0.50 191 HELO_NO_DOMAIN 1096 0.55 0.72 0.50 192 XMHTML_After_End 1094 0.59 0.88 0.50 193 SUBJ_DOLLARS 1093 0.69 1.35 0.50 194 XMLngstWrd_03 1089 0.42 0.14 0.50 195 XMSubMetaSxObfu_02 1089 0.48 0.40 0.50 196 SHORT_URI_3 1076 0.45 0.30 0.49 197 DKIM_ADSP_NXDOMAIN 1056 0.61 1.04 0.48 198 URI_TRY_3LD 1050 0.55 0.81 0.48 199 HTML_TITLE_SUBJ_DIFF 1008 0.76 1.77 0.46 200 MPART_ALT_DIFF_COUNT 1007 0.51 0.69 0.46 ----------------------------------------------------------------------