Email: 495790 Autolearn: 0 AvgScore: 0.99 AvgScanTime: 2.38 sec Spam: 104327 Autolearn: 0 AvgScore: 12.95 AvgScanTime: 2.74 sec Ham: 391463 Autolearn: 0 AvgScore: -2.19 AvgScanTime: 2.28 sec Time Spent Running SA: 327.52 hours Time Spent Processing Spam: 79.31 hours Time Spent Processing Ham: 248.22 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 99951 89.51 95.81 87.83 2 DKIM_SIGNED 92955 71.07 89.10 66.26 3 XM_DK_Pass 89392 69.25 85.68 64.87 4 DKIM_VALID 86252 67.15 82.67 63.01 5 RELAYCOUNTRY_US 86006 79.82 82.44 79.12 6 XM_B_Unicode 81630 72.22 78.24 70.61 7 DCC_CHECK 76634 43.76 73.46 35.84 8 XM_B_SpammyWords 75549 48.87 72.42 42.60 9 XMListUnsubscribeExists 75295 49.18 72.17 43.05 10 DKIM_VALID_AU 62532 49.95 59.94 47.29 11 BAYES_50 49400 49.77 47.35 50.42 12 XM_B_Unicode3 47125 45.13 45.17 45.11 13 XM_DK_Undo_02 42368 14.07 40.61 7.00 14 LOC_TINY_FONT_1 40093 25.69 38.43 22.29 15 XM_B_SpammyWords2 38790 21.68 37.18 17.55 16 HTML_FONT_LOW_CONTRAST 35788 26.13 34.30 23.95 17 TR_XM_DKIM_Undo 33530 10.89 32.14 5.22 18 DKIM_VALID_EF 31985 25.61 30.66 24.26 19 T_KAM_HTML_FONT_INVALID 31572 19.67 30.26 16.84 20 MIME_HTML_ONLY 31000 23.59 29.71 21.95 21 FVGT_m_MULTI_ODD 30600 23.36 29.33 21.76 22 BAYES_99 29177 14.90 27.97 11.42 23 DCC_CHECK_NEGATIVE 27659 56.20 26.51 64.11 24 XMSubLong 26269 21.24 25.18 20.19 25 RCVD_IN_MSPIKE_H2 24465 19.67 23.45 18.66 26 RCVD_IN_MSPIKE_WL 24035 25.75 23.04 26.47 27 T_TM2_M_HEADER_IN_MSG 24000 27.43 23.00 28.60 28 XM_Body_Dirty_Words 23972 14.27 22.98 11.95 29 BAYES_999 21681 12.64 20.78 10.47 30 TR_DCC_Bayes_99 21584 6.51 20.69 2.74 31 RELAYCOUNTRY_META 19378 6.63 18.57 3.44 32 XM_Multi_Part_URI 18516 12.28 17.75 10.82 33 BOTNET_IPINHOSTNAME 15639 6.38 14.99 4.09 34 RCVD_IN_MSPIKE_H3 14653 13.81 14.05 13.75 35 XM_B_Unsub 14281 12.30 13.69 11.93 36 UNPARSEABLE_RELAY 13878 8.50 13.30 7.22 37 TR_XM_SpammyRelay 13855 4.04 13.28 1.57 38 LOTS_OF_MONEY 13706 8.99 13.14 7.89 39 TR_XM_UnparsRelay 13476 7.15 12.92 5.61 40 BOTNET 12483 3.73 11.97 1.54 41 XM_B_SpammyWords3 12364 5.29 11.85 3.55 42 FSL_BULK_SIG 12276 8.45 11.77 7.56 43 TR_XM_SpammyWords4 11879 6.21 11.39 4.83 44 XM_SendGrid 11058 7.33 10.60 6.46 45 XM_UncommonTLD01 10955 4.65 10.50 3.09 46 XM_Evil_Numbers_Gen 10610 7.78 10.17 7.15 47 XMSexyCombo_05 10596 5.06 10.16 3.71 48 UNTRUSTED_Relay 10340 3.04 9.91 1.21 49 TR_XM_SpammyWords2 9937 2.79 9.52 0.99 50 MPART_ALT_DIFF 9882 7.40 9.47 6.85 51 RCVD_IN_BL_SPAMCOP_NET 9046 2.44 8.67 0.77 52 RCVD_IN_MSPIKE_H4 8986 10.16 8.61 10.58 53 HTML_IMAGE_RATIO_02 8879 6.63 8.51 6.13 54 LotsOfNums_01 8122 8.36 7.79 8.51 55 XMSubMetaSx_00 8091 4.57 7.76 3.72 56 TooManyTo_001 7683 8.39 7.36 8.66 57 MIME_HTML_MOSTLY 7542 3.48 7.23 2.49 58 BAYES_80 7490 4.37 7.18 3.62 59 TR_XM_PhishingBody 7016 3.76 6.73 2.97 60 BAYES_60 7013 7.34 6.72 7.51 61 DKIM_INVALID 6703 3.92 6.42 3.25 62 XM_B_Phish_Phrases 6655 4.06 6.38 3.44 63 TR_XM_DK_SendGrid 6475 4.52 6.21 4.07 64 XM_H_Long_From01 6404 5.05 6.14 4.76 65 XM_UB50 5726 1.79 5.49 0.81 66 HTML_IMAGE_RATIO_04 5379 6.27 5.16 6.57 67 MIME_QP_LONG_LINE 5189 5.73 4.97 5.93 68 TR_XM_SPAMCOP 5130 1.30 4.92 0.33 69 URI_NOVOWEL 5027 3.28 4.82 2.87 70 XM_B_Investor 4956 2.01 4.75 1.28 71 RELAYCOUNTRY_CA 4945 1.60 4.74 0.76 72 TM2_M_URI_OPT_OUT 4735 4.62 4.54 4.64 73 RCVD_IN_MSPIKE_BL 4718 1.33 4.52 0.48 74 TR_XM_MSPIKECOMBO 4711 1.33 4.52 0.48 75 HTML_MIME_NO_HTML_TAG 4668 3.15 4.47 2.80 76 XM_SPF_SoftFail 4573 2.31 4.38 1.76 77 SpammyFromTLD_02 4521 1.32 4.33 0.51 78 SpammyFromTLD_01 4500 1.48 4.31 0.72 79 TR_XM_MaxUnsub 4162 1.72 3.99 1.12 80 HTML_IMAGE_RATIO_06 4140 3.81 3.97 3.76 81 MIME_HTML_ONLY_MULTI 4027 4.81 3.86 5.06 82 BAYES_95 4004 2.54 3.84 2.20 83 XM_B_Phish66 3903 2.03 3.74 1.58 84 XMStrtUSub 3659 3.47 3.51 3.46 85 XMNumbers 3656 3.28 3.50 3.22 86 XM_B_SpammyTLD 3601 2.23 3.45 1.91 87 XM_GoogleGroups 3599 2.02 3.45 1.64 88 TR_XM_SpammyWords5 3555 1.81 3.41 1.38 89 URIBL_DBL_SPAM 3550 0.72 3.40 0.01 90 TR_XM_PHPDW 3248 0.91 3.11 0.32 91 T_TooManySym_01 3210 4.80 3.08 5.26 92 HTML_IMAGE_ONLY_20 3204 1.99 3.07 1.70 93 RCVD_IN_IADB_LISTED 3166 4.60 3.03 5.02 94 XMDiploma_00 3146 1.93 3.02 1.64 95 HTML_TITLE_SUBJ_DIFF 3126 1.01 3.00 0.49 96 TR_XM_SpammyWords3 3107 0.83 2.98 0.25 97 TR_XM_PHPForged 3095 0.84 2.97 0.28 98 TR_XM_FormFill2 3069 0.84 2.94 0.28 99 XM_H_PHPOS 3063 0.83 2.94 0.27 100 TR_XM_SB_Phish 3036 2.33 2.91 2.17 101 HTML_IMAGE_RATIO_08 3028 2.46 2.90 2.34 102 T_REMOTE_IMAGE 3000 3.26 2.88 3.36 103 XM_B_COVIDMETA 2997 1.18 2.87 0.73 104 T_XMDrugObfuBody_14 2984 2.27 2.86 2.11 105 XMSubPhish11 2953 2.28 2.83 2.14 106 T_XMDrugObfuBody_08 2946 1.69 2.82 1.39 107 HTML_SHORT_LINK_IMG_3 2911 0.99 2.79 0.51 108 XM_OfRef6 2893 1.23 2.77 0.82 109 RCVD_IN_MSPIKE_L3 2802 0.83 2.69 0.34 110 XMSexyCombo_01 2709 1.44 2.60 1.13 111 RCVD_IN_IADB_SPF 2701 4.00 2.59 4.37 112 XM_CamelCaseFrm001 2680 1.94 2.57 1.77 113 XM_DK_Undo_01 2667 1.79 2.56 1.59 114 TM2_M_VERY_LONG_WORD 2659 1.36 2.55 1.04 115 BAYES_40 2652 4.73 2.54 5.31 116 XM_DIRTYINTL 2590 0.75 2.48 0.29 117 KHOP_HELO_FCRDNS 2569 1.76 2.46 1.57 118 T_XMDrugObfuBody_00 2534 1.24 2.43 0.92 119 ALL_TRUSTED 2521 15.11 2.42 18.49 120 RCVD_IN_IADB_DK 2491 3.50 2.39 3.79 121 T_FILL_THIS_FORM_SHORT 2461 1.16 2.36 0.84 122 RCVD_IN_IADB_SENDERID 2452 3.59 2.35 3.92 123 RCVD_IN_RP_SAFE 2402 5.28 2.30 6.07 124 TR_XM_NoHeaderRelay 2378 0.61 2.28 0.17 125 MAILING_LIST_MULTI 2354 2.30 2.26 2.31 126 RELAYCOUNTRY_IN 2349 0.53 2.25 0.08 127 JH_SPAMMY_HEADERS 2282 0.46 2.19 0.00 128 URI_HEX 2209 1.78 2.12 1.70 129 XM_B_Unsub2 2208 1.47 2.12 1.30 130 TR_Symld_Words 2140 1.71 2.05 1.62 131 SUBJ_ALL_CAPS 2076 1.78 1.99 1.73 132 XM_URI_RBL 2053 0.50 1.97 0.11 133 XM_B_SpammyWords4 2039 0.62 1.95 0.27 134 TR_XM_COVIDMETA4 1972 0.61 1.89 0.26 135 XMBody_17 1882 0.68 1.80 0.38 136 BAYES_20 1859 3.44 1.78 3.88 137 FROM_EXCESS_BASE64 1854 2.40 1.78 2.56 138 XMStockSpam_06 1824 1.28 1.75 1.15 139 TR_XM_COVIDMETA1 1766 0.50 1.69 0.18 140 URIBL_BLACK 1761 0.39 1.69 0.04 141 XM_UB99 1696 0.34 1.63 0.00 142 T_XMHurry_00 1678 0.66 1.61 0.41 143 XMGenDplmaNmb 1660 0.95 1.59 0.77 144 BOTNET_NORDNS 1642 0.34 1.57 0.02 145 PDS_OTHER_BAD_TLD 1627 0.48 1.56 0.19 146 RELAYCOUNTRY_AU 1570 0.62 1.50 0.38 147 TR_XM_INV_DKIM 1568 0.50 1.50 0.23 148 RCVD_IN_IADB_VOUCHED 1564 2.72 1.50 3.05 149 BAYES_00 1555 10.74 1.49 13.21 150 RCVD_IN_VALIDITY_SAFE 1531 4.55 1.47 5.37 151 RCVD_IN_RP_CERTIFIED 1515 4.54 1.45 5.36 152 RELAYCOUNTRY_FR 1514 0.43 1.45 0.16 153 XMSubMetaSxObfu_03 1510 0.57 1.45 0.34 154 TR_MetaPhish_Combo_01 1504 0.94 1.44 0.80 155 XMBrknScrpt_02 1499 0.82 1.44 0.65 156 URI_TRY_3LD 1484 0.77 1.42 0.59 157 XMPhish30 1445 0.77 1.39 0.61 158 TR_LOTS_OF_MONEY3 1438 0.56 1.38 0.34 159 XM_Body_Dirty_Words_01 1428 0.45 1.37 0.21 160 RCVD_IN_MSPIKE_L5 1291 0.28 1.24 0.02 161 HTTPS_HTTP_MISMATCH 1272 0.79 1.22 0.67 162 XMSubMetaI_00 1266 0.69 1.21 0.55 163 XM_UB999 1260 0.26 1.21 0.00 164 USER_IN_DEF_DKIM_WL 1235 8.63 1.18 10.62 165 XM_H_Long_From02 1207 0.96 1.16 0.91 166 DIET_1 1206 0.74 1.16 0.63 167 RCVD_IN_PSBL 1180 0.32 1.13 0.10 168 BAYES_05 1155 2.15 1.11 2.43 169 RELAYCOUNTRY_GB 1136 0.81 1.09 0.73 170 XMHTML_After_End 1133 0.72 1.09 0.63 171 PHP_SCRIPT 1118 0.23 1.07 0.01 172 URI_PHISH 1114 0.23 1.07 0.01 173 TR_Mismatch_TLD_01 1095 0.42 1.05 0.25 174 TR_XM_BayesRelay 1094 0.22 1.05 0.00 175 XMSubMetaSSx_00 1090 0.46 1.04 0.31 176 XM_UB60 1083 0.26 1.04 0.05 177 XM_B_SEO 1079 0.32 1.03 0.12 178 RCVD_IN_IADB_OPTIN 1074 1.77 1.03 1.97 179 TM2_M_A_HREF_HREF 1074 0.72 1.03 0.64 180 XM_B_COPY_HTML 1054 0.76 1.01 0.70 181 TR_XM_FormFill 1053 0.23 1.01 0.02 182 URI_WP_DIRINDEX 1048 0.21 1.00 0.00 183 InconsistentFrom_001 1039 0.21 1.00 0.00 184 TR_BOTNET_NEGATE 1039 0.39 1.00 0.23 185 XM_PDF 1032 3.77 0.99 4.51 186 DKIM_ADSP_CUSTOM_MED 1026 0.92 0.98 0.90 187 XM_H_Undi_Recip 1021 0.32 0.98 0.14 188 XM_H_PHPMailer 1007 0.62 0.97 0.53 189 FROM_SUSPICIOUS_NTLD 996 0.23 0.95 0.03 190 RELAYCOUNTRY_RU 985 0.22 0.94 0.03 191 TR_XM_DK_Bayes 972 5.87 0.93 7.19 192 URI_PHP_REDIR 954 0.19 0.91 0.00 193 MPART_ALT_DIFF_COUNT 950 0.54 0.91 0.44 194 HK_RANDOM_REPLYTO 949 0.28 0.91 0.11 195 SHOPIFY_IMG_NOT_RCVD_SFY 944 0.34 0.90 0.19 196 FROM_SUSPICIOUS_NTLD_FP 943 0.21 0.90 0.03 197 TR_XM_DK_Bayes1 942 5.70 0.90 6.98 198 T_TooManySym_02 940 2.52 0.90 2.95 199 HTML_FONT_FACE_BAD 934 1.90 0.90 2.17 200 TR_XM_SEO4 930 0.25 0.89 0.07 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 343837 89.51 95.81 87.83 2 RELAYCOUNTRY_US 309728 79.82 82.44 79.12 3 XM_B_Unicode 276417 72.22 78.24 70.61 4 DKIM_SIGNED 259387 71.07 89.10 66.26 5 XM_DK_Pass 253925 69.25 85.68 64.87 6 DCC_CHECK_NEGATIVE 250963 56.20 26.51 64.11 7 DKIM_VALID 246656 67.15 82.67 63.01 8 BAYES_50 197379 49.77 47.35 50.42 9 DKIM_VALID_AU 185123 49.95 59.94 47.29 10 XM_B_Unicode3 176607 45.13 45.17 45.11 11 XMListUnsubscribeExists 168543 49.18 72.17 43.05 12 XM_B_SpammyWords 166761 48.87 72.42 42.60 13 DCC_CHECK 140318 43.76 73.46 35.84 14 T_TM2_M_HEADER_IN_MSG 111971 27.43 23.00 28.60 15 RCVD_IN_MSPIKE_WL 103638 25.75 23.04 26.47 16 DKIM_VALID_EF 94987 25.61 30.66 24.26 17 HTML_FONT_LOW_CONTRAST 93738 26.13 34.30 23.95 18 LOC_TINY_FONT_1 87255 25.69 38.43 22.29 19 MIME_HTML_ONLY 85936 23.59 29.71 21.95 20 FVGT_m_MULTI_ODD 85195 23.36 29.33 21.76 21 XMSubLong 79055 21.24 25.18 20.19 22 RCVD_IN_MSPIKE_H2 73055 19.67 23.45 18.66 23 ALL_TRUSTED 72385 15.11 2.42 18.49 24 XM_B_SpammyWords2 68716 21.68 37.18 17.55 25 T_KAM_HTML_FONT_INVALID 65931 19.67 30.26 16.84 26 RCVD_IN_MSPIKE_H3 53822 13.81 14.05 13.75 27 BAYES_00 51705 10.74 1.49 13.21 28 XM_Body_Dirty_Words 46775 14.27 22.98 11.95 29 XM_B_Unsub 46705 12.30 13.69 11.93 30 BAYES_99 44713 14.90 27.97 11.42 31 XM_Multi_Part_URI 42370 12.28 17.75 10.82 32 USER_IN_DEF_DKIM_WL 41556 8.63 1.18 10.62 33 RCVD_IN_MSPIKE_H4 41408 10.16 8.61 10.58 34 BAYES_999 41002 12.64 20.78 10.47 35 XM_H_Trusted_IP 37552 7.57 0.00 9.59 36 TooManyTo_001 33914 8.39 7.36 8.66 37 LotsOfNums_01 33331 8.36 7.79 8.51 38 LOTS_OF_MONEY 30874 8.99 13.14 7.89 39 FSL_BULK_SIG 29597 8.45 11.77 7.56 40 BAYES_60 29384 7.34 6.72 7.51 41 UNPARSEABLE_RELAY 28246 8.50 13.30 7.22 42 TR_XM_DK_Bayes 28133 5.87 0.93 7.19 43 XM_Evil_Numbers_Gen 27973 7.78 10.17 7.15 44 XM_DKIMWhitelistDomains 27754 5.60 0.02 7.09 45 XM_DK_Undo_02 27390 14.07 40.61 7.00 46 TR_XM_DK_Bayes1 27306 5.70 0.90 6.98 47 MPART_ALT_DIFF 26808 7.40 9.47 6.85 48 HTML_IMAGE_RATIO_04 25711 6.27 5.16 6.57 49 XM_SendGrid 25304 7.33 10.60 6.46 50 IN_ZIMBRA_NJ_WHITELIST 24051 4.87 0.09 6.14 51 HTML_IMAGE_RATIO_02 23990 6.63 8.51 6.13 52 RCVD_IN_RP_SAFE 23774 5.28 2.30 6.07 53 TR_XM_DK_Bayes2 23277 4.83 0.63 5.95 54 MIME_QP_LONG_LINE 23229 5.73 4.97 5.93 55 TR_XM_UnparsRelay 21971 7.15 12.92 5.61 56 ANY_BOUNCE_MESSAGE 21720 4.55 0.82 5.55 57 BOUNCE_MESSAGE 21717 4.55 0.81 5.55 58 RCVD_IN_VALIDITY_SAFE 21037 4.55 1.47 5.37 59 RCVD_IN_RP_CERTIFIED 20979 4.54 1.45 5.36 60 BAYES_40 20785 4.73 2.54 5.31 61 T_TooManySym_01 20594 4.80 3.08 5.26 62 TR_XM_DKIM_Undo 20441 10.89 32.14 5.22 63 MIME_HTML_ONLY_MULTI 19823 4.81 3.86 5.06 64 RCVD_IN_IADB_LISTED 19661 4.60 3.03 5.02 65 XMSubNoVowel 19156 4.02 0.74 4.89 66 TR_XM_SpammyWords4 18898 6.21 11.39 4.83 67 XM_H_Long_From01 18633 5.05 6.14 4.76 68 RCVD_IN_VALIDITY_CERTIFIED 18540 3.90 0.79 4.74 69 TM2_M_URI_OPT_OUT 18172 4.62 4.54 4.64 70 XM_PDF 17648 3.77 0.99 4.51 71 RCVD_IN_IADB_SPF 17113 4.00 2.59 4.37 72 BOTNET_IPINHOSTNAME 16008 6.38 14.99 4.09 73 TR_XM_DK_SendGrid 15938 4.52 6.21 4.07 74 RCVD_IN_IADB_SENDERID 15364 3.59 2.35 3.92 75 BAYES_20 15182 3.44 1.78 3.88 76 TVD_SPACE_RATIO_MINFP 14930 3.04 0.14 3.81 77 RCVD_IN_IADB_DK 14846 3.50 2.39 3.79 78 HTML_IMAGE_RATIO_06 14732 3.81 3.97 3.76 79 XMSubMetaSx_00 14572 4.57 7.76 3.72 80 XMSexyCombo_05 14505 5.06 10.16 3.71 81 BAYES_80 14185 4.37 7.18 3.62 82 XM_B_SpammyWords3 13881 5.29 11.85 3.55 83 XMStrtUSub 13550 3.47 3.51 3.46 84 RELAYCOUNTRY_META 13479 6.63 18.57 3.44 85 XM_B_Phish_Phrases 13473 4.06 6.38 3.44 86 T_REMOTE_IMAGE 13165 3.26 2.88 3.36 87 DKIM_INVALID 12731 3.92 6.42 3.25 88 XMNumbers 12608 3.28 3.50 3.22 89 XM_UncommonTLD01 12092 4.65 10.50 3.09 90 RCVD_IN_IADB_VOUCHED 11938 2.72 1.50 3.05 91 TR_XM_PhishingBody 11621 3.76 6.73 2.97 92 T_TooManySym_02 11549 2.52 0.90 2.95 93 URI_NOVOWEL 11244 3.28 4.82 2.87 94 HTML_MIME_NO_HTML_TAG 10965 3.15 4.47 2.80 95 TR_DCC_Bayes_99 10707 6.51 20.69 2.74 96 FROM_EXCESS_BASE64 10033 2.40 1.78 2.56 97 MIME_HTML_MOSTLY 9734 3.48 7.23 2.49 98 BAYES_05 9513 2.15 1.11 2.43 99 HTML_IMAGE_RATIO_08 9174 2.46 2.90 2.34 100 MAILING_LIST_MULTI 9026 2.30 2.26 2.31 101 BAYES_95 8608 2.54 3.84 2.20 102 TR_XM_SB_Phish 8496 2.33 2.91 2.17 103 HTML_FONT_FACE_BAD 8480 1.90 0.90 2.17 104 RCVD_IN_MSPIKE_H5 8408 1.78 0.38 2.15 105 XMSubPhish11 8368 2.28 2.83 2.14 106 T_XMDrugObfuBody_14 8249 2.27 2.86 2.11 107 TooManyTo_002 7977 1.79 0.86 2.04 108 RCVD_IN_IADB_OPTIN 7721 1.77 1.03 1.97 109 XM_B_SpammyTLD 7472 2.23 3.45 1.91 110 XM_CamelCaseFrm001 6919 1.94 2.57 1.77 111 XM_SPF_SoftFail 6898 2.31 4.38 1.76 112 INVALID_MSGID 6827 1.41 0.18 1.74 113 SUBJ_ALL_CAPS 6754 1.78 1.99 1.73 114 IN_HORDE_ADDRESS_BOOK 6728 1.38 0.11 1.72 115 HTML_IMAGE_ONLY_20 6654 1.99 3.07 1.70 116 URI_HEX 6637 1.78 2.12 1.70 117 XMDiploma_00 6432 1.93 3.02 1.64 118 XM_GoogleGroups 6404 2.02 3.45 1.64 119 MSGID_NOFQDN1 6366 1.29 0.05 1.63 120 TR_Symld_Words 6329 1.71 2.05 1.62 121 XM_DK_Undo_01 6213 1.79 2.56 1.59 122 XM_B_Phish66 6167 2.03 3.74 1.58 123 TR_XM_SpammyRelay 6152 4.04 13.28 1.57 124 KHOP_HELO_FCRDNS 6145 1.76 2.46 1.57 125 TO_MALFORMED 6041 1.22 0.02 1.54 126 BOTNET 6013 3.73 11.97 1.54 127 HELO_NODOT 5852 1.32 0.66 1.49 128 HELO_NO_DOMAIN 5852 1.32 0.65 1.49 129 TVD_RCVD_IP 5631 1.17 0.16 1.44 130 T_XMDrugObfuBody_08 5449 1.69 2.82 1.39 131 TR_XM_SpammyWords5 5401 1.81 3.41 1.38 132 XMGappySubj_01 5359 1.13 0.23 1.37 133 TooManyTo_003 5249 1.20 0.66 1.34 134 XM_B_Unsub2 5078 1.47 2.12 1.30 135 XM_B_Investor 4997 2.01 4.75 1.28 136 UNTRUSTED_Relay 4746 3.04 9.91 1.21 137 XMStockSpam_06 4501 1.28 1.75 1.15 138 XMSexyCombo_01 4413 1.44 2.60 1.13 139 TR_XM_MaxUnsub 4365 1.72 3.99 1.12 140 TM2_M_VERY_LONG_WORD 4071 1.36 2.55 1.04 141 XMCapTrack 3924 0.89 0.46 1.00 142 TR_XM_SpammyWords2 3881 2.79 9.52 0.99 143 TVD_SPACE_RATIO 3693 0.77 0.14 0.94 144 TooManyTo_004 3642 0.83 0.47 0.93 145 T_XMDrugObfuBody_00 3618 1.24 2.43 0.92 146 XM_H_Long_From02 3574 0.96 1.16 0.91 147 XMBSHREFv2 3538 0.78 0.32 0.90 148 DKIM_ADSP_CUSTOM_MED 3525 0.92 0.98 0.90 149 SHORT_URI_2 3441 0.85 0.72 0.88 150 T_FILL_THIS_FORM_SHORT 3288 1.16 2.36 0.84 151 XM_ProductURIs 3225 0.82 0.80 0.82 152 XM_OfRef6 3222 1.23 2.77 0.82 153 XM_UB50 3169 1.79 5.49 0.81 154 TR_MetaPhish_Combo_01 3151 0.94 1.44 0.80 155 RCVD_IN_BL_SPAMCOP_NET 3032 2.44 8.67 0.77 156 XMGenDplmaNmb 3028 0.95 1.59 0.77 157 RELAYCOUNTRY_CA 2991 1.60 4.74 0.76 158 XMBdyGiftCard01 2976 0.77 0.81 0.76 159 XMBody_95 2939 0.64 0.23 0.75 160 T_TooManySym_03 2893 0.65 0.31 0.74 161 RELAYCOUNTRY_GB 2862 0.81 1.09 0.73 162 XM_B_COVIDMETA 2839 1.18 2.87 0.73 163 SpammyFromTLD_01 2813 1.48 4.31 0.72 164 TooManyTo_005 2804 0.65 0.39 0.72 165 XM_B_COPY_HTML 2738 0.76 1.01 0.70 166 HTTPS_HTTP_MISMATCH 2623 0.79 1.22 0.67 167 T_OBFU_PDF_ATTACH 2599 0.56 0.19 0.66 168 XMLngstWrd_00 2555 0.59 0.35 0.65 169 XMBrknScrpt_02 2545 0.82 1.44 0.65 170 FROM_GOV_DKIM_AU 2524 0.58 0.32 0.64 171 TM2_M_A_HREF_HREF 2501 0.72 1.03 0.64 172 DIET_1 2461 0.74 1.16 0.63 173 XMHTML_After_End 2458 0.72 1.09 0.63 174 XM_ShortIntro_01 2445 0.63 0.66 0.62 175 XMPhish30 2379 0.77 1.39 0.61 176 URI_TRY_3LD 2322 0.77 1.42 0.59 177 NML_ADSP_CUSTOM_MED 2309 0.62 0.74 0.59 178 XMSubMetaI_00 2137 0.69 1.21 0.55 179 TR_MSPIKEBAYES00 2135 0.44 0.03 0.55 180 HTML_TAG_BALANCE_BODY 2097 0.59 0.77 0.54 181 XM_H_PHPMailer 2089 0.62 0.97 0.53 182 XM_D_tchamptons_WL 2064 0.42 0.01 0.53 183 HTML_SHORT_LINK_IMG_3 2010 0.99 2.79 0.51 184 SpammyFromTLD_02 2007 1.32 4.33 0.51 185 XMNoVowels 1962 0.52 0.59 0.50 186 XMLngstWrd_01 1936 0.45 0.29 0.49 187 HTML_TITLE_SUBJ_DIFF 1900 1.01 3.00 0.49 188 RCVD_IN_MSPIKE_BL 1888 1.33 4.52 0.48 189 T_MANY_PILL_PRICE 1883 0.38 0.00 0.48 190 TR_XM_MSPIKECOMBO 1872 1.33 4.52 0.48 191 FORGED_GMAIL_RCVD 1872 0.55 0.81 0.48 192 XMBody_78 1865 0.53 0.73 0.48 193 RCVD_IN_SORBS_DUL 1863 0.43 0.26 0.48 194 XMPhish14 1754 0.52 0.79 0.45 195 XMMoneyMeta_00 1749 0.50 0.68 0.45 196 MPART_ALT_DIFF_COUNT 1739 0.54 0.91 0.44 197 XMHTMLBadTable_001 1729 0.46 0.51 0.44 198 SHORT_HELO_AND_INLINE_IMAGE 1657 0.35 0.08 0.42 199 TM2_M_BODY_EMPTY 1634 0.37 0.21 0.42 200 RDNS_DYNAMIC 1622 0.44 0.55 0.41 ----------------------------------------------------------------------