Email: 331924 Autolearn: 0 AvgScore: 2.35 AvgScanTime: 1.52 sec Spam: 87387 Autolearn: 0 AvgScore: 14.73 AvgScanTime: 1.74 sec Ham: 244537 Autolearn: 0 AvgScore: -2.08 AvgScanTime: 1.45 sec Time Spent Running SA: 140.58 hours Time Spent Processing Spam: 42.12 hours Time Spent Processing Ham: 98.46 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 83510 86.48 95.56 83.23 2 DKIM_SIGNED 68123 71.72 77.96 69.49 3 XM_DK_Pass 66369 69.85 75.95 67.68 4 DKIM_VALID 64355 68.08 73.64 66.09 5 RELAYCOUNTRY_US 61213 75.23 70.05 77.08 6 DCC_CHECK 59314 46.59 67.88 38.99 7 XM_B_Unicode 58275 66.73 66.69 66.75 8 XM_B_SpammyWords 56976 49.63 65.20 44.06 9 XMListUnsubscribeExists 56318 50.68 64.45 45.76 10 DKIM_VALID_AU 48493 52.91 55.49 51.98 11 BAYES_50 37568 49.56 42.99 51.91 12 XM_DK_Undo_02 35074 16.11 40.14 7.52 13 XM_B_Unicode3 33922 40.69 38.82 41.36 14 MIME_HTML_ONLY 33493 29.03 38.33 25.71 15 LOC_TINY_FONT_1 31163 27.90 35.66 25.12 16 TR_XM_DKIM_Undo 28314 12.42 32.40 5.28 17 DCC_CHECK_NEGATIVE 28052 53.39 32.10 60.99 18 XM_B_SpammyWords2 27161 22.72 31.08 19.73 19 HTML_FONT_LOW_CONTRAST 25066 28.36 28.68 28.25 20 BAYES_99 23998 11.95 27.46 6.41 21 DKIM_VALID_EF 23965 26.19 27.42 25.75 22 T_KAM_HTML_FONT_INVALID 22772 19.48 26.06 17.13 23 FVGT_m_MULTI_ODD 22598 22.92 25.86 21.87 24 BOTNET 21026 7.38 24.06 1.42 25 XM_Multi_Part_URI 20612 15.19 23.59 12.19 26 RELAYCOUNTRY_META 20348 8.01 23.28 2.55 27 XM_UncommonTLD01 19703 9.32 22.55 4.59 28 RCVD_IN_MSPIKE_H2 19434 18.89 22.24 17.70 29 UNTRUSTED_Relay 19120 6.45 21.88 0.93 30 BAYES_999 18714 9.57 21.42 5.34 31 TR_DCC_Bayes_99 18465 7.72 21.13 2.93 32 XM_Body_Dirty_Words 16556 13.57 18.95 11.65 33 RCVD_IN_MSPIKE_WL 16062 25.79 18.38 28.44 34 XMSubLong 15821 19.04 18.10 19.37 35 HTML_MIME_NO_HTML_TAG 14988 6.17 17.15 2.24 36 T_TM2_M_HEADER_IN_MSG 14368 20.10 16.44 21.41 37 TR_XM_SpammyRelay 12634 4.63 14.46 1.12 38 HDRS_MISSP 11307 3.41 12.94 0.01 39 MPART_ALT_DIFF 11162 10.07 12.77 9.10 40 UNPARSEABLE_RELAY 10954 10.08 12.54 9.21 41 LOTS_OF_MONEY 10840 9.70 12.40 8.74 42 FSL_BULK_SIG 10668 9.95 12.21 9.15 43 TR_XM_UnparsRelay 10528 8.52 12.05 7.26 44 XM_B_Unsub 10315 15.42 11.80 16.72 45 RCVD_IN_MSPIKE_H3 9915 13.40 11.35 14.13 46 BOTNET_IPINHOSTNAME 9887 6.63 11.31 4.96 47 HTML_TAG_BALANCE_CENTER 9615 3.00 11.00 0.14 48 TR_XM_SpammyWords4 9319 6.85 10.66 5.48 49 SpammyFromTLD_02 9131 2.90 10.45 0.20 50 XM_B_SpammyWords3 8728 6.32 9.99 5.01 51 XM_UB50 8704 3.08 9.96 0.62 52 TR_XM_SpammyWords2 8655 3.41 9.90 1.09 53 RCVD_IN_BL_SPAMCOP_NET 8202 3.19 9.39 0.98 54 MIME_HTML_MOSTLY 7661 4.33 8.77 2.74 55 HTML_SHORT_LINK_IMG_1 7656 2.31 8.76 0.01 56 BODY_URI_ONLY 7640 2.30 8.74 0.00 57 XM_SendGrid 7370 7.91 8.43 7.72 58 XMSexyCombo_05 7054 5.26 8.07 4.25 59 BAYES_80 6954 5.38 7.96 4.46 60 HTML_IMAGE_RATIO_02 6650 7.20 7.61 7.06 61 GOOG_STO_IMG_HTML 6647 2.04 7.61 0.05 62 BAYES_60 6269 9.18 7.17 9.90 63 URI_NOVOWEL 5885 3.51 6.73 2.36 64 XM_Evil_Numbers_Gen 5829 7.99 6.67 8.46 65 RCVD_IN_MSPIKE_H4 5786 10.60 6.62 12.02 66 MIME_HTML_ONLY_MULTI 5206 6.75 5.96 7.04 67 RCVD_IN_MSPIKE_BL 5091 2.15 5.83 0.84 68 TR_XM_MSPIKECOMBO 5088 2.15 5.82 0.83 69 XMSubMetaSx_00 4982 4.53 5.70 4.11 70 RELAYCOUNTRY_CA 4931 2.08 5.64 0.80 71 SpammyFromTLD_01 4865 1.72 5.57 0.34 72 HTML_IMAGE_ONLY_04 4862 1.49 5.56 0.03 73 HTML_SHORT_CENTER 4851 1.47 5.55 0.00 74 LotsOfNums_01 4827 7.57 5.52 8.30 75 TooManyTo_001 4539 6.38 5.19 6.80 76 TR_XM_PhishingBody 4510 3.06 5.16 2.31 77 XM_B_Investor 4450 2.10 5.09 1.03 78 TM2_M_VERY_LONG_WORD 4392 2.40 5.03 1.46 79 TR_XM_DK_SendGrid 4296 4.92 4.92 4.93 80 XM_B_Phish_Phrases 4224 4.31 4.83 4.13 81 TR_XM_SPAMCOP 4199 1.55 4.81 0.38 82 XM_H_Long_From01 4033 4.76 4.62 4.81 83 HTML_IMAGE_RATIO_04 3952 5.98 4.52 6.50 84 XM_SPF_SoftFail 3884 2.11 4.44 1.28 85 HTML_FONT_SIZE_LARGE 3848 1.23 4.40 0.09 86 RCVD_IN_VALIDITY_SAFE 3839 5.62 4.39 6.06 87 DKIM_INVALID 3768 3.64 4.31 3.39 88 JH_SPAMMY_HEADERS 3738 1.13 4.28 0.00 89 HTML_IMAGE_ONLY_12 3691 1.20 4.22 0.12 90 BAYES_95 3641 3.08 4.17 2.69 91 HTML_SHORT_LINK_IMG_2 3601 1.10 4.12 0.03 92 TM2_M_URI_OPT_OUT 3594 7.11 4.11 8.19 93 XM_GoogleGroups 3370 2.06 3.86 1.42 94 TR_XM_SpammyWords3 3364 1.28 3.85 0.37 95 XM_B_SpammyTLD 3330 2.28 3.81 1.74 96 NO_DNS_FOR_FROM 3131 1.25 3.58 0.41 97 XM_OfRef6 3112 1.44 3.56 0.68 98 DKIM_ADSP_NXDOMAIN 3090 1.28 3.54 0.48 99 XMMoneyMeta_00 3067 1.05 3.51 0.17 100 FROM_MISSP_REPLYTO 3047 0.93 3.49 0.02 101 T_XMDrugObfuBody_14 3027 3.14 3.46 3.03 102 TR_XM_MaxUnsub 2966 1.80 3.39 1.23 103 FROM_SUSPICIOUS_NTLD 2945 0.93 3.37 0.05 104 RCVD_IN_VALIDITY_CERTIFIED 2943 4.77 3.37 5.27 105 FROM_SUSPICIOUS_NTLD_FP 2934 0.92 3.36 0.05 106 HTML_IMAGE_ONLY_08 2898 0.95 3.32 0.10 107 TR_XM_SpammyWords5 2823 1.95 3.23 1.49 108 XMBody_17 2776 1.12 3.18 0.39 109 BAYES_40 2742 4.34 3.14 4.76 110 URIBL_DBL_SPAM 2696 0.81 3.09 0.00 111 TVD_SPACE_RATIO 2686 1.79 3.07 1.33 112 RCVD_IN_MSPIKE_L3 2629 1.09 3.01 0.40 113 MIME_QP_LONG_LINE 2615 4.77 2.99 5.40 114 XMStrtUSub 2553 5.31 2.92 6.16 115 TR_XM_MaxWHORU 2535 0.98 2.90 0.30 116 XMLngstWrd_00 2506 1.56 2.87 1.10 117 XMLngstWrd_01 2474 1.48 2.83 1.00 118 XMNumbers 2470 4.46 2.83 5.04 119 HTML_TITLE_SUBJ_DIFF 2463 1.02 2.82 0.38 120 T_XMDrugObfuBody_08 2429 1.64 2.78 1.24 121 XMLngstWrd_02 2415 1.40 2.76 0.91 122 BAYES_00 2392 11.32 2.74 14.39 123 XMLngstWrd_03 2379 1.29 2.72 0.77 124 BAYES_20 2375 3.16 2.72 3.32 125 XMLngstWrd_04 2345 1.21 2.68 0.68 126 RELAYCOUNTRY_FR 2332 0.82 2.67 0.15 127 UPPERCASE_75_100 2322 0.98 2.66 0.38 128 HTML_IMAGE_RATIO_06 2280 3.04 2.61 3.20 129 XM_B_Phish66 2259 1.52 2.59 1.14 130 T_FILL_THIS_FORM_SHORT 2251 1.26 2.58 0.79 131 XMSexyCombo_01 2220 1.29 2.54 0.85 132 SUBJ_ALL_CAPS 2172 1.68 2.49 1.40 133 TM2_M_A_HREF_HREF 2168 1.26 2.48 0.82 134 HTML_FONT_TINY_NORDNS 2159 0.74 2.47 0.12 135 XM_CamelCaseFrm001 2114 1.72 2.42 1.48 136 XMDiploma_00 2024 1.40 2.32 1.07 137 T_REMOTE_IMAGE 2009 3.52 2.30 3.95 138 RELAYCOUNTRY_CZ 2007 0.61 2.30 0.00 139 T_HTML_TAG_BALANCE_CENTER 1962 0.60 2.25 0.01 140 XM_UB80 1917 0.59 2.19 0.02 141 HK_RANDOM_FROM 1901 0.64 2.18 0.08 142 HTML_IMAGE_RATIO_08 1858 1.99 2.13 1.93 143 XM_DIRTYINTL 1782 0.69 2.04 0.21 144 KHOP_HELO_FCRDNS 1779 1.31 2.04 1.05 145 XM_B_SpammyWords4 1772 0.94 2.03 0.55 146 RELAYCOUNTRY_RU 1751 0.54 2.00 0.01 147 XM_BadFromFormat 1745 0.61 2.00 0.11 148 RELAYCOUNTRY_IN 1731 0.55 1.98 0.04 149 TR_XM_NoHeaderRelay 1725 0.60 1.97 0.12 150 MAILING_LIST_MULTI 1720 1.77 1.97 1.70 151 ALL_TRUSTED 1718 15.91 1.97 20.90 152 RCVD_IN_MSPIKE_L5 1706 0.64 1.95 0.17 153 T_XMHurry_00 1651 0.89 1.89 0.53 154 T_TooManySym_01 1607 5.11 1.84 6.28 155 XM_UB60 1601 0.53 1.83 0.06 156 T_XMDrugObfuBody_00 1593 1.25 1.82 1.05 157 TR_XM_FormFill 1539 0.47 1.76 0.00 158 RCVD_IN_IADB_LISTED 1529 3.55 1.75 4.20 159 XM_DK_Undo_01 1490 1.44 1.71 1.34 160 TR_XM_PHPDW 1457 0.68 1.67 0.32 161 XMStockSpam_06 1435 1.59 1.64 1.56 162 DKIM_ADSP_CUSTOM_MED 1426 1.17 1.63 1.01 163 USER_IN_DEF_DKIM_WL 1384 11.07 1.58 14.46 164 XMBdyGiftCard01 1376 1.18 1.57 1.04 165 PDS_OTHER_BAD_TLD 1361 0.67 1.56 0.36 166 TR_XM_PHPForged 1325 0.58 1.52 0.24 167 BODY_EMPTY 1321 0.40 1.51 0.00 168 TR_XM_FormFill2 1314 0.57 1.50 0.24 169 XM_H_PHPOS 1307 0.57 1.50 0.24 170 XM_UB99 1272 0.38 1.46 0.00 171 XM_B_Unsub2 1253 1.40 1.43 1.39 172 XM_Body_Dirty_Words_01 1247 0.68 1.43 0.41 173 TR_XM_INV_DKIM 1241 0.98 1.42 0.82 174 RCVD_IN_IADB_SPF 1225 3.11 1.40 3.72 175 RELAYCOUNTRY_NO 1220 0.37 1.40 0.01 176 BAYES_05 1209 1.95 1.38 2.15 177 URI_HEX 1205 1.04 1.38 0.91 178 XM_H_Undi_Recip 1178 0.47 1.35 0.15 179 RCVD_IN_IADB_DK 1139 2.72 1.30 3.23 180 XMBrknScrpt_02 1133 0.95 1.30 0.83 181 FROM_EXCESS_BASE64 1122 2.71 1.28 3.22 182 RCVD_IN_IADB_SENDERID 1120 2.80 1.28 3.34 183 HK_RANDOM_REPLYTO 1098 0.38 1.26 0.07 184 RELAYCOUNTRY_AU 1098 0.50 1.26 0.23 185 TR_XM_SB_Phish 1094 3.25 1.25 3.96 186 TR_Mismatch_TLD_01 1093 0.58 1.25 0.34 187 XM_URI_RBL 1076 0.43 1.23 0.14 188 XMSubPhish11 1072 3.23 1.23 3.95 189 TR_LOTS_OF_MONEY3 1063 0.44 1.22 0.17 190 XM_OfRef7 1056 0.37 1.21 0.08 191 XMPhish30 1021 0.80 1.17 0.66 192 TR_Symld_Words 1015 1.49 1.16 1.61 193 RCVD_IN_VALIDITY_RPBL 1013 0.38 1.16 0.11 194 XM_UB95 1005 0.31 1.15 0.01 195 URIBL_BLACK 1002 0.32 1.15 0.03 196 XM_UB999 993 0.30 1.14 0.00 197 XM_B_COVIDMETA 988 0.61 1.13 0.42 198 TR_XM_BayesRelay 960 0.29 1.10 0.00 199 RELAYCOUNTRY_NL 931 0.37 1.07 0.12 200 RCVD_IN_IADB_VOUCHED 927 2.15 1.06 2.54 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 203522 86.48 95.56 83.23 2 RELAYCOUNTRY_US 188486 75.23 70.05 77.08 3 DKIM_SIGNED 169922 71.72 77.96 69.49 4 XM_DK_Pass 165494 69.85 75.95 67.68 5 XM_B_Unicode 163231 66.73 66.69 66.75 6 DKIM_VALID 161621 68.08 73.64 66.09 7 DCC_CHECK_NEGATIVE 149151 53.39 32.10 60.99 8 DKIM_VALID_AU 127113 52.91 55.49 51.98 9 BAYES_50 126934 49.56 42.99 51.91 10 XMListUnsubscribeExists 111909 50.68 64.45 45.76 11 XM_B_SpammyWords 107745 49.63 65.20 44.06 12 XM_B_Unicode3 101135 40.69 38.82 41.36 13 DCC_CHECK 95338 46.59 67.88 38.99 14 RCVD_IN_MSPIKE_WL 69536 25.79 18.38 28.44 15 HTML_FONT_LOW_CONTRAST 69079 28.36 28.68 28.25 16 DKIM_VALID_EF 62960 26.19 27.42 25.75 17 MIME_HTML_ONLY 62863 29.03 38.33 25.71 18 LOC_TINY_FONT_1 61431 27.90 35.66 25.12 19 FVGT_m_MULTI_ODD 53483 22.92 25.86 21.87 20 T_TM2_M_HEADER_IN_MSG 52348 20.10 16.44 21.41 21 ALL_TRUSTED 51097 15.91 1.97 20.90 22 XM_B_SpammyWords2 48238 22.72 31.08 19.73 23 XMSubLong 47364 19.04 18.10 19.37 24 RCVD_IN_MSPIKE_H2 43282 18.89 22.24 17.70 25 T_KAM_HTML_FONT_INVALID 41884 19.48 26.06 17.13 26 XM_B_Unsub 40879 15.42 11.80 16.72 27 USER_IN_DEF_DKIM_WL 35367 11.07 1.58 14.46 28 BAYES_00 35198 11.32 2.74 14.39 29 RCVD_IN_MSPIKE_H3 34560 13.40 11.35 14.13 30 XM_Multi_Part_URI 29808 15.19 23.59 12.19 31 RCVD_IN_MSPIKE_H4 29399 10.60 6.62 12.02 32 XM_Body_Dirty_Words 28484 13.57 18.95 11.65 33 BAYES_60 24201 9.18 7.17 9.90 34 XM_DKIMWhitelistDomains 23933 7.23 0.06 9.79 35 UNPARSEABLE_RELAY 22517 10.08 12.54 9.21 36 FSL_BULK_SIG 22371 9.95 12.21 9.15 37 MPART_ALT_DIFF 22248 10.07 12.77 9.10 38 LOTS_OF_MONEY 21372 9.70 12.40 8.74 39 XM_Evil_Numbers_Gen 20679 7.99 6.67 8.46 40 LotsOfNums_01 20307 7.57 5.52 8.30 41 TM2_M_URI_OPT_OUT 20017 7.11 4.11 8.19 42 XM_SendGrid 18874 7.91 8.43 7.72 43 XM_DK_Undo_02 18385 16.11 40.14 7.52 44 TR_XM_UnparsRelay 17749 8.52 12.05 7.26 45 TR_XM_DK_Bayes 17722 5.52 0.68 7.25 46 TR_XM_DK_Bayes1 17349 5.40 0.64 7.09 47 HTML_IMAGE_RATIO_02 17255 7.20 7.61 7.06 48 MIME_HTML_ONLY_MULTI 17205 6.75 5.96 7.04 49 TooManyTo_001 16640 6.38 5.19 6.80 50 HTML_IMAGE_RATIO_04 15889 5.98 4.52 6.50 51 BAYES_99 15674 11.95 27.46 6.41 52 XM_H_Trusted_IP 15466 4.66 0.00 6.32 53 T_TooManySym_01 15365 5.11 1.84 6.28 54 TR_XM_DK_Bayes2 15171 4.71 0.52 6.20 55 XMStrtUSub 15067 5.31 2.92 6.16 56 RCVD_IN_VALIDITY_SAFE 14809 5.62 4.39 6.06 57 TR_XM_SpammyWords4 13410 6.85 10.66 5.48 58 MIME_QP_LONG_LINE 13216 4.77 2.99 5.40 59 BAYES_999 13064 9.57 21.42 5.34 60 TR_XM_DKIM_Undo 12900 12.42 32.40 5.28 61 RCVD_IN_VALIDITY_CERTIFIED 12899 4.77 3.37 5.27 62 XMNumbers 12320 4.46 2.83 5.04 63 XM_B_SpammyWords3 12242 6.32 9.99 5.01 64 IN_ZIMBRA_NJ_WHITELIST 12212 3.69 0.04 4.99 65 BOTNET_IPINHOSTNAME 12124 6.63 11.31 4.96 66 TR_XM_DK_SendGrid 12046 4.92 4.92 4.93 67 XM_H_Long_From01 11752 4.76 4.62 4.81 68 BAYES_40 11648 4.34 3.14 4.76 69 XM_UncommonTLD01 11232 9.32 22.55 4.59 70 BAYES_80 10915 5.38 7.96 4.46 71 ANY_BOUNCE_MESSAGE 10691 3.34 0.44 4.37 72 BOUNCE_MESSAGE 10689 3.34 0.44 4.37 73 XMSexyCombo_05 10405 5.26 8.07 4.25 74 RCVD_IN_IADB_LISTED 10263 3.55 1.75 4.20 75 XM_B_Phish_Phrases 10096 4.31 4.83 4.13 76 XMSubMetaSx_00 10054 4.53 5.70 4.11 77 TR_XM_SB_Phish 9680 3.25 1.25 3.96 78 XMSubPhish11 9664 3.23 1.23 3.95 79 T_REMOTE_IMAGE 9659 3.52 2.30 3.95 80 T_TooManySym_02 9406 2.94 0.40 3.85 81 XM_PDF 9377 2.93 0.39 3.83 82 RCVD_IN_IADB_SPF 9088 3.11 1.40 3.72 83 DKIM_INVALID 8301 3.64 4.31 3.39 84 RCVD_IN_IADB_SENDERID 8162 2.80 1.28 3.34 85 BAYES_20 8117 3.16 2.72 3.32 86 RCVD_IN_IADB_DK 7898 2.72 1.30 3.23 87 FROM_EXCESS_BASE64 7866 2.71 1.28 3.22 88 HTML_IMAGE_RATIO_06 7813 3.04 2.61 3.20 89 INVALID_MSGID 7612 2.34 0.17 3.11 90 T_XMDrugObfuBody_14 7411 3.14 3.46 3.03 91 MSGID_NOFQDN1 7207 2.18 0.04 2.95 92 TR_DCC_Bayes_99 7174 7.72 21.13 2.93 93 MIME_HTML_MOSTLY 6700 4.33 8.77 2.74 94 BAYES_95 6583 3.08 4.17 2.69 95 RELAYCOUNTRY_META 6235 8.01 23.28 2.55 96 RCVD_IN_IADB_VOUCHED 6214 2.15 1.06 2.54 97 TO_MALFORMED 5982 1.81 0.04 2.45 98 URI_NOVOWEL 5772 3.51 6.73 2.36 99 TR_XM_PhishingBody 5659 3.06 5.16 2.31 100 RCVD_IN_MSPIKE_H5 5577 1.79 0.41 2.28 101 HTML_MIME_NO_HTML_TAG 5480 6.17 17.15 2.24 102 TVD_RCVD_IP 5345 1.65 0.15 2.19 103 BAYES_05 5254 1.95 1.38 2.15 104 IN_HORDE_ADDRESS_BOOK 4870 1.49 0.07 1.99 105 HTML_IMAGE_RATIO_08 4731 1.99 2.13 1.93 106 XMSubNoVowel 4443 1.58 0.90 1.82 107 XM_B_SpammyTLD 4247 2.28 3.81 1.74 108 MAILING_LIST_MULTI 4169 1.77 1.97 1.70 109 RCVD_IN_IADB_OPTIN 4015 1.36 0.56 1.64 110 XMBSHREFv2 3951 1.23 0.15 1.62 111 TR_Symld_Words 3925 1.49 1.16 1.61 112 XMStockSpam_06 3827 1.59 1.64 1.56 113 TR_XM_SpammyWords5 3647 1.95 3.23 1.49 114 XM_CamelCaseFrm001 3610 1.72 2.42 1.48 115 TM2_M_VERY_LONG_WORD 3559 2.40 5.03 1.46 116 XMGappySubj_01 3539 1.10 0.12 1.45 117 BOTNET 3475 7.38 24.06 1.42 118 XM_GoogleGroups 3471 2.06 3.86 1.42 119 SUBJ_ALL_CAPS 3416 1.68 2.49 1.40 120 XM_B_Unsub2 3403 1.40 1.43 1.39 121 XM_DK_Undo_01 3279 1.44 1.71 1.34 122 TVD_SPACE_RATIO 3260 1.79 3.07 1.33 123 XM_SPF_SoftFail 3123 2.11 4.44 1.28 124 T_XMDrugObfuBody_08 3026 1.64 2.78 1.24 125 TR_XM_MaxUnsub 3007 1.80 3.39 1.23 126 RCVD_IN_RP_SAFE 2957 1.13 0.90 1.21 127 SHORT_URI_2 2884 1.05 0.69 1.18 128 XM_B_Phish66 2798 1.52 2.59 1.14 129 TR_XM_SpammyRelay 2737 4.63 14.46 1.12 130 TooManyTo_002 2713 0.96 0.55 1.11 131 XMLngstWrd_00 2682 1.56 2.87 1.10 132 TR_XM_SpammyWords2 2654 3.41 9.90 1.09 133 XMDiploma_00 2627 1.40 2.32 1.07 134 RCVD_IN_RP_CERTIFIED 2612 0.97 0.68 1.07 135 KHOP_HELO_FCRDNS 2566 1.31 2.04 1.05 136 T_XMDrugObfuBody_00 2560 1.25 1.82 1.05 137 XMBdyGiftCard01 2555 1.18 1.57 1.04 138 XM_B_Investor 2521 2.10 5.09 1.03 139 DKIM_ADSP_CUSTOM_MED 2472 1.17 1.63 1.01 140 XMLngstWrd_01 2455 1.48 2.83 1.00 141 RCVD_IN_BL_SPAMCOP_NET 2391 3.19 9.39 0.98 142 HTML_FONT_FACE_BAD 2390 0.85 0.50 0.98 143 XMBody_95 2372 0.73 0.07 0.97 144 T_OBFU_PDF_ATTACH 2302 0.72 0.10 0.94 145 XM_H_Long_From02 2290 0.88 0.71 0.94 146 UNTRUSTED_Relay 2276 6.45 21.88 0.93 147 URI_HEX 2231 1.04 1.38 0.91 148 XMLngstWrd_02 2225 1.40 2.76 0.91 149 XM_D_tchamptons_WL 2146 0.65 0.00 0.88 150 HTML_IMAGE_ONLY_20 2091 0.67 0.15 0.86 151 T_TooManySym_03 2072 0.65 0.12 0.85 152 XMSexyCombo_01 2069 1.29 2.54 0.85 153 RCVD_IN_MSPIKE_BL 2042 2.15 5.83 0.84 154 TR_XM_MSPIKECOMBO 2038 2.15 5.82 0.83 155 XMBrknScrpt_02 2018 0.95 1.30 0.83 156 TR_XM_INV_DKIM 2017 0.98 1.42 0.82 157 TM2_M_A_HREF_HREF 2003 1.26 2.48 0.82 158 HTML_TAG_BALANCE_BODY 1975 0.83 0.90 0.81 159 RELAYCOUNTRY_CA 1958 2.08 5.64 0.80 160 T_FILL_THIS_FORM_SHORT 1931 1.26 2.58 0.79 161 TooManyTo_003 1902 0.68 0.42 0.78 162 XMLngstWrd_03 1892 1.29 2.72 0.77 163 XM_B_COPY_HTML 1816 0.75 0.77 0.74 164 XM_E_Blogspot 1683 0.58 0.28 0.69 165 XMLngstWrd_04 1675 1.21 2.68 0.68 166 XM_OfRef6 1668 1.44 3.56 0.68 167 XMPhish30 1625 0.80 1.17 0.66 168 TR_MetaPhish_Combo_01 1589 0.60 0.47 0.65 169 XM_UB50 1519 3.08 9.96 0.62 170 USER_IN_WELCOMELIST 1506 0.45 0.00 0.62 171 USER_IN_WHITELIST 1506 0.45 0.00 0.62 172 FORGED_GMAIL_RCVD 1492 0.64 0.74 0.61 173 HTTPS_HTTP_MISMATCH 1453 0.62 0.68 0.59 174 RDNS_DYNAMIC 1432 0.57 0.54 0.59 175 TooManyTo_004 1392 0.50 0.32 0.57 176 NML_ADSP_CUSTOM_MED 1363 0.61 0.76 0.56 177 XMBody_78 1358 0.56 0.58 0.56 178 XM_USANA_RCVD 1350 0.41 0.00 0.55 179 XM_B_SpammyWords4 1344 0.94 2.03 0.55 180 MPART_ALT_DIFF_COUNT 1321 0.61 0.80 0.54 181 XMHTMLBadTable_001 1318 0.61 0.80 0.54 182 T_XMHurry_00 1294 0.89 1.89 0.53 183 T_Symld_Words_02 1281 0.57 0.70 0.52 184 XM_B_DNDMA 1266 0.59 0.81 0.52 185 XM_ProductURIs 1242 0.62 0.93 0.51 186 XM_H_PHPMailer 1222 0.53 0.63 0.50 187 TR_XM_Spammywords 1215 0.46 0.34 0.50 188 XM_S_SpammyWords 1215 0.46 0.34 0.50 189 TR_MSPIKEBAYES00 1192 0.36 0.01 0.49 190 TooManyTo_005 1171 0.43 0.29 0.48 191 DKIM_ADSP_NXDOMAIN 1167 1.28 3.54 0.48 192 T_OBFU_DOC_ATTACH 1149 0.35 0.00 0.47 193 HELO_NODOT 1125 0.39 0.20 0.46 194 HELO_NO_DOMAIN 1125 0.39 0.20 0.46 195 XMSubMetaSxObfu_02 1094 0.44 0.41 0.45 196 URI_TRY_3LD 1088 0.52 0.72 0.44 197 XM_B_REG_HTML 1085 0.48 0.58 0.44 198 XMNoVowels 1070 0.47 0.55 0.44 199 RELAYCOUNTRY_GB 1044 0.56 0.92 0.43 200 XM_B_COVIDMETA 1030 0.61 1.13 0.42 ----------------------------------------------------------------------