Email: 281590 Autolearn: 0 AvgScore: 4.10 AvgScanTime: 1.30 sec Spam: 93766 Autolearn: 0 AvgScore: 15.24 AvgScanTime: 1.34 sec Ham: 187824 Autolearn: 0 AvgScore: -1.46 AvgScanTime: 1.28 sec Time Spent Running SA: 101.59 hours Time Spent Processing Spam: 34.91 hours Time Spent Processing Ham: 66.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 89225 87.05 95.16 83.00 2 DKIM_SIGNED 79915 75.89 85.23 71.23 3 XM_DK_Pass 74591 73.25 79.55 70.10 4 RELAYCOUNTRY_US 73713 76.44 78.61 75.35 5 DKIM_VALID 72549 71.32 77.37 68.30 6 DCC_CHECK 69599 52.16 74.23 41.15 7 XM_B_Unicode 68648 68.83 73.21 66.64 8 XMListUnsubscribeExists 62211 55.87 66.35 50.63 9 DKIM_VALID_AU 57457 58.08 61.28 56.48 10 XM_B_SpammyWords 55949 50.96 59.67 46.61 11 XM_DK_Undo_02 41224 20.38 43.96 8.60 12 XM_B_Unicode3 39464 42.46 42.09 42.64 13 BAYES_99 36398 17.72 38.82 7.19 14 LOC_TINY_FONT_1 34903 30.87 37.22 27.69 15 BAYES_50 34156 46.92 36.43 52.15 16 HTML_FONT_LOW_CONTRAST 33281 33.07 35.49 31.86 17 TR_XM_DKIM_Undo 31239 15.38 33.32 6.42 18 DKIM_VALID_EF 30767 28.97 32.81 27.04 19 BAYES_999 30142 14.62 32.15 5.88 20 XM_B_SpammyWords2 28844 21.75 30.76 17.25 21 MIME_HTML_ONLY 28820 24.05 30.74 20.72 22 TR_DCC_Bayes_99 25660 11.52 27.37 3.62 23 DCC_CHECK_NEGATIVE 24132 47.81 25.74 58.83 24 FVGT_m_MULTI_ODD 23289 24.09 24.84 23.72 25 RCVD_IN_MSPIKE_H2 22832 20.26 24.35 18.22 26 RELAYCOUNTRY_META 21958 9.67 23.42 2.81 27 XMSubLong 20662 22.19 22.04 22.27 28 XM_Body_Dirty_Words 20056 17.14 21.39 15.02 29 T_KAM_HTML_FONT_INVALID 19619 17.94 20.92 16.46 30 RCVD_IN_MSPIKE_WL 16867 26.10 17.99 30.15 31 T_TM2_M_HEADER_IN_MSG 16004 19.66 17.07 20.95 32 FSL_BULK_SIG 15631 8.50 16.67 4.42 33 XM_B_Unsub 14997 15.33 15.99 15.00 34 UNPARSEABLE_RELAY 14371 10.97 15.33 8.79 35 TR_XM_UnparsRelay 14189 9.80 15.13 7.14 36 XM_UncommonTLD01 14020 7.89 14.95 4.37 37 XM_Multi_Part_URI 13986 13.91 14.92 13.41 38 BOTNET 12787 5.53 13.64 1.49 39 UNTRUSTED_Relay 12489 5.21 13.32 1.17 40 TR_XM_SpammyWords2 11691 5.61 12.47 2.19 41 TooManyTo_001 11536 11.96 12.30 11.79 42 LOTS_OF_MONEY 10898 7.75 11.62 5.82 43 BOTNET_IPINHOSTNAME 10618 7.78 11.32 6.02 44 RCVD_IN_MSPIKE_H3 10330 13.76 11.02 15.14 45 XM_B_SpammyWords3 9540 6.84 10.17 5.18 46 XMSubMetaSx_00 9536 8.54 10.17 7.73 47 RCVD_IN_BL_SPAMCOP_NET 9447 3.98 10.08 0.94 48 TR_XM_SpammyRelay 9246 4.08 9.86 1.20 49 MPART_ALT_DIFF 9106 6.73 9.71 5.24 50 TR_XM_SpammyWords4 8536 5.46 9.10 3.64 51 HTML_IMAGE_RATIO_02 8526 8.44 9.09 8.12 52 XMSexyCombo_05 8423 5.72 8.98 4.09 53 XM_SendGrid 8375 7.37 8.93 6.59 54 XM_B_SpammyTLD 8141 4.32 8.68 2.14 55 TR_XM_MaxUnsub 7872 3.74 8.40 1.41 56 SpammyFromTLD_02 7797 2.88 8.32 0.16 57 BAYES_60 7460 10.47 7.96 11.72 58 DKIM_INVALID 7366 4.58 7.86 2.94 59 XM_Evil_Numbers_Gen 7263 8.15 7.75 8.35 60 XM_SPF_SoftFail 7013 3.35 7.48 1.28 61 RCVD_IN_MSPIKE_BL 6703 3.05 7.15 1.01 62 TR_XM_MSPIKECOMBO 6622 3.02 7.06 1.00 63 MIME_QP_LONG_LINE 6534 8.33 6.97 9.01 64 BAYES_80 6475 5.66 6.91 5.03 65 URIBL_DBL_SPAM 6418 2.29 6.84 0.02 66 RCVD_IN_MSPIKE_H4 6335 10.86 6.76 12.91 67 PDS_OTHER_BAD_TLD 6248 2.52 6.66 0.46 68 HTML_MIME_NO_HTML_TAG 5645 3.08 6.02 1.62 69 XMStrtUSub 5541 6.07 5.91 6.15 70 FROM_SUSPICIOUS_NTLD 5472 1.99 5.84 0.07 71 XM_H_Long_From01 5449 5.36 5.81 5.14 72 FROM_SUSPICIOUS_NTLD_FP 5432 1.97 5.79 0.07 73 TR_XM_DK_SendGrid 5285 4.72 5.64 4.27 74 TR_XM_PhishingBody 5068 3.90 5.40 3.15 75 MIME_HTML_MOSTLY 4994 3.34 5.33 2.34 76 XM_UB50 4917 2.22 5.24 0.71 77 TR_XM_SPAMCOP 4893 1.93 5.22 0.29 78 MIME_HTML_ONLY_MULTI 4810 4.00 5.13 3.43 79 TM2_M_URI_OPT_OUT 4791 7.91 5.11 9.31 80 HDRS_MISSP 4669 1.66 4.98 0.01 81 XM_B_Phish_Phrases 4547 3.81 4.85 3.29 82 RELAYCOUNTRY_CA 4391 2.04 4.68 0.72 83 TR_XM_INV_DKIM 4379 1.74 4.67 0.28 84 XMSexyCombo_01 4340 3.30 4.63 2.64 85 T_REMOTE_IMAGE 4311 3.39 4.60 2.78 86 XM_H_TOP 4150 1.48 4.43 0.01 87 RCVD_IN_VALIDITY_SAFE 4126 6.85 4.40 8.07 88 XMSubNoVowel 4076 2.40 4.35 1.42 89 BAYES_95 4073 3.45 4.34 3.00 90 DATE_IN_PAST_12_24 3965 1.43 4.23 0.03 91 LotsOfNums_01 3882 7.35 4.14 8.95 92 SpammyFromTLD_01 3816 1.57 4.07 0.33 93 URI_NOVOWEL 3694 2.42 3.94 1.65 94 RCVD_IN_VALIDITY_RPBL 3692 1.39 3.94 0.12 95 HTML_IMAGE_RATIO_04 3678 5.25 3.92 5.91 96 RELAYCOUNTRY_DE 3611 1.45 3.85 0.25 97 TR_XM_SpammyWords3 3602 1.67 3.84 0.59 98 TM2_M_VERY_LONG_WORD 3467 2.27 3.70 1.56 99 BODY_URI_ONLY 3461 1.23 3.69 0.01 100 MPART_ALT_DIFF_COUNT 3449 1.64 3.68 0.62 101 XM_BadFromFormat 3321 1.26 3.54 0.12 102 XMSubLongNoVowel 3284 1.17 3.50 0.01 103 KHOP_HELO_FCRDNS 3213 1.78 3.43 0.96 104 USER_IN_DEF_DKIM_WL 3151 11.83 3.36 16.05 105 XMSubGarbage 3130 1.19 3.34 0.12 106 RCVD_IN_MSPIKE_L5 3123 1.13 3.33 0.03 107 RCVD_IN_VALIDITY_CERTIFIED 3106 6.01 3.31 7.36 108 T_XMDrugObfuBody_14 3101 2.96 3.31 2.78 109 XMBody_17 3091 1.50 3.30 0.61 110 RCVD_IN_PSBL 3070 1.21 3.27 0.18 111 T_TVD_MIME_EPI 3025 1.08 3.23 0.01 112 RELAYCOUNTRY_RU 2910 1.05 3.10 0.02 113 ALL_TRUSTED 2899 16.05 3.09 22.52 114 XM_UB60 2846 1.05 3.04 0.06 115 T_FILL_THIS_FORM_SHORT 2844 1.30 3.03 0.43 116 TR_XM_SpammyWords5 2829 1.80 3.02 1.20 117 XM_B_Investor 2823 2.03 3.01 1.54 118 GOOG_STO_IMG_HTML 2762 0.98 2.95 0.00 119 HTML_SHORT_LINK_IMG_1 2713 0.97 2.89 0.02 120 SUSP_UTF8_WORD_SUBJ 2673 0.97 2.85 0.04 121 RCVD_IN_MSPIKE_L3 2645 1.47 2.82 0.79 122 XM_OfRef6 2605 1.34 2.78 0.63 123 URIBL_CSS 2541 0.91 2.71 0.02 124 URIBL_CSS_A 2541 0.91 2.71 0.02 125 XMNumbers 2509 4.11 2.68 4.82 126 HTML_IMAGE_RATIO_06 2496 3.41 2.66 3.79 127 DKIM_ADSP_NXDOMAIN 2490 1.26 2.66 0.56 128 BOTNET_NORDNS 2436 0.87 2.60 0.01 129 HTML_IMAGE_ONLY_04 2385 0.87 2.54 0.03 130 XM_DIRTYINTL 2343 0.98 2.50 0.23 131 SHORT_URI_2 2333 4.40 2.49 5.35 132 XM_B_Phish66 2262 1.57 2.41 1.15 133 T_XMDrugObfuBody_08 2254 1.69 2.40 1.33 134 HTML_SHORT_CENTER 2229 0.80 2.38 0.01 135 XM_H_Undi_Recip 2191 0.87 2.34 0.14 136 TR_LOTS_OF_MONEY3 2154 0.97 2.30 0.31 137 MIME_HEADER_CTYPE_ONLY 2124 0.83 2.27 0.11 138 TR_XM_NoHeaderRelay 2097 0.85 2.24 0.16 139 JH_SPAMMY_HEADERS 2091 0.74 2.23 0.00 140 SHOPIFY_IMG_NOT_RCVD_SFY 2074 0.89 2.21 0.23 141 XM_UB99 2022 0.72 2.16 0.00 142 TR_XM_FormFill 2010 0.73 2.14 0.02 143 BAYES_40 1970 4.05 2.10 5.03 144 FROM_EXCESS_BASE64 1928 2.70 2.06 3.02 145 XMLngstWrd_00 1781 1.10 1.90 0.71 146 XMStockSpam_06 1777 2.00 1.90 2.05 147 TR_XM_PHPDW 1771 0.87 1.89 0.36 148 T_XMHurry_00 1768 1.21 1.89 0.87 149 XM_CamelCaseFrm001 1748 1.67 1.86 1.57 150 XMLngstWrd_01 1740 1.06 1.86 0.66 151 XM_DK_Undo_01 1704 1.41 1.82 1.21 152 XMLngstWrd_02 1702 0.99 1.82 0.58 153 XMSpecificSbj 1688 0.60 1.80 0.00 154 XM_Body_Dirty_Words_01 1684 1.13 1.80 0.79 155 RELAYCOUNTRY_FR 1679 0.69 1.79 0.14 156 XM_UB999 1642 0.58 1.75 0.00 157 XMLngstWrd_03 1595 0.89 1.70 0.48 158 XMDiploma_00 1584 1.38 1.69 1.23 159 TR_MetaPhish_Combo_01 1582 1.06 1.69 0.74 160 TR_XM_PHPForged 1576 0.72 1.68 0.24 161 XMLngstWrd_04 1558 0.83 1.66 0.42 162 SUBJ_ALL_CAPS 1557 1.23 1.66 1.01 163 TR_XM_FormFill2 1554 0.71 1.66 0.24 164 XM_GoogleGroups 1550 1.53 1.65 1.48 165 XM_H_PHPOS 1547 0.70 1.65 0.23 166 BAYES_20 1523 2.92 1.62 3.57 167 TR_XM_SB_Phish 1515 1.55 1.62 1.51 168 T_TooManySym_01 1497 5.78 1.60 7.86 169 XMBdyGiftCard01 1471 1.51 1.57 1.48 170 URI_HEX 1392 1.49 1.48 1.49 171 HTML_IMAGE_RATIO_08 1389 2.43 1.48 2.91 172 TR_Mismatch_TLD_02 1370 0.52 1.46 0.05 173 URIBL_DBL_ABUSE_SPAM 1335 0.50 1.42 0.03 174 TR_XM_BayesRelay 1325 0.47 1.41 0.01 175 XMPhish30 1308 1.43 1.39 1.45 176 XMSubMetaI_00 1298 0.95 1.38 0.74 177 XM_B_SpammyWords4 1293 0.76 1.38 0.45 178 RCVD_IN_IADB_LISTED 1263 2.78 1.35 3.50 179 XM_B_Unsub2 1261 1.10 1.34 0.98 180 TM2_M_A_HREF_HREF 1211 0.72 1.29 0.44 181 T_XMDrugObfuBody_00 1197 0.71 1.28 0.42 182 XM_B_COVIDMETA 1193 0.94 1.27 0.77 183 HTML_TAG_BALANCE_BODY 1182 0.88 1.26 0.70 184 BAYES_00 1148 7.34 1.22 10.40 185 MAILING_LIST_MULTI 1139 1.77 1.21 2.05 186 SUBJ_YOUR_FAMILY 1132 0.41 1.21 0.01 187 RELAYCOUNTRY_AU 1102 0.55 1.18 0.23 188 PLING_QUERY 1101 0.58 1.17 0.28 189 HTML_IMAGE_ONLY_08 1078 0.46 1.15 0.11 190 URI_TRY_3LD 1075 0.71 1.15 0.49 191 FILL_THIS_FORM 1074 0.56 1.15 0.27 192 XMSlimDrugH 1060 0.58 1.13 0.30 193 DKIM_ADSP_CUSTOM_MED 1059 0.96 1.13 0.87 194 HTML_TITLE_SUBJ_DIFF 1050 0.48 1.12 0.17 195 FILL_THIS_FORM_LONG 1039 0.43 1.11 0.09 196 XMSubPhish11 1037 1.35 1.11 1.48 197 UPPERCASE_75_100 1036 0.48 1.10 0.17 198 XMBrknScrpt_02 1025 1.08 1.09 1.08 199 RCVD_IN_IADB_SPF 1024 2.46 1.09 3.14 200 T_Symld_Words_02 1023 0.67 1.09 0.45 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155886 87.05 95.16 83.00 2 RELAYCOUNTRY_US 141533 76.44 78.61 75.35 3 DKIM_SIGNED 133795 75.89 85.23 71.23 4 XM_DK_Pass 131666 73.25 79.55 70.10 5 DKIM_VALID 128277 71.32 77.37 68.30 6 XM_B_Unicode 125165 68.83 73.21 66.64 7 DCC_CHECK_NEGATIVE 110499 47.81 25.74 58.83 8 DKIM_VALID_AU 106080 58.08 61.28 56.48 9 BAYES_50 97956 46.92 36.43 52.15 10 XMListUnsubscribeExists 95100 55.87 66.35 50.63 11 XM_B_SpammyWords 87541 50.96 59.67 46.61 12 XM_B_Unicode3 80090 42.46 42.09 42.64 13 DCC_CHECK 77289 52.16 74.23 41.15 14 HTML_FONT_LOW_CONTRAST 59843 33.07 35.49 31.86 15 RCVD_IN_MSPIKE_WL 56623 26.10 17.99 30.15 16 LOC_TINY_FONT_1 52010 30.87 37.22 27.69 17 DKIM_VALID_EF 50796 28.97 32.81 27.04 18 FVGT_m_MULTI_ODD 44555 24.09 24.84 23.72 19 ALL_TRUSTED 42301 16.05 3.09 22.52 20 XMSubLong 41833 22.19 22.04 22.27 21 T_TM2_M_HEADER_IN_MSG 39349 19.66 17.07 20.95 22 MIME_HTML_ONLY 38913 24.05 30.74 20.72 23 RCVD_IN_MSPIKE_H2 34224 20.26 24.35 18.22 24 XM_B_SpammyWords2 32404 21.75 30.76 17.25 25 T_KAM_HTML_FONT_INVALID 30907 17.94 20.92 16.46 26 USER_IN_DEF_DKIM_WL 30154 11.83 3.36 16.05 27 RCVD_IN_MSPIKE_H3 28428 13.76 11.02 15.14 28 XM_Body_Dirty_Words 28208 17.14 21.39 15.02 29 XM_B_Unsub 28172 15.33 15.99 15.00 30 XM_Multi_Part_URI 25187 13.91 14.92 13.41 31 RCVD_IN_MSPIKE_H4 24257 10.86 6.76 12.91 32 TooManyTo_001 22144 11.96 12.30 11.79 33 BAYES_60 22013 10.47 7.96 11.72 34 BAYES_00 19526 7.34 1.22 10.40 35 XM_DKIMWhitelistDomains 19278 7.09 0.72 10.26 36 TM2_M_URI_OPT_OUT 17484 7.91 5.11 9.31 37 MIME_QP_LONG_LINE 16919 8.33 6.97 9.01 38 LotsOfNums_01 16801 7.35 4.14 8.95 39 UNPARSEABLE_RELAY 16514 10.97 15.33 8.79 40 XM_DK_Undo_02 16157 20.38 43.96 8.60 41 XM_Evil_Numbers_Gen 15689 8.15 7.75 8.35 42 HTML_IMAGE_RATIO_02 15251 8.44 9.09 8.12 43 RCVD_IN_VALIDITY_SAFE 15156 6.85 4.40 8.07 44 T_TooManySym_01 14771 5.78 1.60 7.86 45 XMSubMetaSx_00 14515 8.54 10.17 7.73 46 RCVD_IN_VALIDITY_CERTIFIED 13827 6.01 3.31 7.36 47 BAYES_99 13505 17.72 38.82 7.19 48 TR_XM_UnparsRelay 13402 9.80 15.13 7.14 49 XM_SendGrid 12378 7.37 8.93 6.59 50 TR_XM_DKIM_Undo 12058 15.38 33.32 6.42 51 XMStrtUSub 11546 6.07 5.91 6.15 52 TR_XM_DK_Bayes 11422 4.25 0.58 6.08 53 BOTNET_IPINHOSTNAME 11299 7.78 11.32 6.02 54 TR_XM_DK_Bayes1 11205 4.17 0.57 5.97 55 HTML_IMAGE_RATIO_04 11106 5.25 3.92 5.91 56 BAYES_999 11040 14.62 32.15 5.88 57 LOTS_OF_MONEY 10926 7.75 11.62 5.82 58 TR_XM_DK_Bayes2 10157 3.71 0.30 5.41 59 SHORT_URI_2 10055 4.40 2.49 5.35 60 IN_ZIMBRA_NJ_WHITELIST 9879 3.53 0.07 5.26 61 MPART_ALT_DIFF 9841 6.73 9.71 5.24 62 XM_B_SpammyWords3 9726 6.84 10.17 5.18 63 XM_H_Long_From01 9646 5.36 5.81 5.14 64 BAYES_80 9451 5.66 6.91 5.03 65 BAYES_40 9448 4.05 2.10 5.03 66 T_TooManySym_02 9300 3.47 0.50 4.95 67 XMNumbers 9054 4.11 2.68 4.82 68 FSL_BULK_SIG 8301 8.50 16.67 4.42 69 XM_UncommonTLD01 8207 7.89 14.95 4.37 70 TR_XM_DK_SendGrid 8012 4.72 5.64 4.27 71 ANY_BOUNCE_MESSAGE 7807 2.90 0.39 4.16 72 BOUNCE_MESSAGE 7804 2.90 0.39 4.15 73 XMSexyCombo_05 7675 5.72 8.98 4.09 74 HTML_IMAGE_RATIO_06 7116 3.41 2.66 3.79 75 INVALID_MSGID 6968 2.52 0.14 3.71 76 TR_XM_SpammyWords4 6833 5.46 9.10 3.64 77 TR_DCC_Bayes_99 6790 11.52 27.37 3.62 78 XM_H_Trusted_IP 6752 2.40 0.00 3.59 79 MSGID_NOFQDN1 6705 2.39 0.03 3.57 80 BAYES_20 6696 2.92 1.62 3.57 81 RCVD_IN_IADB_LISTED 6567 2.78 1.35 3.50 82 MIME_HTML_ONLY_MULTI 6449 4.00 5.13 3.43 83 XM_B_Phish_Phrases 6181 3.81 4.85 3.29 84 TO_MALFORMED 6116 2.17 0.00 3.26 85 TR_XM_PhishingBody 5920 3.90 5.40 3.15 86 RCVD_IN_IADB_SPF 5891 2.46 1.09 3.14 87 FROM_EXCESS_BASE64 5665 2.70 2.06 3.02 88 BAYES_95 5637 3.45 4.34 3.00 89 DKIM_INVALID 5518 4.58 7.86 2.94 90 HTML_IMAGE_RATIO_08 5462 2.43 1.48 2.91 91 RCVD_IN_IADB_SENDERID 5443 2.26 0.99 2.90 92 RCVD_IN_IADB_DK 5325 2.22 0.98 2.84 93 RELAYCOUNTRY_META 5276 9.67 23.42 2.81 94 T_XMDrugObfuBody_14 5224 2.96 3.31 2.78 95 T_REMOTE_IMAGE 5221 3.39 4.60 2.78 96 TVD_RCVD_IP 5118 1.87 0.16 2.72 97 XMSexyCombo_01 4965 3.30 4.63 2.64 98 MIME_HTML_MOSTLY 4404 3.34 5.33 2.34 99 TR_XM_SpammyWords2 4106 5.61 12.47 2.19 100 RCVD_IN_IADB_VOUCHED 4022 1.73 0.91 2.14 101 XM_B_SpammyTLD 4013 4.32 8.68 2.14 102 IN_HORDE_ADDRESS_BOOK 3958 1.48 0.21 2.11 103 RCVD_IN_MSPIKE_H5 3938 1.47 0.22 2.10 104 XMStockSpam_06 3851 2.00 1.90 2.05 105 MAILING_LIST_MULTI 3844 1.77 1.21 2.05 106 XMBSHREFv2 3841 1.45 0.25 2.04 107 BAYES_05 3589 1.47 0.58 1.91 108 XM_PDF 3551 1.40 0.41 1.89 109 URI_NOVOWEL 3107 2.42 3.94 1.65 110 XMGappySubj_01 3099 1.13 0.08 1.65 111 TVD_SPACE_RATIO 3097 1.16 0.17 1.65 112 HTML_MIME_NO_HTML_TAG 3040 3.08 6.02 1.62 113 XM_CamelCaseFrm001 2949 1.67 1.86 1.57 114 TM2_M_VERY_LONG_WORD 2931 2.27 3.70 1.56 115 XM_B_Investor 2890 2.03 3.01 1.54 116 RCVD_IN_RP_SAFE 2845 1.36 1.06 1.51 117 TR_XM_SB_Phish 2836 1.55 1.62 1.51 118 BOTNET 2796 5.53 13.64 1.49 119 URI_HEX 2790 1.49 1.48 1.49 120 XMBdyGiftCard01 2778 1.51 1.57 1.48 121 XMSubPhish11 2777 1.35 1.11 1.48 122 XM_GoogleGroups 2772 1.53 1.65 1.48 123 XMPhish30 2723 1.43 1.39 1.45 124 XMSubNoVowel 2673 2.40 4.35 1.42 125 TR_XM_MaxUnsub 2653 3.74 8.40 1.41 126 RCVD_IN_RP_CERTIFIED 2650 1.20 0.78 1.41 127 RCVD_IN_IADB_OPTIN 2592 1.10 0.54 1.38 128 T_XMDrugObfuBody_08 2495 1.69 2.40 1.33 129 TR_Symld_Words 2430 1.22 1.06 1.29 130 XM_SPF_SoftFail 2410 3.35 7.48 1.28 131 XMDiploma_00 2316 1.38 1.69 1.23 132 T_TooManySym_03 2273 0.86 0.17 1.21 133 XM_DK_Undo_01 2273 1.41 1.82 1.21 134 TR_XM_SpammyRelay 2256 4.08 9.86 1.20 135 TR_XM_SpammyWords5 2251 1.80 3.02 1.20 136 HTML_FONT_FACE_BAD 2216 1.00 0.65 1.18 137 UNTRUSTED_Relay 2192 5.21 13.32 1.17 138 TooManyTo_002 2161 0.95 0.55 1.15 139 XM_B_Phish66 2153 1.57 2.41 1.15 140 XMBrknScrpt_02 2025 1.08 1.09 1.08 141 XM_H_Long_From02 1929 0.97 0.86 1.03 142 SUBJ_ALL_CAPS 1895 1.23 1.66 1.01 143 RCVD_IN_MSPIKE_BL 1888 3.05 7.15 1.01 144 TR_XM_MSPIKECOMBO 1887 3.02 7.06 1.00 145 XM_B_Unsub2 1834 1.10 1.34 0.98 146 KHOP_HELO_FCRDNS 1801 1.78 3.43 0.96 147 SHORTENED_URL_HREF 1774 0.78 0.46 0.94 148 RCVD_IN_BL_SPAMCOP_NET 1763 3.98 10.08 0.94 149 XM_RXBody 1696 0.91 0.92 0.90 150 XM_B_COPY_HTML 1686 0.85 0.75 0.90 151 T_XMHurry_00 1639 1.21 1.89 0.87 152 DKIM_ADSP_CUSTOM_MED 1634 0.96 1.13 0.87 153 HTML_IMAGE_ONLY_20 1600 0.69 0.37 0.85 154 TooManyTo_003 1564 0.73 0.52 0.83 155 RCVD_IN_MSPIKE_L3 1492 1.47 2.82 0.79 156 XM_Body_Dirty_Words_01 1491 1.13 1.80 0.79 157 XM_B_COVIDMETA 1450 0.94 1.27 0.77 158 USER_IN_WELCOMELIST 1439 0.51 0.00 0.77 159 USER_IN_WHITELIST 1439 0.51 0.00 0.77 160 XMBody_95 1406 0.56 0.20 0.75 161 XMSubMetaSSx_00 1400 0.77 0.82 0.75 162 TR_MetaPhish_Combo_01 1389 1.06 1.69 0.74 163 XMSubMetaI_00 1386 0.95 1.38 0.74 164 RELAYCOUNTRY_CA 1349 2.04 4.68 0.72 165 XM_UB50 1341 2.22 5.24 0.71 166 XMLngstWrd_00 1329 1.10 1.90 0.71 167 XMGenDplmaNmb 1329 0.69 0.66 0.71 168 HTML_TAG_BALANCE_BODY 1308 0.88 1.26 0.70 169 TR_MSPIKEBAYES00 1270 0.45 0.01 0.68 170 TooManyTo_004 1250 0.60 0.47 0.67 171 XMLngstWrd_01 1237 1.06 1.86 0.66 172 XMSubMetaSxObfu_03 1202 0.69 0.78 0.64 173 RDNS_DYNAMIC 1191 0.57 0.44 0.63 174 XM_OfRef6 1175 1.34 2.78 0.63 175 XM_B_DNDMA 1169 0.76 1.05 0.62 176 MPART_ALT_DIFF_COUNT 1164 1.64 3.68 0.62 177 XMBody_17 1137 1.50 3.30 0.61 178 XMHTMLBadTable_001 1121 0.69 0.86 0.60 179 TR_XM_SpammyWords3 1109 1.67 3.84 0.59 180 XMLngstWrd_02 1088 0.99 1.82 0.58 181 TooManyTo_005 1059 0.52 0.44 0.56 182 NML_ADSP_CUSTOM_MED 1053 0.62 0.73 0.56 183 XM_ProductURIs 1047 0.53 0.46 0.56 184 DKIM_ADSP_NXDOMAIN 1046 1.26 2.66 0.56 185 T_TooManySym_04 1024 0.39 0.07 0.55 186 DATE_IN_PAST_03_06 1024 0.60 0.72 0.55 187 XMSubMetaSxObfu_02 1019 0.44 0.24 0.54 188 HTTPS_HTTP_MISMATCH 986 0.57 0.68 0.52 189 XMSubMetaSx_01 957 0.58 0.73 0.51 190 HTML_TEXT_INVISIBLE_STYLE 955 0.46 0.37 0.51 191 XMUrgent 952 0.42 0.23 0.51 192 NO_DNS_FOR_FROM 949 0.50 0.49 0.51 193 RELAYCOUNTRY_GB 942 0.61 0.82 0.50 194 XMHTML_After_End 938 0.59 0.77 0.50 195 XM_H_PHPMailer 932 0.67 1.02 0.50 196 URI_TRY_3LD 922 0.71 1.15 0.49 197 NUMERIC_HTTP_ADDR 918 0.47 0.44 0.49 198 XM_Ancestry_Forge 911 0.32 0.00 0.49 199 XM_B_REG_HTML 909 0.51 0.57 0.48 200 TVD_SPACE_RATIO_MINFP 903 0.35 0.10 0.48 ----------------------------------------------------------------------