Email: 352780 Autolearn: 0 AvgScore: 3.67 AvgScanTime: 1.25 sec Spam: 126314 Autolearn: 0 AvgScore: 14.21 AvgScanTime: 1.35 sec Ham: 226466 Autolearn: 0 AvgScore: -2.21 AvgScanTime: 1.19 sec Time Spent Running SA: 122.29 hours Time Spent Processing Spam: 47.38 hours Time Spent Processing Ham: 74.92 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 119240 87.87 94.40 84.23 2 DKIM_SIGNED 110200 78.33 87.24 73.36 3 XM_DK_Pass 108328 77.15 85.76 72.35 4 DKIM_VALID 107606 76.51 85.19 71.67 5 XM_B_Unicode 101382 74.28 80.26 70.95 6 RELAYCOUNTRY_US 100828 79.54 79.82 79.38 7 DCC_CHECK 94759 51.18 75.02 37.89 8 XMListUnsubscribeExists 88658 58.61 70.19 52.15 9 XM_B_SpammyWords 82429 51.16 65.26 43.30 10 DKIM_VALID_AU 81649 60.98 64.64 58.94 11 RCVD_IN_MSPIKE_H2 63319 42.01 50.13 37.48 12 XM_DK_Undo_02 58232 21.74 46.10 8.15 13 XM_B_Unicode3 57289 45.50 45.35 45.59 14 BAYES_50 48904 48.17 38.72 53.44 15 BAYES_99 46797 17.80 37.05 7.06 16 XM_B_SpammyWords2 46255 24.87 36.62 18.31 17 LOC_TINY_FONT_1 44484 29.24 35.22 25.91 18 TR_XM_DKIM_Undo 43907 15.89 34.76 5.37 19 MIME_HTML_ONLY 42763 25.44 33.85 20.74 20 FVGT_m_MULTI_ODD 41832 28.16 33.12 25.40 21 HTML_FONT_LOW_CONTRAST 40372 31.55 31.96 31.33 22 BAYES_999 37779 14.40 29.91 5.76 23 DKIM_VALID_EF 37675 28.43 29.83 27.65 24 TR_DCC_Bayes_99 34362 11.45 27.20 2.66 25 T_KAM_HTML_FONT_INVALID 32466 20.98 25.70 18.35 26 DCC_CHECK_NEGATIVE 31528 48.80 24.96 62.09 27 RELAYCOUNTRY_META 28702 10.47 22.72 3.64 28 XM_Body_Dirty_Words 24581 14.73 19.46 12.09 29 XM_Multi_Part_URI 24364 15.89 19.29 13.99 30 XMSubLong 23108 19.07 18.29 19.50 31 T_TM2_M_HEADER_IN_MSG 23072 21.67 18.27 23.57 32 RCVD_IN_MSPIKE_WL 17684 16.25 14.00 17.50 33 XM_B_Unsub 17653 12.11 13.98 11.06 34 TR_XM_BayesUnsub 17418 10.05 13.79 7.96 35 UNPARSEABLE_RELAY 17286 10.39 13.68 8.55 36 TR_XM_SpammyRelay 17195 5.98 13.61 1.73 37 TR_XM_UnparsRelay 16942 9.21 13.41 6.86 38 TR_XM_SpammyWords2 16459 5.65 13.03 1.54 39 RCVD_IN_BL_SPAMCOP_NET 15655 4.92 12.39 0.74 40 FSL_BULK_SIG 15191 7.36 12.03 4.76 41 BOTNET_IPINHOSTNAME 14521 7.61 11.50 5.44 42 RCVD_IN_MSPIKE_H3 14248 11.38 11.28 11.43 43 BOTNET 13611 4.75 10.78 1.39 44 XM_B_SpammyWords3 13116 6.17 10.38 3.81 45 UNTRUSTED_Relay 12947 4.75 10.25 1.68 46 XM_Evil_Numbers_Gen 12617 9.47 9.99 9.18 47 LOTS_OF_MONEY 12202 7.18 9.66 5.80 48 MPART_ALT_DIFF 11886 7.05 9.41 5.73 49 RELAYCOUNTRY_CA 11098 3.81 8.79 1.03 50 XMSexyCombo_05 11000 5.57 8.71 3.82 51 TR_XM_SPAMCOP 10404 3.10 8.24 0.24 52 TR_XM_SpammyWords4 10232 5.33 8.10 3.79 53 XM_UncommonTLD01 10218 5.56 8.09 4.15 54 BAYES_80 10212 6.42 8.08 5.49 55 XM_SendGrid 10039 6.46 7.95 5.63 56 BAYES_60 9833 9.80 7.78 10.93 57 HTML_IMAGE_RATIO_02 9601 7.77 7.60 7.86 58 LotsOfNums_01 9265 8.62 7.33 9.33 59 MIME_HTML_ONLY_MULTI 8464 4.87 6.70 3.85 60 HTML_MIME_NO_HTML_TAG 8247 3.22 6.53 1.37 61 TM2_M_VERY_LONG_WORD 8084 3.08 6.40 1.23 62 XM_H_Long_From01 7502 5.19 5.94 4.77 63 TR_XM_PhishingBody 7457 3.62 5.90 2.35 64 XMStrtUSub 7246 6.03 5.74 6.20 65 BAYES_95 6636 3.91 5.25 3.17 66 XM_GoogleGroups 6142 2.61 4.86 1.35 67 HTML_IMAGE_RATIO_04 6020 5.87 4.77 6.48 68 RCVD_IN_MSPIKE_BL 5964 2.25 4.72 0.87 69 XMLngstWrd_00 5852 2.14 4.63 0.75 70 TR_XM_MSPIKECOMBO 5834 2.21 4.62 0.86 71 XM_UB50 5799 2.30 4.59 1.02 72 XMLngstWrd_01 5796 2.08 4.59 0.68 73 XMLngstWrd_02 5729 1.99 4.54 0.58 74 RCVD_IN_VALIDITY_SAFE 5686 6.06 4.50 6.93 75 XM_B_Phish_Phrases 5656 4.01 4.48 3.75 76 TooManyTo_001 5640 5.68 4.47 6.36 77 TR_XM_DK_SendGrid 5634 3.87 4.46 3.54 78 XMLngstWrd_03 5599 1.82 4.43 0.36 79 HTML_TITLE_SUBJ_DIFF 5573 1.60 4.41 0.03 80 XMSubMetaSx_00 5540 3.50 4.39 3.01 81 XM_SPF_SoftFail 5531 2.91 4.38 2.09 82 XMLngstWrd_04 5529 1.76 4.38 0.30 83 UPPERCASE_75_100 5455 1.56 4.32 0.02 84 HTML_IMAGE_RATIO_06 5063 3.88 4.01 3.80 85 XM_B_Investor 4985 2.27 3.95 1.33 86 MIME_HTML_MOSTLY 4869 3.03 3.85 2.57 87 TR_XM_SpammyWords5 4552 2.59 3.60 2.03 88 T_XMDrugObfuBody_14 4485 2.33 3.55 1.65 89 XM_DIRTYINTL 4468 1.49 3.54 0.35 90 RCVD_IN_VALIDITY_CERTIFIED 4427 5.31 3.50 6.31 91 T_REMOTE_IMAGE 4409 3.36 3.49 3.29 92 T_XMDrugObfuBody_08 4173 1.92 3.30 1.15 93 XM_B_SpammyTLD 4113 2.33 3.26 1.82 94 XMNumbers 4020 3.62 3.18 3.86 95 XM_B_Phish66 3945 1.85 3.12 1.14 96 USER_IN_DEF_DKIM_WL 3919 11.15 3.10 15.64 97 RCVD_IN_VALIDITY_RPBL 3867 1.11 3.06 0.03 98 XM_CamelCaseFrm001 3847 2.14 3.05 1.64 99 XMDiploma_00 3709 1.89 2.94 1.30 100 SpammyFromTLD_02 3659 1.18 2.90 0.22 101 HTML_IMAGE_RATIO_08 3612 2.50 2.86 2.30 102 SpammyFromTLD_01 3493 1.26 2.77 0.43 103 T_FILL_THIS_FORM_SHORT 3490 1.31 2.76 0.49 104 MIME_QP_LONG_LINE 3490 4.02 2.76 4.73 105 KHOP_HELO_FCRDNS 3481 2.04 2.76 1.64 106 FROM_EXCESS_BASE64 3297 3.09 2.61 3.36 107 T_TooManySym_01 3292 5.54 2.61 7.18 108 RCVD_IN_PSBL 3282 1.11 2.60 0.28 109 TR_XM_SpammyWords3 3271 1.19 2.59 0.41 110 TM2_M_URI_OPT_OUT 3265 2.66 2.58 2.70 111 SUBJ_ALL_CAPS 3262 2.24 2.58 2.04 112 BOTNET_NORDNS 3176 0.91 2.51 0.01 113 XM_OfRef6 3116 1.39 2.47 0.79 114 RCVD_IN_MSPIKE_H4 3109 4.15 2.46 5.09 115 URI_NOVOWEL 3017 2.09 2.39 1.93 116 XMSubMetaI_00 2724 1.57 2.16 1.24 117 TR_XM_MSPIKECOMBO2 2721 0.85 2.15 0.13 118 RCVD_IN_IADB_LISTED 2712 3.58 2.15 4.39 119 TR_XM_PHPDW 2679 0.98 2.12 0.34 120 TR_XM_PHPForged 2636 0.91 2.09 0.26 121 DKIM_INVALID 2594 1.82 2.05 1.69 122 TR_XM_FormFill2 2592 0.90 2.05 0.26 123 XM_H_PHPOS 2577 0.89 2.04 0.24 124 RCVD_IN_MSPIKE_L5 2555 0.76 2.02 0.05 125 XMBody_17 2521 1.01 2.00 0.47 126 HTTPS_HTTP_MISMATCH 2515 1.05 1.99 0.52 127 XM_UB99 2485 0.71 1.97 0.00 128 TR_LOTS_OF_MONEY3 2484 0.85 1.97 0.23 129 URI_HEX 2435 1.86 1.93 1.83 130 XMStockSpam_06 2414 1.71 1.91 1.60 131 XM_B_SpammyWords4 2400 1.04 1.90 0.57 132 XM_B_Unsub2 2391 1.40 1.89 1.12 133 RCVD_IN_MSPIKE_L3 2391 0.95 1.89 0.42 134 RCVD_IN_IADB_SPF 2366 3.24 1.87 4.01 135 XM_DK_Undo_01 2298 1.62 1.82 1.50 136 ALL_TRUSTED 2295 11.92 1.82 17.55 137 TR_XM_SB_Phish 2257 1.83 1.79 1.85 138 RCVD_IN_IADB_DK 2225 2.94 1.76 3.59 139 RCVD_IN_IADB_SENDERID 2224 3.00 1.76 3.69 140 T_XMHurry_00 2207 1.05 1.75 0.66 141 XMBrknScrpt_02 2157 1.11 1.71 0.77 142 TR_XM_NoHeaderRelay 1959 0.64 1.55 0.13 143 XMBdyGiftCard01 1953 1.26 1.55 1.10 144 HTML_TAG_BALANCE_BODY 1933 0.91 1.53 0.56 145 SHOPIFY_IMG_NOT_RCVD_SFY 1915 0.73 1.52 0.29 146 XMSubPhish11 1891 1.72 1.50 1.84 147 XM_UB999 1884 0.54 1.49 0.00 148 TR_XM_FormFill 1868 0.53 1.48 0.01 149 HK_RANDOM_REPLYTO 1853 0.56 1.47 0.05 150 XM_UB60 1851 0.60 1.47 0.11 151 URIBL_DBL_SPAM 1836 0.54 1.45 0.02 152 MAILING_LIST_MULTI 1794 2.19 1.42 2.62 153 XM_H_Undi_Recip 1791 0.66 1.42 0.23 154 MPART_ALT_DIFF_COUNT 1729 0.99 1.37 0.78 155 THIS_AD 1715 0.85 1.36 0.56 156 XM_URI_RBL 1704 0.57 1.35 0.13 157 MONEY_NOHTML 1694 0.51 1.34 0.05 158 RELAYCOUNTRY_RU 1693 0.53 1.34 0.08 159 TR_XM_Base64_M1 1659 1.12 1.31 1.02 160 DIET_1 1643 0.83 1.30 0.57 161 XMSexyCombo_01 1641 0.69 1.30 0.35 162 PDS_OTHER_BAD_TLD 1602 0.55 1.27 0.15 163 BAYES_40 1591 2.95 1.26 3.90 164 TR_XM_MaxSPIKE 1577 0.48 1.25 0.05 165 XM_B_DynamicLink 1571 0.47 1.24 0.03 166 HTML_TAG_BALANCE_CENTER 1567 0.55 1.24 0.17 167 TM2_M_A_HREF_HREF 1565 0.59 1.24 0.22 168 TR_XM_BayesRelay 1460 0.41 1.16 0.00 169 FONT_INVIS_LONG_LINE 1444 0.46 1.14 0.07 170 XM_Nigeria_01 1434 0.42 1.14 0.02 171 T_XMDrugObfuBody_00 1431 0.77 1.13 0.56 172 MIXED_CENTER_CASE 1417 0.40 1.12 0.00 173 RELAYCOUNTRY_IN 1415 0.45 1.12 0.07 174 XM_B_COPY_HTML 1405 1.02 1.11 0.97 175 XMSubNoVowel 1387 1.43 1.10 1.62 176 MIXED_HREF_CASE 1381 0.39 1.09 0.00 177 XM_B_Crypto 1380 0.44 1.09 0.07 178 XMReplyNow 1378 0.53 1.09 0.22 179 XMGenDplmaNmb 1364 0.79 1.08 0.62 180 HTML_FONT_SIZE_LARGE 1354 0.48 1.07 0.16 181 RELAYCOUNTRY_DE 1336 0.62 1.06 0.38 182 MIXED_IMG_CASE 1329 0.38 1.05 0.01 183 MIXED_AREA_CASE 1323 0.38 1.05 0.00 184 URI_TRY_3LD 1318 0.69 1.04 0.49 185 URIBL_BLACK 1289 0.39 1.02 0.04 186 RCVD_IN_IADB_VOUCHED 1273 1.99 1.01 2.54 187 XMClaimOffer 1271 0.43 1.01 0.10 188 XM_B_SEO 1258 0.44 1.00 0.13 189 XM_RXBody 1254 0.58 0.99 0.35 190 XMPhish30 1250 0.78 0.99 0.67 191 XM_H_Long_From02 1241 1.34 0.98 1.54 192 XM_B_COVIDMETA 1224 0.75 0.97 0.63 193 MIXED_FONT_CASE 1219 0.35 0.97 0.00 194 URI_GOOG_STO_SPAMMY 1212 0.34 0.96 0.00 195 BODY_URI_ONLY 1210 0.35 0.96 0.01 196 RELAYCOUNTRY_AU 1205 0.45 0.95 0.17 197 XM_H_PHPMailer 1200 0.76 0.95 0.66 198 XMHTMLBadTable_001 1195 0.75 0.95 0.64 199 RCVD_IN_RP_SAFE 1183 1.19 0.94 1.33 200 DKIM_ADSP_CUSTOM_MED 1177 0.94 0.93 0.95 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 190748 87.87 94.40 84.23 2 RELAYCOUNTRY_US 179769 79.54 79.82 79.38 3 DKIM_SIGNED 166140 78.33 87.24 73.36 4 XM_DK_Pass 163857 77.15 85.76 72.35 5 DKIM_VALID 162312 76.51 85.19 71.67 6 XM_B_Unicode 160671 74.28 80.26 70.95 7 DCC_CHECK_NEGATIVE 140612 48.80 24.96 62.09 8 DKIM_VALID_AU 133476 60.98 64.64 58.94 9 BAYES_50 121033 48.17 38.72 53.44 10 XMListUnsubscribeExists 118113 58.61 70.19 52.15 11 XM_B_Unicode3 103238 45.50 45.35 45.59 12 XM_B_SpammyWords 98061 51.16 65.26 43.30 13 DCC_CHECK 85810 51.18 75.02 37.89 14 RCVD_IN_MSPIKE_H2 84871 42.01 50.13 37.48 15 HTML_FONT_LOW_CONTRAST 70945 31.55 31.96 31.33 16 DKIM_VALID_EF 62612 28.43 29.83 27.65 17 LOC_TINY_FONT_1 58679 29.24 35.22 25.91 18 FVGT_m_MULTI_ODD 57519 28.16 33.12 25.40 19 T_TM2_M_HEADER_IN_MSG 53384 21.67 18.27 23.57 20 MIME_HTML_ONLY 46974 25.44 33.85 20.74 21 XMSubLong 44168 19.07 18.29 19.50 22 T_KAM_HTML_FONT_INVALID 41562 20.98 25.70 18.35 23 XM_B_SpammyWords2 41470 24.87 36.62 18.31 24 ALL_TRUSTED 39753 11.92 1.82 17.55 25 RCVD_IN_MSPIKE_WL 39636 16.25 14.00 17.50 26 USER_IN_DEF_DKIM_WL 35410 11.15 3.10 15.64 27 XM_Multi_Part_URI 31679 15.89 19.29 13.99 28 XM_Body_Dirty_Words 27370 14.73 19.46 12.09 29 RCVD_IN_MSPIKE_H3 25894 11.38 11.28 11.43 30 XM_DKIMWhitelistDomains 25190 7.18 0.11 11.12 31 XM_B_Unsub 25053 12.11 13.98 11.06 32 BAYES_60 24751 9.80 7.78 10.93 33 BAYES_00 24380 7.09 0.49 10.77 34 LotsOfNums_01 21137 8.62 7.33 9.33 35 XM_Evil_Numbers_Gen 20782 9.47 9.99 9.18 36 UNPARSEABLE_RELAY 19371 10.39 13.68 8.55 37 XM_DK_Undo_02 18467 21.74 46.10 8.15 38 TR_XM_BayesUnsub 18033 10.05 13.79 7.96 39 HTML_IMAGE_RATIO_02 17805 7.77 7.60 7.86 40 T_TooManySym_01 16261 5.54 2.61 7.18 41 BAYES_99 15998 17.80 37.05 7.06 42 RCVD_IN_VALIDITY_SAFE 15686 6.06 4.50 6.93 43 TR_XM_UnparsRelay 15535 9.21 13.41 6.86 44 HTML_IMAGE_RATIO_04 14681 5.87 4.77 6.48 45 TooManyTo_001 14413 5.68 4.47 6.36 46 RCVD_IN_VALIDITY_CERTIFIED 14294 5.31 3.50 6.31 47 XMStrtUSub 14037 6.03 5.74 6.20 48 IN_ZIMBRA_NJ_WHITELIST 13215 3.79 0.13 5.84 49 LOTS_OF_MONEY 13124 7.18 9.66 5.80 50 BAYES_999 13034 14.40 29.91 5.76 51 MPART_ALT_DIFF 12970 7.05 9.41 5.73 52 TR_XM_DK_Bayes 12858 3.79 0.39 5.68 53 XM_SendGrid 12761 6.46 7.95 5.63 54 TR_XM_DK_Bayes1 12716 3.74 0.39 5.61 55 BAYES_80 12443 6.42 8.08 5.49 56 BOTNET_IPINHOSTNAME 12327 7.61 11.50 5.44 57 TR_XM_DKIM_Undo 12160 15.89 34.76 5.37 58 RCVD_IN_MSPIKE_H4 11527 4.15 2.46 5.09 59 TR_XM_DK_Bayes2 11351 3.31 0.27 5.01 60 XM_H_Trusted_IP 10984 3.11 0.00 4.85 61 XM_H_Long_From01 10797 5.19 5.94 4.77 62 FSL_BULK_SIG 10779 7.36 12.03 4.76 63 MIME_QP_LONG_LINE 10706 4.02 2.76 4.73 64 RCVD_IN_IADB_LISTED 9934 3.58 2.15 4.39 65 T_TooManySym_02 9834 3.03 0.69 4.34 66 XM_UncommonTLD01 9405 5.56 8.09 4.15 67 RCVD_IN_IADB_SPF 9075 3.24 1.87 4.01 68 BAYES_40 8827 2.95 1.26 3.90 69 XMNumbers 8736 3.62 3.18 3.86 70 MIME_HTML_ONLY_MULTI 8723 4.87 6.70 3.85 71 XMSexyCombo_05 8653 5.57 8.71 3.82 72 XM_B_SpammyWords3 8633 6.17 10.38 3.81 73 HTML_IMAGE_RATIO_06 8608 3.88 4.01 3.80 74 TR_XM_SpammyWords4 8573 5.33 8.10 3.79 75 XM_B_Phish_Phrases 8497 4.01 4.48 3.75 76 RCVD_IN_IADB_SENDERID 8355 3.00 1.76 3.69 77 RELAYCOUNTRY_META 8247 10.47 22.72 3.64 78 RCVD_IN_IADB_DK 8136 2.94 1.76 3.59 79 TR_XM_DK_SendGrid 8021 3.87 4.46 3.54 80 FROM_EXCESS_BASE64 7615 3.09 2.61 3.36 81 TVD_RCVD_IP 7494 2.26 0.39 3.31 82 T_REMOTE_IMAGE 7450 3.36 3.49 3.29 83 BAYES_95 7173 3.91 5.25 3.17 84 BAYES_20 6966 2.30 0.91 3.08 85 XMSubMetaSx_00 6808 3.50 4.39 3.01 86 INVALID_MSGID 6581 1.91 0.13 2.91 87 BOUNCE_MESSAGE 6567 2.08 0.62 2.90 88 ANY_BOUNCE_MESSAGE 6567 2.08 0.62 2.90 89 TM2_M_URI_OPT_OUT 6112 2.66 2.58 2.70 90 TR_DCC_Bayes_99 6024 11.45 27.20 2.66 91 MAILING_LIST_MULTI 5944 2.19 1.42 2.62 92 TO_MALFORMED 5920 1.68 0.01 2.61 93 MIME_HTML_MOSTLY 5829 3.03 3.85 2.57 94 RCVD_IN_IADB_VOUCHED 5763 1.99 1.01 2.54 95 TR_XM_PhishingBody 5312 3.62 5.90 2.35 96 XM_PDF 5308 1.72 0.60 2.34 97 HTML_IMAGE_RATIO_08 5199 2.50 2.86 2.30 98 BAYES_05 4890 1.55 0.45 2.16 99 XM_SPF_SoftFail 4722 2.91 4.38 2.09 100 SUBJ_ALL_CAPS 4623 2.24 2.58 2.04 101 TR_XM_SpammyWords5 4596 2.59 3.60 2.03 102 IN_HORDE_ADDRESS_BOOK 4493 1.33 0.14 1.98 103 URI_NOVOWEL 4365 2.09 2.39 1.93 104 TR_XM_SB_Phish 4195 1.83 1.79 1.85 105 XMSubPhish11 4163 1.72 1.50 1.84 106 URI_HEX 4143 1.86 1.93 1.83 107 XM_B_SpammyTLD 4117 2.33 3.26 1.82 108 XMBSHREFv2 3975 1.28 0.42 1.76 109 TR_XM_SpammyRelay 3909 5.98 13.61 1.73 110 DKIM_INVALID 3828 1.82 2.05 1.69 111 RCVD_IN_IADB_OPTIN 3802 1.30 0.62 1.68 112 UNTRUSTED_Relay 3798 4.75 10.25 1.68 113 T_XMDrugObfuBody_14 3738 2.33 3.55 1.65 114 KHOP_HELO_FCRDNS 3719 2.04 2.76 1.64 115 XM_CamelCaseFrm001 3710 2.14 3.05 1.64 116 XMSubNoVowel 3662 1.43 1.10 1.62 117 XMStockSpam_06 3634 1.71 1.91 1.60 118 TooManyTo_002 3493 1.18 0.52 1.54 119 XM_H_Long_From02 3490 1.34 0.98 1.54 120 TR_XM_SpammyWords2 3478 5.65 13.03 1.54 121 XM_DK_Undo_01 3404 1.62 1.82 1.50 122 HTML_FONT_FACE_BAD 3284 1.16 0.64 1.45 123 XMGappySubj_01 3225 0.95 0.10 1.42 124 BOTNET 3141 4.75 10.78 1.39 125 HTML_MIME_NO_HTML_TAG 3100 3.22 6.53 1.37 126 XM_GoogleGroups 3056 2.61 4.86 1.35 127 TVD_SPACE_RATIO 3055 0.92 0.14 1.35 128 XM_B_Investor 3013 2.27 3.95 1.33 129 RCVD_IN_RP_SAFE 3011 1.19 0.94 1.33 130 XM_E_Blogspot 2990 0.90 0.14 1.32 131 XMDiploma_00 2955 1.89 2.94 1.30 132 XMSubMetaI_00 2807 1.57 2.16 1.24 133 RCVD_IN_RP_CERTIFIED 2788 1.04 0.71 1.23 134 TM2_M_VERY_LONG_WORD 2776 3.08 6.40 1.23 135 TR_Symld_Words 2747 1.11 0.93 1.21 136 XMBody_95 2600 0.80 0.17 1.15 137 T_XMDrugObfuBody_08 2594 1.92 3.30 1.15 138 XM_B_Phish66 2587 1.85 3.12 1.14 139 XM_B_Unsub2 2537 1.40 1.89 1.12 140 TooManyTo_003 2518 0.88 0.47 1.11 141 XMBdyGiftCard01 2483 1.26 1.55 1.10 142 RELAYCOUNTRY_CA 2332 3.81 8.79 1.03 143 XM_UB50 2313 2.30 4.59 1.02 144 MSGID_NOFQDN1 2301 0.65 0.01 1.02 145 TR_XM_Base64_M1 2299 1.12 1.31 1.02 146 XM_shorewaves_Whitelist 2266 0.64 0.00 1.00 147 TM2_M_BODY_EMPTY 2233 0.74 0.30 0.99 148 RCVD_IN_MSPIKE_H5 2215 0.72 0.26 0.98 149 T_TooManySym_03 2214 0.75 0.33 0.98 150 XM_B_COPY_HTML 2190 1.02 1.11 0.97 151 DKIM_ADSP_CUSTOM_MED 2143 0.94 0.93 0.95 152 MY_SERVERS_FOUND 1991 0.76 0.55 0.88 153 TooManyTo_004 1984 0.72 0.44 0.88 154 RCVD_IN_MSPIKE_BL 1960 2.25 4.72 0.87 155 TR_XM_MSPIKECOMBO 1957 2.21 4.62 0.86 156 HTML_IMAGE_ONLY_20 1868 0.81 0.79 0.82 157 XM_OfRef6 1795 1.39 2.47 0.79 158 MPART_ALT_DIFF_COUNT 1773 0.99 1.37 0.78 159 XMEmptyBody_01 1771 0.54 0.10 0.78 160 XMBrknScrpt_02 1747 1.11 1.71 0.77 161 XMLngstWrd_00 1707 2.14 4.63 0.75 162 RCVD_IN_BL_SPAMCOP_NET 1687 4.92 12.39 0.74 163 TR_MetaPhish_Combo_01 1671 0.80 0.92 0.74 164 TooManyTo_005 1662 0.62 0.42 0.73 165 XM_ProductURIs 1557 0.67 0.65 0.69 166 XMLngstWrd_01 1545 2.08 4.59 0.68 167 XMHTML_After_End 1537 0.74 0.86 0.68 168 XMPhish30 1517 0.78 0.99 0.67 169 T_XMHurry_00 1505 1.05 1.75 0.66 170 XM_H_PHPMailer 1492 0.76 0.95 0.66 171 XMHTMLBadTable_001 1450 0.75 0.95 0.64 172 XM_B_COVIDMETA 1424 0.75 0.97 0.63 173 PLING_QUERY 1424 0.67 0.73 0.63 174 XMGenDplmaNmb 1412 0.79 1.08 0.62 175 SUBJ_DOLLARS 1357 0.60 0.61 0.60 176 XMLngstWrd_02 1306 1.99 4.54 0.58 177 RELAYCOUNTRY_GB 1302 0.64 0.76 0.57 178 DIET_1 1292 0.83 1.30 0.57 179 XM_B_SpammyWords4 1284 1.04 1.90 0.57 180 NML_ADSP_CUSTOM_MED 1280 0.64 0.78 0.57 181 T_XMDrugObfuBody_00 1279 0.77 1.13 0.56 182 THIS_AD 1273 0.85 1.36 0.56 183 HTML_TAG_BALANCE_BODY 1266 0.91 1.53 0.56 184 USER_IN_WHITELIST 1254 0.36 0.00 0.55 185 USER_IN_WELCOMELIST 1254 0.36 0.00 0.55 186 FORGED_GMAIL_RCVD 1251 0.64 0.79 0.55 187 RDNS_DYNAMIC 1225 0.58 0.64 0.54 188 HELO_NODOT 1214 0.56 0.60 0.54 189 HELO_NO_DOMAIN 1212 0.55 0.57 0.54 190 HTTPS_HTTP_MISMATCH 1183 1.05 1.99 0.52 191 TR_Caps_n_Bayes_99 1152 0.62 0.81 0.51 192 XMNoVowels 1146 0.43 0.29 0.51 193 XMCapTrack 1123 0.42 0.28 0.50 194 T_FILL_THIS_FORM_SHORT 1118 1.31 2.76 0.49 195 URI_TRY_3LD 1100 0.69 1.04 0.49 196 XM_S_SubURI 1077 0.31 0.01 0.48 197 XMSubMetaSxObfu_02 1077 0.41 0.28 0.48 198 XMBody_17 1054 1.01 2.00 0.47 199 TR_XM_Base64_L1 1028 0.59 0.84 0.45 200 XM_B_DNDMA 1001 0.54 0.73 0.44 ----------------------------------------------------------------------