Email: 285962 Autolearn: 0 AvgScore: 4.14 AvgScanTime: 1.42 sec Spam: 102661 Autolearn: 0 AvgScore: 13.84 AvgScanTime: 1.52 sec Ham: 183301 Autolearn: 0 AvgScore: -1.30 AvgScanTime: 1.37 sec Time Spent Running SA: 113.11 hours Time Spent Processing Spam: 43.46 hours Time Spent Processing Ham: 69.65 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 97041 87.35 94.53 83.33 2 DKIM_SIGNED 92531 82.11 90.13 77.61 3 XM_DK_Pass 91009 80.62 88.65 76.12 4 DKIM_VALID 90383 80.08 88.04 75.63 5 XM_B_Unicode 84004 74.52 81.83 70.42 6 RELAYCOUNTRY_US 83781 80.72 81.61 80.22 7 XMListUnsubscribeExists 71748 60.56 69.89 55.34 8 DKIM_VALID_AU 69884 64.84 68.07 63.03 9 XM_B_SpammyWords 69427 53.37 67.63 45.38 10 DCC_CHECK 68437 46.38 66.66 35.03 11 RCVD_IN_MSPIKE_H2 53400 43.77 52.02 39.16 12 XM_DK_Undo_02 49343 23.49 48.06 9.72 13 XM_B_Unicode3 46573 44.40 45.37 43.87 14 BAYES_99 39446 19.41 38.42 8.75 15 XM_B_SpammyWords2 38857 26.33 37.85 19.88 16 LOC_TINY_FONT_1 38150 31.64 37.16 28.54 17 TR_XM_DKIM_Undo 38048 17.41 37.06 6.40 18 BAYES_50 37187 48.36 36.22 55.16 19 HTML_FONT_LOW_CONTRAST 36410 32.15 35.47 30.29 20 DKIM_VALID_EF 35333 31.85 34.42 30.41 21 MIME_HTML_ONLY 34425 26.37 33.53 22.36 22 DCC_CHECK_NEGATIVE 34204 53.59 33.32 64.94 23 FVGT_m_MULTI_ODD 33837 28.40 32.96 25.84 24 BAYES_999 31613 15.63 30.79 7.14 25 T_KAM_HTML_FONT_INVALID 27969 21.45 27.24 18.20 26 TR_DCC_Bayes_99 26040 11.05 25.37 3.03 27 XMSubLong 21035 21.41 20.49 21.93 28 RELAYCOUNTRY_META 21002 9.64 20.46 3.59 29 XM_Body_Dirty_Words 20905 14.91 20.36 11.85 30 T_TM2_M_HEADER_IN_MSG 20426 21.46 19.90 22.33 31 XM_B_Unsub 18348 12.72 17.87 9.84 32 TR_XM_BayesUnsub 18107 11.42 17.64 7.93 33 XM_Multi_Part_URI 17679 16.05 17.22 15.40 34 RCVD_IN_BL_SPAMCOP_NET 14282 5.52 13.91 0.82 35 LOTS_OF_MONEY 14181 9.89 13.81 7.69 36 UNPARSEABLE_RELAY 14050 10.15 13.69 8.18 37 TR_XM_SpammyRelay 13807 5.91 13.45 1.69 38 TR_XM_UnparsRelay 13653 8.92 13.30 6.47 39 TR_XM_SpammyWords2 13317 5.86 12.97 1.88 40 RCVD_IN_MSPIKE_WL 12714 16.35 12.38 18.57 41 XM_B_SpammyWords3 12094 7.01 11.78 4.34 42 TR_XM_SpammyWords4 11616 6.65 11.31 4.04 43 BOTNET_IPINHOSTNAME 11243 8.20 10.95 6.66 44 FSL_BULK_SIG 10735 5.91 10.46 3.37 45 RELAYCOUNTRY_CA 10718 4.71 10.44 1.51 46 TR_XM_SPAMCOP 10304 3.84 10.04 0.37 47 RCVD_IN_MSPIKE_H3 10102 11.25 9.84 12.04 48 XMSexyCombo_05 9872 5.70 9.62 3.51 49 BOTNET 9381 4.24 9.14 1.50 50 BAYES_80 9181 6.59 8.94 5.27 51 XM_UncommonTLD01 8666 6.02 8.44 4.66 52 MPART_ALT_DIFF 8295 6.56 8.08 5.71 53 XM_SendGrid 7889 6.16 7.68 5.31 54 XM_Evil_Numbers_Gen 7792 8.48 7.59 8.98 55 HTML_IMAGE_RATIO_02 7750 7.21 7.55 7.02 56 BAYES_60 7414 9.96 7.22 11.50 57 UNTRUSTED_Relay 6845 3.23 6.67 1.30 58 TR_XM_PhishingBody 6499 3.74 6.33 2.28 59 MIME_HTML_ONLY_MULTI 5884 4.45 5.73 3.73 60 TM2_M_VERY_LONG_WORD 5757 3.41 5.61 2.18 61 BAYES_95 5712 4.19 5.56 3.42 62 LotsOfNums_01 5705 7.99 5.56 9.36 63 XM_B_Phish_Phrases 5547 4.16 5.40 3.46 64 XM_H_Long_From01 5403 5.20 5.26 5.16 65 XM_B_Investor 4973 2.58 4.84 1.31 66 TR_XM_DK_SendGrid 4888 4.00 4.76 3.58 67 HTML_IMAGE_RATIO_04 4842 5.19 4.72 5.46 68 XMSubMetaSx_00 4639 3.96 4.52 3.65 69 XM_OfRef6 4554 2.12 4.44 0.83 70 T_XMDrugObfuBody_14 4348 2.66 4.24 1.79 71 RCVD_IN_MSPIKE_BL 4342 2.16 4.23 1.00 72 TR_XM_MSPIKECOMBO 4232 2.12 4.12 1.00 73 TooManyTo_001 4167 5.53 4.06 6.35 74 HTML_MIME_NO_HTML_TAG 4100 2.95 3.99 2.36 75 RCVD_IN_VALIDITY_SAFE 4072 5.98 3.97 7.10 76 SpammyFromTLD_02 4025 1.64 3.92 0.36 77 HTML_IMAGE_RATIO_06 3815 3.61 3.72 3.55 78 XM_B_Phish66 3762 1.95 3.66 0.98 79 XM_SPF_SoftFail 3736 2.15 3.64 1.32 80 XMStrtUSub 3709 4.76 3.61 5.41 81 XMLngstWrd_00 3622 2.17 3.53 1.40 82 XM_GoogleGroups 3618 2.71 3.52 2.25 83 XM_DIRTYINTL 3586 1.42 3.49 0.26 84 XMLngstWrd_01 3561 2.09 3.47 1.31 85 MIME_HTML_MOSTLY 3516 2.99 3.42 2.75 86 TR_XM_SpammyWords5 3498 2.35 3.41 1.75 87 XMLngstWrd_02 3495 1.99 3.40 1.19 88 T_FILL_THIS_FORM_SHORT 3478 1.59 3.39 0.59 89 T_XMDrugObfuBody_08 3365 1.87 3.28 1.09 90 XMNumbers 3347 4.18 3.26 4.70 91 XM_B_SpammyTLD 3219 2.34 3.14 1.89 92 HTML_TITLE_SUBJ_DIFF 3179 1.55 3.10 0.68 93 XMLngstWrd_03 3173 1.77 3.09 1.03 94 HTML_IMAGE_RATIO_08 3155 2.45 3.07 2.11 95 XMLngstWrd_04 3123 1.69 3.04 0.94 96 UPPERCASE_75_100 3107 1.52 3.03 0.68 97 RCVD_IN_VALIDITY_CERTIFIED 3072 5.02 2.99 6.16 98 XM_UB50 2986 1.59 2.91 0.85 99 XM_CamelCaseFrm001 2876 2.51 2.80 2.34 100 PDS_OTHER_BAD_TLD 2820 1.08 2.75 0.15 101 XMBody_17 2682 1.43 2.61 0.77 102 TR_LOTS_OF_MONEY3 2655 1.05 2.59 0.18 103 RCVD_IN_VALIDITY_RPBL 2621 0.93 2.55 0.02 104 T_TooManySym_01 2589 6.63 2.52 8.93 105 XMDiploma_00 2557 1.82 2.49 1.45 106 BOTNET_NORDNS 2536 0.90 2.47 0.02 107 T_REMOTE_IMAGE 2530 3.56 2.46 4.17 108 USER_IN_DEF_DKIM_WL 2481 12.15 2.42 17.60 109 SpammyFromTLD_01 2471 1.15 2.41 0.45 110 XM_B_SpammyWords4 2470 1.38 2.41 0.81 111 URI_NOVOWEL 2468 2.35 2.40 2.31 112 RCVD_IN_MSPIKE_L3 2438 1.39 2.37 0.84 113 RCVD_IN_MSPIKE_H4 2378 4.28 2.32 5.37 114 TR_XM_MSPIKECOMBO2 2321 1.07 2.26 0.41 115 TR_XM_FormFill 2319 0.84 2.26 0.05 116 TR_XM_SpammyWords3 2303 1.04 2.24 0.37 117 XM_B_Unsub2 2260 1.48 2.20 1.08 118 FROM_SUSPICIOUS_NTLD 2207 0.79 2.15 0.03 119 FROM_EXCESS_BASE64 2203 3.23 2.15 3.83 120 HTML_TAG_BALANCE_BODY 2188 1.26 2.13 0.77 121 XM_H_Undi_Recip 2171 0.87 2.11 0.17 122 DKIM_INVALID 2148 2.02 2.09 1.98 123 TM2_M_URI_OPT_OUT 2148 2.31 2.09 2.43 124 FROM_SUSPICIOUS_NTLD_FP 2089 0.75 2.03 0.03 125 SUBJ_ALL_CAPS 2052 1.72 2.00 1.56 126 XM_DK_Undo_01 2046 1.61 1.99 1.39 127 URIBL_DBL_SPAM 1996 0.71 1.94 0.02 128 XMHTML_After_End 1928 1.08 1.88 0.64 129 TR_XM_BayesRelay 1897 0.66 1.85 0.00 130 MIME_QP_LONG_LINE 1891 3.25 1.84 4.05 131 XM_UB99 1833 0.64 1.79 0.00 132 TR_Symld_Words 1830 1.87 1.78 1.91 133 T_STY_INVIS_DIRECT 1820 0.78 1.77 0.22 134 XMBrknScrpt_02 1784 0.96 1.74 0.53 135 TR_XM_PHPDW 1764 0.86 1.72 0.39 136 MPART_ALT_DIFF_COUNT 1747 1.24 1.70 0.98 137 LongTLD 1709 0.70 1.66 0.16 138 RCVD_IN_IADB_LISTED 1702 3.32 1.66 4.24 139 T_XMHurry_00 1698 0.90 1.65 0.47 140 TR_XM_PHPForged 1697 0.78 1.65 0.29 141 XM_B_COVIDMETA 1686 1.13 1.64 0.85 142 TR_XM_FormFill2 1680 0.77 1.64 0.29 143 XM_H_PHPOS 1673 0.76 1.63 0.27 144 TR_XM_MaxSPIKE 1644 0.79 1.60 0.33 145 HK_RANDOM_REPLYTO 1608 0.65 1.57 0.14 146 XM_UB999 1546 0.54 1.51 0.00 147 XMSubNoVowel 1540 0.99 1.50 0.71 148 TR_XM_SB_Phish 1531 1.70 1.49 1.82 149 XMStockSpam_06 1530 0.98 1.49 0.69 150 KHOP_HELO_FCRDNS 1524 1.10 1.48 0.88 151 RCVD_IN_PSBL 1513 1.03 1.47 0.78 152 BAYES_40 1474 2.78 1.44 3.54 153 MONEY_NOHTML 1470 0.55 1.43 0.06 154 MAILING_LIST_MULTI 1468 2.04 1.43 2.39 155 TR_XM_NoHeaderRelay 1453 0.56 1.42 0.09 156 RCVD_IN_IADB_SPF 1431 2.94 1.39 3.81 157 XMReplyNow 1423 0.65 1.39 0.24 158 XM_URI_RBL 1419 0.60 1.38 0.16 159 URI_TRY_3LD 1413 0.79 1.38 0.46 160 XM_H_Long_From02 1407 1.16 1.37 1.05 161 UNDISC_MONEY 1390 0.49 1.35 0.01 162 TM2_M_A_HREF_HREF 1352 1.01 1.32 0.83 163 FONT_INVIS_LONG_LINE 1346 0.51 1.31 0.07 164 ALL_TRUSTED 1332 11.21 1.30 16.76 165 RCVD_IN_IADB_DK 1326 2.61 1.29 3.34 166 RCVD_IN_IADB_SENDERID 1316 2.67 1.28 3.44 167 XMSubPhish11 1310 1.62 1.28 1.82 168 RELAYCOUNTRY_RU 1304 0.47 1.27 0.01 169 RCVD_IN_MSPIKE_L5 1296 0.46 1.26 0.02 170 T_XMDrugObfuBody_00 1293 0.93 1.26 0.75 171 TR_XM_Undi_Recip5 1286 0.45 1.25 0.01 172 TR_XM_RelayPhish 1283 0.48 1.25 0.05 173 URI_HEX 1256 1.12 1.22 1.06 174 TR_MetaPhish_Combo_01 1226 1.00 1.19 0.90 175 XMSexyCombo_01 1213 0.68 1.18 0.40 176 XM_B_DynamicLink 1209 0.46 1.18 0.06 177 PLING_QUERY 1184 0.72 1.15 0.47 178 RELAYCOUNTRY_AU 1173 0.52 1.14 0.17 179 XMBdyGiftCard01 1167 1.17 1.14 1.19 180 DIET_1 1152 0.68 1.12 0.43 181 XMPhish30 1129 0.91 1.10 0.80 182 HTML_FONT_FACE_BAD 1125 1.05 1.10 1.02 183 TR_XM_Undi_Recip11 1113 0.41 1.08 0.03 184 TR_Mismatch_TLD_01 1098 0.66 1.07 0.44 185 RCVD_IN_RP_SAFE 1075 1.18 1.05 1.26 186 BAYES_20 1074 2.06 1.05 2.62 187 XMGenDplmaNmb 1055 0.83 1.03 0.73 188 XM_Combo_Sbj 1055 0.48 1.03 0.18 189 TR_XM_Undi_Recip2 1049 0.38 1.02 0.02 190 SHOPIFY_IMG_NOT_RCVD_SFY 1048 0.51 1.02 0.23 191 TR_XM_Base64_M1 1046 1.06 1.02 1.09 192 XMHTMLBadTable_001 1038 0.83 1.01 0.74 193 URIBL_BLACK 1023 0.38 1.00 0.03 194 XM_OfRef7 1012 0.40 0.99 0.07 195 HTML_IMAGE_ONLY_20 1001 0.71 0.98 0.57 196 RELAYCOUNTRY_CN 986 0.39 0.96 0.07 197 T_TooManySym_02 982 4.21 0.96 6.03 198 MIME_CHARSET_FARAWAY 959 0.54 0.93 0.32 199 RCVD_IN_IADB_VOUCHED 940 2.17 0.92 2.87 200 XMClaimOffer 931 0.40 0.91 0.12 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 152740 87.35 94.53 83.33 2 RELAYCOUNTRY_US 147043 80.72 81.61 80.22 3 DKIM_SIGNED 142260 82.11 90.13 77.61 4 XM_DK_Pass 139536 80.62 88.65 76.12 5 DKIM_VALID 138623 80.08 88.04 75.63 6 XM_B_Unicode 129083 74.52 81.83 70.42 7 DCC_CHECK_NEGATIVE 119044 53.59 33.32 64.94 8 DKIM_VALID_AU 115540 64.84 68.07 63.03 9 XMListUnsubscribeExists 101441 60.56 69.89 55.34 10 BAYES_50 101106 48.36 36.22 55.16 11 XM_B_SpammyWords 83181 53.37 67.63 45.38 12 XM_B_Unicode3 80408 44.40 45.37 43.87 13 RCVD_IN_MSPIKE_H2 71776 43.77 52.02 39.16 14 DCC_CHECK 64203 46.38 66.66 35.03 15 DKIM_VALID_EF 55747 31.85 34.42 30.41 16 HTML_FONT_LOW_CONTRAST 55528 32.15 35.47 30.29 17 LOC_TINY_FONT_1 52315 31.64 37.16 28.54 18 FVGT_m_MULTI_ODD 47369 28.40 32.96 25.84 19 MIME_HTML_ONLY 40985 26.37 33.53 22.36 20 T_TM2_M_HEADER_IN_MSG 40938 21.46 19.90 22.33 21 XMSubLong 40191 21.41 20.49 21.93 22 XM_B_SpammyWords2 36432 26.33 37.85 19.88 23 RCVD_IN_MSPIKE_WL 34042 16.35 12.38 18.57 24 T_KAM_HTML_FONT_INVALID 33367 21.45 27.24 18.20 25 USER_IN_DEF_DKIM_WL 32261 12.15 2.42 17.60 26 ALL_TRUSTED 30721 11.21 1.30 16.76 27 XM_Multi_Part_URI 28222 16.05 17.22 15.40 28 XM_DKIMWhitelistDomains 22542 8.01 0.35 12.30 29 RCVD_IN_MSPIKE_H3 22074 11.25 9.84 12.04 30 XM_Body_Dirty_Words 21722 14.91 20.36 11.85 31 BAYES_60 21082 9.96 7.22 11.50 32 XM_B_Unsub 18031 12.72 17.87 9.84 33 XM_DK_Undo_02 17816 23.49 48.06 9.72 34 LotsOfNums_01 17150 7.99 5.56 9.36 35 XM_Evil_Numbers_Gen 16455 8.48 7.59 8.98 36 T_TooManySym_01 16373 6.63 2.52 8.93 37 BAYES_99 16047 19.41 38.42 8.75 38 UNPARSEABLE_RELAY 14987 10.15 13.69 8.18 39 BAYES_00 14944 5.44 0.59 8.15 40 TR_XM_BayesUnsub 14543 11.42 17.64 7.93 41 LOTS_OF_MONEY 14099 9.89 13.81 7.69 42 BAYES_999 13081 15.63 30.79 7.14 43 RCVD_IN_VALIDITY_SAFE 13017 5.98 3.97 7.10 44 HTML_IMAGE_RATIO_02 12874 7.21 7.55 7.02 45 BOTNET_IPINHOSTNAME 12201 8.20 10.95 6.66 46 TR_XM_UnparsRelay 11868 8.92 13.30 6.47 47 TR_XM_DKIM_Undo 11725 17.41 37.06 6.40 48 TooManyTo_001 11640 5.53 4.06 6.35 49 RCVD_IN_VALIDITY_CERTIFIED 11295 5.02 2.99 6.16 50 T_TooManySym_02 11055 4.21 0.96 6.03 51 TR_XM_DK_Bayes 10925 4.00 0.51 5.96 52 TR_XM_DK_Bayes1 10832 3.97 0.50 5.91 53 IN_ZIMBRA_NJ_WHITELIST 10735 3.78 0.07 5.86 54 MPART_ALT_DIFF 10471 6.56 8.08 5.71 55 HTML_IMAGE_RATIO_04 10000 5.19 4.72 5.46 56 XMStrtUSub 9915 4.76 3.61 5.41 57 RCVD_IN_MSPIKE_H4 9849 4.28 2.32 5.37 58 XM_SendGrid 9726 6.16 7.68 5.31 59 BAYES_80 9667 6.59 8.94 5.27 60 TR_XM_DK_Bayes2 9626 3.49 0.35 5.25 61 XM_H_Long_From01 9453 5.20 5.26 5.16 62 XMNumbers 8608 4.18 3.26 4.70 63 XM_UncommonTLD01 8541 6.02 8.44 4.66 64 XM_B_SpammyWords3 7959 7.01 11.78 4.34 65 RCVD_IN_IADB_LISTED 7778 3.32 1.66 4.24 66 T_REMOTE_IMAGE 7645 3.56 2.46 4.17 67 MIME_QP_LONG_LINE 7416 3.25 1.84 4.05 68 TR_XM_SpammyWords4 7400 6.65 11.31 4.04 69 INVALID_MSGID 7026 2.51 0.14 3.83 70 FROM_EXCESS_BASE64 7022 3.23 2.15 3.83 71 RCVD_IN_IADB_SPF 6989 2.94 1.39 3.81 72 MIME_HTML_ONLY_MULTI 6842 4.45 5.73 3.73 73 XMSubMetaSx_00 6685 3.96 4.52 3.65 74 RELAYCOUNTRY_META 6578 9.64 20.46 3.59 75 TR_XM_DK_SendGrid 6560 4.00 4.76 3.58 76 HTML_IMAGE_RATIO_06 6512 3.61 3.72 3.55 77 BAYES_40 6485 2.78 1.44 3.54 78 XMSexyCombo_05 6433 5.70 9.62 3.51 79 XM_B_Phish_Phrases 6336 4.16 5.40 3.46 80 RCVD_IN_IADB_SENDERID 6313 2.67 1.28 3.44 81 BAYES_95 6261 4.19 5.56 3.42 82 FSL_BULK_SIG 6171 5.91 10.46 3.37 83 RCVD_IN_IADB_DK 6129 2.61 1.29 3.34 84 TO_MALFORMED 5932 2.08 0.02 3.24 85 TVD_RCVD_IP 5841 2.13 0.24 3.19 86 TR_DCC_Bayes_99 5557 11.05 25.37 3.03 87 RCVD_IN_IADB_VOUCHED 5264 2.17 0.92 2.87 88 MIME_HTML_MOSTLY 5038 2.99 3.42 2.75 89 BAYES_20 4803 2.06 1.05 2.62 90 MSGID_NOFQDN1 4795 1.68 0.02 2.62 91 XM_PDF 4528 1.74 0.43 2.47 92 TM2_M_URI_OPT_OUT 4447 2.31 2.09 2.43 93 ANY_BOUNCE_MESSAGE 4444 1.73 0.48 2.42 94 BOUNCE_MESSAGE 4443 1.73 0.48 2.42 95 MAILING_LIST_MULTI 4373 2.04 1.43 2.39 96 HTML_MIME_NO_HTML_TAG 4332 2.95 3.99 2.36 97 XM_CamelCaseFrm001 4295 2.51 2.80 2.34 98 URI_NOVOWEL 4238 2.35 2.40 2.31 99 TR_XM_PhishingBody 4187 3.74 6.33 2.28 100 XM_GoogleGroups 4122 2.71 3.52 2.25 101 XMBSHREFv2 4095 1.52 0.26 2.23 102 IN_HORDE_ADDRESS_BOOK 4002 1.43 0.09 2.18 103 TM2_M_VERY_LONG_WORD 3997 3.41 5.61 2.18 104 XM_H_Trusted_IP 3897 1.36 0.00 2.13 105 HTML_IMAGE_RATIO_08 3862 2.45 3.07 2.11 106 DKIM_INVALID 3637 2.02 2.09 1.98 107 XMGappySubj_01 3634 1.29 0.06 1.98 108 TVD_SPACE_RATIO 3516 1.26 0.08 1.92 109 TR_Symld_Words 3506 1.87 1.78 1.91 110 XM_B_SpammyTLD 3470 2.34 3.14 1.89 111 RCVD_IN_IADB_OPTIN 3469 1.41 0.56 1.89 112 TR_XM_SpammyWords2 3448 5.86 12.97 1.88 113 TR_XM_SB_Phish 3341 1.70 1.49 1.82 114 XMSubPhish11 3331 1.62 1.28 1.82 115 T_XMDrugObfuBody_14 3272 2.66 4.24 1.79 116 TR_XM_SpammyWords5 3209 2.35 3.41 1.75 117 TR_XM_SpammyRelay 3090 5.91 13.45 1.69 118 BAYES_05 2896 1.21 0.54 1.58 119 XM_D_tchamptons_WL 2858 1.01 0.02 1.56 120 SUBJ_ALL_CAPS 2855 1.72 2.00 1.56 121 RELAYCOUNTRY_CA 2762 4.71 10.44 1.51 122 BOTNET 2754 4.24 9.14 1.50 123 XMDiploma_00 2658 1.82 2.49 1.45 124 XMLngstWrd_00 2575 2.17 3.53 1.40 125 XM_DK_Undo_01 2549 1.61 1.99 1.39 126 XMBody_95 2498 0.92 0.12 1.36 127 T_TooManySym_03 2477 0.99 0.35 1.35 128 XM_SPF_SoftFail 2419 2.15 3.64 1.32 129 XMLngstWrd_01 2403 2.09 3.47 1.31 130 XM_B_Investor 2400 2.58 4.84 1.31 131 UNTRUSTED_Relay 2381 3.23 6.67 1.30 132 RCVD_IN_RP_SAFE 2313 1.18 1.05 1.26 133 XMLngstWrd_02 2189 1.99 3.40 1.19 134 XMBdyGiftCard01 2183 1.17 1.14 1.19 135 RCVD_IN_MSPIKE_H5 2119 0.82 0.23 1.16 136 TooManyTo_002 2103 0.86 0.34 1.15 137 RCVD_IN_RP_CERTIFIED 2027 1.01 0.84 1.11 138 TR_XM_Base64_M1 1995 1.06 1.02 1.09 139 T_XMDrugObfuBody_08 1990 1.87 3.28 1.09 140 XM_B_Unsub2 1972 1.48 2.20 1.08 141 URI_HEX 1935 1.12 1.22 1.06 142 XM_H_Long_From02 1924 1.16 1.37 1.05 143 XMLngstWrd_03 1892 1.77 3.09 1.03 144 HTML_FONT_FACE_BAD 1868 1.05 1.10 1.02 145 XM_B_COPY_HTML 1856 0.90 0.71 1.01 146 RCVD_IN_MSPIKE_BL 1834 2.16 4.23 1.00 147 TR_XM_MSPIKECOMBO 1827 2.12 4.12 1.00 148 MPART_ALT_DIFF_COUNT 1805 1.24 1.70 0.98 149 XM_B_Phish66 1800 1.95 3.66 0.98 150 XMLngstWrd_04 1722 1.69 3.04 0.94 151 TR_MetaPhish_Combo_01 1644 1.00 1.19 0.90 152 KHOP_HELO_FCRDNS 1610 1.10 1.48 0.88 153 XM_B_COVIDMETA 1559 1.13 1.64 0.85 154 XM_UB50 1554 1.59 2.91 0.85 155 TooManyTo_003 1547 0.65 0.30 0.84 156 RCVD_IN_MSPIKE_L3 1533 1.39 2.37 0.84 157 TM2_M_A_HREF_HREF 1528 1.01 1.32 0.83 158 XMSubMetaI_00 1528 0.82 0.80 0.83 159 XM_OfRef6 1519 2.12 4.44 0.83 160 RCVD_IN_BL_SPAMCOP_NET 1505 5.52 13.91 0.82 161 XM_B_SpammyWords4 1480 1.38 2.41 0.81 162 XMPhish30 1461 0.91 1.10 0.80 163 RCVD_IN_PSBL 1429 1.03 1.47 0.78 164 HTML_TAG_BALANCE_BODY 1419 1.26 2.13 0.77 165 XMBody_17 1415 1.43 2.61 0.77 166 USER_IN_WELCOMELIST 1409 0.49 0.00 0.77 167 USER_IN_WHITELIST 1409 0.49 0.00 0.77 168 DKIM_ADSP_CUSTOM_MED 1398 0.75 0.72 0.76 169 T_XMDrugObfuBody_00 1371 0.93 1.26 0.75 170 XMHTMLBadTable_001 1349 0.83 1.01 0.74 171 XMGenDplmaNmb 1331 0.83 1.03 0.73 172 XMSubNoVowel 1295 0.99 1.50 0.71 173 XMStockSpam_06 1266 0.98 1.49 0.69 174 XM_RXBody 1266 0.68 0.66 0.69 175 UPPERCASE_75_100 1250 1.52 3.03 0.68 176 HTML_TITLE_SUBJ_DIFF 1244 1.55 3.10 0.68 177 RDNS_DYNAMIC 1217 0.65 0.62 0.66 178 XMHTML_After_End 1167 1.08 1.88 0.64 179 TooManyTo_004 1160 0.50 0.27 0.63 180 XM_ProductURIs 1112 0.66 0.75 0.61 181 T_FILL_THIS_FORM_SHORT 1082 1.59 3.39 0.59 182 TR_XM_INV_DKIM 1079 0.58 0.58 0.59 183 XMSubMetaSxObfu_02 1074 0.48 0.29 0.59 184 XM_H_PHPMailer 1069 0.68 0.84 0.58 185 XM_S_SubURI 1053 0.37 0.01 0.57 186 HTML_IMAGE_ONLY_20 1036 0.71 0.98 0.57 187 XMSlimDrugH 1020 0.56 0.58 0.56 188 DATE_IN_PAST_03_06 994 0.53 0.50 0.54 189 TooManyTo_005 987 0.43 0.24 0.54 190 XM_B_REG_HTML 980 0.54 0.54 0.53 191 XMBrknScrpt_02 969 0.96 1.74 0.53 192 XMNoVowels 955 0.43 0.27 0.52 193 SUBJ_DOLLARS 954 0.55 0.59 0.52 194 HELO_NODOT 876 0.51 0.56 0.48 195 HELO_NO_DOMAIN 875 0.50 0.55 0.48 196 T_XMHurry_00 869 0.90 1.65 0.47 197 PLING_QUERY 862 0.72 1.15 0.47 198 URI_TRY_3LD 839 0.79 1.38 0.46 199 SpammyFromTLD_01 820 1.15 2.41 0.45 200 T_TooManySym_04 813 0.36 0.22 0.44 ----------------------------------------------------------------------