Email: 290645 Autolearn: 0 AvgScore: 4.59 AvgScanTime: 1.28 sec Spam: 107258 Autolearn: 0 AvgScore: 13.93 AvgScanTime: 1.38 sec Ham: 183387 Autolearn: 0 AvgScore: -0.88 AvgScanTime: 1.22 sec Time Spent Running SA: 103.33 hours Time Spent Processing Spam: 41.15 hours Time Spent Processing Ham: 62.18 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 102268 88.53 95.35 84.54 2 DKIM_SIGNED 95835 82.76 89.35 78.90 3 XM_DK_Pass 92570 80.82 86.31 77.62 4 DKIM_VALID 91999 80.38 85.77 77.23 5 RELAYCOUNTRY_US 88464 81.74 82.48 81.31 6 XM_B_Unicode 85752 73.54 79.95 69.79 7 XMListUnsubscribeExists 75899 61.52 70.76 56.12 8 DKIM_VALID_AU 72888 65.63 67.96 64.27 9 XM_B_SpammyWords 71357 52.33 66.53 44.02 10 DCC_CHECK 69689 47.23 64.97 36.86 11 RCVD_IN_MSPIKE_H2 52284 42.80 48.75 39.32 12 XM_B_Unicode3 47903 43.70 44.66 43.14 13 XM_DK_Undo_02 46880 21.99 43.71 9.28 14 BAYES_50 42596 49.70 39.71 55.54 15 XM_B_SpammyWords2 41167 26.39 38.38 19.38 16 BAYES_99 38562 18.50 35.95 8.29 17 FVGT_m_MULTI_ODD 38029 30.70 35.46 27.92 18 LOC_TINY_FONT_1 38009 29.90 35.44 26.66 19 DCC_CHECK_NEGATIVE 37552 52.74 35.01 63.11 20 MIME_HTML_ONLY 37365 27.64 34.84 23.43 21 HTML_FONT_LOW_CONTRAST 36470 31.65 34.00 30.27 22 TR_XM_DKIM_Undo 36042 15.83 33.60 5.43 23 DKIM_VALID_EF 33195 30.92 30.95 30.91 24 BAYES_999 30792 14.93 28.71 6.87 25 T_KAM_HTML_FONT_INVALID 28952 21.86 26.99 18.87 26 TR_DCC_Bayes_99 25374 10.51 23.66 2.82 27 XM_Body_Dirty_Words 24947 16.04 23.26 11.81 28 RELAYCOUNTRY_META 21790 9.79 20.32 3.63 29 XMSubLong 20707 20.77 19.31 21.62 30 T_TM2_M_HEADER_IN_MSG 20406 20.76 19.03 21.78 31 XM_B_Unsub 17879 12.58 16.67 10.19 32 XM_Multi_Part_URI 17625 15.82 16.43 15.47 33 TR_XM_BayesUnsub 17602 11.31 16.41 8.32 34 RCVD_IN_MSPIKE_WL 14910 17.91 13.90 20.26 35 LOTS_OF_MONEY 13969 9.49 13.02 7.42 36 BOTNET_IPINHOSTNAME 13967 9.09 13.02 6.79 37 UNPARSEABLE_RELAY 13549 10.21 12.63 8.79 38 XM_B_SpammyWords3 13342 8.07 12.44 5.51 39 TR_XM_UnparsRelay 13119 8.90 12.23 6.95 40 TR_XM_SpammyRelay 13110 5.45 12.22 1.49 41 TR_XM_SpammyWords2 12921 5.21 12.05 1.21 42 XMSexyCombo_05 12864 6.79 11.99 3.75 43 BOTNET 12572 5.32 11.72 1.57 44 RCVD_IN_MSPIKE_H3 11970 12.68 11.16 13.58 45 TR_XM_SpammyWords4 11405 6.58 10.63 4.20 46 RCVD_IN_BL_SPAMCOP_NET 11295 4.27 10.53 0.61 47 XM_UncommonTLD01 10508 6.57 9.80 4.69 48 MPART_ALT_DIFF 10334 7.84 9.63 6.79 49 FSL_BULK_SIG 10286 6.16 9.59 4.16 50 RELAYCOUNTRY_CA 9641 4.15 8.99 1.32 51 BAYES_80 8947 6.27 8.34 5.06 52 MIME_HTML_ONLY_MULTI 8405 6.00 7.84 4.93 53 TM2_M_VERY_LONG_WORD 8178 5.03 7.62 3.51 54 HTML_IMAGE_RATIO_02 8142 7.00 7.59 6.65 55 BAYES_60 7879 10.07 7.35 11.66 56 XM_Evil_Numbers_Gen 7708 8.76 7.19 9.69 57 XM_SendGrid 7550 6.27 7.04 5.82 58 TR_XM_SPAMCOP 7497 2.75 6.99 0.28 59 UNTRUSTED_Relay 7005 3.21 6.53 1.26 60 HTML_MIME_NO_HTML_TAG 6922 4.64 6.45 3.58 61 XM_H_Long_From01 6508 5.24 6.07 4.76 62 XMSubMetaSx_00 6164 5.02 5.75 4.60 63 TR_XM_PhishingBody 6143 3.62 5.73 2.39 64 LotsOfNums_01 6139 7.86 5.72 9.12 65 XM_GoogleGroups 6109 4.17 5.70 3.28 66 RCVD_IN_MSPIKE_BL 6102 2.61 5.69 0.80 67 TR_XM_MSPIKECOMBO 5976 2.56 5.57 0.80 68 XMLngstWrd_00 5842 3.77 5.45 2.79 69 XMLngstWrd_01 5799 3.71 5.41 2.71 70 XMLngstWrd_02 5750 3.60 5.36 2.58 71 HTML_TITLE_SUBJ_DIFF 5720 3.22 5.33 1.99 72 XMLngstWrd_03 5634 3.40 5.25 2.31 73 XM_B_Phish_Phrases 5624 4.06 5.24 3.37 74 XMLngstWrd_04 5594 3.32 5.22 2.22 75 UPPERCASE_75_100 5578 3.16 5.20 1.97 76 XM_B_Investor 5565 2.66 5.19 1.18 77 BAYES_95 5527 3.93 5.15 3.22 78 TooManyTo_001 5210 5.84 4.86 6.41 79 TR_XM_DK_SendGrid 4925 4.12 4.59 3.85 80 T_REMOTE_IMAGE 4848 4.15 4.52 3.93 81 XM_DIRTYINTL 4829 1.81 4.50 0.23 82 SpammyFromTLD_02 4785 1.82 4.46 0.27 83 T_XMDrugObfuBody_14 4549 2.60 4.24 1.64 84 XMStrtUSub 4529 4.67 4.22 4.94 85 RCVD_IN_VALIDITY_SAFE 4528 5.64 4.22 6.47 86 XM_B_SpammyTLD 4374 2.67 4.08 1.85 87 XM_SPF_SoftFail 4357 2.31 4.06 1.29 88 TR_XM_SpammyWords3 4351 1.71 4.06 0.34 89 HTML_IMAGE_RATIO_04 4323 4.85 4.03 5.33 90 XM_OfRef6 4224 2.26 3.94 1.29 91 XMBody_17 4117 1.76 3.84 0.54 92 PDS_OTHER_BAD_TLD 4076 1.49 3.80 0.14 93 TR_XM_SpammyWords5 4048 2.41 3.77 1.61 94 DKIM_INVALID 3836 2.38 3.58 1.67 95 T_XMDrugObfuBody_08 3691 2.08 3.44 1.28 96 HTML_IMAGE_RATIO_06 3608 3.20 3.36 3.10 97 XM_CamelCaseFrm001 3560 2.61 3.32 2.20 98 RCVD_IN_VALIDITY_RPBL 3394 1.24 3.16 0.12 99 MIME_HTML_MOSTLY 3311 3.00 3.09 2.95 100 RCVD_IN_MSPIKE_L5 3192 1.10 2.98 0.01 101 XMNumbers 3184 3.91 2.97 4.46 102 XMDiploma_00 3180 1.95 2.96 1.35 103 RCVD_IN_VALIDITY_CERTIFIED 3120 4.66 2.91 5.68 104 XM_B_Phish66 3076 1.71 2.87 1.03 105 T_FILL_THIS_FORM_SHORT 3074 1.38 2.87 0.52 106 XM_UB50 2979 1.51 2.78 0.77 107 SpammyFromTLD_01 2943 1.28 2.74 0.43 108 HK_RANDOM_REPLYTO 2928 1.07 2.73 0.09 109 XM_B_SpammyWords4 2791 1.61 2.60 1.03 110 BOTNET_NORDNS 2780 0.97 2.59 0.02 111 HTML_IMAGE_RATIO_08 2733 2.00 2.55 1.68 112 T_TooManySym_01 2719 5.80 2.54 7.71 113 TR_LOTS_OF_MONEY3 2712 1.20 2.53 0.43 114 RCVD_IN_MSPIKE_H4 2705 4.28 2.52 5.31 115 T_XMHurry_00 2671 1.32 2.49 0.63 116 USER_IN_DEF_DKIM_WL 2544 11.67 2.37 17.11 117 SUBJ_ALL_CAPS 2467 1.65 2.30 1.26 118 XM_B_Unsub2 2385 1.89 2.22 1.70 119 FROM_EXCESS_BASE64 2368 3.16 2.21 3.72 120 RCVD_IN_MSPIKE_L3 2304 1.13 2.15 0.54 121 TR_XM_MSPIKECOMBO2 2297 0.95 2.14 0.25 122 FROM_SUSPICIOUS_NTLD 2264 0.79 2.11 0.02 123 MIME_QP_LONG_LINE 2260 3.37 2.11 4.11 124 XMBdyGiftCard01 2204 1.59 2.05 1.32 125 TM2_M_URI_OPT_OUT 2124 2.24 1.98 2.40 126 URI_NOVOWEL 2056 2.13 1.92 2.25 127 HTML_TAG_BALANCE_BODY 2050 1.20 1.91 0.79 128 RELAYCOUNTRY_RU 2048 0.71 1.91 0.01 129 T_XMDrugObfuBody_00 2028 1.02 1.89 0.52 130 XMSexyCombo_01 2018 1.16 1.88 0.73 131 URIBL_DBL_SPAM 2013 0.70 1.88 0.01 132 URI_PHP_REDIR 1966 0.68 1.83 0.00 133 TR_XM_PHPDW 1944 0.85 1.81 0.29 134 ALL_TRUSTED 1935 10.61 1.80 15.75 135 FROM_SUSPICIOUS_NTLD_FP 1933 0.68 1.80 0.02 136 TR_XM_PHPForged 1849 0.78 1.72 0.23 137 XMReplyNow 1846 0.80 1.72 0.27 138 TR_XM_FormFill2 1819 0.76 1.70 0.22 139 TR_XM_FormFill 1808 0.64 1.69 0.03 140 XM_H_PHPOS 1802 0.75 1.68 0.21 141 T_STY_INVIS_DIRECT 1716 0.72 1.60 0.20 142 XM_UB99 1703 0.59 1.59 0.00 143 TR_XM_BayesRelay 1701 0.59 1.59 0.00 144 XMClaimOffer 1686 0.64 1.57 0.09 145 RCVD_IN_PSBL 1664 1.40 1.55 1.31 146 XMBrknScrpt_02 1648 1.10 1.54 0.84 147 LongTLD 1630 0.64 1.52 0.12 148 TR_XM_NoHeaderRelay 1630 0.61 1.52 0.08 149 TR_Symld_Words 1624 1.76 1.51 1.91 150 RCVD_IN_IADB_LISTED 1607 3.17 1.50 4.14 151 MAILING_LIST_MULTI 1600 2.09 1.49 2.44 152 KHOP_HELO_FCRDNS 1565 0.88 1.46 0.54 153 URI_TRY_3LD 1524 0.93 1.42 0.64 154 TR_XM_MaxSPIKE 1503 0.61 1.40 0.15 155 BAYES_40 1484 3.07 1.38 4.06 156 XMStockSpam_06 1483 1.08 1.38 0.90 157 XM_DK_Undo_01 1456 1.36 1.36 1.36 158 XM_B_Crypto 1431 0.54 1.33 0.08 159 XM_H_Long_From02 1412 1.18 1.32 1.10 160 MPART_ALT_DIFF_COUNT 1407 1.02 1.31 0.86 161 HTML_FONT_FACE_BAD 1396 1.13 1.30 1.02 162 RCVD_IN_IADB_SPF 1388 2.84 1.29 3.74 163 TR_XM_COVIDMETA4 1383 0.56 1.29 0.13 164 XM_UB999 1365 0.47 1.27 0.00 165 XM_URI_RBL 1361 0.57 1.27 0.16 166 RCVD_IN_IADB_SENDERID 1288 2.57 1.20 3.38 167 HTTPS_HTTP_MISMATCH 1277 0.82 1.19 0.61 168 TR_XM_SB_Phish 1276 1.51 1.19 1.70 169 RCVD_IN_IADB_DK 1276 2.53 1.19 3.31 170 XMHTML_After_End 1256 0.79 1.17 0.57 171 XMPhish30 1253 0.92 1.17 0.77 172 DIET_1 1197 0.64 1.12 0.36 173 XMSubPhish11 1187 1.47 1.11 1.69 174 URI_HEX 1173 1.10 1.09 1.10 175 XMPhish08 1155 0.57 1.08 0.28 176 XM_Body_Dirty_Words_01 1149 0.50 1.07 0.17 177 XM_ProductURIs 1140 0.92 1.06 0.83 178 XMGenDplmaNmb 1131 0.76 1.05 0.59 179 RELAYCOUNTRY_AU 1130 0.52 1.05 0.20 180 XM_B_COVIDMETA 1089 0.73 1.02 0.56 181 XM_H_Undi_Recip 1087 0.46 1.01 0.14 182 HTML_FONT_TINY_NORDNS 1072 0.40 1.00 0.04 183 FONT_INVIS_LONG_LINE 1066 0.39 0.99 0.04 184 XMSexyCombo_04 1061 0.45 0.99 0.14 185 RCVD_IN_RP_SAFE 1051 1.17 0.98 1.29 186 TM2_M_A_HREF_HREF 1049 0.82 0.98 0.72 187 SHOPIFY_IMG_NOT_RCVD_SFY 1048 0.51 0.98 0.24 188 MONEY_NOHTML 1034 0.39 0.96 0.06 189 SUBJ_DOLLARS 1030 0.60 0.96 0.38 190 URIBL_BLACK 1023 0.37 0.95 0.03 191 TR_XM_Base64_M1 1019 1.39 0.95 1.64 192 XMHTMLBadTable_001 1010 0.84 0.94 0.78 193 T_Symld_Words_02 1009 0.52 0.94 0.28 194 RCVD_IN_IADB_VOUCHED 1002 2.07 0.93 2.73 195 RELAYCOUNTRY_CN 980 0.38 0.91 0.06 196 TR_XM_Crypto2 977 0.34 0.91 0.01 197 TR_Caps_n_Bayes_99 962 0.51 0.90 0.28 198 BAYES_20 961 1.97 0.90 2.60 199 XM_H_PHPMailer 943 0.65 0.88 0.51 200 TR_Mismatch_TLD_01 941 0.58 0.88 0.40 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155035 88.53 95.35 84.54 2 RELAYCOUNTRY_US 149116 81.74 82.48 81.31 3 DKIM_SIGNED 144693 82.76 89.35 78.90 4 XM_DK_Pass 142338 80.82 86.31 77.62 5 DKIM_VALID 141625 80.38 85.77 77.23 6 XM_B_Unicode 127983 73.54 79.95 69.79 7 DKIM_VALID_AU 117863 65.63 67.96 64.27 8 DCC_CHECK_NEGATIVE 115735 52.74 35.01 63.11 9 XMListUnsubscribeExists 102916 61.52 70.76 56.12 10 BAYES_50 101860 49.70 39.71 55.54 11 XM_B_SpammyWords 80733 52.33 66.53 44.02 12 XM_B_Unicode3 79121 43.70 44.66 43.14 13 RCVD_IN_MSPIKE_H2 72115 42.80 48.75 39.32 14 DCC_CHECK 67589 47.23 64.97 36.86 15 DKIM_VALID_EF 56676 30.92 30.95 30.91 16 HTML_FONT_LOW_CONTRAST 55520 31.65 34.00 30.27 17 FVGT_m_MULTI_ODD 51203 30.70 35.46 27.92 18 LOC_TINY_FONT_1 48882 29.90 35.44 26.66 19 MIME_HTML_ONLY 42962 27.64 34.84 23.43 20 T_TM2_M_HEADER_IN_MSG 39933 20.76 19.03 21.78 21 XMSubLong 39654 20.77 19.31 21.62 22 RCVD_IN_MSPIKE_WL 37151 17.91 13.90 20.26 23 XM_B_SpammyWords2 35537 26.39 38.38 19.38 24 T_KAM_HTML_FONT_INVALID 34597 21.86 26.99 18.87 25 USER_IN_DEF_DKIM_WL 31372 11.67 2.37 17.11 26 ALL_TRUSTED 28890 10.61 1.80 15.75 27 XM_Multi_Part_URI 28364 15.82 16.43 15.47 28 RCVD_IN_MSPIKE_H3 24898 12.68 11.16 13.58 29 XM_DKIMWhitelistDomains 22769 7.90 0.17 12.42 30 XM_Body_Dirty_Words 21667 16.04 23.26 11.81 31 BAYES_60 21385 10.07 7.35 11.66 32 XM_B_Unsub 18693 12.58 16.67 10.19 33 XM_Evil_Numbers_Gen 17766 8.76 7.19 9.69 34 XM_DK_Undo_02 17026 21.99 43.71 9.28 35 LotsOfNums_01 16716 7.86 5.72 9.12 36 UNPARSEABLE_RELAY 16124 10.21 12.63 8.79 37 TR_XM_BayesUnsub 15260 11.31 16.41 8.32 38 BAYES_99 15199 18.50 35.95 8.29 39 BAYES_00 14621 5.28 0.69 7.97 40 T_TooManySym_01 14144 5.80 2.54 7.71 41 LOTS_OF_MONEY 13600 9.49 13.02 7.42 42 TR_XM_UnparsRelay 12739 8.90 12.23 6.95 43 BAYES_999 12601 14.93 28.71 6.87 44 BOTNET_IPINHOSTNAME 12458 9.09 13.02 6.79 45 MPART_ALT_DIFF 12443 7.84 9.63 6.79 46 HTML_IMAGE_RATIO_02 12189 7.00 7.59 6.65 47 RCVD_IN_VALIDITY_SAFE 11865 5.64 4.22 6.47 48 TooManyTo_001 11753 5.84 4.86 6.41 49 TR_XM_DK_Bayes 11104 4.04 0.61 6.05 50 TR_XM_DK_Bayes1 11034 4.02 0.60 6.02 51 IN_ZIMBRA_NJ_WHITELIST 10709 3.71 0.06 5.84 52 XM_SendGrid 10676 6.27 7.04 5.82 53 RCVD_IN_VALIDITY_CERTIFIED 10425 4.66 2.91 5.68 54 XM_B_SpammyWords3 10111 8.07 12.44 5.51 55 TR_XM_DKIM_Undo 9959 15.83 33.60 5.43 56 TR_XM_DK_Bayes2 9871 3.56 0.44 5.38 57 HTML_IMAGE_RATIO_04 9775 4.85 4.03 5.33 58 RCVD_IN_MSPIKE_H4 9746 4.28 2.52 5.31 59 BAYES_80 9272 6.27 8.34 5.06 60 XMStrtUSub 9051 4.67 4.22 4.94 61 MIME_HTML_ONLY_MULTI 9044 6.00 7.84 4.93 62 T_TooManySym_02 8763 3.22 0.57 4.78 63 XM_H_Long_From01 8722 5.24 6.07 4.76 64 XM_UncommonTLD01 8594 6.57 9.80 4.69 65 XMSubMetaSx_00 8436 5.02 5.75 4.60 66 XMNumbers 8174 3.91 2.97 4.46 67 TR_XM_SpammyWords4 7709 6.58 10.63 4.20 68 FSL_BULK_SIG 7620 6.16 9.59 4.16 69 RCVD_IN_IADB_LISTED 7598 3.17 1.50 4.14 70 MIME_QP_LONG_LINE 7530 3.37 2.11 4.11 71 BAYES_40 7445 3.07 1.38 4.06 72 T_REMOTE_IMAGE 7216 4.15 4.52 3.93 73 TR_XM_DK_SendGrid 7058 4.12 4.59 3.85 74 INVALID_MSGID 7035 2.47 0.15 3.84 75 XMSexyCombo_05 6878 6.79 11.99 3.75 76 RCVD_IN_IADB_SPF 6856 2.84 1.29 3.74 77 FROM_EXCESS_BASE64 6815 3.16 2.21 3.72 78 RELAYCOUNTRY_META 6657 9.79 20.32 3.63 79 HTML_MIME_NO_HTML_TAG 6560 4.64 6.45 3.58 80 TM2_M_VERY_LONG_WORD 6446 5.03 7.62 3.51 81 MSGID_NOFQDN1 6350 2.20 0.03 3.46 82 RCVD_IN_IADB_SENDERID 6194 2.57 1.20 3.38 83 XM_B_Phish_Phrases 6184 4.06 5.24 3.37 84 RCVD_IN_IADB_DK 6077 2.53 1.19 3.31 85 XM_GoogleGroups 6015 4.17 5.70 3.28 86 TO_MALFORMED 6011 2.07 0.01 3.28 87 BAYES_95 5899 3.93 5.15 3.22 88 HTML_IMAGE_RATIO_06 5690 3.20 3.36 3.10 89 MIME_HTML_MOSTLY 5415 3.00 3.09 2.95 90 TVD_RCVD_IP 5197 1.93 0.40 2.83 91 TR_DCC_Bayes_99 5177 10.51 23.66 2.82 92 XMLngstWrd_00 5115 3.77 5.45 2.79 93 RCVD_IN_IADB_VOUCHED 5010 2.07 0.93 2.73 94 XMLngstWrd_01 4971 3.71 5.41 2.71 95 BAYES_20 4775 1.97 0.90 2.60 96 XMLngstWrd_02 4725 3.60 5.36 2.58 97 XM_PDF 4628 1.71 0.32 2.52 98 MAILING_LIST_MULTI 4480 2.09 1.49 2.44 99 TM2_M_URI_OPT_OUT 4395 2.24 1.98 2.40 100 TR_XM_PhishingBody 4384 3.62 5.73 2.39 101 XMLngstWrd_03 4243 3.40 5.25 2.31 102 XMBSHREFv2 4202 1.60 0.41 2.29 103 URI_NOVOWEL 4133 2.13 1.92 2.25 104 XM_H_Trusted_IP 4068 1.40 0.00 2.22 105 XMLngstWrd_04 4068 3.32 5.22 2.22 106 XM_CamelCaseFrm001 4039 2.61 3.32 2.20 107 IN_HORDE_ADDRESS_BOOK 3818 1.34 0.07 2.08 108 HTML_TITLE_SUBJ_DIFF 3642 3.22 5.33 1.99 109 UPPERCASE_75_100 3612 3.16 5.20 1.97 110 TR_Symld_Words 3504 1.76 1.51 1.91 111 XM_B_SpammyTLD 3392 2.67 4.08 1.85 112 ANY_BOUNCE_MESSAGE 3202 1.30 0.52 1.75 113 BOUNCE_MESSAGE 3197 1.29 0.52 1.74 114 RCVD_IN_IADB_OPTIN 3165 1.29 0.55 1.73 115 XM_B_Unsub2 3121 1.89 2.22 1.70 116 TR_XM_SB_Phish 3113 1.51 1.19 1.70 117 XMSubPhish11 3097 1.47 1.11 1.69 118 XMGappySubj_01 3084 1.17 0.29 1.68 119 HTML_IMAGE_RATIO_08 3076 2.00 2.55 1.68 120 DKIM_INVALID 3068 2.38 3.58 1.67 121 TR_XM_Base64_M1 3014 1.39 0.95 1.64 122 T_XMDrugObfuBody_14 3007 2.60 4.24 1.64 123 TR_XM_SpammyWords5 2947 2.41 3.77 1.61 124 BAYES_05 2931 1.20 0.53 1.60 125 XMBody_95 2902 1.03 0.09 1.58 126 BOTNET 2876 5.32 11.72 1.57 127 TR_XM_SpammyRelay 2741 5.45 12.22 1.49 128 TooManyTo_002 2725 1.25 0.86 1.49 129 RCVD_IN_MSPIKE_H5 2507 0.94 0.22 1.37 130 XM_DK_Undo_01 2495 1.36 1.36 1.36 131 XMDiploma_00 2475 1.95 2.96 1.35 132 RELAYCOUNTRY_CA 2424 4.15 8.99 1.32 133 XMBdyGiftCard01 2422 1.59 2.05 1.32 134 RCVD_IN_PSBL 2410 1.40 1.55 1.31 135 XM_SPF_SoftFail 2362 2.31 4.06 1.29 136 XM_OfRef6 2359 2.26 3.94 1.29 137 RCVD_IN_RP_SAFE 2359 1.17 0.98 1.29 138 T_XMDrugObfuBody_08 2345 2.08 3.44 1.28 139 UNTRUSTED_Relay 2318 3.21 6.53 1.26 140 SUBJ_ALL_CAPS 2316 1.65 2.30 1.26 141 TR_XM_SpammyWords2 2216 5.21 12.05 1.21 142 XM_B_Investor 2166 2.66 5.19 1.18 143 XMSubMetaI_00 2026 1.00 0.83 1.10 144 RCVD_IN_RP_CERTIFIED 2020 0.95 0.70 1.10 145 URI_HEX 2011 1.10 1.09 1.10 146 XM_H_Long_From02 2010 1.18 1.32 1.10 147 TooManyTo_003 1959 0.95 0.74 1.07 148 XM_B_SpammyWords4 1892 1.61 2.60 1.03 149 XM_B_Phish66 1880 1.71 2.87 1.03 150 HTML_FONT_FACE_BAD 1876 1.13 1.30 1.02 151 XM_D_tchamptons_WL 1854 0.66 0.05 1.01 152 XM_B_COPY_HTML 1824 0.90 0.75 0.99 153 T_TooManySym_03 1820 0.73 0.28 0.99 154 TR_MetaPhish_Combo_01 1687 0.79 0.58 0.92 155 XMStockSpam_06 1647 1.08 1.38 0.90 156 MPART_ALT_DIFF_COUNT 1569 1.02 1.31 0.86 157 TVD_SPACE_RATIO 1548 0.57 0.10 0.84 158 XMBrknScrpt_02 1542 1.10 1.54 0.84 159 XM_ProductURIs 1521 0.92 1.06 0.83 160 XMSubMetaSxObfu_02 1503 0.71 0.53 0.82 161 RCVD_IN_MSPIKE_BL 1471 2.61 5.69 0.80 162 TR_XM_MSPIKECOMBO 1470 2.56 5.57 0.80 163 TooManyTo_004 1465 0.74 0.64 0.80 164 XMSubNoVowel 1462 0.78 0.75 0.80 165 HTML_TAG_BALANCE_BODY 1448 1.20 1.91 0.79 166 XMHTMLBadTable_001 1433 0.84 0.94 0.78 167 XMPhish30 1412 0.92 1.17 0.77 168 XM_UB50 1405 1.51 2.78 0.77 169 USER_IN_WELCOMELIST 1384 0.48 0.00 0.75 170 USER_IN_WHITELIST 1384 0.48 0.00 0.75 171 DKIM_ADSP_CUSTOM_MED 1362 0.77 0.81 0.74 172 XMSexyCombo_01 1347 1.16 1.88 0.73 173 TM2_M_A_HREF_HREF 1329 0.82 0.98 0.72 174 RDNS_DYNAMIC 1243 0.69 0.71 0.68 175 URI_TRY_3LD 1179 0.93 1.42 0.64 176 HTML_IMAGE_ONLY_20 1174 0.72 0.87 0.64 177 T_XMHurry_00 1152 1.32 2.49 0.63 178 RCVD_IN_BL_SPAMCOP_NET 1123 4.27 10.53 0.61 179 HTTPS_HTTP_MISMATCH 1116 0.82 1.19 0.61 180 XMGenDplmaNmb 1083 0.76 1.05 0.59 181 TooManyTo_005 1060 0.49 0.34 0.58 182 XMHTML_After_End 1047 0.79 1.17 0.57 183 XM_S_SubURI 1046 0.36 0.01 0.57 184 DATE_IN_PAST_03_06 1043 0.53 0.46 0.57 185 XM_B_COVIDMETA 1033 0.73 1.02 0.56 186 XMNoVowels 1023 0.46 0.30 0.56 187 XMBody_17 993 1.76 3.84 0.54 188 RCVD_IN_MSPIKE_L3 991 1.13 2.15 0.54 189 KHOP_HELO_FCRDNS 985 0.88 1.46 0.54 190 XMSlimDrugH 975 0.62 0.77 0.53 191 HELO_NO_DOMAIN 949 0.52 0.53 0.52 192 HELO_NODOT 949 0.52 0.53 0.52 193 T_XMDrugObfuBody_00 949 1.02 1.89 0.52 194 T_FILL_THIS_FORM_SHORT 948 1.38 2.87 0.52 195 XM_B_REG_HTML 946 0.54 0.57 0.52 196 XM_H_PHPMailer 934 0.65 0.88 0.51 197 BODY_ENHANCEMENT2 894 0.31 0.02 0.49 198 PLING_QUERY 818 0.54 0.71 0.45 199 BASE64_LENGTH_79_INF 810 0.43 0.42 0.44 200 NML_ADSP_CUSTOM_MED 805 0.53 0.69 0.44 ----------------------------------------------------------------------