Email: 293918 Autolearn: 0 AvgScore: 4.42 AvgScanTime: 1.27 sec Spam: 108568 Autolearn: 0 AvgScore: 14.11 AvgScanTime: 1.36 sec Ham: 185350 Autolearn: 0 AvgScore: -1.25 AvgScanTime: 1.22 sec Time Spent Running SA: 103.87 hours Time Spent Processing Spam: 40.96 hours Time Spent Processing Ham: 62.91 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 103979 88.06 95.77 83.55 2 DKIM_SIGNED 99261 82.74 91.43 77.65 3 XM_DK_Pass 98028 81.40 90.29 76.19 4 DKIM_VALID 97292 80.84 89.61 75.70 5 XM_B_Unicode 90667 75.31 83.51 70.51 6 RELAYCOUNTRY_US 84279 79.21 77.63 80.13 7 XM_B_SpammyWords 77733 55.40 71.60 45.92 8 XMListUnsubscribeExists 77257 60.30 71.16 53.94 9 DCC_CHECK 73505 47.91 67.70 36.32 10 DKIM_VALID_AU 72782 64.32 67.04 62.74 11 XM_DK_Undo_02 52880 23.33 48.71 8.47 12 RCVD_IN_MSPIKE_H2 51818 41.97 47.73 38.60 13 XM_B_Unicode3 48749 44.12 44.90 43.66 14 TR_XM_DKIM_Undo 44237 18.40 40.75 5.31 15 BAYES_99 43400 19.58 39.97 7.64 16 XM_B_SpammyWords2 42141 27.21 38.82 20.42 17 BAYES_50 39897 49.56 36.75 57.07 18 LOC_TINY_FONT_1 39441 30.52 36.33 27.11 19 DKIM_VALID_EF 39101 31.65 36.02 29.09 20 MIME_HTML_ONLY 38203 27.55 35.19 23.07 21 HTML_FONT_LOW_CONTRAST 36585 31.81 33.70 30.71 22 BAYES_999 35155 15.96 32.38 6.35 23 DCC_CHECK_NEGATIVE 35048 52.07 32.28 63.66 24 FVGT_m_MULTI_ODD 34963 27.95 32.20 25.45 25 T_KAM_HTML_FONT_INVALID 29826 21.76 27.47 18.41 26 TR_DCC_Bayes_99 29446 11.42 27.12 2.22 27 RELAYCOUNTRY_META 25915 11.30 23.87 3.94 28 XM_Body_Dirty_Words 23852 15.98 21.97 12.47 29 XMSubLong 21257 21.48 19.58 22.59 30 T_TM2_M_HEADER_IN_MSG 20267 20.69 18.67 21.87 31 XM_B_Unsub 18436 13.06 16.98 10.76 32 TR_XM_SpammyRelay 18170 7.24 16.74 1.67 33 TR_XM_BayesUnsub 18085 11.68 16.66 8.76 34 XM_Multi_Part_URI 17767 15.33 16.36 14.72 35 RCVD_IN_MSPIKE_WL 16176 17.54 14.90 19.09 36 TR_XM_SpammyWords2 15817 6.36 14.57 1.55 37 LOTS_OF_MONEY 15808 11.08 14.56 9.04 38 RELAYCOUNTRY_CA 13673 5.72 12.59 1.70 39 TR_XM_SpammyWords4 13314 8.10 12.26 5.65 40 XM_B_SpammyWords3 13204 7.22 12.16 4.32 41 UNPARSEABLE_RELAY 13185 9.79 12.14 8.42 42 BOTNET_IPINHOSTNAME 13020 8.76 11.99 6.86 43 TR_XM_UnparsRelay 12782 8.46 11.77 6.53 44 XMSexyCombo_05 11581 6.70 10.67 4.38 45 RCVD_IN_BL_SPAMCOP_NET 11367 4.08 10.47 0.34 46 RCVD_IN_MSPIKE_H3 11229 11.65 10.34 12.42 47 BOTNET 9856 4.56 9.08 1.91 48 FSL_BULK_SIG 9571 5.55 8.82 3.64 49 HTML_IMAGE_RATIO_02 9041 7.40 8.33 6.86 50 MPART_ALT_DIFF 8972 6.62 8.26 5.65 51 BAYES_80 8720 6.00 8.03 4.81 52 UNTRUSTED_Relay 8516 3.74 7.84 1.34 53 TR_XM_SPAMCOP 8495 3.01 7.82 0.20 54 XM_Evil_Numbers_Gen 8113 8.97 7.47 9.85 55 XM_UncommonTLD01 7776 5.68 7.16 4.82 56 XM_SendGrid 7594 6.14 6.99 5.65 57 BAYES_60 7448 9.38 6.86 10.85 58 XMSubMetaSx_00 6578 5.43 6.06 5.06 59 T_FILL_THIS_FORM_SHORT 6250 2.61 5.76 0.77 60 MIME_HTML_ONLY_MULTI 6194 4.48 5.71 3.77 61 LotsOfNums_01 5924 7.41 5.46 8.55 62 XM_H_Long_From01 5875 5.29 5.41 5.21 63 TM2_M_VERY_LONG_WORD 5666 3.26 5.22 2.11 64 TR_XM_PhishingBody 5543 3.31 5.11 2.26 65 T_XMDrugObfuBody_14 5376 2.97 4.95 1.81 66 XMBody_17 5353 2.24 4.93 0.66 67 T_XMDrugObfuBody_08 5328 2.65 4.91 1.33 68 BAYES_95 5255 3.83 4.84 3.24 69 RCVD_IN_VALIDITY_SAFE 5172 5.92 4.76 6.60 70 TR_XM_DK_SendGrid 5124 4.18 4.72 3.87 71 XM_B_SpammyTLD 5105 3.22 4.70 2.35 72 XM_B_Phish_Phrases 5092 4.09 4.69 3.74 73 RCVD_IN_MSPIKE_H4 4721 5.05 4.35 5.46 74 XM_B_Investor 4718 2.34 4.35 1.17 75 TooManyTo_001 4444 5.49 4.09 6.31 76 HTML_MIME_NO_HTML_TAG 4344 2.94 4.00 2.32 77 TR_XM_SpammyWords5 4337 2.76 3.99 2.04 78 XMStrtUSub 4207 4.91 3.87 5.51 79 RCVD_IN_MSPIKE_BL 4203 1.84 3.87 0.65 80 HTML_IMAGE_RATIO_04 4125 5.10 3.80 5.86 81 RCVD_IN_VALIDITY_CERTIFIED 3973 4.96 3.66 5.72 82 TR_XM_MSPIKECOMBO 3966 1.76 3.65 0.64 83 HTML_IMAGE_RATIO_06 3863 3.32 3.56 3.18 84 XM_DIRTYINTL 3858 1.50 3.55 0.30 85 XM_GoogleGroups 3851 2.80 3.55 2.37 86 MIME_HTML_MOSTLY 3840 2.91 3.54 2.54 87 XMLngstWrd_00 3822 2.43 3.52 1.79 88 XMLngstWrd_01 3771 2.34 3.47 1.68 89 DOS_RCVD_IP_TWICE_B 3739 1.71 3.44 0.69 90 XM_CamelCaseFrm001 3718 2.63 3.42 2.16 91 XMLngstWrd_02 3703 2.22 3.41 1.52 92 FONT_INVIS_LONG_LINE 3528 1.31 3.25 0.18 93 XM_SPF_SoftFail 3493 2.02 3.22 1.32 94 USER_IN_DEF_DKIM_WL 3482 12.56 3.21 18.03 95 XM_UB50 3432 1.68 3.16 0.81 96 XMLngstWrd_03 3389 2.03 3.12 1.39 97 HTML_TITLE_SUBJ_DIFF 3372 1.82 3.11 1.07 98 XMLngstWrd_04 3372 1.97 3.11 1.31 99 UPPERCASE_75_100 3349 1.82 3.08 1.08 100 TR_XM_FormFill 3327 1.19 3.06 0.09 101 SpammyFromTLD_01 3276 1.41 3.02 0.46 102 XMNumbers 3220 3.87 2.97 4.39 103 T_TooManySym_01 3179 6.63 2.93 8.80 104 PDS_OTHER_BAD_TLD 2965 1.17 2.73 0.26 105 SpammyFromTLD_02 2963 1.31 2.73 0.48 106 XM_OfRef6 2854 1.59 2.63 0.97 107 RCVD_IN_VALIDITY_RPBL 2849 1.03 2.62 0.10 108 TM2_M_URI_OPT_OUT 2838 2.50 2.61 2.44 109 URIBL_DBL_SPAM 2830 0.97 2.61 0.01 110 SUBJ_ALL_CAPS 2782 1.91 2.56 1.53 111 T_REMOTE_IMAGE 2777 3.32 2.56 3.77 112 URI_NOVOWEL 2764 2.39 2.55 2.29 113 XM_B_Unsub2 2685 1.78 2.47 1.38 114 XM_B_Phish66 2673 1.47 2.46 0.89 115 TM2_M_A_HREF_HREF 2549 1.37 2.35 0.80 116 BOTNET_NORDNS 2525 0.87 2.33 0.02 117 HK_RANDOM_REPLYTO 2512 0.92 2.31 0.11 118 HTML_IMAGE_RATIO_08 2465 2.21 2.27 2.17 119 FROM_EXCESS_BASE64 2339 3.03 2.15 3.54 120 RCVD_IN_PSBL 2291 1.49 2.11 1.13 121 XM_DK_Undo_01 2274 1.58 2.09 1.28 122 XM_UB99 2256 0.77 2.08 0.00 123 T_XMHurry_00 2239 1.16 2.06 0.63 124 XMDiploma_00 2142 1.43 1.97 1.11 125 TR_XM_BayesRelay 2067 0.70 1.90 0.00 126 XMSexyCombo_01 2066 1.54 1.90 1.33 127 TR_XM_MSPIKECOMBO2 2046 0.78 1.88 0.13 128 XM_B_SpammyWords4 2038 1.09 1.88 0.63 129 MIME_QP_LONG_LINE 2025 3.29 1.87 4.12 130 XMStockSpam_06 2025 1.87 1.87 1.87 131 XMSlimDrugH 1986 1.17 1.83 0.79 132 XM_UB999 1983 0.68 1.83 0.00 133 TR_Symld_Words 1969 2.44 1.81 2.81 134 DKIM_INVALID 1969 1.90 1.81 1.96 135 TR_XM_PHPDW 1955 1.31 1.80 1.02 136 RCVD_IN_MSPIKE_L3 1948 1.06 1.79 0.62 137 TR_Mismatch_TLD_01 1934 0.86 1.78 0.32 138 MPART_ALT_DIFF_COUNT 1909 1.23 1.76 0.92 139 TR_LOTS_OF_MONEY3 1891 0.78 1.74 0.21 140 HTML_OBFUSCATE_05_10 1868 0.81 1.72 0.28 141 XMBdyGiftCard01 1857 1.41 1.71 1.24 142 TR_XM_PHPForged 1848 1.24 1.70 0.97 143 RCVD_IN_MSPIKE_L5 1826 0.63 1.68 0.02 144 TR_XM_FormFill2 1809 1.22 1.67 0.97 145 XM_H_PHPOS 1804 1.22 1.66 0.96 146 XMReplyNow 1762 0.76 1.62 0.26 147 TR_LOTS_OF_MONEY2 1761 0.74 1.62 0.22 148 T_MONEY_PERCENT 1761 0.74 1.62 0.22 149 URI_PHP_REDIR 1759 0.60 1.62 0.00 150 T_XMDrugObfuBody_00 1717 1.10 1.58 0.81 151 RCVD_IN_IADB_LISTED 1713 3.31 1.58 4.33 152 TR_XM_NoHeaderRelay 1676 0.63 1.54 0.10 153 ALL_TRUSTED 1656 11.03 1.53 16.60 154 TR_XM_SpammyWords3 1636 0.73 1.51 0.28 155 URI_HEX 1618 1.29 1.49 1.18 156 BAYES_40 1519 2.81 1.40 3.64 157 XM_H_Undi_Recip 1474 0.67 1.36 0.27 158 MAILING_LIST_MULTI 1472 1.98 1.36 2.35 159 URIBL_BLACK 1469 0.52 1.35 0.02 160 RCVD_IN_IADB_SPF 1456 2.95 1.34 3.89 161 HTML_TAG_BALANCE_BODY 1421 1.04 1.31 0.89 162 HTML_IMAGE_ONLY_24 1410 0.64 1.30 0.25 163 RCVD_IN_IADB_DK 1409 2.62 1.30 3.40 164 RCVD_IN_IADB_SENDERID 1396 2.68 1.29 3.50 165 TR_XM_InvalidRelay 1371 0.48 1.26 0.03 166 TR_XM_Base64_M1 1350 1.34 1.24 1.39 167 RELAYCOUNTRY_FR 1315 0.59 1.21 0.23 168 TR_XM_SB_Phish 1312 1.55 1.21 1.75 169 RELAYCOUNTRY_RU 1302 0.45 1.20 0.02 170 XMBrknScrpt_02 1289 0.76 1.19 0.51 171 XMSubPhish11 1263 1.52 1.16 1.73 172 XMClaimOffer 1258 0.48 1.16 0.09 173 TR_XM_MaxSPIKE 1242 0.50 1.14 0.13 174 THIS_AD 1210 0.71 1.11 0.48 175 KHOP_HELO_FCRDNS 1209 1.01 1.11 0.94 176 REMOVE_BEFORE_LINK 1198 0.50 1.10 0.15 177 XM_H_Long_From02 1197 1.07 1.10 1.04 178 BAYES_20 1187 2.12 1.09 2.72 179 TR_XM_Undi_Recip5 1179 0.41 1.09 0.01 180 XM_URI_RBL 1143 0.47 1.05 0.13 181 RELAYCOUNTRY_AU 1135 0.50 1.05 0.18 182 DIET_1 1109 0.59 1.02 0.34 183 XMWghtMeta_00 1093 0.50 1.01 0.20 184 XMPhish30 1089 0.85 1.00 0.76 185 XM_Body_Dirty_Words_01 1088 0.43 1.00 0.09 186 XMHTMLBadTable_001 1079 0.76 0.99 0.62 187 XMMoneyMeta_00 1071 0.49 0.99 0.20 188 XM_UB60 1067 0.40 0.98 0.06 189 XM_B_COVIDMETA 1066 0.71 0.98 0.55 190 XM_H_PHPMailer 1056 0.69 0.97 0.52 191 HTTP_EXCESSIVE_ESCAPES 1047 0.36 0.96 0.01 192 XMSubMetaI_00 1040 0.76 0.96 0.65 193 RCVD_IN_RP_SAFE 1036 1.14 0.95 1.25 194 XMBody_78 1031 0.50 0.95 0.23 195 UNDISC_MONEY 1023 0.35 0.94 0.01 196 XM_ShortIntro_01 1016 0.70 0.94 0.57 197 XMHTML_After_End 1009 0.65 0.93 0.49 198 SHOPIFY_IMG_NOT_RCVD_SFY 991 0.48 0.91 0.23 199 TR_XM_Undi_Recip2 937 0.35 0.86 0.04 200 TR_MetaPhish_Combo_01 905 0.91 0.83 0.96 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 154853 88.06 95.77 83.55 2 RELAYCOUNTRY_US 148522 79.21 77.63 80.13 3 DKIM_SIGNED 143926 82.74 91.43 77.65 4 XM_DK_Pass 141216 81.40 90.29 76.19 5 DKIM_VALID 140302 80.84 89.61 75.70 6 XM_B_Unicode 130686 75.31 83.51 70.51 7 DCC_CHECK_NEGATIVE 117993 52.07 32.28 63.66 8 DKIM_VALID_AU 116280 64.32 67.04 62.74 9 BAYES_50 105780 49.56 36.75 57.07 10 XMListUnsubscribeExists 99979 60.30 71.16 53.94 11 XM_B_SpammyWords 85109 55.40 71.60 45.92 12 XM_B_Unicode3 80933 44.12 44.90 43.66 13 RCVD_IN_MSPIKE_H2 71544 41.97 47.73 38.60 14 DCC_CHECK 67321 47.91 67.70 36.32 15 HTML_FONT_LOW_CONTRAST 56921 31.81 33.70 30.71 16 DKIM_VALID_EF 53911 31.65 36.02 29.09 17 LOC_TINY_FONT_1 50256 30.52 36.33 27.11 18 FVGT_m_MULTI_ODD 47179 27.95 32.20 25.45 19 MIME_HTML_ONLY 42764 27.55 35.19 23.07 20 XMSubLong 41877 21.48 19.58 22.59 21 T_TM2_M_HEADER_IN_MSG 40540 20.69 18.67 21.87 22 XM_B_SpammyWords2 37847 27.21 38.82 20.42 23 RCVD_IN_MSPIKE_WL 35388 17.54 14.90 19.09 24 T_KAM_HTML_FONT_INVALID 34118 21.76 27.47 18.41 25 USER_IN_DEF_DKIM_WL 33423 12.56 3.21 18.03 26 ALL_TRUSTED 30763 11.03 1.53 16.60 27 XM_Multi_Part_URI 27282 15.33 16.36 14.72 28 XM_DKIMWhitelistDomains 23205 8.02 0.34 12.52 29 XM_Body_Dirty_Words 23120 15.98 21.97 12.47 30 RCVD_IN_MSPIKE_H3 23022 11.65 10.34 12.42 31 BAYES_60 20108 9.38 6.86 10.85 32 XM_B_Unsub 19937 13.06 16.98 10.76 33 XM_Evil_Numbers_Gen 18257 8.97 7.47 9.85 34 LOTS_OF_MONEY 16764 11.08 14.56 9.04 35 T_TooManySym_01 16316 6.63 2.93 8.80 36 TR_XM_BayesUnsub 16230 11.68 16.66 8.76 37 LotsOfNums_01 15844 7.41 5.46 8.55 38 XM_DK_Undo_02 15702 23.33 48.71 8.47 39 UNPARSEABLE_RELAY 15603 9.79 12.14 8.42 40 BAYES_00 15412 5.42 0.47 8.32 41 BAYES_99 14153 19.58 39.97 7.64 42 BOTNET_IPINHOSTNAME 12724 8.76 11.99 6.86 43 HTML_IMAGE_RATIO_02 12718 7.40 8.33 6.86 44 RCVD_IN_VALIDITY_SAFE 12240 5.92 4.76 6.60 45 TR_XM_UnparsRelay 12096 8.46 11.77 6.53 46 BAYES_999 11762 15.96 32.38 6.35 47 TooManyTo_001 11697 5.49 4.09 6.31 48 TR_XM_DK_Bayes 11560 4.07 0.37 6.24 49 TR_XM_DK_Bayes1 11472 4.04 0.36 6.19 50 IN_ZIMBRA_NJ_WHITELIST 11040 3.78 0.07 5.96 51 HTML_IMAGE_RATIO_04 10861 5.10 3.80 5.86 52 T_TooManySym_02 10677 3.88 0.66 5.76 53 RCVD_IN_VALIDITY_CERTIFIED 10606 4.96 3.66 5.72 54 TR_XM_SpammyWords4 10481 8.10 12.26 5.65 55 MPART_ALT_DIFF 10474 6.62 8.26 5.65 56 XM_SendGrid 10465 6.14 6.99 5.65 57 TR_XM_DK_Bayes2 10413 3.66 0.31 5.62 58 XMStrtUSub 10220 4.91 3.87 5.51 59 RCVD_IN_MSPIKE_H4 10127 5.05 4.35 5.46 60 TR_XM_DKIM_Undo 9850 18.40 40.75 5.31 61 XM_H_Long_From01 9666 5.29 5.41 5.21 62 XMSubMetaSx_00 9371 5.43 6.06 5.06 63 XM_UncommonTLD01 8931 5.68 7.16 4.82 64 BAYES_80 8923 6.00 8.03 4.81 65 XMNumbers 8146 3.87 2.97 4.39 66 XMSexyCombo_05 8110 6.70 10.67 4.38 67 RCVD_IN_IADB_LISTED 8019 3.31 1.58 4.33 68 XM_B_SpammyWords3 8003 7.22 12.16 4.32 69 MIME_QP_LONG_LINE 7631 3.29 1.87 4.12 70 RELAYCOUNTRY_META 7296 11.30 23.87 3.94 71 RCVD_IN_IADB_SPF 7213 2.95 1.34 3.89 72 TR_XM_DK_SendGrid 7171 4.18 4.72 3.87 73 INVALID_MSGID 7163 2.49 0.15 3.86 74 T_REMOTE_IMAGE 6986 3.32 2.56 3.77 75 MIME_HTML_ONLY_MULTI 6983 4.48 5.71 3.77 76 XM_B_Phish_Phrases 6925 4.09 4.69 3.74 77 MSGID_NOFQDN1 6777 2.32 0.03 3.66 78 FSL_BULK_SIG 6754 5.55 8.82 3.64 79 BAYES_40 6748 2.81 1.40 3.64 80 FROM_EXCESS_BASE64 6554 3.03 2.15 3.54 81 RCVD_IN_IADB_SENDERID 6489 2.68 1.29 3.50 82 RCVD_IN_IADB_DK 6302 2.62 1.30 3.40 83 BAYES_95 5998 3.83 4.84 3.24 84 TO_MALFORMED 5916 2.03 0.06 3.19 85 HTML_IMAGE_RATIO_06 5890 3.32 3.56 3.18 86 TVD_RCVD_IP 5509 2.04 0.45 2.97 87 TR_Symld_Words 5208 2.44 1.81 2.81 88 BAYES_20 5037 2.12 1.09 2.72 89 RCVD_IN_IADB_VOUCHED 4871 1.95 0.80 2.63 90 MIME_HTML_MOSTLY 4711 2.91 3.54 2.54 91 TM2_M_URI_OPT_OUT 4518 2.50 2.61 2.44 92 XM_PDF 4503 1.63 0.28 2.43 93 XM_GoogleGroups 4384 2.80 3.55 2.37 94 MAILING_LIST_MULTI 4353 1.98 1.36 2.35 95 XM_B_SpammyTLD 4350 3.22 4.70 2.35 96 HTML_MIME_NO_HTML_TAG 4302 2.94 4.00 2.32 97 URI_NOVOWEL 4249 2.39 2.55 2.29 98 XM_H_Trusted_IP 4233 1.44 0.00 2.28 99 TR_XM_PhishingBody 4184 3.31 5.11 2.26 100 TR_DCC_Bayes_99 4117 11.42 27.12 2.22 101 HTML_IMAGE_RATIO_08 4023 2.21 2.27 2.17 102 XM_CamelCaseFrm001 4003 2.63 3.42 2.16 103 XMBSHREFv2 3986 1.41 0.14 2.15 104 TM2_M_VERY_LONG_WORD 3913 3.26 5.22 2.11 105 IN_HORDE_ADDRESS_BOOK 3800 1.33 0.09 2.05 106 TR_XM_SpammyWords5 3774 2.76 3.99 2.04 107 XMGappySubj_01 3636 1.28 0.12 1.96 108 DKIM_INVALID 3624 1.90 1.81 1.96 109 BOUNCE_MESSAGE 3581 1.43 0.58 1.93 110 ANY_BOUNCE_MESSAGE 3581 1.43 0.58 1.93 111 BOTNET 3545 4.56 9.08 1.91 112 XMStockSpam_06 3474 1.87 1.87 1.87 113 T_XMDrugObfuBody_14 3351 2.97 4.95 1.81 114 XMLngstWrd_00 3317 2.43 3.52 1.79 115 RCVD_IN_IADB_OPTIN 3298 1.31 0.50 1.78 116 TR_XM_SB_Phish 3235 1.55 1.21 1.75 117 XMSubPhish11 3211 1.52 1.16 1.73 118 BAYES_05 3191 1.30 0.58 1.72 119 RELAYCOUNTRY_CA 3145 5.72 12.59 1.70 120 XMLngstWrd_01 3107 2.34 3.47 1.68 121 TR_XM_SpammyRelay 3103 7.24 16.74 1.67 122 TR_XM_SpammyWords2 2877 6.36 14.57 1.55 123 SUBJ_ALL_CAPS 2842 1.91 2.56 1.53 124 XMLngstWrd_02 2820 2.22 3.41 1.52 125 XMBody_95 2779 1.01 0.17 1.50 126 XMLngstWrd_03 2580 2.03 3.12 1.39 127 TR_XM_Base64_M1 2574 1.34 1.24 1.39 128 XM_B_Unsub2 2559 1.78 2.47 1.38 129 TooManyTo_002 2508 0.99 0.36 1.35 130 UNTRUSTED_Relay 2485 3.74 7.84 1.34 131 XMSexyCombo_01 2472 1.54 1.90 1.33 132 T_XMDrugObfuBody_08 2464 2.65 4.91 1.33 133 XM_SPF_SoftFail 2445 2.02 3.22 1.32 134 XMLngstWrd_04 2424 1.97 3.11 1.31 135 XM_DK_Undo_01 2373 1.58 2.09 1.28 136 XM_D_tchamptons_WL 2334 0.80 0.03 1.26 137 XMSubMetaSxObfu_03 2323 0.93 0.38 1.25 138 RCVD_IN_RP_SAFE 2312 1.14 0.95 1.25 139 XMBdyGiftCard01 2293 1.41 1.71 1.24 140 TVD_SPACE_RATIO 2248 0.80 0.09 1.21 141 RCVD_IN_MSPIKE_H5 2239 0.84 0.21 1.21 142 URI_HEX 2188 1.29 1.49 1.18 143 XM_B_Investor 2166 2.34 4.35 1.17 144 T_TooManySym_03 2127 0.83 0.28 1.15 145 RCVD_IN_PSBL 2098 1.49 2.11 1.13 146 XMDiploma_00 2065 1.43 1.97 1.11 147 RCVD_IN_RP_CERTIFIED 2002 0.96 0.76 1.08 148 UPPERCASE_75_100 1997 1.82 3.08 1.08 149 HTML_TITLE_SUBJ_DIFF 1989 1.82 3.11 1.07 150 XMSexyCombo_04 1971 0.92 0.68 1.06 151 DKIM_ADSP_NXDOMAIN 1956 0.92 0.70 1.06 152 XM_H_Long_From02 1934 1.07 1.10 1.04 153 XMSubMetaSx_01 1895 0.75 0.27 1.02 154 TR_XM_PHPDW 1894 1.31 1.80 1.02 155 NO_DNS_FOR_FROM 1881 0.83 0.50 1.01 156 XMSexyCombo_02 1828 0.73 0.30 0.99 157 XM_OfRef6 1806 1.59 2.63 0.97 158 HTML_FONT_FACE_BAD 1804 0.88 0.71 0.97 159 TooManyTo_003 1794 0.72 0.29 0.97 160 TR_XM_PHPForged 1791 1.24 1.70 0.97 161 TR_XM_FormFill2 1789 1.22 1.67 0.97 162 XM_H_PHPOS 1774 1.22 1.66 0.96 163 XMSubNoVowel 1774 0.86 0.69 0.96 164 TR_MetaPhish_Combo_01 1772 0.91 0.83 0.96 165 TR_XM_MaxWHORU 1748 0.78 0.49 0.94 166 KHOP_HELO_FCRDNS 1746 1.01 1.11 0.94 167 MPART_ALT_DIFF_COUNT 1709 1.23 1.76 0.92 168 XM_B_Phish66 1652 1.47 2.46 0.89 169 HTML_TAG_BALANCE_BODY 1641 1.04 1.31 0.89 170 XM_B_COPY_HTML 1544 0.81 0.78 0.83 171 DKIM_ADSP_CUSTOM_MED 1531 0.80 0.77 0.83 172 T_XMDrugObfuBody_00 1509 1.10 1.58 0.81 173 XM_UB50 1494 1.68 3.16 0.81 174 TM2_M_A_HREF_HREF 1481 1.37 2.35 0.80 175 XMSlimDrugH 1464 1.17 1.83 0.79 176 T_FILL_THIS_FORM_SHORT 1423 2.61 5.76 0.77 177 XMPhish30 1407 0.85 1.00 0.76 178 FROM_GOV_DKIM_AU 1378 0.49 0.05 0.74 179 HTML_IMAGE_ONLY_20 1355 0.58 0.33 0.73 180 USER_IN_WHITELIST 1348 0.46 0.00 0.73 181 USER_IN_WELCOMELIST 1348 0.46 0.00 0.73 182 TooManyTo_004 1310 0.55 0.27 0.71 183 DOS_RCVD_IP_TWICE_B 1284 1.71 3.44 0.69 184 XMBody_17 1227 2.24 4.93 0.66 185 RCVD_IN_MSPIKE_BL 1206 1.84 3.87 0.65 186 XMSubMetaSxObfu_02 1199 0.59 0.49 0.65 187 XMSubMetaI_00 1199 0.76 0.96 0.65 188 TR_XM_MSPIKECOMBO 1194 1.76 3.65 0.64 189 TR_XM_INV_DKIM 1189 0.61 0.55 0.64 190 T_XMHurry_00 1174 1.16 2.06 0.63 191 XM_B_SpammyWords4 1168 1.09 1.88 0.63 192 RCVD_IN_MSPIKE_L3 1158 1.06 1.79 0.62 193 XMHTMLBadTable_001 1141 0.76 0.99 0.62 194 XM_ProductURIs 1132 0.68 0.80 0.61 195 TooManyTo_005 1116 0.47 0.24 0.60 196 URI_TRY_3LD 1067 0.61 0.68 0.58 197 XM_ShortIntro_01 1051 0.70 0.94 0.57 198 XM_S_SubURI 1045 0.37 0.04 0.56 199 PLING_QUERY 1024 0.61 0.71 0.55 200 XM_B_COVIDMETA 1018 0.71 0.98 0.55 ----------------------------------------------------------------------