Email: 304884 Autolearn: 0 AvgScore: 4.19 AvgScanTime: 1.50 sec Spam: 115422 Autolearn: 0 AvgScore: 14.03 AvgScanTime: 1.61 sec Ham: 189462 Autolearn: 0 AvgScore: -1.80 AvgScanTime: 1.43 sec Time Spent Running SA: 126.69 hours Time Spent Processing Spam: 51.63 hours Time Spent Processing Ham: 75.06 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 108550 86.49 94.05 81.88 2 DKIM_SIGNED 106698 84.00 92.44 78.85 3 XM_DK_Pass 105534 82.14 91.43 76.48 4 DKIM_VALID 104848 81.62 90.84 76.00 5 RELAYCOUNTRY_US 92235 80.30 79.91 80.54 6 XM_B_Unicode 89276 72.55 77.35 69.64 7 XMListUnsubscribeExists 87331 62.88 75.66 55.09 8 DKIM_VALID_AU 86078 68.63 74.58 65.02 9 DCC_CHECK 84310 53.29 73.05 41.26 10 XM_B_SpammyWords 79393 54.30 68.78 45.48 11 XM_DK_Undo_02 55618 23.48 48.19 8.43 12 RCVD_IN_MSPIKE_H2 52739 42.19 45.69 40.06 13 XM_B_Unicode3 49198 42.89 42.62 43.06 14 LOC_TINY_FONT_1 49013 34.11 42.46 29.03 15 TR_XM_DKIM_Undo 46019 18.33 39.87 5.20 16 BAYES_99 44620 18.80 38.66 6.70 17 XM_B_SpammyWords2 42582 25.93 36.89 19.26 18 DKIM_VALID_EF 42010 32.54 36.40 30.19 19 HTML_FONT_LOW_CONTRAST 41153 32.82 35.65 31.09 20 BAYES_50 39810 48.39 34.49 56.86 21 FVGT_m_MULTI_ODD 38539 30.74 33.39 29.12 22 BAYES_999 35806 15.12 31.02 5.43 23 MIME_HTML_ONLY 33485 24.95 29.01 22.48 24 TR_DCC_Bayes_99 32472 12.04 28.13 2.23 25 DCC_CHECK_NEGATIVE 31091 46.69 26.94 58.72 26 T_KAM_HTML_FONT_INVALID 30898 21.69 26.77 18.60 27 XM_Body_Dirty_Words 27751 17.13 24.04 12.92 28 RELAYCOUNTRY_META 25155 10.75 21.79 4.02 29 XMSubLong 22707 21.87 19.67 23.21 30 T_TM2_M_HEADER_IN_MSG 21792 21.27 18.88 22.72 31 XM_Multi_Part_URI 20303 15.69 17.59 14.54 32 RCVD_IN_MSPIKE_WL 18774 18.57 16.27 19.97 33 TR_XM_SpammyRelay 18207 7.06 15.77 1.76 34 XM_UncommonTLD01 17985 9.24 15.58 5.37 35 XM_B_Unsub 16532 10.79 14.32 8.64 36 RCVD_IN_MSPIKE_H3 16294 13.38 14.12 12.93 37 TR_XM_BayesUnsub 16293 9.90 14.12 7.33 38 TR_XM_SpammyWords2 16098 5.83 13.95 0.89 39 XM_B_SpammyWords3 13707 7.74 11.88 5.23 40 LOTS_OF_MONEY 13479 8.28 11.68 6.20 41 UNPARSEABLE_RELAY 13390 10.04 11.60 9.09 42 XMSexyCombo_05 13338 6.98 11.56 4.19 43 RELAYCOUNTRY_CA 13247 5.30 11.48 1.54 44 MPART_ALT_DIFF 11937 7.75 10.34 6.17 45 BOTNET_IPINHOSTNAME 11747 7.83 10.18 6.40 46 XM_B_SpammyTLD 11605 5.04 10.05 1.98 47 TR_XM_SpammyWords4 11096 6.07 9.61 3.91 48 TooManyTo_001 11086 7.74 9.60 6.60 49 BAYES_80 10859 6.67 9.41 4.99 50 RCVD_IN_BL_SPAMCOP_NET 10594 3.98 9.18 0.82 51 FSL_BULK_SIG 10538 7.26 9.13 6.12 52 SpammyFromTLD_02 10338 3.52 8.96 0.21 53 BAYES_60 10042 10.21 8.70 11.13 54 PDS_OTHER_BAD_TLD 9704 3.40 8.41 0.35 55 XM_Evil_Numbers_Gen 9682 8.50 8.39 8.58 56 UNTRUSTED_Relay 8821 3.86 7.64 1.55 57 XMSubMetaSx_00 8696 5.80 7.53 4.75 58 BOTNET 8532 3.74 7.39 1.52 59 TR_XM_UnparsRelay 8449 3.75 7.32 1.57 60 LongTLD 8193 2.81 7.10 0.20 61 TR_XM_SPAMCOP 7926 2.78 6.87 0.29 62 FROM_SUSPICIOUS_NTLD 7885 2.65 6.83 0.10 63 LotsOfNums_01 7749 7.52 6.71 8.02 64 FROM_SUSPICIOUS_NTLD_FP 7673 2.56 6.65 0.07 65 MIME_HTML_ONLY_MULTI 7378 4.67 6.39 3.62 66 XM_SendGrid 7074 6.07 6.13 6.04 67 TM2_M_VERY_LONG_WORD 7047 3.73 6.11 2.28 68 DATE_IN_PAST_24_48 6848 2.25 5.93 0.00 69 T_FILL_THIS_FORM_SHORT 6812 2.66 5.90 0.69 70 HTML_IMAGE_RATIO_02 6681 6.61 5.79 7.11 71 XM_H_Long_From01 6502 5.43 5.63 5.31 72 BAYES_95 6449 4.17 5.59 3.31 73 XMBody_17 6266 2.73 5.43 1.09 74 TR_XM_PhishingBody 6142 3.70 5.32 2.71 75 TR_XM_SpammyWords5 6079 2.77 5.27 1.25 76 USER_IN_DEF_DKIM_WL 5968 13.17 5.17 18.05 77 XM_B_Phish_Phrases 5879 4.14 5.09 3.57 78 MIME_HTML_MOSTLY 5809 4.18 5.03 3.67 79 RCVD_IN_VALIDITY_SAFE 5577 5.84 4.83 6.46 80 XM_DIRTYINTL 5573 2.04 4.83 0.34 81 HTML_MIME_NO_HTML_TAG 5406 3.42 4.68 2.64 82 T_XMDrugObfuBody_08 5333 2.79 4.62 1.67 83 XMLngstWrd_00 5291 2.94 4.58 1.95 84 XMLngstWrd_01 5264 2.86 4.56 1.83 85 XMLngstWrd_02 5057 2.70 4.38 1.67 86 XM_GoogleGroups 4979 3.05 4.31 2.28 87 XMStrtUSub 4892 5.20 4.24 5.79 88 T_XMDrugObfuBody_14 4880 2.61 4.23 1.62 89 TR_XM_DK_SendGrid 4787 4.12 4.15 4.11 90 RCVD_IN_VALIDITY_CERTIFIED 4748 4.94 4.11 5.44 91 XM_OfRef6 4741 2.22 4.11 1.07 92 XMLngstWrd_03 4691 2.50 4.06 1.55 93 URIBL_DBL_SPAM 4561 1.50 3.95 0.01 94 SUBJ_ALL_CAPS 4539 2.08 3.93 0.95 95 HTML_IMAGE_RATIO_04 4425 4.81 3.83 5.40 96 TR_XM_FormFill 4360 1.45 3.78 0.03 97 XMLngstWrd_04 4339 2.33 3.76 1.47 98 HTML_TITLE_SUBJ_DIFF 4299 2.12 3.72 1.14 99 UPPERCASE_75_100 4267 2.12 3.70 1.15 100 XMNumbers 4221 4.83 3.66 5.55 101 URI_NOVOWEL 4203 2.68 3.64 2.10 102 XM_UB50 4145 1.99 3.59 1.02 103 XM_SPF_SoftFail 3927 2.62 3.40 2.14 104 T_REMOTE_IMAGE 3829 3.47 3.32 3.56 105 XM_B_Investor 3812 1.99 3.30 1.18 106 HTML_IMAGE_RATIO_06 3794 3.40 3.29 3.47 107 SpammyFromTLD_01 3560 1.63 3.08 0.75 108 RCVD_IN_MSPIKE_BL 3369 1.29 2.92 0.30 109 TR_XM_MSPIKECOMBO 3348 1.29 2.90 0.30 110 XM_DK_Undo_01 3318 1.99 2.87 1.45 111 XM_B_Phish66 3265 1.76 2.83 1.12 112 TM2_M_URI_OPT_OUT 2872 2.15 2.49 1.94 113 FROM_EXCESS_BASE64 2806 3.15 2.43 3.59 114 XMDiploma_00 2788 1.71 2.42 1.29 115 HK_RANDOM_REPLYTO 2776 0.97 2.41 0.10 116 XM_H_Undi_Recip 2775 1.01 2.40 0.16 117 FONT_INVIS_LONG_LINE 2644 0.92 2.29 0.08 118 TR_XM_SpammyWords3 2621 0.99 2.27 0.20 119 RELAYCOUNTRY_IN 2595 0.90 2.25 0.08 120 T_XMHurry_00 2587 1.28 2.24 0.70 121 HTML_IMAGE_RATIO_08 2579 1.96 2.23 1.79 122 TR_Caps_n_Bayes_99 2568 0.92 2.22 0.13 123 XM_CamelCaseFrm001 2539 2.13 2.20 2.09 124 RCVD_IN_MSPIKE_L3 2531 0.96 2.19 0.22 125 XMReplyNow 2436 0.92 2.11 0.19 126 XMBdyGiftCard01 2372 1.67 2.06 1.44 127 TR_LOTS_OF_MONEY3 2296 0.94 1.99 0.31 128 XM_B_SpammyWords4 2292 1.16 1.99 0.66 129 RCVD_IN_MSPIKE_H4 2236 4.16 1.94 5.51 130 RCVD_IN_PSBL 2225 1.04 1.93 0.49 131 TR_XM_Undi_Recip11 2165 0.72 1.88 0.02 132 XM_B_Unsub2 2123 1.32 1.84 1.01 133 T_TooManySym_01 2078 6.31 1.80 9.06 134 XMSexyCombo_01 2005 1.44 1.74 1.26 135 TR_XM_PHPDW 1887 0.91 1.63 0.46 136 XMStockSpam_06 1865 1.57 1.62 1.55 137 DKIM_INVALID 1850 2.38 1.60 2.85 138 T_XMDrugObfuBody_00 1849 1.01 1.60 0.65 139 DIET_1 1844 0.81 1.60 0.33 140 HTML_TAG_BALANCE_BODY 1843 1.21 1.60 0.97 141 XM_RXBody 1820 1.25 1.58 1.04 142 BOTNET_NORDNS 1810 0.60 1.57 0.01 143 KHOP_HELO_FCRDNS 1793 1.56 1.55 1.56 144 TR_XM_PHPForged 1764 0.81 1.53 0.37 145 TR_XM_FormFill2 1724 0.79 1.49 0.36 146 XM_H_PHPOS 1718 0.78 1.49 0.35 147 MIME_QP_LONG_LINE 1711 2.82 1.48 3.63 148 MPART_ALT_DIFF_COUNT 1667 1.06 1.44 0.82 149 TR_XM_NoHeaderRelay 1654 0.60 1.43 0.10 150 XMPhish30 1487 0.99 1.29 0.80 151 RCVD_IN_VALIDITY_RPBL 1478 0.56 1.28 0.12 152 SHOPIFY_IMG_NOT_RCVD_SFY 1419 0.64 1.23 0.28 153 XM_UB99 1414 0.47 1.23 0.00 154 ALL_TRUSTED 1406 10.46 1.22 16.08 155 XM_URI_RBL 1378 0.57 1.19 0.18 156 TR_XM_BayesRelay 1367 0.45 1.18 0.01 157 TR_XM_InvalidRelay 1362 0.46 1.18 0.02 158 BAYES_40 1349 2.82 1.17 3.82 159 XMBrknScrpt_02 1311 0.80 1.14 0.60 160 XM_ProductURIs 1310 0.73 1.13 0.49 161 XM_B_SEO 1283 0.55 1.11 0.20 162 TR_XM_Undi_Recip5 1281 0.43 1.11 0.01 163 MAILING_LIST_MULTI 1268 1.64 1.10 1.96 164 TR_XM_MSPIKECOMBO2 1252 0.42 1.08 0.01 165 XM_B_DNDMA 1243 0.63 1.08 0.35 166 RCVD_IN_RP_SAFE 1220 1.13 1.06 1.17 167 URIBL_BLACK 1211 0.42 1.05 0.03 168 TR_Mismatch_TLD_02 1206 0.47 1.04 0.13 169 XM_OfRef7 1200 0.48 1.04 0.14 170 XM_UB60 1198 0.45 1.04 0.10 171 URI_HEX 1196 0.98 1.04 0.95 172 MONEY_FORM_SHORT 1196 0.39 1.04 0.00 173 RELAYCOUNTRY_RU 1179 0.40 1.02 0.03 174 XM_UB80 1171 0.40 1.01 0.02 175 XMGenDplmaNmb 1170 0.65 1.01 0.43 176 XM_H_Long_From02 1169 0.98 1.01 0.97 177 TR_XM_SEO4 1159 0.44 1.00 0.09 178 XM_UB999 1132 0.37 0.98 0.00 179 UNDISC_MONEY 1127 0.37 0.98 0.01 180 TR_XM_SB_Phish 1124 1.50 0.97 1.82 181 XMSexyCombo_04 1123 0.95 0.97 0.93 182 RCVD_IN_IADB_LISTED 1115 2.34 0.97 3.17 183 BAYES_20 1098 2.04 0.95 2.71 184 TR_Symld_Words 1096 1.43 0.95 1.72 185 TR_MetaPhish_Combo_01 1087 0.97 0.94 0.98 186 XM_B_COVIDMETA 1076 0.73 0.93 0.61 187 XMHTML_After_End 1069 0.67 0.93 0.51 188 XM_H_PHPMailer 1044 0.76 0.90 0.67 189 TR_XM_Undi_Recip2 1042 0.35 0.90 0.02 190 RELAYCOUNTRY_AU 1021 0.47 0.88 0.22 191 TR_XM_Base64_M1 1020 1.06 0.88 1.17 192 XM_Body_Dirty_Words_01 1017 0.86 0.88 0.85 193 XMSubMetaSxObfu_03 1016 0.99 0.88 1.06 194 HTML_TEXT_INVISIBLE_STYLE 1015 0.56 0.88 0.37 195 TR_XM_Undi_RecipCombo2 1013 0.33 0.88 0.00 196 TR_XM_MaxSPIKE 991 0.33 0.86 0.01 197 ANY_BOUNCE_MESSAGE 986 1.48 0.85 1.87 198 BOUNCE_MESSAGE 985 1.48 0.85 1.87 199 RCVD_IN_RP_CERTIFIED 981 0.94 0.85 1.00 200 RCVD_IN_IADB_SPF 958 2.14 0.83 2.94 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 155129 86.49 94.05 81.88 2 RELAYCOUNTRY_US 152592 80.30 79.91 80.54 3 DKIM_SIGNED 149393 84.00 92.44 78.85 4 XM_DK_Pass 144892 82.14 91.43 76.48 5 DKIM_VALID 143993 81.62 90.84 76.00 6 XM_B_Unicode 131932 72.55 77.35 69.64 7 DKIM_VALID_AU 123179 68.63 74.58 65.02 8 DCC_CHECK_NEGATIVE 111253 46.69 26.94 58.72 9 BAYES_50 107721 48.39 34.49 56.86 10 XMListUnsubscribeExists 104381 62.88 75.66 55.09 11 XM_B_SpammyWords 86173 54.30 68.78 45.48 12 XM_B_Unicode3 81578 42.89 42.62 43.06 13 DCC_CHECK 78164 53.29 73.05 41.26 14 RCVD_IN_MSPIKE_H2 75903 42.19 45.69 40.06 15 HTML_FONT_LOW_CONTRAST 58913 32.82 35.65 31.09 16 DKIM_VALID_EF 57201 32.54 36.40 30.19 17 FVGT_m_MULTI_ODD 55177 30.74 33.39 29.12 18 LOC_TINY_FONT_1 54992 34.11 42.46 29.03 19 XMSubLong 43970 21.87 19.67 23.21 20 T_TM2_M_HEADER_IN_MSG 43044 21.27 18.88 22.72 21 MIME_HTML_ONLY 42596 24.95 29.01 22.48 22 RCVD_IN_MSPIKE_WL 37834 18.57 16.27 19.97 23 XM_B_SpammyWords2 36489 25.93 36.89 19.26 24 T_KAM_HTML_FONT_INVALID 35232 21.69 26.77 18.60 25 USER_IN_DEF_DKIM_WL 34200 13.17 5.17 18.05 26 ALL_TRUSTED 30470 10.46 1.22 16.08 27 XM_Multi_Part_URI 27542 15.69 17.59 14.54 28 RCVD_IN_MSPIKE_H3 24488 13.38 14.12 12.93 29 XM_Body_Dirty_Words 24474 17.13 24.04 12.92 30 XM_DKIMWhitelistDomains 23729 7.85 0.18 12.52 31 BAYES_60 21094 10.21 8.70 11.13 32 UNPARSEABLE_RELAY 17214 10.04 11.60 9.09 33 T_TooManySym_01 17169 6.31 1.80 9.06 34 BAYES_00 16528 5.62 0.51 8.72 35 XM_B_Unsub 16362 10.79 14.32 8.64 36 XM_Evil_Numbers_Gen 16248 8.50 8.39 8.58 37 XM_DK_Undo_02 15970 23.48 48.19 8.43 38 LotsOfNums_01 15193 7.52 6.71 8.02 39 TR_XM_BayesUnsub 13895 9.90 14.12 7.33 40 HTML_IMAGE_RATIO_02 13468 6.61 5.79 7.11 41 BAYES_99 12698 18.80 38.66 6.70 42 TR_XM_DK_Bayes 12569 4.28 0.42 6.63 43 TooManyTo_001 12499 7.74 9.60 6.60 44 TR_XM_DK_Bayes1 12471 4.25 0.42 6.58 45 RCVD_IN_VALIDITY_SAFE 12235 5.84 4.83 6.46 46 BOTNET_IPINHOSTNAME 12118 7.83 10.18 6.40 47 T_TooManySym_02 11990 4.10 0.45 6.33 48 LOTS_OF_MONEY 11754 8.28 11.68 6.20 49 MPART_ALT_DIFF 11698 7.75 10.34 6.17 50 FSL_BULK_SIG 11595 7.26 9.13 6.12 51 XM_SendGrid 11440 6.07 6.13 6.04 52 TR_XM_DK_Bayes2 11300 3.85 0.38 5.96 53 XMStrtUSub 10961 5.20 4.24 5.79 54 IN_ZIMBRA_NJ_WHITELIST 10793 3.56 0.06 5.70 55 XMNumbers 10513 4.83 3.66 5.55 56 RCVD_IN_MSPIKE_H4 10443 4.16 1.94 5.51 57 RCVD_IN_VALIDITY_CERTIFIED 10303 4.94 4.11 5.44 58 BAYES_999 10280 15.12 31.02 5.43 59 HTML_IMAGE_RATIO_04 10238 4.81 3.83 5.40 60 XM_UncommonTLD01 10173 9.24 15.58 5.37 61 XM_H_Long_From01 10068 5.43 5.63 5.31 62 XM_B_SpammyWords3 9902 7.74 11.88 5.23 63 TR_XM_DKIM_Undo 9855 18.33 39.87 5.20 64 BAYES_80 9462 6.67 9.41 4.99 65 XMSubMetaSx_00 8994 5.80 7.53 4.75 66 XMSexyCombo_05 7930 6.98 11.56 4.19 67 TR_XM_DK_SendGrid 7783 4.12 4.15 4.11 68 RELAYCOUNTRY_META 7619 10.75 21.79 4.02 69 TR_XM_SpammyWords4 7410 6.07 9.61 3.91 70 BAYES_40 7234 2.82 1.17 3.82 71 INVALID_MSGID 7164 2.40 0.12 3.78 72 MIME_HTML_MOSTLY 6950 4.18 5.03 3.67 73 MIME_QP_LONG_LINE 6884 2.82 1.48 3.63 74 TVD_RCVD_IP 6861 2.50 0.67 3.62 75 MIME_HTML_ONLY_MULTI 6851 4.67 6.39 3.62 76 MSGID_NOFQDN1 6827 2.25 0.03 3.60 77 FROM_EXCESS_BASE64 6807 3.15 2.43 3.59 78 XM_B_Phish_Phrases 6758 4.14 5.09 3.57 79 T_REMOTE_IMAGE 6751 3.47 3.32 3.56 80 HTML_IMAGE_RATIO_06 6583 3.40 3.29 3.47 81 BAYES_95 6266 4.17 5.59 3.31 82 RCVD_IN_IADB_LISTED 6008 2.34 0.97 3.17 83 TO_MALFORMED 5918 1.97 0.07 3.12 84 RCVD_IN_IADB_SPF 5579 2.14 0.83 2.94 85 DKIM_INVALID 5400 2.38 1.60 2.85 86 RCVD_IN_IADB_SENDERID 5174 1.99 0.77 2.73 87 TR_XM_PhishingBody 5139 3.70 5.32 2.71 88 BAYES_20 5127 2.04 0.95 2.71 89 T_TooManySym_03 5079 1.75 0.23 2.68 90 RCVD_IN_IADB_DK 5053 1.95 0.78 2.67 91 TVD_SPACE_RATIO 5038 1.67 0.05 2.66 92 HTML_MIME_NO_HTML_TAG 5010 3.42 4.68 2.64 93 XM_PDF 4450 1.54 0.21 2.35 94 IN_HORDE_ADDRESS_BOOK 4350 1.45 0.07 2.30 95 XM_GoogleGroups 4320 3.05 4.31 2.28 96 TM2_M_VERY_LONG_WORD 4315 3.73 6.11 2.28 97 TR_DCC_Bayes_99 4231 12.04 28.13 2.23 98 XM_SPF_SoftFail 4049 2.62 3.40 2.14 99 XMBSHREFv2 3980 1.38 0.19 2.10 100 URI_NOVOWEL 3980 2.68 3.64 2.10 101 XM_CamelCaseFrm001 3961 2.13 2.20 2.09 102 XM_B_SpammyTLD 3748 5.04 10.05 1.98 103 MAILING_LIST_MULTI 3719 1.64 1.10 1.96 104 XMLngstWrd_00 3686 2.94 4.58 1.95 105 TM2_M_URI_OPT_OUT 3685 2.15 2.49 1.94 106 BOUNCE_MESSAGE 3538 1.48 0.85 1.87 107 ANY_BOUNCE_MESSAGE 3538 1.48 0.85 1.87 108 XMLngstWrd_01 3465 2.86 4.56 1.83 109 RCVD_IN_IADB_VOUCHED 3453 1.31 0.48 1.82 110 TR_XM_SB_Phish 3445 1.50 0.97 1.82 111 XMSubPhish11 3417 1.40 0.73 1.80 112 HTML_IMAGE_RATIO_08 3395 1.96 2.23 1.79 113 BAYES_05 3331 1.29 0.52 1.76 114 TR_XM_SpammyRelay 3326 7.06 15.77 1.76 115 TR_Symld_Words 3251 1.43 0.95 1.72 116 T_XMDrugObfuBody_08 3173 2.79 4.62 1.67 117 XMLngstWrd_02 3173 2.70 4.38 1.67 118 T_XMDrugObfuBody_14 3078 2.61 4.23 1.62 119 TR_XM_UnparsRelay 2975 3.75 7.32 1.57 120 KHOP_HELO_FCRDNS 2954 1.56 1.55 1.56 121 XMLngstWrd_03 2941 2.50 4.06 1.55 122 UNTRUSTED_Relay 2940 3.86 7.64 1.55 123 FVGT_m_MULTI_ODD_EMAIL 2937 1.03 0.16 1.55 124 XMStockSpam_06 2928 1.57 1.62 1.55 125 RELAYCOUNTRY_CA 2926 5.30 11.48 1.54 126 RCVD_IN_MSPIKE_H5 2903 1.03 0.21 1.53 127 BOTNET 2875 3.74 7.39 1.52 128 XMLngstWrd_04 2780 2.33 3.76 1.47 129 XM_DK_Undo_01 2750 1.99 2.87 1.45 130 XMBdyGiftCard01 2722 1.67 2.06 1.44 131 XMGappySubj_01 2696 0.95 0.18 1.42 132 XMBody_95 2662 0.92 0.11 1.41 133 XMDiploma_00 2437 1.71 2.42 1.29 134 TooManyTo_002 2434 0.94 0.38 1.28 135 XMSexyCombo_01 2386 1.44 1.74 1.26 136 TR_XM_SpammyWords5 2377 2.77 5.27 1.25 137 RCVD_IN_IADB_OPTIN 2310 0.86 0.27 1.22 138 XM_B_Investor 2245 1.99 3.30 1.18 139 TR_XM_Base64_M1 2218 1.06 0.88 1.17 140 RCVD_IN_RP_SAFE 2216 1.13 1.06 1.17 141 XM_H_Trusted_IP 2213 0.73 0.00 1.17 142 UPPERCASE_75_100 2183 2.12 3.70 1.15 143 HTML_TITLE_SUBJ_DIFF 2160 2.12 3.72 1.14 144 XM_B_Phish66 2114 1.76 2.83 1.12 145 XMBody_17 2064 2.73 5.43 1.09 146 HTML_FONT_FACE_BAD 2043 0.94 0.70 1.08 147 XM_OfRef6 2033 2.22 4.11 1.07 148 XMSubMetaSxObfu_03 2011 0.99 0.88 1.06 149 XM_RXBody 1979 1.25 1.58 1.04 150 XM_UB50 1928 1.99 3.59 1.02 151 XM_B_Unsub2 1914 1.32 1.84 1.01 152 RCVD_IN_RP_CERTIFIED 1886 0.94 0.85 1.00 153 XM_shorewaves_Whitelist 1875 0.61 0.00 0.99 154 TR_MetaPhish_Combo_01 1863 0.97 0.94 0.98 155 HTML_TAG_BALANCE_BODY 1835 1.21 1.60 0.97 156 XM_H_Long_From02 1832 0.98 1.01 0.97 157 SUBJ_ALL_CAPS 1801 2.08 3.93 0.95 158 URI_HEX 1793 0.98 1.04 0.95 159 TooManyTo_003 1793 0.71 0.32 0.95 160 XMSexyCombo_04 1759 0.95 0.97 0.93 161 XM_B_COPY_HTML 1746 0.84 0.70 0.92 162 TR_XM_SpammyWords2 1687 5.83 13.95 0.89 163 XM_Body_Dirty_Words_01 1607 0.86 0.88 0.85 164 MPART_ALT_DIFF_COUNT 1557 1.06 1.44 0.82 165 RCVD_IN_BL_SPAMCOP_NET 1551 3.98 9.18 0.82 166 XMPhish30 1525 0.99 1.29 0.80 167 XMSexyCombo_02 1520 0.65 0.40 0.80 168 DKIM_ADSP_CUSTOM_MED 1428 0.69 0.59 0.75 169 SpammyFromTLD_01 1419 1.63 3.08 0.75 170 USER_IN_WELCOMELIST 1344 0.44 0.00 0.71 171 USER_IN_WHITELIST 1344 0.44 0.00 0.71 172 NO_DNS_FOR_FROM 1342 0.72 0.74 0.71 173 TooManyTo_004 1329 0.55 0.30 0.70 174 XMSubMetaSxObfu_02 1325 0.66 0.59 0.70 175 T_XMHurry_00 1319 1.28 2.24 0.70 176 T_FILL_THIS_FORM_SHORT 1303 2.66 5.90 0.69 177 XM_H_PHPMailer 1271 0.76 0.90 0.67 178 XM_B_SpammyWords4 1245 1.16 1.99 0.66 179 T_XMDrugObfuBody_00 1235 1.01 1.60 0.65 180 XMSubNoVowel 1216 0.59 0.50 0.64 181 HTTPS_HTTP_MISMATCH 1210 0.69 0.78 0.64 182 HTML_IMAGE_ONLY_20 1157 0.49 0.30 0.61 183 XM_B_COVIDMETA 1153 0.73 0.93 0.61 184 XMBrknScrpt_02 1131 0.80 1.14 0.60 185 DATE_IN_PAST_03_06 1081 0.49 0.36 0.57 186 XMHTMLBadTable_001 1070 0.64 0.77 0.56 187 XM_S_SubURI 1057 0.35 0.02 0.56 188 TooManyTo_005 1045 0.45 0.27 0.55 189 XMSubMetaI_00 1024 0.59 0.66 0.54 190 URI_TRY_3LD 976 0.57 0.66 0.52 191 XMHTML_After_End 974 0.67 0.93 0.51 192 TR_XM_MaxWHORU 973 0.60 0.73 0.51 193 XM_B_REG_HTML 967 0.60 0.75 0.51 194 DKIM_ADSP_NXDOMAIN 936 0.50 0.50 0.49 195 XM_Walgreens_Forge 934 0.31 0.02 0.49 196 RCVD_IN_PSBL 933 1.04 1.93 0.49 197 XM_ProductURIs 924 0.73 1.13 0.49 198 PLING_QUERY 882 0.54 0.66 0.47 199 NML_ADSP_CUSTOM_MED 875 0.48 0.51 0.46 200 TR_XM_PHPDW 873 0.91 1.63 0.46 ----------------------------------------------------------------------