Email: 586499 Autolearn: 0 AvgScore: 2.46 AvgScanTime: 1.68 sec Spam: 184523 Autolearn: 0 AvgScore: 13.76 AvgScanTime: 1.88 sec Ham: 401976 Autolearn: 0 AvgScore: -2.73 AvgScanTime: 1.58 sec Time Spent Running SA: 273.28 hours Time Spent Processing Spam: 96.31 hours Time Spent Processing Ham: 176.97 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 175311 90.64 95.01 88.63 2 DKIM_SIGNED 169339 74.69 91.77 66.85 3 XM_DK_Pass 166063 73.04 90.00 65.25 4 DKIM_VALID 164383 72.18 89.09 64.42 5 XM_B_Unicode 149017 76.38 80.76 74.37 6 RELAYCOUNTRY_US 147958 81.86 80.18 82.64 7 DCC_CHECK 139709 47.60 75.71 34.70 8 XMListUnsubscribeExists 136947 55.33 74.22 46.65 9 XM_B_SpammyWords 127452 52.36 69.07 44.68 10 DKIM_VALID_AU 125043 56.43 67.77 51.22 11 RCVD_IN_MSPIKE_H2 89045 39.06 48.26 34.84 12 XM_DK_Undo_02 84301 18.69 45.69 6.29 13 XM_B_Unicode3 81949 45.50 44.41 46.01 14 BAYES_50 74323 49.10 40.28 53.16 15 XM_B_SpammyWords2 74305 24.60 40.27 17.41 16 LOC_TINY_FONT_1 70809 27.88 38.37 23.06 17 FVGT_m_MULTI_ODD 69332 28.57 37.57 24.43 18 TR_XM_DKIM_Undo 66557 14.25 36.07 4.24 19 HTML_FONT_LOW_CONTRAST 63560 28.53 34.45 25.82 20 DKIM_VALID_EF 62022 26.67 33.61 23.48 21 MIME_HTML_ONLY 61697 25.98 33.44 22.56 22 BAYES_99 61458 13.42 33.31 4.29 23 T_KAM_HTML_FONT_INVALID 54583 22.04 29.58 18.57 24 BAYES_999 47853 10.45 25.93 3.34 25 TR_DCC_Bayes_99 45373 8.78 24.59 1.52 26 DCC_CHECK_NEGATIVE 44779 52.37 24.27 65.27 27 RELAYCOUNTRY_META 41124 9.30 22.29 3.34 28 XM_Body_Dirty_Words 40330 13.62 21.86 9.85 29 XMSubLong 39820 21.87 21.58 22.01 30 T_TM2_M_HEADER_IN_MSG 37364 22.56 20.25 23.62 31 XM_Multi_Part_URI 36256 14.12 19.65 11.59 32 RCVD_IN_MSPIKE_WL 31295 16.07 16.96 15.66 33 TR_XM_SpammyRelay 28134 5.91 15.25 1.62 34 XM_B_Unsub 26952 10.08 14.61 8.01 35 TR_XM_BayesUnsub 26125 8.34 14.16 5.67 36 RCVD_IN_MSPIKE_H3 25999 11.05 14.09 9.66 37 BOTNET_IPINHOSTNAME 25749 7.49 13.95 4.53 38 UNPARSEABLE_RELAY 25660 10.06 13.91 8.30 39 TR_XM_SpammyWords2 23247 4.43 12.60 0.68 40 RCVD_IN_BL_SPAMCOP_NET 21839 4.18 11.84 0.66 41 XM_B_SpammyWords3 21546 6.50 11.68 4.12 42 MPART_ALT_DIFF 20211 10.16 10.95 9.79 43 LOTS_OF_MONEY 20133 7.01 10.91 5.22 44 XMSexyCombo_05 18820 5.22 10.20 2.94 45 RELAYCOUNTRY_CA 18339 3.85 9.94 1.06 46 FSL_BULK_SIG 18093 6.13 9.81 4.45 47 TR_XM_SpammyWords4 17665 5.36 9.57 3.43 48 TR_XM_SPAMCOP 17176 3.17 9.31 0.35 49 XM_Evil_Numbers_Gen 16911 9.22 9.16 9.24 50 BAYES_80 16772 5.75 9.09 4.22 51 BOTNET 16572 3.98 8.98 1.68 52 XM_UncommonTLD01 16384 4.94 8.88 3.13 53 TR_XM_UnparsRelay 16137 3.97 8.75 1.78 54 BAYES_60 15362 8.47 8.33 8.54 55 UNTRUSTED_Relay 14760 3.43 8.00 1.33 56 TM2_M_VERY_LONG_WORD 13738 3.24 7.45 1.31 57 MIME_HTML_ONLY_MULTI 13537 7.72 7.34 7.89 58 XM_SendGrid 12801 5.68 6.94 5.10 59 LotsOfNums_01 12763 8.36 6.92 9.02 60 HTML_IMAGE_RATIO_02 12117 5.99 6.57 5.72 61 TR_XM_PhishingBody 10736 4.07 5.82 3.26 62 XMSubMetaSx_00 10651 3.46 5.77 2.41 63 XM_H_Long_From01 9968 5.14 5.40 5.02 64 BAYES_95 9893 3.47 5.36 2.60 65 XM_B_Phish_Phrases 9863 4.31 5.35 3.84 66 HTML_MIME_NO_HTML_TAG 9708 2.89 5.26 1.80 67 MIME_HTML_MOSTLY 9172 3.14 4.97 2.29 68 HTML_IMAGE_RATIO_04 8725 12.87 4.73 16.61 69 XM_B_SpammyTLD 8697 3.04 4.71 2.27 70 XM_GoogleGroups 8621 2.24 4.67 1.12 71 XMLngstWrd_00 8527 1.88 4.62 0.63 72 XMLngstWrd_01 8464 1.83 4.59 0.56 73 TR_XM_DK_SendGrid 8455 3.89 4.58 3.58 74 XMLngstWrd_02 8243 1.72 4.47 0.45 75 TR_XM_SpammyWords5 8099 2.26 4.39 1.28 76 TooManyTo_001 7764 5.64 4.21 6.30 77 XMLngstWrd_03 7748 1.56 4.20 0.35 78 XMLngstWrd_04 7638 1.49 4.14 0.27 79 T_FILL_THIS_FORM_SHORT 7608 1.72 4.12 0.61 80 XM_DIRTYINTL 7546 1.45 4.09 0.24 81 HTML_TITLE_SUBJ_DIFF 7503 1.30 4.07 0.03 82 XM_SPF_SoftFail 7475 2.31 4.05 1.51 83 XM_B_Investor 7415 2.23 4.02 1.41 84 RCVD_IN_MSPIKE_BL 7375 1.65 4.00 0.57 85 UPPERCASE_75_100 7365 1.27 3.99 0.02 86 XMStrtUSub 7209 8.94 3.91 11.26 87 T_XMDrugObfuBody_08 7180 1.98 3.89 1.11 88 TR_XM_MSPIKECOMBO 7127 1.60 3.86 0.57 89 SpammyFromTLD_02 6931 1.42 3.76 0.34 90 RCVD_IN_VALIDITY_SAFE 6859 4.70 3.72 5.16 91 XMNumbers 6830 3.42 3.70 3.29 92 XMBody_17 6694 1.46 3.63 0.46 93 T_XMDrugObfuBody_14 6544 2.00 3.55 1.28 94 MIME_QP_LONG_LINE 6484 4.58 3.51 5.07 95 XM_OfRef6 6420 1.66 3.48 0.83 96 HTML_IMAGE_RATIO_06 6408 4.98 3.47 5.68 97 TM2_M_URI_OPT_OUT 6359 2.32 3.45 1.80 98 URI_NOVOWEL 6324 2.68 3.43 2.33 99 XM_UB50 6152 1.63 3.33 0.85 100 SpammyFromTLD_01 5957 1.46 3.23 0.65 101 RCVD_IN_VALIDITY_CERTIFIED 5829 4.19 3.16 4.67 102 USER_IN_DEF_DKIM_WL 5712 9.02 3.10 11.74 103 XM_B_Phish66 5673 1.94 3.07 1.42 104 TR_XM_SpammyWords3 5207 1.08 2.82 0.28 105 HTML_IMAGE_RATIO_08 5140 2.28 2.79 2.04 106 URIBL_DBL_SPAM 5136 0.88 2.78 0.01 107 FROM_EXCESS_BASE64 5095 2.76 2.76 2.75 108 DKIM_INVALID 4956 2.51 2.69 2.43 109 RCVD_IN_MSPIKE_H4 4686 4.24 2.54 5.02 110 SUBJ_ALL_CAPS 4587 1.87 2.49 1.58 111 TR_XM_FormFill 4565 0.80 2.47 0.03 112 XM_URI_RBL 4444 0.85 2.41 0.13 113 XM_DK_Undo_01 4439 1.68 2.41 1.34 114 XMDiploma_00 4436 1.44 2.40 0.99 115 XM_B_Unsub2 4371 1.57 2.37 1.20 116 T_XMHurry_00 4272 1.15 2.32 0.62 117 XM_CamelCaseFrm001 4246 1.86 2.30 1.66 118 XMSexyCombo_01 4223 0.92 2.29 0.29 119 HK_RANDOM_REPLYTO 4206 0.81 2.28 0.14 120 T_TooManySym_01 4159 5.30 2.25 6.70 121 RCVD_IN_VALIDITY_RPBL 3925 0.70 2.13 0.05 122 RCVD_IN_MSPIKE_L3 3892 0.97 2.11 0.45 123 MAILING_LIST_MULTI 3873 2.79 2.10 3.11 124 PDS_OTHER_BAD_TLD 3768 0.89 2.04 0.36 125 T_XMDrugObfuBody_00 3681 1.18 1.99 0.80 126 URI_PHP_REDIR 3563 0.61 1.93 0.01 127 FONT_INVIS_LONG_LINE 3506 0.64 1.90 0.06 128 T_REMOTE_IMAGE 3486 2.77 1.89 3.17 129 XM_B_SpammyWords4 3464 0.91 1.88 0.47 130 RCVD_IN_IADB_LISTED 3403 3.71 1.84 4.57 131 XM_H_Undi_Recip 3204 0.66 1.74 0.17 132 XMBdyGiftCard01 3093 1.31 1.68 1.14 133 RELAYCOUNTRY_IN 3066 0.58 1.66 0.08 134 TR_XM_NoHeaderRelay 3001 0.59 1.63 0.12 135 RCVD_IN_IADB_SPF 2984 3.33 1.62 4.11 136 TR_LOTS_OF_MONEY3 2968 0.71 1.61 0.29 137 XMSubMetaI_00 2936 1.01 1.59 0.74 138 RELAYCOUNTRY_AU 2899 0.66 1.57 0.25 139 TR_Mismatch_TLD_02 2869 0.54 1.55 0.07 140 XM_ProductURIs 2862 0.78 1.55 0.43 141 URI_HEX 2796 1.26 1.52 1.15 142 RCVD_IN_IADB_DK 2793 3.00 1.51 3.68 143 RCVD_IN_IADB_SENDERID 2778 3.04 1.51 3.75 144 TR_XM_BayesRelay 2768 0.47 1.50 0.00 145 RCVD_IN_MSPIKE_L5 2767 0.49 1.50 0.03 146 XM_B_COVIDMETA 2757 0.80 1.49 0.48 147 XMStockSpam_06 2714 1.32 1.47 1.25 148 XM_B_DNDMA 2634 0.75 1.43 0.44 149 TR_XM_SB_Phish 2605 1.55 1.41 1.61 150 TR_XM_Undi_Recip11 2590 0.46 1.40 0.03 151 XM_UB99 2561 0.44 1.39 0.01 152 XM_Body_Dirty_Words_01 2516 0.90 1.36 0.68 153 TR_XM_Base64_M1 2512 1.17 1.36 1.09 154 XMPhish30 2502 1.07 1.36 0.94 155 BOTNET_NORDNS 2500 0.43 1.35 0.01 156 FROM_SUSPICIOUS_NTLD 2441 0.44 1.32 0.04 157 XMSubPhish11 2416 1.50 1.31 1.59 158 TR_XM_PHPDW 2414 0.71 1.31 0.43 159 BAYES_40 2402 3.92 1.30 5.12 160 XM_HighProb1 2353 0.40 1.28 0.00 161 XMSubMetaSxObfu_03 2319 0.63 1.26 0.35 162 TR_XM_PHPForged 2306 0.67 1.25 0.40 163 XMGenDplmaNmb 2280 0.76 1.24 0.54 164 TR_XM_FormFill2 2267 0.66 1.23 0.39 165 XM_H_PHPOS 2256 0.65 1.22 0.39 166 LongTLD 2255 0.55 1.22 0.25 167 ALL_TRUSTED 2237 10.39 1.21 14.60 168 HTTPS_HTTP_MISMATCH 2222 0.76 1.20 0.55 169 TR_Caps_n_Bayes_99 2179 0.42 1.18 0.07 170 XM_UB60 2178 0.43 1.18 0.08 171 THIS_AD 2177 0.63 1.18 0.38 172 KHOP_HELO_FCRDNS 2169 1.03 1.18 0.96 173 UNDISC_MONEY 2157 0.37 1.17 0.00 174 URIBL_BLACK 2154 0.43 1.17 0.09 175 TR_Mismatch_TLD_01 2153 0.50 1.17 0.20 176 TR_XM_Undi_RecipCombo2 2109 0.36 1.14 0.00 177 RCVD_IN_PSBL 2101 0.65 1.14 0.42 178 TR_XM_MSPIKECOMBO2 2097 0.39 1.14 0.04 179 FROM_SUSPICIOUS_NTLD_FP 2082 0.38 1.13 0.04 180 TR_Sbj_FN_Bdy 2078 0.42 1.13 0.10 181 XMHTML_After_End 2046 0.96 1.11 0.89 182 RELAYCOUNTRY_DE 2014 0.54 1.09 0.29 183 TR_XM_InvalidRelay 1965 0.35 1.06 0.02 184 MPART_ALT_DIFF_COUNT 1956 0.71 1.06 0.54 185 URI_TRY_3LD 1954 0.71 1.06 0.55 186 XMBrknScrpt_02 1954 0.89 1.06 0.82 187 XMClaimOffer 1892 0.38 1.03 0.08 188 DEAR_BENEFICIARY 1886 0.32 1.02 0.00 189 SHOPIFY_IMG_NOT_RCVD_SFY 1883 0.47 1.02 0.21 190 XM_UB80 1877 0.33 1.02 0.02 191 TR_Symld_Words 1848 1.13 1.00 1.19 192 TR_XM_Base64_L1 1788 0.47 0.97 0.23 193 XMSexyCombo_04 1746 0.34 0.95 0.06 194 HTML_TAG_BALANCE_BODY 1744 0.74 0.95 0.65 195 XM_UB999 1725 0.30 0.93 0.00 196 RELAYCOUNTRY_FR 1711 0.45 0.93 0.24 197 TR_XM_Spammywords 1676 0.57 0.91 0.41 198 XM_S_SpammyWords 1676 0.57 0.91 0.41 199 BAYES_20 1672 3.86 0.91 5.21 200 XM_Combo_Sbj 1657 0.43 0.90 0.22 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 356267 90.64 95.01 88.63 2 RELAYCOUNTRY_US 332178 81.86 80.18 82.64 3 XM_B_Unicode 298957 76.38 80.76 74.37 4 DKIM_SIGNED 268701 74.69 91.77 66.85 5 DCC_CHECK_NEGATIVE 262364 52.37 24.27 65.27 6 XM_DK_Pass 262299 73.04 90.00 65.25 7 DKIM_VALID 258936 72.18 89.09 64.42 8 BAYES_50 213676 49.10 40.28 53.16 9 DKIM_VALID_AU 205890 56.43 67.77 51.22 10 XMListUnsubscribeExists 187535 55.33 74.22 46.65 11 XM_B_Unicode3 184934 45.50 44.41 46.01 12 XM_B_SpammyWords 179615 52.36 69.07 44.68 13 RCVD_IN_MSPIKE_H2 140057 39.06 48.26 34.84 14 DCC_CHECK 139490 47.60 75.71 34.70 15 HTML_FONT_LOW_CONTRAST 103783 28.53 34.45 25.82 16 FVGT_m_MULTI_ODD 98209 28.57 37.57 24.43 17 T_TM2_M_HEADER_IN_MSG 94934 22.56 20.25 23.62 18 DKIM_VALID_EF 94385 26.67 33.61 23.48 19 LOC_TINY_FONT_1 92714 27.88 38.37 23.06 20 MIME_HTML_ONLY 90688 25.98 33.44 22.56 21 XMSubLong 88474 21.87 21.58 22.01 22 T_KAM_HTML_FONT_INVALID 74662 22.04 29.58 18.57 23 XM_B_SpammyWords2 69978 24.60 40.27 17.41 24 HTML_IMAGE_RATIO_04 66783 12.87 4.73 16.61 25 RCVD_IN_MSPIKE_WL 62964 16.07 16.96 15.66 26 HTML_FONT_FACE_BAD 61394 10.65 0.57 15.27 27 ALL_TRUSTED 58675 10.39 1.21 14.60 28 XM_H_Trusted_IP 55984 9.55 0.00 13.93 29 BAYES_00 53256 9.36 0.89 13.25 30 USER_IN_DEF_DKIM_WL 47182 9.02 3.10 11.74 31 XM_Multi_Part_URI 46577 14.12 19.65 11.59 32 XMStrtUSub 45246 8.94 3.91 11.26 33 XM_Body_Dirty_Words 39580 13.62 21.86 9.85 34 MPART_ALT_DIFF 39354 10.16 10.95 9.79 35 RCVD_IN_MSPIKE_H3 38820 11.05 14.09 9.66 36 XM_Evil_Numbers_Gen 37158 9.22 9.16 9.24 37 LotsOfNums_01 36275 8.36 6.92 9.02 38 BAYES_60 34330 8.47 8.33 8.54 39 UNPARSEABLE_RELAY 33363 10.06 13.91 8.30 40 XM_B_Unsub 32183 10.08 14.61 8.01 41 MIME_HTML_ONLY_MULTI 31736 7.72 7.34 7.89 42 XM_DKIMWhitelistDomains 31192 5.34 0.07 7.76 43 T_TooManySym_01 26939 5.30 2.25 6.70 44 TooManyTo_001 25305 5.64 4.21 6.30 45 XM_DK_Undo_02 25295 18.69 45.69 6.29 46 TR_XM_DK_Bayes 23240 4.18 0.68 5.78 47 IN_ZIMBRA_NJ_WHITELIST 23162 3.97 0.07 5.76 48 HTML_IMAGE_RATIO_02 22986 5.99 6.57 5.72 49 HTML_IMAGE_RATIO_06 22819 4.98 3.47 5.68 50 TR_XM_BayesUnsub 22797 8.34 14.16 5.67 51 TR_XM_DK_Bayes1 22221 4.00 0.68 5.53 52 LOTS_OF_MONEY 20996 7.01 10.91 5.22 53 BAYES_20 20961 3.86 0.91 5.21 54 RCVD_IN_VALIDITY_SAFE 20735 4.70 3.72 5.16 55 BAYES_40 20581 3.92 1.30 5.12 56 XM_SendGrid 20517 5.68 6.94 5.10 57 MIME_QP_LONG_LINE 20378 4.58 3.51 5.07 58 XM_H_Long_From01 20177 5.14 5.40 5.02 59 RCVD_IN_MSPIKE_H4 20167 4.24 2.54 5.02 60 TR_XM_DK_Bayes2 19948 3.58 0.58 4.96 61 RCVD_IN_VALIDITY_CERTIFIED 18765 4.19 3.16 4.67 62 XMSubNoVowel 18458 3.39 0.78 4.59 63 RCVD_IN_IADB_LISTED 18354 3.71 1.84 4.57 64 BOTNET_IPINHOSTNAME 18202 7.49 13.95 4.53 65 FSL_BULK_SIG 17877 6.13 9.81 4.45 66 BAYES_99 17226 13.42 33.31 4.29 67 TR_XM_DKIM_Undo 17039 14.25 36.07 4.24 68 BAYES_80 16951 5.75 9.09 4.22 69 XM_B_SpammyWords3 16581 6.50 11.68 4.12 70 RCVD_IN_IADB_SPF 16529 3.33 1.62 4.11 71 T_TooManySym_02 15838 2.89 0.59 3.94 72 XM_B_Phish_Phrases 15425 4.31 5.35 3.84 73 XM_PDF 15243 2.76 0.51 3.79 74 RCVD_IN_IADB_SENDERID 15071 3.04 1.51 3.75 75 RCVD_IN_IADB_DK 14802 3.00 1.51 3.68 76 BAYES_05 14536 2.65 0.54 3.62 77 TR_XM_DK_SendGrid 14375 3.89 4.58 3.58 78 TR_XM_SpammyWords4 13774 5.36 9.57 3.43 79 RELAYCOUNTRY_META 13439 9.30 22.29 3.34 80 BAYES_999 13433 10.45 25.93 3.34 81 XMNumbers 13235 3.42 3.70 3.29 82 TR_XM_PhishingBody 13122 4.07 5.82 3.26 83 T_REMOTE_IMAGE 12732 2.77 1.89 3.17 84 XM_UncommonTLD01 12569 4.94 8.88 3.13 85 MAILING_LIST_MULTI 12509 2.79 2.10 3.11 86 XMSexyCombo_05 11814 5.22 10.20 2.94 87 ANY_BOUNCE_MESSAGE 11099 2.11 0.70 2.76 88 BOUNCE_MESSAGE 11097 2.11 0.70 2.76 89 FROM_EXCESS_BASE64 11072 2.76 2.76 2.75 90 RCVD_IN_IADB_VOUCHED 10594 2.07 0.85 2.64 91 BAYES_95 10458 3.47 5.36 2.60 92 DKIM_INVALID 9765 2.51 2.69 2.43 93 XMSubMetaSx_00 9671 3.46 5.77 2.41 94 URI_NOVOWEL 9373 2.68 3.43 2.33 95 MIME_HTML_MOSTLY 9217 3.14 4.97 2.29 96 XM_B_SpammyTLD 9116 3.04 4.71 2.27 97 HTML_IMAGE_RATIO_08 8206 2.28 2.79 2.04 98 XMSubLongNoVowel 8084 1.42 0.13 2.01 99 XMSubGarbage 7917 1.37 0.05 1.97 100 TM2_M_URI_OPT_OUT 7235 2.32 3.45 1.80 101 HTML_MIME_NO_HTML_TAG 7220 2.89 5.26 1.80 102 TR_XM_UnparsRelay 7136 3.97 8.75 1.78 103 INVALID_MSGID 6880 1.23 0.17 1.71 104 RCVD_IN_IADB_OPTIN 6832 1.32 0.48 1.70 105 BOTNET 6744 3.98 8.98 1.68 106 XM_CamelCaseFrm001 6660 1.86 2.30 1.66 107 TR_XM_SpammyRelay 6506 5.91 15.25 1.62 108 TR_XM_SB_Phish 6465 1.55 1.41 1.61 109 T_TooManySym_03 6440 1.17 0.23 1.60 110 MSGID_NOFQDN1 6407 1.11 0.06 1.59 111 XMSubPhish11 6382 1.50 1.31 1.59 112 SUBJ_ALL_CAPS 6362 1.87 2.49 1.58 113 TVD_RCVD_IP 6292 1.19 0.37 1.57 114 TooManyTo_002 6226 1.24 0.57 1.55 115 IN_HORDE_ADDRESS_BOOK 6138 1.08 0.10 1.53 116 TR_DCC_Bayes_99 6116 8.78 24.59 1.52 117 XM_SPF_SoftFail 6080 2.31 4.05 1.51 118 TO_MALFORMED 5963 1.03 0.04 1.48 119 XM_B_Phish66 5696 1.94 3.07 1.42 120 XM_B_Investor 5667 2.23 4.02 1.41 121 XMNoVowels 5664 1.09 0.38 1.41 122 XM_DK_Undo_01 5394 1.68 2.41 1.34 123 UNTRUSTED_Relay 5351 3.43 8.00 1.33 124 TM2_M_VERY_LONG_WORD 5261 3.24 7.45 1.31 125 T_XMDrugObfuBody_14 5160 2.00 3.55 1.28 126 TR_XM_SpammyWords5 5134 2.26 4.39 1.28 127 TVD_SPACE_RATIO 5093 0.91 0.14 1.27 128 XMStockSpam_06 5007 1.32 1.47 1.25 129 XM_B_Unsub2 4843 1.57 2.37 1.20 130 TR_Symld_Words 4774 1.13 1.00 1.19 131 URI_HEX 4616 1.26 1.52 1.15 132 XMBdyGiftCard01 4600 1.31 1.68 1.14 133 XM_E_Blogspot 4527 0.80 0.09 1.13 134 XM_GoogleGroups 4500 2.24 4.67 1.12 135 T_XMDrugObfuBody_08 4460 1.98 3.89 1.11 136 XMGappySubj_01 4427 0.81 0.17 1.10 137 TR_XM_Base64_M1 4366 1.17 1.36 1.09 138 HELO_NODOT 4263 0.87 0.46 1.06 139 HELO_NO_DOMAIN 4258 0.87 0.46 1.06 140 RELAYCOUNTRY_CA 4243 3.85 9.94 1.06 141 TooManyTo_003 4178 0.86 0.49 1.04 142 RCVD_IN_RP_SAFE 4161 0.96 0.80 1.04 143 XMBSHREFv2 4106 0.76 0.19 1.02 144 XMDiploma_00 3983 1.44 2.40 0.99 145 RCVD_IN_MSPIKE_H5 3977 0.78 0.33 0.99 146 KHOP_HELO_FCRDNS 3858 1.03 1.18 0.96 147 XMBody_95 3832 0.72 0.20 0.95 148 RCVD_IN_RP_CERTIFIED 3817 0.86 0.66 0.95 149 XMPhish30 3794 1.07 1.36 0.94 150 XM_H_Long_From02 3725 0.89 0.80 0.93 151 XMHTML_After_End 3570 0.96 1.11 0.89 152 DKIM_ADSP_CUSTOM_MED 3558 0.78 0.54 0.89 153 XM_UB50 3422 1.63 3.33 0.85 154 XM_OfRef6 3322 1.66 3.48 0.83 155 XMBrknScrpt_02 3288 0.89 1.06 0.82 156 T_XMDrugObfuBody_00 3222 1.18 1.99 0.80 157 TooManyTo_004 3050 0.66 0.44 0.76 158 XMCapTrack 3011 0.61 0.31 0.75 159 FVGT_m_MULTI_ODD_EMAIL 3001 0.55 0.14 0.75 160 XMSubMetaI_00 2988 1.01 1.59 0.74 161 TR_XM_SpammyWords2 2746 4.43 12.60 0.68 162 XM_Body_Dirty_Words_01 2746 0.90 1.36 0.68 163 FROM_GOV_DKIM_AU 2694 0.60 0.44 0.67 164 RCVD_IN_BL_SPAMCOP_NET 2666 4.18 11.84 0.66 165 SpammyFromTLD_01 2630 1.46 3.23 0.65 166 XM_B_COPY_HTML 2624 0.67 0.71 0.65 167 HTML_TAG_BALANCE_BODY 2597 0.74 0.95 0.65 168 XMLngstWrd_00 2528 1.88 4.62 0.63 169 FORGED_GMAIL_RCVD 2501 0.56 0.44 0.62 170 TooManyTo_005 2481 0.55 0.42 0.62 171 T_XMHurry_00 2476 1.15 2.32 0.62 172 T_FILL_THIS_FORM_SHORT 2456 1.72 4.12 0.61 173 T_OBFU_PDF_ATTACH 2379 0.44 0.12 0.59 174 NML_ADSP_CUSTOM_MED 2350 0.52 0.38 0.58 175 XM_RXBody 2340 0.51 0.34 0.58 176 XM_ShortIntro_01 2327 0.56 0.52 0.58 177 RCVD_IN_MSPIKE_BL 2310 1.65 4.00 0.57 178 TR_XM_MSPIKECOMBO 2283 1.60 3.86 0.57 179 XMLngstWrd_01 2245 1.83 4.59 0.56 180 HTTPS_HTTP_MISMATCH 2219 0.76 1.20 0.55 181 URI_TRY_3LD 2191 0.71 1.06 0.55 182 TR_MetaPhish_Combo_01 2184 0.65 0.88 0.54 183 MPART_ALT_DIFF_COUNT 2183 0.71 1.06 0.54 184 XMGenDplmaNmb 2166 0.76 1.24 0.54 185 XMPhish14 2098 0.58 0.69 0.52 186 MISSING_HEADERS 2021 0.41 0.20 0.50 187 XM_B_REG_HTML 1971 0.60 0.83 0.49 188 XM_B_COVIDMETA 1936 0.80 1.49 0.48 189 XM_H_PHPMailer 1904 0.54 0.69 0.47 190 PLING_QUERY 1900 0.58 0.81 0.47 191 XM_B_SpammyWords4 1896 0.91 1.88 0.47 192 XMBody_17 1845 1.46 3.63 0.46 193 XMLngstWrd_02 1818 1.72 4.47 0.45 194 RCVD_IN_MSPIKE_L3 1804 0.97 2.11 0.45 195 RELAYCOUNTRY_GB 1793 0.49 0.58 0.45 196 XM_B_DNDMA 1786 0.75 1.43 0.44 197 TR_XM_PHPDW 1739 0.71 1.31 0.43 198 XM_ProductURIs 1724 0.78 1.55 0.43 199 T_TooManySym_04 1706 0.33 0.12 0.42 200 RCVD_IN_PSBL 1702 0.65 1.14 0.42 ----------------------------------------------------------------------