Email: 369790 Autolearn: 0 AvgScore: 4.74 AvgScanTime: 1.21 sec Spam: 132246 Autolearn: 0 AvgScore: 13.84 AvgScanTime: 1.24 sec Ham: 237544 Autolearn: 0 AvgScore: -0.33 AvgScanTime: 1.20 sec Time Spent Running SA: 124.70 hours Time Spent Processing Spam: 45.44 hours Time Spent Processing Ham: 79.27 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125285 87.34 94.74 83.21 2 DKIM_SIGNED 113535 80.35 85.85 77.29 3 XM_B_Unicode 111968 76.86 84.67 72.51 4 XM_DK_Pass 109610 78.50 82.88 76.05 5 DKIM_VALID 108365 77.78 81.94 75.47 6 T_SCC_BODY_TEXT_LINE 107183 82.43 81.05 83.20 7 DCC_CHECK 97520 52.01 73.74 39.91 8 RELAYCOUNTRY_US 97314 77.70 73.59 79.98 9 XMListUnsubscribeExists 92505 61.60 69.95 56.96 10 XM_B_SpammyWords 90028 52.03 68.08 43.10 11 DKIM_VALID_AU 79138 61.95 59.84 63.12 12 XM_DK_Undo_02 62283 21.31 47.10 6.96 13 XM_B_Unicode3 59871 45.62 45.27 45.81 14 LOC_TINY_FONT_1 51600 32.67 39.02 29.14 15 XM_B_SpammyWords2 51232 26.52 38.74 19.71 16 BAYES_99 50280 17.62 38.02 6.26 17 HTML_FONT_LOW_CONTRAST 49078 34.85 37.11 33.60 18 TR_XM_DKIM_Undo 48340 14.67 36.55 2.49 19 BAYES_50 47571 50.65 35.97 58.82 20 MIME_HTML_ONLY 45665 26.31 34.53 21.74 21 FVGT_m_MULTI_ODD 42008 28.79 31.77 27.13 22 BAYES_999 40359 14.14 30.52 5.02 23 DKIM_VALID_EF 40237 29.84 30.43 29.51 24 TR_DCC_Bayes_99 35842 11.13 27.10 2.24 25 DCC_CHECK_NEGATIVE 34712 47.97 26.25 60.07 26 T_KAM_HTML_FONT_INVALID 33722 22.80 25.50 21.30 27 RCVD_IN_MSPIKE_H2 31327 23.51 23.69 23.41 28 RELAYCOUNTRY_META 31198 11.30 23.59 4.46 29 TR_XM_DK_Unsub 30676 18.77 23.20 16.31 30 T_TM2_M_HEADER_IN_MSG 28059 22.04 21.22 22.50 31 XMSubLong 25835 21.18 19.54 22.10 32 XM_Multi_Part_URI 24624 17.20 18.62 16.41 33 TR_XM_SpammyRelay 23163 7.60 17.52 2.08 34 UNPARSEABLE_RELAY 20563 13.23 15.55 11.93 35 RCVD_IN_BL_SPAMCOP_NET 20342 5.93 15.38 0.67 36 XM_B_Unsub 18850 10.05 14.25 7.72 37 TR_XM_SpammyWords2 18473 5.27 13.97 0.43 38 TR_XM_BayesUnsub 18249 9.11 13.80 6.50 39 BOTNET_IPINHOSTNAME 18193 8.13 13.76 4.99 40 RELAYCOUNTRY_CA 17676 5.60 13.37 1.27 41 TR_XM_SPAMCOP 16677 4.71 12.61 0.31 42 XM_Body_Dirty_Words 16195 8.52 12.25 6.44 43 LOTS_OF_MONEY 15615 7.85 11.81 5.65 44 RCVD_IN_MSPIKE_WL 15374 8.27 11.63 6.41 45 RCVD_IN_MSPIKE_H3 15374 8.27 11.63 6.41 46 XM_B_SpammyWords3 15148 6.76 11.45 4.14 47 FSL_BULK_SIG 14259 6.11 10.78 3.51 48 BOTNET 13269 4.26 10.03 1.05 49 TR_XM_SpammyWords4 12654 5.97 9.57 3.96 50 TR_XM_UnparsRelay 12193 4.75 9.22 2.26 51 HTML_IMAGE_RATIO_04 11830 7.34 8.95 6.44 52 XM_Evil_Numbers_Gen 11691 9.53 8.84 9.92 53 BAYES_80 11564 6.18 8.74 4.76 54 BAYES_60 11135 10.00 8.42 10.89 55 HTML_IMAGE_RATIO_02 10542 6.82 7.97 6.18 56 UNTRUSTED_Relay 10030 3.99 7.58 1.99 57 XM_UncommonTLD01 9449 5.22 7.15 4.14 58 XMSexyCombo_05 8481 3.95 6.41 2.58 59 TR_XM_SpammyWords5 8353 3.47 6.32 1.88 60 XMBody_17 8339 2.81 6.31 0.87 61 XMStrtUSub 8319 5.88 6.29 5.65 62 MPART_ALT_DIFF 7650 5.41 5.78 5.20 63 LotsOfNums_01 7041 7.66 5.32 8.95 64 BAYES_95 6997 3.83 5.29 3.02 65 T_FILL_THIS_FORM_SHORT 6988 2.18 5.28 0.46 66 MIME_HTML_MOSTLY 6961 3.74 5.26 2.89 67 TR_XM_BayesRelay 6854 1.85 5.18 0.00 68 XMNumbers 6401 4.14 4.84 3.75 69 XM_UB50 6397 2.44 4.84 1.10 70 TooManyTo_001 6387 6.31 4.83 7.14 71 XM_SPF_SoftFail 6088 3.13 4.60 2.31 72 HTML_IMAGE_RATIO_06 6063 3.50 4.58 2.90 73 XM_H_Long_From01 5534 4.87 4.18 5.25 74 SUBJ_ALL_CAPS 5494 2.76 4.15 1.98 75 XMSubMetaSx_00 5493 3.61 4.15 3.31 76 XM_B_SpammyTLD 5449 3.34 4.12 2.91 77 TR_XM_PhishingBody 5418 2.87 4.10 2.19 78 XM_H_GMP 5356 5.91 4.05 6.95 79 SpammyFromTLD_01 5338 1.76 4.04 0.49 80 DKIM_INVALID 5170 2.57 3.91 1.82 81 ALL_TRUSTED 5036 11.84 3.81 16.31 82 XM_B_Phish_Phrases 4987 3.33 3.77 3.09 83 XM_OfRef6 4948 1.94 3.74 0.94 84 HK_RANDOM_REPLYTO 4648 1.31 3.51 0.09 85 XM_B_Investor 4597 2.04 3.48 1.25 86 FROM_EXCESS_BASE64 4585 3.19 3.47 3.04 87 TR_Mismatch_TLD_02 4568 1.32 3.45 0.14 88 RCVD_IN_PSBL 4488 1.47 3.39 0.40 89 TM2_M_URI_OPT_OUT 4475 2.63 3.38 2.21 90 TR_XM_FormFill 4290 1.17 3.24 0.02 91 HTML_IMAGE_RATIO_08 4260 2.72 3.22 2.43 92 RCVD_IN_VALIDITY_SAFE 4093 5.21 3.09 6.38 93 T_XMDrugObfuBody_14 3927 2.07 2.97 1.57 94 TR_LOTS_OF_MONEY3 3878 1.28 2.93 0.37 95 T_TooManySym_01 3789 5.90 2.87 7.59 96 XM_DIRTYINTL 3708 1.14 2.80 0.21 97 MIME_HTML_ONLY_MULTI 3587 2.48 2.71 2.36 98 TM2_M_VERY_LONG_WORD 3497 1.84 2.64 1.39 99 USER_IN_DEF_DKIM_WL 3366 11.06 2.55 15.81 100 T_XMDrugObfuBody_08 3257 1.73 2.46 1.32 101 XM_URI_RBL 3212 0.97 2.43 0.15 102 XM_CamelCaseFrm001 3195 2.29 2.42 2.23 103 AC_BR_BONANZA 3127 0.94 2.36 0.14 104 T_XMHurry_00 3036 1.75 2.30 1.45 105 RCVD_IN_VALIDITY_CERTIFIED 2979 4.33 2.25 5.48 106 FONT_INVIS_LONG_LINE 2972 0.83 2.25 0.04 107 REPTO_INFONUMSCOM 2929 0.79 2.21 0.00 108 TR_MetaPhish_Combo_01 2892 1.17 2.19 0.61 109 TR_XM_NoHeaderRelay 2793 0.83 2.11 0.12 110 XMSubMetaI_00 2676 1.47 2.02 1.16 111 XM_B_Unsub2 2620 1.26 1.98 0.86 112 XMBrknScrpt_02 2595 1.05 1.96 0.55 113 TR_XM_PHPForged 2529 1.01 1.91 0.51 114 TR_XM_PHPDW 2526 1.02 1.91 0.52 115 BOTNET_NORDNS 2487 0.68 1.88 0.01 116 RELAYCOUNTRY_AU 2483 0.95 1.88 0.43 117 TR_XM_FormFill2 2444 0.99 1.85 0.51 118 XM_H_PHPOS 2407 0.96 1.82 0.48 119 MIME_QP_LONG_LINE 2402 3.51 1.82 4.46 120 HTML_TAG_BALANCE_BODY 2182 0.83 1.65 0.38 121 T_REMOTE_IMAGE 2110 2.28 1.60 2.67 122 SHOPIFY_IMG_NOT_RCVD_SFY 2056 0.84 1.55 0.44 123 XMDiploma_00 2045 1.26 1.55 1.10 124 RELAYCOUNTRY_DE 2045 0.82 1.55 0.41 125 XMStockSpam_06 2032 2.01 1.54 2.27 126 XM_H_Long_From02 2032 1.07 1.54 0.81 127 BAYES_40 2019 2.99 1.53 3.80 128 TR_XM_INV_DKIM 2014 0.59 1.52 0.07 129 URI_HEX 2006 1.25 1.52 1.10 130 XM_SendGrid 1996 1.45 1.51 1.42 131 URI_TRY_3LD 1991 0.87 1.51 0.52 132 XM_HighProb1 1977 0.54 1.49 0.00 133 XMReplyNow 1975 0.67 1.49 0.22 134 THIS_AD 1959 0.91 1.48 0.60 135 MPART_ALT_DIFF_COUNT 1937 1.04 1.46 0.81 136 DATE_IN_PAST_03_06 1928 0.71 1.46 0.29 137 XM_B_SpammyWords4 1919 1.03 1.45 0.80 138 MAILING_LIST_MULTI 1904 2.55 1.44 3.17 139 XMBody_29 1857 0.58 1.40 0.12 140 TO_NO_BRKTS_FROM_MSSP 1806 0.53 1.37 0.06 141 SpammyFromTLD_02 1787 0.64 1.35 0.25 142 HTML_MIME_NO_HTML_TAG 1785 1.30 1.35 1.27 143 XM_BadFromFormat 1756 0.57 1.33 0.15 144 T_XMDrugObfuBody_10 1753 0.49 1.33 0.02 145 TR_Caps_n_Bayes_99 1747 0.51 1.32 0.06 146 XMPhish30 1742 0.93 1.32 0.71 147 TR_Symld_Words 1727 1.70 1.31 1.92 148 BOUNCE_MESSAGE 1716 3.69 1.30 5.02 149 ANY_BOUNCE_MESSAGE 1716 3.69 1.30 5.02 150 TR_XM_SB_Phish 1714 0.63 1.30 0.26 151 T_XMDrugObfuBody_00 1714 0.91 1.30 0.70 152 XMSubPhish11 1661 0.60 1.26 0.24 153 LOW_PRICE 1645 0.56 1.24 0.17 154 XMPhish11 1638 0.67 1.24 0.35 155 T_TooManySym_02 1615 3.31 1.22 4.47 156 XM_DK_Undo_01 1587 1.50 1.20 1.67 157 HTTPS_HTTP_MISMATCH 1583 0.88 1.20 0.70 158 XM_H_PHPMailer 1541 0.91 1.17 0.78 159 XM_H_Undi_Recip 1537 0.57 1.16 0.24 160 RCVD_IN_VALIDITY_RPBL 1527 0.44 1.15 0.05 161 XMClaimOffer 1511 0.54 1.14 0.21 162 HOSTED_IMG_MULTI_PUB_01 1497 0.41 1.13 0.01 163 BAYES_20 1488 2.08 1.13 2.60 164 KHOP_HELO_FCRDNS 1484 0.81 1.12 0.63 165 HOSTED_IMG_DIRECT_MX 1479 0.40 1.12 0.00 166 XMBdyGiftCard01 1441 1.05 1.09 1.03 167 TR_XM_Base64_M1 1436 0.83 1.09 0.69 168 TR_XM_InvalidRelay 1401 0.40 1.06 0.03 169 TR_XM_DK_SendGrid 1398 1.00 1.06 0.97 170 URI_NOVOWEL 1397 1.19 1.06 1.27 171 XM_ProductURIs 1391 0.89 1.05 0.80 172 PDS_OTHER_BAD_TLD 1336 0.45 1.01 0.14 173 XM_B_COPY_HTML 1335 0.81 1.01 0.71 174 TM2_M_BODY_EMPTY 1296 0.49 0.98 0.22 175 RCVD_IN_IADB_LISTED 1296 2.89 0.98 3.96 176 XMEmptyBody_01 1252 0.36 0.95 0.04 177 RDNS_DYNAMIC 1222 0.54 0.92 0.32 178 XMSexyCombo_01 1210 0.46 0.91 0.21 179 T_TooManySym_03 1198 1.70 0.91 2.14 180 RCVD_IN_IADB_SPF 1178 2.67 0.89 3.66 181 DIET_1 1169 0.53 0.88 0.34 182 RCVD_IN_IADB_DK 1127 2.45 0.85 3.34 183 XM_Combo_Sbj 1117 0.44 0.84 0.21 184 RCVD_IN_IADB_SENDERID 1116 2.50 0.84 3.42 185 RELAYCOUNTRY_NL 1116 0.56 0.84 0.40 186 XM_UB99 1081 0.30 0.82 0.00 187 TVD_RCVD_IP 1075 1.63 0.81 2.08 188 XM_B_DNDMA 1064 0.53 0.80 0.37 189 TM2_M_OBFU_COMMENT 1023 0.42 0.77 0.23 190 XMLngstWrd_00 1016 0.75 0.77 0.74 191 RELAYCOUNTRY_GB 1016 0.61 0.77 0.52 192 NO_DNS_FOR_FROM 1011 0.47 0.76 0.30 193 TR_Mismatch_TLD_01 1001 0.42 0.76 0.24 194 HELO_DYNAMIC_SPLIT_IP 989 0.27 0.75 0.01 195 TR_XM_Base64_L1 971 0.49 0.73 0.36 196 DATE_IN_PAST_06_12 958 0.45 0.72 0.29 197 HTML_FONT_FACE_BAD 954 0.62 0.72 0.56 198 XM_UB60 937 0.30 0.71 0.08 199 XMHTML_After_End 936 0.68 0.71 0.66 200 BASE64_LENGTH_79_INF 924 1.08 0.70 1.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 197672 87.34 94.74 83.21 2 T_SCC_BODY_TEXT_LINE 197643 82.43 81.05 83.20 3 RELAYCOUNTRY_US 189995 77.70 73.59 79.98 4 DKIM_SIGNED 183598 80.35 85.85 77.29 5 XM_DK_Pass 180659 78.50 82.88 76.05 6 DKIM_VALID 179266 77.78 81.94 75.47 7 XM_B_Unicode 172244 76.86 84.67 72.51 8 DKIM_VALID_AU 149935 61.95 59.84 63.12 9 DCC_CHECK_NEGATIVE 142687 47.97 26.25 60.07 10 BAYES_50 139715 50.65 35.97 58.82 11 XMListUnsubscribeExists 135303 61.60 69.95 56.96 12 XM_B_Unicode3 108810 45.62 45.27 45.81 13 XM_B_SpammyWords 102386 52.03 68.08 43.10 14 DCC_CHECK 94813 52.01 73.74 39.91 15 HTML_FONT_LOW_CONTRAST 79809 34.85 37.11 33.60 16 DKIM_VALID_EF 70096 29.84 30.43 29.51 17 LOC_TINY_FONT_1 69215 32.67 39.02 29.14 18 FVGT_m_MULTI_ODD 64445 28.79 31.77 27.13 19 RCVD_IN_MSPIKE_H2 55609 23.51 23.69 23.41 20 T_TM2_M_HEADER_IN_MSG 53437 22.04 21.22 22.50 21 XMSubLong 52491 21.18 19.54 22.10 22 MIME_HTML_ONLY 51636 26.31 34.53 21.74 23 T_KAM_HTML_FONT_INVALID 50598 22.80 25.50 21.30 24 XM_B_SpammyWords2 46820 26.52 38.74 19.71 25 XM_Multi_Part_URI 38984 17.20 18.62 16.41 26 TR_XM_DK_Unsub 38742 18.77 23.20 16.31 27 ALL_TRUSTED 38732 11.84 3.81 16.31 28 USER_IN_DEF_DKIM_WL 37544 11.06 2.55 15.81 29 UNPARSEABLE_RELAY 28344 13.23 15.55 11.93 30 BAYES_60 25858 10.00 8.42 10.89 31 XM_DKIMWhitelistDomains 25290 6.91 0.19 10.65 32 XM_Evil_Numbers_Gen 23562 9.53 8.84 9.92 33 LotsOfNums_01 21269 7.66 5.32 8.95 34 XM_B_Unsub 18331 10.05 14.25 7.72 35 T_TooManySym_01 18027 5.90 2.87 7.59 36 BAYES_00 17401 4.85 0.40 7.33 37 TooManyTo_001 16954 6.31 4.83 7.14 38 XM_DK_Undo_02 16530 21.31 47.10 6.96 39 XM_H_GMP 16507 5.91 4.05 6.95 40 TR_XM_BayesUnsub 15447 9.11 13.80 6.50 41 XM_Body_Dirty_Words 15307 8.52 12.25 6.44 42 HTML_IMAGE_RATIO_04 15300 7.34 8.95 6.44 43 RCVD_IN_MSPIKE_WL 15221 8.27 11.63 6.41 44 RCVD_IN_MSPIKE_H3 15221 8.27 11.63 6.41 45 RCVD_IN_VALIDITY_SAFE 15161 5.21 3.09 6.38 46 BAYES_99 14881 17.62 38.02 6.26 47 HTML_IMAGE_RATIO_02 14677 6.82 7.97 6.18 48 TR_XM_DK_Bayes 13983 3.89 0.29 5.89 49 TR_XM_DK_Bayes1 13891 3.86 0.29 5.85 50 XMStrtUSub 13412 5.88 6.29 5.65 51 LOTS_OF_MONEY 13412 7.85 11.81 5.65 52 RCVD_IN_VALIDITY_CERTIFIED 13015 4.33 2.25 5.48 53 IN_ZIMBRA_NJ_WHITELIST 12836 3.50 0.07 5.40 54 XM_H_Long_From01 12472 4.87 4.18 5.25 55 TR_XM_DK_Bayes2 12453 3.45 0.23 5.24 56 MPART_ALT_DIFF 12344 5.41 5.78 5.20 57 ANY_BOUNCE_MESSAGE 11926 3.69 1.30 5.02 58 BAYES_999 11925 14.14 30.52 5.02 59 BOUNCE_MESSAGE 11925 3.69 1.30 5.02 60 BOTNET_IPINHOSTNAME 11857 8.13 13.76 4.99 61 BAYES_80 11298 6.18 8.74 4.76 62 T_TooManySym_02 10618 3.31 1.22 4.47 63 RELAYCOUNTRY_META 10595 11.30 23.59 4.46 64 MIME_QP_LONG_LINE 10583 3.51 1.82 4.46 65 XM_B_SpammyWords3 9846 6.76 11.45 4.14 66 XM_UncommonTLD01 9836 5.22 7.15 4.14 67 TR_XM_SpammyWords4 9412 5.97 9.57 3.96 68 RCVD_IN_IADB_LISTED 9399 2.89 0.98 3.96 69 BAYES_40 9036 2.99 1.53 3.80 70 XMNumbers 8900 4.14 4.84 3.75 71 RCVD_IN_IADB_SPF 8696 2.67 0.89 3.66 72 FSL_BULK_SIG 8346 6.11 10.78 3.51 73 RCVD_IN_IADB_SENDERID 8113 2.50 0.84 3.42 74 RCVD_IN_IADB_DK 7932 2.45 0.85 3.34 75 XMSubMetaSx_00 7874 3.61 4.15 3.31 76 MAILING_LIST_MULTI 7533 2.55 1.44 3.17 77 XM_B_Phish_Phrases 7343 3.33 3.77 3.09 78 FROM_EXCESS_BASE64 7212 3.19 3.47 3.04 79 BAYES_95 7184 3.83 5.29 3.02 80 XM_B_SpammyTLD 6916 3.34 4.12 2.91 81 HTML_IMAGE_RATIO_06 6895 3.50 4.58 2.90 82 MIME_HTML_MOSTLY 6856 3.74 5.26 2.89 83 SCC_BODY_URI_ONLY 6669 2.03 0.65 2.81 84 INVALID_MSGID 6506 1.80 0.11 2.74 85 TO_MALFORMED 6384 1.73 0.01 2.69 86 T_REMOTE_IMAGE 6334 2.28 1.60 2.67 87 BAYES_20 6188 2.08 1.13 2.60 88 XMSexyCombo_05 6128 3.95 6.41 2.58 89 BAYES_05 5982 1.80 0.50 2.52 90 TR_XM_DKIM_Undo 5923 14.67 36.55 2.49 91 HTML_IMAGE_RATIO_08 5781 2.72 3.22 2.43 92 MIME_HTML_ONLY_MULTI 5597 2.48 2.71 2.36 93 XM_SPF_SoftFail 5495 3.13 4.60 2.31 94 XMStockSpam_06 5402 2.01 1.54 2.27 95 TR_XM_UnparsRelay 5360 4.75 9.22 2.26 96 TR_DCC_Bayes_99 5320 11.13 27.10 2.24 97 XM_CamelCaseFrm001 5289 2.29 2.42 2.23 98 TM2_M_URI_OPT_OUT 5254 2.63 3.38 2.21 99 TR_XM_PhishingBody 5192 2.87 4.10 2.19 100 T_TooManySym_03 5083 1.70 0.91 2.14 101 RCVD_IN_IADB_VOUCHED 5056 1.50 0.37 2.13 102 TR_XM_SpammyRelay 4950 7.60 17.52 2.08 103 TVD_RCVD_IP 4944 1.63 0.81 2.08 104 XM_PDF 4859 1.41 0.27 2.05 105 UNTRUSTED_Relay 4732 3.99 7.58 1.99 106 SUBJ_ALL_CAPS 4704 2.76 4.15 1.98 107 TR_Symld_Words 4563 1.70 1.31 1.92 108 TR_XM_SpammyWords5 4468 3.47 6.32 1.88 109 DKIM_INVALID 4332 2.57 3.91 1.82 110 TooManyTo_002 4117 1.34 0.64 1.73 111 XM_DK_Undo_01 3963 1.50 1.20 1.67 112 IN_HORDE_ADDRESS_BOOK 3926 1.08 0.05 1.65 113 XMBSHREFv2 3910 1.20 0.41 1.65 114 T_XMDrugObfuBody_14 3731 2.07 2.97 1.57 115 RCVD_IN_IADB_OPTIN 3647 1.09 0.28 1.54 116 XMBody_95 3637 1.05 0.20 1.53 117 TVD_SPACE_RATIO 3606 1.02 0.12 1.52 118 XMGappySubj_01 3562 1.03 0.20 1.50 119 T_XMHurry_00 3441 1.75 2.30 1.45 120 XM_SendGrid 3362 1.45 1.51 1.42 121 TM2_M_VERY_LONG_WORD 3303 1.84 2.64 1.39 122 T_XMDrugObfuBody_08 3146 1.73 2.46 1.32 123 BASE64_LENGTH_79_INF 3079 1.08 0.70 1.30 124 XM_GoogleGroups 3074 0.98 0.42 1.29 125 RELAYCOUNTRY_CA 3019 5.60 13.37 1.27 126 HTML_MIME_NO_HTML_TAG 3007 1.30 1.35 1.27 127 URI_NOVOWEL 3006 1.19 1.06 1.27 128 XMGappySubj_02 2985 0.85 0.12 1.26 129 XM_B_Investor 2962 2.04 3.48 1.25 130 RCVD_IN_RP_SAFE 2946 1.04 0.68 1.24 131 XMSubMetaI_00 2762 1.47 2.02 1.16 132 TooManyTo_003 2708 0.94 0.59 1.14 133 XM_UB50 2610 2.44 4.84 1.10 134 RCVD_IN_RP_CERTIFIED 2609 0.86 0.44 1.10 135 URI_HEX 2608 1.25 1.52 1.10 136 XMDiploma_00 2607 1.26 1.55 1.10 137 BOTNET 2483 4.26 10.03 1.05 138 XMBdyGiftCard01 2451 1.05 1.09 1.03 139 TR_XM_DK_SendGrid 2306 1.00 1.06 0.97 140 MSGID_NOFQDN1 2264 0.61 0.00 0.95 141 XM_OfRef6 2227 1.94 3.74 0.94 142 DKIM_ADSP_CUSTOM_MED 2218 0.85 0.69 0.93 143 TooManyTo_004 2165 0.79 0.56 0.91 144 XM_H_Trusted_IP 2129 0.58 0.00 0.90 145 XMBody_17 2065 2.81 6.31 0.87 146 XM_B_Unsub2 2051 1.26 1.98 0.86 147 MPART_ALT_DIFF_COUNT 1916 1.04 1.46 0.81 148 XM_H_Long_From02 1914 1.07 1.54 0.81 149 XM_B_SpammyWords4 1907 1.03 1.45 0.80 150 XM_ProductURIs 1896 0.89 1.05 0.80 151 T_TooManySym_04 1846 0.62 0.33 0.78 152 XM_H_PHPMailer 1841 0.91 1.17 0.78 153 XM_RXBody 1805 0.67 0.51 0.76 154 TooManyTo_005 1798 0.68 0.54 0.76 155 XMLngstWrd_00 1746 0.75 0.77 0.74 156 USER_IN_WHITELIST 1705 0.46 0.00 0.72 157 USER_IN_WELCOMELIST 1705 0.46 0.00 0.72 158 XMPhish30 1693 0.93 1.32 0.71 159 XM_B_COPY_HTML 1678 0.81 1.01 0.71 160 HTTPS_HTTP_MISMATCH 1653 0.88 1.20 0.70 161 T_XMDrugObfuBody_00 1652 0.91 1.30 0.70 162 TR_XM_Base64_M1 1642 0.83 1.09 0.69 163 RCVD_IN_BL_SPAMCOP_NET 1592 5.93 15.38 0.67 164 XMHTML_After_End 1578 0.68 0.71 0.66 165 XMSubNoVowel 1522 0.57 0.43 0.64 166 KHOP_HELO_FCRDNS 1495 0.81 1.12 0.63 167 XMSubMetaSxObfu_02 1461 0.53 0.37 0.62 168 TR_MetaPhish_Combo_01 1440 1.17 2.19 0.61 169 THIS_AD 1416 0.91 1.48 0.60 170 HTML_IMAGE_ONLY_32 1411 0.44 0.17 0.59 171 FORGED_GMAIL_RCVD 1371 0.58 0.60 0.58 172 XMPhish14 1361 0.60 0.64 0.57 173 NML_ADSP_CUSTOM_MED 1359 0.56 0.53 0.57 174 XMCapTrack 1351 0.48 0.32 0.57 175 HTML_FONT_FACE_BAD 1321 0.62 0.72 0.56 176 XMBrknScrpt_02 1300 1.05 1.96 0.55 177 XMNoVowels 1252 0.49 0.41 0.53 178 TR_XM_PHPDW 1242 1.02 1.91 0.52 179 URI_TRY_3LD 1241 0.87 1.51 0.52 180 RELAYCOUNTRY_GB 1239 0.61 0.77 0.52 181 TR_XM_PHPForged 1212 1.01 1.91 0.51 182 TR_XM_FormFill2 1204 0.99 1.85 0.51 183 XMGenDplmaNmb 1179 0.51 0.54 0.50 184 RCVD_IN_IADB_OPTIN_GT50 1178 0.34 0.06 0.50 185 XM_Walgreens_Forge 1167 0.33 0.03 0.49 186 SpammyFromTLD_01 1165 1.76 4.04 0.49 187 HELO_NODOT 1155 0.52 0.58 0.49 188 HELO_NO_DOMAIN 1153 0.52 0.58 0.49 189 XM_H_PHPOS 1135 0.96 1.82 0.48 190 XM_B_REG_HTML 1104 0.47 0.47 0.46 191 T_FILL_THIS_FORM_SHORT 1081 2.18 5.28 0.46 192 SHOPIFY_IMG_NOT_RCVD_SFY 1046 0.84 1.55 0.44 193 TR_XM_SpammyWords2 1020 5.27 13.97 0.43 194 RELAYCOUNTRY_AU 1015 0.95 1.88 0.43 195 RELAYCOUNTRY_DE 979 0.82 1.55 0.41 196 RCVD_IN_PSBL 961 1.47 3.39 0.40 197 XM_B_COVIDMETA 960 0.37 0.30 0.40 198 RELAYCOUNTRY_NL 958 0.56 0.84 0.40 199 XMLngstWrd_01 952 0.37 0.32 0.40 200 MY_SERVERS_FOUND 951 0.31 0.14 0.40 ----------------------------------------------------------------------