Email: 509117 Autolearn: 0 AvgScore: 4.53 AvgScanTime: 1.40 sec Spam: 165117 Autolearn: 0 AvgScore: 13.69 AvgScanTime: 1.51 sec Ham: 344000 Autolearn: 0 AvgScore: 0.13 AvgScanTime: 1.35 sec Time Spent Running SA: 198.00 hours Time Spent Processing Spam: 69.18 hours Time Spent Processing Ham: 128.82 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 159153 90.00 96.39 86.94 2 XM_B_Unicode 143758 77.18 87.06 72.43 3 DKIM_SIGNED 136980 77.83 82.96 75.37 4 XM_DK_Pass 131931 76.01 79.90 74.14 5 DKIM_VALID 130056 75.01 78.77 73.21 6 RELAYCOUNTRY_US 127832 78.12 77.42 78.45 7 XM_B_SpammyWords 119843 55.99 72.58 48.03 8 DCC_CHECK 114179 49.29 69.15 39.76 9 XMListUnsubscribeExists 108488 55.32 65.70 50.34 10 DKIM_VALID_AU 103315 60.51 62.57 59.53 11 XM_B_Unicode3 91040 47.98 55.14 44.55 12 LOC_TINY_FONT_1 73882 33.66 44.75 28.33 13 XM_B_SpammyWords2 69580 27.31 42.14 20.20 14 BAYES_50 69066 53.01 41.83 58.37 15 HTML_FONT_LOW_CONTRAST 60723 31.67 36.78 29.22 16 RCVD_IN_MSPIKE_H2 59677 34.10 36.14 33.12 17 XM_DK_Undo_02 58723 15.47 35.56 5.83 18 FVGT_m_MULTI_ODD 57960 28.18 35.10 24.86 19 DCC_CHECK_NEGATIVE 48927 50.29 29.63 60.21 20 MIME_HTML_ONLY 47800 23.85 28.95 21.41 21 XMSubLong 47012 25.49 28.47 24.06 22 T_KAM_HTML_FONT_INVALID 45480 21.90 27.54 19.20 23 T_TM2_M_HEADER_IN_MSG 45358 29.44 27.47 30.39 24 BAYES_99 43069 11.01 26.08 3.78 25 DKIM_VALID_EF 41001 26.95 24.83 27.97 26 TR_XM_DKIM_Undo 40843 9.74 24.74 2.54 27 XM_B_Unsub 40740 15.51 24.67 11.12 28 TR_XM_BayesUnsub 39790 14.28 24.10 9.57 29 XM_Multi_Part_URI 35326 18.35 21.39 16.89 30 BAYES_999 33476 8.53 20.27 2.90 31 TR_MAX_INTL_RELAY 31780 10.59 19.25 6.44 32 TR_DCC_Bayes_99 30787 6.98 18.65 1.38 33 TR_XM_DK_Unsub 28970 13.69 17.55 11.85 34 UNPARSEABLE_RELAY 28144 13.37 17.04 11.60 35 XM_B_SpammyWords3 24238 8.15 14.68 5.02 36 BAYES_80 22342 7.04 13.53 3.93 37 RELAYCOUNTRY_META 22245 6.99 13.47 3.87 38 BOTNET_IPINHOSTNAME 19800 6.57 11.99 3.97 39 TR_XM_SpammyWords5 19768 6.37 11.97 3.68 40 LOTS_OF_MONEY 19148 7.79 11.60 5.96 41 XMNumbers 18474 6.78 11.19 4.67 42 TR_XM_SpammyWords4 16755 6.05 10.15 4.08 43 TR_XM_SpammyRelay 16427 4.71 9.95 2.19 44 XM_Evil_Numbers_Gen 15851 9.41 9.60 9.32 45 ALL_TRUSTED 15079 15.36 9.13 18.35 46 BOTNET 13951 3.97 8.45 1.83 47 BAYES_60 13663 10.25 8.27 11.20 48 TR_XM_SpammyWords2 13485 2.97 8.17 0.47 49 TR_XM_UnparsRelay 13222 3.65 8.01 1.56 50 XM_B_Phish_Phrases 13175 6.01 7.98 5.06 51 RCVD_IN_BL_SPAMCOP_NET 12946 3.10 7.84 0.82 52 FSL_BULK_SIG 12914 6.82 7.82 6.34 53 HTML_IMAGE_RATIO_02 12564 5.98 7.61 5.20 54 XM_Body_Dirty_Words 11971 4.18 7.25 2.71 55 LotsOfNums_01 11877 7.71 7.19 7.96 56 UNTRUSTED_Relay 10921 3.21 6.61 1.58 57 XMSubMetaSx_00 10907 4.60 6.61 3.64 58 MPART_ALT_DIFF 10801 5.12 6.54 4.43 59 XM_H_Long_From01 10244 5.53 6.20 5.21 60 TR_XM_SPAMCOP 9661 2.15 5.85 0.38 61 HTML_IMAGE_RATIO_04 9331 4.98 5.65 4.65 62 XM_B_PhoneNumber 9250 7.11 5.60 7.83 63 TooManyTo_001 9134 6.57 5.53 7.07 64 XM_UncommonTLD01 9130 5.11 5.53 4.90 65 BAYES_95 8877 3.44 5.38 2.51 66 XM_B_SEO 8094 2.52 4.90 1.37 67 XMSexyCombo_05 8043 2.42 4.87 1.25 68 XM_H_GMP 7657 4.70 4.64 4.73 69 XM_SPF_SoftFail 7320 2.56 4.43 1.67 70 MIME_HTML_MOSTLY 7070 3.32 4.28 2.86 71 TR_XM_SEO4 7065 1.94 4.28 0.82 72 RELAYCOUNTRY_CA 6928 2.09 4.20 1.07 73 DKIM_INVALID 6924 2.82 4.19 2.16 74 T_XMDrugObfuBody_14 6681 2.42 4.05 1.64 75 XM_UB50 6533 1.92 3.96 0.94 76 MIME_HTML_ONLY_MULTI 6513 2.82 3.94 2.28 77 XM_CamelCaseFrm001 6485 3.02 3.93 2.59 78 TR_XM_PhishingBody 6283 2.54 3.81 1.93 79 XMStrtUSub 6097 4.26 3.69 4.54 80 TM2_M_VERY_LONG_WORD 5948 2.17 3.60 1.48 81 XM_B_Investor 5900 2.09 3.57 1.37 82 XM_B_SpammyTLD 5717 4.20 3.46 4.55 83 MIME_QP_LONG_LINE 5270 4.49 3.19 5.11 84 HTML_IMAGE_RATIO_06 5145 3.08 3.12 3.06 85 T_XMDrugObfuBody_08 4867 1.77 2.95 1.20 86 XM_URI_RBL 4514 1.18 2.73 0.43 87 RCVD_IN_MSPIKE_H3 4500 4.55 2.73 5.43 88 RCVD_IN_MSPIKE_WL 4500 4.55 2.73 5.43 89 XM_B_SpammyWords4 4428 1.41 2.68 0.80 90 TM2_M_URI_OPT_OUT 4379 2.04 2.65 1.74 91 RELAYCOUNTRY_AU 4212 1.37 2.55 0.80 92 XM_B_URI_Unicode 4209 2.08 2.55 1.85 93 FROM_EXCESS_BASE64 4017 2.41 2.43 2.40 94 XMDiploma_00 4013 1.79 2.43 1.48 95 XM_OfRef6 3993 1.37 2.42 0.86 96 TR_XM_NoHeaderRelay 3972 0.85 2.41 0.11 97 XM_B_Unsub2 3959 1.74 2.40 1.42 98 XM_H_Long_From02 3948 1.37 2.39 0.89 99 XMBody_17 3948 1.09 2.39 0.46 100 RCVD_IN_VALIDITY_SAFE 3861 4.44 2.34 5.45 101 T_TooManySym_01 3722 4.09 2.25 4.97 102 USER_IN_DEF_DKIM_WL 3715 10.64 2.25 14.67 103 T_XMHurry_00 3618 1.25 2.19 0.79 104 TR_Mismatch_TLD_01 3571 0.81 2.16 0.16 105 SUBJ_ALL_CAPS 3553 1.72 2.15 1.51 106 MAILING_LIST_MULTI 3523 2.42 2.13 2.56 107 TR_LOTS_OF_MONEY3 3480 0.85 2.11 0.25 108 MIME_HEADER_CTYPE_ONLY 3406 0.76 2.06 0.14 109 RCVD_IN_VALIDITY_RPBL 3406 0.75 2.06 0.12 110 HTML_IMAGE_RATIO_08 3396 1.94 2.06 1.88 111 NAME_EMAIL_DIFF 3215 0.70 1.95 0.10 112 XMStockSpam_06 3180 1.83 1.93 1.79 113 PDS_FROM_2_EMAILS 3163 0.62 1.92 0.00 114 XMBrknScrpt_02 3044 1.13 1.84 0.78 115 T_XMDrugObfuBody_00 3003 1.07 1.82 0.71 116 T_FILL_THIS_FORM_SHORT 2944 1.17 1.78 0.88 117 RCVD_IN_VALIDITY_CERTIFIED 2809 3.50 1.70 4.36 118 XM_DK_Undo_01 2792 1.74 1.69 1.77 119 SpammyFromTLD_01 2775 1.05 1.68 0.75 120 SpammyFromTLD_02 2725 0.81 1.65 0.41 121 DIET_1 2485 0.68 1.50 0.28 122 SHOPIFY_IMG_NOT_RCVD_SFY 2420 0.65 1.47 0.26 123 BAYES_40 2326 3.65 1.41 4.72 124 XM_ProductURIs 2321 1.16 1.41 1.05 125 RCVD_IN_IADB_LISTED 2321 3.11 1.41 3.93 126 XMPhish30 2315 1.05 1.40 0.88 127 URI_HEX 2203 1.12 1.33 1.01 128 XMSubMetaI_00 2188 0.99 1.33 0.83 129 THIS_AD 2187 0.67 1.32 0.36 130 T_REMOTE_IMAGE 2184 3.30 1.32 4.24 131 XM_B_COVIDMETA 2154 0.80 1.30 0.56 132 HTML_FONT_TINY_NORDNS 2151 0.47 1.30 0.07 133 HTML_MIME_NO_HTML_TAG 2132 1.76 1.29 1.98 134 RCVD_IN_IADB_SPF 2049 2.72 1.24 3.43 135 XM_SendGrid 2037 1.30 1.23 1.33 136 TooManyTo_002 2016 1.71 1.22 1.94 137 XMBdyGiftCard01 2002 0.87 1.21 0.70 138 RCVD_IN_ZEN_LASTEXTERNAL 1983 0.39 1.20 0.00 139 SHORTCIRCUIT 1983 0.39 1.20 0.00 140 RCVD_IN_IADB_DK 1928 2.39 1.17 2.97 141 RCVD_IN_IADB_SENDERID 1923 2.45 1.16 3.07 142 KHOP_HELO_FCRDNS 1894 1.23 1.15 1.28 143 ANY_BOUNCE_MESSAGE 1889 2.34 1.14 2.91 144 BOUNCE_MESSAGE 1889 2.34 1.14 2.91 145 TR_Symld_Words 1886 1.55 1.14 1.75 146 DKIM_ADSP_NXDOMAIN 1851 0.54 1.12 0.26 147 URI_NOVOWEL 1835 2.61 1.11 3.34 148 XM_B_REG_HTML 1821 0.47 1.10 0.17 149 XMHTMLBadTable_001 1776 0.52 1.08 0.26 150 BAYES_20 1742 2.50 1.06 3.20 151 XMSexyCombo_01 1739 0.49 1.05 0.22 152 DKIM_ADSP_CUSTOM_MED 1733 0.95 1.05 0.90 153 LongTLD 1725 0.54 1.04 0.30 154 XM_B_Phish66 1667 0.62 1.01 0.43 155 HTTPS_HTTP_MISMATCH 1661 0.75 1.01 0.63 156 XM_DIRTYINTL 1658 0.51 1.00 0.27 157 TM2_M_OBFU_COMMENT 1656 0.71 1.00 0.57 158 XMGenDplmaNmb 1655 0.85 1.00 0.77 159 RELAYCOUNTRY_FR 1651 0.54 1.00 0.32 160 TR_XM_FormFill 1623 0.34 0.98 0.03 161 TR_XM_InvalidRelay 1588 0.32 0.96 0.02 162 XM_B_DNDMA 1584 1.00 0.96 1.02 163 MPART_ALT_DIFF_COUNT 1575 1.29 0.95 1.45 164 RCVD_IN_PSBL 1571 0.37 0.95 0.09 165 URI_TRY_3LD 1568 0.75 0.95 0.65 166 XM_H_Undi_Recip 1542 0.40 0.93 0.15 167 XMSubMetaSSx_00 1533 0.49 0.93 0.27 168 TR_XM_Base64_M1 1515 0.84 0.92 0.81 169 TR_XM_INV_DKIM 1513 0.34 0.92 0.06 170 TR_XM_PHPDW 1478 0.55 0.90 0.38 171 T_STY_INVIS_DIRECT 1475 0.47 0.89 0.26 172 TR_XM_PHPForged 1466 0.55 0.89 0.39 173 RDNS_DYNAMIC 1450 0.52 0.88 0.35 174 LONGLN_LOW_CONTRAST 1438 0.45 0.87 0.25 175 HTML_TAG_BALANCE_BODY 1437 0.63 0.87 0.51 176 TR_XM_RelayPhish 1433 0.33 0.87 0.07 177 PDS_RDNS_DYNAMIC_FP 1426 0.41 0.86 0.20 178 TR_XM_FormFill2 1410 0.54 0.85 0.39 179 XM_H_PHPOS 1392 0.53 0.84 0.38 180 XM_GoogleGroups 1389 1.02 0.84 1.11 181 XM_UB99 1379 0.27 0.84 0.01 182 XM_RXBody 1345 0.36 0.81 0.14 183 PLING_QUERY 1341 0.63 0.81 0.54 184 TR_Mismatch_TLD_02 1337 0.30 0.81 0.05 185 XM_S_SpammyWords 1336 0.37 0.81 0.16 186 TR_XM_Spammywords 1336 0.37 0.81 0.16 187 XMSlimDrugH 1326 0.49 0.80 0.34 188 NML_ADSP_CUSTOM_MED 1326 0.68 0.80 0.62 189 XM_B_COPY_HTML 1326 0.70 0.80 0.65 190 XMBody_78 1316 0.49 0.80 0.34 191 RELAYCOUNTRY_CN 1308 0.29 0.79 0.04 192 TR_XM_DK_SendGrid 1302 0.88 0.79 0.93 193 TVD_RCVD_IP 1274 0.60 0.77 0.52 194 XMHTML_After_End 1265 0.43 0.77 0.26 195 MIME_CHARSET_FARAWAY 1253 0.47 0.76 0.34 196 TR_XM_Undi_Recip19 1200 0.29 0.73 0.08 197 XMSubMetaSxObfu_03 1166 0.46 0.71 0.35 198 T_MONEY_PERCENT 1163 0.39 0.70 0.24 199 TR_LOTS_OF_MONEY2 1163 0.39 0.70 0.24 200 RCVD_IN_PBL 1143 0.61 0.69 0.57 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 299057 90.00 96.39 86.94 2 RELAYCOUNTRY_US 269865 78.12 77.42 78.45 3 DKIM_SIGNED 259260 77.83 82.96 75.37 4 XM_DK_Pass 255039 76.01 79.90 74.14 5 DKIM_VALID 251829 75.01 78.77 73.21 6 XM_B_Unicode 249168 77.18 87.06 72.43 7 DCC_CHECK_NEGATIVE 207124 50.29 29.63 60.21 8 DKIM_VALID_AU 204777 60.51 62.57 59.53 9 BAYES_50 200792 53.01 41.83 58.37 10 XMListUnsubscribeExists 173154 55.32 65.70 50.34 11 XM_B_SpammyWords 165212 55.99 72.58 48.03 12 XM_B_Unicode3 153257 47.98 55.14 44.55 13 DCC_CHECK 136780 49.29 69.15 39.76 14 RCVD_IN_MSPIKE_H2 113931 34.10 36.14 33.12 15 T_TM2_M_HEADER_IN_MSG 104532 29.44 27.47 30.39 16 HTML_FONT_LOW_CONTRAST 100507 31.67 36.78 29.22 17 LOC_TINY_FONT_1 97462 33.66 44.75 28.33 18 DKIM_VALID_EF 96221 26.95 24.83 27.97 19 FVGT_m_MULTI_ODD 85503 28.18 35.10 24.86 20 XMSubLong 82766 25.49 28.47 24.06 21 MIME_HTML_ONLY 73640 23.85 28.95 21.41 22 XM_B_SpammyWords2 69479 27.31 42.14 20.20 23 T_KAM_HTML_FONT_INVALID 66033 21.90 27.54 19.20 24 ALL_TRUSTED 63123 15.36 9.13 18.35 25 XM_Multi_Part_URI 58085 18.35 21.39 16.89 26 USER_IN_DEF_DKIM_WL 50479 10.64 2.25 14.67 27 TR_XM_DK_Unsub 40751 13.69 17.55 11.85 28 UNPARSEABLE_RELAY 39906 13.37 17.04 11.60 29 BAYES_60 38516 10.25 8.27 11.20 30 XM_B_Unsub 38237 15.51 24.67 11.12 31 BAYES_00 35191 7.13 0.67 10.23 32 TR_XM_BayesUnsub 32929 14.28 24.10 9.57 33 XM_Evil_Numbers_Gen 32077 9.41 9.60 9.32 34 XM_DKIMWhitelistDomains 28973 5.70 0.02 8.42 35 TR_XM_DK_Bayes 27692 5.61 0.54 8.05 36 LotsOfNums_01 27386 7.71 7.19 7.96 37 TR_XM_DK_Bayes1 27354 5.54 0.53 7.95 38 XM_B_PhoneNumber 26930 7.11 5.60 7.83 39 TooManyTo_001 24310 6.57 5.53 7.07 40 TR_XM_DK_Bayes2 24190 4.85 0.31 7.03 41 TR_MAX_INTL_RELAY 22152 10.59 19.25 6.44 42 IN_ZIMBRA_NJ_WHITELIST 21922 4.34 0.11 6.37 43 FSL_BULK_SIG 21814 6.82 7.82 6.34 44 LOTS_OF_MONEY 20495 7.79 11.60 5.96 45 XM_DK_Undo_02 20060 15.47 35.56 5.83 46 RCVD_IN_VALIDITY_SAFE 18744 4.44 2.34 5.45 47 RCVD_IN_MSPIKE_WL 18685 4.55 2.73 5.43 48 RCVD_IN_MSPIKE_H3 18684 4.55 2.73 5.43 49 XM_H_Long_From01 17935 5.53 6.20 5.21 50 HTML_IMAGE_RATIO_02 17899 5.98 7.61 5.20 51 MIME_QP_LONG_LINE 17592 4.49 3.19 5.11 52 XM_B_Phish_Phrases 17406 6.01 7.98 5.06 53 XM_B_SpammyWords3 17270 8.15 14.68 5.02 54 T_TooManySym_01 17110 4.09 2.25 4.97 55 XM_UncommonTLD01 16869 5.11 5.53 4.90 56 XM_H_GMP 16260 4.70 4.64 4.73 57 BAYES_40 16254 3.65 1.41 4.72 58 XMNumbers 16056 6.78 11.19 4.67 59 HTML_IMAGE_RATIO_04 16007 4.98 5.65 4.65 60 XM_B_SpammyTLD 15659 4.20 3.46 4.55 61 XMStrtUSub 15614 4.26 3.69 4.54 62 MPART_ALT_DIFF 15242 5.12 6.54 4.43 63 RCVD_IN_VALIDITY_CERTIFIED 14996 3.50 1.70 4.36 64 T_REMOTE_IMAGE 14597 3.30 1.32 4.24 65 TR_XM_SpammyWords4 14049 6.05 10.15 4.08 66 BOTNET_IPINHOSTNAME 13647 6.57 11.99 3.97 67 BAYES_80 13514 7.04 13.53 3.93 68 RCVD_IN_IADB_LISTED 13503 3.11 1.41 3.93 69 RELAYCOUNTRY_META 13324 6.99 13.47 3.87 70 XM_PDF 13258 2.77 0.51 3.85 71 BAYES_99 12996 11.01 26.08 3.78 72 TR_XM_SpammyWords5 12645 6.37 11.97 3.68 73 XMSubMetaSx_00 12529 4.60 6.61 3.64 74 RCVD_IN_IADB_SPF 11805 2.72 1.24 3.43 75 URI_NOVOWEL 11478 2.61 1.11 3.34 76 BAYES_20 10997 2.50 1.06 3.20 77 RCVD_IN_IADB_SENDERID 10566 2.45 1.16 3.07 78 HTML_IMAGE_RATIO_06 10513 3.08 3.12 3.06 79 RCVD_IN_IADB_DK 10226 2.39 1.17 2.97 80 ANY_BOUNCE_MESSAGE 10009 2.34 1.14 2.91 81 BOUNCE_MESSAGE 10007 2.34 1.14 2.91 82 BAYES_999 9964 8.53 20.27 2.90 83 MIME_HTML_MOSTLY 9830 3.32 4.28 2.86 84 XM_Body_Dirty_Words 9311 4.18 7.25 2.71 85 XM_CamelCaseFrm001 8902 3.02 3.93 2.59 86 MAILING_LIST_MULTI 8801 2.42 2.13 2.56 87 RCVD_IN_IADB_VOUCHED 8794 1.94 0.67 2.56 88 TR_XM_DKIM_Undo 8722 9.74 24.74 2.54 89 BAYES_95 8625 3.44 5.38 2.51 90 T_TooManySym_02 8320 1.82 0.57 2.42 91 FROM_EXCESS_BASE64 8267 2.41 2.43 2.40 92 MIME_HTML_ONLY_MULTI 7848 2.82 3.94 2.28 93 TR_XM_SpammyRelay 7539 4.71 9.95 2.19 94 DKIM_INVALID 7431 2.82 4.19 2.16 95 INVALID_MSGID 7165 1.45 0.14 2.08 96 BAYES_05 7110 1.58 0.57 2.07 97 HTML_MIME_NO_HTML_TAG 6821 1.76 1.29 1.98 98 TooManyTo_002 6687 1.71 1.22 1.94 99 TR_XM_PhishingBody 6654 2.54 3.81 1.93 100 HTML_IMAGE_RATIO_08 6466 1.94 2.06 1.88 101 XM_B_URI_Unicode 6372 2.08 2.55 1.85 102 BOTNET 6281 3.97 8.45 1.83 103 TO_MALFORMED 6267 1.24 0.03 1.82 104 RCVD_IN_IADB_OPTIN 6197 1.35 0.41 1.80 105 XMStockSpam_06 6141 1.83 1.93 1.79 106 XM_DK_Undo_01 6092 1.74 1.69 1.77 107 TR_Symld_Words 6012 1.55 1.14 1.75 108 TM2_M_URI_OPT_OUT 5988 2.04 2.65 1.74 109 XM_SPF_SoftFail 5735 2.56 4.43 1.67 110 T_XMDrugObfuBody_14 5658 2.42 4.05 1.64 111 UNTRUSTED_Relay 5441 3.21 6.61 1.58 112 TR_XM_UnparsRelay 5352 3.65 8.01 1.56 113 SUBJ_ALL_CAPS 5197 1.72 2.15 1.51 114 TM2_M_VERY_LONG_WORD 5101 2.17 3.60 1.48 115 XMDiploma_00 5081 1.79 2.43 1.48 116 MPART_ALT_DIFF_COUNT 4981 1.29 0.95 1.45 117 IN_HORDE_ADDRESS_BOOK 4932 1.01 0.12 1.43 118 XM_B_Unsub2 4899 1.74 2.40 1.42 119 TR_DCC_Bayes_99 4757 6.98 18.65 1.38 120 XM_B_Investor 4718 2.09 3.57 1.37 121 XM_B_SEO 4711 2.52 4.90 1.37 122 XM_SendGrid 4586 1.30 1.23 1.33 123 KHOP_HELO_FCRDNS 4388 1.23 1.15 1.28 124 TooManyTo_003 4362 1.06 0.62 1.27 125 XMSexyCombo_05 4300 2.42 4.87 1.25 126 XMGappySubj_01 4179 0.91 0.28 1.21 127 T_XMDrugObfuBody_08 4137 1.77 2.95 1.20 128 XM_TLDProd2 4095 0.88 0.23 1.19 129 MANY_SPAN_IN_TEXT 4065 0.81 0.02 1.18 130 FROM_GOV_DKIM_AU 3984 0.82 0.13 1.16 131 XM_GoogleGroups 3824 1.02 0.84 1.11 132 RELAYCOUNTRY_CA 3697 2.09 4.20 1.07 133 TVD_SPACE_RATIO 3687 0.76 0.11 1.07 134 XM_ProductURIs 3595 1.16 1.41 1.05 135 XM_B_DNDMA 3516 1.00 0.96 1.02 136 URI_HEX 3478 1.12 1.33 1.01 137 XMCapTrack 3237 0.80 0.51 0.94 138 XM_UB50 3226 1.92 3.96 0.94 139 TR_XM_DK_SendGrid 3195 0.88 0.79 0.93 140 TooManyTo_004 3191 0.81 0.58 0.93 141 T_TooManySym_03 3120 0.69 0.22 0.91 142 HELO_NODOT 3112 0.65 0.12 0.90 143 HELO_NO_DOMAIN 3101 0.65 0.12 0.90 144 DKIM_ADSP_CUSTOM_MED 3092 0.95 1.05 0.90 145 XM_H_Long_From02 3050 1.37 2.39 0.89 146 XMPhish30 3034 1.05 1.40 0.88 147 T_FILL_THIS_FORM_SHORT 3022 1.17 1.78 0.88 148 XM_OfRef6 2968 1.37 2.42 0.86 149 XMSubMetaI_00 2866 0.99 1.33 0.83 150 TR_XM_SEO4 2821 1.94 4.28 0.82 151 RCVD_IN_BL_SPAMCOP_NET 2817 3.10 7.84 0.82 152 TR_XM_Base64_M1 2770 0.84 0.92 0.81 153 RELAYCOUNTRY_AU 2762 1.37 2.55 0.80 154 XM_B_SpammyWords4 2747 1.41 2.68 0.80 155 T_XMHurry_00 2732 1.25 2.19 0.79 156 XMBrknScrpt_02 2698 1.13 1.84 0.78 157 XMGenDplmaNmb 2655 0.85 1.00 0.77 158 SpammyFromTLD_01 2570 1.05 1.68 0.75 159 TooManyTo_005 2513 0.67 0.54 0.73 160 T_XMDrugObfuBody_00 2452 1.07 1.82 0.71 161 XMGappySubj_02 2445 0.51 0.11 0.71 162 XMBdyGiftCard01 2408 0.87 1.21 0.70 163 XM_B_COPY_HTML 2232 0.70 0.80 0.65 164 URI_TRY_3LD 2226 0.75 0.95 0.65 165 HTTPS_HTTP_MISMATCH 2152 0.75 1.01 0.63 166 NML_ADSP_CUSTOM_MED 2138 0.68 0.80 0.62 167 XM_ShortIntro_01 2071 0.56 0.48 0.60 168 XMBody_95 2068 0.50 0.28 0.60 169 FORGED_GMAIL_RCVD 2054 0.61 0.63 0.60 170 HTML_IMAGE_ONLY_20 2044 0.53 0.39 0.59 171 TM2_M_OBFU_COMMENT 1960 0.71 1.00 0.57 172 RCVD_IN_PBL 1954 0.61 0.69 0.57 173 TR_MetaPhish_Combo_01 1934 0.57 0.57 0.56 174 T_TVD_MIME_NO_HEADERS 1927 0.40 0.07 0.56 175 XM_B_COVIDMETA 1919 0.80 1.30 0.56 176 PLING_QUERY 1856 0.63 0.81 0.54 177 T_OBFU_PDF_ATTACH 1811 0.39 0.09 0.53 178 XM_H_PHPMailer 1799 0.50 0.46 0.52 179 TVD_RCVD_IP 1775 0.60 0.77 0.52 180 HTML_TAG_BALANCE_BODY 1753 0.63 0.87 0.51 181 XMSubMetaSxObfu_02 1726 0.52 0.57 0.50 182 XMNoVowels 1711 0.43 0.29 0.50 183 TR_XM_SpammyWords2 1629 2.97 8.17 0.47 184 RELAYCOUNTRY_GB 1601 0.52 0.62 0.47 185 XMBody_17 1590 1.09 2.39 0.46 186 USER_IN_WELCOMELIST 1587 0.31 0.00 0.46 187 USER_IN_WHITELIST 1587 0.31 0.00 0.46 188 XMSubNoVowel 1533 0.41 0.35 0.45 189 XM_URI_RBL 1484 1.18 2.73 0.43 190 XM_B_Phish66 1467 0.62 1.01 0.43 191 LOW_PRICE 1438 0.43 0.45 0.42 192 SpammyFromTLD_02 1407 0.81 1.65 0.41 193 HTML_FONT_FACE_BAD 1401 0.50 0.69 0.41 194 T_Symld_Words_02 1400 0.47 0.61 0.41 195 XMBSHREFv2 1378 0.37 0.32 0.40 196 HTML_IMAGE_ONLY_28 1373 0.33 0.17 0.40 197 HTML_IMAGE_ONLY_32 1371 0.31 0.14 0.40 198 TR_XM_PHPForged 1329 0.55 0.89 0.39 199 TR_XM_COVIDMETA5 1328 0.26 0.01 0.39 200 TR_XM_FormFill2 1327 0.54 0.85 0.39 ----------------------------------------------------------------------