Email: 440017 Autolearn: 0 AvgScore: 4.76 AvgScanTime: 1.31 sec Spam: 138564 Autolearn: 0 AvgScore: 14.39 AvgScanTime: 1.43 sec Ham: 301453 Autolearn: 0 AvgScore: 0.33 AvgScanTime: 1.26 sec Time Spent Running SA: 160.53 hours Time Spent Processing Spam: 55.17 hours Time Spent Processing Ham: 105.36 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 132678 89.99 95.75 87.34 2 DKIM_SIGNED 121820 77.82 87.92 73.18 3 XM_B_Unicode 118728 75.90 85.68 71.41 4 XM_DK_Pass 116722 75.74 84.24 71.83 5 DKIM_VALID 115333 74.70 83.23 70.77 6 RELAYCOUNTRY_US 114527 82.52 82.65 82.46 7 DCC_CHECK 102670 49.35 74.10 37.97 8 XM_B_SpammyWords 96839 53.42 69.89 45.85 9 XMListUnsubscribeExists 92465 53.71 66.73 47.72 10 DKIM_VALID_AU 91713 59.43 66.19 56.32 11 XM_B_Unicode3 72411 45.26 52.26 42.04 12 LOC_TINY_FONT_1 66624 34.28 48.08 27.93 13 RCVD_IN_MSPIKE_H2 58316 37.40 42.09 35.25 14 BAYES_50 57877 55.34 41.77 61.58 15 XM_B_SpammyWords2 55871 25.34 40.32 18.46 16 XM_DK_Undo_02 54345 16.01 39.22 5.35 17 HTML_FONT_LOW_CONTRAST 49870 32.45 35.99 30.83 18 FVGT_m_MULTI_ODD 45297 26.89 32.69 24.23 19 DKIM_VALID_EF 42866 29.11 30.94 28.27 20 BAYES_99 41988 12.02 30.30 3.61 21 T_KAM_HTML_FONT_INVALID 41585 23.59 30.01 20.64 22 MIME_HTML_ONLY 40877 22.97 29.50 19.97 23 TR_XM_DKIM_Undo 39699 10.91 28.65 2.75 24 DCC_CHECK_NEGATIVE 33909 50.17 24.47 61.99 25 XMSubLong 33857 22.90 24.43 22.20 26 BAYES_999 32689 9.33 23.59 2.78 27 T_TM2_M_HEADER_IN_MSG 32408 29.42 23.39 32.19 28 TR_XM_DK_Unsub 29657 15.48 21.40 12.75 29 TR_DCC_Bayes_99 29616 7.71 21.37 1.43 30 XM_Multi_Part_URI 29548 16.02 21.32 13.59 31 UNPARSEABLE_RELAY 25210 13.89 18.19 11.92 32 XM_B_Unsub 24386 11.64 17.60 8.91 33 TR_XM_BayesUnsub 23662 9.78 17.08 6.42 34 RELAYCOUNTRY_META 21224 7.44 15.32 3.82 35 TR_MAX_INTL_RELAY 20074 8.32 14.49 5.49 36 XM_B_SpammyWords3 19647 7.29 14.18 4.12 37 LOTS_OF_MONEY 17634 8.02 12.73 5.86 38 TR_XM_SpammyWords4 15698 6.28 11.33 3.96 39 TR_XM_SpammyWords2 15495 3.92 11.18 0.58 40 XM_Evil_Numbers_Gen 15165 10.88 10.94 10.85 41 BOTNET_IPINHOSTNAME 14875 5.94 10.74 3.74 42 FSL_BULK_SIG 14864 8.51 10.73 7.49 43 TR_XM_SpammyRelay 14830 4.81 10.70 2.11 44 XM_B_Phish_Phrases 13665 6.89 9.86 5.53 45 BOTNET 12860 4.21 9.28 1.89 46 TR_XM_UnparsRelay 12708 4.01 9.17 1.64 47 BAYES_80 12486 5.15 9.01 3.38 48 RCVD_IN_BL_SPAMCOP_NET 11374 2.92 8.21 0.49 49 BAYES_60 11203 7.23 8.09 6.83 50 T_SCC_BODY_TEXT_LINE 10794 8.26 7.79 8.48 51 XM_Body_Dirty_Words 10747 4.28 7.76 2.68 52 LotsOfNums_01 10685 7.87 7.71 7.95 53 XMSubMetaSx_00 10429 4.86 7.53 3.64 54 HTML_IMAGE_RATIO_02 9833 5.08 7.10 4.16 55 TR_XM_SPAMCOP 9504 2.33 6.86 0.24 56 HTML_IMAGE_RATIO_04 8582 5.16 6.19 4.68 57 TM2_M_VERY_LONG_WORD 8581 6.18 6.19 6.18 58 UNTRUSTED_Relay 8409 2.85 6.07 1.37 59 MPART_ALT_DIFF 8299 4.92 5.99 4.43 60 RELAYCOUNTRY_CA 8036 2.58 5.80 1.10 61 XM_B_PhoneNumber 7923 7.96 5.72 8.99 62 XM_UncommonTLD01 7860 4.55 5.67 4.04 63 XM_H_Long_From01 7798 5.69 5.63 5.72 64 XM_H_GMP 7790 5.59 5.62 5.58 65 XMStrtUSub 7572 4.99 5.46 4.77 66 TR_XM_PhishingBody 7143 2.68 5.16 1.54 67 BAYES_95 7101 3.06 5.12 2.11 68 XMSexyCombo_05 6744 2.74 4.87 1.76 69 T_XMDrugObfuBody_14 6713 2.88 4.84 1.98 70 DKIM_INVALID 6487 3.12 4.68 2.41 71 XM_B_Investor 6416 2.47 4.63 1.48 72 XM_B_SpammyTLD 5757 3.25 4.15 2.84 73 TooManyTo_001 5546 6.69 4.00 7.92 74 XM_CamelCaseFrm001 5157 2.61 3.72 2.09 75 XMDiploma_00 5120 2.36 3.70 1.74 76 MIME_HTML_ONLY_MULTI 4969 2.97 3.59 2.68 77 T_XMDrugObfuBody_08 4874 2.68 3.52 2.29 78 RCVD_IN_MSPIKE_H3 4753 4.66 3.43 5.23 79 RCVD_IN_MSPIKE_WL 4753 4.66 3.43 5.23 80 XMNumbers 4731 3.13 3.41 2.99 81 MIME_HTML_MOSTLY 4656 2.52 3.36 2.14 82 HTML_IMAGE_RATIO_06 4595 2.75 3.32 2.50 83 MIME_QP_LONG_LINE 4542 4.58 3.28 5.18 84 ANY_BOUNCE_MESSAGE 4435 6.68 3.20 8.28 85 BOUNCE_MESSAGE 4434 6.68 3.20 8.28 86 TR_XM_SpammyWords5 4417 1.94 3.19 1.37 87 XM_B_URI_Unicode 4331 2.25 3.13 1.85 88 XM_UB50 4302 1.54 3.10 0.83 89 XM_B_Unsub2 4002 1.85 2.89 1.37 90 KHOP_HELO_FCRDNS 3965 3.43 2.86 3.69 91 XM_SPF_SoftFail 3962 1.79 2.86 1.29 92 XM_OfRef6 3824 1.56 2.76 1.01 93 XM_URI_RBL 3678 1.11 2.65 0.39 94 RELAYCOUNTRY_AU 3573 1.38 2.58 0.83 95 HTML_IMAGE_RATIO_08 3519 2.41 2.54 2.34 96 TM2_M_URI_OPT_OUT 3459 2.14 2.50 1.97 97 ALL_TRUSTED 3398 10.75 2.45 14.57 98 FROM_EXCESS_BASE64 3396 2.02 2.45 1.82 99 MAILING_LIST_MULTI 3371 2.60 2.43 2.68 100 T_TooManySym_01 3331 5.10 2.40 6.33 101 XM_B_SpammyWords4 3238 1.15 2.34 0.61 102 T_XMHurry_00 3237 1.29 2.34 0.81 103 USER_IN_DEF_DKIM_WL 3194 9.70 2.31 13.09 104 XMBody_17 3156 1.04 2.28 0.47 105 XMStockSpam_06 3142 1.67 2.27 1.39 106 TR_XM_NoHeaderRelay 3089 0.89 2.23 0.27 107 HTML_MIME_NO_HTML_TAG 3048 2.31 2.20 2.35 108 SpammyFromTLD_02 3017 1.05 2.18 0.53 109 XM_SendGrid 2899 1.61 2.09 1.39 110 RCVD_IN_VALIDITY_SAFE 2890 3.27 2.09 3.81 111 MAY_BE_FORGED 2888 4.04 2.08 4.93 112 T_XMDrugObfuBody_00 2612 1.14 1.89 0.80 113 BAYES_40 2589 4.25 1.87 5.34 114 XMBrknScrpt_02 2581 1.19 1.86 0.88 115 XMGenDplmaNmb 2519 1.19 1.82 0.90 116 RCVD_IN_VALIDITY_RPBL 2512 0.62 1.81 0.07 117 TR_XM_INV_DKIM 2445 0.66 1.76 0.15 118 SUBJ_ALL_CAPS 2434 1.57 1.76 1.49 119 T_REMOTE_IMAGE 2382 2.84 1.72 3.36 120 RCVD_IN_PSBL 2331 0.71 1.68 0.26 121 T_FILL_THIS_FORM_SHORT 2315 1.14 1.67 0.90 122 DIET_1 2283 0.74 1.65 0.32 123 HTML_FONT_TINY_NORDNS 2273 0.56 1.64 0.06 124 XM_DK_Undo_01 2208 1.68 1.59 1.72 125 RCVD_IN_VALIDITY_CERTIFIED 2202 2.56 1.59 3.01 126 TR_MetaPhish_Combo_01 2202 0.97 1.59 0.68 127 SpammyFromTLD_01 2173 0.99 1.57 0.73 128 URI_HEX 2162 1.22 1.56 1.06 129 XMPhish30 2082 0.89 1.50 0.61 130 HTTPS_HTTP_MISMATCH 1996 0.86 1.44 0.60 131 RCVD_IN_ZEN_LASTEXTERNAL 1968 0.45 1.42 0.00 132 SHORTCIRCUIT 1968 0.45 1.42 0.00 133 MIME_CHARSET_FARAWAY 1966 2.01 1.42 2.28 134 XMSlimDrugH 1941 0.73 1.40 0.42 135 URI_TRY_3LD 1920 0.80 1.39 0.53 136 LongTLD 1920 0.75 1.39 0.46 137 TR_LOTS_OF_MONEY3 1917 0.68 1.38 0.35 138 XM_B_Phish66 1883 0.70 1.36 0.39 139 DKIM_ADSP_CUSTOM_MED 1851 1.01 1.34 0.87 140 XM_B_COPY_HTML 1754 0.82 1.27 0.62 141 DKIM_ADSP_NXDOMAIN 1736 0.60 1.25 0.31 142 SHOPIFY_IMG_NOT_RCVD_SFY 1734 0.61 1.25 0.32 143 XM_H_Long_From02 1732 0.95 1.25 0.82 144 HTML_TAG_BALANCE_BODY 1661 0.80 1.20 0.62 145 TM2_M_OBFU_COMMENT 1643 0.69 1.19 0.46 146 XMBdyGiftCard01 1624 0.82 1.17 0.66 147 BAYES_20 1624 2.92 1.17 3.73 148 CHARSET_FARAWAY_HEADER 1603 1.83 1.16 2.14 149 URI_NOVOWEL 1596 1.65 1.15 1.88 150 NML_ADSP_CUSTOM_MED 1570 0.74 1.13 0.55 151 XM_DIRTYINTL 1556 0.42 1.12 0.10 152 HTML_IMAGE_ONLY_20 1542 0.66 1.11 0.45 153 XM_B_SEO 1509 0.54 1.09 0.29 154 BOTNET_NORDNS 1500 0.35 1.08 0.02 155 RELAYCOUNTRY_FR 1500 0.51 1.08 0.25 156 T_STY_INVIS_DIRECT 1483 0.62 1.07 0.42 157 TR_XM_PHPForged 1480 0.59 1.07 0.37 158 TR_XM_PHPDW 1480 0.60 1.07 0.38 159 MPART_ALT_DIFF_COUNT 1473 0.70 1.06 0.54 160 TR_XM_FormFill2 1471 0.59 1.06 0.38 161 T_MONEY_PERCENT 1471 0.44 1.06 0.16 162 TR_LOTS_OF_MONEY2 1471 0.44 1.06 0.16 163 XM_H_Undi_Recip 1451 0.45 1.05 0.18 164 XM_H_PHPOS 1443 0.58 1.04 0.37 165 FORGED_GMAIL_RCVD 1436 0.71 1.04 0.56 166 XMEqualsVooDoo_00 1411 0.38 1.02 0.09 167 XM_UB99 1391 0.32 1.00 0.00 168 XM_B_DNDMA 1390 0.73 1.00 0.61 169 XMSexyCombo_01 1380 0.43 1.00 0.16 170 TR_Mismatch_TLD_01 1343 0.45 0.97 0.21 171 TR_XM_SEO4 1330 0.41 0.96 0.16 172 XMBody_78 1329 0.53 0.96 0.33 173 XM_BadFromFormat 1328 0.39 0.96 0.12 174 TR_XM_DK_SendGrid 1322 0.92 0.95 0.90 175 XM_ProductURIs 1319 0.61 0.95 0.46 176 TR_XM_Undi_Recip19 1312 0.35 0.95 0.08 177 RCVD_IN_PBL 1310 0.73 0.95 0.63 178 T_Symld_Words_02 1278 0.62 0.92 0.48 179 XMSubMetaSxObfu_03 1271 0.90 0.92 0.89 180 XM_PDF 1253 3.46 0.90 4.63 181 XM_B_COVIDMETA 1246 0.64 0.90 0.52 182 RCVD_IN_IADB_LISTED 1238 2.85 0.89 3.74 183 XMSlimDrugs 1237 0.29 0.89 0.01 184 TR_Symld_Words 1230 1.30 0.89 1.49 185 XMPhish11 1205 0.32 0.87 0.07 186 XMHTML_After_End 1202 0.53 0.87 0.37 187 XM_B_REG_HTML 1198 0.41 0.86 0.20 188 RDNS_DYNAMIC 1181 0.42 0.85 0.23 189 TR_XM_Base64_M1 1180 0.73 0.85 0.67 190 J_POPCORN_WO_D 1176 0.40 0.85 0.19 191 RCVD_IN_IADB_SPF 1175 2.51 0.85 3.27 192 XM_HighProb1 1173 0.27 0.85 0.01 193 XMWghtMeta_00 1166 0.27 0.84 0.01 194 RCVD_IN_IADB_DK 1153 2.20 0.83 2.82 195 RCVD_IN_IADB_SENDERID 1143 2.26 0.82 2.91 196 RELAYCOUNTRY_GB 1131 0.57 0.82 0.46 197 XMLngstWrd_00 1126 0.71 0.81 0.67 198 HTML_FONT_FACE_BAD 1121 0.54 0.81 0.42 199 XMPhish14 1120 0.48 0.81 0.32 200 NORDNS_LOW_CONTRAST 1094 0.27 0.79 0.03 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 263301 89.99 95.75 87.34 2 RELAYCOUNTRY_US 248581 82.52 82.65 82.46 3 DKIM_SIGNED 220605 77.82 87.92 73.18 4 XM_DK_Pass 216538 75.74 84.24 71.83 5 XM_B_Unicode 215258 75.90 85.68 71.41 6 DKIM_VALID 213348 74.70 83.23 70.77 7 DCC_CHECK_NEGATIVE 186861 50.17 24.47 61.99 8 BAYES_50 185631 55.34 41.77 61.58 9 DKIM_VALID_AU 169781 59.43 66.19 56.32 10 XMListUnsubscribeExists 143852 53.71 66.73 47.72 11 XM_B_SpammyWords 138204 53.42 69.89 45.85 12 XM_B_Unicode3 126736 45.26 52.26 42.04 13 DCC_CHECK 114475 49.35 74.10 37.97 14 RCVD_IN_MSPIKE_H2 106249 37.40 42.09 35.25 15 T_TM2_M_HEADER_IN_MSG 97031 29.42 23.39 32.19 16 HTML_FONT_LOW_CONTRAST 92926 32.45 35.99 30.83 17 DKIM_VALID_EF 85223 29.11 30.94 28.27 18 LOC_TINY_FONT_1 84194 34.28 48.08 27.93 19 FVGT_m_MULTI_ODD 73029 26.89 32.69 24.23 20 XMSubLong 66909 22.90 24.43 22.20 21 T_KAM_HTML_FONT_INVALID 62218 23.59 30.01 20.64 22 MIME_HTML_ONLY 60209 22.97 29.50 19.97 23 XM_B_SpammyWords2 55642 25.34 40.32 18.46 24 ALL_TRUSTED 43915 10.75 2.45 14.57 25 XM_Multi_Part_URI 40960 16.02 21.32 13.59 26 USER_IN_DEF_DKIM_WL 39472 9.70 2.31 13.09 27 TR_XM_DK_Unsub 38437 15.48 21.40 12.75 28 UNPARSEABLE_RELAY 35930 13.89 18.19 11.92 29 BAYES_00 33823 7.90 0.69 11.22 30 XM_Evil_Numbers_Gen 32696 10.88 10.94 10.85 31 XM_B_PhoneNumber 27112 7.96 5.72 8.99 32 XM_B_Unsub 26850 11.64 17.60 8.91 33 T_SCC_BODY_TEXT_LINE 25571 8.26 7.79 8.48 34 BOUNCE_MESSAGE 24971 6.68 3.20 8.28 35 ANY_BOUNCE_MESSAGE 24971 6.68 3.20 8.28 36 LotsOfNums_01 23964 7.87 7.71 7.95 37 TooManyTo_001 23886 6.69 4.00 7.92 38 TR_XM_DK_Bayes 23504 5.46 0.38 7.80 39 TR_XM_DK_Bayes1 23079 5.36 0.37 7.66 40 FSL_BULK_SIG 22566 8.51 10.73 7.49 41 XM_DKIMWhitelistDomains 20648 4.74 0.14 6.85 42 BAYES_60 20591 7.23 8.09 6.83 43 IN_ZIMBRA_NJ_WHITELIST 19761 4.53 0.12 6.56 44 TR_XM_DK_Bayes2 19588 4.54 0.27 6.50 45 TR_XM_BayesUnsub 19350 9.78 17.08 6.42 46 T_TooManySym_01 19093 5.10 2.40 6.33 47 TM2_M_VERY_LONG_WORD 18624 6.18 6.19 6.18 48 LOTS_OF_MONEY 17662 8.02 12.73 5.86 49 XM_H_Long_From01 17254 5.69 5.63 5.72 50 XM_H_GMP 16811 5.59 5.62 5.58 51 XM_B_Phish_Phrases 16669 6.89 9.86 5.53 52 TR_MAX_INTL_RELAY 16548 8.32 14.49 5.49 53 XM_DK_Undo_02 16114 16.01 39.22 5.35 54 BAYES_40 16103 4.25 1.87 5.34 55 RCVD_IN_MSPIKE_WL 15764 4.66 3.43 5.23 56 RCVD_IN_MSPIKE_H3 15764 4.66 3.43 5.23 57 MIME_QP_LONG_LINE 15624 4.58 3.28 5.18 58 MAY_BE_FORGED 14870 4.04 2.08 4.93 59 XMStrtUSub 14367 4.99 5.46 4.77 60 HTML_IMAGE_RATIO_04 14117 5.16 6.19 4.68 61 XM_PDF 13954 3.46 0.90 4.63 62 MPART_ALT_DIFF 13365 4.92 5.99 4.43 63 HTML_IMAGE_ONLY_32 13329 3.12 0.28 4.42 64 HTML_IMAGE_RATIO_02 12539 5.08 7.10 4.16 65 XM_B_SpammyWords3 12410 7.29 14.18 4.12 66 XM_UncommonTLD01 12166 4.55 5.67 4.04 67 TR_XM_SpammyWords4 11936 6.28 11.33 3.96 68 RELAYCOUNTRY_META 11523 7.44 15.32 3.82 69 RCVD_IN_VALIDITY_SAFE 11486 3.27 2.09 3.81 70 BOTNET_IPINHOSTNAME 11284 5.94 10.74 3.74 71 RCVD_IN_IADB_LISTED 11282 2.85 0.89 3.74 72 BAYES_20 11244 2.92 1.17 3.73 73 KHOP_HELO_FCRDNS 11133 3.43 2.86 3.69 74 XMSubMetaSx_00 10968 4.86 7.53 3.64 75 BAYES_99 10888 12.02 30.30 3.61 76 BAYES_80 10175 5.15 9.01 3.38 77 T_REMOTE_IMAGE 10118 2.84 1.72 3.36 78 RCVD_IN_IADB_SPF 9863 2.51 0.85 3.27 79 T_TooManySym_02 9234 2.28 0.57 3.06 80 RCVD_IN_VALIDITY_CERTIFIED 9078 2.56 1.59 3.01 81 XMNumbers 9021 3.13 3.41 2.99 82 RCVD_IN_IADB_SENDERID 8782 2.26 0.82 2.91 83 XM_B_SpammyTLD 8563 3.25 4.15 2.84 84 RCVD_IN_IADB_DK 8512 2.20 0.83 2.82 85 BAYES_999 8383 9.33 23.59 2.78 86 TR_XM_DKIM_Undo 8289 10.91 28.65 2.75 87 MIME_HTML_ONLY_MULTI 8094 2.97 3.59 2.68 88 XM_Body_Dirty_Words 8080 4.28 7.76 2.68 89 MAILING_LIST_MULTI 8075 2.60 2.43 2.68 90 TooManyTo_002 7973 2.04 0.72 2.64 91 RCVD_IN_IADB_VOUCHED 7594 1.80 0.25 2.52 92 HTML_IMAGE_RATIO_06 7524 2.75 3.32 2.50 93 INVALID_MSGID 7344 1.75 0.27 2.44 94 DKIM_INVALID 7257 3.12 4.68 2.41 95 HTML_MIME_NO_HTML_TAG 7099 2.31 2.20 2.35 96 HTML_IMAGE_RATIO_08 7066 2.41 2.54 2.34 97 T_XMDrugObfuBody_08 6915 2.68 3.52 2.29 98 MIME_CHARSET_FARAWAY 6887 2.01 1.42 2.28 99 BAYES_05 6601 1.67 0.55 2.19 100 MIME_HTML_MOSTLY 6450 2.52 3.36 2.14 101 CHARSET_FARAWAY_HEADER 6440 1.83 1.16 2.14 102 BAYES_95 6363 3.06 5.12 2.11 103 TR_XM_SpammyRelay 6348 4.81 10.70 2.11 104 XM_CamelCaseFrm001 6308 2.61 3.72 2.09 105 TO_MALFORMED 6272 1.43 0.01 2.08 106 T_XMDrugObfuBody_14 5980 2.88 4.84 1.98 107 TM2_M_URI_OPT_OUT 5938 2.14 2.50 1.97 108 BOTNET 5683 4.21 9.28 1.89 109 URI_NOVOWEL 5680 1.65 1.15 1.88 110 XM_B_URI_Unicode 5571 2.25 3.13 1.85 111 FROM_EXCESS_BASE64 5477 2.02 2.45 1.82 112 XMSexyCombo_05 5296 2.74 4.87 1.76 113 XMDiploma_00 5254 2.36 3.70 1.74 114 RCVD_IN_IADB_OPTIN 5214 1.23 0.15 1.73 115 XM_DK_Undo_01 5189 1.68 1.59 1.72 116 TR_XM_UnparsRelay 4946 4.01 9.17 1.64 117 TR_XM_PhishingBody 4645 2.68 5.16 1.54 118 TR_Symld_Words 4503 1.30 0.89 1.49 119 SUBJ_ALL_CAPS 4495 1.57 1.76 1.49 120 XM_B_Investor 4473 2.47 4.63 1.48 121 TooManyTo_003 4365 1.19 0.63 1.45 122 TR_DCC_Bayes_99 4325 7.71 21.37 1.43 123 IN_HORDE_ADDRESS_BOOK 4304 1.01 0.11 1.43 124 XMStockSpam_06 4196 1.67 2.27 1.39 125 XM_SendGrid 4187 1.61 2.09 1.39 126 XM_B_Unsub2 4136 1.85 2.89 1.37 127 UNTRUSTED_Relay 4117 2.85 6.07 1.37 128 TR_XM_SpammyWords5 4115 1.94 3.19 1.37 129 FROM_GOV_DKIM_AU 4112 0.98 0.15 1.36 130 XMGappySubj_01 4022 1.07 0.49 1.33 131 XM_SPF_SoftFail 3902 1.79 2.86 1.29 132 T_TooManySym_03 3900 0.94 0.18 1.29 133 XM_GoogleGroups 3865 1.08 0.64 1.28 134 RELAYCOUNTRY_CA 3328 2.58 5.80 1.10 135 TVD_SPACE_RATIO 3288 0.85 0.31 1.09 136 HELO_NODOT 3253 0.78 0.12 1.08 137 HELO_NO_DOMAIN 3246 0.77 0.09 1.08 138 TooManyTo_004 3217 0.91 0.57 1.07 139 URI_HEX 3209 1.22 1.56 1.06 140 XMCapTrack 3145 0.84 0.39 1.04 141 XM_OfRef6 3037 1.56 2.76 1.01 142 T_FILL_THIS_FORM_SHORT 2708 1.14 1.67 0.90 143 TR_XM_DK_SendGrid 2705 0.92 0.95 0.90 144 XMGenDplmaNmb 2699 1.19 1.82 0.90 145 XMSubMetaSxObfu_03 2690 0.90 0.92 0.89 146 XMBrknScrpt_02 2649 1.19 1.86 0.88 147 TooManyTo_005 2628 0.76 0.53 0.87 148 DKIM_ADSP_CUSTOM_MED 2611 1.01 1.34 0.87 149 XM_H_PHPMailer 2507 0.72 0.49 0.83 150 RELAYCOUNTRY_AU 2496 1.38 2.58 0.83 151 XM_UB50 2490 1.54 3.10 0.83 152 XM_H_Long_From02 2467 0.95 1.25 0.82 153 T_XMHurry_00 2442 1.29 2.34 0.81 154 XM_ShortIntro_01 2428 0.67 0.37 0.81 155 T_XMDrugObfuBody_00 2406 1.14 1.89 0.80 156 T_OBFU_PDF_ATTACH 2359 0.57 0.11 0.78 157 TVD_RCVD_IP 2258 0.74 0.71 0.75 158 SpammyFromTLD_01 2200 0.99 1.57 0.73 159 TR_MetaPhish_Combo_01 2057 0.97 1.59 0.68 160 TR_XM_Base64_M1 2034 0.73 0.85 0.67 161 XMLngstWrd_00 2015 0.71 0.81 0.67 162 XMBdyGiftCard01 2004 0.82 1.17 0.66 163 XMGappySubj_02 1946 0.45 0.04 0.65 164 LOW_PRICE 1926 0.52 0.27 0.64 165 RCVD_IN_PBL 1913 0.73 0.95 0.63 166 XMNoVowels 1904 0.59 0.50 0.63 167 T_TVD_MIME_NO_HEADERS 1892 0.44 0.04 0.63 168 HTML_TAG_BALANCE_BODY 1873 0.80 1.20 0.62 169 XM_B_COPY_HTML 1871 0.82 1.27 0.62 170 XMPhish30 1840 0.89 1.50 0.61 171 XM_B_SpammyWords4 1834 1.15 2.34 0.61 172 XM_B_DNDMA 1830 0.73 1.00 0.61 173 HTTPS_HTTP_MISMATCH 1804 0.86 1.44 0.60 174 XM_B_FormFill 1766 0.41 0.02 0.59 175 XMBody_95 1757 0.43 0.11 0.58 176 TR_XM_SpammyWords2 1744 3.92 11.18 0.58 177 XMSubMetaSx_01 1719 0.52 0.40 0.57 178 FORGED_GMAIL_RCVD 1675 0.71 1.04 0.56 179 NML_ADSP_CUSTOM_MED 1672 0.74 1.13 0.55 180 XMBSHREFv2 1665 0.50 0.39 0.55 181 MPART_ALT_DIFF_COUNT 1623 0.70 1.06 0.54 182 URI_TRY_3LD 1597 0.80 1.39 0.53 183 SpammyFromTLD_02 1590 1.05 2.18 0.53 184 XM_B_COVIDMETA 1577 0.64 0.90 0.52 185 HELO_MISC_IP 1482 0.35 0.05 0.49 186 RCVD_IN_BL_SPAMCOP_NET 1478 2.92 8.21 0.49 187 T_Symld_Words_02 1439 0.62 0.92 0.48 188 XMLngstWrd_01 1428 0.49 0.53 0.47 189 XMBody_17 1425 1.04 2.28 0.47 190 MSGID_FROM_MTA_HEADER 1412 0.37 0.14 0.47 191 LongTLD 1400 0.75 1.39 0.46 192 TM2_M_OBFU_COMMENT 1400 0.69 1.19 0.46 193 RELAYCOUNTRY_GB 1396 0.57 0.82 0.46 194 XMSubMetaI_00 1382 0.53 0.69 0.46 195 XM_ProductURIs 1381 0.61 0.95 0.46 196 HTML_IMAGE_ONLY_20 1351 0.66 1.11 0.45 197 FONT_INVIS_MSGID 1339 0.34 0.11 0.44 198 TR_XM_COVIDMETA5 1324 0.31 0.03 0.44 199 TM2_M_BODY_EMPTY 1309 0.32 0.08 0.43 200 XMDateMe_00 1300 0.45 0.49 0.43 ----------------------------------------------------------------------