Email: 444363 Autolearn: 0 AvgScore: 5.17 AvgScanTime: 1.29 sec Spam: 134607 Autolearn: 0 AvgScore: 15.08 AvgScanTime: 1.44 sec Ham: 309756 Autolearn: 0 AvgScore: 0.86 AvgScanTime: 1.22 sec Time Spent Running SA: 158.68 hours Time Spent Processing Spam: 54.00 hours Time Spent Processing Ham: 104.68 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 125040 89.28 92.89 87.71 2 DKIM_SIGNED 117647 77.17 87.40 72.72 3 XM_DK_Pass 112194 74.98 83.35 71.35 4 XM_B_Unicode 111139 73.97 82.57 70.24 5 DKIM_VALID 111101 73.94 82.54 70.20 6 RELAYCOUNTRY_US 106762 80.61 79.31 81.18 7 DCC_CHECK 94509 43.07 70.21 31.28 8 XM_B_SpammyWords 93180 52.38 69.22 45.06 9 XMListUnsubscribeExists 88443 51.53 65.70 45.38 10 DKIM_VALID_AU 88121 60.11 65.47 57.78 11 XM_B_Unicode3 64740 42.94 48.10 40.70 12 LOC_TINY_FONT_1 63208 33.43 46.96 27.55 13 BAYES_50 54036 54.65 40.14 60.95 14 XM_B_SpammyWords2 53561 25.01 39.79 18.58 15 XM_DK_Undo_02 53152 15.18 39.49 4.62 16 HTML_FONT_LOW_CONTRAST 46535 31.13 34.57 29.63 17 BAYES_99 42391 11.97 31.49 3.49 18 FVGT_m_MULTI_ODD 42278 26.57 31.41 24.47 19 DKIM_VALID_EF 42015 30.79 31.21 30.60 20 MIME_HTML_ONLY 40279 22.20 29.92 18.85 21 T_KAM_HTML_FONT_INVALID 39922 23.42 29.66 20.71 22 TR_XM_DKIM_Undo 39059 10.16 29.02 1.97 23 DCC_CHECK_NEGATIVE 38066 56.43 28.28 68.67 24 XMSubLong 33180 23.30 24.65 22.71 25 BAYES_999 31539 8.95 23.43 2.66 26 XM_Multi_Part_URI 31170 15.72 23.16 12.49 27 T_TM2_M_HEADER_IN_MSG 30641 30.37 22.76 33.67 28 TR_XM_DK_Unsub 29943 15.78 22.24 12.97 29 TR_DCC_Bayes_99 27450 7.05 20.39 1.25 30 RELAYCOUNTRY_META 25579 8.27 19.00 3.60 31 RCVD_IN_MSPIKE_H2 24468 16.64 18.18 15.97 32 XM_B_Unsub 23411 10.98 17.39 8.19 33 TR_XM_BayesUnsub 22785 9.61 16.93 6.42 34 UNPARSEABLE_RELAY 22510 13.38 16.72 11.93 35 TR_MAX_INTL_RELAY 20800 8.83 15.45 5.95 36 XM_B_SpammyWords3 20733 8.46 15.40 5.45 37 TR_XM_SpammyRelay 18339 5.30 13.62 1.69 38 LOTS_OF_MONEY 18048 8.43 13.41 6.27 39 TR_XM_SpammyWords4 16572 6.67 12.31 4.22 40 BOTNET_IPINHOSTNAME 15205 5.58 11.30 3.09 41 RCVD_IN_BL_SPAMCOP_NET 14634 3.54 10.87 0.35 42 XM_Evil_Numbers_Gen 14342 9.77 10.65 9.38 43 BOTNET 13698 3.95 10.18 1.24 44 TR_XM_SpammyWords2 13473 3.39 10.01 0.51 45 RCVD_IN_MSPIKE_WL 13096 15.38 9.73 17.83 46 BAYES_80 12730 5.41 9.46 3.65 47 TR_XM_UnparsRelay 12178 3.94 9.05 1.72 48 XM_B_Phish_Phrases 11306 5.56 8.40 4.32 49 FSL_BULK_SIG 10928 5.04 8.12 3.70 50 BAYES_60 10871 7.20 8.08 6.83 51 UNTRUSTED_Relay 10490 3.63 7.79 1.83 52 RCVD_IN_MSPIKE_BL 10342 2.93 7.68 0.86 53 TR_XM_MSPIKECOMBO 10339 2.93 7.68 0.86 54 RELAYCOUNTRY_CA 9361 2.62 6.95 0.73 55 MPART_ALT_DIFF 9072 5.16 6.74 4.47 56 XM_UncommonTLD01 8901 5.02 6.61 4.32 57 LotsOfNums_01 8564 8.53 6.36 9.48 58 HTML_IMAGE_RATIO_02 8356 4.84 6.21 4.25 59 XMSubMetaSx_00 8240 4.20 6.12 3.36 60 XM_Body_Dirty_Words 7747 3.67 5.76 2.76 61 TR_XM_SpammyWords3 7604 2.02 5.65 0.45 62 XM_B_PhoneNumber 7524 8.29 5.59 9.47 63 BAYES_95 7428 3.27 5.52 2.30 64 XM_H_GMP 7246 5.81 5.38 5.99 65 XM_H_Long_From01 7160 5.43 5.32 5.47 66 RCVD_IN_MSPIKE_H3 6789 7.24 5.04 8.20 67 XM_B_Investor 6691 2.52 4.97 1.46 68 DKIM_INVALID 6546 3.23 4.86 2.52 69 HTML_IMAGE_RATIO_04 6164 4.56 4.58 4.56 70 RCVD_IN_MSPIKE_L3 6054 1.92 4.50 0.79 71 XMStrtUSub 6044 4.99 4.49 5.21 72 TR_XM_PhishingBody 5980 2.44 4.44 1.57 73 TR_XM_SPAMCOP 5870 1.40 4.36 0.11 74 XM_URI_RBL 5816 1.58 4.32 0.39 75 XMSexyCombo_05 5571 1.90 4.14 0.93 76 XMNumbers 5528 3.66 4.11 3.47 77 XM_OfRef6 5444 2.04 4.04 1.18 78 TR_XM_SpammyWords5 5267 2.12 3.91 1.34 79 XM_B_SpammyTLD 5255 2.89 3.90 2.45 80 T_XMDrugObfuBody_14 5144 2.79 3.82 2.34 81 TooManyTo_001 5108 7.12 3.79 8.57 82 T_XMDrugObfuBody_08 5054 2.17 3.75 1.48 83 XM_SPF_SoftFail 4911 1.94 3.65 1.19 84 HTML_IMAGE_RATIO_06 4902 2.91 3.64 2.59 85 MIME_HTML_ONLY_MULTI 4842 2.73 3.60 2.36 86 TM2_M_VERY_LONG_WORD 4832 4.47 3.59 4.86 87 MIME_HTML_MOSTLY 4831 2.71 3.59 2.33 88 XM_UB50 4754 1.95 3.53 1.27 89 KHOP_HELO_FCRDNS 4679 3.49 3.48 3.50 90 HTML_IMAGE_RATIO_08 4424 2.61 3.29 2.31 91 XM_B_Unsub2 4403 1.89 3.27 1.28 92 RCVD_IN_VALIDITY_RPBL 4284 1.00 3.18 0.05 93 TM2_M_URI_OPT_OUT 4208 2.11 3.13 1.67 94 XM_B_SpammyWords4 4086 1.50 3.04 0.83 95 XMDiploma_00 3966 1.98 2.95 1.56 96 TR_XM_NoHeaderRelay 3955 0.99 2.94 0.14 97 MIME_QP_LONG_LINE 3862 4.09 2.87 4.63 98 RELAYCOUNTRY_AU 3825 1.13 2.84 0.39 99 T_TooManySym_01 3686 4.95 2.74 5.91 100 TR_XM_INTL_Spamhaus 3672 1.14 2.73 0.45 101 RCVD_IN_MSPIKE_L4 3633 0.86 2.70 0.06 102 XM_CamelCaseFrm001 3599 2.07 2.67 1.81 103 USER_IN_DEF_DKIM_WL 3585 9.09 2.66 11.88 104 URI_TRY_3LD 3419 1.13 2.54 0.51 105 RCVD_IN_SBL_CSS 3382 0.81 2.51 0.06 106 RCVD_IN_VALIDITY_SAFE 3272 2.95 2.43 3.18 107 RCVD_IN_MSPIKE_H5 3242 4.79 2.41 5.82 108 T_FILL_THIS_FORM_SHORT 3236 1.27 2.40 0.78 109 TR_XM_MSPIKECOMBO2 3207 0.76 2.38 0.05 110 XM_B_URI_Unicode 3150 2.22 2.34 2.17 111 RCVD_IN_XBL 3090 0.71 2.30 0.02 112 RCVD_IN_MSPIKE_H4 3065 3.35 2.28 3.82 113 SUBJ_ALL_CAPS 3004 1.75 2.23 1.55 114 XMBody_17 3003 1.02 2.23 0.50 115 XM_ProductURIs 2960 0.99 2.20 0.46 116 ALL_TRUSTED 2892 11.57 2.15 15.66 117 TR_XM_INV_DKIM 2841 0.65 2.11 0.01 118 RCVD_IN_PSBL 2796 0.96 2.08 0.47 119 XMStockSpam_06 2774 1.74 2.06 1.61 120 FROM_EXCESS_BASE64 2670 1.56 1.98 1.37 121 MAILING_LIST_MULTI 2665 2.58 1.98 2.84 122 SpammyFromTLD_02 2637 0.79 1.96 0.28 123 RELAYCOUNTRY_FR 2624 0.86 1.95 0.38 124 XM_HighProb1 2599 0.59 1.93 0.00 125 T_XMHurry_00 2566 0.99 1.91 0.59 126 HTML_MIME_NO_HTML_TAG 2556 2.80 1.90 3.19 127 RCVD_IN_VALIDITY_CERTIFIED 2544 2.48 1.89 2.74 128 XMGenDplmaNmb 2461 1.21 1.83 0.94 129 TM2_M_OBFU_COMMENT 2438 0.68 1.81 0.18 130 MPART_ALT_DIFF_COUNT 2417 0.89 1.80 0.50 131 XMPhish30 2416 0.87 1.79 0.46 132 MultiRelay_CC 2390 0.79 1.78 0.36 133 TR_XM_MaxSPIKE 2385 0.57 1.77 0.05 134 XM_H_Long_From02 2383 1.08 1.77 0.78 135 SpammyFromTLD_01 2316 1.01 1.72 0.70 136 TR_LOTS_OF_MONEY3 2308 0.79 1.71 0.38 137 HTML_TAG_BALANCE_BODY 2305 0.90 1.71 0.55 138 XMBrknScrpt_02 2287 1.21 1.70 1.00 139 RCVD_IN_PBL 2279 1.19 1.69 0.96 140 BAYES_40 2263 4.95 1.68 6.38 141 XMBdyGiftCard01 2233 0.65 1.66 0.22 142 XM_B_COVIDMETA 2230 0.61 1.66 0.15 143 XM_SendGrid 2173 1.53 1.61 1.50 144 TR_XM_RelayPhish 2117 0.53 1.57 0.08 145 RDNS_DYNAMIC 2091 0.58 1.55 0.15 146 ANY_BOUNCE_MESSAGE 2018 5.83 1.50 7.72 147 BOUNCE_MESSAGE 2018 5.83 1.50 7.71 148 XM_B_SEO 2008 0.61 1.49 0.22 149 RCVD_IN_ZEN_LASTEXTERNAL 2007 0.45 1.49 0.00 150 SHORTCIRCUIT 2007 0.45 1.49 0.00 151 T_XMDrugObfuBody_00 1976 1.01 1.47 0.81 152 RCVD_IN_IADB_LISTED 1967 2.39 1.46 2.79 153 BOTNET_NORDNS 1956 0.45 1.45 0.01 154 XM_UB99 1934 0.44 1.44 0.00 155 URI_HEX 1851 1.30 1.38 1.26 156 TR_XM_InvalidRelay 1849 0.42 1.37 0.01 157 TR_LOTS_OF_MONEY2 1806 0.58 1.34 0.25 158 T_MONEY_PERCENT 1806 0.58 1.34 0.25 159 T_REMOTE_IMAGE 1797 3.03 1.33 3.76 160 URI_NOVOWEL 1786 1.21 1.33 1.16 161 DKIM_ADSP_CUSTOM_MED 1747 0.98 1.30 0.85 162 XMBody_78 1745 0.61 1.30 0.32 163 XMSubMetaI_00 1710 0.76 1.27 0.54 164 XM_B_Phish66 1680 0.67 1.25 0.42 165 RCVD_IN_IADB_SPF 1654 2.11 1.23 2.49 166 XM_DK_Undo_01 1650 1.48 1.23 1.59 167 THIS_AD 1648 0.63 1.22 0.37 168 XM_B_COPY_HTML 1634 0.75 1.21 0.54 169 T_HTML_ATTACH 1586 0.39 1.18 0.04 170 FILL_THIS_FORM 1567 0.64 1.16 0.41 171 TR_Mismatch_TLD_02 1559 0.56 1.16 0.30 172 STY_INVIS_DIRECT 1521 0.54 1.13 0.29 173 RCVD_IN_IADB_DK 1520 1.84 1.13 2.15 174 NML_ADSP_CUSTOM_MED 1517 0.70 1.13 0.51 175 TR_XM_SEO4 1505 0.41 1.12 0.10 176 TVD_RCVD_IP 1502 1.20 1.12 1.23 177 XM_UB60 1501 0.39 1.12 0.08 178 TR_XM_COVIDMETA4 1499 0.37 1.11 0.04 179 XMMoneyMeta_00 1487 0.64 1.10 0.44 180 RCVD_IN_IADB_SENDERID 1480 1.89 1.10 2.24 181 BAYES_20 1463 3.21 1.09 4.14 182 DIET_1 1459 0.48 1.08 0.21 183 XMSlimDrugH 1421 0.77 1.06 0.64 184 URI_TRUNCATED 1415 0.38 1.05 0.09 185 TR_XM_GMP_BULK_SIG 1408 0.39 1.05 0.11 186 TR_MetaPhish_Combo_01 1400 0.86 1.04 0.78 187 URIBL_SBL_A 1399 0.32 1.04 0.00 188 URIBL_SBL 1399 0.32 1.04 0.00 189 SH_BODYURI_REVERSE_SBL 1396 0.32 1.04 0.00 190 XM_PDF 1369 3.83 1.02 5.05 191 HELO_DYNAMIC_SPLIT_IP 1344 0.31 1.00 0.01 192 T_FILL_THIS_FORM_FRAUD_PHISH 1328 0.36 0.99 0.08 193 TR_Symld_Words 1313 1.53 0.98 1.78 194 XM_UB80 1291 0.30 0.96 0.02 195 TR_XM_PHPForged 1291 0.49 0.96 0.28 196 SHOPIFY_IMG_NOT_RCVD_SFY 1271 0.45 0.94 0.23 197 HTTPS_HTTP_MISMATCH 1261 0.87 0.94 0.84 198 URI_NO_WWW_INFO_CGI 1255 0.30 0.93 0.03 199 TR_XM_FormFill2 1251 0.47 0.93 0.28 200 TR_XM_PHPDW 1251 0.48 0.93 0.28 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 271693 89.28 92.89 87.71 2 RELAYCOUNTRY_US 251455 80.61 79.31 81.18 3 DKIM_SIGNED 225251 77.17 87.40 72.72 4 XM_DK_Pass 220996 74.98 83.35 71.35 5 XM_B_Unicode 217562 73.97 82.57 70.24 6 DKIM_VALID 217451 73.94 82.54 70.20 7 DCC_CHECK_NEGATIVE 212703 56.43 28.28 68.67 8 BAYES_50 188811 54.65 40.14 60.95 9 DKIM_VALID_AU 178985 60.11 65.47 57.78 10 XMListUnsubscribeExists 140552 51.53 65.70 45.38 11 XM_B_SpammyWords 139578 52.38 69.22 45.06 12 XM_B_Unicode3 126060 42.94 48.10 40.70 13 T_TM2_M_HEADER_IN_MSG 104290 30.37 22.76 33.67 14 DCC_CHECK 96893 43.07 70.21 31.28 15 DKIM_VALID_EF 94795 30.79 31.21 30.60 16 HTML_FONT_LOW_CONTRAST 91779 31.13 34.57 29.63 17 LOC_TINY_FONT_1 85330 33.43 46.96 27.55 18 FVGT_m_MULTI_ODD 75805 26.57 31.41 24.47 19 XMSubLong 70356 23.30 24.65 22.71 20 T_KAM_HTML_FONT_INVALID 64154 23.42 29.66 20.71 21 MIME_HTML_ONLY 58376 22.20 29.92 18.85 22 XM_B_SpammyWords2 57563 25.01 39.79 18.58 23 RCVD_IN_MSPIKE_WL 55243 15.38 9.73 17.83 24 RCVD_IN_MSPIKE_H2 49470 16.64 18.18 15.97 25 ALL_TRUSTED 48501 11.57 2.15 15.66 26 TR_XM_DK_Unsub 40173 15.78 22.24 12.97 27 XM_Multi_Part_URI 38685 15.72 23.16 12.49 28 UNPARSEABLE_RELAY 36958 13.38 16.72 11.93 29 USER_IN_DEF_DKIM_WL 36813 9.09 2.66 11.88 30 BAYES_00 30597 7.05 0.53 9.88 31 LotsOfNums_01 29359 8.53 6.36 9.48 32 XM_B_PhoneNumber 29320 8.29 5.59 9.47 33 XM_Evil_Numbers_Gen 29064 9.77 10.65 9.38 34 TooManyTo_001 26544 7.12 3.79 8.57 35 RCVD_IN_MSPIKE_H3 25391 7.24 5.04 8.20 36 XM_B_Unsub 25383 10.98 17.39 8.19 37 ANY_BOUNCE_MESSAGE 23899 5.83 1.50 7.72 38 BOUNCE_MESSAGE 23896 5.83 1.50 7.71 39 BAYES_60 21143 7.20 8.08 6.83 40 XM_DKIMWhitelistDomains 20862 4.70 0.01 6.73 41 TR_XM_DK_Bayes 20447 4.71 0.36 6.60 42 TR_XM_DK_Bayes1 20076 4.63 0.36 6.48 43 TR_XM_BayesUnsub 19900 9.61 16.93 6.42 44 BAYES_40 19747 4.95 1.68 6.38 45 LOTS_OF_MONEY 19420 8.43 13.41 6.27 46 XM_H_GMP 18567 5.81 5.38 5.99 47 TR_MAX_INTL_RELAY 18419 8.83 15.45 5.95 48 T_TooManySym_01 18296 4.95 2.74 5.91 49 RCVD_IN_MSPIKE_H5 18026 4.79 2.41 5.82 50 TR_XM_DK_Bayes2 17007 3.91 0.27 5.49 51 XM_H_Long_From01 16947 5.43 5.32 5.47 52 XM_B_SpammyWords3 16877 8.46 15.40 5.45 53 XMStrtUSub 16148 4.99 4.49 5.21 54 XM_PDF 15656 3.83 1.02 5.05 55 TM2_M_VERY_LONG_WORD 15052 4.47 3.59 4.86 56 MIME_QP_LONG_LINE 14327 4.09 2.87 4.63 57 XM_DK_Undo_02 14300 15.18 39.49 4.62 58 HTML_IMAGE_RATIO_04 14115 4.56 4.58 4.56 59 MPART_ALT_DIFF 13841 5.16 6.74 4.47 60 XM_B_Phish_Phrases 13393 5.56 8.40 4.32 61 XM_UncommonTLD01 13393 5.02 6.61 4.32 62 HTML_IMAGE_RATIO_02 13173 4.84 6.21 4.25 63 TR_XM_SpammyWords4 13086 6.67 12.31 4.22 64 BAYES_20 12816 3.21 1.09 4.14 65 RCVD_IN_MSPIKE_H4 11826 3.35 2.28 3.82 66 T_REMOTE_IMAGE 11653 3.03 1.33 3.76 67 FSL_BULK_SIG 11474 5.04 8.12 3.70 68 BAYES_80 11293 5.41 9.46 3.65 69 RELAYCOUNTRY_META 11164 8.27 19.00 3.60 70 KHOP_HELO_FCRDNS 10844 3.49 3.48 3.50 71 BAYES_99 10815 11.97 31.49 3.49 72 XMNumbers 10746 3.66 4.11 3.47 73 XMSubMetaSx_00 10406 4.20 6.12 3.36 74 HTML_MIME_NO_HTML_TAG 9885 2.80 1.90 3.19 75 T_TooManySym_02 9874 2.46 0.79 3.19 76 RCVD_IN_VALIDITY_SAFE 9847 2.95 2.43 3.18 77 BOTNET_IPINHOSTNAME 9581 5.58 11.30 3.09 78 MAILING_LIST_MULTI 8805 2.58 1.98 2.84 79 TooManyTo_002 8750 2.19 0.73 2.82 80 RCVD_IN_IADB_LISTED 8637 2.39 1.46 2.79 81 XM_Body_Dirty_Words 8559 3.67 5.76 2.76 82 RCVD_IN_VALIDITY_CERTIFIED 8492 2.48 1.89 2.74 83 BAYES_999 8247 8.95 23.43 2.66 84 HTML_IMAGE_RATIO_06 8009 2.91 3.64 2.59 85 DKIM_INVALID 7800 3.23 4.86 2.52 86 RCVD_IN_IADB_SPF 7722 2.11 1.23 2.49 87 XM_B_SpammyTLD 7603 2.89 3.90 2.45 88 BAYES_05 7411 1.82 0.52 2.39 89 INVALID_MSGID 7379 1.72 0.19 2.38 90 MIME_HTML_ONLY_MULTI 7300 2.73 3.60 2.36 91 MIME_CHARSET_FARAWAY 7251 1.88 0.82 2.34 92 T_XMDrugObfuBody_14 7237 2.79 3.82 2.34 93 MIME_HTML_MOSTLY 7223 2.71 3.59 2.33 94 HTML_IMAGE_RATIO_08 7170 2.61 3.29 2.31 95 BAYES_95 7123 3.27 5.52 2.30 96 RCVD_IN_IADB_SENDERID 6931 1.89 1.10 2.24 97 XM_B_URI_Unicode 6729 2.22 2.34 2.17 98 RCVD_IN_IADB_DK 6664 1.84 1.13 2.15 99 MSGID_NOFQDN1 6593 1.49 0.01 2.13 100 CHARSET_FARAWAY_HEADER 6364 1.62 0.62 2.05 101 TO_MALFORMED 6339 1.44 0.05 2.05 102 TR_XM_DKIM_Undo 6094 10.16 29.02 1.97 103 TooManyTo_003 5733 1.48 0.62 1.85 104 RCVD_IN_IADB_VOUCHED 5698 1.54 0.86 1.84 105 UNTRUSTED_Relay 5654 3.63 7.79 1.83 106 XM_CamelCaseFrm001 5604 2.07 2.67 1.81 107 TR_Symld_Words 5503 1.53 0.98 1.78 108 TR_XM_UnparsRelay 5318 3.94 9.05 1.72 109 TR_XM_SpammyRelay 5229 5.30 13.62 1.69 110 TM2_M_URI_OPT_OUT 5162 2.11 3.13 1.67 111 XMStockSpam_06 4977 1.74 2.06 1.61 112 XM_DK_Undo_01 4919 1.48 1.23 1.59 113 TR_XM_PhishingBody 4859 2.44 4.44 1.57 114 XMDiploma_00 4832 1.98 2.95 1.56 115 SUBJ_ALL_CAPS 4792 1.75 2.23 1.55 116 XM_SendGrid 4640 1.53 1.61 1.50 117 T_XMDrugObfuBody_08 4575 2.17 3.75 1.48 118 XM_B_Investor 4525 2.52 4.97 1.46 119 HELO_NODOT 4398 1.07 0.26 1.42 120 HELO_NO_DOMAIN 4392 1.05 0.19 1.42 121 XMLngstWrd_00 4354 1.13 0.49 1.41 122 FROM_EXCESS_BASE64 4255 1.56 1.98 1.37 123 TooManyTo_004 4201 1.10 0.52 1.36 124 TR_XM_SpammyWords5 4147 2.12 3.91 1.34 125 IN_HORDE_ADDRESS_BOOK 4130 0.95 0.07 1.33 126 XM_ShortIntro_01 4116 1.09 0.55 1.33 127 RCVD_IN_IADB_OPTIN 4081 1.09 0.57 1.32 128 XM_B_Unsub2 3980 1.89 3.27 1.28 129 XM_UB50 3933 1.95 3.53 1.27 130 URI_HEX 3913 1.30 1.38 1.26 131 XMCapTrack 3888 1.04 0.55 1.26 132 TR_DCC_Bayes_99 3870 7.05 20.39 1.25 133 XM_GoogleGroups 3859 1.09 0.72 1.25 134 BOTNET 3837 3.95 10.18 1.24 135 T_TVD_MIME_NO_HEADERS 3824 0.88 0.07 1.23 136 TVD_RCVD_IP 3822 1.20 1.12 1.23 137 T_TooManySym_03 3819 0.92 0.20 1.23 138 XM_SPF_SoftFail 3696 1.94 3.65 1.19 139 XM_OfRef6 3641 2.04 4.04 1.18 140 URI_NOVOWEL 3598 1.21 1.33 1.16 141 TooManyTo_005 3500 0.93 0.46 1.13 142 TR_XM_DK_SendGrid 3206 0.98 0.86 1.04 143 HTML_IMAGE_ONLY_32 3111 0.77 0.23 1.00 144 TVD_SPACE_RATIO 3094 0.77 0.24 1.00 145 XMBrknScrpt_02 3085 1.21 1.70 1.00 146 RCVD_IN_PBL 2987 1.19 1.69 0.96 147 XMGenDplmaNmb 2905 1.21 1.83 0.94 148 XMSexyCombo_05 2882 1.90 4.14 0.93 149 XM_H_PHPMailer 2728 0.77 0.52 0.88 150 RCVD_IN_MSPIKE_BL 2675 2.93 7.68 0.86 151 TR_XM_MSPIKECOMBO 2673 2.93 7.68 0.86 152 DKIM_ADSP_CUSTOM_MED 2625 0.98 1.30 0.85 153 HTTPS_HTTP_MISMATCH 2596 0.87 0.94 0.84 154 MSGID_FROM_MTA_HEADER 2585 0.65 0.23 0.83 155 XM_B_SpammyWords4 2572 1.50 3.04 0.83 156 T_OBFU_PDF_ATTACH 2566 0.69 0.39 0.83 157 T_XMDrugObfuBody_00 2507 1.01 1.47 0.81 158 XMGappySubj_01 2474 0.61 0.18 0.80 159 RCVD_IN_MSPIKE_L3 2459 1.92 4.50 0.79 160 XM_H_Long_From02 2429 1.08 1.77 0.78 161 T_FILL_THIS_FORM_SHORT 2427 1.27 2.40 0.78 162 TR_MetaPhish_Combo_01 2412 0.86 1.04 0.78 163 HTML_IMAGE_ONLY_20 2306 0.78 0.87 0.74 164 RELAYCOUNTRY_CA 2271 2.62 6.95 0.73 165 TR_XM_Base64_M1 2237 0.76 0.85 0.72 166 SpammyFromTLD_01 2160 1.01 1.72 0.70 167 XMBSHREFv2 2124 0.59 0.36 0.69 168 RELAYCOUNTRY_GB 2001 0.68 0.76 0.65 169 XMSlimDrugH 1992 0.77 1.06 0.64 170 T_Symld_Words_02 1945 0.65 0.70 0.63 171 TO_NO_BRKTS_HTML_ONLY 1942 0.49 0.17 0.63 172 XMNoVowels 1848 0.57 0.52 0.60 173 T_XMHurry_00 1828 0.99 1.91 0.59 174 TRACKER_ID 1807 0.44 0.11 0.58 175 HTML_TAG_BALANCE_BODY 1709 0.90 1.71 0.55 176 XM_B_COPY_HTML 1686 0.75 1.21 0.54 177 XMSubMetaI_00 1673 0.76 1.27 0.54 178 NML_ADSP_CUSTOM_MED 1595 0.70 1.13 0.51 179 TR_XM_SpammyWords2 1585 3.39 10.01 0.51 180 URI_TRY_3LD 1581 1.13 2.54 0.51 181 XM_B_DNDMA 1563 0.59 0.78 0.50 182 XMBody_17 1546 1.02 2.23 0.50 183 MPART_ALT_DIFF_COUNT 1534 0.89 1.80 0.50 184 FORGED_GMAIL_RCVD 1517 0.60 0.87 0.49 185 LongTLD 1515 0.52 0.58 0.49 186 XMGappySubj_02 1509 0.35 0.05 0.49 187 FROM_GOV_DKIM_AU 1504 0.39 0.16 0.49 188 RCVD_IN_PSBL 1469 0.96 2.08 0.47 189 XMDateMe_00 1452 0.45 0.41 0.47 190 XMPhish30 1436 0.87 1.79 0.46 191 XM_ProductURIs 1430 0.99 2.20 0.46 192 HTML_IMAGE_ONLY_28 1412 0.39 0.23 0.46 193 TR_XM_INTL_Spamhaus 1398 1.14 2.73 0.45 194 TR_XM_SpammyWords3 1387 2.02 5.65 0.45 195 XMMoneyMeta_00 1377 0.64 1.10 0.44 196 FROM_GOV_SPOOF 1358 0.33 0.09 0.44 197 TR_XM_GMP_MSPIKE_UNDO2 1344 0.37 0.22 0.43 198 XMPhish14 1333 0.54 0.79 0.43 199 XM_B_Phish66 1316 0.67 1.25 0.42 200 XMLngstWrd_01 1311 0.42 0.43 0.42 ----------------------------------------------------------------------