Email: 432586 Autolearn: 0 AvgScore: 5.20 AvgScanTime: 1.55 sec Spam: 139846 Autolearn: 0 AvgScore: 14.28 AvgScanTime: 1.70 sec Ham: 292740 Autolearn: 0 AvgScore: 0.87 AvgScanTime: 1.47 sec Time Spent Running SA: 185.73 hours Time Spent Processing Spam: 66.20 hours Time Spent Processing Ham: 119.53 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 133790 89.54 95.67 86.61 2 DKIM_SIGNED 128667 82.41 92.01 77.83 3 XM_DK_Pass 122417 80.05 87.54 76.47 4 DKIM_VALID 121333 79.16 86.76 75.53 5 XM_B_Unicode 120898 75.79 86.45 70.70 6 RELAYCOUNTRY_US 113998 82.15 81.52 82.45 7 DCC_CHECK 99482 46.96 71.14 35.42 8 XM_B_SpammyWords 98465 54.39 70.41 46.74 9 XMListUnsubscribeExists 96685 56.72 69.14 50.79 10 DKIM_VALID_AU 96076 64.15 68.70 61.97 11 LOC_TINY_FONT_1 69330 36.11 49.58 29.68 12 XM_B_Unicode3 69199 43.29 49.48 40.34 13 XM_DK_Undo_02 57946 17.69 41.44 6.34 14 XM_B_SpammyWords2 56666 26.50 40.52 19.80 15 BAYES_50 56624 54.75 40.49 61.56 16 HTML_FONT_LOW_CONTRAST 53927 31.49 38.56 28.11 17 FVGT_m_MULTI_ODD 47415 28.06 33.91 25.26 18 DKIM_VALID_EF 44468 30.97 31.80 30.57 19 T_KAM_HTML_FONT_INVALID 42746 25.11 30.57 22.50 20 BAYES_99 42592 12.48 30.46 3.89 21 TR_XM_DKIM_Undo 42234 11.68 30.20 2.83 22 DCC_CHECK_NEGATIVE 38644 52.61 27.63 64.54 23 MIME_HTML_ONLY 38577 22.78 27.59 20.49 24 XM_Multi_Part_URI 33806 18.47 24.17 15.75 25 XMSubLong 33477 23.48 23.94 23.26 26 BAYES_999 32337 9.49 23.12 2.98 27 TR_XM_DK_Unsub 30852 16.69 22.06 14.12 28 T_TM2_M_HEADER_IN_MSG 29684 26.99 21.23 29.74 29 TR_DCC_Bayes_99 27985 7.47 20.01 1.48 30 RCVD_IN_MSPIKE_H2 26743 16.94 19.12 15.89 31 XM_B_Unsub 25628 12.05 18.33 9.05 32 UNPARSEABLE_RELAY 25013 14.20 17.89 12.43 33 TR_XM_BayesUnsub 23987 10.14 17.15 6.79 34 RELAYCOUNTRY_META 23649 7.64 16.91 3.21 35 TR_MAX_INTL_RELAY 21352 9.10 15.27 6.15 36 LOTS_OF_MONEY 20544 9.07 14.69 6.38 37 XM_B_SpammyWords3 20506 8.12 14.66 4.99 38 TR_XM_SpammyWords4 18745 7.30 13.40 4.39 39 RCVD_IN_BL_SPAMCOP_NET 16841 4.35 12.04 0.67 40 TR_XM_SpammyRelay 16681 5.01 11.93 1.70 41 BOTNET_IPINHOSTNAME 16305 6.85 11.66 4.55 42 TR_XM_SpammyWords2 15285 3.89 10.93 0.52 43 RCVD_IN_MSPIKE_WL 14800 16.95 10.58 19.99 44 XM_Evil_Numbers_Gen 14645 9.64 10.47 9.25 45 BOTNET 13618 4.64 9.74 2.20 46 TR_XM_UnparsRelay 13170 4.24 9.42 1.77 47 BAYES_80 12997 5.57 9.29 3.79 48 XM_B_Phish_Phrases 12410 6.45 8.87 5.29 49 BAYES_60 11604 7.49 8.30 7.10 50 RELAYCOUNTRY_CA 10694 2.93 7.65 0.67 51 FSL_BULK_SIG 10362 5.26 7.41 4.23 52 RCVD_IN_MSPIKE_BL 9830 3.08 7.03 1.19 53 TR_XM_MSPIKECOMBO 9800 3.07 7.01 1.19 54 LotsOfNums_01 9720 8.44 6.95 9.15 55 MPART_ALT_DIFF 9603 5.62 6.87 5.02 56 XM_H_Long_From01 8929 5.87 6.38 5.63 57 HTML_IMAGE_RATIO_02 8866 5.24 6.34 4.72 58 TR_XM_SPAMCOP 8671 2.15 6.20 0.21 59 XM_Body_Dirty_Words 8430 4.02 6.03 3.06 60 XMSubMetaSx_00 8423 4.08 6.02 3.15 61 UNTRUSTED_Relay 8322 2.97 5.95 1.54 62 XM_B_PhoneNumber 8224 7.99 5.88 9.00 63 BAYES_95 7869 3.42 5.63 2.36 64 DKIM_INVALID 7334 3.25 5.24 2.30 65 TR_XM_SpammyWords3 7299 2.15 5.22 0.68 66 RCVD_IN_MSPIKE_H3 7195 7.98 5.14 9.33 67 XM_UncommonTLD01 7132 4.39 5.10 4.06 68 XM_H_GMP 6877 5.54 4.92 5.83 69 TR_XM_PhishingBody 6590 2.33 4.71 1.20 70 XM_B_Investor 6567 2.75 4.70 1.82 71 RCVD_IN_MSPIKE_L3 6487 2.24 4.64 1.09 72 MIME_HTML_MOSTLY 6391 3.28 4.57 2.66 73 XM_OfRef6 6372 2.05 4.56 0.85 74 HTML_IMAGE_RATIO_04 6162 4.73 4.41 4.89 75 T_XMDrugObfuBody_14 5962 2.59 4.26 1.79 76 XMStrtUSub 5937 4.62 4.25 4.80 77 XMDiploma_00 5811 2.54 4.16 1.77 78 TR_XM_SpammyWords5 5748 2.37 4.11 1.54 79 XM_B_SpammyTLD 5489 3.32 3.93 3.03 80 HTML_IMAGE_RATIO_06 5427 3.41 3.88 3.19 81 XMSexyCombo_05 5201 1.84 3.72 0.95 82 TM2_M_VERY_LONG_WORD 5195 2.81 3.71 2.38 83 TooManyTo_001 5183 6.38 3.71 7.66 84 XMNumbers 4927 3.33 3.52 3.24 85 XM_B_Unsub2 4887 2.13 3.49 1.48 86 T_XMDrugObfuBody_08 4678 2.19 3.35 1.63 87 XM_CamelCaseFrm001 4665 2.49 3.34 2.09 88 MIME_QP_LONG_LINE 4593 4.76 3.28 5.46 89 XM_URI_RBL 4526 1.22 3.24 0.26 90 T_XMHurry_00 4473 1.48 3.20 0.65 91 XMGenDplmaNmb 4263 1.65 3.05 0.98 92 RCVD_IN_MSPIKE_H5 3950 5.37 2.82 6.58 93 XM_UB50 3940 1.58 2.82 0.99 94 RELAYCOUNTRY_AU 3891 1.33 2.78 0.64 95 XM_SPF_SoftFail 3813 1.74 2.73 1.26 96 HTML_IMAGE_RATIO_08 3796 3.02 2.71 3.17 97 XM_B_URI_Unicode 3670 2.27 2.62 2.10 98 MIME_HTML_ONLY_MULTI 3662 2.59 2.62 2.57 99 RCVD_IN_MSPIKE_H4 3655 3.61 2.61 4.08 100 RCVD_IN_VALIDITY_SAFE 3643 3.14 2.61 3.40 101 USER_IN_DEF_DKIM_WL 3640 10.09 2.60 13.66 102 T_TooManySym_01 3502 5.17 2.50 6.45 103 TR_LOTS_OF_MONEY3 3482 1.18 2.49 0.55 104 TR_XM_NoHeaderRelay 3459 0.91 2.47 0.16 105 XM_B_SpammyWords4 3429 1.27 2.45 0.71 106 TR_XM_INV_DKIM 3413 0.80 2.44 0.01 107 TR_XM_MSPIKECOMBO2 3376 0.81 2.41 0.04 108 SUBJ_ALL_CAPS 3139 1.92 2.24 1.77 109 XMStockSpam_06 3120 1.55 2.23 1.23 110 TM2_M_URI_OPT_OUT 3044 2.01 2.18 1.93 111 RCVD_IN_VALIDITY_CERTIFIED 3032 2.54 2.17 2.72 112 FROM_EXCESS_BASE64 3008 1.80 2.15 1.63 113 T_FILL_THIS_FORM_SHORT 3003 1.29 2.15 0.89 114 XMPhish30 2999 0.93 2.14 0.35 115 URI_TRY_3LD 2936 1.10 2.10 0.62 116 MAILING_LIST_MULTI 2838 2.78 2.03 3.15 117 XMBody_17 2770 1.00 1.98 0.53 118 RCVD_IN_VALIDITY_RPBL 2745 0.66 1.96 0.03 119 URI_HEX 2642 1.36 1.89 1.10 120 SpammyFromTLD_02 2627 1.11 1.88 0.74 121 TR_XM_MaxSPIKE 2606 0.63 1.86 0.04 122 BAYES_40 2535 3.98 1.81 5.02 123 RCVD_IN_IADB_LISTED 2498 3.24 1.79 3.93 124 XM_ProductURIs 2420 0.90 1.73 0.50 125 XMBrknScrpt_02 2393 1.14 1.71 0.87 126 KHOP_HELO_FCRDNS 2324 1.74 1.66 1.78 127 MultiRelay_CC 2323 0.60 1.66 0.09 128 RCVD_IN_PSBL 2276 0.84 1.63 0.46 129 XMBdyGiftCard01 2244 0.66 1.60 0.20 130 MPART_ALT_DIFF_COUNT 2222 0.97 1.59 0.68 131 RCVD_IN_MSPIKE_L4 2163 0.56 1.55 0.09 132 RCVD_IN_IADB_SPF 2151 2.86 1.54 3.49 133 T_XMDrugObfuBody_00 2133 1.18 1.53 1.02 134 SpammyFromTLD_01 2121 0.95 1.52 0.67 135 RELAYCOUNTRY_GB 2093 0.83 1.50 0.51 136 XM_B_DNDMA 2093 0.70 1.50 0.32 137 TR_XM_INTL_Spamhaus 2068 0.56 1.48 0.12 138 URI_NOVOWEL 2028 1.24 1.45 1.15 139 RCVD_IN_IADB_DK 1976 2.51 1.41 3.03 140 T_REMOTE_IMAGE 1942 3.07 1.39 3.87 141 RDNS_DYNAMIC 1941 0.56 1.39 0.16 142 RCVD_IN_IADB_SENDERID 1936 2.58 1.38 3.14 143 XM_DK_Undo_01 1910 1.48 1.37 1.53 144 STY_INVIS_DIRECT 1903 0.65 1.36 0.31 145 HTML_MIME_NO_HTML_TAG 1891 2.26 1.35 2.69 146 XM_B_COPY_HTML 1866 0.90 1.33 0.70 147 BAYES_20 1838 2.91 1.31 3.67 148 XMBody_78 1831 0.65 1.31 0.34 149 RCVD_IN_XBL 1828 0.44 1.31 0.02 150 TR_XM_Base64_M1 1818 0.73 1.30 0.46 151 HTML_EXTRA_CLOSE 1814 0.59 1.30 0.26 152 DIET_1 1806 0.60 1.29 0.26 153 XM_B_Phish66 1789 0.64 1.28 0.33 154 J_WEEDS_I 1787 0.41 1.28 0.00 155 J_WEEDS_E 1787 0.41 1.28 0.00 156 J_WEEDS_R 1786 0.41 1.28 0.00 157 ALL_TRUSTED 1786 10.27 1.28 14.57 158 J_WEEDS_M 1785 0.41 1.28 0.00 159 J_WEEDS_C 1785 0.41 1.28 0.00 160 J_WEEDS_W 1785 0.41 1.28 0.00 161 J_WEEDS_L 1785 0.41 1.28 0.00 162 J_WEEDS_F 1783 0.41 1.27 0.00 163 J_WEEDS_P 1782 0.41 1.27 0.00 164 XM_H_Long_From02 1770 0.91 1.27 0.74 165 SHOPIFY_IMG_NOT_RCVD_SFY 1760 0.59 1.26 0.27 166 BOTNET_NORDNS 1758 0.41 1.26 0.01 167 XM_HighProb1 1749 0.41 1.25 0.00 168 XM_B_SEO 1748 0.59 1.25 0.28 169 DKIM_ADSP_NXDOMAIN 1736 0.62 1.24 0.32 170 XM_SendGrid 1728 1.45 1.24 1.55 171 RCVD_IN_SBL_CSS 1724 0.42 1.23 0.03 172 RCVD_IN_ZEN_LASTEXTERNAL 1686 0.39 1.21 0.00 173 SHORTCIRCUIT 1686 0.39 1.21 0.00 174 T_Symld_Words_02 1651 0.69 1.18 0.46 175 TVD_RCVD_IP 1644 1.15 1.18 1.14 176 TR_MetaPhish_Combo_01 1626 0.91 1.16 0.79 177 XMSubMetaI_00 1597 0.70 1.14 0.49 178 THIS_AD 1568 0.56 1.12 0.29 179 RCVD_IN_PBL 1559 0.80 1.11 0.65 180 HTML_FONT_TINY_NORDNS 1522 0.41 1.09 0.09 181 XM_OfRef7 1503 0.46 1.07 0.17 182 RELAYCOUNTRY_FR 1477 0.55 1.06 0.31 183 TR_Symld_Words 1466 1.41 1.05 1.58 184 TR_XM_SEO4 1460 0.44 1.04 0.15 185 TR_LOTS_OF_MONEY2 1449 0.51 1.04 0.25 186 T_MONEY_PERCENT 1449 0.51 1.04 0.25 187 RCVD_IN_IADB_VOUCHED 1405 2.01 1.00 2.48 188 HTML_IMAGE_ONLY_20 1397 0.68 1.00 0.53 189 SUBJ_DOLLARS 1392 0.69 1.00 0.54 190 XMSubMetaSxObfu_03 1362 0.59 0.97 0.40 191 XM_DIRTYINTL 1355 0.36 0.97 0.07 192 TR_XM_GMP_BULK_SIG 1350 0.40 0.97 0.13 193 XM_UB60 1345 0.38 0.96 0.10 194 HELO_DYNAMIC_SPLIT_IP 1334 0.31 0.95 0.01 195 URIBL_SBL 1332 0.31 0.95 0.00 196 URIBL_SBL_A 1332 0.31 0.95 0.00 197 SH_BODYURI_REVERSE_SBL 1328 0.31 0.95 0.00 198 HTML_TAG_BALANCE_BODY 1295 0.60 0.93 0.44 199 DKIM_ADSP_CUSTOM_MED 1281 0.80 0.92 0.74 200 TR_XM_PHPDW 1280 0.50 0.92 0.30 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 253534 89.54 95.67 86.61 2 RELAYCOUNTRY_US 241375 82.15 81.52 82.45 3 DKIM_SIGNED 227842 82.41 92.01 77.83 4 XM_DK_Pass 223859 80.05 87.54 76.47 5 DKIM_VALID 221102 79.16 86.76 75.53 6 XM_B_Unicode 206965 75.79 86.45 70.70 7 DCC_CHECK_NEGATIVE 188930 52.61 27.63 64.54 8 DKIM_VALID_AU 181409 64.15 68.70 61.97 9 BAYES_50 180201 54.75 40.49 61.56 10 XMListUnsubscribeExists 148683 56.72 69.14 50.79 11 XM_B_SpammyWords 136833 54.39 70.41 46.74 12 XM_B_Unicode3 118078 43.29 49.48 40.34 13 DCC_CHECK 103681 46.96 71.14 35.42 14 DKIM_VALID_EF 89489 30.97 31.80 30.57 15 T_TM2_M_HEADER_IN_MSG 87064 26.99 21.23 29.74 16 LOC_TINY_FONT_1 86894 36.11 49.58 29.68 17 HTML_FONT_LOW_CONTRAST 82283 31.49 38.56 28.11 18 FVGT_m_MULTI_ODD 73948 28.06 33.91 25.26 19 XMSubLong 68097 23.48 23.94 23.26 20 T_KAM_HTML_FONT_INVALID 65881 25.11 30.57 22.50 21 MIME_HTML_ONLY 59981 22.78 27.59 20.49 22 RCVD_IN_MSPIKE_WL 58532 16.95 10.58 19.99 23 XM_B_SpammyWords2 57955 26.50 40.52 19.80 24 RCVD_IN_MSPIKE_H2 46528 16.94 19.12 15.89 25 XM_Multi_Part_URI 46106 18.47 24.17 15.75 26 ALL_TRUSTED 42649 10.27 1.28 14.57 27 TR_XM_DK_Unsub 41347 16.69 22.06 14.12 28 USER_IN_DEF_DKIM_WL 39992 10.09 2.60 13.66 29 UNPARSEABLE_RELAY 36398 14.20 17.89 12.43 30 BAYES_00 30870 7.39 0.77 10.55 31 RCVD_IN_MSPIKE_H3 27315 7.98 5.14 9.33 32 XM_Evil_Numbers_Gen 27065 9.64 10.47 9.25 33 LotsOfNums_01 26793 8.44 6.95 9.15 34 XM_B_Unsub 26487 12.05 18.33 9.05 35 XM_B_PhoneNumber 26346 7.99 5.88 9.00 36 TR_XM_DK_Bayes 22636 5.43 0.60 7.73 37 TooManyTo_001 22435 6.38 3.71 7.66 38 TR_XM_DK_Bayes1 22343 5.36 0.60 7.63 39 BAYES_60 20798 7.49 8.30 7.10 40 XM_DKIMWhitelistDomains 20322 4.73 0.11 6.94 41 TR_XM_BayesUnsub 19889 10.14 17.15 6.79 42 TR_XM_DK_Bayes2 19770 4.75 0.55 6.75 43 RCVD_IN_MSPIKE_H5 19263 5.37 2.82 6.58 44 T_TooManySym_01 18875 5.17 2.50 6.45 45 LOTS_OF_MONEY 18684 9.07 14.69 6.38 46 XM_DK_Undo_02 18564 17.69 41.44 6.34 47 TR_MAX_INTL_RELAY 17992 9.10 15.27 6.15 48 XM_H_GMP 17068 5.54 4.92 5.83 49 XM_H_Long_From01 16478 5.87 6.38 5.63 50 MIME_QP_LONG_LINE 15980 4.76 3.28 5.46 51 XM_B_Phish_Phrases 15478 6.45 8.87 5.29 52 BAYES_40 14703 3.98 1.81 5.02 53 MPART_ALT_DIFF 14688 5.62 6.87 5.02 54 XM_B_SpammyWords3 14607 8.12 14.66 4.99 55 HTML_IMAGE_RATIO_04 14313 4.73 4.41 4.89 56 XM_PDF 14041 3.46 0.65 4.80 57 XMStrtUSub 14039 4.62 4.25 4.80 58 HTML_IMAGE_RATIO_02 13821 5.24 6.34 4.72 59 ANY_BOUNCE_MESSAGE 13419 3.37 0.83 4.58 60 BOUNCE_MESSAGE 13414 3.37 0.83 4.58 61 BOTNET_IPINHOSTNAME 13311 6.85 11.66 4.55 62 TR_XM_SpammyWords4 12847 7.30 13.40 4.39 63 FSL_BULK_SIG 12383 5.26 7.41 4.23 64 RCVD_IN_MSPIKE_H4 11954 3.61 2.61 4.08 65 XM_UncommonTLD01 11879 4.39 5.10 4.06 66 RCVD_IN_IADB_LISTED 11518 3.24 1.79 3.93 67 BAYES_99 11398 12.48 30.46 3.89 68 T_REMOTE_IMAGE 11319 3.07 1.39 3.87 69 BAYES_80 11083 5.57 9.29 3.79 70 BAYES_20 10742 2.91 1.31 3.67 71 RCVD_IN_IADB_SPF 10222 2.86 1.54 3.49 72 RCVD_IN_VALIDITY_SAFE 9948 3.14 2.61 3.40 73 XMNumbers 9485 3.33 3.52 3.24 74 RELAYCOUNTRY_META 9398 7.64 16.91 3.21 75 HTML_IMAGE_RATIO_06 9333 3.41 3.88 3.19 76 T_TooManySym_02 9277 2.34 0.60 3.17 77 HTML_IMAGE_RATIO_08 9267 3.02 2.71 3.17 78 XMSubMetaSx_00 9228 4.08 6.02 3.15 79 MAILING_LIST_MULTI 9209 2.78 2.03 3.15 80 RCVD_IN_IADB_SENDERID 9205 2.58 1.38 3.14 81 XM_Body_Dirty_Words 8956 4.02 6.03 3.06 82 RCVD_IN_IADB_DK 8864 2.51 1.41 3.03 83 XM_B_SpammyTLD 8859 3.32 3.93 3.03 84 BAYES_999 8737 9.49 23.12 2.98 85 TR_XM_DKIM_Undo 8278 11.68 30.20 2.83 86 RCVD_IN_VALIDITY_CERTIFIED 7975 2.54 2.17 2.72 87 HTML_MIME_NO_HTML_TAG 7882 2.26 1.35 2.69 88 MIME_HTML_MOSTLY 7790 3.28 4.57 2.66 89 MIME_HTML_ONLY_MULTI 7534 2.59 2.62 2.57 90 RCVD_IN_IADB_VOUCHED 7273 2.01 1.00 2.48 91 TooManyTo_002 7089 1.81 0.52 2.42 92 INVALID_MSGID 7066 1.72 0.27 2.41 93 TM2_M_VERY_LONG_WORD 6960 2.81 3.71 2.38 94 BAYES_95 6907 3.42 5.63 2.36 95 DKIM_INVALID 6740 3.25 5.24 2.30 96 BOTNET 6447 4.64 9.74 2.20 97 MSGID_NOFQDN1 6416 1.49 0.01 2.19 98 TO_MALFORMED 6347 1.47 0.01 2.17 99 XM_B_URI_Unicode 6143 2.27 2.62 2.10 100 XM_CamelCaseFrm001 6106 2.49 3.34 2.09 101 BAYES_05 6038 1.63 0.73 2.06 102 FROM_GOV_DKIM_AU 5718 1.57 0.75 1.95 103 TM2_M_URI_OPT_OUT 5652 2.01 2.18 1.93 104 XM_B_Investor 5340 2.75 4.70 1.82 105 RCVD_IN_IADB_OPTIN 5260 1.44 0.70 1.80 106 T_XMDrugObfuBody_14 5235 2.59 4.26 1.79 107 KHOP_HELO_FCRDNS 5197 1.74 1.66 1.78 108 TR_XM_UnparsRelay 5189 4.24 9.42 1.77 109 SUBJ_ALL_CAPS 5182 1.92 2.24 1.77 110 XMDiploma_00 5177 2.54 4.16 1.77 111 TR_XM_SpammyRelay 4988 5.01 11.93 1.70 112 T_XMDrugObfuBody_08 4784 2.19 3.35 1.63 113 FROM_EXCESS_BASE64 4773 1.80 2.15 1.63 114 TR_Symld_Words 4637 1.41 1.05 1.58 115 XM_GoogleGroups 4551 1.33 0.87 1.55 116 XM_SendGrid 4534 1.45 1.24 1.55 117 UNTRUSTED_Relay 4515 2.97 5.95 1.54 118 TR_XM_SpammyWords5 4512 2.37 4.11 1.54 119 XM_DK_Undo_01 4492 1.48 1.37 1.53 120 TooManyTo_003 4385 1.16 0.45 1.50 121 TR_DCC_Bayes_99 4337 7.47 20.01 1.48 122 XM_B_Unsub2 4328 2.13 3.49 1.48 123 IN_HORDE_ADDRESS_BOOK 4289 1.01 0.07 1.47 124 XMGappySubj_01 4178 1.04 0.22 1.43 125 T_TooManySym_03 3865 0.94 0.15 1.32 126 XM_SPF_SoftFail 3695 1.74 2.73 1.26 127 XMStockSpam_06 3590 1.55 2.23 1.23 128 TR_XM_PhishingBody 3501 2.33 4.71 1.20 129 TR_XM_MSPIKECOMBO 3477 3.07 7.01 1.19 130 RCVD_IN_MSPIKE_BL 3477 3.08 7.03 1.19 131 URI_NOVOWEL 3357 1.24 1.45 1.15 132 TooManyTo_004 3330 0.89 0.38 1.14 133 TVD_RCVD_IP 3326 1.15 1.18 1.14 134 TVD_SPACE_RATIO 3288 0.80 0.12 1.12 135 HELO_NODOT 3278 0.80 0.13 1.12 136 HELO_NO_DOMAIN 3269 0.79 0.11 1.12 137 URI_HEX 3228 1.36 1.89 1.10 138 RCVD_IN_MSPIKE_L3 3185 2.24 4.64 1.09 139 TR_XM_DK_SendGrid 3010 0.94 0.75 1.03 140 XMCapTrack 2994 0.84 0.47 1.02 141 T_XMDrugObfuBody_00 2983 1.18 1.53 1.02 142 XM_UB50 2907 1.58 2.82 0.99 143 XMGenDplmaNmb 2855 1.65 3.05 0.98 144 T_OBFU_PDF_ATTACH 2808 0.70 0.14 0.96 145 XMSexyCombo_05 2777 1.84 3.72 0.95 146 XM_ShortIntro_01 2734 0.80 0.53 0.93 147 TooManyTo_005 2697 0.74 0.35 0.92 148 T_FILL_THIS_FORM_SHORT 2598 1.29 2.15 0.89 149 XMBrknScrpt_02 2541 1.14 1.71 0.87 150 XM_OfRef6 2480 2.05 4.56 0.85 151 TR_MetaPhish_Combo_01 2299 0.91 1.16 0.79 152 XMBSHREFv2 2214 0.67 0.48 0.76 153 XM_H_PHPMailer 2213 0.66 0.46 0.76 154 SpammyFromTLD_02 2177 1.11 1.88 0.74 155 DKIM_ADSP_CUSTOM_MED 2163 0.80 0.92 0.74 156 XM_H_Long_From02 2160 0.91 1.27 0.74 157 HTML_IMAGE_ONLY_32 2114 0.53 0.12 0.72 158 XM_B_SpammyWords4 2083 1.27 2.45 0.71 159 XM_B_COPY_HTML 2042 0.90 1.33 0.70 160 TR_XM_SpammyWords3 2003 2.15 5.22 0.68 161 MPART_ALT_DIFF_COUNT 1989 0.97 1.59 0.68 162 RCVD_IN_BL_SPAMCOP_NET 1973 4.35 12.04 0.67 163 SpammyFromTLD_01 1967 0.95 1.52 0.67 164 RELAYCOUNTRY_CA 1966 2.93 7.65 0.67 165 T_TVD_MIME_NO_HEADERS 1939 0.46 0.03 0.66 166 XMLngstWrd_00 1922 0.57 0.39 0.66 167 T_XMHurry_00 1910 1.48 3.20 0.65 168 RCVD_IN_PBL 1889 0.80 1.11 0.65 169 RELAYCOUNTRY_AU 1873 1.33 2.78 0.64 170 HTTPS_HTTP_MISMATCH 1857 0.68 0.78 0.63 171 XMNoVowels 1821 0.60 0.54 0.62 172 URI_TRY_3LD 1812 1.10 2.10 0.62 173 XM_B_COVIDMETA 1786 0.65 0.74 0.61 174 XMGappySubj_02 1713 0.41 0.04 0.59 175 TR_LOTS_OF_MONEY3 1623 1.18 2.49 0.55 176 SUBJ_DOLLARS 1585 0.69 1.00 0.54 177 XMBody_17 1545 1.00 1.98 0.53 178 HTML_IMAGE_ONLY_20 1540 0.68 1.00 0.53 179 TR_XM_SpammyWords2 1523 3.89 10.93 0.52 180 TO_NO_BRKTS_HTML_ONLY 1501 0.39 0.13 0.51 181 RELAYCOUNTRY_GB 1483 0.83 1.50 0.51 182 XM_ProductURIs 1475 0.90 1.73 0.50 183 TR_XM_GMP_MSPIKE_UNDO2 1464 0.40 0.18 0.50 184 LongTLD 1448 0.54 0.64 0.49 185 XMSubMetaI_00 1444 0.70 1.14 0.49 186 MSGID_FROM_MTA_HEADER 1414 0.39 0.21 0.48 187 TR_XM_Base64_M1 1353 0.73 1.30 0.46 188 RCVD_IN_PSBL 1346 0.84 1.63 0.46 189 XMSlimDrugH 1346 0.51 0.61 0.46 190 TM2_M_BODY_EMPTY 1333 0.33 0.05 0.46 191 T_Symld_Words_02 1333 0.69 1.18 0.46 192 HTML_TAG_BALANCE_BODY 1298 0.60 0.93 0.44 193 FORGED_GMAIL_RCVD 1297 0.51 0.66 0.44 194 NML_ADSP_CUSTOM_MED 1293 0.53 0.70 0.44 195 TR_XM_COVIDMETA5 1288 0.30 0.01 0.44 196 XMLngstWrd_01 1268 0.39 0.30 0.43 197 HTML_FONT_FACE_BAD 1264 0.52 0.69 0.43 198 XMMoneyMeta_00 1181 0.52 0.77 0.40 199 XMSubMetaSxObfu_03 1180 0.59 0.97 0.40 200 GMD_PDF_EMPTY_BODY 1156 0.28 0.04 0.39 ----------------------------------------------------------------------