Email: 368230 Autolearn: 0 AvgScore: 0.35 AvgScanTime: 1.51 sec Spam: 52514 Autolearn: 0 AvgScore: 12.90 AvgScanTime: 2.60 sec Ham: 315716 Autolearn: 0 AvgScore: -1.74 AvgScanTime: 1.33 sec Time Spent Running SA: 154.61 hours Time Spent Processing Spam: 37.98 hours Time Spent Processing Ham: 116.63 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 51142 98.84 97.39 99.08 2 HTML_MESSAGE 47584 85.34 90.61 84.46 3 XM_B_Unicode 38494 70.08 73.30 69.55 4 DKIM_SIGNED 38269 76.90 72.87 77.57 5 XM_DK_Pass 37160 75.67 70.76 76.49 6 XMListUnsubscribeExists 36639 57.64 69.77 55.62 7 RELAYCOUNTRY_US 33659 77.94 64.10 80.24 8 DKIM_VALID 33361 72.38 63.53 73.85 9 XM_DK_Undo_02 27161 18.99 51.72 13.55 10 BAYES_99 24657 15.22 46.95 9.94 11 DKIM_VALID_AU 24449 58.69 46.56 60.71 12 BAYES_999 19438 12.12 37.01 7.98 13 XM_B_Unicode3 18253 42.42 34.76 43.69 14 LOC_TINY_FONT_1 17141 31.95 32.64 31.84 15 RELAYCOUNTRY_META 15553 8.87 29.62 5.42 16 BAYES_50 15081 47.66 28.72 50.81 17 MIME_HTML_ONLY 14925 25.34 28.42 24.83 18 RCVD_IN_MSPIKE_H2 14915 26.99 28.40 26.76 19 HTML_FONT_LOW_CONTRAST 14474 31.51 27.56 32.17 20 FVGT_m_MULTI_ODD 13813 21.41 26.30 20.59 21 UNTRUSTED_Relay 13067 5.79 24.88 2.61 22 T_TM2_M_HEADER_IN_MSG 12930 23.08 24.62 22.82 23 DKIM_VALID_EF 12745 27.03 24.27 27.49 24 BOTNET 12515 5.89 23.83 2.91 25 XM_Multi_Part_URI 12280 15.39 23.38 14.06 26 T_KAM_HTML_FONT_INVALID 11395 16.73 21.70 15.91 27 XM_Body_Dirty_Words 10284 16.42 19.58 15.89 28 XM_UncommonTLD01 9999 5.75 19.04 3.54 29 XMSubLong 9437 20.55 17.97 20.98 30 RCVD_IN_MSPIKE_BL 9113 3.38 17.35 1.06 31 RCVD_IN_BL_SPAMCOP_NET 9113 3.53 17.35 1.23 32 XM_B_Phish_Phrases 8575 8.33 16.33 7.00 33 BOTNET_IPINHOSTNAME 8016 7.88 15.26 6.65 34 MPART_ALT_DIFF 6860 6.95 13.06 5.93 35 RCVD_IN_RP_RNBL 6472 1.85 12.32 0.11 36 XMSexyCombo_05 6374 6.99 12.14 6.14 37 RCVD_IN_PSBL 6275 1.75 11.95 0.05 38 RCVD_IN_MSPIKE_L5 5980 1.90 11.39 0.32 39 XM_SPF_SoftFail 5806 2.51 11.06 1.09 40 LOTS_OF_MONEY 5648 7.97 10.76 7.51 41 XM_UB99 5635 1.54 10.73 0.01 42 LotsOfNums_01 5504 9.30 10.48 9.11 43 HTML_IMAGE_RATIO_02 5313 9.69 10.12 9.62 44 SpammyFromTLD_01 5040 1.80 9.60 0.51 45 DKIM_INVALID 4908 4.52 9.35 3.72 46 RELAYCOUNTRY_CA 4868 3.26 9.27 2.26 47 XM_B_Unsub 4711 9.79 8.97 9.93 48 XM_UB999 4496 1.22 8.56 0.00 49 XM_Evil_Numbers_Gen 4359 10.24 8.30 10.56 50 BAYES_80 4231 5.85 8.06 5.48 51 RCVD_IN_MSPIKE_WL 3961 26.00 7.54 29.06 52 TR_XM_PhishingBody 3813 3.62 7.26 3.02 53 NO_DNS_FOR_FROM 3792 2.65 7.22 1.90 54 XMSubMetaSx_00 3784 5.15 7.21 4.81 55 XMBrknScrpt_02 3714 2.57 7.07 1.82 56 TooManyTo_001 3407 6.55 6.49 6.56 57 XM_H_Long_From01 3393 5.15 6.46 4.94 58 BAYES_60 3043 7.49 5.79 7.77 59 MIME_HTML_MOSTLY 2993 3.78 5.70 3.46 60 T_XMDrugObfuBody_08 2903 2.26 5.53 1.72 61 RCVD_IN_MSPIKE_L3 2805 1.38 5.34 0.72 62 XM_UB50 2800 1.98 5.33 1.42 63 UNPARSEABLE_RELAY 2747 7.28 5.23 7.62 64 BAYES_95 2738 3.53 5.21 3.25 65 XM_B_Phish66 2683 1.83 5.11 1.28 66 XMDiploma_00 2664 1.86 5.07 1.33 67 XMStrtUSub 2515 5.77 4.79 5.93 68 XMBody_17 2508 1.73 4.78 1.22 69 XM_DIRTYINTL 2454 1.18 4.67 0.60 70 HTML_MIME_NO_HTML_TAG 2421 3.03 4.61 2.77 71 BOTNET_NORDNS 2406 0.66 4.58 0.01 72 KHOP_HELO_FCRDNS 2284 2.11 4.35 1.74 73 RCVD_IN_MSPIKE_H3 2204 15.02 4.20 16.82 74 HTML_IMAGE_RATIO_08 2130 3.37 4.06 3.25 75 URIBL_SBL_A 2096 0.81 3.99 0.28 76 SpammyFromTLD_02 2091 0.76 3.98 0.23 77 XM_B_SpammyTLD 2091 2.27 3.98 1.98 78 XM_SendGrid 1911 6.00 3.64 6.40 79 HTML_IMAGE_RATIO_04 1893 6.28 3.60 6.72 80 HTML_IMAGE_RATIO_06 1885 3.43 3.59 3.41 81 RELAYCOUNTRY_FR 1856 0.78 3.53 0.32 82 TR_XM_MaxSPIKE 1827 0.57 3.48 0.09 83 XM_B_COVIDMETA 1806 1.20 3.44 0.83 84 BODY_URI_ONLY 1753 0.53 3.34 0.06 85 TR_XM_MaxBayes 1717 0.55 3.27 0.10 86 TR_XM_UnparsRelay 1696 1.01 3.23 0.64 87 FROM_EXCESS_BASE64 1682 3.45 3.20 3.49 88 XM_UB80 1661 0.49 3.16 0.04 89 TO_NO_BRKTS_HTML_ONLY 1633 0.50 3.11 0.07 90 RCVD_IN_MSPIKE_H4 1627 9.73 3.10 10.83 91 DATE_IN_PAST_03_06 1620 0.61 3.08 0.20 92 TR_XM_INV_DKIM 1579 0.60 3.01 0.20 93 TR_XM_PHPDW 1571 0.76 2.99 0.39 94 RDNS_DYNAMIC 1542 0.82 2.94 0.47 95 TR_XM_PHPForged 1521 0.74 2.90 0.39 96 T_REMOTE_IMAGE 1521 2.86 2.90 2.86 97 TR_XM_FormFill2 1506 0.74 2.87 0.38 98 XM_H_PHPOS 1503 0.73 2.86 0.38 99 RELAYCOUNTRY_KR 1499 0.43 2.85 0.02 100 URI_HEX 1489 2.03 2.84 1.90 101 HK_RANDOM_REPLYTO 1405 0.58 2.68 0.23 102 TR_LOTS_OF_MONEY3 1379 0.95 2.63 0.67 103 XM_CamelCaseFrm001 1365 2.02 2.60 1.92 104 DATE_IN_PAST_06_12 1332 0.69 2.54 0.39 105 XMNumbers 1319 3.88 2.51 4.11 106 XM_OfRef6 1308 1.67 2.49 1.54 107 HTML_IMAGE_ONLY_32 1303 0.53 2.48 0.21 108 URI_PHP_REDIR 1246 0.35 2.37 0.02 109 XMSexyCombo_01 1224 1.73 2.33 1.63 110 BAYES_40 1217 3.83 2.32 4.08 111 TR_XM_COVIDMETA4 1206 0.65 2.30 0.37 112 XM_UB60 1194 0.41 2.27 0.10 113 XM_UB95 1183 0.34 2.25 0.02 114 TR_XM_RelayPhish 1173 0.41 2.23 0.11 115 T_TooManySym_01 1095 5.02 2.09 5.51 116 XMSubNoVowel 1082 1.09 2.06 0.93 117 TR_XM_MaxWHORU 1082 0.34 2.06 0.05 118 TR_Mismatch_TLD_01 1071 0.46 2.04 0.20 119 TM2_M_URI_OPT_OUT 1053 4.29 2.01 4.67 120 XM_URI_RBL 1042 0.46 1.98 0.20 121 TM2_M_VERY_LONG_WORD 1029 1.28 1.96 1.16 122 URI_TRY_3LD 1001 1.60 1.91 1.55 123 SUBJ_ALL_CAPS 993 1.14 1.89 1.02 124 XMHTML_After_End 982 1.03 1.87 0.89 125 XM_B_SEO 982 0.36 1.87 0.10 126 T_FILL_THIS_FORM_SHORT 981 1.00 1.87 0.86 127 MIME_QP_LONG_LINE 974 3.19 1.85 3.41 128 T_PDS_OTHER_BAD_TLD 960 0.53 1.83 0.32 129 MPART_ALT_DIFF_COUNT 923 0.60 1.76 0.40 130 MIME_HTML_ONLY_MULTI 882 3.41 1.68 3.69 131 XM_JunkDunk 870 0.24 1.66 0.00 132 ALL_TRUSTED 861 13.18 1.64 15.09 133 BAYES_20 854 3.17 1.63 3.42 134 XMStockSpam_06 852 1.65 1.62 1.66 135 LongTLD 838 0.33 1.60 0.11 136 XM_B_Unsub2 827 1.06 1.57 0.97 137 T_XMDrugObfuBody_14 827 1.89 1.57 1.94 138 FROM_SUSPICIOUS_NTLD 812 0.29 1.55 0.09 139 XM_H_PHPMailer 801 0.59 1.53 0.44 140 FROM_SUSPICIOUS_NTLD_FP 783 0.28 1.49 0.08 141 INVESTMENT_ADVICE 770 0.30 1.47 0.11 142 TR_XM_DK_SendGrid 767 3.24 1.46 3.54 143 MIME_CHARSET_FARAWAY 756 0.30 1.44 0.11 144 URI_NOVOWEL 743 1.47 1.41 1.47 145 XMBdyGiftCard01 742 1.93 1.41 2.01 146 DKIM_ADSP_NXDOMAIN 733 0.85 1.40 0.76 147 TR_Mismatch_TLD_02 724 0.28 1.38 0.10 148 XM_Combo_Sbj 700 0.46 1.33 0.31 149 TR_XM_FormFill 698 0.25 1.33 0.07 150 DKIM_ADSP_CUSTOM_MED 697 1.08 1.33 1.04 151 HTML_IMAGE_ONLY_28 695 0.43 1.32 0.28 152 RELAYCOUNTRY_NL 693 0.42 1.32 0.28 153 TR_MetaPhish_Combo_01 685 0.83 1.30 0.75 154 TR_XM_SEO4 682 0.19 1.30 0.00 155 XM_ShortIntro_01 682 0.51 1.30 0.38 156 TVD_RCVD_IP 668 2.49 1.27 2.69 157 IMG_ONLY_FM_DOM_INFO 665 0.18 1.27 0.00 158 RELAYCOUNTRY_GB 658 0.70 1.25 0.61 159 XMReplyNow 656 0.29 1.25 0.13 160 TVD_SPACE_RATIO_MINFP 655 0.20 1.25 0.02 161 NML_ADSP_CUSTOM_MED 644 0.79 1.23 0.71 162 XM_SPF_Unknown 642 0.48 1.22 0.35 163 XM_OfRef7 633 0.51 1.21 0.39 164 XM_H_PHPOS_M 629 0.37 1.20 0.24 165 DEAR_FRIEND 612 0.21 1.17 0.05 166 FORGED_GMAIL_RCVD 612 0.56 1.17 0.46 167 URIBL_BLACK 611 0.17 1.16 0.01 168 XMSexyCombo_04 611 0.82 1.16 0.76 169 XMGenDplmaNmb 609 0.76 1.16 0.69 170 TR_Symld_Words 605 1.65 1.15 1.74 171 INVALID_MSGID 595 2.30 1.13 2.50 172 FROM_MISSP_REPLYTO 592 0.17 1.13 0.01 173 CHARSET_FARAWAY_HEADER 588 0.21 1.12 0.05 174 RELAYCOUNTRY_IN 569 0.19 1.08 0.04 175 HTML_FONT_FACE_BAD 555 1.54 1.06 1.62 176 RELAYCOUNTRY_VN 548 0.16 1.04 0.01 177 URIBL_DBL_SPAM 546 0.16 1.04 0.01 178 XMGppyBdWords 545 0.41 1.04 0.31 179 NORDNS_LOW_CONTRAST 540 0.15 1.03 0.01 180 T_Symld_Words_02 539 0.69 1.03 0.63 181 TR_XM_COVIDMETA1 534 0.33 1.02 0.22 182 FSL_THIS_IS_ADV 534 0.18 1.02 0.04 183 MAILING_LIST_MULTI 524 1.60 1.00 1.70 184 T_XMDrugObfuBody_00 518 0.74 0.99 0.70 185 MISSING_HEADERS 515 0.36 0.98 0.25 186 T_XMHurry_00 507 0.67 0.97 0.62 187 XM_Body_Obfu01 506 0.27 0.96 0.15 188 RELAYCOUNTRY_CN 491 0.21 0.93 0.09 189 HELO_NODOT 490 0.52 0.93 0.46 190 HELO_NO_DOMAIN 490 0.52 0.93 0.46 191 RELAYCOUNTRY_RU 479 0.21 0.91 0.09 192 RELAYCOUNTRY_TW 476 0.18 0.91 0.06 193 XM_B_COPY_HTML 470 0.72 0.89 0.69 194 NUMERIC_HTTP_ADDR 469 0.72 0.89 0.69 195 BOUNCE_MESSAGE 467 4.44 0.89 5.03 196 ANY_BOUNCE_MESSAGE 467 4.44 0.89 5.03 197 XMSubMetaI_00 458 0.72 0.87 0.69 198 XMBody_78 454 0.52 0.86 0.46 199 XMSlimDrugH 452 0.48 0.86 0.42 200 HELO_MISC_IP 452 2.17 0.86 2.39 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 DCC_CHECK_NEGATIVE 312825 98.84 97.39 99.08 2 HTML_MESSAGE 266653 85.34 90.61 84.46 3 RELAYCOUNTRY_US 253329 77.94 64.10 80.24 4 DKIM_SIGNED 244890 76.90 72.87 77.57 5 XM_DK_Pass 241488 75.67 70.76 76.49 6 DKIM_VALID 233150 72.38 63.53 73.85 7 XM_B_Unicode 219566 70.08 73.30 69.55 8 DKIM_VALID_AU 191679 58.69 46.56 60.71 9 XMListUnsubscribeExists 175605 57.64 69.77 55.62 10 BAYES_50 160415 47.66 28.72 50.81 11 XM_B_Unicode3 137945 42.42 34.76 43.69 12 HTML_FONT_LOW_CONTRAST 101560 31.51 27.56 32.17 13 LOC_TINY_FONT_1 100518 31.95 32.64 31.84 14 RCVD_IN_MSPIKE_WL 91761 26.00 7.54 29.06 15 DKIM_VALID_EF 86795 27.03 24.27 27.49 16 RCVD_IN_MSPIKE_H2 84473 26.99 28.40 26.76 17 MIME_HTML_ONLY 78395 25.34 28.42 24.83 18 T_TM2_M_HEADER_IN_MSG 72062 23.08 24.62 22.82 19 XMSubLong 66234 20.55 17.97 20.98 20 FVGT_m_MULTI_ODD 65012 21.41 26.30 20.59 21 RCVD_IN_MSPIKE_H3 53119 15.02 4.20 16.82 22 T_KAM_HTML_FONT_INVALID 50216 16.73 21.70 15.91 23 XM_Body_Dirty_Words 50176 16.42 19.58 15.89 24 ALL_TRUSTED 47656 13.18 1.64 15.09 25 XM_Multi_Part_URI 44380 15.39 23.38 14.06 26 XM_DK_Undo_02 42765 18.99 51.72 13.55 27 BAYES_00 41225 11.28 0.60 13.06 28 RCVD_IN_RP_SAFE 35343 9.71 0.80 11.19 29 RCVD_IN_MSPIKE_H4 34195 9.73 3.10 10.83 30 XM_DKIMWhitelistDomains 33488 9.10 0.01 10.61 31 RCVD_IN_RP_CERTIFIED 33378 9.12 0.42 10.57 32 XM_Evil_Numbers_Gen 33336 10.24 8.30 10.56 33 BAYES_99 31392 15.22 46.95 9.94 34 XM_B_Unsub 31344 9.79 8.97 9.93 35 HTML_IMAGE_RATIO_02 30386 9.69 10.12 9.62 36 LotsOfNums_01 28750 9.30 10.48 9.11 37 BAYES_999 25205 12.12 37.01 7.98 38 TR_XM_DK_Bayes 25197 6.88 0.24 7.98 39 BAYES_60 24544 7.49 5.79 7.77 40 TR_XM_DK_Bayes1 24110 6.57 0.19 7.64 41 UNPARSEABLE_RELAY 24060 7.28 5.23 7.62 42 LOTS_OF_MONEY 23699 7.97 10.76 7.51 43 TR_XM_DK_Bayes2 22493 6.13 0.17 7.12 44 XM_B_Phish_Phrases 22112 8.33 16.33 7.00 45 HTML_IMAGE_RATIO_04 21229 6.28 3.60 6.72 46 BOTNET_IPINHOSTNAME 20992 7.88 15.26 6.65 47 TooManyTo_001 20717 6.55 6.49 6.56 48 XM_SendGrid 20199 6.00 3.64 6.40 49 XMSexyCombo_05 19372 6.99 12.14 6.14 50 MPART_ALT_DIFF 18724 6.95 13.06 5.93 51 XMStrtUSub 18719 5.77 4.79 5.93 52 T_TooManySym_01 17393 5.02 2.09 5.51 53 BAYES_80 17314 5.85 8.06 5.48 54 RELAYCOUNTRY_META 17117 8.87 29.62 5.42 55 ANY_BOUNCE_MESSAGE 15881 4.44 0.89 5.03 56 BOUNCE_MESSAGE 15881 4.44 0.89 5.03 57 XM_H_Long_From01 15586 5.15 6.46 4.94 58 XMSubMetaSx_00 15175 5.15 7.21 4.81 59 TM2_M_URI_OPT_OUT 14749 4.29 2.01 4.67 60 IN_ZIMBRA_NJ_WHITELIST 13122 3.57 0.02 4.16 61 XMNumbers 12985 3.88 2.51 4.11 62 BAYES_40 12896 3.83 2.32 4.08 63 DKIM_INVALID 11740 4.52 9.35 3.72 64 MIME_HTML_ONLY_MULTI 11661 3.41 1.68 3.69 65 TR_XM_DK_SendGrid 11180 3.24 1.46 3.54 66 XM_UncommonTLD01 11162 5.75 19.04 3.54 67 FROM_EXCESS_BASE64 11019 3.45 3.20 3.49 68 MIME_HTML_MOSTLY 10933 3.78 5.70 3.46 69 BAYES_20 10801 3.17 1.63 3.42 70 MIME_QP_LONG_LINE 10767 3.19 1.85 3.41 71 HTML_IMAGE_RATIO_06 10761 3.43 3.59 3.41 72 HTML_IMAGE_RATIO_08 10271 3.37 4.06 3.25 73 BAYES_95 10271 3.53 5.21 3.25 74 RCVD_IN_IADB_LISTED 9890 2.77 0.60 3.13 75 T_TooManySym_02 9664 2.71 0.60 3.06 76 TR_XM_PhishingBody 9522 3.62 7.26 3.02 77 BOTNET 9176 5.89 23.83 2.91 78 T_REMOTE_IMAGE 9019 2.86 2.90 2.86 79 HTML_MIME_NO_HTML_TAG 8751 3.03 4.61 2.77 80 XM_H_Trusted_IP 8671 2.35 0.00 2.75 81 RCVD_IN_IADB_SPF 8628 2.42 0.54 2.73 82 TVD_RCVD_IP 8503 2.49 1.27 2.69 83 UNTRUSTED_Relay 8246 5.79 24.88 2.61 84 INVALID_MSGID 7879 2.30 1.13 2.50 85 RCVD_IN_IADB_SENDERID 7801 2.19 0.51 2.47 86 RCVD_IN_IADB_DK 7604 2.14 0.52 2.41 87 HELO_MISC_IP 7543 2.17 0.86 2.39 88 CK_HELO_DYNAMIC_SPLIT_IP 7537 2.15 0.73 2.39 89 RELAYCOUNTRY_CA 7120 3.26 9.27 2.26 90 BAYES_05 6855 1.96 0.69 2.17 91 XMBdyGiftCard01 6352 1.93 1.41 2.01 92 TO_MALFORMED 6299 1.72 0.04 2.00 93 XM_B_SpammyTLD 6261 2.27 3.98 1.98 94 T_XMDrugObfuBody_14 6139 1.89 1.57 1.94 95 XM_CamelCaseFrm001 6064 2.02 2.60 1.92 96 URI_HEX 5998 2.03 2.84 1.90 97 NO_DNS_FOR_FROM 5983 2.65 7.22 1.90 98 XMBrknScrpt_02 5750 2.57 7.07 1.82 99 RCVD_IN_IADB_VOUCHED 5660 1.56 0.16 1.79 100 KHOP_HELO_FCRDNS 5500 2.11 4.35 1.74 101 TR_Symld_Words 5486 1.65 1.15 1.74 102 T_XMDrugObfuBody_08 5429 2.26 5.53 1.72 103 MAILING_LIST_MULTI 5364 1.60 1.00 1.70 104 XMStockSpam_06 5226 1.65 1.62 1.66 105 XM_PDF 5189 1.49 0.59 1.64 106 XMSexyCombo_01 5136 1.73 2.33 1.63 107 HTML_FONT_FACE_BAD 5121 1.54 1.06 1.62 108 XMSubEmpty 4962 1.46 0.82 1.57 109 TR_Sbj_FN_Bdy 4923 1.41 0.53 1.56 110 URI_TRY_3LD 4878 1.60 1.91 1.55 111 XM_OfRef6 4855 1.67 2.49 1.54 112 IN_HORDE_ADDRESS_BOOK 4829 1.31 0.02 1.53 113 XMGappySubj_01 4798 1.33 0.18 1.52 114 XM_DK_Undo_01 4733 1.38 0.66 1.50 115 URI_NOVOWEL 4654 1.47 1.41 1.47 116 MISSING_SUBJECT 4572 1.29 0.33 1.45 117 XMNoSubject 4572 1.29 0.33 1.45 118 USER_IN_DEF_DKIM_WL 4510 1.23 0.00 1.43 119 XM_UB50 4477 1.98 5.33 1.42 120 RCVD_IN_MSPIKE_H5 4447 1.24 0.25 1.41 121 XMDiploma_00 4195 1.86 5.07 1.33 122 XM_GoogleGroups 4130 1.18 0.40 1.31 123 XM_B_Phish66 4039 1.83 5.11 1.28 124 T_TooManySym_03 3959 1.11 0.25 1.25 125 RCVD_IN_BL_SPAMCOP_NET 3882 3.53 17.35 1.23 126 XMBody_17 3862 1.73 4.78 1.22 127 XM_ProductURIs 3826 1.13 0.63 1.21 128 XMLngstWrd_00 3765 1.08 0.43 1.19 129 TR_MSPIKEBAYES00 3752 1.02 0.01 1.19 130 RCVD_IN_IADB_OPTIN 3715 1.04 0.21 1.18 131 TM2_M_VERY_LONG_WORD 3666 1.28 1.96 1.16 132 XMLngstWrd_01 3645 1.05 0.41 1.15 133 TooManyTo_002 3511 1.03 0.50 1.11 134 XM_H_Long_From02 3479 1.03 0.59 1.10 135 XM_SPF_SoftFail 3437 2.51 11.06 1.09 136 RCVD_IN_MSPIKE_BL 3339 3.38 17.35 1.06 137 DKIM_ADSP_CUSTOM_MED 3269 1.08 1.33 1.04 138 SUBJ_ALL_CAPS 3208 1.14 1.89 1.02 139 XM_B_Unsub2 3061 1.06 1.57 0.97 140 XMSubNoVowel 2940 1.09 2.06 0.93 141 XMHTML_After_End 2815 1.03 1.87 0.89 142 T_FILL_THIS_FORM_SHORT 2718 1.00 1.87 0.86 143 XMBSHREFv2 2643 0.73 0.11 0.84 144 XMBody_95 2632 0.74 0.19 0.83 145 XM_B_COVIDMETA 2620 1.20 3.44 0.83 146 TooManyTo_003 2564 0.75 0.35 0.81 147 XM_RXBody 2524 0.79 0.71 0.80 148 T_TooManySym_04 2465 0.69 0.13 0.78 149 URI_OPTOUT_3LD 2424 0.69 0.20 0.77 150 DKIM_ADSP_NXDOMAIN 2401 0.85 1.40 0.76 151 XMSexyCombo_04 2397 0.82 1.16 0.76 152 TR_MetaPhish_Combo_01 2368 0.83 1.30 0.75 153 XMPhish08 2360 0.72 0.55 0.75 154 XMHTMLBadTable_001 2350 0.70 0.43 0.74 155 RCVD_IN_MSPIKE_L3 2268 1.38 5.34 0.72 156 NML_ADSP_CUSTOM_MED 2252 0.79 1.23 0.71 157 XMSubMetaSxObfu_02 2250 0.71 0.68 0.71 158 XM_S_SubURI 2208 0.61 0.07 0.70 159 T_XMDrugObfuBody_00 2205 0.74 0.99 0.70 160 XM_B_COPY_HTML 2188 0.72 0.89 0.69 161 NUMERIC_HTTP_ADDR 2175 0.72 0.89 0.69 162 XMSubMetaI_00 2175 0.72 0.87 0.69 163 XMGenDplmaNmb 2172 0.76 1.16 0.69 164 XM_B_REG_HTML 2145 0.63 0.32 0.68 165 TooManyTo_004 2117 0.62 0.32 0.67 166 MY_SERVERS_FOUND 2116 0.60 0.16 0.67 167 TR_LOTS_OF_MONEY3 2103 0.95 2.63 0.67 168 XMPhish30 2068 0.68 0.85 0.66 169 TR_BOTNET_NEGATE 2016 0.59 0.32 0.64 170 TR_XM_UnparsRelay 2005 1.01 3.23 0.64 171 T_Symld_Words_02 1993 0.69 1.03 0.63 172 T_TooManySym_05 1948 0.54 0.05 0.62 173 T_XMHurry_00 1943 0.67 0.97 0.62 174 RELAYCOUNTRY_GB 1930 0.70 1.25 0.61 175 DIET_1 1913 0.63 0.77 0.61 176 XM_DIRTYINTL 1882 1.18 4.67 0.60 177 HTML_IMAGE_ONLY_20 1876 0.55 0.26 0.59 178 TooManyTo_005 1800 0.53 0.26 0.57 179 SUBJ_DOLLARS 1780 0.54 0.41 0.56 180 USER_IN_WHITELIST 1765 0.48 0.00 0.56 181 HTML_TAG_BALANCE_BODY 1623 0.55 0.75 0.51 182 SpammyFromTLD_01 1597 1.80 9.60 0.51 183 THIS_AD 1513 0.48 0.47 0.48 184 RDNS_DYNAMIC 1491 0.82 2.94 0.47 185 FORGED_GMAIL_RCVD 1468 0.56 1.17 0.46 186 XMBody_78 1454 0.52 0.86 0.46 187 HELO_NODOT 1441 0.52 0.93 0.46 188 HELO_NO_DOMAIN 1440 0.52 0.93 0.46 189 HTTPS_HTTP_MISMATCH 1438 0.49 0.70 0.46 190 XM_H_PHPMailer 1381 0.59 1.53 0.44 191 BODY_QUOTE_MALF_MSGID 1375 0.45 0.55 0.44 192 XMSlimDrugH 1322 0.48 0.86 0.42 193 XMLngstWrd_02 1289 0.39 0.29 0.41 194 MPART_ALT_DIFF_COUNT 1271 0.60 1.76 0.40 195 XM_OfRef7 1245 0.51 1.21 0.39 196 TR_XM_PHPDW 1244 0.76 2.99 0.39 197 TR_XM_PHPForged 1222 0.74 2.90 0.39 198 DATE_IN_PAST_06_12 1220 0.69 2.54 0.39 199 BODY_ENHANCEMENT 1215 0.33 0.02 0.38 200 XM_ShortIntro_01 1214 0.51 1.30 0.38 ----------------------------------------------------------------------